@aws/nx-plugin 1.0.0-rc.57 → 1.0.0-rc.59

package/src/utils/migration-versions.js.map

@@ -1 +1 @@
-{"version":3,"sources":["../../../../../packages/nx-plugin/src/utils/migration-versions.ts"],"sourcesContent":["/**\n * Copyright Amazon.com, Inc. or its affiliates. All Rights Reserved.\n * SPDX-License-Identifier: Apache-2.0\n */\nimport { compare, valid } from 'semver';\n\n/**\n * Version stamping for migrations.\n *\n * A new migration is committed with no `version` — releases are calculated from\n * conventional commits and written only to `dist/` and a git tag, so versions\n * reach the published `migrations.json` two ways:\n *\n * - At release time (`scripts/stamp-migrations.ts`) entries still missing a\n *   version are stamped into the compiled `migrations.json`: an already shipped\n *   one gets the earliest release tag registering it, and a net-new one gets the\n *   version the release is about to publish, which the release job passes in\n *   after `nx release version` writes it to the dist manifests.\n * - The weekly `update-versions` PR backfills the version of the release that\n *   shipped each migration, moving and re-keying it accordingly\n *   (`scripts/backfill-migration-versions.ts`), so source converges on the\n *   versions of everything already released. `packageJsonUpdates` entries are\n *   dated in place there too, since their keys never change.\n *\n * A version already in source always wins, so backfilled entries are stable.\n *\n * An entry marked `everyMigration: true` is never backfilled or pinned, and is\n * re-stamped with each pending version, so it runs on every upgrade.\n */\n\nexport interface MigrationsJson {\n  generators?: Record<\n    string,\n    { version?: string; everyMigration?: boolean } & Record<string, unknown>\n  >;\n  /**\n   * Declarative dependency bumps `nx migrate` applies to the root manifest.\n   * Keyed by what the bump targets rather than the release that ships it, so an\n   * entry is unique from the moment it is written and one release's bump can sit\n   * beside the next; nx itself gates on the entry's `version`.\n   */\n  packageJsonUpdates?: Record<\n    string,\n    { version: string } & Record<string, unknown>\n  >;\n}\n\n/** Ascending semver comparator for `Array.prototype.sort`. */\nexport const compareVersions = compare;\n\n/** Whether a string is an exact semver version. */\nexport const isValidVersion = (version: string): boolean =>\n  valid(version) !== null;\n\n/**\n * Map of entry key -> version of the earliest release that registers it, across\n * both `generators` and `packageJsonUpdates`. Resolved only for the entries still\n * missing a version (one already recorded in source wins, so its history doesn't\n * need reading). An entry that hasn't been released is absent.\n *\n * Walks releases newest first and stops as soon as every entry is resolved: an\n * entry that has disappeared from a release's `migrations.json` was first\n * registered by the release after it, which is the one that shipped it.\n *\n * Both sections resolve the same way and share the walk, so the release doesn't\n * read tag history twice. Keys can't collide: a migration is keyed by its own\n * name, an nx bump by the nx version it moves to.\n *\n * @param migrations parsed source migrations.json\n * @param versions released versions in descending semver order\n * @param readReleasedMigrations reads the `migrations.json` published by a given\n *   version, or undefined if it predates the manifest\n */\nexport const readShippedMigrationVersions = (\n  migrations: MigrationsJson,\n  versions: string[],\n  readReleasedMigrations: (version: string) => MigrationsJson | undefined,\n): Record<string, string> => {\n  const shippedVersions: Record<string, string> = {};\n  // A `packageJsonUpdates` entry records `latest` rather than omitting its\n  // version, since nx requires the field.\n  let unresolved = [\n    ...Object.entries(migrations.generators ?? {})\n      .filter(([, entry]) => !entry.version)\n      .map(([key]) => key),\n    ...Object.entries(migrations.packageJsonUpdates ?? {})\n      .filter(([, entry]) => entry.version === LATEST_MIGRATIONS_DIR)\n      .map(([key]) => key),\n  ];\n\n  for (const version of versions) {\n    if (unresolved.length === 0) {\n      break;\n    }\n    const released = readReleasedMigrations(version);\n    const registered = new Set([\n      ...Object.keys(released?.generators ?? {}),\n      ...Object.keys(released?.packageJsonUpdates ?? {}),\n    ]);\n    // Entries gone at this release keep the version recorded from the release\n    // after it (if any) and stop being looked up.\n    unresolved = unresolved.filter((key) => registered.has(key));\n    for (const key of unresolved) {\n      shippedVersions[key] = version;\n    }\n  }\n\n  return shippedVersions;\n};\n\n/**\n * Return a copy of the migrations collection with a `version` stamped onto\n * every generator entry, preserving any already present, and the pending version\n * recorded on any `packageJsonUpdates` entry still holding `latest`.\n *\n * @param migrations parsed migrations.json to stamp\n * @param shippedVersions migration key -> version of the earliest release\n *   tag that registers it (absent for migrations that haven't shipped)\n * @param pendingVersion version the release is about to publish, stamped onto\n *   unshipped migrations so their version is one that really shipped\n */\nexport const stampMigrationVersions = (\n  migrations: MigrationsJson,\n  shippedVersions: Record<string, string>,\n  pendingVersion: string,\n): MigrationsJson => ({\n  ...migrations,\n  generators: Object.fromEntries(\n    // `nx migrate` sorts the run ascending by version and preserves the\n    // manifest's order among equal versions, so emitting the every-migration\n    // entries last is what makes them run after the release's own migrations.\n    Object.entries(migrations.generators ?? {})\n      .sort(\n        ([, a], [, b]) =>\n          Number(a.everyMigration ?? false) - Number(b.everyMigration ?? false),\n      )\n      .map(([name, entry]) => {\n        // Source-only marker, stripped from what nx reads.\n        const { everyMigration, version: sourceVersion, ...published } = entry;\n        // Overrides any source version so it stays ahead of what is installed.\n        const version = everyMigration\n          ? pendingVersion\n          : (sourceVersion ?? shippedVersions[name] ?? pendingVersion);\n        return [name, { version, ...published }];\n      }),\n  ),\n  ...(migrations.packageJsonUpdates && {\n    packageJsonUpdates: stampPackageJsonUpdates(\n      migrations.packageJsonUpdates,\n      pendingVersion,\n    ),\n  }),\n});\n\n/**\n * Version any `packageJsonUpdates` entry still holding `latest` with the release\n * about to publish it, so the nx bump ships under a version `nx migrate` gates on.\n */\nconst stampPackageJsonUpdates = (\n  packageJsonUpdates: NonNullable<MigrationsJson['packageJsonUpdates']>,\n  pendingVersion: string,\n): NonNullable<MigrationsJson['packageJsonUpdates']> =>\n  resolvePackageJsonUpdateVersions(packageJsonUpdates, () => pendingVersion);\n\n/** Directory a newly scaffolded migration lands in, before a release claims it. */\nexport const LATEST_MIGRATIONS_DIR = 'latest';\n\n/** Directory holding the migrations shipped by a given release. */\nexport const versionMigrationsDir = (version: string) => `v${version}`;\n\n/**\n * Key a migration is registered under in `migrations.json`. Prefixed with its\n * directory so reusing a name in a later release can't silently overwrite the\n * one that already shipped.\n */\nexport const migrationKey = (dir: string, name: string) => `${dir}-${name}`;\n\nconst LATEST_KEY_PREFIX = `${LATEST_MIGRATIONS_DIR}-`;\n\n/** A migration directory move the caller needs to make on disk. */\nexport interface MigrationDirMove {\n  name: string;\n  version: string;\n  from: string;\n  to: string;\n}\n\n/**\n * Record the release that shipped each migration on entries without a version,\n * re-keying them and re-pointing their paths at that release's folder, and\n * return the collection alongside the keys that changed and the directory moves\n * to make on disk.\n *\n * Unlike `stampMigrationVersions` this only records already-released versions,\n * leaving the release to decide what a net-new migration gets.\n *\n * @param migrations parsed migrations.json to backfill\n * @param shippedVersions migration key -> version of the earliest release tag\n *   that registers it (absent for migrations that haven't shipped)\n */\nexport const backfillMigrationVersions = (\n  migrations: MigrationsJson,\n  shippedVersions: Record<string, string>,\n): {\n  migrations: MigrationsJson;\n  backfilled: string[];\n  moves: MigrationDirMove[];\n} => {\n  const generators: NonNullable<MigrationsJson['generators']> = {};\n  const backfilled: string[] = [];\n  const moves: MigrationDirMove[] = [];\n  // Reported alongside the migrations so the update's PR says an nx bump was\n  // dated, and so the caller knows there is something to commit.\n  const backfilledUpdates = Object.entries(migrations.packageJsonUpdates ?? {})\n    .filter(\n      ([key, entry]) =>\n        entry.version === LATEST_MIGRATIONS_DIR && shippedVersions[key],\n    )\n    .map(([key]) => key);\n\n  for (const [key, entry] of Object.entries(migrations.generators ?? {})) {\n    const version = shippedVersions[key];\n    // Pinning an every-migration entry would stop it running on later upgrades.\n    if (entry.version || !version || entry.everyMigration) {\n      generators[key] = entry;\n      continue;\n    }\n\n    const name = key.startsWith(LATEST_KEY_PREFIX)\n      ? key.slice(LATEST_KEY_PREFIX.length)\n      : key;\n    const versionDir = versionMigrationsDir(version);\n    const latestSegment = `/${LATEST_MIGRATIONS_DIR}/${name}/`;\n    const versionSegment = `/${versionDir}/${name}/`;\n\n    // Re-point each path field at the version folder, recording the move the\n    // caller needs to make on disk the first time one is found.\n    const repointed: Record<string, unknown> = {};\n    let moved = false;\n    for (const [field, value] of Object.entries(entry)) {\n      if (typeof value !== 'string' || !value.includes(latestSegment)) {\n        repointed[field] = value;\n        continue;\n      }\n      repointed[field] = value.replace(latestSegment, versionSegment);\n      if (!moved) {\n        moved = true;\n        const dir = value.slice(0, value.indexOf(latestSegment));\n        moves.push({\n          name,\n          version,\n          from: `${dir}${latestSegment}`.replace(/^\\.\\/|\\/$/g, ''),\n          to: `${dir}${versionSegment}`.replace(/^\\.\\/|\\/$/g, ''),\n        });\n      }\n    }\n\n    generators[migrationKey(versionDir, name)] = { version, ...repointed };\n    backfilled.push(key);\n  }\n\n  return {\n    migrations: {\n      ...migrations,\n      generators,\n      ...(migrations.packageJsonUpdates && {\n        packageJsonUpdates: resolvePackageJsonUpdateVersions(\n          migrations.packageJsonUpdates,\n          (key) => shippedVersions[key],\n        ),\n      }),\n    },\n    backfilled: [...backfilled, ...backfilledUpdates],\n    moves,\n  };\n};\n\n/**\n * Record the version each `packageJsonUpdates` entry ships under, for those still\n * holding `latest`.