@aws/nx-plugin 1.0.0-rc.7 → 1.0.0-rc.71

package/src/utils/files/common/scripts/src/{stage-credentials → infra/stage-credentials}/cdk-command.ts.template

@@ -4,6 +4,10 @@
  * Defaults to --require-approval=never (standard for local dev deploys).
  * If the user explicitly passes --require-approval with any value, we
  * respect their choice and don't add the default.
+ *
+ * Pass --express to opt into CloudFormation express mode for faster
+ * iteration; it is not enabled by default so deploys wait for full
+ * resource stabilization.
  */
 export function buildCdkCommand(
   action: string,
@@ -12,7 +16,6 @@ export function buildCdkCommand(
   const hasRequireApproval = remainingArgs.some(
     (a) => a === '--require-approval' || a.startsWith('--require-approval='),
   );
-  return hasRequireApproval
-    ? ['cdk', action, ...remainingArgs]
-    : ['cdk', action, '--require-approval=never', ...remainingArgs];
+  const defaults = hasRequireApproval ? [] : ['--require-approval=never'];
+  return ['cdk', action, ...defaults, ...remainingArgs];
 }

package/src/utils/files/common/scripts/src/{stage-credentials → infra/stage-credentials}/run.ts.template

@@ -1,12 +1,12 @@
 import { spawnSync } from 'child_process';
 import stagesConfig from '<%= scopeAlias %>common-infra-config';
-import { parseStageName } from './stage-parser.js';
+import { parseStageName } from './stage-parser<% if (esm) { %>.js<% } %>';
 import {
   lookupCredentials,
   buildChildEnv,
   describeCredentials,
-} from './credentials.js';
-import { buildCdkCommand } from './cdk-command.js';
+} from './credentials<% if (esm) { %>.js<% } %>';
+import { buildCdkCommand } from './cdk-command<% if (esm) { %>.js<% } %>';
 
 const log = (msg: string) => console.error(`[infra-deploy] ${msg}`);
 

package/src/utils/files/common/scripts/src/rdb/mysql/wait-for-mysql-db.ts.template

@@ -0,0 +1,32 @@
+import { readFileSync } from 'fs';
+import { createConnection } from 'mariadb';
+
+const { port, dbName, dbUser, dbPassword, dbEngine } =
+  JSON.parse(readFileSync('config.json', 'utf-8')).localDev;
+
+const noop = () => undefined;
+const timeoutAt = Date.now() + 60000;
+
+while (Date.now() < timeoutAt) {
+  let conn: Awaited<ReturnType<typeof createConnection>> | undefined;
+  try {
+    conn = await createConnection({
+      host: 'localhost',
+      port: parseInt(port),
+      user: dbUser,
+      password: dbPassword,
+      database: dbName,
+      connectTimeout: 500,
+      allowPublicKeyRetrieval: true,
+    });
+    await conn.end();
+    console.log('Database is ready.');
+    process.exit(0);
+  } catch {
+    console.log('Database is not ready.');
+    await conn?.end().catch(noop);
+  }
+  await new Promise((r) => setTimeout(r, 200));
+}
+
+throw new Error(`Timed out waiting for ${dbEngine} on port ${port}`);

package/src/utils/files/common/scripts/src/rdb/postgres/wait-for-postgres-db.ts.template

@@ -0,0 +1,32 @@
+import { readFileSync } from 'fs';
+import { Client } from 'pg';
+
+const { port, dbName, dbUser, dbPassword, dbEngine } =
+  JSON.parse(readFileSync('config.json', 'utf-8')).localDev;
+
+const noop = () => undefined;
+const timeoutAt = Date.now() + 60000;
+
+while (Date.now() < timeoutAt) {
+  const client = new Client({
+    host: 'localhost',
+    port: parseInt(port),
+    user: dbUser,
+    password: dbPassword,
+    database: dbName,
+    connectionTimeoutMillis: 500,
+  });
+  client.on('error', noop);
+  try {
+    await client.connect();
+    await client.end();
+    console.log('Database is ready.');
+    process.exit(0);
+  } catch {
+    console.log('Database is not ready.');
+    await client.end().catch(noop);
+  }
+  await new Promise((r) => setTimeout(r, 200));
+}
+
+throw new Error(`Timed out waiting for ${dbEngine} on port ${port}`);

