@aws/nx-plugin 1.0.0-rc.47 → 1.0.0-rc.48

package/src/utils/init.js.map

@@ -1 +1 @@
-{"version":3,"sources":["../../../../../packages/nx-plugin/src/utils/init.ts"],"sourcesContent":["/**\n * Copyright Amazon.com, Inc. or its affiliates. All Rights Reserved.\n * SPDX-License-Identifier: Apache-2.0\n */\nimport {\n  generateFiles,\n  joinPathFragments,\n  OverwriteStrategy,\n  readNxJson,\n  type Tree,\n  updateJson,\n  updateNxJson,\n} from '@nx/devkit';\nimport { initGenerator } from '@nx/js';\nimport { readFileSync } from 'fs';\nimport yaml from 'js-yaml';\nimport { readModulePackageJson } from 'nx/src/utils/package-json';\nimport GeneratorsJson from '../../generators.json' with { type: 'json' };\nimport { SYNC_GENERATOR_NAME as TS_SYNC_GENERATOR_NAME } from '../ts/sync/generator';\nimport { BASE_TSCONFIG_COMPILER_OPTIONS } from './base-tsconfig';\nimport {\n  ensureAwsNxPluginConfig,\n  updateAwsNxPluginConfig,\n} from './config/utils';\nimport { type Containers, inferContainers } from './containers';\nimport {\n  addDependenciesToPackageJson,\n  detectWorkspacePackageManager,\n} from './dependencies';\nimport { getDefaultBiomeConfig } from './format';\nimport type { Iac } from './iac';\nimport { configureMcpServers } from './mcp';\nimport { getNpmScope } from './npm-scope';\nimport { mergeTargetDefault } from './nx';\nimport { getPackageManagerDisplayCommands } from './pkg-manager';\nimport { workspaceGlobs } from './project-package-json';\nimport { withVersions } from './versions';\n\nconst WORKSPACES = ['packages/*'];\nconst NX_TYPESCRIPT_SYNC_GENERATOR = '@nx/js:typescript-sync';\n\n// Built dependencies whose install scripts the generated workspace trusts.\n// `onlyBuiltDependencies` is the pnpm 10 key (silently ignored by pnpm 11);\n// pnpm 11 reads `allowBuilds` instead. Any dep NOT in this allowlist will\n// have its install scripts skipped with a warning — matching pnpm 10's\n// default behaviour. The user can opt-in later via `pnpm approve-builds`.\nexport const PNPM_BUILT_DEPENDENCIES = ['@swc/core', 'esbuild', 'nx', 'sharp'];\n\n/**\n * Options controlling how the workspace is initialised. These mirror the\n * preset schema so a workspace created via the preset and one initialised via\n * the `init` generator end up in the same shape.\n */\nexport interface ApplyWorkspaceInitOptions {\n  /** The IaC provider to record in the plugin config. */\n  readonly iac: Iac;\n  /**\n   * The container engine to record. `undefined`/`'infer'` picks docker when\n   * installed, else finch.\n   */\n  readonly containers?: Containers | 'infer';\n  /** Whether to configure MCP servers for coding agents. Defaults to true. */\n  readonly mcp?: boolean;\n  /**\n   * How to treat the generated workspace README. The preset owns the README of\n   * a greenfield workspace (`Overwrite`); the `init` generator must not clobber\n   * an existing workspace's README (`KeepExisting`, the default).\n   */\n  readonly readmeOverwriteStrategy?: OverwriteStrategy;\n  /**\n   * Whether to overwrite root package.json scripts that already exist. The\n   * preset owns a greenfield workspace's scripts (`true`); the `init`\n   * generator must not clobber an existing workspace's scripts (`false`,\n   * the default) — it only adds the convenience scripts that are absent.\n   */\n  readonly overwriteScripts?: boolean;\n  /**\n   * Whether generators use the package manager's dependency catalog. On pnpm\n   * this also sets `catalogMode: strict` so `pnpm add` records new deps in the\n   * catalog. Defaults to true.\n   */\n  readonly catalogs?: boolean;\n}\n\n/**\n * Add or repair the pnpm `allowBuilds` / `onlyBuiltDependencies` allowlist for\n * the workspace's `packages` globs, without clobbering any packages the user\n * has already declared.\n *\n * A workspace not created by the preset commonly has either no\n * `pnpm-workspace.yaml`, one missing the `packages` globs, or one carrying the\n * broken `set this to true or false` placeholder pnpm writes when it skips a\n * build script. This makes the file self-consistent so the first generator's\n * install doesn't fail with `ERR_PNPM_IGNORED_BUILDS`.\n */\nconst setUpPnpmWorkspace = (tree: Tree, catalogs: boolean) => {\n  const existing = tree.exists('pnpm-workspace.yaml')\n    ? ((yaml.load(tree.read('pnpm-workspace.yaml', 'utf-8') ?? '') as Record<\n        string,\n        unknown\n      >) ?? {})\n    : {};\n\n  // Preserve any packages globs the user already has, ensuring ours are present.\n  const packages = Array.from(\n    new Set([...((existing.packages as string[]) ?? []), ...WORKSPACES]),\n  );\n\n  const allowBuilds = {\n    ...(typeof existing.allowBuilds === 'object' && existing.allowBuilds\n      ? (existing.allowBuilds as Record<string, unknown>)\n      : {}),\n    // Overwrite any non-boolean (e.g. the \"set this to true or false\"\n    // placeholder) with an explicit true for the deps we trust.\n    ...Object.fromEntries(PNPM_BUILT_DEPENDENCIES.map((dep) => [dep, true])),\n  };\n\n  // `strict` makes `pnpm add` record new deps in the catalog; it only gates\n  // that flow, so pre-declared direct ranges (e.g. tslib) still install.\n  // Preserve an explicit user choice.\n  const catalogMode = catalogs\n    ? (existing.catalogMode ?? 'strict')\n    : existing.catalogMode;\n\n  tree.write(\n    'pnpm-workspace.yaml',\n    yaml.dump(\n      {\n        ...existing,\n        packages,\n        allowBuilds,\n        onlyBuiltDependencies: PNPM_BUILT_DEPENDENCIES,\n        ...(catalogMode ? { catalogMode } : {}),\n      },\n      { quotingType: \"'\" },\n    ),\n  );\n};\n\n/**\n * Configure the workspace's package manager for a monorepo layout.\n *\n * pnpm workspaces are declared in `pnpm-workspace.yaml`; every other package\n * manager reads the `workspaces` field of the root `package.json`.\n */\nconst setUpWorkspaces = (tree: Tree, catalogs: boolean) => {\n  if (detectWorkspacePackageManager(tree) === 'pnpm') {\n    setUpPnpmWorkspace(tree, catalogs);\n  } else {\n    updateJson(tree, 'package.json', (json) => {\n      // The `workspaces` field may be the object form ({ \"packages\": [...] })\n      // accepted by yarn and bun — extend the globs while preserving the form.\n      const globs = Array.from(\n        new Set([...workspaceGlobs(json.workspaces), ...WORKSPACES]),\n      );\n      return {\n        ...json,\n        workspaces:\n          json.workspaces !== undefined && !Array.isArray(json.workspaces)\n            ? { ...json.workspaces, packages: globs }\n            : globs,\n      };\n    });\n  }\n};\n\n/**\n * Ensure the workspace has a `tsconfig.base.json`.\n *\n * `@nx/js` `initGenerator` (with `addTsPlugin`) normally creates this, but it\n * short-circuits when the workspace already has a root `tsconfig.json` — in\n * which case no base file is written and the next project generator fails with\n * `Cannot find tsconfig.base.json`. So we create a compatible one when it's\n * absent. An existing base is left untouched: the user may have tuned it, and\n * rewriting shared compiler options can break other projects (see the\n * \"add to an existing workspace\" guide).\n */\nconst ensureBaseTsConfig = (tree: Tree) => {\n  if (tree.exists('tsconfig.base.json')) {\n    return;\n  }\n  tree.write(\n    'tsconfig.base.json',\n    JSON.stringify(\n      {\n        compilerOptions: {\n          ...BASE_TSCONFIG_COMPILER_OPTIONS,\n          customConditions: [getNpmScope(tree)],\n        },\n      },\n      null,\n      2,\n    ),\n  );\n};\n\n/**\n * Ensure the workspace has a root `tsconfig.json`.\n *\n * Nx's `@nx/js:typescript-sync` generator hard-fails with\n * `Missing root \"tsconfig.json\"` when it's absent. The plugin's TypeScript\n * projects reference each other via this file, so we guarantee a minimal one\n * exists (sync populates its `references`).\n */\nconst ensureRootTsConfig = (tree: Tree) => {\n  if (tree.exists('tsconfig.json')) {\n    return;\n  }\n  tree.write(\n    'tsconfig.json',\n    JSON.stringify(\n      {\n        extends: './tsconfig.base.json',\n        files: [],\n        references: [],\n      },\n      null,\n      2,\n    ),\n  );\n};\n\n/**\n * Transform an Nx workspace into one ready to run `@aws/nx-plugin` generators.\n *\n * This is the deterministic core shared by the workspace preset and the `init`\n * generator. It is safe to re-run: every step is idempotent (config merges,\n * keyed nx.json / package.json entries, create-if-missing files), so running\n * it against an already-initialised workspace is a no-op.\n *\n * It preserves the workspace's module format: the root package.json `type`\n * field is owned by the preset (written from its `--module` option) and left\n * untouched here. It does NOT rewrite an existing `tsconfig.base.json`'s\n * compiler options, migrate a workspace's package manager, or restructure\n * existing projects — those are decisions for the user (see the \"add to an\n * existing workspace\" guide).\n */\nexport const applyWorkspaceInit = async (\n  tree: Tree,\n  {\n    iac,\n    containers,\n    mcp,\n    readmeOverwriteStrategy = OverwriteStrategy.KeepExisting,\n    overwriteScripts = false,\n    catalogs = true,\n  }: ApplyWorkspaceInitOptions,\n) => {\n  const resolvedContainers =\n    !containers || containers === 'infer' ? inferContainers() : containers;\n\n  // The catalogs flag is written explicitly (even when true) so the workspace\n  // records its dependency-management choice.\n  await ensureAwsNxPluginConfig(tree);\n  await updateAwsNxPluginConfig(tree, {\n    iac: { provider: iac },\n    containers: { engine: resolvedContainers },\n    packageManager: { catalogs },\n  });\n\n  // Set up the TypeScript plugin, base tsconfig, formatter etc. `@nx/js`\n  // creates `tsconfig.base.json` when absent, but skips it when a root\n  // `tsconfig.json` already exists — so we ensure both explicitly below.\n  await initGenerator(tree, {\n    formatter: 'none',\n    addTsPlugin: true,\n  });\n\n  ensureBaseTsConfig(tree);\n  ensureRootTsConfig(tree);\n\n  setUpWorkspaces(tree, catalogs);\n\n  const nxJson = readNxJson(tree);\n  updateNxJson(tree, {\n    ...nxJson,\n    // Preserve an explicit analytics choice in an existing workspace.\n    analytics: (nxJson as { analytics?: boolean }).analytics ?? false,\n    targetDefaults: {\n      ...nxJson.targetDefaults,\n      compile: mergeTargetDefault(nxJson.targetDefaults?.compile, (base) => ({\n        ...base,\n        syncGenerators: [\n          ...(base.syncGenerators ?? []).filter(\n            (g) =>\n              ![TS_SYNC_GENERATOR_NAME, NX_TYPESCRIPT_SYNC_GENERATOR].includes(\n                g,\n              ),\n          ),\n          NX_TYPESCRIPT_SYNC_GENERATOR,\n          TS_SYNC_GENERATOR_NAME,\n        ],\n      })),\n    },\n  });\n\n  const CONVENIENCE_SCRIPTS = {\n    dev: 'nx run-many --target dev',\n    build: 'nx run-many --target build',\n    lint: 'nx run-many --target lint --configuration=fix',\n    test: 'nx run-many --target test --all',\n    // Trivy container image scanning is not part of `build` (its result\n    // depends on the ever-changing vulnerability database); run it explicitly,\n    // e.g. in CI.\n    trivy: 'nx run-many --target trivy --all',\n    'build:skip-lint': 'nx run-many --target build --configuration=skip-lint',\n    'build:all': 'nx run-many --target build --all',\n    'affected:all': 'nx affected --target build',\n  };\n  updateJson(tree, 'package.json', (packageJson) => ({\n    ...packageJson,\n    // The root `type` field is owned by the preset (written explicitly from\n    // its `--module` option). `init` preserves an existing workspace's field\n    // as-is: an ESM workspace already carries `type: \"module\"` (that is how\n    // the format is inferred), and introducing a `type` into a CommonJS\n    // workspace that lacks one changes behaviour for frameworks that parse it\n    // (e.g. Next.js starts treating the app's ESM source as CJS).\n    scripts: overwriteScripts\n      ? { ...packageJson.scripts, ...CONVENIENCE_SCRIPTS }\n      : { ...CONVENIENCE_SCRIPTS, ...packageJson.scripts },\n  }));\n\n  // Pin the workspace's `nx` to the version the plugin's @nx/* packages are\n  // built against. A mismatched workspace nx (even a patch apart) hoists a\n  // second nested nx under @nx/js, and the two instances deadlock `nx sync`.\n  // `@nx/js` must be a root dependency for the `@nx/js:typescript-sync`\n  // generator registered in nx.json to resolve (npm doesn't hoist the\n  // plugin's own copy reliably).\n  const nxVersion = readModulePackageJson('@nx/js').packageJson.version;\n  addDependenciesToPackageJson(\n    tree,\n    {},\n    {\n      nx: nxVersion,\n      '@nx/js': nxVersion,\n      '@nx/workspace': nxVersion,\n      ...withVersions(['typescript', '@biomejs/biome']),\n    },\n  );\n\n  // Write biome.json for formatting and linting\n  if (!tree.exists('biome.json')) {\n    tree.write(\n      'biome.json',\n      JSON.stringify(getDefaultBiomeConfig(tree), null, 2),\n    );\n  }\n\n  generateFiles(\n    tree, // the virtual file system\n    joinPathFragments(import.meta.dirname, '..', 'preset', 'files'),\n    '.',\n    {\n      projectName: getNpmScope(tree),\n      generators: Object.entries(GeneratorsJson.generators)\n        .filter(([_, v]) => !v['hidden'])\n        .map(([k, v]) => ({ name: k, description: v.description })),\n      ...(() => {\n        const cmds = getPackageManagerDisplayCommands();\n        return {\n          pkgMgrCmd: cmds.exec,\n          buildCmd: `${cmds.run} build`,\n          lintCmd: `${cmds.run} lint`,\n        };\n      })(),\n    },\n    {\n      overwriteStrategy: readmeOverwriteStrategy,\n    },\n  );\n\n  if (mcp !== false) {\n    configureMcpServers(tree);\n  }\n};\n"],"names":["generateFiles","joinPathFragments","OverwriteStrategy","readNxJson","updateJson","updateNxJson","initGenerator","yaml","readModulePackageJson","GeneratorsJson","type","SYNC_GENERATOR_NAME","TS_SYNC_GENERATOR_NAME","BASE_TSCONFIG_COMPILER_OPTIONS","ensureAwsNxPluginConfig","updateAwsNxPluginConfig","inferContainers","addDependenciesToPackageJson","detectWorkspacePackageManager","getDefaultBiomeConfig","configureMcpServers","getNpmScope","mergeTargetDefault","getPackageManagerDisplayCommands","workspaceGlobs","withVersions","WORKSPACES","NX_TYPESCRIPT_SYNC_GENERATOR","PNPM_BUILT_DEPENDENCIES","setUpPnpmWorkspace","tree","catalogs","existing","exists","load","read","packages","Array","from","Set","allowBuilds","Object","fromEntries","map","dep","catalogMode","write","dump","onlyBuiltDependencies","quotingType","setUpWorkspaces","json","globs","workspaces","undefined","isArray","ensureBaseTsConfig","JSON","stringify","compilerOptions","customConditions","ensureRootTsConfig","extends","files","references","applyWorkspaceInit","iac","containers","mcp","readmeOverwriteStrategy","KeepExisting","overwriteScripts","resolvedContainers","provider","engine","packageManager","formatter","addTsPlugin","nxJson","analytics","targetDefaults","compile","base","syncGenerators","filter","g","includes","CONVENIENCE_SCRIPTS","dev","build","lint","test","trivy","packageJson","scripts","nxVersion","version","nx","dirname","projectName","generators","entries","_","v","k","name","description","cmds","pkgMgrCmd","exec","buildCmd","run","lintCmd","overwriteStrategy"],"mappings":"AAAA;;;CAGC,GACD,SACEA,aAAa,EACbC,iBAAiB,EACjBC,iBAAiB,EACjBC,UAAU,EAEVC,UAAU,EACVC,YAAY,QACP,aAAa;AACpB,SAASC,aAAa,QAAQ,SAAS;AAEvC,OAAOC,UAAU,UAAU;AAC3B,SAASC,qBAAqB,QAAQ,4BAA4B;AAClE,OAAOC,oBAAoB,6BAA6B;IAAEC,MAAM;AAAO,EAAE;AACzE,SAASC,uBAAuBC,sBAAsB,QAAQ,0BAAuB;AACrF,SAASC,8BAA8B,QAAQ,qBAAkB;AACjE,SACEC,uBAAuB,EACvBC,uBAAuB,QAClB,oBAAiB;AACxB,SAA0BC,eAAe,QAAQ,kBAAe;AAChE,SACEC,4BAA4B,EAC5BC,6BAA6B,QACxB,oBAAiB;AACxB,SAASC,qBAAqB,QAAQ,cAAW;AAEjD,SAASC,mBAAmB,QAAQ,WAAQ;AAC5C,SAASC,WAAW,QAAQ,iBAAc;AAC1C,SAASC,kBAAkB,QAAQ,UAAO;AAC1C,SAASC,gCAAgC,QAAQ,mBAAgB;AACjE,SAASC,cAAc,QAAQ,4BAAyB;AACxD,SAASC,YAAY,QAAQ,gBAAa;AAE1C,MAAMC,aAAa;IAAC;CAAa;AACjC,MAAMC,+BAA+B;AAErC,2EAA2E;AAC3E,4EAA4E;AAC5E,0EAA0E;AAC1E,uEAAuE;AACvE,0EAA0E;AAC1E,OAAO,MAAMC,0BAA0B;IAAC;IAAa;IAAW;IAAM;CAAQ,CAAC;AAsC/E;;;;;;;;;;CAUC,GACD,MAAMC,qBAAqB,CAACC,MAAYC;IACtC,MAAMC,WAAWF,KAAKG,MAAM,CAAC,yBACxB,AAAC1B,KAAK2B,IAAI,CAACJ,KAAKK,IAAI,CAAC,uBAAuB,YAAY,OAGnD,CAAC,IACP,CAAC;IAEL,+EAA+E;IAC/E,MAAMC,WAAWC,MAAMC,IAAI,CACzB,IAAIC,IAAI;WAAK,AAACP,SAASI,QAAQ,IAAiB,EAAE;WAAMV;KAAW;IAGrE,MAAMc,cAAc;QAClB,GAAI,OAAOR,SAASQ,WAAW,KAAK,YAAYR,SAASQ,WAAW,GAC/DR,SAASQ,WAAW,GACrB,CAAC,CAAC;QACN,kEAAkE;QAClE,4DAA4D;QAC5D,GAAGC,OAAOC,WAAW,CAACd,wBAAwBe,GAAG,CAAC,CAACC,MAAQ;gBAACA;gBAAK;aAAK,EAAE;IAC1E;IAEA,0EAA0E;IAC1E,uEAAuE;IACvE,oCAAoC;IACpC,MAAMC,cAAcd,WACfC,SAASa,WAAW,IAAI,WACzBb,SAASa,WAAW;IAExBf,KAAKgB,KAAK,CACR,uBACAvC,KAAKwC,IAAI,CACP;QACE,GAAGf,QAAQ;QACXI;QACAI;QACAQ,uBAAuBpB;QACvB,GAAIiB,cAAc;YAAEA;QAAY,IAAI,CAAC,CAAC;IACxC,GACA;QAAEI,aAAa;IAAI;AAGzB;AAEA;;;;;CAKC,GACD,MAAMC,kBAAkB,CAACpB,MAAYC;IACnC,IAAIb,8BAA8BY,UAAU,QAAQ;QAClDD,mBAAmBC,MAAMC;IAC3B,OAAO;QACL3B,WAAW0B,MAAM,gBAAgB,CAACqB;YAChC,wEAAwE;YACxE,yEAAyE;YACzE,MAAMC,QAAQf,MAAMC,IAAI,CACtB,IAAIC,IAAI;mBAAIf,eAAe2B,KAAKE,UAAU;mBAAM3B;aAAW;YAE7D,OAAO;gBACL,GAAGyB,IAAI;gBACPE,YACEF,KAAKE,UAAU,KAAKC,aAAa,CAACjB,MAAMkB,OAAO,CAACJ,KAAKE,UAAU,IAC3D;oBAAE,GAAGF,KAAKE,UAAU;oBAAEjB,UAAUgB;gBAAM,IACtCA;YACR;QACF;IACF;AACF;AAEA;;;;;;;;;;CAUC,GACD,MAAMI,qBAAqB,CAAC1B;IAC1B,IAAIA,KAAKG,MAAM,CAAC,uBAAuB;QACrC;IACF;IACAH,KAAKgB,KAAK,CACR,sBACAW,KAAKC,SAAS,CACZ;QACEC,iBAAiB;YACf,GAAG9C,8BAA8B;YACjC+C,kBAAkB;gBAACvC,YAAYS;aAAM;QACvC;IACF,GACA,MACA;AAGN;AAEA;;;;;;;CAOC,GACD,MAAM+B,qBAAqB,CAAC/B;IAC1B,IAAIA,KAAKG,MAAM,CAAC,kBAAkB;QAChC;IACF;IACAH,KAAKgB,KAAK,CACR,iBACAW,KAAKC,SAAS,CACZ;QACEI,SAAS;QACTC,OAAO,EAAE;QACTC,YAAY,EAAE;IAChB,GACA,MACA;AAGN;AAEA;;;;;;;;;;;;;;CAcC,GACD,OAAO,MAAMC,qBAAqB,OAChCnC,MACA,EACEoC,GAAG,EACHC,UAAU,EACVC,GAAG,EACHC,0BAA0BnE,kBAAkBoE,YAAY,EACxDC,mBAAmB,KAAK,EACxBxC,WAAW,IAAI,EACW;IAE5B,MAAMyC,qBACJ,CAACL,cAAcA,eAAe,UAAUnD,oBAAoBmD;IAE9D,4EAA4E;IAC5E,4CAA4C;IAC5C,MAAMrD,wBAAwBgB;IAC9B,MAAMf,wBAAwBe,MAAM;QAClCoC,KAAK;YAAEO,UAAUP;QAAI;QACrBC,YAAY;YAAEO,QAAQF;QAAmB;QACzCG,gBAAgB;YAAE5C;QAAS;IAC7B;IAEA,uEAAuE;IACvE,qEAAqE;IACrE,uEAAuE;IACvE,MAAMzB,cAAcwB,MAAM;QACxB8C,WAAW;QACXC,aAAa;IACf;IAEArB,mBAAmB1B;IACnB+B,mBAAmB/B;IAEnBoB,gBAAgBpB,MAAMC;IAEtB,MAAM+C,SAAS3E,WAAW2B;IAC1BzB,aAAayB,MAAM;QACjB,GAAGgD,MAAM;QACT,kEAAkE;QAClEC,WAAW,AAACD,OAAmCC,SAAS,IAAI;QAC5DC,gBAAgB;YACd,GAAGF,OAAOE,cAAc;YACxBC,SAAS3D,mBAAmBwD,OAAOE,cAAc,EAAEC,SAAS,CAACC,OAAU,CAAA;oBACrE,GAAGA,IAAI;oBACPC,gBAAgB;2BACX,AAACD,CAAAA,KAAKC,cAAc,IAAI,EAAE,AAAD,EAAGC,MAAM,CACnC,CAACC,IACC,CAAC;gCAACzE;gCAAwBe;6BAA6B,CAAC2D,QAAQ,CAC9DD;wBAGN1D;wBACAf;qBACD;gBACH,CAAA;QACF;IACF;IAEA,MAAM2E,sBAAsB;QAC1BC,KAAK;QACLC,OAAO;QACPC,MAAM;QACNC,MAAM;QACN,oEAAoE;QACpE,2EAA2E;QAC3E,cAAc;QACdC,OAAO;QACP,mBAAmB;QACnB,aAAa;QACb,gBAAgB;IAClB;IACAxF,WAAW0B,MAAM,gBAAgB,CAAC+D,cAAiB,CAAA;YACjD,GAAGA,WAAW;YACd,wEAAwE;YACxE,yEAAyE;YACzE,wEAAwE;YACxE,oEAAoE;YACpE,0EAA0E;YAC1E,8DAA8D;YAC9DC,SAASvB,mBACL;gBAAE,GAAGsB,YAAYC,OAAO;gBAAE,GAAGP,mBAAmB;YAAC,IACjD;gBAAE,GAAGA,mBAAmB;gBAAE,GAAGM,YAAYC,OAAO;YAAC;QACvD,CAAA;IAEA,0EAA0E;IAC1E,yEAAyE;IACzE,2EAA2E;IAC3E,sEAAsE;IACtE,oEAAoE;IACpE,+BAA+B;IAC/B,MAAMC,YAAYvF,sBAAsB,UAAUqF,WAAW,CAACG,OAAO;IACrE/E,6BACEa,MACA,CAAC,GACD;QACEmE,IAAIF;QACJ,UAAUA;QACV,iBAAiBA;QACjB,GAAGtE,aAAa;YAAC;YAAc;SAAiB,CAAC;IACnD;IAGF,8CAA8C;IAC9C,IAAI,CAACK,KAAKG,MAAM,CAAC,eAAe;QAC9BH,KAAKgB,KAAK,CACR,cACAW,KAAKC,SAAS,CAACvC,sBAAsBW,OAAO,MAAM;IAEtD;IAEA9B,cACE8B,MACA7B,kBAAkB,YAAYiG,OAAO,EAAE,MAAM,UAAU,UACvD,KACA;QACEC,aAAa9E,YAAYS;QACzBsE,YAAY3D,OAAO4D,OAAO,CAAC5F,eAAe2F,UAAU,EACjDhB,MAAM,CAAC,CAAC,CAACkB,GAAGC,EAAE,GAAK,CAACA,CAAC,CAAC,SAAS,EAC/B5D,GAAG,CAAC,CAAC,CAAC6D,GAAGD,EAAE,GAAM,CAAA;gBAAEE,MAAMD;gBAAGE,aAAaH,EAAEG,WAAW;YAAC,CAAA;QAC1D,GAAG,AAAC,CAAA;YACF,MAAMC,OAAOpF;YACb,OAAO;gBACLqF,WAAWD,KAAKE,IAAI;gBACpBC,UAAU,GAAGH,KAAKI,GAAG,CAAC,MAAM,CAAC;gBAC7BC,SAAS,GAAGL,KAAKI,GAAG,CAAC,KAAK,CAAC;YAC7B;QACF,CAAA,GAAI;IACN,GACA;QACEE,mBAAmB5C;IACrB;IAGF,IAAID,QAAQ,OAAO;QACjBhD,oBAAoBU;IACtB;AACF,EAAE"}
