@aws/nx-plugin 1.0.0-rc.4 → 1.0.0-rc.41

package/src/utils/config/utils.js.map

@@ -1 +1 @@
-{"version":3,"file":"utils.js","sourceRoot":"","sources":["../../../../../../packages/nx-plugin/src/utils/config/utils.ts"],"names":[],"mappings":";;;AAAA;;;GAGG;AACH,uCAAoE;AAEpE,gCAAkD;AAClD,sCAAiD;AACjD,8BAA+C;AAElC,QAAA,8BAA8B,GAAG,0BAA0B,CAAC;AAEzE;;GAEG;AACI,MAAM,uBAAuB,GAAG,KAAK,EAC1C,IAAU,EACkB,EAAE;IAC9B,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,sCAA8B,CAAC,EAAE,CAAC;QACjD,0DAA0D;QAC1D,IAAA,sBAAa,EAAC,IAAI,EAAE,IAAA,0BAAiB,EAAC,SAAS,EAAE,OAAO,CAAC,EAAE,GAAG,EAAE,EAAE,CAAC,CAAC;IACtE,CAAC;IACD,oEAAoE;IACpE,OAAO,MAAM,IAAA,6BAAqB,EAAC,IAAI,CAAE,CAAC;AAC5C,CAAC,CAAC;AATW,QAAA,uBAAuB,2BASlC;AAEF;;GAEG;AACI,MAAM,qBAAqB,GAAG,KAAK,EACxC,IAAU,EAC8B,EAAE;IAC1C,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,sCAA8B,CAAC,EAAE,CAAC;QACjD,OAAO,SAAS,CAAC;IACnB,CAAC;IACD,MAAM,QAAQ,GAAG,IAAI,CAAC,IAAI,CAAC,sCAA8B,EAAE,OAAO,CAAC,CAAC;IACpE,OAAO,MAAM,IAAA,2BAAsB,EAAC,QAAQ,CAAC,CAAC;AAChD,CAAC,CAAC;AARW,QAAA,qBAAqB,yBAQhC;AAEF,MAAM,WAAW,GAAG,mBAAmB,CAAC;AAExC;;;;GAIG;AACH,MAAM,iBAAiB,GAAG,KAAK,EAC7B,IAAU,EACV,QAAgB,EAChB,GAAW,EACX,KAAc,EACC,EAAE;IACjB,MAAM,IAAI,GAAG,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC;IAEnC,kEAAkE;IAClE,+DAA+D;IAC/D,MAAM,iBAAiB,GAAG,MAAM,IAAA,iBAAW,EACzC,IAAI,EACJ,QAAQ,EACR,KAAK,GAAG,sEAAsE,CAC/E,CAAC;IACF,MAAM,aAAa,GACjB,CAAC,iBAAiB;QAClB,CAAC,MAAM,IAAA,iBAAW,EAChB,IAAI,EACJ,QAAQ,EACR,KAAK,GAAG,yDAAyD,CAClE,CAAC,CAAC;IAEL,IAAI,iBAAiB,IAAI,aAAa,EAAE,CAAC;QACvC,mEAAmE;QACnE,MAAM,MAAM,GAAG,iBAAiB;YAC9B,CAAC,CAAC,2CAA2C;YAC7C,CAAC,CAAC,8BAA8B,CAAC;QACnC,MAAM,IAAA,iBAAW,EACf,IAAI,EACJ,QAAQ,EACR,KAAK,GAAG,iBAAiB,GAAG,KAAK,WAAW,sBAAsB,MAAM,IAAI,CAC7E,CAAC;IACJ,CAAC;SAAM,CAAC;QACN,gEAAgE;QAChE,qEAAqE;QACrE,uEAAuE;QACvE,IAAI,KAAK,GAAG,MAAM,IAAA,iBAAW,EAC3B,IAAI,EACJ,QAAQ,EACR,uEAAuE,GAAG,KAAK,WAAW,MAAM,CACjG,CAAC;QAEF,IAAI,CAAC,KAAK,EAAE,CAAC;YACX,KAAK,GAAG,MAAM,IAAA,iBAAW,EACvB,IAAI,EACJ,QAAQ,EACR,gEAAgE,GAAG,KAAK,WAAW,sBAAsB,CAC1G,CAAC;QACJ,CAAC;QAED,IAAI,CAAC,KAAK,EAAE,CAAC;YACX,KAAK,GAAG,MAAM,IAAA,iBAAW,EACvB,IAAI,EACJ,QAAQ,EACR,uDAAuD,GAAG,KAAK,WAAW,MAAM,CACjF,CAAC;QACJ,CAAC;QAED,IAAI,CAAC,KAAK,EAAE,CAAC;YACX,MAAM,IAAA,iBAAW,EACf,IAAI,EACJ,QAAQ,EACR,gDAAgD,GAAG,KAAK,WAAW,MAAM,CAC1E,CAAC;QACJ,CAAC;IACH,CAAC;IAED,wDAAwD;IACxD,MAAM,OAAO,GAAG,IAAI,CAAC,IAAI,CAAC,QAAQ,CAAE,CAAC,QAAQ,EAAE,CAAC;IAChD,IAAI,CAAC,KAAK,CAAC,QAAQ,EAAE,OAAO,CAAC,OAAO,CAAC,WAAW,EAAE,IAAI,CAAC,CAAC,CAAC;AAC3D,CAAC,CAAC;AAEF;;;;GAIG;AACI,MAAM,uBAAuB,GAAG,KAAK,EAC1C,IAAU,EACV,YAAwC,EACzB,EAAE;IACjB,MAAM,QAAQ,GAAG,sCAA8B,CAAC;IAEhD,KAAK,MAAM,CAAC,GAAG,EAAE,KAAK,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,YAAY,CAAC,EAAE,CAAC;QACxD,MAAM,iBAAiB,CAAC,IAAI,EAAE,QAAQ,EAAE,GAAG,EAAE,KAAK,CAAC,CAAC;IACtD,CAAC;IAED,gEAAgE;IAChE,MAAM,IAAA,6BAAoB,EAAC,IAAI,EAAE,QAAQ,CAAC,CAAC;AAC7C,CAAC,CAAC;AAZW,QAAA,uBAAuB,2BAYlC"}
+{"version":3,"sources":["../../../../../../packages/nx-plugin/src/utils/config/utils.ts"],"sourcesContent":["/**\n * Copyright Amazon.com, Inc. or its affiliates. All Rights Reserved.\n * SPDX-License-Identifier: Apache-2.0\n */\nimport { generateFiles, joinPathFragments, type Tree } from '@nx/devkit';\nimport { existsSync, readFileSync } from 'fs';\nimport { createJiti } from 'jiti';\nimport { join } from 'path';\nimport { applyGritQL, matchGritQL } from '../ast';\nimport { formatFilesInSubtree } from '../format';\nimport type { AwsNxPluginConfig } from '.';\n\nexport const AWS_NX_PLUGIN_CONFIG_FILE_NAME = 'aws-nx-plugin.config.mts';\n\n/**\n * Aliases used by jiti to resolve `@aws/nx-plugin` imports in the config file\n * to this package's source, so the config can be evaluated in-memory.\n */\nconst AWS_NX_PLUGIN_JITI_ALIASES = {\n  '@aws/nx-plugin/sdk/license': join(\n    import.meta.dirname,\n    '..',\n    '..',\n    'sdk',\n    'license',\n  ),\n  '@aws/nx-plugin': join(import.meta.dirname, '..', '..'),\n};\n\n/**\n * Ensure that the config file exists\n */\nexport const ensureAwsNxPluginConfig = async (\n  tree: Tree,\n): Promise<AwsNxPluginConfig> => {\n  if (!tree.exists(AWS_NX_PLUGIN_CONFIG_FILE_NAME)) {\n    // Create an empty config file if it doesn't already exist\n    generateFiles(\n      tree,\n      joinPathFragments(import.meta.dirname, 'files'),\n      '.',\n      {},\n    );\n  }\n  // eslint-disable-next-line @typescript-eslint/no-non-null-assertion\n  return await readAwsNxPluginConfig(tree)!;\n};\n\n/**\n * Read config from the aws nx plugin configuration file.\n *\n * Uses jiti to evaluate the TypeScript source in-memory with proper module\n * resolution — imports from @aws/nx-plugin/* resolve via alias, and any\n * third-party imports resolve from the workspace's node_modules.\n */\nexport const readAwsNxPluginConfig = async (\n  tree: Tree,\n): Promise<AwsNxPluginConfig | undefined> => {\n  if (!tree.exists(AWS_NX_PLUGIN_CONFIG_FILE_NAME)) {\n    return undefined;\n  }\n  const source = tree.read(AWS_NX_PLUGIN_CONFIG_FILE_NAME, 'utf-8')!;\n  const configFilePath = join(tree.root, AWS_NX_PLUGIN_CONFIG_FILE_NAME);\n\n  const jiti = createJiti(import.meta.filename, {\n    alias: AWS_NX_PLUGIN_JITI_ALIASES,\n  });\n\n  const mod = jiti.evalModule(source, { filename: configFilePath });\n  return (mod as any).default ?? mod;\n};\n\n/**\n * Read config directly from disk. Used by executors that run in the real\n * workspace (not a virtual Tree). Resolves all imports — including\n * third-party dependencies — from the workspace's node_modules.\n */\nexport const readAwsNxPluginConfigFromDisk = (\n  workspaceRoot: string,\n): AwsNxPluginConfig | undefined => {\n  const configPath = join(workspaceRoot, AWS_NX_PLUGIN_CONFIG_FILE_NAME);\n  if (!existsSync(configPath)) return undefined;\n\n  const source = readFileSync(configPath, 'utf-8');\n\n  const jiti = createJiti(import.meta.filename, {\n    alias: AWS_NX_PLUGIN_JITI_ALIASES,\n  });\n  const mod = jiti.evalModule(source, { filename: configPath });\n  return (mod as any).default ?? mod;\n};\n\nconst PLACEHOLDER = '\"__PLACEHOLDER__\"';\n\n/**\n * Use GritQL to set a top-level property in the export default object,\n * then substitute the placeholder with the JSON-serialized value.\n * Preserves all other properties (including JS expressions) untouched.\n */\nconst setConfigProperty = async (\n  tree: Tree,\n  filePath: string,\n  key: string,\n  value: unknown,\n): Promise<void> => {\n  const json = JSON.stringify(value);\n\n  // Check if the property already exists using a named metavariable\n  // to avoid ambiguity with anonymous $_ in nested where clauses\n  const existsInSatisfies = await matchGritQL(\n    tree,\n    filePath,\n    `\\`${key}: $val\\` where { $val <: within \\`export default $_ satisfies $_\\` }`,\n  );\n  const existsInPlain =\n    !existsInSatisfies &&\n    (await matchGritQL(\n      tree,\n      filePath,\n      `\\`${key}: $val\\` where { $val <: within \\`export default $_\\` }`,\n    ));\n\n  if (existsInSatisfies || existsInPlain) {\n    // Replace only this property's value, scoped to the export default\n    const within = existsInSatisfies\n      ? `within \\`export default $_ satisfies $_\\``\n      : `within \\`export default $_\\``;\n    await applyGritQL(\n      tree,\n      filePath,\n      `\\`${key}: $old\\` => \\`${key}: ${PLACEHOLDER}\\` where { $old <: ${within} }`,\n    );\n  } else {\n    // Add the new property using GritQL's += (accumulate) operator.\n    // For non-empty objects, += appends correctly without double commas.\n    // For empty objects, += fails so we fall back to a direct replacement.\n    let added = await applyGritQL(\n      tree,\n      filePath,\n      `\\`export default { $props } satisfies $type\\` where { $props += \\`, ${key}: ${PLACEHOLDER}\\` }`,\n    );\n\n    if (!added) {\n      added = await applyGritQL(\n        tree,\n        filePath,\n        `\\`export default { } satisfies $type\\` => \\`export default { ${key}: ${PLACEHOLDER} } satisfies $type\\``,\n      );\n    }\n\n    if (!added) {\n      added = await applyGritQL(\n        tree,\n        filePath,\n        `\\`export default { $props }\\` where { $props += \\`, ${key}: ${PLACEHOLDER}\\` }`,\n      );\n    }\n\n    if (!added) {\n      await applyGritQL(\n        tree,\n        filePath,\n        `\\`export default { }\\` => \\`export default { ${key}: ${PLACEHOLDER} }\\``,\n      );\n    }\n  }\n\n  // Substitute the placeholder with the actual JSON value\n  const content = tree.read(filePath)!.toString();\n  tree.write(filePath, content.replace(PLACEHOLDER, json));\n};\n\n/**\n * Update the aws nx plugin config file.\n * Only the specified top-level keys are replaced; all other properties\n * (including those containing JS expressions) are left untouched in source.\n */\nexport const updateAwsNxPluginConfig = async (\n  tree: Tree,\n  configUpdate: Partial<AwsNxPluginConfig>,\n): Promise<void> => {\n  const filePath = AWS_NX_PLUGIN_CONFIG_FILE_NAME;\n\n  for (const [key, value] of Object.entries(configUpdate)) {\n    await setConfigProperty(tree, filePath, key, value);\n  }\n\n  // Prettier formats the result into properly indented TypeScript\n  await formatFilesInSubtree(tree, filePath);\n};\n"],"names":["generateFiles","joinPathFragments","existsSync","readFileSync","createJiti","join","applyGritQL","matchGritQL","formatFilesInSubtree","AWS_NX_PLUGIN_CONFIG_FILE_NAME","AWS_NX_PLUGIN_JITI_ALIASES","dirname","ensureAwsNxPluginConfig","tree","exists","readAwsNxPluginConfig","undefined","source","read","configFilePath","root","jiti","filename","alias","mod","evalModule","default","readAwsNxPluginConfigFromDisk","workspaceRoot","configPath","PLACEHOLDER","setConfigProperty","filePath","key","value","json","JSON","stringify","existsInSatisfies","existsInPlain","within","added","content","toString","write","replace","updateAwsNxPluginConfig","configUpdate","Object","entries"],"mappings":"AAAA;;;CAGC,GACD,SAASA,aAAa,EAAEC,iBAAiB,QAAmB,aAAa;AACzE,SAASC,UAAU,EAAEC,YAAY,QAAQ,KAAK;AAC9C,SAASC,UAAU,QAAQ,OAAO;AAClC,SAASC,IAAI,QAAQ,OAAO;AAC5B,SAASC,WAAW,EAAEC,WAAW,QAAQ,YAAS;AAClD,SAASC,oBAAoB,QAAQ,eAAY;AAGjD,OAAO,MAAMC,iCAAiC,2BAA2B;AAEzE;;;CAGC,GACD,MAAMC,6BAA6B;IACjC,8BAA8BL,KAC5B,YAAYM,OAAO,EACnB,MACA,MACA,OACA;IAEF,kBAAkBN,KAAK,YAAYM,OAAO,EAAE,MAAM;AACpD;AAEA;;CAEC,GACD,OAAO,MAAMC,0BAA0B,OACrCC;IAEA,IAAI,CAACA,KAAKC,MAAM,CAACL,iCAAiC;QAChD,0DAA0D;QAC1DT,cACEa,MACAZ,kBAAkB,YAAYU,OAAO,EAAE,UACvC,KACA,CAAC;IAEL;IACA,oEAAoE;IACpE,OAAO,MAAMI,sBAAsBF;AACrC,EAAE;AAEF;;;;;;CAMC,GACD,OAAO,MAAME,wBAAwB,OACnCF;IAEA,IAAI,CAACA,KAAKC,MAAM,CAACL,iCAAiC;QAChD,OAAOO;IACT;IACA,MAAMC,SAASJ,KAAKK,IAAI,CAACT,gCAAgC;IACzD,MAAMU,iBAAiBd,KAAKQ,KAAKO,IAAI,EAAEX;IAEvC,MAAMY,OAAOjB,WAAW,YAAYkB,QAAQ,EAAE;QAC5CC,OAAOb;IACT;IAEA,MAAMc,MAAMH,KAAKI,UAAU,CAACR,QAAQ;QAAEK,UAAUH;IAAe;IAC/D,OAAO,AAACK,IAAYE,OAAO,IAAIF;AACjC,EAAE;AAEF;;;;CAIC,GACD,OAAO,MAAMG,gCAAgC,CAC3CC;IAEA,MAAMC,aAAaxB,KAAKuB,eAAenB;IACvC,IAAI,CAACP,WAAW2B,aAAa,OAAOb;IAEpC,MAAMC,SAASd,aAAa0B,YAAY;IAExC,MAAMR,OAAOjB,WAAW,YAAYkB,QAAQ,EAAE;QAC5CC,OAAOb;IACT;IACA,MAAMc,MAAMH,KAAKI,UAAU,CAACR,QAAQ;QAAEK,UAAUO;IAAW;IAC3D,OAAO,AAACL,IAAYE,OAAO,IAAIF;AACjC,EAAE;AAEF,MAAMM,cAAc;AAEpB;;;;CAIC,GACD,MAAMC,oBAAoB,OACxBlB,MACAmB,UACAC,KACAC;IAEA,MAAMC,OAAOC,KAAKC,SAAS,CAACH;IAE5B,kEAAkE;IAClE,+DAA+D;IAC/D,MAAMI,oBAAoB,MAAM/B,YAC9BM,MACAmB,UACA,CAAC,EAAE,EAAEC,IAAI,oEAAoE,CAAC;IAEhF,MAAMM,gBACJ,CAACD,qBACA,MAAM/B,YACLM,MACAmB,UACA,CAAC,EAAE,EAAEC,IAAI,uDAAuD,CAAC;IAGrE,IAAIK,qBAAqBC,eAAe;QACtC,mEAAmE;QACnE,MAAMC,SAASF,oBACX,CAAC,yCAAyC,CAAC,GAC3C,CAAC,4BAA4B,CAAC;QAClC,MAAMhC,YACJO,MACAmB,UACA,CAAC,EAAE,EAAEC,IAAI,cAAc,EAAEA,IAAI,EAAE,EAAEH,YAAY,mBAAmB,EAAEU,OAAO,EAAE,CAAC;IAEhF,OAAO;QACL,gEAAgE;QAChE,qEAAqE;QACrE,uEAAuE;QACvE,IAAIC,QAAQ,MAAMnC,YAChBO,MACAmB,UACA,CAAC,oEAAoE,EAAEC,IAAI,EAAE,EAAEH,YAAY,IAAI,CAAC;QAGlG,IAAI,CAACW,OAAO;YACVA,QAAQ,MAAMnC,YACZO,MACAmB,UACA,CAAC,6DAA6D,EAAEC,IAAI,EAAE,EAAEH,YAAY,oBAAoB,CAAC;QAE7G;QAEA,IAAI,CAACW,OAAO;YACVA,QAAQ,MAAMnC,YACZO,MACAmB,UACA,CAAC,oDAAoD,EAAEC,IAAI,EAAE,EAAEH,YAAY,IAAI,CAAC;QAEpF;QAEA,IAAI,CAACW,OAAO;YACV,MAAMnC,YACJO,MACAmB,UACA,CAAC,6CAA6C,EAAEC,IAAI,EAAE,EAAEH,YAAY,IAAI,CAAC;QAE7E;IACF;IAEA,wDAAwD;IACxD,MAAMY,UAAU7B,KAAKK,IAAI,CAACc,UAAWW,QAAQ;IAC7C9B,KAAK+B,KAAK,CAACZ,UAAUU,QAAQG,OAAO,CAACf,aAAaK;AACpD;AAEA;;;;CAIC,GACD,OAAO,MAAMW,0BAA0B,OACrCjC,MACAkC;IAEA,MAAMf,WAAWvB;IAEjB,KAAK,MAAM,CAACwB,KAAKC,MAAM,IAAIc,OAAOC,OAAO,CAACF,cAAe;QACvD,MAAMhB,kBAAkBlB,MAAMmB,UAAUC,KAAKC;IAC/C;IAEA,gEAAgE;IAChE,MAAM1B,qBAAqBK,MAAMmB;AACnC,EAAE"}

