@aws/nx-plugin 1.0.0-rc.8 → 1.0.0-rc.80

package/src/mcp-server/tools/general-guidance.js.map

@@ -1 +1 @@
-{"version":3,"file":"general-guidance.js","sourceRoot":"","sources":["../../../../../../packages/nx-plugin/src/mcp-server/tools/general-guidance.ts"],"names":[],"mappings":";;;AAMA,6DAA0D;AAC1D,sDAAoE;AACpE,sCAA6C;AAEhC,QAAA,oBAAoB,GAAG;;;;;gGAK4D,CAAC;AAEjG;;GAEG;AACI,MAAM,sBAAsB,GAAG,CACpC,MAAiB,EACjB,UAA6B,EAC7B,EAAE;IACF,MAAM,CAAC,YAAY,CACjB,kBAAkB,EAClB;QACE,KAAK,EAAE,kBAAkB;QACzB,WAAW,EACT,oFAAoF;KACvF,EACD,KAAK,IAAI,EAAE,CAAC,CAAC;QACX,OAAO,EAAE;YACP;gBACE,IAAI,EAAE,MAAe;gBACrB,IAAI,EAAE;;EAEd,4BAAoB;;;;2DAIqC,yBAAgB,CAAC,IAAI,CAAC,IAAI,CAAC;iFACL,6BAAa,CAAC,IAAI,CAAC,IAAI,CAAC;;;;;;;EAOvG,yBAAgB,CAAC,GAAG,CAAC,CAAC,EAAE,EAAE,EAAE,CAAC,IAAA,+BAAc,EAAC,WAAW,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,OAAO,CAAC;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;EAkC3E,MAAM,IAAA,gCAAe,EAAC,CAAC,WAAW,EAAE,oBAAoB,EAAE,gBAAgB,CAAC,EAAE,UAAU,CAAC;;KAErF;aACI;SACF;KACF,CAAC,CACH,CAAC;AACJ,CAAC,CAAC;AAtEW,QAAA,sBAAsB,0BAsEjC"}
+{"version":3,"sources":["../../../../../../packages/nx-plugin/src/mcp-server/tools/general-guidance.ts"],"sourcesContent":["/**\n * Copyright Amazon.com, Inc. or its affiliates. All Rights Reserved.\n * SPDX-License-Identifier: Apache-2.0\n */\nimport type { McpServer } from '@modelcontextprotocol/sdk/server/mcp.js';\nimport type { NxGeneratorInfo } from '../../utils/generators.js';\nimport { IAC_PROVIDERS } from '../../utils/iac-providers.js';\nimport { buildNxCommand, fetchGuidePages } from '../generator-info.js';\nimport { PACKAGE_MANAGERS } from '../schema.js';\n\nexport const TOOL_SELECTION_GUIDE = `## Tool Selection Guide\n\n- Use the \\`general-guidance\\` tool for guidance and best practices for working with Nx and the Nx Plugin for AWS.\n- Use the \\`create-workspace-command\\` tool to discover how to create a workspace to start a new project.\n- Use the \\`add-to-existing-project\\` tool when adding the plugin to an existing Nx workspace or non-Nx monorepo, or when troubleshooting configuration errors in such a workspace.\n- Use the \\`upgrade-workspace\\` tool when upgrading Nx or the Nx Plugin for AWS to a newer version.\n- Use the \\`list-generators\\` tool to discover the available generators and how to run them.\n- Use the \\`generator-guide\\` tool to retrieve detailed information about a specific generator.`;\n\n/**\n * Add a tool which provides general guidance for using Nx and the Nx Plugin for AWS\n */\nexport const addGeneralGuidanceTool = (\n  server: McpServer,\n  generators: NxGeneratorInfo[],\n) => {\n  server.registerTool(\n    'general-guidance',\n    {\n      title: 'General Guidance',\n      description:\n        'Tool for guidance and best practices for working with Nx and the Nx Plugin for AWS',\n    },\n    async () => ({\n      content: [\n        {\n          type: 'text' as const,\n          text: `# Nx Plugin for AWS Guidance\n\n${TOOL_SELECTION_GUIDE}\n\n## Getting Started\n\n- Choose a package manager first. You can choose between ${PACKAGE_MANAGERS.join(', ')}. It's recommended to use \"pnpm\" if the user has no preference\n- Choose an infrastructure as code (IaC) provider next. You can choose between ${IAC_PROVIDERS.join(', ')}. It's recommended to use CDK if the user has no preference\n- Next, you must create an Nx workspace. Use the \\`create-workspace-command\\` tool for more details, and provide it with your chosen package manager\n- After this, you can start scaffolding the main components of your application using generators. Use the \\`list-generators\\` tool to discover available generators, and the \\`generator-guide\\` tool for more detailed information about a specific generator\n\n## Nx Primer\n\n- Prefix nx commands with the appropriate prefix for your package manager, for example:\n${PACKAGE_MANAGERS.map((pm) => buildNxCommand('<options>', pm)).join(' - \\n')}\n- Each project in your workspace has a file named \\`project.json\\` which contains important project information such as its name, and defines the \"targets\" which can be run for that project, for example building or testing the project\n- Use the command \\`nx reset\\` to reset the Nx daemon when unexpected issues arise\n- After adding dependencies between TypeScript projects, use \\`nx sync\\` to ensure project references are set up correctly\n\n## General Instructions\n\n- Each project declares the third-party runtime dependencies its source imports in its own \\`package.json\\`; shared build/test tooling (test runners, bundlers, etc.) is declared in the root \\`package.json\\` \\`devDependencies\\`. Versions follow a single version policy, recorded in the package manager's dependency catalog where supported (referenced as \\`catalog:\\`). Install with the appropriate command for your package manager:\n  - Add a project runtime dependency: \\`pnpm add <package> --filter <project>\\` / \\`yarn workspace <project> add <package>\\` / \\`npm install <package> -w <project>\\` / \\`bun add <package> --cwd <project-directory>\\`\n  - Add a shared dev tool at the root: \\`pnpm add -Dw <package>\\` / \\`yarn add -D <package>\\` / \\`npm install --legacy-peer-deps -D <package>\\` / \\`bun install -D <package>\\`\n- The \\`noUndeclaredDependencies\\` lint rule enforces that a project's source only imports packages declared in its own \\`package.json\\`\n- Projects in the same workspace can import one another directly by package name (eg \\`@workspace-name/project-name\\`) without declaring a dependency in \\`package.json\\` — TypeScript path aliases in \\`tsconfig.base.json\\` resolve these imports\n- When specifying project names as arguments to generators, prefer the _fully qualified_ project name, for example \\`@workspace-name/project-name\\`. Check the \\`project.json\\` file for the specific package to find its fully qualified name\n- When no generator exists for a specific framework required, use the base \\`ts#project\\` and \\`py#project\\` generators and build on top.\n- Leave the \\`--infra\\` option at its default value unless the user has explicitly instructed otherwise. Generators choose a sensible default type of infrastructure to deploy the project with, so only override \\`--infra\\` when the user has specified a particular requirement.\n\n## Useful Commands\n\n- Fix lint issues with \\`nx run-many --target lint --configuration=fix --all --output-style=stream\\`\n- Build all projects with \\`nx run-many --target build --all --output-style=stream\\`\n- Prefer importing the CDK constructs vended by generators in \\`packages/common/constructs\\` over writing your own\n\n## Best Practices\n\n- After running a generator, use the \\`nx show projects\\` command to check which projects have been added (if any)\n- Carefully examine the files that have been generated and always refer back to the generator guide when working in a generated project\n- Generate all projects into the \\`packages/\\` directory\n- After making changes to your projects, fix linting issues, then run a full build\n- When it's time to start testing a project, suggest to the user that infrastructure is deployed to AWS. For websites, if a runtime-config.json is needed, use the load-runtime-config target after a deployment to point a local website at a sandbox stack.\n- For CDK infrastructure projects, deploy the sandbox stage with the \\`deploy-sandbox\\` target (eg \\`nx deploy-sandbox infra\\`) rather than passing a stage pattern to \\`deploy\\` — it already targets the sandbox stage declared in \\`main.ts\\`.\n\n## Batching Generators\n\nWhen scaffolding several projects in one go, chain generators to avoid a slow dependency install after every generator:\n\n- **Chain generators** with \\`&&\\` in a single command. Pass \\`--prefer-install-dependencies=false\\` on each generator except the last so dependencies install once at the end, for example:\n\n${PACKAGE_MANAGERS.map(\n  (pm) => `  \\`\\`\\`bash\n  ${buildNxCommand('g @aws/nx-plugin:ts#trpc-api --no-interactive --name=my-app-api --auth=iam --prefer-install-dependencies=false', pm)} && \\\\\n    ${buildNxCommand('g @aws/nx-plugin:ts#react-website --no-interactive --name=my-app-website --prefer-install-dependencies=false', pm)} && \\\\\n    ${buildNxCommand('g @aws/nx-plugin:connection --no-interactive --sourceProject=@my-app/my-app-website --targetProject=@my-app/my-app-api --prefer-install-dependencies=false', pm)} && \\\\\n    ${buildNxCommand('g @aws/nx-plugin:ts#infra --no-interactive --name=infra', pm)} && \\\\\n    ${buildNxCommand('sync', pm)}\n  \\`\\`\\``,\n).join('\\n')}\n\n- **\\`--prefer-install-dependencies=false\\`** asks a generator to defer its dependency install so the batch installs once at the end (the final generator above omits the flag and installs everything).\n- **\\`nx sync\\`** is required before building — generators modify TypeScript project references.\n\n## Detailed Guides\n\nPlease refer to the below documentation for important details regarding workspaces and working with TypeScript or Python projects.\n\n${await fetchGuidePages(['workspace', 'typescript-project', 'python-project'], generators)}\n\n    `,\n        },\n      ],\n    }),\n  );\n};\n"],"names":["IAC_PROVIDERS","buildNxCommand","fetchGuidePages","PACKAGE_MANAGERS","TOOL_SELECTION_GUIDE","addGeneralGuidanceTool","server","generators","registerTool","title","description","content","type","text","join","map","pm"],"mappings":"AAAA;;;CAGC,GAGD,SAASA,aAAa,QAAQ,+BAA+B;AAC7D,SAASC,cAAc,EAAEC,eAAe,QAAQ,uBAAuB;AACvE,SAASC,gBAAgB,QAAQ,eAAe;AAEhD,OAAO,MAAMC,uBAAuB,CAAC;;;;;;;+FAO0D,CAAC,CAAC;AAEjG;;CAEC,GACD,OAAO,MAAMC,yBAAyB,CACpCC,QACAC;IAEAD,OAAOE,YAAY,CACjB,oBACA;QACEC,OAAO;QACPC,aACE;IACJ,GACA,UAAa,CAAA;YACXC,SAAS;gBACP;oBACEC,MAAM;oBACNC,MAAM,CAAC;;AAEjB,EAAET,qBAAqB;;;;yDAIkC,EAAED,iBAAiBW,IAAI,CAAC,MAAM;+EACR,EAAEd,cAAcc,IAAI,CAAC,MAAM;;;;;;;AAO1G,EAAEX,iBAAiBY,GAAG,CAAC,CAACC,KAAOf,eAAe,aAAae,KAAKF,IAAI,CAAC,SAAS;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAqC9E,EAAEX,iBAAiBY,GAAG,CACpB,CAACC,KAAO,CAAC;EACT,EAAEf,eAAe,kHAAkHe,IAAI;IACrI,EAAEf,eAAe,gHAAgHe,IAAI;IACrI,EAAEf,eAAe,8JAA8Je,IAAI;IACnL,EAAEf,eAAe,2DAA2De,IAAI;IAChF,EAAEf,eAAe,QAAQe,IAAI;QACzB,CAAC,EACPF,IAAI,CAAC,MAAM;;;;;;;;;AASb,EAAE,MAAMZ,gBAAgB;wBAAC;wBAAa;wBAAsB;qBAAiB,EAAEK,YAAY;;IAEvF,CAAC;gBACG;aACD;QACH,CAAA;AAEJ,EAAE"}

