@aws/nx-plugin 1.0.0-rc.54 → 1.0.0-rc.56

package/src/utils/docker.js.map

@@ -1 +1 @@
-{"version":3,"sources":["../../../../../packages/nx-plugin/src/utils/docker.ts"],"sourcesContent":["/**\n * Copyright Amazon.com, Inc. or its affiliates. All Rights Reserved.\n * SPDX-License-Identifier: Apache-2.0\n */\nimport {\n  joinPathFragments,\n  type ProjectConfiguration,\n  type Tree,\n} from '@nx/devkit';\nimport { FsCommands } from './fs';\nimport { addDependencyToTargetIfNotPresent } from './nx';\nimport { CONTAINER_VERSIONS, TS_VERSIONS } from './versions';\n\nconst TRIVY_IGNORE_FILE = '.trivyignore';\n\nconst TRIVY_IGNORE_CONTENTS = `# Trivy ignore file. Add one vulnerability ID (e.g. CVE-2021-12345) per line to\n# suppress it during the image scan (\\`nx run-many --target trivy\\`).\n# https://trivy.dev/latest/docs/configuration/filtering/#by-finding-ids\n`;\n\n/**\n * Substitution variables for the vended Node `Dockerfile` templates: the npm\n * version to install globally, and the versions its dependency overrides pin.\n */\nexport const nodeImageVersions = () => ({\n  npmVersion: TS_VERSIONS.npm,\n  minimatchVersion: TS_VERSIONS.minimatch,\n});\n\nexport interface DockerScanTargetOptions {\n  /**\n   * Project configuration to add the scan target to (mutated in place).\n   */\n  readonly project: ProjectConfiguration;\n  /**\n   * Container engine command to invoke (\\`docker\\` or \\`finch\\`).\n   */\n  readonly containerEngine: string;\n  /**\n   * Name of the scan target to add, e.g. \\`my-agent-trivy\\`.\n   */\n  readonly trivyTargetName: string;\n  /**\n   * Name of the docker target that builds the image(s) to scan. The scan\n   * target depends on it.\n   */\n  readonly dockerTargetName: string;\n  /**\n   * Tags of the images built by the docker target which should be scanned.\n   */\n  readonly imageTags: string[];\n}\n\n/**\n * Add a cacheable Trivy scan target for the images built by a docker target\n * and wire it under the aggregate \\`trivy\\` target. The scan is not part of\n * \\`build\\` — run \\`nx run-many --target trivy\\` (the root \\`trivy\\` script) in CI.\n *\n * The scan target depends on the docker target and declares the project source\n * as its inputs, so an unchanged image is never re-scanned (a cache hit skips\n * the scan entirely). Each image is saved to a tarball under\n * \\`dist/<projectRoot>/trivy/<scan-key>\\` (kept out of any Docker build context)\n * and scanned with the pinned ECR-hosted Trivy image via a workspace-relative\n * bind mount, so the same commands work under both docker and finch. The scan\n * exits non-zero (exit code 1) on HIGH/CRITICAL vulnerabilities.\n *\n * A \\`.trivyignore\\` is vended at the project root (kept if it already exists)\n * for suppressing findings.\n */\nexport const addDockerScanTarget = (\n  tree: Tree,\n  options: DockerScanTargetOptions,\n): void => {\n  const { project, containerEngine, trivyTargetName, dockerTargetName } =\n    options;\n  const { imageTags } = options;\n  const projectRoot = project.root;\n\n  const ignoreFilePath = joinPathFragments(projectRoot, TRIVY_IGNORE_FILE);\n  if (!tree.exists(ignoreFilePath)) {\n    tree.write(ignoreFilePath, TRIVY_IGNORE_CONTENTS);\n  }\n\n  // Stage scan artifacts in a directory unique to this scan target so that\n  // sibling targets in the same project (e.g. multiple agents) don't clobber\n  // each other's tarballs when run in parallel. The first image tag is unique\n  // per target, so it makes a stable, collision-free key.\n  const scanKey = imageTags[0].replace(/[^a-zA-Z0-9-]/g, '-');\n  const scanDir = joinPathFragments('dist', projectRoot, 'trivy', scanKey);\n  const trivyImage = `public.ecr.aws/aquasecurity/trivy:${CONTAINER_VERSIONS.trivy}`;\n\n  const fs = new FsCommands(tree);\n  const commands = [\n    fs.rm(scanDir),\n    fs.mkdir(scanDir),\n    fs.cp(ignoreFilePath, joinPathFragments(scanDir, TRIVY_IGNORE_FILE)),\n  ];\n\n  imageTags.forEach((imageTag, index) => {\n    const tarName = `image-${index}.tar`;\n    commands.push(\n      `${containerEngine} save -o ${joinPathFragments(scanDir, tarName)} ${imageTag}`,\n      `${containerEngine} run --rm -v \"./${scanDir}\":/scan ${trivyImage} image --input /scan/${tarName} --ignorefile /scan/${TRIVY_IGNORE_FILE} --scanners vuln --severity HIGH,CRITICAL --ignore-unfixed --exit-code 1 --no-progress -q`,\n    );\n  });\n\n  project.targets ??= {};\n  project.targets[trivyTargetName] = {\n    cache: true,\n    // The scanned image is fully determined by the project source, so caching\n    // on the source ensures an unchanged image is never re-scanned.\n    inputs: ['default', '^production'],\n    outputs: [`{workspaceRoot}/${scanDir}`],\n    executor: 'nx:run-commands',\n    options: {\n      commands,\n      parallel: false,\n    },\n    dependsOn: [dockerTargetName],\n  };\n\n  // Aggregate per-component scan targets under a single `trivy` target. The\n  // scan is intentionally NOT wired into `build`: image scanning is slow and\n  // its result depends on the ever-changing vulnerability database (a scan\n  // that passes today can fail tomorrow when a new CVE is published), so\n  // coupling it to `build` would make local and CI builds non-deterministic.\n  // Run `nx run-many --target trivy` (the root `trivy` script) in CI instead.\n  if (trivyTargetName !== 'trivy') {\n    addDependencyToTargetIfNotPresent(project, 'trivy', trivyTargetName);\n  }\n};\n"],"names":["joinPathFragments","FsCommands","addDependencyToTargetIfNotPresent","CONTAINER_VERSIONS","TS_VERSIONS","TRIVY_IGNORE_FILE","TRIVY_IGNORE_CONTENTS","nodeImageVersions","npmVersion","npm","minimatchVersion","minimatch","addDockerScanTarget","tree","options","project","containerEngine","trivyTargetName","dockerTargetName","imageTags","projectRoot","root","ignoreFilePath","exists","write","scanKey","replace","scanDir","trivyImage","trivy","fs","commands","rm","mkdir","cp","forEach","imageTag","index","tarName","push","targets","cache","inputs","outputs","executor","parallel","dependsOn"],"mappings":"AAAA;;;CAGC,GACD,SACEA,iBAAiB,QAGZ,aAAa;AACpB,SAASC,UAAU,QAAQ,UAAO;AAClC,SAASC,iCAAiC,QAAQ,UAAO;AACzD,SAASC,kBAAkB,EAAEC,WAAW,QAAQ,gBAAa;AAE7D,MAAMC,oBAAoB;AAE1B,MAAMC,wBAAwB,CAAC;;;AAG/B,CAAC;AAED;;;CAGC,GACD,OAAO,MAAMC,oBAAoB,IAAO,CAAA;QACtCC,YAAYJ,YAAYK,GAAG;QAC3BC,kBAAkBN,YAAYO,SAAS;IACzC,CAAA,EAAG;AA0BH;;;;;;;;;;;;;;;CAeC,GACD,OAAO,MAAMC,sBAAsB,CACjCC,MACAC;IAEA,MAAM,EAAEC,OAAO,EAAEC,eAAe,EAAEC,eAAe,EAAEC,gBAAgB,EAAE,GACnEJ;IACF,MAAM,EAAEK,SAAS,EAAE,GAAGL;IACtB,MAAMM,cAAcL,QAAQM,IAAI;IAEhC,MAAMC,iBAAiBtB,kBAAkBoB,aAAaf;IACtD,IAAI,CAACQ,KAAKU,MAAM,CAACD,iBAAiB;QAChCT,KAAKW,KAAK,CAACF,gBAAgBhB;IAC7B;IAEA,yEAAyE;IACzE,2EAA2E;IAC3E,4EAA4E;IAC5E,wDAAwD;IACxD,MAAMmB,UAAUN,SAAS,CAAC,EAAE,CAACO,OAAO,CAAC,kBAAkB;IACvD,MAAMC,UAAU3B,kBAAkB,QAAQoB,aAAa,SAASK;IAChE,MAAMG,aAAa,CAAC,kCAAkC,EAAEzB,mBAAmB0B,KAAK,EAAE;IAElF,MAAMC,KAAK,IAAI7B,WAAWY;IAC1B,MAAMkB,WAAW;QACfD,GAAGE,EAAE,CAACL;QACNG,GAAGG,KAAK,CAACN;QACTG,GAAGI,EAAE,CAACZ,gBAAgBtB,kBAAkB2B,SAAStB;KAClD;IAEDc,UAAUgB,OAAO,CAAC,CAACC,UAAUC;QAC3B,MAAMC,UAAU,CAAC,MAAM,EAAED,MAAM,IAAI,CAAC;QACpCN,SAASQ,IAAI,CACX,GAAGvB,gBAAgB,SAAS,EAAEhB,kBAAkB2B,SAASW,SAAS,CAAC,EAAEF,UAAU,EAC/E,GAAGpB,gBAAgB,gBAAgB,EAAEW,QAAQ,QAAQ,EAAEC,WAAW,qBAAqB,EAAEU,QAAQ,oBAAoB,EAAEjC,kBAAkB,yFAAyF,CAAC;IAEvO;IAEAU,QAAQyB,OAAO,KAAK,CAAC;IACrBzB,QAAQyB,OAAO,CAACvB,gBAAgB,GAAG;QACjCwB,OAAO;QACP,0EAA0E;QAC1E,gEAAgE;QAChEC,QAAQ;YAAC;YAAW;SAAc;QAClCC,SAAS;YAAC,CAAC,gBAAgB,EAAEhB,SAAS;SAAC;QACvCiB,UAAU;QACV9B,SAAS;YACPiB;YACAc,UAAU;QACZ;QACAC,WAAW;YAAC5B;SAAiB;IAC/B;IAEA,0EAA0E;IAC1E,2EAA2E;IAC3E,yEAAyE;IACzE,uEAAuE;IACvE,2EAA2E;IAC3E,4EAA4E;IAC5E,IAAID,oBAAoB,SAAS;QAC/Bf,kCAAkCa,SAAS,SAASE;IACtD;AACF,EAAE"}
+{"version":3,"sources":["../../../../../packages/nx-plugin/src/utils/docker.ts"],"sourcesContent":["/**\n * Copyright Amazon.com, Inc. or its affiliates. All Rights Reserved.\n * SPDX-License-Identifier: Apache-2.0\n */\nimport {\n  joinPathFragments,\n  type ProjectConfiguration,\n  type Tree,\n} from '@nx/devkit';\nimport {\n  type DependencyDeclaration,\n  forDependencies,\n  type MustDeclare,\n} from './declared-dependencies';\nimport { FS_DEPENDENCIES, FsCommands } from './fs';\nimport { addDependencyToTargetIfNotPresent } from './nx';\nimport { CONTAINER_VERSIONS, TS_VERSIONS } from './versions';\n\n/** Dependencies a caller must declare to add a Docker scan target. */\nexport const DOCKER_DEPENDENCIES = [...FS_DEPENDENCIES] as const;\n\nconst TRIVY_IGNORE_FILE = '.trivyignore';\n\nconst TRIVY_IGNORE_CONTENTS = `# Trivy ignore file. Add one vulnerability ID (e.g. CVE-2021-12345) per line to\n# suppress it during the image scan (\\`nx run-many --target trivy\\`).\n# https://trivy.dev/latest/docs/configuration/filtering/#by-finding-ids\n`;\n\n/**\n * Substitution variables for the vended Node `Dockerfile` templates: the npm\n * version to install globally, and the versions its dependency overrides pin.\n */\nexport const nodeImageVersions = () => ({\n  npmVersion: TS_VERSIONS.npm,\n  minimatchVersion: TS_VERSIONS.minimatch,\n});\n\nexport interface DockerScanTargetOptions {\n  /**\n   * Project configuration to add the scan target to (mutated in place).\n   */\n  readonly project: ProjectConfiguration;\n  /**\n   * Container engine command to invoke (\\`docker\\` or \\`finch\\`).\n   */\n  readonly containerEngine: string;\n  /**\n   * Name of the scan target to add, e.g. \\`my-agent-trivy\\`.\n   */\n  readonly trivyTargetName: string;\n  /**\n   * Name of the docker target that builds the image(s) to scan. The scan\n   * target depends on it.\n   */\n  readonly dockerTargetName: string;\n  /**\n   * Tags of the images built by the docker target which should be scanned.\n   */\n  readonly imageTags: string[];\n}\n\n/**\n * Add a cacheable Trivy scan target for the images built by a docker target\n * and wire it under the aggregate \\`trivy\\` target. The scan is not part of\n * \\`build\\` — run \\`nx run-many --target trivy\\` (the root \\`trivy\\` script) in CI.\n *\n * The scan target depends on the docker target and declares the project source\n * as its inputs, so an unchanged image is never re-scanned (a cache hit skips\n * the scan entirely). Each image is saved to a tarball under\n * \\`dist/<projectRoot>/trivy/<scan-key>\\` (kept out of any Docker build context)\n * and scanned with the pinned ECR-hosted Trivy image via a workspace-relative\n * bind mount, so the same commands work under both docker and finch. The scan\n * exits non-zero (exit code 1) on HIGH/CRITICAL vulnerabilities.\n *\n * A \\`.trivyignore\\` is vended at the project root (kept if it already exists)\n * for suppressing findings.\n */\nexport const addDockerScanTarget = <const D extends DependencyDeclaration>(\n  tree: Tree,\n  options: DockerScanTargetOptions,\n  declaration: D & MustDeclare<typeof DOCKER_DEPENDENCIES, D>,\n): void => {\n  const { project, containerEngine, trivyTargetName, dockerTargetName } =\n    options;\n  const { imageTags } = options;\n  const projectRoot = project.root;\n\n  const ignoreFilePath = joinPathFragments(projectRoot, TRIVY_IGNORE_FILE);\n  if (!tree.exists(ignoreFilePath)) {\n    tree.write(ignoreFilePath, TRIVY_IGNORE_CONTENTS);\n  }\n\n  // Stage scan artifacts in a directory unique to this scan target so that\n  // sibling targets in the same project (e.g. multiple agents) don't clobber\n  // each other's tarballs when run in parallel. The first image tag is unique\n  // per target, so it makes a stable, collision-free key.\n  const scanKey = imageTags[0].replace(/[^a-zA-Z0-9-]/g, '-');\n  const scanDir = joinPathFragments('dist', projectRoot, 'trivy', scanKey);\n  const trivyImage = `public.ecr.aws/aquasecurity/trivy:${CONTAINER_VERSIONS.trivy}`;\n\n  const fs = new FsCommands(\n    tree,\n    forDependencies<typeof DOCKER_DEPENDENCIES>(declaration),\n  );\n  const commands = [\n    fs.rm(scanDir),\n    fs.mkdir(scanDir),\n    fs.cp(ignoreFilePath, joinPathFragments(scanDir, TRIVY_IGNORE_FILE)),\n  ];\n\n  imageTags.forEach((imageTag, index) => {\n    const tarName = `image-${index}.tar`;\n    commands.push(\n      `${containerEngine} save -o ${joinPathFragments(scanDir, tarName)} ${imageTag}`,\n      `${containerEngine} run --rm -v \"./${scanDir}\":/scan ${trivyImage} image --input /scan/${tarName} --ignorefile /scan/${TRIVY_IGNORE_FILE} --scanners vuln --severity HIGH,CRITICAL --ignore-unfixed --exit-code 1 --no-progress -q`,\n    );\n  });\n\n  project.targets ??= {};\n  project.targets[trivyTargetName] = {\n    cache: true,\n    // The scanned image is fully determined by the project source, so caching\n    // on the source ensures an unchanged image is never re-scanned.\n    inputs: ['default', '^production'],\n    outputs: [`{workspaceRoot}/${scanDir}`],\n    executor: 'nx:run-commands',\n    options: {\n      commands,\n      parallel: false,\n    },\n    dependsOn: [dockerTargetName],\n  };\n\n  // Aggregate per-component scan targets under a single `trivy` target. The\n  // scan is intentionally NOT wired into `build`: image scanning is slow and\n  // its result depends on the ever-changing vulnerability database (a scan\n  // that passes today can fail tomorrow when a new CVE is published), so\n  // coupling it to `build` would make local and CI builds non-deterministic.\n  // Run `nx run-many --target trivy` (the root `trivy` script) in CI instead.\n  if (trivyTargetName !== 'trivy') {\n    addDependencyToTargetIfNotPresent(project, 'trivy', trivyTargetName);\n  }\n};\n"],"names":["joinPathFragments","forDependencies","FS_DEPENDENCIES","FsCommands","addDependencyToTargetIfNotPresent","CONTAINER_VERSIONS","TS_VERSIONS","DOCKER_DEPENDENCIES","TRIVY_IGNORE_FILE","TRIVY_IGNORE_CONTENTS","nodeImageVersions","npmVersion","npm","minimatchVersion","minimatch","addDockerScanTarget","tree","options","declaration","project","containerEngine","trivyTargetName","dockerTargetName","imageTags","projectRoot","root","ignoreFilePath","exists","write","scanKey","replace","scanDir","trivyImage","trivy","fs","commands","rm","mkdir","cp","forEach","imageTag","index","tarName","push","targets","cache","inputs","outputs","executor","parallel","dependsOn"],"mappings":"AAAA;;;CAGC,GACD,SACEA,iBAAiB,QAGZ,aAAa;AACpB,SAEEC,eAAe,QAEV,6BAA0B;AACjC,SAASC,eAAe,EAAEC,UAAU,QAAQ,UAAO;AACnD,SAASC,iCAAiC,QAAQ,UAAO;AACzD,SAASC,kBAAkB,EAAEC,WAAW,QAAQ,gBAAa;AAE7D,oEAAoE,GACpE,OAAO,MAAMC,sBAAsB;OAAIL;CAAgB,CAAU;AAEjE,MAAMM,oBAAoB;AAE1B,MAAMC,wBAAwB,CAAC;;;AAG/B,CAAC;AAED;;;CAGC,GACD,OAAO,MAAMC,oBAAoB,IAAO,CAAA;QACtCC,YAAYL,YAAYM,GAAG;QAC3BC,kBAAkBP,YAAYQ,SAAS;IACzC,CAAA,EAAG;AA0BH;;;;;;;;;;;;;;;CAeC,GACD,OAAO,MAAMC,sBAAsB,CACjCC,MACAC,SACAC;IAEA,MAAM,EAAEC,OAAO,EAAEC,eAAe,EAAEC,eAAe,EAAEC,gBAAgB,EAAE,GACnEL;IACF,MAAM,EAAEM,SAAS,EAAE,GAAGN;IACtB,MAAMO,cAAcL,QAAQM,IAAI;IAEhC,MAAMC,iBAAiB1B,kBAAkBwB,aAAahB;IACtD,IAAI,CAACQ,KAAKW,MAAM,CAACD,iBAAiB;QAChCV,KAAKY,KAAK,CAACF,gBAAgBjB;IAC7B;IAEA,yEAAyE;IACzE,2EAA2E;IAC3E,4EAA4E;IAC5E,wDAAwD;IACxD,MAAMoB,UAAUN,SAAS,CAAC,EAAE,CAACO,OAAO,CAAC,kBAAkB;IACvD,MAAMC,UAAU/B,kBAAkB,QAAQwB,aAAa,SAASK;IAChE,MAAMG,aAAa,CAAC,kCAAkC,EAAE3B,mBAAmB4B,KAAK,EAAE;IAElF,MAAMC,KAAK,IAAI/B,WACba,MACAf,gBAA4CiB;IAE9C,MAAMiB,WAAW;QACfD,GAAGE,EAAE,CAACL;QACNG,GAAGG,KAAK,CAACN;QACTG,GAAGI,EAAE,CAACZ,gBAAgB1B,kBAAkB+B,SAASvB;KAClD;IAEDe,UAAUgB,OAAO,CAAC,CAACC,UAAUC;QAC3B,MAAMC,UAAU,CAAC,MAAM,EAAED,MAAM,IAAI,CAAC;QACpCN,SAASQ,IAAI,CACX,GAAGvB,gBAAgB,SAAS,EAAEpB,kBAAkB+B,SAASW,SAAS,CAAC,EAAEF,UAAU,EAC/E,GAAGpB,gBAAgB,gBAAgB,EAAEW,QAAQ,QAAQ,EAAEC,WAAW,qBAAqB,EAAEU,QAAQ,oBAAoB,EAAElC,kBAAkB,yFAAyF,CAAC;IAEvO;IAEAW,QAAQyB,OAAO,KAAK,CAAC;IACrBzB,QAAQyB,OAAO,CAACvB,gBAAgB,GAAG;QACjCwB,OAAO;QACP,0EAA0E;QAC1E,gEAAgE;QAChEC,QAAQ;YAAC;YAAW;SAAc;QAClCC,SAAS;YAAC,CAAC,gBAAgB,EAAEhB,SAAS;SAAC;QACvCiB,UAAU;QACV/B,SAAS;YACPkB;YACAc,UAAU;QACZ;QACAC,WAAW;YAAC5B;SAAiB;IAC/B;IAEA,0EAA0E;IAC1E,2EAA2E;IAC3E,yEAAyE;IACzE,uEAAuE;IACvE,2EAA2E;IAC3E,4EAA4E;IAC5E,IAAID,oBAAoB,SAAS;QAC/BjB,kCAAkCe,SAAS,SAASE;IACtD;AACF,EAAE"}

