npm - @aws/nx-plugin - Versions diffs - 1.0.0-rc.87 → 1.0.0-rc.89 - Mend

@aws/nx-plugin 1.0.0-rc.87 → 1.0.0-rc.89

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.

Files changed (133) hide show

package/src/utils/versions.js CHANGED Viewed

@@ -16,17 +16,17 @@
     // as fixed. Overriding brace-expansion directly is not viable — 5.x drops the
     // CommonJS default export that minimatch 9 calls.
     minimatch: '10.2.6',
-    '@aws-sdk/client-dynamodb': '3.1116.0',
-    '@aws-sdk/client-api-gateway': '3.1116.0',
-    '@aws-sdk/client-iam': '3.1116.0',
-    '@aws-sdk/client-bedrock-agentcore': '3.1116.0',
-    '@aws-sdk/client-bedrock-runtime': '3.1116.0',
-    '@aws-sdk/client-s3': '3.1116.0',
-    '@aws-sdk/client-sts': '3.1116.0',
-    '@aws-sdk/credential-providers': '3.1116.0',
+    '@aws-sdk/client-dynamodb': '3.1119.0',
+    '@aws-sdk/client-api-gateway': '3.1119.0',
+    '@aws-sdk/client-iam': '3.1119.0',
+    '@aws-sdk/client-bedrock-agentcore': '3.1119.0',
+    '@aws-sdk/client-bedrock-runtime': '3.1119.0',
+    '@aws-sdk/client-s3': '3.1119.0',
+    '@aws-sdk/client-sts': '3.1119.0',
+    '@aws-sdk/credential-providers': '3.1119.0',
     '@aws-sdk/credential-provider-cognito-identity': '3.972.69',
-    '@aws-sdk/client-secrets-manager': '3.1116.0',
-    '@aws-sdk/rds-signer': '3.1116.0',
+    '@aws-sdk/client-secrets-manager': '3.1119.0',
+    '@aws-sdk/rds-signer': '3.1119.0',
     '@smithy/server-apigateway': '0.3.3',
     '@smithy/server-node': '0.3.3',
     '@aws-lambda-powertools/logger': '2.35.0',
@@ -34,47 +34,47 @@
     '@aws-lambda-powertools/parameters': '2.35.0',
     '@aws-lambda-powertools/tracer': '2.35.0',
     '@aws-lambda-powertools/parser': '2.35.0',
-    '@aws-sdk/client-appconfigdata': '3.1116.0',
+    '@aws-sdk/client-appconfigdata': '3.1119.0',
     '@middy/core': '7.8.0',
     '@nxlv/python': '23.0.0',
     '@nx-extend/terraform': '10.4.1',
     // These must all hold the same version — see NX_PACKAGES.
-    nx: '23.1.1',
-    '@nx/devkit': '23.1.1',
-    '@nx/js': '23.1.1',
-    '@nx/react': '23.1.1',
-    '@nx/vite': '23.1.1',
-    '@nx/vitest': '23.1.1',
-    '@nx/workspace': '23.1.1',
-    'create-nx-workspace': '23.1.1',
+    nx: '23.1.2',
+    '@nx/devkit': '23.1.2',
+    '@nx/js': '23.1.2',
+    '@nx/react': '23.1.2',
+    '@nx/vite': '23.1.2',
+    '@nx/vitest': '23.1.2',
+    '@nx/workspace': '23.1.2',
+    'create-nx-workspace': '23.1.2',
     '@swc-node/register': '1.12.1',
     '@swc/core': '1.16.1',
     '@modelcontextprotocol/sdk': '1.30.0',
-    '@modelcontextprotocol/inspector': '2.3.0',
+    '@modelcontextprotocol/inspector': '2.4.0',
     '@ag-ui/a2ui-toolkit': '0.0.4',
     '@ag-ui/aws-strands': '0.2.3',
     '@ag-ui/client': '0.0.57',
     '@ag-ui/core': '0.0.57',
     '@ag-ui/encoder': '0.0.57',
     'agent-chat-cli': '0.3.0',
-    '@copilotkit/react-core': '1.69.0',
+    '@copilotkit/react-core': '1.69.2',
     rxjs: '7.8.2',
     '@strands-agents/sdk': '1.14.0',
-    '@tanstack/react-router': '1.170.31',
-    '@tanstack/router-plugin': '1.168.34',
-    '@tanstack/router-generator': '1.167.32',
+    '@tanstack/react-router': '1.170.32',
+    '@tanstack/router-plugin': '1.168.35',
+    '@tanstack/router-generator': '1.167.33',
     '@tanstack/virtual-file-routes': '1.162.0',
     '@tanstack/router-utils': '1.162.2',
     '@cloudscape-design/board-components': '3.0.220',
     '@cloudscape-design/chat-components': '1.0.164',
-    '@cloudscape-design/components': '3.0.1352',
+    '@cloudscape-design/components': '3.0.1354',
     '@cloudscape-design/global-styles': '1.0.67',
-    '@tanstack/react-query': '5.102.0',
-    '@tanstack/react-query-devtools': '5.102.0',
+    '@tanstack/react-query': '5.102.6',
+    '@tanstack/react-query-devtools': '5.102.6',
     '@trpc/tanstack-react-query': '11.18.0',
     '@trpc/client': '11.18.0',
     '@trpc/server': '11.18.0',
-    '@types/node': '26.2.0',
+    '@types/node': '26.4.0',
     '@types/aws-lambda': '8.10.162',
     '@types/cors': '2.8.19',
     '@types/pg': '8.23.1',
@@ -87,11 +87,11 @@
     '@vitest/coverage-v8': '4.1.11',
     '@vitest/ui': '4.1.11',
     '@astrojs/react': '6.0.4',
-    '@astrojs/starlight': '0.41.7',
-    astro: '7.2.4',
+    '@astrojs/starlight': '0.41.9',
+    astro: '7.2.8',
     cookie: '2.0.1',
     aws4fetch: '1.0.20',
-    'aws-cdk': '2.1138.0',
+    'aws-cdk': '2.1139.0',
     'aws-cdk-lib': '2.266.0',
     'aws-xray-sdk-core': '3.12.0',
     constructs: '10.8.1',
@@ -106,9 +106,9 @@
     'event-source-polyfill': '1.0.31',
     '@types/event-source-polyfill': '1.0.5',
     '@biomejs/biome': '2.5.10',
-    '@prisma/adapter-mariadb': '7.9.1',
-    '@prisma/adapter-pg': '7.9.1',
-    '@prisma/client': '7.9.1',
+    '@prisma/adapter-mariadb': '7.10.0',
+    '@prisma/adapter-pg': '7.10.0',
+    '@prisma/client': '7.10.0',
     ejs: '6.0.1',
     '@types/ejs': '3.1.5',
     express: '5.2.1',
@@ -118,18 +118,18 @@
     '@types/fs-extra': '11.0.4',
     'make-dir-cli': '4.0.0',
     mariadb: '3.5.3',
-    mise: '2026.8.10',
+    mise: '2026.8.14',
     ncp: '2.0.0',
     npm: '12.0.2',
-    'npm-check-updates': '23.0.2',
+    'npm-check-updates': '23.1.0',
     'oidc-client-ts': '3.5.0',
     pg: '8.23.0',
-    prisma: '7.9.1',
+    prisma: '7.10.0',
     'react-oidc-context': '3.3.1',
     react: '19.2.8',
     'react-dom': '19.2.8',
     rimraf: '6.1.3',
-    rolldown: '1.2.5',
+    rolldown: '1.2.6',
     'rolldown-plugin-dts': '0.28.2',
     'simple-git': '3.36.0',
     'source-map-support': '0.5.21',
@@ -137,7 +137,7 @@
     tailwindcss: '4.3.3',
     '@tailwindcss/vite': '4.3.3',
     tsx: '4.23.12',
-    'lucide-react': '1.33.0',
+    'lucide-react': '1.34.0',
     'radix-ui': '1.6.7',
     shadcn: '4.19.0',
     'tw-animate-css': '1.4.0',
@@ -183,8 +183,8 @@
  * Versions for Python dependencies added by generators
  */ export const PY_VERSIONS = {
     'a2a-sdk': '==0.3.26',
-    'ag-ui-langgraph': '==0.0.43',
-    'ag-ui-protocol': '==0.1.20',
+    'ag-ui-langgraph': '==0.0.44',
+    'ag-ui-protocol': '==0.1.21',
     'ag-ui-strands': '==0.3.0',
     aiosqlite: '==0.22.1',
     'aws-lambda-powertools': '==3.34.0',
@@ -192,13 +192,13 @@
     'aws-lambda-powertools[parser]': '==3.34.0',
     'aws-opentelemetry-distro': '==0.19.0',
     'bedrock-agentcore': '==1.22.0',
-    boto3: '==1.43.78',
-    checkov: '==3.3.13',
+    boto3: '==1.43.82',
+    checkov: '==3.3.15',
     fastapi: '==0.141.1',
     'fastapi[standard]': '==0.141.1',
     httpx: '==0.28.1',
-    langchain: '==1.3.16',
-    'langchain-aws': '==1.7.3',
+    langchain: '==1.3.18',
+    'langchain-aws': '==1.7.4',
     'langchain-mcp-adapters': '==0.3.2',
     langgraph: '==1.2.11',
     'langgraph-checkpoint-aws': '==1.2.2',
@@ -207,10 +207,10 @@
     'pip-check-updates': '==0.29.0',
     'pip-licenses': '==5.5.5',
     ruff: '==0.16.4',
-    'strands-agents': '==1.53.0',
-    'strands-agents[a2a]': '==1.53.0',
+    'strands-agents': '==1.54.0',
+    'strands-agents[a2a]': '==1.54.0',
     'strands-agents-tools': '==0.8.6',
-    ty: '==0.0.74',
+    ty: '==0.0.75',
     pynamodb: '==6.1.0',
     uvicorn: '==0.52.4',
     sqlmodel: '==0.0.39',
@@ -250,7 +250,7 @@
     'software.amazon.smithy:smithy-aws-traits': '1.73.0',
     'software.amazon.smithy:smithy-validation-model': '1.73.0',
     'software.amazon.smithy:smithy-openapi': '1.73.0',
-    'software.amazon.smithy.typescript:smithy-aws-typescript-codegen': '0.52.0'
+    'software.amazon.smithy.typescript:smithy-aws-typescript-codegen': '0.53.0'
 };
 /** The Maven coordinates the version update resolves, in declaration order. */ export const JAVA_ARTIFACTS = Object.keys(JAVA_VERSIONS);
 /** A Maven coordinate as a dependency names it: `<group>:<artifact>:<version>`. */ export const javaMavenDependency = (artifact)=>`${artifact}:${JAVA_VERSIONS[artifact]}`;
@@ -300,17 +300,14 @@
     python: '3.14'
 };
 /**
- * Patch of the CPython release uv pins as the project interpreter.
+ * The interpreter uv pins for a generated Python project, as the Lambda runtime's
+ * `major.minor`.
  *
- * A Lambda runtime names only `major.minor`, but uv pins an exact
- * `major.minor.patch`, so only the patch lives here — the `major.minor` comes from
- * {@link LAMBDA_RUNTIME_VERSIONS}. Resolved from uv by the version update
- * workflow.
- */ export const PYTHON_RUNTIME_PATCH = '7';
-/**
- * The interpreter uv pins for a generated Python project, as `major.minor.patch`.
- * Matches the Lambda Python runtime by construction.
- */ export const pyenvPythonVersion = ()=>`${LAMBDA_RUNTIME_VERSIONS.python}.${PYTHON_RUNTIME_PATCH}`;
+ * No patch: uv reads this as a request for any patch of that minor, so it resolves
+ * whichever one the platform has a build for. Naming an exact patch pins one that
+ * may not exist everywhere, and Lambda patches the interpreter itself, so the minor
+ * is the whole of what a project needs to agree on.
+ */ export const pyenvPythonVersion = ()=>LAMBDA_RUNTIME_VERSIONS.python;
 /**
  * The `[project].requires-python` specifier for a generated Python project.
  *
@@ -343,7 +340,7 @@
  * Exact versions for Terraform providers used by generated `.tf` modules.
  * Pinned exactly (no range operator) so generated infrastructure is reproducible.
  */ export const TERRAFORM_VERSIONS = {
-    aws: '6.61.0',
+    aws: '6.62.0',
     random: '3.9.0',
     null: '3.3.1',
     archive: '2.8.0',

