@aws/nx-plugin 1.0.0-rc.5 → 1.0.0-rc.51

package/src/utils/website-constructs/files/terraform/core/static-website/static-website.tf.template

@@ -2,12 +2,12 @@ terraform {
   required_providers {
     aws = {
       source  = "hashicorp/aws"
-      version = "~> 6.0"
+      version = "<%- awsProviderVersion %>"
       configuration_aliases = [aws.us_east_1]
     }
     random = {
       source  = "hashicorp/random"
-      version = "~> 3.1"
+      version = "<%- randomProviderVersion %>"
     }
   }
 }
@@ -23,6 +23,31 @@ variable "website_file_path" {
   type        = string
 }
 
+variable "custom_domain_names" {
+  description = "Custom domain names (aliases) for the CloudFront distribution. Requires acm_certificate_arn."
+  type        = list(string)
+  default     = []
+}
+
+variable "acm_certificate_arn" {
+  description = "ARN of an ACM certificate (in us-east-1) for the custom domain names. When set, viewers are required to use TLS 1.2 or later."
+  type        = string
+  default     = null
+}
+
+# Content-Security-Policy enforced on all responses. Restricts scripts and
+# framing to mitigate XSS and clickjacking, while permitting HTTPS/WSS calls
+# (connect-src) to AWS service endpoints such as API Gateway, Cognito and
+# Bedrock AgentCore which are only known at deploy time. Edit this to tighten
+# connect-src to your specific origins once they are known.
+locals {
+  content_security_policy = "default-src 'self'; script-src 'self'; style-src 'self' 'unsafe-inline'; img-src 'self' data:; font-src 'self' data:; connect-src 'self' https: wss:; object-src 'none'; base-uri 'self'; frame-ancestors 'none'"
+
+  # Delivery source/destination names have a 60 character maximum. Truncate the
+  # website name so the longest delivery name stays within the limit.
+  access_logs_name_prefix = substr(lower(var.website_name), 0, 16)
+}
+
 
 # Data sources
 data "aws_caller_identity" "current" {}
@@ -59,6 +84,26 @@ resource "aws_kms_key" "website_key" {
         ]
         Resource = "*"
       },
+      {
+        Sid    = "AllowCloudWatchLogs"
+        Effect = "Allow"
+        Principal = {
+          Service = "logs.${data.aws_region.current.region}.amazonaws.com"
+        }
+        Action = [
+          "kms:Encrypt",
+          "kms:Decrypt",
+          "kms:ReEncrypt*",
+          "kms:GenerateDataKey*",
+          "kms:DescribeKey"
+        ]
+        Resource = "*"
+        Condition = {
+          ArnLike = {
+            "kms:EncryptionContext:aws:logs:arn" = "arn:aws:logs:${data.aws_region.current.region}:${data.aws_caller_identity.current.account_id}:log-group:*"
+          }
+        }
+      },
       {
         Sid    = "AllowCloudFrontServicePrincipalSSE-KMS"
         Effect = "Allow"
@@ -90,18 +135,12 @@ resource "aws_kms_alias" "website_key_alias" {
   target_key_id = aws_kms_key.website_key.key_id
 }
 
-# Access Logs Bucket
-resource "aws_s3_bucket" "access_logs" {
-  #checkov:skip=CKV2_AWS_61:Lifecycle configuration not required for access logs bucket
-  #checkov:skip=CKV_AWS_144:Cross-region replication not required for access logs
-  #checkov:skip=CKV2_AWS_62:Event notifications not required for access logs bucket
-  #checkov:skip=CKV_AWS_21:Versioning disabled for access logs to reduce storage costs
-  bucket        = "${lower(var.website_name)}-access-logs-${random_id.bucket_suffix.hex}"
-  force_destroy = true
-
-  tags = {
-    Name = "${lower(var.website_name)}-access-logs"
-  }
+# CloudWatch log group receiving S3 server access logs for the website and
+# distribution log buckets.
+resource "aws_cloudwatch_log_group" "access_logs" {
+  name              = "/aws/s3/${lower(var.website_name)}-access-logs-${random_id.bucket_suffix.hex}"
+  retention_in_days = 365
+  kms_key_id        = aws_kms_key.website_key.arn
 }
 
 resource "random_id" "unique_suffix" {
@@ -112,63 +151,12 @@ resource "random_id" "bucket_suffix" {
   byte_length = 8
 }
 
-resource "aws_s3_bucket_versioning" "access_logs_versioning" {
-  bucket = aws_s3_bucket.access_logs.id
-  versioning_configuration {
-    status = "Disabled"
-  }
-}
-
-resource "aws_s3_bucket_server_side_encryption_configuration" "access_logs_encryption" {
-  bucket = aws_s3_bucket.access_logs.id
-
-  rule {
-    apply_server_side_encryption_by_default {
-      kms_master_key_id = aws_kms_key.website_key.arn
-      sse_algorithm     = "aws:kms"
-    }
-  }
-}
-
-resource "aws_s3_bucket_public_access_block" "access_logs_pab" {
-  bucket = aws_s3_bucket.access_logs.id
-
-  block_public_acls       = true
-  block_public_policy     = true
-  ignore_public_acls      = true
-  restrict_public_buckets = true
-}
-
-resource "aws_s3_bucket_policy" "access_logs_ssl_policy" {
-  bucket = aws_s3_bucket.access_logs.id
-
-  policy = jsonencode({
-    Version = "2012-10-17"
-    Statement = [
-      {
-        Sid       = "DenyInsecureConnections"
-        Effect    = "Deny"
-        Principal = "*"
-        Action    = "s3:*"
-        Resource = [
-          aws_s3_bucket.access_logs.arn,
-          "${aws_s3_bucket.access_logs.arn}/*"
-        ]
-        Condition = {
-          Bool = {
-            "aws:SecureTransport" = "false"
-          }
-        }
-      }
-    ]
-  })
-}
-
 # Website Bucket
 resource "aws_s3_bucket" "website" {
   #checkov:skip=CKV2_AWS_61:Lifecycle configuration not required for static website content
   #checkov:skip=CKV_AWS_144:Cross-region replication not required for static website
   #checkov:skip=CKV2_AWS_62:Event notifications not required for static website bucket
+  #checkov:skip=CKV_AWS_18:Server access logs are delivered to CloudWatch Logs (see aws_cloudwatch_log_delivery.website)
   bucket        = "${lower(var.website_name)}-website-${random_id.bucket_suffix.hex}"
   force_destroy = true
 
