@aws/nx-plugin 1.0.0-rc.6 → 1.0.0-rc.60

package/src/migrations/latest/smithy-ssdk-bundle-pins/migration.js

@@ -0,0 +1,78 @@
+/**
+ * Copyright Amazon.com, Inc. or its affiliates. All Rights Reserved.
+ * SPDX-License-Identifier: Apache-2.0
+ */ import { getProjects, joinPathFragments } from "@nx/devkit";
+import { SMITHY_PROJECT_GENERATOR_INFO } from "../../../smithy/project/generator.js";
+import { applyGritQL } from "../../../utils/ast.js";
+import { formatFilesInSubtree } from "../../../utils/format.js";
+import { isVendedUpgrade } from "../../../utils/version-upgrade-migration/vended-upgrade.js";
+/**
+ * Hardcoded rather than read from `TS_VERSIONS`: this runs once, for the release
+ * that fixed the declaration naming, so it must keep applying that exact change
+ * however far the vended versions move afterwards. A workspace on a later release
+ * gets the newer pins from the version sync instead.
+ */ const PINS = [
+    {
+        name: 'rolldown',
+        target: '1.2.0'
+    },
+    {
+        name: 'rolldown-plugin-dts',
+        target: '0.28.0'
+    },
+    {
+        name: '@rollup/plugin-esm-shim',
+        target: '0.1.8'
+    }
+];
+/** A version ends at whitespace, a line break or the end of the command. */ const VERSION = String.raw`[^\s\\]+`;
+const escapeRegExp = (value)=>value.replace(/[.*+?^${}()|[\]\\]/g, '\\$&');
+/**
+ * Rewrite every occurrence of one pin to its target version.
+ *
+ * The pin is matched by name, so a `rolldown-plugin-dts@x` in the same command as
+ * `rolldown@y` keeps its own version — the `@` before the version terminates the
+ * match, so the shorter name does not match the longer one.
+ */ const rewritePin = ({ name, target })=>`r"[\\s\\S]*${escapeRegExp(name)}@(${VERSION})[\\s\\S]*"($version) where { $version => \`${target}\` }`;
+/** Whether the file pins this package behind the target version. */ const isBehindTarget = (contents, { name, target })=>{
+    const matches = contents.matchAll(new RegExp(`${escapeRegExp(name)}@(${VERSION})`, 'g'));
+    const declared = [
+        ...matches
+    ].flatMap((match)=>match[1] ? [
+            match[1]
+        ] : []);
+    // A rewrite replaces every occurrence at once, so this has to hold for all of
+    // them. Compared rather than tested for inequality, so a workspace a later
+    // release has already moved past the target keeps its newer pin.
+    return declared.length > 0 && declared.every((version)=>isVendedUpgrade(target, version));
+};
+const divergedNextStep = (path)=>`${path}: the Smithy build image's bundle pins have diverged from the generated shape - left untouched. Update \`rolldown\` to 1.2.0 and \`rolldown-plugin-dts\` to 0.28.0.`;
+export default async function migration(tree) {
+    const nextSteps = [];
+    // Only a Smithy service project bundles the SSDK; the shapes type builds the
+    // model alone and pins none of this.
+    const buildDockerfiles = [
+        ...getProjects(tree).values()
+    ].filter((project)=>{
+        const metadata = project.metadata;
+        return metadata?.generator === SMITHY_PROJECT_GENERATOR_INFO.id && metadata.smithyType === 'service';
+    }).map((project)=>joinPathFragments(project.root, 'build.Dockerfile')).filter((filePath)=>tree.exists(filePath));
+    for (const path of buildDockerfiles){
+        const contents = tree.read(path, 'utf-8') ?? '';
+        for (const pin of PINS){
+            if (!isBehindTarget(contents, pin)) {
+                continue;
+            }
+            if (!await applyGritQL(tree, path, rewritePin(pin))) {
+                nextSteps.push(divergedNextStep(path));
+                break;
+            }
+        }
+    }
+    await formatFilesInSubtree(tree);
+    return {
+        nextSteps
+    };
+}
+
+//# sourceMappingURL=migration.js.map