package/src/utils/connection/open-api/files/components/__apiNameClassName__Provider.tsx.template

@@ -39,7 +39,7 @@ const useCreate<%- apiNameClassName %>Client = (): <%- apiNameClassName %> => {
   const user = auth?.user;
   const cognitoClient: typeof fetch = (url, init) => {
     const headers = new Headers(init?.headers);
-    headers.set('Authorization', `Bearer ${user?.id_token}`);
+    headers.set('Authorization', `Bearer ${user?.access_token}`);
     return fetch(url, { ...init, headers });
   };
   <%_ } _%>

package/src/utils/connection/open-api/react.d.ts

@@ -2,7 +2,7 @@
  * Copyright Amazon.com, Inc. or its affiliates. All Rights Reserved.
  * SPDX-License-Identifier: Apache-2.0
  */
-import { ProjectConfiguration, Tree } from '@nx/devkit';
+import { type ProjectConfiguration, type Tree } from '@nx/devkit';
 export interface AddOpenApiReactClientOptions {
     /**
      * The react project to add the openapi client and build targets to
@@ -43,13 +43,13 @@ export interface AddOpenApiReactClientOptions {
      */
     isAgentRuntime?: boolean;
     /**
-     * When true, skips the serve-local setup. Use this when the caller
-     * handles serve-local configuration separately (e.g. agent connections
-     * that use a component-specific serve-local target instead of 'serve').
+     * When true, skips the dev target setup. Use this when the caller
+     * handles dev target configuration separately (e.g. agent connections
+     * that use a component-specific dev target instead of 'serve').
      */
-    skipServeLocal?: boolean;
+    skipLocalDev?: boolean;
 }
 /**
  * Adds an OpenAPI React client to the frontend project along with supporting build targets
  */
-export declare const addOpenApiReactClient: (tree: Tree, { apiName, frontendProjectConfig, backendProjectConfig, specBuildProject, specPath, specBuildTargetName, auth, port, isAgentRuntime, skipServeLocal, }: AddOpenApiReactClientOptions) => Promise<void>;
+export declare const addOpenApiReactClient: (tree: Tree, { apiName, frontendProjectConfig, backendProjectConfig, specBuildProject, specPath, specBuildTargetName, auth, port, isAgentRuntime, skipLocalDev, }: AddOpenApiReactClientOptions) => Promise<void>;

