@aws/nx-plugin 1.0.0-rc.87 → 1.0.0-rc.88

package/migrations.json

@@ -2,81 +2,6 @@
   "$schema": "http://json-schema.org/schema",
   "name": "@aws/nx-plugin",
   "generators": {
-    "latest-dynamodb-configurable-encryption": {
-      "version": "1.0.0-rc.77",
-      "description": "Surface encryption and encryptionKey on the vended DynamoDBTable construct/module",
-      "implementation": "./src/migrations/latest/dynamodb-configurable-encryption/migration"
-    },
-    "latest-user-identity-configurable-mfa": {
-      "version": "1.0.0-rc.77",
-      "description": "Surface mfa and mfaSecondFactor on the vended UserIdentity construct/module",
-      "implementation": "./src/migrations/latest/user-identity-configurable-mfa/migration"
-    },
-    "latest-static-website-configurable-waf-encryption": {
-      "version": "1.0.0-rc.78",
-      "description": "Surface enableWaf, encryption, encryptionKey and enableKeyRotation on the vended StaticWebsite construct/module",
-      "implementation": "./src/migrations/latest/static-website-configurable-waf-encryption/migration"
-    },
-    "latest-py-agent-ag-ui-hooks": {
-      "version": "1.0.0-rc.79",
-      "description": "Forward the py#agent Strands hooks to the AG-UI adapter so model and tool errors are reported",
-      "implementation": "./src/migrations/latest/py-agent-ag-ui-hooks/migration"
-    },
-    "latest-terraform-load-runtime-config-src-path": {
-      "version": "1.0.0-rc.82",
-      "description": "Point the react website's terraform load-runtime-config target at the runtime-config file the terraform aggregation actually writes",
-      "implementation": "./src/migrations/latest/terraform-load-runtime-config-src-path/migration"
-    },
-    "latest-runtime-config-namespace-defaults": {
-      "version": "1.0.0-rc.82",
-      "description": "Provision AppConfig configuration profiles for every namespace the vended terraform modules write to",
-      "implementation": "./src/migrations/latest/runtime-config-namespace-defaults/migration"
-    },
-    "latest-dynamodb-terraform-app-module-outputs": {
-      "version": "1.0.0-rc.83",
-      "description": "Re-export the DynamoDB table and KMS key attributes from the vended Terraform per-table app module",
-      "implementation": "./src/migrations/latest/dynamodb-terraform-app-module-outputs/migration"
-    },
-    "latest-terraform-data-resource-destroy-protection": {
-      "version": "1.0.0-rc.83",
-      "description": "Add prevent_destroy and a 30 day KMS deletion window to the vended Terraform DynamoDB table and Aurora cluster modules",
-      "implementation": "./src/migrations/latest/terraform-data-resource-destroy-protection/migration"
-    },
-    "latest-terraform-gateway-cedar-render-root-ejs": {
-      "version": "1.0.0-rc.83",
-      "description": "Declare ejs at the workspace root so the Terraform gateway's Cedar render script resolves it",
-      "implementation": "./src/migrations/latest/terraform-gateway-cedar-render-root-ejs/migration"
-    },
-    "latest-rdb-terraform-aurora-app-module-defaults": {
-      "version": "1.0.0-rc.84",
-      "description": "Align the vended Terraform Aurora app module variable defaults with the core module, enabling CloudWatch engine log export and exposing enable_key_rotation",
-      "implementation": "./src/migrations/latest/rdb-terraform-aurora-app-module-defaults/migration"
-    },
-    "latest-agentcore-harness-no-tools-by-default": {
-      "version": "1.0.0-rc.84",
-      "description": "Pin the vended AgentCore Harness construct/module to no tools by default, since AgentCore treats an absent allowedTools as every tool",
-      "implementation": "./src/migrations/latest/agentcore-harness-no-tools-by-default/migration"
-    },
-    "latest-terraform-declare-used-providers": {
-      "version": "1.0.0-rc.84",
-      "description": "Declare every provider each vended Terraform module uses in its own required_providers",
-      "implementation": "./src/migrations/latest/terraform-declare-used-providers/migration"
-    },
-    "latest-waf-log-group-cmk-encryption": {
-      "version": "1.0.0-rc.84",
-      "description": "Encrypt vended WAF log groups with a customer-managed KMS key",
-      "implementation": "./src/migrations/latest/waf-log-group-cmk-encryption/migration"
-    },
-    "latest-terraform-harness-vpc-role-and-memory-grant": {
-      "version": "1.0.0-rc.84",
-      "description": "Add VPC, execution role and native field support to the vended Terraform AgentCore Harness module, and scope its managed-memory grant to the service-assigned ARN",
-      "implementation": "./src/migrations/latest/terraform-harness-vpc-role-and-memory-grant/migration"
-    },
-    "latest-terraform-project-checkov-target-and-bootstrap-destroy": {
-      "version": "1.0.0-rc.85",
-      "description": "Add the Terraform checkov target and config, make bootstrap-destroy non-interactive, and declare required_version in the vended providers.tf",
-      "implementation": "./src/migrations/latest/terraform-project-checkov-target-and-bootstrap-destroy/migration"
-    },
     "latest-add-destroy-sandbox-target": {
       "version": "1.0.0-rc.87",
       "description": "Add a destroy-sandbox target to CDK infrastructure projects which destroys the sandbox stage, and drop the --require-approval flag from cdk destroy, which has no such option",
@@ -87,6 +12,16 @@
       "description": "Replace the MySQL RDS Proxy role's admin secret access with the rds-db:connect grant it needs for end-to-end IAM auth",
       "implementation": "./src/migrations/latest/terraform-rdb-proxy-iam-connect-grant/migration"
     },
+    "latest-python-version-drop-exact-patch": {
+      "version": "1.0.0-rc.88",
+      "description": "Drop the exact CPython patch from .python-version to the Lambda runtime's major.minor",
+      "implementation": "./src/migrations/latest/python-version-drop-exact-patch/migration"
+    },
+    "latest-react-website-nx-react-express-override": {
+      "version": "1.0.0-rc.88",
+      "description": "Add an npm override pinning the express @nx/react resolves to the version generated websites use, so npm can satisfy its optional peer",
+      "implementation": "./src/migrations/latest/react-website-nx-react-express-override/migration"
+    },
     "v1.0.0-rc.50-0001-modernize-function-props-cast": {
       "version": "1.0.0-rc.50",
       "description": "Replace the legacy angle-bracket FunctionProps type assertion with the modern as syntax in generated API constructs",
@@ -227,8 +162,83 @@
       "description": "Extract the duplicated session-id Express middleware in ts#agent's ag-ui/a2a index.ts into a shared middleware/session-id-middleware.ts module",
       "implementation": "./src/migrations/v1.0.0-rc.75/0001-ts-agent-session-id-middleware-extraction/migration"
     },
+    "v1.0.0-rc.77-0001-dynamodb-configurable-encryption": {
+      "version": "1.0.0-rc.77",
+      "description": "Surface encryption and encryptionKey on the vended DynamoDBTable construct/module",
+      "implementation": "./src/migrations/v1.0.0-rc.77/0001-dynamodb-configurable-encryption/migration"
+    },
+    "v1.0.0-rc.77-0002-user-identity-configurable-mfa": {
+      "version": "1.0.0-rc.77",
+      "description": "Surface mfa and mfaSecondFactor on the vended UserIdentity construct/module",
+      "implementation": "./src/migrations/v1.0.0-rc.77/0002-user-identity-configurable-mfa/migration"
+    },
+    "v1.0.0-rc.78-0001-static-website-configurable-waf-encryption": {
+      "version": "1.0.0-rc.78",
+      "description": "Surface enableWaf, encryption, encryptionKey and enableKeyRotation on the vended StaticWebsite construct/module",
+      "implementation": "./src/migrations/v1.0.0-rc.78/0001-static-website-configurable-waf-encryption/migration"
+    },
+    "v1.0.0-rc.79-0001-py-agent-ag-ui-hooks": {
+      "version": "1.0.0-rc.79",
+      "description": "Forward the py#agent Strands hooks to the AG-UI adapter so model and tool errors are reported",
+      "implementation": "./src/migrations/v1.0.0-rc.79/0001-py-agent-ag-ui-hooks/migration"
+    },
+    "v1.0.0-rc.82-0001-terraform-load-runtime-config-src-path": {
+      "version": "1.0.0-rc.82",
+      "description": "Point the react website's terraform load-runtime-config target at the runtime-config file the terraform aggregation actually writes",
+      "implementation": "./src/migrations/v1.0.0-rc.82/0001-terraform-load-runtime-config-src-path/migration"
+    },
+    "v1.0.0-rc.82-0002-runtime-config-namespace-defaults": {
+      "version": "1.0.0-rc.82",
+      "description": "Provision AppConfig configuration profiles for every namespace the vended terraform modules write to",
+      "implementation": "./src/migrations/v1.0.0-rc.82/0002-runtime-config-namespace-defaults/migration"
+    },
+    "v1.0.0-rc.83-0001-dynamodb-terraform-app-module-outputs": {
+      "version": "1.0.0-rc.83",
+      "description": "Re-export the DynamoDB table and KMS key attributes from the vended Terraform per-table app module",
+      "implementation": "./src/migrations/v1.0.0-rc.83/0001-dynamodb-terraform-app-module-outputs/migration"
+    },
+    "v1.0.0-rc.83-0002-terraform-data-resource-destroy-protection": {
+      "version": "1.0.0-rc.83",
+      "description": "Add prevent_destroy and a 30 day KMS deletion window to the vended Terraform DynamoDB table and Aurora cluster modules",
+      "implementation": "./src/migrations/v1.0.0-rc.83/0002-terraform-data-resource-destroy-protection/migration"
+    },
+    "v1.0.0-rc.83-0003-terraform-gateway-cedar-render-root-ejs": {
+      "version": "1.0.0-rc.83",
+      "description": "Declare ejs at the workspace root so the Terraform gateway's Cedar render script resolves it",
+      "implementation": "./src/migrations/v1.0.0-rc.83/0003-terraform-gateway-cedar-render-root-ejs/migration"
+    },
+    "v1.0.0-rc.84-0001-rdb-terraform-aurora-app-module-defaults": {
+      "version": "1.0.0-rc.84",
+      "description": "Align the vended Terraform Aurora app module variable defaults with the core module, enabling CloudWatch engine log export and exposing enable_key_rotation",
+      "implementation": "./src/migrations/v1.0.0-rc.84/0001-rdb-terraform-aurora-app-module-defaults/migration"
+    },
+    "v1.0.0-rc.84-0002-agentcore-harness-no-tools-by-default": {
+      "version": "1.0.0-rc.84",
+      "description": "Pin the vended AgentCore Harness construct/module to no tools by default, since AgentCore treats an absent allowedTools as every tool",
+      "implementation": "./src/migrations/v1.0.0-rc.84/0002-agentcore-harness-no-tools-by-default/migration"
+    },
+    "v1.0.0-rc.84-0003-terraform-declare-used-providers": {
+      "version": "1.0.0-rc.84",
+      "description": "Declare every provider each vended Terraform module uses in its own required_providers",
+      "implementation": "./src/migrations/v1.0.0-rc.84/0003-terraform-declare-used-providers/migration"
+    },
+    "v1.0.0-rc.84-0004-waf-log-group-cmk-encryption": {
+      "version": "1.0.0-rc.84",
+      "description": "Encrypt vended WAF log groups with a customer-managed KMS key",
+      "implementation": "./src/migrations/v1.0.0-rc.84/0004-waf-log-group-cmk-encryption/migration"
+    },
+    "v1.0.0-rc.84-0005-terraform-harness-vpc-role-and-memory-grant": {
+      "version": "1.0.0-rc.84",
+      "description": "Add VPC, execution role and native field support to the vended Terraform AgentCore Harness module, and scope its managed-memory grant to the service-assigned ARN",
+      "implementation": "./src/migrations/v1.0.0-rc.84/0005-terraform-harness-vpc-role-and-memory-grant/migration"
+    },
+    "v1.0.0-rc.85-0001-terraform-project-checkov-target-and-bootstrap-destroy": {
+      "version": "1.0.0-rc.85",
+      "description": "Add the Terraform checkov target and config, make bootstrap-destroy non-interactive, and declare required_version in the vended providers.tf",
+      "implementation": "./src/migrations/v1.0.0-rc.85/0001-terraform-project-checkov-target-and-bootstrap-destroy/migration"
+    },
     "sync-vended-versions": {
-      "version": "1.0.0-rc.87",
+      "version": "1.0.0-rc.88",
       "description": "Sync vended dependency versions and the tracked plugin version to those vended by this release",
       "implementation": "./src/utils/version-upgrade-migration/migration"
     }
@@ -266,6 +276,39 @@
           "alwaysAddToPackageJson": false
         }
       }
+    },
+    "nx-23.1.2-nx-packages": {
+      "version": "1.0.0-rc.88",
+      "packages": {
+        "nx": {
+          "version": "23.1.2",
+          "alwaysAddToPackageJson": false
+        },
+        "@nx/devkit": {
+          "version": "23.1.2",
+          "alwaysAddToPackageJson": false
+        },
+        "@nx/js": {
+          "version": "23.1.2",
+          "alwaysAddToPackageJson": false
+        },
+        "@nx/react": {
+          "version": "23.1.2",
+          "alwaysAddToPackageJson": false
+        },
+        "@nx/vite": {
+          "version": "23.1.2",
+          "alwaysAddToPackageJson": false
+        },
+        "@nx/vitest": {
+          "version": "23.1.2",
+          "alwaysAddToPackageJson": false
+        },
+        "@nx/workspace": {
+          "version": "23.1.2",
+          "alwaysAddToPackageJson": false
+        }
+      }
     }
   }
 }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@aws/nx-plugin",
-  "version": "1.0.0-rc.87",
+  "version": "1.0.0-rc.88",
   "repository": {
     "type": "git",
     "url": "https://github.com/awslabs/nx-plugin-for-aws.git",
@@ -36,7 +36,7 @@
     "node": ">=20.19.0"
   },
   "peerDependencies": {
-    "nx": "23.1.1"
+    "nx": "23.1.2"
   },
   "dependencies": {
     "@apidevtools/swagger-parser": "12.1.0",
@@ -46,10 +46,10 @@
     "@getgrit/gritql": "0.0.3",
     "@iarna/toml": "2.2.5",
     "@modelcontextprotocol/sdk": "1.30.0",
-    "@nx/devkit": "23.1.1",
-    "@nx/js": "23.1.1",
-    "@nx/react": "23.1.1",
-    "@nx/vite": "23.1.1",
+    "@nx/devkit": "23.1.2",
+    "@nx/js": "23.1.2",
+    "@nx/react": "23.1.2",
+    "@nx/vite": "23.1.2",
     "@nxlv/python": "23.0.0",
     "@phenomnomnominal/tsquery": "6.2.0",
     "@types/estree": "1.0.9",
@@ -58,7 +58,7 @@
     "enquirer": "2.4.1",
     "fast-glob": "3.3.3",
     "jiti": "2.7.0",
-    "js-yaml": "4.3.1",
+    "js-yaml": "4.3.2",
     "license-checker-rseidelsohn": "4.4.2",
     "lodash.camelcase": "4.3.0",
     "lodash.clonedeepwith": "4.5.0",