package/src/mcp-server/tools/generator-guide.d.ts

@@ -3,7 +3,7 @@
  * SPDX-License-Identifier: Apache-2.0
  */
 import type { McpServer } from '@modelcontextprotocol/sdk/server/mcp.js';
-import type { NxGeneratorInfo } from '../../utils/generators';
+import type { NxGeneratorInfo } from '../../utils/generators.js';
 /**
  * Add a tool which provides a detailed guide for an individual generator.
  *

package/src/mcp-server/tools/generator-guide.js

@@ -1,9 +1,9 @@
-"use strict";
-Object.defineProperty(exports, "__esModule", { value: true });
-exports.addGeneratorGuideTool = void 0;
-const zod_1 = require("zod");
-const generator_info_1 = require("../generator-info");
-const schema_1 = require("../schema");
+/**
+ * Copyright Amazon.com, Inc. or its affiliates. All Rights Reserved.
+ * SPDX-License-Identifier: Apache-2.0
+ */ import { z } from "zod";
+import { fetchGuidePagesForGenerator, renderGeneratorInfo } from "../generator-info.js";
+import { PackageManagerSchema } from "../schema.js";
 /**
  * Add a tool which provides a detailed guide for an individual generator.
  *
@@ -12,55 +12,47 @@ const schema_1 = require("../schema");
  * — and the "unsupported combination" case, where it returns an explicit
  * warning instead of empty guide content. The tool description points
  * agents at `list-generators` for the list of filterable options.
- */
-const addGeneratorGuideTool = (server, generators) => {
+ */ export const addGeneratorGuideTool = (server, generators)=>{
     server.registerTool('generator-guide', {
-        description: 'Tool to retrieve detailed information about a specific generator. ' +
-            'Pass `options` with the values you intend to use for any filterable option ' +
-            '(e.g. infra, iac, auth, ux, protocol, sourceType, targetType) ' +
-            'to receive only the guide content relevant to those choices — this cuts noise ' +
-            'and avoids suggesting configuration from a different branch. The filterable keys ' +
-            'and their valid values for each generator are listed by the `list-generators` ' +
-            'tool; call it first if you are not sure which keys to pass. When the combination ' +
-            'you pick is not supported by the generator (e.g. connection from ts#trpc-api ' +
-            'to smithy), the tool returns an "Unsupported combination" warning with the ' +
-            'list of supported pairs. When `options` is omitted, every conditional section ' +
-            'is included and prefixed with a `> [!NOTE] Only when …` marker so you can see ' +
-            'the branching condition.',
+        description: 'Tool to retrieve detailed information about a specific generator. ' + 'Pass `options` with the values you intend to use for any filterable option ' + '(e.g. infra, iac, auth, ux, protocol, sourceType, targetType) ' + 'to receive only the guide content relevant to those choices — this cuts noise ' + 'and avoids suggesting configuration from a different branch. The filterable keys ' + 'and their valid values for each generator are listed by the `list-generators` ' + 'tool; call it first if you are not sure which keys to pass. When the combination ' + 'you pick is not supported by the generator (e.g. connection from ts#trpc-api ' + 'to smithy), the tool returns an "Unsupported combination" warning with the ' + 'list of supported pairs. When `options` is omitted, every conditional section ' + 'is included and prefixed with a `> [!NOTE] Only when …` marker so you can see ' + 'the branching condition.',
         inputSchema: {
-            packageManager: schema_1.PackageManagerSchema,
-            generator: zod_1.z.enum(generators.map((g) => g.id)),
-            options: zod_1.z
-                .record(zod_1.z.string(), zod_1.z.string())
-                .optional()
-                .describe('Optional map of generator option values (e.g. { infra: "rest-lambda", iac: "cdk" }) used to filter the guide to content that applies to those choices.'),
-        },
-    }, async ({ packageManager, generator: generatorId, options }) => {
-        const generator = generators.find((g) => g.id === generatorId);
+            packageManager: PackageManagerSchema,
+            generator: z.enum(generators.map((g)=>g.id)),
+            options: z.record(z.string(), z.string()).optional().describe('Optional map of generator option values (e.g. { infra: "rest-lambda", iac: "cdk" }) used to filter the guide to content that applies to those choices.')
+        }
+    }, async ({ packageManager, generator: generatorId, options })=>{
+        const generator = generators.find((g)=>g.id === generatorId);
         if (!generator) {
-            throw new Error(`No generator found with id ${generatorId}. Available generators: ${generators.map((g) => g.id).join(' ,')}`);
+            throw new Error(`No generator found with id ${generatorId}. Available generators: ${generators.map((g)=>g.id).join(' ,')}`);
         }
-        const guide = await (0, generator_info_1.fetchGuidePagesForGenerator)(generator, generators, packageManager, undefined, options);
+        const guide = await fetchGuidePagesForGenerator(generator, generators, packageManager, undefined, options);
         // An unsupported combination renders its own self-contained warning
         // (leads with `## <id>` and lists the supported predicates), so
         // return it directly without the usual guide header.
         if (guide.kind === 'unsupported') {
-            return { content: [{ type: 'text', text: guide.content }] };
+            return {
+                content: [
+                    {
+                        type: 'text',
+                        text: guide.content
+                    }
+                ]
+            };
         }
         return {
             content: [
                 {
                     type: 'text',
-                    text: `## ${(0, generator_info_1.renderGeneratorInfo)(packageManager, generator)}
+                    text: `## ${renderGeneratorInfo(packageManager, generator)}
 