package/src/utils/connection/open-api/react.js

@@ -1,138 +1,142 @@
-"use strict";
-Object.defineProperty(exports, "__esModule", { value: true });
-exports.addOpenApiReactClient = void 0;
-const tslib_1 = require("tslib");
 /**
  * Copyright Amazon.com, Inc. or its affiliates. All Rights Reserved.
  * SPDX-License-Identifier: Apache-2.0
- */
-const devkit_1 = require("@nx/devkit");
-const names_1 = require("../../names");
-const object_1 = require("../../object");
-const git_1 = require("../../git");
-const generator_1 = tslib_1.__importDefault(require("../../../ts/react-website/runtime-config/generator"));
-const ast_1 = require("../../ast");
-const serve_local_1 = require("../../../connection/serve-local");
-const versions_1 = require("../../versions");
+ */ import { addDependenciesToPackageJson, generateFiles, joinPathFragments, OverwriteStrategy, updateProjectConfiguration } from "@nx/devkit";
+import { addTargetToLocalDev } from "../../../connection/local-dev.js";
+import runtimeConfigGenerator from "../../../ts/react-website/runtime-config/generator.js";
+import { addSingleImport, applyGritQL } from "../../ast.js";
+import { updateGitIgnore } from "../../git.js";
+import { kebabCase, toClassName } from "../../names.js";
+import { sortObjectKeys } from "../../object.js";
+import { withVersions } from "../../versions.js";
 /**
  * Adds an OpenAPI React client to the frontend project along with supporting build targets
- */
-const addOpenApiReactClient = async (tree, { apiName, frontendProjectConfig, backendProjectConfig, specBuildProject, specPath, specBuildTargetName, auth, port, isAgentRuntime = false, skipServeLocal = false, }) => {
-    const clientGenTarget = `generate:${(0, names_1.kebabCase)(apiName)}-client`;
+ */ export const addOpenApiReactClient = async (tree, { apiName, frontendProjectConfig, backendProjectConfig, specBuildProject, specPath, specBuildTargetName, auth, port, isAgentRuntime = false, skipLocalDev = false })=>{
+    const clientGenTarget = `generate:${kebabCase(apiName)}-client`;
     const clientGenWatchTarget = `watch-${clientGenTarget}`;
-    const generatedClientDir = (0, devkit_1.joinPathFragments)('generated', (0, names_1.kebabCase)(apiName));
-    const generatedClientDirFromRoot = (0, devkit_1.joinPathFragments)(frontendProjectConfig.sourceRoot, generatedClientDir);
+    const generatedClientDir = joinPathFragments('generated', kebabCase(apiName));
+    const generatedClientDirFromRoot = joinPathFragments(frontendProjectConfig.sourceRoot, generatedClientDir);
     // Add TypeScript client generation to Frontend project.json
-    (0, devkit_1.updateProjectConfiguration)(tree, frontendProjectConfig.name, {
+    updateProjectConfiguration(tree, frontendProjectConfig.name, {
         ...frontendProjectConfig,
-        targets: (0, object_1.sortObjectKeys)({
+        targets: sortObjectKeys({
             ...frontendProjectConfig.targets,
             // Generate should run before compile and bundle as the client is created as part of the website src
-            ...Object.fromEntries(['compile', 'bundle'].map((target) => [
-                target,
-                {
-                    ...frontendProjectConfig.targets?.[target],
-                    dependsOn: [
-                        ...(frontendProjectConfig.targets?.[target]?.dependsOn ?? []).filter((t) => t !== clientGenTarget),
-                        clientGenTarget,
-                    ],
-                },
-            ])),
+            ...Object.fromEntries([
+                'compile',
+                'bundle'
+            ].map((target)=>[
+                    target,
+                    {
+                        ...frontendProjectConfig.targets?.[target],
+                        dependsOn: [
+                            ...(frontendProjectConfig.targets?.[target]?.dependsOn ?? []).filter((t)=>t !== clientGenTarget),
+                            clientGenTarget
+                        ]
+                    }
+                ])),
             [clientGenTarget]: {
                 cache: true,
                 executor: 'nx:run-commands',
                 inputs: [
                     {
-                        dependentTasksOutputFiles: '**/*.json',
-                    },
+                        dependentTasksOutputFiles: '**/*.json'
+                    }
                 ],
                 outputs: [
-                    (0, devkit_1.joinPathFragments)('{workspaceRoot}', generatedClientDirFromRoot),
+                    joinPathFragments('{workspaceRoot}', generatedClientDirFromRoot)
                 ],
                 options: {
                     commands: [
-                        `nx g @aws/nx-plugin:open-api#ts-hooks --openApiSpecPath="${specPath}" --outputPath="${generatedClientDirFromRoot}" --no-interactive`,
-                    ],
+                        `nx g @aws/nx-plugin:open-api#ts-hooks --openApiSpecPath="${specPath}" --outputPath="${generatedClientDirFromRoot}" --no-interactive`
+                    ]
                 },
-                dependsOn: [specBuildTargetName],
+                dependsOn: [
+                    specBuildTargetName
+                ]
             },
             // Watch target for regenerating the client
             [clientGenWatchTarget]: {
                 executor: 'nx:run-commands',
                 options: {
                     commands: [
-                        `nx watch --projects=${specBuildProject.name} --includeDependentProjects -- nx run ${frontendProjectConfig.name}:"${clientGenTarget}"`,
-                    ],
+                        `nx watch --projects=${specBuildProject.name} --includeDependencies -- nx run ${frontendProjectConfig.name}:"${clientGenTarget}"`
+                    ]
                 },
-                continuous: true,
-            },
-        }),
+                continuous: true
+            }
+        })
     });
     const relativeSrcDir = frontendProjectConfig.sourceRoot.slice(frontendProjectConfig.root.length + 1);
     // Ignore the generated client by default
     // Users can safely remove the entry from the .gitignore if they prefer to check it in
-    (0, git_1.updateGitIgnore)(tree, frontendProjectConfig.root, (patterns) => [
-        ...patterns,
-        (0, devkit_1.joinPathFragments)(relativeSrcDir, generatedClientDir),
-    ]);
+    updateGitIgnore(tree, frontendProjectConfig.root, (patterns)=>[
+            ...patterns,
+            joinPathFragments(relativeSrcDir, generatedClientDir)
+        ]);
     // Ensure that the frontend has runtime config as we'll use the url for creating the client
-    await (0, generator_1.default)(tree, {
-        project: frontendProjectConfig.name,
+    await runtimeConfigGenerator(tree, {
+        project: frontendProjectConfig.name
     });
     // Add sigv4 fetch
     if (auth === 'iam') {
-        (0, devkit_1.generateFiles)(tree, (0, devkit_1.joinPathFragments)(__dirname, '../../files/website/hooks/sigv4'), (0, devkit_1.joinPathFragments)(frontendProjectConfig.sourceRoot, 'hooks'), {}, {
-            overwriteStrategy: devkit_1.OverwriteStrategy.KeepExisting,
+        generateFiles(tree, joinPathFragments(import.meta.dirname, '../../files/website/hooks/sigv4'), joinPathFragments(frontendProjectConfig.sourceRoot, 'hooks'), {}, {
+            overwriteStrategy: OverwriteStrategy.KeepExisting
         });
     }
     // Generate the tanstack query provider if it does not exist already
-    (0, devkit_1.generateFiles)(tree, (0, devkit_1.joinPathFragments)(__dirname, '../../files/website/components/tanstack-query'), (0, devkit_1.joinPathFragments)(frontendProjectConfig.sourceRoot, 'components'), {}, {
-        overwriteStrategy: devkit_1.OverwriteStrategy.KeepExisting,
+    generateFiles(tree, joinPathFragments(import.meta.dirname, '../../files/website/components/tanstack-query'), joinPathFragments(frontendProjectConfig.sourceRoot, 'components'), {}, {
+        overwriteStrategy: OverwriteStrategy.KeepExisting
     });
-    const apiNameClassName = (0, names_1.toClassName)(apiName);
+    const apiNameClassName = toClassName(apiName);
     // Add a hook to instantiate the client
-    (0, devkit_1.generateFiles)(tree, (0, devkit_1.joinPathFragments)(__dirname, 'files'), frontendProjectConfig.sourceRoot, {
+    generateFiles(tree, joinPathFragments(import.meta.dirname, 'files'), frontendProjectConfig.sourceRoot, {
         auth,
         apiName,
         apiNameClassName,
         generatedClientDir,
-        isAgentRuntime,
+        isAgentRuntime
     });
     // Update main.tsx to add required providers
-    const mainTsxPath = (0, devkit_1.joinPathFragments)(frontendProjectConfig.sourceRoot, 'main.tsx');
+    const mainTsxPath = joinPathFragments(frontendProjectConfig.sourceRoot, 'main.tsx');
     // Add the query client provider if it doesn't exist already
-    await (0, ast_1.addSingleImport)(tree, mainTsxPath, 'QueryClientProvider', './components/QueryClientProvider');
-    await (0, ast_1.applyGritQL)(tree, mainTsxPath, '`<App />` => `<QueryClientProvider><App /></QueryClientProvider>` where { $program <: not contains `<QueryClientProvider>$_</QueryClientProvider>` }');
+    await addSingleImport(tree, mainTsxPath, 'QueryClientProvider', './components/QueryClientProvider');
+    await applyGritQL(tree, mainTsxPath, '`<App />` => `<QueryClientProvider><App /></QueryClientProvider>` where { $program <: not contains `<QueryClientProvider>$_</QueryClientProvider>` }');
     // Add the api provider if it does not exist
     const providerName = `${apiNameClassName}Provider`;
-    await (0, ast_1.addSingleImport)(tree, mainTsxPath, providerName, `./components/${providerName}`);
-    await (0, ast_1.applyGritQL)(tree, mainTsxPath, `\`<App />\` => \`<${providerName}><App /></${providerName}>\` where { $program <: not contains \`<${providerName}>$_</${providerName}>\` }`);
-    // Update serve-local on the website to use our local server.
-    // Callers that handle serve-local separately (e.g. agent connections) set skipServeLocal.
-    if (!skipServeLocal) {
-        await (0, serve_local_1.addTargetToServeLocal)(tree, frontendProjectConfig.name, backendProjectConfig.name, {
+    await addSingleImport(tree, mainTsxPath, providerName, `./components/${providerName}`);
+    await applyGritQL(tree, mainTsxPath, `\`<App />\` => \`<${providerName}><App /></${providerName}>\` where { $program <: not contains \`<${providerName}>$_</${providerName}>\` }`);
+    // Update the dev target on the website to use our local server.
+    // Callers that handle the dev target separately (e.g. agent connections) set skipLocalDev.
+    if (!skipLocalDev) {
+        await addTargetToLocalDev(tree, frontendProjectConfig.name, backendProjectConfig.name, {
             url: `http://localhost:${port}/`,
             apiName,
             // Additionally add a dependency on the generate watch command to ensure that local
             // API changes that affect the client are also reloaded.
             // We include a dependency on the generate target as watch ONLY triggers on a change,
             // and we need to ensure the client is generated the first time if not already present.
-            additionalDependencyTargets: [clientGenTarget, clientGenWatchTarget],
+            additionalDependencyTargets: [
+                clientGenTarget,
+                clientGenWatchTarget
+            ]
         });
     }
-    (0, devkit_1.addDependenciesToPackageJson)(tree, (0, versions_1.withVersions)([
-        ...(auth === 'iam'
-            ? [
-                'oidc-client-ts',
-                'react-oidc-context',
-                '@aws-sdk/credential-provider-cognito-identity',
-                'aws4fetch',
-            ]
-            : []),
-        ...(auth === 'cognito' ? ['react-oidc-context'] : []),
+    addDependenciesToPackageJson(tree, withVersions([
+        ...auth === 'iam' ? [
+            'oidc-client-ts',
+            'react-oidc-context',
+            '@aws-sdk/credential-provider-cognito-identity',
+            'aws4fetch'
+        ] : [],
+        ...auth === 'cognito' ? [
+            'react-oidc-context'
+        ] : [],
         '@tanstack/react-query',
-        '@tanstack/react-query-devtools',
-    ]), (0, versions_1.withVersions)(['@smithy/types']));
+        '@tanstack/react-query-devtools'
+    ]), withVersions([
+        '@smithy/types'
+    ]));
 };
-exports.addOpenApiReactClient = addOpenApiReactClient;
+
 //# sourceMappingURL=react.js.map

