@aws/nx-plugin 1.0.0-rc.44 → 1.0.0-rc.46

package/src/utils/format.js.map

@@ -1 +1 @@
-{"version":3,"sources":["../../../../../packages/nx-plugin/src/utils/format.ts"],"sourcesContent":["/**\n * Copyright Amazon.com, Inc. or its affiliates. All Rights Reserved.\n * SPDX-License-Identifier: Apache-2.0\n */\n\nimport { Biome } from '@biomejs/js-api/nodejs';\nimport { getProjects, type Tree } from '@nx/devkit';\nimport { execFileSync, execSync } from 'child_process';\nimport { existsSync, readFileSync } from 'fs';\nimport { createRequire } from 'module';\nimport path from 'path';\nimport { uvxCommand } from './py';\nimport { readToml } from './toml';\n\nconst require = createRequire(import.meta.url);\n\nexport const DEFAULT_BIOME_CONFIG = {\n  $schema: 'https://biomejs.dev/schemas/2.4.16/schema.json',\n  root: true,\n  formatter: {\n    enabled: true,\n    indentStyle: 'space',\n    indentWidth: 2,\n    lineWidth: 80,\n  },\n  javascript: {\n    formatter: {\n      quoteStyle: 'single',\n      trailingCommas: 'all',\n    },\n  },\n  css: {\n    formatter: {\n      quoteStyle: 'single',\n    },\n    linter: {\n      enabled: false,\n    },\n  },\n  linter: {\n    enabled: true,\n    rules: {\n      recommended: false,\n      correctness: {\n        noUndeclaredDependencies: 'warn',\n      },\n    },\n  },\n  assist: {\n    actions: {\n      source: {\n        organizeImports: 'on',\n      },\n    },\n  },\n  files: {\n    includes: [\n      '**',\n      '!**/dist',\n      '!**/out-tsc',\n      '!**/node_modules',\n      '!**/.nx',\n      '!**/.venv',\n      '!**/*.css',\n      '!**/*.gen.*',\n      '!**/generated/**',\n      '!**/tsconfig*.json',\n    ],\n  },\n};\n\nconst BIOME_FORMATTABLE_EXTENSIONS = new Set([\n  '.ts',\n  '.tsx',\n  '.js',\n  '.jsx',\n  '.mjs',\n  '.cjs',\n  '.mts',\n  '.cts',\n  '.json',\n  '.jsonc',\n  '.css',\n]);\n\n/** Matches `tsconfig.json` and variants like `tsconfig.lib.json`. */\nconst isTsConfig = (filePath: string): boolean =>\n  /(^|\\/)tsconfig[^/]*\\.json$/.test(filePath);\n\n/**\n * Format files in the given directory within the tree.\n * Handles both TypeScript/JavaScript/JSON (via biome) and Python (via ruff) files.\n * See https://github.com/nrwl/nx/blob/4cd640a9187954505d12de5b6d76a90d8ce4c2eb/packages/devkit/src/generators/format-files.ts#L11\n */\nexport async function formatFilesInSubtree(\n  tree: Tree,\n  dir?: string,\n): Promise<void> {\n  const changedFiles = tree\n    .listChanges()\n    .filter((file) => file.type !== 'DELETE')\n    .filter((file) => (dir ? file.path.startsWith(dir) : true));\n\n  const pyFiles = changedFiles.filter((file) => file.path.endsWith('.py'));\n  const otherFiles = changedFiles.filter(\n    (file) =>\n      BIOME_FORMATTABLE_EXTENSIONS.has(path.extname(file.path)) &&\n      // tsconfigs are not biome-managed: they're excluded from the vended\n      // format target (Nx's typescript-sync rewrites them without formatting),\n      // so formatting them at generation would only diverge from the form\n      // written on later runs. Leave them as updateJson/writeJson emit them so\n      // repeated generation stays idempotent.\n      !isTsConfig(file.path),\n  );\n\n  // Resolve each project's ruff settings (module names, line-length) so files\n  // are formatted to match the on-disk build (see getPythonProjectRuffConfigs).\n  const pythonProjectConfigs = pyFiles.length\n    ? getPythonProjectRuffConfigs(tree)\n    : [];\n\n  // Format Python files with ruff (lint fixes + formatting)\n  for (const file of pyFiles) {\n    try {\n      const content = ruffFixAndFormat(\n        file.content.toString('utf-8'),\n        file.path,\n        hasRuffConfigOnDisk(tree, file.path),\n        getOwningProjectRuffConfig(file.path, pythonProjectConfigs),\n      );\n      tree.write(file.path, content);\n    } catch {\n      // Silently skip ruff formatting failures\n    }\n  }\n\n  if (otherFiles.length === 0) return;\n\n  // Use the workspace's own Biome CLI (its version and config) when biome.json\n  // exists on disk; otherwise format via the bundled library API with the\n  // in-memory tree config. The CLI path does not see in-tree config changes.\n  if (existsSync(path.join(tree.root, 'biome.json'))) {\n    formatWithBiomeCli(tree, otherFiles);\n  } else {\n    formatWithBiomeApi(tree, otherFiles);\n  }\n}\n\n/**\n * Format files via the workspace's Biome CLI, run from the workspace root so it\n * discovers the on-disk biome.json.\n */\nfunction formatWithBiomeCli(\n  tree: Tree,\n  files: { path: string; content: Buffer | null }[],\n): void {\n  const biome = getBiomeCommand(tree.root);\n  if (!biome) {\n    // Fall back to the library API if the CLI cannot be resolved\n    formatWithBiomeApi(tree, files);\n    return;\n  }\n\n  for (const file of files) {\n    try {\n      const content = execFileSync(\n        biome.command,\n        [...biome.args, 'format', `--stdin-file-path=${file.path}`],\n        {\n          input: file.content?.toString('utf-8') ?? '',\n          encoding: 'utf-8',\n          cwd: tree.root,\n          stdio: ['pipe', 'pipe', 'pipe'],\n        },\n      );\n      tree.write(file.path, content);\n    } catch {\n      // Leave individual files that fail to format untouched\n    }\n  }\n}\n\n/**\n * Format files via the bundled Biome library API, applying the in-memory tree\n * config.\n */\nfunction formatWithBiomeApi(\n  tree: Tree,\n  files: { path: string; content: Buffer | null }[],\n): void {\n  try {\n    const biome = new Biome();\n    const { projectKey } = biome.openProject();\n    // Apply the workspace biome.json if it exists in the tree, otherwise the defaults.\n    const treeConfig = tree.read('biome.json', 'utf-8');\n    biome.applyConfiguration(\n      projectKey,\n      treeConfig ? JSON.parse(treeConfig) : DEFAULT_BIOME_CONFIG,\n    );\n\n    for (const file of files) {\n      try {\n        const { content } = biome.formatContent(\n          projectKey,\n          file.content?.toString('utf-8') ?? '',\n          { filePath: file.path },\n        );\n        tree.write(file.path, content);\n      } catch {\n        // Leave individual files that fail to format untouched\n      }\n    }\n  } catch {\n    // Silently skip formatting failures\n  }\n}\n\ninterface BiomeCommand {\n  command: string;\n  args: string[];\n}\n\n/**\n * Resolve the `@biomejs/biome` CLI from the user's workspace, falling back to a\n * `biome` binary on the PATH.\n */\nconst _biomeCommands = new Map<string, BiomeCommand | null>();\nfunction getBiomeCommand(root: string): BiomeCommand | undefined {\n  if (_biomeCommands.has(root)) {\n    return _biomeCommands.get(root) ?? undefined;\n  }\n\n  // Run via node for cross-platform execution of the bin shim.\n  try {\n    const pkgJsonPath = require.resolve('@biomejs/biome/package.json', {\n      paths: [root, import.meta.dirname],\n    });\n    const pkgJson = JSON.parse(readFileSync(pkgJsonPath, 'utf-8'));\n    const binRelative =\n      typeof pkgJson.bin === 'string' ? pkgJson.bin : pkgJson.bin?.biome;\n    if (binRelative) {\n      const binPath = path.join(path.dirname(pkgJsonPath), binRelative);\n      const command = { command: process.execPath, args: [binPath] };\n      _biomeCommands.set(root, command);\n      return command;\n    }\n  } catch {\n    // Fall back to a biome binary on the PATH\n  }\n\n  try {\n    execSync('biome --version', {\n      encoding: 'utf-8',\n      stdio: ['pipe', 'pipe', 'pipe'],\n    });\n    const command = { command: 'biome', args: [] };\n    _biomeCommands.set(root, command);\n    return command;\n  } catch {\n    _biomeCommands.set(root, null);\n    return undefined;\n  }\n}\n\n/**\n * Find the ruff command: `uvx --from ruff==<version> ruff`. uvx works\n * regardless of workspace resolution state (unlike `uv run ruff`, which fails\n * while installs are deferred), and the version pin matches the project's\n * `format` target (PY_VERSIONS) so generation and check format identically.\n * Only a successful probe is cached — ruff can become available mid-run in the\n * long-lived Nx daemon, so a cached failure would skip formatting thereafter.\n */\nlet _ruffCommand: string | undefined;\nfunction getRuffCommand(): string | undefined {\n  if (_ruffCommand) {\n    return _ruffCommand;\n  }\n  const cmd = uvxCommand('ruff');\n  try {\n    execSync(`${cmd} --version`, {\n      encoding: 'utf-8',\n      stdio: ['pipe', 'pipe', 'pipe'],\n    });\n    _ruffCommand = cmd;\n    return cmd;\n  } catch {\n    return undefined;\n  }\n}\n\n/**\n * Whether ruff would discover a config on disk for a file, by walking from its\n * directory up to the workspace root looking for `.ruff.toml`, `ruff.toml`, or a\n * `pyproject.toml` with a `[tool.ruff]` section — the same files ruff itself\n * resolves. The walk stops at `tree.root` so a stray config in a parent of the\n * workspace (or the home directory) is never treated as the project's. Used to\n * decide whether to nudge ruff towards import sorting (see\n * {@link ruffFixAndFormat}).\n */\nfunction hasRuffConfigOnDisk(tree: Tree, filePath: string): boolean {\n  const root = path.resolve(tree.root);\n  let dir = path.resolve(root, path.dirname(filePath));\n  while (true) {\n    if (\n      existsSync(path.join(dir, '.ruff.toml')) ||\n      existsSync(path.join(dir, 'ruff.toml'))\n    ) {\n      return true;\n    }\n    const pyproject = path.join(dir, 'pyproject.toml');\n    if (\n      existsSync(pyproject) &&\n      readFileSync(pyproject, 'utf-8').includes('[tool.ruff')\n    ) {\n      return true;\n    }\n    const parent = path.dirname(dir);\n    // Stop once the workspace root has been checked (or we hit the FS root).\n    if (dir === root || parent === dir) {\n      return false;\n    }\n    dir = parent;\n  }\n}\n\ninterface PythonProjectRuffConfig {\n  /** Project root, normalised to use forward slashes. */\n  readonly root: string;\n  /** Top-level importable module names declared by the project. */\n  readonly modules: string[];\n  /** The project's `[tool.ruff].line-length`, if set. */\n  readonly lineLength?: number;\n  /**\n   * Ruff `target-version` (eg `py314`) derived from `[project].requires-python`.\n   * Generation formats via stdin with no pyproject, so it must be passed\n   * explicitly — ruff's formatting differs by target.\n   */\n  readonly targetVersion?: string;\n}\n\n/**\n * Derive ruff's `target-version` (eg `py314`) from a PEP 508\n * `requires-python` specifier (eg `>=3.14`). Ruff targets the minimum\n * supported version, so take the lowest `major.minor` mentioned.\n */\nexport const requiresPythonToRuffTarget = (\n  requiresPython: unknown,\n): string | undefined => {\n  if (typeof requiresPython !== 'string') {\n    return undefined;\n  }\n  let min: { major: number; minor: number } | undefined;\n  for (const match of requiresPython.matchAll(/(\\d+)\\.(\\d+)/g)) {\n    const major = Number(match[1]);\n    const minor = Number(match[2]);\n    if (\n      !min ||\n      major < min.major ||\n      (major === min.major && minor < min.minor)\n    ) {\n      min = { major, minor };\n    }\n  }\n  return min ? `py${min.major}${min.minor}` : undefined;\n};\n\n/**\n * Map each Nx project with a `pyproject.toml` to the ruff settings the on-disk\n * build enforces for it: its top-level module names (from\n * `[tool.hatch.build.targets.wheel].packages`) and its `[tool.ruff].line-length`.\n */\nfunction getPythonProjectRuffConfigs(tree: Tree): PythonProjectRuffConfig[] {\n  const configs: PythonProjectRuffConfig[] = [];\n\n  for (const project of getProjects(tree).values()) {\n    const pyprojectPath = path.join(project.root, 'pyproject.toml');\n    if (tree.exists(pyprojectPath)) {\n      try {\n        const pyproject = readToml(tree, pyprojectPath) as any;\n        const wheelPackages: unknown =\n          pyproject?.tool?.hatch?.build?.targets?.wheel?.packages;\n        // Record the top-level module segment (`pkg/sub` -> `pkg`), which is\n        // all `known-first-party` keys off.\n        const modules = Array.isArray(wheelPackages)\n          ? wheelPackages\n              .filter((pkg): pkg is string => typeof pkg === 'string' && !!pkg)\n              .map((pkg) => pkg.split('/')[0])\n          : [];\n        const lineLength: unknown = pyproject?.tool?.ruff?.['line-length'];\n        const targetVersion = requiresPythonToRuffTarget(\n          pyproject?.project?.['requires-python'],\n        );\n        if (modules.length || typeof lineLength === 'number' || targetVersion) {\n          configs.push({\n            root: project.root.split(path.sep).join('/'),\n            modules,\n            lineLength: typeof lineLength === 'number' ? lineLength : undefined,\n            targetVersion,\n          });\n        }\n      } catch {\n        // Skip projects whose pyproject.toml cannot be parsed\n      }\n    }\n  }\n\n  return configs;\n}\n\n/**\n * Resolve the ruff config for the project that owns a file (the project with\n * the longest root that is a prefix of the file path). Ruff runs per-project on\n * disk, so a file's settings come from its own project — only its own module is\n * first-party (sibling workspace packages are third-party) and its own\n * line-length applies — and scoping this way keeps in-tree formatting\n * consistent with the on-disk build.\n */\nfunction getOwningProjectRuffConfig(\n  filePath: string,\n  configs: PythonProjectRuffConfig[],\n): PythonProjectRuffConfig | undefined {\n  let owner: PythonProjectRuffConfig | undefined;\n  for (const config of configs) {\n    if (\n      (filePath === config.root || filePath.startsWith(`${config.root}/`)) &&\n      (!owner || config.root.length > owner.root.length)\n    ) {\n      owner = config;\n    }\n  }\n  return owner;\n}\n\n/**\n * Run ruff check --fix and ruff format on Python file content via stdin.\n * Applies all configured lint fixes (including import sorting) and formatting.\n *\n * When no ruff config exists on disk (`hasConfig` false) ruff falls back to its\n * defaults, which omit isort — but generated projects enable rule `I` and their\n * build fails on unsorted imports (I001). In that case we add `--extend-select\n * I` so import sorting matches what the build enforces. When a config does\n * exist we defer to it entirely, honouring the user's rule selection.\n *\n * `projectConfig` carries the owning project's ruff settings, which ruff cannot\n * detect from the filesystem during generation because the project lives only\n * in the tree. We pass them via `--config` so in-tree formatting matches the\n * on-disk build: `known-first-party` (the project's own modules) keeps its\n * imports in their own group, and `line-length` keeps wrapping consistent (the\n * generated config raises it above ruff's default of 88). These are additive to\n * any on-disk config, so they are safe to pass regardless of `hasConfig`.\n */\nfunction ruffFixAndFormat(\n  content: string,\n  filePath: string,\n  hasConfig: boolean,\n  projectConfig?: PythonProjectRuffConfig,\n): string {\n  const ruff = getRuffCommand();\n  if (!ruff) return content;\n\n  const extendSelect = hasConfig ? '' : ' --extend-select I';\n  const configArgs: string[] = [];\n  if (projectConfig?.modules.length) {\n    configArgs.push(\n      `lint.isort.known-first-party = ${JSON.stringify(projectConfig.modules)}`,\n    );\n  }\n  if (typeof projectConfig?.lineLength === 'number') {\n    configArgs.push(`line-length = ${projectConfig.lineLength}`);\n  }\n  if (projectConfig?.targetVersion) {\n    configArgs.push(`target-version = \"${projectConfig.targetVersion}\"`);\n  }\n  const config = configArgs\n    .map((arg) => ` --config ${JSON.stringify(arg)}`)\n    .join('');\n\n  // First apply lint fixes (import sorting, unused imports, etc.)