@aws/nx-plugin 1.0.0-rc.57 → 1.0.0-rc.58

package/src/utils/agent-core-constructs/agent-core-constructs.js.map

@@ -1 +1 @@
-{"version":3,"sources":["../../../../../../packages/nx-plugin/src/utils/agent-core-constructs/agent-core-constructs.ts"],"sourcesContent":["/**\n * Copyright Amazon.com, Inc. or its affiliates. All Rights Reserved.\n * SPDX-License-Identifier: Apache-2.0\n */\nimport {\n  generateFiles,\n  joinPathFragments,\n  OverwriteStrategy,\n  type ProjectConfiguration,\n  type Tree,\n  updateJson,\n} from '@nx/devkit';\nimport { addStarExport } from '../ast';\nimport type { Containers } from '../containers';\nimport {\n  type DeclaredTsDependency,\n  type DependencyDeclaration,\n  forDependencies,\n  type MustDeclare,\n} from '../declared-dependencies';\nimport { addDependenciesToPackageJson } from '../dependencies';\nimport type { Iac } from '../iac';\nimport { esmVars } from '../module-format';\nimport { addDependencyToTargetIfNotPresent } from '../nx';\nimport {\n  generatedInfrastructure,\n  type IacMetadata,\n  PACKAGES_DIR,\n  SHARED_CONSTRUCTS_DIR,\n  SHARED_TERRAFORM_DIR,\n} from '../shared-constructs-constants';\nimport {\n  type ITsDepVersion,\n  PY_VERSIONS,\n  terraformProviderVersions,\n  withVersions,\n} from '../versions';\n\ntype IACProvider = { iac: Iac };\n\n/**\n * Dependencies a caller must declare to add an AgentCore Gateway construct.\n *\n * Gated on infrastructure having been generated, since the construct helpers only\n * run on that branch.\n */\nexport const AGENT_CORE_CONSTRUCTS_DEPENDENCIES = [\n  { name: 'ejs', when: generatedInfrastructure },\n  { name: '@aws-sdk/client-bedrock-agentcore', when: generatedInfrastructure },\n  { name: '@types/ejs', when: generatedInfrastructure },\n] as const satisfies readonly DeclaredTsDependency<\n  ITsDepVersion,\n  IacMetadata\n>[];\n\nexport type AgentCoreAuth = 'iam' | 'cognito';\n\nexport type AgentCoreSession = 's3' | 'in-memory';\n\nexport interface AddAgentCoreInfraProps {\n  nameClassName: string;\n  nameKebabCase: string;\n  projectName: string;\n  dockerImageTag: string;\n  dockerOutputDir: string;\n  appDirectory: string;\n  serverProtocol: 'mcp' | 'http' | 'a2a';\n  auth: AgentCoreAuth;\n  /** How this runtime's session should be persisted. MCP servers have no session, so pass 'in-memory'. */\n  session: AgentCoreSession;\n  containers: Containers;\n}\n\nconst addAgentCoreInfra = async (\n  tree: Tree,\n  options: AddAgentCoreInfraProps & { iac: Iac },\n) => {\n  switch (options.iac) {\n    case 'cdk':\n      await addAgentCoreCDKInfra(tree, options);\n      break;\n    case 'terraform':\n      addAgentCoreTerraformInfra(tree, options);\n      break;\n  }\n\n  // Update shared constructs/terraform project configuration to depend on this project\n  updateJson(\n    tree,\n    joinPathFragments(\n      PACKAGES_DIR,\n      options.iac === 'cdk' ? SHARED_CONSTRUCTS_DIR : SHARED_TERRAFORM_DIR,\n      'project.json',\n    ),\n    (config: ProjectConfiguration) => {\n      addDependencyToTargetIfNotPresent(\n        config,\n        'build',\n        `${options.projectName}:build`,\n      );\n      return config;\n    },\n  );\n};\n\nconst addAgentCoreCDKInfra = async (\n  tree: Tree,\n  options: AddAgentCoreInfraProps,\n) => {\n  // Generate app specific CDK construct\n  generateFiles(\n    tree,\n    joinPathFragments(import.meta.dirname, 'files', 'cdk', 'app', 'agent-core'),\n    joinPathFragments(\n      PACKAGES_DIR,\n      SHARED_CONSTRUCTS_DIR,\n      'src',\n      'app',\n      options.appDirectory,\n    ),\n    { ...options, ...esmVars(tree) },\n    {\n      overwriteStrategy: OverwriteStrategy.KeepExisting,\n    },\n  );\n\n  // Export app specific CDK construct\n  await addStarExport(\n    tree,\n    joinPathFragments(\n      PACKAGES_DIR,\n      SHARED_CONSTRUCTS_DIR,\n      'src',\n      'app',\n      options.appDirectory,\n      'index.ts',\n    ),\n    `./${options.nameKebabCase}/${options.nameKebabCase}.js`,\n  );\n  await addStarExport(\n    tree,\n    joinPathFragments(\n      PACKAGES_DIR,\n      SHARED_CONSTRUCTS_DIR,\n      'src',\n      'app',\n      'index.ts',\n    ),\n    `./${options.appDirectory}/index.js`,\n  );\n};\n\nconst addAgentCoreTerraformInfra = (\n  tree: Tree,\n  options: AddAgentCoreInfraProps,\n) => {\n  // Add the AgentCore shared module\n  generateFiles(\n    tree,\n    joinPathFragments(\n      import.meta.dirname,\n      'files',\n      'terraform',\n      'core',\n      'agent-core',\n    ),\n    joinPathFragments(\n      PACKAGES_DIR,\n      SHARED_TERRAFORM_DIR,\n      'src',\n      'core',\n      'agent-core',\n    ),\n    {\n      containers: options.containers,\n      boto3Version: PY_VERSIONS.boto3,\n      ...terraformProviderVersions(),\n    },\n    {\n      overwriteStrategy: OverwriteStrategy.KeepExisting,\n    },\n  );\n\n  // Generate app specific agent core configuration\n  generateFiles(\n    tree,\n    joinPathFragments(\n      import.meta.dirname,\n      'files',\n      'terraform',\n      'app',\n      'agent-core',\n    ),\n    joinPathFragments(\n      PACKAGES_DIR,\n      SHARED_TERRAFORM_DIR,\n      'src',\n      'app',\n      options.appDirectory,\n    ),\n    { ...options, ...terraformProviderVersions() },\n    {\n      overwriteStrategy: OverwriteStrategy.KeepExisting,\n    },\n  );\n};\n\nexport interface AddMcpServerInfraProps {\n  mcpServerNameClassName: string;\n  mcpServerNameKebabCase: string;\n  projectName: string;\n  dockerImageTag: string;\n  dockerOutputDir: string;\n  auth: AgentCoreAuth;\n  containers: Containers;\n}\n\n/**\n * Add an MCP server CDK construct\n */\nexport const addMcpServerInfra = async (\n  tree: Tree,\n  options: AddMcpServerInfraProps & IACProvider,\n) => {\n  await addAgentCoreInfra(tree, {\n    nameClassName: options.mcpServerNameClassName,\n    nameKebabCase: options.mcpServerNameKebabCase,\n    dockerImageTag: options.dockerImageTag,\n    dockerOutputDir: options.dockerOutputDir,\n    projectName: options.projectName,\n    appDirectory: 'mcp-servers',\n    serverProtocol: 'mcp',\n    iac: options.iac,\n    auth: options.auth,\n    // MCP servers are stateless (no conversation session to persist).\n    session: 'in-memory',\n    containers: options.containers,\n  });\n};\n\nexport interface AddAgentInfraProps {\n  agentNameClassName: string;\n  agentNameKebabCase: string;\n  projectName: string;\n  dockerImageTag: string;\n  dockerOutputDir: string;\n  auth: AgentCoreAuth;\n  session: AgentCoreSession;\n  serverProtocol?: 'http' | 'a2a';\n  containers: Containers;\n}\n\n/**\n * Add an agent CDK construct\n */\nexport const addAgentInfra = async (\n  tree: Tree,\n  options: AddAgentInfraProps & IACProvider,\n) => {\n  await addAgentCoreInfra(tree, {\n    nameClassName: options.agentNameClassName,\n    nameKebabCase: options.agentNameKebabCase,\n    projectName: options.projectName,\n    dockerImageTag: options.dockerImageTag,\n    dockerOutputDir: options.dockerOutputDir,\n    appDirectory: 'agents',\n    session: options.session,\n    serverProtocol: options.serverProtocol ?? 'http',\n    iac: options.iac,\n    auth: options.auth,\n    containers: options.containers,\n  });\n};\n\nexport interface AddAgentCoreGatewayInfraProps {\n  gatewayNameClassName: string;\n  gatewayNameKebabCase: string;\n  projectName: string;\n  projectDirectory: string;\n  cedarPolicy: boolean;\n  auth: AgentCoreAuth;\n}\n\nexport const addAgentCoreGatewayInfra = async <\n  const D extends DependencyDeclaration,\n>(\n  tree: Tree,\n  options: AddAgentCoreGatewayInfraProps & IACProvider,\n  declaration: D & MustDeclare<typeof AGENT_CORE_CONSTRUCTS_DEPENDENCIES, D>,\n) => {\n  switch (options.iac) {\n    case 'cdk':\n      await addAgentCoreGatewayCDKInfra(tree, options, declaration);\n      break;\n    case 'terraform':\n      addAgentCoreGatewayTerraformInfra(tree, options);\n      break;\n  }\n\n  updateJson(\n    tree,\n    joinPathFragments(\n      PACKAGES_DIR,\n      options.iac === 'cdk' ? SHARED_CONSTRUCTS_DIR : SHARED_TERRAFORM_DIR,\n      'project.json',\n    ),\n    (config: ProjectConfiguration) => {\n      addDependencyToTargetIfNotPresent(\n        config,\n        'build',\n        `${options.projectName}:build`,\n      );\n      return config;\n    },\n  );\n};\n\nconst addAgentCoreGatewayCDKInfra = async (\n  tree: Tree,\n  options: AddAgentCoreGatewayInfraProps,\n  declaration: DependencyDeclaration,\n) => {\n  // Generic gateway construct (readiness probe, policy engine, Cedar policy\n  // loading) shared by all gateways\n  generateFiles(\n    tree,\n    joinPathFragments(\n      import.meta.dirname,\n      'files',\n      'cdk',\n      'core',\n      'agentcore-gateway',\n    ),\n    joinPathFragments(\n      PACKAGES_DIR,\n      SHARED_CONSTRUCTS_DIR,\n      'src',\n      'core',\n      'agentcore-gateway',\n    ),\n    { ...esmVars(tree) },\n    {\n      overwriteStrategy: OverwriteStrategy.KeepExisting,\n    },\n  );\n\n  generateFiles(\n    tree,\n    joinPathFragments(\n      import.meta.dirname,\n      'files',\n      'cdk',\n      'app',\n      'agentcore-gateway',\n    ),\n    joinPathFragments(\n      PACKAGES_DIR,\n      SHARED_CONSTRUCTS_DIR,\n      'src',\n      'app',\n      'gateways',\n    ),\n    {\n      nameClassName: options.gatewayNameClassName,\n      nameKebabCase: options.gatewayNameKebabCase,\n      projectDirectory: options.projectDirectory,\n      cedarPolicy: options.cedarPolicy,\n      auth: options.auth,\n      ...esmVars(tree),\n    },\n    {\n      overwriteStrategy: OverwriteStrategy.KeepExisting,\n    },\n  );\n\n  await addStarExport(\n    tree,\n    joinPathFragments(\n      PACKAGES_DIR,\n      SHARED_CONSTRUCTS_DIR,\n      'src',\n      'core',\n      'index.ts',\n    ),\n    './agentcore-gateway/agentcore-gateway.js',\n  );\n  await addStarExport(\n    tree,\n    joinPathFragments(\n      PACKAGES_DIR,\n      SHARED_CONSTRUCTS_DIR,\n      'src',\n      'app',\n      'gateways',\n      'index.ts',\n    ),\n    `./${options.gatewayNameKebabCase}/${options.gatewayNameKebabCase}.js`,\n  );\n  await addStarExport(\n    tree,\n    joinPathFragments(\n      PACKAGES_DIR,\n      SHARED_CONSTRUCTS_DIR,\n      'src',\n      'app',\n      'index.ts',\n    ),\n    './gateways/index.js',\n  );\n\n  // The gateway construct renders Cedar policies with ejs and its readiness\n  // probe uses the AgentCore SDK client; declare both so the lint passes.\n  addDependenciesToPackageJson(\n    tree,\n    withVersions(\n      forDependencies<typeof AGENT_CORE_CONSTRUCTS_DEPENDENCIES>(declaration),\n      ['ejs', '@aws-sdk/client-bedrock-agentcore'],\n    ),\n    withVersions(\n      forDependencies<typeof AGENT_CORE_CONSTRUCTS_DEPENDENCIES>(declaration),\n      ['@types/ejs'],\n    ),\n    joinPathFragments(PACKAGES_DIR, SHARED_CONSTRUCTS_DIR, 'package.json'),\n  );\n};\n\nconst addAgentCoreGatewayTerraformInfra = (\n  tree: Tree,\n  options: AddAgentCoreGatewayInfraProps,\n) => {\n  generateFiles(\n    tree,\n    joinPathFragments(\n      import.meta.dirname,\n      'files',\n      'terraform',\n      'core',\n      'agentcore-gateway',\n    ),\n    joinPathFragments(\n      PACKAGES_DIR,\n      SHARED_TERRAFORM_DIR,\n      'src',\n      'core',\n      'agentcore-gateway',\n    ),\n    { ...terraformProviderVersions() },\n    {\n      overwriteStrategy: OverwriteStrategy.KeepExisting,\n    },\n  );\n\n  generateFiles(\n    tree,\n    joinPathFragments(\n      import.meta.dirname,\n      'files',\n      'terraform',\n      'app',\n      'agentcore-gateway',\n    ),\n    joinPathFragments(\n      PACKAGES_DIR,\n      SHARED_TERRAFORM_DIR,\n      'src',\n      'app',\n      'gateways',\n    ),\n    {\n      nameClassName: options.gatewayNameClassName,\n      nameKebabCase: options.gatewayNameKebabCase,\n      projectDirectory: options.projectDirectory,\n      cedarPolicy: options.cedarPolicy,\n      auth: options.auth,\n      boto3Version: PY_VERSIONS.boto3,\n      httpxVersion: PY_VERSIONS.httpx,\n      mcpVersion: PY_VERSIONS.mcp,\n      ...terraformProviderVersions(),\n    },\n    {\n      overwriteStrategy: OverwriteStrategy.KeepExisting,\n    },\n  );\n\n  // The Cedar render script is only needed when policies are enabled\n  if (!options.cedarPolicy) {\n    const renderScript = joinPathFragments(\n      PACKAGES_DIR,\n      SHARED_TERRAFORM_DIR,\n      'src',\n      'app',\n      'gateways',\n      options.gatewayNameKebabCase,\n      'render-cedar.cjs',\n    );\n    if (tree.exists(renderScript)) {\n      tree.delete(renderScript);\n    }\n  }\n};\n"],"names":["generateFiles","joinPathFragments","OverwriteStrategy","updateJson","addStarExport","forDependencies","addDependenciesToPackageJson","esmVars","addDependencyToTargetIfNotPresent","generatedInfrastructure","PACKAGES_DIR","SHARED_CONSTRUCTS_DIR","SHARED_TERRAFORM_DIR","PY_VERSIONS","terraformProviderVersions","withVersions","AGENT_CORE_CONSTRUCTS_DEPENDENCIES","name","when","addAgentCoreInfra","tree","options","iac","addAgentCoreCDKInfra","addAgentCoreTerraformInfra","config","projectName","dirname","appDirectory","overwriteStrategy","KeepExisting","nameKebabCase","containers","boto3Version","boto3","addMcpServerInfra","nameClassName","mcpServerNameClassName","mcpServerNameKebabCase","dockerImageTag","dockerOutputDir","serverProtocol","auth","session","addAgentInfra","agentNameClassName","agentNameKebabCase","addAgentCoreGatewayInfra","declaration","addAgentCoreGatewayCDKInfra","addAgentCoreGatewayTerraformInfra","gatewayNameClassName","gatewayNameKebabCase","projectDirectory","cedarPolicy","httpxVersion","httpx","mcpVersion","mcp","renderScript","exists","delete"],"mappings":"AAAA;;;CAGC,GACD,SACEA,aAAa,EACbC,iBAAiB,EACjBC,iBAAiB,EAGjBC,UAAU,QACL,aAAa;AACpB,SAASC,aAAa,QAAQ,YAAS;AAEvC,SAGEC,eAAe,QAEV,8BAA2B;AAClC,SAASC,4BAA4B,QAAQ,qBAAkB;AAE/D,SAASC,OAAO,QAAQ,sBAAmB;AAC3C,SAASC,iCAAiC,QAAQ,WAAQ;AAC1D,SACEC,uBAAuB,EAEvBC,YAAY,EACZC,qBAAqB,EACrBC,oBAAoB,QACf,oCAAiC;AACxC,SAEEC,WAAW,EACXC,yBAAyB,EACzBC,YAAY,QACP,iBAAc;AAIrB;;;;;CAKC,GACD,OAAO,MAAMC,qCAAqC;IAChD;QAAEC,MAAM;QAAOC,MAAMT;IAAwB;IAC7C;QAAEQ,MAAM;QAAqCC,MAAMT;IAAwB;IAC3E;QAAEQ,MAAM;QAAcC,MAAMT;IAAwB;CACrD,CAGG;AAoBJ,MAAMU,oBAAoB,OACxBC,MACAC;IAEA,OAAQA,QAAQC,GAAG;QACjB,KAAK;YACH,MAAMC,qBAAqBH,MAAMC;YACjC;QACF,KAAK;YACHG,2BAA2BJ,MAAMC;YACjC;IACJ;IAEA,qFAAqF;IACrFlB,WACEiB,MACAnB,kBACES,cACAW,QAAQC,GAAG,KAAK,QAAQX,wBAAwBC,sBAChD,iBAEF,CAACa;QACCjB,kCACEiB,QACA,SACA,GAAGJ,QAAQK,WAAW,CAAC,MAAM,CAAC;QAEhC,OAAOD;IACT;AAEJ;AAEA,MAAMF,uBAAuB,OAC3BH,MACAC;IAEA,sCAAsC;IACtCrB,cACEoB,MACAnB,kBAAkB,YAAY0B,OAAO,EAAE,SAAS,OAAO,OAAO,eAC9D1B,kBACES,cACAC,uBACA,OACA,OACAU,QAAQO,YAAY,GAEtB;QAAE,GAAGP,OAAO;QAAE,GAAGd,QAAQa,KAAK;IAAC,GAC/B;QACES,mBAAmB3B,kBAAkB4B,YAAY;IACnD;IAGF,oCAAoC;IACpC,MAAM1B,cACJgB,MACAnB,kBACES,cACAC,uBACA,OACA,OACAU,QAAQO,YAAY,EACpB,aAEF,CAAC,EAAE,EAAEP,QAAQU,aAAa,CAAC,CAAC,EAAEV,QAAQU,aAAa,CAAC,GAAG,CAAC;IAE1D,MAAM3B,cACJgB,MACAnB,kBACES,cACAC,uBACA,OACA,OACA,aAEF,CAAC,EAAE,EAAEU,QAAQO,YAAY,CAAC,SAAS,CAAC;AAExC;AAEA,MAAMJ,6BAA6B,CACjCJ,MACAC;IAEA,kCAAkC;IAClCrB,cACEoB,MACAnB,kBACE,YAAY0B,OAAO,EACnB,SACA,aACA,QACA,eAEF1B,kBACES,cACAE,sBACA,OACA,QACA,eAEF;QACEoB,YAAYX,QAAQW,UAAU;QAC9BC,cAAcpB,YAAYqB,KAAK;QAC/B,GAAGpB,2BAA2B;IAChC,GACA;QACEe,mBAAmB3B,kBAAkB4B,YAAY;IACnD;IAGF,iDAAiD;IACjD9B,cACEoB,MACAnB,kBACE,YAAY0B,OAAO,EACnB,SACA,aACA,OACA,eAEF1B,kBACES,cACAE,sBACA,OACA,OACAS,QAAQO,YAAY,GAEtB;QAAE,GAAGP,OAAO;QAAE,GAAGP,2BAA2B;IAAC,GAC7C;QACEe,mBAAmB3B,kBAAkB4B,YAAY;IACnD;AAEJ;AAYA;;CAEC,GACD,OAAO,MAAMK,oBAAoB,OAC/Bf,MACAC;IAEA,MAAMF,kBAAkBC,MAAM;QAC5BgB,eAAef,QAAQgB,sBAAsB;QAC7CN,eAAeV,QAAQiB,sBAAsB;QAC7CC,gBAAgBlB,QAAQkB,cAAc;QACtCC,iBAAiBnB,QAAQmB,eAAe;QACxCd,aAAaL,QAAQK,WAAW;QAChCE,cAAc;QACda,gBAAgB;QAChBnB,KAAKD,QAAQC,GAAG;QAChBoB,MAAMrB,QAAQqB,IAAI;QAClB,kEAAkE;QAClEC,SAAS;QACTX,YAAYX,QAAQW,UAAU;IAChC;AACF,EAAE;AAcF;;CAEC,GACD,OAAO,MAAMY,gBAAgB,OAC3BxB,MACAC;IAEA,MAAMF,kBAAkBC,MAAM;QAC5BgB,eAAef,QAAQwB,kBAAkB;QACzCd,eAAeV,QAAQyB,kBAAkB;QACzCpB,aAAaL,QAAQK,WAAW;QAChCa,gBAAgBlB,QAAQkB,cAAc;QACtCC,iBAAiBnB,QAAQmB,eAAe;QACxCZ,cAAc;QACde,SAAStB,QAAQsB,OAAO;QACxBF,gBAAgBpB,QAAQoB,cAAc,IAAI;QAC1CnB,KAAKD,QAAQC,GAAG;QAChBoB,MAAMrB,QAAQqB,IAAI;QAClBV,YAAYX,QAAQW,UAAU;IAChC;AACF,EAAE;AAWF,OAAO,MAAMe,2BAA2B,OAGtC3B,MACAC,SACA2B;IAEA,OAAQ3B,QAAQC,GAAG;QACjB,KAAK;YACH,MAAM2B,4BAA4B7B,MAAMC,SAAS2B;YACjD;QACF,KAAK;YACHE,kCAAkC9B,MAAMC;YACxC;IACJ;IAEAlB,WACEiB,MACAnB,kBACES,cACAW,QAAQC,GAAG,KAAK,QAAQX,wBAAwBC,sBAChD,iBAEF,CAACa;QACCjB,kCACEiB,QACA,SACA,GAAGJ,QAAQK,WAAW,CAAC,MAAM,CAAC;QAEhC,OAAOD;IACT;AAEJ,EAAE;AAEF,MAAMwB,8BAA8B,OAClC7B,MACAC,SACA2B;IAEA,0EAA0E;IAC1E,kCAAkC;IAClChD,cACEoB,MACAnB,kBACE,YAAY0B,OAAO,EACnB,SACA,OACA,QACA,sBAEF1B,kBACES,cACAC,uBACA,OACA,QACA,sBAEF;QAAE,GAAGJ,QAAQa,KAAK;IAAC,GACnB;QACES,mBAAmB3B,kBAAkB4B,YAAY;IACnD;IAGF9B,cACEoB,MACAnB,kBACE,YAAY0B,OAAO,EACnB,SACA,OACA,OACA,sBAEF1B,kBACES,cACAC,uBACA,OACA,OACA,aAEF;QACEyB,eAAef,QAAQ8B,oBAAoB;QAC3CpB,eAAeV,QAAQ+B,oBAAoB;QAC3CC,kBAAkBhC,QAAQgC,gBAAgB;QAC1CC,aAAajC,QAAQiC,WAAW;QAChCZ,MAAMrB,QAAQqB,IAAI;QAClB,GAAGnC,QAAQa,KAAK;IAClB,GACA;QACES,mBAAmB3B,kBAAkB4B,YAAY;IACnD;IAGF,MAAM1B,cACJgB,MACAnB,kBACES,cACAC,uBACA,OACA,QACA,aAEF;IAEF,MAAMP,cACJgB,MACAnB,kBACES,cACAC,uBACA,OACA,OACA,YACA,aAEF,CAAC,EAAE,EAAEU,QAAQ+B,oBAAoB,CAAC,CAAC,EAAE/B,QAAQ+B,oBAAoB,CAAC,GAAG,CAAC;IAExE,MAAMhD,cACJgB,MACAnB,kBACES,cACAC,uBACA,OACA,OACA,aAEF;IAGF,0EAA0E;IAC1E,wEAAwE;IACxEL,6BACEc,MACAL,aACEV,gBAA2D2C,cAC3D;QAAC;QAAO;KAAoC,GAE9CjC,aACEV,gBAA2D2C,cAC3D;QAAC;KAAa,GAEhB/C,kBAAkBS,cAAcC,uBAAuB;AAE3D;AAEA,MAAMuC,oCAAoC,CACxC9B,MACAC;IAEArB,cACEoB,MACAnB,kBACE,YAAY0B,OAAO,EACnB,SACA,aACA,QACA,sBAEF1B,kBACES,cACAE,sBACA,OACA,QACA,sBAEF;QAAE,GAAGE,2BAA2B;IAAC,GACjC;QACEe,mBAAmB3B,kBAAkB4B,YAAY;IACnD;IAGF9B,cACEoB,MACAnB,kBACE,YAAY0B,OAAO,EACnB,SACA,aACA,OACA,sBAEF1B,kBACES,cACAE,sBACA,OACA,OACA,aAEF;QACEwB,eAAef,QAAQ8B,oBAAoB;QAC3CpB,eAAeV,QAAQ+B,oBAAoB;QAC3CC,kBAAkBhC,QAAQgC,gBAAgB;QAC1CC,aAAajC,QAAQiC,WAAW;QAChCZ,MAAMrB,QAAQqB,IAAI;QAClBT,cAAcpB,YAAYqB,KAAK;QAC/BqB,cAAc1C,YAAY2C,KAAK;QAC/BC,YAAY5C,YAAY6C,GAAG;QAC3B,GAAG5C,2BAA2B;IAChC,GACA;QACEe,mBAAmB3B,kBAAkB4B,YAAY;IACnD;IAGF,mEAAmE;IACnE,IAAI,CAACT,QAAQiC,WAAW,EAAE;QACxB,MAAMK,eAAe1D,kBACnBS,cACAE,sBACA,OACA,OACA,YACAS,QAAQ+B,oBAAoB,EAC5B;QAEF,IAAIhC,KAAKwC,MAAM,CAACD,eAAe;YAC7BvC,KAAKyC,MAAM,CAACF;QACd;IACF;AACF"}
