@aws/nx-plugin 1.0.0-rc.9 → 1.0.0-rc.90

package/src/migrations/latest/open-api-codegen-executor/migration.js

@@ -0,0 +1,100 @@
+/**
+ * Copyright Amazon.com, Inc. or its affiliates. All Rights Reserved.
+ * SPDX-License-Identifier: Apache-2.0
+ */ import { getProjects, updateProjectConfiguration } from "@nx/devkit";
+import { formatFilesInSubtree } from "../../../utils/format.js";
+import { normalizeTargetKeyOrder } from "../../../utils/nx.js";
+import { OPEN_API_CODEGEN_EXECUTOR } from "../../../utils/open-api-codegen-target.js";
+/**
+ * Codegen targets ran `nx g @aws/nx-plugin:open-api#<generator>` through
+ * `nx:run-commands`, paying a second full Nx bootstrap — project graph, plugin
+ * resolution and schema validation — for every codegen step. They now use the
+ * `open-api-codegen` executor, which runs the same generator in the Nx process
+ * that is already running.
+ *
+ * Only the command shape the generators produced is rewritten. A target that has
+ * been customised — an extra flag, a chained command, options beyond `commands` —
+ * is the user's, so it is left as it is and reported.
+ *
+ * How to write a migration:
+ * - https://nx.dev/docs/kb/migration-generators
+ * - What `nextSteps` means: https://nx.dev/docs/reference/devkit/MigrationReturnObject
+ */ /** The generators the executor can run, by the collection name they had. */ const GENERATORS = {
+    'open-api#ts-client': 'ts-client',
+    'open-api#ts-hooks': 'ts-hooks',
+    'open-api#ts-metadata': 'ts-metadata',
+    'open-api#json-metadata': 'json-metadata'
+};
+/**
+ * Matches a whole generated codegen command, binding the generator name and its
+ * two paths. Anchored, so a command carrying anything else does not match and is
+ * reported instead of rewritten.
+ */ const CODEGEN_COMMAND = /^nx g @aws\/nx-plugin:(?<generator>[\w#-]+) --openApiSpecPath="(?<specPath>[^"]+)" --outputPath="(?<outputPath>[^"]+)" --no-interactive$/;
+/**
+ * The command a target runs, when it is a single-command `nx:run-commands` — the
+ * shape the generators produced. A target carrying several commands, or options
+ * beyond `commands`, has diverged.
+ */ const singleCommand = (target)=>{
+    if (target.executor !== 'nx:run-commands') return undefined;
+    const options = target.options;
+    if (!options || Object.keys(options).length !== 1) return undefined;
+    const commands = options.commands;
+    if (!Array.isArray(commands) || commands.length !== 1) return undefined;
+    return typeof commands[0] === 'string' ? commands[0] : undefined;
+};
+/** Parses a generated codegen command, or undefined if it is not one. */ const parseCodegenCommand = (command)=>{
+    const groups = CODEGEN_COMMAND.exec(command)?.groups;
+    if (!groups) return undefined;
+    const generator = GENERATORS[groups.generator];
+    if (!generator) return undefined;
+    return {
+        generator,
+        openApiSpecPath: groups.specPath,
+        outputPath: groups.outputPath
+    };
+};
+/**
+ * Whether a target invokes an OpenAPI generator without being the shape the
+ * generators produced, so it must be reported rather than rewritten.
+ *
+ * Continuous targets are excluded. The vended `watch-generate:<api>-client`
+ * wraps `nx watch -- nx run <project>:<codegen target>`, which references the
+ * codegen target rather than the generator, so it never matches here anyway. But
+ * a watch target rewritten to invoke the generator directly would, and telling
+ * its owner to switch to the executor would be wrong advice: `nx watch` runs
+ * until interrupted, which a single executor invocation cannot express.
+ *
+ * `continuous` is the property that makes that true, so it is what is checked —
+ * rather than the `watch-` name prefix, which is only a convention.
+ */ const hasCustomisedCodegenCommand = (target)=>target.executor === 'nx:run-commands' && !target.continuous && JSON.stringify(target.options ?? {}).includes('@aws/nx-plugin:open-api#');
+export default async function migration(tree) {
+    const nextSteps = [];
+    for (const [projectName, project] of getProjects(tree)){
+        let changed = false;
+        for (const [targetName, target] of Object.entries(project.targets ?? {})){
+            const command = singleCommand(target);
+            const options = command ? parseCodegenCommand(command) : undefined;
+            if (!options) {
+                if (hasCustomisedCodegenCommand(target)) {
+                    nextSteps.push(`${projectName}:${targetName} has diverged from the generated shape — left untouched. Switch it to the '${OPEN_API_CODEGEN_EXECUTOR}' executor to avoid a nested Nx invocation.`);
+                }
+                continue;
+            }
+            project.targets[targetName] = normalizeTargetKeyOrder({
+                ...target,
+                executor: OPEN_API_CODEGEN_EXECUTOR,
+                options
+            });
+            changed = true;
+        }
+        if (changed) {
+            updateProjectConfiguration(tree, projectName, project);
+        }
+    }
+    await formatFilesInSubtree(tree);
+    return {
+        nextSteps
+    };
+}
+
+//# sourceMappingURL=migration.js.map