\n  try {\n    const result = execSync(\n      `${ruff} check --fix${extendSelect}${config} --stdin-filename ${filePath} -`,\n      { input: content, encoding: 'utf-8', stdio: ['pipe', 'pipe', 'pipe'] },\n    );\n    content = result;\n  } catch (e: any) {\n    // ruff check exits non-zero when it finds unfixable issues,\n    // but stdout still contains the fixed content\n    if (e.stdout) {\n      content = e.stdout;\n    }\n  }\n\n  // Then apply formatting\n  try {\n    content = execSync(\n      `${ruff} format${config} --stdin-filename ${filePath} -`,\n      {\n        input: content,\n        encoding: 'utf-8',\n        stdio: ['pipe', 'pipe', 'pipe'],\n      },\n    );\n  } catch {\n    // Fall through with whatever content we have\n  }\n\n  return content;\n}\n"],"names":["Biome","getProjects","execFileSync","execSync","existsSync","readFileSync","createRequire","path","uvxCommand","readToml","require","url","DEFAULT_BIOME_CONFIG","$schema","root","formatter","enabled","indentStyle","indentWidth","lineWidth","javascript","quoteStyle","trailingCommas","css","linter","rules","recommended","correctness","noUndeclaredDependencies","assist","actions","source","organizeImports","files","includes","BIOME_FORMATTABLE_EXTENSIONS","Set","isTsConfig","filePath","test","formatFilesInSubtree","tree","dir","changedFiles","listChanges","filter","file","type","startsWith","pyFiles","endsWith","otherFiles","has","extname","pythonProjectConfigs","length","getPythonProjectRuffConfigs","content","ruffFixAndFormat","toString","hasRuffConfigOnDisk","getOwningProjectRuffConfig","write","join","formatWithBiomeCli","formatWithBiomeApi","biome","getBiomeCommand","command","args","input","encoding","cwd","stdio","projectKey","openProject","treeConfig","read","applyConfiguration","JSON","parse","formatContent","_biomeCommands","Map","get","undefined","pkgJsonPath","resolve","paths","dirname","pkgJson","binRelative","bin","binPath","process","execPath","set","_ruffCommand","getRuffCommand","cmd","pyproject","parent","requiresPythonToRuffTarget","requiresPython","min","match","matchAll","major","Number","minor","configs","project","values","pyprojectPath","exists","wheelPackages","tool","hatch","build","targets","wheel","packages","modules","Array","isArray","pkg","map","split","lineLength","ruff","targetVersion","push","sep","owner","config","hasConfig","projectConfig","extendSelect","configArgs","stringify","arg","result","e","stdout"],"mappings":"AAAA;;;CAGC,GAED,SAASA,KAAK,QAAQ,yBAAyB;AAC/C,SAASC,WAAW,QAAmB,aAAa;AACpD,SAASC,YAAY,EAAEC,QAAQ,QAAQ,gBAAgB;AACvD,SAASC,UAAU,EAAEC,YAAY,QAAQ,KAAK;AAC9C,SAASC,aAAa,QAAQ,SAAS;AACvC,OAAOC,UAAU,OAAO;AACxB,SAASC,UAAU,QAAQ,UAAO;AAClC,SAASC,QAAQ,QAAQ,YAAS;AAElC,MAAMC,UAAUJ,cAAc,YAAYK,GAAG;AAE7C,OAAO,MAAMC,uBAAuB;IAClCC,SAAS;IACTC,MAAM;IACNC,WAAW;QACTC,SAAS;QACTC,aAAa;QACbC,aAAa;QACbC,WAAW;IACb;IACAC,YAAY;QACVL,WAAW;YACTM,YAAY;YACZC,gBAAgB;QAClB;IACF;IACAC,KAAK;QACHR,WAAW;YACTM,YAAY;QACd;QACAG,QAAQ;YACNR,SAAS;QACX;IACF;IACAQ,QAAQ;QACNR,SAAS;QACTS,OAAO;YACLC,aAAa;YACbC,aAAa;gBACXC,0BAA0B;YAC5B;QACF;IACF;IACAC,QAAQ;QACNC,SAAS;YACPC,QAAQ;gBACNC,iBAAiB;YACnB;QACF;IACF;IACAC,OAAO;QACLC,UAAU;YACR;YACA;YACA;YACA;YACA;YACA;YACA;YACA;YACA;YACA;SACD;IACH;AACF,EAAE;AAEF,MAAMC,+BAA+B,IAAIC,IAAI;IAC3C;IACA;IACA;IACA;IACA;IACA;IACA;IACA;IACA;IACA;IACA;CACD;AAED,mEAAmE,GACnE,MAAMC,aAAa,CAACC,WAClB,6BAA6BC,IAAI,CAACD;AAEpC;;;;CAIC,GACD,OAAO,eAAeE,qBACpBC,IAAU,EACVC,GAAY;IAEZ,MAAMC,eAAeF,KAClBG,WAAW,GACXC,MAAM,CAAC,CAACC,OAASA,KAAKC,IAAI,KAAK,UAC/BF,MAAM,CAAC,CAACC,OAAUJ,MAAMI,KAAKvC,IAAI,CAACyC,UAAU,CAACN,OAAO;IAEvD,MAAMO,UAAUN,aAAaE,MAAM,CAAC,CAACC,OAASA,KAAKvC,IAAI,CAAC2C,QAAQ,CAAC;IACjE,MAAMC,aAAaR,aAAaE,MAAM,CACpC,CAACC,OACCX,6BAA6BiB,GAAG,CAAC7C,KAAK8C,OAAO,CAACP,KAAKvC,IAAI,MACvD,oEAAoE;QACpE,yEAAyE;QACzE,oEAAoE;QACpE,yEAAyE;QACzE,wCAAwC;QACxC,CAAC8B,WAAWS,KAAKvC,IAAI;IAGzB,4EAA4E;IAC5E,8EAA8E;IAC9E,MAAM+C,uBAAuBL,QAAQM,MAAM,GACvCC,4BAA4Bf,QAC5B,EAAE;IAEN,0DAA0D;IAC1D,KAAK,MAAMK,QAAQG,QAAS;QAC1B,IAAI;YACF,MAAMQ,UAAUC,iBACdZ,KAAKW,OAAO,CAACE,QAAQ,CAAC,UACtBb,KAAKvC,IAAI,EACTqD,oBAAoBnB,MAAMK,KAAKvC,IAAI,GACnCsD,2BAA2Bf,KAAKvC,IAAI,EAAE+C;YAExCb,KAAKqB,KAAK,CAAChB,KAAKvC,IAAI,EAAEkD;QACxB,EAAE,OAAM;QACN,yCAAyC;QAC3C;IACF;IAEA,IAAIN,WAAWI,MAAM,KAAK,GAAG;IAE7B,6EAA6E;IAC7E,wEAAwE;IACxE,2EAA2E;IAC3E,IAAInD,WAAWG,KAAKwD,IAAI,CAACtB,KAAK3B,IAAI,EAAE,gBAAgB;QAClDkD,mBAAmBvB,MAAMU;IAC3B,OAAO;QACLc,mBAAmBxB,MAAMU;IAC3B;AACF;AAEA;;;CAGC,GACD,SAASa,mBACPvB,IAAU,EACVR,KAAiD;IAEjD,MAAMiC,QAAQC,gBAAgB1B,KAAK3B,IAAI;IACvC,IAAI,CAACoD,OAAO;QACV,6DAA6D;QAC7DD,mBAAmBxB,MAAMR;QACzB;IACF;IAEA,KAAK,MAAMa,QAAQb,MAAO;QACxB,IAAI;YACF,MAAMwB,UAAUvD,aACdgE,MAAME,OAAO,EACb;mBAAIF,MAAMG,IAAI;gBAAE;gBAAU,CAAC,kBAAkB,EAAEvB,KAAKvC,IAAI,EAAE;aAAC,EAC3D;gBACE+D,OAAOxB,KAAKW,OAAO,EAAEE,SAAS,YAAY;gBAC1CY,UAAU;gBACVC,KAAK/B,KAAK3B,IAAI;gBACd2D,OAAO;oBAAC;oBAAQ;oBAAQ;iBAAO;YACjC;YAEFhC,KAAKqB,KAAK,CAAChB,KAAKvC,IAAI,EAAEkD;QACxB,EAAE,OAAM;QACN,uDAAuD;QACzD;IACF;AACF;AAEA;;;CAGC,GACD,SAASQ,mBACPxB,IAAU,EACVR,KAAiD;IAEjD,IAAI;QACF,MAAMiC,QAAQ,IAAIlE;QAClB,MAAM,EAAE0E,UAAU,EAAE,GAAGR,MAAMS,WAAW;QACxC,mFAAmF;QACnF,MAAMC,aAAanC,KAAKoC,IAAI,CAAC,cAAc;QAC3CX,MAAMY,kBAAkB,CACtBJ,YACAE,aAAaG,KAAKC,KAAK,CAACJ,cAAchE;QAGxC,KAAK,MAAMkC,QAAQb,MAAO;YACxB,IAAI;gBACF,MAAM,EAAEwB,OAAO,EAAE,GAAGS,MAAMe,aAAa,CACrCP,YACA5B,KAAKW,OAAO,EAAEE,SAAS,YAAY,IACnC;oBAAErB,UAAUQ,KAAKvC,IAAI;gBAAC;gBAExBkC,KAAKqB,KAAK,CAAChB,KAAKvC,IAAI,EAAEkD;YACxB,EAAE,OAAM;YACN,uDAAuD;YACzD;QACF;IACF,EAAE,OAAM;IACN,oCAAoC;IACtC;AACF;AAOA;;;CAGC,GACD,MAAMyB,iBAAiB,IAAIC;AAC3B,SAAShB,gBAAgBrD,IAAY;IACnC,IAAIoE,eAAe9B,GAAG,CAACtC,OAAO;QAC5B,OAAOoE,eAAeE,GAAG,CAACtE,SAASuE;IACrC;IAEA,6DAA6D;IAC7D,IAAI;QACF,MAAMC,cAAc5E,QAAQ6E,OAAO,CAAC,+BAA+B;YACjEC,OAAO;gBAAC1E;gBAAM,YAAY2E,OAAO;aAAC;QACpC;QACA,MAAMC,UAAUX,KAAKC,KAAK,CAAC3E,aAAaiF,aAAa;QACrD,MAAMK,cACJ,OAAOD,QAAQE,GAAG,KAAK,WAAWF,QAAQE,GAAG,GAAGF,QAAQE,GAAG,EAAE1B;QAC/D,IAAIyB,aAAa;YACf,MAAME,UAAUtF,KAAKwD,IAAI,CAACxD,KAAKkF,OAAO,CAACH,cAAcK;YACrD,MAAMvB,UAAU;gBAAEA,SAAS0B,QAAQC,QAAQ;gBAAE1B,MAAM;oBAACwB;iBAAQ;YAAC;YAC7DX,eAAec,GAAG,CAAClF,MAAMsD;YACzB,OAAOA;QACT;IACF,EAAE,OAAM;IACN,0CAA0C;IAC5C;IAEA,IAAI;QACFjE,SAAS,mBAAmB;YAC1BoE,UAAU;YACVE,OAAO;gBAAC;gBAAQ;gBAAQ;aAAO;QACjC;QACA,MAAML,UAAU;YAAEA,SAAS;YAASC,MAAM,EAAE;QAAC;QAC7Ca,eAAec,GAAG,CAAClF,MAAMsD;QACzB,OAAOA;IACT,EAAE,OAAM;QACNc,eAAec,GAAG,CAAClF,MAAM;QACzB,OAAOuE;IACT;AACF;AAEA;;;;;;;CAOC,GACD,IAAIY;AACJ,SAASC;IACP,IAAID,cAAc;QAChB,OAAOA;IACT;IACA,MAAME,MAAM3F,WAAW;IACvB,IAAI;QACFL,SAAS,GAAGgG,IAAI,UAAU,CAAC,EAAE;YAC3B5B,UAAU;YACVE,OAAO;gBAAC;gBAAQ;gBAAQ;aAAO;QACjC;QACAwB,eAAeE;QACf,OAAOA;IACT,EAAE,OAAM;QACN,OAAOd;IACT;AACF;AAEA;;;;;;;;CAQC,GACD,SAASzB,oBAAoBnB,IAAU,EAAEH,QAAgB;IACvD,MAAMxB,OAAOP,KAAKgF,OAAO,CAAC9C,KAAK3B,IAAI;IACnC,IAAI4B,MAAMnC,KAAKgF,OAAO,CAACzE,MAAMP,KAAKkF,OAAO,CAACnD;IAC1C,MAAO,KAAM;QACX,IACElC,WAAWG,KAAKwD,IAAI,CAACrB,KAAK,kBAC1BtC,WAAWG,KAAKwD,IAAI,CAACrB,KAAK,eAC1B;YACA,OAAO;QACT;QACA,MAAM0D,YAAY7F,KAAKwD,IAAI,CAACrB,KAAK;QACjC,IACEtC,WAAWgG,cACX/F,aAAa+F,WAAW,SAASlE,QAAQ,CAAC,eAC1C;YACA,OAAO;QACT;QACA,MAAMmE,SAAS9F,KAAKkF,OAAO,CAAC/C;QAC5B,yEAAyE;QACzE,IAAIA,QAAQ5B,QAAQuF,WAAW3D,KAAK;YAClC,OAAO;QACT;QACAA,MAAM2D;IACR;AACF;AAiBA;;;;CAIC,GACD,OAAO,MAAMC,6BAA6B,CACxCC;IAEA,IAAI,OAAOA,mBAAmB,UAAU;QACtC,OAAOlB;IACT;IACA,IAAImB;IACJ,KAAK,MAAMC,SAASF,eAAeG,QAAQ,CAAC,iBAAkB;QAC5D,MAAMC,QAAQC,OAAOH,KAAK,CAAC,EAAE;QAC7B,MAAMI,QAAQD,OAAOH,KAAK,CAAC,EAAE;QAC7B,IACE,CAACD,OACDG,QAAQH,IAAIG,KAAK,IAChBA,UAAUH,IAAIG,KAAK,IAAIE,QAAQL,IAAIK,KAAK,EACzC;YACAL,MAAM;gBAAEG;gBAAOE;YAAM;QACvB;IACF;IACA,OAAOL,MAAM,CAAC,EAAE,EAAEA,IAAIG,KAAK,GAAGH,IAAIK,KAAK,EAAE,GAAGxB;AAC9C,EAAE;AAEF;;;;CAIC,GACD,SAAS7B,4BAA4Bf,IAAU;IAC7C,MAAMqE,UAAqC,EAAE;IAE7C,KAAK,MAAMC,WAAW9G,YAAYwC,MAAMuE,MAAM,GAAI;QAChD,MAAMC,gBAAgB1G,KAAKwD,IAAI,CAACgD,QAAQjG,IAAI,EAAE;QAC9C,IAAI2B,KAAKyE,MAAM,CAACD,gBAAgB;YAC9B,IAAI;gBACF,MAAMb,YAAY3F,SAASgC,MAAMwE;gBACjC,MAAME,gBACJf,WAAWgB,MAAMC,OAAOC,OAAOC,SAASC,OAAOC;gBACjD,qEAAqE;gBACrE,oCAAoC;gBACpC,MAAMC,UAAUC,MAAMC,OAAO,CAACT,iBAC1BA,cACGtE,MAAM,CAAC,CAACgF,MAAuB,OAAOA,QAAQ,YAAY,CAAC,CAACA,KAC5DC,GAAG,CAAC,CAACD,MAAQA,IAAIE,KAAK,CAAC,IAAI,CAAC,EAAE,IACjC,EAAE;gBACN,MAAMC,aAAsB5B,WAAWgB,MAAMa,MAAM,CAAC,cAAc;gBAClE,MAAMC,gBAAgB5B,2BACpBF,WAAWW,SAAS,CAAC,kBAAkB;gBAEzC,IAAIW,QAAQnE,MAAM,IAAI,OAAOyE,eAAe,YAAYE,eAAe;oBACrEpB,QAAQqB,IAAI,CAAC;wBACXrH,MAAMiG,QAAQjG,IAAI,CAACiH,KAAK,CAACxH,KAAK6H,GAAG,EAAErE,IAAI,CAAC;wBACxC2D;wBACAM,YAAY,OAAOA,eAAe,WAAWA,aAAa3C;wBAC1D6C;oBACF;gBACF;YACF,EAAE,OAAM;YACN,sDAAsD;YACxD;QACF;IACF;IAEA,OAAOpB;AACT;AAEA;;;;;;;CAOC,GACD,SAASjD,2BACPvB,QAAgB,EAChBwE,OAAkC;IAElC,IAAIuB;IACJ,KAAK,MAAMC,UAAUxB,QAAS;QAC5B,IACE,AAACxE,CAAAA,aAAagG,OAAOxH,IAAI,IAAIwB,SAASU,UAAU,CAAC,GAAGsF,OAAOxH,IAAI,CAAC,CAAC,CAAC,CAAA,KACjE,CAAA,CAACuH,SAASC,OAAOxH,IAAI,CAACyC,MAAM,GAAG8E,MAAMvH,IAAI,CAACyC,MAAM,AAAD,GAChD;YACA8E,QAAQC;QACV;IACF;IACA,OAAOD;AACT;AAEA;;;;;;;;;;;;;;;;;CAiBC,GACD,SAAS3E,iBACPD,OAAe,EACfnB,QAAgB,EAChBiG,SAAkB,EAClBC,aAAuC;IAEvC,MAAMP,OAAO/B;IACb,IAAI,CAAC+B,MAAM,OAAOxE;IAElB,MAAMgF,eAAeF,YAAY,KAAK;IACtC,MAAMG,aAAuB,EAAE;IAC/B,IAAIF,eAAed,QAAQnE,QAAQ;QACjCmF,WAAWP,IAAI,CACb,CAAC,+BAA+B,EAAEpD,KAAK4D,SAAS,CAACH,cAAcd,OAAO,GAAG;IAE7E;IACA,IAAI,OAAOc,eAAeR,eAAe,UAAU;QACjDU,WAAWP,IAAI,CAAC,CAAC,cAAc,EAAEK,cAAcR,UAAU,EAAE;IAC7D;IACA,IAAIQ,eAAeN,eAAe;QAChCQ,WAAWP,IAAI,CAAC,CAAC,kBAAkB,EAAEK,cAAcN,aAAa,CAAC,CAAC,CAAC;IACrE;IACA,MAAMI,SAASI,WACZZ,GAAG,CAAC,CAACc,MAAQ,CAAC,UAAU,EAAE7D,KAAK4D,SAAS,CAACC,MAAM,EAC/C7E,IAAI,CAAC;IAER,gEAAgE;IAChE,IAAI;QACF,MAAM8E,SAAS1I,SACb,GAAG8H,KAAK,YAAY,EAAEQ,eAAeH,OAAO,kBAAkB,EAAEhG,SAAS,EAAE,CAAC,EAC5E;YAAEgC,OAAOb;YAASc,UAAU;YAASE,OAAO;gBAAC;gBAAQ;gBAAQ;aAAO;QAAC;QAEvEhB,UAAUoF;IACZ,EAAE,OAAOC,GAAQ;QACf,4DAA4D;QAC5D,8CAA8C;QAC9C,IAAIA,EAAEC,MAAM,EAAE;YACZtF,UAAUqF,EAAEC,MAAM;QACpB;IACF;IAEA,wBAAwB;IACxB,IAAI;QACFtF,UAAUtD,SACR,GAAG8H,KAAK,OAAO,EAAEK,OAAO,kBAAkB,EAAEhG,SAAS,EAAE,CAAC,EACxD;YACEgC,OAAOb;YACPc,UAAU;YACVE,OAAO;gBAAC;gBAAQ;gBAAQ;aAAO;QACjC;IAEJ,EAAE,OAAM;IACN,6CAA6C;IAC/C;IAEA,OAAOhB;AACT"}
+{"version":3,"sources":["../../../../../packages/nx-plugin/src/utils/format.ts"],"sourcesContent":["/**\n * Copyright Amazon.com, Inc. or its affiliates. All Rights Reserved.\n * SPDX-License-Identifier: Apache-2.0\n */\n\nimport { Biome } from '@biomejs/js-api/nodejs';\nimport { getProjects, type Tree } from '@nx/devkit';\nimport { execFileSync, execSync } from 'child_process';\nimport { existsSync, readFileSync } from 'fs';\nimport { createRequire } from 'module';\nimport path from 'path';\nimport { uvxCommand } from './py';\nimport { readToml } from './toml';\nimport { TS_VERSIONS } from './versions';\n\nconst require = createRequire(import.meta.url);\n\nexport const DEFAULT_BIOME_CONFIG = {\n  $schema: `https://biomejs.dev/schemas/${TS_VERSIONS['@biomejs/biome']}/schema.json`,\n  root: true,\n  formatter: {\n    enabled: true,\n    indentStyle: 'space',\n    indentWidth: 2,\n    lineWidth: 80,\n  },\n  javascript: {\n    formatter: {\n      quoteStyle: 'single',\n      trailingCommas: 'all',\n    },\n  },\n  css: {\n    formatter: {\n      quoteStyle: 'single',\n    },\n    linter: {\n      enabled: false,\n    },\n  },\n  linter: {\n    enabled: true,\n    rules: {\n      preset: 'none',\n      correctness: {\n        noUndeclaredDependencies: 'warn',\n      },\n    },\n  },\n  assist: {\n    actions: {\n      source: {\n        organizeImports: 'on',\n      },\n    },\n  },\n  files: {\n    includes: [\n      '**',\n      '!**/dist',\n      '!**/out-tsc',\n      '!**/node_modules',\n      '!**/.nx',\n      '!**/.venv',\n      '!**/*.css',\n      '!**/*.gen.*',\n      '!**/generated/**',\n      '!**/tsconfig*.json',\n    ],\n  },\n};\n\nconst BIOME_FORMATTABLE_EXTENSIONS = new Set([\n  '.ts',\n  '.tsx',\n  '.js',\n  '.jsx',\n  '.mjs',\n  '.cjs',\n  '.mts',\n  '.cts',\n  '.json',\n  '.jsonc',\n  '.css',\n]);\n\n/** Matches `tsconfig.json` and variants like `tsconfig.lib.json`. */\nconst isTsConfig = (filePath: string): boolean =>\n  /(^|\\/)tsconfig[^/]*\\.json$/.test(filePath);\n\n/**\n * Format files in the given directory within the tree.\n * Handles both TypeScript/JavaScript/JSON (via biome) and Python (via ruff) files.\n * See https://github.com/nrwl/nx/blob/4cd640a9187954505d12de5b6d76a90d8ce4c2eb/packages/devkit/src/generators/format-files.ts#L11\n */\nexport async function formatFilesInSubtree(\n  tree: Tree,\n  dir?: string,\n): Promise<void> {\n  const changedFiles = tree\n    .listChanges()\n    .filter((file) => file.type !== 'DELETE')\n    .filter((file) => (dir ? file.path.startsWith(dir) : true));\n\n  const pyFiles = changedFiles.filter((file) => file.path.endsWith('.py'));\n  const otherFiles = changedFiles.filter(\n    (file) =>\n      BIOME_FORMATTABLE_EXTENSIONS.has(path.extname(file.path)) &&\n      // tsconfigs are not biome-managed: they're excluded from the vended\n      // format target (Nx's typescript-sync rewrites them without formatting),\n      // so formatting them at generation would only diverge from the form\n      // written on later runs. Leave them as updateJson/writeJson emit them so\n      // repeated generation stays idempotent.\n      !isTsConfig(file.path),\n  );\n\n  // Resolve each project's ruff settings (module names, line-length) so files\n  // are formatted to match the on-disk build (see getPythonProjectRuffConfigs).\n  const pythonProjectConfigs = pyFiles.length\n    ? getPythonProjectRuffConfigs(tree)\n    : [];\n\n  // Format Python files with ruff (lint fixes + formatting)\n  for (const file of pyFiles) {\n    try {\n      const content = ruffFixAndFormat(\n        file.content.toString('utf-8'),\n        file.path,\n        hasRuffConfigOnDisk(tree, file.path),\n        getOwningProjectRuffConfig(file.path, pythonProjectConfigs),\n      );\n      tree.write(file.path, content);\n    } catch {\n      // Silently skip ruff formatting failures\n    }\n  }\n\n  if (otherFiles.length === 0) return;\n\n  // Use the workspace's own Biome CLI (its version and config) when biome.json\n  // exists on disk; otherwise format via the bundled library API with the\n  // in-memory tree config. The CLI path does not see in-tree config changes.\n  if (existsSync(path.join(tree.root, 'biome.json'))) {\n    formatWithBiomeCli(tree, otherFiles);\n  } else {\n    formatWithBiomeApi(tree, otherFiles);\n  }\n}\n\n/**\n * Format files via the workspace's Biome CLI, run from the workspace root so it\n * discovers the on-disk biome.json.\n */\nfunction formatWithBiomeCli(\n  tree: Tree,\n  files: { path: string; content: Buffer | null }[],\n): void {\n  const biome = getBiomeCommand(tree.root);\n  if (!biome) {\n    // Fall back to the library API if the CLI cannot be resolved\n    formatWithBiomeApi(tree, files);\n    return;\n  }\n\n  for (const file of files) {\n    try {\n      const content = execFileSync(\n        biome.command,\n        [...biome.args, 'format', `--stdin-file-path=${file.path}`],\n        {\n          input: file.content?.toString('utf-8') ?? '',\n          encoding: 'utf-8',\n          cwd: tree.root,\n          stdio: ['pipe', 'pipe', 'pipe'],\n        },\n      );\n      tree.write(file.path, content);\n    } catch {\n      // Leave individual files that fail to format untouched\n    }\n  }\n}\n\n/**\n * Format files via the bundled Biome library API, applying the in-memory tree\n * config.\n */\nfunction formatWithBiomeApi(\n  tree: Tree,\n  files: { path: string; content: Buffer | null }[],\n): void {\n  try {\n    const biome = new Biome();\n    const { projectKey } = biome.openProject();\n    // Apply the workspace biome.json if it exists in the tree, otherwise the defaults.\n    const treeConfig = tree.read('biome.json', 'utf-8');\n    biome.applyConfiguration(\n      projectKey,\n      treeConfig ? JSON.parse(treeConfig) : DEFAULT_BIOME_CONFIG,\n    );\n\n    for (const file of files) {\n      try {\n        const { content } = biome.formatContent(\n          projectKey,\n          file.content?.toString('utf-8') ?? '',\n          { filePath: file.path },\n        );\n        tree.write(file.path, content);\n      } catch {\n        // Leave individual files that fail to format untouched\n      }\n    }\n  } catch {\n    // Silently skip formatting failures\n  }\n}\n\ninterface BiomeCommand {\n  command: string;\n  args: string[];\n}\n\n/**\n * Resolve the `@biomejs/biome` CLI from the user's workspace, falling back to a\n * `biome` binary on the PATH.\n */\nconst _biomeCommands = new Map<string, BiomeCommand | null>();\nfunction getBiomeCommand(root: string): BiomeCommand | undefined {\n  if (_biomeCommands.has(root)) {\n    return _biomeCommands.get(root) ?? undefined;\n  }\n\n  // Run via node for cross-platform execution of the bin shim.\n  try {\n    const pkgJsonPath = require.resolve('@biomejs/biome/package.json', {\n      paths: [root, import.meta.dirname],\n    });\n    const pkgJson = JSON.parse(readFileSync(pkgJsonPath, 'utf-8'));\n    const binRelative =\n      typeof pkgJson.bin === 'string' ? pkgJson.bin : pkgJson.bin?.biome;\n    if (binRelative) {\n      const binPath = path.join(path.dirname(pkgJsonPath), binRelative);\n      const command = { command: process.execPath, args: [binPath] };\n      _biomeCommands.set(root, command);\n      return command;\n    }\n  } catch {\n    // Fall back to a biome binary on the PATH\n  }\n\n  try {\n    execSync('biome --version', {\n      encoding: 'utf-8',\n      stdio: ['pipe', 'pipe', 'pipe'],\n    });\n    const command = { command: 'biome', args: [] };\n    _biomeCommands.set(root, command);\n    return command;\n  } catch {\n    _biomeCommands.set(root, null);\n    return undefined;\n  }\n}\n\n/**\n * Find the ruff command: `uvx --from ruff==<version> ruff`. uvx works\n * regardless of workspace resolution state (unlike `uv run ruff`, which fails\n * while installs are deferred), and the version pin matches the project's\n * `format` target (PY_VERSIONS) so generation and check format identically.\n * Only a successful probe is cached — ruff can become available mid-run in the\n * long-lived Nx daemon, so a cached failure would skip formatting thereafter.\n */\nlet _ruffCommand: string | undefined;\nfunction getRuffCommand(): string | undefined {\n  if (_ruffCommand) {\n    return _ruffCommand;\n  }\n  const cmd = uvxCommand('ruff');\n  try {\n    execSync(`${cmd} --version`, {\n      encoding: 'utf-8',\n      stdio: ['pipe', 'pipe', 'pipe'],\n    });\n    _ruffCommand = cmd;\n    return cmd;\n  } catch {\n    return undefined;\n  }\n}\n\n/**\n * Whether ruff would discover a config on disk for a file, by walking from its\n * directory up to the workspace root looking for `.ruff.toml`, `ruff.toml`, or a\n * `pyproject.toml` with a `[tool.ruff]` section — the same files ruff itself\n * resolves. The walk stops at `tree.root` so a stray config in a parent of the\n * workspace (or the home directory) is never treated as the project's. Used to\n * decide whether to nudge ruff towards import sorting (see\n * {@link ruffFixAndFormat}).