@aws/nx-plugin 1.0.0-rc.55 → 1.0.0-rc.57

package/src/utils/agent-core-constructs/files/cdk/app/agent-core/__nameKebabCase__/__nameKebabCase__.ts.template

@@ -1,6 +1,17 @@
-import { Fn, Lazy, Names, Stack } from 'aws-cdk-lib';
+import { Fn, Lazy, Names<%_ if (session === 's3') { _%>, RemovalPolicy<%_ } _%>, Stack } from 'aws-cdk-lib';
 import { Platform } from 'aws-cdk-lib/aws-ecr-assets';
 import { Connections, IConnectable } from 'aws-cdk-lib/aws-ec2';
+<%_ if (session === 's3') { _%>
+import { BlockPublicAccess, Bucket, BucketEncryption } from 'aws-cdk-lib/aws-s3';
+import { Key } from 'aws-cdk-lib/aws-kms';
+import {
+  CfnDelivery,
+  CfnDeliveryDestination,
+  CfnDeliverySource,
+  LogGroup,
+  RetentionDays,
+} from 'aws-cdk-lib/aws-logs';
+<%_ } _%>
 import { Construct } from 'constructs';
 import * as path from 'path';
 import * as url from 'url';
@@ -13,10 +24,13 @@ import {
   RuntimeAuthorizerConfiguration,
 <%_ } _%>
 } from 'aws-cdk-lib/aws-bedrockagentcore';
-import { <%_ if (serverProtocol !== 'mcp') { _%>PolicyStatement, <%_ } _%>IGrantable, IPrincipal<%_ if (auth === 'iam') { _%>, Grant<%_ } _%> } from 'aws-cdk-lib/aws-iam';
+import { <%_ if (serverProtocol !== 'mcp') { _%>PolicyStatement, <%_ } _%><%_ if (session === 's3') { _%>Effect, ServicePrincipal, <%_ } _%>IGrantable, IPrincipal<%_ if (auth === 'iam') { _%>, Grant<%_ } _%> } from 'aws-cdk-lib/aws-iam';
 <%_ if (auth === 'cognito') { _%>
 import { IUserPool, IUserPoolClient } from 'aws-cdk-lib/aws-cognito';
 <%_ } _%>
+<%_ if (session === 's3') { _%>
+import { suppressRules } from '../../../core/checkov<% if (esm) { %>.js<% } %>';
+<%_ } _%>
 import { RuntimeConfig } from '../../../core/runtime-config<% if (esm) { %>.js<% } %>';
 import { findWorkspaceRoot } from '../../../core/workspace<% if (esm) { %>.js<% } %>';
 
@@ -72,6 +86,111 @@ export class <%- nameClassName %> extends Construct implements IGrantable, IConn
 <%_ if (auth === 'cognito') { _%>
     const { identity, ...restProps } = props;
 
+<%_ } _%>
+<%_ if (session === 's3') { _%>
+    const sessionKey = new Key(this, 'SessionKey', {
+      enableKeyRotation: true,
+    });
+
+    // Allow CloudWatch Logs to use the session key for server access log delivery.
+    const stack = Stack.of(this);
+    sessionKey.addToResourcePolicy(
+      new PolicyStatement({
+        effect: Effect.ALLOW,
+        principals: [new ServicePrincipal(`logs.${stack.region}.amazonaws.com`)],
+        actions: [
+          'kms:Encrypt',
+          'kms:Decrypt',
+          'kms:ReEncrypt*',
+          'kms:GenerateDataKey*',
+          'kms:DescribeKey',
+        ],
+        resources: ['*'],
+        conditions: {
+          ArnLike: {
+            'kms:EncryptionContext:aws:logs:arn': `arn:aws:logs:${stack.region}:${stack.account}:log-group:*`,
+          },
+        },
+      }),
+    );
+
+    const sessionAccessLogs = new LogGroup(this, 'SessionAccessLogs', {
+      retention: RetentionDays.ONE_YEAR,
+      encryptionKey: sessionKey,
+      removalPolicy: RemovalPolicy.DESTROY,
+    });
+
+    const sessionBucket = new Bucket(this, 'SessionBucket', {
+      enforceSSL: true,
+      removalPolicy: RemovalPolicy.RETAIN,
+      encryption: BucketEncryption.KMS,
+      encryptionKey: sessionKey,
+      blockPublicAccess: BlockPublicAccess.BLOCK_ALL,
+    });
+    suppressRules(
+      sessionBucket,
+      ['CKV_AWS_21'],
+      'Session data does not need versioning enabled',
+    );
+    suppressRules(
+      sessionBucket,
+      ['CKV2_AWS_61'],
+      'Lifecycle configuration not required for session data',
+    );
+    suppressRules(
+      sessionBucket,
+      ['CKV_AWS_144'],
+      'Cross-region replication not required for session data',
+    );
+    suppressRules(
+      sessionBucket,
+      ['CKV2_AWS_62'],
+      'Event notifications not required for session data',
+    );
+    suppressRules(
+      sessionBucket,
+      ['CKV_AWS_18'],
+      'Server access logs are delivered to CloudWatch Logs',
+    );
+
+    const sessionAccessLogsSource: CfnDeliverySource = new CfnDeliverySource(
+      this,
+      'SessionAccessLogsSource',
+      {
+        name: Lazy.string({
+          produce: () =>
+            Names.uniqueResourceName(sessionAccessLogsSource, {
+              maxLength: 60,
+            }),
+        }),
+        logType: 'S3_SERVER_ACCESS_LOGS',
+        resourceArn: sessionBucket.bucketArn,
+      },
+    );
+    const sessionBucketPolicy = sessionBucket.policy;
+    if (sessionBucketPolicy) {
+      sessionAccessLogsSource.node.addDependency(sessionBucketPolicy);
+    }
+    const sessionAccessLogsDestination: CfnDeliveryDestination =
+      new CfnDeliveryDestination(this, 'SessionAccessLogsDestination', {
+        name: Lazy.string({
+          produce: () =>
+            Names.uniqueResourceName(sessionAccessLogsDestination, {
+              maxLength: 60,
+            }),
+        }),
+        destinationResourceArn: sessionAccessLogs.logGroupArn,
+      });
+    const sessionAccessLogsDelivery = new CfnDelivery(
+      this,
+      'SessionAccessLogsDelivery',
+      {
+        deliverySourceName: sessionAccessLogsSource.name,
+        deliveryDestinationArn: sessionAccessLogsDestination.attrArn,
+      },
+    );
+    sessionAccessLogsDelivery.addDependency(sessionAccessLogsSource);
+
 <%_ } _%>
     this.agentCoreRuntime = new Runtime(this, '<%- nameClassName %>', {
       runtimeName: Lazy.string({
@@ -114,12 +233,21 @@ export class <%- nameClassName %> extends Construct implements IGrantable, IConn
       }),
     );
 
+<%_ } _%>
+<%_ if (session === 's3') { _%>
+    sessionBucket.grantReadWrite(this.agentCoreRuntime);
+
 <%_ } _%>
     rc.grantReadAppConfig(this.agentCoreRuntime);
 
     rc.set('agentcore', 'agentRuntimes', {
       ...rc.get('agentcore').agentRuntimes,
-      <%- nameClassName %>: this.agentCoreRuntime.agentRuntimeArn,
+      <%- nameClassName %>: {
+        arn: this.agentCoreRuntime.agentRuntimeArn,
+<%_ if (session === 's3') { _%>
+        session: { bucketName: sessionBucket.bucketName },
+<%_ } _%>
+      },
     });
   }
 

package/src/utils/agent-core-constructs/files/terraform/app/agent-core/__nameKebabCase__/__nameKebabCase__.tf.template

@@ -1,3 +1,14 @@
+<%_ if (session === 's3') { _%>
+terraform {
+  required_providers {
+    random = {
+      source  = "hashicorp/random"
+      version = "<%- randomProviderVersion %>"
+    }
+  }
+}
+
+<%_ } _%>
 variable "env" {
   description = "Environment variables to pass to the agent core runtime"
   type        = map(string)
@@ -60,11 +71,156 @@ variable "user_pool_client_ids" {
   type        = list(string)
 }
 
+<%_ } _%>
+<%_ if (auth === 'cognito' || session === 's3') { _%>
 data "aws_region" "current" {}
+<%_ } _%>
+<%_ if (session === 's3') { _%>
+data "aws_caller_identity" "current" {}
+<%_ } _%>
+<%_ if (auth === 'cognito') { _%>
 
