@aws/nx-plugin 1.0.0-rc.7 → 1.0.0-rc.71

package/src/utils/test-git.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../../../../../packages/nx-plugin/src/utils/test-git.ts"],"sourcesContent":["/**\n * Copyright Amazon.com, Inc. or its affiliates. All Rights Reserved.\n * SPDX-License-Identifier: Apache-2.0\n */\n\nimport { execFileSync } from 'node:child_process';\nimport { mkdtempSync, rmSync, writeFileSync } from 'node:fs';\nimport { tmpdir } from 'node:os';\nimport { join } from 'node:path';\nimport { afterEach, beforeEach } from 'vitest';\n\n/**\n * Identity used by the temp repositories these helpers create. Only ever\n * written to a throwaway `GIT_CONFIG_GLOBAL` file, never to the developer's\n * real config.\n */\nconst TEST_GIT_USER_NAME = 'nx-plugin-for-aws-test';\nconst TEST_GIT_USER_EMAIL = 'nx-plugin-for-aws-test@example.invalid';\n\n/**\n * Isolate every git invocation in the surrounding tests from the machine's real\n * git configuration, and point the test identity at a throwaway config file.\n *\n * Two leaks are prevented:\n *\n * 1. Inherited `GIT_*` variables. When the test suite runs from a git hook (the\n *    repo's `pre-commit` runs the unit tests), git exports `GIT_DIR` and\n *    `GIT_INDEX_FILE` pointing at the surrounding repository. Those take\n *    precedence over `cwd`, so `git init`/`git config`/`git commit` in a temp\n *    directory operate on the real repository instead — writing `user.*` into\n *    its `.git/config` and committing test fixtures.\n * 2. Reads of, and writes to, the user's global and system config. Pointing\n *    `GIT_CONFIG_GLOBAL`/`GIT_CONFIG_SYSTEM` at files inside a temp directory\n *    means a stray `git config --global` lands there and is deleted with it,\n *    and the developer's real `user.email` can neither leak into assertions nor\n *    be overwritten.\n *\n * Both env vars are restored after each test.\n */\nexport const useIsolatedGitEnv = () => {\n  const savedEnv: Record<string, string | undefined> = {};\n  let configDir: string | undefined;\n\n  beforeEach(() => {\n    for (const key of Object.keys(process.env)) {\n      if (key.startsWith('GIT_')) {\n        savedEnv[key] = process.env[key];\n        delete process.env[key];\n      }\n    }\n\n    configDir = mkdtempSync(join(tmpdir(), 'nx-plugin-gitconfig-'));\n    // Seed the identity here rather than per-repo, so temp repos need no\n    // `git config` call at all and cannot write to a real repository.\n    writeFileSync(\n      join(configDir, 'global'),\n      `[user]\\n\\tname = ${TEST_GIT_USER_NAME}\\n\\temail = ${TEST_GIT_USER_EMAIL}\\n`,\n    );\n    // Empty, so system config (which may set user.* or hook paths) cannot leak.\n    writeFileSync(join(configDir, 'system'), '');\n\n    for (const key of ['GIT_CONFIG_GLOBAL', 'GIT_CONFIG_SYSTEM'] as const) {\n      savedEnv[key] ??= process.env[key];\n    }\n    process.env.GIT_CONFIG_GLOBAL = join(configDir, 'global');\n    process.env.GIT_CONFIG_SYSTEM = join(configDir, 'system');\n  });\n\n  afterEach(() => {\n    // Clear every GIT_* variable first, so any set *during* the test (and\n    // therefore absent from savedEnv) cannot leak into the next one.\n    for (const key of Object.keys(process.env)) {\n      if (key.startsWith('GIT_')) {\n        delete process.env[key];\n      }\n    }\n    for (const [key, value] of Object.entries(savedEnv)) {\n      if (value !== undefined) {\n        process.env[key] = value;\n      }\n    }\n    for (const key of Object.keys(savedEnv)) {\n      delete savedEnv[key];\n    }\n    if (configDir) {\n      rmSync(configDir, { force: true, recursive: true });\n      configDir = undefined;\n    }\n  });\n};\n\n/**\n * Run a git command in `cwd`, with the ambient `GIT_DIR`/`GIT_INDEX_FILE`\n * cleared so it cannot escape to a surrounding repository even if\n * `useIsolatedGitEnv` is not in effect. `execFileSync` (no shell) keeps\n * arguments from being re-split.\n */\nexport const runGit = (args: string[], cwd: string): string =>\n  execFileSync('git', args, {\n    cwd,\n    encoding: 'utf-8',\n    stdio: 'pipe',\n    env: {\n      ...process.env,\n      GIT_DIR: undefined,\n      GIT_WORK_TREE: undefined,\n      GIT_INDEX_FILE: undefined,\n      GIT_COMMON_DIR: undefined,\n    } as NodeJS.ProcessEnv,\n  });\n\n/**\n * Create a git repository in `dir` for a test to work in. The identity comes\n * from the isolated global config set up by `useIsolatedGitEnv`, so nothing is\n * written outside `dir`. Hooks are disabled — the repo under test has a\n * `pre-commit` hook that runs the whole test suite.\n */\nexport const initTestGitRepo = (dir: string): void => {\n  runGit(['init'], dir);\n  runGit(['config', 'core.hooksPath', '/dev/null'], dir);\n};\n"],"names":["execFileSync","mkdtempSync","rmSync","writeFileSync","tmpdir","join","afterEach","beforeEach","TEST_GIT_USER_NAME","TEST_GIT_USER_EMAIL","useIsolatedGitEnv","savedEnv","configDir","key","Object","keys","process","env","startsWith","GIT_CONFIG_GLOBAL","GIT_CONFIG_SYSTEM","value","entries","undefined","force","recursive","runGit","args","cwd","encoding","stdio","GIT_DIR","GIT_WORK_TREE","GIT_INDEX_FILE","GIT_COMMON_DIR","initTestGitRepo","dir"],"mappings":"AAAA;;;CAGC,GAED,SAASA,YAAY,QAAQ,qBAAqB;AAClD,SAASC,WAAW,EAAEC,MAAM,EAAEC,aAAa,QAAQ,UAAU;AAC7D,SAASC,MAAM,QAAQ,UAAU;AACjC,SAASC,IAAI,QAAQ,YAAY;AACjC,SAASC,SAAS,EAAEC,UAAU,QAAQ,SAAS;AAE/C;;;;CAIC,GACD,MAAMC,qBAAqB;AAC3B,MAAMC,sBAAsB;AAE5B;;;;;;;;;;;;;;;;;;;CAmBC,GACD,OAAO,MAAMC,oBAAoB;IAC/B,MAAMC,WAA+C,CAAC;IACtD,IAAIC;IAEJL,WAAW;QACT,KAAK,MAAMM,OAAOC,OAAOC,IAAI,CAACC,QAAQC,GAAG,EAAG;YAC1C,IAAIJ,IAAIK,UAAU,CAAC,SAAS;gBAC1BP,QAAQ,CAACE,IAAI,GAAGG,QAAQC,GAAG,CAACJ,IAAI;gBAChC,OAAOG,QAAQC,GAAG,CAACJ,IAAI;YACzB;QACF;QAEAD,YAAYX,YAAYI,KAAKD,UAAU;QACvC,qEAAqE;QACrE,kEAAkE;QAClED,cACEE,KAAKO,WAAW,WAChB,CAAC,iBAAiB,EAAEJ,mBAAmB,YAAY,EAAEC,oBAAoB,EAAE,CAAC;QAE9E,4EAA4E;QAC5EN,cAAcE,KAAKO,WAAW,WAAW;QAEzC,KAAK,MAAMC,OAAO;YAAC;YAAqB;SAAoB,CAAW;YACrEF,QAAQ,CAACE,IAAI,KAAKG,QAAQC,GAAG,CAACJ,IAAI;QACpC;QACAG,QAAQC,GAAG,CAACE,iBAAiB,GAAGd,KAAKO,WAAW;QAChDI,QAAQC,GAAG,CAACG,iBAAiB,GAAGf,KAAKO,WAAW;IAClD;IAEAN,UAAU;QACR,sEAAsE;QACtE,iEAAiE;QACjE,KAAK,MAAMO,OAAOC,OAAOC,IAAI,CAACC,QAAQC,GAAG,EAAG;YAC1C,IAAIJ,IAAIK,UAAU,CAAC,SAAS;gBAC1B,OAAOF,QAAQC,GAAG,CAACJ,IAAI;YACzB;QACF;QACA,KAAK,MAAM,CAACA,KAAKQ,MAAM,IAAIP,OAAOQ,OAAO,CAACX,UAAW;YACnD,IAAIU,UAAUE,WAAW;gBACvBP,QAAQC,GAAG,CAACJ,IAAI,GAAGQ;YACrB;QACF;QACA,KAAK,MAAMR,OAAOC,OAAOC,IAAI,CAACJ,UAAW;YACvC,OAAOA,QAAQ,CAACE,IAAI;QACtB;QACA,IAAID,WAAW;YACbV,OAAOU,WAAW;gBAAEY,OAAO;gBAAMC,WAAW;YAAK;YACjDb,YAAYW;QACd;IACF;AACF,EAAE;AAEF;;;;;CAKC,GACD,OAAO,MAAMG,SAAS,CAACC,MAAgBC,MACrC5B,aAAa,OAAO2B,MAAM;QACxBC;QACAC,UAAU;QACVC,OAAO;QACPb,KAAK;YACH,GAAGD,QAAQC,GAAG;YACdc,SAASR;YACTS,eAAeT;YACfU,gBAAgBV;YAChBW,gBAAgBX;QAClB;IACF,GAAG;AAEL;;;;;CAKC,GACD,OAAO,MAAMY,kBAAkB,CAACC;IAC9BV,OAAO;QAAC;KAAO,EAAEU;IACjBV,OAAO;QAAC;QAAU;QAAkB;KAAY,EAAEU;AACpD,EAAE"}

