@aws/nx-plugin 1.0.0-rc.9 → 1.0.0-rc.90

package/src/migrations/latest/add-destroy-sandbox-target/migration.d.ts

@@ -0,0 +1,6 @@
+/**
+ * Copyright Amazon.com, Inc. or its affiliates. All Rights Reserved.
+ * SPDX-License-Identifier: Apache-2.0
+ */
+import { type MigrationReturnObject, type Tree } from '@nx/devkit';
+export default function migration(tree: Tree): Promise<MigrationReturnObject>;

package/src/migrations/latest/add-destroy-sandbox-target/migration.js

@@ -0,0 +1,150 @@
+/**
+ * Copyright Amazon.com, Inc. or its affiliates. All Rights Reserved.
+ * SPDX-License-Identifier: Apache-2.0
+ */ import { getProjects, joinPathFragments, updateProjectConfiguration } from "@nx/devkit";
+import { readFileSync } from "fs";
+import { join } from "path";
+import { INFRA_APP_GENERATOR_INFO } from "../../../infra/app/generator.js";
+import { captureGritQLVariable } from "../../../utils/ast.js";
+import { formatFilesInSubtree } from "../../../utils/format.js";
+import { normalizeTargetKeyOrder } from "../../../utils/nx.js";
+import { sortObjectKeys } from "../../../utils/object.js";
+import { PACKAGES_DIR, SHARED_SCRIPTS_DIR } from "../../../utils/shared-constructs-constants.js";
+/**
+ * CDK infrastructure projects gained a `destroy-sandbox` target, mirroring
+ * `deploy-sandbox`: it tears down the sandbox stage without the user having to
+ * spell out its stage pattern (`nx destroy-sandbox infra` rather than
+ * `nx destroy infra "my-app-infra-sandbox/*"`).
+ *
+ * The stage id is read from `main.ts` rather than recomputed from the project
+ * name, so a project whose sandbox stage has been renamed gets a target that
+ * destroys the stage it actually declares.
+ *
+ * The destroy targets also drop `--require-approval=never`. `cdk destroy` has no
+ * such option, so it only warns that the flag is being ignored. The same fix
+ * lands in the vended `buildCdkCommand`, which builds the command for
+ * `stageConfig` workspaces.
+ *
+ * How to write a migration:
+ * - https://nx.dev/docs/kb/migration-generators
+ * - What `nextSteps` means: https://nx.dev/docs/reference/devkit/MigrationReturnObject
+ */ const TARGET = 'destroy-sandbox';
+/** The destroy targets the ignored flag is stripped from. */ const DESTROY_TARGETS = [
+    'destroy',
+    'destroy-ci'
+];
+/** `cdk destroy` has no such option, so it only warns and carries on. */ const IGNORED_APPROVAL_FLAG = /\s*--require-approval(=\S*)?/;
+/**
+ * Matches `new ApplicationStage(app, '<id>-sandbox', { ... })`, binding the
+ * quoted stage id. The regex spans the quotes because it is matched against the
+ * whole string literal node; both quote styles are accepted since the user's
+ * formatter may have rewritten them.
+ *
+ * `main.ts` can declare several stages (beta, prod), so the pattern selects the
+ * sandbox one rather than whichever comes first.
+ */ const SANDBOX_STAGE_PATTERN = '`new ApplicationStage($app, $id, $props)` where { $id <: r"[\'\\"].*-sandbox[\'\\"]" }';
+/** The id of the sandbox stage a project's `main.ts` instantiates. */ const sandboxStageId = async (tree, projectRoot)=>{
+    const captured = await captureGritQLVariable(tree, joinPathFragments(projectRoot, 'src', 'main.ts'), SANDBOX_STAGE_PATTERN, 'id');
+    // The binding keeps the quotes from the source.
+    return captured?.slice(1, -1);
+};
+/**
+ * Strip the ignored `--require-approval` from a `cdk destroy` command. Returns
+ * undefined when the command isn't the shape the generator produced, or the flag
+ * is already gone.
+ */ const withoutApprovalFlag = (command)=>{
+    if (typeof command !== 'string' || !command.includes('cdk destroy')) {
+        return undefined;
+    }
+    if (!IGNORED_APPROVAL_FLAG.test(command)) return undefined;
+    return command.replace(IGNORED_APPROVAL_FLAG, '');
+};
+/** Drops the ignored approval flag from the project's destroy targets. */ const migrateDestroyFlags = (project)=>{
+    let changed = false;
+    for (const name of DESTROY_TARGETS){
+        const target = project.targets?.[name];
+        const command = withoutApprovalFlag(target?.options?.command);
+        if (command) {
+            target.options = {
+                ...target.options,
+                command
+            };
+            changed = true;
+        }
+    }
+    return changed;
+};
+/** Path the shared scripts package vends the CDK command builder at. */ const CDK_COMMAND_PATH = joinPathFragments(PACKAGES_DIR, SHARED_SCRIPTS_DIR, 'src/infra/stage-credentials/cdk-command.ts');
+/** The builder as it stands today. The template carries no EJS variables. */ const CDK_COMMAND_TEMPLATE = readFileSync(join(import.meta.dirname, '../../../utils/files/common/scripts/src/infra/stage-credentials/cdk-command.ts.template'), 'utf-8');
+/**
+ * Re-vends the CDK command builder, which no longer adds `--require-approval`
+ * for the `destroy` action. Only the shape the generator produced is replaced: a
+ * customised copy is the user's, so it is reported instead.
+ */ const migrateCdkCommandBuilder = (tree, nextSteps)=>{
+    if (!tree.exists(CDK_COMMAND_PATH)) return;
+    const current = tree.read(CDK_COMMAND_PATH).toString();
+    // Already migrated, so a re-run is a no-op.
+    if (current.includes("action === 'destroy'")) return;
+    if (!current.includes('hasRequireApproval')) {
+        nextSteps.push(`${CDK_COMMAND_PATH}: has diverged from the generated shape — left untouched. Have it skip \`--require-approval\` for the \`destroy\` action, which has no such option.`);
+        return;
+    }
+    tree.write(CDK_COMMAND_PATH, CDK_COMMAND_TEMPLATE);
+};
+/** Adds the `destroy-sandbox` target, mirroring the project's `destroy`. */ const addSandboxTarget = async (tree, projectName, project, nextSteps)=>{
+    // The new target mirrors `destroy`, so it inherits whatever that resolved to
+    // when the project was generated: the `tsx` credential-resolving script
+    // under `stageConfig`, plain `cdk destroy` otherwise.
+    const destroy = project.targets.destroy;
+    const command = destroy?.options?.command;
+    const mainPath = joinPathFragments(project.root, 'src/main.ts');
+    const stageId = await sandboxStageId(tree, project.root);
+    if (typeof command !== 'string') {
+        nextSteps.push(`Add a '${TARGET}' target to ${projectName} by hand if necessary — its 'destroy' target no longer matches the shape the generator produced.`);
+        return false;
+    }
+    if (!stageId) {
+        nextSteps.push(`Add a '${TARGET}' target to ${projectName} by hand if necessary — no sandbox stage was found in ${mainPath}.`);
+        return false;
+    }
+    project.targets[TARGET] = normalizeTargetKeyOrder({
+        executor: destroy.executor,
+        ...destroy.dependsOn ? {
+            dependsOn: [
+                ...destroy.dependsOn
+            ]
+        } : {},
+        // Quoted so the shell does not glob the `*`.
+        options: {
+            ...destroy.options,
+            command: `${command} "${stageId}/*"`
+        }
+    });
+    return true;
+};
+export default async function migration(tree) {
+    const nextSteps = [];
+    for (const [projectName, project] of getProjects(tree)){
+        const generator = project.metadata?.generator;
+        // Not a CDK infrastructure project.
+        if (generator !== INFRA_APP_GENERATOR_INFO.id) continue;
+        // Corrected first so the new target inherits the fixed command.
+        let changed = migrateDestroyFlags(project);
+        if (!project.targets?.[TARGET]) {
+            changed = await addSandboxTarget(tree, projectName, project, nextSteps) || changed;
+        }
+        if (changed) {
+            updateProjectConfiguration(tree, projectName, {
+                ...project,
+                targets: sortObjectKeys(project.targets)
+            });
+        }
+    }
+    migrateCdkCommandBuilder(tree, nextSteps);
+    await formatFilesInSubtree(tree);
+    return {
+        nextSteps
+    };
+}
+
+//# sourceMappingURL=migration.js.map

