@aws/nx-plugin 1.0.0-rc.57 → 1.0.0-rc.59

package/src/utils/config/utils.js.map

@@ -1 +1 @@
-{"version":3,"sources":["../../../../../../packages/nx-plugin/src/utils/config/utils.ts"],"sourcesContent":["/**\n * Copyright Amazon.com, Inc. or its affiliates. All Rights Reserved.\n * SPDX-License-Identifier: Apache-2.0\n */\nimport { generateFiles, joinPathFragments, type Tree } from '@nx/devkit';\nimport { existsSync, readFileSync } from 'fs';\nimport { createJiti } from 'jiti';\nimport { join } from 'path';\nimport { applyGritQL, matchGritQL } from '../ast';\nimport { formatFilesInSubtree } from '../format';\nimport type { AwsNxPluginConfig } from '.';\n\nexport const AWS_NX_PLUGIN_CONFIG_FILE_NAME = 'aws-nx-plugin.config.mts';\n\n/**\n * Aliases used by jiti to resolve `@aws/nx-plugin` imports in the config file\n * to this package's source, so the config can be evaluated in-memory.\n */\nconst AWS_NX_PLUGIN_JITI_ALIASES = {\n  '@aws/nx-plugin/sdk/license': join(\n    import.meta.dirname,\n    '..',\n    '..',\n    'sdk',\n    'license',\n  ),\n  '@aws/nx-plugin': join(import.meta.dirname, '..', '..'),\n};\n\n/**\n * Ensure that the config file exists\n */\nexport const ensureAwsNxPluginConfig = async (\n  tree: Tree,\n): Promise<AwsNxPluginConfig> => {\n  if (!tree.exists(AWS_NX_PLUGIN_CONFIG_FILE_NAME)) {\n    // Create an empty config file if it doesn't already exist\n    generateFiles(\n      tree,\n      joinPathFragments(import.meta.dirname, 'files'),\n      '.',\n      {},\n    );\n  }\n  // eslint-disable-next-line @typescript-eslint/no-non-null-assertion\n  return readAwsNxPluginConfig(tree)!;\n};\n\n/**\n * Read config from the aws nx plugin configuration file.\n *\n * Uses jiti to evaluate the TypeScript source in-memory with proper module\n * resolution — imports from @aws/nx-plugin/* resolve via alias, and any\n * third-party imports resolve from the workspace's node_modules. Synchronous,\n * since `jiti.evalModule` runs in-memory.\n */\nexport const readAwsNxPluginConfig = (\n  tree: Tree,\n): AwsNxPluginConfig | undefined => {\n  if (!tree.exists(AWS_NX_PLUGIN_CONFIG_FILE_NAME)) {\n    return undefined;\n  }\n  const source = tree.read(AWS_NX_PLUGIN_CONFIG_FILE_NAME, 'utf-8')!;\n  const configFilePath = join(tree.root, AWS_NX_PLUGIN_CONFIG_FILE_NAME);\n\n  const jiti = createJiti(import.meta.filename, {\n    alias: AWS_NX_PLUGIN_JITI_ALIASES,\n  });\n\n  const mod = jiti.evalModule(source, { filename: configFilePath });\n  return (mod as any).default ?? mod;\n};\n\n/**\n * Read config directly from disk. Used by executors that run in the real\n * workspace (not a virtual Tree). Resolves all imports — including\n * third-party dependencies — from the workspace's node_modules.\n */\nexport const readAwsNxPluginConfigFromDisk = (\n  workspaceRoot: string,\n): AwsNxPluginConfig | undefined => {\n  const configPath = join(workspaceRoot, AWS_NX_PLUGIN_CONFIG_FILE_NAME);\n  if (!existsSync(configPath)) return undefined;\n\n  const source = readFileSync(configPath, 'utf-8');\n\n  const jiti = createJiti(import.meta.filename, {\n    alias: AWS_NX_PLUGIN_JITI_ALIASES,\n  });\n  const mod = jiti.evalModule(source, { filename: configPath });\n  return (mod as any).default ?? mod;\n};\n\nconst PLACEHOLDER = '\"__PLACEHOLDER__\"';\n\n/**\n * Use GritQL to set a top-level property in the export default object,\n * then substitute the placeholder with the JSON-serialized value.\n * Preserves all other properties (including JS expressions) untouched.\n */\nconst setConfigProperty = async (\n  tree: Tree,\n  filePath: string,\n  key: string,\n  value: unknown,\n): Promise<void> => {\n  const json = JSON.stringify(value);\n\n  // Check if the property already exists using a named metavariable\n  // to avoid ambiguity with anonymous $_ in nested where clauses\n  const existsInSatisfies = await matchGritQL(\n    tree,\n    filePath,\n    `\\`${key}: $val\\` where { $val <: within \\`export default $_ satisfies $_\\` }`,\n  );\n  const existsInPlain =\n    !existsInSatisfies &&\n    (await matchGritQL(\n      tree,\n      filePath,\n      `\\`${key}: $val\\` where { $val <: within \\`export default $_\\` }`,\n    ));\n\n  if (existsInSatisfies || existsInPlain) {\n    // Replace only this property's value, scoped to the export default\n    const within = existsInSatisfies\n      ? `within \\`export default $_ satisfies $_\\``\n      : `within \\`export default $_\\``;\n    await applyGritQL(\n      tree,\n      filePath,\n      `\\`${key}: $old\\` => \\`${key}: ${PLACEHOLDER}\\` where { $old <: ${within} }`,\n    );\n  } else {\n    // Add the new property using GritQL's += (accumulate) operator.\n    // For non-empty objects, += appends correctly without double commas.\n    // For empty objects, += fails so we fall back to a direct replacement.\n    let added = await applyGritQL(\n      tree,\n      filePath,\n      `\\`export default { $props } satisfies $type\\` where { $props += \\`, ${key}: ${PLACEHOLDER}\\` }`,\n    );\n\n    if (!added) {\n      added = await applyGritQL(\n        tree,\n        filePath,\n        `\\`export default { } satisfies $type\\` => \\`export default { ${key}: ${PLACEHOLDER} } satisfies $type\\``,\n      );\n    }\n\n    if (!added) {\n      added = await applyGritQL(\n        tree,\n        filePath,\n        `\\`export default { $props }\\` where { $props += \\`, ${key}: ${PLACEHOLDER}\\` }`,\n      );\n    }\n\n    if (!added) {\n      await applyGritQL(\n        tree,\n        filePath,\n        `\\`export default { }\\` => \\`export default { ${key}: ${PLACEHOLDER} }\\``,\n      );\n    }\n  }\n\n  // Substitute the placeholder with the actual JSON value\n  const content = tree.read(filePath)!.toString();\n  tree.write(filePath, content.replace(PLACEHOLDER, json));\n};\n\n/**\n * Update the aws nx plugin config file.\n * Only the specified top-level keys are replaced; all other properties\n * (including those containing JS expressions) are left untouched in source.\n */\nexport const updateAwsNxPluginConfig = async (\n  tree: Tree,\n  configUpdate: Partial<AwsNxPluginConfig>,\n): Promise<void> => {\n  const filePath = AWS_NX_PLUGIN_CONFIG_FILE_NAME;\n\n  for (const [key, value] of Object.entries(configUpdate)) {\n    await setConfigProperty(tree, filePath, key, value);\n  }\n\n  // Prettier formats the result into properly indented TypeScript\n  await formatFilesInSubtree(tree, filePath);\n};\n"],"names":["generateFiles","joinPathFragments","existsSync","readFileSync","createJiti","join","applyGritQL","matchGritQL","formatFilesInSubtree","AWS_NX_PLUGIN_CONFIG_FILE_NAME","AWS_NX_PLUGIN_JITI_ALIASES","dirname","ensureAwsNxPluginConfig","tree","exists","readAwsNxPluginConfig","undefined","source","read","configFilePath","root","jiti","filename","alias","mod","evalModule","default","readAwsNxPluginConfigFromDisk","workspaceRoot","configPath","PLACEHOLDER","setConfigProperty","filePath","key","value","json","JSON","stringify","existsInSatisfies","existsInPlain","within","added","content","toString","write","replace","updateAwsNxPluginConfig","configUpdate","Object","entries"],"mappings":"AAAA;;;CAGC,GACD,SAASA,aAAa,EAAEC,iBAAiB,QAAmB,aAAa;AACzE,SAASC,UAAU,EAAEC,YAAY,QAAQ,KAAK;AAC9C,SAASC,UAAU,QAAQ,OAAO;AAClC,SAASC,IAAI,QAAQ,OAAO;AAC5B,SAASC,WAAW,EAAEC,WAAW,QAAQ,YAAS;AAClD,SAASC,oBAAoB,QAAQ,eAAY;AAGjD,OAAO,MAAMC,iCAAiC,2BAA2B;AAEzE;;;CAGC,GACD,MAAMC,6BAA6B;IACjC,8BAA8BL,KAC5B,YAAYM,OAAO,EACnB,MACA,MACA,OACA;IAEF,kBAAkBN,KAAK,YAAYM,OAAO,EAAE,MAAM;AACpD;AAEA;;CAEC,GACD,OAAO,MAAMC,0BAA0B,OACrCC;IAEA,IAAI,CAACA,KAAKC,MAAM,CAACL,iCAAiC;QAChD,0DAA0D;QAC1DT,cACEa,MACAZ,kBAAkB,YAAYU,OAAO,EAAE,UACvC,KACA,CAAC;IAEL;IACA,oEAAoE;IACpE,OAAOI,sBAAsBF;AAC/B,EAAE;AAEF;;;;;;;CAOC,GACD,OAAO,MAAME,wBAAwB,CACnCF;IAEA,IAAI,CAACA,KAAKC,MAAM,CAACL,iCAAiC;QAChD,OAAOO;IACT;IACA,MAAMC,SAASJ,KAAKK,IAAI,CAACT,gCAAgC;IACzD,MAAMU,iBAAiBd,KAAKQ,KAAKO,IAAI,EAAEX;IAEvC,MAAMY,OAAOjB,WAAW,YAAYkB,QAAQ,EAAE;QAC5CC,OAAOb;IACT;IAEA,MAAMc,MAAMH,KAAKI,UAAU,CAACR,QAAQ;QAAEK,UAAUH;IAAe;IAC/D,OAAO,AAACK,IAAYE,OAAO,IAAIF;AACjC,EAAE;AAEF;;;;CAIC,GACD,OAAO,MAAMG,gCAAgC,CAC3CC;IAEA,MAAMC,aAAaxB,KAAKuB,eAAenB;IACvC,IAAI,CAACP,WAAW2B,aAAa,OAAOb;IAEpC,MAAMC,SAASd,aAAa0B,YAAY;IAExC,MAAMR,OAAOjB,WAAW,YAAYkB,QAAQ,EAAE;QAC5CC,OAAOb;IACT;IACA,MAAMc,MAAMH,KAAKI,UAAU,CAACR,QAAQ;QAAEK,UAAUO;IAAW;IAC3D,OAAO,AAACL,IAAYE,OAAO,IAAIF;AACjC,EAAE;AAEF,MAAMM,cAAc;AAEpB;;;;CAIC,GACD,MAAMC,oBAAoB,OACxBlB,MACAmB,UACAC,KACAC;IAEA,MAAMC,OAAOC,KAAKC,SAAS,CAACH;IAE5B,kEAAkE;IAClE,+DAA+D;IAC/D,MAAMI,oBAAoB,MAAM/B,YAC9BM,MACAmB,UACA,CAAC,EAAE,EAAEC,IAAI,oEAAoE,CAAC;IAEhF,MAAMM,gBACJ,CAACD,qBACA,MAAM/B,YACLM,MACAmB,UACA,CAAC,EAAE,EAAEC,IAAI,uDAAuD,CAAC;IAGrE,IAAIK,qBAAqBC,eAAe;QACtC,mEAAmE;QACnE,MAAMC,SAASF,oBACX,CAAC,yCAAyC,CAAC,GAC3C,CAAC,4BAA4B,CAAC;QAClC,MAAMhC,YACJO,MACAmB,UACA,CAAC,EAAE,EAAEC,IAAI,cAAc,EAAEA,IAAI,EAAE,EAAEH,YAAY,mBAAmB,EAAEU,OAAO,EAAE,CAAC;IAEhF,OAAO;QACL,gEAAgE;QAChE,qEAAqE;QACrE,uEAAuE;QACvE,IAAIC,QAAQ,MAAMnC,YAChBO,MACAmB,UACA,CAAC,oEAAoE,EAAEC,IAAI,EAAE,EAAEH,YAAY,IAAI,CAAC;QAGlG,IAAI,CAACW,OAAO;YACVA,QAAQ,MAAMnC,YACZO,MACAmB,UACA,CAAC,6DAA6D,EAAEC,IAAI,EAAE,EAAEH,YAAY,oBAAoB,CAAC;QAE7G;QAEA,IAAI,CAACW,OAAO;YACVA,QAAQ,MAAMnC,YACZO,MACAmB,UACA,CAAC,oDAAoD,EAAEC,IAAI,EAAE,EAAEH,YAAY,IAAI,CAAC;QAEpF;QAEA,IAAI,CAACW,OAAO;YACV,MAAMnC,YACJO,MACAmB,UACA,CAAC,6CAA6C,EAAEC,IAAI,EAAE,EAAEH,YAAY,IAAI,CAAC;QAE7E;IACF;IAEA,wDAAwD;IACxD,MAAMY,UAAU7B,KAAKK,IAAI,CAACc,UAAWW,QAAQ;IAC7C9B,KAAK+B,KAAK,CAACZ,UAAUU,QAAQG,OAAO,CAACf,aAAaK;AACpD;AAEA;;;;CAIC,GACD,OAAO,MAAMW,0BAA0B,OACrCjC,MACAkC;IAEA,MAAMf,WAAWvB;IAEjB,KAAK,MAAM,CAACwB,KAAKC,MAAM,IAAIc,OAAOC,OAAO,CAACF,cAAe;QACvD,MAAMhB,kBAAkBlB,MAAMmB,UAAUC,KAAKC;IAC/C;IAEA,gEAAgE;IAChE,MAAM1B,qBAAqBK,MAAMmB;AACnC,EAAE"}
+{"version":3,"sources":["../../../../../../packages/nx-plugin/src/utils/config/utils.ts"],"sourcesContent":["/**\n * Copyright Amazon.com, Inc. or its affiliates. All Rights Reserved.\n * SPDX-License-Identifier: Apache-2.0\n */\nimport { generateFiles, joinPathFragments, type Tree } from '@nx/devkit';\nimport { existsSync, readFileSync } from 'fs';\nimport { createJiti } from 'jiti';\nimport { join } from 'path';\nimport { applyGritQL, matchGritQL } from '../ast';\nimport { formatFilesInSubtree } from '../format';\nimport type { AwsNxPluginConfig } from '.';\n\nexport const AWS_NX_PLUGIN_CONFIG_FILE_NAME = 'aws-nx-plugin.config.mts';\n\n/**\n * Aliases used by jiti to resolve `@aws/nx-plugin` imports in the config file\n * to this package's source, so the config can be evaluated in-memory.\n */\nconst AWS_NX_PLUGIN_JITI_ALIASES = {\n  '@aws/nx-plugin/sdk/license': join(\n    import.meta.dirname,\n    '..',\n    '..',\n    'sdk',\n    'license',\n  ),\n  '@aws/nx-plugin': join(import.meta.dirname, '..', '..'),\n};\n\n/**\n * Ensure that the config file exists\n */\nexport const ensureAwsNxPluginConfig = async (\n  tree: Tree,\n): Promise<AwsNxPluginConfig> => {\n  if (!tree.exists(AWS_NX_PLUGIN_CONFIG_FILE_NAME)) {\n    // Create an empty config file if it doesn't already exist\n    generateFiles(\n      tree,\n      joinPathFragments(import.meta.dirname, 'files'),\n      '.',\n      {},\n    );\n  }\n  // eslint-disable-next-line @typescript-eslint/no-non-null-assertion\n  return readAwsNxPluginConfig(tree)!;\n};\n\n/**\n * Read config from the aws nx plugin configuration file.\n *\n * Uses jiti to evaluate the TypeScript source in-memory with proper module\n * resolution — imports from @aws/nx-plugin/* resolve via alias, and any\n * third-party imports resolve from the workspace's node_modules. Synchronous,\n * since `jiti.evalModule` runs in-memory.\n *\n * The on-disk transform cache is off: jiti keys it by file path, but the source\n * here comes from the Tree, so one path holds different content as generators\n * mutate the config — and every test Tree shares the `/virtual` root, making\n * concurrent workers collide on a single cache file.\n */\nexport const readAwsNxPluginConfig = (\n  tree: Tree,\n): AwsNxPluginConfig | undefined => {\n  if (!tree.exists(AWS_NX_PLUGIN_CONFIG_FILE_NAME)) {\n    return undefined;\n  }\n  const source = tree.read(AWS_NX_PLUGIN_CONFIG_FILE_NAME, 'utf-8')!;\n  const configFilePath = join(tree.root, AWS_NX_PLUGIN_CONFIG_FILE_NAME);\n\n  const jiti = createJiti(import.meta.filename, {\n    alias: AWS_NX_PLUGIN_JITI_ALIASES,\n    fsCache: false,\n  });\n\n  const mod = jiti.evalModule(source, { filename: configFilePath });\n  return (mod as any).default ?? mod;\n};\n\n/**\n * Read config directly from disk. Used by executors that run in the real\n * workspace (not a virtual Tree). Resolves all imports — including\n * third-party dependencies — from the workspace's node_modules.\n */\nexport const readAwsNxPluginConfigFromDisk = (\n  workspaceRoot: string,\n): AwsNxPluginConfig | undefined => {\n  const configPath = join(workspaceRoot, AWS_NX_PLUGIN_CONFIG_FILE_NAME);\n  if (!existsSync(configPath)) return undefined;\n\n  const source = readFileSync(configPath, 'utf-8');\n\n  const jiti = createJiti(import.meta.filename, {\n    alias: AWS_NX_PLUGIN_JITI_ALIASES,\n  });\n  const mod = jiti.evalModule(source, { filename: configPath });\n  return (mod as any).default ?? mod;\n};\n\nconst PLACEHOLDER = '\"__PLACEHOLDER__\"';\n\n/**\n * Use GritQL to set a top-level property in the export default object,\n * then substitute the placeholder with the JSON-serialized value.\n * Preserves all other properties (including JS expressions) untouched.\n */\nconst setConfigProperty = async (\n  tree: Tree,\n  filePath: string,\n  key: string,\n  value: unknown,\n): Promise<void> => {\n  const json = JSON.stringify(value);\n\n  // Check if the property already exists using a named metavariable\n  // to avoid ambiguity with anonymous $_ in nested where clauses\n  const existsInSatisfies = await matchGritQL(\n    tree,\n    filePath,\n    `\\`${key}: $val\\` where { $val <: within \\`export default $_ satisfies $_\\` }`,\n  );\n  const existsInPlain =\n    !existsInSatisfies &&\n    (await matchGritQL(\n      tree,\n      filePath,\n      `\\`${key}: $val\\` where { $val <: within \\`export default $_\\` }`,\n    ));\n\n  if (existsInSatisfies || existsInPlain) {\n    // Replace only this property's value, scoped to the export default\n    const within = existsInSatisfies\n      ? `within \\`export default $_ satisfies $_\\``\n      : `within \\`export default $_\\``;\n    await applyGritQL(\n      tree,\n      filePath,\n      `\\`${key}: $old\\` => \\`${key}: ${PLACEHOLDER}\\` where { $old <: ${within} }`,\n    );\n  } else {\n    // Add the new property using GritQL's += (accumulate) operator.\n    // For non-empty objects, += appends correctly without double commas.\n    // For empty objects, += fails so we fall back to a direct replacement.\n    let added = await applyGritQL(\n      tree,\n      filePath,\n      `\\`export default { $props } satisfies $type\\` where { $props += \\`, ${key}: ${PLACEHOLDER}\\` }`,\n    );\n\n    if (!added) {\n      added = await applyGritQL(\n        tree,\n        filePath,\n        `\\`export default { } satisfies $type\\` => \\`export default { ${key}: ${PLACEHOLDER} } satisfies $type\\``,\n      );\n    }\n\n    if (!added) {\n      added = await applyGritQL(\n        tree,\n        filePath,\n        `\\`export default { $props }\\` where { $props += \\`, ${key}: ${PLACEHOLDER}\\` }`,\n      );\n    }\n\n    if (!added) {\n      await applyGritQL(\n        tree,\n        filePath,\n        `\\`export default { }\\` => \\`export default { ${key}: ${PLACEHOLDER} }\\``,\n      );\n    }\n  }\n\n  // Substitute the placeholder with the actual JSON value\n  const content = tree.read(filePath)!.toString();\n  tree.write(filePath, content.replace(PLACEHOLDER, json));\n};\n\n/**\n * Update the aws nx plugin config file.\n * Only the specified top-level keys are replaced; all other properties\n * (including those containing JS expressions) are left untouched in source.\n */\nexport const updateAwsNxPluginConfig = async (\n  tree: Tree,\n  configUpdate: Partial<AwsNxPluginConfig>,\n): Promise<void> => {\n  const filePath = AWS_NX_PLUGIN_CONFIG_FILE_NAME;\n\n  for (const [key, value] of Object.entries(configUpdate)) {\n    await setConfigProperty(tree, filePath, key, value);\n  }\n\n  // Prettier formats the result into properly indented TypeScript\n  await formatFilesInSubtree(tree, filePath);\n};\n"],"names":["generateFiles","joinPathFragments","existsSync","readFileSync","createJiti","join","applyGritQL","matchGritQL","formatFilesInSubtree","AWS_NX_PLUGIN_CONFIG_FILE_NAME","AWS_NX_PLUGIN_JITI_ALIASES","dirname","ensureAwsNxPluginConfig","tree","exists","readAwsNxPluginConfig","undefined","source","read","configFilePath","root","jiti","filename","alias","fsCache","mod","evalModule","default","readAwsNxPluginConfigFromDisk","workspaceRoot","configPath","PLACEHOLDER","setConfigProperty","filePath","key","value","json","JSON","stringify","existsInSatisfies","existsInPlain","within","added","content","toString","write","replace","updateAwsNxPluginConfig","configUpdate","Object","entries"],"mappings":"AAAA;;;CAGC,GACD,SAASA,aAAa,EAAEC,iBAAiB,QAAmB,aAAa;AACzE,SAASC,UAAU,EAAEC,YAAY,QAAQ,KAAK;AAC9C,SAASC,UAAU,QAAQ,OAAO;AAClC,SAASC,IAAI,QAAQ,OAAO;AAC5B,SAASC,WAAW,EAAEC,WAAW,QAAQ,YAAS;AAClD,SAASC,oBAAoB,QAAQ,eAAY;AAGjD,OAAO,MAAMC,iCAAiC,2BAA2B;AAEzE;;;CAGC,GACD,MAAMC,6BAA6B;IACjC,8BAA8BL,KAC5B,YAAYM,OAAO,EACnB,MACA,MACA,OACA;IAEF,kBAAkBN,KAAK,YAAYM,OAAO,EAAE,MAAM;AACpD;AAEA;;CAEC,GACD,OAAO,MAAMC,0BAA0B,OACrCC;IAEA,IAAI,CAACA,KAAKC,MAAM,CAACL,iCAAiC;QAChD,0DAA0D;QAC1DT,cACEa,MACAZ,kBAAkB,YAAYU,OAAO,EAAE,UACvC,KACA,CAAC;IAEL;IACA,oEAAoE;IACpE,OAAOI,sBAAsBF;AAC/B,EAAE;AAEF;;;;;;;;;;;;CAYC,GACD,OAAO,MAAME,wBAAwB,CACnCF;IAEA,IAAI,CAACA,KAAKC,MAAM,CAACL,iCAAiC;QAChD,OAAOO;IACT;IACA,MAAMC,SAASJ,KAAKK,IAAI,CAACT,gCAAgC;IACzD,MAAMU,iBAAiBd,KAAKQ,KAAKO,IAAI,EAAEX;IAEvC,MAAMY,OAAOjB,WAAW,YAAYkB,QAAQ,EAAE;QAC5CC,OAAOb;QACPc,SAAS;IACX;IAEA,MAAMC,MAAMJ,KAAKK,UAAU,CAACT,QAAQ;QAAEK,UAAUH;IAAe;IAC/D,OAAO,AAACM,IAAYE,OAAO,IAAIF;AACjC,EAAE;AAEF;;;;CAIC,GACD,OAAO,MAAMG,gCAAgC,CAC3CC;IAEA,MAAMC,aAAazB,KAAKwB,eAAepB;IACvC,IAAI,CAACP,WAAW4B,aAAa,OAAOd;IAEpC,MAAMC,SAASd,aAAa2B,YAAY;IAExC,MAAMT,OAAOjB,WAAW,YAAYkB,QAAQ,EAAE;QAC5CC,OAAOb;IACT;IACA,MAAMe,MAAMJ,KAAKK,UAAU,CAACT,QAAQ;QAAEK,UAAUQ;IAAW;IAC3D,OAAO,AAACL,IAAYE,OAAO,IAAIF;AACjC,EAAE;AAEF,MAAMM,cAAc;AAEpB;;;;CAIC,GACD,MAAMC,oBAAoB,OACxBnB,MACAoB,UACAC,KACAC;IAEA,MAAMC,OAAOC,KAAKC,SAAS,CAACH;IAE5B,kEAAkE;IAClE,+DAA+D;IAC/D,MAAMI,oBAAoB,MAAMhC,YAC9BM,MACAoB,UACA,CAAC,EAAE,EAAEC,IAAI,oEAAoE,CAAC;IAEhF,MAAMM,gBACJ,CAACD,qBACA,MAAMhC,YACLM,MACAoB,UACA,CAAC,EAAE,EAAEC,IAAI,uDAAuD,CAAC;IAGrE,IAAIK,qBAAqBC,eAAe;QACtC,mEAAmE;QACnE,MAAMC,SAASF,oBACX,CAAC,yCAAyC,CAAC,GAC3C,CAAC,4BAA4B,CAAC;QAClC,MAAMjC,YACJO,MACAoB,UACA,CAAC,EAAE,EAAEC,IAAI,cAAc,EAAEA,IAAI,EAAE,EAAEH,YAAY,mBAAmB,EAAEU,OAAO,EAAE,CAAC;IAEhF,OAAO;QACL,gEAAgE;QAChE,qEAAqE;QACrE,uEAAuE;QACvE,IAAIC,QAAQ,MAAMpC,YAChBO,MACAoB,UACA,CAAC,oEAAoE,EAAEC,IAAI,EAAE,EAAEH,YAAY,IAAI,CAAC;QAGlG,IAAI,CAACW,OAAO;YACVA,QAAQ,MAAMpC,YACZO,MACAoB,UACA,CAAC,6DAA6D,EAAEC,IAAI,EAAE,EAAEH,YAAY,oBAAoB,CAAC;QAE7G;QAEA,IAAI,CAACW,OAAO;YACVA,QAAQ,MAAMpC,YACZO,MACAoB,UACA,CAAC,oDAAoD,EAAEC,IAAI,EAAE,EAAEH,YAAY,IAAI,CAAC;QAEpF;QAEA,IAAI,CAACW,OAAO;YACV,MAAMpC,YACJO,MACAoB,UACA,CAAC,6CAA6C,EAAEC,IAAI,EAAE,EAAEH,YAAY,IAAI,CAAC;QAE7E;IACF;IAEA,wDAAwD;IACxD,MAAMY,UAAU9B,KAAKK,IAAI,CAACe,UAAWW,QAAQ;IAC7C/B,KAAKgC,KAAK,CAACZ,UAAUU,QAAQG,OAAO,CAACf,aAAaK;AACpD;AAEA;;;;CAIC,GACD,OAAO,MAAMW,0BAA0B,OACrClC,MACAmC;IAEA,MAAMf,WAAWxB;IAEjB,KAAK,MAAM,CAACyB,KAAKC,MAAM,IAAIc,OAAOC,OAAO,CAACF,cAAe;QACvD,MAAMhB,kBAAkBnB,MAAMoB,UAAUC,KAAKC;IAC/C;IAEA,gEAAgE;IAChE,MAAM3B,qBAAqBK,MAAMoB;AACnC,EAAE"}