package/src/migrations/latest/smithy-ssdk-bundle-pins/migration.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../../../../../../../packages/nx-plugin/src/migrations/latest/smithy-ssdk-bundle-pins/migration.ts"],"sourcesContent":["/**\n * Copyright Amazon.com, Inc. or its affiliates. All Rights Reserved.\n * SPDX-License-Identifier: Apache-2.0\n */\nimport {\n  getProjects,\n  joinPathFragments,\n  type MigrationReturnObject,\n  type Tree,\n} from '@nx/devkit';\nimport { SMITHY_PROJECT_GENERATOR_INFO } from '../../../smithy/project/generator';\nimport { applyGritQL } from '../../../utils/ast';\nimport { formatFilesInSubtree } from '../../../utils/format';\nimport { isVendedUpgrade } from '../../../utils/version-upgrade-migration/vended-upgrade';\n\n/**\n * Move a Smithy `build.Dockerfile` onto the SSDK bundle pins this release fixes.\n *\n * `rolldown-plugin-dts` named the bundled declaration after its content hash\n * before 0.20.0, so the generated handler's `./generated/ssdk/index.js` import\n * found no `index.d.ts` beside it and `compile` failed with TS7016. The two pins\n * move together: the plugin release that fixed the naming needs a rolldown past\n * the pin this shipped with.\n *\n * There is no Dockerfile grammar, so each pin is matched as an anchored rewrite\n * over the whole file with the version captured — `${...}` in these patterns is\n * GritQL metavariable syntax, not interpolation.\n */\n\n/** A pin in the file body, and the version this migration moves it to. */\ninterface Pin {\n  /** The package as the install command names it. */\n  readonly name: string;\n  readonly target: string;\n}\n\n/**\n * Hardcoded rather than read from `TS_VERSIONS`: this runs once, for the release\n * that fixed the declaration naming, so it must keep applying that exact change\n * however far the vended versions move afterwards. A workspace on a later release\n * gets the newer pins from the version sync instead.\n */\nconst PINS: readonly Pin[] = [\n  { name: 'rolldown', target: '1.2.0' },\n  { name: 'rolldown-plugin-dts', target: '0.28.0' },\n  { name: '@rollup/plugin-esm-shim', target: '0.1.8' },\n];\n\n/** A version ends at whitespace, a line break or the end of the command. */\nconst VERSION = String.raw`[^\\s\\\\]+`;\n\nconst escapeRegExp = (value: string): string =>\n  value.replace(/[.*+?^${}()|[\\]\\\\]/g, '\\\\$&');\n\n/**\n * Rewrite every occurrence of one pin to its target version.\n *\n * The pin is matched by name, so a `rolldown-plugin-dts@x` in the same command as\n * `rolldown@y` keeps its own version — the `@` before the version terminates the\n * match, so the shorter name does not match the longer one.\n */\nconst rewritePin = ({ name, target }: Pin): string =>\n  `r\"[\\\\s\\\\S]*${escapeRegExp(name)}@(${VERSION})[\\\\s\\\\S]*\"($version) where { $version => \\`${target}\\` }`;\n\n/** Whether the file pins this package behind the target version. */\nconst isBehindTarget = (contents: string, { name, target }: Pin): boolean => {\n  const matches = contents.matchAll(\n    new RegExp(`${escapeRegExp(name)}@(${VERSION})`, 'g'),\n  );\n  const declared = [...matches].flatMap((match) =>\n    match[1] ? [match[1]] : [],\n  );\n  // A rewrite replaces every occurrence at once, so this has to hold for all of\n  // them. Compared rather than tested for inequality, so a workspace a later\n  // release has already moved past the target keeps its newer pin.\n  return (\n    declared.length > 0 &&\n    declared.every((version) => isVendedUpgrade(target, version))\n  );\n};\n\nconst divergedNextStep = (path: string): string =>\n  `${path}: the Smithy build image's bundle pins have diverged from the generated shape - left untouched. Update \\`rolldown\\` to 1.2.0 and \\`rolldown-plugin-dts\\` to 0.28.0.`;\n\nexport default async function migration(\n  tree: Tree,\n): Promise<MigrationReturnObject> {\n  const nextSteps: string[] = [];\n\n  // Only a Smithy service project bundles the SSDK; the shapes type builds the\n  // model alone and pins none of this.\n  const buildDockerfiles = [...getProjects(tree).values()]\n    .filter((project) => {\n      const metadata = project.metadata as\n        | { generator?: string; smithyType?: string }\n        | undefined;\n      return (\n        metadata?.generator === SMITHY_PROJECT_GENERATOR_INFO.id &&\n        metadata.smithyType === 'service'\n      );\n    })\n    .map((project) => joinPathFragments(project.root, 'build.Dockerfile'))\n    .filter((filePath) => tree.exists(filePath));\n\n  for (const path of buildDockerfiles) {\n    const contents = tree.read(path, 'utf-8') ?? '';\n\n    for (const pin of PINS) {\n      if (!isBehindTarget(contents, pin)) {\n        continue;\n      }\n      if (!(await applyGritQL(tree, path, rewritePin(pin)))) {\n        nextSteps.push(divergedNextStep(path));\n        break;\n      }\n    }\n  }\n\n  await formatFilesInSubtree(tree);\n\n  return { nextSteps };\n}\n"],"names":["getProjects","joinPathFragments","SMITHY_PROJECT_GENERATOR_INFO","applyGritQL","formatFilesInSubtree","isVendedUpgrade","PINS","name","target","VERSION","String","raw","escapeRegExp","value","replace","rewritePin","isBehindTarget","contents","matches","matchAll","RegExp","declared","flatMap","match","length","every","version","divergedNextStep","path","migration","tree","nextSteps","buildDockerfiles","values","filter","project","metadata","generator","id","smithyType","map","root","filePath","exists","read","pin","push"],"mappings":"AAAA;;;CAGC,GACD,SACEA,WAAW,EACXC,iBAAiB,QAGZ,aAAa;AACpB,SAASC,6BAA6B,QAAQ,uCAAoC;AAClF,SAASC,WAAW,QAAQ,wBAAqB;AACjD,SAASC,oBAAoB,QAAQ,2BAAwB;AAC7D,SAASC,eAAe,QAAQ,6DAA0D;AAuB1F;;;;;CAKC,GACD,MAAMC,OAAuB;IAC3B;QAAEC,MAAM;QAAYC,QAAQ;IAAQ;IACpC;QAAED,MAAM;QAAuBC,QAAQ;IAAS;IAChD;QAAED,MAAM;QAA2BC,QAAQ;IAAQ;CACpD;AAED,0EAA0E,GAC1E,MAAMC,UAAUC,OAAOC,GAAG,CAAC,QAAQ,CAAC;AAEpC,MAAMC,eAAe,CAACC,QACpBA,MAAMC,OAAO,CAAC,uBAAuB;AAEvC;;;;;;CAMC,GACD,MAAMC,aAAa,CAAC,EAAER,IAAI,EAAEC,MAAM,EAAO,GACvC,CAAC,WAAW,EAAEI,aAAaL,MAAM,EAAE,EAAEE,QAAQ,4CAA4C,EAAED,OAAO,IAAI,CAAC;AAEzG,kEAAkE,GAClE,MAAMQ,iBAAiB,CAACC,UAAkB,EAAEV,IAAI,EAAEC,MAAM,EAAO;IAC7D,MAAMU,UAAUD,SAASE,QAAQ,CAC/B,IAAIC,OAAO,GAAGR,aAAaL,MAAM,EAAE,EAAEE,QAAQ,CAAC,CAAC,EAAE;IAEnD,MAAMY,WAAW;WAAIH;KAAQ,CAACI,OAAO,CAAC,CAACC,QACrCA,KAAK,CAAC,EAAE,GAAG;YAACA,KAAK,CAAC,EAAE;SAAC,GAAG,EAAE;IAE5B,8EAA8E;IAC9E,2EAA2E;IAC3E,iEAAiE;IACjE,OACEF,SAASG,MAAM,GAAG,KAClBH,SAASI,KAAK,CAAC,CAACC,UAAYrB,gBAAgBG,QAAQkB;AAExD;AAEA,MAAMC,mBAAmB,CAACC,OACxB,GAAGA,KAAK,mKAAmK,CAAC;AAE9K,eAAe,eAAeC,UAC5BC,IAAU;IAEV,MAAMC,YAAsB,EAAE;IAE9B,6EAA6E;IAC7E,qCAAqC;IACrC,MAAMC,mBAAmB;WAAIhC,YAAY8B,MAAMG,MAAM;KAAG,CACrDC,MAAM,CAAC,CAACC;QACP,MAAMC,WAAWD,QAAQC,QAAQ;QAGjC,OACEA,UAAUC,cAAcnC,8BAA8BoC,EAAE,IACxDF,SAASG,UAAU,KAAK;IAE5B,GACCC,GAAG,CAAC,CAACL,UAAYlC,kBAAkBkC,QAAQM,IAAI,EAAE,qBACjDP,MAAM,CAAC,CAACQ,WAAaZ,KAAKa,MAAM,CAACD;IAEpC,KAAK,MAAMd,QAAQI,iBAAkB;QACnC,MAAMf,WAAWa,KAAKc,IAAI,CAAChB,MAAM,YAAY;QAE7C,KAAK,MAAMiB,OAAOvC,KAAM;YACtB,IAAI,CAACU,eAAeC,UAAU4B,MAAM;gBAClC;YACF;YACA,IAAI,CAAE,MAAM1C,YAAY2B,MAAMF,MAAMb,WAAW8B,OAAQ;gBACrDd,UAAUe,IAAI,CAACnB,iBAAiBC;gBAChC;YACF;QACF;IACF;IAEA,MAAMxB,qBAAqB0B;IAE3B,OAAO;QAAEC;IAAU;AACrB"}

package/src/migrations/latest/strip-pip-from-python-images/__snapshots__/migration.spec.ts.snap

@@ -0,0 +1,48 @@
+// Vitest Snapshot v1, https://vitest.dev/guide/snapshot.html
+
+exports[`strip-pip-from-python-images migration > strips pip from a py#agent Dockerfile 1`] = `
+"FROM public.ecr.aws/docker/library/python:3.14-slim
+
+# Remove the base image's pip: the runtime runs from the bundled environment and
+# never needs it, and pip's vendored packages carry known HIGH/CRITICAL
+# vulnerabilities flagged by the image scan.
+RUN python -m pip uninstall -y pip && \\
+    rm -rf /usr/local/lib/python*/site-packages/pip \\
+           /usr/local/lib/python*/site-packages/pip-*.dist-info
+
+WORKDIR /app
+
+# Copy bundled package
+COPY . /app
+
+EXPOSE 8080
+
+ENV PYTHONPATH=/app
+ENV PATH="/app/bin:\${PATH}"
+
+CMD ["python", "bin/opentelemetry-instrument", "python", "-m", "proj_py_project.my_agent.main"]
+"
+`;
+
+exports[`strip-pip-from-python-images migration > strips pip from a py#mcp-server Dockerfile 1`] = `
+"FROM public.ecr.aws/docker/library/python:3.14-slim
+
+# Remove the base image's pip: the runtime runs from the bundled environment and
+# never needs it, and pip's vendored packages carry known HIGH/CRITICAL
+# vulnerabilities flagged by the image scan.
+RUN python -m pip uninstall -y pip && \\
+    rm -rf /usr/local/lib/python*/site-packages/pip \\
+           /usr/local/lib/python*/site-packages/pip-*.dist-info
+
+WORKDIR /app
+
+# Copy bundled package
+COPY . /app
+
+EXPOSE 8000
+
+ENV PYTHONPATH=/app
+
+CMD ["python", "bin/opentelemetry-instrument", "python", "-m", "uvicorn", "proj_py_project.my_mcp.http:app", "--host", "0.0.0.0", "--port", "8000"]
+"
+`;

