@aws/nx-plugin 1.0.0-rc.51 → 1.0.0-rc.53

package/README.md

@@ -171,6 +171,7 @@ pnpm nx g @aws/nx-plugin:ts#infra
 | `ts#mcp-server`         | MCP server (TypeScript)                                                                                           |
 | `ts#agent`              | [Strands Agent](https://strandsagents.com/) (TypeScript)                                                          |
 | `ts#nx-generator`       | Nx generator scaffold                                                                                             |
+| `smithy#project`        | Smithy model project — a service model, or a shape library shared between Smithy projects                          |
 | `py#project`            | Python project (uv)                                                                                               |
 | `py#api`                | Python API (FastAPI) with API Gateway + Lambda + [Powertools](https://github.com/aws-powertools/powertools-lambda-python)      |
 | `py#lambda-function`    | Python Lambda with type-safe event sources                                                                        |

package/generators.json

@@ -165,9 +165,9 @@
     "smithy#project": {
       "factory": "./src/smithy/project/generator",
       "schema": "./src/smithy/project/schema.json",
-      "description": "Generate a Smithy model project",
+      "description": "Generate a Smithy model project, either defining a service or a library of reusable shapes",
       "metric": "g27",
-      "hidden": true
+      "guidePages": ["smithy-project"]
     },
     "smithy#react-connection": {
       "factory": "./src/smithy/react-connection/generator",

package/migrations.json

@@ -16,6 +16,11 @@
       "version": "1.0.0-rc.50",
       "description": "Adopt an existing Terraform state bucket in the vended bootstrap script when its state object is missing",
       "implementation": "./src/migrations/latest/terraform-bootstrap-adopt-existing-bucket/migration"
+    },
+    "latest-user-identity-waf-allow-localhost-callback": {
+      "version": "1.0.0-rc.52",
+      "description": "Count the EC2MetaDataSSRF_QUERYARGUMENTS WAF rule on the UserIdentity Web ACL so sign-in from a local dev server is not blocked",
+      "implementation": "./src/migrations/latest/user-identity-waf-allow-localhost-callback/migration"
     }
   }
 }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@aws/nx-plugin",
-  "version": "1.0.0-rc.51",
+  "version": "1.0.0-rc.53",
   "repository": {
     "type": "git",
     "url": "https://github.com/awslabs/nx-plugin-for-aws.git",

package/src/migrations/latest/user-identity-waf-allow-localhost-callback/migration.d.ts

@@ -0,0 +1,6 @@
+/**
+ * Copyright Amazon.com, Inc. or its affiliates. All Rights Reserved.
+ * SPDX-License-Identifier: Apache-2.0
+ */
+import type { MigrationReturnObject, Tree } from '@nx/devkit';
+export default function migration(tree: Tree): Promise<MigrationReturnObject>;

package/src/migrations/latest/user-identity-waf-allow-localhost-callback/migration.js

@@ -0,0 +1,217 @@
+/**
+ * Copyright Amazon.com, Inc. or its affiliates. All Rights Reserved.
+ * SPDX-License-Identifier: Apache-2.0
+ */ import { applyGritQL, matchGritQL } from "../../../utils/ast.js";
+import { formatFilesInSubtree } from "../../../utils/format.js";
+import { PACKAGES_DIR, SHARED_CONSTRUCTS_DIR, SHARED_TERRAFORM_DIR } from "../../../utils/shared-constructs-constants.js";
+/**
+ * Count the EC2MetaDataSSRF_QUERYARGUMENTS WAF rule on the UserIdentity Web ACL
+ *
+ * `AWSManagedRulesCommonRuleSet` treats the loopback `redirect_uri` the Cognito
+ * Hosted UI receives during local sign-in as an SSRF attempt, so sign-in against
+ * a local dev server fails with an opaque 403 before the login page renders. The
+ * rule is overridden to Count while a local callback URL is allowed; every other
+ * rule in the group still blocks.
+ *
+ * The local callback URLs are lifted into a named constant so the override can be
+ * derived from them rather than restating the condition.
+ *
+ * How to write a migration:
+ * - https://nx.dev/docs/kb/migration-generators
+ * - What `nextSteps` means: https://nx.dev/docs/reference/devkit/MigrationReturnObject
+ *
+ * Guardrails:
+ * - Pattern-match before writing: skip files that have diverged from the shape
+ *   your generators produce and report them via `nextSteps`, rather than
+ *   clobbering the user's changes.
+ * - Idempotent: re-running must be a no-op.
+ * - Format what you write: finish with `formatFilesInSubtree` so the files your
+ *   migration wrote are formatted correctly.
+ */ const CDK_USER_IDENTITY_FILE = `${PACKAGES_DIR}/${SHARED_CONSTRUCTS_DIR}/src/core/user-identity.ts`;
+const TERRAFORM_IDENTITY_FILE = `${PACKAGES_DIR}/${SHARED_TERRAFORM_DIR}/src/core/user-identity/identity/identity.tf`;
+const SSRF_RULE_NAME = 'EC2MetaDataSSRF_QUERYARGUMENTS';
+// Guards each file: present only once the override has been added.
+const CDK_MIGRATED_PATTERN = `\`ruleActionOverrides: allowsLocalCallback ? $_ : undefined\``;
+const TERRAFORM_MIGRATED_PATTERN = `language hcl\n\`name = "${SSRF_RULE_NAME}"\``;
+// Every CDK edit site, matched structurally so formatting doesn't affect whether
+// the construct is recognised.
+const CDK_CONSTANT_ANCHOR_PATTERN = "`const WEB_CLIENT_ID = 'WebClient'`";
+// Scoped to the `.concat` callsite so it can't also rewrite the array literal
+// inside the constant this migration inserts.
+const CDK_LOCAL_URLS_PATTERN = "`['http://localhost:4200', 'http://localhost:4300'].concat($rest)`";
+const CDK_CALL_PATTERN = '`this.createWebAcl($id, this.userPool)`';
+const CDK_SIGNATURE_PATTERN = '`private createWebAcl = ($id: string, $pool: UserPool) => $body`';
+const CDK_STATEMENT_PATTERN = "`managedRuleGroupStatement: { name: 'AWSManagedRulesCommonRuleSet', vendorName: 'AWS' }`";
+const CDK_EDITS = [
+    // Local callback URLs become a named constant the override can key off.
+    [
+        CDK_CONSTANT_ANCHOR_PATTERN,
+        `${CDK_CONSTANT_ANCHOR_PATTERN} => \`const WEB_CLIENT_ID = 'WebClient';
+
+/** Local dev server origins permitted to complete the sign-in redirect */
+const LOCAL_CALLBACK_URLS = ['http://localhost:4200', 'http://localhost:4300']\``
+    ],
+    [
+        CDK_LOCAL_URLS_PATTERN,
+        `${CDK_LOCAL_URLS_PATTERN} => \`LOCAL_CALLBACK_URLS.concat($rest)\``
+    ],
+    [
+        CDK_CALL_PATTERN,
+        `${CDK_CALL_PATTERN} => \`this.createWebAcl($id, this.userPool, LOCAL_CALLBACK_URLS.length > 0)\``
+    ],
+    [
+        CDK_SIGNATURE_PATTERN,
+        `${CDK_SIGNATURE_PATTERN} => \`private createWebAcl = (
+    $id: string,
+    $pool: UserPool,
+    allowsLocalCallback: boolean
+  ) => $body\``
+    ],
+    [
+        CDK_STATEMENT_PATTERN,
+        `${CDK_STATEMENT_PATTERN} => \`managedRuleGroupStatement: {
+              name: 'AWSManagedRulesCommonRuleSet',
+              vendorName: 'AWS',
+              // ${SSRF_RULE_NAME} treats the loopback redirect_uri the
+              // Hosted UI receives during local sign-in as an SSRF attempt. Counted
+              // only while a local callback URL is allowed; every other rule blocks.
+              ruleActionOverrides: allowsLocalCallback
+                ? [
+                    {
+                      name: '${SSRF_RULE_NAME}',
+                      actionToUse: { count: {} },
+                    },
+                  ]
+                : undefined,
+            }\``
+    ]
+];
+const TERRAFORM_DATA_SOURCES_PATTERN = [
+    'language hcl',
+    '`data "aws_region" "current" {}`'
+].join('\n');
+const TERRAFORM_EDITS = [
+    // Local callback URLs become a local the override can key off.
+    [
+        TERRAFORM_DATA_SOURCES_PATTERN,
+        [
+            'language hcl',
+            '`data "aws_region" "current" {}` => `data "aws_region" "current" {}',
+            '',
+            'locals {',
+            '  # Local dev server origins permitted to complete the sign-in redirect',
+            '  local_callback_urls = [',
+            '    "http://localhost:4200",',
+            '    "http://localhost:4300"',
+            '  ]',
+            '}`'
+        ].join('\n')
+    ],
+    [
+        [
+            'language hcl',
+            '`callback_urls = concat([',
+            '    "http://localhost:4200",',
+            '    "http://localhost:4300"',
+            '  ], var.callback_urls)`'
+        ].join('\n'),
+        [
+            'language hcl',
+            '`callback_urls = concat([',
+            '    "http://localhost:4200",',
+            '    "http://localhost:4300"',
+            '  ], var.callback_urls)` => `callback_urls = concat(local.local_callback_urls, var.callback_urls)`'
+        ].join('\n')
+    ],
+    [
+        [
+            'language hcl',
+            '`logout_urls = concat([',
+            '    "http://localhost:4200",',
+            '    "http://localhost:4300"',
+            '  ], var.logout_urls)`'
+        ].join('\n'),
+        [
+            'language hcl',
+            '`logout_urls = concat([',
+            '    "http://localhost:4200",',
+            '    "http://localhost:4300"',
+            '  ], var.logout_urls)` => `logout_urls = concat(local.local_callback_urls, var.logout_urls)`'
+        ].join('\n')
+    ],
+    [
+        [
+            'language hcl',
+            '`managed_rule_group_statement {',
+            '        name        = "AWSManagedRulesCommonRuleSet"',
+            '        vendor_name = "AWS"',
+            '      }`'
+        ].join('\n'),
+        [
+            'language hcl',
+            '`managed_rule_group_statement {',
+            '        name        = "AWSManagedRulesCommonRuleSet"',
+            '        vendor_name = "AWS"',
+            '      }` => `managed_rule_group_statement {',
+            '        name        = "AWSManagedRulesCommonRuleSet"',
+            '        vendor_name = "AWS"',
+            '',
+            `        # ${SSRF_RULE_NAME} treats the loopback redirect_uri the`,
+            '        # Hosted UI receives during local sign-in as an SSRF attempt. Counted',
+            '        # only while a local callback URL is allowed; every other rule blocks.',
+            '        dynamic "rule_action_override" {',
+            '          for_each = length(local.local_callback_urls) > 0 ? [1] : []',
+            '',
+            '          content {',
+            `            name = "${SSRF_RULE_NAME}"`,
+            '',
+            '            action_to_use {',
+            '              count {}',
+            '            }',
+            '          }',
+            '        }',
+            '      }`'
+        ].join('\n')
+    ]
+];
+const divergedNextStep = (filePath)=>`${filePath}: the UserIdentity Web ACL has diverged from the generated shape - left untouched. To sign in against a local dev server, override ${SSRF_RULE_NAME} in the AWSManagedRulesCommonRuleSet rule group to Count, otherwise the Cognito Hosted UI returns 403 for localhost redirect URIs.`;
+const migratedNextStep = (filePath)=>`${filePath}: ${SSRF_RULE_NAME} is now counted rather than blocked while a local callback URL is allowed, so signing in against a local dev server works. Redeploy to apply it.`;
+export default async function migration(tree) {
+    const nextSteps = [];
+    for (const [filePath, migratedPattern, edits] of [
+        [
+            CDK_USER_IDENTITY_FILE,
+            CDK_MIGRATED_PATTERN,
+            CDK_EDITS
+        ],
+        [
+            TERRAFORM_IDENTITY_FILE,
+            TERRAFORM_MIGRATED_PATTERN,
+            TERRAFORM_EDITS
+        ]
+    ]){
+        if (!tree.exists(filePath)) {
+            continue;
+        }
+        if (await matchGritQL(tree, filePath, migratedPattern)) {
+            continue;
+        }
+        // Confirm every edit site is present before writing any of them, so a file
+        // that only partly matches is left whole rather than half-edited.
+        const allSitesPresent = (await Promise.all(edits.map(([match])=>matchGritQL(tree, filePath, match)))).every(Boolean);
+        if (!allSitesPresent) {
+            nextSteps.push(divergedNextStep(filePath));
+            continue;
+        }
+        for (const [, rewrite] of edits){
+            await applyGritQL(tree, filePath, rewrite);
+        }
+        nextSteps.push(migratedNextStep(filePath));
+    }
+    await formatFilesInSubtree(tree);
+    return {
+        nextSteps
+    };
+}
+
+//# sourceMappingURL=migration.js.map