package/src/utils/files/common/scripts/src/dynamodb/start-container.ts.template

@@ -64,7 +64,6 @@ for (;;) {
     '-sharedDb',
     '-dbPath', './data',
     '-port', `${port}`,
-    '-optimizeDbBeforeStartup',
   ];
   const create = spawnSync(containerEngine, runArgs, { stdio: 'pipe' });
   if (create.status === 0) {

package/src/utils/fs.d.ts

@@ -3,14 +3,25 @@
  * SPDX-License-Identifier: Apache-2.0
  */
 import type { Tree } from '@nx/devkit';
+import { type DependencyDeclaration, type MustDeclare } from './declared-dependencies';
+/** Dependencies a caller must declare to use `FsCommands`. */
+export declare const FS_DEPENDENCIES: readonly [{
+    readonly name: "ncp";
+}, {
+    readonly name: "rimraf";
+}, {
+    readonly name: "make-dir-cli";
+}];
 /**
- * Utility class for creating platform agnostic commands for filesystem operations.
- * Adds the required dependencies to the root package json
+ * Platform agnostic commands for filesystem operations, adding the CLIs they
+ * need to the root package.json.
  */
-export declare class FsCommands {
+export declare class FsCommands<D extends DependencyDeclaration> {
     private tree;
-    constructor(tree: Tree);
+    private declaration;
+    constructor(tree: Tree, declaration: D & MustDeclare<typeof FS_DEPENDENCIES, D>);
     cp(src: string, dst: string): string;
     rm(dir: string): string;
     mkdir(dir: string): string;
+    private add;
 }

package/src/utils/fs.js

@@ -1,34 +1,47 @@
 /**
  * Copyright Amazon.com, Inc. or its affiliates. All Rights Reserved.
  * SPDX-License-Identifier: Apache-2.0
- */ import { addDependenciesToPackageJson } from "./dependencies.js";
+ */ import { forDependencies } from "./declared-dependencies.js";
+import { addDependenciesToPackageJson } from "./dependencies.js";
 import { withVersions } from "./versions.js";
+/** Dependencies a caller must declare to use `FsCommands`. */ export const FS_DEPENDENCIES = [
+    {
+        name: 'ncp'
+    },
+    {
+        name: 'rimraf'
+    },
+    {
+        name: 'make-dir-cli'
+    }
+];
 /**
- * Utility class for creating platform agnostic commands for filesystem operations.
- * Adds the required dependencies to the root package json
+ * Platform agnostic commands for filesystem operations, adding the CLIs they
+ * need to the root package.json.
  */ export class FsCommands {
     tree;
-    constructor(tree){
+    declaration;
+    constructor(tree, declaration){
         this.tree = tree;
+        this.declaration = declaration;
     }
     cp(src, dst) {
-        addDependenciesToPackageJson(this.tree, {}, withVersions([
-            'ncp'
-        ]));
+        this.add('ncp');
         return `ncp ${src} ${dst}`;
     }
     rm(dir) {
-        addDependenciesToPackageJson(this.tree, {}, withVersions([
-            'rimraf'
-        ]));
+        this.add('rimraf');
         return `rimraf ${dir}`;
     }
     mkdir(dir) {
-        addDependenciesToPackageJson(this.tree, {}, withVersions([
-            'make-dir-cli'
-        ]));
+        this.add('make-dir-cli');
         return `make-dir ${dir}`;
     }
+    add(dep) {
+        addDependenciesToPackageJson(this.tree, {}, withVersions(forDependencies(this.declaration), [
+            dep
+        ]));
+    }
 }
 
