@aws/nx-plugin 1.0.0-rc.77 → 1.0.0-rc.79

package/migrations.json

@@ -32,6 +32,16 @@
       "description": "Surface mfa and mfaSecondFactor on the vended UserIdentity construct/module",
       "implementation": "./src/migrations/latest/user-identity-configurable-mfa/migration"
     },
+    "latest-static-website-configurable-waf-encryption": {
+      "version": "1.0.0-rc.78",
+      "description": "Surface enableWaf, encryption, encryptionKey and enableKeyRotation on the vended StaticWebsite construct/module",
+      "implementation": "./src/migrations/latest/static-website-configurable-waf-encryption/migration"
+    },
+    "latest-py-agent-ag-ui-hooks": {
+      "version": "1.0.0-rc.79",
+      "description": "Forward the py#agent Strands hooks to the AG-UI adapter so model and tool errors are reported",
+      "implementation": "./src/migrations/latest/py-agent-ag-ui-hooks/migration"
+    },
     "v1.0.0-rc.50-0001-modernize-function-props-cast": {
       "version": "1.0.0-rc.50",
       "description": "Replace the legacy angle-bracket FunctionProps type assertion with the modern as syntax in generated API constructs",
@@ -153,7 +163,7 @@
       "implementation": "./src/migrations/v1.0.0-rc.72/0001-py-agent-session-management-support/migration"
     },
     "sync-vended-versions": {
-      "version": "1.0.0-rc.77",
+      "version": "1.0.0-rc.79",
       "description": "Sync vended dependency versions and the tracked plugin version to those vended by this release",
       "implementation": "./src/utils/version-upgrade-migration/migration"
     }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@aws/nx-plugin",
-  "version": "1.0.0-rc.77",
+  "version": "1.0.0-rc.79",
   "repository": {
     "type": "git",
     "url": "https://github.com/awslabs/nx-plugin-for-aws.git",

package/src/migrations/latest/py-agent-ag-ui-hooks/metadata.json

@@ -0,0 +1,3 @@
+{
+  "description": "Forward the py#agent Strands hooks to the AG-UI adapter so model and tool errors are reported"
+}

package/src/migrations/latest/py-agent-ag-ui-hooks/migration.d.ts

@@ -0,0 +1,6 @@
+/**
+ * Copyright Amazon.com, Inc. or its affiliates. All Rights Reserved.
+ * SPDX-License-Identifier: Apache-2.0
+ */
+import { type MigrationReturnObject, type Tree } from '@nx/devkit';
+export default function migration(tree: Tree): Promise<MigrationReturnObject>;

package/src/migrations/latest/py-agent-ag-ui-hooks/migration.js

@@ -0,0 +1,113 @@
+/**
+ * Copyright Amazon.com, Inc. or its affiliates. All Rights Reserved.
+ * SPDX-License-Identifier: Apache-2.0
+ */ import { getProjects, joinPathFragments } from "@nx/devkit";
+import { PY_AGENT_GENERATOR_INFO } from "../../../py/agent/generator.js";
+import { addPythonDestructuredImport, applyGritQL, captureGritQLVariable, GRIT_INSERT_PLACEHOLDER, insertViaGritQL, matchGritQL } from "../../../utils/ast.js";
+import { formatFilesInSubtree } from "../../../utils/format.js";
+/**
+ * Forward a Strands py#agent's hooks to the AG-UI adapter.
+ *
+ * `StrandsAgent` builds a fresh `Agent` per `thread_id` by copying the template
+ * Agent's kwargs, but deliberately skips `hooks` - Strands keeps only the built
+ * `HookRegistry`, so the providers can't be read back off it. An AG-UI agent's
+ * `log_model_errors` / `log_tool_errors` therefore never fired for served
+ * requests, and model/tool failures were reported as successful runs.
+ *
+ * The fix hoists the hooks list out of the `Agent(...)` call into an
+ * `AGENT_HOOKS` module constant in `agent.py` - whatever the user has put in it,
+ * so custom hooks come along - and passes that to `StrandsAgent(...)` in
+ * `main.py` as well. `agent.py` is hoisted for every protocol so the constant
+ * matches what the generator vends today; only AG-UI needs the `main.py` half.
+ */ // `Agent`'s `hooks` list is invariant, so the hoisted constant has to declare
+// the parameter's own type - an inline literal was inferred from it instead.
+const HOOKS_TYPE = 'list[HookProvider | HookCallback]';
+const HOOKS_MODULE = 'strands.hooks';
+// Anchored on the `get_agent` context manager - the one shape shared by every
+// generated protocol and connection combination - so the constant lands
+// directly above its only use, where the generator vends it.
+const HOIST_HOOKS_PATTERN = `language python
+\`@contextmanager
+def get_agent($params):
+    $body\` => raw\`AGENT_HOOKS: ${HOOKS_TYPE} = ${GRIT_INSERT_PLACEHOLDER}
+
+
+@contextmanager
+def get_agent($params):
+    $body\` where { $program <: not contains \`AGENT_HOOKS\` }`;
+// Scoped to the Agent constructor so a hooks list the user passes elsewhere in
+// agent.py is left alone.
+const HOOKS_LIST_CAPTURE_PATTERN = 'language python\n`hooks=[$hooks]` where { $hooks <: within `Agent($_)` }';
+const HOOKS_LIST_REWRITE_PATTERN = 'language python\n`hooks=[$_]` as $kwarg where { $kwarg <: within `Agent($_)`, $kwarg => `hooks=AGENT_HOOKS` }';
+const AGUI_CONSTRUCTOR_MATCH_PATTERN = 'language python\n`StrandsAgent($args)` where { $args <: contains `agent=$_` }';
+const AGUI_HOOKS_WIRED_PATTERN = 'language python\n`StrandsAgent($args)` where { $args <: contains `agent=$_`, $args <: contains `hooks=$_` }';
+// Appends after the last argument rather than re-emitting the argument list,
+// both to land `hooks=` where the template puts it and to leave the other
+// arguments' formatting and comments untouched.
+const AGUI_HOOKS_APPEND_PATTERN = 'language python\n`StrandsAgent($args)` where { $args <: contains `agent=$_`, $args <: not contains `hooks=$_`, $args <: [$..., $last], $last += `, hooks=AGENT_HOOKS` }';
+const findAgentComponents = (components)=>(components ?? []).filter((component)=>component.generator === PY_AGENT_GENERATOR_INFO.id);
+/**
+ * Hoists `agent.py`'s `hooks=[...]` list into an `AGENT_HOOKS` module constant,
+ * returning whether the file ends up exporting one.
+ */ const hoistAgentHooks = async (tree, agentPath)=>{
+    if ((tree.read(agentPath, 'utf-8') ?? '').includes('AGENT_HOOKS')) {
+        return true;
+    }
+    // Nothing to hoist unless the Agent is constructed with an inline hooks list.
+    const hooks = await captureGritQLVariable(tree, agentPath, HOOKS_LIST_CAPTURE_PATTERN, 'hooks');
+    if (!hooks) return false;
+    if (!await insertViaGritQL(tree, agentPath, HOIST_HOOKS_PATTERN, `[${hooks}]`)) {
+        return false;
+    }
+    await applyGritQL(tree, agentPath, HOOKS_LIST_REWRITE_PATTERN);
+    await addPythonDestructuredImport(tree, agentPath, [
+        'HookCallback',
+        'HookProvider'
+    ], HOOKS_MODULE);
+    return true;
+};
+const migrateAgent = async (tree, agentDir, component, nextSteps)=>{
+    // LangChain agents pass no hooks - their AG-UI adapter is handed the graph
+    // itself rather than rebuilding one, so nothing is dropped.
+    if (component.framework === 'langchain') return;
+    const agentPath = joinPathFragments(agentDir, 'agent.py');
+    const mainPath = joinPathFragments(agentDir, 'main.py');
+    const isAgUi = component.protocol === 'ag-ui';
+    if (!tree.exists(agentPath)) return;
+    if (!await hoistAgentHooks(tree, agentPath)) {
+        if (isAgUi) {
+            nextSteps.push(`${agentPath}: the hooks passed to \`Agent(...)\` have diverged from the generated shape - left untouched. Hoist them into an \`AGENT_HOOKS\` module constant and pass it to \`StrandsAgent(...)\` in ${mainPath} too, or AG-UI will not register them (see the py#agent generator's template).`);
+        }
+        return;
+    }
+    // Only AG-UI rebuilds the Agent, so only its main.py needs the hooks.
+    if (!isAgUi || !tree.exists(mainPath)) return;
+    // Already passing hooks, whether from a previous run or the user's own wiring.
+    if (await matchGritQL(tree, mainPath, AGUI_HOOKS_WIRED_PATTERN)) return;
+    if (!await matchGritQL(tree, mainPath, AGUI_CONSTRUCTOR_MATCH_PATTERN)) {
+        nextSteps.push(`${mainPath}: the \`StrandsAgent(...)\` constructor has diverged from the generated shape - left untouched. Pass \`hooks=AGENT_HOOKS\` to it, importing \`AGENT_HOOKS\` from \`.agent\`, or AG-UI will not register the agent's hooks (see the py#agent generator's template).`);
+        return;
+    }
+    await applyGritQL(tree, mainPath, AGUI_HOOKS_APPEND_PATTERN);
+    await addPythonDestructuredImport(tree, mainPath, [
+        'AGENT_HOOKS'
+    ], '.agent');
+};
+export default async function migration(tree) {
+    const nextSteps = [];
+    for (const project of getProjects(tree).values()){
+        const components = findAgentComponents(project.metadata?.components);
+        for (const component of components){
+            if (!component.path) continue;
+            // Legacy component paths point at agent.py rather than its directory.
+            const componentDir = component.path.endsWith('/agent.py') ? component.path.slice(0, -'/agent.py'.length) : component.path;
+            await migrateAgent(tree, joinPathFragments(project.root, componentDir), component, nextSteps);
+        }
+    }
+    await formatFilesInSubtree(tree);
+    return {
+        nextSteps
+    };
+}
+
+//# sourceMappingURL=migration.js.map