package/src/migrations/latest/open-api-codegen-executor/migration.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../../../../../../../packages/nx-plugin/src/migrations/latest/open-api-codegen-executor/migration.ts"],"sourcesContent":["/**\n * Copyright Amazon.com, Inc. or its affiliates. All Rights Reserved.\n * SPDX-License-Identifier: Apache-2.0\n */\nimport {\n  getProjects,\n  type MigrationReturnObject,\n  type TargetConfiguration,\n  type Tree,\n  updateProjectConfiguration,\n} from '@nx/devkit';\nimport type { OpenApiCodegenTarget } from '../../../open-api/codegen/executor-schema';\nimport { formatFilesInSubtree } from '../../../utils/format.js';\nimport { normalizeTargetKeyOrder } from '../../../utils/nx.js';\nimport { OPEN_API_CODEGEN_EXECUTOR } from '../../../utils/open-api-codegen-target.js';\n\n/**\n * Codegen targets ran `nx g @aws/nx-plugin:open-api#<generator>` through\n * `nx:run-commands`, paying a second full Nx bootstrap — project graph, plugin\n * resolution and schema validation — for every codegen step. They now use the\n * `open-api-codegen` executor, which runs the same generator in the Nx process\n * that is already running.\n *\n * Only the command shape the generators produced is rewritten. A target that has\n * been customised — an extra flag, a chained command, options beyond `commands` —\n * is the user's, so it is left as it is and reported.\n *\n * How to write a migration:\n * - https://nx.dev/docs/kb/migration-generators\n * - What `nextSteps` means: https://nx.dev/docs/reference/devkit/MigrationReturnObject\n */\n\n/** The generators the executor can run, by the collection name they had. */\nconst GENERATORS: Record<string, OpenApiCodegenTarget> = {\n  'open-api#ts-client': 'ts-client',\n  'open-api#ts-hooks': 'ts-hooks',\n  'open-api#ts-metadata': 'ts-metadata',\n  'open-api#json-metadata': 'json-metadata',\n};\n\n/**\n * Matches a whole generated codegen command, binding the generator name and its\n * two paths. Anchored, so a command carrying anything else does not match and is\n * reported instead of rewritten.\n */\nconst CODEGEN_COMMAND =\n  /^nx g @aws\\/nx-plugin:(?<generator>[\\w#-]+) --openApiSpecPath=\"(?<specPath>[^\"]+)\" --outputPath=\"(?<outputPath>[^\"]+)\" --no-interactive$/;\n\ninterface CodegenOptions {\n  readonly generator: OpenApiCodegenTarget;\n  readonly openApiSpecPath: string;\n  readonly outputPath: string;\n}\n\n/**\n * The command a target runs, when it is a single-command `nx:run-commands` — the\n * shape the generators produced. A target carrying several commands, or options\n * beyond `commands`, has diverged.\n */\nconst singleCommand = (target: TargetConfiguration): string | undefined => {\n  if (target.executor !== 'nx:run-commands') return undefined;\n  const options = target.options as Record<string, unknown> | undefined;\n  if (!options || Object.keys(options).length !== 1) return undefined;\n  const commands = options.commands;\n  if (!Array.isArray(commands) || commands.length !== 1) return undefined;\n  return typeof commands[0] === 'string' ? commands[0] : undefined;\n};\n\n/** Parses a generated codegen command, or undefined if it is not one. */\nconst parseCodegenCommand = (command: string): CodegenOptions | undefined => {\n  const groups = CODEGEN_COMMAND.exec(command)?.groups;\n  if (!groups) return undefined;\n  const generator = GENERATORS[groups.generator];\n  if (!generator) return undefined;\n  return {\n    generator,\n    openApiSpecPath: groups.specPath,\n    outputPath: groups.outputPath,\n  };\n};\n\n/**\n * Whether a target invokes an OpenAPI generator without being the shape the\n * generators produced, so it must be reported rather than rewritten.\n *\n * Continuous targets are excluded. The vended `watch-generate:<api>-client`\n * wraps `nx watch -- nx run <project>:<codegen target>`, which references the\n * codegen target rather than the generator, so it never matches here anyway. But\n * a watch target rewritten to invoke the generator directly would, and telling\n * its owner to switch to the executor would be wrong advice: `nx watch` runs\n * until interrupted, which a single executor invocation cannot express.\n *\n * `continuous` is the property that makes that true, so it is what is checked —\n * rather than the `watch-` name prefix, which is only a convention.\n */\nconst hasCustomisedCodegenCommand = (target: TargetConfiguration): boolean =>\n  target.executor === 'nx:run-commands' &&\n  !target.continuous &&\n  JSON.stringify(target.options ?? {}).includes('@aws/nx-plugin:open-api#');\n\nexport default async function migration(\n  tree: Tree,\n): Promise<MigrationReturnObject> {\n  const nextSteps: string[] = [];\n\n  for (const [projectName, project] of getProjects(tree)) {\n    let changed = false;\n\n    for (const [targetName, target] of Object.entries(project.targets ?? {})) {\n      const command = singleCommand(target);\n      const options = command ? parseCodegenCommand(command) : undefined;\n\n      if (!options) {\n        if (hasCustomisedCodegenCommand(target)) {\n          nextSteps.push(\n            `${projectName}:${targetName} has diverged from the generated shape — left untouched. Switch it to the '${OPEN_API_CODEGEN_EXECUTOR}' executor to avoid a nested Nx invocation.`,\n          );\n        }\n        continue;\n      }\n\n      project.targets[targetName] = normalizeTargetKeyOrder({\n        ...target,\n        executor: OPEN_API_CODEGEN_EXECUTOR,\n        options,\n      });\n      changed = true;\n    }\n\n    if (changed) {\n      updateProjectConfiguration(tree, projectName, project);\n    }\n  }\n\n  await formatFilesInSubtree(tree);\n\n  return { nextSteps };\n}\n"],"names":["getProjects","updateProjectConfiguration","formatFilesInSubtree","normalizeTargetKeyOrder","OPEN_API_CODEGEN_EXECUTOR","GENERATORS","CODEGEN_COMMAND","singleCommand","target","executor","undefined","options","Object","keys","length","commands","Array","isArray","parseCodegenCommand","command","groups","exec","generator","openApiSpecPath","specPath","outputPath","hasCustomisedCodegenCommand","continuous","JSON","stringify","includes","migration","tree","nextSteps","projectName","project","changed","targetName","entries","targets","push"],"mappings":"AAAA;;;CAGC,GACD,SACEA,WAAW,EAIXC,0BAA0B,QACrB,aAAa;AAEpB,SAASC,oBAAoB,QAAQ,2BAA2B;AAChE,SAASC,uBAAuB,QAAQ,uBAAuB;AAC/D,SAASC,yBAAyB,QAAQ,4CAA4C;AAEtF;;;;;;;;;;;;;;CAcC,GAED,0EAA0E,GAC1E,MAAMC,aAAmD;IACvD,sBAAsB;IACtB,qBAAqB;IACrB,wBAAwB;IACxB,0BAA0B;AAC5B;AAEA;;;;CAIC,GACD,MAAMC,kBACJ;AAQF;;;;CAIC,GACD,MAAMC,gBAAgB,CAACC;IACrB,IAAIA,OAAOC,QAAQ,KAAK,mBAAmB,OAAOC;IAClD,MAAMC,UAAUH,OAAOG,OAAO;IAC9B,IAAI,CAACA,WAAWC,OAAOC,IAAI,CAACF,SAASG,MAAM,KAAK,GAAG,OAAOJ;IAC1D,MAAMK,WAAWJ,QAAQI,QAAQ;IACjC,IAAI,CAACC,MAAMC,OAAO,CAACF,aAAaA,SAASD,MAAM,KAAK,GAAG,OAAOJ;IAC9D,OAAO,OAAOK,QAAQ,CAAC,EAAE,KAAK,WAAWA,QAAQ,CAAC,EAAE,GAAGL;AACzD;AAEA,uEAAuE,GACvE,MAAMQ,sBAAsB,CAACC;IAC3B,MAAMC,SAASd,gBAAgBe,IAAI,CAACF,UAAUC;IAC9C,IAAI,CAACA,QAAQ,OAAOV;IACpB,MAAMY,YAAYjB,UAAU,CAACe,OAAOE,SAAS,CAAC;IAC9C,IAAI,CAACA,WAAW,OAAOZ;IACvB,OAAO;QACLY;QACAC,iBAAiBH,OAAOI,QAAQ;QAChCC,YAAYL,OAAOK,UAAU;IAC/B;AACF;AAEA;;;;;;;;;;;;;CAaC,GACD,MAAMC,8BAA8B,CAAClB,SACnCA,OAAOC,QAAQ,KAAK,qBACpB,CAACD,OAAOmB,UAAU,IAClBC,KAAKC,SAAS,CAACrB,OAAOG,OAAO,IAAI,CAAC,GAAGmB,QAAQ,CAAC;AAEhD,eAAe,eAAeC,UAC5BC,IAAU;IAEV,MAAMC,YAAsB,EAAE;IAE9B,KAAK,MAAM,CAACC,aAAaC,QAAQ,IAAInC,YAAYgC,MAAO;QACtD,IAAII,UAAU;QAEd,KAAK,MAAM,CAACC,YAAY7B,OAAO,IAAII,OAAO0B,OAAO,CAACH,QAAQI,OAAO,IAAI,CAAC,GAAI;YACxE,MAAMpB,UAAUZ,cAAcC;YAC9B,MAAMG,UAAUQ,UAAUD,oBAAoBC,WAAWT;YAEzD,IAAI,CAACC,SAAS;gBACZ,IAAIe,4BAA4BlB,SAAS;oBACvCyB,UAAUO,IAAI,CACZ,GAAGN,YAAY,CAAC,EAAEG,WAAW,2EAA2E,EAAEjC,0BAA0B,2CAA2C,CAAC;gBAEpL;gBACA;YACF;YAEA+B,QAAQI,OAAO,CAACF,WAAW,GAAGlC,wBAAwB;gBACpD,GAAGK,MAAM;gBACTC,UAAUL;gBACVO;YACF;YACAyB,UAAU;QACZ;QAEA,IAAIA,SAAS;YACXnC,2BAA2B+B,MAAME,aAAaC;QAChD;IACF;IAEA,MAAMjC,qBAAqB8B;IAE3B,OAAO;QAAEC;IAAU;AACrB"}

