@aws/nx-plugin 1.0.0-rc.8 → 1.0.0-rc.80

package/src/utils/identity-constructs/files/terraform/core/user-identity/main.tf.template

@@ -1,8 +1,41 @@
+variable "enable_waf" {
+  description = "Whether to enable AWS WAFv2 with the default managed ruleset and associate it with the user pool"
+  type        = bool
+  default     = true
+}
+
+variable "mfa" {
+  description = "Whether users must configure MFA, may optionally configure MFA, or cannot use MFA at all"
+  type        = string
+  default     = "ON"
+
+  validation {
+    condition     = contains(["OFF", "OPTIONAL", "ON"], var.mfa)
+    error_message = "mfa must be one of OFF, OPTIONAL, ON"
+  }
+}
+
+variable "mfa_second_factor_otp" {
+  description = "Whether users can use a time-based one time password (TOTP), generated by a hardware or software token, as an MFA method"
+  type        = bool
+  default     = true
+}
+
+variable "mfa_second_factor_sms" {
+  description = "Whether users can use SMS to their verified phone numbers as an MFA method. Due to a Terraform AWS provider limitation, disabling this also disables SMS-based phone number verification, unlike the equivalent CDK construct prop"
+  type        = bool
+  default     = true
+}
+
 module "identity" {
   source = "./identity"
 
   user_pool_domain_prefix = "<%= cognitoDomain %>"
   allow_signup = <%= allowSignup %>
+  enable_waf = var.enable_waf
+  mfa = var.mfa
+  mfa_second_factor_otp = var.mfa_second_factor_otp
+  mfa_second_factor_sms = var.mfa_second_factor_sms
 }
 
 # Outputs

package/src/utils/identity-constructs/identity-constructs.d.ts

@@ -3,7 +3,17 @@
  * SPDX-License-Identifier: Apache-2.0
  */
 import { type Tree } from '@nx/devkit';
-import type { Iac } from '../iac';
+import type { Iac } from '../iac.js';
+import { type IacMetadata } from '../shared-constructs-constants.js';
+/**
+ * Python version the generated Terraform pins in the callback URL module's inline
+ * `uv run --with` script. Nothing installs it, so it is declared for its version
+ * alone, and only on the Terraform branch that writes the script.
+ */
+export declare const IDENTITY_CONSTRUCTS_PY_DEPENDENCIES: readonly [{
+    readonly name: "boto3";
+    readonly when: (m: IacMetadata) => boolean;
+}];
 export interface AddIdentityInfraOptions {
     cognitoDomain: string;
     allowSignup: boolean;

package/src/utils/identity-constructs/identity-constructs.js

@@ -1,50 +1,71 @@
-"use strict";
-Object.defineProperty(exports, "__esModule", { value: true });
-exports.addIdentityInfra = void 0;
 /**
  * Copyright Amazon.com, Inc. or its affiliates. All Rights Reserved.
  * SPDX-License-Identifier: Apache-2.0
- */
-const devkit_1 = require("@nx/devkit");
-const ast_1 = require("../ast");
-const shared_constructs_constants_1 = require("../shared-constructs-constants");
+ */ import { generateFiles, joinPathFragments, OverwriteStrategy } from "@nx/devkit";
+import { addStarExport } from "../ast.js";
+import { esmVars } from "../module-format.js";
+import { generatedTerraform, PACKAGES_DIR, SHARED_CONSTRUCTS_DIR, SHARED_TERRAFORM_DIR } from "../shared-constructs-constants.js";
+import { PY_VERSIONS, terraformProviderVersions } from "../versions.js";
+/**
+ * Python version the generated Terraform pins in the callback URL module's inline
+ * `uv run --with` script. Nothing installs it, so it is declared for its version
+ * alone, and only on the Terraform branch that writes the script.
+ */ export const IDENTITY_CONSTRUCTS_PY_DEPENDENCIES = [
+    {
+        name: 'boto3',
+        when: generatedTerraform
+    }
+];
 /**
  * Add infrastructure for a static website
- */
-const addIdentityInfra = async (tree, options) => {
+ */ export const addIdentityInfra = async (tree, options)=>{
     if (options.iac === 'cdk') {
         await addIdentityCdkConstructs(tree, options);
-    }
-    else if (options.iac === 'terraform') {
+    } else if (options.iac === 'terraform') {
         addIdentityTerraformModules(tree, options);
-    }
-    else {
+    } else {
         throw new Error(`Unsupported iac ${options.iac}`);
     }
 };
-exports.addIdentityInfra = addIdentityInfra;
-const addIdentityCdkConstructs = async (tree, options) => {
-    (0, devkit_1.generateFiles)(tree, (0, devkit_1.joinPathFragments)(__dirname, 'files', 'cdk', 'core'), (0, devkit_1.joinPathFragments)(shared_constructs_constants_1.PACKAGES_DIR, shared_constructs_constants_1.SHARED_CONSTRUCTS_DIR, 'src', 'core'), options, {
-        overwriteStrategy: devkit_1.OverwriteStrategy.KeepExisting,
+const addIdentityCdkConstructs = async (tree, options)=>{
+    generateFiles(tree, joinPathFragments(import.meta.dirname, 'files', 'cdk', 'core'), joinPathFragments(PACKAGES_DIR, SHARED_CONSTRUCTS_DIR, 'src', 'core'), {
+        ...options,
+        ...esmVars(tree)
+    }, {
+        overwriteStrategy: OverwriteStrategy.KeepExisting
     });
-    await (0, ast_1.addStarExport)(tree, (0, devkit_1.joinPathFragments)(shared_constructs_constants_1.PACKAGES_DIR, shared_constructs_constants_1.SHARED_CONSTRUCTS_DIR, 'src', 'core', 'index.ts'), './user-identity.js');
+    await addStarExport(tree, joinPathFragments(PACKAGES_DIR, SHARED_CONSTRUCTS_DIR, 'src', 'core', 'index.ts'), './user-identity.js');
 };
-const addIdentityTerraformModules = (tree, options) => {
-    (0, devkit_1.generateFiles)(tree, (0, devkit_1.joinPathFragments)(__dirname, 'files', 'terraform', 'core'), (0, devkit_1.joinPathFragments)(shared_constructs_constants_1.PACKAGES_DIR, shared_constructs_constants_1.SHARED_TERRAFORM_DIR, 'src', 'core'), options, {
-        overwriteStrategy: devkit_1.OverwriteStrategy.KeepExisting,
+const addIdentityTerraformModules = (tree, options)=>{
+    generateFiles(tree, joinPathFragments(import.meta.dirname, 'files', 'terraform', 'core'), joinPathFragments(PACKAGES_DIR, SHARED_TERRAFORM_DIR, 'src', 'core'), {
+        ...options,
+        boto3Version: PY_VERSIONS.boto3,
+        ...terraformProviderVersions()
+    }, {
+        overwriteStrategy: OverwriteStrategy.KeepExisting
     });
     // Update the static website module to add the callback url
-    const staticWebsiteModule = tree.read((0, devkit_1.joinPathFragments)(shared_constructs_constants_1.PACKAGES_DIR, shared_constructs_constants_1.SHARED_TERRAFORM_DIR, 'src', 'core', 'static-website', 'static-website.tf'), 'utf-8');
-    if (staticWebsiteModule &&
-        !staticWebsiteModule.includes('source = "../user-identity/add-callback-url"')) {
-        // Find the aws_cloudfront_distribution.website resource and add the callback URL module after it
+    const staticWebsiteModule = tree.read(joinPathFragments(PACKAGES_DIR, SHARED_TERRAFORM_DIR, 'src', 'core', 'static-website', 'static-website.tf'), 'utf-8');
+    if (staticWebsiteModule && !staticWebsiteModule.includes('source = "../user-identity/add-callback-url"')) {
+        // Find the aws_cloudfront_distribution.website resource and add the callback URL module after it.
+        // Includes the CloudFront domain plus any custom domain names (aliases) configured via var.custom_domain_names.
         const callbackUrlModule = `
 
