@aws/nx-plugin 1.0.0-rc.9 → 1.0.0-rc.90

package/src/migrations/v1.0.0-rc.79/0001-py-agent-ag-ui-hooks/migration.js

@@ -0,0 +1,113 @@
+/**
+ * Copyright Amazon.com, Inc. or its affiliates. All Rights Reserved.
+ * SPDX-License-Identifier: Apache-2.0
+ */ import { getProjects, joinPathFragments } from "@nx/devkit";
+import { PY_AGENT_GENERATOR_INFO } from "../../../py/agent/generator.js";
+import { addPythonDestructuredImport, applyGritQL, captureGritQLVariable, GRIT_INSERT_PLACEHOLDER, insertViaGritQL, matchGritQL } from "../../../utils/ast.js";
+import { formatFilesInSubtree } from "../../../utils/format.js";
+/**
+ * Forward a Strands py#agent's hooks to the AG-UI adapter.
+ *
+ * `StrandsAgent` builds a fresh `Agent` per `thread_id` by copying the template
+ * Agent's kwargs, but deliberately skips `hooks` - Strands keeps only the built
+ * `HookRegistry`, so the providers can't be read back off it. An AG-UI agent's
+ * `log_model_errors` / `log_tool_errors` therefore never fired for served
+ * requests, and model/tool failures were reported as successful runs.
+ *
+ * The fix hoists the hooks list out of the `Agent(...)` call into an
+ * `AGENT_HOOKS` module constant in `agent.py` - whatever the user has put in it,
+ * so custom hooks come along - and passes that to `StrandsAgent(...)` in
+ * `main.py` as well. `agent.py` is hoisted for every protocol so the constant
+ * matches what the generator vends today; only AG-UI needs the `main.py` half.
+ */ // `Agent`'s `hooks` list is invariant, so the hoisted constant has to declare
+// the parameter's own type - an inline literal was inferred from it instead.
+const HOOKS_TYPE = 'list[HookProvider | HookCallback]';
+const HOOKS_MODULE = 'strands.hooks';
+// Anchored on the `get_agent` context manager - the one shape shared by every
+// generated protocol and connection combination - so the constant lands
+// directly above its only use, where the generator vends it.
+const HOIST_HOOKS_PATTERN = `language python
+\`@contextmanager
+def get_agent($params):
+    $body\` => raw\`AGENT_HOOKS: ${HOOKS_TYPE} = ${GRIT_INSERT_PLACEHOLDER}
+
+
+@contextmanager
+def get_agent($params):
+    $body\` where { $program <: not contains \`AGENT_HOOKS\` }`;
+// Scoped to the Agent constructor so a hooks list the user passes elsewhere in
+// agent.py is left alone.
+const HOOKS_LIST_CAPTURE_PATTERN = 'language python\n`hooks=[$hooks]` where { $hooks <: within `Agent($_)` }';
+const HOOKS_LIST_REWRITE_PATTERN = 'language python\n`hooks=[$_]` as $kwarg where { $kwarg <: within `Agent($_)`, $kwarg => `hooks=AGENT_HOOKS` }';
+const AGUI_CONSTRUCTOR_MATCH_PATTERN = 'language python\n`StrandsAgent($args)` where { $args <: contains `agent=$_` }';
+const AGUI_HOOKS_WIRED_PATTERN = 'language python\n`StrandsAgent($args)` where { $args <: contains `agent=$_`, $args <: contains `hooks=$_` }';
+// Appends after the last argument rather than re-emitting the argument list,
+// both to land `hooks=` where the template puts it and to leave the other
+// arguments' formatting and comments untouched.
+const AGUI_HOOKS_APPEND_PATTERN = 'language python\n`StrandsAgent($args)` where { $args <: contains `agent=$_`, $args <: not contains `hooks=$_`, $args <: [$..., $last], $last += `, hooks=AGENT_HOOKS` }';
+const findAgentComponents = (components)=>(components ?? []).filter((component)=>component.generator === PY_AGENT_GENERATOR_INFO.id);