package/src/migrations/latest/python-test-input-scoping/metadata.json

@@ -0,0 +1,3 @@
+{
+  "description": "Exclude Python test files from the production named input and scope dependent task outputs to dist so Python test edits do not invalidate build tasks"
+}

package/src/migrations/latest/python-test-input-scoping/migration.d.ts

@@ -0,0 +1,6 @@
+/**
+ * Copyright Amazon.com, Inc. or its affiliates. All Rights Reserved.
+ * SPDX-License-Identifier: Apache-2.0
+ */
+import { type MigrationReturnObject, type Tree } from '@nx/devkit';
+export default function migration(tree: Tree): Promise<MigrationReturnObject>;

package/src/migrations/latest/python-test-input-scoping/migration.js

@@ -0,0 +1,142 @@
+/**
+ * Copyright Amazon.com, Inc. or its affiliates. All Rights Reserved.
+ * SPDX-License-Identifier: Apache-2.0
+ */ import { getProjects, readNxJson, updateNxJson, updateProjectConfiguration } from "@nx/devkit";
+import { PYTHON_TEST_FILE_EXCLUSIONS } from "../../../py/project/generator.js";
+import { DEPENDENT_TASKS_OUTPUT_FILES_INPUT } from "../../../ts/lib/generator.js";
+import { formatFilesInSubtree } from "../../../utils/format.js";
+/**
+ * Editing a Python test file used to invalidate the whole build chain for its
+ * project, and cascade into every downstream project. Two independent causes:
+ *
+ * 1. The `production` named input excluded TypeScript specs but nothing Python,
+ *    and the Python build targets read `default` (every file in the project), so
+ *    a test file was a build input by construction.
+ * 2. `default` consumed *every* output of a dependency task. The Python `test`
+ *    target writes JUnit and coverage reports that pytest stamps wall-clock time
+ *    into, so each test run minted a new hash that propagated downstream.
+ *
+ * Targets whose output genuinely cannot contain a test file move to
+ * `production`; `typecheck` deliberately stays on `default`, because `ty` checks
+ * the tests directory and must re-run when a test changes.
+ */ /** The Python targets whose declared output cannot contain a test file. */ const PRODUCTION_SCOPED_TARGETS = [
+    'compile',
+    'bundle-x86',
+    'bundle-arm'
+];
+/** The inputs those targets read once scoped to production sources. */ const PRODUCTION_INPUTS = [
+    'production',
+    '^production'
+];
+/** The inputs those targets previously read. */ const PREVIOUS_INPUTS = [
+    'default',
+    '^production'
+];
+/**
+ * Dependent-task-output globs this plugin has vended. Any of them is rewritten
+ * to the current one; anything else is the user's own scoping decision.
+ */ const PREVIOUSLY_VENDED_GLOBS = [
+    '**/*',
+    'dist/**'
+];
+const isPythonProject = (project)=>Object.values(project.targets ?? {}).some((target)=>String(target?.executor ?? '').startsWith('@nxlv/python'));
+/**
+ * An OpenAPI spec generation target as the generators vend it: named `openapi`
+ * or `<agent>-openapi`, running a command, and writing its spec under
+ * `dist/.../openapi`. The extra checks keep a user-authored target that merely
+ * shares the suffix from being rescoped, since these targets are identified by
+ * declaring no `inputs` at all.
+ */ const isOpenApiTarget = (name, target)=>{
+    if (name !== 'openapi' && !name.endsWith('-openapi')) return false;
+    if (!target) return true;
+    return target.executor === 'nx:run-commands' && (target.outputs ?? []).some((output)=>output.includes('/openapi'));
+};
+const arraysEqual = (a, b)=>a.length === b.length && a.every((entry, index)=>entry === b[index]);
+/**
+ * Excludes Python test files from the `production` named input, and narrows the
+ * dependent-task-output input so test reports no longer propagate downstream.
+ */ const migrateNamedInputs = (tree, nextSteps)=>{
+    const nxJson = readNxJson(tree);
+    if (!nxJson) return;
+    // Seeded as `['default']` when absent, exactly as the generator does. The
+    // targets below are rewritten to read `production`, and Nx fails hard on a
+    // named input that is not defined, so the two must not diverge.
+    const production = nxJson.namedInputs?.production ?? [
+        'default'
+    ];
+    const nextProduction = [
+        ...production,
+        ...PYTHON_TEST_FILE_EXCLUSIONS.filter((exclusion)=>!production.includes(exclusion))
+    ];
+    const defaultInput = nxJson.namedInputs?.default;
+    let nextDefault = defaultInput;
+    if (defaultInput) {
+        const glob = DEPENDENT_TASKS_OUTPUT_FILES_INPUT.dependentTasksOutputFiles;
+        // Only an entry this plugin vended is rewritten; a different glob is the
+        // user's own scoping decision.
+        nextDefault = defaultInput.map((input)=>typeof input === 'object' && input !== null && 'dependentTasksOutputFiles' in input && PREVIOUSLY_VENDED_GLOBS.includes(input.dependentTasksOutputFiles) ? {
+                ...input,
+                dependentTasksOutputFiles: glob
+            } : input);
+        const hadVendedEntry = nextDefault.some((input)=>typeof input === 'object' && input !== null && 'dependentTasksOutputFiles' in input && input.dependentTasksOutputFiles === glob);
+        const hasCustomEntry = defaultInput.some((input)=>typeof input === 'object' && input !== null && 'dependentTasksOutputFiles' in input && !PREVIOUSLY_VENDED_GLOBS.includes(input.dependentTasksOutputFiles) && input.dependentTasksOutputFiles !== glob);
+        if (!hadVendedEntry && hasCustomEntry) {
+            nextSteps.push(`nx.json's 'default' named input scopes 'dependentTasksOutputFiles' to a custom glob — left untouched. Narrow it to '${glob}' so timestamped test reports do not invalidate downstream tasks.`);
+        }
+    }
+    updateNxJson(tree, {
+        ...nxJson,
+        namedInputs: {
+            ...nxJson.namedInputs,
+            production: nextProduction,
+            ...nextDefault ? {
+                default: nextDefault
+            } : {}
+        }
+    });
+};
+/**
+ * Scopes a Python project's build-chain targets to production sources. Only
+ * targets still carrying the inputs the generator vended are rewritten, so a
+ * project whose inputs the user has tuned is reported rather than clobbered.
+ */ const migrateProjectTargets = (tree, projectName, project, nextSteps)=>{
+    let changed = false;
+    for (const [targetName, target] of Object.entries(project.targets ?? {})){
+        if (!PRODUCTION_SCOPED_TARGETS.includes(targetName) && !isOpenApiTarget(targetName, target)) {
+            continue;
+        }
+        const inputs = target.inputs;
+        // Already migrated, so a re-run is a no-op.
+        if (inputs && arraysEqual(inputs, PRODUCTION_INPUTS)) {
+            continue;
+        }
+        // The OpenAPI targets declared no inputs at all, so they fell back to
+        // `default`. Everything else carried the vended pair.
+        const isVendedShape = inputs ? arraysEqual(inputs, PREVIOUS_INPUTS) : isOpenApiTarget(targetName, target);
+        if (!isVendedShape) {
+            nextSteps.push(`${projectName}:${targetName}: 'inputs' has diverged from the generated shape — left untouched. Scope it to ['production', '^production'] so Python test edits do not invalidate it.`);
+            continue;
+        }
+        target.inputs = [
+            ...PRODUCTION_INPUTS
+        ];
+        changed = true;
+    }
+    if (changed) {
+        updateProjectConfiguration(tree, projectName, project);
+    }
+};
+export default async function migration(tree) {
+    const nextSteps = [];
+    migrateNamedInputs(tree, nextSteps);
+    for (const [projectName, project] of getProjects(tree)){
+        if (!isPythonProject(project)) continue;
+        migrateProjectTargets(tree, projectName, project, nextSteps);
+    }
+    await formatFilesInSubtree(tree);
+    return {
+        nextSteps
+    };
+}
+
+//# sourceMappingURL=migration.js.map