@@ -212,20 +200,35 @@ resource "aws_s3_bucket_ownership_controls" "website_ownership" {
   }
 }
 
-resource "aws_s3_bucket_logging" "website_logging" {
-  bucket = aws_s3_bucket.website.id
+# Deliver the website bucket's server access logs to CloudWatch Logs.
+resource "aws_cloudwatch_log_delivery_source" "website" {
+  name         = "${local.access_logs_name_prefix}-website-logs-${random_id.bucket_suffix.hex}"
+  log_type     = "S3_SERVER_ACCESS_LOGS"
+  resource_arn = aws_s3_bucket.website.arn
+}
 
-  target_bucket = aws_s3_bucket.access_logs.id
-  target_prefix = "website-access-logs/"
+resource "aws_cloudwatch_log_delivery_destination" "access_logs" {
+  name = "${local.access_logs_name_prefix}-access-logs-${random_id.bucket_suffix.hex}"
+
+  delivery_destination_configuration {
+    destination_resource_arn = aws_cloudwatch_log_group.access_logs.arn
+  }
 }
 
+resource "aws_cloudwatch_log_delivery" "website" {
+  delivery_source_name     = aws_cloudwatch_log_delivery_source.website.name
+  delivery_destination_arn = aws_cloudwatch_log_delivery_destination.access_logs.arn
+}
 
-# Distribution Log Bucket
+
+# Distribution Log Bucket — holds CloudFront standard access logs (CloudFront
+# delivers only to S3). Its own S3 server access logs go to CloudWatch Logs.
 resource "aws_s3_bucket" "distribution_logs" {
   #checkov:skip=CKV2_AWS_61:Lifecycle configuration not required for CloudFront logs
   #checkov:skip=CKV_AWS_144:Cross-region replication not required for CloudFront logs
   #checkov:skip=CKV2_AWS_62:Event notifications not required for CloudFront logs bucket
   #checkov:skip=CKV_AWS_21:Versioning not required for CloudFront access logs
+  #checkov:skip=CKV_AWS_18:Server access logs are delivered to CloudWatch Logs (see aws_cloudwatch_log_delivery.distribution_logs)
   bucket        = "${lower(var.website_name)}-distribution-logs-${random_id.bucket_suffix.hex}"
   force_destroy = true
 
@@ -271,11 +274,16 @@ resource "aws_s3_bucket_acl" "distribution_logs_acl" {
   depends_on = [aws_s3_bucket_ownership_controls.distribution_logs_ownership]
 }
 
-resource "aws_s3_bucket_logging" "distribution_logs_logging" {
-  bucket = aws_s3_bucket.distribution_logs.id
+# Deliver the distribution log bucket's server access logs to CloudWatch Logs.
+resource "aws_cloudwatch_log_delivery_source" "distribution_logs" {
+  name         = "${local.access_logs_name_prefix}-distribution-logs-${random_id.bucket_suffix.hex}"
+  log_type     = "S3_SERVER_ACCESS_LOGS"
+  resource_arn = aws_s3_bucket.distribution_logs.arn
+}
 
-  target_bucket = aws_s3_bucket.access_logs.id
-  target_prefix = "distribution-access-logs/"
+resource "aws_cloudwatch_log_delivery" "distribution_logs" {
+  delivery_source_name     = aws_cloudwatch_log_delivery_source.distribution_logs.name
+  delivery_destination_arn = aws_cloudwatch_log_delivery_destination.access_logs.arn
 }
 
 resource "aws_s3_bucket_policy" "distribution_logs_ssl_policy" {
@@ -383,13 +391,42 @@ resource "aws_cloudfront_origin_access_control" "website_oac" {
   signing_protocol                  = "sigv4"
 }
 
+# Security headers applied to all responses.
+resource "aws_cloudfront_response_headers_policy" "website" {
+  name = "${aws_s3_bucket.website.bucket}-security-headers"
+
+  security_headers_config {
+    strict_transport_security {
+      access_control_max_age_sec = 63072000
+      include_subdomains         = true
+      preload                    = true
+      override                   = true
+    }
+    content_type_options {
+      override = true
+    }
+    frame_options {
+      frame_option = "DENY"
+      override     = true
+    }
+    referrer_policy {
+      referrer_policy = "strict-origin-when-cross-origin"
+      override        = true
+    }
+    content_security_policy {
+      content_security_policy = local.content_security_policy
+      override                = true
+    }
+  }
+}
+
 # CloudFront Distribution
 resource "aws_cloudfront_distribution" "website" {
+  # See https://docs.aws.amazon.com/AmazonCloudFront/latest/DeveloperGuide/DownloadDistValuesGeneral.html
   #checkov:skip=CKV_AWS_174:Using CloudFront default certificate which does not support TLS v1.2
   #checkov:skip=CKV_AWS_310:Origin failover not required for single S3 origin static website
   #checkov:skip=CKV_AWS_374:Geo restrictions not required for global web application
   #checkov:skip=CKV2_AWS_42:Custom SSL certificate not required for development - using CloudFront default
-  #checkov:skip=CKV2_AWS_32:Response headers policy not required for basic static website
   #checkov:skip=CKV2_AWS_47:WAF includes AWSManagedRulesKnownBadInputsRuleSet which provides Log4j protection
   origin {
     domain_name              = aws_s3_bucket.website.bucket_regional_domain_name
@@ -401,6 +438,7 @@ resource "aws_cloudfront_distribution" "website" {
   is_ipv6_enabled     = true
   default_root_object = "index.html"
   web_acl_id          = aws_wafv2_web_acl.cloudfront_waf.arn
+  aliases             = var.custom_domain_names
 
   logging_config {
     include_cookies = false
@@ -419,11 +457,12 @@ resource "aws_cloudfront_distribution" "website" {
       }
     }
 
