@aws/nx-plugin 1.0.0-rc.89 → 1.0.0-rc.90

package/src/migrations/latest/dev-target-depends-on-pull-image/migration.js

@@ -0,0 +1,67 @@
+/**
+ * Copyright Amazon.com, Inc. or its affiliates. All Rights Reserved.
+ * SPDX-License-Identifier: Apache-2.0
+ */ import { getProjects, updateProjectConfiguration } from "@nx/devkit";
+import { TS_DYNAMODB_GENERATOR_INFO } from "../../../ts/dynamodb/generator.js";
+import { TS_RDB_GENERATOR_INFO } from "../../../ts/rdb/generator.js";
+import { formatFilesInSubtree } from "../../../utils/format.js";
+import { addDependencyToTargetIfNotPresent } from "../../../utils/nx.js";
+/**
+ * Make the dev target of ts#dynamodb and ts#rdb projects depend on pull-image
+ *
+ * Without it, `nx dev` starts the container (and, for DynamoDB, creates the
+ * local table) while the image is still being fetched, so a first run on a
+ * machine without the image races the pull.
+ */ const GENERATOR_IDS = [
+    TS_DYNAMODB_GENERATOR_INFO.id,
+    TS_RDB_GENERATOR_INFO.id
+];
+const PULL_IMAGE_TARGET = 'pull-image';
+const startsGeneratedContainer = (project)=>{
+    const { command, commands } = project.targets?.dev?.options ?? {};
+    return [
+        ...commands ?? [],
+        ...command ? [
+            command
+        ] : []
+    ].some((c)=>typeof c === 'string' && c.includes('start-container.ts'));
+};
+const divergedNextStep = (projectName)=>`${projectName}: its dev target has been customised, so it was left as it is. Add "${PULL_IMAGE_TARGET}" to the target's dependsOn so the container image is fetched before the container starts.`;
+export default async function migration(tree) {
+    const nextSteps = [];
+    let migrated = false;
+    for (const [name, project] of getProjects(tree)){
+        if (!GENERATOR_IDS.includes(project.metadata?.generator)) {
+            continue;
+        }
+        const dev = project.targets?.dev;
+        if (!dev || !project.targets?.[PULL_IMAGE_TARGET]) {
+            continue;
+        }
+        // Nx requires an array here. Anything else is hand-written and is reported
+        // rather than rewritten, so a malformed value is never spread or clobbered.
+        if (dev.dependsOn !== undefined && !Array.isArray(dev.dependsOn)) {
+            nextSteps.push(divergedNextStep(name));
+            continue;
+        }
+        const alreadyDependsOnPullImage = (dev.dependsOn ?? []).some((dependency)=>dependency === PULL_IMAGE_TARGET || typeof dependency === 'object' && dependency !== null && dependency.target === PULL_IMAGE_TARGET && dependency.projects === undefined);
+        if (alreadyDependsOnPullImage) {
+            continue;
+        }
+        if (!startsGeneratedContainer(project)) {
+            nextSteps.push(divergedNextStep(name));
+            continue;
+        }
+        addDependencyToTargetIfNotPresent(project, 'dev', PULL_IMAGE_TARGET);
+        updateProjectConfiguration(tree, name, project);
+        migrated = true;
+    }
+    if (migrated) {
+        await formatFilesInSubtree(tree);
+    }
+    return {
+        nextSteps
+    };
+}
+
+//# sourceMappingURL=migration.js.map

package/src/migrations/latest/dev-target-depends-on-pull-image/migration.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../../../../../../../packages/nx-plugin/src/migrations/latest/dev-target-depends-on-pull-image/migration.ts"],"sourcesContent":["/**\n * Copyright Amazon.com, Inc. or its affiliates. All Rights Reserved.\n * SPDX-License-Identifier: Apache-2.0\n */\nimport {\n  getProjects,\n  type MigrationReturnObject,\n  type ProjectConfiguration,\n  type Tree,\n  updateProjectConfiguration,\n} from '@nx/devkit';\nimport { TS_DYNAMODB_GENERATOR_INFO } from '../../../ts/dynamodb/generator.js';\nimport { TS_RDB_GENERATOR_INFO } from '../../../ts/rdb/generator.js';\nimport { formatFilesInSubtree } from '../../../utils/format.js';\nimport { addDependencyToTargetIfNotPresent } from '../../../utils/nx.js';\n\n/**\n * Make the dev target of ts#dynamodb and ts#rdb projects depend on pull-image\n *\n * Without it, `nx dev` starts the container (and, for DynamoDB, creates the\n * local table) while the image is still being fetched, so a first run on a\n * machine without the image races the pull.\n */\n\nconst GENERATOR_IDS = [TS_DYNAMODB_GENERATOR_INFO.id, TS_RDB_GENERATOR_INFO.id];\n\nconst PULL_IMAGE_TARGET = 'pull-image';\n\nconst startsGeneratedContainer = (project: ProjectConfiguration): boolean => {\n  const { command, commands } = project.targets?.dev?.options ?? {};\n  return [...(commands ?? []), ...(command ? [command] : [])].some(\n    (c: string) => typeof c === 'string' && c.includes('start-container.ts'),\n  );\n};\n\nconst divergedNextStep = (projectName: string): string =>\n  `${projectName}: its dev target has been customised, so it was left as it is. Add \"${PULL_IMAGE_TARGET}\" to the target's dependsOn so the container image is fetched before the container starts.`;\n\nexport default async function migration(\n  tree: Tree,\n): Promise<MigrationReturnObject> {\n  const nextSteps: string[] = [];\n  let migrated = false;\n\n  for (const [name, project] of getProjects(tree)) {\n    if (!GENERATOR_IDS.includes((project.metadata as any)?.generator)) {\n      continue;\n    }\n\n    const dev = project.targets?.dev;\n    if (!dev || !project.targets?.[PULL_IMAGE_TARGET]) {\n      continue;\n    }\n\n    // Nx requires an array here. Anything else is hand-written and is reported\n    // rather than rewritten, so a malformed value is never spread or clobbered.\n    if (dev.dependsOn !== undefined && !Array.isArray(dev.dependsOn)) {\n      nextSteps.push(divergedNextStep(name));\n      continue;\n    }\n\n    const alreadyDependsOnPullImage = (dev.dependsOn ?? []).some(\n      (dependency) =>\n        dependency === PULL_IMAGE_TARGET ||\n        (typeof dependency === 'object' &&\n          dependency !== null &&\n          dependency.target === PULL_IMAGE_TARGET &&\n          dependency.projects === undefined),\n    );\n    if (alreadyDependsOnPullImage) {\n      continue;\n    }\n\n    if (!startsGeneratedContainer(project)) {\n      nextSteps.push(divergedNextStep(name));\n      continue;\n    }\n\n    addDependencyToTargetIfNotPresent(project, 'dev', PULL_IMAGE_TARGET);\n    updateProjectConfiguration(tree, name, project);\n    migrated = true;\n  }\n\n  if (migrated) {\n    await formatFilesInSubtree(tree);\n  }\n\n  return { nextSteps };\n}\n"],"names":["getProjects","updateProjectConfiguration","TS_DYNAMODB_GENERATOR_INFO","TS_RDB_GENERATOR_INFO","formatFilesInSubtree","addDependencyToTargetIfNotPresent","GENERATOR_IDS","id","PULL_IMAGE_TARGET","startsGeneratedContainer","project","command","commands","targets","dev","options","some","c","includes","divergedNextStep","projectName","migration","tree","nextSteps","migrated","name","metadata","generator","dependsOn","undefined","Array","isArray","push","alreadyDependsOnPullImage","dependency","target","projects"],"mappings":"AAAA;;;CAGC,GACD,SACEA,WAAW,EAIXC,0BAA0B,QACrB,aAAa;AACpB,SAASC,0BAA0B,QAAQ,oCAAoC;AAC/E,SAASC,qBAAqB,QAAQ,+BAA+B;AACrE,SAASC,oBAAoB,QAAQ,2BAA2B;AAChE,SAASC,iCAAiC,QAAQ,uBAAuB;AAEzE;;;;;;CAMC,GAED,MAAMC,gBAAgB;IAACJ,2BAA2BK,EAAE;IAAEJ,sBAAsBI,EAAE;CAAC;AAE/E,MAAMC,oBAAoB;AAE1B,MAAMC,2BAA2B,CAACC;IAChC,MAAM,EAAEC,OAAO,EAAEC,QAAQ,EAAE,GAAGF,QAAQG,OAAO,EAAEC,KAAKC,WAAW,CAAC;IAChE,OAAO;WAAKH,YAAY,EAAE;WAAOD,UAAU;YAACA;SAAQ,GAAG,EAAE;KAAE,CAACK,IAAI,CAC9D,CAACC,IAAc,OAAOA,MAAM,YAAYA,EAAEC,QAAQ,CAAC;AAEvD;AAEA,MAAMC,mBAAmB,CAACC,cACxB,GAAGA,YAAY,oEAAoE,EAAEZ,kBAAkB,0FAA0F,CAAC;AAEpM,eAAe,eAAea,UAC5BC,IAAU;IAEV,MAAMC,YAAsB,EAAE;IAC9B,IAAIC,WAAW;IAEf,KAAK,MAAM,CAACC,MAAMf,QAAQ,IAAIV,YAAYsB,MAAO;QAC/C,IAAI,CAAChB,cAAcY,QAAQ,CAAER,QAAQgB,QAAQ,EAAUC,YAAY;YACjE;QACF;QAEA,MAAMb,MAAMJ,QAAQG,OAAO,EAAEC;QAC7B,IAAI,CAACA,OAAO,CAACJ,QAAQG,OAAO,EAAE,CAACL,kBAAkB,EAAE;YACjD;QACF;QAEA,2EAA2E;QAC3E,4EAA4E;QAC5E,IAAIM,IAAIc,SAAS,KAAKC,aAAa,CAACC,MAAMC,OAAO,CAACjB,IAAIc,SAAS,GAAG;YAChEL,UAAUS,IAAI,CAACb,iBAAiBM;YAChC;QACF;QAEA,MAAMQ,4BAA4B,AAACnB,CAAAA,IAAIc,SAAS,IAAI,EAAE,AAAD,EAAGZ,IAAI,CAC1D,CAACkB,aACCA,eAAe1B,qBACd,OAAO0B,eAAe,YACrBA,eAAe,QACfA,WAAWC,MAAM,KAAK3B,qBACtB0B,WAAWE,QAAQ,KAAKP;QAE9B,IAAII,2BAA2B;YAC7B;QACF;QAEA,IAAI,CAACxB,yBAAyBC,UAAU;YACtCa,UAAUS,IAAI,CAACb,iBAAiBM;YAChC;QACF;QAEApB,kCAAkCK,SAAS,OAAOF;QAClDP,2BAA2BqB,MAAMG,MAAMf;QACvCc,WAAW;IACb;IAEA,IAAIA,UAAU;QACZ,MAAMpB,qBAAqBkB;IAC7B;IAEA,OAAO;QAAEC;IAAU;AACrB"}

