@aws/nx-plugin 1.0.0-rc.41 → 1.0.0-rc.43

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@aws/nx-plugin",
-  "version": "1.0.0-rc.41",
+  "version": "1.0.0-rc.43",
   "repository": {
     "type": "git",
     "url": "https://github.com/awslabs/nx-plugin-for-aws.git",

package/src/py/fast-api/__snapshots__/generator.spec.ts.snap

@@ -147,7 +147,7 @@ async def add_correlation_id(request: Request, call_next):
             try:
                 lambda_context = json.loads(lambda_context_header)
                 corr_id = lambda_context.get("request_id")
-            except (json.JSONDecodeError, KeyError):
+            except json.JSONDecodeError, KeyError:
                 pass
     if not corr_id:
         # If still empty, use uuid

package/src/py/project/generator.js

@@ -191,9 +191,36 @@ const PYTHON_TRANSIENT_ARTIFACTS = [
         }
         return pyProjectToml;
     });
+    // Pin ruff to the version generation-time formatting uses (PY_VERSIONS), so
+    // generated files stay `ruff format --check`-clean across ruff releases.
     addDependenciesToDependencyGroupInPyProjectToml(tree, '.', 'dev', [
+        'ruff',
         'ty'
     ]);
+    // Base format target checks rather than writes (so build/lint don't rewrite
+    // source); `fix` writes, and `skip-lint` writes without failing so it stays
+    // a no-op when propagated through the lint -> format dependency.
+    projectConfiguration.targets.format = {
+        ...projectConfiguration.targets.format,
+        cache: true,
+        inputs: [
+            'default',
+            '^production'
+        ],
+        options: {
+            ...projectConfiguration.targets.format?.options,
+            check: true
+        },
+        configurations: {
+            ...projectConfiguration.targets.format?.configurations,
+            fix: {
+                check: false
+            },
+            'skip-lint': {
+                check: false
+            }
+        }
+    };
     // Add a dependency on the format target for lint in order to reduce the number of
     // fixable lint errors (eg line too long)
     projectConfiguration.targets.lint = {

