@aws/nx-plugin 1.0.0-rc.6 → 1.0.0-rc.61

package/src/migrations/latest/strip-pip-from-python-images/migration.js

@@ -0,0 +1,91 @@
+/**
+ * Copyright Amazon.com, Inc. or its affiliates. All Rights Reserved.
+ * SPDX-License-Identifier: Apache-2.0
+ */ import { getProjects, joinPathFragments } from "@nx/devkit";
+import { formatFilesInSubtree } from "../../../utils/format.js";
+/**
+ * Remove pip from the vended Python agent / MCP server images.
+ *
+ * The runtime runs entirely from the bundled `/app` environment and never needs
+ * pip, whose vendored packages (setuptools, msgpack) in the base image carry
+ * known HIGH/CRITICAL vulnerabilities the image scan flags. New workspaces get
+ * this from the generator templates; this brings existing ones up to date.
+ *
+ * Only the Dockerfiles of `py#agent` / `py#mcp-server` components are touched,
+ * located from their project metadata. The Dockerfile is generated
+ * `KeepExisting`, so it is edited in place: the pip removal is inserted right
+ * after the `FROM` line. A Dockerfile whose pip usage has been customised (an
+ * added `pip install`, or any pip command other than this removal) is left
+ * untouched and reported via `nextSteps`, since stripping pip could break it.
+ */ /**
+ * The generators whose runtime images vend pip and should have it stripped.
+ * Hardcoded rather than imported from the generators: a migration matches the
+ * ids workspaces recorded at generation time, which must stay fixed even if the
+ * generators' current ids change later.
+ */ const RUNTIME_IMAGE_GENERATOR_IDS = [
+    'py#agent',
+    'py#mcp-server'
+];
+const PIP_REMOVAL = `# Remove the base image's pip: the runtime runs from the bundled environment and
+# never needs it, and pip's vendored packages carry known HIGH/CRITICAL
+# vulnerabilities flagged by the image scan.
+RUN python -m pip uninstall -y pip && \\
+    rm -rf /usr/local/lib/python*/site-packages/pip \\
+           /usr/local/lib/python*/site-packages/pip-*.dist-info`;
+/** The exact pip command this migration adds; used to detect an applied fix. */ const PIP_UNINSTALL = 'pip uninstall -y pip';
+/** Matches any `pip` invocation in a RUN instruction (python -m pip … or pip …). */ const PIP_COMMAND = /\b(?:python\s+-m\s+)?pip\s+\S+/g;
+/**
+ * The Dockerfiles of every `py#agent` / `py#mcp-server` component, located from
+ * each project's recorded component metadata (`path` is the component directory
+ * relative to the project root).
+ */ const runtimeImageDockerfiles = (tree)=>{
+    const paths = [];
+    for (const project of getProjects(tree).values()){
+        const components = project.metadata?.components ?? [];
+        for (const component of components){
+            if (!RUNTIME_IMAGE_GENERATOR_IDS.includes(component.generator) || !component.path) {
+                continue;
+            }
+            const dockerfile = joinPathFragments(projectRoot(project), component.path, 'Dockerfile');
+            if (tree.exists(dockerfile)) {
+                paths.push(dockerfile);
+            }
+        }
+    }
+    return paths;
+};
+/** A project's root, falling back to sourceRoot for the TS-solution layout. */ const projectRoot = (project)=>project.root ?? project.sourceRoot ?? '';
+export default async function migration(tree) {
+    const nextSteps = [];
+    for (const filePath of runtimeImageDockerfiles(tree)){
+        const content = tree.read(filePath, 'utf-8');
+        if (!content) {
+            continue;
+        }
+        if (content.includes(PIP_UNINSTALL)) {
+            continue; // Already stripped (migrated or user-added).
+        }
+        // Leave a customised Dockerfile alone: any pip usage other than this
+        // migration's removal (e.g. an added `pip install`) means stripping pip
+        // could break the image, so flag it for the user instead of editing.
+        const pipUsages = content.match(PIP_COMMAND) ?? [];
+        if (pipUsages.length > 0) {
+            nextSteps.push(`In ${filePath}: this image uses pip (${pipUsages.join(', ')}), so it was left unchanged. pip's vendored packages carry known vulnerabilities flagged by the image scan — remove pip once it is no longer needed, e.g. \`RUN python -m pip uninstall -y pip && rm -rf /usr/local/lib/python*/site-packages/pip /usr/local/lib/python*/site-packages/pip-*.dist-info\`.`);
+            continue;
+        }
+        // Insert the pip removal after the FROM line and its trailing blank line,
+        // matching the spacing a freshly generated Dockerfile has.
+        const updated = content.replace(/^(FROM\s+\S*python:.*\n)\n/m, `$1\n${PIP_REMOVAL}\n\n`);
+        if (updated === content) {
+            nextSteps.push(`In ${filePath}: remove pip from the image so its vulnerable vendored packages are not scanned — add \`RUN python -m pip uninstall -y pip && rm -rf /usr/local/lib/python*/site-packages/pip /usr/local/lib/python*/site-packages/pip-*.dist-info\` after the FROM line (the runtime does not need pip).`);
+            continue;
+        }
+        tree.write(filePath, updated);
+    }
+    await formatFilesInSubtree(tree);
+    return {
+        nextSteps
+    };
+}
+
+//# sourceMappingURL=migration.js.map