package/src/utils/versions.js.map CHANGED Viewed

	@@ -1 +1 @@
1	- {"version":3,"sources":["../../../../../packages/nx-plugin/src/utils/versions.ts"],"sourcesContent":["/*\n Copyright Amazon.com, Inc. or its affiliates. All Rights Reserved.\n * SPDX-License-Identifier: Apache-2.0\n /\nimport {\n type DeclaredPy,\n type DeclaredTs,\n type DependencyDeclaration,\n declaredNames,\n} from './declared-dependencies.js';\n\n/\n Versons for TypeScript dependencies added by generators\n /\nexport const TS_VERSIONS = {\n '@a2a-js/sdk': '0.3.14',\n '@aws/aws-distro-opentelemetry-node-autoinstrumentation': '0.12.0',\n // Pinned above the version the ADOT autoinstrumentation package resolves\n // transitively (2.8.0) to clear CVE-2026-59892 (HIGH).\n '@opentelemetry/propagator-jaeger': '2.10.0',\n // Overridden in the vended agent/MCP image builds to clear CVE-2026-14257\n // (HIGH) in brace-expansion: minimatch 10 is the lowest major depending on\n // brace-expansion 5.x, the only line Trivy's `< 5.0.8` advisory range treats\n // as fixed. Overriding brace-expansion directly is not viable — 5.x drops the\n // CommonJS default export that minimatch 9 calls.\n minimatch: '10.2.6',\n '@aws-sdk/client-dynamodb': '3.1116.0',\n '@aws-sdk/client-api-gateway': '3.1116.0',\n '@aws-sdk/client-iam': '3.1116.0',\n '@aws-sdk/client-bedrock-agentcore': '3.1116.0',\n '@aws-sdk/client-bedrock-runtime': '3.1116.0',\n '@aws-sdk/client-s3': '3.1116.0',\n '@aws-sdk/client-sts': '3.1116.0',\n '@aws-sdk/credential-providers': '3.1116.0',\n '@aws-sdk/credential-provider-cognito-identity': '3.972.69',\n '@aws-sdk/client-secrets-manager': '3.1116.0',\n '@aws-sdk/rds-signer': '3.1116.0',\n '@smithy/server-apigateway': '0.3.3',\n '@smithy/server-node': '0.3.3',\n '@aws-lambda-powertools/logger': '2.35.0',\n '@aws-lambda-powertools/metrics': '2.35.0',\n '@aws-lambda-powertools/parameters': '2.35.0',\n '@aws-lambda-powertools/tracer': '2.35.0',\n '@aws-lambda-powertools/parser': '2.35.0',\n '@aws-sdk/client-appconfigdata': '3.1116.0',\n '@middy/core': '7.8.0',\n '@nxlv/python': '23.0.0',\n '@nx-extend/terraform': '10.4.1',\n // These must all hold the same version — see NX_PACKAGES.\n nx: '23.1.1',\n '@nx/devkit': '23.1.1',\n '@nx/js': '23.1.1',\n '@nx/react': '23.1.1',\n '@nx/vite': '23.1.1',\n '@nx/vitest': '23.1.1',\n '@nx/workspace': '23.1.1',\n 'create-nx-workspace': '23.1.1',\n '@swc-node/register': '1.12.1',\n '@swc/core': '1.16.1',\n '@modelcontextprotocol/sdk': '1.30.0',\n '@modelcontextprotocol/inspector': '2.3.0',\n '@ag-ui/a2ui-toolkit': '0.0.4',\n '@ag-ui/aws-strands': '0.2.3',\n '@ag-ui/client': '0.0.57',\n '@ag-ui/core': '0.0.57',\n '@ag-ui/encoder': '0.0.57',\n 'agent-chat-cli': '0.3.0',\n '@copilotkit/react-core': '1.69.0',\n rxjs: '7.8.2',\n '@strands-agents/sdk': '1.14.0',\n '@tanstack/react-router': '1.170.31',\n '@tanstack/router-plugin': '1.168.34',\n '@tanstack/router-generator': '1.167.32',\n '@tanstack/virtual-file-routes': '1.162.0',\n '@tanstack/router-utils': '1.162.2',\n '@cloudscape-design/board-components': '3.0.220',\n '@cloudscape-design/chat-components': '1.0.164',\n '@cloudscape-design/components': '3.0.1352',\n '@cloudscape-design/global-styles': '1.0.67',\n '@tanstack/react-query': '5.102.0',\n '@tanstack/react-query-devtools': '5.102.0',\n '@trpc/tanstack-react-query': '11.18.0',\n '@trpc/client': '11.18.0',\n '@trpc/server': '11.18.0',\n '@types/node': '26.2.0',\n '@types/aws-lambda': '8.10.162',\n '@types/cors': '2.8.19',\n '@types/pg': '8.23.1',\n '@types/ws': '8.18.1',\n '@types/express': '5.0.6',\n '@smithy/config-resolver': '4.7.2',\n '@smithy/node-config-provider': '4.6.2',\n '@smithy/node-http-handler': '4.11.3',\n '@smithy/types': '4.17.2',\n '@vitest/coverage-v8': '4.1.11',\n '@vitest/ui': '4.1.11',\n '@astrojs/react': '6.0.4',\n '@astrojs/starlight': '0.41.7',\n astro: '7.2.4',\n cookie: '2.0.1',\n aws4fetch: '1.0.20',\n 'aws-cdk': '2.1138.0',\n 'aws-cdk-lib': '2.266.0',\n 'aws-xray-sdk-core': '3.12.0',\n constructs: '10.8.1',\n cors: '2.8.6',\n chalk: '6.0.0',\n 'class-variance-authority': '0.7.1',\n clsx: '2.1.1',\n commander: '15.0.0',\n 'cpy-cli': '7.0.0',\n electrodb: '3.9.3',\n esbuild: '0.28.2',\n 'event-source-polyfill': '1.0.31',\n '@types/event-source-polyfill': '1.0.5',\n '@biomejs/biome': '2.5.10',\n '@prisma/adapter-mariadb': '7.9.1',\n '@prisma/adapter-pg': '7.9.1',\n '@prisma/client': '7.9.1',\n ejs: '6.0.1',\n '@types/ejs': '3.1.5',\n express: '5.2.1',\n 'fast-glob': '3.3.3',\n husky: '9.1.7',\n 'fs-extra': '11.4.0',\n '@types/fs-extra': '11.0.4',\n 'make-dir-cli': '4.0.0',\n mariadb: '3.5.3',\n mise: '2026.8.10',\n ncp: '2.0.0',\n npm: '12.0.2',\n 'npm-check-updates': '23.0.2',\n 'oidc-client-ts': '3.5.0',\n pg: '8.23.0',\n prisma: '7.9.1',\n 'react-oidc-context': '3.3.1',\n react: '19.2.8',\n 'react-dom': '19.2.8',\n rimraf: '6.1.3',\n rolldown: '1.2.5',\n 'rolldown-plugin-dts': '0.28.2',\n 'simple-git': '3.36.0',\n 'source-map-support': '0.5.21',\n 'starlight-blog': '0.29.0',\n tailwindcss: '4.3.3',\n '@tailwindcss/vite': '4.3.3',\n tsx: '4.23.12',\n 'lucide-react': '1.33.0',\n 'radix-ui': '1.6.7',\n shadcn: '4.19.0',\n 'tw-animate-css': '1.4.0',\n 'tailwind-merge': '3.6.0',\n vite: '8.2.2',\n typescript: '6.0.3',\n vitest: '4.1.11',\n zod: '4.4.3',\n ws: '8.21.3',\n} as const;\nexport type ITsDepVersion = keyof typeof TS_VERSIONS;\n\n/\n Add versions to the given dependencies, which the declaration must own.\n \n @param declaration the calling generator's `DEPENDENCIES`\n /\nexport const withVersions = <D extends DependencyDeclaration>(\n declaration: D,\n deps: readonly DeclaredTs<D>[],\n): Record<string, string> => {\n assertDeclared(declaration.ts, deps, 'ts');\n return Object.fromEntries(\n deps.map((dep) => [dep, TS_VERSIONS[dep as ITsDepVersion]]),\n );\n};\n\n/\n The `nx` and `@nx/` packages a generated workspace pins, all of which must\n hold the same version: a workspace nx even a patch apart hoists a second\n * nested nx, and the two deadlock `nx sync`.\n \n Bumping them in a user's workspace requires `packageJsonUpdates` rather than a\n * migration — see `version-upgrade-migration/nx-package-updates.ts`.\n /\nexport const NX_PACKAGES = [\n 'nx',\n '@nx/devkit',\n '@nx/js',\n '@nx/react',\n '@nx/vite',\n '@nx/vitest',\n '@nx/workspace',\n] as const satisfies readonly ITsDepVersion[];\n\n/\n The nx version the plugin is built against, and the single source of truth\n * for every place a workspace's nx is pinned.\n /\nexport const NX_VERSION = TS_VERSIONS.nx;\n\n/\n Versions for Python dependencies added by generators\n /\nexport const PY_VERSIONS = {\n 'a2a-sdk': '==0.3.26',\n 'ag-ui-langgraph': '==0.0.43',\n 'ag-ui-protocol': '==0.1.20',\n 'ag-ui-strands': '==0.3.0',\n aiosqlite: '==0.22.1',\n 'aws-lambda-powertools': '==3.34.0',\n 'aws-lambda-powertools[tracer]': '==3.34.0',\n 'aws-lambda-powertools[parser]': '==3.34.0',\n 'aws-opentelemetry-distro': '==0.19.0',\n 'bedrock-agentcore': '==1.22.0',\n boto3: '==1.43.78',\n checkov: '==3.3.13',\n fastapi: '==0.141.1',\n 'fastapi[standard]': '==0.141.1',\n httpx: '==0.28.1',\n langchain: '==1.3.16',\n 'langchain-aws': '==1.7.3',\n 'langchain-mcp-adapters': '==0.3.2',\n langgraph: '==1.2.11',\n 'langgraph-checkpoint-aws': '==1.2.2',\n 'langgraph-checkpoint-sqlite': '==3.1.1',\n mcp: '==1.28.1',\n 'pip-check-updates': '==0.29.0',\n 'pip-licenses': '==5.5.5',\n ruff: '==0.16.4',\n 'strands-agents': '==1.53.0',\n 'strands-agents[a2a]': '==1.53.0',\n 'strands-agents-tools': '==0.8.6',\n ty: '==0.0.74',\n pynamodb: '==6.1.0',\n uvicorn: '==0.52.4',\n sqlmodel: '==0.0.39',\n alembic: '==1.19.1',\n aiomysql: '==0.3.2',\n asyncpg: '==0.31.0',\n // Pinned explicitly: SQLAlchemy's async engine pulls greenlet transitively,\n // and leaving it unpinned lets uv resolve to a just-released version whose\n // platform wheels may not all be published yet (breaking aarch64 installs).\n greenlet: '==3.5.5',\n} as const;\nexport type IPyDepVersion = keyof typeof PY_VERSIONS;\n\n/\n Add versions to the given dependencies\n /\nexport const withPyVersions = <D extends DependencyDeclaration>(\n declaration: D,\n deps: readonly DeclaredPy<D>[],\n): string[] => {\n assertDeclared(declaration.py, deps, 'py');\n return deps.map((dep) => `${dep}${PY_VERSIONS[dep as IPyDepVersion]}`);\n};\n\n/* Catches undeclared packages that reach here past the type checker. /\nconst assertDeclared = (\n declared: readonly { readonly name: string }[],\n deps: readonly unknown[],\n kind: 'ts' \| 'py',\n): void => {\n const names = declaredNames(declared);\n const undeclared = deps.filter((dep) => !names.includes(dep as string));\n if (undeclared.length > 0) {\n throw new Error(\n `Undeclared ${kind} dependencies: ${undeclared.join(', ')}. Add them to the generator's declareDependencies({ ${kind}: [...] }).`,\n );\n }\n};\n\n/\n Versions for vendored tools\n /\nexport const VENDORED_VERSIONS = {\n 'git-secrets': '1.3.0',\n} as const;\n\n/\n Versions of Java dependencies added by generators, keyed by Maven coordinate.\n \n Every entry is resolved from Maven Central by the version update and named\n * `<group>:<artifact>:<version>` where a generator writes it.\n /\nexport const JAVA_VERSIONS = {\n 'software.amazon.smithy:smithy-model': '1.73.0',\n 'software.amazon.smithy:smithy-aws-traits': '1.73.0',\n 'software.amazon.smithy:smithy-validation-model': '1.73.0',\n 'software.amazon.smithy:smithy-openapi': '1.73.0',\n 'software.amazon.smithy.typescript:smithy-aws-typescript-codegen': '0.52.0',\n} as const;\nexport type IJavaVersion = keyof typeof JAVA_VERSIONS;\n\n/* The Maven coordinates the version update resolves, in declaration order. /\nexport const JAVA_ARTIFACTS = Object.keys(JAVA_VERSIONS) as IJavaVersion[];\n\n/* A Maven coordinate as a dependency names it: `<group>:<artifact>:<version>`. /\nexport const javaMavenDependency = (artifact: IJavaVersion): string =>\n `${artifact}:${JAVA_VERSIONS[artifact]}`;\n\n/\n Versions of tools resolved by mise, keyed by the tool name mise knows.\n \n Every entry is checked with `mise latest <tool>` by the version update. Nothing\n * is installed into the workspace: the pin travels in the `project.json` target\n * command, which is what the version sync reaches to move it forward.\n /\nexport const MISE_VERSIONS = {\n smithy: '1.73.0',\n} as const;\nexport type IMiseVersion = keyof typeof MISE_VERSIONS;\n\n/* The tools the version update resolves through mise, in declaration order. /\nexport const MISE_TOOLS = Object.keys(MISE_VERSIONS) as IMiseVersion[];\n\n/\n Base container images used by generated Dockerfiles. Pinned exactly so\n * generated images are reproducible, and chosen to be free of known\n * HIGH/CRITICAL vulnerabilities at time of generation.\n /\nexport const BASE_IMAGES = {\n node: 'public.ecr.aws/docker/library/node:lts-slim',\n python: 'public.ecr.aws/docker/library/python:3.14-slim',\n} as const;\n\n/\n Versions for container tooling used by generated image build/scan targets.\n * Pinned exactly so generated images are reproducible.\n /\nexport const CONTAINER_VERSIONS = {\n // ECR-hosted Trivy image used to scan built images during the build.\n trivy: '0.72.0',\n} as const;\n\n/\n Repository each pinned tool image is pulled from, keyed as\n * {@link CONTAINER_VERSIONS}. Kept beside the versions so a tool added here is\n * one entry rather than a reference built somewhere else, which is also what\n * lets the version sync find these pins wherever a target command runs them.\n /\nexport const CONTAINER_REPOSITORIES = {\n trivy: 'public.ecr.aws/aquasecurity/trivy',\n} as const satisfies Record<keyof typeof CONTAINER_VERSIONS, string>;\n\n/* The pinned reference for a tool image, as a target command runs it. /\nexport const containerImage = (tool: keyof typeof CONTAINER_VERSIONS): string =>\n `${CONTAINER_REPOSITORIES[tool]}:${CONTAINER_VERSIONS[tool]}`;\n\n/\n The managed Lambda runtimes generated infrastructure targets, as the single\n * source both IaC providers derive from.\n \n CDK and Terraform name the same runtime differently — `Runtime.NODEJS_24_X`\n * against `nodejs24.x` — so deriving both from the version here keeps a bump one\n * edit that moves them together. Resolved by the version update workflow.\n /\nexport const LAMBDA_RUNTIME_VERSIONS = {\n node: '24',\n python: '3.14',\n} as const;\nexport type ILambdaRuntime = keyof typeof LAMBDA_RUNTIME_VERSIONS;\n\n/\n Patch of the CPython release uv pins as the project interpreter.\n \n A Lambda runtime names only `major.minor`, but uv pins an exact\n * `major.minor.patch`, so only the patch lives here — the `major.minor` comes from\n * {@link LAMBDA_RUNTIME_VERSIONS}. Resolved from uv by the version update\n * workflow.\n /\nexport const PYTHON_RUNTIME_PATCH = '7';\n\n/\n The interpreter uv pins for a generated Python project, as `major.minor.patch`.\n * Matches the Lambda Python runtime by construction.\n /\nexport const pyenvPythonVersion = (): string =>\n `${LAMBDA_RUNTIME_VERSIONS.python}.${PYTHON_RUNTIME_PATCH}`;\n\n/\n The `[project].requires-python` specifier for a generated Python project.\n \n A lower bound on the Lambda runtime's `major.minor`: the deployed interpreter\n * is that version, and Ruff derives its `target-version` from this (`py314`), so\n * lint targets the same version the function runs on.\n /\nexport const pyprojectPythonDependency = (): string =>\n `>=${LAMBDA_RUNTIME_VERSIONS.python}`;\n\n/* The runtime as Terraform's `runtime` attribute names it, e.g. `nodejs24.x`. /\nexport const terraformLambdaRuntime = (runtime: ILambdaRuntime): string =>\n runtime === 'node'\n ? `nodejs${LAMBDA_RUNTIME_VERSIONS.node}.x`\n : `python${LAMBDA_RUNTIME_VERSIONS.python}`;\n\n/\n The runtime as an `aws-cdk-lib` `Runtime` member, e.g. `Runtime.NODEJS_24_X`.\n * Always an explicitly versioned member, never a `_LATEST` alias.\n /\nexport const cdkLambdaRuntime = (runtime: ILambdaRuntime): string =>\n runtime === 'node'\n ? `Runtime.NODEJS_${LAMBDA_RUNTIME_VERSIONS.node}_X`\n : `Runtime.PYTHON_${LAMBDA_RUNTIME_VERSIONS.python.replace('.', '_')}`;\n\n/\n Substitution variables exposing the pinned runtimes to generated CDK\n * templates (e.g. `runtime: <%- nodeRuntime %>`). Paired with\n * {@link terraformLambdaRuntimeVars}, which names the same variables so a\n * template reads alike under either provider.\n /\nexport const cdkLambdaRuntimeVars = () => ({\n nodeRuntime: cdkLambdaRuntime('node'),\n pythonRuntime: cdkLambdaRuntime('python'),\n});\n\n/\n Substitution variables exposing the pinned runtimes to generated `.tf`\n * templates (e.g. `runtime = \"<%- nodeRuntime %>\"`).\n /\nexport const terraformLambdaRuntimeVars = () => ({\n nodeRuntime: terraformLambdaRuntime('node'),\n pythonRuntime: terraformLambdaRuntime('python'),\n});\n\n/\n Exact versions for Terraform providers used by generated `.tf` modules.\n * Pinned exactly (no range operator) so generated infrastructure is reproducible.\n /\nexport const TERRAFORM_VERSIONS = {\n aws: '6.61.0',\n random: '3.9.0',\n null: '3.3.1',\n archive: '2.8.0',\n external: '2.4.1',\n local: '2.9.0',\n time: '0.14.1',\n} as const;\nexport type ITerraformProviderVersion = keyof typeof TERRAFORM_VERSIONS;\n\n/\n Substitution variables exposing Terraform provider version constraints to\n * generated `.tf` templates (e.g. `version = \"<%- awsProviderVersion %>\"`)\n */\nexport const terraformProviderVersions = () => ({\n awsProviderVersion: TERRAFORM_VERSIONS.aws,\n randomProviderVersion: TERRAFORM_VERSIONS.random,\n nullProviderVersion: TERRAFORM_VERSIONS.null,\n archiveProviderVersion: TERRAFORM_VERSIONS.archive,\n externalProviderVersion: TERRAFORM_VERSIONS.external,\n localProviderVersion: TERRAFORM_VERSIONS.local,\n timeProviderVersion: TERRAFORM_VERSIONS.time,\n});\n"],"names":["declaredNames","TS_VERSIONS","minimatch","nx","rxjs","astro","cookie","aws4fetch","constructs","cors","chalk","clsx","commander","electrodb","esbuild","ejs","express","husky","mariadb","mise","ncp","npm","pg","prisma","react","rimraf","rolldown","tailwindcss","tsx","shadcn","vite","typescript","vitest","zod","ws","withVersions","declaration","deps","assertDeclared","ts","Object","fromEntries","map","dep","NX_PACKAGES","NX_VERSION","PY_VERSIONS","aiosqlite","boto3","checkov","fastapi","httpx","langchain","langgraph","mcp","ruff","ty","pynamodb","uvicorn","sqlmodel","alembic","aiomysql","asyncpg","greenlet","withPyVersions","py","declared","kind","names","undeclared","filter","includes","length","Error","join","VENDORED_VERSIONS","JAVA_VERSIONS","JAVA_ARTIFACTS","keys","javaMavenDependency","artifact","MISE_VERSIONS","smithy","MISE_TOOLS","BASE_IMAGES","node","python","CONTAINER_VERSIONS","trivy","CONTAINER_REPOSITORIES","containerImage","tool","LAMBDA_RUNTIME_VERSIONS","PYTHON_RUNTIME_PATCH","pyenvPythonVersion","pyprojectPythonDependency","terraformLambdaRuntime","runtime","cdkLambdaRuntime","replace","cdkLambdaRuntimeVars","nodeRuntime","pythonRuntime","terraformLambdaRuntimeVars","TERRAFORM_VERSIONS","aws","random","null","archive","external","local","time","terraformProviderVersions","awsProviderVersion","randomProviderVersion","nullProviderVersion","archiveProviderVersion","externalProviderVersion","localProviderVersion","timeProviderVersion"],"mappings":"AAAA;;;CAGC,GACD,SAIEA,aAAa,QACR,6BAA6B;AAEpC;;CAEC,GACD,OAAO,MAAMC,cAAc;IACzB,eAAe;IACf,0DAA0D;IAC1D,yEAAyE;IACzE,uDAAuD;IACvD,oCAAoC;IACpC,0EAA0E;IAC1E,2EAA2E;IAC3E,6EAA6E;IAC7E,8EAA8E;IAC9E,kDAAkD;IAClDC,WAAW;IACX,4BAA4B;IAC5B,+BAA+B;IAC/B,uBAAuB;IACvB,qCAAqC;IACrC,mCAAmC;IACnC,sBAAsB;IACtB,uBAAuB;IACvB,iCAAiC;IACjC,iDAAiD;IACjD,mCAAmC;IACnC,uBAAuB;IACvB,6BAA6B;IAC7B,uBAAuB;IACvB,iCAAiC;IACjC,kCAAkC;IAClC,qCAAqC;IACrC,iCAAiC;IACjC,iCAAiC;IACjC,iCAAiC;IACjC,eAAe;IACf,gBAAgB;IAChB,wBAAwB;IACxB,0DAA0D;IAC1DC,IAAI;IACJ,cAAc;IACd,UAAU;IACV,aAAa;IACb,YAAY;IACZ,cAAc;IACd,iBAAiB;IACjB,uBAAuB;IACvB,sBAAsB;IACtB,aAAa;IACb,6BAA6B;IAC7B,mCAAmC;IACnC,uBAAuB;IACvB,sBAAsB;IACtB,iBAAiB;IACjB,eAAe;IACf,kBAAkB;IAClB,kBAAkB;IAClB,0BAA0B;IAC1BC,MAAM;IACN,uBAAuB;IACvB,0BAA0B;IAC1B,2BAA2B;IAC3B,8BAA8B;IAC9B,iCAAiC;IACjC,0BAA0B;IAC1B,uCAAuC;IACvC,sCAAsC;IACtC,iCAAiC;IACjC,oCAAoC;IACpC,yBAAyB;IACzB,kCAAkC;IAClC,8BAA8B;IAC9B,gBAAgB;IAChB,gBAAgB;IAChB,eAAe;IACf,qBAAqB;IACrB,eAAe;IACf,aAAa;IACb,aAAa;IACb,kBAAkB;IAClB,2BAA2B;IAC3B,gCAAgC;IAChC,6BAA6B;IAC7B,iBAAiB;IACjB,uBAAuB;IACvB,cAAc;IACd,kBAAkB;IAClB,sBAAsB;IACtBC,OAAO;IACPC,QAAQ;IACRC,WAAW;IACX,WAAW;IACX,eAAe;IACf,qBAAqB;IACrBC,YAAY;IACZC,MAAM;IACNC,OAAO;IACP,4BAA4B;IAC5BC,MAAM;IACNC,WAAW;IACX,WAAW;IACXC,WAAW;IACXC,SAAS;IACT,yBAAyB;IACzB,gCAAgC;IAChC,kBAAkB;IAClB,2BAA2B;IAC3B,sBAAsB;IACtB,kBAAkB;IAClBC,KAAK;IACL,cAAc;IACdC,SAAS;IACT,aAAa;IACbC,OAAO;IACP,YAAY;IACZ,mBAAmB;IACnB,gBAAgB;IAChBC,SAAS;IACTC,MAAM;IACNC,KAAK;IACLC,KAAK;IACL,qBAAqB;IACrB,kBAAkB;IAClBC,IAAI;IACJC,QAAQ;IACR,sBAAsB;IACtBC,OAAO;IACP,aAAa;IACbC,QAAQ;IACRC,UAAU;IACV,uBAAuB;IACvB,cAAc;IACd,sBAAsB;IACtB,kBAAkB;IAClBC,aAAa;IACb,qBAAqB;IACrBC,KAAK;IACL,gBAAgB;IAChB,YAAY;IACZC,QAAQ;IACR,kBAAkB;IAClB,kBAAkB;IAClBC,MAAM;IACNC,YAAY;IACZC,QAAQ;IACRC,KAAK;IACLC,IAAI;AACN,EAAW;AAGX;;;;CAIC,GACD,OAAO,MAAMC,eAAe,CAC1BC,aACAC;IAEAC,eAAeF,YAAYG,EAAE,EAAEF,MAAM;IACrC,OAAOG,OAAOC,WAAW,CACvBJ,KAAKK,GAAG,CAAC,CAACC,MAAQ;YAACA;YAAK1C,WAAW,CAAC0C,IAAqB;SAAC;AAE9D,EAAE;AAEF;;;;;;;CAOC,GACD,OAAO,MAAMC,cAAc;IACzB;IACA;IACA;IACA;IACA;IACA;IACA;CACD,CAA6C;AAE9C;;;CAGC,GACD,OAAO,MAAMC,aAAa5C,YAAYE,EAAE,CAAC;AAEzC;;CAEC,GACD,OAAO,MAAM2C,cAAc;IACzB,WAAW;IACX,mBAAmB;IACnB,kBAAkB;IAClB,iBAAiB;IACjBC,WAAW;IACX,yBAAyB;IACzB,iCAAiC;IACjC,iCAAiC;IACjC,4BAA4B;IAC5B,qBAAqB;IACrBC,OAAO;IACPC,SAAS;IACTC,SAAS;IACT,qBAAqB;IACrBC,OAAO;IACPC,WAAW;IACX,iBAAiB;IACjB,0BAA0B;IAC1BC,WAAW;IACX,4BAA4B;IAC5B,+BAA+B;IAC/BC,KAAK;IACL,qBAAqB;IACrB,gBAAgB;IAChBC,MAAM;IACN,kBAAkB;IAClB,uBAAuB;IACvB,wBAAwB;IACxBC,IAAI;IACJC,UAAU;IACVC,SAAS;IACTC,UAAU;IACVC,SAAS;IACTC,UAAU;IACVC,SAAS;IACT,4EAA4E;IAC5E,2EAA2E;IAC3E,4EAA4E;IAC5EC,UAAU;AACZ,EAAW;AAGX;;CAEC,GACD,OAAO,MAAMC,iBAAiB,CAC5B5B,aACAC;IAEAC,eAAeF,YAAY6B,EAAE,EAAE5B,MAAM;IACrC,OAAOA,KAAKK,GAAG,CAAC,CAACC,MAAQ,GAAGA,MAAMG,WAAW,CAACH,IAAqB,EAAE;AACvE,EAAE;AAEF,uEAAuE,GACvE,MAAML,iBAAiB,CACrB4B,UACA7B,MACA8B;IAEA,MAAMC,QAAQpE,cAAckE;IAC5B,MAAMG,aAAahC,KAAKiC,MAAM,CAAC,CAAC3B,MAAQ,CAACyB,MAAMG,QAAQ,CAAC5B;IACxD,IAAI0B,WAAWG,MAAM,GAAG,GAAG;QACzB,MAAM,IAAIC,MACR,CAAC,WAAW,EAAEN,KAAK,eAAe,EAAEE,WAAWK,IAAI,CAAC,MAAM,oDAAoD,EAAEP,KAAK,WAAW,CAAC;IAErI;AACF;AAEA;;CAEC,GACD,OAAO,MAAMQ,oBAAoB;IAC/B,eAAe;AACjB,EAAW;AAEX;;;;;CAKC,GACD,OAAO,MAAMC,gBAAgB;IAC3B,uCAAuC;IACvC,4CAA4C;IAC5C,kDAAkD;IAClD,yCAAyC;IACzC,mEAAmE;AACrE,EAAW;AAGX,6EAA6E,GAC7E,OAAO,MAAMC,iBAAiBrC,OAAOsC,IAAI,CAACF,eAAiC;AAE3E,iFAAiF,GACjF,OAAO,MAAMG,sBAAsB,CAACC,WAClC,GAAGA,SAAS,CAAC,EAAEJ,aAAa,CAACI,SAAS,EAAE,CAAC;AAE3C;;;;;;CAMC,GACD,OAAO,MAAMC,gBAAgB;IAC3BC,QAAQ;AACV,EAAW;AAGX,8EAA8E,GAC9E,OAAO,MAAMC,aAAa3C,OAAOsC,IAAI,CAACG,eAAiC;AAEvE;;;;CAIC,GACD,OAAO,MAAMG,cAAc;IACzBC,MAAM;IACNC,QAAQ;AACV,EAAW;AAEX;;;CAGC,GACD,OAAO,MAAMC,qBAAqB;IAChC,qEAAqE;IACrEC,OAAO;AACT,EAAW;AAEX;;;;;CAKC,GACD,OAAO,MAAMC,yBAAyB;IACpCD,OAAO;AACT,EAAqE;AAErE,wEAAwE,GACxE,OAAO,MAAME,iBAAiB,CAACC,OAC7B,GAAGF,sBAAsB,CAACE,KAAK,CAAC,CAAC,EAAEJ,kBAAkB,CAACI,KAAK,EAAE,CAAC;AAEhE;;;;;;;CAOC,GACD,OAAO,MAAMC,0BAA0B;IACrCP,MAAM;IACNC,QAAQ;AACV,EAAW;AAGX;;;;;;;CAOC,GACD,OAAO,MAAMO,uBAAuB,IAAI;AAExC;;;CAGC,GACD,OAAO,MAAMC,qBAAqB,IAChC,GAAGF,wBAAwBN,MAAM,CAAC,CAAC,EAAEO,sBAAsB,CAAC;AAE9D;;;;;;CAMC,GACD,OAAO,MAAME,4BAA4B,IACvC,CAAC,EAAE,EAAEH,wBAAwBN,MAAM,EAAE,CAAC;AAExC,gFAAgF,GAChF,OAAO,MAAMU,yBAAyB,CAACC,UACrCA,YAAY,SACR,CAAC,MAAM,EAAEL,wBAAwBP,IAAI,CAAC,EAAE,CAAC,GACzC,CAAC,MAAM,EAAEO,wBAAwBN,MAAM,EAAE,CAAC;AAEhD;;;CAGC,GACD,OAAO,MAAMY,mBAAmB,CAACD,UAC/BA,YAAY,SACR,CAAC,eAAe,EAAEL,wBAAwBP,IAAI,CAAC,EAAE,CAAC,GAClD,CAAC,eAAe,EAAEO,wBAAwBN,MAAM,CAACa,OAAO,CAAC,KAAK,MAAM,CAAC;AAE3E;;;;;CAKC,GACD,OAAO,MAAMC,uBAAuB,IAAO,CAAA;QACzCC,aAAaH,iBAAiB;QAC9BI,eAAeJ,iBAAiB;IAClC,CAAA,EAAG;AAEH;;;CAGC,GACD,OAAO,MAAMK,6BAA6B,IAAO,CAAA;QAC/CF,aAAaL,uBAAuB;QACpCM,eAAeN,uBAAuB;IACxC,CAAA,EAAG;AAEH;;;CAGC,GACD,OAAO,MAAMQ,qBAAqB;IAChCC,KAAK;IACLC,QAAQ;IACRC,MAAM;IACNC,SAAS;IACTC,UAAU;IACVC,OAAO;IACPC,MAAM;AACR,EAAW;AAGX;;;CAGC,GACD,OAAO,MAAMC,4BAA4B,IAAO,CAAA;QAC9CC,oBAAoBT,mBAAmBC,GAAG;QAC1CS,uBAAuBV,mBAAmBE,MAAM;QAChDS,qBAAqBX,mBAAmBG,IAAI;QAC5CS,wBAAwBZ,mBAAmBI,OAAO;QAClDS,yBAAyBb,mBAAmBK,QAAQ;QACpDS,sBAAsBd,mBAAmBM,KAAK;QAC9CS,qBAAqBf,mBAAmBO,IAAI;IAC9C,CAAA,EAAG"}