package/src/migrations/latest/python-test-input-scoping/migration.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../../../../../../../packages/nx-plugin/src/migrations/latest/python-test-input-scoping/migration.ts"],"sourcesContent":["/**\n * Copyright Amazon.com, Inc. or its affiliates. All Rights Reserved.\n * SPDX-License-Identifier: Apache-2.0\n */\nimport {\n  getProjects,\n  type MigrationReturnObject,\n  type ProjectConfiguration,\n  readNxJson,\n  type TargetConfiguration,\n  type Tree,\n  updateNxJson,\n  updateProjectConfiguration,\n} from '@nx/devkit';\nimport { PYTHON_TEST_FILE_EXCLUSIONS } from '../../../py/project/generator.js';\nimport { DEPENDENT_TASKS_OUTPUT_FILES_INPUT } from '../../../ts/lib/generator.js';\nimport { formatFilesInSubtree } from '../../../utils/format.js';\n\n/**\n * Editing a Python test file used to invalidate the whole build chain for its\n * project, and cascade into every downstream project. Two independent causes:\n *\n * 1. The `production` named input excluded TypeScript specs but nothing Python,\n *    and the Python build targets read `default` (every file in the project), so\n *    a test file was a build input by construction.\n * 2. `default` consumed *every* output of a dependency task. The Python `test`\n *    target writes JUnit and coverage reports that pytest stamps wall-clock time\n *    into, so each test run minted a new hash that propagated downstream.\n *\n * Targets whose output genuinely cannot contain a test file move to\n * `production`; `typecheck` deliberately stays on `default`, because `ty` checks\n * the tests directory and must re-run when a test changes.\n */\n\n/** The Python targets whose declared output cannot contain a test file. */\nconst PRODUCTION_SCOPED_TARGETS = ['compile', 'bundle-x86', 'bundle-arm'];\n\n/** The inputs those targets read once scoped to production sources. */\nconst PRODUCTION_INPUTS = ['production', '^production'];\n\n/** The inputs those targets previously read. */\nconst PREVIOUS_INPUTS = ['default', '^production'];\n\n/**\n * Dependent-task-output globs this plugin has vended. Any of them is rewritten\n * to the current one; anything else is the user's own scoping decision.\n */\nconst PREVIOUSLY_VENDED_GLOBS = ['**/*', 'dist/**'];\n\nconst isPythonProject = (project: ProjectConfiguration): boolean =>\n  Object.values(project.targets ?? {}).some((target) =>\n    String(target?.executor ?? '').startsWith('@nxlv/python'),\n  );\n\n/**\n * An OpenAPI spec generation target as the generators vend it: named `openapi`\n * or `<agent>-openapi`, running a command, and writing its spec under\n * `dist/.../openapi`. The extra checks keep a user-authored target that merely\n * shares the suffix from being rescoped, since these targets are identified by\n * declaring no `inputs` at all.\n */\nconst isOpenApiTarget = (\n  name: string,\n  target?: TargetConfiguration,\n): boolean => {\n  if (name !== 'openapi' && !name.endsWith('-openapi')) return false;\n  if (!target) return true;\n  return (\n    target.executor === 'nx:run-commands' &&\n    (target.outputs ?? []).some((output) => output.includes('/openapi'))\n  );\n};\n\nconst arraysEqual = (a: readonly unknown[], b: readonly unknown[]): boolean =>\n  a.length === b.length && a.every((entry, index) => entry === b[index]);\n\n/**\n * Excludes Python test files from the `production` named input, and narrows the\n * dependent-task-output input so test reports no longer propagate downstream.\n */\nconst migrateNamedInputs = (tree: Tree, nextSteps: string[]): void => {\n  const nxJson = readNxJson(tree);\n  if (!nxJson) return;\n\n  // Seeded as `['default']` when absent, exactly as the generator does. The\n  // targets below are rewritten to read `production`, and Nx fails hard on a\n  // named input that is not defined, so the two must not diverge.\n  const production = nxJson.namedInputs?.production ?? ['default'];\n  const nextProduction = [\n    ...production,\n    ...PYTHON_TEST_FILE_EXCLUSIONS.filter(\n      (exclusion) => !production.includes(exclusion),\n    ),\n  ];\n\n  const defaultInput = nxJson.namedInputs?.default;\n  let nextDefault = defaultInput;\n  if (defaultInput) {\n    const glob = DEPENDENT_TASKS_OUTPUT_FILES_INPUT.dependentTasksOutputFiles;\n    // Only an entry this plugin vended is rewritten; a different glob is the\n    // user's own scoping decision.\n    nextDefault = defaultInput.map((input) =>\n      typeof input === 'object' &&\n      input !== null &&\n      'dependentTasksOutputFiles' in input &&\n      PREVIOUSLY_VENDED_GLOBS.includes(\n        input.dependentTasksOutputFiles as string,\n      )\n        ? { ...input, dependentTasksOutputFiles: glob }\n        : input,\n    );\n    const hadVendedEntry = nextDefault.some(\n      (input) =>\n        typeof input === 'object' &&\n        input !== null &&\n        'dependentTasksOutputFiles' in input &&\n        input.dependentTasksOutputFiles === glob,\n    );\n    const hasCustomEntry = defaultInput.some(\n      (input) =>\n        typeof input === 'object' &&\n        input !== null &&\n        'dependentTasksOutputFiles' in input &&\n        !PREVIOUSLY_VENDED_GLOBS.includes(\n          input.dependentTasksOutputFiles as string,\n        ) &&\n        input.dependentTasksOutputFiles !== glob,\n    );\n    if (!hadVendedEntry && hasCustomEntry) {\n      nextSteps.push(\n        `nx.json's 'default' named input scopes 'dependentTasksOutputFiles' to a custom glob — left untouched. Narrow it to '${glob}' so timestamped test reports do not invalidate downstream tasks.`,\n      );\n    }\n  }\n\n  updateNxJson(tree, {\n    ...nxJson,\n    namedInputs: {\n      ...nxJson.namedInputs,\n      production: nextProduction,\n      ...