package/src/agentcore-gateway/__snapshots__/generator.spec.ts.snap

@@ -7,7 +7,7 @@ exports[`agentcore-gateway generator > protocol: http > omits protocol_type from
   required_providers {
     aws = {
       source  = "hashicorp/aws"
-      version = "6.61.0"
+      version = "6.62.0"
     }
     time = {
       source  = "hashicorp/time"

package/src/infra/app/__snapshots__/generator.spec.ts.snap

@@ -4,8 +4,8 @@ exports[`infra generator > should add required dependencies to package.json > de
 
 exports[`infra generator > should add required dependencies to package.json > dev-dependencies 1`] = `
 {
-  "@nx/js": "23.1.1",
-  "@nx/vitest": "23.1.1",
+  "@nx/js": "23.1.2",
+  "@nx/vitest": "23.1.2",
   "@swc/helpers": "~0.5.18",
   "@types/node": "catalog:",
   "@vitest/coverage-v8": "catalog:",
@@ -23,8 +23,8 @@ exports[`infra generator > should add required dependencies to package.json > pa
 {
   "dependencies": {},
   "devDependencies": {
-    "@nx/js": "23.1.1",
-    "@nx/vitest": "23.1.1",
+    "@nx/js": "23.1.2",
+    "@nx/vitest": "23.1.2",
     "@swc/helpers": "~0.5.18",
     "@types/node": "catalog:",
     "@vitest/coverage-v8": "catalog:",
@@ -56,7 +56,7 @@ exports[`infra generator > should configure Checkov target correctly > checkov-t
     "{workspaceRoot}/dist/{projectRoot}/cdk.out",
   ],
   "options": {
-    "command": "uvx --from checkov==3.3.13 checkov --config-file {projectRoot}/checkov.yml --directory dist/{projectRoot}/cdk.out --framework cloudformation",
+    "command": "uvx --from checkov==3.3.15 checkov --config-file {projectRoot}/checkov.yml --directory dist/{projectRoot}/cdk.out --framework cloudformation",
   },
   "outputs": [
     "{workspaceRoot}/dist/{projectRoot}/checkov",
@@ -150,7 +150,7 @@ exports[`infra generator > should configure project.json with correct targets >
         "{workspaceRoot}/dist/{projectRoot}/cdk.out",
       ],
       "options": {
-        "command": "uvx --from checkov==3.3.13 checkov --config-file {projectRoot}/checkov.yml --directory dist/{projectRoot}/cdk.out --framework cloudformation",
+        "command": "uvx --from checkov==3.3.15 checkov --config-file {projectRoot}/checkov.yml --directory dist/{projectRoot}/cdk.out --framework cloudformation",
       },
       "outputs": [
         "{workspaceRoot}/dist/{projectRoot}/checkov",
@@ -756,7 +756,7 @@ exports[`infra generator > should handle custom project names correctly > custom
         "{workspaceRoot}/dist/{projectRoot}/cdk.out",
       ],
       "options": {
-        "command": "uvx --from checkov==3.3.13 checkov --config-file {projectRoot}/checkov.yml --directory dist/{projectRoot}/cdk.out --framework cloudformation",
+        "command": "uvx --from checkov==3.3.15 checkov --config-file {projectRoot}/checkov.yml --directory dist/{projectRoot}/cdk.out --framework cloudformation",
       },
       "outputs": [
         "{workspaceRoot}/dist/{projectRoot}/checkov",

package/src/migrations/latest/python-version-drop-exact-patch/metadata.json

@@ -0,0 +1,3 @@
+{
+  "description": "Drop the exact CPython patch from .python-version to the Lambda runtime's major.minor"
+}

package/src/migrations/latest/python-version-drop-exact-patch/migration.js

@@ -0,0 +1,43 @@
+/**
+ * Copyright Amazon.com, Inc. or its affiliates. All Rights Reserved.
+ * SPDX-License-Identifier: Apache-2.0
+ */ import { visitNotIgnoredFiles } from "@nx/devkit";
+import { formatFilesInSubtree } from "../../../utils/format.js";
+/**
+ * A `.python-version` naming an exact CPython patch resolves only where uv has a
+ * build of that patch: `3.14.7` installs on Linux but not on macOS, so `uv sync`
+ * fails there on a workspace that works elsewhere.
+ *
+ * uv reads a bare `major.minor` as a request for any patch of that minor, so
+ * dropping the patch lets each platform resolve a build it has. Lambda patches the
+ * interpreter itself, so the minor is the whole of what a project needs to pin.
+ *
+ * Only a patch of the minor the releases in question vended is dropped — another
+ * minor is the user's choice of interpreter, and the version sync moves the
+ * interpreter forward when the runtime's minor itself changes.
+ */ /**
+ * The Python runtime minor those releases vended, spelled out rather than read
+ * from `LAMBDA_RUNTIME_VERSIONS`.
+ *
+ * A migration describes a fixed point in history: it has to keep rewriting the
+ * versions those releases actually wrote, whatever the current pin is. Reading the
+ * live constant would silently retarget this at whatever minor the plugin vends by
+ * the time a user upgrades, and stop correcting the value it exists for.
+ */ const VENDED_MINOR = '3.14';
+export default async function migration(tree) {
+    // uv writes a `.python-version` per project as well as at the root, and one
+    // left behind fails `uv sync` for that project alone.
+    visitNotIgnoredFiles(tree, '.', (path)=>{
+        if (path !== '.python-version' && !path.endsWith('/.python-version')) {
+            return;
+        }
+        const declared = (tree.read(path, 'utf-8') ?? '').trim();
+        if (/^(\d+\.\d+)\.\d+$/.exec(declared)?.[1] === VENDED_MINOR) {
+            tree.write(path, `${VENDED_MINOR}\n`);
+        }
+    });
+    await formatFilesInSubtree(tree);
+    return {};
+}
+
+//# sourceMappingURL=migration.js.map

package/src/migrations/latest/python-version-drop-exact-patch/migration.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../../../../../../../packages/nx-plugin/src/migrations/latest/python-version-drop-exact-patch/migration.ts"],"sourcesContent":["/**\n * Copyright Amazon.com, Inc. or its affiliates. All Rights Reserved.\n * SPDX-License-Identifier: Apache-2.0\n */\nimport {\n  type MigrationReturnObject,\n  type Tree,\n  visitNotIgnoredFiles,\n} from '@nx/devkit';\nimport { formatFilesInSubtree } from '../../../utils/format.js';\n\n/**\n * A `.python-version` naming an exact CPython patch resolves only where uv has a\n * build of that patch: `3.14.7` installs on Linux but not on macOS, so `uv sync`\n * fails there on a workspace that works elsewhere.\n *\n * uv reads a bare `major.minor` as a request for any patch of that minor, so\n * dropping the patch lets each platform resolve a build it has. Lambda patches the\n * interpreter itself, so the minor is the whole of what a project needs to pin.\n *\n * Only a patch of the minor the releases in question vended is dropped — another\n * minor is the user's choice of interpreter, and the version sync moves the\n * interpreter forward when the runtime's minor itself changes.\n */\n\n/**\n * The Python runtime minor those releases vended, spelled out rather than read\n * from `LAMBDA_RUNTIME_VERSIONS`.\n *\n * A migration describes a fixed point in history: it has to keep rewriting the\n * versions those releases actually wrote, whatever the current pin is. Reading the\n * live constant would silently retarget this at whatever minor the plugin vends by\n * the time a user upgrades, and stop correcting the value it exists for.\n */\nconst VENDED_MINOR = '3.14';\n\nexport default async function migration(\n  tree: Tree,\n): Promise<MigrationReturnObject> {\n  // uv writes a `.python-version` per project as well as at the root, and one\n  // left behind fails `uv sync` for that project alone.\n  visitNotIgnoredFiles(tree, '.', (path) => {\n    if (path !== '.python-version' && !path.endsWith('/.python-version')) {\n      return;\n    }\n    const declared = (tree.read(path, 'utf-8') ?? '').trim();\n    if (/^(\\d+\\.\\d+)\\.\\d+$/.exec(declared)?.[1] === VENDED_MINOR) {\n      tree.write(path, `${VENDED_MINOR}\\n`);\n    }\n  });\n\n  await formatFilesInSubtree(tree);\n\n  return {};\n}\n"],"names":["visitNotIgnoredFiles","formatFilesInSubtree","VENDED_MINOR","migration","tree","path","endsWith","declared","read","trim","exec","write"],"mappings":"AAAA;;;CAGC,GACD,SAGEA,oBAAoB,QACf,aAAa;AACpB,SAASC,oBAAoB,QAAQ,2BAA2B;AAEhE;;;;;;;;;;;;CAYC,GAED;;;;;;;;CAQC,GACD,MAAMC,eAAe;AAErB,eAAe,eAAeC,UAC5BC,IAAU;IAEV,4EAA4E;IAC5E,sDAAsD;IACtDJ,qBAAqBI,MAAM,KAAK,CAACC;QAC/B,IAAIA,SAAS,qBAAqB,CAACA,KAAKC,QAAQ,CAAC,qBAAqB;YACpE;QACF;QACA,MAAMC,WAAW,AAACH,CAAAA,KAAKI,IAAI,CAACH,MAAM,YAAY,EAAC,EAAGI,IAAI;QACtD,IAAI,oBAAoBC,IAAI,CAACH,WAAW,CAAC,EAAE,KAAKL,cAAc;YAC5DE,KAAKO,KAAK,CAACN,MAAM,GAAGH,aAAa,EAAE,CAAC;QACtC;IACF;IAEA,MAAMD,qBAAqBG;IAE3B,OAAO,CAAC;AACV"}

package/src/migrations/latest/react-website-nx-react-express-override/metadata.json

@@ -0,0 +1,3 @@
+{
+  "description": "Add an npm override pinning the express @nx/react resolves to the version generated websites use, so npm can satisfy its optional peer"
+}

package/src/migrations/latest/react-website-nx-react-express-override/migration.d.ts