package/src/migrations/latest/add-destroy-sandbox-target/migration.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../../../../../../../packages/nx-plugin/src/migrations/latest/add-destroy-sandbox-target/migration.ts"],"sourcesContent":["/**\n * Copyright Amazon.com, Inc. or its affiliates. All Rights Reserved.\n * SPDX-License-Identifier: Apache-2.0\n */\nimport {\n  getProjects,\n  joinPathFragments,\n  type MigrationReturnObject,\n  type ProjectConfiguration,\n  type Tree,\n  updateProjectConfiguration,\n} from '@nx/devkit';\nimport { readFileSync } from 'fs';\nimport { join } from 'path';\nimport { INFRA_APP_GENERATOR_INFO } from '../../../infra/app/generator.js';\nimport { captureGritQLVariable } from '../../../utils/ast.js';\nimport { formatFilesInSubtree } from '../../../utils/format.js';\nimport { normalizeTargetKeyOrder } from '../../../utils/nx.js';\nimport { sortObjectKeys } from '../../../utils/object.js';\nimport {\n  PACKAGES_DIR,\n  SHARED_SCRIPTS_DIR,\n} from '../../../utils/shared-constructs-constants.js';\n\n/**\n * CDK infrastructure projects gained a `destroy-sandbox` target, mirroring\n * `deploy-sandbox`: it tears down the sandbox stage without the user having to\n * spell out its stage pattern (`nx destroy-sandbox infra` rather than\n * `nx destroy infra \"my-app-infra-sandbox/*\"`).\n *\n * The stage id is read from `main.ts` rather than recomputed from the project\n * name, so a project whose sandbox stage has been renamed gets a target that\n * destroys the stage it actually declares.\n *\n * The destroy targets also drop `--require-approval=never`. `cdk destroy` has no\n * such option, so it only warns that the flag is being ignored. The same fix\n * lands in the vended `buildCdkCommand`, which builds the command for\n * `stageConfig` workspaces.\n *\n * How to write a migration:\n * - https://nx.dev/docs/kb/migration-generators\n * - What `nextSteps` means: https://nx.dev/docs/reference/devkit/MigrationReturnObject\n */\n\nconst TARGET = 'destroy-sandbox';\n\n/** The destroy targets the ignored flag is stripped from. */\nconst DESTROY_TARGETS = ['destroy', 'destroy-ci'] as const;\n\n/** `cdk destroy` has no such option, so it only warns and carries on. */\nconst IGNORED_APPROVAL_FLAG = /\\s*--require-approval(=\\S*)?/;\n\n/**\n * Matches `new ApplicationStage(app, '<id>-sandbox', { ... })`, binding the\n * quoted stage id. The regex spans the quotes because it is matched against the\n * whole string literal node; both quote styles are accepted since the user's\n * formatter may have rewritten them.\n *\n * `main.ts` can declare several stages (beta, prod), so the pattern selects the\n * sandbox one rather than whichever comes first.\n */\nconst SANDBOX_STAGE_PATTERN =\n  '`new ApplicationStage($app, $id, $props)` where { $id <: r\"[\\'\\\\\"].*-sandbox[\\'\\\\\"]\" }';\n\n/** The id of the sandbox stage a project's `main.ts` instantiates. */\nconst sandboxStageId = async (\n  tree: Tree,\n  projectRoot: string,\n): Promise<string | undefined> => {\n  const captured = await captureGritQLVariable(\n    tree,\n    joinPathFragments(projectRoot, 'src', 'main.ts'),\n    SANDBOX_STAGE_PATTERN,\n    'id',\n  );\n  // The binding keeps the quotes from the source.\n  return captured?.slice(1, -1);\n};\n\n/**\n * Strip the ignored `--require-approval` from a `cdk destroy` command. Returns\n * undefined when the command isn't the shape the generator produced, or the flag\n * is already gone.\n */\nconst withoutApprovalFlag = (command: unknown): string | undefined => {\n  if (typeof command !== 'string' || !command.includes('cdk destroy')) {\n    return undefined;\n  }\n  if (!IGNORED_APPROVAL_FLAG.test(command)) return undefined;\n  return command.replace(IGNORED_APPROVAL_FLAG, '');\n};\n\n/** Drops the ignored approval flag from the project's destroy targets. */\nconst migrateDestroyFlags = (project: ProjectConfiguration): boolean => {\n  let changed = false;\n  for (const name of DESTROY_TARGETS) {\n    const target = project.targets?.[name];\n    const command = withoutApprovalFlag(target?.options?.command);\n    if (command) {\n      target.options = { ...target.options, command };\n      changed = true;\n    }\n  }\n  return changed;\n};\n\n/** Path the shared scripts package vends the CDK command builder at. */\nconst CDK_COMMAND_PATH = joinPathFragments(\n  PACKAGES_DIR,\n  SHARED_SCRIPTS_DIR,\n  'src/infra/stage-credentials/cdk-command.ts',\n);\n\n/** The builder as it stands today. The template carries no EJS variables. */\nconst CDK_COMMAND_TEMPLATE = readFileSync(\n  join(\n    import.meta.dirname,\n    '../../../utils/files/common/scripts/src/infra/stage-credentials/cdk-command.ts.template',\n  ),\n  'utf-8',\n);\n\n/**\n * Re-vends the CDK command builder, which no longer adds `--require-approval`\n * for the `destroy` action. Only the shape the generator produced is replaced: a\n * customised copy is the user's, so it is reported instead.\n */\nconst migrateCdkCommandBuilder = (tree: Tree, nextSteps: string[]): void => {\n  if (!tree.exists(CDK_COMMAND_PATH)) return;\n\n  const current = tree.read(CDK_COMMAND_PATH)!.toString();\n  // Already migrated, so a re-run is a no-op.\n  if (current.includes(\"action === 'destroy'\")) return;\n\n  if (!current.includes('hasRequireApproval')) {\n    nextSteps.push(\n      `${CDK_COMMAND_PATH}: has diverged from the generated shape — left untouched. Have it skip \\`--require-approval\\` for the \\`destroy\\` action, which has no such option.`,\n    );\n    return;\n  }\n\n  tree.write(CDK_COMMAND_PATH, CDK_COMMAND_TEMPLATE);\n};\n\n/** Adds the `destroy-sandbox` target, mirroring the project's `destroy`. */\nconst addSandboxTarget = async (\n  tree: Tree,\n  projectName: string,\n  project: ProjectConfiguration,\n  nextSteps: string[],\n): Promise<boolean> => {\n  // The new target mirrors `destroy`, so it inherits whatever that resolved to\n  // when the project was generated: the `tsx` credential-resolving script\n  // under `stageConfig`, plain `cdk destroy` otherwise.