@aws/nx-plugin 1.0.0-rc.85 → 1.0.0-rc.87

package/migrations.json

@@ -77,6 +77,16 @@
       "description": "Add the Terraform checkov target and config, make bootstrap-destroy non-interactive, and declare required_version in the vended providers.tf",
       "implementation": "./src/migrations/latest/terraform-project-checkov-target-and-bootstrap-destroy/migration"
     },
+    "latest-add-destroy-sandbox-target": {
+      "version": "1.0.0-rc.87",
+      "description": "Add a destroy-sandbox target to CDK infrastructure projects which destroys the sandbox stage, and drop the --require-approval flag from cdk destroy, which has no such option",
+      "implementation": "./src/migrations/latest/add-destroy-sandbox-target/migration"
+    },
+    "latest-terraform-rdb-proxy-iam-connect-grant": {
+      "version": "1.0.0-rc.87",
+      "description": "Replace the MySQL RDS Proxy role's admin secret access with the rds-db:connect grant it needs for end-to-end IAM auth",
+      "implementation": "./src/migrations/latest/terraform-rdb-proxy-iam-connect-grant/migration"
+    },
     "v1.0.0-rc.50-0001-modernize-function-props-cast": {
       "version": "1.0.0-rc.50",
       "description": "Replace the legacy angle-bracket FunctionProps type assertion with the modern as syntax in generated API constructs",
@@ -218,7 +228,7 @@
       "implementation": "./src/migrations/v1.0.0-rc.75/0001-ts-agent-session-id-middleware-extraction/migration"
     },
     "sync-vended-versions": {
-      "version": "1.0.0-rc.85",
+      "version": "1.0.0-rc.87",
       "description": "Sync vended dependency versions and the tracked plugin version to those vended by this release",
       "implementation": "./src/utils/version-upgrade-migration/migration"
     }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@aws/nx-plugin",
-  "version": "1.0.0-rc.85",
+  "version": "1.0.0-rc.87",
   "repository": {
     "type": "git",
     "url": "https://github.com/awslabs/nx-plugin-for-aws.git",

package/src/infra/app/__snapshots__/generator.spec.ts.snap

@@ -98,7 +98,7 @@ exports[`infra generator > should configure project.json with correct targets >
   ],
   "executor": "nx:run-commands",
   "options": {
-    "command": "cdk destroy --require-approval=never",
+    "command": "cdk destroy",
     "cwd": "{projectRoot}",
   },
 }
@@ -202,14 +202,25 @@ exports[`infra generator > should configure project.json with correct targets >
       ],
       "executor": "nx:run-commands",
       "options": {
-        "command": "cdk destroy --require-approval=never",
+        "command": "cdk destroy",
         "cwd": "{projectRoot}",
       },
     },
     "destroy-ci": {
       "executor": "nx:run-commands",
       "options": {
-        "command": "cdk destroy --require-approval=never --app ../../dist/{projectRoot}/cdk.out",
+        "command": "cdk destroy --app ../../dist/{projectRoot}/cdk.out",
+        "cwd": "{projectRoot}",
+      },
+    },
+    "destroy-sandbox": {
+      "dependsOn": [
+        "^build",
+        "compile",
+      ],
+      "executor": "nx:run-commands",
+      "options": {
+        "command": "cdk destroy "proj-test-sandbox/*"",
         "cwd": "{projectRoot}",
       },
     },
@@ -797,14 +808,25 @@ exports[`infra generator > should handle custom project names correctly > custom
       ],
       "executor": "nx:run-commands",
       "options": {
-        "command": "cdk destroy --require-approval=never",
+        "command": "cdk destroy",
         "cwd": "{projectRoot}",
       },
     },
     "destroy-ci": {
       "executor": "nx:run-commands",
       "options": {
-        "command": "cdk destroy --require-approval=never --app ../../dist/{projectRoot}/cdk.out",
+        "command": "cdk destroy --app ../../dist/{projectRoot}/cdk.out",
+        "cwd": "{projectRoot}",
+      },
+    },
+    "destroy-sandbox": {
+      "dependsOn": [
+        "^build",
+        "compile",
+      ],
+      "executor": "nx:run-commands",
+      "options": {
+        "command": "cdk destroy "proj-custom-infra-sandbox/*"",
         "cwd": "{projectRoot}",
       },
     },
@@ -1046,9 +1068,10 @@ exports[`infra generator > with stageConfig > should snapshot generated scripts
 "/**
  * Builds the CDK command as an array of arguments for spawnSync.
  *
- * Defaults to --require-approval=never (standard for local dev deploys).
+ * Deploys default to --require-approval=never (standard for local dev deploys).
  * If the user explicitly passes --require-approval with any value, we
- * respect their choice and don't add the default.
+ * respect their choice and don't add the default. \`cdk destroy\` has no
+ * --require-approval option, so nothing is added for it.
  *
  * Pass --express to opt into CloudFormation express mode for faster
  * iteration; it is not enabled by default so deploys wait for full
@@ -1061,7 +1084,10 @@ export function buildCdkCommand(
   const hasRequireApproval = remainingArgs.some(
     (a) => a === '--require-approval' || a.startsWith('--require-approval='),
   );
-  const defaults = hasRequireApproval ? [] : ['--require-approval=never'];
+  const defaults =
+    action === 'destroy' || hasRequireApproval
+      ? []
+      : ['--require-approval=never'];
   return ['cdk', action, ...defaults, ...remainingArgs];
 }
 "

package/src/infra/app/files/app/README.md.template

@@ -50,6 +50,20 @@ Currently hot swapping supports Lambda functions, Step Functions state machines,
 
 Run `<%= pkgMgrCmd %> nx deploy-sandbox <%= fullyQualifiedName %> --hotswap`
 
+## Tear Down from AWS
+
+### Tear down your Sandbox Stage
+
+Run `<%= pkgMgrCmd %> nx destroy-sandbox <%= fullyQualifiedName %>`
+
+### Tear down all Stacks in a Stage
+
+Run `<%= pkgMgrCmd %> nx destroy <%= fullyQualifiedName %> "[stageName]/*"`
+
+### Tear down a single Stack
+
+Run `<%= pkgMgrCmd %> nx destroy <%= fullyQualifiedName %> [stageName]/[stackName]`
+
 ## Checkov Rule Suppressions
 
 There may be instances where you want to suppress certain rules on resources. You can do this in two ways:

package/src/infra/app/generator.js

@@ -206,14 +206,27 @@ export async function tsInfraGenerator(tree, schema) {
                 command: `tsx packages/common/scripts/src/infra/infra-destroy.ts ${libraryRoot}`
             }) : withCdkEnv({
                 cwd: '{projectRoot}',
-                command: 'cdk destroy --require-approval=never'
+                command: 'cdk destroy'
+            })
+        };
+        config.targets['destroy-sandbox'] = {
+            executor: 'nx:run-commands',
+            dependsOn: [
+                '^build',
+                'compile'
+            ],
+            options: stageConfig ? withCdkEnv({
+                command: `tsx packages/common/scripts/src/infra/infra-destroy.ts ${libraryRoot} ${sandboxStagePattern}`
+            }) : withCdkEnv({
+                cwd: '{projectRoot}',
+                command: `cdk destroy ${sandboxStagePattern}`
             })
         };
         config.targets['destroy-ci'] = {
             executor: 'nx:run-commands',
             options: withCdkEnv({
                 cwd: '{projectRoot}',
-                command: `cdk destroy --require-approval=never --app ${distDirFromProjectRoot}`
+                command: `cdk destroy --app ${distDirFromProjectRoot}`
             })
         };
         config.targets.cdk = {