package/src/migrations/latest/strip-pip-from-python-images/migration.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../../../../../../../packages/nx-plugin/src/migrations/latest/strip-pip-from-python-images/migration.ts"],"sourcesContent":["/**\n * Copyright Amazon.com, Inc. or its affiliates. All Rights Reserved.\n * SPDX-License-Identifier: Apache-2.0\n */\nimport {\n  getProjects,\n  joinPathFragments,\n  type MigrationReturnObject,\n  type ProjectConfiguration,\n  type Tree,\n} from '@nx/devkit';\nimport { formatFilesInSubtree } from '../../../utils/format';\nimport type { ComponentMetadata } from '../../../utils/nx';\n\n/**\n * Remove pip from the vended Python agent / MCP server images.\n *\n * The runtime runs entirely from the bundled `/app` environment and never needs\n * pip, whose vendored packages (setuptools, msgpack) in the base image carry\n * known HIGH/CRITICAL vulnerabilities the image scan flags. New workspaces get\n * this from the generator templates; this brings existing ones up to date.\n *\n * Only the Dockerfiles of `py#agent` / `py#mcp-server` components are touched,\n * located from their project metadata. The Dockerfile is generated\n * `KeepExisting`, so it is edited in place: the pip removal is inserted right\n * after the `FROM` line. A Dockerfile whose pip usage has been customised (an\n * added `pip install`, or any pip command other than this removal) is left\n * untouched and reported via `nextSteps`, since stripping pip could break it.\n */\n\n/**\n * The generators whose runtime images vend pip and should have it stripped.\n * Hardcoded rather than imported from the generators: a migration matches the\n * ids workspaces recorded at generation time, which must stay fixed even if the\n * generators' current ids change later.\n */\nconst RUNTIME_IMAGE_GENERATOR_IDS = ['py#agent', 'py#mcp-server'];\n\nconst PIP_REMOVAL = `# Remove the base image's pip: the runtime runs from the bundled environment and\n# never needs it, and pip's vendored packages carry known HIGH/CRITICAL\n# vulnerabilities flagged by the image scan.\nRUN python -m pip uninstall -y pip && \\\\\n    rm -rf /usr/local/lib/python*/site-packages/pip \\\\\n           /usr/local/lib/python*/site-packages/pip-*.dist-info`;\n\n/** The exact pip command this migration adds; used to detect an applied fix. */\nconst PIP_UNINSTALL = 'pip uninstall -y pip';\n\n/** Matches any `pip` invocation in a RUN instruction (python -m pip … or pip …). */\nconst PIP_COMMAND = /\\b(?:python\\s+-m\\s+)?pip\\s+\\S+/g;\n\n/**\n * The Dockerfiles of every `py#agent` / `py#mcp-server` component, located from\n * each project's recorded component metadata (`path` is the component directory\n * relative to the project root).\n */\nconst runtimeImageDockerfiles = (tree: Tree): string[] => {\n  const paths: string[] = [];\n  for (const project of getProjects(tree).values()) {\n    const components = ((\n      project.metadata as { components?: ComponentMetadata[] }\n    )?.components ?? []) as ComponentMetadata[];\n    for (const component of components) {\n      if (\n        !RUNTIME_IMAGE_GENERATOR_IDS.includes(component.generator) ||\n        !component.path\n      ) {\n        continue;\n      }\n      const dockerfile = joinPathFragments(\n        projectRoot(project),\n        component.path,\n        'Dockerfile',\n      );\n      if (tree.exists(dockerfile)) {\n        paths.push(dockerfile);\n      }\n    }\n  }\n  return paths;\n};\n\n/** A project's root, falling back to sourceRoot for the TS-solution layout. */\nconst projectRoot = (project: ProjectConfiguration): string =>\n  project.root ?? project.sourceRoot ?? '';\n\nexport default async function migration(\n  tree: Tree,\n): Promise<MigrationReturnObject> {\n  const nextSteps: string[] = [];\n\n  for (const filePath of runtimeImageDockerfiles(tree)) {\n    const content = tree.read(filePath, 'utf-8');\n    if (!content) {\n      continue;\n    }\n    if (content.includes(PIP_UNINSTALL)) {\n      continue; // Already stripped (migrated or user-added).\n    }\n\n    // Leave a customised Dockerfile alone: any pip usage other than this\n    // migration's removal (e.g. an added `pip install`) means stripping pip\n    // could break the image, so flag it for the user instead of editing.\n    const pipUsages = content.match(PIP_COMMAND) ?? [];\n    if (pipUsages.length > 0) {\n      nextSteps.push(\n        `In ${filePath}: this image uses pip (${pipUsages.join(', ')}), so it was left unchanged. pip's vendored packages carry known vulnerabilities flagged by the image scan — remove pip once it is no longer needed, e.g. \\`RUN python -m pip uninstall -y pip && rm -rf /usr/local/lib/python*/site-packages/pip /usr/local/lib/python*/site-packages/pip-*.dist-info\\`.`,\n      );\n      continue;\n    }\n\n    // Insert the pip removal after the FROM line and its trailing blank line,\n    // matching the spacing a freshly generated Dockerfile has.\n    const updated = content.replace(\n      /^(FROM\\s+\\S*python:.*\\n)\\n/m,\n      `$1\\n${PIP_REMOVAL}\\n\\n`,\n    );\n    if (updated === content) {\n      nextSteps.push(\n        `In ${filePath}: remove pip from the image so its vulnerable vendored packages are not scanned — add \\`RUN python -m pip uninstall -y pip && rm -rf /usr/local/lib/python*/site-packages/pip /usr/local/lib/python*/site-packages/pip-*.dist-info\\` after the FROM line (the runtime does not need pip).`,\n      );\n      continue;\n    }\n    tree.write(filePath, updated);\n  }\n\n  await formatFilesInSubtree(tree);\n\n  return { nextSteps };\n}\n"],"names":["getProjects","joinPathFragments","formatFilesInSubtree","RUNTIME_IMAGE_GENERATOR_IDS","PIP_REMOVAL","PIP_UNINSTALL","PIP_COMMAND","runtimeImageDockerfiles","tree","paths","project","values","components","metadata","component","includes","generator","path","dockerfile","projectRoot","exists","push","root","sourceRoot","migration","nextSteps","filePath","content","read","pipUsages","match","length","join","updated","replace","write"],"mappings":"AAAA;;;CAGC,GACD,SACEA,WAAW,EACXC,iBAAiB,QAIZ,aAAa;AACpB,SAASC,oBAAoB,QAAQ,2BAAwB;AAG7D;;;;;;;;;;;;;;CAcC,GAED;;;;;CAKC,GACD,MAAMC,8BAA8B;IAAC;IAAY;CAAgB;AAEjE,MAAMC,cAAc,CAAC;;;;;+DAK0C,CAAC;AAEhE,8EAA8E,GAC9E,MAAMC,gBAAgB;AAEtB,kFAAkF,GAClF,MAAMC,cAAc;AAEpB;;;;CAIC,GACD,MAAMC,0BAA0B,CAACC;IAC/B,MAAMC,QAAkB,EAAE;IAC1B,KAAK,MAAMC,WAAWV,YAAYQ,MAAMG,MAAM,GAAI;QAChD,MAAMC,aAAc,AAClBF,QAAQG,QAAQ,EACfD,cAAc,EAAE;QACnB,KAAK,MAAME,aAAaF,WAAY;YAClC,IACE,CAACT,4BAA4BY,QAAQ,CAACD,UAAUE,SAAS,KACzD,CAACF,UAAUG,IAAI,EACf;gBACA;YACF;YACA,MAAMC,aAAajB,kBACjBkB,YAAYT,UACZI,UAAUG,IAAI,EACd;YAEF,IAAIT,KAAKY,MAAM,CAACF,aAAa;gBAC3BT,MAAMY,IAAI,CAACH;YACb;QACF;IACF;IACA,OAAOT;AACT;AAEA,6EAA6E,GAC7E,MAAMU,cAAc,CAACT,UACnBA,QAAQY,IAAI,IAAIZ,QAAQa,UAAU,IAAI;AAExC,eAAe,eAAeC,UAC5BhB,IAAU;IAEV,MAAMiB,YAAsB,EAAE;IAE9B,KAAK,MAAMC,YAAYnB,wBAAwBC,MAAO;QACpD,MAAMmB,UAAUnB,KAAKoB,IAAI,CAACF,UAAU;QACpC,IAAI,CAACC,SAAS;YACZ;QACF;QACA,IAAIA,QAAQZ,QAAQ,CAACV,gBAAgB;YACnC,UAAU,6CAA6C;QACzD;QAEA,qEAAqE;QACrE,wEAAwE;QACxE,qEAAqE;QACrE,MAAMwB,YAAYF,QAAQG,KAAK,CAACxB,gBAAgB,EAAE;QAClD,IAAIuB,UAAUE,MAAM,GAAG,GAAG;YACxBN,UAAUJ,IAAI,CACZ,CAAC,GAAG,EAAEK,SAAS,uBAAuB,EAAEG,UAAUG,IAAI,CAAC,MAAM,ySAAyS,CAAC;YAEzW;QACF;QAEA,0EAA0E;QAC1E,2DAA2D;QAC3D,MAAMC,UAAUN,QAAQO,OAAO,CAC7B,+BACA,CAAC,IAAI,EAAE9B,YAAY,IAAI,CAAC;QAE1B,IAAI6B,YAAYN,SAAS;YACvBF,UAAUJ,IAAI,CACZ,CAAC,GAAG,EAAEK,SAAS,yRAAyR,CAAC;YAE3S;QACF;QACAlB,KAAK2B,KAAK,CAACT,UAAUO;IACvB;IAEA,MAAM/B,qBAAqBM;IAE3B,OAAO;QAAEiB;IAAU;AACrB"}

package/src/migrations/latest/waf-log-group-removal/__snapshots__/migration.spec.ts.snap