package/src/utils/test.d.ts

@@ -3,6 +3,16 @@
  * SPDX-License-Identifier: Apache-2.0
  */
 import { type Tree } from '@nx/devkit';
+/**
+ * Create a workspace tree configured so that nx's `isUsingTsSolutionSetup`
+ * reports `true`, matching the workspaces our preset generates. Rather than
+ * mocking nx internals, we set up the real markers it checks for:
+ * - package manager workspaces enabled (`pnpm-workspace.yaml` with `packages`)
+ * - a root `tsconfig.json` extending `tsconfig.base.json` with empty `include`
+ * - `composite: true` in `tsconfig.base.json`
+ * - a root `package.json` with `type: module`, matching the ESM default the
+ *   preset establishes
+ */
 export declare const createTreeUsingTsSolutionSetup: () => Tree;
 /**
  * Snapshot all files within a directory in the given tree

package/src/utils/test.js

@@ -1,39 +1,58 @@
-"use strict";
 /**
  * Copyright Amazon.com, Inc. or its affiliates. All Rights Reserved.
  * SPDX-License-Identifier: Apache-2.0
- */
-Object.defineProperty(exports, "__esModule", { value: true });
-exports.snapshotTreeDir = exports.createTreeUsingTsSolutionSetup = void 0;
-const tslib_1 = require("tslib");
-const devkit_1 = require("@nx/devkit");
-const testing_1 = require("@nx/devkit/testing");
-const ts_solution_setup_1 = tslib_1.__importDefault(require("@nx/js/src/utils/typescript/ts-solution-setup"));
-const vitest_1 = require("vitest");
-const format_1 = require("./format");
-const createTreeUsingTsSolutionSetup = () => {
-    vitest_1.vi.spyOn(ts_solution_setup_1.default, 'isUsingTsSolutionSetup').mockImplementation(() => true);
-    const tree = (0, testing_1.createTreeWithEmptyWorkspace)();
+ */ import { joinPathFragments, readJson, updateJson, writeJson } from "@nx/devkit";
+import { createTreeWithEmptyWorkspace } from "@nx/devkit/testing";
+import { expect } from "vitest";
+import { getDefaultBiomeConfig } from "./format.js";
+/**
+ * Create a workspace tree configured so that nx's `isUsingTsSolutionSetup`
+ * reports `true`, matching the workspaces our preset generates. Rather than
+ * mocking nx internals, we set up the real markers it checks for:
+ * - package manager workspaces enabled (`pnpm-workspace.yaml` with `packages`)
+ * - a root `tsconfig.json` extending `tsconfig.base.json` with empty `include`
+ * - `composite: true` in `tsconfig.base.json`
+ * - a root `package.json` with `type: module`, matching the ESM default the
+ *   preset establishes
+ */ export const createTreeUsingTsSolutionSetup = ()=>{
+    const tree = createTreeWithEmptyWorkspace();
     tree.write('pnpm-workspace.yaml', `packages:\n  - packages/*`);
-    tree.write('tsconfig.json', '{}');
+    // Write both workspace markers so package-manager detection finds workspaces
+    // enabled whether tests run via pnpm or npm/npx.
+    updateJson(tree, 'package.json', (json)=>({
+            ...json,
+            type: 'module',
+            workspaces: [
+                'packages/*'
+            ]
+        }));
+    const baseTsConfig = readJson(tree, 'tsconfig.base.json');
+    writeJson(tree, 'tsconfig.base.json', {
+        ...baseTsConfig,
+        compilerOptions: {
+            ...baseTsConfig.compilerOptions,
+            composite: true
+        }
+    });
+    writeJson(tree, 'tsconfig.json', {
+        extends: './tsconfig.base.json',
+        files: [],
+        include: [],
+        references: []
+    });
     // The preset always writes biome.json at the workspace root, so mirror that
     // here for realistic lint-target configuration.
-    tree.write('biome.json', JSON.stringify(format_1.DEFAULT_BIOME_CONFIG, null, 2));
+    tree.write('biome.json', JSON.stringify(getDefaultBiomeConfig(tree), null, 2));
     return tree;
 };
-exports.createTreeUsingTsSolutionSetup = createTreeUsingTsSolutionSetup;
 /**
  * Snapshot all files within a directory in the given tree
- */
-const snapshotTreeDir = (tree, dir) => {
+ */ export const snapshotTreeDir = (tree, dir)=>{
     if (tree.isFile(dir)) {
-        (0, vitest_1.expect)(tree.read(dir, 'utf-8')).toMatchSnapshot(dir);
-    }
-    else {
-        tree
-            .children(dir)
-            .forEach((subDir) => (0, exports.snapshotTreeDir)(tree, (0, devkit_1.joinPathFragments)(dir, subDir)));
+        expect(tree.read(dir, 'utf-8')).toMatchSnapshot(dir);
+    } else {
+        tree.children(dir).forEach((subDir)=>snapshotTreeDir(tree, joinPathFragments(dir, subDir)));
     }
 };
-exports.snapshotTreeDir = snapshotTreeDir;
+
 //# sourceMappingURL=test.js.map