+/**
+ * Hoists `agent.py`'s `hooks=[...]` list into an `AGENT_HOOKS` module constant,
+ * returning whether the file ends up exporting one.
+ */ const hoistAgentHooks = async (tree, agentPath)=>{
+    if ((tree.read(agentPath, 'utf-8') ?? '').includes('AGENT_HOOKS')) {
+        return true;
+    }
+    // Nothing to hoist unless the Agent is constructed with an inline hooks list.
+    const hooks = await captureGritQLVariable(tree, agentPath, HOOKS_LIST_CAPTURE_PATTERN, 'hooks');
+    if (!hooks) return false;
+    if (!await insertViaGritQL(tree, agentPath, HOIST_HOOKS_PATTERN, `[${hooks}]`)) {
+        return false;
+    }
+    await applyGritQL(tree, agentPath, HOOKS_LIST_REWRITE_PATTERN);
+    await addPythonDestructuredImport(tree, agentPath, [
+        'HookCallback',
+        'HookProvider'
+    ], HOOKS_MODULE);
+    return true;
+};
+const migrateAgent = async (tree, agentDir, component, nextSteps)=>{
+    // LangChain agents pass no hooks - their AG-UI adapter is handed the graph
+    // itself rather than rebuilding one, so nothing is dropped.
+    if (component.framework === 'langchain') return;
+    const agentPath = joinPathFragments(agentDir, 'agent.py');
+    const mainPath = joinPathFragments(agentDir, 'main.py');
+    const isAgUi = component.protocol === 'ag-ui';
+    if (!tree.exists(agentPath)) return;
+    if (!await hoistAgentHooks(tree, agentPath)) {
+        if (isAgUi) {
+            nextSteps.push(`${agentPath}: the hooks passed to \`Agent(...)\` have diverged from the generated shape - left untouched. Hoist them into an \`AGENT_HOOKS\` module constant and pass it to \`StrandsAgent(...)\` in ${mainPath} too, or AG-UI will not register them (see the py#agent generator's template).`);
+        }
+        return;
+    }
+    // Only AG-UI rebuilds the Agent, so only its main.py needs the hooks.
+    if (!isAgUi || !tree.exists(mainPath)) return;
+    // Already passing hooks, whether from a previous run or the user's own wiring.
+    if (await matchGritQL(tree, mainPath, AGUI_HOOKS_WIRED_PATTERN)) return;
+    if (!await matchGritQL(tree, mainPath, AGUI_CONSTRUCTOR_MATCH_PATTERN)) {
+        nextSteps.push(`${mainPath}: the \`StrandsAgent(...)\` constructor has diverged from the generated shape - left untouched. Pass \`hooks=AGENT_HOOKS\` to it, importing \`AGENT_HOOKS\` from \`.agent\`, or AG-UI will not register the agent's hooks (see the py#agent generator's template).`);
+        return;
+    }
+    await applyGritQL(tree, mainPath, AGUI_HOOKS_APPEND_PATTERN);
+    await addPythonDestructuredImport(tree, mainPath, [
+        'AGENT_HOOKS'
+    ], '.agent');
+};
+export default async function migration(tree) {
+    const nextSteps = [];
+    for (const project of getProjects(tree).values()){
+        const components = findAgentComponents(project.metadata?.components);
+        for (const component of components){
+            if (!component.path) continue;
+            // Legacy component paths point at agent.py rather than its directory.
+            const componentDir = component.path.endsWith('/agent.py') ? component.path.slice(0, -'/agent.py'.length) : component.path;
+            await migrateAgent(tree, joinPathFragments(project.root, componentDir), component, nextSteps);
+        }
+    }
+    await formatFilesInSubtree(tree);
+    return {
+        nextSteps
+    };
+}
+
+//# sourceMappingURL=migration.js.map

