@aws/nx-plugin 1.0.0-rc.8 → 1.0.0-rc.80

package/src/migrations/v1.0.0-rc.52/0001-user-identity-waf-allow-localhost-callback/migration.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../../../../../../../packages/nx-plugin/src/migrations/v1.0.0-rc.52/0001-user-identity-waf-allow-localhost-callback/migration.ts"],"sourcesContent":["/**\n * Copyright Amazon.com, Inc. or its affiliates. All Rights Reserved.\n * SPDX-License-Identifier: Apache-2.0\n */\nimport type { MigrationReturnObject, Tree } from '@nx/devkit';\nimport { applyGritQL, matchGritQL } from '../../../utils/ast.js';\nimport { formatFilesInSubtree } from '../../../utils/format.js';\nimport {\n  PACKAGES_DIR,\n  SHARED_CONSTRUCTS_DIR,\n  SHARED_TERRAFORM_DIR,\n} from '../../../utils/shared-constructs-constants.js';\n\n/**\n * Count the EC2MetaDataSSRF_QUERYARGUMENTS WAF rule on the UserIdentity Web ACL\n *\n * `AWSManagedRulesCommonRuleSet` treats the loopback `redirect_uri` the Cognito\n * Hosted UI receives during local sign-in as an SSRF attempt, so sign-in against\n * a local dev server fails with an opaque 403 before the login page renders. The\n * rule is overridden to Count while a local callback URL is allowed; every other\n * rule in the group still blocks.\n *\n * The local callback URLs are lifted into a named constant so the override can be\n * derived from them rather than restating the condition.\n *\n * How to write a migration:\n * - https://nx.dev/docs/kb/migration-generators\n * - What `nextSteps` means: https://nx.dev/docs/reference/devkit/MigrationReturnObject\n *\n * Guardrails:\n * - Pattern-match before writing: skip files that have diverged from the shape\n *   your generators produce and report them via `nextSteps`, rather than\n *   clobbering the user's changes.\n * - Idempotent: re-running must be a no-op.\n * - Format what you write: finish with `formatFilesInSubtree` so the files your\n *   migration wrote are formatted correctly.\n */\n\nconst CDK_USER_IDENTITY_FILE = `${PACKAGES_DIR}/${SHARED_CONSTRUCTS_DIR}/src/core/user-identity.ts`;\nconst TERRAFORM_IDENTITY_FILE = `${PACKAGES_DIR}/${SHARED_TERRAFORM_DIR}/src/core/user-identity/identity/identity.tf`;\n\nconst SSRF_RULE_NAME = 'EC2MetaDataSSRF_QUERYARGUMENTS';\n\n// Guards each file: present only once the override has been added.\nconst CDK_MIGRATED_PATTERN = `\\`ruleActionOverrides: allowsLocalCallback ? $_ : undefined\\``;\nconst TERRAFORM_MIGRATED_PATTERN = `language hcl\\n\\`name = \"${SSRF_RULE_NAME}\"\\``;\n\n// Every CDK edit site, matched structurally so formatting doesn't affect whether\n// the construct is recognised.\nconst CDK_CONSTANT_ANCHOR_PATTERN = \"`const WEB_CLIENT_ID = 'WebClient'`\";\n// Scoped to the `.concat` callsite so it can't also rewrite the array literal\n// inside the constant this migration inserts.\nconst CDK_LOCAL_URLS_PATTERN =\n  \"`['http://localhost:4200', 'http://localhost:4300'].concat($rest)`\";\nconst CDK_CALL_PATTERN = '`this.createWebAcl($id, this.userPool)`';\nconst CDK_SIGNATURE_PATTERN =\n  '`private createWebAcl = ($id: string, $pool: UserPool) => $body`';\nconst CDK_STATEMENT_PATTERN =\n  \"`managedRuleGroupStatement: { name: 'AWSManagedRulesCommonRuleSet', vendorName: 'AWS' }`\";\n\nconst CDK_EDITS: Array<[string, string]> = [\n  // Local callback URLs become a named constant the override can key off.