-# Add CloudFront domain to user pool client callback URLs
+# Add CloudFront domain and any custom domain names to user pool client callback URLs.
+# Keyed by statically-known values so for_each keys are resolvable at plan time; the
+# CloudFront domain is only known at apply time, so it appears in the value, not the key.
+locals {
+  callback_urls = merge(
+    { cloudfront = "https://\${aws_cloudfront_distribution.website.domain_name}" },
+    { for domain in var.custom_domain_names : domain => "https://\${domain}" },
+  )
+}
+
 module "add_callback_url" {
   source = "../user-identity/add-callback-url"
+  for_each = local.callback_urls
 
-  callback_url = "https://\${aws_cloudfront_distribution.website.domain_name}"
+  callback_url = each.value
 
   depends_on = [aws_cloudfront_distribution.website]
 }`;
@@ -57,12 +78,11 @@ module "add_callback_url" {
             let braceCount = 0;
             let insertionPoint = -1;
             // Count braces to find the end of the resource block
-            for (let i = startIndex; i < staticWebsiteModule.length; i++) {
+            for(let i = startIndex; i < staticWebsiteModule.length; i++){
                 const char = staticWebsiteModule[i];
                 if (char === '{') {
                     braceCount++;
-                }
-                else if (char === '}') {
+                } else if (char === '}') {
                     braceCount--;
                     if (braceCount === 0) {
                         // Found the closing brace of the CloudFront resource
@@ -76,9 +96,10 @@ module "add_callback_url" {
                 const beforeInsertion = staticWebsiteModule.substring(0, insertionPoint);
                 const afterInsertion = staticWebsiteModule.substring(insertionPoint);
                 const updatedContent = beforeInsertion + callbackUrlModule + afterInsertion;
-                tree.write((0, devkit_1.joinPathFragments)(shared_constructs_constants_1.PACKAGES_DIR, shared_constructs_constants_1.SHARED_TERRAFORM_DIR, 'src', 'core', 'static-website', 'static-website.tf'), updatedContent);
+                tree.write(joinPathFragments(PACKAGES_DIR, SHARED_TERRAFORM_DIR, 'src', 'core', 'static-website', 'static-website.tf'), updatedContent);
             }
         }
     }
 };
+
 //# sourceMappingURL=identity-constructs.js.map

