@aws/nx-plugin 1.0.0-rc.8 → 1.0.0-rc.80

package/src/migrations/latest/dynamodb-configurable-encryption/migration.js

@@ -0,0 +1,325 @@
+/**
+ * Copyright Amazon.com, Inc. or its affiliates. All Rights Reserved.
+ * SPDX-License-Identifier: Apache-2.0
+ */ import { joinPathFragments } from "@nx/devkit";
+import { addDestructuredImport, applyGritQL, GRIT_INSERT_PLACEHOLDER, insertViaGritQL, matchGritQL } from "../../../utils/ast.js";
+import { formatFilesInSubtree } from "../../../utils/format.js";
+import { PACKAGES_DIR, SHARED_CONSTRUCTS_DIR, SHARED_TERRAFORM_DIR } from "../../../utils/shared-constructs-constants.js";
+/**
+ * Bring existing workspaces up to the generators' current DynamoDBTable
+ * configurability:
+ *
+ * - The vended `DynamoDBTable` CDK construct gains `encryption` and
+ *   `encryptionKey` props. The KMS key is only created when `encryption` is
+ *   `TableEncryption.CUSTOMER_MANAGED` and no `encryptionKey` is supplied.
+ *   `enableKeyRotation` (already present) only applies to that auto-created
+ *   key.
+ * - The generated per-table CDK app construct already forwards an optional
+ *   `props` parameter through to `DynamoDBTable`, so no change is needed
+ *   there.
+ * - The vended Terraform dynamodb core module gains the equivalent
+ *   `encryption`, `kms_key_arn` and `create_kms_key` variables (`encryption`
+ *   also accepts `DEFAULT`, the AWS owned key, which CDK already supports for
+ *   free via `TableEncryption.DEFAULT`), with the KMS key made conditional on
+ *   `create_kms_key` (not on `kms_key_arn`'s nullness, which `count` can't
+ *   depend on when the ARN comes from another resource) and
+ *   `server_side_encryption.enabled` tied to `encryption`. `AWS_MANAGED`
+ *   resolves to the explicit `alias/aws/dynamodb` ARN rather than `null`,
+ *   since the provider's `kms_key_arn` is Optional+Computed and a `null`
+ *   there means "leave whatever is there", not "clear it".
+ * - The vended Terraform per-table app module (`app/dynamodb/<name>/<name>.tf`)
+ *   gains pass-through `encryption`, `kms_key_arn` and `create_kms_key`
+ *   variables forwarded to the core module call, matching its existing
+ *   `enable_key_rotation` pass-through.
+ *
+ * These files are generated with `KeepExisting`, so without this an upgraded
+ * workspace has generators that support this configuration but vended files
+ * that don't. Diverged files are left untouched and reported via `nextSteps`.
+ */ const CDK_DYNAMODB_FILE = `${PACKAGES_DIR}/${SHARED_CONSTRUCTS_DIR}/src/core/dynamodb.ts`;
+const TERRAFORM_DYNAMODB_FILE = `${PACKAGES_DIR}/${SHARED_TERRAFORM_DIR}/src/core/dynamodb/dynamodb.tf`;
+const TERRAFORM_DYNAMODB_APP_DIR = `${PACKAGES_DIR}/${SHARED_TERRAFORM_DIR}/src/app/dynamodb`;
+const CDK_DIVERGED_MESSAGE = `${CDK_DYNAMODB_FILE}: has diverged from the generated shape - left untouched. To pick up the encryption and encryptionKey props, manually port them from the vended core/dynamodb.ts template (see the ts#dynamodb generator's DynamoDBTable construct).`;
+const TERRAFORM_DIVERGED_MESSAGE = `${TERRAFORM_DYNAMODB_FILE}: has diverged from the generated shape - left untouched. To pick up the encryption and kms_key_arn variables, manually port them from the vended dynamodb.tf template (see the ts#dynamodb generator's dynamodb module).`;
+const terraformAppDivergedMessage = (filePath)=>`${filePath}: has diverged from the generated shape - left untouched. To make encryption and kms_key_arn configurable from your root Terraform configuration, add pass-through variables here and forward them to the dynamodb_table module call (see the ts#dynamodb generator's dynamodb app template).`;
+/**
+ * Surface encryption/encryptionKey on the vended DynamoDBTable CDK
+ * construct.
+ */ const migrateCdkConstruct = async (tree, nextSteps)=>{
+    if (!tree.exists(CDK_DYNAMODB_FILE)) {
+        return; // This workspace has no CDK DynamoDBTable construct.
+    }
+    if (await matchGritQL(tree, CDK_DYNAMODB_FILE, '`readonly encryption?: TableEncryption`')) {
+        return; // Already migrated.
+    }
+    const ENABLE_KEY_ROTATION_FIELD = '`readonly enableKeyRotation?: boolean`';
+    // Matched as a literal so the new fields can be inserted *before* it (see
+    // below) — GritQL doesn't include a leading comment in the span it matches
+    // for the field itself, so anchoring on the field would strand this
+    // comment above the newly-inserted fields instead of above the field it
+    // actually documents.
+    const ENABLE_KEY_ROTATION_COMMENT = `\`/**
+   * Whether to enable automatic key rotation on the KMS key used to encrypt the table.
+   *
+   * @default true
+   */\``;
+    const DESTRUCTURE_OLD = `\`{
+      tableName,
+      runtimeConfigKey,
+      billingMode = BillingMode.PAY_PER_REQUEST,
+      pointInTimeRecoverySpecification = { pointInTimeRecoveryEnabled: true },
+      deletionProtection = true,
+      removalPolicy = RemovalPolicy.RETAIN,
+      enableKeyRotation = true,
+      ...rest
+    }: DynamoDBTableProps\``;
+    const KEY_CREATION_OLD = "`const key = new Key(this, 'EncryptionKey', { enableKeyRotation });`";
+    const TABLE_ENCRYPTION_OLD = '`encryption: TableEncryption.CUSTOMER_MANAGED`';
+    const anchors = [
+        ENABLE_KEY_ROTATION_FIELD,
+        ENABLE_KEY_ROTATION_COMMENT,
+        DESTRUCTURE_OLD,
+        KEY_CREATION_OLD,
+        TABLE_ENCRYPTION_OLD
+    ];
+    const allPresent = (await Promise.all(anchors.map((pattern)=>matchGritQL(tree, CDK_DYNAMODB_FILE, pattern)))).every(Boolean);
+    if (!allPresent) {
+        nextSteps.push(CDK_DIVERGED_MESSAGE);
+        return;
+    }
+    await addDestructuredImport(tree, CDK_DYNAMODB_FILE, [
+        'IKey'
+    ], 'aws-cdk-lib/aws-kms');
+    // Inserted before the enableKeyRotation field's own leading comment (rather
+    // than before the bare field) so that comment stays directly above the
+    // field it documents, instead of being stranded above the new fields.
+    await insertViaGritQL(tree, CDK_DYNAMODB_FILE, `${ENABLE_KEY_ROTATION_COMMENT} as $comment => \`${GRIT_INSERT_PLACEHOLDER}
+  $comment\``, `/**
+   * Server-side encryption for the table.
+   *
+   * @default TableEncryption.CUSTOMER_MANAGED
+   */
+  readonly encryption?: TableEncryption;
+
+  /**
+   * KMS key used to encrypt the table. Only used when \`encryption\` is
+   * \`TableEncryption.CUSTOMER_MANAGED\`. When not provided, a new key is created.
+   */
+  readonly encryptionKey?: IKey;
+
+  `);
+    // Update the enableKeyRotation field's own comment to note it now only
+    // applies to the auto-created key, matching the vended template exactly.
+    // Routed through the insert placeholder (rather than embedding the text
+    // directly in the GritQL rewrite) since the comment's own backticks would
+    // otherwise be parsed as GritQL code-block delimiters.
+    await insertViaGritQL(tree, CDK_DYNAMODB_FILE, `${ENABLE_KEY_ROTATION_COMMENT} => \`${GRIT_INSERT_PLACEHOLDER}\``, `/**
+   * Whether to enable automatic key rotation on the KMS key used to encrypt the table.
+   * Only applies when \`encryption\` is \`TableEncryption.CUSTOMER_MANAGED\` and no
+   * \`encryptionKey\` is supplied.
+   *
+   * @default true
+   */`);
+    await applyGritQL(tree, CDK_DYNAMODB_FILE, `${DESTRUCTURE_OLD} => \`{
+      tableName,
+      runtimeConfigKey,
+      billingMode = BillingMode.PAY_PER_REQUEST,
+      pointInTimeRecoverySpecification = { pointInTimeRecoveryEnabled: true },
+      deletionProtection = true,
+      removalPolicy = RemovalPolicy.RETAIN,
+      encryption = TableEncryption.CUSTOMER_MANAGED,
+      encryptionKey,
+      enableKeyRotation = true,
+      ...rest
+    }: DynamoDBTableProps\``);
+    await applyGritQL(tree, CDK_DYNAMODB_FILE, `${KEY_CREATION_OLD} => \`const key: IKey | undefined =
+      encryption === TableEncryption.CUSTOMER_MANAGED
+        ? (encryptionKey ?? new Key(this, 'EncryptionKey', { enableKeyRotation }))
+        : undefined;\``);
+    await applyGritQL(tree, CDK_DYNAMODB_FILE, `${TABLE_ENCRYPTION_OLD} => \`encryption\``);
+};
+const hcl = (pattern)=>`language hcl\n${pattern}`;
+const NEW_TERRAFORM_VARIABLES_TEXT = [
+    'variable "encryption" {',
+    '  description = "Server-side encryption for the table. One of CUSTOMER_MANAGED, AWS_MANAGED or DEFAULT (the AWS owned key, at no cost and with no key to manage). Changing this on an already-deployed table away from CUSTOMER_MANAGED requires a manual step first - see the ts#dynamodb generator docs."',
+    '  type        = string',
+    '  default     = "CUSTOMER_MANAGED"',
+    '',
+    '  validation {',
+    '    condition     = contains(["CUSTOMER_MANAGED", "AWS_MANAGED", "DEFAULT"], var.encryption)',
+    '    error_message = "encryption must be one of CUSTOMER_MANAGED, AWS_MANAGED or DEFAULT."',
+    '  }',
+    '}',
+    '',
+    'variable "kms_key_arn" {',
+    '  description = "ARN of an existing KMS key used to encrypt the table when encryption is CUSTOMER_MANAGED. When not provided and create_kms_key is true, a new key is created. Note that a customer-supplied key must already grant the DynamoDB service the necessary permissions in its own key policy."',
+    '  type        = string',
+    '  default     = null',
+    '}',
+    '',
+    'variable "create_kms_key" {',
+    '  description = "Whether to create a KMS key for the table. Only applies when encryption is CUSTOMER_MANAGED. Set to false when supplying kms_key_arn."',
+    '  type        = bool',
+    '  default     = true',
+    '}',
+    '',
+    'variable "enable_key_rotation" {',
+    '  description = "Whether to enable automatic key rotation on the KMS key used to encrypt the table. Only applies when encryption is CUSTOMER_MANAGED and create_kms_key is true."',
+    '  type        = bool',
+    '  default     = true',
+    '}'
+].join('\n');
+/**
+ * Surface encryption/kms_key_arn on the vended Terraform dynamodb core
+ * module.
