@aws/nx-plugin 1.0.0-rc.8 → 1.0.0-rc.80

package/src/migrations/latest/ts-agent-session-id-middleware-extraction/migration.js

@@ -0,0 +1,136 @@
+/**
+ * Copyright Amazon.com, Inc. or its affiliates. All Rights Reserved.
+ * SPDX-License-Identifier: Apache-2.0
+ */ import { readFileSync } from "node:fs";
+import { join } from "node:path";
+import { getProjects, joinPathFragments } from "@nx/devkit";
+import { TS_AGENT_GENERATOR_INFO } from "../../../ts/agent/generator.js";
+import { addDestructuredImport, applyGritQL, captureGritQLVariable, matchGritQL } from "../../../utils/ast.js";
+import { formatFilesInSubtree } from "../../../utils/format.js";
+/**
+ * Extract the inline session-id Express middleware - previously duplicated
+ * verbatim in every ts#agent AG-UI/A2A `index.ts` - into a shared
+ * `middleware/session-id-middleware.ts` module sitting beside `index.ts`,
+ * mirroring how `agent.ts`/`session.ts` are already shared siblings.
+ *
+ * HTTP is untouched: its one procedure is a tRPC subscription served over
+ * WebSocket, which bypasses Express entirely, so it never had this middleware
+ * to begin with (see `enterSessionContext` in its `router.ts` instead).
+ *
+ * AG-UI and A2A wire the same logic up differently - AG-UI binds it to a
+ * named `sessionIdMiddleware` const before use, while A2A inlines it directly
+ * at the `app.use` call site - so each gets its own old-shape pattern below,
+ * even though both resolve to the same shared middleware content.
+ *
+ * Guardrails:
+ * - Pattern-match before writing: skip files that have diverged from the
+ *   generated shape and report them via `nextSteps`, rather than clobbering
+ *   the user's changes.
+ * - Idempotent: re-running is a no-op once migrated.
+ */ // The consuming repo's formatter/linter (e.g. Biome, ESLint import/order) may
+// alphabetize these three named type imports, so match/rewrite any of their
+// orderings rather than only the literal order the generator emits. Fixed-
+// arity destructuring (`[$a, $b, $c]`) pins the specifier count to exactly
+// three - so a 4th merged-in specifier fails to match - while constraining
+// each slot independently makes the check order-independent.
+const EXPRESS_IMPORT_OLD_WHERE = `{
+  $clause <: import_clause(default=\`express\`, name=named_imports(imports=[$a, $b, $c])),
+  $a <: or { \`type Request\`, \`type Response\`, \`type NextFunction\` },
+  $b <: or { \`type Request\`, \`type Response\`, \`type NextFunction\` },
+  $c <: or { \`type Request\`, \`type Response\`, \`type NextFunction\` }
+}`;
+const EXPRESS_IMPORT_OLD_MATCH = `\`import $clause from 'express';\` where ${EXPRESS_IMPORT_OLD_WHERE}`;
+const EXPRESS_IMPORT_OLD_REWRITE = `\`import $clause from 'express';\` => \`import express from 'express';\` where ${EXPRESS_IMPORT_OLD_WHERE}`;
+const RANDOM_UUID_IMPORT = "import { randomUUID } from 'node:crypto';";
+const SESSION_ID_HEADER_LINE = "const SESSION_ID_HEADER = 'x-amzn-bedrock-agentcore-runtime-session-id';";
+// The leading comment sits directly above both shapes below. GritQL can only
+// match it as its own comment node - folding it into the same backtick
+// snippet as the statement that follows fails to parse as one construct - so
+// it's matched/deleted as a separate step from the statement/expression.
+const MIDDLEWARE_LEADING_COMMENT = '// Bind the inbound session (or a fresh UUID) for downstream MCP / A2A calls.';
+// AG-UI binds the middleware to a named const, used later via `app.use(sessionIdMiddleware)`.
+const AGUI_MIDDLEWARE_DEFINITION_OLD = `const sessionIdMiddleware = (req: Request, _res: Response, next: NextFunction) => {
+  const header = req.headers[SESSION_ID_HEADER];
+  const sessionId = (Array.isArray(header) ? header[0] : header) ?? randomUUID();
+  runWithSessionId(sessionId, () => next());
+};`;
+// A2A inlines the same logic directly at the `app.use` call site instead.
+const A2A_MIDDLEWARE_USE_OLD = `app.use((req: Request, _res: Response, next: NextFunction) => {
+    const header = req.headers[SESSION_ID_HEADER];
+    const sessionId = (Array.isArray(header) ? header[0] : header) ?? randomUUID();
+    runWithSessionId(sessionId, () => next());
+  });`;
+const A2A_MIDDLEWARE_USE_NEW = 'app.use(sessionIdMiddleware);';
+// Captures the agent-connection package specifier so the new middleware
+// module targets the same one. Generic over `$names` since a connection
+// generator may have merged its own import into this same statement.
+const RUNWITHSESSIONID_IMPORT_CAPTURE = "`import { $names } from '$mod';` where { $names <: contains `runWithSessionId` }";
+// Removes `runWithSessionId` from the named import, preserving any other
+// merged specifiers (or the whole statement if it was the only one).
+// Decomposed via `import_clause(name=named_imports($imports))` since a naive
+// `$rest`-based rewrite silently fails once other specifiers are involved.
+const REMOVE_RUNWITHSESSIONID_IMPORT_PATTERN = `\`import $clause from '$mod';\` as $import where {
+  $clause <: import_clause(name=named_imports($imports)),
+  $imports <: contains \`runWithSessionId\`,
+  if ($imports <: [\`runWithSessionId\`]) { $import => . } else { $imports <: some import_specifier(name=\`runWithSessionId\`) => . }
+}`;
+// Both protocols' `common-express/` dir vends byte-identical middleware
+// content; read as the single source of truth rather than hand-duplicating
+// it here.
+const SESSION_ID_MIDDLEWARE_TEMPLATE = readFileSync(join(import.meta.dirname, '../../../ts/agent/files/common-express/middleware/session-id-middleware.ts.template'), 'utf-8');
+const sessionIdMiddlewareContent = (agentConnectionImport)=>SESSION_ID_MIDDLEWARE_TEMPLATE.replace('<%- agentConnectionImport %>', agentConnectionImport);
+const findAgentComponents = (components)=>(components ?? []).filter((component)=>component.generator === TS_AGENT_GENERATOR_INFO.id && (component.protocol === 'ag-ui' || component.protocol === 'a2a'));
+const migrateIndex = async (tree, indexPath, protocol, nextSteps)=>{
+    if (!tree.exists(indexPath)) return;
+    const contents = tree.read(indexPath, 'utf-8') ?? '';
+    if (!contents.includes(SESSION_ID_HEADER_LINE)) return;
+    const middlewarePattern = protocol === 'ag-ui' ? AGUI_MIDDLEWARE_DEFINITION_OLD : A2A_MIDDLEWARE_USE_OLD;
+    const diverged = ()=>{
+        nextSteps.push(`${indexPath}: diverged from the generated ts#agent ${protocol} shape - left untouched. Manually move the inline session-id middleware into a sibling \`middleware/session-id-middleware.ts\` module and import \`sessionIdMiddleware\` from there (see the ts#agent generator's template).`);
+    };
+    const ready = await matchGritQL(tree, indexPath, EXPRESS_IMPORT_OLD_MATCH) && await matchGritQL(tree, indexPath, `\`${RANDOM_UUID_IMPORT}\``) && await matchGritQL(tree, indexPath, `\`${SESSION_ID_HEADER_LINE}\``) && await matchGritQL(tree, indexPath, `\`${MIDDLEWARE_LEADING_COMMENT}\``) && await matchGritQL(tree, indexPath, `\`${middlewarePattern}\``) && await matchGritQL(tree, indexPath, RUNWITHSESSIONID_IMPORT_CAPTURE);
+    if (!ready) {
+        diverged();
+        return;
+    }
+    const mod = await captureGritQLVariable(tree, indexPath, RUNWITHSESSIONID_IMPORT_CAPTURE, 'mod');
+    if (!mod) {
+        diverged();
+        return;
+    }
+    const dir = indexPath.split('/').slice(0, -1).join('/');
+    const middlewarePath = joinPathFragments(dir, 'middleware', 'session-id-middleware.ts');
+    if (!tree.exists(middlewarePath)) {
+        tree.write(middlewarePath, sessionIdMiddlewareContent(mod));
+    }
+    await applyGritQL(tree, indexPath, EXPRESS_IMPORT_OLD_REWRITE);
+    await applyGritQL(tree, indexPath, `\`${RANDOM_UUID_IMPORT}\` => .`);
+    await applyGritQL(tree, indexPath, `\`${SESSION_ID_HEADER_LINE}\` => .`);