package/src/utils/files/common/scripts/src/rdb/shared/pull-image.ts.template

@@ -0,0 +1,16 @@
+import { spawnSync } from 'child_process';
+import { readFileSync } from 'fs';
+
+const { containerEngine, image } =
+  JSON.parse(readFileSync('config.json', 'utf-8')).localDev;
+
+const inspect = spawnSync(containerEngine, ['image', 'inspect', image], {
+  stdio: 'ignore',
+});
+
+if (inspect.status !== 0) {
+  const pull = spawnSync(containerEngine, ['pull', image], { stdio: 'inherit' });
+  if (pull.status !== 0) {
+    process.exit(pull.status ?? 1);
+  }
+}

package/src/utils/files/common/scripts/src/rdb/shared/start-container.ts.template

@@ -0,0 +1,115 @@
+import { spawn, spawnSync } from "child_process";
+import { readFileSync } from "fs";
+
+const {
+  containerEngine,
+  containerName,
+  image,
+  port,
+  dbName,
+  dbUser,
+  dbPassword,
+  dbEngine,
+} = JSON.parse(readFileSync("config.json", "utf-8")).localDev;
+
+const containerExists = (): boolean =>
+  spawnSync(containerEngine, ["container", "inspect", containerName], {
+    stdio: "ignore",
+  }).status === 0;
+
+const isRunning = (): boolean => {
+  const result = spawnSync(
+    containerEngine,
+    ["container", "inspect", "-f", "{{.State.Running}}", containerName],
+    { encoding: "utf-8" },
+  );
+  return result.status === 0 && result.stdout.trim() === "true";
+};
+
+// Ensure the image is available locally before starting the container.
+const ensureImage = (): void => {
+  const inspect = spawnSync(containerEngine, ["image", "inspect", image], {
+    stdio: "ignore",
+  });
+  if (inspect.status !== 0) {
+    const pull = spawnSync(containerEngine, ["pull", image], {
+      stdio: "inherit",
+    });
+    if (pull.status !== 0) process.exit(pull.status ?? 1);
+  }
+};
+
+ensureImage();
+
+if (containerExists()) {
+  if (!isRunning()) {
+    const start = spawnSync(containerEngine, ["start", containerName], {
+      stdio: "inherit",
+    });
+    if (start.status !== 0) process.exit(start.status ?? 1);
+  }
+} else {
+  const engineArgs =
+    dbEngine === "mysql"
+      ? [
+          "-v",
+          `${containerName}-data:/var/lib/mysql`,
+          "-e",
+          `MYSQL_DATABASE=${dbName}`,
+          "-e",
+          `MYSQL_ROOT_PASSWORD=${dbPassword}`,
+          "-p",
+          `${port}:3306`,
+        ]
+      : [
+          "-v",
+          `${containerName}-data:/var/lib/postgresql`,
+          "-e",
+          `POSTGRES_DB=${dbName}`,
+          "-e",
+          `POSTGRES_USER=${dbUser}`,
+          "-e",
+          `POSTGRES_PASSWORD=${dbPassword}`,
+          "-e",
+          "PGDATA=/var/lib/postgresql/17/docker",
+          "-p",
+          `${port}:5432`,
+        ];
+  const runArgs = [
+    "run",
+    ...(containerEngine === "docker" ? ["--rm"] : []),
+    "--name",
+    containerName,
+    "-d",
+    ...engineArgs,
+    image,
+  ];
+  const create = spawnSync(containerEngine, runArgs, { stdio: "inherit" });
+  if (create.status !== 0) process.exit(create.status ?? 1);
+}
+
+const logs = spawn(containerEngine, ["logs", "-f", containerName], {
+  stdio: ["ignore", "inherit", "inherit"],
+});
+
+let exiting = false;
+
+const cleanup = () => {
+  if (exiting) return;
+  exiting = true;
+  if (containerEngine === "docker") {
+    spawnSync(containerEngine, ["stop", containerName], { stdio: "ignore" });
+  } else {
+    spawnSync(containerEngine, ["rm", "-f", containerName], {
+      stdio: "ignore",
+    });
+  }
+  logs.kill();
+  process.exit(0);
+};
+
+process.on("SIGTERM", cleanup);
+process.on("SIGINT", cleanup);
+process.on("SIGHUP", cleanup);
+
+logs.on("exit", cleanup);

package/src/utils/files/common/shadcn/readme/README.md.template

@@ -5,9 +5,9 @@ This package centralises Shadcn UI components that are shared between your React
 - Components live under `packages/common/shadcn/src/components`
 - Utilities live under `packages/common/shadcn/src/lib`
 - Hooks live under `packages/common/shadcn/src/hooks`
-- Global styles are defined in `packages/common/shadcn/src/styles.css`
+- Global styles are defined in `packages/common/shadcn/src/styles/globals.css`
 