package/src/infra/app/generator.js.map

@@ -1 +1 @@
-{"version":3,"sources":["../../../../../../packages/nx-plugin/src/infra/app/generator.ts"],"sourcesContent":["/**\n * Copyright Amazon.com, Inc. or its affiliates. All Rights Reserved.\n * SPDX-License-Identifier: Apache-2.0\n */\nimport {\n  type GeneratorCallback,\n  generateFiles,\n  joinPathFragments,\n  OverwriteStrategy,\n  type ProjectConfiguration,\n  readProjectConfiguration,\n  type Tree,\n  updateJson,\n} from '@nx/devkit';\nimport path from 'path';\nimport tsProjectGenerator, { getTsLibDetails } from '../../ts/lib/generator.js';\nimport { mergeTsReferences } from '../../ts/lib/ts-project-utils.js';\nimport { addTsDependencies } from '../../utils/add-dependencies.js';\nimport { resolveContainers } from '../../utils/containers.js';\nimport {\n  declareDependencies,\n  ownedElsewhere,\n} from '../../utils/declared-dependencies.js';\nimport { formatFilesInSubtree } from '../../utils/format.js';\nimport { installDependencies } from '../../utils/install.js';\nimport { addGeneratorMetricsIfApplicable } from '../../utils/metrics.js';\nimport { esmVars } from '../../utils/module-format.js';\nimport { kebabCase } from '../../utils/names.js';\nimport { getNpmScopePrefix } from '../../utils/npm-scope.js';\nimport {\n  addDependencyToTargetIfNotPresent,\n  addGeneratorMetadata,\n  getGeneratorInfo,\n  type NxGeneratorInfo,\n  projectExists,\n} from '../../utils/nx.js';\nimport { sortObjectKeys } from '../../utils/object.js';\nimport { getPackageManagerDisplayCommands } from '../../utils/pkg-manager.js';\nimport { uvxCommand } from '../../utils/py.js';\nimport {\n  SHARED_CONSTRUCTS_DEPENDENCIES,\n  sharedConstructsGenerator,\n} from '../../utils/shared-constructs.js';\nimport {\n  PACKAGES_DIR,\n  SHARED_CONSTRUCTS_DIR,\n  SHARED_INFRA_CONFIG_DIR,\n} from '../../utils/shared-constructs-constants.js';\nimport { sharedInfraConfigGenerator } from '../../utils/shared-infra-config.js';\nimport {\n  SHARED_INFRA_SCRIPTS_DEPENDENCIES,\n  sharedInfraScriptsGenerator,\n} from '../../utils/shared-infra-scripts.js';\nimport type { TsInfraGeneratorSchema } from './schema';\n\n// This generator records no metadata, so nothing a predicate could read: the\n// CDK app always needs the app libraries, and the CLI, bundler and tsx are\n// shared tooling.\nexport const DEPENDENCIES = declareDependencies()({\n  ts: [\n    { name: 'aws-cdk-lib' },\n    { name: 'constructs' },\n    { name: 'source-map-support' },\n    // The `aws-cdk` CLI, esbuild (CDK bundling) and tsx are shared tooling.\n    { name: 'aws-cdk', dev: true, root: true },\n    { name: 'esbuild', dev: true, root: true },\n    { name: 'tsx', dev: true, root: true },\n    ...ownedElsewhere(SHARED_CONSTRUCTS_DEPENDENCIES),\n    ...ownedElsewhere(SHARED_INFRA_SCRIPTS_DEPENDENCIES),\n  ],\n});\n\nexport const INFRA_APP_GENERATOR_INFO: NxGeneratorInfo = getGeneratorInfo(\n  import.meta.filename,\n);\n\nexport async function tsInfraGenerator(\n  tree: Tree,\n  schema: TsInfraGeneratorSchema,\n): Promise<GeneratorCallback> {\n  const lib = getTsLibDetails(tree, schema);\n\n  if (!projectExists(tree, lib.fullyQualifiedName)) {\n    await tsProjectGenerator(tree, {\n      ...schema,\n      preferInstallDependencies: false,\n    });\n  }\n\n  // CDK shells out to a container engine to build image assets. Default\n  // (docker) needs no env override; finch is set via CDK_DOCKER per\n  // https://docs.aws.amazon.com/cdk/v2/guide/build-containers.html#build-container-replace.\n  const containers = await resolveContainers(tree, 'inherit');\n  const cdkEnv: Record<string, string> | undefined =\n    containers === 'docker' ? undefined : { CDK_DOCKER: containers };\n  const withCdkEnv = <T extends Record<string, unknown>>(opts: T): T => {\n    if (!cdkEnv) return opts;\n    const existingEnv = (opts.env as Record<string, string> | undefined) ?? {};\n    return { ...opts, env: { ...existingEnv, ...cdkEnv } } as T;\n  };\n\n  // This generator IS the CDK infrastructure project, so the provider is fixed.\n  addGeneratorMetadata(tree, lib.fullyQualifiedName, INFRA_APP_GENERATOR_INFO, {\n    iac: 'cdk',\n  });\n\n  // Shared constructs always in CDK for typescript infra generator\n  await sharedConstructsGenerator(\n    tree,\n    {\n      iac: 'cdk',\n    },\n    DEPENDENCIES,\n  );\n\n  // Shared infra-config and infra-scripts packages (lazy creation, only when enabled)\n  const stageConfig = schema.stageConfig ?? false;\n  if (stageConfig) {\n    await sharedInfraConfigGenerator(tree);\n    await sharedInfraScriptsGenerator(tree, DEPENDENCIES);\n  }\n\n  const synthDirFromRoot = `/dist/${lib.dir}/cdk.out`;\n  const synthDirFromProject =\n    lib.dir\n      .split('/')\n      .map(() => '..')\n      .join('/') + `/dist/${lib.dir}/cdk.out`;\n  const distDirFromProjectRoot =\n    lib.dir\n      .split('/')\n      .map(() => '..')\n      .join('/') + '/dist/{projectRoot}/cdk.out';\n  const projectConfig = readProjectConfiguration(tree, lib.fullyQualifiedName);\n  const libraryRoot = projectConfig.root;\n  const npmScopePrefix = getNpmScopePrefix(tree);\n  const scopeAlias = npmScopePrefix;\n  const fullyQualifiedName = `${npmScopePrefix}${schema.name}`;\n  const namespace = kebabCase(fullyQualifiedName);\n  // The stage instantiated in main.ts. Quoted so the shell does not glob `*`.\n  const sandboxStagePattern = `\"${namespace}-sandbox/*\"`;\n  tree.delete(joinPathFragments(libraryRoot, 'src'));\n\n  generateFiles(\n    tree, // the virtual file system\n    joinPathFragments(import.meta.dirname, './files/app'), // path to the file templates\n    libraryRoot, // destination path of the files\n    {\n      synthDir: synthDirFromProject,\n      scopeAlias: scopeAlias,\n      namespace,\n      fullyQualifiedName,\n      pkgMgrCmd: getPackageManagerDisplayCommands().exec,\n      dir: lib.dir,\n      stageConfig,\n      ...schema,\n      ...esmVars(tree),\n    },\n    {\n      overwriteStrategy: OverwriteStrategy.Overwrite,\n    },\n  );\n\n  updateJson(\n    tree,\n    `${libraryRoot}/project.json`,\n    (config: ProjectConfiguration) => {\n      config.projectType = 'application';\n      addDependencyToTargetIfNotPresent(config, 'build', 'synth');\n      addDependencyToTargetIfNotPresent(config, 'build', 'checkov');\n      config.targets.compile.outputs = [\n        '{workspaceRoot}/dist/{projectRoot}/tsc',\n      ];\n      config.targets.synth = {\n        cache: true,\n        executor: 'nx:run-commands',\n        inputs: ['default'],\n        outputs: ['{workspaceRoot}/dist/{projectRoot}/cdk.out'],\n        dependsOn: ['^build', 'compile'], // compile clobbers dist directory, so ensure synth runs afterwards\n        options: withCdkEnv({\n          cwd: '{projectRoot}',\n          command: 'cdk synth',\n        }),\n      };\n      config.targets.checkov = {\n        cache: true,\n        executor: 'nx:run-commands',\n        inputs: ['{workspaceRoot}/dist/{projectRoot}/cdk.out'],\n        outputs: ['{workspaceRoot}/dist/{projectRoot}/checkov'],\n        dependsOn: ['synth'],\n        options: {\n          command: uvxCommand(\n            'checkov',\n            '--config-file {projectRoot}/checkov.yml --directory dist/{projectRoot}/cdk.out --framework cloudformation',\n          ),\n        },\n      };\n      config.targets.deploy = {\n        executor: 'nx:run-commands',\n        dependsOn: ['^build', 'compile'],\n        options: stageConfig\n          ? withCdkEnv({\n              command: `tsx packages/common/scripts/src/infra/infra-deploy.ts ${libraryRoot}`,\n            })\n          : withCdkEnv({\n              cwd: '{projectRoot}',\n              command: 'cdk deploy --require-approval=never',\n            }),\n      };\n      config.targets['deploy-sandbox'] = {\n        executor: 'nx:run-commands',\n        dependsOn: ['^build', 'compile'],\n        options: stageConfig\n          ? withCdkEnv({\n              command: `tsx packages/common/scripts/src/infra/infra-deploy.ts ${libraryRoot} ${sandboxStagePattern}`,\n            })\n          : withCdkEnv({\n              cwd: '{projectRoot}',\n              command: `cdk deploy --require-approval=never ${sandboxStagePattern}`,\n            }),\n      };\n      config.targets['deploy-ci'] = {\n        executor: 'nx:run-commands',\n        options: withCdkEnv({\n          cwd: '{projectRoot}',\n          command: `cdk deploy --require-approval=never --app ${distDirFromProjectRoot}`,\n        }),\n      };\n      config.targets.destroy = {\n        executor: 'nx:run-commands',\n        dependsOn: ['^build', 'compile'],\n        options: stageConfig\n          ? withCdkEnv({\n              command: `tsx packages/common/scripts/src/infra/infra-destroy.ts ${libraryRoot}`,\n            })\n          : withCdkEnv({\n              cwd: '{projectRoot}',\n              command: 'cdk destroy --require-approval=never',\n            }),\n      };\n      config.targets['destroy-ci'] = {\n        executor: 'nx:run-commands',\n        options: withCdkEnv({\n          cwd: '{projectRoot}',\n          command: `cdk destroy --require-approval=never --app ${distDirFromProjectRoot}`,\n        }),\n      };\n      config.targets.cdk = {\n        executor: 'nx:run-commands',\n        options: withCdkEnv({\n          cwd: '{projectRoot}',\n          command: 'cdk',\n        }),\n      };\n      config.targets.bootstrap = {\n        executor: 'nx:run-commands',\n        options: withCdkEnv({\n          cwd: '{projectRoot}',\n          command: 'cdk bootstrap',\n        }),\n      };\n      config.targets = sortObjectKeys(config.targets);\n      return config;\n    },\n  );\n\n  addTsDependencies(tree, DEPENDENCIES, { projectRoot: libraryRoot });\n\n  updateJson(tree, `${libraryRoot}/tsconfig.lib.json`, (tsConfig) => ({\n    ...tsConfig,\n    references: mergeTsReferences(tsConfig.references, [\n      {\n        path: `${path.relative(\n          libraryRoot,\n          `${tree.root}/${PACKAGES_DIR}`,\n        )}/${SHARED_CONSTRUCTS_DIR}/tsconfig.lib.json`,\n      },\n      ...