 # Guide
 
 ${guide.content}
-`,
-                },
-            ],
+`
+                }
+            ]
         };
     });
 };
-exports.addGeneratorGuideTool = addGeneratorGuideTool;
+
 //# sourceMappingURL=generator-guide.js.map

package/src/mcp-server/tools/generator-guide.js.map

@@ -1 +1 @@
-{"version":3,"file":"generator-guide.js","sourceRoot":"","sources":["../../../../../../packages/nx-plugin/src/mcp-server/tools/generator-guide.ts"],"names":[],"mappings":";;;AAKA,6BAAwB;AAExB,sDAG2B;AAC3B,sCAAiD;AAEjD;;;;;;;;GAQG;AACI,MAAM,qBAAqB,GAAG,CACnC,MAAiB,EACjB,UAA6B,EAC7B,EAAE;IACF,MAAM,CAAC,YAAY,CACjB,iBAAiB,EACjB;QACE,WAAW,EACT,oEAAoE;YACpE,6EAA6E;YAC7E,gEAAgE;YAChE,gFAAgF;YAChF,mFAAmF;YACnF,gFAAgF;YAChF,mFAAmF;YACnF,+EAA+E;YAC/E,6EAA6E;YAC7E,gFAAgF;YAChF,gFAAgF;YAChF,0BAA0B;QAC5B,WAAW,EAAE;YACX,cAAc,EAAE,6BAAoB;YACpC,SAAS,EAAE,OAAC,CAAC,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC;YAC9C,OAAO,EAAE,OAAC;iBACP,MAAM,CAAC,OAAC,CAAC,MAAM,EAAE,EAAE,OAAC,CAAC,MAAM,EAAE,CAAC;iBAC9B,QAAQ,EAAE;iBACV,QAAQ,CACP,wJAAwJ,CACzJ;SACJ;KACF,EACD,KAAK,EAAE,EAAE,cAAc,EAAE,SAAS,EAAE,WAAW,EAAE,OAAO,EAAE,EAAE,EAAE;QAC5D,MAAM,SAAS,GAAG,UAAU,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,KAAK,WAAW,CAAC,CAAC;QAC/D,IAAI,CAAC,SAAS,EAAE,CAAC;YACf,MAAM,IAAI,KAAK,CACb,8BAA8B,WAAW,2BAA2B,UAAU,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAC7G,CAAC;QACJ,CAAC;QAED,MAAM,KAAK,GAAG,MAAM,IAAA,4CAA2B,EAC7C,SAAS,EACT,UAAU,EACV,cAAc,EACd,SAAS,EACT,OAAO,CACR,CAAC;QAEF,oEAAoE;QACpE,gEAAgE;QAChE,qDAAqD;QACrD,IAAI,KAAK,CAAC,IAAI,KAAK,aAAa,EAAE,CAAC;YACjC,OAAO,EAAE,OAAO,EAAE,CAAC,EAAE,IAAI,EAAE,MAAe,EAAE,IAAI,EAAE,KAAK,CAAC,OAAO,EAAE,CAAC,EAAE,CAAC;QACvE,CAAC;QAED,OAAO;YACL,OAAO,EAAE;gBACP;oBACE,IAAI,EAAE,MAAe;oBACrB,IAAI,EAAE,MAAM,IAAA,oCAAmB,EAAC,cAAc,EAAE,SAAS,CAAC;;;;EAIpE,KAAK,CAAC,OAAO;CACd;iBACU;aACF;SACF,CAAC;IACJ,CAAC,CACF,CAAC;AACJ,CAAC,CAAC;AArEW,QAAA,qBAAqB,yBAqEhC"}
+{"version":3,"sources":["../../../../../../packages/nx-plugin/src/mcp-server/tools/generator-guide.ts"],"sourcesContent":["/**\n * Copyright Amazon.com, Inc. or its affiliates. All Rights Reserved.\n * SPDX-License-Identifier: Apache-2.0\n */\nimport type { McpServer } from '@modelcontextprotocol/sdk/server/mcp.js';\nimport { z } from 'zod';\nimport type { NxGeneratorInfo } from '../../utils/generators.js';\nimport {\n  fetchGuidePagesForGenerator,\n  renderGeneratorInfo,\n} from '../generator-info.js';\nimport { PackageManagerSchema } from '../schema.js';\n\n/**\n * Add a tool which provides a detailed guide for an individual generator.\n *\n * `fetchGuidePagesForGenerator` handles both the \"narrow by `options`\"\n * case — reading each page's frontmatter `when:` to pick matching variants\n * — and the \"unsupported combination\" case, where it returns an explicit\n * warning instead of empty guide content. The tool description points\n * agents at `list-generators` for the list of filterable options.\n */\nexport const addGeneratorGuideTool = (\n  server: McpServer,\n  generators: NxGeneratorInfo[],\n) => {\n  server.registerTool(\n    'generator-guide',\n    {\n      description:\n        'Tool to retrieve detailed information about a specific generator. ' +\n        'Pass `options` with the values you intend to use for any filterable option ' +\n        '(e.g. infra, iac, auth, ux, protocol, sourceType, targetType) ' +\n        'to receive only the guide content relevant to those choices — this cuts noise ' +\n        'and avoids suggesting configuration from a different branch. The filterable keys ' +\n        'and their valid values for each generator are listed by the `list-generators` ' +\n        'tool; call it first if you are not sure which keys to pass. When the combination ' +\n        'you pick is not supported by the generator (e.g. connection from ts#trpc-api ' +\n        'to smithy), the tool returns an \"Unsupported combination\" warning with the ' +\n        'list of supported pairs. When `options` is omitted, every conditional section ' +\n        'is included and prefixed with a `> [!NOTE] Only when …` marker so you can see ' +\n        'the branching condition.',\n      inputSchema: {\n        packageManager: PackageManagerSchema,\n        generator: z.enum(generators.map((g) => g.id)),\n        options: z\n          .record(z.string(), z.string())\n          .optional()\n          .describe(\n            'Optional map of generator option values (e.g. { infra: \"rest-lambda\", iac: \"cdk\" }) used to filter the guide to content that applies to those choices.',\n          ),\n      },\n    },\n    async ({ packageManager, generator: generatorId, options }) => {\n      const generator = generators.find((g) => g.id === generatorId);\n      if (!generator) {\n        throw new Error(\n          `No generator found with id ${generatorId}. Available generators: ${generators.map((g) => g.id).join(' ,')}`,\n        );\n      }\n\n      const guide = await fetchGuidePagesForGenerator(\n        generator,\n        generators,\n        packageManager,\n        undefined,\n        options,\n      );\n\n      // An unsupported combination renders its own self-contained warning\n      // (leads with `## <id>` and lists the supported predicates), so\n      // return it directly without the usual guide header.\n      if (guide.kind === 'unsupported') {\n        return { content: [{ type: 'text' as const, text: guide.content }] };\n      }\n\n      return {\n        content: [\n          {\n            type: 'text' as const,\n            text: `## ${renderGeneratorInfo(packageManager, generator)}\n\n# Guide\n\n${guide.content}\n`,\n          },\n        ],\n      };\n    },\n  );\n};\n"],"names":["z","fetchGuidePagesForGenerator","renderGeneratorInfo","PackageManagerSchema","addGeneratorGuideTool","server","generators","registerTool","description","inputSchema","packageManager","generator","enum","map","g","id","options","record","string","optional","describe","generatorId","find","Error","join","guide","undefined","kind","content","type","text"],"mappings":"AAAA;;;CAGC,GAED,SAASA,CAAC,QAAQ,MAAM;AAExB,SACEC,2BAA2B,EAC3BC,mBAAmB,QACd,uBAAuB;AAC9B,SAASC,oBAAoB,QAAQ,eAAe;AAEpD;;;;;;;;CAQC,GACD,OAAO,MAAMC,wBAAwB,CACnCC,QACAC;IAEAD,OAAOE,YAAY,CACjB,mBACA;QACEC,aACE,uEACA,gFACA,mEACA,mFACA,sFACA,mFACA,sFACA,kFACA,gFACA,mFACA,mFACA;QACFC,aAAa;YACXC,gBAAgBP;YAChBQ,WAAWX,EAAEY,IAAI,CAACN,WAAWO,GAAG,CAAC,CAACC,IAAMA,EAAEC,EAAE;YAC5CC,SAAShB,EACNiB,MAAM,CAACjB,EAAEkB,MAAM,IAAIlB,EAAEkB,MAAM,IAC3BC,QAAQ,GACRC,QAAQ,CACP;QAEN;IACF,GACA,OAAO,EAAEV,cAAc,EAAEC,WAAWU,WAAW,EAAEL,OAAO,EAAE;QACxD,MAAML,YAAYL,WAAWgB,IAAI,CAAC,CAACR,IAAMA,EAAEC,EAAE,KAAKM;QAClD,IAAI,CAACV,WAAW;YACd,MAAM,IAAIY,MACR,CAAC,2BAA2B,EAAEF,YAAY,wBAAwB,EAAEf,WAAWO,GAAG,CAAC,CAACC,IAAMA,EAAEC,EAAE,EAAES,IAAI,CAAC,OAAO;QAEhH;QAEA,MAAMC,QAAQ,MAAMxB,4BAClBU,WACAL,YACAI,gBACAgB,WACAV;QAGF,oEAAoE;QACpE,gEAAgE;QAChE,qDAAqD;QACrD,IAAIS,MAAME,IAAI,KAAK,eAAe;YAChC,OAAO;gBAAEC,SAAS;oBAAC;wBAAEC,MAAM;wBAAiBC,MAAML,MAAMG,OAAO;oBAAC;iBAAE;YAAC;QACrE;QAEA,OAAO;YACLA,SAAS;gBACP;oBACEC,MAAM;oBACNC,MAAM,CAAC,GAAG,EAAE5B,oBAAoBQ,gBAAgBC,WAAW;;;;AAIvE,EAAEc,MAAMG,OAAO,CAAC;AAChB,CAAC;gBACS;aACD;QACH;IACF;AAEJ,EAAE"}