package/src/migrations/latest/strip-pip-from-python-images/metadata.json

@@ -0,0 +1,3 @@
+{
+  "description": "Remove pip from vended Python agent / MCP server images so its vulnerable vendored packages are not present at runtime"
+}

package/src/migrations/latest/strip-pip-from-python-images/migration.d.ts

@@ -0,0 +1,6 @@
+/**
+ * Copyright Amazon.com, Inc. or its affiliates. All Rights Reserved.
+ * SPDX-License-Identifier: Apache-2.0
+ */
+import { type MigrationReturnObject, type Tree } from '@nx/devkit';
+export default function migration(tree: Tree): Promise<MigrationReturnObject>;

package/src/migrations/latest/strip-pip-from-python-images/migration.js

@@ -0,0 +1,91 @@
+/**
+ * Copyright Amazon.com, Inc. or its affiliates. All Rights Reserved.
+ * SPDX-License-Identifier: Apache-2.0
+ */ import { getProjects, joinPathFragments } from "@nx/devkit";
+import { formatFilesInSubtree } from "../../../utils/format.js";
+/**
+ * Remove pip from the vended Python agent / MCP server images.
+ *
+ * The runtime runs entirely from the bundled `/app` environment and never needs
+ * pip, whose vendored packages (setuptools, msgpack) in the base image carry
+ * known HIGH/CRITICAL vulnerabilities the image scan flags. New workspaces get
+ * this from the generator templates; this brings existing ones up to date.
+ *
+ * Only the Dockerfiles of `py#agent` / `py#mcp-server` components are touched,
+ * located from their project metadata. The Dockerfile is generated
+ * `KeepExisting`, so it is edited in place: the pip removal is inserted right
+ * after the `FROM` line. A Dockerfile whose pip usage has been customised (an
+ * added `pip install`, or any pip command other than this removal) is left
+ * untouched and reported via `nextSteps`, since stripping pip could break it.
+ */ /**
+ * The generators whose runtime images vend pip and should have it stripped.
+ * Hardcoded rather than imported from the generators: a migration matches the
+ * ids workspaces recorded at generation time, which must stay fixed even if the
+ * generators' current ids change later.
+ */ const RUNTIME_IMAGE_GENERATOR_IDS = [
+    'py#agent',
+    'py#mcp-server'
+];
+const PIP_REMOVAL = `# Remove the base image's pip: the runtime runs from the bundled environment and
+# never needs it, and pip's vendored packages carry known HIGH/CRITICAL
+# vulnerabilities flagged by the image scan.
+RUN python -m pip uninstall -y pip && \\
+    rm -rf /usr/local/lib/python*/site-packages/pip \\
+           /usr/local/lib/python*/site-packages/pip-*.dist-info`;
+/** The exact pip command this migration adds; used to detect an applied fix. */ const PIP_UNINSTALL = 'pip uninstall -y pip';
+/** Matches any `pip` invocation in a RUN instruction (python -m pip … or pip …). */ const PIP_COMMAND = /\b(?:python\s+-m\s+)?pip\s+\S+/g;
+/**
+ * The Dockerfiles of every `py#agent` / `py#mcp-server` component, located from
+ * each project's recorded component metadata (`path` is the component directory
+ * relative to the project root).
+ */ const runtimeImageDockerfiles = (tree)=>{
+    const paths = [];
+    for (const project of getProjects(tree).values()){
+        const components = project.metadata?.components ?? [];
+        for (const component of components){
+            if (!RUNTIME_IMAGE_GENERATOR_IDS.includes(component.generator) || !component.path) {
+                continue;
+            }
+            const dockerfile = joinPathFragments(projectRoot(project), component.path, 'Dockerfile');
+            if (tree.exists(dockerfile)) {
+                paths.push(dockerfile);
+            }
+        }
+    }
+    return paths;
+};
+/** A project's root, falling back to sourceRoot for the TS-solution layout. */ const projectRoot = (project)=>project.root ?? project.sourceRoot ?? '';
+export default async function migration(tree) {
+    const nextSteps = [];
+    for (const filePath of runtimeImageDockerfiles(tree)){
+        const content = tree.read(filePath, 'utf-8');
+        if (!content) {
+            continue;
+        }
+        if (content.includes(PIP_UNINSTALL)) {
+            continue; // Already stripped (migrated or user-added).
+        }
+        // Leave a customised Dockerfile alone: any pip usage other than this
+        // migration's removal (e.g. an added `pip install`) means stripping pip
+        // could break the image, so flag it for the user instead of editing.
+        const pipUsages = content.match(PIP_COMMAND) ?? [];
+        if (pipUsages.length > 0) {
+            nextSteps.push(`In ${filePath}: this image uses pip (${pipUsages.join(', ')}), so it was left unchanged. pip's vendored packages carry known vulnerabilities flagged by the image scan — remove pip once it is no longer needed, e.g. \`RUN python -m pip uninstall -y pip && rm -rf /usr/local/lib/python*/site-packages/pip /usr/local/lib/python*/site-packages/pip-*.dist-info\`.`);
+            continue;
+        }
+        // Insert the pip removal after the FROM line and its trailing blank line,
+        // matching the spacing a freshly generated Dockerfile has.
+        const updated = content.replace(/^(FROM\s+\S*python:.*\n)\n/m, `$1\n${PIP_REMOVAL}\n\n`);
+        if (updated === content) {
+            nextSteps.push(`In ${filePath}: remove pip from the image so its vulnerable vendored packages are not scanned — add \`RUN python -m pip uninstall -y pip && rm -rf /usr/local/lib/python*/site-packages/pip /usr/local/lib/python*/site-packages/pip-*.dist-info\` after the FROM line (the runtime does not need pip).`);
+            continue;
+        }
+        tree.write(filePath, updated);
+    }
+    await formatFilesInSubtree(tree);
+    return {
+        nextSteps
+    };
+}
+
+//# sourceMappingURL=migration.js.map

