@aws/nx-plugin 1.0.0-rc.45 → 1.0.0-rc.47

package/src/utils/iac.js

@@ -8,7 +8,7 @@ import { IAC_PROVIDERS } from "./iac-providers.js";
  * Given an iac provider option, resolve the actual iac provider to use
  */ export const resolveIac = async (tree, iacOption)=>{
     if (iacOption === 'inherit') {
-        const pluginConfig = await readAwsNxPluginConfig(tree);
+        const pluginConfig = readAwsNxPluginConfig(tree);
         if (!pluginConfig?.iac?.provider) {
             throw new Error(`IaC provider "inherit" requires iac.provider to be set in ${AWS_NX_PLUGIN_CONFIG_FILE_NAME}`);
         }

package/src/utils/iac.js.map

@@ -1 +1 @@
-{"version":3,"sources":["../../../../../packages/nx-plugin/src/utils/iac.ts"],"sourcesContent":["/**\n * Copyright Amazon.com, Inc. or its affiliates. All Rights Reserved.\n * SPDX-License-Identifier: Apache-2.0\n */\nimport type { Tree } from '@nx/devkit';\nimport {\n  AWS_NX_PLUGIN_CONFIG_FILE_NAME,\n  readAwsNxPluginConfig,\n} from './config/utils';\n\nexport { IAC_PROVIDERS, type Iac, type IacOption } from './iac-providers';\n\nimport { IAC_PROVIDERS } from './iac-providers';\n\n/**\n * Configuration for infrastructure as code\n */\nexport interface IacConfig {\n  /**\n   * Default provider for infrastructure as code\n   */\n  provider: (typeof IAC_PROVIDERS)[number];\n}\n\n/**\n * Given an iac provider option, resolve the actual iac provider to use\n */\nexport const resolveIac = async (\n  tree: Tree,\n  iacOption: 'cdk' | 'terraform' | 'inherit',\n): Promise<(typeof IAC_PROVIDERS)[number]> => {\n  if (iacOption === 'inherit') {\n    const pluginConfig = await readAwsNxPluginConfig(tree);\n\n    if (!pluginConfig?.iac?.provider) {\n      throw new Error(\n        `IaC provider \"inherit\" requires iac.provider to be set in ${AWS_NX_PLUGIN_CONFIG_FILE_NAME}`,\n      );\n    }\n    if (!IAC_PROVIDERS.includes(pluginConfig.iac.provider)) {\n      throw new Error(\n        `iac.provider in ${AWS_NX_PLUGIN_CONFIG_FILE_NAME} must be one of ${IAC_PROVIDERS.join(', ')}`,\n      );\n    }\n\n    return pluginConfig.iac.provider;\n  }\n  return iacOption;\n};\n"],"names":["AWS_NX_PLUGIN_CONFIG_FILE_NAME","readAwsNxPluginConfig","IAC_PROVIDERS","resolveIac","tree","iacOption","pluginConfig","iac","provider","Error","includes","join"],"mappings":"AAAA;;;CAGC,GAED,SACEA,8BAA8B,EAC9BC,qBAAqB,QAChB,oBAAiB;AAExB,SAASC,aAAa,QAAkC,qBAAkB;AAE1E,SAASA,aAAa,QAAQ,qBAAkB;AAYhD;;CAEC,GACD,OAAO,MAAMC,aAAa,OACxBC,MACAC;IAEA,IAAIA,cAAc,WAAW;QAC3B,MAAMC,eAAe,MAAML,sBAAsBG;QAEjD,IAAI,CAACE,cAAcC,KAAKC,UAAU;YAChC,MAAM,IAAIC,MACR,CAAC,0DAA0D,EAAET,gCAAgC;QAEjG;QACA,IAAI,CAACE,cAAcQ,QAAQ,CAACJ,aAAaC,GAAG,CAACC,QAAQ,GAAG;YACtD,MAAM,IAAIC,MACR,CAAC,gBAAgB,EAAET,+BAA+B,gBAAgB,EAAEE,cAAcS,IAAI,CAAC,OAAO;QAElG;QAEA,OAAOL,aAAaC,GAAG,CAACC,QAAQ;IAClC;IACA,OAAOH;AACT,EAAE"}
+{"version":3,"sources":["../../../../../packages/nx-plugin/src/utils/iac.ts"],"sourcesContent":["/**\n * Copyright Amazon.com, Inc. or its affiliates. All Rights Reserved.\n * SPDX-License-Identifier: Apache-2.0\n */\nimport type { Tree } from '@nx/devkit';\nimport {\n  AWS_NX_PLUGIN_CONFIG_FILE_NAME,\n  readAwsNxPluginConfig,\n} from './config/utils';\n\nexport { IAC_PROVIDERS, type Iac, type IacOption } from './iac-providers';\n\nimport { IAC_PROVIDERS } from './iac-providers';\n\n/**\n * Configuration for infrastructure as code\n */\nexport interface IacConfig {\n  /**\n   * Default provider for infrastructure as code\n   */\n  provider: (typeof IAC_PROVIDERS)[number];\n}\n\n/**\n * Given an iac provider option, resolve the actual iac provider to use\n */\nexport const resolveIac = async (\n  tree: Tree,\n  iacOption: 'cdk' | 'terraform' | 'inherit',\n): Promise<(typeof IAC_PROVIDERS)[number]> => {\n  if (iacOption === 'inherit') {\n    const pluginConfig = readAwsNxPluginConfig(tree);\n\n    if (!pluginConfig?.iac?.provider) {\n      throw new Error(\n        `IaC provider \"inherit\" requires iac.provider to be set in ${AWS_NX_PLUGIN_CONFIG_FILE_NAME}`,\n      );\n    }\n    if (!IAC_PROVIDERS.includes(pluginConfig.iac.provider)) {\n      throw new Error(\n        `iac.provider in ${AWS_NX_PLUGIN_CONFIG_FILE_NAME} must be one of ${IAC_PROVIDERS.join(', ')}`,\n      );\n    }\n\n    return pluginConfig.iac.provider;\n  }\n  return iacOption;\n};\n"],"names":["AWS_NX_PLUGIN_CONFIG_FILE_NAME","readAwsNxPluginConfig","IAC_PROVIDERS","resolveIac","tree","iacOption","pluginConfig","iac","provider","Error","includes","join"],"mappings":"AAAA;;;CAGC,GAED,SACEA,8BAA8B,EAC9BC,qBAAqB,QAChB,oBAAiB;AAExB,SAASC,aAAa,QAAkC,qBAAkB;AAE1E,SAASA,aAAa,QAAQ,qBAAkB;AAYhD;;CAEC,GACD,OAAO,MAAMC,aAAa,OACxBC,MACAC;IAEA,IAAIA,cAAc,WAAW;QAC3B,MAAMC,eAAeL,sBAAsBG;QAE3C,IAAI,CAACE,cAAcC,KAAKC,UAAU;YAChC,MAAM,IAAIC,MACR,CAAC,0DAA0D,EAAET,gCAAgC;QAEjG;QACA,IAAI,CAACE,cAAcQ,QAAQ,CAACJ,aAAaC,GAAG,CAACC,QAAQ,GAAG;YACtD,MAAM,IAAIC,MACR,CAAC,gBAAgB,EAAET,+BAA+B,gBAAgB,EAAEE,cAAcS,IAAI,CAAC,OAAO;QAElG;QAEA,OAAOL,aAAaC,GAAG,CAACC,QAAQ;IAClC;IACA,OAAOH;AACT,EAAE"}

package/src/utils/identity-constructs/files/cdk/core/user-identity.ts.template

@@ -30,7 +30,7 @@ import {
 import { LogGroup, RetentionDays } from 'aws-cdk-lib/aws-logs';
 import { Construct } from 'constructs';
 import { RuntimeConfig } from './runtime-config<% if (esm) { %>.js<% } %>';
-import { Distribution } from 'aws-cdk-lib/aws-cloudfront';
+import { CfnDistribution, Distribution } from 'aws-cdk-lib/aws-cloudfront';
 import { suppressRules } from './checkov<% if (esm) { %>.js<% } %>';
 
 const WEB_CLIENT_ID = 'WebClient';
@@ -242,9 +242,7 @@ export class UserIdentity extends Construct {
     const lazilyComputedCallbackUrls = Lazy.list({
       produce: () =>
         ['http://localhost:4200', 'http://localhost:4300'].concat(
-          this.findCloudFrontDistributions().map(
-            (d) => `https://${d.domainName}`
-          )
+          this.findCloudFrontDomainNames().map((domain) => `https://${domain}`)
         ),
     });
 
@@ -294,8 +292,15 @@ export class UserIdentity extends Construct {
     }).node.addDependency(userPoolClient, userPool, userPoolDomain);
   };
 
-  private findCloudFrontDistributions = (): Distribution[] =>
+  // Includes each distribution's default domain name plus any custom domain names (aliases) configured on it.
+  private findCloudFrontDomainNames = (): string[] =>
     Stack.of(this)
       .node.findAll()
-      .filter((child) => child instanceof Distribution);
+      .filter((child): child is Distribution => child instanceof Distribution)
+      .flatMap((d) => {
+        const cfnDistribution = d.node.defaultChild as CfnDistribution;
+        const distributionConfig =
+          cfnDistribution.distributionConfig as CfnDistribution.DistributionConfigProperty;
+        return [d.domainName, ...(distributionConfig.aliases ?? [])];
+      });
 }

package/src/utils/identity-constructs/identity-constructs.js

@@ -37,14 +37,25 @@ const addIdentityTerraformModules = (tree, options)=>{
     // Update the static website module to add the callback url
     const staticWebsiteModule = tree.read(joinPathFragments(PACKAGES_DIR, SHARED_TERRAFORM_DIR, 'src', 'core', 'static-website', 'static-website.tf'), 'utf-8');
     if (staticWebsiteModule && !staticWebsiteModule.includes('source = "../user-identity/add-callback-url"')) {
-        // Find the aws_cloudfront_distribution.website resource and add the callback URL module after it
+        // Find the aws_cloudfront_distribution.website resource and add the callback URL module after it.
+        // Includes the CloudFront domain plus any custom domain names (aliases) configured via var.custom_domain_names.
         const callbackUrlModule = `
 
-# Add CloudFront domain to user pool client callback URLs
+# Add CloudFront domain and any custom domain names to user pool client callback URLs.
+# Keyed by statically-known values so for_each keys are resolvable at plan time; the
+# CloudFront domain is only known at apply time, so it appears in the value, not the key.
+locals {
+  callback_urls = merge(
+    { cloudfront = "https://\${aws_cloudfront_distribution.website.domain_name}" },
+    { for domain in var.custom_domain_names : domain => "https://\${domain}" },
+  )
+}
+
 module "add_callback_url" {
   source = "../user-identity/add-callback-url"
+  for_each = local.callback_urls
 
-  callback_url = "https://\${aws_cloudfront_distribution.website.domain_name}"
+  callback_url = each.value
 
   depends_on = [aws_cloudfront_distribution.website]
 }`;