package/src/mcp-server/tools/list-generators.d.ts

@@ -3,7 +3,7 @@
  * SPDX-License-Identifier: Apache-2.0
  */
 import type { McpServer } from '@modelcontextprotocol/sdk/server/mcp.js';
-import type { NxGeneratorInfo } from '../../utils/generators';
+import type { NxGeneratorInfo } from '../../utils/generators.js';
 /**
  * Adds a tool which lists details about the available generators.
  *

package/src/mcp-server/tools/list-generators.js

@@ -1,8 +1,8 @@
-"use strict";
-Object.defineProperty(exports, "__esModule", { value: true });
-exports.addListGeneratorsTool = void 0;
-const generator_info_1 = require("../generator-info");
-const schema_1 = require("../schema");
+/**
+ * Copyright Amazon.com, Inc. or its affiliates. All Rights Reserved.
+ * SPDX-License-Identifier: Apache-2.0
+ */ import { renderFilterableOptionsAsync, renderGeneratorInfo } from "../generator-info.js";
+import { PackageManagerSchema } from "../schema.js";
 /**
  * Adds a tool which lists details about the available generators.
  *
@@ -14,34 +14,28 @@ const schema_1 = require("../schema");
  *   - The union of `when:` frontmatter keys across the generator's guide
  *     pages (lets multi-variant generators like `connection` surface
  *     `sourceType` / `targetType` / `protocol` without any bespoke config).
- */
-const addListGeneratorsTool = (server, generators) => {
+ */ export const addListGeneratorsTool = (server, generators)=>{
     server.registerTool('list-generators', {
-        description: 'Tool to discover the available generators and how to run them. ' +
-            'Each entry includes a "Filterable options" section — pass those ' +
-            'keys to `generator-guide` before invoking a generator so the guide ' +
-            'is narrowed to the variant you intend to scaffold.',
-        inputSchema: { packageManager: schema_1.PackageManagerSchema },
-    }, async ({ packageManager }) => {
-        const entries = await Promise.all(generators.map(async (g) => {
-            const info = (0, generator_info_1.renderGeneratorInfo)(packageManager, g);
-            const filterable = await (0, generator_info_1.renderFilterableOptionsAsync)(g);
+        description: 'Tool to discover the available generators and how to run them. ' + 'Each entry includes a "Filterable options" section — pass those ' + 'keys to `generator-guide` before invoking a generator so the guide ' + 'is narrowed to the variant you intend to scaffold.',
+        inputSchema: {
+            packageManager: PackageManagerSchema
+        }
+    }, async ({ packageManager })=>{
+        const entries = await Promise.all(generators.map(async (g)=>{
+            const info = renderGeneratorInfo(packageManager, g);
+            const filterable = await renderFilterableOptionsAsync(g);
             return `### ${info}${filterable ? `\n${filterable}\n` : ''}`;
         }));
-        const guidance = 'Before running any generator below, call `generator-guide` with the ' +
-            "generator's id and `options` populated from its `generator-guide options` " +
-            'list — the guide is returned narrowed to the branches that apply to ' +
-            'those choices, which keeps you from mixing configuration from a ' +
-            'different variant.';
+        const guidance = 'Before running any generator below, call `generator-guide` with the ' + "generator's id and `options` populated from its `generator-guide options` " + 'list — the guide is returned narrowed to the branches that apply to ' + 'those choices, which keeps you from mixing configuration from a ' + 'different variant.';
         return {
             content: [
                 {
                     type: 'text',
-                    text: `## Available Generators\n\n${guidance}\n\n${entries.join('\n\n')}\n`,
-                },
-            ],
+                    text: `## Available Generators\n\n${guidance}\n\n${entries.join('\n\n')}\n`
+                }
+            ]
         };
     });
 };
-exports.addListGeneratorsTool = addListGeneratorsTool;
+
 //# sourceMappingURL=list-generators.js.map