@@ -0,0 +1,57 @@
+// Vitest Snapshot v1, https://vitest.dev/guide/snapshot.html
+
+exports[`waf-log-group-removal migration > should add a DESTROY removal policy and import to the rest api WAF log group 1`] = `
+"import { IAspect, Stack, RemovalPolicy } from 'aws-cdk-lib';
+import { LogGroup, RetentionDays } from 'aws-cdk-lib/aws-logs';
+import { Key } from 'aws-cdk-lib/aws-kms';
+import { CfnLoggingConfiguration } from 'aws-cdk-lib/aws-wafv2';
+import { Construct } from 'constructs';
+
+export class RestApi extends Construct {
+  constructor(scope: Construct, id: string) {
+    super(scope, id);
+    const logsKey = new Key(this, 'WebAclLogsKey', { enableKeyRotation: true });
+    // The construct has another log group sharing the encryptionKey shape, so
+    // the migration must scope its rewrite to the WAF log group only.
+    const accessLogs = new LogGroup(this, 'AccessLogs', {
+      retention: RetentionDays.ONE_YEAR,
+      encryptionKey: logsKey,
+    });
+    const wafLogGroup = new LogGroup(this, 'WebAclLogs', {
+      logGroupName: \`aws-waf-logs-\${apiName}-\${this.node.addr.slice(-8)}\`,
+      retention: RetentionDays.ONE_YEAR,
+      encryptionKey: logsKey,
+      // The log group name is deterministic, so retaining it on delete would
+      // orphan it and block re-creation (e.g. after a rolled-back deploy).
+      removalPolicy: RemovalPolicy.DESTROY,
+    });
+  }
+}
+"
+`;
+
+exports[`waf-log-group-removal migration > should add a DESTROY removal policy to the gateway WAF log group 1`] = `
+"import * as cdk from 'aws-cdk-lib';
+import * as kms from 'aws-cdk-lib/aws-kms';
+import * as logs from 'aws-cdk-lib/aws-logs';
+import * as wafv2 from 'aws-cdk-lib/aws-wafv2';
+import { Construct } from 'constructs';
+
+export class AgentCoreGateway extends Construct {
+  private createWebAcl(metricPrefix: string): wafv2.CfnWebACL {
+    const logsKey = new kms.Key(this, 'WebAclLogsKey', {
+      enableKeyRotation: true,
+    });
+    const wafLogGroup = new logs.LogGroup(this, 'WebAclLogs', {
+      logGroupName: \`aws-waf-logs-\${metricPrefix}-\${this.node.addr.slice(-8)}\`,
+      retention: logs.RetentionDays.ONE_YEAR,
+      encryptionKey: logsKey,
+      // The log group name is deterministic, so retaining it on delete would
+      // orphan it and block re-creation (e.g. after a rolled-back deploy).
+      removalPolicy: cdk.RemovalPolicy.DESTROY,
+    });
+    return undefined as any;
+  }
+}
+"
+`;

package/src/migrations/latest/waf-log-group-removal/metadata.json

@@ -0,0 +1,3 @@
+{
+  "description": "Set RemovalPolicy.DESTROY on WAF log groups in the vended AgentCoreGateway and REST API constructs so a rolled-back deploy does not orphan them"
+}

package/src/migrations/latest/waf-log-group-removal/migration.d.ts

@@ -0,0 +1,6 @@
+/**
+ * Copyright Amazon.com, Inc. or its affiliates. All Rights Reserved.
+ * SPDX-License-Identifier: Apache-2.0
+ */
+import type { MigrationReturnObject, Tree } from '@nx/devkit';
+export default function migration(tree: Tree): Promise<MigrationReturnObject>;

package/src/migrations/latest/waf-log-group-removal/migration.js

@@ -0,0 +1,77 @@
+/**
+ * Copyright Amazon.com, Inc. or its affiliates. All Rights Reserved.
+ * SPDX-License-Identifier: Apache-2.0
+ */ import { addDestructuredImport, insertViaGritQL, matchGritQL } from "../../../utils/ast.js";
+import { formatFilesInSubtree } from "../../../utils/format.js";
+import { PACKAGES_DIR, SHARED_CONSTRUCTS_DIR } from "../../../utils/shared-constructs-constants.js";
+/**
+ * Vended WAF log groups have a deterministic name (WAFv2 requires the
+ * `aws-waf-logs-` prefix, so the name can't be CloudFormation-generated) and,
+ * without an explicit removal policy, inherit CloudFormation's default RETAIN
+ * for log groups. A rolled-back or replaced deploy then orphans the log group,
+ * so the next deploy fails to create one of the same name. Set
+ * `RemovalPolicy.DESTROY` so it is torn down with the stack, matching the
+ * vended user-identity (Cognito) construct.
+ */ const CONSTRUCTS_SRC = `${PACKAGES_DIR}/${SHARED_CONSTRUCTS_DIR}/src`;
+const WAF_CONSTRUCTS = [
+    {
+        file: `${CONSTRUCTS_SRC}/core/agentcore-gateway/agentcore-gateway.ts`,
+        logGroupExpr: 'logs.LogGroup',
+        removalPolicyExpr: 'cdk.RemovalPolicy.DESTROY'
+    },
+    {
+        file: `${CONSTRUCTS_SRC}/core/api/rest-api.ts`,
+        logGroupExpr: 'LogGroup',
+        removalPolicyExpr: 'RemovalPolicy.DESTROY',
+        destructuredImport: 'RemovalPolicy'
+    }
+];
+const migrateConstruct = async (tree, construct, nextSteps)=>{
+    const { file, logGroupExpr } = construct;
+    if (!tree.exists(file)) {
+        // Construct not vended in this workspace - nothing to migrate.
+        return;
+    }
+    const contents = tree.read(file, 'utf-8') ?? '';
+    // The WAF web ACL (and its log group) is optional in some constructs, so it
+    // may be absent. Nothing to do if it is.
+    if (!contents.includes(`new ${logGroupExpr}(this, 'WebAclLogs'`)) {
+        return;
+    }
+    // Already migrated (or user-added a removal policy).
+    if (await matchGritQL(tree, file, `\`new ${logGroupExpr}(this, 'WebAclLogs', { $props })\` where { $props <: contains \`removalPolicy\` }`)) {
+        return;
+    }
+    // Append the removal policy after the WAF log group's `encryptionKey`
+    // property. The rewrite is scoped to the `WebAclLogs` LogGroup because a
+    // construct can have other log groups sharing the `encryptionKey: logsKey`
+    // shape (e.g. the rest api's access logs).
+    const added = await insertViaGritQL(tree, file, `\`new ${logGroupExpr}(this, 'WebAclLogs', { $props })\` where {
+  $props <: contains \`encryptionKey: logsKey\` as $enc,
+  $enc => \`encryptionKey: logsKey,
+      __GRIT_INSERT_PLACEHOLDER__\`
+}`, `// The log group name is deterministic, so retaining it on delete would
+      // orphan it and block re-creation (e.g. after a rolled-back deploy).
+      removalPolicy: ${construct.removalPolicyExpr}`);
+    if (!added) {
+        nextSteps.push(`${file}: could not add a removal policy to the WAF log group automatically - it may have diverged from the generated shape. Add \`removalPolicy: ${construct.removalPolicyExpr}\` to the \`new ${logGroupExpr}(this, 'WebAclLogs', ...)\` call so a rolled-back deploy does not orphan the log group.`);
+        return;
+    }
+    if (construct.destructuredImport) {
+        await addDestructuredImport(tree, file, [
+            construct.destructuredImport
+        ], 'aws-cdk-lib');
+    }
+};
+export default async function migration(tree) {
+    const nextSteps = [];
+    for (const construct of WAF_CONSTRUCTS){
+        await migrateConstruct(tree, construct, nextSteps);
+    }
+    await formatFilesInSubtree(tree);
+    return {
+        nextSteps
+    };
+}
+
+//# sourceMappingURL=migration.js.map