package/src/utils/identity-constructs/identity-constructs.js.map

@@ -1 +1 @@
-{"version":3,"file":"identity-constructs.js","sourceRoot":"","sources":["../../../../../../packages/nx-plugin/src/utils/identity-constructs/identity-constructs.ts"],"names":[],"mappings":";;;AAAA;;;GAGG;AACH,uCAKoB;AACpB,gCAAuC;AAEvC,gFAIwC;AAOxC;;GAEG;AACI,MAAM,gBAAgB,GAAG,KAAK,EACnC,IAAU,EACV,OAA+C,EAC/C,EAAE;IACF,IAAI,OAAO,CAAC,GAAG,KAAK,KAAK,EAAE,CAAC;QAC1B,MAAM,wBAAwB,CAAC,IAAI,EAAE,OAAO,CAAC,CAAC;IAChD,CAAC;SAAM,IAAI,OAAO,CAAC,GAAG,KAAK,WAAW,EAAE,CAAC;QACvC,2BAA2B,CAAC,IAAI,EAAE,OAAO,CAAC,CAAC;IAC7C,CAAC;SAAM,CAAC;QACN,MAAM,IAAI,KAAK,CAAC,mBAAmB,OAAO,CAAC,GAAG,EAAE,CAAC,CAAC;IACpD,CAAC;AACH,CAAC,CAAC;AAXW,QAAA,gBAAgB,oBAW3B;AAEF,MAAM,wBAAwB,GAAG,KAAK,EACpC,IAAU,EACV,OAAgC,EAChC,EAAE;IACF,IAAA,sBAAa,EACX,IAAI,EACJ,IAAA,0BAAiB,EAAC,SAAS,EAAE,OAAO,EAAE,KAAK,EAAE,MAAM,CAAC,EACpD,IAAA,0BAAiB,EAAC,0CAAY,EAAE,mDAAqB,EAAE,KAAK,EAAE,MAAM,CAAC,EACrE,OAAO,EACP;QACE,iBAAiB,EAAE,0BAAiB,CAAC,YAAY;KAClD,CACF,CAAC;IAEF,MAAM,IAAA,mBAAa,EACjB,IAAI,EACJ,IAAA,0BAAiB,EACf,0CAAY,EACZ,mDAAqB,EACrB,KAAK,EACL,MAAM,EACN,UAAU,CACX,EACD,oBAAoB,CACrB,CAAC;AACJ,CAAC,CAAC;AAEF,MAAM,2BAA2B,GAAG,CAClC,IAAU,EACV,OAAgC,EAChC,EAAE;IACF,IAAA,sBAAa,EACX,IAAI,EACJ,IAAA,0BAAiB,EAAC,SAAS,EAAE,OAAO,EAAE,WAAW,EAAE,MAAM,CAAC,EAC1D,IAAA,0BAAiB,EAAC,0CAAY,EAAE,kDAAoB,EAAE,KAAK,EAAE,MAAM,CAAC,EACpE,OAAO,EACP;QACE,iBAAiB,EAAE,0BAAiB,CAAC,YAAY;KAClD,CACF,CAAC;IAEF,2DAA2D;IAC3D,MAAM,mBAAmB,GAAG,IAAI,CAAC,IAAI,CACnC,IAAA,0BAAiB,EACf,0CAAY,EACZ,kDAAoB,EACpB,KAAK,EACL,MAAM,EACN,gBAAgB,EAChB,mBAAmB,CACpB,EACD,OAAO,CACR,CAAC;IACF,IACE,mBAAmB;QACnB,CAAC,mBAAmB,CAAC,QAAQ,CAC3B,8CAA8C,CAC/C,EACD,CAAC;QACD,iGAAiG;QACjG,MAAM,iBAAiB,GAAG;;;;;;;;;EAS5B,CAAC;QAEC,wEAAwE;QACxE,kDAAkD;QAClD,MAAM,oBAAoB,GACxB,2DAA2D,CAAC;QAC9D,MAAM,kBAAkB,GAAG,mBAAmB,CAAC,KAAK,CAAC,oBAAoB,CAAC,CAAC;QAE3E,IAAI,kBAAkB,EAAE,CAAC;YACvB,MAAM,UAAU,GACd,kBAAkB,CAAC,KAAM,GAAG,kBAAkB,CAAC,CAAC,CAAC,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,4BAA4B;YAC5F,IAAI,UAAU,GAAG,CAAC,CAAC;YACnB,IAAI,cAAc,GAAG,CAAC,CAAC,CAAC;YAExB,qDAAqD;YACrD,KAAK,IAAI,CAAC,GAAG,UAAU,EAAE,CAAC,GAAG,mBAAmB,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;gBAC7D,MAAM,IAAI,GAAG,mBAAmB,CAAC,CAAC,CAAC,CAAC;gBACpC,IAAI,IAAI,KAAK,GAAG,EAAE,CAAC;oBACjB,UAAU,EAAE,CAAC;gBACf,CAAC;qBAAM,IAAI,IAAI,KAAK,GAAG,EAAE,CAAC;oBACxB,UAAU,EAAE,CAAC;oBACb,IAAI,UAAU,KAAK,CAAC,EAAE,CAAC;wBACrB,qDAAqD;wBACrD,cAAc,GAAG,CAAC,GAAG,CAAC,CAAC;wBACvB,MAAM;oBACR,CAAC;gBACH,CAAC;YACH,CAAC;YAED,IAAI,cAAc,KAAK,CAAC,CAAC,EAAE,CAAC;gBAC1B,yEAAyE;gBACzE,MAAM,eAAe,GAAG,mBAAmB,CAAC,SAAS,CACnD,CAAC,EACD,cAAc,CACf,CAAC;gBACF,MAAM,cAAc,GAAG,mBAAmB,CAAC,SAAS,CAAC,cAAc,CAAC,CAAC;gBACrE,MAAM,cAAc,GAClB,eAAe,GAAG,iBAAiB,GAAG,cAAc,CAAC;gBAEvD,IAAI,CAAC,KAAK,CACR,IAAA,0BAAiB,EACf,0CAAY,EACZ,kDAAoB,EACpB,KAAK,EACL,MAAM,EACN,gBAAgB,EAChB,mBAAmB,CACpB,EACD,cAAc,CACf,CAAC;YACJ,CAAC;QACH,CAAC;IACH,CAAC;AACH,CAAC,CAAC"}
+{"version":3,"sources":["../../../../../../packages/nx-plugin/src/utils/identity-constructs/identity-constructs.ts"],"sourcesContent":["/**\n * Copyright Amazon.com, Inc. or its affiliates. All Rights Reserved.\n * SPDX-License-Identifier: Apache-2.0\n */\nimport {\n  generateFiles,\n  joinPathFragments,\n  OverwriteStrategy,\n  type Tree,\n} from '@nx/devkit';\nimport { addStarExport } from '../ast.js';\nimport type { DeclaredPyDependency } from '../declared-dependencies.js';\nimport type { Iac } from '../iac.js';\nimport { esmVars } from '../module-format.js';\nimport {\n  generatedTerraform,\n  type IacMetadata,\n  PACKAGES_DIR,\n  SHARED_CONSTRUCTS_DIR,\n  SHARED_TERRAFORM_DIR,\n} from '../shared-constructs-constants.js';\nimport {\n  type IPyDepVersion,\n  PY_VERSIONS,\n  terraformProviderVersions,\n} from '../versions.js';\n\n/**\n * Python version the generated Terraform pins in the callback URL module's inline\n * `uv run --with` script. Nothing installs it, so it is declared for its version\n * alone, and only on the Terraform branch that writes the script.