+ */ const migrateTerraformModule = async (tree, nextSteps)=>{
+    if (!tree.exists(TERRAFORM_DYNAMODB_FILE)) {
+        return; // This workspace has no Terraform dynamodb module.
+    }
+    if (await matchGritQL(tree, TERRAFORM_DYNAMODB_FILE, hcl('`variable "encryption" { $_ }`'))) {
+        return; // Already migrated.
+    }
+    const OLD_ENABLE_KEY_ROTATION_VAR = hcl([
+        '`variable "enable_key_rotation" {',
+        '  description = "Whether to enable automatic key rotation on the KMS key used to encrypt the table."',
+        '  type        = bool',
+        '  default     = true',
+        '}`'
+    ].join('\n'));
+    const LOCALS_BLOCK = hcl('`locals { $_ }`');
+    const DATA_PARTITION_LINE = hcl('`data "aws_partition" "current" {}`');
+    const KMS_KEY_BLOCK = hcl('`resource "aws_kms_key" "table" { $_ }`');
+    const SSE_ENABLED_LINE = hcl('`enabled = true`');
+    const SSE_KMS_KEY_LINE = hcl('`kms_key_arn = aws_kms_key.table.arn`');
+    const OUTPUT_VALUE_LINE = hcl('`value = aws_kms_key.table.arn`');
+    const OUTPUT_DESCRIPTION_LINE = hcl('`description = "ARN of the KMS key used to encrypt the DynamoDB table."`');
+    const anchors = [
+        OLD_ENABLE_KEY_ROTATION_VAR,
+        LOCALS_BLOCK,
+        DATA_PARTITION_LINE,
+        KMS_KEY_BLOCK,
+        SSE_ENABLED_LINE,
+        SSE_KMS_KEY_LINE,
+        OUTPUT_VALUE_LINE,
+        OUTPUT_DESCRIPTION_LINE
+    ];
+    const allPresent = (await Promise.all(anchors.map((pattern)=>matchGritQL(tree, TERRAFORM_DYNAMODB_FILE, pattern)))).every(Boolean);
+    if (!allPresent) {
+        nextSteps.push(TERRAFORM_DIVERGED_MESSAGE);
+        return;
+    }
+    // 1. Replace the enable_key_rotation variable with the new variables plus
+    //    an updated enable_key_rotation description, in the same position.
+    await applyGritQL(tree, TERRAFORM_DYNAMODB_FILE, `${OLD_ENABLE_KEY_ROTATION_VAR} => \`${NEW_TERRAFORM_VARIABLES_TEXT.replace(/`/g, '\\`')}\``);
+    // 2. New locals, appended into the existing locals block.
+    await insertViaGritQL(tree, TERRAFORM_DYNAMODB_FILE, hcl(`\`locals { $body }\` => \`locals {\n  $body\n\n  ${GRIT_INSERT_PLACEHOLDER}\n}\``), [
+        'create_table_key = var.encryption == "CUSTOMER_MANAGED" && var.create_kms_key',
+        'table_kms_key_arn = (',
+        '  var.encryption == "CUSTOMER_MANAGED" ? (local.create_table_key ? aws_kms_key.table[0].arn : var.kms_key_arn) :',
+        '  var.encryption == "AWS_MANAGED" ? "arn:${data.aws_partition.current.partition}:kms:${data.aws_region.current.region}:${data.aws_caller_identity.current.account_id}:alias/aws/dynamodb" :',
+        '  null',
+        ')'
+    ].join('\n  '));
+    // 2b. Region is needed to resolve the AWS_MANAGED key's alias ARN above.
+    await insertViaGritQL(tree, TERRAFORM_DYNAMODB_FILE, `${DATA_PARTITION_LINE} => \`data "aws_partition" "current" {}\n${GRIT_INSERT_PLACEHOLDER}\``, 'data "aws_region" "current" {}');
+    // 3. Make the KMS key conditional on encryption/kms_key_arn.
+    await applyGritQL(tree, TERRAFORM_DYNAMODB_FILE, hcl(`\`resource "aws_kms_key" "table" { $body }\` => \`resource "aws_kms_key" "table" {
+  count = local.create_table_key ? 1 : 0
+
+  $body
+}\``));
+    // 4. Only enable KMS-backed encryption when not using the AWS owned key.
+    await applyGritQL(tree, TERRAFORM_DYNAMODB_FILE, `${SSE_ENABLED_LINE} => \`enabled = var.encryption != "DEFAULT"\``);
+    // 4b. Checkov's CKV_AWS_119 only passes when server_side_encryption.enabled
+    // is the literal `true` — it can't resolve the conditional above, even
+    // though CUSTOMER_MANAGED (the default) always uses a real CMK. Same
+    // false-positive shape as CKV_AWS_139 on the vended RDS module.
+    await insertViaGritQL(tree, TERRAFORM_DYNAMODB_FILE, hcl(`\`resource "aws_dynamodb_table" "table" { $body }\` => \`resource "aws_dynamodb_table" "table" {\n  ${GRIT_INSERT_PLACEHOLDER}\n  $body\n}\``), '#checkov:skip=CKV_AWS_119:Encryption is configurable via var.encryption; checkov cannot resolve the conditional server_side_encryption.enabled expression');
+    // 5. Resolve the key ARN through the new local everywhere it's consumed.
+    await applyGritQL(tree, TERRAFORM_DYNAMODB_FILE, `${SSE_KMS_KEY_LINE} => \`kms_key_arn = local.table_kms_key_arn\``);
+    await applyGritQL(tree, TERRAFORM_DYNAMODB_FILE, `${OUTPUT_VALUE_LINE} => \`value = local.table_kms_key_arn\``);
+    await applyGritQL(tree, TERRAFORM_DYNAMODB_FILE, `${OUTPUT_DESCRIPTION_LINE} => \`description = "ARN of the KMS key used to encrypt the DynamoDB table, or null when using the AWS owned key (encryption = DEFAULT)."\``);
+};
+const NEW_APP_MODULE_VARIABLES_TEXT = [
+    'variable "encryption" {',
+    '  description = "Server-side encryption for the table. One of CUSTOMER_MANAGED, AWS_MANAGED or DEFAULT (the AWS owned key, at no cost and with no key to manage). Changing this on an already-deployed table away from CUSTOMER_MANAGED requires a manual step first - see the ts#dynamodb generator docs."',
+    '  type        = string',
+    '  default     = "CUSTOMER_MANAGED"',
+    '',
+    '  validation {',
+    '    condition     = contains(["CUSTOMER_MANAGED", "AWS_MANAGED", "DEFAULT"], var.encryption)',
+    '    error_message = "encryption must be one of CUSTOMER_MANAGED, AWS_MANAGED or DEFAULT."',
+    '  }',
+    '}',
+    '',
+    'variable "kms_key_arn" {',
+    '  description = "ARN of an existing KMS key used to encrypt the table when encryption is CUSTOMER_MANAGED. When not provided and create_kms_key is true, a new key is created. Note that a customer-supplied key must already grant the DynamoDB service the necessary permissions in its own key policy."',
+    '  type        = string',
+    '  default     = null',
+    '}',
+    '',
+    'variable "create_kms_key" {',
+    '  description = "Whether to create a KMS key for the table. Only applies when encryption is CUSTOMER_MANAGED. Set to false when supplying kms_key_arn."',
+    '  type        = bool',
+    '  default     = true',
+    '}',
+    '',
+    'variable "enable_key_rotation" {',
+    '  description = "Whether to enable automatic key rotation on the KMS key used to encrypt the table. Only applies when encryption is CUSTOMER_MANAGED and create_kms_key is true."',
+    '  type        = bool',
+    '  default     = true',
+    '}'
+].join('\n');
+/**
+ * Surface the same configuration as pass-through variables on each vended
+ * per-table Terraform app module, matching its existing pass-through
+ * convention for enable_key_rotation.
+ */ const migrateTerraformAppModules = async (tree, nextSteps)=>{
+    if (!tree.exists(TERRAFORM_DYNAMODB_APP_DIR)) {
+        return;
+    }
+    for (const dirName of tree.children(TERRAFORM_DYNAMODB_APP_DIR)){
+        const filePath = joinPathFragments(TERRAFORM_DYNAMODB_APP_DIR, dirName, `${dirName}.tf`);
+        if (!tree.exists(filePath)) {
+            continue; // Not a dynamodb app module directory.
+        }
+        if (await matchGritQL(tree, filePath, hcl('`variable "encryption" { $_ }`'))) {
+            continue; // Already migrated.
