@aws/nx-plugin 1.0.0-rc.87 → 1.0.0-rc.89

package/migrations.json

@@ -2,81 +2,6 @@
   "$schema": "http://json-schema.org/schema",
   "name": "@aws/nx-plugin",
   "generators": {
-    "latest-dynamodb-configurable-encryption": {
-      "version": "1.0.0-rc.77",
-      "description": "Surface encryption and encryptionKey on the vended DynamoDBTable construct/module",
-      "implementation": "./src/migrations/latest/dynamodb-configurable-encryption/migration"
-    },
-    "latest-user-identity-configurable-mfa": {
-      "version": "1.0.0-rc.77",
-      "description": "Surface mfa and mfaSecondFactor on the vended UserIdentity construct/module",
-      "implementation": "./src/migrations/latest/user-identity-configurable-mfa/migration"
-    },
-    "latest-static-website-configurable-waf-encryption": {
-      "version": "1.0.0-rc.78",
-      "description": "Surface enableWaf, encryption, encryptionKey and enableKeyRotation on the vended StaticWebsite construct/module",
-      "implementation": "./src/migrations/latest/static-website-configurable-waf-encryption/migration"
-    },
-    "latest-py-agent-ag-ui-hooks": {
-      "version": "1.0.0-rc.79",
-      "description": "Forward the py#agent Strands hooks to the AG-UI adapter so model and tool errors are reported",
-      "implementation": "./src/migrations/latest/py-agent-ag-ui-hooks/migration"
-    },
-    "latest-terraform-load-runtime-config-src-path": {
-      "version": "1.0.0-rc.82",
-      "description": "Point the react website's terraform load-runtime-config target at the runtime-config file the terraform aggregation actually writes",
-      "implementation": "./src/migrations/latest/terraform-load-runtime-config-src-path/migration"
-    },
-    "latest-runtime-config-namespace-defaults": {
-      "version": "1.0.0-rc.82",
-      "description": "Provision AppConfig configuration profiles for every namespace the vended terraform modules write to",
-      "implementation": "./src/migrations/latest/runtime-config-namespace-defaults/migration"
-    },
-    "latest-dynamodb-terraform-app-module-outputs": {
-      "version": "1.0.0-rc.83",
-      "description": "Re-export the DynamoDB table and KMS key attributes from the vended Terraform per-table app module",
-      "implementation": "./src/migrations/latest/dynamodb-terraform-app-module-outputs/migration"
-    },
-    "latest-terraform-data-resource-destroy-protection": {
-      "version": "1.0.0-rc.83",
-      "description": "Add prevent_destroy and a 30 day KMS deletion window to the vended Terraform DynamoDB table and Aurora cluster modules",
-      "implementation": "./src/migrations/latest/terraform-data-resource-destroy-protection/migration"
-    },
-    "latest-terraform-gateway-cedar-render-root-ejs": {
-      "version": "1.0.0-rc.83",
-      "description": "Declare ejs at the workspace root so the Terraform gateway's Cedar render script resolves it",
-      "implementation": "./src/migrations/latest/terraform-gateway-cedar-render-root-ejs/migration"
-    },
-    "latest-rdb-terraform-aurora-app-module-defaults": {
-      "version": "1.0.0-rc.84",
-      "description": "Align the vended Terraform Aurora app module variable defaults with the core module, enabling CloudWatch engine log export and exposing enable_key_rotation",
-      "implementation": "./src/migrations/latest/rdb-terraform-aurora-app-module-defaults/migration"
-    },
-    "latest-agentcore-harness-no-tools-by-default": {
-      "version": "1.0.0-rc.84",
-      "description": "Pin the vended AgentCore Harness construct/module to no tools by default, since AgentCore treats an absent allowedTools as every tool",
-      "implementation": "./src/migrations/latest/agentcore-harness-no-tools-by-default/migration"
-    },
-    "latest-terraform-declare-used-providers": {
-      "version": "1.0.0-rc.84",
-      "description": "Declare every provider each vended Terraform module uses in its own required_providers",
-      "implementation": "./src/migrations/latest/terraform-declare-used-providers/migration"
-    },
-    "latest-waf-log-group-cmk-encryption": {
-      "version": "1.0.0-rc.84",
-      "description": "Encrypt vended WAF log groups with a customer-managed KMS key",
-      "implementation": "./src/migrations/latest/waf-log-group-cmk-encryption/migration"
-    },
-    "latest-terraform-harness-vpc-role-and-memory-grant": {
-      "version": "1.0.0-rc.84",
-      "description": "Add VPC, execution role and native field support to the vended Terraform AgentCore Harness module, and scope its managed-memory grant to the service-assigned ARN",
-      "implementation": "./src/migrations/latest/terraform-harness-vpc-role-and-memory-grant/migration"
-    },
-    "latest-terraform-project-checkov-target-and-bootstrap-destroy": {
-      "version": "1.0.0-rc.85",
-      "description": "Add the Terraform checkov target and config, make bootstrap-destroy non-interactive, and declare required_version in the vended providers.tf",
