@aws/nx-plugin 1.0.0-rc.9 → 1.0.0-rc.90

package/src/migrations/latest/vitest-coverage-output-dir/migration.js

@@ -0,0 +1,177 @@
+/**
+ * Copyright Amazon.com, Inc. or its affiliates. All Rights Reserved.
+ * SPDX-License-Identifier: Apache-2.0
+ */ import { getProjects, joinPathFragments, updateJson } from "@nx/devkit";
+import { isAbsolute } from "path";
+import { GENERATED_REPORTS_DIRECTORY, getCoverageReportsDirectory } from "../../../ts/lib/vitest.js";
+import { applyGritQL, matchGritQL } from "../../../utils/ast.js";
+import { BIOME_TEST_OUTPUT_EXCLUDE, formatFilesInSubtree } from "../../../utils/format.js";
+import { updateGitIgnore } from "../../../utils/git.js";
+/**
+ * Point each project's vitest coverage directory at the workspace's `dist`.
+ *
+ * `@nx/vitest` writes `reportsDirectory: './test-output/vitest/coverage'`, which
+ * resolves inside the project. Coverage is off by default, so the directory stays
+ * dormant until someone runs `vitest --coverage` — at which point the HTML
+ * reporter's bundled third-party scripts land in the project, where the `format`
+ * target reformats them (failing every later build) and the `default` named input
+ * counts them, so no task in the project can be cached again.
+ *
+ * Alongside the rewrite, the coverage directory an older release already wrote
+ * into the project is deleted and `test-output` is added to the workspace
+ * `.gitignore`, so the reporter's vendored third-party scripts can neither be
+ * committed nor picked up by `license#sync`.
+ *
+ * Guardrails:
+ * - The pattern is anchored to the exact literal `@nx/vitest` generated, and
+ *   scoped to the `coverage` block of the config's own `test` object, so a
+ *   `reportsDirectory` elsewhere in the file is left alone.
+ * - A project whose directory has been repointed keeps its value, and is reported
+ *   via `nextSteps` instead — as is one whose directory is set on a target, or a
+ *   `biome.json` whose `files.includes` has diverged from the vended list.
+ * - Idempotent: the pattern no longer matches once rewritten.
+ */ /**
+ * The config filenames to check. Generated projects carry the `.mts` forms; the
+ * other extensions vitest supports are included so a project whose config was
+ * renamed is still migrated. Safe to widen, because the pattern matched inside is
+ * anchored to the exact literal `@nx/vitest` generated.
+ */ const CONFIG_FILES = [
+    'vitest.config.mts',
+    'vitest.config.ts',
+    'vitest.config.mjs',
+    'vitest.config.js',
+    'vite.config.mts',
+    'vite.config.ts',
+    'vite.config.mjs',
+    'vite.config.js'
+];
+/**
+ * The `coverage` block of the object the config factory returns, scoped so a
+ * `coverage` option elsewhere in the file is not matched.
+ */ const coveragePattern = (body)=>`\`test: { $props }\` where {
+  $props <: within \`defineConfig($_)\`,
+  $props <: some \`coverage: { $cov }\`,
+  ${body}
+}`;
+/** Matches a coverage block still carrying the directory `@nx/vitest` generated. */ const GENERATED_DIRECTORY_PATTERN = coveragePattern(`$cov <: some \`reportsDirectory: '${GENERATED_REPORTS_DIRECTORY}'\``);
+/** Matches a coverage block that declares a `reportsDirectory` at all. */ const ANY_DIRECTORY_PATTERN = coveragePattern('$cov <: some `reportsDirectory: $_`');
+/** Rewrites the generated directory to the one under `dist` for a project root. */ const rewriteDirectoryPattern = (projectRoot)=>coveragePattern(`$cov <: some \`reportsDirectory: '${GENERATED_REPORTS_DIRECTORY}'\` as $reportsDirectory,
+  $reportsDirectory => \`reportsDirectory: '${getCoverageReportsDirectory(projectRoot)}'\``);
+/** Matches a coverage block already pointing at the directory under `dist`. */ const migratedDirectoryPattern = (projectRoot)=>coveragePattern(`$cov <: some \`reportsDirectory: '${getCoverageReportsDirectory(projectRoot)}'\``);
+/** The directory an older release wrote coverage into, relative to a project. */ const OLD_COVERAGE_DIRECTORY = 'test-output';
+/**
+ * Exclude test reports from Biome, so a coverage directory pointed anywhere
+ * inside the workspace is still never formatted or linted. Anchored to the
+ * excludes we vend, so a workspace that has rewritten `files.includes` keeps its
+ * own list — and is told to add the exclude itself.
+ */ const excludeTestOutputFromBiome = (tree)=>{
+    if (!tree.exists('biome.json')) {
+        return [];
+    }
+    let unrecognised = false;
+    updateJson(tree, 'biome.json', (biome)=>{
+        const includes = biome?.files?.includes;
+        if (!Array.isArray(includes) || includes.includes(BIOME_TEST_OUTPUT_EXCLUDE)) {
+            return biome;
+        }
+        // Placed next to the other build-output excludes. Without that anchor the
+        // list has diverged from the one we vend, so leave it to the user.
+        if (!includes.includes('!**/out-tsc')) {
+            unrecognised = true;
+            return biome;
+        }
+        return {
+            ...biome,
+            files: {
+                ...biome.files,
+                includes: includes.flatMap((include)=>include === '!**/out-tsc' ? [
+                        include,
+                        BIOME_TEST_OUTPUT_EXCLUDE
+                    ] : [
+                        include
+                    ])
+            }
+        };
+    });
+    return unrecognised ? [
+        `\`biome.json\`: add \`"${BIOME_TEST_OUTPUT_EXCLUDE}"\` to \`files.includes\` so test reports are never formatted or linted. Its \`files.includes\` has diverged from the vended list, so it was left as it is.`
+    ] : [];
+};
+/**
+ * Delete the coverage directory an older release wrote inside the project.
+ *
+ * Left in place it stays git-visible: the vended `.gitignore` covers `dist` but
+ * not `test-output`, so the HTML reporter's vendored third-party scripts can be
+ * committed, and `license#sync` — which builds its candidate set from
+ * git-visible files rather than from `biome.json` — would stamp an Apache-2.0
+ * header onto them. Only the reporter's own output is removed; anything else the
+ * user keeps there is left alone.
+ */ const deleteOldCoverageDirectory = (tree, projectRoot)=>{
+    const oldDirectory = joinPathFragments(projectRoot, OLD_COVERAGE_DIRECTORY, 'vitest/coverage');
+    if (tree.exists(oldDirectory)) {
+        tree.delete(oldDirectory);
+    }
+};
+/**
+ * A `reportsDirectory` set on a target rather than in the vitest config, which
+ * takes precedence over the config value. `@nx/vitest` supports this shape, so
+ * report any that still resolves inside the project — rewriting a target option
+ * is the user's call, not this migration's.
+ */ const targetReportsDirectories = (project)=>{
+    const found = [];
+    for (const [target, config] of Object.entries(project.targets ?? {})){
+        for (const options of [
+            config.options,
+            ...Object.values(config.configurations ?? {})
+        ]){
+            const reportsDirectory = options?.reportsDirectory;
+            // A path escaping the project root is already outside it.
+            if (typeof reportsDirectory === 'string' && !reportsDirectory.startsWith('..') && !isAbsolute(reportsDirectory)) {
+                found.push({
+                    target,
+                    reportsDirectory
+                });
+            }
+        }
+    }
+    return found;
+};
+export default async function migration(tree) {
+    const nextSteps = [
+        ...excludeTestOutputFromBiome(tree)
+    ];
+    // Test reports are build output, so ignore them wherever a project writes them.
+    updateGitIgnore(tree, '.', (patterns)=>patterns.includes(OLD_COVERAGE_DIRECTORY) ? patterns : [
+            ...patterns,
+            OLD_COVERAGE_DIRECTORY
+        ]);
+    for (const [name, project] of getProjects(tree)){
+        for (const { target, reportsDirectory } of targetReportsDirectories(project)){
+            nextSteps.push(`${name}: the \`${target}\` target sets \`reportsDirectory: '${reportsDirectory}'\`, which resolves inside the project and takes precedence over the vitest config. Point it outside the project (eg \`${getCoverageReportsDirectory(project.root)}\`).`);
+        }
+        for (const configFile of CONFIG_FILES){
+            const configPath = joinPathFragments(project.root, configFile);
+            if (!tree.exists(configPath)) {
+                continue;
+            }
+            if (await matchGritQL(tree, configPath, GENERATED_DIRECTORY_PATTERN)) {
+                await applyGritQL(tree, configPath, rewriteDirectoryPattern(project.root));
+                deleteOldCoverageDirectory(tree, project.root);
+                continue;
+            }
+            // A directory the user repointed is theirs to keep, but it may still sit
+            // inside the project, so report it rather than rewriting it. A config
+            // declaring no directory at all relies on vitest's default, which this
+            // migration has no generated shape to match.
+            if (await matchGritQL(tree, configPath, ANY_DIRECTORY_PATTERN) && !await matchGritQL(tree, configPath, migratedDirectoryPattern(project.root))) {
+                nextSteps.push(`${name}: \`${configPath}\` sets its own \`test.coverage.reportsDirectory\`. Point it outside the project (eg \`${getCoverageReportsDirectory(project.root)}\`) so coverage output is not formatted, linted or treated as a task input.`);
+            }
+        }
+    }
+    await formatFilesInSubtree(tree);
+    return {
+        nextSteps
+    };
+}
+
+//# sourceMappingURL=migration.js.map