package/src/utils/connection/open-api/files/components/__apiNameClassName__Provider.tsx.template

@@ -7,7 +7,16 @@ import { useSigV4 } from '../hooks/useSigV4';
 <%_ } else if (auth === 'cognito') { _%>
 import { useAuth } from 'react-oidc-context';
 <%_ } _%>
-<%_ if (isAgentRuntime) { _%>
+<%_ if (gatewayRoute) { _%>
+
+/**
+ * Build the agent's base URL from its AgentCore Gateway's URL. The gateway
+ * proxies `/<targetName>/...` paths to the agent runtime.
+ */
+function buildGatewayTargetUrl(gatewayUrl: string): string {
+  return `${new URL(gatewayUrl).origin}/<%- gatewayRoute.targetName %>`;
+}
+<%_ } else if (isAgentRuntime) { _%>
 
 /**
  * Build an HTTP URL from a Bedrock AgentCore Runtime ARN
@@ -24,7 +33,9 @@ export const <%- apiNameClassName %>ClientContext = createContext<<%- apiNameCla
 
 const useCreate<%- apiNameClassName %>Client = (): <%- apiNameClassName %> => {
   const runtimeConfig = useRuntimeConfig();
-<%_ if (isAgentRuntime) { _%>
+<%_ if (gatewayRoute) { _%>
+  const apiUrl = buildGatewayTargetUrl(runtimeConfig.gateways.<%- gatewayRoute.gatewayClassName %>);
+<%_ } else if (isAgentRuntime) { _%>
   const agentRuntimeValue = runtimeConfig.agentRuntimes.<%- apiNameClassName %>;
   // A local-dev override is a plain URL; otherwise it's the agent's runtime
   // ARN, so build the invocation URL from it.

package/src/utils/connection/open-api/react.d.ts

@@ -59,6 +59,15 @@ export interface AddOpenApiReactClientOptions {
      * When false (default), reads from runtimeConfig.apis directly.
      */
     isAgentRuntime?: boolean;
+    /**
+     * When set, the generated provider reads the gateway's URL from
+     * runtimeConfig.gateways and routes to the agent via the gateway's
+     * path-based `/<targetName>` route instead of invoking the runtime directly.
+     */
+    gatewayRoute?: {
+        gatewayClassName: string;
+        targetName: string;
+    };
     /**
      * When true, skips the dev target setup. Use this when the caller
      * handles dev target configuration separately (e.g. agent connections
@@ -69,4 +78,4 @@ export interface AddOpenApiReactClientOptions {
 /**
  * Adds an OpenAPI React client to the frontend project along with supporting build targets
  */
-export declare const addOpenApiReactClient: <const D extends DependencyDeclaration>(tree: Tree, { apiName, frontendProjectConfig, backendProjectConfig, specBuildProject, specPath, specBuildTargetName, auth, port, isAgentRuntime, skipLocalDev, }: AddOpenApiReactClientOptions, declaration: D & MustDeclare<typeof OPEN_API_REACT_DEPENDENCIES, D>) => Promise<void>;
+export declare const addOpenApiReactClient: <const D extends DependencyDeclaration>(tree: Tree, { apiName, frontendProjectConfig, backendProjectConfig, specBuildProject, specPath, specBuildTargetName, auth, port, isAgentRuntime, gatewayRoute, skipLocalDev, }: AddOpenApiReactClientOptions, declaration: D & MustDeclare<typeof OPEN_API_REACT_DEPENDENCIES, D>) => Promise<void>;

package/src/utils/connection/open-api/react.js

@@ -36,7 +36,7 @@ import { withVersions } from "../../versions.js";
 ];
 /**
  * Adds an OpenAPI React client to the frontend project along with supporting build targets
- */ export const addOpenApiReactClient = async (tree, { apiName, frontendProjectConfig, backendProjectConfig, specBuildProject, specPath, specBuildTargetName, auth, port, isAgentRuntime = false, skipLocalDev = false }, declaration)=>{
+ */ export const addOpenApiReactClient = async (tree, { apiName, frontendProjectConfig, backendProjectConfig, specBuildProject, specPath, specBuildTargetName, auth, port, isAgentRuntime = false, gatewayRoute, skipLocalDev = false }, declaration)=>{
     const clientGenTarget = `generate:${kebabCase(apiName)}-client`;
     const clientGenWatchTarget = `watch-${clientGenTarget}`;
     const generatedClientDir = joinPathFragments('generated', kebabCase(apiName));
@@ -120,7 +120,8 @@ import { withVersions } from "../../versions.js";
         apiName,
         apiNameClassName,
         generatedClientDir,
-        isAgentRuntime
+        isAgentRuntime,
+        gatewayRoute
     });
     // Update main.tsx to add required providers
     const mainTsxPath = joinPathFragments(frontendProjectConfig.sourceRoot, 'main.tsx');