package/src/migrations/v1.0.0-rc.79/0001-py-agent-ag-ui-hooks/migration.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../../../../../../../packages/nx-plugin/src/migrations/v1.0.0-rc.79/0001-py-agent-ag-ui-hooks/migration.ts"],"sourcesContent":["/**\n * Copyright Amazon.com, Inc. or its affiliates. All Rights Reserved.\n * SPDX-License-Identifier: Apache-2.0\n */\nimport {\n  getProjects,\n  joinPathFragments,\n  type MigrationReturnObject,\n  type Tree,\n} from '@nx/devkit';\nimport { PY_AGENT_GENERATOR_INFO } from '../../../py/agent/generator.js';\nimport {\n  addPythonDestructuredImport,\n  applyGritQL,\n  captureGritQLVariable,\n  GRIT_INSERT_PLACEHOLDER,\n  insertViaGritQL,\n  matchGritQL,\n} from '../../../utils/ast.js';\nimport { formatFilesInSubtree } from '../../../utils/format.js';\nimport type { ComponentMetadata } from '../../../utils/nx.js';\n\n/**\n * Forward a Strands py#agent's hooks to the AG-UI adapter.\n *\n * `StrandsAgent` builds a fresh `Agent` per `thread_id` by copying the template\n * Agent's kwargs, but deliberately skips `hooks` - Strands keeps only the built\n * `HookRegistry`, so the providers can't be read back off it. An AG-UI agent's\n * `log_model_errors` / `log_tool_errors` therefore never fired for served\n * requests, and model/tool failures were reported as successful runs.\n *\n * The fix hoists the hooks list out of the `Agent(...)` call into an\n * `AGENT_HOOKS` module constant in `agent.py` - whatever the user has put in it,\n * so custom hooks come along - and passes that to `StrandsAgent(...)` in\n * `main.py` as well. `agent.py` is hoisted for every protocol so the constant\n * matches what the generator vends today; only AG-UI needs the `main.py` half.\n */\n\n// `Agent`'s `hooks` list is invariant, so the hoisted constant has to declare\n// the parameter's own type - an inline literal was inferred from it instead.\nconst HOOKS_TYPE = 'list[HookProvider | HookCallback]';\nconst HOOKS_MODULE = 'strands.hooks';\n\n// Anchored on the `get_agent` context manager - the one shape shared by every\n// generated protocol and connection combination - so the constant lands\n// directly above its only use, where the generator vends it.\nconst HOIST_HOOKS_PATTERN = `language python\n\\`@contextmanager\ndef get_agent($params):\n    $body\\` => raw\\`AGENT_HOOKS: ${HOOKS_TYPE} = ${GRIT_INSERT_PLACEHOLDER}\n\n\n@contextmanager\ndef get_agent($params):\n    $body\\` where { $program <: not contains \\`AGENT_HOOKS\\` }`;\n\n// Scoped to the Agent constructor so a hooks list the user passes elsewhere in\n// agent.py is left alone.\nconst HOOKS_LIST_CAPTURE_PATTERN =\n  'language python\\n`hooks=[$hooks]` where { $hooks <: within `Agent($_)` }';\nconst HOOKS_LIST_REWRITE_PATTERN =\n  'language python\\n`hooks=[$_]` as $kwarg where { $kwarg <: within `Agent($_)`, $kwarg => `hooks=AGENT_HOOKS` }';\n\nconst AGUI_CONSTRUCTOR_MATCH_PATTERN =\n  'language python\\n`StrandsAgent($args)` where { $args <: contains `agent=$_` }';\nconst AGUI_HOOKS_WIRED_PATTERN =\n  'language python\\n`StrandsAgent($args)` where { $args <: contains `agent=$_`, $args <: contains `hooks=$_` }';\n// Appends after the last argument rather than re-emitting the argument list,\n// both to land `hooks=` where the template puts it and to leave the other\n// arguments' formatting and comments untouched.