package/src/migrations/latest/docker-target-cache-soundness/metadata.json

@@ -0,0 +1,3 @@
+{
+  "description": "Make container image build and scan targets non-cacheable, so a cache hit can never report success for an image the container engine no longer has"
+}

package/src/migrations/latest/docker-target-cache-soundness/migration.d.ts

@@ -0,0 +1,6 @@
+/**
+ * Copyright Amazon.com, Inc. or its affiliates. All Rights Reserved.
+ * SPDX-License-Identifier: Apache-2.0
+ */
+import { type MigrationReturnObject, type Tree } from '@nx/devkit';
+export default function migration(tree: Tree): Promise<MigrationReturnObject>;

package/src/migrations/latest/docker-target-cache-soundness/migration.js

@@ -0,0 +1,95 @@
+/**
+ * Copyright Amazon.com, Inc. or its affiliates. All Rights Reserved.
+ * SPDX-License-Identifier: Apache-2.0
+ */ import { getProjects, updateProjectConfiguration } from "@nx/devkit";
+import { IMAGE_BUILD_CACHE } from "../../../utils/docker.js";
+import { formatFilesInSubtree } from "../../../utils/format.js";
+/**
+ * Stop Nx caching the targets that build and scan container images.
+ *
+ * A built image lives in the container engine's store, not under any `outputs`
+ * path, so there was nothing for Nx to restore on a cache hit: `build` reported
+ * success for an image the engine no longer had, and the `trivy` target that
+ * depends on it reported a cached pass against that missing image — so a stale
+ * or absent image could clear both a build and a vulnerability scan.
+ *
+ * The container engine's layer cache already makes the rebuild cheap and, unlike
+ * Nx's, it cannot claim a hit for an image that isn't there.
+ *
+ * A target named as one of these but no longer running the engine has been
+ * reworked by the user, so it is left untouched and reported via `nextSteps`.
+ */ /** Names the generators give the targets that build or scan an image. */ const IMAGE_TARGET_NAME = /(^|-)(docker|trivy)$/;
+/** Commands that build an image, or read one back out of the engine to scan it. */ const CONTAINER_ENGINE_COMMAND = /\b(docker|finch)\s+(build|save)\b/;
+/**
+ * The `Dockerfile` the TypeScript image targets declared as their output. It is
+ * a copy made on the way into the build context, never a product of the build,
+ * so it is dropped along with the caching it existed to support.
+ */ const VENDED_DOCKERFILE_OUTPUT = /\/bundle\/(agent|mcp)\/[^/]+\/Dockerfile$/;
+/** The directory the scan target stages its tarball and ignore file in. */ const VENDED_SCAN_OUTPUT = /\/trivy\/[^/]+$/;
+/**
+ * Outputs the generators declare on these targets. Neither is the artifact the
+ * target's success stands for, so dropping their caching loses nothing. An
+ * output beyond these belongs to a target the user has repurposed, whose product
+ * may genuinely be on disk and soundly cacheable.
+ */ const isVendedOutput = (output)=>VENDED_DOCKERFILE_OUTPUT.test(output) || VENDED_SCAN_OUTPUT.test(output);
+/** Every command a target runs, however its options spell them. */ const targetCommands = (target)=>{
+    const { command, commands } = target.options ?? {};
+    return [
+        ...typeof command === 'string' ? [
+            command
+        ] : [],
+        ...Array.isArray(commands) ? commands : []
+    ].filter((c)=>typeof c === 'string');
+};
+const divergedMessage = (projectName, targetName)=>`${projectName}:${targetName}: has diverged from the generated shape - left untouched. Set \`"cache": false\` on it by hand if it builds or scans a container image: the image lives in the container engine rather than under the target's \`outputs\`, so a cache hit can report success for an image that is no longer there.`;
+const ownOutputsMessage = (projectName, targetName)=>`${projectName}:${targetName}: declares outputs of its own, so it was left cacheable. If its result depends on a container image rather than only on those outputs, set \`"cache": false\` on it by hand: the image lives in the container engine, so a cache hit can report success for an image that is no longer there.`;
+/** Applies the fix to one target, reporting one it declines to touch. */ const migrateTarget = (projectName, targetName, target, nextSteps)=>{
+    // A target with `cache` unset is not cached unless `targetDefaults` opts it
+    // in, and one already set to false is sound, so only an explicitly cacheable
+    // one needs rewriting. Both leave a re-run a no-op.
+    if (target.cache !== true) return false;
+    if (!targetCommands(target).some((c)=>CONTAINER_ENGINE_COMMAND.test(c))) {
+        nextSteps.push(divergedMessage(projectName, targetName));
+        return false;
+    }
+    // Running the engine does not by itself make a target's result uncacheable:
+    // one that also declares outputs of its own may well produce the artifact its
+    // success stands for on disk (a `docker save` tarball, a test report), and
+    // that is soundly cacheable. Only the shapes the generators vend are rewritten.
+    const ownOutputs = target.outputs?.filter((o)=>!isVendedOutput(o)) ?? [];
+    if (ownOutputs.length > 0) {
+        nextSteps.push(ownOutputsMessage(projectName, targetName));
+        return false;
+    }
+    target.cache = IMAGE_BUILD_CACHE;
+    // The scan keeps its staging directory: it is a real directory on disk, and
+    // dropping it would leave the tarball behind on a later run.
+    const outputs = target.outputs?.filter((o)=>!VENDED_DOCKERFILE_OUTPUT.test(o));
+    if (outputs && outputs.length === 0) {
+        delete target.outputs;
+    } else if (outputs) {
+        target.outputs = outputs;
+    }
+    return true;
+};
+export default async function migration(tree) {
+    const nextSteps = [];
+    for (const [projectName, project] of getProjects(tree)){
+        let changed = false;
+        for (const [targetName, target] of Object.entries(project.targets ?? {})){
+            // Matched on the name so a target reworked to no longer run the engine is
+            // still found and reported, rather than silently left cacheable.
+            if (!IMAGE_TARGET_NAME.test(targetName)) continue;
+            changed = migrateTarget(projectName, targetName, target, nextSteps) || changed;
+        }
+        if (changed) {
+            updateProjectConfiguration(tree, projectName, project);
+        }
+    }
+    await formatFilesInSubtree(tree);
+    return {
+        nextSteps
+    };
+}
+
+//# sourceMappingURL=migration.js.map

