@aws/nx-plugin 1.0.0-rc.50 → 1.0.0-rc.52

package/src/utils/format.js.map

@@ -1 +1 @@
-{"version":3,"sources":["../../../../../packages/nx-plugin/src/utils/format.ts"],"sourcesContent":["/**\n * Copyright Amazon.com, Inc. or its affiliates. All Rights Reserved.\n * SPDX-License-Identifier: Apache-2.0\n */\n\nimport { Biome } from '@biomejs/js-api/nodejs';\nimport { getProjects, type Tree } from '@nx/devkit';\nimport path from 'path';\nimport { type RuffOptions, ruffFixAndFormat } from './ruff';\nimport { tryReadToml } from './toml';\nimport { TS_VERSIONS } from './versions';\n\n/**\n * The biome.json vended into a new workspace. The pnpm catalog resolver is only\n * included on pnpm workspaces, since `experimentalPnpmCatalogs` is Biome's only\n * catalog resolver and reads `pnpm-workspace.yaml` exclusively — it does nothing\n * for yarn or bun catalogs, so vending it there would be misleading.\n */\nexport const getDefaultBiomeConfig = (tree: Tree) => ({\n  $schema: `https://biomejs.dev/schemas/${TS_VERSIONS['@biomejs/biome']}/schema.json`,\n  root: true,\n  formatter: {\n    enabled: true,\n    indentStyle: 'space',\n    indentWidth: 2,\n    lineWidth: 80,\n  },\n  javascript: {\n    formatter: {\n      quoteStyle: 'single',\n      trailingCommas: 'all',\n    },\n    // Resolve `catalog:` versions from pnpm-workspace.yaml (pnpm workspaces only).\n    ...(tree.exists('pnpm-workspace.yaml')\n      ? { resolver: { experimentalPnpmCatalogs: true } }\n      : {}),\n  },\n  css: {\n    formatter: {\n      quoteStyle: 'single',\n    },\n    linter: {\n      enabled: false,\n    },\n  },\n  linter: {\n    enabled: true,\n    rules: {\n      preset: 'none',\n      correctness: {\n        // Every project must declare the third-party dependencies its source\n        // code imports in its own package.json.\n        noUndeclaredDependencies: 'error',\n      },\n    },\n  },\n  assist: {\n    actions: {\n      source: {\n        organizeImports: 'on',\n      },\n    },\n  },\n  files: {\n    includes: [\n      '**',\n      '!**/dist',\n      '!**/out-tsc',\n      '!**/node_modules',\n      '!**/.nx',\n      '!**/.venv',\n      // GritQL codemod cache written by generators — its sample sources\n      // otherwise pollute a bare `biome check .` with parse errors.\n      '!**/.grit',\n      '!**/*.css',\n      '!**/*.gen.*',\n      '!**/generated/**',\n      '!**/tsconfig*.json',\n    ],\n  },\n  // Config files, build scripts and tests use root tooling rather than\n  // declaring it per-project, so the undeclared-dependency rule is off for them.\n  overrides: [\n    {\n      includes: [\n        '**/*.config.{ts,mts,cts,js,mjs,cjs}',\n        '**/*.{spec,test}.{ts,tsx,mts,cts,js,jsx,mjs,cjs}',\n        '**/*.stories.{ts,tsx}',\n      ],\n      linter: {\n        rules: {\n          correctness: {\n            noUndeclaredDependencies: 'off',\n          },\n        },\n      },\n    },\n  ],\n});\n\nconst BIOME_FORMATTABLE_EXTENSIONS = new Set([\n  '.ts',\n  '.tsx',\n  '.js',\n  '.jsx',\n  '.mjs',\n  '.cjs',\n  '.mts',\n  '.cts',\n  '.json',\n  '.jsonc',\n  '.css',\n]);\n\n/** Matches `tsconfig.json` and variants like `tsconfig.lib.json`. */\nconst isTsConfig = (filePath: string): boolean =>\n  /(^|\\/)tsconfig[^/]*\\.json$/.test(filePath);\n\n/**\n * Format files in the given directory within the tree.\n * Handles both TypeScript/JavaScript/JSON (via biome) and Python (via ruff) files.\n * See https://github.com/nrwl/nx/blob/4cd640a9187954505d12de5b6d76a90d8ce4c2eb/packages/devkit/src/generators/format-files.ts#L11\n */\nexport async function formatFilesInSubtree(\n  tree: Tree,\n  dir?: string,\n): Promise<void> {\n  const changedFiles = tree\n    .listChanges()\n    .filter((file) => file.type !== 'DELETE')\n    .filter((file) => (dir ? file.path.startsWith(dir) : true));\n\n  const pyFiles = changedFiles.filter((file) => file.path.endsWith('.py'));\n  const otherFiles = changedFiles.filter(\n    (file) =>\n      BIOME_FORMATTABLE_EXTENSIONS.has(path.extname(file.path)) &&\n      // tsconfigs are not biome-managed: they're excluded from the vended\n      // format target (Nx's typescript-sync rewrites them without formatting),\n      // so formatting them at generation would only diverge from the form\n      // written on later runs. Leave them as updateJson/writeJson emit them so\n      // repeated generation stays idempotent.\n      !isTsConfig(file.path),\n  );\n\n  // Resolve each project's ruff settings (module names, line-length) so files\n  // are formatted to match the on-disk build (see getPythonProjectRuffConfigs).\n  const pythonProjectConfigs = pyFiles.length\n    ? getPythonProjectRuffConfigs(tree)\n    : [];\n\n  // Format Python files with ruff (lint fixes + formatting)\n  for (const file of pyFiles) {\n    try {\n      const content = ruffFixAndFormat(\n        file.content.toString('utf-8'),\n        file.path,\n        resolveRuffOptions(\n          readRuffConfig(tree, file.path),\n          getOwningProjectRuffConfig(file.path, pythonProjectConfigs),\n        ),\n      );\n      tree.write(file.path, content);\n    } catch {\n      // Silently skip ruff formatting failures\n    }\n  }\n\n  if (otherFiles.length === 0) return;\n\n  formatWithBiome(tree, otherFiles);\n}\n\n/**\n * The Biome configuration to format with: the workspace's own `biome.json`, else\n * the config we vend.\n *\n * Read through the tree, which falls back to disk for a file it doesn't hold. So\n * this resolves the most current config either way — the workspace's on-disk one,\n * or the version a generator has just written to the tree and not yet flushed,\n * which shelling out to the CLI could never see.\n */\nfunction readBiomeConfig(tree: Tree): unknown {\n  const config = tree.read('biome.json', 'utf-8');\n  if (config) {\n    try {\n      return JSON.parse(config);\n    } catch {\n      // Malformed config — fall through to the config we vend\n    }\n  }\n  return getDefaultBiomeConfig(tree);\n}\n\n/**\n * Format files with Biome in-process, reusing one instance across the batch.\n *\n * Replaces one `biome format --stdin-file-path` process per file, which\n * dominated generation at ~70ms each: `formatFilesInSubtree` formats every\n * change accumulated in the tree, not only the ones its caller made, so\n * generators sharing a tree reformat the same files once per call. In-process is\n * ~0.5ms per file. Output was verified byte-identical across the plugin's whole\n * source tree, except that the CLI corrupts control characters passed through\n * stdin (a NUL in a template literal) where formatting in-process preserves them.