-    viewer_protocol_policy = "redirect-to-https"
-    min_ttl                = 0
-    default_ttl            = 3600
-    max_ttl                = 86400
-    compress               = true
+    viewer_protocol_policy     = "redirect-to-https"
+    response_headers_policy_id = aws_cloudfront_response_headers_policy.website.id
+    min_ttl                    = 0
+    default_ttl                = 3600
+    max_ttl                    = 86400
+    compress                   = true
   }
 
   # Custom error responses for SPA routing
@@ -446,7 +485,10 @@ resource "aws_cloudfront_distribution" "website" {
   }
 
   viewer_certificate {
-    cloudfront_default_certificate = true
+    cloudfront_default_certificate = var.acm_certificate_arn == null
+    acm_certificate_arn            = var.acm_certificate_arn
+    ssl_support_method             = var.acm_certificate_arn == null ? null : "sni-only"
+    minimum_protocol_version       = var.acm_certificate_arn == null ? "TLSv1" : "TLSv1.2_2021"
   }
 
   tags = {
@@ -527,8 +569,8 @@ resource "null_resource" "upload_website_files" {
 
   provisioner "local-exec" {
     command = <<-EOT
-      cd "${path.root}"
-      uv run --with boto3 python3 -c "
+      cd "$ROOT_PATH"
+      uv run --with boto3<%= boto3Version %> python3 -c "
 import os
 import sys
 import boto3
@@ -616,9 +658,14 @@ def sync_to_s3(local_path, bucket_name):
         sys.exit(1)
 
 # Execute sync
-sync_to_s3('${var.website_file_path}', '${aws_s3_bucket.website.bucket}')
+sync_to_s3(os.environ['WEBSITE_FILE_PATH'], os.environ['BUCKET_NAME'])
 "
     EOT
+    environment = {
+      ROOT_PATH         = path.root
+      WEBSITE_FILE_PATH = var.website_file_path
+      BUCKET_NAME       = aws_s3_bucket.website.bucket
+    }
   }
 
   depends_on = [aws_s3_bucket_policy.website_cloudfront_policy]
@@ -626,11 +673,12 @@ sync_to_s3('${var.website_file_path}', '${aws_s3_bucket.website.bucket}')
 
 # Upload runtime config file
 resource "aws_s3_object" "runtime_config" {
-  bucket       = aws_s3_bucket.website.id
-  key          = "runtime-config.json"
-  content      = module.runtime_config_reader.config_json
-  content_type = "application/json"
-  etag         = md5(module.runtime_config_reader.config_json)
+  bucket        = aws_s3_bucket.website.id
+  key           = "runtime-config.json"
+  content       = module.runtime_config_reader.config_json
+  content_type  = "application/json"
+  cache_control = "no-cache"
+  etag          = md5(module.runtime_config_reader.config_json)
 
   depends_on = [null_resource.upload_website_files]
 }
@@ -645,8 +693,9 @@ resource "null_resource" "cloudfront_invalidation" {
 
   provisioner "local-exec" {
     command = <<-EOT
-      uv run --with boto3 python3 -c "
+      uv run --with boto3<%= boto3Version %> python3 -c "
 import boto3
+import os
 import sys
 from botocore.exceptions import ClientError, NoCredentialsError
 
@@ -668,7 +717,7 @@ def create_invalidation(distribution_id):
 
         invalidation_id = response['Invalidation']['Id']
         print(f'CloudFront cache invalidation created: {invalidation_id}')
-        print(f'Distribution: ${aws_cloudfront_distribution.website.id}')
+        print(f'Distribution: {distribution_id}')
         print(f'Status: {response[\"Invalidation\"][\"Status\"]}')
 
     except NoCredentialsError:
@@ -682,9 +731,12 @@ def create_invalidation(distribution_id):
         sys.exit(1)
 
 # Execute invalidation
-create_invalidation('${aws_cloudfront_distribution.website.id}')
+create_invalidation(os.environ['DISTRIBUTION_ID'])
 "
     EOT
+    environment = {
+      DISTRIBUTION_ID = aws_cloudfront_distribution.website.id
+    }
   }
 
   depends_on = [

package/src/utils/website-constructs/website-constructs.d.ts

@@ -2,8 +2,8 @@
  * Copyright Amazon.com, Inc. or its affiliates. All Rights Reserved.
  * SPDX-License-Identifier: Apache-2.0
  */
-import { Tree } from '@nx/devkit';
-import { Iac } from '../iac';
+import { type Tree } from '@nx/devkit';
+import type { Iac } from '../iac';
 export interface AddWebsiteInfraOptions {
     websiteProjectName: string;
     scopeAlias: string;