+    await applyGritQL(tree, indexPath, REMOVE_RUNWITHSESSIONID_IMPORT_PATTERN);
+    await applyGritQL(tree, indexPath, `\`${MIDDLEWARE_LEADING_COMMENT}\` => .`);
+    if (protocol === 'ag-ui') {
+        await applyGritQL(tree, indexPath, `\`${AGUI_MIDDLEWARE_DEFINITION_OLD}\` => .`);
+    } else {
+        await applyGritQL(tree, indexPath, `\`${A2A_MIDDLEWARE_USE_OLD}\` => \`${A2A_MIDDLEWARE_USE_NEW}\``);
+    }
+    await addDestructuredImport(tree, indexPath, [
+        'sessionIdMiddleware'
+    ], './middleware/session-id-middleware.js');
+};
+export default async function migration(tree) {
+    const nextSteps = [];
+    for (const project of getProjects(tree).values()){
+        const components = findAgentComponents(project.metadata?.components);
+        for (const component of components){
+            if (!component.path) continue;
+            const indexPath = joinPathFragments(project.root, component.path, 'index.ts');
+            await migrateIndex(tree, indexPath, component.protocol, nextSteps);
+        }
+    }
+    await formatFilesInSubtree(tree);
+    return {
+        nextSteps
+    };
+}
+
+//# sourceMappingURL=migration.js.map

package/src/migrations/latest/ts-agent-session-id-middleware-extraction/migration.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../../../../../../../packages/nx-plugin/src/migrations/latest/ts-agent-session-id-middleware-extraction/migration.ts"],"sourcesContent":["/**\n * Copyright Amazon.com, Inc. or its affiliates. All Rights Reserved.\n * SPDX-License-Identifier: Apache-2.0\n */\nimport { readFileSync } from 'node:fs';\nimport { join } from 'node:path';\nimport {\n  getProjects,\n  joinPathFragments,\n  type MigrationReturnObject,\n  type Tree,\n} from '@nx/devkit';\nimport { TS_AGENT_GENERATOR_INFO } from '../../../ts/agent/generator.js';\nimport {\n  addDestructuredImport,\n  applyGritQL,\n  captureGritQLVariable,\n  matchGritQL,\n} from '../../../utils/ast.js';\nimport { formatFilesInSubtree } from '../../../utils/format.js';\nimport type { ComponentMetadata } from '../../../utils/nx.js';\n\n/**\n * Extract the inline session-id Express middleware - previously duplicated\n * verbatim in every ts#agent AG-UI/A2A `index.ts` - into a shared\n * `middleware/session-id-middleware.ts` module sitting beside `index.ts`,\n * mirroring how `agent.ts`/`session.ts` are already shared siblings.\n *\n * HTTP is untouched: its one procedure is a tRPC subscription served over\n * WebSocket, which bypasses Express entirely, so it never had this middleware\n * to begin with (see `enterSessionContext` in its `router.ts` instead).\n *\n * AG-UI and A2A wire the same logic up differently - AG-UI binds it to a\n * named `sessionIdMiddleware` const before use, while A2A inlines it directly\n * at the `app.use` call site - so each gets its own old-shape pattern below,\n * even though both resolve to the same shared middleware content.\n *\n * Guardrails:\n * - Pattern-match before writing: skip files that have diverged from the\n *   generated shape and report them via `nextSteps`, rather than clobbering\n *   the user's changes.\n * - Idempotent: re-running is a no-op once migrated.\n */\n\n// The consuming repo's formatter/linter (e.g. Biome, ESLint import/order) may\n// alphabetize these three named type imports, so match/rewrite any of their\n// orderings rather than only the literal order the generator emits. Fixed-\n// arity destructuring (`[$a, $b, $c]`) pins the specifier count to exactly\n// three - so a 4th merged-in specifier fails to match - while constraining\n// each slot independently makes the check order-independent.\nconst EXPRESS_IMPORT_OLD_WHERE = `{\n  $clause <: import_clause(default=\\`express\\`, name=named_imports(imports=[$a, $b, $c])),\n  $a <: or { \\`type Request\\`, \\`type Response\\`, \\`type NextFunction\\` },\n  $b <: or { \\`type Request\\`, \\`type Response\\`, \\`type NextFunction\\` },\n  $c <: or { \\`type Request\\`, \\`type Response\\`, \\`type NextFunction\\` }\n}`;\nconst EXPRESS_IMPORT_OLD_MATCH = `\\`import $clause from 'express';\\` where ${EXPRESS_IMPORT_OLD_WHERE}`;\nconst EXPRESS_IMPORT_OLD_REWRITE = `\\`import $clause from 'express';\\` => \\`import express from 'express';\\` where ${EXPRESS_IMPORT_OLD_WHERE}`;\n\nconst RANDOM_UUID_IMPORT = \"import { randomUUID } from 'node:crypto';\";\n\nconst SESSION_ID_HEADER_LINE =\n  \"const SESSION_ID_HEADER = 'x-amzn-bedrock-agentcore-runtime-session-id';\";\n\n// The leading comment sits directly above both shapes below. GritQL can only\n// match it as its own comment node - folding it into the same backtick\n// snippet as the statement that follows fails to parse as one construct - so\n// it's matched/deleted as a separate step from the statement/expression.\nconst MIDDLEWARE_LEADING_COMMENT =\n  '// Bind the inbound session (or a fresh UUID) for downstream MCP / A2A calls.';\n\n// AG-UI binds the middleware to a named const, used later via `app.use(sessionIdMiddleware)`.\nconst AGUI_MIDDLEWARE_DEFINITION_OLD = `const sessionIdMiddleware = (req: Request, _res: Response, next: NextFunction) => {\n  const header = req.headers[SESSION_ID_HEADER];\n  const sessionId = (Array.isArray(header) ? header[0] : header) ?? randomUUID();\n  runWithSessionId(sessionId, () => next());\n};`;\n\n// A2A inlines the same logic directly at the `app.use` call site instead.\nconst A2A_MIDDLEWARE_USE_OLD = `app.use((req: Request, _res: Response, next: NextFunction) => {\n    const header = req.headers[SESSION_ID_HEADER];\n    const sessionId = (Array.isArray(header) ? header[0] : header) ?? randomUUID();\n    runWithSessionId(sessionId, () => next());\n  });`;\nconst A2A_MIDDLEWARE_USE_NEW = 'app.use(sessionIdMiddleware);';\n\n// Captures the agent-connection package specifier so the new middleware\n// module targets the same one. Generic over `$names` since a connection\n// generator may have merged its own import into this same statement.\nconst RUNWITHSESSIONID_IMPORT_CAPTURE =\n  \"`import { $names } from '$mod';` where { $names <: contains `runWithSessionId` }\";\n\n// Removes `runWithSessionId` from the named import, preserving any other\n// merged specifiers (or the whole statement if it was the only one).\n// Decomposed via `import_clause(name=named_imports($imports))` since a naive\n// `$rest`-based rewrite silently fails once other specifiers are involved.\nconst REMOVE_RUNWITHSESSIONID_IMPORT_PATTERN = `\\`import $clause from '$mod';\\` as $import where {\n  $clause <: import_clause(name=named_imports($imports)),\n  $imports <: contains \\`runWithSessionId\\`,\n  if ($imports <: [\\`runWithSessionId\\`]) { $import => . } else { $imports <: some import_specifier(name=\\`runWithSessionId\\`) => . }\n}`;\n\n// Both protocols' `common-express/` dir vends byte-identical middleware\n// content; read as the single source of truth rather than hand-duplicating\n// it here.\nconst SESSION_ID_MIDDLEWARE_TEMPLATE = readFileSync(\n  join(\n    import.meta.dirname,\n    '../../../ts/agent/files/common-express/middleware/session-id-middleware.ts.template',\n  ),\n  'utf-8',\n);\n\nconst sessionIdMiddlewareContent = (agentConnectionImport: string): string =>\n  SESSION_ID_MIDDLEWARE_TEMPLATE.replace(\n    '<%- agentConnectionImport %>',\n    agentConnectionImport,\n  );\n\nconst findAgentComponents = (\n  components: ComponentMetadata[] | undefined,\n): ComponentMetadata[] =>\n  (components ?? []).filter(\n    (component) =>\n      component.generator === TS_AGENT_GENERATOR_INFO.id &&\n      (component.protocol === 'ag-ui' || component.protocol === 'a2a'),\n  );\n\nconst migrateIndex = async (\n  tree: Tree,\n  indexPath: string,\n  protocol: 'ag-ui' | 'a2a',\n  nextSteps: string[],\n): Promise<void> => {\n  if (!tree.exists(indexPath)) return;\n\n  const contents = tree.read(indexPath, 'utf-8') ?? '';\n  if (!contents.includes(SESSION_ID_HEADER_LINE)) return;\n\n  const middlewarePattern =\n    protocol === 'ag-ui'\n      ? AGUI_MIDDLEWARE_DEFINITION_OLD\n      : A2A_MIDDLEWARE_USE_OLD;\n\n  const diverged = () => {\n    nextSteps.push(\n      `${indexPath}: diverged from the generated ts#agent ${protocol} shape - left untouched. Manually move the inline session-id middleware into a sibling \\`middleware/session-id-middleware.ts\\` module and import \\`sessionIdMiddleware\\` from there (see the ts#agent generator's template).