\n */\nfunction formatWithBiome(\n  tree: Tree,\n  files: { path: string; content: Buffer | null }[],\n): void {\n  try {\n    const biome = new Biome();\n    const { projectKey } = biome.openProject();\n    biome.applyConfiguration(projectKey, readBiomeConfig(tree));\n\n    for (const file of files) {\n      try {\n        const { content } = biome.formatContent(\n          projectKey,\n          file.content?.toString('utf-8') ?? '',\n          { filePath: file.path },\n        );\n        tree.write(file.path, content);\n      } catch {\n        // Leave individual files that fail to format untouched\n      }\n    }\n  } catch {\n    // Silently skip formatting failures\n  }\n}\n\n/**\n * Read the ruff config for a file, by walking from its directory up to the\n * workspace root looking for `.ruff.toml`, `ruff.toml`, or a `pyproject.toml`\n * with a `[tool.ruff]` section — the same files, in the same order, that ruff\n * itself resolves. The walk stops at the workspace root so a stray config in a\n * parent of the workspace (or the home directory) is never treated as the\n * project's.\n *\n * The settings are read rather than merely detected because formatting runs\n * in-process against tree content, so ruff never sees the file's location and\n * cannot resolve the config itself (see {@link resolveRuffOptions}).\n *\n * Reads go through the tree, which falls through to disk for files this run has\n * not touched, so a config the generator has just written in memory is picked up\n * as well as one already on disk.\n */\nfunction readRuffConfig(tree: Tree, filePath: string): RuffOptions | undefined {\n  let dir = path.dirname(filePath);\n  while (true) {\n    for (const name of ['.ruff.toml', 'ruff.toml']) {\n      const config = tryReadToml(tree, path.join(dir, name));\n      if (config) {\n        return config as RuffOptions;\n      }\n    }\n    const ruff = (tryReadToml(tree, path.join(dir, 'pyproject.toml')) as any)\n      ?.tool?.ruff;\n    if (ruff) {\n      return ruff as RuffOptions;\n    }\n    // Stop once the workspace root ('.') has been checked.\n    if (dir === '.' || dir === '' || dir === path.dirname(dir)) {\n      return undefined;\n    }\n    dir = path.dirname(dir);\n  }\n}\n\n/**\n * The `[tool.ruff.lint].select` generated Python projects vend. Generation\n * formats before that config lands on disk, so it is pinned here to keep\n * generated files clean under the project's own `lint` target rather than under\n * whatever ruff's defaults happen to be for the pinned release.\n */\nconst DEFAULT_RUFF_SELECT = ['E', 'F', 'UP', 'B', 'SIM', 'I'];\n\ninterface PythonProjectRuffConfig {\n  /** Project root, normalised to use forward slashes. */\n  readonly root: string;\n  /** Top-level importable module names declared by the project. */\n  readonly modules: string[];\n  /** The project's `[tool.ruff].line-length`, if set. */\n  readonly lineLength?: number;\n  /**\n   * Ruff `target-version` (eg `py314`) derived from `[project].requires-python`.\n   * Generation formats via stdin with no pyproject, so it must be passed\n   * explicitly — ruff's formatting differs by target.\n   */\n  readonly targetVersion?: string;\n  /** The project's `[tool.ruff.lint].select`, if set. */\n  readonly select?: string[];\n}\n\n/**\n * Derive ruff's `target-version` (eg `py314`) from a PEP 508\n * `requires-python` specifier (eg `>=3.14`). Ruff targets the minimum\n * supported version, so take the lowest `major.minor` mentioned.\n */\nexport const requiresPythonToRuffTarget = (\n  requiresPython: unknown,\n): string | undefined => {\n  if (typeof requiresPython !== 'string') {\n    return undefined;\n  }\n  let min: { major: number; minor: number } | undefined;\n  for (const match of requiresPython.matchAll(/(\\d+)\\.(\\d+)/g)) {\n    const major = Number(match[1]);\n    const minor = Number(match[2]);\n    if (\n      !min ||\n      major < min.major ||\n      (major === min.major && minor < min.minor)\n    ) {\n      min = { major, minor };\n    }\n  }\n  return min ? `py${min.major}${min.minor}` : undefined;\n};\n\n/**\n * Map each Nx project with a `pyproject.toml` to the ruff settings the on-disk\n * build enforces for it: its top-level module names (from\n * `[tool.hatch.build.targets.wheel].packages`), its `[tool.ruff].line-length`\n * and its `[tool.ruff.lint].select`.\n */\nfunction getPythonProjectRuffConfigs(tree: Tree): PythonProjectRuffConfig[] {\n  const configs: PythonProjectRuffConfig[] = [];\n\n  for (const project of getProjects(tree).values()) {\n    // Projects without a pyproject.toml, or whose one cannot be parsed, have no\n    // ruff settings to contribute.\n    const pyproject = tryReadToml(\n      tree,\n      path.join(project.root, 'pyproject.toml'),\n    ) as any;\n    if (!pyproject) {\n      continue;\n    }\n    const wheelPackages: unknown =\n      pyproject?.tool?.hatch?.build?.targets?.wheel?.packages;\n    // Record the top-level module segment (`pkg/sub` -> `pkg`), which is\n    // all `known-first-party` keys off.\n    const modules = Array.isArray(wheelPackages)\n      ? wheelPackages\n          .filter((pkg): pkg is string => typeof pkg === 'string' && !!pkg)\n          .map((pkg) => pkg.split('/')[0])\n      : [];\n    const lineLength: unknown = pyproject?.tool?.ruff?.['line-length'];\n    const targetVersion = requiresPythonToRuffTarget(\n      pyproject?.project?.['requires-python'],\n    );\n    const selected: unknown = pyproject?.tool?.ruff?.lint?.select;\n    const select = Array.isArray(selected)\n      ? selected.filter(\n          (rule): rule is string => typeof rule === 'string' && !!rule,\n        )\n      : undefined;\n    if (\n      modules.length ||\n      typeof lineLength === 'number' ||\n      targetVersion ||\n      select?.length\n    ) {\n      configs.push({\n        root: project.root.split(path.sep).join('/'),\n        modules,\n        lineLength: typeof lineLength === 'number' ? lineLength : undefined,\n        targetVersion,\n        select: select?.length ? select : undefined,\n      });\n    }\n  }\n\n  return configs;\n}\n\n/**\n * Resolve the ruff config for the project that owns a file (the project with\n * the longest root that is a prefix of the file path). Ruff runs per-project on\n * disk, so a file's settings come from its own project — only its own module is\n * first-party (sibling workspace packages are third-party) and its own\n * line-length applies — and scoping this way keeps in-tree formatting\n * consistent with the on-disk build.\n */\nfunction getOwningProjectRuffConfig(\n  filePath: string,\n  configs: PythonProjectRuffConfig[],\n): PythonProjectRuffConfig | undefined {\n  let owner: PythonProjectRuffConfig | undefined;\n  for (const config of configs) {\n    if (\n      (filePath === config.root || filePath.startsWith(`${config.root}/`)) &&\n      (!owner || config.root.length > owner.root.length)\n    ) {\n      owner = config;\n    }\n  }\n  return owner;\n}\n\n/**\n * Resolve the ruff settings to format a Python file with, mirroring what the\n * file's build enforces.