+        }
+        const OLD_ENABLE_KEY_ROTATION_VAR = hcl([
+            '`variable "enable_key_rotation" {',
+            '  description = "Whether to enable automatic key rotation on the KMS key used to encrypt the table."',
+            '  type        = bool',
+            '  default     = true',
+            '}`'
+        ].join('\n'));
+        const MODULE_BLOCK = hcl('`module "dynamodb_table" { $_ }`');
+        const DELETION_PROTECTION_LINE = hcl('`deletion_protection_enabled = var.deletion_protection_enabled`');
+        const ready = (await Promise.all([
+            OLD_ENABLE_KEY_ROTATION_VAR,
+            MODULE_BLOCK,
+            DELETION_PROTECTION_LINE
+        ].map((pattern)=>matchGritQL(tree, filePath, pattern)))).every(Boolean);
+        if (!ready) {
+            nextSteps.push(terraformAppDivergedMessage(filePath));
+            continue;
+        }
+        await applyGritQL(tree, filePath, `${OLD_ENABLE_KEY_ROTATION_VAR} => \`${NEW_APP_MODULE_VARIABLES_TEXT.replace(/`/g, '\\`')}\``);
+        await insertViaGritQL(tree, filePath, hcl(`\`deletion_protection_enabled = var.deletion_protection_enabled\` => \`deletion_protection_enabled = var.deletion_protection_enabled\n  ${GRIT_INSERT_PLACEHOLDER}\``), [
+            'encryption      = var.encryption',
+            'kms_key_arn     = var.kms_key_arn',
+            'create_kms_key  = var.create_kms_key'
+        ].join('\n  '));
+    }
+};
+export default async function migration(tree) {
+    const nextSteps = [];
+    await migrateCdkConstruct(tree, nextSteps);
+    await migrateTerraformModule(tree, nextSteps);
+    await migrateTerraformAppModules(tree, nextSteps);
+    await formatFilesInSubtree(tree);
+    return {
+        nextSteps
+    };
+}
+
+//# sourceMappingURL=migration.js.map

package/src/migrations/latest/dynamodb-configurable-encryption/migration.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../../../../../../../packages/nx-plugin/src/migrations/latest/dynamodb-configurable-encryption/migration.ts"],"sourcesContent":["/**\n * Copyright Amazon.com, Inc. or its affiliates. All Rights Reserved.\n * SPDX-License-Identifier: Apache-2.0\n */\nimport {\n  joinPathFragments,\n  type MigrationReturnObject,\n  type Tree,\n} from '@nx/devkit';\nimport {\n  addDestructuredImport,\n  applyGritQL,\n  GRIT_INSERT_PLACEHOLDER,\n  insertViaGritQL,\n  matchGritQL,\n} from '../../../utils/ast.js';\nimport { formatFilesInSubtree } from '../../../utils/format.js';\nimport {\n  PACKAGES_DIR,\n  SHARED_CONSTRUCTS_DIR,\n  SHARED_TERRAFORM_DIR,\n} from '../../../utils/shared-constructs-constants.js';\n\n/**\n * Bring existing workspaces up to the generators' current DynamoDBTable\n * configurability:\n *\n * - The vended `DynamoDBTable` CDK construct gains `encryption` and\n *   `encryptionKey` props. The KMS key is only created when `encryption` is\n *   `TableEncryption.CUSTOMER_MANAGED` and no `encryptionKey` is supplied.\n *   `enableKeyRotation` (already present) only applies to that auto-created\n *   key.\n * - The generated per-table CDK app construct already forwards an optional\n *   `props` parameter through to `DynamoDBTable`, so no change is needed\n *   there.\n * - The vended Terraform dynamodb core module gains the equivalent\n *   `encryption`, `kms_key_arn` and `create_kms_key` variables (`encryption`\n *   also accepts `DEFAULT`, the AWS owned key, which CDK already supports for\n *   free via `TableEncryption.DEFAULT`), with the KMS key made conditional on\n *   `create_kms_key` (not on `kms_key_arn`'s nullness, which `count` can't\n *   depend on when the ARN comes from another resource) and\n *   `server_side_encryption.enabled` tied to `encryption`. `AWS_MANAGED`\n *   resolves to the explicit `alias/aws/dynamodb` ARN rather than `null`,\n *   since the provider's `kms_key_arn` is Optional+Computed and a `null`\n *   there means \"leave whatever is there\", not \"clear it\".\n * - The vended Terraform per-table app module (`app/dynamodb/<name>/<name>.tf`)\n *   gains pass-through `encryption`, `kms_key_arn` and `create_kms_key`\n *   variables forwarded to the core module call, matching its existing\n *   `enable_key_rotation` pass-through.\n *\n * These files are generated with `KeepExisting`, so without this an upgraded\n * workspace has generators that support this configuration but vended files\n * that don't. Diverged files are left untouched and reported via `nextSteps`.\n */\n\nconst CDK_DYNAMODB_FILE = `${PACKAGES_DIR}/${SHARED_CONSTRUCTS_DIR}/src/core/dynamodb.ts`;\nconst TERRAFORM_DYNAMODB_FILE = `${PACKAGES_DIR}/${SHARED_TERRAFORM_DIR}/src/core/dynamodb/dynamodb.tf`;\nconst TERRAFORM_DYNAMODB_APP_DIR = `${PACKAGES_DIR}/${SHARED_TERRAFORM_DIR}/src/app/dynamodb`;\n\nconst CDK_DIVERGED_MESSAGE = `${CDK_DYNAMODB_FILE}: has diverged from the generated shape - left untouched. To pick up the encryption and encryptionKey props, manually port them from the vended core/dynamodb.ts template (see the ts#dynamodb generator's DynamoDBTable construct).`;\n\nconst TERRAFORM_DIVERGED_MESSAGE = `${TERRAFORM_DYNAMODB_FILE}: has diverged from the generated shape - left untouched. To pick up the encryption and kms_key_arn variables, manually port them from the vended dynamodb.tf template (see the ts#dynamodb generator's dynamodb module).`;\n\nconst terraformAppDivergedMessage = (filePath: string) =>\n  `${filePath}: has diverged from the generated shape - left untouched. To make encryption and kms_key_arn configurable from your root Terraform configuration, add pass-through variables here and forward them to the dynamodb_table module call (see the ts#dynamodb generator's dynamodb app template).`;\n\n/**\n * Surface encryption/encryptionKey on the vended DynamoDBTable CDK\n * construct.\n */\nconst migrateCdkConstruct = async (\n  tree: Tree,\n  nextSteps: string[],\n): Promise<void> => {\n  if (!tree.exists(CDK_DYNAMODB_FILE)) {\n    return; // This workspace has no CDK DynamoDBTable construct.\n  }\n\n  if (\n    await matchGritQL(\n      tree,\n      CDK_DYNAMODB_FILE,\n      '`readonly encryption?: TableEncryption`',\n    )\n  ) {\n    return; // Already migrated.\n  }\n\n  const ENABLE_KEY_ROTATION_FIELD = '`readonly enableKeyRotation?: boolean`';\n  // Matched as a literal so the new fields can be inserted *before* it (see\n  // below) — GritQL doesn't include a leading comment in the span it matches\n  // for the field itself, so anchoring on the field would strand this\n  // comment above the newly-inserted fields instead of above the field it\n  // actually documents.\n  const ENABLE_KEY_ROTATION_COMMENT = `\\`/**\n   * Whether to enable automatic key rotation on the KMS key used to encrypt the table.\n   *\n   * @default true\n   */\\``;\n  const DESTRUCTURE_OLD = `\\`{\n      tableName,\n      runtimeConfigKey,\n      billingMode = BillingMode.PAY_PER_REQUEST,\n      pointInTimeRecoverySpecification = { pointInTimeRecoveryEnabled: true },\n      deletionProtection = true,\n      removalPolicy = RemovalPolicy.RETAIN,\n      enableKeyRotation = true,\n      ...rest\n    }: DynamoDBTableProps\\``;\n  const KEY_CREATION_OLD =\n    \"`const key = new Key(this, 'EncryptionKey', { enableKeyRotation });`\";\n  const TABLE_ENCRYPTION_OLD = '`encryption: TableEncryption.CUSTOMER_MANAGED`';\n\n  const anchors = [\n    ENABLE_KEY_ROTATION_FIELD,\n    ENABLE_KEY_ROTATION_COMMENT,\n    DESTRUCTURE_OLD,\n    KEY_CREATION_OLD,\n    TABLE_ENCRYPTION_OLD,\n  ];\n\n  const allPresent = (\n    await Promise.all(\n      anchors.map((pattern) => matchGritQL(tree, CDK_DYNAMODB_FILE, pattern)),\n    )\n  ).every(Boolean);\n\n  if (!allPresent) {\n    nextSteps.push(CDK_DIVERGED_MESSAGE);\n    return;\n  }\n\n  await addDestructuredImport(\n    tree,\n    CDK_DYNAMODB_FILE,\n    ['IKey'],\n    'aws-cdk-lib/aws-kms',\n  );\n\n  // Inserted before the enableKeyRotation field's own leading comment (rather\n  // than before the bare field) so that comment stays directly above the\n  // field it documents, instead of being stranded above the new fields.