`,\n    );\n  };\n\n  const ready =\n    (await matchGritQL(tree, indexPath, EXPRESS_IMPORT_OLD_MATCH)) &&\n    (await matchGritQL(tree, indexPath, `\\`${RANDOM_UUID_IMPORT}\\``)) &&\n    (await matchGritQL(tree, indexPath, `\\`${SESSION_ID_HEADER_LINE}\\``)) &&\n    (await matchGritQL(tree, indexPath, `\\`${MIDDLEWARE_LEADING_COMMENT}\\``)) &&\n    (await matchGritQL(tree, indexPath, `\\`${middlewarePattern}\\``)) &&\n    (await matchGritQL(tree, indexPath, RUNWITHSESSIONID_IMPORT_CAPTURE));\n\n  if (!ready) {\n    diverged();\n    return;\n  }\n\n  const mod = await captureGritQLVariable(\n    tree,\n    indexPath,\n    RUNWITHSESSIONID_IMPORT_CAPTURE,\n    'mod',\n  );\n  if (!mod) {\n    diverged();\n    return;\n  }\n\n  const dir = indexPath.split('/').slice(0, -1).join('/');\n  const middlewarePath = joinPathFragments(\n    dir,\n    'middleware',\n    'session-id-middleware.ts',\n  );\n\n  if (!tree.exists(middlewarePath)) {\n    tree.write(middlewarePath, sessionIdMiddlewareContent(mod));\n  }\n\n  await applyGritQL(tree, indexPath, EXPRESS_IMPORT_OLD_REWRITE);\n  await applyGritQL(tree, indexPath, `\\`${RANDOM_UUID_IMPORT}\\` => .`);\n  await applyGritQL(tree, indexPath, `\\`${SESSION_ID_HEADER_LINE}\\` => .`);\n  await applyGritQL(tree, indexPath, REMOVE_RUNWITHSESSIONID_IMPORT_PATTERN);\n  await applyGritQL(tree, indexPath, `\\`${MIDDLEWARE_LEADING_COMMENT}\\` => .`);\n\n  if (protocol === 'ag-ui') {\n    await applyGritQL(\n      tree,\n      indexPath,\n      `\\`${AGUI_MIDDLEWARE_DEFINITION_OLD}\\` => .`,\n    );\n  } else {\n    await applyGritQL(\n      tree,\n      indexPath,\n      `\\`${A2A_MIDDLEWARE_USE_OLD}\\` => \\`${A2A_MIDDLEWARE_USE_NEW}\\``,\n    );\n  }\n\n  await addDestructuredImport(\n    tree,\n    indexPath,\n    ['sessionIdMiddleware'],\n    './middleware/session-id-middleware.js',\n  );\n};\n\nexport default async function migration(\n  tree: Tree,\n): Promise<MigrationReturnObject> {\n  const nextSteps: string[] = [];\n\n  for (const project of getProjects(tree).values()) {\n    const components = findAgentComponents(\n      (project.metadata as { components?: ComponentMetadata[] })?.components,\n    );\n\n    for (const component of components) {\n      if (!component.path) continue;\n\n      const indexPath = joinPathFragments(\n        project.root,\n        component.path,\n        'index.ts',\n      );\n\n      await migrateIndex(\n        tree,\n        indexPath,\n        component.protocol as 'ag-ui' | 'a2a',\n        nextSteps,\n      );\n    }\n  }\n\n  await formatFilesInSubtree(tree);\n\n  return { nextSteps };\n}\n"],"names":["readFileSync","join","getProjects","joinPathFragments","TS_AGENT_GENERATOR_INFO","addDestructuredImport","applyGritQL","captureGritQLVariable","matchGritQL","formatFilesInSubtree","EXPRESS_IMPORT_OLD_WHERE","EXPRESS_IMPORT_OLD_MATCH","EXPRESS_IMPORT_OLD_REWRITE","RANDOM_UUID_IMPORT","SESSION_ID_HEADER_LINE","MIDDLEWARE_LEADING_COMMENT","AGUI_MIDDLEWARE_DEFINITION_OLD","A2A_MIDDLEWARE_USE_OLD","A2A_MIDDLEWARE_USE_NEW","RUNWITHSESSIONID_IMPORT_CAPTURE","REMOVE_RUNWITHSESSIONID_IMPORT_PATTERN","SESSION_ID_MIDDLEWARE_TEMPLATE","dirname","sessionIdMiddlewareContent","agentConnectionImport","replace","findAgentComponents","components","filter","component","generator","id","protocol","migrateIndex","tree","indexPath","nextSteps","exists","contents","read","includes","middlewarePattern","diverged","push","ready","mod","dir","split","slice","middlewarePath","write","migration","project","values","metadata","path","root"],"mappings":"AAAA;;;CAGC,GACD,SAASA,YAAY,QAAQ,UAAU;AACvC,SAASC,IAAI,QAAQ,YAAY;AACjC,SACEC,WAAW,EACXC,iBAAiB,QAGZ,aAAa;AACpB,SAASC,uBAAuB,QAAQ,iCAAiC;AACzE,SACEC,qBAAqB,EACrBC,WAAW,EACXC,qBAAqB,EACrBC,WAAW,QACN,wBAAwB;AAC/B,SAASC,oBAAoB,QAAQ,2BAA2B;AAGhE;;;;;;;;;;;;;;;;;;;;CAoBC,GAED,8EAA8E;AAC9E,4EAA4E;AAC5E,2EAA2E;AAC3E,2EAA2E;AAC3E,2EAA2E;AAC3E,6DAA6D;AAC7D,MAAMC,2BAA2B,CAAC;;;;;CAKjC,CAAC;AACF,MAAMC,2BAA2B,CAAC,yCAAyC,EAAED,0BAA0B;AACvG,MAAME,6BAA6B,CAAC,+EAA+E,EAAEF,0BAA0B;AAE/I,MAAMG,qBAAqB;AAE3B,MAAMC,yBACJ;AAEF,6EAA6E;AAC7E,uEAAuE;AACvE,6EAA6E;AAC7E,yEAAyE;AACzE,MAAMC,6BACJ;AAEF,8FAA8F;AAC9F,MAAMC,iCAAiC,CAAC;;;;EAItC,CAAC;AAEH,0EAA0E;AAC1E,MAAMC,yBAAyB,CAAC;;;;KAI3B,CAAC;AACN,MAAMC,yBAAyB;AAE/B,wEAAwE;AACxE,wEAAwE;AACxE,qEAAqE;AACrE,MAAMC,kCACJ;AAEF,yEAAyE;AACzE,qEAAqE;AACrE,6EAA6E;AAC7E,2EAA2E;AAC3E,MAAMC,yCAAyC,CAAC;;;;CAI/C,CAAC;AAEF,wEAAwE;AACxE,2EAA2E;AAC3E,WAAW;AACX,MAAMC,iCAAiCrB,aACrCC,KACE,YAAYqB,OAAO,EACnB,wFAEF;AAGF,MAAMC,6BAA6B,CAACC,wBAClCH,+BAA+BI,OAAO,CACpC,gCACAD;AAGJ,MAAME,sBAAsB,CAC1BC,aAEA,AAACA,CAAAA,cAAc,EAAE,AAAD,EAAGC,MAAM,CACvB,CAACC,YACCA,UAAUC,SAAS,KAAK1B,wBAAwB2B,EAAE,IACjDF,CAAAA,UAAUG,QAAQ,KAAK,WAAWH,UAAUG,QAAQ,KAAK,KAAI;AAGpE,MAAMC,eAAe,OACnBC,MACAC,WACAH,UACAI;IAEA,IAAI,CAACF,KAAKG,MAAM,CAACF,YAAY;IAE7B,MAAMG,WAAWJ,KAAKK,IAAI,CAACJ,WAAW,YAAY;IAClD,IAAI,CAACG,SAASE,QAAQ,CAAC1B,yBAAyB;IAEhD,MAAM2B,oBACJT,aAAa,UACThB,iCACAC;IAEN,MAAMyB,WAAW;QACfN,UAAUO,IAAI,CACZ,GAAGR,UAAU,uCAAuC,EAAEH,SAAS,4NAA4N,CAAC;IAEhS;IAEA,MAAMY,QACJ,AAAC,MAAMpC,YAAY0B,MAAMC,WAAWxB,6BACnC,MAAMH,YAAY0B,MAAMC,WAAW,CAAC,EAAE,EAAEtB,mBAAmB,EAAE,CAAC,KAC9D,MAAML,YAAY0B,MAAMC,WAAW,CAAC,EAAE,EAAErB,uBAAuB,EAAE,CAAC,KAClE,MAAMN,YAAY0B,MAAMC,WAAW,CAAC,EAAE,EAAEpB,2BAA2B,EAAE,CAAC,KACtE,MAAMP,YAAY0B,MAAMC,WAAW,CAAC,EAAE,EAAEM,kBAAkB,EAAE,CAAC,KAC7D,MAAMjC,YAAY0B,MAAMC,WAAWhB;IAEtC,IAAI,CAACyB,OAAO;QACVF;QACA;IACF;IAEA,MAAMG,MAAM,MAAMtC,sBAChB2B,MACAC,WACAhB,iCACA;IAEF,IAAI,CAAC0B,KAAK;QACRH;QACA;IACF;IAEA,MAAMI,MAAMX,UAAUY,KAAK,CAAC,KAAKC,KAAK,CAAC,GAAG,CAAC,GAAG/C,IAAI,CAAC;IACnD,MAAMgD,iBAAiB9C,kBACrB2C,KACA,cACA;IAGF,IAAI,CAACZ,KAAKG,MAAM,CAACY,iBAAiB;QAChCf,KAAKgB,KAAK,CAACD,gBAAgB1B,2BAA2BsB;IACxD;IAEA,MAAMvC,YAAY4B,MAAMC,WAAWvB;IACnC,MAAMN,YAAY4B,MAAMC,WAAW,CAAC,EAAE,EAAEtB,mBAAmB,OAAO,CAAC;IACnE,MAAMP,YAAY4B,MAAMC,WAAW,CAAC,EAAE,EAAErB,uBAAuB,OAAO,CAAC;IACvE,MAAMR,YAAY4B,MAAMC,WAAWf;IACnC,MAAMd,YAAY4B,MAAMC,WAAW,CAAC,EAAE,EAAEpB,2BAA2B,OAAO,CAAC;IAE3E,IAAIiB,aAAa,SAAS;QACxB,MAAM1B,YACJ4B,MACAC,WACA,CAAC,EAAE,EAAEnB,+BAA+B,OAAO,CAAC;IAEhD,OAAO;QACL,MAAMV,YACJ4B,MACAC,WACA,CAAC,EAAE,EAAElB,uBAAuB,QAAQ,EAAEC,uBAAuB,EAAE,CAAC;IAEpE;IAEA,MAAMb,sBACJ6B,MACAC,WACA;QAAC;KAAsB,EACvB;AAEJ;AAEA,eAAe,eAAegB,UAC5BjB,IAAU;IAEV,MAAME,YAAsB,EAAE;IAE9B,KAAK,MAAMgB,WAAWlD,YAAYgC,MAAMmB,MAAM,GAAI;QAChD,MAAM1B,aAAaD,oBAChB0B,QAAQE,QAAQ,EAA2C3B;QAG9D,KAAK,MAAME,aAAaF,WAAY;YAClC,IAAI,CAACE,UAAU0B,IAAI,EAAE;YAErB,MAAMpB,YAAYhC,kBAChBiD,QAAQI,IAAI,EACZ3B,UAAU0B,IAAI,EACd;YAGF,MAAMtB,aACJC,MACAC,WACAN,UAAUG,QAAQ,EAClBI;QAEJ;IACF;IAEA,MAAM3B,qBAAqByB;IAE3B,OAAO;QAAEE;IAAU;AACrB"}

package/src/migrations/latest/user-identity-configurable-mfa/metadata.json

@@ -0,0 +1,3 @@
+{
+  "description": "Surface mfa and mfaSecondFactor on the vended UserIdentity construct/module"
+}

package/src/migrations/latest/user-identity-configurable-mfa/migration.d.ts

@@ -0,0 +1,6 @@
+/**
+ * Copyright Amazon.com, Inc. or its affiliates. All Rights Reserved.
+ * SPDX-License-Identifier: Apache-2.0
+ */
+import type { MigrationReturnObject, Tree } from '@nx/devkit';
+export default function migration(tree: Tree): Promise<MigrationReturnObject>;

package/src/migrations/latest/user-identity-configurable-mfa/migration.js

@@ -0,0 +1,362 @@
+/**
+ * Copyright Amazon.com, Inc. or its affiliates. All Rights Reserved.