+{"version":3,"sources":["../../../../../packages/nx-plugin/src/utils/init.ts"],"sourcesContent":["/**\n * Copyright Amazon.com, Inc. or its affiliates. All Rights Reserved.\n * SPDX-License-Identifier: Apache-2.0\n */\nimport {\n  generateFiles,\n  joinPathFragments,\n  OverwriteStrategy,\n  readNxJson,\n  type Tree,\n  updateJson,\n  updateNxJson,\n} from '@nx/devkit';\nimport { initGenerator } from '@nx/js';\nimport { readFileSync } from 'fs';\nimport yaml from 'js-yaml';\nimport { readModulePackageJson } from 'nx/src/utils/package-json';\nimport GeneratorsJson from '../../generators.json' with { type: 'json' };\nimport { SYNC_GENERATOR_NAME as TS_SYNC_GENERATOR_NAME } from '../ts/sync/generator';\nimport { BASE_TSCONFIG_COMPILER_OPTIONS } from './base-tsconfig';\nimport {\n  ensureAwsNxPluginConfig,\n  updateAwsNxPluginConfig,\n} from './config/utils';\nimport { type Containers, inferContainers } from './containers';\nimport {\n  addDependenciesToPackageJson,\n  detectWorkspacePackageManager,\n} from './dependencies';\nimport { getDefaultBiomeConfig } from './format';\nimport type { Iac } from './iac';\nimport { configureMcpServers } from './mcp';\nimport { getNpmScope } from './npm-scope';\nimport {\n  mergeTargetDefault,\n  nxPluginMcpDependency,\n  nxPluginSelfDependency,\n} from './nx';\nimport { getPackageManagerDisplayCommands } from './pkg-manager';\nimport { workspaceGlobs } from './project-package-json';\nimport { withVersions } from './versions';\n\nconst WORKSPACES = ['packages/*'];\nconst NX_TYPESCRIPT_SYNC_GENERATOR = '@nx/js:typescript-sync';\n\n// Built dependencies whose install scripts the generated workspace trusts.\n// `onlyBuiltDependencies` is the pnpm 10 key (silently ignored by pnpm 11);\n// pnpm 11 reads `allowBuilds` instead. Any dep NOT in this allowlist will\n// have its install scripts skipped with a warning — matching pnpm 10's\n// default behaviour. The user can opt-in later via `pnpm approve-builds`.\nexport const PNPM_BUILT_DEPENDENCIES = ['@swc/core', 'esbuild', 'nx', 'sharp'];\n\n/**\n * Options controlling how the workspace is initialised. These mirror the\n * preset schema so a workspace created via the preset and one initialised via\n * the `init` generator end up in the same shape.\n */\nexport interface ApplyWorkspaceInitOptions {\n  /** The IaC provider to record in the plugin config. */\n  readonly iac: Iac;\n  /**\n   * The container engine to record. `undefined`/`'infer'` picks docker when\n   * installed, else finch.\n   */\n  readonly containers?: Containers | 'infer';\n  /** Whether to configure MCP servers for coding agents. Defaults to true. */\n  readonly mcp?: boolean;\n  /**\n   * How to treat the generated workspace README. The preset owns the README of\n   * a greenfield workspace (`Overwrite`); the `init` generator must not clobber\n   * an existing workspace's README (`KeepExisting`, the default).\n   */\n  readonly readmeOverwriteStrategy?: OverwriteStrategy;\n  /**\n   * Whether to overwrite root package.json scripts that already exist. The\n   * preset owns a greenfield workspace's scripts (`true`); the `init`\n   * generator must not clobber an existing workspace's scripts (`false`,\n   * the default) — it only adds the convenience scripts that are absent.\n   */\n  readonly overwriteScripts?: boolean;\n  /**\n   * Whether generators use the package manager's dependency catalog. On pnpm\n   * this also sets `catalogMode: strict` so `pnpm add` records new deps in the\n   * catalog. Defaults to true.\n   */\n  readonly catalogs?: boolean;\n}\n\n/**\n * Add or repair the pnpm `allowBuilds` / `onlyBuiltDependencies` allowlist for\n * the workspace's `packages` globs, without clobbering any packages the user\n * has already declared.\n *\n * A workspace not created by the preset commonly has either no\n * `pnpm-workspace.yaml`, one missing the `packages` globs, or one carrying the\n * broken `set this to true or false` placeholder pnpm writes when it skips a\n * build script. This makes the file self-consistent so the first generator's\n * install doesn't fail with `ERR_PNPM_IGNORED_BUILDS`.\n */\nconst setUpPnpmWorkspace = (tree: Tree, catalogs: boolean) => {\n  const existing = tree.exists('pnpm-workspace.yaml')\n    ? ((yaml.load(tree.read('pnpm-workspace.yaml', 'utf-8') ?? '') as Record<\n        string,\n        unknown\n      >) ?? {})\n    : {};\n\n  // Preserve any packages globs the user already has, ensuring ours are present.\n  const packages = Array.from(\n    new Set([...((existing.packages as string[]) ?? []), ...WORKSPACES]),\n  );\n\n  const allowBuilds = {\n    ...(typeof existing.allowBuilds === 'object' && existing.allowBuilds\n      ? (existing.allowBuilds as Record<string, unknown>)\n      : {}),\n    // Overwrite any non-boolean (e.g. the \"set this to true or false\"\n    // placeholder) with an explicit true for the deps we trust.\n    ...Object.fromEntries(PNPM_BUILT_DEPENDENCIES.map((dep) => [dep, true])),\n  };\n\n  // `strict` makes `pnpm add` record new deps in the catalog; it only gates\n  // that flow, so pre-declared direct ranges (e.g. tslib) still install.\n  // Preserve an explicit user choice.\n  const catalogMode = catalogs\n    ? (existing.catalogMode ?? 'strict')\n    : existing.catalogMode;\n\n  tree.write(\n    'pnpm-workspace.yaml',\n    yaml.dump(\n      {\n        ...existing,\n        packages,\n        allowBuilds,\n        onlyBuiltDependencies: PNPM_BUILT_DEPENDENCIES,\n        ...(catalogMode ? { catalogMode } : {}),\n      },\n      { quotingType: \"'\" },\n    ),\n  );\n};\n\n/**\n * Configure the workspace's package manager for a monorepo layout.\n *\n * pnpm workspaces are declared in `pnpm-workspace.yaml`; every other package\n * manager reads the `workspaces` field of the root `package.json`.\n */\nconst setUpWorkspaces = (tree: Tree, catalogs: boolean) => {\n  if (detectWorkspacePackageManager(tree) === 'pnpm') {\n    setUpPnpmWorkspace(tree, catalogs);\n  } else {\n    updateJson(tree, 'package.json', (json) => {\n      // The `workspaces` field may be the object form ({ \"packages\": [...] })\n      // accepted by yarn and bun — extend the globs while preserving the form.\n      const globs = Array.from(\n        new Set([...workspaceGlobs(json.workspaces), ...WORKSPACES]),\n      );\n      return {\n        ...json,\n        workspaces:\n          json.workspaces !== undefined && !Array.isArray(json.workspaces)\n            ? { ...json.workspaces, packages: globs }\n            : globs,\n      };\n    });\n  }\n};\n\n/**\n * Ensure the workspace has a `tsconfig.base.json`.\n *\n * `@nx/js` `initGenerator` (with `addTsPlugin`) normally creates this, but it\n * short-circuits when the workspace already has a root `tsconfig.json` — in\n * which case no base file is written and the next project generator fails with\n * `Cannot find tsconfig.base.json`. So we create a compatible one when it's\n * absent. An existing base is left untouched: the user may have tuned it, and\n * rewriting shared compiler options can break other projects (see the\n * \"add to an existing workspace\" guide).\n */\nconst ensureBaseTsConfig = (tree: Tree) => {\n  if (tree.exists('tsconfig.base.json')) {\n    return;\n  }\n  tree.write(\n    'tsconfig.base.json',\n    JSON.stringify(\n      {\n        compilerOptions: {\n          ...BASE_TSCONFIG_COMPILER_OPTIONS,\n          customConditions: [getNpmScope(tree)],\n        },\n      },\n      null,\n      2,\n    ),\n  );\n};\n\n/**\n * Ensure the workspace has a root `tsconfig.json`.\n *\n * Nx's `@nx/js:typescript-sync` generator hard-fails with\n * `Missing root \"tsconfig.json\"` when it's absent. The plugin's TypeScript\n * projects reference each other via this file, so we guarantee a minimal one\n * exists (sync populates its `references`).\n */\nconst ensureRootTsConfig = (tree: Tree) => {\n  if (tree.exists('tsconfig.json')) {\n    return;\n  }\n  tree.write(\n    'tsconfig.json',\n    JSON.stringify(\n      {\n        extends: './tsconfig.base.json',\n        files: [],\n        references: [],\n      },\n      null,\n      2,\n    ),\n  );\n};\n\n/**\n * Transform an Nx workspace into one ready to run `@aws/nx-plugin` generators.\n *\n * This is the deterministic core shared by the workspace preset and the `init`\n * generator. It is safe to re-run: every step is idempotent (config merges,\n * keyed nx.json / package.json entries, create-if-missing files), so running\n * it against an already-initialised workspace is a no-op.\n *\n * It preserves the workspace's module format: the root package.json `type`\n * field is owned by the preset (written from its `--module` option) and left\n * untouched here. It does NOT rewrite an existing `tsconfig.base.json`'s\n * compiler options, migrate a workspace's package manager, or restructure\n * existing projects — those are decisions for the user (see the \"add to an\n * existing workspace\" guide).\n */\nexport const applyWorkspaceInit = async (\n  tree: Tree,\n  {\n    iac,\n    containers,\n    mcp,\n    readmeOverwriteStrategy = OverwriteStrategy.KeepExisting,\n    overwriteScripts = false,\n    catalogs = true,\n  }: ApplyWorkspaceInitOptions,\n) => {\n  const resolvedContainers =\n    !containers || containers === 'infer' ? inferContainers() : containers;\n\n  // The catalogs flag is written explicitly (even when true) so the workspace\n  // records its dependency-management choice.\n  await ensureAwsNxPluginConfig(tree);\n  await updateAwsNxPluginConfig(tree, {\n    iac: { provider: iac },\n    containers: { engine: resolvedContainers },\n    packageManager: { catalogs },\n  });\n\n  // Set up the TypeScript plugin, base tsconfig, formatter etc. `@nx/js`\n  // creates `tsconfig.base.json` when absent, but skips it when a root\n  // `tsconfig.json` already exists — so we ensure both explicitly below.\n  await initGenerator(tree, {\n    formatter: 'none',\n    addTsPlugin: true,\n  });\n\n  ensureBaseTsConfig(tree);\n  ensureRootTsConfig(tree);\n\n  setUpWorkspaces(tree, catalogs);\n\n  const nxJson = readNxJson(tree);\n  updateNxJson(tree, {\n    ...nxJson,\n    // Preserve an explicit analytics choice in an existing workspace.\n    analytics: (nxJson as { analytics?: boolean }).analytics ?? false,\n    targetDefaults: {\n      ...nxJson.targetDefaults,\n      compile: mergeTargetDefault(nxJson.targetDefaults?.compile, (base) => ({\n        ...base,\n        syncGenerators: [\n          ...(base.syncGenerators ?? []).filter(\n            (g) =>\n              ![TS_SYNC_GENERATOR_NAME, NX_TYPESCRIPT_SYNC_GENERATOR].includes(\n                g,\n              ),\n          ),\n          NX_TYPESCRIPT_SYNC_GENERATOR,\n          TS_SYNC_GENERATOR_NAME,\n        ],\n      })),\n    },\n  });\n\n  const CONVENIENCE_SCRIPTS = {\n    dev: 'nx run-many --target dev',\n    build: 'nx run-many --target build',\n    lint: 'nx run-many --target lint --configuration=fix',\n    test: 'nx run-many --target test --all',\n    // Trivy container image scanning is not part of `build` (its result\n    // depends on the ever-changing vulnerability database); run it explicitly,\n    // e.g. in CI.\n    trivy: 'nx run-many --target trivy --all',\n    'build:skip-lint': 'nx run-many --target build --configuration=skip-lint',\n    'build:all': 'nx run-many --target build --all',\n    'affected:all': 'nx affected --target build',\n  };\n  updateJson(tree, 'package.json', (packageJson) => ({\n    ...packageJson,\n    // The root `type` field is owned by the preset (written explicitly from\n    // its `--module` option). `init` preserves an existing workspace's field\n    // as-is: an ESM workspace already carries `type: \"module\"` (that is how\n    // the format is inferred), and introducing a `type` into a CommonJS\n    // workspace that lacks one changes behaviour for frameworks that parse it\n    // (e.g. Next.js starts treating the app's ESM source as CJS).\n    scripts: overwriteScripts\n      ? { ...packageJson.scripts, ...CONVENIENCE_SCRIPTS }\n      : { ...CONVENIENCE_SCRIPTS, ...packageJson.scripts },\n  }));\n\n  // Pin the workspace's `nx` to the version the plugin's @nx/* packages are\n  // built against. A mismatched workspace nx (even a patch apart) hoists a\n  // second nested nx under @nx/js, and the two instances deadlock `nx sync`.\n  // `@nx/js` must be a root dependency for the `@nx/js:typescript-sync`\n  // generator registered in nx.json to resolve (npm doesn't hoist the\n  // plugin's own copy reliably).\n  const nxVersion = readModulePackageJson('@nx/js').packageJson.version;\n  addDependenciesToPackageJson(\n    tree,\n    {},\n    {\n      nx: nxVersion,\n      '@nx/js': nxVersion,\n      '@nx/workspace': nxVersion,\n      ...withVersions(['typescript', '@biomejs/biome']),\n      // Declare the plugin the generators are running from, plus the MCP server\n      // package the vended config runs, so both are pinned in the workspace's\n      // lockfile and upgrading them upgrades what the agents use.\n      ...nxPluginSelfDependency(tree),\n      ...nxPluginMcpDependency(tree),\n    },\n  );\n\n  // Write biome.json for formatting and linting\n  if (!tree.exists('biome.json')) {\n    tree.write(\n      'biome.json',\n      JSON.stringify(getDefaultBiomeConfig(tree), null, 2),\n    );\n  }\n\n  generateFiles(\n    tree, // the virtual file system\n    joinPathFragments(import.meta.dirname, '..', 'preset', 'files'),\n    '.',\n    {\n      projectName: getNpmScope(tree),\n      generators: Object.entries(GeneratorsJson.generators)\n        .filter(([_, v]) => !v['hidden'])\n        .map(([k, v]) => ({ name: k, description: v.description })),\n      ...(() => {\n        const cmds = getPackageManagerDisplayCommands();\n        return {\n          pkgMgrCmd: cmds.exec,\n          buildCmd: `${cmds.run} build`,\n          lintCmd: `${cmds.run} lint`,\n        };\n      })(),\n    },\n    {\n      overwriteStrategy: readmeOverwriteStrategy,\n    },\n  );\n\n  if (mcp !== false) {\n    configureMcpServers(tree);\n  }\n};\n"],"names":["generateFiles","joinPathFragments","OverwriteStrategy","readNxJson","updateJson","updateNxJson","initGenerator","yaml","readModulePackageJson","GeneratorsJson","type","SYNC_GENERATOR_NAME","TS_SYNC_GENERATOR_NAME","BASE_TSCONFIG_COMPILER_OPTIONS","ensureAwsNxPluginConfig","updateAwsNxPluginConfig","inferContainers","addDependenciesToPackageJson","detectWorkspacePackageManager","getDefaultBiomeConfig","configureMcpServers","getNpmScope","mergeTargetDefault","nxPluginMcpDependency","nxPluginSelfDependency","getPackageManagerDisplayCommands","workspaceGlobs","withVersions","WORKSPACES","NX_TYPESCRIPT_SYNC_GENERATOR","PNPM_BUILT_DEPENDENCIES","setUpPnpmWorkspace","tree","catalogs","existing","exists","load","read","packages","Array","from","Set","allowBuilds","Object","fromEntries","map","dep","catalogMode","write","dump","onlyBuiltDependencies","quotingType","setUpWorkspaces","json","globs","workspaces","undefined","isArray","ensureBaseTsConfig","JSON","stringify","compilerOptions","customConditions","ensureRootTsConfig","extends","files","references","applyWorkspaceInit","iac","containers","mcp","readmeOverwriteStrategy","KeepExisting","overwriteScripts","resolvedContainers","provider","engine","packageManager","formatter","addTsPlugin","nxJson","analytics","targetDefaults","compile","base","syncGenerators","filter","g","includes","CONVENIENCE_SCRIPTS","dev","build","lint","test","trivy","packageJson","scripts","nxVersion","version","nx","dirname","projectName","generators","entries","_","v","k","name","description","cmds","pkgMgrCmd","exec","buildCmd","run","lintCmd","overwriteStrategy"],"mappings":"AAAA;;;CAGC,GACD,SACEA,aAAa,EACbC,iBAAiB,EACjBC,iBAAiB,EACjBC,UAAU,EAEVC,UAAU,EACVC,YAAY,QACP,aAAa;AACpB,SAASC,aAAa,QAAQ,SAAS;AAEvC,OAAOC,UAAU,UAAU;AAC3B,SAASC,qBAAqB,QAAQ,4BAA4B;AAClE,OAAOC,oBAAoB,6BAA6B;IAAEC,MAAM;AAAO,EAAE;AACzE,SAASC,uBAAuBC,sBAAsB,QAAQ,0BAAuB;AACrF,SAASC,8BAA8B,QAAQ,qBAAkB;AACjE,SACEC,uBAAuB,EACvBC,uBAAuB,QAClB,oBAAiB;AACxB,SAA0BC,eAAe,QAAQ,kBAAe;AAChE,SACEC,4BAA4B,EAC5BC,6BAA6B,QACxB,oBAAiB;AACxB,SAASC,qBAAqB,QAAQ,cAAW;AAEjD,SAASC,mBAAmB,QAAQ,WAAQ;AAC5C,SAASC,WAAW,QAAQ,iBAAc;AAC1C,SACEC,kBAAkB,EAClBC,qBAAqB,EACrBC,sBAAsB,QACjB,UAAO;AACd,SAASC,gCAAgC,QAAQ,mBAAgB;AACjE,SAASC,cAAc,QAAQ,4BAAyB;AACxD,SAASC,YAAY,QAAQ,gBAAa;AAE1C,MAAMC,aAAa;IAAC;CAAa;AACjC,MAAMC,+BAA+B;AAErC,2EAA2E;AAC3E,4EAA4E;AAC5E,0EAA0E;AAC1E,uEAAuE;AACvE,0EAA0E;AAC1E,OAAO,MAAMC,0BAA0B;IAAC;IAAa;IAAW;IAAM;CAAQ,CAAC;AAsC/E;;;;;;;;;;CAUC,GACD,MAAMC,qBAAqB,CAACC,MAAYC;IACtC,MAAMC,WAAWF,KAAKG,MAAM,CAAC,yBACxB,AAAC5B,KAAK6B,IAAI,CAACJ,KAAKK,IAAI,CAAC,uBAAuB,YAAY,OAGnD,CAAC,IACP,CAAC;IAEL,+EAA+E;IAC/E,MAAMC,WAAWC,MAAMC,IAAI,CACzB,IAAIC,IAAI;WAAK,AAACP,SAASI,QAAQ,IAAiB,EAAE;WAAMV;KAAW;IAGrE,MAAMc,cAAc;QAClB,GAAI,OAAOR,SAASQ,WAAW,KAAK,YAAYR,SAASQ,WAAW,GAC/DR,SAASQ,WAAW,GACrB,CAAC,CAAC;QACN,kEAAkE;QAClE,4DAA4D;QAC5D,GAAGC,OAAOC,WAAW,CAACd,wBAAwBe,GAAG,CAAC,CAACC,MAAQ;gBAACA;gBAAK;aAAK,EAAE;IAC1E;IAEA,0EAA0E;IAC1E,uEAAuE;IACvE,oCAAoC;IACpC,MAAMC,cAAcd,WACfC,SAASa,WAAW,IAAI,WACzBb,SAASa,WAAW;IAExBf,KAAKgB,KAAK,CACR,uBACAzC,KAAK0C,IAAI,CACP;QACE,GAAGf,QAAQ;QACXI;QACAI;QACAQ,uBAAuBpB;QACvB,GAAIiB,cAAc;YAAEA;QAAY,IAAI,CAAC,CAAC;IACxC,GACA;QAAEI,aAAa;IAAI;AAGzB;AAEA;;;;;CAKC,GACD,MAAMC,kBAAkB,CAACpB,MAAYC;IACnC,IAAIf,8BAA8Bc,UAAU,QAAQ;QAClDD,mBAAmBC,MAAMC;IAC3B,OAAO;QACL7B,WAAW4B,MAAM,gBAAgB,CAACqB;YAChC,wEAAwE;YACxE,yEAAyE;YACzE,MAAMC,QAAQf,MAAMC,IAAI,CACtB,IAAIC,IAAI;mBAAIf,eAAe2B,KAAKE,UAAU;mBAAM3B;aAAW;YAE7D,OAAO;gBACL,GAAGyB,IAAI;gBACPE,YACEF,KAAKE,UAAU,KAAKC,aAAa,CAACjB,MAAMkB,OAAO,CAACJ,KAAKE,UAAU,IAC3D;oBAAE,GAAGF,KAAKE,UAAU;oBAAEjB,UAAUgB;gBAAM,IACtCA;YACR;QACF;IACF;AACF;AAEA;;;;;;;;;;CAUC,GACD,MAAMI,qBAAqB,CAAC1B;IAC1B,IAAIA,KAAKG,MAAM,CAAC,uBAAuB;QACrC;IACF;IACAH,KAAKgB,KAAK,CACR,sBACAW,KAAKC,SAAS,CACZ;QACEC,iBAAiB;YACf,GAAGhD,8BAA8B;YACjCiD,kBAAkB;gBAACzC,YAAYW;aAAM;QACvC;IACF,GACA,MACA;AAGN;AAEA;;;;;;;CAOC,GACD,MAAM+B,qBAAqB,CAAC/B;IAC1B,IAAIA,KAAKG,MAAM,CAAC,kBAAkB;QAChC;IACF;IACAH,KAAKgB,KAAK,CACR,iBACAW,KAAKC,SAAS,CACZ;QACEI,SAAS;QACTC,OAAO,EAAE;QACTC,YAAY,EAAE;IAChB,GACA,MACA;AAGN;AAEA;;;;;;;;;;;;;;CAcC,GACD,OAAO,MAAMC,qBAAqB,OAChCnC,MACA,EACEoC,GAAG,EACHC,UAAU,EACVC,GAAG,EACHC,0BAA0BrE,kBAAkBsE,YAAY,EACxDC,mBAAmB,KAAK,EACxBxC,WAAW,IAAI,EACW;IAE5B,MAAMyC,qBACJ,CAACL,cAAcA,eAAe,UAAUrD,oBAAoBqD;IAE9D,4EAA4E;IAC5E,4CAA4C;IAC5C,MAAMvD,wBAAwBkB;IAC9B,MAAMjB,wBAAwBiB,MAAM;QAClCoC,KAAK;YAAEO,UAAUP;QAAI;QACrBC,YAAY;YAAEO,QAAQF;QAAmB;QACzCG,gBAAgB;YAAE5C;QAAS;IAC7B;IAEA,uEAAuE;IACvE,qEAAqE;IACrE,uEAAuE;IACvE,MAAM3B,cAAc0B,MAAM;QACxB8C,WAAW;QACXC,aAAa;IACf;IAEArB,mBAAmB1B;IACnB+B,mBAAmB/B;IAEnBoB,gBAAgBpB,MAAMC;IAEtB,MAAM+C,SAAS7E,WAAW6B;IAC1B3B,aAAa2B,MAAM;QACjB,GAAGgD,MAAM;QACT,kEAAkE;QAClEC,WAAW,AAACD,OAAmCC,SAAS,IAAI;QAC5DC,gBAAgB;YACd,GAAGF,OAAOE,cAAc;YACxBC,SAAS7D,mBAAmB0D,OAAOE,cAAc,EAAEC,SAAS,CAACC,OAAU,CAAA;oBACrE,GAAGA,IAAI;oBACPC,gBAAgB;2BACX,AAACD,CAAAA,KAAKC,cAAc,IAAI,EAAE,AAAD,EAAGC,MAAM,CACnC,CAACC,IACC,CAAC;gCAAC3E;gCAAwBiB;6BAA6B,CAAC2D,QAAQ,CAC9DD;wBAGN1D;wBACAjB;qBACD;gBACH,CAAA;QACF;IACF;IAEA,MAAM6E,sBAAsB;QAC1BC,KAAK;QACLC,OAAO;QACPC,MAAM;QACNC,MAAM;QACN,oEAAoE;QACpE,2EAA2E;QAC3E,cAAc;QACdC,OAAO;QACP,mBAAmB;QACnB,aAAa;QACb,gBAAgB;IAClB;IACA1F,WAAW4B,MAAM,gBAAgB,CAAC+D,cAAiB,CAAA;YACjD,GAAGA,WAAW;YACd,wEAAwE;YACxE,yEAAyE;YACzE,wEAAwE;YACxE,oEAAoE;YACpE,0EAA0E;YAC1E,8DAA8D;YAC9DC,SAASvB,mBACL;gBAAE,GAAGsB,YAAYC,OAAO;gBAAE,GAAGP,mBAAmB;YAAC,IACjD;gBAAE,GAAGA,mBAAmB;gBAAE,GAAGM,YAAYC,OAAO;YAAC;QACvD,CAAA;IAEA,0EAA0E;IAC1E,yEAAyE;IACzE,2EAA2E;IAC3E,sEAAsE;IACtE,oEAAoE;IACpE,+BAA+B;IAC/B,MAAMC,YAAYzF,sBAAsB,UAAUuF,WAAW,CAACG,OAAO;IACrEjF,6BACEe,MACA,CAAC,GACD;QACEmE,IAAIF;QACJ,UAAUA;QACV,iBAAiBA;QACjB,GAAGtE,aAAa;YAAC;YAAc;SAAiB,CAAC;QACjD,0EAA0E;QAC1E,wEAAwE;QACxE,4DAA4D;QAC5D,GAAGH,uBAAuBQ,KAAK;QAC/B,GAAGT,sBAAsBS,KAAK;IAChC;IAGF,8CAA8C;IAC9C,IAAI,CAACA,KAAKG,MAAM,CAAC,eAAe;QAC9BH,KAAKgB,KAAK,CACR,cACAW,KAAKC,SAAS,CAACzC,sBAAsBa,OAAO,MAAM;IAEtD;IAEAhC,cACEgC,MACA/B,kBAAkB,YAAYmG,OAAO,EAAE,MAAM,UAAU,UACvD,KACA;QACEC,aAAahF,YAAYW;QACzBsE,YAAY3D,OAAO4D,OAAO,CAAC9F,eAAe6F,UAAU,EACjDhB,MAAM,CAAC,CAAC,CAACkB,GAAGC,EAAE,GAAK,CAACA,CAAC,CAAC,SAAS,EAC/B5D,GAAG,CAAC,CAAC,CAAC6D,GAAGD,EAAE,GAAM,CAAA;gBAAEE,MAAMD;gBAAGE,aAAaH,EAAEG,WAAW;YAAC,CAAA;QAC1D,GAAG,AAAC,CAAA;YACF,MAAMC,OAAOpF;YACb,OAAO;gBACLqF,WAAWD,KAAKE,IAAI;gBACpBC,UAAU,GAAGH,KAAKI,GAAG,CAAC,MAAM,CAAC;gBAC7BC,SAAS,GAAGL,KAAKI,GAAG,CAAC,KAAK,CAAC;YAC7B;QACF,CAAA,GAAI;IACN,GACA;QACEE,mBAAmB5C;IACrB;IAGF,IAAID,QAAQ,OAAO;QACjBlD,oBAAoBY;IACtB;AACF,EAAE"}