\n */\nfunction hasRuffConfigOnDisk(tree: Tree, filePath: string): boolean {\n  const root = path.resolve(tree.root);\n  let dir = path.resolve(root, path.dirname(filePath));\n  while (true) {\n    if (\n      existsSync(path.join(dir, '.ruff.toml')) ||\n      existsSync(path.join(dir, 'ruff.toml'))\n    ) {\n      return true;\n    }\n    const pyproject = path.join(dir, 'pyproject.toml');\n    if (\n      existsSync(pyproject) &&\n      readFileSync(pyproject, 'utf-8').includes('[tool.ruff')\n    ) {\n      return true;\n    }\n    const parent = path.dirname(dir);\n    // Stop once the workspace root has been checked (or we hit the FS root).\n    if (dir === root || parent === dir) {\n      return false;\n    }\n    dir = parent;\n  }\n}\n\ninterface PythonProjectRuffConfig {\n  /** Project root, normalised to use forward slashes. */\n  readonly root: string;\n  /** Top-level importable module names declared by the project. */\n  readonly modules: string[];\n  /** The project's `[tool.ruff].line-length`, if set. */\n  readonly lineLength?: number;\n  /**\n   * Ruff `target-version` (eg `py314`) derived from `[project].requires-python`.\n   * Generation formats via stdin with no pyproject, so it must be passed\n   * explicitly — ruff's formatting differs by target.\n   */\n  readonly targetVersion?: string;\n}\n\n/**\n * Derive ruff's `target-version` (eg `py314`) from a PEP 508\n * `requires-python` specifier (eg `>=3.14`). Ruff targets the minimum\n * supported version, so take the lowest `major.minor` mentioned.\n */\nexport const requiresPythonToRuffTarget = (\n  requiresPython: unknown,\n): string | undefined => {\n  if (typeof requiresPython !== 'string') {\n    return undefined;\n  }\n  let min: { major: number; minor: number } | undefined;\n  for (const match of requiresPython.matchAll(/(\\d+)\\.(\\d+)/g)) {\n    const major = Number(match[1]);\n    const minor = Number(match[2]);\n    if (\n      !min ||\n      major < min.major ||\n      (major === min.major && minor < min.minor)\n    ) {\n      min = { major, minor };\n    }\n  }\n  return min ? `py${min.major}${min.minor}` : undefined;\n};\n\n/**\n * Map each Nx project with a `pyproject.toml` to the ruff settings the on-disk\n * build enforces for it: its top-level module names (from\n * `[tool.hatch.build.targets.wheel].packages`) and its `[tool.ruff].line-length`.\n */\nfunction getPythonProjectRuffConfigs(tree: Tree): PythonProjectRuffConfig[] {\n  const configs: PythonProjectRuffConfig[] = [];\n\n  for (const project of getProjects(tree).values()) {\n    const pyprojectPath = path.join(project.root, 'pyproject.toml');\n    if (tree.exists(pyprojectPath)) {\n      try {\n        const pyproject = readToml(tree, pyprojectPath) as any;\n        const wheelPackages: unknown =\n          pyproject?.tool?.hatch?.build?.targets?.wheel?.packages;\n        // Record the top-level module segment (`pkg/sub` -> `pkg`), which is\n        // all `known-first-party` keys off.\n        const modules = Array.isArray(wheelPackages)\n          ? wheelPackages\n              .filter((pkg): pkg is string => typeof pkg === 'string' && !!pkg)\n              .map((pkg) => pkg.split('/')[0])\n          : [];\n        const lineLength: unknown = pyproject?.tool?.ruff?.['line-length'];\n        const targetVersion = requiresPythonToRuffTarget(\n          pyproject?.project?.['requires-python'],\n        );\n        if (modules.length || typeof lineLength === 'number' || targetVersion) {\n          configs.push({\n            root: project.root.split(path.sep).join('/'),\n            modules,\n            lineLength: typeof lineLength === 'number' ? lineLength : undefined,\n            targetVersion,\n          });\n        }\n      } catch {\n        // Skip projects whose pyproject.toml cannot be parsed\n      }\n    }\n  }\n\n  return configs;\n}\n\n/**\n * Resolve the ruff config for the project that owns a file (the project with\n * the longest root that is a prefix of the file path). Ruff runs per-project on\n * disk, so a file's settings come from its own project — only its own module is\n * first-party (sibling workspace packages are third-party) and its own\n * line-length applies — and scoping this way keeps in-tree formatting\n * consistent with the on-disk build.\n */\nfunction getOwningProjectRuffConfig(\n  filePath: string,\n  configs: PythonProjectRuffConfig[],\n): PythonProjectRuffConfig | undefined {\n  let owner: PythonProjectRuffConfig | undefined;\n  for (const config of configs) {\n    if (\n      (filePath === config.root || filePath.startsWith(`${config.root}/`)) &&\n      (!owner || config.root.length > owner.root.length)\n    ) {\n      owner = config;\n    }\n  }\n  return owner;\n}\n\n/**\n * Run ruff check --fix and ruff format on Python file content via stdin.\n * Applies all configured lint fixes (including import sorting) and formatting.\n *\n * When no ruff config exists on disk (`hasConfig` false) ruff falls back to its\n * defaults, which omit isort — but generated projects enable rule `I` and their\n * build fails on unsorted imports (I001). In that case we add `--extend-select\n * I` so import sorting matches what the build enforces. When a config does\n * exist we defer to it entirely, honouring the user's rule selection.\n *\n * `projectConfig` carries the owning project's ruff settings, which ruff cannot\n * detect from the filesystem during generation because the project lives only\n * in the tree. We pass them via `--config` so in-tree formatting matches the\n * on-disk build: `known-first-party` (the project's own modules) keeps its\n * imports in their own group, and `line-length` keeps wrapping consistent (the\n * generated config raises it above ruff's default of 88). These are additive to\n * any on-disk config, so they are safe to pass regardless of `hasConfig`.\n */\nfunction ruffFixAndFormat(\n  content: string,\n  filePath: string,\n  hasConfig: boolean,\n  projectConfig?: PythonProjectRuffConfig,\n): string {\n  const ruff = getRuffCommand();\n  if (!ruff) return content;\n\n  const extendSelect = hasConfig ? '' : ' --extend-select I';\n  const configArgs: string[] = [];\n  if (projectConfig?.modules.length) {\n    configArgs.push(\n      `lint.isort.known-first-party = ${JSON.stringify(projectConfig.modules)}`,\n    );\n  }\n  if (typeof projectConfig?.lineLength === 'number') {\n    configArgs.push(`line-length = ${projectConfig.lineLength}`);\n  }\n  if (projectConfig?.targetVersion) {\n    configArgs.push(`target-version = \"${projectConfig.targetVersion}\"`);\n  }\n  const config = configArgs\n    .map((arg) => ` --config ${JSON.stringify(arg)}`)\n    .join('');\n\n  // First apply lint fixes (import sorting, unused imports, etc.)\n  try {\n    const result = execSync(\n      `${ruff} check --fix${extendSelect}${config} --stdin-filename ${filePath} -`,\n      { input: content, encoding: 'utf-8', stdio: ['pipe', 'pipe', 'pipe'] },\n    );\n    content = result;\n  } catch (e: any) {\n    // ruff check exits non-zero when it finds unfixable issues,\n    // but stdout still contains the fixed content\n    if (e.stdout) {\n      content = e.stdout;\n    }\n  }\n\n  // Then apply formatting\n  try {\n    content = execSync(\n      `${ruff} format${config} --stdin-filename ${filePath} -`,\n      {\n        input: content,\n        encoding: 'utf-8',\n        stdio: ['pipe', 'pipe', 'pipe'],\n      },\n    );\n  } catch {\n    // Fall through with whatever content we have\n  }\n\n  return content;\n}\n"],"names":["Biome","getProjects","execFileSync","execSync","existsSync","readFileSync","createRequire","path","uvxCommand","readToml","TS_VERSIONS","require","url","DEFAULT_BIOME_CONFIG","$schema","root","formatter","enabled","indentStyle","indentWidth","lineWidth","javascript","quoteStyle","trailingCommas","css","linter","rules","preset","correctness","noUndeclaredDependencies","assist","actions","source","organizeImports","files","includes","BIOME_FORMATTABLE_EXTENSIONS","Set","isTsConfig","filePath","test","formatFilesInSubtree","tree","dir","changedFiles","listChanges","filter","file","type","startsWith","pyFiles","endsWith","otherFiles","has","extname","pythonProjectConfigs","length","getPythonProjectRuffConfigs","content","ruffFixAndFormat","toString","hasRuffConfigOnDisk","getOwningProjectRuffConfig","write","join","formatWithBiomeCli","formatWithBiomeApi","biome","getBiomeCommand","command","args","input","encoding","cwd","stdio","projectKey","openProject","treeConfig","read","applyConfiguration","JSON","parse","formatContent","_biomeCommands","Map","get","undefined","pkgJsonPath","resolve","paths","dirname","pkgJson","binRelative","bin","binPath","process","execPath","set","_ruffCommand","getRuffCommand","cmd","pyproject","parent","requiresPythonToRuffTarget","requiresPython","min","match","matchAll","major","Number","minor","configs","project","values","pyprojectPath","exists","wheelPackages","tool","hatch","build","targets","wheel","packages","modules","Array","isArray","pkg","map","split","lineLength","ruff","targetVersion","push","sep","owner","config","hasConfig","projectConfig","extendSelect","configArgs","stringify","arg","result","e","stdout"],"mappings":"AAAA;;;CAGC,GAED,SAASA,KAAK,QAAQ,yBAAyB;AAC/C,SAASC,WAAW,QAAmB,aAAa;AACpD,SAASC,YAAY,EAAEC,QAAQ,QAAQ,gBAAgB;AACvD,SAASC,UAAU,EAAEC,YAAY,QAAQ,KAAK;AAC9C,SAASC,aAAa,QAAQ,SAAS;AACvC,OAAOC,UAAU,OAAO;AACxB,SAASC,UAAU,QAAQ,UAAO;AAClC,SAASC,QAAQ,QAAQ,YAAS;AAClC,SAASC,WAAW,QAAQ,gBAAa;AAEzC,MAAMC,UAAUL,cAAc,YAAYM,GAAG;AAE7C,OAAO,MAAMC,uBAAuB;IAClCC,SAAS,CAAC,4BAA4B,EAAEJ,WAAW,CAAC,iBAAiB,CAAC,YAAY,CAAC;IACnFK,MAAM;IACNC,WAAW;QACTC,SAAS;QACTC,aAAa;QACbC,aAAa;QACbC,WAAW;IACb;IACAC,YAAY;QACVL,WAAW;YACTM,YAAY;YACZC,gBAAgB;QAClB;IACF;IACAC,KAAK;QACHR,WAAW;YACTM,YAAY;QACd;QACAG,QAAQ;YACNR,SAAS;QACX;IACF;IACAQ,QAAQ;QACNR,SAAS;QACTS,OAAO;YACLC,QAAQ;YACRC,aAAa;gBACXC,0BAA0B;YAC5B;QACF;IACF;IACAC,QAAQ;QACNC,SAAS;YACPC,QAAQ;gBACNC,iBAAiB;YACnB;QACF;IACF;IACAC,OAAO;QACLC,UAAU;YACR;YACA;YACA;YACA;YACA;YACA;YACA;YACA;YACA;YACA;SACD;IACH;AACF,EAAE;AAEF,MAAMC,+BAA+B,IAAIC,IAAI;IAC3C;IACA;IACA;IACA;IACA;IACA;IACA;IACA;IACA;IACA;IACA;CACD;AAED,mEAAmE,GACnE,MAAMC,aAAa,CAACC,WAClB,6BAA6BC,IAAI,CAACD;AAEpC;;;;CAIC,GACD,OAAO,eAAeE,qBACpBC,IAAU,EACVC,GAAY;IAEZ,MAAMC,eAAeF,KAClBG,WAAW,GACXC,MAAM,CAAC,CAACC,OAASA,KAAKC,IAAI,KAAK,UAC/BF,MAAM,CAAC,CAACC,OAAUJ,MAAMI,KAAKxC,IAAI,CAAC0C,UAAU,CAACN,OAAO;IAEvD,MAAMO,UAAUN,aAAaE,MAAM,CAAC,CAACC,OAASA,KAAKxC,IAAI,CAAC4C,QAAQ,CAAC;IACjE,MAAMC,aAAaR,aAAaE,MAAM,CACpC,CAACC,OACCX,6BAA6BiB,GAAG,CAAC9C,KAAK+C,OAAO,CAACP,KAAKxC,IAAI,MACvD,oEAAoE;QACpE,yEAAyE;QACzE,oEAAoE;QACpE,yEAAyE;QACzE,wCAAwC;QACxC,CAAC+B,WAAWS,KAAKxC,IAAI;IAGzB,4EAA4E;IAC5E,8EAA8E;IAC9E,MAAMgD,uBAAuBL,QAAQM,MAAM,GACvCC,4BAA4Bf,QAC5B,EAAE;IAEN,0DAA0D;IAC1D,KAAK,MAAMK,QAAQG,QAAS;QAC1B,IAAI;YACF,MAAMQ,UAAUC,iBACdZ,KAAKW,OAAO,CAACE,QAAQ,CAAC,UACtBb,KAAKxC,IAAI,EACTsD,oBAAoBnB,MAAMK,KAAKxC,IAAI,GACnCuD,2BAA2Bf,KAAKxC,IAAI,EAAEgD;YAExCb,KAAKqB,KAAK,CAAChB,KAAKxC,IAAI,EAAEmD;QACxB,EAAE,OAAM;QACN,yCAAyC;QAC3C;IACF;IAEA,IAAIN,WAAWI,MAAM,KAAK,GAAG;IAE7B,6EAA6E;IAC7E,wEAAwE;IACxE,2EAA2E;IAC3E,IAAIpD,WAAWG,KAAKyD,IAAI,CAACtB,KAAK3B,IAAI,EAAE,gBAAgB;QAClDkD,mBAAmBvB,MAAMU;IAC3B,OAAO;QACLc,mBAAmBxB,MAAMU;IAC3B;AACF;AAEA;;;CAGC,GACD,SAASa,mBACPvB,IAAU,EACVR,KAAiD;IAEjD,MAAMiC,QAAQC,gBAAgB1B,KAAK3B,IAAI;IACvC,IAAI,CAACoD,OAAO;QACV,6DAA6D;QAC7DD,mBAAmBxB,MAAMR;QACzB;IACF;IAEA,KAAK,MAAMa,QAAQb,MAAO;QACxB,IAAI;YACF,MAAMwB,UAAUxD,aACdiE,MAAME,OAAO,EACb;mBAAIF,MAAMG,IAAI;gBAAE;gBAAU,CAAC,kBAAkB,EAAEvB,KAAKxC,IAAI,EAAE;aAAC,EAC3D;gBACEgE,OAAOxB,KAAKW,OAAO,EAAEE,SAAS,YAAY;gBAC1CY,UAAU;gBACVC,KAAK/B,KAAK3B,IAAI;gBACd2D,OAAO;oBAAC;oBAAQ;oBAAQ;iBAAO;YACjC;YAEFhC,KAAKqB,KAAK,CAAChB,KAAKxC,IAAI,EAAEmD;QACxB,EAAE,OAAM;QACN,uDAAuD;QACzD;IACF;AACF;AAEA;;;CAGC,GACD,SAASQ,mBACPxB,IAAU,EACVR,KAAiD;IAEjD,IAAI;QACF,MAAMiC,QAAQ,IAAInE;QAClB,MAAM,EAAE2E,UAAU,EAAE,GAAGR,MAAMS,WAAW;QACxC,mFAAmF;QACnF,MAAMC,aAAanC,KAAKoC,IAAI,CAAC,cAAc;QAC3CX,MAAMY,kBAAkB,CACtBJ,YACAE,aAAaG,KAAKC,KAAK,CAACJ,cAAchE;QAGxC,KAAK,MAAMkC,QAAQb,MAAO;YACxB,IAAI;gBACF,MAAM,EAAEwB,OAAO,EAAE,GAAGS,MAAMe,aAAa,CACrCP,YACA5B,KAAKW,OAAO,EAAEE,SAAS,YAAY,IACnC;oBAAErB,UAAUQ,KAAKxC,IAAI;gBAAC;gBAExBmC,KAAKqB,KAAK,CAAChB,KAAKxC,IAAI,EAAEmD;YACxB,EAAE,OAAM;YACN,uDAAuD;YACzD;QACF;IACF,EAAE,OAAM;IACN,oCAAoC;IACtC;AACF;AAOA;;;CAGC,GACD,MAAMyB,iBAAiB,IAAIC;AAC3B,SAAShB,gBAAgBrD,IAAY;IACnC,IAAIoE,eAAe9B,GAAG,CAACtC,OAAO;QAC5B,OAAOoE,eAAeE,GAAG,CAACtE,SAASuE;IACrC;IAEA,6DAA6D;IAC7D,IAAI;QACF,MAAMC,cAAc5E,QAAQ6E,OAAO,CAAC,+BAA+B;YACjEC,OAAO;gBAAC1E;gBAAM,YAAY2E,OAAO;aAAC;QACpC;QACA,MAAMC,UAAUX,KAAKC,KAAK,CAAC5E,aAAakF,aAAa;QACrD,MAAMK,cACJ,OAAOD,QAAQE,GAAG,KAAK,WAAWF,QAAQE,GAAG,GAAGF,QAAQE,GAAG,EAAE1B;QAC/D,IAAIyB,aAAa;YACf,MAAME,UAAUvF,KAAKyD,IAAI,CAACzD,KAAKmF,OAAO,CAACH,cAAcK;YACrD,MAAMvB,UAAU;gBAAEA,SAAS0B,QAAQC,QAAQ;gBAAE1B,MAAM;oBAACwB;iBAAQ;YAAC;YAC7DX,eAAec,GAAG,CAAClF,MAAMsD;YACzB,OAAOA;QACT;IACF,EAAE,OAAM;IACN,0CAA0C;IAC5C;IAEA,IAAI;QACFlE,SAAS,mBAAmB;YAC1BqE,UAAU;YACVE,OAAO;gBAAC;gBAAQ;gBAAQ;aAAO;QACjC;QACA,MAAML,UAAU;YAAEA,SAAS;YAASC,MAAM,EAAE;QAAC;QAC7Ca,eAAec,GAAG,CAAClF,MAAMsD;QACzB,OAAOA;IACT,EAAE,OAAM;QACNc,eAAec,GAAG,CAAClF,MAAM;QACzB,OAAOuE;IACT;AACF;AAEA;;;;;;;CAOC,GACD,IAAIY;AACJ,SAASC;IACP,IAAID,cAAc;QAChB,OAAOA;IACT;IACA,MAAME,MAAM5F,WAAW;IACvB,IAAI;QACFL,SAAS,GAAGiG,IAAI,UAAU,CAAC,EAAE;YAC3B5B,UAAU;YACVE,OAAO;gBAAC;gBAAQ;gBAAQ;aAAO;QACjC;QACAwB,eAAeE;QACf,OAAOA;IACT,EAAE,OAAM;QACN,OAAOd;IACT;AACF;AAEA;;;;;;;;CAQC,GACD,SAASzB,oBAAoBnB,IAAU,EAAEH,QAAgB;IACvD,MAAMxB,OAAOR,KAAKiF,OAAO,CAAC9C,KAAK3B,IAAI;IACnC,IAAI4B,MAAMpC,KAAKiF,OAAO,CAACzE,MAAMR,KAAKmF,OAAO,CAACnD;IAC1C,MAAO,KAAM;QACX,IACEnC,WAAWG,KAAKyD,IAAI,CAACrB,KAAK,kBAC1BvC,WAAWG,KAAKyD,IAAI,CAACrB,KAAK,eAC1B;YACA,OAAO;QACT;QACA,MAAM0D,YAAY9F,KAAKyD,IAAI,CAACrB,KAAK;QACjC,IACEvC,WAAWiG,cACXhG,aAAagG,WAAW,SAASlE,QAAQ,CAAC,eAC1C;YACA,OAAO;QACT;QACA,MAAMmE,SAAS/F,KAAKmF,OAAO,CAAC/C;QAC5B,yEAAyE;QACzE,IAAIA,QAAQ5B,QAAQuF,WAAW3D,KAAK;YAClC,OAAO;QACT;QACAA,MAAM2D;IACR;AACF;AAiBA;;;;CAIC,GACD,OAAO,MAAMC,6BAA6B,CACxCC;IAEA,IAAI,OAAOA,mBAAmB,UAAU;QACtC,OAAOlB;IACT;IACA,IAAImB;IACJ,KAAK,MAAMC,SAASF,eAAeG,QAAQ,CAAC,iBAAkB;QAC5D,MAAMC,QAAQC,OAAOH,KAAK,CAAC,EAAE;QAC7B,MAAMI,QAAQD,OAAOH,KAAK,CAAC,EAAE;QAC7B,IACE,CAACD,OACDG,QAAQH,IAAIG,KAAK,IAChBA,UAAUH,IAAIG,KAAK,IAAIE,QAAQL,IAAIK,KAAK,EACzC;YACAL,MAAM;gBAAEG;gBAAOE;YAAM;QACvB;IACF;IACA,OAAOL,MAAM,CAAC,EAAE,EAAEA,IAAIG,KAAK,GAAGH,IAAIK,KAAK,EAAE,GAAGxB;AAC9C,EAAE;AAEF;;;;CAIC,GACD,SAAS7B,4BAA4Bf,IAAU;IAC7C,MAAMqE,UAAqC,EAAE;IAE7C,KAAK,MAAMC,WAAW/G,YAAYyC,MAAMuE,MAAM,GAAI;QAChD,MAAMC,gBAAgB3G,KAAKyD,IAAI,CAACgD,QAAQjG,IAAI,EAAE;QAC9C,IAAI2B,KAAKyE,MAAM,CAACD,gBAAgB;YAC9B,IAAI;gBACF,MAAMb,YAAY5F,SAASiC,MAAMwE;gBACjC,MAAME,gBACJf,WAAWgB,MAAMC,OAAOC,OAAOC,SAASC,OAAOC;gBACjD,qEAAqE;gBACrE,oCAAoC;gBACpC,MAAMC,UAAUC,MAAMC,OAAO,CAACT,iBAC1BA,cACGtE,MAAM,CAAC,CAACgF,MAAuB,OAAOA,QAAQ,YAAY,CAAC,CAACA,KAC5DC,GAAG,CAAC,CAACD,MAAQA,IAAIE,KAAK,CAAC,IAAI,CAAC,EAAE,IACjC,EAAE;gBACN,MAAMC,aAAsB5B,WAAWgB,MAAMa,MAAM,CAAC,cAAc;gBAClE,MAAMC,gBAAgB5B,2BACpBF,WAAWW,SAAS,CAAC,kBAAkB;gBAEzC,IAAIW,QAAQnE,MAAM,IAAI,OAAOyE,eAAe,YAAYE,eAAe;oBACrEpB,QAAQqB,IAAI,CAAC;wBACXrH,MAAMiG,QAAQjG,IAAI,CAACiH,KAAK,CAACzH,KAAK8H,GAAG,EAAErE,IAAI,CAAC;wBACxC2D;wBACAM,YAAY,OAAOA,eAAe,WAAWA,aAAa3C;wBAC1D6C;oBACF;gBACF;YACF,EAAE,OAAM;YACN,sDAAsD;YACxD;QACF;IACF;IAEA,OAAOpB;AACT;AAEA;;;;;;;CAOC,GACD,SAASjD,2BACPvB,QAAgB,EAChBwE,OAAkC;IAElC,IAAIuB;IACJ,KAAK,MAAMC,UAAUxB,QAAS;QAC5B,IACE,AAACxE,CAAAA,aAAagG,OAAOxH,IAAI,IAAIwB,SAASU,UAAU,CAAC,GAAGsF,OAAOxH,IAAI,CAAC,CAAC,CAAC,CAAA,KACjE,CAAA,CAACuH,SAASC,OAAOxH,IAAI,CAACyC,MAAM,GAAG8E,MAAMvH,IAAI,CAACyC,MAAM,AAAD,GAChD;YACA8E,QAAQC;QACV;IACF;IACA,OAAOD;AACT;AAEA;;;;;;;;;;;;;;;;;CAiBC,GACD,SAAS3E,iBACPD,OAAe,EACfnB,QAAgB,EAChBiG,SAAkB,EAClBC,aAAuC;IAEvC,MAAMP,OAAO/B;IACb,IAAI,CAAC+B,MAAM,OAAOxE;IAElB,MAAMgF,eAAeF,YAAY,KAAK;IACtC,MAAMG,aAAuB,EAAE;IAC/B,IAAIF,eAAed,QAAQnE,QAAQ;QACjCmF,WAAWP,IAAI,CACb,CAAC,+BAA+B,EAAEpD,KAAK4D,SAAS,CAACH,cAAcd,OAAO,GAAG;IAE7E;IACA,IAAI,OAAOc,eAAeR,eAAe,UAAU;QACjDU,WAAWP,IAAI,CAAC,CAAC,cAAc,EAAEK,cAAcR,UAAU,EAAE;IAC7D;IACA,IAAIQ,eAAeN,eAAe;QAChCQ,WAAWP,IAAI,CAAC,CAAC,kBAAkB,EAAEK,cAAcN,aAAa,CAAC,CAAC,CAAC;IACrE;IACA,MAAMI,SAASI,WACZZ,GAAG,CAAC,CAACc,MAAQ,CAAC,UAAU,EAAE7D,KAAK4D,SAAS,CAACC,MAAM,EAC/C7E,IAAI,CAAC;IAER,gEAAgE;IAChE,IAAI;QACF,MAAM8E,SAAS3I,SACb,GAAG+H,KAAK,YAAY,EAAEQ,eAAeH,OAAO,kBAAkB,EAAEhG,SAAS,EAAE,CAAC,EAC5E;YAAEgC,OAAOb;YAASc,UAAU;YAASE,OAAO;gBAAC;gBAAQ;gBAAQ;aAAO;QAAC;QAEvEhB,UAAUoF;IACZ,EAAE,OAAOC,GAAQ;QACf,4DAA4D;QAC5D,8CAA8C;QAC9C,IAAIA,EAAEC,MAAM,EAAE;YACZtF,UAAUqF,EAAEC,MAAM;QACpB;IACF;IAEA,wBAAwB;IACxB,IAAI;QACFtF,UAAUvD,SACR,GAAG+H,KAAK,OAAO,EAAEK,OAAO,kBAAkB,EAAEhG,SAAS,EAAE,CAAC,EACxD;YACEgC,OAAOb;YACPc,UAAU;YACVE,OAAO;gBAAC;gBAAQ;gBAAQ;aAAO;QACjC;IAEJ,EAAE,OAAM;IACN,6CAA6C;IAC/C;IAEA,OAAOhB;AACT"}