\n *\n * Ruff's own config discovery never runs: settings are passed to the linter\n * directly rather than resolved from the file's location, which it never sees.\n * That also means a stray config above the workspace (or in the home directory)\n * can never be picked up.\n *\n * `config` is the file's nearest ruff config, whose rule selection is honoured\n * as-is. Without one, ruff would fall back to its own defaults, which change\n * between releases — 0.16 widened them from `E` and `F` to 36 rule prefixes — so\n * generation would apply fixes the project's build never asks for (eg `RUF022`\n * reordering `__all__`). Instead the project's own `lint.select` is pinned, so\n * generation enforces exactly what `lint` does and nothing more.\n *\n * `projectConfig` layers on the settings derived from the owning project rather\n * than declared under `[tool.ruff]`: `known-first-party` (the project's own\n * modules, from its wheel packages) keeps its imports in their own group, and\n * `target-version` (from its `requires-python`) matches the formatting the build\n * produces.\n */\nfunction resolveRuffOptions(\n  config: RuffOptions | undefined,\n  projectConfig?: PythonProjectRuffConfig,\n): RuffOptions {\n  const lint: Record<string, unknown> = { ...config?.lint };\n  // Pin the rule selection only when deferring to ruff's defaults would\n  // otherwise apply rules the project's build does not enforce.\n  if (!config) {\n    lint.select = projectConfig?.select ?? DEFAULT_RUFF_SELECT;\n  }\n  if (projectConfig?.modules.length) {\n    lint.isort = {\n      ...(lint.isort as object | undefined),\n      'known-first-party': projectConfig.modules,\n    };\n  }\n  return {\n    ...config,\n    ...(typeof projectConfig?.lineLength === 'number'\n      ? { 'line-length': projectConfig.lineLength }\n      : {}),\n    ...(projectConfig?.targetVersion\n      ? { 'target-version': projectConfig.targetVersion }\n      : {}),\n    lint,\n  };\n}\n"],"names":["Biome","getProjects","path","ruffFixAndFormat","tryReadToml","TS_VERSIONS","getDefaultBiomeConfig","tree","$schema","root","formatter","enabled","indentStyle","indentWidth","lineWidth","javascript","quoteStyle","trailingCommas","exists","resolver","experimentalPnpmCatalogs","css","linter","rules","preset","correctness","noUndeclaredDependencies","assist","actions","source","organizeImports","files","includes","overrides","BIOME_FORMATTABLE_EXTENSIONS","Set","isTsConfig","filePath","test","formatFilesInSubtree","dir","changedFiles","listChanges","filter","file","type","startsWith","pyFiles","endsWith","otherFiles","has","extname","pythonProjectConfigs","length","getPythonProjectRuffConfigs","content","toString","resolveRuffOptions","readRuffConfig","getOwningProjectRuffConfig","write","formatWithBiome","readBiomeConfig","config","read","JSON","parse","biome","projectKey","openProject","applyConfiguration","formatContent","dirname","name","join","ruff","tool","undefined","DEFAULT_RUFF_SELECT","requiresPythonToRuffTarget","requiresPython","min","match","matchAll","major","Number","minor","configs","project","values","pyproject","wheelPackages","hatch","build","targets","wheel","packages","modules","Array","isArray","pkg","map","split","lineLength","targetVersion","selected","lint","select","rule","push","sep","owner","projectConfig","isort"],"mappings":"AAAA;;;CAGC,GAED,SAASA,KAAK,QAAQ,yBAAyB;AAC/C,SAASC,WAAW,QAAmB,aAAa;AACpD,OAAOC,UAAU,OAAO;AACxB,SAA2BC,gBAAgB,QAAQ,YAAS;AAC5D,SAASC,WAAW,QAAQ,YAAS;AACrC,SAASC,WAAW,QAAQ,gBAAa;AAEzC;;;;;CAKC,GACD,OAAO,MAAMC,wBAAwB,CAACC,OAAgB,CAAA;QACpDC,SAAS,CAAC,4BAA4B,EAAEH,WAAW,CAAC,iBAAiB,CAAC,YAAY,CAAC;QACnFI,MAAM;QACNC,WAAW;YACTC,SAAS;YACTC,aAAa;YACbC,aAAa;YACbC,WAAW;QACb;QACAC,YAAY;YACVL,WAAW;gBACTM,YAAY;gBACZC,gBAAgB;YAClB;YACA,+EAA+E;YAC/E,GAAIV,KAAKW,MAAM,CAAC,yBACZ;gBAAEC,UAAU;oBAAEC,0BAA0B;gBAAK;YAAE,IAC/C,CAAC,CAAC;QACR;QACAC,KAAK;YACHX,WAAW;gBACTM,YAAY;YACd;YACAM,QAAQ;gBACNX,SAAS;YACX;QACF;QACAW,QAAQ;YACNX,SAAS;YACTY,OAAO;gBACLC,QAAQ;gBACRC,aAAa;oBACX,qEAAqE;oBACrE,wCAAwC;oBACxCC,0BAA0B;gBAC5B;YACF;QACF;QACAC,QAAQ;YACNC,SAAS;gBACPC,QAAQ;oBACNC,iBAAiB;gBACnB;YACF;QACF;QACAC,OAAO;YACLC,UAAU;gBACR;gBACA;gBACA;gBACA;gBACA;gBACA;gBACA,kEAAkE;gBAClE,8DAA8D;gBAC9D;gBACA;gBACA;gBACA;gBACA;aACD;QACH;QACA,qEAAqE;QACrE,+EAA+E;QAC/EC,WAAW;YACT;gBACED,UAAU;oBACR;oBACA;oBACA;iBACD;gBACDV,QAAQ;oBACNC,OAAO;wBACLE,aAAa;4BACXC,0BAA0B;wBAC5B;oBACF;gBACF;YACF;SACD;IACH,CAAA,EAAG;AAEH,MAAMQ,+BAA+B,IAAIC,IAAI;IAC3C;IACA;IACA;IACA;IACA;IACA;IACA;IACA;IACA;IACA;IACA;CACD;AAED,mEAAmE,GACnE,MAAMC,aAAa,CAACC,WAClB,6BAA6BC,IAAI,CAACD;AAEpC;;;;CAIC,GACD,OAAO,eAAeE,qBACpBhC,IAAU,EACViC,GAAY;IAEZ,MAAMC,eAAelC,KAClBmC,WAAW,GACXC,MAAM,CAAC,CAACC,OAASA,KAAKC,IAAI,KAAK,UAC/BF,MAAM,CAAC,CAACC,OAAUJ,MAAMI,KAAK1C,IAAI,CAAC4C,UAAU,CAACN,OAAO;IAEvD,MAAMO,UAAUN,aAAaE,MAAM,CAAC,CAACC,OAASA,KAAK1C,IAAI,CAAC8C,QAAQ,CAAC;IACjE,MAAMC,aAAaR,aAAaE,MAAM,CACpC,CAACC,OACCV,6BAA6BgB,GAAG,CAAChD,KAAKiD,OAAO,CAACP,KAAK1C,IAAI,MACvD,oEAAoE;QACpE,yEAAyE;QACzE,oEAAoE;QACpE,yEAAyE;QACzE,wCAAwC;QACxC,CAACkC,WAAWQ,KAAK1C,IAAI;IAGzB,4EAA4E;IAC5E,8EAA8E;IAC9E,MAAMkD,uBAAuBL,QAAQM,MAAM,GACvCC,4BAA4B/C,QAC5B,EAAE;IAEN,0DAA0D;IAC1D,KAAK,MAAMqC,QAAQG,QAAS;QAC1B,IAAI;YACF,MAAMQ,UAAUpD,iBACdyC,KAAKW,OAAO,CAACC,QAAQ,CAAC,UACtBZ,KAAK1C,IAAI,EACTuD,mBACEC,eAAenD,MAAMqC,KAAK1C,IAAI,GAC9ByD,2BAA2Bf,KAAK1C,IAAI,EAAEkD;YAG1C7C,KAAKqD,KAAK,CAAChB,KAAK1C,IAAI,EAAEqD;QACxB,EAAE,OAAM;QACN,yCAAyC;QAC3C;IACF;IAEA,IAAIN,WAAWI,MAAM,KAAK,GAAG;IAE7BQ,gBAAgBtD,MAAM0C;AACxB;AAEA;;;;;;;;CAQC,GACD,SAASa,gBAAgBvD,IAAU;IACjC,MAAMwD,SAASxD,KAAKyD,IAAI,CAAC,cAAc;IACvC,IAAID,QAAQ;QACV,IAAI;YACF,OAAOE,KAAKC,KAAK,CAACH;QACpB,EAAE,OAAM;QACN,wDAAwD;QAC1D;IACF;IACA,OAAOzD,sBAAsBC;AAC/B;AAEA;;;;;;;;;;CAUC,GACD,SAASsD,gBACPtD,IAAU,EACVwB,KAAiD;IAEjD,IAAI;QACF,MAAMoC,QAAQ,IAAInE;QAClB,MAAM,EAAEoE,UAAU,EAAE,GAAGD,MAAME,WAAW;QACxCF,MAAMG,kBAAkB,CAACF,YAAYN,gBAAgBvD;QAErD,KAAK,MAAMqC,QAAQb,MAAO;YACxB,IAAI;gBACF,MAAM,EAAEwB,OAAO,EAAE,GAAGY,MAAMI,aAAa,CACrCH,YACAxB,KAAKW,OAAO,EAAEC,SAAS,YAAY,IACnC;oBAAEnB,UAAUO,KAAK1C,IAAI;gBAAC;gBAExBK,KAAKqD,KAAK,CAAChB,KAAK1C,IAAI,EAAEqD;YACxB,EAAE,OAAM;YACN,uDAAuD;YACzD;QACF;IACF,EAAE,OAAM;IACN,oCAAoC;IACtC;AACF;AAEA;;;;;;;;;;;;;;;CAeC,GACD,SAASG,eAAenD,IAAU,EAAE8B,QAAgB;IAClD,IAAIG,MAAMtC,KAAKsE,OAAO,CAACnC;IACvB,MAAO,KAAM;QACX,KAAK,MAAMoC,QAAQ;YAAC;YAAc;SAAY,CAAE;YAC9C,MAAMV,SAAS3D,YAAYG,MAAML,KAAKwE,IAAI,CAAClC,KAAKiC;YAChD,IAAIV,QAAQ;gBACV,OAAOA;YACT;QACF;QACA,MAAMY,OAAQvE,YAAYG,MAAML,KAAKwE,IAAI,CAAClC,KAAK,oBAC3CoC,MAAMD;QACV,IAAIA,MAAM;YACR,OAAOA;QACT;QACA,uDAAuD;QACvD,IAAInC,QAAQ,OAAOA,QAAQ,MAAMA,QAAQtC,KAAKsE,OAAO,CAAChC,MAAM;YAC1D,OAAOqC;QACT;QACArC,MAAMtC,KAAKsE,OAAO,CAAChC;IACrB;AACF;AAEA;;;;;CAKC,GACD