(stageConfig\n        ? [\n            {\n              path: `${path.relative(\n                libraryRoot,\n                `${tree.root}/${PACKAGES_DIR}`,\n              )}/${SHARED_INFRA_CONFIG_DIR}/tsconfig.json`,\n            },\n          ]\n        : []),\n    ]),\n  }));\n\n  await addGeneratorMetricsIfApplicable(tree, [INFRA_APP_GENERATOR_INFO]);\n\n  await formatFilesInSubtree(tree);\n  return () =>\n    installDependencies(tree, schema.preferInstallDependencies, {\n      languages: ['typescript'],\n    });\n}\nexport default tsInfraGenerator;\n"],"names":["generateFiles","joinPathFragments","OverwriteStrategy","readProjectConfiguration","updateJson","path","tsProjectGenerator","getTsLibDetails","mergeTsReferences","addTsDependencies","resolveContainers","declareDependencies","ownedElsewhere","formatFilesInSubtree","installDependencies","addGeneratorMetricsIfApplicable","esmVars","kebabCase","getNpmScopePrefix","addDependencyToTargetIfNotPresent","addGeneratorMetadata","getGeneratorInfo","projectExists","sortObjectKeys","getPackageManagerDisplayCommands","uvxCommand","SHARED_CONSTRUCTS_DEPENDENCIES","sharedConstructsGenerator","PACKAGES_DIR","SHARED_CONSTRUCTS_DIR","SHARED_INFRA_CONFIG_DIR","sharedInfraConfigGenerator","SHARED_INFRA_SCRIPTS_DEPENDENCIES","sharedInfraScriptsGenerator","DEPENDENCIES","ts","name","dev","root","INFRA_APP_GENERATOR_INFO","filename","tsInfraGenerator","tree","schema","lib","fullyQualifiedName","preferInstallDependencies","containers","cdkEnv","undefined","CDK_DOCKER","withCdkEnv","opts","existingEnv","env","iac","stageConfig","synthDirFromRoot","dir","synthDirFromProject","split","map","join","distDirFromProjectRoot","projectConfig","libraryRoot","npmScopePrefix","scopeAlias","namespace","sandboxStagePattern","delete","dirname","synthDir","pkgMgrCmd","exec","overwriteStrategy","Overwrite","config","projectType","targets","compile","outputs","synth","cache","executor","inputs","dependsOn","options","cwd","command","checkov","deploy","destroy","cdk","bootstrap","projectRoot","tsConfig","references","relative","languages"],"mappings":"AAAA;;;CAGC,GACD,SAEEA,aAAa,EACbC,iBAAiB,EACjBC,iBAAiB,EAEjBC,wBAAwB,EAExBC,UAAU,QACL,aAAa;AACpB,OAAOC,UAAU,OAAO;AACxB,OAAOC,sBAAsBC,eAAe,QAAQ,4BAA4B;AAChF,SAASC,iBAAiB,QAAQ,mCAAmC;AACrE,SAASC,iBAAiB,QAAQ,kCAAkC;AACpE,SAASC,iBAAiB,QAAQ,4BAA4B;AAC9D,SACEC,mBAAmB,EACnBC,cAAc,QACT,uCAAuC;AAC9C,SAASC,oBAAoB,QAAQ,wBAAwB;AAC7D,SAASC,mBAAmB,QAAQ,yBAAyB;AAC7D,SAASC,+BAA+B,QAAQ,yBAAyB;AACzE,SAASC,OAAO,QAAQ,+BAA+B;AACvD,SAASC,SAAS,QAAQ,uBAAuB;AACjD,SAASC,iBAAiB,QAAQ,2BAA2B;AAC7D,SACEC,iCAAiC,EACjCC,oBAAoB,EACpBC,gBAAgB,EAEhBC,aAAa,QACR,oBAAoB;AAC3B,SAASC,cAAc,QAAQ,wBAAwB;AACvD,SAASC,gCAAgC,QAAQ,6BAA6B;AAC9E,SAASC,UAAU,QAAQ,oBAAoB;AAC/C,SACEC,8BAA8B,EAC9BC,yBAAyB,QACpB,mCAAmC;AAC1C,SACEC,YAAY,EACZC,qBAAqB,EACrBC,uBAAuB,QAClB,6CAA6C;AACpD,SAASC,0BAA0B,QAAQ,qCAAqC;AAChF,SACEC,iCAAiC,EACjCC,2BAA2B,QACtB,sCAAsC;AAG7C,6EAA6E;AAC7E,2EAA2E;AAC3E,kBAAkB;AAClB,OAAO,MAAMC,eAAevB,sBAAsB;IAChDwB,IAAI;QACF;YAAEC,MAAM;QAAc;QACtB;YAAEA,MAAM;QAAa;QACrB;YAAEA,MAAM;QAAqB;QAC7B,wEAAwE;QACxE;YAAEA,MAAM;YAAWC,KAAK;YAAMC,MAAM;QAAK;QACzC;YAAEF,MAAM;YAAWC,KAAK;YAAMC,MAAM;QAAK;QACzC;YAAEF,MAAM;YAAOC,KAAK;YAAMC,MAAM;QAAK;WAClC1B,eAAec;WACfd,eAAeoB;KACnB;AACH,GAAG;AAEH,OAAO,MAAMO,2BAA4ClB,iBACvD,YAAYmB,QAAQ,EACpB;AAEF,OAAO,eAAeC,iBACpBC,IAAU,EACVC,MAA8B;IAE9B,MAAMC,MAAMrC,gBAAgBmC,MAAMC;IAElC,IAAI,CAACrB,cAAcoB,MAAME,IAAIC,kBAAkB,GAAG;QAChD,MAAMvC,mBAAmBoC,MAAM;YAC7B,GAAGC,MAAM;YACTG,2BAA2B;QAC7B;IACF;IAEA,sEAAsE;IACtE,kEAAkE;IAClE,0FAA0F;IAC1F,MAAMC,aAAa,MAAMrC,kBAAkBgC,MAAM;IACjD,MAAMM,SACJD,eAAe,WAAWE,YAAY;QAAEC,YAAYH;IAAW;IACjE,MAAMI,aAAa,CAAoCC;QACrD,IAAI,CAACJ,QAAQ,OAAOI;QACpB,MAAMC,cAAc,AAACD,KAAKE,GAAG,IAA2C,CAAC;QACzE,OAAO;YAAE,GAAGF,IAAI;YAAEE,KAAK;gBAAE,GAAGD,WAAW;gBAAE,GAAGL,MAAM;YAAC;QAAE;IACvD;IAEA,8EAA8E;IAC9E5B,qBAAqBsB,MAAME,IAAIC,kBAAkB,EAAEN,0BAA0B;QAC3EgB,KAAK;IACP;IAEA,iEAAiE;IACjE,MAAM5B,0BACJe,MACA;QACEa,KAAK;IACP,GACArB;IAGF,oFAAoF;IACpF,MAAMsB,cAAcb,OAAOa,WAAW,IAAI;IAC1C,IAAIA,aAAa;QACf,MAAMzB,2BAA2BW;QACjC,MAAMT,4BAA4BS,MAAMR;IAC1C;IAEA,MAAMuB,mBAAmB,CAAC,MAAM,EAAEb,IAAIc,GAAG,CAAC,QAAQ,CAAC;IACnD,MAAMC,sBACJf,IAAIc,GAAG,CACJE,KAAK,CAAC,KACNC,GAAG,CAAC,IAAM,MACVC,IAAI,CAAC,OAAO,CAAC,MAAM,EAAElB,IAAIc,GAAG,CAAC,QAAQ,CAAC;IAC3C,MAAMK,yBACJnB,IAAIc,GAAG,CACJE,KAAK,CAAC,KACNC,GAAG,CAAC,IAAM,MACVC,IAAI,CAAC,OAAO;IACjB,MAAME,gBAAgB7D,yBAAyBuC,MAAME,IAAIC,kBAAkB;IAC3E,MAAMoB,cAAcD,cAAc1B,IAAI;IACtC,MAAM4B,iBAAiBhD,kBAAkBwB;IACzC,MAAMyB,aAAaD;IACnB,MAAMrB,qBAAqB,GAAGqB,iBAAiBvB,OAAOP,IAAI,EAAE;IAC5D,MAAMgC,YAAYnD,UAAU4B;IAC5B,4EAA4E;IAC5E,MAAMwB,sBAAsB,CAAC,CAAC,EAAED,UAAU,WAAW,CAAC;IACtD1B,KAAK4B,MAAM,CAACrE,kBAAkBgE,aAAa;IAE3CjE,cACE0C,MACAzC,kBAAkB,YAAYsE,OAAO,EAAE,gBACvCN,aACA;QACEO,UAAUb;QACVQ,YAAYA;QACZC;QACAvB;QACA4B,WAAWjD,mCAAmCkD,IAAI;QAClDhB,KAAKd,IAAIc,GAAG;QACZF;QACA,GAAGb,MAAM;QACT,GAAG3B,QAAQ0B,KAAK;IAClB,GACA;QACEiC,mBAAmBzE,kBAAkB0E,SAAS;IAChD;IAGFxE,WACEsC,MACA,GAAGuB,YAAY,aAAa,CAAC,EAC7B,CAACY;QACCA,OAAOC,WAAW,GAAG;QACrB3D,kCAAkC0D,QAAQ,SAAS;QACnD1D,kCAAkC0D,QAAQ,SAAS;QACnDA,OAAOE,OAAO,CAACC,OAAO,CAACC,OAAO,GAAG;YAC/B;SACD;QACDJ,OAAOE,OAAO,CAACG,KAAK,GAAG;YACrBC,OAAO;YACPC,UAAU;YACVC,QAAQ;gBAAC;aAAU;YACnBJ,SAAS;gBAAC;aAA6C;YACvDK,WAAW;gBAAC;gBAAU;aAAU;YAChCC,SAASpC,WAAW;gBAClBqC,KAAK;gBACLC,SAAS;YACX;QACF;QACAZ,OAAOE,OAAO,CAACW,OAAO,GAAG;YACvBP,OAAO;YACPC,UAAU;YACVC,QAAQ;gBAAC;aAA6C;YACtDJ,SAAS;gBAAC;aAA6C;YACvDK,WAAW;gBAAC;aAAQ;YACpBC,SAAS;gBACPE,SAAShE,WACP,WACA;YAEJ;QACF;QACAoD,OAAOE,OAAO,CAACY,MAAM,GAAG;YACtBP,UAAU;YACVE,WAAW;gBAAC;gBAAU;aAAU;YAChCC,SAAS/B,cACLL,WAAW;gBACTsC,SAAS,CAAC,sDAAsD,EAAExB,aAAa;YACjF,KACAd,WAAW;gBACTqC,KAAK;gBACLC,SAAS;YACX;QACN;QACAZ,OAAOE,OAAO,CAAC,iBAAiB,GAAG;YACjCK,UAAU;YACVE,WAAW;gBAAC;gBAAU;aAAU;YAChCC,SAAS/B,cACLL,WAAW;gBACTsC,SAAS,CAAC,sDAAsD,EAAExB,YAAY,CAAC,EAAEI,qBAAqB;YACxG,KACAlB,WAAW;gBACTqC,KAAK;gBACLC,SAAS,CAAC,oCAAoC,EAAEpB,qBAAqB;YACvE;QACN;QACAQ,OAAOE,OAAO,CAAC,YAAY,GAAG;YAC5BK,UAAU;YACVG,SAASpC,WAAW;gBAClBqC,KAAK;gBACLC,SAAS,CAAC,0CAA0C,EAAE1B,wBAAwB;YAChF;QACF;QACAc,OAAOE,OAAO,CAACa,OAAO,GAAG;YACvBR,UAAU;YACVE,WAAW;gBAAC;gBAAU;aAAU;YAChCC,SAAS/B,cACLL,WAAW;gBACTsC,SAAS,CAAC,uDAAuD,EAAExB,aAAa;YAClF,KACAd,WAAW;gBACTqC,KAAK;gBACLC,SAAS;YACX;QACN;QACAZ,OAAOE,OAAO,CAAC,aAAa,GAAG;YAC7BK,UAAU;YACVG,SAASpC,WAAW;gBAClBqC,KAAK;gBACLC,SAAS,CAAC,2CAA2C,EAAE1B,wBAAwB;YACjF;QACF;QACAc,OAAOE,OAAO,CAACc,GAAG,GAAG;YACnBT,UAAU;YACVG,SAASpC,WAAW;gBAClBqC,KAAK;gBACLC,SAAS;YACX;QACF;QACAZ,OAAOE,OAAO,CAACe,SAAS,GAAG;YACzBV,UAAU;YACVG,SAASpC,WAAW;gBAClBqC,KAAK;gBACLC,SAAS;YACX;QACF;QACAZ,OAAOE,OAAO,GAAGxD,eAAesD,OAAOE,OAAO;QAC9C,OAAOF;IACT;IAGFpE,kBAAkBiC,MAAMR,cAAc;QAAE6D,aAAa9B;IAAY;IAEjE7D,WAAWsC,MAAM,GAAGuB,YAAY,kBAAkB,CAAC,EAAE,CAAC+B,WAAc,CAAA;YAClE,GAAGA,QAAQ;YACXC,YAAYzF,kBAAkBwF,SAASC,UAAU,EAAE;gBACjD;oBACE5F,MAAM,GAAGA,KAAK6F,QAAQ,CACpBjC,aACA,GAAGvB,KAAKJ,IAAI,CAAC,CAAC,EAAEV,cAAc,EAC9B,CAAC,EAAEC,sBAAsB,kBAAkB,CAAC;gBAChD;mBACI2B,cACA;oBACE;wBACEnD,MAAM,GAAGA,KAAK6F,QAAQ,CACpBjC,aACA,GAAGvB,KAAKJ,IAAI,CAAC,CAAC,EAAEV,cAAc,EAC9B,CAAC,EAAEE,wBAAwB,cAAc,CAAC;oBAC9C;iBACD,GACD,EAAE;aACP;QACH,CAAA;IAEA,MAAMf,gCAAgC2B,MAAM;QAACH;KAAyB;IAEtE,MAAM1B,qBAAqB6B;IAC3B,OAAO,IACL5B,oBAAoB4B,MAAMC,OAAOG,yBAAyB,EAAE;YAC1DqD,WAAW;gBAAC;aAAa;QAC3B;AACJ;AACA,eAAe1D,iBAAiB"}