package/src/py/project/generator.js.map

@@ -1 +1 @@
-{"version":3,"sources":["../../../../../../packages/nx-plugin/src/py/project/generator.ts"],"sourcesContent":["/**\n * Copyright Amazon.com, Inc. or its affiliates. All Rights Reserved.\n * SPDX-License-Identifier: Apache-2.0\n */\nimport {\n  addDependenciesToPackageJson,\n  ensurePackage,\n  type GeneratorCallback,\n  joinPathFragments,\n  readNxJson,\n  readProjectConfiguration,\n  type Tree,\n  updateNxJson,\n  updateProjectConfiguration,\n} from '@nx/devkit';\nimport {\n  addLicenseCheckToLintTarget,\n  ensurePythonLicenseCollector,\n} from '../../license/config';\nimport { updateGitIgnore } from '../../utils/git';\nimport { installDependencies } from '../../utils/install';\nimport { addGeneratorMetricsIfApplicable } from '../../utils/metrics';\nimport { normalizeDistributionName, toSnakeCase } from '../../utils/names';\nimport { getNpmScope } from '../../utils/npm-scope';\nimport {\n  addDependencyToTargetIfNotPresent,\n  addGeneratorMetadata,\n  getGeneratorInfo,\n  type NxGeneratorInfo,\n  projectExists,\n} from '../../utils/nx';\nimport type { UVPyprojectToml } from '../../utils/nxlv-python';\nimport {\n  migrateToSharedVenvGenerator,\n  uvProjectGenerator,\n} from '../../utils/nxlv-python';\nimport { sortObjectKeys } from '../../utils/object';\nimport { addDependenciesToDependencyGroupInPyProjectToml } from '../../utils/py';\nimport { updateToml } from '../../utils/toml';\nimport { withVersions } from '../../utils/versions';\nimport type { PyProjectGeneratorSchema } from './schema';\n\nexport const PY_PROJECT_GENERATOR_INFO: NxGeneratorInfo = getGeneratorInfo(\n  import.meta.filename,\n);\n\n// Transient artifacts that pytest, coverage and ruff create and remove while\n// the test, typecheck and compile targets run concurrently. `.coverage.*` are\n// the per-process data files pytest-cov writes (`.coverage.<host>.<pid>.<rand>`)\n// before combining them. Both `ty` (which respects .gitignore) and the\n// `@nxlv/python:build` copy (which respects `ignorePaths`) would otherwise fail\n// when they read one of these mid-deletion.\nconst PYTHON_TRANSIENT_ARTIFACTS = [\n  '__pycache__',\n  '.coverage',\n  '.coverage.*',\n  '.pytest_cache',\n  'pytest-cache-files-*',\n  '.ruff_cache',\n];\n\nexport interface PyProjectDetails {\n  /**\n   * Fully qualified Nx project id including scope, in dot notation (eg foo.bar).\n   * This is the identifier Nx uses (readProjectConfiguration, the project\n   * graph, target references) and is intentionally kept dotted.\n   */\n  readonly fullyQualifiedName: string;\n  /**\n   * PEP 503 normalised Python distribution name (eg foo-bar). This is the name\n   * written to the project's `[project].name`, the root `[tool.uv.sources]`\n   * key, and any inter-project dependency string. It is hyphenated (not dotted)\n   * so `uv` and `@nxlv/python` can match it: uv writes `uv.lock` keyed by the\n   * PEP 503 hyphenated name, and `@nxlv/python`'s dependency inference splits a\n   * dotted name on `.` and so would otherwise drop the edge entirely. Keeping\n   * the distribution name decoupled from `fullyQualifiedName` is what lets the\n   * workspace dependency edge appear in the Nx project graph.\n   */\n  readonly distributionName: string;\n  /**\n   * Directory of the library relative to the root\n   */\n  readonly dir: string;\n  /**\n   * Module name for the project\n   */\n  readonly normalizedModuleName: string;\n}\n\n/**\n * Returns details about the Python project to be created\n */\nexport const getPyProjectDetails = (\n  tree: Tree,\n  schema: {\n    name: string;\n    directory?: string;\n    subDirectory?: string;\n    moduleName?: string;\n  },\n): PyProjectDetails => {\n  const scope = toSnakeCase(getNpmScope(tree));\n  const normalizedName = toSnakeCase(schema.name);\n  const normalizedModuleName = toSnakeCase(\n    schema.moduleName ?? `${scope}_${normalizedName}`,\n  );\n  const fullyQualifiedName = `${scope}.${normalizedName}`;\n  // The Python distribution name is the PEP 503 normalised form of the\n  // fully qualified name: hyphenated, never dotted. See PyProjectDetails.\n  const distributionName = normalizeDistributionName(fullyQualifiedName);\n  // NB: interactive nx generator cli can pass empty string\n  const dir = joinPathFragments(\n    schema.directory || '.',\n    schema.subDirectory || normalizedName,\n  );\n  return { dir, fullyQualifiedName, distributionName, normalizedModuleName };\n};\n\n/**\n * Generates a Python project\n */\nexport const pyProjectGenerator = async (\n  tree: Tree,\n  schema: PyProjectGeneratorSchema,\n): Promise<GeneratorCallback> => {\n  const { dir, normalizedModuleName, fullyQualifiedName, distributionName } =\n    getPyProjectDetails(tree, schema);\n\n  const pythonPlugin = withVersions(['@nxlv/python']);\n  addDependenciesToPackageJson(tree, {}, pythonPlugin);\n\n  Object.entries(pythonPlugin).forEach(([name, version]) =>\n    ensurePackage(name, version),\n  );\n\n  const nxJson = readNxJson(tree);\n\n  // Only rewrite nx.json when the plugin needs adding, so re-running does not\n  // reserialize (and reformat) the file when nothing has changed.\n  if (\n    !nxJson.plugins?.find((p) =>\n      typeof p === 'string'\n        ? p === '@nxlv/python'\n        : p.plugin === '@nxlv/python',\n    )\n  ) {\n    nxJson.plugins = [\n      ...(nxJson.plugins ?? []),\n      {\n        plugin: '@nxlv/python',\n        options: {\n          packageManager: 'uv',\n        },\n      },\n    ];\n    updateNxJson(tree, nxJson);\n  }\n\n  // Only scaffold the project when it does not already exist so re-running with\n  // the same name does not throw. The rest of the generator still runs to apply\n  // any changed options to the existing project.\n  if (!projectExists(tree, fullyQualifiedName)) {\n    if (!tree.exists('uv.lock')) {\n      await migrateToSharedVenvGenerator(tree, {\n        autoActivate: true,\n        packageManager: 'uv',\n        moveDevDependencies: false,\n        pyenvPythonVersion: '3.14.0',\n        pyprojectPythonDependency: '>=3.14',\n      });\n    }\n\n    await uvProjectGenerator(tree, {\n      // The Nx project id (and `uv.workspace.members` etc.) keys off `name`, so\n      // keep it dotted. `packageName` is the separate PEP 503 distribution name\n      // written to `[project].name` and the root `[tool.uv.sources]` key; it is\n      // hyphenated so `@nxlv/python` infers the workspace dependency edge (it\n      // splits a dotted name on `.` and would otherwise drop it). This split is\n      // the whole fix (see PyProjectDetails.distributionName).\n      name: fullyQualifiedName,\n      packageName: distributionName,\n      publishable: false,\n      buildLockedVersions: true,\n      buildBundleLocalDependencies: true,\n      linter: 'ruff',\n      rootPyprojectDependencyGroup: 'main',\n      pyenvPythonVersion: '3.14.0',\n      pyprojectPythonDependency: '>=3.14',\n      projectType: schema.type,\n      projectNameAndRootFormat: 'as-provided',\n      moduleName: normalizedModuleName,\n      directory: dir,\n      unitTestRunner: 'pytest',\n      codeCoverage: true,\n      codeCoverageHtmlReport: true,\n      codeCoverageXmlReport: true,\n      unitTestHtmlReport: true,\n      unitTestJUnitReport: true,\n      buildSystem: 'hatch',\n      srcDir: false,\n    });\n\n    // Remove generated hello.py and test_hello.py as they are not needed\n    [\n      joinPathFragments(dir, normalizedModuleName, 'hello.py'),\n      joinPathFragments(dir, 'tests', 'test_hello.py'),\n    ].forEach((f) => tree.delete(f));\n\n    // Add a placeholder test so pytest doesn't fail with \"no tests collected\"\n    tree.write(\n      joinPathFragments(dir, 'tests', 'test_noop.py'),\n      'def test_noop():\\n    pass\\n',\n    );\n  }\n\n  const outputPath = '{workspaceRoot}/dist/{projectRoot}';\n  const buildOutputPath = joinPathFragments(outputPath, 'build');\n  const projectConfiguration = readProjectConfiguration(\n    tree,\n    fullyQualifiedName,\n  );\n  projectConfiguration.name = fullyQualifiedName;\n  // Derive the compile target from the uv build target, and rewrite build to\n  // orchestrate the other targets. This only runs on first creation: on re-run\n  // build has already been transformed, so re-deriving would corrupt compile\n  // and duplicate the build dependencies.\n  if (!projectConfiguration.targets.compile) {\n    const buildTarget = projectConfiguration.targets.build;\n    projectConfiguration.targets.compile = {\n      ...buildTarget,\n      inputs: ['default', '^production'],\n      outputs: [buildOutputPath],\n      options: {\n        ...buildTarget.options,\n        outputPath: buildOutputPath,\n        // The build executor copies the project to a temp folder; exclude the\n        // executor defaults plus transient artifacts so the copy does not race\n        // a concurrent test/typecheck target deleting a file mid-copy.\n        ignorePaths: ['.venv', '.tox', 'tests', ...PYTHON_TRANSIENT_ARTIFACTS],\n      },\n    };\n    projectConfiguration.targets.build = {\n      inputs: ['default', '^production'],\n      dependsOn: [\n        'lint',\n        'compile',\n        'test',\n        'typecheck',\n        ...(buildTarget.dependsOn ?? []),\n      ],\n      options: {\n        outputPath,\n      },\n    };\n  }\n  projectConfiguration.targets.typecheck = {\n    cache: true,\n    inputs: ['default', '^production'],\n    executor: '@nxlv/python:run-commands',\n    options: {\n      command: 'uv run ty check',\n      cwd: '{projectRoot}',\n    },\n  };\n\n  // Set the default line length to 120, as 88 is a little too strict\n  updateToml(\n    tree,\n    joinPathFragments(dir, 'pyproject.toml'),\n    (pyProjectToml: UVPyprojectToml) => {\n      if ((pyProjectToml.tool as any)?.ruff) {\n        (pyProjectToml.tool as any).ruff['line-length'] = 120;\n      }\n      return pyProjectToml;\n    },\n  );\n\n  addDependenciesToDependencyGroupInPyProjectToml(tree, '.', 'dev', ['ty']);\n\n  // Add a dependency on the format target for lint in order to reduce the number of\n  // fixable lint errors (eg line too long)\n  projectConfiguration.targets.lint = {\n    ...projectConfiguration.targets.lint,\n    cache: true,\n    inputs: ['default', '^production'],\n    configurations: {\n      ...projectConfiguration.targets.lint?.configurations,\n      fix: {\n        fix: true,\n      },\n      'skip-lint': {\n        exitZero: true,\n      },\n    },\n  };\n  // Append `format` without moving an existing entry, so re-running does not\n  // reorder lint dependencies (e.g. relative to a later-added license-check).\n  addDependencyToTargetIfNotPresent(projectConfiguration, 'lint', 'format');\n\n  projectConfiguration.targets = sortObjectKeys(projectConfiguration.targets);\n  updateProjectConfiguration(tree, fullyQualifiedName, projectConfiguration);\n\n  addGeneratorMetadata(tree, fullyQualifiedName, PY_PROJECT_GENERATOR_INFO);\n\n  // Update root .gitignore\n  updateGitIgnore(tree, '.', (patterns) => [...patterns, '/reports']);\n\n  // Update project level .gitignore. The cache directories are also kept out\n  // of type checking: `ty` respects .gitignore, and pytest creates and removes\n  // transient `pytest-cache-files-*` directories while the test and typecheck\n  // targets run concurrently, which would otherwise make `ty` fail with an I/O\n  // error when it scans one mid-deletion.\n  updateGitIgnore(tree, dir, (patterns) => [\n    ...patterns,\n    '**/__pycache__',\n    ...PYTHON_TRANSIENT_ARTIFACTS.filter((p) => p !== '__pycache__'),\n  ]);\n\n  await addGeneratorMetricsIfApplicable(tree, [PY_PROJECT_GENERATOR_INFO]);\n\n  await ensurePythonLicenseCollector(tree);\n\n  // If license checking is configured, make this project's lint target depend\n  // on the root license-check target. No-op if license checking isn't set up;\n  // the license generator wires up existing projects itself, so the dependency\n  // is added regardless of which generator runs first.\n  addLicenseCheckToLintTarget(tree, fullyQualifiedName);\n\n  return () =>\n    installDependencies(tree, schema.preferInstallDependencies, {\n      languages: ['typescript', 'python'],\n    });\n};\nexport default pyProjectGenerator;\n"],"names":["addDependenciesToPackageJson","ensurePackage","joinPathFragments","readNxJson","readProjectConfiguration","updateNxJson","updateProjectConfiguration","addLicenseCheckToLintTarget","ensurePythonLicenseCollector","updateGitIgnore","installDependencies","addGeneratorMetricsIfApplicable","normalizeDistributionName","toSnakeCase","getNpmScope","addDependencyToTargetIfNotPresent","addGeneratorMetadata","getGeneratorInfo","projectExists","migrateToSharedVenvGenerator","uvProjectGenerator","sortObjectKeys","addDependenciesToDependencyGroupInPyProjectToml","updateToml","withVersions","PY_PROJECT_GENERATOR_INFO","filename","PYTHON_TRANSIENT_ARTIFACTS","getPyProjectDetails","tree","schema","scope","normalizedName","name","normalizedModuleName","moduleName","fullyQualifiedName","distributionName","dir","directory","subDirectory","pyProjectGenerator","pythonPlugin","Object","entries","forEach","version","nxJson","plugins","find","p","plugin","options","packageManager","exists","autoActivate","moveDevDependencies","pyenvPythonVersion","pyprojectPythonDependency","packageName","publishable","buildLockedVersions","buildBundleLocalDependencies","linter","rootPyprojectDependencyGroup","projectType","type","projectNameAndRootFormat","unitTestRunner","codeCoverage","codeCoverageHtmlReport","codeCoverageXmlReport","unitTestHtmlReport","unitTestJUnitReport","buildSystem","srcDir","f","delete","write","outputPath","buildOutputPath","projectConfiguration","targets","compile","buildTarget","build","inputs","outputs","ignorePaths","dependsOn","typecheck","cache","executor","command","cwd","pyProjectToml","tool","ruff","lint","configurations","fix","exitZero","patterns","filter","preferInstallDependencies","languages"],"mappings":"AAAA;;;CAGC,GACD,SACEA,4BAA4B,EAC5BC,aAAa,EAEbC,iBAAiB,EACjBC,UAAU,EACVC,wBAAwB,EAExBC,YAAY,EACZC,0BAA0B,QACrB,aAAa;AACpB,SACEC,2BAA2B,EAC3BC,4BAA4B,QACvB,0BAAuB;AAC9B,SAASC,eAAe,QAAQ,qBAAkB;AAClD,SAASC,mBAAmB,QAAQ,yBAAsB;AAC1D,SAASC,+BAA+B,QAAQ,yBAAsB;AACtE,SAASC,yBAAyB,EAAEC,WAAW,QAAQ,uBAAoB;AAC3E,SAASC,WAAW,QAAQ,2BAAwB;AACpD,SACEC,iCAAiC,EACjCC,oBAAoB,EACpBC,gBAAgB,EAEhBC,aAAa,QACR,oBAAiB;AAExB,SACEC,4BAA4B,EAC5BC,kBAAkB,QACb,6BAA0B;AACjC,SAASC,cAAc,QAAQ,wBAAqB;AACpD,SAASC,+CAA+C,QAAQ,oBAAiB;AACjF,SAASC,UAAU,QAAQ,sBAAmB;AAC9C,SAASC,YAAY,QAAQ,0BAAuB;AAGpD,OAAO,MAAMC,4BAA6CR,iBACxD,YAAYS,QAAQ,EACpB;AAEF,6EAA6E;AAC7E,8EAA8E;AAC9E,iFAAiF;AACjF,uEAAuE;AACvE,gFAAgF;AAChF,4CAA4C;AAC5C,MAAMC,6BAA6B;IACjC;IACA;IACA;IACA;IACA;IACA;CACD;AA8BD;;CAEC,GACD,OAAO,MAAMC,sBAAsB,CACjCC,MACAC;IAOA,MAAMC,QAAQlB,YAAYC,YAAYe;IACtC,MAAMG,iBAAiBnB,YAAYiB,OAAOG,IAAI;IAC9C,MAAMC,uBAAuBrB,YAC3BiB,OAAOK,UAAU,IAAI,GAAGJ,MAAM,CAAC,EAAEC,gBAAgB;IAEnD,MAAMI,qBAAqB,GAAGL,MAAM,CAAC,EAAEC,gBAAgB;IACvD,qEAAqE;IACrE,wEAAwE;IACxE,MAAMK,mBAAmBzB,0BAA0BwB;IACnD,yDAAyD;IACzD,MAAME,MAAMpC,kBACV4B,OAAOS,SAAS,IAAI,KACpBT,OAAOU,YAAY,IAAIR;IAEzB,OAAO;QAAEM;QAAKF;QAAoBC;QAAkBH;IAAqB;AAC3E,EAAE;AAEF;;CAEC,GACD,OAAO,MAAMO,qBAAqB,OAChCZ,MACAC;IAEA,MAAM,EAAEQ,GAAG,EAAEJ,oBAAoB,EAAEE,kBAAkB,EAAEC,gBAAgB,EAAE,GACvET,oBAAoBC,MAAMC;IAE5B,MAAMY,eAAelB,aAAa;QAAC;KAAe;IAClDxB,6BAA6B6B,MAAM,CAAC,GAAGa;IAEvCC,OAAOC,OAAO,CAACF,cAAcG,OAAO,CAAC,CAAC,CAACZ,MAAMa,QAAQ,GACnD7C,cAAcgC,MAAMa;IAGtB,MAAMC,SAAS5C,WAAW0B;IAE1B,4EAA4E;IAC5E,gEAAgE;IAChE,IACE,CAACkB,OAAOC,OAAO,EAAEC,KAAK,CAACC,IACrB,OAAOA,MAAM,WACTA,MAAM,iBACNA,EAAEC,MAAM,KAAK,iBAEnB;QACAJ,OAAOC,OAAO,GAAG;eACXD,OAAOC,OAAO,IAAI,EAAE;YACxB;gBACEG,QAAQ;gBACRC,SAAS;oBACPC,gBAAgB;gBAClB;YACF;SACD;QACDhD,aAAawB,MAAMkB;IACrB;IAEA,8EAA8E;IAC9E,8EAA8E;IAC9E,+CAA+C;IAC/C,IAAI,CAAC7B,cAAcW,MAAMO,qBAAqB;QAC5C,IAAI,CAACP,KAAKyB,MAAM,CAAC,YAAY;YAC3B,MAAMnC,6BAA6BU,MAAM;gBACvC0B,cAAc;gBACdF,gBAAgB;gBAChBG,qBAAqB;gBACrBC,oBAAoB;gBACpBC,2BAA2B;YAC7B;QACF;QAEA,MAAMtC,mBAAmBS,MAAM;YAC7B,0EAA0E;YAC1E,0EAA0E;YAC1E,0EAA0E;YAC1E,wEAAwE;YACxE,0EAA0E;YAC1E,yDAAyD;YACzDI,MAAMG;YACNuB,aAAatB;YACbuB,aAAa;YACbC,qBAAqB;YACrBC,8BAA8B;YAC9BC,QAAQ;YACRC,8BAA8B;YAC9BP,oBAAoB;YACpBC,2BAA2B;YAC3BO,aAAanC,OAAOoC,IAAI;YACxBC,0BAA0B;YAC1BhC,YAAYD;YACZK,WAAWD;YACX8B,gBAAgB;YAChBC,cAAc;YACdC,wBAAwB;YACxBC,uBAAuB;YACvBC,oBAAoB;YACpBC,qBAAqB;YACrBC,aAAa;YACbC,QAAQ;QACV;QAEA,qEAAqE;QACrE;YACEzE,kBAAkBoC,KAAKJ,sBAAsB;YAC7ChC,kBAAkBoC,KAAK,SAAS;SACjC,CAACO,OAAO,CAAC,CAAC+B,IAAM/C,KAAKgD,MAAM,CAACD;QAE7B,0EAA0E;QAC1E/C,KAAKiD,KAAK,CACR5E,kBAAkBoC,KAAK,SAAS,iBAChC;IAEJ;IAEA,MAAMyC,aAAa;IACnB,MAAMC,kBAAkB9E,kBAAkB6E,YAAY;IACtD,MAAME,uBAAuB7E,yBAC3ByB,MACAO;IAEF6C,qBAAqBhD,IAAI,GAAGG;IAC5B,2EAA2E;IAC3E,6EAA6E;IAC7E,2EAA2E;IAC3E,wCAAwC;IACxC,IAAI,CAAC6C,qBAAqBC,OAAO,CAACC,OAAO,EAAE;QACzC,MAAMC,cAAcH,qBAAqBC,OAAO,CAACG,KAAK;QACtDJ,qBAAqBC,OAAO,CAACC,OAAO,GAAG;YACrC,GAAGC,WAAW;YACdE,QAAQ;gBAAC;gBAAW;aAAc;YAClCC,SAAS;gBAACP;aAAgB;YAC1B5B,SAAS;gBACP,GAAGgC,YAAYhC,OAAO;gBACtB2B,YAAYC;gBACZ,sEAAsE;gBACtE,uEAAuE;gBACvE,+DAA+D;gBAC/DQ,aAAa;oBAAC;oBAAS;oBAAQ;uBAAY7D;iBAA2B;YACxE;QACF;QACAsD,qBAAqBC,OAAO,CAACG,KAAK,GAAG;YACnCC,QAAQ;gBAAC;gBAAW;aAAc;YAClCG,WAAW;gBACT;gBACA;gBACA;gBACA;mBACIL,YAAYK,SAAS,IAAI,EAAE;aAChC;YACDrC,SAAS;gBACP2B;YACF;QACF;IACF;IACAE,qBAAqBC,OAAO,CAACQ,SAAS,GAAG;QACvCC,OAAO;QACPL,QAAQ;YAAC;YAAW;SAAc;QAClCM,UAAU;QACVxC,SAAS;YACPyC,SAAS;YACTC,KAAK;QACP;IACF;IAEA,mEAAmE;IACnEvE,WACEM,MACA3B,kBAAkBoC,KAAK,mBACvB,CAACyD;QACC,IAAKA,cAAcC,IAAI,EAAUC,MAAM;YACpCF,cAAcC,IAAI,CAASC,IAAI,CAAC,cAAc,GAAG;QACpD;QACA,OAAOF;IACT;IAGFzE,gDAAgDO,MAAM,KAAK,OAAO;QAAC;KAAK;IAExE,kFAAkF;IAClF,yCAAyC;IACzCoD,qBAAqBC,OAAO,CAACgB,IAAI,GAAG;QAClC,GAAGjB,qBAAqBC,OAAO,CAACgB,IAAI;QACpCP,OAAO;QACPL,QAAQ;YAAC;YAAW;SAAc;QAClCa,gBAAgB;YACd,GAAGlB,qBAAqBC,OAAO,CAACgB,IAAI,EAAEC,cAAc;YACpDC,KAAK;gBACHA,KAAK;YACP;YACA,aAAa;gBACXC,UAAU;YACZ;QACF;IACF;IACA,2EAA2E;IAC3E,4EAA4E;IAC5EtF,kCAAkCkE,sBAAsB,QAAQ;IAEhEA,qBAAqBC,OAAO,GAAG7D,eAAe4D,qBAAqBC,OAAO;IAC1E5E,2BAA2BuB,MAAMO,oBAAoB6C;IAErDjE,qBAAqBa,MAAMO,oBAAoBX;IAE/C,yBAAyB;IACzBhB,gBAAgBoB,MAAM,KAAK,CAACyE,WAAa;eAAIA;YAAU;SAAW;IAElE,2EAA2E;IAC3E,6EAA6E;IAC7E,4EAA4E;IAC5E,6EAA6E;IAC7E,wCAAwC;IACxC7F,gBAAgBoB,MAAMS,KAAK,CAACgE,WAAa;eACpCA;YACH;eACG3E,2BAA2B4E,MAAM,CAAC,CAACrD,IAAMA,MAAM;SACnD;IAED,MAAMvC,gCAAgCkB,MAAM;QAACJ;KAA0B;IAEvE,MAAMjB,6BAA6BqB;IAEnC,4EAA4E;IAC5E,4EAA4E;IAC5E,6EAA6E;IAC7E,qDAAqD;IACrDtB,4BAA4BsB,MAAMO;IAElC,OAAO,IACL1B,oBAAoBmB,MAAMC,OAAO0E,yBAAyB,EAAE;YAC1DC,WAAW;gBAAC;gBAAc;aAAS;QACrC;AACJ,EAAE;AACF,eAAehE,mBAAmB"}