package/src/utils/connection/open-api/react.js.map

@@ -1 +1 @@
-{"version":3,"file":"react.js","sourceRoot":"","sources":["../../../../../../../packages/nx-plugin/src/utils/connection/open-api/react.ts"],"names":[],"mappings":";;;;AAAA;;;GAGG;AACH,uCAQoB;AACpB,uCAAqD;AACrD,yCAA8C;AAC9C,mCAA4C;AAC5C,2GAAwF;AACxF,mCAAyD;AACzD,iEAAwE;AACxE,6CAA8C;AAiD9C;;GAEG;AACI,MAAM,qBAAqB,GAAG,KAAK,EACxC,IAAU,EACV,EACE,OAAO,EACP,qBAAqB,EACrB,oBAAoB,EACpB,gBAAgB,EAChB,QAAQ,EACR,mBAAmB,EACnB,IAAI,EACJ,IAAI,EACJ,cAAc,GAAG,KAAK,EACtB,cAAc,GAAG,KAAK,GACO,EAC/B,EAAE;IACF,MAAM,eAAe,GAAG,YAAY,IAAA,iBAAS,EAAC,OAAO,CAAC,SAAS,CAAC;IAChE,MAAM,oBAAoB,GAAG,SAAS,eAAe,EAAE,CAAC;IAExD,MAAM,kBAAkB,GAAG,IAAA,0BAAiB,EAAC,WAAW,EAAE,IAAA,iBAAS,EAAC,OAAO,CAAC,CAAC,CAAC;IAC9E,MAAM,0BAA0B,GAAG,IAAA,0BAAiB,EAClD,qBAAqB,CAAC,UAAU,EAChC,kBAAkB,CACnB,CAAC;IAEF,4DAA4D;IAC5D,IAAA,mCAA0B,EAAC,IAAI,EAAE,qBAAqB,CAAC,IAAI,EAAE;QAC3D,GAAG,qBAAqB;QACxB,OAAO,EAAE,IAAA,uBAAc,EAAC;YACtB,GAAG,qBAAqB,CAAC,OAAO;YAChC,oGAAoG;YACpG,GAAG,MAAM,CAAC,WAAW,CACnB,CAAC,SAAS,EAAE,QAAQ,CAAC,CAAC,GAAG,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC;gBACpC,MAAM;gBACN;oBACE,GAAG,qBAAqB,CAAC,OAAO,EAAE,CAAC,MAAM,CAAC;oBAC1C,SAAS,EAAE;wBACT,GAAG,CACD,qBAAqB,CAAC,OAAO,EAAE,CAAC,MAAM,CAAC,EAAE,SAAS,IAAI,EAAE,CACzD,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,KAAK,eAAe,CAAC;wBACtC,eAAe;qBAChB;iBACF;aACF,CAAC,CACH;YACD,CAAC,eAAe,CAAC,EAAE;gBACjB,KAAK,EAAE,IAAI;gBACX,QAAQ,EAAE,iBAAiB;gBAC3B,MAAM,EAAE;oBACN;wBACE,yBAAyB,EAAE,WAAW;qBACvC;iBACF;gBACD,OAAO,EAAE;oBACP,IAAA,0BAAiB,EAAC,iBAAiB,EAAE,0BAA0B,CAAC;iBACjE;gBACD,OAAO,EAAE;oBACP,QAAQ,EAAE;wBACR,4DAA4D,QAAQ,mBAAmB,0BAA0B,oBAAoB;qBACtI;iBACF;gBACD,SAAS,EAAE,CAAC,mBAAmB,CAAC;aACjC;YACD,2CAA2C;YAC3C,CAAC,oBAAoB,CAAC,EAAE;gBACtB,QAAQ,EAAE,iBAAiB;gBAC3B,OAAO,EAAE;oBACP,QAAQ,EAAE;wBACR,uBAAuB,gBAAgB,CAAC,IAAI,yCAAyC,qBAAqB,CAAC,IAAI,KAAK,eAAe,GAAG;qBACvI;iBACF;gBACD,UAAU,EAAE,IAAI;aACjB;SACF,CAAC;KACH,CAAC,CAAC;IAEH,MAAM,cAAc,GAAG,qBAAqB,CAAC,UAAU,CAAC,KAAK,CAC3D,qBAAqB,CAAC,IAAI,CAAC,MAAM,GAAG,CAAC,CACtC,CAAC;IAEF,yCAAyC;IACzC,sFAAsF;IACtF,IAAA,qBAAe,EAAC,IAAI,EAAE,qBAAqB,CAAC,IAAI,EAAE,CAAC,QAAQ,EAAE,EAAE,CAAC;QAC9D,GAAG,QAAQ;QACX,IAAA,0BAAiB,EAAC,cAAc,EAAE,kBAAkB,CAAC;KACtD,CAAC,CAAC;IAEH,2FAA2F;IAC3F,MAAM,IAAA,mBAAsB,EAAC,IAAI,EAAE;QACjC,OAAO,EAAE,qBAAqB,CAAC,IAAI;KACpC,CAAC,CAAC;IAEH,kBAAkB;IAClB,IAAI,IAAI,KAAK,KAAK,EAAE,CAAC;QACnB,IAAA,sBAAa,EACX,IAAI,EACJ,IAAA,0BAAiB,EAAC,SAAS,EAAE,iCAAiC,CAAC,EAC/D,IAAA,0BAAiB,EAAC,qBAAqB,CAAC,UAAU,EAAE,OAAO,CAAC,EAC5D,EAAE,EACF;YACE,iBAAiB,EAAE,0BAAiB,CAAC,YAAY;SAClD,CACF,CAAC;IACJ,CAAC;IAED,oEAAoE;IACpE,IAAA,sBAAa,EACX,IAAI,EACJ,IAAA,0BAAiB,EACf,SAAS,EACT,+CAA+C,CAChD,EACD,IAAA,0BAAiB,EAAC,qBAAqB,CAAC,UAAU,EAAE,YAAY,CAAC,EACjE,EAAE,EACF;QACE,iBAAiB,EAAE,0BAAiB,CAAC,YAAY;KAClD,CACF,CAAC;IAEF,MAAM,gBAAgB,GAAG,IAAA,mBAAW,EAAC,OAAO,CAAC,CAAC;IAE9C,uCAAuC;IACvC,IAAA,sBAAa,EACX,IAAI,EACJ,IAAA,0BAAiB,EAAC,SAAS,EAAE,OAAO,CAAC,EACrC,qBAAqB,CAAC,UAAU,EAChC;QACE,IAAI;QACJ,OAAO;QACP,gBAAgB;QAChB,kBAAkB;QAClB,cAAc;KACf,CACF,CAAC;IAEF,4CAA4C;IAC5C,MAAM,WAAW,GAAG,IAAA,0BAAiB,EACnC,qBAAqB,CAAC,UAAU,EAChC,UAAU,CACX,CAAC;IAEF,4DAA4D;IAC5D,MAAM,IAAA,qBAAe,EACnB,IAAI,EACJ,WAAW,EACX,qBAAqB,EACrB,kCAAkC,CACnC,CAAC;IACF,MAAM,IAAA,iBAAW,EACf,IAAI,EACJ,WAAW,EACX,sJAAsJ,CACvJ,CAAC;IAEF,4CAA4C;IAC5C,MAAM,YAAY,GAAG,GAAG,gBAAgB,UAAU,CAAC;IACnD,MAAM,IAAA,qBAAe,EACnB,IAAI,EACJ,WAAW,EACX,YAAY,EACZ,gBAAgB,YAAY,EAAE,CAC/B,CAAC;IACF,MAAM,IAAA,iBAAW,EACf,IAAI,EACJ,WAAW,EACX,qBAAqB,YAAY,aAAa,YAAY,2CAA2C,YAAY,QAAQ,YAAY,OAAO,CAC7I,CAAC;IAEF,6DAA6D;IAC7D,0FAA0F;IAC1F,IAAI,CAAC,cAAc,EAAE,CAAC;QACpB,MAAM,IAAA,mCAAqB,EACzB,IAAI,EACJ,qBAAqB,CAAC,IAAI,EAC1B,oBAAoB,CAAC,IAAI,EACzB;YACE,GAAG,EAAE,oBAAoB,IAAI,GAAG;YAChC,OAAO;YACP,mFAAmF;YACnF,wDAAwD;YACxD,qFAAqF;YACrF,uFAAuF;YACvF,2BAA2B,EAAE,CAAC,eAAe,EAAE,oBAAoB,CAAC;SACrE,CACF,CAAC;IACJ,CAAC;IAED,IAAA,qCAA4B,EAC1B,IAAI,EACJ,IAAA,uBAAY,EAAC;QACX,GAAI,CAAC,IAAI,KAAK,KAAK;YACjB,CAAC,CAAC;gBACE,gBAAgB;gBAChB,oBAAoB;gBACpB,+CAA+C;gBAC/C,WAAW;aACZ;YACH,CAAC,CAAC,EAAE,CAAS;QACf,GAAI,CAAC,IAAI,KAAK,SAAS,CAAC,CAAC,CAAC,CAAC,oBAAoB,CAAC,CAAC,CAAC,CAAC,EAAE,CAAS;QAC9D,uBAAuB;QACvB,gCAAgC;KACjC,CAAC,EACF,IAAA,uBAAY,EAAC,CAAC,eAAe,CAAC,CAAC,CAChC,CAAC;AACJ,CAAC,CAAC;AA3MW,QAAA,qBAAqB,yBA2MhC"}
+{"version":3,"sources":["../../../../../../../packages/nx-plugin/src/utils/connection/open-api/react.ts"],"sourcesContent":["/**\n * Copyright Amazon.com, Inc. or its affiliates. All Rights Reserved.\n * SPDX-License-Identifier: Apache-2.0\n */\nimport {\n  addDependenciesToPackageJson,\n  generateFiles,\n  joinPathFragments,\n  OverwriteStrategy,\n  type ProjectConfiguration,\n  type Tree,\n  updateProjectConfiguration,\n} from '@nx/devkit';\nimport { addTargetToLocalDev } from '../../../connection/local-dev';\nimport runtimeConfigGenerator from '../../../ts/react-website/runtime-config/generator';\nimport { addSingleImport, applyGritQL } from '../../ast';\nimport { updateGitIgnore } from '../../git';\nimport { kebabCase, toClassName } from '../../names';\nimport { sortObjectKeys } from '../../object';\nimport { withVersions } from '../../versions';\n\nexport interface AddOpenApiReactClientOptions {\n  /**\n   * The react project to add the openapi client and build targets to\n   */\n  frontendProjectConfig: ProjectConfiguration;\n  /**\n   * The backend project which serves the api\n   */\n  backendProjectConfig: ProjectConfiguration;\n  /**\n   * The project which builds/generates the openapi spec\n   */\n  specBuildProject: ProjectConfiguration;\n  /**\n   * Name of the api\n   */\n  apiName: string;\n  /**\n   * Path to the openapi spec from the workspace root\n   */\n  specPath: string;\n  /**\n   * Fully qualified target name for the target that builds/generates the openapi spec\n   */\n  specBuildTargetName: string;\n  /**\n   * Authentication method\n   */\n  auth: 'iam' | 'cognito' | 'custom';\n  /**\n   * Port on which the backend project's local server listens\n   */\n  port: number;\n  /**\n   * When true, the generated provider reads from runtimeConfig.agentRuntimes\n   * and converts Bedrock AgentCore Runtime ARNs to HTTP URLs.\n   * When false (default), reads from runtimeConfig.apis directly.\n   */\n  isAgentRuntime?: boolean;\n  /**\n   * When true, skips the dev target setup. Use this when the caller\n   * handles dev target configuration separately (e.g. agent connections\n   * that use a component-specific dev target instead of 'serve').\n   */\n  skipLocalDev?: boolean;\n}\n\n/**\n * Adds an OpenAPI React client to the frontend project along with supporting build targets\n */\nexport const addOpenApiReactClient = async (\n  tree: Tree,\n  {\n    apiName,\n    frontendProjectConfig,\n    backendProjectConfig,\n    specBuildProject,\n    specPath,\n    specBuildTargetName,\n    auth,\n    port,\n    isAgentRuntime = false,\n    skipLocalDev = false,\n  }: AddOpenApiReactClientOptions,\n) => {\n  const clientGenTarget = `generate:${kebabCase(apiName)}-client`;\n  const clientGenWatchTarget = `watch-${clientGenTarget}`;\n\n  const generatedClientDir = joinPathFragments('generated', kebabCase(apiName));\n  const generatedClientDirFromRoot = joinPathFragments(\n    frontendProjectConfig.sourceRoot,\n    generatedClientDir,\n  );\n\n  // Add TypeScript client generation to Frontend project.json\n  updateProjectConfiguration(tree, frontendProjectConfig.name, {\n    ...frontendProjectConfig,\n    targets: sortObjectKeys({\n      ...frontendProjectConfig.targets,\n      // Generate should run before compile and bundle as the client is created as part of the website src\n      ...Object.fromEntries(\n        ['compile', 'bundle'].map((target) => [\n          target,\n          {\n            ...frontendProjectConfig.targets?.[target],\n            dependsOn: [\n              ...(\n                frontendProjectConfig.targets?.[target]?.dependsOn ?? []\n              ).filter((t) => t !