\n  const destroy = project.targets.destroy;\n  const command = destroy?.options?.command;\n  const mainPath = joinPathFragments(project.root, 'src/main.ts');\n  const stageId = await sandboxStageId(tree, project.root);\n\n  if (typeof command !== 'string') {\n    nextSteps.push(\n      `Add a '${TARGET}' target to ${projectName} by hand if necessary — its 'destroy' target no longer matches the shape the generator produced.`,\n    );\n    return false;\n  }\n  if (!stageId) {\n    nextSteps.push(\n      `Add a '${TARGET}' target to ${projectName} by hand if necessary — no sandbox stage was found in ${mainPath}.`,\n    );\n    return false;\n  }\n\n  project.targets[TARGET] = normalizeTargetKeyOrder({\n    executor: destroy.executor,\n    ...(destroy.dependsOn ? { dependsOn: [...destroy.dependsOn] } : {}),\n    // Quoted so the shell does not glob the `*`.\n    options: { ...destroy.options, command: `${command} \"${stageId}/*\"` },\n  });\n  return true;\n};\n\nexport default async function migration(\n  tree: Tree,\n): Promise<MigrationReturnObject> {\n  const nextSteps: string[] = [];\n\n  for (const [projectName, project] of getProjects(tree)) {\n    const generator = (project.metadata as { generator?: string } | undefined)\n      ?.generator;\n    // Not a CDK infrastructure project.\n    if (generator !== INFRA_APP_GENERATOR_INFO.id) continue;\n\n    // Corrected first so the new target inherits the fixed command.\n    let changed = migrateDestroyFlags(project);\n\n    if (!project.targets?.[TARGET]) {\n      changed =\n        (await addSandboxTarget(tree, projectName, project, nextSteps)) ||\n        changed;\n    }\n\n    if (changed) {\n      updateProjectConfiguration(tree, projectName, {\n        ...project,\n        targets: sortObjectKeys(project.targets),\n      });\n    }\n  }\n\n  migrateCdkCommandBuilder(tree, nextSteps);\n\n  await formatFilesInSubtree(tree);\n\n  return { nextSteps };\n}\n"],"names":["getProjects","joinPathFragments","updateProjectConfiguration","readFileSync","join","INFRA_APP_GENERATOR_INFO","captureGritQLVariable","formatFilesInSubtree","normalizeTargetKeyOrder","sortObjectKeys","PACKAGES_DIR","SHARED_SCRIPTS_DIR","TARGET","DESTROY_TARGETS","IGNORED_APPROVAL_FLAG","SANDBOX_STAGE_PATTERN","sandboxStageId","tree","projectRoot","captured","slice","withoutApprovalFlag","command","includes","undefined","test","replace","migrateDestroyFlags","project","changed","name","target","targets","options","CDK_COMMAND_PATH","CDK_COMMAND_TEMPLATE","dirname","migrateCdkCommandBuilder","nextSteps","exists","current","read","toString","push","write","addSandboxTarget","projectName","destroy","mainPath","root","stageId","executor","dependsOn","migration","generator","metadata","id"],"mappings":"AAAA;;;CAGC,GACD,SACEA,WAAW,EACXC,iBAAiB,EAIjBC,0BAA0B,QACrB,aAAa;AACpB,SAASC,YAAY,QAAQ,KAAK;AAClC,SAASC,IAAI,QAAQ,OAAO;AAC5B,SAASC,wBAAwB,QAAQ,kCAAkC;AAC3E,SAASC,qBAAqB,QAAQ,wBAAwB;AAC9D,SAASC,oBAAoB,QAAQ,2BAA2B;AAChE,SAASC,uBAAuB,QAAQ,uBAAuB;AAC/D,SAASC,cAAc,QAAQ,2BAA2B;AAC1D,SACEC,YAAY,EACZC,kBAAkB,QACb,gDAAgD;AAEvD;;;;;;;;;;;;;;;;;;CAkBC,GAED,MAAMC,SAAS;AAEf,2DAA2D,GAC3D,MAAMC,kBAAkB;IAAC;IAAW;CAAa;AAEjD,uEAAuE,GACvE,MAAMC,wBAAwB;AAE9B;;;;;;;;CAQC,GACD,MAAMC,wBACJ;AAEF,oEAAoE,GACpE,MAAMC,iBAAiB,OACrBC,MACAC;IAEA,MAAMC,WAAW,MAAMb,sBACrBW,MACAhB,kBAAkBiB,aAAa,OAAO,YACtCH,uBACA;IAEF,gDAAgD;IAChD,OAAOI,UAAUC,MAAM,GAAG,CAAC;AAC7B;AAEA;;;;CAIC,GACD,MAAMC,sBAAsB,CAACC;IAC3B,IAAI,OAAOA,YAAY,YAAY,CAACA,QAAQC,QAAQ,CAAC,gBAAgB;QACnE,OAAOC;IACT;IACA,IAAI,CAACV,sBAAsBW,IAAI,CAACH,UAAU,OAAOE;IACjD,OAAOF,QAAQI,OAAO,CAACZ,uBAAuB;AAChD;AAEA,wEAAwE,GACxE,MAAMa,sBAAsB,CAACC;IAC3B,IAAIC,UAAU;IACd,KAAK,MAAMC,QAAQjB,gBAAiB;QAClC,MAAMkB,SAASH,QAAQI,OAAO,EAAE,CAACF,KAAK;QACtC,MAAMR,UAAUD,oBAAoBU,QAAQE,SAASX;QACrD,IAAIA,SAAS;YACXS,OAAOE,OAAO,GAAG;gBAAE,GAAGF,OAAOE,OAAO;gBAAEX;YAAQ;YAC9CO,UAAU;QACZ;IACF;IACA,OAAOA;AACT;AAEA,sEAAsE,GACtE,MAAMK,mBAAmBjC,kBACvBS,cACAC,oBACA;AAGF,2EAA2E,GAC3E,MAAMwB,uBAAuBhC,aAC3BC,KACE,YAAYgC,OAAO,EACnB,4FAEF;AAGF;;;;CAIC,GACD,MAAMC,2BAA2B,CAACpB,MAAYqB;IAC5C,IAAI,CAACrB,KAAKsB,MAAM,CAACL,mBAAmB;IAEpC,MAAMM,UAAUvB,KAAKwB,IAAI,CAACP,kBAAmBQ,QAAQ;IACrD,4CAA4C;IAC5C,IAAIF,QAAQjB,QAAQ,CAAC,yBAAyB;IAE9C,IAAI,CAACiB,QAAQjB,QAAQ,CAAC,uBAAuB;QAC3Ce,UAAUK,IAAI,CACZ,GAAGT,iBAAiB,mJAAmJ,CAAC;QAE1K;IACF;IAEAjB,KAAK2B,KAAK,CAACV,kBAAkBC;AAC/B;AAEA,0EAA0E,GAC1E,MAAMU,mBAAmB,OACvB5B,MACA6B,aACAlB,SACAU;IAEA,6EAA6E;IAC7E,wEAAwE;IACxE,sDAAsD;IACtD,MAAMS,UAAUnB,QAAQI,OAAO,CAACe,OAAO;IACvC,MAAMzB,UAAUyB,SAASd,SAASX;IAClC,MAAM0B,WAAW/C,kBAAkB2B,QAAQqB,IAAI,EAAE;IACjD,MAAMC,UAAU,MAAMlC,eAAeC,MAAMW,QAAQqB,IAAI;IAEvD,IAAI,OAAO3B,YAAY,UAAU;QAC/BgB,UAAUK,IAAI,CACZ,CAAC,OAAO,EAAE/B,OAAO,YAAY,EAAEkC,YAAY,gGAAgG,CAAC;QAE9I,OAAO;IACT;IACA,IAAI,CAACI,SAAS;QACZZ,UAAUK,IAAI,CACZ,CAAC,OAAO,EAAE/B,OAAO,YAAY,EAAEkC,YAAY,sDAAsD,EAAEE,SAAS,CAAC,CAAC;QAEhH,OAAO;IACT;IAEApB,QAAQI,OAAO,CAACpB,OAAO,GAAGJ,wBAAwB;QAChD2C,UAAUJ,QAAQI,QAAQ;QAC1B,GAAIJ,QAAQK,SAAS,GAAG;YAAEA,WAAW;mBAAIL,QAAQK,SAAS;aAAC;QAAC,IAAI,CAAC,CAAC;QAClE,6CAA6C;QAC7CnB,SAAS;YAAE,GAAGc,QAAQd,OAAO;YAAEX,SAAS,GAAGA,QAAQ,EAAE,EAAE4B,QAAQ,GAAG,CAAC;QAAC;IACtE;IACA,OAAO;AACT;AAEA,eAAe,eAAeG,UAC5BpC,IAAU;IAEV,MAAMqB,YAAsB,EAAE;IAE9B,KAAK,MAAM,CAACQ,aAAalB,QAAQ,IAAI5B,YAAYiB,MAAO;QACtD,MAAMqC,YAAa1B,QAAQ2B,QAAQ,EAC/BD;QACJ,oCAAoC;QACpC,IAAIA,cAAcjD,yBAAyBmD,EAAE,EAAE;QAE/C,gEAAgE;QAChE,IAAI3B,UAAUF,oBAAoBC;QAElC,IAAI,CAACA,QAAQI,OAAO,EAAE,CAACpB,OAAO,EAAE;YAC9BiB,UACE,AAAC,MAAMgB,iBAAiB5B,MAAM6B,aAAalB,SAASU,cACpDT;QACJ;QAEA,IAAIA,SAAS;YACX3B,2BAA2Be,MAAM6B,aAAa;gBAC5C,GAAGlB,OAAO;gBACVI,SAASvB,eAAemB,QAAQI,OAAO;YACzC;QACF;IACF;IAEAK,yBAAyBpB,MAAMqB;IAE/B,MAAM/B,qBAAqBU;IAE3B,OAAO;QAAEqB;IAAU;AACrB"}

