@aws/nx-plugin 1.0.0-rc.83 → 1.0.0-rc.85

package/src/utils/agent-core-constructs/files/terraform/app/agentcore-harness/__nameKebabCase__/__nameKebabCase__.tf.template

@@ -19,6 +19,84 @@ variable "model_id" {
   default     = "global.anthropic.claude-sonnet-4-6"
 }
 
+variable "allowed_tools" {
+  description = "Tools the Harness may use. Defaults to none; set [\"@builtin\"] for every built-in tool, or name individual tools. Always sent explicitly, since the service treats an absent value as every tool."
+  type        = list(string)
+  default     = []
+}
+
+variable "memory" {
+  description = "Memory configuration for the Harness. Null leaves the service to provision managed memory with default strategies. Set exactly one field: managed_memory_configuration to tune that managed memory, agentcore_memory_configuration to use a memory resource you own, or disabled to turn memory off."
+  type = object({
+    managed_memory_configuration = optional(object({
+      strategies            = optional(set(string))
+      event_expiry_duration = optional(number)
+      encryption_key_arn    = optional(string)
+    }))
+    agentcore_memory_configuration = optional(object({
+      arn            = string
+      actor_id       = optional(string)
+      messages_count = optional(number)
+    }))
+    disabled = optional(bool, false)
+  })
+  default = null
+
+  validation {
+    condition = var.memory == null || length([
+      for configured in [
+        var.memory.managed_memory_configuration != null,
+        var.memory.agentcore_memory_configuration != null,
+        var.memory.disabled,
+      ] : configured if configured
+    ]) == 1
+    error_message = "Set exactly one of memory.managed_memory_configuration, memory.agentcore_memory_configuration or memory.disabled."
+  }
+}
+
+variable "environment_variables" {
+  description = "Environment variables available to the Harness."
+  type        = map(string)
+  default     = null
+  sensitive   = true
+}
+
+variable "max_iterations" {
+  description = "Maximum agent loop iterations per invocation. Uses the service default when null."
+  type        = number
+  default     = null
+}
+
+variable "timeout_seconds" {
+  description = "Maximum seconds an invocation may run. Uses the service default when null."
+  type        = number
+  default     = null
+}
+
+variable "create_execution_role" {
+  description = "Create the execution role with the baseline permissions below. Set false alongside execution_role_arn to use a role you already have, which is then used as-is."
+  type        = bool
+  default     = true
+
+  validation {
+    condition     = var.create_execution_role || var.execution_role_arn != null
+    error_message = "execution_role_arn must be set when create_execution_role is false."
+  }
+
+  validation {
+    condition = var.create_execution_role || (
+      var.model_resource_arns == null && length(var.additional_execution_role_policy_statements) == 0
+    )
+    error_message = "model_resource_arns and additional_execution_role_policy_statements configure the generated execution role, which is not created when create_execution_role is false. Grant those permissions on the supplied role instead."
+  }
+}
+
+variable "execution_role_arn" {
+  description = "ARN of an existing IAM role for the Harness to assume. Requires create_execution_role = false."
+  type        = string
+  default     = null
+}
+
 variable "model_resource_arns" {
   description = "Bedrock model and inference-profile ARNs the execution role may invoke. Defaults to every foundation model plus this account's Bedrock resources in the deployment region; replace with narrower ARNs to restrict baseline model access."
   type        = set(string)
@@ -37,6 +115,36 @@ variable "additional_execution_role_policy_statements" {
   default = []
 }
 
+# VPC Configuration (optional)
+variable "enable_vpc" {
+  description = "Run the Harness inside a VPC so it can reach private resources. Set alongside vpc_id/subnet_ids."
+  type        = bool
+  default     = false
+}
+
+variable "vpc_id" {
+  description = "VPC ID to run the Harness in. Required when enable_vpc is true."
+  type        = string
+  default     = null
+
+  validation {
+    condition     = !var.enable_vpc || (var.vpc_id != null && var.subnet_ids != null)
+    error_message = "vpc_id and subnet_ids must be set when enable_vpc is true."
+  }
+}
+
+variable "subnet_ids" {
+  description = "Subnet IDs to run the Harness in. Required when enable_vpc is true."
+  type        = list(string)
+  default     = null
+}
+
+variable "tags" {
+  description = "Tags to apply to resources"
+  type        = map(string)
+  default     = {}
+}
+
 data "aws_caller_identity" "current" {}
 data "aws_partition" "current" {}
 data "aws_region" "current" {}
@@ -60,9 +168,17 @@ locals {
     "arn:${local.partition}:bedrock:*::foundation-model/*",
     "arn:${local.partition}:bedrock:${local.region}:${local.account_id}:*",
   ]
+
+  execution_role_arn = var.create_execution_role ? aws_iam_role.execution_role[0].arn : var.execution_role_arn
+
+  # The service provisions managed memory unless var.memory redirects it
+  # elsewhere or turns it off.
+  has_managed_memory = var.memory == null || var.memory.managed_memory_configuration != null
 }
 
 resource "aws_iam_role" "execution_role" {
+  count = var.create_execution_role ? 1 : 0
+
   name = "${local.harness_name_prefix}-HarnessRole-${random_id.unique_suffix.hex}"
 
   assume_role_policy = jsonencode({
@@ -83,14 +199,18 @@ resource "aws_iam_role" "execution_role" {
       }
     }]
   })
+
+  tags = var.tags
 }
 
