@aws/nx-plugin 1.0.0-rc.86 → 1.0.0-rc.87

package/src/utils/rdb-constructs/files/cdk/app/dbs/__nameKebabCase__.ts.template

@@ -4,14 +4,14 @@ import { readFileSync } from 'fs';
 import { Construct } from 'constructs';
 import { Platform } from 'aws-cdk-lib/aws-ecr-assets';
 import {
-<%_ if (framework !== 'sqlmodel') { _%>
+<%_ if (framework === 'prisma') { _%>
   Code,
 <%_ } _%>
   DockerImageCode,
   DockerImageFunction,
   Function,
   FunctionOptions,
-<%_ if (framework !== 'sqlmodel') { _%>
+<%_ if (framework === 'prisma') { _%>
   Runtime,
 <%_ } _%>
 } from 'aws-cdk-lib/aws-lambda';
@@ -76,7 +76,7 @@ export class <%= nameClassName %> extends AuroraDatabase {
       ...baseProps,
       code: Code.fromAsset(createDbUserBundleDir),
       handler: 'index.handler',
-      runtime: Runtime.NODEJS_LATEST,
+      runtime: <%- nodeRuntime %>,
       environment: {
         NODE_EXTRA_CA_CERTS: '/var/runtime/ca-cert.pem',
       },

package/src/utils/rdb-constructs/files/terraform/app/dbs/__nameKebabCase__/__nameKebabCase__.tf.template

@@ -138,7 +138,7 @@ variable "create_db_user_docker_image_tag" {
 }
 <%_ } _%>
 
-<%_ if (framework !== 'sqlmodel') { _%>
+<%_ if (framework === 'prisma') { _%>
 variable "asset_bucket_name" {
   description = "Name of the shared asset S3 bucket used to stage the Lambda deployment zip. Instantiate the `core/asset-bucket` module once per deployment and pass its `bucket_name` output here."
   type        = string
@@ -157,7 +157,7 @@ resource "random_string" "suffix" {
 locals {
   config                       = jsondecode(file("${path.module}/../../../../../../../<%= projectRoot %>/config.json"))
   runtime_config_key           = local.config.runtimeConfigKey
-<%_ if (framework !== 'sqlmodel') { _%>
+<%_ if (framework === 'prisma') { _%>
   create_db_user_bundle_path   = "${path.module}/../../../../../../../<%- createDbUserBundleDir %>"
 <%_ } _%>
   migration_function_name      = "<%= nameKebabCase %>-migration-${random_string.suffix.result}"
@@ -198,22 +198,6 @@ resource "aws_iam_role_policy" "proxy_db_user_connect" {
   policy = jsonencode({
     Version = "2012-10-17"
     Statement = [
-<%_ if (engine === 'mysql' && framework !== 'sqlmodel') { _%>
-      {
-        Effect = "Allow"
-        Action = [
-          "secretsmanager:GetSecretValue"
-        ]
-        Resource = [module.aurora.secret_arn]
-      },
-      {
-        Effect = "Allow"
-        Action = [
-          "kms:Decrypt"
-        ]
-        Resource = [module.aurora.kms_key_arn]
-      }
-<%_ } else { _%>
       {
         Effect = "Allow"
         Action = ["rds-db:connect"]
@@ -221,12 +205,11 @@ resource "aws_iam_role_policy" "proxy_db_user_connect" {
           "arn:aws:rds-db:${data.aws_region.current.region}:${data.aws_caller_identity.current.account_id}:dbuser:${module.aurora.cluster_resource_id}/${local.database_runtime_user}"
         ]
       }
-<%_ } _%>
     ]
   })
 }
 
-<%_ if (framework !== 'sqlmodel') { _%>
+<%_ if (framework === 'prisma') { _%>
 data "archive_file" "create_db_user_zip" {
   type        = "zip"
   source_dir  = local.create_db_user_bundle_path
@@ -587,7 +570,7 @@ resource "aws_lambda_function" "create_db_user" {
   role              = aws_iam_role.create_db_user.arn
   handler           = "index.handler"
   source_code_hash  = data.archive_file.create_db_user_zip.output_base64sha256
-  runtime           = "nodejs24.x"
+  runtime           = "<%- nodeRuntime %>"
   timeout          = 300
   architectures    = ["arm64"]
 <%_ } _%>

package/src/utils/rdb-constructs/rdb-constructs.js

@@ -6,7 +6,7 @@ import { addStarExport } from "../ast.js";
 import { esmVars } from "../module-format.js";
 import { addDependencyToTargetIfNotPresent } from "../nx.js";
 import { PACKAGES_DIR, SHARED_CONSTRUCTS_DIR, SHARED_TERRAFORM_DIR } from "../shared-constructs-constants.js";
-import { terraformProviderVersions } from "../versions.js";
+import { cdkLambdaRuntimeVars, terraformLambdaRuntimeVars, terraformProviderVersions } from "../versions.js";
 /**
  * Aurora Serverless v2 scaling bounds, in ACUs, that both IaC providers derive
  * from so the same generator options vend the same ceiling regardless of `--iac`.
@@ -48,7 +48,8 @@ export const addRdbCdkConstructs = async (tree, options)=>{
     });
     generateFiles(tree, joinPathFragments(import.meta.dirname, 'files', 'cdk', 'app', 'dbs'), joinPathFragments(PACKAGES_DIR, SHARED_CONSTRUCTS_DIR, 'src', 'app', 'dbs'), {
         ...options,
-        ...esmVars(tree)
+        ...esmVars(tree),
+        ...cdkLambdaRuntimeVars()
     }, {
         overwriteStrategy: OverwriteStrategy.KeepExisting
     });
@@ -66,7 +67,8 @@ export const addRdbTerraformModules = (tree, options)=>{
     generateFiles(tree, joinPathFragments(import.meta.dirname, 'files', 'terraform', 'app', 'dbs'), joinPathFragments(PACKAGES_DIR, SHARED_TERRAFORM_DIR, 'src', 'app', 'dbs'), {
         ...options,
         ...terraformProviderVersions(),
-        ...auroraServerlessV2Capacity()
+        ...auroraServerlessV2Capacity(),
+        ...terraformLambdaRuntimeVars()
     }, {
         overwriteStrategy: OverwriteStrategy.KeepExisting
     });