package/src/migrations/latest/user-identity-waf-allow-localhost-callback/migration.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../../../../../../../packages/nx-plugin/src/migrations/latest/user-identity-waf-allow-localhost-callback/migration.ts"],"sourcesContent":["/**\n * Copyright Amazon.com, Inc. or its affiliates. All Rights Reserved.\n * SPDX-License-Identifier: Apache-2.0\n */\nimport type { MigrationReturnObject, Tree } from '@nx/devkit';\nimport { applyGritQL, matchGritQL } from '../../../utils/ast';\nimport { formatFilesInSubtree } from '../../../utils/format';\nimport {\n  PACKAGES_DIR,\n  SHARED_CONSTRUCTS_DIR,\n  SHARED_TERRAFORM_DIR,\n} from '../../../utils/shared-constructs-constants';\n\n/**\n * Count the EC2MetaDataSSRF_QUERYARGUMENTS WAF rule on the UserIdentity Web ACL\n *\n * `AWSManagedRulesCommonRuleSet` treats the loopback `redirect_uri` the Cognito\n * Hosted UI receives during local sign-in as an SSRF attempt, so sign-in against\n * a local dev server fails with an opaque 403 before the login page renders. The\n * rule is overridden to Count while a local callback URL is allowed; every other\n * rule in the group still blocks.\n *\n * The local callback URLs are lifted into a named constant so the override can be\n * derived from them rather than restating the condition.\n *\n * How to write a migration:\n * - https://nx.dev/docs/kb/migration-generators\n * - What `nextSteps` means: https://nx.dev/docs/reference/devkit/MigrationReturnObject\n *\n * Guardrails:\n * - Pattern-match before writing: skip files that have diverged from the shape\n *   your generators produce and report them via `nextSteps`, rather than\n *   clobbering the user's changes.\n * - Idempotent: re-running must be a no-op.\n * - Format what you write: finish with `formatFilesInSubtree` so the files your\n *   migration wrote are formatted correctly.\n */\n\nconst CDK_USER_IDENTITY_FILE = `${PACKAGES_DIR}/${SHARED_CONSTRUCTS_DIR}/src/core/user-identity.ts`;\nconst TERRAFORM_IDENTITY_FILE = `${PACKAGES_DIR}/${SHARED_TERRAFORM_DIR}/src/core/user-identity/identity/identity.tf`;\n\nconst SSRF_RULE_NAME = 'EC2MetaDataSSRF_QUERYARGUMENTS';\n\n// Guards each file: present only once the override has been added.\nconst CDK_MIGRATED_PATTERN = `\\`ruleActionOverrides: allowsLocalCallback ? $_ : undefined\\``;\nconst TERRAFORM_MIGRATED_PATTERN = `language hcl\\n\\`name = \"${SSRF_RULE_NAME}\"\\``;\n\n// Every CDK edit site, matched structurally so formatting doesn't affect whether\n// the construct is recognised.\nconst CDK_CONSTANT_ANCHOR_PATTERN = \"`const WEB_CLIENT_ID = 'WebClient'`\";\n// Scoped to the `.concat` callsite so it can't also rewrite the array literal\n// inside the constant this migration inserts.\nconst CDK_LOCAL_URLS_PATTERN =\n  \"`['http://localhost:4200', 'http://localhost:4300'].concat($rest)`\";\nconst CDK_CALL_PATTERN = '`this.createWebAcl($id, this.userPool)`';\nconst CDK_SIGNATURE_PATTERN =\n  '`private createWebAcl = ($id: string, $pool: UserPool) => $body`';\nconst CDK_STATEMENT_PATTERN =\n  \"`managedRuleGroupStatement: { name: 'AWSManagedRulesCommonRuleSet', vendorName: 'AWS' }`\";\n\nconst CDK_EDITS: Array<[string, string]> = [\n  // Local callback URLs become a named constant the override can key off.\n  [\n    CDK_CONSTANT_ANCHOR_PATTERN,\n    `${CDK_CONSTANT_ANCHOR_PATTERN} => \\`const WEB_CLIENT_ID = 'WebClient';\n\n/** Local dev server origins permitted to complete the sign-in redirect */\nconst LOCAL_CALLBACK_URLS = ['http://localhost:4200', 'http://localhost:4300']\\``,\n  ],\n  [\n    CDK_LOCAL_URLS_PATTERN,\n    `${CDK_LOCAL_URLS_PATTERN} => \\`LOCAL_CALLBACK_URLS.concat($rest)\\``,\n  ],\n  [\n    CDK_CALL_PATTERN,\n    `${CDK_CALL_PATTERN} => \\`this.createWebAcl($id, this.userPool, LOCAL_CALLBACK_URLS.length > 0)\\``,\n  ],\n  [\n    CDK_SIGNATURE_PATTERN,\n    `${CDK_SIGNATURE_PATTERN} => \\`private createWebAcl = (\n    $id: string,\n    $pool: UserPool,\n    allowsLocalCallback: boolean\n  ) => $body\\``,\n  ],\n  [\n    CDK_STATEMENT_PATTERN,\n    `${CDK_STATEMENT_PATTERN} => \\`managedRuleGroupStatement: {\n              name: 'AWSManagedRulesCommonRuleSet',\n              vendorName: 'AWS',\n              // ${SSRF_RULE_NAME} treats the loopback redirect_uri the\n              // Hosted UI receives during local sign-in as an SSRF attempt. Counted\n              // only while a local callback URL is allowed; every other rule blocks.\n              ruleActionOverrides: allowsLocalCallback\n                ? [\n                    {\n                      name: '${SSRF_RULE_NAME}',\n                      actionToUse: { count: {} },\n                    },\n                  ]\n                : undefined,\n            }\\``,\n  ],\n];\n\nconst TERRAFORM_DATA_SOURCES_PATTERN = [\n  'language hcl',\n  '`data \"aws_region\" \"current\" {}`',\n].join('\\n');\n\nconst TERRAFORM_EDITS: Array<[string, string]> = [\n  // Local callback URLs become a local the override can key off.\n  [\n    TERRAFORM_DATA_SOURCES_PATTERN,\n    [\n      'language hcl',\n      '`data \"aws_region\" \"current\" {}` => `data \"aws_region\" \"current\" {}',\n      '',\n      'locals {',\n      '  # Local dev server origins permitted to complete the sign-in redirect',\n      '  local_callback_urls = [',\n      '    \"http://localhost:4200\",',\n      '    \"http://localhost:4300\"',\n      '  ]',\n      '}`',\n    ].join('\\n'),\n  ],\n  [\n    [\n      'language hcl',\n      '`callback_urls = concat([',\n      '    \"http://localhost:4200\",',\n      '    \"http://localhost:4300\"',\n      '  ], var.callback_urls)`',\n    ].join('\\n'),\n    [\n      'language hcl',\n      '`callback_urls = concat([',\n      '    \"http://localhost:4200\",',\n      '    \"http://localhost:4300\"',\n      '  ], var.callback_urls)` => `callback_urls = concat(local.local_callback_urls, var.callback_urls)`',\n    ].join('\\n'),\n  ],\n  [\n    [\n      'language hcl',\n      '`logout_urls = concat([',\n      '    \"http://localhost:4200\",',\n      '    \"http://localhost:4300\"',\n      '  ], var.logout_urls)`',\n    ].join('\\n'),\n    [\n      'language hcl',\n      '`logout_urls = concat([',\n      '    \"http://localhost:4200\",',\n      '    \"http://localhost:4300\"',\n      '  ], var.logout_urls)` => `logout_urls = concat(local.local_callback_urls, var.logout_urls)`',\n    ].join('\\n'),\n  ],\n  [\n    [\n      'language hcl',\n      '`managed_rule_group_statement {',\n      '        name        = \"AWSManagedRulesCommonRuleSet\"',\n      '        vendor_name = \"AWS\"',\n      '      }`',\n    ].join('\\n'),\n    [\n      'language hcl',\n      '`managed_rule_group_statement {',\n      '        name        = \"AWSManagedRulesCommonRuleSet\"',\n      '        vendor_name = \"AWS\"',\n      '      }` => `managed_rule_group_statement {',\n      '        name        = \"AWSManagedRulesCommonRuleSet\"',\n      '        vendor_name = \"AWS\"',\n      '',\n      `        # ${SSRF_RULE_NAME} treats the loopback redirect_uri the`,\n      '        # Hosted UI receives during local sign-in as an SSRF attempt. Counted',\n      '        # only while a local callback URL is allowed; every other rule blocks.',\n      '        dynamic \"rule_action_override\" {',\n      '          for_each = length(local.local_callback_urls) > 0 ? [1] : []',\n      '',\n      '          content {',\n      `            name = \"${SSRF_RULE_NAME}\"`,\n      '',\n      '            action_to_use {',\n      '              count {}',\n      '            }',\n      '          }',\n      '        }',\n      '      }`',\n    ].join('\\n'),\n  ],\n];\n\nconst divergedNextStep = (filePath: string) =>\n  `${filePath}: the UserIdentity Web ACL has diverged from the generated shape - left untouched. To sign in against a local dev server, override ${SSRF_RULE_NAME} in the AWSManagedRulesCommonRuleSet rule group to Count, otherwise the Cognito Hosted UI returns 403 for localhost redirect URIs.`;\n\nconst migratedNextStep = (filePath: string) =>\n  `${filePath}: ${SSRF_RULE_NAME} is now counted rather than blocked while a local callback URL is allowed, so signing in against a local dev server works. Redeploy to apply it.`;\n\nexport default async function migration(\n  tree: Tree,\n): Promise<MigrationReturnObject> {\n  const nextSteps: string[] = [];\n\n  for (const [filePath, migratedPattern, edits] of [\n    [CDK_USER_IDENTITY_FILE, CDK_MIGRATED_PATTERN, CDK_EDITS],\n    [TERRAFORM_IDENTITY_FILE, TERRAFORM_MIGRATED_PATTERN, TERRAFORM_EDITS],\n  ] as const) {\n    if (!tree.exists(filePath)) {\n      // This workspace doesn't use this IaC provider, or has no UserIdentity.\n      continue;\n    }\n\n    if (await matchGritQL(tree, filePath, migratedPattern)) {\n      // Already migrated - silent skip keeps re-runs a no-op.\n      continue;\n    }\n\n    // Confirm every edit site is present before writing any of them, so a file\n    // that only partly matches is left whole rather than half-edited.\n    const allSitesPresent = (\n      await Promise.all(\n        edits.map(([match]) => matchGritQL(tree, filePath, match)),\n      )\n    ).every(Boolean);\n\n    if (!allSitesPresent) {\n      nextSteps.push(divergedNextStep(filePath));\n      continue;\n    }\n\n    for (const [, rewrite] of edits) {\n      await applyGritQL(tree, filePath, rewrite);\n    }\n    nextSteps.push(migratedNextStep(filePath));\n  }\n\n  await formatFilesInSubtree(tree);\n\n  return { nextSteps };\n}\n"],"names":["applyGritQL","matchGritQL","formatFilesInSubtree","PACKAGES_DIR","SHARED_CONSTRUCTS_DIR","SHARED_TERRAFORM_DIR","CDK_USER_IDENTITY_FILE","TERRAFORM_IDENTITY_FILE","SSRF_RULE_NAME","CDK_MIGRATED_PATTERN","TERRAFORM_MIGRATED_PATTERN","CDK_CONSTANT_ANCHOR_PATTERN","CDK_LOCAL_URLS_PATTERN","CDK_CALL_PATTERN","CDK_SIGNATURE_PATTERN","CDK_STATEMENT_PATTERN","CDK_EDITS","TERRAFORM_DATA_SOURCES_PATTERN","join","TERRAFORM_EDITS","divergedNextStep","filePath","migratedNextStep","migration","tree","nextSteps","migratedPattern","edits","exists","allSitesPresent","Promise","all","map","match","every","Boolean","push","rewrite"],"mappings":"AAAA;;;CAGC,GAED,SAASA,WAAW,EAAEC,WAAW,QAAQ,wBAAqB;AAC9D,SAASC,oBAAoB,QAAQ,2BAAwB;AAC7D,SACEC,YAAY,EACZC,qBAAqB,EACrBC,oBAAoB,QACf,gDAA6C;AAEpD;;;;;;;;;;;;;;;;;;;;;;;CAuBC,GAED,MAAMC,yBAAyB,GAAGH,aAAa,CAAC,EAAEC,sBAAsB,0BAA0B,CAAC;AACnG,MAAMG,0BAA0B,GAAGJ,aAAa,CAAC,EAAEE,qBAAqB,4CAA4C,CAAC;AAErH,MAAMG,iBAAiB;AAEvB,mEAAmE;AACnE,MAAMC,uBAAuB,CAAC,6DAA6D,CAAC;AAC5F,MAAMC,6BAA6B,CAAC,wBAAwB,EAAEF,eAAe,GAAG,CAAC;AAEjF,iFAAiF;AACjF,+BAA+B;AAC/B,MAAMG,8BAA8B;AACpC,8EAA8E;AAC9E,8CAA8C;AAC9C,MAAMC,yBACJ;AACF,MAAMC,mBAAmB;AACzB,MAAMC,wBACJ;AACF,MAAMC,wBACJ;AAEF,MAAMC,YAAqC;IACzC,wEAAwE;IACxE;QACEL;QACA,GAAGA,4BAA4B;;;gFAG6C,CAAC;KAC9E;IACD;QACEC;QACA,GAAGA,uBAAuB,yCAAyC,CAAC;KACrE;IACD;QACEC;QACA,GAAGA,iBAAiB,6EAA6E,CAAC;KACnG;IACD;QACEC;QACA,GAAGA,sBAAsB;;;;cAIf,CAAC;KACZ;IACD;QACEC;QACA,GAAGA,sBAAsB;;;iBAGZ,EAAEP,eAAe;;;;;;6BAML,EAAEA,eAAe;;;;;eAK/B,CAAC;KACb;CACF;AAED,MAAMS,iCAAiC;IACrC;IACA;CACD,CAACC,IAAI,CAAC;AAEP,MAAMC,kBAA2C;IAC/C,+DAA+D;IAC/D;QACEF;QACA;YACE;YACA;YACA;YACA;YACA;YACA;YACA;YACA;YACA;YACA;SACD,CAACC,IAAI,CAAC;KACR;IACD;QACE;YACE;YACA;YACA;YACA;YACA;SACD,CAACA,IAAI,CAAC;QACP;YACE;YACA;YACA;YACA;YACA;SACD,CAACA,IAAI,CAAC;KACR;IACD;QACE;YACE;YACA;YACA;YACA;YACA;SACD,CAACA,IAAI,CAAC;QACP;YACE;YACA;YACA;YACA;YACA;SACD,CAACA,IAAI,CAAC;KACR;IACD;QACE;YACE;YACA;YACA;YACA;YACA;SACD,CAACA,IAAI,CAAC;QACP;YACE;YACA;YACA;YACA;YACA;YACA;YACA;YACA;YACA,CAAC,UAAU,EAAEV,eAAe,qCAAqC,CAAC;YAClE;YACA;YACA;YACA;YACA;YACA;YACA,CAAC,oBAAoB,EAAEA,eAAe,CAAC,CAAC;YACxC;YACA;YACA;YACA;YACA;YACA;YACA;SACD,CAACU,IAAI,CAAC;KACR;CACF;AAED,MAAME,mBAAmB,CAACC,WACxB,GAAGA,SAAS,mIAAmI,EAAEb,eAAe,kIAAkI,CAAC;AAErS,MAAMc,mBAAmB,CAACD,WACxB,GAAGA,SAAS,EAAE,EAAEb,eAAe,gJAAgJ,CAAC;AAElL,eAAe,eAAee,UAC5BC,IAAU;IAEV,MAAMC,YAAsB,EAAE;IAE9B,KAAK,MAAM,CAACJ,UAAUK,iBAAiBC,MAAM,IAAI;QAC/C;YAACrB;YAAwBG;YAAsBO;SAAU;QACzD;YAACT;YAAyBG;YAA4BS;SAAgB;KACvE,CAAW;QACV,IAAI,CAACK,KAAKI,MAAM,CAACP,WAAW;YAE1B;QACF;QAEA,IAAI,MAAMpB,YAAYuB,MAAMH,UAAUK,kBAAkB;YAEtD;QACF;QAEA,2EAA2E;QAC3E,kEAAkE;QAClE,MAAMG,kBAAkB,AACtB,CAAA,MAAMC,QAAQC,GAAG,CACfJ,MAAMK,GAAG,CAAC,CAAC,CAACC,MAAM,GAAKhC,YAAYuB,MAAMH,UAAUY,QACrD,EACAC,KAAK,CAACC;QAER,IAAI,CAACN,iBAAiB;YACpBJ,UAAUW,IAAI,CAAChB,iBAAiBC;YAChC;QACF;QAEA,KAAK,MAAM,GAAGgB,QAAQ,IAAIV,MAAO;YAC/B,MAAM3B,YAAYwB,MAAMH,UAAUgB;QACpC;QACAZ,UAAUW,IAAI,CAACd,iBAAiBD;IAClC;IAEA,MAAMnB,qBAAqBsB;IAE3B,OAAO;QAAEC;IAAU;AACrB"}