package/src/utils/test.js.map

@@ -1 +1 @@
-{"version":3,"file":"test.js","sourceRoot":"","sources":["../../../../../packages/nx-plugin/src/utils/test.ts"],"names":[],"mappings":";AAAA;;;GAGG;;;;AAEH,uCAA0D;AAC1D,gDAAkE;AAClE,8GAA0E;AAC1E,mCAAoC;AACpC,qCAAgD;AAEzC,MAAM,8BAA8B,GAAG,GAAS,EAAE;IACvD,WAAE,CAAC,KAAK,CAAC,2BAAa,EAAE,wBAAwB,CAAC,CAAC,kBAAkB,CAClE,GAAG,EAAE,CAAC,IAAI,CACX,CAAC;IAEF,MAAM,IAAI,GAAG,IAAA,sCAA4B,GAAE,CAAC;IAE5C,IAAI,CAAC,KAAK,CAAC,qBAAqB,EAAE,2BAA2B,CAAC,CAAC;IAE/D,IAAI,CAAC,KAAK,CAAC,eAAe,EAAE,IAAI,CAAC,CAAC;IAClC,4EAA4E;IAC5E,gDAAgD;IAChD,IAAI,CAAC,KAAK,CAAC,YAAY,EAAE,IAAI,CAAC,SAAS,CAAC,6BAAoB,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,CAAC;IACxE,OAAO,IAAI,CAAC;AACd,CAAC,CAAC;AAdW,QAAA,8BAA8B,kCAczC;AAEF;;GAEG;AACI,MAAM,eAAe,GAAG,CAAC,IAAU,EAAE,GAAW,EAAE,EAAE;IACzD,IAAI,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,EAAE,CAAC;QACrB,IAAA,eAAM,EAAC,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,OAAO,CAAC,CAAC,CAAC,eAAe,CAAC,GAAG,CAAC,CAAC;IACvD,CAAC;SAAM,CAAC;QACN,IAAI;aACD,QAAQ,CAAC,GAAG,CAAC;aACb,OAAO,CAAC,CAAC,MAAM,EAAE,EAAE,CAClB,IAAA,uBAAe,EAAC,IAAI,EAAE,IAAA,0BAAiB,EAAC,GAAG,EAAE,MAAM,CAAC,CAAC,CACtD,CAAC;IACN,CAAC;AACH,CAAC,CAAC;AAVW,QAAA,eAAe,mBAU1B"}
+{"version":3,"sources":["../../../../../packages/nx-plugin/src/utils/test.ts"],"sourcesContent":["/**\n * Copyright Amazon.com, Inc. or its affiliates. All Rights Reserved.\n * SPDX-License-Identifier: Apache-2.0\n */\n\nimport {\n  joinPathFragments,\n  readJson,\n  type Tree,\n  updateJson,\n  writeJson,\n} from '@nx/devkit';\nimport { createTreeWithEmptyWorkspace } from '@nx/devkit/testing';\nimport { expect } from 'vitest';\nimport { getDefaultBiomeConfig } from './format';\n\n/**\n * Create a workspace tree configured so that nx's `isUsingTsSolutionSetup`\n * reports `true`, matching the workspaces our preset generates. Rather than\n * mocking nx internals, we set up the real markers it checks for:\n * - package manager workspaces enabled (`pnpm-workspace.yaml` with `packages`)\n * - a root `tsconfig.json` extending `tsconfig.base.json` with empty `include`\n * - `composite: true` in `tsconfig.base.json`\n * - a root `package.json` with `type: module`, matching the ESM default the\n *   preset establishes\n */\nexport const createTreeUsingTsSolutionSetup = (): Tree => {\n  const tree = createTreeWithEmptyWorkspace();\n\n  tree.write('pnpm-workspace.yaml', `packages:\\n  - packages/*`);\n\n  // Write both workspace markers so package-manager detection finds workspaces\n  // enabled whether tests run via pnpm or npm/npx.\n  updateJson(tree, 'package.json', (json) => ({\n    ...json,\n    type: 'module',\n    workspaces: ['packages/*'],\n  }));\n\n  const baseTsConfig = readJson(tree, 'tsconfig.base.json');\n  writeJson(tree, 'tsconfig.base.json', {\n    ...baseTsConfig,\n    compilerOptions: { ...baseTsConfig.compilerOptions, composite: true },\n  });\n  writeJson(tree, 'tsconfig.json', {\n    extends: './tsconfig.base.json',\n    files: [],\n    include: [],\n    references: [],\n  });\n\n  // The preset always writes biome.json at the workspace root, so mirror that\n  // here for realistic lint-target configuration.\n  tree.write(\n    'biome.json',\n    JSON.stringify(getDefaultBiomeConfig(tree), null, 2),\n  );\n  return tree;\n};\n\n/**\n * Snapshot all files within a directory in the given tree\n */\nexport const snapshotTreeDir = (tree: Tree, dir: string) => {\n  if (tree.isFile(dir)) {\n    expect(tree.read(dir, 'utf-8')).toMatchSnapshot(dir);\n  } else {\n    tree\n      .children(dir)\n      .forEach((subDir) =>\n        snapshotTreeDir(tree, joinPathFragments(dir, subDir)),\n      );\n  }\n};\n"],"names":["joinPathFragments","readJson","updateJson","writeJson","createTreeWithEmptyWorkspace","expect","getDefaultBiomeConfig","createTreeUsingTsSolutionSetup","tree","write","json","type","workspaces","baseTsConfig","compilerOptions","composite","extends","files","include","references","JSON","stringify","snapshotTreeDir","dir","isFile","read","toMatchSnapshot","children","forEach","subDir"],"mappings":"AAAA;;;CAGC,GAED,SACEA,iBAAiB,EACjBC,QAAQ,EAERC,UAAU,EACVC,SAAS,QACJ,aAAa;AACpB,SAASC,4BAA4B,QAAQ,qBAAqB;AAClE,SAASC,MAAM,QAAQ,SAAS;AAChC,SAASC,qBAAqB,QAAQ,cAAW;AAEjD;;;;;;;;;CASC,GACD,OAAO,MAAMC,iCAAiC;IAC5C,MAAMC,OAAOJ;IAEbI,KAAKC,KAAK,CAAC,uBAAuB,CAAC,yBAAyB,CAAC;IAE7D,6EAA6E;IAC7E,iDAAiD;IACjDP,WAAWM,MAAM,gBAAgB,CAACE,OAAU,CAAA;YAC1C,GAAGA,IAAI;YACPC,MAAM;YACNC,YAAY;gBAAC;aAAa;QAC5B,CAAA;IAEA,MAAMC,eAAeZ,SAASO,MAAM;IACpCL,UAAUK,MAAM,sBAAsB;QACpC,GAAGK,YAAY;QACfC,iBAAiB;YAAE,GAAGD,aAAaC,eAAe;YAAEC,WAAW;QAAK;IACtE;IACAZ,UAAUK,MAAM,iBAAiB;QAC/BQ,SAAS;QACTC,OAAO,EAAE;QACTC,SAAS,EAAE;QACXC,YAAY,EAAE;IAChB;IAEA,4EAA4E;IAC5E,gDAAgD;IAChDX,KAAKC,KAAK,CACR,cACAW,KAAKC,SAAS,CAACf,sBAAsBE,OAAO,MAAM;IAEpD,OAAOA;AACT,EAAE;AAEF;;CAEC,GACD,OAAO,MAAMc,kBAAkB,CAACd,MAAYe;IAC1C,IAAIf,KAAKgB,MAAM,CAACD,MAAM;QACpBlB,OAAOG,KAAKiB,IAAI,CAACF,KAAK,UAAUG,eAAe,CAACH;IAClD,OAAO;QACLf,KACGmB,QAAQ,CAACJ,KACTK,OAAO,CAAC,CAACC,SACRP,gBAAgBd,MAAMR,kBAAkBuB,KAAKM;IAEnD;AACF,EAAE"}

package/src/utils/toml.d.ts

@@ -12,3 +12,8 @@ export declare const updateToml: (tree: Tree, filePath: string, updater: (prev:
  * Read a toml file
  */
 export declare const readToml: (tree: Tree, filePath: string) => TOML.JsonMap;
+/**
+ * Read a toml file, treating one that is missing or cannot be parsed as absent.
+ * For callers that probe for optional configuration rather than requiring it.
+ */
+export declare const tryReadToml: (tree: Tree, filePath: string) => TOML.JsonMap | undefined;

package/src/utils/toml.js

@@ -1,28 +1,30 @@
-"use strict";
 /**
  * Copyright Amazon.com, Inc. or its affiliates. All Rights Reserved.
  * SPDX-License-Identifier: Apache-2.0
- */
-Object.defineProperty(exports, "__esModule", { value: true });
-exports.readToml = exports.updateToml = void 0;
-const tslib_1 = require("tslib");
-const toml_1 = tslib_1.__importDefault(require("@iarna/toml"));
+ */ import TOML from "@iarna/toml";
 /**
  * Update a toml file
- */
-const updateToml = (tree, filePath, updater) => {
-    const prev = (0, exports.readToml)(tree, filePath);
-    tree.write(filePath, toml_1.default.stringify(updater(prev)));
+ */ export const updateToml = (tree, filePath, updater)=>{
+    const prev = readToml(tree, filePath);
+    tree.write(filePath, TOML.stringify(updater(prev)));
 };
-exports.updateToml = updateToml;
 /**
  * Read a toml file
- */
-const readToml = (tree, filePath) => {
+ */ export const readToml = (tree, filePath)=>{
     if (!tree.exists(filePath)) {
         throw new Error(`${filePath} does not exist`);
     }
-    return toml_1.default.parse(tree.read(filePath, 'utf-8'));
+    return TOML.parse(tree.read(filePath, 'utf-8'));
 };
-exports.readToml = readToml;
+/**
+ * Read a toml file, treating one that is missing or cannot be parsed as absent.
+ * For callers that probe for optional configuration rather than requiring it.
+ */ export const tryReadToml = (tree, filePath)=>{
+    try {
+        return readToml(tree, filePath);
+    } catch  {
+        return undefined;
+    }
+};
+
 //# sourceMappingURL=toml.js.map