package/src/migrations/latest/vitest-coverage-output-dir/migration.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../../../../../../../packages/nx-plugin/src/migrations/latest/vitest-coverage-output-dir/migration.ts"],"sourcesContent":["/**\n * Copyright Amazon.com, Inc. or its affiliates. All Rights Reserved.\n * SPDX-License-Identifier: Apache-2.0\n */\nimport {\n  getProjects,\n  joinPathFragments,\n  type MigrationReturnObject,\n  type ProjectConfiguration,\n  type Tree,\n  updateJson,\n} from '@nx/devkit';\nimport { isAbsolute } from 'path';\nimport {\n  GENERATED_REPORTS_DIRECTORY,\n  getCoverageReportsDirectory,\n} from '../../../ts/lib/vitest.js';\nimport { applyGritQL, matchGritQL } from '../../../utils/ast.js';\nimport {\n  BIOME_TEST_OUTPUT_EXCLUDE,\n  formatFilesInSubtree,\n} from '../../../utils/format.js';\nimport { updateGitIgnore } from '../../../utils/git.js';\n\n/**\n * Point each project's vitest coverage directory at the workspace's `dist`.\n *\n * `@nx/vitest` writes `reportsDirectory: './test-output/vitest/coverage'`, which\n * resolves inside the project. Coverage is off by default, so the directory stays\n * dormant until someone runs `vitest --coverage` — at which point the HTML\n * reporter's bundled third-party scripts land in the project, where the `format`\n * target reformats them (failing every later build) and the `default` named input\n * counts them, so no task in the project can be cached again.\n *\n * Alongside the rewrite, the coverage directory an older release already wrote\n * into the project is deleted and `test-output` is added to the workspace\n * `.gitignore`, so the reporter's vendored third-party scripts can neither be\n * committed nor picked up by `license#sync`.\n *\n * Guardrails:\n * - The pattern is anchored to the exact literal `@nx/vitest` generated, and\n *   scoped to the `coverage` block of the config's own `test` object, so a\n *   `reportsDirectory` elsewhere in the file is left alone.\n * - A project whose directory has been repointed keeps its value, and is reported\n *   via `nextSteps` instead — as is one whose directory is set on a target, or a\n *   `biome.json` whose `files.includes` has diverged from the vended list.\n * - Idempotent: the pattern no longer matches once rewritten.\n */\n\n/**\n * The config filenames to check. Generated projects carry the `.mts` forms; the\n * other extensions vitest supports are included so a project whose config was\n * renamed is still migrated. Safe to widen, because the pattern matched inside is\n * anchored to the exact literal `@nx/vitest` generated.\n */\nconst CONFIG_FILES = [\n  'vitest.config.mts',\n  'vitest.config.ts',\n  'vitest.config.mjs',\n  'vitest.config.js',\n  'vite.config.mts',\n  'vite.config.ts',\n  'vite.config.mjs',\n  'vite.config.js',\n];\n\n/**\n * The `coverage` block of the object the config factory returns, scoped so a\n * `coverage` option elsewhere in the file is not matched.\n */\nconst coveragePattern = (body: string): string =>\n  `\\`test: { $props }\\` where {\n  $props <: within \\`defineConfig($_)\\`,\n  $props <: some \\`coverage: { $cov }\\`,\n  ${body}\n}`;\n\n/** Matches a coverage block still carrying the directory `@nx/vitest` generated. */\nconst GENERATED_DIRECTORY_PATTERN = coveragePattern(\n  `$cov <: some \\`reportsDirectory: '${GENERATED_REPORTS_DIRECTORY}'\\``,\n);\n\n/** Matches a coverage block that declares a `reportsDirectory` at all. */\nconst ANY_DIRECTORY_PATTERN = coveragePattern(\n  '$cov <: some `reportsDirectory: $_`',\n);\n\n/** Rewrites the generated directory to the one under `dist` for a project root. */\nconst rewriteDirectoryPattern = (projectRoot: string): string =>\n  coveragePattern(\n    `$cov <: some \\`reportsDirectory: '${GENERATED_REPORTS_DIRECTORY}'\\` as $reportsDirectory,\n  $reportsDirectory => \\`reportsDirectory: '${getCoverageReportsDirectory(projectRoot)}'\\``,\n  );\n\n/** Matches a coverage block already pointing at the directory under `dist`. */\nconst migratedDirectoryPattern = (projectRoot: string): string =>\n  coveragePattern(\n    `$cov <: some \\`reportsDirectory: '${getCoverageReportsDirectory(projectRoot)}'\\``,\n  );\n\n/** The directory an older release wrote coverage into, relative to a project. */\nconst OLD_COVERAGE_DIRECTORY = 'test-output';\n\n/**\n * Exclude test reports from Biome, so a coverage directory pointed anywhere\n * inside the workspace is still never formatted or linted. Anchored to the\n * excludes we vend, so a workspace that has rewritten `files.includes` keeps its\n * own list — and is told to add the exclude itself.\n */\nconst excludeTestOutputFromBiome = (tree: Tree): string[] => {\n  if (!tree.exists('biome.json')) {\n    return [];\n  }\n  let unrecognised = false;\n  updateJson(tree, 'biome.json', (biome) => {\n    const includes: unknown = biome?.files?.includes;\n    if (\n      !Array.isArray(includes) ||\n      includes.includes(BIOME_TEST_OUTPUT_EXCLUDE)\n    ) {\n      return biome;\n    }\n    // Placed next to the other build-output excludes. Without that anchor the\n    // list has diverged from the one we vend, so leave it to the user.\n    if (!includes.includes('!**/out-tsc')) {\n      unrecognised = true;\n      return biome;\n    }\n    return {\n      ...biome,\n      files: {\n        ...biome.files,\n        includes: includes.flatMap((include) =>\n          include === '!**/out-tsc'\n            ? [include, BIOME_TEST_OUTPUT_EXCLUDE]\n            : [include],\n        ),\n      },\n    };\n  });\n  return unrecognised\n    ? [\n        `\\`biome.json\\`: add \\`\"${BIOME_TEST_OUTPUT_EXCLUDE}\"\\` to \\`files.includes\\` so test reports are never formatted or linted. Its \\`files.includes\\` has diverged from the vended list, so it was left as it is.`,\n      ]\n    : [];\n};\n\n/**\n * Delete the coverage directory an older release wrote inside the project.\n *\n * Left in place it stays git-visible: the vended `.gitignore` covers `dist` but\n * not `test-output`, so the HTML reporter's vendored third-party scripts can be\n * committed, and `license#sync` — which builds its candidate set from\n * git-visible files rather than from `biome.json` — would stamp an Apache-2.0\n * header onto them. Only the reporter's own output is removed; anything else the\n * user keeps there is left alone.\n */\nconst deleteOldCoverageDirectory = (tree: Tree, projectRoot: string): void => {\n  const oldDirectory = joinPathFragments(\n    projectRoot,\n    OLD_COVERAGE_DIRECTORY,\n    'vitest/coverage',\n  );\n  if (tree.exists(oldDirectory)) {\n    tree.delete(oldDirectory);\n  }\n};\n\n/**\n * A `reportsDirectory` set on a target rather than in the vitest config, which\n * takes precedence over the config value. `@nx/vitest` supports this shape, so\n * report any that still resolves inside the project — rewriting a target option\n * is the user's call, not this migration's.\n */\nconst targetReportsDirectories = (\n  project: ProjectConfiguration,\n): { target: string; reportsDirectory: string }[] => {\n  const found: { target: string; reportsDirectory: string }[] = [];\n  for (const [target, config] of Object.entries(project.targets ?? {})) {\n    for (const options of [\n      config.options,\n      ...Object.values(config.configurations ?? {}),\n    ]) {\n      const reportsDirectory: unknown = options?.reportsDirectory;\n      // A path escaping the project root is already outside it.\n      if (\n        typeof reportsDirectory === 'string' &&\n        !reportsDirectory.startsWith('..') &&\n        !isAbsolute(reportsDirectory)\n      ) {\n        found.push({ target, reportsDirectory });\n      }\n    }\n  }\n  return found;\n};\n\nexport default async function migration(\n  tree: Tree,\n): Promise<MigrationReturnObject> {\n  const nextSteps: string[] = [...excludeTestOutputFromBiome(tree)];\n\n  // Test reports are build output, so ignore them wherever a project writes them.\n  updateGitIgnore(tree, '.', (patterns) =>\n    patterns.includes(OLD_COVERAGE_DIRECTORY)\n      ? patterns\n      : [...patterns, OLD_COVERAGE_DIRECTORY],\n  );\n\n  for (const [name, project] of getProjects(tree)) {\n    for (const { target, reportsDirectory } of targetReportsDirectories(\n      project,\n    )) {\n      nextSteps.push(\n        `${name}: the \\`${target}\\` target sets \\`reportsDirectory: '${reportsDirectory}'\\`, which resolves inside the project and takes precedence over the vitest config. Point it outside the project (eg \\`${getCoverageReportsDirectory(project.root)}\\`).`,\n      );\n    }\n\n    for (const configFile of CONFIG_FILES) {\n      const configPath = joinPathFragments(project.root, configFile);\n      if (!tree.exists(configPath)) {\n        continue;\n      }\n\n      if (await matchGritQL(tree, configPath, GENERATED_DIRECTORY_PATTERN)) {\n        await applyGritQL(\n          tree,\n          configPath,\n          rewriteDirectoryPattern(project.root),\n        );\n        deleteOldCoverageDirectory(tree, project.root);\n        continue;\n      }\n\n      // A directory the user repointed is theirs to keep, but it may still sit\n      // inside the project, so report it rather than rewriting it. A config\n      // declaring no directory at all relies on vitest's default, which this\n      // migration has no generated shape to match.\n      if (\n        (await matchGritQL(tree, configPath, ANY_DIRECTORY_PATTERN)) &&\n        !(await matchGritQL(\n          tree,\n          configPath,\n          migratedDirectoryPattern(project.root),\n        ))\n      ) {\n        nextSteps.push(\n          `${name}: \\`${configPath}\\` sets its own \\`test.coverage.reportsDirectory\\`. Point it outside the project (eg \\`${getCoverageReportsDirectory(project.root)}\\`) so coverage output is not formatted, linted or treated as a task input.`,\n        );\n      }\n    }\n  }\n\n  await formatFilesInSubtree(tree);\n\n  return { nextSteps };\n}\n"],"names":["getProjects","joinPathFragments","updateJson","isAbsolute","GENERATED_REPORTS_DIRECTORY","getCoverageReportsDirectory","applyGritQL","matchGritQL","BIOME_TEST_OUTPUT_EXCLUDE","formatFilesInSubtree","updateGitIgnore","CONFIG_FILES","coveragePattern","body","GENERATED_DIRECTORY_PATTERN","ANY_DIRECTORY_PATTERN","rewriteDirectoryPattern","projectRoot","migratedDirectoryPattern","OLD_COVERAGE_DIRECTORY","excludeTestOutputFromBiome","tree","exists","unrecognised","biome","includes","files","Array","isArray","flatMap","include","deleteOldCoverageDirectory","oldDirectory","delete","targetReportsDirectories","project","found","target","config","Object","entries","targets","options","values","configurations","reportsDirectory","startsWith","push","migration","nextSteps","patterns","name","root","configFile","configPath"],"mappings":"AAAA;;;CAGC,GACD,SACEA,WAAW,EACXC,iBAAiB,EAIjBC,UAAU,QACL,aAAa;AACpB,SAASC,UAAU,QAAQ,OAAO;AAClC,SACEC,2BAA2B,EAC3BC,2BAA2B,QACtB,4BAA4B;AACnC,SAASC,WAAW,EAAEC,WAAW,QAAQ,wBAAwB;AACjE,SACEC,yBAAyB,EACzBC,oBAAoB,QACf,2BAA2B;AAClC,SAASC,eAAe,QAAQ,wBAAwB;AAExD;;;;;;;;;;;;;;;;;;;;;;;CAuBC,GAED;;;;;CAKC,GACD,MAAMC,eAAe;IACnB;IACA;IACA;IACA;IACA;IACA;IACA;IACA;CACD;AAED;;;CAGC,GACD,MAAMC,kBAAkB,CAACC,OACvB,CAAC;;;EAGD,EAAEA,KAAK;CACR,CAAC;AAEF,kFAAkF,GAClF,MAAMC,8BAA8BF,gBAClC,CAAC,kCAAkC,EAAER,4BAA4B,GAAG,CAAC;AAGvE,wEAAwE,GACxE,MAAMW,wBAAwBH,gBAC5B;AAGF,iFAAiF,GACjF,MAAMI,0BAA0B,CAACC,cAC/BL,gBACE,CAAC,kCAAkC,EAAER,4BAA4B;4CACzB,EAAEC,4BAA4BY,aAAa,GAAG,CAAC;AAG3F,6EAA6E,GAC7E,MAAMC,2BAA2B,CAACD,cAChCL,gBACE,CAAC,kCAAkC,EAAEP,4BAA4BY,aAAa,GAAG,CAAC;AAGtF,+EAA+E,GAC/E,MAAME,yBAAyB;AAE/B;;;;;CAKC,GACD,MAAMC,6BAA6B,CAACC;IAClC,IAAI,CAACA,KAAKC,MAAM,CAAC,eAAe;QAC9B,OAAO,EAAE;IACX;IACA,IAAIC,eAAe;IACnBrB,WAAWmB,MAAM,cAAc,CAACG;QAC9B,MAAMC,WAAoBD,OAAOE,OAAOD;QACxC,IACE,CAACE,MAAMC,OAAO,CAACH,aACfA,SAASA,QAAQ,CAACjB,4BAClB;YACA,OAAOgB;QACT;QACA,0EAA0E;QAC1E,mEAAmE;QACnE,IAAI,CAACC,SAASA,QAAQ,CAAC,gBAAgB;YACrCF,eAAe;YACf,OAAOC;QACT;QACA,OAAO;YACL,GAAGA,KAAK;YACRE,OAAO;gBACL,GAAGF,MAAME,KAAK;gBACdD,UAAUA,SAASI,OAAO,CAAC,CAACC,UAC1BA,YAAY,gBACR;wBAACA;wBAAStB;qBAA0B,GACpC;wBAACsB;qBAAQ;YAEjB;QACF;IACF;IACA,OAAOP,eACH;QACE,CAAC,uBAAuB,EAAEf,0BAA0B,2JAA2J,CAAC;KACjN,GACD,EAAE;AACR;AAEA;;;;;;;;;CASC,GACD,MAAMuB,6BAA6B,CAACV,MAAYJ;IAC9C,MAAMe,eAAe/B,kBACnBgB,aACAE,wBACA;IAEF,IAAIE,KAAKC,MAAM,CAACU,eAAe;QAC7BX,KAAKY,MAAM,CAACD;IACd;AACF;AAEA;;;;;CAKC,GACD,MAAME,2BAA2B,CAC/BC;IAEA,MAAMC,QAAwD,EAAE;IAChE,KAAK,MAAM,CAACC,QAAQC,OAAO,IAAIC,OAAOC,OAAO,CAACL,QAAQM,OAAO,IAAI,CAAC,GAAI;QACpE,KAAK,MAAMC,WAAW;YACpBJ,OAAOI,OAAO;eACXH,OAAOI,MAAM,CAACL,OAAOM,cAAc,IAAI,CAAC;SAC5C,CAAE;YACD,MAAMC,mBAA4BH,SAASG;YAC3C,0DAA0D;YAC1D,IACE,OAAOA,qBAAqB,YAC5B,CAACA,iBAAiBC,UAAU,CAAC,SAC7B,CAAC3C,WAAW0C,mBACZ;gBACAT,MAAMW,IAAI,CAAC;oBAAEV;oBAAQQ;gBAAiB;YACxC;QACF;IACF;IACA,OAAOT;AACT;AAEA,eAAe,eAAeY,UAC5B3B,IAAU;IAEV,MAAM4B,YAAsB;WAAI7B,2BAA2BC;KAAM;IAEjE,gFAAgF;IAChFX,gBAAgBW,MAAM,KAAK,CAAC6B,WAC1BA,SAASzB,QAAQ,CAACN,0BACd+B,WACA;eAAIA;YAAU/B;SAAuB;IAG3C,KAAK,MAAM,CAACgC,MAAMhB,QAAQ,IAAInC,YAAYqB,MAAO;QAC/C,KAAK,MAAM,EAAEgB,MAAM,EAAEQ,gBAAgB,EAAE,IAAIX,yBACzCC,SACC;YACDc,UAAUF,IAAI,CACZ,GAAGI,KAAK,QAAQ,EAAEd,OAAO,oCAAoC,EAAEQ,iBAAiB,uHAAuH,EAAExC,4BAA4B8B,QAAQiB,IAAI,EAAE,IAAI,CAAC;QAE5P;QAEA,KAAK,MAAMC,cAAc1C,aAAc;YACrC,MAAM2C,aAAarD,kBAAkBkC,QAAQiB,IAAI,EAAEC;YACnD,IAAI,CAAChC,KAAKC,MAAM,CAACgC,aAAa;gBAC5B;YACF;YAEA,IAAI,MAAM/C,YAAYc,MAAMiC,YAAYxC,8BAA8B;gBACpE,MAAMR,YACJe,MACAiC,YACAtC,wBAAwBmB,QAAQiB,IAAI;gBAEtCrB,2BAA2BV,MAAMc,QAAQiB,IAAI;gBAC7C;YACF;YAEA,yEAAyE;YACzE,sEAAsE;YACtE,uEAAuE;YACvE,6CAA6C;YAC7C,IACE,AAAC,MAAM7C,YAAYc,MAAMiC,YAAYvC,0BACrC,CAAE,MAAMR,YACNc,MACAiC,YACApC,yBAAyBiB,QAAQiB,IAAI,IAEvC;gBACAH,UAAUF,IAAI,CACZ,GAAGI,KAAK,IAAI,EAAEG,WAAW,uFAAuF,EAAEjD,4BAA4B8B,QAAQiB,IAAI,EAAE,2EAA2E,CAAC;YAE5O;QACF;IACF;IAEA,MAAM3C,qBAAqBY;IAE3B,OAAO;QAAE4B;IAAU;AACrB"}