 //# sourceMappingURL=fs.js.map

package/src/utils/fs.js.map

@@ -1 +1 @@
-{"version":3,"sources":["../../../../../packages/nx-plugin/src/utils/fs.ts"],"sourcesContent":["/**\n * Copyright Amazon.com, Inc. or its affiliates. All Rights Reserved.\n * SPDX-License-Identifier: Apache-2.0\n */\nimport type { Tree } from '@nx/devkit';\nimport { addDependenciesToPackageJson } from './dependencies';\nimport { withVersions } from './versions';\n\n/**\n * Utility class for creating platform agnostic commands for filesystem operations.\n * Adds the required dependencies to the root package json\n */\nexport class FsCommands {\n  private tree: Tree;\n\n  constructor(tree: Tree) {\n    this.tree = tree;\n  }\n\n  public cp(src: string, dst: string) {\n    addDependenciesToPackageJson(this.tree, {}, withVersions(['ncp']));\n    return `ncp ${src} ${dst}`;\n  }\n\n  public rm(dir: string) {\n    addDependenciesToPackageJson(this.tree, {}, withVersions(['rimraf']));\n    return `rimraf ${dir}`;\n  }\n\n  public mkdir(dir: string) {\n    addDependenciesToPackageJson(this.tree, {}, withVersions(['make-dir-cli']));\n    return `make-dir ${dir}`;\n  }\n}\n"],"names":["addDependenciesToPackageJson","withVersions","FsCommands","tree","cp","src","dst","rm","dir","mkdir"],"mappings":"AAAA;;;CAGC,GAED,SAASA,4BAA4B,QAAQ,oBAAiB;AAC9D,SAASC,YAAY,QAAQ,gBAAa;AAE1C;;;CAGC,GACD,OAAO,MAAMC;IACHC,KAAW;IAEnB,YAAYA,IAAU,CAAE;QACtB,IAAI,CAACA,IAAI,GAAGA;IACd;IAEOC,GAAGC,GAAW,EAAEC,GAAW,EAAE;QAClCN,6BAA6B,IAAI,CAACG,IAAI,EAAE,CAAC,GAAGF,aAAa;YAAC;SAAM;QAChE,OAAO,CAAC,IAAI,EAAEI,IAAI,CAAC,EAAEC,KAAK;IAC5B;IAEOC,GAAGC,GAAW,EAAE;QACrBR,6BAA6B,IAAI,CAACG,IAAI,EAAE,CAAC,GAAGF,aAAa;YAAC;SAAS;QACnE,OAAO,CAAC,OAAO,EAAEO,KAAK;IACxB;IAEOC,MAAMD,GAAW,EAAE;QACxBR,6BAA6B,IAAI,CAACG,IAAI,EAAE,CAAC,GAAGF,aAAa;YAAC;SAAe;QACzE,OAAO,CAAC,SAAS,EAAEO,KAAK;IAC1B;AACF"}
+{"version":3,"sources":["../../../../../packages/nx-plugin/src/utils/fs.ts"],"sourcesContent":["/**\n * Copyright Amazon.com, Inc. or its affiliates. All Rights Reserved.\n * SPDX-License-Identifier: Apache-2.0\n */\nimport type { Tree } from '@nx/devkit';\nimport {\n  type DependencyDeclaration,\n  forDependencies,\n  type MustDeclare,\n} from './declared-dependencies';\nimport { addDependenciesToPackageJson } from './dependencies';\nimport { type ITsDepVersion, withVersions } from './versions';\n\n/** Dependencies a caller must declare to use `FsCommands`. */\nexport const FS_DEPENDENCIES = [\n  { name: 'ncp' },\n  { name: 'rimraf' },\n  { name: 'make-dir-cli' },\n] as const satisfies readonly { name: ITsDepVersion }[];\n\n/**\n * Platform agnostic commands for filesystem operations, adding the CLIs they\n * need to the root package.json.\n */\nexport class FsCommands<D extends DependencyDeclaration> {\n  private tree: Tree;\n  private declaration: D;\n\n  constructor(\n    tree: Tree,\n    declaration: D & MustDeclare<typeof FS_DEPENDENCIES, D>,\n  ) {\n    this.tree = tree;\n    this.declaration = declaration;\n  }\n\n  public cp(src: string, dst: string) {\n    this.add('ncp');\n    return `ncp ${src} ${dst}`;\n  }\n\n  public rm(dir: string) {\n    this.add('rimraf');\n    return `rimraf ${dir}`;\n  }\n\n  public mkdir(dir: string) {\n    this.add('make-dir-cli');\n    return `make-dir ${dir}`;\n  }\n\n  private add(dep: (typeof FS_DEPENDENCIES)[number]['name']) {\n    addDependenciesToPackageJson(\n      this.tree,\n      {},\n      withVersions(forDependencies<typeof FS_DEPENDENCIES>(this.declaration), [\n        dep,\n      ]),\n    );\n  }\n}\n"],"names":["forDependencies","addDependenciesToPackageJson","withVersions","FS_DEPENDENCIES","name","FsCommands","tree","declaration","cp","src","dst","add","rm","dir","mkdir","dep"],"mappings":"AAAA;;;CAGC,GAED,SAEEA,eAAe,QAEV,6BAA0B;AACjC,SAASC,4BAA4B,QAAQ,oBAAiB;AAC9D,SAA6BC,YAAY,QAAQ,gBAAa;AAE9D,4DAA4D,GAC5D,OAAO,MAAMC,kBAAkB;IAC7B;QAAEC,MAAM;IAAM;IACd;QAAEA,MAAM;IAAS;IACjB;QAAEA,MAAM;IAAe;CACxB,CAAuD;AAExD;;;CAGC,GACD,OAAO,MAAMC;IACHC,KAAW;IACXC,YAAe;IAEvB,YACED,IAAU,EACVC,WAAuD,CACvD;QACA,IAAI,CAACD,IAAI,GAAGA;QACZ,IAAI,CAACC,WAAW,GAAGA;IACrB;IAEOC,GAAGC,GAAW,EAAEC,GAAW,EAAE;QAClC,IAAI,CAACC,GAAG,CAAC;QACT,OAAO,CAAC,IAAI,EAAEF,IAAI,CAAC,EAAEC,KAAK;IAC5B;IAEOE,GAAGC,GAAW,EAAE;QACrB,IAAI,CAACF,GAAG,CAAC;QACT,OAAO,CAAC,OAAO,EAAEE,KAAK;IACxB;IAEOC,MAAMD,GAAW,EAAE;QACxB,IAAI,CAACF,GAAG,CAAC;QACT,OAAO,CAAC,SAAS,EAAEE,KAAK;IAC1B;IAEQF,IAAII,GAA6C,EAAE;QACzDd,6BACE,IAAI,CAACK,IAAI,EACT,CAAC,GACDJ,aAAaF,gBAAwC,IAAI,CAACO,WAAW,GAAG;YACtEQ;SACD;IAEL;AACF"}

package/src/utils/init.d.ts

@@ -4,7 +4,20 @@
  */
 import { OverwriteStrategy, type Tree } from '@nx/devkit';
 import { type Containers } from './containers';
+import { type DependencyDeclaration, type MustDeclare } from './declared-dependencies';
 import type { Iac } from './iac';
+/** Dependencies a caller must declare to apply the workspace init. */
+export declare const INIT_DEPENDENCIES: readonly [{
+    readonly name: "nx";
+}, {
+    readonly name: "@nx/js";
+}, {
+    readonly name: "@nx/workspace";
+}, {
+    readonly name: "typescript";
+}, {
+    readonly name: "@biomejs/biome";
+}];
 export declare const PNPM_BUILT_DEPENDENCIES: string[];
 /**
  * Options controlling how the workspace is initialised. These mirror the
@@ -56,4 +69,4 @@ export interface ApplyWorkspaceInitOptions {
  * existing projects — those are decisions for the user (see the "add to an
  * existing workspace" guide).
  */
-export declare const applyWorkspaceInit: (tree: Tree, { iac, containers, mcp, readmeOverwriteStrategy, overwriteScripts, catalogs, }: ApplyWorkspaceInitOptions) => Promise<void>;
+export declare const applyWorkspaceInit: <const D extends DependencyDeclaration>(tree: Tree, { iac, containers, mcp, readmeOverwriteStrategy, overwriteScripts, catalogs, }: ApplyWorkspaceInitOptions, declaration: D & MustDeclare<typeof INIT_DEPENDENCIES, D>) => Promise<void>;

package/src/utils/init.js

@@ -4,7 +4,6 @@
  */ import { generateFiles, joinPathFragments, OverwriteStrategy, readNxJson, updateJson, updateNxJson } from "@nx/devkit";
 import { initGenerator } from "@nx/js";
 import yaml from "js-yaml";
-import { readModulePackageJson } from "nx/src/utils/package-json";
 import GeneratorsJson from "../../generators.json" with {
     type: 'json'
 };
@@ -12,6 +11,7 @@ import { SYNC_GENERATOR_NAME as TS_SYNC_GENERATOR_NAME } from "../ts/sync/genera
 import { BASE_TSCONFIG_COMPILER_OPTIONS } from "./base-tsconfig.js";
 import { ensureAwsNxPluginConfig, updateAwsNxPluginConfig } from "./config/utils.js";
 import { inferContainers } from "./containers.js";
+import { forDependencies } from "./declared-dependencies.js";
 import { addDependenciesToPackageJson, detectWorkspacePackageManager } from "./dependencies.js";
 import { getDefaultBiomeConfig } from "./format.js";
 import { configureMcpServers } from "./mcp.js";
@@ -24,6 +24,23 @@ const WORKSPACES = [
     'packages/*'
 ];
 const NX_TYPESCRIPT_SYNC_GENERATOR = '@nx/js:typescript-sync';
+/** Dependencies a caller must declare to apply the workspace init. */ export const INIT_DEPENDENCIES = [
+    {
+        name: 'nx'
+    },
+    {
+        name: '@nx/js'
+    },
+    {
+        name: '@nx/workspace'
+    },
+    {
+        name: 'typescript'
+    },
+    {
+        name: '@biomejs/biome'
+    }
+];
 // Built dependencies whose install scripts the generated workspace trusts.
 // `onlyBuiltDependencies` is the pnpm 10 key (silently ignored by pnpm 11);
 // pnpm 11 reads `allowBuilds` instead. Any dep NOT in this allowlist will
@@ -157,7 +174,7 @@ export const PNPM_BUILT_DEPENDENCIES = [
  * compiler options, migrate a workspace's package manager, or restructure
  * existing projects — those are decisions for the user (see the "add to an
  * existing workspace" guide).
- */ export const applyWorkspaceInit = async (tree, { iac, containers, mcp, readmeOverwriteStrategy = OverwriteStrategy.KeepExisting, overwriteScripts = false, catalogs = true })=>{
+ */ export const applyWorkspaceInit = async (tree, { iac, containers, mcp, readmeOverwriteStrategy = OverwriteStrategy.KeepExisting, overwriteScripts = false, catalogs = true }, declaration)=>{
     const resolvedContainers = !containers || containers === 'infer' ? inferContainers() : containers;
     // The catalogs flag is written explicitly (even when true) so the workspace
     // records its dependency-management choice.
@@ -238,12 +255,13 @@ export const PNPM_BUILT_DEPENDENCIES = [
     // `@nx/js` must be a root dependency for the `@nx/js:typescript-sync`
     // generator registered in nx.json to resolve (npm doesn't hoist the
     // plugin's own copy reliably).
-    const nxVersion = readModulePackageJson('@nx/js').packageJson.version;
     addDependenciesToPackageJson(tree, {}, {
-        nx: nxVersion,
-        '@nx/js': nxVersion,
-        '@nx/workspace': nxVersion,
-        ...withVersions([
+        ...withVersions(forDependencies(declaration), [
+            'nx',
+            '@nx/js',
+            '@nx/workspace'
+        ]),
+        ...withVersions(forDependencies(declaration), [
             'typescript',
             '@biomejs/biome'
         ]),