 locals {
   aws_region = data.aws_region.current.id
 }
+<%_ } _%>
+<%_ if (session === 's3') { _%>
+
+locals {
+  # Delivery source/destination names have a 60 character maximum. Truncate
+  # the agent name so these stay within the limit.
+  session_access_logs_name_prefix = substr("<%= nameKebabCase %>", 0, 30)
+}
+
+# Uniquifies resource names below so this construct can be deployed more than
+# once (e.g. across stages) within the same account/region.
+resource "random_id" "session_unique_suffix" {
+  byte_length = 4
+}
+
+# KMS key encrypting the session bucket and its server access logs.
+resource "aws_kms_key" "session" {
+  description             = "KMS key for <%= nameKebabCase %> agent session data"
+  enable_key_rotation     = true
+  deletion_window_in_days = 7
+
+  policy = jsonencode({
+    Version = "2012-10-17"
+    Statement = [
+      {
+        Sid       = "EnableIAMUserPermissions"
+        Effect    = "Allow"
+        Principal = { AWS = "arn:aws:iam::${data.aws_caller_identity.current.account_id}:root" }
+        Action    = "kms:*"
+        Resource  = "*"
+      },
+      {
+        Sid       = "AllowCloudWatchLogs"
+        Effect    = "Allow"
+        Principal = { Service = "logs.${data.aws_region.current.region}.amazonaws.com" }
+        Action = [
+          "kms:Encrypt",
+          "kms:Decrypt",
+          "kms:ReEncrypt*",
+          "kms:GenerateDataKey*",
+          "kms:DescribeKey"
+        ]
+        Resource = "*"
+        Condition = {
+          ArnLike = {
+            "kms:EncryptionContext:aws:logs:arn" = "arn:aws:logs:${data.aws_region.current.region}:${data.aws_caller_identity.current.account_id}:log-group:*"
+          }
+        }
+      }
+    ]
+  })
+
+  tags = var.tags
+}
+
+# CloudWatch log group receiving the session bucket's server access logs.
+resource "aws_cloudwatch_log_group" "session_access_logs" {
+  name              = "/aws/s3/<%= nameKebabCase %>-session-access-logs-${random_id.session_unique_suffix.hex}"
+  retention_in_days = 365
+  kms_key_id        = aws_kms_key.session.arn
+
+  tags = var.tags
+}
+
+# Bucket storing the agent's session data
+resource "aws_s3_bucket" "session" {
+  #checkov:skip=CKV2_AWS_61:Lifecycle configuration not required for session data
+  #checkov:skip=CKV_AWS_144:Cross-region replication not required for session data
+  #checkov:skip=CKV2_AWS_62:Event notifications not required for session data
+  #checkov:skip=CKV_AWS_18:Server access logs are delivered to CloudWatch Logs (see aws_cloudwatch_log_delivery.session)
+  #checkov:skip=CKV_AWS_21:Session data does not need versioning enabled
+  force_destroy = false
+}
+
+resource "aws_s3_bucket_server_side_encryption_configuration" "session" {
+  bucket = aws_s3_bucket.session.id
+
+  rule {
+    apply_server_side_encryption_by_default {
+      kms_master_key_id = aws_kms_key.session.arn
+      sse_algorithm     = "aws:kms"
+    }
+  }
+}
+
+resource "aws_s3_bucket_public_access_block" "session" {
+  bucket = aws_s3_bucket.session.id
+
+  block_public_acls       = true
+  block_public_policy     = true
+  ignore_public_acls      = true
+  restrict_public_buckets = true
+}
+
+resource "aws_s3_bucket_policy" "session" {
+  bucket = aws_s3_bucket.session.id
+
+  policy = jsonencode({
+    Version = "2012-10-17"
+    Statement = [
+      {
+        Sid       = "DenyInsecureConnections"
+        Effect    = "Deny"
+        Principal = "*"
+        Action    = "s3:*"
+        Resource = [
+          aws_s3_bucket.session.arn,
+          "${aws_s3_bucket.session.arn}/*"
+        ]
+        Condition = {
+          Bool = {
+            "aws:SecureTransport" = "false"
+          }
+        }
+      }
+    ]
+  })
+}
+
+# Deliver the session bucket's server access logs to CloudWatch Logs.
+resource "aws_cloudwatch_log_delivery_source" "session" {
+  name         = "${local.session_access_logs_name_prefix}-access-logs-source-${random_id.session_unique_suffix.hex}"
+  log_type     = "S3_SERVER_ACCESS_LOGS"
+  resource_arn = aws_s3_bucket.session.arn
+}
+
+resource "aws_cloudwatch_log_delivery_destination" "session" {
+  name = "${local.session_access_logs_name_prefix}-access-logs-dest-${random_id.session_unique_suffix.hex}"
+
+  delivery_destination_configuration {
+    destination_resource_arn = aws_cloudwatch_log_group.session_access_logs.arn
+  }
+}
+
+resource "aws_cloudwatch_log_delivery" "session" {
+  delivery_source_name     = aws_cloudwatch_log_delivery_source.session.name
+  delivery_destination_arn = aws_cloudwatch_log_delivery_destination.session.arn
+}
 
 <%_ } _%>
 module "agent_core_runtime" {
@@ -107,6 +263,29 @@ module "agent_core_runtime" {
         "arn:aws:bedrock:*:*:foundation-model/*",
         "arn:aws:bedrock:*:*:inference-profile/*"
       ]
+    }<% } %><% if (session === 's3') { %>,
+    # Grant access for the agent to read/write its session data
+    {
+      Effect = "Allow"
+      Action = [
+        "s3:GetObject",
+        "s3:PutObject",
+        "s3:DeleteObject",
+        "s3:ListBucket"
+      ]
+      Resource = [
+        aws_s3_bucket.session.arn,
+        "${aws_s3_bucket.session.arn}/*"
+      ]
+    },
+    # Grant access for the agent to use the session bucket's KMS key
+    {
+      Effect = "Allow"
+      Action = [
+        "kms:Decrypt",
+        "kms:GenerateDataKey*"
+      ]
+      Resource = [aws_kms_key.session.arn]
     }<% } %>
   ], var.additional_iam_policy_statements)
   tags = var.tags
@@ -118,7 +297,7 @@ module "add_agent_runtime_to_runtime_config" {
 
   namespace = "agentcore"
   key       = "agentRuntimes"
-  value     = { "<%= nameClassName %>" = module.agent_core_runtime.agent_core_runtime_arn }
+  value     = { "<%= nameClassName %>" = { arn = module.agent_core_runtime.agent_core_runtime_arn<% if (session === 's3') { %>, session = { bucketName = aws_s3_bucket.session.bucket }<% } %> } }
 
   depends_on = [module.agent_core_runtime]
 }

package/src/utils/ast.d.ts

@@ -54,6 +54,11 @@ export declare const matchGritQL: (tree: Tree, filePath: string, pattern: string
  * matches. The file is not modified.
  */
 export declare const captureGritQL: (tree: Tree, filePath: string, pattern: string) => Promise<string | undefined>;
+/**
+ * Like `captureGritQL`, but returns one metavariable's binding (e.g. `mod`
+ * for `$mod`) instead of the whole matched node.
+ */
+export declare const captureGritQLVariable: (tree: Tree, filePath: string, pattern: string, variableName: string) => Promise<string | undefined>;
 /**
  * Return the text of every node matching the GritQL pattern, in document order.
  */

package/src/utils/ast.js

@@ -226,6 +226,31 @@ export const addDestructuredImport = async (tree, filePath, variableNames, from)
     }
     return captured;
 };
+/**
+ * Like `captureGritQL`, but returns one metavariable's binding (e.g. `mod`
+ * for `$mod`) instead of the whole matched node.
+ */ export const captureGritQLVariable = async (tree, filePath, pattern, variableName)=>{
+    if (!tree.exists(filePath)) return undefined;
+    ensureGritDir(tree);
+    const source = tree.read(filePath).toString();
+    // The underlying binding lookup requires the `$` sigil.
+    const name = variableName.startsWith('$') ? variableName : `$${variableName}`;
+    let captured;
+    try {
+        const query = new QueryBuilder(pattern);
+        query.filter((node)=>{
+            captured ??= node.var(name) ?? undefined;
+            return true;
+        });
+        await query.applyToFile({
+            path: filePath,
+            content: source
+        });
+    } catch  {
+        return undefined;
+    }
+    return captured;
+};
 /**
  * Return the text of every node matching the GritQL pattern, in document order.
  */ export const captureAllGritQL = async (tree, filePath, pattern)=>{