-      "implementation": "./src/migrations/latest/terraform-project-checkov-target-and-bootstrap-destroy/migration"
-    },
     "latest-add-destroy-sandbox-target": {
       "version": "1.0.0-rc.87",
       "description": "Add a destroy-sandbox target to CDK infrastructure projects which destroys the sandbox stage, and drop the --require-approval flag from cdk destroy, which has no such option",
@@ -87,6 +12,21 @@
       "description": "Replace the MySQL RDS Proxy role's admin secret access with the rds-db:connect grant it needs for end-to-end IAM auth",
       "implementation": "./src/migrations/latest/terraform-rdb-proxy-iam-connect-grant/migration"
     },
+    "latest-python-version-drop-exact-patch": {
+      "version": "1.0.0-rc.88",
+      "description": "Drop the exact CPython patch from .python-version to the Lambda runtime's major.minor",
+      "implementation": "./src/migrations/latest/python-version-drop-exact-patch/migration"
+    },
+    "latest-react-website-nx-react-express-override": {
+      "version": "1.0.0-rc.88",
+      "description": "Add an npm override pinning the express @nx/react resolves to the version generated websites use, so npm can satisfy its optional peer",
+      "implementation": "./src/migrations/latest/react-website-nx-react-express-override/migration"
+    },
+    "latest-nx-parallel-default": {
+      "version": "1.0.0-rc.89",
+      "description": "Set nx.json parallel to 8 so full builds use available cores, preserving an existing value",
+      "implementation": "./src/migrations/latest/nx-parallel-default/migration"
+    },
     "v1.0.0-rc.50-0001-modernize-function-props-cast": {
       "version": "1.0.0-rc.50",
       "description": "Replace the legacy angle-bracket FunctionProps type assertion with the modern as syntax in generated API constructs",
@@ -227,8 +167,83 @@
       "description": "Extract the duplicated session-id Express middleware in ts#agent's ag-ui/a2a index.ts into a shared middleware/session-id-middleware.ts module",
       "implementation": "./src/migrations/v1.0.0-rc.75/0001-ts-agent-session-id-middleware-extraction/migration"
     },
+    "v1.0.0-rc.77-0001-dynamodb-configurable-encryption": {
+      "version": "1.0.0-rc.77",
+      "description": "Surface encryption and encryptionKey on the vended DynamoDBTable construct/module",
+      "implementation": "./src/migrations/v1.0.0-rc.77/0001-dynamodb-configurable-encryption/migration"
+    },
+    "v1.0.0-rc.77-0002-user-identity-configurable-mfa": {
+      "version": "1.0.0-rc.77",
+      "description": "Surface mfa and mfaSecondFactor on the vended UserIdentity construct/module",
+      "implementation": "./src/migrations/v1.0.0-rc.77/0002-user-identity-configurable-mfa/migration"
+    },
+    "v1.0.0-rc.78-0001-static-website-configurable-waf-encryption": {
+      "version": "1.0.0-rc.78",
+      "description": "Surface enableWaf, encryption, encryptionKey and enableKeyRotation on the vended StaticWebsite construct/module",
+      "implementation": "./src/migrations/v1.0.0-rc.78/0001-static-website-configurable-waf-encryption/migration"
+    },
+    "v1.0.0-rc.79-0001-py-agent-ag-ui-hooks": {
+      "version": "1.0.0-rc.79",
+      "description": "Forward the py#agent Strands hooks to the AG-UI adapter so model and tool errors are reported",
+      "implementation": "./src/migrations/v1.0.0-rc.79/0001-py-agent-ag-ui-hooks/migration"
+    },
+    "v1.0.0-rc.82-0001-terraform-load-runtime-config-src-path": {
+      "version": "1.0.0-rc.82",
+      "description": "Point the react website's terraform load-runtime-config target at the runtime-config file the terraform aggregation actually writes",
+      "implementation": "./src/migrations/v1.0.0-rc.82/0001-terraform-load-runtime-config-src-path/migration"
+    },
+    "v1.0.0-rc.82-0002-runtime-config-namespace-defaults": {
+      "version": "1.0.0-rc.82",
+      "description": "Provision AppConfig configuration profiles for every namespace the vended terraform modules write to",
+      "implementation": "./src/migrations/v1.0.0-rc.82/0002-runtime-config-namespace-defaults/migration"
+    },
+    "v1.0.0-rc.83-0001-dynamodb-terraform-app-module-outputs": {
+      "version": "1.0.0-rc.83",
+      "description": "Re-export the DynamoDB table and KMS key attributes from the vended Terraform per-table app module",
+      "implementation": "./src/migrations/v1.0.0-rc.83/0001-dynamodb-terraform-app-module-outputs/migration"
+    },
+    "v1.0.0-rc.83-0002-terraform-data-resource-destroy-protection": {
+      "version": "1.0.0-rc.83",
+      "description": "Add prevent_destroy and a 30 day KMS deletion window to the vended Terraform DynamoDB table and Aurora cluster modules",
+      "implementation": "./src/migrations/v1.0.0-rc.83/0002-terraform-data-resource-destroy-protection/migration"
+    },