@@ -0,0 +1,31 @@
+/**
+ * Copyright Amazon.com, Inc. or its affiliates. All Rights Reserved.
+ * SPDX-License-Identifier: Apache-2.0
+ */
+import { type MigrationReturnObject, type Tree } from '@nx/devkit';
+/**
+ * Pin the `express` `@nx/react` resolves to the version generated websites use.
+ *
+ * `@nx/react` declares an optional `express` peer for its module-federation
+ * dev-server, on the major behind the `express` vended here. npm is alone in
+ * failing the whole install on an optional peer it cannot satisfy:
+ *
+ *   npm error ERESOLVE could not resolve
+ *   npm error   peerOptional express@"^4.21.2" from @nx/react
+ *   npm error Conflicting peer dependency: express@5.2.1
+ *
+ * so an npm workspace with a website cannot install once its nx moves onto a
+ * version carrying that peer. pnpm, bun and yarn only warn, and get nothing.
+ *
+ * Scoped to `@nx/react` rather than pinning `express` workspace-wide: nothing
+ * here loads it, the peer only has to be satisfiable, and a bare override would
+ * reach every other consumer of express too.
+ *
+ * Guardrails:
+ * - npm only, and only for a workspace that has a website — the root `@nx/react`
+ *   the generator adds. Anything else needs no override.
+ * - A user's own `overrides['@nx/react'].express` is left alone: theirs may pin a
+ *   version deliberately.
+ * - Idempotent: writing the same pin twice is a no-op.
+ */
+export default function migration(tree: Tree): Promise<MigrationReturnObject>;

package/src/migrations/latest/react-website-nx-react-express-override/migration.js

@@ -0,0 +1,74 @@
+/**
+ * Copyright Amazon.com, Inc. or its affiliates. All Rights Reserved.
+ * SPDX-License-Identifier: Apache-2.0
+ */ import { detectPackageManager, readJson, updateJson } from "@nx/devkit";
+import { formatFilesInSubtree } from "../../../utils/format.js";
+import { TS_VERSIONS } from "../../../utils/versions.js";
+/**
+ * Pin the `express` `@nx/react` resolves to the version generated websites use.
+ *
+ * `@nx/react` declares an optional `express` peer for its module-federation
+ * dev-server, on the major behind the `express` vended here. npm is alone in
+ * failing the whole install on an optional peer it cannot satisfy:
+ *
+ *   npm error ERESOLVE could not resolve
+ *   npm error   peerOptional express@"^4.21.2" from @nx/react
+ *   npm error Conflicting peer dependency: express@5.2.1
+ *
+ * so an npm workspace with a website cannot install once its nx moves onto a
+ * version carrying that peer. pnpm, bun and yarn only warn, and get nothing.
+ *
+ * Scoped to `@nx/react` rather than pinning `express` workspace-wide: nothing
+ * here loads it, the peer only has to be satisfiable, and a bare override would
+ * reach every other consumer of express too.
+ *
+ * Guardrails:
+ * - npm only, and only for a workspace that has a website — the root `@nx/react`
+ *   the generator adds. Anything else needs no override.
+ * - A user's own `overrides['@nx/react'].express` is left alone: theirs may pin a
+ *   version deliberately.
+ * - Idempotent: writing the same pin twice is a no-op.
+ */ export default async function migration(tree) {
+    const nextSteps = [];
+    if (detectPackageManager(tree.root) !== 'npm') {
+        return {
+            nextSteps
+        };
+    }
+    const packageJson = readJson(tree, 'package.json');
+    const hasNxReact = Boolean(packageJson.devDependencies?.['@nx/react'] ?? packageJson.dependencies?.['@nx/react']);
+    if (!hasNxReact) {
+        return {
+            nextSteps
+        }; // No website in this workspace.
+    }
+    const scoped = packageJson.overrides?.['@nx/react'];
+    // The string form pins `@nx/react` itself, leaving nowhere to nest the peer.
+    if (typeof scoped === 'string') {
+        nextSteps.push(`package.json: overrides['@nx/react'] pins a version as a string, so the express override could not be nested under it - left untouched. npm fails the install on @nx/react's optional express peer, so add { "@nx/react": { ".": "${scoped}", "express": "${TS_VERSIONS.express}" } } to keep it satisfiable.`);
+        return {
+            nextSteps
+        };
+    }
+    if (scoped?.express) {
+        return {
+            nextSteps
+        }; // Already pinned, by this migration or by the user.
+    }
+    updateJson(tree, 'package.json', (json)=>({
+            ...json,
+            overrides: {
+                ...json.overrides,
+                '@nx/react': {
+                    ...scoped,
+                    express: TS_VERSIONS.express
+                }
+            }
+        }));
+    await formatFilesInSubtree(tree);
+    return {
+        nextSteps
+    };
+}
+
+//# sourceMappingURL=migration.js.map

package/src/migrations/latest/react-website-nx-react-express-override/migration.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../../../../../../../packages/nx-plugin/src/migrations/latest/react-website-nx-react-express-override/migration.ts"],"sourcesContent":["/**\n * Copyright Amazon.com, Inc. or its affiliates. All Rights Reserved.\n * SPDX-License-Identifier: Apache-2.0\n */\nimport {\n  detectPackageManager,\n  type MigrationReturnObject,\n  readJson,\n  type Tree,\n  updateJson,\n} from '@nx/devkit';\nimport { formatFilesInSubtree } from '../../../utils/format';\nimport { TS_VERSIONS } from '../../../utils/versions';\n\n/**\n * Pin the `express` `@nx/react` resolves to the version generated websites use.\n *\n * `@nx/react` declares an optional `express` peer for its module-federation\n * dev-server, on the major behind the `express` vended here. npm is alone in\n * failing the whole install on an optional peer it cannot satisfy:\n *\n *   npm error ERESOLVE could not resolve\n *   npm error   peerOptional express@\"^4.21.2\" from @nx/react\n *   npm error Conflicting peer dependency: express@5.2.1\n *\n * so an npm workspace with a website cannot install once its nx moves onto a\n * version carrying that peer. pnpm, bun and yarn only warn, and get nothing.\n *\n * Scoped to `@nx/react` rather than pinning `express` workspace-wide: nothing\n * here loads it, the peer only has to be satisfiable, and a bare override would\n * reach every other consumer of express too.\n *\n * Guardrails:\n * - npm only, and only for a workspace that has a website — the root `@nx/react`\n *   the generator adds. Anything else needs no override.\n * - A user's own `overrides['@nx/react'].express` is left alone: theirs may pin a\n *   version deliberately.\n * - Idempotent: writing the same pin twice is a no-op.\n */\nexport default async function migration(\n  tree: Tree,\n): Promise<MigrationReturnObject> {\n  const nextSteps: string[] = [];\n\n  if (detectPackageManager(tree.root) !== 'npm') {\n    return { nextSteps };\n  }\n\n  const packageJson = readJson<{\n    devDependencies?: Record<string, string>;\n    dependencies?: Record<string, string>;\n    overrides?: Record<string, unknown>;\n  }>(tree, 'package.json');\n\n  const hasNxReact = Boolean(\n    packageJson.devDependencies?.['@nx/react'] ??\n      packageJson.dependencies?.['@nx/react'],\n  );\n  if (!hasNxReact) {\n    return { nextSteps }; // No website in this workspace.\n  }\n\n  const scoped = packageJson.overrides?.['@nx/react'] as\n    | Record<string, string>\n    | string\n    | undefined;\n\n  // The string form pins `@nx/react` itself, leaving nowhere to nest the peer.\n  if (typeof scoped === 'string') {\n    nextSteps.push(\n      `package.json: overrides['@nx/react'] pins a version as a string, so the express override could not be nested under it - left untouched. npm fails the install on @nx/react's optional express peer, so add { \"@nx/react\": { \".\": \"${scoped}\", \"express\": \"${TS_VERSIONS.express}\" } } to keep it satisfiable.`,\n    );\n    return { nextSteps };\n  }\n\n  if (scoped?.express) {\n    return { nextSteps }; // Already pinned, by this migration or by the user.\n  }\n\n  updateJson(tree, 'package.json', (json) => ({\n    ...json,\n    overrides: {\n      ...json.overrides,\n      '@nx/react': { ...scoped, express: TS_VERSIONS.express },\n    },\n  }));\n\n  await formatFilesInSubtree(tree);\n\n  return { nextSteps };\n}\n"],"names":["detectPackageManager","readJson","updateJson","formatFilesInSubtree","TS_VERSIONS","migration","tree","nextSteps","root","packageJson","hasNxReact","Boolean","devDependencies","dependencies","scoped","overrides","push","express","json"],"mappings":"AAAA;;;CAGC,GACD,SACEA,oBAAoB,EAEpBC,QAAQ,EAERC,UAAU,QACL,aAAa;AACpB,SAASC,oBAAoB,QAAQ,2BAAwB;AAC7D,SAASC,WAAW,QAAQ,6BAA0B;AAEtD;;;;;;;;;;;;;;;;;;;;;;;;CAwBC,GACD,eAAe,eAAeC,UAC5BC,IAAU;IAEV,MAAMC,YAAsB,EAAE;IAE9B,IAAIP,qBAAqBM,KAAKE,IAAI,MAAM,OAAO;QAC7C,OAAO;YAAED;QAAU;IACrB;IAEA,MAAME,cAAcR,SAIjBK,MAAM;IAET,MAAMI,aAAaC,QACjBF,YAAYG,eAAe,EAAE,CAAC,YAAY,IACxCH,YAAYI,YAAY,EAAE,CAAC,YAAY;IAE3C,IAAI,CAACH,YAAY;QACf,OAAO;YAAEH;QAAU,GAAG,gCAAgC;IACxD;IAEA,MAAMO,SAASL,YAAYM,SAAS,EAAE,CAAC,YAAY;IAKnD,6EAA6E;IAC7E,IAAI,OAAOD,WAAW,UAAU;QAC9BP,UAAUS,IAAI,CACZ,CAAC,kOAAkO,EAAEF,OAAO,eAAe,EAAEV,YAAYa,OAAO,CAAC,6BAA6B,CAAC;QAEjT,OAAO;YAAEV;QAAU;IACrB;IAEA,IAAIO,QAAQG,SAAS;QACnB,OAAO;YAAEV;QAAU,GAAG,oDAAoD;IAC5E;IAEAL,WAAWI,MAAM,gBAAgB,CAACY,OAAU,CAAA;YAC1C,GAAGA,IAAI;YACPH,WAAW;gBACT,GAAGG,KAAKH,SAAS;gBACjB,aAAa;oBAAE,GAAGD,MAAM;oBAAEG,SAASb,YAAYa,OAAO;gBAAC;YACzD;QACF,CAAA;IAEA,MAAMd,qBAAqBG;IAE3B,OAAO;QAAEC;IAAU;AACrB"}