\n *\n * The key already identifies the entry — an nx bump is named for the nx version\n * it moves to — so only the `version` field changes. Nothing is re-keyed, which\n * is what lets one release's bump sit alongside the next without either being\n * overwritten before it ships.\n */\nconst resolvePackageJsonUpdateVersions = (\n  packageJsonUpdates: NonNullable<MigrationsJson['packageJsonUpdates']>,\n  resolve: (key: string) => string | undefined,\n): NonNullable<MigrationsJson['packageJsonUpdates']> =>\n  Object.fromEntries(\n    Object.entries(packageJsonUpdates).map(([key, entry]) => {\n      const version =\n        entry.version === LATEST_MIGRATIONS_DIR ? resolve(key) : undefined;\n      return [key, version ? { ...entry, version } : entry];\n    }),\n  );\n"],"names":["compare","valid","compareVersions","isValidVersion","version","readShippedMigrationVersions","migrations","versions","readReleasedMigrations","shippedVersions","unresolved","Object","entries","generators","filter","entry","map","key","packageJsonUpdates","LATEST_MIGRATIONS_DIR","length","released","registered","Set","keys","has","stampMigrationVersions","pendingVersion","fromEntries","sort","a","b","Number","everyMigration","name","sourceVersion","published","stampPackageJsonUpdates","resolvePackageJsonUpdateVersions","versionMigrationsDir","migrationKey","dir","LATEST_KEY_PREFIX","backfillMigrationVersions","backfilled","moves","backfilledUpdates","startsWith","slice","versionDir","latestSegment","versionSegment","repointed","moved","field","value","includes","replace","indexOf","push","from","to","resolve","undefined"],"mappings":"AAAA;;;CAGC,GACD,SAASA,OAAO,EAAEC,KAAK,QAAQ,SAAS;AA2CxC,4DAA4D,GAC5D,OAAO,MAAMC,kBAAkBF,QAAQ;AAEvC,iDAAiD,GACjD,OAAO,MAAMG,iBAAiB,CAACC,UAC7BH,MAAMG,aAAa,KAAK;AAE1B;;;;;;;;;;;;;;;;;;CAkBC,GACD,OAAO,MAAMC,+BAA+B,CAC1CC,YACAC,UACAC;IAEA,MAAMC,kBAA0C,CAAC;IACjD,yEAAyE;IACzE,wCAAwC;IACxC,IAAIC,aAAa;WACZC,OAAOC,OAAO,CAACN,WAAWO,UAAU,IAAI,CAAC,GACzCC,MAAM,CAAC,CAAC,GAAGC,MAAM,GAAK,CAACA,MAAMX,OAAO,EACpCY,GAAG,CAAC,CAAC,CAACC,IAAI,GAAKA;WACfN,OAAOC,OAAO,CAACN,WAAWY,kBAAkB,IAAI,CAAC,GACjDJ,MAAM,CAAC,CAAC,GAAGC,MAAM,GAAKA,MAAMX,OAAO,KAAKe,uBACxCH,GAAG,CAAC,CAAC,CAACC,IAAI,GAAKA;KACnB;IAED,KAAK,MAAMb,WAAWG,SAAU;QAC9B,IAAIG,WAAWU,MAAM,KAAK,GAAG;YAC3B;QACF;QACA,MAAMC,WAAWb,uBAAuBJ;QACxC,MAAMkB,aAAa,IAAIC,IAAI;eACtBZ,OAAOa,IAAI,CAACH,UAAUR,cAAc,CAAC;eACrCF,OAAOa,IAAI,CAACH,UAAUH,sBAAsB,CAAC;SACjD;QACD,0EAA0E;QAC1E,8CAA8C;QAC9CR,aAAaA,WAAWI,MAAM,CAAC,CAACG,MAAQK,WAAWG,GAAG,CAACR;QACvD,KAAK,MAAMA,OAAOP,WAAY;YAC5BD,eAAe,CAACQ,IAAI,GAAGb;QACzB;IACF;IAEA,OAAOK;AACT,EAAE;AAEF;;;;;;;;;;CAUC,GACD,OAAO,MAAMiB,yBAAyB,CACpCpB,YACAG,iBACAkB,iBACoB,CAAA;QACpB,GAAGrB,UAAU;QACbO,YAAYF,OAAOiB,WAAW,CAC5B,oEAAoE;QACpE,yEAAyE;QACzE,0EAA0E;QAC1EjB,OAAOC,OAAO,CAACN,WAAWO,UAAU,IAAI,CAAC,GACtCgB,IAAI,CACH,CAAC,GAAGC,EAAE,EAAE,GAAGC,EAAE,GACXC,OAAOF,EAAEG,cAAc,IAAI,SAASD,OAAOD,EAAEE,cAAc,IAAI,QAElEjB,GAAG,CAAC,CAAC,CAACkB,MAAMnB,MAAM;YACjB,mDAAmD;YACnD,MAAM,EAAEkB,cAAc,EAAE7B,SAAS+B,aAAa,EAAE,GAAGC,WAAW,GAAGrB;YACjE,uEAAuE;YACvE,MAAMX,UAAU6B,iBACZN,iBACCQ,iBAAiB1B,eAAe,CAACyB,KAAK,IAAIP;YAC/C,OAAO;gBAACO;gBAAM;oBAAE9B;oBAAS,GAAGgC,SAAS;gBAAC;aAAE;QAC1C;QAEJ,GAAI9B,WAAWY,kBAAkB,IAAI;YACnCA,oBAAoBmB,wBAClB/B,WAAWY,kBAAkB,EAC7BS;QAEJ,CAAC;IACH,CAAA,EAAG;AAEH;;;CAGC,GACD,MAAMU,0BAA0B,CAC9BnB,oBACAS,iBAEAW,iCAAiCpB,oBAAoB,IAAMS;AAE7D,iFAAiF,GACjF,OAAO,MAAMR,wBAAwB,SAAS;AAE9C,iEAAiE,GACjE,OAAO,MAAMoB,uBAAuB,CAACnC,UAAoB,CAAC,CAAC,EAAEA,SAAS,CAAC;AAEvE;;;;CAIC,GACD,OAAO,MAAMoC,eAAe,CAACC,KAAaP,OAAiB,GAAGO,IAAI,CAAC,EAAEP,MAAM,CAAC;AAE5E,MAAMQ,oBAAoB,GAAGvB,sBAAsB,CAAC,CAAC;AAUrD;;;;;;;;;;;;CAYC,GACD,OAAO,MAAMwB,4BAA4B,CACvCrC,YACAG;IAMA,MAAMI,aAAwD,CAAC;IAC/D,MAAM+B,aAAuB,EAAE;IAC/B,MAAMC,QAA4B,EAAE;IACpC,2EAA2E;IAC3E,+DAA+D;IAC/D,MAAMC,oBAAoBnC,OAAOC,OAAO,CAACN,WAAWY,kBAAkB,IAAI,CAAC,GACxEJ,MAAM,CACL,CAAC,CAACG,KAAKF,MAAM,GACXA,MAAMX,OAAO,KAAKe,yBAAyBV,eAAe,CAACQ,IAAI,EAElED,GAAG,CAAC,CAAC,CAACC,IAAI,GAAKA;IAElB,KAAK,MAAM,CAACA,KAAKF,MAAM,IAAIJ,OAAOC,OAAO,CAACN,WAAWO,UAAU,IAAI,CAAC,GAAI;QACtE,MAAMT,UAAUK,eAAe,CAACQ,IAAI;QACpC,4EAA4E;QAC5E,IAAIF,MAAMX,OAAO,IAAI,CAACA,WAAWW,MAAMkB,cAAc,EAAE;YACrDpB,UAAU,CAACI,IAAI,GAAGF;YAClB;QACF;QAEA,MAAMmB,OAAOjB,IAAI8B,UAAU,CAACL,qBACxBzB,IAAI+B,KAAK,CAACN,kBAAkBtB,MAAM,IAClCH;QACJ,MAAMgC,aAAaV,qBAAqBnC;QACxC,MAAM8C,gBAAgB,CAAC,CAAC,EAAE/B,sBAAsB,CAAC,EAAEe,KAAK,CAAC,CAAC;QAC1D,MAAMiB,iBAAiB,CAAC,CAAC,EAAEF,WAAW,CAAC,EAAEf,KAAK,CAAC,CAAC;QAEhD,yEAAyE;QACzE,4DAA4D;QAC5D,MAAMkB,YAAqC,CAAC;QAC5C,IAAIC,QAAQ;QACZ,KAAK,MAAM,CAACC,OAAOC,MAAM,IAAI5C,OAAOC,OAAO,CAACG,OAAQ;YAClD,IAAI,OAAOwC,UAAU,YAAY,CAACA,MAAMC,QAAQ,CAACN,gBAAgB;gBAC/DE,SAAS,CAACE,MAAM,GAAGC;gBACnB;YACF;YACAH,SAAS,CAACE,MAAM,GAAGC,MAAME,OAAO,CAACP,eAAeC;YAChD,IAAI,CAACE,OAAO;gBACVA,QAAQ;gBACR,MAAMZ,MAAMc,MAAMP,KAAK,CAAC,GAAGO,MAAMG,OAAO,CAACR;gBACzCL,MAAMc,IAAI,CAAC;oBACTzB;oBACA9B;oBACAwD,MAAM,GAAGnB,MAAMS,eAAe,CAACO,OAAO,CAAC,cAAc;oBACrDI,IAAI,GAAGpB,MAAMU,gBAAgB,CAACM,OAAO,CAAC,cAAc;gBACtD;YACF;QACF;QAEA5C,UAAU,CAAC2B,aAAaS,YAAYf,MAAM,GAAG;YAAE9B;YAAS,GAAGgD,SAAS;QAAC;QACrER,WAAWe,IAAI,CAAC1C;IAClB;IAEA,OAAO;QACLX,YAAY;YACV,GAAGA,UAAU;YACbO;YACA,GAAIP,WAAWY,kBAAkB,IAAI;gBACnCA,oBAAoBoB,iCAClBhC,WAAWY,kBAAkB,EAC7B,CAACD,MAAQR,eAAe,CAACQ,IAAI;YAEjC,CAAC;QACH;QACA2B,YAAY;eAAIA;eAAeE;SAAkB;QACjDD;IACF;AACF,EAAE;AAEF;;;;;;;;CAQC,GACD,MAAMP,mCAAmC,CACvCpB,oBACA4C,UAEAnD,OAAOiB,WAAW,CAChBjB,OAAOC,OAAO,CAACM,oBAAoBF,GAAG,CAAC,CAAC,CAACC,KAAKF,MAAM;QAClD,MAAMX,UACJW,MAAMX,OAAO,KAAKe,wBAAwB2C,QAAQ7C,OAAO8C;QAC3D,OAAO;YAAC9C;YAAKb,UAAU;gBAAE,GAAGW,KAAK;gBAAEX;YAAQ,IAAIW;SAAM;IACvD"}
+{"version":3,"sources":["../../../../../packages/nx-plugin/src/utils/migration-versions.ts"],"sourcesContent":["/**\n * Copyright Amazon.com, Inc. or its affiliates. All Rights Reserved.\n * SPDX-License-Identifier: Apache-2.0\n */\nimport { compare, valid } from 'semver';\n\n/**\n * Version stamping for migrations.\n *\n * A new migration is committed with no `version` — releases are calculated from\n * conventional commits and written only to `dist/` and a git tag, so versions\n * reach the published `migrations.json` two ways:\n *\n * - At release time (`scripts/stamp-migrations.ts`) entries still missing a\n *   version are stamped into the compiled `migrations.json`: an already shipped\n *   one gets the earliest release tag registering it, and a net-new one gets the\n *   version the release is about to publish, which the release job passes in\n *   after `nx release version` writes it to the dist manifests.\n * - The weekly `update-versions` PR backfills the version of the release that\n *   shipped each migration, moving and re-keying it accordingly\n *   (`scripts/backfill-migration-versions.ts`), so source converges on the\n *   versions of everything already released. `packageJsonUpdates` entries are\n *   dated in place there too, since their keys never change.\n *\n * A version already in source always wins, so backfilled entries are stable.\n *\n * An entry marked `everyMigration: true` is never backfilled or pinned, and is\n * re-stamped with each pending version, so it runs on every upgrade.\n */\n\nexport interface MigrationsJson {\n  $schema?: string;\n  name?: string;\n  generators?: Record<\n    string,\n    { version?: string; everyMigration?: boolean } & Record<string, unknown>\n  >;\n  /**\n   * Declarative dependency bumps `nx migrate` applies to the root manifest.\n   * Keyed by what the bump targets rather than the release that ships it, so an\n   * entry is unique from the moment it is written and one release's bump can sit\n   * beside the next; nx itself gates on the entry's `version`.\n   */\n  packageJsonUpdates?: Record<\n    string,\n    { version: string } & Record<string, unknown>\n  >;\n}\n\n/** Ascending semver comparator for `Array.prototype.sort`. */\nexport const compareVersions = compare;\n\n/** Whether a string is an exact semver version. */\nexport const isValidVersion = (version: string): boolean =>\n  valid(version) !== null;\n\n/**\n * Map of entry key -> version of the earliest release that registers it, across\n * both `generators` and `packageJsonUpdates`. Resolved only for the entries still\n * missing a version (one already recorded in source wins, so its history doesn't\n * need reading). An entry that hasn't been released is absent.\n *\n * Walks releases newest first and stops as soon as every entry is resolved: an\n * entry that has disappeared from a release's `migrations.json` was first\n * registered by the release after it, which is the one that shipped it.\n *\n * Both sections resolve the same way and share the walk, so the release doesn't\n * read tag history twice. Keys can't collide: a migration is keyed by its own\n * name, an nx bump by the nx version it moves to.\n *\n * @param migrations parsed source migrations.json\n * @param versions released versions in descending semver order\n * @param readReleasedMigrations reads the `migrations.json` published by a given\n *   version, or undefined if it predates the manifest\n */\nexport const readShippedMigrationVersions = (\n  migrations: MigrationsJson,\n  versions: string[],\n  readReleasedMigrations: (version: string) => MigrationsJson | undefined,\n): Record<string, string> => {\n  const shippedVersions: Record<string, string> = {};\n  // A `packageJsonUpdates` entry records `latest` rather than omitting its\n  // version, since nx requires the field.\n  let unresolved = [\n    ...Object.entries(migrations.generators ?? {})\n      .filter(([, entry]) => !entry.version)\n      .map(([key]) => key),\n    ...Object.entries(migrations.packageJsonUpdates ?? {})\n      .filter(([, entry]) => entry.version === LATEST_MIGRATIONS_DIR)\n      .map(([key]) => key),\n  ];\n\n  for (const version of versions) {\n    if (unresolved.length === 0) {\n      break;\n    }\n    const released = readReleasedMigrations(version);\n    const registered = new Set([\n      ...Object.keys(released?.generators ?? {}),\n      ...Object.keys(released?.packageJsonUpdates ?? {}),\n    ]);\n    // Entries gone at this release keep the version recorded from the release\n    // after it (if any) and stop being looked up.\n    unresolved = unresolved.filter((key) => registered.has(key));\n    for (const key of unresolved) {\n      shippedVersions[key] = version;\n    }\n  }\n\n  return shippedVersions;\n};\n\n/**\n * Return a copy of the migrations collection with a `version` stamped onto\n * every generator entry, preserving any already present, and the pending version\n * recorded on any `packageJsonUpdates` entry still holding `latest`.\n *\n * @param migrations parsed migrations.json to stamp\n * @param shippedVersions migration key -> version of the earliest release\n *   tag that registers it (absent for migrations that haven't shipped)\n * @param pendingVersion version the release is about to publish, stamped onto\n *   unshipped migrations so their version is one that really shipped\n */\nexport const stampMigrationVersions = (\n  migrations: MigrationsJson,\n  shippedVersions: Record<string, string>,\n  pendingVersion: string,\n): MigrationsJson => ({\n  ...migrations,\n  generators: Object.fromEntries(\n    // `nx migrate` sorts the run ascending by version and preserves the\n    // manifest's order among equal versions, so emitting the every-migration\n    // entries last is what makes them run after the release's own migrations.