package/src/utils/rdb-constructs/rdb-constructs.js.map

@@ -1 +1 @@
-{"version":3,"sources":["../../../../../../packages/nx-plugin/src/utils/rdb-constructs/rdb-constructs.ts"],"sourcesContent":["/**\n * Copyright Amazon.com, Inc. or its affiliates. All Rights Reserved.\n * SPDX-License-Identifier: Apache-2.0\n */\nimport {\n  generateFiles,\n  joinPathFragments,\n  OverwriteStrategy,\n  type ProjectConfiguration,\n  type Tree,\n  updateJson,\n} from '@nx/devkit';\nimport { addStarExport } from '../ast.js';\nimport type { Containers } from '../containers.js';\nimport type { Iac } from '../iac.js';\nimport { esmVars } from '../module-format.js';\nimport { addDependencyToTargetIfNotPresent } from '../nx.js';\nimport {\n  PACKAGES_DIR,\n  SHARED_CONSTRUCTS_DIR,\n  SHARED_TERRAFORM_DIR,\n} from '../shared-constructs-constants.js';\nimport { terraformProviderVersions } from '../versions.js';\n\n/**\n * Aurora Serverless v2 scaling bounds, in ACUs, that both IaC providers derive\n * from so the same generator options vend the same ceiling regardless of `--iac`.\n *\n * Set explicitly on CDK rather than inheriting `DatabaseClusterProps`, whose\n * default moves with `aws-cdk-lib`. Serverless v2 bills on ACUs consumed, not on\n * the ceiling, so the maximum is headroom rather than a cost commitment.\n */\nexport const AURORA_SERVERLESS_V2_CAPACITY = {\n  min: 0.5,\n  max: 4,\n} as const;\n\n/**\n * Substitution variables exposing the Aurora Serverless v2 scaling bounds to\n * generated CDK and Terraform templates.\n */\nconst auroraServerlessV2Capacity = () => ({\n  serverlessMinCapacity: AURORA_SERVERLESS_V2_CAPACITY.min,\n  serverlessMaxCapacity: AURORA_SERVERLESS_V2_CAPACITY.max,\n});\n\nexport interface AddRdbConstructOptions {\n  projectName: string;\n  projectRoot: string;\n  nameClassName: string;\n  nameKebabCase: string;\n  databasePackageAlias: string;\n  databaseName: string;\n  adminUser: string;\n  engine: 'postgres' | 'mysql';\n  migrationBundleDir: string;\n  /**\n   * Node.js zip bundle directory for the create-db-user Lambda (ts#rdb).\n   * When absent the migration Docker image is reused with the\n   * `create_db_user_handler.handler` command (py#rdb).\n   */\n  createDbUserBundleDir: string;\n  /** ORM framework used by the create-db-user Lambda. */\n  framework: 'prisma' | 'sqlmodel';\n  /** Local Docker tag for the Python create-db-user Lambda image. */\n  createDbUserDockerImageTag?: string;\n  /** Local Docker tag for the migration Lambda image. */\n  migrationDockerImageTag: string;\n  containerEngine: Containers;\n}\n\nexport const addRdbInfra = async (\n  tree: Tree,\n  options: AddRdbConstructOptions & { iac: Iac },\n) => {\n  if (options.iac === 'cdk') {\n    await addRdbCdkConstructs(tree, options);\n  } else if (options.iac === 'terraform') {\n    addRdbTerraformModules(tree, options);\n  } else {\n    throw new Error(`Unsupported iac ${options.iac}`);\n  }\n\n  updateJson(\n    tree,\n    joinPathFragments(\n      PACKAGES_DIR,\n      options.iac === 'cdk' ? SHARED_CONSTRUCTS_DIR : SHARED_TERRAFORM_DIR,\n      'project.json',\n    ),\n    (config: ProjectConfiguration) => {\n      addDependencyToTargetIfNotPresent(\n        config,\n        'build',\n        `${options.projectName}:build`,\n      );\n      return config;\n    },\n  );\n};\n\nexport const addRdbCdkConstructs = async (\n  tree: Tree,\n  options: AddRdbConstructOptions,\n) => {\n  generateFiles(\n    tree,\n    joinPathFragments(import.meta.dirname, 'files', 'cdk', 'core', 'rdb'),\n    joinPathFragments(\n      PACKAGES_DIR,\n      SHARED_CONSTRUCTS_DIR,\n      'src',\n      'core',\n      'rdb',\n    ),\n    { ...options, ...esmVars(tree), ...auroraServerlessV2Capacity() },\n    {\n      overwriteStrategy: OverwriteStrategy.KeepExisting,\n    },\n  );\n\n  generateFiles(\n    tree,\n    joinPathFragments(import.meta.dirname, 'files', 'cdk', 'app', 'dbs'),\n    joinPathFragments(PACKAGES_DIR, SHARED_CONSTRUCTS_DIR, 'src', 'app', 'dbs'),\n    { ...options, ...esmVars(tree) },\n    {\n      overwriteStrategy: OverwriteStrategy.KeepExisting,\n    },\n  );\n\n  await addStarExport(\n    tree,\n    joinPathFragments(\n      PACKAGES_DIR,\n      SHARED_CONSTRUCTS_DIR,\n      'src',\n      'core',\n      'index.ts',\n    ),\n    './rdb/aurora.js',\n  );\n  await addStarExport(\n    tree,\n    joinPathFragments(\n      PACKAGES_DIR,\n      SHARED_CONSTRUCTS_DIR,\n      'src',\n      'app',\n      'dbs',\n      'index.ts',\n    ),\n    `./${options.nameKebabCase}.js`,\n  );\n  await addStarExport(\n    tree,\n    joinPathFragments(\n      PACKAGES_DIR,\n      SHARED_CONSTRUCTS_DIR,\n      'src',\n      'app',\n      'index.ts',\n    ),\n    './dbs/index.js',\n  );\n};\n\nexport const addRdbTerraformModules = (\n  tree: Tree,\n  options: AddRdbConstructOptions,\n) => {\n  generateFiles(\n    tree,\n    joinPathFragments(import.meta.dirname, 'files', 'terraform', 'core', 'rdb'),\n    joinPathFragments(PACKAGES_DIR, SHARED_TERRAFORM_DIR, 'src', 'core', 'rdb'),\n    { ...terraformProviderVersions(), ...auroraServerlessV2Capacity() },\n    {\n      overwriteStrategy: OverwriteStrategy.KeepExisting,\n    },\n  );\n\n  generateFiles(\n    tree,\n    joinPathFragments(import.meta.dirname, 'files', 'terraform', 'app', 'dbs'),\n    joinPathFragments(PACKAGES_DIR, SHARED_TERRAFORM_DIR, 'src', 'app', 'dbs'),\n    {\n      ...options,\n      ...terraformProviderVersions(),\n      ...auroraServerlessV2Capacity(),\n    },\n    {\n      overwriteStrategy: OverwriteStrategy.KeepExisting,\n    },\n  );\n};\n"],"names":["generateFiles","joinPathFragments","OverwriteStrategy","updateJson","addStarExport","esmVars","addDependencyToTargetIfNotPresent","PACKAGES_DIR","SHARED_CONSTRUCTS_DIR","SHARED_TERRAFORM_DIR","terraformProviderVersions","AURORA_SERVERLESS_V2_CAPACITY","min","max","auroraServerlessV2Capacity","serverlessMinCapacity","serverlessMaxCapacity","addRdbInfra","tree","options","iac","addRdbCdkConstructs","addRdbTerraformModules","Error","config","projectName","dirname","overwriteStrategy","KeepExisting","nameKebabCase"],"mappings":"AAAA;;;CAGC,GACD,SACEA,aAAa,EACbC,iBAAiB,EACjBC,iBAAiB,EAGjBC,UAAU,QACL,aAAa;AACpB,SAASC,aAAa,QAAQ,YAAY;AAG1C,SAASC,OAAO,QAAQ,sBAAsB;AAC9C,SAASC,iCAAiC,QAAQ,WAAW;AAC7D,SACEC,YAAY,EACZC,qBAAqB,EACrBC,oBAAoB,QACf,oCAAoC;AAC3C,SAASC,yBAAyB,QAAQ,iBAAiB;AAE3D;;;;;;;CAOC,GACD,OAAO,MAAMC,gCAAgC;IAC3CC,KAAK;IACLC,KAAK;AACP,EAAW;AAEX;;;CAGC,GACD,MAAMC,6BAA6B,IAAO,CAAA;QACxCC,uBAAuBJ,8BAA8BC,GAAG;QACxDI,uBAAuBL,8BAA8BE,GAAG;IAC1D,CAAA;AA2BA,OAAO,MAAMI,cAAc,OACzBC,MACAC;IAEA,IAAIA,QAAQC,GAAG,KAAK,OAAO;QACzB,MAAMC,oBAAoBH,MAAMC;IAClC,OAAO,IAAIA,QAAQC,GAAG,KAAK,aAAa;QACtCE,uBAAuBJ,MAAMC;IAC/B,OAAO;QACL,MAAM,IAAII,MAAM,CAAC,gBAAgB,EAAEJ,QAAQC,GAAG,EAAE;IAClD;IAEAjB,WACEe,MACAjB,kBACEM,cACAY,QAAQC,GAAG,KAAK,QAAQZ,wBAAwBC,sBAChD,iBAEF,CAACe;QACClB,kCACEkB,QACA,SACA,GAAGL,QAAQM,WAAW,CAAC,MAAM,CAAC;QAEhC,OAAOD;IACT;AAEJ,EAAE;AAEF,OAAO,MAAMH,sBAAsB,OACjCH,MACAC;IAEAnB,cACEkB,MACAjB,kBAAkB,YAAYyB,OAAO,EAAE,SAAS,OAAO,QAAQ,QAC/DzB,kBACEM,cACAC,uBACA,OACA,QACA,QAEF;QAAE,GAAGW,OAAO;QAAE,GAAGd,QAAQa,KAAK;QAAE,GAAGJ,4BAA4B;IAAC,GAChE;QACEa,mBAAmBzB,kBAAkB0B,YAAY;IACnD;IAGF5B,cACEkB,MACAjB,kBAAkB,YAAYyB,OAAO,EAAE,SAAS,OAAO,OAAO,QAC9DzB,kBAAkBM,cAAcC,uBAAuB,OAAO,OAAO,QACrE;QAAE,GAAGW,OAAO;QAAE,GAAGd,QAAQa,KAAK;IAAC,GAC/B;QACES,mBAAmBzB,kBAAkB0B,YAAY;IACnD;IAGF,MAAMxB,cACJc,MACAjB,kBACEM,cACAC,uBACA,OACA,QACA,aAEF;IAEF,MAAMJ,cACJc,MACAjB,kBACEM,cACAC,uBACA,OACA,OACA,OACA,aAEF,CAAC,EAAE,EAAEW,QAAQU,aAAa,CAAC,GAAG,CAAC;IAEjC,MAAMzB,cACJc,MACAjB,kBACEM,cACAC,uBACA,OACA,OACA,aAEF;AAEJ,EAAE;AAEF,OAAO,MAAMc,yBAAyB,CACpCJ,MACAC;IAEAnB,cACEkB,MACAjB,kBAAkB,YAAYyB,OAAO,EAAE,SAAS,aAAa,QAAQ,QACrEzB,kBAAkBM,cAAcE,sBAAsB,OAAO,QAAQ,QACrE;QAAE,GAAGC,2BAA2B;QAAE,GAAGI,4BAA4B;IAAC,GAClE;QACEa,mBAAmBzB,kBAAkB0B,YAAY;IACnD;IAGF5B,cACEkB,MACAjB,kBAAkB,YAAYyB,OAAO,EAAE,SAAS,aAAa,OAAO,QACpEzB,kBAAkBM,cAAcE,sBAAsB,OAAO,OAAO,QACpE;QACE,GAAGU,OAAO;QACV,GAAGT,2BAA2B;QAC9B,GAAGI,4BAA4B;IACjC,GACA;QACEa,mBAAmBzB,kBAAkB0B,YAAY;IACnD;AAEJ,EAAE"}