package/src/migrations/v1.0.0-rc.77/0001-dynamodb-configurable-encryption/migration.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../../../../../../../packages/nx-plugin/src/migrations/v1.0.0-rc.77/0001-dynamodb-configurable-encryption/migration.ts"],"sourcesContent":["/**\n * Copyright Amazon.com, Inc. or its affiliates. All Rights Reserved.\n * SPDX-License-Identifier: Apache-2.0\n */\nimport {\n  joinPathFragments,\n  type MigrationReturnObject,\n  type Tree,\n} from '@nx/devkit';\nimport {\n  addDestructuredImport,\n  applyGritQL,\n  GRIT_INSERT_PLACEHOLDER,\n  insertViaGritQL,\n  matchGritQL,\n} from '../../../utils/ast.js';\nimport { formatFilesInSubtree } from '../../../utils/format.js';\nimport {\n  PACKAGES_DIR,\n  SHARED_CONSTRUCTS_DIR,\n  SHARED_TERRAFORM_DIR,\n} from '../../../utils/shared-constructs-constants.js';\n\n/**\n * Bring existing workspaces up to the generators' current DynamoDBTable\n * configurability:\n *\n * - The vended `DynamoDBTable` CDK construct gains `encryption` and\n *   `encryptionKey` props. The KMS key is only created when `encryption` is\n *   `TableEncryption.CUSTOMER_MANAGED` and no `encryptionKey` is supplied.\n *   `enableKeyRotation` (already present) only applies to that auto-created\n *   key.\n * - The generated per-table CDK app construct already forwards an optional\n *   `props` parameter through to `DynamoDBTable`, so no change is needed\n *   there.\n * - The vended Terraform dynamodb core module gains the equivalent\n *   `encryption`, `kms_key_arn` and `create_kms_key` variables (`encryption`\n *   also accepts `DEFAULT`, the AWS owned key, which CDK already supports for\n *   free via `TableEncryption.DEFAULT`), with the KMS key made conditional on\n *   `create_kms_key` (not on `kms_key_arn`'s nullness, which `count` can't\n *   depend on when the ARN comes from another resource) and\n *   `server_side_encryption.enabled` tied to `encryption`. `AWS_MANAGED`\n *   resolves to the explicit `alias/aws/dynamodb` ARN rather than `null`,\n *   since the provider's `kms_key_arn` is Optional+Computed and a `null`\n *   there means \"leave whatever is there\", not \"clear it\".\n * - The vended Terraform per-table app module (`app/dynamodb/<name>/<name>.tf`)\n *   gains pass-through `encryption`, `kms_key_arn` and `create_kms_key`\n *   variables forwarded to the core module call, matching its existing\n *   `enable_key_rotation` pass-through.\n *\n * These files are generated with `KeepExisting`, so without this an upgraded\n * workspace has generators that support this configuration but vended files\n * that don't. Diverged files are left untouched and reported via `nextSteps`.\n */\n\nconst CDK_DYNAMODB_FILE = `${PACKAGES_DIR}/${SHARED_CONSTRUCTS_DIR}/src/core/dynamodb.ts`;\nconst TERRAFORM_DYNAMODB_FILE = `${PACKAGES_DIR}/${SHARED_TERRAFORM_DIR}/src/core/dynamodb/dynamodb.tf`;\nconst TERRAFORM_DYNAMODB_APP_DIR = `${PACKAGES_DIR}/${SHARED_TERRAFORM_DIR}/src/app/dynamodb`;\n\nconst CDK_DIVERGED_MESSAGE = `${CDK_DYNAMODB_FILE}: has diverged from the generated shape - left untouched. To pick up the encryption and encryptionKey props, manually port them from the vended core/dynamodb.ts template (see the ts#dynamodb generator's DynamoDBTable construct).`;\n\nconst TERRAFORM_DIVERGED_MESSAGE = `${TERRAFORM_DYNAMODB_FILE}: has diverged from the generated shape - left untouched. To pick up the encryption and kms_key_arn variables, manually port them from the vended dynamodb.tf template (see the ts#dynamodb generator's dynamodb module).`;\n\nconst terraformAppDivergedMessage = (filePath: string) =>\n  `${filePath}: has diverged from the generated shape - left untouched. To make encryption and kms_key_arn configurable from your root Terraform configuration, add pass-through variables here and forward them to the dynamodb_table module call (see the ts#dynamodb generator's dynamodb app template).`;\n\n/**\n * Surface encryption/encryptionKey on the vended DynamoDBTable CDK\n * construct.\n */\nconst migrateCdkConstruct = async (\n  tree: Tree,\n  nextSteps: string[],\n): Promise<void> => {\n  if (!tree.exists(CDK_DYNAMODB_FILE)) {\n    return; // This workspace has no CDK DynamoDBTable construct.\n  }\n\n  if (\n    await matchGritQL(\n      tree,\n      CDK_DYNAMODB_FILE,\n      '`readonly encryption?: TableEncryption`',\n    )\n  ) {\n    return; // Already migrated.\n  }\n\n  const ENABLE_KEY_ROTATION_FIELD = '`readonly enableKeyRotation?: boolean`';\n  // Matched as a literal so the new fields can be inserted *before* it (see\n  // below) — GritQL doesn't include a leading comment in the span it matches\n  // for the field itself, so anchoring on the field would strand this\n  // comment above the newly-inserted fields instead of above the field it\n  // actually documents.\n  const ENABLE_KEY_ROTATION_COMMENT = `\\`/**\n   * Whether to enable automatic key rotation on the KMS key used to encrypt the table.\n   *\n   * @default true\n   */\\``;\n  const DESTRUCTURE_OLD = `\\`{\n      tableName,\n      runtimeConfigKey,\n      billingMode = BillingMode.PAY_PER_REQUEST,\n      pointInTimeRecoverySpecification = { pointInTimeRecoveryEnabled: true },\n      deletionProtection = true,\n      removalPolicy = RemovalPolicy.RETAIN,\n      enableKeyRotation = true,\n      ...rest\n    }: DynamoDBTableProps\\``;\n  const KEY_CREATION_OLD =\n    \"`const key = new Key(this, 'EncryptionKey', { enableKeyRotation });`\";\n  const TABLE_ENCRYPTION_OLD = '`encryption: TableEncryption.CUSTOMER_MANAGED`';\n\n  const anchors = [\n    ENABLE_KEY_ROTATION_FIELD,\n    ENABLE_KEY_ROTATION_COMMENT,\n    DESTRUCTURE_OLD,\n    KEY_CREATION_OLD,\n    TABLE_ENCRYPTION_OLD,\n  ];\n\n  const allPresent = (\n    await Promise.all(\n      anchors.map((pattern) => matchGritQL(tree, CDK_DYNAMODB_FILE, pattern)),\n    )\n  ).every(Boolean);\n\n  if (!allPresent) {\n    nextSteps.push(CDK_DIVERGED_MESSAGE);\n    return;\n  }\n\n  await addDestructuredImport(\n    tree,\n    CDK_DYNAMODB_FILE,\n    ['IKey'],\n    'aws-cdk-lib/aws-kms',\n  );\n\n  // Inserted before the enableKeyRotation field's own leading comment (rather\n  // than before the bare field) so that comment stays directly above the\n  // field it documents, instead of being stranded above the new fields.\n  await insertViaGritQL(\n    tree,\n    CDK_DYNAMODB_FILE,\n    `${ENABLE_KEY_ROTATION_COMMENT} as $comment => \\`${GRIT_INSERT_PLACEHOLDER}\n  $comment\\``,\n    `/**\n   * Server-side encryption for the table.\n   *\n   * @default TableEncryption.CUSTOMER_MANAGED\n   */\n  readonly encryption?: TableEncryption;\n\n  /**\n   * KMS key used to encrypt the table. Only used when \\`encryption\\` is\n   * \\`TableEncryption.CUSTOMER_MANAGED\\`. When not provided, a new key is created.\n   */\n  readonly encryptionKey?: IKey;\n\n  `,\n  );\n\n  // Update the enableKeyRotation field's own comment to note it now only\n  // applies to the auto-created key, matching the vended template exactly.\n  // Routed through the insert placeholder (rather than embedding the text\n  // directly in the GritQL rewrite) since the comment's own backticks would\n  // otherwise be parsed as GritQL code-block delimiters.\n  await insertViaGritQL(\n    tree,\n    CDK_DYNAMODB_FILE,\n    `${ENABLE_KEY_ROTATION_COMMENT} => \\`${GRIT_INSERT_PLACEHOLDER}\\``,\n    `/**\n   * Whether to enable automatic key rotation on the KMS key used to encrypt the table.\n   * Only applies when \\`encryption\\` is \\`TableEncryption.CUSTOMER_MANAGED\\` and no\n   * \\`encryptionKey\\` is supplied.\n   *\n   * @default true\n   */`,\n  );\n\n  await applyGritQL(\n    tree,\n    CDK_DYNAMODB_FILE,\n    `${DESTRUCTURE_OLD} => \\`{\n      tableName,\n      runtimeConfigKey,\n      billingMode = BillingMode.PAY_PER_REQUEST,\n      pointInTimeRecoverySpecification = { pointInTimeRecoveryEnabled: true },\n      deletionProtection = true,\n      removalPolicy = RemovalPolicy.RETAIN,\n      encryption = TableEncryption.CUSTOMER_MANAGED,\n      encryptionKey,\n      enableKeyRotation = true,\n      ...rest\n    }: DynamoDBTableProps\\``,\n  );\n\n  await applyGritQL(\n    tree,\n    CDK_DYNAMODB_FILE,\n    `${KEY_CREATION_OLD} => \\`const key: IKey | undefined =\n      encryption === TableEncryption.CUSTOMER_MANAGED\n        ? (encryptionKey ?? new Key(this, 'EncryptionKey', { enableKeyRotation }))\n        : undefined;\\``,\n  );\n\n  await applyGritQL(\n    tree,\n    CDK_DYNAMODB_FILE,\n    `${TABLE_ENCRYPTION_OLD} => \\`encryption\\``,\n  );\n};\n\nconst hcl = (pattern: string) => `language hcl\\n${pattern}`;\n\nconst NEW_TERRAFORM_VARIABLES_TEXT = [\n  'variable \"encryption\" {',\n  '  description = \"Server-side encryption for the table. One of CUSTOMER_MANAGED, AWS_MANAGED or DEFAULT (the AWS owned key, at no cost and with no key to manage). Changing this on an already-deployed table away from CUSTOMER_MANAGED requires a manual step first - see the ts#dynamodb generator docs.