package/src/utils/identity-constructs/identity-constructs.js.map

@@ -1 +1 @@
-{"version":3,"sources":["../../../../../../packages/nx-plugin/src/utils/identity-constructs/identity-constructs.ts"],"sourcesContent":["/**\n * Copyright Amazon.com, Inc. or its affiliates. All Rights Reserved.\n * SPDX-License-Identifier: Apache-2.0\n */\nimport {\n  generateFiles,\n  joinPathFragments,\n  OverwriteStrategy,\n  type Tree,\n} from '@nx/devkit';\nimport { addStarExport } from '../ast';\nimport type { Iac } from '../iac';\nimport { esmVars } from '../module-format';\nimport {\n  PACKAGES_DIR,\n  SHARED_CONSTRUCTS_DIR,\n  SHARED_TERRAFORM_DIR,\n} from '../shared-constructs-constants';\nimport { PY_VERSIONS, terraformProviderVersions } from '../versions';\n\nexport interface AddIdentityInfraOptions {\n  cognitoDomain: string;\n  allowSignup: boolean;\n}\n\n/**\n * Add infrastructure for a static website\n */\nexport const addIdentityInfra = async (\n  tree: Tree,\n  options: AddIdentityInfraOptions & { iac: Iac },\n) => {\n  if (options.iac === 'cdk') {\n    await addIdentityCdkConstructs(tree, options);\n  } else if (options.iac === 'terraform') {\n    addIdentityTerraformModules(tree, options);\n  } else {\n    throw new Error(`Unsupported iac ${options.iac}`);\n  }\n};\n\nconst addIdentityCdkConstructs = async (\n  tree: Tree,\n  options: AddIdentityInfraOptions,\n) => {\n  generateFiles(\n    tree,\n    joinPathFragments(import.meta.dirname, 'files', 'cdk', 'core'),\n    joinPathFragments(PACKAGES_DIR, SHARED_CONSTRUCTS_DIR, 'src', 'core'),\n    { ...options, ...esmVars(tree) },\n    {\n      overwriteStrategy: OverwriteStrategy.KeepExisting,\n    },\n  );\n\n  await addStarExport(\n    tree,\n    joinPathFragments(\n      PACKAGES_DIR,\n      SHARED_CONSTRUCTS_DIR,\n      'src',\n      'core',\n      'index.ts',\n    ),\n    './user-identity.js',\n  );\n};\n\nconst addIdentityTerraformModules = (\n  tree: Tree,\n  options: AddIdentityInfraOptions,\n) => {\n  generateFiles(\n    tree,\n    joinPathFragments(import.meta.dirname, 'files', 'terraform', 'core'),\n    joinPathFragments(PACKAGES_DIR, SHARED_TERRAFORM_DIR, 'src', 'core'),\n    {\n      ...options,\n      boto3Version: PY_VERSIONS.boto3,\n      ...terraformProviderVersions(),\n    },\n    {\n      overwriteStrategy: OverwriteStrategy.KeepExisting,\n    },\n  );\n\n  // Update the static website module to add the callback url\n  const staticWebsiteModule = tree.read(\n    joinPathFragments(\n      PACKAGES_DIR,\n      SHARED_TERRAFORM_DIR,\n      'src',\n      'core',\n      'static-website',\n      'static-website.tf',\n    ),\n    'utf-8',\n  );\n  if (\n    staticWebsiteModule &&\n    !staticWebsiteModule.includes(\n      'source = \"../user-identity/add-callback-url\"',\n    )\n  ) {\n    // Find the aws_cloudfront_distribution.website resource and add the callback URL module after it\n    const callbackUrlModule = `\n\n# Add CloudFront domain to user pool client callback URLs\nmodule \"add_callback_url\" {\n  source = \"../user-identity/add-callback-url\"\n\n  callback_url = \"https://\\${aws_cloudfront_distribution.website.domain_name}\"\n\n  depends_on = [aws_cloudfront_distribution.website]\n}`;\n\n    // Find the CloudFront distribution resource using proper brace counting\n    // This handles deeply nested structures correctly\n    const resourceStartPattern =\n      /resource\\s+\"aws_cloudfront_distribution\"\\s+\"website\"\\s*\\{/;\n    const resourceStartMatch = staticWebsiteModule.match(resourceStartPattern);\n\n    if (resourceStartMatch) {\n      const startIndex =\n        resourceStartMatch.index! + resourceStartMatch[0].length - 1; // Position at opening brace\n      let braceCount = 0;\n      let insertionPoint = -1;\n\n      // Count braces to find the end of the resource block\n      for (let i = startIndex; i < staticWebsiteModule.length; i++) {\n        const char = staticWebsiteModule[i];\n        if (char === '{') {\n          braceCount++;\n        } else if (char === '}') {\n          braceCount--;\n          if (braceCount === 0) {\n            // Found the closing brace of the CloudFront resource\n            insertionPoint = i + 1;\n            break;\n          }\n        }\n      }\n\n      if (insertionPoint !== -1) {\n        // Insert the callback URL module right after the CloudFront distribution\n        const beforeInsertion = staticWebsiteModule.substring(\n          0,\n          insertionPoint,\n        );\n        const afterInsertion = staticWebsiteModule.substring(insertionPoint);\n        const updatedContent =\n          beforeInsertion + callbackUrlModule + afterInsertion;\n\n        tree.write(\n          joinPathFragments(\n            PACKAGES_DIR,\n            SHARED_TERRAFORM_DIR,\n            'src',\n            'core',\n            'static-website',\n            'static-website.tf',\n          ),\n          updatedContent,\n        );\n      }\n    }\n  }\n};\n"],"names":["generateFiles","joinPathFragments","OverwriteStrategy","addStarExport","esmVars","PACKAGES_DIR","SHARED_CONSTRUCTS_DIR","SHARED_TERRAFORM_DIR","PY_VERSIONS","terraformProviderVersions","addIdentityInfra","tree","options","iac","addIdentityCdkConstructs","addIdentityTerraformModules","Error","dirname","overwriteStrategy","KeepExisting","boto3Version","boto3","staticWebsiteModule","read","includes","callbackUrlModule","resourceStartPattern","resourceStartMatch","match","startIndex","index","length","braceCount","insertionPoint","i","char","beforeInsertion","substring","afterInsertion","updatedContent","write"],"mappings":"AAAA;;;CAGC,GACD,SACEA,aAAa,EACbC,iBAAiB,EACjBC,iBAAiB,QAEZ,aAAa;AACpB,SAASC,aAAa,QAAQ,YAAS;AAEvC,SAASC,OAAO,QAAQ,sBAAmB;AAC3C,SACEC,YAAY,EACZC,qBAAqB,EACrBC,oBAAoB,QACf,oCAAiC;AACxC,SAASC,WAAW,EAAEC,yBAAyB,QAAQ,iBAAc;AAOrE;;CAEC,GACD,OAAO,MAAMC,mBAAmB,OAC9BC,MACAC;IAEA,IAAIA,QAAQC,GAAG,KAAK,OAAO;QACzB,MAAMC,yBAAyBH,MAAMC;IACvC,OAAO,IAAIA,QAAQC,GAAG,KAAK,aAAa;QACtCE,4BAA4BJ,MAAMC;IACpC,OAAO;QACL,MAAM,IAAII,MAAM,CAAC,gBAAgB,EAAEJ,QAAQC,GAAG,EAAE;IAClD;AACF,EAAE;AAEF,MAAMC,2BAA2B,OAC/BH,MACAC;IAEAZ,cACEW,MACAV,kBAAkB,YAAYgB,OAAO,EAAE,SAAS,OAAO,SACvDhB,kBAAkBI,cAAcC,uBAAuB,OAAO,SAC9D;QAAE,GAAGM,OAAO;QAAE,GAAGR,QAAQO,KAAK;IAAC,GAC/B;QACEO,mBAAmBhB,kBAAkBiB,YAAY;IACnD;IAGF,MAAMhB,cACJQ,MACAV,kBACEI,cACAC,uBACA,OACA,QACA,aAEF;AAEJ;AAEA,MAAMS,8BAA8B,CAClCJ,MACAC;IAEAZ,cACEW,MACAV,kBAAkB,YAAYgB,OAAO,EAAE,SAAS,aAAa,SAC7DhB,kBAAkBI,cAAcE,sBAAsB,OAAO,SAC7D;QACE,GAAGK,OAAO;QACVQ,cAAcZ,YAAYa,KAAK;QAC/B,GAAGZ,2BAA2B;IAChC,GACA;QACES,mBAAmBhB,kBAAkBiB,YAAY;IACnD;IAGF,2DAA2D;IAC3D,MAAMG,sBAAsBX,KAAKY,IAAI,CACnCtB,kBACEI,cACAE,sBACA,OACA,QACA,kBACA,sBAEF;IAEF,IACEe,uBACA,CAACA,oBAAoBE,QAAQ,CAC3B,iDAEF;QACA,iGAAiG;QACjG,MAAMC,oBAAoB,CAAC;;;;;;;;;CAS9B,CAAC;QAEE,wEAAwE;QACxE,kDAAkD;QAClD,MAAMC,uBACJ;QACF,MAAMC,qBAAqBL,oBAAoBM,KAAK,CAACF;QAErD,IAAIC,oBAAoB;YACtB,MAAME,aACJF,mBAAmBG,KAAK,GAAIH,kBAAkB,CAAC,EAAE,CAACI,MAAM,GAAG,GAAG,4BAA4B;YAC5F,IAAIC,aAAa;YACjB,IAAIC,iBAAiB,CAAC;YAEtB,qDAAqD;YACrD,IAAK,IAAIC,IAAIL,YAAYK,IAAIZ,oBAAoBS,MAAM,EAAEG,IAAK;gBAC5D,MAAMC,OAAOb,mBAAmB,CAACY,EAAE;gBACnC,IAAIC,SAAS,KAAK;oBAChBH;gBACF,OAAO,IAAIG,SAAS,KAAK;oBACvBH;oBACA,IAAIA,eAAe,GAAG;wBACpB,qDAAqD;wBACrDC,iBAAiBC,IAAI;wBACrB;oBACF;gBACF;YACF;YAEA,IAAID,mBAAmB,CAAC,GAAG;gBACzB,yEAAyE;gBACzE,MAAMG,kBAAkBd,oBAAoBe,SAAS,CACnD,GACAJ;gBAEF,MAAMK,iBAAiBhB,oBAAoBe,SAAS,CAACJ;gBACrD,MAAMM,iBACJH,kBAAkBX,oBAAoBa;gBAExC3B,KAAK6B,KAAK,CACRvC,kBACEI,cACAE,sBACA,OACA,QACA,kBACA,sBAEFgC;YAEJ;QACF;IACF;AACF"}
+{"version":3,"sources":["../../../../../../packages/nx-plugin/src/utils/identity-constructs/identity-constructs.ts"],"sourcesContent":["/**\n * Copyright Amazon.com, Inc. or its affiliates. All Rights Reserved.\n * SPDX-License-Identifier: Apache-2.0\n */\nimport {\n  generateFiles,\n  joinPathFragments,\n  OverwriteStrategy,\n  type Tree,\n} from '@nx/devkit';\nimport { addStarExport } from '../ast';\nimport type { Iac } from '../iac';\nimport { esmVars } from '../module-format';\nimport {\n  PACKAGES_DIR,\n  SHARED_CONSTRUCTS_DIR,\n  SHARED_TERRAFORM_DIR,\n} from '../shared-constructs-constants';\nimport { PY_VERSIONS, terraformProviderVersions } from '../versions';\n\nexport interface AddIdentityInfraOptions {\n  cognitoDomain: string;\n  allowSignup: boolean;\n}\n\n/**\n * Add infrastructure for a static website\n */\nexport const addIdentityInfra = async (\n  tree: Tree,\n  options: AddIdentityInfraOptions & { iac: Iac },\n) => {\n  if (options.iac === 'cdk') {\n    await addIdentityCdkConstructs(tree, options);\n  } else if (options.iac === 'terraform') {\n    addIdentityTerraformModules(tree, options);\n  } else {\n    throw new Error(`Unsupported iac ${options.iac}`);\n  }\n};\n\nconst addIdentityCdkConstructs = async (\n  tree: Tree,\n  options: AddIdentityInfraOptions,\n) => {\n  generateFiles(\n    tree,\n    joinPathFragments(import.meta.dirname, 'files', 'cdk', 'core'),\n    joinPathFragments(PACKAGES_DIR, SHARED_CONSTRUCTS_DIR, 'src', 'core'),\n    { ...options, ...esmVars(tree) },\n    {\n      overwriteStrategy: OverwriteStrategy.KeepExisting,\n    },\n  );\n\n  await addStarExport(\n    tree,\n    joinPathFragments(\n      PACKAGES_DIR,\n      SHARED_CONSTRUCTS_DIR,\n      'src',\n      'core',\n      'index.ts',\n    ),\n    './user-identity.js',\n  );\n};\n\nconst addIdentityTerraformModules = (\n  tree: Tree,\n  options: AddIdentityInfraOptions,\n) => {\n  generateFiles(\n    tree,\n    joinPathFragments(import.meta.dirname, 'files', 'terraform', 'core'),\n    joinPathFragments(PACKAGES_DIR, SHARED_TERRAFORM_DIR, 'src', 'core'),\n    {\n      ...options,\n      boto3Version: PY_VERSIONS.boto3,\n      ...terraformProviderVersions(),\n    },\n    {\n      overwriteStrategy: OverwriteStrategy.KeepExisting,\n    },\n  );\n\n  // Update the static website module to add the callback url\n  const staticWebsiteModule = tree.read(\n    joinPathFragments(\n      PACKAGES_DIR,\n      SHARED_TERRAFORM_DIR,\n      'src',\n      'core',\n      'static-website',\n      'static-website.tf',\n    ),\n    'utf-8',\n  );\n  if (\n    staticWebsiteModule &&\n    !staticWebsiteModule.includes(\n      'source = \"../user-identity/add-callback-url\"',\n    )\n  ) {\n    // Find the aws_cloudfront_distribution.website resource and add the callback URL module after it.\n    // Includes the CloudFront domain plus any custom domain names (aliases) configured via var.custom_domain_names.\n    const callbackUrlModule = `\n\n# Add CloudFront domain and any custom domain names to user pool client callback URLs.\n# Keyed by statically-known values so for_each keys are resolvable at plan time; the\n# CloudFront domain is only known at apply time, so it appears in the value, not the key.\nlocals {\n  callback_urls = merge(\n    { cloudfront = \"https://\\${aws_cloudfront_distribution.website.domain_name}\" },\n    { for domain in var.custom_domain_names : domain => \"https://\\${domain}\" },\n  )\n}\n\nmodule \"add_callback_url\" {\n  source = \"../user-identity/add-callback-url\"\n  for_each = local.callback_urls\n\n  callback_url = each.value\n\n  depends_on = [aws_cloudfront_distribution.website]\n}`;\n\n    // Find the CloudFront distribution resource using proper brace counting\n    // This handles deeply nested structures correctly\n    const resourceStartPattern =\n      /resource\\s+\"aws_cloudfront_distribution\"\\s+\"website\"\\s*\\{/;\n    const resourceStartMatch = staticWebsiteModule.match(resourceStartPattern);\n\n    if (resourceStartMatch) {\n      const startIndex =\n        resourceStartMatch.index! + resourceStartMatch[0].length - 1; // Position at opening brace\n      let braceCount = 0;\n      let insertionPoint = -1;\n\n      // Count braces to find the end of the resource block\n      for (let i = startIndex; i < staticWebsiteModule.length; i++) {\n        const char = staticWebsiteModule[i];\n        if (char === '{') {\n          braceCount++;\n        } else if (char === '}') {\n          braceCount--;\n          if (braceCount === 0) {\n            // Found the closing brace of the CloudFront resource\n            insertionPoint = i + 1;\n            break;\n          }\n        }\n      }\n\n      if (insertionPoint !== -1) {\n        // Insert the callback URL module right after the CloudFront distribution\n        const beforeInsertion = staticWebsiteModule.substring(\n          0,\n          insertionPoint,\n        );\n        const afterInsertion = staticWebsiteModule.substring(insertionPoint);\n        const updatedContent =\n          beforeInsertion + callbackUrlModule + afterInsertion;\n\n        tree.write(\n          joinPathFragments(\n            PACKAGES_DIR,\n            SHARED_TERRAFORM_DIR,\n            'src',\n            'core',\n            'static-website',\n            'static-website.tf',\n          ),\n          updatedContent,\n        );\n      }\n    }\n  }\n};\n"],"names":["generateFiles","joinPathFragments","OverwriteStrategy","addStarExport","esmVars","PACKAGES_DIR","SHARED_CONSTRUCTS_DIR","SHARED_TERRAFORM_DIR","PY_VERSIONS","terraformProviderVersions","addIdentityInfra","tree","options","iac","addIdentityCdkConstructs","addIdentityTerraformModules","Error","dirname","overwriteStrategy","KeepExisting","boto3Version","boto3","staticWebsiteModule","read","includes","callbackUrlModule","resourceStartPattern","resourceStartMatch","match","startIndex","index","length","braceCount","insertionPoint","i","char","beforeInsertion","substring","afterInsertion","updatedContent","write"],"mappings":"AAAA;;;CAGC,GACD,SACEA,aAAa,EACbC,iBAAiB,EACjBC,iBAAiB,QAEZ,aAAa;AACpB,SAASC,aAAa,QAAQ,YAAS;AAEvC,SAASC,OAAO,QAAQ,sBAAmB;AAC3C,SACEC,YAAY,EACZC,qBAAqB,EACrBC,oBAAoB,QACf,oCAAiC;AACxC,SAASC,WAAW,EAAEC,yBAAyB,QAAQ,iBAAc;AAOrE;;CAEC,GACD,OAAO,MAAMC,mBAAmB,OAC9BC,MACAC;IAEA,IAAIA,QAAQC,GAAG,KAAK,OAAO;QACzB,MAAMC,yBAAyBH,MAAMC;IACvC,OAAO,IAAIA,QAAQC,GAAG,KAAK,aAAa;QACtCE,4BAA4BJ,MAAMC;IACpC,OAAO;QACL,MAAM,IAAII,MAAM,CAAC,gBAAgB,EAAEJ,QAAQC,GAAG,EAAE;IAClD;AACF,EAAE;AAEF,MAAMC,2BAA2B,OAC/BH,MACAC;IAEAZ,cACEW,MACAV,kBAAkB,YAAYgB,OAAO,EAAE,SAAS,OAAO,SACvDhB,kBAAkBI,cAAcC,uBAAuB,OAAO,SAC9D;QAAE,GAAGM,OAAO;QAAE,GAAGR,QAAQO,KAAK;IAAC,GAC/B;QACEO,mBAAmBhB,kBAAkBiB,YAAY;IACnD;IAGF,MAAMhB,cACJQ,MACAV,kBACEI,cACAC,uBACA,OACA,QACA,aAEF;AAEJ;AAEA,MAAMS,8BAA8B,CAClCJ,MACAC;IAEAZ,cACEW,MACAV,kBAAkB,YAAYgB,OAAO,EAAE,SAAS,aAAa,SAC7DhB,kBAAkBI,cAAcE,sBAAsB,OAAO,SAC7D;QACE,GAAGK,OAAO;QACVQ,cAAcZ,YAAYa,KAAK;QAC/B,GAAGZ,2BAA2B;IAChC,GACA;QACES,mBAAmBhB,kBAAkBiB,YAAY;IACnD;IAGF,2DAA2D;IAC3D,MAAMG,sBAAsBX,KAAKY,IAAI,CACnCtB,kBACEI,cACAE,sBACA,OACA,QACA,kBACA,sBAEF;IAEF,IACEe,uBACA,CAACA,oBAAoBE,QAAQ,CAC3B,iDAEF;QACA,kGAAkG;QAClG,gHAAgH;QAChH,MAAMC,oBAAoB,CAAC;;;;;;;;;;;;;;;;;;;CAmB9B,CAAC;QAEE,wEAAwE;QACxE,kDAAkD;QAClD,MAAMC,uBACJ;QACF,MAAMC,qBAAqBL,oBAAoBM,KAAK,CAACF;QAErD,IAAIC,oBAAoB;YACtB,MAAME,aACJF,mBAAmBG,KAAK,GAAIH,kBAAkB,CAAC,EAAE,CAACI,MAAM,GAAG,GAAG,4BAA4B;YAC5F,IAAIC,aAAa;YACjB,IAAIC,iBAAiB,CAAC;YAEtB,qDAAqD;YACrD,IAAK,IAAIC,IAAIL,YAAYK,IAAIZ,oBAAoBS,MAAM,EAAEG,IAAK;gBAC5D,MAAMC,OAAOb,mBAAmB,CAACY,EAAE;gBACnC,IAAIC,SAAS,KAAK;oBAChBH;gBACF,OAAO,IAAIG,SAAS,KAAK;oBACvBH;oBACA,IAAIA,eAAe,GAAG;wBACpB,qDAAqD;wBACrDC,iBAAiBC,IAAI;wBACrB;oBACF;gBACF;YACF;YAEA,IAAID,mBAAmB,CAAC,GAAG;gBACzB,yEAAyE;gBACzE,MAAMG,kBAAkBd,oBAAoBe,SAAS,CACnD,GACAJ;gBAEF,MAAMK,iBAAiBhB,oBAAoBe,SAAS,CAACJ;gBACrD,MAAMM,iBACJH,kBAAkBX,oBAAoBa;gBAExC3B,KAAK6B,KAAK,CACRvC,kBACEI,cACAE,sBACA,OACA,QACA,kBACA,sBAEFgC;YAEJ;QACF;IACF;AACF"}