\n */\nexport const IDENTITY_CONSTRUCTS_PY_DEPENDENCIES = [\n  { name: 'boto3', when: generatedTerraform },\n] as const satisfies readonly DeclaredPyDependency<\n  IPyDepVersion,\n  IacMetadata\n>[];\n\nexport interface AddIdentityInfraOptions {\n  cognitoDomain: string;\n  allowSignup: boolean;\n}\n\n/**\n * Add infrastructure for a static website\n */\nexport const addIdentityInfra = async (\n  tree: Tree,\n  options: AddIdentityInfraOptions & { iac: Iac },\n) => {\n  if (options.iac === 'cdk') {\n    await addIdentityCdkConstructs(tree, options);\n  } else if (options.iac === 'terraform') {\n    addIdentityTerraformModules(tree, options);\n  } else {\n    throw new Error(`Unsupported iac ${options.iac}`);\n  }\n};\n\nconst addIdentityCdkConstructs = async (\n  tree: Tree,\n  options: AddIdentityInfraOptions,\n) => {\n  generateFiles(\n    tree,\n    joinPathFragments(import.meta.dirname, 'files', 'cdk', 'core'),\n    joinPathFragments(PACKAGES_DIR, SHARED_CONSTRUCTS_DIR, 'src', 'core'),\n    { ...options, ...esmVars(tree) },\n    {\n      overwriteStrategy: OverwriteStrategy.KeepExisting,\n    },\n  );\n\n  await addStarExport(\n    tree,\n    joinPathFragments(\n      PACKAGES_DIR,\n      SHARED_CONSTRUCTS_DIR,\n      'src',\n      'core',\n      'index.ts',\n    ),\n    './user-identity.js',\n  );\n};\n\nconst addIdentityTerraformModules = (\n  tree: Tree,\n  options: AddIdentityInfraOptions,\n) => {\n  generateFiles(\n    tree,\n    joinPathFragments(import.meta.dirname, 'files', 'terraform', 'core'),\n    joinPathFragments(PACKAGES_DIR, SHARED_TERRAFORM_DIR, 'src', 'core'),\n    {\n      ...options,\n      boto3Version: PY_VERSIONS.boto3,\n      ...terraformProviderVersions(),\n    },\n    {\n      overwriteStrategy: OverwriteStrategy.KeepExisting,\n    },\n  );\n\n  // Update the static website module to add the callback url\n  const staticWebsiteModule = tree.read(\n    joinPathFragments(\n      PACKAGES_DIR,\n      SHARED_TERRAFORM_DIR,\n      'src',\n      'core',\n      'static-website',\n      'static-website.tf',\n    ),\n    'utf-8',\n  );\n  if (\n    staticWebsiteModule &&\n    !staticWebsiteModule.includes(\n      'source = \"../user-identity/add-callback-url\"',\n    )\n  ) {\n    // Find the aws_cloudfront_distribution.website resource and add the callback URL module after it.\n    // Includes the CloudFront domain plus any custom domain names (aliases) configured via var.custom_domain_names.\n    const callbackUrlModule = `\n\n# Add CloudFront domain and any custom domain names to user pool client callback URLs.\n# Keyed by statically-known values so for_each keys are resolvable at plan time; the\n# CloudFront domain is only known at apply time, so it appears in the value, not the key.\nlocals {\n  callback_urls = merge(\n    { cloudfront = \"https://\\${aws_cloudfront_distribution.website.domain_name}\" },\n    { for domain in var.custom_domain_names : domain => \"https://\\${domain}\" },\n  )\n}\n\nmodule \"add_callback_url\" {\n  source = \"../user-identity/add-callback-url\"\n  for_each = local.callback_urls\n\n  callback_url = each.value\n\n  depends_on = [aws_cloudfront_distribution.website]\n}`;\n\n    // Find the CloudFront distribution resource using proper brace counting\n    // This handles deeply nested structures correctly\n    const resourceStartPattern =\n      /resource\\s+\"aws_cloudfront_distribution\"\\s+\"website\"\\s*\\{/;\n    const resourceStartMatch = staticWebsiteModule.match(resourceStartPattern);\n\n    if (resourceStartMatch) {\n      const startIndex =\n        resourceStartMatch.index! + resourceStartMatch[0].length - 1; // Position at opening brace\n      let braceCount = 0;\n      let insertionPoint = -1;\n\n      // Count braces to find the end of the resource block\n      for (let i = startIndex; i < staticWebsiteModule.length; i++) {\n        const char = staticWebsiteModule[i];\n        if (char === '{') {\n          braceCount++;\n        } else if (char === '}') {\n          braceCount--;\n          if (braceCount === 0) {\n            // Found the closing brace of the CloudFront resource\n            insertionPoint = i + 1;\n            break;\n          }\n        }\n      }\n\n      if (insertionPoint !