package/src/migrations/latest/declare-cacheable-target-inputs/metadata.json

@@ -0,0 +1,3 @@
+{
+  "description": "Declare explicit inputs on cacheable bundle, openapi, operations and checkov targets so they no longer read a dependency's whole project directory through Nx's implicit inputs"
+}

package/src/migrations/latest/declare-cacheable-target-inputs/migration.d.ts

@@ -0,0 +1,6 @@
+/**
+ * Copyright Amazon.com, Inc. or its affiliates. All Rights Reserved.
+ * SPDX-License-Identifier: Apache-2.0
+ */
+import { type MigrationReturnObject, type Tree } from '@nx/devkit';
+export default function migration(tree: Tree): Promise<MigrationReturnObject>;

package/src/migrations/latest/declare-cacheable-target-inputs/migration.js

@@ -0,0 +1,94 @@
+/**
+ * Copyright Amazon.com, Inc. or its affiliates. All Rights Reserved.
+ * SPDX-License-Identifier: Apache-2.0
+ */ import { getProjects, updateProjectConfiguration } from "@nx/devkit";
+import { formatFilesInSubtree } from "../../../utils/format.js";
+/**
+ * A cacheable target declaring no `inputs` gets Nx's implicit
+ * `["default", "^default"]`, which reads a dependency's whole project directory
+ * — its README, its dev scripts, everything. That is wider than the explicit
+ * inputs its siblings carry, so editing a dependency's README re-ran targets
+ * whose output could not possibly change.
+ *
+ * Which explicit inputs are right depends on whether the target has a
+ * `dependsOn`. `default` carries a transitive `dependentTasksOutputFiles` entry,
+ * which Nx resolves against the task's upstream tasks — so a target with an
+ * upstream task still hashes the dependency output it consumes through it, and
+ * `["default"]` is enough. A target with no `dependsOn` has nothing for that
+ * entry to resolve against, so `default` collapses to the project's own files
+ * and dropping `^default` would remove the last edge to the dependency. Those
+ * keep a dependency input: `["default", "^production"]`.
+ */ /** Targets whose `dependsOn` keeps the dependency edge inside `default`. */ const DEFAULT_ONLY_NAMES = [
+    'bundle',
+    'bundle-migration',
+    'bundle-create-db-user',
+    'operations'
+];
+/**
+ * Suffix of the OpenAPI spec targets, which carry a per-agent prefix
+ * (`my-agent-openapi`) on a project hosting more than one.
+ *
+ * These have no `dependsOn`, and their spec serialises models a dependency may
+ * own, so they keep a dependency input — without it a dependency's model change
+ * serves a stale spec, and that spec feeds client generation.
+ */ const OPENAPI_SUFFIX = 'openapi';
+const CHECKOV_TARGET = 'checkov';
+/**
+ * Inputs for a target with no upstream task to resolve `default`'s transitive
+ * `dependentTasksOutputFiles` against. `^production` rather than `^default` so a
+ * dependency's test edits still do not invalidate it.
+ */ const WITH_DEPENDENCY_INPUTS = [
+    'default',
+    '^production'
+];
+/** Whether a target is one of the ones narrowed to `["default"]`. */ const isDefaultOnlyTarget = (name)=>DEFAULT_ONLY_NAMES.includes(name);
+/** Whether a target is an OpenAPI spec target, which has no `dependsOn`. */ const isOpenApiTarget = (name)=>name === OPENAPI_SUFFIX || name.endsWith(`-${OPENAPI_SUFFIX}`);
+/**
+ * Whether a target still looks like the one the generators produced: a
+ * run-commands target declaring where it writes. A target with no declared
+ * outputs is not one of ours, and is the user's to scope since only they know
+ * what it reads.
+ *
+ * The location is not checked. `operations` writes generated Terraform sources
+ * under `packages/common/terraform/src/generated/`, not `dist`, so requiring
+ * `dist` would mean this migration could never match a real one.
+ */ const matchesVendedShape = (target)=>target.executor === 'nx:run-commands' && Array.isArray(target.outputs) && target.outputs.length > 0 && target.outputs.every((output)=>typeof output === 'string');
+/** The inputs a target should declare, or undefined to leave it alone. */ const inputsFor = (name, target)=>{
+    // Only a cacheable target with no inputs at all falls back to Nx's implicit
+    // ones, so one already declaring inputs is left as it is — which also makes
+    // re-running this a no-op.
+    if (!target.cache || target.inputs) return undefined;
+    if (!matchesVendedShape(target)) return undefined;
+    // `checkov` resolves the relative Terraform modules a project consumes, so it
+    // keeps a dependency edge rather than dropping one.
+    if (name === CHECKOV_TARGET || isOpenApiTarget(name)) {
+        return WITH_DEPENDENCY_INPUTS;
+    }
+    return isDefaultOnlyTarget(name) ? [
+        'default'
+    ] : undefined;
+};
+export default async function migration(tree) {
+    const nextSteps = [];
+    for (const [projectName, project] of getProjects(tree)){
+        let changed = false;
+        for (const [name, target] of Object.entries(project.targets ?? {})){
+            const inputs = inputsFor(name, target);
+            if (!inputs) continue;
+            project.targets[name] = {
+                ...target,
+                inputs
+            };
+            changed = true;
+        }
+        if (changed) {
+            updateProjectConfiguration(tree, projectName, project);
+        }
+    }
+    await formatFilesInSubtree(tree);
+    return {
+        nextSteps
+    };
+}
+
+//# sourceMappingURL=migration.js.map

package/src/migrations/latest/declare-cacheable-target-inputs/migration.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../../../../../../../packages/nx-plugin/src/migrations/latest/declare-cacheable-target-inputs/migration.ts"],"sourcesContent":["/**\n * Copyright Amazon.com, Inc. or its affiliates. All Rights Reserved.\n * SPDX-License-Identifier: Apache-2.0\n */\nimport {\n  getProjects,\n  type MigrationReturnObject,\n  type TargetConfiguration,\n  type Tree,\n  updateProjectConfiguration,\n} from '@nx/devkit';\nimport { formatFilesInSubtree } from '../../../utils/format.js';\n\n/**\n * A cacheable target declaring no `inputs` gets Nx's implicit\n * `[\"default\", \"^default\"]`, which reads a dependency's whole project directory\n * — its README, its dev scripts, everything. That is wider than the explicit\n * inputs its siblings carry, so editing a dependency's README re-ran targets\n * whose output could not possibly change.\n *\n * Which explicit inputs are right depends on whether the target has a\n * `dependsOn`. `default` carries a transitive `dependentTasksOutputFiles` entry,\n * which Nx resolves against the task's upstream tasks — so a target with an\n * upstream task still hashes the dependency output it consumes through it, and\n * `[\"default\"]` is enough. A target with no `dependsOn` has nothing for that\n * entry to resolve against, so `default` collapses to the project's own files\n * and dropping `^default` would remove the last edge to the dependency. Those\n * keep a dependency input: `[\"default\", \"^production\"]`.\n */\n\n/** Targets whose `dependsOn` keeps the dependency edge inside `default`. */\nconst DEFAULT_ONLY_NAMES = [\n  'bundle',\n  'bundle-migration',\n  'bundle-create-db-user',\n  'operations',\n];\n\n/**\n * Suffix of the OpenAPI spec targets, which carry a per-agent prefix\n * (`my-agent-openapi`) on a project hosting more than one.\n *\n * These have no `dependsOn`, and their spec serialises models a dependency may\n * own, so they keep a dependency input — without it a dependency's model change\n * serves a stale spec, and that spec feeds client generation.\n */\nconst OPENAPI_SUFFIX = 'openapi';\n\nconst CHECKOV_TARGET = 'checkov';\n\n/**\n * Inputs for a target with no upstream task to resolve `default`'s transitive\n * `dependentTasksOutputFiles` against. `^production` rather than `^default` so a\n * dependency's test edits still do not invalidate it.\n */\nconst WITH_DEPENDENCY_INPUTS = ['default', '^production'];\n\n/** Whether a target is one of the ones narrowed to `[\"default\"]`. */\nconst isDefaultOnlyTarget = (name: string): boolean =>\n  DEFAULT_ONLY_NAMES.includes(name);\n\n/** Whether a target is an OpenAPI spec target, which has no `dependsOn`. */\nconst isOpenApiTarget = (name: string): boolean =>\n  name === OPENAPI_SUFFIX || name.endsWith(`-${OPENAPI_SUFFIX}`);\n\n/**\n * Whether a target still looks like the one the generators produced: a\n * run-commands target declaring where it writes. A target with no declared\n * outputs is not one of ours, and is the user's to scope since only they know\n * what it reads.\n *\n * The location is not checked. `operations` writes generated Terraform sources\n * under `packages/common/terraform/src/generated/`, not `dist`, so requiring\n * `dist` would mean this migration could never match a real one.\n */\nconst matchesVendedShape = (target: TargetConfiguration): boolean =>\n  target.executor === 'nx:run-commands' &&\n  Array.isArray(target.outputs) &&\n  target.outputs.length > 0 &&\n  target.outputs.every((output) => typeof output === 'string');\n\n/** The inputs a target should declare, or undefined to leave it alone. */\nconst inputsFor = (\n  name: string,\n  target: TargetConfiguration,\n): string[] | undefined => {\n  // Only a cacheable target with no inputs at all falls back to Nx's implicit\n  // ones, so one already declaring inputs is left as it is — which also makes\n  // re-running this a no-op.\n  if (!target.cache || target.inputs) return undefined;\n  if (!matchesVendedShape(target)) return undefined;\n  // `checkov` resolves the relative Terraform modules a project consumes, so it\n  // keeps a dependency edge rather than dropping one.\n  if (name === CHECKOV_TARGET || isOpenApiTarget(name)) {\n    return WITH_DEPENDENCY_INPUTS;\n  }\n  return isDefaultOnlyTarget(name) ? ['default'] : undefined;\n};\n\nexport default async function migration(\n  tree: Tree,\n): Promise<MigrationReturnObject> {\n  const nextSteps: string[] = [];\n\n  for (const [projectName, project] of getProjects(tree)) {\n    let changed = false;\n\n    for (const [name, target] of Object.entries(project.targets ?? {})) {\n      const inputs = inputsFor(name, target);\n      if (!inputs) continue;\n\n      project.targets[name] = { ...target, inputs };\n      changed = true;\n    }\n\n    if (changed) {\n      updateProjectConfiguration(tree, projectName, project);\n    }\n  }\n\n  await formatFilesInSubtree(tree);\n\n  return { nextSteps };\n}\n"],"names":["getProjects","updateProjectConfiguration","formatFilesInSubtree","DEFAULT_ONLY_NAMES","OPENAPI_SUFFIX","CHECKOV_TARGET","WITH_DEPENDENCY_INPUTS","isDefaultOnlyTarget","name","includes","isOpenApiTarget","endsWith","matchesVendedShape","target","executor","Array","isArray","outputs","length","every","output","inputsFor","cache","inputs","undefined","migration","tree","nextSteps","projectName","project","changed","Object","entries","targets"],"mappings":"AAAA;;;CAGC,GACD,SACEA,WAAW,EAIXC,0BAA0B,QACrB,aAAa;AACpB,SAASC,oBAAoB,QAAQ,2BAA2B;AAEhE;;;;;;;;;;;;;;;CAeC,GAED,0EAA0E,GAC1E,MAAMC,qBAAqB;IACzB;IACA;IACA;IACA;CACD;AAED;;;;;;;CAOC,GACD,MAAMC,iBAAiB;AAEvB,MAAMC,iBAAiB;AAEvB;;;;CAIC,GACD,MAAMC,yBAAyB;IAAC;IAAW;CAAc;AAEzD,mEAAmE,GACnE,MAAMC,sBAAsB,CAACC,OAC3BL,mBAAmBM,QAAQ,CAACD;AAE9B,0EAA0E,GAC1E,MAAME,kBAAkB,CAACF,OACvBA,SAASJ,kBAAkBI,KAAKG,QAAQ,CAAC,CAAC,CAAC,EAAEP,gBAAgB;AAE/D;;;;;;;;;CASC,GACD,MAAMQ,qBAAqB,CAACC,SAC1BA,OAAOC,QAAQ,KAAK,qBACpBC,MAAMC,OAAO,CAACH,OAAOI,OAAO,KAC5BJ,OAAOI,OAAO,CAACC,MAAM,GAAG,KACxBL,OAAOI,OAAO,CAACE,KAAK,CAAC,CAACC,SAAW,OAAOA,WAAW;AAErD,wEAAwE,GACxE,MAAMC,YAAY,CAChBb,MACAK;IAEA,4EAA4E;IAC5E,4EAA4E;IAC5E,2BAA2B;IAC3B,IAAI,CAACA,OAAOS,KAAK,IAAIT,OAAOU,MAAM,EAAE,OAAOC;IAC3C,IAAI,CAACZ,mBAAmBC,SAAS,OAAOW;IACxC,8EAA8E;IAC9E,oDAAoD;IACpD,IAAIhB,SAASH,kBAAkBK,gBAAgBF,OAAO;QACpD,OAAOF;IACT;IACA,OAAOC,oBAAoBC,QAAQ;QAAC;KAAU,GAAGgB;AACnD;AAEA,eAAe,eAAeC,UAC5BC,IAAU;IAEV,MAAMC,YAAsB,EAAE;IAE9B,KAAK,MAAM,CAACC,aAAaC,QAAQ,IAAI7B,YAAY0B,MAAO;QACtD,IAAII,UAAU;QAEd,KAAK,MAAM,CAACtB,MAAMK,OAAO,IAAIkB,OAAOC,OAAO,CAACH,QAAQI,OAAO,IAAI,CAAC,GAAI;YAClE,MAAMV,SAASF,UAAUb,MAAMK;YAC/B,IAAI,CAACU,QAAQ;YAEbM,QAAQI,OAAO,CAACzB,KAAK,GAAG;gBAAE,GAAGK,MAAM;gBAAEU;YAAO;YAC5CO,UAAU;QACZ;QAEA,IAAIA,SAAS;YACX7B,2BAA2ByB,MAAME,aAAaC;QAChD;IACF;IAEA,MAAM3B,qBAAqBwB;IAE3B,OAAO;QAAEC;IAAU;AACrB"}