package/src/utils/init.js.map

@@ -1 +1 @@
-{"version":3,"sources":["../../../../../packages/nx-plugin/src/utils/init.ts"],"sourcesContent":["/**\n * Copyright Amazon.com, Inc. or its affiliates. All Rights Reserved.\n * SPDX-License-Identifier: Apache-2.0\n */\nimport {\n  generateFiles,\n  joinPathFragments,\n  OverwriteStrategy,\n  readNxJson,\n  type Tree,\n  updateJson,\n  updateNxJson,\n} from '@nx/devkit';\nimport { initGenerator } from '@nx/js';\nimport { readFileSync } from 'fs';\nimport yaml from 'js-yaml';\nimport { readModulePackageJson } from 'nx/src/utils/package-json';\nimport GeneratorsJson from '../../generators.json' with { type: 'json' };\nimport { SYNC_GENERATOR_NAME as TS_SYNC_GENERATOR_NAME } from '../ts/sync/generator';\nimport { BASE_TSCONFIG_COMPILER_OPTIONS } from './base-tsconfig';\nimport {\n  ensureAwsNxPluginConfig,\n  updateAwsNxPluginConfig,\n} from './config/utils';\nimport { type Containers, inferContainers } from './containers';\nimport {\n  addDependenciesToPackageJson,\n  detectWorkspacePackageManager,\n} from './dependencies';\nimport { getDefaultBiomeConfig } from './format';\nimport type { Iac } from './iac';\nimport { configureMcpServers } from './mcp';\nimport { getNpmScope } from './npm-scope';\nimport {\n  mergeTargetDefault,\n  nxPluginMcpDependency,\n  nxPluginSelfDependency,\n} from './nx';\nimport { getPackageManagerDisplayCommands } from './pkg-manager';\nimport { workspaceGlobs } from './project-package-json';\nimport { withVersions } from './versions';\n\nconst WORKSPACES = ['packages/*'];\nconst NX_TYPESCRIPT_SYNC_GENERATOR = '@nx/js:typescript-sync';\n\n// Built dependencies whose install scripts the generated workspace trusts.\n// `onlyBuiltDependencies` is the pnpm 10 key (silently ignored by pnpm 11);\n// pnpm 11 reads `allowBuilds` instead. Any dep NOT in this allowlist will\n// have its install scripts skipped with a warning — matching pnpm 10's\n// default behaviour. The user can opt-in later via `pnpm approve-builds`.\nexport const PNPM_BUILT_DEPENDENCIES = ['@swc/core', 'esbuild', 'nx', 'sharp'];\n\n/**\n * Options controlling how the workspace is initialised. These mirror the\n * preset schema so a workspace created via the preset and one initialised via\n * the `init` generator end up in the same shape.\n */\nexport interface ApplyWorkspaceInitOptions {\n  /** The IaC provider to record in the plugin config. */\n  readonly iac: Iac;\n  /**\n   * The container engine to record. `undefined`/`'infer'` picks docker when\n   * installed, else finch.\n   */\n  readonly containers?: Containers | 'infer';\n  /** Whether to configure MCP servers for coding agents. Defaults to true. */\n  readonly mcp?: boolean;\n  /**\n   * How to treat the generated workspace README. The preset owns the README of\n   * a greenfield workspace (`Overwrite`); the `init` generator must not clobber\n   * an existing workspace's README (`KeepExisting`, the default).\n   */\n  readonly readmeOverwriteStrategy?: OverwriteStrategy;\n  /**\n   * Whether to overwrite root package.json scripts that already exist. The\n   * preset owns a greenfield workspace's scripts (`true`); the `init`\n   * generator must not clobber an existing workspace's scripts (`false`,\n   * the default) — it only adds the convenience scripts that are absent.\n   */\n  readonly overwriteScripts?: boolean;\n  /**\n   * Whether generators use the package manager's dependency catalog. On pnpm\n   * this also sets `catalogMode: strict` so `pnpm add` records new deps in the\n   * catalog. Defaults to true.\n   */\n  readonly catalogs?: boolean;\n}\n\n/**\n * Add or repair the pnpm `allowBuilds` / `onlyBuiltDependencies` allowlist for\n * the workspace's `packages` globs, without clobbering any packages the user\n * has already declared.\n *\n * A workspace not created by the preset commonly has either no\n * `pnpm-workspace.yaml`, one missing the `packages` globs, or one carrying the\n * broken `set this to true or false` placeholder pnpm writes when it skips a\n * build script. This makes the file self-consistent so the first generator's\n * install doesn't fail with `ERR_PNPM_IGNORED_BUILDS`.\n */\nconst setUpPnpmWorkspace = (tree: Tree, catalogs: boolean) => {\n  const existing = tree.exists('pnpm-workspace.yaml')\n    ? ((yaml.load(tree.read('pnpm-workspace.yaml', 'utf-8') ?? '') as Record<\n        string,\n        unknown\n      >) ?? {})\n    : {};\n\n  // Preserve any packages globs the user already has, ensuring ours are present.\n  const packages = Array.from(\n    new Set([...((existing.packages as string[]) ?? []), ...WORKSPACES]),\n  );\n\n  const allowBuilds = {\n    ...(typeof existing.allowBuilds === 'object' && existing.allowBuilds\n      ? (existing.allowBuilds as Record<string, unknown>)\n      : {}),\n    // Overwrite any non-boolean (e.g. the \"set this to true or false\"\n    // placeholder) with an explicit true for the deps we trust.\n    ...Object.fromEntries(PNPM_BUILT_DEPENDENCIES.map((dep) => [dep, true])),\n  };\n\n  // `strict` makes `pnpm add` record new deps in the catalog; it only gates\n  // that flow, so pre-declared direct ranges (e.g. tslib) still install.\n  // Preserve an explicit user choice.\n  const catalogMode = catalogs\n    ? (existing.catalogMode ?? 'strict')\n    : existing.catalogMode;\n\n  tree.write(\n    'pnpm-workspace.yaml',\n    yaml.dump(\n      {\n        ...existing,\n        packages,\n        allowBuilds,\n        onlyBuiltDependencies: PNPM_BUILT_DEPENDENCIES,\n        ...(catalogMode ? { catalogMode } : {}),\n      },\n      { quotingType: \"'\" },\n    ),\n  );\n};\n\n/**\n * Configure the workspace's package manager for a monorepo layout.\n *\n * pnpm workspaces are declared in `pnpm-workspace.yaml`; every other package\n * manager reads the `workspaces` field of the root `package.json`.\n */\nconst setUpWorkspaces = (tree: Tree, catalogs: boolean) => {\n  if (detectWorkspacePackageManager(tree) === 'pnpm') {\n    setUpPnpmWorkspace(tree, catalogs);\n  } else {\n    updateJson(tree, 'package.json', (json) => {\n      // The `workspaces` field may be the object form ({ \"packages\": [...] })\n      // accepted by yarn and bun — extend the globs while preserving the form.\n      const globs = Array.from(\n        new Set([...workspaceGlobs(json.workspaces), ...WORKSPACES]),\n      );\n      return {\n        ...json,\n        workspaces:\n          json.workspaces !== undefined && !Array.isArray(json.workspaces)\n            ? { ...json.workspaces, packages: globs }\n            : globs,\n      };\n    });\n  }\n};\n\n/**\n * Ensure the workspace has a `tsconfig.base.json`.\n *\n * `@nx/js` `initGenerator` (with `addTsPlugin`) normally creates this, but it\n * short-circuits when the workspace already has a root `tsconfig.json` — in\n * which case no base file is written and the next project generator fails with\n * `Cannot find tsconfig.base.json`. So we create a compatible one when it's\n * absent. An existing base is left untouched: the user may have tuned it, and\n * rewriting shared compiler options can break other projects (see the\n * \"add to an existing workspace\" guide).\n */\nconst ensureBaseTsConfig = (tree: Tree) => {\n  if (tree.exists('tsconfig.base.json')) {\n    return;\n  }\n  tree.write(\n    'tsconfig.base.json',\n    JSON.stringify(\n      {\n        compilerOptions: {\n          ...BASE_TSCONFIG_COMPILER_OPTIONS,\n          customConditions: [getNpmScope(tree)],\n        },\n      },\n      null,\n      2,\n    ),\n  );\n};\n\n/**\n * Ensure the workspace has a root `tsconfig.json`.\n *\n * Nx's `@nx/js:typescript-sync` generator hard-fails with\n * `Missing root \"tsconfig.json\"` when it's absent. The plugin's TypeScript\n * projects reference each other via this file, so we guarantee a minimal one\n * exists (sync populates its `references`).\n */\nconst ensureRootTsConfig = (tree: Tree) => {\n  if (tree.exists('tsconfig.json')) {\n    return;\n  }\n  tree.write(\n    'tsconfig.json',\n    JSON.stringify(\n      {\n        extends: './tsconfig.base.json',\n        files: [],\n        references: [],\n      },\n      null,\n      2,\n    ),\n  );\n};\n\n/**\n * Transform an Nx workspace into one ready to run `@aws/nx-plugin` generators.\n *\n * This is the deterministic core shared by the workspace preset and the `init`\n * generator. It is safe to re-run: every step is idempotent (config merges,\n * keyed nx.json / package.json entries, create-if-missing files), so running\n * it against an already-initialised workspace is a no-op.\n *\n * It preserves the workspace's module format: the root package.json `type`\n * field is owned by the preset (written from its `--module` option) and left\n * untouched here. It does NOT rewrite an existing `tsconfig.base.json`'s\n * compiler options, migrate a workspace's package manager, or restructure\n * existing projects — those are decisions for the user (see the \"add to an\n * existing workspace\" guide).\n */\nexport const applyWorkspaceInit = async (\n  tree: Tree,\n  {\n    iac,\n    containers,\n    mcp,\n    readmeOverwriteStrategy = OverwriteStrategy.KeepExisting,\n    overwriteScripts = false,\n    catalogs = true,\n  }: ApplyWorkspaceInitOptions,\n) => {\n  const resolvedContainers =\n    !containers || containers === 'infer' ? inferContainers() : containers;\n\n  // The catalogs flag is written explicitly (even when true) so the workspace\n  // records its dependency-management choice.\n  await ensureAwsNxPluginConfig(tree);\n  await updateAwsNxPluginConfig(tree, {\n    iac: { provider: iac },\n    containers: { engine: resolvedContainers },\n    packageManager: { catalogs },\n  });\n\n  // Set up the TypeScript plugin, base tsconfig, formatter etc. `@nx/js`\n  // creates `tsconfig.base.json` when absent, but skips it when a root\n  // `tsconfig.json` already exists — so we ensure both explicitly below.\n  await initGenerator(tree, {\n    formatter: 'none',\n    addTsPlugin: true,\n  });\n\n  ensureBaseTsConfig(tree);\n  ensureRootTsConfig(tree);\n\n  setUpWorkspaces(tree, catalogs);\n\n  const nxJson = readNxJson(tree);\n  updateNxJson(tree, {\n    ...nxJson,\n    // Preserve an explicit analytics choice in an existing workspace.\n    analytics: (nxJson as { analytics?: boolean }).analytics ?? false,\n    targetDefaults: {\n      ...nxJson.targetDefaults,\n      compile: mergeTargetDefault(nxJson.targetDefaults?.compile, (base) => ({\n        ...base,\n        syncGenerators: [\n          ...