package/src/utils/mcp.d.ts

@@ -11,8 +11,17 @@ export declare const NX_PLUGIN_MCP_SERVER_NAME = "nx-plugin-for-aws";
  * Command used to launch the Nx Plugin for AWS MCP server.
  */
 export declare const NX_PLUGIN_MCP_SERVER_COMMAND = "npx";
+/**
+ * Package providing the Nx Plugin for AWS MCP server.
+ */
+export declare const NX_PLUGIN_MCP_PACKAGE_NAME = "@aws/nx-plugin-mcp";
 /**
  * Arguments used to launch the Nx Plugin for AWS MCP server.
+ *
+ * npx prefers a locally installed package over the registry, and generators
+ * declare this package as a workspace devDependency, so the server tracks the
+ * version in the workspace's lockfile. `-y` falls back to fetching from the
+ * registry for a workspace where it isn't installed.
  */
 export declare const NX_PLUGIN_MCP_SERVER_ARGS: string[];
 /**

package/src/utils/mcp.js

@@ -9,11 +9,19 @@ import { updateToml } from "./toml.js";
 /**
  * Command used to launch the Nx Plugin for AWS MCP server.
  */ export const NX_PLUGIN_MCP_SERVER_COMMAND = 'npx';
+/**
+ * Package providing the Nx Plugin for AWS MCP server.
+ */ export const NX_PLUGIN_MCP_PACKAGE_NAME = '@aws/nx-plugin-mcp';
 /**
  * Arguments used to launch the Nx Plugin for AWS MCP server.
+ *
+ * npx prefers a locally installed package over the registry, and generators
+ * declare this package as a workspace devDependency, so the server tracks the
+ * version in the workspace's lockfile. `-y` falls back to fetching from the
+ * registry for a workspace where it isn't installed.
  */ export const NX_PLUGIN_MCP_SERVER_ARGS = [
     '-y',
-    '@aws/nx-plugin-mcp'
+    NX_PLUGIN_MCP_PACKAGE_NAME
 ];
 /**
  * A single stdio MCP server entry, shared by agents that use the `mcpServers` config shape.