package/src/migrations/latest/waf-log-group-removal/migration.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../../../../../../../packages/nx-plugin/src/migrations/latest/waf-log-group-removal/migration.ts"],"sourcesContent":["/**\n * Copyright Amazon.com, Inc. or its affiliates. All Rights Reserved.\n * SPDX-License-Identifier: Apache-2.0\n */\nimport type { MigrationReturnObject, Tree } from '@nx/devkit';\nimport {\n  addDestructuredImport,\n  insertViaGritQL,\n  matchGritQL,\n} from '../../../utils/ast';\nimport { formatFilesInSubtree } from '../../../utils/format';\nimport {\n  PACKAGES_DIR,\n  SHARED_CONSTRUCTS_DIR,\n} from '../../../utils/shared-constructs-constants';\n\n/**\n * Vended WAF log groups have a deterministic name (WAFv2 requires the\n * `aws-waf-logs-` prefix, so the name can't be CloudFormation-generated) and,\n * without an explicit removal policy, inherit CloudFormation's default RETAIN\n * for log groups. A rolled-back or replaced deploy then orphans the log group,\n * so the next deploy fails to create one of the same name. Set\n * `RemovalPolicy.DESTROY` so it is torn down with the stack, matching the\n * vended user-identity (Cognito) construct.\n */\n\nconst CONSTRUCTS_SRC = `${PACKAGES_DIR}/${SHARED_CONSTRUCTS_DIR}/src`;\n\n/**\n * A vended construct carrying a WAF log group. They differ in how the log\n * group is constructed and how `cdk` is imported: the gateway namespaces both\n * (`logs.LogGroup`, `cdk.RemovalPolicy`), the rest api destructures both\n * (`LogGroup`, `RemovalPolicy` — the latter added by this migration when\n * absent).\n */\ninterface WafConstruct {\n  file: string;\n  /** How `LogGroup` is referenced in this file (`LogGroup` or `logs.LogGroup`). */\n  logGroupExpr: string;\n  /** The removal policy expression, matching the file's import style. */\n  removalPolicyExpr: string;\n  /** When set, ensure this destructured import from `aws-cdk-lib`. */\n  destructuredImport?: string;\n}\n\nconst WAF_CONSTRUCTS: WafConstruct[] = [\n  {\n    file: `${CONSTRUCTS_SRC}/core/agentcore-gateway/agentcore-gateway.ts`,\n    logGroupExpr: 'logs.LogGroup',\n    removalPolicyExpr: 'cdk.RemovalPolicy.DESTROY',\n  },\n  {\n    file: `${CONSTRUCTS_SRC}/core/api/rest-api.ts`,\n    logGroupExpr: 'LogGroup',\n    removalPolicyExpr: 'RemovalPolicy.DESTROY',\n    destructuredImport: 'RemovalPolicy',\n  },\n];\n\nconst migrateConstruct = async (\n  tree: Tree,\n  construct: WafConstruct,\n  nextSteps: string[],\n): Promise<void> => {\n  const { file, logGroupExpr } = construct;\n  if (!tree.exists(file)) {\n    // Construct not vended in this workspace - nothing to migrate.\n    return;\n  }\n\n  const contents = tree.read(file, 'utf-8') ?? '';\n\n  // The WAF web ACL (and its log group) is optional in some constructs, so it\n  // may be absent. Nothing to do if it is.\n  if (!contents.includes(`new ${logGroupExpr}(this, 'WebAclLogs'`)) {\n    return;\n  }\n\n  // Already migrated (or user-added a removal policy).\n  if (\n    await matchGritQL(\n      tree,\n      file,\n      `\\`new ${logGroupExpr}(this, 'WebAclLogs', { $props })\\` where { $props <: contains \\`removalPolicy\\` }`,\n    )\n  ) {\n    return;\n  }\n\n  // Append the removal policy after the WAF log group's `encryptionKey`\n  // property. The rewrite is scoped to the `WebAclLogs` LogGroup because a\n  // construct can have other log groups sharing the `encryptionKey: logsKey`\n  // shape (e.g. the rest api's access logs).\n  const added = await insertViaGritQL(\n    tree,\n    file,\n    `\\`new ${logGroupExpr}(this, 'WebAclLogs', { $props })\\` where {\n  $props <: contains \\`encryptionKey: logsKey\\` as $enc,\n  $enc => \\`encryptionKey: logsKey,\n      __GRIT_INSERT_PLACEHOLDER__\\`\n}`,\n    `// The log group name is deterministic, so retaining it on delete would\n      // orphan it and block re-creation (e.g. after a rolled-back deploy).\n      removalPolicy: ${construct.removalPolicyExpr}`,\n  );\n\n  if (!added) {\n    nextSteps.push(\n      `${file}: could not add a removal policy to the WAF log group automatically - it may have diverged from the generated shape. Add \\`removalPolicy: ${construct.removalPolicyExpr}\\` to the \\`new ${logGroupExpr}(this, 'WebAclLogs', ...)\\` call so a rolled-back deploy does not orphan the log group.`,\n    );\n    return;\n  }\n\n  if (construct.destructuredImport) {\n    await addDestructuredImport(\n      tree,\n      file,\n      [construct.destructuredImport],\n      'aws-cdk-lib',\n    );\n  }\n};\n\nexport default async function migration(\n  tree: Tree,\n): Promise<MigrationReturnObject> {\n  const nextSteps: string[] = [];\n\n  for (const construct of WAF_CONSTRUCTS) {\n    await migrateConstruct(tree, construct, nextSteps);\n  }\n\n  await formatFilesInSubtree(tree);\n\n  return { nextSteps };\n}\n"],"names":["addDestructuredImport","insertViaGritQL","matchGritQL","formatFilesInSubtree","PACKAGES_DIR","SHARED_CONSTRUCTS_DIR","CONSTRUCTS_SRC","WAF_CONSTRUCTS","file","logGroupExpr","removalPolicyExpr","destructuredImport","migrateConstruct","tree","construct","nextSteps","exists","contents","read","includes","added","push","migration"],"mappings":"AAAA;;;CAGC,GAED,SACEA,qBAAqB,EACrBC,eAAe,EACfC,WAAW,QACN,wBAAqB;AAC5B,SAASC,oBAAoB,QAAQ,2BAAwB;AAC7D,SACEC,YAAY,EACZC,qBAAqB,QAChB,gDAA6C;AAEpD;;;;;;;;CAQC,GAED,MAAMC,iBAAiB,GAAGF,aAAa,CAAC,EAAEC,sBAAsB,IAAI,CAAC;AAmBrE,MAAME,iBAAiC;IACrC;QACEC,MAAM,GAAGF,eAAe,4CAA4C,CAAC;QACrEG,cAAc;QACdC,mBAAmB;IACrB;IACA;QACEF,MAAM,GAAGF,eAAe,qBAAqB,CAAC;QAC9CG,cAAc;QACdC,mBAAmB;QACnBC,oBAAoB;IACtB;CACD;AAED,MAAMC,mBAAmB,OACvBC,MACAC,WACAC;IAEA,MAAM,EAAEP,IAAI,EAAEC,YAAY,EAAE,GAAGK;IAC/B,IAAI,CAACD,KAAKG,MAAM,CAACR,OAAO;QACtB,+DAA+D;QAC/D;IACF;IAEA,MAAMS,WAAWJ,KAAKK,IAAI,CAACV,MAAM,YAAY;IAE7C,4EAA4E;IAC5E,yCAAyC;IACzC,IAAI,CAACS,SAASE,QAAQ,CAAC,CAAC,IAAI,EAAEV,aAAa,mBAAmB,CAAC,GAAG;QAChE;IACF;IAEA,qDAAqD;IACrD,IACE,MAAMP,YACJW,MACAL,MACA,CAAC,MAAM,EAAEC,aAAa,iFAAiF,CAAC,GAE1G;QACA;IACF;IAEA,sEAAsE;IACtE,yEAAyE;IACzE,2EAA2E;IAC3E,2CAA2C;IAC3C,MAAMW,QAAQ,MAAMnB,gBAClBY,MACAL,MACA,CAAC,MAAM,EAAEC,aAAa;;;;CAIzB,CAAC,EACE,CAAC;;qBAEgB,EAAEK,UAAUJ,iBAAiB,EAAE;IAGlD,IAAI,CAACU,OAAO;QACVL,UAAUM,IAAI,CACZ,GAAGb,KAAK,0IAA0I,EAAEM,UAAUJ,iBAAiB,CAAC,gBAAgB,EAAED,aAAa,uFAAuF,CAAC;QAEzS;IACF;IAEA,IAAIK,UAAUH,kBAAkB,EAAE;QAChC,MAAMX,sBACJa,MACAL,MACA;YAACM,UAAUH,kBAAkB;SAAC,EAC9B;IAEJ;AACF;AAEA,eAAe,eAAeW,UAC5BT,IAAU;IAEV,MAAME,YAAsB,EAAE;IAE9B,KAAK,MAAMD,aAAaP,eAAgB;QACtC,MAAMK,iBAAiBC,MAAMC,WAAWC;IAC1C;IAEA,MAAMZ,qBAAqBU;IAE3B,OAAO;QAAEE;IAAU;AACrB"}

package/src/migrations/v1.0.0-rc.50/0001-modernize-function-props-cast/metadata.json

