@aws/nx-plugin 1.0.0-rc.79 → 1.0.0-rc.80

package/src/utils/version-upgrade-migration/sync-embedded-versions.js.map

@@ -1 +1 @@
-{"version":3,"sources":["../../../../../../packages/nx-plugin/src/utils/version-upgrade-migration/sync-embedded-versions.ts"],"sourcesContent":["/**\n * Copyright Amazon.com, Inc. or its affiliates. All Rights Reserved.\n * SPDX-License-Identifier: Apache-2.0\n */\nimport type { ProjectConfiguration, Tree } from '@nx/devkit';\nimport {\n  getProjects,\n  joinPathFragments,\n  visitNotIgnoredFiles,\n} from '@nx/devkit';\nimport { SMITHY_PROJECT_GENERATOR_INFO } from '../../smithy/project/generator';\nimport { applyGritQL } from '../ast';\nimport {\n  BASE_IMAGES,\n  CONTAINER_REPOSITORIES,\n  CONTAINER_VERSIONS,\n  JAVA_ARTIFACTS,\n  JAVA_VERSIONS,\n  MISE_VERSIONS,\n  PY_VERSIONS,\n  TS_VERSIONS,\n} from '../versions';\nimport { type OwnedDependencies, ownedForFile } from './owned-dependencies';\nimport { isVendedUpgrade } from './vended-upgrade';\n\n/**\n * Sync the vended versions generators bake into the body of a file rather than\n * into a manifest: the container image pins in a `Dockerfile`, the Python pins\n * in a Terraform inline script, and the tooling images a `project.json` target\n * command runs.\n *\n * Every version here is pinned to clear a known HIGH/CRITICAL vulnerability, or\n * to keep a generated image reproducible, so leaving them behind strands a\n * workspace on exactly the versions most in need of an upgrade.\n *\n * These sit inside shell commands, which GritQL has no grammar for — so instead\n * of pattern-matching the surrounding syntax, each pin is located by an anchored\n * regex whose single capture group is the version, and only that capture is\n * rewritten. The file's own text around it is never reconstructed, so a\n * reformatted or hand-edited file syncs the same way a freshly generated one\n * does.\n */\n\n/** A pin found in a file body, and the version this release vends for it. */\ninterface EmbeddedPin {\n  /** Regex matching the pin, with the version as its only capture group. */\n  readonly pattern: string;\n  readonly vended: string;\n  /**\n   * Whether the declared value is a version to move forward, or a tag to replace\n   * whenever it differs. A tag — `lts-slim`, say — has no ordering to compare, so\n   * one that isn't what this release vends is simply out of date.\n   */\n  readonly kind?: 'version' | 'tag';\n}\n\n/** Escape a package name or image reference for use inside a regex. */\nconst escapeRegExp = (value: string): string =>\n  value.replace(/[.*+?^${}()|[\\]\\\\]/g, '\\\\$&');\n\n/**\n * Characters that end a pinned version: whitespace, the backslash continuing a\n * shell line, and the quote closing the string the pin sits in.\n *\n * The quote is escaped because the pattern is itself a double-quoted GritQL\n * regex literal, which a bare quote would terminate.\n */\nconst VERSION_TERMINATORS = '\\\\s\\\\\\\\\\\\\"';\n\n/**\n * Rewrite the capture group of an anchored regex to the vended version.\n *\n * The leading and trailing `[\\s\\S]*` anchor the match to the whole file, which\n * is what lets a capture group be rewritten on its own: GritQL binds the group\n * to a node it can replace, leaving every other byte untouched. Without the\n * anchors nothing matches.\n */\nconst rewriteCapture = (pattern: string, vended: string): string =>\n  `r\"[\\\\s\\\\S]*${pattern}[\\\\s\\\\S]*\"($version) where { $version => \\`${vended}\\` }`;\n\n/**\n * Versions a pin's regex currently matches in the file.\n *\n * Read before rewriting so a version the user raised past what this release\n * vends is left alone, matching how every other surface behaves.\n */\nconst declaredVersions = (contents: string, pattern: string): string[] => {\n  const matches = contents.matchAll(new RegExp(pattern, 'g'));\n  return [...matches].flatMap((match) => (match[1] ? [match[1]] : []));\n};\n\n/**\n * Occurrences of one pin a single rewrite will handle.\n *\n * GritQL rewrites each match separately, so its cost grows with how many a\n * pattern matches — ~10ms an occurrence, which a hand-authored file with hundreds\n * of `RUN npm install` lines turns into minutes of an unattended `nx migrate`.\n * Past this the file is left alone and reported, since a wrong version the user\n * can see and fix beats an upgrade that appears to hang.\n */\nconst MAX_OCCURRENCES_PER_PIN = 100;\n\n/**\n * Apply the pins whose declared version this release moves forward.\n *\n * A single rewrite covers every occurrence of a pin in the file, so each pin is\n * applied once. Reports whether anything changed, and whether a pin was left\n * alone for exceeding {@link MAX_OCCURRENCES_PER_PIN}.\n */\nconst applyPins = async (\n  tree: Tree,\n  path: string,\n  pins: readonly EmbeddedPin[],\n): Promise<{ changed: boolean; skipped: boolean }> => {\n  // Read once and re-read only after a rewrite: a rewrite parses the whole file,\n  // and there is a pin per owned package, so re-reading per pin would scale the\n  // cost of a large file with the size of the owned set.\n  let contents = tree.read(path, 'utf-8') ?? '';\n  let changed = false;\n  let skipped = false;\n\n  for (const { pattern, vended, kind = 'version' } of pins) {\n    const declared = declaredVersions(contents, pattern);\n    if (declared.length === 0) {\n      continue;\n    }\n    if (declared.length > MAX_OCCURRENCES_PER_PIN) {\n      skipped = true;\n      continue;\n    }\n    const outOfDate =\n      kind === 'tag'\n        ? (tag: string) => tag !== vended\n        : (version: string) => isVendedUpgrade(vended, version);\n    // A rewrite replaces every occurrence at once, so this must hold for all of\n    // them — a pin already at or beyond the vended version is left as it is.\n    if (!declared.every(outOfDate)) {\n      continue;\n    }\n    if (await applyGritQL(tree, path, rewriteCapture(pattern, vended))) {\n      contents = tree.read(path, 'utf-8') ?? '';\n      changed = true;\n    }\n  }\n\n  return { changed, skipped };\n};\n\n/**\n * The version this release vends for a package, or undefined for one it doesn't\n * vend at all.\n *\n * Ownership is applied by the caller, which only ever passes a name drawn from\n * the owned set — so a package the user pinned themselves never reaches here and\n * keeps the version they chose.\n */\nconst vendedTsVersion = (name: string): string | undefined =>\n  TS_VERSIONS[name as keyof typeof TS_VERSIONS];\n\n/** `PY_VERSIONS` records the `==` operator; a pin holds the bare version. */\nconst vendedPyVersion = (name: string): string | undefined =>\n  PY_VERSIONS[name as keyof typeof PY_VERSIONS]?.replace(/^==/, '');\n\n/**\n * The ways a generated `Dockerfile` pins a TypeScript package's version, as\n * regex fragments taking the escaped package name.\n *\n * The name is required to run to its delimiter, so a package whose name merely\n * ends with another's — `some-npm` against `npm` — cannot match, and an\n * installed version must start with a digit so a `@latest` style tag is left\n * alone.\n */\nconst DOCKERFILE_PIN_SHAPES: readonly ((name: string) => string)[] = [\n  // Installed by the image build. `install` and its `i` alias are both used, as\n  // are `-g` and several packages in one command, so the name only has to follow\n  // an `npm` subcommand rather than sit right after it. The whitespace before it\n  // is matched rather than asserted, since GritQL's regex engine has no\n  // lookbehind — which also keeps `some-npm` from matching `npm`, and unlike a\n  // `\\b` boundary still reaches a `@scope/name`.\n  (name) =>\n    `npm (?:install|i|add)[^\\\\n]*?\\\\s${name}@([0-9][^${VERSION_TERMINATORS}]*)`,\n  // Held at a fixed version through an `npm pkg set` override, to clear a known\n  // vulnerability in a transitive dependency.\n  (name) => `overrides\\\\.${name}=([^${VERSION_TERMINATORS}]+)`,\n];\n\n/**\n * Every pin a generated `Dockerfile` may carry, for the packages owned where it\n * sits.\n *\n * Driven off the owned packages rather than a list of the ones that happen to be\n * pinned today: a pin added to a template in a later release is then covered\n * without this module changing, which is the whole point — the versions baked\n * into image builds are pinned precisely because they clear a known\n * vulnerability.\n *\n * A package the user pinned themselves is not owned, so it is never matched.\n */\nconst dockerfilePins = (owned: {\n  readonly ts: ReadonlySet<string>;\n}): EmbeddedPin[] => {\n  const pins: EmbeddedPin[] = [];\n\n  for (const name of owned.ts) {\n    const vended = vendedTsVersion(name);\n    if (!vended) {\n      continue;\n    }\n    for (const shape of DOCKERFILE_PIN_SHAPES) {\n      pins.push({ pattern: shape(escapeRegExp(name)), vended });\n    }\n  }\n\n  for (const image of Object.values(BASE_IMAGES)) {\n    const [repository, tag] = splitImageReference(image);\n    pins.push({\n      // Only a `FROM` that is the whole instruction. A build stage names itself\n      // — `FROM <repo>:24 AS builder` — and picks its tag for what that stage has\n      // to run: the smithy builder needs curl and unzip, which the slim tag this\n      // release vends for a runtime image does not carry. Rewriting it would\n      // break the build, and the two share a repository, so the instruction\n      // ending is what separates them.\n      pattern: `FROM ${escapeRegExp(repository)}:([^\\\\s]+)\\\\n`,\n      vended: tag,\n      kind: 'tag',\n    });\n  }\n\n  return pins;\n};\n\n/**\n * The repository and tag of a pinned image reference. The tag is the part after\n * the last `:`, which a registry port would otherwise be mistaken for — every\n * reference here carries one.\n */\nconst splitImageReference = (image: string): [string, string] => {\n  const at = image.lastIndexOf(':');\n  return [image.slice(0, at), image.slice(at + 1)];\n};\n\n/**\n * Whether a file is a Dockerfile: exactly `Dockerfile`, or the `<name>.Dockerfile`\n * form the smithy templates vend as `build.Dockerfile`.\n *\n * Deliberately exact rather than a prefix match, which would also claim a\n * `Dockerfile.bak` or a `Dockerfile.md` the user keeps beside a real one.\n */\nexport const isDockerfile = (filePath: string): boolean => {\n  const name = filePath.split('/').pop() ?? '';\n  return name === 'Dockerfile' || name.endsWith('.Dockerfile');\n};\n\n/**\n * Sync the pins in every generated Dockerfile.\n *\n * Ownership is resolved per file, so a Dockerfile is only rewritten for the\n * packages the project it belongs to owns — a sibling project owning `prisma`\n * does not license rewriting a `prisma` pin here.\n */\nconst syncDockerfiles = async (\n  tree: Tree,\n  owned: OwnedDependencies,\n): Promise<string[]> => {\n  const dockerfiles: string[] = [];\n\n  visitNotIgnoredFiles(tree, '.', (path) => {\n    if (isDockerfile(path)) {\n      dockerfiles.push(path);\n    }\n  });\n\n  const skipped: string[] = [];\n  for (const path of dockerfiles) {\n    const result = await applyPins(\n      tree,\n      path,\n      dockerfilePins(ownedForFile(owned, path)),\n    );\n    if (result.skipped) {\n      skipped.push(path);\n    }\n  }\n  return skipped;\n};\n\n/** The `uv run --with` pins to apply, for the Python packages owned where a file sits. */\nconst terraformScriptPins = (owned: {\n  readonly py: ReadonlySet<string>;\n}): EmbeddedPin[] =>\n  [...owned.py].flatMap((name) => {\n    const vended = vendedPyVersion(name);\n    return vended\n      ? [\n          {\n            pattern: `--with ${escapeRegExp(name)}==([^${VERSION_TERMINATORS}]+)`,\n            vended,\n          },\n        ]\n      : [];\n  });\n\n/**\n * Sync the Python pins a generated Terraform inline script runs through\n * `uv run --with <package>==<version>`.\n *\n * These are the plugin's own pins, in a file the Terraform provider sync already\n * visits but only reads `required_providers` from. Driven off the owned Python\n * packages, so a pin added to a template later is covered without a change here.\n *\n * Scoped per file like the Dockerfiles. The modules carrying these live in the\n * shared Terraform project, which no single generator owns — a file there belongs\n * to no project, so it takes the workspace-wide union, which is the set of\n * generators that legitimately write into it.\n */\nconst syncTerraformScriptPins = async (\n  tree: Tree,\n  owned: OwnedDependencies,\n): Promise<string[]> => {\n  const terraformFiles: string[] = [];\n\n  visitNotIgnoredFiles(tree, '.', (path) => {\n    if (path.endsWith('.tf')) {\n      terraformFiles.push(path);\n    }\n  });\n\n  const skipped: string[] = [];\n  for (const path of terraformFiles) {\n    const result = await applyPins(\n      tree,\n      path,\n      terraformScriptPins(ownedForFile(owned, path)),\n    );\n    if (result.skipped) {\n      skipped.push(path);\n    }\n  }\n  return skipped;\n};\n\n/**\n * The ways a `uvx` invocation pins a Python version: the tool it runs, and any\n * package it adds to that tool's environment.\n *\n * A command string is JSON here, so a quote ends a version too.\n */\nconst UVX_PIN_SHAPES: readonly ((name: string) => string)[] = [\n  (name) => `uvx --from ${name}==`,\n  (name) => `--with ${name}==`,\n];\n\n/**\n * Sync the pinned tools a `project.json` target command runs: a container image,\n * and the Python versions a `uvx` invocation pins.\n *\n * Both are built into the command string rather than declared as a dependency, so\n * nothing else reaches them. The images are driven off `CONTAINER_REPOSITORIES`\n * and the Python versions off `PY_VERSIONS`, so a tool pinned in a target command\n * later is covered without a change here — the same property the Dockerfile and\n * Terraform paths get from the owned set.\n *\n * Unscoped, unlike the file-body pins: a `uvx` invocation installs nothing into\n * the project, so there is no dependency for a generator to own. A version is only\n * rewritten where this release vends that exact package at a higher one.\n */\nconst syncTargetToolPins = async (tree: Tree): Promise<string[]> => {\n  const projectJsons: string[] = [];\n\n  visitNotIgnoredFiles(tree, '.', (path) => {\n    if (path.endsWith('project.json')) {\n      projectJsons.push(path);\n    }\n  });\n\n  const pins: EmbeddedPin[] = [\n    ...Object.entries(CONTAINER_REPOSITORIES).map(([tool, repository]) => ({\n      // A command string is JSON here, so a quote ends the reference too.\n      pattern: `${escapeRegExp(repository)}:([^${VERSION_TERMINATORS}']+)`,\n      vended: CONTAINER_VERSIONS[tool as keyof typeof CONTAINER_VERSIONS],\n    })),\n    // The Smithy CLI a Smithy project's compile target runs, and the `mise` that\n    // resolves it. Neither is installed into the workspace — the target fetches\n    // mise with `npx` — so this command is the only place either version sits.\n    {\n      pattern: `exec smithy@([^${VERSION_TERMINATORS}']+)`,\n      vended: MISE_VERSIONS.smithy,\n    },\n    {\n      pattern: `npx -y mise@([^${VERSION_TERMINATORS}']+)`,\n      vended: TS_VERSIONS.mise,\n    },\n    ...Object.keys(PY_VERSIONS).flatMap((name) => {\n      const vended = vendedPyVersion(name);\n      return vended\n        ? UVX_PIN_SHAPES.map((shape) => ({\n            pattern: `${shape(escapeRegExp(name))}([^${VERSION_TERMINATORS}']+)`,\n            vended,\n          }))\n        : [];\n    }),\n  ];\n\n  const skipped: string[] = [];\n  for (const path of projectJsons) {\n    if ((await applyPins(tree, path, pins)).skipped) {\n      skipped.push(path);\n    }\n  }\n  return skipped;\n};\n\n/**\n * Sync the Maven coordinates a generated `smithy-build.json` resolves.\n *\n * These are Java artifacts the Smithy CLI downloads, so they appear in no\n * manifest the dependency sync reads — this file is the only place they sit. Each\n * is matched by its `group:artifact` prefix so only the version is rewritten,\n * leaving any coordinate the user added alone.\n *\n * Scoped to the projects `smithy#project` generated: a `smithy-build.json` a user\n * wrote themselves keeps the versions they chose.\n */\nconst syncSmithyMavenPins = async (tree: Tree): Promise<string[]> => {\n  const isGeneratedSmithyProject = (project: ProjectConfiguration): boolean =>\n    (project.metadata as { generator?: string } | undefined)?.generator ===\n    SMITHY_PROJECT_GENERATOR_INFO.id;\n\n  const smithyBuilds: string[] = [];\n  for (const [, project] of getProjects(tree)) {\n    if (!isGeneratedSmithyProject(project)) {\n      continue;\n    }\n    const path = joinPathFragments(project.root, 'smithy-build.json');\n    if (tree.exists(path)) {\n      smithyBuilds.push(path);\n    }\n  }\n\n  const pins: EmbeddedPin[] = JAVA_ARTIFACTS.map((artifact) => ({\n    // A coordinate is a JSON string here, so a quote ends the version.\n    pattern: `${escapeRegExp(artifact)}:([^${VERSION_TERMINATORS}']+)`,\n    vended: JAVA_VERSIONS[artifact],\n  }));\n\n  const skipped: string[] = [];\n  for (const path of smithyBuilds) {\n    if ((await applyPins(tree, path, pins)).skipped) {\n      skipped.push(path);\n    }\n  }\n  return skipped;\n};\n\n/**\n * Sync the vended versions baked into generated file bodies: `Dockerfile` pins,\n * the Python pins in Terraform inline scripts, the tooling `project.json` target\n * commands run, and the Maven coordinates a `smithy-build.json` resolves.\n *\n * Reports only the files left for the user: a pin that takes effect the next time\n * the thing holding it runs needs no follow-up, but one this skipped for holding\n * more occurrences than it will rewrite at once does.\n *\n * @returns paths whose pins were left as they were\n */\nexport const syncEmbeddedVersions = async (\n  tree: Tree,\n  owned: OwnedDependencies,\n): Promise<string[]> => [\n  ...(await syncDockerfiles(tree, owned)),\n  ...(await syncTerraformScriptPins(tree, owned)),\n  ...(await syncTargetToolPins(tree)),\n  ...(await syncSmithyMavenPins(tree)),\n];\n"],"names":["getProjects","joinPathFragments","visitNotIgnoredFiles","SMITHY_PROJECT_GENERATOR_INFO","applyGritQL","BASE_IMAGES","CONTAINER_REPOSITORIES","CONTAINER_VERSIONS","JAVA_ARTIFACTS","JAVA_VERSIONS","MISE_VERSIONS","PY_VERSIONS","TS_VERSIONS","ownedForFile","isVendedUpgrade","escapeRegExp","value","replace","VERSION_TERMINATORS","rewriteCapture","pattern","vended","declaredVersions","contents","matches","matchAll","RegExp","flatMap","match","MAX_OCCURRENCES_PER_PIN","applyPins","tree","path","pins","read","changed","skipped","kind","declared","length","outOfDate","tag","version","every","vendedTsVersion","name","vendedPyVersion","DOCKERFILE_PIN_SHAPES","dockerfilePins","owned","ts","shape","push","image","Object","values","repository","splitImageReference","at","lastIndexOf","slice","isDockerfile","filePath","split","pop","endsWith","syncDockerfiles","dockerfiles","result","terraformScriptPins","py","syncTerraformScriptPins","terraformFiles","UVX_PIN_SHAPES","syncTargetToolPins","projectJsons","entries","map","tool","smithy","mise","keys","syncSmithyMavenPins","isGeneratedSmithyProject","project","metadata","generator","id","smithyBuilds","root","exists","artifact","syncEmbeddedVersions"],"mappings":"AAAA;;;CAGC,GAED,SACEA,WAAW,EACXC,iBAAiB,EACjBC,oBAAoB,QACf,aAAa;AACpB,SAASC,6BAA6B,QAAQ,oCAAiC;AAC/E,SAASC,WAAW,QAAQ,YAAS;AACrC,SACEC,WAAW,EACXC,sBAAsB,EACtBC,kBAAkB,EAClBC,cAAc,EACdC,aAAa,EACbC,aAAa,EACbC,WAAW,EACXC,WAAW,QACN,iBAAc;AACrB,SAAiCC,YAAY,QAAQ,0BAAuB;AAC5E,SAASC,eAAe,QAAQ,sBAAmB;AAiCnD,qEAAqE,GACrE,MAAMC,eAAe,CAACC,QACpBA,MAAMC,OAAO,CAAC,uBAAuB;AAEvC;;;;;;CAMC,GACD,MAAMC,sBAAsB;AAE5B;;;;;;;CAOC,GACD,MAAMC,iBAAiB,CAACC,SAAiBC,SACvC,CAAC,WAAW,EAAED,QAAQ,2CAA2C,EAAEC,OAAO,IAAI,CAAC;AAEjF;;;;;CAKC,GACD,MAAMC,mBAAmB,CAACC,UAAkBH;IAC1C,MAAMI,UAAUD,SAASE,QAAQ,CAAC,IAAIC,OAAON,SAAS;IACtD,OAAO;WAAII;KAAQ,CAACG,OAAO,CAAC,CAACC,QAAWA,KAAK,CAAC,EAAE,GAAG;YAACA,KAAK,CAAC,EAAE;SAAC,GAAG,EAAE;AACpE;AAEA;;;;;;;;CAQC,GACD,MAAMC,0BAA0B;AAEhC;;;;;;CAMC,GACD,MAAMC,YAAY,OAChBC,MACAC,MACAC;IAEA,+EAA+E;IAC/E,8EAA8E;IAC9E,uDAAuD;IACvD,IAAIV,WAAWQ,KAAKG,IAAI,CAACF,MAAM,YAAY;IAC3C,IAAIG,UAAU;IACd,IAAIC,UAAU;IAEd,KAAK,MAAM,EAAEhB,OAAO,EAAEC,MAAM,EAAEgB,OAAO,SAAS,EAAE,IAAIJ,KAAM;QACxD,MAAMK,WAAWhB,iBAAiBC,UAAUH;QAC5C,IAAIkB,SAASC,MAAM,KAAK,GAAG;YACzB;QACF;QACA,IAAID,SAASC,MAAM,GAAGV,yBAAyB;YAC7CO,UAAU;YACV;QACF;QACA,MAAMI,YACJH,SAAS,QACL,CAACI,MAAgBA,QAAQpB,SACzB,CAACqB,UAAoB5B,gBAAgBO,QAAQqB;QACnD,4EAA4E;QAC5E,yEAAyE;QACzE,IAAI,CAACJ,SAASK,KAAK,CAACH,YAAY;YAC9B;QACF;QACA,IAAI,MAAMpC,YAAY2B,MAAMC,MAAMb,eAAeC,SAASC,UAAU;YAClEE,WAAWQ,KAAKG,IAAI,CAACF,MAAM,YAAY;YACvCG,UAAU;QACZ;IACF;IAEA,OAAO;QAAEA;QAASC;IAAQ;AAC5B;AAEA;;;;;;;CAOC,GACD,MAAMQ,kBAAkB,CAACC,OACvBjC,WAAW,CAACiC,KAAiC;AAE/C,2EAA2E,GAC3E,MAAMC,kBAAkB,CAACD,OACvBlC,WAAW,CAACkC,KAAiC,EAAE5B,QAAQ,OAAO;AAEhE;;;;;;;;CAQC,GACD,MAAM8B,wBAA+D;IACnE,8EAA8E;IAC9E,+EAA+E;IAC/E,+EAA+E;IAC/E,sEAAsE;IACtE,6EAA6E;IAC7E,+CAA+C;IAC/C,CAACF,OACC,CAAC,gCAAgC,EAAEA,KAAK,SAAS,EAAE3B,oBAAoB,GAAG,CAAC;IAC7E,8EAA8E;IAC9E,4CAA4C;IAC5C,CAAC2B,OAAS,CAAC,YAAY,EAAEA,KAAK,IAAI,EAAE3B,oBAAoB,GAAG,CAAC;CAC7D;AAED;;;;;;;;;;;CAWC,GACD,MAAM8B,iBAAiB,CAACC;IAGtB,MAAMhB,OAAsB,EAAE;IAE9B,KAAK,MAAMY,QAAQI,MAAMC,EAAE,CAAE;QAC3B,MAAM7B,SAASuB,gBAAgBC;QAC/B,IAAI,CAACxB,QAAQ;YACX;QACF;QACA,KAAK,MAAM8B,SAASJ,sBAAuB;YACzCd,KAAKmB,IAAI,CAAC;gBAAEhC,SAAS+B,MAAMpC,aAAa8B;gBAAQxB;YAAO;QACzD;IACF;IAEA,KAAK,MAAMgC,SAASC,OAAOC,MAAM,CAAClD,aAAc;QAC9C,MAAM,CAACmD,YAAYf,IAAI,GAAGgB,oBAAoBJ;QAC9CpB,KAAKmB,IAAI,CAAC;YACR,0EAA0E;YAC1E,4EAA4E;YAC5E,2EAA2E;YAC3E,uEAAuE;YACvE,sEAAsE;YACtE,iCAAiC;YACjChC,SAAS,CAAC,KAAK,EAAEL,aAAayC,YAAY,aAAa,CAAC;YACxDnC,QAAQoB;YACRJ,MAAM;QACR;IACF;IAEA,OAAOJ;AACT;AAEA;;;;CAIC,GACD,MAAMwB,sBAAsB,CAACJ;IAC3B,MAAMK,KAAKL,MAAMM,WAAW,CAAC;IAC7B,OAAO;QAACN,MAAMO,KAAK,CAAC,GAAGF;QAAKL,MAAMO,KAAK,CAACF,KAAK;KAAG;AAClD;AAEA;;;;;;CAMC,GACD,OAAO,MAAMG,eAAe,CAACC;IAC3B,MAAMjB,OAAOiB,SAASC,KAAK,CAAC,KAAKC,GAAG,MAAM;IAC1C,OAAOnB,SAAS,gBAAgBA,KAAKoB,QAAQ,CAAC;AAChD,EAAE;AAEF;;;;;;CAMC,GACD,MAAMC,kBAAkB,OACtBnC,MACAkB;IAEA,MAAMkB,cAAwB,EAAE;IAEhCjE,qBAAqB6B,MAAM,KAAK,CAACC;QAC/B,IAAI6B,aAAa7B,OAAO;YACtBmC,YAAYf,IAAI,CAACpB;QACnB;IACF;IAEA,MAAMI,UAAoB,EAAE;IAC5B,KAAK,MAAMJ,QAAQmC,YAAa;QAC9B,MAAMC,SAAS,MAAMtC,UACnBC,MACAC,MACAgB,eAAenC,aAAaoC,OAAOjB;QAErC,IAAIoC,OAAOhC,OAAO,EAAE;YAClBA,QAAQgB,IAAI,CAACpB;QACf;IACF;IACA,OAAOI;AACT;AAEA,wFAAwF,GACxF,MAAMiC,sBAAsB,CAACpB,QAG3B;WAAIA,MAAMqB,EAAE;KAAC,CAAC3C,OAAO,CAAC,CAACkB;QACrB,MAAMxB,SAASyB,gBAAgBD;QAC/B,OAAOxB,SACH;YACE;gBACED,SAAS,CAAC,OAAO,EAAEL,aAAa8B,MAAM,KAAK,EAAE3B,oBAAoB,GAAG,CAAC;gBACrEG;YACF;SACD,GACD,EAAE;IACR;AAEF;;;;;;;;;;;;CAYC,GACD,MAAMkD,0BAA0B,OAC9BxC,MACAkB;IAEA,MAAMuB,iBAA2B,EAAE;IAEnCtE,qBAAqB6B,MAAM,KAAK,CAACC;QAC/B,IAAIA,KAAKiC,QAAQ,CAAC,QAAQ;YACxBO,eAAepB,IAAI,CAACpB;QACtB;IACF;IAEA,MAAMI,UAAoB,EAAE;IAC5B,KAAK,MAAMJ,QAAQwC,eAAgB;QACjC,MAAMJ,SAAS,MAAMtC,UACnBC,MACAC,MACAqC,oBAAoBxD,aAAaoC,OAAOjB;QAE1C,IAAIoC,OAAOhC,OAAO,EAAE;YAClBA,QAAQgB,IAAI,CAACpB;QACf;IACF;IACA,OAAOI;AACT;AAEA;;;;;CAKC,GACD,MAAMqC,iBAAwD;IAC5D,CAAC5B,OAAS,CAAC,WAAW,EAAEA,KAAK,EAAE,CAAC;IAChC,CAACA,OAAS,CAAC,OAAO,EAAEA,KAAK,EAAE,CAAC;CAC7B;AAED;;;;;;;;;;;;;CAaC,GACD,MAAM6B,qBAAqB,OAAO3C;IAChC,MAAM4C,eAAyB,EAAE;IAEjCzE,qBAAqB6B,MAAM,KAAK,CAACC;QAC/B,IAAIA,KAAKiC,QAAQ,CAAC,iBAAiB;YACjCU,aAAavB,IAAI,CAACpB;QACpB;IACF;IAEA,MAAMC,OAAsB;WACvBqB,OAAOsB,OAAO,CAACtE,wBAAwBuE,GAAG,CAAC,CAAC,CAACC,MAAMtB,WAAW,GAAM,CAAA;gBACrE,oEAAoE;gBACpEpC,SAAS,GAAGL,aAAayC,YAAY,IAAI,EAAEtC,oBAAoB,IAAI,CAAC;gBACpEG,QAAQd,kBAAkB,CAACuE,KAAwC;YACrE,CAAA;QACA,6EAA6E;QAC7E,4EAA4E;QAC5E,2EAA2E;QAC3E;YACE1D,SAAS,CAAC,eAAe,EAAEF,oBAAoB,IAAI,CAAC;YACpDG,QAAQX,cAAcqE,MAAM;QAC9B;QACA;YACE3D,SAAS,CAAC,eAAe,EAAEF,oBAAoB,IAAI,CAAC;YACpDG,QAAQT,YAAYoE,IAAI;QAC1B;WACG1B,OAAO2B,IAAI,CAACtE,aAAagB,OAAO,CAAC,CAACkB;YACnC,MAAMxB,SAASyB,gBAAgBD;YAC/B,OAAOxB,SACHoD,eAAeI,GAAG,CAAC,CAAC1B,QAAW,CAAA;oBAC7B/B,SAAS,GAAG+B,MAAMpC,aAAa8B,OAAO,GAAG,EAAE3B,oBAAoB,IAAI,CAAC;oBACpEG;gBACF,CAAA,KACA,EAAE;QACR;KACD;IAED,MAAMe,UAAoB,EAAE;IAC5B,KAAK,MAAMJ,QAAQ2C,aAAc;QAC/B,IAAI,AAAC,CAAA,MAAM7C,UAAUC,MAAMC,MAAMC,KAAI,EAAGG,OAAO,EAAE;YAC/CA,QAAQgB,IAAI,CAACpB;QACf;IACF;IACA,OAAOI;AACT;AAEA;;;;;;;;;;CAUC,GACD,MAAM8C,sBAAsB,OAAOnD;IACjC,MAAMoD,2BAA2B,CAACC,UAChC,AAACA,QAAQC,QAAQ,EAAyCC,cAC1DnF,8BAA8BoF,EAAE;IAElC,MAAMC,eAAyB,EAAE;IACjC,KAAK,MAAM,GAAGJ,QAAQ,IAAIpF,YAAY+B,MAAO;QAC3C,IAAI,CAACoD,yBAAyBC,UAAU;YACtC;QACF;QACA,MAAMpD,OAAO/B,kBAAkBmF,QAAQK,IAAI,EAAE;QAC7C,IAAI1D,KAAK2D,MAAM,CAAC1D,OAAO;YACrBwD,aAAapC,IAAI,CAACpB;QACpB;IACF;IAEA,MAAMC,OAAsBzB,eAAeqE,GAAG,CAAC,CAACc,WAAc,CAAA;YAC5D,mEAAmE;YACnEvE,SAAS,GAAGL,aAAa4E,UAAU,IAAI,EAAEzE,oBAAoB,IAAI,CAAC;YAClEG,QAAQZ,aAAa,CAACkF,SAAS;QACjC,CAAA;IAEA,MAAMvD,UAAoB,EAAE;IAC5B,KAAK,MAAMJ,QAAQwD,aAAc;QAC/B,IAAI,AAAC,CAAA,MAAM1D,UAAUC,MAAMC,MAAMC,KAAI,EAAGG,OAAO,EAAE;YAC/CA,QAAQgB,IAAI,CAACpB;QACf;IACF;IACA,OAAOI;AACT;AAEA;;;;;;;;;;CAUC,GACD,OAAO,MAAMwD,uBAAuB,OAClC7D,MACAkB,QACsB;WAClB,MAAMiB,gBAAgBnC,MAAMkB;WAC5B,MAAMsB,wBAAwBxC,MAAMkB;WACpC,MAAMyB,mBAAmB3C;WACzB,MAAMmD,oBAAoBnD;KAC/B,CAAC"}