+    "v1.0.0-rc.83-0003-terraform-gateway-cedar-render-root-ejs": {
+      "version": "1.0.0-rc.83",
+      "description": "Declare ejs at the workspace root so the Terraform gateway's Cedar render script resolves it",
+      "implementation": "./src/migrations/v1.0.0-rc.83/0003-terraform-gateway-cedar-render-root-ejs/migration"
+    },
+    "v1.0.0-rc.84-0001-rdb-terraform-aurora-app-module-defaults": {
+      "version": "1.0.0-rc.84",
+      "description": "Align the vended Terraform Aurora app module variable defaults with the core module, enabling CloudWatch engine log export and exposing enable_key_rotation",
+      "implementation": "./src/migrations/v1.0.0-rc.84/0001-rdb-terraform-aurora-app-module-defaults/migration"
+    },
+    "v1.0.0-rc.84-0002-agentcore-harness-no-tools-by-default": {
+      "version": "1.0.0-rc.84",
+      "description": "Pin the vended AgentCore Harness construct/module to no tools by default, since AgentCore treats an absent allowedTools as every tool",
+      "implementation": "./src/migrations/v1.0.0-rc.84/0002-agentcore-harness-no-tools-by-default/migration"
+    },
+    "v1.0.0-rc.84-0003-terraform-declare-used-providers": {
+      "version": "1.0.0-rc.84",
+      "description": "Declare every provider each vended Terraform module uses in its own required_providers",
+      "implementation": "./src/migrations/v1.0.0-rc.84/0003-terraform-declare-used-providers/migration"
+    },
+    "v1.0.0-rc.84-0004-waf-log-group-cmk-encryption": {
+      "version": "1.0.0-rc.84",
+      "description": "Encrypt vended WAF log groups with a customer-managed KMS key",
+      "implementation": "./src/migrations/v1.0.0-rc.84/0004-waf-log-group-cmk-encryption/migration"
+    },
+    "v1.0.0-rc.84-0005-terraform-harness-vpc-role-and-memory-grant": {
+      "version": "1.0.0-rc.84",
+      "description": "Add VPC, execution role and native field support to the vended Terraform AgentCore Harness module, and scope its managed-memory grant to the service-assigned ARN",
+      "implementation": "./src/migrations/v1.0.0-rc.84/0005-terraform-harness-vpc-role-and-memory-grant/migration"
+    },
+    "v1.0.0-rc.85-0001-terraform-project-checkov-target-and-bootstrap-destroy": {
+      "version": "1.0.0-rc.85",
+      "description": "Add the Terraform checkov target and config, make bootstrap-destroy non-interactive, and declare required_version in the vended providers.tf",
+      "implementation": "./src/migrations/v1.0.0-rc.85/0001-terraform-project-checkov-target-and-bootstrap-destroy/migration"
+    },
     "sync-vended-versions": {
-      "version": "1.0.0-rc.87",
+      "version": "1.0.0-rc.89",
       "description": "Sync vended dependency versions and the tracked plugin version to those vended by this release",
       "implementation": "./src/utils/version-upgrade-migration/migration"
     }
@@ -266,6 +281,39 @@
           "alwaysAddToPackageJson": false
         }
       }
+    },
+    "nx-23.1.2-nx-packages": {
+      "version": "1.0.0-rc.89",
+      "packages": {
+        "nx": {
+          "version": "23.1.2",
+          "alwaysAddToPackageJson": false
+        },
+        "@nx/devkit": {
+          "version": "23.1.2",
+          "alwaysAddToPackageJson": false
+        },
+        "@nx/js": {
+          "version": "23.1.2",
+          "alwaysAddToPackageJson": false
+        },
+        "@nx/react": {
+          "version": "23.1.2",
+          "alwaysAddToPackageJson": false
+        },
+        "@nx/vite": {
+          "version": "23.1.2",
+          "alwaysAddToPackageJson": false
+        },
+        "@nx/vitest": {
+          "version": "23.1.2",
+          "alwaysAddToPackageJson": false
+        },
+        "@nx/workspace": {
+          "version": "23.1.2",
+          "alwaysAddToPackageJson": false
+        }
+      }
     }
   }
 }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@aws/nx-plugin",
-  "version": "1.0.0-rc.87",
+  "version": "1.0.0-rc.89",
   "repository": {
     "type": "git",
     "url": "https://github.com/awslabs/nx-plugin-for-aws.git",
@@ -36,7 +36,7 @@
     "node": ">=20.19.0"
   },
   "peerDependencies": {
-    "nx": "23.1.1"
+    "nx": "23.1.2"
   },
   "dependencies": {
     "@apidevtools/swagger-parser": "12.1.0",
@@ -46,10 +46,10 @@
     "@getgrit/gritql": "0.0.3",
     "@iarna/toml": "2.2.5",
     "@modelcontextprotocol/sdk": "1.30.0",
-    "@nx/devkit": "23.1.1",
-    "@nx/js": "23.1.1",
-    "@nx/react": "23.1.1",
-    "@nx/vite": "23.1.1",
+    "@nx/devkit": "23.1.2",
+    "@nx/js": "23.1.2",
+    "@nx/react": "23.1.2",
+    "@nx/vite": "23.1.2",
     "@nxlv/python": "23.0.0",
     "@phenomnomnominal/tsquery": "6.2.0",
     "@types/estree": "1.0.9",
@@ -58,7 +58,7 @@
     "enquirer": "2.4.1",
     "fast-glob": "3.3.3",
     "jiti": "2.7.0",
-    "js-yaml": "4.3.1",
+    "js-yaml": "4.3.2",
     "license-checker-rseidelsohn": "4.4.2",
     "lodash.camelcase": "4.3.0",
     "lodash.clonedeepwith": "4.5.0",