 # Baseline permissions per the AgentCore Harness security guidance; extend for
 # customer-owned resources via var.additional_execution_role_policy_statements.
 # https://docs.aws.amazon.com/bedrock-agentcore/latest/devguide/harness-security.html
 resource "aws_iam_role_policy" "execution_role" {
+  count = var.create_execution_role ? 1 : 0
+
   name = "${local.harness_name_prefix}-HarnessPolicy"
-  role = aws_iam_role.execution_role.id
+  role = aws_iam_role.execution_role[0].id
 
   policy = jsonencode({
     Version = "2012-10-17"
@@ -184,22 +304,6 @@ resource "aws_iam_role_policy" "execution_role" {
           "arn:${local.partition}:bedrock-agentcore:${local.region}:${local.account_id}:workload-identity-directory/default/workload-identity/harness_${local.harness_name}-*",
         ]
       },
-      # The service names the managed memory from the harness name plus a
-      # generated suffix, so this scopes to that prefix.
-      {
-        Sid    = "AgentCoreManagedMemory"
-        Effect = "Allow"
-        Action = [
-          "bedrock-agentcore:CreateEvent",
-          "bedrock-agentcore:DeleteEvent",
-          "bedrock-agentcore:GetEvent",
-          "bedrock-agentcore:ListEvents",
-          "bedrock-agentcore:RetrieveMemoryRecords",
-        ]
-        Resource = [
-          "arn:${local.partition}:bedrock-agentcore:${local.region}:${local.account_id}:memory/${local.harness_name}-*",
-        ]
-      },
       {
         Sid    = "AgentCoreBrowserDefault"
         Effect = "Allow"
@@ -230,19 +334,70 @@ resource "aws_iam_role_policy" "execution_role" {
           "arn:${local.partition}:bedrock-agentcore:${local.region}:aws:code-interpreter/*",
         ]
       },
-      ], [
-      # Null Sid/Condition fields are dropped from the rendered policy.
-      for statement in var.additional_execution_role_policy_statements :
-      { for key, value in statement : key => value if value != null }
+      ],
+      # In VPC mode the Harness pulls its managed container from a private ECR
+      # repository in the region rather than ECR Public, so it needs pull
+      # permissions on it. The repository is service-owned, hence the wildcard
+      # account.
+      var.enable_vpc ? [
+        {
+          Sid    = "EcrManagedImagePull"
+          Effect = "Allow"
+          Action = [
+            "ecr:BatchGetImage",
+            "ecr:GetDownloadUrlForLayer",
+            "ecr:BatchCheckLayerAvailability",
+          ]
+          Resource = ["arn:${local.partition}:ecr:${local.region}:*:repository/harness-*"]
+        },
+        {
+          #checkov:skip=CKV_AWS_355:EcrManagedImageToken requires a wildcard resource; ecr:GetAuthorizationToken has no resource-level permission
+          Sid      = "EcrManagedImageToken"
+          Effect   = "Allow"
+          Action   = ["ecr:GetAuthorizationToken"]
+          Resource = ["*"]
+        },
+      ] : [],
+      [
+        # Null Sid/Condition fields are dropped from the rendered policy.
+        for statement in var.additional_execution_role_policy_statements :
+        { for key, value in statement : key => value if value != null }
     ])
   })
 }
 
+# Security group for the Harness, used when running inside a VPC
+resource "aws_security_group" "harness" {
+  count = var.enable_vpc ? 1 : 0
+
+  #checkov:skip=CKV2_AWS_5:Attached to the Harness via its network configuration; Checkov cannot resolve this reference
+  name_prefix = "${local.harness_name_prefix}-harness-"
+  description = "Security group for the ${local.harness_name_prefix} Harness"
+  vpc_id      = var.vpc_id
+  tags        = var.tags
+}
+
+resource "aws_vpc_security_group_egress_rule" "harness_https" {
+  count = var.enable_vpc ? 1 : 0
+
+  security_group_id = aws_security_group.harness[0].id
+  cidr_ipv4         = "0.0.0.0/0"
+  from_port         = 443
+  to_port           = 443
+  ip_protocol       = "tcp"
+  description       = "Allow outbound HTTPS to AWS service endpoints"
+}
+
 # Omitting authorizer_configuration uses IAM inbound authorization; add a
 # custom_jwt_authorizer block to change that.
 resource "aws_bedrockagentcore_harness" "this" {
   harness_name       = local.harness_name
-  execution_role_arn = aws_iam_role.execution_role.arn
+  execution_role_arn = local.execution_role_arn
+
+  allowed_tools         = var.allowed_tools
+  environment_variables = var.environment_variables
+  max_iterations        = var.max_iterations
+  timeout_seconds       = var.timeout_seconds
 
   model {
     bedrock_model_config {
@@ -255,9 +410,83 @@ resource "aws_bedrockagentcore_harness" "this" {
     text = file("${path.module}/../../../../../../../<%- promptPathFromTerraform %>")
   }
 
+  dynamic "memory" {
+    for_each = var.memory != null ? [var.memory] : []
+    content {
+      dynamic "managed_memory_configuration" {
+        for_each = memory.value.managed_memory_configuration != null ? [memory.value.managed_memory_configuration] : []
+        content {
+          strategies            = managed_memory_configuration.value.strategies
+          event_expiry_duration = managed_memory_configuration.value.event_expiry_duration
+          encryption_key_arn    = managed_memory_configuration.value.encryption_key_arn
+        }
+      }
+
+      dynamic "agentcore_memory_configuration" {
+        for_each = memory.value.agentcore_memory_configuration != null ? [memory.value.agentcore_memory_configuration] : []
+        content {
+          arn            = agentcore_memory_configuration.value.arn
+          actor_id       = agentcore_memory_configuration.value.actor_id
+          messages_count = agentcore_memory_configuration.value.messages_count
+        }
+      }
+
+      dynamic "disabled" {
+        for_each = memory.value.disabled ? [1] : []
+        content {}
+      }
+    }
+  }
+
+  dynamic "environment" {
+    for_each = var.enable_vpc ? [1] : []
+    content {
+      agentcore_runtime_environment {
+        network_configuration {
+          network_mode = "VPC"
+          network_mode_config {
+            security_groups = [aws_security_group.harness[0].id]
+            subnets         = var.subnet_ids
+          }
+        }
+      }
+    }
+  }
+
+  tags = var.tags
+
   depends_on = [aws_iam_role_policy.execution_role]
 }
 
