@aws/nx-plugin 1.0.0-rc.38 → 1.0.0-rc.39

package/src/ts/agent/generator.js.map

@@ -1 +1 @@
-{"version":3,"sources":["../../../../../../packages/nx-plugin/src/ts/agent/generator.ts"],"sourcesContent":["/**\n * Copyright Amazon.com, Inc. or its affiliates. All Rights Reserved.\n * SPDX-License-Identifier: Apache-2.0\n */\nimport {\n  addDependenciesToPackageJson,\n  type GeneratorCallback,\n  generateFiles,\n  joinPathFragments,\n  OverwriteStrategy,\n  type Tree,\n  updateProjectConfiguration,\n} from '@nx/devkit';\nimport { addAgentChatScripts } from '../../utils/agent-chat/agent-chat';\nimport {\n  addTypeScriptFrameworkBase,\n  ensureTypeScriptAgentConnectionProject,\n} from '../../utils/agent-connection/agent-connection';\nimport { addAgentInfra } from '../../utils/agent-core-constructs/agent-core-constructs';\nimport { addTypeScriptBundleTarget } from '../../utils/bundle/bundle';\nimport { resolveContainers } from '../../utils/containers';\nimport { formatFilesInSubtree } from '../../utils/format';\nimport { FsCommands } from '../../utils/fs';\nimport { resolveIac } from '../../utils/iac';\nimport { installDependencies } from '../../utils/install';\nimport { addGeneratorMetricsIfApplicable } from '../../utils/metrics';\nimport { esmVars } from '../../utils/module-format';\nimport { kebabCase, toClassName } from '../../utils/names';\nimport { getNpmScope } from '../../utils/npm-scope';\nimport {\n  addComponentDevTarget,\n  addComponentGeneratorMetadata,\n  addDependencyToTargetIfNotPresent,\n  getGeneratorInfo,\n  type NxGeneratorInfo,\n  readProjectConfigurationUnqualified,\n} from '../../utils/nx';\nimport { sortObjectKeys } from '../../utils/object';\nimport { assignPort } from '../../utils/port';\nimport { sharedConstructsGenerator } from '../../utils/shared-constructs';\nimport { TS_VERSIONS, withVersions } from '../../utils/versions';\nimport type { TsAgentGeneratorSchema } from './schema';\n\nexport const TS_AGENT_GENERATOR_INFO: NxGeneratorInfo = getGeneratorInfo(\n  import.meta.filename,\n);\n\nexport const tsAgentGenerator = async (\n  tree: Tree,\n  options: TsAgentGeneratorSchema,\n): Promise<GeneratorCallback> => {\n  const project = readProjectConfigurationUnqualified(tree, options.project);\n\n  if (!tree.exists(joinPathFragments(project.root, 'tsconfig.json'))) {\n    throw new Error(\n      `Unsupported project ${options.project}. Expected a TypeScript project (with a tsconfig.json)`,\n    );\n  }\n\n  const defaultName = `${kebabCase(project.name.split('/').pop())}-agent`;\n  const name = kebabCase(options.name || defaultName);\n  const agentNameClassName = toClassName(name);\n  const agentTargetPrefix = options.name ? name : 'agent';\n  const targetSourceDirRelativeToProjectRoot = joinPathFragments(\n    'src',\n    agentTargetPrefix,\n  );\n  const targetSourceDir = joinPathFragments(\n    project.root,\n    targetSourceDirRelativeToProjectRoot,\n  );\n  const relativeSourceDir = targetSourceDir.replace(project.root + '/', './');\n  const distDir = joinPathFragments('dist', project.root);\n\n  const infra = options.infra ?? 'agentcore';\n  const protocol = options.protocol ?? 'http';\n\n  if (infra === 'none' && options.auth && options.auth !== 'iam') {\n    console.warn(\n      'Warning: auth is ignored when no infrastructure is configured (no infrastructure is generated)',\n    );\n  }\n\n  const auth = options.auth ?? 'iam';\n\n  // Ensure the shared agent-connection project exists so the server entry\n  // point can import `runWithSessionId` and propagate the AgentCore session\n  // ID to any downstream MCP / A2A clients a later connection generator\n  // wires into this agent.\n  await ensureTypeScriptAgentConnectionProject(tree);\n  // The agent server imports the framework base helpers (session cache + model\n  // error logging) regardless of whether a connection client is wired in.\n  await addTypeScriptFrameworkBase(tree);\n\n  const templateContext = {\n    name,\n    agentNameClassName,\n    distDir,\n    agentConnectionImport: `:${getNpmScope(tree)}/agent-connection`,\n    ...esmVars(tree),\n  };\n\n  // Generate common files shared by both protocols\n  generateFiles(\n    tree,\n    joinPathFragments(import.meta.dirname, 'files', 'common'),\n    targetSourceDir,\n    templateContext,\n    { overwriteStrategy: OverwriteStrategy.KeepExisting },\n  );\n\n  // Generate protocol-specific files\n  generateFiles(\n    tree,\n    joinPathFragments(import.meta.dirname, 'files', protocol.toLowerCase()),\n    targetSourceDir,\n    templateContext,\n    { overwriteStrategy: OverwriteStrategy.KeepExisting },\n  );\n\n  if (infra === 'agentcore') {\n    const containers = await resolveContainers(tree, 'inherit');\n    const dockerImageTag = `${getNpmScope(tree)}-${name}:latest`;\n\n    // Add bundle target\n    await addTypeScriptBundleTarget(tree, project, {\n      targetFilePath: `${targetSourceDirRelativeToProjectRoot}/index.ts`,\n      bundleOutputDir: joinPathFragments('agent', name),\n    });\n\n    // Add the Dockerfile\n    generateFiles(\n      tree,\n      joinPathFragments(import.meta.dirname, 'files', 'deploy'),\n      targetSourceDir,\n      {\n        distDir,\n        name,\n        protocol,\n        adotVersion:\n          TS_VERSIONS['@aws/aws-distro-opentelemetry-node-autoinstrumentation'],\n        ...esmVars(tree),\n      },\n      { overwriteStrategy: OverwriteStrategy.KeepExisting },\n    );\n\n    const dockerOutputDir = joinPathFragments(\n      'dist',\n      project.root,\n      'bundle',\n      'agent',\n      name,\n    );\n    const dockerTargetName = `${agentTargetPrefix}-docker`;\n\n    const fs = new FsCommands(tree);\n    project.targets[dockerTargetName] = {\n      cache: true,\n      outputs: [`{workspaceRoot}/${dockerOutputDir}/Dockerfile`],\n      executor: 'nx:run-commands',\n      options: {\n        commands: [\n          fs.cp(\n            `${targetSourceDir}/Dockerfile`,\n            `${dockerOutputDir}/Dockerfile`,\n          ),\n          `${containers} build --platform linux/arm64 -t ${dockerImageTag} ${dockerOutputDir}`,\n        ],\n        parallel: false,\n      },\n      dependsOn: ['bundle'],\n    };\n\n    addDependencyToTargetIfNotPresent(project, 'docker', dockerTargetName);\n    addDependencyToTargetIfNotPresent(project, 'build', 'docker');\n\n    // Add shared constructs\n    const iac = await resolveIac(tree, options.iac);\n    await sharedConstructsGenerator(tree, { iac });\n\n    // AG-UI uses HTTP as the AgentCore protocol type (AG-UI is HTTP-based with SSE over POST).\n    const infraProtocol: 'http' | 'a2a' =\n      protocol === 'ag-ui' ? 'http' : (protocol as 'http' | 'a2a');\n\n    await addAgentInfra(tree, {\n      agentNameKebabCase: name,\n      agentNameClassName,\n      projectName: project.name,\n      dockerImageTag,\n      dockerOutputDir,\n      iac,\n      auth,\n      serverProtocol: infraProtocol,\n      containers,\n    });\n  }\n\n  // Add dependencies\n  addDependenciesToPackageJson(\n    tree,\n    withVersions([\n      'zod',\n      '@strands-agents/sdk',\n      '@aws-sdk/credential-providers',\n      '@aws-sdk/client-appconfigdata',\n      '@aws-lambda-powertools/parameters',\n      '@modelcontextprotocol/sdk',\n      ...(protocol === 'a2a'\n        ? (['express', '@a2a-js/sdk'] as const)\n        : protocol === 'ag-ui'\n          ? ([\n              '@ag-ui/aws-strands',\n              '@ag-ui/core',\n              '@ag-ui/encoder',\n              'express',\n              'cors',\n            ] as const)\n          : ([\n              '@trpc/server',\n              '@trpc/client',\n              'ws',\n              'cors',\n              'aws4fetch',\n            ] as const)),\n    ]),\n    withVersions([\n      // The chat CLI runs standalone via tsx for every protocol, and resolves\n      // the deployed agent from AppConfig when `RUNTIME_CONFIG_APP_ID` is set.\n      'tsx',\n      '@types/node',\n      'agent-chat-cli',\n      '@aws-lambda-powertools/parameters',\n      '@aws-sdk/client-appconfigdata',\n      ...(auth === 'iam'\n        ? (['aws4fetch', '@aws-sdk/credential-providers'] as const)\n        : ([] as const)),\n      // A2A chat builds a signed @a2a-js client factory for the deployed agent.\n      ...(protocol === 'a2a' ? (['@a2a-js/sdk'] as const) : ([] as const)),\n      ...(protocol === 'a2a' || protocol === 'ag-ui'\n        ? (['@types/express', '@types/cors'] as const)\n        : (['@types/ws', '@types/cors'] as const)),\n    ]),\n  );\n\n  // A2A servers use port 9000 as per the Strands A2A SDK default and AgentCore A2A contract.\n  // HTTP and AG-UI agents use port 8081+ to avoid conflict with VS Code server on 8080.\n  const localDevPortStart = protocol === 'a2a' ? 9000 : 8081;\n  const localDevPort = assignPort(tree, project, localDevPortStart, {\n    component: { info: TS_AGENT_GENERATOR_INFO, name: agentTargetPrefix },\n  });\n\n  // Every protocol gets a standalone `chat.ts`. It connects to the local\n  // `dev` server by default, or to the deployed agent (with the\n  // appropriate auth) when `RUNTIME_CONFIG_APP_ID` is set.\n  const scriptsDir = joinPathFragments(\n    project.root,\n    'scripts',\n    agentTargetPrefix,\n  );\n  addAgentChatScripts(tree, {\n    scriptsDir,\n    protocol,\n    language: 'ts',\n    agentNameClassName,\n    auth,\n    relativeAgentImport: `../../${targetSourceDirRelativeToProjectRoot}`,\n  });\n\n  const chatUrl =\n    protocol === 'http'\n      ? `ws://localhost:${localDevPort}/ws`\n      : protocol === 'ag-ui'\n        ? `http://localhost:${localDevPort}/invocations`\n        : `http://localhost:${localDevPort}`;\n  const chatCommand = `tsx ./scripts/${agentTargetPrefix}/chat.ts`;\n\n  const agentTargets = {\n    ...project.targets,\n    [`${agentTargetPrefix}-serve`]: {\n      executor: 'nx:run-commands',\n      continuous: true,\n      options: {\n        commands: [`tsx --watch ${relativeSourceDir}/index.ts`],\n        cwd: '{projectRoot}',\n        env: {\n          PORT: `${localDevPort}`,\n        },\n      },\n    },\n    [`${agentTargetPrefix}-dev`]: {\n      executor: 'nx:run-commands',\n      continuous: true,\n      options: {\n        commands: [`tsx --watch ${relativeSourceDir}/index.ts`],\n        cwd: '{projectRoot}',\n        env: {\n          PORT: `${localDevPort}`,\n          LOCAL_DEV: 'true',\n        },\n      },\n    },\n    [`${agentTargetPrefix}-chat`]: {\n      executor: 'nx:run-commands',\n      options: {\n        commands: [chatCommand],\n        cwd: '{projectRoot}',\n        env: {\n          URL: chatUrl,\n        },\n      },\n    },\n  };\n\n  // Aggregate `<agent>-dev` under the project-level `dev` target.\n  addComponentDevTarget(agentTargets, `${agentTargetPrefix}-dev`);\n\n  updateProjectConfiguration(tree, project.name, {\n    ...project,\n    // Sort targets so their order is stable regardless of insertion order on\n    // first run vs re-run.\n    targets: sortObjectKeys(agentTargets),\n  });\n\n  addComponentGeneratorMetadata(\n    tree,\n    project.name,\n    TS_AGENT_GENERATOR_INFO,\n    targetSourceDirRelativeToProjectRoot,\n    agentTargetPrefix,\n    { port: localDevPort, rc: agentNameClassName, auth, protocol },\n  );\n\n  await addGeneratorMetricsIfApplicable(tree, [TS_AGENT_GENERATOR_INFO]);\n\n  await formatFilesInSubtree(tree);\n  return () =>\n    installDependencies(tree, options.preferInstallDependencies, {\n      languages: ['typescript'],\n    });\n};\n\nexport default tsAgentGenerator;\n"],"names":["addDependenciesToPackageJson","generateFiles","joinPathFragments","OverwriteStrategy","updateProjectConfiguration","addAgentChatScripts","addTypeScriptFrameworkBase","ensureTypeScriptAgentConnectionProject","addAgentInfra","addTypeScriptBundleTarget","resolveContainers","formatFilesInSubtree","FsCommands","resolveIac","installDependencies","addGeneratorMetricsIfApplicable","esmVars","kebabCase","toClassName","getNpmScope","addComponentDevTarget","addComponentGeneratorMetadata","addDependencyToTargetIfNotPresent","getGeneratorInfo","readProjectConfigurationUnqualified","sortObjectKeys","assignPort","sharedConstructsGenerator","TS_VERSIONS","withVersions","TS_AGENT_GENERATOR_INFO","filename","tsAgentGenerator","tree","options","project","exists","root","Error","defaultName","name","split","pop","agentNameClassName","agentTargetPrefix","targetSourceDirRelativeToProjectRoot","targetSourceDir","relativeSourceDir","replace","distDir","infra","protocol","auth","console","warn","templateContext","agentConnectionImport","dirname","overwriteStrategy","KeepExisting","toLowerCase","containers","dockerImageTag","targetFilePath","bundleOutputDir","adotVersion","dockerOutputDir","dockerTargetName","fs","targets","cache","outputs","executor","commands","cp","parallel","dependsOn","iac","infraProtocol","agentNameKebabCase","projectName","serverProtocol","localDevPortStart","localDevPort","component","info","scriptsDir","language","relativeAgentImport","chatUrl","chatCommand","agentTargets","continuous","cwd","env","PORT","LOCAL_DEV","URL","port","rc","preferInstallDependencies","languages"],"mappings":"AAAA;;;CAGC,GACD,SACEA,4BAA4B,EAE5BC,aAAa,EACbC,iBAAiB,EACjBC,iBAAiB,EAEjBC,0BAA0B,QACrB,aAAa;AACpB,SAASC,mBAAmB,QAAQ,uCAAoC;AACxE,SACEC,0BAA0B,EAC1BC,sCAAsC,QACjC,mDAAgD;AACvD,SAASC,aAAa,QAAQ,6DAA0D;AACxF,SAASC,yBAAyB,QAAQ,+BAA4B;AACtE,SAASC,iBAAiB,QAAQ,4BAAyB;AAC3D,SAASC,oBAAoB,QAAQ,wBAAqB;AAC1D,SAASC,UAAU,QAAQ,oBAAiB;AAC5C,SAASC,UAAU,QAAQ,qBAAkB;AAC7C,SAASC,mBAAmB,QAAQ,yBAAsB;AAC1D,SAASC,+BAA+B,QAAQ,yBAAsB;AACtE,SAASC,OAAO,QAAQ,+BAA4B;AACpD,SAASC,SAAS,EAAEC,WAAW,QAAQ,uBAAoB;AAC3D,SAASC,WAAW,QAAQ,2BAAwB;AACpD,SACEC,qBAAqB,EACrBC,6BAA6B,EAC7BC,iCAAiC,EACjCC,gBAAgB,EAEhBC,mCAAmC,QAC9B,oBAAiB;AACxB,SAASC,cAAc,QAAQ,wBAAqB;AACpD,SAASC,UAAU,QAAQ,sBAAmB;AAC9C,SAASC,yBAAyB,QAAQ,mCAAgC;AAC1E,SAASC,WAAW,EAAEC,YAAY,QAAQ,0BAAuB;AAGjE,OAAO,MAAMC,0BAA2CP,iBACtD,YAAYQ,QAAQ,EACpB;AAEF,OAAO,MAAMC,mBAAmB,OAC9BC,MACAC;IAEA,MAAMC,UAAUX,oCAAoCS,MAAMC,QAAQC,OAAO;IAEzE,IAAI,CAACF,KAAKG,MAAM,CAAClC,kBAAkBiC,QAAQE,IAAI,EAAE,mBAAmB;QAClE,MAAM,IAAIC,MACR,CAAC,oBAAoB,EAAEJ,QAAQC,OAAO,CAAC,sDAAsD,CAAC;IAElG;IAEA,MAAMI,cAAc,GAAGtB,UAAUkB,QAAQK,IAAI,CAACC,KAAK,CAAC,KAAKC,GAAG,IAAI,MAAM,CAAC;IACvE,MAAMF,OAAOvB,UAAUiB,QAAQM,IAAI,IAAID;IACvC,MAAMI,qBAAqBzB,YAAYsB;IACvC,MAAMI,oBAAoBV,QAAQM,IAAI,GAAGA,OAAO;IAChD,MAAMK,uCAAuC3C,kBAC3C,OACA0C;IAEF,MAAME,kBAAkB5C,kBACtBiC,QAAQE,IAAI,EACZQ;IAEF,MAAME,oBAAoBD,gBAAgBE,OAAO,CAACb,QAAQE,IAAI,GAAG,KAAK;IACtE,MAAMY,UAAU/C,kBAAkB,QAAQiC,QAAQE,IAAI;IAEtD,MAAMa,QAAQhB,QAAQgB,KAAK,IAAI;IAC/B,MAAMC,WAAWjB,QAAQiB,QAAQ,IAAI;IAErC,IAAID,UAAU,UAAUhB,QAAQkB,IAAI,IAAIlB,QAAQkB,IAAI,KAAK,OAAO;QAC9DC,QAAQC,IAAI,CACV;IAEJ;IAEA,MAAMF,OAAOlB,QAAQkB,IAAI,IAAI;IAE7B,wEAAwE;IACxE,0EAA0E;IAC1E,sEAAsE;IACtE,yBAAyB;IACzB,MAAM7C,uCAAuC0B;IAC7C,6EAA6E;IAC7E,wEAAwE;IACxE,MAAM3B,2BAA2B2B;IAEjC,MAAMsB,kBAAkB;QACtBf;QACAG;QACAM;QACAO,uBAAuB,CAAC,CAAC,EAAErC,YAAYc,MAAM,iBAAiB,CAAC;QAC/D,GAAGjB,QAAQiB,KAAK;IAClB;IAEA,iDAAiD;IACjDhC,cACEgC,MACA/B,kBAAkB,YAAYuD,OAAO,EAAE,SAAS,WAChDX,iBACAS,iBACA;QAAEG,mBAAmBvD,kBAAkBwD,YAAY;IAAC;IAGtD,mCAAmC;IACnC1D,cACEgC,MACA/B,kBAAkB,YAAYuD,OAAO,EAAE,SAASN,SAASS,WAAW,KACpEd,iBACAS,iBACA;QAAEG,mBAAmBvD,kBAAkBwD,YAAY;IAAC;IAGtD,IAAIT,UAAU,aAAa;QACzB,MAAMW,aAAa,MAAMnD,kBAAkBuB,MAAM;QACjD,MAAM6B,iBAAiB,GAAG3C,YAAYc,MAAM,CAAC,EAAEO,KAAK,OAAO,CAAC;QAE5D,oBAAoB;QACpB,MAAM/B,0BAA0BwB,MAAME,SAAS;YAC7C4B,gBAAgB,GAAGlB,qCAAqC,SAAS,CAAC;YAClEmB,iBAAiB9D,kBAAkB,SAASsC;QAC9C;QAEA,qBAAqB;QACrBvC,cACEgC,MACA/B,kBAAkB,YAAYuD,OAAO,EAAE,SAAS,WAChDX,iBACA;YACEG;YACAT;YACAW;YACAc,aACErC,WAAW,CAAC,yDAAyD;YACvE,GAAGZ,QAAQiB,KAAK;QAClB,GACA;YAAEyB,mBAAmBvD,kBAAkBwD,YAAY;QAAC;QAGtD,MAAMO,kBAAkBhE,kBACtB,QACAiC,QAAQE,IAAI,EACZ,UACA,SACAG;QAEF,MAAM2B,mBAAmB,GAAGvB,kBAAkB,OAAO,CAAC;QAEtD,MAAMwB,KAAK,IAAIxD,WAAWqB;QAC1BE,QAAQkC,OAAO,CAACF,iBAAiB,GAAG;YAClCG,OAAO;YACPC,SAAS;gBAAC,CAAC,gBAAgB,EAAEL,gBAAgB,WAAW,CAAC;aAAC;YAC1DM,UAAU;YACVtC,SAAS;gBACPuC,UAAU;oBACRL,GAAGM,EAAE,CACH,GAAG5B,gBAAgB,WAAW,CAAC,EAC/B,GAAGoB,gBAAgB,WAAW,CAAC;oBAEjC,GAAGL,WAAW,iCAAiC,EAAEC,eAAe,CAAC,EAAEI,iBAAiB;iBACrF;gBACDS,UAAU;YACZ;YACAC,WAAW;gBAAC;aAAS;QACvB;QAEAtD,kCAAkCa,SAAS,UAAUgC;QACrD7C,kCAAkCa,SAAS,SAAS;QAEpD,wBAAwB;QACxB,MAAM0C,MAAM,MAAMhE,WAAWoB,MAAMC,QAAQ2C,GAAG;QAC9C,MAAMlD,0BAA0BM,MAAM;YAAE4C;QAAI;QAE5C,2FAA2F;QAC3F,MAAMC,gBACJ3B,aAAa,UAAU,SAAUA;QAEnC,MAAM3C,cAAcyB,MAAM;YACxB8C,oBAAoBvC;YACpBG;YACAqC,aAAa7C,QAAQK,IAAI;YACzBsB;YACAI;YACAW;YACAzB;YACA6B,gBAAgBH;YAChBjB;QACF;IACF;IAEA,mBAAmB;IACnB7D,6BACEiC,MACAJ,aAAa;QACX;QACA;QACA;QACA;QACA;QACA;WACIsB,aAAa,QACZ;YAAC;YAAW;SAAc,GAC3BA,aAAa,UACV;YACC;YACA;YACA;YACA;YACA;SACD,GACA;YACC;YACA;YACA;YACA;YACA;SACD;KACR,GACDtB,aAAa;QACX,wEAAwE;QACxE,yEAAyE;QACzE;QACA;QACA;QACA;QACA;WACIuB,SAAS,QACR;YAAC;YAAa;SAAgC,GAC9C,EAAE;QACP,0EAA0E;WACtED,aAAa,QAAS;YAAC;SAAc,GAAc,EAAE;WACrDA,aAAa,SAASA,aAAa,UAClC;YAAC;YAAkB;SAAc,GACjC;YAAC;YAAa;SAAc;KAClC;IAGH,2FAA2F;IAC3F,sFAAsF;IACtF,MAAM+B,oBAAoB/B,aAAa,QAAQ,OAAO;IACtD,MAAMgC,eAAezD,WAAWO,MAAME,SAAS+C,mBAAmB;QAChEE,WAAW;YAAEC,MAAMvD;YAAyBU,MAAMI;QAAkB;IACtE;IAEA,uEAAuE;IACvE,8DAA8D;IAC9D,yDAAyD;IACzD,MAAM0C,aAAapF,kBACjBiC,QAAQE,IAAI,EACZ,WACAO;IAEFvC,oBAAoB4B,MAAM;QACxBqD;QACAnC;QACAoC,UAAU;QACV5C;QACAS;QACAoC,qBAAqB,CAAC,MAAM,EAAE3C,sCAAsC;IACtE;IAEA,MAAM4C,UACJtC,aAAa,SACT,CAAC,eAAe,EAAEgC,aAAa,GAAG,CAAC,GACnChC,aAAa,UACX,CAAC,iBAAiB,EAAEgC,aAAa,YAAY,CAAC,GAC9C,CAAC,iBAAiB,EAAEA,cAAc;IAC1C,MAAMO,cAAc,CAAC,cAAc,EAAE9C,kBAAkB,QAAQ,CAAC;IAEhE,MAAM+C,eAAe;QACnB,GAAGxD,QAAQkC,OAAO;QAClB,CAAC,GAAGzB,kBAAkB,MAAM,CAAC,CAAC,EAAE;YAC9B4B,UAAU;YACVoB,YAAY;YACZ1D,SAAS;gBACPuC,UAAU;oBAAC,CAAC,YAAY,EAAE1B,kBAAkB,SAAS,CAAC;iBAAC;gBACvD8C,KAAK;gBACLC,KAAK;oBACHC,MAAM,GAAGZ,cAAc;gBACzB;YACF;QACF;QACA,CAAC,GAAGvC,kBAAkB,IAAI,CAAC,CAAC,EAAE;YAC5B4B,UAAU;YACVoB,YAAY;YACZ1D,SAAS;gBACPuC,UAAU;oBAAC,CAAC,YAAY,EAAE1B,kBAAkB,SAAS,CAAC;iBAAC;gBACvD8C,KAAK;gBACLC,KAAK;oBACHC,MAAM,GAAGZ,cAAc;oBACvBa,WAAW;gBACb;YACF;QACF;QACA,CAAC,GAAGpD,kBAAkB,KAAK,CAAC,CAAC,EAAE;YAC7B4B,UAAU;YACVtC,SAAS;gBACPuC,UAAU;oBAACiB;iBAAY;gBACvBG,KAAK;gBACLC,KAAK;oBACHG,KAAKR;gBACP;YACF;QACF;IACF;IAEA,gEAAgE;IAChErE,sBAAsBuE,cAAc,GAAG/C,kBAAkB,IAAI,CAAC;IAE9DxC,2BAA2B6B,MAAME,QAAQK,IAAI,EAAE;QAC7C,GAAGL,OAAO;QACV,yEAAyE;QACzE,uBAAuB;QACvBkC,SAAS5C,eAAekE;IAC1B;IAEAtE,8BACEY,MACAE,QAAQK,IAAI,EACZV,yBACAe,sCACAD,mBACA;QAAEsD,MAAMf;QAAcgB,IAAIxD;QAAoBS;QAAMD;IAAS;IAG/D,MAAMpC,gCAAgCkB,MAAM;QAACH;KAAwB;IAErE,MAAMnB,qBAAqBsB;IAC3B,OAAO,IACLnB,oBAAoBmB,MAAMC,QAAQkE,yBAAyB,EAAE;YAC3DC,WAAW;gBAAC;aAAa;QAC3B;AACJ,EAAE;AAEF,eAAerE,iBAAiB"}