\nconst AGUI_HOOKS_APPEND_PATTERN =\n  'language python\\n`StrandsAgent($args)` where { $args <: contains `agent=$_`, $args <: not contains `hooks=$_`, $args <: [$..., $last], $last += `, hooks=AGENT_HOOKS` }';\n\nconst findAgentComponents = (\n  components: ComponentMetadata[] | undefined,\n): ComponentMetadata[] =>\n  (components ?? []).filter(\n    (component) => component.generator === PY_AGENT_GENERATOR_INFO.id,\n  );\n\n/**\n * Hoists `agent.py`'s `hooks=[...]` list into an `AGENT_HOOKS` module constant,\n * returning whether the file ends up exporting one.\n */\nconst hoistAgentHooks = async (\n  tree: Tree,\n  agentPath: string,\n): Promise<boolean> => {\n  if ((tree.read(agentPath, 'utf-8') ?? '').includes('AGENT_HOOKS')) {\n    return true;\n  }\n\n  // Nothing to hoist unless the Agent is constructed with an inline hooks list.\n  const hooks = await captureGritQLVariable(\n    tree,\n    agentPath,\n    HOOKS_LIST_CAPTURE_PATTERN,\n    'hooks',\n  );\n  if (!hooks) return false;\n\n  if (\n    !(await insertViaGritQL(tree, agentPath, HOIST_HOOKS_PATTERN, `[${hooks}]`))\n  ) {\n    return false;\n  }\n  await applyGritQL(tree, agentPath, HOOKS_LIST_REWRITE_PATTERN);\n  await addPythonDestructuredImport(\n    tree,\n    agentPath,\n    ['HookCallback', 'HookProvider'],\n    HOOKS_MODULE,\n  );\n  return true;\n};\n\nconst migrateAgent = async (\n  tree: Tree,\n  agentDir: string,\n  component: ComponentMetadata,\n  nextSteps: string[],\n): Promise<void> => {\n  // LangChain agents pass no hooks - their AG-UI adapter is handed the graph\n  // itself rather than rebuilding one, so nothing is dropped.\n  if (component.framework === 'langchain') return;\n\n  const agentPath = joinPathFragments(agentDir, 'agent.py');\n  const mainPath = joinPathFragments(agentDir, 'main.py');\n  const isAgUi = component.protocol === 'ag-ui';\n\n  if (!tree.exists(agentPath)) return;\n\n  if (!(await hoistAgentHooks(tree, agentPath))) {\n    if (isAgUi) {\n      nextSteps.push(\n        `${agentPath}: the hooks passed to \\`Agent(...)\\` have diverged from the generated shape - left untouched. Hoist them into an \\`AGENT_HOOKS\\` module constant and pass it to \\`StrandsAgent(...)\\` in ${mainPath} too, or AG-UI will not register them (see the py#agent generator's template).`,\n      );\n    }\n    return;\n  }\n\n  // Only AG-UI rebuilds the Agent, so only its main.py needs the hooks.\n  if (!isAgUi || !tree.exists(mainPath)) return;\n\n  // Already passing hooks, whether from a previous run or the user's own wiring.\n  if (await matchGritQL(tree, mainPath, AGUI_HOOKS_WIRED_PATTERN)) return;\n\n  if (!(await matchGritQL(tree, mainPath, AGUI_CONSTRUCTOR_MATCH_PATTERN))) {\n    nextSteps.push(\n      `${mainPath}: the \\`StrandsAgent(...)\\` constructor has diverged from the generated shape - left untouched. Pass \\`hooks=AGENT_HOOKS\\` to it, importing \\`AGENT_HOOKS\\` from \\`.agent\\`, or AG-UI will not register the agent's hooks (see the py#agent generator's template).`,\n    );\n    return;\n  }\n\n  await applyGritQL(tree, mainPath, AGUI_HOOKS_APPEND_PATTERN);\n  await addPythonDestructuredImport(tree, mainPath, ['AGENT_HOOKS'], '.agent');\n};\n\nexport default async function migration(\n  tree: Tree,\n): Promise<MigrationReturnObject> {\n  const nextSteps: string[] = [];\n\n  for (const project of getProjects(tree).values()) {\n    const components = findAgentComponents(\n      (project.metadata as { components?: ComponentMetadata[] })?.components,\n    );\n\n    for (const component of components) {\n      if (!component.path) continue;\n\n      // Legacy component paths point at agent.py rather than its directory.