package/src/migrations/latest/py-agent-ag-ui-hooks/migration.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../../../../../../../packages/nx-plugin/src/migrations/latest/py-agent-ag-ui-hooks/migration.ts"],"sourcesContent":["/**\n * Copyright Amazon.com, Inc. or its affiliates. All Rights Reserved.\n * SPDX-License-Identifier: Apache-2.0\n */\nimport {\n  getProjects,\n  joinPathFragments,\n  type MigrationReturnObject,\n  type Tree,\n} from '@nx/devkit';\nimport { PY_AGENT_GENERATOR_INFO } from '../../../py/agent/generator';\nimport {\n  addPythonDestructuredImport,\n  applyGritQL,\n  captureGritQLVariable,\n  GRIT_INSERT_PLACEHOLDER,\n  insertViaGritQL,\n  matchGritQL,\n} from '../../../utils/ast';\nimport { formatFilesInSubtree } from '../../../utils/format';\nimport type { ComponentMetadata } from '../../../utils/nx';\n\n/**\n * Forward a Strands py#agent's hooks to the AG-UI adapter.\n *\n * `StrandsAgent` builds a fresh `Agent` per `thread_id` by copying the template\n * Agent's kwargs, but deliberately skips `hooks` - Strands keeps only the built\n * `HookRegistry`, so the providers can't be read back off it. An AG-UI agent's\n * `log_model_errors` / `log_tool_errors` therefore never fired for served\n * requests, and model/tool failures were reported as successful runs.\n *\n * The fix hoists the hooks list out of the `Agent(...)` call into an\n * `AGENT_HOOKS` module constant in `agent.py` - whatever the user has put in it,\n * so custom hooks come along - and passes that to `StrandsAgent(...)` in\n * `main.py` as well. `agent.py` is hoisted for every protocol so the constant\n * matches what the generator vends today; only AG-UI needs the `main.py` half.\n */\n\n// `Agent`'s `hooks` list is invariant, so the hoisted constant has to declare\n// the parameter's own type - an inline literal was inferred from it instead.\nconst HOOKS_TYPE = 'list[HookProvider | HookCallback]';\nconst HOOKS_MODULE = 'strands.hooks';\n\n// Anchored on the `get_agent` context manager - the one shape shared by every\n// generated protocol and connection combination - so the constant lands\n// directly above its only use, where the generator vends it.\nconst HOIST_HOOKS_PATTERN = `language python\n\\`@contextmanager\ndef get_agent($params):\n    $body\\` => raw\\`AGENT_HOOKS: ${HOOKS_TYPE} = ${GRIT_INSERT_PLACEHOLDER}\n\n\n@contextmanager\ndef get_agent($params):\n    $body\\` where { $program <: not contains \\`AGENT_HOOKS\\` }`;\n\n// Scoped to the Agent constructor so a hooks list the user passes elsewhere in\n// agent.py is left alone.\nconst HOOKS_LIST_CAPTURE_PATTERN =\n  'language python\\n`hooks=[$hooks]` where { $hooks <: within `Agent($_)` }';\nconst HOOKS_LIST_REWRITE_PATTERN =\n  'language python\\n`hooks=[$_]` as $kwarg where { $kwarg <: within `Agent($_)`, $kwarg => `hooks=AGENT_HOOKS` }';\n\nconst AGUI_CONSTRUCTOR_MATCH_PATTERN =\n  'language python\\n`StrandsAgent($args)` where { $args <: contains `agent=$_` }';\nconst AGUI_HOOKS_WIRED_PATTERN =\n  'language python\\n`StrandsAgent($args)` where { $args <: contains `agent=$_`, $args <: contains `hooks=$_` }';\n// Appends after the last argument rather than re-emitting the argument list,\n// both to land `hooks=` where the template puts it and to leave the other\n// arguments' formatting and comments untouched.\nconst AGUI_HOOKS_APPEND_PATTERN =\n  'language python\\n`StrandsAgent($args)` where { $args <: contains `agent=$_`, $args <: not contains `hooks=$_`, $args <: [$..., $last], $last += `, hooks=AGENT_HOOKS` }';\n\nconst findAgentComponents = (\n  components: ComponentMetadata[] | undefined,\n): ComponentMetadata[] =>\n  (components ?? []).filter(\n    (component) => component.generator === PY_AGENT_GENERATOR_INFO.id,\n  );\n\n/**\n * Hoists `agent.py`'s `hooks=[...]` list into an `AGENT_HOOKS` module constant,\n * returning whether the file ends up exporting one.\n */\nconst hoistAgentHooks = async (\n  tree: Tree,\n  agentPath: string,\n): Promise<boolean> => {\n  if ((tree.read(agentPath, 'utf-8') ?? '').includes('AGENT_HOOKS')) {\n    return true;\n  }\n\n  // Nothing to hoist unless the Agent is constructed with an inline hooks list.\n  const hooks = await captureGritQLVariable(\n    tree,\n    agentPath,\n    HOOKS_LIST_CAPTURE_PATTERN,\n    'hooks',\n  );\n  if (!hooks) return false;\n\n  if (\n    !(await insertViaGritQL(tree, agentPath, HOIST_HOOKS_PATTERN, `[${hooks}]`))\n  ) {\n    return false;\n  }\n  await applyGritQL(tree, agentPath, HOOKS_LIST_REWRITE_PATTERN);\n  await addPythonDestructuredImport(\n    tree,\n    agentPath,\n    ['HookCallback', 'HookProvider'],\n    HOOKS_MODULE,\n  );\n  return true;\n};\n\nconst migrateAgent = async (\n  tree: Tree,\n  agentDir: string,\n  component: ComponentMetadata,\n  nextSteps: string[],\n): Promise<void> => {\n  // LangChain agents pass no hooks - their AG-UI adapter is handed the graph\n  // itself rather than rebuilding one, so nothing is dropped.\n  if (component.framework === 'langchain') return;\n\n  const agentPath = joinPathFragments(agentDir, 'agent.py');\n  const mainPath = joinPathFragments(agentDir, 'main.py');\n  const isAgUi = component.protocol === 'ag-ui';\n\n  if (!tree.exists(agentPath)) return;\n\n  if (!