package/src/migrations/latest/dev-target-depends-on-pull-image/metadata.json

@@ -0,0 +1,3 @@
+{
+  "description": "Add dependsOn pull-image to the dev target of ts#dynamodb and ts#rdb projects"
+}

package/src/migrations/latest/dev-target-depends-on-pull-image/migration.d.ts

@@ -0,0 +1,6 @@
+/**
+ * Copyright Amazon.com, Inc. or its affiliates. All Rights Reserved.
+ * SPDX-License-Identifier: Apache-2.0
+ */
+import { type MigrationReturnObject, type Tree } from '@nx/devkit';
+export default function migration(tree: Tree): Promise<MigrationReturnObject>;

package/src/migrations/latest/dev-target-depends-on-pull-image/migration.js

@@ -0,0 +1,67 @@
+/**
+ * Copyright Amazon.com, Inc. or its affiliates. All Rights Reserved.
+ * SPDX-License-Identifier: Apache-2.0
+ */ import { getProjects, updateProjectConfiguration } from "@nx/devkit";
+import { TS_DYNAMODB_GENERATOR_INFO } from "../../../ts/dynamodb/generator.js";
+import { TS_RDB_GENERATOR_INFO } from "../../../ts/rdb/generator.js";
+import { formatFilesInSubtree } from "../../../utils/format.js";
+import { addDependencyToTargetIfNotPresent } from "../../../utils/nx.js";
+/**
+ * Make the dev target of ts#dynamodb and ts#rdb projects depend on pull-image
+ *
+ * Without it, `nx dev` starts the container (and, for DynamoDB, creates the
+ * local table) while the image is still being fetched, so a first run on a
+ * machine without the image races the pull.
+ */ const GENERATOR_IDS = [
+    TS_DYNAMODB_GENERATOR_INFO.id,
+    TS_RDB_GENERATOR_INFO.id
+];
+const PULL_IMAGE_TARGET = 'pull-image';
+const startsGeneratedContainer = (project)=>{
+    const { command, commands } = project.targets?.dev?.options ?? {};
+    return [
+        ...commands ?? [],
+        ...command ? [
+            command
+        ] : []
+    ].some((c)=>typeof c === 'string' && c.includes('start-container.ts'));
+};
+const divergedNextStep = (projectName)=>`${projectName}: its dev target has been customised, so it was left as it is. Add "${PULL_IMAGE_TARGET}" to the target's dependsOn so the container image is fetched before the container starts.`;
+export default async function migration(tree) {
+    const nextSteps = [];
+    let migrated = false;
+    for (const [name, project] of getProjects(tree)){
+        if (!GENERATOR_IDS.includes(project.metadata?.generator)) {
+            continue;
+        }
+        const dev = project.targets?.dev;
+        if (!dev || !project.targets?.[PULL_IMAGE_TARGET]) {
+            continue;
+        }
+        // Nx requires an array here. Anything else is hand-written and is reported
+        // rather than rewritten, so a malformed value is never spread or clobbered.
+        if (dev.dependsOn !== undefined && !Array.isArray(dev.dependsOn)) {
+            nextSteps.push(divergedNextStep(name));
+            continue;
+        }
+        const alreadyDependsOnPullImage = (dev.dependsOn ?? []).some((dependency)=>dependency === PULL_IMAGE_TARGET || typeof dependency === 'object' && dependency !== null && dependency.target === PULL_IMAGE_TARGET && dependency.projects === undefined);
+        if (alreadyDependsOnPullImage) {
+            continue;
+        }
+        if (!startsGeneratedContainer(project)) {
+            nextSteps.push(divergedNextStep(name));
+            continue;
+        }
+        addDependencyToTargetIfNotPresent(project, 'dev', PULL_IMAGE_TARGET);
+        updateProjectConfiguration(tree, name, project);
+        migrated = true;
+    }
+    if (migrated) {
+        await formatFilesInSubtree(tree);
+    }
+    return {
+        nextSteps
+    };
+}
+
+//# sourceMappingURL=migration.js.map