package/src/migrations/latest/docker-target-cache-soundness/migration.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../../../../../../../packages/nx-plugin/src/migrations/latest/docker-target-cache-soundness/migration.ts"],"sourcesContent":["/**\n * Copyright Amazon.com, Inc. or its affiliates. All Rights Reserved.\n * SPDX-License-Identifier: Apache-2.0\n */\nimport {\n  getProjects,\n  type MigrationReturnObject,\n  type ProjectConfiguration,\n  type TargetConfiguration,\n  type Tree,\n  updateProjectConfiguration,\n} from '@nx/devkit';\nimport { IMAGE_BUILD_CACHE } from '../../../utils/docker.js';\nimport { formatFilesInSubtree } from '../../../utils/format.js';\n\n/**\n * Stop Nx caching the targets that build and scan container images.\n *\n * A built image lives in the container engine's store, not under any `outputs`\n * path, so there was nothing for Nx to restore on a cache hit: `build` reported\n * success for an image the engine no longer had, and the `trivy` target that\n * depends on it reported a cached pass against that missing image — so a stale\n * or absent image could clear both a build and a vulnerability scan.\n *\n * The container engine's layer cache already makes the rebuild cheap and, unlike\n * Nx's, it cannot claim a hit for an image that isn't there.\n *\n * A target named as one of these but no longer running the engine has been\n * reworked by the user, so it is left untouched and reported via `nextSteps`.\n */\n\n/** Names the generators give the targets that build or scan an image. */\nconst IMAGE_TARGET_NAME = /(^|-)(docker|trivy)$/;\n\n/** Commands that build an image, or read one back out of the engine to scan it. */\nconst CONTAINER_ENGINE_COMMAND = /\\b(docker|finch)\\s+(build|save)\\b/;\n\n/**\n * The `Dockerfile` the TypeScript image targets declared as their output. It is\n * a copy made on the way into the build context, never a product of the build,\n * so it is dropped along with the caching it existed to support.\n */\nconst VENDED_DOCKERFILE_OUTPUT = /\\/bundle\\/(agent|mcp)\\/[^/]+\\/Dockerfile$/;\n\n/** The directory the scan target stages its tarball and ignore file in. */\nconst VENDED_SCAN_OUTPUT = /\\/trivy\\/[^/]+$/;\n\n/**\n * Outputs the generators declare on these targets. Neither is the artifact the\n * target's success stands for, so dropping their caching loses nothing. An\n * output beyond these belongs to a target the user has repurposed, whose product\n * may genuinely be on disk and soundly cacheable.\n */\nconst isVendedOutput = (output: string): boolean =>\n  VENDED_DOCKERFILE_OUTPUT.test(output) || VENDED_SCAN_OUTPUT.test(output);\n\n/** Every command a target runs, however its options spell them. */\nconst targetCommands = (target: TargetConfiguration): string[] => {\n  const { command, commands } = (target.options ?? {}) as {\n    command?: unknown;\n    commands?: unknown;\n  };\n  return [\n    ...(typeof command === 'string' ? [command] : []),\n    ...(Array.isArray(commands) ? commands : []),\n  ].filter((c): c is string => typeof c === 'string');\n};\n\nconst divergedMessage = (projectName: string, targetName: string) =>\n  `${projectName}:${targetName}: has diverged from the generated shape - left untouched. Set \\`\"cache\": false\\` on it by hand if it builds or scans a container image: the image lives in the container engine rather than under the target's \\`outputs\\`, so a cache hit can report success for an image that is no longer there.`;\n\nconst ownOutputsMessage = (projectName: string, targetName: string) =>\n  `${projectName}:${targetName}: declares outputs of its own, so it was left cacheable. If its result depends on a container image rather than only on those outputs, set \\`\"cache\": false\\` on it by hand: the image lives in the container engine, so a cache hit can report success for an image that is no longer there.`;\n\n/** Applies the fix to one target, reporting one it declines to touch. */\nconst migrateTarget = (\n  projectName: string,\n  targetName: string,\n  target: TargetConfiguration,\n  nextSteps: string[],\n): boolean => {\n  // A target with `cache` unset is not cached unless `targetDefaults` opts it\n  // in, and one already set to false is sound, so only an explicitly cacheable\n  // one needs rewriting. Both leave a re-run a no-op.\n  if (target.cache !== true) return false;\n\n  if (!targetCommands(target).some((c) => CONTAINER_ENGINE_COMMAND.test(c))) {\n    nextSteps.push(divergedMessage(projectName, targetName));\n    return false;\n  }\n\n  // Running the engine does not by itself make a target's result uncacheable:\n  // one that also declares outputs of its own may well produce the artifact its\n  // success stands for on disk (a `docker save` tarball, a test report), and\n  // that is soundly cacheable. Only the shapes the generators vend are rewritten.\n  const ownOutputs = target.outputs?.filter((o) => !isVendedOutput(o)) ?? [];\n  if (ownOutputs.length > 0) {\n    nextSteps.push(ownOutputsMessage(projectName, targetName));\n    return false;\n  }\n\n  target.cache = IMAGE_BUILD_CACHE;\n\n  // The scan keeps its staging directory: it is a real directory on disk, and\n  // dropping it would leave the tarball behind on a later run.\n  const outputs = target.outputs?.filter(\n    (o) => !VENDED_DOCKERFILE_OUTPUT.test(o),\n  );\n  if (outputs && outputs.length === 0) {\n    delete target.outputs;\n  } else if (outputs) {\n    target.outputs = outputs;\n  }\n\n  return true;\n};\n\nexport default async function migration(\n  tree: Tree,\n): Promise<MigrationReturnObject> {\n  const nextSteps: string[] = [];\n\n  for (const [projectName, project] of getProjects(tree)) {\n    let changed = false;\n\n    for (const [targetName, target] of Object.entries(project.targets ?? {})) {\n      // Matched on the name so a target reworked to no longer run the engine is\n      // still found and reported, rather than silently left cacheable.\n      if (!IMAGE_TARGET_NAME.test(targetName)) continue;\n\n      changed =\n        migrateTarget(projectName, targetName, target, nextSteps) || changed;\n    }\n\n    if (changed) {\n      updateProjectConfiguration(\n        tree,\n        projectName,\n        project as ProjectConfiguration,\n      );\n    }\n  }\n\n  await formatFilesInSubtree(tree);\n\n  return { nextSteps };\n}\n"],"names":["getProjects","updateProjectConfiguration","IMAGE_BUILD_CACHE","formatFilesInSubtree","IMAGE_TARGET_NAME","CONTAINER_ENGINE_COMMAND","VENDED_DOCKERFILE_OUTPUT","VENDED_SCAN_OUTPUT","isVendedOutput","output","test","targetCommands","target","command","commands","options","Array","isArray","filter","c","divergedMessage","projectName","targetName","ownOutputsMessage","migrateTarget","nextSteps","cache","some","push","ownOutputs","outputs","o","length","migration","tree","project","changed","Object","entries","targets"],"mappings":"AAAA;;;CAGC,GACD,SACEA,WAAW,EAKXC,0BAA0B,QACrB,aAAa;AACpB,SAASC,iBAAiB,QAAQ,2BAA2B;AAC7D,SAASC,oBAAoB,QAAQ,2BAA2B;AAEhE;;;;;;;;;;;;;;CAcC,GAED,uEAAuE,GACvE,MAAMC,oBAAoB;AAE1B,iFAAiF,GACjF,MAAMC,2BAA2B;AAEjC;;;;CAIC,GACD,MAAMC,2BAA2B;AAEjC,yEAAyE,GACzE,MAAMC,qBAAqB;AAE3B;;;;;CAKC,GACD,MAAMC,iBAAiB,CAACC,SACtBH,yBAAyBI,IAAI,CAACD,WAAWF,mBAAmBG,IAAI,CAACD;AAEnE,iEAAiE,GACjE,MAAME,iBAAiB,CAACC;IACtB,MAAM,EAAEC,OAAO,EAAEC,QAAQ,EAAE,GAAIF,OAAOG,OAAO,IAAI,CAAC;IAIlD,OAAO;WACD,OAAOF,YAAY,WAAW;YAACA;SAAQ,GAAG,EAAE;WAC5CG,MAAMC,OAAO,CAACH,YAAYA,WAAW,EAAE;KAC5C,CAACI,MAAM,CAAC,CAACC,IAAmB,OAAOA,MAAM;AAC5C;AAEA,MAAMC,kBAAkB,CAACC,aAAqBC,aAC5C,GAAGD,YAAY,CAAC,EAAEC,WAAW,mSAAmS,CAAC;AAEnU,MAAMC,oBAAoB,CAACF,aAAqBC,aAC9C,GAAGD,YAAY,CAAC,EAAEC,WAAW,6RAA6R,CAAC;AAE7T,uEAAuE,GACvE,MAAME,gBAAgB,CACpBH,aACAC,YACAV,QACAa;IAEA,4EAA4E;IAC5E,6EAA6E;IAC7E,oDAAoD;IACpD,IAAIb,OAAOc,KAAK,KAAK,MAAM,OAAO;IAElC,IAAI,CAACf,eAAeC,QAAQe,IAAI,CAAC,CAACR,IAAMd,yBAAyBK,IAAI,CAACS,KAAK;QACzEM,UAAUG,IAAI,CAACR,gBAAgBC,aAAaC;QAC5C,OAAO;IACT;IAEA,4EAA4E;IAC5E,8EAA8E;IAC9E,2EAA2E;IAC3E,gFAAgF;IAChF,MAAMO,aAAajB,OAAOkB,OAAO,EAAEZ,OAAO,CAACa,IAAM,CAACvB,eAAeuB,OAAO,EAAE;IAC1E,IAAIF,WAAWG,MAAM,GAAG,GAAG;QACzBP,UAAUG,IAAI,CAACL,kBAAkBF,aAAaC;QAC9C,OAAO;IACT;IAEAV,OAAOc,KAAK,GAAGxB;IAEf,4EAA4E;IAC5E,6DAA6D;IAC7D,MAAM4B,UAAUlB,OAAOkB,OAAO,EAAEZ,OAC9B,CAACa,IAAM,CAACzB,yBAAyBI,IAAI,CAACqB;IAExC,IAAID,WAAWA,QAAQE,MAAM,KAAK,GAAG;QACnC,OAAOpB,OAAOkB,OAAO;IACvB,OAAO,IAAIA,SAAS;QAClBlB,OAAOkB,OAAO,GAAGA;IACnB;IAEA,OAAO;AACT;AAEA,eAAe,eAAeG,UAC5BC,IAAU;IAEV,MAAMT,YAAsB,EAAE;IAE9B,KAAK,MAAM,CAACJ,aAAac,QAAQ,IAAInC,YAAYkC,MAAO;QACtD,IAAIE,UAAU;QAEd,KAAK,MAAM,CAACd,YAAYV,OAAO,IAAIyB,OAAOC,OAAO,CAACH,QAAQI,OAAO,IAAI,CAAC,GAAI;YACxE,0EAA0E;YAC1E,iEAAiE;YACjE,IAAI,CAACnC,kBAAkBM,IAAI,CAACY,aAAa;YAEzCc,UACEZ,cAAcH,aAAaC,YAAYV,QAAQa,cAAcW;QACjE;QAEA,IAAIA,SAAS;YACXnC,2BACEiC,MACAb,aACAc;QAEJ;IACF;IAEA,MAAMhC,qBAAqB+B;IAE3B,OAAO;QAAET;IAAU;AACrB"}