+{"version":3,"sources":["../../../../../../packages/nx-plugin/src/utils/rdb-constructs/rdb-constructs.ts"],"sourcesContent":["/**\n * Copyright Amazon.com, Inc. or its affiliates. All Rights Reserved.\n * SPDX-License-Identifier: Apache-2.0\n */\nimport {\n  generateFiles,\n  joinPathFragments,\n  OverwriteStrategy,\n  type ProjectConfiguration,\n  type Tree,\n  updateJson,\n} from '@nx/devkit';\nimport { addStarExport } from '../ast.js';\nimport type { Containers } from '../containers.js';\nimport type { Iac } from '../iac.js';\nimport { esmVars } from '../module-format.js';\nimport { addDependencyToTargetIfNotPresent } from '../nx.js';\nimport {\n  PACKAGES_DIR,\n  SHARED_CONSTRUCTS_DIR,\n  SHARED_TERRAFORM_DIR,\n} from '../shared-constructs-constants.js';\nimport {\n  cdkLambdaRuntimeVars,\n  terraformLambdaRuntimeVars,\n  terraformProviderVersions,\n} from '../versions.js';\n\n/**\n * Aurora Serverless v2 scaling bounds, in ACUs, that both IaC providers derive\n * from so the same generator options vend the same ceiling regardless of `--iac`.\n *\n * Set explicitly on CDK rather than inheriting `DatabaseClusterProps`, whose\n * default moves with `aws-cdk-lib`. Serverless v2 bills on ACUs consumed, not on\n * the ceiling, so the maximum is headroom rather than a cost commitment.\n */\nexport const AURORA_SERVERLESS_V2_CAPACITY = {\n  min: 0.5,\n  max: 4,\n} as const;\n\n/**\n * Substitution variables exposing the Aurora Serverless v2 scaling bounds to\n * generated CDK and Terraform templates.\n */\nconst auroraServerlessV2Capacity = () => ({\n  serverlessMinCapacity: AURORA_SERVERLESS_V2_CAPACITY.min,\n  serverlessMaxCapacity: AURORA_SERVERLESS_V2_CAPACITY.max,\n});\n\nexport interface AddRdbConstructOptions {\n  projectName: string;\n  projectRoot: string;\n  nameClassName: string;\n  nameKebabCase: string;\n  databasePackageAlias: string;\n  databaseName: string;\n  adminUser: string;\n  engine: 'postgres' | 'mysql';\n  migrationBundleDir: string;\n  /**\n   * Node.js zip bundle directory for the create-db-user Lambda (ts#rdb).\n   * When absent the migration Docker image is reused with the\n   * `create_db_user_handler.handler` command (py#rdb).\n   */\n  createDbUserBundleDir: string;\n  /** ORM framework used by the create-db-user Lambda. */\n  framework: 'prisma' | 'sqlmodel';\n  /** Local Docker tag for the Python create-db-user Lambda image. */\n  createDbUserDockerImageTag?: string;\n  /** Local Docker tag for the migration Lambda image. */\n  migrationDockerImageTag: string;\n  containerEngine: Containers;\n}\n\nexport const addRdbInfra = async (\n  tree: Tree,\n  options: AddRdbConstructOptions & { iac: Iac },\n) => {\n  if (options.iac === 'cdk') {\n    await addRdbCdkConstructs(tree, options);\n  } else if (options.iac === 'terraform') {\n    addRdbTerraformModules(tree, options);\n  } else {\n    throw new Error(`Unsupported iac ${options.iac}`);\n  }\n\n  updateJson(\n    tree,\n    joinPathFragments(\n      PACKAGES_DIR,\n      options.iac === 'cdk' ? SHARED_CONSTRUCTS_DIR : SHARED_TERRAFORM_DIR,\n      'project.json',\n    ),\n    (config: ProjectConfiguration) => {\n      addDependencyToTargetIfNotPresent(\n        config,\n        'build',\n        `${options.projectName}:build`,\n      );\n      return config;\n    },\n  );\n};\n\nexport const addRdbCdkConstructs = async (\n  tree: Tree,\n  options: AddRdbConstructOptions,\n) => {\n  generateFiles(\n    tree,\n    joinPathFragments(import.meta.dirname, 'files', 'cdk', 'core', 'rdb'),\n    joinPathFragments(\n      PACKAGES_DIR,\n      SHARED_CONSTRUCTS_DIR,\n      'src',\n      'core',\n      'rdb',\n    ),\n    { ...options, ...esmVars(tree), ...auroraServerlessV2Capacity() },\n    {\n      overwriteStrategy: OverwriteStrategy.KeepExisting,\n    },\n  );\n\n  generateFiles(\n    tree,\n    joinPathFragments(import.meta.dirname, 'files', 'cdk', 'app', 'dbs'),\n    joinPathFragments(PACKAGES_DIR, SHARED_CONSTRUCTS_DIR, 'src', 'app', 'dbs'),\n    { ...options, ...esmVars(tree), ...cdkLambdaRuntimeVars() },\n    {\n      overwriteStrategy: OverwriteStrategy.KeepExisting,\n    },\n  );\n\n  await addStarExport(\n    tree,\n    joinPathFragments(\n      PACKAGES_DIR,\n      SHARED_CONSTRUCTS_DIR,\n      'src',\n      'core',\n      'index.ts',\n    ),\n    './rdb/aurora.js',\n  );\n  await addStarExport(\n    tree,\n    joinPathFragments(\n      PACKAGES_DIR,\n      SHARED_CONSTRUCTS_DIR,\n      'src',\n      'app',\n      'dbs',\n      'index.ts',\n    ),\n    `./${options.nameKebabCase}.js`,\n  );\n  await addStarExport(\n    tree,\n    joinPathFragments(\n      PACKAGES_DIR,\n      SHARED_CONSTRUCTS_DIR,\n      'src',\n      'app',\n      'index.ts',\n    ),\n    './dbs/index.js',\n  );\n};\n\nexport const addRdbTerraformModules = (\n  tree: Tree,\n  options: AddRdbConstructOptions,\n) => {\n  generateFiles(\n    tree,\n    joinPathFragments(import.meta.dirname, 'files', 'terraform', 'core', 'rdb'),\n    joinPathFragments(PACKAGES_DIR, SHARED_TERRAFORM_DIR, 'src', 'core', 'rdb'),\n    { ...terraformProviderVersions(), ...auroraServerlessV2Capacity() },\n    {\n      overwriteStrategy: OverwriteStrategy.KeepExisting,\n    },\n  );\n\n  generateFiles(\n    tree,\n    joinPathFragments(import.meta.dirname, 'files', 'terraform', 'app', 'dbs'),\n    joinPathFragments(PACKAGES_DIR, SHARED_TERRAFORM_DIR, 'src', 'app', 'dbs'),\n    {\n      ...options,\n      ...terraformProviderVersions(),\n      ...auroraServerlessV2Capacity(),\n      ...terraformLambdaRuntimeVars(),\n    },\n    {\n      overwriteStrategy: OverwriteStrategy.KeepExisting,\n    },\n  );\n};\n"],"names":["generateFiles","joinPathFragments","OverwriteStrategy","updateJson","addStarExport","esmVars","addDependencyToTargetIfNotPresent","PACKAGES_DIR","SHARED_CONSTRUCTS_DIR","SHARED_TERRAFORM_DIR","cdkLambdaRuntimeVars","terraformLambdaRuntimeVars","terraformProviderVersions","AURORA_SERVERLESS_V2_CAPACITY","min","max","auroraServerlessV2Capacity","serverlessMinCapacity","serverlessMaxCapacity","addRdbInfra","tree","options","iac","addRdbCdkConstructs","addRdbTerraformModules","Error","config","projectName","dirname","overwriteStrategy","KeepExisting","nameKebabCase"],"mappings":"AAAA;;;CAGC,GACD,SACEA,aAAa,EACbC,iBAAiB,EACjBC,iBAAiB,EAGjBC,UAAU,QACL,aAAa;AACpB,SAASC,aAAa,QAAQ,YAAY;AAG1C,SAASC,OAAO,QAAQ,sBAAsB;AAC9C,SAASC,iCAAiC,QAAQ,WAAW;AAC7D,SACEC,YAAY,EACZC,qBAAqB,EACrBC,oBAAoB,QACf,oCAAoC;AAC3C,SACEC,oBAAoB,EACpBC,0BAA0B,EAC1BC,yBAAyB,QACpB,iBAAiB;AAExB;;;;;;;CAOC,GACD,OAAO,MAAMC,gCAAgC;IAC3CC,KAAK;IACLC,KAAK;AACP,EAAW;AAEX;;;CAGC,GACD,MAAMC,6BAA6B,IAAO,CAAA;QACxCC,uBAAuBJ,8BAA8BC,GAAG;QACxDI,uBAAuBL,8BAA8BE,GAAG;IAC1D,CAAA;AA2BA,OAAO,MAAMI,cAAc,OACzBC,MACAC;IAEA,IAAIA,QAAQC,GAAG,KAAK,OAAO;QACzB,MAAMC,oBAAoBH,MAAMC;IAClC,OAAO,IAAIA,QAAQC,GAAG,KAAK,aAAa;QACtCE,uBAAuBJ,MAAMC;IAC/B,OAAO;QACL,MAAM,IAAII,MAAM,CAAC,gBAAgB,EAAEJ,QAAQC,GAAG,EAAE;IAClD;IAEAnB,WACEiB,MACAnB,kBACEM,cACAc,QAAQC,GAAG,KAAK,QAAQd,wBAAwBC,sBAChD,iBAEF,CAACiB;QACCpB,kCACEoB,QACA,SACA,GAAGL,QAAQM,WAAW,CAAC,MAAM,CAAC;QAEhC,OAAOD;IACT;AAEJ,EAAE;AAEF,OAAO,MAAMH,sBAAsB,OACjCH,MACAC;IAEArB,cACEoB,MACAnB,kBAAkB,YAAY2B,OAAO,EAAE,SAAS,OAAO,QAAQ,QAC/D3B,kBACEM,cACAC,uBACA,OACA,QACA,QAEF;QAAE,GAAGa,OAAO;QAAE,GAAGhB,QAAQe,KAAK;QAAE,GAAGJ,4BAA4B;IAAC,GAChE;QACEa,mBAAmB3B,kBAAkB4B,YAAY;IACnD;IAGF9B,cACEoB,MACAnB,kBAAkB,YAAY2B,OAAO,EAAE,SAAS,OAAO,OAAO,QAC9D3B,kBAAkBM,cAAcC,uBAAuB,OAAO,OAAO,QACrE;QAAE,GAAGa,OAAO;QAAE,GAAGhB,QAAQe,KAAK;QAAE,GAAGV,sBAAsB;IAAC,GAC1D;QACEmB,mBAAmB3B,kBAAkB4B,YAAY;IACnD;IAGF,MAAM1B,cACJgB,MACAnB,kBACEM,cACAC,uBACA,OACA,QACA,aAEF;IAEF,MAAMJ,cACJgB,MACAnB,kBACEM,cACAC,uBACA,OACA,OACA,OACA,aAEF,CAAC,EAAE,EAAEa,QAAQU,aAAa,CAAC,GAAG,CAAC;IAEjC,MAAM3B,cACJgB,MACAnB,kBACEM,cACAC,uBACA,OACA,OACA,aAEF;AAEJ,EAAE;AAEF,OAAO,MAAMgB,yBAAyB,CACpCJ,MACAC;IAEArB,cACEoB,MACAnB,kBAAkB,YAAY2B,OAAO,EAAE,SAAS,aAAa,QAAQ,QACrE3B,kBAAkBM,cAAcE,sBAAsB,OAAO,QAAQ,QACrE;QAAE,GAAGG,2BAA2B;QAAE,GAAGI,4BAA4B;IAAC,GAClE;QACEa,mBAAmB3B,kBAAkB4B,YAAY;IACnD;IAGF9B,cACEoB,MACAnB,kBAAkB,YAAY2B,OAAO,EAAE,SAAS,aAAa,OAAO,QACpE3B,kBAAkBM,cAAcE,sBAAsB,OAAO,OAAO,QACpE;QACE,GAAGY,OAAO;QACV,GAAGT,2BAA2B;QAC9B,GAAGI,4BAA4B;QAC/B,GAAGL,4BAA4B;IACjC,GACA;QACEkB,mBAAmB3B,kBAAkB4B,YAAY;IACnD;AAEJ,EAAE"}