-The repository root contains a `components.json` configured to target this package, so you can add new components with:
+This package contains a `components.json`, so you can add new components by running the following from `packages/common/shadcn`:
 
 With npm:
 ```bash
@@ -29,4 +29,4 @@ With bun:
 bunx --bun shadcn@latest add <component>
 ```
 
-Run the command from the repository root (not `packages/common/shadcn`) so it picks up the root `components.json`.
+Running from this directory means any dependencies a component needs are installed into this package's `package.json`.

package/src/utils/files/common/shadcn/src/index.ts.template

@@ -1,2 +1,2 @@
-export * from './lib/utils.js';
-export * from './hooks/use-mobile.js';
+export * from './lib/utils<% if (esm) { %>.js<% } %>';
+export * from './hooks/use-mobile<% if (esm) { %>.js<% } %>';

package/src/utils/files/shadcn/components.json.template

@@ -5,7 +5,7 @@
   "tsx": true,
   "tailwind": {
     "config": "",
-    "css": "packages/common/shadcn/src/styles/globals.css",
+    "css": "src/styles/globals.css",
     "baseColor": "zinc",
     "cssVariables": true
   },

package/src/utils/files/terraform/src/core/asset-bucket/asset-bucket.tf.template

@@ -4,11 +4,11 @@ terraform {
   required_providers {
     aws = {
       source  = "hashicorp/aws"
-      version = "~> 6.0"
+      version = "<%- awsProviderVersion %>"
     }
     random = {
       source  = "hashicorp/random"
-      version = "~> 3.0"
+      version = "<%- randomProviderVersion %>"
     }
   }
 }
@@ -34,82 +34,59 @@ resource "random_string" "suffix" {
   upper   = false
 }
 
-# Access logs bucket for the asset bucket.
-resource "aws_s3_bucket" "access_logs" {
-  #checkov:skip=CKV2_AWS_61:Lifecycle configuration not required for access log bucket
-  #checkov:skip=CKV_AWS_144:Cross-region replication not required for access log bucket
-  #checkov:skip=CKV2_AWS_62:Event notifications not required for access log bucket
-  #checkov:skip=CKV_AWS_18:Access logging the access log bucket would create a cycle
-  #checkov:skip=CKV_AWS_145:AES256 (S3-managed) encryption is sufficient for access logs
-  bucket        = "${var.bucket_name_prefix}-logs-${data.aws_caller_identity.current.account_id}-${data.aws_region.current.region}-${random_string.suffix.result}"
-  force_destroy = true
-
-  tags = var.tags
+locals {
+  # Delivery source/destination names have a 60 character maximum. Truncate the
+  # bucket name prefix so the delivery names stay within the limit.
+  access_logs_name_prefix = substr(var.bucket_name_prefix, 0, 16)
 }
 
-resource "aws_s3_bucket_versioning" "access_logs" {
-  bucket = aws_s3_bucket.access_logs.id
-  versioning_configuration {
-    status = "Enabled"
-  }
-}
-
-resource "aws_s3_bucket_server_side_encryption_configuration" "access_logs" {
-  bucket = aws_s3_bucket.access_logs.id
-
-  rule {
-    apply_server_side_encryption_by_default {
-      sse_algorithm = "AES256"
-    }
-  }
-}
-
-resource "aws_s3_bucket_public_access_block" "access_logs" {
-  bucket = aws_s3_bucket.access_logs.id
-
-  block_public_acls       = true
-  block_public_policy     = true
-  ignore_public_acls      = true
-  restrict_public_buckets = true
-}
-
-resource "aws_s3_bucket_policy" "access_logs" {
-  bucket = aws_s3_bucket.access_logs.id
+# KMS key encrypting the server access logs delivered to CloudWatch Logs.
+resource "aws_kms_key" "access_logs" {
+  description             = "KMS key for ${var.bucket_name_prefix} asset bucket access logs"
+  enable_key_rotation     = true
+  deletion_window_in_days = 7
 