(await hoistAgentHooks(tree, agentPath))) {\n    if (isAgUi) {\n      nextSteps.push(\n        `${agentPath}: the hooks passed to \\`Agent(...)\\` have diverged from the generated shape - left untouched. Hoist them into an \\`AGENT_HOOKS\\` module constant and pass it to \\`StrandsAgent(...)\\` in ${mainPath} too, or AG-UI will not register them (see the py#agent generator's template).`,\n      );\n    }\n    return;\n  }\n\n  // Only AG-UI rebuilds the Agent, so only its main.py needs the hooks.\n  if (!isAgUi || !tree.exists(mainPath)) return;\n\n  // Already passing hooks, whether from a previous run or the user's own wiring.\n  if (await matchGritQL(tree, mainPath, AGUI_HOOKS_WIRED_PATTERN)) return;\n\n  if (!(await matchGritQL(tree, mainPath, AGUI_CONSTRUCTOR_MATCH_PATTERN))) {\n    nextSteps.push(\n      `${mainPath}: the \\`StrandsAgent(...)\\` constructor has diverged from the generated shape - left untouched. Pass \\`hooks=AGENT_HOOKS\\` to it, importing \\`AGENT_HOOKS\\` from \\`.agent\\`, or AG-UI will not register the agent's hooks (see the py#agent generator's template).`,\n    );\n    return;\n  }\n\n  await applyGritQL(tree, mainPath, AGUI_HOOKS_APPEND_PATTERN);\n  await addPythonDestructuredImport(tree, mainPath, ['AGENT_HOOKS'], '.agent');\n};\n\nexport default async function migration(\n  tree: Tree,\n): Promise<MigrationReturnObject> {\n  const nextSteps: string[] = [];\n\n  for (const project of getProjects(tree).values()) {\n    const components = findAgentComponents(\n      (project.metadata as { components?: ComponentMetadata[] })?.components,\n    );\n\n    for (const component of components) {\n      if (!component.path) continue;\n\n      // Legacy component paths point at agent.py rather than its directory.\n      const componentDir = component.path.endsWith('/agent.py')\n        ? component.path.slice(0, -'/agent.py'.length)\n        : component.path;\n\n      await migrateAgent(\n        tree,\n        joinPathFragments(project.root, componentDir),\n        component,\n        nextSteps,\n      );\n    }\n  }\n\n  await formatFilesInSubtree(tree);\n\n  return { nextSteps };\n}\n"],"names":["getProjects","joinPathFragments","PY_AGENT_GENERATOR_INFO","addPythonDestructuredImport","applyGritQL","captureGritQLVariable","GRIT_INSERT_PLACEHOLDER","insertViaGritQL","matchGritQL","formatFilesInSubtree","HOOKS_TYPE","HOOKS_MODULE","HOIST_HOOKS_PATTERN","HOOKS_LIST_CAPTURE_PATTERN","HOOKS_LIST_REWRITE_PATTERN","AGUI_CONSTRUCTOR_MATCH_PATTERN","AGUI_HOOKS_WIRED_PATTERN","AGUI_HOOKS_APPEND_PATTERN","findAgentComponents","components","filter","component","generator","id","hoistAgentHooks","tree","agentPath","read","includes","hooks","migrateAgent","agentDir","nextSteps","framework","mainPath","isAgUi","protocol","exists","push","migration","project","values","metadata","path","componentDir","endsWith","slice","length","root"],"mappings":"AAAA;;;CAGC,GACD,SACEA,WAAW,EACXC,iBAAiB,QAGZ,aAAa;AACpB,SAASC,uBAAuB,QAAQ,iCAA8B;AACtE,SACEC,2BAA2B,EAC3BC,WAAW,EACXC,qBAAqB,EACrBC,uBAAuB,EACvBC,eAAe,EACfC,WAAW,QACN,wBAAqB;AAC5B,SAASC,oBAAoB,QAAQ,2BAAwB;AAG7D;;;;;;;;;;;;;;CAcC,GAED,8EAA8E;AAC9E,6EAA6E;AAC7E,MAAMC,aAAa;AACnB,MAAMC,eAAe;AAErB,8EAA8E;AAC9E,wEAAwE;AACxE,6DAA6D;AAC7D,MAAMC,sBAAsB,CAAC;;;iCAGI,EAAEF,WAAW,GAAG,EAAEJ,wBAAwB;;;;;8DAKb,CAAC;AAE/D,+EAA+E;AAC/E,0BAA0B;AAC1B,MAAMO,6BACJ;AACF,MAAMC,6BACJ;AAEF,MAAMC,iCACJ;AACF,MAAMC,2BACJ;AACF,6EAA6E;AAC7E,0EAA0E;AAC1E,gDAAgD;AAChD,MAAMC,4BACJ;AAEF,MAAMC,sBAAsB,CAC1BC,aAEA,AAACA,CAAAA,cAAc,EAAE,AAAD,EAAGC,MAAM,CACvB,CAACC,YAAcA,UAAUC,SAAS,KAAKpB,wBAAwBqB,EAAE;AAGrE;;;CAGC,GACD,MAAMC,kBAAkB,OACtBC,MACAC;IAEA,IAAI,AAACD,CAAAA,KAAKE,IAAI,CAACD,WAAW,YAAY,EAAC,EAAGE,QAAQ,CAAC,gBAAgB;QACjE,OAAO;IACT;IAEA,8EAA8E;IAC9E,MAAMC,QAAQ,MAAMxB,sBAClBoB,MACAC,WACAb,4BACA;IAEF,IAAI,CAACgB,OAAO,OAAO;IAEnB,IACE,CAAE,MAAMtB,gBAAgBkB,MAAMC,WAAWd,qBAAqB,CAAC,CAAC,EAAEiB,MAAM,CAAC,CAAC,GAC1E;QACA,OAAO;IACT;IACA,MAAMzB,YAAYqB,MAAMC,WAAWZ;IACnC,MAAMX,4BACJsB,MACAC,WACA;QAAC;QAAgB;KAAe,EAChCf;IAEF,OAAO;AACT;AAEA,MAAMmB,eAAe,OACnBL,MACAM,UACAV,WACAW;IAEA,2EAA2E;IAC3E,4DAA4D;IAC5D,IAAIX,UAAUY,SAAS,KAAK,aAAa;IAEzC,MAAMP,YAAYzB,kBAAkB8B,UAAU;IAC9C,MAAMG,WAAWjC,kBAAkB8B,UAAU;IAC7C,MAAMI,SAASd,UAAUe,QAAQ,KAAK;IAEtC,IAAI,CAACX,KAAKY,MAAM,CAACX,YAAY;IAE7B,IAAI,CAAE,MAAMF,gBAAgBC,MAAMC,YAAa;QAC7C,IAAIS,QAAQ;YACVH,UAAUM,IAAI,CACZ,GAAGZ,UAAU,yLAAyL,EAAEQ,SAAS,8EAA8E,CAAC;QAEpS;QACA;IACF;IAEA,sEAAsE;IACtE,IAAI,CAACC,UAAU,CAACV,KAAKY,MAAM,CAACH,WAAW;IAEvC,+EAA+E;IAC/E,IAAI,MAAM1B,YAAYiB,MAAMS,UAAUlB,2BAA2B;IAEjE,IAAI,CAAE,MAAMR,YAAYiB,MAAMS,UAAUnB,iCAAkC;QACxEiB,UAAUM,IAAI,CACZ,GAAGJ,SAAS,kQAAkQ,CAAC;QAEjR;IACF;IAEA,MAAM9B,YAAYqB,MAAMS,UAAUjB;IAClC,MAAMd,4BAA4BsB,MAAMS,UAAU;QAAC;KAAc,EAAE;AACrE;AAEA,eAAe,eAAeK,UAC5Bd,IAAU;IAEV,MAAMO,YAAsB,EAAE;IAE9B,KAAK,MAAMQ,WAAWxC,YAAYyB,MAAMgB,MAAM,GAAI;QAChD,MAAMtB,aAAaD,oBAChBsB,QAAQE,QAAQ,EAA2CvB;QAG9D,KAAK,MAAME,aAAaF,WAAY;YAClC,IAAI,CAACE,UAAUsB,IAAI,EAAE;YAErB,sEAAsE;YACtE,MAAMC,eAAevB,UAAUsB,IAAI,CAACE,QAAQ,CAAC,eACzCxB,UAAUsB,IAAI,CAACG,KAAK,CAAC,GAAG,CAAC,YAAYC,MAAM,IAC3C1B,UAAUsB,IAAI;YAElB,MAAMb,aACJL,MACAxB,kBAAkBuC,QAAQQ,IAAI,EAAEJ,eAChCvB,WACAW;QAEJ;IACF;IAEA,MAAMvB,qBAAqBgB;IAE3B,OAAO;QAAEO;IAAU;AACrB"}