(base.syncGenerators ?? []).filter(\n            (g) =>\n              ![TS_SYNC_GENERATOR_NAME, NX_TYPESCRIPT_SYNC_GENERATOR].includes(\n                g,\n              ),\n          ),\n          NX_TYPESCRIPT_SYNC_GENERATOR,\n          TS_SYNC_GENERATOR_NAME,\n        ],\n      })),\n    },\n  });\n\n  const CONVENIENCE_SCRIPTS = {\n    dev: 'nx run-many --target dev',\n    build: 'nx run-many --target build',\n    lint: 'nx run-many --target lint --configuration=fix',\n    test: 'nx run-many --target test --all',\n    // Trivy container image scanning is not part of `build` (its result\n    // depends on the ever-changing vulnerability database); run it explicitly,\n    // e.g. in CI.\n    trivy: 'nx run-many --target trivy --all',\n    'build:skip-lint': 'nx run-many --target build --configuration=skip-lint',\n    'build:all': 'nx run-many --target build --all',\n    'affected:all': 'nx affected --target build',\n  };\n  updateJson(tree, 'package.json', (packageJson) => ({\n    ...packageJson,\n    // The root `type` field is owned by the preset (written explicitly from\n    // its `--module` option). `init` preserves an existing workspace's field\n    // as-is: an ESM workspace already carries `type: \"module\"` (that is how\n    // the format is inferred), and introducing a `type` into a CommonJS\n    // workspace that lacks one changes behaviour for frameworks that parse it\n    // (e.g. Next.js starts treating the app's ESM source as CJS).\n    scripts: overwriteScripts\n      ? { ...packageJson.scripts, ...CONVENIENCE_SCRIPTS }\n      : { ...CONVENIENCE_SCRIPTS, ...packageJson.scripts },\n  }));\n\n  // Pin the workspace's `nx` to the version the plugin's @nx/* packages are\n  // built against. A mismatched workspace nx (even a patch apart) hoists a\n  // second nested nx under @nx/js, and the two instances deadlock `nx sync`.\n  // `@nx/js` must be a root dependency for the `@nx/js:typescript-sync`\n  // generator registered in nx.json to resolve (npm doesn't hoist the\n  // plugin's own copy reliably).\n  const nxVersion = readModulePackageJson('@nx/js').packageJson.version;\n  addDependenciesToPackageJson(\n    tree,\n    {},\n    {\n      nx: nxVersion,\n      '@nx/js': nxVersion,\n      '@nx/workspace': nxVersion,\n      ...withVersions(['typescript', '@biomejs/biome']),\n      // Declare the plugin the generators are running from, plus the MCP server\n      // package the vended config runs, so both are pinned in the workspace's\n      // lockfile and upgrading them upgrades what the agents use.\n      ...nxPluginSelfDependency(tree),\n      ...nxPluginMcpDependency(tree),\n    },\n  );\n\n  // Write biome.json for formatting and linting\n  if (!tree.exists('biome.json')) {\n    tree.write(\n      'biome.json',\n      JSON.stringify(getDefaultBiomeConfig(tree), null, 2),\n    );\n  }\n\n  generateFiles(\n    tree, // the virtual file system\n    joinPathFragments(import.meta.dirname, '..', 'preset', 'files'),\n    '.',\n    {\n      projectName: getNpmScope(tree),\n      generators: Object.entries(GeneratorsJson.generators)\n        .filter(([_, v]) => !v['hidden'])\n        .map(([k, v]) => ({ name: k, description: v.description })),\n      ...(() => {\n        const cmds = getPackageManagerDisplayCommands();\n        return {\n          pkgMgrCmd: cmds.exec,\n          buildCmd: `${cmds.run} build`,\n          lintCmd: `${cmds.run} lint`,\n        };\n      })(),\n    },\n    {\n      overwriteStrategy: readmeOverwriteStrategy,\n    },\n  );\n\n  if (mcp !== false) {\n    configureMcpServers(tree);\n  }\n};\n"],"names":["generateFiles","joinPathFragments","OverwriteStrategy","readNxJson","updateJson","updateNxJson","initGenerator","yaml","readModulePackageJson","GeneratorsJson","type","SYNC_GENERATOR_NAME","TS_SYNC_GENERATOR_NAME","BASE_TSCONFIG_COMPILER_OPTIONS","ensureAwsNxPluginConfig","updateAwsNxPluginConfig","inferContainers","addDependenciesToPackageJson","detectWorkspacePackageManager","getDefaultBiomeConfig","configureMcpServers","getNpmScope","mergeTargetDefault","nxPluginMcpDependency","nxPluginSelfDependency","getPackageManagerDisplayCommands","workspaceGlobs","withVersions","WORKSPACES","NX_TYPESCRIPT_SYNC_GENERATOR","PNPM_BUILT_DEPENDENCIES","setUpPnpmWorkspace","tree","catalogs","existing","exists","load","read","packages","Array","from","Set","allowBuilds","Object","fromEntries","map","dep","catalogMode","write","dump","onlyBuiltDependencies","quotingType","setUpWorkspaces","json","globs","workspaces","undefined","isArray","ensureBaseTsConfig","JSON","stringify","compilerOptions","customConditions","ensureRootTsConfig","extends","files","references","applyWorkspaceInit","iac","containers","mcp","readmeOverwriteStrategy","KeepExisting","overwriteScripts","resolvedContainers","provider","engine","packageManager","formatter","addTsPlugin","nxJson","analytics","targetDefaults","compile","base","syncGenerators","filter","g","includes","CONVENIENCE_SCRIPTS","dev","build","lint","test","trivy","packageJson","scripts","nxVersion","version","nx","dirname","projectName","generators","entries","_","v","k","name","description","cmds","pkgMgrCmd","exec","buildCmd","run","lintCmd","overwriteStrategy"],"mappings":"AAAA;;;CAGC,GACD,SACEA,aAAa,EACbC,iBAAiB,EACjBC,iBAAiB,EACjBC,UAAU,EAEVC,UAAU,EACVC,YAAY,QACP,aAAa;AACpB,SAASC,aAAa,QAAQ,SAAS;AAEvC,OAAOC,UAAU,UAAU;AAC3B,SAASC,qBAAqB,QAAQ,4BAA4B;AAClE,OAAOC,oBAAoB,6BAA6B;IAAEC,MAAM;AAAO,EAAE;AACzE,SAASC,uBAAuBC,sBAAsB,QAAQ,0BAAuB;AACrF,SAASC,8BAA8B,QAAQ,qBAAkB;AACjE,SACEC,uBAAuB,EACvBC,uBAAuB,QAClB,oBAAiB;AACxB,SAA0BC,eAAe,QAAQ,kBAAe;AAChE,SACEC,4BAA4B,EAC5BC,6BAA6B,QACxB,oBAAiB;AACxB,SAASC,qBAAqB,QAAQ,cAAW;AAEjD,SAASC,mBAAmB,QAAQ,WAAQ;AAC5C,SAASC,WAAW,QAAQ,iBAAc;AAC1C,SACEC,kBAAkB,EAClBC,qBAAqB,EACrBC,sBAAsB,QACjB,UAAO;AACd,SAASC,gCAAgC,QAAQ,mBAAgB;AACjE,SAASC,cAAc,QAAQ,4BAAyB;AACxD,SAASC,YAAY,QAAQ,gBAAa;AAE1C,MAAMC,aAAa;IAAC;CAAa;AACjC,MAAMC,+BAA+B;AAErC,2EAA2E;AAC3E,4EAA4E;AAC5E,0EAA0E;AAC1E,uEAAuE;AACvE,0EAA0E;AAC1E,OAAO,MAAMC,0BAA0B;IAAC;IAAa;IAAW;IAAM;CAAQ,CAAC;AAsC/E;;;;;;;;;;CAUC,GACD,MAAMC,qBAAqB,CAACC,MAAYC;IACtC,MAAMC,WAAWF,KAAKG,MAAM,CAAC,yBACxB,AAAC5B,KAAK6B,IAAI,CAACJ,KAAKK,IAAI,CAAC,uBAAuB,YAAY,OAGnD,CAAC,IACP,CAAC;IAEL,+EAA+E;IAC/E,MAAMC,WAAWC,MAAMC,IAAI,CACzB,IAAIC,IAAI;WAAK,AAACP,SAASI,QAAQ,IAAiB,EAAE;WAAMV;KAAW;IAGrE,MAAMc,cAAc;QAClB,GAAI,OAAOR,SAASQ,WAAW,KAAK,YAAYR,SAASQ,WAAW,GAC/DR,SAASQ,WAAW,GACrB,CAAC,CAAC;QACN,kEAAkE;QAClE,4DAA4D;QAC5D,GAAGC,OAAOC,WAAW,CAACd,wBAAwBe,GAAG,CAAC,CAACC,MAAQ;gBAACA;gBAAK;aAAK,EAAE;IAC1E;IAEA,0EAA0E;IAC1E,uEAAuE;IACvE,oCAAoC;IACpC,MAAMC,cAAcd,WACfC,SAASa,WAAW,IAAI,WACzBb,SAASa,WAAW;IAExBf,KAAKgB,KAAK,CACR,uBACAzC,KAAK0C,IAAI,CACP;QACE,GAAGf,QAAQ;QACXI;QACAI;QACAQ,uBAAuBpB;QACvB,GAAIiB,cAAc;YAAEA;QAAY,IAAI,CAAC,CAAC;IACxC,GACA;QAAEI,aAAa;IAAI;AAGzB;AAEA;;;;;CAKC,GACD,MAAMC,kBAAkB,CAACpB,MAAYC;IACnC,IAAIf,8BAA8Bc,UAAU,QAAQ;QAClDD,mBAAmBC,MAAMC;IAC3B,OAAO;QACL7B,WAAW4B,MAAM,gBAAgB,CAACqB;YAChC,wEAAwE;YACxE,yEAAyE;YACzE,MAAMC,QAAQf,MAAMC,IAAI,CACtB,IAAIC,IAAI;mBAAIf,eAAe2B,KAAKE,UAAU;mBAAM3B;aAAW;YAE7D,OAAO;gBACL,GAAGyB,IAAI;gBACPE,YACEF,KAAKE,UAAU,KAAKC,aAAa,CAACjB,MAAMkB,OAAO,CAACJ,KAAKE,UAAU,IAC3D;oBAAE,GAAGF,KAAKE,UAAU;oBAAEjB,UAAUgB;gBAAM,IACtCA;YACR;QACF;IACF;AACF;AAEA;;;;;;;;;;CAUC,GACD,MAAMI,qBAAqB,CAAC1B;IAC1B,IAAIA,KAAKG,MAAM,CAAC,uBAAuB;QACrC;IACF;IACAH,KAAKgB,KAAK,CACR,sBACAW,KAAKC,SAAS,CACZ;QACEC,iBAAiB;YACf,GAAGhD,8BAA8B;YACjCiD,kBAAkB;gBAACzC,YAAYW;aAAM;QACvC;IACF,GACA,MACA;AAGN;AAEA;;;;;;;CAOC,GACD,MAAM+B,qBAAqB,CAAC/B;IAC1B,IAAIA,KAAKG,MAAM,CAAC,kBAAkB;QAChC;IACF;IACAH,KAAKgB,KAAK,CACR,iBACAW,KAAKC,SAAS,CACZ;QACEI,SAAS;QACTC,OAAO,EAAE;QACTC,YAAY,EAAE;IAChB,GACA,MACA;AAGN;AAEA;;;;;;;;;;;;;;CAcC,GACD,OAAO,MAAMC,qBAAqB,OAChCnC,MACA,EACEoC,GAAG,EACHC,UAAU,EACVC,GAAG,EACHC,0BAA0BrE,kBAAkBsE,YAAY,EACxDC,mBAAmB,KAAK,EACxBxC,WAAW,IAAI,EACW;IAE5B,MAAMyC,qBACJ,CAACL,cAAcA,eAAe,UAAUrD,oBAAoBqD;IAE9D,4EAA4E;IAC5E,4CAA4C;IAC5C,MAAMvD,wBAAwBkB;IAC9B,MAAMjB,wBAAwBiB,MAAM;QAClCoC,KAAK;YAAEO,UAAUP;QAAI;QACrBC,YAAY;YAAEO,QAAQF;QAAmB;QACzCG,gBAAgB;YAAE5C;QAAS;IAC7B;IAEA,uEAAuE;IACvE,qEAAqE;IACrE,uEAAuE;IACvE,MAAM3B,cAAc0B,MAAM;QACxB8C,WAAW;QACXC,aAAa;IACf;IAEArB,mBAAmB1B;IACnB+B,mBAAmB/B;IAEnBoB,gBAAgBpB,MAAMC;IAEtB,MAAM+C,SAAS7E,WAAW6B;IAC1B3B,aAAa2B,MAAM;QACjB,GAAGgD,MAAM;QACT,kEAAkE;QAClEC,WAAW,AAACD,OAAmCC,SAAS,IAAI;QAC5DC,gBAAgB;YACd,GAAGF,OAAOE,cAAc;YACxBC,SAAS7D,mBAAmB0D,OAAOE,cAAc,EAAEC,SAAS,CAACC,OAAU,CAAA;oBACrE,GAAGA,IAAI;oBACPC,gBAAgB;2BACX,AAACD,CAAAA,KAAKC,cAAc,IAAI,EAAE,AAAD,EAAGC,MAAM,CACnC,CAACC,IACC,CAAC;gCAAC3E;gCAAwBiB;6BAA6B,CAAC2D,QAAQ,CAC9DD;wBAGN1D;wBACAjB;qBACD;gBACH,CAAA;QACF;IACF;IAEA,MAAM6E,sBAAsB;QAC1BC,KAAK;QACLC,OAAO;QACPC,MAAM;QACNC,MAAM;QACN,oEAAoE;QACpE,2EAA2E;QAC3E,cAAc;QACdC,OAAO;QACP,mBAAmB;QACnB,aAAa;QACb,gBAAgB;IAClB;IACA1F,WAAW4B,MAAM,gBAAgB,CAAC+D,cAAiB,CAAA;YACjD,GAAGA,WAAW;YACd,wEAAwE;YACxE,yEAAyE;YACzE,wEAAwE;YACxE,oEAAoE;YACpE,0EAA0E;YAC1E,8DAA8D;YAC9DC,SAASvB,mBACL;gBAAE,GAAGsB,YAAYC,OAAO;gBAAE,GAAGP,mBAAmB;YAAC,IACjD;gBAAE,GAAGA,mBAAmB;gBAAE,GAAGM,YAAYC,OAAO;YAAC;QACvD,CAAA;IAEA,0EAA0E;IAC1E,yEAAyE;IACzE,2EAA2E;IAC3E,sEAAsE;IACtE,oEAAoE;IACpE,+BAA+B;IAC/B,MAAMC,YAAYzF,sBAAsB,UAAUuF,WAAW,CAACG,OAAO;IACrEjF,6BACEe,MACA,CAAC,GACD;QACEmE,IAAIF;QACJ,UAAUA;QACV,iBAAiBA;QACjB,GAAGtE,aAAa;YAAC;YAAc;SAAiB,CAAC;QACjD,0EAA0E;QAC1E,wEAAwE;QACxE,4DAA4D;QAC5D,GAAGH,uBAAuBQ,KAAK;QAC/B,GAAGT,sBAAsBS,KAAK;IAChC;IAGF,8CAA8C;IAC9C,IAAI,CAACA,KAAKG,MAAM,CAAC,eAAe;QAC9BH,KAAKgB,KAAK,CACR,cACAW,KAAKC,SAAS,CAACzC,sBAAsBa,OAAO,MAAM;IAEtD;IAEAhC,cACEgC,MACA/B,kBAAkB,YAAYmG,OAAO,EAAE,MAAM,UAAU,UACvD,KACA;QACEC,aAAahF,YAAYW;QACzBsE,YAAY3D,OAAO4D,OAAO,CAAC9F,eAAe6F,UAAU,EACjDhB,MAAM,CAAC,CAAC,CAACkB,GAAGC,EAAE,GAAK,CAACA,CAAC,CAAC,SAAS,EAC/B5D,GAAG,CAAC,CAAC,CAAC6D,GAAGD,EAAE,GAAM,CAAA;gBAAEE,MAAMD;gBAAGE,aAAaH,EAAEG,WAAW;YAAC,CAAA;QAC1D,GAAG,AAAC,CAAA;YACF,MAAMC,OAAOpF;YACb,OAAO;gBACLqF,WAAWD,KAAKE,IAAI;gBACpBC,UAAU,GAAGH,KAAKI,GAAG,CAAC,MAAM,CAAC;gBAC7BC,SAAS,GAAGL,KAAKI,GAAG,CAAC,KAAK,CAAC;YAC7B;QACF,CAAA,GAAI;IACN,GACA;QACEE,mBAAmB5C;IACrB;IAGF,IAAID,QAAQ,OAAO;QACjBlD,oBAAoBY;IACtB;AACF,EAAE"}