package/src/utils/ast.js.map

@@ -1 +1 @@
-{"version":3,"sources":["../../../../../packages/nx-plugin/src/utils/ast.ts"],"sourcesContent":["/**\n * Copyright Amazon.com, Inc. or its affiliates. All Rights Reserved.\n * SPDX-License-Identifier: Apache-2.0\n */\n\nimport { QueryBuilder } from '@getgrit/gritql';\nimport type { Tree } from '@nx/devkit';\nimport * as path from 'path';\nimport { updateGitIgnore } from './git';\nimport { isEsmWorkspace } from './module-format';\n\nconst GRIT_DIR = '.grit';\n\n/**\n * Normalize a relative module specifier for the workspace's module format.\n * ESM (`nodenext`) requires an explicit `.js` extension on relative imports;\n * CommonJS (`node16`) resolves them extensionless. Callers always pass the ESM\n * form (with `.js`); this strips the extension for CommonJS workspaces.\n */\nconst normalizeModuleSpecifier = (tree: Tree, from: string): string => {\n  if (isEsmWorkspace(tree)) {\n    return from;\n  }\n  const isRelative = from.startsWith('./') || from.startsWith('../');\n  return isRelative && from.endsWith('.js')\n    ? from.slice(0, -'.js'.length)\n    : from;\n};\n\n// Pin the gritql native library's \"global\" stdlib directory to <workspace>/.grit so it doesn't try to write to /usr/local/.grit (or wherever node's grandparent resolves to).\nconst ensureGritDir = (tree: Tree) => {\n  process.env.GRIT_GLOBAL_DIR ??= path.join(tree.root, GRIT_DIR);\n  updateGitIgnore(tree, '.', (patterns) => [...patterns, GRIT_DIR]);\n};\n\nconst assertFilePath = (tree: Tree, filePath: string) => {\n  if (!tree.exists(filePath)) {\n    throw new Error(`No file located at ${filePath}`);\n  }\n};\n\nexport const addDestructuredImport = async (\n  tree: Tree,\n  filePath: string,\n  variableNames: string[],\n  from: string,\n) => {\n  assertFilePath(tree, filePath);\n  from = normalizeModuleSpecifier(tree, from);\n\n  // Check if there's an existing import from this module\n  const hasExistingImport = await matchGritQL(\n    tree,\n    filePath,\n    `\\`import { $_ } from '${from}'\\``,\n  );\n\n  if (hasExistingImport) {\n    // For each new variable, use GritQL rewrite to add it if not already present\n    for (const variableName of variableNames) {\n      const localName = variableName.includes(' as ')\n        ? variableName.split(' as ')[1]\n        : variableName;\n      // Use rewrite (=>) which correctly handles comma-separated import specifier lists\n      await applyGritQL(\n        tree,\n        filePath,\n        `\\`import { $imports } from '${from}'\\` => \\`import { $imports, ${variableName} } from '${from}'\\` where { $imports <: not contains \\`${localName}\\` }`,\n      );\n    }\n  } else {\n    // No existing import — prepend a new one (after shebang if present)\n    const specifiers = variableNames.join(', ');\n    const contents = tree.read(filePath)!.toString();\n    const newImport = `import { ${specifiers} } from '${from}';\\n`;\n    if (contents.startsWith('#!')) {\n      const newlineIndex = contents.indexOf('\\n');\n      tree.write(\n        filePath,\n        `${contents.substring(0, newlineIndex + 1)}${newImport}${contents.substring(newlineIndex + 1)}`,\n      );\n    } else {\n      tree.write(filePath, `${newImport}${contents}`);\n    }\n  }\n};\n\n/**\n * Ensure a Python `from <module> import <name1>, <name2>, ...` statement\n * exists in the given file. If the module already has a `from <module> import`\n * line, any missing names are appended; otherwise a fresh import statement is\n * prepended to the file (ruff's import sorter will reorder it into place on\n * the next format pass).\n *\n * We try to append first (which only succeeds if an import-from for the\n * module already exists AND the name isn't yet in the list). If nothing\n * was rewritten after trying every requested name, we fall back to checking\n * whether the module is imported at all; if not, we prepend a fresh\n * `from <module> import ...` line.\n */\nexport const addPythonDestructuredImport = async (\n  tree: Tree,\n  filePath: string,\n  variableNames: string[],\n  from: string,\n) => {\n  assertFilePath(tree, filePath);\n\n  // Determine whether there's any `from <module> import ...` line in the file.\n  // We detect this by attempting a no-op transformation — the file is unchanged,\n  // but a successful match tells us the line exists.\n  const beforeContents = tree.read(filePath)!.toString();\n  let moduleAlreadyImported = false;\n  for (const variableName of variableNames) {\n    // Appends the name if the import-from exists and the name isn't already there.\n    const appended = await applyGritQL(\n      tree,\n      filePath,\n      `language python\\n\\`from ${from} import $names\\` where { $names <: not contains \\`${variableName}\\`, $names += \\`, ${variableName}\\` }`,\n    );\n    if (appended) {\n      moduleAlreadyImported = true;\n    }\n  }\n\n  // If the append succeeded for at least one name, we know the module line\n  // exists; we're done. If nothing was appended we need to distinguish\n  // between \"module not imported\" (need to add a new line) and \"module\n  // imported but all names already present\" (no-op).\n  if (moduleAlreadyImported) {\n    return;\n  }\n\n  const allAlreadyPresent = await matchGritQL(\n    tree,\n    filePath,\n    `language python\\n\\`from ${from} import $names\\` where { ${variableNames\n      .map((n) => `$names <: contains \\`${n}\\``)\n      .join(', ')} }`,\n  );\n  if (allAlreadyPresent) {\n    return;\n  }\n\n  // No existing `from <module> import` line — prepend one. Ruff's import\n  // sorter will place it in the right group on the next formatter pass.\n  const specifiers = variableNames.join(', ');\n  tree.write(filePath, `from ${from} import ${specifiers}\\n${beforeContents}`);\n};\n\n/**\n * Adds an `import <variableName> from '<from>'; statement to the beginning of the file,\n * if it doesn't already exist\n */\nexport const addSingleImport = async (\n  tree: Tree,\n  filePath: string,\n  variableName: string,\n  from: string,\n) => {\n  assertFilePath(tree, filePath);\n  from = normalizeModuleSpecifier(tree, from);\n\n  // Check if default import already exists using GritQL\n  const alreadyImported = await matchGritQL(\n    tree,\n    filePath,\n    `\\`import ${variableName} from '${from}'\\``,\n  );\n  if (alreadyImported) {\n    return;\n  }\n\n  // Prepend new import to file\n  const contents = tree.read(filePath)!.toString();\n  tree.write(filePath, `import ${variableName} from '${from}';\\n${contents}`);\n};\n\n/**\n * Adds an `export * from '<from>'; statement to the given TypeScript file.\n * Note that this will create the file if it does not exist in the tree.\n */\nexport const addStarExport = async (\n  tree: Tree,\n  filePath: string,\n  from: string,\n) => {\n  from = normalizeModuleSpecifier(tree, from);\n  const contents = tree.read(filePath)?.toString() ?? '';\n\n  // For empty/non-existent files, just write the export\n  if (!contents.trim()) {\n    tree.write(filePath, `export * from '${from}';\\n`);\n    return;\n  }\n\n  // Check if already exported using GritQL\n  const alreadyExported = await matchGritQL(\n    tree,\n    filePath,\n    `\\`export * from '${from}'\\``,\n  );\n  if (alreadyExported) {\n    return;\n  }\n\n  // Prepend new export to file\n  tree.write(filePath, `export * from '${from}';\\n${contents}`);\n};\n\n/**\n * Return whether or not the given identifier is exported in the source file.\n * Checks for both `export { Identifier }` and `export type Identifier = ...`.\n */\nexport const hasExportDeclaration = async (\n  tree: Tree,\n  source: string,\n  identifierName: string,\n): Promise<boolean> => {\n  ensureGritDir(tree);\n  const patterns = [\n    `\\`export type ${identifierName} = $_\\``,\n    `\\`export { ${identifierName} }\\``,\n    `\\`export type { ${identifierName} } from $_\\``,\n  ];\n\n  for (const pattern of patterns) {\n    try {\n      const q = new QueryBuilder(`$p => $p where { $p <: ${pattern} }`);\n      const result = await q.applyToFile({\n        path: 'check.ts',\n        content: source,\n      });\n      if (result !