+{"version":3,"sources":["../../../../../../packages/nx-plugin/src/ts/agent/generator.ts"],"sourcesContent":["/**\n * Copyright Amazon.com, Inc. or its affiliates. All Rights Reserved.\n * SPDX-License-Identifier: Apache-2.0\n */\nimport {\n  addDependenciesToPackageJson,\n  type GeneratorCallback,\n  generateFiles,\n  joinPathFragments,\n  OverwriteStrategy,\n  type Tree,\n  updateProjectConfiguration,\n} from '@nx/devkit';\nimport { addAgentChatScripts } from '../../utils/agent-chat/agent-chat';\nimport {\n  addTypeScriptFrameworkBase,\n  ensureTypeScriptAgentConnectionProject,\n} from '../../utils/agent-connection/agent-connection';\nimport { addAgentInfra } from '../../utils/agent-core-constructs/agent-core-constructs';\nimport { addTypeScriptBundleTarget } from '../../utils/bundle/bundle';\nimport { resolveContainers } from '../../utils/containers';\nimport { addDockerScanTarget } from '../../utils/docker';\nimport { formatFilesInSubtree } from '../../utils/format';\nimport { FsCommands } from '../../utils/fs';\nimport { resolveIac } from '../../utils/iac';\nimport { installDependencies } from '../../utils/install';\nimport { addGeneratorMetricsIfApplicable } from '../../utils/metrics';\nimport { esmVars } from '../../utils/module-format';\nimport { kebabCase, toClassName } from '../../utils/names';\nimport { getNpmScope } from '../../utils/npm-scope';\nimport {\n  addComponentDevTarget,\n  addComponentGeneratorMetadata,\n  addDependencyToTargetIfNotPresent,\n  getGeneratorInfo,\n  type NxGeneratorInfo,\n  readProjectConfigurationUnqualified,\n} from '../../utils/nx';\nimport { sortObjectKeys } from '../../utils/object';\nimport { assignPort } from '../../utils/port';\nimport { sharedConstructsGenerator } from '../../utils/shared-constructs';\nimport { BASE_IMAGES, TS_VERSIONS, withVersions } from '../../utils/versions';\nimport type { TsAgentGeneratorSchema } from './schema';\n\nexport const TS_AGENT_GENERATOR_INFO: NxGeneratorInfo = getGeneratorInfo(\n  import.meta.filename,\n);\n\nexport const tsAgentGenerator = async (\n  tree: Tree,\n  options: TsAgentGeneratorSchema,\n): Promise<GeneratorCallback> => {\n  const project = readProjectConfigurationUnqualified(tree, options.project);\n\n  if (!tree.exists(joinPathFragments(project.root, 'tsconfig.json'))) {\n    throw new Error(\n      `Unsupported project ${options.project}. Expected a TypeScript project (with a tsconfig.json)`,\n    );\n  }\n\n  const defaultName = `${kebabCase(project.name.split('/').pop())}-agent`;\n  const name = kebabCase(options.name || defaultName);\n  const agentNameClassName = toClassName(name);\n  const agentTargetPrefix = options.name ? name : 'agent';\n  const targetSourceDirRelativeToProjectRoot = joinPathFragments(\n    'src',\n    agentTargetPrefix,\n  );\n  const targetSourceDir = joinPathFragments(\n    project.root,\n    targetSourceDirRelativeToProjectRoot,\n  );\n  const relativeSourceDir = targetSourceDir.replace(project.root + '/', './');\n  const distDir = joinPathFragments('dist', project.root);\n\n  const infra = options.infra ?? 'agentcore';\n  const protocol = options.protocol ?? 'http';\n\n  if (infra === 'none' && options.auth && options.auth !== 'iam') {\n    console.warn(\n      'Warning: auth is ignored when no infrastructure is configured (no infrastructure is generated)',\n    );\n  }\n\n  const auth = options.auth ?? 'iam';\n\n  // Ensure the shared agent-connection project exists so the server entry\n  // point can import `runWithSessionId` and propagate the AgentCore session\n  // ID to any downstream MCP / A2A clients a later connection generator\n  // wires into this agent.\n  await ensureTypeScriptAgentConnectionProject(tree);\n  // The agent server imports the framework base helpers (session cache + model\n  // error logging) regardless of whether a connection client is wired in.\n  await addTypeScriptFrameworkBase(tree);\n\n  const templateContext = {\n    name,\n    agentNameClassName,\n    distDir,\n    agentConnectionImport: `:${getNpmScope(tree)}/agent-connection`,\n    ...esmVars(tree),\n  };\n\n  // Generate common files shared by both protocols\n  generateFiles(\n    tree,\n    joinPathFragments(import.meta.dirname, 'files', 'common'),\n    targetSourceDir,\n    templateContext,\n    { overwriteStrategy: OverwriteStrategy.KeepExisting },\n  );\n\n  // Generate protocol-specific files\n  generateFiles(\n    tree,\n    joinPathFragments(import.meta.dirname, 'files', protocol.toLowerCase()),\n    targetSourceDir,\n    templateContext,\n    { overwriteStrategy: OverwriteStrategy.KeepExisting },\n  );\n\n  if (infra === 'agentcore') {\n    const containers = await resolveContainers(tree, 'inherit');\n    const dockerImageTag = `${getNpmScope(tree)}-${name}:latest`;\n\n    // Add bundle target\n    await addTypeScriptBundleTarget(tree, project, {\n      targetFilePath: `${targetSourceDirRelativeToProjectRoot}/index.ts`,\n      bundleOutputDir: joinPathFragments('agent', name),\n    });\n\n    // Add the Dockerfile\n    generateFiles(\n      tree,\n      joinPathFragments(import.meta.dirname, 'files', 'deploy'),\n      targetSourceDir,\n      {\n        distDir,\n        name,\n        protocol,\n        adotVersion:\n          TS_VERSIONS['@aws/aws-distro-opentelemetry-node-autoinstrumentation'],\n        nodeBaseImage: BASE_IMAGES.node,\n        npmVersion: TS_VERSIONS.npm,\n        ...esmVars(tree),\n      },\n      { overwriteStrategy: OverwriteStrategy.KeepExisting },\n    );\n\n    const dockerOutputDir = joinPathFragments(\n      'dist',\n      project.root,\n      'bundle',\n      'agent',\n      name,\n    );\n    const dockerTargetName = `${agentTargetPrefix}-docker`;\n\n    const fs = new FsCommands(tree);\n    project.targets[dockerTargetName] = {\n      cache: true,\n      outputs: [`{workspaceRoot}/${dockerOutputDir}/Dockerfile`],\n      executor: 'nx:run-commands',\n      options: {\n        commands: [\n          fs.cp(\n            `${targetSourceDir}/Dockerfile`,\n            `${dockerOutputDir}/Dockerfile`,\n          ),\n          `${containers} build --platform linux/arm64 -t ${dockerImageTag} ${dockerOutputDir}`,\n        ],\n        parallel: false,\n      },\n      dependsOn: ['bundle'],\n    };\n\n    addDependencyToTargetIfNotPresent(project, 'docker', dockerTargetName);\n    addDependencyToTargetIfNotPresent(project, 'build', 'docker');\n\n    addDockerScanTarget(tree, {\n      project,\n      containerEngine: containers,\n      trivyTargetName: `${agentTargetPrefix}-trivy`,\n      dockerTargetName,\n      imageTags: [dockerImageTag],\n    });\n\n    // Add shared constructs\n    const iac = await resolveIac(tree, options.iac);\n    await sharedConstructsGenerator(tree, { iac });\n\n    // AG-UI uses HTTP as the AgentCore protocol type (AG-UI is HTTP-based with SSE over POST).\n    const infraProtocol: 'http' | 'a2a' =\n      protocol === 'ag-ui' ? 'http' : (protocol as 'http' | 'a2a');\n\n    await addAgentInfra(tree, {\n      agentNameKebabCase: name,\n      agentNameClassName,\n      projectName: project.name,\n      dockerImageTag,\n      dockerOutputDir,\n      iac,\n      auth,\n      serverProtocol: infraProtocol,\n      containers,\n    });\n  }\n\n  // Add dependencies\n  addDependenciesToPackageJson(\n    tree,\n    withVersions([\n      'zod',\n      '@strands-agents/sdk',\n      '@aws-sdk/credential-providers',\n      '@aws-sdk/client-appconfigdata',\n      '@aws-lambda-powertools/parameters',\n      '@modelcontextprotocol/sdk',\n      ...(protocol === 'a2a'\n        ? (['express', '@a2a-js/sdk'] as const)\n        : protocol === 'ag-ui'\n          ? ([\n              '@ag-ui/aws-strands',\n              '@ag-ui/core',\n              '@ag-ui/encoder',\n              'express',\n              'cors',\n            ] as const)\n          : ([\n              '@trpc/server',\n              '@trpc/client',\n              'ws',\n              'cors',\n              'aws4fetch',\n            ] as const)),\n    ]),\n    withVersions([\n      // The chat CLI runs standalone via tsx for every protocol, and resolves\n      // the deployed agent from AppConfig when `RUNTIME_CONFIG_APP_ID` is set.\n      'tsx',\n      '@types/node',\n      'agent-chat-cli',\n      '@aws-lambda-powertools/parameters',\n      '@aws-sdk/client-appconfigdata',\n      ...(auth === 'iam'\n        ? (['aws4fetch', '@aws-sdk/credential-providers'] as const)\n        : ([] as const)),\n      // A2A chat builds a signed @a2a-js client factory for the deployed agent.\n      ...(protocol === 'a2a' ? (['@a2a-js/sdk'] as const) : ([] as const)),\n      ...(protocol === 'a2a' || protocol === 'ag-ui'\n        ? (['@types/express', '@types/cors'] as const)\n        : (['@types/ws', '@types/cors'] as const)),\n    ]),\n  );\n\n  // A2A servers use port 9000 as per the Strands A2A SDK default and AgentCore A2A contract.\n  // HTTP and AG-UI agents use port 8081+ to avoid conflict with VS Code server on 8080.\n  const localDevPortStart = protocol === 'a2a' ? 9000 : 8081;\n  const localDevPort = assignPort(tree, project, localDevPortStart, {\n    component: { info: TS_AGENT_GENERATOR_INFO, name: agentTargetPrefix },\n  });\n\n  // Every protocol gets a standalone `chat.ts`. It connects to the local\n  // `dev` server by default, or to the deployed agent (with the\n  // appropriate auth) when `RUNTIME_CONFIG_APP_ID` is set.\n  const scriptsDir = joinPathFragments(\n    project.root,\n    'scripts',\n    agentTargetPrefix,\n  );\n  addAgentChatScripts(tree, {\n    scriptsDir,\n    protocol,\n    language: 'ts',\n    agentNameClassName,\n    auth,\n    relativeAgentImport: `../../${targetSourceDirRelativeToProjectRoot}`,\n  });\n\n  const chatUrl =\n    protocol === 'http'\n      ? `ws://localhost:${localDevPort}/ws`\n      : protocol === 'ag-ui'\n        ? `http://localhost:${localDevPort}/invocations`\n        : `http://localhost:${localDevPort}`;\n  const chatCommand = `tsx ./scripts/${agentTargetPrefix}/chat.ts`;\n\n  const agentTargets = {\n    ...project.targets,\n    [`${agentTargetPrefix}-serve`]: {\n      executor: 'nx:run-commands',\n      continuous: true,\n      options: {\n        commands: [`tsx --watch ${relativeSourceDir}/index.ts`],\n        cwd: '{projectRoot}',\n        env: {\n          PORT: `${localDevPort}`,\n        },\n      },\n    },\n    [`${agentTargetPrefix}-dev`]: {\n      executor: 'nx:run-commands',\n      continuous: true,\n      options: {\n        commands: [`tsx --watch ${relativeSourceDir}/index.ts`],\n        cwd: '{projectRoot}',\n        env: {\n          PORT: `${localDevPort}`,\n          LOCAL_DEV: 'true',\n        },\n      },\n    },\n    [`${agentTargetPrefix}-chat`]: {\n      executor: 'nx:run-commands',\n      options: {\n        commands: [chatCommand],\n        cwd: '{projectRoot}',\n        env: {\n          URL: chatUrl,\n        },\n      },\n    },\n  };\n\n  // Aggregate `<agent>-dev` under the project-level `dev` target.\n  addComponentDevTarget(agentTargets, `${agentTargetPrefix}-dev`);\n\n  updateProjectConfiguration(tree, project.name, {\n    ...project,\n    // Sort targets so their order is stable regardless of insertion order on\n    // first run vs re-run.\n    targets: sortObjectKeys(agentTargets),\n  });\n\n  addComponentGeneratorMetadata(\n    tree,\n    project.name,\n    TS_AGENT_GENERATOR_INFO,\n    targetSourceDirRelativeToProjectRoot,\n    agentTargetPrefix,\n    { port: localDevPort, rc: agentNameClassName, auth, protocol },\n  );\n\n  await addGeneratorMetricsIfApplicable(tree, [TS_AGENT_GENERATOR_INFO]);\n\n  await formatFilesInSubtree(tree);\n  return () =>\n    installDependencies(tree, options.preferInstallDependencies, {\n      languages: ['typescript'],\n    });\n};\n\nexport default tsAgentGenerator;\n"],"names":["addDependenciesToPackageJson","generateFiles","joinPathFragments","OverwriteStrategy","updateProjectConfiguration","addAgentChatScripts","addTypeScriptFrameworkBase","ensureTypeScriptAgentConnectionProject","addAgentInfra","addTypeScriptBundleTarget","resolveContainers","addDockerScanTarget","formatFilesInSubtree","FsCommands","resolveIac","installDependencies","addGeneratorMetricsIfApplicable","esmVars","kebabCase","toClassName","getNpmScope","addComponentDevTarget","addComponentGeneratorMetadata","addDependencyToTargetIfNotPresent","getGeneratorInfo","readProjectConfigurationUnqualified","sortObjectKeys","assignPort","sharedConstructsGenerator","BASE_IMAGES","TS_VERSIONS","withVersions","TS_AGENT_GENERATOR_INFO","filename","tsAgentGenerator","tree","options","project","exists","root","Error","defaultName","name","split","pop","agentNameClassName","agentTargetPrefix","targetSourceDirRelativeToProjectRoot","targetSourceDir","relativeSourceDir","replace","distDir","infra","protocol","auth","console","warn","templateContext","agentConnectionImport","dirname","overwriteStrategy","KeepExisting","toLowerCase","containers","dockerImageTag","targetFilePath","bundleOutputDir","adotVersion","nodeBaseImage","node","npmVersion","npm","dockerOutputDir","dockerTargetName","fs","targets","cache","outputs","executor","commands","cp","parallel","dependsOn","containerEngine","trivyTargetName","imageTags","iac","infraProtocol","agentNameKebabCase","projectName","serverProtocol","localDevPortStart","localDevPort","component","info","scriptsDir","language","relativeAgentImport","chatUrl","chatCommand","agentTargets","continuous","cwd","env","PORT","LOCAL_DEV","URL","port","rc","preferInstallDependencies","languages"],"mappings":"AAAA;;;CAGC,GACD,SACEA,4BAA4B,EAE5BC,aAAa,EACbC,iBAAiB,EACjBC,iBAAiB,EAEjBC,0BAA0B,QACrB,aAAa;AACpB,SAASC,mBAAmB,QAAQ,uCAAoC;AACxE,SACEC,0BAA0B,EAC1BC,sCAAsC,QACjC,mDAAgD;AACvD,SAASC,aAAa,QAAQ,6DAA0D;AACxF,SAASC,yBAAyB,QAAQ,+BAA4B;AACtE,SAASC,iBAAiB,QAAQ,4BAAyB;AAC3D,SAASC,mBAAmB,QAAQ,wBAAqB;AACzD,SAASC,oBAAoB,QAAQ,wBAAqB;AAC1D,SAASC,UAAU,QAAQ,oBAAiB;AAC5C,SAASC,UAAU,QAAQ,qBAAkB;AAC7C,SAASC,mBAAmB,QAAQ,yBAAsB;AAC1D,SAASC,+BAA+B,QAAQ,yBAAsB;AACtE,SAASC,OAAO,QAAQ,+BAA4B;AACpD,SAASC,SAAS,EAAEC,WAAW,QAAQ,uBAAoB;AAC3D,SAASC,WAAW,QAAQ,2BAAwB;AACpD,SACEC,qBAAqB,EACrBC,6BAA6B,EAC7BC,iCAAiC,EACjCC,gBAAgB,EAEhBC,mCAAmC,QAC9B,oBAAiB;AACxB,SAASC,cAAc,QAAQ,wBAAqB;AACpD,SAASC,UAAU,QAAQ,sBAAmB;AAC9C,SAASC,yBAAyB,QAAQ,mCAAgC;AAC1E,SAASC,WAAW,EAAEC,WAAW,EAAEC,YAAY,QAAQ,0BAAuB;AAG9E,OAAO,MAAMC,0BAA2CR,iBACtD,YAAYS,QAAQ,EACpB;AAEF,OAAO,MAAMC,mBAAmB,OAC9BC,MACAC;IAEA,MAAMC,UAAUZ,oCAAoCU,MAAMC,QAAQC,OAAO;IAEzE,IAAI,CAACF,KAAKG,MAAM,CAACpC,kBAAkBmC,QAAQE,IAAI,EAAE,mBAAmB;QAClE,MAAM,IAAIC,MACR,CAAC,oBAAoB,EAAEJ,QAAQC,OAAO,CAAC,sDAAsD,CAAC;IAElG;IAEA,MAAMI,cAAc,GAAGvB,UAAUmB,QAAQK,IAAI,CAACC,KAAK,CAAC,KAAKC,GAAG,IAAI,MAAM,CAAC;IACvE,MAAMF,OAAOxB,UAAUkB,QAAQM,IAAI,IAAID;IACvC,MAAMI,qBAAqB1B,YAAYuB;IACvC,MAAMI,oBAAoBV,QAAQM,IAAI,GAAGA,OAAO;IAChD,MAAMK,uCAAuC7C,kBAC3C,OACA4C;IAEF,MAAME,kBAAkB9C,kBACtBmC,QAAQE,IAAI,EACZQ;IAEF,MAAME,oBAAoBD,gBAAgBE,OAAO,CAACb,QAAQE,IAAI,GAAG,KAAK;IACtE,MAAMY,UAAUjD,kBAAkB,QAAQmC,QAAQE,IAAI;IAEtD,MAAMa,QAAQhB,QAAQgB,KAAK,IAAI;IAC/B,MAAMC,WAAWjB,QAAQiB,QAAQ,IAAI;IAErC,IAAID,UAAU,UAAUhB,QAAQkB,IAAI,IAAIlB,QAAQkB,IAAI,KAAK,OAAO;QAC9DC,QAAQC,IAAI,CACV;IAEJ;IAEA,MAAMF,OAAOlB,QAAQkB,IAAI,IAAI;IAE7B,wEAAwE;IACxE,0EAA0E;IAC1E,sEAAsE;IACtE,yBAAyB;IACzB,MAAM/C,uCAAuC4B;IAC7C,6EAA6E;IAC7E,wEAAwE;IACxE,MAAM7B,2BAA2B6B;IAEjC,MAAMsB,kBAAkB;QACtBf;QACAG;QACAM;QACAO,uBAAuB,CAAC,CAAC,EAAEtC,YAAYe,MAAM,iBAAiB,CAAC;QAC/D,GAAGlB,QAAQkB,KAAK;IAClB;IAEA,iDAAiD;IACjDlC,cACEkC,MACAjC,kBAAkB,YAAYyD,OAAO,EAAE,SAAS,WAChDX,iBACAS,iBACA;QAAEG,mBAAmBzD,kBAAkB0D,YAAY;IAAC;IAGtD,mCAAmC;IACnC5D,cACEkC,MACAjC,kBAAkB,YAAYyD,OAAO,EAAE,SAASN,SAASS,WAAW,KACpEd,iBACAS,iBACA;QAAEG,mBAAmBzD,kBAAkB0D,YAAY;IAAC;IAGtD,IAAIT,UAAU,aAAa;QACzB,MAAMW,aAAa,MAAMrD,kBAAkByB,MAAM;QACjD,MAAM6B,iBAAiB,GAAG5C,YAAYe,MAAM,CAAC,EAAEO,KAAK,OAAO,CAAC;QAE5D,oBAAoB;QACpB,MAAMjC,0BAA0B0B,MAAME,SAAS;YAC7C4B,gBAAgB,GAAGlB,qCAAqC,SAAS,CAAC;YAClEmB,iBAAiBhE,kBAAkB,SAASwC;QAC9C;QAEA,qBAAqB;QACrBzC,cACEkC,MACAjC,kBAAkB,YAAYyD,OAAO,EAAE,SAAS,WAChDX,iBACA;YACEG;YACAT;YACAW;YACAc,aACErC,WAAW,CAAC,yDAAyD;YACvEsC,eAAevC,YAAYwC,IAAI;YAC/BC,YAAYxC,YAAYyC,GAAG;YAC3B,GAAGtD,QAAQkB,KAAK;QAClB,GACA;YAAEyB,mBAAmBzD,kBAAkB0D,YAAY;QAAC;QAGtD,MAAMW,kBAAkBtE,kBACtB,QACAmC,QAAQE,IAAI,EACZ,UACA,SACAG;QAEF,MAAM+B,mBAAmB,GAAG3B,kBAAkB,OAAO,CAAC;QAEtD,MAAM4B,KAAK,IAAI7D,WAAWsB;QAC1BE,QAAQsC,OAAO,CAACF,iBAAiB,GAAG;YAClCG,OAAO;YACPC,SAAS;gBAAC,CAAC,gBAAgB,EAAEL,gBAAgB,WAAW,CAAC;aAAC;YAC1DM,UAAU;YACV1C,SAAS;gBACP2C,UAAU;oBACRL,GAAGM,EAAE,CACH,GAAGhC,gBAAgB,WAAW,CAAC,EAC/B,GAAGwB,gBAAgB,WAAW,CAAC;oBAEjC,GAAGT,WAAW,iCAAiC,EAAEC,eAAe,CAAC,EAAEQ,iBAAiB;iBACrF;gBACDS,UAAU;YACZ;YACAC,WAAW;gBAAC;aAAS;QACvB;QAEA3D,kCAAkCc,SAAS,UAAUoC;QACrDlD,kCAAkCc,SAAS,SAAS;QAEpD1B,oBAAoBwB,MAAM;YACxBE;YACA8C,iBAAiBpB;YACjBqB,iBAAiB,GAAGtC,kBAAkB,MAAM,CAAC;YAC7C2B;YACAY,WAAW;gBAACrB;aAAe;QAC7B;QAEA,wBAAwB;QACxB,MAAMsB,MAAM,MAAMxE,WAAWqB,MAAMC,QAAQkD,GAAG;QAC9C,MAAM1D,0BAA0BO,MAAM;YAAEmD;QAAI;QAE5C,2FAA2F;QAC3F,MAAMC,gBACJlC,aAAa,UAAU,SAAUA;QAEnC,MAAM7C,cAAc2B,MAAM;YACxBqD,oBAAoB9C;YACpBG;YACA4C,aAAapD,QAAQK,IAAI;YACzBsB;YACAQ;YACAc;YACAhC;YACAoC,gBAAgBH;YAChBxB;QACF;IACF;IAEA,mBAAmB;IACnB/D,6BACEmC,MACAJ,aAAa;QACX;QACA;QACA;QACA;QACA;QACA;WACIsB,aAAa,QACZ;YAAC;YAAW;SAAc,GAC3BA,aAAa,UACV;YACC;YACA;YACA;YACA;YACA;SACD,GACA;YACC;YACA;YACA;YACA;YACA;SACD;KACR,GACDtB,aAAa;QACX,wEAAwE;QACxE,yEAAyE;QACzE;QACA;QACA;QACA;QACA;WACIuB,SAAS,QACR;YAAC;YAAa;SAAgC,GAC9C,EAAE;QACP,0EAA0E;WACtED,aAAa,QAAS;YAAC;SAAc,GAAc,EAAE;WACrDA,aAAa,SAASA,aAAa,UAClC;YAAC;YAAkB;SAAc,GACjC;YAAC;YAAa;SAAc;KAClC;IAGH,2FAA2F;IAC3F,sFAAsF;IACtF,MAAMsC,oBAAoBtC,aAAa,QAAQ,OAAO;IACtD,MAAMuC,eAAejE,WAAWQ,MAAME,SAASsD,mBAAmB;QAChEE,WAAW;YAAEC,MAAM9D;YAAyBU,MAAMI;QAAkB;IACtE;IAEA,uEAAuE;IACvE,8DAA8D;IAC9D,yDAAyD;IACzD,MAAMiD,aAAa7F,kBACjBmC,QAAQE,IAAI,EACZ,WACAO;IAEFzC,oBAAoB8B,MAAM;QACxB4D;QACA1C;QACA2C,UAAU;QACVnD;QACAS;QACA2C,qBAAqB,CAAC,MAAM,EAAElD,sCAAsC;IACtE;IAEA,MAAMmD,UACJ7C,aAAa,SACT,CAAC,eAAe,EAAEuC,aAAa,GAAG,CAAC,GACnCvC,aAAa,UACX,CAAC,iBAAiB,EAAEuC,aAAa,YAAY,CAAC,GAC9C,CAAC,iBAAiB,EAAEA,cAAc;IAC1C,MAAMO,cAAc,CAAC,cAAc,EAAErD,kBAAkB,QAAQ,CAAC;IAEhE,MAAMsD,eAAe;QACnB,GAAG/D,QAAQsC,OAAO;QAClB,CAAC,GAAG7B,kBAAkB,MAAM,CAAC,CAAC,EAAE;YAC9BgC,UAAU;YACVuB,YAAY;YACZjE,SAAS;gBACP2C,UAAU;oBAAC,CAAC,YAAY,EAAE9B,kBAAkB,SAAS,CAAC;iBAAC;gBACvDqD,KAAK;gBACLC,KAAK;oBACHC,MAAM,GAAGZ,cAAc;gBACzB;YACF;QACF;QACA,CAAC,GAAG9C,kBAAkB,IAAI,CAAC,CAAC,EAAE;YAC5BgC,UAAU;YACVuB,YAAY;YACZjE,SAAS;gBACP2C,UAAU;oBAAC,CAAC,YAAY,EAAE9B,kBAAkB,SAAS,CAAC;iBAAC;gBACvDqD,KAAK;gBACLC,KAAK;oBACHC,MAAM,GAAGZ,cAAc;oBACvBa,WAAW;gBACb;YACF;QACF;QACA,CAAC,GAAG3D,kBAAkB,KAAK,CAAC,CAAC,EAAE;YAC7BgC,UAAU;YACV1C,SAAS;gBACP2C,UAAU;oBAACoB;iBAAY;gBACvBG,KAAK;gBACLC,KAAK;oBACHG,KAAKR;gBACP;YACF;QACF;IACF;IAEA,gEAAgE;IAChE7E,sBAAsB+E,cAAc,GAAGtD,kBAAkB,IAAI,CAAC;IAE9D1C,2BAA2B+B,MAAME,QAAQK,IAAI,EAAE;QAC7C,GAAGL,OAAO;QACV,yEAAyE;QACzE,uBAAuB;QACvBsC,SAASjD,eAAe0E;IAC1B;IAEA9E,8BACEa,MACAE,QAAQK,IAAI,EACZV,yBACAe,sCACAD,mBACA;QAAE6D,MAAMf;QAAcgB,IAAI/D;QAAoBS;QAAMD;IAAS;IAG/D,MAAMrC,gCAAgCmB,MAAM;QAACH;KAAwB;IAErE,MAAMpB,qBAAqBuB;IAC3B,OAAO,IACLpB,oBAAoBoB,MAAMC,QAAQyE,yBAAyB,EAAE;YAC3DC,WAAW;gBAAC;aAAa;QAC3B;AACJ,EAAE;AAEF,eAAe5E,iBAAiB"}