@@ -0,0 +1,3 @@
+{
+  "description": "Replace the legacy angle-bracket FunctionProps type assertion with the modern as syntax in generated API constructs"
+}

package/src/migrations/v1.0.0-rc.50/0001-modernize-function-props-cast/migration.d.ts

@@ -0,0 +1,6 @@
+/**
+ * Copyright Amazon.com, Inc. or its affiliates. All Rights Reserved.
+ * SPDX-License-Identifier: Apache-2.0
+ */
+import { type MigrationReturnObject, type Tree } from '@nx/devkit';
+export default function migration(tree: Tree): Promise<MigrationReturnObject>;

package/src/migrations/v1.0.0-rc.50/0001-modernize-function-props-cast/migration.js

@@ -0,0 +1,65 @@
+/**
+ * Copyright Amazon.com, Inc. or its affiliates. All Rights Reserved.
+ * SPDX-License-Identifier: Apache-2.0
+ */ import { visitNotIgnoredFiles } from "@nx/devkit";
+import { formatFilesInSubtree } from "../../../utils/format.js";
+import { PACKAGES_DIR, SHARED_CONSTRUCTS_DIR } from "../../../utils/shared-constructs-constants.js";
+/**
+ * Replace the legacy angle-bracket FunctionProps type assertion with the modern as syntax in generated API constructs
+ *
+ * The legacy `<FunctionProps>{ ... }` cast form is not supported by GritQL's
+ * TypeScript parser, which silently breaks parsing (and therefore matching)
+ * for the entire containing file. Since several other migrations rely on
+ * GritQL to update these API construct files, this cast is replaced here with
+ * the equivalent, GritQL-compatible `{ ... } as FunctionProps` form. This is
+ * matched as an exact literal (rather than via GritQL) since GritQL cannot
+ * parse the file while the legacy cast is still present.
+ *
+ * How to write a migration:
+ * - https://nx.dev/docs/kb/migration-generators
+ * - What `nextSteps` means: https://nx.dev/docs/reference/devkit/MigrationReturnObject
+ *
+ * Guardrails:
+ * - Pattern-match before writing: skip files that have diverged from the shape
+ *   your generators produce and report them via `nextSteps`, or consider a
+ *   hybrid migration, rather than clobbering the user's changes.
+ * - Idempotent: re-running must be a no-op.
+ * - Format what you write: finish with `formatFilesInSubtree` so the files your
+ *   migration wrote are formatted correctly.
+ */ const APIS_APP_DIR = `${PACKAGES_DIR}/${SHARED_CONSTRUCTS_DIR}/src/app/apis`;
+const OLD_CAST_OPEN = 'defaultIntegrationOptions: <FunctionProps>{';
+const NEW_CAST_OPEN = 'defaultIntegrationOptions: {';
+const OLD_CAST_CLOSE = '\n      },\n      buildDefaultIntegration:';
+const NEW_CAST_CLOSE = '\n      } as FunctionProps,\n      buildDefaultIntegration:';
+export default async function migration(tree) {
+    const nextSteps = [];
+    if (!tree.exists(APIS_APP_DIR)) {
+        return {
+            nextSteps
+        };
+    }
+    const apiAppFiles = [];
+    visitNotIgnoredFiles(tree, APIS_APP_DIR, (filePath)=>{
+        apiAppFiles.push(filePath);
+    });
+    for (const filePath of apiAppFiles){
+        if (!filePath.endsWith('.ts') || filePath.endsWith('/index.ts')) {
+            continue;
+        }
+        const contents = tree.read(filePath, 'utf-8') ?? '';
+        if (!contents.includes(OLD_CAST_OPEN)) {
+            continue;
+        }
+        if (!contents.includes(OLD_CAST_CLOSE)) {
+            nextSteps.push(`${filePath}: the defaultIntegrationOptions cast has diverged from the generated shape - left untouched. Manually replace \`<FunctionProps>{ ... }\` with \`{ ... } as FunctionProps\`.`);
+            continue;
+        }
+        tree.write(filePath, contents.replace(OLD_CAST_OPEN, NEW_CAST_OPEN).replace(OLD_CAST_CLOSE, NEW_CAST_CLOSE));
+    }
+    await formatFilesInSubtree(tree);
+    return {
+        nextSteps
+    };
+}
+
+//# sourceMappingURL=migration.js.map

package/src/migrations/v1.0.0-rc.50/0001-modernize-function-props-cast/migration.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../../../../../../../packages/nx-plugin/src/migrations/v1.0.0-rc.50/0001-modernize-function-props-cast/migration.ts"],"sourcesContent":["/**\n * Copyright Amazon.com, Inc. or its affiliates. All Rights Reserved.\n * SPDX-License-Identifier: Apache-2.0\n */\nimport {\n  type MigrationReturnObject,\n  type Tree,\n  visitNotIgnoredFiles,\n} from '@nx/devkit';\nimport { formatFilesInSubtree } from '../../../utils/format';\nimport {\n  PACKAGES_DIR,\n  SHARED_CONSTRUCTS_DIR,\n} from '../../../utils/shared-constructs-constants';\n\n/**\n * Replace the legacy angle-bracket FunctionProps type assertion with the modern as syntax in generated API constructs\n *\n * The legacy `<FunctionProps>{ ... }` cast form is not supported by GritQL's\n * TypeScript parser, which silently breaks parsing (and therefore matching)\n * for the entire containing file. Since several other migrations rely on\n * GritQL to update these API construct files, this cast is replaced here with\n * the equivalent, GritQL-compatible `{ ... } as FunctionProps` form. This is\n * matched as an exact literal (rather than via GritQL) since GritQL cannot\n * parse the file while the legacy cast is still present.\n *\n * How to write a migration:\n * - https://nx.dev/docs/kb/migration-generators\n * - What `nextSteps` means: https://nx.dev/docs/reference/devkit/MigrationReturnObject\n *\n * Guardrails:\n * - Pattern-match before writing: skip files that have diverged from the shape\n *   your generators produce and report them via `nextSteps`, or consider a\n *   hybrid migration, rather than clobbering the user's changes.\n * - Idempotent: re-running must be a no-op.\n * - Format what you write: finish with `formatFilesInSubtree` so the files your\n *   migration wrote are formatted correctly.\n */\n\nconst APIS_APP_DIR = `${PACKAGES_DIR}/${SHARED_CONSTRUCTS_DIR}/src/app/apis`;\n\nconst OLD_CAST_OPEN = 'defaultIntegrationOptions: <FunctionProps>{';\nconst NEW_CAST_OPEN = 'defaultIntegrationOptions: {';\nconst OLD_CAST_CLOSE = '\\n      },\\n      buildDefaultIntegration:';\nconst NEW_CAST_CLOSE =\n  '\\n      } as FunctionProps,\\n      buildDefaultIntegration:';\n\nexport default async function migration(\n  tree: Tree,\n): Promise<MigrationReturnObject> {\n  const nextSteps: string[] = [];\n\n  if (!tree.exists(APIS_APP_DIR)) {\n    return { nextSteps };\n  }\n\n  const apiAppFiles: string[] = [];\n  visitNotIgnoredFiles(tree, APIS_APP_DIR, (filePath) => {\n    apiAppFiles.push(filePath);\n  });\n\n  for (const filePath of apiAppFiles) {\n    if (!filePath.endsWith('.ts') || filePath.endsWith('/index.ts')) {\n      continue;\n    }\n    const contents = tree.read(filePath, 'utf-8') ?? '';\n    if (!contents.includes(OLD_CAST_OPEN)) {\n      // Already migrated, or doesn't use this shape.\n      continue;\n    }\n    if (!contents.includes(OLD_CAST_CLOSE)) {\n      nextSteps.push(\n        `${filePath}: the defaultIntegrationOptions cast has diverged from the generated shape - left untouched. Manually replace \\`<FunctionProps>{ ... }\\` with \\`{ ... } as FunctionProps\\`.`,\n      );\n      continue;\n    }\n    tree.write(\n      filePath,\n      contents\n        .replace(OLD_CAST_OPEN, NEW_CAST_OPEN)\n        .replace(OLD_CAST_CLOSE, NEW_CAST_CLOSE),\n    );\n  }\n\n  await formatFilesInSubtree(tree);\n\n  return { nextSteps };\n}\n"],"names":["visitNotIgnoredFiles","formatFilesInSubtree","PACKAGES_DIR","SHARED_CONSTRUCTS_DIR","APIS_APP_DIR","OLD_CAST_OPEN","NEW_CAST_OPEN","OLD_CAST_CLOSE","NEW_CAST_CLOSE","migration","tree","nextSteps","exists","apiAppFiles","filePath","push","endsWith","contents","read","includes","write","replace"],"mappings":"AAAA;;;CAGC,GACD,SAGEA,oBAAoB,QACf,aAAa;AACpB,SAASC,oBAAoB,QAAQ,2BAAwB;AAC7D,SACEC,YAAY,EACZC,qBAAqB,QAChB,gDAA6C;AAEpD;;;;;;;;;;;;;;;;;;;;;;CAsBC,GAED,MAAMC,eAAe,GAAGF,aAAa,CAAC,EAAEC,sBAAsB,aAAa,CAAC;AAE5E,MAAME,gBAAgB;AACtB,MAAMC,gBAAgB;AACtB,MAAMC,iBAAiB;AACvB,MAAMC,iBACJ;AAEF,eAAe,eAAeC,UAC5BC,IAAU;IAEV,MAAMC,YAAsB,EAAE;IAE9B,IAAI,CAACD,KAAKE,MAAM,CAACR,eAAe;QAC9B,OAAO;YAAEO;QAAU;IACrB;IAEA,MAAME,cAAwB,EAAE;IAChCb,qBAAqBU,MAAMN,cAAc,CAACU;QACxCD,YAAYE,IAAI,CAACD;IACnB;IAEA,KAAK,MAAMA,YAAYD,YAAa;QAClC,IAAI,CAACC,SAASE,QAAQ,CAAC,UAAUF,SAASE,QAAQ,CAAC,cAAc;YAC/D;QACF;QACA,MAAMC,WAAWP,KAAKQ,IAAI,CAACJ,UAAU,YAAY;QACjD,IAAI,CAACG,SAASE,QAAQ,CAACd,gBAAgB;YAErC;QACF;QACA,IAAI,CAACY,SAASE,QAAQ,CAACZ,iBAAiB;YACtCI,UAAUI,IAAI,CACZ,GAAGD,SAAS,2KAA2K,CAAC;YAE1L;QACF;QACAJ,KAAKU,KAAK,CACRN,UACAG,SACGI,OAAO,CAAChB,eAAeC,eACvBe,OAAO,CAACd,gBAAgBC;IAE/B;IAEA,MAAMP,qBAAqBS;IAE3B,OAAO;QAAEC;IAAU;AACrB"}