package/src/utils/mcp.js.map

@@ -1 +1 @@
-{"version":3,"sources":["../../../../../packages/nx-plugin/src/utils/mcp.ts"],"sourcesContent":["/**\n * Copyright Amazon.com, Inc. or its affiliates. All Rights Reserved.\n * SPDX-License-Identifier: Apache-2.0\n */\nimport { readJson, type Tree, writeJson } from '@nx/devkit';\nimport { updateToml } from './toml';\n\n/**\n * Name of the Nx Plugin for AWS MCP server, used as the key in each agent's config.\n */\nexport const NX_PLUGIN_MCP_SERVER_NAME = 'nx-plugin-for-aws';\n\n/**\n * Command used to launch the Nx Plugin for AWS MCP server.\n */\nexport const NX_PLUGIN_MCP_SERVER_COMMAND = 'npx';\n\n/**\n * Arguments used to launch the Nx Plugin for AWS MCP server.\n */\nexport const NX_PLUGIN_MCP_SERVER_ARGS = ['-y', '@aws/nx-plugin-mcp'];\n\n/**\n * A single stdio MCP server entry, shared by agents that use the `mcpServers` config shape.\n */\nconst stdioServerEntry = () => ({\n  command: NX_PLUGIN_MCP_SERVER_COMMAND,\n  args: NX_PLUGIN_MCP_SERVER_ARGS,\n});\n\n/**\n * Merge the Nx Plugin for AWS MCP server into a JSON config file under the given key,\n * preserving any other servers already configured. Creates the file if it does not exist.\n */\nconst mergeJsonMcpConfig = (\n  tree: Tree,\n  filePath: string,\n  key: 'mcpServers' | 'servers',\n  entry: Record<string, unknown>,\n) => {\n  const config = tree.exists(filePath) ? readJson(tree, filePath) : {};\n  config[key] = {\n    ...config[key],\n    [NX_PLUGIN_MCP_SERVER_NAME]: entry,\n  };\n  writeJson(tree, filePath, config);\n};\n\n/**\n * Configure the Nx Plugin for AWS MCP server across the project-level config locations\n * used by common coding agents, so agents working in the workspace can use it to scaffold\n * AWS projects with the Nx Plugin for AWS.\n *\n * Existing servers and unrelated config in each file are preserved.\n */\nexport const configureMcpServers = (tree: Tree) => {\n  // Agents using the `mcpServers` config shape (Claude Code, Cursor, Kiro, Gemini CLI)\n  const mcpServersFiles = [\n    '.mcp.json', // Claude Code\n    '.cursor/mcp.json', // Cursor\n    '.kiro/settings/mcp.json', // Kiro\n    '.gemini/settings.json', // Gemini CLI\n  ];\n  for (const filePath of mcpServersFiles) {\n    mergeJsonMcpConfig(tree, filePath, 'mcpServers', stdioServerEntry());\n  }\n\n  // GitHub Copilot uses the `servers` key with an explicit `type`\n  mergeJsonMcpConfig(tree, '.vscode/mcp.json', 'servers', {\n    type: 'stdio',\n    ...stdioServerEntry(),\n  });\n\n  // OpenAI Codex CLI uses TOML under the `mcp_servers` table\n  const codexConfig = '.codex/config.toml';\n  if (!tree.exists(codexConfig)) {\n    tree.write(codexConfig, '');\n  }\n  updateToml(tree, codexConfig, (prev) => ({\n    ...prev,\n    mcp_servers: {\n      ...(prev.mcp_servers as object),\n      [NX_PLUGIN_MCP_SERVER_NAME]: {\n        command: NX_PLUGIN_MCP_SERVER_COMMAND,\n        args: NX_PLUGIN_MCP_SERVER_ARGS,\n      },\n    },\n  }));\n};\n"],"names":["readJson","writeJson","updateToml","NX_PLUGIN_MCP_SERVER_NAME","NX_PLUGIN_MCP_SERVER_COMMAND","NX_PLUGIN_MCP_SERVER_ARGS","stdioServerEntry","command","args","mergeJsonMcpConfig","tree","filePath","key","entry","config","exists","configureMcpServers","mcpServersFiles","type","codexConfig","write","prev","mcp_servers"],"mappings":"AAAA;;;CAGC,GACD,SAASA,QAAQ,EAAaC,SAAS,QAAQ,aAAa;AAC5D,SAASC,UAAU,QAAQ,YAAS;AAEpC;;CAEC,GACD,OAAO,MAAMC,4BAA4B,oBAAoB;AAE7D;;CAEC,GACD,OAAO,MAAMC,+BAA+B,MAAM;AAElD;;CAEC,GACD,OAAO,MAAMC,4BAA4B;IAAC;IAAM;CAAqB,CAAC;AAEtE;;CAEC,GACD,MAAMC,mBAAmB,IAAO,CAAA;QAC9BC,SAASH;QACTI,MAAMH;IACR,CAAA;AAEA;;;CAGC,GACD,MAAMI,qBAAqB,CACzBC,MACAC,UACAC,KACAC;IAEA,MAAMC,SAASJ,KAAKK,MAAM,CAACJ,YAAYX,SAASU,MAAMC,YAAY,CAAC;IACnEG,MAAM,CAACF,IAAI,GAAG;QACZ,GAAGE,MAAM,CAACF,IAAI;QACd,CAACT,0BAA0B,EAAEU;IAC/B;IACAZ,UAAUS,MAAMC,UAAUG;AAC5B;AAEA;;;;;;CAMC,GACD,OAAO,MAAME,sBAAsB,CAACN;IAClC,qFAAqF;IACrF,MAAMO,kBAAkB;QACtB;QACA;QACA;QACA;KACD;IACD,KAAK,MAAMN,YAAYM,gBAAiB;QACtCR,mBAAmBC,MAAMC,UAAU,cAAcL;IACnD;IAEA,gEAAgE;IAChEG,mBAAmBC,MAAM,oBAAoB,WAAW;QACtDQ,MAAM;QACN,GAAGZ,kBAAkB;IACvB;IAEA,2DAA2D;IAC3D,MAAMa,cAAc;IACpB,IAAI,CAACT,KAAKK,MAAM,CAACI,cAAc;QAC7BT,KAAKU,KAAK,CAACD,aAAa;IAC1B;IACAjB,WAAWQ,MAAMS,aAAa,CAACE,OAAU,CAAA;YACvC,GAAGA,IAAI;YACPC,aAAa;gBACX,GAAID,KAAKC,WAAW;gBACpB,CAACnB,0BAA0B,EAAE;oBAC3BI,SAASH;oBACTI,MAAMH;gBACR;YACF;QACF,CAAA;AACF,EAAE"}
+{"version":3,"sources":["../../../../../packages/nx-plugin/src/utils/mcp.ts"],"sourcesContent":["/**\n * Copyright Amazon.com, Inc. or its affiliates. All Rights Reserved.\n * SPDX-License-Identifier: Apache-2.0\n */\nimport { readJson, type Tree, writeJson } from '@nx/devkit';\nimport { updateToml } from './toml';\n\n/**\n * Name of the Nx Plugin for AWS MCP server, used as the key in each agent's config.\n */\nexport const NX_PLUGIN_MCP_SERVER_NAME = 'nx-plugin-for-aws';\n\n/**\n * Command used to launch the Nx Plugin for AWS MCP server.\n */\nexport const NX_PLUGIN_MCP_SERVER_COMMAND = 'npx';\n\n/**\n * Package providing the Nx Plugin for AWS MCP server.\n */\nexport const NX_PLUGIN_MCP_PACKAGE_NAME = '@aws/nx-plugin-mcp';\n\n/**\n * Arguments used to launch the Nx Plugin for AWS MCP server.\n *\n * npx prefers a locally installed package over the registry, and generators\n * declare this package as a workspace devDependency, so the server tracks the\n * version in the workspace's lockfile. `-y` falls back to fetching from the\n * registry for a workspace where it isn't installed.\n */\nexport const NX_PLUGIN_MCP_SERVER_ARGS = ['-y', NX_PLUGIN_MCP_PACKAGE_NAME];\n\n/**\n * A single stdio MCP server entry, shared by agents that use the `mcpServers` config shape.\n */\nconst stdioServerEntry = () => ({\n  command: NX_PLUGIN_MCP_SERVER_COMMAND,\n  args: NX_PLUGIN_MCP_SERVER_ARGS,\n});\n\n/**\n * Merge the Nx Plugin for AWS MCP server into a JSON config file under the given key,\n * preserving any other servers already configured. Creates the file if it does not exist.\n */\nconst mergeJsonMcpConfig = (\n  tree: Tree,\n  filePath: string,\n  key: 'mcpServers' | 'servers',\n  entry: Record<string, unknown>,\n) => {\n  const config = tree.exists(filePath) ? readJson(tree, filePath) : {};\n  config[key] = {\n    ...config[key],\n    [NX_PLUGIN_MCP_SERVER_NAME]: entry,\n  };\n  writeJson(tree, filePath, config);\n};\n\n/**\n * Configure the Nx Plugin for AWS MCP server across the project-level config locations\n * used by common coding agents, so agents working in the workspace can use it to scaffold\n * AWS projects with the Nx Plugin for AWS.\n *\n * Existing servers and unrelated config in each file are preserved.\n */\nexport const configureMcpServers = (tree: Tree) => {\n  // Agents using the `mcpServers` config shape (Claude Code, Cursor, Kiro, Gemini CLI)\n  const mcpServersFiles = [\n    '.mcp.json', // Claude Code\n    '.cursor/mcp.json', // Cursor\n    '.kiro/settings/mcp.json', // Kiro\n    '.gemini/settings.json', // Gemini CLI\n  ];\n  for (const filePath of mcpServersFiles) {\n    mergeJsonMcpConfig(tree, filePath, 'mcpServers', stdioServerEntry());\n  }\n\n  // GitHub Copilot uses the `servers` key with an explicit `type`\n  mergeJsonMcpConfig(tree, '.vscode/mcp.json', 'servers', {\n    type: 'stdio',\n    ...stdioServerEntry(),\n  });\n\n  // OpenAI Codex CLI uses TOML under the `mcp_servers` table\n  const codexConfig = '.codex/config.toml';\n  if (!tree.exists(codexConfig)) {\n    tree.write(codexConfig, '');\n  }\n  updateToml(tree, codexConfig, (prev) => ({\n    ...prev,\n    mcp_servers: {\n      ...(prev.mcp_servers as object),\n      [NX_PLUGIN_MCP_SERVER_NAME]: {\n        command: NX_PLUGIN_MCP_SERVER_COMMAND,\n        args: NX_PLUGIN_MCP_SERVER_ARGS,\n      },\n    },\n  }));\n};\n"],"names":["readJson","writeJson","updateToml","NX_PLUGIN_MCP_SERVER_NAME","NX_PLUGIN_MCP_SERVER_COMMAND","NX_PLUGIN_MCP_PACKAGE_NAME","NX_PLUGIN_MCP_SERVER_ARGS","stdioServerEntry","command","args","mergeJsonMcpConfig","tree","filePath","key","entry","config","exists","configureMcpServers","mcpServersFiles","type","codexConfig","write","prev","mcp_servers"],"mappings":"AAAA;;;CAGC,GACD,SAASA,QAAQ,EAAaC,SAAS,QAAQ,aAAa;AAC5D,SAASC,UAAU,QAAQ,YAAS;AAEpC;;CAEC,GACD,OAAO,MAAMC,4BAA4B,oBAAoB;AAE7D;;CAEC,GACD,OAAO,MAAMC,+BAA+B,MAAM;AAElD;;CAEC,GACD,OAAO,MAAMC,6BAA6B,qBAAqB;AAE/D;;;;;;;CAOC,GACD,OAAO,MAAMC,4BAA4B;IAAC;IAAMD;CAA2B,CAAC;AAE5E;;CAEC,GACD,MAAME,mBAAmB,IAAO,CAAA;QAC9BC,SAASJ;QACTK,MAAMH;IACR,CAAA;AAEA;;;CAGC,GACD,MAAMI,qBAAqB,CACzBC,MACAC,UACAC,KACAC;IAEA,MAAMC,SAASJ,KAAKK,MAAM,CAACJ,YAAYZ,SAASW,MAAMC,YAAY,CAAC;IACnEG,MAAM,CAACF,IAAI,GAAG;QACZ,GAAGE,MAAM,CAACF,IAAI;QACd,CAACV,0BAA0B,EAAEW;IAC/B;IACAb,UAAUU,MAAMC,UAAUG;AAC5B;AAEA;;;;;;CAMC,GACD,OAAO,MAAME,sBAAsB,CAACN;IAClC,qFAAqF;IACrF,MAAMO,kBAAkB;QACtB;QACA;QACA;QACA;KACD;IACD,KAAK,MAAMN,YAAYM,gBAAiB;QACtCR,mBAAmBC,MAAMC,UAAU,cAAcL;IACnD;IAEA,gEAAgE;IAChEG,mBAAmBC,MAAM,oBAAoB,WAAW;QACtDQ,MAAM;QACN,GAAGZ,kBAAkB;IACvB;IAEA,2DAA2D;IAC3D,MAAMa,cAAc;IACpB,IAAI,CAACT,KAAKK,MAAM,CAACI,cAAc;QAC7BT,KAAKU,KAAK,CAACD,aAAa;IAC1B;IACAlB,WAAWS,MAAMS,aAAa,CAACE,OAAU,CAAA;YACvC,GAAGA,IAAI;YACPC,aAAa;gBACX,GAAID,KAAKC,WAAW;gBACpB,CAACpB,0BAA0B,EAAE;oBAC3BK,SAASJ;oBACTK,MAAMH;gBACR;YACF;QACF,CAAA;AACF,EAAE"}

package/src/utils/nx.d.ts

@@ -16,6 +16,19 @@ export declare const listGenerators: (includeHidden?: boolean) => GeneratorInfo[
  */
 export declare const getGeneratorInfo: (generatorFileName: string) => GeneratorInfo;
 export declare const getPackageVersion: () => string;
+/**
+ * The `@aws/nx-plugin` devDependency entry for a workspace the plugin generates
+ * into, keyed to the version the running generators come from. Empty inside the
+ * plugin's own monorepo.
+ */
+export declare const nxPluginSelfDependency: (tree: Tree) => Record<string, string>;
+/**
+ * The `@aws/nx-plugin-mcp` devDependency entry, keyed to the running generators'
+ * version — the two packages are released in lockstep. Declaring it pins the MCP
+ * server the vended config runs in the workspace's lockfile, so upgrading it
+ * upgrades the server. Empty inside the plugin's own monorepo.
+ */
+export declare const nxPluginMcpDependency: (tree: Tree) => Record<string, string>;
 /**
  * Read a project configuration where the project name may not be fully qualified (ie may omit the scope prefix)
  */

package/src/utils/nx.js

@@ -1,11 +1,12 @@
 /**
  * Copyright Amazon.com, Inc. or its affiliates. All Rights Reserved.
  * SPDX-License-Identifier: Apache-2.0
- */ import { getProjects, readProjectConfiguration, updateProjectConfiguration } from "@nx/devkit";
+ */ import { getProjects, readJson, readProjectConfiguration, updateProjectConfiguration } from "@nx/devkit";
 import * as path from "path";
 import PackageJson from "../../package.json" with {
     type: 'json'
 };
+import { NX_PLUGIN_MCP_PACKAGE_NAME } from "./mcp.js";
 import { toSnakeCase } from "./names.js";
 import { getNpmScope, getNpmScopePrefix } from "./npm-scope.js";
 export { buildGeneratorInfoList } from "./generators.js";
@@ -25,6 +26,28 @@ const GENERATORS = buildGeneratorInfoList(path.resolve(import.meta.dirname, '..'
 export const getPackageVersion = ()=>{
     return PackageJson.version;
 };
+/**
+ * True inside the plugin's own monorepo, where the plugin is the source rather
+ * than a dependency.
+ */ const isNxPluginForAwsWorkspace = (tree)=>{
+    const rootPackageJson = tree.exists('package.json') ? readJson(tree, 'package.json') : undefined;
+    return rootPackageJson?.name === '@aws/nx-plugin-source';
+};
+/**
+ * The `@aws/nx-plugin` devDependency entry for a workspace the plugin generates
+ * into, keyed to the version the running generators come from. Empty inside the
+ * plugin's own monorepo.
+ */ export const nxPluginSelfDependency = (tree)=>isNxPluginForAwsWorkspace(tree) ? {} : {
+        [PackageJson.name]: `^${PackageJson.version}`
+    };
+/**
+ * The `@aws/nx-plugin-mcp` devDependency entry, keyed to the running generators'
+ * version — the two packages are released in lockstep. Declaring it pins the MCP
+ * server the vended config runs in the workspace's lockfile, so upgrading it
+ * upgrades the server. Empty inside the plugin's own monorepo.
+ */ export const nxPluginMcpDependency = (tree)=>isNxPluginForAwsWorkspace(tree) ? {} : {
+        [NX_PLUGIN_MCP_PACKAGE_NAME]: `^${PackageJson.version}`
+    };
 /**
  * Read a project configuration where the project name may not be fully qualified (ie may omit the scope prefix)
  */ export const readProjectConfigurationUnqualified = (tree, projectName)=>{