package/src/preset/__snapshots__/generator.spec.ts.snap

@@ -108,6 +108,8 @@ The following list of generators are what is currently available in the \`@aws/n
 
 - **py#agent**: Add an AI Agent to a Python project
 
+- **smithy#project**: Generate a Smithy model project, either defining a service or a library of reusable shapes
+
 - **terraform#project**: Generates a Terraform project
 
 - **ts#docs**: Generates a documentation site

package/src/smithy/project/__snapshots__/generator.spec.ts.snap

@@ -1,5 +1,102 @@
 // Vitest Snapshot v1, https://vitest.dev/guide/snapshot.html
 
+exports[`smithyProjectGenerator > shape libraries > should generate a shape library without a service > shapes-build.Dockerfile 1`] = `
+"FROM public.ecr.aws/docker/library/node:24 AS builder
+ENV CI=true
+
+# Output directory
+RUN mkdir /out
+
+# Install Smithy CLI
+# https://smithy.io/2.0/guides/smithy-cli/cli_installation.html
+WORKDIR /smithy
+ARG TARGETPLATFORM
+RUN if [ "$TARGETPLATFORM" = "linux/arm64" ]; then ARCH="aarch64"; else ARCH="x86_64"; fi && \\
+    mkdir -p smithy-install/smithy && \\
+    curl -L https://github.com/smithy-lang/smithy/releases/download/1.61.0/smithy-cli-linux-$ARCH.zip -o smithy-install/smithy-cli-linux-$ARCH.zip && \\
+    unzip -qo smithy-install/smithy-cli-linux-$ARCH.zip -d smithy-install && \\
+    mv smithy-install/smithy-cli-linux-$ARCH/* smithy-install/smithy
+RUN smithy-install/smithy/install
+
+# Copy project files
+WORKDIR /project
+COPY smithy-build.json .
+COPY src src
+
+# Validate the model and assemble it into a single JSON model file
+RUN --mount=type=cache,target=/root/.m2/repository,id=maven-cache \\
+    smithy build
+
+# Copy the assembled model to the output location
+RUN mkdir -p /out/model
+RUN cp /project/build/smithy/source/model/model.json /out/model/model.json
+
+# Export the /out directory
+FROM scratch AS export
+COPY --from=builder /out /
+"
+`;
+
+exports[`smithyProjectGenerator > shape libraries > should generate a shape library without a service > shapes-main.smithy 1`] = `
+"$version: "2.0"
+
+namespace proj
+
+/// TODO: define the shapes you would like to share between your Smithy projects
+structure ExampleShape {
+    @required
+    id: String
+
+    description: String
+}
+"
+`;
+
+exports[`smithyProjectGenerator > shape libraries > should generate a shape library without a service > shapes-project.json 1`] = `
+"{
+  "name": "@proj/test-shapes",
+  "$schema": "../node_modules/nx/schemas/project-schema.json",
+  "sourceRoot": "test-shapes/src",
+  "projectType": "library",
+  "metadata": {
+    "generator": "smithy#project",
+    "smithyType": "shapes",
+    "namespace": "proj"
+  },
+  "targets": {
+    "build": {
+      "dependsOn": ["compile"]
+    },
+    "compile": {
+      "cache": true,
+      "outputs": ["{workspaceRoot}/dist/{projectRoot}/build"],
+      "executor": "nx:run-commands",
+      "options": {
+        "commands": [
+          "rimraf dist/{projectRoot}/build",
+          "make-dir dist/{projectRoot}/build",
+          "docker build -f {projectRoot}/build.Dockerfile --build-context workspace=. --target export --output type=local,dest=dist/{projectRoot}/build {projectRoot}"
+        ],
+        "parallel": false,
+        "cwd": "{workspaceRoot}"
+      }
+    }
+  }
+}
+"
+`;
+
+exports[`smithyProjectGenerator > shape libraries > should generate a shape library without a service > shapes-smithy-build.json 1`] = `
+"{
+  "version": "1.0",
+  "sources": ["src/"],
+  "maven": {
+    "dependencies": ["software.amazon.smithy:smithy-model:1.61.0"]
+  }
+}
+"
+`;
+
 exports[`smithyProjectGenerator > should generate smithy project with all custom options > all-custom-main.smithy 1`] = `
 "$version: "2.0"
 