package/src/utils/toml.js.map

@@ -1 +1 @@
-{"version":3,"file":"toml.js","sourceRoot":"","sources":["../../../../../packages/nx-plugin/src/utils/toml.ts"],"names":[],"mappings":";AAAA;;;GAGG;;;;AAEH,+DAA+B;AAG/B;;GAEG;AACI,MAAM,UAAU,GAAG,CACxB,IAAU,EACV,QAAgB,EAChB,OAA6C,EAC7C,EAAE;IACF,MAAM,IAAI,GAAG,IAAA,gBAAQ,EAAC,IAAI,EAAE,QAAQ,CAAC,CAAC;IACtC,IAAI,CAAC,KAAK,CAAC,QAAQ,EAAE,cAAI,CAAC,SAAS,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;AACtD,CAAC,CAAC;AAPW,QAAA,UAAU,cAOrB;AAEF;;GAEG;AACI,MAAM,QAAQ,GAAG,CAAC,IAAU,EAAE,QAAgB,EAAgB,EAAE;IACrE,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,EAAE,CAAC;QAC3B,MAAM,IAAI,KAAK,CAAC,GAAG,QAAQ,iBAAiB,CAAC,CAAC;IAChD,CAAC;IACD,OAAO,cAAI,CAAC,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,QAAQ,EAAE,OAAO,CAAC,CAAC,CAAC;AAClD,CAAC,CAAC;AALW,QAAA,QAAQ,YAKnB"}
+{"version":3,"sources":["../../../../../packages/nx-plugin/src/utils/toml.ts"],"sourcesContent":["/**\n * Copyright Amazon.com, Inc. or its affiliates. All Rights Reserved.\n * SPDX-License-Identifier: Apache-2.0\n */\n\nimport TOML from '@iarna/toml';\nimport type { Tree } from '@nx/devkit';\n\n/**\n * Update a toml file\n */\nexport const updateToml = (\n  tree: Tree,\n  filePath: string,\n  updater: (prev: TOML.JsonMap) => TOML.JsonMap,\n) => {\n  const prev = readToml(tree, filePath);\n  tree.write(filePath, TOML.stringify(updater(prev)));\n};\n\n/**\n * Read a toml file\n */\nexport const readToml = (tree: Tree, filePath: string): TOML.JsonMap => {\n  if (!tree.exists(filePath)) {\n    throw new Error(`${filePath} does not exist`);\n  }\n  return TOML.parse(tree.read(filePath, 'utf-8'));\n};\n\n/**\n * Read a toml file, treating one that is missing or cannot be parsed as absent.\n * For callers that probe for optional configuration rather than requiring it.\n */\nexport const tryReadToml = (\n  tree: Tree,\n  filePath: string,\n): TOML.JsonMap | undefined => {\n  try {\n    return readToml(tree, filePath);\n  } catch {\n    return undefined;\n  }\n};\n"],"names":["TOML","updateToml","tree","filePath","updater","prev","readToml","write","stringify","exists","Error","parse","read","tryReadToml","undefined"],"mappings":"AAAA;;;CAGC,GAED,OAAOA,UAAU,cAAc;AAG/B;;CAEC,GACD,OAAO,MAAMC,aAAa,CACxBC,MACAC,UACAC;IAEA,MAAMC,OAAOC,SAASJ,MAAMC;IAC5BD,KAAKK,KAAK,CAACJ,UAAUH,KAAKQ,SAAS,CAACJ,QAAQC;AAC9C,EAAE;AAEF;;CAEC,GACD,OAAO,MAAMC,WAAW,CAACJ,MAAYC;IACnC,IAAI,CAACD,KAAKO,MAAM,CAACN,WAAW;QAC1B,MAAM,IAAIO,MAAM,GAAGP,SAAS,eAAe,CAAC;IAC9C;IACA,OAAOH,KAAKW,KAAK,CAACT,KAAKU,IAAI,CAACT,UAAU;AACxC,EAAE;AAEF;;;CAGC,GACD,OAAO,MAAMU,cAAc,CACzBX,MACAC;IAEA,IAAI;QACF,OAAOG,SAASJ,MAAMC;IACxB,EAAE,OAAM;QACN,OAAOW;IACT;AACF,EAAE"}

package/src/utils/version-upgrade-migration/migration.d.ts

@@ -0,0 +1,14 @@
+/**
+ * Copyright Amazon.com, Inc. or its affiliates. All Rights Reserved.
+ * SPDX-License-Identifier: Apache-2.0
+ */
+import type { MigrationReturnObject, Tree } from '@nx/devkit';
+/**
+ * Syncs the workspace's vended versions to those the installed plugin vends.
+ *
+ * Registered `everyMigration`, so it runs on every upgrade and last in the run:
+ * versions come from the installed plugin's own tables, so there is nothing
+ * release-specific to register, and running after the code migrations lets them
+ * add dependencies this then brings up to date.
+ */
+export default function migration(tree: Tree): Promise<MigrationReturnObject>;

package/src/utils/version-upgrade-migration/migration.js

@@ -0,0 +1,16 @@
+/**
+ * Copyright Amazon.com, Inc. or its affiliates. All Rights Reserved.
+ * SPDX-License-Identifier: Apache-2.0
+ */ import { syncVendedVersions } from "./sync-vended-versions.js";
+/**
+ * Syncs the workspace's vended versions to those the installed plugin vends.
+ *
+ * Registered `everyMigration`, so it runs on every upgrade and last in the run:
+ * versions come from the installed plugin's own tables, so there is nothing
+ * release-specific to register, and running after the code migrations lets them
+ * add dependencies this then brings up to date.
+ */ export default async function migration(tree) {
+    return syncVendedVersions(tree);
+}
+
+//# sourceMappingURL=migration.js.map

package/src/utils/version-upgrade-migration/migration.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../../../../../../packages/nx-plugin/src/utils/version-upgrade-migration/migration.ts"],"sourcesContent":["/**\n * Copyright Amazon.com, Inc. or its affiliates. All Rights Reserved.\n * SPDX-License-Identifier: Apache-2.0\n */\nimport type { MigrationReturnObject, Tree } from '@nx/devkit';\nimport { syncVendedVersions } from './sync-vended-versions';\n\n/**\n * Syncs the workspace's vended versions to those the installed plugin vends.\n *\n * Registered `everyMigration`, so it runs on every upgrade and last in the run:\n * versions come from the installed plugin's own tables, so there is nothing\n * release-specific to register, and running after the code migrations lets them\n * add dependencies this then brings up to date.\n */\nexport default async function migration(\n  tree: Tree,\n): Promise<MigrationReturnObject> {\n  return syncVendedVersions(tree);\n}\n"],"names":["syncVendedVersions","migration","tree"],"mappings":"AAAA;;;CAGC,GAED,SAASA,kBAAkB,QAAQ,4BAAyB;AAE5D;;;;;;;CAOC,GACD,eAAe,eAAeC,UAC5BC,IAAU;IAEV,OAAOF,mBAAmBE;AAC5B"}