+{"version":3,"sources":["../../../../../packages/nx-plugin/src/utils/init.ts"],"sourcesContent":["/**\n * Copyright Amazon.com, Inc. or its affiliates. All Rights Reserved.\n * SPDX-License-Identifier: Apache-2.0\n */\nimport {\n  generateFiles,\n  joinPathFragments,\n  OverwriteStrategy,\n  readNxJson,\n  type Tree,\n  updateJson,\n  updateNxJson,\n} from '@nx/devkit';\nimport { initGenerator } from '@nx/js';\nimport { readFileSync } from 'fs';\nimport yaml from 'js-yaml';\nimport GeneratorsJson from '../../generators.json' with { type: 'json' };\nimport { SYNC_GENERATOR_NAME as TS_SYNC_GENERATOR_NAME } from '../ts/sync/generator';\nimport { BASE_TSCONFIG_COMPILER_OPTIONS } from './base-tsconfig';\nimport {\n  ensureAwsNxPluginConfig,\n  updateAwsNxPluginConfig,\n} from './config/utils';\nimport { type Containers, inferContainers } from './containers';\nimport {\n  type DependencyDeclaration,\n  forDependencies,\n  type MustDeclare,\n} from './declared-dependencies';\nimport {\n  addDependenciesToPackageJson,\n  detectWorkspacePackageManager,\n} from './dependencies';\nimport { getDefaultBiomeConfig } from './format';\nimport type { Iac } from './iac';\nimport { configureMcpServers } from './mcp';\nimport { getNpmScope } from './npm-scope';\nimport {\n  mergeTargetDefault,\n  nxPluginMcpDependency,\n  nxPluginSelfDependency,\n} from './nx';\nimport { getPackageManagerDisplayCommands } from './pkg-manager';\nimport { workspaceGlobs } from './project-package-json';\nimport { type ITsDepVersion, withVersions } from './versions';\n\nconst WORKSPACES = ['packages/*'];\nconst NX_TYPESCRIPT_SYNC_GENERATOR = '@nx/js:typescript-sync';\n\n/** Dependencies a caller must declare to apply the workspace init. */\nexport const INIT_DEPENDENCIES = [\n  { name: 'nx' },\n  { name: '@nx/js' },\n  { name: '@nx/workspace' },\n  { name: 'typescript' },\n  { name: '@biomejs/biome' },\n] as const satisfies readonly { name: ITsDepVersion }[];\n\n// Built dependencies whose install scripts the generated workspace trusts.\n// `onlyBuiltDependencies` is the pnpm 10 key (silently ignored by pnpm 11);\n// pnpm 11 reads `allowBuilds` instead. Any dep NOT in this allowlist will\n// have its install scripts skipped with a warning — matching pnpm 10's\n// default behaviour. The user can opt-in later via `pnpm approve-builds`.\nexport const PNPM_BUILT_DEPENDENCIES = ['@swc/core', 'esbuild', 'nx', 'sharp'];\n\n/**\n * Options controlling how the workspace is initialised. These mirror the\n * preset schema so a workspace created via the preset and one initialised via\n * the `init` generator end up in the same shape.\n */\nexport interface ApplyWorkspaceInitOptions {\n  /** The IaC provider to record in the plugin config. */\n  readonly iac: Iac;\n  /**\n   * The container engine to record. `undefined`/`'infer'` picks docker when\n   * installed, else finch.\n   */\n  readonly containers?: Containers | 'infer';\n  /** Whether to configure MCP servers for coding agents. Defaults to true. */\n  readonly mcp?: boolean;\n  /**\n   * How to treat the generated workspace README. The preset owns the README of\n   * a greenfield workspace (`Overwrite`); the `init` generator must not clobber\n   * an existing workspace's README (`KeepExisting`, the default).\n   */\n  readonly readmeOverwriteStrategy?: OverwriteStrategy;\n  /**\n   * Whether to overwrite root package.json scripts that already exist. The\n   * preset owns a greenfield workspace's scripts (`true`); the `init`\n   * generator must not clobber an existing workspace's scripts (`false`,\n   * the default) — it only adds the convenience scripts that are absent.\n   */\n  readonly overwriteScripts?: boolean;\n  /**\n   * Whether generators use the package manager's dependency catalog. On pnpm\n   * this also sets `catalogMode: strict` so `pnpm add` records new deps in the\n   * catalog. Defaults to true.\n   */\n  readonly catalogs?: boolean;\n}\n\n/**\n * Add or repair the pnpm `allowBuilds` / `onlyBuiltDependencies` allowlist for\n * the workspace's `packages` globs, without clobbering any packages the user\n * has already declared.\n *\n * A workspace not created by the preset commonly has either no\n * `pnpm-workspace.yaml`, one missing the `packages` globs, or one carrying the\n * broken `set this to true or false` placeholder pnpm writes when it skips a\n * build script. This makes the file self-consistent so the first generator's\n * install doesn't fail with `ERR_PNPM_IGNORED_BUILDS`.\n */\nconst setUpPnpmWorkspace = (tree: Tree, catalogs: boolean) => {\n  const existing = tree.exists('pnpm-workspace.yaml')\n    ? ((yaml.load(tree.read('pnpm-workspace.yaml', 'utf-8') ?? '') as Record<\n        string,\n        unknown\n      >) ?? {})\n    : {};\n\n  // Preserve any packages globs the user already has, ensuring ours are present.\n  const packages = Array.from(\n    new Set([...((existing.packages as string[]) ?? []), ...WORKSPACES]),\n  );\n\n  const allowBuilds = {\n    ...(typeof existing.allowBuilds === 'object' && existing.allowBuilds\n      ? (existing.allowBuilds as Record<string, unknown>)\n      : {}),\n    // Overwrite any non-boolean (e.g. the \"set this to true or false\"\n    // placeholder) with an explicit true for the deps we trust.\n    ...Object.fromEntries(PNPM_BUILT_DEPENDENCIES.map((dep) => [dep, true])),\n  };\n\n  // `strict` makes `pnpm add` record new deps in the catalog; it only gates\n  // that flow, so pre-declared direct ranges (e.g. tslib) still install.\n  // Preserve an explicit user choice.\n  const catalogMode = catalogs\n    ? (existing.catalogMode ?? 'strict')\n    : existing.catalogMode;\n\n  tree.write(\n    'pnpm-workspace.yaml',\n    yaml.dump(\n      {\n        ...existing,\n        packages,\n        allowBuilds,\n        onlyBuiltDependencies: PNPM_BUILT_DEPENDENCIES,\n        ...(catalogMode ? { catalogMode } : {}),\n      },\n      { quotingType: \"'\" },\n    ),\n  );\n};\n\n/**\n * Configure the workspace's package manager for a monorepo layout.\n *\n * pnpm workspaces are declared in `pnpm-workspace.yaml`; every other package\n * manager reads the `workspaces` field of the root `package.json`.\n */\nconst setUpWorkspaces = (tree: Tree, catalogs: boolean) => {\n  if (detectWorkspacePackageManager(tree) === 'pnpm') {\n    setUpPnpmWorkspace(tree, catalogs);\n  } else {\n    updateJson(tree, 'package.json', (json) => {\n      // The `workspaces` field may be the object form ({ \"packages\": [...] })\n      // accepted by yarn and bun — extend the globs while preserving the form.\n      const globs = Array.from(\n        new Set([...workspaceGlobs(json.workspaces), ...WORKSPACES]),\n      );\n      return {\n        ...json,\n        workspaces:\n          json.workspaces !== undefined && !Array.isArray(json.workspaces)\n            ? { ...json.workspaces, packages: globs }\n            : globs,\n      };\n    });\n  }\n};\n\n/**\n * Ensure the workspace has a `tsconfig.base.json`.\n *\n * `@nx/js` `initGenerator` (with `addTsPlugin`) normally creates this, but it\n * short-circuits when the workspace already has a root `tsconfig.json` — in\n * which case no base file is written and the next project generator fails with\n * `Cannot find tsconfig.base.json`. So we create a compatible one when it's\n * absent. An existing base is left untouched: the user may have tuned it, and\n * rewriting shared compiler options can break other projects (see the\n * \"add to an existing workspace\" guide).\n */\nconst ensureBaseTsConfig = (tree: Tree) => {\n  if (tree.exists('tsconfig.base.json')) {\n    return;\n  }\n  tree.write(\n    'tsconfig.base.json',\n    JSON.stringify(\n      {\n        compilerOptions: {\n          ...BASE_TSCONFIG_COMPILER_OPTIONS,\n          customConditions: [getNpmScope(tree)],\n        },\n      },\n      null,\n      2,\n    ),\n  );\n};\n\n/**\n * Ensure the workspace has a root `tsconfig.json`.\n *\n * Nx's `@nx/js:typescript-sync` generator hard-fails with\n * `Missing root \"tsconfig.json\"` when it's absent. The plugin's TypeScript\n * projects reference each other via this file, so we guarantee a minimal one\n * exists (sync populates its `references`).\n */\nconst ensureRootTsConfig = (tree: Tree) => {\n  if (tree.exists('tsconfig.json')) {\n    return;\n  }\n  tree.write(\n    'tsconfig.json',\n    JSON.stringify(\n      {\n        extends: './tsconfig.base.json',\n        files: [],\n        references: [],\n      },\n      null,\n      2,\n    ),\n  );\n};\n\n/**\n * Transform an Nx workspace into one ready to run `@aws/nx-plugin` generators.\n *\n * This is the deterministic core shared by the workspace preset and the `init`\n * generator. It is safe to re-run: every step is idempotent (config merges,\n * keyed nx.json / package.json entries, create-if-missing files), so running\n * it against an already-initialised workspace is a no-op.\n *\n * It preserves the workspace's module format: the root package.json `type`\n * field is owned by the preset (written from its `--module` option) and left\n * untouched here. It does NOT rewrite an existing `tsconfig.base.json`'s\n * compiler options, migrate a workspace's package manager, or restructure\n * existing projects — those are decisions for the user (see the \"add to an\n * existing workspace\" guide).\n */\nexport const applyWorkspaceInit = async <const D extends DependencyDeclaration>(\n  tree: Tree,\n  {\n    iac,\n    containers,\n    mcp,\n    readmeOverwriteStrategy = OverwriteStrategy.KeepExisting,\n    overwriteScripts = false,\n    catalogs = true,\n  }: ApplyWorkspaceInitOptions,\n  declaration: D & MustDeclare<typeof INIT_DEPENDENCIES, D>,\n) => {\n  const resolvedContainers =\n    !containers || containers === 'infer' ? inferContainers() : containers;\n\n  // The catalogs flag is written explicitly (even when true) so the workspace\n  // records its dependency-management choice.\n  await ensureAwsNxPluginConfig(tree);\n  await updateAwsNxPluginConfig(tree, {\n    iac: { provider: iac },\n    containers: { engine: resolvedContainers },\n    packageManager: { catalogs },\n  });\n\n  // Set up the TypeScript plugin, base tsconfig, formatter etc. `@nx/js`\n  // creates `tsconfig.base.json` when absent, but skips it when a root\n  // `tsconfig.json` already exists — so we ensure both explicitly below.\n  await initGenerator(tree, {\n    formatter: 'none',\n    addTsPlugin: true,\n  });\n\n  ensureBaseTsConfig(tree);\n  ensureRootTsConfig(tree);\n\n  setUpWorkspaces(tree, catalogs);\n\n  const nxJson = readNxJson(tree);\n  updateNxJson(tree, {\n    ...nxJson,\n    // Preserve an explicit analytics choice in an existing workspace.