package/src/utils/version-upgrade-migration/sync-lambda-runtimes.d.ts

@@ -0,0 +1,28 @@
+/**
+ * Copyright Amazon.com, Inc. or its affiliates. All Rights Reserved.
+ * SPDX-License-Identifier: Apache-2.0
+ */
+import { type Tree } from '@nx/devkit';
+/**
+ * Sync the Lambda runtimes vended into the projects this plugin owns.
+ *
+ * The runtimes present are read from each file rather than compared against a
+ * list of what past releases vended, which would need maintaining by hand for the
+ * same reason the pin itself does.
+ */
+/** The IaC provider a vended file belongs to, decided by the directory it sits in. */
+export type VendedIac = 'cdk' | 'terraform';
+/**
+ * Sync the Lambda runtimes in the directories this plugin owns.
+ *
+ * A runtime below the pin is ours to move, as is a `_LATEST` alias — its value is
+ * decided by `aws-cdk-lib`, which is the drift this closes. A runtime at or ahead
+ * of the pin is the user's and is left, as is any Lambda outside these
+ * directories. One the rewrite cannot reach is reported instead.
+ *
+ * @returns the files changed, and the owned files still holding an older runtime
+ */
+export declare const syncLambdaRuntimes: (tree: Tree, dirs: Readonly<Record<VendedIac, string>>) => Promise<{
+    updated: string[];
+    diverged: string[];
+}>;

package/src/utils/version-upgrade-migration/sync-lambda-runtimes.js

@@ -0,0 +1,148 @@
+/**
+ * Copyright Amazon.com, Inc. or its affiliates. All Rights Reserved.
+ * SPDX-License-Identifier: Apache-2.0
+ */ import { visitNotIgnoredFiles } from "@nx/devkit";
+import { applyGritQL, captureAllGritQLVariable } from "../ast.js";
+import { cdkLambdaRuntime, LAMBDA_RUNTIME_VERSIONS, terraformLambdaRuntime } from "../versions.js";
+import { isVendedUpgrade } from "./vended-upgrade.js";
+/**
+ * GritQL binding the value of a `runtime` assignment.
+ *
+ * Structure is matched here and nowhere else: the binding is the runtime alone, so
+ * no caller re-derives the assignment around it, and a `runtime` that isn't a real
+ * property or attribute — inside a comment, say — never matches.
+ */ const RUNTIME_ASSIGNMENT = {
+    cdk: '`runtime: $value`',
+    terraform: 'language hcl\n`runtime = $value`'
+};
+/** `NODEJS_22_X` -> `22`, `PYTHON_3_14` -> `3.14`; undefined for an alias. */ const cdkMemberVersion = (member)=>/^NODEJS_(\d+)_X$/.exec(member)?.[1] ?? /^PYTHON_(\d+)_(\d+)$/.exec(member)?.slice(1).join('.');
+/**
+ * Read a bound CDK runtime, or undefined when the value is not a versioned managed
+ * runtime.
+ *
+ * GritQL has already established this is a `runtime` property and isolated its
+ * value, so the regex only reads that scalar.
+ */ const readCdkRuntime = (value)=>{
+    const member = /^(?:lambda\.)?Runtime\.((?:NODEJS|PYTHON)_[A-Z0-9_]+)$/.exec(value.trim())?.[1];
+    if (!member) {
+        return undefined;
+    }
+    return {
+        value: value.trim(),
+        language: member.startsWith('NODEJS') ? 'node' : 'python',
+        version: cdkMemberVersion(member)
+    };
+};
+/** Read a bound Terraform runtime, or undefined for a non-runtime value. */ const readTerraformRuntime = (value)=>{
+    const identifier = /^"((?:nodejs|python)[0-9][^"]*)"$/.exec(value.trim())?.[1];
+    if (!identifier) {
+        return undefined;
+    }
+    return {
+        value: value.trim(),
+        language: identifier.startsWith('nodejs') ? 'node' : 'python',
+        version: /^nodejs([\d.]+?)\.x$/.exec(identifier)?.[1] ?? /^python([\d.]+)$/.exec(identifier)?.[1]
+    };
+};
+/**
+ * Every runtime a vended file assigns, or undefined when the pattern could not be
+ * applied to it.
+ *
+ * The two are distinguished so a file the parser rejected is reported rather than
+ * mistaken for one with nothing to do, which would make this a silent no-op.
+ */ const declaredRuntimes = async (tree, path, iac)=>{
+    const values = await captureAllGritQLVariable(tree, path, RUNTIME_ASSIGNMENT[iac], 'value');
+    if (values === undefined) {
+        return undefined;
+    }
+    const read = iac === 'terraform' ? readTerraformRuntime : readCdkRuntime;
+    return values.flatMap((value)=>{
+        const runtime = read(value);
+        return runtime ? [
+            runtime
+        ] : [];
+    });
+};
+/**
+ * The runtime this release vends, written the way the declared one was.
+ *
+ * A namespace-imported construct writes `lambda.Runtime.X`, so the prefix on the
+ * declared value is carried over rather than dropped.
+ */ const vendedRuntime = (iac, declared)=>{
+    if (iac === 'terraform') {
+        return `"${terraformLambdaRuntime(declared.language)}"`;
+    }
+    const namespace = declared.value.startsWith('lambda.') ? 'lambda.' : '';
+    return `${namespace}${cdkLambdaRuntime(declared.language)}`;
+};
+/**
+ * Sync the Lambda runtimes in the directories this plugin owns.
+ *
+ * A runtime below the pin is ours to move, as is a `_LATEST` alias — its value is
+ * decided by `aws-cdk-lib`, which is the drift this closes. A runtime at or ahead
+ * of the pin is the user's and is left, as is any Lambda outside these
+ * directories. One the rewrite cannot reach is reported instead.
+ *
+ * @returns the files changed, and the owned files still holding an older runtime
+ */ export const syncLambdaRuntimes = async (tree, dirs)=>{
+    const updated = [];
+    const diverged = [];
+    for (const [iac, dir] of Object.entries(dirs)){
+        if (!tree.exists(dir)) {
+            continue;
+        }
+        const extension = iac === 'terraform' ? '.tf' : '.ts';
+        const files = [];
+        // Started at the owned directory, so the provider follows from where a file
+        // sits rather than being inferred from it.
+        visitNotIgnoredFiles(tree, dir, (path)=>{
+            if (path.endsWith(extension)) {
+                files.push(path);
+            }
+        });
+        for (const path of files){
+            const declared = await declaredRuntimes(tree, path, iac);
+            if (declared === undefined) {
+                diverged.push(path);
+                continue;
+            }
+            let changed = false;
+            let stale = false;
+            // Deduped: one rewrite covers every occurrence of the same value.
+            const seen = new Set();
+            for (const runtime of declared){
+                if (seen.has(runtime.value)) {
+                    continue;
+                }
+                seen.add(runtime.value);
+                const vended = vendedRuntime(iac, runtime);
+                if (runtime.value === vended) {
+                    continue;
+                }
+                // An alias carries no version to compare, and is always ours to pin.
+                if (runtime.version !== undefined && !isVendedUpgrade(LAMBDA_RUNTIME_VERSIONS[runtime.language], runtime.version)) {
+                    continue;
+                }
+                const assignment = iac === 'terraform' ? 'runtime = ' : 'runtime: ';
+                const prefix = iac === 'terraform' ? 'language hcl\n' : '';
+                if (await applyGritQL(tree, path, `${prefix}\`${assignment}${runtime.value}\` => \`${assignment}${vended}\``)) {
+                    changed = true;
+                } else {
+                    stale = true;
+                }
+            }
+            if (changed) {
+                updated.push(path);
+            }
+            if (stale) {
+                diverged.push(path);
+            }
+        }
+    }
+    return {
+        updated,
+        diverged
+    };
+};
+
+//# sourceMappingURL=sync-lambda-runtimes.js.map