package/src/utils/init.d.ts

@@ -34,6 +34,12 @@ export interface ApplyWorkspaceInitOptions {
      * the default) — it only adds the convenience scripts that are absent.
      */
     readonly overwriteScripts?: boolean;
+    /**
+     * Whether generators use the package manager's dependency catalog. On pnpm
+     * this also sets `catalogMode: strict` so `pnpm add` records new deps in the
+     * catalog. Defaults to true.
+     */
+    readonly catalogs?: boolean;
 }
 /**
  * Transform an Nx workspace into one ready to run `@aws/nx-plugin` generators.
@@ -50,4 +56,4 @@ export interface ApplyWorkspaceInitOptions {
  * existing projects — those are decisions for the user (see the "add to an
  * existing workspace" guide).
  */
-export declare const applyWorkspaceInit: (tree: Tree, { iac, containers, mcp, readmeOverwriteStrategy, overwriteScripts, }: ApplyWorkspaceInitOptions) => Promise<void>;
+export declare const applyWorkspaceInit: (tree: Tree, { iac, containers, mcp, readmeOverwriteStrategy, overwriteScripts, catalogs, }: ApplyWorkspaceInitOptions) => Promise<void>;

package/src/utils/init.js

@@ -1,7 +1,7 @@
 /**
  * Copyright Amazon.com, Inc. or its affiliates. All Rights Reserved.
  * SPDX-License-Identifier: Apache-2.0
- */ import { addDependenciesToPackageJson, detectPackageManager, generateFiles, joinPathFragments, OverwriteStrategy, readNxJson, updateJson, updateNxJson } from "@nx/devkit";
+ */ import { generateFiles, joinPathFragments, OverwriteStrategy, readNxJson, updateJson, updateNxJson } from "@nx/devkit";
 import { initGenerator } from "@nx/js";
 import yaml from "js-yaml";
 import { readModulePackageJson } from "nx/src/utils/package-json";
@@ -12,11 +12,13 @@ import { SYNC_GENERATOR_NAME as TS_SYNC_GENERATOR_NAME } from "../ts/sync/genera
 import { BASE_TSCONFIG_COMPILER_OPTIONS } from "./base-tsconfig.js";
 import { ensureAwsNxPluginConfig, updateAwsNxPluginConfig } from "./config/utils.js";
 import { inferContainers } from "./containers.js";
-import { DEFAULT_BIOME_CONFIG } from "./format.js";
+import { addDependenciesToPackageJson, detectWorkspacePackageManager } from "./dependencies.js";
+import { getDefaultBiomeConfig } from "./format.js";
 import { configureMcpServers } from "./mcp.js";
 import { getNpmScope } from "./npm-scope.js";
 import { mergeTargetDefault } from "./nx.js";
 import { getPackageManagerDisplayCommands } from "./pkg-manager.js";
+import { workspaceGlobs } from "./project-package-json.js";
 import { withVersions } from "./versions.js";
 const WORKSPACES = [
     'packages/*'
@@ -43,7 +45,7 @@ export const PNPM_BUILT_DEPENDENCIES = [
  * broken `set this to true or false` placeholder pnpm writes when it skips a
  * build script. This makes the file self-consistent so the first generator's
  * install doesn't fail with `ERR_PNPM_IGNORED_BUILDS`.
- */ const setUpPnpmWorkspace = (tree)=>{
+ */ const setUpPnpmWorkspace = (tree, catalogs)=>{
     const existing = tree.exists('pnpm-workspace.yaml') ? yaml.load(tree.read('pnpm-workspace.yaml', 'utf-8') ?? '') ?? {} : {};
     // Preserve any packages globs the user already has, ensuring ours are present.
     const packages = Array.from(new Set([
@@ -59,11 +61,18 @@ export const PNPM_BUILT_DEPENDENCIES = [
                 true
             ]))
     };
+    // `strict` makes `pnpm add` record new deps in the catalog; it only gates
+    // that flow, so pre-declared direct ranges (e.g. tslib) still install.
+    // Preserve an explicit user choice.
+    const catalogMode = catalogs ? existing.catalogMode ?? 'strict' : existing.catalogMode;
     tree.write('pnpm-workspace.yaml', yaml.dump({
         ...existing,
         packages,
         allowBuilds,
-        onlyBuiltDependencies: PNPM_BUILT_DEPENDENCIES
+        onlyBuiltDependencies: PNPM_BUILT_DEPENDENCIES,
+        ...catalogMode ? {
+            catalogMode
+        } : {}
     }, {
         quotingType: "'"
     }));
@@ -73,17 +82,25 @@ export const PNPM_BUILT_DEPENDENCIES = [
  *
  * pnpm workspaces are declared in `pnpm-workspace.yaml`; every other package
  * manager reads the `workspaces` field of the root `package.json`.
- */ const setUpWorkspaces = (tree)=>{
-    if (detectPackageManager() === 'pnpm') {
-        setUpPnpmWorkspace(tree);
+ */ const setUpWorkspaces = (tree, catalogs)=>{
+    if (detectWorkspacePackageManager(tree) === 'pnpm') {
+        setUpPnpmWorkspace(tree, catalogs);
     } else {
-        updateJson(tree, 'package.json', (json)=>({
+        updateJson(tree, 'package.json', (json)=>{
+            // The `workspaces` field may be the object form ({ "packages": [...] })
+            // accepted by yarn and bun — extend the globs while preserving the form.
+            const globs = Array.from(new Set([
+                ...workspaceGlobs(json.workspaces),
+                ...WORKSPACES
+            ]));
+            return {
                 ...json,
-                workspaces: Array.from(new Set([
-                    ...json.workspaces ?? [],
-                    ...WORKSPACES
-                ]))
-            }));
+                workspaces: json.workspaces !== undefined && !Array.isArray(json.workspaces) ? {
+                    ...json.workspaces,
+                    packages: globs
+                } : globs
+            };
+        });
     }
 };
 /**
@@ -140,9 +157,10 @@ export const PNPM_BUILT_DEPENDENCIES = [
  * compiler options, migrate a workspace's package manager, or restructure
  * existing projects — those are decisions for the user (see the "add to an
  * existing workspace" guide).
- */ export const applyWorkspaceInit = async (tree, { iac, containers, mcp, readmeOverwriteStrategy = OverwriteStrategy.KeepExisting, overwriteScripts = false })=>{
+ */ export const applyWorkspaceInit = async (tree, { iac, containers, mcp, readmeOverwriteStrategy = OverwriteStrategy.KeepExisting, overwriteScripts = false, catalogs = true })=>{
     const resolvedContainers = !containers || containers === 'infer' ? inferContainers() : containers;
-    // Write IaC provider and container engine to plugin config
+    // The catalogs flag is written explicitly (even when true) so the workspace
+    // records its dependency-management choice.
     await ensureAwsNxPluginConfig(tree);
     await updateAwsNxPluginConfig(tree, {
         iac: {
@@ -150,6 +168,9 @@ export const PNPM_BUILT_DEPENDENCIES = [
         },
         containers: {
             engine: resolvedContainers
+        },
+        packageManager: {
+            catalogs
         }
     });
     // Set up the TypeScript plugin, base tsconfig, formatter etc. `@nx/js`
@@ -161,7 +182,7 @@ export const PNPM_BUILT_DEPENDENCIES = [
     });
     ensureBaseTsConfig(tree);
     ensureRootTsConfig(tree);
-    setUpWorkspaces(tree);
+    setUpWorkspaces(tree, catalogs);
     const nxJson = readNxJson(tree);
     updateNxJson(tree, {
         ...nxJson,
@@ -229,7 +250,7 @@ export const PNPM_BUILT_DEPENDENCIES = [
     });
     // Write biome.json for formatting and linting
     if (!tree.exists('biome.json')) {
-        tree.write('biome.json', JSON.stringify(DEFAULT_BIOME_CONFIG, null, 2));
+        tree.write('biome.json', JSON.stringify(getDefaultBiomeConfig(tree), null, 2));
     }
     generateFiles(tree, joinPathFragments(import.meta.dirname, '..', 'preset', 'files'), '.', {
         projectName: getNpmScope(tree),