package/src/migrations/v1.0.0-rc.50/0002-restrict-cors-to-custom-domains/metadata.json

@@ -0,0 +1,3 @@
+{
+  "description": "Include CloudFront custom domain aliases in restrictCorsTo and UserIdentity callback URLs"
+}

package/src/migrations/v1.0.0-rc.50/0002-restrict-cors-to-custom-domains/migration.d.ts

@@ -0,0 +1,6 @@
+/**
+ * Copyright Amazon.com, Inc. or its affiliates. All Rights Reserved.
+ * SPDX-License-Identifier: Apache-2.0
+ */
+import { type MigrationReturnObject, type Tree } from '@nx/devkit';
+export default function migration(tree: Tree): Promise<MigrationReturnObject>;

package/src/migrations/v1.0.0-rc.50/0002-restrict-cors-to-custom-domains/migration.js

@@ -0,0 +1,108 @@
+/**
+ * Copyright Amazon.com, Inc. or its affiliates. All Rights Reserved.
+ * SPDX-License-Identifier: Apache-2.0
+ */ import { visitNotIgnoredFiles } from "@nx/devkit";
+import { addDestructuredImport, addStarExport, applyGritQL } from "../../../utils/ast.js";
+import { formatFilesInSubtree } from "../../../utils/format.js";
+import { isEsmWorkspace } from "../../../utils/module-format.js";
+import { PACKAGES_DIR, SHARED_CONSTRUCTS_DIR } from "../../../utils/shared-constructs-constants.js";
+/**
+ * Include CloudFront custom domain aliases in restrictCorsTo and UserIdentity callback URLs
+ *
+ * How to write a migration:
+ * - https://nx.dev/docs/kb/migration-generators
+ * - What `nextSteps` means: https://nx.dev/docs/reference/devkit/MigrationReturnObject
+ *
+ * Guardrails:
+ * - Pattern-match before writing: skip files that have diverged from the shape
+ *   your generators produce and report them via `nextSteps`, rather than
+ *   clobbering the user's changes.
+ * - Idempotent: re-running must be a no-op.
+ * - Format what you write: finish with `formatFilesInSubtree` so the files your
+ *   migration wrote are formatted correctly.
+ */ const CORE_DIR = `${PACKAGES_DIR}/${SHARED_CONSTRUCTS_DIR}/src/core`;
+const APIS_APP_DIR = `${PACKAGES_DIR}/${SHARED_CONSTRUCTS_DIR}/src/app/apis`;
+const CLOUDFRONT_CORE_FILE = `${CORE_DIR}/cloudfront.ts`;
+const CORE_INDEX_FILE = `${CORE_DIR}/index.ts`;
+const USER_IDENTITY_FILE = `${CORE_DIR}/user-identity.ts`;
+const CLOUDFRONT_HELPER_CONTENT = `import { CfnDistribution, Distribution } from 'aws-cdk-lib/aws-cloudfront';
+
+/**
+ * Finds the domain names associated with a CloudFront distribution.
+ *
+ * Includes the distribution's default \`*.cloudfront.net\` domain name plus any custom
+ * domain names (aliases) configured on it.
+ */
+export const findCloudFrontDomainNames = (
+  distribution: Distribution,
+): string[] => {
+  const cfnDistribution = distribution.node.defaultChild as CfnDistribution;
+  const distributionConfig =
+    cfnDistribution.distributionConfig as CfnDistribution.DistributionConfigProperty;
+  return [distribution.domainName, ...(distributionConfig.aliases ?? [])];
+};
+`;
+// Rewrites the `restrictCorsTo` body as produced by generators prior to this fix.
+const RESTRICT_CORS_TO_GRITQL_PATTERN = "`origins.map(($o) => typeof $o === 'string' ? $o : 'cloudFrontDistribution' in $o ? $branch1 : $branch2)` where { $branch1 <: contains `distributionDomainName`, $branch2 <: contains `distributionDomainName` } => raw`origins.flatMap(($o) => typeof $o === 'string' ? [$o] : findCloudFrontDomainNames('cloudFrontDistribution' in $o ? $o.cloudFrontDistribution : $o).map((domain) => \\`https://${domain}\\`))`";
+// Rewrites UserIdentity's callback/logout URL logic as produced by generators
+// prior to this fix.
+const USER_IDENTITY_CALLBACK_URLS_GRITQL_PATTERN = '`this.findCloudFrontDomainNames()` => `Stack.of(this).node.findAll().filter((child): child is Distribution => child instanceof Distribution).flatMap(findCloudFrontDomainNames)`';
+export default async function migration(tree) {
+    const nextSteps = [];
+    if (!tree.exists(CORE_INDEX_FILE)) {
+        // No common/constructs shared library in this workspace - nothing to migrate.
+        return {
+            nextSteps
+        };
+    }
+    const esm = isEsmWorkspace(tree);
+    const apiCloudFrontImportSpecifier = esm ? '../../core/cloudfront.js' : '../../core/cloudfront';
+    const coreCloudFrontImportSpecifier = esm ? './cloudfront.js' : './cloudfront';
+    if (!tree.exists(CLOUDFRONT_CORE_FILE)) {
+        tree.write(CLOUDFRONT_CORE_FILE, CLOUDFRONT_HELPER_CONTENT);
+    }
+    await addStarExport(tree, CORE_INDEX_FILE, './cloudfront.js');
+    const apiAppFiles = [];
+    visitNotIgnoredFiles(tree, APIS_APP_DIR, (filePath)=>{
+        apiAppFiles.push(filePath);
+    });
+    for (const filePath of apiAppFiles){
+        if (!filePath.endsWith('.ts') || filePath.endsWith('/index.ts')) {
+            continue;
+        }
+        const rewrote = await applyGritQL(tree, filePath, RESTRICT_CORS_TO_GRITQL_PATTERN);
+        if (rewrote) {
+            await addDestructuredImport(tree, filePath, [
+                'findCloudFrontDomainNames'
+            ], apiCloudFrontImportSpecifier);
+            continue;
+        }
+        const contents = tree.read(filePath, 'utf-8') ?? '';
+        if (!contents.includes('findCloudFrontDomainNames(')) {
+            nextSteps.push(`${filePath}: restrictCorsTo has diverged from the generated shape - left untouched. Manually apply the CloudFront custom domain fix (see findCloudFrontDomainNames in common/constructs/src/core/cloudfront.ts).`);
+        }
+    // Otherwise already migrated - silent skip.
+    }
+    if (tree.exists(USER_IDENTITY_FILE)) {
+        const rewrote = await applyGritQL(tree, USER_IDENTITY_FILE, USER_IDENTITY_CALLBACK_URLS_GRITQL_PATTERN);
+        if (rewrote) {
+            await applyGritQL(tree, USER_IDENTITY_FILE, "`import { CfnDistribution, Distribution } from 'aws-cdk-lib/aws-cloudfront'` => `import { Distribution } from 'aws-cdk-lib/aws-cloudfront';`");
+            await applyGritQL(tree, USER_IDENTITY_FILE, "or { `// Includes each distribution's default domain name plus any custom domain names (aliases) configured on it.` => ., `private findCloudFrontDomainNames = (): string[] => $body` => . }");
+            await addDestructuredImport(tree, USER_IDENTITY_FILE, [
+                'findCloudFrontDomainNames'
+            ], coreCloudFrontImportSpecifier);
+        } else {
+            const contents = tree.read(USER_IDENTITY_FILE, 'utf-8') ?? '';
+            if (!contents.includes('.flatMap(findCloudFrontDomainNames)')) {
+                nextSteps.push(`${USER_IDENTITY_FILE}: the callback URL logic has diverged from the generated shape - left untouched. Manually apply the shared findCloudFrontDomainNames helper (see common/constructs/src/core/cloudfront.ts).`);
+            }
+        // Otherwise already migrated - silent skip.
+        }
+    }
+    await formatFilesInSubtree(tree);
+    return {
+        nextSteps
+    };
+}
+
+//# sourceMappingURL=migration.js.map