+ * SPDX-License-Identifier: Apache-2.0
+ */ import { addDestructuredImport, applyGritQL, matchGritQL } from "../../../utils/ast.js";
+import { formatFilesInSubtree } from "../../../utils/format.js";
+import { PACKAGES_DIR, SHARED_CONSTRUCTS_DIR, SHARED_TERRAFORM_DIR } from "../../../utils/shared-constructs-constants.js";
+/**
+ * Surface mfa and mfaSecondFactor on the vended UserIdentity construct/module
+ *
+ * CDK's `mfa` / `mfaSecondFactor` props default to what the construct already
+ * hard-coded (`Mfa.REQUIRED` / `{ sms: true, otp: true }`), so this just makes
+ * them overridable, matching the existing `enableWaf` prop pattern.
+ *
+ * Terraform has no equivalent of CloudFormation's `EnabledMfas` - SMS MFA is
+ * inseparable from the `sms_configuration` block, which phone number
+ * verification also relies on. So `mfa_second_factor_sms` gates
+ * `sms_configuration` (and, with it, SMS phone verification) rather than only
+ * MFA, unlike the CDK prop.
+ *
+ * CDK has the same underlying coupling for any non-OFF `mfa`: Cognito rejects
+ * `SmsConfiguration` (which CDK emits whenever phone is auto-verified) unless
+ * SMS is also an enabled MFA method. So `phoneVerificationEnabled` gates
+ * `autoVerify`/`keepOriginal`'s `phone` flag on whether SMS is actually usable
+ * as a second factor, and a `mfa: REQUIRED` with neither `sms` nor `otp`
+ * enabled - a pool nobody could ever sign into - is rejected at synth time.
+ *
+ * How to write a migration:
+ * - https://nx.dev/docs/kb/migration-generators
+ * - What `nextSteps` means: https://nx.dev/docs/reference/devkit/MigrationReturnObject
+ *
+ * Guardrails:
+ * - Pattern-match before writing: skip files that have diverged from the shape
+ *   your generators produce and report them via `nextSteps`, rather than
+ *   clobbering the user's changes.
+ * - Idempotent: re-running must be a no-op.
+ * - Format what you write: finish with `formatFilesInSubtree` so the files your
+ *   migration wrote are formatted correctly.
+ */ const CDK_USER_IDENTITY_FILE = `${PACKAGES_DIR}/${SHARED_CONSTRUCTS_DIR}/src/core/user-identity.ts`;
+const TERRAFORM_IDENTITY_FILE = `${PACKAGES_DIR}/${SHARED_TERRAFORM_DIR}/src/core/user-identity/identity/identity.tf`;
+const TERRAFORM_MAIN_FILE = `${PACKAGES_DIR}/${SHARED_TERRAFORM_DIR}/src/core/user-identity/main.tf`;
+const NEW_TERRAFORM_VARIABLES = `variable "mfa" {
+  description = "Whether users must configure MFA, may optionally configure MFA, or cannot use MFA at all"
+  type        = string
+  default     = "ON"
+
+  validation {
+    condition     = contains(["OFF", "OPTIONAL", "ON"], var.mfa)
+    error_message = "mfa must be one of OFF, OPTIONAL, ON"
+  }
+}
+
+variable "mfa_second_factor_otp" {
+  description = "Whether users can use a time-based one time password (TOTP), generated by a hardware or software token, as an MFA method"
+  type        = bool
+  default     = true
+}
+
+variable "mfa_second_factor_sms" {
+  description = "Whether users can use SMS to their verified phone numbers as an MFA method. Due to a Terraform AWS provider limitation, disabling this also disables SMS-based phone number verification, unlike the equivalent CDK construct prop"
+  type        = bool
+  default     = true
+}`;
+// Guards each file: present only once it has been migrated.
+const CDK_MIGRATED_PATTERN = '`mfa === Mfa.OFF || mfaSecondFactor.sms`';
+const TERRAFORM_IDENTITY_MIGRATED_PATTERN = 'language hcl\n`mfa_configuration = var.mfa`';
+const TERRAFORM_MAIN_MIGRATED_PATTERN = 'language hcl\n`mfa = var.mfa`';
+// Interface members don't parse as standalone snippets, so this anchors on the
+// whole interface body (preserved via $body) rather than the enableWaf member.
+const CDK_INTERFACE_BODY_PATTERN = '`export interface UserIdentityProps { $body }`';
+// A parameter's type annotation blocks matching the destructure sub-pattern in
+// isolation, so this anchors on the full constructor signature instead
+// (literal params so a customised signature is correctly seen as diverged).
+const CDK_CONSTRUCTOR_PATTERN = '`constructor(scope: Construct, id: string, { enableWaf = true }: UserIdentityProps = {}) { $body }`';
+const CDK_CREATE_CALL_PATTERN = '`this.createUserPool()`';
+const CDK_CREATE_SIGNATURE_PATTERN = '`private createUserPool = () => $body`';
+// Trailing commas block matching a bare object property in isolation; the
+// separator is outside the matched span either way, so it survives untouched.
+const CDK_MFA_FIELD_PATTERN = '`mfa: Mfa.REQUIRED`';
+const CDK_MFA_SECOND_FACTOR_FIELD_PATTERN = '`mfaSecondFactor: { sms: true, otp: true }`';
+const CDK_SUPER_CALL_PATTERN = '`super(scope, id);`';
+// $props preserves the whole (large) UserPool props object untouched while
+// inserting the new const declaration immediately before it.
+const CDK_NEW_USER_POOL_PATTERN = "`const userPool = new UserPool(this, 'UserPool', { $props })`";
+// Matches both the autoVerify.phone and keepOriginal.phone occurrences in one pass.
+const CDK_PHONE_TRUE_PATTERN = '`phone: true`';
+const CDK_EDITS = [
+    [
+        CDK_INTERFACE_BODY_PATTERN,
+        `${CDK_INTERFACE_BODY_PATTERN} => \`export interface UserIdentityProps {
+  $body
+
+  /**
+   * Whether users must configure MFA, may optionally configure MFA, or cannot use MFA at all.
+   *
+   * @default Mfa.REQUIRED
+   */
+  readonly mfa?: Mfa;
+
+  /**
+   * The MFA methods available to users when MFA is not off.
+   *
+   * @default { sms: true, otp: true }
+   */
+  readonly mfaSecondFactor?: MfaSecondFactor;
+}\``
+    ],
+    [
+        CDK_CONSTRUCTOR_PATTERN,
+        `${CDK_CONSTRUCTOR_PATTERN} => \`constructor(
+    scope: Construct,
+    id: string,
+    {
+      enableWaf = true,
+      mfa = Mfa.REQUIRED,
+      mfaSecondFactor = { sms: true, otp: true },
+    }: UserIdentityProps = {},
+  ) { $body }\``
+    ],
+    [
+        CDK_CREATE_CALL_PATTERN,
+        `${CDK_CREATE_CALL_PATTERN} => \`this.createUserPool(mfa, mfaSecondFactor)\``
+    ],
+    [
+        CDK_CREATE_SIGNATURE_PATTERN,
+        `${CDK_CREATE_SIGNATURE_PATTERN} => \`private createUserPool = (mfa: Mfa, mfaSecondFactor: MfaSecondFactor) => $body\``
+    ],
+    [
+        CDK_MFA_FIELD_PATTERN,
+        `${CDK_MFA_FIELD_PATTERN} => \`mfa\``
+    ],
+    [
+        CDK_MFA_SECOND_FACTOR_FIELD_PATTERN,
+        `${CDK_MFA_SECOND_FACTOR_FIELD_PATTERN} => \`mfaSecondFactor\``
+    ],
+    [
+        CDK_SUPER_CALL_PATTERN,
+        `${CDK_SUPER_CALL_PATTERN} => \`super(scope, id);
+
+    if (mfa === Mfa.REQUIRED && !mfaSecondFactor.sms && !mfaSecondFactor.otp) {
+      throw new Error(
+        'UserIdentity: mfa is REQUIRED but mfaSecondFactor has no methods enabled (sms and otp are both false)',
+      );
+    }\``
+    ],
+    [
+        CDK_NEW_USER_POOL_PATTERN,
+        `${CDK_NEW_USER_POOL_PATTERN} => \`const phoneVerificationEnabled = mfa === Mfa.OFF || mfaSecondFactor.sms;
+
+    const userPool = new UserPool(this, 'UserPool', { $props })\``
+    ],
+    [
+        CDK_PHONE_TRUE_PATTERN,
+        `${CDK_PHONE_TRUE_PATTERN} => \`phone: phoneVerificationEnabled\``