== -1) {\n        // Insert the callback URL module right after the CloudFront distribution\n        const beforeInsertion = staticWebsiteModule.substring(\n          0,\n          insertionPoint,\n        );\n        const afterInsertion = staticWebsiteModule.substring(insertionPoint);\n        const updatedContent =\n          beforeInsertion + callbackUrlModule + afterInsertion;\n\n        tree.write(\n          joinPathFragments(\n            PACKAGES_DIR,\n            SHARED_TERRAFORM_DIR,\n            'src',\n            'core',\n            'static-website',\n            'static-website.tf',\n          ),\n          updatedContent,\n        );\n      }\n    }\n  }\n};\n"],"names":["generateFiles","joinPathFragments","OverwriteStrategy","addStarExport","esmVars","generatedTerraform","PACKAGES_DIR","SHARED_CONSTRUCTS_DIR","SHARED_TERRAFORM_DIR","PY_VERSIONS","terraformProviderVersions","IDENTITY_CONSTRUCTS_PY_DEPENDENCIES","name","when","addIdentityInfra","tree","options","iac","addIdentityCdkConstructs","addIdentityTerraformModules","Error","dirname","overwriteStrategy","KeepExisting","boto3Version","boto3","staticWebsiteModule","read","includes","callbackUrlModule","resourceStartPattern","resourceStartMatch","match","startIndex","index","length","braceCount","insertionPoint","i","char","beforeInsertion","substring","afterInsertion","updatedContent","write"],"mappings":"AAAA;;;CAGC,GACD,SACEA,aAAa,EACbC,iBAAiB,EACjBC,iBAAiB,QAEZ,aAAa;AACpB,SAASC,aAAa,QAAQ,YAAY;AAG1C,SAASC,OAAO,QAAQ,sBAAsB;AAC9C,SACEC,kBAAkB,EAElBC,YAAY,EACZC,qBAAqB,EACrBC,oBAAoB,QACf,oCAAoC;AAC3C,SAEEC,WAAW,EACXC,yBAAyB,QACpB,iBAAiB;AAExB;;;;CAIC,GACD,OAAO,MAAMC,sCAAsC;IACjD;QAAEC,MAAM;QAASC,MAAMR;IAAmB;CAC3C,CAGG;AAOJ;;CAEC,GACD,OAAO,MAAMS,mBAAmB,OAC9BC,MACAC;IAEA,IAAIA,QAAQC,GAAG,KAAK,OAAO;QACzB,MAAMC,yBAAyBH,MAAMC;IACvC,OAAO,IAAIA,QAAQC,GAAG,KAAK,aAAa;QACtCE,4BAA4BJ,MAAMC;IACpC,OAAO;QACL,MAAM,IAAII,MAAM,CAAC,gBAAgB,EAAEJ,QAAQC,GAAG,EAAE;IAClD;AACF,EAAE;AAEF,MAAMC,2BAA2B,OAC/BH,MACAC;IAEAhB,cACEe,MACAd,kBAAkB,YAAYoB,OAAO,EAAE,SAAS,OAAO,SACvDpB,kBAAkBK,cAAcC,uBAAuB,OAAO,SAC9D;QAAE,GAAGS,OAAO;QAAE,GAAGZ,QAAQW,KAAK;IAAC,GAC/B;QACEO,mBAAmBpB,kBAAkBqB,YAAY;IACnD;IAGF,MAAMpB,cACJY,MACAd,kBACEK,cACAC,uBACA,OACA,QACA,aAEF;AAEJ;AAEA,MAAMY,8BAA8B,CAClCJ,MACAC;IAEAhB,cACEe,MACAd,kBAAkB,YAAYoB,OAAO,EAAE,SAAS,aAAa,SAC7DpB,kBAAkBK,cAAcE,sBAAsB,OAAO,SAC7D;QACE,GAAGQ,OAAO;QACVQ,cAAcf,YAAYgB,KAAK;QAC/B,GAAGf,2BAA2B;IAChC,GACA;QACEY,mBAAmBpB,kBAAkBqB,YAAY;IACnD;IAGF,2DAA2D;IAC3D,MAAMG,sBAAsBX,KAAKY,IAAI,CACnC1B,kBACEK,cACAE,sBACA,OACA,QACA,kBACA,sBAEF;IAEF,IACEkB,uBACA,CAACA,oBAAoBE,QAAQ,CAC3B,iDAEF;QACA,kGAAkG;QAClG,gHAAgH;QAChH,MAAMC,oBAAoB,CAAC;;;;;;;;;;;;;;;;;;;CAmB9B,CAAC;QAEE,wEAAwE;QACxE,kDAAkD;QAClD,MAAMC,uBACJ;QACF,MAAMC,qBAAqBL,oBAAoBM,KAAK,CAACF;QAErD,IAAIC,oBAAoB;YACtB,MAAME,aACJF,mBAAmBG,KAAK,GAAIH,kBAAkB,CAAC,EAAE,CAACI,MAAM,GAAG,GAAG,4BAA4B;YAC5F,IAAIC,aAAa;YACjB,IAAIC,iBAAiB,CAAC;YAEtB,qDAAqD;YACrD,IAAK,IAAIC,IAAIL,YAAYK,IAAIZ,oBAAoBS,MAAM,EAAEG,IAAK;gBAC5D,MAAMC,OAAOb,mBAAmB,CAACY,EAAE;gBACnC,IAAIC,SAAS,KAAK;oBAChBH;gBACF,OAAO,IAAIG,SAAS,KAAK;oBACvBH;oBACA,IAAIA,eAAe,GAAG;wBACpB,qDAAqD;wBACrDC,iBAAiBC,IAAI;wBACrB;oBACF;gBACF;YACF;YAEA,IAAID,mBAAmB,CAAC,GAAG;gBACzB,yEAAyE;gBACzE,MAAMG,kBAAkBd,oBAAoBe,SAAS,CACnD,GACAJ;gBAEF,MAAMK,iBAAiBhB,oBAAoBe,SAAS,CAACJ;gBACrD,MAAMM,iBACJH,kBAAkBX,oBAAoBa;gBAExC3B,KAAK6B,KAAK,CACR3C,kBACEK,cACAE,sBACA,OACA,QACA,kBACA,sBAEFmC;YAEJ;QACF;IACF;AACF"}