package/src/utils/nx.js.map

@@ -1 +1 @@
-{"version":3,"sources":["../../../../../packages/nx-plugin/src/utils/nx.ts"],"sourcesContent":["/**\n * Copyright Amazon.com, Inc. or its affiliates. All Rights Reserved.\n * SPDX-License-Identifier: Apache-2.0\n */\nimport {\n  getProjects,\n  type ProjectConfiguration,\n  readProjectConfiguration,\n  type TargetConfiguration,\n  type TargetDefaultValue,\n  type Tree,\n  updateProjectConfiguration,\n} from '@nx/devkit';\nimport * as path from 'path';\nimport PackageJson from '../../package.json' with { type: 'json' };\nimport { toSnakeCase } from './names';\nimport { getNpmScope, getNpmScopePrefix } from './npm-scope';\n\nexport type { GeneratorInfo, NxGeneratorInfo } from './generators';\nexport { buildGeneratorInfoList } from './generators';\n\nimport { buildGeneratorInfoList, type GeneratorInfo } from './generators';\n\nconst GENERATORS = buildGeneratorInfoList(\n  path.resolve(import.meta.dirname, '..', '..'),\n);\n\n/**\n * List Nx Plugin for AWS generators\n * @param includeHidden include hidden generators (default false)\n */\nexport const listGenerators = (includeHidden = false) =>\n  GENERATORS.filter((g) => includeHidden || !g.hidden);\n\n/**\n * Return generator information. Call this from a generator method with import.meta.filename\n */\nexport const getGeneratorInfo = (generatorFileName: string): GeneratorInfo => {\n  const { dir, name } = path.parse(path.resolve(generatorFileName));\n  const resolvedFactoryPath = path.join(dir, name);\n  return GENERATORS.find(\n    (generatorInfo) =>\n      generatorInfo.resolvedFactoryPath === resolvedFactoryPath,\n  );\n};\n\nexport const getPackageVersion = () => {\n  return PackageJson.version;\n};\n\n/**\n * Read a project configuration where the project name may not be fully qualified (ie may omit the scope prefix)\n */\nexport const readProjectConfigurationUnqualified = (\n  tree: Tree,\n  projectName: string,\n) => {\n  try {\n    return readProjectConfiguration(tree, projectName);\n  } catch (e) {\n    // Attempt to find the project without the scope\n    const project = [...getProjects(tree).values()].find(\n      (p) =>\n        p.name &&\n        (p.name === `${getNpmScopePrefix(tree)}${projectName}` || // TypeScript fully-qualified name\n          p.name === `${toSnakeCase(getNpmScope(tree))}.${projectName}`), // Python fully-qualified name\n    );\n    if (project) {\n      return project;\n    }\n    throw e;\n  }\n};\n\n/**\n * Returns whether a project with the given name already exists in the workspace.\n * The project name may be unqualified (ie may omit the scope prefix).\n */\nexport const projectExists = (tree: Tree, projectName: string): boolean => {\n  try {\n    readProjectConfigurationUnqualified(tree, projectName);\n    return true;\n  } catch {\n    return false;\n  }\n};\n\n/**\n * Add metadata about the generator that generated the project to the project.json\n */\nexport const addGeneratorMetadata = (\n  tree: Tree,\n  projectName: string,\n  info: { id: string },\n  additionalMetadata?: { [key: string]: any },\n) => {\n  const config = readProjectConfigurationUnqualified(tree, projectName);\n  const metadata = {\n    ...config?.metadata,\n    generator: info.id,\n    ...additionalMetadata,\n  };\n  // Skip the write when nothing changed so re-running doesn't reserialize\n  // project.json. metadata is plain JSON built in a fixed key order, so a\n  // stringify comparison is exact here.\n  if (JSON.stringify(config?.metadata) === JSON.stringify(metadata)) {\n    return;\n  }\n  // Place metadata immediately before targets so the serialized key order is\n  // identical whether or not metadata already existed (matching the order Nx\n  // normalizes a read config to), keeping the change a pure metadata insert.\n  const { targets, ...rest } = config;\n  updateProjectConfiguration(tree, config.name, {\n    ...rest,\n    metadata: metadata as any,\n    ...(targets ? { targets } : {}),\n  });\n};\n\n/**\n * Represents a component entry in project metadata\n */\nexport interface ComponentMetadata {\n  readonly generator: string;\n  readonly name?: string;\n  readonly path?: string;\n  [key: string]: any;\n}\n\n/**\n * Add metadata about the generator that generated the component to the project.json\n */\nexport const addComponentGeneratorMetadata = (\n  tree: Tree,\n  projectName: string,\n  info: { id: string },\n  componentPath: string,\n  componentName?: string,\n  additionalMetadata?: { [key: string]: any },\n) => {\n  const config = readProjectConfigurationUnqualified(tree, projectName);\n\n  const existingComponents = (config?.metadata as any)?.components ?? [];\n  const alreadyAdded = existingComponents.filter(\n    (c: any) => c.generator === info.id && c.name === componentName,\n  );\n\n  if (alreadyAdded.length === 0) {\n    const componentMetadata: ComponentMetadata = {\n      generator: info.id,\n      path: componentPath,\n      ...(componentName ? { name: componentName } : {}),\n      ...additionalMetadata,\n    };\n    // Place metadata before targets for a stable serialized key order.\n    const { targets, ...rest } = config;\n    updateProjectConfiguration(tree, config.name, {\n      ...rest,\n      metadata: {\n        ...config?.metadata,\n        components: [...existingComponents, componentMetadata],\n      } as any,\n      ...(targets ? { targets } : {}),\n    });\n  }\n};\n\n/**\n * Merge a generator's own config into an `nx.json` `targetDefaults` value,\n * preserving whatever the workspace already had. `apply` receives the config to\n * layer onto and returns the merged config (e.g. `(base) => ({ cache: true,\n * ...base })`); it must be idempotent so re-running the generator is a no-op.\n *\n * Nx 23.1 widened each value to either a config object or an ordered array of\n * filtered entries. The plugin only contributes unfiltered (catch-all) config,\n * so the input's shape is preserved: an object (or unset) stays an object;\n * an array keeps the user's filtered entries and `apply` merges into its first\n * unfiltered entry, prepending one as the base if none exists (Nx layers later\n * matches on top, so our catch-all must stay first to not override a filter).\n */\nexport const mergeTargetDefault = (\n  value: TargetDefaultValue | undefined,\n  apply: (base: Partial<TargetConfiguration>) => Partial<TargetConfiguration>,\n): TargetDefaultValue => {\n  if (!Array.isArray(value)) {\n    return apply(value ?? {});\n  }\n  const catchAllIndex = value.findIndex((entry) => entry.filter === undefined);\n  if (catchAllIndex === -1) {\n    return [apply({}), ...value];\n  }\n  return value.map((entry, index) =>\n    index === catchAllIndex ? apply(entry) : entry,\n  );\n};\n\n/**\n * A single entry in an Nx `dependsOn` array.\n * Matches the shape accepted by Nx without requiring a devkit type import.\n */\nexport type TargetDependency =\n  | string\n  | {\n      projects?: string | string[];\n      target: string;\n      params?: 'ignore' | 'forward';\n    };\n\nconst targetDependencyEquals = (a: TargetDependency, b: TargetDependency) => {\n  if (typeof a === 'string' || typeof b === 'string') {\n    return a === b;\n  }\n  if (a.target !== b.target || a.params !== b.params) {\n    return false;\n  }\n  const aProjects = Array.isArray(a.projects)\n    ? a.projects\n    : a.projects !== undefined\n      ? [a.projects]\n      : [];\n  const bProjects = Array.isArray(b.projects)\n    ? b.projects\n    : b.projects !== undefined\n      ? [b.projects]\n      : [];\n  if (aProjects.length !== bProjects.length) {\n    return false;\n  }\n  return aProjects.every((p, i) => p === bProjects[i]);\n};\n\n// The order target properties are authored in. Nx preserves a target's\n// authored key order when it reads then rewrites an existing project.json,\n// except `options` and `configurations`, which it always moves to the end (in\n// that order). Keeping `options`/`configurations` last here therefore makes a\n// generator's first-run output byte-identical to subsequent runs (idempotency);\n// the remaining keys are ordered to read intuitively.\nconst NX_TARGET_KEY_ORDER = [\n  'executor',\n  'dependsOn',\n  'continuous',\n  'cache',\n  'inputs',\n  'outputs',\n  'metadata',\n  'defaultConfiguration',\n  'options',\n  'configurations',\n];\n\n/**\n * Reorder a target's keys to match Nx's own serialization order. Nx reorders\n * target properties when it rewrites an existing project.json, so applying the\n * same order when first authoring a target keeps generators idempotent.\n */\nexport const normalizeTargetKeyOrder = <T extends object>(target: T): T =>\n  Object.fromEntries(\n    Object.entries(target as Record<string, unknown>).sort(([a], [b]) => {\n      const ai = NX_TARGET_KEY_ORDER.indexOf(a);\n      const bi = NX_TARGET_KEY_ORDER.indexOf(b);\n      return (\n        (ai === -1 ? NX_TARGET_KEY_ORDER.length : ai) -\n        (bi === -1 ? NX_TARGET_KEY_ORDER.length : bi)\n      );\n    }),\n  ) as T;\n\n/**\n * Mutate the project to add the dependency to the target if not already present\n * Adds the target if not present.\n *\n * Accepts either a string target name (e.g. `'build'`) or a dependency config\n * object (e.g. `{ projects: ['foo'], target: 'dev' }`). Deduplicates\n * using deep equality so re-running a generator does not grow `dependsOn`.\n */\nexport const addDependencyToTargetIfNotPresent = (\n  project: ProjectConfiguration,\n  target: string,\n  dependency: TargetDependency,\n) => {\n  project.targets ??= {};\n  project.targets[target] ??= {};\n  project.targets[target].dependsOn ??= [];\n  const dependsOn = project.targets[target].dependsOn;\n  // Leave existing dependencies in place so re-running does not reorder them;\n  // only append when the dependency is genuinely absent.\n  if (!dependsOn.some((d) => targetDependencyEquals(d, dependency))) {\n    dependsOn.push(dependency);\n  }\n  // Keep key order aligned with Nx's so first run matches subsequent runs.\n  project.targets[target] = normalizeTargetKeyOrder(project.targets[target]);\n};\n\n/**\n * Register a component's `<name>-dev` target under the project-level `dev`\n * target, so `nx run <project>:dev` starts every component in the project.\n *\n * Component generators author their own continuous `<name>-dev` runner and call\n * this to aggregate it. Every component added to the project accumulates its\n * `<name>-dev` under `dev`. Nx keys tasks by `project:target`, so any\n * dependencies shared between components run exactly once.\n */\nexport const addComponentDevTarget = (\n  targets: Record<string, ProjectConfiguration['targets'][string]>,\n  componentDevTargetName: string,\n) => {\n  targets['dev'] ??= { continuous: true, dependsOn: [] };\n  const projectDev = targets['dev'];\n  projectDev.continuous = true;\n  projectDev.dependsOn ??= [];\n  // Append in component-creation order; dedupe keeps re-runs idempotent.\n  if (!projectDev.dependsOn.includes(componentDevTargetName)) {\n    projectDev.dependsOn.push(componentDevTargetName);\n  }\n  targets['dev'] = normalizeTargetKeyOrder(projectDev);\n};\n"],"names":["getProjects","readProjectConfiguration","updateProjectConfiguration","path","PackageJson","type","toSnakeCase","getNpmScope","getNpmScopePrefix","buildGeneratorInfoList","GENERATORS","resolve","dirname","listGenerators","includeHidden","filter","g","hidden","getGeneratorInfo","generatorFileName","dir","name","parse","resolvedFactoryPath","join","find","generatorInfo","getPackageVersion","version","readProjectConfigurationUnqualified","tree","projectName","e","project","values","p","projectExists","addGeneratorMetadata","info","additionalMetadata","config","metadata","generator","id","JSON","stringify","targets","rest","addComponentGeneratorMetadata","componentPath","componentName","existingComponents","components","alreadyAdded","c","length","componentMetadata","mergeTargetDefault","value","apply","Array","isArray","catchAllIndex","findIndex","entry","undefined","map","index","targetDependencyEquals","a","b","target","params","aProjects","projects","bProjects","every","i","NX_TARGET_KEY_ORDER","normalizeTargetKeyOrder","Object","fromEntries","entries","sort","ai","indexOf","bi","addDependencyToTargetIfNotPresent","dependency","dependsOn","some","d","push","addComponentDevTarget","componentDevTargetName","continuous","projectDev","includes"],"mappings":"AAAA;;;CAGC,GACD,SACEA,WAAW,EAEXC,wBAAwB,EAIxBC,0BAA0B,QACrB,aAAa;AACpB,YAAYC,UAAU,OAAO;AAC7B,OAAOC,iBAAiB,0BAA0B;IAAEC,MAAM;AAAO,EAAE;AACnE,SAASC,WAAW,QAAQ,aAAU;AACtC,SAASC,WAAW,EAAEC,iBAAiB,QAAQ,iBAAc;AAG7D,SAASC,sBAAsB,QAAQ,kBAAe;AAEtD,SAASA,sBAAsB,QAA4B,kBAAe;AAE1E,MAAMC,aAAaD,uBACjBN,KAAKQ,OAAO,CAAC,YAAYC,OAAO,EAAE,MAAM;AAG1C;;;CAGC,GACD,OAAO,MAAMC,iBAAiB,CAACC,gBAAgB,KAAK,GAClDJ,WAAWK,MAAM,CAAC,CAACC,IAAMF,iBAAiB,CAACE,EAAEC,MAAM,EAAE;AAEvD;;CAEC,GACD,OAAO,MAAMC,mBAAmB,CAACC;IAC/B,MAAM,EAAEC,GAAG,EAAEC,IAAI,EAAE,GAAGlB,KAAKmB,KAAK,CAACnB,KAAKQ,OAAO,CAACQ;IAC9C,MAAMI,sBAAsBpB,KAAKqB,IAAI,CAACJ,KAAKC;IAC3C,OAAOX,WAAWe,IAAI,CACpB,CAACC,gBACCA,cAAcH,mBAAmB,KAAKA;AAE5C,EAAE;AAEF,OAAO,MAAMI,oBAAoB;IAC/B,OAAOvB,YAAYwB,OAAO;AAC5B,EAAE;AAEF;;CAEC,GACD,OAAO,MAAMC,sCAAsC,CACjDC,MACAC;IAEA,IAAI;QACF,OAAO9B,yBAAyB6B,MAAMC;IACxC,EAAE,OAAOC,GAAG;QACV,gDAAgD;QAChD,MAAMC,UAAU;eAAIjC,YAAY8B,MAAMI,MAAM;SAAG,CAACT,IAAI,CAClD,CAACU,IACCA,EAAEd,IAAI,IACLc,CAAAA,EAAEd,IAAI,KAAK,GAAGb,kBAAkBsB,QAAQC,aAAa,IAAI,kCAAkC;YAC1FI,EAAEd,IAAI,KAAK,GAAGf,YAAYC,YAAYuB,OAAO,CAAC,EAAEC,aAAa,AAAD;QAElE,IAAIE,SAAS;YACX,OAAOA;QACT;QACA,MAAMD;IACR;AACF,EAAE;AAEF;;;CAGC,GACD,OAAO,MAAMI,gBAAgB,CAACN,MAAYC;IACxC,IAAI;QACFF,oCAAoCC,MAAMC;QAC1C,OAAO;IACT,EAAE,OAAM;QACN,OAAO;IACT;AACF,EAAE;AAEF;;CAEC,GACD,OAAO,MAAMM,uBAAuB,CAClCP,MACAC,aACAO,MACAC;IAEA,MAAMC,SAASX,oCAAoCC,MAAMC;IACzD,MAAMU,WAAW;QACf,GAAGD,QAAQC,QAAQ;QACnBC,WAAWJ,KAAKK,EAAE;QAClB,GAAGJ,kBAAkB;IACvB;IACA,wEAAwE;IACxE,wEAAwE;IACxE,sCAAsC;IACtC,IAAIK,KAAKC,SAAS,CAACL,QAAQC,cAAcG,KAAKC,SAAS,CAACJ,WAAW;QACjE;IACF;IACA,2EAA2E;IAC3E,2EAA2E;IAC3E,2EAA2E;IAC3E,MAAM,EAAEK,OAAO,EAAE,GAAGC,MAAM,GAAGP;IAC7BtC,2BAA2B4B,MAAMU,OAAOnB,IAAI,EAAE;QAC5C,GAAG0B,IAAI;QACPN,UAAUA;QACV,GAAIK,UAAU;YAAEA;QAAQ,IAAI,CAAC,CAAC;IAChC;AACF,EAAE;AAYF;;CAEC,GACD,OAAO,MAAME,gCAAgC,CAC3ClB,MACAC,aACAO,MACAW,eACAC,eACAX;IAEA,MAAMC,SAASX,oCAAoCC,MAAMC;IAEzD,MAAMoB,qBAAqB,AAACX,QAAQC,UAAkBW,cAAc,EAAE;IACtE,MAAMC,eAAeF,mBAAmBpC,MAAM,CAC5C,CAACuC,IAAWA,EAAEZ,SAAS,KAAKJ,KAAKK,EAAE,IAAIW,EAAEjC,IAAI,KAAK6B;IAGpD,IAAIG,aAAaE,MAAM,KAAK,GAAG;QAC7B,MAAMC,oBAAuC;YAC3Cd,WAAWJ,KAAKK,EAAE;YAClBxC,MAAM8C;YACN,GAAIC,gBAAgB;gBAAE7B,MAAM6B;YAAc,IAAI,CAAC,CAAC;YAChD,GAAGX,kBAAkB;QACvB;QACA,mEAAmE;QACnE,MAAM,EAAEO,OAAO,EAAE,GAAGC,MAAM,GAAGP;QAC7BtC,2BAA2B4B,MAAMU,OAAOnB,IAAI,EAAE;YAC5C,GAAG0B,IAAI;YACPN,UAAU;gBACR,GAAGD,QAAQC,QAAQ;gBACnBW,YAAY;uBAAID;oBAAoBK;iBAAkB;YACxD;YACA,GAAIV,UAAU;gBAAEA;YAAQ,IAAI,CAAC,CAAC;QAChC;IACF;AACF,EAAE;AAEF;;;;;;;;;;;;CAYC,GACD,OAAO,MAAMW,qBAAqB,CAChCC,OACAC;IAEA,IAAI,CAACC,MAAMC,OAAO,CAACH,QAAQ;QACzB,OAAOC,MAAMD,SAAS,CAAC;IACzB;IACA,MAAMI,gBAAgBJ,MAAMK,SAAS,CAAC,CAACC,QAAUA,MAAMjD,MAAM,KAAKkD;IAClE,IAAIH,kBAAkB,CAAC,GAAG;QACxB,OAAO;YAACH,MAAM,CAAC;eAAOD;SAAM;IAC9B;IACA,OAAOA,MAAMQ,GAAG,CAAC,CAACF,OAAOG,QACvBA,UAAUL,gBAAgBH,MAAMK,SAASA;AAE7C,EAAE;AAcF,MAAMI,yBAAyB,CAACC,GAAqBC;IACnD,IAAI,OAAOD,MAAM,YAAY,OAAOC,MAAM,UAAU;QAClD,OAAOD,MAAMC;IACf;IACA,IAAID,EAAEE,MAAM,KAAKD,EAAEC,MAAM,IAAIF,EAAEG,MAAM,KAAKF,EAAEE,MAAM,EAAE;QAClD,OAAO;IACT;IACA,MAAMC,YAAYb,MAAMC,OAAO,CAACQ,EAAEK,QAAQ,IACtCL,EAAEK,QAAQ,GACVL,EAAEK,QAAQ,KAAKT,YACb;QAACI,EAAEK,QAAQ;KAAC,GACZ,EAAE;IACR,MAAMC,YAAYf,MAAMC,OAAO,CAACS,EAAEI,QAAQ,IACtCJ,EAAEI,QAAQ,GACVJ,EAAEI,QAAQ,KAAKT,YACb;QAACK,EAAEI,QAAQ;KAAC,GACZ,EAAE;IACR,IAAID,UAAUlB,MAAM,KAAKoB,UAAUpB,MAAM,EAAE;QACzC,OAAO;IACT;IACA,OAAOkB,UAAUG,KAAK,CAAC,CAACzC,GAAG0C,IAAM1C,MAAMwC,SAAS,CAACE,EAAE;AACrD;AAEA,uEAAuE;AACvE,2EAA2E;AAC3E,8EAA8E;AAC9E,8EAA8E;AAC9E,gFAAgF;AAChF,sDAAsD;AACtD,MAAMC,sBAAsB;IAC1B;IACA;IACA;IACA;IACA;IACA;IACA;IACA;IACA;IACA;CACD;AAED;;;;CAIC,GACD,OAAO,MAAMC,0BAA0B,CAAmBR,SACxDS,OAAOC,WAAW,CAChBD,OAAOE,OAAO,CAACX,QAAmCY,IAAI,CAAC,CAAC,CAACd,EAAE,EAAE,CAACC,EAAE;QAC9D,MAAMc,KAAKN,oBAAoBO,OAAO,CAAChB;QACvC,MAAMiB,KAAKR,oBAAoBO,OAAO,CAACf;QACvC,OACE,AAACc,CAAAA,OAAO,CAAC,IAAIN,oBAAoBvB,MAAM,GAAG6B,EAAC,IAC1CE,CAAAA,OAAO,CAAC,IAAIR,oBAAoBvB,MAAM,GAAG+B,EAAC;IAE/C,IACK;AAET;;;;;;;CAOC,GACD,OAAO,MAAMC,oCAAoC,CAC/CtD,SACAsC,QACAiB;IAEAvD,QAAQa,OAAO,KAAK,CAAC;IACrBb,QAAQa,OAAO,CAACyB,OAAO,KAAK,CAAC;IAC7BtC,QAAQa,OAAO,CAACyB,OAAO,CAACkB,SAAS,KAAK,EAAE;IACxC,MAAMA,YAAYxD,QAAQa,OAAO,CAACyB,OAAO,CAACkB,SAAS;IACnD,4EAA4E;IAC5E,uDAAuD;IACvD,IAAI,CAACA,UAAUC,IAAI,CAAC,CAACC,IAAMvB,uBAAuBuB,GAAGH,cAAc;QACjEC,UAAUG,IAAI,CAACJ;IACjB;IACA,yEAAyE;IACzEvD,QAAQa,OAAO,CAACyB,OAAO,GAAGQ,wBAAwB9C,QAAQa,OAAO,CAACyB,OAAO;AAC3E,EAAE;AAEF;;;;;;;;CAQC,GACD,OAAO,MAAMsB,wBAAwB,CACnC/C,SACAgD;IAEAhD,OAAO,CAAC,MAAM,KAAK;QAAEiD,YAAY;QAAMN,WAAW,EAAE;IAAC;IACrD,MAAMO,aAAalD,OAAO,CAAC,MAAM;IACjCkD,WAAWD,UAAU,GAAG;IACxBC,WAAWP,SAAS,KAAK,EAAE;IAC3B,uEAAuE;IACvE,IAAI,CAACO,WAAWP,SAAS,CAACQ,QAAQ,CAACH,yBAAyB;QAC1DE,WAAWP,SAAS,CAACG,IAAI,CAACE;IAC5B;IACAhD,OAAO,CAAC,MAAM,GAAGiC,wBAAwBiB;AAC3C,EAAE"}