package/src/utils/identity-constructs/files/cdk/core/user-identity.ts.template

@@ -30,7 +30,7 @@ import {
 import { LogGroup, RetentionDays } from 'aws-cdk-lib/aws-logs';
 import { Construct } from 'constructs';
 import { RuntimeConfig } from './runtime-config<% if (esm) { %>.js<% } %>';
-import { Distribution } from 'aws-cdk-lib/aws-cloudfront';
+import { CfnDistribution, Distribution } from 'aws-cdk-lib/aws-cloudfront';
 import { suppressRules } from './checkov<% if (esm) { %>.js<% } %>';
 
 const WEB_CLIENT_ID = 'WebClient';
@@ -242,9 +242,7 @@ export class UserIdentity extends Construct {
     const lazilyComputedCallbackUrls = Lazy.list({
       produce: () =>
         ['http://localhost:4200', 'http://localhost:4300'].concat(
-          this.findCloudFrontDistributions().map(
-            (d) => `https://${d.domainName}`
-          )
+          this.findCloudFrontDomainNames().map((domain) => `https://${domain}`)
         ),
     });
 
@@ -294,8 +292,15 @@ export class UserIdentity extends Construct {
     }).node.addDependency(userPoolClient, userPool, userPoolDomain);
   };
 
-  private findCloudFrontDistributions = (): Distribution[] =>
+  // Includes each distribution's default domain name plus any custom domain names (aliases) configured on it.
+  private findCloudFrontDomainNames = (): string[] =>
     Stack.of(this)
       .node.findAll()
-      .filter((child) => child instanceof Distribution);
+      .filter((child): child is Distribution => child instanceof Distribution)
+      .flatMap((d) => {
+        const cfnDistribution = d.node.defaultChild as CfnDistribution;
+        const distributionConfig =
+          cfnDistribution.distributionConfig as CfnDistribution.DistributionConfigProperty;
+        return [d.domainName, ...(distributionConfig.aliases ?? [])];
+      });
 }

package/src/utils/identity-constructs/identity-constructs.js

@@ -37,14 +37,25 @@ const addIdentityTerraformModules = (tree, options)=>{
     // Update the static website module to add the callback url
     const staticWebsiteModule = tree.read(joinPathFragments(PACKAGES_DIR, SHARED_TERRAFORM_DIR, 'src', 'core', 'static-website', 'static-website.tf'), 'utf-8');
     if (staticWebsiteModule && !staticWebsiteModule.includes('source = "../user-identity/add-callback-url"')) {
-        // Find the aws_cloudfront_distribution.website resource and add the callback URL module after it
+        // Find the aws_cloudfront_distribution.website resource and add the callback URL module after it.
+        // Includes the CloudFront domain plus any custom domain names (aliases) configured via var.custom_domain_names.
         const callbackUrlModule = `
 
-# Add CloudFront domain to user pool client callback URLs
+# Add CloudFront domain and any custom domain names to user pool client callback URLs.
+# Keyed by statically-known values so for_each keys are resolvable at plan time; the
+# CloudFront domain is only known at apply time, so it appears in the value, not the key.
+locals {
+  callback_urls = merge(
+    { cloudfront = "https://\${aws_cloudfront_distribution.website.domain_name}" },
+    { for domain in var.custom_domain_names : domain => "https://\${domain}" },
+  )
+}
+
 module "add_callback_url" {
   source = "../user-identity/add-callback-url"
+  for_each = local.callback_urls
 
-  callback_url = "https://\${aws_cloudfront_distribution.website.domain_name}"
+  callback_url = each.value
 
   depends_on = [aws_cloudfront_distribution.website]
 }`;

package/src/utils/identity-constructs/identity-constructs.js.map

@@ -1 +1 @@
-{"version":3,"sources":["../../../../../../packages/nx-plugin/src/utils/identity-constructs/identity-constructs.ts"],"sourcesContent":["/**\n * Copyright Amazon.com, Inc. or its affiliates. All Rights Reserved.\n * SPDX-License-Identifier: Apache-2.0\n */\nimport {\n  generateFiles,\n  joinPathFragments,\n  OverwriteStrategy,\n  type Tree,\n} from '@nx/devkit';\nimport { addStarExport } from '../ast';\nimport type { Iac } from '../iac';\nimport { esmVars } from '../module-format';\nimport {\n  PACKAGES_DIR,\n  SHARED_CONSTRUCTS_DIR,\n  SHARED_TERRAFORM_DIR,\n} from '../shared-constructs-constants';\nimport { PY_VERSIONS, terraformProviderVersions } from '../versions';\n\nexport interface AddIdentityInfraOptions {\n  cognitoDomain: string;\n  allowSignup: boolean;\n}\n\n/**\n * Add infrastructure for a static website\n */\nexport const addIdentityInfra = async (\n  tree: Tree,\n  options: AddIdentityInfraOptions & { iac: Iac },\n) => {\n  if (options.iac === 'cdk') {\n    await addIdentityCdkConstructs(tree, options);\n  } else if (options.iac === 'terraform') {\n    addIdentityTerraformModules(tree, options);\n  } else {\n    throw new Error(`Unsupported iac ${options.iac}`);\n  }\n};\n\nconst addIdentityCdkConstructs = async (\n  tree: Tree,\n  options: AddIdentityInfraOptions,\n) => {\n  generateFiles(\n    tree,\n    joinPathFragments(import.meta.dirname, 'files', 'cdk', 'core'),\n    joinPathFragments(PACKAGES_DIR, SHARED_CONSTRUCTS_DIR, 'src', 'core'),\n    { ...options, ...esmVars(tree) },\n    {\n      overwriteStrategy: OverwriteStrategy.KeepExisting,\n    },\n  );\n\n  await addStarExport(\n    tree,\n    joinPathFragments(\n      PACKAGES_DIR,\n      SHARED_CONSTRUCTS_DIR,\n      'src',\n      'core',\n      'index.ts',\n    ),\n    './user-identity.js',\n  );\n};\n\nconst addIdentityTerraformModules = (\n  tree: Tree,\n  options: AddIdentityInfraOptions,\n) => {\n  generateFiles(\n    tree,\n    joinPathFragments(import.meta.dirname, 'files', 'terraform', 'core'),\n    joinPathFragments(PACKAGES_DIR, SHARED_TERRAFORM_DIR, 'src', 'core'),\n    {\n      ...options,\n      boto3Version: PY_VERSIONS.boto3,\n      ...terraformProviderVersions(),\n    },\n    {\n      overwriteStrategy: OverwriteStrategy.KeepExisting,\n    },\n  );\n\n  // Update the static website module to add the callback url\n  const staticWebsiteModule = tree.read(\n    joinPathFragments(\n      PACKAGES_DIR,\n      SHARED_TERRAFORM_DIR,\n      'src',\n      'core',\n      'static-website',\n      'static-website.tf',\n    ),\n    'utf-8',\n  );\n  if (\n    staticWebsiteModule &&\n    !staticWebsiteModule.includes(\n      'source = \"../user-identity/add-callback-url\"',\n    )\n  ) {\n    // Find the aws_cloudfront_distribution.website resource and add the callback URL module after it\n    const callbackUrlModule = `\n\n# Add CloudFront domain to user pool client callback URLs\nmodule \"add_callback_url\" {\n  source = \"../user-identity/add-callback-url\"\n\n  callback_url = \"https://\\${aws_cloudfront_distribution.website.domain_name}\"\n\n  depends_on = [aws_cloudfront_distribution.website]\n}`;\n\n    // Find the CloudFront distribution resource using proper brace counting\n    // This handles deeply nested structures correctly\n    const resourceStartPattern =\n      /resource\\s+\"aws_cloudfront_distribution\"\\s+\"website\"\\s*\\{/;\n    const resourceStartMatch = staticWebsiteModule.match(resourceStartPattern);\n\n    if (resourceStartMatch) {\n      const startIndex =\n        resourceStartMatch.index! + resourceStartMatch[0].length - 1; // Position at opening brace\n      let braceCount = 0;\n      let insertionPoint = -1;\n\n      // Count braces to find the end of the resource block\n      for (let i = startIndex; i < staticWebsiteModule.length; i++) {\n        const char = staticWebsiteModule[i];\n        if (char === '{') {\n          braceCount++;\n        } else if (char === '}') {\n          braceCount--;\n          if (braceCount === 0) {\n            // Found the closing brace of the CloudFront resource\n            insertionPoint = i + 1;\n            break;\n          }\n        }\n      }\n\n      if (insertionPoint !== -1) {\n        // Insert the callback URL module right after the CloudFront distribution\n        const beforeInsertion = staticWebsiteModule.substring(\n          0,\n          insertionPoint,\n        );\n        const afterInsertion = staticWebsiteModule.substring(insertionPoint);\n        const updatedContent =\n          beforeInsertion + callbackUrlModule + afterInsertion;\n\n        tree.write(\n          joinPathFragments(\n            PACKAGES_DIR,\n            SHARED_TERRAFORM_DIR,\n            'src',\n            'core',\n            'static-website',\n            'static-website.tf',\n          ),\n          updatedContent,\n        );\n      }\n    }\n  }\n};\n"],"names":["generateFiles","joinPathFragments","OverwriteStrategy","addStarExport","esmVars","PACKAGES_DIR","SHARED_CONSTRUCTS_DIR","SHARED_TERRAFORM_DIR","PY_VERSIONS","terraformProviderVersions","addIdentityInfra","tree","options","iac","addIdentityCdkConstructs","addIdentityTerraformModules","Error","dirname","overwriteStrategy","KeepExisting","boto3Version","boto3","staticWebsiteModule","read","includes","callbackUrlModule","resourceStartPattern","resourceStartMatch","match","startIndex","index","length","braceCount","insertionPoint","i","char","beforeInsertion","substring","afterInsertion","updatedContent","write"],"mappings":"AAAA;;;CAGC,GACD,SACEA,aAAa,EACbC,iBAAiB,EACjBC,iBAAiB,QAEZ,aAAa;AACpB,SAASC,aAAa,QAAQ,YAAS;AAEvC,SAASC,OAAO,QAAQ,sBAAmB;AAC3C,SACEC,YAAY,EACZC,qBAAqB,EACrBC,oBAAoB,QACf,oCAAiC;AACxC,SAASC,WAAW,EAAEC,yBAAyB,QAAQ,iBAAc;AAOrE;;CAEC,GACD,OAAO,MAAMC,mBAAmB,OAC9BC,MACAC;IAEA,IAAIA,QAAQC,GAAG,KAAK,OAAO;QACzB,MAAMC,yBAAyBH,MAAMC;IACvC,OAAO,IAAIA,QAAQC,GAAG,KAAK,aAAa;QACtCE,4BAA4BJ,MAAMC;IACpC,OAAO;QACL,MAAM,IAAII,MAAM,CAAC,gBAAgB,EAAEJ,QAAQC,GAAG,EAAE;IAClD;AACF,EAAE;AAEF,MAAMC,2BAA2B,OAC/BH,MACAC;IAEAZ,cACEW,MACAV,kBAAkB,YAAYgB,OAAO,EAAE,SAAS,OAAO,SACvDhB,kBAAkBI,cAAcC,uBAAuB,OAAO,SAC9D;QAAE,GAAGM,OAAO;QAAE,GAAGR,QAAQO,KAAK;IAAC,GAC/B;QACEO,mBAAmBhB,kBAAkBiB,YAAY;IACnD;IAGF,MAAMhB,cACJQ,MACAV,kBACEI,cACAC,uBACA,OACA,QACA,aAEF;AAEJ;AAEA,MAAMS,8BAA8B,CAClCJ,MACAC;IAEAZ,cACEW,MACAV,kBAAkB,YAAYgB,OAAO,EAAE,SAAS,aAAa,SAC7DhB,kBAAkBI,cAAcE,sBAAsB,OAAO,SAC7D;QACE,GAAGK,OAAO;QACVQ,cAAcZ,YAAYa,KAAK;QAC/B,GAAGZ,2BAA2B;IAChC,GACA;QACES,mBAAmBhB,kBAAkBiB,YAAY;IACnD;IAGF,2DAA2D;IAC3D,MAAMG,sBAAsBX,KAAKY,IAAI,CACnCtB,kBACEI,cACAE,sBACA,OACA,QACA,kBACA,sBAEF;IAEF,IACEe,uBACA,CAACA,oBAAoBE,QAAQ,CAC3B,iDAEF;QACA,iGAAiG;QACjG,MAAMC,oBAAoB,CAAC;;;;;;;;;CAS9B,CAAC;QAEE,wEAAwE;QACxE,kDAAkD;QAClD,MAAMC,uBACJ;QACF,MAAMC,qBAAqBL,oBAAoBM,KAAK,CAACF;QAErD,IAAIC,oBAAoB;YACtB,MAAME,aACJF,mBAAmBG,KAAK,GAAIH,kBAAkB,CAAC,EAAE,CAACI,MAAM,GAAG,GAAG,4BAA4B;YAC5F,IAAIC,aAAa;YACjB,IAAIC,iBAAiB,CAAC;YAEtB,qDAAqD;YACrD,IAAK,IAAIC,IAAIL,YAAYK,IAAIZ,oBAAoBS,MAAM,EAAEG,IAAK;gBAC5D,MAAMC,OAAOb,mBAAmB,CAACY,EAAE;gBACnC,IAAIC,SAAS,KAAK;oBAChBH;gBACF,OAAO,IAAIG,SAAS,KAAK;oBACvBH;oBACA,IAAIA,eAAe,GAAG;wBACpB,qDAAqD;wBACrDC,iBAAiBC,IAAI;wBACrB;oBACF;gBACF;YACF;YAEA,IAAID,mBAAmB,CAAC,GAAG;gBACzB,yEAAyE;gBACzE,MAAMG,kBAAkBd,oBAAoBe,SAAS,CACnD,GACAJ;gBAEF,MAAMK,iBAAiBhB,oBAAoBe,SAAS,CAACJ;gBACrD,MAAMM,iBACJH,kBAAkBX,oBAAoBa;gBAExC3B,KAAK6B,KAAK,CACRvC,kBACEI,cACAE,sBACA,OACA,QACA,kBACA,sBAEFgC;YAEJ;QACF;IACF;AACF"}
+{"version":3,"sources":["../../../../../../packages/nx-plugin/src/utils/identity-constructs/identity-constructs.ts"],"sourcesContent":["/**\n * Copyright Amazon.com, Inc. or its affiliates. All Rights Reserved.\n * SPDX-License-Identifier: Apache-2.0\n */\nimport {\n  generateFiles,\n  joinPathFragments,\n  OverwriteStrategy,\n  type Tree,\n} from '@nx/devkit';\nimport { addStarExport } from '../ast';\nimport type { Iac } from '../iac';\nimport { esmVars } from '../module-format';\nimport {\n  PACKAGES_DIR,\n  SHARED_CONSTRUCTS_DIR,\n  SHARED_TERRAFORM_DIR,\n} from '../shared-constructs-constants';\nimport { PY_VERSIONS, terraformProviderVersions } from '../versions';\n\nexport interface AddIdentityInfraOptions {\n  cognitoDomain: string;\n  allowSignup: boolean;\n}\n\n/**\n * Add infrastructure for a static website\n */\nexport const addIdentityInfra = async (\n  tree: Tree,\n  options: AddIdentityInfraOptions & { iac: Iac },\n) => {\n  if (options.iac === 'cdk') {\n    await addIdentityCdkConstructs(tree, options);\n  } else if (options.iac === 'terraform') {\n    addIdentityTerraformModules(tree, options);\n  } else {\n    throw new Error(`Unsupported iac ${options.iac}`);\n  }\n};\n\nconst addIdentityCdkConstructs = async (\n  tree: Tree,\n  options: AddIdentityInfraOptions,\n) => {\n  generateFiles(\n    tree,\n    joinPathFragments(import.meta.dirname, 'files', 'cdk', 'core'),\n    joinPathFragments(PACKAGES_DIR, SHARED_CONSTRUCTS_DIR, 'src', 'core'),\n    { ...options, ...esmVars(tree) },\n    {\n      overwriteStrategy: OverwriteStrategy.KeepExisting,\n    },\n  );\n\n  await addStarExport(\n    tree,\n    joinPathFragments(\n      PACKAGES_DIR,\n      SHARED_CONSTRUCTS_DIR,\n      'src',\n      'core',\n      'index.ts',\n    ),\n    './user-identity.js',\n  );\n};\n\nconst addIdentityTerraformModules = (\n  tree: Tree,\n  options: AddIdentityInfraOptions,\n) => {\n  generateFiles(\n    tree,\n    joinPathFragments(import.meta.dirname, 'files', 'terraform', 'core'),\n    joinPathFragments(PACKAGES_DIR, SHARED_TERRAFORM_DIR, 'src', 'core'),\n    {\n      ...options,\n      boto3Version: PY_VERSIONS.boto3,\n      ...terraformProviderVersions(),\n    },\n    {\n      overwriteStrategy: OverwriteStrategy.KeepExisting,\n    },\n  );\n\n  // Update the static website module to add the callback url\n  const staticWebsiteModule = tree.read(\n    joinPathFragments(\n      PACKAGES_DIR,\n      SHARED_TERRAFORM_DIR,\n      'src',\n      'core',\n      'static-website',\n      'static-website.tf',\n    ),\n    'utf-8',\n  );\n  if (\n    staticWebsiteModule &&\n    !staticWebsiteModule.includes(\n      'source = \"../user-identity/add-callback-url\"',\n    )\n  ) {\n    // Find the aws_cloudfront_distribution.website resource and add the callback URL module after it.\n    // Includes the CloudFront domain plus any custom domain names (aliases) configured via var.custom_domain_names.\n    const callbackUrlModule = `\n\n# Add CloudFront domain and any custom domain names to user pool client callback URLs.\n# Keyed by statically-known values so for_each keys are resolvable at plan time; the\n# CloudFront domain is only known at apply time, so it appears in the value, not the key.\nlocals {\n  callback_urls = merge(\n    { cloudfront = \"https://\\${aws_cloudfront_distribution.website.domain_name}\" },\n    { for domain in var.custom_domain_names : domain => \"https://\\${domain}\" },\n  )\n}\n\nmodule \"add_callback_url\" {\n  source = \"../user-identity/add-callback-url\"\n  for_each = local.callback_urls\n\n  callback_url = each.value\n\n  depends_on = [aws_cloudfront_distribution.website]\n}`;\n\n    // Find the CloudFront distribution resource using proper brace counting\n    // This handles deeply nested structures correctly\n    const resourceStartPattern =\n      /resource\\s+\"aws_cloudfront_distribution\"\\s+\"website\"\\s*\\{/;\n    const resourceStartMatch = staticWebsiteModule.match(resourceStartPattern);\n\n    if (resourceStartMatch) {\n      const startIndex =\n        resourceStartMatch.index! + resourceStartMatch[0].length - 1; // Position at opening brace\n      let braceCount = 0;\n      let insertionPoint = -1;\n\n      // Count braces to find the end of the resource block\n      for (let i = startIndex; i < staticWebsiteModule.length; i++) {\n        const char = staticWebsiteModule[i];\n        if (char === '{') {\n          braceCount++;\n        } else if (char === '}') {\n          braceCount--;\n          if (braceCount === 0) {\n            // Found the closing brace of the CloudFront resource\n            insertionPoint = i + 1;\n            break;\n          }\n        }\n      }\n\n      if (insertionPoint !== -1) {\n        // Insert the callback URL module right after the CloudFront distribution\n        const beforeInsertion = staticWebsiteModule.substring(\n          0,\n          insertionPoint,\n        );\n        const afterInsertion = staticWebsiteModule.substring(insertionPoint);\n        const updatedContent =\n          beforeInsertion + callbackUrlModule + afterInsertion;\n\n        tree.write(\n          joinPathFragments(\n            PACKAGES_DIR,\n            SHARED_TERRAFORM_DIR,\n            'src',\n            'core',\n            'static-website',\n            'static-website.tf',\n          ),\n          updatedContent,\n        );\n      }\n    }\n  }\n};\n"],"names":["generateFiles","joinPathFragments","OverwriteStrategy","addStarExport","esmVars","PACKAGES_DIR","SHARED_CONSTRUCTS_DIR","SHARED_TERRAFORM_DIR","PY_VERSIONS","terraformProviderVersions","addIdentityInfra","tree","options","iac","addIdentityCdkConstructs","addIdentityTerraformModules","Error","dirname","overwriteStrategy","KeepExisting","boto3Version","boto3","staticWebsiteModule","read","includes","callbackUrlModule","resourceStartPattern","resourceStartMatch","match","startIndex","index","length","braceCount","insertionPoint","i","char","beforeInsertion","substring","afterInsertion","updatedContent","write"],"mappings":"AAAA;;;CAGC,GACD,SACEA,aAAa,EACbC,iBAAiB,EACjBC,iBAAiB,QAEZ,aAAa;AACpB,SAASC,aAAa,QAAQ,YAAS;AAEvC,SAASC,OAAO,QAAQ,sBAAmB;AAC3C,SACEC,YAAY,EACZC,qBAAqB,EACrBC,oBAAoB,QACf,oCAAiC;AACxC,SAASC,WAAW,EAAEC,yBAAyB,QAAQ,iBAAc;AAOrE;;CAEC,GACD,OAAO,MAAMC,mBAAmB,OAC9BC,MACAC;IAEA,IAAIA,QAAQC,GAAG,KAAK,OAAO;QACzB,MAAMC,yBAAyBH,MAAMC;IACvC,OAAO,IAAIA,QAAQC,GAAG,KAAK,aAAa;QACtCE,4BAA4BJ,MAAMC;IACpC,OAAO;QACL,MAAM,IAAII,MAAM,CAAC,gBAAgB,EAAEJ,QAAQC,GAAG,EAAE;IAClD;AACF,EAAE;AAEF,MAAMC,2BAA2B,OAC/BH,MACAC;IAEAZ,cACEW,MACAV,kBAAkB,YAAYgB,OAAO,EAAE,SAAS,OAAO,SACvDhB,kBAAkBI,cAAcC,uBAAuB,OAAO,SAC9D;QAAE,GAAGM,OAAO;QAAE,GAAGR,QAAQO,KAAK;IAAC,GAC/B;QACEO,mBAAmBhB,kBAAkBiB,YAAY;IACnD;IAGF,MAAMhB,cACJQ,MACAV,kBACEI,cACAC,uBACA,OACA,QACA,aAEF;AAEJ;AAEA,MAAMS,8BAA8B,CAClCJ,MACAC;IAEAZ,cACEW,MACAV,kBAAkB,YAAYgB,OAAO,EAAE,SAAS,aAAa,SAC7DhB,kBAAkBI,cAAcE,sBAAsB,OAAO,SAC7D;QACE,GAAGK,OAAO;QACVQ,cAAcZ,YAAYa,KAAK;QAC/B,GAAGZ,2BAA2B;IAChC,GACA;QACES,mBAAmBhB,kBAAkBiB,YAAY;IACnD;IAGF,2DAA2D;IAC3D,MAAMG,sBAAsBX,KAAKY,IAAI,CACnCtB,kBACEI,cACAE,sBACA,OACA,QACA,kBACA,sBAEF;IAEF,IACEe,uBACA,CAACA,oBAAoBE,QAAQ,CAC3B,iDAEF;QACA,kGAAkG;QAClG,gHAAgH;QAChH,MAAMC,oBAAoB,CAAC;;;;;;;;;;;;;;;;;;;CAmB9B,CAAC;QAEE,wEAAwE;QACxE,kDAAkD;QAClD,MAAMC,uBACJ;QACF,MAAMC,qBAAqBL,oBAAoBM,KAAK,CAACF;QAErD,IAAIC,oBAAoB;YACtB,MAAME,aACJF,mBAAmBG,KAAK,GAAIH,kBAAkB,CAAC,EAAE,CAACI,MAAM,GAAG,GAAG,4BAA4B;YAC5F,IAAIC,aAAa;YACjB,IAAIC,iBAAiB,CAAC;YAEtB,qDAAqD;YACrD,IAAK,IAAIC,IAAIL,YAAYK,IAAIZ,oBAAoBS,MAAM,EAAEG,IAAK;gBAC5D,MAAMC,OAAOb,mBAAmB,CAACY,EAAE;gBACnC,IAAIC,SAAS,KAAK;oBAChBH;gBACF,OAAO,IAAIG,SAAS,KAAK;oBACvBH;oBACA,IAAIA,eAAe,GAAG;wBACpB,qDAAqD;wBACrDC,iBAAiBC,IAAI;wBACrB;oBACF;gBACF;YACF;YAEA,IAAID,mBAAmB,CAAC,GAAG;gBACzB,yEAAyE;gBACzE,MAAMG,kBAAkBd,oBAAoBe,SAAS,CACnD,GACAJ;gBAEF,MAAMK,iBAAiBhB,oBAAoBe,SAAS,CAACJ;gBACrD,MAAMM,iBACJH,kBAAkBX,oBAAoBa;gBAExC3B,KAAK6B,KAAK,CACRvC,kBACEI,cACAE,sBACA,OACA,QACA,kBACA,sBAEFgC;YAEJ;QACF;IACF;AACF"}