package/src/utils/version-upgrade-migration/sync-lambda-runtimes.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../../../../../../packages/nx-plugin/src/utils/version-upgrade-migration/sync-lambda-runtimes.ts"],"sourcesContent":["/**\n * Copyright Amazon.com, Inc. or its affiliates. All Rights Reserved.\n * SPDX-License-Identifier: Apache-2.0\n */\nimport { type Tree, visitNotIgnoredFiles } from '@nx/devkit';\nimport { applyGritQL, captureAllGritQLVariable } from '../ast.js';\nimport {\n  cdkLambdaRuntime,\n  type ILambdaRuntime,\n  LAMBDA_RUNTIME_VERSIONS,\n  terraformLambdaRuntime,\n} from '../versions.js';\nimport { isVendedUpgrade } from './vended-upgrade.js';\n\n/**\n * Sync the Lambda runtimes vended into the projects this plugin owns.\n *\n * The runtimes present are read from each file rather than compared against a\n * list of what past releases vended, which would need maintaining by hand for the\n * same reason the pin itself does.\n */\n\n/** The IaC provider a vended file belongs to, decided by the directory it sits in. */\nexport type VendedIac = 'cdk' | 'terraform';\n\n/** A Lambda runtime a vended file declares. */\ninterface DeclaredRuntime {\n  /** The runtime as written, e.g. `lambda.Runtime.NODEJS_22_X` or `\"nodejs22.x\"`. */\n  readonly value: string;\n  readonly language: ILambdaRuntime;\n  /**\n   * Version the runtime names, or undefined for an alias like `NODEJS_LATEST`\n   * whose value `aws-cdk-lib` decides rather than this repo.\n   */\n  readonly version?: string;\n}\n\n/**\n * GritQL binding the value of a `runtime` assignment.\n *\n * Structure is matched here and nowhere else: the binding is the runtime alone, so\n * no caller re-derives the assignment around it, and a `runtime` that isn't a real\n * property or attribute — inside a comment, say — never matches.\n */\nconst RUNTIME_ASSIGNMENT: Record<VendedIac, string> = {\n  cdk: '`runtime: $value`',\n  terraform: 'language hcl\\n`runtime = $value`',\n};\n\n/** `NODEJS_22_X` -> `22`, `PYTHON_3_14` -> `3.14`; undefined for an alias. */\nconst cdkMemberVersion = (member: string): string | undefined =>\n  /^NODEJS_(\\d+)_X$/.exec(member)?.[1] ??\n  /^PYTHON_(\\d+)_(\\d+)$/.exec(member)?.slice(1).join('.');\n\n/**\n * Read a bound CDK runtime, or undefined when the value is not a versioned managed\n * runtime.\n *\n * GritQL has already established this is a `runtime` property and isolated its\n * value, so the regex only reads that scalar.\n */\nconst readCdkRuntime = (value: string): DeclaredRuntime | undefined => {\n  const member = /^(?:lambda\\.)?Runtime\\.((?:NODEJS|PYTHON)_[A-Z0-9_]+)$/.exec(\n    value.trim(),\n  )?.[1];\n  if (!member) {\n    return undefined;\n  }\n  return {\n    value: value.trim(),\n    language: member.startsWith('NODEJS') ? 'node' : 'python',\n    version: cdkMemberVersion(member),\n  };\n};\n\n/** Read a bound Terraform runtime, or undefined for a non-runtime value. */\nconst readTerraformRuntime = (value: string): DeclaredRuntime | undefined => {\n  const identifier = /^\"((?:nodejs|python)[0-9][^\"]*)\"$/.exec(\n    value.trim(),\n  )?.[1];\n  if (!identifier) {\n    return undefined;\n  }\n  return {\n    value: value.trim(),\n    language: identifier.startsWith('nodejs') ? 'node' : 'python',\n    version:\n      /^nodejs([\\d.]+?)\\.x$/.exec(identifier)?.[1] ??\n      /^python([\\d.]+)$/.exec(identifier)?.[1],\n  };\n};\n\n/**\n * Every runtime a vended file assigns, or undefined when the pattern could not be\n * applied to it.\n *\n * The two are distinguished so a file the parser rejected is reported rather than\n * mistaken for one with nothing to do, which would make this a silent no-op.\n */\nconst declaredRuntimes = async (\n  tree: Tree,\n  path: string,\n  iac: VendedIac,\n): Promise<DeclaredRuntime[] | undefined> => {\n  const values = await captureAllGritQLVariable(\n    tree,\n    path,\n    RUNTIME_ASSIGNMENT[iac],\n    'value',\n  );\n  if (values === undefined) {\n    return undefined;\n  }\n\n  const read = iac === 'terraform' ? readTerraformRuntime : readCdkRuntime;\n  return values.flatMap((value) => {\n    const runtime = read(value);\n    return runtime ? [runtime] : [];\n  });\n};\n\n/**\n * The runtime this release vends, written the way the declared one was.\n *\n * A namespace-imported construct writes `lambda.Runtime.X`, so the prefix on the\n * declared value is carried over rather than dropped.\n */\nconst vendedRuntime = (iac: VendedIac, declared: DeclaredRuntime): string => {\n  if (iac === 'terraform') {\n    return `\"${terraformLambdaRuntime(declared.language)}\"`;\n  }\n  const namespace = declared.value.startsWith('lambda.') ? 'lambda.' : '';\n  return `${namespace}${cdkLambdaRuntime(declared.language)}`;\n};\n\n/**\n * Sync the Lambda runtimes in the directories this plugin owns.\n *\n * A runtime below the pin is ours to move, as is a `_LATEST` alias — its value is\n * decided by `aws-cdk-lib`, which is the drift this closes. A runtime at or ahead\n * of the pin is the user's and is left, as is any Lambda outside these\n * directories. One the rewrite cannot reach is reported instead.\n *\n * @returns the files changed, and the owned files still holding an older runtime\n */\nexport const syncLambdaRuntimes = async (\n  tree: Tree,\n  dirs: Readonly<Record<VendedIac, string>>,\n): Promise<{ updated: string[]; diverged: string[] }> => {\n  const updated: string[] = [];\n  const diverged: string[] = [];\n\n  for (const [iac, dir] of Object.entries(dirs) as [VendedIac, string][]) {\n    if (!tree.exists(dir)) {\n      continue;\n    }\n    const extension = iac === 'terraform' ? '.tf' : '.ts';\n    const files: string[] = [];\n    // Started at the owned directory, so the provider follows from where a file\n    // sits rather than being inferred from it.\n    visitNotIgnoredFiles(tree, dir, (path) => {\n      if (path.endsWith(extension)) {\n        files.push(path);\n      }\n    });\n\n    for (const path of files) {\n      const declared = await declaredRuntimes(tree, path, iac);\n      if (declared === undefined) {\n        diverged.push(path);\n        continue;\n      }\n\n      let changed = false;\n      let stale = false;\n\n      // Deduped: one rewrite covers every occurrence of the same value.\n      const seen = new Set<string>();\n      for (const runtime of declared) {\n        if (seen.has(runtime.value)) {\n          continue;\n        }\n        seen.add(runtime.value);\n\n        const vended = vendedRuntime(iac, runtime);\n        if (runtime.value === vended) {\n          continue;\n        }\n        // An alias carries no version to compare, and is always ours to pin.\n        if (\n          runtime.version !== undefined &&\n          !isVendedUpgrade(\n            LAMBDA_RUNTIME_VERSIONS[runtime.language],\n            runtime.version,\n          )\n        ) {\n          continue;\n        }\n\n        const assignment = iac === 'terraform' ? 'runtime = ' : 'runtime: ';\n        const prefix = iac === 'terraform' ? 'language hcl\\n' : '';\n        if (\n          await applyGritQL(\n            tree,\n            path,\n            `${prefix}\\`${assignment}${runtime.value}\\` => \\`${assignment}${vended}\\``,\n          )\n        ) {\n          changed = true;\n        } else {\n          stale = true;\n        }\n      }\n\n      if (changed) {\n        updated.push(path);\n      }\n      if (stale) {\n        diverged.push(path);\n      }\n    }\n  }\n\n  return { updated, diverged };\n};\n"],"names":["visitNotIgnoredFiles","applyGritQL","captureAllGritQLVariable","cdkLambdaRuntime","LAMBDA_RUNTIME_VERSIONS","terraformLambdaRuntime","isVendedUpgrade","RUNTIME_ASSIGNMENT","cdk","terraform","cdkMemberVersion","member","exec","slice","join","readCdkRuntime","value","trim","undefined","language","startsWith","version","readTerraformRuntime","identifier","declaredRuntimes","tree","path","iac","values","read","flatMap","runtime","vendedRuntime","declared","namespace","syncLambdaRuntimes","dirs","updated","diverged","dir","Object","entries","exists","extension","files","endsWith","push","changed","stale","seen","Set","has","add","vended","assignment","prefix"],"mappings":"AAAA;;;CAGC,GACD,SAAoBA,oBAAoB,QAAQ,aAAa;AAC7D,SAASC,WAAW,EAAEC,wBAAwB,QAAQ,YAAY;AAClE,SACEC,gBAAgB,EAEhBC,uBAAuB,EACvBC,sBAAsB,QACjB,iBAAiB;AACxB,SAASC,eAAe,QAAQ,sBAAsB;AAyBtD;;;;;;CAMC,GACD,MAAMC,qBAAgD;IACpDC,KAAK;IACLC,WAAW;AACb;AAEA,4EAA4E,GAC5E,MAAMC,mBAAmB,CAACC,SACxB,mBAAmBC,IAAI,CAACD,SAAS,CAAC,EAAE,IACpC,uBAAuBC,IAAI,CAACD,SAASE,MAAM,GAAGC,KAAK;AAErD;;;;;;CAMC,GACD,MAAMC,iBAAiB,CAACC;IACtB,MAAML,SAAS,yDAAyDC,IAAI,CAC1EI,MAAMC,IAAI,KACT,CAAC,EAAE;IACN,IAAI,CAACN,QAAQ;QACX,OAAOO;IACT;IACA,OAAO;QACLF,OAAOA,MAAMC,IAAI;QACjBE,UAAUR,OAAOS,UAAU,CAAC,YAAY,SAAS;QACjDC,SAASX,iBAAiBC;IAC5B;AACF;AAEA,0EAA0E,GAC1E,MAAMW,uBAAuB,CAACN;IAC5B,MAAMO,aAAa,oCAAoCX,IAAI,CACzDI,MAAMC,IAAI,KACT,CAAC,EAAE;IACN,IAAI,CAACM,YAAY;QACf,OAAOL;IACT;IACA,OAAO;QACLF,OAAOA,MAAMC,IAAI;QACjBE,UAAUI,WAAWH,UAAU,CAAC,YAAY,SAAS;QACrDC,SACE,uBAAuBT,IAAI,CAACW,aAAa,CAAC,EAAE,IAC5C,mBAAmBX,IAAI,CAACW,aAAa,CAAC,EAAE;IAC5C;AACF;AAEA;;;;;;CAMC,GACD,MAAMC,mBAAmB,OACvBC,MACAC,MACAC;IAEA,MAAMC,SAAS,MAAM1B,yBACnBuB,MACAC,MACAnB,kBAAkB,CAACoB,IAAI,EACvB;IAEF,IAAIC,WAAWV,WAAW;QACxB,OAAOA;IACT;IAEA,MAAMW,OAAOF,QAAQ,cAAcL,uBAAuBP;IAC1D,OAAOa,OAAOE,OAAO,CAAC,CAACd;QACrB,MAAMe,UAAUF,KAAKb;QACrB,OAAOe,UAAU;YAACA;SAAQ,GAAG,EAAE;IACjC;AACF;AAEA;;;;;CAKC,GACD,MAAMC,gBAAgB,CAACL,KAAgBM;IACrC,IAAIN,QAAQ,aAAa;QACvB,OAAO,CAAC,CAAC,EAAEtB,uBAAuB4B,SAASd,QAAQ,EAAE,CAAC,CAAC;IACzD;IACA,MAAMe,YAAYD,SAASjB,KAAK,CAACI,UAAU,CAAC,aAAa,YAAY;IACrE,OAAO,GAAGc,YAAY/B,iBAAiB8B,SAASd,QAAQ,GAAG;AAC7D;AAEA;;;;;;;;;CASC,GACD,OAAO,MAAMgB,qBAAqB,OAChCV,MACAW;IAEA,MAAMC,UAAoB,EAAE;IAC5B,MAAMC,WAAqB,EAAE;IAE7B,KAAK,MAAM,CAACX,KAAKY,IAAI,IAAIC,OAAOC,OAAO,CAACL,MAAgC;QACtE,IAAI,CAACX,KAAKiB,MAAM,CAACH,MAAM;YACrB;QACF;QACA,MAAMI,YAAYhB,QAAQ,cAAc,QAAQ;QAChD,MAAMiB,QAAkB,EAAE;QAC1B,4EAA4E;QAC5E,2CAA2C;QAC3C5C,qBAAqByB,MAAMc,KAAK,CAACb;YAC/B,IAAIA,KAAKmB,QAAQ,CAACF,YAAY;gBAC5BC,MAAME,IAAI,CAACpB;YACb;QACF;QAEA,KAAK,MAAMA,QAAQkB,MAAO;YACxB,MAAMX,WAAW,MAAMT,iBAAiBC,MAAMC,MAAMC;YACpD,IAAIM,aAAaf,WAAW;gBAC1BoB,SAASQ,IAAI,CAACpB;gBACd;YACF;YAEA,IAAIqB,UAAU;YACd,IAAIC,QAAQ;YAEZ,kEAAkE;YAClE,MAAMC,OAAO,IAAIC;YACjB,KAAK,MAAMnB,WAAWE,SAAU;gBAC9B,IAAIgB,KAAKE,GAAG,CAACpB,QAAQf,KAAK,GAAG;oBAC3B;gBACF;gBACAiC,KAAKG,GAAG,CAACrB,QAAQf,KAAK;gBAEtB,MAAMqC,SAASrB,cAAcL,KAAKI;gBAClC,IAAIA,QAAQf,KAAK,KAAKqC,QAAQ;oBAC5B;gBACF;gBACA,qEAAqE;gBACrE,IACEtB,QAAQV,OAAO,KAAKH,aACpB,CAACZ,gBACCF,uBAAuB,CAAC2B,QAAQZ,QAAQ,CAAC,EACzCY,QAAQV,OAAO,GAEjB;oBACA;gBACF;gBAEA,MAAMiC,aAAa3B,QAAQ,cAAc,eAAe;gBACxD,MAAM4B,SAAS5B,QAAQ,cAAc,mBAAmB;gBACxD,IACE,MAAM1B,YACJwB,MACAC,MACA,GAAG6B,OAAO,EAAE,EAAED,aAAavB,QAAQf,KAAK,CAAC,QAAQ,EAAEsC,aAAaD,OAAO,EAAE,CAAC,GAE5E;oBACAN,UAAU;gBACZ,OAAO;oBACLC,QAAQ;gBACV;YACF;YAEA,IAAID,SAAS;gBACXV,QAAQS,IAAI,CAACpB;YACf;YACA,IAAIsB,OAAO;gBACTV,SAASQ,IAAI,CAACpB;YAChB;QACF;IACF;IAEA,OAAO;QAAEW;QAASC;IAAS;AAC7B,EAAE"}