+{"version":3,"sources":["../../../../../packages/nx-plugin/src/utils/nx.ts"],"sourcesContent":["/**\n * Copyright Amazon.com, Inc. or its affiliates. All Rights Reserved.\n * SPDX-License-Identifier: Apache-2.0\n */\nimport {\n  getProjects,\n  type ProjectConfiguration,\n  readJson,\n  readProjectConfiguration,\n  type TargetConfiguration,\n  type TargetDefaultValue,\n  type Tree,\n  updateProjectConfiguration,\n} from '@nx/devkit';\nimport * as path from 'path';\nimport PackageJson from '../../package.json' with { type: 'json' };\nimport { NX_PLUGIN_MCP_PACKAGE_NAME } from './mcp';\nimport { toSnakeCase } from './names';\nimport { getNpmScope, getNpmScopePrefix } from './npm-scope';\n\nexport type { GeneratorInfo, NxGeneratorInfo } from './generators';\nexport { buildGeneratorInfoList } from './generators';\n\nimport { buildGeneratorInfoList, type GeneratorInfo } from './generators';\n\nconst GENERATORS = buildGeneratorInfoList(\n  path.resolve(import.meta.dirname, '..', '..'),\n);\n\n/**\n * List Nx Plugin for AWS generators\n * @param includeHidden include hidden generators (default false)\n */\nexport const listGenerators = (includeHidden = false) =>\n  GENERATORS.filter((g) => includeHidden || !g.hidden);\n\n/**\n * Return generator information. Call this from a generator method with import.meta.filename\n */\nexport const getGeneratorInfo = (generatorFileName: string): GeneratorInfo => {\n  const { dir, name } = path.parse(path.resolve(generatorFileName));\n  const resolvedFactoryPath = path.join(dir, name);\n  return GENERATORS.find(\n    (generatorInfo) =>\n      generatorInfo.resolvedFactoryPath === resolvedFactoryPath,\n  );\n};\n\nexport const getPackageVersion = () => {\n  return PackageJson.version;\n};\n\n/**\n * True inside the plugin's own monorepo, where the plugin is the source rather\n * than a dependency.\n */\nconst isNxPluginForAwsWorkspace = (tree: Tree): boolean => {\n  const rootPackageJson = tree.exists('package.json')\n    ? readJson(tree, 'package.json')\n    : undefined;\n  return rootPackageJson?.name === '@aws/nx-plugin-source';\n};\n\n/**\n * The `@aws/nx-plugin` devDependency entry for a workspace the plugin generates\n * into, keyed to the version the running generators come from. Empty inside the\n * plugin's own monorepo.\n */\nexport const nxPluginSelfDependency = (tree: Tree): Record<string, string> =>\n  isNxPluginForAwsWorkspace(tree)\n    ? {}\n    : { [PackageJson.name]: `^${PackageJson.version}` };\n\n/**\n * The `@aws/nx-plugin-mcp` devDependency entry, keyed to the running generators'\n * version — the two packages are released in lockstep. Declaring it pins the MCP\n * server the vended config runs in the workspace's lockfile, so upgrading it\n * upgrades the server. Empty inside the plugin's own monorepo.\n */\nexport const nxPluginMcpDependency = (tree: Tree): Record<string, string> =>\n  isNxPluginForAwsWorkspace(tree)\n    ? {}\n    : { [NX_PLUGIN_MCP_PACKAGE_NAME]: `^${PackageJson.version}` };\n\n/**\n * Read a project configuration where the project name may not be fully qualified (ie may omit the scope prefix)\n */\nexport const readProjectConfigurationUnqualified = (\n  tree: Tree,\n  projectName: string,\n) => {\n  try {\n    return readProjectConfiguration(tree, projectName);\n  } catch (e) {\n    // Attempt to find the project without the scope\n    const project = [...getProjects(tree).values()].find(\n      (p) =>\n        p.name &&\n        (p.name === `${getNpmScopePrefix(tree)}${projectName}` || // TypeScript fully-qualified name\n          p.name === `${toSnakeCase(getNpmScope(tree))}.${projectName}`), // Python fully-qualified name\n    );\n    if (project) {\n      return project;\n    }\n    throw e;\n  }\n};\n\n/**\n * Returns whether a project with the given name already exists in the workspace.\n * The project name may be unqualified (ie may omit the scope prefix).\n */\nexport const projectExists = (tree: Tree, projectName: string): boolean => {\n  try {\n    readProjectConfigurationUnqualified(tree, projectName);\n    return true;\n  } catch {\n    return false;\n  }\n};\n\n/**\n * Add metadata about the generator that generated the project to the project.json\n */\nexport const addGeneratorMetadata = (\n  tree: Tree,\n  projectName: string,\n  info: { id: string },\n  additionalMetadata?: { [key: string]: any },\n) => {\n  const config = readProjectConfigurationUnqualified(tree, projectName);\n  const metadata = {\n    ...config?.metadata,\n    generator: info.id,\n    ...additionalMetadata,\n  };\n  // Skip the write when nothing changed so re-running doesn't reserialize\n  // project.json. metadata is plain JSON built in a fixed key order, so a\n  // stringify comparison is exact here.\n  if (JSON.stringify(config?.metadata) === JSON.stringify(metadata)) {\n    return;\n  }\n  // Place metadata immediately before targets so the serialized key order is\n  // identical whether or not metadata already existed (matching the order Nx\n  // normalizes a read config to), keeping the change a pure metadata insert.\n  const { targets, ...rest } = config;\n  updateProjectConfiguration(tree, config.name, {\n    ...rest,\n    metadata: metadata as any,\n    ...(targets ? { targets } : {}),\n  });\n};\n\n/**\n * Represents a component entry in project metadata\n */\nexport interface ComponentMetadata {\n  readonly generator: string;\n  readonly name?: string;\n  readonly path?: string;\n  [key: string]: any;\n}\n\n/**\n * Add metadata about the generator that generated the component to the project.json\n */\nexport const addComponentGeneratorMetadata = (\n  tree: Tree,\n  projectName: string,\n  info: { id: string },\n  componentPath: string,\n  componentName?: string,\n  additionalMetadata?: { [key: string]: any },\n) => {\n  const config = readProjectConfigurationUnqualified(tree, projectName);\n\n  const existingComponents = (config?.metadata as any)?.components ?? [];\n  const alreadyAdded = existingComponents.filter(\n    (c: any) => c.generator === info.id && c.name === componentName,\n  );\n\n  if (alreadyAdded.length === 0) {\n    const componentMetadata: ComponentMetadata = {\n      generator: info.id,\n      path: componentPath,\n      ...(componentName ? { name: componentName } : {}),\n      ...additionalMetadata,\n    };\n    // Place metadata before targets for a stable serialized key order.\n    const { targets, ...rest } = config;\n    updateProjectConfiguration(tree, config.name, {\n      ...rest,\n      metadata: {\n        ...config?.metadata,\n        components: [...existingComponents, componentMetadata],\n      } as any,\n      ...(targets ? { targets } : {}),\n    });\n  }\n};\n\n/**\n * Merge a generator's own config into an `nx.json` `targetDefaults` value,\n * preserving whatever the workspace already had. `apply` receives the config to\n * layer onto and returns the merged config (e.g. `(base) => ({ cache: true,\n * ...base })`); it must be idempotent so re-running the generator is a no-op.\n *\n * Nx 23.1 widened each value to either a config object or an ordered array of\n * filtered entries. The plugin only contributes unfiltered (catch-all) config,\n * so the input's shape is preserved: an object (or unset) stays an object;\n * an array keeps the user's filtered entries and `apply` merges into its first\n * unfiltered entry, prepending one as the base if none exists (Nx layers later\n * matches on top, so our catch-all must stay first to not override a filter).\n */\nexport const mergeTargetDefault = (\n  value: TargetDefaultValue | undefined,\n  apply: (base: Partial<TargetConfiguration>) => Partial<TargetConfiguration>,\n): TargetDefaultValue => {\n  if (!Array.isArray(value)) {\n    return apply(value ?? {});\n  }\n  const catchAllIndex = value.findIndex((entry) => entry.filter === undefined);\n  if (catchAllIndex === -1) {\n    return [apply({}), ...value];\n  }\n  return value.map((entry, index) =>\n    index === catchAllIndex ? apply(entry) : entry,\n  );\n};\n\n/**\n * A single entry in an Nx `dependsOn` array.\n * Matches the shape accepted by Nx without requiring a devkit type import.\n */\nexport type TargetDependency =\n  | string\n  | {\n      projects?: string | string[];\n      target: string;\n      params?: 'ignore' | 'forward';\n    };\n\nconst targetDependencyEquals = (a: TargetDependency, b: TargetDependency) => {\n  if (typeof a === 'string' || typeof b === 'string') {\n    return a === b;\n  }\n  if (a.target !== b.target || a.params !== b.params) {\n    return false;\n  }\n  const aProjects = Array.isArray(a.projects)\n    ? a.projects\n    : a.projects !== undefined\n      ? [a.projects]\n      : [];\n  const bProjects = Array.isArray(b.projects)\n    ? b.projects\n    : b.projects !== undefined\n      ? [b.projects]\n      : [];\n  if (aProjects.length !== bProjects.length) {\n    return false;\n  }\n  return aProjects.every((p, i) => p === bProjects[i]);\n};\n\n// The order target properties are authored in. Nx preserves a target's\n// authored key order when it reads then rewrites an existing project.json,\n// except `options` and `configurations`, which it always moves to the end (in\n// that order). Keeping `options`/`configurations` last here therefore makes a\n// generator's first-run output byte-identical to subsequent runs (idempotency);\n// the remaining keys are ordered to read intuitively.\nconst NX_TARGET_KEY_ORDER = [\n  'executor',\n  'dependsOn',\n  'continuous',\n  'cache',\n  'inputs',\n  'outputs',\n  'metadata',\n  'defaultConfiguration',\n  'options',\n  'configurations',\n];\n\n/**\n * Reorder a target's keys to match Nx's own serialization order. Nx reorders\n * target properties when it rewrites an existing project.json, so applying the\n * same order when first authoring a target keeps generators idempotent.\n */\nexport const normalizeTargetKeyOrder = <T extends object>(target: T): T =>\n  Object.fromEntries(\n    Object.entries(target as Record<string, unknown>).sort(([a], [b]) => {\n      const ai = NX_TARGET_KEY_ORDER.indexOf(a);\n      const bi = NX_TARGET_KEY_ORDER.indexOf(b);\n      return (\n        (ai === -1 ? NX_TARGET_KEY_ORDER.length : ai) -\n        (bi === -1 ? NX_TARGET_KEY_ORDER.length : bi)\n      );\n    }),\n  ) as T;\n\n/**\n * Mutate the project to add the dependency to the target if not already present\n * Adds the target if not present.\n *\n * Accepts either a string target name (e.g. `'build'`) or a dependency config\n * object (e.g. `{ projects: ['foo'], target: 'dev' }`). Deduplicates\n * using deep equality so re-running a generator does not grow `dependsOn`.\n */\nexport const addDependencyToTargetIfNotPresent = (\n  project: ProjectConfiguration,\n  target: string,\n  dependency: TargetDependency,\n) => {\n  project.targets ??= {};\n  project.targets[target] ??= {};\n  project.targets[target].dependsOn ??= [];\n  const dependsOn = project.targets[target].dependsOn;\n  // Leave existing dependencies in place so re-running does not reorder them;\n  // only append when the dependency is genuinely absent.\n  if (!dependsOn.some((d) => targetDependencyEquals(d, dependency))) {\n    dependsOn.push(dependency);\n  }\n  // Keep key order aligned with Nx's so first run matches subsequent runs.\n  project.targets[target] = normalizeTargetKeyOrder(project.targets[target]);\n};\n\n/**\n * Register a component's `<name>-dev` target under the project-level `dev`\n * target, so `nx run <project>:dev` starts every component in the project.\n *\n * Component generators author their own continuous `<name>-dev` runner and call\n * this to aggregate it. Every component added to the project accumulates its\n * `<name>-dev` under `dev`. Nx keys tasks by `project:target`, so any\n * dependencies shared between components run exactly once.\n */\nexport const addComponentDevTarget = (\n  targets: Record<string, ProjectConfiguration['targets'][string]>,\n  componentDevTargetName: string,\n) => {\n  targets['dev'] ??= { continuous: true, dependsOn: [] };\n  const projectDev = targets['dev'];\n  projectDev.continuous = true;\n  projectDev.dependsOn ??= [];\n  // Append in component-creation order; dedupe keeps re-runs idempotent.\n  if (!projectDev.dependsOn.includes(componentDevTargetName)) {\n    projectDev.dependsOn.push(componentDevTargetName);\n  }\n  targets['dev'] = normalizeTargetKeyOrder(projectDev);\n};\n"],"names":["getProjects","readJson","readProjectConfiguration","updateProjectConfiguration","path","PackageJson","type","NX_PLUGIN_MCP_PACKAGE_NAME","toSnakeCase","getNpmScope","getNpmScopePrefix","buildGeneratorInfoList","GENERATORS","resolve","dirname","listGenerators","includeHidden","filter","g","hidden","getGeneratorInfo","generatorFileName","dir","name","parse","resolvedFactoryPath","join","find","generatorInfo","getPackageVersion","version","isNxPluginForAwsWorkspace","tree","rootPackageJson","exists","undefined","nxPluginSelfDependency","nxPluginMcpDependency","readProjectConfigurationUnqualified","projectName","e","project","values","p","projectExists","addGeneratorMetadata","info","additionalMetadata","config","metadata","generator","id","JSON","stringify","targets","rest","addComponentGeneratorMetadata","componentPath","componentName","existingComponents","components","alreadyAdded","c","length","componentMetadata","mergeTargetDefault","value","apply","Array","isArray","catchAllIndex","findIndex","entry","map","index","targetDependencyEquals","a","b","target","params","aProjects","projects","bProjects","every","i","NX_TARGET_KEY_ORDER","normalizeTargetKeyOrder","Object","fromEntries","entries","sort","ai","indexOf","bi","addDependencyToTargetIfNotPresent","dependency","dependsOn","some","d","push","addComponentDevTarget","componentDevTargetName","continuous","projectDev","includes"],"mappings":"AAAA;;;CAGC,GACD,SACEA,WAAW,EAEXC,QAAQ,EACRC,wBAAwB,EAIxBC,0BAA0B,QACrB,aAAa;AACpB,YAAYC,UAAU,OAAO;AAC7B,OAAOC,iBAAiB,0BAA0B;IAAEC,MAAM;AAAO,EAAE;AACnE,SAASC,0BAA0B,QAAQ,WAAQ;AACnD,SAASC,WAAW,QAAQ,aAAU;AACtC,SAASC,WAAW,EAAEC,iBAAiB,QAAQ,iBAAc;AAG7D,SAASC,sBAAsB,QAAQ,kBAAe;AAEtD,SAASA,sBAAsB,QAA4B,kBAAe;AAE1E,MAAMC,aAAaD,uBACjBP,KAAKS,OAAO,CAAC,YAAYC,OAAO,EAAE,MAAM;AAG1C;;;CAGC,GACD,OAAO,MAAMC,iBAAiB,CAACC,gBAAgB,KAAK,GAClDJ,WAAWK,MAAM,CAAC,CAACC,IAAMF,iBAAiB,CAACE,EAAEC,MAAM,EAAE;AAEvD;;CAEC,GACD,OAAO,MAAMC,mBAAmB,CAACC;IAC/B,MAAM,EAAEC,GAAG,EAAEC,IAAI,EAAE,GAAGnB,KAAKoB,KAAK,CAACpB,KAAKS,OAAO,CAACQ;IAC9C,MAAMI,sBAAsBrB,KAAKsB,IAAI,CAACJ,KAAKC;IAC3C,OAAOX,WAAWe,IAAI,CACpB,CAACC,gBACCA,cAAcH,mBAAmB,KAAKA;AAE5C,EAAE;AAEF,OAAO,MAAMI,oBAAoB;IAC/B,OAAOxB,YAAYyB,OAAO;AAC5B,EAAE;AAEF;;;CAGC,GACD,MAAMC,4BAA4B,CAACC;IACjC,MAAMC,kBAAkBD,KAAKE,MAAM,CAAC,kBAChCjC,SAAS+B,MAAM,kBACfG;IACJ,OAAOF,iBAAiBV,SAAS;AACnC;AAEA;;;;CAIC,GACD,OAAO,MAAMa,yBAAyB,CAACJ,OACrCD,0BAA0BC,QACtB,CAAC,IACD;QAAE,CAAC3B,YAAYkB,IAAI,CAAC,EAAE,CAAC,CAAC,EAAElB,YAAYyB,OAAO,EAAE;IAAC,EAAE;AAExD;;;;;CAKC,GACD,OAAO,MAAMO,wBAAwB,CAACL,OACpCD,0BAA0BC,QACtB,CAAC,IACD;QAAE,CAACzB,2BAA2B,EAAE,CAAC,CAAC,EAAEF,YAAYyB,OAAO,EAAE;IAAC,EAAE;AAElE;;CAEC,GACD,OAAO,MAAMQ,sCAAsC,CACjDN,MACAO;IAEA,IAAI;QACF,OAAOrC,yBAAyB8B,MAAMO;IACxC,EAAE,OAAOC,GAAG;QACV,gDAAgD;QAChD,MAAMC,UAAU;eAAIzC,YAAYgC,MAAMU,MAAM;SAAG,CAACf,IAAI,CAClD,CAACgB,IACCA,EAAEpB,IAAI,IACLoB,CAAAA,EAAEpB,IAAI,KAAK,GAAGb,kBAAkBsB,QAAQO,aAAa,IAAI,kCAAkC;YAC1FI,EAAEpB,IAAI,KAAK,GAAGf,YAAYC,YAAYuB,OAAO,CAAC,EAAEO,aAAa,AAAD;QAElE,IAAIE,SAAS;YACX,OAAOA;QACT;QACA,MAAMD;IACR;AACF,EAAE;AAEF;;;CAGC,GACD,OAAO,MAAMI,gBAAgB,CAACZ,MAAYO;IACxC,IAAI;QACFD,oCAAoCN,MAAMO;QAC1C,OAAO;IACT,EAAE,OAAM;QACN,OAAO;IACT;AACF,EAAE;AAEF;;CAEC,GACD,OAAO,MAAMM,uBAAuB,CAClCb,MACAO,aACAO,MACAC;IAEA,MAAMC,SAASV,oCAAoCN,MAAMO;IACzD,MAAMU,WAAW;QACf,GAAGD,QAAQC,QAAQ;QACnBC,WAAWJ,KAAKK,EAAE;QAClB,GAAGJ,kBAAkB;IACvB;IACA,wEAAwE;IACxE,wEAAwE;IACxE,sCAAsC;IACtC,IAAIK,KAAKC,SAAS,CAACL,QAAQC,cAAcG,KAAKC,SAAS,CAACJ,WAAW;QACjE;IACF;IACA,2EAA2E;IAC3E,2EAA2E;IAC3E,2EAA2E;IAC3E,MAAM,EAAEK,OAAO,EAAE,GAAGC,MAAM,GAAGP;IAC7B7C,2BAA2B6B,MAAMgB,OAAOzB,IAAI,EAAE;QAC5C,GAAGgC,IAAI;QACPN,UAAUA;QACV,GAAIK,UAAU;YAAEA;QAAQ,IAAI,CAAC,CAAC;IAChC;AACF,EAAE;AAYF;;CAEC,GACD,OAAO,MAAME,gCAAgC,CAC3CxB,MACAO,aACAO,MACAW,eACAC,eACAX;IAEA,MAAMC,SAASV,oCAAoCN,MAAMO;IAEzD,MAAMoB,qBAAqB,AAACX,QAAQC,UAAkBW,cAAc,EAAE;IACtE,MAAMC,eAAeF,mBAAmB1C,MAAM,CAC5C,CAAC6C,IAAWA,EAAEZ,SAAS,KAAKJ,KAAKK,EAAE,IAAIW,EAAEvC,IAAI,KAAKmC;IAGpD,IAAIG,aAAaE,MAAM,KAAK,GAAG;QAC7B,MAAMC,oBAAuC;YAC3Cd,WAAWJ,KAAKK,EAAE;YAClB/C,MAAMqD;YACN,GAAIC,gBAAgB;gBAAEnC,MAAMmC;YAAc,IAAI,CAAC,CAAC;YAChD,GAAGX,kBAAkB;QACvB;QACA,mEAAmE;QACnE,MAAM,EAAEO,OAAO,EAAE,GAAGC,MAAM,GAAGP;QAC7B7C,2BAA2B6B,MAAMgB,OAAOzB,IAAI,EAAE;YAC5C,GAAGgC,IAAI;YACPN,UAAU;gBACR,GAAGD,QAAQC,QAAQ;gBACnBW,YAAY;uBAAID;oBAAoBK;iBAAkB;YACxD;YACA,GAAIV,UAAU;gBAAEA;YAAQ,IAAI,CAAC,CAAC;QAChC;IACF;AACF,EAAE;AAEF;;;;;;;;;;;;CAYC,GACD,OAAO,MAAMW,qBAAqB,CAChCC,OACAC;IAEA,IAAI,CAACC,MAAMC,OAAO,CAACH,QAAQ;QACzB,OAAOC,MAAMD,SAAS,CAAC;IACzB;IACA,MAAMI,gBAAgBJ,MAAMK,SAAS,CAAC,CAACC,QAAUA,MAAMvD,MAAM,KAAKkB;IAClE,IAAImC,kBAAkB,CAAC,GAAG;QACxB,OAAO;YAACH,MAAM,CAAC;eAAOD;SAAM;IAC9B;IACA,OAAOA,MAAMO,GAAG,CAAC,CAACD,OAAOE,QACvBA,UAAUJ,gBAAgBH,MAAMK,SAASA;AAE7C,EAAE;AAcF,MAAMG,yBAAyB,CAACC,GAAqBC;IACnD,IAAI,OAAOD,MAAM,YAAY,OAAOC,MAAM,UAAU;QAClD,OAAOD,MAAMC;IACf;IACA,IAAID,EAAEE,MAAM,KAAKD,EAAEC,MAAM,IAAIF,EAAEG,MAAM,KAAKF,EAAEE,MAAM,EAAE;QAClD,OAAO;IACT;IACA,MAAMC,YAAYZ,MAAMC,OAAO,CAACO,EAAEK,QAAQ,IACtCL,EAAEK,QAAQ,GACVL,EAAEK,QAAQ,KAAK9C,YACb;QAACyC,EAAEK,QAAQ;KAAC,GACZ,EAAE;IACR,MAAMC,YAAYd,MAAMC,OAAO,CAACQ,EAAEI,QAAQ,IACtCJ,EAAEI,QAAQ,GACVJ,EAAEI,QAAQ,KAAK9C,YACb;QAAC0C,EAAEI,QAAQ;KAAC,GACZ,EAAE;IACR,IAAID,UAAUjB,MAAM,KAAKmB,UAAUnB,MAAM,EAAE;QACzC,OAAO;IACT;IACA,OAAOiB,UAAUG,KAAK,CAAC,CAACxC,GAAGyC,IAAMzC,MAAMuC,SAAS,CAACE,EAAE;AACrD;AAEA,uEAAuE;AACvE,2EAA2E;AAC3E,8EAA8E;AAC9E,8EAA8E;AAC9E,gFAAgF;AAChF,sDAAsD;AACtD,MAAMC,sBAAsB;IAC1B;IACA;IACA;IACA;IACA;IACA;IACA;IACA;IACA;IACA;CACD;AAED;;;;CAIC,GACD,OAAO,MAAMC,0BAA0B,CAAmBR,SACxDS,OAAOC,WAAW,CAChBD,OAAOE,OAAO,CAACX,QAAmCY,IAAI,CAAC,CAAC,CAACd,EAAE,EAAE,CAACC,EAAE;QAC9D,MAAMc,KAAKN,oBAAoBO,OAAO,CAAChB;QACvC,MAAMiB,KAAKR,oBAAoBO,OAAO,CAACf;QACvC,OACE,AAACc,CAAAA,OAAO,CAAC,IAAIN,oBAAoBtB,MAAM,GAAG4B,EAAC,IAC1CE,CAAAA,OAAO,CAAC,IAAIR,oBAAoBtB,MAAM,GAAG8B,EAAC;IAE/C,IACK;AAET;;;;;;;CAOC,GACD,OAAO,MAAMC,oCAAoC,CAC/CrD,SACAqC,QACAiB;IAEAtD,QAAQa,OAAO,KAAK,CAAC;IACrBb,QAAQa,OAAO,CAACwB,OAAO,KAAK,CAAC;IAC7BrC,QAAQa,OAAO,CAACwB,OAAO,CAACkB,SAAS,KAAK,EAAE;IACxC,MAAMA,YAAYvD,QAAQa,OAAO,CAACwB,OAAO,CAACkB,SAAS;IACnD,4EAA4E;IAC5E,uDAAuD;IACvD,IAAI,CAACA,UAAUC,IAAI,CAAC,CAACC,IAAMvB,uBAAuBuB,GAAGH,cAAc;QACjEC,UAAUG,IAAI,CAACJ;IACjB;IACA,yEAAyE;IACzEtD,QAAQa,OAAO,CAACwB,OAAO,GAAGQ,wBAAwB7C,QAAQa,OAAO,CAACwB,OAAO;AAC3E,EAAE;AAEF;;;;;;;;CAQC,GACD,OAAO,MAAMsB,wBAAwB,CACnC9C,SACA+C;IAEA/C,OAAO,CAAC,MAAM,KAAK;QAAEgD,YAAY;QAAMN,WAAW,EAAE;IAAC;IACrD,MAAMO,aAAajD,OAAO,CAAC,MAAM;IACjCiD,WAAWD,UAAU,GAAG;IACxBC,WAAWP,SAAS,KAAK,EAAE;IAC3B,uEAAuE;IACvE,IAAI,CAACO,WAAWP,SAAS,CAACQ,QAAQ,CAACH,yBAAyB;QAC1DE,WAAWP,SAAS,CAACG,IAAI,CAACE;IAC5B;IACA/C,OAAO,CAAC,MAAM,GAAGgC,wBAAwBiB;AAC3C,EAAE"}