package/src/utils/init.js

@@ -187,6 +187,10 @@ export const PNPM_BUILT_DEPENDENCIES = [
         build: 'nx run-many --target build',
         lint: 'nx run-many --target lint --configuration=fix',
         test: 'nx run-many --target test --all',
+        // Trivy container image scanning is not part of `build` (its result
+        // depends on the ever-changing vulnerability database); run it explicitly,
+        // e.g. in CI.
+        trivy: 'nx run-many --target trivy --all',
         'build:skip-lint': 'nx run-many --target build --configuration=skip-lint',
         'build:all': 'nx run-many --target build --all',
         'affected:all': 'nx affected --target build'

package/src/utils/init.js.map

@@ -1 +1 @@
-{"version":3,"sources":["../../../../../packages/nx-plugin/src/utils/init.ts"],"sourcesContent":["/**\n * Copyright Amazon.com, Inc. or its affiliates. All Rights Reserved.\n * SPDX-License-Identifier: Apache-2.0\n */\nimport {\n  addDependenciesToPackageJson,\n  detectPackageManager,\n  generateFiles,\n  joinPathFragments,\n  OverwriteStrategy,\n  readNxJson,\n  type Tree,\n  updateJson,\n  updateNxJson,\n} from '@nx/devkit';\nimport { initGenerator } from '@nx/js';\nimport { readFileSync } from 'fs';\nimport yaml from 'js-yaml';\nimport { readModulePackageJson } from 'nx/src/utils/package-json';\nimport GeneratorsJson from '../../generators.json' with { type: 'json' };\nimport { SYNC_GENERATOR_NAME as TS_SYNC_GENERATOR_NAME } from '../ts/sync/generator';\nimport { BASE_TSCONFIG_COMPILER_OPTIONS } from './base-tsconfig';\nimport {\n  ensureAwsNxPluginConfig,\n  updateAwsNxPluginConfig,\n} from './config/utils';\nimport { type Containers, inferContainers } from './containers';\nimport { DEFAULT_BIOME_CONFIG } from './format';\nimport type { Iac } from './iac';\nimport { configureMcpServers } from './mcp';\nimport { getNpmScope } from './npm-scope';\nimport { mergeTargetDefault } from './nx';\nimport { getPackageManagerDisplayCommands } from './pkg-manager';\nimport { withVersions } from './versions';\n\nconst WORKSPACES = ['packages/*'];\nconst NX_TYPESCRIPT_SYNC_GENERATOR = '@nx/js:typescript-sync';\n\n// Built dependencies whose install scripts the generated workspace trusts.\n// `onlyBuiltDependencies` is the pnpm 10 key (silently ignored by pnpm 11);\n// pnpm 11 reads `allowBuilds` instead. Any dep NOT in this allowlist will\n// have its install scripts skipped with a warning — matching pnpm 10's\n// default behaviour. The user can opt-in later via `pnpm approve-builds`.\nexport const PNPM_BUILT_DEPENDENCIES = ['@swc/core', 'esbuild', 'nx', 'sharp'];\n\n/**\n * Options controlling how the workspace is initialised. These mirror the\n * preset schema so a workspace created via the preset and one initialised via\n * the `init` generator end up in the same shape.\n */\nexport interface ApplyWorkspaceInitOptions {\n  /** The IaC provider to record in the plugin config. */\n  readonly iac: Iac;\n  /**\n   * The container engine to record. `undefined`/`'infer'` picks docker when\n   * installed, else finch.\n   */\n  readonly containers?: Containers | 'infer';\n  /** Whether to configure MCP servers for coding agents. Defaults to true. */\n  readonly mcp?: boolean;\n  /**\n   * How to treat the generated workspace README. The preset owns the README of\n   * a greenfield workspace (`Overwrite`); the `init` generator must not clobber\n   * an existing workspace's README (`KeepExisting`, the default).\n   */\n  readonly readmeOverwriteStrategy?: OverwriteStrategy;\n  /**\n   * Whether to overwrite root package.json scripts that already exist. The\n   * preset owns a greenfield workspace's scripts (`true`); the `init`\n   * generator must not clobber an existing workspace's scripts (`false`,\n   * the default) — it only adds the convenience scripts that are absent.\n   */\n  readonly overwriteScripts?: boolean;\n}\n\n/**\n * Add or repair the pnpm `allowBuilds` / `onlyBuiltDependencies` allowlist for\n * the workspace's `packages` globs, without clobbering any packages the user\n * has already declared.\n *\n * A workspace not created by the preset commonly has either no\n * `pnpm-workspace.yaml`, one missing the `packages` globs, or one carrying the\n * broken `set this to true or false` placeholder pnpm writes when it skips a\n * build script. This makes the file self-consistent so the first generator's\n * install doesn't fail with `ERR_PNPM_IGNORED_BUILDS`.\n */\nconst setUpPnpmWorkspace = (tree: Tree) => {\n  const existing = tree.exists('pnpm-workspace.yaml')\n    ? ((yaml.load(tree.read('pnpm-workspace.yaml', 'utf-8') ?? '') as Record<\n        string,\n        unknown\n      >) ?? {})\n    : {};\n\n  // Preserve any packages globs the user already has, ensuring ours are present.\n  const packages = Array.from(\n    new Set([...((existing.packages as string[]) ?? []), ...WORKSPACES]),\n  );\n\n  const allowBuilds = {\n    ...(typeof existing.allowBuilds === 'object' && existing.allowBuilds\n      ? (existing.allowBuilds as Record<string, unknown>)\n      : {}),\n    // Overwrite any non-boolean (e.g. the \"set this to true or false\"\n    // placeholder) with an explicit true for the deps we trust.\n    ...Object.fromEntries(PNPM_BUILT_DEPENDENCIES.map((dep) => [dep, true])),\n  };\n\n  tree.write(\n    'pnpm-workspace.yaml',\n    yaml.dump(\n      {\n        ...existing,\n        packages,\n        allowBuilds,\n        onlyBuiltDependencies: PNPM_BUILT_DEPENDENCIES,\n      },\n      { quotingType: \"'\" },\n    ),\n  );\n};\n\n/**\n * Configure the workspace's package manager for a monorepo layout.\n *\n * pnpm workspaces are declared in `pnpm-workspace.yaml`; every other package\n * manager reads the `workspaces` field of the root `package.json`.\n */\nconst setUpWorkspaces = (tree: Tree) => {\n  if (detectPackageManager() === 'pnpm') {\n    setUpPnpmWorkspace(tree);\n  } else {\n    updateJson(tree, 'package.json', (json) => ({\n      ...json,\n      workspaces: Array.from(\n        new Set([...(json.workspaces ?? []), ...WORKSPACES]),\n      ),\n    }));\n  }\n};\n\n/**\n * Ensure the workspace has a `tsconfig.base.json`.\n *\n * `@nx/js` `initGenerator` (with `addTsPlugin`) normally creates this, but it\n * short-circuits when the workspace already has a root `tsconfig.json` — in\n * which case no base file is written and the next project generator fails with\n * `Cannot find tsconfig.base.json`. So we create a compatible one when it's\n * absent. An existing base is left untouched: the user may have tuned it, and\n * rewriting shared compiler options can break other projects (see the\n * \"add to an existing workspace\" guide).\n */\nconst ensureBaseTsConfig = (tree: Tree) => {\n  if (tree.exists('tsconfig.base.json')) {\n    return;\n  }\n  tree.write(\n    'tsconfig.base.json',\n    JSON.stringify(\n      {\n        compilerOptions: {\n          ...BASE_TSCONFIG_COMPILER_OPTIONS,\n          customConditions: [getNpmScope(tree)],\n        },\n      },\n      null,\n      2,\n    ),\n  );\n};\n\n/**\n * Ensure the workspace has a root `tsconfig.json`.\n *\n * Nx's `@nx/js:typescript-sync` generator hard-fails with\n * `Missing root \"tsconfig.json\"` when it's absent. The plugin's TypeScript\n * projects reference each other via this file, so we guarantee a minimal one\n * exists (sync populates its `references`).\n */\nconst ensureRootTsConfig = (tree: Tree) => {\n  if (tree.exists('tsconfig.json')) {\n    return;\n  }\n  tree.write(\n    'tsconfig.json',\n    JSON.stringify(\n      {\n        extends: './tsconfig.base.json',\n        files: [],\n        references: [],\n      },\n      null,\n      2,\n    ),\n  );\n};\n\n/**\n * Transform an Nx workspace into one ready to run `@aws/nx-plugin` generators.\n *\n * This is the deterministic core shared by the workspace preset and the `init`\n * generator. It is safe to re-run: every step is idempotent (config merges,\n * keyed nx.json / package.json entries, create-if-missing files), so running\n * it against an already-initialised workspace is a no-op.\n *\n * It preserves the workspace's module format: the root package.json `type`\n * field is owned by the preset (written from its `--module` option) and left\n * untouched here. It does NOT rewrite an existing `tsconfig.base.json`'s\n * compiler options, migrate a workspace's package manager, or restructure\n * existing projects — those are decisions for the user (see the \"add to an\n * existing workspace\" guide).\n */\nexport const applyWorkspaceInit = async (\n  tree: Tree,\n  {\n    iac,\n    containers,\n    mcp,\n    readmeOverwriteStrategy = OverwriteStrategy.KeepExisting,\n    overwriteScripts = false,\n  }: ApplyWorkspaceInitOptions,\n) => {\n  const resolvedContainers =\n    !containers || containers === 'infer' ? inferContainers() : containers;\n\n  // Write IaC provider and container engine to plugin config\n  await ensureAwsNxPluginConfig(tree);\n  await updateAwsNxPluginConfig(tree, {\n    iac: { provider: iac },\n    containers: { engine: resolvedContainers },\n  });\n\n  // Set up the TypeScript plugin, base tsconfig, formatter etc. `@nx/js`\n  // creates `tsconfig.base.json` when absent, but skips it when a root\n  // `tsconfig.json` already exists — so we ensure both explicitly below.\n  await initGenerator(tree, {\n    formatter: 'none',\n    addTsPlugin: true,\n  });\n\n  ensureBaseTsConfig(tree);\n  ensureRootTsConfig(tree);\n\n  setUpWorkspaces(tree);\n\n  const nxJson = readNxJson(tree);\n  updateNxJson(tree, {\n    ...nxJson,\n    // Preserve an explicit analytics choice in an existing workspace.\n    analytics: (nxJson as { analytics?: boolean }).analytics ?? false,\n    targetDefaults: {\n      ...nxJson.targetDefaults,\n      compile: mergeTargetDefault(nxJson.targetDefaults?.compile, (base) => ({\n        ...base,\n        syncGenerators: [\n          ...(base.syncGenerators ?? []).filter(\n            (g) =>\n              ![TS_SYNC_GENERATOR_NAME, NX_TYPESCRIPT_SYNC_GENERATOR].includes(\n                g,\n              ),\n          ),\n          NX_TYPESCRIPT_SYNC_GENERATOR,\n          TS_SYNC_GENERATOR_NAME,\n        ],\n      })),\n    },\n  });\n\n  const CONVENIENCE_SCRIPTS = {\n    dev: 'nx run-many --target dev',\n    build: 'nx run-many --target build',\n    lint: 'nx run-many --target lint --configuration=fix',\n    test: 'nx run-many --target test --all',\n    'build:skip-lint': 'nx run-many --target build --configuration=skip-lint',\n    'build:all': 'nx run-many --target build --all',\n    'affected:all': 'nx affected --target build',\n  };\n  updateJson(tree, 'package.json', (packageJson) => ({\n    ...packageJson,\n    // The root `type` field is owned by the preset (written explicitly from\n    // its `--module` option). `init` preserves an existing workspace's field\n    // as-is: an ESM workspace already carries `type: \"module\"` (that is how\n    // the format is inferred), and introducing a `type` into a CommonJS\n    // workspace that lacks one changes behaviour for frameworks that parse it\n    // (e.g. Next.js starts treating the app's ESM source as CJS).\n    scripts: overwriteScripts\n      ? { ...packageJson.scripts, ...CONVENIENCE_SCRIPTS }\n      : { ...CONVENIENCE_SCRIPTS, ...packageJson.scripts },\n  }));\n\n  // Pin the workspace's `nx` to the version the plugin's @nx/* packages are\n  // built against. A mismatched workspace nx (even a patch apart) hoists a\n  // second nested nx under @nx/js, and the two instances deadlock `nx sync`.\n  // `@nx/js` must be a root dependency for the `@nx/js:typescript-sync`\n  // generator registered in nx.json to resolve (npm doesn't hoist the\n  // plugin's own copy reliably).\n  const nxVersion = readModulePackageJson('@nx/js').packageJson.version;\n  addDependenciesToPackageJson(\n    tree,\n    {},\n    {\n      nx: nxVersion,\n      '@nx/js': nxVersion,\n      '@nx/workspace': nxVersion,\n      ...withVersions(['typescript', '@biomejs/biome']),\n    },\n  );\n\n  // Write biome.json for formatting and linting\n  if (!tree.exists('biome.json')) {\n    tree.write('biome.json', JSON.stringify(DEFAULT_BIOME_CONFIG, null, 2));\n  }\n\n  generateFiles(\n    tree, // the virtual file system\n    joinPathFragments(import.meta.dirname, '..', 'preset', 'files'),\n    '.',\n    {\n      projectName: getNpmScope(tree),\n      generators: Object.entries(GeneratorsJson.generators)\n        .filter(([_, v]) => !v['hidden'])\n        .map(([k, v]) => ({ name: k, description: v.description })),\n      ...(() => {\n        const cmds = getPackageManagerDisplayCommands();\n        return {\n          pkgMgrCmd: cmds.exec,\n          buildCmd: `${cmds.run} build`,\n          lintCmd: `${cmds.run} lint`,\n        };\n      })(),\n    },\n    {\n      overwriteStrategy: readmeOverwriteStrategy,\n    },\n  );\n\n  if (mcp !== false) {\n    configureMcpServers(tree);\n  }\n};\n"],"names":["addDependenciesToPackageJson","detectPackageManager","generateFiles","joinPathFragments","OverwriteStrategy","readNxJson","updateJson","updateNxJson","initGenerator","yaml","readModulePackageJson","GeneratorsJson","type","SYNC_GENERATOR_NAME","TS_SYNC_GENERATOR_NAME","BASE_TSCONFIG_COMPILER_OPTIONS","ensureAwsNxPluginConfig","updateAwsNxPluginConfig","inferContainers","DEFAULT_BIOME_CONFIG","configureMcpServers","getNpmScope","mergeTargetDefault","getPackageManagerDisplayCommands","withVersions","WORKSPACES","NX_TYPESCRIPT_SYNC_GENERATOR","PNPM_BUILT_DEPENDENCIES","setUpPnpmWorkspace","tree","existing","exists","load","read","packages","Array","from","Set","allowBuilds","Object","fromEntries","map","dep","write","dump","onlyBuiltDependencies","quotingType","setUpWorkspaces","json","workspaces","ensureBaseTsConfig","JSON","stringify","compilerOptions","customConditions","ensureRootTsConfig","extends","files","references","applyWorkspaceInit","iac","containers","mcp","readmeOverwriteStrategy","KeepExisting","overwriteScripts","resolvedContainers","provider","engine","formatter","addTsPlugin","nxJson","analytics","targetDefaults","compile","base","syncGenerators","filter","g","includes","CONVENIENCE_SCRIPTS","dev","build","lint","test","packageJson","scripts","nxVersion","version","nx","dirname","projectName","generators","entries","_","v","k","name","description","cmds","pkgMgrCmd","exec","buildCmd","run","lintCmd","overwriteStrategy"],"mappings":"AAAA;;;CAGC,GACD,SACEA,4BAA4B,EAC5BC,oBAAoB,EACpBC,aAAa,EACbC,iBAAiB,EACjBC,iBAAiB,EACjBC,UAAU,EAEVC,UAAU,EACVC,YAAY,QACP,aAAa;AACpB,SAASC,aAAa,QAAQ,SAAS;AAEvC,OAAOC,UAAU,UAAU;AAC3B,SAASC,qBAAqB,QAAQ,4BAA4B;AAClE,OAAOC,oBAAoB,6BAA6B;IAAEC,MAAM;AAAO,EAAE;AACzE,SAASC,uBAAuBC,sBAAsB,QAAQ,0BAAuB;AACrF,SAASC,8BAA8B,QAAQ,qBAAkB;AACjE,SACEC,uBAAuB,EACvBC,uBAAuB,QAClB,oBAAiB;AACxB,SAA0BC,eAAe,QAAQ,kBAAe;AAChE,SAASC,oBAAoB,QAAQ,cAAW;AAEhD,SAASC,mBAAmB,QAAQ,WAAQ;AAC5C,SAASC,WAAW,QAAQ,iBAAc;AAC1C,SAASC,kBAAkB,QAAQ,UAAO;AAC1C,SAASC,gCAAgC,QAAQ,mBAAgB;AACjE,SAASC,YAAY,QAAQ,gBAAa;AAE1C,MAAMC,aAAa;IAAC;CAAa;AACjC,MAAMC,+BAA+B;AAErC,2EAA2E;AAC3E,4EAA4E;AAC5E,0EAA0E;AAC1E,uEAAuE;AACvE,0EAA0E;AAC1E,OAAO,MAAMC,0BAA0B;IAAC;IAAa;IAAW;IAAM;CAAQ,CAAC;AAgC/E;;;;;;;;;;CAUC,GACD,MAAMC,qBAAqB,CAACC;IAC1B,MAAMC,WAAWD,KAAKE,MAAM,CAAC,yBACxB,AAACtB,KAAKuB,IAAI,CAACH,KAAKI,IAAI,CAAC,uBAAuB,YAAY,OAGnD,CAAC,IACP,CAAC;IAEL,+EAA+E;IAC/E,MAAMC,WAAWC,MAAMC,IAAI,CACzB,IAAIC,IAAI;WAAK,AAACP,SAASI,QAAQ,IAAiB,EAAE;WAAMT;KAAW;IAGrE,MAAMa,cAAc;QAClB,GAAI,OAAOR,SAASQ,WAAW,KAAK,YAAYR,SAASQ,WAAW,GAC/DR,SAASQ,WAAW,GACrB,CAAC,CAAC;QACN,kEAAkE;QAClE,4DAA4D;QAC5D,GAAGC,OAAOC,WAAW,CAACb,wBAAwBc,GAAG,CAAC,CAACC,MAAQ;gBAACA;gBAAK;aAAK,EAAE;IAC1E;IAEAb,KAAKc,KAAK,CACR,uBACAlC,KAAKmC,IAAI,CACP;QACE,GAAGd,QAAQ;QACXI;QACAI;QACAO,uBAAuBlB;IACzB,GACA;QAAEmB,aAAa;IAAI;AAGzB;AAEA;;;;;CAKC,GACD,MAAMC,kBAAkB,CAAClB;IACvB,IAAI5B,2BAA2B,QAAQ;QACrC2B,mBAAmBC;IACrB,OAAO;QACLvB,WAAWuB,MAAM,gBAAgB,CAACmB,OAAU,CAAA;gBAC1C,GAAGA,IAAI;gBACPC,YAAYd,MAAMC,IAAI,CACpB,IAAIC,IAAI;uBAAKW,KAAKC,UAAU,IAAI,EAAE;uBAAMxB;iBAAW;YAEvD,CAAA;IACF;AACF;AAEA;;;;;;;;;;CAUC,GACD,MAAMyB,qBAAqB,CAACrB;IAC1B,IAAIA,KAAKE,MAAM,CAAC,uBAAuB;QACrC;IACF;IACAF,KAAKc,KAAK,CACR,sBACAQ,KAAKC,SAAS,CACZ;QACEC,iBAAiB;YACf,GAAGtC,8BAA8B;YACjCuC,kBAAkB;gBAACjC,YAAYQ;aAAM;QACvC;IACF,GACA,MACA;AAGN;AAEA;;;;;;;CAOC,GACD,MAAM0B,qBAAqB,CAAC1B;IAC1B,IAAIA,KAAKE,MAAM,CAAC,kBAAkB;QAChC;IACF;IACAF,KAAKc,KAAK,CACR,iBACAQ,KAAKC,SAAS,CACZ;QACEI,SAAS;QACTC,OAAO,EAAE;QACTC,YAAY,EAAE;IAChB,GACA,MACA;AAGN;AAEA;;;;;;;;;;;;;;CAcC,GACD,OAAO,MAAMC,qBAAqB,OAChC9B,MACA,EACE+B,GAAG,EACHC,UAAU,EACVC,GAAG,EACHC,0BAA0B3D,kBAAkB4D,YAAY,EACxDC,mBAAmB,KAAK,EACE;IAE5B,MAAMC,qBACJ,CAACL,cAAcA,eAAe,UAAU3C,oBAAoB2C;IAE9D,2DAA2D;IAC3D,MAAM7C,wBAAwBa;IAC9B,MAAMZ,wBAAwBY,MAAM;QAClC+B,KAAK;YAAEO,UAAUP;QAAI;QACrBC,YAAY;YAAEO,QAAQF;QAAmB;IAC3C;IAEA,uEAAuE;IACvE,qEAAqE;IACrE,uEAAuE;IACvE,MAAM1D,cAAcqB,MAAM;QACxBwC,WAAW;QACXC,aAAa;IACf;IAEApB,mBAAmBrB;IACnB0B,mBAAmB1B;IAEnBkB,gBAAgBlB;IAEhB,MAAM0C,SAASlE,WAAWwB;IAC1BtB,aAAasB,MAAM;QACjB,GAAG0C,MAAM;QACT,kEAAkE;QAClEC,WAAW,AAACD,OAAmCC,SAAS,IAAI;QAC5DC,gBAAgB;YACd,GAAGF,OAAOE,cAAc;YACxBC,SAASpD,mBAAmBiD,OAAOE,cAAc,EAAEC,SAAS,CAACC,OAAU,CAAA;oBACrE,GAAGA,IAAI;oBACPC,gBAAgB;2BACX,AAACD,CAAAA,KAAKC,cAAc,IAAI,EAAE,AAAD,EAAGC,MAAM,CACnC,CAACC,IACC,CAAC;gCAAChE;gCAAwBY;6BAA6B,CAACqD,QAAQ,CAC9DD;wBAGNpD;wBACAZ;qBACD;gBACH,CAAA;QACF;IACF;IAEA,MAAMkE,sBAAsB;QAC1BC,KAAK;QACLC,OAAO;QACPC,MAAM;QACNC,MAAM;QACN,mBAAmB;QACnB,aAAa;QACb,gBAAgB;IAClB;IACA9E,WAAWuB,MAAM,gBAAgB,CAACwD,cAAiB,CAAA;YACjD,GAAGA,WAAW;YACd,wEAAwE;YACxE,yEAAyE;YACzE,wEAAwE;YACxE,oEAAoE;YACpE,0EAA0E;YAC1E,8DAA8D;YAC9DC,SAASrB,mBACL;gBAAE,GAAGoB,YAAYC,OAAO;gBAAE,GAAGN,mBAAmB;YAAC,IACjD;gBAAE,GAAGA,mBAAmB;gBAAE,GAAGK,YAAYC,OAAO;YAAC;QACvD,CAAA;IAEA,0EAA0E;IAC1E,yEAAyE;IACzE,2EAA2E;IAC3E,sEAAsE;IACtE,oEAAoE;IACpE,+BAA+B;IAC/B,MAAMC,YAAY7E,sBAAsB,UAAU2E,WAAW,CAACG,OAAO;IACrExF,6BACE6B,MACA,CAAC,GACD;QACE4D,IAAIF;QACJ,UAAUA;QACV,iBAAiBA;QACjB,GAAG/D,aAAa;YAAC;YAAc;SAAiB,CAAC;IACnD;IAGF,8CAA8C;IAC9C,IAAI,CAACK,KAAKE,MAAM,CAAC,eAAe;QAC9BF,KAAKc,KAAK,CAAC,cAAcQ,KAAKC,SAAS,CAACjC,sBAAsB,MAAM;IACtE;IAEAjB,cACE2B,MACA1B,kBAAkB,YAAYuF,OAAO,EAAE,MAAM,UAAU,UACvD,KACA;QACEC,aAAatE,YAAYQ;QACzB+D,YAAYrD,OAAOsD,OAAO,CAAClF,eAAeiF,UAAU,EACjDf,MAAM,CAAC,CAAC,CAACiB,GAAGC,EAAE,GAAK,CAACA,CAAC,CAAC,SAAS,EAC/BtD,GAAG,CAAC,CAAC,CAACuD,GAAGD,EAAE,GAAM,CAAA;gBAAEE,MAAMD;gBAAGE,aAAaH,EAAEG,WAAW;YAAC,CAAA;QAC1D,GAAG,AAAC,CAAA;YACF,MAAMC,OAAO5E;YACb,OAAO;gBACL6E,WAAWD,KAAKE,IAAI;gBACpBC,UAAU,GAAGH,KAAKI,GAAG,CAAC,MAAM,CAAC;gBAC7BC,SAAS,GAAGL,KAAKI,GAAG,CAAC,KAAK,CAAC;YAC7B;QACF,CAAA,GAAI;IACN,GACA;QACEE,mBAAmB1C;IACrB;IAGF,IAAID,QAAQ,OAAO;QACjB1C,oBAAoBS;IACtB;AACF,EAAE"}