+{"version":3,"sources":["../../../../../../packages/nx-plugin/src/utils/agent-core-constructs/agent-core-constructs.ts"],"sourcesContent":["/**\n * Copyright Amazon.com, Inc. or its affiliates. All Rights Reserved.\n * SPDX-License-Identifier: Apache-2.0\n */\nimport {\n  generateFiles,\n  joinPathFragments,\n  OverwriteStrategy,\n  type ProjectConfiguration,\n  type Tree,\n  updateJson,\n} from '@nx/devkit';\nimport { addStarExport } from '../ast';\nimport type { Containers } from '../containers';\nimport {\n  type DeclaredPyDependency,\n  type DeclaredTsDependency,\n  type DependencyDeclaration,\n  forDependencies,\n  type MustDeclare,\n} from '../declared-dependencies';\nimport { addDependenciesToPackageJson } from '../dependencies';\nimport type { Iac } from '../iac';\nimport { esmVars } from '../module-format';\nimport { addDependencyToTargetIfNotPresent } from '../nx';\nimport {\n  generatedInfrastructure,\n  generatedTerraform,\n  type IacMetadata,\n  PACKAGES_DIR,\n  SHARED_CONSTRUCTS_DIR,\n  SHARED_TERRAFORM_DIR,\n} from '../shared-constructs-constants';\nimport {\n  type IPyDepVersion,\n  type ITsDepVersion,\n  PY_VERSIONS,\n  terraformProviderVersions,\n  withVersions,\n} from '../versions';\n\ntype IACProvider = { iac: Iac };\n\n/**\n * Dependencies a caller must declare to add an AgentCore Gateway construct.\n *\n * Gated on infrastructure having been generated, since the construct helpers only\n * run on that branch.\n */\nexport const AGENT_CORE_CONSTRUCTS_DEPENDENCIES = [\n  { name: 'ejs', when: generatedInfrastructure },\n  { name: '@aws-sdk/client-bedrock-agentcore', when: generatedInfrastructure },\n  { name: '@types/ejs', when: generatedInfrastructure },\n] as const satisfies readonly DeclaredTsDependency<\n  ITsDepVersion,\n  IacMetadata\n>[];\n\n/**\n * Python versions the generated Terraform pins in an inline `uv run --with`\n * script, rather than in any `pyproject.toml`.\n *\n * Spread through `ownedElsewhere` because nothing installs them into the\n * workspace — the pin is owned so the version sync keeps it current, and gated on\n * Terraform since the CDK branch writes no such script.\n */\nexport const AGENT_CORE_CONSTRUCTS_PY_DEPENDENCIES = [\n  { name: 'boto3', when: generatedTerraform },\n  { name: 'httpx', when: generatedTerraform },\n  { name: 'mcp', when: generatedTerraform },\n] as const satisfies readonly DeclaredPyDependency<\n  IPyDepVersion,\n  IacMetadata\n>[];\n\nexport type AgentCoreAuth = 'iam' | 'cognito';\n\nexport type AgentCoreSession = 's3' | 'in-memory';\n\nexport interface AddAgentCoreInfraProps {\n  nameClassName: string;\n  nameKebabCase: string;\n  projectName: string;\n  dockerImageTag: string;\n  dockerOutputDir: string;\n  appDirectory: string;\n  serverProtocol: 'mcp' | 'http' | 'a2a';\n  auth: AgentCoreAuth;\n  /** How this runtime's session should be persisted. MCP servers have no session, so pass 'in-memory'. */\n  session: AgentCoreSession;\n  containers: Containers;\n}\n\nconst addAgentCoreInfra = async (\n  tree: Tree,\n  options: AddAgentCoreInfraProps & { iac: Iac },\n) => {\n  switch (options.iac) {\n    case 'cdk':\n      await addAgentCoreCDKInfra(tree, options);\n      break;\n    case 'terraform':\n      addAgentCoreTerraformInfra(tree, options);\n      break;\n  }\n\n  // Update shared constructs/terraform project configuration to depend on this project\n  updateJson(\n    tree,\n    joinPathFragments(\n      PACKAGES_DIR,\n      options.iac === 'cdk' ? SHARED_CONSTRUCTS_DIR : SHARED_TERRAFORM_DIR,\n      'project.json',\n    ),\n    (config: ProjectConfiguration) => {\n      addDependencyToTargetIfNotPresent(\n        config,\n        'build',\n        `${options.projectName}:build`,\n      );\n      return config;\n    },\n  );\n};\n\nconst addAgentCoreCDKInfra = async (\n  tree: Tree,\n  options: AddAgentCoreInfraProps,\n) => {\n  // Generate app specific CDK construct\n  generateFiles(\n    tree,\n    joinPathFragments(import.meta.dirname, 'files', 'cdk', 'app', 'agent-core'),\n    joinPathFragments(\n      PACKAGES_DIR,\n      SHARED_CONSTRUCTS_DIR,\n      'src',\n      'app',\n      options.appDirectory,\n    ),\n    { ...options, ...esmVars(tree) },\n    {\n      overwriteStrategy: OverwriteStrategy.KeepExisting,\n    },\n  );\n\n  // Export app specific CDK construct\n  await addStarExport(\n    tree,\n    joinPathFragments(\n      PACKAGES_DIR,\n      SHARED_CONSTRUCTS_DIR,\n      'src',\n      'app',\n      options.appDirectory,\n      'index.ts',\n    ),\n    `./${options.nameKebabCase}/${options.nameKebabCase}.js`,\n  );\n  await addStarExport(\n    tree,\n    joinPathFragments(\n      PACKAGES_DIR,\n      SHARED_CONSTRUCTS_DIR,\n      'src',\n      'app',\n      'index.ts',\n    ),\n    `./${options.appDirectory}/index.js`,\n  );\n};\n\nconst addAgentCoreTerraformInfra = (\n  tree: Tree,\n  options: AddAgentCoreInfraProps,\n) => {\n  // Add the AgentCore shared module\n  generateFiles(\n    tree,\n    joinPathFragments(\n      import.meta.dirname,\n      'files',\n      'terraform',\n      'core',\n      'agent-core',\n    ),\n    joinPathFragments(\n      PACKAGES_DIR,\n      SHARED_TERRAFORM_DIR,\n      'src',\n      'core',\n      'agent-core',\n    ),\n    {\n      containers: options.containers,\n      boto3Version: PY_VERSIONS.boto3,\n      ...terraformProviderVersions(),\n    },\n    {\n      overwriteStrategy: OverwriteStrategy.KeepExisting,\n    },\n  );\n\n  // Generate app specific agent core configuration\n  generateFiles(\n    tree,\n    joinPathFragments(\n      import.meta.dirname,\n      'files',\n      'terraform',\n      'app',\n      'agent-core',\n    ),\n    joinPathFragments(\n      PACKAGES_DIR,\n      SHARED_TERRAFORM_DIR,\n      'src',\n      'app',\n      options.appDirectory,\n    ),\n    { ...options, ...terraformProviderVersions() },\n    {\n      overwriteStrategy: OverwriteStrategy.KeepExisting,\n    },\n  );\n};\n\nexport interface AddMcpServerInfraProps {\n  mcpServerNameClassName: string;\n  mcpServerNameKebabCase: string;\n  projectName: string;\n  dockerImageTag: string;\n  dockerOutputDir: string;\n  auth: AgentCoreAuth;\n  containers: Containers;\n}\n\n/**\n * Add an MCP server CDK construct\n */\nexport const addMcpServerInfra = async (\n  tree: Tree,\n  options: AddMcpServerInfraProps & IACProvider,\n) => {\n  await addAgentCoreInfra(tree, {\n    nameClassName: options.mcpServerNameClassName,\n    nameKebabCase: options.mcpServerNameKebabCase,\n    dockerImageTag: options.dockerImageTag,\n    dockerOutputDir: options.dockerOutputDir,\n    projectName: options.projectName,\n    appDirectory: 'mcp-servers',\n    serverProtocol: 'mcp',\n    iac: options.iac,\n    auth: options.auth,\n    // MCP servers are stateless (no conversation session to persist).\n    session: 'in-memory',\n    containers: options.containers,\n  });\n};\n\nexport interface AddAgentInfraProps {\n  agentNameClassName: string;\n  agentNameKebabCase: string;\n  projectName: string;\n  dockerImageTag: string;\n  dockerOutputDir: string;\n  auth: AgentCoreAuth;\n  session: AgentCoreSession;\n  serverProtocol?: 'http' | 'a2a';\n  containers: Containers;\n}\n\n/**\n * Add an agent CDK construct\n */\nexport const addAgentInfra = async (\n  tree: Tree,\n  options: AddAgentInfraProps & IACProvider,\n) => {\n  await addAgentCoreInfra(tree, {\n    nameClassName: options.agentNameClassName,\n    nameKebabCase: options.agentNameKebabCase,\n    projectName: options.projectName,\n    dockerImageTag: options.dockerImageTag,\n    dockerOutputDir: options.dockerOutputDir,\n    appDirectory: 'agents',\n    session: options.session,\n    serverProtocol: options.serverProtocol ?? 'http',\n    iac: options.iac,\n    auth: options.auth,\n    containers: options.containers,\n  });\n};\n\nexport interface AddAgentCoreGatewayInfraProps {\n  gatewayNameClassName: string;\n  gatewayNameKebabCase: string;\n  projectName: string;\n  projectDirectory: string;\n  cedarPolicy: boolean;\n  auth: AgentCoreAuth;\n}\n\nexport const addAgentCoreGatewayInfra = async <\n  const D extends DependencyDeclaration,\n>(\n  tree: Tree,\n  options: AddAgentCoreGatewayInfraProps & IACProvider,\n  declaration: D & MustDeclare<typeof AGENT_CORE_CONSTRUCTS_DEPENDENCIES, D>,\n) => {\n  switch (options.iac) {\n    case 'cdk':\n      await addAgentCoreGatewayCDKInfra(tree, options, declaration);\n      break;\n    case 'terraform':\n      addAgentCoreGatewayTerraformInfra(tree, options);\n      break;\n  }\n\n  updateJson(\n    tree,\n    joinPathFragments(\n      PACKAGES_DIR,\n      options.iac === 'cdk' ? SHARED_CONSTRUCTS_DIR : SHARED_TERRAFORM_DIR,\n      'project.json',\n    ),\n    (config: ProjectConfiguration) => {\n      addDependencyToTargetIfNotPresent(\n        config,\n        'build',\n        `${options.projectName}:build`,\n      );\n      return config;\n    },\n  );\n};\n\nconst addAgentCoreGatewayCDKInfra = async (\n  tree: Tree,\n  options: AddAgentCoreGatewayInfraProps,\n  declaration: DependencyDeclaration,\n) => {\n  // Generic gateway construct (readiness probe, policy engine, Cedar policy\n  // loading) shared by all gateways\n  generateFiles(\n    tree,\n    joinPathFragments(\n      import.meta.dirname,\n      'files',\n      'cdk',\n      'core',\n      'agentcore-gateway',\n    ),\n    joinPathFragments(\n      PACKAGES_DIR,\n      SHARED_CONSTRUCTS_DIR,\n      'src',\n      'core',\n      'agentcore-gateway',\n    ),\n    { ...esmVars(tree) },\n    {\n      overwriteStrategy: OverwriteStrategy.KeepExisting,\n    },\n  );\n\n  generateFiles(\n    tree,\n    joinPathFragments(\n      import.meta.dirname,\n      'files',\n      'cdk',\n      'app',\n      'agentcore-gateway',\n    ),\n    joinPathFragments(\n      PACKAGES_DIR,\n      SHARED_CONSTRUCTS_DIR,\n      'src',\n      'app',\n      'gateways',\n    ),\n    {\n      nameClassName: options.gatewayNameClassName,\n      nameKebabCase: options.gatewayNameKebabCase,\n      projectDirectory: options.projectDirectory,\n      cedarPolicy: options.cedarPolicy,\n      auth: options.auth,\n      ...esmVars(tree),\n    },\n    {\n      overwriteStrategy: OverwriteStrategy.KeepExisting,\n    },\n  );\n\n  await addStarExport(\n    tree,\n    joinPathFragments(\n      PACKAGES_DIR,\n      SHARED_CONSTRUCTS_DIR,\n      'src',\n      'core',\n      'index.ts',\n    ),\n    './agentcore-gateway/agentcore-gateway.js',\n  );\n  await addStarExport(\n    tree,\n    joinPathFragments(\n      PACKAGES_DIR,\n      SHARED_CONSTRUCTS_DIR,\n      'src',\n      'app',\n      'gateways',\n      'index.ts',\n    ),\n    `./${options.gatewayNameKebabCase}/${options.gatewayNameKebabCase}.js`,\n  );\n  await addStarExport(\n    tree,\n    joinPathFragments(\n      PACKAGES_DIR,\n      SHARED_CONSTRUCTS_DIR,\n      'src',\n      'app',\n      'index.ts',\n    ),\n    './gateways/index.js',\n  );\n\n  // The gateway construct renders Cedar policies with ejs and its readiness\n  // probe uses the AgentCore SDK client; declare both so the lint passes.\n  addDependenciesToPackageJson(\n    tree,\n    withVersions(\n      forDependencies<typeof AGENT_CORE_CONSTRUCTS_DEPENDENCIES>(declaration),\n      ['ejs', '@aws-sdk/client-bedrock-agentcore'],\n    ),\n    withVersions(\n      forDependencies<typeof AGENT_CORE_CONSTRUCTS_DEPENDENCIES>(declaration),\n      ['@types/ejs'],\n    ),\n    joinPathFragments(PACKAGES_DIR, SHARED_CONSTRUCTS_DIR, 'package.json'),\n  );\n};\n\nconst addAgentCoreGatewayTerraformInfra = (\n  tree: Tree,\n  options: AddAgentCoreGatewayInfraProps,\n) => {\n  generateFiles(\n    tree,\n    joinPathFragments(\n      import.meta.dirname,\n      'files',\n      'terraform',\n      'core',\n      'agentcore-gateway',\n    ),\n    joinPathFragments(\n      PACKAGES_DIR,\n      SHARED_TERRAFORM_DIR,\n      'src',\n      'core',\n      'agentcore-gateway',\n    ),\n    { ...terraformProviderVersions() },\n    {\n      overwriteStrategy: OverwriteStrategy.KeepExisting,\n    },\n  );\n\n  generateFiles(\n    tree,\n    joinPathFragments(\n      import.meta.dirname,\n      'files',\n      'terraform',\n      'app',\n      'agentcore-gateway',\n    ),\n    joinPathFragments(\n      PACKAGES_DIR,\n      SHARED_TERRAFORM_DIR,\n      'src',\n      'app',\n      'gateways',\n    ),\n    {\n      nameClassName: options.gatewayNameClassName,\n      nameKebabCase: options.gatewayNameKebabCase,\n      projectDirectory: options.projectDirectory,\n      cedarPolicy: options.cedarPolicy,\n      auth: options.auth,\n      boto3Version: PY_VERSIONS.boto3,\n      httpxVersion: PY_VERSIONS.httpx,\n      mcpVersion: PY_VERSIONS.mcp,\n      ...terraformProviderVersions(),\n    },\n    {\n      overwriteStrategy: OverwriteStrategy.KeepExisting,\n    },\n  );\n\n  // The Cedar render script is only needed when policies are enabled\n  if (!options.cedarPolicy) {\n    const renderScript = joinPathFragments(\n      PACKAGES_DIR,\n      SHARED_TERRAFORM_DIR,\n      'src',\n      'app',\n      'gateways',\n      options.gatewayNameKebabCase,\n      'render-cedar.cjs',\n    );\n    if (tree.exists(renderScript)) {\n      tree.delete(renderScript);\n    }\n  }\n};\n"],"names":["generateFiles","joinPathFragments","OverwriteStrategy","updateJson","addStarExport","forDependencies","addDependenciesToPackageJson","esmVars","addDependencyToTargetIfNotPresent","generatedInfrastructure","generatedTerraform","PACKAGES_DIR","SHARED_CONSTRUCTS_DIR","SHARED_TERRAFORM_DIR","PY_VERSIONS","terraformProviderVersions","withVersions","AGENT_CORE_CONSTRUCTS_DEPENDENCIES","name","when","AGENT_CORE_CONSTRUCTS_PY_DEPENDENCIES","addAgentCoreInfra","tree","options","iac","addAgentCoreCDKInfra","addAgentCoreTerraformInfra","config","projectName","dirname","appDirectory","overwriteStrategy","KeepExisting","nameKebabCase","containers","boto3Version","boto3","addMcpServerInfra","nameClassName","mcpServerNameClassName","mcpServerNameKebabCase","dockerImageTag","dockerOutputDir","serverProtocol","auth","session","addAgentInfra","agentNameClassName","agentNameKebabCase","addAgentCoreGatewayInfra","declaration","addAgentCoreGatewayCDKInfra","addAgentCoreGatewayTerraformInfra","gatewayNameClassName","gatewayNameKebabCase","projectDirectory","cedarPolicy","httpxVersion","httpx","mcpVersion","mcp","renderScript","exists","delete"],"mappings":"AAAA;;;CAGC,GACD,SACEA,aAAa,EACbC,iBAAiB,EACjBC,iBAAiB,EAGjBC,UAAU,QACL,aAAa;AACpB,SAASC,aAAa,QAAQ,YAAS;AAEvC,SAIEC,eAAe,QAEV,8BAA2B;AAClC,SAASC,4BAA4B,QAAQ,qBAAkB;AAE/D,SAASC,OAAO,QAAQ,sBAAmB;AAC3C,SAASC,iCAAiC,QAAQ,WAAQ;AAC1D,SACEC,uBAAuB,EACvBC,kBAAkB,EAElBC,YAAY,EACZC,qBAAqB,EACrBC,oBAAoB,QACf,oCAAiC;AACxC,SAGEC,WAAW,EACXC,yBAAyB,EACzBC,YAAY,QACP,iBAAc;AAIrB;;;;;CAKC,GACD,OAAO,MAAMC,qCAAqC;IAChD;QAAEC,MAAM;QAAOC,MAAMV;IAAwB;IAC7C;QAAES,MAAM;QAAqCC,MAAMV;IAAwB;IAC3E;QAAES,MAAM;QAAcC,MAAMV;IAAwB;CACrD,CAGG;AAEJ;;;;;;;CAOC,GACD,OAAO,MAAMW,wCAAwC;IACnD;QAAEF,MAAM;QAASC,MAAMT;IAAmB;IAC1C;QAAEQ,MAAM;QAASC,MAAMT;IAAmB;IAC1C;QAAEQ,MAAM;QAAOC,MAAMT;IAAmB;CACzC,CAGG;AAoBJ,MAAMW,oBAAoB,OACxBC,MACAC;IAEA,OAAQA,QAAQC,GAAG;QACjB,KAAK;YACH,MAAMC,qBAAqBH,MAAMC;YACjC;QACF,KAAK;YACHG,2BAA2BJ,MAAMC;YACjC;IACJ;IAEA,qFAAqF;IACrFpB,WACEmB,MACArB,kBACEU,cACAY,QAAQC,GAAG,KAAK,QAAQZ,wBAAwBC,sBAChD,iBAEF,CAACc;QACCnB,kCACEmB,QACA,SACA,GAAGJ,QAAQK,WAAW,CAAC,MAAM,CAAC;QAEhC,OAAOD;IACT;AAEJ;AAEA,MAAMF,uBAAuB,OAC3BH,MACAC;IAEA,sCAAsC;IACtCvB,cACEsB,MACArB,kBAAkB,YAAY4B,OAAO,EAAE,SAAS,OAAO,OAAO,eAC9D5B,kBACEU,cACAC,uBACA,OACA,OACAW,QAAQO,YAAY,GAEtB;QAAE,GAAGP,OAAO;QAAE,GAAGhB,QAAQe,KAAK;IAAC,GAC/B;QACES,mBAAmB7B,kBAAkB8B,YAAY;IACnD;IAGF,oCAAoC;IACpC,MAAM5B,cACJkB,MACArB,kBACEU,cACAC,uBACA,OACA,OACAW,QAAQO,YAAY,EACpB,aAEF,CAAC,EAAE,EAAEP,QAAQU,aAAa,CAAC,CAAC,EAAEV,QAAQU,aAAa,CAAC,GAAG,CAAC;IAE1D,MAAM7B,cACJkB,MACArB,kBACEU,cACAC,uBACA,OACA,OACA,aAEF,CAAC,EAAE,EAAEW,QAAQO,YAAY,CAAC,SAAS,CAAC;AAExC;AAEA,MAAMJ,6BAA6B,CACjCJ,MACAC;IAEA,kCAAkC;IAClCvB,cACEsB,MACArB,kBACE,YAAY4B,OAAO,EACnB,SACA,aACA,QACA,eAEF5B,kBACEU,cACAE,sBACA,OACA,QACA,eAEF;QACEqB,YAAYX,QAAQW,UAAU;QAC9BC,cAAcrB,YAAYsB,KAAK;QAC/B,GAAGrB,2BAA2B;IAChC,GACA;QACEgB,mBAAmB7B,kBAAkB8B,YAAY;IACnD;IAGF,iDAAiD;IACjDhC,cACEsB,MACArB,kBACE,YAAY4B,OAAO,EACnB,SACA,aACA,OACA,eAEF5B,kBACEU,cACAE,sBACA,OACA,OACAU,QAAQO,YAAY,GAEtB;QAAE,GAAGP,OAAO;QAAE,GAAGR,2BAA2B;IAAC,GAC7C;QACEgB,mBAAmB7B,kBAAkB8B,YAAY;IACnD;AAEJ;AAYA;;CAEC,GACD,OAAO,MAAMK,oBAAoB,OAC/Bf,MACAC;IAEA,MAAMF,kBAAkBC,MAAM;QAC5BgB,eAAef,QAAQgB,sBAAsB;QAC7CN,eAAeV,QAAQiB,sBAAsB;QAC7CC,gBAAgBlB,QAAQkB,cAAc;QACtCC,iBAAiBnB,QAAQmB,eAAe;QACxCd,aAAaL,QAAQK,WAAW;QAChCE,cAAc;QACda,gBAAgB;QAChBnB,KAAKD,QAAQC,GAAG;QAChBoB,MAAMrB,QAAQqB,IAAI;QAClB,kEAAkE;QAClEC,SAAS;QACTX,YAAYX,QAAQW,UAAU;IAChC;AACF,EAAE;AAcF;;CAEC,GACD,OAAO,MAAMY,gBAAgB,OAC3BxB,MACAC;IAEA,MAAMF,kBAAkBC,MAAM;QAC5BgB,eAAef,QAAQwB,kBAAkB;QACzCd,eAAeV,QAAQyB,kBAAkB;QACzCpB,aAAaL,QAAQK,WAAW;QAChCa,gBAAgBlB,QAAQkB,cAAc;QACtCC,iBAAiBnB,QAAQmB,eAAe;QACxCZ,cAAc;QACde,SAAStB,QAAQsB,OAAO;QACxBF,gBAAgBpB,QAAQoB,cAAc,IAAI;QAC1CnB,KAAKD,QAAQC,GAAG;QAChBoB,MAAMrB,QAAQqB,IAAI;QAClBV,YAAYX,QAAQW,UAAU;IAChC;AACF,EAAE;AAWF,OAAO,MAAMe,2BAA2B,OAGtC3B,MACAC,SACA2B;IAEA,OAAQ3B,QAAQC,GAAG;QACjB,KAAK;YACH,MAAM2B,4BAA4B7B,MAAMC,SAAS2B;YACjD;QACF,KAAK;YACHE,kCAAkC9B,MAAMC;YACxC;IACJ;IAEApB,WACEmB,MACArB,kBACEU,cACAY,QAAQC,GAAG,KAAK,QAAQZ,wBAAwBC,sBAChD,iBAEF,CAACc;QACCnB,kCACEmB,QACA,SACA,GAAGJ,QAAQK,WAAW,CAAC,MAAM,CAAC;QAEhC,OAAOD;IACT;AAEJ,EAAE;AAEF,MAAMwB,8BAA8B,OAClC7B,MACAC,SACA2B;IAEA,0EAA0E;IAC1E,kCAAkC;IAClClD,cACEsB,MACArB,kBACE,YAAY4B,OAAO,EACnB,SACA,OACA,QACA,sBAEF5B,kBACEU,cACAC,uBACA,OACA,QACA,sBAEF;QAAE,GAAGL,QAAQe,KAAK;IAAC,GACnB;QACES,mBAAmB7B,kBAAkB8B,YAAY;IACnD;IAGFhC,cACEsB,MACArB,kBACE,YAAY4B,OAAO,EACnB,SACA,OACA,OACA,sBAEF5B,kBACEU,cACAC,uBACA,OACA,OACA,aAEF;QACE0B,eAAef,QAAQ8B,oBAAoB;QAC3CpB,eAAeV,QAAQ+B,oBAAoB;QAC3CC,kBAAkBhC,QAAQgC,gBAAgB;QAC1CC,aAAajC,QAAQiC,WAAW;QAChCZ,MAAMrB,QAAQqB,IAAI;QAClB,GAAGrC,QAAQe,KAAK;IAClB,GACA;QACES,mBAAmB7B,kBAAkB8B,YAAY;IACnD;IAGF,MAAM5B,cACJkB,MACArB,kBACEU,cACAC,uBACA,OACA,QACA,aAEF;IAEF,MAAMR,cACJkB,MACArB,kBACEU,cACAC,uBACA,OACA,OACA,YACA,aAEF,CAAC,EAAE,EAAEW,QAAQ+B,oBAAoB,CAAC,CAAC,EAAE/B,QAAQ+B,oBAAoB,CAAC,GAAG,CAAC;IAExE,MAAMlD,cACJkB,MACArB,kBACEU,cACAC,uBACA,OACA,OACA,aAEF;IAGF,0EAA0E;IAC1E,wEAAwE;IACxEN,6BACEgB,MACAN,aACEX,gBAA2D6C,cAC3D;QAAC;QAAO;KAAoC,GAE9ClC,aACEX,gBAA2D6C,cAC3D;QAAC;KAAa,GAEhBjD,kBAAkBU,cAAcC,uBAAuB;AAE3D;AAEA,MAAMwC,oCAAoC,CACxC9B,MACAC;IAEAvB,cACEsB,MACArB,kBACE,YAAY4B,OAAO,EACnB,SACA,aACA,QACA,sBAEF5B,kBACEU,cACAE,sBACA,OACA,QACA,sBAEF;QAAE,GAAGE,2BAA2B;IAAC,GACjC;QACEgB,mBAAmB7B,kBAAkB8B,YAAY;IACnD;IAGFhC,cACEsB,MACArB,kBACE,YAAY4B,OAAO,EACnB,SACA,aACA,OACA,sBAEF5B,kBACEU,cACAE,sBACA,OACA,OACA,aAEF;QACEyB,eAAef,QAAQ8B,oBAAoB;QAC3CpB,eAAeV,QAAQ+B,oBAAoB;QAC3CC,kBAAkBhC,QAAQgC,gBAAgB;QAC1CC,aAAajC,QAAQiC,WAAW;QAChCZ,MAAMrB,QAAQqB,IAAI;QAClBT,cAAcrB,YAAYsB,KAAK;QAC/BqB,cAAc3C,YAAY4C,KAAK;QAC/BC,YAAY7C,YAAY8C,GAAG;QAC3B,GAAG7C,2BAA2B;IAChC,GACA;QACEgB,mBAAmB7B,kBAAkB8B,YAAY;IACnD;IAGF,mEAAmE;IACnE,IAAI,CAACT,QAAQiC,WAAW,EAAE;QACxB,MAAMK,eAAe5D,kBACnBU,cACAE,sBACA,OACA,OACA,YACAU,QAAQ+B,oBAAoB,EAC5B;QAEF,IAAIhC,KAAKwC,MAAM,CAACD,eAAe;YAC7BvC,KAAKyC,MAAM,CAACF;QACd;IACF;AACF"}