@@ -31,6 +128,8 @@ exports[`smithyProjectGenerator > should generate smithy project with all custom
   "projectType": "library",
   "metadata": {
     "generator": "smithy#project",
+    "smithyType": "service",
+    "namespace": "com.mycompany.api",
     "apiName": "test-api"
   },
   "targets": {
@@ -45,7 +144,7 @@ exports[`smithyProjectGenerator > should generate smithy project with all custom
         "commands": [
           "rimraf dist/{projectRoot}/build",
           "make-dir dist/{projectRoot}/build",
-          "docker build -f {projectRoot}/build.Dockerfile --target export --output type=local,dest=dist/{projectRoot}/build {projectRoot}"
+          "docker build -f {projectRoot}/build.Dockerfile --build-context workspace=. --target export --output type=local,dest=dist/{projectRoot}/build {projectRoot}"
         ],
         "parallel": false,
         "cwd": "{workspaceRoot}"
@@ -64,6 +163,8 @@ exports[`smithyProjectGenerator > should generate smithy project with custom dir
   "projectType": "library",
   "metadata": {
     "generator": "smithy#project",
+    "smithyType": "service",
+    "namespace": "proj",
     "apiName": "test-api"
   },
   "targets": {
@@ -78,7 +179,7 @@ exports[`smithyProjectGenerator > should generate smithy project with custom dir
         "commands": [
           "rimraf dist/{projectRoot}/build",
           "make-dir dist/{projectRoot}/build",
-          "docker build -f {projectRoot}/build.Dockerfile --target export --output type=local,dest=dist/{projectRoot}/build {projectRoot}"
+          "docker build -f {projectRoot}/build.Dockerfile --build-context workspace=. --target export --output type=local,dest=dist/{projectRoot}/build {projectRoot}"
         ],
         "parallel": false,
         "cwd": "{workspaceRoot}"
@@ -288,6 +389,8 @@ exports[`smithyProjectGenerator > should generate smithy project with default op
   "projectType": "library",
   "metadata": {
     "generator": "smithy#project",
+    "smithyType": "service",
+    "namespace": "proj",
     "apiName": "test-api"
   },
   "targets": {
@@ -302,7 +405,7 @@ exports[`smithyProjectGenerator > should generate smithy project with default op
         "commands": [
           "rimraf dist/{projectRoot}/build",
           "make-dir dist/{projectRoot}/build",
-          "docker build -f {projectRoot}/build.Dockerfile --target export --output type=local,dest=dist/{projectRoot}/build {projectRoot}"
+          "docker build -f {projectRoot}/build.Dockerfile --build-context workspace=. --target export --output type=local,dest=dist/{projectRoot}/build {projectRoot}"
         ],
         "parallel": false,
         "cwd": "{workspaceRoot}"
@@ -350,6 +453,8 @@ exports[`smithyProjectGenerator > should generate smithy project with subdirecto
   "projectType": "library",
   "metadata": {
     "generator": "smithy#project",
+    "smithyType": "service",
+    "namespace": "proj",
     "apiName": "test-api"
   },
   "targets": {
@@ -364,7 +469,7 @@ exports[`smithyProjectGenerator > should generate smithy project with subdirecto
         "commands": [
           "rimraf dist/{projectRoot}/build",
           "make-dir dist/{projectRoot}/build",
-          "docker build -f {projectRoot}/build.Dockerfile --target export --output type=local,dest=dist/{projectRoot}/build {projectRoot}"
+          "docker build -f {projectRoot}/build.Dockerfile --build-context workspace=. --target export --output type=local,dest=dist/{projectRoot}/build {projectRoot}"
         ],
         "parallel": false,
         "cwd": "{workspaceRoot}"

package/src/smithy/project/files/shapes/build.Dockerfile.template

@@ -0,0 +1,33 @@
+FROM public.ecr.aws/docker/library/node:24 AS builder
+ENV CI=true
+
+# Output directory
+RUN mkdir /out
+
+# Install Smithy CLI
+# https://smithy.io/2.0/guides/smithy-cli/cli_installation.html
+WORKDIR /smithy
+ARG TARGETPLATFORM
+RUN if [ "$TARGETPLATFORM" = "linux/arm64" ]; then ARCH="aarch64"; else ARCH="x86_64"; fi && \
+    mkdir -p smithy-install/smithy && \
+    curl -L https://github.com/smithy-lang/smithy/releases/download/1.61.0/smithy-cli-linux-$ARCH.zip -o smithy-install/smithy-cli-linux-$ARCH.zip && \
+    unzip -qo smithy-install/smithy-cli-linux-$ARCH.zip -d smithy-install && \
+    mv smithy-install/smithy-cli-linux-$ARCH/* smithy-install/smithy
+RUN smithy-install/smithy/install
+
+# Copy project files
+WORKDIR /project
+COPY smithy-build.json .
+COPY src src
+
+# Validate the model and assemble it into a single JSON model file
+RUN --mount=type=cache,target=/root/.m2/repository,id=maven-cache \
+    smithy build
+
+# Copy the assembled model to the output location
+RUN mkdir -p /out/model
+RUN cp /project/build/smithy/source/model/model.json /out/model/model.json
+
+# Export the /out directory
+FROM scratch AS export
+COPY --from=builder /out /

package/src/smithy/project/files/shapes/smithy-build.json.template

@@ -0,0 +1,7 @@
+{
+  "version": "1.0",
+  "sources": ["src/"],
+  "maven": {
+    "dependencies": ["software.amazon.smithy:smithy-model:1.61.0"]
+  }
+}

package/src/smithy/project/files/shapes/src/main.smithy.template

@@ -0,0 +1,11 @@
+$version: "2.0"
+
+namespace <%- namespace %>
+
+/// TODO: define the shapes you would like to share between your Smithy projects
+structure ExampleShape {
+    @required
+    id: String
+
+    description: String
+}

package/src/smithy/project/generator.js

@@ -1,7 +1,7 @@
 /**
  * Copyright Amazon.com, Inc. or its affiliates. All Rights Reserved.
  * SPDX-License-Identifier: Apache-2.0
- */ import { addProjectConfiguration, generateFiles, joinPathFragments } from "@nx/devkit";
+ */ import { addProjectConfiguration, generateFiles, joinPathFragments, OverwriteStrategy } from "@nx/devkit";
 import { getTsLibDetails } from "../../ts/lib/generator.js";
 import { resolveContainers } from "../../utils/containers.js";
 import { formatFilesInSubtree } from "../../utils/format.js";
@@ -15,6 +15,7 @@ export const SMITHY_PROJECT_GENERATOR_INFO = getGeneratorInfo(import.meta.filena
 export const smithyProjectGenerator = async (tree, options)=>{
     const cmd = new FsCommands(tree);
     const containers = await resolveContainers(tree, 'inherit');
+    const type = options.type ?? 'service';
     // Create project.json
     const { fullyQualifiedName, dir } = getTsLibDetails(tree, options);
     if (!projectExists(tree, fullyQualifiedName)) {
@@ -39,7 +40,10 @@ export const smithyProjectGenerator = async (tree, options)=>{
                         commands: [
                             cmd.rm('dist/{projectRoot}/build'),
                             cmd.mkdir('dist/{projectRoot}/build'),
-                            `${containers} build -f {projectRoot}/build.Dockerfile --target export --output type=local,dest=dist/{projectRoot}/build {projectRoot}`
+                            // The workspace build context lets a project's Dockerfile copy in
+                            // the built models of shape libraries it depends on. Commands run
+                            // from the workspace root, so it is the current directory.
+                            `${containers} build -f {projectRoot}/build.Dockerfile --build-context workspace=. --target export --output type=local,dest=dist/{projectRoot}/build {projectRoot}`
                         ],
                         parallel: false,
                         cwd: '{workspaceRoot}'
@@ -53,14 +57,21 @@ export const smithyProjectGenerator = async (tree, options)=>{
     const serviceNameKebabCase = toKebabCase(serviceName);
     const scope = getNpmScope(tree);
     const namespace = options.namespace ?? toKebabCase(scope).replace(/-/g, '.');
-    generateFiles(tree, joinPathFragments(import.meta.dirname, 'files'), dir, {
+    generateFiles(tree, joinPathFragments(import.meta.dirname, 'files', type), dir, {
         namespace,
         serviceNameClassName,
         serviceNameKebabCase,
         scope
+    }, {
+        // Smithy models are user-owned — a re-run must not discard edits
+        overwriteStrategy: OverwriteStrategy.KeepExisting
     });
     addGeneratorMetadata(tree, fullyQualifiedName, SMITHY_PROJECT_GENERATOR_INFO, {
-        apiName: options.name
+        smithyType: type,
+        namespace,
+        ...type === 'service' ? {
+            apiName: options.name
+        } : {}
     });
     await addGeneratorMetricsIfApplicable(tree, [
         SMITHY_PROJECT_GENERATOR_INFO