1	+ {"version":3,"sources":["../../../../../packages/nx-plugin/src/utils/versions.ts"],"sourcesContent":["/*\n Copyright Amazon.com, Inc. or its affiliates. All Rights Reserved.\n * SPDX-License-Identifier: Apache-2.0\n /\nimport {\n type DeclaredPy,\n type DeclaredTs,\n type DependencyDeclaration,\n declaredNames,\n} from './declared-dependencies.js';\n\n/\n Versons for TypeScript dependencies added by generators\n /\nexport const TS_VERSIONS = {\n '@a2a-js/sdk': '0.3.14',\n '@aws/aws-distro-opentelemetry-node-autoinstrumentation': '0.12.0',\n // Pinned above the version the ADOT autoinstrumentation package resolves\n // transitively (2.8.0) to clear CVE-2026-59892 (HIGH).\n '@opentelemetry/propagator-jaeger': '2.10.0',\n // Overridden in the vended agent/MCP image builds to clear CVE-2026-14257\n // (HIGH) in brace-expansion: minimatch 10 is the lowest major depending on\n // brace-expansion 5.x, the only line Trivy's `< 5.0.8` advisory range treats\n // as fixed. Overriding brace-expansion directly is not viable — 5.x drops the\n // CommonJS default export that minimatch 9 calls.\n minimatch: '10.2.6',\n '@aws-sdk/client-dynamodb': '3.1119.0',\n '@aws-sdk/client-api-gateway': '3.1119.0',\n '@aws-sdk/client-iam': '3.1119.0',\n '@aws-sdk/client-bedrock-agentcore': '3.1119.0',\n '@aws-sdk/client-bedrock-runtime': '3.1119.0',\n '@aws-sdk/client-s3': '3.1119.0',\n '@aws-sdk/client-sts': '3.1119.0',\n '@aws-sdk/credential-providers': '3.1119.0',\n '@aws-sdk/credential-provider-cognito-identity': '3.972.69',\n '@aws-sdk/client-secrets-manager': '3.1119.0',\n '@aws-sdk/rds-signer': '3.1119.0',\n '@smithy/server-apigateway': '0.3.3',\n '@smithy/server-node': '0.3.3',\n '@aws-lambda-powertools/logger': '2.35.0',\n '@aws-lambda-powertools/metrics': '2.35.0',\n '@aws-lambda-powertools/parameters': '2.35.0',\n '@aws-lambda-powertools/tracer': '2.35.0',\n '@aws-lambda-powertools/parser': '2.35.0',\n '@aws-sdk/client-appconfigdata': '3.1119.0',\n '@middy/core': '7.8.0',\n '@nxlv/python': '23.0.0',\n '@nx-extend/terraform': '10.4.1',\n // These must all hold the same version — see NX_PACKAGES.\n nx: '23.1.2',\n '@nx/devkit': '23.1.2',\n '@nx/js': '23.1.2',\n '@nx/react': '23.1.2',\n '@nx/vite': '23.1.2',\n '@nx/vitest': '23.1.2',\n '@nx/workspace': '23.1.2',\n 'create-nx-workspace': '23.1.2',\n '@swc-node/register': '1.12.1',\n '@swc/core': '1.16.1',\n '@modelcontextprotocol/sdk': '1.30.0',\n '@modelcontextprotocol/inspector': '2.4.0',\n '@ag-ui/a2ui-toolkit': '0.0.4',\n '@ag-ui/aws-strands': '0.2.3',\n '@ag-ui/client': '0.0.57',\n '@ag-ui/core': '0.0.57',\n '@ag-ui/encoder': '0.0.57',\n 'agent-chat-cli': '0.3.0',\n '@copilotkit/react-core': '1.69.2',\n rxjs: '7.8.2',\n '@strands-agents/sdk': '1.14.0',\n '@tanstack/react-router': '1.170.32',\n '@tanstack/router-plugin': '1.168.35',\n '@tanstack/router-generator': '1.167.33',\n '@tanstack/virtual-file-routes': '1.162.0',\n '@tanstack/router-utils': '1.162.2',\n '@cloudscape-design/board-components': '3.0.220',\n '@cloudscape-design/chat-components': '1.0.164',\n '@cloudscape-design/components': '3.0.1354',\n '@cloudscape-design/global-styles': '1.0.67',\n '@tanstack/react-query': '5.102.6',\n '@tanstack/react-query-devtools': '5.102.6',\n '@trpc/tanstack-react-query': '11.18.0',\n '@trpc/client': '11.18.0',\n '@trpc/server': '11.18.0',\n '@types/node': '26.4.0',\n '@types/aws-lambda': '8.10.162',\n '@types/cors': '2.8.19',\n '@types/pg': '8.23.1',\n '@types/ws': '8.18.1',\n '@types/express': '5.0.6',\n '@smithy/config-resolver': '4.7.2',\n '@smithy/node-config-provider': '4.6.2',\n '@smithy/node-http-handler': '4.11.3',\n '@smithy/types': '4.17.2',\n '@vitest/coverage-v8': '4.1.11',\n '@vitest/ui': '4.1.11',\n '@astrojs/react': '6.0.4',\n '@astrojs/starlight': '0.41.9',\n astro: '7.2.8',\n cookie: '2.0.1',\n aws4fetch: '1.0.20',\n 'aws-cdk': '2.1139.0',\n 'aws-cdk-lib': '2.266.0',\n 'aws-xray-sdk-core': '3.12.0',\n constructs: '10.8.1',\n cors: '2.8.6',\n chalk: '6.0.0',\n 'class-variance-authority': '0.7.1',\n clsx: '2.1.1',\n commander: '15.0.0',\n 'cpy-cli': '7.0.0',\n electrodb: '3.9.3',\n esbuild: '0.28.2',\n 'event-source-polyfill': '1.0.31',\n '@types/event-source-polyfill': '1.0.5',\n '@biomejs/biome': '2.5.10',\n '@prisma/adapter-mariadb': '7.10.0',\n '@prisma/adapter-pg': '7.10.0',\n '@prisma/client': '7.10.0',\n ejs: '6.0.1',\n '@types/ejs': '3.1.5',\n express: '5.2.1',\n 'fast-glob': '3.3.3',\n husky: '9.1.7',\n 'fs-extra': '11.4.0',\n '@types/fs-extra': '11.0.4',\n 'make-dir-cli': '4.0.0',\n mariadb: '3.5.3',\n mise: '2026.8.14',\n ncp: '2.0.0',\n npm: '12.0.2',\n 'npm-check-updates': '23.1.0',\n 'oidc-client-ts': '3.5.0',\n pg: '8.23.0',\n prisma: '7.10.0',\n 'react-oidc-context': '3.3.1',\n react: '19.2.8',\n 'react-dom': '19.2.8',\n rimraf: '6.1.3',\n rolldown: '1.2.6',\n 'rolldown-plugin-dts': '0.28.2',\n 'simple-git': '3.36.0',\n 'source-map-support': '0.5.21',\n 'starlight-blog': '0.29.0',\n tailwindcss: '4.3.3',\n '@tailwindcss/vite': '4.3.3',\n tsx: '4.23.12',\n 'lucide-react': '1.34.0',\n 'radix-ui': '1.6.7',\n shadcn: '4.19.0',\n 'tw-animate-css': '1.4.0',\n 'tailwind-merge': '3.6.0',\n vite: '8.2.2',\n typescript: '6.0.3',\n vitest: '4.1.11',\n zod: '4.4.3',\n ws: '8.21.3',\n} as const;\nexport type ITsDepVersion = keyof typeof TS_VERSIONS;\n\n/\n Add versions to the given dependencies, which the declaration must own.\n \n @param declaration the calling generator's `DEPENDENCIES`\n /\nexport const withVersions = <D extends DependencyDeclaration>(\n declaration: D,\n deps: readonly DeclaredTs<D>[],\n): Record<string, string> => {\n assertDeclared(declaration.ts, deps, 'ts');\n return Object.fromEntries(\n deps.map((dep) => [dep, TS_VERSIONS[dep as ITsDepVersion]]),\n );\n};\n\n/\n The `nx` and `@nx/` packages a generated workspace pins, all of which must\n hold the same version: a workspace nx even a patch apart hoists a second\n * nested nx, and the two deadlock `nx sync`.\n \n Bumping them in a user's workspace requires `packageJsonUpdates` rather than a\n * migration — see `version-upgrade-migration/nx-package-updates.ts`.\n /\nexport const NX_PACKAGES = [\n 'nx',\n '@nx/devkit',\n '@nx/js',\n '@nx/react',\n '@nx/vite',\n '@nx/vitest',\n '@nx/workspace',\n] as const satisfies readonly ITsDepVersion[];\n\n/\n The nx version the plugin is built against, and the single source of truth\n * for every place a workspace's nx is pinned.\n /\nexport const NX_VERSION = TS_VERSIONS.nx;\n\n/\n Versions for Python dependencies added by generators\n /\nexport const PY_VERSIONS = {\n 'a2a-sdk': '==0.3.26',\n 'ag-ui-langgraph': '==0.0.44',\n 'ag-ui-protocol': '==0.1.21',\n 'ag-ui-strands': '==0.3.0',\n aiosqlite: '==0.22.1',\n 'aws-lambda-powertools': '==3.34.0',\n 'aws-lambda-powertools[tracer]': '==3.34.0',\n 'aws-lambda-powertools[parser]': '==3.34.0',\n 'aws-opentelemetry-distro': '==0.19.0',\n 'bedrock-agentcore': '==1.22.0',\n boto3: '==1.43.82',\n checkov: '==3.3.15',\n fastapi: '==0.141.1',\n 'fastapi[standard]': '==0.141.1',\n httpx: '==0.28.1',\n langchain: '==1.3.18',\n 'langchain-aws': '==1.7.4',\n 'langchain-mcp-adapters': '==0.3.2',\n langgraph: '==1.2.11',\n 'langgraph-checkpoint-aws': '==1.2.2',\n 'langgraph-checkpoint-sqlite': '==3.1.1',\n mcp: '==1.28.1',\n 'pip-check-updates': '==0.29.0',\n 'pip-licenses': '==5.5.5',\n ruff: '==0.16.4',\n 'strands-agents': '==1.54.0',\n 'strands-agents[a2a]': '==1.54.0',\n 'strands-agents-tools': '==0.8.6',\n ty: '==0.0.75',\n pynamodb: '==6.1.0',\n uvicorn: '==0.52.4',\n sqlmodel: '==0.0.39',\n alembic: '==1.19.1',\n aiomysql: '==0.3.2',\n asyncpg: '==0.31.0',\n // Pinned explicitly: SQLAlchemy's async engine pulls greenlet transitively,\n // and leaving it unpinned lets uv resolve to a just-released version whose\n // platform wheels may not all be published yet (breaking aarch64 installs).\n greenlet: '==3.5.5',\n} as const;\nexport type IPyDepVersion = keyof typeof PY_VERSIONS;\n\n/\n Add versions to the given dependencies\n /\nexport const withPyVersions = <D extends DependencyDeclaration>(\n declaration: D,\n deps: readonly DeclaredPy<D>[],\n): string[] => {\n assertDeclared(declaration.py, deps, 'py');\n return deps.map((dep) => `${dep}${PY_VERSIONS[dep as IPyDepVersion]}`);\n};\n\n/* Catches undeclared packages that reach here past the type checker. /\nconst assertDeclared = (\n declared: readonly { readonly name: string }[],\n deps: readonly unknown[],\n kind: 'ts' \| 'py',\n): void => {\n const names = declaredNames(declared);\n const undeclared = deps.filter((dep) => !names.includes(dep as string));\n if (undeclared.length > 0) {\n throw new Error(\n `Undeclared ${kind} dependencies: ${undeclared.join(', ')}. Add them to the generator's declareDependencies({ ${kind}: [...] }).`,\n );\n }\n};\n\n/\n Versions for vendored tools\n /\nexport const VENDORED_VERSIONS = {\n 'git-secrets': '1.3.0',\n} as const;\n\n/\n Versions of Java dependencies added by generators, keyed by Maven coordinate.\n \n Every entry is resolved from Maven Central by the version update and named\n * `<group>:<artifact>:<version>` where a generator writes it.\n /\nexport const JAVA_VERSIONS = {\n 'software.amazon.smithy:smithy-model': '1.73.0',\n 'software.amazon.smithy:smithy-aws-traits': '1.73.0',\n 'software.amazon.smithy:smithy-validation-model': '1.73.0',\n 'software.amazon.smithy:smithy-openapi': '1.73.0',\n 'software.amazon.smithy.typescript:smithy-aws-typescript-codegen': '0.53.0',\n} as const;\nexport type IJavaVersion = keyof typeof JAVA_VERSIONS;\n\n/* The Maven coordinates the version update resolves, in declaration order. /\nexport const JAVA_ARTIFACTS = Object.keys(JAVA_VERSIONS) as IJavaVersion[];\n\n/* A Maven coordinate as a dependency names it: `<group>:<artifact>:<version>`. /\nexport const javaMavenDependency = (artifact: IJavaVersion): string =>\n `${artifact}:${JAVA_VERSIONS[artifact]}`;\n\n/\n Versions of tools resolved by mise, keyed by the tool name mise knows.\n \n Every entry is checked with `mise latest <tool>` by the version update. Nothing\n * is installed into the workspace: the pin travels in the `project.json` target\n * command, which is what the version sync reaches to move it forward.\n /\nexport const MISE_VERSIONS = {\n smithy: '1.73.0',\n} as const;\nexport type IMiseVersion = keyof typeof MISE_VERSIONS;\n\n/* The tools the version update resolves through mise, in declaration order. /\nexport const MISE_TOOLS = Object.keys(MISE_VERSIONS) as IMiseVersion[];\n\n/\n Base container images used by generated Dockerfiles. Pinned exactly so\n * generated images are reproducible, and chosen to be free of known\n * HIGH/CRITICAL vulnerabilities at time of generation.\n /\nexport const BASE_IMAGES = {\n node: 'public.ecr.aws/docker/library/node:lts-slim',\n python: 'public.ecr.aws/docker/library/python:3.14-slim',\n} as const;\n\n/\n Versions for container tooling used by generated image build/scan targets.\n * Pinned exactly so generated images are reproducible.\n /\nexport const CONTAINER_VERSIONS = {\n // ECR-hosted Trivy image used to scan built images during the build.\n trivy: '0.72.0',\n} as const;\n\n/\n Repository each pinned tool image is pulled from, keyed as\n * {@link CONTAINER_VERSIONS}. Kept beside the versions so a tool added here is\n * one entry rather than a reference built somewhere else, which is also what\n * lets the version sync find these pins wherever a target command runs them.\n /\nexport const CONTAINER_REPOSITORIES = {\n trivy: 'public.ecr.aws/aquasecurity/trivy',\n} as const satisfies Record<keyof typeof CONTAINER_VERSIONS, string>;\n\n/* The pinned reference for a tool image, as a target command runs it. /\nexport const containerImage = (tool: keyof typeof CONTAINER_VERSIONS): string =>\n `${CONTAINER_REPOSITORIES[tool]}:${CONTAINER_VERSIONS[tool]}`;\n\n/\n The managed Lambda runtimes generated infrastructure targets, as the single\n * source both IaC providers derive from.\n \n CDK and Terraform name the same runtime differently — `Runtime.NODEJS_24_X`\n * against `nodejs24.x` — so deriving both from the version here keeps a bump one\n * edit that moves them together. Resolved by the version update workflow.\n /\nexport const LAMBDA_RUNTIME_VERSIONS = {\n node: '24',\n python: '3.14',\n} as const;\nexport type ILambdaRuntime = keyof typeof LAMBDA_RUNTIME_VERSIONS;\n\n/\n The interpreter uv pins for a generated Python project, as the Lambda runtime's\n * `major.minor`.\n \n No patch: uv reads this as a request for any patch of that minor, so it resolves\n * whichever one the platform has a build for. Naming an exact patch pins one that\n * may not exist everywhere, and Lambda patches the interpreter itself, so the minor\n * is the whole of what a project needs to agree on.\n /\nexport const pyenvPythonVersion = (): string => LAMBDA_RUNTIME_VERSIONS.python;\n\n/\n The `[project].requires-python` specifier for a generated Python project.\n \n A lower bound on the Lambda runtime's `major.minor`: the deployed interpreter\n * is that version, and Ruff derives its `target-version` from this (`py314`), so\n * lint targets the same version the function runs on.\n /\nexport const pyprojectPythonDependency = (): string =>\n `>=${LAMBDA_RUNTIME_VERSIONS.python}`;\n\n/* The runtime as Terraform's `runtime` attribute names it, e.g. `nodejs24.x`. /\nexport const terraformLambdaRuntime = (runtime: ILambdaRuntime): string =>\n runtime === 'node'\n ? `nodejs${LAMBDA_RUNTIME_VERSIONS.node}.x`\n : `python${LAMBDA_RUNTIME_VERSIONS.python}`;\n\n/\n The runtime as an `aws-cdk-lib` `Runtime` member, e.g. `Runtime.NODEJS_24_X`.\n * Always an explicitly versioned member, never a `_LATEST` alias.\n /\nexport const cdkLambdaRuntime = (runtime: ILambdaRuntime): string =>\n runtime === 'node'\n ? `Runtime.NODEJS_${LAMBDA_RUNTIME_VERSIONS.node}_X`\n : `Runtime.PYTHON_${LAMBDA_RUNTIME_VERSIONS.python.replace('.', '_')}`;\n\n/\n Substitution variables exposing the pinned runtimes to generated CDK\n * templates (e.g. `runtime: <%- nodeRuntime %>`). Paired with\n * {@link terraformLambdaRuntimeVars}, which names the same variables so a\n * template reads alike under either provider.\n /\nexport const cdkLambdaRuntimeVars = () => ({\n nodeRuntime: cdkLambdaRuntime('node'),\n pythonRuntime: cdkLambdaRuntime('python'),\n});\n\n/\n Substitution variables exposing the pinned runtimes to generated `.tf`\n * templates (e.g. `runtime = \"<%- nodeRuntime %>\"`).\n /\nexport const terraformLambdaRuntimeVars = () => ({\n nodeRuntime: terraformLambdaRuntime('node'),\n pythonRuntime: terraformLambdaRuntime('python'),\n});\n\n/\n Exact versions for Terraform providers used by generated `.tf` modules.\n * Pinned exactly (no range operator) so generated infrastructure is reproducible.\n /\nexport const TERRAFORM_VERSIONS = {\n aws: '6.62.0',\n random: '3.9.0',\n null: '3.3.1',\n archive: '2.8.0',\n external: '2.4.1',\n local: '2.9.0',\n time: '0.14.1',\n} as const;\nexport type ITerraformProviderVersion = keyof typeof TERRAFORM_VERSIONS;\n\n/\n Substitution variables exposing Terraform provider version constraints to\n * generated `.tf` templates (e.g. `version = \"<%- awsProviderVersion %>\"`)\n */\nexport const terraformProviderVersions = () => ({\n awsProviderVersion: TERRAFORM_VERSIONS.aws,\n randomProviderVersion: TERRAFORM_VERSIONS.random,\n nullProviderVersion: TERRAFORM_VERSIONS.null,\n archiveProviderVersion: TERRAFORM_VERSIONS.archive,\n externalProviderVersion: TERRAFORM_VERSIONS.external,\n localProviderVersion: TERRAFORM_VERSIONS.local,\n timeProviderVersion: TERRAFORM_VERSIONS.time,\n});\n"],"names":["declaredNames","TS_VERSIONS","minimatch","nx","rxjs","astro","cookie","aws4fetch","constructs","cors","chalk","clsx","commander","electrodb","esbuild","ejs","express","husky","mariadb","mise","ncp","npm","pg","prisma","react","rimraf","rolldown","tailwindcss","tsx","shadcn","vite","typescript","vitest","zod","ws","withVersions","declaration","deps","assertDeclared","ts","Object","fromEntries","map","dep","NX_PACKAGES","NX_VERSION","PY_VERSIONS","aiosqlite","boto3","checkov","fastapi","httpx","langchain","langgraph","mcp","ruff","ty","pynamodb","uvicorn","sqlmodel","alembic","aiomysql","asyncpg","greenlet","withPyVersions","py","declared","kind","names","undeclared","filter","includes","length","Error","join","VENDORED_VERSIONS","JAVA_VERSIONS","JAVA_ARTIFACTS","keys","javaMavenDependency","artifact","MISE_VERSIONS","smithy","MISE_TOOLS","BASE_IMAGES","node","python","CONTAINER_VERSIONS","trivy","CONTAINER_REPOSITORIES","containerImage","tool","LAMBDA_RUNTIME_VERSIONS","pyenvPythonVersion","pyprojectPythonDependency","terraformLambdaRuntime","runtime","cdkLambdaRuntime","replace","cdkLambdaRuntimeVars","nodeRuntime","pythonRuntime","terraformLambdaRuntimeVars","TERRAFORM_VERSIONS","aws","random","null","archive","external","local","time","terraformProviderVersions","awsProviderVersion","randomProviderVersion","nullProviderVersion","archiveProviderVersion","externalProviderVersion","localProviderVersion","timeProviderVersion"],"mappings":"AAAA;;;CAGC,GACD,SAIEA,aAAa,QACR,6BAA6B;AAEpC;;CAEC,GACD,OAAO,MAAMC,cAAc;IACzB,eAAe;IACf,0DAA0D;IAC1D,yEAAyE;IACzE,uDAAuD;IACvD,oCAAoC;IACpC,0EAA0E;IAC1E,2EAA2E;IAC3E,6EAA6E;IAC7E,8EAA8E;IAC9E,kDAAkD;IAClDC,WAAW;IACX,4BAA4B;IAC5B,+BAA+B;IAC/B,uBAAuB;IACvB,qCAAqC;IACrC,mCAAmC;IACnC,sBAAsB;IACtB,uBAAuB;IACvB,iCAAiC;IACjC,iDAAiD;IACjD,mCAAmC;IACnC,uBAAuB;IACvB,6BAA6B;IAC7B,uBAAuB;IACvB,iCAAiC;IACjC,kCAAkC;IAClC,qCAAqC;IACrC,iCAAiC;IACjC,iCAAiC;IACjC,iCAAiC;IACjC,eAAe;IACf,gBAAgB;IAChB,wBAAwB;IACxB,0DAA0D;IAC1DC,IAAI;IACJ,cAAc;IACd,UAAU;IACV,aAAa;IACb,YAAY;IACZ,cAAc;IACd,iBAAiB;IACjB,uBAAuB;IACvB,sBAAsB;IACtB,aAAa;IACb,6BAA6B;IAC7B,mCAAmC;IACnC,uBAAuB;IACvB,sBAAsB;IACtB,iBAAiB;IACjB,eAAe;IACf,kBAAkB;IAClB,kBAAkB;IAClB,0BAA0B;IAC1BC,MAAM;IACN,uBAAuB;IACvB,0BAA0B;IAC1B,2BAA2B;IAC3B,8BAA8B;IAC9B,iCAAiC;IACjC,0BAA0B;IAC1B,uCAAuC;IACvC,sCAAsC;IACtC,iCAAiC;IACjC,oCAAoC;IACpC,yBAAyB;IACzB,kCAAkC;IAClC,8BAA8B;IAC9B,gBAAgB;IAChB,gBAAgB;IAChB,eAAe;IACf,qBAAqB;IACrB,eAAe;IACf,aAAa;IACb,aAAa;IACb,kBAAkB;IAClB,2BAA2B;IAC3B,gCAAgC;IAChC,6BAA6B;IAC7B,iBAAiB;IACjB,uBAAuB;IACvB,cAAc;IACd,kBAAkB;IAClB,sBAAsB;IACtBC,OAAO;IACPC,QAAQ;IACRC,WAAW;IACX,WAAW;IACX,eAAe;IACf,qBAAqB;IACrBC,YAAY;IACZC,MAAM;IACNC,OAAO;IACP,4BAA4B;IAC5BC,MAAM;IACNC,WAAW;IACX,WAAW;IACXC,WAAW;IACXC,SAAS;IACT,yBAAyB;IACzB,gCAAgC;IAChC,kBAAkB;IAClB,2BAA2B;IAC3B,sBAAsB;IACtB,kBAAkB;IAClBC,KAAK;IACL,cAAc;IACdC,SAAS;IACT,aAAa;IACbC,OAAO;IACP,YAAY;IACZ,mBAAmB;IACnB,gBAAgB;IAChBC,SAAS;IACTC,MAAM;IACNC,KAAK;IACLC,KAAK;IACL,qBAAqB;IACrB,kBAAkB;IAClBC,IAAI;IACJC,QAAQ;IACR,sBAAsB;IACtBC,OAAO;IACP,aAAa;IACbC,QAAQ;IACRC,UAAU;IACV,uBAAuB;IACvB,cAAc;IACd,sBAAsB;IACtB,kBAAkB;IAClBC,aAAa;IACb,qBAAqB;IACrBC,KAAK;IACL,gBAAgB;IAChB,YAAY;IACZC,QAAQ;IACR,kBAAkB;IAClB,kBAAkB;IAClBC,MAAM;IACNC,YAAY;IACZC,QAAQ;IACRC,KAAK;IACLC,IAAI;AACN,EAAW;AAGX;;;;CAIC,GACD,OAAO,MAAMC,eAAe,CAC1BC,aACAC;IAEAC,eAAeF,YAAYG,EAAE,EAAEF,MAAM;IACrC,OAAOG,OAAOC,WAAW,CACvBJ,KAAKK,GAAG,CAAC,CAACC,MAAQ;YAACA;YAAK1C,WAAW,CAAC0C,IAAqB;SAAC;AAE9D,EAAE;AAEF;;;;;;;CAOC,GACD,OAAO,MAAMC,cAAc;IACzB;IACA;IACA;IACA;IACA;IACA;IACA;CACD,CAA6C;AAE9C;;;CAGC,GACD,OAAO,MAAMC,aAAa5C,YAAYE,EAAE,CAAC;AAEzC;;CAEC,GACD,OAAO,MAAM2C,cAAc;IACzB,WAAW;IACX,mBAAmB;IACnB,kBAAkB;IAClB,iBAAiB;IACjBC,WAAW;IACX,yBAAyB;IACzB,iCAAiC;IACjC,iCAAiC;IACjC,4BAA4B;IAC5B,qBAAqB;IACrBC,OAAO;IACPC,SAAS;IACTC,SAAS;IACT,qBAAqB;IACrBC,OAAO;IACPC,WAAW;IACX,iBAAiB;IACjB,0BAA0B;IAC1BC,WAAW;IACX,4BAA4B;IAC5B,+BAA+B;IAC/BC,KAAK;IACL,qBAAqB;IACrB,gBAAgB;IAChBC,MAAM;IACN,kBAAkB;IAClB,uBAAuB;IACvB,wBAAwB;IACxBC,IAAI;IACJC,UAAU;IACVC,SAAS;IACTC,UAAU;IACVC,SAAS;IACTC,UAAU;IACVC,SAAS;IACT,4EAA4E;IAC5E,2EAA2E;IAC3E,4EAA4E;IAC5EC,UAAU;AACZ,EAAW;AAGX;;CAEC,GACD,OAAO,MAAMC,iBAAiB,CAC5B5B,aACAC;IAEAC,eAAeF,YAAY6B,EAAE,EAAE5B,MAAM;IACrC,OAAOA,KAAKK,GAAG,CAAC,CAACC,MAAQ,GAAGA,MAAMG,WAAW,CAACH,IAAqB,EAAE;AACvE,EAAE;AAEF,uEAAuE,GACvE,MAAML,iBAAiB,CACrB4B,UACA7B,MACA8B;IAEA,MAAMC,QAAQpE,cAAckE;IAC5B,MAAMG,aAAahC,KAAKiC,MAAM,CAAC,CAAC3B,MAAQ,CAACyB,MAAMG,QAAQ,CAAC5B;IACxD,IAAI0B,WAAWG,MAAM,GAAG,GAAG;QACzB,MAAM,IAAIC,MACR,CAAC,WAAW,EAAEN,KAAK,eAAe,EAAEE,WAAWK,IAAI,CAAC,MAAM,oDAAoD,EAAEP,KAAK,WAAW,CAAC;IAErI;AACF;AAEA;;CAEC,GACD,OAAO,MAAMQ,oBAAoB;IAC/B,eAAe;AACjB,EAAW;AAEX;;;;;CAKC,GACD,OAAO,MAAMC,gBAAgB;IAC3B,uCAAuC;IACvC,4CAA4C;IAC5C,kDAAkD;IAClD,yCAAyC;IACzC,mEAAmE;AACrE,EAAW;AAGX,6EAA6E,GAC7E,OAAO,MAAMC,iBAAiBrC,OAAOsC,IAAI,CAACF,eAAiC;AAE3E,iFAAiF,GACjF,OAAO,MAAMG,sBAAsB,CAACC,WAClC,GAAGA,SAAS,CAAC,EAAEJ,aAAa,CAACI,SAAS,EAAE,CAAC;AAE3C;;;;;;CAMC,GACD,OAAO,MAAMC,gBAAgB;IAC3BC,QAAQ;AACV,EAAW;AAGX,8EAA8E,GAC9E,OAAO,MAAMC,aAAa3C,OAAOsC,IAAI,CAACG,eAAiC;AAEvE;;;;CAIC,GACD,OAAO,MAAMG,cAAc;IACzBC,MAAM;IACNC,QAAQ;AACV,EAAW;AAEX;;;CAGC,GACD,OAAO,MAAMC,qBAAqB;IAChC,qEAAqE;IACrEC,OAAO;AACT,EAAW;AAEX;;;;;CAKC,GACD,OAAO,MAAMC,yBAAyB;IACpCD,OAAO;AACT,EAAqE;AAErE,wEAAwE,GACxE,OAAO,MAAME,iBAAiB,CAACC,OAC7B,GAAGF,sBAAsB,CAACE,KAAK,CAAC,CAAC,EAAEJ,kBAAkB,CAACI,KAAK,EAAE,CAAC;AAEhE;;;;;;;CAOC,GACD,OAAO,MAAMC,0BAA0B;IACrCP,MAAM;IACNC,QAAQ;AACV,EAAW;AAGX;;;;;;;;CAQC,GACD,OAAO,MAAMO,qBAAqB,IAAcD,wBAAwBN,MAAM,CAAC;AAE/E;;;;;;CAMC,GACD,OAAO,MAAMQ,4BAA4B,IACvC,CAAC,EAAE,EAAEF,wBAAwBN,MAAM,EAAE,CAAC;AAExC,gFAAgF,GAChF,OAAO,MAAMS,yBAAyB,CAACC,UACrCA,YAAY,SACR,CAAC,MAAM,EAAEJ,wBAAwBP,IAAI,CAAC,EAAE,CAAC,GACzC,CAAC,MAAM,EAAEO,wBAAwBN,MAAM,EAAE,CAAC;AAEhD;;;CAGC,GACD,OAAO,MAAMW,mBAAmB,CAACD,UAC/BA,YAAY,SACR,CAAC,eAAe,EAAEJ,wBAAwBP,IAAI,CAAC,EAAE,CAAC,GAClD,CAAC,eAAe,EAAEO,wBAAwBN,MAAM,CAACY,OAAO,CAAC,KAAK,MAAM,CAAC;AAE3E;;;;;CAKC,GACD,OAAO,MAAMC,uBAAuB,IAAO,CAAA;QACzCC,aAAaH,iBAAiB;QAC9BI,eAAeJ,iBAAiB;IAClC,CAAA,EAAG;AAEH;;;CAGC,GACD,OAAO,MAAMK,6BAA6B,IAAO,CAAA;QAC/CF,aAAaL,uBAAuB;QACpCM,eAAeN,uBAAuB;IACxC,CAAA,EAAG;AAEH;;;CAGC,GACD,OAAO,MAAMQ,qBAAqB;IAChCC,KAAK;IACLC,QAAQ;IACRC,MAAM;IACNC,SAAS;IACTC,UAAU;IACVC,OAAO;IACPC,MAAM;AACR,EAAW;AAGX;;;CAGC,GACD,OAAO,MAAMC,4BAA4B,IAAO,CAAA;QAC9CC,oBAAoBT,mBAAmBC,GAAG;QAC1CS,uBAAuBV,mBAAmBE,MAAM;QAChDS,qBAAqBX,mBAAmBG,IAAI;QAC5CS,wBAAwBZ,mBAAmBI,OAAO;QAClDS,yBAAyBb,mBAAmBK,QAAQ;QACpDS,sBAAsBd,mBAAmBM,KAAK;QAC9CS,qBAAqBf,mBAAmBO,IAAI;IAC9C,CAAA,EAAG"}