== clientGenTarget),\n              clientGenTarget,\n            ],\n          },\n        ]),\n      ),\n      [clientGenTarget]: {\n        cache: true,\n        executor: 'nx:run-commands',\n        inputs: [\n          {\n            dependentTasksOutputFiles: '**/*.json',\n          },\n        ],\n        outputs: [\n          joinPathFragments('{workspaceRoot}', generatedClientDirFromRoot),\n        ],\n        options: {\n          commands: [\n            `nx g @aws/nx-plugin:open-api#ts-hooks --openApiSpecPath=\"${specPath}\" --outputPath=\"${generatedClientDirFromRoot}\" --no-interactive`,\n          ],\n        },\n        dependsOn: [specBuildTargetName],\n      },\n      // Watch target for regenerating the client\n      [clientGenWatchTarget]: {\n        executor: 'nx:run-commands',\n        options: {\n          commands: [\n            `nx watch --projects=${specBuildProject.name} --includeDependencies -- nx run ${frontendProjectConfig.name}:\"${clientGenTarget}\"`,\n          ],\n        },\n        continuous: true,\n      },\n    }),\n  });\n\n  const relativeSrcDir = frontendProjectConfig.sourceRoot.slice(\n    frontendProjectConfig.root.length + 1,\n  );\n\n  // Ignore the generated client by default\n  // Users can safely remove the entry from the .gitignore if they prefer to check it in\n  updateGitIgnore(tree, frontendProjectConfig.root, (patterns) => [\n    ...patterns,\n    joinPathFragments(relativeSrcDir, generatedClientDir),\n  ]);\n\n  // Ensure that the frontend has runtime config as we'll use the url for creating the client\n  await runtimeConfigGenerator(tree, {\n    project: frontendProjectConfig.name,\n  });\n\n  // Add sigv4 fetch\n  if (auth === 'iam') {\n    generateFiles(\n      tree,\n      joinPathFragments(import.meta.dirname, '../../files/website/hooks/sigv4'),\n      joinPathFragments(frontendProjectConfig.sourceRoot, 'hooks'),\n      {},\n      {\n        overwriteStrategy: OverwriteStrategy.KeepExisting,\n      },\n    );\n  }\n\n  // Generate the tanstack query provider if it does not exist already\n  generateFiles(\n    tree,\n    joinPathFragments(\n      import.meta.dirname,\n      '../../files/website/components/tanstack-query',\n    ),\n    joinPathFragments(frontendProjectConfig.sourceRoot, 'components'),\n    {},\n    {\n      overwriteStrategy: OverwriteStrategy.KeepExisting,\n    },\n  );\n\n  const apiNameClassName = toClassName(apiName);\n\n  // Add a hook to instantiate the client\n  generateFiles(\n    tree,\n    joinPathFragments(import.meta.dirname, 'files'),\n    frontendProjectConfig.sourceRoot,\n    {\n      auth,\n      apiName,\n      apiNameClassName,\n      generatedClientDir,\n      isAgentRuntime,\n    },\n  );\n\n  // Update main.tsx to add required providers\n  const mainTsxPath = joinPathFragments(\n    frontendProjectConfig.sourceRoot,\n    'main.tsx',\n  );\n\n  // Add the query client provider if it doesn't exist already\n  await addSingleImport(\n    tree,\n    mainTsxPath,\n    'QueryClientProvider',\n    './components/QueryClientProvider',\n  );\n  await applyGritQL(\n    tree,\n    mainTsxPath,\n    '`<App />` => `<QueryClientProvider><App /></QueryClientProvider>` where { $program <: not contains `<QueryClientProvider>$_</QueryClientProvider>` }',\n  );\n\n  // Add the api provider if it does not exist\n  const providerName = `${apiNameClassName}Provider`;\n  await addSingleImport(\n    tree,\n    mainTsxPath,\n    providerName,\n    `./components/${providerName}`,\n  );\n  await applyGritQL(\n    tree,\n    mainTsxPath,\n    `\\`<App />\\` => \\`<${providerName}><App /></${providerName}>\\` where { $program <: not contains \\`<${providerName}>$_</${providerName}>\\` }`,\n  );\n\n  // Update the dev target on the website to use our local server.\n  // Callers that handle the dev target separately (e.g. agent connections) set skipLocalDev.\n  if (!skipLocalDev) {\n    await addTargetToLocalDev(\n      tree,\n      frontendProjectConfig.name,\n      backendProjectConfig.name,\n      {\n        url: `http://localhost:${port}/`,\n        apiName,\n        // Additionally add a dependency on the generate watch command to ensure that local\n        // API changes that affect the client are also reloaded.\n        // We include a dependency on the generate target as watch ONLY triggers on a change,\n        // and we need to ensure the client is generated the first time if not already present.\n        additionalDependencyTargets: [clientGenTarget, clientGenWatchTarget],\n      },\n    );\n  }\n\n  addDependenciesToPackageJson(\n    tree,\n    withVersions([\n      ...((auth === 'iam'\n        ? [\n            'oidc-client-ts',\n            'react-oidc-context',\n            '@aws-sdk/credential-provider-cognito-identity',\n            'aws4fetch',\n          ]\n        : []) as any),\n      ...((auth === 'cognito' ? ['react-oidc-context'] : []) as any),\n      '@tanstack/react-query',\n      '@tanstack/react-query-devtools',\n    ]),\n    withVersions(['@smithy/types']),\n  );\n};\n"],"names":["addDependenciesToPackageJson","generateFiles","joinPathFragments","OverwriteStrategy","updateProjectConfiguration","addTargetToLocalDev","runtimeConfigGenerator","addSingleImport","applyGritQL","updateGitIgnore","kebabCase","toClassName","sortObjectKeys","withVersions","addOpenApiReactClient","tree","apiName","frontendProjectConfig","backendProjectConfig","specBuildProject","specPath","specBuildTargetName","auth","port","isAgentRuntime","skipLocalDev","clientGenTarget","clientGenWatchTarget","generatedClientDir","generatedClientDirFromRoot","sourceRoot","name","targets","Object","fromEntries","map","target","dependsOn","filter","t","cache","executor","inputs","dependentTasksOutputFiles","outputs","options","commands","continuous","relativeSrcDir","slice","root","length","patterns","project","dirname","overwriteStrategy","KeepExisting","apiNameClassName","mainTsxPath","providerName","url","additionalDependencyTargets"],"mappings":"AAAA;;;CAGC,GACD,SACEA,4BAA4B,EAC5BC,aAAa,EACbC,iBAAiB,EACjBC,iBAAiB,EAGjBC,0BAA0B,QACrB,aAAa;AACpB,SAASC,mBAAmB,QAAQ,mCAAgC;AACpE,OAAOC,4BAA4B,wDAAqD;AACxF,SAASC,eAAe,EAAEC,WAAW,QAAQ,eAAY;AACzD,SAASC,eAAe,QAAQ,eAAY;AAC5C,SAASC,SAAS,EAAEC,WAAW,QAAQ,iBAAc;AACrD,SAASC,cAAc,QAAQ,kBAAe;AAC9C,SAASC,YAAY,QAAQ,oBAAiB;AAiD9C;;CAEC,GACD,OAAO,MAAMC,wBAAwB,OACnCC,MACA,EACEC,OAAO,EACPC,qBAAqB,EACrBC,oBAAoB,EACpBC,gBAAgB,EAChBC,QAAQ,EACRC,mBAAmB,EACnBC,IAAI,EACJC,IAAI,EACJC,iBAAiB,KAAK,EACtBC,eAAe,KAAK,EACS;IAE/B,MAAMC,kBAAkB,CAAC,SAAS,EAAEhB,UAAUM,SAAS,OAAO,CAAC;IAC/D,MAAMW,uBAAuB,CAAC,MAAM,EAAED,iBAAiB;IAEvD,MAAME,qBAAqB1B,kBAAkB,aAAaQ,UAAUM;IACpE,MAAMa,6BAA6B3B,kBACjCe,sBAAsBa,UAAU,EAChCF;IAGF,4DAA4D;IAC5DxB,2BAA2BW,MAAME,sBAAsBc,IAAI,EAAE;QAC3D,GAAGd,qBAAqB;QACxBe,SAASpB,eAAe;YACtB,GAAGK,sBAAsBe,OAAO;YAChC,oGAAoG;YACpG,GAAGC,OAAOC,WAAW,CACnB;gBAAC;gBAAW;aAAS,CAACC,GAAG,CAAC,CAACC,SAAW;oBACpCA;oBACA;wBACE,GAAGnB,sBAAsBe,OAAO,EAAE,CAACI,OAAO;wBAC1CC,WAAW;+BACN,AACDpB,CAAAA,sBAAsBe,OAAO,EAAE,CAACI,OAAO,EAAEC,aAAa,EAAE,AAAD,EACvDC,MAAM,CAAC,CAACC,IAAMA,MAAMb;4BACtBA;yBACD;oBACH;iBACD,EACF;YACD,CAACA,gBAAgB,EAAE;gBACjBc,OAAO;gBACPC,UAAU;gBACVC,QAAQ;oBACN;wBACEC,2BAA2B;oBAC7B;iBACD;gBACDC,SAAS;oBACP1C,kBAAkB,mBAAmB2B;iBACtC;gBACDgB,SAAS;oBACPC,UAAU;wBACR,CAAC,yDAAyD,EAAE1B,SAAS,gBAAgB,EAAES,2BAA2B,kBAAkB,CAAC;qBACtI;gBACH;gBACAQ,WAAW;oBAAChB;iBAAoB;YAClC;YACA,2CAA2C;YAC3C,CAACM,qBAAqB,EAAE;gBACtBc,UAAU;gBACVI,SAAS;oBACPC,UAAU;wBACR,CAAC,oBAAoB,EAAE3B,iBAAiBY,IAAI,CAAC,iCAAiC,EAAEd,sBAAsBc,IAAI,CAAC,EAAE,EAAEL,gBAAgB,CAAC,CAAC;qBAClI;gBACH;gBACAqB,YAAY;YACd;QACF;IACF;IAEA,MAAMC,iBAAiB/B,sBAAsBa,UAAU,CAACmB,KAAK,CAC3DhC,sBAAsBiC,IAAI,CAACC,MAAM,GAAG;IAGtC,yCAAyC;IACzC,sFAAsF;IACtF1C,gBAAgBM,MAAME,sBAAsBiC,IAAI,EAAE,CAACE,WAAa;eAC3DA;YACHlD,kBAAkB8C,gBAAgBpB;SACnC;IAED,2FAA2F;IAC3F,MAAMtB,uBAAuBS,MAAM;QACjCsC,SAASpC,sBAAsBc,IAAI;IACrC;IAEA,kBAAkB;IAClB,IAAIT,SAAS,OAAO;QAClBrB,cACEc,MACAb,kBAAkB,YAAYoD,OAAO,EAAE,oCACvCpD,kBAAkBe,sBAAsBa,UAAU,EAAE,UACpD,CAAC,GACD;YACEyB,mBAAmBpD,kBAAkBqD,YAAY;QACnD;IAEJ;IAEA,oEAAoE;IACpEvD,cACEc,MACAb,kBACE,YAAYoD,OAAO,EACnB,kDAEFpD,kBAAkBe,sBAAsBa,UAAU,EAAE,eACpD,CAAC,GACD;QACEyB,mBAAmBpD,kBAAkBqD,YAAY;IACnD;IAGF,MAAMC,mBAAmB9C,YAAYK;IAErC,uCAAuC;IACvCf,cACEc,MACAb,kBAAkB,YAAYoD,OAAO,EAAE,UACvCrC,sBAAsBa,UAAU,EAChC;QACER;QACAN;QACAyC;QACA7B;QACAJ;IACF;IAGF,4CAA4C;IAC5C,MAAMkC,cAAcxD,kBAClBe,sBAAsBa,UAAU,EAChC;IAGF,4DAA4D;IAC5D,MAAMvB,gBACJQ,MACA2C,aACA,uBACA;IAEF,MAAMlD,YACJO,MACA2C,aACA;IAGF,4CAA4C;IAC5C,MAAMC,eAAe,GAAGF,iBAAiB,QAAQ,CAAC;IAClD,MAAMlD,gBACJQ,MACA2C,aACAC,cACA,CAAC,aAAa,EAAEA,cAAc;IAEhC,MAAMnD,YACJO,MACA2C,aACA,CAAC,kBAAkB,EAAEC,aAAa,UAAU,EAAEA,aAAa,wCAAwC,EAAEA,aAAa,KAAK,EAAEA,aAAa,KAAK,CAAC;IAG9I,gEAAgE;IAChE,2FAA2F;IAC3F,IAAI,CAAClC,cAAc;QACjB,MAAMpB,oBACJU,MACAE,sBAAsBc,IAAI,EAC1Bb,qBAAqBa,IAAI,EACzB;YACE6B,KAAK,CAAC,iBAAiB,EAAErC,KAAK,CAAC,CAAC;YAChCP;YACA,mFAAmF;YACnF,wDAAwD;YACxD,qFAAqF;YACrF,uFAAuF;YACvF6C,6BAA6B;gBAACnC;gBAAiBC;aAAqB;QACtE;IAEJ;IAEA3B,6BACEe,MACAF,aAAa;WACNS,SAAS,QACV;YACE;YACA;YACA;YACA;SACD,GACD,EAAE;WACDA,SAAS,YAAY;YAAC;SAAqB,GAAG,EAAE;QACrD;QACA;KACD,GACDT,aAAa;QAAC;KAAgB;AAElC,EAAE"}