package/src/migrations/v1.0.0-rc.50/0002-restrict-cors-to-custom-domains/migration.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../../../../../../../packages/nx-plugin/src/migrations/v1.0.0-rc.50/0002-restrict-cors-to-custom-domains/migration.ts"],"sourcesContent":["/**\n * Copyright Amazon.com, Inc. or its affiliates. All Rights Reserved.\n * SPDX-License-Identifier: Apache-2.0\n */\nimport {\n  type MigrationReturnObject,\n  type Tree,\n  visitNotIgnoredFiles,\n} from '@nx/devkit';\nimport {\n  addDestructuredImport,\n  addStarExport,\n  applyGritQL,\n} from '../../../utils/ast';\nimport { formatFilesInSubtree } from '../../../utils/format';\nimport { isEsmWorkspace } from '../../../utils/module-format';\nimport {\n  PACKAGES_DIR,\n  SHARED_CONSTRUCTS_DIR,\n} from '../../../utils/shared-constructs-constants';\n\n/**\n * Include CloudFront custom domain aliases in restrictCorsTo and UserIdentity callback URLs\n *\n * How to write a migration:\n * - https://nx.dev/docs/kb/migration-generators\n * - What `nextSteps` means: https://nx.dev/docs/reference/devkit/MigrationReturnObject\n *\n * Guardrails:\n * - Pattern-match before writing: skip files that have diverged from the shape\n *   your generators produce and report them via `nextSteps`, rather than\n *   clobbering the user's changes.\n * - Idempotent: re-running must be a no-op.\n * - Format what you write: finish with `formatFilesInSubtree` so the files your\n *   migration wrote are formatted correctly.\n */\n\nconst CORE_DIR = `${PACKAGES_DIR}/${SHARED_CONSTRUCTS_DIR}/src/core`;\nconst APIS_APP_DIR = `${PACKAGES_DIR}/${SHARED_CONSTRUCTS_DIR}/src/app/apis`;\nconst CLOUDFRONT_CORE_FILE = `${CORE_DIR}/cloudfront.ts`;\nconst CORE_INDEX_FILE = `${CORE_DIR}/index.ts`;\nconst USER_IDENTITY_FILE = `${CORE_DIR}/user-identity.ts`;\n\nconst CLOUDFRONT_HELPER_CONTENT = `import { CfnDistribution, Distribution } from 'aws-cdk-lib/aws-cloudfront';\n\n/**\n * Finds the domain names associated with a CloudFront distribution.\n *\n * Includes the distribution's default \\`*.cloudfront.net\\` domain name plus any custom\n * domain names (aliases) configured on it.\n */\nexport const findCloudFrontDomainNames = (\n  distribution: Distribution,\n): string[] => {\n  const cfnDistribution = distribution.node.defaultChild as CfnDistribution;\n  const distributionConfig =\n    cfnDistribution.distributionConfig as CfnDistribution.DistributionConfigProperty;\n  return [distribution.domainName, ...(distributionConfig.aliases ?? [])];\n};\n`;\n\n// Rewrites the `restrictCorsTo` body as produced by generators prior to this fix.\nconst RESTRICT_CORS_TO_GRITQL_PATTERN =\n  \"`origins.map(($o) => typeof $o === 'string' ? $o : 'cloudFrontDistribution' in $o ? $branch1 : $branch2)` where { $branch1 <: contains `distributionDomainName`, $branch2 <: contains `distributionDomainName` } => raw`origins.flatMap(($o) => typeof $o === 'string' ? [$o] : findCloudFrontDomainNames('cloudFrontDistribution' in $o ? $o.cloudFrontDistribution : $o).map((domain) => \\\\`https://${domain}\\\\`))`\";\n\n// Rewrites UserIdentity's callback/logout URL logic as produced by generators\n// prior to this fix.\nconst USER_IDENTITY_CALLBACK_URLS_GRITQL_PATTERN =\n  '`this.findCloudFrontDomainNames()` => `Stack.of(this).node.findAll().filter((child): child is Distribution => child instanceof Distribution).flatMap(findCloudFrontDomainNames)`';\n\nexport default async function migration(\n  tree: Tree,\n): Promise<MigrationReturnObject> {\n  const nextSteps: string[] = [];\n\n  if (!tree.exists(CORE_INDEX_FILE)) {\n    // No common/constructs shared library in this workspace - nothing to migrate.\n    return { nextSteps };\n  }\n\n  const esm = isEsmWorkspace(tree);\n  const apiCloudFrontImportSpecifier = esm\n    ? '../../core/cloudfront.js'\n    : '../../core/cloudfront';\n  const coreCloudFrontImportSpecifier = esm\n    ? './cloudfront.js'\n    : './cloudfront';\n\n  if (!tree.exists(CLOUDFRONT_CORE_FILE)) {\n    tree.write(CLOUDFRONT_CORE_FILE, CLOUDFRONT_HELPER_CONTENT);\n  }\n  await addStarExport(tree, CORE_INDEX_FILE, './cloudfront.js');\n\n  const apiAppFiles: string[] = [];\n  visitNotIgnoredFiles(tree, APIS_APP_DIR, (filePath) => {\n    apiAppFiles.push(filePath);\n  });\n\n  for (const filePath of apiAppFiles) {\n    if (!filePath.endsWith('.ts') || filePath.endsWith('/index.ts')) {\n      continue;\n    }\n    const rewrote = await applyGritQL(\n      tree,\n      filePath,\n      RESTRICT_CORS_TO_GRITQL_PATTERN,\n    );\n    if (rewrote) {\n      await addDestructuredImport(\n        tree,\n        filePath,\n        ['findCloudFrontDomainNames'],\n        apiCloudFrontImportSpecifier,\n      );\n      continue;\n    }\n    const contents = tree.read(filePath, 'utf-8') ?? '';\n    if (!contents.includes('findCloudFrontDomainNames(')) {\n      nextSteps.push(\n        `${filePath}: restrictCorsTo has diverged from the generated shape - left untouched. Manually apply the CloudFront custom domain fix (see findCloudFrontDomainNames in common/constructs/src/core/cloudfront.ts).