package/src/migrations/latest/agentcore-harness-no-tools-by-default/migration.js.map DELETED Viewed

@@ -1 +0,0 @@

- {"version":3,"sources":["../../../../../../../packages/nx-plugin/src/migrations/latest/agentcore-harness-no-tools-by-default/migration.ts"],"sourcesContent":["/**\n * Copyright Amazon.com, Inc. or its affiliates. All Rights Reserved.\n * SPDX-License-Identifier: Apache-2.0\n */\nimport {\n joinPathFragments,\n type MigrationReturnObject,\n type Tree,\n} from '@nx/devkit';\nimport {\n applyGritQL,\n GRIT_INSERT_PLACEHOLDER,\n insertViaGritQL,\n matchGritQL,\n} from '../../../utils/ast.js';\nimport { formatFilesInSubtree } from '../../../utils/format.js';\nimport {\n PACKAGES_DIR,\n SHARED_CONSTRUCTS_DIR,\n SHARED_TERRAFORM_DIR,\n} from '../../../utils/shared-constructs-constants.js';\n\n/**\n * Pin each vended Harness to no tools by default.\n *\n * AgentCore treats an absent `allowedTools` as every tool, so a Harness that\n * never set it deployed with `allowedTools: [\"*\"]` — shell execution and file\n * read/write included. Both providers now send the field explicitly, defaulting\n * to none.\n *\n * These files are generated with `KeepExisting`, so an upgraded workspace keeps\n * the implicit every-tool default until this runs. Diverged files are left\n * untouched and reported via `nextSteps`.\n */\n\nconst CDK_HARNESSES_DIR = `${PACKAGES_DIR}/${SHARED_CONSTRUCTS_DIR}/src/app/harnesses`;\nconst TERRAFORM_HARNESSES_DIR = `${PACKAGES_DIR}/${SHARED_TERRAFORM_DIR}/src/app/harnesses`;\n\nconst hcl = (pattern: string) => `language hcl\\n${pattern}`;\n\nconst ALLOWED_TOOLS_VARIABLE = [\n 'variable \"allowed_tools\" {',\n ' description = \"Tools the Harness may use. Defaults to none; set [\\\\\"@builtin\\\\\"] for every built-in tool, or name individual tools. Always sent explicitly, since the service treats an absent value as every tool.\"',\n ' type = list(string)',\n ' default = []',\n '}',\n].join('\\n');\n\nconst divergedMessage = (filePath: string, remedy: string) =>\n `${filePath}: has diverged from the generated shape - left untouched. AgentCore treats an absent allowedTools as every tool, so this Harness deploys with all built-in tools (including shell and file access). ${remedy}`;\n\n/**\n * Default the construct's `allowedTools` to none and pass it to the resource\n * after the props spread, so an undefined caller value cannot reinstate the\n * service's every-tool default.\n */\nconst migrateCdkConstruct = async (\n tree: Tree,\n filePath: string,\n): Promise<boolean> => {\n const destructured = await insertViaGritQL(\n tree,\n filePath,\n `\\`const { $fields } = props ?? {};\\` => \\`const {\\n ${GRIT_INSERT_PLACEHOLDER}\\n $fields\\n } = props ?? {};\\``,\n [\n '// The service treats an absent allowedTools as every tool, so this',\n '// defaults to none and is always passed explicitly.',\n 'allowedTools = [],',\n ].join('\\n '),\n );\n if (!destructured) return false;\n\n return await applyGritQL(\n tree,\n filePath,\n '`new agentcore.CfnHarness($scope, $id, { $props })` where {' +\n ' $props <: contains spread_element() as $spread,' +\n ' $spread => `$spread,\\n allowedTools`' +\n ' }',\n );\n};\n\n/**\n * Declare `allowed_tools` and assign it to the Harness resource, so the module\n * always sends the field.\n */\nconst migrateTerraformModule = async (\n tree: Tree,\n filePath: string,\n): Promise<boolean> => {\n const declared = await insertViaGritQL(\n tree,\n filePath,\n hcl(\n `\\`variable \"model_resource_arns\" { $props }\\` => \\`${GRIT_INSERT_PLACEHOLDER}\\n\\nvariable \"model_resource_arns\" {\\n $props\\n}\\``,\n ),\n ALLOWED_TOOLS_VARIABLE,\n );\n if (!declared) return false;\n\n // Appended after the existing arguments so their alignment is preserved;\n // `terraform fmt` re-aligns the block.\n return await applyGritQL(\n tree,\n filePath,\n hcl(\n '`execution_role_arn = aws_iam_role.execution_role.arn` => `execution_role_arn = aws_iam_role.execution_role.arn\\n allowed_tools = var.allowed_tools`',\n ),\n );\n};\n\nexport default async function migration(\n tree: Tree,\n): Promise<MigrationReturnObject> {\n const nextSteps: string[] = [];\n\n for (const dirName of tree.exists(CDK_HARNESSES_DIR)\n ? tree.children(CDK_HARNESSES_DIR)\n : []) {\n const filePath = joinPathFragments(\n CDK_HARNESSES_DIR,\n dirName,\n `${dirName}.ts`,\n );\n if (!tree.exists(filePath)) {\n continue; // Not a Harness construct directory.\n }\n\n // Already pinned, by this migration or by hand.\n if (tree.read(filePath, 'utf-8')?.includes('allowedTools = [],')) {\n continue;\n }\n\n if (!(await migrateCdkConstruct(tree, filePath))) {\n nextSteps.push(\n divergedMessage(\n filePath,\n 'Default `allowedTools` to `[]` when destructuring props, and pass `allowedTools` to the CfnHarness after the `...harnessProps` spread.',\n ),\n );\n }\n }\n\n for (const dirName of tree.exists(TERRAFORM_HARNESSES_DIR)\n ? tree.children(TERRAFORM_HARNESSES_DIR)\n : []) {\n const filePath = joinPathFragments(\n TERRAFORM_HARNESSES_DIR,\n dirName,\n `${dirName}.tf`,\n );\n if (!tree.exists(filePath)) {\n continue; // Not a Harness module directory.\n }\n\n // Already assigned, by this migration or by hand.\n if (await matchGritQL(tree, filePath, hcl('`allowed_tools = $_`'))) {\n continue;\n }\n\n if (!(await migrateTerraformModule(tree, filePath))) {\n nextSteps.push(\n divergedMessage(\n filePath,\n 'Declare an `allowed_tools` variable (list(string), default []) and assign `allowed_tools = var.allowed_tools` on the `aws_bedrockagentcore_harness` resource.',\n ),\n );\n }\n }\n\n await formatFilesInSubtree(tree);\n\n return { nextSteps };\n}\n"],"names":["joinPathFragments","applyGritQL","GRIT_INSERT_PLACEHOLDER","insertViaGritQL","matchGritQL","formatFilesInSubtree","PACKAGES_DIR","SHARED_CONSTRUCTS_DIR","SHARED_TERRAFORM_DIR","CDK_HARNESSES_DIR","TERRAFORM_HARNESSES_DIR","hcl","pattern","ALLOWED_TOOLS_VARIABLE","join","divergedMessage","filePath","remedy","migrateCdkConstruct","tree","destructured","migrateTerraformModule","declared","migration","nextSteps","dirName","exists","children","read","includes","push"],"mappings":"AAAA;;;CAGC,GACD,SACEA,iBAAiB,QAGZ,aAAa;AACpB,SACEC,WAAW,EACXC,uBAAuB,EACvBC,eAAe,EACfC,WAAW,QACN,wBAAwB;AAC/B,SAASC,oBAAoB,QAAQ,2BAA2B;AAChE,SACEC,YAAY,EACZC,qBAAqB,EACrBC,oBAAoB,QACf,gDAAgD;AAEvD;;;;;;;;;;;CAWC,GAED,MAAMC,oBAAoB,GAAGH,aAAa,CAAC,EAAEC,sBAAsB,kBAAkB,CAAC;AACtF,MAAMG,0BAA0B,GAAGJ,aAAa,CAAC,EAAEE,qBAAqB,kBAAkB,CAAC;AAE3F,MAAMG,MAAM,CAACC,UAAoB,CAAC,cAAc,EAAEA,SAAS;AAE3D,MAAMC,yBAAyB;IAC7B;IACA;IACA;IACA;IACA;CACD,CAACC,IAAI,CAAC;AAEP,MAAMC,kBAAkB,CAACC,UAAkBC,SACzC,GAAGD,SAAS,oMAAoM,EAAEC,QAAQ;AAE5N;;;;CAIC,GACD,MAAMC,sBAAsB,OAC1BC,MACAH;IAEA,MAAMI,eAAe,MAAMjB,gBACzBgB,MACAH,UACA,CAAC,yDAAyD,EAAEd,wBAAwB,uCAAuC,CAAC,EAC5H;QACE;QACA;QACA;KACD,CAACY,IAAI,CAAC;IAET,IAAI,CAACM,cAAc,OAAO;IAE1B,OAAO,MAAMnB,YACXkB,MACAH,UACA,gEACE,qDACA,+CACA;AAEN;AAEA;;;CAGC,GACD,MAAMK,yBAAyB,OAC7BF,MACAH;IAEA,MAAMM,WAAW,MAAMnB,gBACrBgB,MACAH,UACAL,IACE,CAAC,mDAAmD,EAAET,wBAAwB,mDAAmD,CAAC,GAEpIW;IAEF,IAAI,CAACS,UAAU,OAAO;IAEtB,yEAAyE;IACzE,uCAAuC;IACvC,OAAO,MAAMrB,YACXkB,MACAH,UACAL,IACE;AAGN;AAEA,eAAe,eAAeY,UAC5BJ,IAAU;IAEV,MAAMK,YAAsB,EAAE;IAE9B,KAAK,MAAMC,WAAWN,KAAKO,MAAM,CAACjB,qBAC9BU,KAAKQ,QAAQ,CAAClB,qBACd,EAAE,CAAE;QACN,MAAMO,WAAWhB,kBACfS,mBACAgB,SACA,GAAGA,QAAQ,GAAG,CAAC;QAEjB,IAAI,CAACN,KAAKO,MAAM,CAACV,WAAW;YAC1B,UAAU,qCAAqC;QACjD;QAEA,gDAAgD;QAChD,IAAIG,KAAKS,IAAI,CAACZ,UAAU,UAAUa,SAAS,uBAAuB;YAChE;QACF;QAEA,IAAI,CAAE,MAAMX,oBAAoBC,MAAMH,WAAY;YAChDQ,UAAUM,IAAI,CACZf,gBACEC,UACA;QAGN;IACF;IAEA,KAAK,MAAMS,WAAWN,KAAKO,MAAM,CAAChB,2BAC9BS,KAAKQ,QAAQ,CAACjB,2BACd,EAAE,CAAE;QACN,MAAMM,WAAWhB,kBACfU,yBACAe,SACA,GAAGA,QAAQ,GAAG,CAAC;QAEjB,IAAI,CAACN,KAAKO,MAAM,CAACV,WAAW;YAC1B,UAAU,kCAAkC;QAC9C;QAEA,kDAAkD;QAClD,IAAI,MAAMZ,YAAYe,MAAMH,UAAUL,IAAI,0BAA0B;YAClE;QACF;QAEA,IAAI,CAAE,MAAMU,uBAAuBF,MAAMH,WAAY;YACnDQ,UAAUM,IAAI,CACZf,gBACEC,UACA;QAGN;IACF;IAEA,MAAMX,qBAAqBc;IAE3B,OAAO;QAAEK;IAAU;AACrB"}

package/src/migrations/latest/dynamodb-configurable-encryption/migration.js.map DELETED Viewed