package/src/utils/version-upgrade-migration/nx-package-updates.d.ts

@@ -0,0 +1,45 @@
+/**
+ * `packageJsonUpdates` for the nx packages a generated workspace pins.
+ *
+ * A migration cannot bump these: `nx migrate` builds its migration list from the
+ * packages it is itself bumping, so an nx version only rewritten by our migration
+ * silently skips Nx's own migrations for that hop. Declaring the bump here pulls
+ * them in.
+ *
+ * It also keeps every nx pin moving together. A workspace nx even a patch apart
+ * from the plugin's `@nx/*` packages hoists a second nested nx, and the two
+ * deadlock `nx sync`.
+ */
+export declare const NX_PACKAGE_UPDATES_NAME = "nx-packages";
+export declare const isNxPackage: (name: string) => boolean;
+/** Indexed to satisfy the open shape `migrations.json` entries carry. */
+export interface PackageJsonUpdate extends Record<string, unknown> {
+    version: string;
+    packages: Record<string, {
+        version: string;
+        alwaysAddToPackageJson: false;
+    }>;
+}
+export type PackageJsonUpdates = Record<string, PackageJsonUpdate>;
+/**
+ * Key an nx bump is registered under, named for the nx version it moves to.
+ *
+ * The plugin version the bump ships under isn't known when it is written — the
+ * weekly update writes it, and only the release that publishes it can say which
+ * version that is. The nx version, though, is exactly what the entry is *for*,
+ * and two bumps to the same nx version would be the same bump — so it keys the
+ * entry uniquely from the moment it is written, with no re-keying later.
+ *
+ * That matters because each release's bump has to stay behind as the next is
+ * written: a workspace several releases behind gets every nx hop in turn rather
+ * than only the newest. A key that had to be rewritten once the plugin version
+ * was known would let a second bump land on the first before either shipped.
+ */
+export declare const nxPackageUpdatesKey: (nxVersion: string) => string;
+/**
+ * `alwaysAddToPackageJson: false` so only packages already present are updated.
+ *
+ * @param version plugin version `nx migrate` gates the bump on, or
+ *   {@link LATEST_MIGRATIONS_DIR} while it is still waiting for a release
+ */
+export declare const nxPackageJsonUpdates: (version: string, nxVersion?: string) => PackageJsonUpdates;

package/src/utils/version-upgrade-migration/nx-package-updates.js

@@ -0,0 +1,50 @@
+/**
+ * Copyright Amazon.com, Inc. or its affiliates. All Rights Reserved.
+ * SPDX-License-Identifier: Apache-2.0
+ */ import { NX_PACKAGES, NX_VERSION } from "../versions.js";
+/**
+ * `packageJsonUpdates` for the nx packages a generated workspace pins.
+ *
+ * A migration cannot bump these: `nx migrate` builds its migration list from the
+ * packages it is itself bumping, so an nx version only rewritten by our migration
+ * silently skips Nx's own migrations for that hop. Declaring the bump here pulls
+ * them in.
+ *
+ * It also keeps every nx pin moving together. A workspace nx even a patch apart
+ * from the plugin's `@nx/*` packages hoists a second nested nx, and the two
+ * deadlock `nx sync`.
+ */ export const NX_PACKAGE_UPDATES_NAME = 'nx-packages';
+export const isNxPackage = (name)=>NX_PACKAGES.includes(name);
+/**
+ * Key an nx bump is registered under, named for the nx version it moves to.
+ *
+ * The plugin version the bump ships under isn't known when it is written — the
+ * weekly update writes it, and only the release that publishes it can say which
+ * version that is. The nx version, though, is exactly what the entry is *for*,
+ * and two bumps to the same nx version would be the same bump — so it keys the
+ * entry uniquely from the moment it is written, with no re-keying later.
+ *
+ * That matters because each release's bump has to stay behind as the next is
+ * written: a workspace several releases behind gets every nx hop in turn rather
+ * than only the newest. A key that had to be rewritten once the plugin version
+ * was known would let a second bump land on the first before either shipped.
+ */ export const nxPackageUpdatesKey = (nxVersion)=>`nx-${nxVersion}-${NX_PACKAGE_UPDATES_NAME}`;
+/**
+ * `alwaysAddToPackageJson: false` so only packages already present are updated.
+ *
+ * @param version plugin version `nx migrate` gates the bump on, or
+ *   {@link LATEST_MIGRATIONS_DIR} while it is still waiting for a release
+ */ export const nxPackageJsonUpdates = (version, nxVersion = NX_VERSION)=>({
+        [nxPackageUpdatesKey(nxVersion)]: {
+            version,
+            packages: Object.fromEntries(NX_PACKAGES.map((name)=>[
+                    name,
+                    {
+                        version: nxVersion,
+                        alwaysAddToPackageJson: false
+                    }
+                ]))
+        }
+    });
+
+//# sourceMappingURL=nx-package-updates.js.map

package/src/utils/version-upgrade-migration/nx-package-updates.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../../../../../../packages/nx-plugin/src/utils/version-upgrade-migration/nx-package-updates.ts"],"sourcesContent":["/**\n * Copyright Amazon.com, Inc. or its affiliates. All Rights Reserved.\n * SPDX-License-Identifier: Apache-2.0\n */\nimport { migrationKey } from '../migration-versions';\nimport { NX_PACKAGES, NX_VERSION } from '../versions';\n\n/**\n * `packageJsonUpdates` for the nx packages a generated workspace pins.\n *\n * A migration cannot bump these: `nx migrate` builds its migration list from the\n * packages it is itself bumping, so an nx version only rewritten by our migration\n * silently skips Nx's own migrations for that hop. Declaring the bump here pulls\n * them in.\n *\n * It also keeps every nx pin moving together. A workspace nx even a patch apart\n * from the plugin's `@nx/*` packages hoists a second nested nx, and the two\n * deadlock `nx sync`.\n */\n\nexport const NX_PACKAGE_UPDATES_NAME = 'nx-packages';\n\nexport const isNxPackage = (name: string): boolean =>\n  (NX_PACKAGES as readonly string[]).includes(name);\n\n/** Indexed to satisfy the open shape `migrations.json` entries carry. */\nexport interface PackageJsonUpdate extends Record<string, unknown> {\n  version: string;\n  packages: Record<string, { version: string; alwaysAddToPackageJson: false }>;\n}\n\nexport type PackageJsonUpdates = Record<string, PackageJsonUpdate>;\n\n/**\n * Key an nx bump is registered under, named for the nx version it moves to.\n *\n * The plugin version the bump ships under isn't known when it is written — the\n * weekly update writes it, and only the release that publishes it can say which\n * version that is. The nx version, though, is exactly what the entry is *for*,\n * and two bumps to the same nx version would be the same bump — so it keys the\n * entry uniquely from the moment it is written, with no re-keying later.\n *\n * That matters because each release's bump has to stay behind as the next is\n * written: a workspace several releases behind gets every nx hop in turn rather\n * than only the newest. A key that had to be rewritten once the plugin version\n * was known would let a second bump land on the first before either shipped.\n */\nexport const nxPackageUpdatesKey = (nxVersion: string) =>\n  `nx-${nxVersion}-${NX_PACKAGE_UPDATES_NAME}`;\n\n/**\n * `alwaysAddToPackageJson: false` so only packages already present are updated.\n *\n * @param version plugin version `nx migrate` gates the bump on, or\n *   {@link LATEST_MIGRATIONS_DIR} while it is still waiting for a release\n */\nexport const nxPackageJsonUpdates = (\n  version: string,\n  nxVersion: string = NX_VERSION,\n): PackageJsonUpdates => ({\n  [nxPackageUpdatesKey(nxVersion)]: {\n    version,\n    packages: Object.fromEntries(\n      NX_PACKAGES.map((name) => [\n        name,\n        { version: nxVersion, alwaysAddToPackageJson: false as const },\n      ]),\n    ),\n  },\n});\n"],"names":["NX_PACKAGES","NX_VERSION","NX_PACKAGE_UPDATES_NAME","isNxPackage","name","includes","nxPackageUpdatesKey","nxVersion","nxPackageJsonUpdates","version","packages","Object","fromEntries","map","alwaysAddToPackageJson"],"mappings":"AAAA;;;CAGC,GAED,SAASA,WAAW,EAAEC,UAAU,QAAQ,iBAAc;AAEtD;;;;;;;;;;;CAWC,GAED,OAAO,MAAMC,0BAA0B,cAAc;AAErD,OAAO,MAAMC,cAAc,CAACC,OAC1B,AAACJ,YAAkCK,QAAQ,CAACD,MAAM;AAUpD;;;;;;;;;;;;;CAaC,GACD,OAAO,MAAME,sBAAsB,CAACC,YAClC,CAAC,GAAG,EAAEA,UAAU,CAAC,EAAEL,yBAAyB,CAAC;AAE/C;;;;;CAKC,GACD,OAAO,MAAMM,uBAAuB,CAClCC,SACAF,YAAoBN,UAAU,GACN,CAAA;QACxB,CAACK,oBAAoBC,WAAW,EAAE;YAChCE;YACAC,UAAUC,OAAOC,WAAW,CAC1BZ,YAAYa,GAAG,CAAC,CAACT,OAAS;oBACxBA;oBACA;wBAAEK,SAASF;wBAAWO,wBAAwB;oBAAe;iBAC9D;QAEL;IACF,CAAA,EAAG"}