package/src/migrations/latest/strip-pip-from-python-images/migration.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../../../../../../../packages/nx-plugin/src/migrations/latest/strip-pip-from-python-images/migration.ts"],"sourcesContent":["/**\n * Copyright Amazon.com, Inc. or its affiliates. All Rights Reserved.\n * SPDX-License-Identifier: Apache-2.0\n */\nimport {\n  getProjects,\n  joinPathFragments,\n  type MigrationReturnObject,\n  type ProjectConfiguration,\n  type Tree,\n} from '@nx/devkit';\nimport { formatFilesInSubtree } from '../../../utils/format';\nimport type { ComponentMetadata } from '../../../utils/nx';\n\n/**\n * Remove pip from the vended Python agent / MCP server images.\n *\n * The runtime runs entirely from the bundled `/app` environment and never needs\n * pip, whose vendored packages (setuptools, msgpack) in the base image carry\n * known HIGH/CRITICAL vulnerabilities the image scan flags. New workspaces get\n * this from the generator templates; this brings existing ones up to date.\n *\n * Only the Dockerfiles of `py#agent` / `py#mcp-server` components are touched,\n * located from their project metadata. The Dockerfile is generated\n * `KeepExisting`, so it is edited in place: the pip removal is inserted right\n * after the `FROM` line. A Dockerfile whose pip usage has been customised (an\n * added `pip install`, or any pip command other than this removal) is left\n * untouched and reported via `nextSteps`, since stripping pip could break it.\n */\n\n/**\n * The generators whose runtime images vend pip and should have it stripped.\n * Hardcoded rather than imported from the generators: a migration matches the\n * ids workspaces recorded at generation time, which must stay fixed even if the\n * generators' current ids change later.\n */\nconst RUNTIME_IMAGE_GENERATOR_IDS = ['py#agent', 'py#mcp-server'];\n\nconst PIP_REMOVAL = `# Remove the base image's pip: the runtime runs from the bundled environment and\n# never needs it, and pip's vendored packages carry known HIGH/CRITICAL\n# vulnerabilities flagged by the image scan.\nRUN python -m pip uninstall -y pip && \\\\\n    rm -rf /usr/local/lib/python*/site-packages/pip \\\\\n           /usr/local/lib/python*/site-packages/pip-*.dist-info`;\n\n/** The exact pip command this migration adds; used to detect an applied fix. */\nconst PIP_UNINSTALL = 'pip uninstall -y pip';\n\n/** Matches any `pip` invocation in a RUN instruction (python -m pip … or pip …). */\nconst PIP_COMMAND = /\\b(?:python\\s+-m\\s+)?pip\\s+\\S+/g;\n\n/**\n * The Dockerfiles of every `py#agent` / `py#mcp-server` component, located from\n * each project's recorded component metadata (`path` is the component directory\n * relative to the project root).\n */\nconst runtimeImageDockerfiles = (tree: Tree): string[] => {\n  const paths: string[] = [];\n  for (const project of getProjects(tree).values()) {\n    const components = ((\n      project.metadata as { components?: ComponentMetadata[] }\n    )?.components ?? []) as ComponentMetadata[];\n    for (const component of components) {\n      if (\n        !RUNTIME_IMAGE_GENERATOR_IDS.includes(component.generator) ||\n        !component.path\n      ) {\n        continue;\n      }\n      const dockerfile = joinPathFragments(\n        projectRoot(project),\n        component.path,\n        'Dockerfile',\n      );\n      if (tree.exists(dockerfile)) {\n        paths.push(dockerfile);\n      }\n    }\n  }\n  return paths;\n};\n\n/** A project's root, falling back to sourceRoot for the TS-solution layout. */\nconst projectRoot = (project: ProjectConfiguration): string =>\n  project.root ?? project.sourceRoot ?? '';\n\nexport default async function migration(\n  tree: Tree,\n): Promise<MigrationReturnObject> {\n  const nextSteps: string[] = [];\n\n  for (const filePath of runtimeImageDockerfiles(tree)) {\n    const content = tree.read(filePath, 'utf-8');\n    if (!content) {\n      continue;\n    }\n    if (content.includes(PIP_UNINSTALL)) {\n      continue; // Already stripped (migrated or user-added).\n    }\n\n    // Leave a customised Dockerfile alone: any pip usage other than this\n    // migration's removal (e.g. an added `pip install`) means stripping pip\n    // could break the image, so flag it for the user instead of editing.\n    const pipUsages = content.match(PIP_COMMAND) ?? [];\n    if (pipUsages.length > 0) {\n      nextSteps.push(\n        `In ${filePath}: this image uses pip (${pipUsages.join(', ')}), so it was left unchanged. pip's vendored packages carry known vulnerabilities flagged by the image scan — remove pip once it is no longer needed, e.g. \\`RUN python -m pip uninstall -y pip && rm -rf /usr/local/lib/python*/site-packages/pip /usr/local/lib/python*/site-packages/pip-*.dist-info\\`.`,\n      );\n      continue;\n    }\n\n    // Insert the pip removal after the FROM line and its trailing blank line,\n    // matching the spacing a freshly generated Dockerfile has.\n    const updated = content.replace(\n      /^(FROM\\s+\\S*python:.*\\n)\\n/m,\n      `$1\\n${PIP_REMOVAL}\\n\\n`,\n    );\n    if (updated === content) {\n      nextSteps.push(\n        `In ${filePath}: remove pip from the image so its vulnerable vendored packages are not scanned — add \\`RUN python -m pip uninstall -y pip && rm -rf /usr/local/lib/python*/site-packages/pip /usr/local/lib/python*/site-packages/pip-*.dist-info\\` after the FROM line (the runtime does not need pip).`,\n      );\n      continue;\n    }\n    tree.write(filePath, updated);\n  }\n\n  await formatFilesInSubtree(tree);\n\n  return { nextSteps };\n}\n"],"names":["getProjects","joinPathFragments","formatFilesInSubtree","RUNTIME_IMAGE_GENERATOR_IDS","PIP_REMOVAL","PIP_UNINSTALL","PIP_COMMAND","runtimeImageDockerfiles","tree","paths","project","values","components","metadata","component","includes","generator","path","dockerfile","projectRoot","exists","push","root","sourceRoot","migration","nextSteps","filePath","content","read","pipUsages","match","length","join","updated","replace","write"],"mappings":"AAAA;;;CAGC,GACD,SACEA,WAAW,EACXC,iBAAiB,QAIZ,aAAa;AACpB,SAASC,oBAAoB,QAAQ,2BAAwB;AAG7D;;;;;;;;;;;;;;CAcC,GAED;;;;;CAKC,GACD,MAAMC,8BAA8B;IAAC;IAAY;CAAgB;AAEjE,MAAMC,cAAc,CAAC;;;;;+DAK0C,CAAC;AAEhE,8EAA8E,GAC9E,MAAMC,gBAAgB;AAEtB,kFAAkF,GAClF,MAAMC,cAAc;AAEpB;;;;CAIC,GACD,MAAMC,0BAA0B,CAACC;IAC/B,MAAMC,QAAkB,EAAE;IAC1B,KAAK,MAAMC,WAAWV,YAAYQ,MAAMG,MAAM,GAAI;QAChD,MAAMC,aAAc,AAClBF,QAAQG,QAAQ,EACfD,cAAc,EAAE;QACnB,KAAK,MAAME,aAAaF,WAAY;YAClC,IACE,CAACT,4BAA4BY,QAAQ,CAACD,UAAUE,SAAS,KACzD,CAACF,UAAUG,IAAI,EACf;gBACA;YACF;YACA,MAAMC,aAAajB,kBACjBkB,YAAYT,UACZI,UAAUG,IAAI,EACd;YAEF,IAAIT,KAAKY,MAAM,CAACF,aAAa;gBAC3BT,MAAMY,IAAI,CAACH;YACb;QACF;IACF;IACA,OAAOT;AACT;AAEA,6EAA6E,GAC7E,MAAMU,cAAc,CAACT,UACnBA,QAAQY,IAAI,IAAIZ,QAAQa,UAAU,IAAI;AAExC,eAAe,eAAeC,UAC5BhB,IAAU;IAEV,MAAMiB,YAAsB,EAAE;IAE9B,KAAK,MAAMC,YAAYnB,wBAAwBC,MAAO;QACpD,MAAMmB,UAAUnB,KAAKoB,IAAI,CAACF,UAAU;QACpC,IAAI,CAACC,SAAS;YACZ;QACF;QACA,IAAIA,QAAQZ,QAAQ,CAACV,gBAAgB;YACnC,UAAU,6CAA6C;QACzD;QAEA,qEAAqE;QACrE,wEAAwE;QACxE,qEAAqE;QACrE,MAAMwB,YAAYF,QAAQG,KAAK,CAACxB,gBAAgB,EAAE;QAClD,IAAIuB,UAAUE,MAAM,GAAG,GAAG;YACxBN,UAAUJ,IAAI,CACZ,CAAC,GAAG,EAAEK,SAAS,uBAAuB,EAAEG,UAAUG,IAAI,CAAC,MAAM,ySAAyS,CAAC;YAEzW;QACF;QAEA,0EAA0E;QAC1E,2DAA2D;QAC3D,MAAMC,UAAUN,QAAQO,OAAO,CAC7B,+BACA,CAAC,IAAI,EAAE9B,YAAY,IAAI,CAAC;QAE1B,IAAI6B,YAAYN,SAAS;YACvBF,UAAUJ,IAAI,CACZ,CAAC,GAAG,EAAEK,SAAS,yRAAyR,CAAC;YAE3S;QACF;QACAlB,KAAK2B,KAAK,CAACT,UAAUO;IACvB;IAEA,MAAM/B,qBAAqBM;IAE3B,OAAO;QAAEiB;IAAU;AACrB"}