\n      const componentDir = component.path.endsWith('/agent.py')\n        ? component.path.slice(0, -'/agent.py'.length)\n        : component.path;\n\n      await migrateAgent(\n        tree,\n        joinPathFragments(project.root, componentDir),\n        component,\n        nextSteps,\n      );\n    }\n  }\n\n  await formatFilesInSubtree(tree);\n\n  return { nextSteps };\n}\n"],"names":["getProjects","joinPathFragments","PY_AGENT_GENERATOR_INFO","addPythonDestructuredImport","applyGritQL","captureGritQLVariable","GRIT_INSERT_PLACEHOLDER","insertViaGritQL","matchGritQL","formatFilesInSubtree","HOOKS_TYPE","HOOKS_MODULE","HOIST_HOOKS_PATTERN","HOOKS_LIST_CAPTURE_PATTERN","HOOKS_LIST_REWRITE_PATTERN","AGUI_CONSTRUCTOR_MATCH_PATTERN","AGUI_HOOKS_WIRED_PATTERN","AGUI_HOOKS_APPEND_PATTERN","findAgentComponents","components","filter","component","generator","id","hoistAgentHooks","tree","agentPath","read","includes","hooks","migrateAgent","agentDir","nextSteps","framework","mainPath","isAgUi","protocol","exists","push","migration","project","values","metadata","path","componentDir","endsWith","slice","length","root"],"mappings":"AAAA;;;CAGC,GACD,SACEA,WAAW,EACXC,iBAAiB,QAGZ,aAAa;AACpB,SAASC,uBAAuB,QAAQ,iCAAiC;AACzE,SACEC,2BAA2B,EAC3BC,WAAW,EACXC,qBAAqB,EACrBC,uBAAuB,EACvBC,eAAe,EACfC,WAAW,QACN,wBAAwB;AAC/B,SAASC,oBAAoB,QAAQ,2BAA2B;AAGhE;;;;;;;;;;;;;;CAcC,GAED,8EAA8E;AAC9E,6EAA6E;AAC7E,MAAMC,aAAa;AACnB,MAAMC,eAAe;AAErB,8EAA8E;AAC9E,wEAAwE;AACxE,6DAA6D;AAC7D,MAAMC,sBAAsB,CAAC;;;iCAGI,EAAEF,WAAW,GAAG,EAAEJ,wBAAwB;;;;;8DAKb,CAAC;AAE/D,+EAA+E;AAC/E,0BAA0B;AAC1B,MAAMO,6BACJ;AACF,MAAMC,6BACJ;AAEF,MAAMC,iCACJ;AACF,MAAMC,2BACJ;AACF,6EAA6E;AAC7E,0EAA0E;AAC1E,gDAAgD;AAChD,MAAMC,4BACJ;AAEF,MAAMC,sBAAsB,CAC1BC,aAEA,AAACA,CAAAA,cAAc,EAAE,AAAD,EAAGC,MAAM,CACvB,CAACC,YAAcA,UAAUC,SAAS,KAAKpB,wBAAwBqB,EAAE;AAGrE;;;CAGC,GACD,MAAMC,kBAAkB,OACtBC,MACAC;IAEA,IAAI,AAACD,CAAAA,KAAKE,IAAI,CAACD,WAAW,YAAY,EAAC,EAAGE,QAAQ,CAAC,gBAAgB;QACjE,OAAO;IACT;IAEA,8EAA8E;IAC9E,MAAMC,QAAQ,MAAMxB,sBAClBoB,MACAC,WACAb,4BACA;IAEF,IAAI,CAACgB,OAAO,OAAO;IAEnB,IACE,CAAE,MAAMtB,gBAAgBkB,MAAMC,WAAWd,qBAAqB,CAAC,CAAC,EAAEiB,MAAM,CAAC,CAAC,GAC1E;QACA,OAAO;IACT;IACA,MAAMzB,YAAYqB,MAAMC,WAAWZ;IACnC,MAAMX,4BACJsB,MACAC,WACA;QAAC;QAAgB;KAAe,EAChCf;IAEF,OAAO;AACT;AAEA,MAAMmB,eAAe,OACnBL,MACAM,UACAV,WACAW;IAEA,2EAA2E;IAC3E,4DAA4D;IAC5D,IAAIX,UAAUY,SAAS,KAAK,aAAa;IAEzC,MAAMP,YAAYzB,kBAAkB8B,UAAU;IAC9C,MAAMG,WAAWjC,kBAAkB8B,UAAU;IAC7C,MAAMI,SAASd,UAAUe,QAAQ,KAAK;IAEtC,IAAI,CAACX,KAAKY,MAAM,CAACX,YAAY;IAE7B,IAAI,CAAE,MAAMF,gBAAgBC,MAAMC,YAAa;QAC7C,IAAIS,QAAQ;YACVH,UAAUM,IAAI,CACZ,GAAGZ,UAAU,yLAAyL,EAAEQ,SAAS,8EAA8E,CAAC;QAEpS;QACA;IACF;IAEA,sEAAsE;IACtE,IAAI,CAACC,UAAU,CAACV,KAAKY,MAAM,CAACH,WAAW;IAEvC,+EAA+E;IAC/E,IAAI,MAAM1B,YAAYiB,MAAMS,UAAUlB,2BAA2B;IAEjE,IAAI,CAAE,MAAMR,YAAYiB,MAAMS,UAAUnB,iCAAkC;QACxEiB,UAAUM,IAAI,CACZ,GAAGJ,SAAS,kQAAkQ,CAAC;QAEjR;IACF;IAEA,MAAM9B,YAAYqB,MAAMS,UAAUjB;IAClC,MAAMd,4BAA4BsB,MAAMS,UAAU;QAAC;KAAc,EAAE;AACrE;AAEA,eAAe,eAAeK,UAC5Bd,IAAU;IAEV,MAAMO,YAAsB,EAAE;IAE9B,KAAK,MAAMQ,WAAWxC,YAAYyB,MAAMgB,MAAM,GAAI;QAChD,MAAMtB,aAAaD,oBAChBsB,QAAQE,QAAQ,EAA2CvB;QAG9D,KAAK,MAAME,aAAaF,WAAY;YAClC,IAAI,CAACE,UAAUsB,IAAI,EAAE;YAErB,sEAAsE;YACtE,MAAMC,eAAevB,UAAUsB,IAAI,CAACE,QAAQ,CAAC,eACzCxB,UAAUsB,IAAI,CAACG,KAAK,CAAC,GAAG,CAAC,YAAYC,MAAM,IAC3C1B,UAAUsB,IAAI;YAElB,MAAMb,aACJL,MACAxB,kBAAkBuC,QAAQQ,IAAI,EAAEJ,eAChCvB,WACAW;QAEJ;IACF;IAEA,MAAMvB,qBAAqBgB;IAE3B,OAAO;QAAEO;IAAU;AACrB"}