\n    Object.entries(migrations.generators ?? {})\n      .sort(\n        ([, a], [, b]) =>\n          Number(a.everyMigration ?? false) - Number(b.everyMigration ?? false),\n      )\n      .map(([name, entry]) => {\n        // Source-only marker, stripped from what nx reads.\n        const { everyMigration, version: sourceVersion, ...published } = entry;\n        // Overrides any source version so it stays ahead of what is installed.\n        const version = everyMigration\n          ? pendingVersion\n          : (sourceVersion ?? shippedVersions[name] ?? pendingVersion);\n        return [name, { version, ...published }];\n      }),\n  ),\n  ...(migrations.packageJsonUpdates && {\n    packageJsonUpdates: stampPackageJsonUpdates(\n      migrations.packageJsonUpdates,\n      pendingVersion,\n    ),\n  }),\n});\n\n/**\n * Version any `packageJsonUpdates` entry still holding `latest` with the release\n * about to publish it, so the nx bump ships under a version `nx migrate` gates on.\n */\nconst stampPackageJsonUpdates = (\n  packageJsonUpdates: NonNullable<MigrationsJson['packageJsonUpdates']>,\n  pendingVersion: string,\n): NonNullable<MigrationsJson['packageJsonUpdates']> =>\n  resolvePackageJsonUpdateVersions(packageJsonUpdates, () => pendingVersion);\n\n/** Directory a newly scaffolded migration lands in, before a release claims it. */\nexport const LATEST_MIGRATIONS_DIR = 'latest';\n\n/** Directory holding the migrations shipped by a given release. */\nexport const versionMigrationsDir = (version: string) => `v${version}`;\n\n/**\n * Key a migration is registered under in `migrations.json`. Prefixed with its\n * directory so reusing a name in a later release can't silently overwrite the\n * one that already shipped.\n */\nexport const migrationKey = (dir: string, name: string) => `${dir}-${name}`;\n\nconst LATEST_KEY_PREFIX = `${LATEST_MIGRATIONS_DIR}-`;\n\n/** A migration directory move the caller needs to make on disk. */\nexport interface MigrationDirMove {\n  name: string;\n  version: string;\n  from: string;\n  to: string;\n}\n\n/**\n * Record the release that shipped each migration on entries without a version,\n * re-keying them and re-pointing their paths at that release's folder, and\n * return the collection alongside the keys that changed and the directory moves\n * to make on disk.\n *\n * Unlike `stampMigrationVersions` this only records already-released versions,\n * leaving the release to decide what a net-new migration gets.\n *\n * @param migrations parsed migrations.json to backfill\n * @param shippedVersions migration key -> version of the earliest release tag\n *   that registers it (absent for migrations that haven't shipped)\n */\nexport const backfillMigrationVersions = (\n  migrations: MigrationsJson,\n  shippedVersions: Record<string, string>,\n): {\n  migrations: MigrationsJson;\n  backfilled: string[];\n  moves: MigrationDirMove[];\n} => {\n  const generators: NonNullable<MigrationsJson['generators']> = {};\n  const backfilled: string[] = [];\n  const moves: MigrationDirMove[] = [];\n  // Reported alongside the migrations so the update's PR says an nx bump was\n  // dated, and so the caller knows there is something to commit.\n  const backfilledUpdates = Object.entries(migrations.packageJsonUpdates ?? {})\n    .filter(\n      ([key, entry]) =>\n        entry.version === LATEST_MIGRATIONS_DIR && shippedVersions[key],\n    )\n    .map(([key]) => key);\n\n  for (const [key, entry] of Object.entries(migrations.generators ?? {})) {\n    const version = shippedVersions[key];\n    // Pinning an every-migration entry would stop it running on later upgrades.\n    if (entry.version || !version || entry.everyMigration) {\n      generators[key] = entry;\n      continue;\n    }\n\n    const name = key.startsWith(LATEST_KEY_PREFIX)\n      ? key.slice(LATEST_KEY_PREFIX.length)\n      : key;\n    const versionDir = versionMigrationsDir(version);\n    const latestSegment = `/${LATEST_MIGRATIONS_DIR}/${name}/`;\n    const versionSegment = `/${versionDir}/${name}/`;\n\n    // Re-point each path field at the version folder, recording the move the\n    // caller needs to make on disk the first time one is found.\n    const repointed: Record<string, unknown> = {};\n    let moved = false;\n    for (const [field, value] of Object.entries(entry)) {\n      if (typeof value !== 'string' || !value.includes(latestSegment)) {\n        repointed[field] = value;\n        continue;\n      }\n      repointed[field] = value.replace(latestSegment, versionSegment);\n      if (!moved) {\n        moved = true;\n        const dir = value.slice(0, value.indexOf(latestSegment));\n        moves.push({\n          name,\n          version,\n          from: `${dir}${latestSegment}`.replace(/^\\.\\/|\\/$/g, ''),\n          to: `${dir}${versionSegment}`.replace(/^\\.\\/|\\/$/g, ''),\n        });\n      }\n    }\n\n    generators[migrationKey(versionDir, name)] = { version, ...repointed };\n    backfilled.push(key);\n  }\n\n  return {\n    migrations: {\n      ...migrations,\n      generators,\n      ...(migrations.packageJsonUpdates && {\n        packageJsonUpdates: resolvePackageJsonUpdateVersions(\n          migrations.packageJsonUpdates,\n          (key) => shippedVersions[key],\n        ),\n      }),\n    },\n    backfilled: [...backfilled, ...backfilledUpdates],\n    moves,\n  };\n};\n\n/**\n * Record the version each `packageJsonUpdates` entry ships under, for those still\n * holding `latest`.\n *\n * The key already identifies the entry — an nx bump is named for the nx version\n * it moves to — so only the `version` field changes. Nothing is re-keyed, which\n * is what lets one release's bump sit alongside the next without either being\n * overwritten before it ships.\n */\nconst resolvePackageJsonUpdateVersions = (\n  packageJsonUpdates: NonNullable<MigrationsJson['packageJsonUpdates']>,\n  resolve: (key: string) => string | undefined,\n): NonNullable<MigrationsJson['packageJsonUpdates']> =>\n  Object.fromEntries(\n    Object.entries(packageJsonUpdates).map(([key, entry]) => {\n      const version =\n        entry.version === LATEST_MIGRATIONS_DIR ? resolve(key) : undefined;\n      return [key, version ? { ...entry, version } : entry];\n    }),\n  );\n"],"names":["compare","valid","compareVersions","isValidVersion","version","readShippedMigrationVersions","migrations","versions","readReleasedMigrations","shippedVersions","unresolved","Object","entries","generators","filter","entry","map","key","packageJsonUpdates","LATEST_MIGRATIONS_DIR","length","released","registered","Set","keys","has","stampMigrationVersions","pendingVersion","fromEntries","sort","a","b","Number","everyMigration","name","sourceVersion","published","stampPackageJsonUpdates","resolvePackageJsonUpdateVersions","versionMigrationsDir","migrationKey","dir","LATEST_KEY_PREFIX","backfillMigrationVersions","backfilled","moves","backfilledUpdates","startsWith","slice","versionDir","latestSegment","versionSegment","repointed","moved","field","value","includes","replace","indexOf","push","from","to","resolve","undefined"],"mappings":"AAAA;;;CAGC,GACD,SAASA,OAAO,EAAEC,KAAK,QAAQ,SAAS;AA6CxC,4DAA4D,GAC5D,OAAO,MAAMC,kBAAkBF,QAAQ;AAEvC,iDAAiD,GACjD,OAAO,MAAMG,iBAAiB,CAACC,UAC7BH,MAAMG,aAAa,KAAK;AAE1B;;;;;;;;;;;;;;;;;;CAkBC,GACD,OAAO,MAAMC,+BAA+B,CAC1CC,YACAC,UACAC;IAEA,MAAMC,kBAA0C,CAAC;IACjD,yEAAyE;IACzE,wCAAwC;IACxC,IAAIC,aAAa;WACZC,OAAOC,OAAO,CAACN,WAAWO,UAAU,IAAI,CAAC,GACzCC,MAAM,CAAC,CAAC,GAAGC,MAAM,GAAK,CAACA,MAAMX,OAAO,EACpCY,GAAG,CAAC,CAAC,CAACC,IAAI,GAAKA;WACfN,OAAOC,OAAO,CAACN,WAAWY,kBAAkB,IAAI,CAAC,GACjDJ,MAAM,CAAC,CAAC,GAAGC,MAAM,GAAKA,MAAMX,OAAO,KAAKe,uBACxCH,GAAG,CAAC,CAAC,CAACC,IAAI,GAAKA;KACnB;IAED,KAAK,MAAMb,WAAWG,SAAU;QAC9B,IAAIG,WAAWU,MAAM,KAAK,GAAG;YAC3B;QACF;QACA,MAAMC,WAAWb,uBAAuBJ;QACxC,MAAMkB,aAAa,IAAIC,IAAI;eACtBZ,OAAOa,IAAI,CAACH,UAAUR,cAAc,CAAC;eACrCF,OAAOa,IAAI,CAACH,UAAUH,sBAAsB,CAAC;SACjD;QACD,0EAA0E;QAC1E,8CAA8C;QAC9CR,aAAaA,WAAWI,MAAM,CAAC,CAACG,MAAQK,WAAWG,GAAG,CAACR;QACvD,KAAK,MAAMA,OAAOP,WAAY;YAC5BD,eAAe,CAACQ,IAAI,GAAGb;QACzB;IACF;IAEA,OAAOK;AACT,EAAE;AAEF;;;;;;;;;;CAUC,GACD,OAAO,MAAMiB,yBAAyB,CACpCpB,YACAG,iBACAkB,iBACoB,CAAA;QACpB,GAAGrB,UAAU;QACbO,YAAYF,OAAOiB,WAAW,CAC5B,oEAAoE;QACpE,yEAAyE;QACzE,0EAA0E;QAC1EjB,OAAOC,OAAO,CAACN,WAAWO,UAAU,IAAI,CAAC,GACtCgB,IAAI,CACH,CAAC,GAAGC,EAAE,EAAE,GAAGC,EAAE,GACXC,OAAOF,EAAEG,cAAc,IAAI,SAASD,OAAOD,EAAEE,cAAc,IAAI,QAElEjB,GAAG,CAAC,CAAC,CAACkB,MAAMnB,MAAM;YACjB,mDAAmD;YACnD,MAAM,EAAEkB,cAAc,EAAE7B,SAAS+B,aAAa,EAAE,GAAGC,WAAW,GAAGrB;YACjE,uEAAuE;YACvE,MAAMX,UAAU6B,iBACZN,iBACCQ,iBAAiB1B,eAAe,CAACyB,KAAK,IAAIP;YAC/C,OAAO;gBAACO;gBAAM;oBAAE9B;oBAAS,GAAGgC,SAAS;gBAAC;aAAE;QAC1C;QAEJ,GAAI9B,WAAWY,kBAAkB,IAAI;YACnCA,oBAAoBmB,wBAClB/B,WAAWY,kBAAkB,EAC7BS;QAEJ,CAAC;IACH,CAAA,EAAG;AAEH;;;CAGC,GACD,MAAMU,0BAA0B,CAC9BnB,oBACAS,iBAEAW,iCAAiCpB,oBAAoB,IAAMS;AAE7D,iFAAiF,GACjF,OAAO,MAAMR,wBAAwB,SAAS;AAE9C,iEAAiE,GACjE,OAAO,MAAMoB,uBAAuB,CAACnC,UAAoB,CAAC,CAAC,EAAEA,SAAS,CAAC;AAEvE;;;;CAIC,GACD,OAAO,MAAMoC,eAAe,CAACC,KAAaP,OAAiB,GAAGO,IAAI,CAAC,EAAEP,MAAM,CAAC;AAE5E,MAAMQ,oBAAoB,GAAGvB,sBAAsB,CAAC,CAAC;AAUrD;;;;;;;;;;;;CAYC,GACD,OAAO,MAAMwB,4BAA4B,CACvCrC,YACAG;IAMA,MAAMI,aAAwD,CAAC;IAC/D,MAAM+B,aAAuB,EAAE;IAC/B,MAAMC,QAA4B,EAAE;IACpC,2EAA2E;IAC3E,+DAA+D;IAC/D,MAAMC,oBAAoBnC,OAAOC,OAAO,CAACN,WAAWY,kBAAkB,IAAI,CAAC,GACxEJ,MAAM,CACL,CAAC,CAACG,KAAKF,MAAM,GACXA,MAAMX,OAAO,KAAKe,yBAAyBV,eAAe,CAACQ,IAAI,EAElED,GAAG,CAAC,CAAC,CAACC,IAAI,GAAKA;IAElB,KAAK,MAAM,CAACA,KAAKF,MAAM,IAAIJ,OAAOC,OAAO,CAACN,WAAWO,UAAU,IAAI,CAAC,GAAI;QACtE,MAAMT,UAAUK,eAAe,CAACQ,IAAI;QACpC,4EAA4E;QAC5E,IAAIF,MAAMX,OAAO,IAAI,CAACA,WAAWW,MAAMkB,cAAc,EAAE;YACrDpB,UAAU,CAACI,IAAI,GAAGF;YAClB;QACF;QAEA,MAAMmB,OAAOjB,IAAI8B,UAAU,CAACL,qBACxBzB,IAAI+B,KAAK,CAACN,kBAAkBtB,MAAM,IAClCH;QACJ,MAAMgC,aAAaV,qBAAqBnC;QACxC,MAAM8C,gBAAgB,CAAC,CAAC,EAAE/B,sBAAsB,CAAC,EAAEe,KAAK,CAAC,CAAC;QAC1D,MAAMiB,iBAAiB,CAAC,CAAC,EAAEF,WAAW,CAAC,EAAEf,KAAK,CAAC,CAAC;QAEhD,yEAAyE;QACzE,4DAA4D;QAC5D,MAAMkB,YAAqC,CAAC;QAC5C,IAAIC,QAAQ;QACZ,KAAK,MAAM,CAACC,OAAOC,MAAM,IAAI5C,OAAOC,OAAO,CAACG,OAAQ;YAClD,IAAI,OAAOwC,UAAU,YAAY,CAACA,MAAMC,QAAQ,CAACN,gBAAgB;gBAC/DE,SAAS,CAACE,MAAM,GAAGC;gBACnB;YACF;YACAH,SAAS,CAACE,MAAM,GAAGC,MAAME,OAAO,CAACP,eAAeC;YAChD,IAAI,CAACE,OAAO;gBACVA,QAAQ;gBACR,MAAMZ,MAAMc,MAAMP,KAAK,CAAC,GAAGO,MAAMG,OAAO,CAACR;gBACzCL,MAAMc,IAAI,CAAC;oBACTzB;oBACA9B;oBACAwD,MAAM,GAAGnB,MAAMS,eAAe,CAACO,OAAO,CAAC,cAAc;oBACrDI,IAAI,GAAGpB,MAAMU,gBAAgB,CAACM,OAAO,CAAC,cAAc;gBACtD;YACF;QACF;QAEA5C,UAAU,CAAC2B,aAAaS,YAAYf,MAAM,GAAG;YAAE9B;YAAS,GAAGgD,SAAS;QAAC;QACrER,WAAWe,IAAI,CAAC1C;IAClB;IAEA,OAAO;QACLX,YAAY;YACV,GAAGA,UAAU;YACbO;YACA,GAAIP,WAAWY,kBAAkB,IAAI;gBACnCA,oBAAoBoB,iCAClBhC,WAAWY,kBAAkB,EAC7B,CAACD,MAAQR,eAAe,CAACQ,IAAI;YAEjC,CAAC;QACH;QACA2B,YAAY;eAAIA;eAAeE;SAAkB;QACjDD;IACF;AACF,EAAE;AAEF;;;;;;;;CAQC,GACD,MAAMP,mCAAmC,CACvCpB,oBACA4C,UAEAnD,OAAOiB,WAAW,CAChBjB,OAAOC,OAAO,CAACM,oBAAoBF,GAAG,CAAC,CAAC,CAACC,KAAKF,MAAM;QAClD,MAAMX,UACJW,MAAMX,OAAO,KAAKe,wBAAwB2C,QAAQ7C,OAAO8C;QAC3D,OAAO;YAAC9C;YAAKb,UAAU;gBAAE,GAAGW,KAAK;gBAAEX;YAAQ,IAAIW;SAAM;IACvD"}