== null) return true;\n    } catch {\n      // Pattern didn't match, try next\n    }\n  }\n\n  return false;\n};\n\n/**\n * Apply a GritQL pattern to a file in the Nx tree.\n */\nexport const applyGritQL = async (\n  tree: Tree,\n  filePath: string,\n  pattern: string,\n): Promise<boolean> => {\n  if (!tree.exists(filePath)) throw new Error(`No file at ${filePath}`);\n  ensureGritDir(tree);\n  const source = tree.read(filePath)!.toString();\n  const query = new QueryBuilder(pattern);\n  const result = await query.applyToFile({ path: filePath, content: source });\n  if (result && result.content !== source) {\n    tree.write(filePath, result.content);\n    return true;\n  }\n  return false;\n};\n\n/**\n * Check whether a GritQL pattern matches anywhere in a file.\n * Returns true if the pattern matches at least once.\n *\n * Accepts raw GritQL, including patterns that start with a `language <name>`\n * header (e.g. `language python\\n\\`print($_)\\``) — the pattern is passed\n * straight through to QueryBuilder without any wrapping rewrite.\n */\nexport const matchGritQL = async (\n  tree: Tree,\n  filePath: string,\n  pattern: string,\n): Promise<boolean> => {\n  if (!tree.exists(filePath)) return false;\n  ensureGritDir(tree);\n  const source = tree.read(filePath)!.toString();\n  let matched = false;\n  try {\n    const query = new QueryBuilder(pattern);\n    query.filter(() => {\n      matched = true;\n      return true;\n    });\n    await query.applyToFile({ path: filePath, content: source });\n  } catch {\n    return false;\n  }\n  return matched;\n};\n\n/**\n * Capture the source text of the first match of a GritQL pattern.\n *\n * For example `` `dependencyCheck: $_` `` returns the whole\n * `dependencyCheck: { ... }` property text. Returns undefined if nothing\n * matches. The file is not modified.\n */\nexport const captureGritQL = async (\n  tree: Tree,\n  filePath: string,\n  pattern: string,\n): Promise<string | undefined> => {\n  if (!tree.exists(filePath)) return undefined;\n  ensureGritDir(tree);\n  const source = tree.read(filePath)!.toString();\n  let captured: string | undefined;\n  try {\n    const query = new QueryBuilder(pattern);\n    query.filter((node) => {\n      captured ??= node.text();\n      return true;\n    });\n    await query.applyToFile({ path: filePath, content: source });\n  } catch {\n    return undefined;\n  }\n  return captured;\n};\n\n/**\n * Return the text of every node matching the GritQL pattern, in document order.\n */\nexport const captureAllGritQL = async (\n  tree: Tree,\n  filePath: string,\n  pattern: string,\n): Promise<string[]> => {\n  if (!tree.exists(filePath)) return [];\n  ensureGritDir(tree);\n  const source = tree.read(filePath)!.toString();\n  const captured: string[] = [];\n  try {\n    const query = new QueryBuilder(pattern);\n    query.filter((node) => {\n      captured.push(node.text());\n      return true;\n    });\n    await query.applyToFile({ path: filePath, content: source });\n  } catch {\n    return [];\n  }\n  return captured;\n};\n\n/**\n * A unique token that is a valid identifier, so it can stand in for an array\n * element or object property inside a GritQL rewrite.\n */\nexport const GRIT_INSERT_PLACEHOLDER = '__GRIT_INSERT_PLACEHOLDER__';\n\n/**\n * Apply a GritQL rewrite that inserts {@link GRIT_INSERT_PLACEHOLDER}, then\n * replace the placeholder with `text`. Routing user-provided text through a\n * placeholder keeps it out of the GritQL pattern, where quotes, backticks or\n * `${...}` would otherwise break parsing.\n *\n * Any separator (e.g. a leading `, ` when appending to an array) must be part\n * of the GritQL pattern, not `text`. The one adjustment made here: if the\n * placeholder lands after a trailing line comment (`// ...`) — which would\n * comment out the text — the text is moved to its own line.\n *\n * The caller formats afterwards. Returns true if the pattern matched and the\n * file changed.\n */\nexport const insertViaGritQL = async (\n  tree: Tree,\n  filePath: string,\n  pattern: string,\n  text: string,\n): Promise<boolean> => {\n  if (!(await applyGritQL(tree, filePath, pattern))) return false;\n  const content = tree.read(filePath)!.toString();\n  const at = content.indexOf(GRIT_INSERT_PLACEHOLDER);\n  const lineSoFar = content.slice(content.lastIndexOf('\\n', at) + 1, at);\n  const replacement = lineSoFar.includes('//') ? `\\n${text}` : text;\n\n  // Function replacer so `$` in `text` isn't treated as a replacement pattern.\n  tree.write(\n    filePath,\n    content.replace(GRIT_INSERT_PLACEHOLDER, () => replacement),\n  );\n  return true;\n};\n"],"names":["QueryBuilder","path","updateGitIgnore","isEsmWorkspace","GRIT_DIR","normalizeModuleSpecifier","tree","from","isRelative","startsWith","endsWith","slice","length","ensureGritDir","process","env","GRIT_GLOBAL_DIR","join","root","patterns","assertFilePath","filePath","exists","Error","addDestructuredImport","variableNames","hasExistingImport","matchGritQL","variableName","localName","includes","split","applyGritQL","specifiers","contents","read","toString","newImport","newlineIndex","indexOf","write","substring","addPythonDestructuredImport","beforeContents","moduleAlreadyImported","appended","allAlreadyPresent","map","n","addSingleImport","alreadyImported","addStarExport","trim","alreadyExported","hasExportDeclaration","source","identifierName","pattern","q","result","applyToFile","content","query","matched","filter","captureGritQL","undefined","captured","node","text","captureAllGritQL","push","GRIT_INSERT_PLACEHOLDER","insertViaGritQL","at","lineSoFar","lastIndexOf","replacement","replace"],"mappings":"AAAA;;;CAGC,GAED,SAASA,YAAY,QAAQ,kBAAkB;AAE/C,YAAYC,UAAU,OAAO;AAC7B,SAASC,eAAe,QAAQ,WAAQ;AACxC,SAASC,cAAc,QAAQ,qBAAkB;AAEjD,MAAMC,WAAW;AAEjB;;;;;CAKC,GACD,MAAMC,2BAA2B,CAACC,MAAYC;IAC5C,IAAIJ,eAAeG,OAAO;QACxB,OAAOC;IACT;IACA,MAAMC,aAAaD,KAAKE,UAAU,CAAC,SAASF,KAAKE,UAAU,CAAC;IAC5D,OAAOD,cAAcD,KAAKG,QAAQ,CAAC,SAC/BH,KAAKI,KAAK,CAAC,GAAG,CAAC,MAAMC,MAAM,IAC3BL;AACN;AAEA,8KAA8K;AAC9K,MAAMM,gBAAgB,CAACP;IACrBQ,QAAQC,GAAG,CAACC,eAAe,KAAKf,KAAKgB,IAAI,CAACX,KAAKY,IAAI,EAAEd;IACrDF,gBAAgBI,MAAM,KAAK,CAACa,WAAa;eAAIA;YAAUf;SAAS;AAClE;AAEA,MAAMgB,iBAAiB,CAACd,MAAYe;IAClC,IAAI,CAACf,KAAKgB,MAAM,CAACD,WAAW;QAC1B,MAAM,IAAIE,MAAM,CAAC,mBAAmB,EAAEF,UAAU;IAClD;AACF;AAEA,OAAO,MAAMG,wBAAwB,OACnClB,MACAe,UACAI,eACAlB;IAEAa,eAAed,MAAMe;IACrBd,OAAOF,yBAAyBC,MAAMC;IAEtC,uDAAuD;IACvD,MAAMmB,oBAAoB,MAAMC,YAC9BrB,MACAe,UACA,CAAC,sBAAsB,EAAEd,KAAK,GAAG,CAAC;IAGpC,IAAImB,mBAAmB;QACrB,6EAA6E;QAC7E,KAAK,MAAME,gBAAgBH,cAAe;YACxC,MAAMI,YAAYD,aAAaE,QAAQ,CAAC,UACpCF,aAAaG,KAAK,CAAC,OAAO,CAAC,EAAE,GAC7BH;YACJ,kFAAkF;YAClF,MAAMI,YACJ1B,MACAe,UACA,CAAC,4BAA4B,EAAEd,KAAK,4BAA4B,EAAEqB,aAAa,SAAS,EAAErB,KAAK,uCAAuC,EAAEsB,UAAU,IAAI,CAAC;QAE3J;IACF,OAAO;QACL,oEAAoE;QACpE,MAAMI,aAAaR,cAAcR,IAAI,CAAC;QACtC,MAAMiB,WAAW5B,KAAK6B,IAAI,CAACd,UAAWe,QAAQ;QAC9C,MAAMC,YAAY,CAAC,SAAS,EAAEJ,WAAW,SAAS,EAAE1B,KAAK,IAAI,CAAC;QAC9D,IAAI2B,SAASzB,UAAU,CAAC,OAAO;YAC7B,MAAM6B,eAAeJ,SAASK,OAAO,CAAC;YACtCjC,KAAKkC,KAAK,CACRnB,UACA,GAAGa,SAASO,SAAS,CAAC,GAAGH,eAAe,KAAKD,YAAYH,SAASO,SAAS,CAACH,eAAe,IAAI;QAEnG,OAAO;YACLhC,KAAKkC,KAAK,CAACnB,UAAU,GAAGgB,YAAYH,UAAU;QAChD;IACF;AACF,EAAE;AAEF;;;;;;;;;;;;CAYC,GACD,OAAO,MAAMQ,8BAA8B,OACzCpC,MACAe,UACAI,eACAlB;IAEAa,eAAed,MAAMe;IAErB,6EAA6E;IAC7E,+EAA+E;IAC/E,mDAAmD;IACnD,MAAMsB,iBAAiBrC,KAAK6B,IAAI,CAACd,UAAWe,QAAQ;IACpD,IAAIQ,wBAAwB;IAC5B,KAAK,MAAMhB,gBAAgBH,cAAe;QACxC,+EAA+E;QAC/E,MAAMoB,WAAW,MAAMb,YACrB1B,MACAe,UACA,CAAC,wBAAwB,EAAEd,KAAK,kDAAkD,EAAEqB,aAAa,kBAAkB,EAAEA,aAAa,IAAI,CAAC;QAEzI,IAAIiB,UAAU;YACZD,wBAAwB;QAC1B;IACF;IAEA,yEAAyE;IACzE,qEAAqE;IACrE,qEAAqE;IACrE,mDAAmD;IACnD,IAAIA,uBAAuB;QACzB;IACF;IAEA,MAAME,oBAAoB,MAAMnB,YAC9BrB,MACAe,UACA,CAAC,wBAAwB,EAAEd,KAAK,yBAAyB,EAAEkB,cACxDsB,GAAG,CAAC,CAACC,IAAM,CAAC,qBAAqB,EAAEA,EAAE,EAAE,CAAC,EACxC/B,IAAI,CAAC,MAAM,EAAE,CAAC;IAEnB,IAAI6B,mBAAmB;QACrB;IACF;IAEA,uEAAuE;IACvE,sEAAsE;IACtE,MAAMb,aAAaR,cAAcR,IAAI,CAAC;IACtCX,KAAKkC,KAAK,CAACnB,UAAU,CAAC,KAAK,EAAEd,KAAK,QAAQ,EAAE0B,WAAW,EAAE,EAAEU,gBAAgB;AAC7E,EAAE;AAEF;;;CAGC,GACD,OAAO,MAAMM,kBAAkB,OAC7B3C,MACAe,UACAO,cACArB;IAEAa,eAAed,MAAMe;IACrBd