package/src/utils/connection/open-api/react.js.map

@@ -1 +1 @@
-{"version":3,"sources":["../../../../../../../packages/nx-plugin/src/utils/connection/open-api/react.ts"],"sourcesContent":["/**\n * Copyright Amazon.com, Inc. or its affiliates. All Rights Reserved.\n * SPDX-License-Identifier: Apache-2.0\n */\nimport {\n  generateFiles,\n  joinPathFragments,\n  OverwriteStrategy,\n  type ProjectConfiguration,\n  type Tree,\n  updateProjectConfiguration,\n} from '@nx/devkit';\nimport { addTargetToLocalDev } from '../../../connection/local-dev';\nimport runtimeConfigGenerator from '../../../ts/react-website/runtime-config/generator';\nimport { addSingleImport, applyGritQL } from '../../ast';\nimport {\n  type DependencyDeclaration,\n  forDependencies,\n  type MustDeclare,\n} from '../../declared-dependencies';\nimport { addDependenciesToPackageJson } from '../../dependencies';\nimport { updateGitIgnore } from '../../git';\nimport { kebabCase, toClassName } from '../../names';\nimport { sortObjectKeys } from '../../object';\nimport { type ITsDepVersion, withVersions } from '../../versions';\n\n/** Dependencies a caller must declare to add an OpenAPI React client. */\nexport const OPEN_API_REACT_DEPENDENCIES = [\n  { name: 'oidc-client-ts' },\n  { name: 'react-oidc-context' },\n  { name: '@aws-sdk/credential-provider-cognito-identity' },\n  { name: 'aws4fetch' },\n  { name: '@tanstack/react-query' },\n  { name: '@tanstack/react-query-devtools' },\n  { name: '@smithy/types' },\n] as const satisfies readonly { name: ITsDepVersion }[];\n\nexport interface AddOpenApiReactClientOptions {\n  /**\n   * The react project to add the openapi client and build targets to\n   */\n  frontendProjectConfig: ProjectConfiguration;\n  /**\n   * The backend project which serves the api\n   */\n  backendProjectConfig: ProjectConfiguration;\n  /**\n   * The project which builds/generates the openapi spec\n   */\n  specBuildProject: ProjectConfiguration;\n  /**\n   * Name of the api\n   */\n  apiName: string;\n  /**\n   * Path to the openapi spec from the workspace root\n   */\n  specPath: string;\n  /**\n   * Fully qualified target name for the target that builds/generates the openapi spec\n   */\n  specBuildTargetName: string;\n  /**\n   * Authentication method\n   */\n  auth: 'iam' | 'cognito' | 'custom';\n  /**\n   * Port on which the backend project's local server listens\n   */\n  port: number;\n  /**\n   * When true, the generated provider reads from runtimeConfig.agentRuntimes\n   * and converts Bedrock AgentCore Runtime ARNs to HTTP URLs.\n   * When false (default), reads from runtimeConfig.apis directly.\n   */\n  isAgentRuntime?: boolean;\n  /**\n   * When true, skips the dev target setup. Use this when the caller\n   * handles dev target configuration separately (e.g. agent connections\n   * that use a component-specific dev target instead of 'serve').\n   */\n  skipLocalDev?: boolean;\n}\n\n/**\n * Adds an OpenAPI React client to the frontend project along with supporting build targets\n */\nexport const addOpenApiReactClient = async <\n  const D extends DependencyDeclaration,\n>(\n  tree: Tree,\n  {\n    apiName,\n    frontendProjectConfig,\n    backendProjectConfig,\n    specBuildProject,\n    specPath,\n    specBuildTargetName,\n    auth,\n    port,\n    isAgentRuntime = false,\n    skipLocalDev = false,\n  }: AddOpenApiReactClientOptions,\n  declaration: D & MustDeclare<typeof OPEN_API_REACT_DEPENDENCIES, D>,\n) => {\n  const clientGenTarget = `generate:${kebabCase(apiName)}-client`;\n  const clientGenWatchTarget = `watch-${clientGenTarget}`;\n\n  const generatedClientDir = joinPathFragments('generated', kebabCase(apiName));\n  const generatedClientDirFromRoot = joinPathFragments(\n    frontendProjectConfig.sourceRoot,\n    generatedClientDir,\n  );\n\n  // Add TypeScript client generation to Frontend project.json\n  updateProjectConfiguration(tree, frontendProjectConfig.name, {\n    ...frontendProjectConfig,\n    targets: sortObjectKeys({\n      ...frontendProjectConfig.targets,\n      // Generate should run before compile and bundle as the client is created as part of the website src\n      ...Object.fromEntries(\n        ['compile', 'bundle'].map((target) => [\n          target,\n          {\n            ...frontendProjectConfig.targets?.[target],\n            dependsOn: [\n              ...(\n                frontendProjectConfig.targets?.[target]?.dependsOn ?? []\n              ).filter((t) => t !== clientGenTarget),\n              clientGenTarget,\n            ],\n          },\n        ]),\n      ),\n      [clientGenTarget]: {\n        cache: true,\n        executor: 'nx:run-commands',\n        inputs: [\n          {\n            dependentTasksOutputFiles: '**/*.json',\n          },\n        ],\n        outputs: [\n          joinPathFragments('{workspaceRoot}', generatedClientDirFromRoot),\n        ],\n        options: {\n          commands: [\n            `nx g @aws/nx-plugin:open-api#ts-hooks --openApiSpecPath=\"${specPath}\" --outputPath=\"${generatedClientDirFromRoot}\" --no-interactive`,\n          ],\n        },\n        dependsOn: [specBuildTargetName],\n      },\n      // Watch target for regenerating the client\n      [clientGenWatchTarget]: {\n        executor: 'nx:run-commands',\n        options: {\n          commands: [\n            `nx watch --projects=${specBuildProject.name} --includeDependencies -- nx run ${frontendProjectConfig.name}:\"${clientGenTarget}\"`,\n          ],\n        },\n        continuous: true,\n      },\n    }),\n  });\n\n  const relativeSrcDir = frontendProjectConfig.sourceRoot.slice(\n    frontendProjectConfig.root.length + 1,\n  );\n\n  // Ignore the generated client by default\n  // Users can safely remove the entry from the .gitignore if they prefer to check it in\n  updateGitIgnore(tree, frontendProjectConfig.root, (patterns) => [\n    ...patterns,\n    joinPathFragments(relativeSrcDir, generatedClientDir),\n  ]);\n\n  // Ensure that the frontend has runtime config as we'll use the url for creating the client\n  await runtimeConfigGenerator(tree, {\n    project: frontendProjectConfig.name,\n  });\n\n  // Add sigv4 fetch\n  if (auth === 'iam') {\n    generateFiles(\n      tree,\n      joinPathFragments(import.meta.dirname, '../../files/website/hooks/sigv4'),\n      joinPathFragments(frontendProjectConfig.sourceRoot, 'hooks'),\n      {},\n      {\n        overwriteStrategy: OverwriteStrategy.KeepExisting,\n      },\n    );\n  }\n\n  // Generate the tanstack query provider if it does not exist already\n  generateFiles(\n    tree,\n    joinPathFragments(\n      import.meta.dirname,\n      '../../files/website/components/tanstack-query',\n    ),\n    joinPathFragments(frontendProjectConfig.sourceRoot, 'components'),\n    {},\n    {\n      overwriteStrategy: OverwriteStrategy.KeepExisting,\n    },\n  );\n\n  const apiNameClassName = toClassName(apiName);\n\n  // Add a hook to instantiate the client\n  generateFiles(\n    tree,\n    joinPathFragments(import.meta.dirname, 'files'),\n    frontendProjectConfig.sourceRoot,\n    {\n      auth,\n      apiName,\n      apiNameClassName,\n      generatedClientDir,\n      isAgentRuntime,\n    },\n  );\n\n  // Update main.tsx to add required providers\n  const mainTsxPath = joinPathFragments(\n    frontendProjectConfig.sourceRoot,\n    'main.tsx',\n  );\n\n  // Add the query client provider if it doesn't exist already\n  await addSingleImport(\n    tree,\n    mainTsxPath,\n    'QueryClientProvider',\n    './components/QueryClientProvider',\n  );\n  await applyGritQL(\n    tree,\n    mainTsxPath,\n    '`<App />` => `<QueryClientProvider><App /></QueryClientProvider>` where { $program <: not contains `<QueryClientProvider>$_</QueryClientProvider>` }',\n  );\n\n  // Add the api provider if it does not exist\n  const providerName = `${apiNameClassName}Provider`;\n  await addSingleImport(\n    tree,\n    mainTsxPath,\n    providerName,\n    `./components/${providerName}`,\n  );\n  await applyGritQL(\n    tree,\n    mainTsxPath,\n    `\\`<App />\\` => \\`<${providerName}><App /></${providerName}>\\` where { $program <: not contains \\`<${providerName}>$_</${providerName}>\\` }`,\n  );\n\n  // Update the dev target on the website to use our local server.\n  // Callers that handle the dev target separately (e.g. agent connections) set skipLocalDev.\n  if (!skipLocalDev) {\n    await addTargetToLocalDev(\n      tree,\n      frontendProjectConfig.name,\n      backendProjectConfig.name,\n      {\n        url: `http://localhost:${port}/`,\n        apiName,\n        // Additionally add a dependency on the generate watch command to ensure that local\n        // API changes that affect the client are also reloaded.\n        // We include a dependency on the generate target as watch ONLY triggers on a change,\n        // and we need to ensure the client is generated the first time if not already present.\n        additionalDependencyTargets: [clientGenTarget, clientGenWatchTarget],\n      },\n    );\n  }\n\n  addDependenciesToPackageJson(\n    tree,\n    withVersions(\n      forDependencies<typeof OPEN_API_REACT_DEPENDENCIES>(declaration),\n      [\n        ...((auth === 'iam'\n          ? [\n              'oidc-client-ts',\n              'react-oidc-context',\n              '@aws-sdk/credential-provider-cognito-identity',\n              'aws4fetch',\n            ]\n          : []) as any),\n        ...((auth === 'cognito' ? ['react-oidc-context'] : []) as any),\n        '@tanstack/react-query',\n        '@tanstack/react-query-devtools',\n      ],\n    ),\n    withVersions(\n      forDependencies<typeof OPEN_API_REACT_DEPENDENCIES>(declaration),\n      ['@smithy/types'],\n    ),\n    joinPathFragments(frontendProjectConfig.root, 'package.json'),\n  );\n};\n"],"names":["generateFiles","joinPathFragments","OverwriteStrategy","updateProjectConfiguration","addTargetToLocalDev","runtimeConfigGenerator","addSingleImport","applyGritQL","forDependencies","addDependenciesToPackageJson","updateGitIgnore","kebabCase","toClassName","sortObjectKeys","withVersions","OPEN_API_REACT_DEPENDENCIES","name","addOpenApiReactClient","tree","apiName","frontendProjectConfig","backendProjectConfig","specBuildProject","specPath","specBuildTargetName","auth","port","isAgentRuntime","skipLocalDev","declaration","clientGenTarget","clientGenWatchTarget","generatedClientDir","generatedClientDirFromRoot","sourceRoot","targets","Object","fromEntries","map","target","dependsOn","filter","t","cache","executor","inputs","dependentTasksOutputFiles","outputs","options","commands","continuous","relativeSrcDir","slice","root","length","patterns","project","dirname","overwriteStrategy","KeepExisting","apiNameClassName","mainTsxPath","providerName","url","additionalDependencyTargets"],"mappings":"AAAA;;;CAGC,GACD,SACEA,aAAa,EACbC,iBAAiB,EACjBC,iBAAiB,EAGjBC,0BAA0B,QACrB,aAAa;AACpB,SAASC,mBAAmB,QAAQ,mCAAgC;AACpE,OAAOC,4BAA4B,wDAAqD;AACxF,SAASC,eAAe,EAAEC,WAAW,QAAQ,eAAY;AACzD,SAEEC,eAAe,QAEV,iCAA8B;AACrC,SAASC,4BAA4B,QAAQ,wBAAqB;AAClE,SAASC,eAAe,QAAQ,eAAY;AAC5C,SAASC,SAAS,EAAEC,WAAW,QAAQ,iBAAc;AACrD,SAASC,cAAc,QAAQ,kBAAe;AAC9C,SAA6BC,YAAY,QAAQ,oBAAiB;AAElE,uEAAuE,GACvE,OAAO,MAAMC,8BAA8B;IACzC;QAAEC,MAAM;IAAiB;IACzB;QAAEA,MAAM;IAAqB;IAC7B;QAAEA,MAAM;IAAgD;IACxD;QAAEA,MAAM;IAAY;IACpB;QAAEA,MAAM;IAAwB;IAChC;QAAEA,MAAM;IAAiC;IACzC;QAAEA,MAAM;IAAgB;CACzB,CAAuD;AAiDxD;;CAEC,GACD,OAAO,MAAMC,wBAAwB,OAGnCC,MACA,EACEC,OAAO,EACPC,qBAAqB,EACrBC,oBAAoB,EACpBC,gBAAgB,EAChBC,QAAQ,EACRC,mBAAmB,EACnBC,IAAI,EACJC,IAAI,EACJC,iBAAiB,KAAK,EACtBC,eAAe,KAAK,EACS,EAC/BC;IAEA,MAAMC,kBAAkB,CAAC,SAAS,EAAEnB,UAAUQ,SAAS,OAAO,CAAC;IAC/D,MAAMY,uBAAuB,CAAC,MAAM,EAAED,iBAAiB;IAEvD,MAAME,qBAAqB/B,kBAAkB,aAAaU,UAAUQ;IACpE,MAAMc,6BAA6BhC,kBACjCmB,sBAAsBc,UAAU,EAChCF;IAGF,4DAA4D;IAC5D7B,2BAA2Be,MAAME,sBAAsBJ,IAAI,EAAE;QAC3D,GAAGI,qBAAqB;QACxBe,SAAStB,eAAe;YACtB,GAAGO,sBAAsBe,OAAO;YAChC,oGAAoG;YACpG,GAAGC,OAAOC,WAAW,CACnB;gBAAC;gBAAW;aAAS,CAACC,GAAG,CAAC,CAACC,SAAW;oBACpCA;oBACA;wBACE,GAAGnB,sBAAsBe,OAAO,EAAE,CAACI,OAAO;wBAC1CC,WAAW;+BACN,AACDpB,CAAAA,sBAAsBe,OAAO,EAAE,CAACI,OAAO,EAAEC,aAAa,EAAE,AAAD,EACvDC,MAAM,CAAC,CAACC,IAAMA,MAAMZ;4BACtBA;yBACD;oBACH;iBACD,EACF;YACD,CAACA,gBAAgB,EAAE;gBACjBa,OAAO;gBACPC,UAAU;gBACVC,QAAQ;oBACN;wBACEC,2BAA2B;oBAC7B;iBACD;gBACDC,SAAS;oBACP9C,kBAAkB,mBAAmBgC;iBACtC;gBACDe,SAAS;oBACPC,UAAU;wBACR,CAAC,yDAAyD,EAAE1B,SAAS,gBAAgB,EAAEU,2BAA2B,kBAAkB,CAAC;qBACtI;gBACH;gBACAO,WAAW;oBAAChB;iBAAoB;YAClC;YACA,2CAA2C;YAC3C,CAACO,qBAAqB,EAAE;gBACtBa,UAAU;gBACVI,SAAS;oBACPC,UAAU;wBACR,CAAC,oBAAoB,EAAE3B,iBAAiBN,IAAI,CAAC,iCAAiC,EAAEI,sBAAsBJ,IAAI,CAAC,EAAE,EAAEc,gBAAgB,CAAC,CAAC;qBAClI;gBACH;gBACAoB,YAAY;YACd;QACF;IACF;IAEA,MAAMC,iBAAiB/B,sBAAsBc,UAAU,CAACkB,KAAK,CAC3DhC,sBAAsBiC,IAAI,CAACC,MAAM,GAAG;IAGtC,yCAAyC;IACzC,sFAAsF;IACtF5C,gBAAgBQ,MAAME,sBAAsBiC,IAAI,EAAE,CAACE,WAAa;eAC3DA;YACHtD,kBAAkBkD,gBAAgBnB;SACnC;IAED,2FAA2F;IAC3F,MAAM3B,uBAAuBa,MAAM;QACjCsC,SAASpC,sBAAsBJ,IAAI;IACrC;IAEA,kBAAkB;IAClB,IAAIS,SAAS,OAAO;QAClBzB,cACEkB,MACAjB,kBAAkB,YAAYwD,OAAO,EAAE,oCACvCxD,kBAAkBmB,sBAAsBc,UAAU,EAAE,UACpD,CAAC,GACD;YACEwB,mBAAmBxD,kBAAkByD,YAAY;QACnD;IAEJ;IAEA,oEAAoE;IACpE3D,cACEkB,MACAjB,kBACE,YAAYwD,OAAO,EACnB,kDAEFxD,kBAAkBmB,sBAAsBc,UAAU,EAAE,eACpD,CAAC,GACD;QACEwB,mBAAmBxD,kBAAkByD,YAAY;IACnD;IAGF,MAAMC,mBAAmBhD,YAAYO;IAErC,uCAAuC;IACvCnB,cACEkB,MACAjB,kBAAkB,YAAYwD,OAAO,EAAE,UACvCrC,sBAAsBc,UAAU,EAChC;QACET;QACAN;QACAyC;QACA5B;QACAL;IACF;IAGF,4CAA4C;IAC5C,MAAMkC,cAAc5D,kBAClBmB,sBAAsBc,UAAU,EAChC;IAGF,4DAA4D;IAC5D,MAAM5B,gBACJY,MACA2C,aACA,uBACA;IAEF,MAAMtD,YACJW,MACA2C,aACA;IAGF,4CAA4C;IAC5C,MAAMC,eAAe,GAAGF,iBAAiB,QAAQ,CAAC;IAClD,MAAMtD,gBACJY,MACA2C,aACAC,cACA,CAAC,aAAa,EAAEA,cAAc;IAEhC,MAAMvD,YACJW,MACA2C,aACA,CAAC,kBAAkB,EAAEC,aAAa,UAAU,EAAEA,aAAa,wCAAwC,EAAEA,aAAa,KAAK,EAAEA,aAAa,KAAK,CAAC;IAG9I,gEAAgE;IAChE,2FAA2F;IAC3F,IAAI,CAAClC,cAAc;QACjB,MAAMxB,oBACJc,MACAE,sBAAsBJ,IAAI,EAC1BK,qBAAqBL,IAAI,EACzB;YACE+C,KAAK,CAAC,iBAAiB,EAAErC,KAAK,CAAC,CAAC;YAChCP;YACA,mFAAmF;YACnF,wDAAwD;YACxD,qFAAqF;YACrF,uFAAuF;YACvF6C,6BAA6B;gBAAClC;gBAAiBC;aAAqB;QACtE;IAEJ;IAEAtB,6BACES,MACAJ,aACEN,gBAAoDqB,cACpD;WACOJ,SAAS,QACV;YACE;YACA;YACA;YACA;SACD,GACD,EAAE;WACDA,SAAS,YAAY;YAAC;SAAqB,GAAG,EAAE;QACrD;QACA;KACD,GAEHX,aACEN,gBAAoDqB,cACpD;QAAC;KAAgB,GAEnB5B,kBAAkBmB,sBAAsBiC,IAAI,EAAE;AAElD,EAAE"}