package/src/smithy/project/generator.js.map

@@ -1 +1 @@
-{"version":3,"sources":["../../../../../../packages/nx-plugin/src/smithy/project/generator.ts"],"sourcesContent":["/**\n * Copyright Amazon.com, Inc. or its affiliates. All Rights Reserved.\n * SPDX-License-Identifier: Apache-2.0\n */\nimport {\n  addProjectConfiguration,\n  type GeneratorCallback,\n  generateFiles,\n  joinPathFragments,\n  type Tree,\n} from '@nx/devkit';\nimport { getTsLibDetails } from '../../ts/lib/generator';\nimport { resolveContainers } from '../../utils/containers';\nimport { formatFilesInSubtree } from '../../utils/format';\nimport { FsCommands } from '../../utils/fs';\nimport { installDependencies } from '../../utils/install';\nimport { addGeneratorMetricsIfApplicable } from '../../utils/metrics';\nimport { toClassName, toKebabCase } from '../../utils/names';\nimport { getNpmScope } from '../../utils/npm-scope';\nimport {\n  addGeneratorMetadata,\n  getGeneratorInfo,\n  type NxGeneratorInfo,\n  projectExists,\n} from '../../utils/nx';\nimport type { SmithyProjectGeneratorSchema } from './schema';\n\nexport const SMITHY_PROJECT_GENERATOR_INFO: NxGeneratorInfo = getGeneratorInfo(\n  import.meta.filename,\n);\n\nexport const smithyProjectGenerator = async (\n  tree: Tree,\n  options: SmithyProjectGeneratorSchema,\n): Promise<GeneratorCallback> => {\n  const cmd = new FsCommands(tree);\n  const containers = await resolveContainers(tree, 'inherit');\n\n  // Create project.json\n  const { fullyQualifiedName, dir } = getTsLibDetails(tree, options);\n\n  if (!projectExists(tree, fullyQualifiedName)) {\n    addProjectConfiguration(tree, fullyQualifiedName, {\n      name: fullyQualifiedName,\n      root: dir,\n      sourceRoot: joinPathFragments(dir, 'src'),\n      projectType: 'library',\n      targets: {\n        build: {\n          dependsOn: ['compile'],\n        },\n        compile: {\n          cache: true,\n          outputs: ['{workspaceRoot}/dist/{projectRoot}/build'],\n          executor: 'nx:run-commands',\n          options: {\n            commands: [\n              cmd.rm('dist/{projectRoot}/build'),\n              cmd.mkdir('dist/{projectRoot}/build'),\n              `${containers} build -f {projectRoot}/build.Dockerfile --target export --output type=local,dest=dist/{projectRoot}/build {projectRoot}`,\n            ],\n            parallel: false,\n            cwd: '{workspaceRoot}',\n          },\n        },\n      },\n    });\n  }\n\n  const serviceName = options.serviceName ?? options.name;\n  const serviceNameClassName = toClassName(serviceName);\n  const serviceNameKebabCase = toKebabCase(serviceName);\n  const scope = getNpmScope(tree);\n  const namespace = options.namespace ?? toKebabCase(scope).replace(/-/g, '.');\n\n  generateFiles(tree, joinPathFragments(import.meta.dirname, 'files'), dir, {\n    namespace,\n    serviceNameClassName,\n    serviceNameKebabCase,\n    scope,\n  });\n\n  addGeneratorMetadata(\n    tree,\n    fullyQualifiedName,\n    SMITHY_PROJECT_GENERATOR_INFO,\n    {\n      apiName: options.name,\n    },\n  );\n\n  await addGeneratorMetricsIfApplicable(tree, [SMITHY_PROJECT_GENERATOR_INFO]);\n\n  await formatFilesInSubtree(tree);\n  return () =>\n    installDependencies(tree, options.preferInstallDependencies, {\n      languages: ['typescript'],\n    });\n};\n\nexport default smithyProjectGenerator;\n"],"names":["addProjectConfiguration","generateFiles","joinPathFragments","getTsLibDetails","resolveContainers","formatFilesInSubtree","FsCommands","installDependencies","addGeneratorMetricsIfApplicable","toClassName","toKebabCase","getNpmScope","addGeneratorMetadata","getGeneratorInfo","projectExists","SMITHY_PROJECT_GENERATOR_INFO","filename","smithyProjectGenerator","tree","options","cmd","containers","fullyQualifiedName","dir","name","root","sourceRoot","projectType","targets","build","dependsOn","compile","cache","outputs","executor","commands","rm","mkdir","parallel","cwd","serviceName","serviceNameClassName","serviceNameKebabCase","scope","namespace","replace","dirname","apiName","preferInstallDependencies","languages"],"mappings":"AAAA;;;CAGC,GACD,SACEA,uBAAuB,EAEvBC,aAAa,EACbC,iBAAiB,QAEZ,aAAa;AACpB,SAASC,eAAe,QAAQ,4BAAyB;AACzD,SAASC,iBAAiB,QAAQ,4BAAyB;AAC3D,SAASC,oBAAoB,QAAQ,wBAAqB;AAC1D,SAASC,UAAU,QAAQ,oBAAiB;AAC5C,SAASC,mBAAmB,QAAQ,yBAAsB;AAC1D,SAASC,+BAA+B,QAAQ,yBAAsB;AACtE,SAASC,WAAW,EAAEC,WAAW,QAAQ,uBAAoB;AAC7D,SAASC,WAAW,QAAQ,2BAAwB;AACpD,SACEC,oBAAoB,EACpBC,gBAAgB,EAEhBC,aAAa,QACR,oBAAiB;AAGxB,OAAO,MAAMC,gCAAiDF,iBAC5D,YAAYG,QAAQ,EACpB;AAEF,OAAO,MAAMC,yBAAyB,OACpCC,MACAC;IAEA,MAAMC,MAAM,IAAId,WAAWY;IAC3B,MAAMG,aAAa,MAAMjB,kBAAkBc,MAAM;IAEjD,sBAAsB;IACtB,MAAM,EAAEI,kBAAkB,EAAEC,GAAG,EAAE,GAAGpB,gBAAgBe,MAAMC;IAE1D,IAAI,CAACL,cAAcI,MAAMI,qBAAqB;QAC5CtB,wBAAwBkB,MAAMI,oBAAoB;YAChDE,MAAMF;YACNG,MAAMF;YACNG,YAAYxB,kBAAkBqB,KAAK;YACnCI,aAAa;YACbC,SAAS;gBACPC,OAAO;oBACLC,WAAW;wBAAC;qBAAU;gBACxB;gBACAC,SAAS;oBACPC,OAAO;oBACPC,SAAS;wBAAC;qBAA2C;oBACrDC,UAAU;oBACVf,SAAS;wBACPgB,UAAU;4BACRf,IAAIgB,EAAE,CAAC;4BACPhB,IAAIiB,KAAK,CAAC;4BACV,GAAGhB,WAAW,wHAAwH,CAAC;yBACxI;wBACDiB,UAAU;wBACVC,KAAK;oBACP;gBACF;YACF;QACF;IACF;IAEA,MAAMC,cAAcrB,QAAQqB,WAAW,IAAIrB,QAAQK,IAAI;IACvD,MAAMiB,uBAAuBhC,YAAY+B;IACzC,MAAME,uBAAuBhC,YAAY8B;IACzC,MAAMG,QAAQhC,YAAYO;IAC1B,MAAM0B,YAAYzB,QAAQyB,SAAS,IAAIlC,YAAYiC,OAAOE,OAAO,CAAC,MAAM;IAExE5C,cAAciB,MAAMhB,kBAAkB,YAAY4C,OAAO,EAAE,UAAUvB,KAAK;QACxEqB;QACAH;QACAC;QACAC;IACF;IAEA/B,qBACEM,MACAI,oBACAP,+BACA;QACEgC,SAAS5B,QAAQK,IAAI;IACvB;IAGF,MAAMhB,gCAAgCU,MAAM;QAACH;KAA8B;IAE3E,MAAMV,qBAAqBa;IAC3B,OAAO,IACLX,oBAAoBW,MAAMC,QAAQ6B,yBAAyB,EAAE;YAC3DC,WAAW;gBAAC;aAAa;QAC3B;AACJ,EAAE;AAEF,eAAehC,uBAAuB"}