package/src/utils/init.js.map

@@ -1 +1 @@
-{"version":3,"sources":["../../../../../packages/nx-plugin/src/utils/init.ts"],"sourcesContent":["/**\n * Copyright Amazon.com, Inc. or its affiliates. All Rights Reserved.\n * SPDX-License-Identifier: Apache-2.0\n */\nimport {\n  addDependenciesToPackageJson,\n  detectPackageManager,\n  generateFiles,\n  joinPathFragments,\n  OverwriteStrategy,\n  readNxJson,\n  type Tree,\n  updateJson,\n  updateNxJson,\n} from '@nx/devkit';\nimport { initGenerator } from '@nx/js';\nimport { readFileSync } from 'fs';\nimport yaml from 'js-yaml';\nimport { readModulePackageJson } from 'nx/src/utils/package-json';\nimport GeneratorsJson from '../../generators.json' with { type: 'json' };\nimport { SYNC_GENERATOR_NAME as TS_SYNC_GENERATOR_NAME } from '../ts/sync/generator';\nimport { BASE_TSCONFIG_COMPILER_OPTIONS } from './base-tsconfig';\nimport {\n  ensureAwsNxPluginConfig,\n  updateAwsNxPluginConfig,\n} from './config/utils';\nimport { type Containers, inferContainers } from './containers';\nimport { DEFAULT_BIOME_CONFIG } from './format';\nimport type { Iac } from './iac';\nimport { configureMcpServers } from './mcp';\nimport { getNpmScope } from './npm-scope';\nimport { mergeTargetDefault } from './nx';\nimport { getPackageManagerDisplayCommands } from './pkg-manager';\nimport { withVersions } from './versions';\n\nconst WORKSPACES = ['packages/*'];\nconst NX_TYPESCRIPT_SYNC_GENERATOR = '@nx/js:typescript-sync';\n\n// Built dependencies whose install scripts the generated workspace trusts.\n// `onlyBuiltDependencies` is the pnpm 10 key (silently ignored by pnpm 11);\n// pnpm 11 reads `allowBuilds` instead. Any dep NOT in this allowlist will\n// have its install scripts skipped with a warning — matching pnpm 10's\n// default behaviour. The user can opt-in later via `pnpm approve-builds`.\nexport const PNPM_BUILT_DEPENDENCIES = ['@swc/core', 'esbuild', 'nx', 'sharp'];\n\n/**\n * Options controlling how the workspace is initialised. These mirror the\n * preset schema so a workspace created via the preset and one initialised via\n * the `init` generator end up in the same shape.\n */\nexport interface ApplyWorkspaceInitOptions {\n  /** The IaC provider to record in the plugin config. */\n  readonly iac: Iac;\n  /**\n   * The container engine to record. `undefined`/`'infer'` picks docker when\n   * installed, else finch.\n   */\n  readonly containers?: Containers | 'infer';\n  /** Whether to configure MCP servers for coding agents. Defaults to true. */\n  readonly mcp?: boolean;\n  /**\n   * How to treat the generated workspace README. The preset owns the README of\n   * a greenfield workspace (`Overwrite`); the `init` generator must not clobber\n   * an existing workspace's README (`KeepExisting`, the default).\n   */\n  readonly readmeOverwriteStrategy?: OverwriteStrategy;\n  /**\n   * Whether to overwrite root package.json scripts that already exist. The\n   * preset owns a greenfield workspace's scripts (`true`); the `init`\n   * generator must not clobber an existing workspace's scripts (`false`,\n   * the default) — it only adds the convenience scripts that are absent.\n   */\n  readonly overwriteScripts?: boolean;\n}\n\n/**\n * Add or repair the pnpm `allowBuilds` / `onlyBuiltDependencies` allowlist for\n * the workspace's `packages` globs, without clobbering any packages the user\n * has already declared.\n *\n * A workspace not created by the preset commonly has either no\n * `pnpm-workspace.yaml`, one missing the `packages` globs, or one carrying the\n * broken `set this to true or false` placeholder pnpm writes when it skips a\n * build script. This makes the file self-consistent so the first generator's\n * install doesn't fail with `ERR_PNPM_IGNORED_BUILDS`.\n */\nconst setUpPnpmWorkspace = (tree: Tree) => {\n  const existing = tree.exists('pnpm-workspace.yaml')\n    ? ((yaml.load(tree.read('pnpm-workspace.yaml', 'utf-8') ?? '') as Record<\n        string,\n        unknown\n      >) ?? {})\n    : {};\n\n  // Preserve any packages globs the user already has, ensuring ours are present.\n  const packages = Array.from(\n    new Set([...((existing.packages as string[]) ?? []), ...WORKSPACES]),\n  );\n\n  const allowBuilds = {\n    ...(typeof existing.allowBuilds === 'object' && existing.allowBuilds\n      ? (existing.allowBuilds as Record<string, unknown>)\n      : {}),\n    // Overwrite any non-boolean (e.g. the \"set this to true or false\"\n    // placeholder) with an explicit true for the deps we trust.\n    ...Object.fromEntries(PNPM_BUILT_DEPENDENCIES.map((dep) => [dep, true])),\n  };\n\n  tree.write(\n    'pnpm-workspace.yaml',\n    yaml.dump(\n      {\n        ...existing,\n        packages,\n        allowBuilds,\n        onlyBuiltDependencies: PNPM_BUILT_DEPENDENCIES,\n      },\n      { quotingType: \"'\" },\n    ),\n  );\n};\n\n/**\n * Configure the workspace's package manager for a monorepo layout.\n *\n * pnpm workspaces are declared in `pnpm-workspace.yaml`; every other package\n * manager reads the `workspaces` field of the root `package.json`.\n */\nconst setUpWorkspaces = (tree: Tree) => {\n  if (detectPackageManager() === 'pnpm') {\n    setUpPnpmWorkspace(tree);\n  } else {\n    updateJson(tree, 'package.json', (json) => ({\n      ...json,\n      workspaces: Array.from(\n        new Set([...(json.workspaces ?? []), ...WORKSPACES]),\n      ),\n    }));\n  }\n};\n\n/**\n * Ensure the workspace has a `tsconfig.base.json`.\n *\n * `@nx/js` `initGenerator` (with `addTsPlugin`) normally creates this, but it\n * short-circuits when the workspace already has a root `tsconfig.json` — in\n * which case no base file is written and the next project generator fails with\n * `Cannot find tsconfig.base.json`. So we create a compatible one when it's\n * absent. An existing base is left untouched: the user may have tuned it, and\n * rewriting shared compiler options can break other projects (see the\n * \"add to an existing workspace\" guide).\n */\nconst ensureBaseTsConfig = (tree: Tree) => {\n  if (tree.exists('tsconfig.base.json')) {\n    return;\n  }\n  tree.write(\n    'tsconfig.base.json',\n    JSON.stringify(\n      {\n        compilerOptions: {\n          ...BASE_TSCONFIG_COMPILER_OPTIONS,\n          customConditions: [getNpmScope(tree)],\n        },\n      },\n      null,\n      2,\n    ),\n  );\n};\n\n/**\n * Ensure the workspace has a root `tsconfig.json`.\n *\n * Nx's `@nx/js:typescript-sync` generator hard-fails with\n * `Missing root \"tsconfig.json\"` when it's absent. The plugin's TypeScript\n * projects reference each other via this file, so we guarantee a minimal one\n * exists (sync populates its `references`).\n */\nconst ensureRootTsConfig = (tree: Tree) => {\n  if (tree.exists('tsconfig.json')) {\n    return;\n  }\n  tree.write(\n    'tsconfig.json',\n    JSON.stringify(\n      {\n        extends: './tsconfig.base.json',\n        files: [],\n        references: [],\n      },\n      null,\n      2,\n    ),\n  );\n};\n\n/**\n * Transform an Nx workspace into one ready to run `@aws/nx-plugin` generators.\n *\n * This is the deterministic core shared by the workspace preset and the `init`\n * generator. It is safe to re-run: every step is idempotent (config merges,\n * keyed nx.json / package.json entries, create-if-missing files), so running\n * it against an already-initialised workspace is a no-op.\n *\n * It preserves the workspace's module format: the root package.json `type`\n * field is owned by the preset (written from its `--module` option) and left\n * untouched here. It does NOT rewrite an existing `tsconfig.base.json`'s\n * compiler options, migrate a workspace's package manager, or restructure\n * existing projects — those are decisions for the user (see the \"add to an\n * existing workspace\" guide).\n */\nexport const applyWorkspaceInit = async (\n  tree: Tree,\n  {\n    iac,\n    containers,\n    mcp,\n    readmeOverwriteStrategy = OverwriteStrategy.KeepExisting,\n    overwriteScripts = false,\n  }: ApplyWorkspaceInitOptions,\n) => {\n  const resolvedContainers =\n    !containers || containers === 'infer' ? inferContainers() : containers;\n\n  // Write IaC provider and container engine to plugin config\n  await ensureAwsNxPluginConfig(tree);\n  await updateAwsNxPluginConfig(tree, {\n    iac: { provider: iac },\n    containers: { engine: resolvedContainers },\n  });\n\n  // Set up the TypeScript plugin, base tsconfig, formatter etc. `@nx/js`\n  // creates `tsconfig.base.json` when absent, but skips it when a root\n  // `tsconfig.json` already exists — so we ensure both explicitly below.\n  await initGenerator(tree, {\n    formatter: 'none',\n    addTsPlugin: true,\n  });\n\n  ensureBaseTsConfig(tree);\n  ensureRootTsConfig(tree);\n\n  setUpWorkspaces(tree);\n\n  const nxJson = readNxJson(tree);\n  updateNxJson(tree, {\n    ...nxJson,\n    // Preserve an explicit analytics choice in an existing workspace.\n    analytics: (nxJson as { analytics?: boolean }).analytics ?? false,\n    targetDefaults: {\n      ...nxJson.targetDefaults,\n      compile: mergeTargetDefault(nxJson.targetDefaults?.compile, (base) => ({\n        ...base,\n        syncGenerators: [\n          ...(base.syncGenerators ?? []).filter(\n            (g) =>\n              ![TS_SYNC_GENERATOR_NAME, NX_TYPESCRIPT_SYNC_GENERATOR].includes(\n                g,\n              ),\n          ),\n          NX_TYPESCRIPT_SYNC_GENERATOR,\n          TS_SYNC_GENERATOR_NAME,\n        ],\n      })),\n    },\n  });\n\n  const CONVENIENCE_SCRIPTS = {\n    dev: 'nx run-many --target dev',\n    build: 'nx run-many --target build',\n    lint: 'nx run-many --target lint --configuration=fix',\n    test: 'nx run-many --target test --all',\n    // Trivy container image scanning is not part of `build` (its result\n    // depends on the ever-changing vulnerability database); run it explicitly,\n    // e.g. in CI.\n    trivy: 'nx run-many --target trivy --all',\n    'build:skip-lint': 'nx run-many --target build --configuration=skip-lint',\n    'build:all': 'nx run-many --target build --all',\n    'affected:all': 'nx affected --target build',\n  };\n  updateJson(tree, 'package.json', (packageJson) => ({\n    ...packageJson,\n    // The root `type` field is owned by the preset (written explicitly from\n    // its `--module` option). `init` preserves an existing workspace's field\n    // as-is: an ESM workspace already carries `type: \"module\"` (that is how\n    // the format is inferred), and introducing a `type` into a CommonJS\n    // workspace that lacks one changes behaviour for frameworks that parse it\n    // (e.g. Next.js starts treating the app's ESM source as CJS).\n    scripts: overwriteScripts\n      ? { ...packageJson.scripts, ...CONVENIENCE_SCRIPTS }\n      : { ...CONVENIENCE_SCRIPTS, ...packageJson.scripts },\n  }));\n\n  // Pin the workspace's `nx` to the version the plugin's @nx/* packages are\n  // built against. A mismatched workspace nx (even a patch apart) hoists a\n  // second nested nx under @nx/js, and the two instances deadlock `nx sync`.\n  // `@nx/js` must be a root dependency for the `@nx/js:typescript-sync`\n  // generator registered in nx.json to resolve (npm doesn't hoist the\n  // plugin's own copy reliably).\n  const nxVersion = readModulePackageJson('@nx/js').packageJson.version;\n  addDependenciesToPackageJson(\n    tree,\n    {},\n    {\n      nx: nxVersion,\n      '@nx/js': nxVersion,\n      '@nx/workspace': nxVersion,\n      ...withVersions(['typescript', '@biomejs/biome']),\n    },\n  );\n\n  // Write biome.json for formatting and linting\n  if (!tree.exists('biome.json')) {\n    tree.write('biome.json', JSON.stringify(DEFAULT_BIOME_CONFIG, null, 2));\n  }\n\n  generateFiles(\n    tree, // the virtual file system\n    joinPathFragments(import.meta.dirname, '..', 'preset', 'files'),\n    '.',\n    {\n      projectName: getNpmScope(tree),\n      generators: Object.entries(GeneratorsJson.generators)\n        .filter(([_, v]) => !v['hidden'])\n        .map(([k, v]) => ({ name: k, description: v.description })),\n      ...(() => {\n        const cmds = getPackageManagerDisplayCommands();\n        return {\n          pkgMgrCmd: cmds.exec,\n          buildCmd: `${cmds.run} build`,\n          lintCmd: `${cmds.run} lint`,\n        };\n      })(),\n    },\n    {\n      overwriteStrategy: readmeOverwriteStrategy,\n    },\n  );\n\n  if (mcp !