,OAAOF,yBAAyBC,MAAMC;IAEtC,sDAAsD;IACtD,MAAM2C,kBAAkB,MAAMvB,YAC5BrB,MACAe,UACA,CAAC,SAAS,EAAEO,aAAa,OAAO,EAAErB,KAAK,GAAG,CAAC;IAE7C,IAAI2C,iBAAiB;QACnB;IACF;IAEA,6BAA6B;IAC7B,MAAMhB,WAAW5B,KAAK6B,IAAI,CAACd,UAAWe,QAAQ;IAC9C9B,KAAKkC,KAAK,CAACnB,UAAU,CAAC,OAAO,EAAEO,aAAa,OAAO,EAAErB,KAAK,IAAI,EAAE2B,UAAU;AAC5E,EAAE;AAEF;;;CAGC,GACD,OAAO,MAAMiB,gBAAgB,OAC3B7C,MACAe,UACAd;IAEAA,OAAOF,yBAAyBC,MAAMC;IACtC,MAAM2B,WAAW5B,KAAK6B,IAAI,CAACd,WAAWe,cAAc;IAEpD,sDAAsD;IACtD,IAAI,CAACF,SAASkB,IAAI,IAAI;QACpB9C,KAAKkC,KAAK,CAACnB,UAAU,CAAC,eAAe,EAAEd,KAAK,IAAI,CAAC;QACjD;IACF;IAEA,yCAAyC;IACzC,MAAM8C,kBAAkB,MAAM1B,YAC5BrB,MACAe,UACA,CAAC,iBAAiB,EAAEd,KAAK,GAAG,CAAC;IAE/B,IAAI8C,iBAAiB;QACnB;IACF;IAEA,6BAA6B;IAC7B/C,KAAKkC,KAAK,CAACnB,UAAU,CAAC,eAAe,EAAEd,KAAK,IAAI,EAAE2B,UAAU;AAC9D,EAAE;AAEF;;;CAGC,GACD,OAAO,MAAMoB,uBAAuB,OAClChD,MACAiD,QACAC;IAEA3C,cAAcP;IACd,MAAMa,WAAW;QACf,CAAC,cAAc,EAAEqC,eAAe,OAAO,CAAC;QACxC,CAAC,WAAW,EAAEA,eAAe,IAAI,CAAC;QAClC,CAAC,gBAAgB,EAAEA,eAAe,YAAY,CAAC;KAChD;IAED,KAAK,MAAMC,WAAWtC,SAAU;QAC9B,IAAI;YACF,MAAMuC,IAAI,IAAI1D,aAAa,CAAC,uBAAuB,EAAEyD,QAAQ,EAAE,CAAC;YAChE,MAAME,SAAS,MAAMD,EAAEE,WAAW,CAAC;gBACjC3D,MAAM;gBACN4D,SAASN;YACX;YACA,IAAII,WAAW,MAAM,OAAO;QAC9B,EAAE,OAAM;QACN,iCAAiC;QACnC;IACF;IAEA,OAAO;AACT,EAAE;AAEF;;CAEC,GACD,OAAO,MAAM3B,cAAc,OACzB1B,MACAe,UACAoC;IAEA,IAAI,CAACnD,KAAKgB,MAAM,CAACD,WAAW,MAAM,IAAIE,MAAM,CAAC,WAAW,EAAEF,UAAU;IACpER,cAAcP;IACd,MAAMiD,SAASjD,KAAK6B,IAAI,CAACd,UAAWe,QAAQ;IAC5C,MAAM0B,QAAQ,IAAI9D,aAAayD;IAC/B,MAAME,SAAS,MAAMG,MAAMF,WAAW,CAAC;QAAE3D,MAAMoB;QAAUwC,SAASN;IAAO;IACzE,IAAII,UAAUA,OAAOE,OAAO,KAAKN,QAAQ;QACvCjD,KAAKkC,KAAK,CAACnB,UAAUsC,OAAOE,OAAO;QACnC,OAAO;IACT;IACA,OAAO;AACT,EAAE;AAEF;;;;;;;CAOC,GACD,OAAO,MAAMlC,cAAc,OACzBrB,MACAe,UACAoC;IAEA,IAAI,CAACnD,KAAKgB,MAAM,CAACD,WAAW,OAAO;IACnCR,cAAcP;IACd,MAAMiD,SAASjD,KAAK6B,IAAI,CAACd,UAAWe,QAAQ;IAC5C,IAAI2B,UAAU;IACd,IAAI;QACF,MAAMD,QAAQ,IAAI9D,aAAayD;QAC/BK,MAAME,MAAM,CAAC;YACXD,UAAU;YACV,OAAO;QACT;QACA,MAAMD,MAAMF,WAAW,CAAC;YAAE3D,MAAMoB;YAAUwC,SAASN;QAAO;IAC5D,EAAE,OAAM;QACN,OAAO;IACT;IACA,OAAOQ;AACT,EAAE;AAEF;;;;;;CAMC,GACD,OAAO,MAAME,gBAAgB,OAC3B3D,MACAe,UACAoC;IAEA,IAAI,CAACnD,KAAKgB,MAAM,CAACD,WAAW,OAAO6C;IACnCrD,cAAcP;IACd,MAAMiD,SAASjD,KAAK6B,IAAI,CAACd,UAAWe,QAAQ;IAC5C,IAAI+B;IACJ,IAAI;QACF,MAAML,QAAQ,IAAI9D,aAAayD;QAC/BK,MAAME,MAAM,CAAC,CAACI;YACZD,aAAaC,KAAKC,IAAI;YACtB,OAAO;QACT;QACA,MAAMP,MAAMF,WAAW,CAAC;YAAE3D,MAAMoB;YAAUwC,SAASN;QAAO;IAC5D,EAAE,OAAM;QACN,OAAOW;IACT;IACA,OAAOC;AACT,EAAE;AAEF;;CAEC,GACD,OAAO,MAAMG,mBAAmB,OAC9BhE,MACAe,UACAoC;IAEA,IAAI,CAACnD,KAAKgB,MAAM,CAACD,WAAW,OAAO,EAAE;IACrCR,cAAcP;IACd,MAAMiD,SAASjD,KAAK6B,IAAI,CAACd,UAAWe,QAAQ;IAC5C,MAAM+B,WAAqB,EAAE;IAC7B,IAAI;QACF,MAAML,QAAQ,IAAI9D,aAAayD;QAC/BK,MAAME,MAAM,CAAC,CAACI;YACZD,SAASI,IAAI,CAACH,KAAKC,IAAI;YACvB,OAAO;QACT;QACA,MAAMP,MAAMF,WAAW,CAAC;YAAE3D,MAAMoB;YAAUwC,SAASN;QAAO;IAC5D,EAAE,OAAM;QACN,OAAO,EAAE;IACX;IACA,OAAOY;AACT,EAAE;AAEF;;;CAGC,GACD,OAAO,MAAMK,0BAA0B,8BAA8B;AAErE;;;;;;;;;;;;;CAaC,GACD,OAAO,MAAMC,kBAAkB,OAC7BnE,MACAe,UACAoC,SACAY;IAEA,IAAI,CAAE,MAAMrC,YAAY1B,MAAMe,UAAUoC,UAAW,OAAO;IAC1D,MAAMI,UAAUvD,KAAK6B,IAAI,CAACd,UAAWe,QAAQ;IAC7C,MAAMsC,KAAKb,QAAQtB,OAAO,CAACiC;IAC3B,MAAMG,YAAYd,QAAQlD,KAAK,CAACkD,QAAQe,WAAW,CAAC,MAAMF,MAAM,GAAGA;IACnE,MAAMG,cAAcF,UAAU7C,QAAQ,CAAC,QAAQ,CAAC,EAAE,EAAEuC,MAAM,GAAGA;IAE7D,6EAA6E;IAC7E/D,KAAKkC,KAAK,CACRnB,UACAwC,QAAQiB,OAAO,CAACN,yBAAyB,IAAMK;IAEjD,OAAO;AACT,EAAE"}
+{"version":3,"sources":["../../../../../packages/nx-plugin/src/utils/ast.ts"],"sourcesContent":["/**\n * Copyright Amazon.com, Inc. or its affiliates. All Rights Reserved.\n * SPDX-License-Identifier: Apache-2.0\n */\n\nimport { QueryBuilder } from '@getgrit/gritql';\nimport type { Tree } from '@nx/devkit';\nimport * as path from 'path';\nimport { updateGitIgnore } from './git';\nimport { isEsmWorkspace } from './module-format';\n\nconst GRIT_DIR = '.grit';\n\n/**\n * Normalize a relative module specifier for the workspace's module format.\n * ESM (`nodenext`) requires an explicit `.js` extension on relative imports;\n * CommonJS (`node16`) resolves them extensionless. Callers always pass the ESM\n * form (with `.js`); this strips the extension for CommonJS workspaces.\n */\nconst normalizeModuleSpecifier = (tree: Tree, from: string): string => {\n  if (isEsmWorkspace(tree)) {\n    return from;\n  }\n  const isRelative = from.startsWith('./') || from.startsWith('../');\n  return isRelative && from.endsWith('.js')\n    ? from.slice(0, -'.js'.length)\n    : from;\n};\n\n// Pin the gritql native library's \"global\" stdlib directory to <workspace>/.grit so it doesn't try to write to /usr/local/.grit (or wherever node's grandparent resolves to).\nconst ensureGritDir = (tree: Tree) => {\n  process.env.GRIT_GLOBAL_DIR ??= path.join(tree.root, GRIT_DIR);\n  updateGitIgnore(tree, '.', (patterns) => [...patterns, GRIT_DIR]);\n};\n\nconst assertFilePath = (tree: Tree, filePath: string) => {\n  if (!tree.exists(filePath)) {\n    throw new Error(`No file located at ${filePath}`);\n  }\n};\n\nexport const addDestructuredImport = async (\n  tree: Tree,\n  filePath: string,\n  variableNames: string[],\n  from: string,\n) => {\n  assertFilePath(tree, filePath);\n  from = normalizeModuleSpecifier(tree, from);\n\n  // Check if there's an existing import from this module\n  const hasExistingImport = await matchGritQL(\n    tree,\n    filePath,\n    `\\`import { $_ } from '${from}'\\``,\n  );\n\n  if (hasExistingImport) {\n    // For each new variable, use GritQL rewrite to add it if not already present\n    for (const variableName of variableNames) {\n      const localName = variableName.includes(' as ')\n        ? variableName.split(' as ')[1]\n        : variableName;\n      // Use rewrite (=>) which correctly handles comma-separated import specifier lists\n      await applyGritQL(\n        tree,\n        filePath,\n        `\\`import { $imports } from '${from}'\\` => \\`import { $imports, ${variableName} } from '${from}'\\` where { $imports <: not contains \\`${localName}\\` }`,\n      );\n    }\n  } else {\n    // No existing import — prepend a new one (after shebang if present)\n    const specifiers = variableNames.join(', ');\n    const contents = tree.read(filePath)!.toString();\n    const newImport = `import { ${specifiers} } from '${from}';\\n`;\n    if (contents.startsWith('#!')) {\n      const newlineIndex = contents.indexOf('\\n');\n      tree.write(\n        filePath,\n        `${contents.substring(0, newlineIndex + 1)}${newImport}${contents.substring(newlineIndex + 1)}`,\n      );\n    } else {\n      tree.write(filePath, `${newImport}${contents}`);\n    }\n  }\n};\n\n/**\n * Ensure a Python `from <module> import <name1>, <name2>, ...` statement\n * exists in the given file. If the module already has a `from <module> import`\n * line, any missing names are appended; otherwise a fresh import statement is\n * prepended to the file (ruff's import sorter will reorder it into place on\n * the next format pass).\n *\n * We try to append first (which only succeeds if an import-from for the\n * module already exists AND the name isn't yet in the list). If nothing\n * was rewritten after trying every requested name, we fall back to checking\n * whether the module is imported at all; if not, we prepend a fresh\n * `from <module> import ...` line.\n */\nexport const addPythonDestructuredImport = async (\n  tree: Tree,\n  filePath: string,\n  variableNames: string[],\n  from: string,\n) => {\n  assertFilePath(tree, filePath);\n\n  // Determine whether there's any `from <module> import ...` line in the file.\n  // We detect this by attempting a no-op transformation — the file is unchanged,\n  // but a successful match tells us the line exists.\n  const beforeContents = tree.read(filePath)!.toString();\n  let moduleAlreadyImported = false;\n  for (const variableName of variableNames) {\n    // Appends the name if the import-from exists and the name isn't already there.