+{"version":3,"sources":["../../../../../../packages/nx-plugin/src/py/project/generator.ts"],"sourcesContent":["/**\n * Copyright Amazon.com, Inc. or its affiliates. All Rights Reserved.\n * SPDX-License-Identifier: Apache-2.0\n */\nimport {\n  addDependenciesToPackageJson,\n  ensurePackage,\n  type GeneratorCallback,\n  joinPathFragments,\n  readNxJson,\n  readProjectConfiguration,\n  type Tree,\n  updateNxJson,\n  updateProjectConfiguration,\n} from '@nx/devkit';\nimport {\n  addLicenseCheckToLintTarget,\n  ensurePythonLicenseCollector,\n} from '../../license/config';\nimport { updateGitIgnore } from '../../utils/git';\nimport { installDependencies } from '../../utils/install';\nimport { addGeneratorMetricsIfApplicable } from '../../utils/metrics';\nimport { normalizeDistributionName, toSnakeCase } from '../../utils/names';\nimport { getNpmScope } from '../../utils/npm-scope';\nimport {\n  addDependencyToTargetIfNotPresent,\n  addGeneratorMetadata,\n  getGeneratorInfo,\n  type NxGeneratorInfo,\n  projectExists,\n} from '../../utils/nx';\nimport type { UVPyprojectToml } from '../../utils/nxlv-python';\nimport {\n  migrateToSharedVenvGenerator,\n  uvProjectGenerator,\n} from '../../utils/nxlv-python';\nimport { sortObjectKeys } from '../../utils/object';\nimport { addDependenciesToDependencyGroupInPyProjectToml } from '../../utils/py';\nimport { updateToml } from '../../utils/toml';\nimport { withVersions } from '../../utils/versions';\nimport type { PyProjectGeneratorSchema } from './schema';\n\nexport const PY_PROJECT_GENERATOR_INFO: NxGeneratorInfo = getGeneratorInfo(\n  import.meta.filename,\n);\n\n// Transient artifacts that pytest, coverage and ruff create and remove while\n// the test, typecheck and compile targets run concurrently. `.coverage.*` are\n// the per-process data files pytest-cov writes (`.coverage.<host>.<pid>.<rand>`)\n// before combining them. Both `ty` (which respects .gitignore) and the\n// `@nxlv/python:build` copy (which respects `ignorePaths`) would otherwise fail\n// when they read one of these mid-deletion.\nconst PYTHON_TRANSIENT_ARTIFACTS = [\n  '__pycache__',\n  '.coverage',\n  '.coverage.*',\n  '.pytest_cache',\n  'pytest-cache-files-*',\n  '.ruff_cache',\n];\n\nexport interface PyProjectDetails {\n  /**\n   * Fully qualified Nx project id including scope, in dot notation (eg foo.bar).\n   * This is the identifier Nx uses (readProjectConfiguration, the project\n   * graph, target references) and is intentionally kept dotted.\n   */\n  readonly fullyQualifiedName: string;\n  /**\n   * PEP 503 normalised Python distribution name (eg foo-bar). This is the name\n   * written to the project's `[project].name`, the root `[tool.uv.sources]`\n   * key, and any inter-project dependency string. It is hyphenated (not dotted)\n   * so `uv` and `@nxlv/python` can match it: uv writes `uv.lock` keyed by the\n   * PEP 503 hyphenated name, and `@nxlv/python`'s dependency inference splits a\n   * dotted name on `.` and so would otherwise drop the edge entirely. Keeping\n   * the distribution name decoupled from `fullyQualifiedName` is what lets the\n   * workspace dependency edge appear in the Nx project graph.\n   */\n  readonly distributionName: string;\n  /**\n   * Directory of the library relative to the root\n   */\n  readonly dir: string;\n  /**\n   * Module name for the project\n   */\n  readonly normalizedModuleName: string;\n}\n\n/**\n * Returns details about the Python project to be created\n */\nexport const getPyProjectDetails = (\n  tree: Tree,\n  schema: {\n    name: string;\n    directory?: string;\n    subDirectory?: string;\n    moduleName?: string;\n  },\n): PyProjectDetails => {\n  const scope = toSnakeCase(getNpmScope(tree));\n  const normalizedName = toSnakeCase(schema.name);\n  const normalizedModuleName = toSnakeCase(\n    schema.moduleName ?? `${scope}_${normalizedName}`,\n  );\n  const fullyQualifiedName = `${scope}.${normalizedName}`;\n  // The Python distribution name is the PEP 503 normalised form of the\n  // fully qualified name: hyphenated, never dotted. See PyProjectDetails.\n  const distributionName = normalizeDistributionName(fullyQualifiedName);\n  // NB: interactive nx generator cli can pass empty string\n  const dir = joinPathFragments(\n    schema.directory || '.',\n    schema.subDirectory || normalizedName,\n  );\n  return { dir, fullyQualifiedName, distributionName, normalizedModuleName };\n};\n\n/**\n * Generates a Python project\n */\nexport const pyProjectGenerator = async (\n  tree: Tree,\n  schema: PyProjectGeneratorSchema,\n): Promise<GeneratorCallback> => {\n  const { dir, normalizedModuleName, fullyQualifiedName, distributionName } =\n    getPyProjectDetails(tree, schema);\n\n  const pythonPlugin = withVersions(['@nxlv/python']);\n  addDependenciesToPackageJson(tree, {}, pythonPlugin);\n\n  Object.entries(pythonPlugin).forEach(([name, version]) =>\n    ensurePackage(name, version),\n  );\n\n  const nxJson = readNxJson(tree);\n\n  // Only rewrite nx.json when the plugin needs adding, so re-running does not\n  // reserialize (and reformat) the file when nothing has changed.\n  if (\n    !nxJson.plugins?.find((p) =>\n      typeof p === 'string'\n        ? p === '@nxlv/python'\n        : p.plugin === '@nxlv/python',\n    )\n  ) {\n    nxJson.plugins = [\n      ...(nxJson.plugins ?? []),\n      {\n        plugin: '@nxlv/python',\n        options: {\n          packageManager: 'uv',\n        },\n      },\n    ];\n    updateNxJson(tree, nxJson);\n  }\n\n  // Only scaffold the project when it does not already exist so re-running with\n  // the same name does not throw. The rest of the generator still runs to apply\n  // any changed options to the existing project.\n  if (!projectExists(tree, fullyQualifiedName)) {\n    if (!tree.exists('uv.lock')) {\n      await migrateToSharedVenvGenerator(tree, {\n        autoActivate: true,\n        packageManager: 'uv',\n        moveDevDependencies: false,\n        pyenvPythonVersion: '3.14.0',\n        pyprojectPythonDependency: '>=3.14',\n      });\n    }\n\n    await uvProjectGenerator(tree, {\n      // The Nx project id (and `uv.workspace.members` etc.) keys off `name`, so\n      // keep it dotted. `packageName` is the separate PEP 503 distribution name\n      // written to `[project].name` and the root `[tool.uv.sources]` key; it is\n      // hyphenated so `@nxlv/python` infers the workspace dependency edge (it\n      // splits a dotted name on `.` and would otherwise drop it). This split is\n      // the whole fix (see PyProjectDetails.distributionName).\n      name: fullyQualifiedName,\n      packageName: distributionName,\n      publishable: false,\n      buildLockedVersions: true,\n      buildBundleLocalDependencies: true,\n      linter: 'ruff',\n      rootPyprojectDependencyGroup: 'main',\n      pyenvPythonVersion: '3.14.0',\n      pyprojectPythonDependency: '>=3.14',\n      projectType: schema.type,\n      projectNameAndRootFormat: 'as-provided',\n      moduleName: normalizedModuleName,\n      directory: dir,\n      unitTestRunner: 'pytest',\n      codeCoverage: true,\n      codeCoverageHtmlReport: true,\n      codeCoverageXmlReport: true,\n      unitTestHtmlReport: true,\n      unitTestJUnitReport: true,\n      buildSystem: 'hatch',\n      srcDir: false,\n    });\n\n    // Remove generated hello.py and test_hello.py as they are not needed\n    [\n      joinPathFragments(dir, normalizedModuleName, 'hello.py'),\n      joinPathFragments(dir, 'tests', 'test_hello.py'),\n    ].forEach((f) => tree.delete(f));\n\n    // Add a placeholder test so pytest doesn't fail with \"no tests collected\"\n    tree.write(\n      joinPathFragments(dir, 'tests', 'test_noop.py'),\n      'def test_noop():\\n    pass\\n',\n    );\n  }\n\n  const outputPath = '{workspaceRoot}/dist/{projectRoot}';\n  const buildOutputPath = joinPathFragments(outputPath, 'build');\n  const projectConfiguration = readProjectConfiguration(\n    tree,\n    fullyQualifiedName,\n  );\n  projectConfiguration.name = fullyQualifiedName;\n  // Derive the compile target from the uv build target, and rewrite build to\n  // orchestrate the other targets. This only runs on first creation: on re-run\n  // build has already been transformed, so re-deriving would corrupt compile\n  // and duplicate the build dependencies.\n  if (!projectConfiguration.targets.compile) {\n    const buildTarget = projectConfiguration.targets.build;\n    projectConfiguration.targets.compile = {\n      ...buildTarget,\n      inputs: ['default', '^production'],\n      outputs: [buildOutputPath],\n      options: {\n        ...buildTarget.options,\n        outputPath: buildOutputPath,\n        // The build executor copies the project to a temp folder; exclude the\n        // executor defaults plus transient artifacts so the copy does not race\n        // a concurrent test/typecheck target deleting a file mid-copy.\n        ignorePaths: ['.venv', '.tox', 'tests', ...PYTHON_TRANSIENT_ARTIFACTS],\n      },\n    };\n    projectConfiguration.targets.build = {\n      inputs: ['default', '^production'],\n      dependsOn: [\n        'lint',\n        'compile',\n        'test',\n        'typecheck',\n        ...(buildTarget.dependsOn ?? []),\n      ],\n      options: {\n        outputPath,\n      },\n    };\n  }\n  projectConfiguration.targets.typecheck = {\n    cache: true,\n    inputs: ['default', '^production'],\n    executor: '@nxlv/python:run-commands',\n    options: {\n      command: 'uv run ty check',\n      cwd: '{projectRoot}',\n    },\n  };\n\n  // Set the default line length to 120, as 88 is a little too strict\n  updateToml(\n    tree,\n    joinPathFragments(dir, 'pyproject.toml'),\n    (pyProjectToml: UVPyprojectToml) => {\n      if ((pyProjectToml.tool as any)?.ruff) {\n        (pyProjectToml.tool as any).ruff['line-length'] = 120;\n      }\n      return pyProjectToml;\n    },\n  );\n\n  // Pin ruff to the version generation-time formatting uses (PY_VERSIONS), so\n  // generated files stay `ruff format --check`-clean across ruff releases.\n  addDependenciesToDependencyGroupInPyProjectToml(tree, '.', 'dev', [\n    'ruff',\n    'ty',\n  ]);\n\n  // Base format target checks rather than writes (so build/lint don't rewrite\n  // source); `fix` writes, and `skip-lint` writes without failing so it stays\n  // a no-op when propagated through the lint -> format dependency.\n  projectConfiguration.targets.format = {\n    ...projectConfiguration.targets.format,\n    cache: true,\n    inputs: ['default', '^production'],\n    options: {\n      ...projectConfiguration.targets.format?.options,\n      check: true,\n    },\n    configurations: {\n      ...projectConfiguration.targets.format?.configurations,\n      fix: {\n        check: false,\n      },\n      'skip-lint': {\n        check: false,\n      },\n    },\n  };\n\n  // Add a dependency on the format target for lint in order to reduce the number of\n  // fixable lint errors (eg line too long)\n  projectConfiguration.targets.lint = {\n    ...projectConfiguration.targets.lint,\n    cache: true,\n    inputs: ['default', '^production'],\n    configurations: {\n      ...projectConfiguration.targets.lint?.configurations,\n      fix: {\n        fix: true,\n      },\n      'skip-lint': {\n        exitZero: true,\n      },\n    },\n  };\n  // Append `format` without moving an existing entry, so re-running does not\n  // reorder lint dependencies (e.g. relative to a later-added license-check).\n  addDependencyToTargetIfNotPresent(projectConfiguration, 'lint', 'format');\n\n  projectConfiguration.targets = sortObjectKeys(projectConfiguration.targets);\n  updateProjectConfiguration(tree, fullyQualifiedName, projectConfiguration);\n\n  addGeneratorMetadata(tree, fullyQualifiedName, PY_PROJECT_GENERATOR_INFO);\n\n  // Update root .gitignore\n  updateGitIgnore(tree, '.', (patterns) => [...patterns, '/reports']);\n\n  // Update project level .gitignore. The cache directories are also kept out\n  // of type checking: `ty` respects .gitignore, and pytest creates and removes\n  // transient `pytest-cache-files-*` directories while the test and typecheck\n  // targets run concurrently, which would otherwise make `ty` fail with an I/O\n  // error when it scans one mid-deletion.\n  updateGitIgnore(tree, dir, (patterns) => [\n    ...patterns,\n    '**/__pycache__',\n    ...PYTHON_TRANSIENT_ARTIFACTS.filter((p) => p !== '__pycache__'),\n  ]);\n\n  await addGeneratorMetricsIfApplicable(tree, [PY_PROJECT_GENERATOR_INFO]);\n\n  await ensurePythonLicenseCollector(tree);\n\n  // If license checking is configured, make this project's lint target depend\n  // on the root license-check target. No-op if license checking isn't set up;\n  // the license generator wires up existing projects itself, so the dependency\n  // is added regardless of which generator runs first.\n  addLicenseCheckToLintTarget(tree, fullyQualifiedName);\n\n  return () =>\n    installDependencies(tree, schema.preferInstallDependencies, {\n      languages: ['typescript', 'python'],\n    });\n};\nexport default pyProjectGenerator;\n"],"names":["addDependenciesToPackageJson","ensurePackage","joinPathFragments","readNxJson","readProjectConfiguration","updateNxJson","updateProjectConfiguration","addLicenseCheckToLintTarget","ensurePythonLicenseCollector","updateGitIgnore","installDependencies","addGeneratorMetricsIfApplicable","normalizeDistributionName","toSnakeCase","getNpmScope","addDependencyToTargetIfNotPresent","addGeneratorMetadata","getGeneratorInfo","projectExists","migrateToSharedVenvGenerator","uvProjectGenerator","sortObjectKeys","addDependenciesToDependencyGroupInPyProjectToml","updateToml","withVersions","PY_PROJECT_GENERATOR_INFO","filename","PYTHON_TRANSIENT_ARTIFACTS","getPyProjectDetails","tree","schema","scope","normalizedName","name","normalizedModuleName","moduleName","fullyQualifiedName","distributionName","dir","directory","subDirectory","pyProjectGenerator","pythonPlugin","Object","entries","forEach","version","nxJson","plugins","find","p","plugin","options","packageManager","exists","autoActivate","moveDevDependencies","pyenvPythonVersion","pyprojectPythonDependency","packageName","publishable","buildLockedVersions","buildBundleLocalDependencies","linter","rootPyprojectDependencyGroup","projectType","type","projectNameAndRootFormat","unitTestRunner","codeCoverage","codeCoverageHtmlReport","codeCoverageXmlReport","unitTestHtmlReport","unitTestJUnitReport","buildSystem","srcDir","f","delete","write","outputPath","buildOutputPath","projectConfiguration","targets","compile","buildTarget","build","inputs","outputs","ignorePaths","dependsOn","typecheck","cache","executor","command","cwd","pyProjectToml","tool","ruff","format","check","configurations","fix","lint","exitZero","patterns","filter","preferInstallDependencies","languages"],"mappings":"AAAA;;;CAGC,GACD,SACEA,4BAA4B,EAC5BC,aAAa,EAEbC,iBAAiB,EACjBC,UAAU,EACVC,wBAAwB,EAExBC,YAAY,EACZC,0BAA0B,QACrB,aAAa;AACpB,SACEC,2BAA2B,EAC3BC,4BAA4B,QACvB,0BAAuB;AAC9B,SAASC,eAAe,QAAQ,qBAAkB;AAClD,SAASC,mBAAmB,QAAQ,yBAAsB;AAC1D,SAASC,+BAA+B,QAAQ,yBAAsB;AACtE,SAASC,yBAAyB,EAAEC,WAAW,QAAQ,uBAAoB;AAC3E,SAASC,WAAW,QAAQ,2BAAwB;AACpD,SACEC,iCAAiC,EACjCC,oBAAoB,EACpBC,gBAAgB,EAEhBC,aAAa,QACR,oBAAiB;AAExB,SACEC,4BAA4B,EAC5BC,kBAAkB,QACb,6BAA0B;AACjC,SAASC,cAAc,QAAQ,wBAAqB;AACpD,SAASC,+CAA+C,QAAQ,oBAAiB;AACjF,SAASC,UAAU,QAAQ,sBAAmB;AAC9C,SAASC,YAAY,QAAQ,0BAAuB;AAGpD,OAAO,MAAMC,4BAA6CR,iBACxD,YAAYS,QAAQ,EACpB;AAEF,6EAA6E;AAC7E,8EAA8E;AAC9E,iFAAiF;AACjF,uEAAuE;AACvE,gFAAgF;AAChF,4CAA4C;AAC5C,MAAMC,6BAA6B;IACjC;IACA;IACA;IACA;IACA;IACA;CACD;AA8BD;;CAEC,GACD,OAAO,MAAMC,sBAAsB,CACjCC,MACAC;IAOA,MAAMC,QAAQlB,YAAYC,YAAYe;IACtC,MAAMG,iBAAiBnB,YAAYiB,OAAOG,IAAI;IAC9C,MAAMC,uBAAuBrB,YAC3BiB,OAAOK,UAAU,IAAI,GAAGJ,MAAM,CAAC,EAAEC,gBAAgB;IAEnD,MAAMI,qBAAqB,GAAGL,MAAM,CAAC,EAAEC,gBAAgB;IACvD,qEAAqE;IACrE,wEAAwE;IACxE,MAAMK,mBAAmBzB,0BAA0BwB;IACnD,yDAAyD;IACzD,MAAME,MAAMpC,kBACV4B,OAAOS,SAAS,IAAI,KACpBT,OAAOU,YAAY,IAAIR;IAEzB,OAAO;QAAEM;QAAKF;QAAoBC;QAAkBH;IAAqB;AAC3E,EAAE;AAEF;;CAEC,GACD,OAAO,MAAMO,qBAAqB,OAChCZ,MACAC;IAEA,MAAM,EAAEQ,GAAG,EAAEJ,oBAAoB,EAAEE,kBAAkB,EAAEC,gBAAgB,EAAE,GACvET,oBAAoBC,MAAMC;IAE5B,MAAMY,eAAelB,aAAa;QAAC;KAAe;IAClDxB,6BAA6B6B,MAAM,CAAC,GAAGa;IAEvCC,OAAOC,OAAO,CAACF,cAAcG,OAAO,CAAC,CAAC,CAACZ,MAAMa,QAAQ,GACnD7C,cAAcgC,MAAMa;IAGtB,MAAMC,SAAS5C,WAAW0B;IAE1B,4EAA4E;IAC5E,gEAAgE;IAChE,IACE,CAACkB,OAAOC,OAAO,EAAEC,KAAK,CAACC,IACrB,OAAOA,MAAM,WACTA,MAAM,iBACNA,EAAEC,MAAM,KAAK,iBAEnB;QACAJ,OAAOC,OAAO,GAAG;eACXD,OAAOC,OAAO,IAAI,EAAE;YACxB;gBACEG,QAAQ;gBACRC,SAAS;oBACPC,gBAAgB;gBAClB;YACF;SACD;QACDhD,aAAawB,MAAMkB;IACrB;IAEA,8EAA8E;IAC9E,8EAA8E;IAC9E,+CAA+C;IAC/C,IAAI,CAAC7B,cAAcW,MAAMO,qBAAqB;QAC5C,IAAI,CAACP,KAAKyB,MAAM,CAAC,YAAY;YAC3B,MAAMnC,6BAA6BU,MAAM;gBACvC0B,cAAc;gBACdF,gBAAgB;gBAChBG,qBAAqB;gBACrBC,oBAAoB;gBACpBC,2BAA2B;YAC7B;QACF;QAEA,MAAMtC,mBAAmBS,MAAM;YAC7B,0EAA0E;YAC1E,0EAA0E;YAC1E,0EAA0E;YAC1E,wEAAwE;YACxE,0EAA0E;YAC1E,yDAAyD;YACzDI,MAAMG;YACNuB,aAAatB;YACbuB,aAAa;YACbC,qBAAqB;YACrBC,8BAA8B;YAC9BC,QAAQ;YACRC,8BAA8B;YAC9BP,oBAAoB;YACpBC,2BAA2B;YAC3BO,aAAanC,OAAOoC,IAAI;YACxBC,0BAA0B;YAC1BhC,YAAYD;YACZK,WAAWD;YACX8B,gBAAgB;YAChBC,cAAc;YACdC,wBAAwB;YACxBC,uBAAuB;YACvBC,oBAAoB;YACpBC,qBAAqB;YACrBC,aAAa;YACbC,QAAQ;QACV;QAEA,qEAAqE;QACrE;YACEzE,kBAAkBoC,KAAKJ,sBAAsB;YAC7ChC,kBAAkBoC,KAAK,SAAS;SACjC,CAACO,OAAO,CAAC,CAAC+B,IAAM/C,KAAKgD,MAAM,CAACD;QAE7B,0EAA0E;QAC1E/C,KAAKiD,KAAK,CACR5E,kBAAkBoC,KAAK,SAAS,iBAChC;IAEJ;IAEA,MAAMyC,aAAa;IACnB,MAAMC,kBAAkB9E,kBAAkB6E,YAAY;IACtD,MAAME,uBAAuB7E,yBAC3ByB,MACAO;IAEF6C,qBAAqBhD,IAAI,GAAGG;IAC5B,2EAA2E;IAC3E,6EAA6E;IAC7E,2EAA2E;IAC3E,wCAAwC;IACxC,IAAI,CAAC6C,qBAAqBC,OAAO,CAACC,OAAO,EAAE;QACzC,MAAMC,cAAcH,qBAAqBC,OAAO,CAACG,KAAK;QACtDJ,qBAAqBC,OAAO,CAACC,OAAO,GAAG;YACrC,GAAGC,WAAW;YACdE,QAAQ;gBAAC;gBAAW;aAAc;YAClCC,SAAS;gBAACP;aAAgB;YAC1B5B,SAAS;gBACP,GAAGgC,YAAYhC,OAAO;gBACtB2B,YAAYC;gBACZ,sEAAsE;gBACtE,uEAAuE;gBACvE,+DAA+D;gBAC/DQ,aAAa;oBAAC;oBAAS;oBAAQ;uBAAY7D;iBAA2B;YACxE;QACF;QACAsD,qBAAqBC,OAAO,CAACG,KAAK,GAAG;YACnCC,QAAQ;gBAAC;gBAAW;aAAc;YAClCG,WAAW;gBACT;gBACA;gBACA;gBACA;mBACIL,YAAYK,SAAS,IAAI,EAAE;aAChC;YACDrC,SAAS;gBACP2B;YACF;QACF;IACF;IACAE,qBAAqBC,OAAO,CAACQ,SAAS,GAAG;QACvCC,OAAO;QACPL,QAAQ;YAAC;YAAW;SAAc;QAClCM,UAAU;QACVxC,SAAS;YACPyC,SAAS;YACTC,KAAK;QACP;IACF;IAEA,mEAAmE;IACnEvE,WACEM,MACA3B,kBAAkBoC,KAAK,mBACvB,CAACyD;QACC,IAAKA,cAAcC,IAAI,EAAUC,MAAM;YACpCF,cAAcC,IAAI,CAASC,IAAI,CAAC,cAAc,GAAG;QACpD;QACA,OAAOF;IACT;IAGF,4EAA4E;IAC5E,yEAAyE;IACzEzE,gDAAgDO,MAAM,KAAK,OAAO;QAChE;QACA;KACD;IAED,4EAA4E;IAC5E,4EAA4E;IAC5E,iEAAiE;IACjEoD,qBAAqBC,OAAO,CAACgB,MAAM,GAAG;QACpC,GAAGjB,qBAAqBC,OAAO,CAACgB,MAAM;QACtCP,OAAO;QACPL,QAAQ;YAAC;YAAW;SAAc;QAClClC,SAAS;YACP,GAAG6B,qBAAqBC,OAAO,CAACgB,MAAM,EAAE9C,OAAO;YAC/C+C,OAAO;QACT;QACAC,gBAAgB;YACd,GAAGnB,qBAAqBC,OAAO,CAACgB,MAAM,EAAEE,cAAc;YACtDC,KAAK;gBACHF,OAAO;YACT;YACA,aAAa;gBACXA,OAAO;YACT;QACF;IACF;IAEA,kFAAkF;IAClF,yCAAyC;IACzClB,qBAAqBC,OAAO,CAACoB,IAAI,GAAG;QAClC,GAAGrB,qBAAqBC,OAAO,CAACoB,IAAI;QACpCX,OAAO;QACPL,QAAQ;YAAC;YAAW;SAAc;QAClCc,gBAAgB;YACd,GAAGnB,qBAAqBC,OAAO,CAACoB,IAAI,EAAEF,cAAc;YACpDC,KAAK;gBACHA,KAAK;YACP;YACA,aAAa;gBACXE,UAAU;YACZ;QACF;IACF;IACA,2EAA2E;IAC3E,4EAA4E;IAC5ExF,kCAAkCkE,sBAAsB,QAAQ;IAEhEA,qBAAqBC,OAAO,GAAG7D,eAAe4D,qBAAqBC,OAAO;IAC1E5E,2BAA2BuB,MAAMO,oBAAoB6C;IAErDjE,qBAAqBa,MAAMO,oBAAoBX;IAE/C,yBAAyB;IACzBhB,gBAAgBoB,MAAM,KAAK,CAAC2E,WAAa;eAAIA;YAAU;SAAW;IAElE,2EAA2E;IAC3E,6EAA6E;IAC7E,4EAA4E;IAC5E,6EAA6E;IAC7E,wCAAwC;IACxC/F,gBAAgBoB,MAAMS,KAAK,CAACkE,WAAa;eACpCA;YACH;eACG7E,2BAA2B8E,MAAM,CAAC,CAACvD,IAAMA,MAAM;SACnD;IAED,MAAMvC,gCAAgCkB,MAAM;QAACJ;KAA0B;IAEvE,MAAMjB,6BAA6BqB;IAEnC,4EAA4E;IAC5E,4EAA4E;IAC5E,6EAA6E;IAC7E,qDAAqD;IACrDtB,4BAA4BsB,MAAMO;IAElC,OAAO,IACL1B,oBAAoBmB,MAAMC,OAAO4E,yBAAyB,EAAE;YAC1DC,WAAW;gBAAC;gBAAc;aAAS;QACrC;AACJ,EAAE;AACF,eAAelE,mBAAmB"}