package/src/ts/mcp-server/files/Dockerfile.template

@@ -1,4 +1,7 @@
-FROM public.ecr.aws/docker/library/node:lts-jod
+FROM <%- nodeBaseImage %>
+
+# Upgrade npm to a version free of known HIGH/CRITICAL vulnerabilities
+RUN npm install -g npm@<%- npmVersion %>
 
 WORKDIR /app
 

package/src/ts/mcp-server/generator.js

@@ -7,6 +7,7 @@ import { MCP_INSPECTOR_EXCEPTIONS } from "../../license/known-exceptions.js";
 import { addMcpServerInfra } from "../../utils/agent-core-constructs/agent-core-constructs.js";
 import { addTypeScriptBundleTarget } from "../../utils/bundle/bundle.js";
 import { resolveContainers } from "../../utils/containers.js";
+import { addDockerScanTarget } from "../../utils/docker.js";
 import { formatFilesInSubtree } from "../../utils/format.js";
 import { FsCommands } from "../../utils/fs.js";
 import { resolveIac } from "../../utils/iac.js";
@@ -19,7 +20,7 @@ import { addComponentDevTarget, addComponentGeneratorMetadata, addDependencyToTa
 import { sortObjectKeys } from "../../utils/object.js";
 import { assignPort } from "../../utils/port.js";
 import { sharedConstructsGenerator } from "../../utils/shared-constructs.js";
-import { TS_VERSIONS, withVersions } from "../../utils/versions.js";
+import { BASE_IMAGES, TS_VERSIONS, withVersions } from "../../utils/versions.js";
 export const TS_MCP_SERVER_GENERATOR_INFO = getGeneratorInfo(import.meta.filename);
 export const tsMcpServerGenerator = async (tree, options)=>{
     const project = readProjectConfigurationUnqualified(tree, options.project);
@@ -49,7 +50,9 @@ export const tsMcpServerGenerator = async (tree, options)=>{
         name,
         esm,
         distDir,
-        adotVersion: TS_VERSIONS['@aws/aws-distro-opentelemetry-node-autoinstrumentation']
+        adotVersion: TS_VERSIONS['@aws/aws-distro-opentelemetry-node-autoinstrumentation'],
+        nodeBaseImage: BASE_IMAGES.node,
+        npmVersion: TS_VERSIONS.npm
     }, {
         overwriteStrategy: OverwriteStrategy.KeepExisting
     });
@@ -97,6 +100,15 @@ export const tsMcpServerGenerator = async (tree, options)=>{
         };
         addDependencyToTargetIfNotPresent(project, 'docker', dockerTargetName);
         addDependencyToTargetIfNotPresent(project, 'build', 'docker');
+        addDockerScanTarget(tree, {
+            project,
+            containerEngine: containers,
+            trivyTargetName: `${mcpTargetPrefix}-trivy`,
+            dockerTargetName,
+            imageTags: [
+                dockerImageTag
+            ]
+        });
         // Add shared constructs
         const iac = await resolveIac(tree, options.iac);
         await sharedConstructsGenerator(tree, {