+{"version":3,"sources":["../../../../../../packages/nx-plugin/src/utils/version-upgrade-migration/sync-embedded-versions.ts"],"sourcesContent":["/**\n * Copyright Amazon.com, Inc. or its affiliates. All Rights Reserved.\n * SPDX-License-Identifier: Apache-2.0\n */\nimport type { ProjectConfiguration, Tree } from '@nx/devkit';\nimport {\n  getProjects,\n  joinPathFragments,\n  visitNotIgnoredFiles,\n} from '@nx/devkit';\nimport { SMITHY_PROJECT_GENERATOR_INFO } from '../../smithy/project/generator.js';\nimport { applyGritQL } from '../ast.js';\nimport {\n  BASE_IMAGES,\n  CONTAINER_REPOSITORIES,\n  CONTAINER_VERSIONS,\n  JAVA_ARTIFACTS,\n  JAVA_VERSIONS,\n  MISE_VERSIONS,\n  PY_VERSIONS,\n  TS_VERSIONS,\n} from '../versions.js';\nimport { type OwnedDependencies, ownedForFile } from './owned-dependencies.js';\nimport { isVendedUpgrade } from './vended-upgrade.js';\n\n/**\n * Sync the vended versions generators bake into the body of a file rather than\n * into a manifest: the container image pins in a `Dockerfile`, the Python pins\n * in a Terraform inline script, and the tooling images a `project.json` target\n * command runs.\n *\n * Every version here is pinned to clear a known HIGH/CRITICAL vulnerability, or\n * to keep a generated image reproducible, so leaving them behind strands a\n * workspace on exactly the versions most in need of an upgrade.\n *\n * These sit inside shell commands, which GritQL has no grammar for — so instead\n * of pattern-matching the surrounding syntax, each pin is located by an anchored\n * regex whose single capture group is the version, and only that capture is\n * rewritten. The file's own text around it is never reconstructed, so a\n * reformatted or hand-edited file syncs the same way a freshly generated one\n * does.\n */\n\n/** A pin found in a file body, and the version this release vends for it. */\ninterface EmbeddedPin {\n  /** Regex matching the pin, with the version as its only capture group. */\n  readonly pattern: string;\n  readonly vended: string;\n  /**\n   * Whether the declared value is a version to move forward, or a tag to replace\n   * whenever it differs. A tag — `lts-slim`, say — has no ordering to compare, so\n   * one that isn't what this release vends is simply out of date.\n   */\n  readonly kind?: 'version' | 'tag';\n}\n\n/** Escape a package name or image reference for use inside a regex. */\nconst escapeRegExp = (value: string): string =>\n  value.replace(/[.*+?^${}()|[\\]\\\\]/g, '\\\\$&');\n\n/**\n * Characters that end a pinned version: whitespace, the backslash continuing a\n * shell line, and the quote closing the string the pin sits in.\n *\n * The quote is escaped because the pattern is itself a double-quoted GritQL\n * regex literal, which a bare quote would terminate.\n */\nconst VERSION_TERMINATORS = '\\\\s\\\\\\\\\\\\\"';\n\n/**\n * Rewrite the capture group of an anchored regex to the vended version.\n *\n * The leading and trailing `[\\s\\S]*` anchor the match to the whole file, which\n * is what lets a capture group be rewritten on its own: GritQL binds the group\n * to a node it can replace, leaving every other byte untouched. Without the\n * anchors nothing matches.\n */\nconst rewriteCapture = (pattern: string, vended: string): string =>\n  `r\"[\\\\s\\\\S]*${pattern}[\\\\s\\\\S]*\"($version) where { $version => \\`${vended}\\` }`;\n\n/**\n * Versions a pin's regex currently matches in the file.\n *\n * Read before rewriting so a version the user raised past what this release\n * vends is left alone, matching how every other surface behaves.\n */\nconst declaredVersions = (contents: string, pattern: string): string[] => {\n  const matches = contents.matchAll(new RegExp(pattern, 'g'));\n  return [...matches].flatMap((match) => (match[1] ? [match[1]] : []));\n};\n\n/**\n * Occurrences of one pin a single rewrite will handle.\n *\n * GritQL rewrites each match separately, so its cost grows with how many a\n * pattern matches — ~10ms an occurrence, which a hand-authored file with hundreds\n * of `RUN npm install` lines turns into minutes of an unattended `nx migrate`.\n * Past this the file is left alone and reported, since a wrong version the user\n * can see and fix beats an upgrade that appears to hang.\n */\nconst MAX_OCCURRENCES_PER_PIN = 100;\n\n/**\n * Apply the pins whose declared version this release moves forward.\n *\n * A single rewrite covers every occurrence of a pin in the file, so each pin is\n * applied once. Reports whether anything changed, and whether a pin was left\n * alone for exceeding {@link MAX_OCCURRENCES_PER_PIN}.\n */\nconst applyPins = async (\n  tree: Tree,\n  path: string,\n  pins: readonly EmbeddedPin[],\n): Promise<{ changed: boolean; skipped: boolean }> => {\n  // Read once and re-read only after a rewrite: a rewrite parses the whole file,\n  // and there is a pin per owned package, so re-reading per pin would scale the\n  // cost of a large file with the size of the owned set.\n  let contents = tree.read(path, 'utf-8') ?? '';\n  let changed = false;\n  let skipped = false;\n\n  for (const { pattern, vended, kind = 'version' } of pins) {\n    const declared = declaredVersions(contents, pattern);\n    if (declared.length === 0) {\n      continue;\n    }\n    if (declared.length > MAX_OCCURRENCES_PER_PIN) {\n      skipped = true;\n      continue;\n    }\n    const outOfDate =\n      kind === 'tag'\n        ? (tag: string) => tag !== vended\n        : (version: string) => isVendedUpgrade(vended, version);\n    // A rewrite replaces every occurrence at once, so this must hold for all of\n    // them — a pin already at or beyond the vended version is left as it is.\n    if (!declared.every(outOfDate)) {\n      continue;\n    }\n    if (await applyGritQL(tree, path, rewriteCapture(pattern, vended))) {\n      contents = tree.read(path, 'utf-8') ?? '';\n      changed = true;\n    }\n  }\n\n  return { changed, skipped };\n};\n\n/**\n * The version this release vends for a package, or undefined for one it doesn't\n * vend at all.\n *\n * Ownership is applied by the caller, which only ever passes a name drawn from\n * the owned set — so a package the user pinned themselves never reaches here and\n * keeps the version they chose.\n */\nconst vendedTsVersion = (name: string): string | undefined =>\n  TS_VERSIONS[name as keyof typeof TS_VERSIONS];\n\n/** `PY_VERSIONS` records the `==` operator; a pin holds the bare version. */\nconst vendedPyVersion = (name: string): string | undefined =>\n  PY_VERSIONS[name as keyof typeof PY_VERSIONS]?.replace(/^==/, '');\n\n/**\n * The ways a generated `Dockerfile` pins a TypeScript package's version, as\n * regex fragments taking the escaped package name.\n *\n * The name is required to run to its delimiter, so a package whose name merely\n * ends with another's — `some-npm` against `npm` — cannot match, and an\n * installed version must start with a digit so a `@latest` style tag is left\n * alone.\n */\nconst DOCKERFILE_PIN_SHAPES: readonly ((name: string) => string)[] = [\n  // Installed by the image build. `install` and its `i` alias are both used, as\n  // are `-g` and several packages in one command, so the name only has to follow\n  // an `npm` subcommand rather than sit right after it. The whitespace before it\n  // is matched rather than asserted, since GritQL's regex engine has no\n  // lookbehind — which also keeps `some-npm` from matching `npm`, and unlike a\n  // `\\b` boundary still reaches a `@scope/name`.\n  (name) =>\n    `npm (?:install|i|add)[^\\\\n]*?\\\\s${name}@([0-9][^${VERSION_TERMINATORS}]*)`,\n  // Held at a fixed version through an `npm pkg set` override, to clear a known\n  // vulnerability in a transitive dependency.\n  (name) => `overrides\\\\.${name}=([^${VERSION_TERMINATORS}]+)`,\n];\n\n/**\n * Every pin a generated `Dockerfile` may carry, for the packages owned where it\n * sits.\n *\n * Driven off the owned packages rather than a list of the ones that happen to be\n * pinned today: a pin added to a template in a later release is then covered\n * without this module changing, which is the whole point — the versions baked\n * into image builds are pinned precisely because they clear a known\n * vulnerability.\n *\n * A package the user pinned themselves is not owned, so it is never matched.\n */\nconst dockerfilePins = (owned: {\n  readonly ts: ReadonlySet<string>;\n}): EmbeddedPin[] => {\n  const pins: EmbeddedPin[] = [];\n\n  for (const name of owned.ts) {\n    const vended = vendedTsVersion(name);\n    if (!vended) {\n      continue;\n    }\n    for (const shape of DOCKERFILE_PIN_SHAPES) {\n      pins.push({ pattern: shape(escapeRegExp(name)), vended });\n    }\n  }\n\n  for (const image of Object.values(BASE_IMAGES)) {\n    const [repository, tag] = splitImageReference(image);\n    pins.push({\n      // Only a `FROM` that is the whole instruction. A build stage names itself\n      // — `FROM <repo>:24 AS builder` — and picks its tag for what that stage has\n      // to run: the smithy builder needs curl and unzip, which the slim tag this\n      // release vends for a runtime image does not carry. Rewriting it would\n      // break the build, and the two share a repository, so the instruction\n      // ending is what separates them.\n      pattern: `FROM ${escapeRegExp(repository)}:([^\\\\s]+)\\\\n`,\n      vended: tag,\n      kind: 'tag',\n    });\n  }\n\n  return pins;\n};\n\n/**\n * The repository and tag of a pinned image reference. The tag is the part after\n * the last `:`, which a registry port would otherwise be mistaken for — every\n * reference here carries one.\n */\nconst splitImageReference = (image: string): [string, string] => {\n  const at = image.lastIndexOf(':');\n  return [image.slice(0, at), image.slice(at + 1)];\n};\n\n/**\n * Whether a file is a Dockerfile: exactly `Dockerfile`, or the `<name>.Dockerfile`\n * form the smithy templates vend as `build.Dockerfile`.\n *\n * Deliberately exact rather than a prefix match, which would also claim a\n * `Dockerfile.bak` or a `Dockerfile.md` the user keeps beside a real one.\n */\nexport const isDockerfile = (filePath: string): boolean => {\n  const name = filePath.split('/').pop() ?? '';\n  return name === 'Dockerfile' || name.endsWith('.Dockerfile');\n};\n\n/**\n * Sync the pins in every generated Dockerfile.\n *\n * Ownership is resolved per file, so a Dockerfile is only rewritten for the\n * packages the project it belongs to owns — a sibling project owning `prisma`\n * does not license rewriting a `prisma` pin here.\n */\nconst syncDockerfiles = async (\n  tree: Tree,\n  owned: OwnedDependencies,\n): Promise<string[]> => {\n  const dockerfiles: string[] = [];\n\n  visitNotIgnoredFiles(tree, '.', (path) => {\n    if (isDockerfile(path)) {\n      dockerfiles.push(path);\n    }\n  });\n\n  const skipped: string[] = [];\n  for (const path of dockerfiles) {\n    const result = await applyPins(\n      tree,\n      path,\n      dockerfilePins(ownedForFile(owned, path)),\n    );\n    if (result.skipped) {\n      skipped.push(path);\n    }\n  }\n  return skipped;\n};\n\n/** The `uv run --with` pins to apply, for the Python packages owned where a file sits. */\nconst terraformScriptPins = (owned: {\n  readonly py: ReadonlySet<string>;\n}): EmbeddedPin[] =>\n  [...owned.py].flatMap((name) => {\n    const vended = vendedPyVersion(name);\n    return vended\n      ? [\n          {\n            pattern: `--with ${escapeRegExp(name)}==([^${VERSION_TERMINATORS}]+)`,\n            vended,\n          },\n        ]\n      : [];\n  });\n\n/**\n * Sync the Python pins a generated Terraform inline script runs through\n * `uv run --with <package>==<version>`.\n *\n * These are the plugin's own pins, in a file the Terraform provider sync already\n * visits but only reads `required_providers` from. Driven off the owned Python\n * packages, so a pin added to a template later is covered without a change here.\n *\n * Scoped per file like the Dockerfiles. The modules carrying these live in the\n * shared Terraform project, which no single generator owns — a file there belongs\n * to no project, so it takes the workspace-wide union, which is the set of\n * generators that legitimately write into it.\n */\nconst syncTerraformScriptPins = async (\n  tree: Tree,\n  owned: OwnedDependencies,\n): Promise<string[]> => {\n  const terraformFiles: string[] = [];\n\n  visitNotIgnoredFiles(tree, '.', (path) => {\n    if (path.endsWith('.tf')) {\n      terraformFiles.push(path);\n    }\n  });\n\n  const skipped: string[] = [];\n  for (const path of terraformFiles) {\n    const result = await applyPins(\n      tree,\n      path,\n      terraformScriptPins(ownedForFile(owned, path)),\n    );\n    if (result.skipped) {\n      skipped.push(path);\n    }\n  }\n  return skipped;\n};\n\n/**\n * The ways a `uvx` invocation pins a Python version: the tool it runs, and any\n * package it adds to that tool's environment.\n *\n * A command string is JSON here, so a quote ends a version too.\n */\nconst UVX_PIN_SHAPES: readonly ((name: string) => string)[] = [\n  (name) => `uvx --from ${name}==`,\n  (name) => `--with ${name}==`,\n];\n\n/**\n * Sync the pinned tools a `project.json` target command runs: a container image,\n * and the Python versions a `uvx` invocation pins.\n *\n * Both are built into the command string rather than declared as a dependency, so\n * nothing else reaches them. The images are driven off `CONTAINER_REPOSITORIES`\n * and the Python versions off `PY_VERSIONS`, so a tool pinned in a target command\n * later is covered without a change here — the same property the Dockerfile and\n * Terraform paths get from the owned set.\n *\n * Unscoped, unlike the file-body pins: a `uvx` invocation installs nothing into\n * the project, so there is no dependency for a generator to own. A version is only\n * rewritten where this release vends that exact package at a higher one.\n */\nconst syncTargetToolPins = async (tree: Tree): Promise<string[]> => {\n  const projectJsons: string[] = [];\n\n  visitNotIgnoredFiles(tree, '.', (path) => {\n    if (path.endsWith('project.json')) {\n      projectJsons.push(path);\n    }\n  });\n\n  const pins: EmbeddedPin[] = [\n    ...Object.entries(CONTAINER_REPOSITORIES).map(([tool, repository]) => ({\n      // A command string is JSON here, so a quote ends the reference too.\n      pattern: `${escapeRegExp(repository)}:([^${VERSION_TERMINATORS}']+)`,\n      vended: CONTAINER_VERSIONS[tool as keyof typeof CONTAINER_VERSIONS],\n    })),\n    // The Smithy CLI a Smithy project's compile target runs, and the `mise` that\n    // resolves it. Neither is installed into the workspace — the target fetches\n    // mise with `npx` — so this command is the only place either version sits.\n    {\n      pattern: `exec smithy@([^${VERSION_TERMINATORS}']+)`,\n      vended: MISE_VERSIONS.smithy,\n    },\n    {\n      pattern: `npx -y mise@([^${VERSION_TERMINATORS}']+)`,\n      vended: TS_VERSIONS.mise,\n    },\n    ...Object.keys(PY_VERSIONS).flatMap((name) => {\n      const vended = vendedPyVersion(name);\n      return vended\n        ? UVX_PIN_SHAPES.map((shape) => ({\n            pattern: `${shape(escapeRegExp(name))}([^${VERSION_TERMINATORS}']+)`,\n            vended,\n          }))\n        : [];\n    }),\n  ];\n\n  const skipped: string[] = [];\n  for (const path of projectJsons) {\n    if ((await applyPins(tree, path, pins)).skipped) {\n      skipped.push(path);\n    }\n  }\n  return skipped;\n};\n\n/**\n * Sync the Maven coordinates a generated `smithy-build.json` resolves.\n *\n * These are Java artifacts the Smithy CLI downloads, so they appear in no\n * manifest the dependency sync reads — this file is the only place they sit. Each\n * is matched by its `group:artifact` prefix so only the version is rewritten,\n * leaving any coordinate the user added alone.\n *\n * Scoped to the projects `smithy#project` generated: a `smithy-build.json` a user\n * wrote themselves keeps the versions they chose.\n */\nconst syncSmithyMavenPins = async (tree: Tree): Promise<string[]> => {\n  const isGeneratedSmithyProject = (project: ProjectConfiguration): boolean =>\n    (project.metadata as { generator?: string } | undefined)?.generator ===\n    SMITHY_PROJECT_GENERATOR_INFO.id;\n\n  const smithyBuilds: string[] = [];\n  for (const [, project] of getProjects(tree)) {\n    if (!isGeneratedSmithyProject(project)) {\n      continue;\n    }\n    const path = joinPathFragments(project.root, 'smithy-build.json');\n    if (tree.exists(path)) {\n      smithyBuilds.push(path);\n    }\n  }\n\n  const pins: EmbeddedPin[] = JAVA_ARTIFACTS.map((artifact) => ({\n    // A coordinate is a JSON string here, so a quote ends the version.\n    pattern: `${escapeRegExp(artifact)}:([^${VERSION_TERMINATORS}']+)`,\n    vended: JAVA_VERSIONS[artifact],\n  }));\n\n  const skipped: string[] = [];\n  for (const path of smithyBuilds) {\n    if ((await applyPins(tree, path, pins)).skipped) {\n      skipped.push(path);\n    }\n  }\n  return skipped;\n};\n\n/**\n * Sync the vended versions baked into generated file bodies: `Dockerfile` pins,\n * the Python pins in Terraform inline scripts, the tooling `project.json` target\n * commands run, and the Maven coordinates a `smithy-build.json` resolves.\n *\n * Reports only the files left for the user: a pin that takes effect the next time\n * the thing holding it runs needs no follow-up, but one this skipped for holding\n * more occurrences than it will rewrite at once does.\n *\n * @returns paths whose pins were left as they were\n */\nexport const syncEmbeddedVersions = async (\n  tree: Tree,\n  owned: OwnedDependencies,\n): Promise<string[]> => [\n  ...(await syncDockerfiles(tree, owned)),\n  ...(await syncTerraformScriptPins(tree, owned)),\n  ...(await syncTargetToolPins(tree)),\n  ...