package/src/migrations/v1.0.0-rc.50/0001-modernize-function-props-cast/metadata.json

@@ -0,0 +1,3 @@
+{
+  "description": "Replace the legacy angle-bracket FunctionProps type assertion with the modern as syntax in generated API constructs"
+}

package/src/migrations/v1.0.0-rc.50/0001-modernize-function-props-cast/migration.d.ts

@@ -0,0 +1,6 @@
+/**
+ * Copyright Amazon.com, Inc. or its affiliates. All Rights Reserved.
+ * SPDX-License-Identifier: Apache-2.0
+ */
+import { type MigrationReturnObject, type Tree } from '@nx/devkit';
+export default function migration(tree: Tree): Promise<MigrationReturnObject>;

package/src/migrations/v1.0.0-rc.50/0001-modernize-function-props-cast/migration.js

@@ -0,0 +1,65 @@
+/**
+ * Copyright Amazon.com, Inc. or its affiliates. All Rights Reserved.
+ * SPDX-License-Identifier: Apache-2.0
+ */ import { visitNotIgnoredFiles } from "@nx/devkit";
+import { formatFilesInSubtree } from "../../../utils/format.js";
+import { PACKAGES_DIR, SHARED_CONSTRUCTS_DIR } from "../../../utils/shared-constructs-constants.js";
+/**
+ * Replace the legacy angle-bracket FunctionProps type assertion with the modern as syntax in generated API constructs
+ *
+ * The legacy `<FunctionProps>{ ... }` cast form is not supported by GritQL's
+ * TypeScript parser, which silently breaks parsing (and therefore matching)
+ * for the entire containing file. Since several other migrations rely on
+ * GritQL to update these API construct files, this cast is replaced here with
+ * the equivalent, GritQL-compatible `{ ... } as FunctionProps` form. This is
+ * matched as an exact literal (rather than via GritQL) since GritQL cannot
+ * parse the file while the legacy cast is still present.
+ *
+ * How to write a migration:
+ * - https://nx.dev/docs/kb/migration-generators
+ * - What `nextSteps` means: https://nx.dev/docs/reference/devkit/MigrationReturnObject
+ *
+ * Guardrails:
+ * - Pattern-match before writing: skip files that have diverged from the shape
+ *   your generators produce and report them via `nextSteps`, or consider a
+ *   hybrid migration, rather than clobbering the user's changes.
+ * - Idempotent: re-running must be a no-op.
+ * - Format what you write: finish with `formatFilesInSubtree` so the files your
+ *   migration wrote are formatted correctly.
+ */ const APIS_APP_DIR = `${PACKAGES_DIR}/${SHARED_CONSTRUCTS_DIR}/src/app/apis`;
+const OLD_CAST_OPEN = 'defaultIntegrationOptions: <FunctionProps>{';
+const NEW_CAST_OPEN = 'defaultIntegrationOptions: {';
+const OLD_CAST_CLOSE = '\n      },\n      buildDefaultIntegration:';
+const NEW_CAST_CLOSE = '\n      } as FunctionProps,\n      buildDefaultIntegration:';
+export default async function migration(tree) {
+    const nextSteps = [];
+    if (!tree.exists(APIS_APP_DIR)) {
+        return {
+            nextSteps
+        };
+    }
+    const apiAppFiles = [];
+    visitNotIgnoredFiles(tree, APIS_APP_DIR, (filePath)=>{
+        apiAppFiles.push(filePath);
+    });
+    for (const filePath of apiAppFiles){
+        if (!filePath.endsWith('.ts') || filePath.endsWith('/index.ts')) {
+            continue;
+        }
+        const contents = tree.read(filePath, 'utf-8') ?? '';
+        if (!contents.includes(OLD_CAST_OPEN)) {
+            continue;
+        }
+        if (!contents.includes(OLD_CAST_CLOSE)) {
+            nextSteps.push(`${filePath}: the defaultIntegrationOptions cast has diverged from the generated shape - left untouched. Manually replace \`<FunctionProps>{ ... }\` with \`{ ... } as FunctionProps\`.`);
+            continue;
+        }
+        tree.write(filePath, contents.replace(OLD_CAST_OPEN, NEW_CAST_OPEN).replace(OLD_CAST_CLOSE, NEW_CAST_CLOSE));
+    }
+    await formatFilesInSubtree(tree);
+    return {
+        nextSteps
+    };
+}
+
+//# sourceMappingURL=migration.js.map