package/src/utils/website-constructs/website-constructs.js

@@ -1,50 +1,58 @@
-"use strict";
-Object.defineProperty(exports, "__esModule", { value: true });
-exports.addWebsiteInfra = void 0;
 /**
  * Copyright Amazon.com, Inc. or its affiliates. All Rights Reserved.
  * SPDX-License-Identifier: Apache-2.0
- */
-const devkit_1 = require("@nx/devkit");
-const shared_constructs_constants_1 = require("../shared-constructs-constants");
-const ast_1 = require("../ast");
-const nx_1 = require("../nx");
+ */ import { generateFiles, joinPathFragments, OverwriteStrategy, updateJson } from "@nx/devkit";
+import { addStarExport } from "../ast.js";
+import { esmVars } from "../module-format.js";
+import { addDependencyToTargetIfNotPresent } from "../nx.js";
+import { PACKAGES_DIR, SHARED_CONSTRUCTS_DIR, SHARED_TERRAFORM_DIR } from "../shared-constructs-constants.js";
+import { PY_VERSIONS, terraformProviderVersions } from "../versions.js";
 /**
  * Add infrastructure for a static website
- */
-const addWebsiteInfra = async (tree, options) => {
+ */ export const addWebsiteInfra = async (tree, options)=>{
     if (options.iac === 'cdk') {
         await addWebsiteCdkConstructs(tree, options);
-    }
-    else if (options.iac === 'terraform') {
+    } else if (options.iac === 'terraform') {
         addWebsiteTerraformModules(tree, options);
-    }
-    else {
+    } else {
         throw new Error(`Unsupported iac ${options.iac}`);
     }
-    (0, devkit_1.updateJson)(tree, (0, devkit_1.joinPathFragments)(shared_constructs_constants_1.PACKAGES_DIR, options.iac === 'cdk' ? shared_constructs_constants_1.SHARED_CONSTRUCTS_DIR : shared_constructs_constants_1.SHARED_TERRAFORM_DIR, 'project.json'), (config) => {
-        (0, nx_1.addDependencyToTargetIfNotPresent)(config, 'build', `${options.websiteProjectName}:build`);
+    updateJson(tree, joinPathFragments(PACKAGES_DIR, options.iac === 'cdk' ? SHARED_CONSTRUCTS_DIR : SHARED_TERRAFORM_DIR, 'project.json'), (config)=>{
+        addDependencyToTargetIfNotPresent(config, 'build', `${options.websiteProjectName}:build`);
         return config;
     });
 };
-exports.addWebsiteInfra = addWebsiteInfra;
-const addWebsiteCdkConstructs = async (tree, options) => {
-    (0, devkit_1.generateFiles)(tree, (0, devkit_1.joinPathFragments)(__dirname, 'files', 'cdk', 'core'), (0, devkit_1.joinPathFragments)(shared_constructs_constants_1.PACKAGES_DIR, shared_constructs_constants_1.SHARED_CONSTRUCTS_DIR, 'src', 'core'), options, {
-        overwriteStrategy: devkit_1.OverwriteStrategy.KeepExisting,
+const addWebsiteCdkConstructs = async (tree, options)=>{
+    generateFiles(tree, joinPathFragments(import.meta.dirname, 'files', 'cdk', 'core'), joinPathFragments(PACKAGES_DIR, SHARED_CONSTRUCTS_DIR, 'src', 'core'), {
+        ...options,
+        ...esmVars(tree)
+    }, {
+        overwriteStrategy: OverwriteStrategy.KeepExisting
     });
-    (0, devkit_1.generateFiles)(tree, (0, devkit_1.joinPathFragments)(__dirname, 'files', 'cdk', 'app'), (0, devkit_1.joinPathFragments)(shared_constructs_constants_1.PACKAGES_DIR, shared_constructs_constants_1.SHARED_CONSTRUCTS_DIR, 'src', 'app'), options, {
-        overwriteStrategy: devkit_1.OverwriteStrategy.KeepExisting,
+    generateFiles(tree, joinPathFragments(import.meta.dirname, 'files', 'cdk', 'app'), joinPathFragments(PACKAGES_DIR, SHARED_CONSTRUCTS_DIR, 'src', 'app'), {
+        ...options,
+        ...esmVars(tree)
+    }, {
+        overwriteStrategy: OverwriteStrategy.KeepExisting
     });
-    await (0, ast_1.addStarExport)(tree, (0, devkit_1.joinPathFragments)(shared_constructs_constants_1.PACKAGES_DIR, shared_constructs_constants_1.SHARED_CONSTRUCTS_DIR, 'src', 'app', 'index.ts'), './static-websites/index.js');
-    await (0, ast_1.addStarExport)(tree, (0, devkit_1.joinPathFragments)(shared_constructs_constants_1.PACKAGES_DIR, shared_constructs_constants_1.SHARED_CONSTRUCTS_DIR, 'src', 'app', 'static-websites', 'index.ts'), `./${options.websiteNameKebabCase}.js`);
-    await (0, ast_1.addStarExport)(tree, (0, devkit_1.joinPathFragments)(shared_constructs_constants_1.PACKAGES_DIR, shared_constructs_constants_1.SHARED_CONSTRUCTS_DIR, 'src', 'core', 'index.ts'), './static-website.js');
+    await addStarExport(tree, joinPathFragments(PACKAGES_DIR, SHARED_CONSTRUCTS_DIR, 'src', 'app', 'index.ts'), './static-websites/index.js');
+    await addStarExport(tree, joinPathFragments(PACKAGES_DIR, SHARED_CONSTRUCTS_DIR, 'src', 'app', 'static-websites', 'index.ts'), `./${options.websiteNameKebabCase}.js`);
+    await addStarExport(tree, joinPathFragments(PACKAGES_DIR, SHARED_CONSTRUCTS_DIR, 'src', 'core', 'index.ts'), './static-website.js');
 };
-const addWebsiteTerraformModules = (tree, options) => {
-    (0, devkit_1.generateFiles)(tree, (0, devkit_1.joinPathFragments)(__dirname, 'files', 'terraform', 'core'), (0, devkit_1.joinPathFragments)(shared_constructs_constants_1.PACKAGES_DIR, shared_constructs_constants_1.SHARED_TERRAFORM_DIR, 'src', 'core'), options, {
-        overwriteStrategy: devkit_1.OverwriteStrategy.KeepExisting,
+const addWebsiteTerraformModules = (tree, options)=>{
+    generateFiles(tree, joinPathFragments(import.meta.dirname, 'files', 'terraform', 'core'), joinPathFragments(PACKAGES_DIR, SHARED_TERRAFORM_DIR, 'src', 'core'), {
+        ...options,
+        boto3Version: PY_VERSIONS.boto3,
+        ...terraformProviderVersions()
+    }, {
+        overwriteStrategy: OverwriteStrategy.KeepExisting
     });
-    (0, devkit_1.generateFiles)(tree, (0, devkit_1.joinPathFragments)(__dirname, 'files', 'terraform', 'app'), (0, devkit_1.joinPathFragments)(shared_constructs_constants_1.PACKAGES_DIR, shared_constructs_constants_1.SHARED_TERRAFORM_DIR, 'src', 'app'), options, {
-        overwriteStrategy: devkit_1.OverwriteStrategy.KeepExisting,
+    generateFiles(tree, joinPathFragments(import.meta.dirname, 'files', 'terraform', 'app'), joinPathFragments(PACKAGES_DIR, SHARED_TERRAFORM_DIR, 'src', 'app'), {
+        ...options,
+        ...terraformProviderVersions()
+    }, {
+        overwriteStrategy: OverwriteStrategy.KeepExisting
     });
 };
+
 //# sourceMappingURL=website-constructs.js.map