\n    const appended = await applyGritQL(\n      tree,\n      filePath,\n      `language python\\n\\`from ${from} import $names\\` where { $names <: not contains \\`${variableName}\\`, $names += \\`, ${variableName}\\` }`,\n    );\n    if (appended) {\n      moduleAlreadyImported = true;\n    }\n  }\n\n  // If the append succeeded for at least one name, we know the module line\n  // exists; we're done. If nothing was appended we need to distinguish\n  // between \"module not imported\" (need to add a new line) and \"module\n  // imported but all names already present\" (no-op).\n  if (moduleAlreadyImported) {\n    return;\n  }\n\n  const allAlreadyPresent = await matchGritQL(\n    tree,\n    filePath,\n    `language python\\n\\`from ${from} import $names\\` where { ${variableNames\n      .map((n) => `$names <: contains \\`${n}\\``)\n      .join(', ')} }`,\n  );\n  if (allAlreadyPresent) {\n    return;\n  }\n\n  // No existing `from <module> import` line — prepend one. Ruff's import\n  // sorter will place it in the right group on the next formatter pass.\n  const specifiers = variableNames.join(', ');\n  tree.write(filePath, `from ${from} import ${specifiers}\\n${beforeContents}`);\n};\n\n/**\n * Adds an `import <variableName> from '<from>'; statement to the beginning of the file,\n * if it doesn't already exist\n */\nexport const addSingleImport = async (\n  tree: Tree,\n  filePath: string,\n  variableName: string,\n  from: string,\n) => {\n  assertFilePath(tree, filePath);\n  from = normalizeModuleSpecifier(tree, from);\n\n  // Check if default import already exists using GritQL\n  const alreadyImported = await matchGritQL(\n    tree,\n    filePath,\n    `\\`import ${variableName} from '${from}'\\``,\n  );\n  if (alreadyImported) {\n    return;\n  }\n\n  // Prepend new import to file\n  const contents = tree.read(filePath)!.toString();\n  tree.write(filePath, `import ${variableName} from '${from}';\\n${contents}`);\n};\n\n/**\n * Adds an `export * from '<from>'; statement to the given TypeScript file.\n * Note that this will create the file if it does not exist in the tree.\n */\nexport const addStarExport = async (\n  tree: Tree,\n  filePath: string,\n  from: string,\n) => {\n  from = normalizeModuleSpecifier(tree, from);\n  const contents = tree.read(filePath)?.toString() ?? '';\n\n  // For empty/non-existent files, just write the export\n  if (!contents.trim()) {\n    tree.write(filePath, `export * from '${from}';\\n`);\n    return;\n  }\n\n  // Check if already exported using GritQL\n  const alreadyExported = await matchGritQL(\n    tree,\n    filePath,\n    `\\`export * from '${from}'\\``,\n  );\n  if (alreadyExported) {\n    return;\n  }\n\n  // Prepend new export to file\n  tree.write(filePath, `export * from '${from}';\\n${contents}`);\n};\n\n/**\n * Return whether or not the given identifier is exported in the source file.\n * Checks for both `export { Identifier }` and `export type Identifier = ...`.\n */\nexport const hasExportDeclaration = async (\n  tree: Tree,\n  source: string,\n  identifierName: string,\n): Promise<boolean> => {\n  ensureGritDir(tree);\n  const patterns = [\n    `\\`export type ${identifierName} = $_\\``,\n    `\\`export { ${identifierName} }\\``,\n    `\\`export type { ${identifierName} } from $_\\``,\n  ];\n\n  for (const pattern of patterns) {\n    try {\n      const q = new QueryBuilder(`$p => $p where { $p <: ${pattern} }`);\n      const result = await q.applyToFile({\n        path: 'check.ts',\n        content: source,\n      });\n      if (result !== null) return true;\n    } catch {\n      // Pattern didn't match, try next\n    }\n  }\n\n  return false;\n};\n\n/**\n * Apply a GritQL pattern to a file in the Nx tree.\n */\nexport const applyGritQL = async (\n  tree: Tree,\n  filePath: string,\n  pattern: string,\n): Promise<boolean> => {\n  if (!tree.exists(filePath)) throw new Error(`No file at ${filePath}`);\n  ensureGritDir(tree);\n  const source = tree.read(filePath)!.toString();\n  const query = new QueryBuilder(pattern);\n  const result = await query.applyToFile({ path: filePath, content: source });\n  if (result && result.content !== source) {\n    tree.write(filePath, result.content);\n    return true;\n  }\n  return false;\n};\n\n/**\n * Check whether a GritQL pattern matches anywhere in a file.\n * Returns true if the pattern matches at least once.\n *\n * Accepts raw GritQL, including patterns that start with a `language <name>`\n * header (e.g. `language python\\n\\`print($_)\\``) — the pattern is passed\n * straight through to QueryBuilder without any wrapping rewrite.\n */\nexport const matchGritQL = async (\n  tree: Tree,\n  filePath: string,\n  pattern: string,\n): Promise<boolean> => {\n  if (!tree.exists(filePath)) return false;\n  ensureGritDir(tree);\n  const source = tree.read(filePath)!.toString();\n  let matched = false;\n  try {\n    const query = new QueryBuilder(pattern);\n    query.filter(() => {\n      matched = true;\n      return true;\n    });\n    await query.applyToFile({ path: filePath, content: source });\n  } catch {\n    return false;\n  }\n  return matched;\n};\n\n/**\n * Capture the source text of the first match of a GritQL pattern.\n *\n * For example `` `dependencyCheck: $_` `` returns the whole\n * `dependencyCheck: { ... }` property text. Returns undefined if nothing\n * matches. The file is not modified.\n */\nexport const captureGritQL = async (\n  tree: Tree,\n  filePath: string,\n  pattern: string,\n): Promise<string | undefined> => {\n  if (!tree.exists(filePath)) return undefined;\n  ensureGritDir(tree);\n  const source = tree.read(filePath)!.toString();\n  let captured: string | undefined;\n  try {\n    const query = new QueryBuilder(pattern);\n    query.filter((node) => {\n      captured ??= node.text();\n      return true;\n    });\n    await query.applyToFile({ path: filePath, content: source });\n  } catch {\n    return undefined;\n  }\n  return captured;\n};\n\n/**\n * Like `captureGritQL`, but returns one metavariable's binding (e.g. `mod`\n * for `$mod`) instead of the whole matched node.\n */\nexport const captureGritQLVariable = async (\n  tree: Tree,\n  filePath: string,\n  pattern: string,\n  variableName: string,\n): Promise<string | undefined> => {\n  if (!tree.exists(filePath)) return undefined;\n  ensureGritDir(tree);\n  const source = tree.read(filePath)!.toString();\n  // The underlying binding lookup requires the `$` sigil.\n  const name = variableName.startsWith('$') ? variableName : `$${variableName}`;\n  let captured: string | undefined;\n  try {\n    const query = new QueryBuilder(pattern);\n    query.filter((node) => {\n      captured ??= node.var(name) ?? undefined;\n      return true;\n    });\n    await query.applyToFile({ path: filePath, content: source });\n  } catch {\n    return undefined;\n  }\n  return captured;\n};\n\n/**\n * Return the text of every node matching the GritQL pattern, in document order.\n */\nexport const captureAllGritQL = async (\n  tree: Tree,\n  filePath: string,\n  pattern: string,\n): Promise<string[]> => {\n  if (!tree.exists(filePath)) return [];\n  ensureGritDir(tree);\n  const source = tree.read(filePath)!.toString();\n  const captured: string[] = [];\n  try {\n    const query = new QueryBuilder(pattern);\n    query.filter((node) => {\n      captured.push(node.text());\n      return true;\n    });\n    await query.applyToFile({ path: filePath, content: source });\n  } catch {\n    return [];\n  }\n  return captured;\n};\n\n/**\n * A unique token that is a valid identifier, so it can stand in for an array\n * element or object property inside a GritQL rewrite.\n */\nexport const GRIT_INSERT_PLACEHOLDER = '__GRIT_INSERT_PLACEHOLDER__';\n\n/**\n * Apply a GritQL rewrite that inserts {@link GRIT_INSERT_PLACEHOLDER}, then\n * replace the placeholder with `text`. Routing user-provided text through a\n * placeholder keeps it out of the GritQL pattern, where quotes, backticks or\n * `${...}` would otherwise break parsing.\n *\n * Any separator (e.g. a leading `, ` when appending to an array) must be part\n * of the GritQL pattern, not `text`. The one adjustment made here: if the\n * placeholder lands after a trailing line comment (`// ...`) — which would\n * comment out the text — the text is moved to its own line.\n *\n * The caller formats afterwards. Returns true if the pattern matched and the\n * file changed.