== false) {\n    configureMcpServers(tree);\n  }\n};\n"],"names":["addDependenciesToPackageJson","detectPackageManager","generateFiles","joinPathFragments","OverwriteStrategy","readNxJson","updateJson","updateNxJson","initGenerator","yaml","readModulePackageJson","GeneratorsJson","type","SYNC_GENERATOR_NAME","TS_SYNC_GENERATOR_NAME","BASE_TSCONFIG_COMPILER_OPTIONS","ensureAwsNxPluginConfig","updateAwsNxPluginConfig","inferContainers","DEFAULT_BIOME_CONFIG","configureMcpServers","getNpmScope","mergeTargetDefault","getPackageManagerDisplayCommands","withVersions","WORKSPACES","NX_TYPESCRIPT_SYNC_GENERATOR","PNPM_BUILT_DEPENDENCIES","setUpPnpmWorkspace","tree","existing","exists","load","read","packages","Array","from","Set","allowBuilds","Object","fromEntries","map","dep","write","dump","onlyBuiltDependencies","quotingType","setUpWorkspaces","json","workspaces","ensureBaseTsConfig","JSON","stringify","compilerOptions","customConditions","ensureRootTsConfig","extends","files","references","applyWorkspaceInit","iac","containers","mcp","readmeOverwriteStrategy","KeepExisting","overwriteScripts","resolvedContainers","provider","engine","formatter","addTsPlugin","nxJson","analytics","targetDefaults","compile","base","syncGenerators","filter","g","includes","CONVENIENCE_SCRIPTS","dev","build","lint","test","trivy","packageJson","scripts","nxVersion","version","nx","dirname","projectName","generators","entries","_","v","k","name","description","cmds","pkgMgrCmd","exec","buildCmd","run","lintCmd","overwriteStrategy"],"mappings":"AAAA;;;CAGC,GACD,SACEA,4BAA4B,EAC5BC,oBAAoB,EACpBC,aAAa,EACbC,iBAAiB,EACjBC,iBAAiB,EACjBC,UAAU,EAEVC,UAAU,EACVC,YAAY,QACP,aAAa;AACpB,SAASC,aAAa,QAAQ,SAAS;AAEvC,OAAOC,UAAU,UAAU;AAC3B,SAASC,qBAAqB,QAAQ,4BAA4B;AAClE,OAAOC,oBAAoB,6BAA6B;IAAEC,MAAM;AAAO,EAAE;AACzE,SAASC,uBAAuBC,sBAAsB,QAAQ,0BAAuB;AACrF,SAASC,8BAA8B,QAAQ,qBAAkB;AACjE,SACEC,uBAAuB,EACvBC,uBAAuB,QAClB,oBAAiB;AACxB,SAA0BC,eAAe,QAAQ,kBAAe;AAChE,SAASC,oBAAoB,QAAQ,cAAW;AAEhD,SAASC,mBAAmB,QAAQ,WAAQ;AAC5C,SAASC,WAAW,QAAQ,iBAAc;AAC1C,SAASC,kBAAkB,QAAQ,UAAO;AAC1C,SAASC,gCAAgC,QAAQ,mBAAgB;AACjE,SAASC,YAAY,QAAQ,gBAAa;AAE1C,MAAMC,aAAa;IAAC;CAAa;AACjC,MAAMC,+BAA+B;AAErC,2EAA2E;AAC3E,4EAA4E;AAC5E,0EAA0E;AAC1E,uEAAuE;AACvE,0EAA0E;AAC1E,OAAO,MAAMC,0BAA0B;IAAC;IAAa;IAAW;IAAM;CAAQ,CAAC;AAgC/E;;;;;;;;;;CAUC,GACD,MAAMC,qBAAqB,CAACC;IAC1B,MAAMC,WAAWD,KAAKE,MAAM,CAAC,yBACxB,AAACtB,KAAKuB,IAAI,CAACH,KAAKI,IAAI,CAAC,uBAAuB,YAAY,OAGnD,CAAC,IACP,CAAC;IAEL,+EAA+E;IAC/E,MAAMC,WAAWC,MAAMC,IAAI,CACzB,IAAIC,IAAI;WAAK,AAACP,SAASI,QAAQ,IAAiB,EAAE;WAAMT;KAAW;IAGrE,MAAMa,cAAc;QAClB,GAAI,OAAOR,SAASQ,WAAW,KAAK,YAAYR,SAASQ,WAAW,GAC/DR,SAASQ,WAAW,GACrB,CAAC,CAAC;QACN,kEAAkE;QAClE,4DAA4D;QAC5D,GAAGC,OAAOC,WAAW,CAACb,wBAAwBc,GAAG,CAAC,CAACC,MAAQ;gBAACA;gBAAK;aAAK,EAAE;IAC1E;IAEAb,KAAKc,KAAK,CACR,uBACAlC,KAAKmC,IAAI,CACP;QACE,GAAGd,QAAQ;QACXI;QACAI;QACAO,uBAAuBlB;IACzB,GACA;QAAEmB,aAAa;IAAI;AAGzB;AAEA;;;;;CAKC,GACD,MAAMC,kBAAkB,CAAClB;IACvB,IAAI5B,2BAA2B,QAAQ;QACrC2B,mBAAmBC;IACrB,OAAO;QACLvB,WAAWuB,MAAM,gBAAgB,CAACmB,OAAU,CAAA;gBAC1C,GAAGA,IAAI;gBACPC,YAAYd,MAAMC,IAAI,CACpB,IAAIC,IAAI;uBAAKW,KAAKC,UAAU,IAAI,EAAE;uBAAMxB;iBAAW;YAEvD,CAAA;IACF;AACF;AAEA;;;;;;;;;;CAUC,GACD,MAAMyB,qBAAqB,CAACrB;IAC1B,IAAIA,KAAKE,MAAM,CAAC,uBAAuB;QACrC;IACF;IACAF,KAAKc,KAAK,CACR,sBACAQ,KAAKC,SAAS,CACZ;QACEC,iBAAiB;YACf,GAAGtC,8BAA8B;YACjCuC,kBAAkB;gBAACjC,YAAYQ;aAAM;QACvC;IACF,GACA,MACA;AAGN;AAEA;;;;;;;CAOC,GACD,MAAM0B,qBAAqB,CAAC1B;IAC1B,IAAIA,KAAKE,MAAM,CAAC,kBAAkB;QAChC;IACF;IACAF,KAAKc,KAAK,CACR,iBACAQ,KAAKC,SAAS,CACZ;QACEI,SAAS;QACTC,OAAO,EAAE;QACTC,YAAY,EAAE;IAChB,GACA,MACA;AAGN;AAEA;;;;;;;;;;;;;;CAcC,GACD,OAAO,MAAMC,qBAAqB,OAChC9B,MACA,EACE+B,GAAG,EACHC,UAAU,EACVC,GAAG,EACHC,0BAA0B3D,kBAAkB4D,YAAY,EACxDC,mBAAmB,KAAK,EACE;IAE5B,MAAMC,qBACJ,CAACL,cAAcA,eAAe,UAAU3C,oBAAoB2C;IAE9D,2DAA2D;IAC3D,MAAM7C,wBAAwBa;IAC9B,MAAMZ,wBAAwBY,MAAM;QAClC+B,KAAK;YAAEO,UAAUP;QAAI;QACrBC,YAAY;YAAEO,QAAQF;QAAmB;IAC3C;IAEA,uEAAuE;IACvE,qEAAqE;IACrE,uEAAuE;IACvE,MAAM1D,cAAcqB,MAAM;QACxBwC,WAAW;QACXC,aAAa;IACf;IAEApB,mBAAmBrB;IACnB0B,mBAAmB1B;IAEnBkB,gBAAgBlB;IAEhB,MAAM0C,SAASlE,WAAWwB;IAC1BtB,aAAasB,MAAM;QACjB,GAAG0C,MAAM;QACT,kEAAkE;QAClEC,WAAW,AAACD,OAAmCC,SAAS,IAAI;QAC5DC,gBAAgB;YACd,GAAGF,OAAOE,cAAc;YACxBC,SAASpD,mBAAmBiD,OAAOE,cAAc,EAAEC,SAAS,CAACC,OAAU,CAAA;oBACrE,GAAGA,IAAI;oBACPC,gBAAgB;2BACX,AAACD,CAAAA,KAAKC,cAAc,IAAI,EAAE,AAAD,EAAGC,MAAM,CACnC,CAACC,IACC,CAAC;gCAAChE;gCAAwBY;6BAA6B,CAACqD,QAAQ,CAC9DD;wBAGNpD;wBACAZ;qBACD;gBACH,CAAA;QACF;IACF;IAEA,MAAMkE,sBAAsB;QAC1BC,KAAK;QACLC,OAAO;QACPC,MAAM;QACNC,MAAM;QACN,oEAAoE;QACpE,2EAA2E;QAC3E,cAAc;QACdC,OAAO;QACP,mBAAmB;QACnB,aAAa;QACb,gBAAgB;IAClB;IACA/E,WAAWuB,MAAM,gBAAgB,CAACyD,cAAiB,CAAA;YACjD,GAAGA,WAAW;YACd,wEAAwE;YACxE,yEAAyE;YACzE,wEAAwE;YACxE,oEAAoE;YACpE,0EAA0E;YAC1E,8DAA8D;YAC9DC,SAAStB,mBACL;gBAAE,GAAGqB,YAAYC,OAAO;gBAAE,GAAGP,mBAAmB;YAAC,IACjD;gBAAE,GAAGA,mBAAmB;gBAAE,GAAGM,YAAYC,OAAO;YAAC;QACvD,CAAA;IAEA,0EAA0E;IAC1E,yEAAyE;IACzE,2EAA2E;IAC3E,sEAAsE;IACtE,oEAAoE;IACpE,+BAA+B;IAC/B,MAAMC,YAAY9E,sBAAsB,UAAU4E,WAAW,CAACG,OAAO;IACrEzF,6BACE6B,MACA,CAAC,GACD;QACE6D,IAAIF;QACJ,UAAUA;QACV,iBAAiBA;QACjB,GAAGhE,aAAa;YAAC;YAAc;SAAiB,CAAC;IACnD;IAGF,8CAA8C;IAC9C,IAAI,CAACK,KAAKE,MAAM,CAAC,eAAe;QAC9BF,KAAKc,KAAK,CAAC,cAAcQ,KAAKC,SAAS,CAACjC,sBAAsB,MAAM;IACtE;IAEAjB,cACE2B,MACA1B,kBAAkB,YAAYwF,OAAO,EAAE,MAAM,UAAU,UACvD,KACA;QACEC,aAAavE,YAAYQ;QACzBgE,YAAYtD,OAAOuD,OAAO,CAACnF,eAAekF,UAAU,EACjDhB,MAAM,CAAC,CAAC,CAACkB,GAAGC,EAAE,GAAK,CAACA,CAAC,CAAC,SAAS,EAC/BvD,GAAG,CAAC,CAAC,CAACwD,GAAGD,EAAE,GAAM,CAAA;gBAAEE,MAAMD;gBAAGE,aAAaH,EAAEG,WAAW;YAAC,CAAA;QAC1D,GAAG,AAAC,CAAA;YACF,MAAMC,OAAO7E;YACb,OAAO;gBACL8E,WAAWD,KAAKE,IAAI;gBACpBC,UAAU,GAAGH,KAAKI,GAAG,CAAC,MAAM,CAAC;gBAC7BC,SAAS,GAAGL,KAAKI,GAAG,CAAC,KAAK,CAAC;YAC7B;QACF,CAAA,GAAI;IACN,GACA;QACEE,mBAAmB3C;IACrB;IAGF,IAAID,QAAQ,OAAO;QACjB1C,oBAAoBS;IACtB;AACF,EAAE"}
+{"version":3,"sources":["../../../../../packages/nx-plugin/src/utils/init.ts"],"sourcesContent":["/**\n * Copyright Amazon.com, Inc. or its affiliates. All Rights Reserved.\n * SPDX-License-Identifier: Apache-2.0\n */\nimport {\n  generateFiles,\n  joinPathFragments,\n  OverwriteStrategy,\n  readNxJson,\n  type Tree,\n  updateJson,\n  updateNxJson,\n} from '@nx/devkit';\nimport { initGenerator } from '@nx/js';\nimport { readFileSync } from 'fs';\nimport yaml from 'js-yaml';\nimport { readModulePackageJson } from 'nx/src/utils/package-json';\nimport GeneratorsJson from '../../generators.json' with { type: 'json' };\nimport { SYNC_GENERATOR_NAME as TS_SYNC_GENERATOR_NAME } from '../ts/sync/generator';\nimport { BASE_TSCONFIG_COMPILER_OPTIONS } from './base-tsconfig';\nimport {\n  ensureAwsNxPluginConfig,\n  updateAwsNxPluginConfig,\n} from './config/utils';\nimport { type Containers, inferContainers } from './containers';\nimport {\n  addDependenciesToPackageJson,\n  detectWorkspacePackageManager,\n} from './dependencies';\nimport { getDefaultBiomeConfig } from './format';\nimport type { Iac } from './iac';\nimport { configureMcpServers } from './mcp';\nimport { getNpmScope } from './npm-scope';\nimport { mergeTargetDefault } from './nx';\nimport { getPackageManagerDisplayCommands } from './pkg-manager';\nimport { workspaceGlobs } from './project-package-json';\nimport { withVersions } from './versions';\n\nconst WORKSPACES = ['packages/*'];\nconst NX_TYPESCRIPT_SYNC_GENERATOR = '@nx/js:typescript-sync';\n\n// Built dependencies whose install scripts the generated workspace trusts.\n// `onlyBuiltDependencies` is the pnpm 10 key (silently ignored by pnpm 11);\n// pnpm 11 reads `allowBuilds` instead. Any dep NOT in this allowlist will\n// have its install scripts skipped with a warning — matching pnpm 10's\n// default behaviour. The user can opt-in later via `pnpm approve-builds`.\nexport const PNPM_BUILT_DEPENDENCIES = ['@swc/core', 'esbuild', 'nx', 'sharp'];\n\n/**\n * Options controlling how the workspace is initialised. These mirror the\n * preset schema so a workspace created via the preset and one initialised via\n * the `init` generator end up in the same shape.\n */\nexport interface ApplyWorkspaceInitOptions {\n  /** The IaC provider to record in the plugin config. */\n  readonly iac: Iac;\n  /**\n   * The container engine to record. `undefined`/`'infer'` picks docker when\n   * installed, else finch.\n   */\n  readonly containers?: Containers | 'infer';\n  /** Whether to configure MCP servers for coding agents. Defaults to true. */\n  readonly mcp?: boolean;\n  /**\n   * How to treat the generated workspace README. The preset owns the README of\n   * a greenfield workspace (`Overwrite`); the `init` generator must not clobber\n   * an existing workspace's README (`KeepExisting`, the default).\n   */\n  readonly readmeOverwriteStrategy?: OverwriteStrategy;\n  /**\n   * Whether to overwrite root package.json scripts that already exist. The\n   * preset owns a greenfield workspace's scripts (`true`); the `init`\n   * generator must not clobber an existing workspace's scripts (`false`,\n   * the default) — it only adds the convenience scripts that are absent.\n   */\n  readonly overwriteScripts?: boolean;\n  /**\n   * Whether generators use the package manager's dependency catalog. On pnpm\n   * this also sets `catalogMode: strict` so `pnpm add` records new deps in the\n   * catalog. Defaults to true.\n   */\n  readonly catalogs?: boolean;\n}\n\n/**\n * Add or repair the pnpm `allowBuilds` / `onlyBuiltDependencies` allowlist for\n * the workspace's `packages` globs, without clobbering any packages the user\n * has already declared.\n *\n * A workspace not created by the preset commonly has either no\n * `pnpm-workspace.yaml`, one missing the `packages` globs, or one carrying the\n * broken `set this to true or false` placeholder pnpm writes when it skips a\n * build script. This makes the file self-consistent so the first generator's\n * install doesn't fail with `ERR_PNPM_IGNORED_BUILDS`.\n */\nconst setUpPnpmWorkspace = (tree: Tree, catalogs: boolean) => {\n  const existing = tree.exists('pnpm-workspace.yaml')\n    ? ((yaml.load(tree.read('pnpm-workspace.yaml', 'utf-8') ?? '') as Record<\n        string,\n        unknown\n      >) ?? {})\n    : {};\n\n  // Preserve any packages globs the user already has, ensuring ours are present.\n  const packages = Array.from(\n    new Set([...((existing.packages as string[]) ?? []), ...WORKSPACES]),\n  );\n\n  const allowBuilds = {\n    ...(typeof existing.allowBuilds === 'object' && existing.allowBuilds\n      ? (existing.allowBuilds as Record<string, unknown>)\n      : {}),\n    // Overwrite any non-boolean (e.g. the \"set this to true or false\"\n    // placeholder) with an explicit true for the deps we trust.\n    ...Object.fromEntries(PNPM_BUILT_DEPENDENCIES.map((dep) => [dep, true])),\n  };\n\n  // `strict` makes `pnpm add` record new deps in the catalog; it only gates\n  // that flow, so pre-declared direct ranges (e.g. tslib) still install.\n  // Preserve an explicit user choice.\n  const catalogMode = catalogs\n    ? (existing.catalogMode ?? 'strict')\n    : existing.catalogMode;\n\n  tree.write(\n    'pnpm-workspace.yaml',\n    yaml.dump(\n      {\n        ...existing,\n        packages,\n        allowBuilds,\n        onlyBuiltDependencies: PNPM_BUILT_DEPENDENCIES,\n        ...(catalogMode ? { catalogMode } : {}),\n      },\n      { quotingType: \"'\" },\n    ),\n  );\n};\n\n/**\n * Configure the workspace's package manager for a monorepo layout.\n *\n * pnpm workspaces are declared in `pnpm-workspace.yaml`; every other package\n * manager reads the `workspaces` field of the root `package.json`.\n */\nconst setUpWorkspaces = (tree: Tree, catalogs: boolean) => {\n  if (detectWorkspacePackageManager(tree) === 'pnpm') {\n    setUpPnpmWorkspace(tree, catalogs);\n  } else {\n    updateJson(tree, 'package.json', (json) => {\n      // The `workspaces` field may be the object form ({ \"packages\": [...] })\n      // accepted by yarn and bun — extend the globs while preserving the form.\n      const globs = Array.from(\n        new Set([...workspaceGlobs(json.workspaces), ...WORKSPACES]),\n      );\n      return {\n        ...json,\n        workspaces:\n          json.workspaces !== undefined && !Array.isArray(json.workspaces)\n            ? { ...json.workspaces, packages: globs }\n            : globs,\n      };\n    });\n  }\n};\n\n/**\n * Ensure the workspace has a `tsconfig.base.json`.\n *\n * `@nx/js` `initGenerator` (with `addTsPlugin`) normally creates this, but it\n * short-circuits when the workspace already has a root `tsconfig.json` — in\n * which case no base file is written and the next project generator fails with\n * `Cannot find tsconfig.base.json`. So we create a compatible one when it's\n * absent. An existing base is left untouched: the user may have tuned it, and\n * rewriting shared compiler options can break other projects (see the\n * \"add to an existing workspace\" guide).