package/src/migrations/latest/static-website-configurable-waf-encryption/metadata.json

@@ -0,0 +1,3 @@
+{
+  "description": "Surface enableWaf, encryption, encryptionKey and enableKeyRotation on the vended StaticWebsite construct/module"
+}

package/src/migrations/latest/static-website-configurable-waf-encryption/migration.d.ts

@@ -0,0 +1,6 @@
+/**
+ * Copyright Amazon.com, Inc. or its affiliates. All Rights Reserved.
+ * SPDX-License-Identifier: Apache-2.0
+ */
+import { type MigrationReturnObject, type Tree } from '@nx/devkit';
+export default function migration(tree: Tree): Promise<MigrationReturnObject>;

package/src/migrations/latest/static-website-configurable-waf-encryption/migration.js

@@ -0,0 +1,418 @@
+/**
+ * Copyright Amazon.com, Inc. or its affiliates. All Rights Reserved.
+ * SPDX-License-Identifier: Apache-2.0
+ */ import { joinPathFragments } from "@nx/devkit";
+import { addDestructuredImport, applyGritQL, captureGritQLVariable, GRIT_INSERT_PLACEHOLDER, insertViaGritQL, matchGritQL } from "../../../utils/ast.js";
+import { formatFilesInSubtree } from "../../../utils/format.js";
+import { PACKAGES_DIR, SHARED_CONSTRUCTS_DIR, SHARED_TERRAFORM_DIR } from "../../../utils/shared-constructs-constants.js";
+/**
+ * Bring existing workspaces up to the generators' current StaticWebsite
+ * configurability:
+ *
+ * - The vended `StaticWebsite` CDK construct gains `enableWaf`, `encryption`,
+ *   `encryptionKey` and `enableKeyRotation` props. The WAF Web ACL is now
+ *   optional, the KMS key used to encrypt the website and distribution log
+ *   buckets is now overridable (or skippable in favour of another
+ *   `BucketEncryption`), and the auto-created key's rotation is configurable.
+ * - Each vended per-website app construct (`app/static-websites/*.ts`) gains
+ *   an optional `props` constructor parameter so these can be configured per
+ *   app, rather than only by hand-editing the vended construct.
+ * - The vended Terraform static-website core module gains the equivalent
+ *   `enable_waf`, `encryption`, `kms_key_arn`, `create_kms_key` and
+ *   `enable_key_rotation` variables. The CloudFront distribution's
+ *   `lifecycle.replace_triggered_by` on the WAF ACL is also dropped - it
+ *   can't resolve once the ACL has a count of 0 and no prior state to
+ *   reference, which broke `terraform plan` on any greenfield deployment
+ *   with `enable_waf = false`.
+ * - Each vended per-website Terraform app module (`app/static-websites/<name>/<name>.tf`)
+ *   gains pass-through `custom_domain_names`, `acm_certificate_arn`,
+ *   `enable_waf`, `encryption`, `kms_key_arn`, `create_kms_key` and
+ *   `enable_key_rotation` variables forwarded to the core module call,
+ *   matching the pass-through convention every other app-wraps-core
+ *   Terraform module in this plugin already follows (`rdb`, `agent-core`,
+ *   `dcr-proxies`, the REST/HTTP API).
+ *
+ * These files are generated with `KeepExisting`, so without this an upgraded
+ * workspace has generators that support this configuration but vended files
+ * that don't. Diverged files are left untouched and reported via `nextSteps`.
+ */ const CDK_STATIC_WEBSITE_FILE = `${PACKAGES_DIR}/${SHARED_CONSTRUCTS_DIR}/src/core/static-website.ts`;
+const CDK_STATIC_WEBSITES_APP_DIR = `${PACKAGES_DIR}/${SHARED_CONSTRUCTS_DIR}/src/app/static-websites`;
+const TERRAFORM_STATIC_WEBSITE_FILE = `${PACKAGES_DIR}/${SHARED_TERRAFORM_DIR}/src/core/static-website/static-website.tf`;
+const TERRAFORM_STATIC_WEBSITES_APP_DIR = `${PACKAGES_DIR}/${SHARED_TERRAFORM_DIR}/src/app/static-websites`;
+const CDK_DIVERGED_MESSAGE = `${CDK_STATIC_WEBSITE_FILE}: has diverged from the generated shape - left untouched. To pick up the enableWaf, encryption, encryptionKey and enableKeyRotation props, manually port them from the vended core/static-website.ts template (see the ts#react-website generator's static-website construct).`;
+const TERRAFORM_DIVERGED_MESSAGE = `${TERRAFORM_STATIC_WEBSITE_FILE}: has diverged from the generated shape - left untouched. To pick up the enable_waf, encryption, kms_key_arn, create_kms_key and enable_key_rotation variables, manually port them from the vended static-website.tf template (see the ts#react-website generator's static-website module).`;
+const terraformAppDivergedMessage = (filePath)=>`${filePath}: has diverged from the generated shape - left untouched. To make custom_domain_names, acm_certificate_arn, enable_waf, encryption, kms_key_arn, create_kms_key and enable_key_rotation configurable from your root Terraform configuration, add pass-through variables here and forward them to the static_website module call (see the ts#react-website generator's static-websites app template).`;
+// The doc comments below carry backticked markdown, which must stay out of
+// the GritQL pattern that inserts this text (see insertViaGritQL). It's routed
+// in as plain text via the placeholder instead.
+const STATIC_WEBSITE_PROPS_TEXT = `/**
+   * Whether to protect the CloudFront distribution with an AWS WAF Web ACL.
+   *
+   * @default true
+   */
+  readonly enableWaf?: boolean;
+  /**
+   * Server-side encryption for the website and distribution log buckets.
+   *
+   * @default BucketEncryption.KMS
+   */
+  readonly encryption?: BucketEncryption;
+  /**
+   * KMS key used to encrypt the website and distribution log buckets. Only used when \`encryption\` is
+   * \`BucketEncryption.KMS\`. When not provided, a new key is created. Note that a key imported via