package/src/migrations/latest/waf-log-group-removal/__snapshots__/migration.spec.ts.snap

@@ -0,0 +1,57 @@
+// Vitest Snapshot v1, https://vitest.dev/guide/snapshot.html
+
+exports[`waf-log-group-removal migration > should add a DESTROY removal policy and import to the rest api WAF log group 1`] = `
+"import { IAspect, Stack, RemovalPolicy } from 'aws-cdk-lib';
+import { LogGroup, RetentionDays } from 'aws-cdk-lib/aws-logs';
+import { Key } from 'aws-cdk-lib/aws-kms';
+import { CfnLoggingConfiguration } from 'aws-cdk-lib/aws-wafv2';
+import { Construct } from 'constructs';
+
+export class RestApi extends Construct {
+  constructor(scope: Construct, id: string) {
+    super(scope, id);
+    const logsKey = new Key(this, 'WebAclLogsKey', { enableKeyRotation: true });
+    // The construct has another log group sharing the encryptionKey shape, so
+    // the migration must scope its rewrite to the WAF log group only.
+    const accessLogs = new LogGroup(this, 'AccessLogs', {
+      retention: RetentionDays.ONE_YEAR,
+      encryptionKey: logsKey,
+    });
+    const wafLogGroup = new LogGroup(this, 'WebAclLogs', {
+      logGroupName: \`aws-waf-logs-\${apiName}-\${this.node.addr.slice(-8)}\`,
+      retention: RetentionDays.ONE_YEAR,
+      encryptionKey: logsKey,
+      // The log group name is deterministic, so retaining it on delete would
+      // orphan it and block re-creation (e.g. after a rolled-back deploy).
+      removalPolicy: RemovalPolicy.DESTROY,
+    });
+  }
+}
+"
+`;
+
+exports[`waf-log-group-removal migration > should add a DESTROY removal policy to the gateway WAF log group 1`] = `
+"import * as cdk from 'aws-cdk-lib';
+import * as kms from 'aws-cdk-lib/aws-kms';
+import * as logs from 'aws-cdk-lib/aws-logs';
+import * as wafv2 from 'aws-cdk-lib/aws-wafv2';
+import { Construct } from 'constructs';
+
+export class AgentCoreGateway extends Construct {
+  private createWebAcl(metricPrefix: string): wafv2.CfnWebACL {
+    const logsKey = new kms.Key(this, 'WebAclLogsKey', {
+      enableKeyRotation: true,
+    });
+    const wafLogGroup = new logs.LogGroup(this, 'WebAclLogs', {
+      logGroupName: \`aws-waf-logs-\${metricPrefix}-\${this.node.addr.slice(-8)}\`,
+      retention: logs.RetentionDays.ONE_YEAR,
+      encryptionKey: logsKey,
+      // The log group name is deterministic, so retaining it on delete would
+      // orphan it and block re-creation (e.g. after a rolled-back deploy).
+      removalPolicy: cdk.RemovalPolicy.DESTROY,
+    });
+    return undefined as any;
+  }
+}
+"
+`;

package/src/migrations/latest/waf-log-group-removal/metadata.json

@@ -0,0 +1,3 @@
+{
+  "description": "Set RemovalPolicy.DESTROY on WAF log groups in the vended AgentCoreGateway and REST API constructs so a rolled-back deploy does not orphan them"
+}

package/src/migrations/latest/waf-log-group-removal/migration.d.ts

@@ -0,0 +1,6 @@
+/**
+ * Copyright Amazon.com, Inc. or its affiliates. All Rights Reserved.
+ * SPDX-License-Identifier: Apache-2.0
+ */
+import type { MigrationReturnObject, Tree } from '@nx/devkit';
+export default function migration(tree: Tree): Promise<MigrationReturnObject>;

package/src/migrations/latest/waf-log-group-removal/migration.js

@@ -0,0 +1,77 @@
+/**
+ * Copyright Amazon.com, Inc. or its affiliates. All Rights Reserved.
+ * SPDX-License-Identifier: Apache-2.0
+ */ import { addDestructuredImport, insertViaGritQL, matchGritQL } from "../../../utils/ast.js";
+import { formatFilesInSubtree } from "../../../utils/format.js";
+import { PACKAGES_DIR, SHARED_CONSTRUCTS_DIR } from "../../../utils/shared-constructs-constants.js";
+/**
+ * Vended WAF log groups have a deterministic name (WAFv2 requires the
+ * `aws-waf-logs-` prefix, so the name can't be CloudFormation-generated) and,
+ * without an explicit removal policy, inherit CloudFormation's default RETAIN
+ * for log groups. A rolled-back or replaced deploy then orphans the log group,
+ * so the next deploy fails to create one of the same name. Set
+ * `RemovalPolicy.DESTROY` so it is torn down with the stack, matching the
+ * vended user-identity (Cognito) construct.
+ */ const CONSTRUCTS_SRC = `${PACKAGES_DIR}/${SHARED_CONSTRUCTS_DIR}/src`;
+const WAF_CONSTRUCTS = [
+    {
+        file: `${CONSTRUCTS_SRC}/core/agentcore-gateway/agentcore-gateway.ts`,
+        logGroupExpr: 'logs.LogGroup',
+        removalPolicyExpr: 'cdk.RemovalPolicy.DESTROY'
+    },
+    {
+        file: `${CONSTRUCTS_SRC}/core/api/rest-api.ts`,
+        logGroupExpr: 'LogGroup',
+        removalPolicyExpr: 'RemovalPolicy.DESTROY',
+        destructuredImport: 'RemovalPolicy'
+    }
+];
+const migrateConstruct = async (tree, construct, nextSteps)=>{
+    const { file, logGroupExpr } = construct;
+    if (!tree.exists(file)) {
+        // Construct not vended in this workspace - nothing to migrate.
+        return;
+    }
+    const contents = tree.read(file, 'utf-8') ?? '';
+    // The WAF web ACL (and its log group) is optional in some constructs, so it
+    // may be absent. Nothing to do if it is.
+    if (!contents.includes(`new ${logGroupExpr}(this, 'WebAclLogs'`)) {
+        return;
+    }
+    // Already migrated (or user-added a removal policy).
+    if (await matchGritQL(tree, file, `\`new ${logGroupExpr}(this, 'WebAclLogs', { $props })\` where { $props <: contains \`removalPolicy\` }`)) {
+        return;
+    }
+    // Append the removal policy after the WAF log group's `encryptionKey`
+    // property. The rewrite is scoped to the `WebAclLogs` LogGroup because a
+    // construct can have other log groups sharing the `encryptionKey: logsKey`
+    // shape (e.g. the rest api's access logs).
+    const added = await insertViaGritQL(tree, file, `\`new ${logGroupExpr}(this, 'WebAclLogs', { $props })\` where {
+  $props <: contains \`encryptionKey: logsKey\` as $enc,
+  $enc => \`encryptionKey: logsKey,
+      __GRIT_INSERT_PLACEHOLDER__\`
+}`, `// The log group name is deterministic, so retaining it on delete would
+      // orphan it and block re-creation (e.g. after a rolled-back deploy).
+      removalPolicy: ${construct.removalPolicyExpr}`);
+    if (!added) {
+        nextSteps.push(`${file}: could not add a removal policy to the WAF log group automatically - it may have diverged from the generated shape. Add \`removalPolicy: ${construct.removalPolicyExpr}\` to the \`new ${logGroupExpr}(this, 'WebAclLogs', ...)\` call so a rolled-back deploy does not orphan the log group.`);
+        return;
+    }
+    if (construct.destructuredImport) {
+        await addDestructuredImport(tree, file, [
+            construct.destructuredImport
+        ], 'aws-cdk-lib');
+    }
+};
+export default async function migration(tree) {
+    const nextSteps = [];
+    for (const construct of WAF_CONSTRUCTS){
+        await migrateConstruct(tree, construct, nextSteps);
+    }
+    await formatFilesInSubtree(tree);
+    return {
+        nextSteps
+    };
+}
+
+//# sourceMappingURL=migration.js.map