+# Scoped to the memory ARN the service assigns, which is only readable after the
+# Harness exists, so this is a policy of its own rather than a baseline
+# statement. Skipped when the Harness uses a role or memory the module did not
+# create.
+resource "aws_iam_role_policy" "managed_memory" {
+  count = var.create_execution_role && local.has_managed_memory ? 1 : 0
+
+  name = "${local.harness_name_prefix}-HarnessManagedMemoryPolicy"
+  role = aws_iam_role.execution_role[0].id
+
+  policy = jsonencode({
+    Version = "2012-10-17"
+    Statement = [{
+      Sid    = "AgentCoreManagedMemory"
+      Effect = "Allow"
+      Action = [
+        "bedrock-agentcore:CreateEvent",
+        "bedrock-agentcore:DeleteEvent",
+        "bedrock-agentcore:GetEvent",
+        "bedrock-agentcore:ListEvents",
+        "bedrock-agentcore:RetrieveMemoryRecords",
+      ]
+      Resource = [
+        aws_bedrockagentcore_harness.this.memory_actual[0].managed_memory_configuration[0].arn,
+      ]
+    }]
+  })
+}
+
 module "add_harness_arn_to_runtime_config" {
   source = "../../../core/runtime-config/entry"
 
@@ -277,6 +506,11 @@ output "harness_arn" {
 }
 
 output "execution_role_arn" {
-  description = "ARN of the IAM role assumed by the Harness"
-  value       = aws_iam_role.execution_role.arn
+  description = "ARN of the IAM role assumed by the Harness, whether generated or supplied via var.execution_role_arn"
+  value       = local.execution_role_arn
+}
+
+output "security_group_id" {
+  description = "Security group ID of the Harness, for use in ingress rules on resources it must reach (e.g. a database). Null unless enable_vpc is true."
+  value       = var.enable_vpc ? aws_security_group.harness[0].id : null
 }

package/src/utils/agent-core-constructs/files/terraform/core/agent-core/runtime.tf.template

@@ -6,6 +6,10 @@ terraform {
       source  = "hashicorp/aws"
       version = "<%- awsProviderVersion %>"
     }
+    external = {
+      source  = "hashicorp/external"
+      version = "<%- externalProviderVersion %>"
+    }
     null = {
       source  = "hashicorp/null"
       version = "<%- nullProviderVersion %>"

package/src/utils/api-constructs/api-constructs.js

@@ -39,6 +39,16 @@ import { PY_VERSIONS, terraformProviderVersions, withVersions } from "../version
         when: generatedTerraform
     }
 ];
+/**
+ * Path segments a REST API operation may have in the generated Terraform.
+ *
+ * API Gateway REST APIs need a resource per path segment, and instances of a
+ * Terraform resource cannot reference one another
+ * (https://github.com/hashicorp/terraform/issues/26697), so the module declares
+ * one resource per level up to this depth. Deeper paths fail the plan with a
+ * message pointing at the fix. Empty levels create no resources, so the only
+ * cost of the headroom is the generated configuration itself.
+ */ const MAX_REST_PATH_DEPTH = 16;
 export const addApiGatewayInfra = async (tree, options, declaration)=>{
     if (options.iac === 'cdk') {
         await addApiGatewayCdkConstructs(tree, options, declaration);
@@ -105,6 +115,7 @@ export const addApiGatewayInfra = async (tree, options, declaration)=>{
     // Generate app specific terraform module
     generateFiles(tree, joinPathFragments(import.meta.dirname, 'files', 'terraform', 'app', 'apis', options.constructType), joinPathFragments(PACKAGES_DIR, SHARED_TERRAFORM_DIR, 'src', 'app', 'apis'), {
         ...options,
+        maxRestPathDepth: MAX_REST_PATH_DEPTH,
         ...terraformProviderVersions()
     }, {
         overwriteStrategy: OverwriteStrategy.KeepExisting