package/src/utils/init.d.ts

@@ -0,0 +1,72 @@
+/**
+ * Copyright Amazon.com, Inc. or its affiliates. All Rights Reserved.
+ * SPDX-License-Identifier: Apache-2.0
+ */
+import { OverwriteStrategy, type Tree } from '@nx/devkit';
+import { type Containers } from './containers.js';
+import { type DependencyDeclaration, type MustDeclare } from './declared-dependencies.js';
+import type { Iac } from './iac.js';
+/** Dependencies a caller must declare to apply the workspace init. */
+export declare const INIT_DEPENDENCIES: readonly [{
+    readonly name: "nx";
+}, {
+    readonly name: "@nx/js";
+}, {
+    readonly name: "@nx/workspace";
+}, {
+    readonly name: "typescript";
+}, {
+    readonly name: "@biomejs/biome";
+}];
+export declare const PNPM_BUILT_DEPENDENCIES: string[];
+/**
+ * Options controlling how the workspace is initialised. These mirror the
+ * preset schema so a workspace created via the preset and one initialised via
+ * the `init` generator end up in the same shape.
+ */
+export interface ApplyWorkspaceInitOptions {
+    /** The IaC provider to record in the plugin config. */
+    readonly iac: Iac;
+    /**
+     * The container engine to record. `undefined`/`'infer'` picks docker when
+     * installed, else finch.
+     */
+    readonly containers?: Containers | 'infer';
+    /** Whether to configure MCP servers for coding agents. Defaults to true. */
+    readonly mcp?: boolean;
+    /**
+     * How to treat the generated workspace README. The preset owns the README of
+     * a greenfield workspace (`Overwrite`); the `init` generator must not clobber
+     * an existing workspace's README (`KeepExisting`, the default).
+     */
+    readonly readmeOverwriteStrategy?: OverwriteStrategy;
+    /**
+     * Whether to overwrite root package.json scripts that already exist. The
+     * preset owns a greenfield workspace's scripts (`true`); the `init`
+     * generator must not clobber an existing workspace's scripts (`false`,
+     * the default) — it only adds the convenience scripts that are absent.
+     */
+    readonly overwriteScripts?: boolean;
+    /**
+     * Whether generators use the package manager's dependency catalog. On pnpm
+     * this also sets `catalogMode: strict` so `pnpm add` records new deps in the
+     * catalog. Defaults to true.
+     */
+    readonly catalogs?: boolean;
+}
+/**
+ * Transform an Nx workspace into one ready to run `@aws/nx-plugin` generators.
+ *
+ * This is the deterministic core shared by the workspace preset and the `init`
+ * generator. It is safe to re-run: every step is idempotent (config merges,
+ * keyed nx.json / package.json entries, create-if-missing files), so running
+ * it against an already-initialised workspace is a no-op.
+ *
+ * It preserves the workspace's module format: the root package.json `type`
+ * field is owned by the preset (written from its `--module` option) and left
+ * untouched here. It does NOT rewrite an existing `tsconfig.base.json`'s
+ * compiler options, migrate a workspace's package manager, or restructure
+ * existing projects — those are decisions for the user (see the "add to an
+ * existing workspace" guide).
+ */
+export declare const applyWorkspaceInit: <const D extends DependencyDeclaration>(tree: Tree, { iac, containers, mcp, readmeOverwriteStrategy, overwriteScripts, catalogs, }: ApplyWorkspaceInitOptions, declaration: D & MustDeclare<typeof INIT_DEPENDENCIES, D>) => Promise<void>;