\n  [\n    CDK_CONSTANT_ANCHOR_PATTERN,\n    `${CDK_CONSTANT_ANCHOR_PATTERN} => \\`const WEB_CLIENT_ID = 'WebClient';\n\n/** Local dev server origins permitted to complete the sign-in redirect */\nconst LOCAL_CALLBACK_URLS = ['http://localhost:4200', 'http://localhost:4300']\\``,\n  ],\n  [\n    CDK_LOCAL_URLS_PATTERN,\n    `${CDK_LOCAL_URLS_PATTERN} => \\`LOCAL_CALLBACK_URLS.concat($rest)\\``,\n  ],\n  [\n    CDK_CALL_PATTERN,\n    `${CDK_CALL_PATTERN} => \\`this.createWebAcl($id, this.userPool, LOCAL_CALLBACK_URLS.length > 0)\\``,\n  ],\n  [\n    CDK_SIGNATURE_PATTERN,\n    `${CDK_SIGNATURE_PATTERN} => \\`private createWebAcl = (\n    $id: string,\n    $pool: UserPool,\n    allowsLocalCallback: boolean\n  ) => $body\\``,\n  ],\n  [\n    CDK_STATEMENT_PATTERN,\n    `${CDK_STATEMENT_PATTERN} => \\`managedRuleGroupStatement: {\n              name: 'AWSManagedRulesCommonRuleSet',\n              vendorName: 'AWS',\n              // ${SSRF_RULE_NAME} treats the loopback redirect_uri the\n              // Hosted UI receives during local sign-in as an SSRF attempt. Counted\n              // only while a local callback URL is allowed; every other rule blocks.\n              ruleActionOverrides: allowsLocalCallback\n                ? [\n                    {\n                      name: '${SSRF_RULE_NAME}',\n                      actionToUse: { count: {} },\n                    },\n                  ]\n                : undefined,\n            }\\``,\n  ],\n];\n\nconst TERRAFORM_DATA_SOURCES_PATTERN = [\n  'language hcl',\n  '`data \"aws_region\" \"current\" {}`',\n].join('\\n');\n\nconst TERRAFORM_EDITS: Array<[string, string]> = [\n  // Local callback URLs become a local the override can key off.\n  [\n    TERRAFORM_DATA_SOURCES_PATTERN,\n    [\n      'language hcl',\n      '`data \"aws_region\" \"current\" {}` => `data \"aws_region\" \"current\" {}',\n      '',\n      'locals {',\n      '  # Local dev server origins permitted to complete the sign-in redirect',\n      '  local_callback_urls = [',\n      '    \"http://localhost:4200\",',\n      '    \"http://localhost:4300\"',\n      '  ]',\n      '}`',\n    ].join('\\n'),\n  ],\n  [\n    [\n      'language hcl',\n      '`callback_urls = concat([',\n      '    \"http://localhost:4200\",',\n      '    \"http://localhost:4300\"',\n      '  ], var.callback_urls)`',\n    ].join('\\n'),\n    [\n      'language hcl',\n      '`callback_urls = concat([',\n      '    \"http://localhost:4200\",',\n      '    \"http://localhost:4300\"',\n      '  ], var.callback_urls)` => `callback_urls = concat(local.local_callback_urls, var.callback_urls)`',\n    ].join('\\n'),\n  ],\n  [\n    [\n      'language hcl',\n      '`logout_urls = concat([',\n      '    \"http://localhost:4200\",',\n      '    \"http://localhost:4300\"',\n      '  ], var.logout_urls)`',\n    ].join('\\n'),\n    [\n      'language hcl',\n      '`logout_urls = concat([',\n      '    \"http://localhost:4200\",',\n      '    \"http://localhost:4300\"',\n      '  ], var.logout_urls)` => `logout_urls = concat(local.local_callback_urls, var.logout_urls)`',\n    ].join('\\n'),\n  ],\n  [\n    [\n      'language hcl',\n      '`managed_rule_group_statement {',\n      '        name        = \"AWSManagedRulesCommonRuleSet\"',\n      '        vendor_name = \"AWS\"',\n      '      }`',\n    ].join('\\n'),\n    [\n      'language hcl',\n      '`managed_rule_group_statement {',\n      '        name        = \"AWSManagedRulesCommonRuleSet\"',\n      '        