+{"version":3,"sources":["../../../../../../../packages/nx-plugin/src/utils/connection/open-api/react.ts"],"sourcesContent":["/**\n * Copyright Amazon.com, Inc. or its affiliates. All Rights Reserved.\n * SPDX-License-Identifier: Apache-2.0\n */\nimport {\n  generateFiles,\n  joinPathFragments,\n  OverwriteStrategy,\n  type ProjectConfiguration,\n  type Tree,\n  updateProjectConfiguration,\n} from '@nx/devkit';\nimport { addTargetToLocalDev } from '../../../connection/local-dev';\nimport runtimeConfigGenerator from '../../../ts/react-website/runtime-config/generator';\nimport { addSingleImport, applyGritQL } from '../../ast';\nimport {\n  type DependencyDeclaration,\n  forDependencies,\n  type MustDeclare,\n} from '../../declared-dependencies';\nimport { addDependenciesToPackageJson } from '../../dependencies';\nimport { updateGitIgnore } from '../../git';\nimport { kebabCase, toClassName } from '../../names';\nimport { sortObjectKeys } from '../../object';\nimport { type ITsDepVersion, withVersions } from '../../versions';\n\n/** Dependencies a caller must declare to add an OpenAPI React client. */\nexport const OPEN_API_REACT_DEPENDENCIES = [\n  { name: 'oidc-client-ts' },\n  { name: 'react-oidc-context' },\n  { name: '@aws-sdk/credential-provider-cognito-identity' },\n  { name: 'aws4fetch' },\n  { name: '@tanstack/react-query' },\n  { name: '@tanstack/react-query-devtools' },\n  { name: '@smithy/types' },\n] as const satisfies readonly { name: ITsDepVersion }[];\n\nexport interface AddOpenApiReactClientOptions {\n  /**\n   * The react project to add the openapi client and build targets to\n   */\n  frontendProjectConfig: ProjectConfiguration;\n  /**\n   * The backend project which serves the api\n   */\n  backendProjectConfig: ProjectConfiguration;\n  /**\n   * The project which builds/generates the openapi spec\n   */\n  specBuildProject: ProjectConfiguration;\n  /**\n   * Name of the api\n   */\n  apiName: string;\n  /**\n   * Path to the openapi spec from the workspace root\n   */\n  specPath: string;\n  /**\n   * Fully qualified target name for the target that builds/generates the openapi spec\n   */\n  specBuildTargetName: string;\n  /**\n   * Authentication method\n   */\n  auth: 'iam' | 'cognito' | 'custom';\n  /**\n   * Port on which the backend project's local server listens\n   */\n  port: number;\n  /**\n   * When true, the generated provider reads from runtimeConfig.agentRuntimes\n   * and converts Bedrock AgentCore Runtime ARNs to HTTP URLs.\n   * When false (default), reads from runtimeConfig.apis directly.\n   */\n  isAgentRuntime?: boolean;\n  /**\n   * When set, the generated provider reads the gateway's URL from\n   * runtimeConfig.gateways and routes to the agent via the gateway's\n   * path-based `/<targetName>` route instead of invoking the runtime directly.\n   */\n  gatewayRoute?: {\n    gatewayClassName: string;\n    targetName: string;\n  };\n  /**\n   * When true, skips the dev target setup. Use this when the caller\n   * handles dev target configuration separately (e.g. agent connections\n   * that use a component-specific dev target instead of 'serve').\n   */\n  skipLocalDev?: boolean;\n}\n\n/**\n * Adds an OpenAPI React client to the frontend project along with supporting build targets\n */\nexport const addOpenApiReactClient = async <\n  const D extends DependencyDeclaration,\n>(\n  tree: Tree,\n  {\n    apiName,\n    frontendProjectConfig,\n    backendProjectConfig,\n    specBuildProject,\n    specPath,\n    specBuildTargetName,\n    auth,\n    port,\n    isAgentRuntime = false,\n    gatewayRoute,\n    skipLocalDev = false,\n  }: AddOpenApiReactClientOptions,\n  declaration: D & MustDeclare<typeof OPEN_API_REACT_DEPENDENCIES, D>,\n) => {\n  const clientGenTarget = `generate:${kebabCase(apiName)}-client`;\n  const clientGenWatchTarget = `watch-${clientGenTarget}`;\n\n  const generatedClientDir = joinPathFragments('generated', kebabCase(apiName));\n  const generatedClientDirFromRoot = joinPathFragments(\n    frontendProjectConfig.sourceRoot,\n    generatedClientDir,\n  );\n\n  // Add TypeScript client generation to Frontend project.json\n  updateProjectConfiguration(tree, frontendProjectConfig.name, {\n    ...frontendProjectConfig,\n    targets: sortObjectKeys({\n      ...frontendProjectConfig.targets,\n      // Generate should run before compile and bundle as the client is created as part of the website src\n      ...Object.fromEntries(\n        ['compile', 'bundle'].map((target) => [\n          target,\n          {\n            ...frontendProjectConfig.targets?.[target],\n            dependsOn: [\n              ...(\n                frontendProjectConfig.targets?.[target]?.dependsOn ?? []\n              ).filter((t) => t !== clientGenTarget),\n              clientGenTarget,\n            ],\n          },\n        ]),\n      ),\n      [clientGenTarget]: {\n        cache: true,\n        executor: 'nx:run-commands',\n        inputs: [\n          {\n            dependentTasksOutputFiles: '**/*.json',\n          },\n        ],\n        outputs: [\n          joinPathFragments('{workspaceRoot}', generatedClientDirFromRoot),\n        ],\n        options: {\n          commands: [\n            `nx g @aws/nx-plugin:open-api#ts-hooks --openApiSpecPath=\"${specPath}\" --outputPath=\"${generatedClientDirFromRoot}\" --no-interactive`,\n          ],\n        },\n        dependsOn: [specBuildTargetName],\n      },\n      // Watch target for regenerating the client\n      [clientGenWatchTarget]: {\n        executor: 'nx:run-commands',\n        options: {\n          commands: [\n            `nx watch --projects=${specBuildProject.name} --includeDependencies -- nx run ${frontendProjectConfig.name}:\"${clientGenTarget}\"`,\n          ],\n        },\n        continuous: true,\n      },\n    }),\n  });\n\n  const relativeSrcDir = frontendProjectConfig.sourceRoot.slice(\n    frontendProjectConfig.root.length + 1,\n  );\n\n  // Ignore the generated client by default\n  // Users can safely remove the entry from the .gitignore if they prefer to check it in\n  updateGitIgnore(tree, frontendProjectConfig.root, (patterns) => [\n    ...patterns,\n    joinPathFragments(relativeSrcDir, generatedClientDir),\n  ]);\n\n  // Ensure that the frontend has runtime config as we'll use the url for creating the client\n  await runtimeConfigGenerator(tree, {\n    project: frontendProjectConfig.name,\n  });\n\n  // Add sigv4 fetch\n  if (auth === 'iam') {\n    generateFiles(\n      tree,\n      joinPathFragments(import.meta.dirname, '../../files/website/hooks/sigv4'),\n      joinPathFragments(frontendProjectConfig.sourceRoot, 'hooks'),\n      {},\n      {\n        overwriteStrategy: OverwriteStrategy.KeepExisting,\n      },\n    );\n  }\n\n  // Generate the tanstack query provider if it does not exist already\n  generateFiles(\n    tree,\n    joinPathFragments(\n      import.meta.dirname,\n      '../../files/website/components/tanstack-query',\n    ),\n    joinPathFragments(frontendProjectConfig.sourceRoot, 'components'),\n    {},\n    {\n      overwriteStrategy: OverwriteStrategy.KeepExisting,\n    },\n  );\n\n  const apiNameClassName = toClassName(apiName);\n\n  // Add a hook to instantiate the client\n  generateFiles(\n    tree,\n    joinPathFragments(import.meta.dirname, 'files'),\n    frontendProjectConfig.sourceRoot,\n    {\n      auth,\n      apiName,\n      apiNameClassName,\n      generatedClientDir,\n      isAgentRuntime,\n      gatewayRoute,\n    },\n  );\n\n  // Update main.tsx to add required providers\n  const mainTsxPath = joinPathFragments(\n    frontendProjectConfig.sourceRoot,\n    'main.tsx',\n  );\n\n  // Add the query client provider if it doesn't exist already\n  await addSingleImport(\n    tree,\n    mainTsxPath,\n    'QueryClientProvider',\n    './components/QueryClientProvider',\n  );\n  await applyGritQL(\n    tree,\n    mainTsxPath,\n    '`<App />` => `<QueryClientProvider><App /></QueryClientProvider>` where { $program <: not contains `<QueryClientProvider>$_</QueryClientProvider>` }',\n  );\n\n  // Add the api provider if it does not exist\n  const providerName = `${apiNameClassName}Provider`;\n  await addSingleImport(\n    tree,\n    mainTsxPath,\n    providerName,\n    `./components/${providerName}`,\n  );\n  await applyGritQL(\n    tree,\n    mainTsxPath,\n    `\\`<App />\\` => \\`<${providerName}><App /></${providerName}>\\` where { $program <: not contains \\`<${providerName}>$_</${providerName}>\\` }`,\n  );\n\n  // Update the dev target on the website to use our local server.\n  // Callers that handle the dev target separately (e.g. agent connections) set skipLocalDev.\n  if (!skipLocalDev) {\n    await addTargetToLocalDev(\n      tree,\n      frontendProjectConfig.name,\n      backendProjectConfig.name,\n      {\n        url: `http://localhost:${port}/`,\n        apiName,\n        // Additionally add a dependency on the generate watch command to ensure that local\n        // API changes that affect the client are also reloaded.\n        // We include a dependency on the generate target as watch ONLY triggers on a change,\n        // and we need to ensure the client is generated the first time if not already present.\n        additionalDependencyTargets: [clientGenTarget, clientGenWatchTarget],\n      },\n    );\n  }\n\n  addDependenciesToPackageJson(\n    tree,\n    withVersions(\n      forDependencies<typeof OPEN_API_REACT_DEPENDENCIES>(declaration),\n      [\n        ...((auth === 'iam'\n          ? [\n              'oidc-client-ts',\n              'react-oidc-context',\n              '@aws-sdk/credential-provider-cognito-identity',\n              'aws4fetch',\n            ]\n          : []) as any),\n        ...((auth === 'cognito' ? ['react-oidc-context'] : []) as any),\n        '@tanstack/react-query',\n        '@tanstack/react-query-devtools',\n      ],\n    ),\n    withVersions(\n      forDependencies<typeof OPEN_API_REACT_DEPENDENCIES>(declaration),\n      ['@smithy/types'],\n    ),\n    joinPathFragments(frontendProjectConfig.root, 'package.json'),\n  );\n};\n"],"names":["generateFiles","joinPathFragments","OverwriteStrategy","updateProjectConfiguration","addTargetToLocalDev","runtimeConfigGenerator","addSingleImport","applyGritQL","forDependencies","addDependenciesToPackageJson","updateGitIgnore","kebabCase","toClassName","sortObjectKeys","withVersions","OPEN_API_REACT_DEPENDENCIES","name","addOpenApiReactClient","tree","apiName","frontendProjectConfig","backendProjectConfig","specBuildProject","specPath","specBuildTargetName","auth","port","isAgentRuntime","gatewayRoute","skipLocalDev","declaration","clientGenTarget","clientGenWatchTarget","generatedClientDir","generatedClientDirFromRoot","sourceRoot","targets","Object","fromEntries","map","target","dependsOn","filter","t","cache","executor","inputs","dependentTasksOutputFiles","outputs","options","commands","continuous","relativeSrcDir","slice","root","length","patterns","project","dirname","overwriteStrategy","KeepExisting","apiNameClassName","mainTsxPath","providerName","url","additionalDependencyTargets"],"mappings":"AAAA;;;CAGC,GACD,SACEA,aAAa,EACbC,iBAAiB,EACjBC,iBAAiB,EAGjBC,0BAA0B,QACrB,aAAa;AACpB,SAASC,mBAAmB,QAAQ,mCAAgC;AACpE,OAAOC,4BAA4B,wDAAqD;AACxF,SAASC,eAAe,EAAEC,WAAW,QAAQ,eAAY;AACzD,SAEEC,eAAe,QAEV,iCAA8B;AACrC,SAASC,4BAA4B,QAAQ,wBAAqB;AAClE,SAASC,eAAe,QAAQ,eAAY;AAC5C,SAASC,SAAS,EAAEC,WAAW,QAAQ,iBAAc;AACrD,SAASC,cAAc,QAAQ,kBAAe;AAC9C,SAA6BC,YAAY,QAAQ,oBAAiB;AAElE,uEAAuE,GACvE,OAAO,MAAMC,8BAA8B;IACzC;QAAEC,MAAM;IAAiB;IACzB;QAAEA,MAAM;IAAqB;IAC7B;QAAEA,MAAM;IAAgD;IACxD;QAAEA,MAAM;IAAY;IACpB;QAAEA,MAAM;IAAwB;IAChC;QAAEA,MAAM;IAAiC;IACzC;QAAEA,MAAM;IAAgB;CACzB,CAAuD;AA0DxD;;CAEC,GACD,OAAO,MAAMC,wBAAwB,OAGnCC,MACA,EACEC,OAAO,EACPC,qBAAqB,EACrBC,oBAAoB,EACpBC,gBAAgB,EAChBC,QAAQ,EACRC,mBAAmB,EACnBC,IAAI,EACJC,IAAI,EACJC,iBAAiB,KAAK,EACtBC,YAAY,EACZC,eAAe,KAAK,EACS,EAC/BC;IAEA,MAAMC,kBAAkB,CAAC,SAAS,EAAEpB,UAAUQ,SAAS,OAAO,CAAC;IAC/D,MAAMa,uBAAuB,CAAC,MAAM,EAAED,iBAAiB;IAEvD,MAAME,qBAAqBhC,kBAAkB,aAAaU,UAAUQ;IACpE,MAAMe,6BAA6BjC,kBACjCmB,sBAAsBe,UAAU,EAChCF;IAGF,4DAA4D;IAC5D9B,2BAA2Be,MAAME,sBAAsBJ,IAAI,EAAE;QAC3D,GAAGI,qBAAqB;QACxBgB,SAASvB,eAAe;YACtB,GAAGO,sBAAsBgB,OAAO;YAChC,oGAAoG;YACpG,GAAGC,OAAOC,WAAW,CACnB;gBAAC;gBAAW;aAAS,CAACC,GAAG,CAAC,CAACC,SAAW;oBACpCA;oBACA;wBACE,GAAGpB,sBAAsBgB,OAAO,EAAE,CAACI,OAAO;wBAC1CC,WAAW;+BACN,AACDrB,CAAAA,sBAAsBgB,OAAO,EAAE,CAACI,OAAO,EAAEC,aAAa,EAAE,AAAD,EACvDC,MAAM,CAAC,CAACC,IAAMA,MAAMZ;4BACtBA;yBACD;oBACH;iBACD,EACF;YACD,CAACA,gBAAgB,EAAE;gBACjBa,OAAO;gBACPC,UAAU;gBACVC,QAAQ;oBACN;wBACEC,2BAA2B;oBAC7B;iBACD;gBACDC,SAAS;oBACP/C,kBAAkB,mBAAmBiC;iBACtC;gBACDe,SAAS;oBACPC,UAAU;wBACR,CAAC,yDAAyD,EAAE3B,SAAS,gBAAgB,EAAEW,2BAA2B,kBAAkB,CAAC;qBACtI;gBACH;gBACAO,WAAW;oBAACjB;iBAAoB;YAClC;YACA,2CAA2C;YAC3C,CAACQ,qBAAqB,EAAE;gBACtBa,UAAU;gBACVI,SAAS;oBACPC,UAAU;wBACR,CAAC,oBAAoB,EAAE5B,iBAAiBN,IAAI,CAAC,iCAAiC,EAAEI,sBAAsBJ,IAAI,CAAC,EAAE,EAAEe,gBAAgB,CAAC,CAAC;qBAClI;gBACH;gBACAoB,YAAY;YACd;QACF;IACF;IAEA,MAAMC,iBAAiBhC,sBAAsBe,UAAU,CAACkB,KAAK,CAC3DjC,sBAAsBkC,IAAI,CAACC,MAAM,GAAG;IAGtC,yCAAyC;IACzC,sFAAsF;IACtF7C,gBAAgBQ,MAAME,sBAAsBkC,IAAI,EAAE,CAACE,WAAa;eAC3DA;YACHvD,kBAAkBmD,gBAAgBnB;SACnC;IAED,2FAA2F;IAC3F,MAAM5B,uBAAuBa,MAAM;QACjCuC,SAASrC,sBAAsBJ,IAAI;IACrC;IAEA,kBAAkB;IAClB,IAAIS,SAAS,OAAO;QAClBzB,cACEkB,MACAjB,kBAAkB,YAAYyD,OAAO,EAAE,oCACvCzD,kBAAkBmB,sBAAsBe,UAAU,EAAE,UACpD,CAAC,GACD;YACEwB,mBAAmBzD,kBAAkB0D,YAAY;QACnD;IAEJ;IAEA,oEAAoE;IACpE5D,cACEkB,MACAjB,kBACE,YAAYyD,OAAO,EACnB,kDAEFzD,kBAAkBmB,sBAAsBe,UAAU,EAAE,eACpD,CAAC,GACD;QACEwB,mBAAmBzD,kBAAkB0D,YAAY;IACnD;IAGF,MAAMC,mBAAmBjD,YAAYO;IAErC,uCAAuC;IACvCnB,cACEkB,MACAjB,kBAAkB,YAAYyD,OAAO,EAAE,UACvCtC,sBAAsBe,UAAU,EAChC;QACEV;QACAN;QACA0C;QACA5B;QACAN;QACAC;IACF;IAGF,4CAA4C;IAC5C,MAAMkC,cAAc7D,kBAClBmB,sBAAsBe,UAAU,EAChC;IAGF,4DAA4D;IAC5D,MAAM7B,gBACJY,MACA4C,aACA,uBACA;IAEF,MAAMvD,YACJW,MACA4C,aACA;IAGF,4CAA4C;IAC5C,MAAMC,eAAe,GAAGF,iBAAiB,QAAQ,CAAC;IAClD,MAAMvD,gBACJY,MACA4C,aACAC,cACA,CAAC,aAAa,EAAEA,cAAc;IAEhC,MAAMxD,YACJW,MACA4C,aACA,CAAC,kBAAkB,EAAEC,aAAa,UAAU,EAAEA,aAAa,wCAAwC,EAAEA,aAAa,KAAK,EAAEA,aAAa,KAAK,CAAC;IAG9I,gEAAgE;IAChE,2FAA2F;IAC3F,IAAI,CAAClC,cAAc;QACjB,MAAMzB,oBACJc,MACAE,sBAAsBJ,IAAI,EAC1BK,qBAAqBL,IAAI,EACzB;YACEgD,KAAK,CAAC,iBAAiB,EAAEtC,KAAK,CAAC,CAAC;YAChCP;YACA,mFAAmF;YACnF,wDAAwD;YACxD,qFAAqF;YACrF,uFAAuF;YACvF8C,6BAA6B;gBAAClC;gBAAiBC;aAAqB;QACtE;IAEJ;IAEAvB,6BACES,MACAJ,aACEN,gBAAoDsB,cACpD;WACOL,SAAS,QACV;YACE;YACA;YACA;YACA;SACD,GACD,EAAE;WACDA,SAAS,YAAY;YAAC;SAAqB,GAAG,EAAE;QACrD;QACA;KACD,GAEHX,aACEN,gBAAoDsB,cACpD;QAAC;KAAgB,GAEnB7B,kBAAkBmB,sBAAsBkC,IAAI,EAAE;AAElD,EAAE"}