   policy = jsonencode({
     Version = "2012-10-17"
     Statement = [
       {
-        Sid       = "DenyInsecureConnections"
-        Effect    = "Deny"
-        Principal = "*"
-        Action    = "s3:*"
-        Resource = [
-          aws_s3_bucket.access_logs.arn,
-          "${aws_s3_bucket.access_logs.arn}/*"
-        ]
-        Condition = {
-          Bool = {
-            "aws:SecureTransport" = "false"
-          }
-        }
+        Sid       = "EnableIAMUserPermissions"
+        Effect    = "Allow"
+        Principal = { AWS = "arn:aws:iam::${data.aws_caller_identity.current.account_id}:root" }
+        Action    = "kms:*"
+        Resource  = "*"
       },
       {
-        Sid       = "AllowS3LogDelivery"
+        Sid       = "AllowCloudWatchLogs"
         Effect    = "Allow"
-        Principal = {
-          Service = "logging.s3.amazonaws.com"
-        }
-        Action   = "s3:PutObject"
-        Resource = "${aws_s3_bucket.access_logs.arn}/*"
+        Principal = { Service = "logs.${data.aws_region.current.region}.amazonaws.com" }
+        Action = [
+          "kms:Encrypt",
+          "kms:Decrypt",
+          "kms:ReEncrypt*",
+          "kms:GenerateDataKey*",
+          "kms:DescribeKey"
+        ]
+        Resource = "*"
         Condition = {
-          StringEquals = {
-            "aws:SourceAccount" = data.aws_caller_identity.current.account_id
+          ArnLike = {
+            "kms:EncryptionContext:aws:logs:arn" = "arn:aws:logs:${data.aws_region.current.region}:${data.aws_caller_identity.current.account_id}:log-group:*"
           }
         }
       }
     ]
   })
+
+  tags = var.tags
+}
+
+# CloudWatch log group receiving the asset bucket server access logs.
+resource "aws_cloudwatch_log_group" "access_logs" {
+  name              = "/aws/s3/${var.bucket_name_prefix}-access-logs-${random_string.suffix.result}"
+  retention_in_days = 365
+  kms_key_id        = aws_kms_key.access_logs.arn
+
+  tags = var.tags
 }
 
 # Shared asset bucket
@@ -118,6 +95,7 @@ resource "aws_s3_bucket" "assets" {
   #checkov:skip=CKV_AWS_144:Cross-region replication not required for asset bucket
   #checkov:skip=CKV2_AWS_62:Event notifications not required for asset bucket
   #checkov:skip=CKV_AWS_145:AES256 (S3-managed) encryption is sufficient for build artefacts
+  #checkov:skip=CKV_AWS_18:Server access logs are delivered to CloudWatch Logs (see aws_cloudwatch_log_delivery.assets)
   bucket        = "${var.bucket_name_prefix}-${data.aws_caller_identity.current.account_id}-${data.aws_region.current.region}-${random_string.suffix.result}"
   force_destroy = true
 
@@ -150,11 +128,24 @@ resource "aws_s3_bucket_public_access_block" "assets" {
   restrict_public_buckets = true
 }
 
-resource "aws_s3_bucket_logging" "assets" {
-  bucket = aws_s3_bucket.assets.id
+# Deliver the asset bucket's server access logs to CloudWatch Logs.
+resource "aws_cloudwatch_log_delivery_source" "assets" {
+  name         = "${local.access_logs_name_prefix}-access-logs-source-${random_string.suffix.result}"
+  log_type     = "S3_SERVER_ACCESS_LOGS"
+  resource_arn = aws_s3_bucket.assets.arn
+}
+
+resource "aws_cloudwatch_log_delivery_destination" "assets" {
+  name = "${local.access_logs_name_prefix}-access-logs-dest-${random_string.suffix.result}"
+
+  delivery_destination_configuration {
+    destination_resource_arn = aws_cloudwatch_log_group.access_logs.arn
+  }
+}
 