+{"version":3,"sources":["../../../../../../packages/nx-plugin/src/smithy/project/generator.ts"],"sourcesContent":["/**\n * Copyright Amazon.com, Inc. or its affiliates. All Rights Reserved.\n * SPDX-License-Identifier: Apache-2.0\n */\nimport {\n  addProjectConfiguration,\n  type GeneratorCallback,\n  generateFiles,\n  joinPathFragments,\n  OverwriteStrategy,\n  type Tree,\n} from '@nx/devkit';\nimport { getTsLibDetails } from '../../ts/lib/generator';\nimport { resolveContainers } from '../../utils/containers';\nimport { formatFilesInSubtree } from '../../utils/format';\nimport { FsCommands } from '../../utils/fs';\nimport { installDependencies } from '../../utils/install';\nimport { addGeneratorMetricsIfApplicable } from '../../utils/metrics';\nimport { toClassName, toKebabCase } from '../../utils/names';\nimport { getNpmScope } from '../../utils/npm-scope';\nimport {\n  addGeneratorMetadata,\n  getGeneratorInfo,\n  type NxGeneratorInfo,\n  projectExists,\n} from '../../utils/nx';\nimport type { SmithyProjectGeneratorSchema } from './schema';\n\nexport const SMITHY_PROJECT_GENERATOR_INFO: NxGeneratorInfo = getGeneratorInfo(\n  import.meta.filename,\n);\n\nexport const smithyProjectGenerator = async (\n  tree: Tree,\n  options: SmithyProjectGeneratorSchema,\n): Promise<GeneratorCallback> => {\n  const cmd = new FsCommands(tree);\n  const containers = await resolveContainers(tree, 'inherit');\n  const type = options.type ?? 'service';\n\n  // Create project.json\n  const { fullyQualifiedName, dir } = getTsLibDetails(tree, options);\n\n  if (!projectExists(tree, fullyQualifiedName)) {\n    addProjectConfiguration(tree, fullyQualifiedName, {\n      name: fullyQualifiedName,\n      root: dir,\n      sourceRoot: joinPathFragments(dir, 'src'),\n      projectType: 'library',\n      targets: {\n        build: {\n          dependsOn: ['compile'],\n        },\n        compile: {\n          cache: true,\n          outputs: ['{workspaceRoot}/dist/{projectRoot}/build'],\n          executor: 'nx:run-commands',\n          options: {\n            commands: [\n              cmd.rm('dist/{projectRoot}/build'),\n              cmd.mkdir('dist/{projectRoot}/build'),\n              // The workspace build context lets a project's Dockerfile copy in\n              // the built models of shape libraries it depends on. Commands run\n              // from the workspace root, so it is the current directory.\n              `${containers} build -f {projectRoot}/build.Dockerfile --build-context workspace=. --target export --output type=local,dest=dist/{projectRoot}/build {projectRoot}`,\n            ],\n            parallel: false,\n            cwd: '{workspaceRoot}',\n          },\n        },\n      },\n    });\n  }\n\n  const serviceName = options.serviceName ?? options.name;\n  const serviceNameClassName = toClassName(serviceName);\n  const serviceNameKebabCase = toKebabCase(serviceName);\n  const scope = getNpmScope(tree);\n  const namespace = options.namespace ?? toKebabCase(scope).replace(/-/g, '.');\n\n  generateFiles(\n    tree,\n    joinPathFragments(import.meta.dirname, 'files', type),\n    dir,\n    {\n      namespace,\n      serviceNameClassName,\n      serviceNameKebabCase,\n      scope,\n    },\n    {\n      // Smithy models are user-owned — a re-run must not discard edits\n      overwriteStrategy: OverwriteStrategy.KeepExisting,\n    },\n  );\n\n  addGeneratorMetadata(\n    tree,\n    fullyQualifiedName,\n    SMITHY_PROJECT_GENERATOR_INFO,\n    {\n      smithyType: type,\n      namespace,\n      ...(type === 'service' ? { apiName: options.name } : {}),\n    },\n  );\n\n  await addGeneratorMetricsIfApplicable(tree, [SMITHY_PROJECT_GENERATOR_INFO]);\n\n  await formatFilesInSubtree(tree);\n  return () =>\n    installDependencies(tree, options.preferInstallDependencies, {\n      languages: ['typescript'],\n    });\n};\n\nexport default smithyProjectGenerator;\n"],"names":["addProjectConfiguration","generateFiles","joinPathFragments","OverwriteStrategy","getTsLibDetails","resolveContainers","formatFilesInSubtree","FsCommands","installDependencies","addGeneratorMetricsIfApplicable","toClassName","toKebabCase","getNpmScope","addGeneratorMetadata","getGeneratorInfo","projectExists","SMITHY_PROJECT_GENERATOR_INFO","filename","smithyProjectGenerator","tree","options","cmd","containers","type","fullyQualifiedName","dir","name","root","sourceRoot","projectType","targets","build","dependsOn","compile","cache","outputs","executor","commands","rm","mkdir","parallel","cwd","serviceName","serviceNameClassName","serviceNameKebabCase","scope","namespace","replace","dirname","overwriteStrategy","KeepExisting","smithyType","apiName","preferInstallDependencies","languages"],"mappings":"AAAA;;;CAGC,GACD,SACEA,uBAAuB,EAEvBC,aAAa,EACbC,iBAAiB,EACjBC,iBAAiB,QAEZ,aAAa;AACpB,SAASC,eAAe,QAAQ,4BAAyB;AACzD,SAASC,iBAAiB,QAAQ,4BAAyB;AAC3D,SAASC,oBAAoB,QAAQ,wBAAqB;AAC1D,SAASC,UAAU,QAAQ,oBAAiB;AAC5C,SAASC,mBAAmB,QAAQ,yBAAsB;AAC1D,SAASC,+BAA+B,QAAQ,yBAAsB;AACtE,SAASC,WAAW,EAAEC,WAAW,QAAQ,uBAAoB;AAC7D,SAASC,WAAW,QAAQ,2BAAwB;AACpD,SACEC,oBAAoB,EACpBC,gBAAgB,EAEhBC,aAAa,QACR,oBAAiB;AAGxB,OAAO,MAAMC,gCAAiDF,iBAC5D,YAAYG,QAAQ,EACpB;AAEF,OAAO,MAAMC,yBAAyB,OACpCC,MACAC;IAEA,MAAMC,MAAM,IAAId,WAAWY;IAC3B,MAAMG,aAAa,MAAMjB,kBAAkBc,MAAM;IACjD,MAAMI,OAAOH,QAAQG,IAAI,IAAI;IAE7B,sBAAsB;IACtB,MAAM,EAAEC,kBAAkB,EAAEC,GAAG,EAAE,GAAGrB,gBAAgBe,MAAMC;IAE1D,IAAI,CAACL,cAAcI,MAAMK,qBAAqB;QAC5CxB,wBAAwBmB,MAAMK,oBAAoB;YAChDE,MAAMF;YACNG,MAAMF;YACNG,YAAY1B,kBAAkBuB,KAAK;YACnCI,aAAa;YACbC,SAAS;gBACPC,OAAO;oBACLC,WAAW;wBAAC;qBAAU;gBACxB;gBACAC,SAAS;oBACPC,OAAO;oBACPC,SAAS;wBAAC;qBAA2C;oBACrDC,UAAU;oBACVhB,SAAS;wBACPiB,UAAU;4BACRhB,IAAIiB,EAAE,CAAC;4BACPjB,IAAIkB,KAAK,CAAC;4BACV,kEAAkE;4BAClE,kEAAkE;4BAClE,2DAA2D;4BAC3D,GAAGjB,WAAW,oJAAoJ,CAAC;yBACpK;wBACDkB,UAAU;wBACVC,KAAK;oBACP;gBACF;YACF;QACF;IACF;IAEA,MAAMC,cAActB,QAAQsB,WAAW,IAAItB,QAAQM,IAAI;IACvD,MAAMiB,uBAAuBjC,YAAYgC;IACzC,MAAME,uBAAuBjC,YAAY+B;IACzC,MAAMG,QAAQjC,YAAYO;IAC1B,MAAM2B,YAAY1B,QAAQ0B,SAAS,IAAInC,YAAYkC,OAAOE,OAAO,CAAC,MAAM;IAExE9C,cACEkB,MACAjB,kBAAkB,YAAY8C,OAAO,EAAE,SAASzB,OAChDE,KACA;QACEqB;QACAH;QACAC;QACAC;IACF,GACA;QACE,iEAAiE;QACjEI,mBAAmB9C,kBAAkB+C,YAAY;IACnD;IAGFrC,qBACEM,MACAK,oBACAR,+BACA;QACEmC,YAAY5B;QACZuB;QACA,GAAIvB,SAAS,YAAY;YAAE6B,SAAShC,QAAQM,IAAI;QAAC,IAAI,CAAC,CAAC;IACzD;IAGF,MAAMjB,gCAAgCU,MAAM;QAACH;KAA8B;IAE3E,MAAMV,qBAAqBa;IAC3B,OAAO,IACLX,oBAAoBW,MAAMC,QAAQiC,yBAAyB,EAAE;YAC3DC,WAAW;gBAAC;aAAa;QAC3B;AACJ,EAAE;AAEF,eAAepC,uBAAuB"}