@@ -1 +0,0 @@

- {"version":3,"sources":["../../../../../../../packages/nx-plugin/src/migrations/latest/dynamodb-configurable-encryption/migration.ts"],"sourcesContent":["/**\n * Copyright Amazon.com, Inc. or its affiliates. All Rights Reserved.\n * SPDX-License-Identifier: Apache-2.0\n */\nimport {\n joinPathFragments,\n type MigrationReturnObject,\n type Tree,\n} from '@nx/devkit';\nimport {\n addDestructuredImport,\n applyGritQL,\n GRIT_INSERT_PLACEHOLDER,\n insertViaGritQL,\n matchGritQL,\n} from '../../../utils/ast.js';\nimport { formatFilesInSubtree } from '../../../utils/format.js';\nimport {\n PACKAGES_DIR,\n SHARED_CONSTRUCTS_DIR,\n SHARED_TERRAFORM_DIR,\n} from '../../../utils/shared-constructs-constants.js';\n\n/**\n * Bring existing workspaces up to the generators' current DynamoDBTable\n * configurability:\n *\n * - The vended `DynamoDBTable` CDK construct gains `encryption` and\n * `encryptionKey` props. The KMS key is only created when `encryption` is\n * `TableEncryption.CUSTOMER_MANAGED` and no `encryptionKey` is supplied.\n * `enableKeyRotation` (already present) only applies to that auto-created\n * key.\n * - The generated per-table CDK app construct already forwards an optional\n * `props` parameter through to `DynamoDBTable`, so no change is needed\n * there.\n * - The vended Terraform dynamodb core module gains the equivalent\n * `encryption`, `kms_key_arn` and `create_kms_key` variables (`encryption`\n * also accepts `DEFAULT`, the AWS owned key, which CDK already supports for\n * free via `TableEncryption.DEFAULT`), with the KMS key made conditional on\n * `create_kms_key` (not on `kms_key_arn`'s nullness, which `count` can't\n * depend on when the ARN comes from another resource) and\n * `server_side_encryption.enabled` tied to `encryption`. `AWS_MANAGED`\n * resolves to the explicit `alias/aws/dynamodb` ARN rather than `null`,\n * since the provider's `kms_key_arn` is Optional+Computed and a `null`\n * there means \"leave whatever is there\", not \"clear it\".\n * - The vended Terraform per-table app module (`app/dynamodb/<name>/<name>.tf`)\n * gains pass-through `encryption`, `kms_key_arn` and `create_kms_key`\n * variables forwarded to the core module call, matching its existing\n * `enable_key_rotation` pass-through.\n *\n * These files are generated with `KeepExisting`, so without this an upgraded\n * workspace has generators that support this configuration but vended files\n * that don't. Diverged files are left untouched and reported via `nextSteps`.\n */\n\nconst CDK_DYNAMODB_FILE = `${PACKAGES_DIR}/${SHARED_CONSTRUCTS_DIR}/src/core/dynamodb.ts`;\nconst TERRAFORM_DYNAMODB_FILE = `${PACKAGES_DIR}/${SHARED_TERRAFORM_DIR}/src/core/dynamodb/dynamodb.tf`;\nconst TERRAFORM_DYNAMODB_APP_DIR = `${PACKAGES_DIR}/${SHARED_TERRAFORM_DIR}/src/app/dynamodb`;\n\nconst CDK_DIVERGED_MESSAGE = `${CDK_DYNAMODB_FILE}: has diverged from the generated shape - left untouched. To pick up the encryption and encryptionKey props, manually port them from the vended core/dynamodb.ts template (see the ts#dynamodb generator's DynamoDBTable construct).`;\n\nconst TERRAFORM_DIVERGED_MESSAGE = `${TERRAFORM_DYNAMODB_FILE}: has diverged from the generated shape - left untouched. To pick up the encryption and kms_key_arn variables, manually port them from the vended dynamodb.tf template (see the ts#dynamodb generator's dynamodb module).`;\n\nconst terraformAppDivergedMessage = (filePath: string) =>\n `${filePath}: has diverged from the generated shape - left untouched. To make encryption and kms_key_arn configurable from your root Terraform configuration, add pass-through variables here and forward them to the dynamodb_table module call (see the ts#dynamodb generator's dynamodb app template).`;\n\n/**\n * Surface encryption/encryptionKey on the vended DynamoDBTable CDK\n * construct.\n */\nconst migrateCdkConstruct = async (\n tree: Tree,\n nextSteps: string[],\n): Promise<void> => {\n if (!tree.exists(CDK_DYNAMODB_FILE)) {\n return; // This workspace has no CDK DynamoDBTable construct.\n }\n\n if (\n await matchGritQL(\n tree,\n CDK_DYNAMODB_FILE,\n '`readonly encryption?: TableEncryption`',\n )\n ) {\n return; // Already migrated.\n }\n\n const ENABLE_KEY_ROTATION_FIELD = '`readonly enableKeyRotation?: boolean`';\n // Matched as a literal so the new fields can be inserted *before* it (see\n // below) — GritQL doesn't include a leading comment in the span it matches\n // for the field itself, so anchoring on the field would strand this\n // comment above the newly-inserted fields instead of above the field it\n // actually documents.\n const ENABLE_KEY_ROTATION_COMMENT = `\\`/**\n * Whether to enable automatic key rotation on the KMS key used to encrypt the table.\n *\n * @default true\n */\\``;\n const DESTRUCTURE_OLD = `\\`{\n tableName,\n runtimeConfigKey,\n billingMode = BillingMode.PAY_PER_REQUEST,\n pointInTimeRecoverySpecification = { pointInTimeRecoveryEnabled: true },\n deletionProtection = true,\n removalPolicy = RemovalPolicy.RETAIN,\n enableKeyRotation = true,\n ...rest\n }: DynamoDBTableProps\\``;\n const KEY_CREATION_OLD =\n \"`const key = new Key(this, 'EncryptionKey', { enableKeyRotation });`\";\n const TABLE_ENCRYPTION_OLD = '`encryption: TableEncryption.CUSTOMER_MANAGED`';\n\n const anchors = [\n ENABLE_KEY_ROTATION_FIELD,\n ENABLE_KEY_ROTATION_COMMENT,\n DESTRUCTURE_OLD,\n KEY_CREATION_OLD,\n TABLE_ENCRYPTION_OLD,\n ];\n\n const allPresent = (\n await Promise.all(\n anchors.map((pattern) => matchGritQL(tree, CDK_DYNAMODB_FILE, pattern)),\n )\n ).every(Boolean);\n\n if (!allPresent) {\n nextSteps.push(CDK_DIVERGED_MESSAGE);\n return;\n }\n\n await addDestructuredImport(\n tree,\n CDK_DYNAMODB_FILE,\n ['IKey'],\n 'aws-cdk-lib/aws-kms',\n );\n\n // Inserted before the enableKeyRotation field's own leading comment (rather\n // than before the bare field) so that comment stays directly above the\n // field it documents, instead of being stranded above the new fields.\n await insertViaGritQL(\n tree,\n CDK_DYNAMODB_FILE,\n `${ENABLE_KEY_ROTATION_COMMENT} as $comment => \\`${GRIT_INSERT_PLACEHOLDER}\n $comment\\``,\n `/**\n * Server-side encryption for the table.\n *\n * @default TableEncryption.CUSTOMER_MANAGED\n */\n readonly encryption?: TableEncryption;\n\n /**\n * KMS key used to encrypt the table. Only used when \\`encryption\\` is\n * \\`TableEncryption.CUSTOMER_MANAGED\\`. When not provided, a new key is created.\n */\n readonly encryptionKey?: IKey;\n\n `,\n );\n\n // Update the enableKeyRotation field's own comment to note it now only\n // applies to the auto-created key, matching the vended template exactly.\n // Routed through the insert placeholder (rather than embedding the text\n // directly in the GritQL rewrite) since the comment's own backticks would\n // otherwise be parsed as GritQL code-block delimiters.\n await insertViaGritQL(\n tree,\n CDK_DYNAMODB_FILE,\n `${ENABLE_KEY_ROTATION_COMMENT} => \\`${GRIT_INSERT_PLACEHOLDER}\\``,\n `/**\n * Whether to enable automatic key rotation on the KMS key used to encrypt the table.\n * Only applies when \\`encryption\\` is \\`TableEncryption.CUSTOMER_MANAGED\\` and no\n * \\`encryptionKey\\` is supplied.\n *\n * @default true\n */`,\n );\n\n await applyGritQL(\n tree,\n CDK_DYNAMODB_FILE,\n `${DESTRUCTURE_OLD} => \\`{\n tableName,\n runtimeConfigKey,\n billingMode = BillingMode.PAY_PER_REQUEST,\n pointInTimeRecoverySpecification = { pointInTimeRecoveryEnabled: true },\n deletionProtection = true,\n removalPolicy = RemovalPolicy.RETAIN,\n encryption = TableEncryption.CUSTOMER_MANAGED,\n encryptionKey,\n enableKeyRotation = true,\n ...rest\n }: DynamoDBTableProps\\``,\n );\n\n await applyGritQL(\n tree,\n CDK_DYNAMODB_FILE,\n `${KEY_CREATION_OLD} => \\`const key: IKey | undefined =\n encryption === TableEncryption.CUSTOMER_MANAGED\n ? (encryptionKey ?? new Key(this, 'EncryptionKey', { enableKeyRotation }))\n : undefined;\\``,\n );\n\n await applyGritQL(\n tree,\n CDK_DYNAMODB_FILE,\n `${TABLE_ENCRYPTION_OLD} => \\`encryption\\``,\n );\n};\n\nconst hcl = (pattern: string) => `language hcl\\n${pattern}`;\n\nconst NEW_TERRAFORM_VARIABLES_TEXT = [\n 'variable \"encryption\" {',\n ' description = \"Server-side encryption for the table. One of CUSTOMER_MANAGED, AWS_MANAGED or DEFAULT (the AWS owned key, at no cost and with no key to manage). Changing this on an already-deployed table away from CUSTOMER_MANAGED requires a manual step first - see the ts#dynamodb generator docs.\"',\n ' type = string',\n ' default = \"CUSTOMER_MANAGED\"',\n '',\n ' validation {',\n ' condition = contains([\"CUSTOMER_MANAGED\", \"AWS_MANAGED\", \"DEFAULT\"], var.encryption)',\n ' error_message = \"encryption must be one of CUSTOMER_MANAGED, AWS_MANAGED or DEFAULT.\"',\n ' }',\n '}',\n '',\n 'variable \"kms_key_arn\" {',\n ' description = \"ARN of an existing KMS key used to encrypt the table when encryption is CUSTOMER_MANAGED. When not provided and create_kms_key is true, a new key is created. Note that a customer-supplied key must already grant the DynamoDB service the necessary permissions in its own key policy.\"',\n ' type = string',\n ' default = null',\n '}',\n '',\n 'variable \"create_kms_key\" {',\n ' description = \"Whether to create a KMS key for the table. Only applies when encryption is CUSTOMER_MANAGED. Set to false when supplying kms_key_arn.\"',\n ' type = bool',\n ' default = true',\n '}',\n '',\n 'variable \"enable_key_rotation\" {',\n ' description = \"Whether to enable automatic key rotation on the KMS key used to encrypt the table. Only applies when encryption is CUSTOMER_MANAGED and create_kms_key is true.\"',\n ' type = bool',\n ' default = true',\n '}',\n].join('\\n');\n\n/**\n * Surface encryption/kms_key_arn on the vended Terraform dynamodb core\n * module.\n */\nconst migrateTerraformModule = async (\n tree: Tree,\n nextSteps: string[],\n): Promise<void> => {\n if (!tree.exists(TERRAFORM_DYNAMODB_FILE)) {\n return; // This workspace has no Terraform dynamodb module.\n }\n\n if (\n await matchGritQL(\n tree,\n TERRAFORM_DYNAMODB_FILE,\n hcl('`variable \"encryption\" { $_ }`'),\n )\n ) {\n return; // Already migrated.\n }\n\n const OLD_ENABLE_KEY_ROTATION_VAR = hcl(\n [\n '`variable \"enable_key_rotation\" {',\n ' description = \"Whether to enable automatic key rotation on the KMS key used to encrypt the table.\"',\n ' type = bool',\n ' default = true',\n '}`',\n ].join('\\n'),\n );\n const LOCALS_BLOCK = hcl('`locals { $_ }`');\n const DATA_PARTITION_LINE = hcl('`data \"aws_partition\" \"current\" {}`');\n const KMS_KEY_BLOCK = hcl('`resource \"aws_kms_key\" \"table\" { $_ }`');\n const SSE_ENABLED_LINE = hcl('`enabled = true`');\n const SSE_KMS_KEY_LINE = hcl('`kms_key_arn = aws_kms_key.table.arn`');\n const OUTPUT_VALUE_LINE = hcl('`value = aws_kms_key.table.arn`');\n const OUTPUT_DESCRIPTION_LINE = hcl(\n '`description = \"ARN of the KMS key used to encrypt the DynamoDB table.\"`',\n );\n\n const anchors = [\n OLD_ENABLE_KEY_ROTATION_VAR,\n LOCALS_BLOCK,\n DATA_PARTITION_LINE,\n KMS_KEY_BLOCK,\n SSE_ENABLED_LINE,\n SSE_KMS_KEY_LINE,\n OUTPUT_VALUE_LINE,\n OUTPUT_DESCRIPTION_LINE,\n ];\n\n const allPresent = (\n await Promise.all(\n anchors.map((pattern) =>\n matchGritQL(tree, TERRAFORM_DYNAMODB_FILE, pattern),\n ),\n )\n ).every(Boolean);\n\n if (!allPresent) {\n nextSteps.push(TERRAFORM_DIVERGED_MESSAGE);\n return;\n }\n\n // 1. Replace the enable_key_rotation variable with the new variables plus\n // an updated enable_key_rotation description, in the same position.\n await applyGritQL(\n tree,\n TERRAFORM_DYNAMODB_FILE,\n `${OLD_ENABLE_KEY_ROTATION_VAR} => \\`${NEW_TERRAFORM_VARIABLES_TEXT.replace(/`/g, '\\\\`')}\\``,\n );\n\n // 2. New locals, appended into the existing locals block.\n await insertViaGritQL(\n tree,\n TERRAFORM_DYNAMODB_FILE,\n hcl(\n `\\`locals { $body }\\` => \\`locals {\\n $body\\n\\n ${GRIT_INSERT_PLACEHOLDER}\\n}\\``,\n ),\n [\n 'create_table_key = var.encryption == \"CUSTOMER_MANAGED\" && var.create_kms_key',\n 'table_kms_key_arn = (',\n ' var.encryption == \"CUSTOMER_MANAGED\" ? (local.create_table_key ? aws_kms_key.table[0].arn : var.kms_key_arn) :',\n ' var.encryption == \"AWS_MANAGED\" ? \"arn:${data.aws_partition.current.partition}:kms:${data.aws_region.current.region}:${data.aws_caller_identity.current.account_id}:alias/aws/dynamodb\" :',\n ' null',\n ')',\n ].join('\\n '),\n );\n\n // 2b. Region is needed to resolve the AWS_MANAGED key's alias ARN above.\n await insertViaGritQL(\n tree,\n TERRAFORM_DYNAMODB_FILE,\n `${DATA_PARTITION_LINE} => \\`data \"aws_partition\" \"current\" {}\\n${GRIT_INSERT_PLACEHOLDER}\\``,\n 'data \"aws_region\" \"current\" {}',\n );\n\n // 3. Make the KMS key conditional on encryption/kms_key_arn.\n await applyGritQL(\n tree,\n TERRAFORM_DYNAMODB_FILE,\n hcl(`\\`resource \"aws_kms_key\" \"table\" { $body }\\` => \\`resource \"aws_kms_key\" \"table\" {\n count = local.create_table_key ? 1 : 0\n\n $body\n}\\``),\n );\n\n // 4. Only enable KMS-backed encryption when not using the AWS owned key.\n await applyGritQL(\n tree,\n TERRAFORM_DYNAMODB_FILE,\n `${SSE_ENABLED_LINE} => \\`enabled = var.encryption != \"DEFAULT\"\\``,\n );\n\n // 4b. Checkov's CKV_AWS_119 only passes when server_side_encryption.enabled\n // is the literal `true` — it can't resolve the conditional above, even\n // though CUSTOMER_MANAGED (the default) always uses a real CMK. Same\n // false-positive shape as CKV_AWS_139 on the vended RDS module.\n await insertViaGritQL(\n tree,\n TERRAFORM_DYNAMODB_FILE,\n hcl(\n `\\`resource \"aws_dynamodb_table\" \"table\" { $body }\\` => \\`resource \"aws_dynamodb_table\" \"table\" {\\n ${GRIT_INSERT_PLACEHOLDER}\\n $body\\n}\\``,\n ),\n '#checkov:skip=CKV_AWS_119:Encryption is configurable via var.encryption; checkov cannot resolve the conditional server_side_encryption.enabled expression',\n );\n\n // 5. Resolve the key ARN through the new local everywhere it's consumed.\n await applyGritQL(\n tree,\n TERRAFORM_DYNAMODB_FILE,\n `${SSE_KMS_KEY_LINE} => \\`kms_key_arn = local.table_kms_key_arn\\``,\n );\n await applyGritQL(\n tree,\n TERRAFORM_DYNAMODB_FILE,\n `${OUTPUT_VALUE_LINE} => \\`value = local.table_kms_key_arn\\``,\n );\n await applyGritQL(\n tree,\n TERRAFORM_DYNAMODB_FILE,\n `${OUTPUT_DESCRIPTION_LINE} => \\`description = \"ARN of the KMS key used to encrypt the DynamoDB table, or null when using the AWS owned key (encryption = DEFAULT).\"\\``,\n );\n};\n\nconst NEW_APP_MODULE_VARIABLES_TEXT = [\n 'variable \"encryption\" {',\n ' description = \"Server-side encryption for the table. One of CUSTOMER_MANAGED, AWS_MANAGED or DEFAULT (the AWS owned key, at no cost and with no key to manage). Changing this on an already-deployed table away from CUSTOMER_MANAGED requires a manual step first - see the ts#dynamodb generator docs.\"',\n ' type = string',\n ' default = \"CUSTOMER_MANAGED\"',\n '',\n ' validation {',\n ' condition = contains([\"CUSTOMER_MANAGED\", \"AWS_MANAGED\", \"DEFAULT\"], var.encryption)',\n ' error_message = \"encryption must be one of CUSTOMER_MANAGED, AWS_MANAGED or DEFAULT.\"',\n ' }',\n '}',\n '',\n 'variable \"kms_key_arn\" {',\n ' description = \"ARN of an existing KMS key used to encrypt the table when encryption is CUSTOMER_MANAGED. When not provided and create_kms_key is true, a new key is created. Note that a customer-supplied key must already grant the DynamoDB service the necessary permissions in its own key policy.\"',\n ' type = string',\n ' default = null',\n '}',\n '',\n 'variable \"create_kms_key\" {',\n ' description = \"Whether to create a KMS key for the table. Only applies when encryption is CUSTOMER_MANAGED. Set to false when supplying kms_key_arn.\"',\n ' type = bool',\n ' default = true',\n '}',\n '',\n 'variable \"enable_key_rotation\" {',\n ' description = \"Whether to enable automatic key rotation on the KMS key used to encrypt the table. Only applies when encryption is CUSTOMER_MANAGED and create_kms_key is true.\"',\n ' type = bool',\n ' default = true',\n '}',\n].join('\\n');\n\n/**\n * Surface the same configuration as pass-through variables on each vended\n * per-table Terraform app module, matching its existing pass-through\n * convention for enable_key_rotation.\n */\nconst migrateTerraformAppModules = async (\n tree: Tree,\n nextSteps: string[],\n): Promise<void> => {\n if (!tree.exists(TERRAFORM_DYNAMODB_APP_DIR)) {\n return;\n }\n\n for (const dirName of tree.children(TERRAFORM_DYNAMODB_APP_DIR)) {\n const filePath = joinPathFragments(\n TERRAFORM_DYNAMODB_APP_DIR,\n dirName,\n `${dirName}.tf`,\n );\n if (!tree.exists(filePath)) {\n continue; // Not a dynamodb app module directory.\n }\n\n if (\n await matchGritQL(tree, filePath, hcl('`variable \"encryption\" { $_ }`'))\n ) {\n continue; // Already migrated.\n }\n\n const OLD_ENABLE_KEY_ROTATION_VAR = hcl(\n [\n '`variable \"enable_key_rotation\" {',\n ' description = \"Whether to enable automatic key rotation on the KMS key used to encrypt the table.\"',\n ' type = bool',\n ' default = true',\n '}`',\n ].join('\\n'),\n );\n const MODULE_BLOCK = hcl('`module \"dynamodb_table\" { $_ }`');\n const DELETION_PROTECTION_LINE = hcl(\n '`deletion_protection_enabled = var.deletion_protection_enabled`',\n );\n\n const ready = (\n await Promise.all(\n [\n OLD_ENABLE_KEY_ROTATION_VAR,\n MODULE_BLOCK,\n DELETION_PROTECTION_LINE,\n ].map((pattern) => matchGritQL(tree, filePath, pattern)),\n )\n ).every(Boolean);\n\n if (!ready) {\n nextSteps.push(terraformAppDivergedMessage(filePath));\n continue;\n }\n\n await applyGritQL(\n tree,\n filePath,\n `${OLD_ENABLE_KEY_ROTATION_VAR} => \\`${NEW_APP_MODULE_VARIABLES_TEXT.replace(/`/g, '\\\\`')}\\``,\n );\n\n await insertViaGritQL(\n tree,\n filePath,\n hcl(\n `\\`deletion_protection_enabled = var.deletion_protection_enabled\\` => \\`deletion_protection_enabled = var.deletion_protection_enabled\\n ${GRIT_INSERT_PLACEHOLDER}\\``,\n ),\n [\n 'encryption = var.encryption',\n 'kms_key_arn = var.kms_key_arn',\n 'create_kms_key = var.create_kms_key',\n ].join('\\n '),\n );\n }\n};\n\nexport default async function migration(\n tree: Tree,\n): Promise<MigrationReturnObject> {\n const nextSteps: string[] = [];\n\n await migrateCdkConstruct(tree, nextSteps);\n await migrateTerraformModule(tree, nextSteps);\n await migrateTerraformAppModules(tree, nextSteps);\n\n await formatFilesInSubtree(tree);\n\n return { nextSteps };\n}\n"],"names":["joinPathFragments","addDestructuredImport","applyGritQL","GRIT_INSERT_PLACEHOLDER","insertViaGritQL","matchGritQL","formatFilesInSubtree","PACKAGES_DIR","SHARED_CONSTRUCTS_DIR","SHARED_TERRAFORM_DIR","CDK_DYNAMODB_FILE","TERRAFORM_DYNAMODB_FILE","TERRAFORM_DYNAMODB_APP_DIR","CDK_DIVERGED_MESSAGE","TERRAFORM_DIVERGED_MESSAGE","terraformAppDivergedMessage","filePath","migrateCdkConstruct","tree","nextSteps","exists","ENABLE_KEY_ROTATION_FIELD","ENABLE_KEY_ROTATION_COMMENT","DESTRUCTURE_OLD","KEY_CREATION_OLD","TABLE_ENCRYPTION_OLD","anchors","allPresent","Promise","all","map","pattern","every","Boolean","push","hcl","NEW_TERRAFORM_VARIABLES_TEXT","join","migrateTerraformModule","OLD_ENABLE_KEY_ROTATION_VAR","LOCALS_BLOCK","DATA_PARTITION_LINE","KMS_KEY_BLOCK","SSE_ENABLED_LINE","SSE_KMS_KEY_LINE","OUTPUT_VALUE_LINE","OUTPUT_DESCRIPTION_LINE","replace","NEW_APP_MODULE_VARIABLES_TEXT","migrateTerraformAppModules","dirName","children","MODULE_BLOCK","DELETION_PROTECTION_LINE","ready","migration"],"mappings":"AAAA;;;CAGC,GACD,SACEA,iBAAiB,QAGZ,aAAa;AACpB,SACEC,qBAAqB,EACrBC,WAAW,EACXC,uBAAuB,EACvBC,eAAe,EACfC,WAAW,QACN,wBAAwB;AAC/B,SAASC,oBAAoB,QAAQ,2BAA2B;AAChE,SACEC,YAAY,EACZC,qBAAqB,EACrBC,oBAAoB,QACf,gDAAgD;AAEvD;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;CA8BC,GAED,MAAMC,oBAAoB,GAAGH,aAAa,CAAC,EAAEC,sBAAsB,qBAAqB,CAAC;AACzF,MAAMG,0BAA0B,GAAGJ,aAAa,CAAC,EAAEE,qBAAqB,8BAA8B,CAAC;AACvG,MAAMG,6BAA6B,GAAGL,aAAa,CAAC,EAAEE,qBAAqB,iBAAiB,CAAC;AAE7F,MAAMI,uBAAuB,GAAGH,kBAAkB,oOAAoO,CAAC;AAEvR,MAAMI,6BAA6B,GAAGH,wBAAwB,yNAAyN,CAAC;AAExR,MAAMI,8BAA8B,CAACC,WACnC,GAAGA,SAAS,6RAA6R,CAAC;AAE5S;;;CAGC,GACD,MAAMC,sBAAsB,OAC1BC,MACAC;IAEA,IAAI,CAACD,KAAKE,MAAM,CAACV,oBAAoB;QACnC,QAAQ,qDAAqD;IAC/D;IAEA,IACE,MAAML,YACJa,MACAR,mBACA,4CAEF;QACA,QAAQ,oBAAoB;IAC9B;IAEA,MAAMW,4BAA4B;IAClC,0EAA0E;IAC1E,2EAA2E;IAC3E,oEAAoE;IACpE,wEAAwE;IACxE,sBAAsB;IACtB,MAAMC,8BAA8B,CAAC;;;;OAIhC,CAAC;IACN,MAAMC,kBAAkB,CAAC;;;;;;;;;2BASA,CAAC;IAC1B,MAAMC,mBACJ;IACF,MAAMC,uBAAuB;IAE7B,MAAMC,UAAU;QACdL;QACAC;QACAC;QACAC;QACAC;KACD;IAED,MAAME,aAAa,AACjB,CAAA,MAAMC,QAAQC,GAAG,CACfH,QAAQI,GAAG,CAAC,CAACC,UAAY1B,YAAYa,MAAMR,mBAAmBqB,UAChE,EACAC,KAAK,CAACC;IAER,IAAI,CAACN,YAAY;QACfR,UAAUe,IAAI,CAACrB;QACf;IACF;IAEA,MAAMZ,sBACJiB,MACAR,mBACA;QAAC;KAAO,EACR;IAGF,4EAA4E;IAC5E,uEAAuE;IACvE,sEAAsE;IACtE,MAAMN,gBACJc,MACAR,mBACA,GAAGY,4BAA4B,kBAAkB,EAAEnB,wBAAwB;YACnE,CAAC,EACT,CAAC;;;;;;;;;;;;;EAaH,CAAC;IAGD,uEAAuE;IACvE,yEAAyE;IACzE,wEAAwE;IACxE,0EAA0E;IAC1E,uDAAuD;IACvD,MAAMC,gBACJc,MACAR,mBACA,GAAGY,4BAA4B,MAAM,EAAEnB,wBAAwB,EAAE,CAAC,EAClE,CAAC;;;;;;KAMA,CAAC;IAGJ,MAAMD,YACJgB,MACAR,mBACA,GAAGa,gBAAgB;;;;;;;;;;;2BAWI,CAAC;IAG1B,MAAMrB,YACJgB,MACAR,mBACA,GAAGc,iBAAiB;;;sBAGF,CAAC;IAGrB,MAAMtB,YACJgB,MACAR,mBACA,GAAGe,qBAAqB,kBAAkB,CAAC;AAE/C;AAEA,MAAMU,MAAM,CAACJ,UAAoB,CAAC,cAAc,EAAEA,SAAS;AAE3D,MAAMK,+BAA+B;IACnC;IACA;IACA;IACA;IACA;IACA;IACA;IACA;IACA;IACA;IACA;IACA;IACA;IACA;IACA;IACA;IACA;IACA;IACA;IACA;IACA;IACA;IACA;IACA;IACA;IACA;IACA;IACA;CACD,CAACC,IAAI,CAAC;AAEP;;;CAGC,GACD,MAAMC,yBAAyB,OAC7BpB,MACAC;IAEA,IAAI,CAACD,KAAKE,MAAM,CAACT,0BAA0B;QACzC,QAAQ,mDAAmD;IAC7D;IAEA,IACE,MAAMN,YACJa,MACAP,yBACAwB,IAAI,oCAEN;QACA,QAAQ,oBAAoB;IAC9B;IAEA,MAAMI,8BAA8BJ,IAClC;QACE;QACA;QACA;QACA;QACA;KACD,CAACE,IAAI,CAAC;IAET,MAAMG,eAAeL,IAAI;IACzB,MAAMM,sBAAsBN,IAAI;IAChC,MAAMO,gBAAgBP,IAAI;IAC1B,MAAMQ,mBAAmBR,IAAI;IAC7B,MAAMS,mBAAmBT,IAAI;IAC7B,MAAMU,oBAAoBV,IAAI;IAC9B,MAAMW,0BAA0BX,IAC9B;IAGF,MAAMT,UAAU;QACda;QACAC;QACAC;QACAC;QACAC;QACAC;QACAC;QACAC;KACD;IAED,MAAMnB,aAAa,AACjB,CAAA,MAAMC,QAAQC,GAAG,CACfH,QAAQI,GAAG,CAAC,CAACC,UACX1B,YAAYa,MAAMP,yBAAyBoB,UAE/C,EACAC,KAAK,CAACC;IAER,IAAI,CAACN,YAAY;QACfR,UAAUe,IAAI,CAACpB;QACf;IACF;IAEA,0EAA0E;IAC1E,uEAAuE;IACvE,MAAMZ,YACJgB,MACAP,yBACA,GAAG4B,4BAA4B,MAAM,EAAEH,6BAA6BW,OAAO,CAAC,MAAM,OAAO,EAAE,CAAC;IAG9F,0DAA0D;IAC1D,MAAM3C,gBACJc,MACAP,yBACAwB,IACE,CAAC,iDAAiD,EAAEhC,wBAAwB,KAAK,CAAC,GAEpF;QACE;QACA;QACA;QACA;QACA;QACA;KACD,CAACkC,IAAI,CAAC;IAGT,yEAAyE;IACzE,MAAMjC,gBACJc,MACAP,yBACA,GAAG8B,oBAAoB,yCAAyC,EAAEtC,wBAAwB,EAAE,CAAC,EAC7F;IAGF,6DAA6D;IAC7D,MAAMD,YACJgB,MACAP,yBACAwB,IAAI,CAAC;;;;GAIN,CAAC;IAGF,yEAAyE;IACzE,MAAMjC,YACJgB,MACAP,yBACA,GAAGgC,iBAAiB,6CAA6C,CAAC;IAGpE,4EAA4E;IAC5E,uEAAuE;IACvE,qEAAqE;IACrE,gEAAgE;IAChE,MAAMvC,gBACJc,MACAP,yBACAwB,IACE,CAAC,oGAAoG,EAAEhC,wBAAwB,cAAc,CAAC,GAEhJ;IAGF,yEAAyE;IACzE,MAAMD,YACJgB,MACAP,yBACA,GAAGiC,iBAAiB,6CAA6C,CAAC;IAEpE,MAAM1C,YACJgB,MACAP,yBACA,GAAGkC,kBAAkB,uCAAuC,CAAC;IAE/D,MAAM3C,YACJgB,MACAP,yBACA,GAAGmC,wBAAwB,2IAA2I,CAAC;AAE3K;AAEA,MAAME,gCAAgC;IACpC;IACA;IACA;IACA;IACA;IACA;IACA;IACA;IACA;IACA;IACA;IACA;IACA;IACA;IACA;IACA;IACA;IACA;IACA;IACA;IACA;IACA;IACA;IACA;IACA;IACA;IACA;IACA;CACD,CAACX,IAAI,CAAC;AAEP;;;;CAIC,GACD,MAAMY,6BAA6B,OACjC/B,MACAC;IAEA,IAAI,CAACD,KAAKE,MAAM,CAACR,6BAA6B;QAC5C;IACF;IAEA,KAAK,MAAMsC,WAAWhC,KAAKiC,QAAQ,CAACvC,4BAA6B;QAC/D,MAAMI,WAAWhB,kBACfY,4BACAsC,SACA,GAAGA,QAAQ,GAAG,CAAC;QAEjB,IAAI,CAAChC,KAAKE,MAAM,CAACJ,WAAW;YAC1B,UAAU,uCAAuC;QACnD;QAEA,IACE,MAAMX,YAAYa,MAAMF,UAAUmB,IAAI,oCACtC;YACA,UAAU,oBAAoB;QAChC;QAEA,MAAMI,8BAA8BJ,IAClC;YACE;YACA;YACA;YACA;YACA;SACD,CAACE,IAAI,CAAC;QAET,MAAMe,eAAejB,IAAI;QACzB,MAAMkB,2BAA2BlB,IAC/B;QAGF,MAAMmB,QAAQ,AACZ,CAAA,MAAM1B,QAAQC,GAAG,CACf;YACEU;YACAa;YACAC;SACD,CAACvB,GAAG,CAAC,CAACC,UAAY1B,YAAYa,MAAMF,UAAUe,UACjD,EACAC,KAAK,CAACC;QAER,IAAI,CAACqB,OAAO;YACVnC,UAAUe,IAAI,CAACnB,4BAA4BC;YAC3C;QACF;QAEA,MAAMd,YACJgB,MACAF,UACA,GAAGuB,4BAA4B,MAAM,EAAES,8BAA8BD,OAAO,CAAC,MAAM,OAAO,EAAE,CAAC;QAG/F,MAAM3C,gBACJc,MACAF,UACAmB,IACE,CAAC,wIAAwI,EAAEhC,wBAAwB,EAAE,CAAC,GAExK;YACE;YACA;YACA;SACD,CAACkC,IAAI,CAAC;IAEX;AACF;AAEA,eAAe,eAAekB,UAC5BrC,IAAU;IAEV,MAAMC,YAAsB,EAAE;IAE9B,MAAMF,oBAAoBC,MAAMC;IAChC,MAAMmB,uBAAuBpB,MAAMC;IACnC,MAAM8B,2BAA2B/B,MAAMC;IAEvC,MAAMb,qBAAqBY;IAE3B,OAAO;QAAEC;IAAU;AACrB"}