\n  await insertViaGritQL(\n    tree,\n    CDK_DYNAMODB_FILE,\n    `${ENABLE_KEY_ROTATION_COMMENT} as $comment => \\`${GRIT_INSERT_PLACEHOLDER}\n  $comment\\``,\n    `/**\n   * Server-side encryption for the table.\n   *\n   * @default TableEncryption.CUSTOMER_MANAGED\n   */\n  readonly encryption?: TableEncryption;\n\n  /**\n   * KMS key used to encrypt the table. Only used when \\`encryption\\` is\n   * \\`TableEncryption.CUSTOMER_MANAGED\\`. When not provided, a new key is created.\n   */\n  readonly encryptionKey?: IKey;\n\n  `,\n  );\n\n  // Update the enableKeyRotation field's own comment to note it now only\n  // applies to the auto-created key, matching the vended template exactly.\n  // Routed through the insert placeholder (rather than embedding the text\n  // directly in the GritQL rewrite) since the comment's own backticks would\n  // otherwise be parsed as GritQL code-block delimiters.\n  await insertViaGritQL(\n    tree,\n    CDK_DYNAMODB_FILE,\n    `${ENABLE_KEY_ROTATION_COMMENT} => \\`${GRIT_INSERT_PLACEHOLDER}\\``,\n    `/**\n   * Whether to enable automatic key rotation on the KMS key used to encrypt the table.\n   * Only applies when \\`encryption\\` is \\`TableEncryption.CUSTOMER_MANAGED\\` and no\n   * \\`encryptionKey\\` is supplied.\n   *\n   * @default true\n   */`,\n  );\n\n  await applyGritQL(\n    tree,\n    CDK_DYNAMODB_FILE,\n    `${DESTRUCTURE_OLD} => \\`{\n      tableName,\n      runtimeConfigKey,\n      billingMode = BillingMode.PAY_PER_REQUEST,\n      pointInTimeRecoverySpecification = { pointInTimeRecoveryEnabled: true },\n      deletionProtection = true,\n      removalPolicy = RemovalPolicy.RETAIN,\n      encryption = TableEncryption.CUSTOMER_MANAGED,\n      encryptionKey,\n      enableKeyRotation = true,\n      ...rest\n    }: DynamoDBTableProps\\``,\n  );\n\n  await applyGritQL(\n    tree,\n    CDK_DYNAMODB_FILE,\n    `${KEY_CREATION_OLD} => \\`const key: IKey | undefined =\n      encryption === TableEncryption.CUSTOMER_MANAGED\n        ? (encryptionKey ?? new Key(this, 'EncryptionKey', { enableKeyRotation }))\n        : undefined;\\``,\n  );\n\n  await applyGritQL(\n    tree,\n    CDK_DYNAMODB_FILE,\n    `${TABLE_ENCRYPTION_OLD} => \\`encryption\\``,\n  );\n};\n\nconst hcl = (pattern: string) => `language hcl\\n${pattern}`;\n\nconst NEW_TERRAFORM_VARIABLES_TEXT = [\n  'variable \"encryption\" {',\n  '  description = \"Server-side encryption for the table. One of CUSTOMER_MANAGED, AWS_MANAGED or DEFAULT (the AWS owned key, at no cost and with no key to manage). Changing this on an already-deployed table away from CUSTOMER_MANAGED requires a manual step first - see the ts#dynamodb generator docs.\"',\n  '  type        = string',\n  '  default     = \"CUSTOMER_MANAGED\"',\n  '',\n  '  validation {',\n  '    condition     = contains([\"CUSTOMER_MANAGED\", \"AWS_MANAGED\", \"DEFAULT\"], var.encryption)',\n  '    error_message = \"encryption must be one of CUSTOMER_MANAGED, AWS_MANAGED or DEFAULT.\"',\n  '  }',\n  '}',\n  '',\n  'variable \"kms_key_arn\" {',\n  '  description = \"ARN of an existing KMS key used to encrypt the table when encryption is CUSTOMER_MANAGED. When not provided and create_kms_key is true, a new key is created. Note that a customer-supplied key must already grant the DynamoDB service the necessary permissions in its own key policy.\"',\n  '  type        = string',\n  '  default     = null',\n  '}',\n  '',\n  'variable \"create_kms_key\" {',\n  '  description = \"Whether to create a KMS key for the table. Only applies when encryption is CUSTOMER_MANAGED. Set to false when supplying kms_key_arn.\"',\n  '  type        = bool',\n  '  default     = true',\n  '}',\n  '',\n  'variable \"enable_key_rotation\" {',\n  '  description = \"Whether to enable automatic key rotation on the KMS key used to encrypt the table. Only applies when encryption is CUSTOMER_MANAGED and create_kms_key is true.\"',\n  '  type        = bool',\n  '  default     = true',\n  '}',\n].join('\\n');\n\n/**\n * Surface encryption/kms_key_arn on the vended Terraform dynamodb core\n * module.\n */\nconst migrateTerraformModule = async (\n  tree: Tree,\n  nextSteps: string[],\n): Promise<void> => {\n  if (!tree.exists(TERRAFORM_DYNAMODB_FILE)) {\n    return; // This workspace has no Terraform dynamodb module.\n  }\n\n  if (\n    await matchGritQL(\n      tree,\n      TERRAFORM_DYNAMODB_FILE,\n      hcl('`variable \"encryption\" { $_ }`'),\n    )\n  ) {\n    return; // Already migrated.\n  }\n\n  const OLD_ENABLE_KEY_ROTATION_VAR = hcl(\n    [\n      '`variable \"enable_key_rotation\" {',\n      '  description = \"Whether to enable automatic key rotation on the KMS key used to encrypt the table.\"',\n      '  type        = bool',\n      '  default     = true',\n      '}`',\n    ].join('\\n'),\n  );\n  const LOCALS_BLOCK = hcl('`locals { $_ }`');\n  const DATA_PARTITION_LINE = hcl('`data \"aws_partition\" \"current\" {}`');\n  const KMS_KEY_BLOCK = hcl('`resource \"aws_kms_key\" \"table\" { $_ }`');\n  const SSE_ENABLED_LINE = hcl('`enabled = true`');\n  const SSE_KMS_KEY_LINE = hcl('`kms_key_arn = aws_kms_key.table.arn`');\n  const OUTPUT_VALUE_LINE = hcl('`value = aws_kms_key.table.arn`');\n  const OUTPUT_DESCRIPTION_LINE = hcl(\n    '`description = \"ARN of the KMS key used to encrypt the DynamoDB table.\"`',\n  );\n\n  const anchors = [\n    OLD_ENABLE_KEY_ROTATION_VAR,\n    LOCALS_BLOCK,\n    DATA_PARTITION_LINE,\n    KMS_KEY_BLOCK,\n    SSE_ENABLED_LINE,\n    SSE_KMS_KEY_LINE,\n    OUTPUT_VALUE_LINE,\n    OUTPUT_DESCRIPTION_LINE,\n  ];\n\n  const allPresent = (\n    await Promise.all(\n      anchors.map((pattern) =>\n        matchGritQL(tree, TERRAFORM_DYNAMODB_FILE, pattern),\n      ),\n    )\n  ).every(Boolean);\n\n  if (!allPresent) {\n    nextSteps.push(TERRAFORM_DIVERGED_MESSAGE);\n    return;\n  }\n\n  // 1. Replace the enable_key_rotation variable with the new variables plus\n  //    an updated enable_key_rotation description, in the same position.\n  await applyGritQL(\n    tree,\n    TERRAFORM_DYNAMODB_FILE,\n    `${OLD_ENABLE_KEY_ROTATION_VAR} => \\`${NEW_TERRAFORM_VARIABLES_TEXT.replace(/`/g, '\\\\`')}\\``,\n  );\n\n  // 2. New locals, appended into the existing locals block.\n  await insertViaGritQL(\n    tree,\n    TERRAFORM_DYNAMODB_FILE,\n    hcl(\n      `\\`locals { $body }\\` => \\`locals {\\n  $body\\n\\n  ${GRIT_INSERT_PLACEHOLDER}\\n}\\``,\n    ),\n    [\n      'create_table_key = var.encryption == \"CUSTOMER_MANAGED\" && var.create_kms_key',\n      'table_kms_key_arn = (',\n      '  var.encryption == \"CUSTOMER_MANAGED\" ? (local.create_table_key ? aws_kms_key.table[0].arn : var.kms_key_arn) :',\n      '  var.encryption == \"AWS_MANAGED\" ? \"arn:${data.aws_partition.current.partition}:kms:${data.aws_region.current.region}:${data.aws_caller_identity.current.account_id}:alias/aws/dynamodb\" :',\n      '  null',\n      ')',\n    ].join('\\n  '),\n  );\n\n  // 2b. Region is needed to resolve the AWS_MANAGED key's alias ARN above.