vendor_name = \"AWS\"',\n      '      }` => `managed_rule_group_statement {',\n      '        name        = \"AWSManagedRulesCommonRuleSet\"',\n      '        vendor_name = \"AWS\"',\n      '',\n      `        # ${SSRF_RULE_NAME} treats the loopback redirect_uri the`,\n      '        # Hosted UI receives during local sign-in as an SSRF attempt. Counted',\n      '        # only while a local callback URL is allowed; every other rule blocks.',\n      '        dynamic \"rule_action_override\" {',\n      '          for_each = length(local.local_callback_urls) > 0 ? [1] : []',\n      '',\n      '          content {',\n      `            name = \"${SSRF_RULE_NAME}\"`,\n      '',\n      '            action_to_use {',\n      '              count {}',\n      '            }',\n      '          }',\n      '        }',\n      '      }`',\n    ].join('\\n'),\n  ],\n];\n\nconst divergedNextStep = (filePath: string) =>\n  `${filePath}: the UserIdentity Web ACL has diverged from the generated shape - left untouched. To sign in against a local dev server, override ${SSRF_RULE_NAME} in the AWSManagedRulesCommonRuleSet rule group to Count, otherwise the Cognito Hosted UI returns 403 for localhost redirect URIs.`;\n\nexport default async function migration(\n  tree: Tree,\n): Promise<MigrationReturnObject> {\n  const nextSteps: string[] = [];\n\n  for (const [filePath, migratedPattern, edits] of [\n    [CDK_USER_IDENTITY_FILE, CDK_MIGRATED_PATTERN, CDK_EDITS],\n    [TERRAFORM_IDENTITY_FILE, TERRAFORM_MIGRATED_PATTERN, TERRAFORM_EDITS],\n  ] as const) {\n    if (!tree.exists(filePath)) {\n      // This workspace doesn't use this IaC provider, or has no UserIdentity.\n      continue;\n    }\n\n    if (await matchGritQL(tree, filePath, migratedPattern)) {\n      // Already migrated - silent skip keeps re-runs a no-op.\n      continue;\n    }\n\n    // Confirm every edit site is present before writing any of them, so a file\n    // that only partly matches is left whole rather than half-edited.\n    const allSitesPresent = (\n      await Promise.all(\n        edits.map(([match]) => matchGritQL(tree, filePath, match)),\n      )\n    ).every(Boolean);\n\n    if (!allSitesPresent) {\n      nextSteps.push(divergedNextStep(filePath));\n      continue;\n    }\n\n    for (const [, rewrite] of edits) {\n      await applyGritQL(tree, filePath, rewrite);\n    }\n  }\n\n  await formatFilesInSubtree(tree);\n\n  return { nextSteps };\n}\n"],"names":["applyGritQL","matchGritQL","formatFilesInSubtree","PACKAGES_DIR","SHARED_CONSTRUCTS_DIR","SHARED_TERRAFORM_DIR","CDK_USER_IDENTITY_FILE","TERRAFORM_IDENTITY_FILE","SSRF_RULE_NAME","CDK_MIGRATED_PATTERN","TERRAFORM_MIGRATED_PATTERN","CDK_CONSTANT_ANCHOR_PATTERN","CDK_LOCAL_URLS_PATTERN","CDK_CALL_PATTERN","CDK_SIGNATURE_PATTERN","CDK_STATEMENT_PATTERN","CDK_EDITS","TERRAFORM_DATA_SOURCES_PATTERN","join","TERRAFORM_EDITS","divergedNextStep","filePath","migration","tree","nextSteps","migratedPattern","edits","exists","allSitesPresent","Promise","all","map","match","every","Boolean","push","rewrite"],"mappings":"AAAA;;;CAGC,GAED,SAASA,WAAW,EAAEC,WAAW,QAAQ,wBAAwB;AACjE,SAASC,oBAAoB,QAAQ,2BAA2B;AAChE,SACEC,YAAY,EACZC,qBAAqB,EACrBC,oBAAoB,QACf,gDAAgD;AAEvD;;;;;;;;;;;;;;;;;;;;;;;CAuBC,GAED,MAAMC,yBAAyB,GAAGH,aAAa,CAAC,EAAEC,sBAAsB,0BAA0B,CAAC;AACnG,MAAMG,0BAA0B,GAAGJ,aAAa,CAAC,EAAEE,qBAAqB,4CAA4C,CAAC;AAErH,MAAMG,iBAAiB;AAEvB,mEAAmE;AACnE,MAAMC,uBAAuB,CAAC,6DAA6D,CAAC;AAC5F,MAAMC,6BAA6B,CAAC,wBAAwB,EAAEF,eAAe,GAAG,CAAC;AAEjF,iFAAiF;AACjF,+BAA+B;AAC/B,MAAMG,8BAA8B;AACpC,8EAA8E;AAC9E,8CAA8C;AAC9C,MAAMC,yBACJ;AACF,MAAMC,mBAAmB;AACzB,MAAMC,wBACJ;AACF,MAAMC,wBACJ;AAEF,MAAMC,YAAqC;IACzC,wEAAwE;IACxE;QACEL;QACA,GAAGA,4BAA4B;;;gFAG6C,CAAC;KAC9E;IACD;QACEC;QACA,GAAGA,uBAAuB,yCAAyC,CAAC;KACrE;IACD;QACEC;QACA,GAAGA,iBAAiB,6EAA6E,CAAC;KACnG;IACD;QACEC;QACA,GAAGA,sBAAsB;;;;cAIf,CAAC;KACZ;IACD;QACEC;QACA,GAAGA,sBAAsB;;;iBAGZ,EAAEP,eAAe;;;;;;6BAML,EAAEA,eAAe;;;;;eAK/B,CAAC;KACb;CACF;AAED,MAAMS,iCAAiC;IACrC;IACA;CACD,CAACC,IAAI,CAAC;AAEP,MAAMC,kBAA2C;IAC/C,+DAA+D;IAC/D;QACEF;QACA;YACE;YACA;YACA;YACA;YACA;YACA;YACA;YACA;YACA;YACA;SACD,CAACC,IAAI,CAAC;KACR;IACD;QACE;YACE;YACA;YACA;YACA;YACA;SACD,CAACA,IAAI,CAAC;QACP;YACE;YACA;YACA;YACA;YACA;SACD,CAACA,IAAI,CAAC;KACR;IACD;QACE;YACE;YACA;YACA;YACA;YACA;SACD,CAACA,IAAI,CAAC;QACP;YACE;YACA;YACA;YACA;YACA;SACD,CAACA,IAAI,CAAC;KACR;IACD;QACE;YACE;YACA;YACA;YACA;YACA;SACD,CAACA,IAAI,CAAC;QACP;YACE;YACA;YACA;YACA;YACA;YACA;YACA;YACA;YACA,CAAC,UAAU,EAAEV,eAAe,qCAAqC,CAAC;YAClE;YACA;YACA;YACA;YACA;YACA;YACA,CAAC,oBAAoB,EAAEA,eAAe,CAAC,CAAC;YACxC;YACA;YACA;YACA;YACA;YACA;YACA;SACD,CAACU,IAAI,CAAC;KACR;CACF;AAED,MAAME,mBAAmB,CAACC,WACxB,GAAGA,SAAS,mIAAmI,EAAEb,eAAe,kIAAkI,CAAC;AAErS,eAAe,eAAec,UAC5BC,IAAU;IAEV,MAAMC,YAAsB,EAAE;IAE9B,KAAK,MAAM,CAACH,UAAUI,iBAAiBC,MAAM,IAAI;QAC/C;YAACpB;YAAwBG;YAAsBO;SAAU;QACzD;YAACT;YAAyBG;YAA4BS;SAAgB;KACvE,CAAW;QACV,IAAI,CAACI,KAAKI,MAAM,CAACN,WAAW;YAE1B;QACF;QAEA,IAAI,MAAMpB,YAAYsB,MAAMF,UAAUI,kBAAkB;YAEtD;QACF;QAEA,2EAA2E;QAC3E,kEAAkE;QAClE,MAAMG,kBAAkB,AACtB,CAAA,MAAMC,QAAQC,GAAG,CACfJ,MAAMK,GAAG,CAAC,CAAC,CAACC,MAAM,GAAK/B,YAAYsB,MAAMF,UAAUW,QACrD,EACAC,KAAK,CAACC;QAER,IAAI,CAACN,iBAAiB;YACpBJ,UAAUW,IAAI,CAACf,iBAAiBC;YAChC;QACF;QAEA,KAAK,MAAM,GAAGe,QAAQ,IAAIV,MAAO;YAC/B,MAAM1B,YAAYuB,MAAMF,UAAUe;QACpC;IACF;IAEA,MAAMlC,qBAAqBqB;IAE3B,OAAO;QAAEC;IAAU;AACrB"}

package/src/migrations/v1.0.0-rc.54/0001-order-access-log-delivery-after-bucket-policy/metadata.json

@@ -0,0 +1,3 @@
+{
+  "description": "Order the S3 server access log delivery source after the bucket policy to avoid a 409 from concurrent bucket configuration writes"
+}

package/src/migrations/v1.0.0-rc.54/0001-order-access-log-delivery-after-bucket-policy/migration.d.ts

@@ -0,0 +1,6 @@
+/**
+ * Copyright Amazon.com, Inc. or its affiliates. All Rights Reserved.
+ * SPDX-License-Identifier: Apache-2.0
+ */
+import type { MigrationReturnObject, Tree } from '@nx/devkit';
+export default function migration(tree: Tree): Promise<MigrationReturnObject>;

package/src/migrations/v1.0.0-rc.54/0001-order-access-log-delivery-after-bucket-policy/migration.js

@@ -0,0 +1,93 @@
+/**
+ * Copyright Amazon.com, Inc. or its affiliates. All Rights Reserved.
+ * SPDX-License-Identifier: Apache-2.0
+ */ import { addDestructuredImport, applyGritQL, captureGritQL, matchGritQL } from "../../../utils/ast.js";
+import { formatFilesInSubtree } from "../../../utils/format.js";
+import { PACKAGES_DIR, SHARED_CONSTRUCTS_DIR } from "../../../utils/shared-constructs-constants.js";
+/**
+ * Order the S3 server access log delivery source after the bucket policy.
+ *
+ * S3 rejects concurrent configuration writes against the same bucket with a 409
+ * (OperationAborted). The generated StaticWebsite construct left the delivery
+ * source and the bucket policy unordered, so CloudFormation could submit both at
+ * once and fail the stack.