package/src/ts/mcp-server/generator.js.map

@@ -1 +1 @@
-{"version":3,"sources":["../../../../../../packages/nx-plugin/src/ts/mcp-server/generator.ts"],"sourcesContent":["/**\n * Copyright Amazon.com, Inc. or its affiliates. All Rights Reserved.\n * SPDX-License-Identifier: Apache-2.0\n */\nimport {\n  addDependenciesToPackageJson,\n  detectPackageManager,\n  type GeneratorCallback,\n  generateFiles,\n  joinPathFragments,\n  OverwriteStrategy,\n  readJson,\n  type Tree,\n  updateJson,\n  updateProjectConfiguration,\n} from '@nx/devkit';\nimport { ensureLicenseExceptions } from '../../license/config';\nimport { MCP_INSPECTOR_EXCEPTIONS } from '../../license/known-exceptions';\nimport { addMcpServerInfra } from '../../utils/agent-core-constructs/agent-core-constructs';\nimport { addTypeScriptBundleTarget } from '../../utils/bundle/bundle';\nimport { resolveContainers } from '../../utils/containers';\nimport { formatFilesInSubtree } from '../../utils/format';\nimport { FsCommands } from '../../utils/fs';\nimport { resolveIac } from '../../utils/iac';\nimport { installDependencies } from '../../utils/install';\nimport { addGeneratorMetricsIfApplicable } from '../../utils/metrics';\nimport { isEsmWorkspace } from '../../utils/module-format';\nimport { kebabCase, toClassName } from '../../utils/names';\nimport { getNpmScope } from '../../utils/npm-scope';\nimport {\n  addComponentDevTarget,\n  addComponentGeneratorMetadata,\n  addDependencyToTargetIfNotPresent,\n  getGeneratorInfo,\n  type NxGeneratorInfo,\n  readProjectConfigurationUnqualified,\n} from '../../utils/nx';\nimport { sortObjectKeys } from '../../utils/object';\nimport { assignPort } from '../../utils/port';\nimport { sharedConstructsGenerator } from '../../utils/shared-constructs';\nimport { TS_VERSIONS, withVersions } from '../../utils/versions';\nimport type { TsMcpServerGeneratorSchema } from './schema';\n\nexport const TS_MCP_SERVER_GENERATOR_INFO: NxGeneratorInfo = getGeneratorInfo(\n  import.meta.filename,\n);\n\nexport const tsMcpServerGenerator = async (\n  tree: Tree,\n  options: TsMcpServerGeneratorSchema,\n): Promise<GeneratorCallback> => {\n  const project = readProjectConfigurationUnqualified(tree, options.project);\n\n  if (!tree.exists(joinPathFragments(project.root, 'tsconfig.json'))) {\n    throw new Error(\n      `Unsupported project ${options.project}. Expected a TypeScript project (with a tsconfig.json)`,\n    );\n  }\n\n  const defaultName = `${kebabCase(project.name.split('/').pop())}-mcp-server`;\n  const name = kebabCase(options.name || defaultName);\n  const mcpServerNameClassName = toClassName(name);\n  const mcpTargetPrefix = options.name ? name : 'mcp-server';\n  const targetSourceDirRelativeToProjectRoot = joinPathFragments(\n    'src',\n    mcpTargetPrefix,\n  );\n  const targetSourceDir = joinPathFragments(\n    project.root,\n    targetSourceDirRelativeToProjectRoot,\n  );\n  const relativeSourceDir = targetSourceDir.replace(project.root + '/', './');\n  const distDir = joinPathFragments('dist', project.root);\n\n  const infra = options.infra ?? 'agentcore';\n\n  if (infra === 'none' && options.auth && options.auth !== 'iam') {\n    console.warn(\n      'Warning: auth is ignored when no infrastructure is configured (no infrastructure is generated)',\n    );\n  }\n\n  const auth = options.auth ?? 'iam';\n\n  const projectPackageJsonPath = joinPathFragments(\n    project.root,\n    'package.json',\n  );\n\n  // Generate esm if the module system is esm, otherwise commonjs. Projects\n  // don't typically have their own package.json (dependencies are declared in\n  // the workspace root), so fall back to the workspace format when absent.\n  const esm = tree.exists(projectPackageJsonPath)\n    ? readJson(tree, projectPackageJsonPath).type === 'module'\n    : isEsmWorkspace(tree);\n\n  // Generate example server\n  generateFiles(\n    tree,\n    joinPathFragments(import.meta.dirname, 'files'),\n    targetSourceDir,\n    {\n      name,\n      esm,\n      distDir,\n      adotVersion:\n        TS_VERSIONS['@aws/aws-distro-opentelemetry-node-autoinstrumentation'],\n    },\n    { overwriteStrategy: OverwriteStrategy.KeepExisting },\n  );\n\n  // Add dependencies\n  const deps = withVersions([\n    '@modelcontextprotocol/sdk',\n    'zod',\n    'express',\n    '@aws-lambda-powertools/parameters',\n    '@aws-sdk/client-appconfigdata',\n  ]);\n  const devDeps = withVersions([\n    'tsx',\n    '@types/express',\n    '@modelcontextprotocol/inspector',\n  ]);\n\n  // Add hosting based on infra\n  if (infra === 'agentcore') {\n    const containers = await resolveContainers(tree, 'inherit');\n    const dockerImageTag = `${getNpmScope(tree)}-${name}:latest`;\n\n    // Add bundle target\n    await addTypeScriptBundleTarget(tree, project, {\n      targetFilePath: `${targetSourceDirRelativeToProjectRoot}/http.ts`,\n      bundleOutputDir: joinPathFragments('mcp', name),\n    });\n\n    const dockerOutputDir = joinPathFragments(\n      'dist',\n      project.root,\n      'bundle',\n      'mcp',\n      name,\n    );\n    const dockerTargetName = `${mcpTargetPrefix}-docker`;\n\n    const fs = new FsCommands(tree);\n    project.targets[dockerTargetName] = {\n      cache: true,\n      outputs: [`{workspaceRoot}/${dockerOutputDir}/Dockerfile`],\n      executor: 'nx:run-commands',\n      options: {\n        commands: [\n          fs.cp(\n            `${targetSourceDir}/Dockerfile`,\n            `${dockerOutputDir}/Dockerfile`,\n          ),\n          `${containers} build --platform linux/arm64 -t ${dockerImageTag} ${dockerOutputDir}`,\n        ],\n        parallel: false,\n      },\n      dependsOn: ['bundle'],\n    };\n\n    addDependencyToTargetIfNotPresent(project, 'docker', dockerTargetName);\n    addDependencyToTargetIfNotPresent(project, 'build', 'docker');\n\n    // Add shared constructs\n    const iac = await resolveIac(tree, options.iac);\n    await sharedConstructsGenerator(tree, { iac });\n\n    // Add the construct to deploy the mcp server\n    await addMcpServerInfra(tree, {\n      mcpServerNameKebabCase: name,\n      mcpServerNameClassName,\n      projectName: project.name,\n      dockerImageTag,\n      dockerOutputDir,\n      iac,\n      auth,\n      containers,\n    });\n  } else {\n    // No Dockerfile needed for non-hosted MCP\n    tree.delete(joinPathFragments(targetSourceDir, 'Dockerfile'));\n  }\n\n  addDependenciesToPackageJson(tree, deps, devDeps);\n  // Add to the project's package.json too if it has one (e.g. nx plugins),\n  // otherwise dependencies live in the workspace root only.\n  if (tree.exists(projectPackageJsonPath)) {\n    addDependenciesToPackageJson(tree, deps, devDeps, projectPackageJsonPath);\n  }\n\n  // @modelcontextprotocol/sdk declares zod as a peer dependency with a wide range\n  // (^3.25 || ^4.0). Yarn does not dedupe the peer to the workspace's pinned zod, so\n  // without a resolution it installs a separate zod under the SDK's own node_modules.\n  // The two zod copies have structurally incompatible types, which breaks type\n  // inference for registerTool inputSchema. Scope the resolution to the SDK so\n  // other consumers (e.g. @tanstack/router-generator pinning zod@3) are unaffected.\n  if (detectPackageManager() === 'yarn') {\n    updateJson(tree, 'package.json', (packageJson) => {\n      packageJson.resolutions = {\n        ...packageJson.resolutions,\n        '**/@modelcontextprotocol/sdk/zod': TS_VERSIONS['zod'],\n      };\n      return packageJson;\n    });\n  }\n\n  const localDevPort = assignPort(tree, project, 8000, {\n    component: { info: TS_MCP_SERVER_GENERATOR_INFO, name: mcpTargetPrefix },\n  });\n\n  const mcpTargets = {\n    ...project.targets,\n    // Add targets for running the MCP server\n    [`${mcpTargetPrefix}-serve-stdio`]: {\n      executor: 'nx:run-commands',\n      continuous: true,\n      options: {\n        commands: [`tsx --watch ${relativeSourceDir}/stdio.ts`],\n        cwd: '{projectRoot}',\n      },\n    },\n    [`${mcpTargetPrefix}-serve`]: {\n      executor: 'nx:run-commands',\n      continuous: true,\n      options: {\n        commands: [`tsx --watch ${relativeSourceDir}/http.ts`],\n        cwd: '{projectRoot}',\n        env: {\n          PORT: `${localDevPort}`,\n        },\n      },\n    },\n    [`${mcpTargetPrefix}-dev`]: {\n      executor: 'nx:run-commands',\n      continuous: true,\n      options: {\n        commands: [`tsx --watch ${relativeSourceDir}/http.ts`],\n        cwd: '{projectRoot}',\n        env: {\n          PORT: `${localDevPort}`,\n          LOCAL_DEV: 'true',\n        },\n      },\n    },\n    [`${mcpTargetPrefix}-inspect`]: {\n      executor: 'nx:run-commands',\n      continuous: true,\n      // Launch the inspector against the locally served HTTP server. The dev\n      // target starts the server and any connected dependencies (e.g. a local\n      // database).\n      dependsOn: [`${mcpTargetPrefix}-dev`],\n      options: {\n        commands: [\n          `mcp-inspector --transport http --server-url http://localhost:${localDevPort}/mcp`,\n        ],\n        cwd: '{projectRoot}',\n      },\n    },\n    [`${mcpTargetPrefix}-inspect-stdio`]: {\n      executor: 'nx:run-commands',\n      continuous: true,\n      options: {\n        commands: [\n          `mcp-inspector -- tsx --watch ${relativeSourceDir}/stdio.ts`,\n        ],\n        cwd: '{projectRoot}',\n      },\n    },\n  };\n\n  // Aggregate `<mcp>-dev` under the project-level `dev` target.\n  addComponentDevTarget(mcpTargets, `${mcpTargetPrefix}-dev`);\n\n  updateProjectConfiguration(tree, project.name, {\n    ...project,\n    // Sort targets so their order is stable regardless of insertion order on\n    // first run vs re-run.\n    targets: sortObjectKeys(mcpTargets),\n  });\n\n  addComponentGeneratorMetadata(\n    tree,\n    project.name,\n    TS_MCP_SERVER_GENERATOR_INFO,\n    targetSourceDirRelativeToProjectRoot,\n    mcpTargetPrefix,\n    {\n      port: localDevPort,\n      rc: mcpServerNameClassName,\n      auth,\n    },\n  );\n\n  await addGeneratorMetricsIfApplicable(tree, [TS_MCP_SERVER_GENERATOR_INFO]);\n\n  await ensureLicenseExceptions(tree, MCP_INSPECTOR_EXCEPTIONS);\n\n  await formatFilesInSubtree(tree);\n  return () =>\n    installDependencies(tree, options.preferInstallDependencies, {\n      languages: ['typescript'],\n    });\n};\n\nexport default tsMcpServerGenerator;\n"],"names":["addDependenciesToPackageJson","detectPackageManager","generateFiles","joinPathFragments","OverwriteStrategy","readJson","updateJson","updateProjectConfiguration","ensureLicenseExceptions","MCP_INSPECTOR_EXCEPTIONS","addMcpServerInfra","addTypeScriptBundleTarget","resolveContainers","formatFilesInSubtree","FsCommands","resolveIac","installDependencies","addGeneratorMetricsIfApplicable","isEsmWorkspace","kebabCase","toClassName","getNpmScope","addComponentDevTarget","addComponentGeneratorMetadata","addDependencyToTargetIfNotPresent","getGeneratorInfo","readProjectConfigurationUnqualified","sortObjectKeys","assignPort","sharedConstructsGenerator","TS_VERSIONS","withVersions","TS_MCP_SERVER_GENERATOR_INFO","filename","tsMcpServerGenerator","tree","options","project","exists","root","Error","defaultName","name","split","pop","mcpServerNameClassName","mcpTargetPrefix","targetSourceDirRelativeToProjectRoot","targetSourceDir","relativeSourceDir","replace","distDir","infra","auth","console","warn","projectPackageJsonPath","esm","type","dirname","adotVersion","overwriteStrategy","KeepExisting","deps","devDeps","containers","dockerImageTag","targetFilePath","bundleOutputDir","dockerOutputDir","dockerTargetName","fs","targets","cache","outputs","executor","commands","cp","parallel","dependsOn","iac","mcpServerNameKebabCase","projectName","delete","packageJson","resolutions","localDevPort","component","info","mcpTargets","continuous","cwd","env","PORT","LOCAL_DEV","port","rc","preferInstallDependencies","languages"],"mappings":"AAAA;;;CAGC,GACD,SACEA,4BAA4B,EAC5BC,oBAAoB,EAEpBC,aAAa,EACbC,iBAAiB,EACjBC,iBAAiB,EACjBC,QAAQ,EAERC,UAAU,EACVC,0BAA0B,QACrB,aAAa;AACpB,SAASC,uBAAuB,QAAQ,0BAAuB;AAC/D,SAASC,wBAAwB,QAAQ,oCAAiC;AAC1E,SAASC,iBAAiB,QAAQ,6DAA0D;AAC5F,SAASC,yBAAyB,QAAQ,+BAA4B;AACtE,SAASC,iBAAiB,QAAQ,4BAAyB;AAC3D,SAASC,oBAAoB,QAAQ,wBAAqB;AAC1D,SAASC,UAAU,QAAQ,oBAAiB;AAC5C,SAASC,UAAU,QAAQ,qBAAkB;AAC7C,SAASC,mBAAmB,QAAQ,yBAAsB;AAC1D,SAASC,+BAA+B,QAAQ,yBAAsB;AACtE,SAASC,cAAc,QAAQ,+BAA4B;AAC3D,SAASC,SAAS,EAAEC,WAAW,QAAQ,uBAAoB;AAC3D,SAASC,WAAW,QAAQ,2BAAwB;AACpD,SACEC,qBAAqB,EACrBC,6BAA6B,EAC7BC,iCAAiC,EACjCC,gBAAgB,EAEhBC,mCAAmC,QAC9B,oBAAiB;AACxB,SAASC,cAAc,QAAQ,wBAAqB;AACpD,SAASC,UAAU,QAAQ,sBAAmB;AAC9C,SAASC,yBAAyB,QAAQ,mCAAgC;AAC1E,SAASC,WAAW,EAAEC,YAAY,QAAQ,0BAAuB;AAGjE,OAAO,MAAMC,+BAAgDP,iBAC3D,YAAYQ,QAAQ,EACpB;AAEF,OAAO,MAAMC,uBAAuB,OAClCC,MACAC;IAEA,MAAMC,UAAUX,oCAAoCS,MAAMC,QAAQC,OAAO;IAEzE,IAAI,CAACF,KAAKG,MAAM,CAACnC,kBAAkBkC,QAAQE,IAAI,EAAE,mBAAmB;QAClE,MAAM,IAAIC,MACR,CAAC,oBAAoB,EAAEJ,QAAQC,OAAO,CAAC,sDAAsD,CAAC;IAElG;IAEA,MAAMI,cAAc,GAAGtB,UAAUkB,QAAQK,IAAI,CAACC,KAAK,CAAC,KAAKC,GAAG,IAAI,WAAW,CAAC;IAC5E,MAAMF,OAAOvB,UAAUiB,QAAQM,IAAI,IAAID;IACvC,MAAMI,yBAAyBzB,YAAYsB;IAC3C,MAAMI,kBAAkBV,QAAQM,IAAI,GAAGA,OAAO;IAC9C,MAAMK,uCAAuC5C,kBAC3C,OACA2C;IAEF,MAAME,kBAAkB7C,kBACtBkC,QAAQE,IAAI,EACZQ;IAEF,MAAME,oBAAoBD,gBAAgBE,OAAO,CAACb,QAAQE,IAAI,GAAG,KAAK;IACtE,MAAMY,UAAUhD,kBAAkB,QAAQkC,QAAQE,IAAI;IAEtD,MAAMa,QAAQhB,QAAQgB,KAAK,IAAI;IAE/B,IAAIA,UAAU,UAAUhB,QAAQiB,IAAI,IAAIjB,QAAQiB,IAAI,KAAK,OAAO;QAC9DC,QAAQC,IAAI,CACV;IAEJ;IAEA,MAAMF,OAAOjB,QAAQiB,IAAI,IAAI;IAE7B,MAAMG,yBAAyBrD,kBAC7BkC,QAAQE,IAAI,EACZ;IAGF,yEAAyE;IACzE,4EAA4E;IAC5E,yEAAyE;IACzE,MAAMkB,MAAMtB,KAAKG,MAAM,CAACkB,0BACpBnD,SAAS8B,MAAMqB,wBAAwBE,IAAI,KAAK,WAChDxC,eAAeiB;IAEnB,0BAA0B;IAC1BjC,cACEiC,MACAhC,kBAAkB,YAAYwD,OAAO,EAAE,UACvCX,iBACA;QACEN;QACAe;QACAN;QACAS,aACE9B,WAAW,CAAC,yDAAyD;IACzE,GACA;QAAE+B,mBAAmBzD,kBAAkB0D,YAAY;IAAC;IAGtD,mBAAmB;IACnB,MAAMC,OAAOhC,aAAa;QACxB;QACA;QACA;QACA;QACA;KACD;IACD,MAAMiC,UAAUjC,aAAa;QAC3B;QACA;QACA;KACD;IAED,6BAA6B;IAC7B,IAAIqB,UAAU,aAAa;QACzB,MAAMa,aAAa,MAAMrD,kBAAkBuB,MAAM;QACjD,MAAM+B,iBAAiB,GAAG7C,YAAYc,MAAM,CAAC,EAAEO,KAAK,OAAO,CAAC;QAE5D,oBAAoB;QACpB,MAAM/B,0BAA0BwB,MAAME,SAAS;YAC7C8B,gBAAgB,GAAGpB,qCAAqC,QAAQ,CAAC;YACjEqB,iBAAiBjE,kBAAkB,OAAOuC;QAC5C;QAEA,MAAM2B,kBAAkBlE,kBACtB,QACAkC,QAAQE,IAAI,EACZ,UACA,OACAG;QAEF,MAAM4B,mBAAmB,GAAGxB,gBAAgB,OAAO,CAAC;QAEpD,MAAMyB,KAAK,IAAIzD,WAAWqB;QAC1BE,QAAQmC,OAAO,CAACF,iBAAiB,GAAG;YAClCG,OAAO;YACPC,SAAS;gBAAC,CAAC,gBAAgB,EAAEL,gBAAgB,WAAW,CAAC;aAAC;YAC1DM,UAAU;YACVvC,SAAS;gBACPwC,UAAU;oBACRL,GAAGM,EAAE,CACH,GAAG7B,gBAAgB,WAAW,CAAC,EAC/B,GAAGqB,gBAAgB,WAAW,CAAC;oBAEjC,GAAGJ,WAAW,iCAAiC,EAAEC,eAAe,CAAC,EAAEG,iBAAiB;iBACrF;gBACDS,UAAU;YACZ;YACAC,WAAW;gBAAC;aAAS;QACvB;QAEAvD,kCAAkCa,SAAS,UAAUiC;QACrD9C,kCAAkCa,SAAS,SAAS;QAEpD,wBAAwB;QACxB,MAAM2C,MAAM,MAAMjE,WAAWoB,MAAMC,QAAQ4C,GAAG;QAC9C,MAAMnD,0BAA0BM,MAAM;YAAE6C;QAAI;QAE5C,6CAA6C;QAC7C,MAAMtE,kBAAkByB,MAAM;YAC5B8C,wBAAwBvC;YACxBG;YACAqC,aAAa7C,QAAQK,IAAI;YACzBwB;YACAG;YACAW;YACA3B;YACAY;QACF;IACF,OAAO;QACL,0CAA0C;QAC1C9B,KAAKgD,MAAM,CAAChF,kBAAkB6C,iBAAiB;IACjD;IAEAhD,6BAA6BmC,MAAM4B,MAAMC;IACzC,yEAAyE;IACzE,0DAA0D;IAC1D,IAAI7B,KAAKG,MAAM,CAACkB,yBAAyB;QACvCxD,6BAA6BmC,MAAM4B,MAAMC,SAASR;IACpD;IAEA,gFAAgF;IAChF,mFAAmF;IACnF,oFAAoF;IACpF,6EAA6E;IAC7E,6EAA6E;IAC7E,kFAAkF;IAClF,IAAIvD,2BAA2B,QAAQ;QACrCK,WAAW6B,MAAM,gBAAgB,CAACiD;YAChCA,YAAYC,WAAW,GAAG;gBACxB,GAAGD,YAAYC,WAAW;gBAC1B,oCAAoCvD,WAAW,CAAC,MAAM;YACxD;YACA,OAAOsD;QACT;IACF;IAEA,MAAME,eAAe1D,WAAWO,MAAME,SAAS,MAAM;QACnDkD,WAAW;YAAEC,MAAMxD;YAA8BU,MAAMI;QAAgB;IACzE;IAEA,MAAM2C,aAAa;QACjB,GAAGpD,QAAQmC,OAAO;QAClB,yCAAyC;QACzC,CAAC,GAAG1B,gBAAgB,YAAY,CAAC,CAAC,EAAE;YAClC6B,UAAU;YACVe,YAAY;YACZtD,SAAS;gBACPwC,UAAU;oBAAC,CAAC,YAAY,EAAE3B,kBAAkB,SAAS,CAAC;iBAAC;gBACvD0C,KAAK;YACP;QACF;QACA,CAAC,GAAG7C,gBAAgB,MAAM,CAAC,CAAC,EAAE;YAC5B6B,UAAU;YACVe,YAAY;YACZtD,SAAS;gBACPwC,UAAU;oBAAC,CAAC,YAAY,EAAE3B,kBAAkB,QAAQ,CAAC;iBAAC;gBACtD0C,KAAK;gBACLC,KAAK;oBACHC,MAAM,GAAGP,cAAc;gBACzB;YACF;QACF;QACA,CAAC,GAAGxC,gBAAgB,IAAI,CAAC,CAAC,EAAE;YAC1B6B,UAAU;YACVe,YAAY;YACZtD,SAAS;gBACPwC,UAAU;oBAAC,CAAC,YAAY,EAAE3B,kBAAkB,QAAQ,CAAC;iBAAC;gBACtD0C,KAAK;gBACLC,KAAK;oBACHC,MAAM,GAAGP,cAAc;oBACvBQ,WAAW;gBACb;YACF;QACF;QACA,CAAC,GAAGhD,gBAAgB,QAAQ,CAAC,CAAC,EAAE;YAC9B6B,UAAU;YACVe,YAAY;YACZ,uEAAuE;YACvE,wEAAwE;YACxE,aAAa;YACbX,WAAW;gBAAC,GAAGjC,gBAAgB,IAAI,CAAC;aAAC;YACrCV,SAAS;gBACPwC,UAAU;oBACR,CAAC,6DAA6D,EAAEU,aAAa,IAAI,CAAC;iBACnF;gBACDK,KAAK;YACP;QACF;QACA,CAAC,GAAG7C,gBAAgB,cAAc,CAAC,CAAC,EAAE;YACpC6B,UAAU;YACVe,YAAY;YACZtD,SAAS;gBACPwC,UAAU;oBACR,CAAC,6BAA6B,EAAE3B,kBAAkB,SAAS,CAAC;iBAC7D;gBACD0C,KAAK;YACP;QACF;IACF;IAEA,8DAA8D;IAC9DrE,sBAAsBmE,YAAY,GAAG3C,gBAAgB,IAAI,CAAC;IAE1DvC,2BAA2B4B,MAAME,QAAQK,IAAI,EAAE;QAC7C,GAAGL,OAAO;QACV,yEAAyE;QACzE,uBAAuB;QACvBmC,SAAS7C,eAAe8D;IAC1B;IAEAlE,8BACEY,MACAE,QAAQK,IAAI,EACZV,8BACAe,sCACAD,iBACA;QACEiD,MAAMT;QACNU,IAAInD;QACJQ;IACF;IAGF,MAAMpC,gCAAgCkB,MAAM;QAACH;KAA6B;IAE1E,MAAMxB,wBAAwB2B,MAAM1B;IAEpC,MAAMI,qBAAqBsB;IAC3B,OAAO,IACLnB,oBAAoBmB,MAAMC,QAAQ6D,yBAAyB,EAAE;YAC3DC,WAAW;gBAAC;aAAa;QAC3B;AACJ,EAAE;AAEF,eAAehE,qBAAqB"}
+{"version":3,"sources":["../../../../../../packages/nx-plugin/src/ts/mcp-server/generator.ts"],"sourcesContent":["/**\n * Copyright Amazon.com, Inc. or its affiliates. All Rights Reserved.\n * SPDX-License-Identifier: Apache-2.0\n */\nimport {\n  addDependenciesToPackageJson,\n  detectPackageManager,\n  type GeneratorCallback,\n  generateFiles,\n  joinPathFragments,\n  OverwriteStrategy,\n  readJson,\n  type Tree,\n  updateJson,\n  updateProjectConfiguration,\n} from '@nx/devkit';\nimport { ensureLicenseExceptions } from '../../license/config';\nimport { MCP_INSPECTOR_EXCEPTIONS } from '../../license/known-exceptions';\nimport { addMcpServerInfra } from '../../utils/agent-core-constructs/agent-core-constructs';\nimport { addTypeScriptBundleTarget } from '../../utils/bundle/bundle';\nimport { resolveContainers } from '../../utils/containers';\nimport { addDockerScanTarget } from '../../utils/docker';\nimport { formatFilesInSubtree } from '../../utils/format';\nimport { FsCommands } from '../../utils/fs';\nimport { resolveIac } from '../../utils/iac';\nimport { installDependencies } from '../../utils/install';\nimport { addGeneratorMetricsIfApplicable } from '../../utils/metrics';\nimport { isEsmWorkspace } from '../../utils/module-format';\nimport { kebabCase, toClassName } from '../../utils/names';\nimport { getNpmScope } from '../../utils/npm-scope';\nimport {\n  addComponentDevTarget,\n  addComponentGeneratorMetadata,\n  addDependencyToTargetIfNotPresent,\n  getGeneratorInfo,\n  type NxGeneratorInfo,\n  readProjectConfigurationUnqualified,\n} from '../../utils/nx';\nimport { sortObjectKeys } from '../../utils/object';\nimport { assignPort } from '../../utils/port';\nimport { sharedConstructsGenerator } from '../../utils/shared-constructs';\nimport { BASE_IMAGES, TS_VERSIONS, withVersions } from '../../utils/versions';\nimport type { TsMcpServerGeneratorSchema } from './schema';\n\nexport const TS_MCP_SERVER_GENERATOR_INFO: NxGeneratorInfo = getGeneratorInfo(\n  import.meta.filename,\n);\n\nexport const tsMcpServerGenerator = async (\n  tree: Tree,\n  options: TsMcpServerGeneratorSchema,\n): Promise<GeneratorCallback> => {\n  const project = readProjectConfigurationUnqualified(tree, options.project);\n\n  if (!tree.exists(joinPathFragments(project.root, 'tsconfig.json'))) {\n    throw new Error(\n      `Unsupported project ${options.project}. Expected a TypeScript project (with a tsconfig.json)`,\n    );\n  }\n\n  const defaultName = `${kebabCase(project.name.split('/').pop())}-mcp-server`;\n  const name = kebabCase(options.name || defaultName);\n  const mcpServerNameClassName = toClassName(name);\n  const mcpTargetPrefix = options.name ? name : 'mcp-server';\n  const targetSourceDirRelativeToProjectRoot = joinPathFragments(\n    'src',\n    mcpTargetPrefix,\n  );\n  const targetSourceDir = joinPathFragments(\n    project.root,\n    targetSourceDirRelativeToProjectRoot,\n  );\n  const relativeSourceDir = targetSourceDir.replace(project.root + '/', './');\n  const distDir = joinPathFragments('dist', project.root);\n\n  const infra = options.infra ?? 'agentcore';\n\n  if (infra === 'none' && options.auth && options.auth !== 'iam') {\n    console.warn(\n      'Warning: auth is ignored when no infrastructure is configured (no infrastructure is generated)',\n    );\n  }\n\n  const auth = options.auth ?? 'iam';\n\n  const projectPackageJsonPath = joinPathFragments(\n    project.root,\n    'package.json',\n  );\n\n  // Generate esm if the module system is esm, otherwise commonjs. Projects\n  // don't typically have their own package.json (dependencies are declared in\n  // the workspace root), so fall back to the workspace format when absent.\n  const esm = tree.exists(projectPackageJsonPath)\n    ? readJson(tree, projectPackageJsonPath).type === 'module'\n    : isEsmWorkspace(tree);\n\n  // Generate example server\n  generateFiles(\n    tree,\n    joinPathFragments(import.meta.dirname, 'files'),\n    targetSourceDir,\n    {\n      name,\n      esm,\n      distDir,\n      adotVersion:\n        TS_VERSIONS['@aws/aws-distro-opentelemetry-node-autoinstrumentation'],\n      nodeBaseImage: BASE_IMAGES.node,\n      npmVersion: TS_VERSIONS.npm,\n    },\n    { overwriteStrategy: OverwriteStrategy.KeepExisting },\n  );\n\n  // Add dependencies\n  const deps = withVersions([\n    '@modelcontextprotocol/sdk',\n    'zod',\n    'express',\n    '@aws-lambda-powertools/parameters',\n    '@aws-sdk/client-appconfigdata',\n  ]);\n  const devDeps = withVersions([\n    'tsx',\n    '@types/express',\n    '@modelcontextprotocol/inspector',\n  ]);\n\n  // Add hosting based on infra\n  if (infra === 'agentcore') {\n    const containers = await resolveContainers(tree, 'inherit');\n    const dockerImageTag = `${getNpmScope(tree)}-${name}:latest`;\n\n    // Add bundle target\n    await addTypeScriptBundleTarget(tree, project, {\n      targetFilePath: `${targetSourceDirRelativeToProjectRoot}/http.ts`,\n      bundleOutputDir: joinPathFragments('mcp', name),\n    });\n\n    const dockerOutputDir = joinPathFragments(\n      'dist',\n      project.root,\n      'bundle',\n      'mcp',\n      name,\n    );\n    const dockerTargetName = `${mcpTargetPrefix}-docker`;\n\n    const fs = new FsCommands(tree);\n    project.targets[dockerTargetName] = {\n      cache: true,\n      outputs: [`{workspaceRoot}/${dockerOutputDir}/Dockerfile`],\n      executor: 'nx:run-commands',\n      options: {\n        commands: [\n          fs.cp(\n            `${targetSourceDir}/Dockerfile`,\n            `${dockerOutputDir}/Dockerfile`,\n          ),\n          `${containers} build --platform linux/arm64 -t ${dockerImageTag} ${dockerOutputDir}`,\n        ],\n        parallel: false,\n      },\n      dependsOn: ['bundle'],\n    };\n\n    addDependencyToTargetIfNotPresent(project, 'docker', dockerTargetName);\n    addDependencyToTargetIfNotPresent(project, 'build', 'docker');\n\n    addDockerScanTarget(tree, {\n      project,\n      containerEngine: containers,\n      trivyTargetName: `${mcpTargetPrefix}-trivy`,\n      dockerTargetName,\n      imageTags: [dockerImageTag],\n    });\n\n    // Add shared constructs\n    const iac = await resolveIac(tree, options.iac);\n    await sharedConstructsGenerator(tree, { iac });\n\n    // Add the construct to deploy the mcp server\n    await addMcpServerInfra(tree, {\n      mcpServerNameKebabCase: name,\n      mcpServerNameClassName,\n      projectName: project.name,\n      dockerImageTag,\n      dockerOutputDir,\n      iac,\n      auth,\n      containers,\n    });\n  } else {\n    // No Dockerfile needed for non-hosted MCP\n    tree.delete(joinPathFragments(targetSourceDir, 'Dockerfile'));\n  }\n\n  addDependenciesToPackageJson(tree, deps, devDeps);\n  // Add to the project's package.json too if it has one (e.g. nx plugins),\n  // otherwise dependencies live in the workspace root only.\n  if (tree.exists(projectPackageJsonPath)) {\n    addDependenciesToPackageJson(tree, deps, devDeps, projectPackageJsonPath);\n  }\n\n  // @modelcontextprotocol/sdk declares zod as a peer dependency with a wide range\n  // (^3.25 || ^4.0). Yarn does not dedupe the peer to the workspace's pinned zod, so\n  // without a resolution it installs a separate zod under the SDK's own node_modules.\n  // The two zod copies have structurally incompatible types, which breaks type\n  // inference for registerTool inputSchema. Scope the resolution to the SDK so\n  // other consumers (e.g. @tanstack/router-generator pinning zod@3) are unaffected.\n  if (detectPackageManager() === 'yarn') {\n    updateJson(tree, 'package.json', (packageJson) => {\n      packageJson.resolutions = {\n        ...packageJson.resolutions,\n        '**/@modelcontextprotocol/sdk/zod': TS_VERSIONS['zod'],\n      };\n      return packageJson;\n    });\n  }\n\n  const localDevPort = assignPort(tree, project, 8000, {\n    component: { info: TS_MCP_SERVER_GENERATOR_INFO, name: mcpTargetPrefix },\n  });\n\n  const mcpTargets = {\n    ...project.targets,\n    // Add targets for running the MCP server\n    [`${mcpTargetPrefix}-serve-stdio`]: {\n      executor: 'nx:run-commands',\n      continuous: true,\n      options: {\n        commands: [`tsx --watch ${relativeSourceDir}/stdio.ts`],\n        cwd: '{projectRoot}',\n      },\n    },\n    [`${mcpTargetPrefix}-serve`]: {\n      executor: 'nx:run-commands',\n      continuous: true,\n      options: {\n        commands: [`tsx --watch ${relativeSourceDir}/http.ts`],\n        cwd: '{projectRoot}',\n        env: {\n          PORT: `${localDevPort}`,\n        },\n      },\n    },\n    [`${mcpTargetPrefix}-dev`]: {\n      executor: 'nx:run-commands',\n      continuous: true,\n      options: {\n        commands: [`tsx --watch ${relativeSourceDir}/http.ts`],\n        cwd: '{projectRoot}',\n        env: {\n          PORT: `${localDevPort}`,\n          LOCAL_DEV: 'true',\n        },\n      },\n    },\n    [`${mcpTargetPrefix}-inspect`]: {\n      executor: 'nx:run-commands',\n      continuous: true,\n      // Launch the inspector against the locally served HTTP server. The dev\n      // target starts the server and any connected dependencies (e.g. a local\n      // database).\n      dependsOn: [`${mcpTargetPrefix}-dev`],\n      options: {\n        commands: [\n          `mcp-inspector --transport http --server-url http://localhost:${localDevPort}/mcp`,\n        ],\n        cwd: '{projectRoot}',\n      },\n    },\n    [`${mcpTargetPrefix}-inspect-stdio`]: {\n      executor: 'nx:run-commands',\n      continuous: true,\n      options: {\n        commands: [\n          `mcp-inspector -- tsx --watch ${relativeSourceDir}/stdio.ts`,\n        ],\n        cwd: '{projectRoot}',\n      },\n    },\n  };\n\n  // Aggregate `<mcp>-dev` under the project-level `dev` target.\n  addComponentDevTarget(mcpTargets, `${mcpTargetPrefix}-dev`);\n\n  updateProjectConfiguration(tree, project.name, {\n    ...project,\n    // Sort targets so their order is stable regardless of insertion order on\n    // first run vs re-run.\n    targets: sortObjectKeys(mcpTargets),\n  });\n\n  addComponentGeneratorMetadata(\n    tree,\n    project.name,\n    TS_MCP_SERVER_GENERATOR_INFO,\n    targetSourceDirRelativeToProjectRoot,\n    mcpTargetPrefix,\n    {\n      port: localDevPort,\n      rc: mcpServerNameClassName,\n      auth,\n    },\n  );\n\n  await addGeneratorMetricsIfApplicable(tree, [TS_MCP_SERVER_GENERATOR_INFO]);\n\n  await ensureLicenseExceptions(tree, MCP_INSPECTOR_EXCEPTIONS);\n\n  await formatFilesInSubtree(tree);\n  return () =>\n    installDependencies(tree, options.preferInstallDependencies, {\n      languages: ['typescript'],\n    });\n};\n\nexport default tsMcpServerGenerator;\n"],"names":["addDependenciesToPackageJson","detectPackageManager","generateFiles","joinPathFragments","OverwriteStrategy","readJson","updateJson","updateProjectConfiguration","ensureLicenseExceptions","MCP_INSPECTOR_EXCEPTIONS","addMcpServerInfra","addTypeScriptBundleTarget","resolveContainers","addDockerScanTarget","formatFilesInSubtree","FsCommands","resolveIac","installDependencies","addGeneratorMetricsIfApplicable","isEsmWorkspace","kebabCase","toClassName","getNpmScope","addComponentDevTarget","addComponentGeneratorMetadata","addDependencyToTargetIfNotPresent","getGeneratorInfo","readProjectConfigurationUnqualified","sortObjectKeys","assignPort","sharedConstructsGenerator","BASE_IMAGES","TS_VERSIONS","withVersions","TS_MCP_SERVER_GENERATOR_INFO","filename","tsMcpServerGenerator","tree","options","project","exists","root","Error","defaultName","name","split","pop","mcpServerNameClassName","mcpTargetPrefix","targetSourceDirRelativeToProjectRoot","targetSourceDir","relativeSourceDir","replace","distDir","infra","auth","console","warn","projectPackageJsonPath","esm","type","dirname","adotVersion","nodeBaseImage","node","npmVersion","npm","overwriteStrategy","KeepExisting","deps","devDeps","containers","dockerImageTag","targetFilePath","bundleOutputDir","dockerOutputDir","dockerTargetName","fs","targets","cache","outputs","executor","commands","cp","parallel","dependsOn","containerEngine","trivyTargetName","imageTags","iac","mcpServerNameKebabCase","projectName","delete","packageJson","resolutions","localDevPort","component","info","mcpTargets","continuous","cwd","env","PORT","LOCAL_DEV","port","rc","preferInstallDependencies","languages"],"mappings":"AAAA;;;CAGC,GACD,SACEA,4BAA4B,EAC5BC,oBAAoB,EAEpBC,aAAa,EACbC,iBAAiB,EACjBC,iBAAiB,EACjBC,QAAQ,EAERC,UAAU,EACVC,0BAA0B,QACrB,aAAa;AACpB,SAASC,uBAAuB,QAAQ,0BAAuB;AAC/D,SAASC,wBAAwB,QAAQ,oCAAiC;AAC1E,SAASC,iBAAiB,QAAQ,6DAA0D;AAC5F,SAASC,yBAAyB,QAAQ,+BAA4B;AACtE,SAASC,iBAAiB,QAAQ,4BAAyB;AAC3D,SAASC,mBAAmB,QAAQ,wBAAqB;AACzD,SAASC,oBAAoB,QAAQ,wBAAqB;AAC1D,SAASC,UAAU,QAAQ,oBAAiB;AAC5C,SAASC,UAAU,QAAQ,qBAAkB;AAC7C,SAASC,mBAAmB,QAAQ,yBAAsB;AAC1D,SAASC,+BAA+B,QAAQ,yBAAsB;AACtE,SAASC,cAAc,QAAQ,+BAA4B;AAC3D,SAASC,SAAS,EAAEC,WAAW,QAAQ,uBAAoB;AAC3D,SAASC,WAAW,QAAQ,2BAAwB;AACpD,SACEC,qBAAqB,EACrBC,6BAA6B,EAC7BC,iCAAiC,EACjCC,gBAAgB,EAEhBC,mCAAmC,QAC9B,oBAAiB;AACxB,SAASC,cAAc,QAAQ,wBAAqB;AACpD,SAASC,UAAU,QAAQ,sBAAmB;AAC9C,SAASC,yBAAyB,QAAQ,mCAAgC;AAC1E,SAASC,WAAW,EAAEC,WAAW,EAAEC,YAAY,QAAQ,0BAAuB;AAG9E,OAAO,MAAMC,+BAAgDR,iBAC3D,YAAYS,QAAQ,EACpB;AAEF,OAAO,MAAMC,uBAAuB,OAClCC,MACAC;IAEA,MAAMC,UAAUZ,oCAAoCU,MAAMC,QAAQC,OAAO;IAEzE,IAAI,CAACF,KAAKG,MAAM,CAACrC,kBAAkBoC,QAAQE,IAAI,EAAE,mBAAmB;QAClE,MAAM,IAAIC,MACR,CAAC,oBAAoB,EAAEJ,QAAQC,OAAO,CAAC,sDAAsD,CAAC;IAElG;IAEA,MAAMI,cAAc,GAAGvB,UAAUmB,QAAQK,IAAI,CAACC,KAAK,CAAC,KAAKC,GAAG,IAAI,WAAW,CAAC;IAC5E,MAAMF,OAAOxB,UAAUkB,QAAQM,IAAI,IAAID;IACvC,MAAMI,yBAAyB1B,YAAYuB;IAC3C,MAAMI,kBAAkBV,QAAQM,IAAI,GAAGA,OAAO;IAC9C,MAAMK,uCAAuC9C,kBAC3C,OACA6C;IAEF,MAAME,kBAAkB/C,kBACtBoC,QAAQE,IAAI,EACZQ;IAEF,MAAME,oBAAoBD,gBAAgBE,OAAO,CAACb,QAAQE,IAAI,GAAG,KAAK;IACtE,MAAMY,UAAUlD,kBAAkB,QAAQoC,QAAQE,IAAI;IAEtD,MAAMa,QAAQhB,QAAQgB,KAAK,IAAI;IAE/B,IAAIA,UAAU,UAAUhB,QAAQiB,IAAI,IAAIjB,QAAQiB,IAAI,KAAK,OAAO;QAC9DC,QAAQC,IAAI,CACV;IAEJ;IAEA,MAAMF,OAAOjB,QAAQiB,IAAI,IAAI;IAE7B,MAAMG,yBAAyBvD,kBAC7BoC,QAAQE,IAAI,EACZ;IAGF,yEAAyE;IACzE,4EAA4E;IAC5E,yEAAyE;IACzE,MAAMkB,MAAMtB,KAAKG,MAAM,CAACkB,0BACpBrD,SAASgC,MAAMqB,wBAAwBE,IAAI,KAAK,WAChDzC,eAAekB;IAEnB,0BAA0B;IAC1BnC,cACEmC,MACAlC,kBAAkB,YAAY0D,OAAO,EAAE,UACvCX,iBACA;QACEN;QACAe;QACAN;QACAS,aACE9B,WAAW,CAAC,yDAAyD;QACvE+B,eAAehC,YAAYiC,IAAI;QAC/BC,YAAYjC,YAAYkC,GAAG;IAC7B,GACA;QAAEC,mBAAmB/D,kBAAkBgE,YAAY;IAAC;IAGtD,mBAAmB;IACnB,MAAMC,OAAOpC,aAAa;QACxB;QACA;QACA;QACA;QACA;KACD;IACD,MAAMqC,UAAUrC,aAAa;QAC3B;QACA;QACA;KACD;IAED,6BAA6B;IAC7B,IAAIqB,UAAU,aAAa;QACzB,MAAMiB,aAAa,MAAM3D,kBAAkByB,MAAM;QACjD,MAAMmC,iBAAiB,GAAGlD,YAAYe,MAAM,CAAC,EAAEO,KAAK,OAAO,CAAC;QAE5D,oBAAoB;QACpB,MAAMjC,0BAA0B0B,MAAME,SAAS;YAC7CkC,gBAAgB,GAAGxB,qCAAqC,QAAQ,CAAC;YACjEyB,iBAAiBvE,kBAAkB,OAAOyC;QAC5C;QAEA,MAAM+B,kBAAkBxE,kBACtB,QACAoC,QAAQE,IAAI,EACZ,UACA,OACAG;QAEF,MAAMgC,mBAAmB,GAAG5B,gBAAgB,OAAO,CAAC;QAEpD,MAAM6B,KAAK,IAAI9D,WAAWsB;QAC1BE,QAAQuC,OAAO,CAACF,iBAAiB,GAAG;YAClCG,OAAO;YACPC,SAAS;gBAAC,CAAC,gBAAgB,EAAEL,gBAAgB,WAAW,CAAC;aAAC;YAC1DM,UAAU;YACV3C,SAAS;gBACP4C,UAAU;oBACRL,GAAGM,EAAE,CACH,GAAGjC,gBAAgB,WAAW,CAAC,EAC/B,GAAGyB,gBAAgB,WAAW,CAAC;oBAEjC,GAAGJ,WAAW,iCAAiC,EAAEC,eAAe,CAAC,EAAEG,iBAAiB;iBACrF;gBACDS,UAAU;YACZ;YACAC,WAAW;gBAAC;aAAS;QACvB;QAEA5D,kCAAkCc,SAAS,UAAUqC;QACrDnD,kCAAkCc,SAAS,SAAS;QAEpD1B,oBAAoBwB,MAAM;YACxBE;YACA+C,iBAAiBf;YACjBgB,iBAAiB,GAAGvC,gBAAgB,MAAM,CAAC;YAC3C4B;YACAY,WAAW;gBAAChB;aAAe;QAC7B;QAEA,wBAAwB;QACxB,MAAMiB,MAAM,MAAMzE,WAAWqB,MAAMC,QAAQmD,GAAG;QAC9C,MAAM3D,0BAA0BO,MAAM;YAAEoD;QAAI;QAE5C,6CAA6C;QAC7C,MAAM/E,kBAAkB2B,MAAM;YAC5BqD,wBAAwB9C;YACxBG;YACA4C,aAAapD,QAAQK,IAAI;YACzB4B;YACAG;YACAc;YACAlC;YACAgB;QACF;IACF,OAAO;QACL,0CAA0C;QAC1ClC,KAAKuD,MAAM,CAACzF,kBAAkB+C,iBAAiB;IACjD;IAEAlD,6BAA6BqC,MAAMgC,MAAMC;IACzC,yEAAyE;IACzE,0DAA0D;IAC1D,IAAIjC,KAAKG,MAAM,CAACkB,yBAAyB;QACvC1D,6BAA6BqC,MAAMgC,MAAMC,SAASZ;IACpD;IAEA,gFAAgF;IAChF,mFAAmF;IACnF,oFAAoF;IACpF,6EAA6E;IAC7E,6EAA6E;IAC7E,kFAAkF;IAClF,IAAIzD,2BAA2B,QAAQ;QACrCK,WAAW+B,MAAM,gBAAgB,CAACwD;YAChCA,YAAYC,WAAW,GAAG;gBACxB,GAAGD,YAAYC,WAAW;gBAC1B,oCAAoC9D,WAAW,CAAC,MAAM;YACxD;YACA,OAAO6D;QACT;IACF;IAEA,MAAME,eAAelE,WAAWQ,MAAME,SAAS,MAAM;QACnDyD,WAAW;YAAEC,MAAM/D;YAA8BU,MAAMI;QAAgB;IACzE;IAEA,MAAMkD,aAAa;QACjB,GAAG3D,QAAQuC,OAAO;QAClB,yCAAyC;QACzC,CAAC,GAAG9B,gBAAgB,YAAY,CAAC,CAAC,EAAE;YAClCiC,UAAU;YACVkB,YAAY;YACZ7D,SAAS;gBACP4C,UAAU;oBAAC,CAAC,YAAY,EAAE/B,kBAAkB,SAAS,CAAC;iBAAC;gBACvDiD,KAAK;YACP;QACF;QACA,CAAC,GAAGpD,gBAAgB,MAAM,CAAC,CAAC,EAAE;YAC5BiC,UAAU;YACVkB,YAAY;YACZ7D,SAAS;gBACP4C,UAAU;oBAAC,CAAC,YAAY,EAAE/B,kBAAkB,QAAQ,CAAC;iBAAC;gBACtDiD,KAAK;gBACLC,KAAK;oBACHC,MAAM,GAAGP,cAAc;gBACzB;YACF;QACF;QACA,CAAC,GAAG/C,gBAAgB,IAAI,CAAC,CAAC,EAAE;YAC1BiC,UAAU;YACVkB,YAAY;YACZ7D,SAAS;gBACP4C,UAAU;oBAAC,CAAC,YAAY,EAAE/B,kBAAkB,QAAQ,CAAC;iBAAC;gBACtDiD,KAAK;gBACLC,KAAK;oBACHC,MAAM,GAAGP,cAAc;oBACvBQ,WAAW;gBACb;YACF;QACF;QACA,CAAC,GAAGvD,gBAAgB,QAAQ,CAAC,CAAC,EAAE;YAC9BiC,UAAU;YACVkB,YAAY;YACZ,uEAAuE;YACvE,wEAAwE;YACxE,aAAa;YACbd,WAAW;gBAAC,GAAGrC,gBAAgB,IAAI,CAAC;aAAC;YACrCV,SAAS;gBACP4C,UAAU;oBACR,CAAC,6DAA6D,EAAEa,aAAa,IAAI,CAAC;iBACnF;gBACDK,KAAK;YACP;QACF;QACA,CAAC,GAAGpD,gBAAgB,cAAc,CAAC,CAAC,EAAE;YACpCiC,UAAU;YACVkB,YAAY;YACZ7D,SAAS;gBACP4C,UAAU;oBACR,CAAC,6BAA6B,EAAE/B,kBAAkB,SAAS,CAAC;iBAC7D;gBACDiD,KAAK;YACP;QACF;IACF;IAEA,8DAA8D;IAC9D7E,sBAAsB2E,YAAY,GAAGlD,gBAAgB,IAAI,CAAC;IAE1DzC,2BAA2B8B,MAAME,QAAQK,IAAI,EAAE;QAC7C,GAAGL,OAAO;QACV,yEAAyE;QACzE,uBAAuB;QACvBuC,SAASlD,eAAesE;IAC1B;IAEA1E,8BACEa,MACAE,QAAQK,IAAI,EACZV,8BACAe,sCACAD,iBACA;QACEwD,MAAMT;QACNU,IAAI1D;QACJQ;IACF;IAGF,MAAMrC,gCAAgCmB,MAAM;QAACH;KAA6B;IAE1E,MAAM1B,wBAAwB6B,MAAM5B;IAEpC,MAAMK,qBAAqBuB;IAC3B,OAAO,IACLpB,oBAAoBoB,MAAMC,QAAQoE,yBAAyB,EAAE;YAC3DC,WAAW;gBAAC;aAAa;QAC3B;AACJ,EAAE;AAEF,eAAevE,qBAAqB"}