package/src/migrations/v1.0.0-rc.50/0001-modernize-function-props-cast/migration.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../../../../../../../packages/nx-plugin/src/migrations/v1.0.0-rc.50/0001-modernize-function-props-cast/migration.ts"],"sourcesContent":["/**\n * Copyright Amazon.com, Inc. or its affiliates. All Rights Reserved.\n * SPDX-License-Identifier: Apache-2.0\n */\nimport {\n  type MigrationReturnObject,\n  type Tree,\n  visitNotIgnoredFiles,\n} from '@nx/devkit';\nimport { formatFilesInSubtree } from '../../../utils/format.js';\nimport {\n  PACKAGES_DIR,\n  SHARED_CONSTRUCTS_DIR,\n} from '../../../utils/shared-constructs-constants.js';\n\n/**\n * Replace the legacy angle-bracket FunctionProps type assertion with the modern as syntax in generated API constructs\n *\n * The legacy `<FunctionProps>{ ... }` cast form is not supported by GritQL's\n * TypeScript parser, which silently breaks parsing (and therefore matching)\n * for the entire containing file. Since several other migrations rely on\n * GritQL to update these API construct files, this cast is replaced here with\n * the equivalent, GritQL-compatible `{ ... } as FunctionProps` form. This is\n * matched as an exact literal (rather than via GritQL) since GritQL cannot\n * parse the file while the legacy cast is still present.\n *\n * How to write a migration:\n * - https://nx.dev/docs/kb/migration-generators\n * - What `nextSteps` means: https://nx.dev/docs/reference/devkit/MigrationReturnObject\n *\n * Guardrails:\n * - Pattern-match before writing: skip files that have diverged from the shape\n *   your generators produce and report them via `nextSteps`, or consider a\n *   hybrid migration, rather than clobbering the user's changes.\n * - Idempotent: re-running must be a no-op.\n * - Format what you write: finish with `formatFilesInSubtree` so the files your\n *   migration wrote are formatted correctly.\n */\n\nconst APIS_APP_DIR = `${PACKAGES_DIR}/${SHARED_CONSTRUCTS_DIR}/src/app/apis`;\n\nconst OLD_CAST_OPEN = 'defaultIntegrationOptions: <FunctionProps>{';\nconst NEW_CAST_OPEN = 'defaultIntegrationOptions: {';\nconst OLD_CAST_CLOSE = '\\n      },\\n      buildDefaultIntegration:';\nconst NEW_CAST_CLOSE =\n  '\\n      } as FunctionProps,\\n      buildDefaultIntegration:';\n\nexport default async function migration(\n  tree: Tree,\n): Promise<MigrationReturnObject> {\n  const nextSteps: string[] = [];\n\n  if (!tree.exists(APIS_APP_DIR)) {\n    return { nextSteps };\n  }\n\n  const apiAppFiles: string[] = [];\n  visitNotIgnoredFiles(tree, APIS_APP_DIR, (filePath) => {\n    apiAppFiles.push(filePath);\n  });\n\n  for (const filePath of apiAppFiles) {\n    if (!filePath.endsWith('.ts') || filePath.endsWith('/index.ts')) {\n      continue;\n    }\n    const contents = tree.read(filePath, 'utf-8') ?? '';\n    if (!contents.includes(OLD_CAST_OPEN)) {\n      // Already migrated, or doesn't use this shape.\n      continue;\n    }\n    if (!contents.includes(OLD_CAST_CLOSE)) {\n      nextSteps.push(\n        `${filePath}: the defaultIntegrationOptions cast has diverged from the generated shape - left untouched. Manually replace \\`<FunctionProps>{ ... }\\` with \\`{ ... } as FunctionProps\\`.`,\n      );\n      continue;\n    }\n    tree.write(\n      filePath,\n      contents\n        .replace(OLD_CAST_OPEN, NEW_CAST_OPEN)\n        .replace(OLD_CAST_CLOSE, NEW_CAST_CLOSE),\n    );\n  }\n\n  await formatFilesInSubtree(tree);\n\n  return { nextSteps };\n}\n"],"names":["visitNotIgnoredFiles","formatFilesInSubtree","PACKAGES_DIR","SHARED_CONSTRUCTS_DIR","APIS_APP_DIR","OLD_CAST_OPEN","NEW_CAST_OPEN","OLD_CAST_CLOSE","NEW_CAST_CLOSE","migration","tree","nextSteps","exists","apiAppFiles","filePath","push","endsWith","contents","read","includes","write","replace"],"mappings":"AAAA;;;CAGC,GACD,SAGEA,oBAAoB,QACf,aAAa;AACpB,SAASC,oBAAoB,QAAQ,2BAA2B;AAChE,SACEC,YAAY,EACZC,qBAAqB,QAChB,gDAAgD;AAEvD;;;;;;;;;;;;;;;;;;;;;;CAsBC,GAED,MAAMC,eAAe,GAAGF,aAAa,CAAC,EAAEC,sBAAsB,aAAa,CAAC;AAE5E,MAAME,gBAAgB;AACtB,MAAMC,gBAAgB;AACtB,MAAMC,iBAAiB;AACvB,MAAMC,iBACJ;AAEF,eAAe,eAAeC,UAC5BC,IAAU;IAEV,MAAMC,YAAsB,EAAE;IAE9B,IAAI,CAACD,KAAKE,MAAM,CAACR,eAAe;QAC9B,OAAO;YAAEO;QAAU;IACrB;IAEA,MAAME,cAAwB,EAAE;IAChCb,qBAAqBU,MAAMN,cAAc,CAACU;QACxCD,YAAYE,IAAI,CAACD;IACnB;IAEA,KAAK,MAAMA,YAAYD,YAAa;QAClC,IAAI,CAACC,SAASE,QAAQ,CAAC,UAAUF,SAASE,QAAQ,CAAC,cAAc;YAC/D;QACF;QACA,MAAMC,WAAWP,KAAKQ,IAAI,CAACJ,UAAU,YAAY;QACjD,IAAI,CAACG,SAASE,QAAQ,CAACd,gBAAgB;YAErC;QACF;QACA,IAAI,CAACY,SAASE,QAAQ,CAACZ,iBAAiB;YACtCI,UAAUI,IAAI,CACZ,GAAGD,SAAS,2KAA2K,CAAC;YAE1L;QACF;QACAJ,KAAKU,KAAK,CACRN,UACAG,SACGI,OAAO,CAAChB,eAAeC,eACvBe,OAAO,CAACd,gBAAgBC;IAE/B;IAEA,MAAMP,qBAAqBS;IAE3B,OAAO;QAAEC;IAAU;AACrB"}

package/src/migrations/v1.0.0-rc.50/0002-restrict-cors-to-custom-domains/metadata.json

@@ -0,0 +1,3 @@
+{
+  "description": "Include CloudFront custom domain aliases in restrictCorsTo and UserIdentity callback URLs"
+}

package/src/migrations/v1.0.0-rc.50/0002-restrict-cors-to-custom-domains/migration.d.ts

@@ -0,0 +1,6 @@
+/**
+ * Copyright Amazon.com, Inc. or its affiliates. All Rights Reserved.
+ * SPDX-License-Identifier: Apache-2.0
+ */
+import { type MigrationReturnObject, type Tree } from '@nx/devkit';
+export default function migration(tree: Tree): Promise<MigrationReturnObject>;

package/src/migrations/v1.0.0-rc.50/0002-restrict-cors-to-custom-domains/migration.js