(await syncSmithyMavenPins(tree)),\n];\n"],"names":["getProjects","joinPathFragments","visitNotIgnoredFiles","SMITHY_PROJECT_GENERATOR_INFO","applyGritQL","BASE_IMAGES","CONTAINER_REPOSITORIES","CONTAINER_VERSIONS","JAVA_ARTIFACTS","JAVA_VERSIONS","MISE_VERSIONS","PY_VERSIONS","TS_VERSIONS","ownedForFile","isVendedUpgrade","escapeRegExp","value","replace","VERSION_TERMINATORS","rewriteCapture","pattern","vended","declaredVersions","contents","matches","matchAll","RegExp","flatMap","match","MAX_OCCURRENCES_PER_PIN","applyPins","tree","path","pins","read","changed","skipped","kind","declared","length","outOfDate","tag","version","every","vendedTsVersion","name","vendedPyVersion","DOCKERFILE_PIN_SHAPES","dockerfilePins","owned","ts","shape","push","image","Object","values","repository","splitImageReference","at","lastIndexOf","slice","isDockerfile","filePath","split","pop","endsWith","syncDockerfiles","dockerfiles","result","terraformScriptPins","py","syncTerraformScriptPins","terraformFiles","UVX_PIN_SHAPES","syncTargetToolPins","projectJsons","entries","map","tool","smithy","mise","keys","syncSmithyMavenPins","isGeneratedSmithyProject","project","metadata","generator","id","smithyBuilds","root","exists","artifact","syncEmbeddedVersions"],"mappings":"AAAA;;;CAGC,GAED,SACEA,WAAW,EACXC,iBAAiB,EACjBC,oBAAoB,QACf,aAAa;AACpB,SAASC,6BAA6B,QAAQ,oCAAoC;AAClF,SAASC,WAAW,QAAQ,YAAY;AACxC,SACEC,WAAW,EACXC,sBAAsB,EACtBC,kBAAkB,EAClBC,cAAc,EACdC,aAAa,EACbC,aAAa,EACbC,WAAW,EACXC,WAAW,QACN,iBAAiB;AACxB,SAAiCC,YAAY,QAAQ,0BAA0B;AAC/E,SAASC,eAAe,QAAQ,sBAAsB;AAiCtD,qEAAqE,GACrE,MAAMC,eAAe,CAACC,QACpBA,MAAMC,OAAO,CAAC,uBAAuB;AAEvC;;;;;;CAMC,GACD,MAAMC,sBAAsB;AAE5B;;;;;;;CAOC,GACD,MAAMC,iBAAiB,CAACC,SAAiBC,SACvC,CAAC,WAAW,EAAED,QAAQ,2CAA2C,EAAEC,OAAO,IAAI,CAAC;AAEjF;;;;;CAKC,GACD,MAAMC,mBAAmB,CAACC,UAAkBH;IAC1C,MAAMI,UAAUD,SAASE,QAAQ,CAAC,IAAIC,OAAON,SAAS;IACtD,OAAO;WAAII;KAAQ,CAACG,OAAO,CAAC,CAACC,QAAWA,KAAK,CAAC,EAAE,GAAG;YAACA,KAAK,CAAC,EAAE;SAAC,GAAG,EAAE;AACpE;AAEA;;;;;;;;CAQC,GACD,MAAMC,0BAA0B;AAEhC;;;;;;CAMC,GACD,MAAMC,YAAY,OAChBC,MACAC,MACAC;IAEA,+EAA+E;IAC/E,8EAA8E;IAC9E,uDAAuD;IACvD,IAAIV,WAAWQ,KAAKG,IAAI,CAACF,MAAM,YAAY;IAC3C,IAAIG,UAAU;IACd,IAAIC,UAAU;IAEd,KAAK,MAAM,EAAEhB,OAAO,EAAEC,MAAM,EAAEgB,OAAO,SAAS,EAAE,IAAIJ,KAAM;QACxD,MAAMK,WAAWhB,iBAAiBC,UAAUH;QAC5C,IAAIkB,SAASC,MAAM,KAAK,GAAG;YACzB;QACF;QACA,IAAID,SAASC,MAAM,GAAGV,yBAAyB;YAC7CO,UAAU;YACV;QACF;QACA,MAAMI,YACJH,SAAS,QACL,CAACI,MAAgBA,QAAQpB,SACzB,CAACqB,UAAoB5B,gBAAgBO,QAAQqB;QACnD,4EAA4E;QAC5E,yEAAyE;QACzE,IAAI,CAACJ,SAASK,KAAK,CAACH,YAAY;YAC9B;QACF;QACA,IAAI,MAAMpC,YAAY2B,MAAMC,MAAMb,eAAeC,SAASC,UAAU;YAClEE,WAAWQ,KAAKG,IAAI,CAACF,MAAM,YAAY;YACvCG,UAAU;QACZ;IACF;IAEA,OAAO;QAAEA;QAASC;IAAQ;AAC5B;AAEA;;;;;;;CAOC,GACD,MAAMQ,kBAAkB,CAACC,OACvBjC,WAAW,CAACiC,KAAiC;AAE/C,2EAA2E,GAC3E,MAAMC,kBAAkB,CAACD,OACvBlC,WAAW,CAACkC,KAAiC,EAAE5B,QAAQ,OAAO;AAEhE;;;;;;;;CAQC,GACD,MAAM8B,wBAA+D;IACnE,8EAA8E;IAC9E,+EAA+E;IAC/E,+EAA+E;IAC/E,sEAAsE;IACtE,6EAA6E;IAC7E,+CAA+C;IAC/C,CAACF,OACC,CAAC,gCAAgC,EAAEA,KAAK,SAAS,EAAE3B,oBAAoB,GAAG,CAAC;IAC7E,8EAA8E;IAC9E,4CAA4C;IAC5C,CAAC2B,OAAS,CAAC,YAAY,EAAEA,KAAK,IAAI,EAAE3B,oBAAoB,GAAG,CAAC;CAC7D;AAED;;;;;;;;;;;CAWC,GACD,MAAM8B,iBAAiB,CAACC;IAGtB,MAAMhB,OAAsB,EAAE;IAE9B,KAAK,MAAMY,QAAQI,MAAMC,EAAE,CAAE;QAC3B,MAAM7B,SAASuB,gBAAgBC;QAC/B,IAAI,CAACxB,QAAQ;YACX;QACF;QACA,KAAK,MAAM8B,SAASJ,sBAAuB;YACzCd,KAAKmB,IAAI,CAAC;gBAAEhC,SAAS+B,MAAMpC,aAAa8B;gBAAQxB;YAAO;QACzD;IACF;IAEA,KAAK,MAAMgC,SAASC,OAAOC,MAAM,CAAClD,aAAc;QAC9C,MAAM,CAACmD,YAAYf,IAAI,GAAGgB,oBAAoBJ;QAC9CpB,KAAKmB,IAAI,CAAC;YACR,0EAA0E;YAC1E,4EAA4E;YAC5E,2EAA2E;YAC3E,uEAAuE;YACvE,sEAAsE;YACtE,iCAAiC;YACjChC,SAAS,CAAC,KAAK,EAAEL,aAAayC,YAAY,aAAa,CAAC;YACxDnC,QAAQoB;YACRJ,MAAM;QACR;IACF;IAEA,OAAOJ;AACT;AAEA;;;;CAIC,GACD,MAAMwB,sBAAsB,CAACJ;IAC3B,MAAMK,KAAKL,MAAMM,WAAW,CAAC;IAC7B,OAAO;QAACN,MAAMO,KAAK,CAAC,GAAGF;QAAKL,MAAMO,KAAK,CAACF,KAAK;KAAG;AAClD;AAEA;;;;;;CAMC,GACD,OAAO,MAAMG,eAAe,CAACC;IAC3B,MAAMjB,OAAOiB,SAASC,KAAK,CAAC,KAAKC,GAAG,MAAM;IAC1C,OAAOnB,SAAS,gBAAgBA,KAAKoB,QAAQ,CAAC;AAChD,EAAE;AAEF;;;;;;CAMC,GACD,MAAMC,kBAAkB,OACtBnC,MACAkB;IAEA,MAAMkB,cAAwB,EAAE;IAEhCjE,qBAAqB6B,MAAM,KAAK,CAACC;QAC/B,IAAI6B,aAAa7B,OAAO;YACtBmC,YAAYf,IAAI,CAACpB;QACnB;IACF;IAEA,MAAMI,UAAoB,EAAE;IAC5B,KAAK,MAAMJ,QAAQmC,YAAa;QAC9B,MAAMC,SAAS,MAAMtC,UACnBC,MACAC,MACAgB,eAAenC,aAAaoC,OAAOjB;QAErC,IAAIoC,OAAOhC,OAAO,EAAE;YAClBA,QAAQgB,IAAI,CAACpB;QACf;IACF;IACA,OAAOI;AACT;AAEA,wFAAwF,GACxF,MAAMiC,sBAAsB,CAACpB,QAG3B;WAAIA,MAAMqB,EAAE;KAAC,CAAC3C,OAAO,CAAC,CAACkB;QACrB,MAAMxB,SAASyB,gBAAgBD;QAC/B,OAAOxB,SACH;YACE;gBACED,SAAS,CAAC,OAAO,EAAEL,aAAa8B,MAAM,KAAK,EAAE3B,oBAAoB,GAAG,CAAC;gBACrEG;YACF;SACD,GACD,EAAE;IACR;AAEF;;;;;;;;;;;;CAYC,GACD,MAAMkD,0BAA0B,OAC9BxC,MACAkB;IAEA,MAAMuB,iBAA2B,EAAE;IAEnCtE,qBAAqB6B,MAAM,KAAK,CAACC;QAC/B,IAAIA,KAAKiC,QAAQ,CAAC,QAAQ;YACxBO,eAAepB,IAAI,CAACpB;QACtB;IACF;IAEA,MAAMI,UAAoB,EAAE;IAC5B,KAAK,MAAMJ,QAAQwC,eAAgB;QACjC,MAAMJ,SAAS,MAAMtC,UACnBC,MACAC,MACAqC,oBAAoBxD,aAAaoC,OAAOjB;QAE1C,IAAIoC,OAAOhC,OAAO,EAAE;YAClBA,QAAQgB,IAAI,CAACpB;QACf;IACF;IACA,OAAOI;AACT;AAEA;;;;;CAKC,GACD,MAAMqC,iBAAwD;IAC5D,CAAC5B,OAAS,CAAC,WAAW,EAAEA,KAAK,EAAE,CAAC;IAChC,CAACA,OAAS,CAAC,OAAO,EAAEA,KAAK,EAAE,CAAC;CAC7B;AAED;;;;;;;;;;;;;CAaC,GACD,MAAM6B,qBAAqB,OAAO3C;IAChC,MAAM4C,eAAyB,EAAE;IAEjCzE,qBAAqB6B,MAAM,KAAK,CAACC;QAC/B,IAAIA,KAAKiC,QAAQ,CAAC,iBAAiB;YACjCU,aAAavB,IAAI,CAACpB;QACpB;IACF;IAEA,MAAMC,OAAsB;WACvBqB,OAAOsB,OAAO,CAACtE,wBAAwBuE,GAAG,CAAC,CAAC,CAACC,MAAMtB,WAAW,GAAM,CAAA;gBACrE,oEAAoE;gBACpEpC,SAAS,GAAGL,aAAayC,YAAY,IAAI,EAAEtC,oBAAoB,IAAI,CAAC;gBACpEG,QAAQd,kBAAkB,CAACuE,KAAwC;YACrE,CAAA;QACA,6EAA6E;QAC7E,4EAA4E;QAC5E,2EAA2E;QAC3E;YACE1D,SAAS,CAAC,eAAe,EAAEF,oBAAoB,IAAI,CAAC;YACpDG,QAAQX,cAAcqE,MAAM;QAC9B;QACA;YACE3D,SAAS,CAAC,eAAe,EAAEF,oBAAoB,IAAI,CAAC;YACpDG,QAAQT,YAAYoE,IAAI;QAC1B;WACG1B,OAAO2B,IAAI,CAACtE,aAAagB,OAAO,CAAC,CAACkB;YACnC,MAAMxB,SAASyB,gBAAgBD;YAC/B,OAAOxB,SACHoD,eAAeI,GAAG,CAAC,CAAC1B,QAAW,CAAA;oBAC7B/B,SAAS,GAAG+B,MAAMpC,aAAa8B,OAAO,GAAG,EAAE3B,oBAAoB,IAAI,CAAC;oBACpEG;gBACF,CAAA,KACA,EAAE;QACR;KACD;IAED,MAAMe,UAAoB,EAAE;IAC5B,KAAK,MAAMJ,QAAQ2C,aAAc;QAC/B,IAAI,AAAC,CAAA,MAAM7C,UAAUC,MAAMC,MAAMC,KAAI,EAAGG,OAAO,EAAE;YAC/CA,QAAQgB,IAAI,CAACpB;QACf;IACF;IACA,OAAOI;AACT;AAEA;;;;;;;;;;CAUC,GACD,MAAM8C,sBAAsB,OAAOnD;IACjC,MAAMoD,2BAA2B,CAACC,UAChC,AAACA,QAAQC,QAAQ,EAAyCC,cAC1DnF,8BAA8BoF,EAAE;IAElC,MAAMC,eAAyB,EAAE;IACjC,KAAK,MAAM,GAAGJ,QAAQ,IAAIpF,YAAY+B,MAAO;QAC3C,IAAI,CAACoD,yBAAyBC,UAAU;YACtC;QACF;QACA,MAAMpD,OAAO/B,kBAAkBmF,QAAQK,IAAI,EAAE;QAC7C,IAAI1D,KAAK2D,MAAM,CAAC1D,OAAO;YACrBwD,aAAapC,IAAI,CAACpB;QACpB;IACF;IAEA,MAAMC,OAAsBzB,eAAeqE,GAAG,CAAC,CAACc,WAAc,CAAA;YAC5D,mEAAmE;YACnEvE,SAAS,GAAGL,aAAa4E,UAAU,IAAI,EAAEzE,oBAAoB,IAAI,CAAC;YAClEG,QAAQZ,aAAa,CAACkF,SAAS;QACjC,CAAA;IAEA,MAAMvD,UAAoB,EAAE;IAC5B,KAAK,MAAMJ,QAAQwD,aAAc;QAC/B,IAAI,AAAC,CAAA,MAAM1D,UAAUC,MAAMC,MAAMC,KAAI,EAAGG,OAAO,EAAE;YAC/CA,QAAQgB,IAAI,CAACpB;QACf;IACF;IACA,OAAOI;AACT;AAEA;;;;;;;;;;CAUC,GACD,OAAO,MAAMwD,uBAAuB,OAClC7D,MACAkB,QACsB;WAClB,MAAMiB,gBAAgBnC,MAAMkB;WAC5B,MAAMsB,wBAAwBxC,MAAMkB;WACpC,MAAMyB,mBAAmB3C;WACzB,MAAMmD,oBAAoBnD;KAC/B,CAAC"}

package/src/utils/version-upgrade-migration/sync-metrics-version.js.map

@@ -1 +1 @@
-{"version":3,"sources":["../../../../../../packages/nx-plugin/src/utils/version-upgrade-migration/sync-metrics-version.ts"],"sourcesContent":["/**\n * Copyright Amazon.com, Inc. or its affiliates. All Rights Reserved.\n * SPDX-License-Identifier: Apache-2.0\n */\nimport type { Tree } from '@nx/devkit';\nimport { applyGritQL } from '../ast';\nimport {\n  METRICS_ASPECT_FILE_PATH,\n  TERRAFORM_METRICS_FILE_PATH,\n} from '../metrics';\nimport { getPackageVersion } from '../nx';\n\n/**\n * Sync the plugin version the metrics files report, so usage is attributed to\n * the release the workspace actually runs. The metric id and tags are owned by\n * the generators and left alone.\n *\n * @returns the metrics files that changed\n */\nexport const syncMetricsVersion = async (tree: Tree): Promise<string[]> => {\n  const version = getPackageVersion();\n  const updated: string[] = [];\n\n  if (tree.exists(METRICS_ASPECT_FILE_PATH)) {\n    const changed = await applyGritQL(\n      tree,\n      METRICS_ASPECT_FILE_PATH,\n      `\\`const version = $old\\` => \\`const version = '${version}'\\`` +\n        ' where { $old <: within `class MetricsAspect implements $_ { $_ }` }',\n    );\n    if (changed) {\n      updated.push(METRICS_ASPECT_FILE_PATH);\n    }\n  }\n\n  if (tree.exists(TERRAFORM_METRICS_FILE_PATH)) {\n    // GritQL's HCL grammar rejects `within locals { ... }`, so the match is\n    // narrowed to a string value to skip interpolated mentions.\n    const changed = await applyGritQL(\n      tree,\n      TERRAFORM_METRICS_FILE_PATH,\n      `\\`metric_version = $old\\` => \\`metric_version = \"${version}\"\\`` +\n        ' where { $old <: string() }',\n    );\n    if (changed) {\n      updated.push(TERRAFORM_METRICS_FILE_PATH);\n    }\n  }\n\n  return updated;\n};\n"],"names":["applyGritQL","METRICS_ASPECT_FILE_PATH","TERRAFORM_METRICS_FILE_PATH","getPackageVersion","syncMetricsVersion","tree","version","updated","exists","changed","push"],"mappings":"AAAA;;;CAGC,GAED,SAASA,WAAW,QAAQ,YAAS;AACrC,SACEC,wBAAwB,EACxBC,2BAA2B,QACtB,gBAAa;AACpB,SAASC,iBAAiB,QAAQ,WAAQ;AAE1C;;;;;;CAMC,GACD,OAAO,MAAMC,qBAAqB,OAAOC;IACvC,MAAMC,UAAUH;IAChB,MAAMI,UAAoB,EAAE;IAE5B,IAAIF,KAAKG,MAAM,CAACP,2BAA2B;QACzC,MAAMQ,UAAU,MAAMT,YACpBK,MACAJ,0BACA,CAAC,+CAA+C,EAAEK,QAAQ,GAAG,CAAC,GAC5D;QAEJ,IAAIG,SAAS;YACXF,QAAQG,IAAI,CAACT;QACf;IACF;IAEA,IAAII,KAAKG,MAAM,CAACN,8BAA8B;QAC5C,wEAAwE;QACxE,4DAA4D;QAC5D,MAAMO,UAAU,MAAMT,YACpBK,MACAH,6BACA,CAAC,iDAAiD,EAAEI,QAAQ,GAAG,CAAC,GAC9D;QAEJ,IAAIG,SAAS;YACXF,QAAQG,IAAI,CAACR;QACf;IACF;IAEA,OAAOK;AACT,EAAE"}
+{"version":3,"sources":["../../../../../../packages/nx-plugin/src/utils/version-upgrade-migration/sync-metrics-version.ts"],"sourcesContent":["/**\n * Copyright Amazon.com, Inc. or its affiliates. All Rights Reserved.\n * SPDX-License-Identifier: Apache-2.0\n */\nimport type { Tree } from '@nx/devkit';\nimport { applyGritQL } from '../ast.js';\nimport {\n  METRICS_ASPECT_FILE_PATH,\n  TERRAFORM_METRICS_FILE_PATH,\n} from '../metrics.js';\nimport { getPackageVersion } from '../nx.js';\n\n/**\n * Sync the plugin version the metrics files report, so usage is attributed to\n * the release the workspace actually runs. The metric id and tags are owned by\n * the generators and left alone.\n *\n * @returns the metrics files that changed\n */\nexport const syncMetricsVersion = async (tree: Tree): Promise<string[]> => {\n  const version = getPackageVersion();\n  const updated: string[] = [];\n\n  if (tree.exists(METRICS_ASPECT_FILE_PATH)) {\n    const changed = await applyGritQL(\n      tree,\n      METRICS_ASPECT_FILE_PATH,\n      `\\`const version = $old\\` => \\`const version = '${version}'\\`` +\n        ' where { $old <: within `class MetricsAspect implements $_ { $_ }` }',\n    );\n    if (changed) {\n      updated.push(METRICS_ASPECT_FILE_PATH);\n    }\n  }\n\n  if (tree.exists(TERRAFORM_METRICS_FILE_PATH)) {\n    // GritQL's HCL grammar rejects `within locals { ... }`, so the match is\n    // narrowed to a string value to skip interpolated mentions.\n    const changed = await applyGritQL(\n      tree,\n      TERRAFORM_METRICS_FILE_PATH,\n      `\\`metric_version = $old\\` => \\`metric_version = \"${version}\"\\`` +\n        ' where { $old <: string() }',\n    );\n    if (changed) {\n      updated.push(TERRAFORM_METRICS_FILE_PATH);\n    }\n  }\n\n  return updated;\n};\n"],"names":["applyGritQL","METRICS_ASPECT_FILE_PATH","TERRAFORM_METRICS_FILE_PATH","getPackageVersion","syncMetricsVersion","tree","version","updated","exists","changed","push"],"mappings":"AAAA;;;CAGC,GAED,SAASA,WAAW,QAAQ,YAAY;AACxC,SACEC,wBAAwB,EACxBC,2BAA2B,QACtB,gBAAgB;AACvB,SAASC,iBAAiB,QAAQ,WAAW;AAE7C;;;;;;CAMC,GACD,OAAO,MAAMC,qBAAqB,OAAOC;IACvC,MAAMC,UAAUH;IAChB,MAAMI,UAAoB,EAAE;IAE5B,IAAIF,KAAKG,MAAM,CAACP,2BAA2B;QACzC,MAAMQ,UAAU,MAAMT,YACpBK,MACAJ,0BACA,CAAC,+CAA+C,EAAEK,QAAQ,GAAG,CAAC,GAC5D;QAEJ,IAAIG,SAAS;YACXF,QAAQG,IAAI,CAACT;QACf;IACF;IAEA,IAAII,KAAKG,MAAM,CAACN,8BAA8B;QAC5C,wEAAwE;QACxE,4DAA4D;QAC5D,MAAMO,UAAU,MAAMT,YACpBK,MACAH,6BACA,CAAC,iDAAiD,EAAEI,QAAQ,GAAG,CAAC,GAC9D;QAEJ,IAAIG,SAAS;YACXF,QAAQG,IAAI,CAACR;QACf;IACF;IAEA,OAAOK;AACT,EAAE"}

package/src/utils/version-upgrade-migration/sync-vended-versions.js.map

@@ -1 +1 @@
-{"version":3,"sources":["../../../../../../packages/nx-plugin/src/utils/version-upgrade-migration/sync-vended-versions.ts"],"sourcesContent":["/**\n * Copyright Amazon.com, Inc. or its affiliates. All Rights Reserved.\n * SPDX-License-Identifier: Apache-2.0\n */\nimport {\n  addDependenciesToPackageJson,\n  detectPackageManager,\n  type MigrationReturnObject,\n  readJson,\n  type Tree,\n  updateJson,\n  visitNotIgnoredFiles,\n} from '@nx/devkit';\nimport yaml from 'js-yaml';\nimport { getCatalogManager } from 'nx/src/utils/catalog';\nimport { parsePipRequirementsLine } from 'pip-requirements-js';\nimport { coerce, parse, satisfies, validRange } from 'semver';\nimport { applyGritQL, captureAllGritQL } from '../ast';\nimport { buildInstallCommand } from '../commands';\nimport { formatFilesInSubtree } from '../format';\nimport { updateToml } from '../toml';\nimport { PY_VERSIONS, TERRAFORM_VERSIONS, TS_VERSIONS } from '../versions';\nimport { isNxPackage } from './nx-package-updates';\nimport {\n  type OwnedDependencies,\n  ownedDependencies,\n} from './owned-dependencies';\nimport { syncEmbeddedVersions } from './sync-embedded-versions';\nimport { syncMetricsVersion } from './sync-metrics-version';\nimport { isVendedUpgrade } from './vended-upgrade';\n\n/**\n * Syncs the versions a generated workspace pins to those this release vends:\n * TypeScript dependencies (including those pinned only by an override), Python\n * pins, Terraform providers, and the plugin version the metrics files report.\n *\n * nx and `@nx/*` are excluded — `packageJsonUpdates` owns them so `nx migrate`\n * collects Nx's own migrations (see `nx-package-updates.ts`).\n */\n\n/** Workspace files holding catalog definitions, and pnpm 11's overrides. */\nconst YAML_WORKSPACE_FILES = ['pnpm-workspace.yaml', '.yarnrc.yml'];\n\n/**\n * Vended version for a dependency this workspace's generators own, or undefined\n * for one the user added themselves.\n */\nconst vendedTsVersion = (\n  owned: OwnedDependencies,\n  name: string,\n): string | undefined =>\n  isNxPackage(name) || !owned.ts.has(name)\n    ? undefined\n    : TS_VERSIONS[name as keyof typeof TS_VERSIONS];\n\n/** PY_VERSIONS records the `==` operator; the pin holds the bare version. */\nconst vendedPyVersion = (\n  owned: OwnedDependencies,\n  name: string,\n): string | undefined =>\n  owned.py.has(name)\n    ? PY_VERSIONS[name as keyof typeof PY_VERSIONS]?.replace(/^==/, '')\n    : undefined;\n\n/** Protocols whose version lives elsewhere, and is synced there instead. */\nconst REFERENCE_PROTOCOL =\n  /^(?:workspace|file|link|npm|git|git\\+|github|portal|patch|exec):/;\n\n/**\n * Whether devkit may be handed this specifier.\n *\n * `catalog:` is only safe where devkit has a catalog manager (pnpm, yarn).\n * It ships none for bun, and without one it rewrites the reference to a literal\n * version, severing the catalog — so bun's references are synced directly.\n */\nconst isSyncableSpecifier = (tree: Tree, declared: unknown): boolean => {\n  // A manifest is the user's file and may hold anything. A version that isn't a\n  // string is not one this can reason about, and throwing here would abort the\n  // whole `nx migrate` over a file the sync only meant to skip.\n  if (typeof declared !== 'string') {\n    return false;\n  }\n  if (REFERENCE_PROTOCOL.test(declared)) {\n    return false;\n  }\n  return (\n    !declared.startsWith('catalog:') || getCatalogManager(tree.root) !== null\n  );\n};\n\n/**\n * Whether the declared range already permits the vended version, following a\n * `catalog:` reference to the range it points at.\n *\n * Devkit would narrow such a range to an exact pin, discarding a user's widened\n * specifier without changing what resolves, so it is left alone.\n */\nconst alreadyPermitsVended = (\n  tree: Tree,\n  packageName: string,\n  declared: string,\n  vended: string,\n): boolean => {\n  let range = declared;\n  if (declared.startsWith('catalog:')) {\n    const resolved = getCatalogManager(tree.root)?.resolveCatalogReference(\n      tree,\n      packageName,\n      declared,\n    );\n    if (!resolved) {\n      return false;\n    }\n    range = resolved;\n  }\n  range = range.trim();\n  // An exact pin is the case to upgrade, not a range to preserve.\n  if (parse(range) !== null || validRange(range) === null) {\n    return false;\n  }\n  return satisfies(vended, range);\n};\n\n/**\n * Vended packages a manifest already declares, and the version to move each to.\n *\n * Only packages already present are named: devkit adds whatever it is given, so\n * passing the full vended list would inject all of it into every manifest.\n */\nconst declaredVendedPackages = (\n  tree: Tree,\n  owned: OwnedDependencies,\n  packageJsonPath: string,\n): {\n  dependencies: Record<string, string>;\n  devDependencies: Record<string, string>;\n} => {\n  const json = readJson(tree, packageJsonPath);\n  const pick = (field: 'dependencies' | 'devDependencies') =>\n    Object.fromEntries(\n      Object.entries((json[field] ?? {}) as Record<string, string>).flatMap(\n        ([name, declared]) => {\n          const vended = vendedTsVersion(owned, name);\n          return vended &&\n            isSyncableSpecifier(tree, declared) &&\n            !alreadyPermitsVended(tree, name, declared, vended)\n            ? [[name, vended] as const]\n            : [];\n        },\n      ),\n    );\n  return {\n    dependencies: pick('dependencies'),\n    devDependencies: pick('devDependencies'),\n  };\n};\n\n/**\n * Sync the TypeScript dependencies every `package.json` declares.\n *\n * Devkit does the writing: it moves a version wherever the workspace keeps it —\n * through a `catalog:` reference or directly — and refuses anything that isn't a\n * strict upgrade on what is installed.\n *\n * Called directly rather than through this plugin's wrapper, which *migrates*\n * declarations into the catalog; right when generating, wrong for a version bump.\n */\nconst syncPackageJsons = (tree: Tree, owned: OwnedDependencies): string[] => {\n  const updated: string[] = [];\n\n  visitNotIgnoredFiles(tree, '.', (path) => {\n    if (!path.endsWith('package.json')) {\n      return;\n    }\n    const { dependencies, devDependencies } = declaredVendedPackages(\n      tree,\n      owned,\n      path,\n    );\n    if (\n      Object.keys(dependencies).length === 0 &&\n      Object.keys(devDependencies).length === 0\n    ) {\n      return;\n    }\n\n    const before = tree.read(path, 'utf-8');\n    const catalogsBefore = readCatalogFiles(tree);\n    // Install callback dropped: `nx migrate` runs install itself.\n    addDependenciesToPackageJson(tree, dependencies, devDependencies, path);\n    if (\n      tree.read(path, 'utf-8') !== before ||\n      readCatalogFiles(tree) !== catalogsBefore\n    ) {\n      updated.push(path);\n    }\n  });\n\n  return updated;\n};\n\n/** Snapshot of every catalog definition file, for change detection. */\nconst readCatalogFiles = (tree: Tree): string =>\n  [...YAML_WORKSPACE_FILES, 'package.json']\n    .map((path) => (tree.exists(path) ? tree.read(path, 'utf-8') : ''))\n    .join('\\0');\n\n/**\n * Upgrade vended catalog entries devkit cannot reach: those no manifest\n * references, and every bun entry (bun has no catalog manager).\n */\nconst syncOrphanCatalogEntries = (\n  tree: Tree,\n  owned: OwnedDependencies,\n): string[] => {\n  const referenced = referencedCatalogPackages(tree);\n  const updated: string[] = [];\n\n  const syncCatalog = (\n    catalog: Record<string, string> | undefined,\n  ): boolean => {\n    let changed = false;\n    for (const [name, declared] of Object.entries(catalog ?? {})) {\n      const vended = vendedTsVersion(owned, name);\n      if (!vended || referenced.has(name)) {\n        continue;\n      }\n      if (isVendedUpgrade(vended, String(declared))) {\n        catalog![name] = vended;\n        changed = true;\n      }\n    }\n    return changed;\n  };\n\n  for (const path of YAML_WORKSPACE_FILES) {\n    if (!tree.exists(path)) {\n      continue;\n    }\n    const catalogFile = (yaml.load(tree.read(path, 'utf-8') ?? '') ?? {}) as {\n      catalog?: Record<string, string>;\n      catalogs?: Record<string, Record<string, string>>;\n    };\n    const changed = [\n      syncCatalog(catalogFile.catalog),\n      ...Object.values(catalogFile.catalogs ?? {}).map(syncCatalog),\n    ].some(Boolean);\n    if (changed) {\n      tree.write(path, yaml.dump(catalogFile, { quotingType: \"'\" }));\n      updated.push(path);\n    }\n  }\n\n  // Bun keeps its catalogs in the root manifest.\n  if (tree.exists('package.json')) {\n    let changed = false;\n    updateJson(tree, 'package.json', (json) => {\n      changed = [\n        syncCatalog(json.catalog),\n        ...Object.values(\n          (json.catalogs ?? {}) as Record<string, Record<string, string>>,\n        ).map(syncCatalog),\n      ].some(Boolean);\n      return json;\n    });\n    if (changed) {\n      updated.push('package.json');\n    }\n  }\n\n  return updated;\n};\n\n/**\n * The package an override key pins, or undefined when the key names none.\n *\n * A key is a package name, optionally preceded by the path it is scoped to and\n * followed by the parent range it applies at:\n *\n *   zod                                     -> zod\n *   zod@^3                                  -> zod\n *   **&#47;@modelcontextprotocol/sdk/zod        -> zod\n *   @prisma/adapter-pg/@types/pg            -> @types/pg\n *\n * The last segment is the package, since every earlier one is a parent it is\n * scoped under — except that a scope and the name after it are one segment.\n */\nconst overriddenPackage = (key: string): string | undefined => {\n  const segments = key.split('/').reduce<string[]>((acc, part) => {\n    // A bare `@scope` is only half a name; join it to what follows.\n    const previous = acc[acc.length - 1];\n    if (previous?.startsWith('@') && !previous.includes('/')) {\n      acc[acc.length - 1] = `${previous}/${part}`;\n      return acc;\n    }\n    acc.push(part);\n    return acc;\n  }, []);\n\n  const name = segments[segments.length - 1];\n  if (!name || name === '.') {\n    return undefined;\n  }\n  // A trailing `@range` scopes the override to a parent version.\n  const at = name.lastIndexOf('@');\n  return at > 0 ? name.slice(0, at) : name;\n};\n\n/**\n * Sync the owned packages an override pins, wherever the workspace keeps them:\n * npm's `overrides`, yarn and bun's `resolutions`, and pnpm's `pnpm.overrides`\n * (10) or `pnpm-workspace.yaml` `overrides` (11).\n *\n * Devkit does not manage these fields, so an owned package pinned only here\n * would otherwise stay on the version it was generated with. Values are compared\n * with `isVendedUpgrade`, so a range the user widened is left alone.\n */\n/**\n * Where the workspace's package manager reads overrides from.\n *\n * Only the root manifest is considered: every package manager resolves overrides\n * from the workspace root, so a nested `overrides` block is inert and rewriting\n * it would imply an effect it doesn't have.\n *\n * pnpm moved the block between majors — 10 reads `pnpm.overrides` in the\n * manifest, 11 reads `overrides` in `pnpm-workspace.yaml` — so both are covered\n * rather than detecting the minor.\n */\nconst overrideLocations = (\n  tree: Tree,\n): {\n  manifestFields: readonly ('overrides' | 'resolutions' | 'pnpm.overrides')[];\n  workspaceFile?: string;\n} => {\n  switch (detectPackageManager(tree.root)) {\n    case 'npm':\n      return { manifestFields: ['overrides'] };\n    case 'yarn':\n      return { manifestFields: ['resolutions'] };\n    case 'bun':\n      // Bun reads npm's `overrides` and yarn's `resolutions` alike.\n      return { manifestFields: ['overrides', 'resolutions'] };\n    default:\n      return {\n        manifestFields: ['pnpm.overrides'],\n        workspaceFile: 'pnpm-workspace.yaml',\n      };\n  }\n};\n\nconst syncOverrides = (tree: Tree, owned: OwnedDependencies): string[] => {\n  const updated: string[] = [];\n\n  // Nested npm overrides carry the pin under `.`, with sibling keys scoping\n  // deeper, so a value may be a string or another override object.