package/src/agentcore-gateway/__snapshots__/generator.spec.ts.snap

@@ -7,7 +7,7 @@ exports[`agentcore-gateway generator > protocol: http > omits protocol_type from
   required_providers {
     aws = {
       source  = "hashicorp/aws"
-      version = "6.61.0"
+      version = "6.62.0"
     }
     time = {
       source  = "hashicorp/time"

package/src/infra/app/__snapshots__/generator.spec.ts.snap

@@ -4,8 +4,8 @@ exports[`infra generator > should add required dependencies to package.json > de
 
 exports[`infra generator > should add required dependencies to package.json > dev-dependencies 1`] = `
 {
-  "@nx/js": "23.1.1",
-  "@nx/vitest": "23.1.1",
+  "@nx/js": "23.1.2",
+  "@nx/vitest": "23.1.2",
   "@swc/helpers": "~0.5.18",
   "@types/node": "catalog:",
   "@vitest/coverage-v8": "catalog:",
@@ -23,8 +23,8 @@ exports[`infra generator > should add required dependencies to package.json > pa
 {
   "dependencies": {},
   "devDependencies": {
-    "@nx/js": "23.1.1",
-    "@nx/vitest": "23.1.1",
+    "@nx/js": "23.1.2",
+    "@nx/vitest": "23.1.2",
     "@swc/helpers": "~0.5.18",
     "@types/node": "catalog:",
     "@vitest/coverage-v8": "catalog:",
@@ -56,7 +56,7 @@ exports[`infra generator > should configure Checkov target correctly > checkov-t
     "{workspaceRoot}/dist/{projectRoot}/cdk.out",
   ],
   "options": {
-    "command": "uvx --from checkov==3.3.13 checkov --config-file {projectRoot}/checkov.yml --directory dist/{projectRoot}/cdk.out --framework cloudformation",
+    "command": "uvx --from checkov==3.3.15 checkov --config-file {projectRoot}/checkov.yml --directory dist/{projectRoot}/cdk.out --framework cloudformation",
   },
   "outputs": [
     "{workspaceRoot}/dist/{projectRoot}/checkov",
@@ -150,7 +150,7 @@ exports[`infra generator > should configure project.json with correct targets >
         "{workspaceRoot}/dist/{projectRoot}/cdk.out",
       ],
       "options": {
-        "command": "uvx --from checkov==3.3.13 checkov --config-file {projectRoot}/checkov.yml --directory dist/{projectRoot}/cdk.out --framework cloudformation",
+        "command": "uvx --from checkov==3.3.15 checkov --config-file {projectRoot}/checkov.yml --directory dist/{projectRoot}/cdk.out --framework cloudformation",
       },
       "outputs": [
         "{workspaceRoot}/dist/{projectRoot}/checkov",
@@ -756,7 +756,7 @@ exports[`infra generator > should handle custom project names correctly > custom
         "{workspaceRoot}/dist/{projectRoot}/cdk.out",
       ],
       "options": {
-        "command": "uvx --from checkov==3.3.13 checkov --config-file {projectRoot}/checkov.yml --directory dist/{projectRoot}/cdk.out --framework cloudformation",
+        "command": "uvx --from checkov==3.3.15 checkov --config-file {projectRoot}/checkov.yml --directory dist/{projectRoot}/cdk.out --framework cloudformation",
       },
       "outputs": [
         "{workspaceRoot}/dist/{projectRoot}/checkov",

package/src/migrations/latest/nx-parallel-default/metadata.json

@@ -0,0 +1,3 @@
+{
+  "description": "Set nx.json parallel to 8 so full builds use available cores, preserving an existing value"
+}

package/src/migrations/latest/nx-parallel-default/migration.d.ts

@@ -0,0 +1,14 @@
+/**
+ * Copyright Amazon.com, Inc. or its affiliates. All Rights Reserved.
+ * SPDX-License-Identifier: Apache-2.0
+ */
+import { type MigrationReturnObject, type Tree } from '@nx/devkit';
+/**
+ * New workspaces set `parallel` in `nx.json` so a full build uses the available
+ * cores rather than Nx's default of 3. Existing workspaces have no value at all,
+ * so this backfills it.
+ *
+ * A workspace that already declares `parallel` has made a deliberate choice —
+ * often to bound memory on a smaller machine — so it is left as it is.
+ */
+export default function migration(tree: Tree): Promise<MigrationReturnObject>;