+{"version":3,"sources":["../../../../../../packages/nx-plugin/src/infra/app/generator.ts"],"sourcesContent":["/**\n * Copyright Amazon.com, Inc. or its affiliates. All Rights Reserved.\n * SPDX-License-Identifier: Apache-2.0\n */\nimport {\n  type GeneratorCallback,\n  generateFiles,\n  joinPathFragments,\n  OverwriteStrategy,\n  type ProjectConfiguration,\n  readProjectConfiguration,\n  type Tree,\n  updateJson,\n} from '@nx/devkit';\nimport path from 'path';\nimport tsProjectGenerator, { getTsLibDetails } from '../../ts/lib/generator.js';\nimport { mergeTsReferences } from '../../ts/lib/ts-project-utils.js';\nimport { addTsDependencies } from '../../utils/add-dependencies.js';\nimport { resolveContainers } from '../../utils/containers.js';\nimport {\n  declareDependencies,\n  ownedElsewhere,\n} from '../../utils/declared-dependencies.js';\nimport { formatFilesInSubtree } from '../../utils/format.js';\nimport { installDependencies } from '../../utils/install.js';\nimport { addGeneratorMetricsIfApplicable } from '../../utils/metrics.js';\nimport { esmVars } from '../../utils/module-format.js';\nimport { kebabCase } from '../../utils/names.js';\nimport { getNpmScopePrefix } from '../../utils/npm-scope.js';\nimport {\n  addDependencyToTargetIfNotPresent,\n  addGeneratorMetadata,\n  getGeneratorInfo,\n  type NxGeneratorInfo,\n  projectExists,\n} from '../../utils/nx.js';\nimport { sortObjectKeys } from '../../utils/object.js';\nimport { getPackageManagerDisplayCommands } from '../../utils/pkg-manager.js';\nimport { uvxCommand } from '../../utils/py.js';\nimport {\n  SHARED_CONSTRUCTS_DEPENDENCIES,\n  sharedConstructsGenerator,\n} from '../../utils/shared-constructs.js';\nimport {\n  PACKAGES_DIR,\n  SHARED_CONSTRUCTS_DIR,\n  SHARED_INFRA_CONFIG_DIR,\n} from '../../utils/shared-constructs-constants.js';\nimport { sharedInfraConfigGenerator } from '../../utils/shared-infra-config.js';\nimport {\n  SHARED_INFRA_SCRIPTS_DEPENDENCIES,\n  sharedInfraScriptsGenerator,\n} from '../../utils/shared-infra-scripts.js';\nimport type { TsInfraGeneratorSchema } from './schema';\n\n// This generator records no metadata, so nothing a predicate could read: the\n// CDK app always needs the app libraries, and the CLI, bundler and tsx are\n// shared tooling.\nexport const DEPENDENCIES = declareDependencies()({\n  ts: [\n    { name: 'aws-cdk-lib' },\n    { name: 'constructs' },\n    { name: 'source-map-support' },\n    // The `aws-cdk` CLI, esbuild (CDK bundling) and tsx are shared tooling.\n    { name: 'aws-cdk', dev: true, root: true },\n    { name: 'esbuild', dev: true, root: true },\n    { name: 'tsx', dev: true, root: true },\n    ...ownedElsewhere(SHARED_CONSTRUCTS_DEPENDENCIES),\n    ...ownedElsewhere(SHARED_INFRA_SCRIPTS_DEPENDENCIES),\n  ],\n});\n\nexport const INFRA_APP_GENERATOR_INFO: NxGeneratorInfo = getGeneratorInfo(\n  import.meta.filename,\n);\n\nexport async function tsInfraGenerator(\n  tree: Tree,\n  schema: TsInfraGeneratorSchema,\n): Promise<GeneratorCallback> {\n  const lib = getTsLibDetails(tree, schema);\n\n  if (!projectExists(tree, lib.fullyQualifiedName)) {\n    await tsProjectGenerator(tree, {\n      ...schema,\n      preferInstallDependencies: false,\n    });\n  }\n\n  // CDK shells out to a container engine to build image assets. Default\n  // (docker) needs no env override; finch is set via CDK_DOCKER per\n  // https://docs.aws.amazon.com/cdk/v2/guide/build-containers.html#build-container-replace.\n  const containers = await resolveContainers(tree, 'inherit');\n  const cdkEnv: Record<string, string> | undefined =\n    containers === 'docker' ? undefined : { CDK_DOCKER: containers };\n  const withCdkEnv = <T extends Record<string, unknown>>(opts: T): T => {\n    if (!cdkEnv) return opts;\n    const existingEnv = (opts.env as Record<string, string> | undefined) ?? {};\n    return { ...opts, env: { ...existingEnv, ...cdkEnv } } as T;\n  };\n\n  // This generator IS the CDK infrastructure project, so the provider is fixed.\n  addGeneratorMetadata(tree, lib.fullyQualifiedName, INFRA_APP_GENERATOR_INFO, {\n    iac: 'cdk',\n  });\n\n  // Shared constructs always in CDK for typescript infra generator\n  await sharedConstructsGenerator(\n    tree,\n    {\n      iac: 'cdk',\n    },\n    DEPENDENCIES,\n  );\n\n  // Shared infra-config and infra-scripts packages (lazy creation, only when enabled)\n  const stageConfig = schema.stageConfig ?? false;\n  if (stageConfig) {\n    await sharedInfraConfigGenerator(tree);\n    await sharedInfraScriptsGenerator(tree, DEPENDENCIES);\n  }\n\n  const synthDirFromRoot = `/dist/${lib.dir}/cdk.out`;\n  const synthDirFromProject =\n    lib.dir\n      .split('/')\n      .map(() => '..')\n      .join('/') + `/dist/${lib.dir}/cdk.out`;\n  const distDirFromProjectRoot =\n    lib.dir\n      .split('/')\n      .map(() => '..')\n      .join('/') + '/dist/{projectRoot}/cdk.out';\n  const projectConfig = readProjectConfiguration(tree, lib.fullyQualifiedName);\n  const libraryRoot = projectConfig.root;\n  const npmScopePrefix = getNpmScopePrefix(tree);\n  const scopeAlias = npmScopePrefix;\n  const fullyQualifiedName = `${npmScopePrefix}${schema.name}`;\n  const namespace = kebabCase(fullyQualifiedName);\n  // The stage instantiated in main.ts. Quoted so the shell does not glob `*`.\n  const sandboxStagePattern = `\"${namespace}-sandbox/*\"`;\n  tree.delete(joinPathFragments(libraryRoot, 'src'));\n\n  generateFiles(\n    tree, // the virtual file system\n    joinPathFragments(import.meta.dirname, './files/app'), // path to the file templates\n    libraryRoot, // destination path of the files\n    {\n      synthDir: synthDirFromProject,\n      scopeAlias: scopeAlias,\n      namespace,\n      fullyQualifiedName,\n      pkgMgrCmd: getPackageManagerDisplayCommands().exec,\n      dir: lib.dir,\n      stageConfig,\n      ...schema,\n      ...esmVars(tree),\n    },\n    {\n      overwriteStrategy: OverwriteStrategy.Overwrite,\n    },\n  );\n\n  updateJson(\n    tree,\n    `${libraryRoot}/project.json`,\n    (config: ProjectConfiguration) => {\n      config.projectType = 'application';\n      addDependencyToTargetIfNotPresent(config, 'build', 'synth');\n      addDependencyToTargetIfNotPresent(config, 'build', 'checkov');\n      config.targets.compile.outputs = [\n        '{workspaceRoot}/dist/{projectRoot}/tsc',\n      ];\n      config.targets.synth = {\n        cache: true,\n        executor: 'nx:run-commands',\n        inputs: ['default'],\n        outputs: ['{workspaceRoot}/dist/{projectRoot}/cdk.out'],\n        dependsOn: ['^build', 'compile'], // compile clobbers dist directory, so ensure synth runs afterwards\n        options: withCdkEnv({\n          cwd: '{projectRoot}',\n          command: 'cdk synth',\n        }),\n      };\n      config.targets.checkov = {\n        cache: true,\n        executor: 'nx:run-commands',\n        inputs: ['{workspaceRoot}/dist/{projectRoot}/cdk.out'],\n        outputs: ['{workspaceRoot}/dist/{projectRoot}/checkov'],\n        dependsOn: ['synth'],\n        options: {\n          command: uvxCommand(\n            'checkov',\n            '--config-file {projectRoot}/checkov.yml --directory dist/{projectRoot}/cdk.out --framework cloudformation',\n          ),\n        },\n      };\n      config.targets.deploy = {\n        executor: 'nx:run-commands',\n        dependsOn: ['^build', 'compile'],\n        options: stageConfig\n          ? withCdkEnv({\n              command: `tsx packages/common/scripts/src/infra/infra-deploy.ts ${libraryRoot}`,\n            })\n          : withCdkEnv({\n              cwd: '{projectRoot}',\n              command: 'cdk deploy --require-approval=never',\n            }),\n      };\n      config.targets['deploy-sandbox'] = {\n        executor: 'nx:run-commands',\n        dependsOn: ['^build', 'compile'],\n        options: stageConfig\n          ? withCdkEnv({\n              command: `tsx packages/common/scripts/src/infra/infra-deploy.ts ${libraryRoot} ${sandboxStagePattern}`,\n            })\n          : withCdkEnv({\n              cwd: '{projectRoot}',\n              command: `cdk deploy --require-approval=never ${sandboxStagePattern}`,\n            }),\n      };\n      config.targets['deploy-ci'] = {\n        executor: 'nx:run-commands',\n        options: withCdkEnv({\n          cwd: '{projectRoot}',\n          command: `cdk deploy --require-approval=never --app ${distDirFromProjectRoot}`,\n        }),\n      };\n      config.targets.destroy = {\n        executor: 'nx:run-commands',\n        dependsOn: ['^build', 'compile'],\n        options: stageConfig\n          ? withCdkEnv({\n              command: `tsx packages/common/scripts/src/infra/infra-destroy.ts ${libraryRoot}`,\n            })\n          : withCdkEnv({\n              cwd: '{projectRoot}',\n              command: 'cdk destroy',\n            }),\n      };\n      config.targets['destroy-sandbox'] = {\n        executor: 'nx:run-commands',\n        dependsOn: ['^build', 'compile'],\n        options: stageConfig\n          ? withCdkEnv({\n              command: `tsx