package/src/utils/shared-constructs-constants.d.ts

@@ -31,6 +31,12 @@ export interface IacMetadata {
  * questions and no generator needs a second one.
  */
 export declare const generatedInfrastructure: (m: IacMetadata) => boolean;
+/**
+ * Whether Terraform infrastructure was generated, for the versions only a `.tf`
+ * module pins — a Terraform inline script's `uv run --with` pins, which the CDK
+ * branch never writes.
+ */
+export declare const generatedTerraform: (m: IacMetadata) => boolean;
 /**
  * Dependencies a caller must declare to use the shared constructs project.
  * Lives here so generators can spread it without importing the generator.

package/src/utils/shared-constructs-constants.js

@@ -24,6 +24,11 @@ export const DYNAMODB_GENERATOR_IDS = [
  * resolves `iac` only on the infra branch, so one recorded field answers both
  * questions and no generator needs a second one.
  */ export const generatedInfrastructure = (m)=>m.iac !== undefined;
+/**
+ * Whether Terraform infrastructure was generated, for the versions only a `.tf`
+ * module pins — a Terraform inline script's `uv run --with` pins, which the CDK
+ * branch never writes.
+ */ export const generatedTerraform = (m)=>m.iac === 'terraform';
 /**
  * Dependencies a caller must declare to use the shared constructs project.
  * Lives here so generators can spread it without importing the generator.