package/src/ts/rdb/__snapshots__/generator.spec.ts.snap

@@ -4598,9 +4598,16 @@ export default defineConfig({
 exports[`ts#rdb generator > should generate the aurora shared construct 4`] = `
 "FROM public.ecr.aws/lambda/nodejs:24
 
+# Upgrade npm to a version free of known HIGH/CRITICAL vulnerabilities
+RUN npm install -g npm@12.0.1
+
 WORKDIR \${LAMBDA_TASK_ROOT}
 
-RUN npm install prisma@7.8.0
+# npm blocks dependency install scripts by default; allow prisma's so its
+# postinstall downloads the schema-engine binary needed to run migrations.
+RUN printf 'allow-scripts[]=prisma\\nallow-scripts[]=@prisma/engines\\n' > .npmrc \\
+    && npm install prisma@7.8.0 \\
+    && rm .npmrc
 
 COPY index.js ./index.js
 COPY prisma ./prisma

package/src/ts/rdb/files/Dockerfile.template

@@ -1,8 +1,15 @@
 FROM public.ecr.aws/lambda/nodejs:24
 
+# Upgrade npm to a version free of known HIGH/CRITICAL vulnerabilities
+RUN npm install -g npm@<%= npmVersion %>
+
 WORKDIR ${LAMBDA_TASK_ROOT}
 
-RUN npm install prisma@<%= prismaVersion %>
+# npm blocks dependency install scripts by default; allow prisma's so its
+# postinstall downloads the schema-engine binary needed to run migrations.
+RUN printf 'allow-scripts[]=prisma\nallow-scripts[]=@prisma/engines\n' > .npmrc \
+    && npm install prisma@<%= prismaVersion %> \
+    && rm .npmrc
 
 COPY index.js ./index.js
 COPY prisma ./prisma

package/src/ts/rdb/generator.js

@@ -5,6 +5,7 @@
 import { addDependenciesToPackageJson, generateFiles, joinPathFragments, readProjectConfiguration, updateJson, updateProjectConfiguration } from "@nx/devkit";
 import { addTypeScriptBundleTarget } from "../../utils/bundle/bundle.js";
 import { resolveContainers } from "../../utils/containers.js";
+import { addDockerScanTarget } from "../../utils/docker.js";
 import { formatFilesInSubtree } from "../../utils/format.js";
 import { FsCommands } from "../../utils/fs.js";
 import { updateGitIgnore } from "../../utils/git.js";
@@ -70,6 +71,7 @@ export const tsRdbGenerator = async (tree, options)=>{
         databasePackageAlias: toScopeAlias(fullyQualifiedName),
         databaseProvider: options.engine === 'mysql' ? 'mysql' : 'postgresql',
         prismaVersion: TS_VERSIONS.prisma,
+        npmVersion: TS_VERSIONS.npm,
         prismaAdapterPackage: options.engine === 'mysql' ? '@prisma/adapter-mariadb' : '@prisma/adapter-pg',
         prismaAdapterClassName: options.engine === 'mysql' ? 'PrismaMariaDb' : 'PrismaPg',
         localDbPort,
@@ -187,6 +189,15 @@ export const tsRdbGenerator = async (tree, options)=>{
                 ]
             };
             addDependencyToTargetIfNotPresent(projectConfig, 'build', 'docker');
+            addDockerScanTarget(tree, {
+                project: projectConfig,
+                containerEngine,
+                trivyTargetName: 'trivy',
+                dockerTargetName: 'docker',
+                imageTags: [
+                    migrationDockerImageTag
+                ]
+            });
         }
         addDependencyToTargetIfNotPresent(projectConfig, 'build', 'bundle');
     }