+   * \`Key.fromKeyArn\` must already grant the CloudWatch Logs, S3 and CloudFront service principals the
+   * necessary permissions in its own key policy - \`addToResourcePolicy\` is a no-op on an imported key,
+   * so this construct cannot grant them on your behalf.
+   */
+  readonly encryptionKey?: IKey;
+  /**
+   * Whether the automatically created KMS key has rotation enabled. Only applies when \`encryption\` is
+   * \`BucketEncryption.KMS\` and no \`encryptionKey\` is supplied.
+   *
+   * @default true
+   */
+  readonly enableKeyRotation?: boolean`;
+/**
+ * Surface enableWaf/encryption/encryptionKey/enableKeyRotation on the vended
+ * StaticWebsite CDK construct.
+ */ const migrateCdkConstruct = async (tree, nextSteps)=>{
+    if (!tree.exists(CDK_STATIC_WEBSITE_FILE)) {
+        return; // This workspace has no CDK static website construct.
+    }
+    if (await matchGritQL(tree, CDK_STATIC_WEBSITE_FILE, '`readonly enableWaf?: boolean`')) {
+        return; // Already migrated.
+    }
+    const CERTIFICATE_FIELD = '`readonly certificate?: ICertificate`';
+    const DESTRUCTURE_OLD = '`{ websiteFilePath, websiteName, domainNames, certificate }: StaticWebsiteProps`';
+    const KEY_CREATION_OLD = "`const websiteKey = new Key(this, 'WebsiteKey', { enableKeyRotation: true })`";
+    const ADD_TO_RESOURCE_POLICY_OLD = '`websiteKey.addToResourcePolicy($args)`';
+    const WEBSITE_BUCKET_ENCRYPTION_OLD = "`encryption: BucketEncryption.KMS` as $prop where { $prop <: within `new Bucket($_, 'WebsiteBucket', $_)` }";
+    const DISTRIBUTION_LOGS_BUCKET_ENCRYPTION_OLD = "`encryption: BucketEncryption.KMS` as $prop where { $prop <: within `new Bucket($_, 'DistributionLogBucket', $_)` }";
+    const WAF_STACK_OLD = "`const wafStack = new CloudfrontWebAcl(this, 'waf')`";
+    const WEB_ACL_ID_OLD = '`webAclId: wafStack.wafArn`';
+    const anchors = [
+        CERTIFICATE_FIELD,
+        DESTRUCTURE_OLD,
+        KEY_CREATION_OLD,
+        ADD_TO_RESOURCE_POLICY_OLD,
+        WEBSITE_BUCKET_ENCRYPTION_OLD,
+        DISTRIBUTION_LOGS_BUCKET_ENCRYPTION_OLD,
+        WAF_STACK_OLD,
+        WEB_ACL_ID_OLD
+    ];
+    const allPresent = (await Promise.all(anchors.map((pattern)=>matchGritQL(tree, CDK_STATIC_WEBSITE_FILE, pattern)))).every(Boolean);
+    if (!allPresent) {
+        nextSteps.push(CDK_DIVERGED_MESSAGE);
+        return;
+    }
+    await addDestructuredImport(tree, CDK_STATIC_WEBSITE_FILE, [
+        'IKey'
+    ], 'aws-cdk-lib/aws-kms');
+    await insertViaGritQL(tree, CDK_STATIC_WEBSITE_FILE, `${CERTIFICATE_FIELD} as $field => \`$field;
+  ${GRIT_INSERT_PLACEHOLDER}\``, STATIC_WEBSITE_PROPS_TEXT);
+    await applyGritQL(tree, CDK_STATIC_WEBSITE_FILE, `${DESTRUCTURE_OLD} => \`{
+      websiteFilePath,
+      websiteName,
+      domainNames,
+      certificate,
+      enableWaf = true,
+      encryption = BucketEncryption.KMS,
+      encryptionKey,
+      enableKeyRotation = true,
+    }: StaticWebsiteProps\``);
+    await applyGritQL(tree, CDK_STATIC_WEBSITE_FILE, `${KEY_CREATION_OLD} => \`const websiteKey: IKey | undefined =
+      encryption === BucketEncryption.KMS
+        ? (encryptionKey ?? new Key(this, 'WebsiteKey', { enableKeyRotation }))
+        : undefined;\``);
+    await applyGritQL(tree, CDK_STATIC_WEBSITE_FILE, `${ADD_TO_RESOURCE_POLICY_OLD} => \`websiteKey?.addToResourcePolicy($args)\``);
+    await applyGritQL(tree, CDK_STATIC_WEBSITE_FILE, `${WEBSITE_BUCKET_ENCRYPTION_OLD} => \`encryption\``);
+    await applyGritQL(tree, CDK_STATIC_WEBSITE_FILE, `${DISTRIBUTION_LOGS_BUCKET_ENCRYPTION_OLD} => \`encryption\``);
+    await applyGritQL(tree, CDK_STATIC_WEBSITE_FILE, `${WAF_STACK_OLD} => \`const wafStack = enableWaf ? new CloudfrontWebAcl(this, 'waf') : undefined;\``);
+    await applyGritQL(tree, CDK_STATIC_WEBSITE_FILE, `${WEB_ACL_ID_OLD} => \`webAclId: wafStack?.wafArn\``);
+};
+/**
+ * Surface the same props on each vended per-website app construct, so they
+ * can be configured per app rather than only by editing the shared construct.
+ */ const migrateCdkAppConstructs = async (tree, nextSteps)=>{
+    if (!tree.exists(CDK_STATIC_WEBSITES_APP_DIR)) {
+        return;
+    }
+    for (const fileName of tree.children(CDK_STATIC_WEBSITES_APP_DIR)){
+        if (fileName === 'index.ts' || !fileName.endsWith('.ts')) {
+            continue;
+        }
+        const filePath = joinPathFragments(CDK_STATIC_WEBSITES_APP_DIR, fileName);
+        const contents = tree.read(filePath, 'utf-8') ?? '';
+        if (contents.includes('StaticWebsiteProps')) {
+            continue; // Already migrated.
+        }
+        const name = await captureGritQLVariable(tree, filePath, '`export class $name extends StaticWebsite { $_ }`', 'name');
+        if (!name) {
+            continue; // Not a StaticWebsite subclass, not ours to touch.
+        }
+        const importPattern = '`import { StaticWebsite } from $path`';
+        const ctorPattern = '`constructor(scope: Construct, id: string) { $body }`';
+        // Captures the whole property list rather than anchoring on websiteName
+        // being followed by exactly one more property ($rest binds a single
+        // trailing node, not a variadic list). This must still match when a
+        // workspace already customised the super() call with e.g. domainNames
+        // and certificate (the pre-existing documented customization point).