\n    analytics: (nxJson as { analytics?: boolean }).analytics ?? false,\n    targetDefaults: {\n      ...nxJson.targetDefaults,\n      compile: mergeTargetDefault(nxJson.targetDefaults?.compile, (base) => ({\n        ...base,\n        syncGenerators: [\n          ...(base.syncGenerators ?? []).filter(\n            (g) =>\n              ![TS_SYNC_GENERATOR_NAME, NX_TYPESCRIPT_SYNC_GENERATOR].includes(\n                g,\n              ),\n          ),\n          NX_TYPESCRIPT_SYNC_GENERATOR,\n          TS_SYNC_GENERATOR_NAME,\n        ],\n      })),\n    },\n  });\n\n  const CONVENIENCE_SCRIPTS = {\n    dev: 'nx run-many --target dev',\n    build: 'nx run-many --target build',\n    lint: 'nx run-many --target lint --configuration=fix',\n    test: 'nx run-many --target test --all',\n    // Trivy container image scanning is not part of `build` (its result\n    // depends on the ever-changing vulnerability database); run it explicitly,\n    // e.g. in CI.\n    trivy: 'nx run-many --target trivy --all',\n    'build:skip-lint': 'nx run-many --target build --configuration=skip-lint',\n    'build:all': 'nx run-many --target build --all',\n    'affected:all': 'nx affected --target build',\n  };\n  updateJson(tree, 'package.json', (packageJson) => ({\n    ...packageJson,\n    // The root `type` field is owned by the preset (written explicitly from\n    // its `--module` option). `init` preserves an existing workspace's field\n    // as-is: an ESM workspace already carries `type: \"module\"` (that is how\n    // the format is inferred), and introducing a `type` into a CommonJS\n    // workspace that lacks one changes behaviour for frameworks that parse it\n    // (e.g. Next.js starts treating the app's ESM source as CJS).\n    scripts: overwriteScripts\n      ? { ...packageJson.scripts, ...CONVENIENCE_SCRIPTS }\n      : { ...CONVENIENCE_SCRIPTS, ...packageJson.scripts },\n  }));\n\n  // Pin the workspace's `nx` to the version the plugin's @nx/* packages are\n  // built against. A mismatched workspace nx (even a patch apart) hoists a\n  // second nested nx under @nx/js, and the two instances deadlock `nx sync`.\n  // `@nx/js` must be a root dependency for the `@nx/js:typescript-sync`\n  // generator registered in nx.json to resolve (npm doesn't hoist the\n  // plugin's own copy reliably).\n  addDependenciesToPackageJson(\n    tree,\n    {},\n    {\n      ...withVersions(forDependencies<typeof INIT_DEPENDENCIES>(declaration), [\n        'nx',\n        '@nx/js',\n        '@nx/workspace',\n      ]),\n      ...withVersions(forDependencies<typeof INIT_DEPENDENCIES>(declaration), [\n        'typescript',\n        '@biomejs/biome',\n      ]),\n      // Declare the plugin the generators are running from, plus the MCP server\n      // package the vended config runs, so both are pinned in the workspace's\n      // lockfile and upgrading them upgrades what the agents use.\n      ...nxPluginSelfDependency(tree),\n      ...nxPluginMcpDependency(tree),\n    },\n  );\n\n  // Write biome.json for formatting and linting\n  if (!tree.exists('biome.json')) {\n    tree.write(\n      'biome.json',\n      JSON.stringify(getDefaultBiomeConfig(tree), null, 2),\n    );\n  }\n\n  generateFiles(\n    tree, // the virtual file system\n    joinPathFragments(import.meta.dirname, '..', 'preset', 'files'),\n    '.',\n    {\n      projectName: getNpmScope(tree),\n      generators: Object.entries(GeneratorsJson.generators)\n        .filter(([_, v]) => !v['hidden'])\n        .map(([k, v]) => ({ name: k, description: v.description })),\n      ...(() => {\n        const cmds = getPackageManagerDisplayCommands();\n        return {\n          pkgMgrCmd: cmds.exec,\n          buildCmd: `${cmds.run} build`,\n          lintCmd: `${cmds.run} lint`,\n        };\n      })(),\n    },\n    {\n      overwriteStrategy: readmeOverwriteStrategy,\n    },\n  );\n\n  if (mcp !== false) {\n    configureMcpServers(tree);\n  }\n};\n"],"names":["generateFiles","joinPathFragments","OverwriteStrategy","readNxJson","updateJson","updateNxJson","initGenerator","yaml","GeneratorsJson","type","SYNC_GENERATOR_NAME","TS_SYNC_GENERATOR_NAME","BASE_TSCONFIG_COMPILER_OPTIONS","ensureAwsNxPluginConfig","updateAwsNxPluginConfig","inferContainers","forDependencies","addDependenciesToPackageJson","detectWorkspacePackageManager","getDefaultBiomeConfig","configureMcpServers","getNpmScope","mergeTargetDefault","nxPluginMcpDependency","nxPluginSelfDependency","getPackageManagerDisplayCommands","workspaceGlobs","withVersions","WORKSPACES","NX_TYPESCRIPT_SYNC_GENERATOR","INIT_DEPENDENCIES","name","PNPM_BUILT_DEPENDENCIES","setUpPnpmWorkspace","tree","catalogs","existing","exists","load","read","packages","Array","from","Set","allowBuilds","Object","fromEntries","map","dep","catalogMode","write","dump","onlyBuiltDependencies","quotingType","setUpWorkspaces","json","globs","workspaces","undefined","isArray","ensureBaseTsConfig","JSON","stringify","compilerOptions","customConditions","ensureRootTsConfig","extends","files","references","applyWorkspaceInit","iac","containers","mcp","readmeOverwriteStrategy","KeepExisting","overwriteScripts","declaration","resolvedContainers","provider","engine","packageManager","formatter","addTsPlugin","nxJson","analytics","targetDefaults","compile","base","syncGenerators","filter","g","includes","CONVENIENCE_SCRIPTS","dev","build","lint","test","trivy","packageJson","scripts","dirname","projectName","generators","entries","_","v","k","description","cmds","pkgMgrCmd","exec","buildCmd","run","lintCmd","overwriteStrategy"],"mappings":"AAAA;;;CAGC,GACD,SACEA,aAAa,EACbC,iBAAiB,EACjBC,iBAAiB,EACjBC,UAAU,EAEVC,UAAU,EACVC,YAAY,QACP,aAAa;AACpB,SAASC,aAAa,QAAQ,SAAS;AAEvC,OAAOC,UAAU,UAAU;AAC3B,OAAOC,oBAAoB,6BAA6B;IAAEC,MAAM;AAAO,EAAE;AACzE,SAASC,uBAAuBC,sBAAsB,QAAQ,0BAAuB;AACrF,SAASC,8BAA8B,QAAQ,qBAAkB;AACjE,SACEC,uBAAuB,EACvBC,uBAAuB,QAClB,oBAAiB;AACxB,SAA0BC,eAAe,QAAQ,kBAAe;AAChE,SAEEC,eAAe,QAEV,6BAA0B;AACjC,SACEC,4BAA4B,EAC5BC,6BAA6B,QACxB,oBAAiB;AACxB,SAASC,qBAAqB,QAAQ,cAAW;AAEjD,SAASC,mBAAmB,QAAQ,WAAQ;AAC5C,SAASC,WAAW,QAAQ,iBAAc;AAC1C,SACEC,kBAAkB,EAClBC,qBAAqB,EACrBC,sBAAsB,QACjB,UAAO;AACd,SAASC,gCAAgC,QAAQ,mBAAgB;AACjE,SAASC,cAAc,QAAQ,4BAAyB;AACxD,SAA6BC,YAAY,QAAQ,gBAAa;AAE9D,MAAMC,aAAa;IAAC;CAAa;AACjC,MAAMC,+BAA+B;AAErC,oEAAoE,GACpE,OAAO,MAAMC,oBAAoB;IAC/B;QAAEC,MAAM;IAAK;IACb;QAAEA,MAAM;IAAS;IACjB;QAAEA,MAAM;IAAgB;IACxB;QAAEA,MAAM;IAAa;IACrB;QAAEA,MAAM;IAAiB;CAC1B,CAAuD;AAExD,2EAA2E;AAC3E,4EAA4E;AAC5E,0EAA0E;AAC1E,uEAAuE;AACvE,0EAA0E;AAC1E,OAAO,MAAMC,0BAA0B;IAAC;IAAa;IAAW;IAAM;CAAQ,CAAC;AAsC/E;;;;;;;;;;CAUC,GACD,MAAMC,qBAAqB,CAACC,MAAYC;IACtC,MAAMC,WAAWF,KAAKG,MAAM,CAAC,yBACxB,AAAC9B,KAAK+B,IAAI,CAACJ,KAAKK,IAAI,CAAC,uBAAuB,YAAY,OAGnD,CAAC,IACP,CAAC;IAEL,+EAA+E;IAC/E,MAAMC,WAAWC,MAAMC,IAAI,CACzB,IAAIC,IAAI;WAAK,AAACP,SAASI,QAAQ,IAAiB,EAAE;WAAMZ;KAAW;IAGrE,MAAMgB,cAAc;QAClB,GAAI,OAAOR,SAASQ,WAAW,KAAK,YAAYR,SAASQ,WAAW,GAC/DR,SAASQ,WAAW,GACrB,CAAC,CAAC;QACN,kEAAkE;QAClE,4DAA4D;QAC5D,GAAGC,OAAOC,WAAW,CAACd,wBAAwBe,GAAG,CAAC,CAACC,MAAQ;gBAACA;gBAAK;aAAK,EAAE;IAC1E;IAEA,0EAA0E;IAC1E,uEAAuE;IACvE,oCAAoC;IACpC,MAAMC,cAAcd,WACfC,SAASa,WAAW,IAAI,WACzBb,SAASa,WAAW;IAExBf,KAAKgB,KAAK,CACR,uBACA3C,KAAK4C,IAAI,CACP;QACE,GAAGf,QAAQ;QACXI;QACAI;QACAQ,uBAAuBpB;QACvB,GAAIiB,cAAc;YAAEA;QAAY,IAAI,CAAC,CAAC;IACxC,GACA;QAAEI,aAAa;IAAI;AAGzB;AAEA;;;;;CAKC,GACD,MAAMC,kBAAkB,CAACpB,MAAYC;IACnC,IAAIjB,8BAA8BgB,UAAU,QAAQ;QAClDD,mBAAmBC,MAAMC;IAC3B,OAAO;QACL/B,WAAW8B,MAAM,gBAAgB,CAACqB;YAChC,wEAAwE;YACxE,yEAAyE;YACzE,MAAMC,QAAQf,MAAMC,IAAI,CACtB,IAAIC,IAAI;mBAAIjB,eAAe6B,KAAKE,UAAU;mBAAM7B;aAAW;YAE7D,OAAO;gBACL,GAAG2B,IAAI;gBACPE,YACEF,KAAKE,UAAU,KAAKC,aAAa,CAACjB,MAAMkB,OAAO,CAACJ,KAAKE,UAAU,IAC3D;oBAAE,GAAGF,KAAKE,UAAU;oBAAEjB,UAAUgB;gBAAM,IACtCA;YACR;QACF;IACF;AACF;AAEA;;;;;;;;;;CAUC,GACD,MAAMI,qBAAqB,CAAC1B;IAC1B,IAAIA,KAAKG,MAAM,CAAC,uBAAuB;QACrC;IACF;IACAH,KAAKgB,KAAK,CACR,sBACAW,KAAKC,SAAS,CACZ;QACEC,iBAAiB;YACf,GAAGnD,8BAA8B;YACjCoD,kBAAkB;gBAAC3C,YAAYa;aAAM;QACvC;IACF,GACA,MACA;AAGN;AAEA;;;;;;;CAOC,GACD,MAAM+B,qBAAqB,CAAC/B;IAC1B,IAAIA,KAAKG,MAAM,CAAC,kBAAkB;QAChC;IACF;IACAH,KAAKgB,KAAK,CACR,iBACAW,KAAKC,SAAS,CACZ;QACEI,SAAS;QACTC,OAAO,EAAE;QACTC,YAAY,EAAE;IAChB,GACA,MACA;AAGN;AAEA;;;;;;;;;;;;;;CAcC,GACD,OAAO,MAAMC,qBAAqB,OAChCnC,MACA,EACEoC,GAAG,EACHC,UAAU,EACVC,GAAG,EACHC,0BAA0BvE,kBAAkBwE,YAAY,EACxDC,mBAAmB,KAAK,EACxBxC,WAAW,IAAI,EACW,EAC5ByC;IAEA,MAAMC,qBACJ,CAACN,cAAcA,eAAe,UAAUxD,oBAAoBwD;IAE9D,4EAA4E;IAC5E,4CAA4C;IAC5C,MAAM1D,wBAAwBqB;IAC9B,MAAMpB,wBAAwBoB,MAAM;QAClCoC,KAAK;YAAEQ,UAAUR;QAAI;QACrBC,YAAY;YAAEQ,QAAQF;QAAmB;QACzCG,gBAAgB;YAAE7C;QAAS;IAC7B;IAEA,uEAAuE;IACvE,qEAAqE;IACrE,uEAAuE;IACvE,MAAM7B,cAAc4B,MAAM;QACxB+C,WAAW;QACXC,aAAa;IACf;IAEAtB,mBAAmB1B;IACnB+B,mBAAmB/B;IAEnBoB,gBAAgBpB,MAAMC;IAEtB,MAAMgD,SAAShF,WAAW+B;IAC1B7B,aAAa6B,MAAM;QACjB,GAAGiD,MAAM;QACT,kEAAkE;QAClEC,WAAW,AAACD,OAAmCC,SAAS,IAAI;QAC5DC,gBAAgB;YACd,GAAGF,OAAOE,cAAc;YACxBC,SAAShE,mBAAmB6D,OAAOE,cAAc,EAAEC,SAAS,CAACC,OAAU,CAAA;oBACrE,GAAGA,IAAI;oBACPC,gBAAgB;2BACX,AAACD,CAAAA,KAAKC,cAAc,IAAI,EAAE,AAAD,EAAGC,MAAM,CACnC,CAACC,IACC,CAAC;gCAAC/E;gCAAwBkB;6BAA6B,CAAC8D,QAAQ,CAC9DD;wBAGN7D;wBACAlB;qBACD;gBACH,CAAA;QACF;IACF;IAEA,MAAMiF,sBAAsB;QAC1BC,KAAK;QACLC,OAAO;QACPC,MAAM;QACNC,MAAM;QACN,oEAAoE;QACpE,2EAA2E;QAC3E,cAAc;QACdC,OAAO;QACP,mBAAmB;QACnB,aAAa;QACb,gBAAgB;IAClB;IACA7F,WAAW8B,MAAM,gBAAgB,CAACgE,cAAiB,CAAA;YACjD,GAAGA,WAAW;YACd,wEAAwE;YACxE,yEAAyE;YACzE,wEAAwE;YACxE,oEAAoE;YACpE,0EAA0E;YAC1E,8DAA8D;YAC9DC,SAASxB,mBACL;gBAAE,GAAGuB,YAAYC,OAAO;gBAAE,GAAGP,mBAAmB;YAAC,IACjD;gBAAE,GAAGA,mBAAmB;gBAAE,GAAGM,YAAYC,OAAO;YAAC;QACvD,CAAA;IAEA,0EAA0E;IAC1E,yEAAyE;IACzE,2EAA2E;IAC3E,sEAAsE;IACtE,oEAAoE;IACpE,+BAA+B;IAC/BlF,6BACEiB,MACA,CAAC,GACD;QACE,GAAGP,aAAaX,gBAA0C4D,cAAc;YACtE;YACA;YACA;SACD,CAAC;QACF,GAAGjD,aAAaX,gBAA0C4D,cAAc;YACtE;YACA;SACD,CAAC;QACF,0EAA0E;QAC1E,wEAAwE;QACxE,4DAA4D;QAC5D,GAAGpD,uBAAuBU,KAAK;QAC/B,GAAGX,sBAAsBW,KAAK;IAChC;IAGF,8CAA8C;IAC9C,IAAI,CAACA,KAAKG,MAAM,CAAC,eAAe;QAC9BH,KAAKgB,KAAK,CACR,cACAW,KAAKC,SAAS,CAAC3C,sBAAsBe,OAAO,MAAM;IAEtD;IAEAlC,cACEkC,MACAjC,kBAAkB,YAAYmG,OAAO,EAAE,MAAM,UAAU,UACvD,KACA;QACEC,aAAahF,YAAYa;QACzBoE,YAAYzD,OAAO0D,OAAO,CAAC/F,eAAe8F,UAAU,EACjDb,MAAM,CAAC,CAAC,CAACe,GAAGC,EAAE,GAAK,CAACA,CAAC,CAAC,SAAS,EAC/B1D,GAAG,CAAC,CAAC,CAAC2D,GAAGD,EAAE,GAAM,CAAA;gBAAE1E,MAAM2E;gBAAGC,aAAaF,EAAEE,WAAW;YAAC,CAAA;QAC1D,GAAG,AAAC,CAAA;YACF,MAAMC,OAAOnF;YACb,OAAO;gBACLoF,WAAWD,KAAKE,IAAI;gBACpBC,UAAU,GAAGH,KAAKI,GAAG,CAAC,MAAM,CAAC;gBAC7BC,SAAS,GAAGL,KAAKI,GAAG,CAAC,KAAK,CAAC;YAC7B;QACF,CAAA,GAAI;IACN,GACA;QACEE,mBAAmBzC;IACrB;IAGF,IAAID,QAAQ,OAAO;QACjBpD,oBAAoBc;IACtB;AACF,EAAE"}