\n */\nconst ensureBaseTsConfig = (tree: Tree) => {\n  if (tree.exists('tsconfig.base.json')) {\n    return;\n  }\n  tree.write(\n    'tsconfig.base.json',\n    JSON.stringify(\n      {\n        compilerOptions: {\n          ...BASE_TSCONFIG_COMPILER_OPTIONS,\n          customConditions: [getNpmScope(tree)],\n        },\n      },\n      null,\n      2,\n    ),\n  );\n};\n\n/**\n * Ensure the workspace has a root `tsconfig.json`.\n *\n * Nx's `@nx/js:typescript-sync` generator hard-fails with\n * `Missing root \"tsconfig.json\"` when it's absent. The plugin's TypeScript\n * projects reference each other via this file, so we guarantee a minimal one\n * exists (sync populates its `references`).\n */\nconst ensureRootTsConfig = (tree: Tree) => {\n  if (tree.exists('tsconfig.json')) {\n    return;\n  }\n  tree.write(\n    'tsconfig.json',\n    JSON.stringify(\n      {\n        extends: './tsconfig.base.json',\n        files: [],\n        references: [],\n      },\n      null,\n      2,\n    ),\n  );\n};\n\n/**\n * Transform an Nx workspace into one ready to run `@aws/nx-plugin` generators.\n *\n * This is the deterministic core shared by the workspace preset and the `init`\n * generator. It is safe to re-run: every step is idempotent (config merges,\n * keyed nx.json / package.json entries, create-if-missing files), so running\n * it against an already-initialised workspace is a no-op.\n *\n * It preserves the workspace's module format: the root package.json `type`\n * field is owned by the preset (written from its `--module` option) and left\n * untouched here. It does NOT rewrite an existing `tsconfig.base.json`'s\n * compiler options, migrate a workspace's package manager, or restructure\n * existing projects — those are decisions for the user (see the \"add to an\n * existing workspace\" guide).\n */\nexport const applyWorkspaceInit = async (\n  tree: Tree,\n  {\n    iac,\n    containers,\n    mcp,\n    readmeOverwriteStrategy = OverwriteStrategy.KeepExisting,\n    overwriteScripts = false,\n    catalogs = true,\n  }: ApplyWorkspaceInitOptions,\n) => {\n  const resolvedContainers =\n    !containers || containers === 'infer' ? inferContainers() : containers;\n\n  // The catalogs flag is written explicitly (even when true) so the workspace\n  // records its dependency-management choice.\n  await ensureAwsNxPluginConfig(tree);\n  await updateAwsNxPluginConfig(tree, {\n    iac: { provider: iac },\n    containers: { engine: resolvedContainers },\n    packageManager: { catalogs },\n  });\n\n  // Set up the TypeScript plugin, base tsconfig, formatter etc. `@nx/js`\n  // creates `tsconfig.base.json` when absent, but skips it when a root\n  // `tsconfig.json` already exists — so we ensure both explicitly below.\n  await initGenerator(tree, {\n    formatter: 'none',\n    addTsPlugin: true,\n  });\n\n  ensureBaseTsConfig(tree);\n  ensureRootTsConfig(tree);\n\n  setUpWorkspaces(tree, catalogs);\n\n  const nxJson = readNxJson(tree);\n  updateNxJson(tree, {\n    ...nxJson,\n    // Preserve an explicit analytics choice in an existing workspace.\n    analytics: (nxJson as { analytics?: boolean }).analytics ?? false,\n    targetDefaults: {\n      ...nxJson.targetDefaults,\n      compile: mergeTargetDefault(nxJson.targetDefaults?.compile, (base) => ({\n        ...base,\n        syncGenerators: [\n          ...(base.syncGenerators ?? []).filter(\n            (g) =>\n              ![TS_SYNC_GENERATOR_NAME, NX_TYPESCRIPT_SYNC_GENERATOR].includes(\n                g,\n              ),\n          ),\n          NX_TYPESCRIPT_SYNC_GENERATOR,\n          TS_SYNC_GENERATOR_NAME,\n        ],\n      })),\n    },\n  });\n\n  const CONVENIENCE_SCRIPTS = {\n    dev: 'nx run-many --target dev',\n    build: 'nx run-many --target build',\n    lint: 'nx run-many --target lint --configuration=fix',\n    test: 'nx run-many --target test --all',\n    // Trivy container image scanning is not part of `build` (its result\n    // depends on the ever-changing vulnerability database); run it explicitly,\n    // e.g. in CI.\n    trivy: 'nx run-many --target trivy --all',\n    'build:skip-lint': 'nx run-many --target build --configuration=skip-lint',\n    'build:all': 'nx run-many --target build --all',\n    'affected:all': 'nx affected --target build',\n  };\n  updateJson(tree, 'package.json', (packageJson) => ({\n    ...packageJson,\n    // The root `type` field is owned by the preset (written explicitly from\n    // its `--module` option). `init` preserves an existing workspace's field\n    // as-is: an ESM workspace already carries `type: \"module\"` (that is how\n    // the format is inferred), and introducing a `type` into a CommonJS\n    // workspace that lacks one changes behaviour for frameworks that parse it\n    // (e.g. Next.js starts treating the app's ESM source as CJS).\n    scripts: overwriteScripts\n      ? { ...packageJson.scripts, ...CONVENIENCE_SCRIPTS }\n      : { ...CONVENIENCE_SCRIPTS, ...packageJson.scripts },\n  }));\n\n  // Pin the workspace's `nx` to the version the plugin's @nx/* packages are\n  // built against. A mismatched workspace nx (even a patch apart) hoists a\n  // second nested nx under @nx/js, and the two instances deadlock `nx sync`.\n  // `@nx/js` must be a root dependency for the `@nx/js:typescript-sync`\n  // generator registered in nx.json to resolve (npm doesn't hoist the\n  // plugin's own copy reliably).\n  const nxVersion = readModulePackageJson('@nx/js').packageJson.version;\n  addDependenciesToPackageJson(\n    tree,\n    {},\n    {\n      nx: nxVersion,\n      '@nx/js': nxVersion,\n      '@nx/workspace': nxVersion,\n      ...withVersions(['typescript', '@biomejs/biome']),\n    },\n  );\n\n  // Write biome.json for formatting and linting\n  if (!tree.exists('biome.json')) {\n    tree.write(\n      'biome.json',\n      JSON.stringify(getDefaultBiomeConfig(tree), null, 2),\n    );\n  }\n\n  generateFiles(\n    tree, // the virtual file system\n    joinPathFragments(import.meta.dirname, '..', 'preset', 'files'),\n    '.',\n    {\n      projectName: getNpmScope(tree),\n      generators: Object.entries(GeneratorsJson.generators)\n        .filter(([_, v]) => !v['hidden'])\n        .map(([k, v]) => ({ name: k, description: v.description })),\n      ...(() => {\n        const cmds = getPackageManagerDisplayCommands();\n        return {\n          pkgMgrCmd: cmds.exec,\n          buildCmd: `${cmds.run} build`,\n          lintCmd: `${cmds.run} lint`,\n        };\n      })(),\n    },\n    {\n      overwriteStrategy: readmeOverwriteStrategy,\n    },\n  );\n\n  if (mcp !== false) {\n    configureMcpServers(tree);\n  }\n};\n"],"names":["generateFiles","joinPathFragments","OverwriteStrategy","readNxJson","updateJson","updateNxJson","initGenerator","yaml","readModulePackageJson","GeneratorsJson","type","SYNC_GENERATOR_NAME","TS_SYNC_GENERATOR_NAME","BASE_TSCONFIG_COMPILER_OPTIONS","ensureAwsNxPluginConfig","updateAwsNxPluginConfig","inferContainers","addDependenciesToPackageJson","detectWorkspacePackageManager","getDefaultBiomeConfig","configureMcpServers","getNpmScope","mergeTargetDefault","getPackageManagerDisplayCommands","workspaceGlobs","withVersions","WORKSPACES","NX_TYPESCRIPT_SYNC_GENERATOR","PNPM_BUILT_DEPENDENCIES","setUpPnpmWorkspace","tree","catalogs","existing","exists","load","read","packages","Array","from","Set","allowBuilds","Object","fromEntries","map","dep","catalogMode","write","dump","onlyBuiltDependencies","quotingType","setUpWorkspaces","json","globs","workspaces","undefined","isArray","ensureBaseTsConfig","JSON","stringify","compilerOptions","customConditions","ensureRootTsConfig","extends","files","references","applyWorkspaceInit","iac","containers","mcp","readmeOverwriteStrategy","KeepExisting","overwriteScripts","resolvedContainers","provider","engine","packageManager","formatter","addTsPlugin","nxJson","analytics","targetDefaults","compile","base","syncGenerators","filter","g","includes","CONVENIENCE_SCRIPTS","dev","build","lint","test","trivy","packageJson","scripts","nxVersion","version","nx","dirname","projectName","generators","entries","_","v","k","name","description","cmds","pkgMgrCmd","exec","buildCmd","run","lintCmd","overwriteStrategy"],"mappings":"AAAA;;;CAGC,GACD,SACEA,aAAa,EACbC,iBAAiB,EACjBC,iBAAiB,EACjBC,UAAU,EAEVC,UAAU,EACVC,YAAY,QACP,aAAa;AACpB,SAASC,aAAa,QAAQ,SAAS;AAEvC,OAAOC,UAAU,UAAU;AAC3B,SAASC,qBAAqB,QAAQ,4BAA4B;AAClE,OAAOC,oBAAoB,6BAA6B;IAAEC,MAAM;AAAO,EAAE;AACzE,SAASC,uBAAuBC,sBAAsB,QAAQ,0BAAuB;AACrF,SAASC,8BAA8B,QAAQ,qBAAkB;AACjE,SACEC,uBAAuB,EACvBC,uBAAuB,QAClB,oBAAiB;AACxB,SAA0BC,eAAe,QAAQ,kBAAe;AAChE,SACEC,4BAA4B,EAC5BC,6BAA6B,QACxB,oBAAiB;AACxB,SAASC,qBAAqB,QAAQ,cAAW;AAEjD,SAASC,mBAAmB,QAAQ,WAAQ;AAC5C,SAASC,WAAW,QAAQ,iBAAc;AAC1C,SAASC,kBAAkB,QAAQ,UAAO;AAC1C,SAASC,gCAAgC,QAAQ,mBAAgB;AACjE,SAASC,cAAc,QAAQ,4BAAyB;AACxD,SAASC,YAAY,QAAQ,gBAAa;AAE1C,MAAMC,aAAa;IAAC;CAAa;AACjC,MAAMC,+BAA+B;AAErC,2EAA2E;AAC3E,4EAA4E;AAC5E,0EAA0E;AAC1E,uEAAuE;AACvE,0EAA0E;AAC1E,OAAO,MAAMC,0BAA0B;IAAC;IAAa;IAAW;IAAM;CAAQ,CAAC;AAsC/E;;;;;;;;;;CAUC,GACD,MAAMC,qBAAqB,CAACC,MAAYC;IACtC,MAAMC,WAAWF,KAAKG,MAAM,CAAC,yBACxB,AAAC1B,KAAK2B,IAAI,CAACJ,KAAKK,IAAI,CAAC,uBAAuB,YAAY,OAGnD,CAAC,IACP,CAAC;IAEL,+EAA+E;IAC/E,MAAMC,WAAWC,MAAMC,IAAI,CACzB,IAAIC,IAAI;WAAK,AAACP,SAASI,QAAQ,IAAiB,EAAE;WAAMV;KAAW;IAGrE,MAAMc,cAAc;QAClB,GAAI,OAAOR,SAASQ,WAAW,KAAK,YAAYR,SAASQ,WAAW,GAC/DR,SAASQ,WAAW,GACrB,CAAC,CAAC;QACN,kEAAkE;QAClE,4DAA4D;QAC5D,GAAGC,OAAOC,WAAW,CAACd,wBAAwBe,GAAG,CAAC,CAACC,MAAQ;gBAACA;gBAAK;aAAK,EAAE;IAC1E;IAEA,0EAA0E;IAC1E,uEAAuE;IACvE,oCAAoC;IACpC,MAAMC,cAAcd,WACfC,SAASa,WAAW,IAAI,WACzBb,SAASa,WAAW;IAExBf,KAAKgB,KAAK,CACR,uBACAvC,KAAKwC,IAAI,CACP;QACE,GAAGf,QAAQ;QACXI;QACAI;QACAQ,uBAAuBpB;QACvB,GAAIiB,cAAc;YAAEA;QAAY,IAAI,CAAC,CAAC;IACxC,GACA;QAAEI,aAAa;IAAI;AAGzB;AAEA;;;;;CAKC,GACD,MAAMC,kBAAkB,CAACpB,MAAYC;IACnC,IAAIb,8BAA8BY,UAAU,QAAQ;QAClDD,mBAAmBC,MAAMC;IAC3B,OAAO;QACL3B,WAAW0B,MAAM,gBAAgB,CAACqB;YAChC,wEAAwE;YACxE,yEAAyE;YACzE,MAAMC,QAAQf,MAAMC,IAAI,CACtB,IAAIC,IAAI;mBAAIf,eAAe2B,KAAKE,UAAU;mBAAM3B;aAAW;YAE7D,OAAO;gBACL,GAAGyB,IAAI;gBACPE,YACEF,KAAKE,UAAU,KAAKC,aAAa,CAACjB,MAAMkB,OAAO,CAACJ,KAAKE,UAAU,IAC3D;oBAAE,GAAGF,KAAKE,UAAU;oBAAEjB,UAAUgB;gBAAM,IACtCA;YACR;QACF;IACF;AACF;AAEA;;;;;;;;;;CAUC,GACD,MAAMI,qBAAqB,CAAC1B;IAC1B,IAAIA,KAAKG,MAAM,CAAC,uBAAuB;QACrC;IACF;IACAH,KAAKgB,KAAK,CACR,sBACAW,KAAKC,SAAS,CACZ;QACEC,iBAAiB;YACf,GAAG9C,8BAA8B;YACjC+C,kBAAkB;gBAACvC,YAAYS;aAAM;QACvC;IACF,GACA,MACA;AAGN;AAEA;;;;;;;CAOC,GACD,MAAM+B,qBAAqB,CAAC/B;IAC1B,IAAIA,KAAKG,MAAM,CAAC,kBAAkB;QAChC;IACF;IACAH,KAAKgB,KAAK,CACR,iBACAW,KAAKC,SAAS,CACZ;QACEI,SAAS;QACTC,OAAO,EAAE;QACTC,YAAY,EAAE;IAChB,GACA,MACA;AAGN;AAEA;;;;;;;;;;;;;;CAcC,GACD,OAAO,MAAMC,qBAAqB,OAChCnC,MACA,EACEoC,GAAG,EACHC,UAAU,EACVC,GAAG,EACHC,0BAA0BnE,kBAAkBoE,YAAY,EACxDC,mBAAmB,KAAK,EACxBxC,WAAW,IAAI,EACW;IAE5B,MAAMyC,qBACJ,CAACL,cAAcA,eAAe,UAAUnD,oBAAoBmD;IAE9D,4EAA4E;IAC5E,4CAA4C;IAC5C,MAAMrD,wBAAwBgB;IAC9B,MAAMf,wBAAwBe,MAAM;QAClCoC,KAAK;YAAEO,UAAUP;QAAI;QACrBC,YAAY;YAAEO,QAAQF;QAAmB;QACzCG,gBAAgB;YAAE5C;QAAS;IAC7B;IAEA,uEAAuE;IACvE,qEAAqE;IACrE,uEAAuE;IACvE,MAAMzB,cAAcwB,MAAM;QACxB8C,WAAW;QACXC,aAAa;IACf;IAEArB,mBAAmB1B;IACnB+B,mBAAmB/B;IAEnBoB,gBAAgBpB,MAAMC;IAEtB,MAAM+C,SAAS3E,WAAW2B;IAC1BzB,aAAayB,MAAM;QACjB,GAAGgD,MAAM;QACT,kEAAkE;QAClEC,WAAW,AAACD,OAAmCC,SAAS,IAAI;QAC5DC,gBAAgB;YACd,GAAGF,OAAOE,cAAc;YACxBC,SAAS3D,mBAAmBwD,OAAOE,cAAc,EAAEC,SAAS,CAACC,OAAU,CAAA;oBACrE,GAAGA,IAAI;oBACPC,gBAAgB;2BACX,AAACD,CAAAA,KAAKC,cAAc,IAAI,EAAE,AAAD,EAAGC,MAAM,CACnC,CAACC,IACC,CAAC;gCAACzE;gCAAwBe;6BAA6B,CAAC2D,QAAQ,CAC9DD;wBAGN1D;wBACAf;qBACD;gBACH,CAAA;QACF;IACF;IAEA,MAAM2E,sBAAsB;QAC1BC,KAAK;QACLC,OAAO;QACPC,MAAM;QACNC,MAAM;QACN,oEAAoE;QACpE,2EAA2E;QAC3E,cAAc;QACdC,OAAO;QACP,mBAAmB;QACnB,aAAa;QACb,gBAAgB;IAClB;IACAxF,WAAW0B,MAAM,gBAAgB,CAAC+D,cAAiB,CAAA;YACjD,GAAGA,WAAW;YACd,wEAAwE;YACxE,yEAAyE;YACzE,wEAAwE;YACxE,oEAAoE;YACpE,0EAA0E;YAC1E,8DAA8D;YAC9DC,SAASvB,mBACL;gBAAE,GAAGsB,YAAYC,OAAO;gBAAE,GAAGP,mBAAmB;YAAC,IACjD;gBAAE,GAAGA,mBAAmB;gBAAE,GAAGM,YAAYC,OAAO;YAAC;QACvD,CAAA;IAEA,0EAA0E;IAC1E,yEAAyE;IACzE,2EAA2E;IAC3E,sEAAsE;IACtE,oEAAoE;IACpE,+BAA+B;IAC/B,MAAMC,YAAYvF,sBAAsB,UAAUqF,WAAW,CAACG,OAAO;IACrE/E,6BACEa,MACA,CAAC,GACD;QACEmE,IAAIF;QACJ,UAAUA;QACV,iBAAiBA;QACjB,GAAGtE,aAAa;YAAC;YAAc;SAAiB,CAAC;IACnD;IAGF,8CAA8C;IAC9C,IAAI,CAACK,KAAKG,MAAM,CAAC,eAAe;QAC9BH,KAAKgB,KAAK,CACR,cACAW,KAAKC,SAAS,CAACvC,sBAAsBW,OAAO,MAAM;IAEtD;IAEA9B,cACE8B,MACA7B,kBAAkB,YAAYiG,OAAO,EAAE,MAAM,UAAU,UACvD,KACA;QACEC,aAAa9E,YAAYS;QACzBsE,YAAY3D,OAAO4D,OAAO,CAAC5F,eAAe2F,UAAU,EACjDhB,MAAM,CAAC,CAAC,CAACkB,GAAGC,EAAE,GAAK,CAACA,CAAC,CAAC,SAAS,EAC/B5D,GAAG,CAAC,CAAC,CAAC6D,GAAGD,EAAE,GAAM,CAAA;gBAAEE,MAAMD;gBAAGE,aAAaH,EAAEG,WAAW;YAAC,CAAA;QAC1D,GAAG,AAAC,CAAA;YACF,MAAMC,OAAOpF;YACb,OAAO;gBACLqF,WAAWD,KAAKE,IAAI;gBACpBC,UAAU,GAAGH,KAAKI,GAAG,CAAC,MAAM,CAAC;gBAC7BC,SAAS,GAAGL,KAAKI,GAAG,CAAC,KAAK,CAAC;YAC7B;QACF,CAAA,GAAI;IACN,GACA;QACEE,mBAAmB5C;IACrB;IAGF,IAAID,QAAQ,OAAO;QACjBhD,oBAAoBU;IACtB;AACF,EAAE"}