@@ -0,0 +1,108 @@
+/**
+ * Copyright Amazon.com, Inc. or its affiliates. All Rights Reserved.
+ * SPDX-License-Identifier: Apache-2.0
+ */ import { visitNotIgnoredFiles } from "@nx/devkit";
+import { addDestructuredImport, addStarExport, applyGritQL } from "../../../utils/ast.js";
+import { formatFilesInSubtree } from "../../../utils/format.js";
+import { isEsmWorkspace } from "../../../utils/module-format.js";
+import { PACKAGES_DIR, SHARED_CONSTRUCTS_DIR } from "../../../utils/shared-constructs-constants.js";
+/**
+ * Include CloudFront custom domain aliases in restrictCorsTo and UserIdentity callback URLs
+ *
+ * How to write a migration:
+ * - https://nx.dev/docs/kb/migration-generators
+ * - What `nextSteps` means: https://nx.dev/docs/reference/devkit/MigrationReturnObject
+ *
+ * Guardrails:
+ * - Pattern-match before writing: skip files that have diverged from the shape
+ *   your generators produce and report them via `nextSteps`, rather than
+ *   clobbering the user's changes.
+ * - Idempotent: re-running must be a no-op.
+ * - Format what you write: finish with `formatFilesInSubtree` so the files your
+ *   migration wrote are formatted correctly.
+ */ const CORE_DIR = `${PACKAGES_DIR}/${SHARED_CONSTRUCTS_DIR}/src/core`;
+const APIS_APP_DIR = `${PACKAGES_DIR}/${SHARED_CONSTRUCTS_DIR}/src/app/apis`;
+const CLOUDFRONT_CORE_FILE = `${CORE_DIR}/cloudfront.ts`;
+const CORE_INDEX_FILE = `${CORE_DIR}/index.ts`;
+const USER_IDENTITY_FILE = `${CORE_DIR}/user-identity.ts`;
+const CLOUDFRONT_HELPER_CONTENT = `import { CfnDistribution, Distribution } from 'aws-cdk-lib/aws-cloudfront';
+
+/**
+ * Finds the domain names associated with a CloudFront distribution.
+ *
+ * Includes the distribution's default \`*.cloudfront.net\` domain name plus any custom
+ * domain names (aliases) configured on it.
+ */
+export const findCloudFrontDomainNames = (
+  distribution: Distribution,
+): string[] => {
+  const cfnDistribution = distribution.node.defaultChild as CfnDistribution;
+  const distributionConfig =
+    cfnDistribution.distributionConfig as CfnDistribution.DistributionConfigProperty;
+  return [distribution.domainName, ...(distributionConfig.aliases ?? [])];
+};
+`;
+// Rewrites the `restrictCorsTo` body as produced by generators prior to this fix.
+const RESTRICT_CORS_TO_GRITQL_PATTERN = "`origins.map(($o) => typeof $o === 'string' ? $o : 'cloudFrontDistribution' in $o ? $branch1 : $branch2)` where { $branch1 <: contains `distributionDomainName`, $branch2 <: contains `distributionDomainName` } => raw`origins.flatMap(($o) => typeof $o === 'string' ? [$o] : findCloudFrontDomainNames('cloudFrontDistribution' in $o ? $o.cloudFrontDistribution : $o).map((domain) => \\`https://${domain}\\`))`";
+// Rewrites UserIdentity's callback/logout URL logic as produced by generators
+// prior to this fix.
+const USER_IDENTITY_CALLBACK_URLS_GRITQL_PATTERN = '`this.findCloudFrontDomainNames()` => `Stack.of(this).node.findAll().filter((child): child is Distribution => child instanceof Distribution).flatMap(findCloudFrontDomainNames)`';
+export default async function migration(tree) {
+    const nextSteps = [];
+    if (!tree.exists(CORE_INDEX_FILE)) {
+        // No common/constructs shared library in this workspace - nothing to migrate.
+        return {
+            nextSteps
+        };
+    }
+    const esm = isEsmWorkspace(tree);
+    const apiCloudFrontImportSpecifier = esm ? '../../core/cloudfront.js' : '../../core/cloudfront';
+    const coreCloudFrontImportSpecifier = esm ? './cloudfront.js' : './cloudfront';
+    if (!tree.exists(CLOUDFRONT_CORE_FILE)) {
+        tree.write(CLOUDFRONT_CORE_FILE, CLOUDFRONT_HELPER_CONTENT);
+    }
+    await addStarExport(tree, CORE_INDEX_FILE, './cloudfront.js');
+    const apiAppFiles = [];
+    visitNotIgnoredFiles(tree, APIS_APP_DIR, (filePath)=>{
+        apiAppFiles.push(filePath);
+    });
+    for (const filePath of apiAppFiles){
+        if (!filePath.endsWith('.ts') || filePath.endsWith('/index.ts')) {
+            continue;
+        }
+        const rewrote = await applyGritQL(tree, filePath, RESTRICT_CORS_TO_GRITQL_PATTERN);
+        if (rewrote) {
+            await addDestructuredImport(tree, filePath, [
+                'findCloudFrontDomainNames'
+            ], apiCloudFrontImportSpecifier);
+            continue;
+        }
+        const contents = tree.read(filePath, 'utf-8') ?? '';
+        if (!contents.includes('findCloudFrontDomainNames(')) {
+            nextSteps.push(`${filePath}: restrictCorsTo has diverged from the generated shape - left untouched. Manually apply the CloudFront custom domain fix (see findCloudFrontDomainNames in common/constructs/src/core/cloudfront.ts).`);
+        }
+    // Otherwise already migrated - silent skip.
+    }
+    if (tree.exists(USER_IDENTITY_FILE)) {
+        const rewrote = await applyGritQL(tree, USER_IDENTITY_FILE, USER_IDENTITY_CALLBACK_URLS_GRITQL_PATTERN);
+        if (rewrote) {
+            await applyGritQL(tree, USER_IDENTITY_FILE, "`import { CfnDistribution, Distribution } from 'aws-cdk-lib/aws-cloudfront'` => `import { Distribution } from 'aws-cdk-lib/aws-cloudfront';`");
+            await applyGritQL(tree, USER_IDENTITY_FILE, "or { `// Includes each distribution's default domain name plus any custom domain names (aliases) configured on it.` => ., `private findCloudFrontDomainNames = (): string[] => $body` => . }");
+            await addDestructuredImport(tree, USER_IDENTITY_FILE, [
+                'findCloudFrontDomainNames'
+            ], coreCloudFrontImportSpecifier);
+        } else {
+            const contents = tree.read(USER_IDENTITY_FILE, 'utf-8') ?? '';
+            if (!contents.includes('.flatMap(findCloudFrontDomainNames)')) {
+                nextSteps.push(`${USER_IDENTITY_FILE}: the callback URL logic has diverged from the generated shape - left untouched. Manually apply the shared findCloudFrontDomainNames helper (see common/constructs/src/core/cloudfront.ts).`);
+            }
+        // Otherwise already migrated - silent skip.
+        }
+    }
+    await formatFilesInSubtree(tree);
+    return {
+        nextSteps
+    };
+}
+
+//# sourceMappingURL=migration.js.map