package/src/utils/api-constructs/api-constructs.js.map

@@ -1 +1 @@
-{"version":3,"sources":["../../../../../../packages/nx-plugin/src/utils/api-constructs/api-constructs.ts"],"sourcesContent":["/**\n * Copyright Amazon.com, Inc. or its affiliates. All Rights Reserved.\n * SPDX-License-Identifier: Apache-2.0\n */\nimport {\n  generateFiles,\n  joinPathFragments,\n  OverwriteStrategy,\n  type ProjectConfiguration,\n  type Tree,\n  updateJson,\n} from '@nx/devkit';\nimport { addStarExport } from '../ast.js';\nimport {\n  type DeclaredPyDependency,\n  type DeclaredTsDependency,\n  type DependencyDeclaration,\n  forDependencies,\n  type MustDeclare,\n} from '../declared-dependencies.js';\nimport { addDependenciesToPackageJson } from '../dependencies.js';\nimport type { Iac } from '../iac.js';\nimport { esmVars } from '../module-format.js';\nimport { addDependencyToTargetIfNotPresent } from '../nx.js';\nimport {\n  generatedInfrastructure,\n  generatedTerraform,\n  type IacMetadata,\n  PACKAGES_DIR,\n  SHARED_CONSTRUCTS_DIR,\n  SHARED_TERRAFORM_DIR,\n} from '../shared-constructs-constants.js';\nimport {\n  type IPyDepVersion,\n  type ITsDepVersion,\n  PY_VERSIONS,\n  terraformProviderVersions,\n  withVersions,\n} from '../versions.js';\n\n/**\n * Dependencies a caller must declare to add API Gateway infrastructure.\n *\n * Gated on infrastructure having been generated: `addApiGatewayInfra` only runs\n * on that branch, so a project generated with `infra: 'none'` never receives\n * these.\n */\nexport const API_CONSTRUCTS_DEPENDENCIES = [\n  { name: '@aws-sdk/client-api-gateway', when: generatedInfrastructure },\n  { name: '@aws-sdk/client-iam', when: generatedInfrastructure },\n  { name: '@trpc/server', when: generatedInfrastructure },\n] as const satisfies readonly DeclaredTsDependency<\n  ITsDepVersion,\n  IacMetadata\n>[];\n\n/**\n * Python version the generated Terraform pins in the account module's inline\n * `uv run --with` script. Nothing installs it, so it is declared for its version\n * alone, and only on the Terraform branch that writes the script.\n */\nexport const API_CONSTRUCTS_PY_DEPENDENCIES = [\n  { name: 'boto3', when: generatedTerraform },\n] as const satisfies readonly DeclaredPyDependency<\n  IPyDepVersion,\n  IacMetadata\n>[];\n\ninterface BackendOptions {\n  type: 'trpc' | 'fastapi' | 'smithy';\n  integrationPattern: 'isolated' | 'shared';\n}\n\nexport interface TrpcBackendOptions extends BackendOptions {\n  type: 'trpc';\n  projectAlias: string;\n  bundleOutputDir: string;\n  authorizerBundleOutputDir?: string;\n}\n\nexport interface FastApiBackendOptions extends BackendOptions {\n  type: 'fastapi';\n  moduleName: string;\n  bundleOutputDir: string;\n}\n\nexport interface SmithyBackendOptions extends BackendOptions {\n  type: 'smithy';\n  bundleOutputDir: string;\n  authorizerBundleOutputDir?: string;\n}\n\nexport interface AddApiGatewayConstructOptions {\n  apiProjectName: string;\n  apiNameClassName: string;\n  apiNameKebabCase: string;\n  constructType: 'http' | 'rest';\n  backend: TrpcBackendOptions | FastApiBackendOptions | SmithyBackendOptions;\n  auth: 'iam' | 'cognito' | 'custom';\n}\n\nexport const addApiGatewayInfra = async <const D extends DependencyDeclaration>(\n  tree: Tree,\n  options: AddApiGatewayConstructOptions & { iac: Iac },\n  declaration: D & MustDeclare<typeof API_CONSTRUCTS_DEPENDENCIES, D>,\n) => {\n  if (options.iac === 'cdk') {\n    await addApiGatewayCdkConstructs(tree, options, declaration);\n  } else if (options.iac === 'terraform') {\n    addApiGatewayTerraformModules(tree, options);\n  } else {\n    throw new Error(`Unsupported iac ${options.iac}`);\n  }\n\n  updateJson(\n    tree,\n    joinPathFragments(\n      PACKAGES_DIR,\n      options.iac === 'cdk' ? SHARED_CONSTRUCTS_DIR : SHARED_TERRAFORM_DIR,\n      'project.json',\n    ),\n    (config: ProjectConfiguration) => {\n      addDependencyToTargetIfNotPresent(\n        config,\n        'build',\n        `${options.apiProjectName}:build`,\n      );\n      return config;\n    },\n  );\n};\n\n/**\n * Add an API CDK construct, and update the Runtime Config type to export its url\n */\nconst addApiGatewayCdkConstructs = async (\n  tree: Tree,\n  options: AddApiGatewayConstructOptions,\n  declaration: DependencyDeclaration,\n) => {\n  const generateCoreApiFile = (name: string) => {\n    generateFiles(\n      tree,\n      joinPathFragments(\n        import.meta.dirname,\n        'files',\n        'cdk',\n        'core',\n        'api',\n        name,\n      ),\n      joinPathFragments(\n        PACKAGES_DIR,\n        SHARED_CONSTRUCTS_DIR,\n        'src',\n        'core',\n        'api',\n      ),\n      { ...esmVars(tree) },\n      {\n        overwriteStrategy: OverwriteStrategy.KeepExisting,\n      },\n    );\n  };\n\n  // Generate relevant core CDK construct and utilities\n  generateCoreApiFile(options.constructType);\n  generateCoreApiFile('utils');\n  if (options.backend.type === 'trpc') {\n    generateCoreApiFile('trpc');\n  }\n\n  // Declare the deps the generated core construct files import.