\"',\n  '  type        = string',\n  '  default     = \"CUSTOMER_MANAGED\"',\n  '',\n  '  validation {',\n  '    condition     = contains([\"CUSTOMER_MANAGED\", \"AWS_MANAGED\", \"DEFAULT\"], var.encryption)',\n  '    error_message = \"encryption must be one of CUSTOMER_MANAGED, AWS_MANAGED or DEFAULT.\"',\n  '  }',\n  '}',\n  '',\n  'variable \"kms_key_arn\" {',\n  '  description = \"ARN of an existing KMS key used to encrypt the table when encryption is CUSTOMER_MANAGED. When not provided and create_kms_key is true, a new key is created. Note that a customer-supplied key must already grant the DynamoDB service the necessary permissions in its own key policy.\"',\n  '  type        = string',\n  '  default     = null',\n  '}',\n  '',\n  'variable \"create_kms_key\" {',\n  '  description = \"Whether to create a KMS key for the table. Only applies when encryption is CUSTOMER_MANAGED. Set to false when supplying kms_key_arn.\"',\n  '  type        = bool',\n  '  default     = true',\n  '}',\n  '',\n  'variable \"enable_key_rotation\" {',\n  '  description = \"Whether to enable automatic key rotation on the KMS key used to encrypt the table. Only applies when encryption is CUSTOMER_MANAGED and create_kms_key is true.\"',\n  '  type        = bool',\n  '  default     = true',\n  '}',\n].join('\\n');\n\n/**\n * Surface encryption/kms_key_arn on the vended Terraform dynamodb core\n * module.\n */\nconst migrateTerraformModule = async (\n  tree: Tree,\n  nextSteps: string[],\n): Promise<void> => {\n  if (!tree.exists(TERRAFORM_DYNAMODB_FILE)) {\n    return; // This workspace has no Terraform dynamodb module.\n  }\n\n  if (\n    await matchGritQL(\n      tree,\n      TERRAFORM_DYNAMODB_FILE,\n      hcl('`variable \"encryption\" { $_ }`'),\n    )\n  ) {\n    return; // Already migrated.\n  }\n\n  const OLD_ENABLE_KEY_ROTATION_VAR = hcl(\n    [\n      '`variable \"enable_key_rotation\" {',\n      '  description = \"Whether to enable automatic key rotation on the KMS key used to encrypt the table.\"',\n      '  type        = bool',\n      '  default     = true',\n      '}`',\n    ].join('\\n'),\n  );\n  const LOCALS_BLOCK = hcl('`locals { $_ }`');\n  const DATA_PARTITION_LINE = hcl('`data \"aws_partition\" \"current\" {}`');\n  const KMS_KEY_BLOCK = hcl('`resource \"aws_kms_key\" \"table\" { $_ }`');\n  const SSE_ENABLED_LINE = hcl('`enabled = true`');\n  const SSE_KMS_KEY_LINE = hcl('`kms_key_arn = aws_kms_key.table.arn`');\n  const OUTPUT_VALUE_LINE = hcl('`value = aws_kms_key.table.arn`');\n  const OUTPUT_DESCRIPTION_LINE = hcl(\n    '`description = \"ARN of the KMS key used to encrypt the DynamoDB table.\"`',\n  );\n\n  const anchors = [\n    OLD_ENABLE_KEY_ROTATION_VAR,\n    LOCALS_BLOCK,\n    DATA_PARTITION_LINE,\n    KMS_KEY_BLOCK,\n    SSE_ENABLED_LINE,\n    SSE_KMS_KEY_LINE,\n    OUTPUT_VALUE_LINE,\n    OUTPUT_DESCRIPTION_LINE,\n  ];\n\n  const allPresent = (\n    await Promise.all(\n      anchors.map((pattern) =>\n        matchGritQL(tree, TERRAFORM_DYNAMODB_FILE, pattern),\n      ),\n    )\n  ).every(Boolean);\n\n  if (!allPresent) {\n    nextSteps.push(TERRAFORM_DIVERGED_MESSAGE);\n    return;\n  }\n\n  // 1. Replace the enable_key_rotation variable with the new variables plus\n  //    an updated enable_key_rotation description, in the same position.\n  await applyGritQL(\n    tree,\n    TERRAFORM_DYNAMODB_FILE,\n    `${OLD_ENABLE_KEY_ROTATION_VAR} => \\`${NEW_TERRAFORM_VARIABLES_TEXT.replace(/`/g, '\\\\`')}\\``,\n  );\n\n  // 2. New locals, appended into the existing locals block.\n  await insertViaGritQL(\n    tree,\n    TERRAFORM_DYNAMODB_FILE,\n    hcl(\n      `\\`locals { $body }\\` => \\`locals {\\n  $body\\n\\n  ${GRIT_INSERT_PLACEHOLDER}\\n}\\``,\n    ),\n    [\n      'create_table_key = var.encryption == \"CUSTOMER_MANAGED\" && var.create_kms_key',\n      'table_kms_key_arn = (',\n      '  var.encryption == \"CUSTOMER_MANAGED\" ? (local.create_table_key ? aws_kms_key.table[0].arn : var.kms_key_arn) :',\n      '  var.encryption == \"AWS_MANAGED\" ? \"arn:${data.aws_partition.current.partition}:kms:${data.aws_region.current.region}:${data.aws_caller_identity.current.account_id}:alias/aws/dynamodb\" :',\n      '  null',\n      ')',\n    ].join('\\n  '),\n  );\n\n  // 2b. Region is needed to resolve the AWS_MANAGED key's alias ARN above.\n  await insertViaGritQL(\n    tree,\n    TERRAFORM_DYNAMODB_FILE,\n    `${DATA_PARTITION_LINE} => \\`data \"aws_partition\" \"current\" {}\\n${GRIT_INSERT_PLACEHOLDER}\\``,\n    'data \"aws_region\" \"current\" {}',\n  );\n\n  // 3. Make the KMS key conditional on encryption/kms_key_arn.\n  await applyGritQL(\n    tree,\n    TERRAFORM_DYNAMODB_FILE,\n    hcl(`\\`resource \"aws_kms_key\" \"table\" { $body }\\` => \\`resource \"aws_kms_key\" \"table\" {\n  count = local.create_table_key ? 1 : 0\n\n  $body\n}\\``),\n  );\n\n  // 4. Only enable KMS-backed encryption when not using the AWS owned key.\n  await applyGritQL(\n    tree,\n    TERRAFORM_DYNAMODB_FILE,\n    `${SSE_ENABLED_LINE} => \\`enabled = var.encryption != \"DEFAULT\"\\``,\n  );\n\n  // 4b. Checkov's CKV_AWS_119 only passes when server_side_encryption.enabled\n  // is the literal `true` — it can't resolve the conditional above, even\n  // though CUSTOMER_MANAGED (the default) always uses a real CMK. Same\n  // false-positive shape as CKV_AWS_139 on the vended RDS module.\n  await insertViaGritQL(\n    tree,\n    TERRAFORM_DYNAMODB_FILE,\n    hcl(\n      `\\`resource \"aws_dynamodb_table\" \"table\" { $body }\\` => \\`resource \"aws_dynamodb_table\" \"table\" {\\n  ${GRIT_INSERT_PLACEHOLDER}\\n  $body\\n}\\``,\n    ),\n    '#checkov:skip=CKV_AWS_119:Encryption is configurable via var.encryption; checkov cannot resolve the conditional server_side_encryption.enabled expression',\n  );\n\n  // 5. Resolve the key ARN through the new local everywhere it's consumed.\n  await applyGritQL(\n    tree,\n    TERRAFORM_DYNAMODB_FILE,\n    `${SSE_KMS_KEY_LINE} => \\`kms_key_arn = local.table_kms_key_arn\\``,\n  );\n  await applyGritQL(\n    tree,\n    TERRAFORM_DYNAMODB_FILE,\n    `${OUTPUT_VALUE_LINE} => \\`value = local.table_kms_key_arn\\``,\n  );\n  await applyGritQL(\n    tree,\n    TERRAFORM_DYNAMODB_FILE,\n    `${OUTPUT_DESCRIPTION_LINE} => \\`description = \"ARN of the KMS key used to encrypt the DynamoDB table, or null when using the AWS owned key (encryption = DEFAULT).\"\\``,\n  );\n};\n\nconst NEW_APP_MODULE_VARIABLES_TEXT = [\n  'variable \"encryption\" {',\n  '  description = \"Server-side encryption for the table. One of CUSTOMER_MANAGED, AWS_MANAGED or DEFAULT (the AWS owned key, at no cost and with no key to manage). Changing this on an already-deployed table away from CUSTOMER_MANAGED requires a manual step first - see the ts#dynamodb generator docs.\"',\n  '  type        = string',\n  '  default     = \"CUSTOMER_MANAGED\"',\n  '',\n  '  validation {',\n  '    condition     = contains([\"CUSTOMER_MANAGED\", \"AWS_MANAGED\", \"DEFAULT\"], var.encryption)',\n  '    error_message = \"encryption must be one of CUSTOMER_MANAGED, AWS_MANAGED or DEFAULT.\"',\n  '  }',\n  '}',\n  '',\n  'variable \"kms_key_arn\" {',\n  '  description = \"ARN of an existing KMS key used to encrypt the table when encryption is CUSTOMER_MANAGED. When not provided and create_kms_key is true, a new key is created. Note that a customer-supplied key must already grant the DynamoDB service the necessary permissions in its own key policy.\"',\n  '  type        = string',\n  '  default     = null',\n  '}',\n  '',\n  'variable \"create_kms_key\" {',\n  '  description = \"Whether to create a KMS key for the table. Only applies when encryption is CUSTOMER_MANAGED. Set to false when supplying kms_key_arn.\"',\n  '  type        = bool',\n  '  default     = true',\n  '}',\n  '',\n  'variable \"enable_key_rotation\" {',\n  '  description = \"Whether to enable automatic key rotation on the KMS key used to encrypt the table. Only applies when encryption is CUSTOMER_MANAGED and create_kms_key is true.