package/src/utils/docker.d.ts

@@ -17,9 +17,34 @@ export declare const DOCKER_DEPENDENCIES: readonly [{
  * version to install globally, and the versions its dependency overrides pin.
  */
 export declare const nodeImageVersions: () => {
-    npmVersion: "12.0.1";
-    minimatchVersion: "10.2.5";
+    npmVersion: "12.0.2";
+    minimatchVersion: "10.2.6";
 };
+/**
+ * Packages a vended Node `Dockerfile` pins, which every generator writing one
+ * must declare so the version sync keeps those pins current.
+ *
+ * Spread through `ownedElsewhere`: the pin lives in the image build rather than
+ * in any manifest, so nothing is installed into the workspace. Left undeclared
+ * these would be the only vended versions never upgraded — and they are
+ * precisely the ones held at a version clear of a known HIGH/CRITICAL
+ * vulnerability.
+ */
+export declare const NODE_IMAGE_DEPENDENCIES: readonly [{
+    readonly name: "npm";
+}, {
+    readonly name: "minimatch";
+}];
+/**
+ * Packages the AWS Distro for OpenTelemetry install in a vended `Dockerfile`
+ * pins, for the images that auto-instrument with it. Spread through
+ * `ownedElsewhere` for the same reason as {@link NODE_IMAGE_DEPENDENCIES}.
+ */
+export declare const ADOT_IMAGE_DEPENDENCIES: readonly [{
+    readonly name: "@aws/aws-distro-opentelemetry-node-autoinstrumentation";
+}, {
+    readonly name: "@opentelemetry/propagator-jaeger";
+}];
 export interface DockerScanTargetOptions {
     /**
      * Project configuration to add the scan target to (mutated in place).

package/src/utils/docker.js

@@ -5,7 +5,7 @@
 import { forDependencies } from "./declared-dependencies.js";
 import { FS_DEPENDENCIES, FsCommands } from "./fs.js";
 import { addDependencyToTargetIfNotPresent } from "./nx.js";
-import { CONTAINER_VERSIONS, TS_VERSIONS } from "./versions.js";
+import { containerImage, TS_VERSIONS } from "./versions.js";
 /** Dependencies a caller must declare to add a Docker scan target. */ export const DOCKER_DEPENDENCIES = [
     ...FS_DEPENDENCIES
 ];
@@ -21,6 +21,35 @@ const TRIVY_IGNORE_CONTENTS = `# Trivy ignore file. Add one vulnerability ID (e.
         npmVersion: TS_VERSIONS.npm,
         minimatchVersion: TS_VERSIONS.minimatch
     });
+/**
+ * Packages a vended Node `Dockerfile` pins, which every generator writing one
+ * must declare so the version sync keeps those pins current.
+ *
+ * Spread through `ownedElsewhere`: the pin lives in the image build rather than
+ * in any manifest, so nothing is installed into the workspace. Left undeclared
+ * these would be the only vended versions never upgraded — and they are
+ * precisely the ones held at a version clear of a known HIGH/CRITICAL
+ * vulnerability.
+ */ export const NODE_IMAGE_DEPENDENCIES = [
+    {
+        name: 'npm'
+    },
+    {
+        name: 'minimatch'
+    }
+];
+/**
+ * Packages the AWS Distro for OpenTelemetry install in a vended `Dockerfile`
+ * pins, for the images that auto-instrument with it. Spread through
+ * `ownedElsewhere` for the same reason as {@link NODE_IMAGE_DEPENDENCIES}.
+ */ export const ADOT_IMAGE_DEPENDENCIES = [
+    {
+        name: '@aws/aws-distro-opentelemetry-node-autoinstrumentation'
+    },
+    {
+        name: '@opentelemetry/propagator-jaeger'
+    }
+];
 /**
  * Add a cacheable Trivy scan target for the images built by a docker target
  * and wire it under the aggregate \`trivy\` target. The scan is not part of
@@ -50,7 +79,7 @@ const TRIVY_IGNORE_CONTENTS = `# Trivy ignore file. Add one vulnerability ID (e.
     // per target, so it makes a stable, collision-free key.
     const scanKey = imageTags[0].replace(/[^a-zA-Z0-9-]/g, '-');
     const scanDir = joinPathFragments('dist', projectRoot, 'trivy', scanKey);
-    const trivyImage = `public.ecr.aws/aquasecurity/trivy:${CONTAINER_VERSIONS.trivy}`;
+    const trivyImage = containerImage('trivy');
     const fs = new FsCommands(tree, forDependencies(declaration));
     const commands = [
         fs.rm(scanDir),