package/src/utils/install.js

@@ -46,7 +46,9 @@ import { Logger, UVProvider } from "./nxlv-python.js";
         return;
     }
     if (languages.includes('typescript')) {
-        installPackagesTask(tree);
+        // Force the install: devkit's default only installs when the root
+        // package.json changed, but deps land in per-project manifests.
+        installPackagesTask(tree, true);
     }
     if (languages.includes('python')) {
         await new UVProvider(tree.root, new Logger(), tree).install();

package/src/utils/install.js.map

@@ -1 +1 @@
-{"version":3,"sources":["../../../../../packages/nx-plugin/src/utils/install.ts"],"sourcesContent":["/**\n * Copyright Amazon.com, Inc. or its affiliates. All Rights Reserved.\n * SPDX-License-Identifier: Apache-2.0\n */\nimport { existsSync } from 'node:fs';\nimport { join } from 'node:path';\nimport { installPackagesTask, type Tree } from '@nx/devkit';\nimport { Logger, UVProvider } from './nxlv-python';\nimport type { ITsDepVersion } from './versions';\n\n/**\n * Languages whose dependencies a generator may install.\n */\nexport type InstallLanguage = 'typescript' | 'python';\n\nexport interface InstallDependenciesOptions {\n  /** Languages to install dependencies for. */\n  languages: InstallLanguage[];\n  /**\n   * Packages that must resolve from the workspace after this generator, because\n   * a config file it writes (e.g. `vite.config.mts`) imports them and Nx loads\n   * that config when computing the project graph. When the caller prefers to\n   * defer installing, we honour that only if these already resolve.\n   *\n   * The per-language graph deps in `LANGUAGE_GRAPH_DEPS` are always included, so\n   * callers only list packages beyond those.\n   */\n  ensureResolvable?: ITsDepVersion[];\n}\n\n/**\n * Packages each language always needs resolvable for Nx to compute the project\n * graph, so a deferred install still runs whenever it would otherwise break.\n */\nconst LANGUAGE_GRAPH_DEPS: Record<InstallLanguage, string[]> = {\n  typescript: ['vitest'], // every TypeScript project has a `vitest.config.mts`\n  python: ['@nxlv/python'], // every Python project registers this inference plugin\n};\n\n/**\n * Returns true if every package is linked at `<root>/node_modules/<pkg>`.\n *\n * This is the condition Nx's inferred plugins need when they load a generated\n * config (e.g. `vite.config.mts`) during graph computation: the config's\n * imports resolve from inside the workspace's own `node_modules`. We avoid\n * `require.resolve`, which can succeed via an ancestor `node_modules` even when\n * the package isn't linked here. `existsSync` follows symlinks, so pnpm's store\n * links resolve, and Nx always uses a `node_modules` linker (never PnP).\n */\nconst allResolvable = (root: string, packages: string[]): boolean =>\n  packages.every((pkg) => existsSync(join(root, 'node_modules', pkg)));\n\n/**\n * Installs dependencies for the given languages.\n *\n * Call from a generator's returned callback:\n * `return () => installDependencies(tree, options.preferInstallDependencies, { ... })`.\n *\n * `preferInstallDependencies` is a preference: when `false` the install is\n * deferred so a batch installs once at the end — unless an `ensureResolvable`\n * package is missing, in which case it runs anyway so the next `nx` command can\n * still compute the project graph.\n */\nexport const installDependencies = async (\n  tree: Tree,\n  preferInstallDependencies: boolean | undefined,\n  options: InstallDependenciesOptions,\n): Promise<void> => {\n  const { languages, ensureResolvable = [] } = options;\n  const mustResolve = [\n    ...ensureResolvable,\n    ...languages.flatMap((language) => LANGUAGE_GRAPH_DEPS[language]),\n  ];\n  if (\n    preferInstallDependencies === false &&\n    allResolvable(tree.root, mustResolve)\n  ) {\n    return;\n  }\n  if (languages.includes('typescript')) {\n    installPackagesTask(tree);\n  }\n  if (languages.includes('python')) {\n    await new UVProvider(tree.root, new Logger(), tree).install();\n  }\n};\n"],"names":["existsSync","join","installPackagesTask","Logger","UVProvider","LANGUAGE_GRAPH_DEPS","typescript","python","allResolvable","root","packages","every","pkg","installDependencies","tree","preferInstallDependencies","options","languages","ensureResolvable","mustResolve","flatMap","language","includes","install"],"mappings":"AAAA;;;CAGC,GACD,SAASA,UAAU,QAAQ,UAAU;AACrC,SAASC,IAAI,QAAQ,YAAY;AACjC,SAASC,mBAAmB,QAAmB,aAAa;AAC5D,SAASC,MAAM,EAAEC,UAAU,QAAQ,mBAAgB;AAuBnD;;;CAGC,GACD,MAAMC,sBAAyD;IAC7DC,YAAY;QAAC;KAAS;IACtBC,QAAQ;QAAC;KAAe;AAC1B;AAEA;;;;;;;;;CASC,GACD,MAAMC,gBAAgB,CAACC,MAAcC,WACnCA,SAASC,KAAK,CAAC,CAACC,MAAQZ,WAAWC,KAAKQ,MAAM,gBAAgBG;AAEhE;;;;;;;;;;CAUC,GACD,OAAO,MAAMC,sBAAsB,OACjCC,MACAC,2BACAC;IAEA,MAAM,EAAEC,SAAS,EAAEC,mBAAmB,EAAE,EAAE,GAAGF;IAC7C,MAAMG,cAAc;WACfD;WACAD,UAAUG,OAAO,CAAC,CAACC,WAAahB,mBAAmB,CAACgB,SAAS;KACjE;IACD,IACEN,8BAA8B,SAC9BP,cAAcM,KAAKL,IAAI,EAAEU,cACzB;QACA;IACF;IACA,IAAIF,UAAUK,QAAQ,CAAC,eAAe;QACpCpB,oBAAoBY;IACtB;IACA,IAAIG,UAAUK,QAAQ,CAAC,WAAW;QAChC,MAAM,IAAIlB,WAAWU,KAAKL,IAAI,EAAE,IAAIN,UAAUW,MAAMS,OAAO;IAC7D;AACF,EAAE"}
+{"version":3,"sources":["../../../../../packages/nx-plugin/src/utils/install.ts"],"sourcesContent":["/**\n * Copyright Amazon.com, Inc. or its affiliates. All Rights Reserved.\n * SPDX-License-Identifier: Apache-2.0\n */\nimport { existsSync } from 'node:fs';\nimport { join } from 'node:path';\nimport { installPackagesTask, type Tree } from '@nx/devkit';\nimport { Logger, UVProvider } from './nxlv-python';\nimport type { ITsDepVersion } from './versions';\n\n/**\n * Languages whose dependencies a generator may install.\n */\nexport type InstallLanguage = 'typescript' | 'python';\n\nexport interface InstallDependenciesOptions {\n  /** Languages to install dependencies for. */\n  languages: InstallLanguage[];\n  /**\n   * Packages that must resolve from the workspace after this generator, because\n   * a config file it writes (e.g. `vite.config.mts`) imports them and Nx loads\n   * that config when computing the project graph. When the caller prefers to\n   * defer installing, we honour that only if these already resolve.\n   *\n   * The per-language graph deps in `LANGUAGE_GRAPH_DEPS` are always included, so\n   * callers only list packages beyond those.\n   */\n  ensureResolvable?: ITsDepVersion[];\n}\n\n/**\n * Packages each language always needs resolvable for Nx to compute the project\n * graph, so a deferred install still runs whenever it would otherwise break.\n */\nconst LANGUAGE_GRAPH_DEPS: Record<InstallLanguage, string[]> = {\n  typescript: ['vitest'], // every TypeScript project has a `vitest.config.mts`\n  python: ['@nxlv/python'], // every Python project registers this inference plugin\n};\n\n/**\n * Returns true if every package is linked at `<root>/node_modules/<pkg>`.\n *\n * This is the condition Nx's inferred plugins need when they load a generated\n * config (e.g. `vite.config.mts`) during graph computation: the config's\n * imports resolve from inside the workspace's own `node_modules`. We avoid\n * `require.resolve`, which can succeed via an ancestor `node_modules` even when\n * the package isn't linked here. `existsSync` follows symlinks, so pnpm's store\n * links resolve, and Nx always uses a `node_modules` linker (never PnP).\n */\nconst allResolvable = (root: string, packages: string[]): boolean =>\n  packages.every((pkg) => existsSync(join(root, 'node_modules', pkg)));\n\n/**\n * Installs dependencies for the given languages.\n *\n * Call from a generator's returned callback:\n * `return () => installDependencies(tree, options.preferInstallDependencies, { ... })`.\n *\n * `preferInstallDependencies` is a preference: when `false` the install is\n * deferred so a batch installs once at the end — unless an `ensureResolvable`\n * package is missing, in which case it runs anyway so the next `nx` command can\n * still compute the project graph.\n */\nexport const installDependencies = async (\n  tree: Tree,\n  preferInstallDependencies: boolean | undefined,\n  options: InstallDependenciesOptions,\n): Promise<void> => {\n  const { languages, ensureResolvable = [] } = options;\n  const mustResolve = [\n    ...ensureResolvable,\n    ...languages.flatMap((language) => LANGUAGE_GRAPH_DEPS[language]),\n  ];\n  if (\n    preferInstallDependencies === false &&\n    allResolvable(tree.root, mustResolve)\n  ) {\n    return;\n  }\n  if (languages.includes('typescript')) {\n    // Force the install: devkit's default only installs when the root\n    // package.json changed, but deps land in per-project manifests.\n    installPackagesTask(tree, true);\n  }\n  if (languages.includes('python')) {\n    await new UVProvider(tree.root, new Logger(), tree).install();\n  }\n};\n"],"names":["existsSync","join","installPackagesTask","Logger","UVProvider","LANGUAGE_GRAPH_DEPS","typescript","python","allResolvable","root","packages","every","pkg","installDependencies","tree","preferInstallDependencies","options","languages","ensureResolvable","mustResolve","flatMap","language","includes","install"],"mappings":"AAAA;;;CAGC,GACD,SAASA,UAAU,QAAQ,UAAU;AACrC,SAASC,IAAI,QAAQ,YAAY;AACjC,SAASC,mBAAmB,QAAmB,aAAa;AAC5D,SAASC,MAAM,EAAEC,UAAU,QAAQ,mBAAgB;AAuBnD;;;CAGC,GACD,MAAMC,sBAAyD;IAC7DC,YAAY;QAAC;KAAS;IACtBC,QAAQ;QAAC;KAAe;AAC1B;AAEA;;;;;;;;;CASC,GACD,MAAMC,gBAAgB,CAACC,MAAcC,WACnCA,SAASC,KAAK,CAAC,CAACC,MAAQZ,WAAWC,KAAKQ,MAAM,gBAAgBG;AAEhE;;;;;;;;;;CAUC,GACD,OAAO,MAAMC,sBAAsB,OACjCC,MACAC,2BACAC;IAEA,MAAM,EAAEC,SAAS,EAAEC,mBAAmB,EAAE,EAAE,GAAGF;IAC7C,MAAMG,cAAc;WACfD;WACAD,UAAUG,OAAO,CAAC,CAACC,WAAahB,mBAAmB,CAACgB,SAAS;KACjE;IACD,IACEN,8BAA8B,SAC9BP,cAAcM,KAAKL,IAAI,EAAEU,cACzB;QACA;IACF;IACA,IAAIF,UAAUK,QAAQ,CAAC,eAAe;QACpC,kEAAkE;QAClE,gEAAgE;QAChEpB,oBAAoBY,MAAM;IAC5B;IACA,IAAIG,UAAUK,QAAQ,CAAC,WAAW;QAChC,MAAM,IAAIlB,WAAWU,KAAKL,IAAI,EAAE,IAAIN,UAAUW,MAAMS,OAAO;IAC7D;AACF,EAAE"}

package/src/utils/module-format.d.ts

@@ -8,14 +8,11 @@ import { type Tree } from '@nx/devkit';
  */
 export type ModuleFormat = 'esm' | 'cjs';
 /**
- * Whether the workspace is configured for ES modules, inferred from the root
- * package.json. The module format is a workspace-wide property established when
- * the workspace is created, so shared infrastructure/construct helpers can read
- * it from the tree rather than having it threaded through every call site.
- *
- * ESM requires an explicit `type: "module"`, matching Node: an absent `type` (or
- * `type: "commonjs"`) means CommonJS. A workspace with no root package.json
- * defaults to ESM.
+ * Whether the workspace targets ES modules, read from the tree so shared
+ * helpers needn't thread it through call sites. An explicit root `type` wins
+ * (`module`/`commonjs`); when absent (e.g. an adopted Nx workspace) infer ESM
+ * from any sibling project declaring `type: "module"`, else CJS. No root
+ * package.json defaults to ESM.
  */
 export declare const isEsmWorkspace: (tree: Tree) => boolean;
 /**