\"',\n  '  type        = bool',\n  '  default     = true',\n  '}',\n].join('\\n');\n\n/**\n * Surface the same configuration as pass-through variables on each vended\n * per-table Terraform app module, matching its existing pass-through\n * convention for enable_key_rotation.\n */\nconst migrateTerraformAppModules = async (\n  tree: Tree,\n  nextSteps: string[],\n): Promise<void> => {\n  if (!tree.exists(TERRAFORM_DYNAMODB_APP_DIR)) {\n    return;\n  }\n\n  for (const dirName of tree.children(TERRAFORM_DYNAMODB_APP_DIR)) {\n    const filePath = joinPathFragments(\n      TERRAFORM_DYNAMODB_APP_DIR,\n      dirName,\n      `${dirName}.tf`,\n    );\n    if (!tree.exists(filePath)) {\n      continue; // Not a dynamodb app module directory.\n    }\n\n    if (\n      await matchGritQL(tree, filePath, hcl('`variable \"encryption\" { $_ }`'))\n    ) {\n      continue; // Already migrated.\n    }\n\n    const OLD_ENABLE_KEY_ROTATION_VAR = hcl(\n      [\n        '`variable \"enable_key_rotation\" {',\n        '  description = \"Whether to enable automatic key rotation on the KMS key used to encrypt the table.\"',\n        '  type        = bool',\n        '  default     = true',\n        '}`',\n      ].join('\\n'),\n    );\n    const MODULE_BLOCK = hcl('`module \"dynamodb_table\" { $_ }`');\n    const DELETION_PROTECTION_LINE = hcl(\n      '`deletion_protection_enabled = var.deletion_protection_enabled`',\n    );\n\n    const ready = (\n      await Promise.all(\n        [\n          OLD_ENABLE_KEY_ROTATION_VAR,\n          MODULE_BLOCK,\n          DELETION_PROTECTION_LINE,\n        ].map((pattern) => matchGritQL(tree, filePath, pattern)),\n      )\n    ).every(Boolean);\n\n    if (!ready) {\n      nextSteps.push(terraformAppDivergedMessage(filePath));\n      continue;\n    }\n\n    await applyGritQL(\n      tree,\n      filePath,\n      `${OLD_ENABLE_KEY_ROTATION_VAR} => \\`${NEW_APP_MODULE_VARIABLES_TEXT.replace(/`/g, '\\\\`')}\\``,\n    );\n\n    await insertViaGritQL(\n      tree,\n      filePath,\n      hcl(\n        `\\`deletion_protection_enabled = var.deletion_protection_enabled\\` => \\`deletion_protection_enabled = var.deletion_protection_enabled\\n  ${GRIT_INSERT_PLACEHOLDER}\\``,\n      ),\n      [\n        'encryption      = var.encryption',\n        'kms_key_arn     = var.kms_key_arn',\n        'create_kms_key  = var.create_kms_key',\n      ].join('\\n  '),\n    );\n  }\n};\n\nexport default async function migration(\n  tree: Tree,\n): Promise<MigrationReturnObject> {\n  const nextSteps: string[] = [];\n\n  await migrateCdkConstruct(tree, nextSteps);\n  await migrateTerraformModule(tree, nextSteps);\n  await migrateTerraformAppModules(tree, nextSteps);\n\n  await formatFilesInSubtree(tree);\n\n  return { nextSteps };\n}\n"],"names":["joinPathFragments","addDestructuredImport","applyGritQL","GRIT_INSERT_PLACEHOLDER","insertViaGritQL","matchGritQL","formatFilesInSubtree","PACKAGES_DIR","SHARED_CONSTRUCTS_DIR","SHARED_TERRAFORM_DIR","CDK_DYNAMODB_FILE","TERRAFORM_DYNAMODB_FILE","TERRAFORM_DYNAMODB_APP_DIR","CDK_DIVERGED_MESSAGE","TERRAFORM_DIVERGED_MESSAGE","terraformAppDivergedMessage","filePath","migrateCdkConstruct","tree","nextSteps","exists","ENABLE_KEY_ROTATION_FIELD","ENABLE_KEY_ROTATION_COMMENT","DESTRUCTURE_OLD","KEY_CREATION_OLD","TABLE_ENCRYPTION_OLD","anchors","allPresent","Promise","all","map","pattern","every","Boolean","push","hcl","NEW_TERRAFORM_VARIABLES_TEXT","join","migrateTerraformModule","OLD_ENABLE_KEY_ROTATION_VAR","LOCALS_BLOCK","DATA_PARTITION_LINE","KMS_KEY_BLOCK","SSE_ENABLED_LINE","SSE_KMS_KEY_LINE","OUTPUT_VALUE_LINE","OUTPUT_DESCRIPTION_LINE","replace","NEW_APP_MODULE_VARIABLES_TEXT","migrateTerraformAppModules","dirName","children","MODULE_BLOCK","DELETION_PROTECTION_LINE","ready","migration"],"mappings":"AAAA;;;CAGC,GACD,SACEA,iBAAiB,QAGZ,aAAa;AACpB,SACEC,qBAAqB,EACrBC,WAAW,EACXC,uBAAuB,EACvBC,eAAe,EACfC,WAAW,QACN,wBAAwB;AAC/B,SAASC,oBAAoB,QAAQ,2BAA2B;AAChE,SACEC,YAAY,EACZC,qBAAqB,EACrBC,oBAAoB,QACf,gDAAgD;AAEvD;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;CA8BC,GAED,MAAMC,oBAAoB,GAAGH,aAAa,CAAC,EAAEC,sBAAsB,qBAAqB,CAAC;AACzF,MAAMG,0BAA0B,GAAGJ,aAAa,CAAC,EAAEE,qBAAqB,8BAA8B,CAAC;AACvG,MAAMG,6BAA6B,GAAGL,aAAa,CAAC,EAAEE,qBAAqB,iBAAiB,CAAC;AAE7F,MAAMI,uBAAuB,GAAGH,kBAAkB,oOAAoO,CAAC;AAEvR,MAAMI,6BAA6B,GAAGH,wBAAwB,yNAAyN,CAAC;AAExR,MAAMI,8BAA8B,CAACC,WACnC,GAAGA,SAAS,6RAA6R,CAAC;AAE5S;;;CAGC,GACD,MAAMC,sBAAsB,OAC1BC,MACAC;IAEA,IAAI,CAACD,KAAKE,MAAM,CAACV,oBAAoB;QACnC,QAAQ,qDAAqD;IAC/D;IAEA,IACE,MAAML,YACJa,MACAR,mBACA,4CAEF;QACA,QAAQ,oBAAoB;IAC9B;IAEA,MAAMW,4BAA4B;IAClC,0EAA0E;IAC1E,2EAA2E;IAC3E,oEAAoE;IACpE,wEAAwE;IACxE,sBAAsB;IACtB,MAAMC,8BAA8B,CAAC;;;;OAIhC,CAAC;IACN,MAAMC,kBAAkB,CAAC;;;;;;;;;2BASA,CAAC;IAC1B,MAAMC,mBACJ;IACF,MAAMC,uBAAuB;IAE7B,MAAMC,UAAU;QACdL;QACAC;QACAC;QACAC;QACAC;KACD;IAED,MAAME,aAAa,AACjB,CAAA,MAAMC,QAAQC,GAAG,CACfH,QAAQI,GAAG,CAAC,CAACC,UAAY1B,YAAYa,MAAMR,mBAAmBqB,UAChE,EACAC,KAAK,CAACC;IAER,IAAI,CAACN,YAAY;QACfR,UAAUe,IAAI,CAACrB;QACf;IACF;IAEA,MAAMZ,sBACJiB,MACAR,mBACA;QAAC;KAAO,EACR;IAGF,4EAA4E;IAC5E,uEAAuE;IACvE,sEAAsE;IACtE,MAAMN,gBACJc,MACAR,mBACA,GAAGY,4BAA4B,kBAAkB,EAAEnB,wBAAwB;YACnE,CAAC,EACT,CAAC;;;;;;;;;;;;;EAaH,CAAC;IAGD,uEAAuE;IACvE,yEAAyE;IACzE,wEAAwE;IACxE,0EAA0E;IAC1E,uDAAuD;IACvD,MAAMC,gBACJc,MACAR,mBACA,GAAGY,4BAA4B,MAAM,EAAEnB,wBAAwB,EAAE,CAAC,EAClE,CAAC;;;;;;KAMA,CAAC;IAGJ,MAAMD,YACJgB,MACAR,mBACA,GAAGa,gBAAgB;;;;;;;;;;;2BAWI,CAAC;IAG1B,MAAMrB,YACJgB,MACAR,mBACA,GAAGc,iBAAiB;;;sBAGF,CAAC;IAGrB,MAAMtB,YACJgB,MACAR,mBACA,GAAGe,qBAAqB,kBAAkB,CAAC;AAE/C;AAEA,MAAMU,MAAM,CAACJ,UAAoB,CAAC,cAAc,EAAEA,SAAS;AAE3D,MAAMK,+BAA+B;IACnC;IACA;IACA;IACA;IACA;IACA;IACA;IACA;IACA;IACA;IACA;IACA;IACA;IACA;IACA;IACA;IACA;IACA;IACA;IACA;IACA;IACA;IACA;IACA;IACA;IACA;IACA;IACA;CACD,CAACC,IAAI,CAAC;AAEP;;;CAGC,GACD,MAAMC,yBAAyB,OAC7BpB,MACAC;IAEA,IAAI,CAACD,KAAKE,MAAM,CAACT,0BAA0B;QACzC,QAAQ,mDAAmD;IAC7D;IAEA,IACE,MAAMN,YACJa,MACAP,yBACAwB,IAAI,oCAEN;QACA,QAAQ,oBAAoB;IAC9B;IAEA,MAAMI,8BAA8BJ,IAClC;QACE;QACA;QACA;QACA;QACA;KACD,CAACE,IAAI,CAAC;IAET,MAAMG,eAAeL,IAAI;IACzB,MAAMM,sBAAsBN,IAAI;IAChC,MAAMO,gBAAgBP,IAAI;IAC1B,MAAMQ,mBAAmBR,IAAI;IAC7B,MAAMS,mBAAmBT,IAAI;IAC7B,MAAMU,oBAAoBV,IAAI;IAC9B,MAAMW,0BAA0BX,IAC9B;IAGF,MAAMT,UAAU;QACda;QACAC;QACAC;QACAC;QACAC;QACAC;QACAC;QACAC;KACD;IAED,MAAMnB,aAAa,AACjB,CAAA,MAAMC,QAAQC,GAAG,CACfH,QAAQI,GAAG,CAAC,CAACC,UACX1B,YAAYa,MAAMP,yBAAyBoB,UAE/C,EACAC,KAAK,CAACC;IAER,IAAI,CAACN,YAAY;QACfR,UAAUe,IAAI,CAACpB;QACf;IACF;IAEA,0EAA0E;IAC1E,uEAAuE;IACvE,MAAMZ,YACJgB,MACAP,yBACA,GAAG4B,4BAA4B,MAAM,EAAEH,6BAA6BW,OAAO,CAAC,MAAM,OAAO,EAAE,CAAC;IAG9F,0DAA0D;IAC1D,MAAM3C,gBACJc,MACAP,yBACAwB,IACE,CAAC,iDAAiD,EAAEhC,wBAAwB,KAAK,CAAC,GAEpF;QACE;QACA;QACA;QACA;QACA;QACA;KACD,CAACkC,IAAI,CAAC;IAGT,yEAAyE;IACzE,MAAMjC,gBACJc,MACAP,yBACA,GAAG8B,oBAAoB,yCAAyC,EAAEtC,wBAAwB,EAAE,CAAC,EAC7F;IAGF,6DAA6D;IAC7D,MAAMD,YACJgB,MACAP,yBACAwB,IAAI,CAAC;;;;GAIN,CAAC;IAGF,yEAAyE;IACzE,MAAMjC,YACJgB,MACAP,yBACA,GAAGgC,iBAAiB,6CAA6C,CAAC;IAGpE,4EAA4E;IAC5E,uEAAuE;IACvE,qEAAqE;IACrE,gEAAgE;IAChE,MAAMvC,gBACJc,MACAP,yBACAwB,IACE,CAAC,oGAAoG,EAAEhC,wBAAwB,cAAc,CAAC,GAEhJ;IAGF,yEAAyE;IACzE,MAAMD,YACJgB,MACAP,yBACA,GAAGiC,iBAAiB,6CAA6C,CAAC;IAEpE,MAAM1C,YACJgB,MACAP,yBACA,GAAGkC,kBAAkB,uCAAuC,CAAC;IAE/D,MAAM3C,YACJgB,MACAP,yBACA,GAAGmC,wBAAwB,2IAA2I,CAAC;AAE3K;AAEA,MAAME,gCAAgC;IACpC;IACA;IACA;IACA;IACA;IACA;IACA;IACA;IACA;IACA;IACA;IACA;IACA;IACA;IACA;IACA;IACA;IACA;IACA;IACA;IACA;IACA;IACA;IACA;IACA;IACA;IACA;IACA;CACD,CAACX,IAAI,CAAC;AAEP;;;;CAIC,GACD,MAAMY,6BAA6B,OACjC/B,MACAC;IAEA,IAAI,CAACD,KAAKE,MAAM,CAACR,6BAA6B;QAC5C;IACF;IAEA,KAAK,MAAMsC,WAAWhC,KAAKiC,QAAQ,CAACvC,4BAA6B;QAC/D,MAAMI,WAAWhB,kBACfY,4BACAsC,SACA,GAAGA,QAAQ,GAAG,CAAC;QAEjB,IAAI,CAAChC,KAAKE,MAAM,CAACJ,WAAW;YAC1B,UAAU,uCAAuC;QACnD;QAEA,IACE,MAAMX,YAAYa,MAAMF,UAAUmB,IAAI,oCACtC;YACA,UAAU,oBAAoB;QAChC;QAEA,MAAMI,8BAA8BJ,IAClC;YACE;YACA;YACA;YACA;YACA;SACD,CAACE,IAAI,CAAC;QAET,MAAMe,eAAejB,IAAI;QACzB,MAAMkB,2BAA2BlB,IAC/B;QAGF,MAAMmB,QAAQ,AACZ,CAAA,MAAM1B,QAAQC,GAAG,CACf;YACEU;YACAa;YACAC;SACD,CAACvB,GAAG,CAAC,CAACC,UAAY1B,YAAYa,MAAMF,UAAUe,UACjD,EACAC,KAAK,CAACC;QAER,IAAI,CAACqB,OAAO;YACVnC,UAAUe,IAAI,CAACnB,4BAA4BC;YAC3C;QACF;QAEA,MAAMd,YACJgB,MACAF,UACA,GAAGuB,4BAA4B,MAAM,EAAES,8BAA8BD,OAAO,CAAC,MAAM,OAAO,EAAE,CAAC;QAG/F,MAAM3C,gBACJc,MACAF,UACAmB,IACE,CAAC,wIAAwI,EAAEhC,wBAAwB,EAAE,CAAC,GAExK;YACE;YACA;YACA;SACD,CAACkC,IAAI,CAAC;IAEX;AACF;AAEA,eAAe,eAAekB,UAC5BrC,IAAU;IAEV,MAAMC,YAAsB,EAAE;IAE9B,MAAMF,oBAAoBC,MAAMC;IAChC,MAAMmB,uBAAuBpB,MAAMC;IACnC,MAAM8B,2BAA2B/B,MAAMC;IAEvC,MAAMb,qBAAqBY;IAE3B,OAAO;QAAEC;IAAU;AACrB"}