package/src/utils/website-constructs/website-constructs.js.map

@@ -1 +1 @@
-{"version":3,"file":"website-constructs.js","sourceRoot":"","sources":["../../../../../../packages/nx-plugin/src/utils/website-constructs/website-constructs.ts"],"names":[],"mappings":";;;AAAA;;;GAGG;AACH,uCAOoB;AACpB,gFAIwC;AACxC,gCAAuC;AAEvC,8BAA0D;AAU1D;;GAEG;AACI,MAAM,eAAe,GAAG,KAAK,EAClC,IAAU,EACV,OAA8C,EAC9C,EAAE;IACF,IAAI,OAAO,CAAC,GAAG,KAAK,KAAK,EAAE,CAAC;QAC1B,MAAM,uBAAuB,CAAC,IAAI,EAAE,OAAO,CAAC,CAAC;IAC/C,CAAC;SAAM,IAAI,OAAO,CAAC,GAAG,KAAK,WAAW,EAAE,CAAC;QACvC,0BAA0B,CAAC,IAAI,EAAE,OAAO,CAAC,CAAC;IAC5C,CAAC;SAAM,CAAC;QACN,MAAM,IAAI,KAAK,CAAC,mBAAmB,OAAO,CAAC,GAAG,EAAE,CAAC,CAAC;IACpD,CAAC;IAED,IAAA,mBAAU,EACR,IAAI,EACJ,IAAA,0BAAiB,EACf,0CAAY,EACZ,OAAO,CAAC,GAAG,KAAK,KAAK,CAAC,CAAC,CAAC,mDAAqB,CAAC,CAAC,CAAC,kDAAoB,EACpE,cAAc,CACf,EACD,CAAC,MAA4B,EAAE,EAAE;QAC/B,IAAA,sCAAiC,EAC/B,MAAM,EACN,OAAO,EACP,GAAG,OAAO,CAAC,kBAAkB,QAAQ,CACtC,CAAC;QACF,OAAO,MAAM,CAAC;IAChB,CAAC,CACF,CAAC;AACJ,CAAC,CAAC;AA5BW,QAAA,eAAe,mBA4B1B;AAEF,MAAM,uBAAuB,GAAG,KAAK,EACnC,IAAU,EACV,OAA+B,EAC/B,EAAE;IACF,IAAA,sBAAa,EACX,IAAI,EACJ,IAAA,0BAAiB,EAAC,SAAS,EAAE,OAAO,EAAE,KAAK,EAAE,MAAM,CAAC,EACpD,IAAA,0BAAiB,EAAC,0CAAY,EAAE,mDAAqB,EAAE,KAAK,EAAE,MAAM,CAAC,EACrE,OAAO,EACP;QACE,iBAAiB,EAAE,0BAAiB,CAAC,YAAY;KAClD,CACF,CAAC;IAEF,IAAA,sBAAa,EACX,IAAI,EACJ,IAAA,0BAAiB,EAAC,SAAS,EAAE,OAAO,EAAE,KAAK,EAAE,KAAK,CAAC,EACnD,IAAA,0BAAiB,EAAC,0CAAY,EAAE,mDAAqB,EAAE,KAAK,EAAE,KAAK,CAAC,EACpE,OAAO,EACP;QACE,iBAAiB,EAAE,0BAAiB,CAAC,YAAY;KAClD,CACF,CAAC;IAEF,MAAM,IAAA,mBAAa,EACjB,IAAI,EACJ,IAAA,0BAAiB,EACf,0CAAY,EACZ,mDAAqB,EACrB,KAAK,EACL,KAAK,EACL,UAAU,CACX,EACD,4BAA4B,CAC7B,CAAC;IACF,MAAM,IAAA,mBAAa,EACjB,IAAI,EACJ,IAAA,0BAAiB,EACf,0CAAY,EACZ,mDAAqB,EACrB,KAAK,EACL,KAAK,EACL,iBAAiB,EACjB,UAAU,CACX,EACD,KAAK,OAAO,CAAC,oBAAoB,KAAK,CACvC,CAAC;IACF,MAAM,IAAA,mBAAa,EACjB,IAAI,EACJ,IAAA,0BAAiB,EACf,0CAAY,EACZ,mDAAqB,EACrB,KAAK,EACL,MAAM,EACN,UAAU,CACX,EACD,qBAAqB,CACtB,CAAC;AACJ,CAAC,CAAC;AAEF,MAAM,0BAA0B,GAAG,CACjC,IAAU,EACV,OAA+B,EAC/B,EAAE;IACF,IAAA,sBAAa,EACX,IAAI,EACJ,IAAA,0BAAiB,EAAC,SAAS,EAAE,OAAO,EAAE,WAAW,EAAE,MAAM,CAAC,EAC1D,IAAA,0BAAiB,EAAC,0CAAY,EAAE,kDAAoB,EAAE,KAAK,EAAE,MAAM,CAAC,EACpE,OAAO,EACP;QACE,iBAAiB,EAAE,0BAAiB,CAAC,YAAY;KAClD,CACF,CAAC;IAEF,IAAA,sBAAa,EACX,IAAI,EACJ,IAAA,0BAAiB,EAAC,SAAS,EAAE,OAAO,EAAE,WAAW,EAAE,KAAK,CAAC,EACzD,IAAA,0BAAiB,EAAC,0CAAY,EAAE,kDAAoB,EAAE,KAAK,EAAE,KAAK,CAAC,EACnE,OAAO,EACP;QACE,iBAAiB,EAAE,0BAAiB,CAAC,YAAY;KAClD,CACF,CAAC;AACJ,CAAC,CAAC"}
+{"version":3,"sources":["../../../../../../packages/nx-plugin/src/utils/website-constructs/website-constructs.ts"],"sourcesContent":["/**\n * Copyright Amazon.com, Inc. or its affiliates. All Rights Reserved.\n * SPDX-License-Identifier: Apache-2.0\n */\nimport {\n  generateFiles,\n  joinPathFragments,\n  OverwriteStrategy,\n  type ProjectConfiguration,\n  type Tree,\n  updateJson,\n} from '@nx/devkit';\nimport { addStarExport } from '../ast';\nimport type { Iac } from '../iac';\nimport { esmVars } from '../module-format';\nimport { addDependencyToTargetIfNotPresent } from '../nx';\nimport {\n  PACKAGES_DIR,\n  SHARED_CONSTRUCTS_DIR,\n  SHARED_TERRAFORM_DIR,\n} from '../shared-constructs-constants';\nimport { PY_VERSIONS, terraformProviderVersions } from '../versions';\n\nexport interface AddWebsiteInfraOptions {\n  websiteProjectName: string;\n  scopeAlias: string;\n  websiteContentPath: string;\n  websiteNameKebabCase: string;\n  websiteNameClassName: string;\n}\n\n/**\n * Add infrastructure for a static website\n */\nexport const addWebsiteInfra = async (\n  tree: Tree,\n  options: AddWebsiteInfraOptions & { iac: Iac },\n) => {\n  if (options.iac === 'cdk') {\n    await addWebsiteCdkConstructs(tree, options);\n  } else if (options.iac === 'terraform') {\n    addWebsiteTerraformModules(tree, options);\n  } else {\n    throw new Error(`Unsupported iac ${options.iac}`);\n  }\n\n  updateJson(\n    tree,\n    joinPathFragments(\n      PACKAGES_DIR,\n      options.iac === 'cdk' ? SHARED_CONSTRUCTS_DIR : SHARED_TERRAFORM_DIR,\n      'project.json',\n    ),\n    (config: ProjectConfiguration) => {\n      addDependencyToTargetIfNotPresent(\n        config,\n        'build',\n        `${options.websiteProjectName}:build`,\n      );\n      return config;\n    },\n  );\n};\n\nconst