package/src/migrations/latest/nx-parallel-default/migration.js

@@ -0,0 +1,29 @@
+/**
+ * Copyright Amazon.com, Inc. or its affiliates. All Rights Reserved.
+ * SPDX-License-Identifier: Apache-2.0
+ */ import { readNxJson, updateNxJson } from "@nx/devkit";
+import { formatFilesInSubtree } from "../../../utils/format.js";
+import { DEFAULT_PARALLEL } from "../../../utils/init.js";
+/**
+ * New workspaces set `parallel` in `nx.json` so a full build uses the available
+ * cores rather than Nx's default of 3. Existing workspaces have no value at all,
+ * so this backfills it.
+ *
+ * A workspace that already declares `parallel` has made a deliberate choice —
+ * often to bound memory on a smaller machine — so it is left as it is.
+ */ export default async function migration(tree) {
+    const nextSteps = [];
+    const nxJson = readNxJson(tree);
+    if (nxJson && nxJson.parallel === undefined) {
+        updateNxJson(tree, {
+            ...nxJson,
+            parallel: DEFAULT_PARALLEL
+        });
+    }
+    await formatFilesInSubtree(tree);
+    return {
+        nextSteps
+    };
+}
+
+//# sourceMappingURL=migration.js.map

package/src/migrations/latest/nx-parallel-default/migration.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../../../../../../../packages/nx-plugin/src/migrations/latest/nx-parallel-default/migration.ts"],"sourcesContent":["/**\n * Copyright Amazon.com, Inc. or its affiliates. All Rights Reserved.\n * SPDX-License-Identifier: Apache-2.0\n */\nimport {\n  type MigrationReturnObject,\n  readNxJson,\n  type Tree,\n  updateNxJson,\n} from '@nx/devkit';\nimport { formatFilesInSubtree } from '../../../utils/format.js';\nimport { DEFAULT_PARALLEL } from '../../../utils/init.js';\n\n/**\n * New workspaces set `parallel` in `nx.json` so a full build uses the available\n * cores rather than Nx's default of 3. Existing workspaces have no value at all,\n * so this backfills it.\n *\n * A workspace that already declares `parallel` has made a deliberate choice —\n * often to bound memory on a smaller machine — so it is left as it is.\n */\nexport default async function migration(\n  tree: Tree,\n): Promise<MigrationReturnObject> {\n  const nextSteps: string[] = [];\n\n  const nxJson = readNxJson(tree);\n  if (nxJson && nxJson.parallel === undefined) {\n    updateNxJson(tree, { ...nxJson, parallel: DEFAULT_PARALLEL });\n  }\n\n  await formatFilesInSubtree(tree);\n\n  return { nextSteps };\n}\n"],"names":["readNxJson","updateNxJson","formatFilesInSubtree","DEFAULT_PARALLEL","migration","tree","nextSteps","nxJson","parallel","undefined"],"mappings":"AAAA;;;CAGC,GACD,SAEEA,UAAU,EAEVC,YAAY,QACP,aAAa;AACpB,SAASC,oBAAoB,QAAQ,2BAA2B;AAChE,SAASC,gBAAgB,QAAQ,yBAAyB;AAE1D;;;;;;;CAOC,GACD,eAAe,eAAeC,UAC5BC,IAAU;IAEV,MAAMC,YAAsB,EAAE;IAE9B,MAAMC,SAASP,WAAWK;IAC1B,IAAIE,UAAUA,OAAOC,QAAQ,KAAKC,WAAW;QAC3CR,aAAaI,MAAM;YAAE,GAAGE,MAAM;YAAEC,UAAUL;QAAiB;IAC7D;IAEA,MAAMD,qBAAqBG;IAE3B,OAAO;QAAEC;IAAU;AACrB"}

package/src/migrations/latest/python-version-drop-exact-patch/metadata.json

@@ -0,0 +1,3 @@
+{
+  "description": "Drop the exact CPython patch from .python-version to the Lambda runtime's major.minor"
+}

package/src/migrations/latest/python-version-drop-exact-patch/migration.js

@@ -0,0 +1,43 @@
+/**
+ * Copyright Amazon.com, Inc. or its affiliates. All Rights Reserved.
+ * SPDX-License-Identifier: Apache-2.0
+ */ import { visitNotIgnoredFiles } from "@nx/devkit";
+import { formatFilesInSubtree } from "../../../utils/format.js";
+/**
+ * A `.python-version` naming an exact CPython patch resolves only where uv has a
+ * build of that patch: `3.14.7` installs on Linux but not on macOS, so `uv sync`
+ * fails there on a workspace that works elsewhere.
+ *
+ * uv reads a bare `major.minor` as a request for any patch of that minor, so
+ * dropping the patch lets each platform resolve a build it has. Lambda patches the
+ * interpreter itself, so the minor is the whole of what a project needs to pin.
+ *
+ * Only a patch of the minor the releases in question vended is dropped — another
+ * minor is the user's choice of interpreter, and the version sync moves the
+ * interpreter forward when the runtime's minor itself changes.
+ */ /**
+ * The Python runtime minor those releases vended, spelled out rather than read
+ * from `LAMBDA_RUNTIME_VERSIONS`.
+ *
+ * A migration describes a fixed point in history: it has to keep rewriting the
+ * versions those releases actually wrote, whatever the current pin is. Reading the
+ * live constant would silently retarget this at whatever minor the plugin vends by
+ * the time a user upgrades, and stop correcting the value it exists for.
+ */ const VENDED_MINOR = '3.14';
+export default async function migration(tree) {
+    // uv writes a `.python-version` per project as well as at the root, and one
+    // left behind fails `uv sync` for that project alone.
+    visitNotIgnoredFiles(tree, '.', (path)=>{
+        if (path !== '.python-version' && !path.endsWith('/.python-version')) {
+            return;
+        }
+        const declared = (tree.read(path, 'utf-8') ?? '').trim();
+        if (/^(\d+\.\d+)\.\d+$/.exec(declared)?.[1] === VENDED_MINOR) {
+            tree.write(path, `${VENDED_MINOR}\n`);
+        }
+    });
+    await formatFilesInSubtree(tree);
+    return {};
+}
+
+//# sourceMappingURL=migration.js.map