,MAAMsC,sBAAsB;IAAC;IAAK;IAAK;IAAM;IAAK;IAAO;CAAI;AAmB7D;;;;CAIC,GACD,OAAO,MAAMC,6BAA6B,CACxCC;IAEA,IAAI,OAAOA,mBAAmB,UAAU;QACtC,OAAOH;IACT;IACA,IAAII;IACJ,KAAK,MAAMC,SAASF,eAAeG,QAAQ,CAAC,iBAAkB;QAC5D,MAAMC,QAAQC,OAAOH,KAAK,CAAC,EAAE;QAC7B,MAAMI,QAAQD,OAAOH,KAAK,CAAC,EAAE;QAC7B,IACE,CAACD,OACDG,QAAQH,IAAIG,KAAK,IAChBA,UAAUH,IAAIG,KAAK,IAAIE,QAAQL,IAAIK,KAAK,EACzC;YACAL,MAAM;gBAAEG;gBAAOE;YAAM;QACvB;IACF;IACA,OAAOL,MAAM,CAAC,EAAE,EAAEA,IAAIG,KAAK,GAAGH,IAAIK,KAAK,EAAE,GAAGT;AAC9C,EAAE;AAEF;;;;;CAKC,GACD,SAASvB,4BAA4B/C,IAAU;IAC7C,MAAMgF,UAAqC,EAAE;IAE7C,KAAK,MAAMC,WAAWvF,YAAYM,MAAMkF,MAAM,GAAI;QAChD,4EAA4E;QAC5E,+BAA+B;QAC/B,MAAMC,YAAYtF,YAChBG,MACAL,KAAKwE,IAAI,CAACc,QAAQ/E,IAAI,EAAE;QAE1B,IAAI,CAACiF,WAAW;YACd;QACF;QACA,MAAMC,gBACJD,WAAWd,MAAMgB,OAAOC,OAAOC,SAASC,OAAOC;QACjD,qEAAqE;QACrE,oCAAoC;QACpC,MAAMC,UAAUC,MAAMC,OAAO,CAACR,iBAC1BA,cACGhD,MAAM,CAAC,CAACyD,MAAuB,OAAOA,QAAQ,YAAY,CAAC,CAACA,KAC5DC,GAAG,CAAC,CAACD,MAAQA,IAAIE,KAAK,CAAC,IAAI,CAAC,EAAE,IACjC,EAAE;QACN,MAAMC,aAAsBb,WAAWd,MAAMD,MAAM,CAAC,cAAc;QAClE,MAAM6B,gBAAgBzB,2BACpBW,WAAWF,SAAS,CAAC,kBAAkB;QAEzC,MAAMiB,WAAoBf,WAAWd,MAAMD,MAAM+B,MAAMC;QACvD,MAAMA,SAAST,MAAMC,OAAO,CAACM,YACzBA,SAAS9D,MAAM,CACb,CAACiE,OAAyB,OAAOA,SAAS,YAAY,CAAC,CAACA,QAE1D/B;QACJ,IACEoB,QAAQ5C,MAAM,IACd,OAAOkD,eAAe,YACtBC,iBACAG,QAAQtD,QACR;YACAkC,QAAQsB,IAAI,CAAC;gBACXpG,MAAM+E,QAAQ/E,IAAI,CAAC6F,KAAK,CAACpG,KAAK4G,GAAG,EAAEpC,IAAI,CAAC;gBACxCuB;gBACAM,YAAY,OAAOA,eAAe,WAAWA,aAAa1B;gBAC1D2B;gBACAG,QAAQA,QAAQtD,SAASsD,SAAS9B;YACpC;QACF;IACF;IAEA,OAAOU;AACT;AAEA;;;;;;;CAOC,GACD,SAAS5B,2BACPtB,QAAgB,EAChBkD,OAAkC;IAElC,IAAIwB;IACJ,KAAK,MAAMhD,UAAUwB,QAAS;QAC5B,IACE,AAAClD,CAAAA,aAAa0B,OAAOtD,IAAI,IAAI4B,SAASS,UAAU,CAAC,GAAGiB,OAAOtD,IAAI,CAAC,CAAC,CAAC,CAAA,KACjE,CAAA,CAACsG,SAAShD,OAAOtD,IAAI,CAAC4C,MAAM,GAAG0D,MAAMtG,IAAI,CAAC4C,MAAM,AAAD,GAChD;YACA0D,QAAQhD;QACV;IACF;IACA,OAAOgD;AACT;AAEA;;;;;;;;;;;;;;;;;;;;;CAqBC,GACD,SAAStD,mBACPM,MAA+B,EAC/BiD,aAAuC;IAEvC,MAAMN,OAAgC;QAAE,GAAG3C,QAAQ2C,IAAI;IAAC;IACxD,sEAAsE;IACtE,8DAA8D;IAC9D,IAAI,CAAC3C,QAAQ;QACX2C,KAAKC,MAAM,GAAGK,eAAeL,UAAU7B;IACzC;IACA,IAAIkC,eAAef,QAAQ5C,QAAQ;QACjCqD,KAAKO,KAAK,GAAG;YACX,GAAIP,KAAKO,KAAK;YACd,qBAAqBD,cAAcf,OAAO;QAC5C;IACF;IACA,OAAO;QACL,GAAGlC,MAAM;QACT,GAAI,OAAOiD,eAAeT,eAAe,WACrC;YAAE,eAAeS,cAAcT,UAAU;QAAC,IAC1C,CAAC,CAAC;QACN,GAAIS,eAAeR,gBACf;YAAE,kBAAkBQ,cAAcR,aAAa;QAAC,IAChD,CAAC,CAAC;QACNE;IACF;AACF"}
+{"version":3,"sources":["../../../../../packages/nx-plugin/src/utils/format.ts"],"sourcesContent":["/**\n * Copyright Amazon.com, Inc. or its affiliates. All Rights Reserved.\n * SPDX-License-Identifier: Apache-2.0\n */\n\nimport { Biome } from '@biomejs/js-api/nodejs';\nimport { getProjects, type Tree } from '@nx/devkit';\nimport path from 'path';\nimport { type RuffOptions, ruffFixAndFormat } from './ruff';\nimport { tryReadToml } from './toml';\nimport { TS_VERSIONS } from './versions';\n\n/**\n * The biome.json vended into a new workspace. The pnpm catalog resolver is only\n * included on pnpm workspaces, since `experimentalPnpmCatalogs` is Biome's only\n * catalog resolver and reads `pnpm-workspace.yaml` exclusively — it does nothing\n * for yarn or bun catalogs, so vending it there would be misleading.\n */\nexport const getDefaultBiomeConfig = (tree: Tree) => ({\n  $schema: `https://biomejs.dev/schemas/${TS_VERSIONS['@biomejs/biome']}/schema.json`,\n  root: true,\n  formatter: {\n    enabled: true,\n    indentStyle: 'space',\n    indentWidth: 2,\n    lineWidth: 80,\n  },\n  javascript: {\n    formatter: {\n      quoteStyle: 'single',\n      trailingCommas: 'all',\n    },\n    // Resolve `catalog:` versions from pnpm-workspace.yaml (pnpm workspaces only).\n    ...(tree.exists('pnpm-workspace.yaml')\n      ? { resolver: { experimentalPnpmCatalogs: true } }\n      : {}),\n  },\n  css: {\n    formatter: {\n      quoteStyle: 'single',\n    },\n    linter: {\n      enabled: false,\n    },\n  },\n  linter: {\n    enabled: true,\n    rules: {\n      preset: 'none',\n      correctness: {\n        // Every project must declare the third-party dependencies its source\n        // code imports in its own package.json.\n        noUndeclaredDependencies: 'error',\n      },\n    },\n  },\n  assist: {\n    actions: {\n      source: {\n        organizeImports: 'on',\n      },\n    },\n  },\n  files: {\n    includes: [\n      '**',\n      '!**/dist',\n      '!**/out-tsc',\n      '!**/node_modules',\n      '!**/.nx',\n      '!**/.venv',\n      // GritQL codemod cache written by generators — its sample sources\n      // otherwise pollute a bare `biome check .` with parse errors.\n      '!**/.grit',\n      '!**/*.css',\n      '!**/*.gen.*',\n      '!**/generated/**',\n      '!**/tsconfig*.json',\n    ],\n  },\n  // Config files, build scripts and tests use root tooling rather than\n  // declaring it per-project, so the undeclared-dependency rule is off for them.\n  overrides: [\n    {\n      includes: [\n        '**/*.config.{ts,mts,cts,js,mjs,cjs}',\n        '**/*.{spec,test}.{ts,tsx,mts,cts,js,jsx,mjs,cjs}',\n        '**/*.stories.{ts,tsx}',\n      ],\n      linter: {\n        rules: {\n          correctness: {\n            noUndeclaredDependencies: 'off',\n          },\n        },\n      },\n    },\n  ],\n});\n\nconst BIOME_FORMATTABLE_EXTENSIONS = new Set([\n  '.ts',\n  '.tsx',\n  '.js',\n  '.jsx',\n  '.mjs',\n  '.cjs',\n  '.mts',\n  '.cts',\n  '.json',\n  '.jsonc',\n  '.css',\n]);\n\n/** Matches `tsconfig.json` and variants like `tsconfig.lib.json`. */\nconst isTsConfig = (filePath: string): boolean =>\n  /(^|\\/)tsconfig[^/]*\\.json$/.test(filePath);\n\nexport interface FormatFilesInSubtreeOptions {\n  /**\n   * Paths, relative to the workspace root, to leave untouched.\n   *\n   * For files another tool owns the formatting of: formatting them here makes\n   * generation non-idempotent, since the tool rewrites them in its own shape on\n   * the next run and the workspace flips between the two forms.\n   */\n  readonly ignore?: readonly string[];\n}\n\n/**\n * Paths declared ignored for a tree, which stay ignored for every later call.\n *\n * A call formats every change pending in the tree, not only the ones its caller\n * made, so the list cannot be scoped to the call that passes it: generators\n * composing on one tree would reformat a file an earlier generator had excluded.\n * Once the generator that owns a file declares it ignored, it stays ignored for\n * the rest of the run.\n */\nconst treeIgnoredPaths = new WeakMap<Tree, Set<string>>();\n\n/**\n * Tree paths are workspace-relative and forward-slash separated. Normalise so a\n * caller building a path with `path.join` on Windows still matches.\n */\nconst normalizeTreePath = (filePath: string): string =>\n  filePath.split(path.sep).join('/').replace(/^\\.\\//, '');\n\n/**\n * Format files in the given directory within the tree.