package/src/smithy/project/schema.d.js.map

@@ -1 +1 @@
-{"version":3,"sources":["../../../../../../packages/nx-plugin/src/smithy/project/schema.d.ts"],"sourcesContent":["/**\n * Copyright Amazon.com, Inc. or its affiliates. All Rights Reserved.\n * SPDX-License-Identifier: Apache-2.0\n */\nexport interface SmithyProjectGeneratorSchema {\n  name: string;\n  serviceName?: string;\n  namespace?: string;\n  directory?: string;\n  subDirectory?: string;\n  preferInstallDependencies?: boolean;\n}\n"],"names":[],"mappings":"AAAA;;;CAGC,GACD,WAOC"}
+{"version":3,"sources":["../../../../../../packages/nx-plugin/src/smithy/project/schema.d.ts"],"sourcesContent":["/**\n * Copyright Amazon.com, Inc. or its affiliates. All Rights Reserved.\n * SPDX-License-Identifier: Apache-2.0\n */\nexport interface SmithyProjectGeneratorSchema {\n  name: string;\n  type?: 'service' | 'shapes';\n  serviceName?: string;\n  namespace?: string;\n  directory?: string;\n  subDirectory?: string;\n  preferInstallDependencies?: boolean;\n}\n"],"names":[],"mappings":"AAAA;;;CAGC,GACD,WAQC"}

package/src/smithy/project/schema.d.ts

@@ -4,6 +4,7 @@
  */
 export interface SmithyProjectGeneratorSchema {
   name: string;
+  type?: 'service' | 'shapes';
   serviceName?: string;
   namespace?: string;
   directory?: string;