(nextDefault ? { default: nextDefault } : {}),\n    },\n  });\n};\n\n/**\n * Scopes a Python project's build-chain targets to production sources. Only\n * targets still carrying the inputs the generator vended are rewritten, so a\n * project whose inputs the user has tuned is reported rather than clobbered.\n */\nconst migrateProjectTargets = (\n  tree: Tree,\n  projectName: string,\n  project: ProjectConfiguration,\n  nextSteps: string[],\n): void => {\n  let changed = false;\n\n  for (const [targetName, target] of Object.entries(project.targets ?? {})) {\n    if (\n      !PRODUCTION_SCOPED_TARGETS.includes(targetName) &&\n      !isOpenApiTarget(targetName, target)\n    ) {\n      continue;\n    }\n\n    const inputs = target.inputs;\n\n    // Already migrated, so a re-run is a no-op.\n    if (inputs && arraysEqual(inputs as unknown[], PRODUCTION_INPUTS)) {\n      continue;\n    }\n\n    // The OpenAPI targets declared no inputs at all, so they fell back to\n    // `default`. Everything else carried the vended pair.\n    const isVendedShape = inputs\n      ? arraysEqual(inputs as unknown[], PREVIOUS_INPUTS)\n      : isOpenApiTarget(targetName, target);\n\n    if (!isVendedShape) {\n      nextSteps.push(\n        `${projectName}:${targetName}: 'inputs' has diverged from the generated shape — left untouched. Scope it to ['production', '^production'] so Python test edits do not invalidate it.`,\n      );\n      continue;\n    }\n\n    target.inputs = [...PRODUCTION_INPUTS];\n    changed = true;\n  }\n\n  if (changed) {\n    updateProjectConfiguration(tree, projectName, project);\n  }\n};\n\nexport default async function migration(\n  tree: Tree,\n): Promise<MigrationReturnObject> {\n  const nextSteps: string[] = [];\n\n  migrateNamedInputs(tree, nextSteps);\n\n  for (const [projectName, project] of getProjects(tree)) {\n    if (!isPythonProject(project)) continue;\n    migrateProjectTargets(tree, projectName, project, nextSteps);\n  }\n\n  await formatFilesInSubtree(tree);\n\n  return { nextSteps };\n}\n"],"names":["getProjects","readNxJson","updateNxJson","updateProjectConfiguration","PYTHON_TEST_FILE_EXCLUSIONS","DEPENDENT_TASKS_OUTPUT_FILES_INPUT","formatFilesInSubtree","PRODUCTION_SCOPED_TARGETS","PRODUCTION_INPUTS","PREVIOUS_INPUTS","PREVIOUSLY_VENDED_GLOBS","isPythonProject","project","Object","values","targets","some","target","String","executor","startsWith","isOpenApiTarget","name","endsWith","outputs","output","includes","arraysEqual","a","b","length","every","entry","index","migrateNamedInputs","tree","nextSteps","nxJson","production","namedInputs","nextProduction","filter","exclusion","defaultInput","default","nextDefault","glob","dependentTasksOutputFiles","map","input","hadVendedEntry","hasCustomEntry","push","migrateProjectTargets","projectName","changed","targetName","entries","inputs","isVendedShape","migration"],"mappings":"AAAA;;;CAGC,GACD,SACEA,WAAW,EAGXC,UAAU,EAGVC,YAAY,EACZC,0BAA0B,QACrB,aAAa;AACpB,SAASC,2BAA2B,QAAQ,mCAAmC;AAC/E,SAASC,kCAAkC,QAAQ,+BAA+B;AAClF,SAASC,oBAAoB,QAAQ,2BAA2B;AAEhE;;;;;;;;;;;;;;CAcC,GAED,yEAAyE,GACzE,MAAMC,4BAA4B;IAAC;IAAW;IAAc;CAAa;AAEzE,qEAAqE,GACrE,MAAMC,oBAAoB;IAAC;IAAc;CAAc;AAEvD,8CAA8C,GAC9C,MAAMC,kBAAkB;IAAC;IAAW;CAAc;AAElD;;;CAGC,GACD,MAAMC,0BAA0B;IAAC;IAAQ;CAAU;AAEnD,MAAMC,kBAAkB,CAACC,UACvBC,OAAOC,MAAM,CAACF,QAAQG,OAAO,IAAI,CAAC,GAAGC,IAAI,CAAC,CAACC,SACzCC,OAAOD,QAAQE,YAAY,IAAIC,UAAU,CAAC;AAG9C;;;;;;CAMC,GACD,MAAMC,kBAAkB,CACtBC,MACAL;IAEA,IAAIK,SAAS,aAAa,CAACA,KAAKC,QAAQ,CAAC,aAAa,OAAO;IAC7D,IAAI,CAACN,QAAQ,OAAO;IACpB,OACEA,OAAOE,QAAQ,KAAK,qBACpB,AAACF,CAAAA,OAAOO,OAAO,IAAI,EAAE,AAAD,EAAGR,IAAI,CAAC,CAACS,SAAWA,OAAOC,QAAQ,CAAC;AAE5D;AAEA,MAAMC,cAAc,CAACC,GAAuBC,IAC1CD,EAAEE,MAAM,KAAKD,EAAEC,MAAM,IAAIF,EAAEG,KAAK,CAAC,CAACC,OAAOC,QAAUD,UAAUH,CAAC,CAACI,MAAM;AAEvE;;;CAGC,GACD,MAAMC,qBAAqB,CAACC,MAAYC;IACtC,MAAMC,SAASpC,WAAWkC;IAC1B,IAAI,CAACE,QAAQ;IAEb,0EAA0E;IAC1E,2EAA2E;IAC3E,gEAAgE;IAChE,MAAMC,aAAaD,OAAOE,WAAW,EAAED,cAAc;QAAC;KAAU;IAChE,MAAME,iBAAiB;WAClBF;WACAlC,4BAA4BqC,MAAM,CACnC,CAACC,YAAc,CAACJ,WAAWZ,QAAQ,CAACgB;KAEvC;IAED,MAAMC,eAAeN,OAAOE,WAAW,EAAEK;IACzC,IAAIC,cAAcF;IAClB,IAAIA,cAAc;QAChB,MAAMG,OAAOzC,mCAAmC0C,yBAAyB;QACzE,yEAAyE;QACzE,+BAA+B;QAC/BF,cAAcF,aAAaK,GAAG,CAAC,CAACC,QAC9B,OAAOA,UAAU,YACjBA,UAAU,QACV,+BAA+BA,SAC/BvC,wBAAwBgB,QAAQ,CAC9BuB,MAAMF,yBAAyB,IAE7B;gBAAE,GAAGE,KAAK;gBAAEF,2BAA2BD;YAAK,IAC5CG;QAEN,MAAMC,iBAAiBL,YAAY7B,IAAI,CACrC,CAACiC,QACC,OAAOA,UAAU,YACjBA,UAAU,QACV,+BAA+BA,SAC/BA,MAAMF,yBAAyB,KAAKD;QAExC,MAAMK,iBAAiBR,aAAa3B,IAAI,CACtC,CAACiC,QACC,OAAOA,UAAU,YACjBA,UAAU,QACV,+BAA+BA,SAC/B,CAACvC,wBAAwBgB,QAAQ,CAC/BuB,MAAMF,yBAAyB,KAEjCE,MAAMF,yBAAyB,KAAKD;QAExC,IAAI,CAACI,kBAAkBC,gBAAgB;YACrCf,UAAUgB,IAAI,CACZ,CAAC,oHAAoH,EAAEN,KAAK,iEAAiE,CAAC;QAElM;IACF;IAEA5C,aAAaiC,MAAM;QACjB,GAAGE,MAAM;QACTE,aAAa;YACX,GAAGF,OAAOE,WAAW;YACrBD,YAAYE;YACZ,GAAIK,cAAc;gBAAED,SAASC;YAAY,IAAI,CAAC,CAAC;QACjD;IACF;AACF;AAEA;;;;CAIC,GACD,MAAMQ,wBAAwB,CAC5BlB,MACAmB,aACA1C,SACAwB;IAEA,IAAImB,UAAU;IAEd,KAAK,MAAM,CAACC,YAAYvC,OAAO,IAAIJ,OAAO4C,OAAO,CAAC7C,QAAQG,OAAO,IAAI,CAAC,GAAI;QACxE,IACE,CAACR,0BAA0BmB,QAAQ,CAAC8B,eACpC,CAACnC,gBAAgBmC,YAAYvC,SAC7B;YACA;QACF;QAEA,MAAMyC,SAASzC,OAAOyC,MAAM;QAE5B,4CAA4C;QAC5C,IAAIA,UAAU/B,YAAY+B,QAAqBlD,oBAAoB;YACjE;QACF;QAEA,sEAAsE;QACtE,sDAAsD;QACtD,MAAMmD,gBAAgBD,SAClB/B,YAAY+B,QAAqBjD,mBACjCY,gBAAgBmC,YAAYvC;QAEhC,IAAI,CAAC0C,eAAe;YAClBvB,UAAUgB,IAAI,CACZ,GAAGE,YAAY,CAAC,EAAEE,WAAW,uJAAuJ,CAAC;YAEvL;QACF;QAEAvC,OAAOyC,MAAM,GAAG;eAAIlD;SAAkB;QACtC+C,UAAU;IACZ;IAEA,IAAIA,SAAS;QACXpD,2BAA2BgC,MAAMmB,aAAa1C;IAChD;AACF;AAEA,eAAe,eAAegD,UAC5BzB,IAAU;IAEV,MAAMC,YAAsB,EAAE;IAE9BF,mBAAmBC,MAAMC;IAEzB,KAAK,MAAM,CAACkB,aAAa1C,QAAQ,IAAIZ,YAAYmC,MAAO;QACtD,IAAI,CAACxB,gBAAgBC,UAAU;QAC/ByC,sBAAsBlB,MAAMmB,aAAa1C,SAASwB;IACpD;IAEA,MAAM9B,qBAAqB6B;IAE3B,OAAO;QAAEC;IAAU;AACrB"}