package/src/mcp-server/tools/list-generators.js.map

@@ -1 +1 @@
-{"version":3,"file":"list-generators.js","sourceRoot":"","sources":["../../../../../../packages/nx-plugin/src/mcp-server/tools/list-generators.ts"],"names":[],"mappings":";;;AAMA,sDAG2B;AAC3B,sCAAiD;AAEjD;;;;;;;;;;;GAWG;AACI,MAAM,qBAAqB,GAAG,CACnC,MAAiB,EACjB,UAA6B,EAC7B,EAAE;IACF,MAAM,CAAC,YAAY,CACjB,iBAAiB,EACjB;QACE,WAAW,EACT,iEAAiE;YACjE,kEAAkE;YAClE,qEAAqE;YACrE,oDAAoD;QACtD,WAAW,EAAE,EAAE,cAAc,EAAE,6BAAoB,EAAE;KACtD,EACD,KAAK,EAAE,EAAE,cAAc,EAAE,EAAE,EAAE;QAC3B,MAAM,OAAO,GAAG,MAAM,OAAO,CAAC,GAAG,CAC/B,UAAU,CAAC,GAAG,CAAC,KAAK,EAAE,CAAC,EAAE,EAAE;YACzB,MAAM,IAAI,GAAG,IAAA,oCAAmB,EAAC,cAAc,EAAE,CAAC,CAAC,CAAC;YACpD,MAAM,UAAU,GAAG,MAAM,IAAA,6CAA4B,EAAC,CAAC,CAAC,CAAC;YACzD,OAAO,OAAO,IAAI,GAAG,UAAU,CAAC,CAAC,CAAC,KAAK,UAAU,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC;QAC/D,CAAC,CAAC,CACH,CAAC;QACF,MAAM,QAAQ,GACZ,sEAAsE;YACtE,4EAA4E;YAC5E,sEAAsE;YACtE,kEAAkE;YAClE,oBAAoB,CAAC;QACvB,OAAO;YACL,OAAO,EAAE;gBACP;oBACE,IAAI,EAAE,MAAe;oBACrB,IAAI,EAAE,8BAA8B,QAAQ,OAAO,OAAO,CAAC,IAAI,CAAC,MAAM,CAAC,IAAI;iBAC5E;aACF;SACF,CAAC;IACJ,CAAC,CACF,CAAC;AACJ,CAAC,CAAC;AAtCW,QAAA,qBAAqB,yBAsChC"}
+{"version":3,"sources":["../../../../../../packages/nx-plugin/src/mcp-server/tools/list-generators.ts"],"sourcesContent":["/**\n * Copyright Amazon.com, Inc. or its affiliates. All Rights Reserved.\n * SPDX-License-Identifier: Apache-2.0\n */\nimport type { McpServer } from '@modelcontextprotocol/sdk/server/mcp.js';\nimport type { NxGeneratorInfo } from '../../utils/generators.js';\nimport {\n  renderFilterableOptionsAsync,\n  renderGeneratorInfo,\n} from '../generator-info.js';\nimport { PackageManagerSchema } from '../schema.js';\n\n/**\n * Adds a tool which lists details about the available generators.\n *\n * Each entry carries a \"Filterable options\" section that tells the agent\n * which keys it can pass to `generator-guide` to narrow the guide response\n * to only the branches relevant to its selection. The keys come from two\n * sources, merged transparently:\n *   - Enum properties from the generator's JSON schema.\n *   - The union of `when:` frontmatter keys across the generator's guide\n *     pages (lets multi-variant generators like `connection` surface\n *     `sourceType` / `targetType` / `protocol` without any bespoke config).\n */\nexport const addListGeneratorsTool = (\n  server: McpServer,\n  generators: NxGeneratorInfo[],\n) => {\n  server.registerTool(\n    'list-generators',\n    {\n      description:\n        'Tool to discover the available generators and how to run them. ' +\n        'Each entry includes a \"Filterable options\" section — pass those ' +\n        'keys to `generator-guide` before invoking a generator so the guide ' +\n        'is narrowed to the variant you intend to scaffold.',\n      inputSchema: { packageManager: PackageManagerSchema },\n    },\n    async ({ packageManager }) => {\n      const entries = await Promise.all(\n        generators.map(async (g) => {\n          const info = renderGeneratorInfo(packageManager, g);\n          const filterable = await renderFilterableOptionsAsync(g);\n          return `### ${info}${filterable ? `\\n${filterable}\\n` : ''}`;\n        }),\n      );\n      const guidance =\n        'Before running any generator below, call `generator-guide` with the ' +\n        \"generator's id and `options` populated from its `generator-guide options` \" +\n        'list — the guide is returned narrowed to the branches that apply to ' +\n        'those choices, which keeps you from mixing configuration from a ' +\n        'different variant.';\n      return {\n        content: [\n          {\n            type: 'text' as const,\n            text: `## Available Generators\\n\\n${guidance}\\n\\n${entries.join('\\n\\n')}\\n`,\n          },\n        ],\n      };\n    },\n  );\n};\n"],"names":["renderFilterableOptionsAsync","renderGeneratorInfo","PackageManagerSchema","addListGeneratorsTool","server","generators","registerTool","description","inputSchema","packageManager","entries","Promise","all","map","g","info","filterable","guidance","content","type","text","join"],"mappings":"AAAA;;;CAGC,GAGD,SACEA,4BAA4B,EAC5BC,mBAAmB,QACd,uBAAuB;AAC9B,SAASC,oBAAoB,QAAQ,eAAe;AAEpD;;;;;;;;;;;CAWC,GACD,OAAO,MAAMC,wBAAwB,CACnCC,QACAC;IAEAD,OAAOE,YAAY,CACjB,mBACA;QACEC,aACE,oEACA,qEACA,wEACA;QACFC,aAAa;YAAEC,gBAAgBP;QAAqB;IACtD,GACA,OAAO,EAAEO,cAAc,EAAE;QACvB,MAAMC,UAAU,MAAMC,QAAQC,GAAG,CAC/BP,WAAWQ,GAAG,CAAC,OAAOC;YACpB,MAAMC,OAAOd,oBAAoBQ,gBAAgBK;YACjD,MAAME,aAAa,MAAMhB,6BAA6Bc;YACtD,OAAO,CAAC,IAAI,EAAEC,OAAOC,aAAa,CAAC,EAAE,EAAEA,WAAW,EAAE,CAAC,GAAG,IAAI;QAC9D;QAEF,MAAMC,WACJ,yEACA,+EACA,yEACA,qEACA;QACF,OAAO;YACLC,SAAS;gBACP;oBACEC,MAAM;oBACNC,MAAM,CAAC,2BAA2B,EAAEH,SAAS,IAAI,EAAEP,QAAQW,IAAI,CAAC,QAAQ,EAAE,CAAC;gBAC7E;aACD;QACH;IACF;AAEJ,EAAE"}