packages/common/scripts/src/infra/infra-destroy.ts ${libraryRoot} ${sandboxStagePattern}`,\n            })\n          : withCdkEnv({\n              cwd: '{projectRoot}',\n              command: `cdk destroy ${sandboxStagePattern}`,\n            }),\n      };\n      config.targets['destroy-ci'] = {\n        executor: 'nx:run-commands',\n        options: withCdkEnv({\n          cwd: '{projectRoot}',\n          command: `cdk destroy --app ${distDirFromProjectRoot}`,\n        }),\n      };\n      config.targets.cdk = {\n        executor: 'nx:run-commands',\n        options: withCdkEnv({\n          cwd: '{projectRoot}',\n          command: 'cdk',\n        }),\n      };\n      config.targets.bootstrap = {\n        executor: 'nx:run-commands',\n        options: withCdkEnv({\n          cwd: '{projectRoot}',\n          command: 'cdk bootstrap',\n        }),\n      };\n      config.targets = sortObjectKeys(config.targets);\n      return config;\n    },\n  );\n\n  addTsDependencies(tree, DEPENDENCIES, { projectRoot: libraryRoot });\n\n  updateJson(tree, `${libraryRoot}/tsconfig.lib.json`, (tsConfig) => ({\n    ...tsConfig,\n    references: mergeTsReferences(tsConfig.references, [\n      {\n        path: `${path.relative(\n          libraryRoot,\n          `${tree.root}/${PACKAGES_DIR}`,\n        )}/${SHARED_CONSTRUCTS_DIR}/tsconfig.lib.json`,\n      },\n      ...(stageConfig\n        ? [\n            {\n              path: `${path.relative(\n                libraryRoot,\n                `${tree.root}/${PACKAGES_DIR}`,\n              )}/${SHARED_INFRA_CONFIG_DIR}/tsconfig.json`,\n            },\n          ]\n        : []),\n    ]),\n  }));\n\n  await addGeneratorMetricsIfApplicable(tree, [INFRA_APP_GENERATOR_INFO]);\n\n  await formatFilesInSubtree(tree);\n  return () =>\n    installDependencies(tree, schema.preferInstallDependencies, {\n      languages: ['typescript'],\n    });\n}\nexport default tsInfraGenerator;\n"],"names":["generateFiles","joinPathFragments","OverwriteStrategy","readProjectConfiguration","updateJson","path","tsProjectGenerator","getTsLibDetails","mergeTsReferences","addTsDependencies","resolveContainers","declareDependencies","ownedElsewhere","formatFilesInSubtree","installDependencies","addGeneratorMetricsIfApplicable","esmVars","kebabCase","getNpmScopePrefix","addDependencyToTargetIfNotPresent","addGeneratorMetadata","getGeneratorInfo","projectExists","sortObjectKeys","getPackageManagerDisplayCommands","uvxCommand","SHARED_CONSTRUCTS_DEPENDENCIES","sharedConstructsGenerator","PACKAGES_DIR","SHARED_CONSTRUCTS_DIR","SHARED_INFRA_CONFIG_DIR","sharedInfraConfigGenerator","SHARED_INFRA_SCRIPTS_DEPENDENCIES","sharedInfraScriptsGenerator","DEPENDENCIES","ts","name","dev","root","INFRA_APP_GENERATOR_INFO","filename","tsInfraGenerator","tree","schema","lib","fullyQualifiedName","preferInstallDependencies","containers","cdkEnv","undefined","CDK_DOCKER","withCdkEnv","opts","existingEnv","env","iac","stageConfig","synthDirFromRoot","dir","synthDirFromProject","split","map","join","distDirFromProjectRoot","projectConfig","libraryRoot","npmScopePrefix","scopeAlias","namespace","sandboxStagePattern","delete","dirname","synthDir","pkgMgrCmd","exec","overwriteStrategy","Overwrite","config","projectType","targets","compile","outputs","synth","cache","executor","inputs","dependsOn","options","cwd","command","checkov","deploy","destroy","cdk","bootstrap","projectRoot","tsConfig","references","relative","languages"],"mappings":"AAAA;;;CAGC,GACD,SAEEA,aAAa,EACbC,iBAAiB,EACjBC,iBAAiB,EAEjBC,wBAAwB,EAExBC,UAAU,QACL,aAAa;AACpB,OAAOC,UAAU,OAAO;AACxB,OAAOC,sBAAsBC,eAAe,QAAQ,4BAA4B;AAChF,SAASC,iBAAiB,QAAQ,mCAAmC;AACrE,SAASC,iBAAiB,QAAQ,kCAAkC;AACpE,SAASC,iBAAiB,QAAQ,4BAA4B;AAC9D,SACEC,mBAAmB,EACnBC,cAAc,QACT,uCAAuC;AAC9C,SAASC,oBAAoB,QAAQ,wBAAwB;AAC7D,SAASC,mBAAmB,QAAQ,yBAAyB;AAC7D,SAASC,+BAA+B,QAAQ,yBAAyB;AACzE,SAASC,OAAO,QAAQ,+BAA+B;AACvD,SAASC,SAAS,QAAQ,uBAAuB;AACjD,SAASC,iBAAiB,QAAQ,2BAA2B;AAC7D,SACEC,iCAAiC,EACjCC,oBAAoB,EACpBC,gBAAgB,EAEhBC,aAAa,QACR,oBAAoB;AAC3B,SAASC,cAAc,QAAQ,wBAAwB;AACvD,SAASC,gCAAgC,QAAQ,6BAA6B;AAC9E,SAASC,UAAU,QAAQ,oBAAoB;AAC/C,SACEC,8BAA8B,EAC9BC,yBAAyB,QACpB,mCAAmC;AAC1C,SACEC,YAAY,EACZC,qBAAqB,EACrBC,uBAAuB,QAClB,6CAA6C;AACpD,SAASC,0BAA0B,QAAQ,qCAAqC;AAChF,SACEC,iCAAiC,EACjCC,2BAA2B,QACtB,sCAAsC;AAG7C,6EAA6E;AAC7E,2EAA2E;AAC3E,kBAAkB;AAClB,OAAO,MAAMC,eAAevB,sBAAsB;IAChDwB,IAAI;QACF;YAAEC,MAAM;QAAc;QACtB;YAAEA,MAAM;QAAa;QACrB;YAAEA,MAAM;QAAqB;QAC7B,wEAAwE;QACxE;YAAEA,MAAM;YAAWC,KAAK;YAAMC,MAAM;QAAK;QACzC;YAAEF,MAAM;YAAWC,KAAK;YAAMC,MAAM;QAAK;QACzC;YAAEF,MAAM;YAAOC,KAAK;YAAMC,MAAM;QAAK;WAClC1B,eAAec;WACfd,eAAeoB;KACnB;AACH,GAAG;AAEH,OAAO,MAAMO,2BAA4ClB,iBACvD,YAAYmB,QAAQ,EACpB;AAEF,OAAO,eAAeC,iBACpBC,IAAU,EACVC,MAA8B;IAE9B,MAAMC,MAAMrC,gBAAgBmC,MAAMC;IAElC,IAAI,CAACrB,cAAcoB,MAAME,IAAIC,kBAAkB,GAAG;QAChD,MAAMvC,mBAAmBoC,MAAM;YAC7B,GAAGC,MAAM;YACTG,2BAA2B;QAC7B;IACF;IAEA,sEAAsE;IACtE,kEAAkE;IAClE,0FAA0F;IAC1F,MAAMC,aAAa,MAAMrC,kBAAkBgC,MAAM;IACjD,MAAMM,SACJD,eAAe,WAAWE,YAAY;QAAEC,YAAYH;IAAW;IACjE,MAAMI,aAAa,CAAoCC;QACrD,IAAI,CAACJ,QAAQ,OAAOI;QACpB,MAAMC,cAAc,AAACD,KAAKE,GAAG,IAA2C,CAAC;QACzE,OAAO;YAAE,GAAGF,IAAI;YAAEE,KAAK;gBAAE,GAAGD,WAAW;gBAAE,GAAGL,MAAM;YAAC;QAAE;IACvD;IAEA,8EAA8E;IAC9E5B,qBAAqBsB,MAAME,IAAIC,kBAAkB,EAAEN,0BAA0B;QAC3EgB,KAAK;IACP;IAEA,iEAAiE;IACjE,MAAM5B,0BACJe,MACA;QACEa,KAAK;IACP,GACArB;IAGF,oFAAoF;IACpF,MAAMsB,cAAcb,OAAOa,WAAW,IAAI;IAC1C,IAAIA,aAAa;QACf,MAAMzB,2BAA2BW;QACjC,MAAMT,4BAA4BS,MAAMR;IAC1C;IAEA,MAAMuB,mBAAmB,CAAC,MAAM,EAAEb,IAAIc,GAAG,CAAC,QAAQ,CAAC;IACnD,MAAMC,sBACJf,IAAIc,GAAG,CACJE,KAAK,CAAC,KACNC,GAAG,CAAC,IAAM,MACVC,IAAI,CAAC,OAAO,CAAC,MAAM,EAAElB,IAAIc,GAAG,CAAC,QAAQ,CAAC;IAC3C,MAAMK,yBACJnB,IAAIc,GAAG,CACJE,KAAK,CAAC,KACNC,GAAG,CAAC,IAAM,MACVC,IAAI,CAAC,OAAO;IACjB,MAAME,gBAAgB7D,yBAAyBuC,MAAME,IAAIC,kBAAkB;IAC3E,MAAMoB,cAAcD,cAAc1B,IAAI;IACtC,MAAM4B,iBAAiBhD,kBAAkBwB;IACzC,MAAMyB,aAAaD;IACnB,MAAMrB,qBAAqB,GAAGqB,iBAAiBvB,OAAOP,IAAI,EAAE;IAC5D,MAAMgC,YAAYnD,UAAU4B;IAC5B,4EAA4E;IAC5E,MAAMwB,sBAAsB,CAAC,CAAC,EAAED,UAAU,WAAW,CAAC;IACtD1B,KAAK4B,MAAM,CAACrE,kBAAkBgE,aAAa;IAE3CjE,cACE0C,MACAzC,kBAAkB,YAAYsE,OAAO,EAAE,gBACvCN,aACA;QACEO,UAAUb;QACVQ,YAAYA;QACZC;QACAvB;QACA4B,WAAWjD,mCAAmCkD,IAAI;QAClDhB,KAAKd,IAAIc,GAAG;QACZF;QACA,GAAGb,MAAM;QACT,GAAG3B,QAAQ0B,KAAK;IAClB,GACA;QACEiC,mBAAmBzE,kBAAkB0E,SAAS;IAChD;IAGFxE,WACEsC,MACA,GAAGuB,YAAY,aAAa,CAAC,EAC7B,CAACY;QACCA,OAAOC,WAAW,GAAG;QACrB3D,kCAAkC0D,QAAQ,SAAS;QACnD1D,kCAAkC0D,QAAQ,SAAS;QACnDA,OAAOE,OAAO,CAACC,OAAO,CAACC,OAAO,GAAG;YAC/B;SACD;QACDJ,OAAOE,OAAO,CAACG,KAAK,GAAG;YACrBC,OAAO;YACPC,UAAU;YACVC,QAAQ;gBAAC;aAAU;YACnBJ,SAAS;gBAAC;aAA6C;YACvDK,WAAW;gBAAC;gBAAU;aAAU;YAChCC,SAASpC,WAAW;gBAClBqC,KAAK;gBACLC,SAAS;YACX;QACF;QACAZ,OAAOE,OAAO,CAACW,OAAO,GAAG;YACvBP,OAAO;YACPC,UAAU;YACVC,QAAQ;gBAAC;aAA6C;YACtDJ,SAAS;gBAAC;aAA6C;YACvDK,WAAW;gBAAC;aAAQ;YACpBC,SAAS;gBACPE,SAAShE,WACP,WACA;YAEJ;QACF;QACAoD,OAAOE,OAAO,CAACY,MAAM,GAAG;YACtBP,UAAU;YACVE,WAAW;gBAAC;gBAAU;aAAU;YAChCC,SAAS/B,cACLL,WAAW;gBACTsC,SAAS,CAAC,sDAAsD,EAAExB,aAAa;YACjF,KACAd,WAAW;gBACTqC,KAAK;gBACLC,SAAS;YACX;QACN;QACAZ,OAAOE,OAAO,CAAC,iBAAiB,GAAG;YACjCK,UAAU;YACVE,WAAW;gBAAC;gBAAU;aAAU;YAChCC,SAAS/B,cACLL,WAAW;gBACTsC,SAAS,CAAC,sDAAsD,EAAExB,YAAY,CAAC,EAAEI,qBAAqB;YACxG,KACAlB,WAAW;gBACTqC,KAAK;gBACLC,SAAS,CAAC,oCAAoC,EAAEpB,qBAAqB;YACvE;QACN;QACAQ,OAAOE,OAAO,CAAC,YAAY,GAAG;YAC5BK,UAAU;YACVG,SAASpC,WAAW;gBAClBqC,KAAK;gBACLC,SAAS,CAAC,0CAA0C,EAAE1B,wBAAwB;YAChF;QACF;QACAc,OAAOE,OAAO,CAACa,OAAO,GAAG;YACvBR,UAAU;YACVE,WAAW;gBAAC;gBAAU;aAAU;YAChCC,SAAS/B,cACLL,WAAW;gBACTsC,SAAS,CAAC,uDAAuD,EAAExB,aAAa;YAClF,KACAd,WAAW;gBACTqC,KAAK;gBACLC,SAAS;YACX;QACN;QACAZ,OAAOE,OAAO,CAAC,kBAAkB,GAAG;YAClCK,UAAU;YACVE,WAAW;gBAAC;gBAAU;aAAU;YAChCC,SAAS/B,cACLL,WAAW;gBACTsC,SAAS,CAAC,uDAAuD,EAAExB,YAAY,CAAC,EAAEI,qBAAqB;YACzG,KACAlB,WAAW;gBACTqC,KAAK;gBACLC,SAAS,CAAC,YAAY,EAAEpB,qBAAqB;YAC/C;QACN;QACAQ,OAAOE,OAAO,CAAC,aAAa,GAAG;YAC7BK,UAAU;YACVG,SAASpC,WAAW;gBAClBqC,KAAK;gBACLC,SAAS,CAAC,kBAAkB,EAAE1B,wBAAwB;YACxD;QACF;QACAc,OAAOE,OAAO,CAACc,GAAG,GAAG;YACnBT,UAAU;YACVG,SAASpC,WAAW;gBAClBqC,KAAK;gBACLC,SAAS;YACX;QACF;QACAZ,OAAOE,OAAO,CAACe,SAAS,GAAG;YACzBV,UAAU;YACVG,SAASpC,WAAW;gBAClBqC,KAAK;gBACLC,SAAS;YACX;QACF;QACAZ,OAAOE,OAAO,GAAGxD,eAAesD,OAAOE,OAAO;QAC9C,OAAOF;IACT;IAGFpE,kBAAkBiC,MAAMR,cAAc;QAAE6D,aAAa9B;IAAY;IAEjE7D,WAAWsC,MAAM,GAAGuB,YAAY,kBAAkB,CAAC,EAAE,CAAC+B,WAAc,CAAA;YAClE,GAAGA,QAAQ;YACXC,YAAYzF,kBAAkBwF,SAASC,UAAU,EAAE;gBACjD;oBACE5F,MAAM,GAAGA,KAAK6F,QAAQ,CACpBjC,aACA,GAAGvB,KAAKJ,IAAI,CAAC,CAAC,EAAEV,cAAc,EAC9B,CAAC,EAAEC,sBAAsB,kBAAkB,CAAC;gBAChD;mBACI2B,cACA;oBACE;wBACEnD,MAAM,GAAGA,KAAK6F,QAAQ,CACpBjC,aACA,GAAGvB,KAAKJ,IAAI,CAAC,CAAC,EAAEV,cAAc,EAC9B,CAAC,EAAEE,wBAAwB,cAAc,CAAC;oBAC9C;iBACD,GACD,EAAE;aACP;QACH,CAAA;IAEA,MAAMf,gCAAgC2B,MAAM;QAACH;KAAyB;IAEtE,MAAM1B,qBAAqB6B;IAC3B,OAAO,IACL5B,oBAAoB4B,MAAMC,OAAOG,yBAAyB,EAAE;YAC1DqD,WAAW;gBAAC;aAAa;QAC3B;AACJ;AACA,eAAe1D,iBAAiB"}