package/src/utils/containers.d.ts

@@ -2,7 +2,7 @@
  * Copyright Amazon.com, Inc. or its affiliates. All Rights Reserved.
  * SPDX-License-Identifier: Apache-2.0
  */
-import { Tree } from '@nx/devkit';
+import type { Tree } from '@nx/devkit';
 export declare const CONTAINER_ENGINES: readonly ["docker", "finch"];
 export type Containers = (typeof CONTAINER_ENGINES)[number];
 export type ContainersOption = Containers | 'inherit';

package/src/utils/containers.js

@@ -1,16 +1,20 @@
-"use strict";
-Object.defineProperty(exports, "__esModule", { value: true });
-exports.resolveContainers = exports.inferContainers = exports.CONTAINER_ENGINES = void 0;
-const child_process_1 = require("child_process");
-const utils_1 = require("./config/utils");
-exports.CONTAINER_ENGINES = ['docker', 'finch'];
-const isOnPath = (binary) => {
+/**
+ * Copyright Amazon.com, Inc. or its affiliates. All Rights Reserved.
+ * SPDX-License-Identifier: Apache-2.0
+ */ import { execSync } from "child_process";
+import { AWS_NX_PLUGIN_CONFIG_FILE_NAME, readAwsNxPluginConfig } from "./config/utils.js";
+export const CONTAINER_ENGINES = [
+    'docker',
+    'finch'
+];
+const isOnPath = (binary)=>{
     try {
         const which = process.platform === 'win32' ? 'where' : 'command -v';
-        (0, child_process_1.execSync)(`${which} ${binary}`, { stdio: 'ignore' });
+        execSync(`${which} ${binary}`, {
+            stdio: 'ignore'
+        });
         return true;
-    }
-    catch {
+    } catch  {
         return false;
     }
 };
@@ -18,30 +22,25 @@ const isOnPath = (binary) => {
  * Detect which container engine is available on the host. Prefers docker;
  * falls back to finch when only finch is installed; defaults to docker
  * when neither is found.
- */
-const inferContainers = () => {
-    if (isOnPath('docker'))
-        return 'docker';
-    if (isOnPath('finch'))
-        return 'finch';
+ */ export const inferContainers = ()=>{
+    if (isOnPath('docker')) return 'docker';
+    if (isOnPath('finch')) return 'finch';
     return 'docker';
 };
-exports.inferContainers = inferContainers;
 /**
  * Given a container engine option, resolve the actual engine to use.
  * `Inherit` reads the value from the workspace plugin config, defaulting
  * to docker when nothing has been configured.
- */
-const resolveContainers = async (tree, option) => {
+ */ export const resolveContainers = async (tree, option)=>{
     if (option === 'inherit') {
-        const pluginConfig = await (0, utils_1.readAwsNxPluginConfig)(tree);
+        const pluginConfig = await readAwsNxPluginConfig(tree);
         const engine = pluginConfig?.containers?.engine ?? 'docker';
-        if (!exports.CONTAINER_ENGINES.includes(engine)) {
-            throw new Error(`containers.engine in ${utils_1.AWS_NX_PLUGIN_CONFIG_FILE_NAME} must be one of ${exports.CONTAINER_ENGINES.join(', ')}`);
+        if (!CONTAINER_ENGINES.includes(engine)) {
+            throw new Error(`containers.engine in ${AWS_NX_PLUGIN_CONFIG_FILE_NAME} must be one of ${CONTAINER_ENGINES.join(', ')}`);
         }
         return engine;
     }
     return option;
 };
-exports.resolveContainers = resolveContainers;
+
 //# sourceMappingURL=containers.js.map