package/src/migrations/latest/python-version-drop-exact-patch/migration.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../../../../../../../packages/nx-plugin/src/migrations/latest/python-version-drop-exact-patch/migration.ts"],"sourcesContent":["/**\n * Copyright Amazon.com, Inc. or its affiliates. All Rights Reserved.\n * SPDX-License-Identifier: Apache-2.0\n */\nimport {\n  type MigrationReturnObject,\n  type Tree,\n  visitNotIgnoredFiles,\n} from '@nx/devkit';\nimport { formatFilesInSubtree } from '../../../utils/format.js';\n\n/**\n * A `.python-version` naming an exact CPython patch resolves only where uv has a\n * build of that patch: `3.14.7` installs on Linux but not on macOS, so `uv sync`\n * fails there on a workspace that works elsewhere.\n *\n * uv reads a bare `major.minor` as a request for any patch of that minor, so\n * dropping the patch lets each platform resolve a build it has. Lambda patches the\n * interpreter itself, so the minor is the whole of what a project needs to pin.\n *\n * Only a patch of the minor the releases in question vended is dropped — another\n * minor is the user's choice of interpreter, and the version sync moves the\n * interpreter forward when the runtime's minor itself changes.\n */\n\n/**\n * The Python runtime minor those releases vended, spelled out rather than read\n * from `LAMBDA_RUNTIME_VERSIONS`.\n *\n * A migration describes a fixed point in history: it has to keep rewriting the\n * versions those releases actually wrote, whatever the current pin is. Reading the\n * live constant would silently retarget this at whatever minor the plugin vends by\n * the time a user upgrades, and stop correcting the value it exists for.\n */\nconst VENDED_MINOR = '3.14';\n\nexport default async function migration(\n  tree: Tree,\n): Promise<MigrationReturnObject> {\n  // uv writes a `.python-version` per project as well as at the root, and one\n  // left behind fails `uv sync` for that project alone.\n  visitNotIgnoredFiles(tree, '.', (path) => {\n    if (path !== '.python-version' && !path.endsWith('/.python-version')) {\n      return;\n    }\n    const declared = (tree.read(path, 'utf-8') ?? '').trim();\n    if (/^(\\d+\\.\\d+)\\.\\d+$/.exec(declared)?.[1] === VENDED_MINOR) {\n      tree.write(path, `${VENDED_MINOR}\\n`);\n    }\n  });\n\n  await formatFilesInSubtree(tree);\n\n  return {};\n}\n"],"names":["visitNotIgnoredFiles","formatFilesInSubtree","VENDED_MINOR","migration","tree","path","endsWith","declared","read","trim","exec","write"],"mappings":"AAAA;;;CAGC,GACD,SAGEA,oBAAoB,QACf,aAAa;AACpB,SAASC,oBAAoB,QAAQ,2BAA2B;AAEhE;;;;;;;;;;;;CAYC,GAED;;;;;;;;CAQC,GACD,MAAMC,eAAe;AAErB,eAAe,eAAeC,UAC5BC,IAAU;IAEV,4EAA4E;IAC5E,sDAAsD;IACtDJ,qBAAqBI,MAAM,KAAK,CAACC;QAC/B,IAAIA,SAAS,qBAAqB,CAACA,KAAKC,QAAQ,CAAC,qBAAqB;YACpE;QACF;QACA,MAAMC,WAAW,AAACH,CAAAA,KAAKI,IAAI,CAACH,MAAM,YAAY,EAAC,EAAGI,IAAI;QACtD,IAAI,oBAAoBC,IAAI,CAACH,WAAW,CAAC,EAAE,KAAKL,cAAc;YAC5DE,KAAKO,KAAK,CAACN,MAAM,GAAGH,aAAa,EAAE,CAAC;QACtC;IACF;IAEA,MAAMD,qBAAqBG;IAE3B,OAAO,CAAC;AACV"}

package/src/migrations/latest/react-website-nx-react-express-override/metadata.json

@@ -0,0 +1,3 @@
+{
+  "description": "Add an npm override pinning the express @nx/react resolves to the version generated websites use, so npm can satisfy its optional peer"
+}

package/src/migrations/latest/react-website-nx-react-express-override/migration.d.ts