package/src/py/rdb/__snapshots__/generator.spec.ts.snap

@@ -1813,7 +1813,11 @@ export interface AuroraDatabaseProps extends _AuroraDatabaseProps {
    * Whether to export Aurora engine logs to CloudWatch Logs.
    * See https://docs.aws.amazon.com/AmazonRDS/latest/AuroraUserGuide/USER_LogAccess.html
    *
-   * @default false
+   * PostgreSQL logs DDL statements only (log_statement=ddl); MySQL enables
+   * Advanced Auditing scoped to connections and DDL (server_audit_events=CONNECT,QUERY_DDL).
+   * Neither logs statement parameter values, to avoid leaking PII into log data.
+   *
+   * @default true
    */
   readonly enableCloudwatchLogs?: boolean;
 
@@ -1850,7 +1854,7 @@ export abstract class AuroraDatabase extends Construct {
       deletionProtection = true,
       removalPolicy = RemovalPolicy.RETAIN,
       enableKeyRotation = true,
-      enableCloudwatchLogs = false,
+      enableCloudwatchLogs = true,
       enablePerformanceInsights = true,
       engine,
       engineVersion,
@@ -1882,9 +1886,20 @@ export abstract class AuroraDatabase extends Construct {
       monitoringInterval: Duration.seconds(5),
       cloudwatchLogsExports: enableCloudwatchLogs
         ? engine.type === 'mysql'
-          ? ['audit', 'error', 'general', 'slowquery']
+          ? ['audit', 'error']
           : ['postgresql']
         : undefined,
+      parameters: enableCloudwatchLogs
+        ? engine.type === 'mysql'
+          ? {
+              server_audit_logging: '1',
+              server_audit_events: 'CONNECT,QUERY_DDL',
+            }
+          : // Only safe statement-at-a-time; a multi-statement batch mixing
+            // DDL with DML (e.g. one \`psql -c "a;b;c"\` call) logs the whole
+            // raw text verbatim, including any literal DML values.
+            { log_statement: 'ddl' }
+        : undefined,
       defaultDatabaseName: databaseName,
       storageEncrypted: true,
       storageEncryptionKey: key,

package/src/ts/rdb/__snapshots__/generator.spec.ts.snap

@@ -522,7 +522,11 @@ export interface AuroraDatabaseProps extends _AuroraDatabaseProps {
    * Whether to export Aurora engine logs to CloudWatch Logs.
    * See https://docs.aws.amazon.com/AmazonRDS/latest/AuroraUserGuide/USER_LogAccess.html
    *
-   * @default false
+   * PostgreSQL logs DDL statements only (log_statement=ddl); MySQL enables
+   * Advanced Auditing scoped to connections and DDL (server_audit_events=CONNECT,QUERY_DDL).
+   * Neither logs statement parameter values, to avoid leaking PII into log data.
+   *
+   * @default true
    */
   readonly enableCloudwatchLogs?: boolean;
 
@@ -559,7 +563,7 @@ export abstract class AuroraDatabase extends Construct {
       deletionProtection = true,
       removalPolicy = RemovalPolicy.RETAIN,
       enableKeyRotation = true,
-      enableCloudwatchLogs = false,
+      enableCloudwatchLogs = true,
       enablePerformanceInsights = true,
       engine,
       engineVersion,
@@ -591,9 +595,20 @@ export abstract class AuroraDatabase extends Construct {
       monitoringInterval: Duration.seconds(5),
       cloudwatchLogsExports: enableCloudwatchLogs
         ? engine.type === 'mysql'
-          ? ['audit', 'error', 'general', 'slowquery']
+          ? ['audit', 'error']
           : ['postgresql']
         : undefined,
+      parameters: enableCloudwatchLogs
+        ? engine.type === 'mysql'
+          ? {
+              server_audit_logging: '1',
+              server_audit_events: 'CONNECT,QUERY_DDL',
+            }
+          : // Only safe statement-at-a-time; a multi-statement batch mixing
+            // DDL with DML (e.g. one \`psql -c "a;b;c"\` call) logs the whole
+            // raw text verbatim, including any literal DML values.
+            { log_statement: 'ddl' }
+        : undefined,
       defaultDatabaseName: databaseName,
       storageEncrypted: true,
       storageEncryptionKey: key,
@@ -899,9 +914,9 @@ variable "enable_credential_rotation" {
 }
 
 variable "enable_cloudwatch_logs" {
-  description = "Whether to export Aurora engine logs to CloudWatch. PostgreSQL also enables verbose statement logging."
+  description = "Whether to export Aurora engine logs to CloudWatch. PostgreSQL logs DDL statements only (log_statement=ddl); MySQL enables Advanced Auditing scoped to connections and DDL (server_audit_events=CONNECT,QUERY_DDL). Neither logs statement parameter values, to avoid leaking PII into log data."
   type        = bool
-  default     = false
+  default     = true
 }
 
 variable "enable_performance_insights" {
@@ -956,11 +971,30 @@ resource "aws_rds_cluster_parameter_group" "database" {
   family      = local.parameter_group_family
   description = "Parameter group for \${var.name} Aurora cluster"
 
+  # Only safe statement-at-a-time; a multi-statement batch mixing DDL with
+  # DML (e.g. one \`psql -c "a;b;c"\` call) logs the whole raw text verbatim,
+  # including any literal DML values.
   dynamic "parameter" {
     for_each = var.engine == "aurora-postgresql" ? [1] : []
     content {
       name  = "log_statement"
-      value = "all"
+      value = "ddl"
+    }
+  }
+
+  dynamic "parameter" {
+    for_each = var.engine == "aurora-mysql" ? [1] : []
+    content {
+      name  = "server_audit_logging"
+      value = "1"
+    }
+  }
+
+  dynamic "parameter" {
+    for_each = var.engine == "aurora-mysql" ? [1] : []
+    content {
+      name  = "server_audit_events"
+      value = "CONNECT,QUERY_DDL"
     }
   }
 
@@ -1082,7 +1116,7 @@ resource "aws_secretsmanager_secret_version" "credentials" {
 }
 
 resource "aws_rds_cluster" "database" {
-  #checkov:skip=CKV2_AWS_27:Query logging can be enabled with enable_cloudwatch_logs; this module defaults to CDK-equivalent behavior unless logging is requested
+  #checkov:skip=CKV2_AWS_27:Query logging is enabled by default via enable_cloudwatch_logs; checkov cannot resolve the conditional count expression on aws_rds_cluster_parameter_group.database
   #checkov:skip=CKV_AWS_139:Deletion protection is enabled but checkov is unable to detect it correctly
   cluster_identifier                  = local.cluster_name
   engine                              = var.engine
@@ -1103,7 +1137,7 @@ resource "aws_rds_cluster" "database" {
   monitoring_interval                 = 5
   monitoring_role_arn                 = aws_iam_role.enhanced_monitoring.arn
   copy_tags_to_snapshot               = true
-  enabled_cloudwatch_logs_exports     = var.enable_cloudwatch_logs ? (var.engine == "aurora-mysql" ? ["audit", "error", "general", "slowquery"] : ["postgresql"]) : null
+  enabled_cloudwatch_logs_exports     = var.enable_cloudwatch_logs ? (var.engine == "aurora-mysql" ? ["audit", "error"] : ["postgresql"]) : null
 
   serverlessv2_scaling_configuration {
     min_capacity = var.serverless_min_capacity
@@ -2366,9 +2400,9 @@ variable "enable_credential_rotation" {
 }
 
 variable "enable_cloudwatch_logs" {
-  description = "Whether to export Aurora engine logs to CloudWatch. PostgreSQL also enables verbose statement logging."
+  description = "Whether to export Aurora engine logs to CloudWatch. PostgreSQL logs DDL statements only (log_statement=ddl); MySQL enables Advanced Auditing scoped to connections and DDL (server_audit_events=CONNECT,QUERY_DDL). Neither logs statement parameter values, to avoid leaking PII into log data."
   type        = bool
-  default     = false
+  default     = true
 }
 
 variable "enable_performance_insights" {
@@ -2423,11 +2457,30 @@ resource "aws_rds_cluster_parameter_group" "database" {
   family      = local.parameter_group_family
   description = "Parameter group for \${var.name} Aurora cluster"
 
+  # Only safe statement-at-a-time; a multi-statement batch mixing DDL with
+  # DML (e.g. one \`psql -c "a;b;c"\` call) logs the whole raw text verbatim,
+  # including any literal DML values.
   dynamic "parameter" {
     for_each = var.engine == "aurora-postgresql" ? [1] : []
     content {
       name  = "log_statement"
-      value = "all"
+      value = "ddl"
+    }
+  }
+
+  dynamic "parameter" {
+    for_each = var.engine == "aurora-mysql" ? [1] : []
+    content {
+      name  = "server_audit_logging"
+      value = "1"
+    }
+  }
+
+  dynamic "parameter" {
+    for_each = var.engine == "aurora-mysql" ? [1] : []
+    content {
+      name  = "server_audit_events"
+      value = "CONNECT,QUERY_DDL"
     }
   }
 
@@ -2549,7 +2602,7 @@ resource "aws_secretsmanager_secret_version" "credentials" {
 }
 
 resource "aws_rds_cluster" "database" {
-  #checkov:skip=CKV2_AWS_27:Query logging can be enabled with enable_cloudwatch_logs; this module defaults to CDK-equivalent behavior unless logging is requested
+  #checkov:skip=CKV2_AWS_27:Query logging is enabled by default via enable_cloudwatch_logs; checkov cannot resolve the conditional count expression on aws_rds_cluster_parameter_group.database
   #checkov:skip=CKV_AWS_139:Deletion protection is enabled but checkov is unable to detect it correctly
   cluster_identifier                  = local.cluster_name
   engine                              = var.engine
@@ -2570,7 +2623,7 @@ resource "aws_rds_cluster" "database" {
   monitoring_interval                 = 5
   monitoring_role_arn                 = aws_iam_role.enhanced_monitoring.arn
   copy_tags_to_snapshot               = true
-  enabled_cloudwatch_logs_exports     = var.enable_cloudwatch_logs ? (var.engine == "aurora-mysql" ? ["audit", "error", "general", "slowquery"] : ["postgresql"]) : null
+  enabled_cloudwatch_logs_exports     = var.enable_cloudwatch_logs ? (var.engine == "aurora-mysql" ? ["audit", "error"] : ["postgresql"]) : null
 
   serverlessv2_scaling_configuration {
     min_capacity = var.serverless_min_capacity
@@ -4259,7 +4312,11 @@ export interface AuroraDatabaseProps extends _AuroraDatabaseProps {
    * Whether to export Aurora engine logs to CloudWatch Logs.
    * See https://docs.aws.amazon.com/AmazonRDS/latest/AuroraUserGuide/USER_LogAccess.html
    *
-   * @default false
+   * PostgreSQL logs DDL statements only (log_statement=ddl); MySQL enables
+   * Advanced Auditing scoped to connections and DDL (server_audit_events=CONNECT,QUERY_DDL).
+   * Neither logs statement parameter values, to avoid leaking PII into log data.
+   *
+   * @default true
    */
   readonly enableCloudwatchLogs?: boolean;
 
@@ -4296,7 +4353,7 @@ export abstract class AuroraDatabase extends Construct {
       deletionProtection = true,
       removalPolicy = RemovalPolicy.RETAIN,
       enableKeyRotation = true,
-      enableCloudwatchLogs = false,
+      enableCloudwatchLogs = true,
       enablePerformanceInsights = true,
       engine,
       engineVersion,
@@ -4328,9 +4385,20 @@ export abstract class AuroraDatabase extends Construct {
       monitoringInterval: Duration.seconds(5),
       cloudwatchLogsExports: enableCloudwatchLogs
         ? engine.type === 'mysql'
-          ? ['audit', 'error', 'general', 'slowquery']
+          ? ['audit', 'error']
           : ['postgresql']
         : undefined,
+      parameters: enableCloudwatchLogs
+        ? engine.type === 'mysql'
+          ? {
+              server_audit_logging: '1',
+              server_audit_events: 'CONNECT,QUERY_DDL',
+            }
+          : // Only safe statement-at-a-time; a multi-statement batch mixing
+            // DDL with DML (e.g. one \`psql -c "a;b;c"\` call) logs the whole
+            // raw text verbatim, including any literal DML values.
+            { log_statement: 'ddl' }
+        : undefined,
       defaultDatabaseName: databaseName,
       storageEncrypted: true,
       storageEncryptionKey: key,

package/src/utils/format.d.ts

@@ -52,3 +52,9 @@ export declare const DEFAULT_BIOME_CONFIG: {
  * See https://github.com/nrwl/nx/blob/4cd640a9187954505d12de5b6d76a90d8ce4c2eb/packages/devkit/src/generators/format-files.ts#L11
  */
 export declare function formatFilesInSubtree(tree: Tree, dir?: string): Promise<void>;
+/**
+ * Derive ruff's `target-version` (eg `py314`) from a PEP 508
+ * `requires-python` specifier (eg `>=3.14`). Ruff targets the minimum
+ * supported version, so take the lowest `major.minor` mentioned.
+ */
+export declare const requiresPythonToRuffTarget: (requiresPython: unknown) => string | undefined;

package/src/utils/format.js

@@ -7,6 +7,7 @@ import { execFileSync, execSync } from "child_process";
 import { existsSync, readFileSync } from "fs";
 import { createRequire } from "module";
 import path from "path";
+import { uvxCommand } from "./py.js";
 import { readToml } from "./toml.js";
 const require = createRequire(import.meta.url);
 export const DEFAULT_BIOME_CONFIG = {
@@ -221,34 +222,32 @@ function getBiomeCommand(root) {
     }
 }
 /**
- * Find the ruff command. Tries 'uv run ruff', then 'uvx ruff'.
- * Matches how @nxlv/python runs ruff via the UV provider.
+ * Find the ruff command: `uvx --from ruff==<version> ruff`. uvx works
+ * regardless of workspace resolution state (unlike `uv run ruff`, which fails
+ * while installs are deferred), and the version pin matches the project's
+ * `format` target (PY_VERSIONS) so generation and check format identically.
+ * Only a successful probe is cached — ruff can become available mid-run in the
+ * long-lived Nx daemon, so a cached failure would skip formatting thereafter.
  */ let _ruffCommand;
 function getRuffCommand() {
-    if (_ruffCommand !== undefined) {
-        return _ruffCommand || undefined;
+    if (_ruffCommand) {
+        return _ruffCommand;
     }
-    for (const cmd of [
-        'uv run ruff',
-        'uvx ruff'
-    ]){
-        try {
-            execSync(`${cmd} --version`, {
-                encoding: 'utf-8',
-                stdio: [
-                    'pipe',
-                    'pipe',
-                    'pipe'
-                ]
-            });
-            _ruffCommand = cmd;
-            return cmd;
-        } catch  {
-        // Try next command
-        }
+    const cmd = uvxCommand('ruff');
+    try {
+        execSync(`${cmd} --version`, {
+            encoding: 'utf-8',
+            stdio: [
+                'pipe',
+                'pipe',
+                'pipe'
+            ]
+        });
+        _ruffCommand = cmd;
+        return cmd;
+    } catch  {
+        return undefined;
     }
-    _ruffCommand = '';
-    return undefined;
 }
 /**
  * Whether ruff would discover a config on disk for a file, by walking from its
@@ -277,6 +276,27 @@ function getRuffCommand() {
         dir = parent;
     }
 }
+/**
+ * Derive ruff's `target-version` (eg `py314`) from a PEP 508
+ * `requires-python` specifier (eg `>=3.14`). Ruff targets the minimum
+ * supported version, so take the lowest `major.minor` mentioned.
+ */ export const requiresPythonToRuffTarget = (requiresPython)=>{
+    if (typeof requiresPython !== 'string') {
+        return undefined;
+    }
+    let min;
+    for (const match of requiresPython.matchAll(/(\d+)\.(\d+)/g)){
+        const major = Number(match[1]);
+        const minor = Number(match[2]);
+        if (!min || major < min.major || major === min.major && minor < min.minor) {
+            min = {
+                major,
+                minor
+            };
+        }
+    }
+    return min ? `py${min.major}${min.minor}` : undefined;
+};
 /**
  * Map each Nx project with a `pyproject.toml` to the ruff settings the on-disk
  * build enforces for it: its top-level module names (from
@@ -293,11 +313,13 @@ function getRuffCommand() {
                 // all `known-first-party` keys off.
                 const modules = Array.isArray(wheelPackages) ? wheelPackages.filter((pkg)=>typeof pkg === 'string' && !!pkg).map((pkg)=>pkg.split('/')[0]) : [];
                 const lineLength = pyproject?.tool?.ruff?.['line-length'];
-                if (modules.length || typeof lineLength === 'number') {
+                const targetVersion = requiresPythonToRuffTarget(pyproject?.project?.['requires-python']);
+                if (modules.length || typeof lineLength === 'number' || targetVersion) {
                     configs.push({
                         root: project.root.split(path.sep).join('/'),
                         modules,
-                        lineLength: typeof lineLength === 'number' ? lineLength : undefined
+                        lineLength: typeof lineLength === 'number' ? lineLength : undefined,
+                        targetVersion
                     });
                 }
             } catch  {
@@ -351,6 +373,9 @@ function getRuffCommand() {
     if (typeof projectConfig?.lineLength === 'number') {
         configArgs.push(`line-length = ${projectConfig.lineLength}`);
     }
+    if (projectConfig?.targetVersion) {
+        configArgs.push(`target-version = "${projectConfig.targetVersion}"`);
+    }
     const config = configArgs.map((arg)=>` --config ${JSON.stringify(arg)}`).join('');
     // First apply lint fixes (import sorting, unused imports, etc.)
     try {