package/src/utils/test-git.d.ts

@@ -0,0 +1,39 @@
+/**
+ * Copyright Amazon.com, Inc. or its affiliates. All Rights Reserved.
+ * SPDX-License-Identifier: Apache-2.0
+ */
+/**
+ * Isolate every git invocation in the surrounding tests from the machine's real
+ * git configuration, and point the test identity at a throwaway config file.
+ *
+ * Two leaks are prevented:
+ *
+ * 1. Inherited `GIT_*` variables. When the test suite runs from a git hook (the
+ *    repo's `pre-commit` runs the unit tests), git exports `GIT_DIR` and
+ *    `GIT_INDEX_FILE` pointing at the surrounding repository. Those take
+ *    precedence over `cwd`, so `git init`/`git config`/`git commit` in a temp
+ *    directory operate on the real repository instead — writing `user.*` into
+ *    its `.git/config` and committing test fixtures.
+ * 2. Reads of, and writes to, the user's global and system config. Pointing
+ *    `GIT_CONFIG_GLOBAL`/`GIT_CONFIG_SYSTEM` at files inside a temp directory
+ *    means a stray `git config --global` lands there and is deleted with it,
+ *    and the developer's real `user.email` can neither leak into assertions nor
+ *    be overwritten.
+ *
+ * Both env vars are restored after each test.
+ */
+export declare const useIsolatedGitEnv: () => void;
+/**
+ * Run a git command in `cwd`, with the ambient `GIT_DIR`/`GIT_INDEX_FILE`
+ * cleared so it cannot escape to a surrounding repository even if
+ * `useIsolatedGitEnv` is not in effect. `execFileSync` (no shell) keeps
+ * arguments from being re-split.
+ */
+export declare const runGit: (args: string[], cwd: string) => string;
+/**
+ * Create a git repository in `dir` for a test to work in. The identity comes
+ * from the isolated global config set up by `useIsolatedGitEnv`, so nothing is
+ * written outside `dir`. Hooks are disabled — the repo under test has a
+ * `pre-commit` hook that runs the whole test suite.
+ */
+export declare const initTestGitRepo: (dir: string) => void;

package/src/utils/test-git.js

@@ -0,0 +1,117 @@
+/**
+ * Copyright Amazon.com, Inc. or its affiliates. All Rights Reserved.
+ * SPDX-License-Identifier: Apache-2.0
+ */ import { execFileSync } from "node:child_process";
+import { mkdtempSync, rmSync, writeFileSync } from "node:fs";
+import { tmpdir } from "node:os";
+import { join } from "node:path";
+import { afterEach, beforeEach } from "vitest";
+/**
+ * Identity used by the temp repositories these helpers create. Only ever
+ * written to a throwaway `GIT_CONFIG_GLOBAL` file, never to the developer's
+ * real config.
+ */ const TEST_GIT_USER_NAME = 'nx-plugin-for-aws-test';
+const TEST_GIT_USER_EMAIL = 'nx-plugin-for-aws-test@example.invalid';
+/**
+ * Isolate every git invocation in the surrounding tests from the machine's real
+ * git configuration, and point the test identity at a throwaway config file.
+ *
+ * Two leaks are prevented:
+ *
+ * 1. Inherited `GIT_*` variables. When the test suite runs from a git hook (the
+ *    repo's `pre-commit` runs the unit tests), git exports `GIT_DIR` and
+ *    `GIT_INDEX_FILE` pointing at the surrounding repository. Those take
+ *    precedence over `cwd`, so `git init`/`git config`/`git commit` in a temp
+ *    directory operate on the real repository instead — writing `user.*` into
+ *    its `.git/config` and committing test fixtures.
+ * 2. Reads of, and writes to, the user's global and system config. Pointing
+ *    `GIT_CONFIG_GLOBAL`/`GIT_CONFIG_SYSTEM` at files inside a temp directory
+ *    means a stray `git config --global` lands there and is deleted with it,
+ *    and the developer's real `user.email` can neither leak into assertions nor
+ *    be overwritten.
+ *
+ * Both env vars are restored after each test.
+ */ export const useIsolatedGitEnv = ()=>{
+    const savedEnv = {};
+    let configDir;
+    beforeEach(()=>{
+        for (const key of Object.keys(process.env)){
+            if (key.startsWith('GIT_')) {
+                savedEnv[key] = process.env[key];
+                delete process.env[key];
+            }
+        }
+        configDir = mkdtempSync(join(tmpdir(), 'nx-plugin-gitconfig-'));
+        // Seed the identity here rather than per-repo, so temp repos need no
+        // `git config` call at all and cannot write to a real repository.
+        writeFileSync(join(configDir, 'global'), `[user]\n\tname = ${TEST_GIT_USER_NAME}\n\temail = ${TEST_GIT_USER_EMAIL}\n`);
+        // Empty, so system config (which may set user.* or hook paths) cannot leak.
+        writeFileSync(join(configDir, 'system'), '');
+        for (const key of [
+            'GIT_CONFIG_GLOBAL',
+            'GIT_CONFIG_SYSTEM'
+        ]){
+            savedEnv[key] ??= process.env[key];
+        }
+        process.env.GIT_CONFIG_GLOBAL = join(configDir, 'global');
+        process.env.GIT_CONFIG_SYSTEM = join(configDir, 'system');
+    });
+    afterEach(()=>{
+        // Clear every GIT_* variable first, so any set *during* the test (and
+        // therefore absent from savedEnv) cannot leak into the next one.
+        for (const key of Object.keys(process.env)){
+            if (key.startsWith('GIT_')) {
+                delete process.env[key];
+            }
+        }
+        for (const [key, value] of Object.entries(savedEnv)){
+            if (value !== undefined) {
+                process.env[key] = value;
+            }
+        }
+        for (const key of Object.keys(savedEnv)){
+            delete savedEnv[key];
+        }
+        if (configDir) {
+            rmSync(configDir, {
+                force: true,
+                recursive: true
+            });
+            configDir = undefined;
+        }
+    });
+};
+/**
+ * Run a git command in `cwd`, with the ambient `GIT_DIR`/`GIT_INDEX_FILE`
+ * cleared so it cannot escape to a surrounding repository even if
+ * `useIsolatedGitEnv` is not in effect. `execFileSync` (no shell) keeps
+ * arguments from being re-split.
+ */ export const runGit = (args, cwd)=>execFileSync('git', args, {
+        cwd,
+        encoding: 'utf-8',
+        stdio: 'pipe',
+        env: {
+            ...process.env,
+            GIT_DIR: undefined,
+            GIT_WORK_TREE: undefined,
+            GIT_INDEX_FILE: undefined,
+            GIT_COMMON_DIR: undefined
+        }
+    });
+/**
+ * Create a git repository in `dir` for a test to work in. The identity comes
+ * from the isolated global config set up by `useIsolatedGitEnv`, so nothing is
+ * written outside `dir`. Hooks are disabled — the repo under test has a
+ * `pre-commit` hook that runs the whole test suite.
+ */ export const initTestGitRepo = (dir)=>{
+    runGit([
+        'init'
+    ], dir);
+    runGit([
+        'config',
+        'core.hooksPath',
+        '/dev/null'
+    ], dir);
+};
+
+//# sourceMappingURL=test-git.js.map