-  target_bucket = aws_s3_bucket.access_logs.id
-  target_prefix = "s3-access-logs/"
+resource "aws_cloudwatch_log_delivery" "assets" {
+  delivery_source_name     = aws_cloudwatch_log_delivery_source.assets.name
+  delivery_destination_arn = aws_cloudwatch_log_delivery_destination.assets.arn
 }
 
 resource "aws_s3_bucket_policy" "assets" {
@@ -192,12 +183,12 @@ output "bucket_arn" {
   value       = aws_s3_bucket.assets.arn
 }
 
-output "access_logs_bucket_name" {
-  description = "Name of the access-logs bucket that receives S3 access logs for the asset bucket."
-  value       = aws_s3_bucket.access_logs.id
+output "access_logs_log_group_name" {
+  description = "Name of the CloudWatch log group that receives S3 server access logs for the asset bucket."
+  value       = aws_cloudwatch_log_group.access_logs.name
 }
 
-output "access_logs_bucket_arn" {
-  description = "ARN of the access-logs bucket"
-  value       = aws_s3_bucket.access_logs.arn
+output "access_logs_log_group_arn" {
+  description = "ARN of the CloudWatch log group that receives S3 server access logs for the asset bucket."
+  value       = aws_cloudwatch_log_group.access_logs.arn
 }

package/src/utils/files/terraform/src/core/runtime-config/appconfig/appconfig.tf.template

@@ -4,7 +4,7 @@ terraform {
   required_providers {
     aws = {
       source  = "hashicorp/aws"
-      version = ">= 5.0"
+      version = "<%- awsProviderVersion %>"
     }
   }
 }

package/src/utils/files/terraform/src/core/runtime-config/appconfig-deployment/appconfig-deployment.tf.template

@@ -4,15 +4,15 @@ terraform {
   required_providers {
     aws = {
       source  = "hashicorp/aws"
-      version = ">= 5.0"
+      version = "<%- awsProviderVersion %>"
     }
     local = {
       source  = "hashicorp/local"
-      version = "~> 2.0"
+      version = "<%- localProviderVersion %>"
     }
     null = {
       source  = "hashicorp/null"
-      version = ">= 3.0"
+      version = "<%- nullProviderVersion %>"
     }
   }
 }
@@ -65,12 +65,13 @@ resource "null_resource" "aggregate_namespace" {
     command = <<-EOT
       uv run python -c "
 import json
+import os
 import pathlib
 import sys
 
-namespace = '${each.key}'
-entries_dir = pathlib.Path('${local.entries_dir}') / namespace
-output_file = pathlib.Path('${local.config_dir}') / f'{namespace}.json'
+namespace = os.environ['NAMESPACE']
+entries_dir = pathlib.Path(os.environ['ENTRIES_DIR']) / namespace
+output_file = pathlib.Path(os.environ['CONFIG_DIR']) / f'{namespace}.json'
 
 def deep_merge(target: dict, source: dict) -> dict:
     for k, v in source.items():
@@ -103,6 +104,11 @@ output_file.write_text(json.dumps(merged, indent=2))
 print(f'Aggregated {namespace}.json with {len(merged)} section(s)')
 "
     EOT
+    environment = {
+      NAMESPACE   = each.key
+      ENTRIES_DIR = local.entries_dir
+      CONFIG_DIR  = local.config_dir
+    }
   }
 }
 

package/src/utils/files/terraform/src/core/runtime-config/entry/entry.tf.template

@@ -2,7 +2,7 @@ terraform {
   required_providers {
     local = {
       source  = "hashicorp/local"
-      version = "~> 2.0"
+      version = "<%- localProviderVersion %>"
     }
   }
 }

package/src/utils/files/terraform/src/core/runtime-config/read/read.tf.template

@@ -2,11 +2,11 @@ terraform {
   required_providers {
     local = {
       source  = "hashicorp/local"
-      version = "~> 2.0"
+      version = "<%- localProviderVersion %>"
     }
     null = {
       source  = "hashicorp/null"
-      version = ">= 3.0"
+      version = "<%- nullProviderVersion %>"
     }
   }
 }
@@ -38,11 +38,12 @@ resource "null_resource" "aggregate_namespace" {
     command = <<-EOT
       uv run python -c "
 import json
+import os
 import pathlib
 import sys
 