addWebsiteCdkConstructs = async (\n  tree: Tree,\n  options: AddWebsiteInfraOptions,\n) => {\n  generateFiles(\n    tree,\n    joinPathFragments(import.meta.dirname, 'files', 'cdk', 'core'),\n    joinPathFragments(PACKAGES_DIR, SHARED_CONSTRUCTS_DIR, 'src', 'core'),\n    { ...options, ...esmVars(tree) },\n    {\n      overwriteStrategy: OverwriteStrategy.KeepExisting,\n    },\n  );\n\n  generateFiles(\n    tree,\n    joinPathFragments(import.meta.dirname, 'files', 'cdk', 'app'),\n    joinPathFragments(PACKAGES_DIR, SHARED_CONSTRUCTS_DIR, 'src', 'app'),\n    { ...options, ...esmVars(tree) },\n    {\n      overwriteStrategy: OverwriteStrategy.KeepExisting,\n    },\n  );\n\n  await addStarExport(\n    tree,\n    joinPathFragments(\n      PACKAGES_DIR,\n      SHARED_CONSTRUCTS_DIR,\n      'src',\n      'app',\n      'index.ts',\n    ),\n    './static-websites/index.js',\n  );\n  await addStarExport(\n    tree,\n    joinPathFragments(\n      PACKAGES_DIR,\n      SHARED_CONSTRUCTS_DIR,\n      'src',\n      'app',\n      'static-websites',\n      'index.ts',\n    ),\n    `./${options.websiteNameKebabCase}.js`,\n  );\n  await addStarExport(\n    tree,\n    joinPathFragments(\n      PACKAGES_DIR,\n      SHARED_CONSTRUCTS_DIR,\n      'src',\n      'core',\n      'index.ts',\n    ),\n    './static-website.js',\n  );\n};\n\nconst addWebsiteTerraformModules = (\n  tree: Tree,\n  options: AddWebsiteInfraOptions,\n) => {\n  generateFiles(\n    tree,\n    joinPathFragments(import.meta.dirname, 'files', 'terraform', 'core'),\n    joinPathFragments(PACKAGES_DIR, SHARED_TERRAFORM_DIR, 'src', 'core'),\n    {\n      ...options,\n      boto3Version: PY_VERSIONS.boto3,\n      ...terraformProviderVersions(),\n    },\n    {\n      overwriteStrategy: OverwriteStrategy.KeepExisting,\n    },\n  );\n\n  generateFiles(\n    tree,\n    joinPathFragments(import.meta.dirname, 'files', 'terraform', 'app'),\n    joinPathFragments(PACKAGES_DIR, SHARED_TERRAFORM_DIR, 'src', 'app'),\n    { ...options, ...terraformProviderVersions() },\n    {\n      overwriteStrategy: OverwriteStrategy.KeepExisting,\n    },\n  );\n};\n"],"names":["generateFiles","joinPathFragments","OverwriteStrategy","updateJson","addStarExport","esmVars","addDependencyToTargetIfNotPresent","PACKAGES_DIR","SHARED_CONSTRUCTS_DIR","SHARED_TERRAFORM_DIR","PY_VERSIONS","terraformProviderVersions","addWebsiteInfra","tree","options","iac","addWebsiteCdkConstructs","addWebsiteTerraformModules","Error","config","websiteProjectName","dirname","overwriteStrategy","KeepExisting","websiteNameKebabCase","boto3Version","boto3"],"mappings":"AAAA;;;CAGC,GACD,SACEA,aAAa,EACbC,iBAAiB,EACjBC,iBAAiB,EAGjBC,UAAU,QACL,aAAa;AACpB,SAASC,aAAa,QAAQ,YAAS;AAEvC,SAASC,OAAO,QAAQ,sBAAmB;AAC3C,SAASC,iCAAiC,QAAQ,WAAQ;AAC1D,SACEC,YAAY,EACZC,qBAAqB,EACrBC,oBAAoB,QACf,oCAAiC;AACxC,SAASC,WAAW,EAAEC,yBAAyB,QAAQ,iBAAc;AAUrE;;CAEC,GACD,OAAO,MAAMC,kBAAkB,OAC7BC,MACAC;IAEA,IAAIA,QAAQC,GAAG,KAAK,OAAO;QACzB,MAAMC,wBAAwBH,MAAMC;IACtC,OAAO,IAAIA,QAAQC,GAAG,KAAK,aAAa;QACtCE,2BAA2BJ,MAAMC;IACnC,OAAO;QACL,MAAM,IAAII,MAAM,CAAC,gBAAgB,EAAEJ,QAAQC,GAAG,EAAE;IAClD;IAEAZ,WACEU,MACAZ,kBACEM,cACAO,QAAQC,GAAG,KAAK,QAAQP,wBAAwBC,sBAChD,iBAEF,CAACU;QACCb,kCACEa,QACA,SACA,GAAGL,QAAQM,kBAAkB,CAAC,MAAM,CAAC;QAEvC,OAAOD;IACT;AAEJ,EAAE;AAEF,MAAMH,0BAA0B,OAC9BH,MACAC;IAEAd,cACEa,MACAZ,kBAAkB,YAAYoB,OAAO,EAAE,SAAS,OAAO,SACvDpB,kBAAkBM,cAAcC,uBAAuB,OAAO,SAC9D;QAAE,GAAGM,OAAO;QAAE,GAAGT,QAAQQ,KAAK;IAAC,GAC/B;QACES,mBAAmBpB,kBAAkBqB,YAAY;IACnD;IAGFvB,cACEa,MACAZ,kBAAkB,YAAYoB,OAAO,EAAE,SAAS,OAAO,QACvDpB,kBAAkBM,cAAcC,uBAAuB,OAAO,QAC9D;QAAE,GAAGM,OAAO;QAAE,GAAGT,QAAQQ,KAAK;IAAC,GAC/B;QACES,mBAAmBpB,kBAAkBqB,YAAY;IACnD;IAGF,MAAMnB,cACJS,MACAZ,kBACEM,cACAC,uBACA,OACA,OACA,aAEF;IAEF,MAAMJ,cACJS,MACAZ,kBACEM,cACAC,uBACA,OACA,OACA,mBACA,aAEF,CAAC,EAAE,EAAEM,QAAQU,oBAAoB,CAAC,GAAG,CAAC;IAExC,MAAMpB,cACJS,MACAZ,kBACEM,cACAC,uBACA,OACA,QACA,aAEF;AAEJ;AAEA,MAAMS,6BAA6B,CACjCJ,MACAC;IAEAd,cACEa,MACAZ,kBAAkB,YAAYoB,OAAO,EAAE,SAAS,aAAa,SAC7DpB,kBAAkBM,cAAcE,sBAAsB,OAAO,SAC7D;QACE,GAAGK,OAAO;QACVW,cAAcf,YAAYgB,KAAK;QAC/B,GAAGf,2BAA2B;IAChC,GACA;QACEW,mBAAmBpB,kBAAkBqB,YAAY;IACnD;IAGFvB,cACEa,MACAZ,kBAAkB,YAAYoB,OAAO,EAAE,SAAS,aAAa,QAC7DpB,kBAAkBM,cAAcE,sBAAsB,OAAO,QAC7D;QAAE,GAAGK,OAAO;QAAE,GAAGH,2BAA2B;IAAC,GAC7C;QACEW,mBAAmBpB,kBAAkBqB,YAAY;IACnD;AAEJ"}