\n  await insertViaGritQL(\n    tree,\n    TERRAFORM_DYNAMODB_FILE,\n    `${DATA_PARTITION_LINE} => \\`data \"aws_partition\" \"current\" {}\\n${GRIT_INSERT_PLACEHOLDER}\\``,\n    'data \"aws_region\" \"current\" {}',\n  );\n\n  // 3. Make the KMS key conditional on encryption/kms_key_arn.\n  await applyGritQL(\n    tree,\n    TERRAFORM_DYNAMODB_FILE,\n    hcl(`\\`resource \"aws_kms_key\" \"table\" { $body }\\` => \\`resource \"aws_kms_key\" \"table\" {\n  count = local.create_table_key ? 1 : 0\n\n  $body\n}\\``),\n  );\n\n  // 4. Only enable KMS-backed encryption when not using the AWS owned key.\n  await applyGritQL(\n    tree,\n    TERRAFORM_DYNAMODB_FILE,\n    `${SSE_ENABLED_LINE} => \\`enabled = var.encryption != \"DEFAULT\"\\``,\n  );\n\n  // 4b. Checkov's CKV_AWS_119 only passes when server_side_encryption.enabled\n  // is the literal `true` — it can't resolve the conditional above, even\n  // though CUSTOMER_MANAGED (the default) always uses a real CMK. Same\n  // false-positive shape as CKV_AWS_139 on the vended RDS module.\n  await insertViaGritQL(\n    tree,\n    TERRAFORM_DYNAMODB_FILE,\n    hcl(\n      `\\`resource \"aws_dynamodb_table\" \"table\" { $body }\\` => \\`resource \"aws_dynamodb_table\" \"table\" {\\n  ${GRIT_INSERT_PLACEHOLDER}\\n  $body\\n}\\``,\n    ),\n    '#checkov:skip=CKV_AWS_119:Encryption is configurable via var.encryption; checkov cannot resolve the conditional server_side_encryption.enabled expression',\n  );\n\n  // 5. Resolve the key ARN through the new local everywhere it's consumed.\n  await applyGritQL(\n    tree,\n    TERRAFORM_DYNAMODB_FILE,\n    `${SSE_KMS_KEY_LINE} => \\`kms_key_arn = local.table_kms_key_arn\\``,\n  );\n  await applyGritQL(\n    tree,\n    TERRAFORM_DYNAMODB_FILE,\n    `${OUTPUT_VALUE_LINE} => \\`value = local.table_kms_key_arn\\``,\n  );\n  await applyGritQL(\n    tree,\n    TERRAFORM_DYNAMODB_FILE,\n    `${OUTPUT_DESCRIPTION_LINE} => \\`description = \"ARN of the KMS key used to encrypt the DynamoDB table, or null when using the AWS owned key (encryption = DEFAULT).\"\\``,\n  );\n};\n\nconst NEW_APP_MODULE_VARIABLES_TEXT = [\n  'variable \"encryption\" {',\n  '  description = \"Server-side encryption for the table. One of CUSTOMER_MANAGED, AWS_MANAGED or DEFAULT (the AWS owned key, at no cost and with no key to manage). Changing this on an already-deployed table away from CUSTOMER_MANAGED requires a manual step first - see the ts#dynamodb generator docs.\"',\n  '  type        = string',\n  '  default     = \"CUSTOMER_MANAGED\"',\n  '',\n  '  validation {',\n  '    condition     = contains([\"CUSTOMER_MANAGED\", \"AWS_MANAGED\", \"DEFAULT\"], var.encryption)',\n  '    error_message = \"encryption must be one of CUSTOMER_MANAGED, AWS_MANAGED or DEFAULT.\"',\n  '  }',\n  '}',\n  '',\n  'variable \"kms_key_arn\" {',\n  '  description = \"ARN of an existing KMS key used to encrypt the table when encryption is CUSTOMER_MANAGED. When not provided and create_kms_key is true, a new key is created. Note that a customer-supplied key must already grant the DynamoDB service the necessary permissions in its own key policy.\"',\n  '  type        = string',\n  '  default     = null',\n  '}',\n  '',\n  'variable \"create_kms_key\" {',\n  '  description = \"Whether to create a KMS key for the table. Only applies when encryption is CUSTOMER_MANAGED. Set to false when supplying kms_key_arn.\"',\n  '  type        = bool',\n  '  default     = true',\n  '}',\n  '',\n  'variable \"enable_key_rotation\" {',\n  '  description = \"Whether to enable automatic key rotation on the KMS key used to encrypt the table. Only applies when encryption is CUSTOMER_MANAGED and create_kms_key is true.\"',\n  '  type        = bool',\n  '  default     = true',\n  '}',\n].join('\\n');\n\n/**\n * Surface the same configuration as pass-through variables on each vended\n * per-table Terraform app module, matching its existing pass-through\n * convention for enable_key_rotation.\n */\nconst migrateTerraformAppModules = async (\n  tree: Tree,\n  nextSteps: string[],\n): Promise<void> => {\n  if (!tree.exists(TERRAFORM_DYNAMODB_APP_DIR)) {\n    return;\n  }\n\n  for (const dirName of tree.children(TERRAFORM_DYNAMODB_APP_DIR)) {\n    const filePath = joinPathFragments(\n      TERRAFORM_DYNAMODB_APP_DIR,\n      dirName,\n      `${dirName}.tf`,\n    );\n    if (!tree.exists(filePath)) {\n      continue; // Not a dynamodb app module directory.\n    }\n\n    if (\n      await matchGritQL(tree, filePath, hcl('`variable \"encryption\" { $_ }`'))\n    ) {\n      continue; // Already migrated.\n    }\n\n    const OLD_ENABLE_KEY_ROTATION_VAR = hcl(\n      [\n        '`variable \"enable_key_rotation\" {',\n        '  description = \"Whether to enable automatic key rotation on the KMS key used to encrypt the table.\"',\n        '  type        = bool',\n        '  default     = true',\n        '}`',\n      ].join('\\n'),\n    );\n    const MODULE_BLOCK = hcl('`module \"dynamodb_table\" { $_ }`');\n    const DELETION_PROTECTION_LINE = hcl(\n      '`deletion_protection_enabled = var.deletion_protection_enabled`',\n    );\n\n    const ready = (\n      await Promise.all(\n        [\n          OLD_ENABLE_KEY_ROTATION_VAR,\n          MODULE_BLOCK,\n          DELETION_PROTECTION_LINE,\n        ].map((pattern) => matchGritQL(tree, filePath, pattern)),\n      )\n    ).every(Boolean);\n\n    if (!ready) {\n      nextSteps.push(terraformAppDivergedMessage(filePath));\n      continue;\n    }\n\n    await applyGritQL(\n      tree,\n      filePath,\n      `${OLD_ENABLE_KEY_ROTATION_VAR} => \\`${NEW_APP_MODULE_VARIABLES_TEXT.replace(/`/g, '\\\\`')}\\``,\n    );\n\n    await insertViaGritQL(\n      tree,\n      filePath,\n      hcl(\n        `\\`deletion_protection_enabled = var.deletion_protection_enabled\\` => \\`deletion_protection_enabled = var.deletion_protection_enabled\\n  ${GRIT_INSERT_PLACEHOLDER}\\``,\n      ),\n      [\n        'encryption      = var.encryption',\n        'kms_key_arn     = var.kms_key_arn',\n        'create_kms_key  = var.create_kms_key',\n      ].join('\\n  '),\n    );\n  }\n};\n\nexport default async function migration(\n  tree: Tree,\n): Promise<MigrationReturnObject> {\n  const nextSteps: string[] = [];\n\n  await migrateCdkConstruct(tree, nextSteps);\n  await migrateTerraformModule(tree, nextSteps);\n  await migrateTerraformAppModules(tree, nextSteps);\n\n  await formatFilesInSubtree(tree);\n\n  return { nextSteps };\n}\n"],"names":["joinPathFragments","addDestructuredImport","applyGritQL","GRIT_INSERT_PLACEHOLDER","insertViaGritQL","matchGritQL","formatFilesInSubtree","PACKAGES_DIR","SHARED_CONSTRUCTS_DIR","SHARED_TERRAFORM_DIR","CDK_DYNAMODB_FILE","TERRAFORM_DYNAMODB_FILE","TERRAFORM_DYNAMODB_APP_DIR","CDK_DIVERGED_MESSAGE","TERRAFORM_DIVERGED_MESSAGE","terraformAppDivergedMessage","filePath","migrateCdkConstruct","tree","nextSteps","exists","ENABLE_KEY_ROTATION_FIELD","ENABLE_KEY_ROTATION_COMMENT","DESTRUCTURE_OLD","KEY_CREATION_OLD","TABLE_ENCRYPTION_OLD","anchors","allPresent","Promise","all","map","pattern","every","Boolean","push","hcl","NEW_TERRAFORM_VARIABLES_TEXT","join","migrateTerraformModule","OLD_ENABLE_KEY_ROTATION_VAR","LOCALS_BLOCK","DATA_PARTITION_LINE","KMS_KEY_BLOCK","SSE_ENABLED_LINE","SSE_KMS_KEY_LINE","OUTPUT_VALUE_LINE","OUTPUT_DESCRIPTION_LINE","replace","NEW_APP_MODULE_VARIABLES_TEXT","migrateTerraformAppModules","dirName","children","MODULE_BLOCK","DELETION_PROTECTION_LINE","ready","migration"],"mappings":"AAAA;;;CAGC,GACD,SACEA,iBAAiB,QAGZ,aAAa;AACpB,SACEC,qBAAqB,EACrBC,WAAW,EACXC,uBAAuB,EACvBC,eAAe,EACfC,WAAW,QACN,wBAAwB;AAC/B,SAASC,oBAAoB,QAAQ,2BAA2B;AAChE,SACEC,YAAY,EACZC,qBAAqB,EACrBC,oBAAoB,QACf,gDAAgD;AAEvD;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;CA8BC,GAED,MAAMC,oBAAoB,GAAGH,aAAa,CAAC,EAAEC,sBAAsB,qBAAqB,CAAC;AACzF,MAAMG,0BAA0B,GAAGJ,aAAa,CAAC,EAAEE,qBAAqB,8BAA8B,CAAC;AACvG,MAAMG,6BAA6B,GAAGL,aAAa,CAAC,EAAEE,qBAAqB,iBAAiB,CAAC;AAE7F,MAAMI,uBAAuB,GAAGH,kBAAkB,oOAAoO,CAAC;AAEvR,MAAMI,6BAA6B,GAAGH,wBAAwB,yNAAyN,CAAC;AAExR,MAAMI,8BAA8B,CAACC,WACnC,GAAGA,SAAS,6RAA6R,CAAC;AAE5S;;;CAGC,GACD,MAAMC,sBAAsB,OAC1BC,MACAC;IAEA,IAAI,CAACD,KAAKE,MAAM,CAACV,oBAAoB;QACnC,QAAQ,qDAAqD;IAC/D;IAEA,IACE,MAAML,YACJa,MACAR,mBACA,4CAEF;QACA,QAAQ,oBAAoB;IAC9B;IAEA,MAAMW,4BAA4B;IAClC,0EAA0E;IAC1E,2EAA2E;IAC3E,oEAAoE;IACpE,wEAAwE;IACxE,sBAAsB;IACtB,MAAMC,8BAA8B,CAAC;;;;OAIhC,CAAC;IACN,MAAMC,kBAAkB,CAAC;;;;;;;;;2BASA,CAAC;IAC1B,MAAMC,mBACJ;IACF,MAAMC,uBAAuB;IAE7B,MAAMC,UAAU;QACdL;QACAC;QACAC;QACAC;QACAC;KACD;IAED,MAAME,aAAa,AACjB,CAAA,MAAMC,QAAQC,GAAG,CACfH,QAAQI,GAAG,CAAC,CAACC,UAAY1B,YAAYa,MAAMR,mBAAmBqB,UAChE,EACAC,KAAK,CAACC;IAER,IAAI,CAACN,YAAY;QACfR,UAAUe,IAAI,CAACrB;QACf;IACF;IAEA,MAAMZ,sBACJiB,MACAR,mBACA;QAAC;KAAO,EACR;IAGF,4EAA4E;IAC5E,uEAAuE;IACvE,sEAAsE;IACtE,MAAMN,gBACJc,MACAR,mBACA,GAAGY,4BAA4B,kBAAkB,EAAEnB,wBAAwB;YACnE,CAAC,EACT,CAAC;;;;;;;;;;;;;EAaH,CAAC;IAGD,uEAAuE;IACvE,yEAAyE;IACzE,wEAAwE;IACxE,0EAA0E;IAC1E,uDAAuD;IACvD,MAAMC,gBACJc,MACAR,mBACA,GAAGY,4BAA4B,MAAM,EAAEnB,wBAAwB,EAAE,CAAC,EAClE,CAAC;;;;;;KAMA,CAAC;IAGJ,MAAMD,YACJgB,MACAR,mBACA,GAAGa,gBAAgB;;;;;;;;;;;2BAWI,CAAC;IAG1B,MAAMrB,YACJgB,MACAR,mBACA,GAAGc,iBAAiB;;;sBAGF,CAAC;IAGrB,MAAMtB,YACJgB,MACAR,mBACA,GAAGe,qBAAqB,kBAAkB,CAAC;AAE/C;AAEA,MAAMU,MAAM,CAACJ,UAAoB,CAAC,cAAc,EAAEA,SAAS;AAE3D,MAAMK,+BAA+B;IACnC;IACA;IACA;IACA;IACA;IACA;IACA;IACA;IACA;IACA;IACA;IACA;IACA;IACA;IACA;IACA;IACA;IACA;IACA;IACA;IACA;IACA;IACA;IACA;IACA;IACA;IACA;IACA;CACD,CAACC,IAAI,CAAC;AAEP;;;CAGC,GACD,MAAMC,yBAAyB,OAC7BpB,MACAC;IAEA,IAAI,CAACD,KAAKE,MAAM,CAACT,0BAA0B;QACzC,QAAQ,mDAAmD;IAC7D;IAEA,IACE,MAAMN,YACJa,MACAP,yBACAwB,IAAI,oCAEN;QACA,QAAQ,oBAAoB;IAC9B;IAEA,MAAMI,8BAA8BJ,IAClC;QACE;QACA;QACA;QACA;QACA;KACD,CAACE,IAAI,CAAC;IAET,MAAMG,eAAeL,IAAI;IACzB,MAAMM,sBAAsBN,IAAI;IAChC,MAAMO,gBAAgBP,IAAI;IAC1B,MAAMQ,mBAAmBR,IAAI;IAC7B,MAAMS,mBAAmBT,IAAI;IAC7B,MAAMU,oBAAoBV,IAAI;IAC9B,MAAMW,0BAA0BX,IAC9B;IAGF,MAAMT,UAAU;QACda;QACAC;QACAC;QACAC;QACAC;QACAC;QACAC;QACAC;KACD;IAED,MAAMnB,aAAa,AACjB,CAAA,MAAMC,QAAQC,GAAG,CACfH,QAAQI,GAAG,CAAC,CAACC,UACX1B,YAAYa,MAAMP,yBAAyBoB,UAE/C,EACAC,KAAK,CAACC;IAER,IAAI,CAACN,YAAY;QACfR,UAAUe,IAAI,CAACpB;QACf;IACF;IAEA,0EAA0E;IAC1E,uEAAuE;IACvE,MAAMZ,YACJgB,MACAP,yBACA,GAAG4B,4BAA4B,MAAM,EAAEH,6BAA6BW,OAAO,CAAC,MAAM,OAAO,EAAE,CAAC;IAG9F,0DAA0D;IAC1D,MAAM3C,gBACJc,MACAP,yBACAwB,IACE,CAAC,iDAAiD,EAAEhC,wBAAwB,KAAK,CAAC,GAEpF;QACE;QACA;QACA;QACA;QACA;QACA;KACD,CAACkC,IAAI,CAAC;IAGT,yEAAyE;IACzE,MAAMjC,gBACJc,MACAP,yBACA,GAAG8B,oBAAoB,yCAAyC,EAAEtC,wBAAwB,EAAE,CAAC,EAC7F;IAGF,6DAA6D;IAC7D,MAAMD,YACJgB,MACAP,yBACAwB,IAAI,CAAC;;;;GAIN,CAAC;IAGF,yEAAyE;IACzE,MAAMjC,YACJgB,MACAP,yBACA,GAAGgC,iBAAiB,6CAA6C,CAAC;IAGpE,4EAA4E;IAC5E,uEAAuE;IACvE,qEAAqE;IACrE,gEAAgE;IAChE,MAAMvC,gBACJc,MACAP,yBACAwB,IACE,CAAC,oGAAoG,EAAEhC,wBAAwB,cAAc,CAAC,GAEhJ;IAGF,yEAAyE;IACzE,MAAMD,YACJgB,MACAP,yBACA,GAAGiC,iBAAiB,6CAA6C,CAAC;IAEpE,MAAM1C,YACJgB,MACAP,yBACA,GAAGkC,kBAAkB,uCAAuC,CAAC;IAE/D,MAAM3C,YACJgB,MACAP,yBACA,GAAGmC,wBAAwB,2IAA2I,CAAC;AAE3K;AAEA,MAAME,gCAAgC;IACpC;IACA;IACA;IACA;IACA;IACA;IACA;IACA;IACA;IACA;IACA;IACA;IACA;IACA;IACA;IACA;IACA;IACA;IACA;IACA;IACA;IACA;IACA;IACA;IACA;IACA;IACA;IACA;CACD,CAACX,IAAI,CAAC;AAEP;;;;CAIC,GACD,MAAMY,6BAA6B,OACjC/B,MACAC;IAEA,IAAI,CAACD,KAAKE,MAAM,CAACR,6BAA6B;QAC5C;IACF;IAEA,KAAK,MAAMsC,WAAWhC,KAAKiC,QAAQ,CAACvC,4BAA6B;QAC/D,MAAMI,WAAWhB,kBACfY,4BACAsC,SACA,GAAGA,QAAQ,GAAG,CAAC;QAEjB,IAAI,CAAChC,KAAKE,MAAM,CAACJ,WAAW;YAC1B,UAAU,uCAAuC;QACnD;QAEA,IACE,MAAMX,YAAYa,MAAMF,UAAUmB,IAAI,oCACtC;YACA,UAAU,oBAAoB;QAChC;QAEA,MAAMI,8BAA8BJ,IAClC;YACE;YACA;YACA;YACA;YACA;SACD,CAACE,IAAI,CAAC;QAET,MAAMe,eAAejB,IAAI;QACzB,MAAMkB,2BAA2BlB,IAC/B;QAGF,MAAMmB,QAAQ,AACZ,CAAA,MAAM1B,QAAQC,GAAG,CACf;YACEU;YACAa;YACAC;SACD,CAACvB,GAAG,CAAC,CAACC,UAAY1B,YAAYa,MAAMF,UAAUe,UACjD,EACAC,KAAK,CAACC;QAER,IAAI,CAACqB,OAAO;YACVnC,UAAUe,IAAI,CAACnB,4BAA4BC;YAC3C;QACF;QAEA,MAAMd,YACJgB,MACAF,UACA,GAAGuB,4BAA4B,MAAM,EAAES,8BAA8BD,OAAO,CAAC,MAAM,OAAO,EAAE,CAAC;QAG/F,MAAM3C,gBACJc,MACAF,UACAmB,IACE,CAAC,wIAAwI,EAAEhC,wBAAwB,EAAE,CAAC,GAExK;YACE;YACA;YACA;SACD,CAACkC,IAAI,CAAC;IAEX;AACF;AAEA,eAAe,eAAekB,UAC5BrC,IAAU;IAEV,MAAMC,YAAsB,EAAE;IAE9B,MAAMF,oBAAoBC,MAAMC;IAChC,MAAMmB,uBAAuBpB,MAAMC;IACnC,MAAM8B,2BAA2B/B,MAAMC;IAEvC,MAAMb,qBAAqBY;IAE3B,OAAO;QAAEC;IAAU;AACrB"}

package/src/migrations/latest/py-agent-ag-ui-hooks/metadata.json

@@ -0,0 +1,3 @@
+{
+  "description": "Forward the py#agent Strands hooks to the AG-UI adapter so model and tool errors are reported"
+}

package/src/migrations/latest/py-agent-ag-ui-hooks/migration.d.ts

@@ -0,0 +1,6 @@
+/**
+ * Copyright Amazon.com, Inc. or its affiliates. All Rights Reserved.
+ * SPDX-License-Identifier: Apache-2.0
+ */
+import { type MigrationReturnObject, type Tree } from '@nx/devkit';
+export default function migration(tree: Tree): Promise<MigrationReturnObject>;

package/src/migrations/latest/py-agent-ag-ui-hooks/migration.js

@@ -0,0 +1,113 @@
+/**
+ * Copyright Amazon.com, Inc. or its affiliates. All Rights Reserved.
+ * SPDX-License-Identifier: Apache-2.0
+ */ import { getProjects, joinPathFragments } from "@nx/devkit";
+import { PY_AGENT_GENERATOR_INFO } from "../../../py/agent/generator.js";
+import { addPythonDestructuredImport, applyGritQL, captureGritQLVariable, GRIT_INSERT_PLACEHOLDER, insertViaGritQL, matchGritQL } from "../../../utils/ast.js";
+import { formatFilesInSubtree } from "../../../utils/format.js";
+/**
+ * Forward a Strands py#agent's hooks to the AG-UI adapter.
+ *
+ * `StrandsAgent` builds a fresh `Agent` per `thread_id` by copying the template
+ * Agent's kwargs, but deliberately skips `hooks` - Strands keeps only the built
+ * `HookRegistry`, so the providers can't be read back off it. An AG-UI agent's
+ * `log_model_errors` / `log_tool_errors` therefore never fired for served
+ * requests, and model/tool failures were reported as successful runs.
+ *
+ * The fix hoists the hooks list out of the `Agent(...)` call into an
+ * `AGENT_HOOKS` module constant in `agent.py` - whatever the user has put in it,
+ * so custom hooks come along - and passes that to `StrandsAgent(...)` in
+ * `main.py` as well. `agent.py` is hoisted for every protocol so the constant
+ * matches what the generator vends today; only AG-UI needs the `main.py` half.
+ */ // `Agent`'s `hooks` list is invariant, so the hoisted constant has to declare
+// the parameter's own type - an inline literal was inferred from it instead.
+const HOOKS_TYPE = 'list[HookProvider | HookCallback]';
+const HOOKS_MODULE = 'strands.hooks';
+// Anchored on the `get_agent` context manager - the one shape shared by every
+// generated protocol and connection combination - so the constant lands
+// directly above its only use, where the generator vends it.
+const HOIST_HOOKS_PATTERN = `language python
+\`@contextmanager
+def get_agent($params):
+    $body\` => raw\`AGENT_HOOKS: ${HOOKS_TYPE} = ${GRIT_INSERT_PLACEHOLDER}
+
+
+@contextmanager
+def get_agent($params):
+    $body\` where { $program <: not contains \`AGENT_HOOKS\` }`;
+// Scoped to the Agent constructor so a hooks list the user passes elsewhere in
+// agent.py is left alone.