+        const superPattern = `\`super(scope, id, { $props })\` as $call where {
+  $props <: contains \`websiteName: '${name}'\`
+}`;
+        const ready = (await Promise.all([
+            importPattern,
+            ctorPattern,
+            superPattern
+        ].map((pattern)=>matchGritQL(tree, filePath, pattern)))).every(Boolean);
+        if (!ready) {
+            nextSteps.push(`${filePath}: has diverged from the generated shape - left untouched. To make enableWaf, encryption, encryptionKey and enableKeyRotation configurable here, add an optional \`props?: ${name}Props\` constructor parameter (\`Omit<StaticWebsiteProps, 'websiteName' | 'websiteFilePath'>\`) and spread it into the super() call (see the ts#react-website generator's static-websites app template).`);
+            continue;
+        }
+        await applyGritQL(tree, filePath, `${importPattern} => \`import { StaticWebsite, StaticWebsiteProps } from $path\``);
+        await insertViaGritQL(tree, filePath, `\`export class ${name} extends StaticWebsite { $body }\` as $cls => \`${GRIT_INSERT_PLACEHOLDER}
+
+$cls\``, `export type ${name}Props = Omit<\n  StaticWebsiteProps,\n  'websiteName' | 'websiteFilePath'\n>;`);
+        await applyGritQL(tree, filePath, `${ctorPattern} => \`constructor(scope: Construct, id: string, props?: ${name}Props) { $body }\``);
+        await applyGritQL(tree, filePath, `${superPattern} => \`super(scope, id, { ...props, $props })\``);
+    }
+};
+// Terraform (HCL) patterns are built from plain strings rather than JS
+// template literals, since the HCL text itself is full of `${...}`
+// interpolations that would otherwise be parsed as JS interpolation.
+const hcl = (pattern)=>'language hcl\n' + pattern;
+const withinResource = (linePattern, resourceType, resourceLabel)=>hcl('`' + linePattern + '` as $line where {\n' + '  $line <: within `resource "' + resourceType + '" "' + resourceLabel + '" { $_ }`\n' + '}');
+const NEW_VARIABLES_TEXT = [
+    'variable "enable_waf" {',
+    '  description = "Whether to protect the CloudFront distribution with an AWS WAF Web ACL."',
+    '  type        = bool',
+    '  default     = true',
+    '}',
+    '',
+    'variable "encryption" {',
+    '  description = "Server-side encryption for the website and distribution log buckets. One of KMS or S3_MANAGED."',
+    '  type        = string',
+    '  default     = "KMS"',
+    '',
+    '  validation {',
+    '    condition     = contains(["KMS", "S3_MANAGED"], var.encryption)',
+    '    error_message = "encryption must be one of KMS or S3_MANAGED."',
+    '  }',
+    '}',
+    '',
+    'variable "kms_key_arn" {',
+    '  description = "ARN of an existing KMS key used to encrypt the website and distribution log buckets when encryption is KMS. When not provided and create_kms_key is true, a new key is created. Note that a customer-supplied key must already grant the CloudWatch Logs, S3 and CloudFront service principals the necessary permissions in its own key policy."',
+    '  type        = string',
+    '  default     = null',
+    '}',
+    '',
+    'variable "create_kms_key" {',
+    '  description = "Whether to create a KMS key for the website. Only applies when encryption is KMS. Set to false when supplying kms_key_arn."',
+    '  type        = bool',
+    '  default     = true',
+    '}',
+    '',
+    'variable "enable_key_rotation" {',
+    '  description = "Whether the automatically created KMS key has rotation enabled. Only applies when encryption is KMS and create_kms_key is true."',
+    '  type        = bool',
+    '  default     = true',
+    '}'
+].join('\n');
+const NEW_LOCALS_TEXT = [
+    '',
+    '  create_website_key = var.encryption == "KMS" && var.create_kms_key',
+    '  website_kms_key_arn = (',
+    '    var.encryption != "KMS" ? null :',
+    '    local.create_website_key ? aws_kms_key.website_key[0].arn :',
+    '    var.kms_key_arn',
+    '  )'
+].join('\n');
+/**
+ * Surface the same configuration on the vended Terraform static-website
+ * module.
+ */ const migrateTerraformModule = async (tree, nextSteps)=>{
+    if (!tree.exists(TERRAFORM_STATIC_WEBSITE_FILE)) {
+        return; // This workspace has no Terraform static website module.
+    }
+    if (await matchGritQL(tree, TERRAFORM_STATIC_WEBSITE_FILE, hcl('`variable "enable_waf" { $_ }`'))) {
+        return; // Already migrated.
+    }
+    const ACM_CERT_VARIABLE = hcl('`variable "acm_certificate_arn" { $_ }`');
+    const ACCESS_LOGS_LOCAL = hcl('`access_logs_name_prefix = substr(lower(var.website_name), 0, 16)`');
+    const KMS_KEY_BLOCK = hcl('`resource "aws_kms_key" "website_key" { $_ }`');
+    const KMS_KEY_ROTATION_LINE = withinResource('enable_key_rotation = true', 'aws_kms_key', 'website_key');
+    const KMS_ALIAS_BLOCK = hcl('`resource "aws_kms_alias" "website_key_alias" { $_ }`');
+    const KMS_ALIAS_TARGET_LINE = hcl('`target_key_id = aws_kms_key.website_key.key_id`');
+    const LOG_GROUP_KMS_LINE = hcl('`kms_key_id = aws_kms_key.website_key.arn`');
+    const WEBSITE_ENCRYPTION_KEY_LINE = withinResource('kms_master_key_id = aws_kms_key.website_key.arn', 'aws_s3_bucket_server_side_encryption_configuration', 'website_encryption');
+    const WEBSITE_ENCRYPTION_ALGO_LINE = withinResource('sse_algorithm = "aws:kms"', 'aws_s3_bucket_server_side_encryption_configuration', 'website_encryption');
+    const DISTRIBUTION_LOGS_ENCRYPTION_KEY_LINE = withinResource('kms_master_key_id = aws_kms_key.website_key.arn', 'aws_s3_bucket_server_side_encryption_configuration', 'distribution_logs_encryption');