-entries_dir = pathlib.Path('${local.entries_dir}')
-output_file = pathlib.Path('${local.namespace_path}')
+entries_dir = pathlib.Path(os.environ['ENTRIES_DIR'])
+output_file = pathlib.Path(os.environ['NAMESPACE_PATH'])
 
 def deep_merge(target: dict, source: dict) -> dict:
     for k, v in source.items():
@@ -71,6 +72,10 @@ output_file.parent.mkdir(parents=True, exist_ok=True)
 output_file.write_text(json.dumps(merged, indent=2))
 "
     EOT
+    environment = {
+      ENTRIES_DIR    = local.entries_dir
+      NAMESPACE_PATH = local.namespace_path
+    }
   }
 }
 

package/src/utils/files/website/hooks/sigv4/useSigV4.tsx.template

@@ -33,7 +33,7 @@ export const useSigV4 = (): SigV4Client => {
     {},
   );
 
-  const skipSigning = !cognitoProps && import.meta.env.MODE === 'serve-local';
+  const skipSigning = !cognitoProps && import.meta.env.MODE === 'local-dev';
 
   const withCachedCredentials = useCallback(
     async (

package/src/utils/format.d.ts

@@ -2,8 +2,14 @@
  * Copyright Amazon.com, Inc. or its affiliates. All Rights Reserved.
  * SPDX-License-Identifier: Apache-2.0
  */
-import type { Tree } from '@nx/devkit';
-export declare const DEFAULT_BIOME_CONFIG: {
+import { type Tree } from '@nx/devkit';
+/**
+ * The biome.json vended into a new workspace. The pnpm catalog resolver is only
+ * included on pnpm workspaces, since `experimentalPnpmCatalogs` is Biome's only
+ * catalog resolver and reads `pnpm-workspace.yaml` exclusively — it does nothing
+ * for yarn or bun catalogs, so vending it there would be misleading.
+ */
+export declare const getDefaultBiomeConfig: (tree: Tree) => {
     $schema: string;
     root: boolean;
     formatter: {
@@ -13,6 +19,9 @@ export declare const DEFAULT_BIOME_CONFIG: {
         lineWidth: number;
     };
     javascript: {
+        resolver?: {
+            experimentalPnpmCatalogs: boolean;
+        };
         formatter: {
             quoteStyle: string;
             trailingCommas: string;
@@ -29,7 +38,7 @@ export declare const DEFAULT_BIOME_CONFIG: {
     linter: {
         enabled: boolean;
         rules: {
-            recommended: boolean;
+            preset: string;
             correctness: {
                 noUndeclaredDependencies: string;
             };
@@ -45,10 +54,36 @@ export declare const DEFAULT_BIOME_CONFIG: {
     files: {
         includes: string[];
     };
+    overrides: {
+        includes: string[];
+        linter: {
+            rules: {
+                correctness: {
+                    noUndeclaredDependencies: string;
+                };
+            };
+        };
+    }[];
 };
+export interface FormatFilesInSubtreeOptions {
+    /**
+     * Paths, relative to the workspace root, to leave untouched.
+     *
+     * For files another tool owns the formatting of: formatting them here makes
+     * generation non-idempotent, since the tool rewrites them in its own shape on
+     * the next run and the workspace flips between the two forms.
+     */
+    readonly ignore?: readonly string[];
+}
 /**
  * Format files in the given directory within the tree.
  * Handles both TypeScript/JavaScript/JSON (via biome) and Python (via ruff) files.
  * See https://github.com/nrwl/nx/blob/4cd640a9187954505d12de5b6d76a90d8ce4c2eb/packages/devkit/src/generators/format-files.ts#L11
  */
-export declare function formatFilesInSubtree(tree: Tree, dir?: string): Promise<void>;
+export declare function formatFilesInSubtree(tree: Tree, dir?: string, options?: FormatFilesInSubtreeOptions): Promise<void>;
+/**
+ * Derive ruff's `target-version` (eg `py314`) from a PEP 508
+ * `requires-python` specifier (eg `>=3.14`). Ruff targets the minimum
+ * supported version, so take the lowest `major.minor` mentioned.
+ */
+export declare const requiresPythonToRuffTarget: (requiresPython: unknown) => string | undefined;