package/src/utils/version-upgrade-migration/sync-python-language-version.d.ts

@@ -0,0 +1,31 @@
+/**
+ * Copyright Amazon.com, Inc. or its affiliates. All Rights Reserved.
+ * SPDX-License-Identifier: Apache-2.0
+ */
+import { type Tree } from '@nx/devkit';
+/**
+ * Sync the Python language version a generated workspace builds and lints against
+ * to the Lambda Python runtime it deploys onto.
+ *
+ * These are workspace-wide rather than scoped to the infrastructure projects: uv
+ * writes a `.python-version` per Python project wherever it sits, and a bundle
+ * target lives in the project it belongs to.
+ */
+/**
+ * Sync the interpreter a uv project pins to the Lambda Python runtime.
+ *
+ * `.python-version` holds the exact interpreter and `[project].requires-python`
+ * its lower bound; Ruff's `target-version` is derived from the latter, so leaving
+ * these behind lints against a different version than the function runs on. Only
+ * moved forward, and only from a value this plugin vended.
+ */
+export declare const syncProjectPythonVersion: (tree: Tree) => string[];
+/**
+ * Sync the Python version a `bundle` target resolves wheels against.
+ *
+ * The target pins `--python-platform` but earlier releases pinned no
+ * `--python-version`, so wheels resolved against whichever interpreter the build
+ * machine had rather than the Lambda runtime. Both the missing flag and a stale
+ * one are corrected, keyed on the `uv pip install` the generators write.
+ */
+export declare const syncPythonBundleVersion: (tree: Tree) => string[];