package/src/utils/format.js.map

@@ -1 +1 @@
-{"version":3,"sources":["../../../../../packages/nx-plugin/src/utils/format.ts"],"sourcesContent":["/**\n * Copyright Amazon.com, Inc. or its affiliates. All Rights Reserved.\n * SPDX-License-Identifier: Apache-2.0\n */\n\nimport { Biome } from '@biomejs/js-api/nodejs';\nimport { getProjects, type Tree } from '@nx/devkit';\nimport { execFileSync, execSync } from 'child_process';\nimport { existsSync, readFileSync } from 'fs';\nimport { createRequire } from 'module';\nimport path from 'path';\nimport { readToml } from './toml';\n\nconst require = createRequire(import.meta.url);\n\nexport const DEFAULT_BIOME_CONFIG = {\n  $schema: 'https://biomejs.dev/schemas/2.4.16/schema.json',\n  root: true,\n  formatter: {\n    enabled: true,\n    indentStyle: 'space',\n    indentWidth: 2,\n    lineWidth: 80,\n  },\n  javascript: {\n    formatter: {\n      quoteStyle: 'single',\n      trailingCommas: 'all',\n    },\n  },\n  css: {\n    formatter: {\n      quoteStyle: 'single',\n    },\n    linter: {\n      enabled: false,\n    },\n  },\n  linter: {\n    enabled: true,\n    rules: {\n      recommended: false,\n      correctness: {\n        noUndeclaredDependencies: 'warn',\n      },\n    },\n  },\n  assist: {\n    actions: {\n      source: {\n        organizeImports: 'on',\n      },\n    },\n  },\n  files: {\n    includes: [\n      '**',\n      '!**/dist',\n      '!**/out-tsc',\n      '!**/node_modules',\n      '!**/.nx',\n      '!**/.venv',\n      '!**/*.css',\n      '!**/*.gen.*',\n      '!**/generated/**',\n      '!**/tsconfig*.json',\n    ],\n  },\n};\n\nconst BIOME_FORMATTABLE_EXTENSIONS = new Set([\n  '.ts',\n  '.tsx',\n  '.js',\n  '.jsx',\n  '.mjs',\n  '.cjs',\n  '.mts',\n  '.cts',\n  '.json',\n  '.jsonc',\n  '.css',\n]);\n\n/** Matches `tsconfig.json` and variants like `tsconfig.lib.json`. */\nconst isTsConfig = (filePath: string): boolean =>\n  /(^|\\/)tsconfig[^/]*\\.json$/.test(filePath);\n\n/**\n * Format files in the given directory within the tree.\n * Handles both TypeScript/JavaScript/JSON (via biome) and Python (via ruff) files.\n * See https://github.com/nrwl/nx/blob/4cd640a9187954505d12de5b6d76a90d8ce4c2eb/packages/devkit/src/generators/format-files.ts#L11\n */\nexport async function formatFilesInSubtree(\n  tree: Tree,\n  dir?: string,\n): Promise<void> {\n  const changedFiles = tree\n    .listChanges()\n    .filter((file) => file.type !== 'DELETE')\n    .filter((file) => (dir ? file.path.startsWith(dir) : true));\n\n  const pyFiles = changedFiles.filter((file) => file.path.endsWith('.py'));\n  const otherFiles = changedFiles.filter(\n    (file) =>\n      BIOME_FORMATTABLE_EXTENSIONS.has(path.extname(file.path)) &&\n      // tsconfigs are not biome-managed: they're excluded from the vended\n      // format target (Nx's typescript-sync rewrites them without formatting),\n      // so formatting them at generation would only diverge from the form\n      // written on later runs. Leave them as updateJson/writeJson emit them so\n      // repeated generation stays idempotent.\n      !isTsConfig(file.path),\n  );\n\n  // Resolve each project's ruff settings (module names, line-length) so files\n  // are formatted to match the on-disk build (see getPythonProjectRuffConfigs).\n  const pythonProjectConfigs = pyFiles.length\n    ? getPythonProjectRuffConfigs(tree)\n    : [];\n\n  // Format Python files with ruff (lint fixes + formatting)\n  for (const file of pyFiles) {\n    try {\n      const content = ruffFixAndFormat(\n        file.content.toString('utf-8'),\n        file.path,\n        hasRuffConfigOnDisk(tree, file.path),\n        getOwningProjectRuffConfig(file.path, pythonProjectConfigs),\n      );\n      tree.write(file.path, content);\n    } catch {\n      // Silently skip ruff formatting failures\n    }\n  }\n\n  if (otherFiles.length === 0) return;\n\n  // Use the workspace's own Biome CLI (its version and config) when biome.json\n  // exists on disk; otherwise format via the bundled library API with the\n  // in-memory tree config. The CLI path does not see in-tree config changes.\n  if (existsSync(path.join(tree.root, 'biome.json'))) {\n    formatWithBiomeCli(tree, otherFiles);\n  } else {\n    formatWithBiomeApi(tree, otherFiles);\n  }\n}\n\n/**\n * Format files via the workspace's Biome CLI, run from the workspace root so it\n * discovers the on-disk biome.json.\n */\nfunction formatWithBiomeCli(\n  tree: Tree,\n  files: { path: string; content: Buffer | null }[],\n): void {\n  const biome = getBiomeCommand(tree.root);\n  if (!biome) {\n    // Fall back to the library API if the CLI cannot be resolved\n    formatWithBiomeApi(tree, files);\n    return;\n  }\n\n  for (const file of files) {\n    try {\n      const content = execFileSync(\n        biome.command,\n        [...biome.args, 'format', `--stdin-file-path=${file.path}`],\n        {\n          input: file.content?.toString('utf-8') ?? '',\n          encoding: 'utf-8',\n          cwd: tree.root,\n          stdio: ['pipe', 'pipe', 'pipe'],\n        },\n      );\n      tree.write(file.path, content);\n    } catch {\n      // Leave individual files that fail to format untouched\n    }\n  }\n}\n\n/**\n * Format files via the bundled Biome library API, applying the in-memory tree\n * config.\n */\nfunction formatWithBiomeApi(\n  tree: Tree,\n  files: { path: string; content: Buffer | null }[],\n): void {\n  try {\n    const biome = new Biome();\n    const { projectKey } = biome.openProject();\n    // Apply the workspace biome.json if it exists in the tree, otherwise the defaults.\n    const treeConfig = tree.read('biome.json', 'utf-8');\n    biome.applyConfiguration(\n      projectKey,\n      treeConfig ? JSON.parse(treeConfig) : DEFAULT_BIOME_CONFIG,\n    );\n\n    for (const file of files) {\n      try {\n        const { content } = biome.formatContent(\n          projectKey,\n          file.content?.toString('utf-8') ?? '',\n          { filePath: file.path },\n        );\n        tree.write(file.path, content);\n      } catch {\n        // Leave individual files that fail to format untouched\n      }\n    }\n  } catch {\n    // Silently skip formatting failures\n  }\n}\n\ninterface BiomeCommand {\n  command: string;\n  args: string[];\n}\n\n/**\n * Resolve the `@biomejs/biome` CLI from the user's workspace, falling back to a\n * `biome` binary on the PATH.\n */\nconst _biomeCommands = new Map<string, BiomeCommand | null>();\nfunction getBiomeCommand(root: string): BiomeCommand | undefined {\n  if (_biomeCommands.has(root)) {\n    return _biomeCommands.get(root) ?? undefined;\n  }\n\n  // Run via node for cross-platform execution of the bin shim.\n  try {\n    const pkgJsonPath = require.resolve('@biomejs/biome/package.json', {\n      paths: [root, import.meta.dirname],\n    });\n    const pkgJson = JSON.parse(readFileSync(pkgJsonPath, 'utf-8'));\n    const binRelative =\n      typeof pkgJson.bin === 'string' ? pkgJson.bin : pkgJson.bin?.biome;\n    if (binRelative) {\n      const binPath = path.join(path.dirname(pkgJsonPath), binRelative);\n      const command = { command: process.execPath, args: [binPath] };\n      _biomeCommands.set(root, command);\n      return command;\n    }\n  } catch {\n    // Fall back to a biome binary on the PATH\n  }\n\n  try {\n    execSync('biome --version', {\n      encoding: 'utf-8',\n      stdio: ['pipe', 'pipe', 'pipe'],\n    });\n    const command = { command: 'biome', args: [] };\n    _biomeCommands.set(root, command);\n    return command;\n  } catch {\n    _biomeCommands.set(root, null);\n    return undefined;\n  }\n}\n\n/**\n * Find the ruff command. Tries 'uv run ruff', then 'uvx ruff'.\n * Matches how @nxlv/python runs ruff via the UV provider.\n */\nlet _ruffCommand: string | undefined;\nfunction getRuffCommand(): string | undefined {\n  if (_ruffCommand !== undefined) {\n    return _ruffCommand || undefined;\n  }\n  for (const cmd of ['uv run ruff', 'uvx ruff']) {\n    try {\n      execSync(`${cmd} --version`, {\n        encoding: 'utf-8',\n        stdio: ['pipe', 'pipe', 'pipe'],\n      });\n      _ruffCommand = cmd;\n      return cmd;\n    } catch {\n      // Try next command\n    }\n  }\n  _ruffCommand = '';\n  return undefined;\n}\n\n/**\n * Whether ruff would discover a config on disk for a file, by walking from its\n * directory up to the workspace root looking for `.ruff.toml`, `ruff.toml`, or a\n * `pyproject.toml` with a `[tool.ruff]` section — the same files ruff itself\n * resolves. The walk stops at `tree.root` so a stray config in a parent of the\n * workspace (or the home directory) is never treated as the project's. Used to\n * decide whether to nudge ruff towards import sorting (see\n * {@link ruffFixAndFormat}).\n */\nfunction hasRuffConfigOnDisk(tree: Tree, filePath: string): boolean {\n  const root = path.resolve(tree.root);\n  let dir = path.resolve(root, path.dirname(filePath));\n  while (true) {\n    if (\n      existsSync(path.join(dir, '.ruff.toml')) ||\n      existsSync(path.join(dir, 'ruff.toml'))\n    ) {\n      return true;\n    }\n    const pyproject = path.join(dir, 'pyproject.toml');\n    if (\n      existsSync(pyproject) &&\n      readFileSync(pyproject, 'utf-8').includes('[tool.ruff')\n    ) {\n      return true;\n    }\n    const parent = path.dirname(dir);\n    // Stop once the workspace root has been checked (or we hit the FS root).\n    if (dir === root || parent === dir) {\n      return false;\n    }\n    dir = parent;\n  }\n}\n\ninterface PythonProjectRuffConfig {\n  /** Project root, normalised to use forward slashes. */\n  readonly root: string;\n  /** Top-level importable module names declared by the project. */\n  readonly modules: string[];\n  /** The project's `[tool.ruff].line-length`, if set. */\n  readonly lineLength?: number;\n}\n\n/**\n * Map each Nx project with a `pyproject.toml` to the ruff settings the on-disk\n * build enforces for it: its top-level module names (from\n * `[tool.hatch.build.targets.wheel].packages`) and its `[tool.ruff].line-length`.\n */\nfunction getPythonProjectRuffConfigs(tree: Tree): PythonProjectRuffConfig[] {\n  const configs: PythonProjectRuffConfig[] = [];\n\n  for (const project of getProjects(tree).values()) {\n    const pyprojectPath = path.join(project.root, 'pyproject.toml');\n    if (tree.exists(pyprojectPath)) {\n      try {\n        const pyproject = readToml(tree, pyprojectPath) as any;\n        const wheelPackages: unknown =\n          pyproject?.tool?.hatch?.build?.targets?.wheel?.packages;\n        // Record the top-level module segment (`pkg/sub` -> `pkg`), which is\n        // all `known-first-party` keys off.\n        const modules = Array.isArray(wheelPackages)\n          ? wheelPackages\n              .filter((pkg): pkg is string => typeof pkg === 'string' && !!pkg)\n              .map((pkg) => pkg.split('/')[0])\n          : [];\n        const lineLength: unknown = pyproject?.tool?.ruff?.['line-length'];\n        if (modules.length || typeof lineLength === 'number') {\n          configs.push({\n            root: project.root.split(path.sep).join('/'),\n            modules,\n            lineLength: typeof lineLength === 'number' ? lineLength : undefined,\n          });\n        }\n      } catch {\n        // Skip projects whose pyproject.toml cannot be parsed\n      }\n    }\n  }\n\n  return configs;\n}\n\n/**\n * Resolve the ruff config for the project that owns a file (the project with\n * the longest root that is a prefix of the file path). Ruff runs per-project on\n * disk, so a file's settings come from its own project — only its own module is\n * first-party (sibling workspace packages are third-party) and its own\n * line-length applies — and scoping this way keeps in-tree formatting\n * consistent with the on-disk build.\n */\nfunction getOwningProjectRuffConfig(\n  filePath: string,\n  configs: PythonProjectRuffConfig[],\n): PythonProjectRuffConfig | undefined {\n  let owner: PythonProjectRuffConfig | undefined;\n  for (const config of configs) {\n    if (\n      (filePath === config.root || filePath.startsWith(`${config.root}/`)) &&\n      (!owner || config.root.length > owner.root.length)\n    ) {\n      owner = config;\n    }\n  }\n  return owner;\n}\n\n/**\n * Run ruff check --fix and ruff format on Python file content via stdin.\n * Applies all configured lint fixes (including import sorting) and formatting.\n *\n * When no ruff config exists on disk (`hasConfig` false) ruff falls back to its\n * defaults, which omit isort — but generated projects enable rule `I` and their\n * build fails on unsorted imports (I001). In that case we add `--extend-select\n * I` so import sorting matches what the build enforces. When a config does\n * exist we defer to it entirely, honouring the user's rule selection.\n *\n * `projectConfig` carries the owning project's ruff settings, which ruff cannot\n * detect from the filesystem during generation because the project lives only\n * in the tree. We pass them via `--config` so in-tree formatting matches the\n * on-disk build: `known-first-party` (the project's own modules) keeps its\n * imports in their own group, and `line-length` keeps wrapping consistent (the\n * generated config raises it above ruff's default of 88). These are additive to\n * any on-disk config, so they are safe to pass regardless of `hasConfig`.\n */\nfunction ruffFixAndFormat(\n  content: string,\n  filePath: string,\n  hasConfig: boolean,\n  projectConfig?: PythonProjectRuffConfig,\n): string {\n  const ruff = getRuffCommand();\n  if (!ruff) return content;\n\n  const extendSelect = hasConfig ? '' : ' --extend-select I';\n  const configArgs: string[] = [];\n  if (projectConfig?.modules.length) {\n    configArgs.push(\n      `lint.isort.known-first-party = ${JSON.stringify(projectConfig.modules)}`,\n    );\n  }\n  if (typeof projectConfig?.lineLength === 'number') {\n    configArgs.push(`line-length = ${projectConfig.lineLength}`);\n  }\n  const config = configArgs\n    .map((arg) => ` --config ${JSON.stringify(arg)}`)\n    .join('');\n\n  // First apply lint fixes (import sorting, unused imports, etc.)\n  try {\n    const result = execSync(\n      `${ruff} check --fix${extendSelect}${config} --stdin-filename ${filePath} -`,\n      { input: content, encoding: 'utf-8', stdio: ['pipe', 'pipe', 'pipe'] },\n    );\n    content = result;\n  } catch (e: any) {\n    // ruff check exits non-zero when it finds unfixable issues,\n    // but stdout still contains the fixed content\n    if (e.stdout) {\n      content = e.stdout;\n    }\n  }\n\n  // Then apply formatting\n  try {\n    content = execSync(\n      `${ruff} format${config} --stdin-filename ${filePath} -`,\n      {\n        input: content,\n        encoding: 'utf-8',\n        stdio: ['pipe', 'pipe', 'pipe'],\n      },\n    );\n  } catch {\n    // Fall through with whatever content we have\n  }\n\n  return content;\n}\n"],"names":["Biome","getProjects","execFileSync","execSync","existsSync","readFileSync","createRequire","path","readToml","require","url","DEFAULT_BIOME_CONFIG","$schema","root","formatter","enabled","indentStyle","indentWidth","lineWidth","javascript","quoteStyle","trailingCommas","css","linter","rules","recommended","correctness","noUndeclaredDependencies","assist","actions","source","organizeImports","files","includes","BIOME_FORMATTABLE_EXTENSIONS","Set","isTsConfig","filePath","test","formatFilesInSubtree","tree","dir","changedFiles","listChanges","filter","file","type","startsWith","pyFiles","endsWith","otherFiles","has","extname","pythonProjectConfigs","length","getPythonProjectRuffConfigs","content","ruffFixAndFormat","toString","hasRuffConfigOnDisk","getOwningProjectRuffConfig","write","join","formatWithBiomeCli","formatWithBiomeApi","biome","getBiomeCommand","command","args","input","encoding","cwd","stdio","projectKey","openProject","treeConfig","read","applyConfiguration","JSON","parse","formatContent","_biomeCommands","Map","get","undefined","pkgJsonPath","resolve","paths","dirname","pkgJson","binRelative","bin","binPath","process","execPath","set","_ruffCommand","getRuffCommand","cmd","pyproject","parent","configs","project","values","pyprojectPath","exists","wheelPackages","tool","hatch","build","targets","wheel","packages","modules","Array","isArray","pkg","map","split","lineLength","ruff","push","sep","owner","config","hasConfig","projectConfig","extendSelect","configArgs","stringify","arg","result","e","stdout"],"mappings":"AAAA;;;CAGC,GAED,SAASA,KAAK,QAAQ,yBAAyB;AAC/C,SAASC,WAAW,QAAmB,aAAa;AACpD,SAASC,YAAY,EAAEC,QAAQ,QAAQ,gBAAgB;AACvD,SAASC,UAAU,EAAEC,YAAY,QAAQ,KAAK;AAC9C,SAASC,aAAa,QAAQ,SAAS;AACvC,OAAOC,UAAU,OAAO;AACxB,SAASC,QAAQ,QAAQ,YAAS;AAElC,MAAMC,UAAUH,cAAc,YAAYI,GAAG;AAE7C,OAAO,MAAMC,uBAAuB;IAClCC,SAAS;IACTC,MAAM;IACNC,WAAW;QACTC,SAAS;QACTC,aAAa;QACbC,aAAa;QACbC,WAAW;IACb;IACAC,YAAY;QACVL,WAAW;YACTM,YAAY;YACZC,gBAAgB;QAClB;IACF;IACAC,KAAK;QACHR,WAAW;YACTM,YAAY;QACd;QACAG,QAAQ;YACNR,SAAS;QACX;IACF;IACAQ,QAAQ;QACNR,SAAS;QACTS,OAAO;YACLC,aAAa;YACbC,aAAa;gBACXC,0BAA0B;YAC5B;QACF;IACF;IACAC,QAAQ;QACNC,SAAS;YACPC,QAAQ;gBACNC,iBAAiB;YACnB;QACF;IACF;IACAC,OAAO;QACLC,UAAU;YACR;YACA;YACA;YACA;YACA;YACA;YACA;YACA;YACA;YACA;SACD;IACH;AACF,EAAE;AAEF,MAAMC,+BAA+B,IAAIC,IAAI;IAC3C;IACA;IACA;IACA;IACA;IACA;IACA;IACA;IACA;IACA;IACA;CACD;AAED,mEAAmE,GACnE,MAAMC,aAAa,CAACC,WAClB,6BAA6BC,IAAI,CAACD;AAEpC;;;;CAIC,GACD,OAAO,eAAeE,qBACpBC,IAAU,EACVC,GAAY;IAEZ,MAAMC,eAAeF,KAClBG,WAAW,GACXC,MAAM,CAAC,CAACC,OAASA,KAAKC,IAAI,KAAK,UAC/BF,MAAM,CAAC,CAACC,OAAUJ,MAAMI,KAAKtC,IAAI,CAACwC,UAAU,CAACN,OAAO;IAEvD,MAAMO,UAAUN,aAAaE,MAAM,CAAC,CAACC,OAASA,KAAKtC,IAAI,CAAC0C,QAAQ,CAAC;IACjE,MAAMC,aAAaR,aAAaE,MAAM,CACpC,CAACC,OACCX,6BAA6BiB,GAAG,CAAC5C,KAAK6C,OAAO,CAACP,KAAKtC,IAAI,MACvD,oEAAoE;QACpE,yEAAyE;QACzE,oEAAoE;QACpE,yEAAyE;QACzE,wCAAwC;QACxC,CAAC6B,WAAWS,KAAKtC,IAAI;IAGzB,4EAA4E;IAC5E,8EAA8E;IAC9E,MAAM8C,uBAAuBL,QAAQM,MAAM,GACvCC,4BAA4Bf,QAC5B,EAAE;IAEN,0DAA0D;IAC1D,KAAK,MAAMK,QAAQG,QAAS;QAC1B,IAAI;YACF,MAAMQ,UAAUC,iBACdZ,KAAKW,OAAO,CAACE,QAAQ,CAAC,UACtBb,KAAKtC,IAAI,EACToD,oBAAoBnB,MAAMK,KAAKtC,IAAI,GACnCqD,2BAA2Bf,KAAKtC,IAAI,EAAE8C;YAExCb,KAAKqB,KAAK,CAAChB,KAAKtC,IAAI,EAAEiD;QACxB,EAAE,OAAM;QACN,yCAAyC;QAC3C;IACF;IAEA,IAAIN,WAAWI,MAAM,KAAK,GAAG;IAE7B,6EAA6E;IAC7E,wEAAwE;IACxE,2EAA2E;IAC3E,IAAIlD,WAAWG,KAAKuD,IAAI,CAACtB,KAAK3B,IAAI,EAAE,gBAAgB;QAClDkD,mBAAmBvB,MAAMU;IAC3B,OAAO;QACLc,mBAAmBxB,MAAMU;IAC3B;AACF;AAEA;;;CAGC,GACD,SAASa,mBACPvB,IAAU,EACVR,KAAiD;IAEjD,MAAMiC,QAAQC,gBAAgB1B,KAAK3B,IAAI;IACvC,IAAI,CAACoD,OAAO;QACV,6DAA6D;QAC7DD,mBAAmBxB,MAAMR;QACzB;IACF;IAEA,KAAK,MAAMa,QAAQb,MAAO;QACxB,IAAI;YACF,MAAMwB,UAAUtD,aACd+D,MAAME,OAAO,EACb;mBAAIF,MAAMG,IAAI;gBAAE;gBAAU,CAAC,kBAAkB,EAAEvB,KAAKtC,IAAI,EAAE;aAAC,EAC3D;gBACE8D,OAAOxB,KAAKW,OAAO,EAAEE,SAAS,YAAY;gBAC1CY,UAAU;gBACVC,KAAK/B,KAAK3B,IAAI;gBACd2D,OAAO;oBAAC;oBAAQ;oBAAQ;iBAAO;YACjC;YAEFhC,KAAKqB,KAAK,CAAChB,KAAKtC,IAAI,EAAEiD;QACxB,EAAE,OAAM;QACN,uDAAuD;QACzD;IACF;AACF;AAEA;;;CAGC,GACD,SAASQ,mBACPxB,IAAU,EACVR,KAAiD;IAEjD,IAAI;QACF,MAAMiC,QAAQ,IAAIjE;QAClB,MAAM,EAAEyE,UAAU,EAAE,GAAGR,MAAMS,WAAW;QACxC,mFAAmF;QACnF,MAAMC,aAAanC,KAAKoC,IAAI,CAAC,cAAc;QAC3CX,MAAMY,kBAAkB,CACtBJ,YACAE,aAAaG,KAAKC,KAAK,CAACJ,cAAchE;QAGxC,KAAK,MAAMkC,QAAQb,MAAO;YACxB,IAAI;gBACF,MAAM,EAAEwB,OAAO,EAAE,GAAGS,MAAMe,aAAa,CACrCP,YACA5B,KAAKW,OAAO,EAAEE,SAAS,YAAY,IACnC;oBAAErB,UAAUQ,KAAKtC,IAAI;gBAAC;gBAExBiC,KAAKqB,KAAK,CAAChB,KAAKtC,IAAI,EAAEiD;YACxB,EAAE,OAAM;YACN,uDAAuD;YACzD;QACF;IACF,EAAE,OAAM;IACN,oCAAoC;IACtC;AACF;AAOA;;;CAGC,GACD,MAAMyB,iBAAiB,IAAIC;AAC3B,SAAShB,gBAAgBrD,IAAY;IACnC,IAAIoE,eAAe9B,GAAG,CAACtC,OAAO;QAC5B,OAAOoE,eAAeE,GAAG,CAACtE,SAASuE;IACrC;IAEA,6DAA6D;IAC7D,IAAI;QACF,MAAMC,cAAc5E,QAAQ6E,OAAO,CAAC,+BAA+B;YACjEC,OAAO;gBAAC1E;gBAAM,YAAY2E,OAAO;aAAC;QACpC;QACA,MAAMC,UAAUX,KAAKC,KAAK,CAAC1E,aAAagF,aAAa;QACrD,MAAMK,cACJ,OAAOD,QAAQE,GAAG,KAAK,WAAWF,QAAQE,GAAG,GAAGF,QAAQE,GAAG,EAAE1B;QAC/D,IAAIyB,aAAa;YACf,MAAME,UAAUrF,KAAKuD,IAAI,CAACvD,KAAKiF,OAAO,CAACH,cAAcK;YACrD,MAAMvB,UAAU;gBAAEA,SAAS0B,QAAQC,QAAQ;gBAAE1B,MAAM;oBAACwB;iBAAQ;YAAC;YAC7DX,eAAec,GAAG,CAAClF,MAAMsD;YACzB,OAAOA;QACT;IACF,EAAE,OAAM;IACN,0CAA0C;IAC5C;IAEA,IAAI;QACFhE,SAAS,mBAAmB;YAC1BmE,UAAU;YACVE,OAAO;gBAAC;gBAAQ;gBAAQ;aAAO;QACjC;QACA,MAAML,UAAU;YAAEA,SAAS;YAASC,MAAM,EAAE;QAAC;QAC7Ca,eAAec,GAAG,CAAClF,MAAMsD;QACzB,OAAOA;IACT,EAAE,OAAM;QACNc,eAAec,GAAG,CAAClF,MAAM;QACzB,OAAOuE;IACT;AACF;AAEA;;;CAGC,GACD,IAAIY;AACJ,SAASC;IACP,IAAID,iBAAiBZ,WAAW;QAC9B,OAAOY,gBAAgBZ;IACzB;IACA,KAAK,MAAMc,OAAO;QAAC;QAAe;KAAW,CAAE;QAC7C,IAAI;YACF/F,SAAS,GAAG+F,IAAI,UAAU,CAAC,EAAE;gBAC3B5B,UAAU;gBACVE,OAAO;oBAAC;oBAAQ;oBAAQ;iBAAO;YACjC;YACAwB,eAAeE;YACf,OAAOA;QACT,EAAE,OAAM;QACN,mBAAmB;QACrB;IACF;IACAF,eAAe;IACf,OAAOZ;AACT;AAEA;;;;;;;;CAQC,GACD,SAASzB,oBAAoBnB,IAAU,EAAEH,QAAgB;IACvD,MAAMxB,OAAON,KAAK+E,OAAO,CAAC9C,KAAK3B,IAAI;IACnC,IAAI4B,MAAMlC,KAAK+E,OAAO,CAACzE,MAAMN,KAAKiF,OAAO,CAACnD;IAC1C,MAAO,KAAM;QACX,IACEjC,WAAWG,KAAKuD,IAAI,CAACrB,KAAK,kBAC1BrC,WAAWG,KAAKuD,IAAI,CAACrB,KAAK,eAC1B;YACA,OAAO;QACT;QACA,MAAM0D,YAAY5F,KAAKuD,IAAI,CAACrB,KAAK;QACjC,IACErC,WAAW+F,cACX9F,aAAa8F,WAAW,SAASlE,QAAQ,CAAC,eAC1C;YACA,OAAO;QACT;QACA,MAAMmE,SAAS7F,KAAKiF,OAAO,CAAC/C;QAC5B,yEAAyE;QACzE,IAAIA,QAAQ5B,QAAQuF,WAAW3D,KAAK;YAClC,OAAO;QACT;QACAA,MAAM2D;IACR;AACF;AAWA;;;;CAIC,GACD,SAAS7C,4BAA4Bf,IAAU;IAC7C,MAAM6D,UAAqC,EAAE;IAE7C,KAAK,MAAMC,WAAWrG,YAAYuC,MAAM+D,MAAM,GAAI;QAChD,MAAMC,gBAAgBjG,KAAKuD,IAAI,CAACwC,QAAQzF,IAAI,EAAE;QAC9C,IAAI2B,KAAKiE,MAAM,CAACD,gBAAgB;YAC9B,IAAI;gBACF,MAAML,YAAY3F,SAASgC,MAAMgE;gBACjC,MAAME,gBACJP,WAAWQ,MAAMC,OAAOC,OAAOC,SAASC,OAAOC;gBACjD,qEAAqE;gBACrE,oCAAoC;gBACpC,MAAMC,UAAUC,MAAMC,OAAO,CAACT,iBAC1BA,cACG9D,MAAM,CAAC,CAACwE,MAAuB,OAAOA,QAAQ,YAAY,CAAC,CAACA,KAC5DC,GAAG,CAAC,CAACD,MAAQA,IAAIE,KAAK,CAAC,IAAI,CAAC,EAAE,IACjC,EAAE;gBACN,MAAMC,aAAsBpB,WAAWQ,MAAMa,MAAM,CAAC,cAAc;gBAClE,IAAIP,QAAQ3D,MAAM,IAAI,OAAOiE,eAAe,UAAU;oBACpDlB,QAAQoB,IAAI,CAAC;wBACX5G,MAAMyF,QAAQzF,IAAI,CAACyG,KAAK,CAAC/G,KAAKmH,GAAG,EAAE5D,IAAI,CAAC;wBACxCmD;wBACAM,YAAY,OAAOA,eAAe,WAAWA,aAAanC;oBAC5D;gBACF;YACF,EAAE,OAAM;YACN,sDAAsD;YACxD;QACF;IACF;IAEA,OAAOiB;AACT;AAEA;;;;;;;CAOC,GACD,SAASzC,2BACPvB,QAAgB,EAChBgE,OAAkC;IAElC,IAAIsB;IACJ,KAAK,MAAMC,UAAUvB,QAAS;QAC5B,IACE,AAAChE,CAAAA,aAAauF,OAAO/G,IAAI,IAAIwB,SAASU,UAAU,CAAC,GAAG6E,OAAO/G,IAAI,CAAC,CAAC,CAAC,CAAA,KACjE,CAAA,CAAC8G,SAASC,OAAO/G,IAAI,CAACyC,MAAM,GAAGqE,MAAM9G,IAAI,CAACyC,MAAM,AAAD,GAChD;YACAqE,QAAQC;QACV;IACF;IACA,OAAOD;AACT;AAEA;;;;;;;;;;;;;;;;;CAiBC,GACD,SAASlE,iBACPD,OAAe,EACfnB,QAAgB,EAChBwF,SAAkB,EAClBC,aAAuC;IAEvC,MAAMN,OAAOvB;IACb,IAAI,CAACuB,MAAM,OAAOhE;IAElB,MAAMuE,eAAeF,YAAY,KAAK;IACtC,MAAMG,aAAuB,EAAE;IAC/B,IAAIF,eAAeb,QAAQ3D,QAAQ;QACjC0E,WAAWP,IAAI,CACb,CAAC,+BAA+B,EAAE3C,KAAKmD,SAAS,CAACH,cAAcb,OAAO,GAAG;IAE7E;IACA,IAAI,OAAOa,eAAeP,eAAe,UAAU;QACjDS,WAAWP,IAAI,CAAC,CAAC,cAAc,EAAEK,cAAcP,UAAU,EAAE;IAC7D;IACA,MAAMK,SAASI,WACZX,GAAG,CAAC,CAACa,MAAQ,CAAC,UAAU,EAAEpD,KAAKmD,SAAS,CAACC,MAAM,EAC/CpE,IAAI,CAAC;IAER,gEAAgE;IAChE,IAAI;QACF,MAAMqE,SAAShI,SACb,GAAGqH,KAAK,YAAY,EAAEO,eAAeH,OAAO,kBAAkB,EAAEvF,SAAS,EAAE,CAAC,EAC5E;YAAEgC,OAAOb;YAASc,UAAU;YAASE,OAAO;gBAAC;gBAAQ;gBAAQ;aAAO;QAAC;QAEvEhB,UAAU2E;IACZ,EAAE,OAAOC,GAAQ;QACf,4DAA4D;QAC5D,8CAA8C;QAC9C,IAAIA,EAAEC,MAAM,EAAE;YACZ7E,UAAU4E,EAAEC,MAAM;QACpB;IACF;IAEA,wBAAwB;IACxB,IAAI;QACF7E,UAAUrD,SACR,GAAGqH,KAAK,OAAO,EAAEI,OAAO,kBAAkB,EAAEvF,SAAS,EAAE,CAAC,EACxD;YACEgC,OAAOb;YACPc,UAAU;YACVE,OAAO;gBAAC;gBAAQ;gBAAQ;aAAO;QACjC;IAEJ,EAAE,OAAM;IACN,6CAA6C;IAC/C;IAEA,OAAOhB;AACT"}