\n * Handles both TypeScript/JavaScript/JSON (via biome) and Python (via ruff) files.\n * See https://github.com/nrwl/nx/blob/4cd640a9187954505d12de5b6d76a90d8ce4c2eb/packages/devkit/src/generators/format-files.ts#L11\n */\nexport async function formatFilesInSubtree(\n  tree: Tree,\n  dir?: string,\n  options?: FormatFilesInSubtreeOptions,\n): Promise<void> {\n  let ignored = treeIgnoredPaths.get(tree);\n  if (options?.ignore?.length) {\n    if (!ignored) {\n      ignored = new Set();\n      treeIgnoredPaths.set(tree, ignored);\n    }\n    for (const filePath of options.ignore) {\n      ignored.add(normalizeTreePath(filePath));\n    }\n  }\n  const changedFiles = tree\n    .listChanges()\n    .filter((file) => file.type !== 'DELETE')\n    .filter((file) => (dir ? file.path.startsWith(dir) : true))\n    .filter((file) => !ignored?.has(normalizeTreePath(file.path)));\n\n  const pyFiles = changedFiles.filter((file) => file.path.endsWith('.py'));\n  const otherFiles = changedFiles.filter(\n    (file) =>\n      BIOME_FORMATTABLE_EXTENSIONS.has(path.extname(file.path)) &&\n      // tsconfigs are not biome-managed: they're excluded from the vended\n      // format target (Nx's typescript-sync rewrites them without formatting),\n      // so formatting them at generation would only diverge from the form\n      // written on later runs. Leave them as updateJson/writeJson emit them so\n      // repeated generation stays idempotent.\n      !isTsConfig(file.path),\n  );\n\n  // Resolve each project's ruff settings (module names, line-length) so files\n  // are formatted to match the on-disk build (see getPythonProjectRuffConfigs).\n  const pythonProjectConfigs = pyFiles.length\n    ? getPythonProjectRuffConfigs(tree)\n    : [];\n\n  // Format Python files with ruff (lint fixes + formatting)\n  for (const file of pyFiles) {\n    try {\n      const content = ruffFixAndFormat(\n        file.content.toString('utf-8'),\n        file.path,\n        resolveRuffOptions(\n          readRuffConfig(tree, file.path),\n          getOwningProjectRuffConfig(file.path, pythonProjectConfigs),\n        ),\n      );\n      tree.write(file.path, content);\n    } catch {\n      // Silently skip ruff formatting failures\n    }\n  }\n\n  if (otherFiles.length === 0) return;\n\n  formatWithBiome(tree, otherFiles);\n}\n\n/**\n * The Biome configuration to format with: the workspace's own `biome.json`, else\n * the config we vend.\n *\n * Read through the tree, which falls back to disk for a file it doesn't hold. So\n * this resolves the most current config either way — the workspace's on-disk one,\n * or the version a generator has just written to the tree and not yet flushed,\n * which shelling out to the CLI could never see.\n */\nfunction readBiomeConfig(tree: Tree): unknown {\n  const config = tree.read('biome.json', 'utf-8');\n  if (config) {\n    try {\n      return JSON.parse(config);\n    } catch {\n      // Malformed config — fall through to the config we vend\n    }\n  }\n  return getDefaultBiomeConfig(tree);\n}\n\n/**\n * Format files with Biome in-process, reusing one instance across the batch.\n *\n * Replaces one `biome format --stdin-file-path` process per file, which\n * dominated generation at ~70ms each: `formatFilesInSubtree` formats every\n * change accumulated in the tree, not only the ones its caller made, so\n * generators sharing a tree reformat the same files once per call. In-process is\n * ~0.5ms per file. Output was verified byte-identical across the plugin's whole\n * source tree, except that the CLI corrupts control characters passed through\n * stdin (a NUL in a template literal) where formatting in-process preserves them.\n */\nfunction formatWithBiome(\n  tree: Tree,\n  files: { path: string; content: Buffer | null }[],\n): void {\n  try {\n    const biome = new Biome();\n    const { projectKey } = biome.openProject();\n    biome.applyConfiguration(projectKey, readBiomeConfig(tree));\n\n    for (const file of files) {\n      try {\n        const { content } = biome.formatContent(\n          projectKey,\n          file.content?.toString('utf-8') ?? '',\n          { filePath: file.path },\n        );\n        tree.write(file.path, content);\n      } catch {\n        // Leave individual files that fail to format untouched\n      }\n    }\n  } catch {\n    // Silently skip formatting failures\n  }\n}\n\n/**\n * Read the ruff config for a file, by walking from its directory up to the\n * workspace root looking for `.ruff.toml`, `ruff.toml`, or a `pyproject.toml`\n * with a `[tool.ruff]` section — the same files, in the same order, that ruff\n * itself resolves. The walk stops at the workspace root so a stray config in a\n * parent of the workspace (or the home directory) is never treated as the\n * project's.\n *\n * The settings are read rather than merely detected because formatting runs\n * in-process against tree content, so ruff never sees the file's location and\n * cannot resolve the config itself (see {@link resolveRuffOptions}).\n *\n * Reads go through the tree, which falls through to disk for files this run has\n * not touched, so a config the generator has just written in memory is picked up\n * as well as one already on disk.\n */\nfunction readRuffConfig(tree: Tree, filePath: string): RuffOptions | undefined {\n  let dir = path.dirname(filePath);\n  while (true) {\n    for (const name of ['.ruff.toml', 'ruff.toml']) {\n      const config = tryReadToml(tree, path.join(dir, name));\n      if (config) {\n        return config as RuffOptions;\n      }\n    }\n    const ruff = (tryReadToml(tree, path.join(dir, 'pyproject.toml')) as any)\n      ?.tool?.ruff;\n    if (ruff) {\n      return ruff as RuffOptions;\n    }\n    // Stop once the workspace root ('.') has been checked.\n    if (dir === '.' || dir === '' || dir === path.dirname(dir)) {\n      return undefined;\n    }\n    dir = path.dirname(dir);\n  }\n}\n\n/**\n * The `[tool.ruff.lint].select` generated Python projects vend. Generation\n * formats before that config lands on disk, so it is pinned here to keep\n * generated files clean under the project's own `lint` target rather than under\n * whatever ruff's defaults happen to be for the pinned release.\n */\nconst DEFAULT_RUFF_SELECT = ['E', 'F', 'UP', 'B', 'SIM', 'I'];\n\ninterface PythonProjectRuffConfig {\n  /** Project root, normalised to use forward slashes. */\n  readonly root: string;\n  /** Top-level importable module names declared by the project. */\n  readonly modules: string[];\n  /** The project's `[tool.ruff].line-length`, if set. */\n  readonly lineLength?: number;\n  /**\n   * Ruff `target-version` (eg `py314`) derived from `[project].requires-python`.\n   * Generation formats via stdin with no pyproject, so it must be passed\n   * explicitly — ruff's formatting differs by target.