+const HOOKS_LIST_CAPTURE_PATTERN = 'language python\n`hooks=[$hooks]` where { $hooks <: within `Agent($_)` }';
+const HOOKS_LIST_REWRITE_PATTERN = 'language python\n`hooks=[$_]` as $kwarg where { $kwarg <: within `Agent($_)`, $kwarg => `hooks=AGENT_HOOKS` }';
+const AGUI_CONSTRUCTOR_MATCH_PATTERN = 'language python\n`StrandsAgent($args)` where { $args <: contains `agent=$_` }';
+const AGUI_HOOKS_WIRED_PATTERN = 'language python\n`StrandsAgent($args)` where { $args <: contains `agent=$_`, $args <: contains `hooks=$_` }';
+// Appends after the last argument rather than re-emitting the argument list,
+// both to land `hooks=` where the template puts it and to leave the other
+// arguments' formatting and comments untouched.
+const AGUI_HOOKS_APPEND_PATTERN = 'language python\n`StrandsAgent($args)` where { $args <: contains `agent=$_`, $args <: not contains `hooks=$_`, $args <: [$..., $last], $last += `, hooks=AGENT_HOOKS` }';
+const findAgentComponents = (components)=>(components ?? []).filter((component)=>component.generator === PY_AGENT_GENERATOR_INFO.id);
+/**
+ * Hoists `agent.py`'s `hooks=[...]` list into an `AGENT_HOOKS` module constant,
+ * returning whether the file ends up exporting one.
+ */ const hoistAgentHooks = async (tree, agentPath)=>{
+    if ((tree.read(agentPath, 'utf-8') ?? '').includes('AGENT_HOOKS')) {
+        return true;
+    }
+    // Nothing to hoist unless the Agent is constructed with an inline hooks list.
+    const hooks = await captureGritQLVariable(tree, agentPath, HOOKS_LIST_CAPTURE_PATTERN, 'hooks');
+    if (!hooks) return false;
+    if (!await insertViaGritQL(tree, agentPath, HOIST_HOOKS_PATTERN, `[${hooks}]`)) {
+        return false;
+    }
+    await applyGritQL(tree, agentPath, HOOKS_LIST_REWRITE_PATTERN);
+    await addPythonDestructuredImport(tree, agentPath, [
+        'HookCallback',
+        'HookProvider'
+    ], HOOKS_MODULE);
+    return true;
+};
+const migrateAgent = async (tree, agentDir, component, nextSteps)=>{
+    // LangChain agents pass no hooks - their AG-UI adapter is handed the graph
+    // itself rather than rebuilding one, so nothing is dropped.
+    if (component.framework === 'langchain') return;
+    const agentPath = joinPathFragments(agentDir, 'agent.py');
+    const mainPath = joinPathFragments(agentDir, 'main.py');
+    const isAgUi = component.protocol === 'ag-ui';
+    if (!tree.exists(agentPath)) return;
+    if (!await hoistAgentHooks(tree, agentPath)) {
+        if (isAgUi) {
+            nextSteps.push(`${agentPath}: the hooks passed to \`Agent(...)\` have diverged from the generated shape - left untouched. Hoist them into an \`AGENT_HOOKS\` module constant and pass it to \`StrandsAgent(...)\` in ${mainPath} too, or AG-UI will not register them (see the py#agent generator's template).`);
+        }
+        return;
+    }
+    // Only AG-UI rebuilds the Agent, so only its main.py needs the hooks.
+    if (!isAgUi || !tree.exists(mainPath)) return;
+    // Already passing hooks, whether from a previous run or the user's own wiring.
+    if (await matchGritQL(tree, mainPath, AGUI_HOOKS_WIRED_PATTERN)) return;
+    if (!await matchGritQL(tree, mainPath, AGUI_CONSTRUCTOR_MATCH_PATTERN)) {
+        nextSteps.push(`${mainPath}: the \`StrandsAgent(...)\` constructor has diverged from the generated shape - left untouched. Pass \`hooks=AGENT_HOOKS\` to it, importing \`AGENT_HOOKS\` from \`.agent\`, or AG-UI will not register the agent's hooks (see the py#agent generator's template).`);
+        return;
+    }
+    await applyGritQL(tree, mainPath, AGUI_HOOKS_APPEND_PATTERN);
+    await addPythonDestructuredImport(tree, mainPath, [
+        'AGENT_HOOKS'
+    ], '.agent');
+};
+export default async function migration(tree) {
+    const nextSteps = [];
+    for (const project of getProjects(tree).values()){
+        const components = findAgentComponents(project.metadata?.components);
+        for (const component of components){
+            if (!component.path) continue;
+            // Legacy component paths point at agent.py rather than its directory.
+            const componentDir = component.path.endsWith('/agent.py') ? component.path.slice(0, -'/agent.py'.length) : component.path;
+            await migrateAgent(tree, joinPathFragments(project.root, componentDir), component, nextSteps);
+        }
+    }
+    await formatFilesInSubtree(tree);
+    return {
+        nextSteps
+    };
+}
+
+//# sourceMappingURL=migration.js.map

package/src/migrations/latest/py-agent-ag-ui-hooks/migration.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../../../../../../../packages/nx-plugin/src/migrations/latest/py-agent-ag-ui-hooks/migration.ts"],"sourcesContent":["/**\n * Copyright Amazon.com, Inc. or its affiliates. All Rights Reserved.\n * SPDX-License-Identifier: Apache-2.0\n */\nimport {\n  getProjects,\n  joinPathFragments,\n  type MigrationReturnObject,\n  type Tree,\n} from '@nx/devkit';\nimport { PY_AGENT_GENERATOR_INFO } from '../../../py/agent/generator.js';\nimport {\n  addPythonDestructuredImport,\n  applyGritQL,\n  captureGritQLVariable,\n  GRIT_INSERT_PLACEHOLDER,\n  insertViaGritQL,\n  matchGritQL,\n} from '../../../utils/ast.js';\nimport { formatFilesInSubtree } from '../../../utils/format.js';\nimport type { ComponentMetadata } from '../../../utils/nx.js';\n\n/**\n * Forward a Strands py#agent's hooks to the AG-UI adapter.\n *\n * `StrandsAgent` builds a fresh `Agent` per `thread_id` by copying the template\n * Agent's kwargs, but deliberately skips `hooks` - Strands keeps only the built\n * `HookRegistry`, so the providers can't be read back off it. An AG-UI agent's\n * `log_model_errors` / `log_tool_errors` therefore never fired for served\n * requests, and model/tool failures were reported as successful runs.\n *\n * The fix hoists the hooks list out of the `Agent(...)` call into an\n * `AGENT_HOOKS` module constant in `agent.py` - whatever the user has put in it,\n * so custom hooks come along - and passes that to `StrandsAgent(...)` in\n * `main.py` as well. `agent.py` is hoisted for every protocol so the constant\n * matches what the generator vends today; only AG-UI needs the `main.py` half.\n */\n\n// `Agent`'s `hooks` list is invariant, so the hoisted constant has to declare\n// the parameter's own type - an inline literal was inferred from it instead.\nconst HOOKS_TYPE = 'list[HookProvider | HookCallback]';\nconst HOOKS_MODULE = 'strands.hooks';\n\n// Anchored on the `get_agent` context manager - the one shape shared by every\n// generated protocol and connection combination - so the constant lands\n// directly above its only use, where the generator vends it.\nconst HOIST_HOOKS_PATTERN = `language python\n\\`@contextmanager\ndef get_agent($params):\n    $body\\` => raw\\`AGENT_HOOKS: ${HOOKS_TYPE} = ${GRIT_INSERT_PLACEHOLDER}\n\n\n@contextmanager\ndef get_agent($params):\n    $body\\` where { $program <: not contains \\`AGENT_HOOKS\\` }`;\n\n// Scoped to the Agent constructor so a hooks list the user passes elsewhere in\n// agent.py is left alone.\nconst HOOKS_LIST_CAPTURE_PATTERN =\n  'language python\\n`hooks=[$hooks]` where { $hooks <: within `Agent($_)` }';\nconst HOOKS_LIST_REWRITE_PATTERN =\n  'language python\\n`hooks=[$_]` as $kwarg where { $kwarg <: within `Agent($_)`, $kwarg => `hooks=AGENT_HOOKS` }';\n\nconst AGUI_CONSTRUCTOR_MATCH_PATTERN =\n  'language python\\n`StrandsAgent($args)` where { $args <: contains `agent=$_` }';\nconst AGUI_HOOKS_WIRED_PATTERN =\n  'language python\\n`StrandsAgent($args)` where { $args <: contains `agent=$_`, $args <: contains `hooks=$_` }';\n// Appends after the last argument rather than re-emitting the argument list,\n// both to land `hooks=` where the template puts it and to leave the other\n// arguments' formatting and comments untouched.