+{"version":3,"sources":["../../../../../packages/nx-plugin/src/utils/format.ts"],"sourcesContent":["/**\n * Copyright Amazon.com, Inc. or its affiliates. All Rights Reserved.\n * SPDX-License-Identifier: Apache-2.0\n */\n\nimport { Biome } from '@biomejs/js-api/nodejs';\nimport { getProjects, type Tree } from '@nx/devkit';\nimport { execFileSync, execSync } from 'child_process';\nimport { existsSync, readFileSync } from 'fs';\nimport { createRequire } from 'module';\nimport path from 'path';\nimport { uvxCommand } from './py';\nimport { readToml } from './toml';\n\nconst require = createRequire(import.meta.url);\n\nexport const DEFAULT_BIOME_CONFIG = {\n  $schema: 'https://biomejs.dev/schemas/2.4.16/schema.json',\n  root: true,\n  formatter: {\n    enabled: true,\n    indentStyle: 'space',\n    indentWidth: 2,\n    lineWidth: 80,\n  },\n  javascript: {\n    formatter: {\n      quoteStyle: 'single',\n      trailingCommas: 'all',\n    },\n  },\n  css: {\n    formatter: {\n      quoteStyle: 'single',\n    },\n    linter: {\n      enabled: false,\n    },\n  },\n  linter: {\n    enabled: true,\n    rules: {\n      recommended: false,\n      correctness: {\n        noUndeclaredDependencies: 'warn',\n      },\n    },\n  },\n  assist: {\n    actions: {\n      source: {\n        organizeImports: 'on',\n      },\n    },\n  },\n  files: {\n    includes: [\n      '**',\n      '!**/dist',\n      '!**/out-tsc',\n      '!**/node_modules',\n      '!**/.nx',\n      '!**/.venv',\n      '!**/*.css',\n      '!**/*.gen.*',\n      '!**/generated/**',\n      '!**/tsconfig*.json',\n    ],\n  },\n};\n\nconst BIOME_FORMATTABLE_EXTENSIONS = new Set([\n  '.ts',\n  '.tsx',\n  '.js',\n  '.jsx',\n  '.mjs',\n  '.cjs',\n  '.mts',\n  '.cts',\n  '.json',\n  '.jsonc',\n  '.css',\n]);\n\n/** Matches `tsconfig.json` and variants like `tsconfig.lib.json`. */\nconst isTsConfig = (filePath: string): boolean =>\n  /(^|\\/)tsconfig[^/]*\\.json$/.test(filePath);\n\n/**\n * Format files in the given directory within the tree.\n * Handles both TypeScript/JavaScript/JSON (via biome) and Python (via ruff) files.\n * See https://github.com/nrwl/nx/blob/4cd640a9187954505d12de5b6d76a90d8ce4c2eb/packages/devkit/src/generators/format-files.ts#L11\n */\nexport async function formatFilesInSubtree(\n  tree: Tree,\n  dir?: string,\n): Promise<void> {\n  const changedFiles = tree\n    .listChanges()\n    .filter((file) => file.type !== 'DELETE')\n    .filter((file) => (dir ? file.path.startsWith(dir) : true));\n\n  const pyFiles = changedFiles.filter((file) => file.path.endsWith('.py'));\n  const otherFiles = changedFiles.filter(\n    (file) =>\n      BIOME_FORMATTABLE_EXTENSIONS.has(path.extname(file.path)) &&\n      // tsconfigs are not biome-managed: they're excluded from the vended\n      // format target (Nx's typescript-sync rewrites them without formatting),\n      // so formatting them at generation would only diverge from the form\n      // written on later runs. Leave them as updateJson/writeJson emit them so\n      // repeated generation stays idempotent.\n      !isTsConfig(file.path),\n  );\n\n  // Resolve each project's ruff settings (module names, line-length) so files\n  // are formatted to match the on-disk build (see getPythonProjectRuffConfigs).\n  const pythonProjectConfigs = pyFiles.length\n    ? getPythonProjectRuffConfigs(tree)\n    : [];\n\n  // Format Python files with ruff (lint fixes + formatting)\n  for (const file of pyFiles) {\n    try {\n      const content = ruffFixAndFormat(\n        file.content.toString('utf-8'),\n        file.path,\n        hasRuffConfigOnDisk(tree, file.path),\n        getOwningProjectRuffConfig(file.path, pythonProjectConfigs),\n      );\n      tree.write(file.path, content);\n    } catch {\n      // Silently skip ruff formatting failures\n    }\n  }\n\n  if (otherFiles.length === 0) return;\n\n  // Use the workspace's own Biome CLI (its version and config) when biome.json\n  // exists on disk; otherwise format via the bundled library API with the\n  // in-memory tree config. The CLI path does not see in-tree config changes.\n  if (existsSync(path.join(tree.root, 'biome.json'))) {\n    formatWithBiomeCli(tree, otherFiles);\n  } else {\n    formatWithBiomeApi(tree, otherFiles);\n  }\n}\n\n/**\n * Format files via the workspace's Biome CLI, run from the workspace root so it\n * discovers the on-disk biome.json.\n */\nfunction formatWithBiomeCli(\n  tree: Tree,\n  files: { path: string; content: Buffer | null }[],\n): void {\n  const biome = getBiomeCommand(tree.root);\n  if (!biome) {\n    // Fall back to the library API if the CLI cannot be resolved\n    formatWithBiomeApi(tree, files);\n    return;\n  }\n\n  for (const file of files) {\n    try {\n      const content = execFileSync(\n        biome.command,\n        [...biome.args, 'format', `--stdin-file-path=${file.path}`],\n        {\n          input: file.content?.toString('utf-8') ?? '',\n          encoding: 'utf-8',\n          cwd: tree.root,\n          stdio: ['pipe', 'pipe', 'pipe'],\n        },\n      );\n      tree.write(file.path, content);\n    } catch {\n      // Leave individual files that fail to format untouched\n    }\n  }\n}\n\n/**\n * Format files via the bundled Biome library API, applying the in-memory tree\n * config.\n */\nfunction formatWithBiomeApi(\n  tree: Tree,\n  files: { path: string; content: Buffer | null }[],\n): void {\n  try {\n    const biome = new Biome();\n    const { projectKey } = biome.openProject();\n    // Apply the workspace biome.json if it exists in the tree, otherwise the defaults.\n    const treeConfig = tree.read('biome.json', 'utf-8');\n    biome.applyConfiguration(\n      projectKey,\n      treeConfig ? JSON.parse(treeConfig) : DEFAULT_BIOME_CONFIG,\n    );\n\n    for (const file of files) {\n      try {\n        const { content } = biome.formatContent(\n          projectKey,\n          file.content?.toString('utf-8') ?? '',\n          { filePath: file.path },\n        );\n        tree.write(file.path, content);\n      } catch {\n        // Leave individual files that fail to format untouched\n      }\n    }\n  } catch {\n    // Silently skip formatting failures\n  }\n}\n\ninterface BiomeCommand {\n  command: string;\n  args: string[];\n}\n\n/**\n * Resolve the `@biomejs/biome` CLI from the user's workspace, falling back to a\n * `biome` binary on the PATH.\n */\nconst _biomeCommands = new Map<string, BiomeCommand | null>();\nfunction getBiomeCommand(root: string): BiomeCommand | undefined {\n  if (_biomeCommands.has(root)) {\n    return _biomeCommands.get(root) ?? undefined;\n  }\n\n  // Run via node for cross-platform execution of the bin shim.\n  try {\n    const pkgJsonPath = require.resolve('@biomejs/biome/package.json', {\n      paths: [root, import.meta.dirname],\n    });\n    const pkgJson = JSON.parse(readFileSync(pkgJsonPath, 'utf-8'));\n    const binRelative =\n      typeof pkgJson.bin === 'string' ? pkgJson.bin : pkgJson.bin?.biome;\n    if (binRelative) {\n      const binPath = path.join(path.dirname(pkgJsonPath), binRelative);\n      const command = { command: process.execPath, args: [binPath] };\n      _biomeCommands.set(root, command);\n      return command;\n    }\n  } catch {\n    // Fall back to a biome binary on the PATH\n  }\n\n  try {\n    execSync('biome --version', {\n      encoding: 'utf-8',\n      stdio: ['pipe', 'pipe', 'pipe'],\n    });\n    const command = { command: 'biome', args: [] };\n    _biomeCommands.set(root, command);\n    return command;\n  } catch {\n    _biomeCommands.set(root, null);\n    return undefined;\n  }\n}\n\n/**\n * Find the ruff command: `uvx --from ruff==<version> ruff`. uvx works\n * regardless of workspace resolution state (unlike `uv run ruff`, which fails\n * while installs are deferred), and the version pin matches the project's\n * `format` target (PY_VERSIONS) so generation and check format identically.\n * Only a successful probe is cached — ruff can become available mid-run in the\n * long-lived Nx daemon, so a cached failure would skip formatting thereafter.\n */\nlet _ruffCommand: string | undefined;\nfunction getRuffCommand(): string | undefined {\n  if (_ruffCommand) {\n    return _ruffCommand;\n  }\n  const cmd = uvxCommand('ruff');\n  try {\n    execSync(`${cmd} --version`, {\n      encoding: 'utf-8',\n      stdio: ['pipe', 'pipe', 'pipe'],\n    });\n    _ruffCommand = cmd;\n    return cmd;\n  } catch {\n    return undefined;\n  }\n}\n\n/**\n * Whether ruff would discover a config on disk for a file, by walking from its\n * directory up to the workspace root looking for `.ruff.toml`, `ruff.toml`, or a\n * `pyproject.toml` with a `[tool.ruff]` section — the same files ruff itself\n * resolves. The walk stops at `tree.root` so a stray config in a parent of the\n * workspace (or the home directory) is never treated as the project's. Used to\n * decide whether to nudge ruff towards import sorting (see\n * {@link ruffFixAndFormat}).\n */\nfunction hasRuffConfigOnDisk(tree: Tree, filePath: string): boolean {\n  const root = path.resolve(tree.root);\n  let dir = path.resolve(root, path.dirname(filePath));\n  while (true) {\n    if (\n      existsSync(path.join(dir, '.ruff.toml')) ||\n      existsSync(path.join(dir, 'ruff.toml'))\n    ) {\n      return true;\n    }\n    const pyproject = path.join(dir, 'pyproject.toml');\n    if (\n      existsSync(pyproject) &&\n      readFileSync(pyproject, 'utf-8').includes('[tool.ruff')\n    ) {\n      return true;\n    }\n    const parent = path.dirname(dir);\n    // Stop once the workspace root has been checked (or we hit the FS root).\n    if (dir === root || parent === dir) {\n      return false;\n    }\n    dir = parent;\n  }\n}\n\ninterface PythonProjectRuffConfig {\n  /** Project root, normalised to use forward slashes. */\n  readonly root: string;\n  /** Top-level importable module names declared by the project. */\n  readonly modules: string[];\n  /** The project's `[tool.ruff].line-length`, if set. */\n  readonly lineLength?: number;\n  /**\n   * Ruff `target-version` (eg `py314`) derived from `[project].requires-python`.\n   * Generation formats via stdin with no pyproject, so it must be passed\n   * explicitly — ruff's formatting differs by target.\n   */\n  readonly targetVersion?: string;\n}\n\n/**\n * Derive ruff's `target-version` (eg `py314`) from a PEP 508\n * `requires-python` specifier (eg `>=3.14`). Ruff targets the minimum\n * supported version, so take the lowest `major.minor` mentioned.\n */\nexport const requiresPythonToRuffTarget = (\n  requiresPython: unknown,\n): string | undefined => {\n  if (typeof requiresPython !== 'string') {\n    return undefined;\n  }\n  let min: { major: number; minor: number } | undefined;\n  for (const match of requiresPython.matchAll(/(\\d+)\\.(\\d+)/g)) {\n    const major = Number(match[1]);\n    const minor = Number(match[2]);\n    if (\n      !min ||\n      major < min.major ||\n      (major === min.major && minor < min.minor)\n    ) {\n      min = { major, minor };\n    }\n  }\n  return min ? `py${min.major}${min.minor}` : undefined;\n};\n\n/**\n * Map each Nx project with a `pyproject.toml` to the ruff settings the on-disk\n * build enforces for it: its top-level module names (from\n * `[tool.hatch.build.targets.wheel].packages`) and its `[tool.ruff].line-length`.\n */\nfunction getPythonProjectRuffConfigs(tree: Tree): PythonProjectRuffConfig[] {\n  const configs: PythonProjectRuffConfig[] = [];\n\n  for (const project of getProjects(tree).values()) {\n    const pyprojectPath = path.join(project.root, 'pyproject.toml');\n    if (tree.exists(pyprojectPath)) {\n      try {\n        const pyproject = readToml(tree, pyprojectPath) as any;\n        const wheelPackages: unknown =\n          pyproject?.tool?.hatch?.build?.targets?.wheel?.packages;\n        // Record the top-level module segment (`pkg/sub` -> `pkg`), which is\n        // all `known-first-party` keys off.\n        const modules = Array.isArray(wheelPackages)\n          ? wheelPackages\n              .filter((pkg): pkg is string => typeof pkg === 'string' && !!pkg)\n              .map((pkg) => pkg.split('/')[0])\n          : [];\n        const lineLength: unknown = pyproject?.tool?.ruff?.['line-length'];\n        const targetVersion = requiresPythonToRuffTarget(\n          pyproject?.project?.['requires-python'],\n        );\n        if (modules.length || typeof lineLength === 'number' || targetVersion) {\n          configs.push({\n            root: project.root.split(path.sep).join('/'),\n            modules,\n            lineLength: typeof lineLength === 'number' ? lineLength : undefined,\n            targetVersion,\n          });\n        }\n      } catch {\n        // Skip projects whose pyproject.toml cannot be parsed\n      }\n    }\n  }\n\n  return configs;\n}\n\n/**\n * Resolve the ruff config for the project that owns a file (the project with\n * the longest root that is a prefix of the file path). Ruff runs per-project on\n * disk, so a file's settings come from its own project — only its own module is\n * first-party (sibling workspace packages are third-party) and its own\n * line-length applies — and scoping this way keeps in-tree formatting\n * consistent with the on-disk build.\n */\nfunction getOwningProjectRuffConfig(\n  filePath: string,\n  configs: PythonProjectRuffConfig[],\n): PythonProjectRuffConfig | undefined {\n  let owner: PythonProjectRuffConfig | undefined;\n  for (const config of configs) {\n    if (\n      (filePath === config.root || filePath.startsWith(`${config.root}/`)) &&\n      (!owner || config.root.length > owner.root.length)\n    ) {\n      owner = config;\n    }\n  }\n  return owner;\n}\n\n/**\n * Run ruff check --fix and ruff format on Python file content via stdin.\n * Applies all configured lint fixes (including import sorting) and formatting.\n *\n * When no ruff config exists on disk (`hasConfig` false) ruff falls back to its\n * defaults, which omit isort — but generated projects enable rule `I` and their\n * build fails on unsorted imports (I001). In that case we add `--extend-select\n * I` so import sorting matches what the build enforces. When a config does\n * exist we defer to it entirely, honouring the user's rule selection.\n *\n * `projectConfig` carries the owning project's ruff settings, which ruff cannot\n * detect from the filesystem during generation because the project lives only\n * in the tree. We pass them via `--config` so in-tree formatting matches the\n * on-disk build: `known-first-party` (the project's own modules) keeps its\n * imports in their own group, and `line-length` keeps wrapping consistent (the\n * generated config raises it above ruff's default of 88). These are additive to\n * any on-disk config, so they are safe to pass regardless of `hasConfig`.\n */\nfunction ruffFixAndFormat(\n  content: string,\n  filePath: string,\n  hasConfig: boolean,\n  projectConfig?: PythonProjectRuffConfig,\n): string {\n  const ruff = getRuffCommand();\n  if (!ruff) return content;\n\n  const extendSelect = hasConfig ? '' : ' --extend-select I';\n  const configArgs: string[] = [];\n  if (projectConfig?.modules.length) {\n    configArgs.push(\n      `lint.isort.known-first-party = ${JSON.stringify(projectConfig.modules)}`,\n    );\n  }\n  if (typeof projectConfig?.lineLength === 'number') {\n    configArgs.push(`line-length = ${projectConfig.lineLength}`);\n  }\n  if (projectConfig?.targetVersion) {\n    configArgs.push(`target-version = \"${projectConfig.targetVersion}\"`);\n  }\n  const config = configArgs\n    .map((arg) => ` --config ${JSON.stringify(arg)}`)\n    .join('');\n\n  // First apply lint fixes (import sorting, unused imports, etc.)\n  try {\n    const result = execSync(\n      `${ruff} check --fix${extendSelect}${config} --stdin-filename ${filePath} -`,\n      { input: content, encoding: 'utf-8', stdio: ['pipe', 'pipe', 'pipe'] },\n    );\n    content = result;\n  } catch (e: any) {\n    // ruff check exits non-zero when it finds unfixable issues,\n    // but stdout still contains the fixed content\n    if (e.stdout) {\n      content = e.stdout;\n    }\n  }\n\n  // Then apply formatting\n  try {\n    content = execSync(\n      `${ruff} format${config} --stdin-filename ${filePath} -`,\n      {\n        input: content,\n        encoding: 'utf-8',\n        stdio: ['pipe', 'pipe', 'pipe'],\n      },\n    );\n  } catch {\n    // Fall through with whatever content we have\n  }\n\n  return content;\n}\n"],"names":["Biome","getProjects","execFileSync","execSync","existsSync","readFileSync","createRequire","path","uvxCommand","readToml","require","url","DEFAULT_BIOME_CONFIG","$schema","root","formatter","enabled","indentStyle","indentWidth","lineWidth","javascript","quoteStyle","trailingCommas","css","linter","rules","recommended","correctness","noUndeclaredDependencies","assist","actions","source","organizeImports","files","includes","BIOME_FORMATTABLE_EXTENSIONS","Set","isTsConfig","filePath","test","formatFilesInSubtree","tree","dir","changedFiles","listChanges","filter","file","type","startsWith","pyFiles","endsWith","otherFiles","has","extname","pythonProjectConfigs","length","getPythonProjectRuffConfigs","content","ruffFixAndFormat","toString","hasRuffConfigOnDisk","getOwningProjectRuffConfig","write","join","formatWithBiomeCli","formatWithBiomeApi","biome","getBiomeCommand","command","args","input","encoding","cwd","stdio","projectKey","openProject","treeConfig","read","applyConfiguration","JSON","parse","formatContent","_biomeCommands","Map","get","undefined","pkgJsonPath","resolve","paths","dirname","pkgJson","binRelative","bin","binPath","process","execPath","set","_ruffCommand","getRuffCommand","cmd","pyproject","parent","requiresPythonToRuffTarget","requiresPython","min","match","matchAll","major","Number","minor","configs","project","values","pyprojectPath","exists","wheelPackages","tool","hatch","build","targets","wheel","packages","modules","Array","isArray","pkg","map","split","lineLength","ruff","targetVersion","push","sep","owner","config","hasConfig","projectConfig","extendSelect","configArgs","stringify","arg","result","e","stdout"],"mappings":"AAAA;;;CAGC,GAED,SAASA,KAAK,QAAQ,yBAAyB;AAC/C,SAASC,WAAW,QAAmB,aAAa;AACpD,SAASC,YAAY,EAAEC,QAAQ,QAAQ,gBAAgB;AACvD,SAASC,UAAU,EAAEC,YAAY,QAAQ,KAAK;AAC9C,SAASC,aAAa,QAAQ,SAAS;AACvC,OAAOC,UAAU,OAAO;AACxB,SAASC,UAAU,QAAQ,UAAO;AAClC,SAASC,QAAQ,QAAQ,YAAS;AAElC,MAAMC,UAAUJ,cAAc,YAAYK,GAAG;AAE7C,OAAO,MAAMC,uBAAuB;IAClCC,SAAS;IACTC,MAAM;IACNC,WAAW;QACTC,SAAS;QACTC,aAAa;QACbC,aAAa;QACbC,WAAW;IACb;IACAC,YAAY;QACVL,WAAW;YACTM,YAAY;YACZC,gBAAgB;QAClB;IACF;IACAC,KAAK;QACHR,WAAW;YACTM,YAAY;QACd;QACAG,QAAQ;YACNR,SAAS;QACX;IACF;IACAQ,QAAQ;QACNR,SAAS;QACTS,OAAO;YACLC,aAAa;YACbC,aAAa;gBACXC,0BAA0B;YAC5B;QACF;IACF;IACAC,QAAQ;QACNC,SAAS;YACPC,QAAQ;gBACNC,iBAAiB;YACnB;QACF;IACF;IACAC,OAAO;QACLC,UAAU;YACR;YACA;YACA;YACA;YACA;YACA;YACA;YACA;YACA;YACA;SACD;IACH;AACF,EAAE;AAEF,MAAMC,+BAA+B,IAAIC,IAAI;IAC3C;IACA;IACA;IACA;IACA;IACA;IACA;IACA;IACA;IACA;IACA;CACD;AAED,mEAAmE,GACnE,MAAMC,aAAa,CAACC,WAClB,6BAA6BC,IAAI,CAACD;AAEpC;;;;CAIC,GACD,OAAO,eAAeE,qBACpBC,IAAU,EACVC,GAAY;IAEZ,MAAMC,eAAeF,KAClBG,WAAW,GACXC,MAAM,CAAC,CAACC,OAASA,KAAKC,IAAI,KAAK,UAC/BF,MAAM,CAAC,CAACC,OAAUJ,MAAMI,KAAKvC,IAAI,CAACyC,UAAU,CAACN,OAAO;IAEvD,MAAMO,UAAUN,aAAaE,MAAM,CAAC,CAACC,OAASA,KAAKvC,IAAI,CAAC2C,QAAQ,CAAC;IACjE,MAAMC,aAAaR,aAAaE,MAAM,CACpC,CAACC,OACCX,6BAA6BiB,GAAG,CAAC7C,KAAK8C,OAAO,CAACP,KAAKvC,IAAI,MACvD,oEAAoE;QACpE,yEAAyE;QACzE,oEAAoE;QACpE,yEAAyE;QACzE,wCAAwC;QACxC,CAAC8B,WAAWS,KAAKvC,IAAI;IAGzB,4EAA4E;IAC5E,8EAA8E;IAC9E,MAAM+C,uBAAuBL,QAAQM,MAAM,GACvCC,4BAA4Bf,QAC5B,EAAE;IAEN,0DAA0D;IAC1D,KAAK,MAAMK,QAAQG,QAAS;QAC1B,IAAI;YACF,MAAMQ,UAAUC,iBACdZ,KAAKW,OAAO,CAACE,QAAQ,CAAC,UACtBb,KAAKvC,IAAI,EACTqD,oBAAoBnB,MAAMK,KAAKvC,IAAI,GACnCsD,2BAA2Bf,KAAKvC,IAAI,EAAE+C;YAExCb,KAAKqB,KAAK,CAAChB,KAAKvC,IAAI,EAAEkD;QACxB,EAAE,OAAM;QACN,yCAAyC;QAC3C;IACF;IAEA,IAAIN,WAAWI,MAAM,KAAK,GAAG;IAE7B,6EAA6E;IAC7E,wEAAwE;IACxE,2EAA2E;IAC3E,IAAInD,WAAWG,KAAKwD,IAAI,CAACtB,KAAK3B,IAAI,EAAE,gBAAgB;QAClDkD,mBAAmBvB,MAAMU;IAC3B,OAAO;QACLc,mBAAmBxB,MAAMU;IAC3B;AACF;AAEA;;;CAGC,GACD,SAASa,mBACPvB,IAAU,EACVR,KAAiD;IAEjD,MAAMiC,QAAQC,gBAAgB1B,KAAK3B,IAAI;IACvC,IAAI,CAACoD,OAAO;QACV,6DAA6D;QAC7DD,mBAAmBxB,MAAMR;QACzB;IACF;IAEA,KAAK,MAAMa,QAAQb,MAAO;QACxB,IAAI;YACF,MAAMwB,UAAUvD,aACdgE,MAAME,OAAO,EACb;mBAAIF,MAAMG,IAAI;gBAAE;gBAAU,CAAC,kBAAkB,EAAEvB,KAAKvC,IAAI,EAAE;aAAC,EAC3D;gBACE+D,OAAOxB,KAAKW,OAAO,EAAEE,SAAS,YAAY;gBAC1CY,UAAU;gBACVC,KAAK/B,KAAK3B,IAAI;gBACd2D,OAAO;oBAAC;oBAAQ;oBAAQ;iBAAO;YACjC;YAEFhC,KAAKqB,KAAK,CAAChB,KAAKvC,IAAI,EAAEkD;QACxB,EAAE,OAAM;QACN,uDAAuD;QACzD;IACF;AACF;AAEA;;;CAGC,GACD,SAASQ,mBACPxB,IAAU,EACVR,KAAiD;IAEjD,IAAI;QACF,MAAMiC,QAAQ,IAAIlE;QAClB,MAAM,EAAE0E,UAAU,EAAE,GAAGR,MAAMS,WAAW;QACxC,mFAAmF;QACnF,MAAMC,aAAanC,KAAKoC,IAAI,CAAC,cAAc;QAC3CX,MAAMY,kBAAkB,CACtBJ,YACAE,aAAaG,KAAKC,KAAK,CAACJ,cAAchE;QAGxC,KAAK,MAAMkC,QAAQb,MAAO;YACxB,IAAI;gBACF,MAAM,EAAEwB,OAAO,EAAE,GAAGS,MAAMe,aAAa,CACrCP,YACA5B,KAAKW,OAAO,EAAEE,SAAS,YAAY,IACnC;oBAAErB,UAAUQ,KAAKvC,IAAI;gBAAC;gBAExBkC,KAAKqB,KAAK,CAAChB,KAAKvC,IAAI,EAAEkD;YACxB,EAAE,OAAM;YACN,uDAAuD;YACzD;QACF;IACF,EAAE,OAAM;IACN,oCAAoC;IACtC;AACF;AAOA;;;CAGC,GACD,MAAMyB,iBAAiB,IAAIC;AAC3B,SAAShB,gBAAgBrD,IAAY;IACnC,IAAIoE,eAAe9B,GAAG,CAACtC,OAAO;QAC5B,OAAOoE,eAAeE,GAAG,CAACtE,SAASuE;IACrC;IAEA,6DAA6D;IAC7D,IAAI;QACF,MAAMC,cAAc5E,QAAQ6E,OAAO,CAAC,+BAA+B;YACjEC,OAAO;gBAAC1E;gBAAM,YAAY2E,OAAO;aAAC;QACpC;QACA,MAAMC,UAAUX,KAAKC,KAAK,CAAC3E,aAAaiF,aAAa;QACrD,MAAMK,cACJ,OAAOD,QAAQE,GAAG,KAAK,WAAWF,QAAQE,GAAG,GAAGF,QAAQE,GAAG,EAAE1B;QAC/D,IAAIyB,aAAa;YACf,MAAME,UAAUtF,KAAKwD,IAAI,CAACxD,KAAKkF,OAAO,CAACH,cAAcK;YACrD,MAAMvB,UAAU;gBAAEA,SAAS0B,QAAQC,QAAQ;gBAAE1B,MAAM;oBAACwB;iBAAQ;YAAC;YAC7DX,eAAec,GAAG,CAAClF,MAAMsD;YACzB,OAAOA;QACT;IACF,EAAE,OAAM;IACN,0CAA0C;IAC5C;IAEA,IAAI;QACFjE,SAAS,mBAAmB;YAC1BoE,UAAU;YACVE,OAAO;gBAAC;gBAAQ;gBAAQ;aAAO;QACjC;QACA,MAAML,UAAU;YAAEA,SAAS;YAASC,MAAM,EAAE;QAAC;QAC7Ca,eAAec,GAAG,CAAClF,MAAMsD;QACzB,OAAOA;IACT,EAAE,OAAM;QACNc,eAAec,GAAG,CAAClF,MAAM;QACzB,OAAOuE;IACT;AACF;AAEA;;;;;;;CAOC,GACD,IAAIY;AACJ,SAASC;IACP,IAAID,cAAc;QAChB,OAAOA;IACT;IACA,MAAME,MAAM3F,WAAW;IACvB,IAAI;QACFL,SAAS,GAAGgG,IAAI,UAAU,CAAC,EAAE;YAC3B5B,UAAU;YACVE,OAAO;gBAAC;gBAAQ;gBAAQ;aAAO;QACjC;QACAwB,eAAeE;QACf,OAAOA;IACT,EAAE,OAAM;QACN,OAAOd;IACT;AACF;AAEA;;;;;;;;CAQC,GACD,SAASzB,oBAAoBnB,IAAU,EAAEH,QAAgB;IACvD,MAAMxB,OAAOP,KAAKgF,OAAO,CAAC9C,KAAK3B,IAAI;IACnC,IAAI4B,MAAMnC,KAAKgF,OAAO,CAACzE,MAAMP,KAAKkF,OAAO,CAACnD;IAC1C,MAAO,KAAM;QACX,IACElC,WAAWG,KAAKwD,IAAI,CAACrB,KAAK,kBAC1BtC,WAAWG,KAAKwD,IAAI,CAACrB,KAAK,eAC1B;YACA,OAAO;QACT;QACA,MAAM0D,YAAY7F,KAAKwD,IAAI,CAACrB,KAAK;QACjC,IACEtC,WAAWgG,cACX/F,aAAa+F,WAAW,SAASlE,QAAQ,CAAC,eAC1C;YACA,OAAO;QACT;QACA,MAAMmE,SAAS9F,KAAKkF,OAAO,CAAC/C;QAC5B,yEAAyE;QACzE,IAAIA,QAAQ5B,QAAQuF,WAAW3D,KAAK;YAClC,OAAO;QACT;QACAA,MAAM2D;IACR;AACF;AAiBA;;;;CAIC,GACD,OAAO,MAAMC,6BAA6B,CACxCC;IAEA,IAAI,OAAOA,mBAAmB,UAAU;QACtC,OAAOlB;IACT;IACA,IAAImB;IACJ,KAAK,MAAMC,SAASF,eAAeG,QAAQ,CAAC,iBAAkB;QAC5D,MAAMC,QAAQC,OAAOH,KAAK,CAAC,EAAE;QAC7B,MAAMI,QAAQD,OAAOH,KAAK,CAAC,EAAE;QAC7B,IACE,CAACD,OACDG,QAAQH,IAAIG,KAAK,IAChBA,UAAUH,IAAIG,KAAK,IAAIE,QAAQL,IAAIK,KAAK,EACzC;YACAL,MAAM;gBAAEG;gBAAOE;YAAM;QACvB;IACF;IACA,OAAOL,MAAM,CAAC,EAAE,EAAEA,IAAIG,KAAK,GAAGH,IAAIK,KAAK,EAAE,GAAGxB;AAC9C,EAAE;AAEF;;;;CAIC,GACD,SAAS7B,4BAA4Bf,IAAU;IAC7C,MAAMqE,UAAqC,EAAE;IAE7C,KAAK,MAAMC,WAAW9G,YAAYwC,MAAMuE,MAAM,GAAI;QAChD,MAAMC,gBAAgB1G,KAAKwD,IAAI,CAACgD,QAAQjG,IAAI,EAAE;QAC9C,IAAI2B,KAAKyE,MAAM,CAACD,gBAAgB;YAC9B,IAAI;gBACF,MAAMb,YAAY3F,SAASgC,MAAMwE;gBACjC,MAAME,gBACJf,WAAWgB,MAAMC,OAAOC,OAAOC,SAASC,OAAOC;gBACjD,qEAAqE;gBACrE,oCAAoC;gBACpC,MAAMC,UAAUC,MAAMC,OAAO,CAACT,iBAC1BA,cACGtE,MAAM,CAAC,CAACgF,MAAuB,OAAOA,QAAQ,YAAY,CAAC,CAACA,KAC5DC,GAAG,CAAC,CAACD,MAAQA,IAAIE,KAAK,CAAC,IAAI,CAAC,EAAE,IACjC,EAAE;gBACN,MAAMC,aAAsB5B,WAAWgB,MAAMa,MAAM,CAAC,cAAc;gBAClE,MAAMC,gBAAgB5B,2BACpBF,WAAWW,SAAS,CAAC,kBAAkB;gBAEzC,IAAIW,QAAQnE,MAAM,IAAI,OAAOyE,eAAe,YAAYE,eAAe;oBACrEpB,QAAQqB,IAAI,CAAC;wBACXrH,MAAMiG,QAAQjG,IAAI,CAACiH,KAAK,CAACxH,KAAK6H,GAAG,EAAErE,IAAI,CAAC;wBACxC2D;wBACAM,YAAY,OAAOA,eAAe,WAAWA,aAAa3C;wBAC1D6C;oBACF;gBACF;YACF,EAAE,OAAM;YACN,sDAAsD;YACxD;QACF;IACF;IAEA,OAAOpB;AACT;AAEA;;;;;;;CAOC,GACD,SAASjD,2BACPvB,QAAgB,EAChBwE,OAAkC;IAElC,IAAIuB;IACJ,KAAK,MAAMC,UAAUxB,QAAS;QAC5B,IACE,AAACxE,CAAAA,aAAagG,OAAOxH,IAAI,IAAIwB,SAASU,UAAU,CAAC,GAAGsF,OAAOxH,IAAI,CAAC,CAAC,CAAC,CAAA,KACjE,CAAA,CAACuH,SAASC,OAAOxH,IAAI,CAACyC,MAAM,GAAG8E,MAAMvH,IAAI,CAACyC,MAAM,AAAD,GAChD;YACA8E,QAAQC;QACV;IACF;IACA,OAAOD;AACT;AAEA;;;;;;;;;;;;;;;;;CAiBC,GACD,SAAS3E,iBACPD,OAAe,EACfnB,QAAgB,EAChBiG,SAAkB,EAClBC,aAAuC;IAEvC,MAAMP,OAAO/B;IACb,IAAI,CAAC+B,MAAM,OAAOxE;IAElB,MAAMgF,eAAeF,YAAY,KAAK;IACtC,MAAMG,aAAuB,EAAE;IAC/B,IAAIF,eAAed,QAAQnE,QAAQ;QACjCmF,WAAWP,IAAI,CACb,CAAC,+BAA+B,EAAEpD,KAAK4D,SAAS,CAACH,cAAcd,OAAO,GAAG;IAE7E;IACA,IAAI,OAAOc,eAAeR,eAAe,UAAU;QACjDU,WAAWP,IAAI,CAAC,CAAC,cAAc,EAAEK,cAAcR,UAAU,EAAE;IAC7D;IACA,IAAIQ,eAAeN,eAAe;QAChCQ,WAAWP,IAAI,CAAC,CAAC,kBAAkB,EAAEK,cAAcN,aAAa,CAAC,CAAC,CAAC;IACrE;IACA,MAAMI,SAASI,WACZZ,GAAG,CAAC,CAACc,MAAQ,CAAC,UAAU,EAAE7D,KAAK4D,SAAS,CAACC,MAAM,EAC/C7E,IAAI,CAAC;IAER,gEAAgE;IAChE,IAAI;QACF,MAAM8E,SAAS1I,SACb,GAAG8H,KAAK,YAAY,EAAEQ,eAAeH,OAAO,kBAAkB,EAAEhG,SAAS,EAAE,CAAC,EAC5E;YAAEgC,OAAOb;YAASc,UAAU;YAASE,OAAO;gBAAC;gBAAQ;gBAAQ;aAAO;QAAC;QAEvEhB,UAAUoF;IACZ,EAAE,OAAOC,GAAQ;QACf,4DAA4D;QAC5D,8CAA8C;QAC9C,IAAIA,EAAEC,MAAM,EAAE;YACZtF,UAAUqF,EAAEC,MAAM;QACpB;IACF;IAEA,wBAAwB;IACxB,IAAI;QACFtF,UAAUtD,SACR,GAAG8H,KAAK,OAAO,EAAEK,OAAO,kBAAkB,EAAEhG,SAAS,EAAE,CAAC,EACxD;YACEgC,OAAOb;YACPc,UAAU;YACVE,OAAO;gBAAC;gBAAQ;gBAAQ;aAAO;QACjC;IAEJ,EAAE,OAAM;IACN,6CAA6C;IAC/C;IAEA,OAAOhB;AACT"}