package/src/migrations/latest/dev-target-depends-on-pull-image/migration.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../../../../../../../packages/nx-plugin/src/migrations/latest/dev-target-depends-on-pull-image/migration.ts"],"sourcesContent":["/**\n * Copyright Amazon.com, Inc. or its affiliates. All Rights Reserved.\n * SPDX-License-Identifier: Apache-2.0\n */\nimport {\n  getProjects,\n  type MigrationReturnObject,\n  type ProjectConfiguration,\n  type Tree,\n  updateProjectConfiguration,\n} from '@nx/devkit';\nimport { TS_DYNAMODB_GENERATOR_INFO } from '../../../ts/dynamodb/generator.js';\nimport { TS_RDB_GENERATOR_INFO } from '../../../ts/rdb/generator.js';\nimport { formatFilesInSubtree } from '../../../utils/format.js';\nimport { addDependencyToTargetIfNotPresent } from '../../../utils/nx.js';\n\n/**\n * Make the dev target of ts#dynamodb and ts#rdb projects depend on pull-image\n *\n * Without it, `nx dev` starts the container (and, for DynamoDB, creates the\n * local table) while the image is still being fetched, so a first run on a\n * machine without the image races the pull.\n */\n\nconst GENERATOR_IDS = [TS_DYNAMODB_GENERATOR_INFO.id, TS_RDB_GENERATOR_INFO.id];\n\nconst PULL_IMAGE_TARGET = 'pull-image';\n\nconst startsGeneratedContainer = (project: ProjectConfiguration): boolean => {\n  const { command, commands } = project.targets?.dev?.options ?? {};\n  return [...(commands ?? []), ...(command ? [command] : [])].some(\n    (c: string) => typeof c === 'string' && c.includes('start-container.ts'),\n  );\n};\n\nconst divergedNextStep = (projectName: string): string =>\n  `${projectName}: its dev target has been customised, so it was left as it is. Add \"${PULL_IMAGE_TARGET}\" to the target's dependsOn so the container image is fetched before the container starts.`;\n\nexport default async function migration(\n  tree: Tree,\n): Promise<MigrationReturnObject> {\n  const nextSteps: string[] = [];\n  let migrated = false;\n\n  for (const [name, project] of getProjects(tree)) {\n    if (!GENERATOR_IDS.includes((project.metadata as any)?.generator)) {\n      continue;\n    }\n\n    const dev = project.targets?.dev;\n    if (!dev || !project.targets?.[PULL_IMAGE_TARGET]) {\n      continue;\n    }\n\n    // Nx requires an array here. Anything else is hand-written and is reported\n    // rather than rewritten, so a malformed value is never spread or clobbered.\n    if (dev.dependsOn !== undefined && !Array.isArray(dev.dependsOn)) {\n      nextSteps.push(divergedNextStep(name));\n      continue;\n    }\n\n    const alreadyDependsOnPullImage = (dev.dependsOn ?? []).some(\n      (dependency) =>\n        dependency === PULL_IMAGE_TARGET ||\n        (typeof dependency === 'object' &&\n          dependency !== null &&\n          dependency.target === PULL_IMAGE_TARGET &&\n          dependency.projects === undefined),\n    );\n    if (alreadyDependsOnPullImage) {\n      continue;\n    }\n\n    if (!startsGeneratedContainer(project)) {\n      nextSteps.push(divergedNextStep(name));\n      continue;\n    }\n\n    addDependencyToTargetIfNotPresent(project, 'dev', PULL_IMAGE_TARGET);\n    updateProjectConfiguration(tree, name, project);\n    migrated = true;\n  }\n\n  if (migrated) {\n    await formatFilesInSubtree(tree);\n  }\n\n  return { nextSteps };\n}\n"],"names":["getProjects","updateProjectConfiguration","TS_DYNAMODB_GENERATOR_INFO","TS_RDB_GENERATOR_INFO","formatFilesInSubtree","addDependencyToTargetIfNotPresent","GENERATOR_IDS","id","PULL_IMAGE_TARGET","startsGeneratedContainer","project","command","commands","targets","dev","options","some","c","includes","divergedNextStep","projectName","migration","tree","nextSteps","migrated","name","metadata","generator","dependsOn","undefined","Array","isArray","push","alreadyDependsOnPullImage","dependency","target","projects"],"mappings":"AAAA;;;CAGC,GACD,SACEA,WAAW,EAIXC,0BAA0B,QACrB,aAAa;AACpB,SAASC,0BAA0B,QAAQ,oCAAoC;AAC/E,SAASC,qBAAqB,QAAQ,+BAA+B;AACrE,SAASC,oBAAoB,QAAQ,2BAA2B;AAChE,SAASC,iCAAiC,QAAQ,uBAAuB;AAEzE;;;;;;CAMC,GAED,MAAMC,gBAAgB;IAACJ,2BAA2BK,EAAE;IAAEJ,sBAAsBI,EAAE;CAAC;AAE/E,MAAMC,oBAAoB;AAE1B,MAAMC,2BAA2B,CAACC;IAChC,MAAM,EAAEC,OAAO,EAAEC,QAAQ,EAAE,GAAGF,QAAQG,OAAO,EAAEC,KAAKC,WAAW,CAAC;IAChE,OAAO;WAAKH,YAAY,EAAE;WAAOD,UAAU;YAACA;SAAQ,GAAG,EAAE;KAAE,CAACK,IAAI,CAC9D,CAACC,IAAc,OAAOA,MAAM,YAAYA,EAAEC,QAAQ,CAAC;AAEvD;AAEA,MAAMC,mBAAmB,CAACC,cACxB,GAAGA,YAAY,oEAAoE,EAAEZ,kBAAkB,0FAA0F,CAAC;AAEpM,eAAe,eAAea,UAC5BC,IAAU;IAEV,MAAMC,YAAsB,EAAE;IAC9B,IAAIC,WAAW;IAEf,KAAK,MAAM,CAACC,MAAMf,QAAQ,IAAIV,YAAYsB,MAAO;QAC/C,IAAI,CAAChB,cAAcY,QAAQ,CAAER,QAAQgB,QAAQ,EAAUC,YAAY;YACjE;QACF;QAEA,MAAMb,MAAMJ,QAAQG,OAAO,EAAEC;QAC7B,IAAI,CAACA,OAAO,CAACJ,QAAQG,OAAO,EAAE,CAACL,kBAAkB,EAAE;YACjD;QACF;QAEA,2EAA2E;QAC3E,4EAA4E;QAC5E,IAAIM,IAAIc,SAAS,KAAKC,aAAa,CAACC,MAAMC,OAAO,CAACjB,IAAIc,SAAS,GAAG;YAChEL,UAAUS,IAAI,CAACb,iBAAiBM;YAChC;QACF;QAEA,MAAMQ,4BAA4B,AAACnB,CAAAA,IAAIc,SAAS,IAAI,EAAE,AAAD,EAAGZ,IAAI,CAC1D,CAACkB,aACCA,eAAe1B,qBACd,OAAO0B,eAAe,YACrBA,eAAe,QACfA,WAAWC,MAAM,KAAK3B,qBACtB0B,WAAWE,QAAQ,KAAKP;QAE9B,IAAII,2BAA2B;YAC7B;QACF;QAEA,IAAI,CAACxB,yBAAyBC,UAAU;YACtCa,UAAUS,IAAI,CAACb,iBAAiBM;YAChC;QACF;QAEApB,kCAAkCK,SAAS,OAAOF;QAClDP,2BAA2BqB,MAAMG,MAAMf;QACvCc,WAAW;IACb;IAEA,IAAIA,UAAU;QACZ,MAAMpB,qBAAqBkB;IAC7B;IAEA,OAAO;QAAEC;IAAU;AACrB"}

package/src/migrations/latest/docker-target-cache-soundness/metadata.json

@@ -0,0 +1,3 @@
+{
+  "description": "Make container image build and scan targets non-cacheable, so a cache hit can never report success for an image the container engine no longer has"
+}

package/src/migrations/latest/docker-target-cache-soundness/migration.d.ts

@@ -0,0 +1,6 @@
+/**
+ * Copyright Amazon.com, Inc. or its affiliates. All Rights Reserved.
+ * SPDX-License-Identifier: Apache-2.0
+ */
+import { type MigrationReturnObject, type Tree } from '@nx/devkit';
+export default function migration(tree: Tree): Promise<MigrationReturnObject>;

package/src/migrations/latest/docker-target-cache-soundness/migration.js

@@ -0,0 +1,95 @@
+/**
+ * Copyright Amazon.com, Inc. or its affiliates. All Rights Reserved.
+ * SPDX-License-Identifier: Apache-2.0
+ */ import { getProjects, updateProjectConfiguration } from "@nx/devkit";
+import { IMAGE_BUILD_CACHE } from "../../../utils/docker.js";
+import { formatFilesInSubtree } from "../../../utils/format.js";
+/**
+ * Stop Nx caching the targets that build and scan container images.
+ *
+ * A built image lives in the container engine's store, not under any `outputs`
+ * path, so there was nothing for Nx to restore on a cache hit: `build` reported
+ * success for an image the engine no longer had, and the `trivy` target that
+ * depends on it reported a cached pass against that missing image — so a stale
+ * or absent image could clear both a build and a vulnerability scan.
+ *
+ * The container engine's layer cache already makes the rebuild cheap and, unlike
+ * Nx's, it cannot claim a hit for an image that isn't there.
+ *
+ * A target named as one of these but no longer running the engine has been
+ * reworked by the user, so it is left untouched and reported via `nextSteps`.
+ */ /** Names the generators give the targets that build or scan an image. */ const IMAGE_TARGET_NAME = /(^|-)(docker|trivy)$/;
+/** Commands that build an image, or read one back out of the engine to scan it. */ const CONTAINER_ENGINE_COMMAND = /\b(docker|finch)\s+(build|save)\b/;
+/**
+ * The `Dockerfile` the TypeScript image targets declared as their output. It is
+ * a copy made on the way into the build context, never a product of the build,
+ * so it is dropped along with the caching it existed to support.
+ */ const VENDED_DOCKERFILE_OUTPUT = /\/bundle\/(agent|mcp)\/[^/]+\/Dockerfile$/;
+/** The directory the scan target stages its tarball and ignore file in. */ const VENDED_SCAN_OUTPUT = /\/trivy\/[^/]+$/;
+/**
+ * Outputs the generators declare on these targets. Neither is the artifact the
+ * target's success stands for, so dropping their caching loses nothing. An
+ * output beyond these belongs to a target the user has repurposed, whose product
+ * may genuinely be on disk and soundly cacheable.
+ */ const isVendedOutput = (output)=>VENDED_DOCKERFILE_OUTPUT.test(output) || VENDED_SCAN_OUTPUT.test(output);
+/** Every command a target runs, however its options spell them. */ const targetCommands = (target)=>{
+    const { command, commands } = target.options ?? {};
+    return [
+        ...typeof command === 'string' ? [
+            command
+        ] : [],
+        ...Array.isArray(commands) ? commands : []
+    ].filter((c)=>typeof c === 'string');
+};
+const divergedMessage = (projectName, targetName)=>`${projectName}:${targetName}: has diverged from the generated shape - left untouched. Set \`"cache": false\` on it by hand if it builds or scans a container image: the image lives in the container engine rather than under the target's \`outputs\`, so a cache hit can report success for an image that is no longer there.`;
+const ownOutputsMessage = (projectName, targetName)=>`${projectName}:${targetName}: declares outputs of its own, so it was left cacheable. If its result depends on a container image rather than only on those outputs, set \`"cache": false\` on it by hand: the image lives in the container engine, so a cache hit can report success for an image that is no longer there.`;
+/** Applies the fix to one target, reporting one it declines to touch. */ const migrateTarget = (projectName, targetName, target, nextSteps)=>{
+    // A target with `cache` unset is not cached unless `targetDefaults` opts it
+    // in, and one already set to false is sound, so only an explicitly cacheable
+    // one needs rewriting. Both leave a re-run a no-op.
+    if (target.cache !== true) return false;
+    if (!targetCommands(target).some((c)=>CONTAINER_ENGINE_COMMAND.test(c))) {
+        nextSteps.push(divergedMessage(projectName, targetName));
+        return false;
+    }
+    // Running the engine does not by itself make a target's result uncacheable:
+    // one that also declares outputs of its own may well produce the artifact its
+    // success stands for on disk (a `docker save` tarball, a test report), and
+    // that is soundly cacheable. Only the shapes the generators vend are rewritten.
+    const ownOutputs = target.outputs?.filter((o)=>!isVendedOutput(o)) ?? [];
+    if (ownOutputs.length > 0) {
+        nextSteps.push(ownOutputsMessage(projectName, targetName));
+        return false;
+    }
+    target.cache = IMAGE_BUILD_CACHE;
+    // The scan keeps its staging directory: it is a real directory on disk, and
+    // dropping it would leave the tarball behind on a later run.
+    const outputs = target.outputs?.filter((o)=>!VENDED_DOCKERFILE_OUTPUT.test(o));
+    if (outputs && outputs.length === 0) {
+        delete target.outputs;
+    } else if (outputs) {
+        target.outputs = outputs;
+    }
+    return true;
+};
+export default async function migration(tree) {
+    const nextSteps = [];
+    for (const [projectName, project] of getProjects(tree)){
+        let changed = false;
+        for (const [targetName, target] of Object.entries(project.targets ?? {})){
+            // Matched on the name so a target reworked to no longer run the engine is
+            // still found and reported, rather than silently left cacheable.
+            if (!IMAGE_TARGET_NAME.test(targetName)) continue;
+            changed = migrateTarget(projectName, targetName, target, nextSteps) || changed;
+        }
+        if (changed) {
+            updateProjectConfiguration(tree, projectName, project);
+        }
+    }
+    await formatFilesInSubtree(tree);
+    return {
+        nextSteps
+    };
+}
+
+//# sourceMappingURL=migration.js.map