package/src/ts/rdb/generator.js.map

@@ -1 +1 @@
-{"version":3,"sources":["../../../../../../packages/nx-plugin/src/ts/rdb/generator.ts"],"sourcesContent":["/**\n * Copyright Amazon.com, Inc. or its affiliates. All Rights Reserved.\n * SPDX-License-Identifier: Apache-2.0\n */\nimport { relative } from 'node:path';\nimport {\n  addDependenciesToPackageJson,\n  type GeneratorCallback,\n  generateFiles,\n  joinPathFragments,\n  readProjectConfiguration,\n  type Tree,\n  updateJson,\n  updateProjectConfiguration,\n} from '@nx/devkit';\nimport { addTypeScriptBundleTarget } from '../../utils/bundle/bundle';\nimport { resolveContainers } from '../../utils/containers';\nimport { formatFilesInSubtree } from '../../utils/format';\nimport { FsCommands } from '../../utils/fs';\nimport { updateGitIgnore } from '../../utils/git';\nimport { resolveIac } from '../../utils/iac';\nimport { installDependencies } from '../../utils/install';\nimport { addGeneratorMetricsIfApplicable } from '../../utils/metrics';\nimport { esmVars } from '../../utils/module-format';\nimport { kebabCase, snakeCase, toClassName } from '../../utils/names';\nimport { getNpmScope, toScopeAlias } from '../../utils/npm-scope';\nimport {\n  addDependencyToTargetIfNotPresent,\n  addGeneratorMetadata,\n  getGeneratorInfo,\n  type NxGeneratorInfo,\n} from '../../utils/nx';\nimport { getRelativePathToRootByDirectory } from '../../utils/paths';\nimport { registerPnpmBuiltDependencies } from '../../utils/pnpm-workspace';\nimport { assignPort } from '../../utils/port';\nimport { addRdbInfra } from '../../utils/rdb-constructs/rdb-constructs';\nimport { sharedConstructsGenerator } from '../../utils/shared-constructs';\nimport {\n  PACKAGES_DIR,\n  SHARED_SCRIPTS_DIR,\n} from '../../utils/shared-constructs-constants';\nimport { sharedRdbScriptsGenerator } from '../../utils/shared-rdb-scripts';\nimport { TS_VERSIONS, withVersions } from '../../utils/versions';\nimport tsProjectGenerator, { getTsLibDetails } from '../lib/generator';\nimport type { TsRdbGeneratorSchema } from './schema';\n\nexport const TS_RDB_GENERATOR_INFO: NxGeneratorInfo = getGeneratorInfo(\n  import.meta.filename,\n);\n\nexport const tsRdbGenerator = async (\n  tree: Tree,\n  options: TsRdbGeneratorSchema,\n): Promise<GeneratorCallback> => {\n  const nameKebabCase = kebabCase(options.name);\n  const nameClassName = toClassName(options.name);\n  const databaseUser = options.databaseUser ?? 'dbadmin';\n  const databaseName = snakeCase(options.databaseName ?? options.name);\n  const containerEngine = await resolveContainers(tree, 'inherit');\n  const { fullyQualifiedName, dir } = getTsLibDetails(tree, {\n    name: options.name,\n    directory: options.directory,\n    subDirectory: options.subDirectory,\n  });\n\n  let projectExists: boolean;\n  try {\n    readProjectConfiguration(tree, fullyQualifiedName);\n    projectExists = true;\n  } catch {\n    projectExists = false;\n  }\n\n  if (!projectExists) {\n    await tsProjectGenerator(tree, {\n      name: options.name,\n      directory: options.directory,\n      preferInstallDependencies: false,\n    });\n  }\n\n  updateJson(tree, joinPathFragments(dir, 'tsconfig.lib.json'), (tsConfig) => ({\n    ...tsConfig,\n    include: ['src/**/*.ts', 'generated/prisma/**/*.ts'],\n  }));\n\n  const projectConfig = readProjectConfiguration(tree, fullyQualifiedName);\n  const localDbPort = assignPort(\n    tree,\n    projectConfig,\n    options.engine === 'mysql' ? 3306 : 5432,\n  );\n  const localDbHost = 'localhost';\n  const localDbUser = options.engine === 'mysql' ? 'root' : 'dbadmin';\n  const localDbPassword = 'password';\n  const containerName = `${getNpmScope(tree)}-${databaseName}`;\n  const dockerImage =\n    options.engine === 'mysql'\n      ? 'public.ecr.aws/docker/library/mysql:8.0.44'\n      : 'public.ecr.aws/docker/library/postgres:17.7';\n\n  const templateOptions = {\n    engine: options.engine,\n    runtimeConfigKey: nameClassName,\n    databasePackageAlias: toScopeAlias(fullyQualifiedName),\n    databaseProvider: options.engine === 'mysql' ? 'mysql' : 'postgresql',\n    prismaVersion: TS_VERSIONS.prisma,\n    prismaAdapterPackage:\n      options.engine === 'mysql'\n        ? '@prisma/adapter-mariadb'\n        : '@prisma/adapter-pg',\n    prismaAdapterClassName:\n      options.engine === 'mysql' ? 'PrismaMariaDb' : 'PrismaPg',\n    localDbPort,\n    localDbHost,\n    localDbName: databaseName,\n    localDbUser,\n    localDbPassword,\n    containerEngine,\n    containerName,\n    dockerImage,\n    ...esmVars(tree),\n  };\n\n  generateFiles(\n    tree,\n    joinPathFragments(import.meta.dirname, 'files'),\n    dir,\n    templateOptions,\n  );\n  updateGitIgnore(tree, dir, (patterns) => [...patterns, 'generated/prisma']);\n  await sharedRdbScriptsGenerator(tree, options.engine);\n  const waitForDbScript =\n    options.engine === 'mysql'\n      ? 'wait-for-mysql-db.ts'\n      : 'wait-for-postgres-db.ts';\n  const scriptsDir = relative(\n    dir,\n    joinPathFragments(PACKAGES_DIR, SHARED_SCRIPTS_DIR, 'src', 'rdb'),\n  );\n  const relativePathToRoot = getRelativePathToRootByDirectory(\n    projectConfig.root,\n  );\n  const fs = new FsCommands(tree);\n  const migrationBundleDir = joinPathFragments(\n    'dist',\n    projectConfig.root,\n    'bundle',\n    'migration',\n  );\n  const migrationDockerImageTag = `${getNpmScope(tree)}-${kebabCase(options.name)}-migration:latest`;\n\n  if (options.infra !== 'none') {\n    await addTypeScriptBundleTarget(tree, projectConfig, {\n      targetFilePath: 'src/migration-handler.ts',\n      bundleOutputDir: 'migration',\n    });\n    await addTypeScriptBundleTarget(tree, projectConfig, {\n      targetFilePath: 'src/create-db-user-handler.ts',\n      bundleOutputDir: 'create-db-user',\n    });\n    const bundleTarget = projectConfig.targets['bundle'];\n    // The bundle target starts with a single rolldown `command`. Wrap it with\n    // the migration asset copy steps, unless it has already been transformed\n    // into a `commands` array on a previous run.\n    if (!bundleTarget.options.commands) {\n      const rolldownCommand = bundleTarget.options.command;\n      delete bundleTarget.options.command;\n      bundleTarget.options = {\n        ...bundleTarget.options,\n        commands: [\n          fs.rm(`${relativePathToRoot}dist/{projectRoot}/bundle/migration`),\n          fs.mkdir(`${relativePathToRoot}dist/{projectRoot}/bundle/migration`),\n          fs.cp(\n            'prisma',\n            `${relativePathToRoot}dist/{projectRoot}/bundle/migration/prisma`,\n          ),\n          fs.cp(\n            'prisma.config.ts',\n            `${relativePathToRoot}dist/{projectRoot}/bundle/migration/prisma.config.ts`,\n          ),\n          fs.cp(\n            'Dockerfile',\n            `${relativePathToRoot}dist/{projectRoot}/bundle/migration/Dockerfile`,\n          ),\n          rolldownCommand,\n        ],\n        parallel: false,\n      };\n    }\n  }\n\n  projectConfig.targets.generate = {\n    executor: 'nx:run-commands',\n    outputs: ['{projectRoot}/generated/prisma'],\n    options: {\n      command: 'prisma generate',\n      cwd: '{projectRoot}',\n    },\n  };\n  projectConfig.targets['pull-image'] = {\n    executor: 'nx:run-commands',\n    options: {\n      command: `tsx ${scriptsDir}/pull-image.ts`,\n      cwd: '{projectRoot}',\n    },\n  };\n  projectConfig.targets['dev'] = {\n    executor: 'nx:run-commands',\n    options: {\n      command: `tsx ${scriptsDir}/start-container.ts`,\n      cwd: '{projectRoot}',\n    },\n    continuous: true,\n  };\n  projectConfig.targets['wait-for-db'] = {\n    executor: 'nx:run-commands',\n    dependsOn: ['dev'],\n    options: {\n      command: `tsx ${scriptsDir}/${waitForDbScript}`,\n      cwd: '{projectRoot}',\n    },\n  };\n  projectConfig.targets.prisma = {\n    executor: 'nx:run-commands',\n    dependsOn: ['dev', 'wait-for-db'],\n    options: {\n      cwd: '{projectRoot}',\n      command: 'prisma',\n      env: {\n        LOCAL_DEV: 'true',\n      },\n    },\n  };\n  if (options.infra !== 'none') {\n    const iac = await resolveIac(tree, options.iac);\n    if (iac === 'terraform') {\n      projectConfig.targets['docker'] = {\n        cache: true,\n        executor: 'nx:run-commands',\n        options: {\n          command: `${containerEngine} build --platform linux/arm64 --provenance=false -t ${migrationDockerImageTag} ${migrationBundleDir}`,\n        },\n        dependsOn: ['bundle'],\n      };\n      addDependencyToTargetIfNotPresent(projectConfig, 'build', 'docker');\n    }\n    addDependencyToTargetIfNotPresent(projectConfig, 'build', 'bundle');\n  }\n  addDependencyToTargetIfNotPresent(projectConfig, 'compile', 'generate');\n  updateProjectConfiguration(tree, fullyQualifiedName, projectConfig);\n  addGeneratorMetadata(tree, fullyQualifiedName, TS_RDB_GENERATOR_INFO, {\n    engine: options.engine,\n  });\n\n  if (options.infra !== 'none') {\n    const iac = await resolveIac(tree, options.iac);\n    await sharedConstructsGenerator(tree, { iac });\n    await addRdbInfra(tree, {\n      iac,\n      projectName: fullyQualifiedName,\n      projectRoot: dir,\n      nameClassName,\n      nameKebabCase,\n      databasePackageAlias: toScopeAlias(fullyQualifiedName),\n      databaseName,\n      adminUser: databaseUser,\n      engine: options.engine,\n      migrationBundleDir,\n      createDbUserBundleDir: joinPathFragments(\n        'dist',\n        projectConfig.root,\n        'bundle',\n        'create-db-user',\n      ),\n      framework: options.framework,\n      migrationDockerImageTag,\n      containerEngine,\n    });\n  }\n\n  addDependenciesToPackageJson(\n    tree,\n    withVersions([\n      '@aws-lambda-powertools/parameters',\n      '@aws-sdk/client-appconfigdata',\n      '@aws-sdk/client-secrets-manager',\n      '@aws-sdk/rds-signer',\n      '@prisma/client',\n      ...(options.engine === 'mysql'\n        ? (['@prisma/adapter-mariadb', 'mariadb'] as const)\n        : (['@prisma/adapter-pg', 'pg'] as const)),\n    ]),\n    withVersions([\n      'prisma',\n      'tsx',\n      '@types/aws-lambda',\n      ...(options.engine === 'mysql'\n        ? ([] as const)\n        : (['@types/pg'] as const)),\n    ]),\n  );\n\n  registerPnpmBuiltDependencies(tree, {\n    '@prisma/engines': false,\n    prisma: false,\n  });\n\n  await addGeneratorMetricsIfApplicable(tree, [TS_RDB_GENERATOR_INFO]);\n\n  await formatFilesInSubtree(tree);\n  return () =>\n    installDependencies(tree, options.preferInstallDependencies, {\n      languages: ['typescript'],\n    });\n};\n\nexport default tsRdbGenerator;\n"],"names":["relative","addDependenciesToPackageJson","generateFiles","joinPathFragments","readProjectConfiguration","updateJson","updateProjectConfiguration","addTypeScriptBundleTarget","resolveContainers","formatFilesInSubtree","FsCommands","updateGitIgnore","resolveIac","installDependencies","addGeneratorMetricsIfApplicable","esmVars","kebabCase","snakeCase","toClassName","getNpmScope","toScopeAlias","addDependencyToTargetIfNotPresent","addGeneratorMetadata","getGeneratorInfo","getRelativePathToRootByDirectory","registerPnpmBuiltDependencies","assignPort","addRdbInfra","sharedConstructsGenerator","PACKAGES_DIR","SHARED_SCRIPTS_DIR","sharedRdbScriptsGenerator","TS_VERSIONS","withVersions","tsProjectGenerator","getTsLibDetails","TS_RDB_GENERATOR_INFO","filename","tsRdbGenerator","tree","options","nameKebabCase","name","nameClassName","databaseUser","databaseName","containerEngine","fullyQualifiedName","dir","directory","subDirectory","projectExists","preferInstallDependencies","tsConfig","include","projectConfig","localDbPort","engine","localDbHost","localDbUser","localDbPassword","containerName","dockerImage","templateOptions","runtimeConfigKey","databasePackageAlias","databaseProvider","prismaVersion","prisma","prismaAdapterPackage","prismaAdapterClassName","localDbName","dirname","patterns","waitForDbScript","scriptsDir","relativePathToRoot","root","fs","migrationBundleDir","migrationDockerImageTag","infra","targetFilePath","bundleOutputDir","bundleTarget","targets","commands","rolldownCommand","command","rm","mkdir","cp","parallel","generate","executor","outputs","cwd","continuous","dependsOn","env","LOCAL_DEV","iac","cache","projectName","projectRoot","adminUser","createDbUserBundleDir","framework","languages"],"mappings":"AAAA;;;CAGC,GACD,SAASA,QAAQ,QAAQ,YAAY;AACrC,SACEC,4BAA4B,EAE5BC,aAAa,EACbC,iBAAiB,EACjBC,wBAAwB,EAExBC,UAAU,EACVC,0BAA0B,QACrB,aAAa;AACpB,SAASC,yBAAyB,QAAQ,+BAA4B;AACtE,SAASC,iBAAiB,QAAQ,4BAAyB;AAC3D,SAASC,oBAAoB,QAAQ,wBAAqB;AAC1D,SAASC,UAAU,QAAQ,oBAAiB;AAC5C,SAASC,eAAe,QAAQ,qBAAkB;AAClD,SAASC,UAAU,QAAQ,qBAAkB;AAC7C,SAASC,mBAAmB,QAAQ,yBAAsB;AAC1D,SAASC,+BAA+B,QAAQ,yBAAsB;AACtE,SAASC,OAAO,QAAQ,+BAA4B;AACpD,SAASC,SAAS,EAAEC,SAAS,EAAEC,WAAW,QAAQ,uBAAoB;AACtE,SAASC,WAAW,EAAEC,YAAY,QAAQ,2BAAwB;AAClE,SACEC,iCAAiC,EACjCC,oBAAoB,EACpBC,gBAAgB,QAEX,oBAAiB;AACxB,SAASC,gCAAgC,QAAQ,uBAAoB;AACrE,SAASC,6BAA6B,QAAQ,gCAA6B;AAC3E,SAASC,UAAU,QAAQ,sBAAmB;AAC9C,SAASC,WAAW,QAAQ,+CAA4C;AACxE,SAASC,yBAAyB,QAAQ,mCAAgC;AAC1E,SACEC,YAAY,EACZC,kBAAkB,QACb,6CAA0C;AACjD,SAASC,yBAAyB,QAAQ,oCAAiC;AAC3E,SAASC,WAAW,EAAEC,YAAY,QAAQ,0BAAuB;AACjE,OAAOC,sBAAsBC,eAAe,QAAQ,sBAAmB;AAGvE,OAAO,MAAMC,wBAAyCb,iBACpD,YAAYc,QAAQ,EACpB;AAEF,OAAO,MAAMC,iBAAiB,OAC5BC,MACAC;IAEA,MAAMC,gBAAgBzB,UAAUwB,QAAQE,IAAI;IAC5C,MAAMC,gBAAgBzB,YAAYsB,QAAQE,IAAI;IAC9C,MAAME,eAAeJ,QAAQI,YAAY,IAAI;IAC7C,MAAMC,eAAe5B,UAAUuB,QAAQK,YAAY,IAAIL,QAAQE,IAAI;IACnE,MAAMI,kBAAkB,MAAMtC,kBAAkB+B,MAAM;IACtD,MAAM,EAAEQ,kBAAkB,EAAEC,GAAG,EAAE,GAAGb,gBAAgBI,MAAM;QACxDG,MAAMF,QAAQE,IAAI;QAClBO,WAAWT,QAAQS,SAAS;QAC5BC,cAAcV,QAAQU,YAAY;IACpC;IAEA,IAAIC;IACJ,IAAI;QACF/C,yBAAyBmC,MAAMQ;QAC/BI,gBAAgB;IAClB,EAAE,OAAM;QACNA,gBAAgB;IAClB;IAEA,IAAI,CAACA,eAAe;QAClB,MAAMjB,mBAAmBK,MAAM;YAC7BG,MAAMF,QAAQE,IAAI;YAClBO,WAAWT,QAAQS,SAAS;YAC5BG,2BAA2B;QAC7B;IACF;IAEA/C,WAAWkC,MAAMpC,kBAAkB6C,KAAK,sBAAsB,CAACK,WAAc,CAAA;YAC3E,GAAGA,QAAQ;YACXC,SAAS;gBAAC;gBAAe;aAA2B;QACtD,CAAA;IAEA,MAAMC,gBAAgBnD,yBAAyBmC,MAAMQ;IACrD,MAAMS,cAAc9B,WAClBa,MACAgB,eACAf,QAAQiB,MAAM,KAAK,UAAU,OAAO;IAEtC,MAAMC,cAAc;IACpB,MAAMC,cAAcnB,QAAQiB,MAAM,KAAK,UAAU,SAAS;IAC1D,MAAMG,kBAAkB;IACxB,MAAMC,gBAAgB,GAAG1C,YAAYoB,MAAM,CAAC,EAAEM,cAAc;IAC5D,MAAMiB,cACJtB,QAAQiB,MAAM,KAAK,UACf,+CACA;IAEN,MAAMM,kBAAkB;QACtBN,QAAQjB,QAAQiB,MAAM;QACtBO,kBAAkBrB;QAClBsB,sBAAsB7C,aAAa2B;QACnCmB,kBAAkB1B,QAAQiB,MAAM,KAAK,UAAU,UAAU;QACzDU,eAAenC,YAAYoC,MAAM;QACjCC,sBACE7B,QAAQiB,MAAM,KAAK,UACf,4BACA;QACNa,wBACE9B,QAAQiB,MAAM,KAAK,UAAU,kBAAkB;QACjDD;QACAE;QACAa,aAAa1B;QACbc;QACAC;QACAd;QACAe;QACAC;QACA,GAAG/C,QAAQwB,KAAK;IAClB;IAEArC,cACEqC,MACApC,kBAAkB,YAAYqE,OAAO,EAAE,UACvCxB,KACAe;IAEFpD,gBAAgB4B,MAAMS,KAAK,CAACyB,WAAa;eAAIA;YAAU;SAAmB;IAC1E,MAAM1C,0BAA0BQ,MAAMC,QAAQiB,MAAM;IACpD,MAAMiB,kBACJlC,QAAQiB,MAAM,KAAK,UACf,yBACA;IACN,MAAMkB,aAAa3E,SACjBgD,KACA7C,kBAAkB0B,cAAcC,oBAAoB,OAAO;IAE7D,MAAM8C,qBAAqBpD,iCACzB+B,cAAcsB,IAAI;IAEpB,MAAMC,KAAK,IAAIpE,WAAW6B;IAC1B,MAAMwC,qBAAqB5E,kBACzB,QACAoD,cAAcsB,IAAI,EAClB,UACA;IAEF,MAAMG,0BAA0B,GAAG7D,YAAYoB,MAAM,CAAC,EAAEvB,UAAUwB,QAAQE,IAAI,EAAE,iBAAiB,CAAC;IAElG,IAAIF,QAAQyC,KAAK,KAAK,QAAQ;QAC5B,MAAM1E,0BAA0BgC,MAAMgB,eAAe;YACnD2B,gBAAgB;YAChBC,iBAAiB;QACnB;QACA,MAAM5E,0BAA0BgC,MAAMgB,eAAe;YACnD2B,gBAAgB;YAChBC,iBAAiB;QACnB;QACA,MAAMC,eAAe7B,cAAc8B,OAAO,CAAC,SAAS;QACpD,0EAA0E;QAC1E,yEAAyE;QACzE,6CAA6C;QAC7C,IAAI,CAACD,aAAa5C,OAAO,CAAC8C,QAAQ,EAAE;YAClC,MAAMC,kBAAkBH,aAAa5C,OAAO,CAACgD,OAAO;YACpD,OAAOJ,aAAa5C,OAAO,CAACgD,OAAO;YACnCJ,aAAa5C,OAAO,GAAG;gBACrB,GAAG4C,aAAa5C,OAAO;gBACvB8C,UAAU;oBACRR,GAAGW,EAAE,CAAC,GAAGb,mBAAmB,mCAAmC,CAAC;oBAChEE,GAAGY,KAAK,CAAC,GAAGd,mBAAmB,mCAAmC,CAAC;oBACnEE,GAAGa,EAAE,CACH,UACA,GAAGf,mBAAmB,0CAA0C,CAAC;oBAEnEE,GAAGa,EAAE,CACH,oBACA,GAAGf,mBAAmB,oDAAoD,CAAC;oBAE7EE,GAAGa,EAAE,CACH,cACA,GAAGf,mBAAmB,8CAA8C,CAAC;oBAEvEW;iBACD;gBACDK,UAAU;YACZ;QACF;IACF;IAEArC,cAAc8B,OAAO,CAACQ,QAAQ,GAAG;QAC/BC,UAAU;QACVC,SAAS;YAAC;SAAiC;QAC3CvD,SAAS;YACPgD,SAAS;YACTQ,KAAK;QACP;IACF;IACAzC,cAAc8B,OAAO,CAAC,aAAa,GAAG;QACpCS,UAAU;QACVtD,SAAS;YACPgD,SAAS,CAAC,IAAI,EAAEb,WAAW,cAAc,CAAC;YAC1CqB,KAAK;QACP;IACF;IACAzC,cAAc8B,OAAO,CAAC,MAAM,GAAG;QAC7BS,UAAU;QACVtD,SAAS;YACPgD,SAAS,CAAC,IAAI,EAAEb,WAAW,mBAAmB,CAAC;YAC/CqB,KAAK;QACP;QACAC,YAAY;IACd;IACA1C,cAAc8B,OAAO,CAAC,cAAc,GAAG;QACrCS,UAAU;QACVI,WAAW;YAAC;SAAM;QAClB1D,SAAS;YACPgD,SAAS,CAAC,IAAI,EAAEb,WAAW,CAAC,EAAED,iBAAiB;YAC/CsB,KAAK;QACP;IACF;IACAzC,cAAc8B,OAAO,CAACjB,MAAM,GAAG;QAC7B0B,UAAU;QACVI,WAAW;YAAC;YAAO;SAAc;QACjC1D,SAAS;YACPwD,KAAK;YACLR,SAAS;YACTW,KAAK;gBACHC,WAAW;YACb;QACF;IACF;IACA,IAAI5D,QAAQyC,KAAK,KAAK,QAAQ;QAC5B,MAAMoB,MAAM,MAAMzF,WAAW2B,MAAMC,QAAQ6D,GAAG;QAC9C,IAAIA,QAAQ,aAAa;YACvB9C,cAAc8B,OAAO,CAAC,SAAS,GAAG;gBAChCiB,OAAO;gBACPR,UAAU;gBACVtD,SAAS;oBACPgD,SAAS,GAAG1C,gBAAgB,oDAAoD,EAAEkC,wBAAwB,CAAC,EAAED,oBAAoB;gBACnI;gBACAmB,WAAW;oBAAC;iBAAS;YACvB;YACA7E,kCAAkCkC,eAAe,SAAS;QAC5D;QACAlC,kCAAkCkC,eAAe,SAAS;IAC5D;IACAlC,kCAAkCkC,eAAe,WAAW;IAC5DjD,2BAA2BiC,MAAMQ,oBAAoBQ;IACrDjC,qBAAqBiB,MAAMQ,oBAAoBX,uBAAuB;QACpEqB,QAAQjB,QAAQiB,MAAM;IACxB;IAEA,IAAIjB,QAAQyC,KAAK,KAAK,QAAQ;QAC5B,MAAMoB,MAAM,MAAMzF,WAAW2B,MAAMC,QAAQ6D,GAAG;QAC9C,MAAMzE,0BAA0BW,MAAM;YAAE8D;QAAI;QAC5C,MAAM1E,YAAYY,MAAM;YACtB8D;YACAE,aAAaxD;YACbyD,aAAaxD;YACbL;YACAF;YACAwB,sBAAsB7C,aAAa2B;YACnCF;YACA4D,WAAW7D;YACXa,QAAQjB,QAAQiB,MAAM;YACtBsB;YACA2B,uBAAuBvG,kBACrB,QACAoD,cAAcsB,IAAI,EAClB,UACA;YAEF8B,WAAWnE,QAAQmE,SAAS;YAC5B3B;YACAlC;QACF;IACF;IAEA7C,6BACEsC,MACAN,aAAa;QACX;QACA;QACA;QACA;QACA;WACIO,QAAQiB,MAAM,KAAK,UAClB;YAAC;YAA2B;SAAU,GACtC;YAAC;YAAsB;SAAK;KAClC,GACDxB,aAAa;QACX;QACA;QACA;WACIO,QAAQiB,MAAM,KAAK,UAClB,EAAE,GACF;YAAC;SAAY;KACnB;IAGHhC,8BAA8Bc,MAAM;QAClC,mBAAmB;QACnB6B,QAAQ;IACV;IAEA,MAAMtD,gCAAgCyB,MAAM;QAACH;KAAsB;IAEnE,MAAM3B,qBAAqB8B;IAC3B,OAAO,IACL1B,oBAAoB0B,MAAMC,QAAQY,yBAAyB,EAAE;YAC3DwD,WAAW;gBAAC;aAAa;QAC3B;AACJ,EAAE;AAEF,eAAetE,eAAe"}