package/src/utils/api-constructs/api-constructs.d.ts

@@ -23,6 +23,15 @@ export declare const API_CONSTRUCTS_DEPENDENCIES: readonly [{
     readonly name: "@trpc/server";
     readonly when: (m: IacMetadata) => boolean;
 }];
+/**
+ * Python version the generated Terraform pins in the account module's inline
+ * `uv run --with` script. Nothing installs it, so it is declared for its version
+ * alone, and only on the Terraform branch that writes the script.
+ */
+export declare const API_CONSTRUCTS_PY_DEPENDENCIES: readonly [{
+    readonly name: "boto3";
+    readonly when: (m: IacMetadata) => boolean;
+}];
 interface BackendOptions {
     type: 'trpc' | 'fastapi' | 'smithy';
     integrationPattern: 'isolated' | 'shared';

package/src/utils/api-constructs/api-constructs.js

@@ -7,7 +7,7 @@ import { forDependencies } from "../declared-dependencies.js";
 import { addDependenciesToPackageJson } from "../dependencies.js";
 import { esmVars } from "../module-format.js";
 import { addDependencyToTargetIfNotPresent } from "../nx.js";
-import { generatedInfrastructure, PACKAGES_DIR, SHARED_CONSTRUCTS_DIR, SHARED_TERRAFORM_DIR } from "../shared-constructs-constants.js";
+import { generatedInfrastructure, generatedTerraform, PACKAGES_DIR, SHARED_CONSTRUCTS_DIR, SHARED_TERRAFORM_DIR } from "../shared-constructs-constants.js";
 import { PY_VERSIONS, terraformProviderVersions, withVersions } from "../versions.js";
 /**
  * Dependencies a caller must declare to add API Gateway infrastructure.
@@ -29,6 +29,16 @@ import { PY_VERSIONS, terraformProviderVersions, withVersions } from "../version
         when: generatedInfrastructure
     }
 ];
+/**
+ * Python version the generated Terraform pins in the account module's inline
+ * `uv run --with` script. Nothing installs it, so it is declared for its version
+ * alone, and only on the Terraform branch that writes the script.
+ */ export const API_CONSTRUCTS_PY_DEPENDENCIES = [
+    {
+        name: 'boto3',
+        when: generatedTerraform
+    }
+];
 export const addApiGatewayInfra = async (tree, options, declaration)=>{
     if (options.iac === 'cdk') {
         await addApiGatewayCdkConstructs(tree, options, declaration);