package/src/utils/rdb-constructs/files/cdk/core/rdb/aurora.ts.template

@@ -166,7 +166,11 @@ export interface AuroraDatabaseProps extends _AuroraDatabaseProps {
    * Whether to export Aurora engine logs to CloudWatch Logs.
    * See https://docs.aws.amazon.com/AmazonRDS/latest/AuroraUserGuide/USER_LogAccess.html
    *
-   * @default false
+   * PostgreSQL logs DDL statements only (log_statement=ddl); MySQL enables
+   * Advanced Auditing scoped to connections and DDL (server_audit_events=CONNECT,QUERY_DDL).
+   * Neither logs statement parameter values, to avoid leaking PII into log data.
+   *
+   * @default true
    */
   readonly enableCloudwatchLogs?: boolean;
 
@@ -203,7 +207,7 @@ export abstract class AuroraDatabase extends Construct {
       deletionProtection = true,
       removalPolicy = RemovalPolicy.RETAIN,
       enableKeyRotation = true,
-      enableCloudwatchLogs = false,
+      enableCloudwatchLogs = true,
       enablePerformanceInsights = true,
       engine,
       engineVersion,
@@ -235,9 +239,20 @@ export abstract class AuroraDatabase extends Construct {
       monitoringInterval: Duration.seconds(5),
       cloudwatchLogsExports: enableCloudwatchLogs
         ? engine.type === "mysql"
-          ? ["audit", "error", "general", "slowquery"]
+          ? ["audit", "error"]
           : ["postgresql"]
         : undefined,
+      parameters: enableCloudwatchLogs
+        ? engine.type === "mysql"
+          ? {
+              server_audit_logging: "1",
+              server_audit_events: "CONNECT,QUERY_DDL",
+            }
+          : // Only safe statement-at-a-time; a multi-statement batch mixing
+            // DDL with DML (e.g. one `psql -c "a;b;c"` call) logs the whole
+            // raw text verbatim, including any literal DML values.
+            { log_statement: "ddl" }
+        : undefined,
       defaultDatabaseName: databaseName,
       storageEncrypted: true,
       storageEncryptionKey: key,

package/src/utils/rdb-constructs/files/terraform/core/rdb/aurora/aurora.tf.template

@@ -124,9 +124,9 @@ variable "enable_credential_rotation" {
 }
 
 variable "enable_cloudwatch_logs" {
-  description = "Whether to export Aurora engine logs to CloudWatch. PostgreSQL also enables verbose statement logging."
+  description = "Whether to export Aurora engine logs to CloudWatch. PostgreSQL logs DDL statements only (log_statement=ddl); MySQL enables Advanced Auditing scoped to connections and DDL (server_audit_events=CONNECT,QUERY_DDL). Neither logs statement parameter values, to avoid leaking PII into log data."
   type        = bool
-  default     = false
+  default     = true
 }
 
 variable "enable_performance_insights" {
@@ -181,11 +181,30 @@ resource "aws_rds_cluster_parameter_group" "database" {
   family      = local.parameter_group_family
   description = "Parameter group for ${var.name} Aurora cluster"
 
+  # Only safe statement-at-a-time; a multi-statement batch mixing DDL with
+  # DML (e.g. one `psql -c "a;b;c"` call) logs the whole raw text verbatim,
+  # including any literal DML values.
   dynamic "parameter" {
     for_each = var.engine == "aurora-postgresql" ? [1] : []
     content {
       name  = "log_statement"
-      value = "all"
+      value = "ddl"
+    }
+  }
+
+  dynamic "parameter" {
+    for_each = var.engine == "aurora-mysql" ? [1] : []
+    content {
+      name  = "server_audit_logging"
+      value = "1"
+    }
+  }
+
+  dynamic "parameter" {
+    for_each = var.engine == "aurora-mysql" ? [1] : []
+    content {
+      name  = "server_audit_events"
+      value = "CONNECT,QUERY_DDL"
     }
   }
 
@@ -307,7 +326,7 @@ resource "aws_secretsmanager_secret_version" "credentials" {
 }
 
 resource "aws_rds_cluster" "database" {
-  #checkov:skip=CKV2_AWS_27:Query logging can be enabled with enable_cloudwatch_logs; this module defaults to CDK-equivalent behavior unless logging is requested
+  #checkov:skip=CKV2_AWS_27:Query logging is enabled by default via enable_cloudwatch_logs; checkov cannot resolve the conditional count expression on aws_rds_cluster_parameter_group.database
   #checkov:skip=CKV_AWS_139:Deletion protection is enabled but checkov is unable to detect it correctly
   cluster_identifier                  = local.cluster_name
   engine                              = var.engine
@@ -328,7 +347,7 @@ resource "aws_rds_cluster" "database" {
   monitoring_interval                 = 5
   monitoring_role_arn                 = aws_iam_role.enhanced_monitoring.arn
   copy_tags_to_snapshot               = true
-  enabled_cloudwatch_logs_exports     = var.enable_cloudwatch_logs ? (var.engine == "aurora-mysql" ? ["audit", "error", "general", "slowquery"] : ["postgresql"]) : null
+  enabled_cloudwatch_logs_exports     = var.enable_cloudwatch_logs ? (var.engine == "aurora-mysql" ? ["audit", "error"] : ["postgresql"]) : null
 
   serverlessv2_scaling_configuration {
     min_capacity = var.serverless_min_capacity

package/src/utils/versions.d.ts

@@ -158,6 +158,7 @@ export declare const PY_VERSIONS: {
     readonly mcp: "==1.28.1";
     readonly 'pip-check-updates': "==0.29.0";
     readonly 'pip-licenses': "==5.5.5";
+    readonly ruff: "==0.15.22";
     readonly 'strands-agents': "==1.47.0";
     readonly 'strands-agents[a2a]': "==1.47.0";
     readonly 'strands-agents-tools': "==0.8.3";

package/src/utils/versions.js

@@ -154,6 +154,7 @@
     mcp: '==1.28.1',
     'pip-check-updates': '==0.29.0',
     'pip-licenses': '==5.5.5',
+    ruff: '==0.15.22',
     'strands-agents': '==1.47.0',
     'strands-agents[a2a]': '==1.47.0',
     'strands-agents-tools': '==0.8.3',

package/src/utils/versions.js.map

@@ -1 +1 @@
-{"version":3,"sources":["../../../../../packages/nx-plugin/src/utils/versions.ts"],"sourcesContent":["/**\n * Copyright Amazon.com, Inc. or its affiliates. All Rights Reserved.\n * SPDX-License-Identifier: Apache-2.0\n */\n\n/**\n * Versons for TypeScript dependencies added by generators\n */\nexport const TS_VERSIONS = {\n  '@a2a-js/sdk': '0.3.14',\n  '@aws/aws-distro-opentelemetry-node-autoinstrumentation': '0.12.0',\n  '@aws-sdk/client-dynamodb': '3.1085.0',\n  '@aws-sdk/client-bedrock-runtime': '3.1085.0',\n  '@aws-sdk/client-s3': '3.1085.0',\n  '@aws-sdk/client-sts': '3.1085.0',\n  '@aws-sdk/credential-providers': '3.1085.0',\n  '@aws-sdk/credential-provider-cognito-identity': '3.972.56',\n  '@aws-sdk/client-secrets-manager': '3.1085.0',\n  '@aws-sdk/rds-signer': '3.1085.0',\n  '@aws-smithy/server-apigateway': '1.0.0-alpha.10',\n  '@aws-smithy/server-node': '1.0.0-alpha.10',\n  '@aws-lambda-powertools/logger': '2.34.0',\n  '@aws-lambda-powertools/metrics': '2.34.0',\n  '@aws-lambda-powertools/parameters': '2.34.0',\n  '@aws-lambda-powertools/tracer': '2.34.0',\n  '@aws-lambda-powertools/parser': '2.34.0',\n  '@aws-sdk/client-appconfigdata': '3.1085.0',\n  '@middy/core': '7.7.0',\n  '@nxlv/python': '22.2.1',\n  '@nx-extend/terraform': '10.3.0',\n  '@nx/devkit': '23.1.0',\n  '@nx/react': '23.1.0',\n  'create-nx-workspace': '23.1.0',\n  '@swc-node/register': '1.11.1',\n  '@swc/core': '1.15.43',\n  '@modelcontextprotocol/sdk': '1.29.0',\n  '@modelcontextprotocol/inspector': '0.22.0',\n  '@ag-ui/aws-strands': '0.2.3',\n  '@ag-ui/client': '0.0.57',\n  '@ag-ui/core': '0.0.57',\n  '@ag-ui/encoder': '0.0.57',\n  'agent-chat-cli': '0.3.0',\n  '@copilotkit/react-core': '1.62.3',\n  rxjs: '7.8.2',\n  '@strands-agents/sdk': '1.9.0',\n  '@tanstack/react-router': '1.170.17',\n  '@tanstack/router-plugin': '1.168.19',\n  '@tanstack/router-generator': '1.167.18',\n  '@tanstack/virtual-file-routes': '1.162.0',\n  '@tanstack/router-utils': '1.162.2',\n  '@cloudscape-design/board-components': '3.0.201',\n  '@cloudscape-design/chat-components': '1.0.149',\n  '@cloudscape-design/components': '3.0.1325',\n  '@cloudscape-design/global-styles': '1.0.62',\n  '@tanstack/react-query': '5.101.2',\n  '@tanstack/react-query-devtools': '5.101.2',\n  '@trpc/tanstack-react-query': '11.18.0',\n  '@trpc/client': '11.18.0',\n  '@trpc/server': '11.18.0',\n  '@types/node': '26.1.1',\n  '@types/aws-lambda': '8.10.162',\n  '@types/cors': '2.8.19',\n  '@types/pg': '8.20.0',\n  '@types/ws': '8.18.1',\n  '@types/express': '5.0.6',\n  '@smithy/config-resolver': '4.6.8',\n  '@smithy/node-config-provider': '4.5.8',\n  '@smithy/node-http-handler': '4.9.5',\n  '@smithy/types': '4.16.1',\n  '@vitest/coverage-v8': '4.1.10',\n  '@vitest/ui': '4.1.10',\n  '@astrojs/react': '6.0.1',\n  '@astrojs/starlight': '0.41.3',\n  astro: '7.0.7',\n  aws4fetch: '1.0.20',\n  'aws-cdk': '2.1130.0',\n  'aws-cdk-lib': '2.261.0',\n  'aws-xray-sdk-core': '3.12.0',\n  constructs: '10.6.0',\n  cors: '2.8.6',\n  chalk: '5.6.2',\n  'class-variance-authority': '0.7.1',\n  clsx: '2.1.1',\n  commander: '15.0.0',\n  electrodb: '3.9.1',\n  esbuild: '0.28.1',\n  'event-source-polyfill': '1.0.31',\n  '@types/event-source-polyfill': '1.0.5',\n  '@biomejs/biome': '2.5.3',\n  '@prisma/adapter-mariadb': '7.8.0',\n  '@prisma/adapter-pg': '7.8.0',\n  '@prisma/client': '7.8.0',\n  ejs: '6.0.1',\n  '@types/ejs': '3.1.5',\n  express: '5.2.1',\n  'fast-glob': '3.3.3',\n  husky: '9.1.7',\n  'fs-extra': '11.3.6',\n  '@types/fs-extra': '11.0.4',\n  'make-dir-cli': '4.0.0',\n  mariadb: '3.5.3',\n  ncp: '2.0.0',\n  npm: '12.0.1',\n  'npm-check-updates': '22.2.9',\n  'oidc-client-ts': '3.5.0',\n  pg: '8.22.0',\n  prisma: '7.8.0',\n  'react-oidc-context': '3.3.1',\n  react: '19.2.7',\n  'react-dom': '19.2.7',\n  rimraf: '6.1.3',\n  rolldown: '1.1.5',\n  'simple-git': '3.36.0',\n  'source-map-support': '0.5.21',\n  'starlight-blog': '0.28.0',\n  tailwindcss: '4.3.2',\n  '@tailwindcss/vite': '4.3.2',\n  tsx: '4.23.0',\n  'lucide-react': '1.24.0',\n  'radix-ui': '1.6.2',\n  shadcn: '4.13.0',\n  'tw-animate-css': '1.4.0',\n  'tailwind-merge': '3.6.0',\n  vite: '8.1.4',\n  typescript: '6.0.3',\n  vitest: '4.1.10',\n  zod: '4.4.3',\n  ws: '8.21.0',\n} as const;\nexport type ITsDepVersion = keyof typeof TS_VERSIONS;\n\n/**\n * Add versions to the given dependencies\n */\nexport const withVersions = (deps: ITsDepVersion[]) =>\n  Object.fromEntries(deps.map((dep) => [dep, TS_VERSIONS[dep]]));\n\n/**\n * Versions for Python dependencies added by generators\n */\nexport const PY_VERSIONS = {\n  'a2a-sdk': '==0.3.26',\n  'ag-ui-langgraph': '==0.0.42',\n  'ag-ui-protocol': '==0.1.19',\n  'ag-ui-strands': '==0.2.2',\n  'aws-lambda-powertools': '==3.31.0',\n  'aws-lambda-powertools[tracer]': '==3.31.0',\n  'aws-lambda-powertools[parser]': '==3.31.0',\n  'aws-opentelemetry-distro': '==0.18.0',\n  'bedrock-agentcore': '==1.18.0',\n  boto3: '==1.43.46',\n  checkov: '==3.3.8',\n  fastapi: '==0.139.0',\n  'fastapi[standard]': '==0.139.0',\n  httpx: '==0.28.1',\n  langchain: '==1.3.13',\n  'langchain-aws': '==1.6.2',\n  'langchain-mcp-adapters': '==0.3.0',\n  langgraph: '==1.2.9',\n  mcp: '==1.28.1',\n  'pip-check-updates': '==0.29.0',\n  'pip-licenses': '==5.5.5',\n  'strands-agents': '==1.47.0',\n  'strands-agents[a2a]': '==1.47.0',\n  'strands-agents-tools': '==0.8.3',\n  ty: '==0.0.59',\n  pynamodb: '==6.1.0',\n  uvicorn: '==0.51.0',\n  sqlmodel: '==0.0.38',\n  alembic: '==1.18.4',\n  aiomysql: '==0.3.2',\n  asyncpg: '==0.31.0',\n} as const;\nexport type IPyDepVersion = keyof typeof PY_VERSIONS;\n\n/**\n * Add versions to the given dependencies\n */\nexport const withPyVersions = (deps: IPyDepVersion[]) =>\n  deps.map((dep) => `${dep}${PY_VERSIONS[dep]}`);\n\n/**\n * Versions for vendored tools\n */\nexport const VENDORED_VERSIONS = {\n  'git-secrets': '1.3.0',\n} as const;\n\n/**\n * Base container images used by generated Dockerfiles. Pinned exactly so\n * generated images are reproducible, and chosen to be free of known\n * HIGH/CRITICAL vulnerabilities at time of generation.\n */\nexport const BASE_IMAGES = {\n  node: 'public.ecr.aws/docker/library/node:lts-slim',\n  python: 'public.ecr.aws/docker/library/python:3.14-slim',\n} as const;\n\n/**\n * Versions for container tooling used by generated image build/scan targets.\n * Pinned exactly so generated images are reproducible.\n */\nexport const CONTAINER_VERSIONS = {\n  // ECR-hosted Trivy image used to scan built images during the build.\n  trivy: '0.72.0',\n} as const;\n\n/**\n * Exact versions for Terraform providers used by generated `.tf` modules.\n * Pinned exactly (no range operator) so generated infrastructure is reproducible.\n */\nexport const TERRAFORM_VERSIONS = {\n  aws: '6.54.0',\n  random: '3.9.0',\n  null: '3.3.0',\n  archive: '2.8.0',\n  external: '2.4.0',\n  local: '2.9.0',\n} as const;\nexport type ITerraformProviderVersion = keyof typeof TERRAFORM_VERSIONS;\n\n/**\n * Substitution variables exposing Terraform provider version constraints to\n * generated `.tf` templates (e.g. `version = \"<%- awsProviderVersion %>\"`)\n */\nexport const terraformProviderVersions = () => ({\n  awsProviderVersion: TERRAFORM_VERSIONS.aws,\n  randomProviderVersion: TERRAFORM_VERSIONS.random,\n  nullProviderVersion: TERRAFORM_VERSIONS.null,\n  archiveProviderVersion: TERRAFORM_VERSIONS.archive,\n  externalProviderVersion: TERRAFORM_VERSIONS.external,\n  localProviderVersion: TERRAFORM_VERSIONS.local,\n});\n"],"names":["TS_VERSIONS","rxjs","astro","aws4fetch","constructs","cors","chalk","clsx","commander","electrodb","esbuild","ejs","express","husky","mariadb","ncp","npm","pg","prisma","react","rimraf","rolldown","tailwindcss","tsx","shadcn","vite","typescript","vitest","zod","ws","withVersions","deps","Object","fromEntries","map","dep","PY_VERSIONS","boto3","checkov","fastapi","httpx","langchain","langgraph","mcp","ty","pynamodb","uvicorn","sqlmodel","alembic","aiomysql","asyncpg","withPyVersions","VENDORED_VERSIONS","BASE_IMAGES","node","python","CONTAINER_VERSIONS","trivy","TERRAFORM_VERSIONS","aws","random","null","archive","external","local","terraformProviderVersions","awsProviderVersion","randomProviderVersion","nullProviderVersion","archiveProviderVersion","externalProviderVersion","localProviderVersion"],"mappings":"AAAA;;;CAGC,GAED;;CAEC,GACD,OAAO,MAAMA,cAAc;IACzB,eAAe;IACf,0DAA0D;IAC1D,4BAA4B;IAC5B,mCAAmC;IACnC,sBAAsB;IACtB,uBAAuB;IACvB,iCAAiC;IACjC,iDAAiD;IACjD,mCAAmC;IACnC,uBAAuB;IACvB,iCAAiC;IACjC,2BAA2B;IAC3B,iCAAiC;IACjC,kCAAkC;IAClC,qCAAqC;IACrC,iCAAiC;IACjC,iCAAiC;IACjC,iCAAiC;IACjC,eAAe;IACf,gBAAgB;IAChB,wBAAwB;IACxB,cAAc;IACd,aAAa;IACb,uBAAuB;IACvB,sBAAsB;IACtB,aAAa;IACb,6BAA6B;IAC7B,mCAAmC;IACnC,sBAAsB;IACtB,iBAAiB;IACjB,eAAe;IACf,kBAAkB;IAClB,kBAAkB;IAClB,0BAA0B;IAC1BC,MAAM;IACN,uBAAuB;IACvB,0BAA0B;IAC1B,2BAA2B;IAC3B,8BAA8B;IAC9B,iCAAiC;IACjC,0BAA0B;IAC1B,uCAAuC;IACvC,sCAAsC;IACtC,iCAAiC;IACjC,oCAAoC;IACpC,yBAAyB;IACzB,kCAAkC;IAClC,8BAA8B;IAC9B,gBAAgB;IAChB,gBAAgB;IAChB,eAAe;IACf,qBAAqB;IACrB,eAAe;IACf,aAAa;IACb,aAAa;IACb,kBAAkB;IAClB,2BAA2B;IAC3B,gCAAgC;IAChC,6BAA6B;IAC7B,iBAAiB;IACjB,uBAAuB;IACvB,cAAc;IACd,kBAAkB;IAClB,sBAAsB;IACtBC,OAAO;IACPC,WAAW;IACX,WAAW;IACX,eAAe;IACf,qBAAqB;IACrBC,YAAY;IACZC,MAAM;IACNC,OAAO;IACP,4BAA4B;IAC5BC,MAAM;IACNC,WAAW;IACXC,WAAW;IACXC,SAAS;IACT,yBAAyB;IACzB,gCAAgC;IAChC,kBAAkB;IAClB,2BAA2B;IAC3B,sBAAsB;IACtB,kBAAkB;IAClBC,KAAK;IACL,cAAc;IACdC,SAAS;IACT,aAAa;IACbC,OAAO;IACP,YAAY;IACZ,mBAAmB;IACnB,gBAAgB;IAChBC,SAAS;IACTC,KAAK;IACLC,KAAK;IACL,qBAAqB;IACrB,kBAAkB;IAClBC,IAAI;IACJC,QAAQ;IACR,sBAAsB;IACtBC,OAAO;IACP,aAAa;IACbC,QAAQ;IACRC,UAAU;IACV,cAAc;IACd,sBAAsB;IACtB,kBAAkB;IAClBC,aAAa;IACb,qBAAqB;IACrBC,KAAK;IACL,gBAAgB;IAChB,YAAY;IACZC,QAAQ;IACR,kBAAkB;IAClB,kBAAkB;IAClBC,MAAM;IACNC,YAAY;IACZC,QAAQ;IACRC,KAAK;IACLC,IAAI;AACN,EAAW;AAGX;;CAEC,GACD,OAAO,MAAMC,eAAe,CAACC,OAC3BC,OAAOC,WAAW,CAACF,KAAKG,GAAG,CAAC,CAACC,MAAQ;YAACA;YAAKnC,WAAW,CAACmC,IAAI;SAAC,GAAG;AAEjE;;CAEC,GACD,OAAO,MAAMC,cAAc;IACzB,WAAW;IACX,mBAAmB;IACnB,kBAAkB;IAClB,iBAAiB;IACjB,yBAAyB;IACzB,iCAAiC;IACjC,iCAAiC;IACjC,4BAA4B;IAC5B,qBAAqB;IACrBC,OAAO;IACPC,SAAS;IACTC,SAAS;IACT,qBAAqB;IACrBC,OAAO;IACPC,WAAW;IACX,iBAAiB;IACjB,0BAA0B;IAC1BC,WAAW;IACXC,KAAK;IACL,qBAAqB;IACrB,gBAAgB;IAChB,kBAAkB;IAClB,uBAAuB;IACvB,wBAAwB;IACxBC,IAAI;IACJC,UAAU;IACVC,SAAS;IACTC,UAAU;IACVC,SAAS;IACTC,UAAU;IACVC,SAAS;AACX,EAAW;AAGX;;CAEC,GACD,OAAO,MAAMC,iBAAiB,CAACpB,OAC7BA,KAAKG,GAAG,CAAC,CAACC,MAAQ,GAAGA,MAAMC,WAAW,CAACD,IAAI,EAAE,EAAE;AAEjD;;CAEC,GACD,OAAO,MAAMiB,oBAAoB;IAC/B,eAAe;AACjB,EAAW;AAEX;;;;CAIC,GACD,OAAO,MAAMC,cAAc;IACzBC,MAAM;IACNC,QAAQ;AACV,EAAW;AAEX;;;CAGC,GACD,OAAO,MAAMC,qBAAqB;IAChC,qEAAqE;IACrEC,OAAO;AACT,EAAW;AAEX;;;CAGC,GACD,OAAO,MAAMC,qBAAqB;IAChCC,KAAK;IACLC,QAAQ;IACRC,MAAM;IACNC,SAAS;IACTC,UAAU;IACVC,OAAO;AACT,EAAW;AAGX;;;CAGC,GACD,OAAO,MAAMC,4BAA4B,IAAO,CAAA;QAC9CC,oBAAoBR,mBAAmBC,GAAG;QAC1CQ,uBAAuBT,mBAAmBE,MAAM;QAChDQ,qBAAqBV,mBAAmBG,IAAI;QAC5CQ,wBAAwBX,mBAAmBI,OAAO;QAClDQ,yBAAyBZ,mBAAmBK,QAAQ;QACpDQ,sBAAsBb,mBAAmBM,KAAK;IAChD,CAAA,EAAG"}
+{"version":3,"sources":["../../../../../packages/nx-plugin/src/utils/versions.ts"],"sourcesContent":["/**\n * Copyright Amazon.com, Inc. or its affiliates. All Rights Reserved.\n * SPDX-License-Identifier: Apache-2.0\n */\n\n/**\n * Versons for TypeScript dependencies added by generators\n */\nexport const TS_VERSIONS = {\n  '@a2a-js/sdk': '0.3.14',\n  '@aws/aws-distro-opentelemetry-node-autoinstrumentation': '0.12.0',\n  '@aws-sdk/client-dynamodb': '3.1085.0',\n  '@aws-sdk/client-bedrock-runtime': '3.1085.0',\n  '@aws-sdk/client-s3': '3.1085.0',\n  '@aws-sdk/client-sts': '3.1085.0',\n  '@aws-sdk/credential-providers': '3.1085.0',\n  '@aws-sdk/credential-provider-cognito-identity': '3.972.56',\n  '@aws-sdk/client-secrets-manager': '3.1085.0',\n  '@aws-sdk/rds-signer': '3.1085.0',\n  '@aws-smithy/server-apigateway': '1.0.0-alpha.10',\n  '@aws-smithy/server-node': '1.0.0-alpha.10',\n  '@aws-lambda-powertools/logger': '2.34.0',\n  '@aws-lambda-powertools/metrics': '2.34.0',\n  '@aws-lambda-powertools/parameters': '2.34.0',\n  '@aws-lambda-powertools/tracer': '2.34.0',\n  '@aws-lambda-powertools/parser': '2.34.0',\n  '@aws-sdk/client-appconfigdata': '3.1085.0',\n  '@middy/core': '7.7.0',\n  '@nxlv/python': '22.2.1',\n  '@nx-extend/terraform': '10.3.0',\n  '@nx/devkit': '23.1.0',\n  '@nx/react': '23.1.0',\n  'create-nx-workspace': '23.1.0',\n  '@swc-node/register': '1.11.1',\n  '@swc/core': '1.15.43',\n  '@modelcontextprotocol/sdk': '1.29.0',\n  '@modelcontextprotocol/inspector': '0.22.0',\n  '@ag-ui/aws-strands': '0.2.3',\n  '@ag-ui/client': '0.0.57',\n  '@ag-ui/core': '0.0.57',\n  '@ag-ui/encoder': '0.0.57',\n  'agent-chat-cli': '0.3.0',\n  '@copilotkit/react-core': '1.62.3',\n  rxjs: '7.8.2',\n  '@strands-agents/sdk': '1.9.0',\n  '@tanstack/react-router': '1.170.17',\n  '@tanstack/router-plugin': '1.168.19',\n  '@tanstack/router-generator': '1.167.18',\n  '@tanstack/virtual-file-routes': '1.162.0',\n  '@tanstack/router-utils': '1.162.2',\n  '@cloudscape-design/board-components': '3.0.201',\n  '@cloudscape-design/chat-components': '1.0.149',\n  '@cloudscape-design/components': '3.0.1325',\n  '@cloudscape-design/global-styles': '1.0.62',\n  '@tanstack/react-query': '5.101.2',\n  '@tanstack/react-query-devtools': '5.101.2',\n  '@trpc/tanstack-react-query': '11.18.0',\n  '@trpc/client': '11.18.0',\n  '@trpc/server': '11.18.0',\n  '@types/node': '26.1.1',\n  '@types/aws-lambda': '8.10.162',\n  '@types/cors': '2.8.19',\n  '@types/pg': '8.20.0',\n  '@types/ws': '8.18.1',\n  '@types/express': '5.0.6',\n  '@smithy/config-resolver': '4.6.8',\n  '@smithy/node-config-provider': '4.5.8',\n  '@smithy/node-http-handler': '4.9.5',\n  '@smithy/types': '4.16.1',\n  '@vitest/coverage-v8': '4.1.10',\n  '@vitest/ui': '4.1.10',\n  '@astrojs/react': '6.0.1',\n  '@astrojs/starlight': '0.41.3',\n  astro: '7.0.7',\n  aws4fetch: '1.0.20',\n  'aws-cdk': '2.1130.0',\n  'aws-cdk-lib': '2.261.0',\n  'aws-xray-sdk-core': '3.12.0',\n  constructs: '10.6.0',\n  cors: '2.8.6',\n  chalk: '5.6.2',\n  'class-variance-authority': '0.7.1',\n  clsx: '2.1.1',\n  commander: '15.0.0',\n  electrodb: '3.9.1',\n  esbuild: '0.28.1',\n  'event-source-polyfill': '1.0.31',\n  '@types/event-source-polyfill': '1.0.5',\n  '@biomejs/biome': '2.5.3',\n  '@prisma/adapter-mariadb': '7.8.0',\n  '@prisma/adapter-pg': '7.8.0',\n  '@prisma/client': '7.8.0',\n  ejs: '6.0.1',\n  '@types/ejs': '3.1.5',\n  express: '5.2.1',\n  'fast-glob': '3.3.3',\n  husky: '9.1.7',\n  'fs-extra': '11.3.6',\n  '@types/fs-extra': '11.0.4',\n  'make-dir-cli': '4.0.0',\n  mariadb: '3.5.3',\n  ncp: '2.0.0',\n  npm: '12.0.1',\n  'npm-check-updates': '22.2.9',\n  'oidc-client-ts': '3.5.0',\n  pg: '8.22.0',\n  prisma: '7.8.0',\n  'react-oidc-context': '3.3.1',\n  react: '19.2.7',\n  'react-dom': '19.2.7',\n  rimraf: '6.1.3',\n  rolldown: '1.1.5',\n  'simple-git': '3.36.0',\n  'source-map-support': '0.5.21',\n  'starlight-blog': '0.28.0',\n  tailwindcss: '4.3.2',\n  '@tailwindcss/vite': '4.3.2',\n  tsx: '4.23.0',\n  'lucide-react': '1.24.0',\n  'radix-ui': '1.6.2',\n  shadcn: '4.13.0',\n  'tw-animate-css': '1.4.0',\n  'tailwind-merge': '3.6.0',\n  vite: '8.1.4',\n  typescript: '6.0.3',\n  vitest: '4.1.10',\n  zod: '4.4.3',\n  ws: '8.21.0',\n} as const;\nexport type ITsDepVersion = keyof typeof TS_VERSIONS;\n\n/**\n * Add versions to the given dependencies\n */\nexport const withVersions = (deps: ITsDepVersion[]) =>\n  Object.fromEntries(deps.map((dep) => [dep, TS_VERSIONS[dep]]));\n\n/**\n * Versions for Python dependencies added by generators\n */\nexport const PY_VERSIONS = {\n  'a2a-sdk': '==0.3.26',\n  'ag-ui-langgraph': '==0.0.42',\n  'ag-ui-protocol': '==0.1.19',\n  'ag-ui-strands': '==0.2.2',\n  'aws-lambda-powertools': '==3.31.0',\n  'aws-lambda-powertools[tracer]': '==3.31.0',\n  'aws-lambda-powertools[parser]': '==3.31.0',\n  'aws-opentelemetry-distro': '==0.18.0',\n  'bedrock-agentcore': '==1.18.0',\n  boto3: '==1.43.46',\n  checkov: '==3.3.8',\n  fastapi: '==0.139.0',\n  'fastapi[standard]': '==0.139.0',\n  httpx: '==0.28.1',\n  langchain: '==1.3.13',\n  'langchain-aws': '==1.6.2',\n  'langchain-mcp-adapters': '==0.3.0',\n  langgraph: '==1.2.9',\n  mcp: '==1.28.1',\n  'pip-check-updates': '==0.29.0',\n  'pip-licenses': '==5.5.5',\n  ruff: '==0.15.22',\n  'strands-agents': '==1.47.0',\n  'strands-agents[a2a]': '==1.47.0',\n  'strands-agents-tools': '==0.8.3',\n  ty: '==0.0.59',\n  pynamodb: '==6.1.0',\n  uvicorn: '==0.51.0',\n  sqlmodel: '==0.0.38',\n  alembic: '==1.18.4',\n  aiomysql: '==0.3.2',\n  asyncpg: '==0.31.0',\n} as const;\nexport type IPyDepVersion = keyof typeof PY_VERSIONS;\n\n/**\n * Add versions to the given dependencies\n */\nexport const withPyVersions = (deps: IPyDepVersion[]) =>\n  deps.map((dep) => `${dep}${PY_VERSIONS[dep]}`);\n\n/**\n * Versions for vendored tools\n */\nexport const VENDORED_VERSIONS = {\n  'git-secrets': '1.3.0',\n} as const;\n\n/**\n * Base container images used by generated Dockerfiles. Pinned exactly so\n * generated images are reproducible, and chosen to be free of known\n * HIGH/CRITICAL vulnerabilities at time of generation.\n */\nexport const BASE_IMAGES = {\n  node: 'public.ecr.aws/docker/library/node:lts-slim',\n  python: 'public.ecr.aws/docker/library/python:3.14-slim',\n} as const;\n\n/**\n * Versions for container tooling used by generated image build/scan targets.\n * Pinned exactly so generated images are reproducible.\n */\nexport const CONTAINER_VERSIONS = {\n  // ECR-hosted Trivy image used to scan built images during the build.\n  trivy: '0.72.0',\n} as const;\n\n/**\n * Exact versions for Terraform providers used by generated `.tf` modules.\n * Pinned exactly (no range operator) so generated infrastructure is reproducible.\n */\nexport const TERRAFORM_VERSIONS = {\n  aws: '6.54.0',\n  random: '3.9.0',\n  null: '3.3.0',\n  archive: '2.8.0',\n  external: '2.4.0',\n  local: '2.9.0',\n} as const;\nexport type ITerraformProviderVersion = keyof typeof TERRAFORM_VERSIONS;\n\n/**\n * Substitution variables exposing Terraform provider version constraints to\n * generated `.tf` templates (e.g. `version = \"<%- awsProviderVersion %>\"`)\n */\nexport const terraformProviderVersions = () => ({\n  awsProviderVersion: TERRAFORM_VERSIONS.aws,\n  randomProviderVersion: TERRAFORM_VERSIONS.random,\n  nullProviderVersion: TERRAFORM_VERSIONS.null,\n  archiveProviderVersion: TERRAFORM_VERSIONS.archive,\n  externalProviderVersion: TERRAFORM_VERSIONS.external,\n  localProviderVersion: TERRAFORM_VERSIONS.local,\n});\n"],"names":["TS_VERSIONS","rxjs","astro","aws4fetch","constructs","cors","chalk","clsx","commander","electrodb","esbuild","ejs","express","husky","mariadb","ncp","npm","pg","prisma","react","rimraf","rolldown","tailwindcss","tsx","shadcn","vite","typescript","vitest","zod","ws","withVersions","deps","Object","fromEntries","map","dep","PY_VERSIONS","boto3","checkov","fastapi","httpx","langchain","langgraph","mcp","ruff","ty","pynamodb","uvicorn","sqlmodel","alembic","aiomysql","asyncpg","withPyVersions","VENDORED_VERSIONS","BASE_IMAGES","node","python","CONTAINER_VERSIONS","trivy","TERRAFORM_VERSIONS","aws","random","null","archive","external","local","terraformProviderVersions","awsProviderVersion","randomProviderVersion","nullProviderVersion","archiveProviderVersion","externalProviderVersion","localProviderVersion"],"mappings":"AAAA;;;CAGC,GAED;;CAEC,GACD,OAAO,MAAMA,cAAc;IACzB,eAAe;IACf,0DAA0D;IAC1D,4BAA4B;IAC5B,mCAAmC;IACnC,sBAAsB;IACtB,uBAAuB;IACvB,iCAAiC;IACjC,iDAAiD;IACjD,mCAAmC;IACnC,uBAAuB;IACvB,iCAAiC;IACjC,2BAA2B;IAC3B,iCAAiC;IACjC,kCAAkC;IAClC,qCAAqC;IACrC,iCAAiC;IACjC,iCAAiC;IACjC,iCAAiC;IACjC,eAAe;IACf,gBAAgB;IAChB,wBAAwB;IACxB,cAAc;IACd,aAAa;IACb,uBAAuB;IACvB,sBAAsB;IACtB,aAAa;IACb,6BAA6B;IAC7B,mCAAmC;IACnC,sBAAsB;IACtB,iBAAiB;IACjB,eAAe;IACf,kBAAkB;IAClB,kBAAkB;IAClB,0BAA0B;IAC1BC,MAAM;IACN,uBAAuB;IACvB,0BAA0B;IAC1B,2BAA2B;IAC3B,8BAA8B;IAC9B,iCAAiC;IACjC,0BAA0B;IAC1B,uCAAuC;IACvC,sCAAsC;IACtC,iCAAiC;IACjC,oCAAoC;IACpC,yBAAyB;IACzB,kCAAkC;IAClC,8BAA8B;IAC9B,gBAAgB;IAChB,gBAAgB;IAChB,eAAe;IACf,qBAAqB;IACrB,eAAe;IACf,aAAa;IACb,aAAa;IACb,kBAAkB;IAClB,2BAA2B;IAC3B,gCAAgC;IAChC,6BAA6B;IAC7B,iBAAiB;IACjB,uBAAuB;IACvB,cAAc;IACd,kBAAkB;IAClB,sBAAsB;IACtBC,OAAO;IACPC,WAAW;IACX,WAAW;IACX,eAAe;IACf,qBAAqB;IACrBC,YAAY;IACZC,MAAM;IACNC,OAAO;IACP,4BAA4B;IAC5BC,MAAM;IACNC,WAAW;IACXC,WAAW;IACXC,SAAS;IACT,yBAAyB;IACzB,gCAAgC;IAChC,kBAAkB;IAClB,2BAA2B;IAC3B,sBAAsB;IACtB,kBAAkB;IAClBC,KAAK;IACL,cAAc;IACdC,SAAS;IACT,aAAa;IACbC,OAAO;IACP,YAAY;IACZ,mBAAmB;IACnB,gBAAgB;IAChBC,SAAS;IACTC,KAAK;IACLC,KAAK;IACL,qBAAqB;IACrB,kBAAkB;IAClBC,IAAI;IACJC,QAAQ;IACR,sBAAsB;IACtBC,OAAO;IACP,aAAa;IACbC,QAAQ;IACRC,UAAU;IACV,cAAc;IACd,sBAAsB;IACtB,kBAAkB;IAClBC,aAAa;IACb,qBAAqB;IACrBC,KAAK;IACL,gBAAgB;IAChB,YAAY;IACZC,QAAQ;IACR,kBAAkB;IAClB,kBAAkB;IAClBC,MAAM;IACNC,YAAY;IACZC,QAAQ;IACRC,KAAK;IACLC,IAAI;AACN,EAAW;AAGX;;CAEC,GACD,OAAO,MAAMC,eAAe,CAACC,OAC3BC,OAAOC,WAAW,CAACF,KAAKG,GAAG,CAAC,CAACC,MAAQ;YAACA;YAAKnC,WAAW,CAACmC,IAAI;SAAC,GAAG;AAEjE;;CAEC,GACD,OAAO,MAAMC,cAAc;IACzB,WAAW;IACX,mBAAmB;IACnB,kBAAkB;IAClB,iBAAiB;IACjB,yBAAyB;IACzB,iCAAiC;IACjC,iCAAiC;IACjC,4BAA4B;IAC5B,qBAAqB;IACrBC,OAAO;IACPC,SAAS;IACTC,SAAS;IACT,qBAAqB;IACrBC,OAAO;IACPC,WAAW;IACX,iBAAiB;IACjB,0BAA0B;IAC1BC,WAAW;IACXC,KAAK;IACL,qBAAqB;IACrB,gBAAgB;IAChBC,MAAM;IACN,kBAAkB;IAClB,uBAAuB;IACvB,wBAAwB;IACxBC,IAAI;IACJC,UAAU;IACVC,SAAS;IACTC,UAAU;IACVC,SAAS;IACTC,UAAU;IACVC,SAAS;AACX,EAAW;AAGX;;CAEC,GACD,OAAO,MAAMC,iBAAiB,CAACrB,OAC7BA,KAAKG,GAAG,CAAC,CAACC,MAAQ,GAAGA,MAAMC,WAAW,CAACD,IAAI,EAAE,EAAE;AAEjD;;CAEC,GACD,OAAO,MAAMkB,oBAAoB;IAC/B,eAAe;AACjB,EAAW;AAEX;;;;CAIC,GACD,OAAO,MAAMC,cAAc;IACzBC,MAAM;IACNC,QAAQ;AACV,EAAW;AAEX;;;CAGC,GACD,OAAO,MAAMC,qBAAqB;IAChC,qEAAqE;IACrEC,OAAO;AACT,EAAW;AAEX;;;CAGC,GACD,OAAO,MAAMC,qBAAqB;IAChCC,KAAK;IACLC,QAAQ;IACRC,MAAM;IACNC,SAAS;IACTC,UAAU;IACVC,OAAO;AACT,EAAW;AAGX;;;CAGC,GACD,OAAO,MAAMC,4BAA4B,IAAO,CAAA;QAC9CC,oBAAoBR,mBAAmBC,GAAG;QAC1CQ,uBAAuBT,mBAAmBE,MAAM;QAChDQ,qBAAqBV,mBAAmBG,IAAI;QAC5CQ,wBAAwBX,mBAAmBI,OAAO;QAClDQ,yBAAyBZ,mBAAmBK,QAAQ;QACpDQ,sBAAsBb,mBAAmBM,KAAK;IAChD,CAAA,EAAG"}