`,\n      );\n    }\n    // Otherwise already migrated - silent skip.\n  }\n\n  if (tree.exists(USER_IDENTITY_FILE)) {\n    const rewrote = await applyGritQL(\n      tree,\n      USER_IDENTITY_FILE,\n      USER_IDENTITY_CALLBACK_URLS_GRITQL_PATTERN,\n    );\n    if (rewrote) {\n      await applyGritQL(\n        tree,\n        USER_IDENTITY_FILE,\n        \"`import { CfnDistribution, Distribution } from 'aws-cdk-lib/aws-cloudfront'` => `import { Distribution } from 'aws-cdk-lib/aws-cloudfront';`\",\n      );\n      await applyGritQL(\n        tree,\n        USER_IDENTITY_FILE,\n        \"or { `// Includes each distribution's default domain name plus any custom domain names (aliases) configured on it.` => ., `private findCloudFrontDomainNames = (): string[] => $body` => . }\",\n      );\n      await addDestructuredImport(\n        tree,\n        USER_IDENTITY_FILE,\n        ['findCloudFrontDomainNames'],\n        coreCloudFrontImportSpecifier,\n      );\n    } else {\n      const contents = tree.read(USER_IDENTITY_FILE, 'utf-8') ?? '';\n      if (!contents.includes('.flatMap(findCloudFrontDomainNames)')) {\n        nextSteps.push(\n          `${USER_IDENTITY_FILE}: the callback URL logic has diverged from the generated shape - left untouched. Manually apply the shared findCloudFrontDomainNames helper (see common/constructs/src/core/cloudfront.ts).`,\n        );\n      }\n      // Otherwise already migrated - silent skip.\n    }\n  }\n\n  await formatFilesInSubtree(tree);\n\n  return { nextSteps };\n}\n"],"names":["visitNotIgnoredFiles","addDestructuredImport","addStarExport","applyGritQL","formatFilesInSubtree","isEsmWorkspace","PACKAGES_DIR","SHARED_CONSTRUCTS_DIR","CORE_DIR","APIS_APP_DIR","CLOUDFRONT_CORE_FILE","CORE_INDEX_FILE","USER_IDENTITY_FILE","CLOUDFRONT_HELPER_CONTENT","RESTRICT_CORS_TO_GRITQL_PATTERN","USER_IDENTITY_CALLBACK_URLS_GRITQL_PATTERN","migration","tree","nextSteps","exists","esm","apiCloudFrontImportSpecifier","coreCloudFrontImportSpecifier","write","apiAppFiles","filePath","push","endsWith","rewrote","contents","read","includes"],"mappings":"AAAA;;;CAGC,GACD,SAGEA,oBAAoB,QACf,aAAa;AACpB,SACEC,qBAAqB,EACrBC,aAAa,EACbC,WAAW,QACN,wBAAqB;AAC5B,SAASC,oBAAoB,QAAQ,2BAAwB;AAC7D,SAASC,cAAc,QAAQ,kCAA+B;AAC9D,SACEC,YAAY,EACZC,qBAAqB,QAChB,gDAA6C;AAEpD;;;;;;;;;;;;;;CAcC,GAED,MAAMC,WAAW,GAAGF,aAAa,CAAC,EAAEC,sBAAsB,SAAS,CAAC;AACpE,MAAME,eAAe,GAAGH,aAAa,CAAC,EAAEC,sBAAsB,aAAa,CAAC;AAC5E,MAAMG,uBAAuB,GAAGF,SAAS,cAAc,CAAC;AACxD,MAAMG,kBAAkB,GAAGH,SAAS,SAAS,CAAC;AAC9C,MAAMI,qBAAqB,GAAGJ,SAAS,iBAAiB,CAAC;AAEzD,MAAMK,4BAA4B,CAAC;;;;;;;;;;;;;;;;AAgBnC,CAAC;AAED,kFAAkF;AAClF,MAAMC,kCACJ;AAEF,8EAA8E;AAC9E,qBAAqB;AACrB,MAAMC,6CACJ;AAEF,eAAe,eAAeC,UAC5BC,IAAU;IAEV,MAAMC,YAAsB,EAAE;IAE9B,IAAI,CAACD,KAAKE,MAAM,CAACR,kBAAkB;QACjC,8EAA8E;QAC9E,OAAO;YAAEO;QAAU;IACrB;IAEA,MAAME,MAAMf,eAAeY;IAC3B,MAAMI,+BAA+BD,MACjC,6BACA;IACJ,MAAME,gCAAgCF,MAClC,oBACA;IAEJ,IAAI,CAACH,KAAKE,MAAM,CAACT,uBAAuB;QACtCO,KAAKM,KAAK,CAACb,sBAAsBG;IACnC;IACA,MAAMX,cAAce,MAAMN,iBAAiB;IAE3C,MAAMa,cAAwB,EAAE;IAChCxB,qBAAqBiB,MAAMR,cAAc,CAACgB;QACxCD,YAAYE,IAAI,CAACD;IACnB;IAEA,KAAK,MAAMA,YAAYD,YAAa;QAClC,IAAI,CAACC,SAASE,QAAQ,CAAC,UAAUF,SAASE,QAAQ,CAAC,cAAc;YAC/D;QACF;QACA,MAAMC,UAAU,MAAMzB,YACpBc,MACAQ,UACAX;QAEF,IAAIc,SAAS;YACX,MAAM3B,sBACJgB,MACAQ,UACA;gBAAC;aAA4B,EAC7BJ;YAEF;QACF;QACA,MAAMQ,WAAWZ,KAAKa,IAAI,CAACL,UAAU,YAAY;QACjD,IAAI,CAACI,SAASE,QAAQ,CAAC,+BAA+B;YACpDb,UAAUQ,IAAI,CACZ,GAAGD,SAAS,qMAAqM,CAAC;QAEtN;IACA,4CAA4C;IAC9C;IAEA,IAAIR,KAAKE,MAAM,CAACP,qBAAqB;QACnC,MAAMgB,UAAU,MAAMzB,YACpBc,MACAL,oBACAG;QAEF,IAAIa,SAAS;YACX,MAAMzB,YACJc,MACAL,oBACA;YAEF,MAAMT,YACJc,MACAL,oBACA;YAEF,MAAMX,sBACJgB,MACAL,oBACA;gBAAC;aAA4B,EAC7BU;QAEJ,OAAO;YACL,MAAMO,WAAWZ,KAAKa,IAAI,CAAClB,oBAAoB,YAAY;YAC3D,IAAI,CAACiB,SAASE,QAAQ,CAAC,wCAAwC;gBAC7Db,UAAUQ,IAAI,CACZ,GAAGd,mBAAmB,2LAA2L,CAAC;YAEtN;QACA,4CAA4C;QAC9C;IACF;IAEA,MAAMR,qBAAqBa;IAE3B,OAAO;QAAEC;IAAU;AACrB"}

package/src/migrations/v1.0.0-rc.50/0003-terraform-bootstrap-adopt-existing-bucket/metadata.json

@@ -0,0 +1,3 @@
+{
+  "description": "Adopt an existing Terraform state bucket in the vended bootstrap script when its state object is missing"
+}

package/src/migrations/v1.0.0-rc.50/0003-terraform-bootstrap-adopt-existing-bucket/migration.d.ts

@@ -0,0 +1,6 @@
+/**
+ * Copyright Amazon.com, Inc. or its affiliates. All Rights Reserved.
+ * SPDX-License-Identifier: Apache-2.0
+ */
+import { type MigrationReturnObject, type Tree } from '@nx/devkit';
+export default function migration(tree: Tree): Promise<MigrationReturnObject>;