package/src/utils/init.js

@@ -0,0 +1,300 @@
+/**
+ * Copyright Amazon.com, Inc. or its affiliates. All Rights Reserved.
+ * SPDX-License-Identifier: Apache-2.0
+ */ import { generateFiles, joinPathFragments, OverwriteStrategy, readNxJson, updateJson, updateNxJson } from "@nx/devkit";
+import { initGenerator } from "@nx/js";
+import yaml from "js-yaml";
+import GeneratorsJson from "../../generators.json" with {
+    type: 'json'
+};
+import { SYNC_GENERATOR_NAME as TS_SYNC_GENERATOR_NAME } from "../ts/sync/generator.js";
+import { BASE_TSCONFIG_COMPILER_OPTIONS } from "./base-tsconfig.js";
+import { ensureAwsNxPluginConfig, updateAwsNxPluginConfig } from "./config/utils.js";
+import { inferContainers } from "./containers.js";
+import { forDependencies } from "./declared-dependencies.js";
+import { addDependenciesToPackageJson, detectWorkspacePackageManager } from "./dependencies.js";
+import { getDefaultBiomeConfig } from "./format.js";
+import { configureMcpServers } from "./mcp.js";
+import { getNpmScope } from "./npm-scope.js";
+import { mergeTargetDefault, nxPluginMcpDependency, nxPluginSelfDependency } from "./nx.js";
+import { getPackageManagerDisplayCommands } from "./pkg-manager.js";
+import { workspaceGlobs } from "./project-package-json.js";
+import { withVersions } from "./versions.js";
+const WORKSPACES = [
+    'packages/*'
+];
+const NX_TYPESCRIPT_SYNC_GENERATOR = '@nx/js:typescript-sync';
+/** Dependencies a caller must declare to apply the workspace init. */ export const INIT_DEPENDENCIES = [
+    {
+        name: 'nx'
+    },
+    {
+        name: '@nx/js'
+    },
+    {
+        name: '@nx/workspace'
+    },
+    {
+        name: 'typescript'
+    },
+    {
+        name: '@biomejs/biome'
+    }
+];
+// Built dependencies whose install scripts the generated workspace trusts.
+// `onlyBuiltDependencies` is the pnpm 10 key (silently ignored by pnpm 11);
+// pnpm 11 reads `allowBuilds` instead. Any dep NOT in this allowlist will
+// have its install scripts skipped with a warning — matching pnpm 10's
+// default behaviour. The user can opt-in later via `pnpm approve-builds`.
+export const PNPM_BUILT_DEPENDENCIES = [
+    '@swc/core',
+    'esbuild',
+    'nx',
+    'sharp'
+];
+/**
+ * Add or repair the pnpm `allowBuilds` / `onlyBuiltDependencies` allowlist for
+ * the workspace's `packages` globs, without clobbering any packages the user
+ * has already declared.
+ *
+ * A workspace not created by the preset commonly has either no
+ * `pnpm-workspace.yaml`, one missing the `packages` globs, or one carrying the
+ * broken `set this to true or false` placeholder pnpm writes when it skips a
+ * build script. This makes the file self-consistent so the first generator's
+ * install doesn't fail with `ERR_PNPM_IGNORED_BUILDS`.
+ */ const setUpPnpmWorkspace = (tree, catalogs)=>{
+    const existing = tree.exists('pnpm-workspace.yaml') ? yaml.load(tree.read('pnpm-workspace.yaml', 'utf-8') ?? '') ?? {} : {};
+    // Preserve any packages globs the user already has, ensuring ours are present.
+    const packages = Array.from(new Set([
+        ...existing.packages ?? [],
+        ...WORKSPACES
+    ]));
+    const allowBuilds = {
+        ...typeof existing.allowBuilds === 'object' && existing.allowBuilds ? existing.allowBuilds : {},
+        // Overwrite any non-boolean (e.g. the "set this to true or false"
+        // placeholder) with an explicit true for the deps we trust.
+        ...Object.fromEntries(PNPM_BUILT_DEPENDENCIES.map((dep)=>[
+                dep,
+                true
+            ]))
+    };
+    // `strict` makes `pnpm add` record new deps in the catalog; it only gates
+    // that flow, so pre-declared direct ranges (e.g. tslib) still install.
+    // Preserve an explicit user choice.
+    const catalogMode = catalogs ? existing.catalogMode ?? 'strict' : existing.catalogMode;
+    tree.write('pnpm-workspace.yaml', yaml.dump({
+        ...existing,
+        packages,
+        allowBuilds,
+        onlyBuiltDependencies: PNPM_BUILT_DEPENDENCIES,
+        ...catalogMode ? {
+            catalogMode
+        } : {}
+    }, {
+        quotingType: "'"
+    }));
+};
+/**
+ * Configure the workspace's package manager for a monorepo layout.
+ *
+ * pnpm workspaces are declared in `pnpm-workspace.yaml`; every other package
+ * manager reads the `workspaces` field of the root `package.json`.
+ */ const setUpWorkspaces = (tree, catalogs)=>{
+    if (detectWorkspacePackageManager(tree) === 'pnpm') {
+        setUpPnpmWorkspace(tree, catalogs);
+    } else {
+        updateJson(tree, 'package.json', (json)=>{
+            // The `workspaces` field may be the object form ({ "packages": [...] })
+            // accepted by yarn and bun — extend the globs while preserving the form.
+            const globs = Array.from(new Set([
+                ...workspaceGlobs(json.workspaces),
+                ...WORKSPACES
+            ]));
+            return {
+                ...json,
+                workspaces: json.workspaces !== undefined && !Array.isArray(json.workspaces) ? {
+                    ...json.workspaces,
+                    packages: globs
+                } : globs
+            };
+        });
+    }
+};
+/**
+ * Ensure the workspace has a `tsconfig.base.json`.
+ *
+ * `@nx/js` `initGenerator` (with `addTsPlugin`) normally creates this, but it
+ * short-circuits when the workspace already has a root `tsconfig.json` — in
+ * which case no base file is written and the next project generator fails with
+ * `Cannot find tsconfig.base.json`. So we create a compatible one when it's
+ * absent. An existing base is left untouched: the user may have tuned it, and
+ * rewriting shared compiler options can break other projects (see the
+ * "add to an existing workspace" guide).
+ */ const ensureBaseTsConfig = (tree)=>{
+    if (tree.exists('tsconfig.base.json')) {
+        return;
+    }
+    tree.write('tsconfig.base.json', JSON.stringify({
+        compilerOptions: {
+            ...BASE_TSCONFIG_COMPILER_OPTIONS,
+            customConditions: [
+                getNpmScope(tree)
+            ]
+        }
+    }, null, 2));
+};
+/**
+ * Ensure the workspace has a root `tsconfig.json`.
+ *
+ * Nx's `@nx/js:typescript-sync` generator hard-fails with
+ * `Missing root "tsconfig.json"` when it's absent. The plugin's TypeScript
+ * projects reference each other via this file, so we guarantee a minimal one
+ * exists (sync populates its `references`).
+ */ const ensureRootTsConfig = (tree)=>{