\n   */\n  readonly targetVersion?: string;\n  /** The project's `[tool.ruff.lint].select`, if set. */\n  readonly select?: string[];\n}\n\n/**\n * Derive ruff's `target-version` (eg `py314`) from a PEP 508\n * `requires-python` specifier (eg `>=3.14`). Ruff targets the minimum\n * supported version, so take the lowest `major.minor` mentioned.\n */\nexport const requiresPythonToRuffTarget = (\n  requiresPython: unknown,\n): string | undefined => {\n  if (typeof requiresPython !== 'string') {\n    return undefined;\n  }\n  let min: { major: number; minor: number } | undefined;\n  for (const match of requiresPython.matchAll(/(\\d+)\\.(\\d+)/g)) {\n    const major = Number(match[1]);\n    const minor = Number(match[2]);\n    if (\n      !min ||\n      major < min.major ||\n      (major === min.major && minor < min.minor)\n    ) {\n      min = { major, minor };\n    }\n  }\n  return min ? `py${min.major}${min.minor}` : undefined;\n};\n\n/**\n * Map each Nx project with a `pyproject.toml` to the ruff settings the on-disk\n * build enforces for it: its top-level module names (from\n * `[tool.hatch.build.targets.wheel].packages`), its `[tool.ruff].line-length`\n * and its `[tool.ruff.lint].select`.\n */\nfunction getPythonProjectRuffConfigs(tree: Tree): PythonProjectRuffConfig[] {\n  const configs: PythonProjectRuffConfig[] = [];\n\n  for (const project of getProjects(tree).values()) {\n    // Projects without a pyproject.toml, or whose one cannot be parsed, have no\n    // ruff settings to contribute.\n    const pyproject = tryReadToml(\n      tree,\n      path.join(project.root, 'pyproject.toml'),\n    ) as any;\n    if (!pyproject) {\n      continue;\n    }\n    const wheelPackages: unknown =\n      pyproject?.tool?.hatch?.build?.targets?.wheel?.packages;\n    // Record the top-level module segment (`pkg/sub` -> `pkg`), which is\n    // all `known-first-party` keys off.\n    const modules = Array.isArray(wheelPackages)\n      ? wheelPackages\n          .filter((pkg): pkg is string => typeof pkg === 'string' && !!pkg)\n          .map((pkg) => pkg.split('/')[0])\n      : [];\n    const lineLength: unknown = pyproject?.tool?.ruff?.['line-length'];\n    const targetVersion = requiresPythonToRuffTarget(\n      pyproject?.project?.['requires-python'],\n    );\n    const selected: unknown = pyproject?.tool?.ruff?.lint?.select;\n    const select = Array.isArray(selected)\n      ? selected.filter(\n          (rule): rule is string => typeof rule === 'string' && !!rule,\n        )\n      : undefined;\n    if (\n      modules.length ||\n      typeof lineLength === 'number' ||\n      targetVersion ||\n      select?.length\n    ) {\n      configs.push({\n        root: project.root.split(path.sep).join('/'),\n        modules,\n        lineLength: typeof lineLength === 'number' ? lineLength : undefined,\n        targetVersion,\n        select: select?.length ? select : undefined,\n      });\n    }\n  }\n\n  return configs;\n}\n\n/**\n * Resolve the ruff config for the project that owns a file (the project with\n * the longest root that is a prefix of the file path). Ruff runs per-project on\n * disk, so a file's settings come from its own project — only its own module is\n * first-party (sibling workspace packages are third-party) and its own\n * line-length applies — and scoping this way keeps in-tree formatting\n * consistent with the on-disk build.\n */\nfunction getOwningProjectRuffConfig(\n  filePath: string,\n  configs: PythonProjectRuffConfig[],\n): PythonProjectRuffConfig | undefined {\n  let owner: PythonProjectRuffConfig | undefined;\n  for (const config of configs) {\n    if (\n      (filePath === config.root || filePath.startsWith(`${config.root}/`)) &&\n      (!owner || config.root.length > owner.root.length)\n    ) {\n      owner = config;\n    }\n  }\n  return owner;\n}\n\n/**\n * Resolve the ruff settings to format a Python file with, mirroring what the\n * file's build enforces.\n *\n * Ruff's own config discovery never runs: settings are passed to the linter\n * directly rather than resolved from the file's location, which it never sees.\n * That also means a stray config above the workspace (or in the home directory)\n * can never be picked up.\n *\n * `config` is the file's nearest ruff config, whose rule selection is honoured\n * as-is. Without one, ruff would fall back to its own defaults, which change\n * between releases — 0.16 widened them from `E` and `F` to 36 rule prefixes — so\n * generation would apply fixes the project's build never asks for (eg `RUF022`\n * reordering `__all__`). Instead the project's own `lint.select` is pinned, so\n * generation enforces exactly what `lint` does and nothing more.\n *\n * `projectConfig` layers on the settings derived from the owning project rather\n * than declared under `[tool.ruff]`: `known-first-party` (the project's own\n * modules, from its wheel packages) keeps its imports in their own group, and\n * `target-version` (from its `requires-python`) matches the formatting the build\n * produces.\n */\nfunction resolveRuffOptions(\n  config: RuffOptions | undefined,\n  projectConfig?: PythonProjectRuffConfig,\n): RuffOptions {\n  const lint: Record<string, unknown> = { ...config?.lint };\n  // Pin the rule selection only when deferring to ruff's defaults would\n  // otherwise apply rules the project's build does not enforce.\n  if (!config) {\n    lint.select = projectConfig?.select ?? DEFAULT_RUFF_SELECT;\n  }\n  if (projectConfig?.modules.length) {\n    lint.isort = {\n      ...(lint.isort as object | undefined),\n      'known-first-party': projectConfig.modules,\n    };\n  }\n  return {\n    ...config,\n    ...(typeof projectConfig?.lineLength === 'number'\n      ? { 'line-length': projectConfig.lineLength }\n      : {}),\n    ...