package/bin/aws-nx-mcp.d.ts

@@ -1,2 +0,0 @@
-#!/usr/bin/env node
-export {};

package/bin/aws-nx-mcp.js

@@ -1,17 +0,0 @@
-#!/usr/bin/env node
-"use strict";
-Object.defineProperty(exports, "__esModule", { value: true });
-/**
- * Copyright Amazon.com, Inc. or its affiliates. All Rights Reserved.
- * SPDX-License-Identifier: Apache-2.0
- */
-const mcp_server_1 = require("../src/mcp-server");
-void (async () => {
-    try {
-        await (0, mcp_server_1.startMcpServer)();
-    }
-    catch (e) {
-        console.error(e);
-    }
-})();
-//# sourceMappingURL=aws-nx-mcp.js.map

package/bin/aws-nx-mcp.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"aws-nx-mcp.js","sourceRoot":"","sources":["../../../../packages/nx-plugin/bin/aws-nx-mcp.ts"],"names":[],"mappings":";;;AACA;;;GAGG;AACH,kDAAmD;AAEnD,KAAK,CAAC,KAAK,IAAI,EAAE;IACf,IAAI,CAAC;QACH,MAAM,IAAA,2BAAc,GAAE,CAAC;IACzB,CAAC;IAAC,OAAO,CAAC,EAAE,CAAC;QACX,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;IACnB,CAAC;AACH,CAAC,CAAC,EAAE,CAAC"}