package/src/migrations/latest/docker-target-cache-soundness/migration.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../../../../../../../packages/nx-plugin/src/migrations/latest/docker-target-cache-soundness/migration.ts"],"sourcesContent":["/**\n * Copyright Amazon.com, Inc. or its affiliates. All Rights Reserved.\n * SPDX-License-Identifier: Apache-2.0\n */\nimport {\n  getProjects,\n  type MigrationReturnObject,\n  type ProjectConfiguration,\n  type TargetConfiguration,\n  type Tree,\n  updateProjectConfiguration,\n} from '@nx/devkit';\nimport { IMAGE_BUILD_CACHE } from '../../../utils/docker.js';\nimport { formatFilesInSubtree } from '../../../utils/format.js';\n\n/**\n * Stop Nx caching the targets that build and scan container images.\n *\n * A built image lives in the container engine's store, not under any `outputs`\n * path, so there was nothing for Nx to restore on a cache hit: `build` reported\n * success for an image the engine no longer had, and the `trivy` target that\n * depends on it reported a cached pass against that missing image — so a stale\n * or absent image could clear both a build and a vulnerability scan.\n *\n * The container engine's layer cache already makes the rebuild cheap and, unlike\n * Nx's, it cannot claim a hit for an image that isn't there.\n *\n * A target named as one of these but no longer running the engine has been\n * reworked by the user, so it is left untouched and reported via `nextSteps`.\n */\n\n/** Names the generators give the targets that build or scan an image. */\nconst IMAGE_TARGET_NAME = /(^|-)(docker|trivy)$/;\n\n/** Commands that build an image, or read one back out of the engine to scan it. */\nconst CONTAINER_ENGINE_COMMAND = /\\b(docker|finch)\\s+(build|save)\\b/;\n\n/**\n * The `Dockerfile` the TypeScript image targets declared as their output. It is\n * a copy made on the way into the build context, never a product of the build,\n * so it is dropped along with the caching it existed to support.\n */\nconst VENDED_DOCKERFILE_OUTPUT = /\\/bundle\\/(agent|mcp)\\/[^/]+\\/Dockerfile$/;\n\n/** The directory the scan target stages its tarball and ignore file in. */\nconst VENDED_SCAN_OUTPUT = /\\/trivy\\/[^/]+$/;\n\n/**\n * Outputs the generators declare on these targets. Neither is the artifact the\n * target's success stands for, so dropping their caching loses nothing. An\n * output beyond these belongs to a target the user has repurposed, whose product\n * may genuinely be on disk and soundly cacheable.\n */\nconst isVendedOutput = (output: string): boolean =>\n  VENDED_DOCKERFILE_OUTPUT.test(output) || VENDED_SCAN_OUTPUT.test(output);\n\n/** Every command a target runs, however its options spell them. */\nconst targetCommands = (target: TargetConfiguration): string[] => {\n  const { command, commands } = (target.options ?? {}) as {\n    command?: unknown;\n    commands?: unknown;\n  };\n  return [\n    ...(typeof command === 'string' ? [command] : []),\n    ...(Array.isArray(commands) ? commands : []),\n  ].filter((c): c is string => typeof c === 'string');\n};\n\nconst divergedMessage = (projectName: string, targetName: string) =>\n  `${projectName}:${targetName}: has diverged from the generated shape - left untouched. Set \\`\"cache\": false\\` on it by hand if it builds or scans a container image: the image lives in the container engine rather than under the target's \\`outputs\\`, so a cache hit can report success for an image that is no longer there.`;\n\nconst ownOutputsMessage = (projectName: string, targetName: string) =>\n  `${projectName}:${targetName}: declares outputs of its own, so it was left cacheable. If its result depends on a container image rather than only on those outputs, set \\`\"cache\": false\\` on it by hand: the image lives in the container engine, so a cache hit can report success for an image that is no longer there.`;\n\n/** Applies the fix to one target, reporting one it declines to touch. */\nconst migrateTarget = (\n  projectName: string,\n  targetName: string,\n  target: TargetConfiguration,\n  nextSteps: string[],\n): boolean => {\n  // A target with `cache` unset is not cached unless `targetDefaults` opts it\n  // in, and one already set to false is sound, so only an explicitly cacheable\n  // one needs rewriting. Both leave a re-run a no-op.\n  if (target.cache !== true) return false;\n\n  if (!targetCommands(target).some((c) => CONTAINER_ENGINE_COMMAND.test(c))) {\n    nextSteps.push(divergedMessage(projectName, targetName));\n    return false;\n  }\n\n  // Running the engine does not by itself make a target's result uncacheable:\n  // one that also declares outputs of its own may well produce the artifact its\n  // success stands for on disk (a `docker save` tarball, a test report), and\n  // that is soundly cacheable. Only the shapes the generators vend are rewritten.\n  const ownOutputs = target.outputs?.filter((o) => !isVendedOutput(o)) ?? [];\n  if (ownOutputs.length > 0) {\n    nextSteps.push(ownOutputsMessage(projectName, targetName));\n    return false;\n  }\n\n  target.cache = IMAGE_BUILD_CACHE;\n\n  // The scan keeps its staging directory: it is a real directory on disk, and\n  // dropping it would leave the tarball behind on a later run.\n  const outputs = target.outputs?.filter(\n    (o) => !VENDED_DOCKERFILE_OUTPUT.test(o),\n  );\n  if (outputs && outputs.length === 0) {\n    delete target.outputs;\n  } else if (outputs) {\n    target.outputs = outputs;\n  }\n\n  return true;\n};\n\nexport default async function migration(\n  tree: Tree,\n): Promise<MigrationReturnObject> {\n  const nextSteps: string[] = [];\n\n  for (const [projectName, project] of getProjects(tree)) {\n    let changed = false;\n\n    for (const [targetName, target] of Object.entries(project.targets ?? {})) {\n      // Matched on the name so a target reworked to no longer run the engine is\n      // still found and reported, rather than silently left cacheable.\n      if (!IMAGE_TARGET_NAME.test(targetName)) continue;\n\n      changed =\n        migrateTarget(projectName, targetName, target, nextSteps) || changed;\n    }\n\n    if (changed) {\n      updateProjectConfiguration(\n        tree,\n        projectName,\n        project as ProjectConfiguration,\n      );\n    }\n  }\n\n  await formatFilesInSubtree(tree);\n\n  return { nextSteps };\n}\n"],"names":["getProjects","updateProjectConfiguration","IMAGE_BUILD_CACHE","formatFilesInSubtree","IMAGE_TARGET_NAME","CONTAINER_ENGINE_COMMAND","VENDED_DOCKERFILE_OUTPUT","VENDED_SCAN_OUTPUT","isVendedOutput","output","test","targetCommands","target","command","commands","options","Array","isArray","filter","c","divergedMessage","projectName","targetName","ownOutputsMessage","migrateTarget","nextSteps","cache","some","push","ownOutputs","outputs","o","length","migration","tree","project","changed","Object","entries","targets"],"mappings":"AAAA;;;CAGC,GACD,SACEA,WAAW,EAKXC,0BAA0B,QACrB,aAAa;AACpB,SAASC,iBAAiB,QAAQ,2BAA2B;AAC7D,SAASC,oBAAoB,QAAQ,2BAA2B;AAEhE;;;;;;;;;;;;;;CAcC,GAED,uEAAuE,GACvE,MAAMC,oBAAoB;AAE1B,iFAAiF,GACjF,MAAMC,2BAA2B;AAEjC;;;;CAIC,GACD,MAAMC,2BAA2B;AAEjC,yEAAyE,GACzE,MAAMC,qBAAqB;AAE3B;;;;;CAKC,GACD,MAAMC,iBAAiB,CAACC,SACtBH,yBAAyBI,IAAI,CAACD,WAAWF,mBAAmBG,IAAI,CAACD;AAEnE,iEAAiE,GACjE,MAAME,iBAAiB,CAACC;IACtB,MAAM,EAAEC,OAAO,EAAEC,QAAQ,EAAE,GAAIF,OAAOG,OAAO,IAAI,CAAC;IAIlD,OAAO;WACD,OAAOF,YAAY,WAAW;YAACA;SAAQ,GAAG,EAAE;WAC5CG,MAAMC,OAAO,CAACH,YAAYA,WAAW,EAAE;KAC5C,CAACI,MAAM,CAAC,CAACC,IAAmB,OAAOA,MAAM;AAC5C;AAEA,MAAMC,kBAAkB,CAACC,aAAqBC,aAC5C,GAAGD,YAAY,CAAC,EAAEC,WAAW,mSAAmS,CAAC;AAEnU,MAAMC,oBAAoB,CAACF,aAAqBC,aAC9C,GAAGD,YAAY,CAAC,EAAEC,WAAW,6RAA6R,CAAC;AAE7T,uEAAuE,GACvE,MAAME,gBAAgB,CACpBH,aACAC,YACAV,QACAa;IAEA,4EAA4E;IAC5E,6EAA6E;IAC7E,oDAAoD;IACpD,IAAIb,OAAOc,KAAK,KAAK,MAAM,OAAO;IAElC,IAAI,CAACf,eAAeC,QAAQe,IAAI,CAAC,CAACR,IAAMd,yBAAyBK,IAAI,CAACS,KAAK;QACzEM,UAAUG,IAAI,CAACR,gBAAgBC,aAAaC;QAC5C,OAAO;IACT;IAEA,4EAA4E;IAC5E,8EAA8E;IAC9E,2EAA2E;IAC3E,gFAAgF;IAChF,MAAMO,aAAajB,OAAOkB,OAAO,EAAEZ,OAAO,CAACa,IAAM,CAACvB,eAAeuB,OAAO,EAAE;IAC1E,IAAIF,WAAWG,MAAM,GAAG,GAAG;QACzBP,UAAUG,IAAI,CAACL,kBAAkBF,aAAaC;QAC9C,OAAO;IACT;IAEAV,OAAOc,KAAK,GAAGxB;IAEf,4EAA4E;IAC5E,6DAA6D;IAC7D,MAAM4B,UAAUlB,OAAOkB,OAAO,EAAEZ,OAC9B,CAACa,IAAM,CAACzB,yBAAyBI,IAAI,CAACqB;IAExC,IAAID,WAAWA,QAAQE,MAAM,KAAK,GAAG;QACnC,OAAOpB,OAAOkB,OAAO;IACvB,OAAO,IAAIA,SAAS;QAClBlB,OAAOkB,OAAO,GAAGA;IACnB;IAEA,OAAO;AACT;AAEA,eAAe,eAAeG,UAC5BC,IAAU;IAEV,MAAMT,YAAsB,EAAE;IAE9B,KAAK,MAAM,CAACJ,aAAac,QAAQ,IAAInC,YAAYkC,MAAO;QACtD,IAAIE,UAAU;QAEd,KAAK,MAAM,CAACd,YAAYV,OAAO,IAAIyB,OAAOC,OAAO,CAACH,QAAQI,OAAO,IAAI,CAAC,GAAI;YACxE,0EAA0E;YAC1E,iEAAiE;YACjE,IAAI,CAACnC,kBAAkBM,IAAI,CAACY,aAAa;YAEzCc,UACEZ,cAAcH,aAAaC,YAAYV,QAAQa,cAAcW;QACjE;QAEA,IAAIA,SAAS;YACXnC,2BACEiC,MACAb,aACAc;QAEJ;IACF;IAEA,MAAMhC,qBAAqB+B;IAE3B,OAAO;QAAET;IAAU;AACrB"}