package/src/migrations/v1.0.0-rc.82/0001-terraform-load-runtime-config-src-path/metadata.json

@@ -0,0 +1,3 @@
+{
+  "description": "Point the react website's terraform load-runtime-config target at the runtime-config file the terraform aggregation actually writes"
+}

package/src/migrations/v1.0.0-rc.82/0001-terraform-load-runtime-config-src-path/migration.d.ts

@@ -0,0 +1,6 @@
+/**
+ * Copyright Amazon.com, Inc. or its affiliates. All Rights Reserved.
+ * SPDX-License-Identifier: Apache-2.0
+ */
+import { type MigrationReturnObject, type Tree } from '@nx/devkit';
+export default function migration(tree: Tree): Promise<MigrationReturnObject>;

package/src/migrations/v1.0.0-rc.82/0001-terraform-load-runtime-config-src-path/migration.js

@@ -0,0 +1,48 @@
+/**
+ * Copyright Amazon.com, Inc. or its affiliates. All Rights Reserved.
+ * SPDX-License-Identifier: Apache-2.0
+ */ import { getProjects, updateProjectConfiguration } from "@nx/devkit";
+import { formatFilesInSubtree } from "../../../utils/format.js";
+import { TERRAFORM_WEBSITE_RUNTIME_CONFIG_FILE } from "../../../utils/shared-constructs-constants.js";
+/**
+ * The Terraform `load-runtime-config` target copied
+ * `dist/packages/common/terraform/runtime-config.json`, which nothing writes:
+ * the vended runtime-config modules aggregate per namespace into the
+ * `runtime-config` *directory*, so the website's config lands at
+ * `runtime-config/connection.json`. Copying the directory path always failed
+ * with ENOENT, so point it at the file the aggregation actually writes.
+ *
+ * Both target names are rewritten — `load-runtime-config` and the
+ * `load:runtime-config` it was cloned from, which is left in place for
+ * workspaces that still reference it.
+ *
+ * How to write a migration:
+ * - https://nx.dev/docs/kb/migration-generators
+ * - What `nextSteps` means: https://nx.dev/docs/reference/devkit/MigrationReturnObject
+ */ const TARGETS = [
+    'load-runtime-config',
+    'load:runtime-config'
+];
+/** The path the target used to name, which never existed on disk. */ const BROKEN_SRC_FILE = 'dist/packages/common/terraform/runtime-config.json';
+export default async function migration(tree) {
+    for (const [projectName, project] of getProjects(tree)){
+        let updated = false;
+        for (const targetName of TARGETS){
+            const env = project.targets?.[targetName]?.options?.env;
+            // Only the broken path is rewritten, so a workspace that pointed the
+            // target somewhere of its own keeps it.
+            if (env?.SRC_FILE !== BROKEN_SRC_FILE) {
+                continue;
+            }
+            env.SRC_FILE = TERRAFORM_WEBSITE_RUNTIME_CONFIG_FILE;
+            updated = true;
+        }
+        if (updated) {
+            updateProjectConfiguration(tree, projectName, project);
+        }
+    }
+    await formatFilesInSubtree(tree);
+    return {};
+}
+
+//# sourceMappingURL=migration.js.map