package/src/mcp-server/tools/general-guidance.js

@@ -65,7 +65,7 @@ ${PACKAGE_MANAGERS.map((pm)=>buildNxCommand('<options>', pm)).join(' - \n')}
 - Generate all projects into the \`packages/\` directory
 - After making changes to your projects, fix linting issues, then run a full build
 - When it's time to start testing a project, suggest to the user that infrastructure is deployed to AWS. For websites, if a runtime-config.json is needed, use the load-runtime-config target after a deployment to point a local website at a sandbox stack.
-- For CDK infrastructure projects, deploy the sandbox stage with the \`deploy-sandbox\` target (eg \`nx deploy-sandbox infra\`) rather than passing a stage pattern to \`deploy\` — it already targets the sandbox stage declared in \`main.ts\`.
+- For CDK infrastructure projects, deploy the sandbox stage with the \`deploy-sandbox\` target (eg \`nx deploy-sandbox infra\`) rather than passing a stage pattern to \`deploy\` — it already targets the sandbox stage declared in \`main.ts\`. Likewise \`destroy-sandbox\` tears that stage back down.
 
 ## Batching Generators
 

package/src/mcp-server/tools/general-guidance.js.map

@@ -1 +1 @@
-{"version":3,"sources":["../../../../../../packages/nx-plugin/src/mcp-server/tools/general-guidance.ts"],"sourcesContent":["/**\n * Copyright Amazon.com, Inc. or its affiliates. All Rights Reserved.\n * SPDX-License-Identifier: Apache-2.0\n */\nimport type { McpServer } from '@modelcontextprotocol/sdk/server/mcp.js';\nimport type { NxGeneratorInfo } from '../../utils/generators.js';\nimport { IAC_PROVIDERS } from '../../utils/iac-providers.js';\nimport { buildNxCommand, fetchGuidePages } from '../generator-info.js';\nimport { PACKAGE_MANAGERS } from '../schema.js';\n\nexport const TOOL_SELECTION_GUIDE = `## Tool Selection Guide\n\n- Use the \\`general-guidance\\` tool for guidance and best practices for working with Nx and the Nx Plugin for AWS.\n- Use the \\`create-workspace-command\\` tool to discover how to create a workspace to start a new project.\n- Use the \\`add-to-existing-project\\` tool when adding the plugin to an existing Nx workspace or non-Nx monorepo, or when troubleshooting configuration errors in such a workspace.\n- Use the \\`upgrade-workspace\\` tool when upgrading Nx or the Nx Plugin for AWS to a newer version.\n- Use the \\`list-generators\\` tool to discover the available generators and how to run them.\n- Use the \\`generator-guide\\` tool to retrieve detailed information about a specific generator.`;\n\n/**\n * Add a tool which provides general guidance for using Nx and the Nx Plugin for AWS\n */\nexport const addGeneralGuidanceTool = (\n  server: McpServer,\n  generators: NxGeneratorInfo[],\n) => {\n  server.registerTool(\n    'general-guidance',\n    {\n      title: 'General Guidance',\n      description:\n        'Tool for guidance and best practices for working with Nx and the Nx Plugin for AWS',\n    },\n    async () => ({\n      content: [\n        {\n          type: 'text' as const,\n          text: `# Nx Plugin for AWS Guidance\n\n${TOOL_SELECTION_GUIDE}\n\n## Getting Started\n\n- Choose a package manager first. You can choose between ${PACKAGE_MANAGERS.join(', ')}. It's recommended to use \"pnpm\" if the user has no preference\n- Choose an infrastructure as code (IaC) provider next. You can choose between ${IAC_PROVIDERS.join(', ')}. It's recommended to use CDK if the user has no preference\n- Next, you must create an Nx workspace. Use the \\`create-workspace-command\\` tool for more details, and provide it with your chosen package manager\n- After this, you can start scaffolding the main components of your application using generators. Use the \\`list-generators\\` tool to discover available generators, and the \\`generator-guide\\` tool for more detailed information about a specific generator\n\n## Nx Primer\n\n- Prefix nx commands with the appropriate prefix for your package manager, for example:\n${PACKAGE_MANAGERS.map((pm) => buildNxCommand('<options>', pm)).join(' - \\n')}\n- Each project in your workspace has a file named \\`project.json\\` which contains important project information such as its name, and defines the \"targets\" which can be run for that project, for example building or testing the project\n- Use the command \\`nx reset\\` to reset the Nx daemon when unexpected issues arise\n- After adding dependencies between TypeScript projects, use \\`nx sync\\` to ensure project references are set up correctly\n\n## General Instructions\n\n- Each project declares the third-party runtime dependencies its source imports in its own \\`package.json\\`; shared build/test tooling (test runners, bundlers, etc.) is declared in the root \\`package.json\\` \\`devDependencies\\`. Versions follow a single version policy, recorded in the package manager's dependency catalog where supported (referenced as \\`catalog:\\`). Install with the appropriate command for your package manager:\n  - Add a project runtime dependency: \\`pnpm add <package> --filter <project>\\` / \\`yarn workspace <project> add <package>\\` / \\`npm install <package> -w <project>\\` / \\`bun add <package> --cwd <project-directory>\\`\n  - Add a shared dev tool at the root: \\`pnpm add -Dw <package>\\` / \\`yarn add -D <package>\\` / \\`npm install --legacy-peer-deps -D <package>\\` / \\`bun install -D <package>\\`\n- The \\`noUndeclaredDependencies\\` lint rule enforces that a project's source only imports packages declared in its own \\`package.json\\`\n- Projects in the same workspace can import one another directly by package name (eg \\`@workspace-name/project-name\\`) without declaring a dependency in \\`package.json\\` — TypeScript path aliases in \\`tsconfig.base.json\\` resolve these imports\n- When specifying project names as arguments to generators, prefer the _fully qualified_ project name, for example \\`@workspace-name/project-name\\`. Check the \\`project.json\\` file for the specific package to find its fully qualified name\n- When no generator exists for a specific framework required, use the base \\`ts#project\\` and \\`py#project\\` generators and build on top.\n- Leave the \\`--infra\\` option at its default value unless the user has explicitly instructed otherwise. Generators choose a sensible default type of infrastructure to deploy the project with, so only override \\`--infra\\` when the user has specified a particular requirement.\n\n## Useful Commands\n\n- Fix lint issues with \\`nx run-many --target lint --configuration=fix --all --output-style=stream\\`\n- Build all projects with \\`nx run-many --target build --all --output-style=stream\\`\n- Prefer importing the CDK constructs vended by generators in \\`packages/common/constructs\\` over writing your own\n\n## Best Practices\n\n- After running a generator, use the \\`nx show projects\\` command to check which projects have been added (if any)\n- Carefully examine the files that have been generated and always refer back to the generator guide when working in a generated project\n- Generate all projects into the \\`packages/\\` directory\n- After making changes to your projects, fix linting issues, then run a full build\n- When it's time to start testing a project, suggest to the user that infrastructure is deployed to AWS. For websites, if a runtime-config.json is needed, use the load-runtime-config target after a deployment to point a local website at a sandbox stack.\n- For CDK infrastructure projects, deploy the sandbox stage with the \\`deploy-sandbox\\` target (eg \\`nx deploy-sandbox infra\\`) rather than passing a stage pattern to \\`deploy\\` — it already targets the sandbox stage declared in \\`main.ts\\`.\n\n## Batching Generators\n\nWhen scaffolding several projects in one go, chain generators to avoid a slow dependency install after every generator:\n\n- **Chain generators** with \\`&&\\` in a single command. Pass \\`--prefer-install-dependencies=false\\` on each generator except the last so dependencies install once at the end, for example:\n\n${PACKAGE_MANAGERS.map(\n  (pm) => `  \\`\\`\\`bash\n  ${buildNxCommand('g @aws/nx-plugin:ts#trpc-api --no-interactive --name=my-app-api --auth=iam --prefer-install-dependencies=false', pm)} && \\\\\n    ${buildNxCommand('g @aws/nx-plugin:ts#react-website --no-interactive --name=my-app-website --prefer-install-dependencies=false', pm)} && \\\\\n    ${buildNxCommand('g @aws/nx-plugin:connection --no-interactive --sourceProject=@my-app/my-app-website --targetProject=@my-app/my-app-api --prefer-install-dependencies=false', pm)} && \\\\\n    ${buildNxCommand('g @aws/nx-plugin:ts#infra --no-interactive --name=infra', pm)} && \\\\\n    ${buildNxCommand('sync', pm)}\n  \\`\\`\\``,\n).join('\\n')}\n\n- **\\`--prefer-install-dependencies=false\\`** asks a generator to defer its dependency install so the batch installs once at the end (the final generator above omits the flag and installs everything).\n- **\\`nx sync\\`** is required before building — generators modify TypeScript project references.\n\n## Detailed Guides\n\nPlease refer to the below documentation for important details regarding workspaces and working with TypeScript or Python projects.\n\n${await fetchGuidePages(['workspace', 'typescript-project', 'python-project'], generators)}\n\n    `,\n        },\n      ],\n    }),\n  );\n};\n"],"names":["IAC_PROVIDERS","buildNxCommand","fetchGuidePages","PACKAGE_MANAGERS","TOOL_SELECTION_GUIDE","addGeneralGuidanceTool","server","generators","registerTool","title","description","content","type","text","join","map","pm"],"mappings":"AAAA;;;CAGC,GAGD,SAASA,aAAa,QAAQ,+BAA+B;AAC7D,SAASC,cAAc,EAAEC,eAAe,QAAQ,uBAAuB;AACvE,SAASC,gBAAgB,QAAQ,eAAe;AAEhD,OAAO,MAAMC,uBAAuB,CAAC;;;;;;;+FAO0D,CAAC,CAAC;AAEjG;;CAEC,GACD,OAAO,MAAMC,yBAAyB,CACpCC,QACAC;IAEAD,OAAOE,YAAY,CACjB,oBACA;QACEC,OAAO;QACPC,aACE;IACJ,GACA,UAAa,CAAA;YACXC,SAAS;gBACP;oBACEC,MAAM;oBACNC,MAAM,CAAC;;AAEjB,EAAET,qBAAqB;;;;yDAIkC,EAAED,iBAAiBW,IAAI,CAAC,MAAM;+EACR,EAAEd,cAAcc,IAAI,CAAC,MAAM;;;;;;;AAO1G,EAAEX,iBAAiBY,GAAG,CAAC,CAACC,KAAOf,eAAe,aAAae,KAAKF,IAAI,CAAC,SAAS;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAqC9E,EAAEX,iBAAiBY,GAAG,CACpB,CAACC,KAAO,CAAC;EACT,EAAEf,eAAe,kHAAkHe,IAAI;IACrI,EAAEf,eAAe,gHAAgHe,IAAI;IACrI,EAAEf,eAAe,8JAA8Je,IAAI;IACnL,EAAEf,eAAe,2DAA2De,IAAI;IAChF,EAAEf,eAAe,QAAQe,IAAI;QACzB,CAAC,EACPF,IAAI,CAAC,MAAM;;;;;;;;;AASb,EAAE,MAAMZ,gBAAgB;wBAAC;wBAAa;wBAAsB;qBAAiB,EAAEK,YAAY;;IAEvF,CAAC;gBACG;aACD;QACH,CAAA;AAEJ,EAAE"}
+{"version":3,"sources":["../../../../../../packages/nx-plugin/src/mcp-server/tools/general-guidance.ts"],"sourcesContent":["/**\n * Copyright Amazon.com, Inc. or its affiliates. All Rights Reserved.\n * SPDX-License-Identifier: Apache-2.0\n */\nimport type { McpServer } from '@modelcontextprotocol/sdk/server/mcp.js';\nimport type { NxGeneratorInfo } from '../../utils/generators.js';\nimport { IAC_PROVIDERS } from '../../utils/iac-providers.js';\nimport { buildNxCommand, fetchGuidePages } from '../generator-info.js';\nimport { PACKAGE_MANAGERS } from '../schema.js';\n\nexport const TOOL_SELECTION_GUIDE = `## Tool Selection Guide\n\n- Use the \\`general-guidance\\` tool for guidance and best practices for working with Nx and the Nx Plugin for AWS.\n- Use the \\`create-workspace-command\\` tool to discover how to create a workspace to start a new project.\n- Use the \\`add-to-existing-project\\` tool when adding the plugin to an existing Nx workspace or non-Nx monorepo, or when troubleshooting configuration errors in such a workspace.\n- Use the \\`upgrade-workspace\\` tool when upgrading Nx or the Nx Plugin for AWS to a newer version.\n- Use the \\`list-generators\\` tool to discover the available generators and how to run them.\n- Use the \\`generator-guide\\` tool to retrieve detailed information about a specific generator.`;\n\n/**\n * Add a tool which provides general guidance for using Nx and the Nx Plugin for AWS\n */\nexport const addGeneralGuidanceTool = (\n  server: McpServer,\n  generators: NxGeneratorInfo[],\n) => {\n  server.registerTool(\n    'general-guidance',\n    {\n      title: 'General Guidance',\n      description:\n        'Tool for guidance and best practices for working with Nx and the Nx Plugin for AWS',\n    },\n    async () => ({\n      content: [\n        {\n          type: 'text' as const,\n          text: `# Nx Plugin for AWS Guidance\n\n${TOOL_SELECTION_GUIDE}\n\n## Getting Started\n\n- Choose a package manager first. You can choose between ${PACKAGE_MANAGERS.join(', ')}. It's recommended to use \"pnpm\" if the user has no preference\n- Choose an infrastructure as code (IaC) provider next. You can choose between ${IAC_PROVIDERS.join(', ')}. It's recommended to use CDK if the user has no preference\n- Next, you must create an Nx workspace. Use the \\`create-workspace-command\\` tool for more details, and provide it with your chosen package manager\n- After this, you can start scaffolding the main components of your application using generators. Use the \\`list-generators\\` tool to discover available generators, and the \\`generator-guide\\` tool for more detailed information about a specific generator\n\n## Nx Primer\n\n- Prefix nx commands with the appropriate prefix for your package manager, for example:\n${PACKAGE_MANAGERS.map((pm) => buildNxCommand('<options>', pm)).join(' - \\n')}\n- Each project in your workspace has a file named \\`project.json\\` which contains important project information such as its name, and defines the \"targets\" which can be run for that project, for example building or testing the project\n- Use the command \\`nx reset\\` to reset the Nx daemon when unexpected issues arise\n- After adding dependencies between TypeScript projects, use \\`nx sync\\` to ensure project references are set up correctly\n\n## General Instructions\n\n- Each project declares the third-party runtime dependencies its source imports in its own \\`package.json\\`; shared build/test tooling (test runners, bundlers, etc.) is declared in the root \\`package.json\\` \\`devDependencies\\`. Versions follow a single version policy, recorded in the package manager's dependency catalog where supported (referenced as \\`catalog:\\`). Install with the appropriate command for your package manager:\n  - Add a project runtime dependency: \\`pnpm add <package> --filter <project>\\` / \\`yarn workspace <project> add <package>\\` / \\`npm install <package> -w <project>\\` / \\`bun add <package> --cwd <project-directory>\\`\n  - Add a shared dev tool at the root: \\`pnpm add -Dw <package>\\` / \\`yarn add -D <package>\\` / \\`npm install --legacy-peer-deps -D <package>\\` / \\`bun install -D <package>\\`\n- The \\`noUndeclaredDependencies\\` lint rule enforces that a project's source only imports packages declared in its own \\`package.json\\`\n- Projects in the same workspace can import one another directly by package name (eg \\`@workspace-name/project-name\\`) without declaring a dependency in \\`package.json\\` — TypeScript path aliases in \\`tsconfig.base.json\\` resolve these imports\n- When specifying project names as arguments to generators, prefer the _fully qualified_ project name, for example \\`@workspace-name/project-name\\`. Check the \\`project.json\\` file for the specific package to find its fully qualified name\n- When no generator exists for a specific framework required, use the base \\`ts#project\\` and \\`py#project\\` generators and build on top.\n- Leave the \\`--infra\\` option at its default value unless the user has explicitly instructed otherwise. Generators choose a sensible default type of infrastructure to deploy the project with, so only override \\`--infra\\` when the user has specified a particular requirement.\n\n## Useful Commands\n\n- Fix lint issues with \\`nx run-many --target lint --configuration=fix --all --output-style=stream\\`\n- Build all projects with \\`nx run-many --target build --all --output-style=stream\\`\n- Prefer importing the CDK constructs vended by generators in \\`packages/common/constructs\\` over writing your own\n\n## Best Practices\n\n- After running a generator, use the \\`nx show projects\\` command to check which projects have been added (if any)\n- Carefully examine the files that have been generated and always refer back to the generator guide when working in a generated project\n- Generate all projects into the \\`packages/\\` directory\n- After making changes to your projects, fix linting issues, then run a full build\n- When it's time to start testing a project, suggest to the user that infrastructure is deployed to AWS. For websites, if a runtime-config.json is needed, use the load-runtime-config target after a deployment to point a local website at a sandbox stack.\n- For CDK infrastructure projects, deploy the sandbox stage with the \\`deploy-sandbox\\` target (eg \\`nx deploy-sandbox infra\\`) rather than passing a stage pattern to \\`deploy\\` — it already targets the sandbox stage declared in \\`main.ts\\`. Likewise \\`destroy-sandbox\\` tears that stage back down.\n\n## Batching Generators\n\nWhen scaffolding several projects in one go, chain generators to avoid a slow dependency install after every generator:\n\n- **Chain generators** with \\`&&\\` in a single command. Pass \\`--prefer-install-dependencies=false\\` on each generator except the last so dependencies install once at the end, for example:\n\n${PACKAGE_MANAGERS.map(\n  (pm) => `  \\`\\`\\`bash\n  ${buildNxCommand('g @aws/nx-plugin:ts#trpc-api --no-interactive --name=my-app-api --auth=iam --prefer-install-dependencies=false', pm)} && \\\\\n    ${buildNxCommand('g @aws/nx-plugin:ts#react-website --no-interactive --name=my-app-website --prefer-install-dependencies=false', pm)} && \\\\\n    ${buildNxCommand('g @aws/nx-plugin:connection --no-interactive --sourceProject=@my-app/my-app-website --targetProject=@my-app/my-app-api --prefer-install-dependencies=false', pm)} && \\\\\n    ${buildNxCommand('g @aws/nx-plugin:ts#infra --no-interactive --name=infra', pm)} && \\\\\n    ${buildNxCommand('sync', pm)}\n  \\`\\`\\``,\n).join('\\n')}\n\n- **\\`--prefer-install-dependencies=false\\`** asks a generator to defer its dependency install so the batch installs once at the end (the final generator above omits the flag and installs everything).\n- **\\`nx sync\\`** is required before building — generators modify TypeScript project references.\n\n## Detailed Guides\n\nPlease refer to the below documentation for important details regarding workspaces and working with TypeScript or Python projects.\n\n${await fetchGuidePages(['workspace', 'typescript-project', 'python-project'], generators)}\n\n    `,\n        },\n      ],\n    }),\n  );\n};\n"],"names":["IAC_PROVIDERS","buildNxCommand","fetchGuidePages","PACKAGE_MANAGERS","TOOL_SELECTION_GUIDE","addGeneralGuidanceTool","server","generators","registerTool","title","description","content","type","text","join","map","pm"],"mappings":"AAAA;;;CAGC,GAGD,SAASA,aAAa,QAAQ,+BAA+B;AAC7D,SAASC,cAAc,EAAEC,eAAe,QAAQ,uBAAuB;AACvE,SAASC,gBAAgB,QAAQ,eAAe;AAEhD,OAAO,MAAMC,uBAAuB,CAAC;;;;;;;+FAO0D,CAAC,CAAC;AAEjG;;CAEC,GACD,OAAO,MAAMC,yBAAyB,CACpCC,QACAC;IAEAD,OAAOE,YAAY,CACjB,oBACA;QACEC,OAAO;QACPC,aACE;IACJ,GACA,UAAa,CAAA;YACXC,SAAS;gBACP;oBACEC,MAAM;oBACNC,MAAM,CAAC;;AAEjB,EAAET,qBAAqB;;;;yDAIkC,EAAED,iBAAiBW,IAAI,CAAC,MAAM;+EACR,EAAEd,cAAcc,IAAI,CAAC,MAAM;;;;;;;AAO1G,EAAEX,iBAAiBY,GAAG,CAAC,CAACC,KAAOf,eAAe,aAAae,KAAKF,IAAI,CAAC,SAAS;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAqC9E,EAAEX,iBAAiBY,GAAG,CACpB,CAACC,KAAO,CAAC;EACT,EAAEf,eAAe,kHAAkHe,IAAI;IACrI,EAAEf,eAAe,gHAAgHe,IAAI;IACrI,EAAEf,eAAe,8JAA8Je,IAAI;IACnL,EAAEf,eAAe,2DAA2De,IAAI;IAChF,EAAEf,eAAe,QAAQe,IAAI;QACzB,CAAC,EACPF,IAAI,CAAC,MAAM;;;;;;;;;AASb,EAAE,MAAMZ,gBAAgB;wBAAC;wBAAa;wBAAsB;qBAAiB,EAAEK,YAAY;;IAEvF,CAAC;gBACG;aACD;QACH,CAAA;AAEJ,EAAE"}