+    ]
+];
+const TERRAFORM_IDENTITY_ENABLE_WAF_VARIABLE_ANCHOR = [
+    'language hcl',
+    '`variable "enable_waf" {',
+    '  description = "Whether to enable AWS WAFv2 with the default managed ruleset (AWSManagedRulesCommonRuleSet and AWSManagedRulesKnownBadInputsRuleSet) and associate it with the user pool"',
+    '  type        = bool',
+    '  default     = true',
+    '}`'
+].join('\n');
+const TERRAFORM_MFA_CONFIGURATION_PATTERN = [
+    'language hcl',
+    '`mfa_configuration = "ON"`'
+].join('\n');
+const TERRAFORM_SOFTWARE_TOKEN_MFA_PATTERN = [
+    'language hcl',
+    '`software_token_mfa_configuration {',
+    '    enabled = true',
+    '  }`'
+].join('\n');
+const TERRAFORM_SMS_CONFIGURATION_PATTERN = [
+    'language hcl',
+    '`sms_configuration {',
+    '    external_id    = random_uuid.sms_external_id.result',
+    '    sns_caller_arn = aws_iam_role.cognito_sms_role.arn',
+    '    sns_region     = data.aws_region.current.region',
+    '  }`'
+].join('\n');
+const TERRAFORM_RANDOM_UUID_PATTERN = [
+    'language hcl',
+    '`resource "random_uuid" "sms_external_id" {}`'
+].join('\n');
+const TERRAFORM_SMS_ROLE_PATTERN = [
+    'language hcl',
+    '`resource "aws_iam_role" "cognito_sms_role" { $body }`'
+].join('\n');
+const TERRAFORM_SMS_POLICY_PATTERN = [
+    'language hcl',
+    '`resource "aws_iam_role_policy" "cognito_sms_policy" { $body }`'
+].join('\n');
+const TERRAFORM_SMS_ROLE_ID_REF_PATTERN = [
+    'language hcl',
+    '`aws_iam_role.cognito_sms_role.id`'
+].join('\n');
+const TERRAFORM_EXTERNAL_ID_REF_PATTERN = [
+    'language hcl',
+    '`random_uuid.sms_external_id.result`'
+].join('\n');
+const TERRAFORM_AUTO_VERIFIED_ATTRIBUTES_PATTERN = [
+    'language hcl',
+    '`auto_verified_attributes = ["email", "phone_number"]`'
+].join('\n');
+const TERRAFORM_ATTRIBUTES_REQUIRE_VERIFICATION_PATTERN = [
+    'language hcl',
+    '`attributes_require_verification_before_update = ["email", "phone_number"]`'
+].join('\n');
+const TERRAFORM_IDENTITY_EDITS = [
+    [
+        TERRAFORM_IDENTITY_ENABLE_WAF_VARIABLE_ANCHOR,
+        `${TERRAFORM_IDENTITY_ENABLE_WAF_VARIABLE_ANCHOR} => \`variable "enable_waf" {
+  description = "Whether to enable AWS WAFv2 with the default managed ruleset (AWSManagedRulesCommonRuleSet and AWSManagedRulesKnownBadInputsRuleSet) and associate it with the user pool"
+  type        = bool
+  default     = true
+}
+
+${NEW_TERRAFORM_VARIABLES}\``
+    ],
+    [
+        TERRAFORM_RANDOM_UUID_PATTERN,
+        `${TERRAFORM_RANDOM_UUID_PATTERN} => \`resource "random_uuid" "sms_external_id" {
+  count = var.mfa_second_factor_sms ? 1 : 0
+}\``
+    ],
+    [
+        TERRAFORM_SMS_ROLE_PATTERN,
+        `${TERRAFORM_SMS_ROLE_PATTERN} => \`resource "aws_iam_role" "cognito_sms_role" {
+  count = var.mfa_second_factor_sms ? 1 : 0
+
+  $body
+}\``
+    ],
+    [
+        TERRAFORM_SMS_POLICY_PATTERN,
+        `${TERRAFORM_SMS_POLICY_PATTERN} => \`resource "aws_iam_role_policy" "cognito_sms_policy" {
+  count = var.mfa_second_factor_sms ? 1 : 0
+
+  $body
+}\``
+    ],
+    [
+        TERRAFORM_MFA_CONFIGURATION_PATTERN,
+        `${TERRAFORM_MFA_CONFIGURATION_PATTERN} => \`mfa_configuration = var.mfa\``
+    ],
+    [
+        TERRAFORM_SOFTWARE_TOKEN_MFA_PATTERN,
+        `${TERRAFORM_SOFTWARE_TOKEN_MFA_PATTERN} => \`software_token_mfa_configuration {
+    enabled = var.mfa_second_factor_otp
+  }\``
+    ],
+    [
+        TERRAFORM_SMS_CONFIGURATION_PATTERN,
+        `${TERRAFORM_SMS_CONFIGURATION_PATTERN} => \`# SMS MFA configuration. Due to a Terraform AWS provider limitation, this also gates
+  # SMS-based phone number verification below - see the mfa_second_factor_sms variable.
+  dynamic "sms_configuration" {
+    for_each = var.mfa_second_factor_sms ? [1] : []
+
+    content {
+      external_id    = random_uuid.sms_external_id[0].result
+      sns_caller_arn = aws_iam_role.cognito_sms_role[0].arn
+      sns_region     = data.aws_region.current.region
+    }
+  }\``
+    ],
+    [
+        TERRAFORM_SMS_ROLE_ID_REF_PATTERN,
+        `${TERRAFORM_SMS_ROLE_ID_REF_PATTERN} => \`aws_iam_role.cognito_sms_role[0].id\``
+    ],
+    [
+        TERRAFORM_EXTERNAL_ID_REF_PATTERN,
+        `${TERRAFORM_EXTERNAL_ID_REF_PATTERN} => \`random_uuid.sms_external_id[0].result\``
+    ],
+    [
+        TERRAFORM_AUTO_VERIFIED_ATTRIBUTES_PATTERN,
+        `${TERRAFORM_AUTO_VERIFIED_ATTRIBUTES_PATTERN} => \`auto_verified_attributes = var.mfa_second_factor_sms ? ["email", "phone_number"] : ["email"]\``
+    ],
+    [
+        TERRAFORM_ATTRIBUTES_REQUIRE_VERIFICATION_PATTERN,
+        `${TERRAFORM_ATTRIBUTES_REQUIRE_VERIFICATION_PATTERN} => \`attributes_require_verification_before_update = var.mfa_second_factor_sms ? ["email", "phone_number"] : ["email"]\``
+    ]
+];
+const TERRAFORM_MAIN_ENABLE_WAF_VARIABLE_ANCHOR = [
+    'language hcl',
+    '`variable "enable_waf" {',
+    '  description = "Whether to enable AWS WAFv2 with the default managed ruleset and associate it with the user pool"',
+    '  type        = bool',
+    '  default     = true',
+    '}`'
+].join('\n');
+const TERRAFORM_MAIN_MODULE_PATTERN = [
+    'language hcl',
+    '`module "identity" {',
+    '  source = "./identity"',
+    '',
+    '  user_pool_domain_prefix = $prefix',
+    '  allow_signup = $allowSignup',
+    '  enable_waf = var.enable_waf',
+    '}`'
+].join('\n');
+const TERRAFORM_MAIN_EDITS = [
+    [
+        TERRAFORM_MAIN_ENABLE_WAF_VARIABLE_ANCHOR,
+        `${TERRAFORM_MAIN_ENABLE_WAF_VARIABLE_ANCHOR} => \`variable "enable_waf" {
+  description = "Whether to enable AWS WAFv2 with the default managed ruleset and associate it with the user pool"
+  type        = bool
+  default     = true
+}
+
+${NEW_TERRAFORM_VARIABLES}\``
+    ],
+    [
+        TERRAFORM_MAIN_MODULE_PATTERN,
+        `${TERRAFORM_MAIN_MODULE_PATTERN} => \`module "identity" {
+  source = "./identity"
+
+  user_pool_domain_prefix = $prefix
+  allow_signup = $allowSignup
+  enable_waf = var.enable_waf
+  mfa = var.mfa
+  mfa_second_factor_otp = var.mfa_second_factor_otp
+  mfa_second_factor_sms = var.mfa_second_factor_sms
+}\``
+    ]
+];
+const divergedNextStep = (filePath)=>`${filePath}: the UserIdentity construct/module has diverged from the generated shape - left untouched. To make MFA configurable, add mfa and mfaSecondFactor (CDK) / mfa, mfa_second_factor_otp and mfa_second_factor_sms (Terraform) yourself, following the same pattern as the existing enableWaf prop/variable.`;
+const applyEdits = async (tree, filePath, migratedPattern, edits, nextSteps, beforeApply)=>{
+    if (!tree.exists(filePath)) {
+        // This workspace doesn't use this IaC provider, or has no UserIdentity.
+        return;
+    }
+    if (await matchGritQL(tree, filePath, migratedPattern)) {
+        // Already migrated - silent skip keeps re-runs a no-op.
+        return;
+    }
+    // Confirm every edit site is present before writing any of them, so a file
+    // that only partly matches is left whole rather than half-edited.