package/src/migrations/latest/waf-log-group-removal/migration.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../../../../../../../packages/nx-plugin/src/migrations/latest/waf-log-group-removal/migration.ts"],"sourcesContent":["/**\n * Copyright Amazon.com, Inc. or its affiliates. All Rights Reserved.\n * SPDX-License-Identifier: Apache-2.0\n */\nimport type { MigrationReturnObject, Tree } from '@nx/devkit';\nimport {\n  addDestructuredImport,\n  insertViaGritQL,\n  matchGritQL,\n} from '../../../utils/ast';\nimport { formatFilesInSubtree } from '../../../utils/format';\nimport {\n  PACKAGES_DIR,\n  SHARED_CONSTRUCTS_DIR,\n} from '../../../utils/shared-constructs-constants';\n\n/**\n * Vended WAF log groups have a deterministic name (WAFv2 requires the\n * `aws-waf-logs-` prefix, so the name can't be CloudFormation-generated) and,\n * without an explicit removal policy, inherit CloudFormation's default RETAIN\n * for log groups. A rolled-back or replaced deploy then orphans the log group,\n * so the next deploy fails to create one of the same name. Set\n * `RemovalPolicy.DESTROY` so it is torn down with the stack, matching the\n * vended user-identity (Cognito) construct.\n */\n\nconst CONSTRUCTS_SRC = `${PACKAGES_DIR}/${SHARED_CONSTRUCTS_DIR}/src`;\n\n/**\n * A vended construct carrying a WAF log group. They differ in how the log\n * group is constructed and how `cdk` is imported: the gateway namespaces both\n * (`logs.LogGroup`, `cdk.RemovalPolicy`), the rest api destructures both\n * (`LogGroup`, `RemovalPolicy` — the latter added by this migration when\n * absent).\n */\ninterface WafConstruct {\n  file: string;\n  /** How `LogGroup` is referenced in this file (`LogGroup` or `logs.LogGroup`). */\n  logGroupExpr: string;\n  /** The removal policy expression, matching the file's import style. */\n  removalPolicyExpr: string;\n  /** When set, ensure this destructured import from `aws-cdk-lib`. */\n  destructuredImport?: string;\n}\n\nconst WAF_CONSTRUCTS: WafConstruct[] = [\n  {\n    file: `${CONSTRUCTS_SRC}/core/agentcore-gateway/agentcore-gateway.ts`,\n    logGroupExpr: 'logs.LogGroup',\n    removalPolicyExpr: 'cdk.RemovalPolicy.DESTROY',\n  },\n  {\n    file: `${CONSTRUCTS_SRC}/core/api/rest-api.ts`,\n    logGroupExpr: 'LogGroup',\n    removalPolicyExpr: 'RemovalPolicy.DESTROY',\n    destructuredImport: 'RemovalPolicy',\n  },\n];\n\nconst migrateConstruct = async (\n  tree: Tree,\n  construct: WafConstruct,\n  nextSteps: string[],\n): Promise<void> => {\n  const { file, logGroupExpr } = construct;\n  if (!tree.exists(file)) {\n    // Construct not vended in this workspace - nothing to migrate.\n    return;\n  }\n\n  const contents = tree.read(file, 'utf-8') ?? '';\n\n  // The WAF web ACL (and its log group) is optional in some constructs, so it\n  // may be absent. Nothing to do if it is.\n  if (!contents.includes(`new ${logGroupExpr}(this, 'WebAclLogs'`)) {\n    return;\n  }\n\n  // Already migrated (or user-added a removal policy).\n  if (\n    await matchGritQL(\n      tree,\n      file,\n      `\\`new ${logGroupExpr}(this, 'WebAclLogs', { $props })\\` where { $props <: contains \\`removalPolicy\\` }`,\n    )\n  ) {\n    return;\n  }\n\n  // Append the removal policy after the WAF log group's `encryptionKey`\n  // property. The rewrite is scoped to the `WebAclLogs` LogGroup because a\n  // construct can have other log groups sharing the `encryptionKey: logsKey`\n  // shape (e.g. the rest api's access logs).\n  const added = await insertViaGritQL(\n    tree,\n    file,\n    `\\`new ${logGroupExpr}(this, 'WebAclLogs', { $props })\\` where {\n  $props <: contains \\`encryptionKey: logsKey\\` as $enc,\n  $enc => \\`encryptionKey: logsKey,\n      __GRIT_INSERT_PLACEHOLDER__\\`\n}`,\n    `// The log group name is deterministic, so retaining it on delete would\n      // orphan it and block re-creation (e.g. after a rolled-back deploy).\n      removalPolicy: ${construct.removalPolicyExpr}`,\n  );\n\n  if (!added) {\n    nextSteps.push(\n      `${file}: could not add a removal policy to the WAF log group automatically - it may have diverged from the generated shape. Add \\`removalPolicy: ${construct.removalPolicyExpr}\\` to the \\`new ${logGroupExpr}(this, 'WebAclLogs', ...)\\` call so a rolled-back deploy does not orphan the log group.`,\n    );\n    return;\n  }\n\n  if (construct.destructuredImport) {\n    await addDestructuredImport(\n      tree,\n      file,\n      [construct.destructuredImport],\n      'aws-cdk-lib',\n    );\n  }\n};\n\nexport default async function migration(\n  tree: Tree,\n): Promise<MigrationReturnObject> {\n  const nextSteps: string[] = [];\n\n  for (const construct of WAF_CONSTRUCTS) {\n    await migrateConstruct(tree, construct, nextSteps);\n  }\n\n  await formatFilesInSubtree(tree);\n\n  return { nextSteps };\n}\n"],"names":["addDestructuredImport","insertViaGritQL","matchGritQL","formatFilesInSubtree","PACKAGES_DIR","SHARED_CONSTRUCTS_DIR","CONSTRUCTS_SRC","WAF_CONSTRUCTS","file","logGroupExpr","removalPolicyExpr","destructuredImport","migrateConstruct","tree","construct","nextSteps","exists","contents","read","includes","added","push","migration"],"mappings":"AAAA;;;CAGC,GAED,SACEA,qBAAqB,EACrBC,eAAe,EACfC,WAAW,QACN,wBAAqB;AAC5B,SAASC,oBAAoB,QAAQ,2BAAwB;AAC7D,SACEC,YAAY,EACZC,qBAAqB,QAChB,gDAA6C;AAEpD;;;;;;;;CAQC,GAED,MAAMC,iBAAiB,GAAGF,aAAa,CAAC,EAAEC,sBAAsB,IAAI,CAAC;AAmBrE,MAAME,iBAAiC;IACrC;QACEC,MAAM,GAAGF,eAAe,4CAA4C,CAAC;QACrEG,cAAc;QACdC,mBAAmB;IACrB;IACA;QACEF,MAAM,GAAGF,eAAe,qBAAqB,CAAC;QAC9CG,cAAc;QACdC,mBAAmB;QACnBC,oBAAoB;IACtB;CACD;AAED,MAAMC,mBAAmB,OACvBC,MACAC,WACAC;IAEA,MAAM,EAAEP,IAAI,EAAEC,YAAY,EAAE,GAAGK;IAC/B,IAAI,CAACD,KAAKG,MAAM,CAACR,OAAO;QACtB,+DAA+D;QAC/D;IACF;IAEA,MAAMS,WAAWJ,KAAKK,IAAI,CAACV,MAAM,YAAY;IAE7C,4EAA4E;IAC5E,yCAAyC;IACzC,IAAI,CAACS,SAASE,QAAQ,CAAC,CAAC,IAAI,EAAEV,aAAa,mBAAmB,CAAC,GAAG;QAChE;IACF;IAEA,qDAAqD;IACrD,IACE,MAAMP,YACJW,MACAL,MACA,CAAC,MAAM,EAAEC,aAAa,iFAAiF,CAAC,GAE1G;QACA;IACF;IAEA,sEAAsE;IACtE,yEAAyE;IACzE,2EAA2E;IAC3E,2CAA2C;IAC3C,MAAMW,QAAQ,MAAMnB,gBAClBY,MACAL,MACA,CAAC,MAAM,EAAEC,aAAa;;;;CAIzB,CAAC,EACE,CAAC;;qBAEgB,EAAEK,UAAUJ,iBAAiB,EAAE;IAGlD,IAAI,CAACU,OAAO;QACVL,UAAUM,IAAI,CACZ,GAAGb,KAAK,0IAA0I,EAAEM,UAAUJ,iBAAiB,CAAC,gBAAgB,EAAED,aAAa,uFAAuF,CAAC;QAEzS;IACF;IAEA,IAAIK,UAAUH,kBAAkB,EAAE;QAChC,MAAMX,sBACJa,MACAL,MACA;YAACM,UAAUH,kBAAkB;SAAC,EAC9B;IAEJ;AACF;AAEA,eAAe,eAAeW,UAC5BT,IAAU;IAEV,MAAME,YAAsB,EAAE;IAE9B,KAAK,MAAMD,aAAaP,eAAgB;QACtC,MAAMK,iBAAiBC,MAAMC,WAAWC;IAC1C;IAEA,MAAMZ,qBAAqBU;IAE3B,OAAO;QAAEE;IAAU;AACrB"}