+ */ const STATIC_WEBSITE_FILE = `${PACKAGES_DIR}/${SHARED_CONSTRUCTS_DIR}/src/core/static-website.ts`;
+const BUCKET_ARN_SUFFIX = '.bucketArn';
+/**
+ * The bucket whose policy the delivery source must be ordered after is the one
+ * the delivery source itself targets, so read it off `resourceArn` rather than
+ * assuming the generated parameter name. Returns undefined unless exactly one
+ * simple identifier is found, so a diverged helper is left alone.
+ */ const findDeliverySourceBucket = async (tree, filePath)=>{
+    const captured = await captureGritQL(tree, filePath, '`resourceArn: $bucket.bucketArn`');
+    if (!captured) return undefined;
+    const bucket = captured.slice(captured.indexOf(':') + 1).replace(BUCKET_ARN_SUFFIX, '').trim();
+    // Only a plain identifier can be cast and dereferenced safely in the
+    // statement this migration writes.
+    return /^[A-Za-z_$][A-Za-z0-9_$]*$/.test(bucket) ? bucket : undefined;
+};
+/**
+ * Confirm the bucket the delivery source targets is declared as a parameter of
+ * the enclosing helper, so the statement this migration writes references a
+ * variable that is actually in scope.
+ */ const isBucketDeclaredParameter = async (tree, filePath, bucket)=>await matchGritQL(tree, filePath, `\`private deliverAccessLogsToCloudWatch($params) { $_ }\` where {
+      $params <: contains \`${bucket}: $bucketType\`,
+      $bucketType <: or { \`IBucket\`, \`Bucket\` }
+    }`);
+// Inserts the bucket policy dependency between the delivery source and the
+// delivery destination, matching the shape generators produced prior to this
+// fix. Anchored on the destination declaration so the source's own (multi-line,
+// Lazy-valued) arguments don't need to be matched.
+const addDependencyPattern = (bucket)=>`\`const $dest: CfnDeliveryDestination = new CfnDeliveryDestination($destArgs)\` as $decl where {
+  $dest <: \`destination\`
+} => \`const bucketPolicy = (${bucket} as Bucket).policy;
+    if (bucketPolicy) {
+      source.node.addDependency(bucketPolicy);
+    }
+    $decl\``;
+export default async function migration(tree) {
+    const nextSteps = [];
+    if (!tree.exists(STATIC_WEBSITE_FILE)) {
+        // No vended StaticWebsite construct in this workspace - nothing to migrate.
+        return {
+            nextSteps
+        };
+    }
+    const contents = tree.read(STATIC_WEBSITE_FILE, 'utf-8') ?? '';
+    if (contents.includes('source.node.addDependency(bucketPolicy)')) {
+        // Already migrated.
+        return {
+            nextSteps
+        };
+    }
+    const divergedMessage = `${STATIC_WEBSITE_FILE}: deliverAccessLogsToCloudWatch has diverged from the generated shape - left untouched. Manually order the S3 server access log delivery source after the bucket policy of the bucket it targets (\`source.node.addDependency(bucketPolicy)\`), avoiding a 409 (OperationAborted) from concurrent bucket configuration writes.`;
+    // The rewrite is anchored on the delivery destination but references the
+    // `source` variable, so only apply it when the delivery source still has the
+    // generated shape.
+    const hasGeneratedSource = await matchGritQL(tree, STATIC_WEBSITE_FILE, '`const source: CfnDeliverySource = new CfnDeliverySource($_)`');
+    const bucket = hasGeneratedSource ? await findDeliverySourceBucket(tree, STATIC_WEBSITE_FILE) : undefined;
+    if (!bucket || !await isBucketDeclaredParameter(tree, STATIC_WEBSITE_FILE, bucket)) {
+        nextSteps.push(divergedMessage);
+        return {
+            nextSteps
+        };
+    }
+    const rewrote = await applyGritQL(tree, STATIC_WEBSITE_FILE, addDependencyPattern(bucket));
+    if (!rewrote) {
+        nextSteps.push(divergedMessage);
+        return {
+            nextSteps
+        };
+    }
+    // The inserted statement casts to the concrete Bucket to reach its policy,
+    // which the helper's own `IBucket` parameter type does not expose.