package/src/utils/docker.js.map

@@ -1 +1 @@
-{"version":3,"sources":["../../../../../packages/nx-plugin/src/utils/docker.ts"],"sourcesContent":["/**\n * Copyright Amazon.com, Inc. or its affiliates. All Rights Reserved.\n * SPDX-License-Identifier: Apache-2.0\n */\nimport {\n  joinPathFragments,\n  type ProjectConfiguration,\n  type Tree,\n} from '@nx/devkit';\nimport {\n  type DependencyDeclaration,\n  forDependencies,\n  type MustDeclare,\n} from './declared-dependencies';\nimport { FS_DEPENDENCIES, FsCommands } from './fs';\nimport { addDependencyToTargetIfNotPresent } from './nx';\nimport { CONTAINER_VERSIONS, TS_VERSIONS } from './versions';\n\n/** Dependencies a caller must declare to add a Docker scan target. */\nexport const DOCKER_DEPENDENCIES = [...FS_DEPENDENCIES] as const;\n\nconst TRIVY_IGNORE_FILE = '.trivyignore';\n\nconst TRIVY_IGNORE_CONTENTS = `# Trivy ignore file. Add one vulnerability ID (e.g. CVE-2021-12345) per line to\n# suppress it during the image scan (\\`nx run-many --target trivy\\`).\n# https://trivy.dev/latest/docs/configuration/filtering/#by-finding-ids\n`;\n\n/**\n * Substitution variables for the vended Node `Dockerfile` templates: the npm\n * version to install globally, and the versions its dependency overrides pin.\n */\nexport const nodeImageVersions = () => ({\n  npmVersion: TS_VERSIONS.npm,\n  minimatchVersion: TS_VERSIONS.minimatch,\n});\n\nexport interface DockerScanTargetOptions {\n  /**\n   * Project configuration to add the scan target to (mutated in place).\n   */\n  readonly project: ProjectConfiguration;\n  /**\n   * Container engine command to invoke (\\`docker\\` or \\`finch\\`).\n   */\n  readonly containerEngine: string;\n  /**\n   * Name of the scan target to add, e.g. \\`my-agent-trivy\\`.\n   */\n  readonly trivyTargetName: string;\n  /**\n   * Name of the docker target that builds the image(s) to scan. The scan\n   * target depends on it.\n   */\n  readonly dockerTargetName: string;\n  /**\n   * Tags of the images built by the docker target which should be scanned.\n   */\n  readonly imageTags: string[];\n}\n\n/**\n * Add a cacheable Trivy scan target for the images built by a docker target\n * and wire it under the aggregate \\`trivy\\` target. The scan is not part of\n * \\`build\\` — run \\`nx run-many --target trivy\\` (the root \\`trivy\\` script) in CI.\n *\n * The scan target depends on the docker target and declares the project source\n * as its inputs, so an unchanged image is never re-scanned (a cache hit skips\n * the scan entirely). Each image is saved to a tarball under\n * \\`dist/<projectRoot>/trivy/<scan-key>\\` (kept out of any Docker build context)\n * and scanned with the pinned ECR-hosted Trivy image via a workspace-relative\n * bind mount, so the same commands work under both docker and finch. The scan\n * exits non-zero (exit code 1) on HIGH/CRITICAL vulnerabilities.\n *\n * A \\`.trivyignore\\` is vended at the project root (kept if it already exists)\n * for suppressing findings.\n */\nexport const addDockerScanTarget = <const D extends DependencyDeclaration>(\n  tree: Tree,\n  options: DockerScanTargetOptions,\n  declaration: D & MustDeclare<typeof DOCKER_DEPENDENCIES, D>,\n): void => {\n  const { project, containerEngine, trivyTargetName, dockerTargetName } =\n    options;\n  const { imageTags } = options;\n  const projectRoot = project.root;\n\n  const ignoreFilePath = joinPathFragments(projectRoot, TRIVY_IGNORE_FILE);\n  if (!tree.exists(ignoreFilePath)) {\n    tree.write(ignoreFilePath, TRIVY_IGNORE_CONTENTS);\n  }\n\n  // Stage scan artifacts in a directory unique to this scan target so that\n  // sibling targets in the same project (e.g. multiple agents) don't clobber\n  // each other's tarballs when run in parallel. The first image tag is unique\n  // per target, so it makes a stable, collision-free key.\n  const scanKey = imageTags[0].replace(/[^a-zA-Z0-9-]/g, '-');\n  const scanDir = joinPathFragments('dist', projectRoot, 'trivy', scanKey);\n  const trivyImage = `public.ecr.aws/aquasecurity/trivy:${CONTAINER_VERSIONS.trivy}`;\n\n  const fs = new FsCommands(\n    tree,\n    forDependencies<typeof DOCKER_DEPENDENCIES>(declaration),\n  );\n  const commands = [\n    fs.rm(scanDir),\n    fs.mkdir(scanDir),\n    fs.cp(ignoreFilePath, joinPathFragments(scanDir, TRIVY_IGNORE_FILE)),\n  ];\n\n  imageTags.forEach((imageTag, index) => {\n    const tarName = `image-${index}.tar`;\n    commands.push(\n      `${containerEngine} save -o ${joinPathFragments(scanDir, tarName)} ${imageTag}`,\n      `${containerEngine} run --rm -v \"./${scanDir}\":/scan ${trivyImage} image --input /scan/${tarName} --ignorefile /scan/${TRIVY_IGNORE_FILE} --scanners vuln --severity HIGH,CRITICAL --ignore-unfixed --exit-code 1 --no-progress -q`,\n    );\n  });\n\n  project.targets ??= {};\n  project.targets[trivyTargetName] = {\n    cache: true,\n    // The scanned image is fully determined by the project source, so caching\n    // on the source ensures an unchanged image is never re-scanned.\n    inputs: ['default', '^production'],\n    outputs: [`{workspaceRoot}/${scanDir}`],\n    executor: 'nx:run-commands',\n    options: {\n      commands,\n      parallel: false,\n    },\n    dependsOn: [dockerTargetName],\n  };\n\n  // Aggregate per-component scan targets under a single `trivy` target. The\n  // scan is intentionally NOT wired into `build`: image scanning is slow and\n  // its result depends on the ever-changing vulnerability database (a scan\n  // that passes today can fail tomorrow when a new CVE is published), so\n  // coupling it to `build` would make local and CI builds non-deterministic.\n  // Run `nx run-many --target trivy` (the root `trivy` script) in CI instead.\n  if (trivyTargetName !== 'trivy') {\n    addDependencyToTargetIfNotPresent(project, 'trivy', trivyTargetName);\n  }\n};\n"],"names":["joinPathFragments","forDependencies","FS_DEPENDENCIES","FsCommands","addDependencyToTargetIfNotPresent","CONTAINER_VERSIONS","TS_VERSIONS","DOCKER_DEPENDENCIES","TRIVY_IGNORE_FILE","TRIVY_IGNORE_CONTENTS","nodeImageVersions","npmVersion","npm","minimatchVersion","minimatch","addDockerScanTarget","tree","options","declaration","project","containerEngine","trivyTargetName","dockerTargetName","imageTags","projectRoot","root","ignoreFilePath","exists","write","scanKey","replace","scanDir","trivyImage","trivy","fs","commands","rm","mkdir","cp","forEach","imageTag","index","tarName","push","targets","cache","inputs","outputs","executor","parallel","dependsOn"],"mappings":"AAAA;;;CAGC,GACD,SACEA,iBAAiB,QAGZ,aAAa;AACpB,SAEEC,eAAe,QAEV,6BAA0B;AACjC,SAASC,eAAe,EAAEC,UAAU,QAAQ,UAAO;AACnD,SAASC,iCAAiC,QAAQ,UAAO;AACzD,SAASC,kBAAkB,EAAEC,WAAW,QAAQ,gBAAa;AAE7D,oEAAoE,GACpE,OAAO,MAAMC,sBAAsB;OAAIL;CAAgB,CAAU;AAEjE,MAAMM,oBAAoB;AAE1B,MAAMC,wBAAwB,CAAC;;;AAG/B,CAAC;AAED;;;CAGC,GACD,OAAO,MAAMC,oBAAoB,IAAO,CAAA;QACtCC,YAAYL,YAAYM,GAAG;QAC3BC,kBAAkBP,YAAYQ,SAAS;IACzC,CAAA,EAAG;AA0BH;;;;;;;;;;;;;;;CAeC,GACD,OAAO,MAAMC,sBAAsB,CACjCC,MACAC,SACAC;IAEA,MAAM,EAAEC,OAAO,EAAEC,eAAe,EAAEC,eAAe,EAAEC,gBAAgB,EAAE,GACnEL;IACF,MAAM,EAAEM,SAAS,EAAE,GAAGN;IACtB,MAAMO,cAAcL,QAAQM,IAAI;IAEhC,MAAMC,iBAAiB1B,kBAAkBwB,aAAahB;IACtD,IAAI,CAACQ,KAAKW,MAAM,CAACD,iBAAiB;QAChCV,KAAKY,KAAK,CAACF,gBAAgBjB;IAC7B;IAEA,yEAAyE;IACzE,2EAA2E;IAC3E,4EAA4E;IAC5E,wDAAwD;IACxD,MAAMoB,UAAUN,SAAS,CAAC,EAAE,CAACO,OAAO,CAAC,kBAAkB;IACvD,MAAMC,UAAU/B,kBAAkB,QAAQwB,aAAa,SAASK;IAChE,MAAMG,aAAa,CAAC,kCAAkC,EAAE3B,mBAAmB4B,KAAK,EAAE;IAElF,MAAMC,KAAK,IAAI/B,WACba,MACAf,gBAA4CiB;IAE9C,MAAMiB,WAAW;QACfD,GAAGE,EAAE,CAACL;QACNG,GAAGG,KAAK,CAACN;QACTG,GAAGI,EAAE,CAACZ,gBAAgB1B,kBAAkB+B,SAASvB;KAClD;IAEDe,UAAUgB,OAAO,CAAC,CAACC,UAAUC;QAC3B,MAAMC,UAAU,CAAC,MAAM,EAAED,MAAM,IAAI,CAAC;QACpCN,SAASQ,IAAI,CACX,GAAGvB,gBAAgB,SAAS,EAAEpB,kBAAkB+B,SAASW,SAAS,CAAC,EAAEF,UAAU,EAC/E,GAAGpB,gBAAgB,gBAAgB,EAAEW,QAAQ,QAAQ,EAAEC,WAAW,qBAAqB,EAAEU,QAAQ,oBAAoB,EAAElC,kBAAkB,yFAAyF,CAAC;IAEvO;IAEAW,QAAQyB,OAAO,KAAK,CAAC;IACrBzB,QAAQyB,OAAO,CAACvB,gBAAgB,GAAG;QACjCwB,OAAO;QACP,0EAA0E;QAC1E,gEAAgE;QAChEC,QAAQ;YAAC;YAAW;SAAc;QAClCC,SAAS;YAAC,CAAC,gBAAgB,EAAEhB,SAAS;SAAC;QACvCiB,UAAU;QACV/B,SAAS;YACPkB;YACAc,UAAU;QACZ;QACAC,WAAW;YAAC5B;SAAiB;IAC/B;IAEA,0EAA0E;IAC1E,2EAA2E;IAC3E,yEAAyE;IACzE,uEAAuE;IACvE,2EAA2E;IAC3E,4EAA4E;IAC5E,IAAID,oBAAoB,SAAS;QAC/BjB,kCAAkCe,SAAS,SAASE;IACtD;AACF,EAAE"}
+{"version":3,"sources":["../../../../../packages/nx-plugin/src/utils/docker.ts"],"sourcesContent":["/**\n * Copyright Amazon.com, Inc. or its affiliates. All Rights Reserved.\n * SPDX-License-Identifier: Apache-2.0\n */\nimport {\n  joinPathFragments,\n  type ProjectConfiguration,\n  type Tree,\n} from '@nx/devkit';\nimport {\n  type DependencyDeclaration,\n  forDependencies,\n  type MustDeclare,\n} from './declared-dependencies';\nimport { FS_DEPENDENCIES, FsCommands } from './fs';\nimport { addDependencyToTargetIfNotPresent } from './nx';\nimport { containerImage, type ITsDepVersion, TS_VERSIONS } from './versions';\n\n/** Dependencies a caller must declare to add a Docker scan target. */\nexport const DOCKER_DEPENDENCIES = [...FS_DEPENDENCIES] as const;\n\nconst TRIVY_IGNORE_FILE = '.trivyignore';\n\nconst TRIVY_IGNORE_CONTENTS = `# Trivy ignore file. Add one vulnerability ID (e.g. CVE-2021-12345) per line to\n# suppress it during the image scan (\\`nx run-many --target trivy\\`).\n# https://trivy.dev/latest/docs/configuration/filtering/#by-finding-ids\n`;\n\n/**\n * Substitution variables for the vended Node `Dockerfile` templates: the npm\n * version to install globally, and the versions its dependency overrides pin.\n */\nexport const nodeImageVersions = () => ({\n  npmVersion: TS_VERSIONS.npm,\n  minimatchVersion: TS_VERSIONS.minimatch,\n});\n\n/**\n * Packages a vended Node `Dockerfile` pins, which every generator writing one\n * must declare so the version sync keeps those pins current.\n *\n * Spread through `ownedElsewhere`: the pin lives in the image build rather than\n * in any manifest, so nothing is installed into the workspace. Left undeclared\n * these would be the only vended versions never upgraded — and they are\n * precisely the ones held at a version clear of a known HIGH/CRITICAL\n * vulnerability.\n */\nexport const NODE_IMAGE_DEPENDENCIES = [\n  { name: 'npm' },\n  { name: 'minimatch' },\n] as const satisfies readonly { name: ITsDepVersion }[];\n\n/**\n * Packages the AWS Distro for OpenTelemetry install in a vended `Dockerfile`\n * pins, for the images that auto-instrument with it. Spread through\n * `ownedElsewhere` for the same reason as {@link NODE_IMAGE_DEPENDENCIES}.\n */\nexport const ADOT_IMAGE_DEPENDENCIES = [\n  { name: '@aws/aws-distro-opentelemetry-node-autoinstrumentation' },\n  { name: '@opentelemetry/propagator-jaeger' },\n] as const satisfies readonly { name: ITsDepVersion }[];\n\nexport interface DockerScanTargetOptions {\n  /**\n   * Project configuration to add the scan target to (mutated in place).\n   */\n  readonly project: ProjectConfiguration;\n  /**\n   * Container engine command to invoke (\\`docker\\` or \\`finch\\`).\n   */\n  readonly containerEngine: string;\n  /**\n   * Name of the scan target to add, e.g. \\`my-agent-trivy\\`.\n   */\n  readonly trivyTargetName: string;\n  /**\n   * Name of the docker target that builds the image(s) to scan. The scan\n   * target depends on it.\n   */\n  readonly dockerTargetName: string;\n  /**\n   * Tags of the images built by the docker target which should be scanned.\n   */\n  readonly imageTags: string[];\n}\n\n/**\n * Add a cacheable Trivy scan target for the images built by a docker target\n * and wire it under the aggregate \\`trivy\\` target. The scan is not part of\n * \\`build\\` — run \\`nx run-many --target trivy\\` (the root \\`trivy\\` script) in CI.\n *\n * The scan target depends on the docker target and declares the project source\n * as its inputs, so an unchanged image is never re-scanned (a cache hit skips\n * the scan entirely). Each image is saved to a tarball under\n * \\`dist/<projectRoot>/trivy/<scan-key>\\` (kept out of any Docker build context)\n * and scanned with the pinned ECR-hosted Trivy image via a workspace-relative\n * bind mount, so the same commands work under both docker and finch. The scan\n * exits non-zero (exit code 1) on HIGH/CRITICAL vulnerabilities.\n *\n * A \\`.trivyignore\\` is vended at the project root (kept if it already exists)\n * for suppressing findings.\n */\nexport const addDockerScanTarget = <const D extends DependencyDeclaration>(\n  tree: Tree,\n  options: DockerScanTargetOptions,\n  declaration: D & MustDeclare<typeof DOCKER_DEPENDENCIES, D>,\n): void => {\n  const { project, containerEngine, trivyTargetName, dockerTargetName } =\n    options;\n  const { imageTags } = options;\n  const projectRoot = project.root;\n\n  const ignoreFilePath = joinPathFragments(projectRoot, TRIVY_IGNORE_FILE);\n  if (!tree.exists(ignoreFilePath)) {\n    tree.write(ignoreFilePath, TRIVY_IGNORE_CONTENTS);\n  }\n\n  // Stage scan artifacts in a directory unique to this scan target so that\n  // sibling targets in the same project (e.g. multiple agents) don't clobber\n  // each other's tarballs when run in parallel. The first image tag is unique\n  // per target, so it makes a stable, collision-free key.\n  const scanKey = imageTags[0].replace(/[^a-zA-Z0-9-]/g, '-');\n  const scanDir = joinPathFragments('dist', projectRoot, 'trivy', scanKey);\n  const trivyImage = containerImage('trivy');\n\n  const fs = new FsCommands(\n    tree,\n    forDependencies<typeof DOCKER_DEPENDENCIES>(declaration),\n  );\n  const commands = [\n    fs.rm(scanDir),\n    fs.mkdir(scanDir),\n    fs.cp(ignoreFilePath, joinPathFragments(scanDir, TRIVY_IGNORE_FILE)),\n  ];\n\n  imageTags.forEach((imageTag, index) => {\n    const tarName = `image-${index}.tar`;\n    commands.push(\n      `${containerEngine} save -o ${joinPathFragments(scanDir, tarName)} ${imageTag}`,\n      `${containerEngine} run --rm -v \"./${scanDir}\":/scan ${trivyImage} image --input /scan/${tarName} --ignorefile /scan/${TRIVY_IGNORE_FILE} --scanners vuln --severity HIGH,CRITICAL --ignore-unfixed --exit-code 1 --no-progress -q`,\n    );\n  });\n\n  project.targets ??= {};\n  project.targets[trivyTargetName] = {\n    cache: true,\n    // The scanned image is fully determined by the project source, so caching\n    // on the source ensures an unchanged image is never re-scanned.\n    inputs: ['default', '^production'],\n    outputs: [`{workspaceRoot}/${scanDir}`],\n    executor: 'nx:run-commands',\n    options: {\n      commands,\n      parallel: false,\n    },\n    dependsOn: [dockerTargetName],\n  };\n\n  // Aggregate per-component scan targets under a single `trivy` target. The\n  // scan is intentionally NOT wired into `build`: image scanning is slow and\n  // its result depends on the ever-changing vulnerability database (a scan\n  // that passes today can fail tomorrow when a new CVE is published), so\n  // coupling it to `build` would make local and CI builds non-deterministic.\n  // Run `nx run-many --target trivy` (the root `trivy` script) in CI instead.\n  if (trivyTargetName !== 'trivy') {\n    addDependencyToTargetIfNotPresent(project, 'trivy', trivyTargetName);\n  }\n};\n"],"names":["joinPathFragments","forDependencies","FS_DEPENDENCIES","FsCommands","addDependencyToTargetIfNotPresent","containerImage","TS_VERSIONS","DOCKER_DEPENDENCIES","TRIVY_IGNORE_FILE","TRIVY_IGNORE_CONTENTS","nodeImageVersions","npmVersion","npm","minimatchVersion","minimatch","NODE_IMAGE_DEPENDENCIES","name","ADOT_IMAGE_DEPENDENCIES","addDockerScanTarget","tree","options","declaration","project","containerEngine","trivyTargetName","dockerTargetName","imageTags","projectRoot","root","ignoreFilePath","exists","write","scanKey","replace","scanDir","trivyImage","fs","commands","rm","mkdir","cp","forEach","imageTag","index","tarName","push","targets","cache","inputs","outputs","executor","parallel","dependsOn"],"mappings":"AAAA;;;CAGC,GACD,SACEA,iBAAiB,QAGZ,aAAa;AACpB,SAEEC,eAAe,QAEV,6BAA0B;AACjC,SAASC,eAAe,EAAEC,UAAU,QAAQ,UAAO;AACnD,SAASC,iCAAiC,QAAQ,UAAO;AACzD,SAASC,cAAc,EAAsBC,WAAW,QAAQ,gBAAa;AAE7E,oEAAoE,GACpE,OAAO,MAAMC,sBAAsB;OAAIL;CAAgB,CAAU;AAEjE,MAAMM,oBAAoB;AAE1B,MAAMC,wBAAwB,CAAC;;;AAG/B,CAAC;AAED;;;CAGC,GACD,OAAO,MAAMC,oBAAoB,IAAO,CAAA;QACtCC,YAAYL,YAAYM,GAAG;QAC3BC,kBAAkBP,YAAYQ,SAAS;IACzC,CAAA,EAAG;AAEH;;;;;;;;;CASC,GACD,OAAO,MAAMC,0BAA0B;IACrC;QAAEC,MAAM;IAAM;IACd;QAAEA,MAAM;IAAY;CACrB,CAAuD;AAExD;;;;CAIC,GACD,OAAO,MAAMC,0BAA0B;IACrC;QAAED,MAAM;IAAyD;IACjE;QAAEA,MAAM;IAAmC;CAC5C,CAAuD;AA0BxD;;;;;;;;;;;;;;;CAeC,GACD,OAAO,MAAME,sBAAsB,CACjCC,MACAC,SACAC;IAEA,MAAM,EAAEC,OAAO,EAAEC,eAAe,EAAEC,eAAe,EAAEC,gBAAgB,EAAE,GACnEL;IACF,MAAM,EAAEM,SAAS,EAAE,GAAGN;IACtB,MAAMO,cAAcL,QAAQM,IAAI;IAEhC,MAAMC,iBAAiB7B,kBAAkB2B,aAAanB;IACtD,IAAI,CAACW,KAAKW,MAAM,CAACD,iBAAiB;QAChCV,KAAKY,KAAK,CAACF,gBAAgBpB;IAC7B;IAEA,yEAAyE;IACzE,2EAA2E;IAC3E,4EAA4E;IAC5E,wDAAwD;IACxD,MAAMuB,UAAUN,SAAS,CAAC,EAAE,CAACO,OAAO,CAAC,kBAAkB;IACvD,MAAMC,UAAUlC,kBAAkB,QAAQ2B,aAAa,SAASK;IAChE,MAAMG,aAAa9B,eAAe;IAElC,MAAM+B,KAAK,IAAIjC,WACbgB,MACAlB,gBAA4CoB;IAE9C,MAAMgB,WAAW;QACfD,GAAGE,EAAE,CAACJ;QACNE,GAAGG,KAAK,CAACL;QACTE,GAAGI,EAAE,CAACX,gBAAgB7B,kBAAkBkC,SAAS1B;KAClD;IAEDkB,UAAUe,OAAO,CAAC,CAACC,UAAUC;QAC3B,MAAMC,UAAU,CAAC,MAAM,EAAED,MAAM,IAAI,CAAC;QACpCN,SAASQ,IAAI,CACX,GAAGtB,gBAAgB,SAAS,EAAEvB,kBAAkBkC,SAASU,SAAS,CAAC,EAAEF,UAAU,EAC/E,GAAGnB,gBAAgB,gBAAgB,EAAEW,QAAQ,QAAQ,EAAEC,WAAW,qBAAqB,EAAES,QAAQ,oBAAoB,EAAEpC,kBAAkB,yFAAyF,CAAC;IAEvO;IAEAc,QAAQwB,OAAO,KAAK,CAAC;IACrBxB,QAAQwB,OAAO,CAACtB,gBAAgB,GAAG;QACjCuB,OAAO;QACP,0EAA0E;QAC1E,gEAAgE;QAChEC,QAAQ;YAAC;YAAW;SAAc;QAClCC,SAAS;YAAC,CAAC,gBAAgB,EAAEf,SAAS;SAAC;QACvCgB,UAAU;QACV9B,SAAS;YACPiB;YACAc,UAAU;QACZ;QACAC,WAAW;YAAC3B;SAAiB;IAC/B;IAEA,0EAA0E;IAC1E,2EAA2E;IAC3E,yEAAyE;IACzE,uEAAuE;IACvE,2EAA2E;IAC3E,4EAA4E;IAC5E,IAAID,oBAAoB,SAAS;QAC/BpB,kCAAkCkB,SAAS,SAASE;IACtD;AACF,EAAE"}

package/src/utils/identity-constructs/identity-constructs.d.ts

@@ -4,6 +4,16 @@
  */
 import { type Tree } from '@nx/devkit';
 import type { Iac } from '../iac';
+import { type IacMetadata } from '../shared-constructs-constants';
+/**
+ * Python version the generated Terraform pins in the callback URL module's inline
+ * `uv run --with` script. Nothing installs it, so it is declared for its version
+ * alone, and only on the Terraform branch that writes the script.
+ */
+export declare const IDENTITY_CONSTRUCTS_PY_DEPENDENCIES: readonly [{
+    readonly name: "boto3";
+    readonly when: (m: IacMetadata) => boolean;
+}];
 export interface AddIdentityInfraOptions {
     cognitoDomain: string;
     allowSignup: boolean;

package/src/utils/identity-constructs/identity-constructs.js

@@ -4,8 +4,18 @@
  */ import { generateFiles, joinPathFragments, OverwriteStrategy } from "@nx/devkit";
 import { addStarExport } from "../ast.js";
 import { esmVars } from "../module-format.js";
-import { PACKAGES_DIR, SHARED_CONSTRUCTS_DIR, SHARED_TERRAFORM_DIR } from "../shared-constructs-constants.js";
+import { generatedTerraform, PACKAGES_DIR, SHARED_CONSTRUCTS_DIR, SHARED_TERRAFORM_DIR } from "../shared-constructs-constants.js";
 import { PY_VERSIONS, terraformProviderVersions } from "../versions.js";
+/**
+ * Python version the generated Terraform pins in the callback URL module's inline
+ * `uv run --with` script. Nothing installs it, so it is declared for its version
+ * alone, and only on the Terraform branch that writes the script.
+ */ export const IDENTITY_CONSTRUCTS_PY_DEPENDENCIES = [
+    {
+        name: 'boto3',
+        when: generatedTerraform
+    }
+];
 /**
  * Add infrastructure for a static website
  */ export const addIdentityInfra = async (tree, options)=>{