package/src/migrations/latest/open-api-codegen-executor/metadata.json

@@ -0,0 +1,3 @@
+{
+  "description": "Switch generated OpenAPI codegen targets to the in-process open-api-codegen executor"
+}

package/src/migrations/latest/open-api-codegen-executor/migration.d.ts

@@ -0,0 +1,6 @@
+/**
+ * Copyright Amazon.com, Inc. or its affiliates. All Rights Reserved.
+ * SPDX-License-Identifier: Apache-2.0
+ */
+import { type MigrationReturnObject, type Tree } from '@nx/devkit';
+export default function migration(tree: Tree): Promise<MigrationReturnObject>;

package/src/migrations/latest/open-api-codegen-executor/migration.js

@@ -0,0 +1,100 @@
+/**
+ * Copyright Amazon.com, Inc. or its affiliates. All Rights Reserved.
+ * SPDX-License-Identifier: Apache-2.0
+ */ import { getProjects, updateProjectConfiguration } from "@nx/devkit";
+import { formatFilesInSubtree } from "../../../utils/format.js";
+import { normalizeTargetKeyOrder } from "../../../utils/nx.js";
+import { OPEN_API_CODEGEN_EXECUTOR } from "../../../utils/open-api-codegen-target.js";
+/**
+ * Codegen targets ran `nx g @aws/nx-plugin:open-api#<generator>` through
+ * `nx:run-commands`, paying a second full Nx bootstrap — project graph, plugin
+ * resolution and schema validation — for every codegen step. They now use the
+ * `open-api-codegen` executor, which runs the same generator in the Nx process
+ * that is already running.
+ *
+ * Only the command shape the generators produced is rewritten. A target that has
+ * been customised — an extra flag, a chained command, options beyond `commands` —
+ * is the user's, so it is left as it is and reported.
+ *
+ * How to write a migration:
+ * - https://nx.dev/docs/kb/migration-generators
+ * - What `nextSteps` means: https://nx.dev/docs/reference/devkit/MigrationReturnObject
+ */ /** The generators the executor can run, by the collection name they had. */ const GENERATORS = {
+    'open-api#ts-client': 'ts-client',
+    'open-api#ts-hooks': 'ts-hooks',
+    'open-api#ts-metadata': 'ts-metadata',
+    'open-api#json-metadata': 'json-metadata'
+};
+/**
+ * Matches a whole generated codegen command, binding the generator name and its
+ * two paths. Anchored, so a command carrying anything else does not match and is
+ * reported instead of rewritten.
+ */ const CODEGEN_COMMAND = /^nx g @aws\/nx-plugin:(?<generator>[\w#-]+) --openApiSpecPath="(?<specPath>[^"]+)" --outputPath="(?<outputPath>[^"]+)" --no-interactive$/;
+/**
+ * The command a target runs, when it is a single-command `nx:run-commands` — the
+ * shape the generators produced. A target carrying several commands, or options
+ * beyond `commands`, has diverged.
+ */ const singleCommand = (target)=>{
+    if (target.executor !== 'nx:run-commands') return undefined;
+    const options = target.options;
+    if (!options || Object.keys(options).length !== 1) return undefined;
+    const commands = options.commands;
+    if (!Array.isArray(commands) || commands.length !== 1) return undefined;
+    return typeof commands[0] === 'string' ? commands[0] : undefined;
+};
+/** Parses a generated codegen command, or undefined if it is not one. */ const parseCodegenCommand = (command)=>{
+    const groups = CODEGEN_COMMAND.exec(command)?.groups;
+    if (!groups) return undefined;
+    const generator = GENERATORS[groups.generator];
+    if (!generator) return undefined;
+    return {
+        generator,
+        openApiSpecPath: groups.specPath,
+        outputPath: groups.outputPath
+    };
+};
+/**
+ * Whether a target invokes an OpenAPI generator without being the shape the
+ * generators produced, so it must be reported rather than rewritten.
+ *
+ * Continuous targets are excluded. The vended `watch-generate:<api>-client`
+ * wraps `nx watch -- nx run <project>:<codegen target>`, which references the
+ * codegen target rather than the generator, so it never matches here anyway. But
+ * a watch target rewritten to invoke the generator directly would, and telling
+ * its owner to switch to the executor would be wrong advice: `nx watch` runs
+ * until interrupted, which a single executor invocation cannot express.
+ *
+ * `continuous` is the property that makes that true, so it is what is checked —
+ * rather than the `watch-` name prefix, which is only a convention.
+ */ const hasCustomisedCodegenCommand = (target)=>target.executor === 'nx:run-commands' && !target.continuous && JSON.stringify(target.options ?? {}).includes('@aws/nx-plugin:open-api#');
+export default async function migration(tree) {
+    const nextSteps = [];
+    for (const [projectName, project] of getProjects(tree)){
+        let changed = false;
+        for (const [targetName, target] of Object.entries(project.targets ?? {})){
+            const command = singleCommand(target);
+            const options = command ? parseCodegenCommand(command) : undefined;
+            if (!options) {
+                if (hasCustomisedCodegenCommand(target)) {
+                    nextSteps.push(`${projectName}:${targetName} has diverged from the generated shape — left untouched. Switch it to the '${OPEN_API_CODEGEN_EXECUTOR}' executor to avoid a nested Nx invocation.`);
+                }
+                continue;
+            }
+            project.targets[targetName] = normalizeTargetKeyOrder({
+                ...target,
+                executor: OPEN_API_CODEGEN_EXECUTOR,
+                options
+            });
+            changed = true;
+        }
+        if (changed) {
+            updateProjectConfiguration(tree, projectName, project);
+        }
+    }
+    await formatFilesInSubtree(tree);
+    return {
+        nextSteps
+    };
+}
+
+//# sourceMappingURL=migration.js.map