+    await addDestructuredImport(tree, STATIC_WEBSITE_FILE, [
+        'Bucket'
+    ], 'aws-cdk-lib/aws-s3');
+    await formatFilesInSubtree(tree);
+    return {
+        nextSteps
+    };
+}
+
+//# sourceMappingURL=migration.js.map

package/src/migrations/v1.0.0-rc.54/0001-order-access-log-delivery-after-bucket-policy/migration.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../../../../../../../packages/nx-plugin/src/migrations/v1.0.0-rc.54/0001-order-access-log-delivery-after-bucket-policy/migration.ts"],"sourcesContent":["/**\n * Copyright Amazon.com, Inc. or its affiliates. All Rights Reserved.\n * SPDX-License-Identifier: Apache-2.0\n */\nimport type { MigrationReturnObject, Tree } from '@nx/devkit';\nimport {\n  addDestructuredImport,\n  applyGritQL,\n  captureGritQL,\n  matchGritQL,\n} from '../../../utils/ast.js';\nimport { formatFilesInSubtree } from '../../../utils/format.js';\nimport {\n  PACKAGES_DIR,\n  SHARED_CONSTRUCTS_DIR,\n} from '../../../utils/shared-constructs-constants.js';\n\n/**\n * Order the S3 server access log delivery source after the bucket policy.\n *\n * S3 rejects concurrent configuration writes against the same bucket with a 409\n * (OperationAborted). The generated StaticWebsite construct left the delivery\n * source and the bucket policy unordered, so CloudFormation could submit both at\n * once and fail the stack.\n */\n\nconst STATIC_WEBSITE_FILE = `${PACKAGES_DIR}/${SHARED_CONSTRUCTS_DIR}/src/core/static-website.ts`;\n\nconst BUCKET_ARN_SUFFIX = '.bucketArn';\n\n/**\n * The bucket whose policy the delivery source must be ordered after is the one\n * the delivery source itself targets, so read it off `resourceArn` rather than\n * assuming the generated parameter name. Returns undefined unless exactly one\n * simple identifier is found, so a diverged helper is left alone.\n */\nconst findDeliverySourceBucket = async (\n  tree: Tree,\n  filePath: string,\n): Promise<string | undefined> => {\n  const captured = await captureGritQL(\n    tree,\n    filePath,\n    '`resourceArn: $bucket.bucketArn`',\n  );\n  if (!captured) return undefined;\n\n  const bucket = captured\n    .slice(captured.indexOf(':') + 1)\n    .replace(BUCKET_ARN_SUFFIX, '')\n    .trim();\n\n  // Only a plain identifier can be cast and dereferenced safely in the\n  // statement this migration writes.\n  return /^[A-Za-z_$][A-Za-z0-9_$]*$/.test(bucket) ? bucket : undefined;\n};\n\n/**\n * Confirm the bucket the delivery source targets is declared as a parameter of\n * the enclosing helper, so the statement this migration writes references a\n * variable that is actually in scope.\n */\nconst isBucketDeclaredParameter = async (\n  tree: Tree,\n  filePath: string,\n  bucket: string,\n): Promise<boolean> =>\n  await matchGritQL(\n    tree,\n    filePath,\n    `\\`private deliverAccessLogsToCloudWatch($params) { $_ }\\` where {\n      $params <: contains \\`${bucket}: $bucketType\\`,\n      $bucketType <: or { \\`IBucket\\`, \\`Bucket\\` }\n    }`,\n  );\n\n// Inserts the bucket policy dependency between the delivery source and the\n// delivery destination, matching the shape generators produced prior to this\n// fix. Anchored on the destination declaration so the source's own (multi-line,\n// Lazy-valued) arguments don't need to be matched.\nconst addDependencyPattern = (bucket: string) =>\n  `\\`const $dest: CfnDeliveryDestination = new CfnDeliveryDestination($destArgs)\\` as $decl where {\n  $dest <: \\`destination\\`\n} => \\`const bucketPolicy = (${bucket} as Bucket).policy;\n    if (bucketPolicy) {\n      source.node.addDependency(bucketPolicy);\n    }\n    $decl\\``;\n\nexport default async function migration(\n  tree: Tree,\n): Promise<MigrationReturnObject> {\n  const nextSteps: string[] = [];\n\n  if (!tree.exists(STATIC_WEBSITE_FILE)) {\n    // No vended StaticWebsite construct in this workspace - nothing to migrate.\n    return { nextSteps };\n  }\n\n  const contents = tree.read(STATIC_WEBSITE_FILE, 'utf-8') ?? '';\n  if (contents.includes('source.node.addDependency(bucketPolicy)')) {\n    // Already migrated.