package/src/migrations/latest/add-destroy-sandbox-target/metadata.json

@@ -0,0 +1,3 @@
+{
+  "description": "Add a destroy-sandbox target to CDK infrastructure projects which destroys the sandbox stage, and drop the --require-approval flag from cdk destroy, which has no such option"
+}

package/src/migrations/latest/add-destroy-sandbox-target/migration.d.ts

@@ -0,0 +1,6 @@
+/**
+ * Copyright Amazon.com, Inc. or its affiliates. All Rights Reserved.
+ * SPDX-License-Identifier: Apache-2.0
+ */
+import { type MigrationReturnObject, type Tree } from '@nx/devkit';
+export default function migration(tree: Tree): Promise<MigrationReturnObject>;

package/src/migrations/latest/add-destroy-sandbox-target/migration.js

@@ -0,0 +1,150 @@
+/**
+ * Copyright Amazon.com, Inc. or its affiliates. All Rights Reserved.
+ * SPDX-License-Identifier: Apache-2.0
+ */ import { getProjects, joinPathFragments, updateProjectConfiguration } from "@nx/devkit";
+import { readFileSync } from "fs";
+import { join } from "path";
+import { INFRA_APP_GENERATOR_INFO } from "../../../infra/app/generator.js";
+import { captureGritQLVariable } from "../../../utils/ast.js";
+import { formatFilesInSubtree } from "../../../utils/format.js";
+import { normalizeTargetKeyOrder } from "../../../utils/nx.js";
+import { sortObjectKeys } from "../../../utils/object.js";
+import { PACKAGES_DIR, SHARED_SCRIPTS_DIR } from "../../../utils/shared-constructs-constants.js";
+/**
+ * CDK infrastructure projects gained a `destroy-sandbox` target, mirroring
+ * `deploy-sandbox`: it tears down the sandbox stage without the user having to
+ * spell out its stage pattern (`nx destroy-sandbox infra` rather than
+ * `nx destroy infra "my-app-infra-sandbox/*"`).
+ *
+ * The stage id is read from `main.ts` rather than recomputed from the project
+ * name, so a project whose sandbox stage has been renamed gets a target that
+ * destroys the stage it actually declares.
+ *
+ * The destroy targets also drop `--require-approval=never`. `cdk destroy` has no
+ * such option, so it only warns that the flag is being ignored. The same fix
+ * lands in the vended `buildCdkCommand`, which builds the command for
+ * `stageConfig` workspaces.
+ *
+ * How to write a migration:
+ * - https://nx.dev/docs/kb/migration-generators
+ * - What `nextSteps` means: https://nx.dev/docs/reference/devkit/MigrationReturnObject
+ */ const TARGET = 'destroy-sandbox';
+/** The destroy targets the ignored flag is stripped from. */ const DESTROY_TARGETS = [
+    'destroy',
+    'destroy-ci'
+];
+/** `cdk destroy` has no such option, so it only warns and carries on. */ const IGNORED_APPROVAL_FLAG = /\s*--require-approval(=\S*)?/;
+/**
+ * Matches `new ApplicationStage(app, '<id>-sandbox', { ... })`, binding the
+ * quoted stage id. The regex spans the quotes because it is matched against the
+ * whole string literal node; both quote styles are accepted since the user's
+ * formatter may have rewritten them.
+ *
+ * `main.ts` can declare several stages (beta, prod), so the pattern selects the
+ * sandbox one rather than whichever comes first.
+ */ const SANDBOX_STAGE_PATTERN = '`new ApplicationStage($app, $id, $props)` where { $id <: r"[\'\\"].*-sandbox[\'\\"]" }';
+/** The id of the sandbox stage a project's `main.ts` instantiates. */ const sandboxStageId = async (tree, projectRoot)=>{
+    const captured = await captureGritQLVariable(tree, joinPathFragments(projectRoot, 'src', 'main.ts'), SANDBOX_STAGE_PATTERN, 'id');
+    // The binding keeps the quotes from the source.
+    return captured?.slice(1, -1);
+};
+/**
+ * Strip the ignored `--require-approval` from a `cdk destroy` command. Returns
+ * undefined when the command isn't the shape the generator produced, or the flag
+ * is already gone.
+ */ const withoutApprovalFlag = (command)=>{
+    if (typeof command !== 'string' || !command.includes('cdk destroy')) {
+        return undefined;
+    }
+    if (!IGNORED_APPROVAL_FLAG.test(command)) return undefined;
+    return command.replace(IGNORED_APPROVAL_FLAG, '');
+};
+/** Drops the ignored approval flag from the project's destroy targets. */ const migrateDestroyFlags = (project)=>{
+    let changed = false;
+    for (const name of DESTROY_TARGETS){
+        const target = project.targets?.[name];
+        const command = withoutApprovalFlag(target?.options?.command);
+        if (command) {
+            target.options = {
+                ...target.options,
+                command
+            };
+            changed = true;
+        }
+    }
+    return changed;
+};
+/** Path the shared scripts package vends the CDK command builder at. */ const CDK_COMMAND_PATH = joinPathFragments(PACKAGES_DIR, SHARED_SCRIPTS_DIR, 'src/infra/stage-credentials/cdk-command.ts');
+/** The builder as it stands today. The template carries no EJS variables. */ const CDK_COMMAND_TEMPLATE = readFileSync(join(import.meta.dirname, '../../../utils/files/common/scripts/src/infra/stage-credentials/cdk-command.ts.template'), 'utf-8');
+/**
+ * Re-vends the CDK command builder, which no longer adds `--require-approval`
+ * for the `destroy` action. Only the shape the generator produced is replaced: a
+ * customised copy is the user's, so it is reported instead.
+ */ const migrateCdkCommandBuilder = (tree, nextSteps)=>{
+    if (!tree.exists(CDK_COMMAND_PATH)) return;
+    const current = tree.read(CDK_COMMAND_PATH).toString();
+    // Already migrated, so a re-run is a no-op.
+    if (current.includes("action === 'destroy'")) return;
+    if (!current.includes('hasRequireApproval')) {
+        nextSteps.push(`${CDK_COMMAND_PATH}: has diverged from the generated shape — left untouched. Have it skip \`--require-approval\` for the \`destroy\` action, which has no such option.`);
+        return;
+    }
+    tree.write(CDK_COMMAND_PATH, CDK_COMMAND_TEMPLATE);
+};
+/** Adds the `destroy-sandbox` target, mirroring the project's `destroy`. */ const addSandboxTarget = async (tree, projectName, project, nextSteps)=>{
+    // The new target mirrors `destroy`, so it inherits whatever that resolved to
+    // when the project was generated: the `tsx` credential-resolving script
+    // under `stageConfig`, plain `cdk destroy` otherwise.
+    const destroy = project.targets.destroy;
+    const command = destroy?.options?.command;
+    const mainPath = joinPathFragments(project.root, 'src/main.ts');
+    const stageId = await sandboxStageId(tree, project.root);
+    if (typeof command !== 'string') {
+        nextSteps.push(`Add a '${TARGET}' target to ${projectName} by hand if necessary — its 'destroy' target no longer matches the shape the generator produced.`);
+        return false;
+    }
+    if (!stageId) {
+        nextSteps.push(`Add a '${TARGET}' target to ${projectName} by hand if necessary — no sandbox stage was found in ${mainPath}.`);
+        return false;
+    }
+    project.targets[TARGET] = normalizeTargetKeyOrder({
+        executor: destroy.executor,
+        ...destroy.dependsOn ? {
+            dependsOn: [
+                ...destroy.dependsOn
+            ]
+        } : {},
+        // Quoted so the shell does not glob the `*`.
+        options: {
+            ...destroy.options,
+            command: `${command} "${stageId}/*"`
+        }
+    });
+    return true;
+};
+export default async function migration(tree) {
+    const nextSteps = [];
+    for (const [projectName, project] of getProjects(tree)){
+        const generator = project.metadata?.generator;
+        // Not a CDK infrastructure project.
+        if (generator !== INFRA_APP_GENERATOR_INFO.id) continue;
+        // Corrected first so the new target inherits the fixed command.
+        let changed = migrateDestroyFlags(project);
+        if (!project.targets?.[TARGET]) {
+            changed = await addSandboxTarget(tree, projectName, project, nextSteps) || changed;
+        }
+        if (changed) {
+            updateProjectConfiguration(tree, projectName, {
+                ...project,
+                targets: sortObjectKeys(project.targets)
+            });
+        }
+    }
+    migrateCdkCommandBuilder(tree, nextSteps);
+    await formatFilesInSubtree(tree);
+    return {
+        nextSteps
+    };
+}
+
+//# sourceMappingURL=migration.js.map