package/src/migrations/latest/dynamodb-terraform-app-module-outputs/migration.js.map DELETED Viewed

@@ -1 +0,0 @@

- {"version":3,"sources":["../../../../../../../packages/nx-plugin/src/migrations/latest/dynamodb-terraform-app-module-outputs/migration.ts"],"sourcesContent":["/**\n * Copyright Amazon.com, Inc. or its affiliates. All Rights Reserved.\n * SPDX-License-Identifier: Apache-2.0\n */\nimport {\n joinPathFragments,\n type MigrationReturnObject,\n type Tree,\n} from '@nx/devkit';\nimport {\n GRIT_INSERT_PLACEHOLDER,\n insertViaGritQL,\n matchGritQL,\n} from '../../../utils/ast.js';\nimport { formatFilesInSubtree } from '../../../utils/format.js';\nimport {\n PACKAGES_DIR,\n SHARED_TERRAFORM_DIR,\n} from '../../../utils/shared-constructs-constants.js';\n\n/**\n * Re-export the core dynamodb module's `table_name`, `table_arn` and\n * `kms_key_arn` from each vended per-table Terraform app module\n * (`app/dynamodb/<name>/<name>.tf`).\n *\n * The app module is what a root configuration instantiates, so without these\n * outputs a root module cannot reference the table or its encryption key at\n * all — for example to grant a consumer access to it.\n *\n * These files are generated with `KeepExisting`, so an upgraded workspace keeps\n * a module with no outputs until this runs. Diverged files are left untouched\n * and reported via `nextSteps`.\n */\n\nconst TERRAFORM_DYNAMODB_APP_DIR = `${PACKAGES_DIR}/${SHARED_TERRAFORM_DIR}/src/app/dynamodb`;\n\nconst divergedMessage = (filePath: string) =>\n `${filePath}: has diverged from the generated shape - left untouched. To reference the table from your root Terraform configuration, add table_name, table_arn and kms_key_arn outputs here forwarding the equivalent module.dynamodb_table attributes (see the ts#dynamodb generator's dynamodb app template).`;\n\nconst hcl = (pattern: string) => `language hcl\\n${pattern}`;\n\nconst OUTPUTS_TEXT = [\n 'output \"table_name\" {',\n ' description = \"Name of the DynamoDB table\"',\n ' value = module.dynamodb_table.table_name',\n '}',\n '',\n 'output \"table_arn\" {',\n ' description = \"ARN of the DynamoDB table, for use in IAM policies granting access to the table. Suffix with /index/* to cover its global secondary indexes.\"',\n ' value = module.dynamodb_table.table_arn',\n '}',\n '',\n 'output \"kms_key_arn\" {',\n ' description = \"ARN of the KMS key used to encrypt the DynamoDB table, for use in IAM policies granting access to the table. Null when using the AWS owned key (encryption = DEFAULT).\"',\n ' value = module.dynamodb_table.kms_key_arn',\n '}',\n].join('\\n');\n\nexport default async function migration(\n tree: Tree,\n): Promise<MigrationReturnObject> {\n const nextSteps: string[] = [];\n\n if (!tree.exists(TERRAFORM_DYNAMODB_APP_DIR)) {\n return { nextSteps }; // This workspace has no Terraform dynamodb modules.\n }\n\n for (const dirName of tree.children(TERRAFORM_DYNAMODB_APP_DIR)) {\n const filePath = joinPathFragments(\n TERRAFORM_DYNAMODB_APP_DIR,\n dirName,\n `${dirName}.tf`,\n );\n if (!tree.exists(filePath)) {\n continue; // Not a dynamodb app module directory.\n }\n\n if (await matchGritQL(tree, filePath, hcl('`output \"table_arn\" { $_ }`'))) {\n continue; // Already migrated.\n }\n\n const RUNTIME_CONFIG_MODULE_BLOCK = hcl(\n '`module \"add_to_runtime_config\" { $_ }`',\n );\n if (!(await matchGritQL(tree, filePath, RUNTIME_CONFIG_MODULE_BLOCK))) {\n nextSteps.push(divergedMessage(filePath));\n continue;\n }\n\n // Appended after the runtime config module call, which the template ends\n // with, matching where the generator now writes the outputs.\n await insertViaGritQL(\n tree,\n filePath,\n hcl(\n `\\`module \"add_to_runtime_config\" { $body }\\` => \\`module \"add_to_runtime_config\" {\\n $body\\n}\\n\\n${GRIT_INSERT_PLACEHOLDER}\\``,\n ),\n OUTPUTS_TEXT,\n );\n }\n\n await formatFilesInSubtree(tree);\n\n return { nextSteps };\n}\n"],"names":["joinPathFragments","GRIT_INSERT_PLACEHOLDER","insertViaGritQL","matchGritQL","formatFilesInSubtree","PACKAGES_DIR","SHARED_TERRAFORM_DIR","TERRAFORM_DYNAMODB_APP_DIR","divergedMessage","filePath","hcl","pattern","OUTPUTS_TEXT","join","migration","tree","nextSteps","exists","dirName","children","RUNTIME_CONFIG_MODULE_BLOCK","push"],"mappings":"AAAA;;;CAGC,GACD,SACEA,iBAAiB,QAGZ,aAAa;AACpB,SACEC,uBAAuB,EACvBC,eAAe,EACfC,WAAW,QACN,wBAAwB;AAC/B,SAASC,oBAAoB,QAAQ,2BAA2B;AAChE,SACEC,YAAY,EACZC,oBAAoB,QACf,gDAAgD;AAEvD;;;;;;;;;;;;CAYC,GAED,MAAMC,6BAA6B,GAAGF,aAAa,CAAC,EAAEC,qBAAqB,iBAAiB,CAAC;AAE7F,MAAME,kBAAkB,CAACC,WACvB,GAAGA,SAAS,mSAAmS,CAAC;AAElT,MAAMC,MAAM,CAACC,UAAoB,CAAC,cAAc,EAAEA,SAAS;AAE3D,MAAMC,eAAe;IACnB;IACA;IACA;IACA;IACA;IACA;IACA;IACA;IACA;IACA;IACA;IACA;IACA;IACA;CACD,CAACC,IAAI,CAAC;AAEP,eAAe,eAAeC,UAC5BC,IAAU;IAEV,MAAMC,YAAsB,EAAE;IAE9B,IAAI,CAACD,KAAKE,MAAM,CAACV,6BAA6B;QAC5C,OAAO;YAAES;QAAU,GAAG,oDAAoD;IAC5E;IAEA,KAAK,MAAME,WAAWH,KAAKI,QAAQ,CAACZ,4BAA6B;QAC/D,MAAME,WAAWT,kBACfO,4BACAW,SACA,GAAGA,QAAQ,GAAG,CAAC;QAEjB,IAAI,CAACH,KAAKE,MAAM,CAACR,WAAW;YAC1B,UAAU,uCAAuC;QACnD;QAEA,IAAI,MAAMN,YAAYY,MAAMN,UAAUC,IAAI,iCAAiC;YACzE,UAAU,oBAAoB;QAChC;QAEA,MAAMU,8BAA8BV,IAClC;QAEF,IAAI,CAAE,MAAMP,YAAYY,MAAMN,UAAUW,8BAA+B;YACrEJ,UAAUK,IAAI,CAACb,gBAAgBC;YAC/B;QACF;QAEA,yEAAyE;QACzE,6DAA6D;QAC7D,MAAMP,gBACJa,MACAN,UACAC,IACE,CAAC,kGAAkG,EAAET,wBAAwB,EAAE,CAAC,GAElIW;IAEJ;IAEA,MAAMR,qBAAqBW;IAE3B,OAAO;QAAEC;IAAU;AACrB"}

package/src/migrations/latest/py-agent-ag-ui-hooks/migration.js.map DELETED Viewed