package/src/utils/shared-constructs-constants.js.map

@@ -1 +1 @@
-{"version":3,"sources":["../../../../../packages/nx-plugin/src/utils/shared-constructs-constants.ts"],"sourcesContent":["/**\n * Copyright Amazon.com, Inc. or its affiliates. All Rights Reserved.\n * SPDX-License-Identifier: Apache-2.0\n */\nimport type { DeclaredTsDependency } from './declared-dependencies';\nimport type { ITsDepVersion } from './versions';\n\nexport const PACKAGES_DIR = 'packages';\nexport const SHARED_CONSTRUCTS_NAME = 'common-constructs';\nexport const SHARED_CONSTRUCTS_DIR = 'common/constructs';\nexport const SHARED_TERRAFORM_NAME = 'terraform';\nexport const SHARED_TERRAFORM_DIR = 'common/terraform';\nexport const SHARED_SHADCN_NAME = 'common-shadcn';\nexport const SHARED_SHADCN_DIR = 'common/shadcn';\nexport const SHARED_INFRA_CONFIG_NAME = 'common-infra-config';\nexport const SHARED_INFRA_CONFIG_DIR = 'common/infra-config';\nexport const SHARED_SCRIPTS_NAME = 'common-scripts';\nexport const SHARED_SCRIPTS_DIR = 'common/scripts';\n\nexport const DYNAMODB_GENERATOR_IDS = ['ts#dynamodb', 'py#dynamodb'];\n\n/**\n * What a generator records about the infrastructure it generated.\n *\n * Every generator that creates infrastructure records the `iac` it used, so a\n * predicate can tell a CDK project from a Terraform one at upgrade time. Absent\n * when the generator was run with no infrastructure, so its presence doubles as\n * \"infrastructure was generated\" — which is what gates the packages an infra\n * helper adds.\n */\nexport interface IacMetadata {\n  readonly iac?: string;\n}\n\n/**\n * Whether infrastructure was generated at all, so the packages an infra helper\n * adds are only claimed where that helper ran.\n *\n * Reads `iac` rather than the generator's own `infra` option: every generator\n * resolves `iac` only on the infra branch, so one recorded field answers both\n * questions and no generator needs a second one.\n */\nexport const generatedInfrastructure = (m: IacMetadata): boolean =>\n  m.iac !== undefined;\n\n/**\n * Dependencies a caller must declare to use the shared constructs project.\n * Lives here so generators can spread it without importing the generator.\n *\n * `constructs` and `aws-cdk-lib` are gated on CDK because\n * `sharedConstructsGenerator` creates the TypeScript constructs project on that\n * branch alone — a Terraform workspace gets the shared Terraform project and\n * never receives them.\n */\nexport const SHARED_CONSTRUCTS_DEPENDENCIES = [\n  { name: 'constructs', when: (m: IacMetadata) => m.iac === 'cdk' },\n  { name: 'aws-cdk-lib', when: (m: IacMetadata) => m.iac === 'cdk' },\n  { name: '@types/node' },\n] as const satisfies readonly DeclaredTsDependency<\n  ITsDepVersion,\n  IacMetadata\n>[];\n"],"names":["PACKAGES_DIR","SHARED_CONSTRUCTS_NAME","SHARED_CONSTRUCTS_DIR","SHARED_TERRAFORM_NAME","SHARED_TERRAFORM_DIR","SHARED_SHADCN_NAME","SHARED_SHADCN_DIR","SHARED_INFRA_CONFIG_NAME","SHARED_INFRA_CONFIG_DIR","SHARED_SCRIPTS_NAME","SHARED_SCRIPTS_DIR","DYNAMODB_GENERATOR_IDS","generatedInfrastructure","m","iac","undefined","SHARED_CONSTRUCTS_DEPENDENCIES","name","when"],"mappings":"AAAA;;;CAGC,GAID,OAAO,MAAMA,eAAe,WAAW;AACvC,OAAO,MAAMC,yBAAyB,oBAAoB;AAC1D,OAAO,MAAMC,wBAAwB,oBAAoB;AACzD,OAAO,MAAMC,wBAAwB,YAAY;AACjD,OAAO,MAAMC,uBAAuB,mBAAmB;AACvD,OAAO,MAAMC,qBAAqB,gBAAgB;AAClD,OAAO,MAAMC,oBAAoB,gBAAgB;AACjD,OAAO,MAAMC,2BAA2B,sBAAsB;AAC9D,OAAO,MAAMC,0BAA0B,sBAAsB;AAC7D,OAAO,MAAMC,sBAAsB,iBAAiB;AACpD,OAAO,MAAMC,qBAAqB,iBAAiB;AAEnD,OAAO,MAAMC,yBAAyB;IAAC;IAAe;CAAc,CAAC;AAerE;;;;;;;CAOC,GACD,OAAO,MAAMC,0BAA0B,CAACC,IACtCA,EAAEC,GAAG,KAAKC,UAAU;AAEtB;;;;;;;;CAQC,GACD,OAAO,MAAMC,iCAAiC;IAC5C;QAAEC,MAAM;QAAcC,MAAM,CAACL,IAAmBA,EAAEC,GAAG,KAAK;IAAM;IAChE;QAAEG,MAAM;QAAeC,MAAM,CAACL,IAAmBA,EAAEC,GAAG,KAAK;IAAM;IACjE;QAAEG,MAAM;IAAc;CACvB,CAGG"}
+{"version":3,"sources":["../../../../../packages/nx-plugin/src/utils/shared-constructs-constants.ts"],"sourcesContent":["/**\n * Copyright Amazon.com, Inc. or its affiliates. All Rights Reserved.\n * SPDX-License-Identifier: Apache-2.0\n */\nimport type { DeclaredTsDependency } from './declared-dependencies';\nimport type { ITsDepVersion } from './versions';\n\nexport const PACKAGES_DIR = 'packages';\nexport const SHARED_CONSTRUCTS_NAME = 'common-constructs';\nexport const SHARED_CONSTRUCTS_DIR = 'common/constructs';\nexport const SHARED_TERRAFORM_NAME = 'terraform';\nexport const SHARED_TERRAFORM_DIR = 'common/terraform';\nexport const SHARED_SHADCN_NAME = 'common-shadcn';\nexport const SHARED_SHADCN_DIR = 'common/shadcn';\nexport const SHARED_INFRA_CONFIG_NAME = 'common-infra-config';\nexport const SHARED_INFRA_CONFIG_DIR = 'common/infra-config';\nexport const SHARED_SCRIPTS_NAME = 'common-scripts';\nexport const SHARED_SCRIPTS_DIR = 'common/scripts';\n\nexport const DYNAMODB_GENERATOR_IDS = ['ts#dynamodb', 'py#dynamodb'];\n\n/**\n * What a generator records about the infrastructure it generated.\n *\n * Every generator that creates infrastructure records the `iac` it used, so a\n * predicate can tell a CDK project from a Terraform one at upgrade time. Absent\n * when the generator was run with no infrastructure, so its presence doubles as\n * \"infrastructure was generated\" — which is what gates the packages an infra\n * helper adds.\n */\nexport interface IacMetadata {\n  readonly iac?: string;\n}\n\n/**\n * Whether infrastructure was generated at all, so the packages an infra helper\n * adds are only claimed where that helper ran.\n *\n * Reads `iac` rather than the generator's own `infra` option: every generator\n * resolves `iac` only on the infra branch, so one recorded field answers both\n * questions and no generator needs a second one.\n */\nexport const generatedInfrastructure = (m: IacMetadata): boolean =>\n  m.iac !== undefined;\n\n/**\n * Whether Terraform infrastructure was generated, for the versions only a `.tf`\n * module pins — a Terraform inline script's `uv run --with` pins, which the CDK\n * branch never writes.\n */\nexport const generatedTerraform = (m: IacMetadata): boolean =>\n  m.iac === 'terraform';\n\n/**\n * Dependencies a caller must declare to use the shared constructs project.\n * Lives here so generators can spread it without importing the generator.\n *\n * `constructs` and `aws-cdk-lib` are gated on CDK because\n * `sharedConstructsGenerator` creates the TypeScript constructs project on that\n * branch alone — a Terraform workspace gets the shared Terraform project and\n * never receives them.\n */\nexport const SHARED_CONSTRUCTS_DEPENDENCIES = [\n  { name: 'constructs', when: (m: IacMetadata) => m.iac === 'cdk' },\n  { name: 'aws-cdk-lib', when: (m: IacMetadata) => m.iac === 'cdk' },\n  { name: '@types/node' },\n] as const satisfies readonly DeclaredTsDependency<\n  ITsDepVersion,\n  IacMetadata\n>[];\n"],"names":["PACKAGES_DIR","SHARED_CONSTRUCTS_NAME","SHARED_CONSTRUCTS_DIR","SHARED_TERRAFORM_NAME","SHARED_TERRAFORM_DIR","SHARED_SHADCN_NAME","SHARED_SHADCN_DIR","SHARED_INFRA_CONFIG_NAME","SHARED_INFRA_CONFIG_DIR","SHARED_SCRIPTS_NAME","SHARED_SCRIPTS_DIR","DYNAMODB_GENERATOR_IDS","generatedInfrastructure","m","iac","undefined","generatedTerraform","SHARED_CONSTRUCTS_DEPENDENCIES","name","when"],"mappings":"AAAA;;;CAGC,GAID,OAAO,MAAMA,eAAe,WAAW;AACvC,OAAO,MAAMC,yBAAyB,oBAAoB;AAC1D,OAAO,MAAMC,wBAAwB,oBAAoB;AACzD,OAAO,MAAMC,wBAAwB,YAAY;AACjD,OAAO,MAAMC,uBAAuB,mBAAmB;AACvD,OAAO,MAAMC,qBAAqB,gBAAgB;AAClD,OAAO,MAAMC,oBAAoB,gBAAgB;AACjD,OAAO,MAAMC,2BAA2B,sBAAsB;AAC9D,OAAO,MAAMC,0BAA0B,sBAAsB;AAC7D,OAAO,MAAMC,sBAAsB,iBAAiB;AACpD,OAAO,MAAMC,qBAAqB,iBAAiB;AAEnD,OAAO,MAAMC,yBAAyB;IAAC;IAAe;CAAc,CAAC;AAerE;;;;;;;CAOC,GACD,OAAO,MAAMC,0BAA0B,CAACC,IACtCA,EAAEC,GAAG,KAAKC,UAAU;AAEtB;;;;CAIC,GACD,OAAO,MAAMC,qBAAqB,CAACH,IACjCA,EAAEC,GAAG,KAAK,YAAY;AAExB;;;;;;;;CAQC,GACD,OAAO,MAAMG,iCAAiC;IAC5C;QAAEC,MAAM;QAAcC,MAAM,CAACN,IAAmBA,EAAEC,GAAG,KAAK;IAAM;IAChE;QAAEI,MAAM;QAAeC,MAAM,CAACN,IAAmBA,EAAEC,GAAG,KAAK;IAAM;IACjE;QAAEI,MAAM;IAAc;CACvB,CAGG"}

package/src/utils/version-upgrade-migration/owned-dependencies.d.ts

@@ -12,6 +12,15 @@ export declare const PLUGIN_ROOT: string;
 export interface OwnedDependencies {
     readonly ts: ReadonlySet<string>;
     readonly py: ReadonlySet<string>;
+    /**
+     * The same, split by the root of the project that owns it, for scoping a pin
+     * embedded in a generated file to the project it sits in. Keyed by project
+     * root; read through {@link ownedForFile}.
+     */
+    readonly byProject: ReadonlyMap<string, {
+        readonly ts: ReadonlySet<string>;
+        readonly py: ReadonlySet<string>;
+    }>;
 }
 /**
  * One recorded run of a generator, with the metadata it wrote.
@@ -22,6 +31,8 @@ export interface OwnedDependencies {
 export interface GeneratorOccurrence {
     readonly id: string;
     readonly metadata: DependencyMetadata;
+    /** Root of the project this ran against, for scoping what it owns to it. */
+    readonly projectRoot?: string;
 }
 /**
  * Every recorded run of a generator in this workspace, from the metadata
@@ -48,3 +59,18 @@ export declare const generatorsRun: (tree: Tree) => ReadonlySet<string>;
  * rather than a run — the generators themselves are never invoked.
  */
 export declare const ownedDependencies: (tree: Tree) => Promise<OwnedDependencies>;
+/**
+ * The dependencies owned where a file sits: those of the project it belongs to,
+ * or the workspace-wide union for a file in a shared project or under none.
+ *
+ * Used for the pins embedded in a generated file, so a version is only rewritten
+ * where the generator that pins it actually ran: a `Dockerfile` under one
+ * project's root is not upgraded because a sibling project owns the package.
+ *
+ * The longest matching root wins, since a nested project's root is a prefix of
+ * nothing else but its own files.
+ */
+export declare const ownedForFile: (owned: OwnedDependencies, filePath: string) => {
+    ts: ReadonlySet<string>;
+    py: ReadonlySet<string>;
+};

package/src/utils/version-upgrade-migration/owned-dependencies.js

@@ -6,6 +6,7 @@ import { getProjects } from "@nx/devkit";
 import { AWS_NX_PLUGIN_CONFIG_FILE_NAME } from "../config/utils.js";
 import { ownedDependencyEntries } from "../declared-dependencies.js";
 import { buildGeneratorInfoList } from "../generators.js";
+import { PACKAGES_DIR, SHARED_CONSTRUCTS_DIR, SHARED_TERRAFORM_DIR } from "../shared-constructs-constants.js";
 /** Directory holding `generators.json`, which maps ids to their modules. */ export const PLUGIN_ROOT = path.resolve(import.meta.dirname, '..', '..', '..');
 /**
  * Every recorded run of a generator in this workspace, from the metadata
@@ -29,14 +30,16 @@ import { buildGeneratorInfoList } from "../generators.js";
             const { components, ...ownMetadata } = metadata;
             occurrences.push({
                 id: metadata.generator,
-                metadata: ownMetadata
+                metadata: ownMetadata,
+                projectRoot: project.root
             });
         }
         for (const component of metadata?.components ?? []){
             if (component.generator) {
                 occurrences.push({
                     id: component.generator,
-                    metadata: component
+                    metadata: component,
+                    projectRoot: project.root
                 });
             }
         }
@@ -59,6 +62,7 @@ import { buildGeneratorInfoList } from "../generators.js";
     const occurrences = generatorOccurrences(tree);
     const ts = new Set();
     const py = new Set();
+    const byProject = new Map();
     for (const info of buildGeneratorInfoList(PLUGIN_ROOT)){
         const matching = occurrences.filter((occurrence)=>occurrence.id === info.id);
         if (matching.length === 0) {
@@ -68,20 +72,64 @@ import { buildGeneratorInfoList } from "../generators.js";
         if (!declaration) {
             continue;
         }
-        for (const { metadata } of matching){
+        for (const { metadata, projectRoot } of matching){
+            const scoped = projectRoot ? byProject.get(projectRoot) ?? byProject.set(projectRoot, {
+                ts: new Set(),
+                py: new Set()
+            }).get(projectRoot) : undefined;
             for (const entry of ownedDependencyEntries(declaration.ts, metadata)){
                 ts.add(entry.name);
+                scoped?.ts.add(entry.name);
             }
             for (const entry of ownedDependencyEntries(declaration.py, metadata)){
                 py.add(entry.name);
+                scoped?.py.add(entry.name);
             }
         }
     }
     return {
         ts,
-        py
+        py,
+        byProject
     };
 };
+/**
+ * Roots of the projects every generator contributes into, rather than one
+ * generator owning outright.
+ *
+ * `sharedConstructsGenerator` creates these and each infra generator writes its
+ * own module into them — the Terraform modules carrying the `uv run --with` pins
+ * come from the agent-core, api, identity and website helpers alike. Both are
+ * registered projects, so scoping a file here to the generator that created the
+ * project would strand every pin the others put there.
+ */ const SHARED_PROJECT_ROOTS = [
+    `${PACKAGES_DIR}/${SHARED_CONSTRUCTS_DIR}`,
+    `${PACKAGES_DIR}/${SHARED_TERRAFORM_DIR}`
+];
+/**
+ * The dependencies owned where a file sits: those of the project it belongs to,
+ * or the workspace-wide union for a file in a shared project or under none.
+ *
+ * Used for the pins embedded in a generated file, so a version is only rewritten
+ * where the generator that pins it actually ran: a `Dockerfile` under one
+ * project's root is not upgraded because a sibling project owns the package.
+ *
+ * The longest matching root wins, since a nested project's root is a prefix of
+ * nothing else but its own files.
+ */ export const ownedForFile = (owned, filePath)=>{
+    if (SHARED_PROJECT_ROOTS.some((root)=>filePath === root || filePath.startsWith(`${root}/`))) {
+        return owned;
+    }
+    let best;
+    let bestLength = -1;
+    for (const [root, scoped] of owned.byProject){
+        if ((filePath === root || filePath.startsWith(`${root}/`)) && root.length > bestLength) {
+            best = scoped;
+            bestLength = root.length;
+        }
+    }
+    return best ?? owned;
+};
 /**
  * A generator's `DEPENDENCIES`, or undefined when it declares none.
  * A generator that fails to load must not fail the upgrade, so its dependencies