\n  const syncOverrideTree = (overrides: unknown): boolean => {\n    if (typeof overrides !== 'object' || overrides === null) {\n      return false;\n    }\n    let changed = false;\n    for (const [key, value] of Object.entries(\n      overrides as Record<string, unknown>,\n    )) {\n      if (typeof value === 'object' && value !== null) {\n        changed = syncOverrideTree(value) || changed;\n        continue;\n      }\n      if (typeof value !== 'string') {\n        continue;\n      }\n      // `.` pins the package its parent key names.\n      const name =\n        key === '.' ? undefined : (overriddenPackage(key) ?? undefined);\n      const vended = name ? vendedTsVersion(owned, name) : undefined;\n      if (vended && isVendedUpgrade(vended, value)) {\n        (overrides as Record<string, unknown>)[key] = vended;\n        changed = true;\n      }\n    }\n    return changed;\n  };\n\n  const { manifestFields, workspaceFile } = overrideLocations(tree);\n\n  if (manifestFields.length > 0) {\n    let changed = false;\n    updateJson(tree, 'package.json', (json) => {\n      changed = manifestFields\n        .map((field) =>\n          syncOverrideTree(\n            field === 'pnpm.overrides' ? json.pnpm?.overrides : json[field],\n          ),\n        )\n        .some(Boolean);\n      return json;\n    });\n    if (changed) {\n      updated.push('package.json');\n    }\n  }\n\n  if (workspaceFile && tree.exists(workspaceFile)) {\n    const contents = (yaml.load(tree.read(workspaceFile, 'utf-8') ?? '') ??\n      {}) as Record<string, unknown>;\n    if (syncOverrideTree(contents.overrides)) {\n      tree.write(workspaceFile, yaml.dump(contents, { quotingType: \"'\" }));\n      updated.push(workspaceFile);\n    }\n  }\n\n  return updated;\n};\n\n/**\n * Packages devkit already maintains through a `catalog:` reference. Empty\n * without a catalog manager, where no reference resolves.\n */\nconst referencedCatalogPackages = (tree: Tree): Set<string> => {\n  const referenced = new Set<string>();\n  if (getCatalogManager(tree.root) === null) {\n    return referenced;\n  }\n  visitNotIgnoredFiles(tree, '.', (path) => {\n    if (!path.endsWith('package.json')) {\n      return;\n    }\n    const json = readJson(tree, path);\n    for (const field of ['dependencies', 'devDependencies'] as const) {\n      for (const [name, declared] of Object.entries(\n        (json[field] ?? {}) as Record<string, string>,\n      )) {\n        if (String(declared).startsWith('catalog:')) {\n          referenced.add(name);\n        }\n      }\n    }\n  });\n  return referenced;\n};\n\n/** Pip specifier as `pip-requirements-js` reports it. */\ninterface PyVersionSpec {\n  readonly operator: string;\n  readonly version: string;\n}\n\n/**\n * Whether the declared specifiers already permit the vended version, so\n * rewriting them would discard the user's range without changing what resolves.\n *\n * This mirrors the TypeScript side: an exact pin is the case to upgrade, a range\n * that already reaches the vended version is left alone, and a range that falls\n * short is moved up.\n *\n * A `*` wildcard or a specifier semver can't read counts as already permitting,\n * so anything not understood is left as the user wrote it.\n */\nconst pyRangePermitsVended = (\n  specs: readonly PyVersionSpec[],\n  vended: string,\n): boolean =>\n  specs.every((spec) => {\n    if (spec.version.includes('*')) {\n      return true;\n    }\n    const bound = coerce(spec.version, { includePrerelease: true });\n    if (!bound) {\n      return true;\n    }\n    switch (spec.operator) {\n      // An exact pin permits only itself, so a differing vended version is an\n      // upgrade to apply.\n      case '==':\n      case '===':\n        return satisfies(vended, `=${bound.version}`, {\n          includePrerelease: true,\n        });\n      // `~=1.2.3` allows the patch series; `~=1.2` the minor series.\n      case '~=':\n        return satisfies(\n          vended,\n          spec.version.split('.').length > 2\n            ? `~${bound.version}`\n            : `^${bound.version}`,\n          { includePrerelease: true },\n        );\n      case '>=':\n      case '>':\n      case '<=':\n      case '<':\n        return satisfies(vended, `${spec.operator}${bound.version}`, {\n          includePrerelease: true,\n        });\n      // `!=` only excludes, so it never blocks the vended version by itself.\n      case '!=':\n        return true;\n      default:\n        return true;\n    }\n  });\n\n/**\n * Upgrade a pip requirement to the vended version, or return it unchanged.\n *\n * Parsed rather than pattern-matched so extras and operators are read the way\n * `uv` reads them. A requirement whose specifiers already permit the vended\n * version keeps them; one that falls short is replaced with an exact pin, which\n * is what the generators write.\n */\nconst syncPyRequirement = (\n  owned: OwnedDependencies,\n  requirement: string,\n): string => {\n  const parsed = parsePipRequirementsLine(requirement);\n  if (parsed?.type !== 'ProjectName' || !parsed.versionSpec?.length) {\n    return requirement;\n  }\n\n  const name = parsed.extras?.length\n    ? `${parsed.name}[${parsed.extras.join(',')}]`\n    : parsed.name;\n  const vended = vendedPyVersion(owned, name);\n  if (!vended) {\n    return requirement;\n  }\n\n  const specs = parsed.versionSpec as readonly PyVersionSpec[];\n  // Never move a version backwards: a pin above what this release vends is the\n  // user's, and a range already reaching it is theirs to keep.\n  const [first] = specs;\n  const isExactPin =\n    specs.length === 1 && (first.operator === '==' || first.operator === '===');\n  if (isExactPin && !isVendedUpgrade(vended, first.version)) {\n    return requirement;\n  }\n  if (!isExactPin && pyRangePermitsVended(specs, vended)) {\n    return requirement;\n  }\n  return `${name}==${vended}`;\n};\n\n/** Sync pins in every `pyproject.toml`, dependencies and groups alike. */\nconst syncPyProjects = (tree: Tree, owned: OwnedDependencies): string[] => {\n  const updated: string[] = [];\n\n  visitNotIgnoredFiles(tree, '.', (path) => {\n    if (!path.endsWith('pyproject.toml')) {\n      return;\n    }\n\n    let changed = false;\n    const syncRequirements = (requirements: unknown): unknown =>\n      Array.isArray(requirements)\n        ? requirements.map((requirement) => {\n            if (typeof requirement !== 'string') {\n              return requirement;\n            }\n            const synced = syncPyRequirement(owned, requirement);\n            changed ||= synced !== requirement;\n            return synced;\n          })\n        : requirements;\n\n    updateToml(tree, path, (toml) => {\n      const project = toml.project as Record<string, unknown> | undefined;\n      if (project?.dependencies) {\n        project.dependencies = syncRequirements(project.dependencies) as never;\n      }\n      const groups = toml['dependency-groups'] as\n        | Record<string, unknown>\n        | undefined;\n      for (const group of Object.keys(groups ?? {})) {\n        groups![group] = syncRequirements(groups![group]) as never;\n      }\n      return toml;\n    });\n\n    if (changed) {\n      updated.push(path);\n    }\n  });\n\n  return updated;\n};\n\n/**\n * GritQL matching one provider's `version` in `required_providers`, scoped by\n * the sibling `source` so an alias or another provider's version can't match.\n *\n * `language hcl` is required — without it the pattern silently matches nothing.\n */\nconst providerVersionPattern = (provider: string, rewrite = ''): string =>\n  `language hcl\\n\\`version = $version\\`${rewrite} where {` +\n  ` $version <: within \\`{ source = \"hashicorp/${provider}\" $... }\\` }`;\n\n/** Version a provider currently declares, if it declares one. */\nconst declaredProviderVersion = async (\n  tree: Tree,\n  path: string,\n  provider: string,\n): Promise<string | undefined> => {\n  const [captured] = await captureAllGritQL(\n    tree,\n    path,\n    providerVersionPattern(provider),\n  );\n  // The match is the whole attribute, e.g. `version = \"6.40.0\"`.\n  return /\"([^\"]+)\"/.exec(captured ?? '')?.[1];\n};\n\n/** Sync vended provider versions in every `.tf` file. */\nconst syncTerraformProviders = async (tree: Tree): Promise<string[]> => {\n  const updated: string[] = [];\n  const terraformFiles: string[] = [];\n\n  visitNotIgnoredFiles(tree, '.', (path) => {\n    if (path.endsWith('.tf')) {\n      terraformFiles.push(path);\n    }\n  });\n\n  for (const path of terraformFiles) {\n    let changed = false;\n    for (const [provider, vended] of Object.entries(TERRAFORM_VERSIONS)) {\n      const declared = await declaredProviderVersion(tree, path, provider);\n      if (!declared || !isVendedUpgrade(vended, declared)) {\n        continue;\n      }\n      changed =\n        (await applyGritQL(\n          tree,\n          path,\n          providerVersionPattern(provider, ` => \\`version = \"${vended}\"\\``),\n        )) || changed;\n    }\n    if (changed) {\n      updated.push(path);\n    }\n  }\n\n  return updated;\n};\n\n/**\n * Sync the versions this release vends, for the dependencies the workspace's\n * generators own.\n */\nexport const syncVendedVersions = async (\n  tree: Tree,\n): Promise<MigrationReturnObject> => {\n  const nextSteps: string[] = [];\n  const owned = await ownedDependencies(tree);\n\n  const packageJsons = syncPackageJsons(tree, owned);\n  const catalogs = syncOrphanCatalogEntries(tree, owned);\n  const overrides = syncOverrides(tree, owned);\n  const pyProjects = syncPyProjects(tree, owned);\n  const terraformFiles = await syncTerraformProviders(tree);\n  const skippedEmbedded = await syncEmbeddedVersions(tree, owned);\n  await syncMetricsVersion(tree);\n\n  // Lock files are left to the user: `nx migrate` only installs when the root\n  // manifest changes, and never runs `uv` or `terraform`.\n  if (catalogs.length > 0 || packageJsons.length > 0 || overrides.length > 0) {\n    nextSteps.push(\n      `TypeScript dependency versions were updated. Run \\`${buildInstallCommand(\n        detectPackageManager(tree.root),\n      )}\\` to update the lock file.`,\n    );\n  }\n  if (pyProjects.length > 0) {\n    nextSteps.push(\n      `Python dependency versions were updated in ${pyProjects.join(', ')}. Run \\`uv sync\\` to update uv.lock.`,\n    );\n  }\n  if (terraformFiles.length > 0) {\n    nextSteps.push(\n      `Terraform provider versions were updated in ${terraformFiles.length} file(s). Run \\`terraform init -upgrade\\` in each Terraform project to update its lock file.`,\n    );\n  }\n  // A synced embedded pin needs no next step — it is read the next time the thing\n  // holding it runs. A file the sync left alone does: its versions are still the\n  // old ones, and only the user can reconcile that.\n  if (skippedEmbedded.length > 0) {\n    nextSteps.push(\n      `Version pins were left as they are in ${skippedEmbedded.join(', ')}, which repeat a pin more times than this migration rewrites at once. Update them by hand.`,\n    );\n  }\n\n  // Without this the workspace's own format check fails on the migrated files.\n  await formatFilesInSubtree(tree);\n\n  return { nextSteps };\n};\n"],"names":["addDependenciesToPackageJson","detectPackageManager","readJson","updateJson","visitNotIgnoredFiles","yaml","getCatalogManager","parsePipRequirementsLine","coerce","parse","satisfies","validRange","applyGritQL","captureAllGritQL","buildInstallCommand","formatFilesInSubtree","updateToml","PY_VERSIONS","TERRAFORM_VERSIONS","TS_VERSIONS","isNxPackage","ownedDependencies","syncEmbeddedVersions","syncMetricsVersion","isVendedUpgrade","YAML_WORKSPACE_FILES","vendedTsVersion","owned","name","ts","has","undefined","vendedPyVersion","py","replace","REFERENCE_PROTOCOL","isSyncableSpecifier","tree","declared","test","startsWith","root","alreadyPermitsVended","packageName","vended","range","resolved","resolveCatalogReference","trim","declaredVendedPackages","packageJsonPath","json","pick","field","Object","fromEntries","entries","flatMap","dependencies","devDependencies","syncPackageJsons","updated","path","endsWith","keys","length","before","read","catalogsBefore","readCatalogFiles","push","map","exists","join","syncOrphanCatalogEntries","referenced","referencedCatalogPackages","syncCatalog","catalog","changed","String","catalogFile","load","values","catalogs","some","Boolean","write","dump","quotingType","overriddenPackage","key","segments","split","reduce","acc","part","previous","includes","at","lastIndexOf","slice","overrideLocations","manifestFields","workspaceFile","syncOverrides","syncOverrideTree","overrides","value","pnpm","contents","Set","add","pyRangePermitsVended","specs","every","spec","version","bound","includePrerelease","operator","syncPyRequirement","requirement","parsed","type","versionSpec","extras","first","isExactPin","syncPyProjects","syncRequirements","requirements","Array","isArray","synced","toml","project","groups","group","providerVersionPattern","provider","rewrite","declaredProviderVersion","captured","exec","syncTerraformProviders","terraformFiles","syncVendedVersions","nextSteps","packageJsons","pyProjects","skippedEmbedded"],"mappings":"AAAA;;;CAGC,GACD,SACEA,4BAA4B,EAC5BC,oBAAoB,EAEpBC,QAAQ,EAERC,UAAU,EACVC,oBAAoB,QACf,aAAa;AACpB,OAAOC,UAAU,UAAU;AAC3B,SAASC,iBAAiB,QAAQ,uBAAuB;AACzD,SAASC,wBAAwB,QAAQ,sBAAsB;AAC/D,SAASC,MAAM,EAAEC,KAAK,EAAEC,SAAS,EAAEC,UAAU,QAAQ,SAAS;AAC9D,SAASC,WAAW,EAAEC,gBAAgB,QAAQ,YAAS;AACvD,SAASC,mBAAmB,QAAQ,iBAAc;AAClD,SAASC,oBAAoB,QAAQ,eAAY;AACjD,SAASC,UAAU,QAAQ,aAAU;AACrC,SAASC,WAAW,EAAEC,kBAAkB,EAAEC,WAAW,QAAQ,iBAAc;AAC3E,SAASC,WAAW,QAAQ,0BAAuB;AACnD,SAEEC,iBAAiB,QACZ,0BAAuB;AAC9B,SAASC,oBAAoB,QAAQ,8BAA2B;AAChE,SAASC,kBAAkB,QAAQ,4BAAyB;AAC5D,SAASC,eAAe,QAAQ,sBAAmB;AAEnD;;;;;;;CAOC,GAED,0EAA0E,GAC1E,MAAMC,uBAAuB;IAAC;IAAuB;CAAc;AAEnE;;;CAGC,GACD,MAAMC,kBAAkB,CACtBC,OACAC,OAEAR,YAAYQ,SAAS,CAACD,MAAME,EAAE,CAACC,GAAG,CAACF,QAC/BG,YACAZ,WAAW,CAACS,KAAiC;AAEnD,2EAA2E,GAC3E,MAAMI,kBAAkB,CACtBL,OACAC,OAEAD,MAAMM,EAAE,CAACH,GAAG,CAACF,QACTX,WAAW,CAACW,KAAiC,EAAEM,QAAQ,OAAO,MAC9DH;AAEN,0EAA0E,GAC1E,MAAMI,qBACJ;AAEF;;;;;;CAMC,GACD,MAAMC,sBAAsB,CAACC,MAAYC;IACvC,8EAA8E;IAC9E,6EAA6E;IAC7E,8DAA8D;IAC9D,IAAI,OAAOA,aAAa,UAAU;QAChC,OAAO;IACT;IACA,IAAIH,mBAAmBI,IAAI,CAACD,WAAW;QACrC,OAAO;IACT;IACA,OACE,CAACA,SAASE,UAAU,CAAC,eAAelC,kBAAkB+B,KAAKI,IAAI,MAAM;AAEzE;AAEA;;;;;;CAMC,GACD,MAAMC,uBAAuB,CAC3BL,MACAM,aACAL,UACAM;IAEA,IAAIC,QAAQP;IACZ,IAAIA,SAASE,UAAU,CAAC,aAAa;QACnC,MAAMM,WAAWxC,kBAAkB+B,KAAKI,IAAI,GAAGM,wBAC7CV,MACAM,aACAL;QAEF,IAAI,CAACQ,UAAU;YACb,OAAO;QACT;QACAD,QAAQC;IACV;IACAD,QAAQA,MAAMG,IAAI;IAClB,gEAAgE;IAChE,IAAIvC,MAAMoC,WAAW,QAAQlC,WAAWkC,WAAW,MAAM;QACvD,OAAO;IACT;IACA,OAAOnC,UAAUkC,QAAQC;AAC3B;AAEA;;;;;CAKC,GACD,MAAMI,yBAAyB,CAC7BZ,MACAV,OACAuB;IAKA,MAAMC,OAAOjD,SAASmC,MAAMa;IAC5B,MAAME,OAAO,CAACC,QACZC,OAAOC,WAAW,CAChBD,OAAOE,OAAO,CAAEL,IAAI,CAACE,MAAM,IAAI,CAAC,GAA8BI,OAAO,CACnE,CAAC,CAAC7B,MAAMU,SAAS;YACf,MAAMM,SAASlB,gBAAgBC,OAAOC;YACtC,OAAOgB,UACLR,oBAAoBC,MAAMC,aAC1B,CAACI,qBAAqBL,MAAMT,MAAMU,UAAUM,UAC1C;gBAAC;oBAAChB;oBAAMgB;iBAAO;aAAU,GACzB,EAAE;QACR;IAGN,OAAO;QACLc,cAAcN,KAAK;QACnBO,iBAAiBP,KAAK;IACxB;AACF;AAEA;;;;;;;;;CASC,GACD,MAAMQ,mBAAmB,CAACvB,MAAYV;IACpC,MAAMkC,UAAoB,EAAE;IAE5BzD,qBAAqBiC,MAAM,KAAK,CAACyB;QAC/B,IAAI,CAACA,KAAKC,QAAQ,CAAC,iBAAiB;YAClC;QACF;QACA,MAAM,EAAEL,YAAY,EAAEC,eAAe,EAAE,GAAGV,uBACxCZ,MACAV,OACAmC;QAEF,IACER,OAAOU,IAAI,CAACN,cAAcO,MAAM,KAAK,KACrCX,OAAOU,IAAI,CAACL,iBAAiBM,MAAM,KAAK,GACxC;YACA;QACF;QAEA,MAAMC,SAAS7B,KAAK8B,IAAI,CAACL,MAAM;QAC/B,MAAMM,iBAAiBC,iBAAiBhC;QACxC,8DAA8D;QAC9DrC,6BAA6BqC,MAAMqB,cAAcC,iBAAiBG;QAClE,IACEzB,KAAK8B,IAAI,CAACL,MAAM,aAAaI,UAC7BG,iBAAiBhC,UAAU+B,gBAC3B;YACAP,QAAQS,IAAI,CAACR;QACf;IACF;IAEA,OAAOD;AACT;AAEA,qEAAqE,GACrE,MAAMQ,mBAAmB,CAAChC,OACxB;WAAIZ;QAAsB;KAAe,CACtC8C,GAAG,CAAC,CAACT,OAAUzB,KAAKmC,MAAM,CAACV,QAAQzB,KAAK8B,IAAI,CAACL,MAAM,WAAW,IAC9DW,IAAI,CAAC;AAEV;;;CAGC,GACD,MAAMC,2BAA2B,CAC/BrC,MACAV;IAEA,MAAMgD,aAAaC,0BAA0BvC;IAC7C,MAAMwB,UAAoB,EAAE;IAE5B,MAAMgB,cAAc,CAClBC;QAEA,IAAIC,UAAU;QACd,KAAK,MAAM,CAACnD,MAAMU,SAAS,IAAIgB,OAAOE,OAAO,CAACsB,WAAW,CAAC,GAAI;YAC5D,MAAMlC,SAASlB,gBAAgBC,OAAOC;YACtC,IAAI,CAACgB,UAAU+B,WAAW7C,GAAG,CAACF,OAAO;gBACnC;YACF;YACA,IAAIJ,gBAAgBoB,QAAQoC,OAAO1C,YAAY;gBAC7CwC,OAAQ,CAAClD,KAAK,GAAGgB;gBACjBmC,UAAU;YACZ;QACF;QACA,OAAOA;IACT;IAEA,KAAK,MAAMjB,QAAQrC,qBAAsB;QACvC,IAAI,CAACY,KAAKmC,MAAM,CAACV,OAAO;YACtB;QACF;QACA,MAAMmB,cAAe5E,KAAK6E,IAAI,CAAC7C,KAAK8B,IAAI,CAACL,MAAM,YAAY,OAAO,CAAC;QAInE,MAAMiB,UAAU;YACdF,YAAYI,YAAYH,OAAO;eAC5BxB,OAAO6B,MAAM,CAACF,YAAYG,QAAQ,IAAI,CAAC,GAAGb,GAAG,CAACM;SAClD,CAACQ,IAAI,CAACC;QACP,IAAIP,SAAS;YACX1C,KAAKkD,KAAK,CAACzB,MAAMzD,KAAKmF,IAAI,CAACP,aAAa;gBAAEQ,aAAa;YAAI;YAC3D5B,QAAQS,IAAI,CAACR;QACf;IACF;IAEA,+CAA+C;IAC/C,IAAIzB,KAAKmC,MAAM,CAAC,iBAAiB;QAC/B,IAAIO,UAAU;QACd5E,WAAWkC,MAAM,gBAAgB,CAACc;YAChC4B,UAAU;gBACRF,YAAY1B,KAAK2B,OAAO;mBACrBxB,OAAO6B,MAAM,CACbhC,KAAKiC,QAAQ,IAAI,CAAC,GACnBb,GAAG,CAACM;aACP,CAACQ,IAAI,CAACC;YACP,OAAOnC;QACT;QACA,IAAI4B,SAAS;YACXlB,QAAQS,IAAI,CAAC;QACf;IACF;IAEA,OAAOT;AACT;AAEA;;;;;;;;;;;;;CAaC,GACD,MAAM6B,oBAAoB,CAACC;IACzB,MAAMC,WAAWD,IAAIE,KAAK,CAAC,KAAKC,MAAM,CAAW,CAACC,KAAKC;QACrD,gEAAgE;QAChE,MAAMC,WAAWF,GAAG,CAACA,IAAI9B,MAAM,GAAG,EAAE;QACpC,IAAIgC,UAAUzD,WAAW,QAAQ,CAACyD,SAASC,QAAQ,CAAC,MAAM;YACxDH,GAAG,CAACA,IAAI9B,MAAM,GAAG,EAAE,GAAG,GAAGgC,SAAS,CAAC,EAAED,MAAM;YAC3C,OAAOD;QACT;QACAA,IAAIzB,IAAI,CAAC0B;QACT,OAAOD;IACT,GAAG,EAAE;IAEL,MAAMnE,OAAOgE,QAAQ,CAACA,SAAS3B,MAAM,GAAG,EAAE;IAC1C,IAAI,CAACrC,QAAQA,SAAS,KAAK;QACzB,OAAOG;IACT;IACA,+DAA+D;IAC/D,MAAMoE,KAAKvE,KAAKwE,WAAW,CAAC;IAC5B,OAAOD,KAAK,IAAIvE,KAAKyE,KAAK,CAAC,GAAGF,MAAMvE;AACtC;AAEA;;;;;;;;CAQC,GACD;;;;;;;;;;CAUC,GACD,MAAM0E,oBAAoB,CACxBjE;IAKA,OAAQpC,qBAAqBoC,KAAKI,IAAI;QACpC,KAAK;YACH,OAAO;gBAAE8D,gBAAgB;oBAAC;iBAAY;YAAC;QACzC,KAAK;YACH,OAAO;gBAAEA,gBAAgB;oBAAC;iBAAc;YAAC;QAC3C,KAAK;YACH,8DAA8D;YAC9D,OAAO;gBAAEA,gBAAgB;oBAAC;oBAAa;iBAAc;YAAC;QACxD;YACE,OAAO;gBACLA,gBAAgB;oBAAC;iBAAiB;gBAClCC,eAAe;YACjB;IACJ;AACF;AAEA,MAAMC,gBAAgB,CAACpE,MAAYV;IACjC,MAAMkC,UAAoB,EAAE;IAE5B,0EAA0E;IAC1E,iEAAiE;IACjE,MAAM6C,mBAAmB,CAACC;QACxB,IAAI,OAAOA,cAAc,YAAYA,cAAc,MAAM;YACvD,OAAO;QACT;QACA,IAAI5B,UAAU;QACd,KAAK,MAAM,CAACY,KAAKiB,MAAM,IAAItD,OAAOE,OAAO,CACvCmD,WACC;YACD,IAAI,OAAOC,UAAU,YAAYA,UAAU,MAAM;gBAC/C7B,UAAU2B,iBAAiBE,UAAU7B;gBACrC;YACF;YACA,IAAI,OAAO6B,UAAU,UAAU;gBAC7B;YACF;YACA,6CAA6C;YAC7C,MAAMhF,OACJ+D,QAAQ,MAAM5D,YAAa2D,kBAAkBC,QAAQ5D;YACvD,MAAMa,SAAShB,OAAOF,gBAAgBC,OAAOC,QAAQG;YACrD,IAAIa,UAAUpB,gBAAgBoB,QAAQgE,QAAQ;gBAC3CD,SAAqC,CAAChB,IAAI,GAAG/C;gBAC9CmC,UAAU;YACZ;QACF;QACA,OAAOA;IACT;IAEA,MAAM,EAAEwB,cAAc,EAAEC,aAAa,EAAE,GAAGF,kBAAkBjE;IAE5D,IAAIkE,eAAetC,MAAM,GAAG,GAAG;QAC7B,IAAIc,UAAU;QACd5E,WAAWkC,MAAM,gBAAgB,CAACc;YAChC4B,UAAUwB,eACPhC,GAAG,CAAC,CAAClB,QACJqD,iBACErD,UAAU,mBAAmBF,KAAK0D,IAAI,EAAEF,YAAYxD,IAAI,CAACE,MAAM,GAGlEgC,IAAI,CAACC;YACR,OAAOnC;QACT;QACA,IAAI4B,SAAS;YACXlB,QAAQS,IAAI,CAAC;QACf;IACF;IAEA,IAAIkC,iBAAiBnE,KAAKmC,MAAM,CAACgC,gBAAgB;QAC/C,MAAMM,WAAYzG,KAAK6E,IAAI,CAAC7C,KAAK8B,IAAI,CAACqC,eAAe,YAAY,OAC/D,CAAC;QACH,IAAIE,iBAAiBI,SAASH,SAAS,GAAG;YACxCtE,KAAKkD,KAAK,CAACiB,eAAenG,KAAKmF,IAAI,CAACsB,UAAU;gBAAErB,aAAa;YAAI;YACjE5B,QAAQS,IAAI,CAACkC;QACf;IACF;IAEA,OAAO3C;AACT;AAEA;;;CAGC,GACD,MAAMe,4BAA4B,CAACvC;IACjC,MAAMsC,aAAa,IAAIoC;IACvB,IAAIzG,kBAAkB+B,KAAKI,IAAI,MAAM,MAAM;QACzC,OAAOkC;IACT;IACAvE,qBAAqBiC,MAAM,KAAK,CAACyB;QAC/B,IAAI,CAACA,KAAKC,QAAQ,CAAC,iBAAiB;YAClC;QACF;QACA,MAAMZ,OAAOjD,SAASmC,MAAMyB;QAC5B,KAAK,MAAMT,SAAS;YAAC;YAAgB;SAAkB,CAAW;YAChE,KAAK,MAAM,CAACzB,MAAMU,SAAS,IAAIgB,OAAOE,OAAO,CAC1CL,IAAI,CAACE,MAAM,IAAI,CAAC,GAChB;gBACD,IAAI2B,OAAO1C,UAAUE,UAAU,CAAC,aAAa;oBAC3CmC,WAAWqC,GAAG,CAACpF;gBACjB;YACF;QACF;IACF;IACA,OAAO+C;AACT;AAQA;;;;;;;;;;CAUC,GACD,MAAMsC,uBAAuB,CAC3BC,OACAtE,SAEAsE,MAAMC,KAAK,CAAC,CAACC;QACX,IAAIA,KAAKC,OAAO,CAACnB,QAAQ,CAAC,MAAM;YAC9B,OAAO;QACT;QACA,MAAMoB,QAAQ9G,OAAO4G,KAAKC,OAAO,EAAE;YAAEE,mBAAmB;QAAK;QAC7D,IAAI,CAACD,OAAO;YACV,OAAO;QACT;QACA,OAAQF,KAAKI,QAAQ;YACnB,wEAAwE;YACxE,oBAAoB;YACpB,KAAK;YACL,KAAK;gBACH,OAAO9G,UAAUkC,QAAQ,CAAC,CAAC,EAAE0E,MAAMD,OAAO,EAAE,EAAE;oBAC5CE,mBAAmB;gBACrB;YACF,+DAA+D;YAC/D,KAAK;gBACH,OAAO7G,UACLkC,QACAwE,KAAKC,OAAO,CAACxB,KAAK,CAAC,KAAK5B,MAAM,GAAG,IAC7B,CAAC,CAAC,EAAEqD,MAAMD,OAAO,EAAE,GACnB,CAAC,CAAC,EAAEC,MAAMD,OAAO,EAAE,EACvB;oBAAEE,mBAAmB;gBAAK;YAE9B,KAAK;YACL,KAAK;YACL,KAAK;YACL,KAAK;gBACH,OAAO7G,UAAUkC,QAAQ,GAAGwE,KAAKI,QAAQ,GAAGF,MAAMD,OAAO,EAAE,EAAE;oBAC3DE,mBAAmB;gBACrB;YACF,uEAAuE;YACvE,KAAK;gBACH,OAAO;YACT;gBACE,OAAO;QACX;IACF;AAEF;;;;;;;CAOC,GACD,MAAME,oBAAoB,CACxB9F,OACA+F;IAEA,MAAMC,SAASpH,yBAAyBmH;IACxC,IAAIC,QAAQC,SAAS,iBAAiB,CAACD,OAAOE,WAAW,EAAE5D,QAAQ;QACjE,OAAOyD;IACT;IAEA,MAAM9F,OAAO+F,OAAOG,MAAM,EAAE7D,SACxB,GAAG0D,OAAO/F,IAAI,CAAC,CAAC,EAAE+F,OAAOG,MAAM,CAACrD,IAAI,CAAC,KAAK,CAAC,CAAC,GAC5CkD,OAAO/F,IAAI;IACf,MAAMgB,SAASZ,gBAAgBL,OAAOC;IACtC,IAAI,CAACgB,QAAQ;QACX,OAAO8E;IACT;IAEA,MAAMR,QAAQS,OAAOE,WAAW;IAChC,6EAA6E;IAC7E,6DAA6D;IAC7D,MAAM,CAACE,MAAM,GAAGb;IAChB,MAAMc,aACJd,MAAMjD,MAAM,KAAK,KAAM8D,CAAAA,MAAMP,QAAQ,KAAK,QAAQO,MAAMP,QAAQ,KAAK,KAAI;IAC3E,IAAIQ,cAAc,CAACxG,gBAAgBoB,QAAQmF,MAAMV,OAAO,GAAG;QACzD,OAAOK;IACT;IACA,IAAI,CAACM,cAAcf,qBAAqBC,OAAOtE,SAAS;QACtD,OAAO8E;IACT;IACA,OAAO,GAAG9F,KAAK,EAAE,EAAEgB,QAAQ;AAC7B;AAEA,wEAAwE,GACxE,MAAMqF,iBAAiB,CAAC5F,MAAYV;IAClC,MAAMkC,UAAoB,EAAE;IAE5BzD,qBAAqBiC,MAAM,KAAK,CAACyB;QAC/B,IAAI,CAACA,KAAKC,QAAQ,CAAC,mBAAmB;YACpC;QACF;QAEA,IAAIgB,UAAU;QACd,MAAMmD,mBAAmB,CAACC,eACxBC,MAAMC,OAAO,CAACF,gBACVA,aAAa5D,GAAG,CAAC,CAACmD;gBAChB,IAAI,OAAOA,gBAAgB,UAAU;oBACnC,OAAOA;gBACT;gBACA,MAAMY,SAASb,kBAAkB9F,OAAO+F;gBACxC3C,YAAYuD,WAAWZ;gBACvB,OAAOY;YACT,KACAH;QAENnH,WAAWqB,MAAMyB,MAAM,CAACyE;YACtB,MAAMC,UAAUD,KAAKC,OAAO;YAC5B,IAAIA,SAAS9E,cAAc;gBACzB8E,QAAQ9E,YAAY,GAAGwE,iBAAiBM,QAAQ9E,YAAY;YAC9D;YACA,MAAM+E,SAASF,IAAI,CAAC,oBAAoB;YAGxC,KAAK,MAAMG,SAASpF,OAAOU,IAAI,CAACyE,UAAU,CAAC,GAAI;gBAC7CA,MAAO,CAACC,MAAM,GAAGR,iBAAiBO,MAAO,CAACC,MAAM;YAClD;YACA,OAAOH;QACT;QAEA,IAAIxD,SAAS;YACXlB,QAAQS,IAAI,CAACR;QACf;IACF;IAEA,OAAOD;AACT;AAEA;;;;;CAKC,GACD,MAAM8E,yBAAyB,CAACC,UAAkBC,UAAU,EAAE,GAC5D,CAAC,oCAAoC,EAAEA,QAAQ,QAAQ,CAAC,GACxD,CAAC,4CAA4C,EAAED,SAAS,YAAY,CAAC;AAEvE,+DAA+D,GAC/D,MAAME,0BAA0B,OAC9BzG,MACAyB,MACA8E;IAEA,MAAM,CAACG,SAAS,GAAG,MAAMlI,iBACvBwB,MACAyB,MACA6E,uBAAuBC;IAEzB,+DAA+D;IAC/D,OAAO,YAAYI,IAAI,CAACD,YAAY,KAAK,CAAC,EAAE;AAC9C;AAEA,uDAAuD,GACvD,MAAME,yBAAyB,OAAO5G;IACpC,MAAMwB,UAAoB,EAAE;IAC5B,MAAMqF,iBAA2B,EAAE;IAEnC9I,qBAAqBiC,MAAM,KAAK,CAACyB;QAC/B,IAAIA,KAAKC,QAAQ,CAAC,QAAQ;YACxBmF,eAAe5E,IAAI,CAACR;QACtB;IACF;IAEA,KAAK,MAAMA,QAAQoF,eAAgB;QACjC,IAAInE,UAAU;QACd,KAAK,MAAM,CAAC6D,UAAUhG,OAAO,IAAIU,OAAOE,OAAO,CAACtC,oBAAqB;YACnE,MAAMoB,WAAW,MAAMwG,wBAAwBzG,MAAMyB,MAAM8E;YAC3D,IAAI,CAACtG,YAAY,CAACd,gBAAgBoB,QAAQN,WAAW;gBACnD;YACF;YACAyC,UACE,AAAC,MAAMnE,YACLyB,MACAyB,MACA6E,uBAAuBC,UAAU,CAAC,iBAAiB,EAAEhG,OAAO,GAAG,CAAC,MAC5DmC;QACV;QACA,IAAIA,SAAS;YACXlB,QAAQS,IAAI,CAACR;QACf;IACF;IAEA,OAAOD;AACT;AAEA;;;CAGC,GACD,OAAO,MAAMsF,qBAAqB,OAChC9G;IAEA,MAAM+G,YAAsB,EAAE;IAC9B,MAAMzH,QAAQ,MAAMN,kBAAkBgB;IAEtC,MAAMgH,eAAezF,iBAAiBvB,MAAMV;IAC5C,MAAMyD,WAAWV,yBAAyBrC,MAAMV;IAChD,MAAMgF,YAAYF,cAAcpE,MAAMV;IACtC,MAAM2H,aAAarB,eAAe5F,MAAMV;IACxC,MAAMuH,iBAAiB,MAAMD,uBAAuB5G;IACpD,MAAMkH,kBAAkB,MAAMjI,qBAAqBe,MAAMV;IACzD,MAAMJ,mBAAmBc;IAEzB,4EAA4E;IAC5E,wDAAwD;IACxD,IAAI+C,SAASnB,MAAM,GAAG,KAAKoF,aAAapF,MAAM,GAAG,KAAK0C,UAAU1C,MAAM,GAAG,GAAG;QAC1EmF,UAAU9E,IAAI,CACZ,CAAC,mDAAmD,EAAExD,oBACpDb,qBAAqBoC,KAAKI,IAAI,GAC9B,2BAA2B,CAAC;IAElC;IACA,IAAI6G,WAAWrF,MAAM,GAAG,GAAG;QACzBmF,UAAU9E,IAAI,CACZ,CAAC,2CAA2C,EAAEgF,WAAW7E,IAAI,CAAC,MAAM,oCAAoC,CAAC;IAE7G;IACA,IAAIyE,eAAejF,MAAM,GAAG,GAAG;QAC7BmF,UAAU9E,IAAI,CACZ,CAAC,4CAA4C,EAAE4E,eAAejF,MAAM,CAAC,4FAA4F,CAAC;IAEtK;IACA,gFAAgF;IAChF,+EAA+E;IAC/E,kDAAkD;IAClD,IAAIsF,gBAAgBtF,MAAM,GAAG,GAAG;QAC9BmF,UAAU9E,IAAI,CACZ,CAAC,sCAAsC,EAAEiF,gBAAgB9E,IAAI,CAAC,MAAM,0FAA0F,CAAC;IAEnK;IAEA,6EAA6E;IAC7E,MAAM1D,qBAAqBsB;IAE3B,OAAO;QAAE+G;IAAU;AACrB,EAAE"}