package/src/mcp-server/tools/upgrade-workspace.d.ts

@@ -0,0 +1,11 @@
+/**
+ * Copyright Amazon.com, Inc. or its affiliates. All Rights Reserved.
+ * SPDX-License-Identifier: Apache-2.0
+ */
+import type { McpServer } from '@modelcontextprotocol/sdk/server/mcp.js';
+import type { NxGeneratorInfo } from '../../utils/generators.js';
+/**
+ * Add a tool which guides an agent through upgrading Nx and @aws/nx-plugin in a
+ * workspace, returning the `upgrading` docs page.
+ */
+export declare const addUpgradeWorkspaceTool: (server: McpServer, generators: NxGeneratorInfo[]) => void;

package/src/mcp-server/tools/upgrade-workspace.js

@@ -0,0 +1,32 @@
+/**
+ * Copyright Amazon.com, Inc. or its affiliates. All Rights Reserved.
+ * SPDX-License-Identifier: Apache-2.0
+ */ import { fetchGuidePages } from "../generator-info.js";
+import { PackageManagerSchema } from "../schema.js";
+/** The guide page backing this tool, so it never drifts from the docs. */ const UPGRADING_GUIDE = 'upgrading';
+/**
+ * Add a tool which guides an agent through upgrading Nx and @aws/nx-plugin in a
+ * workspace, returning the `upgrading` docs page.
+ */ export const addUpgradeWorkspaceTool = (server, generators)=>{
+    server.registerTool('upgrade-workspace', {
+        title: 'Upgrade Workspace',
+        description: 'Tool for upgrading Nx and the Nx Plugin for AWS in a workspace. Use this when a user wants to update @aws/nx-plugin or Nx to a newer version, or asks how to run migrations with nx migrate.',
+        inputSchema: {
+            packageManager: PackageManagerSchema.optional()
+        }
+    }, async ({ packageManager })=>{
+        const guide = await fetchGuidePages([
+            UPGRADING_GUIDE
+        ], generators, packageManager);
+        return {
+            content: [
+                {
+                    type: 'text',
+                    text: guide
+                }
+            ]
+        };
+    });
+};
+
+//# sourceMappingURL=upgrade-workspace.js.map

package/src/mcp-server/tools/upgrade-workspace.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../../../../../../packages/nx-plugin/src/mcp-server/tools/upgrade-workspace.ts"],"sourcesContent":["/**\n * Copyright Amazon.com, Inc. or its affiliates. All Rights Reserved.\n * SPDX-License-Identifier: Apache-2.0\n */\nimport type { McpServer } from '@modelcontextprotocol/sdk/server/mcp.js';\nimport type { NxGeneratorInfo } from '../../utils/generators.js';\nimport { fetchGuidePages } from '../generator-info.js';\nimport { PackageManagerSchema } from '../schema.js';\n\n/** The guide page backing this tool, so it never drifts from the docs. */\nconst UPGRADING_GUIDE = 'upgrading';\n\n/**\n * Add a tool which guides an agent through upgrading Nx and @aws/nx-plugin in a\n * workspace, returning the `upgrading` docs page.\n */\nexport const addUpgradeWorkspaceTool = (\n  server: McpServer,\n  generators: NxGeneratorInfo[],\n) => {\n  server.registerTool(\n    'upgrade-workspace',\n    {\n      title: 'Upgrade Workspace',\n      description:\n        'Tool for upgrading Nx and the Nx Plugin for AWS in a workspace. Use this when a user wants to update @aws/nx-plugin or Nx to a newer version, or asks how to run migrations with nx migrate.',\n      inputSchema: {\n        packageManager: PackageManagerSchema.optional(),\n      },\n    },\n    async ({ packageManager }) => {\n      const guide = await fetchGuidePages(\n        [UPGRADING_GUIDE],\n        generators,\n        packageManager,\n      );\n      return {\n        content: [\n          {\n            type: 'text' as const,\n            text: guide,\n          },\n        ],\n      };\n    },\n  );\n};\n"],"names":["fetchGuidePages","PackageManagerSchema","UPGRADING_GUIDE","addUpgradeWorkspaceTool","server","generators","registerTool","title","description","inputSchema","packageManager","optional","guide","content","type","text"],"mappings":"AAAA;;;CAGC,GAGD,SAASA,eAAe,QAAQ,uBAAuB;AACvD,SAASC,oBAAoB,QAAQ,eAAe;AAEpD,wEAAwE,GACxE,MAAMC,kBAAkB;AAExB;;;CAGC,GACD,OAAO,MAAMC,0BAA0B,CACrCC,QACAC;IAEAD,OAAOE,YAAY,CACjB,qBACA;QACEC,OAAO;QACPC,aACE;QACFC,aAAa;YACXC,gBAAgBT,qBAAqBU,QAAQ;QAC/C;IACF,GACA,OAAO,EAAED,cAAc,EAAE;QACvB,MAAME,QAAQ,MAAMZ,gBAClB;YAACE;SAAgB,EACjBG,YACAK;QAEF,OAAO;YACLG,SAAS;gBACP;oBACEC,MAAM;oBACNC,MAAMH;gBACR;aACD;QACH;IACF;AAEJ,EAAE"}

package/src/migrations/latest/apt-security-updates-in-container-images/__snapshots__/migration.spec.ts.snap

@@ -0,0 +1,90 @@
+// Vitest Snapshot v1, https://vitest.dev/guide/snapshot.html
+
+exports[`apt-security-updates-in-container-images migration > adds the security updates to a py#agent Dockerfile 1`] = `
+"FROM public.ecr.aws/docker/library/python:3.14-slim
+
+# Apply the distribution's security updates: base image tags lag behind the
+# security suite, so its OS packages carry fixed HIGH/CRITICAL vulnerabilities
+# flagged by the image scan.
+RUN apt-get update && \\
+    apt-get upgrade -y --no-install-recommends && \\
+    rm -rf /var/lib/apt/lists/*
+
+# Remove the base image's pip: the agent runs from the bundled environment and
+# never needs it at runtime, and pip's vendored packages carry known
+# HIGH/CRITICAL vulnerabilities flagged by the image scan.
+RUN python -m pip uninstall -y pip && \\
+    rm -rf /usr/local/lib/python*/site-packages/pip \\
+           /usr/local/lib/python*/site-packages/pip-*.dist-info
+
+WORKDIR /app
+
+# Copy bundled package
+COPY . /app
+
+EXPOSE 8080
+
+ENV PYTHONPATH=/app
+ENV PATH="/app/bin:\${PATH}"
+
+CMD ["python", "bin/opentelemetry-instrument", "python", "-m", "proj_py_project.my_agent.main"]
+"
+`;
+
+exports[`apt-security-updates-in-container-images migration > adds the security updates to a py#mcp-server Dockerfile 1`] = `
+"FROM public.ecr.aws/docker/library/python:3.14-slim
+
+# Apply the distribution's security updates: base image tags lag behind the
+# security suite, so its OS packages carry fixed HIGH/CRITICAL vulnerabilities
+# flagged by the image scan.
+RUN apt-get update && \\
+    apt-get upgrade -y --no-install-recommends && \\
+    rm -rf /var/lib/apt/lists/*
+
+# Remove the base image's pip: the server runs from the bundled environment and
+# never needs it at runtime, and pip's vendored packages carry known
+# HIGH/CRITICAL vulnerabilities flagged by the image scan.
+RUN python -m pip uninstall -y pip && \\
+    rm -rf /usr/local/lib/python*/site-packages/pip \\
+           /usr/local/lib/python*/site-packages/pip-*.dist-info
+
+WORKDIR /app
+
+# Copy bundled package
+COPY . /app
+
+EXPOSE 8000
+
+ENV PYTHONPATH=/app
+
+CMD ["python", "bin/opentelemetry-instrument", "python", "-m", "uvicorn", "proj_py_project.my_mcp.http:app", "--host", "0.0.0.0", "--port", "8000"]
+"
+`;
+
+exports[`apt-security-updates-in-container-images migration > adds the security updates to a ts#agent Dockerfile 1`] = `
+"FROM public.ecr.aws/docker/library/node:lts-slim
+
+# Apply the distribution's security updates: base image tags lag behind the
+# security suite, so its OS packages carry fixed HIGH/CRITICAL vulnerabilities
+# flagged by the image scan.
+RUN apt-get update && \\
+    apt-get upgrade -y --no-install-recommends && \\
+    rm -rf /var/lib/apt/lists/*
+
+# Upgrade npm to a version free of known HIGH/CRITICAL vulnerabilities
+RUN npm install -g npm@11.0.0
+
+WORKDIR /app
+
+RUN npm init -y \\
+  && npm install @aws/aws-distro-opentelemetry-node-autoinstrumentation@0.12.0 \\
+  && npm uninstall -g npm
+
+# Copy bundled agent
+COPY index.js /app
+
+EXPOSE 8080
+
+CMD [ "node", "--require", "@aws/aws-distro-opentelemetry-node-autoinstrumentation/register", "index.js" ]
+"
+`;