@@ -0,0 +1,31 @@
+/**
+ * Copyright Amazon.com, Inc. or its affiliates. All Rights Reserved.
+ * SPDX-License-Identifier: Apache-2.0
+ */
+import { type MigrationReturnObject, type Tree } from '@nx/devkit';
+/**
+ * Pin the `express` `@nx/react` resolves to the version generated websites use.
+ *
+ * `@nx/react` declares an optional `express` peer for its module-federation
+ * dev-server, on the major behind the `express` vended here. npm is alone in
+ * failing the whole install on an optional peer it cannot satisfy:
+ *
+ *   npm error ERESOLVE could not resolve
+ *   npm error   peerOptional express@"^4.21.2" from @nx/react
+ *   npm error Conflicting peer dependency: express@5.2.1
+ *
+ * so an npm workspace with a website cannot install once its nx moves onto a
+ * version carrying that peer. pnpm, bun and yarn only warn, and get nothing.
+ *
+ * Scoped to `@nx/react` rather than pinning `express` workspace-wide: nothing
+ * here loads it, the peer only has to be satisfiable, and a bare override would
+ * reach every other consumer of express too.
+ *
+ * Guardrails:
+ * - npm only, and only for a workspace that has a website — the root `@nx/react`
+ *   the generator adds. Anything else needs no override.
+ * - A user's own `overrides['@nx/react'].express` is left alone: theirs may pin a
+ *   version deliberately.
+ * - Idempotent: writing the same pin twice is a no-op.
+ */
+export default function migration(tree: Tree): Promise<MigrationReturnObject>;

package/src/migrations/latest/react-website-nx-react-express-override/migration.js

@@ -0,0 +1,74 @@
+/**
+ * Copyright Amazon.com, Inc. or its affiliates. All Rights Reserved.
+ * SPDX-License-Identifier: Apache-2.0
+ */ import { detectPackageManager, readJson, updateJson } from "@nx/devkit";
+import { formatFilesInSubtree } from "../../../utils/format.js";
+import { TS_VERSIONS } from "../../../utils/versions.js";
+/**
+ * Pin the `express` `@nx/react` resolves to the version generated websites use.
+ *
+ * `@nx/react` declares an optional `express` peer for its module-federation
+ * dev-server, on the major behind the `express` vended here. npm is alone in
+ * failing the whole install on an optional peer it cannot satisfy:
+ *
+ *   npm error ERESOLVE could not resolve
+ *   npm error   peerOptional express@"^4.21.2" from @nx/react
+ *   npm error Conflicting peer dependency: express@5.2.1
+ *
+ * so an npm workspace with a website cannot install once its nx moves onto a
+ * version carrying that peer. pnpm, bun and yarn only warn, and get nothing.
+ *
+ * Scoped to `@nx/react` rather than pinning `express` workspace-wide: nothing
+ * here loads it, the peer only has to be satisfiable, and a bare override would
+ * reach every other consumer of express too.
+ *
+ * Guardrails:
+ * - npm only, and only for a workspace that has a website — the root `@nx/react`
+ *   the generator adds. Anything else needs no override.
+ * - A user's own `overrides['@nx/react'].express` is left alone: theirs may pin a
+ *   version deliberately.
+ * - Idempotent: writing the same pin twice is a no-op.
+ */ export default async function migration(tree) {
+    const nextSteps = [];
+    if (detectPackageManager(tree.root) !== 'npm') {
+        return {
+            nextSteps
+        };
+    }
+    const packageJson = readJson(tree, 'package.json');
+    const hasNxReact = Boolean(packageJson.devDependencies?.['@nx/react'] ?? packageJson.dependencies?.['@nx/react']);
+    if (!hasNxReact) {
+        return {
+            nextSteps
+        }; // No website in this workspace.
+    }
+    const scoped = packageJson.overrides?.['@nx/react'];
+    // The string form pins `@nx/react` itself, leaving nowhere to nest the peer.
+    if (typeof scoped === 'string') {
+        nextSteps.push(`package.json: overrides['@nx/react'] pins a version as a string, so the express override could not be nested under it - left untouched. npm fails the install on @nx/react's optional express peer, so add { "@nx/react": { ".": "${scoped}", "express": "${TS_VERSIONS.express}" } } to keep it satisfiable.`);
+        return {
+            nextSteps
+        };
+    }
+    if (scoped?.express) {
+        return {
+            nextSteps
+        }; // Already pinned, by this migration or by the user.
+    }
+    updateJson(tree, 'package.json', (json)=>({
+            ...json,
+            overrides: {
+                ...json.overrides,
+                '@nx/react': {
+                    ...scoped,
+                    express: TS_VERSIONS.express
+                }
+            }
+        }));
+    await formatFilesInSubtree(tree);
+    return {
+        nextSteps
+    };
+}
+
+//# sourceMappingURL=migration.js.map