+{"version":3,"sources":["../../../../../../packages/nx-plugin/src/utils/version-upgrade-migration/sync-vended-versions.ts"],"sourcesContent":["/**\n * Copyright Amazon.com, Inc. or its affiliates. All Rights Reserved.\n * SPDX-License-Identifier: Apache-2.0\n */\nimport {\n  addDependenciesToPackageJson,\n  detectPackageManager,\n  type MigrationReturnObject,\n  readJson,\n  type Tree,\n  updateJson,\n  visitNotIgnoredFiles,\n} from '@nx/devkit';\nimport yaml from 'js-yaml';\nimport { getCatalogManager } from 'nx/src/utils/catalog';\nimport { parsePipRequirementsLine } from 'pip-requirements-js';\nimport { coerce, parse, satisfies, validRange } from 'semver';\nimport { applyGritQL, captureAllGritQL } from '../ast.js';\nimport { buildInstallCommand } from '../commands.js';\nimport { formatFilesInSubtree } from '../format.js';\nimport { updateToml } from '../toml.js';\nimport { PY_VERSIONS, TERRAFORM_VERSIONS, TS_VERSIONS } from '../versions.js';\nimport { isNxPackage } from './nx-package-updates.js';\nimport {\n  type OwnedDependencies,\n  ownedDependencies,\n} from './owned-dependencies.js';\nimport { syncEmbeddedVersions } from './sync-embedded-versions.js';\nimport { syncMetricsVersion } from './sync-metrics-version.js';\nimport { isVendedUpgrade } from './vended-upgrade.js';\n\n/**\n * Syncs the versions a generated workspace pins to those this release vends:\n * TypeScript dependencies (including those pinned only by an override), Python\n * pins, Terraform providers, and the plugin version the metrics files report.\n *\n * nx and `@nx/*` are excluded — `packageJsonUpdates` owns them so `nx migrate`\n * collects Nx's own migrations (see `nx-package-updates.ts`).\n */\n\n/** Workspace files holding catalog definitions, and pnpm 11's overrides. */\nconst YAML_WORKSPACE_FILES = ['pnpm-workspace.yaml', '.yarnrc.yml'];\n\n/**\n * Vended version for a dependency this workspace's generators own, or undefined\n * for one the user added themselves.\n */\nconst vendedTsVersion = (\n  owned: OwnedDependencies,\n  name: string,\n): string | undefined =>\n  isNxPackage(name) || !owned.ts.has(name)\n    ? undefined\n    : TS_VERSIONS[name as keyof typeof TS_VERSIONS];\n\n/** PY_VERSIONS records the `==` operator; the pin holds the bare version. */\nconst vendedPyVersion = (\n  owned: OwnedDependencies,\n  name: string,\n): string | undefined =>\n  owned.py.has(name)\n    ? PY_VERSIONS[name as keyof typeof PY_VERSIONS]?.replace(/^==/, '')\n    : undefined;\n\n/** Protocols whose version lives elsewhere, and is synced there instead. */\nconst REFERENCE_PROTOCOL =\n  /^(?:workspace|file|link|npm|git|git\\+|github|portal|patch|exec):/;\n\n/**\n * Whether devkit may be handed this specifier.\n *\n * `catalog:` is only safe where devkit has a catalog manager (pnpm, yarn).\n * It ships none for bun, and without one it rewrites the reference to a literal\n * version, severing the catalog — so bun's references are synced directly.\n */\nconst isSyncableSpecifier = (tree: Tree, declared: unknown): boolean => {\n  // A manifest is the user's file and may hold anything. A version that isn't a\n  // string is not one this can reason about, and throwing here would abort the\n  // whole `nx migrate` over a file the sync only meant to skip.\n  if (typeof declared !== 'string') {\n    return false;\n  }\n  if (REFERENCE_PROTOCOL.test(declared)) {\n    return false;\n  }\n  return (\n    !declared.startsWith('catalog:') || getCatalogManager(tree.root) !== null\n  );\n};\n\n/**\n * Whether the declared range already permits the vended version, following a\n * `catalog:` reference to the range it points at.\n *\n * Devkit would narrow such a range to an exact pin, discarding a user's widened\n * specifier without changing what resolves, so it is left alone.\n */\nconst alreadyPermitsVended = (\n  tree: Tree,\n  packageName: string,\n  declared: string,\n  vended: string,\n): boolean => {\n  let range = declared;\n  if (declared.startsWith('catalog:')) {\n    const resolved = getCatalogManager(tree.root)?.resolveCatalogReference(\n      tree,\n      packageName,\n      declared,\n    );\n    if (!resolved) {\n      return false;\n    }\n    range = resolved;\n  }\n  range = range.trim();\n  // An exact pin is the case to upgrade, not a range to preserve.\n  if (parse(range) !== null || validRange(range) === null) {\n    return false;\n  }\n  return satisfies(vended, range);\n};\n\n/**\n * Vended packages a manifest already declares, and the version to move each to.\n *\n * Only packages already present are named: devkit adds whatever it is given, so\n * passing the full vended list would inject all of it into every manifest.\n */\nconst declaredVendedPackages = (\n  tree: Tree,\n  owned: OwnedDependencies,\n  packageJsonPath: string,\n): {\n  dependencies: Record<string, string>;\n  devDependencies: Record<string, string>;\n} => {\n  const json = readJson(tree, packageJsonPath);\n  const pick = (field: 'dependencies' | 'devDependencies') =>\n    Object.fromEntries(\n      Object.entries((json[field] ?? {}) as Record<string, string>).flatMap(\n        ([name, declared]) => {\n          const vended = vendedTsVersion(owned, name);\n          return vended &&\n            isSyncableSpecifier(tree, declared) &&\n            !alreadyPermitsVended(tree, name, declared, vended)\n            ? [[name, vended] as const]\n            : [];\n        },\n      ),\n    );\n  return {\n    dependencies: pick('dependencies'),\n    devDependencies: pick('devDependencies'),\n  };\n};\n\n/**\n * Sync the TypeScript dependencies every `package.json` declares.\n *\n * Devkit does the writing: it moves a version wherever the workspace keeps it —\n * through a `catalog:` reference or directly — and refuses anything that isn't a\n * strict upgrade on what is installed.\n *\n * Called directly rather than through this plugin's wrapper, which *migrates*\n * declarations into the catalog; right when generating, wrong for a version bump.\n */\nconst syncPackageJsons = (tree: Tree, owned: OwnedDependencies): string[] => {\n  const updated: string[] = [];\n\n  visitNotIgnoredFiles(tree, '.', (path) => {\n    if (!path.endsWith('package.json')) {\n      return;\n    }\n    const { dependencies, devDependencies } = declaredVendedPackages(\n      tree,\n      owned,\n      path,\n    );\n    if (\n      Object.keys(dependencies).length === 0 &&\n      Object.keys(devDependencies).length === 0\n    ) {\n      return;\n    }\n\n    const before = tree.read(path, 'utf-8');\n    const catalogsBefore = readCatalogFiles(tree);\n    // Install callback dropped: `nx migrate` runs install itself.\n    addDependenciesToPackageJson(tree, dependencies, devDependencies, path);\n    if (\n      tree.read(path, 'utf-8') !== before ||\n      readCatalogFiles(tree) !== catalogsBefore\n    ) {\n      updated.push(path);\n    }\n  });\n\n  return updated;\n};\n\n/** Snapshot of every catalog definition file, for change detection. */\nconst readCatalogFiles = (tree: Tree): string =>\n  [...YAML_WORKSPACE_FILES, 'package.json']\n    .map((path) => (tree.exists(path) ? tree.read(path, 'utf-8') : ''))\n    .join('\\0');\n\n/**\n * Upgrade vended catalog entries devkit cannot reach: those no manifest\n * references, and every bun entry (bun has no catalog manager).\n */\nconst syncOrphanCatalogEntries = (\n  tree: Tree,\n  owned: OwnedDependencies,\n): string[] => {\n  const referenced = referencedCatalogPackages(tree);\n  const updated: string[] = [];\n\n  const syncCatalog = (\n    catalog: Record<string, string> | undefined,\n  ): boolean => {\n    let changed = false;\n    for (const [name, declared] of Object.entries(catalog ?? {})) {\n      const vended = vendedTsVersion(owned, name);\n      if (!vended || referenced.has(name)) {\n        continue;\n      }\n      if (isVendedUpgrade(vended, String(declared))) {\n        catalog![name] = vended;\n        changed = true;\n      }\n    }\n    return changed;\n  };\n\n  for (const path of YAML_WORKSPACE_FILES) {\n    if (!tree.exists(path)) {\n      continue;\n    }\n    const catalogFile = (yaml.load(tree.read(path, 'utf-8') ?? '') ?? {}) as {\n      catalog?: Record<string, string>;\n      catalogs?: Record<string, Record<string, string>>;\n    };\n    const changed = [\n      syncCatalog(catalogFile.catalog),\n      ...Object.values(catalogFile.catalogs ?? {}).map(syncCatalog),\n    ].some(Boolean);\n    if (changed) {\n      tree.write(path, yaml.dump(catalogFile, { quotingType: \"'\" }));\n      updated.push(path);\n    }\n  }\n\n  // Bun keeps its catalogs in the root manifest.\n  if (tree.exists('package.json')) {\n    let changed = false;\n    updateJson(tree, 'package.json', (json) => {\n      changed = [\n        syncCatalog(json.catalog),\n        ...Object.values(\n          (json.catalogs ?? {}) as Record<string, Record<string, string>>,\n        ).map(syncCatalog),\n      ].some(Boolean);\n      return json;\n    });\n    if (changed) {\n      updated.push('package.json');\n    }\n  }\n\n  return updated;\n};\n\n/**\n * The package an override key pins, or undefined when the key names none.\n *\n * A key is a package name, optionally preceded by the path it is scoped to and\n * followed by the parent range it applies at:\n *\n *   zod                                     -> zod\n *   zod@^3                                  -> zod\n *   **&#47;@modelcontextprotocol/sdk/zod        -> zod\n *   @prisma/adapter-pg/@types/pg            -> @types/pg\n *\n * The last segment is the package, since every earlier one is a parent it is\n * scoped under — except that a scope and the name after it are one segment.\n */\nconst overriddenPackage = (key: string): string | undefined => {\n  const segments = key.split('/').reduce<string[]>((acc, part) => {\n    // A bare `@scope` is only half a name; join it to what follows.\n    const previous = acc[acc.length - 1];\n    if (previous?.startsWith('@') && !previous.includes('/')) {\n      acc[acc.length - 1] = `${previous}/${part}`;\n      return acc;\n    }\n    acc.push(part);\n    return acc;\n  }, []);\n\n  const name = segments[segments.length - 1];\n  if (!name || name === '.') {\n    return undefined;\n  }\n  // A trailing `@range` scopes the override to a parent version.\n  const at = name.lastIndexOf('@');\n  return at > 0 ? name.slice(0, at) : name;\n};\n\n/**\n * Sync the owned packages an override pins, wherever the workspace keeps them:\n * npm's `overrides`, yarn and bun's `resolutions`, and pnpm's `pnpm.overrides`\n * (10) or `pnpm-workspace.yaml` `overrides` (11).\n *\n * Devkit does not manage these fields, so an owned package pinned only here\n * would otherwise stay on the version it was generated with. Values are compared\n * with `isVendedUpgrade`, so a range the user widened is left alone.\n */\n/**\n * Where the workspace's package manager reads overrides from.\n *\n * Only the root manifest is considered: every package manager resolves overrides\n * from the workspace root, so a nested `overrides` block is inert and rewriting\n * it would imply an effect it doesn't have.\n *\n * pnpm moved the block between majors — 10 reads `pnpm.overrides` in the\n * manifest, 11 reads `overrides` in `pnpm-workspace.yaml` — so both are covered\n * rather than detecting the minor.\n */\nconst overrideLocations = (\n  tree: Tree,\n): {\n  manifestFields: readonly ('overrides' | 'resolutions' | 'pnpm.overrides')[];\n  workspaceFile?: string;\n} => {\n  switch (detectPackageManager(tree.root)) {\n    case 'npm':\n      return { manifestFields: ['overrides'] };\n    case 'yarn':\n      return { manifestFields: ['resolutions'] };\n    case 'bun':\n      // Bun reads npm's `overrides` and yarn's `resolutions` alike.\n      return { manifestFields: ['overrides', 'resolutions'] };\n    default:\n      return {\n        manifestFields: ['pnpm.overrides'],\n        workspaceFile: 'pnpm-workspace.yaml',\n      };\n  }\n};\n\nconst syncOverrides = (tree: Tree, owned: OwnedDependencies): string[] => {\n  const updated: string[] = [];\n\n  // Nested npm overrides carry the pin under `.`, with sibling keys scoping\n  // deeper, so a value may be a string or another override object.\n  const syncOverrideTree = (overrides: unknown): boolean => {\n    if (typeof overrides !== 'object' || overrides === null) {\n      return false;\n    }\n    let changed = false;\n    for (const [key, value] of Object.entries(\n      overrides as Record<string, unknown>,\n    )) {\n      if (typeof value === 'object' && value !== null) {\n        changed = syncOverrideTree(value) || changed;\n        continue;\n      }\n      if (typeof value !== 'string') {\n        continue;\n      }\n      // `.` pins the package its parent key names.\n      const name =\n        key === '.' ? undefined : (overriddenPackage(key) ?? undefined);\n      const vended = name ? vendedTsVersion(owned, name) : undefined;\n      if (vended && isVendedUpgrade(vended, value)) {\n        (overrides as Record<string, unknown>)[key] = vended;\n        changed = true;\n      }\n    }\n    return changed;\n  };\n\n  const { manifestFields, workspaceFile } = overrideLocations(tree);\n\n  if (manifestFields.length > 0) {\n    let changed = false;\n    updateJson(tree, 'package.json', (json) => {\n      changed = manifestFields\n        .map((field) =>\n          syncOverrideTree(\n            field === 'pnpm.overrides' ? json.pnpm?.overrides : json[field],\n          ),\n        )\n        .some(Boolean);\n      return json;\n    });\n    if (changed) {\n      updated.push('package.json');\n    }\n  }\n\n  if (workspaceFile && tree.exists(workspaceFile)) {\n    const contents = (yaml.load(tree.read(workspaceFile, 'utf-8') ?? '') ??\n      {}) as Record<string, unknown>;\n    if (syncOverrideTree(contents.overrides)) {\n      tree.write(workspaceFile, yaml.dump(contents, { quotingType: \"'\" }));\n      updated.push(workspaceFile);\n    }\n  }\n\n  return updated;\n};\n\n/**\n * Packages devkit already maintains through a `catalog:` reference. Empty\n * without a catalog manager, where no reference resolves.\n */\nconst referencedCatalogPackages = (tree: Tree): Set<string> => {\n  const referenced = new Set<string>();\n  if (getCatalogManager(tree.root) === null) {\n    return referenced;\n  }\n  visitNotIgnoredFiles(tree, '.', (path) => {\n    if (!path.endsWith('package.json')) {\n      return;\n    }\n    const json = readJson(tree, path);\n    for (const field of ['dependencies', 'devDependencies'] as const) {\n      for (const [name, declared] of Object.entries(\n        (json[field] ?? {}) as Record<string, string>,\n      )) {\n        if (String(declared).startsWith('catalog:')) {\n          referenced.add(name);\n        }\n      }\n    }\n  });\n  return referenced;\n};\n\n/** Pip specifier as `pip-requirements-js` reports it. */\ninterface PyVersionSpec {\n  readonly operator: string;\n  readonly version: string;\n}\n\n/**\n * Whether the declared specifiers already permit the vended version, so\n * rewriting them would discard the user's range without changing what resolves.\n *\n * This mirrors the TypeScript side: an exact pin is the case to upgrade, a range\n * that already reaches the vended version is left alone, and a range that falls\n * short is moved up.\n *\n * A `*` wildcard or a specifier semver can't read counts as already permitting,\n * so anything not understood is left as the user wrote it.\n */\nconst pyRangePermitsVended = (\n  specs: readonly PyVersionSpec[],\n  vended: string,\n): boolean =>\n  specs.every((spec) => {\n    if (spec.version.includes('*')) {\n      return true;\n    }\n    const bound = coerce(spec.version, { includePrerelease: true });\n    if (!bound) {\n      return true;\n    }\n    switch (spec.operator) {\n      // An exact pin permits only itself, so a differing vended version is an\n      // upgrade to apply.\n      case '==':\n      case '===':\n        return satisfies(vended, `=${bound.version}`, {\n          includePrerelease: true,\n        });\n      // `~=1.2.3` allows the patch series; `~=1.2` the minor series.\n      case '~=':\n        return satisfies(\n          vended,\n          spec.version.split('.').length > 2\n            ? `~${bound.version}`\n            : `^${bound.version}`,\n          { includePrerelease: true },\n        );\n      case '>=':\n      case '>':\n      case '<=':\n      case '<':\n        return satisfies(vended, `${spec.operator}${bound.version}`, {\n          includePrerelease: true,\n        });\n      // `!=` only excludes, so it never blocks the vended version by itself.\n      case '!=':\n        return true;\n      default:\n        return true;\n    }\n  });\n\n/**\n * Upgrade a pip requirement to the vended version, or return it unchanged.\n *\n * Parsed rather than pattern-matched so extras and operators are read the way\n * `uv` reads them. A requirement whose specifiers already permit the vended\n * version keeps them; one that falls short is replaced with an exact pin, which\n * is what the generators write.\n */\nconst syncPyRequirement = (\n  owned: OwnedDependencies,\n  requirement: string,\n): string => {\n  const parsed = parsePipRequirementsLine(requirement);\n  if (parsed?.type !== 'ProjectName' || !parsed.versionSpec?.length) {\n    return requirement;\n  }\n\n  const name = parsed.extras?.length\n    ? `${parsed.name}[${parsed.extras.join(',')}]`\n    : parsed.name;\n  const vended = vendedPyVersion(owned, name);\n  if (!vended) {\n    return requirement;\n  }\n\n  const specs = parsed.versionSpec as readonly PyVersionSpec[];\n  // Never move a version backwards: a pin above what this release vends is the\n  // user's, and a range already reaching it is theirs to keep.\n  const [first] = specs;\n  const isExactPin =\n    specs.length === 1 && (first.operator === '==' || first.operator === '===');\n  if (isExactPin && !isVendedUpgrade(vended, first.version)) {\n    return requirement;\n  }\n  if (!isExactPin && pyRangePermitsVended(specs, vended)) {\n    return requirement;\n  }\n  return `${name}==${vended}`;\n};\n\n/** Sync pins in every `pyproject.toml`, dependencies and groups alike. */\nconst syncPyProjects = (tree: Tree, owned: OwnedDependencies): string[] => {\n  const updated: string[] = [];\n\n  visitNotIgnoredFiles(tree, '.', (path) => {\n    if (!path.endsWith('pyproject.toml')) {\n      return;\n    }\n\n    let changed = false;\n    const syncRequirements = (requirements: unknown): unknown =>\n      Array.isArray(requirements)\n        ? requirements.map((requirement) => {\n            if (typeof requirement !== 'string') {\n              return requirement;\n            }\n            const synced = syncPyRequirement(owned, requirement);\n            changed ||= synced !== requirement;\n            return synced;\n          })\n        : requirements;\n\n    updateToml(tree, path, (toml) => {\n      const project = toml.project as Record<string, unknown> | undefined;\n      if (project?.dependencies) {\n        project.dependencies = syncRequirements(project.dependencies) as never;\n      }\n      const groups = toml['dependency-groups'] as\n        | Record<string, unknown>\n        | undefined;\n      for (const group of Object.keys(groups ?? {})) {\n        groups![group] = syncRequirements(groups![group]) as never;\n      }\n      return toml;\n    });\n\n    if (changed) {\n      updated.push(path);\n    }\n  });\n\n  return updated;\n};\n\n/**\n * GritQL matching one provider's `version` in `required_providers`, scoped by\n * the sibling `source` so an alias or another provider's version can't match.\n *\n * `language hcl` is required — without it the pattern silently matches nothing.\n */\nconst providerVersionPattern = (provider: string, rewrite = ''): string =>\n  `language hcl\\n\\`version = $version\\`${rewrite} where {` +\n  ` $version <: within \\`{ source = \"hashicorp/${provider}\" $... }\\` }`;\n\n/** Version a provider currently declares, if it declares one. */\nconst declaredProviderVersion = async (\n  tree: Tree,\n  path: string,\n  provider: string,\n): Promise<string | undefined> => {\n  const [captured] = await captureAllGritQL(\n    tree,\n    path,\n    providerVersionPattern(provider),\n  );\n  // The match is the whole attribute, e.g. `version = \"6.40.0\"`.\n  return /\"([^\"]+)\"/.exec(captured ?? '')?.[1];\n};\n\n/** Sync vended provider versions in every `.tf` file. */\nconst syncTerraformProviders = async (tree: Tree): Promise<string[]> => {\n  const updated: string[] = [];\n  const terraformFiles: string[] = [];\n\n  visitNotIgnoredFiles(tree, '.', (path) => {\n    if (path.endsWith('.tf')) {\n      terraformFiles.push(path);\n    }\n  });\n\n  for (const path of terraformFiles) {\n    let changed = false;\n    for (const [provider, vended] of Object.entries(TERRAFORM_VERSIONS)) {\n      const declared = await declaredProviderVersion(tree, path, provider);\n      if (!declared || !isVendedUpgrade(vended, declared)) {\n        continue;\n      }\n      changed =\n        (await applyGritQL(\n          tree,\n          path,\n          providerVersionPattern(provider, ` => \\`version = \"${vended}\"\\``),\n        )) || changed;\n    }\n    if (changed) {\n      updated.push(path);\n    }\n  }\n\n  return updated;\n};\n\n/**\n * Sync the versions this release vends, for the dependencies the workspace's\n * generators own.