@@ -1 +0,0 @@

- {"version":3,"sources":["../../../../../../../packages/nx-plugin/src/migrations/latest/py-agent-ag-ui-hooks/migration.ts"],"sourcesContent":["/**\n * Copyright Amazon.com, Inc. or its affiliates. All Rights Reserved.\n * SPDX-License-Identifier: Apache-2.0\n */\nimport {\n getProjects,\n joinPathFragments,\n type MigrationReturnObject,\n type Tree,\n} from '@nx/devkit';\nimport { PY_AGENT_GENERATOR_INFO } from '../../../py/agent/generator.js';\nimport {\n addPythonDestructuredImport,\n applyGritQL,\n captureGritQLVariable,\n GRIT_INSERT_PLACEHOLDER,\n insertViaGritQL,\n matchGritQL,\n} from '../../../utils/ast.js';\nimport { formatFilesInSubtree } from '../../../utils/format.js';\nimport type { ComponentMetadata } from '../../../utils/nx.js';\n\n/**\n * Forward a Strands py#agent's hooks to the AG-UI adapter.\n *\n * `StrandsAgent` builds a fresh `Agent` per `thread_id` by copying the template\n * Agent's kwargs, but deliberately skips `hooks` - Strands keeps only the built\n * `HookRegistry`, so the providers can't be read back off it. An AG-UI agent's\n * `log_model_errors` / `log_tool_errors` therefore never fired for served\n * requests, and model/tool failures were reported as successful runs.\n *\n * The fix hoists the hooks list out of the `Agent(...)` call into an\n * `AGENT_HOOKS` module constant in `agent.py` - whatever the user has put in it,\n * so custom hooks come along - and passes that to `StrandsAgent(...)` in\n * `main.py` as well. `agent.py` is hoisted for every protocol so the constant\n * matches what the generator vends today; only AG-UI needs the `main.py` half.\n */\n\n// `Agent`'s `hooks` list is invariant, so the hoisted constant has to declare\n// the parameter's own type - an inline literal was inferred from it instead.\nconst HOOKS_TYPE = 'list[HookProvider | HookCallback]';\nconst HOOKS_MODULE = 'strands.hooks';\n\n// Anchored on the `get_agent` context manager - the one shape shared by every\n// generated protocol and connection combination - so the constant lands\n// directly above its only use, where the generator vends it.\nconst HOIST_HOOKS_PATTERN = `language python\n\\`@contextmanager\ndef get_agent($params):\n $body\\` => raw\\`AGENT_HOOKS: ${HOOKS_TYPE} = ${GRIT_INSERT_PLACEHOLDER}\n\n\n@contextmanager\ndef get_agent($params):\n $body\\` where { $program <: not contains \\`AGENT_HOOKS\\` }`;\n\n// Scoped to the Agent constructor so a hooks list the user passes elsewhere in\n// agent.py is left alone.\nconst HOOKS_LIST_CAPTURE_PATTERN =\n 'language python\\n`hooks=[$hooks]` where { $hooks <: within `Agent($_)` }';\nconst HOOKS_LIST_REWRITE_PATTERN =\n 'language python\\n`hooks=[$_]` as $kwarg where { $kwarg <: within `Agent($_)`, $kwarg => `hooks=AGENT_HOOKS` }';\n\nconst AGUI_CONSTRUCTOR_MATCH_PATTERN =\n 'language python\\n`StrandsAgent($args)` where { $args <: contains `agent=$_` }';\nconst AGUI_HOOKS_WIRED_PATTERN =\n 'language python\\n`StrandsAgent($args)` where { $args <: contains `agent=$_`, $args <: contains `hooks=$_` }';\n// Appends after the last argument rather than re-emitting the argument list,\n// both to land `hooks=` where the template puts it and to leave the other\n// arguments' formatting and comments untouched.\nconst AGUI_HOOKS_APPEND_PATTERN =\n 'language python\\n`StrandsAgent($args)` where { $args <: contains `agent=$_`, $args <: not contains `hooks=$_`, $args <: [$..., $last], $last += `, hooks=AGENT_HOOKS` }';\n\nconst findAgentComponents = (\n components: ComponentMetadata[] | undefined,\n): ComponentMetadata[] =>\n (components ?? []).filter(\n (component) => component.generator === PY_AGENT_GENERATOR_INFO.id,\n );\n\n/**\n * Hoists `agent.py`'s `hooks=[...]` list into an `AGENT_HOOKS` module constant,\n * returning whether the file ends up exporting one.\n */\nconst hoistAgentHooks = async (\n tree: Tree,\n agentPath: string,\n): Promise<boolean> => {\n if ((tree.read(agentPath, 'utf-8') ?? '').includes('AGENT_HOOKS')) {\n return true;\n }\n\n // Nothing to hoist unless the Agent is constructed with an inline hooks list.\n const hooks = await captureGritQLVariable(\n tree,\n agentPath,\n HOOKS_LIST_CAPTURE_PATTERN,\n 'hooks',\n );\n if (!hooks) return false;\n\n if (\n !(await insertViaGritQL(tree, agentPath, HOIST_HOOKS_PATTERN, `[${hooks}]`))\n ) {\n return false;\n }\n await applyGritQL(tree, agentPath, HOOKS_LIST_REWRITE_PATTERN);\n await addPythonDestructuredImport(\n tree,\n agentPath,\n ['HookCallback', 'HookProvider'],\n HOOKS_MODULE,\n );\n return true;\n};\n\nconst migrateAgent = async (\n tree: Tree,\n agentDir: string,\n component: ComponentMetadata,\n nextSteps: string[],\n): Promise<void> => {\n // LangChain agents pass no hooks - their AG-UI adapter is handed the graph\n // itself rather than rebuilding one, so nothing is dropped.\n if (component.framework === 'langchain') return;\n\n const agentPath = joinPathFragments(agentDir, 'agent.py');\n const mainPath = joinPathFragments(agentDir, 'main.py');\n const isAgUi = component.protocol === 'ag-ui';\n\n if (!tree.exists(agentPath)) return;\n\n if (!(await hoistAgentHooks(tree, agentPath))) {\n if (isAgUi) {\n nextSteps.push(\n `${agentPath}: the hooks passed to \\`Agent(...)\\` have diverged from the generated shape - left untouched. Hoist them into an \\`AGENT_HOOKS\\` module constant and pass it to \\`StrandsAgent(...)\\` in ${mainPath} too, or AG-UI will not register them (see the py#agent generator's template).`,\n );\n }\n return;\n }\n\n // Only AG-UI rebuilds the Agent, so only its main.py needs the hooks.\n if (!isAgUi || !tree.exists(mainPath)) return;\n\n // Already passing hooks, whether from a previous run or the user's own wiring.\n if (await matchGritQL(tree, mainPath, AGUI_HOOKS_WIRED_PATTERN)) return;\n\n if (!(await matchGritQL(tree, mainPath, AGUI_CONSTRUCTOR_MATCH_PATTERN))) {\n nextSteps.push(\n `${mainPath}: the \\`StrandsAgent(...)\\` constructor has diverged from the generated shape - left untouched. Pass \\`hooks=AGENT_HOOKS\\` to it, importing \\`AGENT_HOOKS\\` from \\`.agent\\`, or AG-UI will not register the agent's hooks (see the py#agent generator's template).`,\n );\n return;\n }\n\n await applyGritQL(tree, mainPath, AGUI_HOOKS_APPEND_PATTERN);\n await addPythonDestructuredImport(tree, mainPath, ['AGENT_HOOKS'], '.agent');\n};\n\nexport default async function migration(\n tree: Tree,\n): Promise<MigrationReturnObject> {\n const nextSteps: string[] = [];\n\n for (const project of getProjects(tree).values()) {\n const components = findAgentComponents(\n (project.metadata as { components?: ComponentMetadata[] })?.components,\n );\n\n for (const component of components) {\n if (!component.path) continue;\n\n // Legacy component paths point at agent.py rather than its directory.\n const componentDir = component.path.endsWith('/agent.py')\n ? component.path.slice(0, -'/agent.py'.length)\n : component.path;\n\n await migrateAgent(\n tree,\n joinPathFragments(project.root, componentDir),\n component,\n nextSteps,\n );\n }\n }\n\n await formatFilesInSubtree(tree);\n\n return { nextSteps };\n}\n"],"names":["getProjects","joinPathFragments","PY_AGENT_GENERATOR_INFO","addPythonDestructuredImport","applyGritQL","captureGritQLVariable","GRIT_INSERT_PLACEHOLDER","insertViaGritQL","matchGritQL","formatFilesInSubtree","HOOKS_TYPE","HOOKS_MODULE","HOIST_HOOKS_PATTERN","HOOKS_LIST_CAPTURE_PATTERN","HOOKS_LIST_REWRITE_PATTERN","AGUI_CONSTRUCTOR_MATCH_PATTERN","AGUI_HOOKS_WIRED_PATTERN","AGUI_HOOKS_APPEND_PATTERN","findAgentComponents","components","filter","component","generator","id","hoistAgentHooks","tree","agentPath","read","includes","hooks","migrateAgent","agentDir","nextSteps","framework","mainPath","isAgUi","protocol","exists","push","migration","project","values","metadata","path","componentDir","endsWith","slice","length","root"],"mappings":"AAAA;;;CAGC,GACD,SACEA,WAAW,EACXC,iBAAiB,QAGZ,aAAa;AACpB,SAASC,uBAAuB,QAAQ,iCAAiC;AACzE,SACEC,2BAA2B,EAC3BC,WAAW,EACXC,qBAAqB,EACrBC,uBAAuB,EACvBC,eAAe,EACfC,WAAW,QACN,wBAAwB;AAC/B,SAASC,oBAAoB,QAAQ,2BAA2B;AAGhE;;;;;;;;;;;;;;CAcC,GAED,8EAA8E;AAC9E,6EAA6E;AAC7E,MAAMC,aAAa;AACnB,MAAMC,eAAe;AAErB,8EAA8E;AAC9E,wEAAwE;AACxE,6DAA6D;AAC7D,MAAMC,sBAAsB,CAAC;;;iCAGI,EAAEF,WAAW,GAAG,EAAEJ,wBAAwB;;;;;8DAKb,CAAC;AAE/D,+EAA+E;AAC/E,0BAA0B;AAC1B,MAAMO,6BACJ;AACF,MAAMC,6BACJ;AAEF,MAAMC,iCACJ;AACF,MAAMC,2BACJ;AACF,6EAA6E;AAC7E,0EAA0E;AAC1E,gDAAgD;AAChD,MAAMC,4BACJ;AAEF,MAAMC,sBAAsB,CAC1BC,aAEA,AAACA,CAAAA,cAAc,EAAE,AAAD,EAAGC,MAAM,CACvB,CAACC,YAAcA,UAAUC,SAAS,KAAKpB,wBAAwBqB,EAAE;AAGrE;;;CAGC,GACD,MAAMC,kBAAkB,OACtBC,MACAC;IAEA,IAAI,AAACD,CAAAA,KAAKE,IAAI,CAACD,WAAW,YAAY,EAAC,EAAGE,QAAQ,CAAC,gBAAgB;QACjE,OAAO;IACT;IAEA,8EAA8E;IAC9E,MAAMC,QAAQ,MAAMxB,sBAClBoB,MACAC,WACAb,4BACA;IAEF,IAAI,CAACgB,OAAO,OAAO;IAEnB,IACE,CAAE,MAAMtB,gBAAgBkB,MAAMC,WAAWd,qBAAqB,CAAC,CAAC,EAAEiB,MAAM,CAAC,CAAC,GAC1E;QACA,OAAO;IACT;IACA,MAAMzB,YAAYqB,MAAMC,WAAWZ;IACnC,MAAMX,4BACJsB,MACAC,WACA;QAAC;QAAgB;KAAe,EAChCf;IAEF,OAAO;AACT;AAEA,MAAMmB,eAAe,OACnBL,MACAM,UACAV,WACAW;IAEA,2EAA2E;IAC3E,4DAA4D;IAC5D,IAAIX,UAAUY,SAAS,KAAK,aAAa;IAEzC,MAAMP,YAAYzB,kBAAkB8B,UAAU;IAC9C,MAAMG,WAAWjC,kBAAkB8B,UAAU;IAC7C,MAAMI,SAASd,UAAUe,QAAQ,KAAK;IAEtC,IAAI,CAACX,KAAKY,MAAM,CAACX,YAAY;IAE7B,IAAI,CAAE,MAAMF,gBAAgBC,MAAMC,YAAa;QAC7C,IAAIS,QAAQ;YACVH,UAAUM,IAAI,CACZ,GAAGZ,UAAU,yLAAyL,EAAEQ,SAAS,8EAA8E,CAAC;QAEpS;QACA;IACF;IAEA,sEAAsE;IACtE,IAAI,CAACC,UAAU,CAACV,KAAKY,MAAM,CAACH,WAAW;IAEvC,+EAA+E;IAC/E,IAAI,MAAM1B,YAAYiB,MAAMS,UAAUlB,2BAA2B;IAEjE,IAAI,CAAE,MAAMR,YAAYiB,MAAMS,UAAUnB,iCAAkC;QACxEiB,UAAUM,IAAI,CACZ,GAAGJ,SAAS,kQAAkQ,CAAC;QAEjR;IACF;IAEA,MAAM9B,YAAYqB,MAAMS,UAAUjB;IAClC,MAAMd,4BAA4BsB,MAAMS,UAAU;QAAC;KAAc,EAAE;AACrE;AAEA,eAAe,eAAeK,UAC5Bd,IAAU;IAEV,MAAMO,YAAsB,EAAE;IAE9B,KAAK,MAAMQ,WAAWxC,YAAYyB,MAAMgB,MAAM,GAAI;QAChD,MAAMtB,aAAaD,oBAChBsB,QAAQE,QAAQ,EAA2CvB;QAG9D,KAAK,MAAME,aAAaF,WAAY;YAClC,IAAI,CAACE,UAAUsB,IAAI,EAAE;YAErB,sEAAsE;YACtE,MAAMC,eAAevB,UAAUsB,IAAI,CAACE,QAAQ,CAAC,eACzCxB,UAAUsB,IAAI,CAACG,KAAK,CAAC,GAAG,CAAC,YAAYC,MAAM,IAC3C1B,UAAUsB,IAAI;YAElB,MAAMb,aACJL,MACAxB,kBAAkBuC,QAAQQ,IAAI,EAAEJ,eAChCvB,WACAW;QAEJ;IACF;IAEA,MAAMvB,qBAAqBgB;IAE3B,OAAO;QAAEO;IAAU;AACrB"}

package/src/migrations/latest/rdb-terraform-aurora-app-module-defaults/migration.js.map DELETED Viewed