package/src/migrations/latest/react-website-nx-react-express-override/migration.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../../../../../../../packages/nx-plugin/src/migrations/latest/react-website-nx-react-express-override/migration.ts"],"sourcesContent":["/**\n * Copyright Amazon.com, Inc. or its affiliates. All Rights Reserved.\n * SPDX-License-Identifier: Apache-2.0\n */\nimport {\n  detectPackageManager,\n  type MigrationReturnObject,\n  readJson,\n  type Tree,\n  updateJson,\n} from '@nx/devkit';\nimport { formatFilesInSubtree } from '../../../utils/format';\nimport { TS_VERSIONS } from '../../../utils/versions';\n\n/**\n * Pin the `express` `@nx/react` resolves to the version generated websites use.\n *\n * `@nx/react` declares an optional `express` peer for its module-federation\n * dev-server, on the major behind the `express` vended here. npm is alone in\n * failing the whole install on an optional peer it cannot satisfy:\n *\n *   npm error ERESOLVE could not resolve\n *   npm error   peerOptional express@\"^4.21.2\" from @nx/react\n *   npm error Conflicting peer dependency: express@5.2.1\n *\n * so an npm workspace with a website cannot install once its nx moves onto a\n * version carrying that peer. pnpm, bun and yarn only warn, and get nothing.\n *\n * Scoped to `@nx/react` rather than pinning `express` workspace-wide: nothing\n * here loads it, the peer only has to be satisfiable, and a bare override would\n * reach every other consumer of express too.\n *\n * Guardrails:\n * - npm only, and only for a workspace that has a website — the root `@nx/react`\n *   the generator adds. Anything else needs no override.\n * - A user's own `overrides['@nx/react'].express` is left alone: theirs may pin a\n *   version deliberately.\n * - Idempotent: writing the same pin twice is a no-op.\n */\nexport default async function migration(\n  tree: Tree,\n): Promise<MigrationReturnObject> {\n  const nextSteps: string[] = [];\n\n  if (detectPackageManager(tree.root) !== 'npm') {\n    return { nextSteps };\n  }\n\n  const packageJson = readJson<{\n    devDependencies?: Record<string, string>;\n    dependencies?: Record<string, string>;\n    overrides?: Record<string, unknown>;\n  }>(tree, 'package.json');\n\n  const hasNxReact = Boolean(\n    packageJson.devDependencies?.['@nx/react'] ??\n      packageJson.dependencies?.['@nx/react'],\n  );\n  if (!hasNxReact) {\n    return { nextSteps }; // No website in this workspace.\n  }\n\n  const scoped = packageJson.overrides?.['@nx/react'] as\n    | Record<string, string>\n    | string\n    | undefined;\n\n  // The string form pins `@nx/react` itself, leaving nowhere to nest the peer.\n  if (typeof scoped === 'string') {\n    nextSteps.push(\n      `package.json: overrides['@nx/react'] pins a version as a string, so the express override could not be nested under it - left untouched. npm fails the install on @nx/react's optional express peer, so add { \"@nx/react\": { \".\": \"${scoped}\", \"express\": \"${TS_VERSIONS.express}\" } } to keep it satisfiable.`,\n    );\n    return { nextSteps };\n  }\n\n  if (scoped?.express) {\n    return { nextSteps }; // Already pinned, by this migration or by the user.\n  }\n\n  updateJson(tree, 'package.json', (json) => ({\n    ...json,\n    overrides: {\n      ...json.overrides,\n      '@nx/react': { ...scoped, express: TS_VERSIONS.express },\n    },\n  }));\n\n  await formatFilesInSubtree(tree);\n\n  return { nextSteps };\n}\n"],"names":["detectPackageManager","readJson","updateJson","formatFilesInSubtree","TS_VERSIONS","migration","tree","nextSteps","root","packageJson","hasNxReact","Boolean","devDependencies","dependencies","scoped","overrides","push","express","json"],"mappings":"AAAA;;;CAGC,GACD,SACEA,oBAAoB,EAEpBC,QAAQ,EAERC,UAAU,QACL,aAAa;AACpB,SAASC,oBAAoB,QAAQ,2BAAwB;AAC7D,SAASC,WAAW,QAAQ,6BAA0B;AAEtD;;;;;;;;;;;;;;;;;;;;;;;;CAwBC,GACD,eAAe,eAAeC,UAC5BC,IAAU;IAEV,MAAMC,YAAsB,EAAE;IAE9B,IAAIP,qBAAqBM,KAAKE,IAAI,MAAM,OAAO;QAC7C,OAAO;YAAED;QAAU;IACrB;IAEA,MAAME,cAAcR,SAIjBK,MAAM;IAET,MAAMI,aAAaC,QACjBF,YAAYG,eAAe,EAAE,CAAC,YAAY,IACxCH,YAAYI,YAAY,EAAE,CAAC,YAAY;IAE3C,IAAI,CAACH,YAAY;QACf,OAAO;YAAEH;QAAU,GAAG,gCAAgC;IACxD;IAEA,MAAMO,SAASL,YAAYM,SAAS,EAAE,CAAC,YAAY;IAKnD,6EAA6E;IAC7E,IAAI,OAAOD,WAAW,UAAU;QAC9BP,UAAUS,IAAI,CACZ,CAAC,kOAAkO,EAAEF,OAAO,eAAe,EAAEV,YAAYa,OAAO,CAAC,6BAA6B,CAAC;QAEjT,OAAO;YAAEV;QAAU;IACrB;IAEA,IAAIO,QAAQG,SAAS;QACnB,OAAO;YAAEV;QAAU,GAAG,oDAAoD;IAC5E;IAEAL,WAAWI,MAAM,gBAAgB,CAACY,OAAU,CAAA;YAC1C,GAAGA,IAAI;YACPH,WAAW;gBACT,GAAGG,KAAKH,SAAS;gBACjB,aAAa;oBAAE,GAAGD,MAAM;oBAAEG,SAASb,YAAYa,OAAO;gBAAC;YACzD;QACF,CAAA;IAEA,MAAMd,qBAAqBG;IAE3B,OAAO;QAAEC;IAAU;AACrB"}