package/src/migrations/v1.0.0-rc.77/0002-user-identity-configurable-mfa/migration.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../../../../../../../packages/nx-plugin/src/migrations/v1.0.0-rc.77/0002-user-identity-configurable-mfa/migration.ts"],"sourcesContent":["/**\n * Copyright Amazon.com, Inc. or its affiliates. All Rights Reserved.\n * SPDX-License-Identifier: Apache-2.0\n */\nimport type { MigrationReturnObject, Tree } from '@nx/devkit';\nimport {\n  addDestructuredImport,\n  applyGritQL,\n  matchGritQL,\n} from '../../../utils/ast.js';\nimport { formatFilesInSubtree } from '../../../utils/format.js';\nimport {\n  PACKAGES_DIR,\n  SHARED_CONSTRUCTS_DIR,\n  SHARED_TERRAFORM_DIR,\n} from '../../../utils/shared-constructs-constants.js';\n\n/**\n * Surface mfa and mfaSecondFactor on the vended UserIdentity construct/module\n *\n * CDK's `mfa` / `mfaSecondFactor` props default to what the construct already\n * hard-coded (`Mfa.REQUIRED` / `{ sms: true, otp: true }`), so this just makes\n * them overridable, matching the existing `enableWaf` prop pattern.\n *\n * Terraform has no equivalent of CloudFormation's `EnabledMfas` - SMS MFA is\n * inseparable from the `sms_configuration` block, which phone number\n * verification also relies on. So `mfa_second_factor_sms` gates\n * `sms_configuration` (and, with it, SMS phone verification) rather than only\n * MFA, unlike the CDK prop.\n *\n * CDK has the same underlying coupling for any non-OFF `mfa`: Cognito rejects\n * `SmsConfiguration` (which CDK emits whenever phone is auto-verified) unless\n * SMS is also an enabled MFA method. So `phoneVerificationEnabled` gates\n * `autoVerify`/`keepOriginal`'s `phone` flag on whether SMS is actually usable\n * as a second factor, and a `mfa: REQUIRED` with neither `sms` nor `otp`\n * enabled - a pool nobody could ever sign into - is rejected at synth time.\n *\n * How to write a migration:\n * - https://nx.dev/docs/kb/migration-generators\n * - What `nextSteps` means: https://nx.dev/docs/reference/devkit/MigrationReturnObject\n *\n * Guardrails:\n * - Pattern-match before writing: skip files that have diverged from the shape\n *   your generators produce and report them via `nextSteps`, rather than\n *   clobbering the user's changes.\n * - Idempotent: re-running must be a no-op.\n * - Format what you write: finish with `formatFilesInSubtree` so the files your\n *   migration wrote are formatted correctly.\n */\n\nconst CDK_USER_IDENTITY_FILE = `${PACKAGES_DIR}/${SHARED_CONSTRUCTS_DIR}/src/core/user-identity.ts`;\nconst TERRAFORM_IDENTITY_FILE = `${PACKAGES_DIR}/${SHARED_TERRAFORM_DIR}/src/core/user-identity/identity/identity.tf`;\nconst TERRAFORM_MAIN_FILE = `${PACKAGES_DIR}/${SHARED_TERRAFORM_DIR}/src/core/user-identity/main.tf`;\n\nconst NEW_TERRAFORM_VARIABLES = `variable \"mfa\" {\n  description = \"Whether users must configure MFA, may optionally configure MFA, or cannot use MFA at all\"\n  type        = string\n  default     = \"ON\"\n\n  validation {\n    condition     = contains([\"OFF\", \"OPTIONAL\", \"ON\"], var.mfa)\n    error_message = \"mfa must be one of OFF, OPTIONAL, ON\"\n  }\n}\n\nvariable \"mfa_second_factor_otp\" {\n  description = \"Whether users can use a time-based one time password (TOTP), generated by a hardware or software token, as an MFA method\"\n  type        = bool\n  default     = true\n}\n\nvariable \"mfa_second_factor_sms\" {\n  description = \"Whether users can use SMS to their verified phone numbers as an MFA method. Due to a Terraform AWS provider limitation, disabling this also disables SMS-based phone number verification, unlike the equivalent CDK construct prop\"\n  type        = bool\n  default     = true\n}`;\n\n// Guards each file: present only once it has been migrated.\nconst CDK_MIGRATED_PATTERN = '`mfa === Mfa.OFF || mfaSecondFactor.sms`';\nconst TERRAFORM_IDENTITY_MIGRATED_PATTERN =\n  'language hcl\\n`mfa_configuration = var.mfa`';\nconst TERRAFORM_MAIN_MIGRATED_PATTERN = 'language hcl\\n`mfa = var.mfa`';\n\n// Interface members don't parse as standalone snippets, so this anchors on the\n// whole interface body (preserved via $body) rather than the enableWaf member.\nconst CDK_INTERFACE_BODY_PATTERN =\n  '`export interface UserIdentityProps { $body }`';\n// A parameter's type annotation blocks matching the destructure sub-pattern in\n// isolation, so this anchors on the full constructor signature instead\n// (literal params so a customised signature is correctly seen as diverged).\nconst CDK_CONSTRUCTOR_PATTERN =\n  '`constructor(scope: Construct, id: string, { enableWaf = true }: UserIdentityProps = {}) { $body }`';\nconst CDK_CREATE_CALL_PATTERN = '`this.createUserPool()`';\nconst CDK_CREATE_SIGNATURE_PATTERN = '`private createUserPool = () => $body`';\n// Trailing commas block matching a bare object property in isolation; the\n// separator is outside the matched span either way, so it survives untouched.\nconst CDK_MFA_FIELD_PATTERN = '`mfa: Mfa.REQUIRED`';\nconst CDK_MFA_SECOND_FACTOR_FIELD_PATTERN =\n  '`mfaSecondFactor: { sms: true, otp: true }`';\nconst CDK_SUPER_CALL_PATTERN = '`super(scope, id);`';\n// $props preserves the whole (large) UserPool props object untouched while\n// inserting the new const declaration immediately before it.\nconst CDK_NEW_USER_POOL_PATTERN =\n  \"`const userPool = new UserPool(this, 'UserPool', { $props })`\";\n// Matches both the autoVerify.phone and keepOriginal.phone occurrences in one pass.\nconst CDK_PHONE_TRUE_PATTERN = '`phone: true`';\n\nconst CDK_EDITS: Array<[string, string]> = [\n  [\n    CDK_INTERFACE_BODY_PATTERN,\n    `${CDK_INTERFACE_BODY_PATTERN} => \\`export interface UserIdentityProps {\n  $body\n\n  /**\n   * Whether users must configure MFA, may optionally configure MFA, or cannot use MFA at all.\n   *\n   * @default Mfa.REQUIRED\n   */\n  readonly mfa?: Mfa;\n\n  /**\n   * The MFA methods available to users when MFA is not off.\n   *\n   * @default { sms: true, otp: true }\n   */\n  readonly mfaSecondFactor?: MfaSecondFactor;\n}\\``,\n  ],\n  [\n    CDK_CONSTRUCTOR_PATTERN,\n    `${CDK_CONSTRUCTOR_PATTERN} => \\`constructor(\n    scope: Construct,\n    id: string,\n    {\n      enableWaf = true,\n      mfa = Mfa.REQUIRED,\n      mfaSecondFactor = { sms: true, otp: true },\n    }: UserIdentityProps = {},\n  ) { $body }\\``,\n  ],\n  [\n    CDK_CREATE_CALL_PATTERN,\n    `${CDK_CREATE_CALL_PATTERN} => \\`this.createUserPool(mfa, mfaSecondFactor)\\``,\n  ],\n  [\n    CDK_CREATE_SIGNATURE_PATTERN,\n    `${CDK_CREATE_SIGNATURE_PATTERN} => \\`private createUserPool = (mfa: Mfa, mfaSecondFactor: MfaSecondFactor) => $body\\``,\n  ],\n  [CDK_MFA_FIELD_PATTERN, `${CDK_MFA_FIELD_PATTERN} => \\`mfa\\``],\n  [\n    CDK_MFA_SECOND_FACTOR_FIELD_PATTERN,\n    `${CDK_MFA_SECOND_FACTOR_FIELD_PATTERN} => \\`mfaSecondFactor\\``,\n  ],\n  [\n    CDK_SUPER_CALL_PATTERN,\n    `${CDK_SUPER_CALL_PATTERN} => \\`super(scope, id);\n\n    if (mfa === Mfa.REQUIRED && !mfaSecondFactor.sms && !mfaSecondFactor.otp) {\n      throw new Error(\n        'UserIdentity: mfa is REQUIRED but mfaSecondFactor has no methods enabled (sms and otp are both false)',\n      );\n    }\\``,\n  ],\n  [\n    CDK_NEW_USER_POOL_PATTERN,\n    `${CDK_NEW_USER_POOL_PATTERN} => \\`const phoneVerificationEnabled = mfa === Mfa.OFF || mfaSecondFactor.sms;\n\n    const userPool = new UserPool(this, 'UserPool', { $props })\\``,\n  ],\n  [\n    CDK_PHONE_TRUE_PATTERN,\n    `${CDK_PHONE_TRUE_PATTERN} => \\`phone: phoneVerificationEnabled\\``,\n  ],\n];\n\nconst TERRAFORM_IDENTITY_ENABLE_WAF_VARIABLE_ANCHOR = [\n  'language hcl',\n  '`variable \"enable_waf\" {',\n  '  description = \"Whether to enable AWS WAFv2 with the default managed ruleset (AWSManagedRulesCommonRuleSet and AWSManagedRulesKnownBadInputsRuleSet) and associate it with the user pool\"',\n  '  type        = bool',\n  '  default     = true',\n  '}`',\n].join('\\n');\n\nconst TERRAFORM_MFA_CONFIGURATION_PATTERN = [\n  'language hcl',\n  '`mfa_configuration = \"ON\"`',\n].join('\\n');\n\nconst TERRAFORM_SOFTWARE_TOKEN_MFA_PATTERN = [\n  'language hcl',\n  '`software_token_mfa_configuration {',\n  '    enabled = true',\n  '  }`',\n].join('\\n');\n\nconst TERRAFORM_SMS_CONFIGURATION_PATTERN = [\n  'language hcl',\n  '`sms_configuration {',\n  '    external_id    = random_uuid.sms_external_id.result',\n  '    sns_caller_arn = aws_iam_role.cognito_sms_role.arn',\n  '    sns_region     = data.aws_region.current.region',\n  '  }`',\n].join('\\n');\n\nconst TERRAFORM_RANDOM_UUID_PATTERN = [\n  'language hcl',\n  '`resource \"random_uuid\" \"sms_external_id\" {}`',\n].join('\\n');\n\nconst TERRAFORM_SMS_ROLE_PATTERN = [\n  'language hcl',\n  '`resource \"aws_iam_role\" \"cognito_sms_role\" { $body }`',\n].join('\\n');\n\nconst TERRAFORM_SMS_POLICY_PATTERN = [\n  'language hcl',\n  '`resource \"aws_iam_role_policy\" \"cognito_sms_policy\" { $body }`',\n].join('\\n');\n\nconst TERRAFORM_SMS_ROLE_ID_REF_PATTERN = [\n  'language hcl',\n  '`aws_iam_role.cognito_sms_role.id`',\n].join('\\n');\n\nconst TERRAFORM_EXTERNAL_ID_REF_PATTERN = [\n  'language hcl',\n  '`random_uuid.sms_external_id.result`',\n].join('\\n');\n\nconst TERRAFORM_AUTO_VERIFIED_ATTRIBUTES_PATTERN = [\n  'language hcl',\n  '`auto_verified_attributes = [\"email\", \"phone_number\"]`',\n].join('\\n');\n\nconst TERRAFORM_ATTRIBUTES_REQUIRE_VERIFICATION_PATTERN = [\n  'language hcl',\n  '`attributes_require_verification_before_update = [\"email\", \"phone_number\"]`',\n].join('\\n');\n\nconst TERRAFORM_IDENTITY_EDITS: Array<[string, string]> = [\n  [\n    TERRAFORM_IDENTITY_ENABLE_WAF_VARIABLE_ANCHOR,\n    `${TERRAFORM_IDENTITY_ENABLE_WAF_VARIABLE_ANCHOR} => \\`variable \"enable_waf\" {\n  description = \"Whether to enable AWS WAFv2 with the default managed ruleset (AWSManagedRulesCommonRuleSet and AWSManagedRulesKnownBadInputsRuleSet) and associate it with the user pool\"\n  type        = bool\n  default     = true\n}\n\n${NEW_TERRAFORM_VARIABLES}\\``,\n  ],\n  [\n    TERRAFORM_RANDOM_UUID_PATTERN,\n    `${TERRAFORM_RANDOM_UUID_PATTERN} => \\`resource \"random_uuid\" \"sms_external_id\" {\n  count = var.mfa_second_factor_sms ? 1 : 0\n}\\``,\n  ],\n  [\n    TERRAFORM_SMS_ROLE_PATTERN,\n    `${TERRAFORM_SMS_ROLE_PATTERN} => \\`resource \"aws_iam_role\" \"cognito_sms_role\" {\n  count = var.mfa_second_factor_sms ? 