\n  const constructDeps: (typeof API_CONSTRUCTS_DEPENDENCIES)[number]['name'][] =\n    [];\n  if (options.constructType === 'rest') {\n    // REST account construct configures the account via the AWS SDK.\n    constructDeps.push('@aws-sdk/client-api-gateway', '@aws-sdk/client-iam');\n  }\n  if (options.backend.type === 'trpc') {\n    // trpc-utils.ts types the router with @trpc/server.\n    constructDeps.push('@trpc/server');\n  }\n  if (constructDeps.length > 0) {\n    addDependenciesToPackageJson(\n      tree,\n      withVersions(\n        forDependencies<typeof API_CONSTRUCTS_DEPENDENCIES>(declaration),\n        constructDeps,\n      ),\n      {},\n      joinPathFragments(PACKAGES_DIR, SHARED_CONSTRUCTS_DIR, 'package.json'),\n    );\n  }\n\n  // Generate app specific CDK construct\n  generateFiles(\n    tree,\n    joinPathFragments(\n      import.meta.dirname,\n      'files',\n      'cdk',\n      'app',\n      'apis',\n      options.constructType,\n    ),\n    joinPathFragments(\n      PACKAGES_DIR,\n      SHARED_CONSTRUCTS_DIR,\n      'src',\n      'app',\n      'apis',\n    ),\n    { ...options, ...esmVars(tree) },\n    {\n      overwriteStrategy: OverwriteStrategy.KeepExisting,\n    },\n  );\n\n  // Export app specific CDK construct\n  await addStarExport(\n    tree,\n    joinPathFragments(\n      PACKAGES_DIR,\n      SHARED_CONSTRUCTS_DIR,\n      'src',\n      'app',\n      'apis',\n      'index.ts',\n    ),\n    `./${options.apiNameKebabCase}.js`,\n  );\n  await addStarExport(\n    tree,\n    joinPathFragments(\n      PACKAGES_DIR,\n      SHARED_CONSTRUCTS_DIR,\n      'src',\n      'app',\n      'index.ts',\n    ),\n    './apis/index.js',\n  );\n};\n\n/**\n * Add an API terraform module, and update the Runtime Config type to export its url\n */\nconst addApiGatewayTerraformModules = (\n  tree: Tree,\n  options: AddApiGatewayConstructOptions,\n) => {\n  // Generate core terraform module\n  generateFiles(\n    tree,\n    joinPathFragments(\n      import.meta.dirname,\n      'files',\n      'terraform',\n      'core',\n      'api',\n      options.constructType,\n    ),\n    joinPathFragments(PACKAGES_DIR, SHARED_TERRAFORM_DIR, 'src', 'core', 'api'),\n    { boto3Version: PY_VERSIONS.boto3, ...terraformProviderVersions() },\n    {\n      overwriteStrategy: OverwriteStrategy.KeepExisting,\n    },\n  );\n\n  // Generate app specific terraform module\n  generateFiles(\n    tree,\n    joinPathFragments(\n      import.meta.dirname,\n      'files',\n      'terraform',\n      'app',\n      'apis',\n      options.constructType,\n    ),\n    joinPathFragments(PACKAGES_DIR, SHARED_TERRAFORM_DIR, 'src', 'app', 'apis'),\n    { ...options, ...terraformProviderVersions() },\n    {\n      overwriteStrategy: OverwriteStrategy.KeepExisting,\n    },\n  );\n};\n"],"names":["generateFiles","joinPathFragments","OverwriteStrategy","updateJson","addStarExport","forDependencies","addDependenciesToPackageJson","esmVars","addDependencyToTargetIfNotPresent","generatedInfrastructure","generatedTerraform","PACKAGES_DIR","SHARED_CONSTRUCTS_DIR","SHARED_TERRAFORM_DIR","PY_VERSIONS","terraformProviderVersions","withVersions","API_CONSTRUCTS_DEPENDENCIES","name","when","API_CONSTRUCTS_PY_DEPENDENCIES","addApiGatewayInfra","tree","options","declaration","iac","addApiGatewayCdkConstructs","addApiGatewayTerraformModules","Error","config","apiProjectName","generateCoreApiFile","dirname","overwriteStrategy","KeepExisting","constructType","backend","type","constructDeps","push","length","apiNameKebabCase","boto3Version","boto3"],"mappings":"AAAA;;;CAGC,GACD,SACEA,aAAa,EACbC,iBAAiB,EACjBC,iBAAiB,EAGjBC,UAAU,QACL,aAAa;AACpB,SAASC,aAAa,QAAQ,YAAY;AAC1C,SAIEC,eAAe,QAEV,8BAA8B;AACrC,SAASC,4BAA4B,QAAQ,qBAAqB;AAElE,SAASC,OAAO,QAAQ,sBAAsB;AAC9C,SAASC,iCAAiC,QAAQ,WAAW;AAC7D,SACEC,uBAAuB,EACvBC,kBAAkB,EAElBC,YAAY,EACZC,qBAAqB,EACrBC,oBAAoB,QACf,oCAAoC;AAC3C,SAGEC,WAAW,EACXC,yBAAyB,EACzBC,YAAY,QACP,iBAAiB;AAExB;;;;;;CAMC,GACD,OAAO,MAAMC,8BAA8B;IACzC;QAAEC,MAAM;QAA+BC,MAAMV;IAAwB;IACrE;QAAES,MAAM;QAAuBC,MAAMV;IAAwB;IAC7D;QAAES,MAAM;QAAgBC,MAAMV;IAAwB;CACvD,CAGG;AAEJ;;;;CAIC,GACD,OAAO,MAAMW,iCAAiC;IAC5C;QAAEF,MAAM;QAASC,MAAMT;IAAmB;CAC3C,CAGG;AAmCJ,