package/src/utils/containers.js.map

@@ -1 +1 @@
-{"version":3,"file":"containers.js","sourceRoot":"","sources":["../../../../../packages/nx-plugin/src/utils/containers.ts"],"names":[],"mappings":";;;AAKA,iDAAyC;AACzC,0CAGwB;AAEX,QAAA,iBAAiB,GAAG,CAAC,QAAQ,EAAE,OAAO,CAAU,CAAC;AAgB9D,MAAM,QAAQ,GAAG,CAAC,MAAc,EAAW,EAAE;IAC3C,IAAI,CAAC;QACH,MAAM,KAAK,GAAG,OAAO,CAAC,QAAQ,KAAK,OAAO,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,YAAY,CAAC;QACpE,IAAA,wBAAQ,EAAC,GAAG,KAAK,IAAI,MAAM,EAAE,EAAE,EAAE,KAAK,EAAE,QAAQ,EAAE,CAAC,CAAC;QACpD,OAAO,IAAI,CAAC;IACd,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,KAAK,CAAC;IACf,CAAC;AACH,CAAC,CAAC;AAEF;;;;GAIG;AACI,MAAM,eAAe,GAAG,GAAe,EAAE;IAC9C,IAAI,QAAQ,CAAC,QAAQ,CAAC;QAAE,OAAO,QAAQ,CAAC;IACxC,IAAI,QAAQ,CAAC,OAAO,CAAC;QAAE,OAAO,OAAO,CAAC;IACtC,OAAO,QAAQ,CAAC;AAClB,CAAC,CAAC;AAJW,QAAA,eAAe,mBAI1B;AAEF;;;;GAIG;AACI,MAAM,iBAAiB,GAAG,KAAK,EACpC,IAAU,EACV,MAAwB,EACH,EAAE;IACvB,IAAI,MAAM,KAAK,SAAS,EAAE,CAAC;QACzB,MAAM,YAAY,GAAG,MAAM,IAAA,6BAAqB,EAAC,IAAI,CAAC,CAAC;QACvD,MAAM,MAAM,GAAG,YAAY,EAAE,UAAU,EAAE,MAAM,IAAI,QAAQ,CAAC;QAC5D,IAAI,CAAC,yBAAiB,CAAC,QAAQ,CAAC,MAAM,CAAC,EAAE,CAAC;YACxC,MAAM,IAAI,KAAK,CACb,wBAAwB,sCAA8B,mBAAmB,yBAAiB,CAAC,IAAI,CAC7F,IAAI,CACL,EAAE,CACJ,CAAC;QACJ,CAAC;QACD,OAAO,MAAM,CAAC;IAChB,CAAC;IACD,OAAO,MAAM,CAAC;AAChB,CAAC,CAAC;AAjBW,QAAA,iBAAiB,qBAiB5B"}
+{"version":3,"sources":["../../../../../packages/nx-plugin/src/utils/containers.ts"],"sourcesContent":["/**\n * Copyright Amazon.com, Inc. or its affiliates. All Rights Reserved.\n * SPDX-License-Identifier: Apache-2.0\n */\nimport type { Tree } from '@nx/devkit';\nimport { execSync } from 'child_process';\nimport {\n  AWS_NX_PLUGIN_CONFIG_FILE_NAME,\n  readAwsNxPluginConfig,\n} from './config/utils';\n\nexport const CONTAINER_ENGINES = ['docker', 'finch'] as const;\n\nexport type Containers = (typeof CONTAINER_ENGINES)[number];\n\nexport type ContainersOption = Containers | 'inherit';\n\n/**\n * Configuration for container tooling\n */\nexport interface ContainersConfig {\n  /**\n   * Container engine used for build/push/login operations\n   */\n  engine: Containers;\n}\n\nconst isOnPath = (binary: string): boolean => {\n  try {\n    const which = process.platform === 'win32' ? 'where' : 'command -v';\n    execSync(`${which} ${binary}`, { stdio: 'ignore' });\n    return true;\n  } catch {\n    return false;\n  }\n};\n\n/**\n * Detect which container engine is available on the host. Prefers docker;\n * falls back to finch when only finch is installed; defaults to docker\n * when neither is found.\n */\nexport const inferContainers = (): Containers => {\n  if (isOnPath('docker')) return 'docker';\n  if (isOnPath('finch')) return 'finch';\n  return 'docker';\n};\n\n/**\n * Given a container engine option, resolve the actual engine to use.\n * `Inherit` reads the value from the workspace plugin config, defaulting\n * to docker when nothing has been configured.\n */\nexport const resolveContainers = async (\n  tree: Tree,\n  option: ContainersOption,\n): Promise<Containers> => {\n  if (option === 'inherit') {\n    const pluginConfig = await readAwsNxPluginConfig(tree);\n    const engine = pluginConfig?.containers?.engine ?? 'docker';\n    if (!CONTAINER_ENGINES.includes(engine)) {\n      throw new Error(\n        `containers.engine in ${AWS_NX_PLUGIN_CONFIG_FILE_NAME} must be one of ${CONTAINER_ENGINES.join(\n          ', ',\n        )}`,\n      );\n    }\n    return engine;\n  }\n  return option;\n};\n"],"names":["execSync","AWS_NX_PLUGIN_CONFIG_FILE_NAME","readAwsNxPluginConfig","CONTAINER_ENGINES","isOnPath","binary","which","process","platform","stdio","inferContainers","resolveContainers","tree","option","pluginConfig","engine","containers","includes","Error","join"],"mappings":"AAAA;;;CAGC,GAED,SAASA,QAAQ,QAAQ,gBAAgB;AACzC,SACEC,8BAA8B,EAC9BC,qBAAqB,QAChB,oBAAiB;AAExB,OAAO,MAAMC,oBAAoB;IAAC;IAAU;CAAQ,CAAU;AAgB9D,MAAMC,WAAW,CAACC;IAChB,IAAI;QACF,MAAMC,QAAQC,QAAQC,QAAQ,KAAK,UAAU,UAAU;QACvDR,SAAS,GAAGM,MAAM,CAAC,EAAED,QAAQ,EAAE;YAAEI,OAAO;QAAS;QACjD,OAAO;IACT,EAAE,OAAM;QACN,OAAO;IACT;AACF;AAEA;;;;CAIC,GACD,OAAO,MAAMC,kBAAkB;IAC7B,IAAIN,SAAS,WAAW,OAAO;IAC/B,IAAIA,SAAS,UAAU,OAAO;IAC9B,OAAO;AACT,EAAE;AAEF;;;;CAIC,GACD,OAAO,MAAMO,oBAAoB,OAC/BC,MACAC;IAEA,IAAIA,WAAW,WAAW;QACxB,MAAMC,eAAe,MAAMZ,sBAAsBU;QACjD,MAAMG,SAASD,cAAcE,YAAYD,UAAU;QACnD,IAAI,CAACZ,kBAAkBc,QAAQ,CAACF,SAAS;YACvC,MAAM,IAAIG,MACR,CAAC,qBAAqB,EAAEjB,+BAA+B,gBAAgB,EAAEE,kBAAkBgB,IAAI,CAC7F,OACC;QAEP;QACA,OAAOJ;IACT;IACA,OAAOF;AACT,EAAE"}

package/src/utils/docker.d.ts

@@ -0,0 +1,44 @@
+/**
+ * Copyright Amazon.com, Inc. or its affiliates. All Rights Reserved.
+ * SPDX-License-Identifier: Apache-2.0
+ */
+import { type ProjectConfiguration, type Tree } from '@nx/devkit';
+export interface DockerScanTargetOptions {
+    /**
+     * Project configuration to add the scan target to (mutated in place).
+     */
+    readonly project: ProjectConfiguration;
+    /**
+     * Container engine command to invoke (\`docker\` or \`finch\`).
+     */
+    readonly containerEngine: string;
+    /**
+     * Name of the scan target to add, e.g. \`my-agent-trivy\`.
+     */
+    readonly trivyTargetName: string;
+    /**
+     * Name of the docker target that builds the image(s) to scan. The scan
+     * target depends on it.
+     */
+    readonly dockerTargetName: string;
+    /**
+     * Tags of the images built by the docker target which should be scanned.
+     */
+    readonly imageTags: string[];
+}
+/**
+ * Add a cacheable Trivy scan target for the images built by a docker target,
+ * wire it under the aggregate \`trivy\` target, and make \`build\` depend on it.
+ *
+ * The scan target depends on the docker target and declares the project source
+ * as its inputs, so an unchanged image is never re-scanned (a cache hit skips
+ * the scan entirely). Each image is saved to a tarball under
+ * \`dist/<projectRoot>/trivy/<scan-key>\` (kept out of any Docker build context)
+ * and scanned with the pinned ECR-hosted Trivy image via a workspace-relative
+ * bind mount, so the same commands work under both docker and finch. The scan
+ * fails the build (exit code 1) on HIGH/CRITICAL vulnerabilities.
+ *
+ * A \`.trivyignore\` is vended at the project root (kept if it already exists)
+ * for suppressing findings.
+ */
+export declare const addDockerScanTarget: (tree: Tree, options: DockerScanTargetOptions) => void;

package/src/utils/docker.js

@@ -0,0 +1,81 @@
+/**
+ * Copyright Amazon.com, Inc. or its affiliates. All Rights Reserved.
+ * SPDX-License-Identifier: Apache-2.0
+ */ import { joinPathFragments } from "@nx/devkit";
+import { FsCommands } from "./fs.js";
+import { addDependencyToTargetIfNotPresent } from "./nx.js";
+import { CONTAINER_VERSIONS } from "./versions.js";
+const TRIVY_IGNORE_FILE = '.trivyignore';
+const TRIVY_IGNORE_CONTENTS = `# Trivy ignore file. Add one vulnerability ID (e.g. CVE-2021-12345) per line to
+# suppress it during the image scan run on build.
+# https://trivy.dev/latest/docs/configuration/filtering/#by-finding-ids
+`;
+/**
+ * Add a cacheable Trivy scan target for the images built by a docker target,
+ * wire it under the aggregate \`trivy\` target, and make \`build\` depend on it.
+ *
+ * The scan target depends on the docker target and declares the project source
+ * as its inputs, so an unchanged image is never re-scanned (a cache hit skips
+ * the scan entirely). Each image is saved to a tarball under
+ * \`dist/<projectRoot>/trivy/<scan-key>\` (kept out of any Docker build context)
+ * and scanned with the pinned ECR-hosted Trivy image via a workspace-relative
+ * bind mount, so the same commands work under both docker and finch. The scan
+ * fails the build (exit code 1) on HIGH/CRITICAL vulnerabilities.
+ *
+ * A \`.trivyignore\` is vended at the project root (kept if it already exists)
+ * for suppressing findings.
+ */ export const addDockerScanTarget = (tree, options)=>{
+    const { project, containerEngine, trivyTargetName, dockerTargetName } = options;
+    const { imageTags } = options;
+    const projectRoot = project.root;
+    const ignoreFilePath = joinPathFragments(projectRoot, TRIVY_IGNORE_FILE);
+    if (!tree.exists(ignoreFilePath)) {
+        tree.write(ignoreFilePath, TRIVY_IGNORE_CONTENTS);
+    }
+    // Stage scan artifacts in a directory unique to this scan target so that
+    // sibling targets in the same project (e.g. multiple agents) don't clobber
+    // each other's tarballs when run in parallel. The first image tag is unique
+    // per target, so it makes a stable, collision-free key.
+    const scanKey = imageTags[0].replace(/[^a-zA-Z0-9-]/g, '-');
+    const scanDir = joinPathFragments('dist', projectRoot, 'trivy', scanKey);
+    const trivyImage = `public.ecr.aws/aquasecurity/trivy:${CONTAINER_VERSIONS.trivy}`;
+    const fs = new FsCommands(tree);
+    const commands = [
+        fs.rm(scanDir),
+        fs.mkdir(scanDir),
+        fs.cp(ignoreFilePath, joinPathFragments(scanDir, TRIVY_IGNORE_FILE))
+    ];
+    imageTags.forEach((imageTag, index)=>{
+        const tarName = `image-${index}.tar`;
+        commands.push(`${containerEngine} save -o ${joinPathFragments(scanDir, tarName)} ${imageTag}`, `${containerEngine} run --rm -v "./${scanDir}":/scan ${trivyImage} image --input /scan/${tarName} --ignorefile /scan/${TRIVY_IGNORE_FILE} --scanners vuln --severity HIGH,CRITICAL --ignore-unfixed --exit-code 1 --no-progress -q`);
+    });
+    project.targets ??= {};
+    project.targets[trivyTargetName] = {
+        cache: true,
+        // The scanned image is fully determined by the project source, so caching
+        // on the source ensures an unchanged image is never re-scanned.
+        inputs: [
+            'default',
+            '^production'
+        ],
+        outputs: [
+            `{workspaceRoot}/${scanDir}`
+        ],
+        executor: 'nx:run-commands',
+        options: {
+            commands,
+            parallel: false
+        },
+        dependsOn: [
+            dockerTargetName
+        ]
+    };
+    // Aggregate per-component scan targets under a single `trivy` target, and
+    // make `build` run the scan.
+    if (trivyTargetName !== 'trivy') {
+        addDependencyToTargetIfNotPresent(project, 'trivy', trivyTargetName);
+    }
+    addDependencyToTargetIfNotPresent(project, 'build', 'trivy');
+};
+
+//# sourceMappingURL=docker.js.map