+    if (tree.exists('tsconfig.json')) {
+        return;
+    }
+    tree.write('tsconfig.json', JSON.stringify({
+        extends: './tsconfig.base.json',
+        files: [],
+        references: []
+    }, null, 2));
+};
+/**
+ * Transform an Nx workspace into one ready to run `@aws/nx-plugin` generators.
+ *
+ * This is the deterministic core shared by the workspace preset and the `init`
+ * generator. It is safe to re-run: every step is idempotent (config merges,
+ * keyed nx.json / package.json entries, create-if-missing files), so running
+ * it against an already-initialised workspace is a no-op.
+ *
+ * It preserves the workspace's module format: the root package.json `type`
+ * field is owned by the preset (written from its `--module` option) and left
+ * untouched here. It does NOT rewrite an existing `tsconfig.base.json`'s
+ * compiler options, migrate a workspace's package manager, or restructure
+ * existing projects — those are decisions for the user (see the "add to an
+ * existing workspace" guide).
+ */ export const applyWorkspaceInit = async (tree, { iac, containers, mcp, readmeOverwriteStrategy = OverwriteStrategy.KeepExisting, overwriteScripts = false, catalogs = true }, declaration)=>{
+    const resolvedContainers = !containers || containers === 'infer' ? inferContainers() : containers;
+    // The catalogs flag is written explicitly (even when true) so the workspace
+    // records its dependency-management choice.
+    await ensureAwsNxPluginConfig(tree);
+    await updateAwsNxPluginConfig(tree, {
+        iac: {
+            provider: iac
+        },
+        containers: {
+            engine: resolvedContainers
+        },
+        packageManager: {
+            catalogs
+        }
+    });
+    // Set up the TypeScript plugin, base tsconfig, formatter etc. `@nx/js`
+    // creates `tsconfig.base.json` when absent, but skips it when a root
+    // `tsconfig.json` already exists — so we ensure both explicitly below.
+    await initGenerator(tree, {
+        formatter: 'none',
+        addTsPlugin: true
+    });
+    ensureBaseTsConfig(tree);
+    ensureRootTsConfig(tree);
+    setUpWorkspaces(tree, catalogs);
+    const nxJson = readNxJson(tree);
+    updateNxJson(tree, {
+        ...nxJson,
+        // Preserve an explicit analytics choice in an existing workspace.
+        analytics: nxJson.analytics ?? false,
+        targetDefaults: {
+            ...nxJson.targetDefaults,
+            compile: mergeTargetDefault(nxJson.targetDefaults?.compile, (base)=>({
+                    ...base,
+                    syncGenerators: [
+                        ...(base.syncGenerators ?? []).filter((g)=>![
+                                TS_SYNC_GENERATOR_NAME,
+                                NX_TYPESCRIPT_SYNC_GENERATOR
+                            ].includes(g)),
+                        NX_TYPESCRIPT_SYNC_GENERATOR,
+                        TS_SYNC_GENERATOR_NAME
+                    ]
+                }))
+        }
+    });
+    const CONVENIENCE_SCRIPTS = {
+        dev: 'nx run-many --target dev',
+        build: 'nx run-many --target build',
+        lint: 'nx run-many --target lint --configuration=fix',
+        test: 'nx run-many --target test --all',
+        // Trivy container image scanning is not part of `build` (its result
+        // depends on the ever-changing vulnerability database); run it explicitly,
+        // e.g. in CI.
+        trivy: 'nx run-many --target trivy --all',
+        'build:skip-lint': 'nx run-many --target build --configuration=skip-lint',
+        'build:all': 'nx run-many --target build --all',
+        'affected:all': 'nx affected --target build'
+    };
+    updateJson(tree, 'package.json', (packageJson)=>({
+            ...packageJson,
+            // The root `type` field is owned by the preset (written explicitly from
+            // its `--module` option). `init` preserves an existing workspace's field
+            // as-is: an ESM workspace already carries `type: "module"` (that is how
+            // the format is inferred), and introducing a `type` into a CommonJS
+            // workspace that lacks one changes behaviour for frameworks that parse it
+            // (e.g. Next.js starts treating the app's ESM source as CJS).
+            scripts: overwriteScripts ? {
+                ...packageJson.scripts,
+                ...CONVENIENCE_SCRIPTS
+            } : {
+                ...CONVENIENCE_SCRIPTS,
+                ...packageJson.scripts
+            }
+        }));
+    // Pin the workspace's `nx` to the version the plugin's @nx/* packages are
+    // built against. A mismatched workspace nx (even a patch apart) hoists a
+    // second nested nx under @nx/js, and the two instances deadlock `nx sync`.
+    // `@nx/js` must be a root dependency for the `@nx/js:typescript-sync`
+    // generator registered in nx.json to resolve (npm doesn't hoist the
+    // plugin's own copy reliably).
+    addDependenciesToPackageJson(tree, {}, {
+        ...withVersions(forDependencies(declaration), [
+            'nx',
+            '@nx/js',
+            '@nx/workspace'
+        ]),
+        ...withVersions(forDependencies(declaration), [
+            'typescript',
+            '@biomejs/biome'
+        ]),
+        // Declare the plugin the generators are running from, plus the MCP server
+        // package the vended config runs, so both are pinned in the workspace's
+        // lockfile and upgrading them upgrades what the agents use.
+        ...nxPluginSelfDependency(tree),
+        ...nxPluginMcpDependency(tree)
+    });
+    // Write biome.json for formatting and linting
+    if (!tree.exists('biome.json')) {
+        tree.write('biome.json', JSON.stringify(getDefaultBiomeConfig(tree), null, 2));
+    }
+    generateFiles(tree, joinPathFragments(import.meta.dirname, '..', 'preset', 'files'), '.', {
+        projectName: getNpmScope(tree),
+        generators: Object.entries(GeneratorsJson.generators).filter(([_, v])=>!v['hidden']).map(([k, v])=>({
+                name: k,
+                description: v.description
+            })),
+        ...(()=>{
+            const cmds = getPackageManagerDisplayCommands();
+            return {
+                pkgMgrCmd: cmds.exec,
+                buildCmd: `${cmds.run} build`,
+                lintCmd: `${cmds.run} lint`
+            };
+        })()
+    }, {
+        overwriteStrategy: readmeOverwriteStrategy
+    });
+    if (mcp !== false) {
+        configureMcpServers(tree);
+    }
+};
+
+//# sourceMappingURL=init.js.map