OAAO,MAAMW,qBAAqB,OAChCC,MACAC,SACAC;IAEA,IAAID,QAAQE,GAAG,KAAK,OAAO;QACzB,MAAMC,2BAA2BJ,MAAMC,SAASC;IAClD,OAAO,IAAID,QAAQE,GAAG,KAAK,aAAa;QACtCE,8BAA8BL,MAAMC;IACtC,OAAO;QACL,MAAM,IAAIK,MAAM,CAAC,gBAAgB,EAAEL,QAAQE,GAAG,EAAE;IAClD;IAEAtB,WACEmB,MACArB,kBACEU,cACAY,QAAQE,GAAG,KAAK,QAAQb,wBAAwBC,sBAChD,iBAEF,CAACgB;QACCrB,kCACEqB,QACA,SACA,GAAGN,QAAQO,cAAc,CAAC,MAAM,CAAC;QAEnC,OAAOD;IACT;AAEJ,EAAE;AAEF;;CAEC,GACD,MAAMH,6BAA6B,OACjCJ,MACAC,SACAC;IAEA,MAAMO,sBAAsB,CAACb;QAC3BlB,cACEsB,MACArB,kBACE,YAAY+B,OAAO,EACnB,SACA,OACA,QACA,OACAd,OAEFjB,kBACEU,cACAC,uBACA,OACA,QACA,QAEF;YAAE,GAAGL,QAAQe,KAAK;QAAC,GACnB;YACEW,mBAAmB/B,kBAAkBgC,YAAY;QACnD;IAEJ;IAEA,qDAAqD;IACrDH,oBAAoBR,QAAQY,aAAa;IACzCJ,oBAAoB;IACpB,IAAIR,QAAQa,OAAO,CAACC,IAAI,KAAK,QAAQ;QACnCN,oBAAoB;IACtB;IAEA,8DAA8D;IAC9D,MAAMO,gBACJ,EAAE;IACJ,IAAIf,QAAQY,aAAa,KAAK,QAAQ;QACpC,iEAAiE;QACjEG,cAAcC,IAAI,CAAC,+BAA+B;IACpD;IACA,IAAIhB,QAAQa,OAAO,CAACC,IAAI,KAAK,QAAQ;QACnC,oDAAoD;QACpDC,cAAcC,IAAI,CAAC;IACrB;IACA,IAAID,cAAcE,MAAM,GAAG,GAAG;QAC5BlC,6BACEgB,MACAN,aACEX,gBAAoDmB,cACpDc,gBAEF,CAAC,GACDrC,kBAAkBU,cAAcC,uBAAuB;IAE3D;IAEA,sCAAsC;IACtCZ,cACEsB,MACArB,kBACE,YAAY+B,OAAO,EACnB,SACA,OACA,OACA,QACAT,QAAQY,aAAa,GAEvBlC,kBACEU,cACAC,uBACA,OACA,OACA,SAEF;QAAE,GAAGW,OAAO;QAAE,GAAGhB,QAAQe,KAAK;IAAC,GAC/B;QACEW,mBAAmB/B,kBAAkBgC,YAAY;IACnD;IAGF,oCAAoC;IACpC,MAAM9B,cACJkB,MACArB,kBACEU,cACAC,uBACA,OACA,OACA,QACA,aAEF,CAAC,EAAE,EAAEW,QAAQkB,gBAAgB,CAAC,GAAG,CAAC;IAEpC,MAAMrC,cACJkB,MACArB,kBACEU,cACAC,uBACA,OACA,OACA,aAEF;AAEJ;AAEA;;CAEC,GACD,MAAMe,gCAAgC,CACpCL,MACAC;IAEA,iCAAiC;IACjCvB,cACEsB,MACArB,kBACE,YAAY+B,OAAO,EACnB,SACA,aACA,QACA,OACAT,QAAQY,aAAa,GAEvBlC,kBAAkBU,cAAcE,sBAAsB,OAAO,QAAQ,QACrE;QAAE6B,cAAc5B,YAAY6B,KAAK;QAAE,GAAG5B,2BAA2B;IAAC,GAClE;QACEkB,mBAAmB/B,kBAAkBgC,YAAY;IACnD;IAGF,yCAAyC;IACzClC,cACEsB,MACArB,kBACE,YAAY+B,OAAO,EACnB,SACA,aACA,OACA,QACAT,QAAQY,aAAa,GAEvBlC,kBAAkBU,cAAcE,sBAAsB,OAAO,OAAO,SACpE;QAAE,GAAGU,OAAO;QAAE,GAAGR,2BAA2B;IAAC,GAC7C;QACEkB,mBAAmB/B,kBAAkBgC,YAAY;IACnD;AAEJ"}
+{"version":3,"sources":["../../../../../../packages/nx-plugin/src/utils/api-constructs/api-constructs.ts"],"sourcesContent":["/**\n * Copyright Amazon.com, Inc. or its affiliates. All Rights Reserved.\n * SPDX-License-Identifier: Apache-2.0\n */\nimport {\n  generateFiles,\n  joinPathFragments,\n  OverwriteStrategy,\n  type ProjectConfiguration,\n  type Tree,\n  updateJson,\n} from '@nx/devkit';\nimport { addStarExport } from '../ast.js';\nimport {\n  type DeclaredPyDependency,\n  type DeclaredTsDependency,\n  type DependencyDeclaration,\n  forDependencies,\n  type MustDeclare,\n} from '../declared-dependencies.js';\nimport { addDependenciesToPackageJson } from '../dependencies.js';\nimport type { Iac } from '../iac.js';\nimport { esmVars } from '../module-format.js';\nimport { addDependencyToTargetIfNotPresent } from '../nx.js';\nimport {\n  generatedInfrastructure,\n  generatedTerraform,\n  type IacMetadata,\n  PACKAGES_DIR,\n  SHARED_CONSTRUCTS_DIR,\n  SHARED_TERRAFORM_DIR,\n} from '../shared-constructs-constants.js';\nimport {\n  type IPyDepVersion,\n  type ITsDepVersion,\n  PY_VERSIONS,\n  terraformProviderVersions,\n  withVersions,\n} from '../versions.js';\n\n/**\n * Dependencies a caller must declare to add API Gateway infrastructure.\n *\n * Gated on infrastructure having been generated: `addApiGatewayInfra` only runs\n * on that branch, so a project generated with `infra: 'none'` never receives\n * these.\n */\nexport const API_CONSTRUCTS_DEPENDENCIES = [\n  { name: '@aws-sdk/client-api-gateway', when: generatedInfrastructure },\n  { name: '@aws-sdk/client-iam', when: generatedInfrastructure },\n  { name: '@trpc/server', when: generatedInfrastructure },\n] as const satisfies readonly DeclaredTsDependency<\n  ITsDepVersion,\n  IacMetadata\n>[];\n\n/**\n * Python version the generated Terraform pins in the account module's inline\n * `uv run --with` script. Nothing installs it, so it is declared for its version\n * alone, and only on the Terraform branch that writes the script.\n */\nexport const API_CONSTRUCTS_PY_DEPENDENCIES = [\n  { name: 'boto3', when: generatedTerraform },\n] as const satisfies readonly DeclaredPyDependency<\n  IPyDepVersion,\n  IacMetadata\n>[];\n\n/**\n * Path segments a REST API operation may have in the generated Terraform.\n *\n * API Gateway REST APIs need a resource per path segment, and instances of a\n * Terraform resource cannot reference one another\n * (https://github.com/hashicorp/terraform/issues/26697), so the module declares\n * one resource per level up to this depth. Deeper paths fail the plan with a\n * message pointing at the fix. Empty levels create no resources, so the only\n * cost of the headroom is the generated configuration itself.