+{"version":3,"sources":["../../../../../packages/nx-plugin/src/utils/init.ts"],"sourcesContent":["/**\n * Copyright Amazon.com, Inc. or its affiliates. All Rights Reserved.\n * SPDX-License-Identifier: Apache-2.0\n */\nimport {\n  addDependenciesToPackageJson,\n  detectPackageManager,\n  generateFiles,\n  joinPathFragments,\n  OverwriteStrategy,\n  readNxJson,\n  type Tree,\n  updateJson,\n  updateNxJson,\n} from '@nx/devkit';\nimport { initGenerator } from '@nx/js';\nimport { readFileSync } from 'fs';\nimport yaml from 'js-yaml';\nimport { readModulePackageJson } from 'nx/src/utils/package-json';\nimport GeneratorsJson from '../../generators.json' with { type: 'json' };\nimport { SYNC_GENERATOR_NAME as TS_SYNC_GENERATOR_NAME } from '../ts/sync/generator';\nimport { BASE_TSCONFIG_COMPILER_OPTIONS } from './base-tsconfig';\nimport {\n  ensureAwsNxPluginConfig,\n  updateAwsNxPluginConfig,\n} from './config/utils';\nimport { type Containers, inferContainers } from './containers';\nimport { DEFAULT_BIOME_CONFIG } from './format';\nimport type { Iac } from './iac';\nimport { configureMcpServers } from './mcp';\nimport { getNpmScope } from './npm-scope';\nimport { mergeTargetDefault } from './nx';\nimport { getPackageManagerDisplayCommands } from './pkg-manager';\nimport { withVersions } from './versions';\n\nconst WORKSPACES = ['packages/*'];\nconst NX_TYPESCRIPT_SYNC_GENERATOR = '@nx/js:typescript-sync';\n\n// Built dependencies whose install scripts the generated workspace trusts.\n// `onlyBuiltDependencies` is the pnpm 10 key (silently ignored by pnpm 11);\n// pnpm 11 reads `allowBuilds` instead. Any dep NOT in this allowlist will\n// have its install scripts skipped with a warning — matching pnpm 10's\n// default behaviour. The user can opt-in later via `pnpm approve-builds`.\nexport const PNPM_BUILT_DEPENDENCIES = ['@swc/core', 'esbuild', 'nx', 'sharp'];\n\n/**\n * Options controlling how the workspace is initialised. These mirror the\n * preset schema so a workspace created via the preset and one initialised via\n * the `init` generator end up in the same shape.\n */\nexport interface ApplyWorkspaceInitOptions {\n  /** The IaC provider to record in the plugin config. */\n  readonly iac: Iac;\n  /**\n   * The container engine to record. `undefined`/`'infer'` picks docker when\n   * installed, else finch.\n   */\n  readonly containers?: Containers | 'infer';\n  /** Whether to configure MCP servers for coding agents. Defaults to true. */\n  readonly mcp?: boolean;\n  /**\n   * How to treat the generated workspace README. The preset owns the README of\n   * a greenfield workspace (`Overwrite`); the `init` generator must not clobber\n   * an existing workspace's README (`KeepExisting`, the default).\n   */\n  readonly readmeOverwriteStrategy?: OverwriteStrategy;\n  /**\n   * Whether to overwrite root package.json scripts that already exist. The\n   * preset owns a greenfield workspace's scripts (`true`); the `init`\n   * generator must not clobber an existing workspace's scripts (`false`,\n   * the default) — it only adds the convenience scripts that are absent.\n   */\n  readonly overwriteScripts?: boolean;\n}\n\n/**\n * Add or repair the pnpm `allowBuilds` / `onlyBuiltDependencies` allowlist for\n * the workspace's `packages` globs, without clobbering any packages the user\n * has already declared.\n *\n * A workspace not created by the preset commonly has either no\n * `pnpm-workspace.yaml`, one missing the `packages` globs, or one carrying the\n * broken `set this to true or false` placeholder pnpm writes when it skips a\n * build script. This makes the file self-consistent so the first generator's\n * install doesn't fail with `ERR_PNPM_IGNORED_BUILDS`.\n */\nconst setUpPnpmWorkspace = (tree: Tree) => {\n  const existing = tree.exists('pnpm-workspace.yaml')\n    ? ((yaml.load(tree.read('pnpm-workspace.yaml', 'utf-8') ?? '') as Record<\n        string,\n        unknown\n      >) ?? {})\n    : {};\n\n  // Preserve any packages globs the user already has, ensuring ours are present.\n  const packages = Array.from(\n    new Set([...((existing.packages as string[]) ?? []), ...WORKSPACES]),\n  );\n\n  const allowBuilds = {\n    ...(typeof existing.allowBuilds === 'object' && existing.allowBuilds\n      ? (existing.allowBuilds as Record<string, unknown>)\n      : {}),\n    // Overwrite any non-boolean (e.g. the \"set this to true or false\"\n    // placeholder) with an explicit true for the deps we trust.\n    ...Object.fromEntries(PNPM_BUILT_DEPENDENCIES.map((dep) => [dep, true])),\n  };\n\n  tree.write(\n    'pnpm-workspace.yaml',\n    yaml.dump(\n      {\n        ...existing,\n        packages,\n        allowBuilds,\n        onlyBuiltDependencies: PNPM_BUILT_DEPENDENCIES,\n      },\n      { quotingType: \"'\" },\n    ),\n  );\n};\n\n/**\n * Configure the workspace's package manager for a monorepo layout.\n *\n * pnpm workspaces are declared in `pnpm-workspace.yaml`; every other package\n * manager reads the `workspaces` field of the root `package.json`.\n */\nconst setUpWorkspaces = (tree: Tree) => {\n  if (detectPackageManager() === 'pnpm') {\n    setUpPnpmWorkspace(tree);\n  } else {\n    updateJson(tree, 'package.json', (json) => ({\n      ...json,\n      workspaces: Array.from(\n        new Set([...(json.workspaces ?? []), ...WORKSPACES]),\n      ),\n    }));\n  }\n};\n\n/**\n * Ensure the workspace has a `tsconfig.base.json`.\n *\n * `@nx/js` `initGenerator` (with `addTsPlugin`) normally creates this, but it\n * short-circuits when the workspace already has a root `tsconfig.json` — in\n * which case no base file is written and the next project generator fails with\n * `Cannot find tsconfig.base.json`. So we create a compatible one when it's\n * absent. An existing base is left untouched: the user may have tuned it, and\n * rewriting shared compiler options can break other projects (see the\n * \"add to an existing workspace\" guide).\n */\nconst ensureBaseTsConfig = (tree: Tree) => {\n  if (tree.exists('tsconfig.base.json')) {\n    return;\n  }\n  tree.write(\n    'tsconfig.base.json',\n    JSON.stringify(\n      {\n        compilerOptions: {\n          ...BASE_TSCONFIG_COMPILER_OPTIONS,\n          customConditions: [getNpmScope(tree)],\n        },\n      },\n      null,\n      2,\n    ),\n  );\n};\n\n/**\n * Ensure the workspace has a root `tsconfig.json`.\n *\n * Nx's `@nx/js:typescript-sync` generator hard-fails with\n * `Missing root \"tsconfig.json\"` when it's absent. The plugin's TypeScript\n * projects reference each other via this file, so we guarantee a minimal one\n * exists (sync populates its `references`).\n */\nconst ensureRootTsConfig = (tree: Tree) => {\n  if (tree.exists('tsconfig.json')) {\n    return;\n  }\n  tree.write(\n    'tsconfig.json',\n    JSON.stringify(\n      {\n        extends: './tsconfig.base.json',\n        files: [],\n        references: [],\n      },\n      null,\n      2,\n    ),\n  );\n};\n\n/**\n * Transform an Nx workspace into one ready to run `@aws/nx-plugin` generators.\n *\n * This is the deterministic core shared by the workspace preset and the `init`\n * generator. It is safe to re-run: every step is idempotent (config merges,\n * keyed nx.json / package.json entries, create-if-missing files), so running\n * it against an already-initialised workspace is a no-op.\n *\n * It preserves the workspace's module format: the root package.json `type`\n * field is owned by the preset (written from its `--module` option) and left\n * untouched here. It does NOT rewrite an existing `tsconfig.base.json`'s\n * compiler options, migrate a workspace's package manager, or restructure\n * existing projects — those are decisions for the user (see the \"add to an\n * existing workspace\" guide).\n */\nexport const applyWorkspaceInit = async (\n  tree: Tree,\n  {\n    iac,\n    containers,\n    mcp,\n    readmeOverwriteStrategy = OverwriteStrategy.KeepExisting,\n    overwriteScripts = false,\n  }: ApplyWorkspaceInitOptions,\n) => {\n  const resolvedContainers =\n    !containers || containers === 'infer' ? inferContainers() : containers;\n\n  // Write IaC provider and container engine to plugin config\n  await ensureAwsNxPluginConfig(tree);\n  await updateAwsNxPluginConfig(tree, {\n    iac: { provider: iac },\n    containers: { engine: resolvedContainers },\n  });\n\n  // Set up the TypeScript plugin, base tsconfig, formatter etc. `@nx/js`\n  // creates `tsconfig.base.json` when absent, but skips it when a root\n  // `tsconfig.json` already exists — so we ensure both explicitly below.\n  await initGenerator(tree, {\n    formatter: 'none',\n    addTsPlugin: true,\n  });\n\n  ensureBaseTsConfig(tree);\n  ensureRootTsConfig(tree);\n\n  setUpWorkspaces(tree);\n\n  const nxJson = readNxJson(tree);\n  updateNxJson(tree, {\n    ...nxJson,\n    // Preserve an explicit analytics choice in an existing workspace.\n    analytics: (nxJson as { analytics?: boolean }).analytics ?? false,\n    targetDefaults: {\n      ...nxJson.targetDefaults,\n      compile: mergeTargetDefault(nxJson.targetDefaults?.compile, (base) => ({\n        ...base,\n        syncGenerators: [\n          ...(base.syncGenerators ?? []).filter(\n            (g) =>\n              ![TS_SYNC_GENERATOR_NAME, NX_TYPESCRIPT_SYNC_GENERATOR].includes(\n                g,\n              ),\n          ),\n          NX_TYPESCRIPT_SYNC_GENERATOR,\n          TS_SYNC_GENERATOR_NAME,\n        ],\n      })),\n    },\n  });\n\n  const CONVENIENCE_SCRIPTS = {\n    dev: 'nx run-many --target dev',\n    build: 'nx run-many --target build',\n    lint: 'nx run-many --target lint --configuration=fix',\n    test: 'nx run-many --target test --all',\n    // Trivy container image scanning is not part of `build` (its result\n    // depends on the ever-changing vulnerability database); run it explicitly,\n    // e.g. in CI.\n    trivy: 'nx run-many --target trivy --all',\n    'build:skip-lint': 'nx run-many --target build --configuration=skip-lint',\n    'build:all': 'nx run-many --target build --all',\n    'affected:all': 'nx affected --target build',\n  };\n  updateJson(tree, 'package.json', (packageJson) => ({\n    ...packageJson,\n    // The root `type` field is owned by the preset (written explicitly from\n    // its `--module` option). `init` preserves an existing workspace's field\n    // as-is: an ESM workspace already carries `type: \"module\"` (that is how\n    // the format is inferred), and introducing a `type` into a CommonJS\n    // workspace that lacks one changes behaviour for frameworks that parse it\n    // (e.g. Next.js starts treating the app's ESM source as CJS).\n    scripts: overwriteScripts\n      ? { ...packageJson.scripts, ...CONVENIENCE_SCRIPTS }\n      : { ...CONVENIENCE_SCRIPTS, ...packageJson.scripts },\n  }));\n\n  // Pin the workspace's `nx` to the version the plugin's @nx/* packages are\n  // built against. A mismatched workspace nx (even a patch apart) hoists a\n  // second nested nx under @nx/js, and the two instances deadlock `nx sync`.\n  // `@nx/js` must be a root dependency for the `@nx/js:typescript-sync`\n  // generator registered in nx.json to resolve (npm doesn't hoist the\n  // plugin's own copy reliably).\n  const nxVersion = readModulePackageJson('@nx/js').packageJson.version;\n  addDependenciesToPackageJson(\n    tree,\n    {},\n    {\n      nx: nxVersion,\n      '@nx/js': nxVersion,\n      '@nx/workspace': nxVersion,\n      ...withVersions(['typescript', '@biomejs/biome']),\n    },\n  );\n\n  // Write biome.json for formatting and linting\n  if (!tree.exists('biome.json')) {\n    tree.write('biome.json', JSON.stringify(DEFAULT_BIOME_CONFIG, null, 2));\n  }\n\n  generateFiles(\n    tree, // the virtual file system\n    joinPathFragments(import.meta.dirname, '..', 'preset', 'files'),\n    '.',\n    {\n      projectName: getNpmScope(tree),\n      generators: Object.entries(GeneratorsJson.generators)\n        .filter(([_, v]) => !v['hidden'])\n        .map(([k, v]) => ({ name: k, description: v.description })),\n      ...(() => {\n        const cmds = getPackageManagerDisplayCommands();\n        return {\n          pkgMgrCmd: cmds.exec,\n          buildCmd: `${cmds.run} build`,\n          lintCmd: `${cmds.run} lint`,\n        };\n      })(),\n    },\n    {\n      overwriteStrategy: readmeOverwriteStrategy,\n    },\n  );\n\n  if (mcp !== false) {\n    configureMcpServers(tree);\n  }\n};\n"],"names":["addDependenciesToPackageJson","detectPackageManager","generateFiles","joinPathFragments","OverwriteStrategy","readNxJson","updateJson","updateNxJson","initGenerator","yaml","readModulePackageJson","GeneratorsJson","type","SYNC_GENERATOR_NAME","TS_SYNC_GENERATOR_NAME","BASE_TSCONFIG_COMPILER_OPTIONS","ensureAwsNxPluginConfig","updateAwsNxPluginConfig","inferContainers","DEFAULT_BIOME_CONFIG","configureMcpServers","getNpmScope","mergeTargetDefault","getPackageManagerDisplayCommands","withVersions","WORKSPACES","NX_TYPESCRIPT_SYNC_GENERATOR","PNPM_BUILT_DEPENDENCIES","setUpPnpmWorkspace","tree","existing","exists","load","read","packages","Array","from","Set","allowBuilds","Object","fromEntries","map","dep","write","dump","onlyBuiltDependencies","quotingType","setUpWorkspaces","json","workspaces","ensureBaseTsConfig","JSON","stringify","compilerOptions","customConditions","ensureRootTsConfig","extends","files","references","applyWorkspaceInit","iac","containers","mcp","readmeOverwriteStrategy","KeepExisting","overwriteScripts","resolvedContainers","provider","engine","formatter","addTsPlugin","nxJson","analytics","targetDefaults","compile","base","syncGenerators","filter","g","includes","CONVENIENCE_SCRIPTS","dev","build","lint","test","trivy","packageJson","scripts","nxVersion","version","nx","dirname","projectName","generators","entries","_","v","k","name","description","cmds","pkgMgrCmd","exec","buildCmd","run","lintCmd","overwriteStrategy"],"mappings":"AAAA;;;CAGC,GACD,SACEA,4BAA4B,EAC5BC,oBAAoB,EACpBC,aAAa,EACbC,iBAAiB,EACjBC,iBAAiB,EACjBC,UAAU,EAEVC,UAAU,EACVC,YAAY,QACP,aAAa;AACpB,SAASC,aAAa,QAAQ,SAAS;AAEvC,OAAOC,UAAU,UAAU;AAC3B,SAASC,qBAAqB,QAAQ,4BAA4B;AAClE,OAAOC,oBAAoB,6BAA6B;IAAEC,MAAM;AAAO,EAAE;AACzE,SAASC,uBAAuBC,sBAAsB,QAAQ,0BAAuB;AACrF,SAASC,8BAA8B,QAAQ,qBAAkB;AACjE,SACEC,uBAAuB,EACvBC,uBAAuB,QAClB,oBAAiB;AACxB,SAA0BC,eAAe,QAAQ,kBAAe;AAChE,SAASC,oBAAoB,QAAQ,cAAW;AAEhD,SAASC,mBAAmB,QAAQ,WAAQ;AAC5C,SAASC,WAAW,QAAQ,iBAAc;AAC1C,SAASC,kBAAkB,QAAQ,UAAO;AAC1C,SAASC,gCAAgC,QAAQ,mBAAgB;AACjE,SAASC,YAAY,QAAQ,gBAAa;AAE1C,MAAMC,aAAa;IAAC;CAAa;AACjC,MAAMC,+BAA+B;AAErC,2EAA2E;AAC3E,4EAA4E;AAC5E,0EAA0E;AAC1E,uEAAuE;AACvE,0EAA0E;AAC1E,OAAO,MAAMC,0BAA0B;IAAC;IAAa;IAAW;IAAM;CAAQ,CAAC;AAgC/E;;;;;;;;;;CAUC,GACD,MAAMC,qBAAqB,CAACC;IAC1B,MAAMC,WAAWD,KAAKE,MAAM,CAAC,yBACxB,AAACtB,KAAKuB,IAAI,CAACH,KAAKI,IAAI,CAAC,uBAAuB,YAAY,OAGnD,CAAC,IACP,CAAC;IAEL,+EAA+E;IAC/E,MAAMC,WAAWC,MAAMC,IAAI,CACzB,IAAIC,IAAI;WAAK,AAACP,SAASI,QAAQ,IAAiB,EAAE;WAAMT;KAAW;IAGrE,MAAMa,cAAc;QAClB,GAAI,OAAOR,SAASQ,WAAW,KAAK,YAAYR,SAASQ,WAAW,GAC/DR,SAASQ,WAAW,GACrB,CAAC,CAAC;QACN,kEAAkE;QAClE,4DAA4D;QAC5D,GAAGC,OAAOC,WAAW,CAACb,wBAAwBc,GAAG,CAAC,CAACC,MAAQ;gBAACA;gBAAK;aAAK,EAAE;IAC1E;IAEAb,KAAKc,KAAK,CACR,uBACAlC,KAAKmC,IAAI,CACP;QACE,GAAGd,QAAQ;QACXI;QACAI;QACAO,uBAAuBlB;IACzB,GACA;QAAEmB,aAAa;IAAI;AAGzB;AAEA;;;;;CAKC,GACD,MAAMC,kBAAkB,CAAClB;IACvB,IAAI5B,2BAA2B,QAAQ;QACrC2B,mBAAmBC;IACrB,OAAO;QACLvB,WAAWuB,MAAM,gBAAgB,CAACmB,OAAU,CAAA;gBAC1C,GAAGA,IAAI;gBACPC,YAAYd,MAAMC,IAAI,CACpB,IAAIC,IAAI;uBAAKW,KAAKC,UAAU,IAAI,EAAE;uBAAMxB;iBAAW;YAEvD,CAAA;IACF;AACF;AAEA;;;;;;;;;;CAUC,GACD,MAAMyB,qBAAqB,CAACrB;IAC1B,IAAIA,KAAKE,MAAM,CAAC,uBAAuB;QACrC;IACF;IACAF,KAAKc,KAAK,CACR,sBACAQ,KAAKC,SAAS,CACZ;QACEC,iBAAiB;YACf,GAAGtC,8BAA8B;YACjCuC,kBAAkB;gBAACjC,YAAYQ;aAAM;QACvC;IACF,GACA,MACA;AAGN;AAEA;;;;;;;CAOC,GACD,MAAM0B,qBAAqB,CAAC1B;IAC1B,IAAIA,KAAKE,MAAM,CAAC,kBAAkB;QAChC;IACF;IACAF,KAAKc,KAAK,CACR,iBACAQ,KAAKC,SAAS,CACZ;QACEI,SAAS;QACTC,OAAO,EAAE;QACTC,YAAY,EAAE;IAChB,GACA,MACA;AAGN;AAEA;;;;;;;;;;;;;;CAcC,GACD,OAAO,MAAMC,qBAAqB,OAChC9B,MACA,EACE+B,GAAG,EACHC,UAAU,EACVC,GAAG,EACHC,0BAA0B3D,kBAAkB4D,YAAY,EACxDC,mBAAmB,KAAK,EACE;IAE5B,MAAMC,qBACJ,CAACL,cAAcA,eAAe,UAAU3C,oBAAoB2C;IAE9D,2DAA2D;IAC3D,MAAM7C,wBAAwBa;IAC9B,MAAMZ,wBAAwBY,MAAM;QAClC+B,KAAK;YAAEO,UAAUP;QAAI;QACrBC,YAAY;YAAEO,QAAQF;QAAmB;IAC3C;IAEA,uEAAuE;IACvE,qEAAqE;IACrE,uEAAuE;IACvE,MAAM1D,cAAcqB,MAAM;QACxBwC,WAAW;QACXC,aAAa;IACf;IAEApB,mBAAmBrB;IACnB0B,mBAAmB1B;IAEnBkB,gBAAgBlB;IAEhB,MAAM0C,SAASlE,WAAWwB;IAC1BtB,aAAasB,MAAM;QACjB,GAAG0C,MAAM;QACT,kEAAkE;QAClEC,WAAW,AAACD,OAAmCC,SAAS,IAAI;QAC5DC,gBAAgB;YACd,GAAGF,OAAOE,cAAc;YACxBC,SAASpD,mBAAmBiD,OAAOE,cAAc,EAAEC,SAAS,CAACC,OAAU,CAAA;oBACrE,GAAGA,IAAI;oBACPC,gBAAgB;2BACX,AAACD,CAAAA,KAAKC,cAAc,IAAI,EAAE,AAAD,EAAGC,MAAM,CACnC,CAACC,IACC,CAAC;gCAAChE;gCAAwBY;6BAA6B,CAACqD,QAAQ,CAC9DD;wBAGNpD;wBACAZ;qBACD;gBACH,CAAA;QACF;IACF;IAEA,MAAMkE,sBAAsB;QAC1BC,KAAK;QACLC,OAAO;QACPC,MAAM;QACNC,MAAM;QACN,oEAAoE;QACpE,2EAA2E;QAC3E,cAAc;QACdC,OAAO;QACP,mBAAmB;QACnB,aAAa;QACb,gBAAgB;IAClB;IACA/E,WAAWuB,MAAM,gBAAgB,CAACyD,cAAiB,CAAA;YACjD,GAAGA,WAAW;YACd,wEAAwE;YACxE,yEAAyE;YACzE,wEAAwE;YACxE,oEAAoE;YACpE,0EAA0E;YAC1E,8DAA8D;YAC9DC,SAAStB,mBACL;gBAAE,GAAGqB,YAAYC,OAAO;gBAAE,GAAGP,mBAAmB;YAAC,IACjD;gBAAE,GAAGA,mBAAmB;gBAAE,GAAGM,YAAYC,OAAO;YAAC;QACvD,CAAA;IAEA,0EAA0E;IAC1E,yEAAyE;IACzE,2EAA2E;IAC3E,sEAAsE;IACtE,oEAAoE;IACpE,+BAA+B;IAC/B,MAAMC,YAAY9E,sBAAsB,UAAU4E,WAAW,CAACG,OAAO;IACrEzF,6BACE6B,MACA,CAAC,GACD;QACE6D,IAAIF;QACJ,UAAUA;QACV,iBAAiBA;QACjB,GAAGhE,aAAa;YAAC;YAAc;SAAiB,CAAC;IACnD;IAGF,8CAA8C;IAC9C,IAAI,CAACK,KAAKE,MAAM,CAAC,eAAe;QAC9BF,KAAKc,KAAK,CAAC,cAAcQ,KAAKC,SAAS,CAACjC,sBAAsB,MAAM;IACtE;IAEAjB,cACE2B,MACA1B,kBAAkB,YAAYwF,OAAO,EAAE,MAAM,UAAU,UACvD,KACA;QACEC,aAAavE,YAAYQ;QACzBgE,YAAYtD,OAAOuD,OAAO,CAACnF,eAAekF,UAAU,EACjDhB,MAAM,CAAC,CAAC,CAACkB,GAAGC,EAAE,GAAK,CAACA,CAAC,CAAC,SAAS,EAC/BvD,GAAG,CAAC,CAAC,CAACwD,GAAGD,EAAE,GAAM,CAAA;gBAAEE,MAAMD;gBAAGE,aAAaH,EAAEG,WAAW;YAAC,CAAA;QAC1D,GAAG,AAAC,CAAA;YACF,MAAMC,OAAO7E;YACb,OAAO;gBACL8E,WAAWD,KAAKE,IAAI;gBACpBC,UAAU,GAAGH,KAAKI,GAAG,CAAC,MAAM,CAAC;gBAC7BC,SAAS,GAAGL,KAAKI,GAAG,CAAC,KAAK,CAAC;YAC7B;QACF,CAAA,GAAI;IACN,GACA;QACEE,mBAAmB3C;IACrB;IAGF,IAAID,QAAQ,OAAO;QACjB1C,oBAAoBS;IACtB;AACF,EAAE"}