package/src/utils/version-upgrade-migration/sync-python-language-version.js

@@ -0,0 +1,110 @@
+/**
+ * Copyright Amazon.com, Inc. or its affiliates. All Rights Reserved.
+ * SPDX-License-Identifier: Apache-2.0
+ */ import { updateJson, visitNotIgnoredFiles } from "@nx/devkit";
+import { updateToml } from "../toml.js";
+import { LAMBDA_RUNTIME_VERSIONS, pyenvPythonVersion, pyprojectPythonDependency } from "../versions.js";
+import { isVendedUpgrade } from "./vended-upgrade.js";
+/**
+ * Sync the Python language version a generated workspace builds and lints against
+ * to the Lambda Python runtime it deploys onto.
+ *
+ * These are workspace-wide rather than scoped to the infrastructure projects: uv
+ * writes a `.python-version` per Python project wherever it sits, and a bundle
+ * target lives in the project it belongs to.
+ */ /**
+ * Sync the interpreter a uv project pins to the Lambda Python runtime.
+ *
+ * `.python-version` holds the exact interpreter and `[project].requires-python`
+ * its lower bound; Ruff's `target-version` is derived from the latter, so leaving
+ * these behind lints against a different version than the function runs on. Only
+ * moved forward, and only from a value this plugin vended.
+ */ export const syncProjectPythonVersion = (tree)=>{
+    const updated = [];
+    const vendedInterpreter = pyenvPythonVersion();
+    const vendedRequires = pyprojectPythonDependency();
+    // Every `.python-version`, not just the root: uv writes one per project too,
+    // and a project left behind resolves a different interpreter than it deploys on.
+    visitNotIgnoredFiles(tree, '.', (path)=>{
+        if (path !== '.python-version' && !path.endsWith('/.python-version')) {
+            return;
+        }
+        const declared = (tree.read(path, 'utf-8') ?? '').trim();
+        if (declared && isVendedUpgrade(vendedInterpreter, declared)) {
+            tree.write(path, `${vendedInterpreter}\n`);
+            updated.push(path);
+        }
+    });
+    visitNotIgnoredFiles(tree, '.', (path)=>{
+        if (!path.endsWith('pyproject.toml')) {
+            return;
+        }
+        let changed = false;
+        updateToml(tree, path, (toml)=>{
+            const project = toml.project;
+            const declared = project?.['requires-python'];
+            if (typeof declared !== 'string') {
+                return toml;
+            }
+            // Only the `>=<major>.<minor>` shape the generators write, so a specifier
+            // the user tightened or widened is theirs to keep.
+            const lower = /^>=\s*(\d+\.\d+)$/.exec(declared.trim());
+            if (lower && isVendedUpgrade(LAMBDA_RUNTIME_VERSIONS.python, lower[1])) {
+                project['requires-python'] = vendedRequires;
+                changed = true;
+            }
+            return toml;
+        });
+        if (changed) {
+            updated.push(path);
+        }
+    });
+    return updated;
+};
+/**
+ * Sync the Python version a `bundle` target resolves wheels against.
+ *
+ * The target pins `--python-platform` but earlier releases pinned no
+ * `--python-version`, so wheels resolved against whichever interpreter the build
+ * machine had rather than the Lambda runtime. Both the missing flag and a stale
+ * one are corrected, keyed on the `uv pip install` the generators write.
+ */ export const syncPythonBundleVersion = (tree)=>{
+    const updated = [];
+    const vended = LAMBDA_RUNTIME_VERSIONS.python;
+    visitNotIgnoredFiles(tree, '.', (path)=>{
+        if (!path.endsWith('project.json')) {
+            return;
+        }
+        let changed = false;
+        updateJson(tree, path, (json)=>{
+            for (const target of Object.values(json.targets ?? {})){
+                const options = target.options;
+                if (!Array.isArray(options?.commands)) {
+                    continue;
+                }
+                options.commands = options.commands.map((command)=>{
+                    if (typeof command !== 'string' || !command.includes('uv pip install') || !command.includes('--python-platform')) {
+                        return command;
+                    }
+                    const declared = /--python-version (\S+)/.exec(command);
+                    if (!declared) {
+                        changed = true;
+                        return command.replace(/(--python-platform \S+)/, `$1 --python-version ${vended}`);
+                    }
+                    if (isVendedUpgrade(vended, declared[1])) {
+                        changed = true;
+                        return command.replace(/--python-version \S+/, `--python-version ${vended}`);
+                    }
+                    return command;
+                });
+            }
+            return json;
+        });
+        if (changed) {
+            updated.push(path);
+        }
+    });
+    return updated;
+};
+
+//# sourceMappingURL=sync-python-language-version.js.map

package/src/utils/version-upgrade-migration/sync-python-language-version.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../../../../../../packages/nx-plugin/src/utils/version-upgrade-migration/sync-python-language-version.ts"],"sourcesContent":["/**\n * Copyright Amazon.com, Inc. or its affiliates. All Rights Reserved.\n * SPDX-License-Identifier: Apache-2.0\n */\nimport { type Tree, updateJson, visitNotIgnoredFiles } from '@nx/devkit';\nimport { updateToml } from '../toml.js';\nimport {\n  LAMBDA_RUNTIME_VERSIONS,\n  pyenvPythonVersion,\n  pyprojectPythonDependency,\n} from '../versions.js';\nimport { isVendedUpgrade } from './vended-upgrade.js';\n\n/**\n * Sync the Python language version a generated workspace builds and lints against\n * to the Lambda Python runtime it deploys onto.\n *\n * These are workspace-wide rather than scoped to the infrastructure projects: uv\n * writes a `.python-version` per Python project wherever it sits, and a bundle\n * target lives in the project it belongs to.\n */\n\n/**\n * Sync the interpreter a uv project pins to the Lambda Python runtime.\n *\n * `.python-version` holds the exact interpreter and `[project].requires-python`\n * its lower bound; Ruff's `target-version` is derived from the latter, so leaving\n * these behind lints against a different version than the function runs on. Only\n * moved forward, and only from a value this plugin vended.\n */\nexport const syncProjectPythonVersion = (tree: Tree): string[] => {\n  const updated: string[] = [];\n  const vendedInterpreter = pyenvPythonVersion();\n  const vendedRequires = pyprojectPythonDependency();\n\n  // Every `.python-version`, not just the root: uv writes one per project too,\n  // and a project left behind resolves a different interpreter than it deploys on.\n  visitNotIgnoredFiles(tree, '.', (path) => {\n    if (path !== '.python-version' && !path.endsWith('/.python-version')) {\n      return;\n    }\n    const declared = (tree.read(path, 'utf-8') ?? '').trim();\n    if (declared && isVendedUpgrade(vendedInterpreter, declared)) {\n      tree.write(path, `${vendedInterpreter}\\n`);\n      updated.push(path);\n    }\n  });\n\n  visitNotIgnoredFiles(tree, '.', (path) => {\n    if (!path.endsWith('pyproject.toml')) {\n      return;\n    }\n    let changed = false;\n    updateToml(tree, path, (toml) => {\n      const project = toml.project as Record<string, unknown> | undefined;\n      const declared = project?.['requires-python'];\n      if (typeof declared !== 'string') {\n        return toml;\n      }\n      // Only the `>=<major>.<minor>` shape the generators write, so a specifier\n      // the user tightened or widened is theirs to keep.\n      const lower = /^>=\\s*(\\d+\\.\\d+)$/.exec(declared.trim());\n      if (lower && isVendedUpgrade(LAMBDA_RUNTIME_VERSIONS.python, lower[1])) {\n        project!['requires-python'] = vendedRequires;\n        changed = true;\n      }\n      return toml;\n    });\n    if (changed) {\n      updated.push(path);\n    }\n  });\n\n  return updated;\n};\n\n/**\n * Sync the Python version a `bundle` target resolves wheels against.\n *\n * The target pins `--python-platform` but earlier releases pinned no\n * `--python-version`, so wheels resolved against whichever interpreter the build\n * machine had rather than the Lambda runtime. Both the missing flag and a stale\n * one are corrected, keyed on the `uv pip install` the generators write.\n */\nexport const syncPythonBundleVersion = (tree: Tree): string[] => {\n  const updated: string[] = [];\n  const vended = LAMBDA_RUNTIME_VERSIONS.python;\n\n  visitNotIgnoredFiles(tree, '.', (path) => {\n    if (!path.endsWith('project.json')) {\n      return;\n    }\n    let changed = false;\n    updateJson(tree, path, (json) => {\n      for (const target of Object.values(\n        (json.targets ?? {}) as Record<string, { options?: unknown }>,\n      )) {\n        const options = target.options as { commands?: unknown[] } | undefined;\n        if (!Array.isArray(options?.commands)) {\n          continue;\n        }\n        options.commands = options.commands.map((command) => {\n          if (\n            typeof command !== 'string' ||\n            !command.includes('uv pip install') ||\n            !command.includes('--python-platform')\n          ) {\n            return command;\n          }\n          const declared = /--python-version (\\S+)/.exec(command);\n          if (!declared) {\n            changed = true;\n            return command.replace(\n              /(--python-platform \\S+)/,\n              `$1 --python-version ${vended}`,\n            );\n          }\n          if (isVendedUpgrade(vended, declared[1])) {\n            changed = true;\n            return command.replace(\n              /--python-version \\S+/,\n              `--python-version ${vended}`,\n            );\n          }\n          return command;\n        });\n      }\n      return json;\n    });\n    if (changed) {\n      updated.push(path);\n    }\n  });\n\n  return updated;\n};\n"],"names":["updateJson","visitNotIgnoredFiles","updateToml","LAMBDA_RUNTIME_VERSIONS","pyenvPythonVersion","pyprojectPythonDependency","isVendedUpgrade","syncProjectPythonVersion","tree","updated","vendedInterpreter","vendedRequires","path","endsWith","declared","read","trim","write","push","changed","toml","project","lower","exec","python","syncPythonBundleVersion","vended","json","target","Object","values","targets","options","Array","isArray","commands","map","command","includes","replace"],"mappings":"AAAA;;;CAGC,GACD,SAAoBA,UAAU,EAAEC,oBAAoB,QAAQ,aAAa;AACzE,SAASC,UAAU,QAAQ,aAAa;AACxC,SACEC,uBAAuB,EACvBC,kBAAkB,EAClBC,yBAAyB,QACpB,iBAAiB;AACxB,SAASC,eAAe,QAAQ,sBAAsB;AAEtD;;;;;;;CAOC,GAED;;;;;;;CAOC,GACD,OAAO,MAAMC,2BAA2B,CAACC;IACvC,MAAMC,UAAoB,EAAE;IAC5B,MAAMC,oBAAoBN;IAC1B,MAAMO,iBAAiBN;IAEvB,6EAA6E;IAC7E,iFAAiF;IACjFJ,qBAAqBO,MAAM,KAAK,CAACI;QAC/B,IAAIA,SAAS,qBAAqB,CAACA,KAAKC,QAAQ,CAAC,qBAAqB;YACpE;QACF;QACA,MAAMC,WAAW,AAACN,CAAAA,KAAKO,IAAI,CAACH,MAAM,YAAY,EAAC,EAAGI,IAAI;QACtD,IAAIF,YAAYR,gBAAgBI,mBAAmBI,WAAW;YAC5DN,KAAKS,KAAK,CAACL,MAAM,GAAGF,kBAAkB,EAAE,CAAC;YACzCD,QAAQS,IAAI,CAACN;QACf;IACF;IAEAX,qBAAqBO,MAAM,KAAK,CAACI;QAC/B,IAAI,CAACA,KAAKC,QAAQ,CAAC,mBAAmB;YACpC;QACF;QACA,IAAIM,UAAU;QACdjB,WAAWM,MAAMI,MAAM,CAACQ;YACtB,MAAMC,UAAUD,KAAKC,OAAO;YAC5B,MAAMP,WAAWO,SAAS,CAAC,kBAAkB;YAC7C,IAAI,OAAOP,aAAa,UAAU;gBAChC,OAAOM;YACT;YACA,0EAA0E;YAC1E,mDAAmD;YACnD,MAAME,QAAQ,oBAAoBC,IAAI,CAACT,SAASE,IAAI;YACpD,IAAIM,SAAShB,gBAAgBH,wBAAwBqB,MAAM,EAAEF,KAAK,CAAC,EAAE,GAAG;gBACtED,OAAQ,CAAC,kBAAkB,GAAGV;gBAC9BQ,UAAU;YACZ;YACA,OAAOC;QACT;QACA,IAAID,SAAS;YACXV,QAAQS,IAAI,CAACN;QACf;IACF;IAEA,OAAOH;AACT,EAAE;AAEF;;;;;;;CAOC,GACD,OAAO,MAAMgB,0BAA0B,CAACjB;IACtC,MAAMC,UAAoB,EAAE;IAC5B,MAAMiB,SAASvB,wBAAwBqB,MAAM;IAE7CvB,qBAAqBO,MAAM,KAAK,CAACI;QAC/B,IAAI,CAACA,KAAKC,QAAQ,CAAC,iBAAiB;YAClC;QACF;QACA,IAAIM,UAAU;QACdnB,WAAWQ,MAAMI,MAAM,CAACe;YACtB,KAAK,MAAMC,UAAUC,OAAOC,MAAM,CAC/BH,KAAKI,OAAO,IAAI,CAAC,GACjB;gBACD,MAAMC,UAAUJ,OAAOI,OAAO;gBAC9B,IAAI,CAACC,MAAMC,OAAO,CAACF,SAASG,WAAW;oBACrC;gBACF;gBACAH,QAAQG,QAAQ,GAAGH,QAAQG,QAAQ,CAACC,GAAG,CAAC,CAACC;oBACvC,IACE,OAAOA,YAAY,YACnB,CAACA,QAAQC,QAAQ,CAAC,qBAClB,CAACD,QAAQC,QAAQ,CAAC,sBAClB;wBACA,OAAOD;oBACT;oBACA,MAAMvB,WAAW,yBAAyBS,IAAI,CAACc;oBAC/C,IAAI,CAACvB,UAAU;wBACbK,UAAU;wBACV,OAAOkB,QAAQE,OAAO,CACpB,2BACA,CAAC,oBAAoB,EAAEb,QAAQ;oBAEnC;oBACA,IAAIpB,gBAAgBoB,QAAQZ,QAAQ,CAAC,EAAE,GAAG;wBACxCK,UAAU;wBACV,OAAOkB,QAAQE,OAAO,CACpB,wBACA,CAAC,iBAAiB,EAAEb,QAAQ;oBAEhC;oBACA,OAAOW;gBACT;YACF;YACA,OAAOV;QACT;QACA,IAAIR,SAAS;YACXV,QAAQS,IAAI,CAACN;QACf;IACF;IAEA,OAAOH;AACT,EAAE"}