\n */\nexport const insertViaGritQL = async (\n  tree: Tree,\n  filePath: string,\n  pattern: string,\n  text: string,\n): Promise<boolean> => {\n  if (!(await applyGritQL(tree, filePath, pattern))) return false;\n  const content = tree.read(filePath)!.toString();\n  const at = content.indexOf(GRIT_INSERT_PLACEHOLDER);\n  const lineSoFar = content.slice(content.lastIndexOf('\\n', at) + 1, at);\n  const replacement = lineSoFar.includes('//') ? `\\n${text}` : text;\n\n  // Function replacer so `$` in `text` isn't treated as a replacement pattern.\n  tree.write(\n    filePath,\n    content.replace(GRIT_INSERT_PLACEHOLDER, () => replacement),\n  );\n  return true;\n};\n"],"names":["QueryBuilder","path","updateGitIgnore","isEsmWorkspace","GRIT_DIR","normalizeModuleSpecifier","tree","from","isRelative","startsWith","endsWith","slice","length","ensureGritDir","process","env","GRIT_GLOBAL_DIR","join","root","patterns","assertFilePath","filePath","exists","Error","addDestructuredImport","variableNames","hasExistingImport","matchGritQL","variableName","localName","includes","split","applyGritQL","specifiers","contents","read","toString","newImport","newlineIndex","indexOf","write","substring","addPythonDestructuredImport","beforeContents","moduleAlreadyImported","appended","allAlreadyPresent","map","n","addSingleImport","alreadyImported","addStarExport","trim","alreadyExported","hasExportDeclaration","source","identifierName","pattern","q","result","applyToFile","content","query","matched","filter","captureGritQL","undefined","captured","node","text","captureGritQLVariable","name","var","captureAllGritQL","push","GRIT_INSERT_PLACEHOLDER","insertViaGritQL","at","lineSoFar","lastIndexOf","replacement","replace"],"mappings":"AAAA;;;CAGC,GAED,SAASA,YAAY,QAAQ,kBAAkB;AAE/C,YAAYC,UAAU,OAAO;AAC7B,SAASC,eAAe,QAAQ,WAAQ;AACxC,SAASC,cAAc,QAAQ,qBAAkB;AAEjD,MAAMC,WAAW;AAEjB;;;;;CAKC,GACD,MAAMC,2BAA2B,CAACC,MAAYC;IAC5C,IAAIJ,eAAeG,OAAO;QACxB,OAAOC;IACT;IACA,MAAMC,aAAaD,KAAKE,UAAU,CAAC,SAASF,KAAKE,UAAU,CAAC;IAC5D,OAAOD,cAAcD,KAAKG,QAAQ,CAAC,SAC/BH,KAAKI,KAAK,CAAC,GAAG,CAAC,MAAMC,MAAM,IAC3BL;AACN;AAEA,8KAA8K;AAC9K,MAAMM,gBAAgB,CAACP;IACrBQ,QAAQC,GAAG,CAACC,eAAe,KAAKf,KAAKgB,IAAI,CAACX,KAAKY,IAAI,EAAEd;IACrDF,gBAAgBI,MAAM,KAAK,CAACa,WAAa;eAAIA;YAAUf;SAAS;AAClE;AAEA,MAAMgB,iBAAiB,CAACd,MAAYe;IAClC,IAAI,CAACf,KAAKgB,MAAM,CAACD,WAAW;QAC1B,MAAM,IAAIE,MAAM,CAAC,mBAAmB,EAAEF,UAAU;IAClD;AACF;AAEA,OAAO,MAAMG,wBAAwB,OACnClB,MACAe,UACAI,eACAlB;IAEAa,eAAed,MAAMe;IACrBd,OAAOF,yBAAyBC,MAAMC;IAEtC,uDAAuD;IACvD,MAAMmB,oBAAoB,MAAMC,YAC9BrB,MACAe,UACA,CAAC,sBAAsB,EAAEd,KAAK,GAAG,CAAC;IAGpC,IAAImB,mBAAmB;QACrB,6EAA6E;QAC7E,KAAK,MAAME,gBAAgBH,cAAe;YACxC,MAAMI,YAAYD,aAAaE,QAAQ,CAAC,UACpCF,aAAaG,KAAK,CAAC,OAAO,CAAC,EAAE,GAC7BH;YACJ,kFAAkF;YAClF,MAAMI,YACJ1B,MACAe,UACA,CAAC,4BAA4B,EAAEd,KAAK,4BAA4B,EAAEqB,aAAa,SAAS,EAAErB,KAAK,uCAAuC,EAAEsB,UAAU,IAAI,CAAC;QAE3J;IACF,OAAO;QACL,oEAAoE;QACpE,MAAMI,aAAaR,cAAcR,IAAI,CAAC;QACtC,MAAMiB,WAAW5B,KAAK6B,IAAI,CAACd,UAAWe,QAAQ;QAC9C,MAAMC,YAAY,CAAC,SAAS,EAAEJ,WAAW,SAAS,EAAE1B,KAAK,IAAI,CAAC;QAC9D,IAAI2B,SAASzB,UAAU,CAAC,OAAO;YAC7B,MAAM6B,eAAeJ,SAASK,OAAO,CAAC;YACtCjC,KAAKkC,KAAK,CACRnB,UACA,GAAGa,SAASO,SAAS,CAAC,GAAGH,eAAe,KAAKD,YAAYH,SAASO,SAAS,CAACH,eAAe,IAAI;QAEnG,OAAO;YACLhC,KAAKkC,KAAK,CAACnB,UAAU,GAAGgB,YAAYH,UAAU;QAChD;IACF;AACF,EAAE;AAEF;;;;;;;;;;;;CAYC,GACD,OAAO,MAAMQ,8BAA8B,OACzCpC,MACAe,UACAI,eACAlB;IAEAa,eAAed,MAAMe;IAErB,6EAA6E;IAC7E,+EAA+E;IAC/E,mDAAmD;IACnD,MAAMsB,iBAAiBrC,KAAK6B,IAAI,CAACd,UAAWe,QAAQ;IACpD,IAAIQ,wBAAwB;IAC5B,KAAK,MAAMhB,gBAAgBH,cAAe;QACxC,+EAA+E;QAC/E,MAAMoB,WAAW,MAAMb,YACrB1B,MACAe,UACA,CAAC,wBAAwB,EAAEd,KAAK,kDAAkD,EAAEqB,aAAa,kBAAkB,EAAEA,aAAa,IAAI,CAAC;QAEzI,IAAIiB,UAAU;YACZD,wBAAwB;QAC1B;IACF;IAEA,yEAAyE;IACzE,qEAAqE;IACrE,qEAAqE;IACrE,mDAAmD;IACnD,IAAIA,uBAAuB;QACzB;IACF;IAEA,MAAME,oBAAoB,MAAMnB,YAC9BrB,MACAe,UACA,CAAC,wBAAwB,EAAEd,KAAK,yBAAyB,EAAEkB,cACxDsB,GAAG,CAAC,CAACC,IAAM,CAAC,qBAAqB,EAAEA,EAAE,EAAE,CAAC,EACxC/B,IAAI,CAAC,MAAM,EAAE,CAAC;IAEnB,IAAI6B,mBAAmB;QACrB;IACF;IAEA,uEAAuE;IACvE,sEAAsE;IACtE,MAAMb,aAAaR,cAAcR,IAAI,CAAC;IACtCX,KAAKkC,KAAK,CAACnB,UAAU,CAAC,KAAK,EAAEd,KAAK,QAAQ,EAAE0B,WAAW,EAAE,EAAEU,gBAAgB;AAC7E,EAAE;AAEF;;;CAGC,GACD,OAAO,MAAMM,kBAAkB,OAC7B3C,MACAe,UACAO,cACArB;IAEAa,eAAed,MAAMe;IACrBd,OAAOF,yBAAyBC,MAAMC;IAEtC,sDAAsD;IACtD,MAAM2C,kBAAkB,MAAMvB,YAC5BrB,MACAe,UACA,CAAC,SAAS,EAAEO,aAAa,OAAO,EAAErB,KAAK,GAAG,CAAC;IAE7C,IAAI2C,iBAAiB;QACnB;IACF;IAEA,6BAA6B;IAC7B,MAAMhB,WAAW5B,KAAK6B,IAAI,CAACd,UAAWe,QAAQ;IAC9C9B,KAAKkC,KAAK,CAACnB,UAAU,CAAC,OAAO,EAAEO,aAAa,OAAO,EAAErB,KAAK,IAAI,EAAE2B,UAAU;AAC5E,EAAE;AAEF;;;CAGC,GACD,OAAO,MAAMiB,gBAAgB,OAC3B7C,MACAe,UACAd;IAEAA,OAAOF,yBAAyBC,MAAMC;IACtC,MAAM2B,WAAW5B,KAAK6B,IAAI,CAACd,WAAWe,cAAc;IAEpD,sDAAsD;IACtD,IAAI,CAACF,SAASkB,IAAI,IAAI;QACpB9C,KAAKkC,KAAK,CAACnB,UAAU,CAAC,eAAe,EAAEd,KAAK,IAAI,CAAC;QACjD;IACF;IAEA,yCAAyC;IACzC,MAAM8C,kBAAkB,MAAM1B,YAC5BrB,MACAe,UACA,CAAC,iBAAiB,EAAEd,KAAK,GAAG,CAAC;IAE/B,IAAI8C,iBAAiB;QACnB;IACF;IAEA,6BAA6B;IAC7B/C,KAAKkC,KAAK,CAACnB,UAAU,CAAC,eAAe,EAAEd,KAAK,IAAI,EAAE2B,UAAU;AAC9D,EAAE;AAEF;;;CAGC,GACD,OAAO,MAAMoB,uBAAuB,OAClChD,MACAiD,QACAC;IAEA3C,cAAcP;IACd,MAAMa,WAAW;QACf,CAAC,cAAc,EAAEqC,eAAe,OAAO,CAAC;QACxC,CAAC,WAAW,EAAEA,eAAe,IAAI,CAAC;QAClC,CAAC,gBAAgB,EAAEA,eAAe,YAAY,CAAC;KAChD;IAED,KAAK,MAAMC,WAAWtC,SAAU;QAC9B,IAAI;YACF,MAAMuC,IAAI,IAAI1D,aAAa,CAAC,uBAAuB,EAAEyD,QAAQ,EAAE,CAAC;YAChE,MAAME,SAAS,MAAMD,EAAEE,WAAW,CAAC;gBACjC3D,MAAM;gBACN4D,SAASN;YACX;YACA,IAAII,WAAW,MAAM,OAAO;QAC9B,EAAE,OAAM;QACN,iCAAiC;QACnC;IACF;IAEA,OAAO;AACT,EAAE;AAEF;;CAEC,GACD,OAAO,MAAM3B,cAAc,OACzB1B,MACAe,UACAoC;IAEA,IAAI,CAACnD,KAAKgB,MAAM,CAACD,WAAW,MAAM,IAAIE,MAAM,CAAC,WAAW,EAAEF,UAAU;IACpER,cAAcP;IACd,MAAMiD,SAASjD,KAAK6B,IAAI,CAACd,UAAWe,QAAQ;IAC5C,MAAM0B,QAAQ,IAAI9D,aAAayD;IAC/B,MAAME,SAAS,MAAMG,MAAMF,WAAW,CAAC;QAAE3D,MAAMoB;QAAUwC,SAASN;IAAO;IACzE,IAAII,UAAUA,OAAOE,OAAO,KAAKN,QAAQ;QACvCjD,KAAKkC,KAAK,CAACnB,UAAUsC,OAAOE,OAAO;QACnC,OAAO;IACT;IACA,OAAO;AACT,EAAE;AAEF;;;;;;;CAOC,GACD,OAAO,MAAMlC,cAAc,OACzBrB,MACAe,UACAoC;IAEA,IAAI,CAACnD,KAAKgB,MAAM,CAACD,WAAW,OAAO;IACnCR,cAAcP;IACd,MAAMiD,SAASjD,KAAK6B,IAAI,CAACd,UAAWe,QAAQ;IAC5C,IAAI2B,UAAU;IACd,IAAI;QACF,MAAMD,QAAQ,IAAI9D,aAAayD;QAC/BK,MAAME,MAAM,CAAC;YACXD,UAAU;YACV,OAAO;QACT;QACA,MAAMD,MAAMF,WAAW,CAAC;YAAE3D,MAAMoB;YAAUwC,SAASN;QAAO;IAC5D,EAAE,OAAM;QACN,OAAO;IACT;IACA,OAAOQ;AACT,EAAE;AAEF;;;;;;CAMC,GACD,OAAO,MAAME,gBAAgB,OAC3B3D,MACAe,UACAoC;IAEA,IAAI,CAACnD,KAAKgB,MAAM,CAACD,WAAW,OAAO6C;IACnCrD,cAAcP;IACd,MAAMiD,SAASjD,KAAK6B,IAAI,CAACd,UAAWe,QAAQ;IAC5C,IAAI+B;IACJ,IAAI;QACF,MAAML,QAAQ,IAAI9D,aAAayD;QAC/BK,MAAME,MAAM,CAAC,CAACI;YACZD,aAAaC,KAAKC,IAAI;YACtB,OAAO;QACT;QACA,MAAMP,MAAMF,WAAW,CAAC;YAAE3D,MAAMoB;YAAUwC,SAASN;QAAO;IAC5D,EAAE,OAAM;QACN,OAAOW;IACT;IACA,OAAOC;AACT,EAAE;AAEF;;;CAGC,GACD,OAAO,MAAMG,wBAAwB,OACnChE,MACAe,UACAoC,SACA7B;IAEA,IAAI,CAACtB,KAAKgB,MAAM,CAACD,WAAW,OAAO6C;IACnCrD,cAAcP;IACd,MAAMiD,SAASjD,KAAK6B,IAAI,CAACd,UAAWe,QAAQ;IAC5C,wDAAwD;IACxD,MAAMmC,OAAO3C,aAAanB,UAAU,CAAC,OAAOmB,eAAe,CAAC,CAAC,EAAEA,cAAc;IAC7E,IAAIuC;IACJ,IAAI;QACF,MAAML,QAAQ,IAAI9D,aAAayD;QAC/BK,MAAME,MAAM,CAAC,CAACI;YACZD,aAAaC,KAAKI,GAAG,CAACD,SAASL;YAC/B,OAAO;QACT;QACA,MAAMJ,MAAMF,WAAW,CAAC;YAAE3D,MAAMoB;YAAUwC,SAASN;QAAO;IAC5D,EAAE,OAAM;QACN,OAAOW;IACT;IACA,OAAOC;AACT,EAAE;AAEF;;CAEC,GACD,OAAO,MAAMM,mBAAmB,OAC9BnE,MACAe,UACAoC;IAEA,IAAI,CAACnD,KAAKgB,MAAM,CAACD,WAAW,OAAO,EAAE;IACrCR,cAAcP;IACd,MAAMiD,SAASjD,KAAK6B,IAAI,CAACd,UAAWe,QAAQ;IAC5C,MAAM+B,WAAqB,EAAE;IAC7B,IAAI;QACF,MAAML,QAAQ,IAAI9D,aAAayD;QAC/BK,MAAME,MAAM,CAAC,CAACI;YACZD,SAASO,IAAI,CAACN,KAAKC,IAAI;YACvB,OAAO;QACT;QACA,MAAMP,MAAMF,WAAW,CAAC;YAAE3D,MAAMoB;YAAUwC,SAASN;QAAO;IAC5D,EAAE,OAAM;QACN,OAAO,EAAE;IACX;IACA,OAAOY;AACT,EAAE;AAEF;;;CAGC,GACD,OAAO,MAAMQ,0BAA0B,8BAA8B;AAErE;;;;;;;;;;;;;CAaC,GACD,OAAO,MAAMC,kBAAkB,OAC7BtE,MACAe,UACAoC,SACAY;IAEA,IAAI,CAAE,MAAMrC,YAAY1B,MAAMe,UAAUoC,UAAW,OAAO;IAC1D,MAAMI,UAAUvD,KAAK6B,IAAI,CAACd,UAAWe,QAAQ;IAC7C,MAAMyC,KAAKhB,QAAQtB,OAAO,CAACoC;IAC3B,MAAMG,YAAYjB,QAAQlD,KAAK,CAACkD,QAAQkB,WAAW,CAAC,MAAMF,MAAM,GAAGA;IACnE,MAAMG,cAAcF,UAAUhD,QAAQ,CAAC,QAAQ,CAAC,EAAE,EAAEuC,MAAM,GAAGA;IAE7D,6EAA6E;IAC7E/D,KAAKkC,KAAK,CACRnB,UACAwC,QAAQoB,OAAO,CAACN,yBAAyB,IAAMK;IAEjD,OAAO;AACT,EAAE"}