package/src/utils/versions.d.ts

@@ -8,6 +8,7 @@
 export declare const TS_VERSIONS: {
     readonly '@a2a-js/sdk': "0.3.14";
     readonly '@aws/aws-distro-opentelemetry-node-autoinstrumentation': "0.12.0";
+    readonly '@opentelemetry/propagator-jaeger': "2.9.0";
     readonly '@aws-sdk/client-dynamodb': "3.1090.0";
     readonly '@aws-sdk/client-bedrock-runtime': "3.1090.0";
     readonly '@aws-sdk/client-s3': "3.1090.0";
@@ -34,6 +35,7 @@ export declare const TS_VERSIONS: {
     readonly '@swc/core': "1.15.43";
     readonly '@modelcontextprotocol/sdk': "1.29.0";
     readonly '@modelcontextprotocol/inspector': "0.22.0";
+    readonly '@ag-ui/a2ui-toolkit': "0.0.4";
     readonly '@ag-ui/aws-strands': "0.2.3";
     readonly '@ag-ui/client': "0.0.57";
     readonly '@ag-ui/core': "0.0.57";
@@ -131,7 +133,7 @@ export type ITsDepVersion = keyof typeof TS_VERSIONS;
  * Add versions to the given dependencies
  */
 export declare const withVersions: (deps: ITsDepVersion[]) => {
-    [k: string]: "0.3.14" | "0.12.0" | "3.1090.0" | "3.972.58" | "1.0.0-alpha.10" | "2.34.0" | "7.7.0" | "22.2.2" | "10.3.0" | "23.1.0" | "1.12.1" | "1.15.43" | "1.29.0" | "0.22.0" | "0.2.3" | "0.0.57" | "0.3.0" | "1.63.1" | "7.8.2" | "1.10.0" | "1.170.18" | "1.168.22" | "1.167.21" | "1.162.0" | "1.162.2" | "3.0.205" | "1.0.151" | "3.0.1330" | "1.0.62" | "5.101.2" | "11.18.0" | "26.1.1" | "8.10.162" | "2.8.19" | "8.20.0" | "8.18.1" | "5.0.6" | "4.6.10" | "4.5.10" | "4.9.7" | "4.16.1" | "4.1.10" | "6.0.1" | "0.41.3" | "7.1.1" | "1.0.20" | "2.1132.0" | "2.261.0" | "3.12.0" | "10.7.0" | "2.8.6" | "5.6.2" | "0.7.1" | "2.1.1" | "15.0.0" | "3.9.1" | "0.28.1" | "1.0.31" | "1.0.5" | "2.5.4" | "7.8.0" | "3.1.5" | "5.2.1" | "3.3.3" | "9.1.7" | "11.3.6" | "11.0.4" | "4.0.0" | "3.5.3" | "2.0.0" | "12.0.1" | "22.2.9" | "3.5.0" | "8.22.0" | "3.3.1" | "19.2.7" | "6.1.3" | "1.2.0" | "3.36.0" | "0.5.21" | "0.28.0" | "4.3.3" | "4.23.1" | "1.25.0" | "1.6.2" | "4.13.1" | "1.4.0" | "3.6.0" | "8.1.5" | "6.0.3" | "4.4.3" | "8.21.1";
+    [k: string]: "0.3.14" | "0.12.0" | "2.9.0" | "3.1090.0" | "3.972.58" | "1.0.0-alpha.10" | "2.34.0" | "7.7.0" | "22.2.2" | "10.3.0" | "23.1.0" | "1.12.1" | "1.15.43" | "1.29.0" | "0.22.0" | "0.0.4" | "0.2.3" | "0.0.57" | "0.3.0" | "1.63.1" | "7.8.2" | "1.10.0" | "1.170.18" | "1.168.22" | "1.167.21" | "1.162.0" | "1.162.2" | "3.0.205" | "1.0.151" | "3.0.1330" | "1.0.62" | "5.101.2" | "11.18.0" | "26.1.1" | "8.10.162" | "2.8.19" | "8.20.0" | "8.18.1" | "5.0.6" | "4.6.10" | "4.5.10" | "4.9.7" | "4.16.1" | "4.1.10" | "6.0.1" | "0.41.3" | "7.1.1" | "1.0.20" | "2.1132.0" | "2.261.0" | "3.12.0" | "10.7.0" | "2.8.6" | "5.6.2" | "0.7.1" | "2.1.1" | "15.0.0" | "3.9.1" | "0.28.1" | "1.0.31" | "1.0.5" | "2.5.4" | "7.8.0" | "3.1.5" | "5.2.1" | "3.3.3" | "9.1.7" | "11.3.6" | "11.0.4" | "4.0.0" | "3.5.3" | "2.0.0" | "12.0.1" | "22.2.9" | "3.5.0" | "8.22.0" | "3.3.1" | "19.2.7" | "6.1.3" | "1.2.0" | "3.36.0" | "0.5.21" | "0.28.0" | "4.3.3" | "4.23.1" | "1.25.0" | "1.6.2" | "4.13.1" | "1.4.0" | "3.6.0" | "8.1.5" | "6.0.3" | "4.4.3" | "8.21.1";
 };
 /**
  * Versions for Python dependencies added by generators
@@ -169,6 +171,7 @@ export declare const PY_VERSIONS: {
     readonly alembic: "==1.18.5";
     readonly aiomysql: "==0.3.2";
     readonly asyncpg: "==0.31.0";
+    readonly greenlet: "==3.5.4";
 };
 export type IPyDepVersion = keyof typeof PY_VERSIONS;
 /**

package/src/utils/versions.js

@@ -6,6 +6,9 @@
  */ export const TS_VERSIONS = {
     '@a2a-js/sdk': '0.3.14',
     '@aws/aws-distro-opentelemetry-node-autoinstrumentation': '0.12.0',
+    // Pinned above the version the ADOT autoinstrumentation package resolves
+    // transitively (2.8.0) to clear CVE-2026-59892 (HIGH).
+    '@opentelemetry/propagator-jaeger': '2.9.0',
     '@aws-sdk/client-dynamodb': '3.1090.0',
     '@aws-sdk/client-bedrock-runtime': '3.1090.0',
     '@aws-sdk/client-s3': '3.1090.0',
@@ -32,6 +35,7 @@
     '@swc/core': '1.15.43',
     '@modelcontextprotocol/sdk': '1.29.0',
     '@modelcontextprotocol/inspector': '0.22.0',
+    '@ag-ui/a2ui-toolkit': '0.0.4',
     '@ag-ui/aws-strands': '0.2.3',
     '@ag-ui/client': '0.0.57',
     '@ag-ui/core': '0.0.57',
@@ -164,7 +168,11 @@
     sqlmodel: '==0.0.39',
     alembic: '==1.18.5',
     aiomysql: '==0.3.2',
-    asyncpg: '==0.31.0'
+    asyncpg: '==0.31.0',
+    // Pinned explicitly: SQLAlchemy's async engine pulls greenlet transitively,
+    // and leaving it unpinned lets uv resolve to a just-released version whose
+    // platform wheels may not all be published yet (breaking aarch64 installs).
+    greenlet: '==3.5.4'
 };
 /**
  * Add versions to the given dependencies