package/src/utils/version-upgrade-migration/owned-dependencies.d.ts

@@ -0,0 +1,76 @@
+import { type Tree } from '@nx/devkit';
+import { type DependencyMetadata } from '../declared-dependencies';
+/** Directory holding `generators.json`, which maps ids to their modules. */
+export declare const PLUGIN_ROOT: string;
+/**
+ * Which vended dependencies this workspace's generators are responsible for.
+ *
+ * Only these are synced, so a package the user added themselves keeps the version
+ * they chose. Ownership is derived from the generators the workspace has run and
+ * the dependencies each declares — nothing extra is recorded in the workspace.
+ */
+export interface OwnedDependencies {
+    readonly ts: ReadonlySet<string>;
+    readonly py: ReadonlySet<string>;
+    /**
+     * The same, split by the root of the project that owns it, for scoping a pin
+     * embedded in a generated file to the project it sits in. Keyed by project
+     * root; read through {@link ownedForFile}.
+     */
+    readonly byProject: ReadonlyMap<string, {
+        readonly ts: ReadonlySet<string>;
+        readonly py: ReadonlySet<string>;
+    }>;
+}
+/**
+ * One recorded run of a generator, with the metadata it wrote.
+ *
+ * The metadata carries the values the generator's dependency conditions read, so
+ * a declaration filters down to the branch this occurrence actually took.
+ */
+export interface GeneratorOccurrence {
+    readonly id: string;
+    readonly metadata: DependencyMetadata;
+    /** Root of the project this ran against, for scoping what it owns to it. */
+    readonly projectRoot?: string;
+}
+/**
+ * Every recorded run of a generator in this workspace, from the metadata
+ * generators record on the projects (and components) they create.
+ *
+ * A generator appears once per project or component it created, since each may
+ * have been run with different options.
+ *
+ * `init` creates no project, so its config file stands in for it.
+ */
+export declare const generatorOccurrences: (tree: Tree) => readonly GeneratorOccurrence[];
+/** Generator ids this workspace has run. */
+export declare const generatorsRun: (tree: Tree) => ReadonlySet<string>;
+/**
+ * Union of the dependencies declared by the generators this workspace has run,
+ * narrowed per occurrence to those whose conditions its recorded metadata
+ * satisfies — a project generated with one protocol does not own another's
+ * packages.
+ *
+ * A `versionOnly` entry is owned like any other: it is declared precisely so the
+ * sync keeps its pinned version current wherever the workspace already holds it.
+ *
+ * Each generator module exports its declaration, so reading one is an import
+ * rather than a run — the generators themselves are never invoked.
+ */
+export declare const ownedDependencies: (tree: Tree) => Promise<OwnedDependencies>;
+/**
+ * The dependencies owned where a file sits: those of the project it belongs to,
+ * or the workspace-wide union for a file in a shared project or under none.
+ *
+ * Used for the pins embedded in a generated file, so a version is only rewritten
+ * where the generator that pins it actually ran: a `Dockerfile` under one
+ * project's root is not upgraded because a sibling project owns the package.
+ *
+ * The longest matching root wins, since a nested project's root is a prefix of
+ * nothing else but its own files.
+ */
+export declare const ownedForFile: (owned: OwnedDependencies, filePath: string) => {
+    ts: ReadonlySet<string>;
+    py: ReadonlySet<string>;
+};

package/src/utils/version-upgrade-migration/owned-dependencies.js

@@ -0,0 +1,146 @@
+/**
+ * Copyright Amazon.com, Inc. or its affiliates. All Rights Reserved.
+ * SPDX-License-Identifier: Apache-2.0
+ */ import * as path from "node:path";
+import { getProjects } from "@nx/devkit";
+import { AWS_NX_PLUGIN_CONFIG_FILE_NAME } from "../config/utils.js";
+import { ownedDependencyEntries } from "../declared-dependencies.js";
+import { buildGeneratorInfoList } from "../generators.js";
+import { PACKAGES_DIR, SHARED_CONSTRUCTS_DIR, SHARED_TERRAFORM_DIR } from "../shared-constructs-constants.js";
+/** Directory holding `generators.json`, which maps ids to their modules. */ export const PLUGIN_ROOT = path.resolve(import.meta.dirname, '..', '..', '..');
+/**
+ * Every recorded run of a generator in this workspace, from the metadata
+ * generators record on the projects (and components) they create.
+ *
+ * A generator appears once per project or component it created, since each may
+ * have been run with different options.
+ *
+ * `init` creates no project, so its config file stands in for it.
+ */ export const generatorOccurrences = (tree)=>{
+    const occurrences = [];
+    if (tree.exists(AWS_NX_PLUGIN_CONFIG_FILE_NAME)) {
+        occurrences.push({
+            id: 'init',
+            metadata: {}
+        });
+    }
+    for (const [, project] of getProjects(tree)){
+        const metadata = project.metadata;
+        if (metadata?.generator) {
+            const { components, ...ownMetadata } = metadata;
+            occurrences.push({
+                id: metadata.generator,
+                metadata: ownMetadata,
+                projectRoot: project.root
+            });
+        }
+        for (const component of metadata?.components ?? []){
+            if (component.generator) {
+                occurrences.push({
+                    id: component.generator,
+                    metadata: component,
+                    projectRoot: project.root
+                });
+            }
+        }
+    }
+    return occurrences;
+};
+/** Generator ids this workspace has run. */ export const generatorsRun = (tree)=>new Set(generatorOccurrences(tree).map((occurrence)=>occurrence.id));
+/**
+ * Union of the dependencies declared by the generators this workspace has run,
+ * narrowed per occurrence to those whose conditions its recorded metadata
+ * satisfies — a project generated with one protocol does not own another's
+ * packages.
+ *
+ * A `versionOnly` entry is owned like any other: it is declared precisely so the
+ * sync keeps its pinned version current wherever the workspace already holds it.
+ *
+ * Each generator module exports its declaration, so reading one is an import
+ * rather than a run — the generators themselves are never invoked.
+ */ export const ownedDependencies = async (tree)=>{
+    const occurrences = generatorOccurrences(tree);
+    const ts = new Set();
+    const py = new Set();
+    const byProject = new Map();
+    for (const info of buildGeneratorInfoList(PLUGIN_ROOT)){
+        const matching = occurrences.filter((occurrence)=>occurrence.id === info.id);
+        if (matching.length === 0) {
+            continue;
+        }
+        const declaration = await readDeclaration(info.resolvedFactoryPath);
+        if (!declaration) {
+            continue;
+        }
+        for (const { metadata, projectRoot } of matching){
+            const scoped = projectRoot ? byProject.get(projectRoot) ?? byProject.set(projectRoot, {
+                ts: new Set(),
+                py: new Set()
+            }).get(projectRoot) : undefined;
+            for (const entry of ownedDependencyEntries(declaration.ts, metadata)){
+                ts.add(entry.name);
+                scoped?.ts.add(entry.name);
+            }
+            for (const entry of ownedDependencyEntries(declaration.py, metadata)){
+                py.add(entry.name);
+                scoped?.py.add(entry.name);
+            }
+        }
+    }
+    return {
+        ts,
+        py,
+        byProject
+    };
+};
+/**
+ * Roots of the projects every generator contributes into, rather than one
+ * generator owning outright.
+ *
+ * `sharedConstructsGenerator` creates these and each infra generator writes its
+ * own module into them — the Terraform modules carrying the `uv run --with` pins
+ * come from the agent-core, api, identity and website helpers alike. Both are
+ * registered projects, so scoping a file here to the generator that created the
+ * project would strand every pin the others put there.
+ */ const SHARED_PROJECT_ROOTS = [
+    `${PACKAGES_DIR}/${SHARED_CONSTRUCTS_DIR}`,
+    `${PACKAGES_DIR}/${SHARED_TERRAFORM_DIR}`
+];
+/**
+ * The dependencies owned where a file sits: those of the project it belongs to,
+ * or the workspace-wide union for a file in a shared project or under none.
+ *
+ * Used for the pins embedded in a generated file, so a version is only rewritten
+ * where the generator that pins it actually ran: a `Dockerfile` under one
+ * project's root is not upgraded because a sibling project owns the package.
+ *
+ * The longest matching root wins, since a nested project's root is a prefix of
+ * nothing else but its own files.
+ */ export const ownedForFile = (owned, filePath)=>{
+    if (SHARED_PROJECT_ROOTS.some((root)=>filePath === root || filePath.startsWith(`${root}/`))) {
+        return owned;
+    }
+    let best;
+    let bestLength = -1;
+    for (const [root, scoped] of owned.byProject){
+        if ((filePath === root || filePath.startsWith(`${root}/`)) && root.length > bestLength) {
+            best = scoped;
+            bestLength = root.length;
+        }
+    }
+    return best ?? owned;
+};
+/**
+ * A generator's `DEPENDENCIES`, or undefined when it declares none.
+ * A generator that fails to load must not fail the upgrade, so its dependencies
+ * are treated as unowned and left as they are.
+ */ const readDeclaration = async (factoryPath)=>{
+    try {
+        const module = await import(`${factoryPath}.js`);
+        return module.DEPENDENCIES;
+    } catch  {
+        return undefined;
+    }
+};
+
+//# sourceMappingURL=owned-dependencies.js.map