package/src/migrations/latest/python-version-drop-exact-patch/metadata.json

@@ -0,0 +1,3 @@
+{
+  "description": "Drop the exact CPython patch from .python-version to the Lambda runtime's major.minor"
+}

package/src/migrations/latest/python-version-drop-exact-patch/migration.d.ts

@@ -0,0 +1,6 @@
+/**
+ * Copyright Amazon.com, Inc. or its affiliates. All Rights Reserved.
+ * SPDX-License-Identifier: Apache-2.0
+ */
+import { type MigrationReturnObject, type Tree } from '@nx/devkit';
+export default function migration(tree: Tree): Promise<MigrationReturnObject>;

package/src/migrations/latest/python-version-drop-exact-patch/migration.js

@@ -0,0 +1,43 @@
+/**
+ * Copyright Amazon.com, Inc. or its affiliates. All Rights Reserved.
+ * SPDX-License-Identifier: Apache-2.0
+ */ import { visitNotIgnoredFiles } from "@nx/devkit";
+import { formatFilesInSubtree } from "../../../utils/format.js";
+/**
+ * A `.python-version` naming an exact CPython patch resolves only where uv has a
+ * build of that patch: `3.14.7` installs on Linux but not on macOS, so `uv sync`
+ * fails there on a workspace that works elsewhere.
+ *
+ * uv reads a bare `major.minor` as a request for any patch of that minor, so
+ * dropping the patch lets each platform resolve a build it has. Lambda patches the
+ * interpreter itself, so the minor is the whole of what a project needs to pin.
+ *
+ * Only a patch of the minor the releases in question vended is dropped — another
+ * minor is the user's choice of interpreter, and the version sync moves the
+ * interpreter forward when the runtime's minor itself changes.
+ */ /**
+ * The Python runtime minor those releases vended, spelled out rather than read
+ * from `LAMBDA_RUNTIME_VERSIONS`.
+ *
+ * A migration describes a fixed point in history: it has to keep rewriting the
+ * versions those releases actually wrote, whatever the current pin is. Reading the
+ * live constant would silently retarget this at whatever minor the plugin vends by
+ * the time a user upgrades, and stop correcting the value it exists for.
+ */ const VENDED_MINOR = '3.14';
+export default async function migration(tree) {
+    // uv writes a `.python-version` per project as well as at the root, and one
+    // left behind fails `uv sync` for that project alone.
+    visitNotIgnoredFiles(tree, '.', (path)=>{
+        if (path !== '.python-version' && !path.endsWith('/.python-version')) {
+            return;
+        }
+        const declared = (tree.read(path, 'utf-8') ?? '').trim();
+        if (/^(\d+\.\d+)\.\d+$/.exec(declared)?.[1] === VENDED_MINOR) {
+            tree.write(path, `${VENDED_MINOR}\n`);
+        }
+    });
+    await formatFilesInSubtree(tree);
+    return {};
+}
+
+//# sourceMappingURL=migration.js.map