package/src/utils/version-upgrade-migration/owned-dependencies.js.map

@@ -1 +1 @@
-{"version":3,"sources":["../../../../../../packages/nx-plugin/src/utils/version-upgrade-migration/owned-dependencies.ts"],"sourcesContent":["/**\n * Copyright Amazon.com, Inc. or its affiliates. All Rights Reserved.\n * SPDX-License-Identifier: Apache-2.0\n */\nimport * as path from 'node:path';\nimport { getProjects, type Tree } from '@nx/devkit';\nimport { AWS_NX_PLUGIN_CONFIG_FILE_NAME } from '../config/utils';\nimport {\n  type DependencyDeclaration,\n  type DependencyMetadata,\n  ownedDependencyEntries,\n} from '../declared-dependencies';\nimport { buildGeneratorInfoList } from '../generators';\n\n/** Directory holding `generators.json`, which maps ids to their modules. */\nexport const PLUGIN_ROOT = path.resolve(import.meta.dirname, '..', '..', '..');\n\n/**\n * Which vended dependencies this workspace's generators are responsible for.\n *\n * Only these are synced, so a package the user added themselves keeps the version\n * they chose. Ownership is derived from the generators the workspace has run and\n * the dependencies each declares — nothing extra is recorded in the workspace.\n */\nexport interface OwnedDependencies {\n  readonly ts: ReadonlySet<string>;\n  readonly py: ReadonlySet<string>;\n}\n\n/**\n * One recorded run of a generator, with the metadata it wrote.\n *\n * The metadata carries the values the generator's dependency conditions read, so\n * a declaration filters down to the branch this occurrence actually took.\n */\nexport interface GeneratorOccurrence {\n  readonly id: string;\n  readonly metadata: DependencyMetadata;\n}\n\n/**\n * Every recorded run of a generator in this workspace, from the metadata\n * generators record on the projects (and components) they create.\n *\n * A generator appears once per project or component it created, since each may\n * have been run with different options.\n *\n * `init` creates no project, so its config file stands in for it.\n */\nexport const generatorOccurrences = (\n  tree: Tree,\n): readonly GeneratorOccurrence[] => {\n  const occurrences: GeneratorOccurrence[] = [];\n  if (tree.exists(AWS_NX_PLUGIN_CONFIG_FILE_NAME)) {\n    occurrences.push({ id: 'init', metadata: {} });\n  }\n  for (const [, project] of getProjects(tree)) {\n    const metadata = project.metadata as\n      | {\n          generator?: string;\n          components?: ({ generator?: string } & DependencyMetadata)[];\n        }\n      | undefined;\n    if (metadata?.generator) {\n      const { components, ...ownMetadata } = metadata;\n      occurrences.push({ id: metadata.generator, metadata: ownMetadata });\n    }\n    for (const component of metadata?.components ?? []) {\n      if (component.generator) {\n        occurrences.push({ id: component.generator, metadata: component });\n      }\n    }\n  }\n  return occurrences;\n};\n\n/** Generator ids this workspace has run. */\nexport const generatorsRun = (tree: Tree): ReadonlySet<string> =>\n  new Set(generatorOccurrences(tree).map((occurrence) => occurrence.id));\n\n/**\n * Union of the dependencies declared by the generators this workspace has run,\n * narrowed per occurrence to those whose conditions its recorded metadata\n * satisfies — a project generated with one protocol does not own another's\n * packages.\n *\n * A `versionOnly` entry is owned like any other: it is declared precisely so the\n * sync keeps its pinned version current wherever the workspace already holds it.\n *\n * Each generator module exports its declaration, so reading one is an import\n * rather than a run — the generators themselves are never invoked.\n */\nexport const ownedDependencies = async (\n  tree: Tree,\n): Promise<OwnedDependencies> => {\n  const occurrences = generatorOccurrences(tree);\n  const ts = new Set<string>();\n  const py = new Set<string>();\n\n  for (const info of buildGeneratorInfoList(PLUGIN_ROOT)) {\n    const matching = occurrences.filter(\n      (occurrence) => occurrence.id === info.id,\n    );\n    if (matching.length === 0) {\n      continue;\n    }\n    const declaration = await readDeclaration(info.resolvedFactoryPath);\n    if (!declaration) {\n      continue;\n    }\n    for (const { metadata } of matching) {\n      for (const entry of ownedDependencyEntries(declaration.ts, metadata)) {\n        ts.add(entry.name as string);\n      }\n      for (const entry of ownedDependencyEntries(declaration.py, metadata)) {\n        py.add(entry.name as string);\n      }\n    }\n  }\n\n  return { ts, py };\n};\n\n/**\n * A generator's `DEPENDENCIES`, or undefined when it declares none.\n * A generator that fails to load must not fail the upgrade, so its dependencies\n * are treated as unowned and left as they are.\n */\nconst readDeclaration = async (\n  factoryPath: string,\n): Promise<DependencyDeclaration | undefined> => {\n  try {\n    const module = await import(`${factoryPath}.js`);\n    return module.DEPENDENCIES;\n  } catch {\n    return undefined;\n  }\n};\n"],"names":["path","getProjects","AWS_NX_PLUGIN_CONFIG_FILE_NAME","ownedDependencyEntries","buildGeneratorInfoList","PLUGIN_ROOT","resolve","dirname","generatorOccurrences","tree","occurrences","exists","push","id","metadata","project","generator","components","ownMetadata","component","generatorsRun","Set","map","occurrence","ownedDependencies","ts","py","info","matching","filter","length","declaration","readDeclaration","resolvedFactoryPath","entry","add","name","factoryPath","module","DEPENDENCIES","undefined"],"mappings":"AAAA;;;CAGC,GACD,YAAYA,UAAU,YAAY;AAClC,SAASC,WAAW,QAAmB,aAAa;AACpD,SAASC,8BAA8B,QAAQ,qBAAkB;AACjE,SAGEC,sBAAsB,QACjB,8BAA2B;AAClC,SAASC,sBAAsB,QAAQ,mBAAgB;AAEvD,0EAA0E,GAC1E,OAAO,MAAMC,cAAcL,KAAKM,OAAO,CAAC,YAAYC,OAAO,EAAE,MAAM,MAAM,MAAM;AAyB/E;;;;;;;;CAQC,GACD,OAAO,MAAMC,uBAAuB,CAClCC;IAEA,MAAMC,cAAqC,EAAE;IAC7C,IAAID,KAAKE,MAAM,CAACT,iCAAiC;QAC/CQ,YAAYE,IAAI,CAAC;YAAEC,IAAI;YAAQC,UAAU,CAAC;QAAE;IAC9C;IACA,KAAK,MAAM,GAAGC,QAAQ,IAAId,YAAYQ,MAAO;QAC3C,MAAMK,WAAWC,QAAQD,QAAQ;QAMjC,IAAIA,UAAUE,WAAW;YACvB,MAAM,EAAEC,UAAU,EAAE,GAAGC,aAAa,GAAGJ;YACvCJ,YAAYE,IAAI,CAAC;gBAAEC,IAAIC,SAASE,SAAS;gBAAEF,UAAUI;YAAY;QACnE;QACA,KAAK,MAAMC,aAAaL,UAAUG,cAAc,EAAE,CAAE;YAClD,IAAIE,UAAUH,SAAS,EAAE;gBACvBN,YAAYE,IAAI,CAAC;oBAAEC,IAAIM,UAAUH,SAAS;oBAAEF,UAAUK;gBAAU;YAClE;QACF;IACF;IACA,OAAOT;AACT,EAAE;AAEF,0CAA0C,GAC1C,OAAO,MAAMU,gBAAgB,CAACX,OAC5B,IAAIY,IAAIb,qBAAqBC,MAAMa,GAAG,CAAC,CAACC,aAAeA,WAAWV,EAAE,GAAG;AAEzE;;;;;;;;;;;CAWC,GACD,OAAO,MAAMW,oBAAoB,OAC/Bf;IAEA,MAAMC,cAAcF,qBAAqBC;IACzC,MAAMgB,KAAK,IAAIJ;IACf,MAAMK,KAAK,IAAIL;IAEf,KAAK,MAAMM,QAAQvB,uBAAuBC,aAAc;QACtD,MAAMuB,WAAWlB,YAAYmB,MAAM,CACjC,CAACN,aAAeA,WAAWV,EAAE,KAAKc,KAAKd,EAAE;QAE3C,IAAIe,SAASE,MAAM,KAAK,GAAG;YACzB;QACF;QACA,MAAMC,cAAc,MAAMC,gBAAgBL,KAAKM,mBAAmB;QAClE,IAAI,CAACF,aAAa;YAChB;QACF;QACA,KAAK,MAAM,EAAEjB,QAAQ,EAAE,IAAIc,SAAU;YACnC,KAAK,MAAMM,SAAS/B,uBAAuB4B,YAAYN,EAAE,EAAEX,UAAW;gBACpEW,GAAGU,GAAG,CAACD,MAAME,IAAI;YACnB;YACA,KAAK,MAAMF,SAAS/B,uBAAuB4B,YAAYL,EAAE,EAAEZ,UAAW;gBACpEY,GAAGS,GAAG,CAACD,MAAME,IAAI;YACnB;QACF;IACF;IAEA,OAAO;QAAEX;QAAIC;IAAG;AAClB,EAAE;AAEF;;;;CAIC,GACD,MAAMM,kBAAkB,OACtBK;IAEA,IAAI;QACF,MAAMC,SAAS,MAAM,MAAM,CAAC,GAAGD,YAAY,GAAG,CAAC;QAC/C,OAAOC,OAAOC,YAAY;IAC5B,EAAE,OAAM;QACN,OAAOC;IACT;AACF"}
+{"version":3,"sources":["../../../../../../packages/nx-plugin/src/utils/version-upgrade-migration/owned-dependencies.ts"],"sourcesContent":["/**\n * Copyright Amazon.com, Inc. or its affiliates. All Rights Reserved.\n * SPDX-License-Identifier: Apache-2.0\n */\nimport * as path from 'node:path';\nimport { getProjects, type Tree } from '@nx/devkit';\nimport { AWS_NX_PLUGIN_CONFIG_FILE_NAME } from '../config/utils';\nimport {\n  type DependencyDeclaration,\n  type DependencyMetadata,\n  ownedDependencyEntries,\n} from '../declared-dependencies';\nimport { buildGeneratorInfoList } from '../generators';\nimport {\n  PACKAGES_DIR,\n  SHARED_CONSTRUCTS_DIR,\n  SHARED_TERRAFORM_DIR,\n} from '../shared-constructs-constants';\n\n/** Directory holding `generators.json`, which maps ids to their modules. */\nexport const PLUGIN_ROOT = path.resolve(import.meta.dirname, '..', '..', '..');\n\n/**\n * Which vended dependencies this workspace's generators are responsible for.\n *\n * Only these are synced, so a package the user added themselves keeps the version\n * they chose. Ownership is derived from the generators the workspace has run and\n * the dependencies each declares — nothing extra is recorded in the workspace.\n */\nexport interface OwnedDependencies {\n  readonly ts: ReadonlySet<string>;\n  readonly py: ReadonlySet<string>;\n  /**\n   * The same, split by the root of the project that owns it, for scoping a pin\n   * embedded in a generated file to the project it sits in. Keyed by project\n   * root; read through {@link ownedForFile}.\n   */\n  readonly byProject: ReadonlyMap<\n    string,\n    { readonly ts: ReadonlySet<string>; readonly py: ReadonlySet<string> }\n  >;\n}\n\n/**\n * One recorded run of a generator, with the metadata it wrote.\n *\n * The metadata carries the values the generator's dependency conditions read, so\n * a declaration filters down to the branch this occurrence actually took.\n */\nexport interface GeneratorOccurrence {\n  readonly id: string;\n  readonly metadata: DependencyMetadata;\n  /** Root of the project this ran against, for scoping what it owns to it. */\n  readonly projectRoot?: string;\n}\n\n/**\n * Every recorded run of a generator in this workspace, from the metadata\n * generators record on the projects (and components) they create.\n *\n * A generator appears once per project or component it created, since each may\n * have been run with different options.\n *\n * `init` creates no project, so its config file stands in for it.\n */\nexport const generatorOccurrences = (\n  tree: Tree,\n): readonly GeneratorOccurrence[] => {\n  const occurrences: GeneratorOccurrence[] = [];\n  if (tree.exists(AWS_NX_PLUGIN_CONFIG_FILE_NAME)) {\n    occurrences.push({ id: 'init', metadata: {} });\n  }\n  for (const [, project] of getProjects(tree)) {\n    const metadata = project.metadata as\n      | {\n          generator?: string;\n          components?: ({ generator?: string } & DependencyMetadata)[];\n        }\n      | undefined;\n    if (metadata?.generator) {\n      const { components, ...ownMetadata } = metadata;\n      occurrences.push({\n        id: metadata.generator,\n        metadata: ownMetadata,\n        projectRoot: project.root,\n      });\n    }\n    for (const component of metadata?.components ?? []) {\n      if (component.generator) {\n        occurrences.push({\n          id: component.generator,\n          metadata: component,\n          projectRoot: project.root,\n        });\n      }\n    }\n  }\n  return occurrences;\n};\n\n/** Generator ids this workspace has run. */\nexport const generatorsRun = (tree: Tree): ReadonlySet<string> =>\n  new Set(generatorOccurrences(tree).map((occurrence) => occurrence.id));\n\n/**\n * Union of the dependencies declared by the generators this workspace has run,\n * narrowed per occurrence to those whose conditions its recorded metadata\n * satisfies — a project generated with one protocol does not own another's\n * packages.\n *\n * A `versionOnly` entry is owned like any other: it is declared precisely so the\n * sync keeps its pinned version current wherever the workspace already holds it.\n *\n * Each generator module exports its declaration, so reading one is an import\n * rather than a run — the generators themselves are never invoked.\n */\nexport const ownedDependencies = async (\n  tree: Tree,\n): Promise<OwnedDependencies> => {\n  const occurrences = generatorOccurrences(tree);\n  const ts = new Set<string>();\n  const py = new Set<string>();\n  const byProject = new Map<string, { ts: Set<string>; py: Set<string> }>();\n\n  for (const info of buildGeneratorInfoList(PLUGIN_ROOT)) {\n    const matching = occurrences.filter(\n      (occurrence) => occurrence.id === info.id,\n    );\n    if (matching.length === 0) {\n      continue;\n    }\n    const declaration = await readDeclaration(info.resolvedFactoryPath);\n    if (!declaration) {\n      continue;\n    }\n    for (const { metadata, projectRoot } of matching) {\n      const scoped = projectRoot\n        ? (byProject.get(projectRoot) ??\n          byProject\n            .set(projectRoot, { ts: new Set(), py: new Set() })\n            .get(projectRoot)!)\n        : undefined;\n      for (const entry of ownedDependencyEntries(declaration.ts, metadata)) {\n        ts.add(entry.name as string);\n        scoped?.ts.add(entry.name as string);\n      }\n      for (const entry of ownedDependencyEntries(declaration.py, metadata)) {\n        py.add(entry.name as string);\n        scoped?.py.add(entry.name as string);\n      }\n    }\n  }\n\n  return { ts, py, byProject };\n};\n\n/**\n * Roots of the projects every generator contributes into, rather than one\n * generator owning outright.\n *\n * `sharedConstructsGenerator` creates these and each infra generator writes its\n * own module into them — the Terraform modules carrying the `uv run --with` pins\n * come from the agent-core, api, identity and website helpers alike. Both are\n * registered projects, so scoping a file here to the generator that created the\n * project would strand every pin the others put there.\n */\nconst SHARED_PROJECT_ROOTS = [\n  `${PACKAGES_DIR}/${SHARED_CONSTRUCTS_DIR}`,\n  `${PACKAGES_DIR}/${SHARED_TERRAFORM_DIR}`,\n];\n\n/**\n * The dependencies owned where a file sits: those of the project it belongs to,\n * or the workspace-wide union for a file in a shared project or under none.\n *\n * Used for the pins embedded in a generated file, so a version is only rewritten\n * where the generator that pins it actually ran: a `Dockerfile` under one\n * project's root is not upgraded because a sibling project owns the package.\n *\n * The longest matching root wins, since a nested project's root is a prefix of\n * nothing else but its own files.\n */\nexport const ownedForFile = (\n  owned: OwnedDependencies,\n  filePath: string,\n): { ts: ReadonlySet<string>; py: ReadonlySet<string> } => {\n  if (\n    SHARED_PROJECT_ROOTS.some(\n      (root) => filePath === root || filePath.startsWith(`${root}/`),\n    )\n  ) {\n    return owned;\n  }\n  let best: { ts: ReadonlySet<string>; py: ReadonlySet<string> } | undefined;\n  let bestLength = -1;\n  for (const [root, scoped] of owned.byProject) {\n    if (\n      (filePath === root || filePath.startsWith(`${root}/`)) &&\n      root.length > bestLength\n    ) {\n      best = scoped;\n      bestLength = root.length;\n    }\n  }\n  return best ?? owned;\n};\n\n/**\n * A generator's `DEPENDENCIES`, or undefined when it declares none.\n * A generator that fails to load must not fail the upgrade, so its dependencies\n * are treated as unowned and left as they are.\n */\nconst readDeclaration = async (\n  factoryPath: string,\n): Promise<DependencyDeclaration | undefined> => {\n  try {\n    const module = await import(`${factoryPath}.js`);\n    return module.DEPENDENCIES;\n  } catch {\n    return undefined;\n  }\n};\n"],"names":["path","getProjects","AWS_NX_PLUGIN_CONFIG_FILE_NAME","ownedDependencyEntries","buildGeneratorInfoList","PACKAGES_DIR","SHARED_CONSTRUCTS_DIR","SHARED_TERRAFORM_DIR","PLUGIN_ROOT","resolve","dirname","generatorOccurrences","tree","occurrences","exists","push","id","metadata","project","generator","components","ownMetadata","projectRoot","root","component","generatorsRun","Set","map","occurrence","ownedDependencies","ts","py","byProject","Map","info","matching","filter","length","declaration","readDeclaration","resolvedFactoryPath","scoped","get","set","undefined","entry","add","name","SHARED_PROJECT_ROOTS","ownedForFile","owned","filePath","some","startsWith","best","bestLength","factoryPath","module","DEPENDENCIES"],"mappings":"AAAA;;;CAGC,GACD,YAAYA,UAAU,YAAY;AAClC,SAASC,WAAW,QAAmB,aAAa;AACpD,SAASC,8BAA8B,QAAQ,qBAAkB;AACjE,SAGEC,sBAAsB,QACjB,8BAA2B;AAClC,SAASC,sBAAsB,QAAQ,mBAAgB;AACvD,SACEC,YAAY,EACZC,qBAAqB,EACrBC,oBAAoB,QACf,oCAAiC;AAExC,0EAA0E,GAC1E,OAAO,MAAMC,cAAcR,KAAKS,OAAO,CAAC,YAAYC,OAAO,EAAE,MAAM,MAAM,MAAM;AAoC/E;;;;;;;;CAQC,GACD,OAAO,MAAMC,uBAAuB,CAClCC;IAEA,MAAMC,cAAqC,EAAE;IAC7C,IAAID,KAAKE,MAAM,CAACZ,iCAAiC;QAC/CW,YAAYE,IAAI,CAAC;YAAEC,IAAI;YAAQC,UAAU,CAAC;QAAE;IAC9C;IACA,KAAK,MAAM,GAAGC,QAAQ,IAAIjB,YAAYW,MAAO;QAC3C,MAAMK,WAAWC,QAAQD,QAAQ;QAMjC,IAAIA,UAAUE,WAAW;YACvB,MAAM,EAAEC,UAAU,EAAE,GAAGC,aAAa,GAAGJ;YACvCJ,YAAYE,IAAI,CAAC;gBACfC,IAAIC,SAASE,SAAS;gBACtBF,UAAUI;gBACVC,aAAaJ,QAAQK,IAAI;YAC3B;QACF;QACA,KAAK,MAAMC,aAAaP,UAAUG,cAAc,EAAE,CAAE;YAClD,IAAII,UAAUL,SAAS,EAAE;gBACvBN,YAAYE,IAAI,CAAC;oBACfC,IAAIQ,UAAUL,SAAS;oBACvBF,UAAUO;oBACVF,aAAaJ,QAAQK,IAAI;gBAC3B;YACF;QACF;IACF;IACA,OAAOV;AACT,EAAE;AAEF,0CAA0C,GAC1C,OAAO,MAAMY,gBAAgB,CAACb,OAC5B,IAAIc,IAAIf,qBAAqBC,MAAMe,GAAG,CAAC,CAACC,aAAeA,WAAWZ,EAAE,GAAG;AAEzE;;;;;;;;;;;CAWC,GACD,OAAO,MAAMa,oBAAoB,OAC/BjB;IAEA,MAAMC,cAAcF,qBAAqBC;IACzC,MAAMkB,KAAK,IAAIJ;IACf,MAAMK,KAAK,IAAIL;IACf,MAAMM,YAAY,IAAIC;IAEtB,KAAK,MAAMC,QAAQ9B,uBAAuBI,aAAc;QACtD,MAAM2B,WAAWtB,YAAYuB,MAAM,CACjC,CAACR,aAAeA,WAAWZ,EAAE,KAAKkB,KAAKlB,EAAE;QAE3C,IAAImB,SAASE,MAAM,KAAK,GAAG;YACzB;QACF;QACA,MAAMC,cAAc,MAAMC,gBAAgBL,KAAKM,mBAAmB;QAClE,IAAI,CAACF,aAAa;YAChB;QACF;QACA,KAAK,MAAM,EAAErB,QAAQ,EAAEK,WAAW,EAAE,IAAIa,SAAU;YAChD,MAAMM,SAASnB,cACVU,UAAUU,GAAG,CAACpB,gBACfU,UACGW,GAAG,CAACrB,aAAa;gBAAEQ,IAAI,IAAIJ;gBAAOK,IAAI,IAAIL;YAAM,GAChDgB,GAAG,CAACpB,eACPsB;YACJ,KAAK,MAAMC,SAAS1C,uBAAuBmC,YAAYR,EAAE,EAAEb,UAAW;gBACpEa,GAAGgB,GAAG,CAACD,MAAME,IAAI;gBACjBN,QAAQX,GAAGgB,IAAID,MAAME,IAAI;YAC3B;YACA,KAAK,MAAMF,SAAS1C,uBAAuBmC,YAAYP,EAAE,EAAEd,UAAW;gBACpEc,GAAGe,GAAG,CAACD,MAAME,IAAI;gBACjBN,QAAQV,GAAGe,IAAID,MAAME,IAAI;YAC3B;QACF;IACF;IAEA,OAAO;QAAEjB;QAAIC;QAAIC;IAAU;AAC7B,EAAE;AAEF;;;;;;;;;CASC,GACD,MAAMgB,uBAAuB;IAC3B,GAAG3C,aAAa,CAAC,EAAEC,uBAAuB;IAC1C,GAAGD,aAAa,CAAC,EAAEE,sBAAsB;CAC1C;AAED;;;;;;;;;;CAUC,GACD,OAAO,MAAM0C,eAAe,CAC1BC,OACAC;IAEA,IACEH,qBAAqBI,IAAI,CACvB,CAAC7B,OAAS4B,aAAa5B,QAAQ4B,SAASE,UAAU,CAAC,GAAG9B,KAAK,CAAC,CAAC,IAE/D;QACA,OAAO2B;IACT;IACA,IAAII;IACJ,IAAIC,aAAa,CAAC;IAClB,KAAK,MAAM,CAAChC,MAAMkB,OAAO,IAAIS,MAAMlB,SAAS,CAAE;QAC5C,IACE,AAACmB,CAAAA,aAAa5B,QAAQ4B,SAASE,UAAU,CAAC,GAAG9B,KAAK,CAAC,CAAC,CAAA,KACpDA,KAAKc,MAAM,GAAGkB,YACd;YACAD,OAAOb;YACPc,aAAahC,KAAKc,MAAM;QAC1B;IACF;IACA,OAAOiB,QAAQJ;AACjB,EAAE;AAEF;;;;CAIC,GACD,MAAMX,kBAAkB,OACtBiB;IAEA,IAAI;QACF,MAAMC,SAAS,MAAM,MAAM,CAAC,GAAGD,YAAY,GAAG,CAAC;QAC/C,OAAOC,OAAOC,YAAY;IAC5B,EAAE,OAAM;QACN,OAAOd;IACT;AACF"}