\n */\nconst MAX_REST_PATH_DEPTH = 16;\n\ninterface BackendOptions {\n  type: 'trpc' | 'fastapi' | 'smithy';\n  integrationPattern: 'isolated' | 'shared';\n}\n\nexport interface TrpcBackendOptions extends BackendOptions {\n  type: 'trpc';\n  projectAlias: string;\n  bundleOutputDir: string;\n  authorizerBundleOutputDir?: string;\n}\n\nexport interface FastApiBackendOptions extends BackendOptions {\n  type: 'fastapi';\n  moduleName: string;\n  bundleOutputDir: string;\n}\n\nexport interface SmithyBackendOptions extends BackendOptions {\n  type: 'smithy';\n  bundleOutputDir: string;\n  authorizerBundleOutputDir?: string;\n}\n\nexport interface AddApiGatewayConstructOptions {\n  apiProjectName: string;\n  apiNameClassName: string;\n  apiNameKebabCase: string;\n  constructType: 'http' | 'rest';\n  backend: TrpcBackendOptions | FastApiBackendOptions | SmithyBackendOptions;\n  auth: 'iam' | 'cognito' | 'custom';\n}\n\nexport const addApiGatewayInfra = async <const D extends DependencyDeclaration>(\n  tree: Tree,\n  options: AddApiGatewayConstructOptions & { iac: Iac },\n  declaration: D & MustDeclare<typeof API_CONSTRUCTS_DEPENDENCIES, D>,\n) => {\n  if (options.iac === 'cdk') {\n    await addApiGatewayCdkConstructs(tree, options, declaration);\n  } else if (options.iac === 'terraform') {\n    addApiGatewayTerraformModules(tree, options);\n  } else {\n    throw new Error(`Unsupported iac ${options.iac}`);\n  }\n\n  updateJson(\n    tree,\n    joinPathFragments(\n      PACKAGES_DIR,\n      options.iac === 'cdk' ? SHARED_CONSTRUCTS_DIR : SHARED_TERRAFORM_DIR,\n      'project.json',\n    ),\n    (config: ProjectConfiguration) => {\n      addDependencyToTargetIfNotPresent(\n        config,\n        'build',\n        `${options.apiProjectName}:build`,\n      );\n      return config;\n    },\n  );\n};\n\n/**\n * Add an API CDK construct, and update the Runtime Config type to export its url\n */\nconst addApiGatewayCdkConstructs = async (\n  tree: Tree,\n  options: AddApiGatewayConstructOptions,\n  declaration: DependencyDeclaration,\n) => {\n  const generateCoreApiFile = (name: string) => {\n    generateFiles(\n      tree,\n      joinPathFragments(\n        import.meta.dirname,\n        'files',\n        'cdk',\n        'core',\n        'api',\n        name,\n      ),\n      joinPathFragments(\n        PACKAGES_DIR,\n        SHARED_CONSTRUCTS_DIR,\n        'src',\n        'core',\n        'api',\n      ),\n      { ...esmVars(tree) },\n      {\n        overwriteStrategy: OverwriteStrategy.KeepExisting,\n      },\n    );\n  };\n\n  // Generate relevant core CDK construct and utilities\n  generateCoreApiFile(options.constructType);\n  generateCoreApiFile('utils');\n  if (options.backend.type === 'trpc') {\n    generateCoreApiFile('trpc');\n  }\n\n  // Declare the deps the generated core construct files import.\n  const constructDeps: (typeof API_CONSTRUCTS_DEPENDENCIES)[number]['name'][] =\n    [];\n  if (options.constructType === 'rest') {\n    // REST account construct configures the account via the AWS SDK.\n    constructDeps.push('@aws-sdk/client-api-gateway', '@aws-sdk/client-iam');\n  }\n  if (options.backend.type === 'trpc') {\n    // trpc-utils.ts types the router with @trpc/server.\n    constructDeps.push('@trpc/server');\n  }\n  if (constructDeps.length > 0) {\n    addDependenciesToPackageJson(\n      tree,\n      withVersions(\n        forDependencies<typeof API_CONSTRUCTS_DEPENDENCIES>(declaration),\n        constructDeps,\n      ),\n      {},\n      joinPathFragments(PACKAGES_DIR, SHARED_CONSTRUCTS_DIR, 'package.json'),\n    );\n  }\n\n  // Generate app specific CDK construct\n  generateFiles(\n    tree,\n    joinPathFragments(\n      import.meta.dirname,\n      'files',\n      'cdk',\n      'app',\n      'apis',\n      options.constructType,\n    ),\n    joinPathFragments(\n      PACKAGES_DIR,\n      SHARED_CONSTRUCTS_DIR,\n      'src',\n      'app',\n      'apis',\n    ),\n    { ...options, ...esmVars(tree) },\n    {\n      overwriteStrategy: OverwriteStrategy.KeepExisting,\n    },\n  );\n\n  // Export app specific CDK construct\n  await addStarExport(\n    tree,\n    joinPathFragments(\n      PACKAGES_DIR,\n      SHARED_CONSTRUCTS_DIR,\n      'src',\n      'app',\n      'apis',\n      'index.ts',\n    ),\n    `./${options.apiNameKebabCase}.js`,\n  );\n  await addStarExport(\n    tree,\n    joinPathFragments(\n      PACKAGES_DIR,\n      SHARED_CONSTRUCTS_DIR,\n      'src',\n      'app',\n      'index.ts',\n    ),\n    './apis/index.js',\n  );\n};\n\n/**\n * Add an API terraform module, and update the Runtime Config type to export its url\n */\nconst addApiGatewayTerraformModules = (\n  tree: Tree,\n  options: AddApiGatewayConstructOptions,\n) => {\n  // Generate core terraform module\n  generateFiles(\n    tree,\n    joinPathFragments(\n      import.meta.dirname,\n      'files',\n      'terraform',\n      'core',\n      'api',\n      options.constructType,\n    ),\n    joinPathFragments(PACKAGES_DIR, SHARED_TERRAFORM_DIR, 'src', 'core', 'api'),\n    { boto3Version: PY_VERSIONS.boto3, ...terraformProviderVersions() },\n    {\n      overwriteStrategy: OverwriteStrategy.KeepExisting,\n    },\n  );\n\n  // Generate app specific terraform module\n  generateFiles(\n    tree,\n    joinPathFragments(\n      import.meta.dirname,\n      'files',\n      'terraform',\n      'app',\n      'apis',\n      options.constructType,\n    ),\n    joinPathFragments(PACKAGES_DIR, SHARED_TERRAFORM_DIR, 'src', 'app', 'apis'),\n    {\n      ...options,\n      maxRestPathDepth: MAX_REST_PATH_DEPTH,\n      ...terraformProviderVersions(),\n    },\n    {\n      overwriteStrategy: OverwriteStrategy.KeepExisting,\n    },\n  );\n};\n"],"names":["generateFiles","joinPathFragments","OverwriteStrategy","updateJson","addStarExport","forDependencies","addDependenciesToPackageJson","esmVars","addDependencyToTargetIfNotPresent","generatedInfrastructure","generatedTerraform","PACKAGES_DIR","SHARED_CONSTRUCTS_DIR","SHARED_TERRAFORM_DIR","PY_VERSIONS","terraformProviderVersions","withVersions","API_CONSTRUCTS_DEPENDENCIES","name","when","API_CONSTRUCTS_PY_DEPENDENCIES","MAX_REST_PATH_DEPTH","addApiGatewayInfra","tree","options","declaration","iac","addApiGatewayCdkConstructs","addApiGatewayTerraformModules","Error","config","apiProjectName","generateCoreApiFile","dirname","overwriteStrategy","KeepExisting","constructType","backend","type","constructDeps","push","length","apiNameKebabCase","boto3Version","boto3","maxRestPathDepth"],"mappings":"AAAA;;;CAGC,GACD,SACEA,aAAa,EACbC,iBAAiB,EACjBC,iBAAiB,EAGjBC,UAAU,QACL,aAAa;AACpB,SAASC,aAAa,QAAQ,YAAY;AAC1C,SAIEC,eAAe,QAEV,8BAA8B;AACrC,SAASC,4BAA4B,QAAQ,qBAAqB;AAElE,SAASC,OAAO,QAAQ,sBAAsB;AAC9C,SAASC,iCAAiC,QAAQ,WAAW;AAC7D,SACEC,uBAAuB,EACvBC,kBAAkB,EAElBC,YAAY,EACZC,qBAAqB,EACrBC,oBAAoB,QACf,oCAAoC;AAC3C,SAGEC,WAAW,EACXC,yBAAyB,EACzBC,YAAY,QACP,iBAAiB;AAExB;;;;;;CAMC,GACD,OAAO,MAAMC,8BAA8B;IACzC;QAAEC,MAAM;QAA+BC,MAAMV;IAAwB;IACrE;QAAES,MAAM;QAAuBC,MAAMV;IAAwB;IAC7D;QAAES,MAAM;QAAgBC,MAAMV;IAAwB;CACvD,CAGG;AAEJ;;;;CAIC,GACD,OAAO,MAAMW,iCAAiC;IAC5C;QAAEF,MAAM;QAASC,MAAMT;IAAmB;CAC3C,CAGG;AAEJ;;;;;;;;;CASC,GACD,MAAMW,sBAAsB;AAmC5B,OAAO,MAAMC,qBAAqB,OAChCC,MACAC,SACAC;IAEA,IAAID,QAAQE,GAAG,KAAK,OAAO;QACzB,MAAMC,2BAA2BJ,MAAMC,SAASC;IAClD,OAAO,IAAID,QAAQE,GAAG,KAAK,aAAa;QACtCE,8BAA8BL,MAAMC;IACtC,OAAO;QACL,MAAM,IAAIK,MAAM,CAAC,gBAAgB,EAAEL,QAAQE,GAAG,EAAE;IAClD;IAEAvB,WACEoB,MACAtB,kBACEU,cACAa,QAAQE,GAAG,KAAK,QAAQd,wBAAwBC,sBAChD,iBAEF,CAACiB;QACCtB,kCACEsB,QACA,SACA,GAAGN,QAAQO,cAAc,CAAC,MAAM,CAAC;QAEnC,OAAOD;IACT;AAEJ,EAAE;AAEF;;CAEC,GACD,MAAMH,6BAA6B,OACjCJ,MACAC,SACAC;IAEA,MAAMO,sBAAsB,CAACd;QAC3BlB,cACEuB,MACAtB,kBACE,YAAYgC,OAAO,EACnB,SACA,OACA,QACA,OACAf,OAEFjB,kBACEU,cACAC,uBACA,OACA,QACA,QAEF;YAAE,GAAGL,QAAQgB,KAAK;QAAC,GACnB;YACEW,mBAAmBhC,kBAAkBiC,YAAY;QACnD;IAEJ;IAEA,qDAAqD;IACrDH,oBAAoBR,QAAQY,aAAa;IACzCJ,oBAAoB;IACpB,IAAIR,QAAQa,OAAO,CAACC,IAAI,KAAK,QAAQ;QACnCN,oBAAoB;IACtB;IAEA,8DAA8D;IAC9D,MAAMO,gBACJ,EAAE;IACJ,IAAIf,QAAQY,aAAa,KAAK,QAAQ;QACpC,iEAAiE;QACjEG,cAAcC,IAAI,CAAC,+BAA+B;IACpD;IACA,IAAIhB,QAAQa,OAAO,CAACC,IAAI,KAAK,QAAQ;QACnC,oDAAoD;QACpDC,cAAcC,IAAI,CAAC;IACrB;IACA,IAAID,cAAcE,MAAM,GAAG,GAAG;QAC5BnC,6BACEiB,MACAP,aACEX,gBAAoDoB,cACpDc,gBAEF,CAAC,GACDtC,kBAAkBU,cAAcC,uBAAuB;IAE3D;IAEA,sCAAsC;IACtCZ,cACEuB,MACAtB,kBACE,YAAYgC,OAAO,EACnB,SACA,OACA,OACA,QACAT,QAAQY,aAAa,GAEvBnC,kBACEU,cACAC,uBACA,OACA,OACA,SAEF;QAAE,GAAGY,OAAO;QAAE,GAAGjB,QAAQgB,KAAK;IAAC,GAC/B;QACEW,mBAAmBhC,kBAAkBiC,YAAY;IACnD;IAGF,oCAAoC;IACpC,MAAM/B,cACJmB,MACAtB,kBACEU,cACAC,uBACA,OACA,OACA,QACA,aAEF,CAAC,EAAE,EAAEY,QAAQkB,gBAAgB,CAAC,GAAG,CAAC;IAEpC,MAAMtC,cACJmB,MACAtB,kBACEU,cACAC,uBACA,OACA,OACA,aAEF;AAEJ;AAEA;;CAEC,GACD,MAAMgB,gCAAgC,CACpCL,MACAC;IAEA,iCAAiC;IACjCxB,cACEuB,MACAtB,kBACE,YAAYgC,OAAO,EACnB,SACA,aACA,QACA,OACAT,QAAQY,aAAa,GAEvBnC,kBAAkBU,cAAcE,sBAAsB,OAAO,QAAQ,QACrE;QAAE8B,cAAc7B,YAAY8B,KAAK;QAAE,GAAG7B,2BAA2B;IAAC,GAClE;QACEmB,mBAAmBhC,kBAAkBiC,YAAY;IACnD;IAGF,yCAAyC;IACzCnC,cACEuB,MACAtB,kBACE,YAAYgC,OAAO,EACnB,SACA,aACA,OACA,QACAT,QAAQY,aAAa,GAEvBnC,kBAAkBU,cAAcE,sBAAsB,OAAO,OAAO,SACpE;QACE,GAAGW,OAAO;QACVqB,kBAAkBxB;QAClB,GAAGN,2BAA2B;IAChC,GACA;QACEmB,mBAAmBhC,kBAAkBiC,YAAY;IACnD;AAEJ"}