package/src/migrations/latest/python-version-drop-exact-patch/migration.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../../../../../../../packages/nx-plugin/src/migrations/latest/python-version-drop-exact-patch/migration.ts"],"sourcesContent":["/**\n * Copyright Amazon.com, Inc. or its affiliates. All Rights Reserved.\n * SPDX-License-Identifier: Apache-2.0\n */\nimport {\n  type MigrationReturnObject,\n  type Tree,\n  visitNotIgnoredFiles,\n} from '@nx/devkit';\nimport { formatFilesInSubtree } from '../../../utils/format.js';\n\n/**\n * A `.python-version` naming an exact CPython patch resolves only where uv has a\n * build of that patch: `3.14.7` installs on Linux but not on macOS, so `uv sync`\n * fails there on a workspace that works elsewhere.\n *\n * uv reads a bare `major.minor` as a request for any patch of that minor, so\n * dropping the patch lets each platform resolve a build it has. Lambda patches the\n * interpreter itself, so the minor is the whole of what a project needs to pin.\n *\n * Only a patch of the minor the releases in question vended is dropped — another\n * minor is the user's choice of interpreter, and the version sync moves the\n * interpreter forward when the runtime's minor itself changes.\n */\n\n/**\n * The Python runtime minor those releases vended, spelled out rather than read\n * from `LAMBDA_RUNTIME_VERSIONS`.\n *\n * A migration describes a fixed point in history: it has to keep rewriting the\n * versions those releases actually wrote, whatever the current pin is. Reading the\n * live constant would silently retarget this at whatever minor the plugin vends by\n * the time a user upgrades, and stop correcting the value it exists for.\n */\nconst VENDED_MINOR = '3.14';\n\nexport default async function migration(\n  tree: Tree,\n): Promise<MigrationReturnObject> {\n  // uv writes a `.python-version` per project as well as at the root, and one\n  // left behind fails `uv sync` for that project alone.\n  visitNotIgnoredFiles(tree, '.', (path) => {\n    if (path !== '.python-version' && !path.endsWith('/.python-version')) {\n      return;\n    }\n    const declared = (tree.read(path, 'utf-8') ?? '').trim();\n    if (/^(\\d+\\.\\d+)\\.\\d+$/.exec(declared)?.[1] === VENDED_MINOR) {\n      tree.write(path, `${VENDED_MINOR}\\n`);\n    }\n  });\n\n  await formatFilesInSubtree(tree);\n\n  return {};\n}\n"],"names":["visitNotIgnoredFiles","formatFilesInSubtree","VENDED_MINOR","migration","tree","path","endsWith","declared","read","trim","exec","write"],"mappings":"AAAA;;;CAGC,GACD,SAGEA,oBAAoB,QACf,aAAa;AACpB,SAASC,oBAAoB,QAAQ,2BAA2B;AAEhE;;;;;;;;;;;;CAYC,GAED;;;;;;;;CAQC,GACD,MAAMC,eAAe;AAErB,eAAe,eAAeC,UAC5BC,IAAU;IAEV,4EAA4E;IAC5E,sDAAsD;IACtDJ,qBAAqBI,MAAM,KAAK,CAACC;QAC/B,IAAIA,SAAS,qBAAqB,CAACA,KAAKC,QAAQ,CAAC,qBAAqB;YACpE;QACF;QACA,MAAMC,WAAW,AAACH,CAAAA,KAAKI,IAAI,CAACH,MAAM,YAAY,EAAC,EAAGI,IAAI;QACtD,IAAI,oBAAoBC,IAAI,CAACH,WAAW,CAAC,EAAE,KAAKL,cAAc;YAC5DE,KAAKO,KAAK,CAACN,MAAM,GAAGH,aAAa,EAAE,CAAC;QACtC;IACF;IAEA,MAAMD,qBAAqBG;IAE3B,OAAO,CAAC;AACV"}

package/src/migrations/latest/react-website-nx-react-express-override/metadata.json

@@ -0,0 +1,3 @@
+{
+  "description": "Add an npm override pinning the express @nx/react resolves to the version generated websites use, so npm can satisfy its optional peer"
+}

package/src/migrations/latest/react-website-nx-react-express-override/migration.d.ts

@@ -0,0 +1,31 @@
+/**
+ * Copyright Amazon.com, Inc. or its affiliates. All Rights Reserved.
+ * SPDX-License-Identifier: Apache-2.0
+ */
+import { type MigrationReturnObject, type Tree } from '@nx/devkit';
+/**
+ * Pin the `express` `@nx/react` resolves to the version generated websites use.
+ *
+ * `@nx/react` declares an optional `express` peer for its module-federation
+ * dev-server, on the major behind the `express` vended here. npm is alone in
+ * failing the whole install on an optional peer it cannot satisfy:
+ *
+ *   npm error ERESOLVE could not resolve
+ *   npm error   peerOptional express@"^4.21.2" from @nx/react
+ *   npm error Conflicting peer dependency: express@5.2.1
+ *
+ * so an npm workspace with a website cannot install once its nx moves onto a
+ * version carrying that peer. pnpm, bun and yarn only warn, and get nothing.
+ *
+ * Scoped to `@nx/react` rather than pinning `express` workspace-wide: nothing
+ * here loads it, the peer only has to be satisfiable, and a bare override would
+ * reach every other consumer of express too.
+ *
+ * Guardrails:
+ * - npm only, and only for a workspace that has a website — the root `@nx/react`
+ *   the generator adds. Anything else needs no override.
+ * - A user's own `overrides['@nx/react'].express` is left alone: theirs may pin a
+ *   version deliberately.
+ * - Idempotent: writing the same pin twice is a no-op.
+ */
+export default function migration(tree: Tree): Promise<MigrationReturnObject>;

package/src/migrations/latest/react-website-nx-react-express-override/migration.js

@@ -0,0 +1,74 @@
+/**
+ * Copyright Amazon.com, Inc. or its affiliates. All Rights Reserved.
+ * SPDX-License-Identifier: Apache-2.0
+ */ import { detectPackageManager, readJson, updateJson } from "@nx/devkit";
+import { formatFilesInSubtree } from "../../../utils/format.js";
+import { TS_VERSIONS } from "../../../utils/versions.js";
+/**
+ * Pin the `express` `@nx/react` resolves to the version generated websites use.
+ *
+ * `@nx/react` declares an optional `express` peer for its module-federation
+ * dev-server, on the major behind the `express` vended here. npm is alone in
+ * failing the whole install on an optional peer it cannot satisfy:
+ *
+ *   npm error ERESOLVE could not resolve
+ *   npm error   peerOptional express@"^4.21.2" from @nx/react
+ *   npm error Conflicting peer dependency: express@5.2.1
+ *
+ * so an npm workspace with a website cannot install once its nx moves onto a
+ * version carrying that peer. pnpm, bun and yarn only warn, and get nothing.
+ *
+ * Scoped to `@nx/react` rather than pinning `express` workspace-wide: nothing
+ * here loads it, the peer only has to be satisfiable, and a bare override would
+ * reach every other consumer of express too.
+ *
+ * Guardrails:
+ * - npm only, and only for a workspace that has a website — the root `@nx/react`
+ *   the generator adds. Anything else needs no override.
+ * - A user's own `overrides['@nx/react'].express` is left alone: theirs may pin a
+ *   version deliberately.
+ * - Idempotent: writing the same pin twice is a no-op.
+ */ export default async function migration(tree) {
+    const nextSteps = [];
+    if (detectPackageManager(tree.root) !== 'npm') {
+        return {
+            nextSteps
+        };
+    }
+    const packageJson = readJson(tree, 'package.json');
+    const hasNxReact = Boolean(packageJson.devDependencies?.['@nx/react'] ?? packageJson.dependencies?.['@nx/react']);
+    if (!hasNxReact) {
+        return {
+            nextSteps
+        }; // No website in this workspace.
+    }
+    const scoped = packageJson.overrides?.['@nx/react'];
+    // The string form pins `@nx/react` itself, leaving nowhere to nest the peer.
+    if (typeof scoped === 'string') {
+        nextSteps.push(`package.json: overrides['@nx/react'] pins a version as a string, so the express override could not be nested under it - left untouched. npm fails the install on @nx/react's optional express peer, so add { "@nx/react": { ".": "${scoped}", "express": "${TS_VERSIONS.express}" } } to keep it satisfiable.`);
+        return {
+            nextSteps
+        };
+    }
+    if (scoped?.express) {
+        return {
+            nextSteps
+        }; // Already pinned, by this migration or by the user.
+    }
+    updateJson(tree, 'package.json', (json)=>({
+            ...json,
+            overrides: {
+                ...json.overrides,
+                '@nx/react': {
+                    ...scoped,
+                    express: TS_VERSIONS.express
+                }
+            }
+        }));
+    await formatFilesInSubtree(tree);
+    return {
+        nextSteps
+    };
+}
+
+//# sourceMappingURL=migration.js.map