\n    return { nextSteps };\n  }\n\n  const divergedMessage = `${STATIC_WEBSITE_FILE}: deliverAccessLogsToCloudWatch has diverged from the generated shape - left untouched. Manually order the S3 server access log delivery source after the bucket policy of the bucket it targets (\\`source.node.addDependency(bucketPolicy)\\`), avoiding a 409 (OperationAborted) from concurrent bucket configuration writes.`;\n\n  // The rewrite is anchored on the delivery destination but references the\n  // `source` variable, so only apply it when the delivery source still has the\n  // generated shape.\n  const hasGeneratedSource = await matchGritQL(\n    tree,\n    STATIC_WEBSITE_FILE,\n    '`const source: CfnDeliverySource = new CfnDeliverySource($_)`',\n  );\n\n  const bucket = hasGeneratedSource\n    ? await findDeliverySourceBucket(tree, STATIC_WEBSITE_FILE)\n    : undefined;\n\n  if (\n    !bucket ||\n    !(await isBucketDeclaredParameter(tree, STATIC_WEBSITE_FILE, bucket))\n  ) {\n    nextSteps.push(divergedMessage);\n    return { nextSteps };\n  }\n\n  const rewrote = await applyGritQL(\n    tree,\n    STATIC_WEBSITE_FILE,\n    addDependencyPattern(bucket),\n  );\n\n  if (!rewrote) {\n    nextSteps.push(divergedMessage);\n    return { nextSteps };\n  }\n\n  // The inserted statement casts to the concrete Bucket to reach its policy,\n  // which the helper's own `IBucket` parameter type does not expose.\n  await addDestructuredImport(\n    tree,\n    STATIC_WEBSITE_FILE,\n    ['Bucket'],\n    'aws-cdk-lib/aws-s3',\n  );\n\n  await formatFilesInSubtree(tree);\n\n  return { nextSteps };\n}\n"],"names":["addDestructuredImport","applyGritQL","captureGritQL","matchGritQL","formatFilesInSubtree","PACKAGES_DIR","SHARED_CONSTRUCTS_DIR","STATIC_WEBSITE_FILE","BUCKET_ARN_SUFFIX","findDeliverySourceBucket","tree","filePath","captured","undefined","bucket","slice","indexOf","replace","trim","test","isBucketDeclaredParameter","addDependencyPattern","migration","nextSteps","exists","contents","read","includes","divergedMessage","hasGeneratedSource","push","rewrote"],"mappings":"AAAA;;;CAGC,GAED,SACEA,qBAAqB,EACrBC,WAAW,EACXC,aAAa,EACbC,WAAW,QACN,wBAAwB;AAC/B,SAASC,oBAAoB,QAAQ,2BAA2B;AAChE,SACEC,YAAY,EACZC,qBAAqB,QAChB,gDAAgD;AAEvD;;;;;;;CAOC,GAED,MAAMC,sBAAsB,GAAGF,aAAa,CAAC,EAAEC,sBAAsB,2BAA2B,CAAC;AAEjG,MAAME,oBAAoB;AAE1B;;;;;CAKC,GACD,MAAMC,2BAA2B,OAC/BC,MACAC;IAEA,MAAMC,WAAW,MAAMV,cACrBQ,MACAC,UACA;IAEF,IAAI,CAACC,UAAU,OAAOC;IAEtB,MAAMC,SAASF,SACZG,KAAK,CAACH,SAASI,OAAO,CAAC,OAAO,GAC9BC,OAAO,CAACT,mBAAmB,IAC3BU,IAAI;IAEP,qEAAqE;IACrE,mCAAmC;IACnC,OAAO,6BAA6BC,IAAI,CAACL,UAAUA,SAASD;AAC9D;AAEA;;;;CAIC,GACD,MAAMO,4BAA4B,OAChCV,MACAC,UACAG,SAEA,MAAMX,YACJO,MACAC,UACA,CAAC;4BACuB,EAAEG,OAAO;;KAEhC,CAAC;AAGN,2EAA2E;AAC3E,6EAA6E;AAC7E,gFAAgF;AAChF,mDAAmD;AACnD,MAAMO,uBAAuB,CAACP,SAC5B,CAAC;;6BAE0B,EAAEA,OAAO;;;;WAI3B,CAAC;AAEZ,eAAe,eAAeQ,UAC5BZ,IAAU;IAEV,MAAMa,YAAsB,EAAE;IAE9B,IAAI,CAACb,KAAKc,MAAM,CAACjB,sBAAsB;QACrC,4EAA4E;QAC5E,OAAO;YAAEgB;QAAU;IACrB;IAEA,MAAME,WAAWf,KAAKgB,IAAI,CAACnB,qBAAqB,YAAY;IAC5D,IAAIkB,SAASE,QAAQ,CAAC,4CAA4C;QAChE,oBAAoB;QACpB,OAAO;YAAEJ;QAAU;IACrB;IAEA,MAAMK,kBAAkB,GAAGrB,oBAAoB,8TAA8T,CAAC;IAE9W,yEAAyE;IACzE,6EAA6E;IAC7E,mBAAmB;IACnB,MAAMsB,qBAAqB,MAAM1B,YAC/BO,MACAH,qBACA;IAGF,MAAMO,SAASe,qBACX,MAAMpB,yBAAyBC,MAAMH,uBACrCM;IAEJ,IACE,CAACC,UACD,CAAE,MAAMM,0BAA0BV,MAAMH,qBAAqBO,SAC7D;QACAS,UAAUO,IAAI,CAACF;QACf,OAAO;YAAEL;QAAU;IACrB;IAEA,MAAMQ,UAAU,MAAM9B,YACpBS,MACAH,qBACAc,qBAAqBP;IAGvB,IAAI,CAACiB,SAAS;QACZR,UAAUO,IAAI,CAACF;QACf,OAAO;YAAEL;QAAU;IACrB;IAEA,2EAA2E;IAC3E,mEAAmE;IACnE,MAAMvB,sBACJU,MACAH,qBACA;QAAC;KAAS,EACV;IAGF,MAAMH,qBAAqBM;IAE3B,OAAO;QAAEa;IAAU;AACrB"}

package/src/migrations/v1.0.0-rc.55/0001-backfill-generator-metadata/metadata.json

@@ -0,0 +1,3 @@
+{
+  "description": "Backfill the project metadata the version sync reads, recovered from the files the generators left behind"
+}

package/src/migrations/v1.0.0-rc.55/0001-backfill-generator-metadata/migration.d.ts

@@ -0,0 +1,96 @@
+/**
+ * Copyright Amazon.com, Inc. or its affiliates. All Rights Reserved.