package/src/smithy/project/schema.json

@@ -15,9 +15,31 @@
       "x-priority": "important",
       "x-prompt": "What would you like to call your Smithy project?"
     },
+    "type": {
+      "type": "string",
+      "description": "The type of Smithy project to create. Choose between service (a model with a service shape, ready for an implementation) and shapes (a shape library of reusable shapes, shared between multiple Smithy projects).",
+      "default": "service",
+      "enum": ["service", "shapes"],
+      "x-priority": "important",
+      "x-prompt": {
+        "message": "What type of Smithy project would you like to create?",
+        "type": "list",
+        "items": [
+          {
+            "value": "service",
+            "label": "service (a model which defines a service and its operations)"
+          },
+          {
+            "value": "shapes",
+            "label": "shapes (a library of reusable shapes, shared between Smithy projects)"
+          }
+        ],
+        "default": "service"
+      }
+    },
     "serviceName": {
       "type": "string",
-      "description": "The name of your Smithy service. Uses the supplied name by default.",
+      "description": "The name of your Smithy service. Uses the supplied name by default. Not applicable to shape libraries.",
       "x-prompt": "What name would you like your Smithy Service to have? i.e: MyService"
     },
     "namespace": {

package/src/smithy/ts/api/__snapshots__/generator.spec.ts.snap

@@ -1743,6 +1743,8 @@ exports[`tsSmithyApiGenerator > should generate smithy ts api with default optio
   "projectType": "library",
   "metadata": {
     "generator": "smithy#project",
+    "smithyType": "service",
+    "namespace": "proj",
     "apiName": "test-api-model",
     "backendProject": "@proj/test-api"
   },
@@ -1758,7 +1760,7 @@ exports[`tsSmithyApiGenerator > should generate smithy ts api with default optio
         "commands": [
           "rimraf dist/{projectRoot}/build",
           "make-dir dist/{projectRoot}/build",
-          "docker build -f {projectRoot}/build.Dockerfile --target export --output type=local,dest=dist/{projectRoot}/build {projectRoot}"
+          "docker build -f {projectRoot}/build.Dockerfile --build-context workspace=. --target export --output type=local,dest=dist/{projectRoot}/build {projectRoot}"
         ],
         "parallel": false,
         "cwd": "{workspaceRoot}"

package/src/ts/react-website/cognito-auth/__snapshots__/generator.spec.ts.snap

@@ -125,6 +125,9 @@ import { suppressRules } from './checkov.js';
 
 const WEB_CLIENT_ID = 'WebClient';
 
+/** Local dev server origins permitted to complete the sign-in redirect */
+const LOCAL_CALLBACK_URLS = ['http://localhost:4200', 'http://localhost:4300'];
+
 export interface UserIdentityProps {
   /**
    * Whether to enable AWS WAFv2 with the default managed ruleset
@@ -160,7 +163,11 @@ export class UserIdentity extends Construct {
     this.userPool = this.createUserPool();
 
     if (enableWaf) {
-      this.webAcl = this.createWebAcl(id, this.userPool);
+      this.webAcl = this.createWebAcl(
+        id,
+        this.userPool,
+        LOCAL_CALLBACK_URLS.length > 0,
+      );
     }
     this.userPoolDomain = this.createUserPoolDomain(this.userPool);
     this.userPoolClient = this.createUserPoolClient(this.userPool);
@@ -248,7 +255,11 @@ export class UserIdentity extends Construct {
     return userPool;
   };
 
-  private createWebAcl = (id: string, userPool: UserPool) => {
+  private createWebAcl = (
+    id: string,
+    userPool: UserPool,
+    allowsLocalCallback: boolean,
+  ) => {
     const webAcl = new CfnWebACL(this, 'WebAcl', {
       defaultAction: { allow: {} },
       scope: 'REGIONAL',
@@ -265,6 +276,17 @@ export class UserIdentity extends Construct {
             managedRuleGroupStatement: {
               name: 'AWSManagedRulesCommonRuleSet',
               vendorName: 'AWS',
+              // EC2MetaDataSSRF_QUERYARGUMENTS treats the loopback redirect_uri the
+              // Hosted UI receives during local sign-in as an SSRF attempt. Counted
+              // only while a local callback URL is allowed; every other rule blocks.
+              ruleActionOverrides: allowsLocalCallback
+                ? [
+                    {
+                      name: 'EC2MetaDataSSRF_QUERYARGUMENTS',
+                      actionToUse: { count: {} },
+                    },
+                  ]
+                : undefined,
             },
           },
           visibilityConfig: {
@@ -335,7 +357,7 @@ export class UserIdentity extends Construct {
   private createUserPoolClient = (userPool: UserPool) => {
     const lazilyComputedCallbackUrls = Lazy.list({
       produce: () =>
-        ['http://localhost:4200', 'http://localhost:4300'].concat(
+        LOCAL_CALLBACK_URLS.concat(
           Stack.of(this)
             .node.findAll()
             .filter(

package/src/utils/identity-constructs/files/cdk/core/user-identity.ts.template

@@ -36,6 +36,9 @@ import { suppressRules } from './checkov<% if (esm) { %>.js<% } %>';
 
 const WEB_CLIENT_ID = 'WebClient';
 
+/** Local dev server origins permitted to complete the sign-in redirect */
+const LOCAL_CALLBACK_URLS = ['http://localhost:4200', 'http://localhost:4300'];
+
 export interface UserIdentityProps {
   /**
    * Whether to enable AWS WAFv2 with the default managed ruleset
@@ -67,7 +70,11 @@ export class UserIdentity extends Construct {
     this.userPool = this.createUserPool();
 
     if (enableWaf) {
-      this.webAcl = this.createWebAcl(id, this.userPool);
+      this.webAcl = this.createWebAcl(
+        id,
+        this.userPool,
+        LOCAL_CALLBACK_URLS.length > 0
+      );
     }
     this.userPoolDomain = this.createUserPoolDomain(this.userPool);
     this.userPoolClient = this.createUserPoolClient(this.userPool);
@@ -155,7 +162,11 @@ export class UserIdentity extends Construct {
     return userPool;
   };
 
-  private createWebAcl = (id: string, userPool: UserPool) => {
+  private createWebAcl = (
+    id: string,
+    userPool: UserPool,
+    allowsLocalCallback: boolean
+  ) => {
     const webAcl = new CfnWebACL(this, 'WebAcl', {
       defaultAction: { allow: {} },
       scope: 'REGIONAL',
@@ -172,6 +183,17 @@ export class UserIdentity extends Construct {
             managedRuleGroupStatement: {
               name: 'AWSManagedRulesCommonRuleSet',
               vendorName: 'AWS',
+              // EC2MetaDataSSRF_QUERYARGUMENTS treats the loopback redirect_uri the
+              // Hosted UI receives during local sign-in as an SSRF attempt. Counted
+              // only while a local callback URL is allowed; every other rule blocks.
+              ruleActionOverrides: allowsLocalCallback
+                ? [
+                    {
+                      name: 'EC2MetaDataSSRF_QUERYARGUMENTS',
+                      actionToUse: { count: {} },
+                    },
+                  ]
+                : undefined,
             },
           },
           visibilityConfig: {
@@ -242,7 +264,7 @@ export class UserIdentity extends Construct {
   private createUserPoolClient = (userPool: UserPool) => {
     const lazilyComputedCallbackUrls = Lazy.list({
       produce: () =>
-        ['http://localhost:4200', 'http://localhost:4300'].concat(
+        LOCAL_CALLBACK_URLS.concat(
           Stack.of(this)
             .node.findAll()
             .filter((child): child is Distribution => child instanceof Distribution)

package/src/utils/identity-constructs/files/terraform/core/user-identity/identity/identity.tf.template

@@ -44,6 +44,14 @@ variable "logout_urls" {
 data "aws_caller_identity" "current" {}
 data "aws_region" "current" {}
 
+locals {
+  # Local dev server origins permitted to complete the sign-in redirect
+  local_callback_urls = [
+    "http://localhost:4200",
+    "http://localhost:4300"
+  ]
+}
+
 # Random suffix for resource names
 resource "random_id" "unique_suffix" {
   byte_length = 4
@@ -260,6 +268,21 @@ resource "aws_wafv2_web_acl" "user_pool_waf" {
       managed_rule_group_statement {
         name        = "AWSManagedRulesCommonRuleSet"
         vendor_name = "AWS"
+
+        # EC2MetaDataSSRF_QUERYARGUMENTS treats the loopback redirect_uri the
+        # Hosted UI receives during local sign-in as an SSRF attempt. Counted
+        # only while a local callback URL is allowed; every other rule blocks.
+        dynamic "rule_action_override" {
+          for_each = length(local.local_callback_urls) > 0 ? [1] : []
+
+          content {
+            name = "EC2MetaDataSSRF_QUERYARGUMENTS"
+
+            action_to_use {
+              count {}
+            }
+          }
+        }
       }
     }
 
@@ -349,15 +372,9 @@ resource "aws_cognito_user_pool_client" "web_client" {
   allowed_oauth_scopes = ["email", "openid", "profile"]
 
   # OAuth-dependent URLs - set after OAuth configuration
-  callback_urls = concat([
-    "http://localhost:4200",
-    "http://localhost:4300"
-  ], var.callback_urls)
+  callback_urls = concat(local.local_callback_urls, var.callback_urls)
 
-  logout_urls = concat([
-    "http://localhost:4200",
-    "http://localhost:4300"
-  ], var.logout_urls)
+  logout_urls = concat(local.local_callback_urls, var.logout_urls)
 
   # Security settings
   prevent_user_existence_errors = "ENABLED"