package/src/utils/migration-versions.d.ts

@@ -18,13 +18,27 @@ import { compare } from 'semver';
  * - The weekly `update-versions` PR backfills the version of the release that
  *   shipped each migration, moving and re-keying it accordingly
  *   (`scripts/backfill-migration-versions.ts`), so source converges on the
- *   versions of everything already released.
+ *   versions of everything already released. `packageJsonUpdates` entries are
+ *   dated in place there too, since their keys never change.
  *
  * A version already in source always wins, so backfilled entries are stable.
+ *
+ * An entry marked `everyMigration: true` is never backfilled or pinned, and is
+ * re-stamped with each pending version, so it runs on every upgrade.
  */
 export interface MigrationsJson {
     generators?: Record<string, {
         version?: string;
+        everyMigration?: boolean;
+    } & Record<string, unknown>>;
+    /**
+     * Declarative dependency bumps `nx migrate` applies to the root manifest.
+     * Keyed by what the bump targets rather than the release that ships it, so an
+     * entry is unique from the moment it is written and one release's bump can sit
+     * beside the next; nx itself gates on the entry's `version`.
+     */
+    packageJsonUpdates?: Record<string, {
+        version: string;
     } & Record<string, unknown>>;
 }
 /** Ascending semver comparator for `Array.prototype.sort`. */
@@ -32,15 +46,19 @@ export declare const compareVersions: typeof compare;
 /** Whether a string is an exact semver version. */
 export declare const isValidVersion: (version: string) => boolean;
 /**
- * Map of migration key -> version of the earliest release that registers it,
- * resolved only for the entries still missing a `version` (one already recorded
- * in source wins, so its history doesn't need reading). A migration that hasn't
- * been released is absent.
+ * Map of entry key -> version of the earliest release that registers it, across
+ * both `generators` and `packageJsonUpdates`. Resolved only for the entries still
+ * missing a version (one already recorded in source wins, so its history doesn't
+ * need reading). An entry that hasn't been released is absent.
  *
  * Walks releases newest first and stops as soon as every entry is resolved: an
  * entry that has disappeared from a release's `migrations.json` was first
  * registered by the release after it, which is the one that shipped it.
  *
+ * Both sections resolve the same way and share the walk, so the release doesn't
+ * read tag history twice. Keys can't collide: a migration is keyed by its own
+ * name, an nx bump by the nx version it moves to.
+ *
  * @param migrations parsed source migrations.json
  * @param versions released versions in descending semver order
  * @param readReleasedMigrations reads the `migrations.json` published by a given
@@ -49,7 +67,8 @@ export declare const isValidVersion: (version: string) => boolean;
 export declare const readShippedMigrationVersions: (migrations: MigrationsJson, versions: string[], readReleasedMigrations: (version: string) => MigrationsJson | undefined) => Record<string, string>;
 /**
  * Return a copy of the migrations collection with a `version` stamped onto
- * every generator entry, preserving any already present.
+ * every generator entry, preserving any already present, and the pending version
+ * recorded on any `packageJsonUpdates` entry still holding `latest`.
  *
  * @param migrations parsed migrations.json to stamp
  * @param shippedVersions migration key -> version of the earliest release

package/src/utils/migration-versions.js

@@ -5,27 +5,40 @@
 /** Ascending semver comparator for `Array.prototype.sort`. */ export const compareVersions = compare;
 /** Whether a string is an exact semver version. */ export const isValidVersion = (version)=>valid(version) !== null;
 /**
- * Map of migration key -> version of the earliest release that registers it,
- * resolved only for the entries still missing a `version` (one already recorded
- * in source wins, so its history doesn't need reading). A migration that hasn't
- * been released is absent.
+ * Map of entry key -> version of the earliest release that registers it, across
+ * both `generators` and `packageJsonUpdates`. Resolved only for the entries still
+ * missing a version (one already recorded in source wins, so its history doesn't
+ * need reading). An entry that hasn't been released is absent.
  *
  * Walks releases newest first and stops as soon as every entry is resolved: an
  * entry that has disappeared from a release's `migrations.json` was first
  * registered by the release after it, which is the one that shipped it.
  *
+ * Both sections resolve the same way and share the walk, so the release doesn't
+ * read tag history twice. Keys can't collide: a migration is keyed by its own
+ * name, an nx bump by the nx version it moves to.
+ *
  * @param migrations parsed source migrations.json
  * @param versions released versions in descending semver order
  * @param readReleasedMigrations reads the `migrations.json` published by a given
  *   version, or undefined if it predates the manifest
  */ export const readShippedMigrationVersions = (migrations, versions, readReleasedMigrations)=>{
     const shippedVersions = {};
-    let unresolved = Object.entries(migrations.generators ?? {}).filter(([, entry])=>!entry.version).map(([key])=>key);
+    // A `packageJsonUpdates` entry records `latest` rather than omitting its
+    // version, since nx requires the field.
+    let unresolved = [
+        ...Object.entries(migrations.generators ?? {}).filter(([, entry])=>!entry.version).map(([key])=>key),
+        ...Object.entries(migrations.packageJsonUpdates ?? {}).filter(([, entry])=>entry.version === LATEST_MIGRATIONS_DIR).map(([key])=>key)
+    ];
     for (const version of versions){
         if (unresolved.length === 0) {
             break;
         }
-        const registered = new Set(Object.keys(readReleasedMigrations(version)?.generators ?? {}));
+        const released = readReleasedMigrations(version);
+        const registered = new Set([
+            ...Object.keys(released?.generators ?? {}),
+            ...Object.keys(released?.packageJsonUpdates ?? {})
+        ]);
         // Entries gone at this release keep the version recorded from the release
         // after it (if any) and stop being looked up.
         unresolved = unresolved.filter((key)=>registered.has(key));
@@ -37,7 +50,8 @@
 };
 /**
  * Return a copy of the migrations collection with a `version` stamped onto
- * every generator entry, preserving any already present.
+ * every generator entry, preserving any already present, and the pending version
+ * recorded on any `packageJsonUpdates` entry still holding `latest`.
  *
  * @param migrations parsed migrations.json to stamp
  * @param shippedVersions migration key -> version of the earliest release
@@ -46,14 +60,30 @@
  *   unshipped migrations so their version is one that really shipped
  */ export const stampMigrationVersions = (migrations, shippedVersions, pendingVersion)=>({
         ...migrations,
-        generators: Object.fromEntries(Object.entries(migrations.generators ?? {}).map(([name, entry])=>[
+        generators: Object.fromEntries(// `nx migrate` sorts the run ascending by version and preserves the
+        // manifest's order among equal versions, so emitting the every-migration
+        // entries last is what makes them run after the release's own migrations.
+        Object.entries(migrations.generators ?? {}).sort(([, a], [, b])=>Number(a.everyMigration ?? false) - Number(b.everyMigration ?? false)).map(([name, entry])=>{
+            // Source-only marker, stripped from what nx reads.
+            const { everyMigration, version: sourceVersion, ...published } = entry;
+            // Overrides any source version so it stays ahead of what is installed.
+            const version = everyMigration ? pendingVersion : sourceVersion ?? shippedVersions[name] ?? pendingVersion;
+            return [
                 name,
                 {
-                    version: shippedVersions[name] ?? pendingVersion,
-                    ...entry
+                    version,
+                    ...published
                 }
-            ]))
+            ];
+        })),
+        ...migrations.packageJsonUpdates && {
+            packageJsonUpdates: stampPackageJsonUpdates(migrations.packageJsonUpdates, pendingVersion)
+        }
     });
+/**
+ * Version any `packageJsonUpdates` entry still holding `latest` with the release
+ * about to publish it, so the nx bump ships under a version `nx migrate` gates on.
+ */ const stampPackageJsonUpdates = (packageJsonUpdates, pendingVersion)=>resolvePackageJsonUpdateVersions(packageJsonUpdates, ()=>pendingVersion);
 /** Directory a newly scaffolded migration lands in, before a release claims it. */ export const LATEST_MIGRATIONS_DIR = 'latest';
 /** Directory holding the migrations shipped by a given release. */ export const versionMigrationsDir = (version)=>`v${version}`;
 /**
@@ -78,9 +108,13 @@ const LATEST_KEY_PREFIX = `${LATEST_MIGRATIONS_DIR}-`;
     const generators = {};
     const backfilled = [];
     const moves = [];
+    // Reported alongside the migrations so the update's PR says an nx bump was
+    // dated, and so the caller knows there is something to commit.
+    const backfilledUpdates = Object.entries(migrations.packageJsonUpdates ?? {}).filter(([key, entry])=>entry.version === LATEST_MIGRATIONS_DIR && shippedVersions[key]).map(([key])=>key);
     for (const [key, entry] of Object.entries(migrations.generators ?? {})){
         const version = shippedVersions[key];
-        if (entry.version || !version) {
+        // Pinning an every-migration entry would stop it running on later upgrades.
+        if (entry.version || !version || entry.everyMigration) {
             generators[key] = entry;
             continue;
         }
@@ -118,11 +152,35 @@ const LATEST_KEY_PREFIX = `${LATEST_MIGRATIONS_DIR}-`;
     return {
         migrations: {
             ...migrations,
-            generators
+            generators,
+            ...migrations.packageJsonUpdates && {
+                packageJsonUpdates: resolvePackageJsonUpdateVersions(migrations.packageJsonUpdates, (key)=>shippedVersions[key])
+            }
         },
-        backfilled,
+        backfilled: [
+            ...backfilled,
+            ...backfilledUpdates
+        ],
         moves
     };
 };
+/**
+ * Record the version each `packageJsonUpdates` entry ships under, for those still
+ * holding `latest`.
+ *
+ * The key already identifies the entry — an nx bump is named for the nx version
+ * it moves to — so only the `version` field changes. Nothing is re-keyed, which
+ * is what lets one release's bump sit alongside the next without either being
+ * overwritten before it ships.
+ */ const resolvePackageJsonUpdateVersions = (packageJsonUpdates, resolve)=>Object.fromEntries(Object.entries(packageJsonUpdates).map(([key, entry])=>{
+        const version = entry.version === LATEST_MIGRATIONS_DIR ? resolve(key) : undefined;
+        return [
+            key,
+            version ? {
+                ...entry,
+                version
+            } : entry
+        ];
+    }));
 
 //# sourceMappingURL=migration-versions.js.map