+    const allSitesPresent = (await Promise.all(edits.map(([match])=>matchGritQL(tree, filePath, match)))).every(Boolean);
+    if (!allSitesPresent) {
+        nextSteps.push(divergedNextStep(filePath));
+        return;
+    }
+    await beforeApply?.();
+    for (const [, rewrite] of edits){
+        await applyGritQL(tree, filePath, rewrite);
+    }
+};
+export default async function migration(tree) {
+    const nextSteps = [];
+    await applyEdits(tree, CDK_USER_IDENTITY_FILE, CDK_MIGRATED_PATTERN, CDK_EDITS, nextSteps, ()=>addDestructuredImport(tree, CDK_USER_IDENTITY_FILE, [
+            'type MfaSecondFactor'
+        ], 'aws-cdk-lib/aws-cognito'));
+    await applyEdits(tree, TERRAFORM_IDENTITY_FILE, TERRAFORM_IDENTITY_MIGRATED_PATTERN, TERRAFORM_IDENTITY_EDITS, nextSteps);
+    await applyEdits(tree, TERRAFORM_MAIN_FILE, TERRAFORM_MAIN_MIGRATED_PATTERN, TERRAFORM_MAIN_EDITS, nextSteps);
+    await formatFilesInSubtree(tree);
+    return {
+        nextSteps
+    };
+}
+
+//# sourceMappingURL=migration.js.map

package/src/migrations/latest/user-identity-configurable-mfa/migration.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../../../../../../../packages/nx-plugin/src/migrations/latest/user-identity-configurable-mfa/migration.ts"],"sourcesContent":["/**\n * Copyright Amazon.com, Inc. or its affiliates. All Rights Reserved.\n * SPDX-License-Identifier: Apache-2.0\n */\nimport type { MigrationReturnObject, Tree } from '@nx/devkit';\nimport {\n  addDestructuredImport,\n  applyGritQL,\n  matchGritQL,\n} from '../../../utils/ast.js';\nimport { formatFilesInSubtree } from '../../../utils/format.js';\nimport {\n  PACKAGES_DIR,\n  SHARED_CONSTRUCTS_DIR,\n  SHARED_TERRAFORM_DIR,\n} from '../../../utils/shared-constructs-constants.js';\n\n/**\n * Surface mfa and mfaSecondFactor on the vended UserIdentity construct/module\n *\n * CDK's `mfa` / `mfaSecondFactor` props default to what the construct already\n * hard-coded (`Mfa.REQUIRED` / `{ sms: true, otp: true }`), so this just makes\n * them overridable, matching the existing `enableWaf` prop pattern.\n *\n * Terraform has no equivalent of CloudFormation's `EnabledMfas` - SMS MFA is\n * inseparable from the `sms_configuration` block, which phone number\n * verification also relies on. So `mfa_second_factor_sms` gates\n * `sms_configuration` (and, with it, SMS phone verification) rather than only\n * MFA, unlike the CDK prop.\n *\n * CDK has the same underlying coupling for any non-OFF `mfa`: Cognito rejects\n * `SmsConfiguration` (which CDK emits whenever phone is auto-verified) unless\n * SMS is also an enabled MFA method. So `phoneVerificationEnabled` gates\n * `autoVerify`/`keepOriginal`'s `phone` flag on whether SMS is actually usable\n * as a second factor, and a `mfa: REQUIRED` with neither `sms` nor `otp`\n * enabled - a pool nobody could ever sign into - is rejected at synth time.\n *\n * How to write a migration:\n * - https://nx.dev/docs/kb/migration-generators\n * - What `nextSteps` means: https://nx.dev/docs/reference/devkit/MigrationReturnObject\n *\n * Guardrails:\n * - Pattern-match before writing: skip files that have diverged from the shape\n *   your generators produce and report them via `nextSteps`, rather than\n *   clobbering the user's changes.\n * - Idempotent: re-running must be a no-op.\n * - Format what you write: finish with `formatFilesInSubtree` so the files your\n *   migration wrote are formatted correctly.\n */\n\nconst CDK_USER_IDENTITY_FILE = `${PACKAGES_DIR}/${SHARED_CONSTRUCTS_DIR}/src/core/user-identity.ts`;\nconst TERRAFORM_IDENTITY_FILE = `${PACKAGES_DIR}/${SHARED_TERRAFORM_DIR}/src/core/user-identity/identity/identity.tf`;\nconst TERRAFORM_MAIN_FILE = `${PACKAGES_DIR}/${SHARED_TERRAFORM_DIR}/src/core/user-identity/main.tf`;\n\nconst NEW_TERRAFORM_VARIABLES = `variable \"mfa\" {\n  description = \"Whether users must configure MFA, may optionally configure MFA, or cannot use MFA at all\"\n  type        = string\n  default     = \"ON\"\n\n  validation {\n    condition     = contains([\"OFF\", \"OPTIONAL\", \"ON\"], var.mfa)\n    error_message = \"mfa must be one of OFF, OPTIONAL, ON\"\n  }\n}\n\nvariable \"mfa_second_factor_otp\" {\n  description = \"Whether users can use a time-based one time password (TOTP), generated by a hardware or software token, as an MFA method\"\n  type        = bool\n  default     = true\n}\n\nvariable \"mfa_second_factor_sms\" {\n  description = \"Whether users can use SMS to their verified phone numbers as an MFA method. Due to a Terraform AWS provider limitation, disabling this also disables SMS-based phone number verification, unlike the equivalent CDK construct prop\"\n  type        = bool\n  default     = true\n}`;\n\n// Guards each file: present only once it has been migrated.\nconst CDK_MIGRATED_PATTERN = '`mfa === Mfa.OFF || mfaSecondFactor.sms`';\nconst TERRAFORM_IDENTITY_MIGRATED_PATTERN =\n  'language hcl\\n`mfa_configuration = var.mfa`';\nconst TERRAFORM_MAIN_MIGRATED_PATTERN = 'language hcl\\n`mfa = var.mfa`';\n\n// Interface members don't parse as standalone snippets, so this anchors on the\n// whole interface body (preserved via $body) rather than the enableWaf member.\nconst CDK_INTERFACE_BODY_PATTERN =\n  '`export interface UserIdentityProps { $body }`';\n// A parameter's type annotation blocks matching the destructure sub-pattern in\n// isolation, so this anchors on the full constructor signature instead\n// (literal params so a customised signature is correctly seen as diverged).\nconst CDK_CONSTRUCTOR_PATTERN =\n  '`constructor(scope: Construct, id: string, { enableWaf = true }: UserIdentityProps = {}) { $body }`';\nconst CDK_CREATE_CALL_PATTERN = '`this.createUserPool()`';\nconst CDK_CREATE_SIGNATURE_PATTERN = '`private createUserPool = () => $body`';\n// Trailing commas block matching a bare object property in isolation; the\n// separator is outside the matched span either way, so it survives untouched.\nconst CDK_MFA_FIELD_PATTERN = '`mfa: Mfa.REQUIRED`';\nconst CDK_MFA_SECOND_FACTOR_FIELD_PATTERN =\n  '`mfaSecondFactor: { sms: true, otp: true }`';\nconst CDK_SUPER_CALL_PATTERN = '`super(scope, id);`';\n// $props preserves the whole (large) UserPool props object untouched while\n// inserting the new const declaration immediately before it.\nconst CDK_NEW_USER_POOL_PATTERN =\n  \"`const userPool = new UserPool(this, 'UserPool', { $props })`\";\n// Matches both the autoVerify.phone and keepOriginal.phone occurrences in one pass.\nconst CDK_PHONE_TRUE_PATTERN = '`phone: true`';\n\nconst CDK_EDITS: Array<[string, string]> = [\n  [\n    CDK_INTERFACE_BODY_PATTERN,\n    `${CDK_INTERFACE_BODY_PATTERN} => \\`export interface UserIdentityProps {\n  $body\n\n  /**\n   * Whether users must configure MFA, may optionally configure MFA, or cannot use MFA at all.\n   *\n   * @default Mfa.REQUIRED\n   */\n  readonly mfa?: Mfa;\n\n  /**\n   * The MFA methods available to users when MFA is not off.