package/src/migrations/latest/add-destroy-sandbox-target/migration.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../../../../../../../packages/nx-plugin/src/migrations/latest/add-destroy-sandbox-target/migration.ts"],"sourcesContent":["/**\n * Copyright Amazon.com, Inc. or its affiliates. All Rights Reserved.\n * SPDX-License-Identifier: Apache-2.0\n */\nimport {\n  getProjects,\n  joinPathFragments,\n  type MigrationReturnObject,\n  type ProjectConfiguration,\n  type Tree,\n  updateProjectConfiguration,\n} from '@nx/devkit';\nimport { readFileSync } from 'fs';\nimport { join } from 'path';\nimport { INFRA_APP_GENERATOR_INFO } from '../../../infra/app/generator.js';\nimport { captureGritQLVariable } from '../../../utils/ast.js';\nimport { formatFilesInSubtree } from '../../../utils/format.js';\nimport { normalizeTargetKeyOrder } from '../../../utils/nx.js';\nimport { sortObjectKeys } from '../../../utils/object.js';\nimport {\n  PACKAGES_DIR,\n  SHARED_SCRIPTS_DIR,\n} from '../../../utils/shared-constructs-constants.js';\n\n/**\n * CDK infrastructure projects gained a `destroy-sandbox` target, mirroring\n * `deploy-sandbox`: it tears down the sandbox stage without the user having to\n * spell out its stage pattern (`nx destroy-sandbox infra` rather than\n * `nx destroy infra \"my-app-infra-sandbox/*\"`).\n *\n * The stage id is read from `main.ts` rather than recomputed from the project\n * name, so a project whose sandbox stage has been renamed gets a target that\n * destroys the stage it actually declares.\n *\n * The destroy targets also drop `--require-approval=never`. `cdk destroy` has no\n * such option, so it only warns that the flag is being ignored. The same fix\n * lands in the vended `buildCdkCommand`, which builds the command for\n * `stageConfig` workspaces.\n *\n * How to write a migration:\n * - https://nx.dev/docs/kb/migration-generators\n * - What `nextSteps` means: https://nx.dev/docs/reference/devkit/MigrationReturnObject\n */\n\nconst TARGET = 'destroy-sandbox';\n\n/** The destroy targets the ignored flag is stripped from. */\nconst DESTROY_TARGETS = ['destroy', 'destroy-ci'] as const;\n\n/** `cdk destroy` has no such option, so it only warns and carries on. */\nconst IGNORED_APPROVAL_FLAG = /\\s*--require-approval(=\\S*)?/;\n\n/**\n * Matches `new ApplicationStage(app, '<id>-sandbox', { ... })`, binding the\n * quoted stage id. The regex spans the quotes because it is matched against the\n * whole string literal node; both quote styles are accepted since the user's\n * formatter may have rewritten them.\n *\n * `main.ts` can declare several stages (beta, prod), so the pattern selects the\n * sandbox one rather than whichever comes first.\n */\nconst SANDBOX_STAGE_PATTERN =\n  '`new ApplicationStage($app, $id, $props)` where { $id <: r\"[\\'\\\\\"].*-sandbox[\\'\\\\\"]\" }';\n\n/** The id of the sandbox stage a project's `main.ts` instantiates. */\nconst sandboxStageId = async (\n  tree: Tree,\n  projectRoot: string,\n): Promise<string | undefined> => {\n  const captured = await captureGritQLVariable(\n    tree,\n    joinPathFragments(projectRoot, 'src', 'main.ts'),\n    SANDBOX_STAGE_PATTERN,\n    'id',\n  );\n  // The binding keeps the quotes from the source.\n  return captured?.slice(1, -1);\n};\n\n/**\n * Strip the ignored `--require-approval` from a `cdk destroy` command. Returns\n * undefined when the command isn't the shape the generator produced, or the flag\n * is already gone.\n */\nconst withoutApprovalFlag = (command: unknown): string | undefined => {\n  if (typeof command !== 'string' || !command.includes('cdk destroy')) {\n    return undefined;\n  }\n  if (!IGNORED_APPROVAL_FLAG.test(command)) return undefined;\n  return command.replace(IGNORED_APPROVAL_FLAG, '');\n};\n\n/** Drops the ignored approval flag from the project's destroy targets. */\nconst migrateDestroyFlags = (project: ProjectConfiguration): boolean => {\n  let changed = false;\n  for (const name of DESTROY_TARGETS) {\n    const target = project.targets?.[name];\n    const command = withoutApprovalFlag(target?.options?.command);\n    if (command) {\n      target.options = { ...target.options, command };\n      changed = true;\n    }\n  }\n  return changed;\n};\n\n/** Path the shared scripts package vends the CDK command builder at. */\nconst CDK_COMMAND_PATH = joinPathFragments(\n  PACKAGES_DIR,\n  SHARED_SCRIPTS_DIR,\n  'src/infra/stage-credentials/cdk-command.ts',\n);\n\n/** The builder as it stands today. The template carries no EJS variables. */\nconst CDK_COMMAND_TEMPLATE = readFileSync(\n  join(\n    import.meta.dirname,\n    '../../../utils/files/common/scripts/src/infra/stage-credentials/cdk-command.ts.template',\n  ),\n  'utf-8',\n);\n\n/**\n * Re-vends the CDK command builder, which no longer adds `--require-approval`\n * for the `destroy` action. Only the shape the generator produced is replaced: a\n * customised copy is the user's, so it is reported instead.\n */\nconst migrateCdkCommandBuilder = (tree: Tree, nextSteps: string[]): void => {\n  if (!tree.exists(CDK_COMMAND_PATH)) return;\n\n  const current = tree.read(CDK_COMMAND_PATH)!.toString();\n  // Already migrated, so a re-run is a no-op.\n  if (current.includes(\"action === 'destroy'\")) return;\n\n  if (!current.includes('hasRequireApproval')) {\n    nextSteps.push(\n      `${CDK_COMMAND_PATH}: has diverged from the generated shape — left untouched. Have it skip \\`--require-approval\\` for the \\`destroy\\` action, which has no such option.`,\n    );\n    return;\n  }\n\n  tree.write(CDK_COMMAND_PATH, CDK_COMMAND_TEMPLATE);\n};\n\n/** Adds the `destroy-sandbox` target, mirroring the project's `destroy`. */\nconst addSandboxTarget = async (\n  tree: Tree,\n  projectName: string,\n  project: ProjectConfiguration,\n  nextSteps: string[],\n): Promise<boolean> => {\n  // The new target mirrors `destroy`, so it inherits whatever that resolved to\n  // when the project was generated: the `tsx` credential-resolving script\n  // under `stageConfig`, plain `cdk destroy` otherwise.\n  const destroy = project.targets.destroy;\n  const command = destroy?.options?.command;\n  const mainPath = joinPathFragments(project.root, 'src/main.ts');\n  const stageId = await sandboxStageId(tree, project.root);\n\n  if (typeof command !== 'string') {\n    nextSteps.push(\n      `Add a '${TARGET}' target to ${projectName} by hand if necessary — its 'destroy' target no longer matches the shape the generator produced.`,\n    );\n    return false;\n  }\n  if (!stageId) {\n    nextSteps.push(\n      `Add a '${TARGET}' target to ${projectName} by hand if necessary — no sandbox stage was found in ${mainPath}.`,\n    );\n    return false;\n  }\n\n  project.targets[TARGET] = normalizeTargetKeyOrder({\n    executor: destroy.executor,\n    ...(destroy.dependsOn ? { dependsOn: [...destroy.dependsOn] } : {}),\n    // Quoted so the shell does not glob the `*`.\n    options: { ...destroy.options, command: `${command} \"${stageId}/*\"` },\n  });\n  return true;\n};\n\nexport default async function migration(\n  tree: Tree,\n): Promise<MigrationReturnObject> {\n  const nextSteps: string[] = [];\n\n  for (const [projectName, project] of getProjects(tree)) {\n    const generator = (project.metadata as { generator?: string } | undefined)\n      ?.generator;\n    // Not a CDK infrastructure project.\n    if (generator !== INFRA_APP_GENERATOR_INFO.id) continue;\n\n    // Corrected first so the new target inherits the fixed command.\n    let changed = migrateDestroyFlags(project);\n\n    if (!project.targets?.[TARGET]) {\n      changed =\n        (await addSandboxTarget(tree, projectName, project, nextSteps)) ||\n        changed;\n    }\n\n    if (changed) {\n      updateProjectConfiguration(tree, projectName, {\n        ...project,\n        targets: sortObjectKeys(project.targets),\n      });\n    }\n  }\n\n  migrateCdkCommandBuilder(tree, nextSteps);\n\n  await formatFilesInSubtree(tree);\n\n  return { nextSteps };\n}\n"],"names":["getProjects","joinPathFragments","updateProjectConfiguration","readFileSync","join","INFRA_APP_GENERATOR_INFO","captureGritQLVariable","formatFilesInSubtree","normalizeTargetKeyOrder","sortObjectKeys","PACKAGES_DIR","SHARED_SCRIPTS_DIR","TARGET","DESTROY_TARGETS","IGNORED_APPROVAL_FLAG","SANDBOX_STAGE_PATTERN","sandboxStageId","tree","projectRoot","captured","slice","withoutApprovalFlag","command","includes","undefined","test","replace","migrateDestroyFlags","project","changed","name","target","targets","options","CDK_COMMAND_PATH","CDK_COMMAND_TEMPLATE","dirname","migrateCdkCommandBuilder","nextSteps","exists","current","read","toString","push","write","addSandboxTarget","projectName","destroy","mainPath","root","stageId","executor","dependsOn","migration","generator","metadata","id"],"mappings":"AAAA;;;CAGC,GACD,SACEA,WAAW,EACXC,iBAAiB,EAIjBC,0BAA0B,QACrB,aAAa;AACpB,SAASC,YAAY,QAAQ,KAAK;AAClC,SAASC,IAAI,QAAQ,OAAO;AAC5B,SAASC,wBAAwB,QAAQ,kCAAkC;AAC3E,SAASC,qBAAqB,QAAQ,wBAAwB;AAC9D,SAASC,oBAAoB,QAAQ,2BAA2B;AAChE,SAASC,uBAAuB,QAAQ,uBAAuB;AAC/D,SAASC,cAAc,QAAQ,2BAA2B;AAC1D,SACEC,YAAY,EACZC,kBAAkB,QACb,gDAAgD;AAEvD;;;;;;;;;;;;;;;;;;CAkBC,GAED,MAAMC,SAAS;AAEf,2DAA2D,GAC3D,MAAMC,kBAAkB;IAAC;IAAW;CAAa;AAEjD,uEAAuE,GACvE,MAAMC,wBAAwB;AAE9B;;;;;;;;CAQC,GACD,MAAMC,wBACJ;AAEF,oEAAoE,GACpE,MAAMC,iBAAiB,OACrBC,MACAC;IAEA,MAAMC,WAAW,MAAMb,sBACrBW,MACAhB,kBAAkBiB,aAAa,OAAO,YACtCH,uBACA;IAEF,gDAAgD;IAChD,OAAOI,UAAUC,MAAM,GAAG,CAAC;AAC7B;AAEA;;;;CAIC,GACD,MAAMC,sBAAsB,CAACC;IAC3B,IAAI,OAAOA,YAAY,YAAY,CAACA,QAAQC,QAAQ,CAAC,gBAAgB;QACnE,OAAOC;IACT;IACA,IAAI,CAACV,sBAAsBW,IAAI,CAACH,UAAU,OAAOE;IACjD,OAAOF,QAAQI,OAAO,CAACZ,uBAAuB;AAChD;AAEA,wEAAwE,GACxE,MAAMa,sBAAsB,CAACC;IAC3B,IAAIC,UAAU;IACd,KAAK,MAAMC,QAAQjB,gBAAiB;QAClC,MAAMkB,SAASH,QAAQI,OAAO,EAAE,CAACF,KAAK;QACtC,MAAMR,UAAUD,oBAAoBU,QAAQE,SAASX;QACrD,IAAIA,SAAS;YACXS,OAAOE,OAAO,GAAG;gBAAE,GAAGF,OAAOE,OAAO;gBAAEX;YAAQ;YAC9CO,UAAU;QACZ;IACF;IACA,OAAOA;AACT;AAEA,sEAAsE,GACtE,MAAMK,mBAAmBjC,kBACvBS,cACAC,oBACA;AAGF,2EAA2E,GAC3E,MAAMwB,uBAAuBhC,aAC3BC,KACE,YAAYgC,OAAO,EACnB,4FAEF;AAGF;;;;CAIC,GACD,MAAMC,2BAA2B,CAACpB,MAAYqB;IAC5C,IAAI,CAACrB,KAAKsB,MAAM,CAACL,mBAAmB;IAEpC,MAAMM,UAAUvB,KAAKwB,IAAI,CAACP,kBAAmBQ,QAAQ;IACrD,4CAA4C;IAC5C,IAAIF,QAAQjB,QAAQ,CAAC,yBAAyB;IAE9C,IAAI,CAACiB,QAAQjB,QAAQ,CAAC,uBAAuB;QAC3Ce,UAAUK,IAAI,CACZ,GAAGT,iBAAiB,mJAAmJ,CAAC;QAE1K;IACF;IAEAjB,KAAK2B,KAAK,CAACV,kBAAkBC;AAC/B;AAEA,0EAA0E,GAC1E,MAAMU,mBAAmB,OACvB5B,MACA6B,aACAlB,SACAU;IAEA,6EAA6E;IAC7E,wEAAwE;IACxE,sDAAsD;IACtD,MAAMS,UAAUnB,QAAQI,OAAO,CAACe,OAAO;IACvC,MAAMzB,UAAUyB,SAASd,SAASX;IAClC,MAAM0B,WAAW/C,kBAAkB2B,QAAQqB,IAAI,EAAE;IACjD,MAAMC,UAAU,MAAMlC,eAAeC,MAAMW,QAAQqB,IAAI;IAEvD,IAAI,OAAO3B,YAAY,UAAU;QAC/BgB,UAAUK,IAAI,CACZ,CAAC,OAAO,EAAE/B,OAAO,YAAY,EAAEkC,YAAY,gGAAgG,CAAC;QAE9I,OAAO;IACT;IACA,IAAI,CAACI,SAAS;QACZZ,UAAUK,IAAI,CACZ,CAAC,OAAO,EAAE/B,OAAO,YAAY,EAAEkC,YAAY,sDAAsD,EAAEE,SAAS,CAAC,CAAC;QAEhH,OAAO;IACT;IAEApB,QAAQI,OAAO,CAACpB,OAAO,GAAGJ,wBAAwB;QAChD2C,UAAUJ,QAAQI,QAAQ;QAC1B,GAAIJ,QAAQK,SAAS,GAAG;YAAEA,WAAW;mBAAIL,QAAQK,SAAS;aAAC;QAAC,IAAI,CAAC,CAAC;QAClE,6CAA6C;QAC7CnB,SAAS;YAAE,GAAGc,QAAQd,OAAO;YAAEX,SAAS,GAAGA,QAAQ,EAAE,EAAE4B,QAAQ,GAAG,CAAC;QAAC;IACtE;IACA,OAAO;AACT;AAEA,eAAe,eAAeG,UAC5BpC,IAAU;IAEV,MAAMqB,YAAsB,EAAE;IAE9B,KAAK,MAAM,CAACQ,aAAalB,QAAQ,IAAI5B,YAAYiB,MAAO;QACtD,MAAMqC,YAAa1B,QAAQ2B,QAAQ,EAC/BD;QACJ,oCAAoC;QACpC,IAAIA,cAAcjD,yBAAyBmD,EAAE,EAAE;QAE/C,gEAAgE;QAChE,IAAI3B,UAAUF,oBAAoBC;QAElC,IAAI,CAACA,QAAQI,OAAO,EAAE,CAACpB,OAAO,EAAE;YAC9BiB,UACE,AAAC,MAAMgB,iBAAiB5B,MAAM6B,aAAalB,SAASU,cACpDT;QACJ;QAEA,IAAIA,SAAS;YACX3B,2BAA2Be,MAAM6B,aAAa;gBAC5C,GAAGlB,OAAO;gBACVI,SAASvB,eAAemB,QAAQI,OAAO;YACzC;QACF;IACF;IAEAK,yBAAyBpB,MAAMqB;IAE/B,MAAM/B,qBAAqBU;IAE3B,OAAO;QAAEqB;IAAU;AACrB"}

package/src/migrations/latest/terraform-rdb-proxy-iam-connect-grant/__snapshots__/migration.spec.ts.snap

@@ -0,0 +1,23 @@
+// Vitest Snapshot v1, https://vitest.dev/guide/snapshot.html
+
+exports[`terraform-rdb-proxy-iam-connect-grant migration > should replace the mysql admin secret grant with rds-db:connect 1`] = `
+"resource "aws_iam_role_policy" "proxy_db_user_connect" {
+  count = var.enable_rds_proxy ? 1 : 0
+
+  role = module.aurora.proxy_role_name
+
+  policy = jsonencode({
+    Version = "2012-10-17"
+    Statement = [
+      {
+        Effect = "Allow"
+        Action = ["rds-db:connect"]
+        Resource = [
+          "arn:aws:rds-db:\${data.aws_region.current.region}:\${data.aws_caller_identity.current.account_id}:dbuser:\${module.aurora.cluster_resource_id}/\${local.database_runtime_user}"
+        ]
+      }
+    ]
+  })
+}
+"
+`;

package/src/migrations/latest/terraform-rdb-proxy-iam-connect-grant/metadata.json

@@ -0,0 +1,3 @@
+{
+  "description": "Replace the MySQL RDS Proxy role's admin secret access with the rds-db:connect grant it needs for end-to-end IAM auth"
+}

package/src/migrations/latest/terraform-rdb-proxy-iam-connect-grant/migration.d.ts

@@ -0,0 +1,6 @@
+/**
+ * Copyright Amazon.com, Inc. or its affiliates. All Rights Reserved.
+ * SPDX-License-Identifier: Apache-2.0
+ */
+import { type MigrationReturnObject, type Tree } from '@nx/devkit';
+export default function migration(tree: Tree): Promise<MigrationReturnObject>;