package/src/utils/api-constructs/api-constructs.js.map

@@ -1 +1 @@
-{"version":3,"sources":["../../../../../../packages/nx-plugin/src/utils/api-constructs/api-constructs.ts"],"sourcesContent":["/**\n * Copyright Amazon.com, Inc. or its affiliates. All Rights Reserved.\n * SPDX-License-Identifier: Apache-2.0\n */\nimport {\n  generateFiles,\n  joinPathFragments,\n  OverwriteStrategy,\n  type ProjectConfiguration,\n  type Tree,\n  updateJson,\n} from '@nx/devkit';\nimport { addStarExport } from '../ast';\nimport {\n  type DeclaredTsDependency,\n  type DependencyDeclaration,\n  forDependencies,\n  type MustDeclare,\n} from '../declared-dependencies';\nimport { addDependenciesToPackageJson } from '../dependencies';\nimport type { Iac } from '../iac';\nimport { esmVars } from '../module-format';\nimport { addDependencyToTargetIfNotPresent } from '../nx';\nimport {\n  generatedInfrastructure,\n  type IacMetadata,\n  PACKAGES_DIR,\n  SHARED_CONSTRUCTS_DIR,\n  SHARED_TERRAFORM_DIR,\n} from '../shared-constructs-constants';\nimport {\n  type ITsDepVersion,\n  PY_VERSIONS,\n  terraformProviderVersions,\n  withVersions,\n} from '../versions';\n\n/**\n * Dependencies a caller must declare to add API Gateway infrastructure.\n *\n * Gated on infrastructure having been generated: `addApiGatewayInfra` only runs\n * on that branch, so a project generated with `infra: 'none'` never receives\n * these.\n */\nexport const API_CONSTRUCTS_DEPENDENCIES = [\n  { name: '@aws-sdk/client-api-gateway', when: generatedInfrastructure },\n  { name: '@aws-sdk/client-iam', when: generatedInfrastructure },\n  { name: '@trpc/server', when: generatedInfrastructure },\n] as const satisfies readonly DeclaredTsDependency<\n  ITsDepVersion,\n  IacMetadata\n>[];\n\ninterface BackendOptions {\n  type: 'trpc' | 'fastapi' | 'smithy';\n  integrationPattern: 'isolated' | 'shared';\n}\n\nexport interface TrpcBackendOptions extends BackendOptions {\n  type: 'trpc';\n  projectAlias: string;\n  bundleOutputDir: string;\n  authorizerBundleOutputDir?: string;\n}\n\nexport interface FastApiBackendOptions extends BackendOptions {\n  type: 'fastapi';\n  moduleName: string;\n  bundleOutputDir: string;\n}\n\nexport interface SmithyBackendOptions extends BackendOptions {\n  type: 'smithy';\n  bundleOutputDir: string;\n  authorizerBundleOutputDir?: string;\n}\n\nexport interface AddApiGatewayConstructOptions {\n  apiProjectName: string;\n  apiNameClassName: string;\n  apiNameKebabCase: string;\n  constructType: 'http' | 'rest';\n  backend: TrpcBackendOptions | FastApiBackendOptions | SmithyBackendOptions;\n  auth: 'iam' | 'cognito' | 'custom';\n}\n\nexport const addApiGatewayInfra = async <const D extends DependencyDeclaration>(\n  tree: Tree,\n  options: AddApiGatewayConstructOptions & { iac: Iac },\n  declaration: D & MustDeclare<typeof API_CONSTRUCTS_DEPENDENCIES, D>,\n) => {\n  if (options.iac === 'cdk') {\n    await addApiGatewayCdkConstructs(tree, options, declaration);\n  } else if (options.iac === 'terraform') {\n    addApiGatewayTerraformModules(tree, options);\n  } else {\n    throw new Error(`Unsupported iac ${options.iac}`);\n  }\n\n  updateJson(\n    tree,\n    joinPathFragments(\n      PACKAGES_DIR,\n      options.iac === 'cdk' ? SHARED_CONSTRUCTS_DIR : SHARED_TERRAFORM_DIR,\n      'project.json',\n    ),\n    (config: ProjectConfiguration) => {\n      addDependencyToTargetIfNotPresent(\n        config,\n        'build',\n        `${options.apiProjectName}:build`,\n      );\n      return config;\n    },\n  );\n};\n\n/**\n * Add an API CDK construct, and update the Runtime Config type to export its url\n */\nconst addApiGatewayCdkConstructs = async (\n  tree: Tree,\n  options: AddApiGatewayConstructOptions,\n  declaration: DependencyDeclaration,\n) => {\n  const generateCoreApiFile = (name: string) => {\n    generateFiles(\n      tree,\n      joinPathFragments(\n        import.meta.dirname,\n        'files',\n        'cdk',\n        'core',\n        'api',\n        name,\n      ),\n      joinPathFragments(\n        PACKAGES_DIR,\n        SHARED_CONSTRUCTS_DIR,\n        'src',\n        'core',\n        'api',\n      ),\n      { ...esmVars(tree) },\n      {\n        overwriteStrategy: OverwriteStrategy.KeepExisting,\n      },\n    );\n  };\n\n  // Generate relevant core CDK construct and utilities\n  generateCoreApiFile(options.constructType);\n  generateCoreApiFile('utils');\n  if (options.backend.type === 'trpc') {\n    generateCoreApiFile('trpc');\n  }\n\n  // Declare the deps the generated core construct files import.\n  const constructDeps: (typeof API_CONSTRUCTS_DEPENDENCIES)[number]['name'][] =\n    [];\n  if (options.constructType === 'rest') {\n    // REST account construct configures the account via the AWS SDK.\n    constructDeps.push('@aws-sdk/client-api-gateway', '@aws-sdk/client-iam');\n  }\n  if (options.backend.type === 'trpc') {\n    // trpc-utils.ts types the router with @trpc/server.\n    constructDeps.push('@trpc/server');\n  }\n  if (constructDeps.length > 0) {\n    addDependenciesToPackageJson(\n      tree,\n      withVersions(\n        forDependencies<typeof API_CONSTRUCTS_DEPENDENCIES>(declaration),\n        constructDeps,\n      ),\n      {},\n      joinPathFragments(PACKAGES_DIR, SHARED_CONSTRUCTS_DIR, 'package.json'),\n    );\n  }\n\n  // Generate app specific CDK construct\n  generateFiles(\n    tree,\n    joinPathFragments(\n      import.meta.dirname,\n      'files',\n      'cdk',\n      'app',\n      'apis',\n      options.constructType,\n    ),\n    joinPathFragments(\n      PACKAGES_DIR,\n      SHARED_CONSTRUCTS_DIR,\n      'src',\n      'app',\n      'apis',\n    ),\n    { ...options, ...esmVars(tree) },\n    {\n      overwriteStrategy: OverwriteStrategy.KeepExisting,\n    },\n  );\n\n  // Export app specific CDK construct\n  await addStarExport(\n    tree,\n    joinPathFragments(\n      PACKAGES_DIR,\n      SHARED_CONSTRUCTS_DIR,\n      'src',\n      'app',\n      'apis',\n      'index.ts',\n    ),\n    `./${options.apiNameKebabCase}.js`,\n  );\n  await addStarExport(\n    tree,\n    joinPathFragments(\n      PACKAGES_DIR,\n      SHARED_CONSTRUCTS_DIR,\n      'src',\n      'app',\n      'index.ts',\n    ),\n    './apis/index.js',\n  );\n};\n\n/**\n * Add an API terraform module, and update the Runtime Config type to export its url\n */\nconst addApiGatewayTerraformModules = (\n  tree: Tree,\n  options: AddApiGatewayConstructOptions,\n) => {\n  // Generate core terraform module\n  generateFiles(\n    tree,\n    joinPathFragments(\n      import.meta.dirname,\n      'files',\n      'terraform',\n      'core',\n      'api',\n      options.constructType,\n    ),\n    joinPathFragments(PACKAGES_DIR, SHARED_TERRAFORM_DIR, 'src', 'core', 'api'),\n    { boto3Version: PY_VERSIONS.boto3, ...terraformProviderVersions() },\n    {\n      overwriteStrategy: OverwriteStrategy.KeepExisting,\n    },\n  );\n\n  // Generate app specific terraform module\n  generateFiles(\n    tree,\n    joinPathFragments(\n      import.meta.dirname,\n      'files',\n      'terraform',\n      'app',\n      'apis',\n      options.constructType,\n    ),\n    joinPathFragments(PACKAGES_DIR, SHARED_TERRAFORM_DIR, 'src', 'app', 'apis'),\n    { ...options, ...terraformProviderVersions() },\n    {\n      overwriteStrategy: OverwriteStrategy.KeepExisting,\n    },\n  );\n};\n"],"names":["generateFiles","joinPathFragments","OverwriteStrategy","updateJson","addStarExport","forDependencies","addDependenciesToPackageJson","esmVars","addDependencyToTargetIfNotPresent","generatedInfrastructure","PACKAGES_DIR","SHARED_CONSTRUCTS_DIR","SHARED_TERRAFORM_DIR","PY_VERSIONS","terraformProviderVersions","withVersions","API_CONSTRUCTS_DEPENDENCIES","name","when","addApiGatewayInfra","tree","options","declaration","iac","addApiGatewayCdkConstructs","addApiGatewayTerraformModules","Error","config","apiProjectName","generateCoreApiFile","dirname","overwriteStrategy","KeepExisting","constructType","backend","type","constructDeps","push","length","apiNameKebabCase","boto3Version","boto3"],"mappings":"AAAA;;;CAGC,GACD,SACEA,aAAa,EACbC,iBAAiB,EACjBC,iBAAiB,EAGjBC,UAAU,QACL,aAAa;AACpB,SAASC,aAAa,QAAQ,YAAS;AACvC,SAGEC,eAAe,QAEV,8BAA2B;AAClC,SAASC,4BAA4B,QAAQ,qBAAkB;AAE/D,SAASC,OAAO,QAAQ,sBAAmB;AAC3C,SAASC,iCAAiC,QAAQ,WAAQ;AAC1D,SACEC,uBAAuB,EAEvBC,YAAY,EACZC,qBAAqB,EACrBC,oBAAoB,QACf,oCAAiC;AACxC,SAEEC,WAAW,EACXC,yBAAyB,EACzBC,YAAY,QACP,iBAAc;AAErB;;;;;;CAMC,GACD,OAAO,MAAMC,8BAA8B;IACzC;QAAEC,MAAM;QAA+BC,MAAMT;IAAwB;IACrE;QAAEQ,MAAM;QAAuBC,MAAMT;IAAwB;IAC7D;QAAEQ,MAAM;QAAgBC,MAAMT;IAAwB;CACvD,CAGG;AAmCJ,OAAO,MAAMU,qBAAqB,OAChCC,MACAC,SACAC;IAEA,IAAID,QAAQE,GAAG,KAAK,OAAO;QACzB,MAAMC,2BAA2BJ,MAAMC,SAASC;IAClD,OAAO,IAAID,QAAQE,GAAG,KAAK,aAAa;QACtCE,8BAA8BL,MAAMC;IACtC,OAAO;QACL,MAAM,IAAIK,MAAM,CAAC,gBAAgB,EAAEL,QAAQE,GAAG,EAAE;IAClD;IAEApB,WACEiB,MACAnB,kBACES,cACAW,QAAQE,GAAG,KAAK,QAAQZ,wBAAwBC,sBAChD,iBAEF,CAACe;QACCnB,kCACEmB,QACA,SACA,GAAGN,QAAQO,cAAc,CAAC,MAAM,CAAC;QAEnC,OAAOD;IACT;AAEJ,EAAE;AAEF;;CAEC,GACD,MAAMH,6BAA6B,OACjCJ,MACAC,SACAC;IAEA,MAAMO,sBAAsB,CAACZ;QAC3BjB,cACEoB,MACAnB,kBACE,YAAY6B,OAAO,EACnB,SACA,OACA,QACA,OACAb,OAEFhB,kBACES,cACAC,uBACA,OACA,QACA,QAEF;YAAE,GAAGJ,QAAQa,KAAK;QAAC,GACnB;YACEW,mBAAmB7B,kBAAkB8B,YAAY;QACnD;IAEJ;IAEA,qDAAqD;IACrDH,oBAAoBR,QAAQY,aAAa;IACzCJ,oBAAoB;IACpB,IAAIR,QAAQa,OAAO,CAACC,IAAI,KAAK,QAAQ;QACnCN,oBAAoB;IACtB;IAEA,8DAA8D;IAC9D,MAAMO,gBACJ,EAAE;IACJ,IAAIf,QAAQY,aAAa,KAAK,QAAQ;QACpC,iEAAiE;QACjEG,cAAcC,IAAI,CAAC,+BAA+B;IACpD;IACA,IAAIhB,QAAQa,OAAO,CAACC,IAAI,KAAK,QAAQ;QACnC,oDAAoD;QACpDC,cAAcC,IAAI,CAAC;IACrB;IACA,IAAID,cAAcE,MAAM,GAAG,GAAG;QAC5BhC,6BACEc,MACAL,aACEV,gBAAoDiB,cACpDc,gBAEF,CAAC,GACDnC,kBAAkBS,cAAcC,uBAAuB;IAE3D;IAEA,sCAAsC;IACtCX,cACEoB,MACAnB,kBACE,YAAY6B,OAAO,EACnB,SACA,OACA,OACA,QACAT,QAAQY,aAAa,GAEvBhC,kBACES,cACAC,uBACA,OACA,OACA,SAEF;QAAE,GAAGU,OAAO;QAAE,GAAGd,QAAQa,KAAK;IAAC,GAC/B;QACEW,mBAAmB7B,kBAAkB8B,YAAY;IACnD;IAGF,oCAAoC;IACpC,MAAM5B,cACJgB,MACAnB,kBACES,cACAC,uBACA,OACA,OACA,QACA,aAEF,CAAC,EAAE,EAAEU,QAAQkB,gBAAgB,CAAC,GAAG,CAAC;IAEpC,MAAMnC,cACJgB,MACAnB,kBACES,cACAC,uBACA,OACA,OACA,aAEF;AAEJ;AAEA;;CAEC,GACD,MAAMc,gCAAgC,CACpCL,MACAC;IAEA,iCAAiC;IACjCrB,cACEoB,MACAnB,kBACE,YAAY6B,OAAO,EACnB,SACA,aACA,QACA,OACAT,QAAQY,aAAa,GAEvBhC,kBAAkBS,cAAcE,sBAAsB,OAAO,QAAQ,QACrE;QAAE4B,cAAc3B,YAAY4B,KAAK;QAAE,GAAG3B,2BAA2B;IAAC,GAClE;QACEiB,mBAAmB7B,kBAAkB8B,YAAY;IACnD;IAGF,yCAAyC;IACzChC,cACEoB,MACAnB,kBACE,YAAY6B,OAAO,EACnB,SACA,aACA,OACA,QACAT,QAAQY,aAAa,GAEvBhC,kBAAkBS,cAAcE,sBAAsB,OAAO,OAAO,SACpE;QAAE,GAAGS,OAAO;QAAE,GAAGP,2BAA2B;IAAC,GAC7C;QACEiB,mBAAmB7B,kBAAkB8B,YAAY;IACnD;AAEJ"}
+{"version":3,"sources":["../../../../../../packages/nx-plugin/src/utils/api-constructs/api-constructs.ts"],"sourcesContent":["/**\n * Copyright Amazon.com, Inc. or its affiliates. All Rights Reserved.\n * SPDX-License-Identifier: Apache-2.0\n */\nimport {\n  generateFiles,\n  joinPathFragments,\n  OverwriteStrategy,\n  type ProjectConfiguration,\n  type Tree,\n  updateJson,\n} from '@nx/devkit';\nimport { addStarExport } from '../ast';\nimport {\n  type DeclaredPyDependency,\n  type DeclaredTsDependency,\n  type DependencyDeclaration,\n  forDependencies,\n  type MustDeclare,\n} from '../declared-dependencies';\nimport { addDependenciesToPackageJson } from '../dependencies';\nimport type { Iac } from '../iac';\nimport { esmVars } from '../module-format';\nimport { addDependencyToTargetIfNotPresent } from '../nx';\nimport {\n  generatedInfrastructure,\n  generatedTerraform,\n  type IacMetadata,\n  PACKAGES_DIR,\n  SHARED_CONSTRUCTS_DIR,\n  SHARED_TERRAFORM_DIR,\n} from '../shared-constructs-constants';\nimport {\n  type IPyDepVersion,\n  type ITsDepVersion,\n  PY_VERSIONS,\n  terraformProviderVersions,\n  withVersions,\n} from '../versions';\n\n/**\n * Dependencies a caller must declare to add API Gateway infrastructure.\n *\n * Gated on infrastructure having been generated: `addApiGatewayInfra` only runs\n * on that branch, so a project generated with `infra: 'none'` never receives\n * these.\n */\nexport const API_CONSTRUCTS_DEPENDENCIES = [\n  { name: '@aws-sdk/client-api-gateway', when: generatedInfrastructure },\n  { name: '@aws-sdk/client-iam', when: generatedInfrastructure },\n  { name: '@trpc/server', when: generatedInfrastructure },\n] as const satisfies readonly DeclaredTsDependency<\n  ITsDepVersion,\n  IacMetadata\n>[];\n\n/**\n * Python version the generated Terraform pins in the account module's inline\n * `uv run --with` script. Nothing installs it, so it is declared for its version\n * alone, and only on the Terraform branch that writes the script.\n */\nexport const API_CONSTRUCTS_PY_DEPENDENCIES = [\n  { name: 'boto3', when: generatedTerraform },\n] as const satisfies readonly DeclaredPyDependency<\n  IPyDepVersion,\n  IacMetadata\n>[];\n\ninterface BackendOptions {\n  type: 'trpc' | 'fastapi' | 'smithy';\n  integrationPattern: 'isolated' | 'shared';\n}\n\nexport interface TrpcBackendOptions extends BackendOptions {\n  type: 'trpc';\n  projectAlias: string;\n  bundleOutputDir: string;\n  authorizerBundleOutputDir?: string;\n}\n\nexport interface FastApiBackendOptions extends BackendOptions {\n  type: 'fastapi';\n  moduleName: string;\n  bundleOutputDir: string;\n}\n\nexport interface SmithyBackendOptions extends BackendOptions {\n  type: 'smithy';\n  bundleOutputDir: string;\n  authorizerBundleOutputDir?: string;\n}\n\nexport interface AddApiGatewayConstructOptions {\n  apiProjectName: string;\n  apiNameClassName: string;\n  apiNameKebabCase: string;\n  constructType: 'http' | 'rest';\n  backend: TrpcBackendOptions | FastApiBackendOptions | SmithyBackendOptions;\n  auth: 'iam' | 'cognito' | 'custom';\n}\n\nexport const addApiGatewayInfra = async <const D extends DependencyDeclaration>(\n  tree: Tree,\n  options: AddApiGatewayConstructOptions & { iac: Iac },\n  declaration: D & MustDeclare<typeof API_CONSTRUCTS_DEPENDENCIES, D>,\n) => {\n  if (options.iac === 'cdk') {\n    await addApiGatewayCdkConstructs(tree, options, declaration);\n  } else if (options.iac === 'terraform') {\n    addApiGatewayTerraformModules(tree, options);\n  } else {\n    throw new Error(`Unsupported iac ${options.iac}`);\n  }\n\n  updateJson(\n    tree,\n    joinPathFragments(\n      PACKAGES_DIR,\n      options.iac === 'cdk' ? SHARED_CONSTRUCTS_DIR : SHARED_TERRAFORM_DIR,\n      'project.json',\n    ),\n    (config: ProjectConfiguration) => {\n      addDependencyToTargetIfNotPresent(\n        config,\n        'build',\n        `${options.apiProjectName}:build`,\n      );\n      return config;\n    },\n  );\n};\n\n/**\n * Add an API CDK construct, and update the Runtime Config type to export its url\n */\nconst addApiGatewayCdkConstructs = async (\n  tree: Tree,\n  options: AddApiGatewayConstructOptions,\n  declaration: DependencyDeclaration,\n) => {\n  const generateCoreApiFile = (name: string) => {\n    generateFiles(\n      tree,\n      joinPathFragments(\n        import.meta.dirname,\n        'files',\n        'cdk',\n        'core',\n        'api',\n        name,\n      ),\n      joinPathFragments(\n        PACKAGES_DIR,\n        SHARED_CONSTRUCTS_DIR,\n        'src',\n        'core',\n        'api',\n      ),\n      { ...esmVars(tree) },\n      {\n        overwriteStrategy: OverwriteStrategy.KeepExisting,\n      },\n    );\n  };\n\n  // Generate relevant core CDK construct and utilities\n  generateCoreApiFile(options.constructType);\n  generateCoreApiFile('utils');\n  if (options.backend.type === 'trpc') {\n    generateCoreApiFile('trpc');\n  }\n\n  // Declare the deps the generated core construct files import.\n  const constructDeps: (typeof API_CONSTRUCTS_DEPENDENCIES)[number]['name'][] =\n    [];\n  if (options.constructType === 'rest') {\n    // REST account construct configures the account via the AWS SDK.\n    constructDeps.push('@aws-sdk/client-api-gateway', '@aws-sdk/client-iam');\n  }\n  if (options.backend.type === 'trpc') {\n    // trpc-utils.ts types the router with @trpc/server.\n    constructDeps.push('@trpc/server');\n  }\n  if (constructDeps.length > 0) {\n    addDependenciesToPackageJson(\n      tree,\n      withVersions(\n        forDependencies<typeof API_CONSTRUCTS_DEPENDENCIES>(declaration),\n        constructDeps,\n      ),\n      {},\n      joinPathFragments(PACKAGES_DIR, SHARED_CONSTRUCTS_DIR, 'package.json'),\n    );\n  }\n\n  // Generate app specific CDK construct\n  generateFiles(\n    tree,\n    joinPathFragments(\n      import.meta.dirname,\n      'files',\n      'cdk',\n      'app',\n      'apis',\n      options.constructType,\n    ),\n    joinPathFragments(\n      PACKAGES_DIR,\n      SHARED_CONSTRUCTS_DIR,\n      'src',\n      'app',\n      'apis',\n    ),\n    { ...options, ...esmVars(tree) },\n    {\n      overwriteStrategy: OverwriteStrategy.KeepExisting,\n    },\n  );\n\n  // Export app specific CDK construct\n  await addStarExport(\n    tree,\n    joinPathFragments(\n      PACKAGES_DIR,\n      SHARED_CONSTRUCTS_DIR,\n      'src',\n      'app',\n      'apis',\n      'index.ts',\n    ),\n    `./${options.apiNameKebabCase}.js`,\n  );\n  await addStarExport(\n    tree,\n    joinPathFragments(\n      PACKAGES_DIR,\n      SHARED_CONSTRUCTS_DIR,\n      'src',\n      'app',\n      'index.ts',\n    ),\n    './apis/index.js',\n  );\n};\n\n/**\n * Add an API terraform module, and update the Runtime Config type to export its url\n */\nconst addApiGatewayTerraformModules = (\n  tree: Tree,\n  options: AddApiGatewayConstructOptions,\n) => {\n  // Generate core terraform module\n  generateFiles(\n    tree,\n    joinPathFragments(\n      import.meta.dirname,\n      'files',\n      'terraform',\n      'core',\n      'api',\n      options.constructType,\n    ),\n    joinPathFragments(PACKAGES_DIR, SHARED_TERRAFORM_DIR, 'src', 'core', 'api'),\n    { boto3Version: PY_VERSIONS.boto3, ...terraformProviderVersions() },\n    {\n      overwriteStrategy: OverwriteStrategy.KeepExisting,\n    },\n  );\n\n  // Generate app specific terraform module\n  generateFiles(\n    tree,\n    joinPathFragments(\n      import.meta.dirname,\n      'files',\n      'terraform',\n      'app',\n      'apis',\n      options.constructType,\n    ),\n    joinPathFragments(PACKAGES_DIR, SHARED_TERRAFORM_DIR, 'src', 'app', 'apis'),\n    { ...options, ...terraformProviderVersions() },\n    {\n      overwriteStrategy: OverwriteStrategy.KeepExisting,\n    },\n  );\n};\n"],"names":["generateFiles","joinPathFragments","OverwriteStrategy","updateJson","addStarExport","forDependencies","addDependenciesToPackageJson","esmVars","addDependencyToTargetIfNotPresent","generatedInfrastructure","generatedTerraform","PACKAGES_DIR","SHARED_CONSTRUCTS_DIR","SHARED_TERRAFORM_DIR","PY_VERSIONS","terraformProviderVersions","withVersions","API_CONSTRUCTS_DEPENDENCIES","name","when","API_CONSTRUCTS_PY_DEPENDENCIES","addApiGatewayInfra","tree","options","declaration","iac","addApiGatewayCdkConstructs","addApiGatewayTerraformModules","Error","config","apiProjectName","generateCoreApiFile","dirname","overwriteStrategy","KeepExisting","constructType","backend","type","constructDeps","push","length","apiNameKebabCase","boto3Version","boto3"],"mappings":"AAAA;;;CAGC,GACD,SACEA,aAAa,EACbC,iBAAiB,EACjBC,iBAAiB,EAGjBC,UAAU,QACL,aAAa;AACpB,SAASC,aAAa,QAAQ,YAAS;AACvC,SAIEC,eAAe,QAEV,8BAA2B;AAClC,SAASC,4BAA4B,QAAQ,qBAAkB;AAE/D,SAASC,OAAO,QAAQ,sBAAmB;AAC3C,SAASC,iCAAiC,QAAQ,WAAQ;AAC1D,SACEC,uBAAuB,EACvBC,kBAAkB,EAElBC,YAAY,EACZC,qBAAqB,EACrBC,oBAAoB,QACf,oCAAiC;AACxC,SAGEC,WAAW,EACXC,yBAAyB,EACzBC,YAAY,QACP,iBAAc;AAErB;;;;;;CAMC,GACD,OAAO,MAAMC,8BAA8B;IACzC;QAAEC,MAAM;QAA+BC,MAAMV;IAAwB;IACrE;QAAES,MAAM;QAAuBC,MAAMV;IAAwB;IAC7D;QAAES,MAAM;QAAgBC,MAAMV;IAAwB;CACvD,CAGG;AAEJ;;;;CAIC,GACD,OAAO,MAAMW,iCAAiC;IAC5C;QAAEF,MAAM;QAASC,MAAMT;IAAmB;CAC3C,CAGG;AAmCJ,OAAO,MAAMW,qBAAqB,OAChCC,MACAC,SACAC;IAEA,IAAID,QAAQE,GAAG,KAAK,OAAO;QACzB,MAAMC,2BAA2BJ,MAAMC,SAASC;IAClD,OAAO,IAAID,QAAQE,GAAG,KAAK,aAAa;QACtCE,8BAA8BL,MAAMC;IACtC,OAAO;QACL,MAAM,IAAIK,MAAM,CAAC,gBAAgB,EAAEL,QAAQE,GAAG,EAAE;IAClD;IAEAtB,WACEmB,MACArB,kBACEU,cACAY,QAAQE,GAAG,KAAK,QAAQb,wBAAwBC,sBAChD,iBAEF,CAACgB;QACCrB,kCACEqB,QACA,SACA,GAAGN,QAAQO,cAAc,CAAC,MAAM,CAAC;QAEnC,OAAOD;IACT;AAEJ,EAAE;AAEF;;CAEC,GACD,MAAMH,6BAA6B,OACjCJ,MACAC,SACAC;IAEA,MAAMO,sBAAsB,CAACb;QAC3BlB,cACEsB,MACArB,kBACE,YAAY+B,OAAO,EACnB,SACA,OACA,QACA,OACAd,OAEFjB,kBACEU,cACAC,uBACA,OACA,QACA,QAEF;YAAE,GAAGL,QAAQe,KAAK;QAAC,GACnB;YACEW,mBAAmB/B,kBAAkBgC,YAAY;QACnD;IAEJ;IAEA,qDAAqD;IACrDH,oBAAoBR,QAAQY,aAAa;IACzCJ,oBAAoB;IACpB,IAAIR,QAAQa,OAAO,CAACC,IAAI,KAAK,QAAQ;QACnCN,oBAAoB;IACtB;IAEA,8DAA8D;IAC9D,MAAMO,gBACJ,EAAE;IACJ,IAAIf,QAAQY,aAAa,KAAK,QAAQ;QACpC,iEAAiE;QACjEG,cAAcC,IAAI,CAAC,+BAA+B;IACpD;IACA,IAAIhB,QAAQa,OAAO,CAACC,IAAI,KAAK,QAAQ;QACnC,oDAAoD;QACpDC,cAAcC,IAAI,CAAC;IACrB;IACA,IAAID,cAAcE,MAAM,GAAG,GAAG;QAC5BlC,6BACEgB,MACAN,aACEX,gBAAoDmB,cACpDc,gBAEF,CAAC,GACDrC,kBAAkBU,cAAcC,uBAAuB;IAE3D;IAEA,sCAAsC;IACtCZ,cACEsB,MACArB,kBACE,YAAY+B,OAAO,EACnB,SACA,OACA,OACA,QACAT,QAAQY,aAAa,GAEvBlC,kBACEU,cACAC,uBACA,OACA,OACA,SAEF;QAAE,GAAGW,OAAO;QAAE,GAAGhB,QAAQe,KAAK;IAAC,GAC/B;QACEW,mBAAmB/B,kBAAkBgC,YAAY;IACnD;IAGF,oCAAoC;IACpC,MAAM9B,cACJkB,MACArB,kBACEU,cACAC,uBACA,OACA,OACA,QACA,aAEF,CAAC,EAAE,EAAEW,QAAQkB,gBAAgB,CAAC,GAAG,CAAC;IAEpC,MAAMrC,cACJkB,MACArB,kBACEU,cACAC,uBACA,OACA,OACA,aAEF;AAEJ;AAEA;;CAEC,GACD,MAAMe,gCAAgC,CACpCL,MACAC;IAEA,iCAAiC;IACjCvB,cACEsB,MACArB,kBACE,YAAY+B,OAAO,EACnB,SACA,aACA,QACA,OACAT,QAAQY,aAAa,GAEvBlC,kBAAkBU,cAAcE,sBAAsB,OAAO,QAAQ,QACrE;QAAE6B,cAAc5B,YAAY6B,KAAK;QAAE,GAAG5B,2BAA2B;IAAC,GAClE;QACEkB,mBAAmB/B,kBAAkBgC,YAAY;IACnD;IAGF,yCAAyC;IACzClC,cACEsB,MACArB,kBACE,YAAY+B,OAAO,EACnB,SACA,aACA,OACA,QACAT,QAAQY,aAAa,GAEvBlC,kBAAkBU,cAAcE,sBAAsB,OAAO,OAAO,SACpE;QAAE,GAAGU,OAAO;QAAE,GAAGR,2BAA2B;IAAC,GAC7C;QACEkB,mBAAmB/B,kBAAkBgC,YAAY;IACnD;AAEJ"}