package/src/utils/docker.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../../../../../packages/nx-plugin/src/utils/docker.ts"],"sourcesContent":["/**\n * Copyright Amazon.com, Inc. or its affiliates. All Rights Reserved.\n * SPDX-License-Identifier: Apache-2.0\n */\nimport {\n  joinPathFragments,\n  type ProjectConfiguration,\n  type Tree,\n} from '@nx/devkit';\nimport { FsCommands } from './fs';\nimport { addDependencyToTargetIfNotPresent } from './nx';\nimport { CONTAINER_VERSIONS } from './versions';\n\nconst TRIVY_IGNORE_FILE = '.trivyignore';\n\nconst TRIVY_IGNORE_CONTENTS = `# Trivy ignore file. Add one vulnerability ID (e.g. CVE-2021-12345) per line to\n# suppress it during the image scan run on build.\n# https://trivy.dev/latest/docs/configuration/filtering/#by-finding-ids\n`;\n\nexport interface DockerScanTargetOptions {\n  /**\n   * Project configuration to add the scan target to (mutated in place).\n   */\n  readonly project: ProjectConfiguration;\n  /**\n   * Container engine command to invoke (\\`docker\\` or \\`finch\\`).\n   */\n  readonly containerEngine: string;\n  /**\n   * Name of the scan target to add, e.g. \\`my-agent-trivy\\`.\n   */\n  readonly trivyTargetName: string;\n  /**\n   * Name of the docker target that builds the image(s) to scan. The scan\n   * target depends on it.\n   */\n  readonly dockerTargetName: string;\n  /**\n   * Tags of the images built by the docker target which should be scanned.\n   */\n  readonly imageTags: string[];\n}\n\n/**\n * Add a cacheable Trivy scan target for the images built by a docker target,\n * wire it under the aggregate \\`trivy\\` target, and make \\`build\\` depend on it.\n *\n * The scan target depends on the docker target and declares the project source\n * as its inputs, so an unchanged image is never re-scanned (a cache hit skips\n * the scan entirely). Each image is saved to a tarball under\n * \\`dist/<projectRoot>/trivy/<scan-key>\\` (kept out of any Docker build context)\n * and scanned with the pinned ECR-hosted Trivy image via a workspace-relative\n * bind mount, so the same commands work under both docker and finch. The scan\n * fails the build (exit code 1) on HIGH/CRITICAL vulnerabilities.\n *\n * A \\`.trivyignore\\` is vended at the project root (kept if it already exists)\n * for suppressing findings.\n */\nexport const addDockerScanTarget = (\n  tree: Tree,\n  options: DockerScanTargetOptions,\n): void => {\n  const { project, containerEngine, trivyTargetName, dockerTargetName } =\n    options;\n  const { imageTags } = options;\n  const projectRoot = project.root;\n\n  const ignoreFilePath = joinPathFragments(projectRoot, TRIVY_IGNORE_FILE);\n  if (!tree.exists(ignoreFilePath)) {\n    tree.write(ignoreFilePath, TRIVY_IGNORE_CONTENTS);\n  }\n\n  // Stage scan artifacts in a directory unique to this scan target so that\n  // sibling targets in the same project (e.g. multiple agents) don't clobber\n  // each other's tarballs when run in parallel. The first image tag is unique\n  // per target, so it makes a stable, collision-free key.\n  const scanKey = imageTags[0].replace(/[^a-zA-Z0-9-]/g, '-');\n  const scanDir = joinPathFragments('dist', projectRoot, 'trivy', scanKey);\n  const trivyImage = `public.ecr.aws/aquasecurity/trivy:${CONTAINER_VERSIONS.trivy}`;\n\n  const fs = new FsCommands(tree);\n  const commands = [\n    fs.rm(scanDir),\n    fs.mkdir(scanDir),\n    fs.cp(ignoreFilePath, joinPathFragments(scanDir, TRIVY_IGNORE_FILE)),\n  ];\n\n  imageTags.forEach((imageTag, index) => {\n    const tarName = `image-${index}.tar`;\n    commands.push(\n      `${containerEngine} save -o ${joinPathFragments(scanDir, tarName)} ${imageTag}`,\n      `${containerEngine} run --rm -v \"./${scanDir}\":/scan ${trivyImage} image --input /scan/${tarName} --ignorefile /scan/${TRIVY_IGNORE_FILE} --scanners vuln --severity HIGH,CRITICAL --ignore-unfixed --exit-code 1 --no-progress -q`,\n    );\n  });\n\n  project.targets ??= {};\n  project.targets[trivyTargetName] = {\n    cache: true,\n    // The scanned image is fully determined by the project source, so caching\n    // on the source ensures an unchanged image is never re-scanned.\n    inputs: ['default', '^production'],\n    outputs: [`{workspaceRoot}/${scanDir}`],\n    executor: 'nx:run-commands',\n    options: {\n      commands,\n      parallel: false,\n    },\n    dependsOn: [dockerTargetName],\n  };\n\n  // Aggregate per-component scan targets under a single `trivy` target, and\n  // make `build` run the scan.\n  if (trivyTargetName !== 'trivy') {\n    addDependencyToTargetIfNotPresent(project, 'trivy', trivyTargetName);\n  }\n  addDependencyToTargetIfNotPresent(project, 'build', 'trivy');\n};\n"],"names":["joinPathFragments","FsCommands","addDependencyToTargetIfNotPresent","CONTAINER_VERSIONS","TRIVY_IGNORE_FILE","TRIVY_IGNORE_CONTENTS","addDockerScanTarget","tree","options","project","containerEngine","trivyTargetName","dockerTargetName","imageTags","projectRoot","root","ignoreFilePath","exists","write","scanKey","replace","scanDir","trivyImage","trivy","fs","commands","rm","mkdir","cp","forEach","imageTag","index","tarName","push","targets","cache","inputs","outputs","executor","parallel","dependsOn"],"mappings":"AAAA;;;CAGC,GACD,SACEA,iBAAiB,QAGZ,aAAa;AACpB,SAASC,UAAU,QAAQ,UAAO;AAClC,SAASC,iCAAiC,QAAQ,UAAO;AACzD,SAASC,kBAAkB,QAAQ,gBAAa;AAEhD,MAAMC,oBAAoB;AAE1B,MAAMC,wBAAwB,CAAC;;;AAG/B,CAAC;AA0BD;;;;;;;;;;;;;;CAcC,GACD,OAAO,MAAMC,sBAAsB,CACjCC,MACAC;IAEA,MAAM,EAAEC,OAAO,EAAEC,eAAe,EAAEC,eAAe,EAAEC,gBAAgB,EAAE,GACnEJ;IACF,MAAM,EAAEK,SAAS,EAAE,GAAGL;IACtB,MAAMM,cAAcL,QAAQM,IAAI;IAEhC,MAAMC,iBAAiBhB,kBAAkBc,aAAaV;IACtD,IAAI,CAACG,KAAKU,MAAM,CAACD,iBAAiB;QAChCT,KAAKW,KAAK,CAACF,gBAAgBX;IAC7B;IAEA,yEAAyE;IACzE,2EAA2E;IAC3E,4EAA4E;IAC5E,wDAAwD;IACxD,MAAMc,UAAUN,SAAS,CAAC,EAAE,CAACO,OAAO,CAAC,kBAAkB;IACvD,MAAMC,UAAUrB,kBAAkB,QAAQc,aAAa,SAASK;IAChE,MAAMG,aAAa,CAAC,kCAAkC,EAAEnB,mBAAmBoB,KAAK,EAAE;IAElF,MAAMC,KAAK,IAAIvB,WAAWM;IAC1B,MAAMkB,WAAW;QACfD,GAAGE,EAAE,CAACL;QACNG,GAAGG,KAAK,CAACN;QACTG,GAAGI,EAAE,CAACZ,gBAAgBhB,kBAAkBqB,SAASjB;KAClD;IAEDS,UAAUgB,OAAO,CAAC,CAACC,UAAUC;QAC3B,MAAMC,UAAU,CAAC,MAAM,EAAED,MAAM,IAAI,CAAC;QACpCN,SAASQ,IAAI,CACX,GAAGvB,gBAAgB,SAAS,EAAEV,kBAAkBqB,SAASW,SAAS,CAAC,EAAEF,UAAU,EAC/E,GAAGpB,gBAAgB,gBAAgB,EAAEW,QAAQ,QAAQ,EAAEC,WAAW,qBAAqB,EAAEU,QAAQ,oBAAoB,EAAE5B,kBAAkB,yFAAyF,CAAC;IAEvO;IAEAK,QAAQyB,OAAO,KAAK,CAAC;IACrBzB,QAAQyB,OAAO,CAACvB,gBAAgB,GAAG;QACjCwB,OAAO;QACP,0EAA0E;QAC1E,gEAAgE;QAChEC,QAAQ;YAAC;YAAW;SAAc;QAClCC,SAAS;YAAC,CAAC,gBAAgB,EAAEhB,SAAS;SAAC;QACvCiB,UAAU;QACV9B,SAAS;YACPiB;YACAc,UAAU;QACZ;QACAC,WAAW;YAAC5B;SAAiB;IAC/B;IAEA,0EAA0E;IAC1E,6BAA6B;IAC7B,IAAID,oBAAoB,SAAS;QAC/BT,kCAAkCO,SAAS,SAASE;IACtD;IACAT,kCAAkCO,SAAS,SAAS;AACtD,EAAE"}