package/src/migrations/latest/open-api-codegen-executor/migration.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../../../../../../../packages/nx-plugin/src/migrations/latest/open-api-codegen-executor/migration.ts"],"sourcesContent":["/**\n * Copyright Amazon.com, Inc. or its affiliates. All Rights Reserved.\n * SPDX-License-Identifier: Apache-2.0\n */\nimport {\n  getProjects,\n  type MigrationReturnObject,\n  type TargetConfiguration,\n  type Tree,\n  updateProjectConfiguration,\n} from '@nx/devkit';\nimport type { OpenApiCodegenTarget } from '../../../open-api/codegen/executor-schema';\nimport { formatFilesInSubtree } from '../../../utils/format.js';\nimport { normalizeTargetKeyOrder } from '../../../utils/nx.js';\nimport { OPEN_API_CODEGEN_EXECUTOR } from '../../../utils/open-api-codegen-target.js';\n\n/**\n * Codegen targets ran `nx g @aws/nx-plugin:open-api#<generator>` through\n * `nx:run-commands`, paying a second full Nx bootstrap — project graph, plugin\n * resolution and schema validation — for every codegen step. They now use the\n * `open-api-codegen` executor, which runs the same generator in the Nx process\n * that is already running.\n *\n * Only the command shape the generators produced is rewritten. A target that has\n * been customised — an extra flag, a chained command, options beyond `commands` —\n * is the user's, so it is left as it is and reported.\n *\n * How to write a migration:\n * - https://nx.dev/docs/kb/migration-generators\n * - What `nextSteps` means: https://nx.dev/docs/reference/devkit/MigrationReturnObject\n */\n\n/** The generators the executor can run, by the collection name they had. */\nconst GENERATORS: Record<string, OpenApiCodegenTarget> = {\n  'open-api#ts-client': 'ts-client',\n  'open-api#ts-hooks': 'ts-hooks',\n  'open-api#ts-metadata': 'ts-metadata',\n  'open-api#json-metadata': 'json-metadata',\n};\n\n/**\n * Matches a whole generated codegen command, binding the generator name and its\n * two paths. Anchored, so a command carrying anything else does not match and is\n * reported instead of rewritten.\n */\nconst CODEGEN_COMMAND =\n  /^nx g @aws\\/nx-plugin:(?<generator>[\\w#-]+) --openApiSpecPath=\"(?<specPath>[^\"]+)\" --outputPath=\"(?<outputPath>[^\"]+)\" --no-interactive$/;\n\ninterface CodegenOptions {\n  readonly generator: OpenApiCodegenTarget;\n  readonly openApiSpecPath: string;\n  readonly outputPath: string;\n}\n\n/**\n * The command a target runs, when it is a single-command `nx:run-commands` — the\n * shape the generators produced. A target carrying several commands, or options\n * beyond `commands`, has diverged.\n */\nconst singleCommand = (target: TargetConfiguration): string | undefined => {\n  if (target.executor !== 'nx:run-commands') return undefined;\n  const options = target.options as Record<string, unknown> | undefined;\n  if (!options || Object.keys(options).length !== 1) return undefined;\n  const commands = options.commands;\n  if (!Array.isArray(commands) || commands.length !== 1) return undefined;\n  return typeof commands[0] === 'string' ? commands[0] : undefined;\n};\n\n/** Parses a generated codegen command, or undefined if it is not one. */\nconst parseCodegenCommand = (command: string): CodegenOptions | undefined => {\n  const groups = CODEGEN_COMMAND.exec(command)?.groups;\n  if (!groups) return undefined;\n  const generator = GENERATORS[groups.generator];\n  if (!generator) return undefined;\n  return {\n    generator,\n    openApiSpecPath: groups.specPath,\n    outputPath: groups.outputPath,\n  };\n};\n\n/**\n * Whether a target invokes an OpenAPI generator without being the shape the\n * generators produced, so it must be reported rather than rewritten.\n *\n * Continuous targets are excluded. The vended `watch-generate:<api>-client`\n * wraps `nx watch -- nx run <project>:<codegen target>`, which references the\n * codegen target rather than the generator, so it never matches here anyway. But\n * a watch target rewritten to invoke the generator directly would, and telling\n * its owner to switch to the executor would be wrong advice: `nx watch` runs\n * until interrupted, which a single executor invocation cannot express.\n *\n * `continuous` is the property that makes that true, so it is what is checked —\n * rather than the `watch-` name prefix, which is only a convention.\n */\nconst hasCustomisedCodegenCommand = (target: TargetConfiguration): boolean =>\n  target.executor === 'nx:run-commands' &&\n  !target.continuous &&\n  JSON.stringify(target.options ?? {}).includes('@aws/nx-plugin:open-api#');\n\nexport default async function migration(\n  tree: Tree,\n): Promise<MigrationReturnObject> {\n  const nextSteps: string[] = [];\n\n  for (const [projectName, project] of getProjects(tree)) {\n    let changed = false;\n\n    for (const [targetName, target] of Object.entries(project.targets ?? {})) {\n      const command = singleCommand(target);\n      const options = command ? parseCodegenCommand(command) : undefined;\n\n      if (!options) {\n        if (hasCustomisedCodegenCommand(target)) {\n          nextSteps.push(\n            `${projectName}:${targetName} has diverged from the generated shape — left untouched. Switch it to the '${OPEN_API_CODEGEN_EXECUTOR}' executor to avoid a nested Nx invocation.`,\n          );\n        }\n        continue;\n      }\n\n      project.targets[targetName] = normalizeTargetKeyOrder({\n        ...target,\n        executor: OPEN_API_CODEGEN_EXECUTOR,\n        options,\n      });\n      changed = true;\n    }\n\n    if (changed) {\n      updateProjectConfiguration(tree, projectName, project);\n    }\n  }\n\n  await formatFilesInSubtree(tree);\n\n  return { nextSteps };\n}\n"],"names":["getProjects","updateProjectConfiguration","formatFilesInSubtree","normalizeTargetKeyOrder","OPEN_API_CODEGEN_EXECUTOR","GENERATORS","CODEGEN_COMMAND","singleCommand","target","executor","undefined","options","Object","keys","length","commands","Array","isArray","parseCodegenCommand","command","groups","exec","generator","openApiSpecPath","specPath","outputPath","hasCustomisedCodegenCommand","continuous","JSON","stringify","includes","migration","tree","nextSteps","projectName","project","changed","targetName","entries","targets","push"],"mappings":"AAAA;;;CAGC,GACD,SACEA,WAAW,EAIXC,0BAA0B,QACrB,aAAa;AAEpB,SAASC,oBAAoB,QAAQ,2BAA2B;AAChE,SAASC,uBAAuB,QAAQ,uBAAuB;AAC/D,SAASC,yBAAyB,QAAQ,4CAA4C;AAEtF;;;;;;;;;;;;;;CAcC,GAED,0EAA0E,GAC1E,MAAMC,aAAmD;IACvD,sBAAsB;IACtB,qBAAqB;IACrB,wBAAwB;IACxB,0BAA0B;AAC5B;AAEA;;;;CAIC,GACD,MAAMC,kBACJ;AAQF;;;;CAIC,GACD,MAAMC,gBAAgB,CAACC;IACrB,IAAIA,OAAOC,QAAQ,KAAK,mBAAmB,OAAOC;IAClD,MAAMC,UAAUH,OAAOG,OAAO;IAC9B,IAAI,CAACA,WAAWC,OAAOC,IAAI,CAACF,SAASG,MAAM,KAAK,GAAG,OAAOJ;IAC1D,MAAMK,WAAWJ,QAAQI,QAAQ;IACjC,IAAI,CAACC,MAAMC,OAAO,CAACF,aAAaA,SAASD,MAAM,KAAK,GAAG,OAAOJ;IAC9D,OAAO,OAAOK,QAAQ,CAAC,EAAE,KAAK,WAAWA,QAAQ,CAAC,EAAE,GAAGL;AACzD;AAEA,uEAAuE,GACvE,MAAMQ,sBAAsB,CAACC;IAC3B,MAAMC,SAASd,gBAAgBe,IAAI,CAACF,UAAUC;IAC9C,IAAI,CAACA,QAAQ,OAAOV;IACpB,MAAMY,YAAYjB,UAAU,CAACe,OAAOE,SAAS,CAAC;IAC9C,IAAI,CAACA,WAAW,OAAOZ;IACvB,OAAO;QACLY;QACAC,iBAAiBH,OAAOI,QAAQ;QAChCC,YAAYL,OAAOK,UAAU;IAC/B;AACF;AAEA;;;;;;;;;;;;;CAaC,GACD,MAAMC,8BAA8B,CAAClB,SACnCA,OAAOC,QAAQ,KAAK,qBACpB,CAACD,OAAOmB,UAAU,IAClBC,KAAKC,SAAS,CAACrB,OAAOG,OAAO,IAAI,CAAC,GAAGmB,QAAQ,CAAC;AAEhD,eAAe,eAAeC,UAC5BC,IAAU;IAEV,MAAMC,YAAsB,EAAE;IAE9B,KAAK,MAAM,CAACC,aAAaC,QAAQ,IAAInC,YAAYgC,MAAO;QACtD,IAAII,UAAU;QAEd,KAAK,MAAM,CAACC,YAAY7B,OAAO,IAAII,OAAO0B,OAAO,CAACH,QAAQI,OAAO,IAAI,CAAC,GAAI;YACxE,MAAMpB,UAAUZ,cAAcC;YAC9B,MAAMG,UAAUQ,UAAUD,oBAAoBC,WAAWT;YAEzD,IAAI,CAACC,SAAS;gBACZ,IAAIe,4BAA4BlB,SAAS;oBACvCyB,UAAUO,IAAI,CACZ,GAAGN,YAAY,CAAC,EAAEG,WAAW,2EAA2E,EAAEjC,0BAA0B,2CAA2C,CAAC;gBAEpL;gBACA;YACF;YAEA+B,QAAQI,OAAO,CAACF,WAAW,GAAGlC,wBAAwB;gBACpD,GAAGK,MAAM;gBACTC,UAAUL;gBACVO;YACF;YACAyB,UAAU;QACZ;QAEA,IAAIA,SAAS;YACXnC,2BAA2B+B,MAAME,aAAaC;QAChD;IACF;IAEA,MAAMjC,qBAAqB8B;IAE3B,OAAO;QAAEC;IAAU;AACrB"}