package/src/utils/docker.d.ts

@@ -17,9 +17,34 @@ export declare const DOCKER_DEPENDENCIES: readonly [{
  * version to install globally, and the versions its dependency overrides pin.
  */
 export declare const nodeImageVersions: () => {
-    npmVersion: "12.0.1";
-    minimatchVersion: "10.2.5";
+    npmVersion: "12.0.2";
+    minimatchVersion: "10.2.6";
 };
+/**
+ * Packages a vended Node `Dockerfile` pins, which every generator writing one
+ * must declare so the version sync keeps those pins current.
+ *
+ * Spread through `ownedElsewhere`: the pin lives in the image build rather than
+ * in any manifest, so nothing is installed into the workspace. Left undeclared
+ * these would be the only vended versions never upgraded — and they are
+ * precisely the ones held at a version clear of a known HIGH/CRITICAL
+ * vulnerability.
+ */
+export declare const NODE_IMAGE_DEPENDENCIES: readonly [{
+    readonly name: "npm";
+}, {
+    readonly name: "minimatch";
+}];
+/**
+ * Packages the AWS Distro for OpenTelemetry install in a vended `Dockerfile`
+ * pins, for the images that auto-instrument with it. Spread through
+ * `ownedElsewhere` for the same reason as {@link NODE_IMAGE_DEPENDENCIES}.
+ */
+export declare const ADOT_IMAGE_DEPENDENCIES: readonly [{
+    readonly name: "@aws/aws-distro-opentelemetry-node-autoinstrumentation";
+}, {
+    readonly name: "@opentelemetry/propagator-jaeger";
+}];
 export interface DockerScanTargetOptions {
     /**
      * Project configuration to add the scan target to (mutated in place).

package/src/utils/docker.js

@@ -5,7 +5,7 @@
 import { forDependencies } from "./declared-dependencies.js";
 import { FS_DEPENDENCIES, FsCommands } from "./fs.js";
 import { addDependencyToTargetIfNotPresent } from "./nx.js";
-import { CONTAINER_VERSIONS, TS_VERSIONS } from "./versions.js";
+import { containerImage, TS_VERSIONS } from "./versions.js";
 /** Dependencies a caller must declare to add a Docker scan target. */ export const DOCKER_DEPENDENCIES = [
     ...FS_DEPENDENCIES
 ];
@@ -21,6 +21,35 @@ const TRIVY_IGNORE_CONTENTS = `# Trivy ignore file. Add one vulnerability ID (e.
         npmVersion: TS_VERSIONS.npm,
         minimatchVersion: TS_VERSIONS.minimatch
     });
+/**
+ * Packages a vended Node `Dockerfile` pins, which every generator writing one
+ * must declare so the version sync keeps those pins current.
+ *
+ * Spread through `ownedElsewhere`: the pin lives in the image build rather than
+ * in any manifest, so nothing is installed into the workspace. Left undeclared
+ * these would be the only vended versions never upgraded — and they are
+ * precisely the ones held at a version clear of a known HIGH/CRITICAL
+ * vulnerability.
+ */ export const NODE_IMAGE_DEPENDENCIES = [
+    {
+        name: 'npm'
+    },
+    {
+        name: 'minimatch'
+    }
+];
+/**
+ * Packages the AWS Distro for OpenTelemetry install in a vended `Dockerfile`
+ * pins, for the images that auto-instrument with it. Spread through
+ * `ownedElsewhere` for the same reason as {@link NODE_IMAGE_DEPENDENCIES}.
+ */ export const ADOT_IMAGE_DEPENDENCIES = [
+    {
+        name: '@aws/aws-distro-opentelemetry-node-autoinstrumentation'
+    },
+    {
+        name: '@opentelemetry/propagator-jaeger'
+    }
+];
 /**
  * Add a cacheable Trivy scan target for the images built by a docker target
  * and wire it under the aggregate \`trivy\` target. The scan is not part of
@@ -50,7 +79,7 @@ const TRIVY_IGNORE_CONTENTS = `# Trivy ignore file. Add one vulnerability ID (e.
     // per target, so it makes a stable, collision-free key.
     const scanKey = imageTags[0].replace(/[^a-zA-Z0-9-]/g, '-');
     const scanDir = joinPathFragments('dist', projectRoot, 'trivy', scanKey);
-    const trivyImage = `public.ecr.aws/aquasecurity/trivy:${CONTAINER_VERSIONS.trivy}`;
+    const trivyImage = containerImage('trivy');
     const fs = new FsCommands(tree, forDependencies(declaration));
     const commands = [
         fs.rm(scanDir),