\nconst AGUI_HOOKS_APPEND_PATTERN =\n  'language python\\n`StrandsAgent($args)` where { $args <: contains `agent=$_`, $args <: not contains `hooks=$_`, $args <: [$..., $last], $last += `, hooks=AGENT_HOOKS` }';\n\nconst findAgentComponents = (\n  components: ComponentMetadata[] | undefined,\n): ComponentMetadata[] =>\n  (components ?? []).filter(\n    (component) => component.generator === PY_AGENT_GENERATOR_INFO.id,\n  );\n\n/**\n * Hoists `agent.py`'s `hooks=[...]` list into an `AGENT_HOOKS` module constant,\n * returning whether the file ends up exporting one.\n */\nconst hoistAgentHooks = async (\n  tree: Tree,\n  agentPath: string,\n): Promise<boolean> => {\n  if ((tree.read(agentPath, 'utf-8') ?? '').includes('AGENT_HOOKS')) {\n    return true;\n  }\n\n  // Nothing to hoist unless the Agent is constructed with an inline hooks list.\n  const hooks = await captureGritQLVariable(\n    tree,\n    agentPath,\n    HOOKS_LIST_CAPTURE_PATTERN,\n    'hooks',\n  );\n  if (!hooks) return false;\n\n  if (\n    !(await insertViaGritQL(tree, agentPath, HOIST_HOOKS_PATTERN, `[${hooks}]`))\n  ) {\n    return false;\n  }\n  await applyGritQL(tree, agentPath, HOOKS_LIST_REWRITE_PATTERN);\n  await addPythonDestructuredImport(\n    tree,\n    agentPath,\n    ['HookCallback', 'HookProvider'],\n    HOOKS_MODULE,\n  );\n  return true;\n};\n\nconst migrateAgent = async (\n  tree: Tree,\n  agentDir: string,\n  component: ComponentMetadata,\n  nextSteps: string[],\n): Promise<void> => {\n  // LangChain agents pass no hooks - their AG-UI adapter is handed the graph\n  // itself rather than rebuilding one, so nothing is dropped.\n  if (component.framework === 'langchain') return;\n\n  const agentPath = joinPathFragments(agentDir, 'agent.py');\n  const mainPath = joinPathFragments(agentDir, 'main.py');\n  const isAgUi = component.protocol === 'ag-ui';\n\n  if (!tree.exists(agentPath)) return;\n\n  if (!(await hoistAgentHooks(tree, agentPath))) {\n    if (isAgUi) {\n      nextSteps.push(\n        `${agentPath}: the hooks passed to \\`Agent(...)\\` have diverged from the generated shape - left untouched. Hoist them into an \\`AGENT_HOOKS\\` module constant and pass it to \\`StrandsAgent(...)\\` in ${mainPath} too, or AG-UI will not register them (see the py#agent generator's template).`,\n      );\n    }\n    return;\n  }\n\n  // Only AG-UI rebuilds the Agent, so only its main.py needs the hooks.\n  if (!isAgUi || !tree.exists(mainPath)) return;\n\n  // Already passing hooks, whether from a previous run or the user's own wiring.\n  if (await matchGritQL(tree, mainPath, AGUI_HOOKS_WIRED_PATTERN)) return;\n\n  if (!(await matchGritQL(tree, mainPath, AGUI_CONSTRUCTOR_MATCH_PATTERN))) {\n    nextSteps.push(\n      `${mainPath}: the \\`StrandsAgent(...)\\` constructor has diverged from the generated shape - left untouched. Pass \\`hooks=AGENT_HOOKS\\` to it, importing \\`AGENT_HOOKS\\` from \\`.agent\\`, or AG-UI will not register the agent's hooks (see the py#agent generator's template).`,\n    );\n    return;\n  }\n\n  await applyGritQL(tree, mainPath, AGUI_HOOKS_APPEND_PATTERN);\n  await addPythonDestructuredImport(tree, mainPath, ['AGENT_HOOKS'], '.agent');\n};\n\nexport default async function migration(\n  tree: Tree,\n): Promise<MigrationReturnObject> {\n  const nextSteps: string[] = [];\n\n  for (const project of getProjects(tree).values()) {\n    const components = findAgentComponents(\n      (project.metadata as { components?: ComponentMetadata[] })?.components,\n    );\n\n    for (const component of components) {\n      if (!component.path) continue;\n\n      // Legacy component paths point at agent.py rather than its directory.\n      const componentDir = component.path.endsWith('/agent.py')\n        ? component.path.slice(0, -'/agent.py'.length)\n        : component.path;\n\n      await migrateAgent(\n        tree,\n        joinPathFragments(project.root, componentDir),\n        component,\n        nextSteps,\n      );\n    }\n  }\n\n  await formatFilesInSubtree(tree);\n\n  return { nextSteps };\n}\n"],"names":["getProjects","joinPathFragments","PY_AGENT_GENERATOR_INFO","addPythonDestructuredImport","applyGritQL","captureGritQLVariable","GRIT_INSERT_PLACEHOLDER","insertViaGritQL","matchGritQL","formatFilesInSubtree","HOOKS_TYPE","HOOKS_MODULE","HOIST_HOOKS_PATTERN","HOOKS_LIST_CAPTURE_PATTERN","HOOKS_LIST_REWRITE_PATTERN","AGUI_CONSTRUCTOR_MATCH_PATTERN","AGUI_HOOKS_WIRED_PATTERN","AGUI_HOOKS_APPEND_PATTERN","findAgentComponents","components","filter","component","generator","id","hoistAgentHooks","tree","agentPath","read","includes","hooks","migrateAgent","agentDir","nextSteps","framework","mainPath","isAgUi","protocol","exists","push","migration","project","values","metadata","path","componentDir","endsWith","slice","length","root"],"mappings":"AAAA;;;CAGC,GACD,SACEA,WAAW,EACXC,iBAAiB,QAGZ,aAAa;AACpB,SAASC,uBAAuB,QAAQ,iCAAiC;AACzE,SACEC,2BAA2B,EAC3BC,WAAW,EACXC,qBAAqB,EACrBC,uBAAuB,EACvBC,eAAe,EACfC,WAAW,QACN,wBAAwB;AAC/B,SAASC,oBAAoB,QAAQ,2BAA2B;AAGhE;;;;;;;;;;;;;;CAcC,GAED,8EAA8E;AAC9E,6EAA6E;AAC7E,MAAMC,aAAa;AACnB,MAAMC,eAAe;AAErB,8EAA8E;AAC9E,wEAAwE;AACxE,6DAA6D;AAC7D,MAAMC,sBAAsB,CAAC;;;iCAGI,EAAEF,WAAW,GAAG,EAAEJ,wBAAwB;;;;;8DAKb,CAAC;AAE/D,+EAA+E;AAC/E,0BAA0B;AAC1B,MAAMO,6BACJ;AACF,MAAMC,6BACJ;AAEF,MAAMC,iCACJ;AACF,MAAMC,2BACJ;AACF,6EAA6E;AAC7E,0EAA0E;AAC1E,gDAAgD;AAChD,MAAMC,4BACJ;AAEF,MAAMC,sBAAsB,CAC1BC,aAEA,AAACA,CAAAA,cAAc,EAAE,AAAD,EAAGC,MAAM,CACvB,CAACC,YAAcA,UAAUC,SAAS,KAAKpB,wBAAwBqB,EAAE;AAGrE;;;CAGC,GACD,MAAMC,kBAAkB,OACtBC,MACAC;IAEA,IAAI,AAACD,CAAAA,KAAKE,IAAI,CAACD,WAAW,YAAY,EAAC,EAAGE,QAAQ,CAAC,gBAAgB;QACjE,OAAO;IACT;IAEA,8EAA8E;IAC9E,MAAMC,QAAQ,MAAMxB,sBAClBoB,MACAC,WACAb,4BACA;IAEF,IAAI,CAACgB,OAAO,OAAO;IAEnB,IACE,CAAE,MAAMtB,gBAAgBkB,MAAMC,WAAWd,qBAAqB,CAAC,CAAC,EAAEiB,MAAM,CAAC,CAAC,GAC1E;QACA,OAAO;IACT;IACA,MAAMzB,YAAYqB,MAAMC,WAAWZ;IACnC,MAAMX,4BACJsB,MACAC,WACA;QAAC;QAAgB;KAAe,EAChCf;IAEF,OAAO;AACT;AAEA,MAAMmB,eAAe,OACnBL,MACAM,UACAV,WACAW;IAEA,2EAA2E;IAC3E,4DAA4D;IAC5D,IAAIX,UAAUY,SAAS,KAAK,aAAa;IAEzC,MAAMP,YAAYzB,kBAAkB8B,UAAU;IAC9C,MAAMG,WAAWjC,kBAAkB8B,UAAU;IAC7C,MAAMI,SAASd,UAAUe,QAAQ,KAAK;IAEtC,IAAI,CAACX,KAAKY,MAAM,CAACX,YAAY;IAE7B,IAAI,CAAE,MAAMF,gBAAgBC,MAAMC,YAAa;QAC7C,IAAIS,QAAQ;YACVH,UAAUM,IAAI,CACZ,GAAGZ,UAAU,yLAAyL,EAAEQ,SAAS,8EAA8E,CAAC;QAEpS;QACA;IACF;IAEA,sEAAsE;IACtE,IAAI,CAACC,UAAU,CAACV,KAAKY,MAAM,CAACH,WAAW;IAEvC,+EAA+E;IAC/E,IAAI,MAAM1B,YAAYiB,MAAMS,UAAUlB,2BAA2B;IAEjE,IAAI,CAAE,MAAMR,YAAYiB,MAAMS,UAAUnB,iCAAkC;QACxEiB,UAAUM,IAAI,CACZ,GAAGJ,SAAS,kQAAkQ,CAAC;QAEjR;IACF;IAEA,MAAM9B,YAAYqB,MAAMS,UAAUjB;IAClC,MAAMd,4BAA4BsB,MAAMS,UAAU;QAAC;KAAc,EAAE;AACrE;AAEA,eAAe,eAAeK,UAC5Bd,IAAU;IAEV,MAAMO,YAAsB,EAAE;IAE9B,KAAK,MAAMQ,WAAWxC,YAAYyB,MAAMgB,MAAM,GAAI;QAChD,MAAMtB,aAAaD,oBAChBsB,QAAQE,QAAQ,EAA2CvB;QAG9D,KAAK,MAAME,aAAaF,WAAY;YAClC,IAAI,CAACE,UAAUsB,IAAI,EAAE;YAErB,sEAAsE;YACtE,MAAMC,eAAevB,UAAUsB,IAAI,CAACE,QAAQ,CAAC,eACzCxB,UAAUsB,IAAI,CAACG,KAAK,CAAC,GAAG,CAAC,YAAYC,MAAM,IAC3C1B,UAAUsB,IAAI;YAElB,MAAMb,aACJL,MACAxB,kBAAkBuC,QAAQQ,IAAI,EAAEJ,eAChCvB,WACAW;QAEJ;IACF;IAEA,MAAMvB,qBAAqBgB;IAE3B,OAAO;QAAEO;IAAU;AACrB"}

package/src/migrations/latest/py-agent-session-id-middleware-extraction/metadata.json

@@ -0,0 +1,3 @@
+{
+  "description": "Extract the duplicated _SessionIdMiddleware class in py#agent's main.py into a shared middleware/session_id_middleware.py module"
+}

package/src/migrations/latest/py-agent-session-id-middleware-extraction/migration.d.ts

@@ -0,0 +1,2 @@
+import { type MigrationReturnObject, type Tree } from '@nx/devkit';
+export default function migration(tree: Tree): Promise<MigrationReturnObject>;