package/src/utils/version-upgrade-migration/owned-dependencies.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../../../../../../packages/nx-plugin/src/utils/version-upgrade-migration/owned-dependencies.ts"],"sourcesContent":["/**\n * Copyright Amazon.com, Inc. or its affiliates. All Rights Reserved.\n * SPDX-License-Identifier: Apache-2.0\n */\nimport * as path from 'node:path';\nimport { getProjects, type Tree } from '@nx/devkit';\nimport { AWS_NX_PLUGIN_CONFIG_FILE_NAME } from '../config/utils';\nimport {\n  type DependencyDeclaration,\n  type DependencyMetadata,\n  ownedDependencyEntries,\n} from '../declared-dependencies';\nimport { buildGeneratorInfoList } from '../generators';\nimport {\n  PACKAGES_DIR,\n  SHARED_CONSTRUCTS_DIR,\n  SHARED_TERRAFORM_DIR,\n} from '../shared-constructs-constants';\n\n/** Directory holding `generators.json`, which maps ids to their modules. */\nexport const PLUGIN_ROOT = path.resolve(import.meta.dirname, '..', '..', '..');\n\n/**\n * Which vended dependencies this workspace's generators are responsible for.\n *\n * Only these are synced, so a package the user added themselves keeps the version\n * they chose. Ownership is derived from the generators the workspace has run and\n * the dependencies each declares — nothing extra is recorded in the workspace.\n */\nexport interface OwnedDependencies {\n  readonly ts: ReadonlySet<string>;\n  readonly py: ReadonlySet<string>;\n  /**\n   * The same, split by the root of the project that owns it, for scoping a pin\n   * embedded in a generated file to the project it sits in. Keyed by project\n   * root; read through {@link ownedForFile}.\n   */\n  readonly byProject: ReadonlyMap<\n    string,\n    { readonly ts: ReadonlySet<string>; readonly py: ReadonlySet<string> }\n  >;\n}\n\n/**\n * One recorded run of a generator, with the metadata it wrote.\n *\n * The metadata carries the values the generator's dependency conditions read, so\n * a declaration filters down to the branch this occurrence actually took.\n */\nexport interface GeneratorOccurrence {\n  readonly id: string;\n  readonly metadata: DependencyMetadata;\n  /** Root of the project this ran against, for scoping what it owns to it. */\n  readonly projectRoot?: string;\n}\n\n/**\n * Every recorded run of a generator in this workspace, from the metadata\n * generators record on the projects (and components) they create.\n *\n * A generator appears once per project or component it created, since each may\n * have been run with different options.\n *\n * `init` creates no project, so its config file stands in for it.\n */\nexport const generatorOccurrences = (\n  tree: Tree,\n): readonly GeneratorOccurrence[] => {\n  const occurrences: GeneratorOccurrence[] = [];\n  if (tree.exists(AWS_NX_PLUGIN_CONFIG_FILE_NAME)) {\n    occurrences.push({ id: 'init', metadata: {} });\n  }\n  for (const [, project] of getProjects(tree)) {\n    const metadata = project.metadata as\n      | {\n          generator?: string;\n          components?: ({ generator?: string } & DependencyMetadata)[];\n        }\n      | undefined;\n    if (metadata?.generator) {\n      const { components, ...ownMetadata } = metadata;\n      occurrences.push({\n        id: metadata.generator,\n        metadata: ownMetadata,\n        projectRoot: project.root,\n      });\n    }\n    for (const component of metadata?.components ?? []) {\n      if (component.generator) {\n        occurrences.push({\n          id: component.generator,\n          metadata: component,\n          projectRoot: project.root,\n        });\n      }\n    }\n  }\n  return occurrences;\n};\n\n/** Generator ids this workspace has run. */\nexport const generatorsRun = (tree: Tree): ReadonlySet<string> =>\n  new Set(generatorOccurrences(tree).map((occurrence) => occurrence.id));\n\n/**\n * Union of the dependencies declared by the generators this workspace has run,\n * narrowed per occurrence to those whose conditions its recorded metadata\n * satisfies — a project generated with one protocol does not own another's\n * packages.\n *\n * A `versionOnly` entry is owned like any other: it is declared precisely so the\n * sync keeps its pinned version current wherever the workspace already holds it.\n *\n * Each generator module exports its declaration, so reading one is an import\n * rather than a run — the generators themselves are never invoked.\n */\nexport const ownedDependencies = async (\n  tree: Tree,\n): Promise<OwnedDependencies> => {\n  const occurrences = generatorOccurrences(tree);\n  const ts = new Set<string>();\n  const py = new Set<string>();\n  const byProject = new Map<string, { ts: Set<string>; py: Set<string> }>();\n\n  for (const info of buildGeneratorInfoList(PLUGIN_ROOT)) {\n    const matching = occurrences.filter(\n      (occurrence) => occurrence.id === info.id,\n    );\n    if (matching.length === 0) {\n      continue;\n    }\n    const declaration = await readDeclaration(info.resolvedFactoryPath);\n    if (!declaration) {\n      continue;\n    }\n    for (const { metadata, projectRoot } of matching) {\n      const scoped = projectRoot\n        ? (byProject.get(projectRoot) ??\n          byProject\n            .set(projectRoot, { ts: new Set(), py: new Set() })\n            .get(projectRoot)!)\n        : undefined;\n      for (const entry of ownedDependencyEntries(declaration.ts, metadata)) {\n        ts.add(entry.name as string);\n        scoped?.ts.add(entry.name as string);\n      }\n      for (const entry of ownedDependencyEntries(declaration.py, metadata)) {\n        py.add(entry.name as string);\n        scoped?.py.add(entry.name as string);\n      }\n    }\n  }\n\n  return { ts, py, byProject };\n};\n\n/**\n * Roots of the projects every generator contributes into, rather than one\n * generator owning outright.