package/src/utils/identity-constructs/identity-constructs.js.map

@@ -1 +1 @@
-{"version":3,"sources":["../../../../../../packages/nx-plugin/src/utils/identity-constructs/identity-constructs.ts"],"sourcesContent":["/**\n * Copyright Amazon.com, Inc. or its affiliates. All Rights Reserved.\n * SPDX-License-Identifier: Apache-2.0\n */\nimport {\n  generateFiles,\n  joinPathFragments,\n  OverwriteStrategy,\n  type Tree,\n} from '@nx/devkit';\nimport { addStarExport } from '../ast';\nimport type { Iac } from '../iac';\nimport { esmVars } from '../module-format';\nimport {\n  PACKAGES_DIR,\n  SHARED_CONSTRUCTS_DIR,\n  SHARED_TERRAFORM_DIR,\n} from '../shared-constructs-constants';\nimport { PY_VERSIONS, terraformProviderVersions } from '../versions';\n\nexport interface AddIdentityInfraOptions {\n  cognitoDomain: string;\n  allowSignup: boolean;\n}\n\n/**\n * Add infrastructure for a static website\n */\nexport const addIdentityInfra = async (\n  tree: Tree,\n  options: AddIdentityInfraOptions & { iac: Iac },\n) => {\n  if (options.iac === 'cdk') {\n    await addIdentityCdkConstructs(tree, options);\n  } else if (options.iac === 'terraform') {\n    addIdentityTerraformModules(tree, options);\n  } else {\n    throw new Error(`Unsupported iac ${options.iac}`);\n  }\n};\n\nconst addIdentityCdkConstructs = async (\n  tree: Tree,\n  options: AddIdentityInfraOptions,\n) => {\n  generateFiles(\n    tree,\n    joinPathFragments(import.meta.dirname, 'files', 'cdk', 'core'),\n    joinPathFragments(PACKAGES_DIR, SHARED_CONSTRUCTS_DIR, 'src', 'core'),\n    { ...options, ...esmVars(tree) },\n    {\n      overwriteStrategy: OverwriteStrategy.KeepExisting,\n    },\n  );\n\n  await addStarExport(\n    tree,\n    joinPathFragments(\n      PACKAGES_DIR,\n      SHARED_CONSTRUCTS_DIR,\n      'src',\n      'core',\n      'index.ts',\n    ),\n    './user-identity.js',\n  );\n};\n\nconst addIdentityTerraformModules = (\n  tree: Tree,\n  options: AddIdentityInfraOptions,\n) => {\n  generateFiles(\n    tree,\n    joinPathFragments(import.meta.dirname, 'files', 'terraform', 'core'),\n    joinPathFragments(PACKAGES_DIR, SHARED_TERRAFORM_DIR, 'src', 'core'),\n    {\n      ...options,\n      boto3Version: PY_VERSIONS.boto3,\n      ...terraformProviderVersions(),\n    },\n    {\n      overwriteStrategy: OverwriteStrategy.KeepExisting,\n    },\n  );\n\n  // Update the static website module to add the callback url\n  const staticWebsiteModule = tree.read(\n    joinPathFragments(\n      PACKAGES_DIR,\n      SHARED_TERRAFORM_DIR,\n      'src',\n      'core',\n      'static-website',\n      'static-website.tf',\n    ),\n    'utf-8',\n  );\n  if (\n    staticWebsiteModule &&\n    !staticWebsiteModule.includes(\n      'source = \"../user-identity/add-callback-url\"',\n    )\n  ) {\n    // Find the aws_cloudfront_distribution.website resource and add the callback URL module after it.\n    // Includes the CloudFront domain plus any custom domain names (aliases) configured via var.custom_domain_names.\n    const callbackUrlModule = `\n\n# Add CloudFront domain and any custom domain names to user pool client callback URLs.\n# Keyed by statically-known values so for_each keys are resolvable at plan time; the\n# CloudFront domain is only known at apply time, so it appears in the value, not the key.\nlocals {\n  callback_urls = merge(\n    { cloudfront = \"https://\\${aws_cloudfront_distribution.website.domain_name}\" },\n    { for domain in var.custom_domain_names : domain => \"https://\\${domain}\" },\n  )\n}\n\nmodule \"add_callback_url\" {\n  source = \"../user-identity/add-callback-url\"\n  for_each = local.callback_urls\n\n  callback_url = each.value\n\n  depends_on = [aws_cloudfront_distribution.website]\n}`;\n\n    // Find the CloudFront distribution resource using proper brace counting\n    // This handles deeply nested structures correctly\n    const resourceStartPattern =\n      /resource\\s+\"aws_cloudfront_distribution\"\\s+\"website\"\\s*\\{/;\n    const resourceStartMatch = staticWebsiteModule.match(resourceStartPattern);\n\n    if (resourceStartMatch) {\n      const startIndex =\n        resourceStartMatch.index! + resourceStartMatch[0].length - 1; // Position at opening brace\n      let braceCount = 0;\n      let insertionPoint = -1;\n\n      // Count braces to find the end of the resource block\n      for (let i = startIndex; i < staticWebsiteModule.length; i++) {\n        const char = staticWebsiteModule[i];\n        if (char === '{') {\n          braceCount++;\n        } else if (char === '}') {\n          braceCount--;\n          if (braceCount === 0) {\n            // Found the closing brace of the CloudFront resource\n            insertionPoint = i + 1;\n            break;\n          }\n        }\n      }\n\n      if (insertionPoint !== -1) {\n        // Insert the callback URL module right after the CloudFront distribution\n        const beforeInsertion = staticWebsiteModule.substring(\n          0,\n          insertionPoint,\n        );\n        const afterInsertion = staticWebsiteModule.substring(insertionPoint);\n        const updatedContent =\n          beforeInsertion + callbackUrlModule + afterInsertion;\n\n        tree.write(\n          joinPathFragments(\n            PACKAGES_DIR,\n            SHARED_TERRAFORM_DIR,\n            'src',\n            'core',\n            'static-website',\n            'static-website.tf',\n          ),\n          updatedContent,\n        );\n      }\n    }\n  }\n};\n"],"names":["generateFiles","joinPathFragments","OverwriteStrategy","addStarExport","esmVars","PACKAGES_DIR","SHARED_CONSTRUCTS_DIR","SHARED_TERRAFORM_DIR","PY_VERSIONS","terraformProviderVersions","addIdentityInfra","tree","options","iac","addIdentityCdkConstructs","addIdentityTerraformModules","Error","dirname","overwriteStrategy","KeepExisting","boto3Version","boto3","staticWebsiteModule","read","includes","callbackUrlModule","resourceStartPattern","resourceStartMatch","match","startIndex","index","length","braceCount","insertionPoint","i","char","beforeInsertion","substring","afterInsertion","updatedContent","write"],"mappings":"AAAA;;;CAGC,GACD,SACEA,aAAa,EACbC,iBAAiB,EACjBC,iBAAiB,QAEZ,aAAa;AACpB,SAASC,aAAa,QAAQ,YAAS;AAEvC,SAASC,OAAO,QAAQ,sBAAmB;AAC3C,SACEC,YAAY,EACZC,qBAAqB,EACrBC,oBAAoB,QACf,oCAAiC;AACxC,SAASC,WAAW,EAAEC,yBAAyB,QAAQ,iBAAc;AAOrE;;CAEC,GACD,OAAO,MAAMC,mBAAmB,OAC9BC,MACAC;IAEA,IAAIA,QAAQC,GAAG,KAAK,OAAO;QACzB,MAAMC,yBAAyBH,MAAMC;IACvC,OAAO,IAAIA,QAAQC,GAAG,KAAK,aAAa;QACtCE,4BAA4BJ,MAAMC;IACpC,OAAO;QACL,MAAM,IAAII,MAAM,CAAC,gBAAgB,EAAEJ,QAAQC,GAAG,EAAE;IAClD;AACF,EAAE;AAEF,MAAMC,2BAA2B,OAC/BH,MACAC;IAEAZ,cACEW,MACAV,kBAAkB,YAAYgB,OAAO,EAAE,SAAS,OAAO,SACvDhB,kBAAkBI,cAAcC,uBAAuB,OAAO,SAC9D;QAAE,GAAGM,OAAO;QAAE,GAAGR,QAAQO,KAAK;IAAC,GAC/B;QACEO,mBAAmBhB,kBAAkBiB,YAAY;IACnD;IAGF,MAAMhB,cACJQ,MACAV,kBACEI,cACAC,uBACA,OACA,QACA,aAEF;AAEJ;AAEA,MAAMS,8BAA8B,CAClCJ,MACAC;IAEAZ,cACEW,MACAV,kBAAkB,YAAYgB,OAAO,EAAE,SAAS,aAAa,SAC7DhB,kBAAkBI,cAAcE,sBAAsB,OAAO,SAC7D;QACE,GAAGK,OAAO;QACVQ,cAAcZ,YAAYa,KAAK;QAC/B,GAAGZ,2BAA2B;IAChC,GACA;QACES,mBAAmBhB,kBAAkBiB,YAAY;IACnD;IAGF,2DAA2D;IAC3D,MAAMG,sBAAsBX,KAAKY,IAAI,CACnCtB,kBACEI,cACAE,sBACA,OACA,QACA,kBACA,sBAEF;IAEF,IACEe,uBACA,CAACA,oBAAoBE,QAAQ,CAC3B,iDAEF;QACA,kGAAkG;QAClG,gHAAgH;QAChH,MAAMC,oBAAoB,CAAC;;;;;;;;;;;;;;;;;;;CAmB9B,CAAC;QAEE,wEAAwE;QACxE,kDAAkD;QAClD,MAAMC,uBACJ;QACF,MAAMC,qBAAqBL,oBAAoBM,KAAK,CAACF;QAErD,IAAIC,oBAAoB;YACtB,MAAME,aACJF,mBAAmBG,KAAK,GAAIH,kBAAkB,CAAC,EAAE,CAACI,MAAM,GAAG,GAAG,4BAA4B;YAC5F,IAAIC,aAAa;YACjB,IAAIC,iBAAiB,CAAC;YAEtB,qDAAqD;YACrD,IAAK,IAAIC,IAAIL,YAAYK,IAAIZ,oBAAoBS,MAAM,EAAEG,IAAK;gBAC5D,MAAMC,OAAOb,mBAAmB,CAACY,EAAE;gBACnC,IAAIC,SAAS,KAAK;oBAChBH;gBACF,OAAO,IAAIG,SAAS,KAAK;oBACvBH;oBACA,IAAIA,eAAe,GAAG;wBACpB,qDAAqD;wBACrDC,iBAAiBC,IAAI;wBACrB;oBACF;gBACF;YACF;YAEA,IAAID,mBAAmB,CAAC,GAAG;gBACzB,yEAAyE;gBACzE,MAAMG,kBAAkBd,oBAAoBe,SAAS,CACnD,GACAJ;gBAEF,MAAMK,iBAAiBhB,oBAAoBe,SAAS,CAACJ;gBACrD,MAAMM,iBACJH,kBAAkBX,oBAAoBa;gBAExC3B,KAAK6B,KAAK,CACRvC,kBACEI,cACAE,sBACA,OACA,QACA,kBACA,sBAEFgC;YAEJ;QACF;IACF;AACF"}
+{"version":3,"sources":["../../../../../../packages/nx-plugin/src/utils/identity-constructs/identity-constructs.ts"],"sourcesContent":["/**\n * Copyright Amazon.com, Inc. or its affiliates. All Rights Reserved.\n * SPDX-License-Identifier: Apache-2.0\n */\nimport {\n  generateFiles,\n  joinPathFragments,\n  OverwriteStrategy,\n  type Tree,\n} from '@nx/devkit';\nimport { addStarExport } from '../ast';\nimport type { DeclaredPyDependency } from '../declared-dependencies';\nimport type { Iac } from '../iac';\nimport { esmVars } from '../module-format';\nimport {\n  generatedTerraform,\n  type IacMetadata,\n  PACKAGES_DIR,\n  SHARED_CONSTRUCTS_DIR,\n  SHARED_TERRAFORM_DIR,\n} from '../shared-constructs-constants';\nimport {\n  type IPyDepVersion,\n  PY_VERSIONS,\n  terraformProviderVersions,\n} from '../versions';\n\n/**\n * Python version the generated Terraform pins in the callback URL module's inline\n * `uv run --with` script. Nothing installs it, so it is declared for its version\n * alone, and only on the Terraform branch that writes the script.\n */\nexport const IDENTITY_CONSTRUCTS_PY_DEPENDENCIES = [\n  { name: 'boto3', when: generatedTerraform },\n] as const satisfies readonly DeclaredPyDependency<\n  IPyDepVersion,\n  IacMetadata\n>[];\n\nexport interface AddIdentityInfraOptions {\n  cognitoDomain: string;\n  allowSignup: boolean;\n}\n\n/**\n * Add infrastructure for a static website\n */\nexport const addIdentityInfra = async (\n  tree: Tree,\n  options: AddIdentityInfraOptions & { iac: Iac },\n) => {\n  if (options.iac === 'cdk') {\n    await addIdentityCdkConstructs(tree, options);\n  } else if (options.iac === 'terraform') {\n    addIdentityTerraformModules(tree, options);\n  } else {\n    throw new Error(`Unsupported iac ${options.iac}`);\n  }\n};\n\nconst addIdentityCdkConstructs = async (\n  tree: Tree,\n  options: AddIdentityInfraOptions,\n) => {\n  generateFiles(\n    tree,\n    joinPathFragments(import.meta.dirname, 'files', 'cdk', 'core'),\n    joinPathFragments(PACKAGES_DIR, SHARED_CONSTRUCTS_DIR, 'src', 'core'),\n    { ...options, ...esmVars(tree) },\n    {\n      overwriteStrategy: OverwriteStrategy.KeepExisting,\n    },\n  );\n\n  await addStarExport(\n    tree,\n    joinPathFragments(\n      PACKAGES_DIR,\n      SHARED_CONSTRUCTS_DIR,\n      'src',\n      'core',\n      'index.ts',\n    ),\n    './user-identity.js',\n  );\n};\n\nconst addIdentityTerraformModules = (\n  tree: Tree,\n  options: AddIdentityInfraOptions,\n) => {\n  generateFiles(\n    tree,\n    joinPathFragments(import.meta.dirname, 'files', 'terraform', 'core'),\n    joinPathFragments(PACKAGES_DIR, SHARED_TERRAFORM_DIR, 'src', 'core'),\n    {\n      ...options,\n      boto3Version: PY_VERSIONS.boto3,\n      ...terraformProviderVersions(),\n    },\n    {\n      overwriteStrategy: OverwriteStrategy.KeepExisting,\n    },\n  );\n\n  // Update the static website module to add the callback url\n  const staticWebsiteModule = tree.read(\n    joinPathFragments(\n      PACKAGES_DIR,\n      SHARED_TERRAFORM_DIR,\n      'src',\n      'core',\n      'static-website',\n      'static-website.tf',\n    ),\n    'utf-8',\n  );\n  if (\n    staticWebsiteModule &&\n    !staticWebsiteModule.includes(\n      'source = \"../user-identity/add-callback-url\"',\n    )\n  ) {\n    // Find the aws_cloudfront_distribution.website resource and add the callback URL module after it.\n    // Includes the CloudFront domain plus any custom domain names (aliases) configured via var.custom_domain_names.\n    const callbackUrlModule = `\n\n# Add CloudFront domain and any custom domain names to user pool client callback URLs.\n# Keyed by statically-known values so for_each keys are resolvable at plan time; the\n# CloudFront domain is only known at apply time, so it appears in the value, not the key.\nlocals {\n  callback_urls = merge(\n    { cloudfront = \"https://\\${aws_cloudfront_distribution.website.domain_name}\" },\n    { for domain in var.custom_domain_names : domain => \"https://\\${domain}\" },\n  )\n}\n\nmodule \"add_callback_url\" {\n  source = \"../user-identity/add-callback-url\"\n  for_each = local.callback_urls\n\n  callback_url = each.value\n\n  depends_on = [aws_cloudfront_distribution.website]\n}`;\n\n    // Find the CloudFront distribution resource using proper brace counting\n    // This handles deeply nested structures correctly\n    const resourceStartPattern =\n      /resource\\s+\"aws_cloudfront_distribution\"\\s+\"website\"\\s*\\{/;\n    const resourceStartMatch = staticWebsiteModule.match(resourceStartPattern);\n\n    if (resourceStartMatch) {\n      const startIndex =\n        resourceStartMatch.index! + resourceStartMatch[0].length - 1; // Position at opening brace\n      let braceCount = 0;\n      let insertionPoint = -1;\n\n      // Count braces to find the end of the resource block\n      for (let i = startIndex; i < staticWebsiteModule.length; i++) {\n        const char = staticWebsiteModule[i];\n        if (char === '{') {\n          braceCount++;\n        } else if (char === '}') {\n          braceCount--;\n          if (braceCount === 0) {\n            // Found the closing brace of the CloudFront resource\n            insertionPoint = i + 1;\n            break;\n          }\n        }\n      }\n\n      if (insertionPoint !== -1) {\n        // Insert the callback URL module right after the CloudFront distribution\n        const beforeInsertion = staticWebsiteModule.substring(\n          0,\n          insertionPoint,\n        );\n        const afterInsertion = staticWebsiteModule.substring(insertionPoint);\n        const updatedContent =\n          beforeInsertion + callbackUrlModule + afterInsertion;\n\n        tree.write(\n          joinPathFragments(\n            PACKAGES_DIR,\n            SHARED_TERRAFORM_DIR,\n            'src',\n            'core',\n            'static-website',\n            'static-website.tf',\n          ),\n          updatedContent,\n        );\n      }\n    }\n  }\n};\n"],"names":["generateFiles","joinPathFragments","OverwriteStrategy","addStarExport","esmVars","generatedTerraform","PACKAGES_DIR","SHARED_CONSTRUCTS_DIR","SHARED_TERRAFORM_DIR","PY_VERSIONS","terraformProviderVersions","IDENTITY_CONSTRUCTS_PY_DEPENDENCIES","name","when","addIdentityInfra","tree","options","iac","addIdentityCdkConstructs","addIdentityTerraformModules","Error","dirname","overwriteStrategy","KeepExisting","boto3Version","boto3","staticWebsiteModule","read","includes","callbackUrlModule","resourceStartPattern","resourceStartMatch","match","startIndex","index","length","braceCount","insertionPoint","i","char","beforeInsertion","substring","afterInsertion","updatedContent","write"],"mappings":"AAAA;;;CAGC,GACD,SACEA,aAAa,EACbC,iBAAiB,EACjBC,iBAAiB,QAEZ,aAAa;AACpB,SAASC,aAAa,QAAQ,YAAS;AAGvC,SAASC,OAAO,QAAQ,sBAAmB;AAC3C,SACEC,kBAAkB,EAElBC,YAAY,EACZC,qBAAqB,EACrBC,oBAAoB,QACf,oCAAiC;AACxC,SAEEC,WAAW,EACXC,yBAAyB,QACpB,iBAAc;AAErB;;;;CAIC,GACD,OAAO,MAAMC,sCAAsC;IACjD;QAAEC,MAAM;QAASC,MAAMR;IAAmB;CAC3C,CAGG;AAOJ;;CAEC,GACD,OAAO,MAAMS,mBAAmB,OAC9BC,MACAC;IAEA,IAAIA,QAAQC,GAAG,KAAK,OAAO;QACzB,MAAMC,yBAAyBH,MAAMC;IACvC,OAAO,IAAIA,QAAQC,GAAG,KAAK,aAAa;QACtCE,4BAA4BJ,MAAMC;IACpC,OAAO;QACL,MAAM,IAAII,MAAM,CAAC,gBAAgB,EAAEJ,QAAQC,GAAG,EAAE;IAClD;AACF,EAAE;AAEF,MAAMC,2BAA2B,OAC/BH,MACAC;IAEAhB,cACEe,MACAd,kBAAkB,YAAYoB,OAAO,EAAE,SAAS,OAAO,SACvDpB,kBAAkBK,cAAcC,uBAAuB,OAAO,SAC9D;QAAE,GAAGS,OAAO;QAAE,GAAGZ,QAAQW,KAAK;IAAC,GAC/B;QACEO,mBAAmBpB,kBAAkBqB,YAAY;IACnD;IAGF,MAAMpB,cACJY,MACAd,kBACEK,cACAC,uBACA,OACA,QACA,aAEF;AAEJ;AAEA,MAAMY,8BAA8B,CAClCJ,MACAC;IAEAhB,cACEe,MACAd,kBAAkB,YAAYoB,OAAO,EAAE,SAAS,aAAa,SAC7DpB,kBAAkBK,cAAcE,sBAAsB,OAAO,SAC7D;QACE,GAAGQ,OAAO;QACVQ,cAAcf,YAAYgB,KAAK;QAC/B,GAAGf,2BAA2B;IAChC,GACA;QACEY,mBAAmBpB,kBAAkBqB,YAAY;IACnD;IAGF,2DAA2D;IAC3D,MAAMG,sBAAsBX,KAAKY,IAAI,CACnC1B,kBACEK,cACAE,sBACA,OACA,QACA,kBACA,sBAEF;IAEF,IACEkB,uBACA,CAACA,oBAAoBE,QAAQ,CAC3B,iDAEF;QACA,kGAAkG;QAClG,gHAAgH;QAChH,MAAMC,oBAAoB,CAAC;;;;;;;;;;;;;;;;;;;CAmB9B,CAAC;QAEE,wEAAwE;QACxE,kDAAkD;QAClD,MAAMC,uBACJ;QACF,MAAMC,qBAAqBL,oBAAoBM,KAAK,CAACF;QAErD,IAAIC,oBAAoB;YACtB,MAAME,aACJF,mBAAmBG,KAAK,GAAIH,kBAAkB,CAAC,EAAE,CAACI,MAAM,GAAG,GAAG,4BAA4B;YAC5F,IAAIC,aAAa;YACjB,IAAIC,iBAAiB,CAAC;YAEtB,qDAAqD;YACrD,IAAK,IAAIC,IAAIL,YAAYK,IAAIZ,oBAAoBS,MAAM,EAAEG,IAAK;gBAC5D,MAAMC,OAAOb,mBAAmB,CAACY,EAAE;gBACnC,IAAIC,SAAS,KAAK;oBAChBH;gBACF,OAAO,IAAIG,SAAS,KAAK;oBACvBH;oBACA,IAAIA,eAAe,GAAG;wBACpB,qDAAqD;wBACrDC,iBAAiBC,IAAI;wBACrB;oBACF;gBACF;YACF;YAEA,IAAID,mBAAmB,CAAC,GAAG;gBACzB,yEAAyE;gBACzE,MAAMG,kBAAkBd,oBAAoBe,SAAS,CACnD,GACAJ;gBAEF,MAAMK,iBAAiBhB,oBAAoBe,SAAS,CAACJ;gBACrD,MAAMM,iBACJH,kBAAkBX,oBAAoBa;gBAExC3B,KAAK6B,KAAK,CACR3C,kBACEK,cACAE,sBACA,OACA,QACA,kBACA,sBAEFmC;YAEJ;QACF;IACF;AACF"}