+ * SPDX-License-Identifier: Apache-2.0
+ */
+import { type MigrationReturnObject, type ProjectConfiguration, type Tree } from '@nx/devkit';
+import type { ComponentMetadata } from '../../../utils/nx.js';
+/** Metadata as a project records it, over the fields this backfill reads. */
+interface ProjectMetadata {
+    generator?: string;
+    components?: ComponentMetadata[];
+    iac?: string;
+    smithyType?: string;
+    namespace?: string;
+    tailwind?: boolean;
+    tanstackRouter?: boolean;
+    [key: string]: unknown;
+}
+/**
+ * A connection generator, and how to recognise a run of it.
+ *
+ * A connection is found from the source component it was made from and the target
+ * it reaches: `evidence` is a check that only passes if that exact pair was wired
+ * up — a client import named after the target, a vended file named after it, or
+ * the dev-target dependency on its project. So `name` and `sourcePath` are
+ * recovered facts rather than guesses.
+ *
+ * Every connection generator is listed, including those that add no dependencies
+ * today. The sync reads the metadata rather than the generator, so recording a
+ * connection now is what lets it be picked up the moment its generator starts
+ * owning packages — a later release would otherwise need another backfill.
+ */
+interface ConnectionKind {
+    /** The generator id to record. */
+    readonly id: string;
+    /**
+     * The generator that created a source component of this connection, or
+     * undefined when the connection is made from the project as a whole.
+     */
+    readonly sourceGenerator?: string;
+    /** The generators that could have created its target. */
+    readonly targetGenerators: readonly string[];
+    /**
+     * Whether this connection was made from `source` to `target`, and what to record
+     * as the component's `path` if so. Undefined means it was not.
+     */
+    readonly evidence: (context: ConnectionContext) => string | undefined | Promise<string | undefined>;
+    /**
+     * The `name` this connection records, when it is not the target's class name.
+     * Matched to what each generator writes so a re-run recognises its own entry.
+     */
+    readonly recordedName?: (context: ConnectionContext) => string;
+    /** What this connection records beyond the path, which its predicates read. */
+    readonly metadata?: (context: ConnectionContext) => Record<string, unknown> | undefined;
+}
+/** What a connection's evidence check has to work from. */
+interface ConnectionContext {
+    readonly tree: Tree;
+    /** The project the connection lives on — the source side. */
+    readonly project: ProjectConfiguration;
+    /**
+     * The source component, or the project's own metadata standing in for it when
+     * the connection is made from the project as a whole.
+     */
+    readonly source: ComponentMetadata;
+    /** The target being connected to. */
+    readonly target: ConnectionTarget;
+}
+/**
+ * Every connection generator, and the trace each leaves on the project it connects
+ * from.
+ *
+ * Grouped by how a run is recognised, since that follows what the generator does
+ * rather than which pair it joins.
+ */
+export declare const CONNECTION_KINDS: readonly ConnectionKind[];
+/**
+ * A thing in the workspace a connection could have been made to, by the names its
+ * generated code is derived from.
+ */
+interface ConnectionTarget {
+    /** The class name a client or provider for this target is named after. */
+    readonly className: string;
+    /**
+     * The last segment of the target project's name, which the database connections
+     * derive their identifiers from.
+     */
+    readonly databaseName: string;
+    /** The target project's name, which a dev-target dependency names. */
+    readonly projectName: string;
+    /** The target project's root, recorded as `path` by the connections that vend no file. */
+    readonly projectRoot: string;
+    /** The target project's metadata, which a connection's own fields come from. */
+    readonly project: ProjectMetadata;
+}
+export default function migration(tree: Tree): Promise<MigrationReturnObject>;
+export {};