package/src/migrations/latest/python-test-input-scoping/metadata.json

@@ -0,0 +1,3 @@
+{
+  "description": "Exclude Python test files from the production named input and scope dependent task outputs to dist so Python test edits do not invalidate build tasks"
+}

package/src/migrations/latest/python-test-input-scoping/migration.d.ts

@@ -0,0 +1,6 @@
+/**
+ * Copyright Amazon.com, Inc. or its affiliates. All Rights Reserved.
+ * SPDX-License-Identifier: Apache-2.0
+ */
+import { type MigrationReturnObject, type Tree } from '@nx/devkit';
+export default function migration(tree: Tree): Promise<MigrationReturnObject>;

package/src/migrations/latest/python-test-input-scoping/migration.js

@@ -0,0 +1,142 @@
+/**
+ * Copyright Amazon.com, Inc. or its affiliates. All Rights Reserved.
+ * SPDX-License-Identifier: Apache-2.0
+ */ import { getProjects, readNxJson, updateNxJson, updateProjectConfiguration } from "@nx/devkit";
+import { PYTHON_TEST_FILE_EXCLUSIONS } from "../../../py/project/generator.js";
+import { DEPENDENT_TASKS_OUTPUT_FILES_INPUT } from "../../../ts/lib/generator.js";
+import { formatFilesInSubtree } from "../../../utils/format.js";
+/**
+ * Editing a Python test file used to invalidate the whole build chain for its
+ * project, and cascade into every downstream project. Two independent causes:
+ *
+ * 1. The `production` named input excluded TypeScript specs but nothing Python,
+ *    and the Python build targets read `default` (every file in the project), so
+ *    a test file was a build input by construction.
+ * 2. `default` consumed *every* output of a dependency task. The Python `test`
+ *    target writes JUnit and coverage reports that pytest stamps wall-clock time
+ *    into, so each test run minted a new hash that propagated downstream.
+ *
+ * Targets whose output genuinely cannot contain a test file move to
+ * `production`; `typecheck` deliberately stays on `default`, because `ty` checks
+ * the tests directory and must re-run when a test changes.
+ */ /** The Python targets whose declared output cannot contain a test file. */ const PRODUCTION_SCOPED_TARGETS = [
+    'compile',
+    'bundle-x86',
+    'bundle-arm'
+];
+/** The inputs those targets read once scoped to production sources. */ const PRODUCTION_INPUTS = [
+    'production',
+    '^production'
+];
+/** The inputs those targets previously read. */ const PREVIOUS_INPUTS = [
+    'default',
+    '^production'
+];
+/**
+ * Dependent-task-output globs this plugin has vended. Any of them is rewritten
+ * to the current one; anything else is the user's own scoping decision.
+ */ const PREVIOUSLY_VENDED_GLOBS = [
+    '**/*',
+    'dist/**'
+];
+const isPythonProject = (project)=>Object.values(project.targets ?? {}).some((target)=>String(target?.executor ?? '').startsWith('@nxlv/python'));
+/**
+ * An OpenAPI spec generation target as the generators vend it: named `openapi`
+ * or `<agent>-openapi`, running a command, and writing its spec under
+ * `dist/.../openapi`. The extra checks keep a user-authored target that merely
+ * shares the suffix from being rescoped, since these targets are identified by
+ * declaring no `inputs` at all.
+ */ const isOpenApiTarget = (name, target)=>{
+    if (name !== 'openapi' && !name.endsWith('-openapi')) return false;
+    if (!target) return true;
+    return target.executor === 'nx:run-commands' && (target.outputs ?? []).some((output)=>output.includes('/openapi'));
+};
+const arraysEqual = (a, b)=>a.length === b.length && a.every((entry, index)=>entry === b[index]);
+/**
+ * Excludes Python test files from the `production` named input, and narrows the
+ * dependent-task-output input so test reports no longer propagate downstream.
+ */ const migrateNamedInputs = (tree, nextSteps)=>{
+    const nxJson = readNxJson(tree);
+    if (!nxJson) return;
+    // Seeded as `['default']` when absent, exactly as the generator does. The
+    // targets below are rewritten to read `production`, and Nx fails hard on a
+    // named input that is not defined, so the two must not diverge.
+    const production = nxJson.namedInputs?.production ?? [
+        'default'
+    ];
+    const nextProduction = [
+        ...production,
+        ...PYTHON_TEST_FILE_EXCLUSIONS.filter((exclusion)=>!production.includes(exclusion))
+    ];
+    const defaultInput = nxJson.namedInputs?.default;
+    let nextDefault = defaultInput;
+    if (defaultInput) {
+        const glob = DEPENDENT_TASKS_OUTPUT_FILES_INPUT.dependentTasksOutputFiles;
+        // Only an entry this plugin vended is rewritten; a different glob is the
+        // user's own scoping decision.
+        nextDefault = defaultInput.map((input)=>typeof input === 'object' && input !== null && 'dependentTasksOutputFiles' in input && PREVIOUSLY_VENDED_GLOBS.includes(input.dependentTasksOutputFiles) ? {
+                ...input,
+                dependentTasksOutputFiles: glob
+            } : input);
+        const hadVendedEntry = nextDefault.some((input)=>typeof input === 'object' && input !== null && 'dependentTasksOutputFiles' in input && input.dependentTasksOutputFiles === glob);
+        const hasCustomEntry = defaultInput.some((input)=>typeof input === 'object' && input !== null && 'dependentTasksOutputFiles' in input && !PREVIOUSLY_VENDED_GLOBS.includes(input.dependentTasksOutputFiles) && input.dependentTasksOutputFiles !== glob);
+        if (!hadVendedEntry && hasCustomEntry) {
+            nextSteps.push(`nx.json's 'default' named input scopes 'dependentTasksOutputFiles' to a custom glob — left untouched. Narrow it to '${glob}' so timestamped test reports do not invalidate downstream tasks.`);
+        }
+    }
+    updateNxJson(tree, {
+        ...nxJson,
+        namedInputs: {
+            ...nxJson.namedInputs,
+            production: nextProduction,
+            ...nextDefault ? {
+                default: nextDefault
+            } : {}
+        }
+    });
+};
+/**
+ * Scopes a Python project's build-chain targets to production sources. Only
+ * targets still carrying the inputs the generator vended are rewritten, so a
+ * project whose inputs the user has tuned is reported rather than clobbered.
+ */ const migrateProjectTargets = (tree, projectName, project, nextSteps)=>{
+    let changed = false;
+    for (const [targetName, target] of Object.entries(project.targets ?? {})){
+        if (!PRODUCTION_SCOPED_TARGETS.includes(targetName) && !isOpenApiTarget(targetName, target)) {
+            continue;
+        }
+        const inputs = target.inputs;
+        // Already migrated, so a re-run is a no-op.
+        if (inputs && arraysEqual(inputs, PRODUCTION_INPUTS)) {
+            continue;
+        }
+        // The OpenAPI targets declared no inputs at all, so they fell back to
+        // `default`. Everything else carried the vended pair.
+        const isVendedShape = inputs ? arraysEqual(inputs, PREVIOUS_INPUTS) : isOpenApiTarget(targetName, target);
+        if (!isVendedShape) {
+            nextSteps.push(`${projectName}:${targetName}: 'inputs' has diverged from the generated shape — left untouched. Scope it to ['production', '^production'] so Python test edits do not invalidate it.`);
+            continue;
+        }
+        target.inputs = [
+            ...PRODUCTION_INPUTS
+        ];
+        changed = true;
+    }
+    if (changed) {
+        updateProjectConfiguration(tree, projectName, project);
+    }
+};
+export default async function migration(tree) {
+    const nextSteps = [];
+    migrateNamedInputs(tree, nextSteps);
+    for (const [projectName, project] of getProjects(tree)){
+        if (!isPythonProject(project)) continue;
+        migrateProjectTargets(tree, projectName, project, nextSteps);
+    }
+    await formatFilesInSubtree(tree);
+    return {
+        nextSteps
+    };
+}
+
+//# sourceMappingURL=migration.js.map