package/src/utils/module-format.js

@@ -1,21 +1,38 @@
 /**
  * Copyright Amazon.com, Inc. or its affiliates. All Rights Reserved.
  * SPDX-License-Identifier: Apache-2.0
- */ import { readJson } from "@nx/devkit";
+ */ import { getProjects, joinPathFragments, readJson } from "@nx/devkit";
 /**
- * Whether the workspace is configured for ES modules, inferred from the root
- * package.json. The module format is a workspace-wide property established when
- * the workspace is created, so shared infrastructure/construct helpers can read
- * it from the tree rather than having it threaded through every call site.
- *
- * ESM requires an explicit `type: "module"`, matching Node: an absent `type` (or
- * `type: "commonjs"`) means CommonJS. A workspace with no root package.json
- * defaults to ESM.
+ * Whether the workspace targets ES modules, read from the tree so shared
+ * helpers needn't thread it through call sites. An explicit root `type` wins
+ * (`module`/`commonjs`); when absent (e.g. an adopted Nx workspace) infer ESM
+ * from any sibling project declaring `type: "module"`, else CJS. No root
+ * package.json defaults to ESM.
  */ export const isEsmWorkspace = (tree)=>{
-    if (tree.exists('package.json')) {
-        return readJson(tree, 'package.json').type === 'module';
+    if (!tree.exists('package.json')) {
+        return true;
     }
-    return true;
+    const rootType = readJson(tree, 'package.json').type;
+    if (rootType === 'module') {
+        return true;
+    }
+    if (rootType === 'commonjs') {
+        return false;
+    }
+    // Root `type` is absent: infer from sibling projects' own manifests.
+    return hasEsmProject(tree);
+};
+/** Whether any non-root project declares `type: "module"` in its own manifest. */ const hasEsmProject = (tree)=>{
+    for (const project of getProjects(tree).values()){
+        if (project.root === '.' || project.root === '') {
+            continue;
+        }
+        const packageJsonPath = joinPathFragments(project.root, 'package.json');
+        if (tree.exists(packageJsonPath) && readJson(tree, packageJsonPath).type === 'module') {
+            return true;
+        }
+    }
+    return false;
 };
 /**
  * Returns the `esm` template variable for `generateFiles` substitutions,

package/src/utils/module-format.js.map

@@ -1 +1 @@
-{"version":3,"sources":["../../../../../packages/nx-plugin/src/utils/module-format.ts"],"sourcesContent":["/**\n * Copyright Amazon.com, Inc. or its affiliates. All Rights Reserved.\n * SPDX-License-Identifier: Apache-2.0\n */\nimport { readJson, type Tree } from '@nx/devkit';\n\n/**\n * The module format for generated TypeScript code and configuration.\n */\nexport type ModuleFormat = 'esm' | 'cjs';\n\n/**\n * Whether the workspace is configured for ES modules, inferred from the root\n * package.json. The module format is a workspace-wide property established when\n * the workspace is created, so shared infrastructure/construct helpers can read\n * it from the tree rather than having it threaded through every call site.\n *\n * ESM requires an explicit `type: \"module\"`, matching Node: an absent `type` (or\n * `type: \"commonjs\"`) means CommonJS. A workspace with no root package.json\n * defaults to ESM.\n */\nexport const isEsmWorkspace = (tree: Tree): boolean => {\n  if (tree.exists('package.json')) {\n    return readJson(tree, 'package.json').type === 'module';\n  }\n  return true;\n};\n\n/**\n * Returns the `esm` template variable for `generateFiles` substitutions,\n * inferred from the workspace root package.json. Spread into the substitution\n * object wherever a template contains `<% if (esm) { %>` conditionals.\n */\nexport const esmVars = (tree: Tree): { esm: boolean } => ({\n  esm: isEsmWorkspace(tree),\n});\n"],"names":["readJson","isEsmWorkspace","tree","exists","type","esmVars","esm"],"mappings":"AAAA;;;CAGC,GACD,SAASA,QAAQ,QAAmB,aAAa;AAOjD;;;;;;;;;CASC,GACD,OAAO,MAAMC,iBAAiB,CAACC;IAC7B,IAAIA,KAAKC,MAAM,CAAC,iBAAiB;QAC/B,OAAOH,SAASE,MAAM,gBAAgBE,IAAI,KAAK;IACjD;IACA,OAAO;AACT,EAAE;AAEF;;;;CAIC,GACD,OAAO,MAAMC,UAAU,CAACH,OAAkC,CAAA;QACxDI,KAAKL,eAAeC;IACtB,CAAA,EAAG"}
+{"version":3,"sources":["../../../../../packages/nx-plugin/src/utils/module-format.ts"],"sourcesContent":["/**\n * Copyright Amazon.com, Inc. or its affiliates. All Rights Reserved.\n * SPDX-License-Identifier: Apache-2.0\n */\nimport {\n  getProjects,\n  joinPathFragments,\n  readJson,\n  type Tree,\n} from '@nx/devkit';\n\n/**\n * The module format for generated TypeScript code and configuration.\n */\nexport type ModuleFormat = 'esm' | 'cjs';\n\n/**\n * Whether the workspace targets ES modules, read from the tree so shared\n * helpers needn't thread it through call sites. An explicit root `type` wins\n * (`module`/`commonjs`); when absent (e.g. an adopted Nx workspace) infer ESM\n * from any sibling project declaring `type: \"module\"`, else CJS. No root\n * package.json defaults to ESM.\n */\nexport const isEsmWorkspace = (tree: Tree): boolean => {\n  if (!tree.exists('package.json')) {\n    return true;\n  }\n  const rootType = readJson(tree, 'package.json').type;\n  if (rootType === 'module') {\n    return true;\n  }\n  if (rootType === 'commonjs') {\n    return false;\n  }\n  // Root `type` is absent: infer from sibling projects' own manifests.\n  return hasEsmProject(tree);\n};\n\n/** Whether any non-root project declares `type: \"module\"` in its own manifest. */\nconst hasEsmProject = (tree: Tree): boolean => {\n  for (const project of getProjects(tree).values()) {\n    if (project.root === '.' || project.root === '') {\n      continue;\n    }\n    const packageJsonPath = joinPathFragments(project.root, 'package.json');\n    if (\n      tree.exists(packageJsonPath) &&\n      readJson(tree, packageJsonPath).type === 'module'\n    ) {\n      return true;\n    }\n  }\n  return false;\n};\n\n/**\n * Returns the `esm` template variable for `generateFiles` substitutions,\n * inferred from the workspace root package.json. Spread into the substitution\n * object wherever a template contains `<% if (esm) { %>` conditionals.\n */\nexport const esmVars = (tree: Tree): { esm: boolean } => ({\n  esm: isEsmWorkspace(tree),\n});\n"],"names":["getProjects","joinPathFragments","readJson","isEsmWorkspace","tree","exists","rootType","type","hasEsmProject","project","values","root","packageJsonPath","esmVars","esm"],"mappings":"AAAA;;;CAGC,GACD,SACEA,WAAW,EACXC,iBAAiB,EACjBC,QAAQ,QAEH,aAAa;AAOpB;;;;;;CAMC,GACD,OAAO,MAAMC,iBAAiB,CAACC;IAC7B,IAAI,CAACA,KAAKC,MAAM,CAAC,iBAAiB;QAChC,OAAO;IACT;IACA,MAAMC,WAAWJ,SAASE,MAAM,gBAAgBG,IAAI;IACpD,IAAID,aAAa,UAAU;QACzB,OAAO;IACT;IACA,IAAIA,aAAa,YAAY;QAC3B,OAAO;IACT;IACA,qEAAqE;IACrE,OAAOE,cAAcJ;AACvB,EAAE;AAEF,gFAAgF,GAChF,MAAMI,gBAAgB,CAACJ;IACrB,KAAK,MAAMK,WAAWT,YAAYI,MAAMM,MAAM,GAAI;QAChD,IAAID,QAAQE,IAAI,KAAK,OAAOF,QAAQE,IAAI,KAAK,IAAI;YAC/C;QACF;QACA,MAAMC,kBAAkBX,kBAAkBQ,QAAQE,IAAI,EAAE;QACxD,IACEP,KAAKC,MAAM,CAACO,oBACZV,SAASE,MAAMQ,iBAAiBL,IAAI,KAAK,UACzC;YACA,OAAO;QACT;IACF;IACA,OAAO;AACT;AAEA;;;;CAIC,GACD,OAAO,MAAMM,UAAU,CAACT,OAAkC,CAAA;QACxDU,KAAKX,eAAeC;IACtB,CAAA,EAAG"}

package/src/utils/npm-scope.d.ts

@@ -5,7 +5,3 @@
 import { type Tree } from '@nx/devkit';
 export declare function getNpmScope(tree: Tree): string | undefined;
 export declare function getNpmScopePrefix(tree: Tree): string | undefined;
-/**
- * Returns a safe import alias for local packages to avoid the potential for sniping attacks
- */
-export declare function toScopeAlias(npmScopeOrPackageName: string): string;

package/src/utils/npm-scope.js

@@ -12,10 +12,5 @@ export function getNpmScopePrefix(tree) {
     const npmScope = getNpmScope(tree);
     return `@${npmScope}/`;
 }
-/**
- * Returns a safe import alias for local packages to avoid the potential for sniping attacks
- */ export function toScopeAlias(npmScopeOrPackageName) {
-    return npmScopeOrPackageName.startsWith('@') ? `:${npmScopeOrPackageName.slice(1)}` : npmScopeOrPackageName;
-}
 
 //# sourceMappingURL=npm-scope.js.map

package/src/utils/npm-scope.js.map

@@ -1 +1 @@
-{"version":3,"sources":["../../../../../packages/nx-plugin/src/utils/npm-scope.ts"],"sourcesContent":["/**\n * Copyright Amazon.com, Inc. or its affiliates. All Rights Reserved.\n * SPDX-License-Identifier: Apache-2.0\n */\nimport { readJson, type Tree } from '@nx/devkit';\nexport function getNpmScope(tree: Tree): string | undefined {\n  const { name } = tree.exists('package.json')\n    ? readJson<{\n        name?: string;\n      }>(tree, 'package.json')\n    : { name: null };\n  return name?.startsWith('@') ? name.split('/')[0].substring(1) : 'monorepo';\n}\nexport function getNpmScopePrefix(tree: Tree): string | undefined {\n  const npmScope = getNpmScope(tree);\n  return `@${npmScope}/`;\n}\n/**\n * Returns a safe import alias for local packages to avoid the potential for sniping attacks\n */\nexport function toScopeAlias(npmScopeOrPackageName: string): string {\n  return npmScopeOrPackageName.startsWith('@')\n    ? `:${npmScopeOrPackageName.slice(1)}`\n    : npmScopeOrPackageName;\n}\n"],"names":["readJson","getNpmScope","tree","name","exists","startsWith","split","substring","getNpmScopePrefix","npmScope","toScopeAlias","npmScopeOrPackageName","slice"],"mappings":"AAAA;;;CAGC,GACD,SAASA,QAAQ,QAAmB,aAAa;AACjD,OAAO,SAASC,YAAYC,IAAU;IACpC,MAAM,EAAEC,IAAI,EAAE,GAAGD,KAAKE,MAAM,CAAC,kBACzBJ,SAEGE,MAAM,kBACT;QAAEC,MAAM;IAAK;IACjB,OAAOA,MAAME,WAAW,OAAOF,KAAKG,KAAK,CAAC,IAAI,CAAC,EAAE,CAACC,SAAS,CAAC,KAAK;AACnE;AACA,OAAO,SAASC,kBAAkBN,IAAU;IAC1C,MAAMO,WAAWR,YAAYC;IAC7B,OAAO,CAAC,CAAC,EAAEO,SAAS,CAAC,CAAC;AACxB;AACA;;CAEC,GACD,OAAO,SAASC,aAAaC,qBAA6B;IACxD,OAAOA,sBAAsBN,UAAU,CAAC,OACpC,CAAC,CAAC,EAAEM,sBAAsBC,KAAK,CAAC,IAAI,GACpCD;AACN"}
+{"version":3,"sources":["../../../../../packages/nx-plugin/src/utils/npm-scope.ts"],"sourcesContent":["/**\n * Copyright Amazon.com, Inc. or its affiliates. All Rights Reserved.\n * SPDX-License-Identifier: Apache-2.0\n */\nimport { readJson, type Tree } from '@nx/devkit';\nexport function getNpmScope(tree: Tree): string | undefined {\n  const { name } = tree.exists('package.json')\n    ? readJson<{\n        name?: string;\n      }>(tree, 'package.json')\n    : { name: null };\n  return name?.startsWith('@') ? name.split('/')[0].substring(1) : 'monorepo';\n}\nexport function getNpmScopePrefix(tree: Tree): string | undefined {\n  const npmScope = getNpmScope(tree);\n  return `@${npmScope}/`;\n}\n"],"names":["readJson","getNpmScope","tree","name","exists","startsWith","split","substring","getNpmScopePrefix","npmScope"],"mappings":"AAAA;;;CAGC,GACD,SAASA,QAAQ,QAAmB,aAAa;AACjD,OAAO,SAASC,YAAYC,IAAU;IACpC,MAAM,EAAEC,IAAI,EAAE,GAAGD,KAAKE,MAAM,CAAC,kBACzBJ,SAEGE,MAAM,kBACT;QAAEC,MAAM;IAAK;IACjB,OAAOA,MAAME,WAAW,OAAOF,KAAKG,KAAK,CAAC,IAAI,CAAC,EAAE,CAACC,SAAS,CAAC,KAAK;AACnE;AACA,OAAO,SAASC,kBAAkBN,IAAU;IAC1C,MAAMO,WAAWR,YAAYC;IAC7B,OAAO,CAAC,CAAC,EAAEO,SAAS,CAAC,CAAC;AACxB"}

package/src/utils/pnpm-workspace.d.ts

@@ -2,7 +2,7 @@
  * Copyright Amazon.com, Inc. or its affiliates. All Rights Reserved.
  * SPDX-License-Identifier: Apache-2.0
  */
-import { type Tree } from '@nx/devkit';
+import type { Tree } from '@nx/devkit';
 /**
  * Merge `allowBuilds` (pnpm 11) / `onlyBuiltDependencies` (pnpm 10) entries
  * into the generated workspace's `pnpm-workspace.yaml`. No-op for non-pnpm
@@ -20,14 +20,3 @@ import { type Tree } from '@nx/devkit';
  * allowlist has no equivalent of the `false` decision).
  */
 export declare const registerPnpmBuiltDependencies: (tree: Tree, entries: Record<string, boolean>) => void;
-/**
- * Set `ignoreWorkspaceRootCheck: true` in `pnpm-workspace.yaml` so `pnpm add`
- * from the workspace root does not error with `ERR_PNPM_ADDING_TO_ROOT`.
- *
- * pnpm 11 no longer honours `ignore-workspace-root-check=true` in `.npmrc`;
- * it must live in `pnpm-workspace.yaml` as the camelCased key. pnpm 10 also
- * accepts the yaml form, so writing it here works for both majors.
- *
- * No-op for non-pnpm workspaces or when `pnpm-workspace.yaml` is absent.
- */
-export declare const ensurePnpmIgnoresWorkspaceRootCheck: (tree: Tree) => boolean;