package/src/utils/docker.js.map

@@ -1 +1 @@
-{"version":3,"sources":["../../../../../packages/nx-plugin/src/utils/docker.ts"],"sourcesContent":["/**\n * Copyright Amazon.com, Inc. or its affiliates. All Rights Reserved.\n * SPDX-License-Identifier: Apache-2.0\n */\nimport {\n  joinPathFragments,\n  type ProjectConfiguration,\n  type Tree,\n} from '@nx/devkit';\nimport {\n  type DependencyDeclaration,\n  forDependencies,\n  type MustDeclare,\n} from './declared-dependencies';\nimport { FS_DEPENDENCIES, FsCommands } from './fs';\nimport { addDependencyToTargetIfNotPresent } from './nx';\nimport { CONTAINER_VERSIONS, TS_VERSIONS } from './versions';\n\n/** Dependencies a caller must declare to add a Docker scan target. */\nexport const DOCKER_DEPENDENCIES = [...FS_DEPENDENCIES] as const;\n\nconst TRIVY_IGNORE_FILE = '.trivyignore';\n\nconst TRIVY_IGNORE_CONTENTS = `# Trivy ignore file. Add one vulnerability ID (e.g. CVE-2021-12345) per line to\n# suppress it during the image scan (\\`nx run-many --target trivy\\`).\n# https://trivy.dev/latest/docs/configuration/filtering/#by-finding-ids\n`;\n\n/**\n * Substitution variables for the vended Node `Dockerfile` templates: the npm\n * version to install globally, and the versions its dependency overrides pin.\n */\nexport const nodeImageVersions = () => ({\n  npmVersion: TS_VERSIONS.npm,\n  minimatchVersion: TS_VERSIONS.minimatch,\n});\n\nexport interface DockerScanTargetOptions {\n  /**\n   * Project configuration to add the scan target to (mutated in place).\n   */\n  readonly project: ProjectConfiguration;\n  /**\n   * Container engine command to invoke (\\`docker\\` or \\`finch\\`).\n   */\n  readonly containerEngine: string;\n  /**\n   * Name of the scan target to add, e.g. \\`my-agent-trivy\\`.\n   */\n  readonly trivyTargetName: string;\n  /**\n   * Name of the docker target that builds the image(s) to scan. The scan\n   * target depends on it.\n   */\n  readonly dockerTargetName: string;\n  /**\n   * Tags of the images built by the docker target which should be scanned.\n   */\n  readonly imageTags: string[];\n}\n\n/**\n * Add a cacheable Trivy scan target for the images built by a docker target\n * and wire it under the aggregate \\`trivy\\` target. The scan is not part of\n * \\`build\\` — run \\`nx run-many --target trivy\\` (the root \\`trivy\\` script) in CI.\n *\n * The scan target depends on the docker target and declares the project source\n * as its inputs, so an unchanged image is never re-scanned (a cache hit skips\n * the scan entirely). Each image is saved to a tarball under\n * \\`dist/<projectRoot>/trivy/<scan-key>\\` (kept out of any Docker build context)\n * and scanned with the pinned ECR-hosted Trivy image via a workspace-relative\n * bind mount, so the same commands work under both docker and finch. The scan\n * exits non-zero (exit code 1) on HIGH/CRITICAL vulnerabilities.\n *\n * A \\`.trivyignore\\` is vended at the project root (kept if it already exists)\n * for suppressing findings.\n */\nexport const addDockerScanTarget = <const D extends DependencyDeclaration>(\n  tree: Tree,\n  options: DockerScanTargetOptions,\n  declaration: D & MustDeclare<typeof DOCKER_DEPENDENCIES, D>,\n): void => {\n  const { project, containerEngine, trivyTargetName, dockerTargetName } =\n    options;\n  const { imageTags } = options;\n  const projectRoot = project.root;\n\n  const ignoreFilePath = joinPathFragments(projectRoot, TRIVY_IGNORE_FILE);\n  if (!tree.exists(ignoreFilePath)) {\n    tree.write(ignoreFilePath, TRIVY_IGNORE_CONTENTS);\n  }\n\n  // Stage scan artifacts in a directory unique to this scan target so that\n  // sibling targets in the same project (e.g. multiple agents) don't clobber\n  // each other's tarballs when run in parallel. The first image tag is unique\n  // per target, so it makes a stable, collision-free key.\n  const scanKey = imageTags[0].replace(/[^a-zA-Z0-9-]/g, '-');\n  const scanDir = joinPathFragments('dist', projectRoot, 'trivy', scanKey);\n  const trivyImage = `public.ecr.aws/aquasecurity/trivy:${CONTAINER_VERSIONS.trivy}`;\n\n  const fs = new FsCommands(\n    tree,\n    forDependencies<typeof DOCKER_DEPENDENCIES>(declaration),\n  );\n  const commands = [\n    fs.rm(scanDir),\n    fs.mkdir(scanDir),\n    fs.cp(ignoreFilePath, joinPathFragments(scanDir, TRIVY_IGNORE_FILE)),\n  ];\n\n  imageTags.forEach((imageTag, index) => {\n    const tarName = `image-${index}.tar`;\n    commands.push(\n      `${containerEngine} save -o ${joinPathFragments(scanDir, tarName)} ${imageTag}`,\n      `${containerEngine} run --rm -v \"./${scanDir}\":/scan ${trivyImage} image --input /scan/${tarName} --ignorefile /scan/${TRIVY_IGNORE_FILE} --scanners vuln --severity HIGH,CRITICAL --ignore-unfixed --exit-code 1 --no-progress -q`,\n    );\n  });\n\n  project.targets ??= {};\n  project.targets[trivyTargetName] = {\n    cache: true,\n    // The scanned image is fully determined by the project source, so caching\n    // on the source ensures an unchanged image is never re-scanned.\n    inputs: ['default', '^production'],\n    outputs: [`{workspaceRoot}/${scanDir}`],\n    executor: 'nx:run-commands',\n    options: {\n      commands,\n      parallel: false,\n    },\n    dependsOn: [dockerTargetName],\n  };\n\n  // Aggregate per-component scan targets under a single `trivy` target. The\n  // scan is intentionally NOT wired into `build`: image scanning is slow and\n  // its result depends on the ever-changing vulnerability database (a scan\n  // that passes today can fail tomorrow when a new CVE is published), so\n  // coupling it to `build` would make local and CI builds non-deterministic.\n  // Run `nx run-many --target trivy` (the root `trivy` script) in CI instead.\n  if (trivyTargetName !== 'trivy') {\n    addDependencyToTargetIfNotPresent(project, 'trivy', trivyTargetName);\n  }\n};\n"],"names":["joinPathFragments","forDependencies","FS_DEPENDENCIES","FsCommands","addDependencyToTargetIfNotPresent","CONTAINER_VERSIONS","TS_VERSIONS","DOCKER_DEPENDENCIES","TRIVY_IGNORE_FILE","TRIVY_IGNORE_CONTENTS","nodeImageVersions","npmVersion","npm","minimatchVersion","minimatch","addDockerScanTarget","tree","options","declaration","project","containerEngine","trivyTargetName","dockerTargetName","imageTags","projectRoot","root","ignoreFilePath","exists","write","scanKey","replace","scanDir","trivyImage","trivy","fs","commands","rm","mkdir","cp","forEach","imageTag","index","tarName","push","targets","cache","inputs","outputs","executor","parallel","dependsOn"],"mappings":"AAAA;;;CAGC,GACD,SACEA,iBAAiB,QAGZ,aAAa;AACpB,SAEEC,eAAe,QAEV,6BAA0B;AACjC,SAASC,eAAe,EAAEC,UAAU,QAAQ,UAAO;AACnD,SAASC,iCAAiC,QAAQ,UAAO;AACzD,SAASC,kBAAkB,EAAEC,WAAW,QAAQ,gBAAa;AAE7D,oEAAoE,GACpE,OAAO,MAAMC,sBAAsB;OAAIL;CAAgB,CAAU;AAEjE,MAAMM,oBAAoB;AAE1B,MAAMC,wBAAwB,CAAC;;;AAG/B,CAAC;AAED;;;CAGC,GACD,OAAO,MAAMC,oBAAoB,IAAO,CAAA;QACtCC,YAAYL,YAAYM,GAAG;QAC3BC,kBAAkBP,YAAYQ,SAAS;IACzC,CAAA,EAAG;AA0BH;;;;;;;;;;;;;;;CAeC,GACD,OAAO,MAAMC,sBAAsB,CACjCC,MACAC,SACAC;IAEA,MAAM,EAAEC,OAAO,EAAEC,eAAe,EAAEC,eAAe,EAAEC,gBAAgB,EAAE,GACnEL;IACF,MAAM,EAAEM,SAAS,EAAE,GAAGN;IACtB,MAAMO,cAAcL,QAAQM,IAAI;IAEhC,MAAMC,iBAAiB1B,kBAAkBwB,aAAahB;IACtD,IAAI,CAACQ,KAAKW,MAAM,CAACD,iBAAiB;QAChCV,KAAKY,KAAK,CAACF,gBAAgBjB;IAC7B;IAEA,yEAAyE;IACzE,2EAA2E;IAC3E,4EAA4E;IAC5E,wDAAwD;IACxD,MAAMoB,UAAUN,SAAS,CAAC,EAAE,CAACO,OAAO,CAAC,kBAAkB;IACvD,MAAMC,UAAU/B,kBAAkB,QAAQwB,aAAa,SAASK;IAChE,MAAMG,aAAa,CAAC,kCAAkC,EAAE3B,mBAAmB4B,KAAK,EAAE;IAElF,MAAMC,KAAK,IAAI/B,WACba,MACAf,gBAA4CiB;IAE9C,MAAMiB,WAAW;QACfD,GAAGE,EAAE,CAACL;QACNG,GAAGG,KAAK,CAACN;QACTG,GAAGI,EAAE,CAACZ,gBAAgB1B,kBAAkB+B,SAASvB;KAClD;IAEDe,UAAUgB,OAAO,CAAC,CAACC,UAAUC;QAC3B,MAAMC,UAAU,CAAC,MAAM,EAAED,MAAM,IAAI,CAAC;QACpCN,SAASQ,IAAI,CACX,GAAGvB,gBAAgB,SAAS,EAAEpB,kBAAkB+B,SAASW,SAAS,CAAC,EAAEF,UAAU,EAC/E,GAAGpB,gBAAgB,gBAAgB,EAAEW,QAAQ,QAAQ,EAAEC,WAAW,qBAAqB,EAAEU,QAAQ,oBAAoB,EAAElC,kBAAkB,yFAAyF,CAAC;IAEvO;IAEAW,QAAQyB,OAAO,KAAK,CAAC;IACrBzB,QAAQyB,OAAO,CAACvB,gBAAgB,GAAG;QACjCwB,OAAO;QACP,0EAA0E;QAC1E,gEAAgE;QAChEC,QAAQ;YAAC;YAAW;SAAc;QAClCC,SAAS;YAAC,CAAC,gBAAgB,EAAEhB,SAAS;SAAC;QACvCiB,UAAU;QACV/B,SAAS;YACPkB;YACAc,UAAU;QACZ;QACAC,WAAW;YAAC5B;SAAiB;IAC/B;IAEA,0EAA0E;IAC1E,2EAA2E;IAC3E,yEAAyE;IACzE,uEAAuE;IACvE,2EAA2E;IAC3E,4EAA4E;IAC5E,IAAID,oBAAoB,SAAS;QAC/BjB,kCAAkCe,SAAS,SAASE;IACtD;AACF,EAAE"}
+{"version":3,"sources":["../../../../../packages/nx-plugin/src/utils/docker.ts"],"sourcesContent":["/**\n * Copyright Amazon.com, Inc. or its affiliates. All Rights Reserved.\n * SPDX-License-Identifier: Apache-2.0\n */\nimport {\n  joinPathFragments,\n  type ProjectConfiguration,\n  type Tree,\n} from '@nx/devkit';\nimport {\n  type DependencyDeclaration,\n  forDependencies,\n  type MustDeclare,\n} from './declared-dependencies';\nimport { FS_DEPENDENCIES, FsCommands } from './fs';\nimport { addDependencyToTargetIfNotPresent } from './nx';\nimport { containerImage, type ITsDepVersion, TS_VERSIONS } from './versions';\n\n/** Dependencies a caller must declare to add a Docker scan target. */\nexport const DOCKER_DEPENDENCIES = [...FS_DEPENDENCIES] as const;\n\nconst TRIVY_IGNORE_FILE = '.trivyignore';\n\nconst TRIVY_IGNORE_CONTENTS = `# Trivy ignore file. Add one vulnerability ID (e.g. CVE-2021-12345) per line to\n# suppress it during the image scan (\\`nx run-many --target trivy\\`).\n# https://trivy.dev/latest/docs/configuration/filtering/#by-finding-ids\n`;\n\n/**\n * Substitution variables for the vended Node `Dockerfile` templates: the npm\n * version to install globally, and the versions its dependency overrides pin.\n */\nexport const nodeImageVersions = () => ({\n  npmVersion: TS_VERSIONS.npm,\n  minimatchVersion: TS_VERSIONS.minimatch,\n});\n\n/**\n * Packages a vended Node `Dockerfile` pins, which every generator writing one\n * must declare so the version sync keeps those pins current.\n *\n * Spread through `ownedElsewhere`: the pin lives in the image build rather than\n * in any manifest, so nothing is installed into the workspace. Left undeclared\n * these would be the only vended versions never upgraded — and they are\n * precisely the ones held at a version clear of a known HIGH/CRITICAL\n * vulnerability.\n */\nexport const NODE_IMAGE_DEPENDENCIES = [\n  { name: 'npm' },\n  { name: 'minimatch' },\n] as const satisfies readonly { name: ITsDepVersion }[];\n\n/**\n * Packages the AWS Distro for OpenTelemetry install in a vended `Dockerfile`\n * pins, for the images that auto-instrument with it. Spread through\n * `ownedElsewhere` for the same reason as {@link NODE_IMAGE_DEPENDENCIES}.\n */\nexport const ADOT_IMAGE_DEPENDENCIES = [\n  { name: '@aws/aws-distro-opentelemetry-node-autoinstrumentation' },\n  { name: '@opentelemetry/propagator-jaeger' },\n] as const satisfies readonly { name: ITsDepVersion }[];\n\nexport interface DockerScanTargetOptions {\n  /**\n   * Project configuration to add the scan target to (mutated in place).\n   */\n  readonly project: ProjectConfiguration;\n  /**\n   * Container engine command to invoke (\\`docker\\` or \\`finch\\`).\n   */\n  readonly containerEngine: string;\n  /**\n   * Name of the scan target to add, e.g. \\`my-agent-trivy\\`.\n   */\n  readonly trivyTargetName: string;\n  /**\n   * Name of the docker target that builds the image(s) to scan. The scan\n   * target depends on it.\n   */\n  readonly dockerTargetName: string;\n  /**\n   * Tags of the images built by the docker target which should be scanned.\n   */\n  readonly imageTags: string[];\n}\n\n/**\n * Add a cacheable Trivy scan target for the images built by a docker target\n * and wire it under the aggregate \\`trivy\\` target. The scan is not part of\n * \\`build\\` — run \\`nx run-many --target trivy\\` (the root \\`trivy\\` script) in CI.\n *\n * The scan target depends on the docker target and declares the project source\n * as its inputs, so an unchanged image is never re-scanned (a cache hit skips\n * the scan entirely). Each image is saved to a tarball under\n * \\`dist/<projectRoot>/trivy/<scan-key>\\` (kept out of any Docker build context)\n * and scanned with the pinned ECR-hosted Trivy image via a workspace-relative\n * bind mount, so the same commands work under both docker and finch. The scan\n * exits non-zero (exit code 1) on HIGH/CRITICAL vulnerabilities.\n *\n * A \\`.trivyignore\\` is vended at the project root (kept if it already exists)\n * for suppressing findings.\n */\nexport const addDockerScanTarget = <const D extends DependencyDeclaration>(\n  tree: Tree,\n  options: DockerScanTargetOptions,\n  declaration: D & MustDeclare<typeof DOCKER_DEPENDENCIES, D>,\n): void => {\n  const { project, containerEngine, trivyTargetName, dockerTargetName } =\n    options;\n  const { imageTags } = options;\n  const projectRoot = project.root;\n\n  const ignoreFilePath = joinPathFragments(projectRoot, TRIVY_IGNORE_FILE);\n  if (!tree.exists(ignoreFilePath)) {\n    tree.write(ignoreFilePath, TRIVY_IGNORE_CONTENTS);\n  }\n\n  // Stage scan artifacts in a directory unique to this scan target so that\n  // sibling targets in the same project (e.g. multiple agents) don't clobber\n  // each other's tarballs when run in parallel. The first image tag is unique\n  // per target, so it makes a stable, collision-free key.\n  const scanKey = imageTags[0].replace(/[^a-zA-Z0-9-]/g, '-');\n  const scanDir = joinPathFragments('dist', projectRoot, 'trivy', scanKey);\n  const trivyImage = containerImage('trivy');\n\n  const fs = new FsCommands(\n    tree,\n    forDependencies<typeof DOCKER_DEPENDENCIES>(declaration),\n  );\n  const commands = [\n    fs.rm(scanDir),\n    fs.mkdir(scanDir),\n    fs.cp(ignoreFilePath, joinPathFragments(scanDir, TRIVY_IGNORE_FILE)),\n  ];\n\n  imageTags.forEach((imageTag, index) => {\n    const tarName = `image-${index}.tar`;\n    commands.push(\n      `${containerEngine} save -o ${joinPathFragments(scanDir, tarName)} ${imageTag}`,\n      `${containerEngine} run --rm -v \"./${scanDir}\":/scan ${trivyImage} image --input /scan/${tarName} --ignorefile /scan/${TRIVY_IGNORE_FILE} --scanners vuln --severity HIGH,CRITICAL --ignore-unfixed --exit-code 1 --no-progress -q`,\n    );\n  });\n\n  project.targets ??= {};\n  project.targets[trivyTargetName] = {\n    cache: true,\n    // The scanned image is fully determined by the project source, so caching\n    // on the source ensures an unchanged image is never re-scanned.\n    inputs: ['default', '^production'],\n    outputs: [`{workspaceRoot}/${scanDir}`],\n    executor: 'nx:run-commands',\n    options: {\n      commands,\n      parallel: false,\n    },\n    dependsOn: [dockerTargetName],\n  };\n\n  // Aggregate per-component scan targets under a single `trivy` target. The\n  // scan is intentionally NOT wired into `build`: image scanning is slow and\n  // its result depends on the ever-changing vulnerability database (a scan\n  // that passes today can fail tomorrow when a new CVE is published), so\n  // coupling it to `build` would make local and CI builds non-deterministic.\n  // Run `nx run-many --target trivy` (the root `trivy` script) in CI instead.\n  if (trivyTargetName !== 'trivy') {\n    addDependencyToTargetIfNotPresent(project, 'trivy', trivyTargetName);\n  }\n};\n"],"names":["joinPathFragments","forDependencies","FS_DEPENDENCIES","FsCommands","addDependencyToTargetIfNotPresent","containerImage","TS_VERSIONS","DOCKER_DEPENDENCIES","TRIVY_IGNORE_FILE","TRIVY_IGNORE_CONTENTS","nodeImageVersions","npmVersion","npm","minimatchVersion","minimatch","NODE_IMAGE_DEPENDENCIES","name","ADOT_IMAGE_DEPENDENCIES","addDockerScanTarget","tree","options","declaration","project","containerEngine","trivyTargetName","dockerTargetName","imageTags","projectRoot","root","ignoreFilePath","exists","write","scanKey","replace","scanDir","trivyImage","fs","commands","rm","mkdir","cp","forEach","imageTag","index","tarName","push","targets","cache","inputs","outputs","executor","parallel","dependsOn"],"mappings":"AAAA;;;CAGC,GACD,SACEA,iBAAiB,QAGZ,aAAa;AACpB,SAEEC,eAAe,QAEV,6BAA0B;AACjC,SAASC,eAAe,EAAEC,UAAU,QAAQ,UAAO;AACnD,SAASC,iCAAiC,QAAQ,UAAO;AACzD,SAASC,cAAc,EAAsBC,WAAW,QAAQ,gBAAa;AAE7E,oEAAoE,GACpE,OAAO,MAAMC,sBAAsB;OAAIL;CAAgB,CAAU;AAEjE,MAAMM,oBAAoB;AAE1B,MAAMC,wBAAwB,CAAC;;;AAG/B,CAAC;AAED;;;CAGC,GACD,OAAO,MAAMC,oBAAoB,IAAO,CAAA;QACtCC,YAAYL,YAAYM,GAAG;QAC3BC,kBAAkBP,YAAYQ,SAAS;IACzC,CAAA,EAAG;AAEH;;;;;;;;;CASC,GACD,OAAO,MAAMC,0BAA0B;IACrC;QAAEC,MAAM;IAAM;IACd;QAAEA,MAAM;IAAY;CACrB,CAAuD;AAExD;;;;CAIC,GACD,OAAO,MAAMC,0BAA0B;IACrC;QAAED,MAAM;IAAyD;IACjE;QAAEA,MAAM;IAAmC;CAC5C,CAAuD;AA0BxD;;;;;;;;;;;;;;;CAeC,GACD,OAAO,MAAME,sBAAsB,CACjCC,MACAC,SACAC;IAEA,MAAM,EAAEC,OAAO,EAAEC,eAAe,EAAEC,eAAe,EAAEC,gBAAgB,EAAE,GACnEL;IACF,MAAM,EAAEM,SAAS,EAAE,GAAGN;IACtB,MAAMO,cAAcL,QAAQM,IAAI;IAEhC,MAAMC,iBAAiB7B,kBAAkB2B,aAAanB;IACtD,IAAI,CAACW,KAAKW,MAAM,CAACD,iBAAiB;QAChCV,KAAKY,KAAK,CAACF,gBAAgBpB;IAC7B;IAEA,yEAAyE;IACzE,2EAA2E;IAC3E,4EAA4E;IAC5E,wDAAwD;IACxD,MAAMuB,UAAUN,SAAS,CAAC,EAAE,CAACO,OAAO,CAAC,kBAAkB;IACvD,MAAMC,UAAUlC,kBAAkB,QAAQ2B,aAAa,SAASK;IAChE,MAAMG,aAAa9B,eAAe;IAElC,MAAM+B,KAAK,IAAIjC,WACbgB,MACAlB,gBAA4CoB;IAE9C,MAAMgB,WAAW;QACfD,GAAGE,EAAE,CAACJ;QACNE,GAAGG,KAAK,CAACL;QACTE,GAAGI,EAAE,CAACX,gBAAgB7B,kBAAkBkC,SAAS1B;KAClD;IAEDkB,UAAUe,OAAO,CAAC,CAACC,UAAUC;QAC3B,MAAMC,UAAU,CAAC,MAAM,EAAED,MAAM,IAAI,CAAC;QACpCN,SAASQ,IAAI,CACX,GAAGtB,gBAAgB,SAAS,EAAEvB,kBAAkBkC,SAASU,SAAS,CAAC,EAAEF,UAAU,EAC/E,GAAGnB,gBAAgB,gBAAgB,EAAEW,QAAQ,QAAQ,EAAEC,WAAW,qBAAqB,EAAES,QAAQ,oBAAoB,EAAEpC,kBAAkB,yFAAyF,CAAC;IAEvO;IAEAc,QAAQwB,OAAO,KAAK,CAAC;IACrBxB,QAAQwB,OAAO,CAACtB,gBAAgB,GAAG;QACjCuB,OAAO;QACP,0EAA0E;QAC1E,gEAAgE;QAChEC,QAAQ;YAAC;YAAW;SAAc;QAClCC,SAAS;YAAC,CAAC,gBAAgB,EAAEf,SAAS;SAAC;QACvCgB,UAAU;QACV9B,SAAS;YACPiB;YACAc,UAAU;QACZ;QACAC,WAAW;YAAC3B;SAAiB;IAC/B;IAEA,0EAA0E;IAC1E,2EAA2E;IAC3E,yEAAyE;IACzE,uEAAuE;IACvE,2EAA2E;IAC3E,4EAA4E;IAC5E,IAAID,oBAAoB,SAAS;QAC/BpB,kCAAkCkB,SAAS,SAASE;IACtD;AACF,EAAE"}