package/src/utils/test-git.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../../../../../packages/nx-plugin/src/utils/test-git.ts"],"sourcesContent":["/**\n * Copyright Amazon.com, Inc. or its affiliates. All Rights Reserved.\n * SPDX-License-Identifier: Apache-2.0\n */\n\nimport { execFileSync } from 'node:child_process';\nimport { mkdtempSync, rmSync, writeFileSync } from 'node:fs';\nimport { tmpdir } from 'node:os';\nimport { join } from 'node:path';\nimport { afterEach, beforeEach } from 'vitest';\n\n/**\n * Identity used by the temp repositories these helpers create. Only ever\n * written to a throwaway `GIT_CONFIG_GLOBAL` file, never to the developer's\n * real config.\n */\nconst TEST_GIT_USER_NAME = 'nx-plugin-for-aws-test';\nconst TEST_GIT_USER_EMAIL = 'nx-plugin-for-aws-test@example.invalid';\n\n/**\n * Isolate every git invocation in the surrounding tests from the machine's real\n * git configuration, and point the test identity at a throwaway config file.\n *\n * Two leaks are prevented:\n *\n * 1. Inherited `GIT_*` variables. When the test suite runs from a git hook (the\n *    repo's `pre-commit` runs the unit tests), git exports `GIT_DIR` and\n *    `GIT_INDEX_FILE` pointing at the surrounding repository. Those take\n *    precedence over `cwd`, so `git init`/`git config`/`git commit` in a temp\n *    directory operate on the real repository instead — writing `user.*` into\n *    its `.git/config` and committing test fixtures.\n * 2. Reads of, and writes to, the user's global and system config. Pointing\n *    `GIT_CONFIG_GLOBAL`/`GIT_CONFIG_SYSTEM` at files inside a temp directory\n *    means a stray `git config --global` lands there and is deleted with it,\n *    and the developer's real `user.email` can neither leak into assertions nor\n *    be overwritten.\n *\n * Both env vars are restored after each test.\n */\nexport const useIsolatedGitEnv = () => {\n  const savedEnv: Record<string, string | undefined> = {};\n  let configDir: string | undefined;\n\n  beforeEach(() => {\n    for (const key of Object.keys(process.env)) {\n      if (key.startsWith('GIT_')) {\n        savedEnv[key] = process.env[key];\n        delete process.env[key];\n      }\n    }\n\n    configDir = mkdtempSync(join(tmpdir(), 'nx-plugin-gitconfig-'));\n    // Seed the identity here rather than per-repo, so temp repos need no\n    // `git config` call at all and cannot write to a real repository.\n    writeFileSync(\n      join(configDir, 'global'),\n      `[user]\\n\\tname = ${TEST_GIT_USER_NAME}\\n\\temail = ${TEST_GIT_USER_EMAIL}\\n`,\n    );\n    // Empty, so system config (which may set user.* or hook paths) cannot leak.\n    writeFileSync(join(configDir, 'system'), '');\n\n    for (const key of ['GIT_CONFIG_GLOBAL', 'GIT_CONFIG_SYSTEM'] as const) {\n      savedEnv[key] ??= process.env[key];\n    }\n    process.env.GIT_CONFIG_GLOBAL = join(configDir, 'global');\n    process.env.GIT_CONFIG_SYSTEM = join(configDir, 'system');\n  });\n\n  afterEach(() => {\n    // Clear every GIT_* variable first, so any set *during* the test (and\n    // therefore absent from savedEnv) cannot leak into the next one.\n    for (const key of Object.keys(process.env)) {\n      if (key.startsWith('GIT_')) {\n        delete process.env[key];\n      }\n    }\n    for (const [key, value] of Object.entries(savedEnv)) {\n      if (value !== undefined) {\n        process.env[key] = value;\n      }\n    }\n    for (const key of Object.keys(savedEnv)) {\n      delete savedEnv[key];\n    }\n    if (configDir) {\n      rmSync(configDir, { force: true, recursive: true });\n      configDir = undefined;\n    }\n  });\n};\n\n/**\n * Run a git command in `cwd`, with the ambient `GIT_DIR`/`GIT_INDEX_FILE`\n * cleared so it cannot escape to a surrounding repository even if\n * `useIsolatedGitEnv` is not in effect. `execFileSync` (no shell) keeps\n * arguments from being re-split.\n */\nexport const runGit = (args: string[], cwd: string): string =>\n  execFileSync('git', args, {\n    cwd,\n    encoding: 'utf-8',\n    stdio: 'pipe',\n    env: {\n      ...process.env,\n      GIT_DIR: undefined,\n      GIT_WORK_TREE: undefined,\n      GIT_INDEX_FILE: undefined,\n      GIT_COMMON_DIR: undefined,\n    } as NodeJS.ProcessEnv,\n  });\n\n/**\n * Create a git repository in `dir` for a test to work in. The identity comes\n * from the isolated global config set up by `useIsolatedGitEnv`, so nothing is\n * written outside `dir`. Hooks are disabled — the repo under test has a\n * `pre-commit` hook that runs the whole test suite.\n */\nexport const initTestGitRepo = (dir: string): void => {\n  runGit(['init'], dir);\n  runGit(['config', 'core.hooksPath', '/dev/null'], dir);\n};\n"],"names":["execFileSync","mkdtempSync","rmSync","writeFileSync","tmpdir","join","afterEach","beforeEach","TEST_GIT_USER_NAME","TEST_GIT_USER_EMAIL","useIsolatedGitEnv","savedEnv","configDir","key","Object","keys","process","env","startsWith","GIT_CONFIG_GLOBAL","GIT_CONFIG_SYSTEM","value","entries","undefined","force","recursive","runGit","args","cwd","encoding","stdio","GIT_DIR","GIT_WORK_TREE","GIT_INDEX_FILE","GIT_COMMON_DIR","initTestGitRepo","dir"],"mappings":"AAAA;;;CAGC,GAED,SAASA,YAAY,QAAQ,qBAAqB;AAClD,SAASC,WAAW,EAAEC,MAAM,EAAEC,aAAa,QAAQ,UAAU;AAC7D,SAASC,MAAM,QAAQ,UAAU;AACjC,SAASC,IAAI,QAAQ,YAAY;AACjC,SAASC,SAAS,EAAEC,UAAU,QAAQ,SAAS;AAE/C;;;;CAIC,GACD,MAAMC,qBAAqB;AAC3B,MAAMC,sBAAsB;AAE5B;;;;;;;;;;;;;;;;;;;CAmBC,GACD,OAAO,MAAMC,oBAAoB;IAC/B,MAAMC,WAA+C,CAAC;IACtD,IAAIC;IAEJL,WAAW;QACT,KAAK,MAAMM,OAAOC,OAAOC,IAAI,CAACC,QAAQC,GAAG,EAAG;YAC1C,IAAIJ,IAAIK,UAAU,CAAC,SAAS;gBAC1BP,QAAQ,CAACE,IAAI,GAAGG,QAAQC,GAAG,CAACJ,IAAI;gBAChC,OAAOG,QAAQC,GAAG,CAACJ,IAAI;YACzB;QACF;QAEAD,YAAYX,YAAYI,KAAKD,UAAU;QACvC,qEAAqE;QACrE,kEAAkE;QAClED,cACEE,KAAKO,WAAW,WAChB,CAAC,iBAAiB,EAAEJ,mBAAmB,YAAY,EAAEC,oBAAoB,EAAE,CAAC;QAE9E,4EAA4E;QAC5EN,cAAcE,KAAKO,WAAW,WAAW;QAEzC,KAAK,MAAMC,OAAO;YAAC;YAAqB;SAAoB,CAAW;YACrEF,QAAQ,CAACE,IAAI,KAAKG,QAAQC,GAAG,CAACJ,IAAI;QACpC;QACAG,QAAQC,GAAG,CAACE,iBAAiB,GAAGd,KAAKO,WAAW;QAChDI,QAAQC,GAAG,CAACG,iBAAiB,GAAGf,KAAKO,WAAW;IAClD;IAEAN,UAAU;QACR,sEAAsE;QACtE,iEAAiE;QACjE,KAAK,MAAMO,OAAOC,OAAOC,IAAI,CAACC,QAAQC,GAAG,EAAG;YAC1C,IAAIJ,IAAIK,UAAU,CAAC,SAAS;gBAC1B,OAAOF,QAAQC,GAAG,CAACJ,IAAI;YACzB;QACF;QACA,KAAK,MAAM,CAACA,KAAKQ,MAAM,IAAIP,OAAOQ,OAAO,CAACX,UAAW;YACnD,IAAIU,UAAUE,WAAW;gBACvBP,QAAQC,GAAG,CAACJ,IAAI,GAAGQ;YACrB;QACF;QACA,KAAK,MAAMR,OAAOC,OAAOC,IAAI,CAACJ,UAAW;YACvC,OAAOA,QAAQ,CAACE,IAAI;QACtB;QACA,IAAID,WAAW;YACbV,OAAOU,WAAW;gBAAEY,OAAO;gBAAMC,WAAW;YAAK;YACjDb,YAAYW;QACd;IACF;AACF,EAAE;AAEF;;;;;CAKC,GACD,OAAO,MAAMG,SAAS,CAACC,MAAgBC,MACrC5B,aAAa,OAAO2B,MAAM;QACxBC;QACAC,UAAU;QACVC,OAAO;QACPb,KAAK;YACH,GAAGD,QAAQC,GAAG;YACdc,SAASR;YACTS,eAAeT;YACfU,gBAAgBV;YAChBW,gBAAgBX;QAClB;IACF,GAAG;AAEL;;;;;CAKC,GACD,OAAO,MAAMY,kBAAkB,CAACC;IAC9BV,OAAO;QAAC;KAAO,EAAEU;IACjBV,OAAO;QAAC;QAAU;QAAkB;KAAY,EAAEU;AACpD,EAAE"}

package/src/utils/versions.d.ts

@@ -9,6 +9,7 @@ export declare const TS_VERSIONS: {
     readonly '@a2a-js/sdk': "0.3.14";
     readonly '@aws/aws-distro-opentelemetry-node-autoinstrumentation': "0.12.0";
     readonly '@opentelemetry/propagator-jaeger': "2.9.0";
+    readonly minimatch: "10.2.5";
     readonly '@aws-sdk/client-dynamodb': "3.1090.0";
     readonly '@aws-sdk/client-api-gateway': "3.1090.0";
     readonly '@aws-sdk/client-iam': "3.1090.0";
@@ -136,7 +137,7 @@ export type ITsDepVersion = keyof typeof TS_VERSIONS;
  * Add versions to the given dependencies
  */
 export declare const withVersions: (deps: ITsDepVersion[]) => {
-    [k: string]: "0.3.14" | "0.12.0" | "2.9.0" | "3.1090.0" | "3.972.58" | "1.0.0-alpha.10" | "2.34.0" | "7.7.0" | "22.2.2" | "10.3.0" | "23.1.0" | "1.12.1" | "1.15.43" | "1.29.0" | "0.22.0" | "0.0.4" | "0.2.3" | "0.0.57" | "0.3.0" | "1.63.1" | "7.8.2" | "1.10.0" | "1.170.18" | "1.168.22" | "1.167.21" | "1.162.0" | "1.162.2" | "3.0.205" | "1.0.151" | "3.0.1330" | "1.0.62" | "5.101.2" | "11.18.0" | "26.1.1" | "8.10.162" | "2.8.19" | "8.20.0" | "8.18.1" | "5.0.6" | "4.6.10" | "4.5.10" | "4.9.7" | "4.16.1" | "4.1.10" | "6.0.1" | "0.41.3" | "7.1.1" | "1.0.20" | "2.1132.0" | "2.261.0" | "3.12.0" | "10.7.0" | "2.8.6" | "5.6.2" | "0.7.1" | "2.1.1" | "15.0.0" | "3.9.1" | "0.28.1" | "1.0.31" | "1.0.5" | "2.5.4" | "7.8.0" | "3.1.5" | "5.2.1" | "3.3.3" | "9.1.7" | "11.3.6" | "11.0.4" | "4.0.0" | "3.5.3" | "2.0.0" | "12.0.1" | "22.2.9" | "3.5.0" | "8.22.0" | "3.3.1" | "19.2.7" | "6.1.3" | "1.2.0" | "3.36.0" | "0.5.21" | "0.28.0" | "4.3.3" | "4.23.1" | "1.25.0" | "1.6.2" | "4.13.1" | "1.4.0" | "3.6.0" | "8.1.5" | "6.0.3" | "4.4.3" | "8.21.1";
+    [k: string]: "0.3.14" | "0.12.0" | "2.9.0" | "10.2.5" | "3.1090.0" | "3.972.58" | "1.0.0-alpha.10" | "2.34.0" | "7.7.0" | "22.2.2" | "10.3.0" | "23.1.0" | "1.12.1" | "1.15.43" | "1.29.0" | "0.22.0" | "0.0.4" | "0.2.3" | "0.0.57" | "0.3.0" | "1.63.1" | "7.8.2" | "1.10.0" | "1.170.18" | "1.168.22" | "1.167.21" | "1.162.0" | "1.162.2" | "3.0.205" | "1.0.151" | "3.0.1330" | "1.0.62" | "5.101.2" | "11.18.0" | "26.1.1" | "8.10.162" | "2.8.19" | "8.20.0" | "8.18.1" | "5.0.6" | "4.6.10" | "4.5.10" | "4.9.7" | "4.16.1" | "4.1.10" | "6.0.1" | "0.41.3" | "7.1.1" | "1.0.20" | "2.1132.0" | "2.261.0" | "3.12.0" | "10.7.0" | "2.8.6" | "5.6.2" | "0.7.1" | "2.1.1" | "15.0.0" | "3.9.1" | "0.28.1" | "1.0.31" | "1.0.5" | "2.5.4" | "7.8.0" | "3.1.5" | "5.2.1" | "3.3.3" | "9.1.7" | "11.3.6" | "11.0.4" | "4.0.0" | "3.5.3" | "2.0.0" | "12.0.1" | "22.2.9" | "3.5.0" | "8.22.0" | "3.3.1" | "19.2.7" | "6.1.3" | "1.2.0" | "3.36.0" | "0.5.21" | "0.28.0" | "4.3.3" | "4.23.1" | "1.25.0" | "1.6.2" | "4.13.1" | "1.4.0" | "3.6.0" | "8.1.5" | "6.0.3" | "4.4.3" | "8.21.1";
 };
 /**
  * Versions for Python dependencies added by generators
@@ -214,6 +215,7 @@ export declare const TERRAFORM_VERSIONS: {
     readonly archive: "2.8.0";
     readonly external: "2.4.0";
     readonly local: "2.9.0";
+    readonly time: "0.14.0";
 };
 export type ITerraformProviderVersion = keyof typeof TERRAFORM_VERSIONS;
 /**
@@ -227,4 +229,5 @@ export declare const terraformProviderVersions: () => {
     archiveProviderVersion: "2.8.0";
     externalProviderVersion: "2.4.0";
     localProviderVersion: "2.9.0";
+    timeProviderVersion: "0.14.0";
 };

package/src/utils/versions.js

@@ -9,6 +9,12 @@
     // Pinned above the version the ADOT autoinstrumentation package resolves
     // transitively (2.8.0) to clear CVE-2026-59892 (HIGH).
     '@opentelemetry/propagator-jaeger': '2.9.0',
+    // Overridden in the vended agent/MCP image builds to clear CVE-2026-14257
+    // (HIGH) in brace-expansion: minimatch 10 is the lowest major depending on
+    // brace-expansion 5.x, the only line Trivy's `< 5.0.8` advisory range treats
+    // as fixed. Overriding brace-expansion directly is not viable — 5.x drops the
+    // CommonJS default export that minimatch 9 calls.
+    minimatch: '10.2.5',
     '@aws-sdk/client-dynamodb': '3.1090.0',
     '@aws-sdk/client-api-gateway': '3.1090.0',
     '@aws-sdk/client-iam': '3.1090.0',
@@ -209,7 +215,8 @@
     null: '3.3.0',
     archive: '2.8.0',
     external: '2.4.0',
-    local: '2.9.0'
+    local: '2.9.0',
+    time: '0.14.0'
 };
 /**
  * Substitution variables exposing Terraform provider version constraints to
@@ -220,7 +227,8 @@
         nullProviderVersion: TERRAFORM_VERSIONS.null,
         archiveProviderVersion: TERRAFORM_VERSIONS.archive,
         externalProviderVersion: TERRAFORM_VERSIONS.external,
-        localProviderVersion: TERRAFORM_VERSIONS.local
+        localProviderVersion: TERRAFORM_VERSIONS.local,
+        timeProviderVersion: TERRAFORM_VERSIONS.time
     });
 
 //# sourceMappingURL=versions.js.map