package/src/utils/versions.js.map

@@ -1 +1 @@
-{"version":3,"sources":["../../../../../packages/nx-plugin/src/utils/versions.ts"],"sourcesContent":["/**\n * Copyright Amazon.com, Inc. or its affiliates. All Rights Reserved.\n * SPDX-License-Identifier: Apache-2.0\n */\n\n/**\n * Versons for TypeScript dependencies added by generators\n */\nexport const TS_VERSIONS = {\n  '@a2a-js/sdk': '0.3.14',\n  '@aws/aws-distro-opentelemetry-node-autoinstrumentation': '0.12.0',\n  '@aws-sdk/client-dynamodb': '3.1090.0',\n  '@aws-sdk/client-bedrock-runtime': '3.1090.0',\n  '@aws-sdk/client-s3': '3.1090.0',\n  '@aws-sdk/client-sts': '3.1090.0',\n  '@aws-sdk/credential-providers': '3.1090.0',\n  '@aws-sdk/credential-provider-cognito-identity': '3.972.58',\n  '@aws-sdk/client-secrets-manager': '3.1090.0',\n  '@aws-sdk/rds-signer': '3.1090.0',\n  '@aws-smithy/server-apigateway': '1.0.0-alpha.10',\n  '@aws-smithy/server-node': '1.0.0-alpha.10',\n  '@aws-lambda-powertools/logger': '2.34.0',\n  '@aws-lambda-powertools/metrics': '2.34.0',\n  '@aws-lambda-powertools/parameters': '2.34.0',\n  '@aws-lambda-powertools/tracer': '2.34.0',\n  '@aws-lambda-powertools/parser': '2.34.0',\n  '@aws-sdk/client-appconfigdata': '3.1090.0',\n  '@middy/core': '7.7.0',\n  '@nxlv/python': '22.2.2',\n  '@nx-extend/terraform': '10.3.0',\n  '@nx/devkit': '23.1.0',\n  '@nx/react': '23.1.0',\n  'create-nx-workspace': '23.1.0',\n  '@swc-node/register': '1.12.1',\n  '@swc/core': '1.15.43',\n  '@modelcontextprotocol/sdk': '1.29.0',\n  '@modelcontextprotocol/inspector': '0.22.0',\n  '@ag-ui/aws-strands': '0.2.3',\n  '@ag-ui/client': '0.0.57',\n  '@ag-ui/core': '0.0.57',\n  '@ag-ui/encoder': '0.0.57',\n  'agent-chat-cli': '0.3.0',\n  '@copilotkit/react-core': '1.63.1',\n  rxjs: '7.8.2',\n  '@strands-agents/sdk': '1.10.0',\n  '@tanstack/react-router': '1.170.18',\n  '@tanstack/router-plugin': '1.168.22',\n  '@tanstack/router-generator': '1.167.21',\n  '@tanstack/virtual-file-routes': '1.162.0',\n  '@tanstack/router-utils': '1.162.2',\n  '@cloudscape-design/board-components': '3.0.205',\n  '@cloudscape-design/chat-components': '1.0.151',\n  '@cloudscape-design/components': '3.0.1330',\n  '@cloudscape-design/global-styles': '1.0.62',\n  '@tanstack/react-query': '5.101.2',\n  '@tanstack/react-query-devtools': '5.101.2',\n  '@trpc/tanstack-react-query': '11.18.0',\n  '@trpc/client': '11.18.0',\n  '@trpc/server': '11.18.0',\n  '@types/node': '26.1.1',\n  '@types/aws-lambda': '8.10.162',\n  '@types/cors': '2.8.19',\n  '@types/pg': '8.20.0',\n  '@types/ws': '8.18.1',\n  '@types/express': '5.0.6',\n  '@smithy/config-resolver': '4.6.10',\n  '@smithy/node-config-provider': '4.5.10',\n  '@smithy/node-http-handler': '4.9.7',\n  '@smithy/types': '4.16.1',\n  '@vitest/coverage-v8': '4.1.10',\n  '@vitest/ui': '4.1.10',\n  '@astrojs/react': '6.0.1',\n  '@astrojs/starlight': '0.41.3',\n  astro: '7.1.1',\n  aws4fetch: '1.0.20',\n  'aws-cdk': '2.1132.0',\n  'aws-cdk-lib': '2.261.0',\n  'aws-xray-sdk-core': '3.12.0',\n  constructs: '10.7.0',\n  cors: '2.8.6',\n  chalk: '5.6.2',\n  'class-variance-authority': '0.7.1',\n  clsx: '2.1.1',\n  commander: '15.0.0',\n  electrodb: '3.9.1',\n  esbuild: '0.28.1',\n  'event-source-polyfill': '1.0.31',\n  '@types/event-source-polyfill': '1.0.5',\n  '@biomejs/biome': '2.5.4',\n  '@prisma/adapter-mariadb': '7.8.0',\n  '@prisma/adapter-pg': '7.8.0',\n  '@prisma/client': '7.8.0',\n  ejs: '6.0.1',\n  '@types/ejs': '3.1.5',\n  express: '5.2.1',\n  'fast-glob': '3.3.3',\n  husky: '9.1.7',\n  'fs-extra': '11.3.6',\n  '@types/fs-extra': '11.0.4',\n  'make-dir-cli': '4.0.0',\n  mariadb: '3.5.3',\n  ncp: '2.0.0',\n  npm: '12.0.1',\n  'npm-check-updates': '22.2.9',\n  'oidc-client-ts': '3.5.0',\n  pg: '8.22.0',\n  prisma: '7.8.0',\n  'react-oidc-context': '3.3.1',\n  react: '19.2.7',\n  'react-dom': '19.2.7',\n  rimraf: '6.1.3',\n  rolldown: '1.2.0',\n  'simple-git': '3.36.0',\n  'source-map-support': '0.5.21',\n  'starlight-blog': '0.28.0',\n  tailwindcss: '4.3.3',\n  '@tailwindcss/vite': '4.3.3',\n  tsx: '4.23.1',\n  'lucide-react': '1.25.0',\n  'radix-ui': '1.6.2',\n  shadcn: '4.13.1',\n  'tw-animate-css': '1.4.0',\n  'tailwind-merge': '3.6.0',\n  vite: '8.1.5',\n  typescript: '6.0.3',\n  vitest: '4.1.10',\n  zod: '4.4.3',\n  ws: '8.21.1',\n} as const;\nexport type ITsDepVersion = keyof typeof TS_VERSIONS;\n\n/**\n * Add versions to the given dependencies\n */\nexport const withVersions = (deps: ITsDepVersion[]) =>\n  Object.fromEntries(deps.map((dep) => [dep, TS_VERSIONS[dep]]));\n\n/**\n * Versions for Python dependencies added by generators\n */\nexport const PY_VERSIONS = {\n  'a2a-sdk': '==0.3.26',\n  'ag-ui-langgraph': '==0.0.42',\n  'ag-ui-protocol': '==0.1.19',\n  'ag-ui-strands': '==0.2.2',\n  'aws-lambda-powertools': '==3.31.1',\n  'aws-lambda-powertools[tracer]': '==3.31.1',\n  'aws-lambda-powertools[parser]': '==3.31.1',\n  'aws-opentelemetry-distro': '==0.18.0',\n  'bedrock-agentcore': '==1.18.1',\n  boto3: '==1.43.51',\n  checkov: '==3.3.8',\n  fastapi: '==0.139.2',\n  'fastapi[standard]': '==0.139.2',\n  httpx: '==0.28.1',\n  langchain: '==1.3.14',\n  'langchain-aws': '==1.6.2',\n  'langchain-mcp-adapters': '==0.3.0',\n  langgraph: '==1.2.9',\n  mcp: '==1.28.1',\n  'pip-check-updates': '==0.29.0',\n  'pip-licenses': '==5.5.5',\n  ruff: '==0.15.22',\n  'strands-agents': '==1.48.0',\n  'strands-agents[a2a]': '==1.48.0',\n  'strands-agents-tools': '==0.8.4',\n  ty: '==0.0.61',\n  pynamodb: '==6.1.0',\n  uvicorn: '==0.51.0',\n  sqlmodel: '==0.0.39',\n  alembic: '==1.18.5',\n  aiomysql: '==0.3.2',\n  asyncpg: '==0.31.0',\n} as const;\nexport type IPyDepVersion = keyof typeof PY_VERSIONS;\n\n/**\n * Add versions to the given dependencies\n */\nexport const withPyVersions = (deps: IPyDepVersion[]) =>\n  deps.map((dep) => `${dep}${PY_VERSIONS[dep]}`);\n\n/**\n * Versions for vendored tools\n */\nexport const VENDORED_VERSIONS = {\n  'git-secrets': '1.3.0',\n} as const;\n\n/**\n * Base container images used by generated Dockerfiles. Pinned exactly so\n * generated images are reproducible, and chosen to be free of known\n * HIGH/CRITICAL vulnerabilities at time of generation.\n */\nexport const BASE_IMAGES = {\n  node: 'public.ecr.aws/docker/library/node:lts-slim',\n  python: 'public.ecr.aws/docker/library/python:3.14-slim',\n} as const;\n\n/**\n * Versions for container tooling used by generated image build/scan targets.\n * Pinned exactly so generated images are reproducible.\n */\nexport const CONTAINER_VERSIONS = {\n  // ECR-hosted Trivy image used to scan built images during the build.\n  trivy: '0.72.0',\n} as const;\n\n/**\n * Exact versions for Terraform providers used by generated `.tf` modules.\n * Pinned exactly (no range operator) so generated infrastructure is reproducible.\n */\nexport const TERRAFORM_VERSIONS = {\n  aws: '6.55.0',\n  random: '3.9.0',\n  null: '3.3.0',\n  archive: '2.8.0',\n  external: '2.4.0',\n  local: '2.9.0',\n} as const;\nexport type ITerraformProviderVersion = keyof typeof TERRAFORM_VERSIONS;\n\n/**\n * Substitution variables exposing Terraform provider version constraints to\n * generated `.tf` templates (e.g. `version = \"<%- awsProviderVersion %>\"`)\n */\nexport const terraformProviderVersions = () => ({\n  awsProviderVersion: TERRAFORM_VERSIONS.aws,\n  randomProviderVersion: TERRAFORM_VERSIONS.random,\n  nullProviderVersion: TERRAFORM_VERSIONS.null,\n  archiveProviderVersion: TERRAFORM_VERSIONS.archive,\n  externalProviderVersion: TERRAFORM_VERSIONS.external,\n  localProviderVersion: TERRAFORM_VERSIONS.local,\n});\n"],"names":["TS_VERSIONS","rxjs","astro","aws4fetch","constructs","cors","chalk","clsx","commander","electrodb","esbuild","ejs","express","husky","mariadb","ncp","npm","pg","prisma","react","rimraf","rolldown","tailwindcss","tsx","shadcn","vite","typescript","vitest","zod","ws","withVersions","deps","Object","fromEntries","map","dep","PY_VERSIONS","boto3","checkov","fastapi","httpx","langchain","langgraph","mcp","ruff","ty","pynamodb","uvicorn","sqlmodel","alembic","aiomysql","asyncpg","withPyVersions","VENDORED_VERSIONS","BASE_IMAGES","node","python","CONTAINER_VERSIONS","trivy","TERRAFORM_VERSIONS","aws","random","null","archive","external","local","terraformProviderVersions","awsProviderVersion","randomProviderVersion","nullProviderVersion","archiveProviderVersion","externalProviderVersion","localProviderVersion"],"mappings":"AAAA;;;CAGC,GAED;;CAEC,GACD,OAAO,MAAMA,cAAc;IACzB,eAAe;IACf,0DAA0D;IAC1D,4BAA4B;IAC5B,mCAAmC;IACnC,sBAAsB;IACtB,uBAAuB;IACvB,iCAAiC;IACjC,iDAAiD;IACjD,mCAAmC;IACnC,uBAAuB;IACvB,iCAAiC;IACjC,2BAA2B;IAC3B,iCAAiC;IACjC,kCAAkC;IAClC,qCAAqC;IACrC,iCAAiC;IACjC,iCAAiC;IACjC,iCAAiC;IACjC,eAAe;IACf,gBAAgB;IAChB,wBAAwB;IACxB,cAAc;IACd,aAAa;IACb,uBAAuB;IACvB,sBAAsB;IACtB,aAAa;IACb,6BAA6B;IAC7B,mCAAmC;IACnC,sBAAsB;IACtB,iBAAiB;IACjB,eAAe;IACf,kBAAkB;IAClB,kBAAkB;IAClB,0BAA0B;IAC1BC,MAAM;IACN,uBAAuB;IACvB,0BAA0B;IAC1B,2BAA2B;IAC3B,8BAA8B;IAC9B,iCAAiC;IACjC,0BAA0B;IAC1B,uCAAuC;IACvC,sCAAsC;IACtC,iCAAiC;IACjC,oCAAoC;IACpC,yBAAyB;IACzB,kCAAkC;IAClC,8BAA8B;IAC9B,gBAAgB;IAChB,gBAAgB;IAChB,eAAe;IACf,qBAAqB;IACrB,eAAe;IACf,aAAa;IACb,aAAa;IACb,kBAAkB;IAClB,2BAA2B;IAC3B,gCAAgC;IAChC,6BAA6B;IAC7B,iBAAiB;IACjB,uBAAuB;IACvB,cAAc;IACd,kBAAkB;IAClB,sBAAsB;IACtBC,OAAO;IACPC,WAAW;IACX,WAAW;IACX,eAAe;IACf,qBAAqB;IACrBC,YAAY;IACZC,MAAM;IACNC,OAAO;IACP,4BAA4B;IAC5BC,MAAM;IACNC,WAAW;IACXC,WAAW;IACXC,SAAS;IACT,yBAAyB;IACzB,gCAAgC;IAChC,kBAAkB;IAClB,2BAA2B;IAC3B,sBAAsB;IACtB,kBAAkB;IAClBC,KAAK;IACL,cAAc;IACdC,SAAS;IACT,aAAa;IACbC,OAAO;IACP,YAAY;IACZ,mBAAmB;IACnB,gBAAgB;IAChBC,SAAS;IACTC,KAAK;IACLC,KAAK;IACL,qBAAqB;IACrB,kBAAkB;IAClBC,IAAI;IACJC,QAAQ;IACR,sBAAsB;IACtBC,OAAO;IACP,aAAa;IACbC,QAAQ;IACRC,UAAU;IACV,cAAc;IACd,sBAAsB;IACtB,kBAAkB;IAClBC,aAAa;IACb,qBAAqB;IACrBC,KAAK;IACL,gBAAgB;IAChB,YAAY;IACZC,QAAQ;IACR,kBAAkB;IAClB,kBAAkB;IAClBC,MAAM;IACNC,YAAY;IACZC,QAAQ;IACRC,KAAK;IACLC,IAAI;AACN,EAAW;AAGX;;CAEC,GACD,OAAO,MAAMC,eAAe,CAACC,OAC3BC,OAAOC,WAAW,CAACF,KAAKG,GAAG,CAAC,CAACC,MAAQ;YAACA;YAAKnC,WAAW,CAACmC,IAAI;SAAC,GAAG;AAEjE;;CAEC,GACD,OAAO,MAAMC,cAAc;IACzB,WAAW;IACX,mBAAmB;IACnB,kBAAkB;IAClB,iBAAiB;IACjB,yBAAyB;IACzB,iCAAiC;IACjC,iCAAiC;IACjC,4BAA4B;IAC5B,qBAAqB;IACrBC,OAAO;IACPC,SAAS;IACTC,SAAS;IACT,qBAAqB;IACrBC,OAAO;IACPC,WAAW;IACX,iBAAiB;IACjB,0BAA0B;IAC1BC,WAAW;IACXC,KAAK;IACL,qBAAqB;IACrB,gBAAgB;IAChBC,MAAM;IACN,kBAAkB;IAClB,uBAAuB;IACvB,wBAAwB;IACxBC,IAAI;IACJC,UAAU;IACVC,SAAS;IACTC,UAAU;IACVC,SAAS;IACTC,UAAU;IACVC,SAAS;AACX,EAAW;AAGX;;CAEC,GACD,OAAO,MAAMC,iBAAiB,CAACrB,OAC7BA,KAAKG,GAAG,CAAC,CAACC,MAAQ,GAAGA,MAAMC,WAAW,CAACD,IAAI,EAAE,EAAE;AAEjD;;CAEC,GACD,OAAO,MAAMkB,oBAAoB;IAC/B,eAAe;AACjB,EAAW;AAEX;;;;CAIC,GACD,OAAO,MAAMC,cAAc;IACzBC,MAAM;IACNC,QAAQ;AACV,EAAW;AAEX;;;CAGC,GACD,OAAO,MAAMC,qBAAqB;IAChC,qEAAqE;IACrEC,OAAO;AACT,EAAW;AAEX;;;CAGC,GACD,OAAO,MAAMC,qBAAqB;IAChCC,KAAK;IACLC,QAAQ;IACRC,MAAM;IACNC,SAAS;IACTC,UAAU;IACVC,OAAO;AACT,EAAW;AAGX;;;CAGC,GACD,OAAO,MAAMC,4BAA4B,IAAO,CAAA;QAC9CC,oBAAoBR,mBAAmBC,GAAG;QAC1CQ,uBAAuBT,mBAAmBE,MAAM;QAChDQ,qBAAqBV,mBAAmBG,IAAI;QAC5CQ,wBAAwBX,mBAAmBI,OAAO;QAClDQ,yBAAyBZ,mBAAmBK,QAAQ;QACpDQ,sBAAsBb,mBAAmBM,KAAK;IAChD,CAAA,EAAG"}
+{"version":3,"sources":["../../../../../packages/nx-plugin/src/utils/versions.ts"],"sourcesContent":["/**\n * Copyright Amazon.com, Inc. or its affiliates. All Rights Reserved.\n * SPDX-License-Identifier: Apache-2.0\n */\n\n/**\n * Versons for TypeScript dependencies added by generators\n */\nexport const TS_VERSIONS = {\n  '@a2a-js/sdk': '0.3.14',\n  '@aws/aws-distro-opentelemetry-node-autoinstrumentation': '0.12.0',\n  // Pinned above the version the ADOT autoinstrumentation package resolves\n  // transitively (2.8.0) to clear CVE-2026-59892 (HIGH).\n  '@opentelemetry/propagator-jaeger': '2.9.0',\n  '@aws-sdk/client-dynamodb': '3.1090.0',\n  '@aws-sdk/client-bedrock-runtime': '3.1090.0',\n  '@aws-sdk/client-s3': '3.1090.0',\n  '@aws-sdk/client-sts': '3.1090.0',\n  '@aws-sdk/credential-providers': '3.1090.0',\n  '@aws-sdk/credential-provider-cognito-identity': '3.972.58',\n  '@aws-sdk/client-secrets-manager': '3.1090.0',\n  '@aws-sdk/rds-signer': '3.1090.0',\n  '@aws-smithy/server-apigateway': '1.0.0-alpha.10',\n  '@aws-smithy/server-node': '1.0.0-alpha.10',\n  '@aws-lambda-powertools/logger': '2.34.0',\n  '@aws-lambda-powertools/metrics': '2.34.0',\n  '@aws-lambda-powertools/parameters': '2.34.0',\n  '@aws-lambda-powertools/tracer': '2.34.0',\n  '@aws-lambda-powertools/parser': '2.34.0',\n  '@aws-sdk/client-appconfigdata': '3.1090.0',\n  '@middy/core': '7.7.0',\n  '@nxlv/python': '22.2.2',\n  '@nx-extend/terraform': '10.3.0',\n  '@nx/devkit': '23.1.0',\n  '@nx/react': '23.1.0',\n  'create-nx-workspace': '23.1.0',\n  '@swc-node/register': '1.12.1',\n  '@swc/core': '1.15.43',\n  '@modelcontextprotocol/sdk': '1.29.0',\n  '@modelcontextprotocol/inspector': '0.22.0',\n  '@ag-ui/a2ui-toolkit': '0.0.4',\n  '@ag-ui/aws-strands': '0.2.3',\n  '@ag-ui/client': '0.0.57',\n  '@ag-ui/core': '0.0.57',\n  '@ag-ui/encoder': '0.0.57',\n  'agent-chat-cli': '0.3.0',\n  '@copilotkit/react-core': '1.63.1',\n  rxjs: '7.8.2',\n  '@strands-agents/sdk': '1.10.0',\n  '@tanstack/react-router': '1.170.18',\n  '@tanstack/router-plugin': '1.168.22',\n  '@tanstack/router-generator': '1.167.21',\n  '@tanstack/virtual-file-routes': '1.162.0',\n  '@tanstack/router-utils': '1.162.2',\n  '@cloudscape-design/board-components': '3.0.205',\n  '@cloudscape-design/chat-components': '1.0.151',\n  '@cloudscape-design/components': '3.0.1330',\n  '@cloudscape-design/global-styles': '1.0.62',\n  '@tanstack/react-query': '5.101.2',\n  '@tanstack/react-query-devtools': '5.101.2',\n  '@trpc/tanstack-react-query': '11.18.0',\n  '@trpc/client': '11.18.0',\n  '@trpc/server': '11.18.0',\n  '@types/node': '26.1.1',\n  '@types/aws-lambda': '8.10.162',\n  '@types/cors': '2.8.19',\n  '@types/pg': '8.20.0',\n  '@types/ws': '8.18.1',\n  '@types/express': '5.0.6',\n  '@smithy/config-resolver': '4.6.10',\n  '@smithy/node-config-provider': '4.5.10',\n  '@smithy/node-http-handler': '4.9.7',\n  '@smithy/types': '4.16.1',\n  '@vitest/coverage-v8': '4.1.10',\n  '@vitest/ui': '4.1.10',\n  '@astrojs/react': '6.0.1',\n  '@astrojs/starlight': '0.41.3',\n  astro: '7.1.1',\n  aws4fetch: '1.0.20',\n  'aws-cdk': '2.1132.0',\n  'aws-cdk-lib': '2.261.0',\n  'aws-xray-sdk-core': '3.12.0',\n  constructs: '10.7.0',\n  cors: '2.8.6',\n  chalk: '5.6.2',\n  'class-variance-authority': '0.7.1',\n  clsx: '2.1.1',\n  commander: '15.0.0',\n  electrodb: '3.9.1',\n  esbuild: '0.28.1',\n  'event-source-polyfill': '1.0.31',\n  '@types/event-source-polyfill': '1.0.5',\n  '@biomejs/biome': '2.5.4',\n  '@prisma/adapter-mariadb': '7.8.0',\n  '@prisma/adapter-pg': '7.8.0',\n  '@prisma/client': '7.8.0',\n  ejs: '6.0.1',\n  '@types/ejs': '3.1.5',\n  express: '5.2.1',\n  'fast-glob': '3.3.3',\n  husky: '9.1.7',\n  'fs-extra': '11.3.6',\n  '@types/fs-extra': '11.0.4',\n  'make-dir-cli': '4.0.0',\n  mariadb: '3.5.3',\n  ncp: '2.0.0',\n  npm: '12.0.1',\n  'npm-check-updates': '22.2.9',\n  'oidc-client-ts': '3.5.0',\n  pg: '8.22.0',\n  prisma: '7.8.0',\n  'react-oidc-context': '3.3.1',\n  react: '19.2.7',\n  'react-dom': '19.2.7',\n  rimraf: '6.1.3',\n  rolldown: '1.2.0',\n  'simple-git': '3.36.0',\n  'source-map-support': '0.5.21',\n  'starlight-blog': '0.28.0',\n  tailwindcss: '4.3.3',\n  '@tailwindcss/vite': '4.3.3',\n  tsx: '4.23.1',\n  'lucide-react': '1.25.0',\n  'radix-ui': '1.6.2',\n  shadcn: '4.13.1',\n  'tw-animate-css': '1.4.0',\n  'tailwind-merge': '3.6.0',\n  vite: '8.1.5',\n  typescript: '6.0.3',\n  vitest: '4.1.10',\n  zod: '4.4.3',\n  ws: '8.21.1',\n} as const;\nexport type ITsDepVersion = keyof typeof TS_VERSIONS;\n\n/**\n * Add versions to the given dependencies\n */\nexport const withVersions = (deps: ITsDepVersion[]) =>\n  Object.fromEntries(deps.map((dep) => [dep, TS_VERSIONS[dep]]));\n\n/**\n * Versions for Python dependencies added by generators\n */\nexport const PY_VERSIONS = {\n  'a2a-sdk': '==0.3.26',\n  'ag-ui-langgraph': '==0.0.42',\n  'ag-ui-protocol': '==0.1.19',\n  'ag-ui-strands': '==0.2.2',\n  'aws-lambda-powertools': '==3.31.1',\n  'aws-lambda-powertools[tracer]': '==3.31.1',\n  'aws-lambda-powertools[parser]': '==3.31.1',\n  'aws-opentelemetry-distro': '==0.18.0',\n  'bedrock-agentcore': '==1.18.1',\n  boto3: '==1.43.51',\n  checkov: '==3.3.8',\n  fastapi: '==0.139.2',\n  'fastapi[standard]': '==0.139.2',\n  httpx: '==0.28.1',\n  langchain: '==1.3.14',\n  'langchain-aws': '==1.6.2',\n  'langchain-mcp-adapters': '==0.3.0',\n  langgraph: '==1.2.9',\n  mcp: '==1.28.1',\n  'pip-check-updates': '==0.29.0',\n  'pip-licenses': '==5.5.5',\n  ruff: '==0.15.22',\n  'strands-agents': '==1.48.0',\n  'strands-agents[a2a]': '==1.48.0',\n  'strands-agents-tools': '==0.8.4',\n  ty: '==0.0.61',\n  pynamodb: '==6.1.0',\n  uvicorn: '==0.51.0',\n  sqlmodel: '==0.0.39',\n  alembic: '==1.18.5',\n  aiomysql: '==0.3.2',\n  asyncpg: '==0.31.0',\n  // Pinned explicitly: SQLAlchemy's async engine pulls greenlet transitively,\n  // and leaving it unpinned lets uv resolve to a just-released version whose\n  // platform wheels may not all be published yet (breaking aarch64 installs).\n  greenlet: '==3.5.4',\n} as const;\nexport type IPyDepVersion = keyof typeof PY_VERSIONS;\n\n/**\n * Add versions to the given dependencies\n */\nexport const withPyVersions = (deps: IPyDepVersion[]) =>\n  deps.map((dep) => `${dep}${PY_VERSIONS[dep]}`);\n\n/**\n * Versions for vendored tools\n */\nexport const VENDORED_VERSIONS = {\n  'git-secrets': '1.3.0',\n} as const;\n\n/**\n * Base container images used by generated Dockerfiles. Pinned exactly so\n * generated images are reproducible, and chosen to be free of known\n * HIGH/CRITICAL vulnerabilities at time of generation.\n */\nexport const BASE_IMAGES = {\n  node: 'public.ecr.aws/docker/library/node:lts-slim',\n  python: 'public.ecr.aws/docker/library/python:3.14-slim',\n} as const;\n\n/**\n * Versions for container tooling used by generated image build/scan targets.\n * Pinned exactly so generated images are reproducible.\n */\nexport const CONTAINER_VERSIONS = {\n  // ECR-hosted Trivy image used to scan built images during the build.\n  trivy: '0.72.0',\n} as const;\n\n/**\n * Exact versions for Terraform providers used by generated `.tf` modules.\n * Pinned exactly (no range operator) so generated infrastructure is reproducible.\n */\nexport const TERRAFORM_VERSIONS = {\n  aws: '6.55.0',\n  random: '3.9.0',\n  null: '3.3.0',\n  archive: '2.8.0',\n  external: '2.4.0',\n  local: '2.9.0',\n} as const;\nexport type ITerraformProviderVersion = keyof typeof TERRAFORM_VERSIONS;\n\n/**\n * Substitution variables exposing Terraform provider version constraints to\n * generated `.tf` templates (e.g. `version = \"<%- awsProviderVersion %>\"`)\n */\nexport const terraformProviderVersions = () => ({\n  awsProviderVersion: TERRAFORM_VERSIONS.aws,\n  randomProviderVersion: TERRAFORM_VERSIONS.random,\n  nullProviderVersion: TERRAFORM_VERSIONS.null,\n  archiveProviderVersion: TERRAFORM_VERSIONS.archive,\n  externalProviderVersion: TERRAFORM_VERSIONS.external,\n  localProviderVersion: TERRAFORM_VERSIONS.local,\n});\n"],"names":["TS_VERSIONS","rxjs","astro","aws4fetch","constructs","cors","chalk","clsx","commander","electrodb","esbuild","ejs","express","husky","mariadb","ncp","npm","pg","prisma","react","rimraf","rolldown","tailwindcss","tsx","shadcn","vite","typescript","vitest","zod","ws","withVersions","deps","Object","fromEntries","map","dep","PY_VERSIONS","boto3","checkov","fastapi","httpx","langchain","langgraph","mcp","ruff","ty","pynamodb","uvicorn","sqlmodel","alembic","aiomysql","asyncpg","greenlet","withPyVersions","VENDORED_VERSIONS","BASE_IMAGES","node","python","CONTAINER_VERSIONS","trivy","TERRAFORM_VERSIONS","aws","random","null","archive","external","local","terraformProviderVersions","awsProviderVersion","randomProviderVersion","nullProviderVersion","archiveProviderVersion","externalProviderVersion","localProviderVersion"],"mappings":"AAAA;;;CAGC,GAED;;CAEC,GACD,OAAO,MAAMA,cAAc;IACzB,eAAe;IACf,0DAA0D;IAC1D,yEAAyE;IACzE,uDAAuD;IACvD,oCAAoC;IACpC,4BAA4B;IAC5B,mCAAmC;IACnC,sBAAsB;IACtB,uBAAuB;IACvB,iCAAiC;IACjC,iDAAiD;IACjD,mCAAmC;IACnC,uBAAuB;IACvB,iCAAiC;IACjC,2BAA2B;IAC3B,iCAAiC;IACjC,kCAAkC;IAClC,qCAAqC;IACrC,iCAAiC;IACjC,iCAAiC;IACjC,iCAAiC;IACjC,eAAe;IACf,gBAAgB;IAChB,wBAAwB;IACxB,cAAc;IACd,aAAa;IACb,uBAAuB;IACvB,sBAAsB;IACtB,aAAa;IACb,6BAA6B;IAC7B,mCAAmC;IACnC,uBAAuB;IACvB,sBAAsB;IACtB,iBAAiB;IACjB,eAAe;IACf,kBAAkB;IAClB,kBAAkB;IAClB,0BAA0B;IAC1BC,MAAM;IACN,uBAAuB;IACvB,0BAA0B;IAC1B,2BAA2B;IAC3B,8BAA8B;IAC9B,iCAAiC;IACjC,0BAA0B;IAC1B,uCAAuC;IACvC,sCAAsC;IACtC,iCAAiC;IACjC,oCAAoC;IACpC,yBAAyB;IACzB,kCAAkC;IAClC,8BAA8B;IAC9B,gBAAgB;IAChB,gBAAgB;IAChB,eAAe;IACf,qBAAqB;IACrB,eAAe;IACf,aAAa;IACb,aAAa;IACb,kBAAkB;IAClB,2BAA2B;IAC3B,gCAAgC;IAChC,6BAA6B;IAC7B,iBAAiB;IACjB,uBAAuB;IACvB,cAAc;IACd,kBAAkB;IAClB,sBAAsB;IACtBC,OAAO;IACPC,WAAW;IACX,WAAW;IACX,eAAe;IACf,qBAAqB;IACrBC,YAAY;IACZC,MAAM;IACNC,OAAO;IACP,4BAA4B;IAC5BC,MAAM;IACNC,WAAW;IACXC,WAAW;IACXC,SAAS;IACT,yBAAyB;IACzB,gCAAgC;IAChC,kBAAkB;IAClB,2BAA2B;IAC3B,sBAAsB;IACtB,kBAAkB;IAClBC,KAAK;IACL,cAAc;IACdC,SAAS;IACT,aAAa;IACbC,OAAO;IACP,YAAY;IACZ,mBAAmB;IACnB,gBAAgB;IAChBC,SAAS;IACTC,KAAK;IACLC,KAAK;IACL,qBAAqB;IACrB,kBAAkB;IAClBC,IAAI;IACJC,QAAQ;IACR,sBAAsB;IACtBC,OAAO;IACP,aAAa;IACbC,QAAQ;IACRC,UAAU;IACV,cAAc;IACd,sBAAsB;IACtB,kBAAkB;IAClBC,aAAa;IACb,qBAAqB;IACrBC,KAAK;IACL,gBAAgB;IAChB,YAAY;IACZC,QAAQ;IACR,kBAAkB;IAClB,kBAAkB;IAClBC,MAAM;IACNC,YAAY;IACZC,QAAQ;IACRC,KAAK;IACLC,IAAI;AACN,EAAW;AAGX;;CAEC,GACD,OAAO,MAAMC,eAAe,CAACC,OAC3BC,OAAOC,WAAW,CAACF,KAAKG,GAAG,CAAC,CAACC,MAAQ;YAACA;YAAKnC,WAAW,CAACmC,IAAI;SAAC,GAAG;AAEjE;;CAEC,GACD,OAAO,MAAMC,cAAc;IACzB,WAAW;IACX,mBAAmB;IACnB,kBAAkB;IAClB,iBAAiB;IACjB,yBAAyB;IACzB,iCAAiC;IACjC,iCAAiC;IACjC,4BAA4B;IAC5B,qBAAqB;IACrBC,OAAO;IACPC,SAAS;IACTC,SAAS;IACT,qBAAqB;IACrBC,OAAO;IACPC,WAAW;IACX,iBAAiB;IACjB,0BAA0B;IAC1BC,WAAW;IACXC,KAAK;IACL,qBAAqB;IACrB,gBAAgB;IAChBC,MAAM;IACN,kBAAkB;IAClB,uBAAuB;IACvB,wBAAwB;IACxBC,IAAI;IACJC,UAAU;IACVC,SAAS;IACTC,UAAU;IACVC,SAAS;IACTC,UAAU;IACVC,SAAS;IACT,4EAA4E;IAC5E,2EAA2E;IAC3E,4EAA4E;IAC5EC,UAAU;AACZ,EAAW;AAGX;;CAEC,GACD,OAAO,MAAMC,iBAAiB,CAACtB,OAC7BA,KAAKG,GAAG,CAAC,CAACC,MAAQ,GAAGA,MAAMC,WAAW,CAACD,IAAI,EAAE,EAAE;AAEjD;;CAEC,GACD,OAAO,MAAMmB,oBAAoB;IAC/B,eAAe;AACjB,EAAW;AAEX;;;;CAIC,GACD,OAAO,MAAMC,cAAc;IACzBC,MAAM;IACNC,QAAQ;AACV,EAAW;AAEX;;;CAGC,GACD,OAAO,MAAMC,qBAAqB;IAChC,qEAAqE;IACrEC,OAAO;AACT,EAAW;AAEX;;;CAGC,GACD,OAAO,MAAMC,qBAAqB;IAChCC,KAAK;IACLC,QAAQ;IACRC,MAAM;IACNC,SAAS;IACTC,UAAU;IACVC,OAAO;AACT,EAAW;AAGX;;;CAGC,GACD,OAAO,MAAMC,4BAA4B,IAAO,CAAA;QAC9CC,oBAAoBR,mBAAmBC,GAAG;QAC1CQ,uBAAuBT,mBAAmBE,MAAM;QAChDQ,qBAAqBV,mBAAmBG,IAAI;QAC5CQ,wBAAwBX,mBAAmBI,OAAO;QAClDQ,yBAAyBZ,mBAAmBK,QAAQ;QACpDQ,sBAAsBb,mBAAmBM,KAAK;IAChD,CAAA,EAAG"}

package/src/utils/website-constructs/files/cdk/core/static-website.ts.template

@@ -259,6 +259,9 @@ export class StaticWebsite extends Construct {
       destinationBucket: this.websiteBucket,
       // Files in the distribution's edge caches will be invalidated after files are uploaded to the destination bucket.
       distribution: this.cloudFrontDistribution,
+      // Exclude the runtime config from this deployment's sync so its default pruning
+      // never deletes the file managed separately by RuntimeConfigDeployment below.
+      exclude: [DEFAULT_RUNTIME_CONFIG_FILENAME],
       memoryLimit: 1024,
     });