\n *\n * `sharedConstructsGenerator` creates these and each infra generator writes its\n * own module into them — the Terraform modules carrying the `uv run --with` pins\n * come from the agent-core, api, identity and website helpers alike. Both are\n * registered projects, so scoping a file here to the generator that created the\n * project would strand every pin the others put there.\n */\nconst SHARED_PROJECT_ROOTS = [\n  `${PACKAGES_DIR}/${SHARED_CONSTRUCTS_DIR}`,\n  `${PACKAGES_DIR}/${SHARED_TERRAFORM_DIR}`,\n];\n\n/**\n * The dependencies owned where a file sits: those of the project it belongs to,\n * or the workspace-wide union for a file in a shared project or under none.\n *\n * Used for the pins embedded in a generated file, so a version is only rewritten\n * where the generator that pins it actually ran: a `Dockerfile` under one\n * project's root is not upgraded because a sibling project owns the package.\n *\n * The longest matching root wins, since a nested project's root is a prefix of\n * nothing else but its own files.\n */\nexport const ownedForFile = (\n  owned: OwnedDependencies,\n  filePath: string,\n): { ts: ReadonlySet<string>; py: ReadonlySet<string> } => {\n  if (\n    SHARED_PROJECT_ROOTS.some(\n      (root) => filePath === root || filePath.startsWith(`${root}/`),\n    )\n  ) {\n    return owned;\n  }\n  let best: { ts: ReadonlySet<string>; py: ReadonlySet<string> } | undefined;\n  let bestLength = -1;\n  for (const [root, scoped] of owned.byProject) {\n    if (\n      (filePath === root || filePath.startsWith(`${root}/`)) &&\n      root.length > bestLength\n    ) {\n      best = scoped;\n      bestLength = root.length;\n    }\n  }\n  return best ?? owned;\n};\n\n/**\n * A generator's `DEPENDENCIES`, or undefined when it declares none.\n * A generator that fails to load must not fail the upgrade, so its dependencies\n * are treated as unowned and left as they are.\n */\nconst readDeclaration = async (\n  factoryPath: string,\n): Promise<DependencyDeclaration | undefined> => {\n  try {\n    const module = await import(`${factoryPath}.js`);\n    return module.DEPENDENCIES;\n  } catch {\n    return undefined;\n  }\n};\n"],"names":["path","getProjects","AWS_NX_PLUGIN_CONFIG_FILE_NAME","ownedDependencyEntries","buildGeneratorInfoList","PACKAGES_DIR","SHARED_CONSTRUCTS_DIR","SHARED_TERRAFORM_DIR","PLUGIN_ROOT","resolve","dirname","generatorOccurrences","tree","occurrences","exists","push","id","metadata","project","generator","components","ownMetadata","projectRoot","root","component","generatorsRun","Set","map","occurrence","ownedDependencies","ts","py","byProject","Map","info","matching","filter","length","declaration","readDeclaration","resolvedFactoryPath","scoped","get","set","undefined","entry","add","name","SHARED_PROJECT_ROOTS","ownedForFile","owned","filePath","some","startsWith","best","bestLength","factoryPath","module","DEPENDENCIES"],"mappings":"AAAA;;;CAGC,GACD,YAAYA,UAAU,YAAY;AAClC,SAASC,WAAW,QAAmB,aAAa;AACpD,SAASC,8BAA8B,QAAQ,qBAAkB;AACjE,SAGEC,sBAAsB,QACjB,8BAA2B;AAClC,SAASC,sBAAsB,QAAQ,mBAAgB;AACvD,SACEC,YAAY,EACZC,qBAAqB,EACrBC,oBAAoB,QACf,oCAAiC;AAExC,0EAA0E,GAC1E,OAAO,MAAMC,cAAcR,KAAKS,OAAO,CAAC,YAAYC,OAAO,EAAE,MAAM,MAAM,MAAM;AAoC/E;;;;;;;;CAQC,GACD,OAAO,MAAMC,uBAAuB,CAClCC;IAEA,MAAMC,cAAqC,EAAE;IAC7C,IAAID,KAAKE,MAAM,CAACZ,iCAAiC;QAC/CW,YAAYE,IAAI,CAAC;YAAEC,IAAI;YAAQC,UAAU,CAAC;QAAE;IAC9C;IACA,KAAK,MAAM,GAAGC,QAAQ,IAAIjB,YAAYW,MAAO;QAC3C,MAAMK,WAAWC,QAAQD,QAAQ;QAMjC,IAAIA,UAAUE,WAAW;YACvB,MAAM,EAAEC,UAAU,EAAE,GAAGC,aAAa,GAAGJ;YACvCJ,YAAYE,IAAI,CAAC;gBACfC,IAAIC,SAASE,SAAS;gBACtBF,UAAUI;gBACVC,aAAaJ,QAAQK,IAAI;YAC3B;QACF;QACA,KAAK,MAAMC,aAAaP,UAAUG,cAAc,EAAE,CAAE;YAClD,IAAII,UAAUL,SAAS,EAAE;gBACvBN,YAAYE,IAAI,CAAC;oBACfC,IAAIQ,UAAUL,SAAS;oBACvBF,UAAUO;oBACVF,aAAaJ,QAAQK,IAAI;gBAC3B;YACF;QACF;IACF;IACA,OAAOV;AACT,EAAE;AAEF,0CAA0C,GAC1C,OAAO,MAAMY,gBAAgB,CAACb,OAC5B,IAAIc,IAAIf,qBAAqBC,MAAMe,GAAG,CAAC,CAACC,aAAeA,WAAWZ,EAAE,GAAG;AAEzE;;;;;;;;;;;CAWC,GACD,OAAO,MAAMa,oBAAoB,OAC/BjB;IAEA,MAAMC,cAAcF,qBAAqBC;IACzC,MAAMkB,KAAK,IAAIJ;IACf,MAAMK,KAAK,IAAIL;IACf,MAAMM,YAAY,IAAIC;IAEtB,KAAK,MAAMC,QAAQ9B,uBAAuBI,aAAc;QACtD,MAAM2B,WAAWtB,YAAYuB,MAAM,CACjC,CAACR,aAAeA,WAAWZ,EAAE,KAAKkB,KAAKlB,EAAE;QAE3C,IAAImB,SAASE,MAAM,KAAK,GAAG;YACzB;QACF;QACA,MAAMC,cAAc,MAAMC,gBAAgBL,KAAKM,mBAAmB;QAClE,IAAI,CAACF,aAAa;YAChB;QACF;QACA,KAAK,MAAM,EAAErB,QAAQ,EAAEK,WAAW,EAAE,IAAIa,SAAU;YAChD,MAAMM,SAASnB,cACVU,UAAUU,GAAG,CAACpB,gBACfU,UACGW,GAAG,CAACrB,aAAa;gBAAEQ,IAAI,IAAIJ;gBAAOK,IAAI,IAAIL;YAAM,GAChDgB,GAAG,CAACpB,eACPsB;YACJ,KAAK,MAAMC,SAAS1C,uBAAuBmC,YAAYR,EAAE,EAAEb,UAAW;gBACpEa,GAAGgB,GAAG,CAACD,MAAME,IAAI;gBACjBN,QAAQX,GAAGgB,IAAID,MAAME,IAAI;YAC3B;YACA,KAAK,MAAMF,SAAS1C,uBAAuBmC,YAAYP,EAAE,EAAEd,UAAW;gBACpEc,GAAGe,GAAG,CAACD,MAAME,IAAI;gBACjBN,QAAQV,GAAGe,IAAID,MAAME,IAAI;YAC3B;QACF;IACF;IAEA,OAAO;QAAEjB;QAAIC;QAAIC;IAAU;AAC7B,EAAE;AAEF;;;;;;;;;CASC,GACD,MAAMgB,uBAAuB;IAC3B,GAAG3C,aAAa,CAAC,EAAEC,uBAAuB;IAC1C,GAAGD,aAAa,CAAC,EAAEE,sBAAsB;CAC1C;AAED;;;;;;;;;;CAUC,GACD,OAAO,MAAM0C,eAAe,CAC1BC,OACAC;IAEA,IACEH,qBAAqBI,IAAI,CACvB,CAAC7B,OAAS4B,aAAa5B,QAAQ4B,SAASE,UAAU,CAAC,GAAG9B,KAAK,CAAC,CAAC,IAE/D;QACA,OAAO2B;IACT;IACA,IAAII;IACJ,IAAIC,aAAa,CAAC;IAClB,KAAK,MAAM,CAAChC,MAAMkB,OAAO,IAAIS,MAAMlB,SAAS,CAAE;QAC5C,IACE,AAACmB,CAAAA,aAAa5B,QAAQ4B,SAASE,UAAU,CAAC,GAAG9B,KAAK,CAAC,CAAC,CAAA,KACpDA,KAAKc,MAAM,GAAGkB,YACd;YACAD,OAAOb;YACPc,aAAahC,KAAKc,MAAM;QAC1B;IACF;IACA,OAAOiB,QAAQJ;AACjB,EAAE;AAEF;;;;CAIC,GACD,MAAMX,kBAAkB,OACtBiB;IAEA,IAAI;QACF,MAAMC,SAAS,MAAM,MAAM,CAAC,GAAGD,YAAY,GAAG,CAAC;QAC/C,OAAOC,OAAOC,YAAY;IAC5B,EAAE,OAAM;QACN,OAAOd;IACT;AACF"}