package/src/migrations/latest/python-test-input-scoping/migration.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../../../../../../../packages/nx-plugin/src/migrations/latest/python-test-input-scoping/migration.ts"],"sourcesContent":["/**\n * Copyright Amazon.com, Inc. or its affiliates. All Rights Reserved.\n * SPDX-License-Identifier: Apache-2.0\n */\nimport {\n  getProjects,\n  type MigrationReturnObject,\n  type ProjectConfiguration,\n  readNxJson,\n  type TargetConfiguration,\n  type Tree,\n  updateNxJson,\n  updateProjectConfiguration,\n} from '@nx/devkit';\nimport { PYTHON_TEST_FILE_EXCLUSIONS } from '../../../py/project/generator.js';\nimport { DEPENDENT_TASKS_OUTPUT_FILES_INPUT } from '../../../ts/lib/generator.js';\nimport { formatFilesInSubtree } from '../../../utils/format.js';\n\n/**\n * Editing a Python test file used to invalidate the whole build chain for its\n * project, and cascade into every downstream project. Two independent causes:\n *\n * 1. The `production` named input excluded TypeScript specs but nothing Python,\n *    and the Python build targets read `default` (every file in the project), so\n *    a test file was a build input by construction.\n * 2. `default` consumed *every* output of a dependency task. The Python `test`\n *    target writes JUnit and coverage reports that pytest stamps wall-clock time\n *    into, so each test run minted a new hash that propagated downstream.\n *\n * Targets whose output genuinely cannot contain a test file move to\n * `production`; `typecheck` deliberately stays on `default`, because `ty` checks\n * the tests directory and must re-run when a test changes.\n */\n\n/** The Python targets whose declared output cannot contain a test file. */\nconst PRODUCTION_SCOPED_TARGETS = ['compile', 'bundle-x86', 'bundle-arm'];\n\n/** The inputs those targets read once scoped to production sources. */\nconst PRODUCTION_INPUTS = ['production', '^production'];\n\n/** The inputs those targets previously read. */\nconst PREVIOUS_INPUTS = ['default', '^production'];\n\n/**\n * Dependent-task-output globs this plugin has vended. Any of them is rewritten\n * to the current one; anything else is the user's own scoping decision.\n */\nconst PREVIOUSLY_VENDED_GLOBS = ['**/*', 'dist/**'];\n\nconst isPythonProject = (project: ProjectConfiguration): boolean =>\n  Object.values(project.targets ?? {}).some((target) =>\n    String(target?.executor ?? '').startsWith('@nxlv/python'),\n  );\n\n/**\n * An OpenAPI spec generation target as the generators vend it: named `openapi`\n * or `<agent>-openapi`, running a command, and writing its spec under\n * `dist/.../openapi`. The extra checks keep a user-authored target that merely\n * shares the suffix from being rescoped, since these targets are identified by\n * declaring no `inputs` at all.\n */\nconst isOpenApiTarget = (\n  name: string,\n  target?: TargetConfiguration,\n): boolean => {\n  if (name !== 'openapi' && !name.endsWith('-openapi')) return false;\n  if (!target) return true;\n  return (\n    target.executor === 'nx:run-commands' &&\n    (target.outputs ?? []).some((output) => output.includes('/openapi'))\n  );\n};\n\nconst arraysEqual = (a: readonly unknown[], b: readonly unknown[]): boolean =>\n  a.length === b.length && a.every((entry, index) => entry === b[index]);\n\n/**\n * Excludes Python test files from the `production` named input, and narrows the\n * dependent-task-output input so test reports no longer propagate downstream.\n */\nconst migrateNamedInputs = (tree: Tree, nextSteps: string[]): void => {\n  const nxJson = readNxJson(tree);\n  if (!nxJson) return;\n\n  // Seeded as `['default']` when absent, exactly as the generator does. The\n  // targets below are rewritten to read `production`, and Nx fails hard on a\n  // named input that is not defined, so the two must not diverge.\n  const production = nxJson.namedInputs?.production ?? ['default'];\n  const nextProduction = [\n    ...production,\n    ...PYTHON_TEST_FILE_EXCLUSIONS.filter(\n      (exclusion) => !production.includes(exclusion),\n    ),\n  ];\n\n  const defaultInput = nxJson.namedInputs?.default;\n  let nextDefault = defaultInput;\n  if (defaultInput) {\n    const glob = DEPENDENT_TASKS_OUTPUT_FILES_INPUT.dependentTasksOutputFiles;\n    // Only an entry this plugin vended is rewritten; a different glob is the\n    // user's own scoping decision.\n    nextDefault = defaultInput.map((input) =>\n      typeof input === 'object' &&\n      input !== null &&\n      'dependentTasksOutputFiles' in input &&\n      PREVIOUSLY_VENDED_GLOBS.includes(\n        input.dependentTasksOutputFiles as string,\n      )\n        ? { ...input, dependentTasksOutputFiles: glob }\n        : input,\n    );\n    const hadVendedEntry = nextDefault.some(\n      (input) =>\n        typeof input === 'object' &&\n        input !== null &&\n        'dependentTasksOutputFiles' in input &&\n        input.dependentTasksOutputFiles === glob,\n    );\n    const hasCustomEntry = defaultInput.some(\n      (input) =>\n        typeof input === 'object' &&\n        input !== null &&\n        'dependentTasksOutputFiles' in input &&\n        !PREVIOUSLY_VENDED_GLOBS.includes(\n          input.dependentTasksOutputFiles as string,\n        ) &&\n        input.dependentTasksOutputFiles !== glob,\n    );\n    if (!hadVendedEntry && hasCustomEntry) {\n      nextSteps.push(\n        `nx.json's 'default' named input scopes 'dependentTasksOutputFiles' to a custom glob — left untouched. Narrow it to '${glob}' so timestamped test reports do not invalidate downstream tasks.`,\n      );\n    }\n  }\n\n  updateNxJson(tree, {\n    ...nxJson,\n    namedInputs: {\n      ...nxJson.namedInputs,\n      production: nextProduction,\n      ...(nextDefault ? { default: nextDefault } : {}),\n    },\n  });\n};\n\n/**\n * Scopes a Python project's build-chain targets to production sources. Only\n * targets still carrying the inputs the generator vended are rewritten, so a\n * project whose inputs the user has tuned is reported rather than clobbered.