package/src/migrations/latest/apt-security-updates-in-container-images/metadata.json

@@ -0,0 +1,3 @@
+{
+  "description": "Apply the distribution's security updates in vended agent / MCP server container images"
+}

package/src/migrations/latest/apt-security-updates-in-container-images/migration.d.ts

@@ -0,0 +1,6 @@
+/**
+ * Copyright Amazon.com, Inc. or its affiliates. All Rights Reserved.
+ * SPDX-License-Identifier: Apache-2.0
+ */
+import { type MigrationReturnObject, type Tree } from '@nx/devkit';
+export default function migration(tree: Tree): Promise<MigrationReturnObject>;

package/src/migrations/latest/apt-security-updates-in-container-images/migration.js

@@ -0,0 +1,90 @@
+/**
+ * Copyright Amazon.com, Inc. or its affiliates. All Rights Reserved.
+ * SPDX-License-Identifier: Apache-2.0
+ */ import { getProjects, joinPathFragments } from "@nx/devkit";
+import { formatFilesInSubtree } from "../../../utils/format.js";
+/**
+ * Apply the distribution's security updates in the vended agent / MCP server
+ * images.
+ *
+ * A base image tag lags behind its distribution's security suite, so the OS
+ * packages it ships carry vulnerabilities that already have a fixed version
+ * published — which the image scan flags as HIGH/CRITICAL. Upgrading them in the
+ * image build clears those findings whenever the scan runs, rather than waiting
+ * for the base image to be rebuilt. New workspaces get this from the generator
+ * templates; this brings existing ones up to date.
+ *
+ * Only the Dockerfiles of the components whose images the generators vend are
+ * touched, located from their project metadata. The Dockerfile is generated
+ * `KeepExisting`, so it is edited in place: the upgrade is inserted right after
+ * the `FROM` line, ahead of every other instruction, so later layers install
+ * against the upgraded packages. One that already runs `apt-get upgrade`, or
+ * which has been re-based onto an image `apt-get` can't upgrade, is left alone.
+ */ /**
+ * The generators whose runtime images the vended Dockerfiles build. Hardcoded
+ * rather than imported from the generators: a migration matches the ids
+ * workspaces recorded at generation time, which must stay fixed even if the
+ * generators' current ids change later.
+ */ const RUNTIME_IMAGE_GENERATOR_IDS = [
+    'py#agent',
+    'py#mcp-server',
+    'ts#agent',
+    'ts#mcp-server'
+];
+const APT_UPGRADE = `# Apply the distribution's security updates: base image tags lag behind the
+# security suite, so its OS packages carry fixed HIGH/CRITICAL vulnerabilities
+# flagged by the image scan.
+RUN apt-get update && \\
+    apt-get upgrade -y --no-install-recommends && \\
+    rm -rf /var/lib/apt/lists/*`;
+/** The apt command this migration adds; used to detect an applied fix. */ const APT_UPGRADE_COMMAND = 'apt-get upgrade';
+/**
+ * The Debian-derived base images the generators vend, whose packages `apt-get`
+ * upgrades. A user who has re-based onto another image (Alpine, distroless,
+ * Amazon Linux) needs a different command, so theirs is left as they wrote it.
+ */ const DEBIAN_BASE_IMAGE = /^FROM\s+\S*(?:node|python):\S*\n/m;
+/**
+ * The Dockerfiles of every runtime image component, located from each project's
+ * recorded component metadata (`path` is the component directory relative to
+ * the project root).
+ */ const runtimeImageDockerfiles = (tree)=>{
+    const paths = [];
+    for (const project of getProjects(tree).values()){
+        const components = project.metadata?.components ?? [];
+        for (const component of components){
+            if (!RUNTIME_IMAGE_GENERATOR_IDS.includes(component.generator) || !component.path) {
+                continue;
+            }
+            const dockerfile = joinPathFragments(projectRoot(project), component.path, 'Dockerfile');
+            if (tree.exists(dockerfile)) {
+                paths.push(dockerfile);
+            }
+        }
+    }
+    return paths;
+};
+/** A project's root, falling back to sourceRoot for the TS-solution layout. */ const projectRoot = (project)=>project.root ?? project.sourceRoot ?? '';
+export default async function migration(tree) {
+    for (const filePath of runtimeImageDockerfiles(tree)){
+        const content = tree.read(filePath, 'utf-8');
+        if (!content) {
+            continue;
+        }
+        if (content.includes(APT_UPGRADE_COMMAND)) {
+            continue; // Already upgrading (migrated or user-added).
+        }
+        const from = content.match(DEBIAN_BASE_IMAGE);
+        if (from?.index === undefined) {
+            continue; // The user has re-based the image; theirs to patch, not ours.
+        }
+        // Insert the upgrade after the FROM line, ahead of every other instruction
+        // so later layers install against the upgraded packages, with the spacing a
+        // freshly generated Dockerfile has.
+        const insertAt = from.index + from[0].length;
+        tree.write(filePath, `${content.slice(0, insertAt)}\n${APT_UPGRADE}\n${content.slice(insertAt)}`);
+    }
+    await formatFilesInSubtree(tree);
+    return {};
+}
+
+//# sourceMappingURL=migration.js.map