+{"version":3,"sources":["../../../../../../packages/nx-plugin/src/ts/rdb/generator.ts"],"sourcesContent":["/**\n * Copyright Amazon.com, Inc. or its affiliates. All Rights Reserved.\n * SPDX-License-Identifier: Apache-2.0\n */\nimport { relative } from 'node:path';\nimport {\n  addDependenciesToPackageJson,\n  type GeneratorCallback,\n  generateFiles,\n  joinPathFragments,\n  readProjectConfiguration,\n  type Tree,\n  updateJson,\n  updateProjectConfiguration,\n} from '@nx/devkit';\nimport { addTypeScriptBundleTarget } from '../../utils/bundle/bundle';\nimport { resolveContainers } from '../../utils/containers';\nimport { addDockerScanTarget } from '../../utils/docker';\nimport { formatFilesInSubtree } from '../../utils/format';\nimport { FsCommands } from '../../utils/fs';\nimport { updateGitIgnore } from '../../utils/git';\nimport { resolveIac } from '../../utils/iac';\nimport { installDependencies } from '../../utils/install';\nimport { addGeneratorMetricsIfApplicable } from '../../utils/metrics';\nimport { esmVars } from '../../utils/module-format';\nimport { kebabCase, snakeCase, toClassName } from '../../utils/names';\nimport { getNpmScope, toScopeAlias } from '../../utils/npm-scope';\nimport {\n  addDependencyToTargetIfNotPresent,\n  addGeneratorMetadata,\n  getGeneratorInfo,\n  type NxGeneratorInfo,\n} from '../../utils/nx';\nimport { getRelativePathToRootByDirectory } from '../../utils/paths';\nimport { registerPnpmBuiltDependencies } from '../../utils/pnpm-workspace';\nimport { assignPort } from '../../utils/port';\nimport { addRdbInfra } from '../../utils/rdb-constructs/rdb-constructs';\nimport { sharedConstructsGenerator } from '../../utils/shared-constructs';\nimport {\n  PACKAGES_DIR,\n  SHARED_SCRIPTS_DIR,\n} from '../../utils/shared-constructs-constants';\nimport { sharedRdbScriptsGenerator } from '../../utils/shared-rdb-scripts';\nimport { TS_VERSIONS, withVersions } from '../../utils/versions';\nimport tsProjectGenerator, { getTsLibDetails } from '../lib/generator';\nimport type { TsRdbGeneratorSchema } from './schema';\n\nexport const TS_RDB_GENERATOR_INFO: NxGeneratorInfo = getGeneratorInfo(\n  import.meta.filename,\n);\n\nexport const tsRdbGenerator = async (\n  tree: Tree,\n  options: TsRdbGeneratorSchema,\n): Promise<GeneratorCallback> => {\n  const nameKebabCase = kebabCase(options.name);\n  const nameClassName = toClassName(options.name);\n  const databaseUser = options.databaseUser ?? 'dbadmin';\n  const databaseName = snakeCase(options.databaseName ?? options.name);\n  const containerEngine = await resolveContainers(tree, 'inherit');\n  const { fullyQualifiedName, dir } = getTsLibDetails(tree, {\n    name: options.name,\n    directory: options.directory,\n    subDirectory: options.subDirectory,\n  });\n\n  let projectExists: boolean;\n  try {\n    readProjectConfiguration(tree, fullyQualifiedName);\n    projectExists = true;\n  } catch {\n    projectExists = false;\n  }\n\n  if (!projectExists) {\n    await tsProjectGenerator(tree, {\n      name: options.name,\n      directory: options.directory,\n      preferInstallDependencies: false,\n    });\n  }\n\n  updateJson(tree, joinPathFragments(dir, 'tsconfig.lib.json'), (tsConfig) => ({\n    ...tsConfig,\n    include: ['src/**/*.ts', 'generated/prisma/**/*.ts'],\n  }));\n\n  const projectConfig = readProjectConfiguration(tree, fullyQualifiedName);\n  const localDbPort = assignPort(\n    tree,\n    projectConfig,\n    options.engine === 'mysql' ? 3306 : 5432,\n  );\n  const localDbHost = 'localhost';\n  const localDbUser = options.engine === 'mysql' ? 'root' : 'dbadmin';\n  const localDbPassword = 'password';\n  const containerName = `${getNpmScope(tree)}-${databaseName}`;\n  const dockerImage =\n    options.engine === 'mysql'\n      ? 'public.ecr.aws/docker/library/mysql:8.0.44'\n      : 'public.ecr.aws/docker/library/postgres:17.7';\n\n  const templateOptions = {\n    engine: options.engine,\n    runtimeConfigKey: nameClassName,\n    databasePackageAlias: toScopeAlias(fullyQualifiedName),\n    databaseProvider: options.engine === 'mysql' ? 'mysql' : 'postgresql',\n    prismaVersion: TS_VERSIONS.prisma,\n    npmVersion: TS_VERSIONS.npm,\n    prismaAdapterPackage:\n      options.engine === 'mysql'\n        ? '@prisma/adapter-mariadb'\n        : '@prisma/adapter-pg',\n    prismaAdapterClassName:\n      options.engine === 'mysql' ? 'PrismaMariaDb' : 'PrismaPg',\n    localDbPort,\n    localDbHost,\n    localDbName: databaseName,\n    localDbUser,\n    localDbPassword,\n    containerEngine,\n    containerName,\n    dockerImage,\n    ...esmVars(tree),\n  };\n\n  generateFiles(\n    tree,\n    joinPathFragments(import.meta.dirname, 'files'),\n    dir,\n    templateOptions,\n  );\n  updateGitIgnore(tree, dir, (patterns) => [...patterns, 'generated/prisma']);\n  await sharedRdbScriptsGenerator(tree, options.engine);\n  const waitForDbScript =\n    options.engine === 'mysql'\n      ? 'wait-for-mysql-db.ts'\n      : 'wait-for-postgres-db.ts';\n  const scriptsDir = relative(\n    dir,\n    joinPathFragments(PACKAGES_DIR, SHARED_SCRIPTS_DIR, 'src', 'rdb'),\n  );\n  const relativePathToRoot = getRelativePathToRootByDirectory(\n    projectConfig.root,\n  );\n  const fs = new FsCommands(tree);\n  const migrationBundleDir = joinPathFragments(\n    'dist',\n    projectConfig.root,\n    'bundle',\n    'migration',\n  );\n  const migrationDockerImageTag = `${getNpmScope(tree)}-${kebabCase(options.name)}-migration:latest`;\n\n  if (options.infra !== 'none') {\n    await addTypeScriptBundleTarget(tree, projectConfig, {\n      targetFilePath: 'src/migration-handler.ts',\n      bundleOutputDir: 'migration',\n    });\n    await addTypeScriptBundleTarget(tree, projectConfig, {\n      targetFilePath: 'src/create-db-user-handler.ts',\n      bundleOutputDir: 'create-db-user',\n    });\n    const bundleTarget = projectConfig.targets['bundle'];\n    // The bundle target starts with a single rolldown `command`. Wrap it with\n    // the migration asset copy steps, unless it has already been transformed\n    // into a `commands` array on a previous run.\n    if (!bundleTarget.options.commands) {\n      const rolldownCommand = bundleTarget.options.command;\n      delete bundleTarget.options.command;\n      bundleTarget.options = {\n        ...bundleTarget.options,\n        commands: [\n          fs.rm(`${relativePathToRoot}dist/{projectRoot}/bundle/migration`),\n          fs.mkdir(`${relativePathToRoot}dist/{projectRoot}/bundle/migration`),\n          fs.cp(\n            'prisma',\n            `${relativePathToRoot}dist/{projectRoot}/bundle/migration/prisma`,\n          ),\n          fs.cp(\n            'prisma.config.ts',\n            `${relativePathToRoot}dist/{projectRoot}/bundle/migration/prisma.config.ts`,\n          ),\n          fs.cp(\n            'Dockerfile',\n            `${relativePathToRoot}dist/{projectRoot}/bundle/migration/Dockerfile`,\n          ),\n          rolldownCommand,\n        ],\n        parallel: false,\n      };\n    }\n  }\n\n  projectConfig.targets.generate = {\n    executor: 'nx:run-commands',\n    outputs: ['{projectRoot}/generated/prisma'],\n    options: {\n      command: 'prisma generate',\n      cwd: '{projectRoot}',\n    },\n  };\n  projectConfig.targets['pull-image'] = {\n    executor: 'nx:run-commands',\n    options: {\n      command: `tsx ${scriptsDir}/pull-image.ts`,\n      cwd: '{projectRoot}',\n    },\n  };\n  projectConfig.targets['dev'] = {\n    executor: 'nx:run-commands',\n    options: {\n      command: `tsx ${scriptsDir}/start-container.ts`,\n      cwd: '{projectRoot}',\n    },\n    continuous: true,\n  };\n  projectConfig.targets['wait-for-db'] = {\n    executor: 'nx:run-commands',\n    dependsOn: ['dev'],\n    options: {\n      command: `tsx ${scriptsDir}/${waitForDbScript}`,\n      cwd: '{projectRoot}',\n    },\n  };\n  projectConfig.targets.prisma = {\n    executor: 'nx:run-commands',\n    dependsOn: ['dev', 'wait-for-db'],\n    options: {\n      cwd: '{projectRoot}',\n      command: 'prisma',\n      env: {\n        LOCAL_DEV: 'true',\n      },\n    },\n  };\n  if (options.infra !== 'none') {\n    const iac = await resolveIac(tree, options.iac);\n    if (iac === 'terraform') {\n      projectConfig.targets['docker'] = {\n        cache: true,\n        executor: 'nx:run-commands',\n        options: {\n          command: `${containerEngine} build --platform linux/arm64 --provenance=false -t ${migrationDockerImageTag} ${migrationBundleDir}`,\n        },\n        dependsOn: ['bundle'],\n      };\n      addDependencyToTargetIfNotPresent(projectConfig, 'build', 'docker');\n\n      addDockerScanTarget(tree, {\n        project: projectConfig,\n        containerEngine,\n        trivyTargetName: 'trivy',\n        dockerTargetName: 'docker',\n        imageTags: [migrationDockerImageTag],\n      });\n    }\n    addDependencyToTargetIfNotPresent(projectConfig, 'build', 'bundle');\n  }\n  addDependencyToTargetIfNotPresent(projectConfig, 'compile', 'generate');\n  updateProjectConfiguration(tree, fullyQualifiedName, projectConfig);\n  addGeneratorMetadata(tree, fullyQualifiedName, TS_RDB_GENERATOR_INFO, {\n    engine: options.engine,\n  });\n\n  if (options.infra !== 'none') {\n    const iac = await resolveIac(tree, options.iac);\n    await sharedConstructsGenerator(tree, { iac });\n    await addRdbInfra(tree, {\n      iac,\n      projectName: fullyQualifiedName,\n      projectRoot: dir,\n      nameClassName,\n      nameKebabCase,\n      databasePackageAlias: toScopeAlias(fullyQualifiedName),\n      databaseName,\n      adminUser: databaseUser,\n      engine: options.engine,\n      migrationBundleDir,\n      createDbUserBundleDir: joinPathFragments(\n        'dist',\n        projectConfig.root,\n        'bundle',\n        'create-db-user',\n      ),\n      framework: options.framework,\n      migrationDockerImageTag,\n      containerEngine,\n    });\n  }\n\n  addDependenciesToPackageJson(\n    tree,\n    withVersions([\n      '@aws-lambda-powertools/parameters',\n      '@aws-sdk/client-appconfigdata',\n      '@aws-sdk/client-secrets-manager',\n      '@aws-sdk/rds-signer',\n      '@prisma/client',\n      ...(options.engine === 'mysql'\n        ? (['@prisma/adapter-mariadb', 'mariadb'] as const)\n        : (['@prisma/adapter-pg', 'pg'] as const)),\n    ]),\n    withVersions([\n      'prisma',\n      'tsx',\n      '@types/aws-lambda',\n      ...(options.engine === 'mysql'\n        ? ([] as const)\n        : (['@types/pg'] as const)),\n    ]),\n  );\n\n  registerPnpmBuiltDependencies(tree, {\n    '@prisma/engines': false,\n    prisma: false,\n  });\n\n  await addGeneratorMetricsIfApplicable(tree, [TS_RDB_GENERATOR_INFO]);\n\n  await formatFilesInSubtree(tree);\n  return () =>\n    installDependencies(tree, options.preferInstallDependencies, {\n      languages: ['typescript'],\n    });\n};\n\nexport default tsRdbGenerator;\n"],"names":["relative","addDependenciesToPackageJson","generateFiles","joinPathFragments","readProjectConfiguration","updateJson","updateProjectConfiguration","addTypeScriptBundleTarget","resolveContainers","addDockerScanTarget","formatFilesInSubtree","FsCommands","updateGitIgnore","resolveIac","installDependencies","addGeneratorMetricsIfApplicable","esmVars","kebabCase","snakeCase","toClassName","getNpmScope","toScopeAlias","addDependencyToTargetIfNotPresent","addGeneratorMetadata","getGeneratorInfo","getRelativePathToRootByDirectory","registerPnpmBuiltDependencies","assignPort","addRdbInfra","sharedConstructsGenerator","PACKAGES_DIR","SHARED_SCRIPTS_DIR","sharedRdbScriptsGenerator","TS_VERSIONS","withVersions","tsProjectGenerator","getTsLibDetails","TS_RDB_GENERATOR_INFO","filename","tsRdbGenerator","tree","options","nameKebabCase","name","nameClassName","databaseUser","databaseName","containerEngine","fullyQualifiedName","dir","directory","subDirectory","projectExists","preferInstallDependencies","tsConfig","include","projectConfig","localDbPort","engine","localDbHost","localDbUser","localDbPassword","containerName","dockerImage","templateOptions","runtimeConfigKey","databasePackageAlias","databaseProvider","prismaVersion","prisma","npmVersion","npm","prismaAdapterPackage","prismaAdapterClassName","localDbName","dirname","patterns","waitForDbScript","scriptsDir","relativePathToRoot","root","fs","migrationBundleDir","migrationDockerImageTag","infra","targetFilePath","bundleOutputDir","bundleTarget","targets","commands","rolldownCommand","command","rm","mkdir","cp","parallel","generate","executor","outputs","cwd","continuous","dependsOn","env","LOCAL_DEV","iac","cache","project","trivyTargetName","dockerTargetName","imageTags","projectName","projectRoot","adminUser","createDbUserBundleDir","framework","languages"],"mappings":"AAAA;;;CAGC,GACD,SAASA,QAAQ,QAAQ,YAAY;AACrC,SACEC,4BAA4B,EAE5BC,aAAa,EACbC,iBAAiB,EACjBC,wBAAwB,EAExBC,UAAU,EACVC,0BAA0B,QACrB,aAAa;AACpB,SAASC,yBAAyB,QAAQ,+BAA4B;AACtE,SAASC,iBAAiB,QAAQ,4BAAyB;AAC3D,SAASC,mBAAmB,QAAQ,wBAAqB;AACzD,SAASC,oBAAoB,QAAQ,wBAAqB;AAC1D,SAASC,UAAU,QAAQ,oBAAiB;AAC5C,SAASC,eAAe,QAAQ,qBAAkB;AAClD,SAASC,UAAU,QAAQ,qBAAkB;AAC7C,SAASC,mBAAmB,QAAQ,yBAAsB;AAC1D,SAASC,+BAA+B,QAAQ,yBAAsB;AACtE,SAASC,OAAO,QAAQ,+BAA4B;AACpD,SAASC,SAAS,EAAEC,SAAS,EAAEC,WAAW,QAAQ,uBAAoB;AACtE,SAASC,WAAW,EAAEC,YAAY,QAAQ,2BAAwB;AAClE,SACEC,iCAAiC,EACjCC,oBAAoB,EACpBC,gBAAgB,QAEX,oBAAiB;AACxB,SAASC,gCAAgC,QAAQ,uBAAoB;AACrE,SAASC,6BAA6B,QAAQ,gCAA6B;AAC3E,SAASC,UAAU,QAAQ,sBAAmB;AAC9C,SAASC,WAAW,QAAQ,+CAA4C;AACxE,SAASC,yBAAyB,QAAQ,mCAAgC;AAC1E,SACEC,YAAY,EACZC,kBAAkB,QACb,6CAA0C;AACjD,SAASC,yBAAyB,QAAQ,oCAAiC;AAC3E,SAASC,WAAW,EAAEC,YAAY,QAAQ,0BAAuB;AACjE,OAAOC,sBAAsBC,eAAe,QAAQ,sBAAmB;AAGvE,OAAO,MAAMC,wBAAyCb,iBACpD,YAAYc,QAAQ,EACpB;AAEF,OAAO,MAAMC,iBAAiB,OAC5BC,MACAC;IAEA,MAAMC,gBAAgBzB,UAAUwB,QAAQE,IAAI;IAC5C,MAAMC,gBAAgBzB,YAAYsB,QAAQE,IAAI;IAC9C,MAAME,eAAeJ,QAAQI,YAAY,IAAI;IAC7C,MAAMC,eAAe5B,UAAUuB,QAAQK,YAAY,IAAIL,QAAQE,IAAI;IACnE,MAAMI,kBAAkB,MAAMvC,kBAAkBgC,MAAM;IACtD,MAAM,EAAEQ,kBAAkB,EAAEC,GAAG,EAAE,GAAGb,gBAAgBI,MAAM;QACxDG,MAAMF,QAAQE,IAAI;QAClBO,WAAWT,QAAQS,SAAS;QAC5BC,cAAcV,QAAQU,YAAY;IACpC;IAEA,IAAIC;IACJ,IAAI;QACFhD,yBAAyBoC,MAAMQ;QAC/BI,gBAAgB;IAClB,EAAE,OAAM;QACNA,gBAAgB;IAClB;IAEA,IAAI,CAACA,eAAe;QAClB,MAAMjB,mBAAmBK,MAAM;YAC7BG,MAAMF,QAAQE,IAAI;YAClBO,WAAWT,QAAQS,SAAS;YAC5BG,2BAA2B;QAC7B;IACF;IAEAhD,WAAWmC,MAAMrC,kBAAkB8C,KAAK,sBAAsB,CAACK,WAAc,CAAA;YAC3E,GAAGA,QAAQ;YACXC,SAAS;gBAAC;gBAAe;aAA2B;QACtD,CAAA;IAEA,MAAMC,gBAAgBpD,yBAAyBoC,MAAMQ;IACrD,MAAMS,cAAc9B,WAClBa,MACAgB,eACAf,QAAQiB,MAAM,KAAK,UAAU,OAAO;IAEtC,MAAMC,cAAc;IACpB,MAAMC,cAAcnB,QAAQiB,MAAM,KAAK,UAAU,SAAS;IAC1D,MAAMG,kBAAkB;IACxB,MAAMC,gBAAgB,GAAG1C,YAAYoB,MAAM,CAAC,EAAEM,cAAc;IAC5D,MAAMiB,cACJtB,QAAQiB,MAAM,KAAK,UACf,+CACA;IAEN,MAAMM,kBAAkB;QACtBN,QAAQjB,QAAQiB,MAAM;QACtBO,kBAAkBrB;QAClBsB,sBAAsB7C,aAAa2B;QACnCmB,kBAAkB1B,QAAQiB,MAAM,KAAK,UAAU,UAAU;QACzDU,eAAenC,YAAYoC,MAAM;QACjCC,YAAYrC,YAAYsC,GAAG;QAC3BC,sBACE/B,QAAQiB,MAAM,KAAK,UACf,4BACA;QACNe,wBACEhC,QAAQiB,MAAM,KAAK,UAAU,kBAAkB;QACjDD;QACAE;QACAe,aAAa5B;QACbc;QACAC;QACAd;QACAe;QACAC;QACA,GAAG/C,QAAQwB,KAAK;IAClB;IAEAtC,cACEsC,MACArC,kBAAkB,YAAYwE,OAAO,EAAE,UACvC1B,KACAe;IAEFpD,gBAAgB4B,MAAMS,KAAK,CAAC2B,WAAa;eAAIA;YAAU;SAAmB;IAC1E,MAAM5C,0BAA0BQ,MAAMC,QAAQiB,MAAM;IACpD,MAAMmB,kBACJpC,QAAQiB,MAAM,KAAK,UACf,yBACA;IACN,MAAMoB,aAAa9E,SACjBiD,KACA9C,kBAAkB2B,cAAcC,oBAAoB,OAAO;IAE7D,MAAMgD,qBAAqBtD,iCACzB+B,cAAcwB,IAAI;IAEpB,MAAMC,KAAK,IAAItE,WAAW6B;IAC1B,MAAM0C,qBAAqB/E,kBACzB,QACAqD,cAAcwB,IAAI,EAClB,UACA;IAEF,MAAMG,0BAA0B,GAAG/D,YAAYoB,MAAM,CAAC,EAAEvB,UAAUwB,QAAQE,IAAI,EAAE,iBAAiB,CAAC;IAElG,IAAIF,QAAQ2C,KAAK,KAAK,QAAQ;QAC5B,MAAM7E,0BAA0BiC,MAAMgB,eAAe;YACnD6B,gBAAgB;YAChBC,iBAAiB;QACnB;QACA,MAAM/E,0BAA0BiC,MAAMgB,eAAe;YACnD6B,gBAAgB;YAChBC,iBAAiB;QACnB;QACA,MAAMC,eAAe/B,cAAcgC,OAAO,CAAC,SAAS;QACpD,0EAA0E;QAC1E,yEAAyE;QACzE,6CAA6C;QAC7C,IAAI,CAACD,aAAa9C,OAAO,CAACgD,QAAQ,EAAE;YAClC,MAAMC,kBAAkBH,aAAa9C,OAAO,CAACkD,OAAO;YACpD,OAAOJ,aAAa9C,OAAO,CAACkD,OAAO;YACnCJ,aAAa9C,OAAO,GAAG;gBACrB,GAAG8C,aAAa9C,OAAO;gBACvBgD,UAAU;oBACRR,GAAGW,EAAE,CAAC,GAAGb,mBAAmB,mCAAmC,CAAC;oBAChEE,GAAGY,KAAK,CAAC,GAAGd,mBAAmB,mCAAmC,CAAC;oBACnEE,GAAGa,EAAE,CACH,UACA,GAAGf,mBAAmB,0CAA0C,CAAC;oBAEnEE,GAAGa,EAAE,CACH,oBACA,GAAGf,mBAAmB,oDAAoD,CAAC;oBAE7EE,GAAGa,EAAE,CACH,cACA,GAAGf,mBAAmB,8CAA8C,CAAC;oBAEvEW;iBACD;gBACDK,UAAU;YACZ;QACF;IACF;IAEAvC,cAAcgC,OAAO,CAACQ,QAAQ,GAAG;QAC/BC,UAAU;QACVC,SAAS;YAAC;SAAiC;QAC3CzD,SAAS;YACPkD,SAAS;YACTQ,KAAK;QACP;IACF;IACA3C,cAAcgC,OAAO,CAAC,aAAa,GAAG;QACpCS,UAAU;QACVxD,SAAS;YACPkD,SAAS,CAAC,IAAI,EAAEb,WAAW,cAAc,CAAC;YAC1CqB,KAAK;QACP;IACF;IACA3C,cAAcgC,OAAO,CAAC,MAAM,GAAG;QAC7BS,UAAU;QACVxD,SAAS;YACPkD,SAAS,CAAC,IAAI,EAAEb,WAAW,mBAAmB,CAAC;YAC/CqB,KAAK;QACP;QACAC,YAAY;IACd;IACA5C,cAAcgC,OAAO,CAAC,cAAc,GAAG;QACrCS,UAAU;QACVI,WAAW;YAAC;SAAM;QAClB5D,SAAS;YACPkD,SAAS,CAAC,IAAI,EAAEb,WAAW,CAAC,EAAED,iBAAiB;YAC/CsB,KAAK;QACP;IACF;IACA3C,cAAcgC,OAAO,CAACnB,MAAM,GAAG;QAC7B4B,UAAU;QACVI,WAAW;YAAC;YAAO;SAAc;QACjC5D,SAAS;YACP0D,KAAK;YACLR,SAAS;YACTW,KAAK;gBACHC,WAAW;YACb;QACF;IACF;IACA,IAAI9D,QAAQ2C,KAAK,KAAK,QAAQ;QAC5B,MAAMoB,MAAM,MAAM3F,WAAW2B,MAAMC,QAAQ+D,GAAG;QAC9C,IAAIA,QAAQ,aAAa;YACvBhD,cAAcgC,OAAO,CAAC,SAAS,GAAG;gBAChCiB,OAAO;gBACPR,UAAU;gBACVxD,SAAS;oBACPkD,SAAS,GAAG5C,gBAAgB,oDAAoD,EAAEoC,wBAAwB,CAAC,EAAED,oBAAoB;gBACnI;gBACAmB,WAAW;oBAAC;iBAAS;YACvB;YACA/E,kCAAkCkC,eAAe,SAAS;YAE1D/C,oBAAoB+B,MAAM;gBACxBkE,SAASlD;gBACTT;gBACA4D,iBAAiB;gBACjBC,kBAAkB;gBAClBC,WAAW;oBAAC1B;iBAAwB;YACtC;QACF;QACA7D,kCAAkCkC,eAAe,SAAS;IAC5D;IACAlC,kCAAkCkC,eAAe,WAAW;IAC5DlD,2BAA2BkC,MAAMQ,oBAAoBQ;IACrDjC,qBAAqBiB,MAAMQ,oBAAoBX,uBAAuB;QACpEqB,QAAQjB,QAAQiB,MAAM;IACxB;IAEA,IAAIjB,QAAQ2C,KAAK,KAAK,QAAQ;QAC5B,MAAMoB,MAAM,MAAM3F,WAAW2B,MAAMC,QAAQ+D,GAAG;QAC9C,MAAM3E,0BAA0BW,MAAM;YAAEgE;QAAI;QAC5C,MAAM5E,YAAYY,MAAM;YACtBgE;YACAM,aAAa9D;YACb+D,aAAa9D;YACbL;YACAF;YACAwB,sBAAsB7C,aAAa2B;YACnCF;YACAkE,WAAWnE;YACXa,QAAQjB,QAAQiB,MAAM;YACtBwB;YACA+B,uBAAuB9G,kBACrB,QACAqD,cAAcwB,IAAI,EAClB,UACA;YAEFkC,WAAWzE,QAAQyE,SAAS;YAC5B/B;YACApC;QACF;IACF;IAEA9C,6BACEuC,MACAN,aAAa;QACX;QACA;QACA;QACA;QACA;WACIO,QAAQiB,MAAM,KAAK,UAClB;YAAC;YAA2B;SAAU,GACtC;YAAC;YAAsB;SAAK;KAClC,GACDxB,aAAa;QACX;QACA;QACA;WACIO,QAAQiB,MAAM,KAAK,UAClB,EAAE,GACF;YAAC;SAAY;KACnB;IAGHhC,8BAA8Bc,MAAM;QAClC,mBAAmB;QACnB6B,QAAQ;IACV;IAEA,MAAMtD,gCAAgCyB,MAAM;QAACH;KAAsB;IAEnE,MAAM3B,qBAAqB8B;IAC3B,OAAO,IACL1B,oBAAoB0B,MAAMC,QAAQY,yBAAyB,EAAE;YAC3D8D,WAAW;gBAAC;aAAa;QAC3B;AACJ,EAAE;AAEF,eAAe5E,eAAe"}