\n   *\n   * @default { sms: true, otp: true }\n   */\n  readonly mfaSecondFactor?: MfaSecondFactor;\n}\\``,\n  ],\n  [\n    CDK_CONSTRUCTOR_PATTERN,\n    `${CDK_CONSTRUCTOR_PATTERN} => \\`constructor(\n    scope: Construct,\n    id: string,\n    {\n      enableWaf = true,\n      mfa = Mfa.REQUIRED,\n      mfaSecondFactor = { sms: true, otp: true },\n    }: UserIdentityProps = {},\n  ) { $body }\\``,\n  ],\n  [\n    CDK_CREATE_CALL_PATTERN,\n    `${CDK_CREATE_CALL_PATTERN} => \\`this.createUserPool(mfa, mfaSecondFactor)\\``,\n  ],\n  [\n    CDK_CREATE_SIGNATURE_PATTERN,\n    `${CDK_CREATE_SIGNATURE_PATTERN} => \\`private createUserPool = (mfa: Mfa, mfaSecondFactor: MfaSecondFactor) => $body\\``,\n  ],\n  [CDK_MFA_FIELD_PATTERN, `${CDK_MFA_FIELD_PATTERN} => \\`mfa\\``],\n  [\n    CDK_MFA_SECOND_FACTOR_FIELD_PATTERN,\n    `${CDK_MFA_SECOND_FACTOR_FIELD_PATTERN} => \\`mfaSecondFactor\\``,\n  ],\n  [\n    CDK_SUPER_CALL_PATTERN,\n    `${CDK_SUPER_CALL_PATTERN} => \\`super(scope, id);\n\n    if (mfa === Mfa.REQUIRED && !mfaSecondFactor.sms && !mfaSecondFactor.otp) {\n      throw new Error(\n        'UserIdentity: mfa is REQUIRED but mfaSecondFactor has no methods enabled (sms and otp are both false)',\n      );\n    }\\``,\n  ],\n  [\n    CDK_NEW_USER_POOL_PATTERN,\n    `${CDK_NEW_USER_POOL_PATTERN} => \\`const phoneVerificationEnabled = mfa === Mfa.OFF || mfaSecondFactor.sms;\n\n    const userPool = new UserPool(this, 'UserPool', { $props })\\``,\n  ],\n  [\n    CDK_PHONE_TRUE_PATTERN,\n    `${CDK_PHONE_TRUE_PATTERN} => \\`phone: phoneVerificationEnabled\\``,\n  ],\n];\n\nconst TERRAFORM_IDENTITY_ENABLE_WAF_VARIABLE_ANCHOR = [\n  'language hcl',\n  '`variable \"enable_waf\" {',\n  '  description = \"Whether to enable AWS WAFv2 with the default managed ruleset (AWSManagedRulesCommonRuleSet and AWSManagedRulesKnownBadInputsRuleSet) and associate it with the user pool\"',\n  '  type        = bool',\n  '  default     = true',\n  '}`',\n].join('\\n');\n\nconst TERRAFORM_MFA_CONFIGURATION_PATTERN = [\n  'language hcl',\n  '`mfa_configuration = \"ON\"`',\n].join('\\n');\n\nconst TERRAFORM_SOFTWARE_TOKEN_MFA_PATTERN = [\n  'language hcl',\n  '`software_token_mfa_configuration {',\n  '    enabled = true',\n  '  }`',\n].join('\\n');\n\nconst TERRAFORM_SMS_CONFIGURATION_PATTERN = [\n  'language hcl',\n  '`sms_configuration {',\n  '    external_id    = random_uuid.sms_external_id.result',\n  '    sns_caller_arn = aws_iam_role.cognito_sms_role.arn',\n  '    sns_region     = data.aws_region.current.region',\n  '  }`',\n].join('\\n');\n\nconst TERRAFORM_RANDOM_UUID_PATTERN = [\n  'language hcl',\n  '`resource \"random_uuid\" \"sms_external_id\" {}`',\n].join('\\n');\n\nconst TERRAFORM_SMS_ROLE_PATTERN = [\n  'language hcl',\n  '`resource \"aws_iam_role\" \"cognito_sms_role\" { $body }`',\n].join('\\n');\n\nconst TERRAFORM_SMS_POLICY_PATTERN = [\n  'language hcl',\n  '`resource \"aws_iam_role_policy\" \"cognito_sms_policy\" { $body }`',\n].join('\\n');\n\nconst TERRAFORM_SMS_ROLE_ID_REF_PATTERN = [\n  'language hcl',\n  '`aws_iam_role.cognito_sms_role.id`',\n].join('\\n');\n\nconst TERRAFORM_EXTERNAL_ID_REF_PATTERN = [\n  'language hcl',\n  '`random_uuid.sms_external_id.result`',\n].join('\\n');\n\nconst TERRAFORM_AUTO_VERIFIED_ATTRIBUTES_PATTERN = [\n  'language hcl',\n  '`auto_verified_attributes = [\"email\", \"phone_number\"]`',\n].join('\\n');\n\nconst TERRAFORM_ATTRIBUTES_REQUIRE_VERIFICATION_PATTERN = [\n  'language hcl',\n  '`attributes_require_verification_before_update = [\"email\", \"phone_number\"]`',\n].join('\\n');\n\nconst TERRAFORM_IDENTITY_EDITS: Array<[string, string]> = [\n  [\n    TERRAFORM_IDENTITY_ENABLE_WAF_VARIABLE_ANCHOR,\n    `${TERRAFORM_IDENTITY_ENABLE_WAF_VARIABLE_ANCHOR} => \\`variable \"enable_waf\" {\n  description = \"Whether to enable AWS WAFv2 with the default managed ruleset (AWSManagedRulesCommonRuleSet and AWSManagedRulesKnownBadInputsRuleSet) and associate it with the user pool\"\n  type        = bool\n  default     = true\n}\n\n${NEW_TERRAFORM_VARIABLES}\\``,\n  ],\n  [\n    TERRAFORM_RANDOM_UUID_PATTERN,\n    `${TERRAFORM_RANDOM_UUID_PATTERN} => \\`resource \"random_uuid\" \"sms_external_id\" {\n  count = var.mfa_second_factor_sms ? 1 : 0\n}\\``,\n  ],\n  [\n    TERRAFORM_SMS_ROLE_PATTERN,\n    `${TERRAFORM_SMS_ROLE_PATTERN} => \\`resource \"aws_iam_role\" \"cognito_sms_role\" {\n  count = var.mfa_second_factor_sms ? 1 : 0\n\n  $body\n}\\``,\n  ],\n  [\n    TERRAFORM_SMS_POLICY_PATTERN,\n    `${TERRAFORM_SMS_POLICY_PATTERN} => \\`resource \"aws_iam_role_policy\" \"cognito_sms_policy\" {\n  count = var.mfa_second_factor_sms ? 1 : 0\n\n  $body\n}\\``,\n  ],\n  [\n    TERRAFORM_MFA_CONFIGURATION_PATTERN,\n    `${TERRAFORM_MFA_CONFIGURATION_PATTERN} => \\`mfa_configuration = var.mfa\\``,\n  ],\n  [\n    TERRAFORM_SOFTWARE_TOKEN_MFA_PATTERN,\n    `${TERRAFORM_SOFTWARE_TOKEN_MFA_PATTERN} => \\`software_token_mfa_configuration {\n    enabled = var.mfa_second_factor_otp\n  }\\``,\n  ],\n  [\n    TERRAFORM_SMS_CONFIGURATION_PATTERN,\n    `${TERRAFORM_SMS_CONFIGURATION_PATTERN} => \\`# SMS MFA configuration. Due to a Terraform AWS provider limitation, this also gates\n  # SMS-based phone number verification below - see the mfa_second_factor_sms variable.\n  dynamic \"sms_configuration\" {\n    for_each = var.mfa_second_factor_sms ? [1] : []\n\n    content {\n      external_id    = random_uuid.sms_external_id[0].result\n      sns_caller_arn = aws_iam_role.cognito_sms_role[0].arn\n      sns_region     = data.aws_region.current.region\n    }\n  }\\``,\n  ],\n  [\n    TERRAFORM_SMS_ROLE_ID_REF_PATTERN,\n    `${TERRAFORM_SMS_ROLE_ID_REF_PATTERN} => \\`aws_iam_role.cognito_sms_role[0].id\\``,\n  ],\n  [\n    TERRAFORM_EXTERNAL_ID_REF_PATTERN,\n    `${TERRAFORM_EXTERNAL_ID_REF_PATTERN} => \\`random_uuid.sms_external_id[0].result\\``,\n  ],\n  [\n    TERRAFORM_AUTO_VERIFIED_ATTRIBUTES_PATTERN,\n    `${TERRAFORM_AUTO_VERIFIED_ATTRIBUTES_PATTERN} => \\`auto_verified_attributes = var.mfa_second_factor_sms ? [\"email\", \"phone_number\"] : [\"email\"]\\``,\n  ],\n  [\n    TERRAFORM_ATTRIBUTES_REQUIRE_VERIFICATION_PATTERN,\n    `${TERRAFORM_ATTRIBUTES_REQUIRE_VERIFICATION_PATTERN} => \\`attributes_require_verification_before_update = var.mfa_second_factor_sms ? [\"email\", \"phone_number\"] : [\"email\"]\\``,\n  ],\n];\n\nconst TERRAFORM_MAIN_ENABLE_WAF_VARIABLE_ANCHOR = [\n  'language hcl',\n  '`variable \"enable_waf\" {',\n  '  description = \"Whether to enable AWS WAFv2 with the default managed ruleset and associate it with the user pool\"',\n  '  type        = bool',\n  '  default     = true',\n  '}`',\n].join('\\n');\n\nconst TERRAFORM_MAIN_MODULE_PATTERN = [\n  'language hcl',\n  '`module \"identity\" {',\n  '  source = \"./identity\"',\n  '',\n  '  user_pool_domain_prefix = $prefix',\n  '  allow_signup = $allowSignup',\n  '  enable_waf = var.enable_waf',\n  '}`',\n].join('\\n');\n\nconst TERRAFORM_MAIN_EDITS: Array<[string, string]> = [\n  [\n    TERRAFORM_MAIN_ENABLE_WAF_VARIABLE_ANCHOR,\n    `${TERRAFORM_MAIN_ENABLE_WAF_VARIABLE_ANCHOR} => \\`variable \"enable_waf\" {\n  description = \"Whether to enable AWS WAFv2 with the default managed ruleset and associate it with the user pool\"\n  type        = bool\n  default     = true\n}\n\n${NEW_TERRAFORM_VARIABLES}\\``,\n  ],\n  [\n    TERRAFORM_MAIN_MODULE_PATTERN,\n    `${TERRAFORM_MAIN_MODULE_PATTERN} => \\`module \"identity\" {\n  source = \"./identity\"\n\n  user_pool_domain_prefix = $prefix\n  allow_signup = $allowSignup\n  enable_waf = var.enable_waf\n  mfa = var.mfa\n  mfa_second_factor_otp = var.mfa_second_factor_otp\n  mfa_second_factor_sms = var.mfa_second_factor_sms\n}\\``,\n  ],\n];\n\nconst divergedNextStep = (filePath: string) =>\n  `${filePath}: the UserIdentity construct/module has diverged from the generated shape - left untouched. To make MFA configurable, add mfa and mfaSecondFactor (CDK) / mfa, mfa_second_factor_otp and mfa_second_factor_sms (Terraform) yourself, following the same pattern as the existing enableWaf prop/variable.