package/sdk/connection.d.ts

@@ -1,6 +0,0 @@
-/**
- * Copyright Amazon.com, Inc. or its affiliates. All Rights Reserved.
- * SPDX-License-Identifier: Apache-2.0
- */
-export { connectionGenerator } from '../src/connection/generator';
-export type { ConnectionGeneratorSchema } from '../src/connection/schema';

package/sdk/connection.js

@@ -1,10 +0,0 @@
-"use strict";
-/**
- * Copyright Amazon.com, Inc. or its affiliates. All Rights Reserved.
- * SPDX-License-Identifier: Apache-2.0
- */
-Object.defineProperty(exports, "__esModule", { value: true });
-exports.connectionGenerator = void 0;
-var generator_1 = require("../src/connection/generator");
-Object.defineProperty(exports, "connectionGenerator", { enumerable: true, get: function () { return generator_1.connectionGenerator; } });
-//# sourceMappingURL=connection.js.map

package/sdk/connection.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"connection.js","sourceRoot":"","sources":["../../../../packages/nx-plugin/sdk/connection.ts"],"names":[],"mappings":";AAAA;;;GAGG;;;AAEH,yDAAkE;AAAzD,gHAAA,mBAAmB,OAAA"}

package/sdk/license.d.ts

@@ -1,8 +0,0 @@
-/**
- * Copyright Amazon.com, Inc. or its affiliates. All Rights Reserved.
- * SPDX-License-Identifier: Apache-2.0
- */
-export { DEFAULT_LICENSE_ALLOWLIST } from '../src/license/index';
-export type { AllowlistEntry, DependencyCheckConfig, DependencyCheckException, } from '../src/license/index';
-export { npmCollector, pythonCollector } from '../src/license/index';
-export type { LicenseCollector, CollectedDependency, } from '../src/license/index';

package/sdk/license.js

@@ -1,13 +0,0 @@
-"use strict";
-Object.defineProperty(exports, "__esModule", { value: true });
-exports.pythonCollector = exports.npmCollector = exports.DEFAULT_LICENSE_ALLOWLIST = void 0;
-/**
- * Copyright Amazon.com, Inc. or its affiliates. All Rights Reserved.
- * SPDX-License-Identifier: Apache-2.0
- */
-var index_1 = require("../src/license/index");
-Object.defineProperty(exports, "DEFAULT_LICENSE_ALLOWLIST", { enumerable: true, get: function () { return index_1.DEFAULT_LICENSE_ALLOWLIST; } });
-var index_2 = require("../src/license/index");
-Object.defineProperty(exports, "npmCollector", { enumerable: true, get: function () { return index_2.npmCollector; } });
-Object.defineProperty(exports, "pythonCollector", { enumerable: true, get: function () { return index_2.pythonCollector; } });
-//# sourceMappingURL=license.js.map

package/sdk/license.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"license.js","sourceRoot":"","sources":["../../../../packages/nx-plugin/sdk/license.ts"],"names":[],"mappings":";;;AAAA;;;GAGG;AACH,8CAAiE;AAAxD,kHAAA,yBAAyB,OAAA;AAMlC,8CAAqE;AAA5D,qGAAA,YAAY,OAAA;AAAE,wGAAA,eAAe,OAAA"}

package/sdk/open-api.d.ts

@@ -1,10 +0,0 @@
-/**
- * Copyright Amazon.com, Inc. or its affiliates. All Rights Reserved.
- * SPDX-License-Identifier: Apache-2.0
- */
-export { openApiTsClientGenerator, buildOpenApiCodeGenerationData, } from '../src/open-api/ts-client/generator';
-export type { OpenApiTsClientGeneratorSchema } from '../src/open-api/ts-client/schema';
-export { openApiTsHooksGenerator } from '../src/open-api/ts-hooks/generator';
-export type { OpenApiTsHooksGeneratorSchema } from '../src/open-api/ts-hooks/schema';
-export { openApiTsMetadataGenerator } from '../src/open-api/ts-metadata/generator';
-export type { OpenApiTsMetadataGeneratorSchema } from '../src/open-api/ts-metadata/schema';

package/sdk/open-api.js

@@ -1,15 +0,0 @@
-"use strict";
-/**
- * Copyright Amazon.com, Inc. or its affiliates. All Rights Reserved.
- * SPDX-License-Identifier: Apache-2.0
- */
-Object.defineProperty(exports, "__esModule", { value: true });
-exports.openApiTsMetadataGenerator = exports.openApiTsHooksGenerator = exports.buildOpenApiCodeGenerationData = exports.openApiTsClientGenerator = void 0;
-var generator_1 = require("../src/open-api/ts-client/generator");
-Object.defineProperty(exports, "openApiTsClientGenerator", { enumerable: true, get: function () { return generator_1.openApiTsClientGenerator; } });
-Object.defineProperty(exports, "buildOpenApiCodeGenerationData", { enumerable: true, get: function () { return generator_1.buildOpenApiCodeGenerationData; } });
-var generator_2 = require("../src/open-api/ts-hooks/generator");
-Object.defineProperty(exports, "openApiTsHooksGenerator", { enumerable: true, get: function () { return generator_2.openApiTsHooksGenerator; } });
-var generator_3 = require("../src/open-api/ts-metadata/generator");
-Object.defineProperty(exports, "openApiTsMetadataGenerator", { enumerable: true, get: function () { return generator_3.openApiTsMetadataGenerator; } });
-//# sourceMappingURL=open-api.js.map

package/sdk/open-api.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"open-api.js","sourceRoot":"","sources":["../../../../packages/nx-plugin/sdk/open-api.ts"],"names":[],"mappings":";AAAA;;;GAGG;;;AAEH,iEAG6C;AAF3C,qHAAA,wBAAwB,OAAA;AACxB,2HAAA,8BAA8B,OAAA;AAIhC,gEAA6E;AAApE,oHAAA,uBAAuB,OAAA;AAGhC,mEAAmF;AAA1E,uHAAA,0BAA0B,OAAA"}