package/src/utils/version-upgrade-migration/sync-vended-versions.js

@@ -6,15 +6,18 @@ import yaml from "js-yaml";
 import { getCatalogManager } from "nx/src/utils/catalog";
 import { parsePipRequirementsLine } from "pip-requirements-js";
 import { coerce, parse, satisfies, validRange } from "semver";
-import { applyGritQL, captureAllGritQL } from "../ast.js";
+import { applyGritQL, captureAllGritQLVariable } from "../ast.js";
 import { buildInstallCommand } from "../commands.js";
 import { formatFilesInSubtree } from "../format.js";
+import { PACKAGES_DIR, SHARED_CONSTRUCTS_DIR, SHARED_TERRAFORM_DIR } from "../shared-constructs-constants.js";
 import { updateToml } from "../toml.js";
-import { PY_VERSIONS, TERRAFORM_VERSIONS, TS_VERSIONS } from "../versions.js";
+import { cdkLambdaRuntime, PY_VERSIONS, TERRAFORM_VERSIONS, TS_VERSIONS, terraformLambdaRuntime } from "../versions.js";
 import { isNxPackage } from "./nx-package-updates.js";
 import { ownedDependencies } from "./owned-dependencies.js";
 import { syncEmbeddedVersions } from "./sync-embedded-versions.js";
+import { syncLambdaRuntimes } from "./sync-lambda-runtimes.js";
 import { syncMetricsVersion } from "./sync-metrics-version.js";
+import { syncProjectPythonVersion, syncPythonBundleVersion } from "./sync-python-language-version.js";
 import { isVendedUpgrade } from "./vended-upgrade.js";
 /**
  * Syncs the versions a generated workspace pins to those this release vends:
@@ -451,9 +454,9 @@ const syncOverrides = (tree, owned)=>{
  * `language hcl` is required — without it the pattern silently matches nothing.
  */ const providerVersionPattern = (provider, rewrite = '')=>`language hcl\n\`version = $version\`${rewrite} where {` + ` $version <: within \`{ source = "hashicorp/${provider}" $... }\` }`;
 /** Version a provider currently declares, if it declares one. */ const declaredProviderVersion = async (tree, path, provider)=>{
-    const [captured] = await captureAllGritQL(tree, path, providerVersionPattern(provider));
-    // The match is the whole attribute, e.g. `version = "6.40.0"`.
-    return /"([^"]+)"/.exec(captured ?? '')?.[1];
+    const [bound] = await captureAllGritQLVariable(tree, path, providerVersionPattern(provider), 'version') ?? [];
+    // The binding is the quoted version, e.g. `"6.40.0"`.
+    return bound?.replace(/^"|"$/g, '');
 };
 /** Sync vended provider versions in every `.tf` file. */ const syncTerraformProviders = async (tree)=>{
     const updated = [];
@@ -478,6 +481,16 @@ const syncOverrides = (tree, owned)=>{
     }
     return updated;
 };
+/**
+ * The projects this plugin generates infrastructure into, per provider.
+ *
+ * A runtime is not a dependency, so there is no per-package ownership to consult —
+ * these directories are the scope. A Lambda a user defined in their own project
+ * keeps whatever runtime they chose, even though it is the same shape.
+ */ const OWNED_INFRA_DIRS = {
+    cdk: `${PACKAGES_DIR}/${SHARED_CONSTRUCTS_DIR}`,
+    terraform: `${PACKAGES_DIR}/${SHARED_TERRAFORM_DIR}`
+};
 /**
  * Sync the versions this release vends, for the dependencies the workspace's
  * generators own.
@@ -489,6 +502,9 @@ const syncOverrides = (tree, owned)=>{
     const overrides = syncOverrides(tree, owned);
     const pyProjects = syncPyProjects(tree, owned);
     const terraformFiles = await syncTerraformProviders(tree);
+    const lambdaRuntimes = await syncLambdaRuntimes(tree, OWNED_INFRA_DIRS);
+    const projectPython = syncProjectPythonVersion(tree);
+    const pythonBundles = syncPythonBundleVersion(tree);
     const skippedEmbedded = await syncEmbeddedVersions(tree, owned);
     await syncMetricsVersion(tree);
     // Lock files are left to the user: `nx migrate` only installs when the root
@@ -496,8 +512,21 @@ const syncOverrides = (tree, owned)=>{
     if (catalogs.length > 0 || packageJsons.length > 0 || overrides.length > 0) {
         nextSteps.push(`TypeScript dependency versions were updated. Run \`${buildInstallCommand(detectPackageManager(tree.root))}\` to update the lock file.`);
     }
-    if (pyProjects.length > 0) {
-        nextSteps.push(`Python dependency versions were updated in ${pyProjects.join(', ')}. Run \`uv sync\` to update uv.lock.`);
+    if (pyProjects.length > 0 || projectPython.length > 0 || pythonBundles.length > 0) {
+        nextSteps.push(`Python dependency versions were updated in ${[
+            ...new Set([
+                ...pyProjects,
+                ...projectPython,
+                ...pythonBundles
+            ])
+        ].join(', ')}. Run \`uv sync\` to update uv.lock.`);
+    }
+    // A runtime the sync recognised is simply moved; one it doesn't recognise is
+    // the user's choice, so it is reported rather than rewritten.
+    if (lambdaRuntimes.diverged.length > 0) {
+        nextSteps.push(`Lambda runtimes in ${[
+            ...new Set(lambdaRuntimes.diverged)
+        ].join(', ')} have diverged from the generated shape and were left untouched. Set them to \`${cdkLambdaRuntime('node')}\` (CDK) or \`"${terraformLambdaRuntime('node')}"\` (Terraform) if you want them on the runtime this release vends.`);
     }
     if (terraformFiles.length > 0) {
         nextSteps.push(`Terraform provider versions were updated in ${terraformFiles.length} file(s). Run \`terraform init -upgrade\` in each Terraform project to update its lock file.`);