package/src/migrations/v1.0.0-rc.50/0002-restrict-cors-to-custom-domains/migration.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../../../../../../../packages/nx-plugin/src/migrations/v1.0.0-rc.50/0002-restrict-cors-to-custom-domains/migration.ts"],"sourcesContent":["/**\n * Copyright Amazon.com, Inc. or its affiliates. All Rights Reserved.\n * SPDX-License-Identifier: Apache-2.0\n */\nimport {\n  type MigrationReturnObject,\n  type Tree,\n  visitNotIgnoredFiles,\n} from '@nx/devkit';\nimport {\n  addDestructuredImport,\n  addStarExport,\n  applyGritQL,\n} from '../../../utils/ast.js';\nimport { formatFilesInSubtree } from '../../../utils/format.js';\nimport { isEsmWorkspace } from '../../../utils/module-format.js';\nimport {\n  PACKAGES_DIR,\n  SHARED_CONSTRUCTS_DIR,\n} from '../../../utils/shared-constructs-constants.js';\n\n/**\n * Include CloudFront custom domain aliases in restrictCorsTo and UserIdentity callback URLs\n *\n * How to write a migration:\n * - https://nx.dev/docs/kb/migration-generators\n * - What `nextSteps` means: https://nx.dev/docs/reference/devkit/MigrationReturnObject\n *\n * Guardrails:\n * - Pattern-match before writing: skip files that have diverged from the shape\n *   your generators produce and report them via `nextSteps`, rather than\n *   clobbering the user's changes.\n * - Idempotent: re-running must be a no-op.\n * - Format what you write: finish with `formatFilesInSubtree` so the files your\n *   migration wrote are formatted correctly.\n */\n\nconst CORE_DIR = `${PACKAGES_DIR}/${SHARED_CONSTRUCTS_DIR}/src/core`;\nconst APIS_APP_DIR = `${PACKAGES_DIR}/${SHARED_CONSTRUCTS_DIR}/src/app/apis`;\nconst CLOUDFRONT_CORE_FILE = `${CORE_DIR}/cloudfront.ts`;\nconst CORE_INDEX_FILE = `${CORE_DIR}/index.ts`;\nconst USER_IDENTITY_FILE = `${CORE_DIR}/user-identity.ts`;\n\nconst CLOUDFRONT_HELPER_CONTENT = `import { CfnDistribution, Distribution } from 'aws-cdk-lib/aws-cloudfront';\n\n/**\n * Finds the domain names associated with a CloudFront distribution.\n *\n * Includes the distribution's default \\`*.cloudfront.net\\` domain name plus any custom\n * domain names (aliases) configured on it.\n */\nexport const findCloudFrontDomainNames = (\n  distribution: Distribution,\n): string[] => {\n  const cfnDistribution = distribution.node.defaultChild as CfnDistribution;\n  const distributionConfig =\n    cfnDistribution.distributionConfig as CfnDistribution.DistributionConfigProperty;\n  return [distribution.domainName, ...(distributionConfig.aliases ?? [])];\n};\n`;\n\n// Rewrites the `restrictCorsTo` body as produced by generators prior to this fix.\nconst RESTRICT_CORS_TO_GRITQL_PATTERN =\n  \"`origins.map(($o) => typeof $o === 'string' ? $o : 'cloudFrontDistribution' in $o ? $branch1 : $branch2)` where { $branch1 <: contains `distributionDomainName`, $branch2 <: contains `distributionDomainName` } => raw`origins.flatMap(($o) => typeof $o === 'string' ? [$o] : findCloudFrontDomainNames('cloudFrontDistribution' in $o ? $o.cloudFrontDistribution : $o).map((domain) => \\\\`https://${domain}\\\\`))`\";\n\n// Rewrites UserIdentity's callback/logout URL logic as produced by generators\n// prior to this fix.\nconst USER_IDENTITY_CALLBACK_URLS_GRITQL_PATTERN =\n  '`this.findCloudFrontDomainNames()` => `Stack.of(this).node.findAll().filter((child): child is Distribution => child instanceof Distribution).flatMap(findCloudFrontDomainNames)`';\n\nexport default async function migration(\n  tree: Tree,\n): Promise<MigrationReturnObject> {\n  const nextSteps: string[] = [];\n\n  if (!tree.exists(CORE_INDEX_FILE)) {\n    // No common/constructs shared library in this workspace - nothing to migrate.\n    return { nextSteps };\n  }\n\n  const esm = isEsmWorkspace(tree);\n  const apiCloudFrontImportSpecifier = esm\n    ? '../../core/cloudfront.js'\n    : '../../core/cloudfront';\n  const coreCloudFrontImportSpecifier = esm\n    ? './cloudfront.js'\n    : './cloudfront';\n\n  if (!tree.exists(CLOUDFRONT_CORE_FILE)) {\n    tree.write(CLOUDFRONT_CORE_FILE, CLOUDFRONT_HELPER_CONTENT);\n  }\n  await addStarExport(tree, CORE_INDEX_FILE, './cloudfront.js');\n\n  const apiAppFiles: string[] = [];\n  visitNotIgnoredFiles(tree, APIS_APP_DIR, (filePath) => {\n    apiAppFiles.push(filePath);\n  });\n\n  for (const filePath of apiAppFiles) {\n    if (!filePath.endsWith('.ts') || filePath.endsWith('/index.ts')) {\n      continue;\n    }\n    const rewrote = await applyGritQL(\n      tree,\n      filePath,\n      RESTRICT_CORS_TO_GRITQL_PATTERN,\n    );\n    if (rewrote) {\n      await addDestructuredImport(\n        tree,\n        filePath,\n        ['findCloudFrontDomainNames'],\n        apiCloudFrontImportSpecifier,\n      );\n      continue;\n    }\n    const contents = tree.read(filePath, 'utf-8') ?? '';\n    if (!contents.includes('findCloudFrontDomainNames(')) {\n      nextSteps.push(\n        `${filePath}: restrictCorsTo has diverged from the generated shape - left untouched. Manually apply the CloudFront custom domain fix (see findCloudFrontDomainNames in common/constructs/src/core/cloudfront.ts).`,\n      );\n    }\n    // Otherwise already migrated - silent skip.\n  }\n\n  if (tree.exists(USER_IDENTITY_FILE)) {\n    const rewrote = await applyGritQL(\n      tree,\n      USER_IDENTITY_FILE,\n      USER_IDENTITY_CALLBACK_URLS_GRITQL_PATTERN,\n    );\n    if (rewrote) {\n      await applyGritQL(\n        tree,\n        USER_IDENTITY_FILE,\n        \"`import { CfnDistribution, Distribution } from 'aws-cdk-lib/aws-cloudfront'` => `import { Distribution } from 'aws-cdk-lib/aws-cloudfront';`\",\n      );\n      await applyGritQL(\n        tree,\n        USER_IDENTITY_FILE,\n        \"or { `// Includes each distribution's default domain name plus any custom domain names (aliases) configured on it.` => ., `private findCloudFrontDomainNames = (): string[] => $body` => . }\",\n      );\n      await addDestructuredImport(\n        tree,\n        USER_IDENTITY_FILE,\n        ['findCloudFrontDomainNames'],\n        coreCloudFrontImportSpecifier,\n      );\n    } else {\n      const contents = tree.read(USER_IDENTITY_FILE, 'utf-8') ?? '';\n      if (!contents.includes('.flatMap(findCloudFrontDomainNames)')) {\n        nextSteps.push(\n          `${USER_IDENTITY_FILE}: the callback URL logic has diverged from the generated shape - left untouched. Manually apply the shared findCloudFrontDomainNames helper (see common/constructs/src/core/cloudfront.ts).`,\n        );\n      }\n      // Otherwise already migrated - silent skip.\n    }\n  }\n\n  await formatFilesInSubtree(tree);\n\n  return { nextSteps };\n}\n"],"names":["visitNotIgnoredFiles","addDestructuredImport","addStarExport","applyGritQL","formatFilesInSubtree","isEsmWorkspace","PACKAGES_DIR","SHARED_CONSTRUCTS_DIR","CORE_DIR","APIS_APP_DIR","CLOUDFRONT_CORE_FILE","CORE_INDEX_FILE","USER_IDENTITY_FILE","CLOUDFRONT_HELPER_CONTENT","RESTRICT_CORS_TO_GRITQL_PATTERN","USER_IDENTITY_CALLBACK_URLS_GRITQL_PATTERN","migration","tree","nextSteps","exists","esm","apiCloudFrontImportSpecifier","coreCloudFrontImportSpecifier","write","apiAppFiles","filePath","push","endsWith","rewrote","contents","read","includes"],"mappings":"AAAA;;;CAGC,GACD,SAGEA,oBAAoB,QACf,aAAa;AACpB,SACEC,qBAAqB,EACrBC,aAAa,EACbC,WAAW,QACN,wBAAwB;AAC/B,SAASC,oBAAoB,QAAQ,2BAA2B;AAChE,SAASC,cAAc,QAAQ,kCAAkC;AACjE,SACEC,YAAY,EACZC,qBAAqB,QAChB,gDAAgD;AAEvD;;;;;;;;;;;;;;CAcC,GAED,MAAMC,WAAW,GAAGF,aAAa,CAAC,EAAEC,sBAAsB,SAAS,CAAC;AACpE,MAAME,eAAe,GAAGH,aAAa,CAAC,EAAEC,sBAAsB,aAAa,CAAC;AAC5E,MAAMG,uBAAuB,GAAGF,SAAS,cAAc,CAAC;AACxD,MAAMG,kBAAkB,GAAGH,SAAS,SAAS,CAAC;AAC9C,MAAMI,qBAAqB,GAAGJ,SAAS,iBAAiB,CAAC;AAEzD,MAAMK,4BAA4B,CAAC;;;;;;;;;;;;;;;;AAgBnC,CAAC;AAED,kFAAkF;AAClF,MAAMC,kCACJ;AAEF,8EAA8E;AAC9E,qBAAqB;AACrB,MAAMC,6CACJ;AAEF,eAAe,eAAeC,UAC5BC,IAAU;IAEV,MAAMC,YAAsB,EAAE;IAE9B,IAAI,CAACD,KAAKE,MAAM,CAACR,kBAAkB;QACjC,8EAA8E;QAC9E,OAAO;YAAEO;QAAU;IACrB;IAEA,MAAME,MAAMf,eAAeY;IAC3B,MAAMI,+BAA+BD,MACjC,6BACA;IACJ,MAAME,gCAAgCF,MAClC,oBACA;IAEJ,IAAI,CAACH,KAAKE,MAAM,CAACT,uBAAuB;QACtCO,KAAKM,KAAK,CAACb,sBAAsBG;IACnC;IACA,MAAMX,cAAce,MAAMN,iBAAiB;IAE3C,MAAMa,cAAwB,EAAE;IAChCxB,qBAAqBiB,MAAMR,cAAc,CAACgB;QACxCD,YAAYE,IAAI,CAACD;IACnB;IAEA,KAAK,MAAMA,YAAYD,YAAa;QAClC,IAAI,CAACC,SAASE,QAAQ,CAAC,UAAUF,SAASE,QAAQ,CAAC,cAAc;YAC/D;QACF;QACA,MAAMC,UAAU,MAAMzB,YACpBc,MACAQ,UACAX;QAEF,IAAIc,SAAS;YACX,MAAM3B,sBACJgB,MACAQ,UACA;gBAAC;aAA4B,EAC7BJ;YAEF;QACF;QACA,MAAMQ,WAAWZ,KAAKa,IAAI,CAACL,UAAU,YAAY;QACjD,IAAI,CAACI,SAASE,QAAQ,CAAC,+BAA+B;YACpDb,UAAUQ,IAAI,CACZ,GAAGD,SAAS,qMAAqM,CAAC;QAEtN;IACA,4CAA4C;IAC9C;IAEA,IAAIR,KAAKE,MAAM,CAACP,qBAAqB;QACnC,MAAMgB,UAAU,MAAMzB,YACpBc,MACAL,oBACAG;QAEF,IAAIa,SAAS;YACX,MAAMzB,YACJc,MACAL,oBACA;YAEF,MAAMT,YACJc,MACAL,oBACA;YAEF,MAAMX,sBACJgB,MACAL,oBACA;gBAAC;aAA4B,EAC7BU;QAEJ,OAAO;YACL,MAAMO,WAAWZ,KAAKa,IAAI,CAAClB,oBAAoB,YAAY;YAC3D,IAAI,CAACiB,SAASE,QAAQ,CAAC,wCAAwC;gBAC7Db,UAAUQ,IAAI,CACZ,GAAGd,mBAAmB,2LAA2L,CAAC;YAEtN;QACA,4CAA4C;QAC9C;IACF;IAEA,MAAMR,qBAAqBa;IAE3B,OAAO;QAAEC;IAAU;AACrB"}

package/src/migrations/v1.0.0-rc.50/0003-terraform-bootstrap-adopt-existing-bucket/metadata.json

@@ -0,0 +1,3 @@
+{
+  "description": "Adopt an existing Terraform state bucket in the vended bootstrap script when its state object is missing"
+}

package/src/migrations/v1.0.0-rc.50/0003-terraform-bootstrap-adopt-existing-bucket/migration.d.ts

@@ -0,0 +1,6 @@
+/**
+ * Copyright Amazon.com, Inc. or its affiliates. All Rights Reserved.
+ * SPDX-License-Identifier: Apache-2.0
+ */
+import { type MigrationReturnObject, type Tree } from '@nx/devkit';
+export default function migration(tree: Tree): Promise<MigrationReturnObject>;

package/src/migrations/v1.0.0-rc.50/0003-terraform-bootstrap-adopt-existing-bucket/migration.js