(projectConfig?.targetVersion\n      ? { 'target-version': projectConfig.targetVersion }\n      : {}),\n    lint,\n  };\n}\n"],"names":["Biome","getProjects","path","ruffFixAndFormat","tryReadToml","TS_VERSIONS","getDefaultBiomeConfig","tree","$schema","root","formatter","enabled","indentStyle","indentWidth","lineWidth","javascript","quoteStyle","trailingCommas","exists","resolver","experimentalPnpmCatalogs","css","linter","rules","preset","correctness","noUndeclaredDependencies","assist","actions","source","organizeImports","files","includes","overrides","BIOME_FORMATTABLE_EXTENSIONS","Set","isTsConfig","filePath","test","treeIgnoredPaths","WeakMap","normalizeTreePath","split","sep","join","replace","formatFilesInSubtree","dir","options","ignored","get","ignore","length","set","add","changedFiles","listChanges","filter","file","type","startsWith","has","pyFiles","endsWith","otherFiles","extname","pythonProjectConfigs","getPythonProjectRuffConfigs","content","toString","resolveRuffOptions","readRuffConfig","getOwningProjectRuffConfig","write","formatWithBiome","readBiomeConfig","config","read","JSON","parse","biome","projectKey","openProject","applyConfiguration","formatContent","dirname","name","ruff","tool","undefined","DEFAULT_RUFF_SELECT","requiresPythonToRuffTarget","requiresPython","min","match","matchAll","major","Number","minor","configs","project","values","pyproject","wheelPackages","hatch","build","targets","wheel","packages","modules","Array","isArray","pkg","map","lineLength","targetVersion","selected","lint","select","rule","push","owner","projectConfig","isort"],"mappings":"AAAA;;;CAGC,GAED,SAASA,KAAK,QAAQ,yBAAyB;AAC/C,SAASC,WAAW,QAAmB,aAAa;AACpD,OAAOC,UAAU,OAAO;AACxB,SAA2BC,gBAAgB,QAAQ,YAAS;AAC5D,SAASC,WAAW,QAAQ,YAAS;AACrC,SAASC,WAAW,QAAQ,gBAAa;AAEzC;;;;;CAKC,GACD,OAAO,MAAMC,wBAAwB,CAACC,OAAgB,CAAA;QACpDC,SAAS,CAAC,4BAA4B,EAAEH,WAAW,CAAC,iBAAiB,CAAC,YAAY,CAAC;QACnFI,MAAM;QACNC,WAAW;YACTC,SAAS;YACTC,aAAa;YACbC,aAAa;YACbC,WAAW;QACb;QACAC,YAAY;YACVL,WAAW;gBACTM,YAAY;gBACZC,gBAAgB;YAClB;YACA,+EAA+E;YAC/E,GAAIV,KAAKW,MAAM,CAAC,yBACZ;gBAAEC,UAAU;oBAAEC,0BAA0B;gBAAK;YAAE,IAC/C,CAAC,CAAC;QACR;QACAC,KAAK;YACHX,WAAW;gBACTM,YAAY;YACd;YACAM,QAAQ;gBACNX,SAAS;YACX;QACF;QACAW,QAAQ;YACNX,SAAS;YACTY,OAAO;gBACLC,QAAQ;gBACRC,aAAa;oBACX,qEAAqE;oBACrE,wCAAwC;oBACxCC,0BAA0B;gBAC5B;YACF;QACF;QACAC,QAAQ;YACNC,SAAS;gBACPC,QAAQ;oBACNC,iBAAiB;gBACnB;YACF;QACF;QACAC,OAAO;YACLC,UAAU;gBACR;gBACA;gBACA;gBACA;gBACA;gBACA;gBACA,kEAAkE;gBAClE,8DAA8D;gBAC9D;gBACA;gBACA;gBACA;gBACA;aACD;QACH;QACA,qEAAqE;QACrE,+EAA+E;QAC/EC,WAAW;YACT;gBACED,UAAU;oBACR;oBACA;oBACA;iBACD;gBACDV,QAAQ;oBACNC,OAAO;wBACLE,aAAa;4BACXC,0BAA0B;wBAC5B;oBACF;gBACF;YACF;SACD;IACH,CAAA,EAAG;AAEH,MAAMQ,+BAA+B,IAAIC,IAAI;IAC3C;IACA;IACA;IACA;IACA;IACA;IACA;IACA;IACA;IACA;IACA;CACD;AAED,mEAAmE,GACnE,MAAMC,aAAa,CAACC,WAClB,6BAA6BC,IAAI,CAACD;AAapC;;;;;;;;CAQC,GACD,MAAME,mBAAmB,IAAIC;AAE7B;;;CAGC,GACD,MAAMC,oBAAoB,CAACJ,WACzBA,SAASK,KAAK,CAACxC,KAAKyC,GAAG,EAAEC,IAAI,CAAC,KAAKC,OAAO,CAAC,SAAS;AAEtD;;;;CAIC,GACD,OAAO,eAAeC,qBACpBvC,IAAU,EACVwC,GAAY,EACZC,OAAqC;IAErC,IAAIC,UAAUV,iBAAiBW,GAAG,CAAC3C;IACnC,IAAIyC,SAASG,QAAQC,QAAQ;QAC3B,IAAI,CAACH,SAAS;YACZA,UAAU,IAAId;YACdI,iBAAiBc,GAAG,CAAC9C,MAAM0C;QAC7B;QACA,KAAK,MAAMZ,YAAYW,QAAQG,MAAM,CAAE;YACrCF,QAAQK,GAAG,CAACb,kBAAkBJ;QAChC;IACF;IACA,MAAMkB,eAAehD,KAClBiD,WAAW,GACXC,MAAM,CAAC,CAACC,OAASA,KAAKC,IAAI,KAAK,UAC/BF,MAAM,CAAC,CAACC,OAAUX,MAAMW,KAAKxD,IAAI,CAAC0D,UAAU,CAACb,OAAO,MACpDU,MAAM,CAAC,CAACC,OAAS,CAACT,SAASY,IAAIpB,kBAAkBiB,KAAKxD,IAAI;IAE7D,MAAM4D,UAAUP,aAAaE,MAAM,CAAC,CAACC,OAASA,KAAKxD,IAAI,CAAC6D,QAAQ,CAAC;IACjE,MAAMC,aAAaT,aAAaE,MAAM,CACpC,CAACC,OACCxB,6BAA6B2B,GAAG,CAAC3D,KAAK+D,OAAO,CAACP,KAAKxD,IAAI,MACvD,oEAAoE;QACpE,yEAAyE;QACzE,oEAAoE;QACpE,yEAAyE;QACzE,wCAAwC;QACxC,CAACkC,WAAWsB,KAAKxD,IAAI;IAGzB,4EAA4E;IAC5E,8EAA8E;IAC9E,MAAMgE,uBAAuBJ,QAAQV,MAAM,GACvCe,4BAA4B5D,QAC5B,EAAE;IAEN,0DAA0D;IAC1D,KAAK,MAAMmD,QAAQI,QAAS;QAC1B,IAAI;YACF,MAAMM,UAAUjE,iBACduD,KAAKU,OAAO,CAACC,QAAQ,CAAC,UACtBX,KAAKxD,IAAI,EACToE,mBACEC,eAAehE,MAAMmD,KAAKxD,IAAI,GAC9BsE,2BAA2Bd,KAAKxD,IAAI,EAAEgE;YAG1C3D,KAAKkE,KAAK,CAACf,KAAKxD,IAAI,EAAEkE;QACxB,EAAE,OAAM;QACN,yCAAyC;QAC3C;IACF;IAEA,IAAIJ,WAAWZ,MAAM,KAAK,GAAG;IAE7BsB,gBAAgBnE,MAAMyD;AACxB;AAEA;;;;;;;;CAQC,GACD,SAASW,gBAAgBpE,IAAU;IACjC,MAAMqE,SAASrE,KAAKsE,IAAI,CAAC,cAAc;IACvC,IAAID,QAAQ;QACV,IAAI;YACF,OAAOE,KAAKC,KAAK,CAACH;QACpB,EAAE,OAAM;QACN,wDAAwD;QAC1D;IACF;IACA,OAAOtE,sBAAsBC;AAC/B;AAEA;;;;;;;;;;CAUC,GACD,SAASmE,gBACPnE,IAAU,EACVwB,KAAiD;IAEjD,IAAI;QACF,MAAMiD,QAAQ,IAAIhF;QAClB,MAAM,EAAEiF,UAAU,EAAE,GAAGD,MAAME,WAAW;QACxCF,MAAMG,kBAAkB,CAACF,YAAYN,gBAAgBpE;QAErD,KAAK,MAAMmD,QAAQ3B,MAAO;YACxB,IAAI;gBACF,MAAM,EAAEqC,OAAO,EAAE,GAAGY,MAAMI,aAAa,CACrCH,YACAvB,KAAKU,OAAO,EAAEC,SAAS,YAAY,IACnC;oBAAEhC,UAAUqB,KAAKxD,IAAI;gBAAC;gBAExBK,KAAKkE,KAAK,CAACf,KAAKxD,IAAI,EAAEkE;YACxB,EAAE,OAAM;YACN,uDAAuD;YACzD;QACF;IACF,EAAE,OAAM;IACN,oCAAoC;IACtC;AACF;AAEA;;;;;;;;;;;;;;;CAeC,GACD,SAASG,eAAehE,IAAU,EAAE8B,QAAgB;IAClD,IAAIU,MAAM7C,KAAKmF,OAAO,CAAChD;IACvB,MAAO,KAAM;QACX,KAAK,MAAMiD,QAAQ;YAAC;YAAc;SAAY,CAAE;YAC9C,MAAMV,SAASxE,YAAYG,MAAML,KAAK0C,IAAI,CAACG,KAAKuC;YAChD,IAAIV,QAAQ;gBACV,OAAOA;YACT;QACF;QACA,MAAMW,OAAQnF,YAAYG,MAAML,KAAK0C,IAAI,CAACG,KAAK,oBAC3CyC,MAAMD;QACV,IAAIA,MAAM;YACR,OAAOA;QACT;QACA,uDAAuD;QACvD,IAAIxC,QAAQ,OAAOA,QAAQ,MAAMA,QAAQ7C,KAAKmF,OAAO,CAACtC,MAAM;YAC1D,OAAO0C;QACT;QACA1C,MAAM7C,KAAKmF,OAAO,CAACtC;IACrB;AACF;AAEA;;;;;CAKC,GACD,MAAM2C,sBAAsB;IAAC;IAAK;IAAK;IAAM;IAAK;IAAO;CAAI;AAmB7D;;;;CAIC,GACD,OAAO,MAAMC,6BAA6B,CACxCC;IAEA,IAAI,OAAOA,mBAAmB,UAAU;QACtC,OAAOH;IACT;IACA,IAAII;IACJ,KAAK,MAAMC,SAASF,eAAeG,QAAQ,CAAC,iBAAkB;QAC5D,MAAMC,QAAQC,OAAOH,KAAK,CAAC,EAAE;QAC7B,MAAMI,QAAQD,OAAOH,KAAK,CAAC,EAAE;QAC7B,IACE,CAACD,OACDG,QAAQH,IAAIG,KAAK,IAChBA,UAAUH,IAAIG,KAAK,IAAIE,QAAQL,IAAIK,KAAK,EACzC;YACAL,MAAM;gBAAEG;gBAAOE;YAAM;QACvB;IACF;IACA,OAAOL,MAAM,CAAC,EAAE,EAAEA,IAAIG,KAAK,GAAGH,IAAIK,KAAK,EAAE,GAAGT;AAC9C,EAAE;AAEF;;;;;CAKC,GACD,SAAStB,4BAA4B5D,IAAU;IAC7C,MAAM4F,UAAqC,EAAE;IAE7C,KAAK,MAAMC,WAAWnG,YAAYM,MAAM8F,MAAM,GAAI;QAChD,4EAA4E;QAC5E,+BAA+B;QAC/B,MAAMC,YAAYlG,YAChBG,MACAL,KAAK0C,IAAI,CAACwD,QAAQ3F,IAAI,EAAE;QAE1B,IAAI,CAAC6F,WAAW;YACd;QACF;QACA,MAAMC,gBACJD,WAAWd,MAAMgB,OAAOC,OAAOC,SAASC,OAAOC;QACjD,qEAAqE;QACrE,oCAAoC;QACpC,MAAMC,UAAUC,MAAMC,OAAO,CAACR,iBAC1BA,cACG9C,MAAM,CAAC,CAACuD,MAAuB,OAAOA,QAAQ,YAAY,CAAC,CAACA,KAC5DC,GAAG,CAAC,CAACD,MAAQA,IAAItE,KAAK,CAAC,IAAI,CAAC,EAAE,IACjC,EAAE;QACN,MAAMwE,aAAsBZ,WAAWd,MAAMD,MAAM,CAAC,cAAc;QAClE,MAAM4B,gBAAgBxB,2BACpBW,WAAWF,SAAS,CAAC,kBAAkB;QAEzC,MAAMgB,WAAoBd,WAAWd,MAAMD,MAAM8B,MAAMC;QACvD,MAAMA,SAASR,MAAMC,OAAO,CAACK,YACzBA,SAAS3D,MAAM,CACb,CAAC8D,OAAyB,OAAOA,SAAS,YAAY,CAAC,CAACA,QAE1D9B;QACJ,IACEoB,QAAQzD,MAAM,IACd,OAAO8D,eAAe,YACtBC,iBACAG,QAAQlE,QACR;YACA+C,QAAQqB,IAAI,CAAC;gBACX/G,MAAM2F,QAAQ3F,IAAI,CAACiC,KAAK,CAACxC,KAAKyC,GAAG,EAAEC,IAAI,CAAC;gBACxCiE;gBACAK,YAAY,OAAOA,eAAe,WAAWA,aAAazB;gBAC1D0B;gBACAG,QAAQA,QAAQlE,SAASkE,SAAS7B;YACpC;QACF;IACF;IAEA,OAAOU;AACT;AAEA;;;;;;;CAOC,GACD,SAAS3B,2BACPnC,QAAgB,EAChB8D,OAAkC;IAElC,IAAIsB;IACJ,KAAK,MAAM7C,UAAUuB,QAAS;QAC5B,IACE,AAAC9D,CAAAA,aAAauC,OAAOnE,IAAI,IAAI4B,SAASuB,UAAU,CAAC,GAAGgB,OAAOnE,IAAI,CAAC,CAAC,CAAC,CAAA,KACjE,CAAA,CAACgH,SAAS7C,OAAOnE,IAAI,CAAC2C,MAAM,GAAGqE,MAAMhH,IAAI,CAAC2C,MAAM,AAAD,GAChD;YACAqE,QAAQ7C;QACV;IACF;IACA,OAAO6C;AACT;AAEA;;;;;;;;;;;;;;;;;;;;;CAqBC,GACD,SAASnD,mBACPM,MAA+B,EAC/B8C,aAAuC;IAEvC,MAAML,OAAgC;QAAE,GAAGzC,QAAQyC,IAAI;IAAC;IACxD,sEAAsE;IACtE,8DAA8D;IAC9D,IAAI,CAACzC,QAAQ;QACXyC,KAAKC,MAAM,GAAGI,eAAeJ,UAAU5B;IACzC;IACA,IAAIgC,eAAeb,QAAQzD,QAAQ;QACjCiE,KAAKM,KAAK,GAAG;YACX,GAAIN,KAAKM,KAAK;YACd,qBAAqBD,cAAcb,OAAO;QAC5C;IACF;IACA,OAAO;QACL,GAAGjC,MAAM;QACT,GAAI,OAAO8C,eAAeR,eAAe,WACrC;YAAE,eAAeQ,cAAcR,UAAU;QAAC,IAC1C,CAAC,CAAC;QACN,GAAIQ,eAAeP,gBACf;YAAE,kBAAkBO,cAAcP,aAAa;QAAC,IAChD,CAAC,CAAC;QACNE;IACF;AACF"}