+    const DISTRIBUTION_LOGS_ENCRYPTION_ALGO_LINE = withinResource('sse_algorithm = "aws:kms"', 'aws_s3_bucket_server_side_encryption_configuration', 'distribution_logs_encryption');
+    const WAF_BLOCK = hcl('`resource "aws_wafv2_web_acl" "cloudfront_waf" { $_ }`');
+    const WEB_ACL_ID_LINE = hcl('`web_acl_id = aws_wafv2_web_acl.cloudfront_waf.arn`');
+    const WAF_OUTPUT_VALUE_LINE = hcl('`value = aws_wafv2_web_acl.cloudfront_waf.arn` as $line where {\n' + '  $line <: within `output "waf_web_acl_arn" { $_ }`\n' + '}');
+    // Forces distribution replacement whenever the WAF ACL changes. Once the
+    // ACL gains `count`, this can't be resolved on a greenfield apply where
+    // count is 0 and there's no prior state to reference - see
+    // https://github.com/awslabs/nx-plugin-for-aws/pull/1107. It's also
+    // redundant: web_acl_id already references the ACL ARN directly, so a
+    // replaced ACL still drives a plain distribution update.
+    const LIFECYCLE_REPLACE_TRIGGERED_BY_BLOCK = hcl('`lifecycle {\n    replace_triggered_by = [\n      aws_wafv2_web_acl.cloudfront_waf\n    ]\n  }`');
+    const anchors = [
+        ACM_CERT_VARIABLE,
+        ACCESS_LOGS_LOCAL,
+        KMS_KEY_BLOCK,
+        KMS_KEY_ROTATION_LINE,
+        KMS_ALIAS_BLOCK,
+        KMS_ALIAS_TARGET_LINE,
+        LOG_GROUP_KMS_LINE,
+        WEBSITE_ENCRYPTION_KEY_LINE,
+        WEBSITE_ENCRYPTION_ALGO_LINE,
+        DISTRIBUTION_LOGS_ENCRYPTION_KEY_LINE,
+        DISTRIBUTION_LOGS_ENCRYPTION_ALGO_LINE,
+        WAF_BLOCK,
+        WEB_ACL_ID_LINE,
+        WAF_OUTPUT_VALUE_LINE,
+        LIFECYCLE_REPLACE_TRIGGERED_BY_BLOCK
+    ];
+    const allPresent = (await Promise.all(anchors.map((pattern)=>matchGritQL(tree, TERRAFORM_STATIC_WEBSITE_FILE, pattern)))).every(Boolean);
+    if (!allPresent) {
+        nextSteps.push(TERRAFORM_DIVERGED_MESSAGE);
+        return;
+    }
+    // 1. New variables, after acm_certificate_arn. Routed through the
+    //    placeholder since the variable descriptions contain double-quoted
+    //    HCL string values.
+    await insertViaGritQL(tree, TERRAFORM_STATIC_WEBSITE_FILE, hcl('`variable "acm_certificate_arn" { $body }` as $var => `$var\n\n' + GRIT_INSERT_PLACEHOLDER + '`'), NEW_VARIABLES_TEXT);
+    // 2. New locals, after access_logs_name_prefix.
+    await insertViaGritQL(tree, TERRAFORM_STATIC_WEBSITE_FILE, hcl('`access_logs_name_prefix = substr(lower(var.website_name), 0, 16)` as $line => `$line\n' + GRIT_INSERT_PLACEHOLDER + '`'), NEW_LOCALS_TEXT);
+    // 3. Make the KMS key and alias conditional on encryption/kms_key_arn.
+    await applyGritQL(tree, TERRAFORM_STATIC_WEBSITE_FILE, hcl('`resource "aws_kms_key" "website_key" { $body }` => `resource "aws_kms_key" "website_key" {\n' + '  count = local.create_website_key ? 1 : 0\n\n' + '  $body\n' + '}`'));
+    await applyGritQL(tree, TERRAFORM_STATIC_WEBSITE_FILE, KMS_KEY_ROTATION_LINE + ' => `enable_key_rotation = var.enable_key_rotation`');
+    await applyGritQL(tree, TERRAFORM_STATIC_WEBSITE_FILE, hcl('`resource "aws_kms_alias" "website_key_alias" { $body }` => `resource "aws_kms_alias" "website_key_alias" {\n' + '  count = local.create_website_key ? 1 : 0\n\n' + '  $body\n' + '}`'));
+    await applyGritQL(tree, TERRAFORM_STATIC_WEBSITE_FILE, KMS_ALIAS_TARGET_LINE + ' => `target_key_id = aws_kms_key.website_key[0].key_id`');
+    // 4. Resolve the key ARN through the new local everywhere it's consumed.
+    await applyGritQL(tree, TERRAFORM_STATIC_WEBSITE_FILE, LOG_GROUP_KMS_LINE + ' => `kms_key_id = local.website_kms_key_arn`');
+    await applyGritQL(tree, TERRAFORM_STATIC_WEBSITE_FILE, WEBSITE_ENCRYPTION_KEY_LINE + ' => `kms_master_key_id = var.encryption == "KMS" ? local.website_kms_key_arn : null`');
+    await applyGritQL(tree, TERRAFORM_STATIC_WEBSITE_FILE, WEBSITE_ENCRYPTION_ALGO_LINE + ' => `sse_algorithm = var.encryption == "KMS" ? "aws:kms" : "AES256"`');
+    await applyGritQL(tree, TERRAFORM_STATIC_WEBSITE_FILE, DISTRIBUTION_LOGS_ENCRYPTION_KEY_LINE + ' => `kms_master_key_id = var.encryption == "KMS" ? local.website_kms_key_arn : null`');
+    await applyGritQL(tree, TERRAFORM_STATIC_WEBSITE_FILE, DISTRIBUTION_LOGS_ENCRYPTION_ALGO_LINE + ' => `sse_algorithm = var.encryption == "KMS" ? "aws:kms" : "AES256"`');
+    // 5. Make the WAF Web ACL conditional on enable_waf.
+    await applyGritQL(tree, TERRAFORM_STATIC_WEBSITE_FILE, hcl('`resource "aws_wafv2_web_acl" "cloudfront_waf" { $body }` => `resource "aws_wafv2_web_acl" "cloudfront_waf" {\n' + '  count = var.enable_waf ? 1 : 0\n\n' + '  $body\n' + '}`'));
+    await applyGritQL(tree, TERRAFORM_STATIC_WEBSITE_FILE, WEB_ACL_ID_LINE + ' => `web_acl_id = var.enable_waf ? aws_wafv2_web_acl.cloudfront_waf[0].arn : null`');
+    await applyGritQL(tree, TERRAFORM_STATIC_WEBSITE_FILE, WAF_OUTPUT_VALUE_LINE + ' => `value = var.enable_waf ? aws_wafv2_web_acl.cloudfront_waf[0].arn : null`');
+    // 6. Drop the lifecycle block that can no longer resolve once the WAF ACL
+    //    has a count of 0 and no prior state to reference.
+    await applyGritQL(tree, TERRAFORM_STATIC_WEBSITE_FILE, LIFECYCLE_REPLACE_TRIGGERED_BY_BLOCK + ' => ``');
+};
+const NEW_APP_MODULE_VARIABLES_TEXT = [
+    'variable "custom_domain_names" {',
+    '  description = "Custom domain names (aliases) for the CloudFront distribution. Requires acm_certificate_arn."',