@@ -0,0 +1,128 @@
+/**
+ * Copyright Amazon.com, Inc. or its affiliates. All Rights Reserved.
+ * SPDX-License-Identifier: Apache-2.0
+ */ import { getProjects, joinPathFragments } from "@nx/devkit";
+import { TERRAFORM_PROJECT_GENERATOR_INFO } from "../../../terraform/project/generator.js";
+import { applyGritQL, GRIT_INSERT_PLACEHOLDER, insertViaGritQL, matchGritQL } from "../../../utils/ast.js";
+import { formatFilesInSubtree } from "../../../utils/format.js";
+/**
+ * Adopt an existing Terraform state bucket in the vended bootstrap script when its state object is missing
+ *
+ * The state bucket stores its own tfstate inside itself, so if that object is
+ * deleted while the bucket survives, `bootstrap` reads the 404 as a first run
+ * and asks terraform to create a bucket that already exists — failing with
+ * `BucketAlreadyOwnedByYou` on every subsequent run, with no retry that clears
+ * it. The vended script now imports the existing bucket instead.
+ *
+ * Every edit is expressed as a GritQL rewrite so the script is matched on its
+ * AST rather than its formatting.
+ *
+ * How to write a migration:
+ * - https://nx.dev/docs/kb/migration-generators
+ * - What `nextSteps` means: https://nx.dev/docs/reference/devkit/MigrationReturnObject
+ *
+ * Guardrails:
+ * - Pattern-match before writing: skip files that have diverged from the shape
+ *   your generators produce and report them via `nextSteps`, or consider a
+ *   hybrid migration, rather than clobbering the user's changes.
+ * - Idempotent: re-running must be a no-op.
+ * - Format what you write: finish with `formatFilesInSubtree` so the files your
+ *   migration wrote are formatted correctly.
+ */ // Guards the whole migration: present only once the import step exists.
+const MIGRATED_PATTERN = '`bucketExists($_, $_)`';
+// Every edit site, matched structurally so formatting and argument layout
+// don't affect whether the script is recognised.
+const STATE_FETCH_TRY_PATTERN = 'try_statement() as $try where { $try <: contains `GetObjectCommand` }';
+const STATE_FLAG_SET_PATTERN = '`if (out.Body) { $body }`';
+const HELPER_PATTERN = '`const main = async () => { $body }`';
+const INIT_PATTERN = "`execFileSync('terraform', ['init'], $opts)`";
+const S3_IMPORT_PATTERN = "`import { $before, GetObjectCommand, $after } from '@aws-sdk/client-s3'`";
+const HEADER_COMMENT_PATTERN = 'comment() as $c where { $c <: includes "state back to S3." }';
+// GritQL snippets are parsed as backtick-quoted patterns, so any backtick in
+// the inserted source has to survive that layer escaped.
+const BUCKET_EXISTS_HELPER = `// S3 answers 404 only when the name is genuinely free; 403 means it exists
+// but is not readable with these credentials.
+const bucketExists = async (s3: S3Client, bucket: string) => {
+  try {
+    await s3.send(new HeadBucketCommand({ Bucket: bucket }));
+    return true;
+  } catch (err: any) {
+    const status = err?.$metadata?.httpStatusCode;
+    if (status === 404) return false;
+    if (status === 403) return true;
+    throw err;
+  }
+};`;
+const IMPORT_STEP = `// The bucket holds its own state, so losing the state object while the
+  // bucket survives would otherwise wedge bootstrap on a permanent
+  // \`BucketAlreadyOwnedByYou\`. Adopt the existing bucket instead.
+  if (!haveState && (await bucketExists(s3, bucket))) {
+    console.log(
+      \`State bucket \${bucket} already exists but its bootstrap state is missing — importing it.\`,
+    );
+    execFileSync(
+      'terraform',
+      [
+        'import',
+        \`-state=\${tfStatePath}\`,
+        \`-var=aws_region=\${region}\`,
+        'aws_s3_bucket.terraform_state',
+        bucket,
+      ],
+      { cwd: bootstrapDir, stdio: 'inherit' },
+    );
+  }`;
+// Rewritten wholesale rather than appended to, since the summary sentence
+// changes rather than gaining a clause.
+const NEW_HEADER_COMMENT = `/**
+ * Bootstraps the remote Terraform state bucket.
+ *
+ * Equivalent to \\\`cdk bootstrap\\\` — resolves account + region from the AWS
+ * SDK credential chain, pulls any existing bootstrap tfstate from S3,
+ * runs \\\`terraform apply\\\` in the \\\`bootstrap\\\` dir, then pushes the new
+ * state back to S3. Adopts an already-existing state bucket when its
+ * state object is missing.
+ */`;
+const DIVERGED_NEXT_STEP = (filePath)=>`${filePath}: the bootstrap script has diverged from the generated shape - left untouched. Manually \`terraform import aws_s3_bucket.terraform_state <bucket>\` before \`terraform apply\` when the state bucket exists but its \`bootstrap.tfstate\` object does not, otherwise bootstrap fails with BucketAlreadyOwnedByYou.`;
+export default async function migration(tree) {
+    const nextSteps = [];
+    // Terraform application projects are the only ones that vend bootstrap.ts.
+    const bootstrapScripts = [
+        ...getProjects(tree).values()
+    ].filter((project)=>project.metadata?.generator === TERRAFORM_PROJECT_GENERATOR_INFO.id).map((project)=>joinPathFragments(project.root, 'scripts/bootstrap.ts')).filter((filePath)=>tree.exists(filePath));
+    for (const filePath of bootstrapScripts){
+        if (await matchGritQL(tree, filePath, MIGRATED_PATTERN)) {
+            continue;
+        }
+        // Confirm every edit site is present before writing any of them, so a
+        // script that only partly matches is left whole rather than half-edited.
+        const allSitesPresent = (await Promise.all([
+            STATE_FETCH_TRY_PATTERN,
+            STATE_FLAG_SET_PATTERN,
+            HELPER_PATTERN,
+            INIT_PATTERN,
+            S3_IMPORT_PATTERN,
+            HEADER_COMMENT_PATTERN
+        ].map((pattern)=>matchGritQL(tree, filePath, pattern)))).every(Boolean);
+        if (!allSitesPresent) {
+            nextSteps.push(DIVERGED_NEXT_STEP(filePath));
+            continue;
+        }
+        // `haveState` distinguishes "no remote state" from "no bucket", so the
+        // import only runs when terraform has no prior knowledge of the bucket.
+        await insertViaGritQL(tree, filePath, `${STATE_FETCH_TRY_PATTERN} => \`${GRIT_INSERT_PLACEHOLDER}\n  $try\``, 'let haveState = false;');
+        await applyGritQL(tree, filePath, `${STATE_FLAG_SET_PATTERN} => \`if (out.Body) {\n      $body\n      haveState = true;\n    }\``);
+        await insertViaGritQL(tree, filePath, `${HELPER_PATTERN} => \`${GRIT_INSERT_PLACEHOLDER}\n\nconst main = async () => { $body }\``, BUCKET_EXISTS_HELPER);
+        await insertViaGritQL(tree, filePath, `${INIT_PATTERN} => \`execFileSync('terraform', ['init'], $opts);\n\n  ${GRIT_INSERT_PLACEHOLDER}\n\``, IMPORT_STEP);
+        // Placed in the generator's import position rather than appended, so a
+        // migrated workspace matches a freshly generated one.
+        await applyGritQL(tree, filePath, `${S3_IMPORT_PATTERN} => \`import { $before, GetObjectCommand, HeadBucketCommand, $after } from '@aws-sdk/client-s3'\``);
+        await applyGritQL(tree, filePath, `${HEADER_COMMENT_PATTERN} => \`${NEW_HEADER_COMMENT}\``);
+    }
+    await formatFilesInSubtree(tree);
+    return {
+        nextSteps
+    };
+}
+
+//# sourceMappingURL=migration.js.map