package/src/utils/connection/open-api/files/components/__apiNameClassName__Provider.tsx.template

@@ -26,6 +26,8 @@ const useCreate<%- apiNameClassName %>Client = (): <%- apiNameClassName %> => {
   const runtimeConfig = useRuntimeConfig();
 <%_ if (isAgentRuntime) { _%>
   const agentRuntimeValue = runtimeConfig.agentRuntimes.<%- apiNameClassName %>;
+  // A local-dev override is a plain URL; otherwise it's the agent's runtime
+  // ARN, so build the invocation URL from it.
   const apiUrl = agentRuntimeValue.startsWith('arn:')
     ? buildAgentCoreHttpUrl(agentRuntimeValue)
     : agentRuntimeValue;

package/src/utils/files/common/scripts/src/dynamodb/start-container.ts.template

@@ -64,7 +64,6 @@ for (;;) {
     '-sharedDb',
     '-dbPath', './data',
     '-port', `${port}`,
-    '-optimizeDbBeforeStartup',
   ];
   const create = spawnSync(containerEngine, runArgs, { stdio: 'pipe' });
   if (create.status === 0) {

package/src/utils/migration-versions.d.ts

@@ -18,7 +18,8 @@ import { compare } from 'semver';
  * - The weekly `update-versions` PR backfills the version of the release that
  *   shipped each migration, moving and re-keying it accordingly
  *   (`scripts/backfill-migration-versions.ts`), so source converges on the
- *   versions of everything already released.
+ *   versions of everything already released. `packageJsonUpdates` entries are
+ *   dated in place there too, since their keys never change.
  *
  * A version already in source always wins, so backfilled entries are stable.
  *
@@ -32,8 +33,9 @@ export interface MigrationsJson {
     } & Record<string, unknown>>;
     /**
      * Declarative dependency bumps `nx migrate` applies to the root manifest.
-     * Keyed `<dir>-<name>` like the migrations so entries from different releases
-     * can't collide; nx itself gates on the entry's `version`.
+     * Keyed by what the bump targets rather than the release that ships it, so an
+     * entry is unique from the moment it is written and one release's bump can sit
+     * beside the next; nx itself gates on the entry's `version`.
      */
     packageJsonUpdates?: Record<string, {
         version: string;
@@ -44,15 +46,19 @@ export declare const compareVersions: typeof compare;
 /** Whether a string is an exact semver version. */
 export declare const isValidVersion: (version: string) => boolean;
 /**
- * Map of migration key -> version of the earliest release that registers it,
- * resolved only for the entries still missing a `version` (one already recorded
- * in source wins, so its history doesn't need reading). A migration that hasn't
- * been released is absent.
+ * Map of entry key -> version of the earliest release that registers it, across
+ * both `generators` and `packageJsonUpdates`. Resolved only for the entries still
+ * missing a version (one already recorded in source wins, so its history doesn't
+ * need reading). An entry that hasn't been released is absent.
  *
  * Walks releases newest first and stops as soon as every entry is resolved: an
  * entry that has disappeared from a release's `migrations.json` was first
  * registered by the release after it, which is the one that shipped it.
  *
+ * Both sections resolve the same way and share the walk, so the release doesn't
+ * read tag history twice. Keys can't collide: a migration is keyed by its own
+ * name, an nx bump by the nx version it moves to.
+ *
  * @param migrations parsed source migrations.json
  * @param versions released versions in descending semver order
  * @param readReleasedMigrations reads the `migrations.json` published by a given
@@ -61,9 +67,8 @@ export declare const isValidVersion: (version: string) => boolean;
 export declare const readShippedMigrationVersions: (migrations: MigrationsJson, versions: string[], readReleasedMigrations: (version: string) => MigrationsJson | undefined) => Record<string, string>;
 /**
  * Return a copy of the migrations collection with a `version` stamped onto
- * every generator entry, preserving any already present, and any
- * `packageJsonUpdates` entry still keyed `latest` re-keyed to the version it
- * ships under.
+ * every generator entry, preserving any already present, and the pending version
+ * recorded on any `packageJsonUpdates` entry still holding `latest`.
  *
  * @param migrations parsed migrations.json to stamp
  * @param shippedVersions migration key -> version of the earliest release