`;\n\nconst applyEdits = async (\n  tree: Tree,\n  filePath: string,\n  migratedPattern: string,\n  edits: Array<[string, string]>,\n  nextSteps: string[],\n  beforeApply?: () => Promise<void>,\n) => {\n  if (!tree.exists(filePath)) {\n    // This workspace doesn't use this IaC provider, or has no UserIdentity.\n    return;\n  }\n\n  if (await matchGritQL(tree, filePath, migratedPattern)) {\n    // Already migrated - silent skip keeps re-runs a no-op.\n    return;\n  }\n\n  // Confirm every edit site is present before writing any of them, so a file\n  // that only partly matches is left whole rather than half-edited.\n  const allSitesPresent = (\n    await Promise.all(\n      edits.map(([match]) => matchGritQL(tree, filePath, match)),\n    )\n  ).every(Boolean);\n\n  if (!allSitesPresent) {\n    nextSteps.push(divergedNextStep(filePath));\n    return;\n  }\n\n  await beforeApply?.();\n\n  for (const [, rewrite] of edits) {\n    await applyGritQL(tree, filePath, rewrite);\n  }\n};\n\nexport default async function migration(\n  tree: Tree,\n): Promise<MigrationReturnObject> {\n  const nextSteps: string[] = [];\n\n  await applyEdits(\n    tree,\n    CDK_USER_IDENTITY_FILE,\n    CDK_MIGRATED_PATTERN,\n    CDK_EDITS,\n    nextSteps,\n    () =>\n      addDestructuredImport(\n        tree,\n        CDK_USER_IDENTITY_FILE,\n        ['type MfaSecondFactor'],\n        'aws-cdk-lib/aws-cognito',\n      ),\n  );\n\n  await applyEdits(\n    tree,\n    TERRAFORM_IDENTITY_FILE,\n    TERRAFORM_IDENTITY_MIGRATED_PATTERN,\n    TERRAFORM_IDENTITY_EDITS,\n    nextSteps,\n  );\n\n  await applyEdits(\n    tree,\n    TERRAFORM_MAIN_FILE,\n    TERRAFORM_MAIN_MIGRATED_PATTERN,\n    TERRAFORM_MAIN_EDITS,\n    nextSteps,\n  );\n\n  await formatFilesInSubtree(tree);\n\n  return { nextSteps };\n}\n"],"names":["addDestructuredImport","applyGritQL","matchGritQL","formatFilesInSubtree","PACKAGES_DIR","SHARED_CONSTRUCTS_DIR","SHARED_TERRAFORM_DIR","CDK_USER_IDENTITY_FILE","TERRAFORM_IDENTITY_FILE","TERRAFORM_MAIN_FILE","NEW_TERRAFORM_VARIABLES","CDK_MIGRATED_PATTERN","TERRAFORM_IDENTITY_MIGRATED_PATTERN","TERRAFORM_MAIN_MIGRATED_PATTERN","CDK_INTERFACE_BODY_PATTERN","CDK_CONSTRUCTOR_PATTERN","CDK_CREATE_CALL_PATTERN","CDK_CREATE_SIGNATURE_PATTERN","CDK_MFA_FIELD_PATTERN","CDK_MFA_SECOND_FACTOR_FIELD_PATTERN","CDK_SUPER_CALL_PATTERN","CDK_NEW_USER_POOL_PATTERN","CDK_PHONE_TRUE_PATTERN","CDK_EDITS","TERRAFORM_IDENTITY_ENABLE_WAF_VARIABLE_ANCHOR","join","TERRAFORM_MFA_CONFIGURATION_PATTERN","TERRAFORM_SOFTWARE_TOKEN_MFA_PATTERN","TERRAFORM_SMS_CONFIGURATION_PATTERN","TERRAFORM_RANDOM_UUID_PATTERN","TERRAFORM_SMS_ROLE_PATTERN","TERRAFORM_SMS_POLICY_PATTERN","TERRAFORM_SMS_ROLE_ID_REF_PATTERN","TERRAFORM_EXTERNAL_ID_REF_PATTERN","TERRAFORM_AUTO_VERIFIED_ATTRIBUTES_PATTERN","TERRAFORM_ATTRIBUTES_REQUIRE_VERIFICATION_PATTERN","TERRAFORM_IDENTITY_EDITS","TERRAFORM_MAIN_ENABLE_WAF_VARIABLE_ANCHOR","TERRAFORM_MAIN_MODULE_PATTERN","TERRAFORM_MAIN_EDITS","divergedNextStep","filePath","applyEdits","tree","migratedPattern","edits","nextSteps","beforeApply","exists","allSitesPresent","Promise","all","map","match","every","Boolean","push","rewrite","migration"],"mappings":"AAAA;;;CAGC,GAED,SACEA,qBAAqB,EACrBC,WAAW,EACXC,WAAW,QACN,wBAAwB;AAC/B,SAASC,oBAAoB,QAAQ,2BAA2B;AAChE,SACEC,YAAY,EACZC,qBAAqB,EACrBC,oBAAoB,QACf,gDAAgD;AAEvD;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;CA+BC,GAED,MAAMC,yBAAyB,GAAGH,aAAa,CAAC,EAAEC,sBAAsB,0BAA0B,CAAC;AACnG,MAAMG,0BAA0B,GAAGJ,aAAa,CAAC,EAAEE,qBAAqB,4CAA4C,CAAC;AACrH,MAAMG,sBAAsB,GAAGL,aAAa,CAAC,EAAEE,qBAAqB,+BAA+B,CAAC;AAEpG,MAAMI,0BAA0B,CAAC;;;;;;;;;;;;;;;;;;;;;CAqBhC,CAAC;AAEF,4DAA4D;AAC5D,MAAMC,uBAAuB;AAC7B,MAAMC,sCACJ;AACF,MAAMC,kCAAkC;AAExC,+EAA+E;AAC/E,+EAA+E;AAC/E,MAAMC,6BACJ;AACF,+EAA+E;AAC/E,uEAAuE;AACvE,4EAA4E;AAC5E,MAAMC,0BACJ;AACF,MAAMC,0BAA0B;AAChC,MAAMC,+BAA+B;AACrC,0EAA0E;AAC1E,8EAA8E;AAC9E,MAAMC,wBAAwB;AAC9B,MAAMC,sCACJ;AACF,MAAMC,yBAAyB;AAC/B,2EAA2E;AAC3E,6DAA6D;AAC7D,MAAMC,4BACJ;AACF,oFAAoF;AACpF,MAAMC,yBAAyB;AAE/B,MAAMC,YAAqC;IACzC;QACET;QACA,GAAGA,2BAA2B;;;;;;;;;;;;;;;;GAgB/B,CAAC;KACD;IACD;QACEC;QACA,GAAGA,wBAAwB;;;;;;;;eAQhB,CAAC;KACb;IACD;QACEC;QACA,GAAGA,wBAAwB,iDAAiD,CAAC;KAC9E;IACD;QACEC;QACA,GAAGA,6BAA6B,sFAAsF,CAAC;KACxH;IACD;QAACC;QAAuB,GAAGA,sBAAsB,WAAW,CAAC;KAAC;IAC9D;QACEC;QACA,GAAGA,oCAAoC,uBAAuB,CAAC;KAChE;IACD;QACEC;QACA,GAAGA,uBAAuB;;;;;;OAMvB,CAAC;KACL;IACD;QACEC;QACA,GAAGA,0BAA0B;;iEAEgC,CAAC;KAC/D;IACD;QACEC;QACA,GAAGA,uBAAuB,uCAAuC,CAAC;KACnE;CACF;AAED,MAAME,gDAAgD;IACpD;IACA;IACA;IACA;IACA;IACA;CACD,CAACC,IAAI,CAAC;AAEP,MAAMC,sCAAsC;IAC1C;IACA;CACD,CAACD,IAAI,CAAC;AAEP,MAAME,uCAAuC;IAC3C;IACA;IACA;IACA;CACD,CAACF,IAAI,CAAC;AAEP,MAAMG,sCAAsC;IAC1C;IACA;IACA;IACA;IACA;IACA;CACD,CAACH,IAAI,CAAC;AAEP,MAAMI,gCAAgC;IACpC;IACA;CACD,CAACJ,IAAI,CAAC;AAEP,MAAMK,6BAA6B;IACjC;IACA;CACD,CAACL,IAAI,CAAC;AAEP,MAAMM,+BAA+B;IACnC;IACA;CACD,CAACN,IAAI,CAAC;AAEP,MAAMO,oCAAoC;IACxC;IACA;CACD,CAACP,IAAI,CAAC;AAEP,MAAMQ,oCAAoC;IACxC;IACA;CACD,CAACR,IAAI,CAAC;AAEP,MAAMS,6CAA6C;IACjD;IACA;CACD,CAACT,IAAI,CAAC;AAEP,MAAMU,oDAAoD;IACxD;IACA;CACD,CAACV,IAAI,CAAC;AAEP,MAAMW,2BAAoD;IACxD;QACEZ;QACA,GAAGA,8CAA8C;;;;;;AAMrD,EAAEd,wBAAwB,EAAE,CAAC;KAC1B;IACD;QACEmB;QACA,GAAGA,8BAA8B;;GAElC,CAAC;KACD;IACD;QACEC;QACA,GAAGA,2BAA2B;;;;GAI/B,CAAC;KACD;IACD;QACEC;QACA,GAAGA,6BAA6B;;;;GAIjC,CAAC;KACD;IACD;QACEL;QACA,GAAGA,oCAAoC,mCAAmC,CAAC;KAC5E;IACD;QACEC;QACA,GAAGA,qCAAqC;;KAEvC,CAAC;KACH;IACD;QACEC;QACA,GAAGA,oCAAoC;;;;;;;;;;KAUtC,CAAC;KACH;IACD;QACEI;QACA,GAAGA,kCAAkC,2CAA2C,CAAC;KAClF;IACD;QACEC;QACA,GAAGA,kCAAkC,6CAA6C,CAAC;KACpF;IACD;QACEC;QACA,GAAGA,2CAA2C,oGAAoG,CAAC;KACpJ;IACD;QACEC;QACA,GAAGA,kDAAkD,yHAAyH,CAAC;KAChL;CACF;AAED,MAAME,4CAA4C;IAChD;IACA;IACA;IACA;IACA;IACA;CACD,CAACZ,IAAI,CAAC;AAEP,MAAMa,gCAAgC;IACpC;IACA;IACA;IACA;IACA;IACA;IACA;IACA;CACD,CAACb,IAAI,CAAC;AAEP,MAAMc,uBAAgD;IACpD;QACEF;QACA,GAAGA,0CAA0C;;;;;;AAMjD,EAAE3B,wBAAwB,EAAE,CAAC;KAC1B;IACD;QACE4B;QACA,GAAGA,8BAA8B;;;;;;;;;GASlC,CAAC;KACD;CACF;AAED,MAAME,mBAAmB,CAACC,WACxB,GAAGA,SAAS,wSAAwS,CAAC;AAEvT,MAAMC,aAAa,OACjBC,MACAF,UACAG,iBACAC,OACAC,WACAC;IAEA,IAAI,CAACJ,KAAKK,MAAM,CAACP,WAAW;QAC1B,wEAAwE;QACxE;IACF;IAEA,IAAI,MAAMvC,YAAYyC,MAAMF,UAAUG,kBAAkB;QACtD,wDAAwD;QACxD;IACF;IAEA,2EAA2E;IAC3E,kEAAkE;IAClE,MAAMK,kBAAkB,AACtB,CAAA,MAAMC,QAAQC,GAAG,CACfN,MAAMO,GAAG,CAAC,CAAC,CAACC,MAAM,GAAKnD,YAAYyC,MAAMF,UAAUY,QACrD,EACAC,KAAK,CAACC;IAER,IAAI,CAACN,iBAAiB;QACpBH,UAAUU,IAAI,CAAChB,iBAAiBC;QAChC;IACF;IAEA,MAAMM;IAEN,KAAK,MAAM,GAAGU,QAAQ,IAAIZ,MAAO;QAC/B,MAAM5C,YAAY0C,MAAMF,UAAUgB;IACpC;AACF;AAEA,eAAe,eAAeC,UAC5Bf,IAAU;IAEV,MAAMG,YAAsB,EAAE;IAE9B,MAAMJ,WACJC,MACApC,wBACAI,sBACAY,WACAuB,WACA,IACE9C,sBACE2C,MACApC,wBACA;YAAC;SAAuB,EACxB;IAIN,MAAMmC,WACJC,MACAnC,yBACAI,qCACAwB,0BACAU;IAGF,MAAMJ,WACJC,MACAlC,qBACAI,iCACA0B,sBACAO;IAGF,MAAM3C,qBAAqBwC;IAE3B,OAAO;QAAEG;IAAU;AACrB"}

package/src/migrations/v1.0.0-rc.50/0001-modernize-function-props-cast/metadata.json

@@ -0,0 +1,3 @@
+{
+  "description": "Replace the legacy angle-bracket FunctionProps type assertion with the modern as syntax in generated API constructs"
+}

package/src/migrations/v1.0.0-rc.50/0001-modernize-function-props-cast/migration.d.ts

@@ -0,0 +1,6 @@
+/**
+ * Copyright Amazon.com, Inc. or its affiliates. All Rights Reserved.
+ * SPDX-License-Identifier: Apache-2.0
+ */
+import { type MigrationReturnObject, type Tree } from '@nx/devkit';
+export default function migration(tree: Tree): Promise<MigrationReturnObject>;