package/src/migrations/v1.0.0-rc.50/modernize-function-props-cast/metadata.json

@@ -0,0 +1,3 @@
+{
+  "description": "Replace the legacy angle-bracket FunctionProps type assertion with the modern as syntax in generated API constructs"
+}

package/src/migrations/v1.0.0-rc.50/modernize-function-props-cast/migration.d.ts

@@ -0,0 +1,6 @@
+/**
+ * Copyright Amazon.com, Inc. or its affiliates. All Rights Reserved.
+ * SPDX-License-Identifier: Apache-2.0
+ */
+import { type MigrationReturnObject, type Tree } from '@nx/devkit';
+export default function migration(tree: Tree): Promise<MigrationReturnObject>;

package/src/migrations/v1.0.0-rc.50/modernize-function-props-cast/migration.js

@@ -0,0 +1,65 @@
+/**
+ * Copyright Amazon.com, Inc. or its affiliates. All Rights Reserved.
+ * SPDX-License-Identifier: Apache-2.0
+ */ import { visitNotIgnoredFiles } from "@nx/devkit";
+import { formatFilesInSubtree } from "../../../utils/format.js";
+import { PACKAGES_DIR, SHARED_CONSTRUCTS_DIR } from "../../../utils/shared-constructs-constants.js";
+/**
+ * Replace the legacy angle-bracket FunctionProps type assertion with the modern as syntax in generated API constructs
+ *
+ * The legacy `<FunctionProps>{ ... }` cast form is not supported by GritQL's
+ * TypeScript parser, which silently breaks parsing (and therefore matching)
+ * for the entire containing file. Since several other migrations rely on
+ * GritQL to update these API construct files, this cast is replaced here with
+ * the equivalent, GritQL-compatible `{ ... } as FunctionProps` form. This is
+ * matched as an exact literal (rather than via GritQL) since GritQL cannot
+ * parse the file while the legacy cast is still present.
+ *
+ * How to write a migration:
+ * - https://nx.dev/docs/kb/migration-generators
+ * - What `nextSteps` means: https://nx.dev/docs/reference/devkit/MigrationReturnObject
+ *
+ * Guardrails:
+ * - Pattern-match before writing: skip files that have diverged from the shape
+ *   your generators produce and report them via `nextSteps`, or consider a
+ *   hybrid migration, rather than clobbering the user's changes.
+ * - Idempotent: re-running must be a no-op.
+ * - Format what you write: finish with `formatFilesInSubtree` so the files your
+ *   migration wrote are formatted correctly.
+ */ const APIS_APP_DIR = `${PACKAGES_DIR}/${SHARED_CONSTRUCTS_DIR}/src/app/apis`;
+const OLD_CAST_OPEN = 'defaultIntegrationOptions: <FunctionProps>{';
+const NEW_CAST_OPEN = 'defaultIntegrationOptions: {';
+const OLD_CAST_CLOSE = '\n      },\n      buildDefaultIntegration:';
+const NEW_CAST_CLOSE = '\n      } as FunctionProps,\n      buildDefaultIntegration:';
+export default async function migration(tree) {
+    const nextSteps = [];
+    if (!tree.exists(APIS_APP_DIR)) {
+        return {
+            nextSteps
+        };
+    }
+    const apiAppFiles = [];
+    visitNotIgnoredFiles(tree, APIS_APP_DIR, (filePath)=>{
+        apiAppFiles.push(filePath);
+    });
+    for (const filePath of apiAppFiles){
+        if (!filePath.endsWith('.ts') || filePath.endsWith('/index.ts')) {
+            continue;
+        }
+        const contents = tree.read(filePath, 'utf-8') ?? '';
+        if (!contents.includes(OLD_CAST_OPEN)) {
+            continue;
+        }
+        if (!contents.includes(OLD_CAST_CLOSE)) {
+            nextSteps.push(`${filePath}: the defaultIntegrationOptions cast has diverged from the generated shape - left untouched. Manually replace \`<FunctionProps>{ ... }\` with \`{ ... } as FunctionProps\`.`);
+            continue;
+        }
+        tree.write(filePath, contents.replace(OLD_CAST_OPEN, NEW_CAST_OPEN).replace(OLD_CAST_CLOSE, NEW_CAST_CLOSE));
+    }
+    await formatFilesInSubtree(tree);
+    return {
+        nextSteps
+    };
+}
+
+//# sourceMappingURL=migration.js.map