package/src/utils/identity-constructs/identity-constructs.d.ts

@@ -4,6 +4,16 @@
  */
 import { type Tree } from '@nx/devkit';
 import type { Iac } from '../iac';
+import { type IacMetadata } from '../shared-constructs-constants';
+/**
+ * Python version the generated Terraform pins in the callback URL module's inline
+ * `uv run --with` script. Nothing installs it, so it is declared for its version
+ * alone, and only on the Terraform branch that writes the script.
+ */
+export declare const IDENTITY_CONSTRUCTS_PY_DEPENDENCIES: readonly [{
+    readonly name: "boto3";
+    readonly when: (m: IacMetadata) => boolean;
+}];
 export interface AddIdentityInfraOptions {
     cognitoDomain: string;
     allowSignup: boolean;

package/src/utils/identity-constructs/identity-constructs.js

@@ -4,8 +4,18 @@
  */ import { generateFiles, joinPathFragments, OverwriteStrategy } from "@nx/devkit";
 import { addStarExport } from "../ast.js";
 import { esmVars } from "../module-format.js";
-import { PACKAGES_DIR, SHARED_CONSTRUCTS_DIR, SHARED_TERRAFORM_DIR } from "../shared-constructs-constants.js";
+import { generatedTerraform, PACKAGES_DIR, SHARED_CONSTRUCTS_DIR, SHARED_TERRAFORM_DIR } from "../shared-constructs-constants.js";
 import { PY_VERSIONS, terraformProviderVersions } from "../versions.js";
+/**
+ * Python version the generated Terraform pins in the callback URL module's inline
+ * `uv run --with` script. Nothing installs it, so it is declared for its version
+ * alone, and only on the Terraform branch that writes the script.
+ */ export const IDENTITY_CONSTRUCTS_PY_DEPENDENCIES = [
+    {
+        name: 'boto3',
+        when: generatedTerraform
+    }
+];
 /**
  * Add infrastructure for a static website
  */ export const addIdentityInfra = async (tree, options)=>{

package/src/utils/identity-constructs/identity-constructs.js.map

@@ -1 +1 @@
-{"version":3,"sources":["../../../../../../packages/nx-plugin/src/utils/identity-constructs/identity-constructs.ts"],"sourcesContent":["/**\n * Copyright Amazon.com, Inc. or its affiliates. All Rights Reserved.\n * SPDX-License-Identifier: Apache-2.0\n */\nimport {\n  generateFiles,\n  joinPathFragments,\n  OverwriteStrategy,\n  type Tree,\n} from '@nx/devkit';\nimport { addStarExport } from '../ast';\nimport type { Iac } from '../iac';\nimport { esmVars } from '../module-format';\nimport {\n  PACKAGES_DIR,\n  SHARED_CONSTRUCTS_DIR,\n  SHARED_TERRAFORM_DIR,\n} from '../shared-constructs-constants';\nimport { PY_VERSIONS, terraformProviderVersions } from '../versions';\n\nexport interface AddIdentityInfraOptions {\n  cognitoDomain: string;\n  allowSignup: boolean;\n}\n\n/**\n * Add infrastructure for a static website\n */\nexport const addIdentityInfra = async (\n  tree: Tree,\n  options: AddIdentityInfraOptions & { iac: Iac },\n) => {\n  if (options.iac === 'cdk') {\n    await addIdentityCdkConstructs(tree, options);\n  } else if (options.iac === 'terraform') {\n    addIdentityTerraformModules(tree, options);\n  } else {\n    throw new Error(`Unsupported iac ${options.iac}`);\n  }\n};\n\nconst addIdentityCdkConstructs = async (\n  tree: Tree,\n  options: AddIdentityInfraOptions,\n) => {\n  generateFiles(\n    tree,\n    joinPathFragments(import.meta.dirname, 'files', 'cdk', 'core'),\n    joinPathFragments(PACKAGES_DIR, SHARED_CONSTRUCTS_DIR, 'src', 'core'),\n    { ...options, ...esmVars(tree) },\n    {\n      overwriteStrategy: OverwriteStrategy.KeepExisting,\n    },\n  );\n\n  await addStarExport(\n    tree,\n    joinPathFragments(\n      PACKAGES_DIR,\n      SHARED_CONSTRUCTS_DIR,\n      'src',\n      'core',\n      'index.ts',\n    ),\n    './user-identity.js',\n  );\n};\n\nconst addIdentityTerraformModules = (\n  tree: Tree,\n  options: AddIdentityInfraOptions,\n) => {\n  generateFiles(\n    tree,\n    joinPathFragments(import.meta.dirname, 'files', 'terraform', 'core'),\n    joinPathFragments(PACKAGES_DIR, SHARED_TERRAFORM_DIR, 'src', 'core'),\n    {\n      ...options,\n      boto3Version: PY_VERSIONS.boto3,\n      ...terraformProviderVersions(),\n    },\n    {\n      overwriteStrategy: OverwriteStrategy.KeepExisting,\n    },\n  );\n\n  // Update the static website module to add the callback url\n  const staticWebsiteModule = tree.read(\n    joinPathFragments(\n      PACKAGES_DIR,\n      SHARED_TERRAFORM_DIR,\n      'src',\n      'core',\n      'static-website',\n      'static-website.tf',\n    ),\n    'utf-8',\n  );\n  if (\n    staticWebsiteModule &&\n    !staticWebsiteModule.includes(\n      'source = \"../user-identity/add-callback-url\"',\n    )\n  ) {\n    // Find the aws_cloudfront_distribution.website resource and add the callback URL module after it.\n    // Includes the CloudFront domain plus any custom domain names (aliases) configured via var.custom_domain_names.\n    const callbackUrlModule = `\n\n# Add CloudFront domain and any custom domain names to user pool client callback URLs.\n# Keyed by statically-known values so for_each keys are resolvable at plan time; the\n# CloudFront domain is only known at apply time, so it appears in the value, not the key.\nlocals {\n  callback_urls = merge(\n    { cloudfront = \"https://\\${aws_cloudfront_distribution.website.domain_name}\" },\n    { for domain in var.custom_domain_names : domain => \"https://\\${domain}\" },\n  )\n}\n\nmodule \"add_callback_url\" {\n  source = \"../user-identity/add-callback-url\"\n  for_each = local.callback_urls\n\n  callback_url = each.value\n\n  depends_on = [aws_cloudfront_distribution.website]\n}`;\n\n    // Find the CloudFront distribution resource using proper brace counting\n    // This handles deeply nested structures correctly\n    const resourceStartPattern =\n      /resource\\s+\"aws_cloudfront_distribution\"\\s+\"website\"\\s*\\{/;\n    const resourceStartMatch = staticWebsiteModule.match(resourceStartPattern);\n\n    if (resourceStartMatch) {\n      const startIndex =\n        resourceStartMatch.index! + resourceStartMatch[0].length - 1; // Position at opening brace\n      let braceCount = 0;\n      let insertionPoint = -1;\n\n      // Count braces to find the end of the resource block\n      for (let i = startIndex; i < staticWebsiteModule.length; i++) {\n        const char = staticWebsiteModule[i];\n        if (char === '{') {\n          braceCount++;\n        } else if (char === '}') {\n          braceCount--;\n          if (braceCount === 0) {\n            // Found the closing brace of the CloudFront resource\n            insertionPoint = i + 1;\n            break;\n          }\n        }\n      }\n\n      if (insertionPoint !== -1) {\n        // Insert the callback URL module right after the CloudFront distribution\n        const beforeInsertion = staticWebsiteModule.substring(\n          0,\n          insertionPoint,\n        );\n        const afterInsertion = staticWebsiteModule.substring(insertionPoint);\n        const updatedContent =\n          beforeInsertion + callbackUrlModule + afterInsertion;\n\n        tree.write(\n          joinPathFragments(\n            PACKAGES_DIR,\n            SHARED_TERRAFORM_DIR,\n            'src',\n            'core',\n            'static-website',\n            'static-website.tf',\n          ),\n          updatedContent,\n        );\n      }\n    }\n  }\n};\n"],"names":["generateFiles","joinPathFragments","OverwriteStrategy","addStarExport","esmVars","PACKAGES_DIR","SHARED_CONSTRUCTS_DIR","SHARED_TERRAFORM_DIR","PY_VERSIONS","terraformProviderVersions","addIdentityInfra","tree","options","iac","addIdentityCdkConstructs","addIdentityTerraformModules","Error","dirname","overwriteStrategy","KeepExisting","boto3Version","boto3","staticWebsiteModule","read","includes","callbackUrlModule","resourceStartPattern","resourceStartMatch","match","startIndex","index","length","braceCount","insertionPoint","i","char","beforeInsertion","substring","afterInsertion","updatedContent","write"],"mappings":"AAAA;;;CAGC,GACD,SACEA,aAAa,EACbC,iBAAiB,EACjBC,iBAAiB,QAEZ,aAAa;AACpB,SAASC,aAAa,QAAQ,YAAS;AAEvC,SAASC,OAAO,QAAQ,sBAAmB;AAC3C,SACEC,YAAY,EACZC,qBAAqB,EACrBC,oBAAoB,QACf,oCAAiC;AACxC,SAASC,WAAW,EAAEC,yBAAyB,QAAQ,iBAAc;AAOrE;;CAEC,GACD,OAAO,MAAMC,mBAAmB,OAC9BC,MACAC;IAEA,IAAIA,QAAQC,GAAG,KAAK,OAAO;QACzB,MAAMC,yBAAyBH,MAAMC;IACvC,OAAO,IAAIA,QAAQC,GAAG,KAAK,aAAa;QACtCE,4BAA4BJ,MAAMC;IACpC,OAAO;QACL,MAAM,IAAII,MAAM,CAAC,gBAAgB,EAAEJ,QAAQC,GAAG,EAAE;IAClD;AACF,EAAE;AAEF,MAAMC,2BAA2B,OAC/BH,MACAC;IAEAZ,cACEW,MACAV,kBAAkB,YAAYgB,OAAO,EAAE,SAAS,OAAO,SACvDhB,kBAAkBI,cAAcC,uBAAuB,OAAO,SAC9D;QAAE,GAAGM,OAAO;QAAE,GAAGR,QAAQO,KAAK;IAAC,GAC/B;QACEO,mBAAmBhB,kBAAkBiB,YAAY;IACnD;IAGF,MAAMhB,cACJQ,MACAV,kBACEI,cACAC,uBACA,OACA,QACA,aAEF;AAEJ;AAEA,MAAMS,8BAA8B,CAClCJ,MACAC;IAEAZ,cACEW,MACAV,kBAAkB,YAAYgB,OAAO,EAAE,SAAS,aAAa,SAC7DhB,kBAAkBI,cAAcE,sBAAsB,OAAO,SAC7D;QACE,GAAGK,OAAO;QACVQ,cAAcZ,YAAYa,KAAK;QAC/B,GAAGZ,2BAA2B;IAChC,GACA;QACES,mBAAmBhB,kBAAkBiB,YAAY;IACnD;IAGF,2DAA2D;IAC3D,MAAMG,sBAAsBX,KAAKY,IAAI,CACnCtB,kBACEI,cACAE,sBACA,OACA,QACA,kBACA,sBAEF;IAEF,IACEe,uBACA,CAACA,oBAAoBE,QAAQ,CAC3B,iDAEF;QACA,kGAAkG;QAClG,gHAAgH;QAChH,MAAMC,oBAAoB,CAAC;;;;;;;;;;;;;;;;;;;CAmB9B,CAAC;QAEE,wEAAwE;QACxE,kDAAkD;QAClD,MAAMC,uBACJ;QACF,MAAMC,qBAAqBL,oBAAoBM,KAAK,CAACF;QAErD,IAAIC,oBAAoB;YACtB,MAAME,aACJF,mBAAmBG,KAAK,GAAIH,kBAAkB,CAAC,EAAE,CAACI,MAAM,GAAG,GAAG,4BAA4B;YAC5F,IAAIC,aAAa;YACjB,IAAIC,iBAAiB,CAAC;YAEtB,qDAAqD;YACrD,IAAK,IAAIC,IAAIL,YAAYK,IAAIZ,oBAAoBS,MAAM,EAAEG,IAAK;gBAC5D,MAAMC,OAAOb,mBAAmB,CAACY,EAAE;gBACnC,IAAIC,SAAS,KAAK;oBAChBH;gBACF,OAAO,IAAIG,SAAS,KAAK;oBACvBH;oBACA,IAAIA,eAAe,GAAG;wBACpB,qDAAqD;wBACrDC,iBAAiBC,IAAI;wBACrB;oBACF;gBACF;YACF;YAEA,IAAID,mBAAmB,CAAC,GAAG;gBACzB,yEAAyE;gBACzE,MAAMG,kBAAkBd,oBAAoBe,SAAS,CACnD,GACAJ;gBAEF,MAAMK,iBAAiBhB,oBAAoBe,SAAS,CAACJ;gBACrD,MAAMM,iBACJH,kBAAkBX,oBAAoBa;gBAExC3B,KAAK6B,KAAK,CACRvC,kBACEI,cACAE,sBACA,OACA,QACA,kBACA,sBAEFgC;YAEJ;QACF;IACF;AACF"}
+{"version":3,"sources":["../../../../../../packages/nx-plugin/src/utils/identity-constructs/identity-constructs.ts"],"sourcesContent":["/**\n * Copyright Amazon.com, Inc. or its affiliates. All Rights Reserved.\n * SPDX-License-Identifier: Apache-2.0\n */\nimport {\n  generateFiles,\n  joinPathFragments,\n  OverwriteStrategy,\n  type Tree,\n} from '@nx/devkit';\nimport { addStarExport } from '../ast';\nimport type { DeclaredPyDependency } from '../declared-dependencies';\nimport type { Iac } from '../iac';\nimport { esmVars } from '../module-format';\nimport {\n  generatedTerraform,\n  type IacMetadata,\n  PACKAGES_DIR,\n  SHARED_CONSTRUCTS_DIR,\n  SHARED_TERRAFORM_DIR,\n} from '../shared-constructs-constants';\nimport {\n  type IPyDepVersion,\n  PY_VERSIONS,\n  terraformProviderVersions,\n} from '../versions';\n\n/**\n * Python version the generated Terraform pins in the callback URL module's inline\n * `uv run --with` script. Nothing installs it, so it is declared for its version\n * alone, and only on the Terraform branch that writes the script.\n */\nexport const IDENTITY_CONSTRUCTS_PY_DEPENDENCIES = [\n  { name: 'boto3', when: generatedTerraform },\n] as const satisfies readonly DeclaredPyDependency<\n  IPyDepVersion,\n  IacMetadata\n>[];\n\nexport interface AddIdentityInfraOptions {\n  cognitoDomain: string;\n  allowSignup: boolean;\n}\n\n/**\n * Add infrastructure for a static website\n */\nexport const addIdentityInfra = async (\n  tree: Tree,\n  options: AddIdentityInfraOptions & { iac: Iac },\n) => {\n  if (options.iac === 'cdk') {\n    await addIdentityCdkConstructs(tree, options);\n  } else if (options.iac === 'terraform') {\n    addIdentityTerraformModules(tree, options);\n  } else {\n    throw new Error(`Unsupported iac ${options.iac}`);\n  }\n};\n\nconst addIdentityCdkConstructs = async (\n  tree: Tree,\n  options: AddIdentityInfraOptions,\n) => {\n  generateFiles(\n    tree,\n    joinPathFragments(import.meta.dirname, 'files', 'cdk', 'core'),\n    joinPathFragments(PACKAGES_DIR, SHARED_CONSTRUCTS_DIR, 'src', 'core'),\n    { ...options, ...esmVars(tree) },\n    {\n      overwriteStrategy: OverwriteStrategy.KeepExisting,\n    },\n  );\n\n  await addStarExport(\n    tree,\n    joinPathFragments(\n      PACKAGES_DIR,\n      SHARED_CONSTRUCTS_DIR,\n      'src',\n      'core',\n      'index.ts',\n    ),\n    './user-identity.js',\n  );\n};\n\nconst addIdentityTerraformModules = (\n  tree: Tree,\n  options: AddIdentityInfraOptions,\n) => {\n  generateFiles(\n    tree,\n    joinPathFragments(import.meta.dirname, 'files', 'terraform', 'core'),\n    joinPathFragments(PACKAGES_DIR, SHARED_TERRAFORM_DIR, 'src', 'core'),\n    {\n      ...options,\n      boto3Version: PY_VERSIONS.boto3,\n      ...terraformProviderVersions(),\n    },\n    {\n      overwriteStrategy: OverwriteStrategy.KeepExisting,\n    },\n  );\n\n  // Update the static website module to add the callback url\n  const staticWebsiteModule = tree.read(\n    joinPathFragments(\n      PACKAGES_DIR,\n      SHARED_TERRAFORM_DIR,\n      'src',\n      'core',\n      'static-website',\n      'static-website.tf',\n    ),\n    'utf-8',\n  );\n  if (\n    staticWebsiteModule &&\n    !staticWebsiteModule.includes(\n      'source = \"../user-identity/add-callback-url\"',\n    )\n  ) {\n    // Find the aws_cloudfront_distribution.website resource and add the callback URL module after it.\n    // Includes the CloudFront domain plus any custom domain names (aliases) configured via var.custom_domain_names.\n    const callbackUrlModule = `\n\n# Add CloudFront domain and any custom domain names to user pool client callback URLs.\n# Keyed by statically-known values so for_each keys are resolvable at plan time; the\n# CloudFront domain is only known at apply time, so it appears in the value, not the key.\nlocals {\n  callback_urls = merge(\n    { cloudfront = \"https://\\${aws_cloudfront_distribution.website.domain_name}\" },\n    { for domain in var.custom_domain_names : domain => \"https://\\${domain}\" },\n  )\n}\n\nmodule \"add_callback_url\" {\n  source = \"../user-identity/add-callback-url\"\n  for_each = local.callback_urls\n\n  callback_url = each.value\n\n  depends_on = [aws_cloudfront_distribution.website]\n}`;\n\n    // Find the CloudFront distribution resource using proper brace counting\n    // This handles deeply nested structures correctly\n    const resourceStartPattern =\n      /resource\\s+\"aws_cloudfront_distribution\"\\s+\"website\"\\s*\\{/;\n    const resourceStartMatch = staticWebsiteModule.match(resourceStartPattern);\n\n    if (resourceStartMatch) {\n      const startIndex =\n        resourceStartMatch.index! + resourceStartMatch[0].length - 1; // Position at opening brace\n      let braceCount = 0;\n      let insertionPoint = -1;\n\n      // Count braces to find the end of the resource block\n      for (let i = startIndex; i < staticWebsiteModule.length; i++) {\n        const char = staticWebsiteModule[i];\n        if (char === '{') {\n          braceCount++;\n        } else if (char === '}') {\n          braceCount--;\n          if (braceCount === 0) {\n            // Found the closing brace of the CloudFront resource\n            insertionPoint = i + 1;\n            break;\n          }\n        }\n      }\n\n      if (insertionPoint !== -1) {\n        // Insert the callback URL module right after the CloudFront distribution\n        const beforeInsertion = staticWebsiteModule.substring(\n          0,\n          insertionPoint,\n        );\n        const afterInsertion = staticWebsiteModule.substring(insertionPoint);\n        const updatedContent =\n          beforeInsertion + callbackUrlModule + afterInsertion;\n\n        tree.write(\n          joinPathFragments(\n            PACKAGES_DIR,\n            SHARED_TERRAFORM_DIR,\n            'src',\n            'core',\n            'static-website',\n            'static-website.tf',\n          ),\n          updatedContent,\n        );\n      }\n    }\n  }\n};\n"],"names":["generateFiles","joinPathFragments","OverwriteStrategy","addStarExport","esmVars","generatedTerraform","PACKAGES_DIR","SHARED_CONSTRUCTS_DIR","SHARED_TERRAFORM_DIR","PY_VERSIONS","terraformProviderVersions","IDENTITY_CONSTRUCTS_PY_DEPENDENCIES","name","when","addIdentityInfra","tree","options","iac","addIdentityCdkConstructs","addIdentityTerraformModules","Error","dirname","overwriteStrategy","KeepExisting","boto3Version","boto3","staticWebsiteModule","read","includes","callbackUrlModule","resourceStartPattern","resourceStartMatch","match","startIndex","index","length","braceCount","insertionPoint","i","char","beforeInsertion","substring","afterInsertion","updatedContent","write"],"mappings":"AAAA;;;CAGC,GACD,SACEA,aAAa,EACbC,iBAAiB,EACjBC,iBAAiB,QAEZ,aAAa;AACpB,SAASC,aAAa,QAAQ,YAAS;AAGvC,SAASC,OAAO,QAAQ,sBAAmB;AAC3C,SACEC,kBAAkB,EAElBC,YAAY,EACZC,qBAAqB,EACrBC,oBAAoB,QACf,oCAAiC;AACxC,SAEEC,WAAW,EACXC,yBAAyB,QACpB,iBAAc;AAErB;;;;CAIC,GACD,OAAO,MAAMC,sCAAsC;IACjD;QAAEC,MAAM;QAASC,MAAMR;IAAmB;CAC3C,CAGG;AAOJ;;CAEC,GACD,OAAO,MAAMS,mBAAmB,OAC9BC,MACAC;IAEA,IAAIA,QAAQC,GAAG,KAAK,OAAO;QACzB,MAAMC,yBAAyBH,MAAMC;IACvC,OAAO,IAAIA,QAAQC,GAAG,KAAK,aAAa;QACtCE,4BAA4BJ,MAAMC;IACpC,OAAO;QACL,MAAM,IAAII,MAAM,CAAC,gBAAgB,EAAEJ,QAAQC,GAAG,EAAE;IAClD;AACF,EAAE;AAEF,MAAMC,2BAA2B,OAC/BH,MACAC;IAEAhB,cACEe,MACAd,kBAAkB,YAAYoB,OAAO,EAAE,SAAS,OAAO,SACvDpB,kBAAkBK,cAAcC,uBAAuB,OAAO,SAC9D;QAAE,GAAGS,OAAO;QAAE,GAAGZ,QAAQW,KAAK;IAAC,GAC/B;QACEO,mBAAmBpB,kBAAkBqB,YAAY;IACnD;IAGF,MAAMpB,cACJY,MACAd,kBACEK,cACAC,uBACA,OACA,QACA,aAEF;AAEJ;AAEA,MAAMY,8BAA8B,CAClCJ,MACAC;IAEAhB,cACEe,MACAd,kBAAkB,YAAYoB,OAAO,EAAE,SAAS,aAAa,SAC7DpB,kBAAkBK,cAAcE,sBAAsB,OAAO,SAC7D;QACE,GAAGQ,OAAO;QACVQ,cAAcf,YAAYgB,KAAK;QAC/B,GAAGf,2BAA2B;IAChC,GACA;QACEY,mBAAmBpB,kBAAkBqB,YAAY;IACnD;IAGF,2DAA2D;IAC3D,MAAMG,sBAAsBX,KAAKY,IAAI,CACnC1B,kBACEK,cACAE,sBACA,OACA,QACA,kBACA,sBAEF;IAEF,IACEkB,uBACA,CAACA,oBAAoBE,QAAQ,CAC3B,iDAEF;QACA,kGAAkG;QAClG,gHAAgH;QAChH,MAAMC,oBAAoB,CAAC;;;;;;;;;;;;;;;;;;;CAmB9B,CAAC;QAEE,wEAAwE;QACxE,kDAAkD;QAClD,MAAMC,uBACJ;QACF,MAAMC,qBAAqBL,oBAAoBM,KAAK,CAACF;QAErD,IAAIC,oBAAoB;YACtB,MAAME,aACJF,mBAAmBG,KAAK,GAAIH,kBAAkB,CAAC,EAAE,CAACI,MAAM,GAAG,GAAG,4BAA4B;YAC5F,IAAIC,aAAa;YACjB,IAAIC,iBAAiB,CAAC;YAEtB,qDAAqD;YACrD,IAAK,IAAIC,IAAIL,YAAYK,IAAIZ,oBAAoBS,MAAM,EAAEG,IAAK;gBAC5D,MAAMC,OAAOb,mBAAmB,CAACY,EAAE;gBACnC,IAAIC,SAAS,KAAK;oBAChBH;gBACF,OAAO,IAAIG,SAAS,KAAK;oBACvBH;oBACA,IAAIA,eAAe,GAAG;wBACpB,qDAAqD;wBACrDC,iBAAiBC,IAAI;wBACrB;oBACF;gBACF;YACF;YAEA,IAAID,mBAAmB,CAAC,GAAG;gBACzB,yEAAyE;gBACzE,MAAMG,kBAAkBd,oBAAoBe,SAAS,CACnD,GACAJ;gBAEF,MAAMK,iBAAiBhB,oBAAoBe,SAAS,CAACJ;gBACrD,MAAMM,iBACJH,kBAAkBX,oBAAoBa;gBAExC3B,KAAK6B,KAAK,CACR3C,kBACEK,cACAE,sBACA,OACA,QACA,kBACA,sBAEFmC;YAEJ;QACF;IACF;AACF"}