package/src/utils/warm-ruff-cache.d.ts

@@ -1,12 +1,8 @@
 /**
- * Vitest globalSetup that warms uv's tool cache once before any worker spawns.
- *
- * The formatter runs `uvx ruff` per Python file. On a cold cache the first uv
- * invocation takes an exclusive write lock on uv's global cache while it
- * installs ruff; with many parallel workers each racing that lock, generation
- * stalls. Installing ruff once up front means every worker hits a warm cache,
- * where uv only takes shared locks and calls run concurrently without
- * contention. Both command forms the formatter may use are warmed; if uv is
- * unavailable the formatter skips ruff anyway, so failures here are ignored.
+ * Vitest globalSetup that warms uv's tool cache once before any worker spawns,
+ * installing the exact pinned ruff the formatter runs. On a cold cache the
+ * first uvx call holds an exclusive lock on uv's cache, so parallel workers
+ * would otherwise stall racing it. Failure is ignored — the formatter skips
+ * ruff when uv is unavailable.
  */
 export default function setup(): void;

package/src/utils/warm-ruff-cache.js

@@ -2,37 +2,28 @@
  * Copyright Amazon.com, Inc. or its affiliates. All Rights Reserved.
  * SPDX-License-Identifier: Apache-2.0
  */ import { execFileSync } from "child_process";
+import { withPyVersions } from "./versions.js";
 /**
- * Vitest globalSetup that warms uv's tool cache once before any worker spawns.
- *
- * The formatter runs `uvx ruff` per Python file. On a cold cache the first uv
- * invocation takes an exclusive write lock on uv's global cache while it
- * installs ruff; with many parallel workers each racing that lock, generation
- * stalls. Installing ruff once up front means every worker hits a warm cache,
- * where uv only takes shared locks and calls run concurrently without
- * contention. Both command forms the formatter may use are warmed; if uv is
- * unavailable the formatter skips ruff anyway, so failures here are ignored.
+ * Vitest globalSetup that warms uv's tool cache once before any worker spawns,
+ * installing the exact pinned ruff the formatter runs. On a cold cache the
+ * first uvx call holds an exclusive lock on uv's cache, so parallel workers
+ * would otherwise stall racing it. Failure is ignored — the formatter skips
+ * ruff when uv is unavailable.
  */ export default function setup() {
-    for (const [command, ...args] of [
-        [
-            'uv',
-            'run',
+    const ruff = withPyVersions([
+        'ruff'
+    ])[0];
+    try {
+        execFileSync('uvx', [
+            '--from',
+            ruff,
             'ruff',
             '--version'
-        ],
-        [
-            'uvx',
-            'ruff',
-            '--version'
-        ]
-    ]){
-        try {
-            execFileSync(command, args, {
-                stdio: 'ignore'
-            });
-        } catch  {
-        // Ignore — the formatter falls back or skips ruff when it is unavailable
-        }
+        ], {
+            stdio: 'ignore'
+        });
+    } catch  {
+    // Ignore — the formatter skips ruff when it is unavailable
     }
 }
 

package/src/utils/warm-ruff-cache.js.map

@@ -1 +1 @@
-{"version":3,"sources":["../../../../../packages/nx-plugin/src/utils/warm-ruff-cache.ts"],"sourcesContent":["/**\n * Copyright Amazon.com, Inc. or its affiliates. All Rights Reserved.\n * SPDX-License-Identifier: Apache-2.0\n */\nimport { execFileSync } from 'child_process';\n\n/**\n * Vitest globalSetup that warms uv's tool cache once before any worker spawns.\n *\n * The formatter runs `uvx ruff` per Python file. On a cold cache the first uv\n * invocation takes an exclusive write lock on uv's global cache while it\n * installs ruff; with many parallel workers each racing that lock, generation\n * stalls. Installing ruff once up front means every worker hits a warm cache,\n * where uv only takes shared locks and calls run concurrently without\n * contention. Both command forms the formatter may use are warmed; if uv is\n * unavailable the formatter skips ruff anyway, so failures here are ignored.\n */\nexport default function setup() {\n  for (const [command, ...args] of [\n    ['uv', 'run', 'ruff', '--version'],\n    ['uvx', 'ruff', '--version'],\n  ]) {\n    try {\n      execFileSync(command, args, { stdio: 'ignore' });\n    } catch {\n      // Ignore — the formatter falls back or skips ruff when it is unavailable\n    }\n  }\n}\n"],"names":["execFileSync","setup","command","args","stdio"],"mappings":"AAAA;;;CAGC,GACD,SAASA,YAAY,QAAQ,gBAAgB;AAE7C;;;;;;;;;;CAUC,GACD,eAAe,SAASC;IACtB,KAAK,MAAM,CAACC,SAAS,GAAGC,KAAK,IAAI;QAC/B;YAAC;YAAM;YAAO;YAAQ;SAAY;QAClC;YAAC;YAAO;YAAQ;SAAY;KAC7B,CAAE;QACD,IAAI;YACFH,aAAaE,SAASC,MAAM;gBAAEC,OAAO;YAAS;QAChD,EAAE,OAAM;QACN,yEAAyE;QAC3E;IACF;AACF"}
+{"version":3,"sources":["../../../../../packages/nx-plugin/src/utils/warm-ruff-cache.ts"],"sourcesContent":["/**\n * Copyright Amazon.com, Inc. or its affiliates. All Rights Reserved.\n * SPDX-License-Identifier: Apache-2.0\n */\nimport { execFileSync } from 'child_process';\nimport { withPyVersions } from './versions';\n\n/**\n * Vitest globalSetup that warms uv's tool cache once before any worker spawns,\n * installing the exact pinned ruff the formatter runs. On a cold cache the\n * first uvx call holds an exclusive lock on uv's cache, so parallel workers\n * would otherwise stall racing it. Failure is ignored — the formatter skips\n * ruff when uv is unavailable.\n */\nexport default function setup() {\n  const ruff = withPyVersions(['ruff'])[0];\n  try {\n    execFileSync('uvx', ['--from', ruff, 'ruff', '--version'], {\n      stdio: 'ignore',\n    });\n  } catch {\n    // Ignore — the formatter skips ruff when it is unavailable\n  }\n}\n"],"names":["execFileSync","withPyVersions","setup","ruff","stdio"],"mappings":"AAAA;;;CAGC,GACD,SAASA,YAAY,QAAQ,gBAAgB;AAC7C,SAASC,cAAc,QAAQ,gBAAa;AAE5C;;;;;;CAMC,GACD,eAAe,SAASC;IACtB,MAAMC,OAAOF,eAAe;QAAC;KAAO,CAAC,CAAC,EAAE;IACxC,IAAI;QACFD,aAAa,OAAO;YAAC;YAAUG;YAAM;YAAQ;SAAY,EAAE;YACzDC,OAAO;QACT;IACF,EAAE,OAAM;IACN,2DAA2D;IAC7D;AACF"}