\n */\nexport const syncVendedVersions = async (\n  tree: Tree,\n): Promise<MigrationReturnObject> => {\n  const nextSteps: string[] = [];\n  const owned = await ownedDependencies(tree);\n\n  const packageJsons = syncPackageJsons(tree, owned);\n  const catalogs = syncOrphanCatalogEntries(tree, owned);\n  const overrides = syncOverrides(tree, owned);\n  const pyProjects = syncPyProjects(tree, owned);\n  const terraformFiles = await syncTerraformProviders(tree);\n  const skippedEmbedded = await syncEmbeddedVersions(tree, owned);\n  await syncMetricsVersion(tree);\n\n  // Lock files are left to the user: `nx migrate` only installs when the root\n  // manifest changes, and never runs `uv` or `terraform`.\n  if (catalogs.length > 0 || packageJsons.length > 0 || overrides.length > 0) {\n    nextSteps.push(\n      `TypeScript dependency versions were updated. Run \\`${buildInstallCommand(\n        detectPackageManager(tree.root),\n      )}\\` to update the lock file.`,\n    );\n  }\n  if (pyProjects.length > 0) {\n    nextSteps.push(\n      `Python dependency versions were updated in ${pyProjects.join(', ')}. Run \\`uv sync\\` to update uv.lock.`,\n    );\n  }\n  if (terraformFiles.length > 0) {\n    nextSteps.push(\n      `Terraform provider versions were updated in ${terraformFiles.length} file(s). Run \\`terraform init -upgrade\\` in each Terraform project to update its lock file.`,\n    );\n  }\n  // A synced embedded pin needs no next step — it is read the next time the thing\n  // holding it runs. A file the sync left alone does: its versions are still the\n  // old ones, and only the user can reconcile that.\n  if (skippedEmbedded.length > 0) {\n    nextSteps.push(\n      `Version pins were left as they are in ${skippedEmbedded.join(', ')}, which repeat a pin more times than this migration rewrites at once. Update them by hand.`,\n    );\n  }\n\n  // Without this the workspace's own format check fails on the migrated files.\n  await formatFilesInSubtree(tree);\n\n  return { nextSteps };\n};\n"],"names":["addDependenciesToPackageJson","detectPackageManager","readJson","updateJson","visitNotIgnoredFiles","yaml","getCatalogManager","parsePipRequirementsLine","coerce","parse","satisfies","validRange","applyGritQL","captureAllGritQL","buildInstallCommand","formatFilesInSubtree","updateToml","PY_VERSIONS","TERRAFORM_VERSIONS","TS_VERSIONS","isNxPackage","ownedDependencies","syncEmbeddedVersions","syncMetricsVersion","isVendedUpgrade","YAML_WORKSPACE_FILES","vendedTsVersion","owned","name","ts","has","undefined","vendedPyVersion","py","replace","REFERENCE_PROTOCOL","isSyncableSpecifier","tree","declared","test","startsWith","root","alreadyPermitsVended","packageName","vended","range","resolved","resolveCatalogReference","trim","declaredVendedPackages","packageJsonPath","json","pick","field","Object","fromEntries","entries","flatMap","dependencies","devDependencies","syncPackageJsons","updated","path","endsWith","keys","length","before","read","catalogsBefore","readCatalogFiles","push","map","exists","join","syncOrphanCatalogEntries","referenced","referencedCatalogPackages","syncCatalog","catalog","changed","String","catalogFile","load","values","catalogs","some","Boolean","write","dump","quotingType","overriddenPackage","key","segments","split","reduce","acc","part","previous","includes","at","lastIndexOf","slice","overrideLocations","manifestFields","workspaceFile","syncOverrides","syncOverrideTree","overrides","value","pnpm","contents","Set","add","pyRangePermitsVended","specs","every","spec","version","bound","includePrerelease","operator","syncPyRequirement","requirement","parsed","type","versionSpec","extras","first","isExactPin","syncPyProjects","syncRequirements","requirements","Array","isArray","synced","toml","project","groups","group","providerVersionPattern","provider","rewrite","declaredProviderVersion","captured","exec","syncTerraformProviders","terraformFiles","syncVendedVersions","nextSteps","packageJsons","pyProjects","skippedEmbedded"],"mappings":"AAAA;;;CAGC,GACD,SACEA,4BAA4B,EAC5BC,oBAAoB,EAEpBC,QAAQ,EAERC,UAAU,EACVC,oBAAoB,QACf,aAAa;AACpB,OAAOC,UAAU,UAAU;AAC3B,SAASC,iBAAiB,QAAQ,uBAAuB;AACzD,SAASC,wBAAwB,QAAQ,sBAAsB;AAC/D,SAASC,MAAM,EAAEC,KAAK,EAAEC,SAAS,EAAEC,UAAU,QAAQ,SAAS;AAC9D,SAASC,WAAW,EAAEC,gBAAgB,QAAQ,YAAY;AAC1D,SAASC,mBAAmB,QAAQ,iBAAiB;AACrD,SAASC,oBAAoB,QAAQ,eAAe;AACpD,SAASC,UAAU,QAAQ,aAAa;AACxC,SAASC,WAAW,EAAEC,kBAAkB,EAAEC,WAAW,QAAQ,iBAAiB;AAC9E,SAASC,WAAW,QAAQ,0BAA0B;AACtD,SAEEC,iBAAiB,QACZ,0BAA0B;AACjC,SAASC,oBAAoB,QAAQ,8BAA8B;AACnE,SAASC,kBAAkB,QAAQ,4BAA4B;AAC/D,SAASC,eAAe,QAAQ,sBAAsB;AAEtD;;;;;;;CAOC,GAED,0EAA0E,GAC1E,MAAMC,uBAAuB;IAAC;IAAuB;CAAc;AAEnE;;;CAGC,GACD,MAAMC,kBAAkB,CACtBC,OACAC,OAEAR,YAAYQ,SAAS,CAACD,MAAME,EAAE,CAACC,GAAG,CAACF,QAC/BG,YACAZ,WAAW,CAACS,KAAiC;AAEnD,2EAA2E,GAC3E,MAAMI,kBAAkB,CACtBL,OACAC,OAEAD,MAAMM,EAAE,CAACH,GAAG,CAACF,QACTX,WAAW,CAACW,KAAiC,EAAEM,QAAQ,OAAO,MAC9DH;AAEN,0EAA0E,GAC1E,MAAMI,qBACJ;AAEF;;;;;;CAMC,GACD,MAAMC,sBAAsB,CAACC,MAAYC;IACvC,8EAA8E;IAC9E,6EAA6E;IAC7E,8DAA8D;IAC9D,IAAI,OAAOA,aAAa,UAAU;QAChC,OAAO;IACT;IACA,IAAIH,mBAAmBI,IAAI,CAACD,WAAW;QACrC,OAAO;IACT;IACA,OACE,CAACA,SAASE,UAAU,CAAC,eAAelC,kBAAkB+B,KAAKI,IAAI,MAAM;AAEzE;AAEA;;;;;;CAMC,GACD,MAAMC,uBAAuB,CAC3BL,MACAM,aACAL,UACAM;IAEA,IAAIC,QAAQP;IACZ,IAAIA,SAASE,UAAU,CAAC,aAAa;QACnC,MAAMM,WAAWxC,kBAAkB+B,KAAKI,IAAI,GAAGM,wBAC7CV,MACAM,aACAL;QAEF,IAAI,CAACQ,UAAU;YACb,OAAO;QACT;QACAD,QAAQC;IACV;IACAD,QAAQA,MAAMG,IAAI;IAClB,gEAAgE;IAChE,IAAIvC,MAAMoC,WAAW,QAAQlC,WAAWkC,WAAW,MAAM;QACvD,OAAO;IACT;IACA,OAAOnC,UAAUkC,QAAQC;AAC3B;AAEA;;;;;CAKC,GACD,MAAMI,yBAAyB,CAC7BZ,MACAV,OACAuB;IAKA,MAAMC,OAAOjD,SAASmC,MAAMa;IAC5B,MAAME,OAAO,CAACC,QACZC,OAAOC,WAAW,CAChBD,OAAOE,OAAO,CAAEL,IAAI,CAACE,MAAM,IAAI,CAAC,GAA8BI,OAAO,CACnE,CAAC,CAAC7B,MAAMU,SAAS;YACf,MAAMM,SAASlB,gBAAgBC,OAAOC;YACtC,OAAOgB,UACLR,oBAAoBC,MAAMC,aAC1B,CAACI,qBAAqBL,MAAMT,MAAMU,UAAUM,UAC1C;gBAAC;oBAAChB;oBAAMgB;iBAAO;aAAU,GACzB,EAAE;QACR;IAGN,OAAO;QACLc,cAAcN,KAAK;QACnBO,iBAAiBP,KAAK;IACxB;AACF;AAEA;;;;;;;;;CASC,GACD,MAAMQ,mBAAmB,CAACvB,MAAYV;IACpC,MAAMkC,UAAoB,EAAE;IAE5BzD,qBAAqBiC,MAAM,KAAK,CAACyB;QAC/B,IAAI,CAACA,KAAKC,QAAQ,CAAC,iBAAiB;YAClC;QACF;QACA,MAAM,EAAEL,YAAY,EAAEC,eAAe,EAAE,GAAGV,uBACxCZ,MACAV,OACAmC;QAEF,IACER,OAAOU,IAAI,CAACN,cAAcO,MAAM,KAAK,KACrCX,OAAOU,IAAI,CAACL,iBAAiBM,MAAM,KAAK,GACxC;YACA;QACF;QAEA,MAAMC,SAAS7B,KAAK8B,IAAI,CAACL,MAAM;QAC/B,MAAMM,iBAAiBC,iBAAiBhC;QACxC,8DAA8D;QAC9DrC,6BAA6BqC,MAAMqB,cAAcC,iBAAiBG;QAClE,IACEzB,KAAK8B,IAAI,CAACL,MAAM,aAAaI,UAC7BG,iBAAiBhC,UAAU+B,gBAC3B;YACAP,QAAQS,IAAI,CAACR;QACf;IACF;IAEA,OAAOD;AACT;AAEA,qEAAqE,GACrE,MAAMQ,mBAAmB,CAAChC,OACxB;WAAIZ;QAAsB;KAAe,CACtC8C,GAAG,CAAC,CAACT,OAAUzB,KAAKmC,MAAM,CAACV,QAAQzB,KAAK8B,IAAI,CAACL,MAAM,WAAW,IAC9DW,IAAI,CAAC;AAEV;;;CAGC,GACD,MAAMC,2BAA2B,CAC/BrC,MACAV;IAEA,MAAMgD,aAAaC,0BAA0BvC;IAC7C,MAAMwB,UAAoB,EAAE;IAE5B,MAAMgB,cAAc,CAClBC;QAEA,IAAIC,UAAU;QACd,KAAK,MAAM,CAACnD,MAAMU,SAAS,IAAIgB,OAAOE,OAAO,CAACsB,WAAW,CAAC,GAAI;YAC5D,MAAMlC,SAASlB,gBAAgBC,OAAOC;YACtC,IAAI,CAACgB,UAAU+B,WAAW7C,GAAG,CAACF,OAAO;gBACnC;YACF;YACA,IAAIJ,gBAAgBoB,QAAQoC,OAAO1C,YAAY;gBAC7CwC,OAAQ,CAAClD,KAAK,GAAGgB;gBACjBmC,UAAU;YACZ;QACF;QACA,OAAOA;IACT;IAEA,KAAK,MAAMjB,QAAQrC,qBAAsB;QACvC,IAAI,CAACY,KAAKmC,MAAM,CAACV,OAAO;YACtB;QACF;QACA,MAAMmB,cAAe5E,KAAK6E,IAAI,CAAC7C,KAAK8B,IAAI,CAACL,MAAM,YAAY,OAAO,CAAC;QAInE,MAAMiB,UAAU;YACdF,YAAYI,YAAYH,OAAO;eAC5BxB,OAAO6B,MAAM,CAACF,YAAYG,QAAQ,IAAI,CAAC,GAAGb,GAAG,CAACM;SAClD,CAACQ,IAAI,CAACC;QACP,IAAIP,SAAS;YACX1C,KAAKkD,KAAK,CAACzB,MAAMzD,KAAKmF,IAAI,CAACP,aAAa;gBAAEQ,aAAa;YAAI;YAC3D5B,QAAQS,IAAI,CAACR;QACf;IACF;IAEA,+CAA+C;IAC/C,IAAIzB,KAAKmC,MAAM,CAAC,iBAAiB;QAC/B,IAAIO,UAAU;QACd5E,WAAWkC,MAAM,gBAAgB,CAACc;YAChC4B,UAAU;gBACRF,YAAY1B,KAAK2B,OAAO;mBACrBxB,OAAO6B,MAAM,CACbhC,KAAKiC,QAAQ,IAAI,CAAC,GACnBb,GAAG,CAACM;aACP,CAACQ,IAAI,CAACC;YACP,OAAOnC;QACT;QACA,IAAI4B,SAAS;YACXlB,QAAQS,IAAI,CAAC;QACf;IACF;IAEA,OAAOT;AACT;AAEA;;;;;;;;;;;;;CAaC,GACD,MAAM6B,oBAAoB,CAACC;IACzB,MAAMC,WAAWD,IAAIE,KAAK,CAAC,KAAKC,MAAM,CAAW,CAACC,KAAKC;QACrD,gEAAgE;QAChE,MAAMC,WAAWF,GAAG,CAACA,IAAI9B,MAAM,GAAG,EAAE;QACpC,IAAIgC,UAAUzD,WAAW,QAAQ,CAACyD,SAASC,QAAQ,CAAC,MAAM;YACxDH,GAAG,CAACA,IAAI9B,MAAM,GAAG,EAAE,GAAG,GAAGgC,SAAS,CAAC,EAAED,MAAM;YAC3C,OAAOD;QACT;QACAA,IAAIzB,IAAI,CAAC0B;QACT,OAAOD;IACT,GAAG,EAAE;IAEL,MAAMnE,OAAOgE,QAAQ,CAACA,SAAS3B,MAAM,GAAG,EAAE;IAC1C,IAAI,CAACrC,QAAQA,SAAS,KAAK;QACzB,OAAOG;IACT;IACA,+DAA+D;IAC/D,MAAMoE,KAAKvE,KAAKwE,WAAW,CAAC;IAC5B,OAAOD,KAAK,IAAIvE,KAAKyE,KAAK,CAAC,GAAGF,MAAMvE;AACtC;AAEA;;;;;;;;CAQC,GACD;;;;;;;;;;CAUC,GACD,MAAM0E,oBAAoB,CACxBjE;IAKA,OAAQpC,qBAAqBoC,KAAKI,IAAI;QACpC,KAAK;YACH,OAAO;gBAAE8D,gBAAgB;oBAAC;iBAAY;YAAC;QACzC,KAAK;YACH,OAAO;gBAAEA,gBAAgB;oBAAC;iBAAc;YAAC;QAC3C,KAAK;YACH,8DAA8D;YAC9D,OAAO;gBAAEA,gBAAgB;oBAAC;oBAAa;iBAAc;YAAC;QACxD;YACE,OAAO;gBACLA,gBAAgB;oBAAC;iBAAiB;gBAClCC,eAAe;YACjB;IACJ;AACF;AAEA,MAAMC,gBAAgB,CAACpE,MAAYV;IACjC,MAAMkC,UAAoB,EAAE;IAE5B,0EAA0E;IAC1E,iEAAiE;IACjE,MAAM6C,mBAAmB,CAACC;QACxB,IAAI,OAAOA,cAAc,YAAYA,cAAc,MAAM;YACvD,OAAO;QACT;QACA,IAAI5B,UAAU;QACd,KAAK,MAAM,CAACY,KAAKiB,MAAM,IAAItD,OAAOE,OAAO,CACvCmD,WACC;YACD,IAAI,OAAOC,UAAU,YAAYA,UAAU,MAAM;gBAC/C7B,UAAU2B,iBAAiBE,UAAU7B;gBACrC;YACF;YACA,IAAI,OAAO6B,UAAU,UAAU;gBAC7B;YACF;YACA,6CAA6C;YAC7C,MAAMhF,OACJ+D,QAAQ,MAAM5D,YAAa2D,kBAAkBC,QAAQ5D;YACvD,MAAMa,SAAShB,OAAOF,gBAAgBC,OAAOC,QAAQG;YACrD,IAAIa,UAAUpB,gBAAgBoB,QAAQgE,QAAQ;gBAC3CD,SAAqC,CAAChB,IAAI,GAAG/C;gBAC9CmC,UAAU;YACZ;QACF;QACA,OAAOA;IACT;IAEA,MAAM,EAAEwB,cAAc,EAAEC,aAAa,EAAE,GAAGF,kBAAkBjE;IAE5D,IAAIkE,eAAetC,MAAM,GAAG,GAAG;QAC7B,IAAIc,UAAU;QACd5E,WAAWkC,MAAM,gBAAgB,CAACc;YAChC4B,UAAUwB,eACPhC,GAAG,CAAC,CAAClB,QACJqD,iBACErD,UAAU,mBAAmBF,KAAK0D,IAAI,EAAEF,YAAYxD,IAAI,CAACE,MAAM,GAGlEgC,IAAI,CAACC;YACR,OAAOnC;QACT;QACA,IAAI4B,SAAS;YACXlB,QAAQS,IAAI,CAAC;QACf;IACF;IAEA,IAAIkC,iBAAiBnE,KAAKmC,MAAM,CAACgC,gBAAgB;QAC/C,MAAMM,WAAYzG,KAAK6E,IAAI,CAAC7C,KAAK8B,IAAI,CAACqC,eAAe,YAAY,OAC/D,CAAC;QACH,IAAIE,iBAAiBI,SAASH,SAAS,GAAG;YACxCtE,KAAKkD,KAAK,CAACiB,eAAenG,KAAKmF,IAAI,CAACsB,UAAU;gBAAErB,aAAa;YAAI;YACjE5B,QAAQS,IAAI,CAACkC;QACf;IACF;IAEA,OAAO3C;AACT;AAEA;;;CAGC,GACD,MAAMe,4BAA4B,CAACvC;IACjC,MAAMsC,aAAa,IAAIoC;IACvB,IAAIzG,kBAAkB+B,KAAKI,IAAI,MAAM,MAAM;QACzC,OAAOkC;IACT;IACAvE,qBAAqBiC,MAAM,KAAK,CAACyB;QAC/B,IAAI,CAACA,KAAKC,QAAQ,CAAC,iBAAiB;YAClC;QACF;QACA,MAAMZ,OAAOjD,SAASmC,MAAMyB;QAC5B,KAAK,MAAMT,SAAS;YAAC;YAAgB;SAAkB,CAAW;YAChE,KAAK,MAAM,CAACzB,MAAMU,SAAS,IAAIgB,OAAOE,OAAO,CAC1CL,IAAI,CAACE,MAAM,IAAI,CAAC,GAChB;gBACD,IAAI2B,OAAO1C,UAAUE,UAAU,CAAC,aAAa;oBAC3CmC,WAAWqC,GAAG,CAACpF;gBACjB;YACF;QACF;IACF;IACA,OAAO+C;AACT;AAQA;;;;;;;;;;CAUC,GACD,MAAMsC,uBAAuB,CAC3BC,OACAtE,SAEAsE,MAAMC,KAAK,CAAC,CAACC;QACX,IAAIA,KAAKC,OAAO,CAACnB,QAAQ,CAAC,MAAM;YAC9B,OAAO;QACT;QACA,MAAMoB,QAAQ9G,OAAO4G,KAAKC,OAAO,EAAE;YAAEE,mBAAmB;QAAK;QAC7D,IAAI,CAACD,OAAO;YACV,OAAO;QACT;QACA,OAAQF,KAAKI,QAAQ;YACnB,wEAAwE;YACxE,oBAAoB;YACpB,KAAK;YACL,KAAK;gBACH,OAAO9G,UAAUkC,QAAQ,CAAC,CAAC,EAAE0E,MAAMD,OAAO,EAAE,EAAE;oBAC5CE,mBAAmB;gBACrB;YACF,+DAA+D;YAC/D,KAAK;gBACH,OAAO7G,UACLkC,QACAwE,KAAKC,OAAO,CAACxB,KAAK,CAAC,KAAK5B,MAAM,GAAG,IAC7B,CAAC,CAAC,EAAEqD,MAAMD,OAAO,EAAE,GACnB,CAAC,CAAC,EAAEC,MAAMD,OAAO,EAAE,EACvB;oBAAEE,mBAAmB;gBAAK;YAE9B,KAAK;YACL,KAAK;YACL,KAAK;YACL,KAAK;gBACH,OAAO7G,UAAUkC,QAAQ,GAAGwE,KAAKI,QAAQ,GAAGF,MAAMD,OAAO,EAAE,EAAE;oBAC3DE,mBAAmB;gBACrB;YACF,uEAAuE;YACvE,KAAK;gBACH,OAAO;YACT;gBACE,OAAO;QACX;IACF;AAEF;;;;;;;CAOC,GACD,MAAME,oBAAoB,CACxB9F,OACA+F;IAEA,MAAMC,SAASpH,yBAAyBmH;IACxC,IAAIC,QAAQC,SAAS,iBAAiB,CAACD,OAAOE,WAAW,EAAE5D,QAAQ;QACjE,OAAOyD;IACT;IAEA,MAAM9F,OAAO+F,OAAOG,MAAM,EAAE7D,SACxB,GAAG0D,OAAO/F,IAAI,CAAC,CAAC,EAAE+F,OAAOG,MAAM,CAACrD,IAAI,CAAC,KAAK,CAAC,CAAC,GAC5CkD,OAAO/F,IAAI;IACf,MAAMgB,SAASZ,gBAAgBL,OAAOC;IACtC,IAAI,CAACgB,QAAQ;QACX,OAAO8E;IACT;IAEA,MAAMR,QAAQS,OAAOE,WAAW;IAChC,6EAA6E;IAC7E,6DAA6D;IAC7D,MAAM,CAACE,MAAM,GAAGb;IAChB,MAAMc,aACJd,MAAMjD,MAAM,KAAK,KAAM8D,CAAAA,MAAMP,QAAQ,KAAK,QAAQO,MAAMP,QAAQ,KAAK,KAAI;IAC3E,IAAIQ,cAAc,CAACxG,gBAAgBoB,QAAQmF,MAAMV,OAAO,GAAG;QACzD,OAAOK;IACT;IACA,IAAI,CAACM,cAAcf,qBAAqBC,OAAOtE,SAAS;QACtD,OAAO8E;IACT;IACA,OAAO,GAAG9F,KAAK,EAAE,EAAEgB,QAAQ;AAC7B;AAEA,wEAAwE,GACxE,MAAMqF,iBAAiB,CAAC5F,MAAYV;IAClC,MAAMkC,UAAoB,EAAE;IAE5BzD,qBAAqBiC,MAAM,KAAK,CAACyB;QAC/B,IAAI,CAACA,KAAKC,QAAQ,CAAC,mBAAmB;YACpC;QACF;QAEA,IAAIgB,UAAU;QACd,MAAMmD,mBAAmB,CAACC,eACxBC,MAAMC,OAAO,CAACF,gBACVA,aAAa5D,GAAG,CAAC,CAACmD;gBAChB,IAAI,OAAOA,gBAAgB,UAAU;oBACnC,OAAOA;gBACT;gBACA,MAAMY,SAASb,kBAAkB9F,OAAO+F;gBACxC3C,YAAYuD,WAAWZ;gBACvB,OAAOY;YACT,KACAH;QAENnH,WAAWqB,MAAMyB,MAAM,CAACyE;YACtB,MAAMC,UAAUD,KAAKC,OAAO;YAC5B,IAAIA,SAAS9E,cAAc;gBACzB8E,QAAQ9E,YAAY,GAAGwE,iBAAiBM,QAAQ9E,YAAY;YAC9D;YACA,MAAM+E,SAASF,IAAI,CAAC,oBAAoB;YAGxC,KAAK,MAAMG,SAASpF,OAAOU,IAAI,CAACyE,UAAU,CAAC,GAAI;gBAC7CA,MAAO,CAACC,MAAM,GAAGR,iBAAiBO,MAAO,CAACC,MAAM;YAClD;YACA,OAAOH;QACT;QAEA,IAAIxD,SAAS;YACXlB,QAAQS,IAAI,CAACR;QACf;IACF;IAEA,OAAOD;AACT;AAEA;;;;;CAKC,GACD,MAAM8E,yBAAyB,CAACC,UAAkBC,UAAU,EAAE,GAC5D,CAAC,oCAAoC,EAAEA,QAAQ,QAAQ,CAAC,GACxD,CAAC,4CAA4C,EAAED,SAAS,YAAY,CAAC;AAEvE,+DAA+D,GAC/D,MAAME,0BAA0B,OAC9BzG,MACAyB,MACA8E;IAEA,MAAM,CAACG,SAAS,GAAG,MAAMlI,iBACvBwB,MACAyB,MACA6E,uBAAuBC;IAEzB,+DAA+D;IAC/D,OAAO,YAAYI,IAAI,CAACD,YAAY,KAAK,CAAC,EAAE;AAC9C;AAEA,uDAAuD,GACvD,MAAME,yBAAyB,OAAO5G;IACpC,MAAMwB,UAAoB,EAAE;IAC5B,MAAMqF,iBAA2B,EAAE;IAEnC9I,qBAAqBiC,MAAM,KAAK,CAACyB;QAC/B,IAAIA,KAAKC,QAAQ,CAAC,QAAQ;YACxBmF,eAAe5E,IAAI,CAACR;QACtB;IACF;IAEA,KAAK,MAAMA,QAAQoF,eAAgB;QACjC,IAAInE,UAAU;QACd,KAAK,MAAM,CAAC6D,UAAUhG,OAAO,IAAIU,OAAOE,OAAO,CAACtC,oBAAqB;YACnE,MAAMoB,WAAW,MAAMwG,wBAAwBzG,MAAMyB,MAAM8E;YAC3D,IAAI,CAACtG,YAAY,CAACd,gBAAgBoB,QAAQN,WAAW;gBACnD;YACF;YACAyC,UACE,AAAC,MAAMnE,YACLyB,MACAyB,MACA6E,uBAAuBC,UAAU,CAAC,iBAAiB,EAAEhG,OAAO,GAAG,CAAC,MAC5DmC;QACV;QACA,IAAIA,SAAS;YACXlB,QAAQS,IAAI,CAACR;QACf;IACF;IAEA,OAAOD;AACT;AAEA;;;CAGC,GACD,OAAO,MAAMsF,qBAAqB,OAChC9G;IAEA,MAAM+G,YAAsB,EAAE;IAC9B,MAAMzH,QAAQ,MAAMN,kBAAkBgB;IAEtC,MAAMgH,eAAezF,iBAAiBvB,MAAMV;IAC5C,MAAMyD,WAAWV,yBAAyBrC,MAAMV;IAChD,MAAMgF,YAAYF,cAAcpE,MAAMV;IACtC,MAAM2H,aAAarB,eAAe5F,MAAMV;IACxC,MAAMuH,iBAAiB,MAAMD,uBAAuB5G;IACpD,MAAMkH,kBAAkB,MAAMjI,qBAAqBe,MAAMV;IACzD,MAAMJ,mBAAmBc;IAEzB,4EAA4E;IAC5E,wDAAwD;IACxD,IAAI+C,SAASnB,MAAM,GAAG,KAAKoF,aAAapF,MAAM,GAAG,KAAK0C,UAAU1C,MAAM,GAAG,GAAG;QAC1EmF,UAAU9E,IAAI,CACZ,CAAC,mDAAmD,EAAExD,oBACpDb,qBAAqBoC,KAAKI,IAAI,GAC9B,2BAA2B,CAAC;IAElC;IACA,IAAI6G,WAAWrF,MAAM,GAAG,GAAG;QACzBmF,UAAU9E,IAAI,CACZ,CAAC,2CAA2C,EAAEgF,WAAW7E,IAAI,CAAC,MAAM,oCAAoC,CAAC;IAE7G;IACA,IAAIyE,eAAejF,MAAM,GAAG,GAAG;QAC7BmF,UAAU9E,IAAI,CACZ,CAAC,4CAA4C,EAAE4E,eAAejF,MAAM,CAAC,4FAA4F,CAAC;IAEtK;IACA,gFAAgF;IAChF,+EAA+E;IAC/E,kDAAkD;IAClD,IAAIsF,gBAAgBtF,MAAM,GAAG,GAAG;QAC9BmF,UAAU9E,IAAI,CACZ,CAAC,sCAAsC,EAAEiF,gBAAgB9E,IAAI,CAAC,MAAM,0FAA0F,CAAC;IAEnK;IAEA,6EAA6E;IAC7E,MAAM1D,qBAAqBsB;IAE3B,OAAO;QAAE+G;IAAU;AACrB,EAAE"}

package/src/utils/versions.d.ts

@@ -2,7 +2,7 @@
  * Copyright Amazon.com, Inc. or its affiliates. All Rights Reserved.
  * SPDX-License-Identifier: Apache-2.0
  */
-import { type DeclaredPy, type DeclaredTs, type DependencyDeclaration } from './declared-dependencies';
+import { type DeclaredPy, type DeclaredTs, type DependencyDeclaration } from './declared-dependencies.js';
 /**
  * Versons for TypeScript dependencies added by generators
  */

package/src/utils/versions.js.map

@@ -1 +1 @@
-{"version":3,"sources":["../../../../../packages/nx-plugin/src/utils/versions.ts"],"sourcesContent":["/**\n * Copyright Amazon.com, Inc. or its affiliates. All Rights Reserved.\n * SPDX-License-Identifier: Apache-2.0\n */\nimport {\n  type DeclaredPy,\n  type DeclaredTs,\n  type DependencyDeclaration,\n  declaredNames,\n} from './declared-dependencies';\n\n/**\n * Versons for TypeScript dependencies added by generators\n */\nexport const TS_VERSIONS = {\n  '@a2a-js/sdk': '0.3.14',\n  '@aws/aws-distro-opentelemetry-node-autoinstrumentation': '0.12.0',\n  // Pinned above the version the ADOT autoinstrumentation package resolves\n  // transitively (2.8.0) to clear CVE-2026-59892 (HIGH).\n  '@opentelemetry/propagator-jaeger': '2.10.0',\n  // Overridden in the vended agent/MCP image builds to clear CVE-2026-14257\n  // (HIGH) in brace-expansion: minimatch 10 is the lowest major depending on\n  // brace-expansion 5.x, the only line Trivy's `< 5.0.8` advisory range treats\n  // as fixed. Overriding brace-expansion directly is not viable — 5.x drops the\n  // CommonJS default export that minimatch 9 calls.\n  minimatch: '10.2.6',\n  '@aws-sdk/client-dynamodb': '3.1111.0',\n  '@aws-sdk/client-api-gateway': '3.1111.0',\n  '@aws-sdk/client-iam': '3.1111.0',\n  '@aws-sdk/client-bedrock-agentcore': '3.1111.0',\n  '@aws-sdk/client-bedrock-runtime': '3.1111.0',\n  '@aws-sdk/client-s3': '3.1111.0',\n  '@aws-sdk/client-sts': '3.1111.0',\n  '@aws-sdk/credential-providers': '3.1111.0',\n  '@aws-sdk/credential-provider-cognito-identity': '3.972.68',\n  '@aws-sdk/client-secrets-manager': '3.1111.0',\n  '@aws-sdk/rds-signer': '3.1111.0',\n  '@smithy/server-apigateway': '0.3.3',\n  '@smithy/server-node': '0.3.3',\n  '@aws-lambda-powertools/logger': '2.34.0',\n  '@aws-lambda-powertools/metrics': '2.34.0',\n  '@aws-lambda-powertools/parameters': '2.34.0',\n  '@aws-lambda-powertools/tracer': '2.34.0',\n  '@aws-lambda-powertools/parser': '2.34.0',\n  '@aws-sdk/client-appconfigdata': '3.1111.0',\n  '@middy/core': '7.7.4',\n  '@nxlv/python': '23.0.0',\n  '@nx-extend/terraform': '10.4.1',\n  // These must all hold the same version — see NX_PACKAGES.\n  nx: '23.1.1',\n  '@nx/devkit': '23.1.1',\n  '@nx/js': '23.1.1',\n  '@nx/react': '23.1.1',\n  '@nx/vite': '23.1.1',\n  '@nx/vitest': '23.1.1',\n  '@nx/workspace': '23.1.1',\n  'create-nx-workspace': '23.1.1',\n  '@swc-node/register': '1.12.1',\n  '@swc/core': '1.16.0',\n  '@modelcontextprotocol/sdk': '1.30.0',\n  '@modelcontextprotocol/inspector': '2.2.0',\n  '@ag-ui/a2ui-toolkit': '0.0.4',\n  '@ag-ui/aws-strands': '0.2.3',\n  '@ag-ui/client': '0.0.57',\n  '@ag-ui/core': '0.0.57',\n  '@ag-ui/encoder': '0.0.57',\n  'agent-chat-cli': '0.3.0',\n  '@copilotkit/react-core': '1.68.1',\n  rxjs: '7.8.2',\n  '@strands-agents/sdk': '1.13.0',\n  '@tanstack/react-router': '1.170.29',\n  '@tanstack/router-plugin': '1.168.32',\n  '@tanstack/router-generator': '1.167.30',\n  '@tanstack/virtual-file-routes': '1.162.0',\n  '@tanstack/router-utils': '1.162.2',\n  '@cloudscape-design/board-components': '3.0.218',\n  '@cloudscape-design/chat-components': '1.0.162',\n  '@cloudscape-design/components': '3.0.1347',\n  '@cloudscape-design/global-styles': '1.0.66',\n  '@tanstack/react-query': '5.101.4',\n  '@tanstack/react-query-devtools': '5.101.4',\n  '@trpc/tanstack-react-query': '11.18.0',\n  '@trpc/client': '11.18.0',\n  '@trpc/server': '11.18.0',\n  '@types/node': '26.2.0',\n  '@types/aws-lambda': '8.10.162',\n  '@types/cors': '2.8.19',\n  '@types/pg': '8.21.0',\n  '@types/ws': '8.18.1',\n  '@types/express': '5.0.6',\n  '@smithy/config-resolver': '4.7.2',\n  '@smithy/node-config-provider': '4.6.2',\n  '@smithy/node-http-handler': '4.11.2',\n  '@smithy/types': '4.17.2',\n  '@vitest/coverage-v8': '4.1.10',\n  '@vitest/ui': '4.1.10',\n  '@astrojs/react': '6.0.2',\n  '@astrojs/starlight': '0.41.7',\n  astro: '7.1.1',\n  aws4fetch: '1.0.20',\n  'aws-cdk': '2.1136.0',\n  'aws-cdk-lib': '2.265.0',\n  'aws-xray-sdk-core': '3.12.0',\n  constructs: '10.8.1',\n  cors: '2.8.6',\n  chalk: '6.0.0',\n  'class-variance-authority': '0.7.1',\n  clsx: '2.1.1',\n  commander: '15.0.0',\n  'cpy-cli': '7.0.0',\n  electrodb: '3.9.3',\n  esbuild: '0.28.2',\n  'event-source-polyfill': '1.0.31',\n  '@types/event-source-polyfill': '1.0.5',\n  '@biomejs/biome': '2.5.8',\n  '@prisma/adapter-mariadb': '7.9.1',\n  '@prisma/adapter-pg': '7.9.1',\n  '@prisma/client': '7.9.1',\n  ejs: '6.0.1',\n  '@types/ejs': '3.1.5',\n  express: '5.2.1',\n  'fast-glob': '3.3.3',\n  husky: '9.1.7',\n  'fs-extra': '11.4.0',\n  '@types/fs-extra': '11.0.4',\n  'make-dir-cli': '4.0.0',\n  mariadb: '3.5.3',\n  mise: '2026.8.6',\n  ncp: '2.0.0',\n  npm: '12.0.2',\n  'npm-check-updates': '23.0.2',\n  'oidc-client-ts': '3.5.0',\n  pg: '8.23.0',\n  prisma: '7.9.1',\n  'react-oidc-context': '3.3.1',\n  react: '19.2.8',\n  'react-dom': '19.2.8',\n  rimraf: '6.1.3',\n  rolldown: '1.2.4',\n  'rolldown-plugin-dts': '0.28.2',\n  'simple-git': '3.36.0',\n  'source-map-support': '0.5.21',\n  'starlight-blog': '0.28.0',\n  tailwindcss: '4.3.3',\n  '@tailwindcss/vite': '4.3.3',\n  tsx: '4.23.12',\n  'lucide-react': '1.31.0',\n  'radix-ui': '1.6.7',\n  shadcn: '4.18.0',\n  'tw-animate-css': '1.4.0',\n  'tailwind-merge': '3.6.0',\n  vite: '8.2.1',\n  typescript: '6.0.3',\n  vitest: '4.1.10',\n  zod: '4.4.3',\n  ws: '8.21.3',\n} as const;\nexport type ITsDepVersion = keyof typeof TS_VERSIONS;\n\n/**\n * Add versions to the given dependencies, which the declaration must own.\n *\n * @param declaration the calling generator's `DEPENDENCIES`\n */\nexport const withVersions = <D extends DependencyDeclaration>(\n  declaration: D,\n  deps: readonly DeclaredTs<D>[],\n): Record<string, string> => {\n  assertDeclared(declaration.ts, deps, 'ts');\n  return Object.fromEntries(\n    deps.map((dep) => [dep, TS_VERSIONS[dep as ITsDepVersion]]),\n  );\n};\n\n/**\n * The `nx` and `@nx/*` packages a generated workspace pins, all of which must\n * hold the same version: a workspace nx even a patch apart hoists a second\n * nested nx, and the two deadlock `nx sync`.\n *\n * Bumping them in a user's workspace requires `packageJsonUpdates` rather than a\n * migration — see `version-upgrade-migration/nx-package-updates.ts`.\n */\nexport const NX_PACKAGES = [\n  'nx',\n  '@nx/devkit',\n  '@nx/js',\n  '@nx/react',\n  '@nx/vite',\n  '@nx/vitest',\n  '@nx/workspace',\n] as const satisfies readonly ITsDepVersion[];\n\n/**\n * The nx version the plugin is built against, and the single source of truth\n * for every place a workspace's nx is pinned.