package/src/migrations/latest/react-website-nx-react-express-override/migration.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../../../../../../../packages/nx-plugin/src/migrations/latest/react-website-nx-react-express-override/migration.ts"],"sourcesContent":["/**\n * Copyright Amazon.com, Inc. or its affiliates. All Rights Reserved.\n * SPDX-License-Identifier: Apache-2.0\n */\nimport {\n  detectPackageManager,\n  type MigrationReturnObject,\n  readJson,\n  type Tree,\n  updateJson,\n} from '@nx/devkit';\nimport { formatFilesInSubtree } from '../../../utils/format';\nimport { TS_VERSIONS } from '../../../utils/versions';\n\n/**\n * Pin the `express` `@nx/react` resolves to the version generated websites use.\n *\n * `@nx/react` declares an optional `express` peer for its module-federation\n * dev-server, on the major behind the `express` vended here. npm is alone in\n * failing the whole install on an optional peer it cannot satisfy:\n *\n *   npm error ERESOLVE could not resolve\n *   npm error   peerOptional express@\"^4.21.2\" from @nx/react\n *   npm error Conflicting peer dependency: express@5.2.1\n *\n * so an npm workspace with a website cannot install once its nx moves onto a\n * version carrying that peer. pnpm, bun and yarn only warn, and get nothing.\n *\n * Scoped to `@nx/react` rather than pinning `express` workspace-wide: nothing\n * here loads it, the peer only has to be satisfiable, and a bare override would\n * reach every other consumer of express too.\n *\n * Guardrails:\n * - npm only, and only for a workspace that has a website — the root `@nx/react`\n *   the generator adds. Anything else needs no override.\n * - A user's own `overrides['@nx/react'].express` is left alone: theirs may pin a\n *   version deliberately.\n * - Idempotent: writing the same pin twice is a no-op.\n */\nexport default async function migration(\n  tree: Tree,\n): Promise<MigrationReturnObject> {\n  const nextSteps: string[] = [];\n\n  if (detectPackageManager(tree.root) !== 'npm') {\n    return { nextSteps };\n  }\n\n  const packageJson = readJson<{\n    devDependencies?: Record<string, string>;\n    dependencies?: Record<string, string>;\n    overrides?: Record<string, unknown>;\n  }>(tree, 'package.json');\n\n  const hasNxReact = Boolean(\n    packageJson.devDependencies?.['@nx/react'] ??\n      packageJson.dependencies?.['@nx/react'],\n  );\n  if (!hasNxReact) {\n    return { nextSteps }; // No website in this workspace.\n  }\n\n  const scoped = packageJson.overrides?.['@nx/react'] as\n    | Record<string, string>\n    | string\n    | undefined;\n\n  // The string form pins `@nx/react` itself, leaving nowhere to nest the peer.\n  if (typeof scoped === 'string') {\n    nextSteps.push(\n      `package.json: overrides['@nx/react'] pins a version as a string, so the express override could not be nested under it - left untouched. npm fails the install on @nx/react's optional express peer, so add { \"@nx/react\": { \".\": \"${scoped}\", \"express\": \"${TS_VERSIONS.express}\" } } to keep it satisfiable.`,\n    );\n    return { nextSteps };\n  }\n\n  if (scoped?.express) {\n    return { nextSteps }; // Already pinned, by this migration or by the user.\n  }\n\n  updateJson(tree, 'package.json', (json) => ({\n    ...json,\n    overrides: {\n      ...json.overrides,\n      '@nx/react': { ...scoped, express: TS_VERSIONS.express },\n    },\n  }));\n\n  await formatFilesInSubtree(tree);\n\n  return { nextSteps };\n}\n"],"names":["detectPackageManager","readJson","updateJson","formatFilesInSubtree","TS_VERSIONS","migration","tree","nextSteps","root","packageJson","hasNxReact","Boolean","devDependencies","dependencies","scoped","overrides","push","express","json"],"mappings":"AAAA;;;CAGC,GACD,SACEA,oBAAoB,EAEpBC,QAAQ,EAERC,UAAU,QACL,aAAa;AACpB,SAASC,oBAAoB,QAAQ,2BAAwB;AAC7D,SAASC,WAAW,QAAQ,6BAA0B;AAEtD;;;;;;;;;;;;;;;;;;;;;;;;CAwBC,GACD,eAAe,eAAeC,UAC5BC,IAAU;IAEV,MAAMC,YAAsB,EAAE;IAE9B,IAAIP,qBAAqBM,KAAKE,IAAI,MAAM,OAAO;QAC7C,OAAO;YAAED;QAAU;IACrB;IAEA,MAAME,cAAcR,SAIjBK,MAAM;IAET,MAAMI,aAAaC,QACjBF,YAAYG,eAAe,EAAE,CAAC,YAAY,IACxCH,YAAYI,YAAY,EAAE,CAAC,YAAY;IAE3C,IAAI,CAACH,YAAY;QACf,OAAO;YAAEH;QAAU,GAAG,gCAAgC;IACxD;IAEA,MAAMO,SAASL,YAAYM,SAAS,EAAE,CAAC,YAAY;IAKnD,6EAA6E;IAC7E,IAAI,OAAOD,WAAW,UAAU;QAC9BP,UAAUS,IAAI,CACZ,CAAC,kOAAkO,EAAEF,OAAO,eAAe,EAAEV,YAAYa,OAAO,CAAC,6BAA6B,CAAC;QAEjT,OAAO;YAAEV;QAAU;IACrB;IAEA,IAAIO,QAAQG,SAAS;QACnB,OAAO;YAAEV;QAAU,GAAG,oDAAoD;IAC5E;IAEAL,WAAWI,MAAM,gBAAgB,CAACY,OAAU,CAAA;YAC1C,GAAGA,IAAI;YACPH,WAAW;gBACT,GAAGG,KAAKH,SAAS;gBACjB,aAAa;oBAAE,GAAGD,MAAM;oBAAEG,SAASb,YAAYa,OAAO;gBAAC;YACzD;QACF,CAAA;IAEA,MAAMd,qBAAqBG;IAE3B,OAAO;QAAEC;IAAU;AACrB"}

package/src/migrations/latest/terraform-fmt-check/metadata.json

@@ -0,0 +1,3 @@
+{
+  "description": "Make the terraform fmt target check formatting rather than rewrite its own inputs, moving the write to a fix configuration, and add a lint target which orchestrates it"
+}

package/src/migrations/latest/terraform-fmt-check/migration.d.ts

@@ -0,0 +1,6 @@
+/**
+ * Copyright Amazon.com, Inc. or its affiliates. All Rights Reserved.
+ * SPDX-License-Identifier: Apache-2.0
+ */
+import { type MigrationReturnObject, type Tree } from '@nx/devkit';
+export default function migration(tree: Tree): Promise<MigrationReturnObject>;