1 : 0\n\n  $body\n}\\``,\n  ],\n  [\n    TERRAFORM_SMS_POLICY_PATTERN,\n    `${TERRAFORM_SMS_POLICY_PATTERN} => \\`resource \"aws_iam_role_policy\" \"cognito_sms_policy\" {\n  count = var.mfa_second_factor_sms ? 1 : 0\n\n  $body\n}\\``,\n  ],\n  [\n    TERRAFORM_MFA_CONFIGURATION_PATTERN,\n    `${TERRAFORM_MFA_CONFIGURATION_PATTERN} => \\`mfa_configuration = var.mfa\\``,\n  ],\n  [\n    TERRAFORM_SOFTWARE_TOKEN_MFA_PATTERN,\n    `${TERRAFORM_SOFTWARE_TOKEN_MFA_PATTERN} => \\`software_token_mfa_configuration {\n    enabled = var.mfa_second_factor_otp\n  }\\``,\n  ],\n  [\n    TERRAFORM_SMS_CONFIGURATION_PATTERN,\n    `${TERRAFORM_SMS_CONFIGURATION_PATTERN} => \\`# SMS MFA configuration. Due to a Terraform AWS provider limitation, this also gates\n  # SMS-based phone number verification below - see the mfa_second_factor_sms variable.\n  dynamic \"sms_configuration\" {\n    for_each = var.mfa_second_factor_sms ? [1] : []\n\n    content {\n      external_id    = random_uuid.sms_external_id[0].result\n      sns_caller_arn = aws_iam_role.cognito_sms_role[0].arn\n      sns_region     = data.aws_region.current.region\n    }\n  }\\``,\n  ],\n  [\n    TERRAFORM_SMS_ROLE_ID_REF_PATTERN,\n    `${TERRAFORM_SMS_ROLE_ID_REF_PATTERN} => \\`aws_iam_role.cognito_sms_role[0].id\\``,\n  ],\n  [\n    TERRAFORM_EXTERNAL_ID_REF_PATTERN,\n    `${TERRAFORM_EXTERNAL_ID_REF_PATTERN} => \\`random_uuid.sms_external_id[0].result\\``,\n  ],\n  [\n    TERRAFORM_AUTO_VERIFIED_ATTRIBUTES_PATTERN,\n    `${TERRAFORM_AUTO_VERIFIED_ATTRIBUTES_PATTERN} => \\`auto_verified_attributes = var.mfa_second_factor_sms ? [\"email\", \"phone_number\"] : [\"email\"]\\``,\n  ],\n  [\n    TERRAFORM_ATTRIBUTES_REQUIRE_VERIFICATION_PATTERN,\n    `${TERRAFORM_ATTRIBUTES_REQUIRE_VERIFICATION_PATTERN} => \\`attributes_require_verification_before_update = var.mfa_second_factor_sms ? [\"email\", \"phone_number\"] : [\"email\"]\\``,\n  ],\n];\n\nconst TERRAFORM_MAIN_ENABLE_WAF_VARIABLE_ANCHOR = [\n  'language hcl',\n  '`variable \"enable_waf\" {',\n  '  description = \"Whether to enable AWS WAFv2 with the default managed ruleset and associate it with the user pool\"',\n  '  type        = bool',\n  '  default     = true',\n  '}`',\n].join('\\n');\n\nconst TERRAFORM_MAIN_MODULE_PATTERN = [\n  'language hcl',\n  '`module \"identity\" {',\n  '  source = \"./identity\"',\n  '',\n  '  user_pool_domain_prefix = $prefix',\n  '  allow_signup = $allowSignup',\n  '  enable_waf = var.enable_waf',\n  '}`',\n].join('\\n');\n\nconst TERRAFORM_MAIN_EDITS: Array<[string, string]> = [\n  [\n    TERRAFORM_MAIN_ENABLE_WAF_VARIABLE_ANCHOR,\n    `${TERRAFORM_MAIN_ENABLE_WAF_VARIABLE_ANCHOR} => \\`variable \"enable_waf\" {\n  description = \"Whether to enable AWS WAFv2 with the default managed ruleset and associate it with the user pool\"\n  type        = bool\n  default     = true\n}\n\n${NEW_TERRAFORM_VARIABLES}\\``,\n  ],\n  [\n    TERRAFORM_MAIN_MODULE_PATTERN,\n    `${TERRAFORM_MAIN_MODULE_PATTERN} => \\`module \"identity\" {\n  source = \"./identity\"\n\n  user_pool_domain_prefix = $prefix\n  allow_signup = $allowSignup\n  enable_waf = var.enable_waf\n  mfa = var.mfa\n  mfa_second_factor_otp = var.mfa_second_factor_otp\n  mfa_second_factor_sms = var.mfa_second_factor_sms\n}\\``,\n  ],\n];\n\nconst divergedNextStep = (filePath: string) =>\n  `${filePath}: the UserIdentity construct/module has diverged from the generated shape - left untouched. To make MFA configurable, add mfa and mfaSecondFactor (CDK) / mfa, mfa_second_factor_otp and mfa_second_factor_sms (Terraform) yourself, following the same pattern as the existing enableWaf prop/variable.`;\n\nconst applyEdits = async (\n  tree: Tree,\n  filePath: string,\n  migratedPattern: string,\n  edits: Array<[string, string]>,\n  nextSteps: string[],\n  beforeApply?: () => Promise<void>,\n) => {\n  if (!tree.exists(filePath)) {\n    // This workspace doesn't use this IaC provider, or has no UserIdentity.\n    return;\n  }\n\n  if (await matchGritQL(tree, filePath, migratedPattern)) {\n    // Already migrated - silent skip keeps re-runs a no-op.\n    return;\n  }\n\n  // Confirm every edit site is present before writing any of them, so a file\n  // that only partly matches is left whole rather than half-edited.\n  const allSitesPresent = (\n    await Promise.all(\n      edits.map(([match]) => matchGritQL(tree, filePath, match)),\n    )\n  ).every(Boolean);\n\n  if (!allSitesPresent) {\n    nextSteps.push(divergedNextStep(filePath));\n    return;\n  }\n\n  await beforeApply?.();\n\n  for (const [, rewrite] of edits) {\n    await applyGritQL(tree, filePath, rewrite);\n  }\n};\n\nexport default async function migration(\n  tree: Tree,\n): Promise<MigrationReturnObject> {\n  const nextSteps: string[] = [];\n\n  await applyEdits(\n    tree,\n    CDK_USER_IDENTITY_FILE,\n    CDK_MIGRATED_PATTERN,\n    CDK_EDITS,\n    nextSteps,\n    () =>\n      addDestructuredImport(\n        tree,\n        CDK_USER_IDENTITY_FILE,\n        ['type MfaSecondFactor'],\n        'aws-cdk-lib/aws-cognito',\n      ),\n  );\n\n  await applyEdits(\n    tree,\n    TERRAFORM_IDENTITY_FILE,\n    TERRAFORM_IDENTITY_MIGRATED_PATTERN,\n    TERRAFORM_IDENTITY_EDITS,\n    nextSteps,\n  );\n\n  await applyEdits(\n    tree,\n    TERRAFORM_MAIN_FILE,\n    TERRAFORM_MAIN_MIGRATED_PATTERN,\n    TERRAFORM_MAIN_EDITS,\n    nextSteps,\n  );\n\n  await formatFilesInSubtree(tree);\n\n  return { nextSteps };\n}\n"],"names":["addDestructuredImport","applyGritQL","matchGritQL","formatFilesInSubtree","PACKAGES_DIR","SHARED_CONSTRUCTS_DIR","SHARED_TERRAFORM_DIR","CDK_USER_IDENTITY_FILE","TERRAFORM_IDENTITY_FILE","TERRAFORM_MAIN_FILE","NEW_TERRAFORM_VARIABLES","CDK_MIGRATED_PATTERN","TERRAFORM_IDENTITY_MIGRATED_PATTERN","TERRAFORM_MAIN_MIGRATED_PATTERN","CDK_INTERFACE_BODY_PATTERN","CDK_CONSTRUCTOR_PATTERN","CDK_CREATE_CALL_PATTERN","CDK_CREATE_SIGNATURE_PATTERN","CDK_MFA_FIELD_PATTERN","CDK_MFA_SECOND_FACTOR_FIELD_PATTERN","CDK_SUPER_CALL_PATTERN","CDK_NEW_USER_POOL_PATTERN","CDK_PHONE_TRUE_PATTERN","CDK_EDITS","TERRAFORM_IDENTITY_ENABLE_WAF_VARIABLE_ANCHOR","join","TERRAFORM_MFA_CONFIGURATION_PATTERN","TERRAFORM_SOFTWARE_TOKEN_MFA_PATTERN","TERRAFORM_SMS_CONFIGURATION_PATTERN","TERRAFORM_RANDOM_UUID_PATTERN","TERRAFORM_SMS_ROLE_PATTERN","TERRAFORM_SMS_POLICY_PATTERN","TERRAFORM_SMS_ROLE_ID_REF_PATTERN","TERRAFORM_EXTERNAL_ID_REF_PATTERN","TERRAFORM_AUTO_VERIFIED_ATTRIBUTES_PATTERN","TERRAFORM_ATTRIBUTES_REQUIRE_VERIFICATION_PATTERN","TERRAFORM_IDENTITY_EDITS","TERRAFORM_MAIN_ENABLE_WAF_VARIABLE_ANCHOR","TERRAFORM_MAIN_MODULE_PATTERN","TERRAFORM_MAIN_EDITS","divergedNextStep","filePath","applyEdits","tree","migratedPattern","edits","nextSteps","beforeApply","exists","allSitesPresent","Promise","all","map","match","every","Boolean","push","rewrite","migration"],"mappings":"AAAA;;;CAGC,GAED,SACEA,qBAAqB,EACrBC,WAAW,EACXC,WAAW,QACN,wBAAwB;AAC/B,SAASC,oBAAoB,QAAQ,2BAA2B;AAChE,SACEC,YAAY,EACZC,qBAAqB,EACrBC,oBAAoB,QACf,gDAAgD;AAEvD;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;CA+BC,GAED,MAAMC,yBAAyB,GAAGH,aAAa,CAAC,EAAEC,sBAAsB,0BAA0B,CAAC;AACnG,MAAMG,0BAA0B,GAAGJ,aAAa,CAAC,EAAEE,qBAAqB,4CAA4C,CAAC;AACrH,MAAMG,sBAAsB,GAAGL,aAAa,CAAC,EAAEE,qBAAqB,+BAA+B,CAAC;AAEpG,MAAMI,0BAA0B,CAAC;;;;;;;;;;;;;;;;;;;;;CAqBhC,CAAC;AAEF,4DAA4D;AAC5D,MAAMC,uBAAuB;AAC7B,MAAMC,sCACJ;AACF,MAAMC,kCAAkC;AAExC,+EAA+E;AAC/E,+EAA+E;AAC/E,MAAMC,6BACJ;AACF,+EAA+E;AAC/E,uEAAuE;AACvE,4EAA4E;AAC5E,MAAMC,0BACJ;AACF,MAAMC,0BAA0B;AAChC,MAAMC,+BAA+B;AACrC,0EAA0E;AAC1E,8EAA8E;AAC9E,MAAMC,wBAAwB;AAC9B,MAAMC,sCACJ;AACF,MAAMC,yBAAyB;AAC/B,2EAA2E;AAC3E,6DAA6D;AAC7D,MAAMC,4BACJ;AACF,oFAAoF;AACpF,MAAMC,yBAAyB;AAE/B,MAAMC,YAAqC;IACzC;QACET;QACA,GAAGA,2BAA2B;;;;;;;;;;;;;;;;GAgB/B,CAAC;KACD;IACD;QACEC;QACA,GAAGA,wBAAwB;;;;;;;;eAQhB,CAAC;KACb;IACD;QACEC;QACA,GAAGA,wBAAwB,iDAAiD,CAAC;KAC9E;IACD;QACEC;QACA,GAAGA,6BAA6B,sFAAsF,CAAC;KACxH;IACD;QAACC;QAAuB,GAAGA,sBAAsB,WAAW,CAAC;KAAC;IAC9D;QACEC;QACA,GAAGA,oCAAoC,uBAAuB,CAAC;KAChE;IACD;QACEC;QACA,GAAGA,uBAAuB;;;;;;OAMvB,CAAC;KACL;IACD;QACEC;QACA,GAAGA,0BAA0B;;iEAEgC,CAAC;KAC/D;IACD;QACEC;QACA,GAAGA,uBAAuB,uCAAuC,CAAC;KACnE;CACF;AAED,MAAME,gDAAgD;IACpD;IACA;IACA;IACA;IACA;IACA;CACD,CAACC,IAAI,CAAC;AAEP,MAAMC,sCAAsC;IAC1C;IACA;CACD,CAACD,IAAI,CAAC;AAEP,MAAME,uCAAuC;IAC3C;IACA;IACA;IACA;CACD,CAACF,IAAI,CAAC;AAEP,MAAMG,sCAAsC;IAC1C;IACA;IACA;IACA;IACA;IACA;CACD,CAACH,IAAI,CAAC;AAEP,MAAMI,gCAAgC;IACpC;IACA;CACD,CAACJ,IAAI,CAAC;AAEP,MAAMK,6BAA6B;IACjC;IACA;CACD,CAACL,IAAI,CAAC;AAEP,MAAMM,+BAA+B;IACnC;IACA;CACD,CAACN,IAAI,CAAC;AAEP,MAAMO,oCAAoC;IACxC;IACA;CACD,CAACP,IAAI,CAAC;AAEP,MAAMQ,oCAAoC;IACxC;IACA;CACD,CAACR,IAAI,CAAC;AAEP,MAAMS,6CAA6C;IACjD;IACA;CACD,CAACT,IAAI,CAAC;AAEP,MAAMU,oDAAoD;IACxD;IACA;CACD,CAACV,IAAI,CAAC;AAEP,MAAMW,2BAAoD;IACxD;QACEZ;QACA,GAAGA,8CAA8C;;;;;;AAMrD,EAAEd,wBAAwB,EAAE,CAAC;KAC1B;IACD;QACEmB;QACA,GAAGA,8BAA8B;;GAElC,CAAC;KACD;IACD;QACEC;QACA,GAAGA,2BAA2B;;;;GAI/B,CAAC;KACD;IACD;QACEC;QACA,GAAGA,6BAA6B;;;;GAIjC,CAAC;KACD;IACD;QACEL;QACA,GAAGA,oCAAoC,mCAAmC,CAAC;KAC5E;IACD;QACEC;QACA,GAAGA,qCAAqC;;KAEvC,CAAC;KACH;IACD;QACEC;QACA,GAAGA,oCAAoC;;;;;;;;;;KAUtC,CAAC;KACH;IACD;QACEI;QACA,GAAGA,kCAAkC,2CAA2C,CAAC;KAClF;IACD;QACEC;QACA,GAAGA,kCAAkC,6CAA6C,CAAC;KACpF;IACD;QACEC;QACA,GAAGA,2CAA2C,oGAAoG,CAAC;KACpJ;IACD;QACEC;QACA,GAAGA,kDAAkD,yHAAyH,CAAC;KAChL;CACF;AAED,MAAME,4CAA4C;IAChD;IACA;IACA;IACA;IACA;IACA;CACD,CAACZ,IAAI,CAAC;AAEP,MAAMa,gCAAgC;IACpC;IACA;IACA;IACA;IACA;IACA;IACA;IACA;CACD,CAACb,IAAI,CAAC;AAEP,MAAMc,uBAAgD;IACpD;QACEF;QACA,GAAGA,0CAA0C;;;;;;AAMjD,EAAE3B,wBAAwB,EAAE,CAAC;KAC1B;IACD;QACE4B;QACA,GAAGA,8BAA8B;;;;;;;;;GASlC,CAAC;KACD;CACF;AAED,MAAME,mBAAmB,CAACC,WACxB,GAAGA,SAAS,wSAAwS,CAAC;AAEvT,MAAMC,aAAa,OACjBC,MACAF,UACAG,iBACAC,OACAC,WACAC;IAEA,IAAI,CAACJ,KAAKK,MAAM,CAACP,WAAW;QAC1B,wEAAwE;QACxE;IACF;IAEA,IAAI,MAAMvC,YAAYyC,MAAMF,UAAUG,kBAAkB;QACtD,wDAAwD;QACxD;IACF;IAEA,2EAA2E;IAC3E,kEAAkE;IAClE,MAAMK,kBAAkB,AACtB,CAAA,MAAMC,QAAQC,GAAG,CACfN,MAAMO,GAAG,CAAC,CAAC,CAACC,MAAM,GAAKnD,YAAYyC,MAAMF,UAAUY,QACrD,EACAC,KAAK,CAACC;IAER,IAAI,CAACN,iBAAiB;QACpBH,UAAUU,IAAI,CAAChB,iBAAiBC;QAChC;IACF;IAEA,MAAMM;IAEN,KAAK,MAAM,GAAGU,QAAQ,IAAIZ,MAAO;QAC/B,MAAM5C,YAAY0C,MAAMF,UAAUgB;IACpC;AACF;AAEA,eAAe,eAAeC,UAC5Bf,IAAU;IAEV,MAAMG,YAAsB,EAAE;IAE9B,MAAMJ,WACJC,MACApC,wBACAI,sBACAY,WACAuB,WACA,IACE9C,sBACE2C,MACApC,wBACA;YAAC;SAAuB,EACxB;IAIN,MAAMmC,WACJC,MACAnC,yBACAI,qCACAwB,0BACAU;IAGF,MAAMJ,WACJC,MACAlC,qBACAI,iCACA0B,sBACAO;IAGF,MAAM3C,qBAAqBwC;IAE3B,OAAO;QAAEG;IAAU;AACrB"}