@@ -1 +0,0 @@

- {"version":3,"sources":["../../../../../../../packages/nx-plugin/src/migrations/latest/rdb-terraform-aurora-app-module-defaults/migration.ts"],"sourcesContent":["/**\n * Copyright Amazon.com, Inc. or its affiliates. All Rights Reserved.\n * SPDX-License-Identifier: Apache-2.0\n */\nimport {\n joinPathFragments,\n type MigrationReturnObject,\n type Tree,\n} from '@nx/devkit';\nimport {\n applyGritQL,\n GRIT_INSERT_PLACEHOLDER,\n insertViaGritQL,\n matchGritQL,\n} from '../../../utils/ast.js';\nimport { formatFilesInSubtree } from '../../../utils/format.js';\nimport {\n PACKAGES_DIR,\n SHARED_TERRAFORM_DIR,\n} from '../../../utils/shared-constructs-constants.js';\n\n/**\n * Align each vended per-database Terraform app module\n * (`app/dbs/<name>/<name>.tf`) with the core Aurora module it wraps.\n *\n * The app module is what a root configuration instantiates and it forwards its\n * own value down, so its default is the one that takes effect:\n *\n * - `enable_cloudwatch_logs` defaulted to `false` against the core module's\n * `true`, so Aurora exported no engine logs and the cluster parameter group\n * that configures them (`log_statement=ddl` on PostgreSQL,\n * `server_audit_events=CONNECT,QUERY_DDL` on MySQL) was never created —\n * the CDK construct enabled both.\n * - `enable_key_rotation` was never declared, leaving the core module's\n * variable unreachable from a root configuration.\n *\n * These files are generated with `KeepExisting`, so an upgraded workspace keeps\n * the diverged defaults until this runs. Diverged files are left untouched and\n * reported via `nextSteps`.\n */\n\nconst TERRAFORM_DBS_APP_DIR = `${PACKAGES_DIR}/${SHARED_TERRAFORM_DIR}/src/app/dbs`;\n\nconst hcl = (pattern: string) => `language hcl\\n${pattern}`;\n\nconst KEY_ROTATION_VARIABLE = [\n 'variable \"enable_key_rotation\" {',\n ' description = \"Whether to enable automatic key rotation on the KMS key used to encrypt the Aurora cluster and its credentials secret.\"',\n ' type = bool',\n ' default = true',\n '}',\n].join('\\n');\n\nconst divergedMessage = (filePath: string) =>\n `${filePath}: has diverged from the generated shape - left untouched. To export Aurora engine logs to CloudWatch as the CDK construct and the core Terraform module do, default \\`enable_cloudwatch_logs\\` to true here, and declare an \\`enable_key_rotation\\` variable (bool, default true) forwarded to the aurora module (see the ts#rdb generator's dbs app template).`;\n\nconst OLD_LOGS_DESCRIPTION =\n 'Whether to export Aurora engine logs to CloudWatch. PostgreSQL also enables verbose statement logging.';\nconst NEW_LOGS_DESCRIPTION =\n 'Whether to export Aurora engine logs to CloudWatch. PostgreSQL logs DDL statements only (log_statement=ddl); MySQL enables Advanced Auditing scoped to connections and DDL (server_audit_events=CONNECT,QUERY_DDL). Neither logs statement parameter values, to avoid leaking PII into log data.';\n\n/**\n * Flip the app module's `enable_cloudwatch_logs` default to match the core\n * module, and replace the description that documented the old behaviour.\n *\n * Keyed on that description, which is the only thing distinguishing the vended\n * `default = false` from a user who deliberately turned log export off.\n */\nconst migrateCloudwatchLogsDefault = (tree: Tree, filePath: string) =>\n applyGritQL(\n tree,\n filePath,\n hcl(\n `\\`variable \"enable_cloudwatch_logs\" { $props }\\` where {` +\n ` $props <: contains \\`description = \"${OLD_LOGS_DESCRIPTION}\"\\` => \\`description = \"${NEW_LOGS_DESCRIPTION}\"\\`,` +\n ` $props <: contains \\`default = false\\` => \\`default = true\\`` +\n ` }`,\n ),\n );\n\n/**\n * Declare `enable_key_rotation` and forward it to the core aurora module, so a\n * root configuration can reach the variable the core module already exposes.\n */\nconst migrateKeyRotationVariable = async (\n tree: Tree,\n filePath: string,\n): Promise<void> => {\n if (\n await matchGritQL(\n tree,\n filePath,\n hcl('`variable \"enable_key_rotation\" { $_ }`'),\n )\n ) {\n return; // Already declared.\n }\n\n const declared = await insertViaGritQL(\n tree,\n filePath,\n hcl(\n `\\`variable \"enable_backup\" { $props }\\` => \\`variable \"enable_backup\" {\\n $props\\n}\\n\\n${GRIT_INSERT_PLACEHOLDER}\\``,\n ),\n KEY_ROTATION_VARIABLE,\n );\n if (!declared) return;\n\n // Appended after the existing arguments so their alignment is preserved;\n // `terraform fmt` re-aligns the block.\n await applyGritQL(\n tree,\n filePath,\n hcl(\n `\\`module \"aurora\" { $props }\\` => \\`module \"aurora\" {\\n $props\\n\\n enable_key_rotation = var.enable_key_rotation\\n}\\``,\n ),\n );\n};\n\nexport default async function migration(\n tree: Tree,\n): Promise<MigrationReturnObject> {\n const nextSteps: string[] = [];\n\n if (!tree.exists(TERRAFORM_DBS_APP_DIR)) {\n return { nextSteps }; // This workspace has no Terraform database modules.\n }\n\n for (const dirName of tree.children(TERRAFORM_DBS_APP_DIR)) {\n const filePath = joinPathFragments(\n TERRAFORM_DBS_APP_DIR,\n dirName,\n `${dirName}.tf`,\n );\n if (!tree.exists(filePath)) {\n continue; // Not a database app module directory.\n }\n\n // Both edits hang off the shape the generator produces: the two variables\n // and the module call that forwards them.\n const recognised =\n (await matchGritQL(\n tree,\n filePath,\n hcl('`variable \"enable_cloudwatch_logs\" { $_ }`'),\n )) &&\n (await matchGritQL(\n tree,\n filePath,\n hcl('`variable \"enable_backup\" { $_ }`'),\n )) &&\n (await matchGritQL(\n tree,\n filePath,\n hcl(\n '`module \"aurora\" { $props }` where { $props <: contains `enable_cloudwatch_logs = var.enable_cloudwatch_logs` }',\n ),\n ));\n\n if (!recognised) {\n nextSteps.push(divergedMessage(filePath));\n continue;\n }\n\n await migrateCloudwatchLogsDefault(tree, filePath);\n await migrateKeyRotationVariable(tree, filePath);\n }\n\n await formatFilesInSubtree(tree);\n\n return { nextSteps };\n}\n"],"names":["joinPathFragments","applyGritQL","GRIT_INSERT_PLACEHOLDER","insertViaGritQL","matchGritQL","formatFilesInSubtree","PACKAGES_DIR","SHARED_TERRAFORM_DIR","TERRAFORM_DBS_APP_DIR","hcl","pattern","KEY_ROTATION_VARIABLE","join","divergedMessage","filePath","OLD_LOGS_DESCRIPTION","NEW_LOGS_DESCRIPTION","migrateCloudwatchLogsDefault","tree","migrateKeyRotationVariable","declared","migration","nextSteps","exists","dirName","children","recognised","push"],"mappings":"AAAA;;;CAGC,GACD,SACEA,iBAAiB,QAGZ,aAAa;AACpB,SACEC,WAAW,EACXC,uBAAuB,EACvBC,eAAe,EACfC,WAAW,QACN,wBAAwB;AAC/B,SAASC,oBAAoB,QAAQ,2BAA2B;AAChE,SACEC,YAAY,EACZC,oBAAoB,QACf,gDAAgD;AAEvD;;;;;;;;;;;;;;;;;;CAkBC,GAED,MAAMC,wBAAwB,GAAGF,aAAa,CAAC,EAAEC,qBAAqB,YAAY,CAAC;AAEnF,MAAME,MAAM,CAACC,UAAoB,CAAC,cAAc,EAAEA,SAAS;AAE3D,MAAMC,wBAAwB;IAC5B;IACA;IACA;IACA;IACA;CACD,CAACC,IAAI,CAAC;AAEP,MAAMC,kBAAkB,CAACC,WACvB,GAAGA,SAAS,+VAA+V,CAAC;AAE9W,MAAMC,uBACJ;AACF,MAAMC,uBACJ;AAEF;;;;;;CAMC,GACD,MAAMC,+BAA+B,CAACC,MAAYJ,WAChDb,YACEiB,MACAJ,UACAL,IACE,CAAC,wDAAwD,CAAC,GACxD,CAAC,qCAAqC,EAAEM,qBAAqB,wBAAwB,EAAEC,qBAAqB,IAAI,CAAC,GACjH,CAAC,6DAA6D,CAAC,GAC/D,CAAC,EAAE,CAAC;AAIZ;;;CAGC,GACD,MAAMG,6BAA6B,OACjCD,MACAJ;IAEA,IACE,MAAMV,YACJc,MACAJ,UACAL,IAAI,6CAEN;QACA,QAAQ,oBAAoB;IAC9B;IAEA,MAAMW,WAAW,MAAMjB,gBACrBe,MACAJ,UACAL,IACE,CAAC,wFAAwF,EAAEP,wBAAwB,EAAE,CAAC,GAExHS;IAEF,IAAI,CAACS,UAAU;IAEf,yEAAyE;IACzE,uCAAuC;IACvC,MAAMnB,YACJiB,MACAJ,UACAL,IACE,CAAC,uHAAuH,CAAC;AAG/H;AAEA,eAAe,eAAeY,UAC5BH,IAAU;IAEV,MAAMI,YAAsB,EAAE;IAE9B,IAAI,CAACJ,KAAKK,MAAM,CAACf,wBAAwB;QACvC,OAAO;YAAEc;QAAU,GAAG,oDAAoD;IAC5E;IAEA,KAAK,MAAME,WAAWN,KAAKO,QAAQ,CAACjB,uBAAwB;QAC1D,MAAMM,WAAWd,kBACfQ,uBACAgB,SACA,GAAGA,QAAQ,GAAG,CAAC;QAEjB,IAAI,CAACN,KAAKK,MAAM,CAACT,WAAW;YAC1B,UAAU,uCAAuC;QACnD;QAEA,0EAA0E;QAC1E,0CAA0C;QAC1C,MAAMY,aACJ,AAAC,MAAMtB,YACLc,MACAJ,UACAL,IAAI,kDAEL,MAAML,YACLc,MACAJ,UACAL,IAAI,yCAEL,MAAML,YACLc,MACAJ,UACAL,IACE;QAIN,IAAI,CAACiB,YAAY;YACfJ,UAAUK,IAAI,CAACd,gBAAgBC;YAC/B;QACF;QAEA,MAAMG,6BAA6BC,MAAMJ;QACzC,MAAMK,2BAA2BD,MAAMJ;IACzC;IAEA,MAAMT,qBAAqBa;IAE3B,OAAO;QAAEI;IAAU;AACrB"}

package/src/migrations/latest/runtime-config-namespace-defaults/migration.js.map DELETED Viewed

@@ -1 +0,0 @@

- {"version":3,"sources":["../../../../../../../packages/nx-plugin/src/migrations/latest/runtime-config-namespace-defaults/migration.ts"],"sourcesContent":["/**\n * Copyright Amazon.com, Inc. or its affiliates. All Rights Reserved.\n * SPDX-License-Identifier: Apache-2.0\n */\nimport {\n type MigrationReturnObject,\n type Tree,\n visitNotIgnoredFiles,\n} from '@nx/devkit';\nimport { applyGritQL, matchGritQL } from '../../../utils/ast.js';\nimport { formatFilesInSubtree } from '../../../utils/format.js';\nimport {\n PACKAGES_DIR,\n SHARED_TERRAFORM_DIR,\n} from '../../../utils/shared-constructs-constants.js';\n\n/**\n * Provision AppConfig configuration profiles for every namespace the vended terraform modules write to\n *\n * `core/runtime-config/appconfig` creates one configuration profile per entry in\n * its `namespaces` list, and `appconfig-deployment` aggregates and deploys the\n * same list. A module contributing an entry to a namespace outside that list\n * writes its entry file to disk and nothing more — the value never reaches\n * AppConfig, so a consumer reading it back fails at runtime. The vended defaults\n * now cover `dynamodb` and `database` alongside `connection` and `agentcore`.\n *\n * Root modules that pass `namespaces` explicitly are updated too, since an\n * explicit list overrides the vended default.\n *\n * How to write a migration:\n * - https://nx.dev/docs/kb/migration-generators\n * - What `nextSteps` means: https://nx.dev/docs/reference/devkit/MigrationReturnObject\n *\n * Guardrails:\n * - Transform source with GritQL (`applyGritQL`, `matchGritQL`), not regexes or\n * string replacements: it matches the AST, so it holds up against however the\n * user's copy has been formatted. Use `updateJson` for JSON.\n * - Pattern-match before writing: skip files that have diverged from the shape\n * your generators produce and report them via `nextSteps`, or consider a\n * hybrid migration, rather than clobbering the user's changes.\n * - `nextSteps` is for work left for the user to do by hand, not a log of the\n * edits you made: an edit that applied cleanly needs no entry.\n * - Idempotent: re-running must be a no-op.\n * - Format what you write: finish with `formatFilesInSubtree` so the files your\n * migration wrote are formatted correctly.\n */\n\n/** Namespaces the vended modules write to that the old defaults omitted. */\nconst ADDED_NAMESPACES = ['database', 'dynamodb'];\n\nconst RUNTIME_CONFIG_DIR = `${PACKAGES_DIR}/${SHARED_TERRAFORM_DIR}/src/core/runtime-config`;\nconst APPCONFIG_FILE = `${RUNTIME_CONFIG_DIR}/appconfig/appconfig.tf`;\nconst APPCONFIG_DEPLOYMENT_FILE = `${RUNTIME_CONFIG_DIR}/appconfig-deployment/appconfig-deployment.tf`;\n\nconst hcl = (pattern: string) => `language hcl\\n${pattern}`;\n\n/**\n * Where a `namespaces` list lives, as the block that encloses it and the\n * attribute holding the list. `clauses` narrows the block further, keeping an\n * unrelated list elsewhere in the file out of scope; `$body` is the block's body\n * in every case, so the clauses below can all be written against it.\n */\ninterface NamespaceList {\n readonly block: string;\n readonly attribute: string;\n readonly clauses?: string;\n}\n\n/** The `namespaces` variable declaration in a vended appconfig module. */\nconst VENDED_DEFAULT: NamespaceList = {\n block: 'variable \"namespaces\" { $body }',\n attribute: 'default',\n};\n\n/**\n * A call to the vended appconfig module that passes `namespaces` explicitly.\n * `$src` binds the quoted string, so the regex ends at the closing quote — that\n * anchor is what keeps the sibling `appconfig-deployment` call, which takes its\n * namespaces from this module's output, out of scope.\n */\nconst ROOT_MODULE_ARGUMENT: NamespaceList = {\n block: 'module $name { $body }',\n attribute: 'namespaces',\n clauses:\n '$body <: contains `source = $src`, $src <: r\".*runtime-config/appconfig\\\\\"\", $body <: contains `namespaces = $_`',\n};\n\n/** A GritQL pattern matching the enclosing block, plus any extra clauses. */\nconst scopePattern = (list: NamespaceList, extraClauses?: string) => {\n const clauses = [list.clauses, extraClauses].filter(Boolean).join(', ');\n return hcl(`\\`${list.block}\\`${clauses ? ` where { ${clauses} }` : ''}`);\n};\n\n/** Whether a namespace already appears in the list. */\nconst listsNamespace = (\n tree: Tree,\n filePath: string,\n list: NamespaceList,\n namespace: string,\n) =>\n matchGritQL(\n tree,\n filePath,\n scopePattern(list, `$body <: contains \\`\"${namespace}\"\\``),\n );\n\n/**\n * Append a namespace to the list. Appended within the list rather than\n * re-emitting it, so no trailing hole is introduced.\n */\nconst appendNamespace = (\n tree: Tree,\n filePath: string,\n list: NamespaceList,\n namespace: string,\n) =>\n applyGritQL(\n tree,\n filePath,\n scopePattern(\n list,\n `$body <: contains bubble \\`${list.attribute} = [$items]\\` where { $items <: [$..., $last], $last += \\`, \"${namespace}\"\\` }`,\n ),\n );\n\n/**\n * Add every missing namespace to a list, returning false when one could not be\n * added. Already-listed namespaces are skipped, which is what makes a re-run a\n * no-op.\n */\nconst addMissingNamespaces = async (\n tree: Tree,\n filePath: string,\n list: NamespaceList,\n): Promise<boolean> => {\n for (const namespace of ADDED_NAMESPACES) {\n if (await listsNamespace(tree, filePath, list, namespace)) {\n continue;\n }\n if (!(await appendNamespace(tree, filePath, list, namespace))) {\n return false;\n }\n }\n return true;\n};\n\n/** The vended module's own description, updated to document the new defaults. */\nconst DESCRIPTION_REWRITE = scopePattern(\n VENDED_DEFAULT,\n '$body <: contains bubble `description = $desc` where { $desc <: r\".*one Configuration Profile is created per namespace.*\", $desc => `\"List of runtime-config namespaces this AppConfig application should expose (one Configuration Profile is created per namespace). The default covers every namespace the generated modules write to, and a namespace with no contributions deploys an empty profile — when adding namespaces of your own, keep the defaults alongside them.\"` }',\n);\n\nconst missing = ADDED_NAMESPACES.map((n) => `\"${n}\"`).join(' and ');\n\nconst divergedNextStep = (filePath: string) =>\n `${filePath}: the \\`namespaces\\` variable has diverged from the generated shape - left untouched. Add ${missing} to its \\`default\\` list, otherwise no configuration profile is created for them and the entries the vended dynamodb/database modules contribute are never deployed.`;\n\nconst rootModuleNextStep = (filePath: string) =>\n `${filePath}: passes \\`namespaces\\` to the runtime-config appconfig module in a shape this migration could not update - left untouched. Add ${missing} to that list, or drop the argument to take the module's defaults, otherwise the entries the vended dynamodb/database modules contribute are never deployed.`;\n\n/** Bring one vended appconfig module's `namespaces` default up to date. */\nconst migrateVendedModule = async (\n tree: Tree,\n filePath: string,\n nextSteps: string[],\n): Promise<void> => {\n if (!tree.exists(filePath)) {\n return; // This workspace has no Terraform runtime config.\n }\n\n if (!(await addMissingNamespaces(tree, filePath, VENDED_DEFAULT))) {\n nextSteps.push(divergedNextStep(filePath));\n }\n};\n\n/**\n * Root modules that pass `namespaces` explicitly override the vended default, so\n * they need the same additions.\n */\nconst migrateRootModules = async (\n tree: Tree,\n nextSteps: string[],\n): Promise<void> => {\n const terraformFiles: string[] = [];\n visitNotIgnoredFiles(tree, '', (filePath) => {\n if (filePath.endsWith('.tf') && !filePath.startsWith(RUNTIME_CONFIG_DIR)) {\n terraformFiles.push(filePath);\n }\n });\n\n for (const filePath of terraformFiles) {\n if (\n !(await matchGritQL(tree, filePath, scopePattern(ROOT_MODULE_ARGUMENT)))\n ) {\n continue; // Takes the module's defaults, so nothing to update.\n }\n\n if (!(await addMissingNamespaces(tree, filePath, ROOT_MODULE_ARGUMENT))) {\n nextSteps.push(rootModuleNextStep(filePath));\n }\n }\n};\n\nexport default async function migration(\n tree: Tree,\n): Promise<MigrationReturnObject> {\n const nextSteps: string[] = [];\n\n await migrateVendedModule(tree, APPCONFIG_FILE, nextSteps);\n await migrateVendedModule(tree, APPCONFIG_DEPLOYMENT_FILE, nextSteps);\n\n if (tree.exists(APPCONFIG_FILE)) {\n await applyGritQL(tree, APPCONFIG_FILE, DESCRIPTION_REWRITE);\n }\n\n await migrateRootModules(tree, nextSteps);\n\n await formatFilesInSubtree(tree);\n\n return { nextSteps };\n}\n"],"names":["visitNotIgnoredFiles","applyGritQL","matchGritQL","formatFilesInSubtree","PACKAGES_DIR","SHARED_TERRAFORM_DIR","ADDED_NAMESPACES","RUNTIME_CONFIG_DIR","APPCONFIG_FILE","APPCONFIG_DEPLOYMENT_FILE","hcl","pattern","VENDED_DEFAULT","block","attribute","ROOT_MODULE_ARGUMENT","clauses","scopePattern","list","extraClauses","filter","Boolean","join","listsNamespace","tree","filePath","namespace","appendNamespace","addMissingNamespaces","DESCRIPTION_REWRITE","missing","map","n","divergedNextStep","rootModuleNextStep","migrateVendedModule","nextSteps","exists","push","migrateRootModules","terraformFiles","endsWith","startsWith","migration"],"mappings":"AAAA;;;CAGC,GACD,SAGEA,oBAAoB,QACf,aAAa;AACpB,SAASC,WAAW,EAAEC,WAAW,QAAQ,wBAAwB;AACjE,SAASC,oBAAoB,QAAQ,2BAA2B;AAChE,SACEC,YAAY,EACZC,oBAAoB,QACf,gDAAgD;AAEvD;;;;;;;;;;;;;;;;;;;;;;;;;;;;;CA6BC,GAED,0EAA0E,GAC1E,MAAMC,mBAAmB;IAAC;IAAY;CAAW;AAEjD,MAAMC,qBAAqB,GAAGH,aAAa,CAAC,EAAEC,qBAAqB,wBAAwB,CAAC;AAC5F,MAAMG,iBAAiB,GAAGD,mBAAmB,uBAAuB,CAAC;AACrE,MAAME,4BAA4B,GAAGF,mBAAmB,6CAA6C,CAAC;AAEtG,MAAMG,MAAM,CAACC,UAAoB,CAAC,cAAc,EAAEA,SAAS;AAc3D,wEAAwE,GACxE,MAAMC,iBAAgC;IACpCC,OAAO;IACPC,WAAW;AACb;AAEA;;;;;CAKC,GACD,MAAMC,uBAAsC;IAC1CF,OAAO;IACPC,WAAW;IACXE,SACE;AACJ;AAEA,2EAA2E,GAC3E,MAAMC,eAAe,CAACC,MAAqBC;IACzC,MAAMH,UAAU;QAACE,KAAKF,OAAO;QAAEG;KAAa,CAACC,MAAM,CAACC,SAASC,IAAI,CAAC;IAClE,OAAOZ,IAAI,CAAC,EAAE,EAAEQ,KAAKL,KAAK,CAAC,EAAE,EAAEG,UAAU,CAAC,SAAS,EAAEA,QAAQ,EAAE,CAAC,GAAG,IAAI;AACzE;AAEA,qDAAqD,GACrD,MAAMO,iBAAiB,CACrBC,MACAC,UACAP,MACAQ,YAEAxB,YACEsB,MACAC,UACAR,aAAaC,MAAM,CAAC,qBAAqB,EAAEQ,UAAU,GAAG,CAAC;AAG7D;;;CAGC,GACD,MAAMC,kBAAkB,CACtBH,MACAC,UACAP,MACAQ,YAEAzB,YACEuB,MACAC,UACAR,aACEC,MACA,CAAC,2BAA2B,EAAEA,KAAKJ,SAAS,CAAC,6DAA6D,EAAEY,UAAU,KAAK,CAAC;AAIlI;;;;CAIC,GACD,MAAME,uBAAuB,OAC3BJ,MACAC,UACAP;IAEA,KAAK,MAAMQ,aAAapB,iBAAkB;QACxC,IAAI,MAAMiB,eAAeC,MAAMC,UAAUP,MAAMQ,YAAY;YACzD;QACF;QACA,IAAI,CAAE,MAAMC,gBAAgBH,MAAMC,UAAUP,MAAMQ,YAAa;YAC7D,OAAO;QACT;IACF;IACA,OAAO;AACT;AAEA,+EAA+E,GAC/E,MAAMG,sBAAsBZ,aAC1BL,gBACA;AAGF,MAAMkB,UAAUxB,iBAAiByB,GAAG,CAAC,CAACC,IAAM,CAAC,CAAC,EAAEA,EAAE,CAAC,CAAC,EAAEV,IAAI,CAAC;AAE3D,MAAMW,mBAAmB,CAACR,WACxB,GAAGA,SAAS,0FAA0F,EAAEK,QAAQ,oKAAoK,CAAC;AAEvR,MAAMI,qBAAqB,CAACT,WAC1B,GAAGA,SAAS,gIAAgI,EAAEK,QAAQ,4JAA4J,CAAC;AAErT,yEAAyE,GACzE,MAAMK,sBAAsB,OAC1BX,MACAC,UACAW;IAEA,IAAI,CAACZ,KAAKa,MAAM,CAACZ,WAAW;QAC1B,QAAQ,kDAAkD;IAC5D;IAEA,IAAI,CAAE,MAAMG,qBAAqBJ,MAAMC,UAAUb,iBAAkB;QACjEwB,UAAUE,IAAI,CAACL,iBAAiBR;IAClC;AACF;AAEA;;;CAGC,GACD,MAAMc,qBAAqB,OACzBf,MACAY;IAEA,MAAMI,iBAA2B,EAAE;IACnCxC,qBAAqBwB,MAAM,IAAI,CAACC;QAC9B,IAAIA,SAASgB,QAAQ,CAAC,UAAU,CAAChB,SAASiB,UAAU,CAACnC,qBAAqB;YACxEiC,eAAeF,IAAI,CAACb;QACtB;IACF;IAEA,KAAK,MAAMA,YAAYe,eAAgB;QACrC,IACE,CAAE,MAAMtC,YAAYsB,MAAMC,UAAUR,aAAaF,wBACjD;YACA,UAAU,qDAAqD;QACjE;QAEA,IAAI,CAAE,MAAMa,qBAAqBJ,MAAMC,UAAUV,uBAAwB;YACvEqB,UAAUE,IAAI,CAACJ,mBAAmBT;QACpC;IACF;AACF;AAEA,eAAe,eAAekB,UAC5BnB,IAAU;IAEV,MAAMY,YAAsB,EAAE;IAE9B,MAAMD,oBAAoBX,MAAMhB,gBAAgB4B;IAChD,MAAMD,oBAAoBX,MAAMf,2BAA2B2B;IAE3D,IAAIZ,KAAKa,MAAM,CAAC7B,iBAAiB;QAC/B,MAAMP,YAAYuB,MAAMhB,gBAAgBqB;IAC1C;IAEA,MAAMU,mBAAmBf,MAAMY;IAE/B,MAAMjC,qBAAqBqB;IAE3B,OAAO;QAAEY;IAAU;AACrB"}