package/src/migrations/v1.0.0-rc.50/modernize-function-props-cast/migration.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../../../../../../../packages/nx-plugin/src/migrations/v1.0.0-rc.50/modernize-function-props-cast/migration.ts"],"sourcesContent":["/**\n * Copyright Amazon.com, Inc. or its affiliates. All Rights Reserved.\n * SPDX-License-Identifier: Apache-2.0\n */\nimport {\n  type MigrationReturnObject,\n  type Tree,\n  visitNotIgnoredFiles,\n} from '@nx/devkit';\nimport { formatFilesInSubtree } from '../../../utils/format';\nimport {\n  PACKAGES_DIR,\n  SHARED_CONSTRUCTS_DIR,\n} from '../../../utils/shared-constructs-constants';\n\n/**\n * Replace the legacy angle-bracket FunctionProps type assertion with the modern as syntax in generated API constructs\n *\n * The legacy `<FunctionProps>{ ... }` cast form is not supported by GritQL's\n * TypeScript parser, which silently breaks parsing (and therefore matching)\n * for the entire containing file. Since several other migrations rely on\n * GritQL to update these API construct files, this cast is replaced here with\n * the equivalent, GritQL-compatible `{ ... } as FunctionProps` form. This is\n * matched as an exact literal (rather than via GritQL) since GritQL cannot\n * parse the file while the legacy cast is still present.\n *\n * How to write a migration:\n * - https://nx.dev/docs/kb/migration-generators\n * - What `nextSteps` means: https://nx.dev/docs/reference/devkit/MigrationReturnObject\n *\n * Guardrails:\n * - Pattern-match before writing: skip files that have diverged from the shape\n *   your generators produce and report them via `nextSteps`, or consider a\n *   hybrid migration, rather than clobbering the user's changes.\n * - Idempotent: re-running must be a no-op.\n * - Format what you write: finish with `formatFilesInSubtree` so the files your\n *   migration wrote are formatted correctly.\n */\n\nconst APIS_APP_DIR = `${PACKAGES_DIR}/${SHARED_CONSTRUCTS_DIR}/src/app/apis`;\n\nconst OLD_CAST_OPEN = 'defaultIntegrationOptions: <FunctionProps>{';\nconst NEW_CAST_OPEN = 'defaultIntegrationOptions: {';\nconst OLD_CAST_CLOSE = '\\n      },\\n      buildDefaultIntegration:';\nconst NEW_CAST_CLOSE =\n  '\\n      } as FunctionProps,\\n      buildDefaultIntegration:';\n\nexport default async function migration(\n  tree: Tree,\n): Promise<MigrationReturnObject> {\n  const nextSteps: string[] = [];\n\n  if (!tree.exists(APIS_APP_DIR)) {\n    return { nextSteps };\n  }\n\n  const apiAppFiles: string[] = [];\n  visitNotIgnoredFiles(tree, APIS_APP_DIR, (filePath) => {\n    apiAppFiles.push(filePath);\n  });\n\n  for (const filePath of apiAppFiles) {\n    if (!filePath.endsWith('.ts') || filePath.endsWith('/index.ts')) {\n      continue;\n    }\n    const contents = tree.read(filePath, 'utf-8') ?? '';\n    if (!contents.includes(OLD_CAST_OPEN)) {\n      // Already migrated, or doesn't use this shape.\n      continue;\n    }\n    if (!contents.includes(OLD_CAST_CLOSE)) {\n      nextSteps.push(\n        `${filePath}: the defaultIntegrationOptions cast has diverged from the generated shape - left untouched. Manually replace \\`<FunctionProps>{ ... }\\` with \\`{ ... } as FunctionProps\\`.`,\n      );\n      continue;\n    }\n    tree.write(\n      filePath,\n      contents\n        .replace(OLD_CAST_OPEN, NEW_CAST_OPEN)\n        .replace(OLD_CAST_CLOSE, NEW_CAST_CLOSE),\n    );\n  }\n\n  await formatFilesInSubtree(tree);\n\n  return { nextSteps };\n}\n"],"names":["visitNotIgnoredFiles","formatFilesInSubtree","PACKAGES_DIR","SHARED_CONSTRUCTS_DIR","APIS_APP_DIR","OLD_CAST_OPEN","NEW_CAST_OPEN","OLD_CAST_CLOSE","NEW_CAST_CLOSE","migration","tree","nextSteps","exists","apiAppFiles","filePath","push","endsWith","contents","read","includes","write","replace"],"mappings":"AAAA;;;CAGC,GACD,SAGEA,oBAAoB,QACf,aAAa;AACpB,SAASC,oBAAoB,QAAQ,2BAAwB;AAC7D,SACEC,YAAY,EACZC,qBAAqB,QAChB,gDAA6C;AAEpD;;;;;;;;;;;;;;;;;;;;;;CAsBC,GAED,MAAMC,eAAe,GAAGF,aAAa,CAAC,EAAEC,sBAAsB,aAAa,CAAC;AAE5E,MAAME,gBAAgB;AACtB,MAAMC,gBAAgB;AACtB,MAAMC,iBAAiB;AACvB,MAAMC,iBACJ;AAEF,eAAe,eAAeC,UAC5BC,IAAU;IAEV,MAAMC,YAAsB,EAAE;IAE9B,IAAI,CAACD,KAAKE,MAAM,CAACR,eAAe;QAC9B,OAAO;YAAEO;QAAU;IACrB;IAEA,MAAME,cAAwB,EAAE;IAChCb,qBAAqBU,MAAMN,cAAc,CAACU;QACxCD,YAAYE,IAAI,CAACD;IACnB;IAEA,KAAK,MAAMA,YAAYD,YAAa;QAClC,IAAI,CAACC,SAASE,QAAQ,CAAC,UAAUF,SAASE,QAAQ,CAAC,cAAc;YAC/D;QACF;QACA,MAAMC,WAAWP,KAAKQ,IAAI,CAACJ,UAAU,YAAY;QACjD,IAAI,CAACG,SAASE,QAAQ,CAACd,gBAAgB;YAErC;QACF;QACA,IAAI,CAACY,SAASE,QAAQ,CAACZ,iBAAiB;YACtCI,UAAUI,IAAI,CACZ,GAAGD,SAAS,2KAA2K,CAAC;YAE1L;QACF;QACAJ,KAAKU,KAAK,CACRN,UACAG,SACGI,OAAO,CAAChB,eAAeC,eACvBe,OAAO,CAACd,gBAAgBC;IAE/B;IAEA,MAAMP,qBAAqBS;IAE3B,OAAO;QAAEC;IAAU;AACrB"}

package/src/migrations/v1.0.0-rc.50/restrict-cors-to-custom-domains/metadata.json

@@ -0,0 +1,3 @@
+{
+  "description": "Include CloudFront custom domain aliases in restrictCorsTo and UserIdentity callback URLs"
+}

package/src/migrations/v1.0.0-rc.50/restrict-cors-to-custom-domains/migration.d.ts

@@ -0,0 +1,6 @@
+/**
+ * Copyright Amazon.com, Inc. or its affiliates. All Rights Reserved.
+ * SPDX-License-Identifier: Apache-2.0
+ */
+import { type MigrationReturnObject, type Tree } from '@nx/devkit';
+export default function migration(tree: Tree): Promise<MigrationReturnObject>;