package/src/migrations/v1.0.0-rc.82/0001-terraform-load-runtime-config-src-path/migration.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../../../../../../../packages/nx-plugin/src/migrations/v1.0.0-rc.82/0001-terraform-load-runtime-config-src-path/migration.ts"],"sourcesContent":["/**\n * Copyright Amazon.com, Inc. or its affiliates. All Rights Reserved.\n * SPDX-License-Identifier: Apache-2.0\n */\nimport {\n  getProjects,\n  type MigrationReturnObject,\n  type Tree,\n  updateProjectConfiguration,\n} from '@nx/devkit';\nimport { formatFilesInSubtree } from '../../../utils/format.js';\nimport { TERRAFORM_WEBSITE_RUNTIME_CONFIG_FILE } from '../../../utils/shared-constructs-constants.js';\n\n/**\n * The Terraform `load-runtime-config` target copied\n * `dist/packages/common/terraform/runtime-config.json`, which nothing writes:\n * the vended runtime-config modules aggregate per namespace into the\n * `runtime-config` *directory*, so the website's config lands at\n * `runtime-config/connection.json`. Copying the directory path always failed\n * with ENOENT, so point it at the file the aggregation actually writes.\n *\n * Both target names are rewritten — `load-runtime-config` and the\n * `load:runtime-config` it was cloned from, which is left in place for\n * workspaces that still reference it.\n *\n * How to write a migration:\n * - https://nx.dev/docs/kb/migration-generators\n * - What `nextSteps` means: https://nx.dev/docs/reference/devkit/MigrationReturnObject\n */\n\nconst TARGETS = ['load-runtime-config', 'load:runtime-config'];\n\n/** The path the target used to name, which never existed on disk. */\nconst BROKEN_SRC_FILE = 'dist/packages/common/terraform/runtime-config.json';\n\nexport default async function migration(\n  tree: Tree,\n): Promise<MigrationReturnObject> {\n  for (const [projectName, project] of getProjects(tree)) {\n    let updated = false;\n\n    for (const targetName of TARGETS) {\n      const env = project.targets?.[targetName]?.options?.env;\n      // Only the broken path is rewritten, so a workspace that pointed the\n      // target somewhere of its own keeps it.\n      if (env?.SRC_FILE !== BROKEN_SRC_FILE) {\n        continue;\n      }\n      env.SRC_FILE = TERRAFORM_WEBSITE_RUNTIME_CONFIG_FILE;\n      updated = true;\n    }\n\n    if (updated) {\n      updateProjectConfiguration(tree, projectName, project);\n    }\n  }\n\n  await formatFilesInSubtree(tree);\n\n  return {};\n}\n"],"names":["getProjects","updateProjectConfiguration","formatFilesInSubtree","TERRAFORM_WEBSITE_RUNTIME_CONFIG_FILE","TARGETS","BROKEN_SRC_FILE","migration","tree","projectName","project","updated","targetName","env","targets","options","SRC_FILE"],"mappings":"AAAA;;;CAGC,GACD,SACEA,WAAW,EAGXC,0BAA0B,QACrB,aAAa;AACpB,SAASC,oBAAoB,QAAQ,2BAA2B;AAChE,SAASC,qCAAqC,QAAQ,gDAAgD;AAEtG;;;;;;;;;;;;;;;CAeC,GAED,MAAMC,UAAU;IAAC;IAAuB;CAAsB;AAE9D,mEAAmE,GACnE,MAAMC,kBAAkB;AAExB,eAAe,eAAeC,UAC5BC,IAAU;IAEV,KAAK,MAAM,CAACC,aAAaC,QAAQ,IAAIT,YAAYO,MAAO;QACtD,IAAIG,UAAU;QAEd,KAAK,MAAMC,cAAcP,QAAS;YAChC,MAAMQ,MAAMH,QAAQI,OAAO,EAAE,CAACF,WAAW,EAAEG,SAASF;YACpD,qEAAqE;YACrE,wCAAwC;YACxC,IAAIA,KAAKG,aAAaV,iBAAiB;gBACrC;YACF;YACAO,IAAIG,QAAQ,GAAGZ;YACfO,UAAU;QACZ;QAEA,IAAIA,SAAS;YACXT,2BAA2BM,MAAMC,aAAaC;QAChD;IACF;IAEA,MAAMP,qBAAqBK;IAE3B,OAAO,CAAC;AACV"}

package/src/migrations/v1.0.0-rc.82/0002-runtime-config-namespace-defaults/metadata.json