package/src/utils/identity-constructs/files/cdk/core/user-identity.ts.template

@@ -36,6 +36,9 @@ import { suppressRules } from './checkov<% if (esm) { %>.js<% } %>';
 
 const WEB_CLIENT_ID = 'WebClient';
 
+/** Local dev server origins permitted to complete the sign-in redirect */
+const LOCAL_CALLBACK_URLS = ['http://localhost:4200', 'http://localhost:4300'];
+
 export interface UserIdentityProps {
   /**
    * Whether to enable AWS WAFv2 with the default managed ruleset
@@ -67,7 +70,11 @@ export class UserIdentity extends Construct {
     this.userPool = this.createUserPool();
 
     if (enableWaf) {
-      this.webAcl = this.createWebAcl(id, this.userPool);
+      this.webAcl = this.createWebAcl(
+        id,
+        this.userPool,
+        LOCAL_CALLBACK_URLS.length > 0
+      );
     }
     this.userPoolDomain = this.createUserPoolDomain(this.userPool);
     this.userPoolClient = this.createUserPoolClient(this.userPool);
@@ -155,7 +162,11 @@ export class UserIdentity extends Construct {
     return userPool;
   };
 
-  private createWebAcl = (id: string, userPool: UserPool) => {
+  private createWebAcl = (
+    id: string,
+    userPool: UserPool,
+    allowsLocalCallback: boolean
+  ) => {
     const webAcl = new CfnWebACL(this, 'WebAcl', {
       defaultAction: { allow: {} },
       scope: 'REGIONAL',
@@ -172,6 +183,17 @@ export class UserIdentity extends Construct {
             managedRuleGroupStatement: {
               name: 'AWSManagedRulesCommonRuleSet',
               vendorName: 'AWS',
+              // EC2MetaDataSSRF_QUERYARGUMENTS treats the loopback redirect_uri the
+              // Hosted UI receives during local sign-in as an SSRF attempt. Counted
+              // only while a local callback URL is allowed; every other rule blocks.
+              ruleActionOverrides: allowsLocalCallback
+                ? [
+                    {
+                      name: 'EC2MetaDataSSRF_QUERYARGUMENTS',
+                      actionToUse: { count: {} },
+                    },
+                  ]
+                : undefined,
             },
           },
           visibilityConfig: {
@@ -242,7 +264,7 @@ export class UserIdentity extends Construct {
   private createUserPoolClient = (userPool: UserPool) => {
     const lazilyComputedCallbackUrls = Lazy.list({
       produce: () =>
-        ['http://localhost:4200', 'http://localhost:4300'].concat(
+        LOCAL_CALLBACK_URLS.concat(
           Stack.of(this)
             .node.findAll()
             .filter((child): child is Distribution => child instanceof Distribution)

package/src/utils/identity-constructs/files/terraform/core/user-identity/identity/identity.tf.template

@@ -44,6 +44,14 @@ variable "logout_urls" {
 data "aws_caller_identity" "current" {}
 data "aws_region" "current" {}
 
+locals {
+  # Local dev server origins permitted to complete the sign-in redirect
+  local_callback_urls = [
+    "http://localhost:4200",
+    "http://localhost:4300"
+  ]
+}
+
 # Random suffix for resource names
 resource "random_id" "unique_suffix" {
   byte_length = 4
@@ -260,6 +268,21 @@ resource "aws_wafv2_web_acl" "user_pool_waf" {
       managed_rule_group_statement {
         name        = "AWSManagedRulesCommonRuleSet"
         vendor_name = "AWS"
+
+        # EC2MetaDataSSRF_QUERYARGUMENTS treats the loopback redirect_uri the
+        # Hosted UI receives during local sign-in as an SSRF attempt. Counted
+        # only while a local callback URL is allowed; every other rule blocks.
+        dynamic "rule_action_override" {
+          for_each = length(local.local_callback_urls) > 0 ? [1] : []
+
+          content {
+            name = "EC2MetaDataSSRF_QUERYARGUMENTS"
+
+            action_to_use {
+              count {}
+            }
+          }
+        }
       }
     }
 
@@ -349,15 +372,9 @@ resource "aws_cognito_user_pool_client" "web_client" {
   allowed_oauth_scopes = ["email", "openid", "profile"]
 
   # OAuth-dependent URLs - set after OAuth configuration
-  callback_urls = concat([
-    "http://localhost:4200",
-    "http://localhost:4300"
-  ], var.callback_urls)
+  callback_urls = concat(local.local_callback_urls, var.callback_urls)
 
-  logout_urls = concat([
-    "http://localhost:4200",
-    "http://localhost:4300"
-  ], var.logout_urls)
+  logout_urls = concat(local.local_callback_urls, var.logout_urls)
 
   # Security settings
   prevent_user_existence_errors = "ENABLED"