\n */\nexport const NX_VERSION = TS_VERSIONS.nx;\n\n/**\n * Versions for Python dependencies added by generators\n */\nexport const PY_VERSIONS = {\n  'a2a-sdk': '==0.3.26',\n  'ag-ui-langgraph': '==0.0.43',\n  'ag-ui-protocol': '==0.1.20',\n  'ag-ui-strands': '==0.3.0',\n  aiosqlite: '==0.22.1',\n  'aws-lambda-powertools': '==3.34.0',\n  'aws-lambda-powertools[tracer]': '==3.34.0',\n  'aws-lambda-powertools[parser]': '==3.34.0',\n  'aws-opentelemetry-distro': '==0.19.0',\n  'bedrock-agentcore': '==1.21.0',\n  boto3: '==1.43.72',\n  checkov: '==3.3.11',\n  fastapi: '==0.141.1',\n  'fastapi[standard]': '==0.141.1',\n  httpx: '==0.28.1',\n  langchain: '==1.3.15',\n  'langchain-aws': '==1.7.1',\n  'langchain-mcp-adapters': '==0.3.2',\n  langgraph: '==1.2.11',\n  'langgraph-checkpoint-aws': '==1.2.2',\n  'langgraph-checkpoint-sqlite': '==3.1.1',\n  mcp: '==1.28.1',\n  'pip-check-updates': '==0.29.0',\n  'pip-licenses': '==5.5.5',\n  ruff: '==0.16.3',\n  'strands-agents': '==1.52.0',\n  'strands-agents[a2a]': '==1.52.0',\n  'strands-agents-tools': '==0.8.6',\n  ty: '==0.0.72',\n  pynamodb: '==6.1.0',\n  uvicorn: '==0.52.3',\n  sqlmodel: '==0.0.39',\n  alembic: '==1.19.1',\n  aiomysql: '==0.3.2',\n  asyncpg: '==0.31.0',\n  // Pinned explicitly: SQLAlchemy's async engine pulls greenlet transitively,\n  // and leaving it unpinned lets uv resolve to a just-released version whose\n  // platform wheels may not all be published yet (breaking aarch64 installs).\n  greenlet: '==3.5.5',\n} as const;\nexport type IPyDepVersion = keyof typeof PY_VERSIONS;\n\n/**\n * Add versions to the given dependencies\n */\nexport const withPyVersions = <D extends DependencyDeclaration>(\n  declaration: D,\n  deps: readonly DeclaredPy<D>[],\n): string[] => {\n  assertDeclared(declaration.py, deps, 'py');\n  return deps.map((dep) => `${dep}${PY_VERSIONS[dep as IPyDepVersion]}`);\n};\n\n/** Catches undeclared packages that reach here past the type checker. */\nconst assertDeclared = (\n  declared: readonly { readonly name: string }[],\n  deps: readonly unknown[],\n  kind: 'ts' | 'py',\n): void => {\n  const names = declaredNames(declared);\n  const undeclared = deps.filter((dep) => !names.includes(dep as string));\n  if (undeclared.length > 0) {\n    throw new Error(\n      `Undeclared ${kind} dependencies: ${undeclared.join(', ')}. Add them to the generator's declareDependencies({ ${kind}: [...] }).`,\n    );\n  }\n};\n\n/**\n * Versions for vendored tools\n */\nexport const VENDORED_VERSIONS = {\n  'git-secrets': '1.3.0',\n} as const;\n\n/**\n * Versions of Java dependencies added by generators, keyed by Maven coordinate.\n *\n * Every entry is resolved from Maven Central by the version update and named\n * `<group>:<artifact>:<version>` where a generator writes it.\n */\nexport const JAVA_VERSIONS = {\n  'software.amazon.smithy:smithy-model': '1.73.0',\n  'software.amazon.smithy:smithy-aws-traits': '1.73.0',\n  'software.amazon.smithy:smithy-validation-model': '1.73.0',\n  'software.amazon.smithy:smithy-openapi': '1.73.0',\n  'software.amazon.smithy.typescript:smithy-aws-typescript-codegen': '0.52.0',\n} as const;\nexport type IJavaVersion = keyof typeof JAVA_VERSIONS;\n\n/** The Maven coordinates the version update resolves, in declaration order. */\nexport const JAVA_ARTIFACTS = Object.keys(JAVA_VERSIONS) as IJavaVersion[];\n\n/** A Maven coordinate as a dependency names it: `<group>:<artifact>:<version>`. */\nexport const javaMavenDependency = (artifact: IJavaVersion): string =>\n  `${artifact}:${JAVA_VERSIONS[artifact]}`;\n\n/**\n * Versions of tools resolved by mise, keyed by the tool name mise knows.\n *\n * Every entry is checked with `mise latest <tool>` by the version update. Nothing\n * is installed into the workspace: the pin travels in the `project.json` target\n * command, which is what the version sync reaches to move it forward.\n */\nexport const MISE_VERSIONS = {\n  smithy: '1.73.0',\n} as const;\nexport type IMiseVersion = keyof typeof MISE_VERSIONS;\n\n/** The tools the version update resolves through mise, in declaration order. */\nexport const MISE_TOOLS = Object.keys(MISE_VERSIONS) as IMiseVersion[];\n\n/**\n * Base container images used by generated Dockerfiles. Pinned exactly so\n * generated images are reproducible, and chosen to be free of known\n * HIGH/CRITICAL vulnerabilities at time of generation.\n */\nexport const BASE_IMAGES = {\n  node: 'public.ecr.aws/docker/library/node:lts-slim',\n  python: 'public.ecr.aws/docker/library/python:3.14-slim',\n} as const;\n\n/**\n * Versions for container tooling used by generated image build/scan targets.\n * Pinned exactly so generated images are reproducible.\n */\nexport const CONTAINER_VERSIONS = {\n  // ECR-hosted Trivy image used to scan built images during the build.\n  trivy: '0.72.0',\n} as const;\n\n/**\n * Repository each pinned tool image is pulled from, keyed as\n * {@link CONTAINER_VERSIONS}. Kept beside the versions so a tool added here is\n * one entry rather than a reference built somewhere else, which is also what\n * lets the version sync find these pins wherever a target command runs them.\n */\nexport const CONTAINER_REPOSITORIES = {\n  trivy: 'public.ecr.aws/aquasecurity/trivy',\n} as const satisfies Record<keyof typeof CONTAINER_VERSIONS, string>;\n\n/** The pinned reference for a tool image, as a target command runs it. */\nexport const containerImage = (tool: keyof typeof CONTAINER_VERSIONS): string =>\n  `${CONTAINER_REPOSITORIES[tool]}:${CONTAINER_VERSIONS[tool]}`;\n\n/**\n * Exact versions for Terraform providers used by generated `.tf` modules.\n * Pinned exactly (no range operator) so generated infrastructure is reproducible.\n */\nexport const TERRAFORM_VERSIONS = {\n  aws: '6.60.0',\n  random: '3.9.0',\n  null: '3.3.1',\n  archive: '2.8.0',\n  external: '2.4.1',\n  local: '2.9.0',\n  time: '0.14.1',\n} as const;\nexport type ITerraformProviderVersion = keyof typeof TERRAFORM_VERSIONS;\n\n/**\n * Substitution variables exposing Terraform provider version constraints to\n * generated `.tf` templates (e.g. `version = \"<%- awsProviderVersion %>\"`)\n */\nexport const terraformProviderVersions = () => ({\n  awsProviderVersion: TERRAFORM_VERSIONS.aws,\n  randomProviderVersion: TERRAFORM_VERSIONS.random,\n  nullProviderVersion: TERRAFORM_VERSIONS.null,\n  archiveProviderVersion: TERRAFORM_VERSIONS.archive,\n  externalProviderVersion: TERRAFORM_VERSIONS.external,\n  localProviderVersion: TERRAFORM_VERSIONS.local,\n  timeProviderVersion: TERRAFORM_VERSIONS.time,\n});\n"],"names":["declaredNames","TS_VERSIONS","minimatch","nx","rxjs","astro","aws4fetch","constructs","cors","chalk","clsx","commander","electrodb","esbuild","ejs","express","husky","mariadb","mise","ncp","npm","pg","prisma","react","rimraf","rolldown","tailwindcss","tsx","shadcn","vite","typescript","vitest","zod","ws","withVersions","declaration","deps","assertDeclared","ts","Object","fromEntries","map","dep","NX_PACKAGES","NX_VERSION","PY_VERSIONS","aiosqlite","boto3","checkov","fastapi","httpx","langchain","langgraph","mcp","ruff","ty","pynamodb","uvicorn","sqlmodel","alembic","aiomysql","asyncpg","greenlet","withPyVersions","py","declared","kind","names","undeclared","filter","includes","length","Error","join","VENDORED_VERSIONS","JAVA_VERSIONS","JAVA_ARTIFACTS","keys","javaMavenDependency","artifact","MISE_VERSIONS","smithy","MISE_TOOLS","BASE_IMAGES","node","python","CONTAINER_VERSIONS","trivy","CONTAINER_REPOSITORIES","containerImage","tool","TERRAFORM_VERSIONS","aws","random","null","archive","external","local","time","terraformProviderVersions","awsProviderVersion","randomProviderVersion","nullProviderVersion","archiveProviderVersion","externalProviderVersion","localProviderVersion","timeProviderVersion"],"mappings":"AAAA;;;CAGC,GACD,SAIEA,aAAa,QACR,6BAA0B;AAEjC;;CAEC,GACD,OAAO,MAAMC,cAAc;IACzB,eAAe;IACf,0DAA0D;IAC1D,yEAAyE;IACzE,uDAAuD;IACvD,oCAAoC;IACpC,0EAA0E;IAC1E,2EAA2E;IAC3E,6EAA6E;IAC7E,8EAA8E;IAC9E,kDAAkD;IAClDC,WAAW;IACX,4BAA4B;IAC5B,+BAA+B;IAC/B,uBAAuB;IACvB,qCAAqC;IACrC,mCAAmC;IACnC,sBAAsB;IACtB,uBAAuB;IACvB,iCAAiC;IACjC,iDAAiD;IACjD,mCAAmC;IACnC,uBAAuB;IACvB,6BAA6B;IAC7B,uBAAuB;IACvB,iCAAiC;IACjC,kCAAkC;IAClC,qCAAqC;IACrC,iCAAiC;IACjC,iCAAiC;IACjC,iCAAiC;IACjC,eAAe;IACf,gBAAgB;IAChB,wBAAwB;IACxB,0DAA0D;IAC1DC,IAAI;IACJ,cAAc;IACd,UAAU;IACV,aAAa;IACb,YAAY;IACZ,cAAc;IACd,iBAAiB;IACjB,uBAAuB;IACvB,sBAAsB;IACtB,aAAa;IACb,6BAA6B;IAC7B,mCAAmC;IACnC,uBAAuB;IACvB,sBAAsB;IACtB,iBAAiB;IACjB,eAAe;IACf,kBAAkB;IAClB,kBAAkB;IAClB,0BAA0B;IAC1BC,MAAM;IACN,uBAAuB;IACvB,0BAA0B;IAC1B,2BAA2B;IAC3B,8BAA8B;IAC9B,iCAAiC;IACjC,0BAA0B;IAC1B,uCAAuC;IACvC,sCAAsC;IACtC,iCAAiC;IACjC,oCAAoC;IACpC,yBAAyB;IACzB,kCAAkC;IAClC,8BAA8B;IAC9B,gBAAgB;IAChB,gBAAgB;IAChB,eAAe;IACf,qBAAqB;IACrB,eAAe;IACf,aAAa;IACb,aAAa;IACb,kBAAkB;IAClB,2BAA2B;IAC3B,gCAAgC;IAChC,6BAA6B;IAC7B,iBAAiB;IACjB,uBAAuB;IACvB,cAAc;IACd,kBAAkB;IAClB,sBAAsB;IACtBC,OAAO;IACPC,WAAW;IACX,WAAW;IACX,eAAe;IACf,qBAAqB;IACrBC,YAAY;IACZC,MAAM;IACNC,OAAO;IACP,4BAA4B;IAC5BC,MAAM;IACNC,WAAW;IACX,WAAW;IACXC,WAAW;IACXC,SAAS;IACT,yBAAyB;IACzB,gCAAgC;IAChC,kBAAkB;IAClB,2BAA2B;IAC3B,sBAAsB;IACtB,kBAAkB;IAClBC,KAAK;IACL,cAAc;IACdC,SAAS;IACT,aAAa;IACbC,OAAO;IACP,YAAY;IACZ,mBAAmB;IACnB,gBAAgB;IAChBC,SAAS;IACTC,MAAM;IACNC,KAAK;IACLC,KAAK;IACL,qBAAqB;IACrB,kBAAkB;IAClBC,IAAI;IACJC,QAAQ;IACR,sBAAsB;IACtBC,OAAO;IACP,aAAa;IACbC,QAAQ;IACRC,UAAU;IACV,uBAAuB;IACvB,cAAc;IACd,sBAAsB;IACtB,kBAAkB;IAClBC,aAAa;IACb,qBAAqB;IACrBC,KAAK;IACL,gBAAgB;IAChB,YAAY;IACZC,QAAQ;IACR,kBAAkB;IAClB,kBAAkB;IAClBC,MAAM;IACNC,YAAY;IACZC,QAAQ;IACRC,KAAK;IACLC,IAAI;AACN,EAAW;AAGX;;;;CAIC,GACD,OAAO,MAAMC,eAAe,CAC1BC,aACAC;IAEAC,eAAeF,YAAYG,EAAE,EAAEF,MAAM;IACrC,OAAOG,OAAOC,WAAW,CACvBJ,KAAKK,GAAG,CAAC,CAACC,MAAQ;YAACA;YAAKzC,WAAW,CAACyC,IAAqB;SAAC;AAE9D,EAAE;AAEF;;;;;;;CAOC,GACD,OAAO,MAAMC,cAAc;IACzB;IACA;IACA;IACA;IACA;IACA;IACA;CACD,CAA6C;AAE9C;;;CAGC,GACD,OAAO,MAAMC,aAAa3C,YAAYE,EAAE,CAAC;AAEzC;;CAEC,GACD,OAAO,MAAM0C,cAAc;IACzB,WAAW;IACX,mBAAmB;IACnB,kBAAkB;IAClB,iBAAiB;IACjBC,WAAW;IACX,yBAAyB;IACzB,iCAAiC;IACjC,iCAAiC;IACjC,4BAA4B;IAC5B,qBAAqB;IACrBC,OAAO;IACPC,SAAS;IACTC,SAAS;IACT,qBAAqB;IACrBC,OAAO;IACPC,WAAW;IACX,iBAAiB;IACjB,0BAA0B;IAC1BC,WAAW;IACX,4BAA4B;IAC5B,+BAA+B;IAC/BC,KAAK;IACL,qBAAqB;IACrB,gBAAgB;IAChBC,MAAM;IACN,kBAAkB;IAClB,uBAAuB;IACvB,wBAAwB;IACxBC,IAAI;IACJC,UAAU;IACVC,SAAS;IACTC,UAAU;IACVC,SAAS;IACTC,UAAU;IACVC,SAAS;IACT,4EAA4E;IAC5E,2EAA2E;IAC3E,4EAA4E;IAC5EC,UAAU;AACZ,EAAW;AAGX;;CAEC,GACD,OAAO,MAAMC,iBAAiB,CAC5B5B,aACAC;IAEAC,eAAeF,YAAY6B,EAAE,EAAE5B,MAAM;IACrC,OAAOA,KAAKK,GAAG,CAAC,CAACC,MAAQ,GAAGA,MAAMG,WAAW,CAACH,IAAqB,EAAE;AACvE,EAAE;AAEF,uEAAuE,GACvE,MAAML,iBAAiB,CACrB4B,UACA7B,MACA8B;IAEA,MAAMC,QAAQnE,cAAciE;IAC5B,MAAMG,aAAahC,KAAKiC,MAAM,CAAC,CAAC3B,MAAQ,CAACyB,MAAMG,QAAQ,CAAC5B;IACxD,IAAI0B,WAAWG,MAAM,GAAG,GAAG;QACzB,MAAM,IAAIC,MACR,CAAC,WAAW,EAAEN,KAAK,eAAe,EAAEE,WAAWK,IAAI,CAAC,MAAM,oDAAoD,EAAEP,KAAK,WAAW,CAAC;IAErI;AACF;AAEA;;CAEC,GACD,OAAO,MAAMQ,oBAAoB;IAC/B,eAAe;AACjB,EAAW;AAEX;;;;;CAKC,GACD,OAAO,MAAMC,gBAAgB;IAC3B,uCAAuC;IACvC,4CAA4C;IAC5C,kDAAkD;IAClD,yCAAyC;IACzC,mEAAmE;AACrE,EAAW;AAGX,6EAA6E,GAC7E,OAAO,MAAMC,iBAAiBrC,OAAOsC,IAAI,CAACF,eAAiC;AAE3E,iFAAiF,GACjF,OAAO,MAAMG,sBAAsB,CAACC,WAClC,GAAGA,SAAS,CAAC,EAAEJ,aAAa,CAACI,SAAS,EAAE,CAAC;AAE3C;;;;;;CAMC,GACD,OAAO,MAAMC,gBAAgB;IAC3BC,QAAQ;AACV,EAAW;AAGX,8EAA8E,GAC9E,OAAO,MAAMC,aAAa3C,OAAOsC,IAAI,CAACG,eAAiC;AAEvE;;;;CAIC,GACD,OAAO,MAAMG,cAAc;IACzBC,MAAM;IACNC,QAAQ;AACV,EAAW;AAEX;;;CAGC,GACD,OAAO,MAAMC,qBAAqB;IAChC,qEAAqE;IACrEC,OAAO;AACT,EAAW;AAEX;;;;;CAKC,GACD,OAAO,MAAMC,yBAAyB;IACpCD,OAAO;AACT,EAAqE;AAErE,wEAAwE,GACxE,OAAO,MAAME,iBAAiB,CAACC,OAC7B,GAAGF,sBAAsB,CAACE,KAAK,CAAC,CAAC,EAAEJ,kBAAkB,CAACI,KAAK,EAAE,CAAC;AAEhE;;;CAGC,GACD,OAAO,MAAMC,qBAAqB;IAChCC,KAAK;IACLC,QAAQ;IACRC,MAAM;IACNC,SAAS;IACTC,UAAU;IACVC,OAAO;IACPC,MAAM;AACR,EAAW;AAGX;;;CAGC,GACD,OAAO,MAAMC,4BAA4B,IAAO,CAAA;QAC9CC,oBAAoBT,mBAAmBC,GAAG;QAC1CS,uBAAuBV,mBAAmBE,MAAM;QAChDS,qBAAqBX,mBAAmBG,IAAI;QAC5CS,wBAAwBZ,mBAAmBI,OAAO;QAClDS,yBAAyBb,mBAAmBK,QAAQ;QACpDS,sBAAsBd,mBAAmBM,KAAK;QAC9CS,qBAAqBf,mBAAmBO,IAAI;IAC9C,CAAA,EAAG"}
+{"version":3,"sources":["../../../../../packages/nx-plugin/src/utils/versions.ts"],"sourcesContent":["/**\n * Copyright Amazon.com, Inc. or its affiliates. All Rights Reserved.\n * SPDX-License-Identifier: Apache-2.0\n */\nimport {\n  type DeclaredPy,\n  type DeclaredTs,\n  type DependencyDeclaration,\n  declaredNames,\n} from './declared-dependencies.js';\n\n/**\n * Versons for TypeScript dependencies added by generators\n */\nexport const TS_VERSIONS = {\n  '@a2a-js/sdk': '0.3.14',\n  '@aws/aws-distro-opentelemetry-node-autoinstrumentation': '0.12.0',\n  // Pinned above the version the ADOT autoinstrumentation package resolves\n  // transitively (2.8.0) to clear CVE-2026-59892 (HIGH).\n  '@opentelemetry/propagator-jaeger': '2.10.0',\n  // Overridden in the vended agent/MCP image builds to clear CVE-2026-14257\n  // (HIGH) in brace-expansion: minimatch 10 is the lowest major depending on\n  // brace-expansion 5.x, the only line Trivy's `< 5.0.8` advisory range treats\n  // as fixed. Overriding brace-expansion directly is not viable — 5.x drops the\n  // CommonJS default export that minimatch 9 calls.\n  minimatch: '10.2.6',\n  '@aws-sdk/client-dynamodb': '3.1111.0',\n  '@aws-sdk/client-api-gateway': '3.1111.0',\n  '@aws-sdk/client-iam': '3.1111.0',\n  '@aws-sdk/client-bedrock-agentcore': '3.1111.0',\n  '@aws-sdk/client-bedrock-runtime': '3.1111.0',\n  '@aws-sdk/client-s3': '3.1111.0',\n  '@aws-sdk/client-sts': '3.1111.0',\n  '@aws-sdk/credential-providers': '3.1111.0',\n  '@aws-sdk/credential-provider-cognito-identity': '3.972.68',\n  '@aws-sdk/client-secrets-manager': '3.1111.0',\n  '@aws-sdk/rds-signer': '3.1111.0',\n  '@smithy/server-apigateway': '0.3.3',\n  '@smithy/server-node': '0.3.3',\n  '@aws-lambda-powertools/logger': '2.34.0',\n  '@aws-lambda-powertools/metrics': '2.34.0',\n  '@aws-lambda-powertools/parameters': '2.34.0',\n  '@aws-lambda-powertools/tracer': '2.34.0',\n  '@aws-lambda-powertools/parser': '2.34.0',\n  '@aws-sdk/client-appconfigdata': '3.1111.0',\n  '@middy/core': '7.7.4',\n  '@nxlv/python': '23.0.0',\n  '@nx-extend/terraform': '10.4.1',\n  // These must all hold the same version — see NX_PACKAGES.\n  nx: '23.1.1',\n  '@nx/devkit': '23.1.1',\n  '@nx/js': '23.1.1',\n  '@nx/react': '23.1.1',\n  '@nx/vite': '23.1.1',\n  '@nx/vitest': '23.1.1',\n  '@nx/workspace': '23.1.1',\n  'create-nx-workspace': '23.1.1',\n  '@swc-node/register': '1.12.1',\n  '@swc/core': '1.16.0',\n  '@modelcontextprotocol/sdk': '1.30.0',\n  '@modelcontextprotocol/inspector': '2.2.0',\n  '@ag-ui/a2ui-toolkit': '0.0.4',\n  '@ag-ui/aws-strands': '0.2.3',\n  '@ag-ui/client': '0.0.57',\n  '@ag-ui/core': '0.0.57',\n  '@ag-ui/encoder': '0.0.57',\n  'agent-chat-cli': '0.3.0',\n  '@copilotkit/react-core': '1.68.1',\n  rxjs: '7.8.2',\n  '@strands-agents/sdk': '1.13.0',\n  '@tanstack/react-router': '1.170.29',\n  '@tanstack/router-plugin': '1.168.32',\n  '@tanstack/router-generator': '1.167.30',\n  '@tanstack/virtual-file-routes': '1.162.0',\n  '@tanstack/router-utils': '1.162.2',\n  '@cloudscape-design/board-components': '3.0.218',\n  '@cloudscape-design/chat-components': '1.0.162',\n  '@cloudscape-design/components': '3.0.1347',\n  '@cloudscape-design/global-styles': '1.0.66',\n  '@tanstack/react-query': '5.101.4',\n  '@tanstack/react-query-devtools': '5.101.4',\n  '@trpc/tanstack-react-query': '11.18.0',\n  '@trpc/client': '11.18.0',\n  '@trpc/server': '11.18.0',\n  '@types/node': '26.2.0',\n  '@types/aws-lambda': '8.10.162',\n  '@types/cors': '2.8.19',\n  '@types/pg': '8.21.0',\n  '@types/ws': '8.18.1',\n  '@types/express': '5.0.6',\n  '@smithy/config-resolver': '4.7.2',\n  '@smithy/node-config-provider': '4.6.2',\n  '@smithy/node-http-handler': '4.11.2',\n  '@smithy/types': '4.17.2',\n  '@vitest/coverage-v8': '4.1.10',\n  '@vitest/ui': '4.1.10',\n  '@astrojs/react': '6.0.2',\n  '@astrojs/starlight': '0.41.7',\n  astro: '7.1.1',\n  aws4fetch: '1.0.20',\n  'aws-cdk': '2.1136.0',\n  'aws-cdk-lib': '2.265.0',\n  'aws-xray-sdk-core': '3.12.0',\n  constructs: '10.8.1',\n  cors: '2.8.6',\n  chalk: '6.0.0',\n  'class-variance-authority': '0.7.1',\n  clsx: '2.1.1',\n  commander: '15.0.0',\n  'cpy-cli': '7.0.0',\n  electrodb: '3.9.3',\n  esbuild: '0.28.2',\n  'event-source-polyfill': '1.0.31',\n  '@types/event-source-polyfill': '1.0.5',\n  '@biomejs/biome': '2.5.8',\n  '@prisma/adapter-mariadb': '7.9.1',\n  '@prisma/adapter-pg': '7.9.1',\n  '@prisma/client': '7.9.1',\n  ejs: '6.0.1',\n  '@types/ejs': '3.1.5',\n  express: '5.2.1',\n  'fast-glob': '3.3.3',\n  husky: '9.1.7',\n  'fs-extra': '11.4.0',\n  '@types/fs-extra': '11.0.4',\n  'make-dir-cli': '4.0.0',\n  mariadb: '3.5.3',\n  mise: '2026.8.6',\n  ncp: '2.0.0',\n  npm: '12.0.2',\n  'npm-check-updates': '23.0.2',\n  'oidc-client-ts': '3.5.0',\n  pg: '8.23.0',\n  prisma: '7.9.1',\n  'react-oidc-context': '3.3.1',\n  react: '19.2.8',\n  'react-dom': '19.2.8',\n  rimraf: '6.1.3',\n  rolldown: '1.2.4',\n  'rolldown-plugin-dts': '0.28.2',\n  'simple-git': '3.36.0',\n  'source-map-support': '0.5.21',\n  'starlight-blog': '0.28.0',\n  tailwindcss: '4.3.3',\n  '@tailwindcss/vite': '4.3.3',\n  tsx: '4.23.12',\n  'lucide-react': '1.31.0',\n  'radix-ui': '1.6.7',\n  shadcn: '4.18.0',\n  'tw-animate-css': '1.4.0',\n  'tailwind-merge': '3.6.0',\n  vite: '8.2.1',\n  typescript: '6.0.3',\n  vitest: '4.1.10',\n  zod: '4.4.3',\n  ws: '8.21.3',\n} as const;\nexport type ITsDepVersion = keyof typeof TS_VERSIONS;\n\n/**\n * Add versions to the given dependencies, which the declaration must own.\n *\n * @param declaration the calling generator's `DEPENDENCIES`\n */\nexport const withVersions = <D extends DependencyDeclaration>(\n  declaration: D,\n  deps: readonly DeclaredTs<D>[],\n): Record<string, string> => {\n  assertDeclared(declaration.ts, deps, 'ts');\n  return Object.fromEntries(\n    deps.map((dep) => [dep, TS_VERSIONS[dep as ITsDepVersion]]),\n  );\n};\n\n/**\n * The `nx` and `@nx/*` packages a generated workspace pins, all of which must\n * hold the same version: a workspace nx even a patch apart hoists a second\n * nested nx, and the two deadlock `nx sync`.\n *\n * Bumping them in a user's workspace requires `packageJsonUpdates` rather than a\n * migration — see `version-upgrade-migration/nx-package-updates.ts`.\n */\nexport const NX_PACKAGES = [\n  'nx',\n  '@nx/devkit',\n  '@nx/js',\n  '@nx/react',\n  '@nx/vite',\n  '@nx/vitest',\n  '@nx/workspace',\n] as const satisfies readonly ITsDepVersion[];\n\n/**\n * The nx version the plugin is built against, and the single source of truth\n * for every place a workspace's nx is pinned.\n */\nexport const NX_VERSION = TS_VERSIONS.nx;\n\n/**\n * Versions for Python dependencies added by generators\n */\nexport const PY_VERSIONS = {\n  'a2a-sdk': '==0.3.26',\n  'ag-ui-langgraph': '==0.0.43',\n  'ag-ui-protocol': '==0.1.20',\n  'ag-ui-strands': '==0.3.0',\n  aiosqlite: '==0.22.1',\n  'aws-lambda-powertools': '==3.34.0',\n  'aws-lambda-powertools[tracer]': '==3.34.0',\n  'aws-lambda-powertools[parser]': '==3.34.0',\n  'aws-opentelemetry-distro': '==0.19.0',\n  'bedrock-agentcore': '==1.21.0',\n  boto3: '==1.43.72',\n  checkov: '==3.3.11',\n  fastapi: '==0.141.1',\n  'fastapi[standard]': '==0.141.1',\n  httpx: '==0.28.1',\n  langchain: '==1.3.15',\n  'langchain-aws': '==1.7.1',\n  'langchain-mcp-adapters': '==0.3.2',\n  langgraph: '==1.2.11',\n  'langgraph-checkpoint-aws': '==1.2.2',\n  'langgraph-checkpoint-sqlite': '==3.1.1',\n  mcp: '==1.28.1',\n  'pip-check-updates': '==0.29.0',\n  'pip-licenses': '==5.5.5',\n  ruff: '==0.16.3',\n  'strands-agents': '==1.52.0',\n  'strands-agents[a2a]': '==1.52.0',\n  'strands-agents-tools': '==0.8.6',\n  ty: '==0.0.72',\n  pynamodb: '==6.1.0',\n  uvicorn: '==0.52.3',\n  sqlmodel: '==0.0.39',\n  alembic: '==1.19.1',\n  aiomysql: '==0.3.2',\n  asyncpg: '==0.31.0',\n  // Pinned explicitly: SQLAlchemy's async engine pulls greenlet transitively,\n  // and leaving it unpinned lets uv resolve to a just-released version whose\n  // platform wheels may not all be published yet (breaking aarch64 installs).\n  greenlet: '==3.5.5',\n} as const;\nexport type IPyDepVersion = keyof typeof PY_VERSIONS;\n\n/**\n * Add versions to the given dependencies\n */\nexport const withPyVersions = <D extends DependencyDeclaration>(\n  declaration: D,\n  deps: readonly DeclaredPy<D>[],\n): string[] => {\n  assertDeclared(declaration.py, deps, 'py');\n  return deps.map((dep) => `${dep}${PY_VERSIONS[dep as IPyDepVersion]}`);\n};\n\n/** Catches undeclared packages that reach here past the type checker. */\nconst assertDeclared = (\n  declared: readonly { readonly name: string }[],\n  deps: readonly unknown[],\n  kind: 'ts' | 'py',\n): void => {\n  const names = declaredNames(declared);\n  const undeclared = deps.filter((dep) => !names.includes(dep as string));\n  if (undeclared.length > 0) {\n    throw new Error(\n      `Undeclared ${kind} dependencies: ${undeclared.join(', ')}. Add them to the generator's declareDependencies({ ${kind}: [...] }).`,\n    );\n  }\n};\n\n/**\n * Versions for vendored tools\n */\nexport const VENDORED_VERSIONS = {\n  'git-secrets': '1.3.0',\n} as const;\n\n/**\n * Versions of Java dependencies added by generators, keyed by Maven coordinate.\n *\n * Every entry is resolved from Maven Central by the version update and named\n * `<group>:<artifact>:<version>` where a generator writes it.\n */\nexport const JAVA_VERSIONS = {\n  'software.amazon.smithy:smithy-model': '1.73.0',\n  'software.amazon.smithy:smithy-aws-traits': '1.73.0',\n  'software.amazon.smithy:smithy-validation-model': '1.73.0',\n  'software.amazon.smithy:smithy-openapi': '1.73.0',\n  'software.amazon.smithy.typescript:smithy-aws-typescript-codegen': '0.52.0',\n} as const;\nexport type IJavaVersion = keyof typeof JAVA_VERSIONS;\n\n/** The Maven coordinates the version update resolves, in declaration order. */\nexport const JAVA_ARTIFACTS = Object.keys(JAVA_VERSIONS) as IJavaVersion[];\n\n/** A Maven coordinate as a dependency names it: `<group>:<artifact>:<version>`. */\nexport const javaMavenDependency = (artifact: IJavaVersion): string =>\n  `${artifact}:${JAVA_VERSIONS[artifact]}`;\n\n/**\n * Versions of tools resolved by mise, keyed by the tool name mise knows.\n *\n * Every entry is checked with `mise latest <tool>` by the version update. Nothing\n * is installed into the workspace: the pin travels in the `project.json` target\n * command, which is what the version sync reaches to move it forward.