package/src/utils/docker.d.ts

@@ -0,0 +1,44 @@
+/**
+ * Copyright Amazon.com, Inc. or its affiliates. All Rights Reserved.
+ * SPDX-License-Identifier: Apache-2.0
+ */
+import { type ProjectConfiguration, type Tree } from '@nx/devkit';
+export interface DockerScanTargetOptions {
+    /**
+     * Project configuration to add the scan target to (mutated in place).
+     */
+    readonly project: ProjectConfiguration;
+    /**
+     * Container engine command to invoke (\`docker\` or \`finch\`).
+     */
+    readonly containerEngine: string;
+    /**
+     * Name of the scan target to add, e.g. \`my-agent-trivy\`.
+     */
+    readonly trivyTargetName: string;
+    /**
+     * Name of the docker target that builds the image(s) to scan. The scan
+     * target depends on it.
+     */
+    readonly dockerTargetName: string;
+    /**
+     * Tags of the images built by the docker target which should be scanned.
+     */
+    readonly imageTags: string[];
+}
+/**
+ * Add a cacheable Trivy scan target for the images built by a docker target,
+ * wire it under the aggregate \`trivy\` target, and make \`build\` depend on it.
+ *
+ * The scan target depends on the docker target and declares the project source
+ * as its inputs, so an unchanged image is never re-scanned (a cache hit skips
+ * the scan entirely). Each image is saved to a tarball under
+ * \`dist/<projectRoot>/trivy/<scan-key>\` (kept out of any Docker build context)
+ * and scanned with the pinned ECR-hosted Trivy image via a workspace-relative
+ * bind mount, so the same commands work under both docker and finch. The scan
+ * fails the build (exit code 1) on HIGH/CRITICAL vulnerabilities.
+ *
+ * A \`.trivyignore\` is vended at the project root (kept if it already exists)
+ * for suppressing findings.
+ */
+export declare const addDockerScanTarget: (tree: Tree, options: DockerScanTargetOptions) => void;

package/src/utils/docker.js

@@ -0,0 +1,81 @@
+/**
+ * Copyright Amazon.com, Inc. or its affiliates. All Rights Reserved.
+ * SPDX-License-Identifier: Apache-2.0
+ */ import { joinPathFragments } from "@nx/devkit";
+import { FsCommands } from "./fs.js";
+import { addDependencyToTargetIfNotPresent } from "./nx.js";
+import { CONTAINER_VERSIONS } from "./versions.js";
+const TRIVY_IGNORE_FILE = '.trivyignore';
+const TRIVY_IGNORE_CONTENTS = `# Trivy ignore file. Add one vulnerability ID (e.g. CVE-2021-12345) per line to
+# suppress it during the image scan run on build.
+# https://trivy.dev/latest/docs/configuration/filtering/#by-finding-ids
+`;
+/**
+ * Add a cacheable Trivy scan target for the images built by a docker target,
+ * wire it under the aggregate \`trivy\` target, and make \`build\` depend on it.
+ *
+ * The scan target depends on the docker target and declares the project source
+ * as its inputs, so an unchanged image is never re-scanned (a cache hit skips
+ * the scan entirely). Each image is saved to a tarball under
+ * \`dist/<projectRoot>/trivy/<scan-key>\` (kept out of any Docker build context)
+ * and scanned with the pinned ECR-hosted Trivy image via a workspace-relative
+ * bind mount, so the same commands work under both docker and finch. The scan
+ * fails the build (exit code 1) on HIGH/CRITICAL vulnerabilities.
+ *
+ * A \`.trivyignore\` is vended at the project root (kept if it already exists)
+ * for suppressing findings.
+ */ export const addDockerScanTarget = (tree, options)=>{
+    const { project, containerEngine, trivyTargetName, dockerTargetName } = options;
+    const { imageTags } = options;
+    const projectRoot = project.root;
+    const ignoreFilePath = joinPathFragments(projectRoot, TRIVY_IGNORE_FILE);
+    if (!tree.exists(ignoreFilePath)) {
+        tree.write(ignoreFilePath, TRIVY_IGNORE_CONTENTS);
+    }
+    // Stage scan artifacts in a directory unique to this scan target so that
+    // sibling targets in the same project (e.g. multiple agents) don't clobber
+    // each other's tarballs when run in parallel. The first image tag is unique
+    // per target, so it makes a stable, collision-free key.
+    const scanKey = imageTags[0].replace(/[^a-zA-Z0-9-]/g, '-');
+    const scanDir = joinPathFragments('dist', projectRoot, 'trivy', scanKey);
+    const trivyImage = `public.ecr.aws/aquasecurity/trivy:${CONTAINER_VERSIONS.trivy}`;
+    const fs = new FsCommands(tree);
+    const commands = [
+        fs.rm(scanDir),
+        fs.mkdir(scanDir),
+        fs.cp(ignoreFilePath, joinPathFragments(scanDir, TRIVY_IGNORE_FILE))
+    ];
+    imageTags.forEach((imageTag, index)=>{
+        const tarName = `image-${index}.tar`;
+        commands.push(`${containerEngine} save -o ${joinPathFragments(scanDir, tarName)} ${imageTag}`, `${containerEngine} run --rm -v "./${scanDir}":/scan ${trivyImage} image --input /scan/${tarName} --ignorefile /scan/${TRIVY_IGNORE_FILE} --scanners vuln --severity HIGH,CRITICAL --ignore-unfixed --exit-code 1 --no-progress -q`);
+    });
+    project.targets ??= {};
+    project.targets[trivyTargetName] = {
+        cache: true,
+        // The scanned image is fully determined by the project source, so caching
+        // on the source ensures an unchanged image is never re-scanned.
+        inputs: [
+            'default',
+            '^production'
+        ],
+        outputs: [
+            `{workspaceRoot}/${scanDir}`
+        ],
+        executor: 'nx:run-commands',
+        options: {
+            commands,
+            parallel: false
+        },
+        dependsOn: [
+            dockerTargetName
+        ]
+    };
+    // Aggregate per-component scan targets under a single `trivy` target, and
+    // make `build` run the scan.
+    if (trivyTargetName !== 'trivy') {
+        addDependencyToTargetIfNotPresent(project, 'trivy', trivyTargetName);
+    }
+    addDependencyToTargetIfNotPresent(project, 'build', 'trivy');
+};
+
+//# sourceMappingURL=docker.js.map

package/src/utils/docker.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../../../../../packages/nx-plugin/src/utils/docker.ts"],"sourcesContent":["/**\n * Copyright Amazon.com, Inc. or its affiliates. All Rights Reserved.\n * SPDX-License-Identifier: Apache-2.0\n */\nimport {\n  joinPathFragments,\n  type ProjectConfiguration,\n  type Tree,\n} from '@nx/devkit';\nimport { FsCommands } from './fs';\nimport { addDependencyToTargetIfNotPresent } from './nx';\nimport { CONTAINER_VERSIONS } from './versions';\n\nconst TRIVY_IGNORE_FILE = '.trivyignore';\n\nconst TRIVY_IGNORE_CONTENTS = `# Trivy ignore file. Add one vulnerability ID (e.g. CVE-2021-12345) per line to\n# suppress it during the image scan run on build.\n# https://trivy.dev/latest/docs/configuration/filtering/#by-finding-ids\n`;\n\nexport interface DockerScanTargetOptions {\n  /**\n   * Project configuration to add the scan target to (mutated in place).\n   */\n  readonly project: ProjectConfiguration;\n  /**\n   * Container engine command to invoke (\\`docker\\` or \\`finch\\`).\n   */\n  readonly containerEngine: string;\n  /**\n   * Name of the scan target to add, e.g. \\`my-agent-trivy\\`.\n   */\n  readonly trivyTargetName: string;\n  /**\n   * Name of the docker target that builds the image(s) to scan. The scan\n   * target depends on it.\n   */\n  readonly dockerTargetName: string;\n  /**\n   * Tags of the images built by the docker target which should be scanned.\n   */\n  readonly imageTags: string[];\n}\n\n/**\n * Add a cacheable Trivy scan target for the images built by a docker target,\n * wire it under the aggregate \\`trivy\\` target, and make \\`build\\` depend on it.\n *\n * The scan target depends on the docker target and declares the project source\n * as its inputs, so an unchanged image is never re-scanned (a cache hit skips\n * the scan entirely). Each image is saved to a tarball under\n * \\`dist/<projectRoot>/trivy/<scan-key>\\` (kept out of any Docker build context)\n * and scanned with the pinned ECR-hosted Trivy image via a workspace-relative\n * bind mount, so the same commands work under both docker and finch. The scan\n * fails the build (exit code 1) on HIGH/CRITICAL vulnerabilities.\n *\n * A \\`.trivyignore\\` is vended at the project root (kept if it already exists)\n * for suppressing findings.\n */\nexport const addDockerScanTarget = (\n  tree: Tree,\n  options: DockerScanTargetOptions,\n): void => {\n  const { project, containerEngine, trivyTargetName, dockerTargetName } =\n    options;\n  const { imageTags } = options;\n  const projectRoot = project.root;\n\n  const ignoreFilePath = joinPathFragments(projectRoot, TRIVY_IGNORE_FILE);\n  if (!tree.exists(ignoreFilePath)) {\n    tree.write(ignoreFilePath, TRIVY_IGNORE_CONTENTS);\n  }\n\n  // Stage scan artifacts in a directory unique to this scan target so that\n  // sibling targets in the same project (e.g. multiple agents) don't clobber\n  // each other's tarballs when run in parallel. The first image tag is unique\n  // per target, so it makes a stable, collision-free key.\n  const scanKey = imageTags[0].replace(/[^a-zA-Z0-9-]/g, '-');\n  const scanDir = joinPathFragments('dist', projectRoot, 'trivy', scanKey);\n  const trivyImage = `public.ecr.aws/aquasecurity/trivy:${CONTAINER_VERSIONS.trivy}`;\n\n  const fs = new FsCommands(tree);\n  const commands = [\n    fs.rm(scanDir),\n    fs.mkdir(scanDir),\n    fs.cp(ignoreFilePath, joinPathFragments(scanDir, TRIVY_IGNORE_FILE)),\n  ];\n\n  imageTags.forEach((imageTag, index) => {\n    const tarName = `image-${index}.tar`;\n    commands.push(\n      `${containerEngine} save -o ${joinPathFragments(scanDir, tarName)} ${imageTag}`,\n      `${containerEngine} run --rm -v \"./${scanDir}\":/scan ${trivyImage} image --input /scan/${tarName} --ignorefile /scan/${TRIVY_IGNORE_FILE} --scanners vuln --severity HIGH,CRITICAL --ignore-unfixed --exit-code 1 --no-progress -q`,\n    );\n  });\n\n  project.targets ??= {};\n  project.targets[trivyTargetName] = {\n    cache: true,\n    // The scanned image is fully determined by the project source, so caching\n    // on the source ensures an unchanged image is never re-scanned.\n    inputs: ['default', '^production'],\n    outputs: [`{workspaceRoot}/${scanDir}`],\n    executor: 'nx:run-commands',\n    options: {\n      commands,\n      parallel: false,\n    },\n    dependsOn: [dockerTargetName],\n  };\n\n  // Aggregate per-component scan targets under a single `trivy` target, and\n  // make `build` run the scan.\n  if (trivyTargetName !== 'trivy') {\n    addDependencyToTargetIfNotPresent(project, 'trivy', trivyTargetName);\n  }\n  addDependencyToTargetIfNotPresent(project, 'build', 'trivy');\n};\n"],"names":["joinPathFragments","FsCommands","addDependencyToTargetIfNotPresent","CONTAINER_VERSIONS","TRIVY_IGNORE_FILE","TRIVY_IGNORE_CONTENTS","addDockerScanTarget","tree","options","project","containerEngine","trivyTargetName","dockerTargetName","imageTags","projectRoot","root","ignoreFilePath","exists","write","scanKey","replace","scanDir","trivyImage","trivy","fs","commands","rm","mkdir","cp","forEach","imageTag","index","tarName","push","targets","cache","inputs","outputs","executor","parallel","dependsOn"],"mappings":"AAAA;;;CAGC,GACD,SACEA,iBAAiB,QAGZ,aAAa;AACpB,SAASC,UAAU,QAAQ,UAAO;AAClC,SAASC,iCAAiC,QAAQ,UAAO;AACzD,SAASC,kBAAkB,QAAQ,gBAAa;AAEhD,MAAMC,oBAAoB;AAE1B,MAAMC,wBAAwB,CAAC;;;AAG/B,CAAC;AA0BD;;;;;;;;;;;;;;CAcC,GACD,OAAO,MAAMC,sBAAsB,CACjCC,MACAC;IAEA,MAAM,EAAEC,OAAO,EAAEC,eAAe,EAAEC,eAAe,EAAEC,gBAAgB,EAAE,GACnEJ;IACF,MAAM,EAAEK,SAAS,EAAE,GAAGL;IACtB,MAAMM,cAAcL,QAAQM,IAAI;IAEhC,MAAMC,iBAAiBhB,kBAAkBc,aAAaV;IACtD,IAAI,CAACG,KAAKU,MAAM,CAACD,iBAAiB;QAChCT,KAAKW,KAAK,CAACF,gBAAgBX;IAC7B;IAEA,yEAAyE;IACzE,2EAA2E;IAC3E,4EAA4E;IAC5E,wDAAwD;IACxD,MAAMc,UAAUN,SAAS,CAAC,EAAE,CAACO,OAAO,CAAC,kBAAkB;IACvD,MAAMC,UAAUrB,kBAAkB,QAAQc,aAAa,SAASK;IAChE,MAAMG,aAAa,CAAC,kCAAkC,EAAEnB,mBAAmBoB,KAAK,EAAE;IAElF,MAAMC,KAAK,IAAIvB,WAAWM;IAC1B,MAAMkB,WAAW;QACfD,GAAGE,EAAE,CAACL;QACNG,GAAGG,KAAK,CAACN;QACTG,GAAGI,EAAE,CAACZ,gBAAgBhB,kBAAkBqB,SAASjB;KAClD;IAEDS,UAAUgB,OAAO,CAAC,CAACC,UAAUC;QAC3B,MAAMC,UAAU,CAAC,MAAM,EAAED,MAAM,IAAI,CAAC;QACpCN,SAASQ,IAAI,CACX,GAAGvB,gBAAgB,SAAS,EAAEV,kBAAkBqB,SAASW,SAAS,CAAC,EAAEF,UAAU,EAC/E,GAAGpB,gBAAgB,gBAAgB,EAAEW,QAAQ,QAAQ,EAAEC,WAAW,qBAAqB,EAAEU,QAAQ,oBAAoB,EAAE5B,kBAAkB,yFAAyF,CAAC;IAEvO;IAEAK,QAAQyB,OAAO,KAAK,CAAC;IACrBzB,QAAQyB,OAAO,CAACvB,gBAAgB,GAAG;QACjCwB,OAAO;QACP,0EAA0E;QAC1E,gEAAgE;QAChEC,QAAQ;YAAC;YAAW;SAAc;QAClCC,SAAS;YAAC,CAAC,gBAAgB,EAAEhB,SAAS;SAAC;QACvCiB,UAAU;QACV9B,SAAS;YACPiB;YACAc,UAAU;QACZ;QACAC,WAAW;YAAC5B;SAAiB;IAC/B;IAEA,0EAA0E;IAC1E,6BAA6B;IAC7B,IAAID,oBAAoB,SAAS;QAC/BT,kCAAkCO,SAAS,SAASE;IACtD;IACAT,kCAAkCO,SAAS,SAAS;AACtD,EAAE"}

package/src/utils/versions.d.ts

@@ -99,6 +99,7 @@ export declare const TS_VERSIONS: {
     readonly 'make-dir-cli': "4.0.0";
     readonly mariadb: "3.5.3";
     readonly ncp: "2.0.0";
+    readonly npm: "12.0.1";
     readonly 'npm-check-updates': "22.2.9";
     readonly 'oidc-client-ts': "3.5.0";
     readonly pg: "8.22.0";
@@ -130,7 +131,7 @@ export type ITsDepVersion = keyof typeof TS_VERSIONS;
  * Add versions to the given dependencies
  */
 export declare const withVersions: (deps: ITsDepVersion[]) => {
-    [k: string]: "0.3.14" | "0.12.0" | "3.1085.0" | "3.972.56" | "1.0.0-alpha.10" | "2.34.0" | "7.7.0" | "22.2.1" | "10.3.0" | "23.0.2" | "1.11.1" | "1.15.43" | "1.29.0" | "0.22.0" | "0.2.3" | "0.0.57" | "0.3.0" | "1.62.3" | "7.8.2" | "1.9.0" | "1.170.17" | "1.168.19" | "1.167.18" | "1.162.0" | "1.162.2" | "3.0.201" | "1.0.149" | "3.0.1325" | "1.0.62" | "5.101.2" | "11.18.0" | "26.1.1" | "8.10.162" | "2.8.19" | "8.20.0" | "8.18.1" | "5.0.6" | "4.6.8" | "4.5.8" | "4.9.5" | "4.16.1" | "4.1.10" | "6.0.1" | "0.41.3" | "7.0.7" | "1.0.20" | "2.1130.0" | "2.261.0" | "3.12.0" | "10.6.0" | "2.8.6" | "5.6.2" | "0.7.1" | "2.1.1" | "15.0.0" | "3.9.1" | "0.28.1" | "1.0.31" | "1.0.5" | "2.5.3" | "7.8.0" | "3.1.5" | "5.2.1" | "3.3.3" | "9.1.7" | "11.3.6" | "11.0.4" | "4.0.0" | "3.5.3" | "2.0.0" | "22.2.9" | "3.5.0" | "8.22.0" | "3.3.1" | "19.2.7" | "6.1.3" | "1.1.5" | "3.36.0" | "0.5.21" | "0.28.0" | "4.3.2" | "4.23.0" | "1.24.0" | "1.6.2" | "4.13.0" | "1.4.0" | "3.6.0" | "8.1.4" | "6.0.3" | "4.4.3" | "8.21.0";
+    [k: string]: "0.3.14" | "0.12.0" | "3.1085.0" | "3.972.56" | "1.0.0-alpha.10" | "2.34.0" | "7.7.0" | "22.2.1" | "10.3.0" | "23.0.2" | "1.11.1" | "1.15.43" | "1.29.0" | "0.22.0" | "0.2.3" | "0.0.57" | "0.3.0" | "1.62.3" | "7.8.2" | "1.9.0" | "1.170.17" | "1.168.19" | "1.167.18" | "1.162.0" | "1.162.2" | "3.0.201" | "1.0.149" | "3.0.1325" | "1.0.62" | "5.101.2" | "11.18.0" | "26.1.1" | "8.10.162" | "2.8.19" | "8.20.0" | "8.18.1" | "5.0.6" | "4.6.8" | "4.5.8" | "4.9.5" | "4.16.1" | "4.1.10" | "6.0.1" | "0.41.3" | "7.0.7" | "1.0.20" | "2.1130.0" | "2.261.0" | "3.12.0" | "10.6.0" | "2.8.6" | "5.6.2" | "0.7.1" | "2.1.1" | "15.0.0" | "3.9.1" | "0.28.1" | "1.0.31" | "1.0.5" | "2.5.3" | "7.8.0" | "3.1.5" | "5.2.1" | "3.3.3" | "9.1.7" | "11.3.6" | "11.0.4" | "4.0.0" | "3.5.3" | "2.0.0" | "12.0.1" | "22.2.9" | "3.5.0" | "8.22.0" | "3.3.1" | "19.2.7" | "6.1.3" | "1.1.5" | "3.36.0" | "0.5.21" | "0.28.0" | "4.3.2" | "4.23.0" | "1.24.0" | "1.6.2" | "4.13.0" | "1.4.0" | "3.6.0" | "8.1.4" | "6.0.3" | "4.4.3" | "8.21.0";
 };
 /**
  * Versions for Python dependencies added by generators
@@ -179,6 +180,22 @@ export declare const withPyVersions: (deps: IPyDepVersion[]) => string[];
 export declare const VENDORED_VERSIONS: {
     readonly 'git-secrets': "1.3.0";
 };
+/**
+ * Base container images used by generated Dockerfiles. Pinned exactly so
+ * generated images are reproducible, and chosen to be free of known
+ * HIGH/CRITICAL vulnerabilities at time of generation.
+ */
+export declare const BASE_IMAGES: {
+    readonly node: "public.ecr.aws/docker/library/node:lts-slim";
+    readonly python: "public.ecr.aws/docker/library/python:3.14-slim";
+};
+/**
+ * Versions for container tooling used by generated image build/scan targets.
+ * Pinned exactly so generated images are reproducible.
+ */
+export declare const CONTAINER_VERSIONS: {
+    readonly trivy: "0.72.0";
+};
 /**
  * Exact versions for Terraform providers used by generated `.tf` modules.
  * Pinned exactly (no range operator) so generated infrastructure is reproducible.