package/src/utils/migration-manifest.d.ts

@@ -0,0 +1,58 @@
+/**
+ * Copyright Amazon.com, Inc. or its affiliates. All Rights Reserved.
+ * SPDX-License-Identifier: Apache-2.0
+ */
+import type { MigrationsJson } from './migration-versions';
+/**
+ * `migrations.json` is assembled from the plugin's source rather than committed,
+ * so two PRs each adding a migration touch disjoint files and never conflict on
+ * a shared manifest.
+ *
+ * The pieces it is assembled from:
+ * - one folder per migration under `src/migrations/<dir>/<name>/`, where `<dir>`
+ *   is `latest` until a release claims it and `v<version>` after — the folder
+ *   carries a `metadata.json` (its description) beside the code, and its files
+ *   discriminate the kind: a `migration.ts` makes it deterministic, a `prompt.md`
+ *   agentic, both hybrid;
+ * - `packageJsonUpdates.json`, the nx bumps the weekly update maintains, kept in
+ *   its own file so that churn never shares an edit with a migration PR;
+ * - the version sync entry, a fixed `everyMigration` codemod that runs on every
+ *   upgrade and so has no folder.
+ *
+ * The assembled manifest is unversioned — release-time stamping resolves versions
+ * (see `migration-versions.ts`).
+ */
+/** JSON schema the manifest declares, matching what nx expects. */
+export declare const MIGRATIONS_JSON_SCHEMA = "http://json-schema.org/schema";
+/** Key the version sync migration is registered under. */
+export declare const SYNC_VENDED_MIGRATION_KEY = "sync-vended-versions";
+/**
+ * The version sync migration entry. Committed as code rather than a folder: it
+ * carries no release-specific registration and must run on every upgrade, so it
+ * is fixed and can't conflict.
+ */
+export declare const syncVendedMigrationEntry: () => NonNullable<MigrationsJson["generators"]>[string];
+/** A migration folder discovered under `src/migrations`. */
+export interface DiscoveredMigration {
+    /** Folder grouping the migration by release: `latest` or `v<version>`. */
+    dir: string;
+    /** Migration folder name. */
+    name: string;
+    /** Description read from the folder's `metadata.json`. */
+    description: string;
+    /** A `migration.ts` is present, so the migration has a codemod. */
+    hasImplementation: boolean;
+    /** A `prompt.md` is present, so the migration hands off to an agent. */
+    hasPrompt: boolean;
+}
+/**
+ * Assemble the plugin's `migrations.json` from its source pieces: the discovered
+ * migration folders, the version sync entry, and the nx `packageJsonUpdates`.
+ *
+ * Deterministic — keys are sorted — so regenerating always yields the same file.
+ *
+ * @param pluginName the plugin package name the manifest is for
+ * @param migrations migration folders discovered under `src/migrations`
+ * @param packageJsonUpdates parsed `packageJsonUpdates.json`, if present
+ */
+export declare const assembleMigrations: (pluginName: string, migrations: DiscoveredMigration[], packageJsonUpdates?: MigrationsJson["packageJsonUpdates"]) => MigrationsJson;

package/src/utils/migration-manifest.js

@@ -0,0 +1,76 @@
+/**
+ * Copyright Amazon.com, Inc. or its affiliates. All Rights Reserved.
+ * SPDX-License-Identifier: Apache-2.0
+ */ import { isValidVersion, LATEST_MIGRATIONS_DIR, migrationKey } from "./migration-versions.js";
+import { sortObjectKeys } from "./object.js";
+/**
+ * `migrations.json` is assembled from the plugin's source rather than committed,
+ * so two PRs each adding a migration touch disjoint files and never conflict on
+ * a shared manifest.
+ *
+ * The pieces it is assembled from:
+ * - one folder per migration under `src/migrations/<dir>/<name>/`, where `<dir>`
+ *   is `latest` until a release claims it and `v<version>` after — the folder
+ *   carries a `metadata.json` (its description) beside the code, and its files
+ *   discriminate the kind: a `migration.ts` makes it deterministic, a `prompt.md`
+ *   agentic, both hybrid;
+ * - `packageJsonUpdates.json`, the nx bumps the weekly update maintains, kept in
+ *   its own file so that churn never shares an edit with a migration PR;
+ * - the version sync entry, a fixed `everyMigration` codemod that runs on every
+ *   upgrade and so has no folder.
+ *
+ * The assembled manifest is unversioned — release-time stamping resolves versions
+ * (see `migration-versions.ts`).
+ */ /** JSON schema the manifest declares, matching what nx expects. */ export const MIGRATIONS_JSON_SCHEMA = 'http://json-schema.org/schema';
+/** Key the version sync migration is registered under. */ export const SYNC_VENDED_MIGRATION_KEY = 'sync-vended-versions';
+/**
+ * The version sync migration entry. Committed as code rather than a folder: it
+ * carries no release-specific registration and must run on every upgrade, so it
+ * is fixed and can't conflict.
+ */ export const syncVendedMigrationEntry = ()=>({
+        description: 'Sync vended dependency versions and the tracked plugin version to those vended by this release',
+        implementation: './src/utils/version-upgrade-migration/migration',
+        everyMigration: true
+    });
+/** Registration for a single discovered migration folder. */ const migrationEntry = (migration)=>{
+    const path = `./src/migrations/${migration.dir}/${migration.name}`;
+    return {
+        // A migration in a `v<version>` folder has already been claimed by that
+        // release; its version is the folder. One in `latest` is left for stamping.
+        ...migration.dir !== LATEST_MIGRATIONS_DIR && isValidVersion(migration.dir.replace(/^v/, '')) ? {
+            version: migration.dir.replace(/^v/, '')
+        } : {},
+        description: migration.description,
+        ...migration.hasImplementation ? {
+            implementation: `${path}/migration`
+        } : {},
+        ...migration.hasPrompt ? {
+            prompt: `${path}/prompt.md`
+        } : {}
+    };
+};
+/**
+ * Assemble the plugin's `migrations.json` from its source pieces: the discovered
+ * migration folders, the version sync entry, and the nx `packageJsonUpdates`.
+ *
+ * Deterministic — keys are sorted — so regenerating always yields the same file.
+ *
+ * @param pluginName the plugin package name the manifest is for
+ * @param migrations migration folders discovered under `src/migrations`
+ * @param packageJsonUpdates parsed `packageJsonUpdates.json`, if present
+ */ export const assembleMigrations = (pluginName, migrations, packageJsonUpdates)=>({
+        $schema: MIGRATIONS_JSON_SCHEMA,
+        name: pluginName,
+        generators: sortObjectKeys({
+            [SYNC_VENDED_MIGRATION_KEY]: syncVendedMigrationEntry(),
+            ...Object.fromEntries(migrations.map((migration)=>[
+                    migrationKey(migration.dir, migration.name),
+                    migrationEntry(migration)
+                ]))
+        }),
+        ...packageJsonUpdates && Object.keys(packageJsonUpdates).length > 0 ? {
+            packageJsonUpdates
+        } : {}
+    });
+
+//# sourceMappingURL=migration-manifest.js.map

package/src/utils/migration-manifest.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../../../../../packages/nx-plugin/src/utils/migration-manifest.ts"],"sourcesContent":["/**\n * Copyright Amazon.com, Inc. or its affiliates. All Rights Reserved.\n * SPDX-License-Identifier: Apache-2.0\n */\nimport type { MigrationsJson } from './migration-versions';\nimport {\n  isValidVersion,\n  LATEST_MIGRATIONS_DIR,\n  migrationKey,\n} from './migration-versions';\nimport { sortObjectKeys } from './object';\n\n/**\n * `migrations.json` is assembled from the plugin's source rather than committed,\n * so two PRs each adding a migration touch disjoint files and never conflict on\n * a shared manifest.\n *\n * The pieces it is assembled from:\n * - one folder per migration under `src/migrations/<dir>/<name>/`, where `<dir>`\n *   is `latest` until a release claims it and `v<version>` after — the folder\n *   carries a `metadata.json` (its description) beside the code, and its files\n *   discriminate the kind: a `migration.ts` makes it deterministic, a `prompt.md`\n *   agentic, both hybrid;\n * - `packageJsonUpdates.json`, the nx bumps the weekly update maintains, kept in\n *   its own file so that churn never shares an edit with a migration PR;\n * - the version sync entry, a fixed `everyMigration` codemod that runs on every\n *   upgrade and so has no folder.\n *\n * The assembled manifest is unversioned — release-time stamping resolves versions\n * (see `migration-versions.ts`).\n */\n\n/** JSON schema the manifest declares, matching what nx expects. */\nexport const MIGRATIONS_JSON_SCHEMA = 'http://json-schema.org/schema';\n\n/** Key the version sync migration is registered under. */\nexport const SYNC_VENDED_MIGRATION_KEY = 'sync-vended-versions';\n\n/**\n * The version sync migration entry. Committed as code rather than a folder: it\n * carries no release-specific registration and must run on every upgrade, so it\n * is fixed and can't conflict.\n */\nexport const syncVendedMigrationEntry = (): NonNullable<\n  MigrationsJson['generators']\n>[string] => ({\n  description:\n    'Sync vended dependency versions and the tracked plugin version to those vended by this release',\n  implementation: './src/utils/version-upgrade-migration/migration',\n  everyMigration: true,\n});\n\n/** A migration folder discovered under `src/migrations`. */\nexport interface DiscoveredMigration {\n  /** Folder grouping the migration by release: `latest` or `v<version>`. */\n  dir: string;\n  /** Migration folder name. */\n  name: string;\n  /** Description read from the folder's `metadata.json`. */\n  description: string;\n  /** A `migration.ts` is present, so the migration has a codemod. */\n  hasImplementation: boolean;\n  /** A `prompt.md` is present, so the migration hands off to an agent. */\n  hasPrompt: boolean;\n}\n\n/** Registration for a single discovered migration folder. */\nconst migrationEntry = (\n  migration: DiscoveredMigration,\n): NonNullable<MigrationsJson['generators']>[string] => {\n  const path = `./src/migrations/${migration.dir}/${migration.name}`;\n  return {\n    // A migration in a `v<version>` folder has already been claimed by that\n    // release; its version is the folder. One in `latest` is left for stamping.\n    ...(migration.dir !== LATEST_MIGRATIONS_DIR &&\n    isValidVersion(migration.dir.replace(/^v/, ''))\n      ? { version: migration.dir.replace(/^v/, '') }\n      : {}),\n    description: migration.description,\n    ...(migration.hasImplementation\n      ? { implementation: `${path}/migration` }\n      : {}),\n    ...(migration.hasPrompt ? { prompt: `${path}/prompt.md` } : {}),\n  };\n};\n\n/**\n * Assemble the plugin's `migrations.json` from its source pieces: the discovered\n * migration folders, the version sync entry, and the nx `packageJsonUpdates`.\n *\n * Deterministic — keys are sorted — so regenerating always yields the same file.\n *\n * @param pluginName the plugin package name the manifest is for\n * @param migrations migration folders discovered under `src/migrations`\n * @param packageJsonUpdates parsed `packageJsonUpdates.json`, if present\n */\nexport const assembleMigrations = (\n  pluginName: string,\n  migrations: DiscoveredMigration[],\n  packageJsonUpdates?: MigrationsJson['packageJsonUpdates'],\n): MigrationsJson => ({\n  $schema: MIGRATIONS_JSON_SCHEMA,\n  name: pluginName,\n  generators: sortObjectKeys({\n    [SYNC_VENDED_MIGRATION_KEY]: syncVendedMigrationEntry(),\n    ...Object.fromEntries(\n      migrations.map((migration) => [\n        migrationKey(migration.dir, migration.name),\n        migrationEntry(migration),\n      ]),\n    ),\n  }),\n  ...(packageJsonUpdates && Object.keys(packageJsonUpdates).length > 0\n    ? { packageJsonUpdates }\n    : {}),\n});\n"],"names":["isValidVersion","LATEST_MIGRATIONS_DIR","migrationKey","sortObjectKeys","MIGRATIONS_JSON_SCHEMA","SYNC_VENDED_MIGRATION_KEY","syncVendedMigrationEntry","description","implementation","everyMigration","migrationEntry","migration","path","dir","name","replace","version","hasImplementation","hasPrompt","prompt","assembleMigrations","pluginName","migrations","packageJsonUpdates","$schema","generators","Object","fromEntries","map","keys","length"],"mappings":"AAAA;;;CAGC,GAED,SACEA,cAAc,EACdC,qBAAqB,EACrBC,YAAY,QACP,0BAAuB;AAC9B,SAASC,cAAc,QAAQ,cAAW;AAE1C;;;;;;;;;;;;;;;;;;CAkBC,GAED,iEAAiE,GACjE,OAAO,MAAMC,yBAAyB,gCAAgC;AAEtE,wDAAwD,GACxD,OAAO,MAAMC,4BAA4B,uBAAuB;AAEhE;;;;CAIC,GACD,OAAO,MAAMC,2BAA2B,IAE1B,CAAA;QACZC,aACE;QACFC,gBAAgB;QAChBC,gBAAgB;IAClB,CAAA,EAAG;AAgBH,2DAA2D,GAC3D,MAAMC,iBAAiB,CACrBC;IAEA,MAAMC,OAAO,CAAC,iBAAiB,EAAED,UAAUE,GAAG,CAAC,CAAC,EAAEF,UAAUG,IAAI,EAAE;IAClE,OAAO;QACL,wEAAwE;QACxE,4EAA4E;QAC5E,GAAIH,UAAUE,GAAG,KAAKZ,yBACtBD,eAAeW,UAAUE,GAAG,CAACE,OAAO,CAAC,MAAM,OACvC;YAAEC,SAASL,UAAUE,GAAG,CAACE,OAAO,CAAC,MAAM;QAAI,IAC3C,CAAC,CAAC;QACNR,aAAaI,UAAUJ,WAAW;QAClC,GAAII,UAAUM,iBAAiB,GAC3B;YAAET,gBAAgB,GAAGI,KAAK,UAAU,CAAC;QAAC,IACtC,CAAC,CAAC;QACN,GAAID,UAAUO,SAAS,GAAG;YAAEC,QAAQ,GAAGP,KAAK,UAAU,CAAC;QAAC,IAAI,CAAC,CAAC;IAChE;AACF;AAEA;;;;;;;;;CASC,GACD,OAAO,MAAMQ,qBAAqB,CAChCC,YACAC,YACAC,qBACoB,CAAA;QACpBC,SAASpB;QACTU,MAAMO;QACNI,YAAYtB,eAAe;YACzB,CAACE,0BAA0B,EAAEC;YAC7B,GAAGoB,OAAOC,WAAW,CACnBL,WAAWM,GAAG,CAAC,CAACjB,YAAc;oBAC5BT,aAAaS,UAAUE,GAAG,EAAEF,UAAUG,IAAI;oBAC1CJ,eAAeC;iBAChB,EACF;QACH;QACA,GAAIY,sBAAsBG,OAAOG,IAAI,CAACN,oBAAoBO,MAAM,GAAG,IAC/D;YAAEP;QAAmB,IACrB,CAAC,CAAC;IACR,CAAA,EAAG"}

package/src/utils/migration-versions.d.ts

@@ -27,6 +27,8 @@ import { compare } from 'semver';
  * re-stamped with each pending version, so it runs on every upgrade.
  */
 export interface MigrationsJson {
+    $schema?: string;
+    name?: string;
     generators?: Record<string, {
         version?: string;
         everyMigration?: boolean;