+    '  type        = list(string)',
+    '  default     = []',
+    '}',
+    '',
+    'variable "acm_certificate_arn" {',
+    '  description = "ARN of an ACM certificate (in us-east-1) for the custom domain names. When set, viewers are required to use TLS 1.2 or later."',
+    '  type        = string',
+    '  default     = null',
+    '}',
+    '',
+    'variable "enable_waf" {',
+    '  description = "Whether to protect the CloudFront distribution with an AWS WAF Web ACL."',
+    '  type        = bool',
+    '  default     = true',
+    '}',
+    '',
+    'variable "encryption" {',
+    '  description = "Server-side encryption for the website and distribution log buckets. One of KMS or S3_MANAGED."',
+    '  type        = string',
+    '  default     = "KMS"',
+    '',
+    '  validation {',
+    '    condition     = contains(["KMS", "S3_MANAGED"], var.encryption)',
+    '    error_message = "encryption must be one of KMS or S3_MANAGED."',
+    '  }',
+    '}',
+    '',
+    'variable "kms_key_arn" {',
+    '  description = "ARN of an existing KMS key used to encrypt the website and distribution log buckets when encryption is KMS. When not provided and create_kms_key is true, a new key is created. Note that a customer-supplied key must already grant the CloudWatch Logs, S3 and CloudFront service principals the necessary permissions in its own key policy."',
+    '  type        = string',
+    '  default     = null',
+    '}',
+    '',
+    'variable "create_kms_key" {',
+    '  description = "Whether to create a KMS key for the website. Only applies when encryption is KMS. Set to false when supplying kms_key_arn."',
+    '  type        = bool',
+    '  default     = true',
+    '}',
+    '',
+    'variable "enable_key_rotation" {',
+    '  description = "Whether the automatically created KMS key has rotation enabled. Only applies when encryption is KMS and create_kms_key is true."',
+    '  type        = bool',
+    '  default     = true',
+    '}'
+].join('\n');
+const NEW_APP_MODULE_FORWARD_TEXT = [
+    'custom_domain_names = var.custom_domain_names',
+    'acm_certificate_arn = var.acm_certificate_arn',
+    'enable_waf          = var.enable_waf',
+    'encryption          = var.encryption',
+    'kms_key_arn         = var.kms_key_arn',
+    'create_kms_key      = var.create_kms_key',
+    'enable_key_rotation = var.enable_key_rotation'
+].join('\n  ');
+/**
+ * Surface the same configuration as pass-through variables on each vended
+ * per-website Terraform app module, matching the pass-through convention
+ * every other app-wraps-core Terraform module already follows.
+ */ const migrateTerraformAppModules = async (tree, nextSteps)=>{
+    if (!tree.exists(TERRAFORM_STATIC_WEBSITES_APP_DIR)) {
+        return;
+    }
+    for (const dirName of tree.children(TERRAFORM_STATIC_WEBSITES_APP_DIR)){
+        const filePath = joinPathFragments(TERRAFORM_STATIC_WEBSITES_APP_DIR, dirName, `${dirName}.tf`);
+        if (!tree.exists(filePath)) {
+            continue; // Not a website app module directory.
+        }
+        if (await matchGritQL(tree, filePath, hcl('`variable "enable_waf" { $_ }`'))) {
+            continue; // Already migrated.
+        }
+        const TERRAFORM_BLOCK = hcl('`terraform { $_ }`');
+        const MODULE_BLOCK = hcl('`module "static_website" { $_ }`');
+        const FILE_PATH_LINE = hcl('`website_file_path = $val` as $line where {\n' + '  $line <: within `module "static_website" { $_ }`\n' + '}');
+        // custom_domain_names/acm_certificate_arn predate this migration as a
+        // documented customization point (hand-editing the module block). If
+        // either is already present as a literal argument, blindly forwarding
+        // our own `= var.x` line would produce a duplicate argument, which is
+        // invalid HCL. Treat that as diverged instead of silently corrupting the file.
+        const hasExistingCustomDomainArg = async (name)=>matchGritQL(tree, filePath, hcl(`\`${name} = $_\` as $line where {\n` + '  $line <: within `module "static_website" { $_ }`\n' + '}'));
+        const ready = (await Promise.all([
+            TERRAFORM_BLOCK,
+            MODULE_BLOCK,
+            FILE_PATH_LINE
+        ].map((pattern)=>matchGritQL(tree, filePath, pattern)))).every(Boolean) && !await hasExistingCustomDomainArg('custom_domain_names') && !await hasExistingCustomDomainArg('acm_certificate_arn');
+        if (!ready) {
+            nextSteps.push(terraformAppDivergedMessage(filePath));
+            continue;
+        }
+        // Inserted right after the terraform/required_providers block (and
+        // before the "Static website module" comment), matching where the
+        // vended template puts these variables.
+        await insertViaGritQL(tree, filePath, hcl('`terraform { $body }` as $tf') + ` => \`$tf\n\n${GRIT_INSERT_PLACEHOLDER}\``, NEW_APP_MODULE_VARIABLES_TEXT);
+        await insertViaGritQL(tree, filePath, FILE_PATH_LINE + ` => \`$line\n\n  ${GRIT_INSERT_PLACEHOLDER}\``, NEW_APP_MODULE_FORWARD_TEXT);
+    }
+};
+export default async function migration(tree) {
+    const nextSteps = [];
+    await migrateCdkConstruct(tree, nextSteps);
+    await migrateCdkAppConstructs(tree, nextSteps);
+    await migrateTerraformModule(tree, nextSteps);
+    await migrateTerraformAppModules(tree, nextSteps);
+    await formatFilesInSubtree(tree);
+    return {
+        nextSteps
+    };
+}
+
+//# sourceMappingURL=migration.js.map