package/src/utils/version-upgrade-migration/register.d.ts

@@ -4,9 +4,11 @@
  */
 import { type Tree } from '@nx/devkit';
 /**
- * Register the nx bump a version update needs, in `migrations.json`. Call only
- * when an nx package actually moved.
+ * Register the nx bump a version update needs, in `packageJsonUpdates.json`. Call
+ * only when an nx package actually moved.
  *
+ * The bumps live in their own committed file, assembled into `migrations.json`
+ * at build time, so this weekly-bot edit never conflicts with a migration PR.
  * The version sync migration itself is a committed `everyMigration` entry, so
  * only the nx packages need registering per update: they go through
  * `packageJsonUpdates` rather than a migration (see `nx-package-updates.ts`).
@@ -18,6 +20,10 @@ import { type Tree } from '@nx/devkit';
  *
  * Idempotent: re-running before a release replaces the pending entry with itself.
  *
+ * @param nxVersion nx version being moved to. The update script rewrites
+ *   `versions.ts` on the tree, which cannot change the `NX_VERSION` this process
+ *   imported at load — so the caller passes the version it just wrote, or the
+ *   entry would record the one being replaced.
  * @returns paths written, for the update report
  */
-export declare const registerNxPackageUpdates: (tree: Tree) => string[];
+export declare const registerNxPackageUpdates: (tree: Tree, nxVersion?: string) => string[];