\n */\nconst migrateProjectTargets = (\n  tree: Tree,\n  projectName: string,\n  project: ProjectConfiguration,\n  nextSteps: string[],\n): void => {\n  let changed = false;\n\n  for (const [targetName, target] of Object.entries(project.targets ?? {})) {\n    if (\n      !PRODUCTION_SCOPED_TARGETS.includes(targetName) &&\n      !isOpenApiTarget(targetName, target)\n    ) {\n      continue;\n    }\n\n    const inputs = target.inputs;\n\n    // Already migrated, so a re-run is a no-op.\n    if (inputs && arraysEqual(inputs as unknown[], PRODUCTION_INPUTS)) {\n      continue;\n    }\n\n    // The OpenAPI targets declared no inputs at all, so they fell back to\n    // `default`. Everything else carried the vended pair.\n    const isVendedShape = inputs\n      ? arraysEqual(inputs as unknown[], PREVIOUS_INPUTS)\n      : isOpenApiTarget(targetName, target);\n\n    if (!isVendedShape) {\n      nextSteps.push(\n        `${projectName}:${targetName}: 'inputs' has diverged from the generated shape — left untouched. Scope it to ['production', '^production'] so Python test edits do not invalidate it.`,\n      );\n      continue;\n    }\n\n    target.inputs = [...PRODUCTION_INPUTS];\n    changed = true;\n  }\n\n  if (changed) {\n    updateProjectConfiguration(tree, projectName, project);\n  }\n};\n\nexport default async function migration(\n  tree: Tree,\n): Promise<MigrationReturnObject> {\n  const nextSteps: string[] = [];\n\n  migrateNamedInputs(tree, nextSteps);\n\n  for (const [projectName, project] of getProjects(tree)) {\n    if (!isPythonProject(project)) continue;\n    migrateProjectTargets(tree, projectName, project, nextSteps);\n  }\n\n  await formatFilesInSubtree(tree);\n\n  return { nextSteps };\n}\n"],"names":["getProjects","readNxJson","updateNxJson","updateProjectConfiguration","PYTHON_TEST_FILE_EXCLUSIONS","DEPENDENT_TASKS_OUTPUT_FILES_INPUT","formatFilesInSubtree","PRODUCTION_SCOPED_TARGETS","PRODUCTION_INPUTS","PREVIOUS_INPUTS","PREVIOUSLY_VENDED_GLOBS","isPythonProject","project","Object","values","targets","some","target","String","executor","startsWith","isOpenApiTarget","name","endsWith","outputs","output","includes","arraysEqual","a","b","length","every","entry","index","migrateNamedInputs","tree","nextSteps","nxJson","production","namedInputs","nextProduction","filter","exclusion","defaultInput","default","nextDefault","glob","dependentTasksOutputFiles","map","input","hadVendedEntry","hasCustomEntry","push","migrateProjectTargets","projectName","changed","targetName","entries","inputs","isVendedShape","migration"],"mappings":"AAAA;;;CAGC,GACD,SACEA,WAAW,EAGXC,UAAU,EAGVC,YAAY,EACZC,0BAA0B,QACrB,aAAa;AACpB,SAASC,2BAA2B,QAAQ,mCAAmC;AAC/E,SAASC,kCAAkC,QAAQ,+BAA+B;AAClF,SAASC,oBAAoB,QAAQ,2BAA2B;AAEhE;;;;;;;;;;;;;;CAcC,GAED,yEAAyE,GACzE,MAAMC,4BAA4B;IAAC;IAAW;IAAc;CAAa;AAEzE,qEAAqE,GACrE,MAAMC,oBAAoB;IAAC;IAAc;CAAc;AAEvD,8CAA8C,GAC9C,MAAMC,kBAAkB;IAAC;IAAW;CAAc;AAElD;;;CAGC,GACD,MAAMC,0BAA0B;IAAC;IAAQ;CAAU;AAEnD,MAAMC,kBAAkB,CAACC,UACvBC,OAAOC,MAAM,CAACF,QAAQG,OAAO,IAAI,CAAC,GAAGC,IAAI,CAAC,CAACC,SACzCC,OAAOD,QAAQE,YAAY,IAAIC,UAAU,CAAC;AAG9C;;;;;;CAMC,GACD,MAAMC,kBAAkB,CACtBC,MACAL;IAEA,IAAIK,SAAS,aAAa,CAACA,KAAKC,QAAQ,CAAC,aAAa,OAAO;IAC7D,IAAI,CAACN,QAAQ,OAAO;IACpB,OACEA,OAAOE,QAAQ,KAAK,qBACpB,AAACF,CAAAA,OAAOO,OAAO,IAAI,EAAE,AAAD,EAAGR,IAAI,CAAC,CAACS,SAAWA,OAAOC,QAAQ,CAAC;AAE5D;AAEA,MAAMC,cAAc,CAACC,GAAuBC,IAC1CD,EAAEE,MAAM,KAAKD,EAAEC,MAAM,IAAIF,EAAEG,KAAK,CAAC,CAACC,OAAOC,QAAUD,UAAUH,CAAC,CAACI,MAAM;AAEvE;;;CAGC,GACD,MAAMC,qBAAqB,CAACC,MAAYC;IACtC,MAAMC,SAASpC,WAAWkC;IAC1B,IAAI,CAACE,QAAQ;IAEb,0EAA0E;IAC1E,2EAA2E;IAC3E,gEAAgE;IAChE,MAAMC,aAAaD,OAAOE,WAAW,EAAED,cAAc;QAAC;KAAU;IAChE,MAAME,iBAAiB;WAClBF;WACAlC,4BAA4BqC,MAAM,CACnC,CAACC,YAAc,CAACJ,WAAWZ,QAAQ,CAACgB;KAEvC;IAED,MAAMC,eAAeN,OAAOE,WAAW,EAAEK;IACzC,IAAIC,cAAcF;IAClB,IAAIA,cAAc;QAChB,MAAMG,OAAOzC,mCAAmC0C,yBAAyB;QACzE,yEAAyE;QACzE,+BAA+B;QAC/BF,cAAcF,aAAaK,GAAG,CAAC,CAACC,QAC9B,OAAOA,UAAU,YACjBA,UAAU,QACV,+BAA+BA,SAC/BvC,wBAAwBgB,QAAQ,CAC9BuB,MAAMF,yBAAyB,IAE7B;gBAAE,GAAGE,KAAK;gBAAEF,2BAA2BD;YAAK,IAC5CG;QAEN,MAAMC,iBAAiBL,YAAY7B,IAAI,CACrC,CAACiC,QACC,OAAOA,UAAU,YACjBA,UAAU,QACV,+BAA+BA,SAC/BA,MAAMF,yBAAyB,KAAKD;QAExC,MAAMK,iBAAiBR,aAAa3B,IAAI,CACtC,CAACiC,QACC,OAAOA,UAAU,YACjBA,UAAU,QACV,+BAA+BA,SAC/B,CAACvC,wBAAwBgB,QAAQ,CAC/BuB,MAAMF,yBAAyB,KAEjCE,MAAMF,yBAAyB,KAAKD;QAExC,IAAI,CAACI,kBAAkBC,gBAAgB;YACrCf,UAAUgB,IAAI,CACZ,CAAC,oHAAoH,EAAEN,KAAK,iEAAiE,CAAC;QAElM;IACF;IAEA5C,aAAaiC,MAAM;QACjB,GAAGE,MAAM;QACTE,aAAa;YACX,GAAGF,OAAOE,WAAW;YACrBD,YAAYE;YACZ,GAAIK,cAAc;gBAAED,SAASC;YAAY,IAAI,CAAC,CAAC;QACjD;IACF;AACF;AAEA;;;;CAIC,GACD,MAAMQ,wBAAwB,CAC5BlB,MACAmB,aACA1C,SACAwB;IAEA,IAAImB,UAAU;IAEd,KAAK,MAAM,CAACC,YAAYvC,OAAO,IAAIJ,OAAO4C,OAAO,CAAC7C,QAAQG,OAAO,IAAI,CAAC,GAAI;QACxE,IACE,CAACR,0BAA0BmB,QAAQ,CAAC8B,eACpC,CAACnC,gBAAgBmC,YAAYvC,SAC7B;YACA;QACF;QAEA,MAAMyC,SAASzC,OAAOyC,MAAM;QAE5B,4CAA4C;QAC5C,IAAIA,UAAU/B,YAAY+B,QAAqBlD,oBAAoB;YACjE;QACF;QAEA,sEAAsE;QACtE,sDAAsD;QACtD,MAAMmD,gBAAgBD,SAClB/B,YAAY+B,QAAqBjD,mBACjCY,gBAAgBmC,YAAYvC;QAEhC,IAAI,CAAC0C,eAAe;YAClBvB,UAAUgB,IAAI,CACZ,GAAGE,YAAY,CAAC,EAAEE,WAAW,uJAAuJ,CAAC;YAEvL;QACF;QAEAvC,OAAOyC,MAAM,GAAG;eAAIlD;SAAkB;QACtC+C,UAAU;IACZ;IAEA,IAAIA,SAAS;QACXpD,2BAA2BgC,MAAMmB,aAAa1C;IAChD;AACF;AAEA,eAAe,eAAegD,UAC5BzB,IAAU;IAEV,MAAMC,YAAsB,EAAE;IAE9BF,mBAAmBC,MAAMC;IAEzB,KAAK,MAAM,CAACkB,aAAa1C,QAAQ,IAAIZ,YAAYmC,MAAO;QACtD,IAAI,CAACxB,gBAAgBC,UAAU;QAC/ByC,sBAAsBlB,MAAMmB,aAAa1C,SAASwB;IACpD;IAEA,MAAM9B,qBAAqB6B;IAE3B,OAAO;QAAEC;IAAU;AACrB"}

package/src/migrations/latest/terraform-fmt-check/metadata.json

@@ -0,0 +1,3 @@
+{
+  "description": "Make the terraform fmt target check formatting rather than rewrite its own inputs, moving the write to a fix configuration, and add a lint target which orchestrates it"
+}

package/src/migrations/latest/terraform-fmt-check/migration.d.ts

@@ -0,0 +1,6 @@
+/**
+ * Copyright Amazon.com, Inc. or its affiliates. All Rights Reserved.
+ * SPDX-License-Identifier: Apache-2.0
+ */
+import { type MigrationReturnObject, type Tree } from '@nx/devkit';
+export default function migration(tree: Tree): Promise<MigrationReturnObject>;