package/src/utils/shared-constructs-constants.d.ts

@@ -31,6 +31,12 @@ export interface IacMetadata {
  * questions and no generator needs a second one.
  */
 export declare const generatedInfrastructure: (m: IacMetadata) => boolean;
+/**
+ * Whether Terraform infrastructure was generated, for the versions only a `.tf`
+ * module pins — a Terraform inline script's `uv run --with` pins, which the CDK
+ * branch never writes.
+ */
+export declare const generatedTerraform: (m: IacMetadata) => boolean;
 /**
  * Dependencies a caller must declare to use the shared constructs project.
  * Lives here so generators can spread it without importing the generator.

package/src/utils/shared-constructs-constants.js

@@ -24,6 +24,11 @@ export const DYNAMODB_GENERATOR_IDS = [
  * resolves `iac` only on the infra branch, so one recorded field answers both
  * questions and no generator needs a second one.
  */ export const generatedInfrastructure = (m)=>m.iac !== undefined;
+/**
+ * Whether Terraform infrastructure was generated, for the versions only a `.tf`
+ * module pins — a Terraform inline script's `uv run --with` pins, which the CDK
+ * branch never writes.
+ */ export const generatedTerraform = (m)=>m.iac === 'terraform';
 /**
  * Dependencies a caller must declare to use the shared constructs project.
  * Lives here so generators can spread it without importing the generator.

package/src/utils/shared-constructs-constants.js.map

@@ -1 +1 @@
-{"version":3,"sources":["../../../../../packages/nx-plugin/src/utils/shared-constructs-constants.ts"],"sourcesContent":["/**\n * Copyright Amazon.com, Inc. or its affiliates. All Rights Reserved.\n * SPDX-License-Identifier: Apache-2.0\n */\nimport type { DeclaredTsDependency } from './declared-dependencies';\nimport type { ITsDepVersion } from './versions';\n\nexport const PACKAGES_DIR = 'packages';\nexport const SHARED_CONSTRUCTS_NAME = 'common-constructs';\nexport const SHARED_CONSTRUCTS_DIR = 'common/constructs';\nexport const SHARED_TERRAFORM_NAME = 'terraform';\nexport const SHARED_TERRAFORM_DIR = 'common/terraform';\nexport const SHARED_SHADCN_NAME = 'common-shadcn';\nexport const SHARED_SHADCN_DIR = 'common/shadcn';\nexport const SHARED_INFRA_CONFIG_NAME = 'common-infra-config';\nexport const SHARED_INFRA_CONFIG_DIR = 'common/infra-config';\nexport const SHARED_SCRIPTS_NAME = 'common-scripts';\nexport const SHARED_SCRIPTS_DIR = 'common/scripts';\n\nexport const DYNAMODB_GENERATOR_IDS = ['ts#dynamodb', 'py#dynamodb'];\n\n/**\n * What a generator records about the infrastructure it generated.\n *\n * Every generator that creates infrastructure records the `iac` it used, so a\n * predicate can tell a CDK project from a Terraform one at upgrade time. Absent\n * when the generator was run with no infrastructure, so its presence doubles as\n * \"infrastructure was generated\" — which is what gates the packages an infra\n * helper adds.\n */\nexport interface IacMetadata {\n  readonly iac?: string;\n}\n\n/**\n * Whether infrastructure was generated at all, so the packages an infra helper\n * adds are only claimed where that helper ran.\n *\n * Reads `iac` rather than the generator's own `infra` option: every generator\n * resolves `iac` only on the infra branch, so one recorded field answers both\n * questions and no generator needs a second one.\n */\nexport const generatedInfrastructure = (m: IacMetadata): boolean =>\n  m.iac !== undefined;\n\n/**\n * Dependencies a caller must declare to use the shared constructs project.\n * Lives here so generators can spread it without importing the generator.\n *\n * `constructs` and `aws-cdk-lib` are gated on CDK because\n * `sharedConstructsGenerator` creates the TypeScript constructs project on that\n * branch alone — a Terraform workspace gets the shared Terraform project and\n * never receives them.\n */\nexport const SHARED_CONSTRUCTS_DEPENDENCIES = [\n  { name: 'constructs', when: (m: IacMetadata) => m.iac === 'cdk' },\n  { name: 'aws-cdk-lib', when: (m: IacMetadata) => m.iac === 'cdk' },\n  { name: '@types/node' },\n] as const satisfies readonly DeclaredTsDependency<\n  ITsDepVersion,\n  IacMetadata\n>[];\n"],"names":["PACKAGES_DIR","SHARED_CONSTRUCTS_NAME","SHARED_CONSTRUCTS_DIR","SHARED_TERRAFORM_NAME","SHARED_TERRAFORM_DIR","SHARED_SHADCN_NAME","SHARED_SHADCN_DIR","SHARED_INFRA_CONFIG_NAME","SHARED_INFRA_CONFIG_DIR","SHARED_SCRIPTS_NAME","SHARED_SCRIPTS_DIR","DYNAMODB_GENERATOR_IDS","generatedInfrastructure","m","iac","undefined","SHARED_CONSTRUCTS_DEPENDENCIES","name","when"],"mappings":"AAAA;;;CAGC,GAID,OAAO,MAAMA,eAAe,WAAW;AACvC,OAAO,MAAMC,yBAAyB,oBAAoB;AAC1D,OAAO,MAAMC,wBAAwB,oBAAoB;AACzD,OAAO,MAAMC,wBAAwB,YAAY;AACjD,OAAO,MAAMC,uBAAuB,mBAAmB;AACvD,OAAO,MAAMC,qBAAqB,gBAAgB;AAClD,OAAO,MAAMC,oBAAoB,gBAAgB;AACjD,OAAO,MAAMC,2BAA2B,sBAAsB;AAC9D,OAAO,MAAMC,0BAA0B,sBAAsB;AAC7D,OAAO,MAAMC,sBAAsB,iBAAiB;AACpD,OAAO,MAAMC,qBAAqB,iBAAiB;AAEnD,OAAO,MAAMC,yBAAyB;IAAC;IAAe;CAAc,CAAC;AAerE;;;;;;;CAOC,GACD,OAAO,MAAMC,0BAA0B,CAACC,IACtCA,EAAEC,GAAG,KAAKC,UAAU;AAEtB;;;;;;;;CAQC,GACD,OAAO,MAAMC,iCAAiC;IAC5C;QAAEC,MAAM;QAAcC,MAAM,CAACL,IAAmBA,EAAEC,GAAG,KAAK;IAAM;IAChE;QAAEG,MAAM;QAAeC,MAAM,CAACL,IAAmBA,EAAEC,GAAG,KAAK;IAAM;IACjE;QAAEG,MAAM;IAAc;CACvB,CAGG"}
+{"version":3,"sources":["../../../../../packages/nx-plugin/src/utils/shared-constructs-constants.ts"],"sourcesContent":["/**\n * Copyright Amazon.com, Inc. or its affiliates. All Rights Reserved.\n * SPDX-License-Identifier: Apache-2.0\n */\nimport type { DeclaredTsDependency } from './declared-dependencies';\nimport type { ITsDepVersion } from './versions';\n\nexport const PACKAGES_DIR = 'packages';\nexport const SHARED_CONSTRUCTS_NAME = 'common-constructs';\nexport const SHARED_CONSTRUCTS_DIR = 'common/constructs';\nexport const SHARED_TERRAFORM_NAME = 'terraform';\nexport const SHARED_TERRAFORM_DIR = 'common/terraform';\nexport const SHARED_SHADCN_NAME = 'common-shadcn';\nexport const SHARED_SHADCN_DIR = 'common/shadcn';\nexport const SHARED_INFRA_CONFIG_NAME = 'common-infra-config';\nexport const SHARED_INFRA_CONFIG_DIR = 'common/infra-config';\nexport const SHARED_SCRIPTS_NAME = 'common-scripts';\nexport const SHARED_SCRIPTS_DIR = 'common/scripts';\n\nexport const DYNAMODB_GENERATOR_IDS = ['ts#dynamodb', 'py#dynamodb'];\n\n/**\n * What a generator records about the infrastructure it generated.\n *\n * Every generator that creates infrastructure records the `iac` it used, so a\n * predicate can tell a CDK project from a Terraform one at upgrade time. Absent\n * when the generator was run with no infrastructure, so its presence doubles as\n * \"infrastructure was generated\" — which is what gates the packages an infra\n * helper adds.\n */\nexport interface IacMetadata {\n  readonly iac?: string;\n}\n\n/**\n * Whether infrastructure was generated at all, so the packages an infra helper\n * adds are only claimed where that helper ran.\n *\n * Reads `iac` rather than the generator's own `infra` option: every generator\n * resolves `iac` only on the infra branch, so one recorded field answers both\n * questions and no generator needs a second one.\n */\nexport const generatedInfrastructure = (m: IacMetadata): boolean =>\n  m.iac !== undefined;\n\n/**\n * Whether Terraform infrastructure was generated, for the versions only a `.tf`\n * module pins — a Terraform inline script's `uv run --with` pins, which the CDK\n * branch never writes.\n */\nexport const generatedTerraform = (m: IacMetadata): boolean =>\n  m.iac === 'terraform';\n\n/**\n * Dependencies a caller must declare to use the shared constructs project.\n * Lives here so generators can spread it without importing the generator.\n *\n * `constructs` and `aws-cdk-lib` are gated on CDK because\n * `sharedConstructsGenerator` creates the TypeScript constructs project on that\n * branch alone — a Terraform workspace gets the shared Terraform project and\n * never receives them.\n */\nexport const SHARED_CONSTRUCTS_DEPENDENCIES = [\n  { name: 'constructs', when: (m: IacMetadata) => m.iac === 'cdk' },\n  { name: 'aws-cdk-lib', when: (m: IacMetadata) => m.iac === 'cdk' },\n  { name: '@types/node' },\n] as const satisfies readonly DeclaredTsDependency<\n  ITsDepVersion,\n  IacMetadata\n>[];\n"],"names":["PACKAGES_DIR","SHARED_CONSTRUCTS_NAME","SHARED_CONSTRUCTS_DIR","SHARED_TERRAFORM_NAME","SHARED_TERRAFORM_DIR","SHARED_SHADCN_NAME","SHARED_SHADCN_DIR","SHARED_INFRA_CONFIG_NAME","SHARED_INFRA_CONFIG_DIR","SHARED_SCRIPTS_NAME","SHARED_SCRIPTS_DIR","DYNAMODB_GENERATOR_IDS","generatedInfrastructure","m","iac","undefined","generatedTerraform","SHARED_CONSTRUCTS_DEPENDENCIES","name","when"],"mappings":"AAAA;;;CAGC,GAID,OAAO,MAAMA,eAAe,WAAW;AACvC,OAAO,MAAMC,yBAAyB,oBAAoB;AAC1D,OAAO,MAAMC,wBAAwB,oBAAoB;AACzD,OAAO,MAAMC,wBAAwB,YAAY;AACjD,OAAO,MAAMC,uBAAuB,mBAAmB;AACvD,OAAO,MAAMC,qBAAqB,gBAAgB;AAClD,OAAO,MAAMC,oBAAoB,gBAAgB;AACjD,OAAO,MAAMC,2BAA2B,sBAAsB;AAC9D,OAAO,MAAMC,0BAA0B,sBAAsB;AAC7D,OAAO,MAAMC,sBAAsB,iBAAiB;AACpD,OAAO,MAAMC,qBAAqB,iBAAiB;AAEnD,OAAO,MAAMC,yBAAyB;IAAC;IAAe;CAAc,CAAC;AAerE;;;;;;;CAOC,GACD,OAAO,MAAMC,0BAA0B,CAACC,IACtCA,EAAEC,GAAG,KAAKC,UAAU;AAEtB;;;;CAIC,GACD,OAAO,MAAMC,qBAAqB,CAACH,IACjCA,EAAEC,GAAG,KAAK,YAAY;AAExB;;;;;;;;CAQC,GACD,OAAO,MAAMG,iCAAiC;IAC5C;QAAEC,MAAM;QAAcC,MAAM,CAACN,IAAmBA,EAAEC,GAAG,KAAK;IAAM;IAChE;QAAEI,MAAM;QAAeC,MAAM,CAACN,IAAmBA,EAAEC,GAAG,KAAK;IAAM;IACjE;QAAEI,MAAM;IAAc;CACvB,CAGG"}

package/src/utils/version-upgrade-migration/owned-dependencies.d.ts

@@ -12,6 +12,15 @@ export declare const PLUGIN_ROOT: string;
 export interface OwnedDependencies {
     readonly ts: ReadonlySet<string>;
     readonly py: ReadonlySet<string>;
+    /**
+     * The same, split by the root of the project that owns it, for scoping a pin
+     * embedded in a generated file to the project it sits in. Keyed by project
+     * root; read through {@link ownedForFile}.
+     */
+    readonly byProject: ReadonlyMap<string, {
+        readonly ts: ReadonlySet<string>;
+        readonly py: ReadonlySet<string>;
+    }>;
 }
 /**
  * One recorded run of a generator, with the metadata it wrote.
@@ -22,6 +31,8 @@ export interface OwnedDependencies {
 export interface GeneratorOccurrence {
     readonly id: string;
     readonly metadata: DependencyMetadata;
+    /** Root of the project this ran against, for scoping what it owns to it. */
+    readonly projectRoot?: string;
 }
 /**
  * Every recorded run of a generator in this workspace, from the metadata
@@ -48,3 +59,18 @@ export declare const generatorsRun: (tree: Tree) => ReadonlySet<string>;
  * rather than a run — the generators themselves are never invoked.
  */
 export declare const ownedDependencies: (tree: Tree) => Promise<OwnedDependencies>;
+/**
+ * The dependencies owned where a file sits: those of the project it belongs to,
+ * or the workspace-wide union for a file in a shared project or under none.
+ *
+ * Used for the pins embedded in a generated file, so a version is only rewritten
+ * where the generator that pins it actually ran: a `Dockerfile` under one
+ * project's root is not upgraded because a sibling project owns the package.
+ *
+ * The longest matching root wins, since a nested project's root is a prefix of
+ * nothing else but its own files.
+ */
+export declare const ownedForFile: (owned: OwnedDependencies, filePath: string) => {
+    ts: ReadonlySet<string>;
+    py: ReadonlySet<string>;
+};