package/src/utils/version-upgrade-migration/register.js

@@ -1,14 +1,16 @@
 /**
  * Copyright Amazon.com, Inc. or its affiliates. All Rights Reserved.
  * SPDX-License-Identifier: Apache-2.0
- */ import { updateJson } from "@nx/devkit";
+ */ import { writeJson } from "@nx/devkit";
 import { LATEST_MIGRATIONS_DIR } from "../migration-versions.js";
 import { nxPackageJsonUpdates } from "./nx-package-updates.js";
-const MIGRATIONS_JSON_PATH = 'packages/nx-plugin/migrations.json';
+const PACKAGE_JSON_UPDATES_PATH = 'packages/nx-plugin/packageJsonUpdates.json';
 /**
- * Register the nx bump a version update needs, in `migrations.json`. Call only
- * when an nx package actually moved.
+ * Register the nx bump a version update needs, in `packageJsonUpdates.json`. Call
+ * only when an nx package actually moved.
  *
+ * The bumps live in their own committed file, assembled into `migrations.json`
+ * at build time, so this weekly-bot edit never conflicts with a migration PR.
  * The version sync migration itself is a committed `everyMigration` entry, so
  * only the nx packages need registering per update: they go through
  * `packageJsonUpdates` rather than a migration (see `nx-package-updates.ts`).
@@ -20,18 +22,20 @@ const MIGRATIONS_JSON_PATH = 'packages/nx-plugin/migrations.json';
  *
  * Idempotent: re-running before a release replaces the pending entry with itself.
  *
+ * @param nxVersion nx version being moved to. The update script rewrites
+ *   `versions.ts` on the tree, which cannot change the `NX_VERSION` this process
+ *   imported at load — so the caller passes the version it just wrote, or the
+ *   entry would record the one being replaced.
  * @returns paths written, for the update report
- */ export const registerNxPackageUpdates = (tree)=>{
-    updateJson(tree, MIGRATIONS_JSON_PATH, (migrations)=>({
-            ...migrations,
-            // Recorded under `latest` until stamping resolves the version it ships with.
-            packageJsonUpdates: {
-                ...Object.fromEntries(Object.entries(migrations.packageJsonUpdates ?? {}).filter(([, entry])=>entry.version !== LATEST_MIGRATIONS_DIR)),
-                ...nxPackageJsonUpdates(LATEST_MIGRATIONS_DIR)
-            }
-        }));
+ */ export const registerNxPackageUpdates = (tree, nxVersion)=>{
+    const existing = tree.exists(PACKAGE_JSON_UPDATES_PATH) ? JSON.parse(tree.read(PACKAGE_JSON_UPDATES_PATH, 'utf-8')) : {};
+    writeJson(tree, PACKAGE_JSON_UPDATES_PATH, {
+        // Recorded under `latest` until stamping resolves the version it ships with.
+        ...Object.fromEntries(Object.entries(existing).filter(([, entry])=>entry.version !== LATEST_MIGRATIONS_DIR)),
+        ...nxPackageJsonUpdates(LATEST_MIGRATIONS_DIR, nxVersion)
+    });
     return [
-        MIGRATIONS_JSON_PATH
+        PACKAGE_JSON_UPDATES_PATH
     ];
 };
 

package/src/utils/version-upgrade-migration/register.js.map

@@ -1 +1 @@
-{"version":3,"sources":["../../../../../../packages/nx-plugin/src/utils/version-upgrade-migration/register.ts"],"sourcesContent":["/**\n * Copyright Amazon.com, Inc. or its affiliates. All Rights Reserved.\n * SPDX-License-Identifier: Apache-2.0\n */\nimport { type Tree, updateJson } from '@nx/devkit';\nimport {\n  LATEST_MIGRATIONS_DIR,\n  type MigrationsJson,\n} from '../migration-versions';\nimport { nxPackageJsonUpdates } from './nx-package-updates';\n\nconst MIGRATIONS_JSON_PATH = 'packages/nx-plugin/migrations.json';\n\n/**\n * Register the nx bump a version update needs, in `migrations.json`. Call only\n * when an nx package actually moved.\n *\n * The version sync migration itself is a committed `everyMigration` entry, so\n * only the nx packages need registering per update: they go through\n * `packageJsonUpdates` rather than a migration (see `nx-package-updates.ts`).\n *\n * A bump already dated by a release stays — a workspace several releases behind\n * needs each hop in turn. One still waiting for a release is dropped: this bump\n * supersedes it, and both would otherwise ship under the same version, leaving\n * which nx a workspace lands on down to the order nx happens to apply them in.\n *\n * Idempotent: re-running before a release replaces the pending entry with itself.\n *\n * @returns paths written, for the update report\n */\nexport const registerNxPackageUpdates = (tree: Tree): string[] => {\n  updateJson<MigrationsJson>(tree, MIGRATIONS_JSON_PATH, (migrations) => ({\n    ...migrations,\n    // Recorded under `latest` until stamping resolves the version it ships with.\n    packageJsonUpdates: {\n      ...Object.fromEntries(\n        Object.entries(migrations.packageJsonUpdates ?? {}).filter(\n          ([, entry]) => entry.version !== LATEST_MIGRATIONS_DIR,\n        ),\n      ),\n      ...nxPackageJsonUpdates(LATEST_MIGRATIONS_DIR),\n    },\n  }));\n\n  return [MIGRATIONS_JSON_PATH];\n};\n"],"names":["updateJson","LATEST_MIGRATIONS_DIR","nxPackageJsonUpdates","MIGRATIONS_JSON_PATH","registerNxPackageUpdates","tree","migrations","packageJsonUpdates","Object","fromEntries","entries","filter","entry","version"],"mappings":"AAAA;;;CAGC,GACD,SAAoBA,UAAU,QAAQ,aAAa;AACnD,SACEC,qBAAqB,QAEhB,2BAAwB;AAC/B,SAASC,oBAAoB,QAAQ,0BAAuB;AAE5D,MAAMC,uBAAuB;AAE7B;;;;;;;;;;;;;;;;CAgBC,GACD,OAAO,MAAMC,2BAA2B,CAACC;IACvCL,WAA2BK,MAAMF,sBAAsB,CAACG,aAAgB,CAAA;YACtE,GAAGA,UAAU;YACb,6EAA6E;YAC7EC,oBAAoB;gBAClB,GAAGC,OAAOC,WAAW,CACnBD,OAAOE,OAAO,CAACJ,WAAWC,kBAAkB,IAAI,CAAC,GAAGI,MAAM,CACxD,CAAC,GAAGC,MAAM,GAAKA,MAAMC,OAAO,KAAKZ,uBAEpC;gBACD,GAAGC,qBAAqBD,sBAAsB;YAChD;QACF,CAAA;IAEA,OAAO;QAACE;KAAqB;AAC/B,EAAE"}
+{"version":3,"sources":["../../../../../../packages/nx-plugin/src/utils/version-upgrade-migration/register.ts"],"sourcesContent":["/**\n * Copyright Amazon.com, Inc. or its affiliates. All Rights Reserved.\n * SPDX-License-Identifier: Apache-2.0\n */\nimport { type Tree, writeJson } from '@nx/devkit';\nimport { LATEST_MIGRATIONS_DIR } from '../migration-versions';\nimport {\n  nxPackageJsonUpdates,\n  type PackageJsonUpdates,\n} from './nx-package-updates';\n\nconst PACKAGE_JSON_UPDATES_PATH = 'packages/nx-plugin/packageJsonUpdates.json';\n\n/**\n * Register the nx bump a version update needs, in `packageJsonUpdates.json`. Call\n * only when an nx package actually moved.\n *\n * The bumps live in their own committed file, assembled into `migrations.json`\n * at build time, so this weekly-bot edit never conflicts with a migration PR.\n * The version sync migration itself is a committed `everyMigration` entry, so\n * only the nx packages need registering per update: they go through\n * `packageJsonUpdates` rather than a migration (see `nx-package-updates.ts`).\n *\n * A bump already dated by a release stays — a workspace several releases behind\n * needs each hop in turn. One still waiting for a release is dropped: this bump\n * supersedes it, and both would otherwise ship under the same version, leaving\n * which nx a workspace lands on down to the order nx happens to apply them in.\n *\n * Idempotent: re-running before a release replaces the pending entry with itself.\n *\n * @param nxVersion nx version being moved to. The update script rewrites\n *   `versions.ts` on the tree, which cannot change the `NX_VERSION` this process\n *   imported at load — so the caller passes the version it just wrote, or the\n *   entry would record the one being replaced.\n * @returns paths written, for the update report\n */\nexport const registerNxPackageUpdates = (\n  tree: Tree,\n  nxVersion?: string,\n): string[] => {\n  const existing: PackageJsonUpdates = tree.exists(PACKAGE_JSON_UPDATES_PATH)\n    ? JSON.parse(tree.read(PACKAGE_JSON_UPDATES_PATH, 'utf-8'))\n    : {};\n\n  writeJson(tree, PACKAGE_JSON_UPDATES_PATH, {\n    // Recorded under `latest` until stamping resolves the version it ships with.\n    ...Object.fromEntries(\n      Object.entries(existing).filter(\n        ([, entry]) => entry.version !== LATEST_MIGRATIONS_DIR,\n      ),\n    ),\n    ...nxPackageJsonUpdates(LATEST_MIGRATIONS_DIR, nxVersion),\n  });\n\n  return [PACKAGE_JSON_UPDATES_PATH];\n};\n"],"names":["writeJson","LATEST_MIGRATIONS_DIR","nxPackageJsonUpdates","PACKAGE_JSON_UPDATES_PATH","registerNxPackageUpdates","tree","nxVersion","existing","exists","JSON","parse","read","Object","fromEntries","entries","filter","entry","version"],"mappings":"AAAA;;;CAGC,GACD,SAAoBA,SAAS,QAAQ,aAAa;AAClD,SAASC,qBAAqB,QAAQ,2BAAwB;AAC9D,SACEC,oBAAoB,QAEf,0BAAuB;AAE9B,MAAMC,4BAA4B;AAElC;;;;;;;;;;;;;;;;;;;;;;CAsBC,GACD,OAAO,MAAMC,2BAA2B,CACtCC,MACAC;IAEA,MAAMC,WAA+BF,KAAKG,MAAM,CAACL,6BAC7CM,KAAKC,KAAK,CAACL,KAAKM,IAAI,CAACR,2BAA2B,YAChD,CAAC;IAELH,UAAUK,MAAMF,2BAA2B;QACzC,6EAA6E;QAC7E,GAAGS,OAAOC,WAAW,CACnBD,OAAOE,OAAO,CAACP,UAAUQ,MAAM,CAC7B,CAAC,GAAGC,MAAM,GAAKA,MAAMC,OAAO,KAAKhB,uBAEpC;QACD,GAAGC,qBAAqBD,uBAAuBK,UAAU;IAC3D;IAEA,OAAO;QAACH;KAA0B;AACpC,EAAE"}

package/src/utils/version-upgrade-migration/sync-embedded-versions.d.ts

@@ -0,0 +1,26 @@
+/**
+ * Copyright Amazon.com, Inc. or its affiliates. All Rights Reserved.
+ * SPDX-License-Identifier: Apache-2.0
+ */
+import type { Tree } from '@nx/devkit';
+import { type OwnedDependencies } from './owned-dependencies';
+/**
+ * Whether a file is a Dockerfile: exactly `Dockerfile`, or the `<name>.Dockerfile`
+ * form the smithy templates vend as `build.Dockerfile`.
+ *
+ * Deliberately exact rather than a prefix match, which would also claim a
+ * `Dockerfile.bak` or a `Dockerfile.md` the user keeps beside a real one.
+ */
+export declare const isDockerfile: (filePath: string) => boolean;
+/**
+ * Sync the vended versions baked into generated file bodies: `Dockerfile` pins,
+ * the Python pins in Terraform inline scripts, and the tooling images
+ * `project.json` target commands run.
+ *
+ * Reports only the files left for the user: a pin that takes effect the next time
+ * the thing holding it runs needs no follow-up, but one this skipped for holding
+ * more occurrences than it will rewrite at once does.
+ *
+ * @returns paths whose pins were left as they were
+ */
+export declare const syncEmbeddedVersions: (tree: Tree, owned: OwnedDependencies) => Promise<string[]>;