package/src/migrations/v1.0.0-rc.50/0003-terraform-bootstrap-adopt-existing-bucket/migration.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../../../../../../../packages/nx-plugin/src/migrations/v1.0.0-rc.50/0003-terraform-bootstrap-adopt-existing-bucket/migration.ts"],"sourcesContent":["/**\n * Copyright Amazon.com, Inc. or its affiliates. All Rights Reserved.\n * SPDX-License-Identifier: Apache-2.0\n */\nimport {\n  getProjects,\n  joinPathFragments,\n  type MigrationReturnObject,\n  type Tree,\n} from '@nx/devkit';\nimport { TERRAFORM_PROJECT_GENERATOR_INFO } from '../../../terraform/project/generator.js';\nimport {\n  applyGritQL,\n  GRIT_INSERT_PLACEHOLDER,\n  insertViaGritQL,\n  matchGritQL,\n} from '../../../utils/ast.js';\nimport { formatFilesInSubtree } from '../../../utils/format.js';\n\n/**\n * Adopt an existing Terraform state bucket in the vended bootstrap script when its state object is missing\n *\n * The state bucket stores its own tfstate inside itself, so if that object is\n * deleted while the bucket survives, `bootstrap` reads the 404 as a first run\n * and asks terraform to create a bucket that already exists — failing with\n * `BucketAlreadyOwnedByYou` on every subsequent run, with no retry that clears\n * it. The vended script now imports the existing bucket instead.\n *\n * Every edit is expressed as a GritQL rewrite so the script is matched on its\n * AST rather than its formatting.\n *\n * How to write a migration:\n * - https://nx.dev/docs/kb/migration-generators\n * - What `nextSteps` means: https://nx.dev/docs/reference/devkit/MigrationReturnObject\n *\n * Guardrails:\n * - Pattern-match before writing: skip files that have diverged from the shape\n *   your generators produce and report them via `nextSteps`, or consider a\n *   hybrid migration, rather than clobbering the user's changes.\n * - Idempotent: re-running must be a no-op.\n * - Format what you write: finish with `formatFilesInSubtree` so the files your\n *   migration wrote are formatted correctly.\n */\n\n// Guards the whole migration: present only once the import step exists.\nconst MIGRATED_PATTERN = '`bucketExists($_, $_)`';\n\n// Every edit site, matched structurally so formatting and argument layout\n// don't affect whether the script is recognised.\nconst STATE_FETCH_TRY_PATTERN =\n  'try_statement() as $try where { $try <: contains `GetObjectCommand` }';\nconst STATE_FLAG_SET_PATTERN = '`if (out.Body) { $body }`';\nconst HELPER_PATTERN = '`const main = async () => { $body }`';\nconst INIT_PATTERN = \"`execFileSync('terraform', ['init'], $opts)`\";\nconst S3_IMPORT_PATTERN =\n  \"`import { $before, GetObjectCommand, $after } from '@aws-sdk/client-s3'`\";\nconst HEADER_COMMENT_PATTERN =\n  'comment() as $c where { $c <: includes \"state back to S3.\" }';\n\n// GritQL snippets are parsed as backtick-quoted patterns, so any backtick in\n// the inserted source has to survive that layer escaped.\nconst BUCKET_EXISTS_HELPER = `// S3 answers 404 only when the name is genuinely free; 403 means it exists\n// but is not readable with these credentials.\nconst bucketExists = async (s3: S3Client, bucket: string) => {\n  try {\n    await s3.send(new HeadBucketCommand({ Bucket: bucket }));\n    return true;\n  } catch (err: any) {\n    const status = err?.$metadata?.httpStatusCode;\n    if (status === 404) return false;\n    if (status === 403) return true;\n    throw err;\n  }\n};`;\n\nconst IMPORT_STEP = `// The bucket holds its own state, so losing the state object while the\n  // bucket survives would otherwise wedge bootstrap on a permanent\n  // \\`BucketAlreadyOwnedByYou\\`. Adopt the existing bucket instead.\n  if (!haveState && (await bucketExists(s3, bucket))) {\n    console.log(\n      \\`State bucket \\${bucket} already exists but its bootstrap state is missing — importing it.\\`,\n    );\n    execFileSync(\n      'terraform',\n      [\n        'import',\n        \\`-state=\\${tfStatePath}\\`,\n        \\`-var=aws_region=\\${region}\\`,\n        'aws_s3_bucket.terraform_state',\n        bucket,\n      ],\n      { cwd: bootstrapDir, stdio: 'inherit' },\n    );\n  }`;\n\n// Rewritten wholesale rather than appended to, since the summary sentence\n// changes rather than gaining a clause.\nconst NEW_HEADER_COMMENT = `/**\n * Bootstraps the remote Terraform state bucket.\n *\n * Equivalent to \\\\\\`cdk bootstrap\\\\\\` — resolves account + region from the AWS\n * SDK credential chain, pulls any existing bootstrap tfstate from S3,\n * runs \\\\\\`terraform apply\\\\\\` in the \\\\\\`bootstrap\\\\\\` dir, then pushes the new\n * state back to S3. Adopts an already-existing state bucket when its\n * state object is missing.\n */`;\n\nconst DIVERGED_NEXT_STEP = (filePath: string) =>\n  `${filePath}: the bootstrap script has diverged from the generated shape - left untouched. Manually \\`terraform import aws_s3_bucket.terraform_state <bucket>\\` before \\`terraform apply\\` when the state bucket exists but its \\`bootstrap.tfstate\\` object does not, otherwise bootstrap fails with BucketAlreadyOwnedByYou.`;\n\nexport default async function migration(\n  tree: Tree,\n): Promise<MigrationReturnObject> {\n  const nextSteps: string[] = [];\n\n  // Terraform application projects are the only ones that vend bootstrap.ts.\n  const bootstrapScripts = [...getProjects(tree).values()]\n    .filter(\n      (project) =>\n        (project.metadata as any)?.generator ===\n        TERRAFORM_PROJECT_GENERATOR_INFO.id,\n    )\n    .map((project) => joinPathFragments(project.root, 'scripts/bootstrap.ts'))\n    .filter((filePath) => tree.exists(filePath));\n\n  for (const filePath of bootstrapScripts) {\n    if (await matchGritQL(tree, filePath, MIGRATED_PATTERN)) {\n      // Already migrated - silent skip keeps re-runs a no-op.\n      continue;\n    }\n\n    // Confirm every edit site is present before writing any of them, so a\n    // script that only partly matches is left whole rather than half-edited.\n    const allSitesPresent = (\n      await Promise.all(\n        [\n          STATE_FETCH_TRY_PATTERN,\n          STATE_FLAG_SET_PATTERN,\n          HELPER_PATTERN,\n          INIT_PATTERN,\n          S3_IMPORT_PATTERN,\n          HEADER_COMMENT_PATTERN,\n        ].map((pattern) => matchGritQL(tree, filePath, pattern)),\n      )\n    ).every(Boolean);\n\n    if (!allSitesPresent) {\n      nextSteps.push(DIVERGED_NEXT_STEP(filePath));\n      continue;\n    }\n\n    // `haveState` distinguishes \"no remote state\" from \"no bucket\", so the\n    // import only runs when terraform has no prior knowledge of the bucket.\n    await insertViaGritQL(\n      tree,\n      filePath,\n      `${STATE_FETCH_TRY_PATTERN} => \\`${GRIT_INSERT_PLACEHOLDER}\\n  $try\\``,\n      'let haveState = false;',\n    );\n    await applyGritQL(\n      tree,\n      filePath,\n      `${STATE_FLAG_SET_PATTERN} => \\`if (out.Body) {\\n      $body\\n      haveState = true;\\n    }\\``,\n    );\n    await insertViaGritQL(\n      tree,\n      filePath,\n      `${HELPER_PATTERN} => \\`${GRIT_INSERT_PLACEHOLDER}\\n\\nconst main = async () => { $body }\\``,\n      BUCKET_EXISTS_HELPER,\n    );\n    await insertViaGritQL(\n      tree,\n      filePath,\n      `${INIT_PATTERN} => \\`execFileSync('terraform', ['init'], $opts);\\n\\n  ${GRIT_INSERT_PLACEHOLDER}\\n\\``,\n      IMPORT_STEP,\n    );\n\n    // Placed in the generator's import position rather than appended, so a\n    // migrated workspace matches a freshly generated one.\n    await applyGritQL(\n      tree,\n      filePath,\n      `${S3_IMPORT_PATTERN} => \\`import { $before, GetObjectCommand, HeadBucketCommand, $after } from '@aws-sdk/client-s3'\\``,\n    );\n\n    await applyGritQL(\n      tree,\n      filePath,\n      `${HEADER_COMMENT_PATTERN} => \\`${NEW_HEADER_COMMENT}\\``,\n    );\n  }\n\n  await formatFilesInSubtree(tree);\n\n  return { nextSteps };\n}\n"],"names":["getProjects","joinPathFragments","TERRAFORM_PROJECT_GENERATOR_INFO","applyGritQL","GRIT_INSERT_PLACEHOLDER","insertViaGritQL","matchGritQL","formatFilesInSubtree","MIGRATED_PATTERN","STATE_FETCH_TRY_PATTERN","STATE_FLAG_SET_PATTERN","HELPER_PATTERN","INIT_PATTERN","S3_IMPORT_PATTERN","HEADER_COMMENT_PATTERN","BUCKET_EXISTS_HELPER","IMPORT_STEP","NEW_HEADER_COMMENT","DIVERGED_NEXT_STEP","filePath","migration","tree","nextSteps","bootstrapScripts","values","filter","project","metadata","generator","id","map","root","exists","allSitesPresent","Promise","all","pattern","every","Boolean","push"],"mappings":"AAAA;;;CAGC,GACD,SACEA,WAAW,EACXC,iBAAiB,QAGZ,aAAa;AACpB,SAASC,gCAAgC,QAAQ,0CAA0C;AAC3F,SACEC,WAAW,EACXC,uBAAuB,EACvBC,eAAe,EACfC,WAAW,QACN,wBAAwB;AAC/B,SAASC,oBAAoB,QAAQ,2BAA2B;AAEhE;;;;;;;;;;;;;;;;;;;;;;;CAuBC,GAED,wEAAwE;AACxE,MAAMC,mBAAmB;AAEzB,0EAA0E;AAC1E,iDAAiD;AACjD,MAAMC,0BACJ;AACF,MAAMC,yBAAyB;AAC/B,MAAMC,iBAAiB;AACvB,MAAMC,eAAe;AACrB,MAAMC,oBACJ;AACF,MAAMC,yBACJ;AAEF,6EAA6E;AAC7E,yDAAyD;AACzD,MAAMC,uBAAuB,CAAC;;;;;;;;;;;;EAY5B,CAAC;AAEH,MAAMC,cAAc,CAAC;;;;;;;;;;;;;;;;;;GAkBlB,CAAC;AAEJ,0EAA0E;AAC1E,wCAAwC;AACxC,MAAMC,qBAAqB,CAAC;;;;;;;;GAQzB,CAAC;AAEJ,MAAMC,qBAAqB,CAACC,WAC1B,GAAGA,SAAS,kTAAkT,CAAC;AAEjU,eAAe,eAAeC,UAC5BC,IAAU;IAEV,MAAMC,YAAsB,EAAE;IAE9B,2EAA2E;IAC3E,MAAMC,mBAAmB;WAAIvB,YAAYqB,MAAMG,MAAM;KAAG,CACrDC,MAAM,CACL,CAACC,UACC,AAACA,QAAQC,QAAQ,EAAUC,cAC3B1B,iCAAiC2B,EAAE,EAEtCC,GAAG,CAAC,CAACJ,UAAYzB,kBAAkByB,QAAQK,IAAI,EAAE,yBACjDN,MAAM,CAAC,CAACN,WAAaE,KAAKW,MAAM,CAACb;IAEpC,KAAK,MAAMA,YAAYI,iBAAkB;QACvC,IAAI,MAAMjB,YAAYe,MAAMF,UAAUX,mBAAmB;YAEvD;QACF;QAEA,sEAAsE;QACtE,yEAAyE;QACzE,MAAMyB,kBAAkB,AACtB,CAAA,MAAMC,QAAQC,GAAG,CACf;YACE1B;YACAC;YACAC;YACAC;YACAC;YACAC;SACD,CAACgB,GAAG,CAAC,CAACM,UAAY9B,YAAYe,MAAMF,UAAUiB,UACjD,EACAC,KAAK,CAACC;QAER,IAAI,CAACL,iBAAiB;YACpBX,UAAUiB,IAAI,CAACrB,mBAAmBC;YAClC;QACF;QAEA,uEAAuE;QACvE,wEAAwE;QACxE,MAAMd,gBACJgB,MACAF,UACA,GAAGV,wBAAwB,MAAM,EAAEL,wBAAwB,UAAU,CAAC,EACtE;QAEF,MAAMD,YACJkB,MACAF,UACA,GAAGT,uBAAuB,oEAAoE,CAAC;QAEjG,MAAML,gBACJgB,MACAF,UACA,GAAGR,eAAe,MAAM,EAAEP,wBAAwB,wCAAwC,CAAC,EAC3FW;QAEF,MAAMV,gBACJgB,MACAF,UACA,GAAGP,aAAa,uDAAuD,EAAER,wBAAwB,IAAI,CAAC,EACtGY;QAGF,uEAAuE;QACvE,sDAAsD;QACtD,MAAMb,YACJkB,MACAF,UACA,GAAGN,kBAAkB,iGAAiG,CAAC;QAGzH,MAAMV,YACJkB,MACAF,UACA,GAAGL,uBAAuB,MAAM,EAAEG,mBAAmB,EAAE,CAAC;IAE5D;IAEA,MAAMV,qBAAqBc;IAE3B,OAAO;QAAEC;IAAU;AACrB"}

package/src/migrations/v1.0.0-rc.52/0001-user-identity-waf-allow-localhost-callback/metadata.json

@@ -0,0 +1,3 @@
+{
+  "description": "Count the EC2MetaDataSSRF_QUERYARGUMENTS WAF rule on the UserIdentity Web ACL so sign-in from a local dev server is not blocked"
+}

package/src/migrations/v1.0.0-rc.52/0001-user-identity-waf-allow-localhost-callback/migration.d.ts

@@ -0,0 +1,6 @@
+/**
+ * Copyright Amazon.com, Inc. or its affiliates. All Rights Reserved.
+ * SPDX-License-Identifier: Apache-2.0
+ */
+import type { MigrationReturnObject, Tree } from '@nx/devkit';
+export default function migration(tree: Tree): Promise<MigrationReturnObject>;