package/src/migrations/latest/nx-parallel-default/metadata.json

@@ -0,0 +1,3 @@
+{
+  "description": "Set nx.json parallel to 8 so full builds use available cores, preserving an existing value"
+}

package/src/migrations/latest/nx-parallel-default/migration.d.ts

@@ -0,0 +1,14 @@
+/**
+ * Copyright Amazon.com, Inc. or its affiliates. All Rights Reserved.
+ * SPDX-License-Identifier: Apache-2.0
+ */
+import { type MigrationReturnObject, type Tree } from '@nx/devkit';
+/**
+ * New workspaces set `parallel` in `nx.json` so a full build uses the available
+ * cores rather than Nx's default of 3. Existing workspaces have no value at all,
+ * so this backfills it.
+ *
+ * A workspace that already declares `parallel` has made a deliberate choice —
+ * often to bound memory on a smaller machine — so it is left as it is.
+ */
+export default function migration(tree: Tree): Promise<MigrationReturnObject>;

package/src/migrations/latest/nx-parallel-default/migration.js

@@ -0,0 +1,29 @@
+/**
+ * Copyright Amazon.com, Inc. or its affiliates. All Rights Reserved.
+ * SPDX-License-Identifier: Apache-2.0
+ */ import { readNxJson, updateNxJson } from "@nx/devkit";
+import { formatFilesInSubtree } from "../../../utils/format.js";
+import { DEFAULT_PARALLEL } from "../../../utils/init.js";
+/**
+ * New workspaces set `parallel` in `nx.json` so a full build uses the available
+ * cores rather than Nx's default of 3. Existing workspaces have no value at all,
+ * so this backfills it.
+ *
+ * A workspace that already declares `parallel` has made a deliberate choice —
+ * often to bound memory on a smaller machine — so it is left as it is.
+ */ export default async function migration(tree) {
+    const nextSteps = [];
+    const nxJson = readNxJson(tree);
+    if (nxJson && nxJson.parallel === undefined) {
+        updateNxJson(tree, {
+            ...nxJson,
+            parallel: DEFAULT_PARALLEL
+        });
+    }
+    await formatFilesInSubtree(tree);
+    return {
+        nextSteps
+    };
+}
+
+//# sourceMappingURL=migration.js.map

package/src/migrations/latest/nx-parallel-default/migration.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../../../../../../../packages/nx-plugin/src/migrations/latest/nx-parallel-default/migration.ts"],"sourcesContent":["/**\n * Copyright Amazon.com, Inc. or its affiliates. All Rights Reserved.\n * SPDX-License-Identifier: Apache-2.0\n */\nimport {\n  type MigrationReturnObject,\n  readNxJson,\n  type Tree,\n  updateNxJson,\n} from '@nx/devkit';\nimport { formatFilesInSubtree } from '../../../utils/format.js';\nimport { DEFAULT_PARALLEL } from '../../../utils/init.js';\n\n/**\n * New workspaces set `parallel` in `nx.json` so a full build uses the available\n * cores rather than Nx's default of 3. Existing workspaces have no value at all,\n * so this backfills it.\n *\n * A workspace that already declares `parallel` has made a deliberate choice —\n * often to bound memory on a smaller machine — so it is left as it is.\n */\nexport default async function migration(\n  tree: Tree,\n): Promise<MigrationReturnObject> {\n  const nextSteps: string[] = [];\n\n  const nxJson = readNxJson(tree);\n  if (nxJson && nxJson.parallel === undefined) {\n    updateNxJson(tree, { ...nxJson, parallel: DEFAULT_PARALLEL });\n  }\n\n  await formatFilesInSubtree(tree);\n\n  return { nextSteps };\n}\n"],"names":["readNxJson","updateNxJson","formatFilesInSubtree","DEFAULT_PARALLEL","migration","tree","nextSteps","nxJson","parallel","undefined"],"mappings":"AAAA;;;CAGC,GACD,SAEEA,UAAU,EAEVC,YAAY,QACP,aAAa;AACpB,SAASC,oBAAoB,QAAQ,2BAA2B;AAChE,SAASC,gBAAgB,QAAQ,yBAAyB;AAE1D;;;;;;;CAOC,GACD,eAAe,eAAeC,UAC5BC,IAAU;IAEV,MAAMC,YAAsB,EAAE;IAE9B,MAAMC,SAASP,WAAWK;IAC1B,IAAIE,UAAUA,OAAOC,QAAQ,KAAKC,WAAW;QAC3CR,aAAaI,MAAM;YAAE,GAAGE,MAAM;YAAEC,UAAUL;QAAiB;IAC7D;IAEA,MAAMD,qBAAqBG;IAE3B,OAAO;QAAEC;IAAU;AACrB"}

package/src/migrations/latest/open-api-codegen-executor/metadata.json

@@ -0,0 +1,3 @@
+{
+  "description": "Switch generated OpenAPI codegen targets to the in-process open-api-codegen executor"
+}

package/src/migrations/latest/open-api-codegen-executor/migration.d.ts

@@ -0,0 +1,6 @@
+/**
+ * Copyright Amazon.com, Inc. or its affiliates. All Rights Reserved.
+ * SPDX-License-Identifier: Apache-2.0
+ */
+import { type MigrationReturnObject, type Tree } from '@nx/devkit';
+export default function migration(tree: Tree): Promise<MigrationReturnObject>;