package/src/migrations/latest/apt-security-updates-in-container-images/migration.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../../../../../../../packages/nx-plugin/src/migrations/latest/apt-security-updates-in-container-images/migration.ts"],"sourcesContent":["/**\n * Copyright Amazon.com, Inc. or its affiliates. All Rights Reserved.\n * SPDX-License-Identifier: Apache-2.0\n */\nimport {\n  getProjects,\n  joinPathFragments,\n  type MigrationReturnObject,\n  type ProjectConfiguration,\n  type Tree,\n} from '@nx/devkit';\nimport { formatFilesInSubtree } from '../../../utils/format.js';\nimport type { ComponentMetadata } from '../../../utils/nx.js';\n\n/**\n * Apply the distribution's security updates in the vended agent / MCP server\n * images.\n *\n * A base image tag lags behind its distribution's security suite, so the OS\n * packages it ships carry vulnerabilities that already have a fixed version\n * published — which the image scan flags as HIGH/CRITICAL. Upgrading them in the\n * image build clears those findings whenever the scan runs, rather than waiting\n * for the base image to be rebuilt. New workspaces get this from the generator\n * templates; this brings existing ones up to date.\n *\n * Only the Dockerfiles of the components whose images the generators vend are\n * touched, located from their project metadata. The Dockerfile is generated\n * `KeepExisting`, so it is edited in place: the upgrade is inserted right after\n * the `FROM` line, ahead of every other instruction, so later layers install\n * against the upgraded packages. One that already runs `apt-get upgrade`, or\n * which has been re-based onto an image `apt-get` can't upgrade, is left alone.\n */\n\n/**\n * The generators whose runtime images the vended Dockerfiles build. Hardcoded\n * rather than imported from the generators: a migration matches the ids\n * workspaces recorded at generation time, which must stay fixed even if the\n * generators' current ids change later.\n */\nconst RUNTIME_IMAGE_GENERATOR_IDS = [\n  'py#agent',\n  'py#mcp-server',\n  'ts#agent',\n  'ts#mcp-server',\n];\n\nconst APT_UPGRADE = `# Apply the distribution's security updates: base image tags lag behind the\n# security suite, so its OS packages carry fixed HIGH/CRITICAL vulnerabilities\n# flagged by the image scan.\nRUN apt-get update && \\\\\n    apt-get upgrade -y --no-install-recommends && \\\\\n    rm -rf /var/lib/apt/lists/*`;\n\n/** The apt command this migration adds; used to detect an applied fix. */\nconst APT_UPGRADE_COMMAND = 'apt-get upgrade';\n\n/**\n * The Debian-derived base images the generators vend, whose packages `apt-get`\n * upgrades. A user who has re-based onto another image (Alpine, distroless,\n * Amazon Linux) needs a different command, so theirs is left as they wrote it.\n */\nconst DEBIAN_BASE_IMAGE = /^FROM\\s+\\S*(?:node|python):\\S*\\n/m;\n\n/**\n * The Dockerfiles of every runtime image component, located from each project's\n * recorded component metadata (`path` is the component directory relative to\n * the project root).\n */\nconst runtimeImageDockerfiles = (tree: Tree): string[] => {\n  const paths: string[] = [];\n  for (const project of getProjects(tree).values()) {\n    const components = ((\n      project.metadata as { components?: ComponentMetadata[] }\n    )?.components ?? []) as ComponentMetadata[];\n    for (const component of components) {\n      if (\n        !RUNTIME_IMAGE_GENERATOR_IDS.includes(component.generator) ||\n        !component.path\n      ) {\n        continue;\n      }\n      const dockerfile = joinPathFragments(\n        projectRoot(project),\n        component.path,\n        'Dockerfile',\n      );\n      if (tree.exists(dockerfile)) {\n        paths.push(dockerfile);\n      }\n    }\n  }\n  return paths;\n};\n\n/** A project's root, falling back to sourceRoot for the TS-solution layout. */\nconst projectRoot = (project: ProjectConfiguration): string =>\n  project.root ?? project.sourceRoot ?? '';\n\nexport default async function migration(\n  tree: Tree,\n): Promise<MigrationReturnObject> {\n  for (const filePath of runtimeImageDockerfiles(tree)) {\n    const content = tree.read(filePath, 'utf-8');\n    if (!content) {\n      continue;\n    }\n    if (content.includes(APT_UPGRADE_COMMAND)) {\n      continue; // Already upgrading (migrated or user-added).\n    }\n\n    const from = content.match(DEBIAN_BASE_IMAGE);\n    if (from?.index === undefined) {\n      continue; // The user has re-based the image; theirs to patch, not ours.\n    }\n\n    // Insert the upgrade after the FROM line, ahead of every other instruction\n    // so later layers install against the upgraded packages, with the spacing a\n    // freshly generated Dockerfile has.\n    const insertAt = from.index + from[0].length;\n    tree.write(\n      filePath,\n      `${content.slice(0, insertAt)}\\n${APT_UPGRADE}\\n${content.slice(insertAt)}`,\n    );\n  }\n\n  await formatFilesInSubtree(tree);\n\n  return {};\n}\n"],"names":["getProjects","joinPathFragments","formatFilesInSubtree","RUNTIME_IMAGE_GENERATOR_IDS","APT_UPGRADE","APT_UPGRADE_COMMAND","DEBIAN_BASE_IMAGE","runtimeImageDockerfiles","tree","paths","project","values","components","metadata","component","includes","generator","path","dockerfile","projectRoot","exists","push","root","sourceRoot","migration","filePath","content","read","from","match","index","undefined","insertAt","length","write","slice"],"mappings":"AAAA;;;CAGC,GACD,SACEA,WAAW,EACXC,iBAAiB,QAIZ,aAAa;AACpB,SAASC,oBAAoB,QAAQ,2BAA2B;AAGhE;;;;;;;;;;;;;;;;;CAiBC,GAED;;;;;CAKC,GACD,MAAMC,8BAA8B;IAClC;IACA;IACA;IACA;CACD;AAED,MAAMC,cAAc,CAAC;;;;;+BAKU,CAAC;AAEhC,wEAAwE,GACxE,MAAMC,sBAAsB;AAE5B;;;;CAIC,GACD,MAAMC,oBAAoB;AAE1B;;;;CAIC,GACD,MAAMC,0BAA0B,CAACC;IAC/B,MAAMC,QAAkB,EAAE;IAC1B,KAAK,MAAMC,WAAWV,YAAYQ,MAAMG,MAAM,GAAI;QAChD,MAAMC,aAAc,AAClBF,QAAQG,QAAQ,EACfD,cAAc,EAAE;QACnB,KAAK,MAAME,aAAaF,WAAY;YAClC,IACE,CAACT,4BAA4BY,QAAQ,CAACD,UAAUE,SAAS,KACzD,CAACF,UAAUG,IAAI,EACf;gBACA;YACF;YACA,MAAMC,aAAajB,kBACjBkB,YAAYT,UACZI,UAAUG,IAAI,EACd;YAEF,IAAIT,KAAKY,MAAM,CAACF,aAAa;gBAC3BT,MAAMY,IAAI,CAACH;YACb;QACF;IACF;IACA,OAAOT;AACT;AAEA,6EAA6E,GAC7E,MAAMU,cAAc,CAACT,UACnBA,QAAQY,IAAI,IAAIZ,QAAQa,UAAU,IAAI;AAExC,eAAe,eAAeC,UAC5BhB,IAAU;IAEV,KAAK,MAAMiB,YAAYlB,wBAAwBC,MAAO;QACpD,MAAMkB,UAAUlB,KAAKmB,IAAI,CAACF,UAAU;QACpC,IAAI,CAACC,SAAS;YACZ;QACF;QACA,IAAIA,QAAQX,QAAQ,CAACV,sBAAsB;YACzC,UAAU,8CAA8C;QAC1D;QAEA,MAAMuB,OAAOF,QAAQG,KAAK,CAACvB;QAC3B,IAAIsB,MAAME,UAAUC,WAAW;YAC7B,UAAU,8DAA8D;QAC1E;QAEA,2EAA2E;QAC3E,4EAA4E;QAC5E,oCAAoC;QACpC,MAAMC,WAAWJ,KAAKE,KAAK,GAAGF,IAAI,CAAC,EAAE,CAACK,MAAM;QAC5CzB,KAAK0B,KAAK,CACRT,UACA,GAAGC,QAAQS,KAAK,CAAC,GAAGH,UAAU,EAAE,EAAE5B,YAAY,EAAE,EAAEsB,QAAQS,KAAK,CAACH,WAAW;IAE/E;IAEA,MAAM9B,qBAAqBM;IAE3B,OAAO,CAAC;AACV"}