\n */\nexport const MISE_VERSIONS = {\n  smithy: '1.73.0',\n} as const;\nexport type IMiseVersion = keyof typeof MISE_VERSIONS;\n\n/** The tools the version update resolves through mise, in declaration order. */\nexport const MISE_TOOLS = Object.keys(MISE_VERSIONS) as IMiseVersion[];\n\n/**\n * Base container images used by generated Dockerfiles. Pinned exactly so\n * generated images are reproducible, and chosen to be free of known\n * HIGH/CRITICAL vulnerabilities at time of generation.\n */\nexport const BASE_IMAGES = {\n  node: 'public.ecr.aws/docker/library/node:lts-slim',\n  python: 'public.ecr.aws/docker/library/python:3.14-slim',\n} as const;\n\n/**\n * Versions for container tooling used by generated image build/scan targets.\n * Pinned exactly so generated images are reproducible.\n */\nexport const CONTAINER_VERSIONS = {\n  // ECR-hosted Trivy image used to scan built images during the build.\n  trivy: '0.72.0',\n} as const;\n\n/**\n * Repository each pinned tool image is pulled from, keyed as\n * {@link CONTAINER_VERSIONS}. Kept beside the versions so a tool added here is\n * one entry rather than a reference built somewhere else, which is also what\n * lets the version sync find these pins wherever a target command runs them.\n */\nexport const CONTAINER_REPOSITORIES = {\n  trivy: 'public.ecr.aws/aquasecurity/trivy',\n} as const satisfies Record<keyof typeof CONTAINER_VERSIONS, string>;\n\n/** The pinned reference for a tool image, as a target command runs it. */\nexport const containerImage = (tool: keyof typeof CONTAINER_VERSIONS): string =>\n  `${CONTAINER_REPOSITORIES[tool]}:${CONTAINER_VERSIONS[tool]}`;\n\n/**\n * Exact versions for Terraform providers used by generated `.tf` modules.\n * Pinned exactly (no range operator) so generated infrastructure is reproducible.\n */\nexport const TERRAFORM_VERSIONS = {\n  aws: '6.60.0',\n  random: '3.9.0',\n  null: '3.3.1',\n  archive: '2.8.0',\n  external: '2.4.1',\n  local: '2.9.0',\n  time: '0.14.1',\n} as const;\nexport type ITerraformProviderVersion = keyof typeof TERRAFORM_VERSIONS;\n\n/**\n * Substitution variables exposing Terraform provider version constraints to\n * generated `.tf` templates (e.g. `version = \"<%- awsProviderVersion %>\"`)\n */\nexport const terraformProviderVersions = () => ({\n  awsProviderVersion: TERRAFORM_VERSIONS.aws,\n  randomProviderVersion: TERRAFORM_VERSIONS.random,\n  nullProviderVersion: TERRAFORM_VERSIONS.null,\n  archiveProviderVersion: TERRAFORM_VERSIONS.archive,\n  externalProviderVersion: TERRAFORM_VERSIONS.external,\n  localProviderVersion: TERRAFORM_VERSIONS.local,\n  timeProviderVersion: TERRAFORM_VERSIONS.time,\n});\n"],"names":["declaredNames","TS_VERSIONS","minimatch","nx","rxjs","astro","aws4fetch","constructs","cors","chalk","clsx","commander","electrodb","esbuild","ejs","express","husky","mariadb","mise","ncp","npm","pg","prisma","react","rimraf","rolldown","tailwindcss","tsx","shadcn","vite","typescript","vitest","zod","ws","withVersions","declaration","deps","assertDeclared","ts","Object","fromEntries","map","dep","NX_PACKAGES","NX_VERSION","PY_VERSIONS","aiosqlite","boto3","checkov","fastapi","httpx","langchain","langgraph","mcp","ruff","ty","pynamodb","uvicorn","sqlmodel","alembic","aiomysql","asyncpg","greenlet","withPyVersions","py","declared","kind","names","undeclared","filter","includes","length","Error","join","VENDORED_VERSIONS","JAVA_VERSIONS","JAVA_ARTIFACTS","keys","javaMavenDependency","artifact","MISE_VERSIONS","smithy","MISE_TOOLS","BASE_IMAGES","node","python","CONTAINER_VERSIONS","trivy","CONTAINER_REPOSITORIES","containerImage","tool","TERRAFORM_VERSIONS","aws","random","null","archive","external","local","time","terraformProviderVersions","awsProviderVersion","randomProviderVersion","nullProviderVersion","archiveProviderVersion","externalProviderVersion","localProviderVersion","timeProviderVersion"],"mappings":"AAAA;;;CAGC,GACD,SAIEA,aAAa,QACR,6BAA6B;AAEpC;;CAEC,GACD,OAAO,MAAMC,cAAc;IACzB,eAAe;IACf,0DAA0D;IAC1D,yEAAyE;IACzE,uDAAuD;IACvD,oCAAoC;IACpC,0EAA0E;IAC1E,2EAA2E;IAC3E,6EAA6E;IAC7E,8EAA8E;IAC9E,kDAAkD;IAClDC,WAAW;IACX,4BAA4B;IAC5B,+BAA+B;IAC/B,uBAAuB;IACvB,qCAAqC;IACrC,mCAAmC;IACnC,sBAAsB;IACtB,uBAAuB;IACvB,iCAAiC;IACjC,iDAAiD;IACjD,mCAAmC;IACnC,uBAAuB;IACvB,6BAA6B;IAC7B,uBAAuB;IACvB,iCAAiC;IACjC,kCAAkC;IAClC,qCAAqC;IACrC,iCAAiC;IACjC,iCAAiC;IACjC,iCAAiC;IACjC,eAAe;IACf,gBAAgB;IAChB,wBAAwB;IACxB,0DAA0D;IAC1DC,IAAI;IACJ,cAAc;IACd,UAAU;IACV,aAAa;IACb,YAAY;IACZ,cAAc;IACd,iBAAiB;IACjB,uBAAuB;IACvB,sBAAsB;IACtB,aAAa;IACb,6BAA6B;IAC7B,mCAAmC;IACnC,uBAAuB;IACvB,sBAAsB;IACtB,iBAAiB;IACjB,eAAe;IACf,kBAAkB;IAClB,kBAAkB;IAClB,0BAA0B;IAC1BC,MAAM;IACN,uBAAuB;IACvB,0BAA0B;IAC1B,2BAA2B;IAC3B,8BAA8B;IAC9B,iCAAiC;IACjC,0BAA0B;IAC1B,uCAAuC;IACvC,sCAAsC;IACtC,iCAAiC;IACjC,oCAAoC;IACpC,yBAAyB;IACzB,kCAAkC;IAClC,8BAA8B;IAC9B,gBAAgB;IAChB,gBAAgB;IAChB,eAAe;IACf,qBAAqB;IACrB,eAAe;IACf,aAAa;IACb,aAAa;IACb,kBAAkB;IAClB,2BAA2B;IAC3B,gCAAgC;IAChC,6BAA6B;IAC7B,iBAAiB;IACjB,uBAAuB;IACvB,cAAc;IACd,kBAAkB;IAClB,sBAAsB;IACtBC,OAAO;IACPC,WAAW;IACX,WAAW;IACX,eAAe;IACf,qBAAqB;IACrBC,YAAY;IACZC,MAAM;IACNC,OAAO;IACP,4BAA4B;IAC5BC,MAAM;IACNC,WAAW;IACX,WAAW;IACXC,WAAW;IACXC,SAAS;IACT,yBAAyB;IACzB,gCAAgC;IAChC,kBAAkB;IAClB,2BAA2B;IAC3B,sBAAsB;IACtB,kBAAkB;IAClBC,KAAK;IACL,cAAc;IACdC,SAAS;IACT,aAAa;IACbC,OAAO;IACP,YAAY;IACZ,mBAAmB;IACnB,gBAAgB;IAChBC,SAAS;IACTC,MAAM;IACNC,KAAK;IACLC,KAAK;IACL,qBAAqB;IACrB,kBAAkB;IAClBC,IAAI;IACJC,QAAQ;IACR,sBAAsB;IACtBC,OAAO;IACP,aAAa;IACbC,QAAQ;IACRC,UAAU;IACV,uBAAuB;IACvB,cAAc;IACd,sBAAsB;IACtB,kBAAkB;IAClBC,aAAa;IACb,qBAAqB;IACrBC,KAAK;IACL,gBAAgB;IAChB,YAAY;IACZC,QAAQ;IACR,kBAAkB;IAClB,kBAAkB;IAClBC,MAAM;IACNC,YAAY;IACZC,QAAQ;IACRC,KAAK;IACLC,IAAI;AACN,EAAW;AAGX;;;;CAIC,GACD,OAAO,MAAMC,eAAe,CAC1BC,aACAC;IAEAC,eAAeF,YAAYG,EAAE,EAAEF,MAAM;IACrC,OAAOG,OAAOC,WAAW,CACvBJ,KAAKK,GAAG,CAAC,CAACC,MAAQ;YAACA;YAAKzC,WAAW,CAACyC,IAAqB;SAAC;AAE9D,EAAE;AAEF;;;;;;;CAOC,GACD,OAAO,MAAMC,cAAc;IACzB;IACA;IACA;IACA;IACA;IACA;IACA;CACD,CAA6C;AAE9C;;;CAGC,GACD,OAAO,MAAMC,aAAa3C,YAAYE,EAAE,CAAC;AAEzC;;CAEC,GACD,OAAO,MAAM0C,cAAc;IACzB,WAAW;IACX,mBAAmB;IACnB,kBAAkB;IAClB,iBAAiB;IACjBC,WAAW;IACX,yBAAyB;IACzB,iCAAiC;IACjC,iCAAiC;IACjC,4BAA4B;IAC5B,qBAAqB;IACrBC,OAAO;IACPC,SAAS;IACTC,SAAS;IACT,qBAAqB;IACrBC,OAAO;IACPC,WAAW;IACX,iBAAiB;IACjB,0BAA0B;IAC1BC,WAAW;IACX,4BAA4B;IAC5B,+BAA+B;IAC/BC,KAAK;IACL,qBAAqB;IACrB,gBAAgB;IAChBC,MAAM;IACN,kBAAkB;IAClB,uBAAuB;IACvB,wBAAwB;IACxBC,IAAI;IACJC,UAAU;IACVC,SAAS;IACTC,UAAU;IACVC,SAAS;IACTC,UAAU;IACVC,SAAS;IACT,4EAA4E;IAC5E,2EAA2E;IAC3E,4EAA4E;IAC5EC,UAAU;AACZ,EAAW;AAGX;;CAEC,GACD,OAAO,MAAMC,iBAAiB,CAC5B5B,aACAC;IAEAC,eAAeF,YAAY6B,EAAE,EAAE5B,MAAM;IACrC,OAAOA,KAAKK,GAAG,CAAC,CAACC,MAAQ,GAAGA,MAAMG,WAAW,CAACH,IAAqB,EAAE;AACvE,EAAE;AAEF,uEAAuE,GACvE,MAAML,iBAAiB,CACrB4B,UACA7B,MACA8B;IAEA,MAAMC,QAAQnE,cAAciE;IAC5B,MAAMG,aAAahC,KAAKiC,MAAM,CAAC,CAAC3B,MAAQ,CAACyB,MAAMG,QAAQ,CAAC5B;IACxD,IAAI0B,WAAWG,MAAM,GAAG,GAAG;QACzB,MAAM,IAAIC,MACR,CAAC,WAAW,EAAEN,KAAK,eAAe,EAAEE,WAAWK,IAAI,CAAC,MAAM,oDAAoD,EAAEP,KAAK,WAAW,CAAC;IAErI;AACF;AAEA;;CAEC,GACD,OAAO,MAAMQ,oBAAoB;IAC/B,eAAe;AACjB,EAAW;AAEX;;;;;CAKC,GACD,OAAO,MAAMC,gBAAgB;IAC3B,uCAAuC;IACvC,4CAA4C;IAC5C,kDAAkD;IAClD,yCAAyC;IACzC,mEAAmE;AACrE,EAAW;AAGX,6EAA6E,GAC7E,OAAO,MAAMC,iBAAiBrC,OAAOsC,IAAI,CAACF,eAAiC;AAE3E,iFAAiF,GACjF,OAAO,MAAMG,sBAAsB,CAACC,WAClC,GAAGA,SAAS,CAAC,EAAEJ,aAAa,CAACI,SAAS,EAAE,CAAC;AAE3C;;;;;;CAMC,GACD,OAAO,MAAMC,gBAAgB;IAC3BC,QAAQ;AACV,EAAW;AAGX,8EAA8E,GAC9E,OAAO,MAAMC,aAAa3C,OAAOsC,IAAI,CAACG,eAAiC;AAEvE;;;;CAIC,GACD,OAAO,MAAMG,cAAc;IACzBC,MAAM;IACNC,QAAQ;AACV,EAAW;AAEX;;;CAGC,GACD,OAAO,MAAMC,qBAAqB;IAChC,qEAAqE;IACrEC,OAAO;AACT,EAAW;AAEX;;;;;CAKC,GACD,OAAO,MAAMC,yBAAyB;IACpCD,OAAO;AACT,EAAqE;AAErE,wEAAwE,GACxE,OAAO,MAAME,iBAAiB,CAACC,OAC7B,GAAGF,sBAAsB,CAACE,KAAK,CAAC,CAAC,EAAEJ,kBAAkB,CAACI,KAAK,EAAE,CAAC;AAEhE;;;CAGC,GACD,OAAO,MAAMC,qBAAqB;IAChCC,KAAK;IACLC,QAAQ;IACRC,MAAM;IACNC,SAAS;IACTC,UAAU;IACVC,OAAO;IACPC,MAAM;AACR,EAAW;AAGX;;;CAGC,GACD,OAAO,MAAMC,4BAA4B,IAAO,CAAA;QAC9CC,oBAAoBT,mBAAmBC,GAAG;QAC1CS,uBAAuBV,mBAAmBE,MAAM;QAChDS,qBAAqBX,mBAAmBG,IAAI;QAC5CS,wBAAwBZ,mBAAmBI,OAAO;QAClDS,yBAAyBb,mBAAmBK,QAAQ;QACpDS,sBAAsBd,mBAAmBM,KAAK;QAC9CS,qBAAqBf,mBAAmBO,IAAI;IAC9C,CAAA,EAAG"}

package/src/utils/website-constructs/website-constructs.d.ts

@@ -3,8 +3,8 @@
  * SPDX-License-Identifier: Apache-2.0
  */
 import { type Tree } from '@nx/devkit';
-import type { Iac } from '../iac';
-import { type IacMetadata } from '../shared-constructs-constants';
+import type { Iac } from '../iac.js';
+import { type IacMetadata } from '../shared-constructs-constants.js';
 /**
  * Python version the generated Terraform pins in the static website module's
  * inline `uv run --with` scripts, which upload the site's assets. Nothing

package/src/utils/website-constructs/website-constructs.js.map

@@ -1 +1 @@
-{"version":3,"sources":["../../../../../../packages/nx-plugin/src/utils/website-constructs/website-constructs.ts"],"sourcesContent":["/**\n * Copyright Amazon.com, Inc. or its affiliates. All Rights Reserved.\n * SPDX-License-Identifier: Apache-2.0\n */\nimport {\n  generateFiles,\n  joinPathFragments,\n  OverwriteStrategy,\n  type ProjectConfiguration,\n  type Tree,\n  updateJson,\n} from '@nx/devkit';\nimport { addStarExport } from '../ast';\nimport type { DeclaredPyDependency } from '../declared-dependencies';\nimport type { Iac } from '../iac';\nimport { esmVars } from '../module-format';\nimport { addDependencyToTargetIfNotPresent } from '../nx';\nimport {\n  generatedTerraform,\n  type IacMetadata,\n  PACKAGES_DIR,\n  SHARED_CONSTRUCTS_DIR,\n  SHARED_TERRAFORM_DIR,\n} from '../shared-constructs-constants';\nimport {\n  type IPyDepVersion,\n  PY_VERSIONS,\n  terraformProviderVersions,\n} from '../versions';\n\n/**\n * Python version the generated Terraform pins in the static website module's\n * inline `uv run --with` scripts, which upload the site's assets. Nothing\n * installs it, so it is declared for its version alone, and only on the\n * Terraform branch that writes the scripts.\n */\nexport const WEBSITE_CONSTRUCTS_PY_DEPENDENCIES = [\n  { name: 'boto3', when: generatedTerraform },\n] as const satisfies readonly DeclaredPyDependency<\n  IPyDepVersion,\n  IacMetadata\n>[];\n\nexport interface AddWebsiteInfraOptions {\n  websiteProjectName: string;\n  scopeAlias: string;\n  websiteContentPath: string;\n  websiteNameKebabCase: string;\n  websiteNameClassName: string;\n}\n\n/**\n * Add infrastructure for a static website\n */\nexport const addWebsiteInfra = async (\n  tree: Tree,\n  options: AddWebsiteInfraOptions & { iac: Iac },\n) => {\n  if (options.iac === 'cdk') {\n    await addWebsiteCdkConstructs(tree, options);\n  } else if (options.iac === 'terraform') {\n    addWebsiteTerraformModules(tree, options);\n  } else {\n    throw new Error(`Unsupported iac ${options.iac}`);\n  }\n\n  updateJson(\n    tree,\n    joinPathFragments(\n      PACKAGES_DIR,\n      options.iac === 'cdk' ? SHARED_CONSTRUCTS_DIR : SHARED_TERRAFORM_DIR,\n      'project.json',\n    ),\n    (config: ProjectConfiguration) => {\n      addDependencyToTargetIfNotPresent(\n        config,\n        'build',\n        `${options.websiteProjectName}:build`,\n      );\n      return config;\n    },\n  );\n};\n\nconst addWebsiteCdkConstructs = async (\n  tree: Tree,\n  options: AddWebsiteInfraOptions,\n) => {\n  generateFiles(\n    tree,\n    joinPathFragments(import.meta.dirname, 'files', 'cdk', 'core'),\n    joinPathFragments(PACKAGES_DIR, SHARED_CONSTRUCTS_DIR, 'src', 'core'),\n    { ...options, ...esmVars(tree) },\n    {\n      overwriteStrategy: OverwriteStrategy.KeepExisting,\n    },\n  );\n\n  generateFiles(\n    tree,\n    joinPathFragments(import.meta.dirname, 'files', 'cdk', 'app'),\n    joinPathFragments(PACKAGES_DIR, SHARED_CONSTRUCTS_DIR, 'src', 'app'),\n    { ...options, ...esmVars(tree) },\n    {\n      overwriteStrategy: OverwriteStrategy.KeepExisting,\n    },\n  );\n\n  await addStarExport(\n    tree,\n    joinPathFragments(\n      PACKAGES_DIR,\n      SHARED_CONSTRUCTS_DIR,\n      'src',\n      'app',\n      'index.ts',\n    ),\n    './static-websites/index.js',\n  );\n  await addStarExport(\n    tree,\n    joinPathFragments(\n      PACKAGES_DIR,\n      SHARED_CONSTRUCTS_DIR,\n      'src',\n      'app',\n      'static-websites',\n      'index.ts',\n    ),\n    `./${options.websiteNameKebabCase}.js`,\n  );\n  await addStarExport(\n    tree,\n    joinPathFragments(\n      PACKAGES_DIR,\n      SHARED_CONSTRUCTS_DIR,\n      'src',\n      'core',\n      'index.ts',\n    ),\n    './static-website.js',\n  );\n};\n\nconst addWebsiteTerraformModules = (\n  tree: Tree,\n  options: AddWebsiteInfraOptions,\n) => {\n  generateFiles(\n    tree,\n    joinPathFragments(import.meta.dirname, 'files', 'terraform', 'core'),\n    joinPathFragments(PACKAGES_DIR, SHARED_TERRAFORM_DIR, 'src', 'core'),\n    {\n      ...options,\n      boto3Version: PY_VERSIONS.boto3,\n      ...terraformProviderVersions(),\n    },\n    {\n      overwriteStrategy: OverwriteStrategy.KeepExisting,\n    },\n  );\n\n  generateFiles(\n    tree,\n    joinPathFragments(import.meta.dirname, 'files', 'terraform', 'app'),\n    joinPathFragments(PACKAGES_DIR, SHARED_TERRAFORM_DIR, 'src', 'app'),\n    { ...options, ...terraformProviderVersions() },\n    {\n      overwriteStrategy: OverwriteStrategy.KeepExisting,\n    },\n  );\n};\n"],"names":["generateFiles","joinPathFragments","OverwriteStrategy","updateJson","addStarExport","esmVars","addDependencyToTargetIfNotPresent","generatedTerraform","PACKAGES_DIR","SHARED_CONSTRUCTS_DIR","SHARED_TERRAFORM_DIR","PY_VERSIONS","terraformProviderVersions","WEBSITE_CONSTRUCTS_PY_DEPENDENCIES","name","when","addWebsiteInfra","tree","options","iac","addWebsiteCdkConstructs","addWebsiteTerraformModules","Error","config","websiteProjectName","dirname","overwriteStrategy","KeepExisting","websiteNameKebabCase","boto3Version","boto3"],"mappings":"AAAA;;;CAGC,GACD,SACEA,aAAa,EACbC,iBAAiB,EACjBC,iBAAiB,EAGjBC,UAAU,QACL,aAAa;AACpB,SAASC,aAAa,QAAQ,YAAS;AAGvC,SAASC,OAAO,QAAQ,sBAAmB;AAC3C,SAASC,iCAAiC,QAAQ,WAAQ;AAC1D,SACEC,kBAAkB,EAElBC,YAAY,EACZC,qBAAqB,EACrBC,oBAAoB,QACf,oCAAiC;AACxC,SAEEC,WAAW,EACXC,yBAAyB,QACpB,iBAAc;AAErB;;;;;CAKC,GACD,OAAO,MAAMC,qCAAqC;IAChD;QAAEC,MAAM;QAASC,MAAMR;IAAmB;CAC3C,CAGG;AAUJ;;CAEC,GACD,OAAO,MAAMS,kBAAkB,OAC7BC,MACAC;IAEA,IAAIA,QAAQC,GAAG,KAAK,OAAO;QACzB,MAAMC,wBAAwBH,MAAMC;IACtC,OAAO,IAAIA,QAAQC,GAAG,KAAK,aAAa;QACtCE,2BAA2BJ,MAAMC;IACnC,OAAO;QACL,MAAM,IAAII,MAAM,CAAC,gBAAgB,EAAEJ,QAAQC,GAAG,EAAE;IAClD;IAEAhB,WACEc,MACAhB,kBACEO,cACAU,QAAQC,GAAG,KAAK,QAAQV,wBAAwBC,sBAChD,iBAEF,CAACa;QACCjB,kCACEiB,QACA,SACA,GAAGL,QAAQM,kBAAkB,CAAC,MAAM,CAAC;QAEvC,OAAOD;IACT;AAEJ,EAAE;AAEF,MAAMH,0BAA0B,OAC9BH,MACAC;IAEAlB,cACEiB,MACAhB,kBAAkB,YAAYwB,OAAO,EAAE,SAAS,OAAO,SACvDxB,kBAAkBO,cAAcC,uBAAuB,OAAO,SAC9D;QAAE,GAAGS,OAAO;QAAE,GAAGb,QAAQY,KAAK;IAAC,GAC/B;QACES,mBAAmBxB,kBAAkByB,YAAY;IACnD;IAGF3B,cACEiB,MACAhB,kBAAkB,YAAYwB,OAAO,EAAE,SAAS,OAAO,QACvDxB,kBAAkBO,cAAcC,uBAAuB,OAAO,QAC9D;QAAE,GAAGS,OAAO;QAAE,GAAGb,QAAQY,KAAK;IAAC,GAC/B;QACES,mBAAmBxB,kBAAkByB,YAAY;IACnD;IAGF,MAAMvB,cACJa,MACAhB,kBACEO,cACAC,uBACA,OACA,OACA,aAEF;IAEF,MAAML,cACJa,MACAhB,kBACEO,cACAC,uBACA,OACA,OACA,mBACA,aAEF,CAAC,EAAE,EAAES,QAAQU,oBAAoB,CAAC,GAAG,CAAC;IAExC,MAAMxB,cACJa,MACAhB,kBACEO,cACAC,uBACA,OACA,QACA,aAEF;AAEJ;AAEA,MAAMY,6BAA6B,CACjCJ,MACAC;IAEAlB,cACEiB,MACAhB,kBAAkB,YAAYwB,OAAO,EAAE,SAAS,aAAa,SAC7DxB,kBAAkBO,cAAcE,sBAAsB,OAAO,SAC7D;QACE,GAAGQ,OAAO;QACVW,cAAclB,YAAYmB,KAAK;QAC/B,GAAGlB,2BAA2B;IAChC,GACA;QACEc,mBAAmBxB,kBAAkByB,YAAY;IACnD;IAGF3B,cACEiB,MACAhB,kBAAkB,YAAYwB,OAAO,EAAE,SAAS,aAAa,QAC7DxB,kBAAkBO,cAAcE,sBAAsB,OAAO,QAC7D;QAAE,GAAGQ,OAAO;QAAE,GAAGN,2BAA2B;IAAC,GAC7C;QACEc,mBAAmBxB,kBAAkByB,YAAY;IACnD;AAEJ"}
+{"version":3,"sources":["../../../../../../packages/nx-plugin/src/utils/website-constructs/website-constructs.ts"],"sourcesContent":["/**\n * Copyright Amazon.com, Inc. or its affiliates. All Rights Reserved.\n * SPDX-License-Identifier: Apache-2.0\n */\nimport {\n  generateFiles,\n  joinPathFragments,\n  OverwriteStrategy,\n  type ProjectConfiguration,\n  type Tree,\n  updateJson,\n} from '@nx/devkit';\nimport { addStarExport } from '../ast.js';\nimport type { DeclaredPyDependency } from '../declared-dependencies.js';\nimport type { Iac } from '../iac.js';\nimport { esmVars } from '../module-format.js';\nimport { addDependencyToTargetIfNotPresent } from '../nx.js';\nimport {\n  generatedTerraform,\n  type IacMetadata,\n  PACKAGES_DIR,\n  SHARED_CONSTRUCTS_DIR,\n  SHARED_TERRAFORM_DIR,\n} from '../shared-constructs-constants.js';\nimport {\n  type IPyDepVersion,\n  PY_VERSIONS,\n  terraformProviderVersions,\n} from '../versions.js';\n\n/**\n * Python version the generated Terraform pins in the static website module's\n * inline `uv run --with` scripts, which upload the site's assets. Nothing\n * installs it, so it is declared for its version alone, and only on the\n * Terraform branch that writes the scripts.\n */\nexport const WEBSITE_CONSTRUCTS_PY_DEPENDENCIES = [\n  { name: 'boto3', when: generatedTerraform },\n] as const satisfies readonly DeclaredPyDependency<\n  IPyDepVersion,\n  IacMetadata\n>[];\n\nexport interface AddWebsiteInfraOptions {\n  websiteProjectName: string;\n  scopeAlias: string;\n  websiteContentPath: string;\n  websiteNameKebabCase: string;\n  websiteNameClassName: string;\n}\n\n/**\n * Add infrastructure for a static website\n */\nexport const addWebsiteInfra = async (\n  tree: Tree,\n  options: AddWebsiteInfraOptions & { iac: Iac },\n) => {\n  if (options.iac === 'cdk') {\n    await addWebsiteCdkConstructs(tree, options);\n  } else if (options.iac === 'terraform') {\n    addWebsiteTerraformModules(tree, options);\n  } else {\n    throw new Error(`Unsupported iac ${options.iac}`);\n  }\n\n  updateJson(\n    tree,\n    joinPathFragments(\n      PACKAGES_DIR,\n      options.iac === 'cdk' ? SHARED_CONSTRUCTS_DIR : SHARED_TERRAFORM_DIR,\n      'project.json',\n    ),\n    (config: ProjectConfiguration) => {\n      addDependencyToTargetIfNotPresent(\n        config,\n        'build',\n        `${options.websiteProjectName}:build`,\n      );\n      return config;\n    },\n  );\n};\n\nconst addWebsiteCdkConstructs = async (\n  tree: Tree,\n  options: AddWebsiteInfraOptions,\n) => {\n  generateFiles(\n    tree,\n    joinPathFragments(import.meta.dirname, 'files', 'cdk', 'core'),\n    joinPathFragments(PACKAGES_DIR, SHARED_CONSTRUCTS_DIR, 'src', 'core'),\n    { ...options, ...esmVars(tree) },\n    {\n      overwriteStrategy: OverwriteStrategy.KeepExisting,\n    },\n  );\n\n  generateFiles(\n    tree,\n    joinPathFragments(import.meta.dirname, 'files', 'cdk', 'app'),\n    joinPathFragments(PACKAGES_DIR, SHARED_CONSTRUCTS_DIR, 'src', 'app'),\n    { ...options, ...esmVars(tree) },\n    {\n      overwriteStrategy: OverwriteStrategy.KeepExisting,\n    },\n  );\n\n  await addStarExport(\n    tree,\n    joinPathFragments(\n      PACKAGES_DIR,\n      SHARED_CONSTRUCTS_DIR,\n      'src',\n      'app',\n      'index.ts',\n    ),\n    './static-websites/index.js',\n  );\n  await addStarExport(\n    tree,\n    joinPathFragments(\n      PACKAGES_DIR,\n      SHARED_CONSTRUCTS_DIR,\n      'src',\n      'app',\n      'static-websites',\n      'index.ts',\n    ),\n    `./${options.websiteNameKebabCase}.js`,\n  );\n  await addStarExport(\n    tree,\n    joinPathFragments(\n      PACKAGES_DIR,\n      SHARED_CONSTRUCTS_DIR,\n      'src',\n      'core',\n      'index.ts',\n    ),\n    './static-website.js',\n  );\n};\n\nconst addWebsiteTerraformModules = (\n  tree: Tree,\n  options: AddWebsiteInfraOptions,\n) => {\n  generateFiles(\n    tree,\n    joinPathFragments(import.meta.dirname, 'files', 'terraform', 'core'),\n    joinPathFragments(PACKAGES_DIR, SHARED_TERRAFORM_DIR, 'src', 'core'),\n    {\n      ...options,\n      boto3Version: PY_VERSIONS.boto3,\n      ...terraformProviderVersions(),\n    },\n    {\n      overwriteStrategy: OverwriteStrategy.KeepExisting,\n    },\n  );\n\n  generateFiles(\n    tree,\n    joinPathFragments(import.meta.dirname, 'files', 'terraform', 'app'),\n    joinPathFragments(PACKAGES_DIR, SHARED_TERRAFORM_DIR, 'src', 'app'),\n    { ...options, ...terraformProviderVersions() },\n    {\n      overwriteStrategy: OverwriteStrategy.KeepExisting,\n    },\n  );\n};\n"],"names":["generateFiles","joinPathFragments","OverwriteStrategy","updateJson","addStarExport","esmVars","addDependencyToTargetIfNotPresent","generatedTerraform","PACKAGES_DIR","SHARED_CONSTRUCTS_DIR","SHARED_TERRAFORM_DIR","PY_VERSIONS","terraformProviderVersions","WEBSITE_CONSTRUCTS_PY_DEPENDENCIES","name","when","addWebsiteInfra","tree","options","iac","addWebsiteCdkConstructs","addWebsiteTerraformModules","Error","config","websiteProjectName","dirname","overwriteStrategy","KeepExisting","websiteNameKebabCase","boto3Version","boto3"],"mappings":"AAAA;;;CAGC,GACD,SACEA,aAAa,EACbC,iBAAiB,EACjBC,iBAAiB,EAGjBC,UAAU,QACL,aAAa;AACpB,SAASC,aAAa,QAAQ,YAAY;AAG1C,SAASC,OAAO,QAAQ,sBAAsB;AAC9C,SAASC,iCAAiC,QAAQ,WAAW;AAC7D,SACEC,kBAAkB,EAElBC,YAAY,EACZC,qBAAqB,EACrBC,oBAAoB,QACf,oCAAoC;AAC3C,SAEEC,WAAW,EACXC,yBAAyB,QACpB,iBAAiB;AAExB;;;;;CAKC,GACD,OAAO,MAAMC,qCAAqC;IAChD;QAAEC,MAAM;QAASC,MAAMR;IAAmB;CAC3C,CAGG;AAUJ;;CAEC,GACD,OAAO,MAAMS,kBAAkB,OAC7BC,MACAC;IAEA,IAAIA,QAAQC,GAAG,KAAK,OAAO;QACzB,MAAMC,wBAAwBH,MAAMC;IACtC,OAAO,IAAIA,QAAQC,GAAG,KAAK,aAAa;QACtCE,2BAA2BJ,MAAMC;IACnC,OAAO;QACL,MAAM,IAAII,MAAM,CAAC,gBAAgB,EAAEJ,QAAQC,GAAG,EAAE;IAClD;IAEAhB,WACEc,MACAhB,kBACEO,cACAU,QAAQC,GAAG,KAAK,QAAQV,wBAAwBC,sBAChD,iBAEF,CAACa;QACCjB,kCACEiB,QACA,SACA,GAAGL,QAAQM,kBAAkB,CAAC,MAAM,CAAC;QAEvC,OAAOD;IACT;AAEJ,EAAE;AAEF,MAAMH,0BAA0B,OAC9BH,MACAC;IAEAlB,cACEiB,MACAhB,kBAAkB,YAAYwB,OAAO,EAAE,SAAS,OAAO,SACvDxB,kBAAkBO,cAAcC,uBAAuB,OAAO,SAC9D;QAAE,GAAGS,OAAO;QAAE,GAAGb,QAAQY,KAAK;IAAC,GAC/B;QACES,mBAAmBxB,kBAAkByB,YAAY;IACnD;IAGF3B,cACEiB,MACAhB,kBAAkB,YAAYwB,OAAO,EAAE,SAAS,OAAO,QACvDxB,kBAAkBO,cAAcC,uBAAuB,OAAO,QAC9D;QAAE,GAAGS,OAAO;QAAE,GAAGb,QAAQY,KAAK;IAAC,GAC/B;QACES,mBAAmBxB,kBAAkByB,YAAY;IACnD;IAGF,MAAMvB,cACJa,MACAhB,kBACEO,cACAC,uBACA,OACA,OACA,aAEF;IAEF,MAAML,cACJa,MACAhB,kBACEO,cACAC,uBACA,OACA,OACA,mBACA,aAEF,CAAC,EAAE,EAAES,QAAQU,oBAAoB,CAAC,GAAG,CAAC;IAExC,MAAMxB,cACJa,MACAhB,kBACEO,cACAC,uBACA,OACA,QACA,aAEF;AAEJ;AAEA,MAAMY,6BAA6B,CACjCJ,MACAC;IAEAlB,cACEiB,MACAhB,kBAAkB,YAAYwB,OAAO,EAAE,SAAS,aAAa,SAC7DxB,kBAAkBO,cAAcE,sBAAsB,OAAO,SAC7D;QACE,GAAGQ,OAAO;QACVW,cAAclB,YAAYmB,KAAK;QAC/B,GAAGlB,2BAA2B;IAChC,GACA;QACEc,mBAAmBxB,kBAAkByB,YAAY;IACnD;IAGF3B,cACEiB,MACAhB,kBAAkB,YAAYwB,OAAO,EAAE,SAAS,aAAa,QAC7DxB,kBAAkBO,cAAcE,sBAAsB,OAAO,QAC7D;QAAE,GAAGQ,OAAO;QAAE,GAAGN,2BAA2B;IAAC,GAC7C;QACEc,mBAAmBxB,kBAAkByB,YAAY;IACnD;AAEJ"}