@@ -0,0 +1,3 @@
+{
+  "description": "Provision AppConfig configuration profiles for every namespace the vended terraform modules write to"
+}

package/src/migrations/v1.0.0-rc.82/0002-runtime-config-namespace-defaults/migration.d.ts

@@ -0,0 +1,6 @@
+/**
+ * Copyright Amazon.com, Inc. or its affiliates. All Rights Reserved.
+ * SPDX-License-Identifier: Apache-2.0
+ */
+import { type MigrationReturnObject, type Tree } from '@nx/devkit';
+export default function migration(tree: Tree): Promise<MigrationReturnObject>;

package/src/migrations/v1.0.0-rc.82/0002-runtime-config-namespace-defaults/migration.js

@@ -0,0 +1,131 @@
+/**
+ * Copyright Amazon.com, Inc. or its affiliates. All Rights Reserved.
+ * SPDX-License-Identifier: Apache-2.0
+ */ import { visitNotIgnoredFiles } from "@nx/devkit";
+import { applyGritQL, matchGritQL } from "../../../utils/ast.js";
+import { formatFilesInSubtree } from "../../../utils/format.js";
+import { PACKAGES_DIR, SHARED_TERRAFORM_DIR } from "../../../utils/shared-constructs-constants.js";
+/**
+ * Provision AppConfig configuration profiles for every namespace the vended terraform modules write to
+ *
+ * `core/runtime-config/appconfig` creates one configuration profile per entry in
+ * its `namespaces` list, and `appconfig-deployment` aggregates and deploys the
+ * same list. A module contributing an entry to a namespace outside that list
+ * writes its entry file to disk and nothing more — the value never reaches
+ * AppConfig, so a consumer reading it back fails at runtime. The vended defaults
+ * now cover `dynamodb` and `database` alongside `connection` and `agentcore`.
+ *
+ * Root modules that pass `namespaces` explicitly are updated too, since an
+ * explicit list overrides the vended default.
+ *
+ * How to write a migration:
+ * - https://nx.dev/docs/kb/migration-generators
+ * - What `nextSteps` means: https://nx.dev/docs/reference/devkit/MigrationReturnObject
+ *
+ * Guardrails:
+ * - Transform source with GritQL (`applyGritQL`, `matchGritQL`), not regexes or
+ *   string replacements: it matches the AST, so it holds up against however the
+ *   user's copy has been formatted. Use `updateJson` for JSON.
+ * - Pattern-match before writing: skip files that have diverged from the shape
+ *   your generators produce and report them via `nextSteps`, or consider a
+ *   hybrid migration, rather than clobbering the user's changes.
+ * - `nextSteps` is for work left for the user to do by hand, not a log of the
+ *   edits you made: an edit that applied cleanly needs no entry.
+ * - Idempotent: re-running must be a no-op.
+ * - Format what you write: finish with `formatFilesInSubtree` so the files your
+ *   migration wrote are formatted correctly.
+ */ /** Namespaces the vended modules write to that the old defaults omitted. */ const ADDED_NAMESPACES = [
+    'database',
+    'dynamodb'
+];
+const RUNTIME_CONFIG_DIR = `${PACKAGES_DIR}/${SHARED_TERRAFORM_DIR}/src/core/runtime-config`;
+const APPCONFIG_FILE = `${RUNTIME_CONFIG_DIR}/appconfig/appconfig.tf`;
+const APPCONFIG_DEPLOYMENT_FILE = `${RUNTIME_CONFIG_DIR}/appconfig-deployment/appconfig-deployment.tf`;
+const hcl = (pattern)=>`language hcl\n${pattern}`;
+/** The `namespaces` variable declaration in a vended appconfig module. */ const VENDED_DEFAULT = {
+    block: 'variable "namespaces" { $body }',
+    attribute: 'default'
+};
+/**
+ * A call to the vended appconfig module that passes `namespaces` explicitly.
+ * `$src` binds the quoted string, so the regex ends at the closing quote — that
+ * anchor is what keeps the sibling `appconfig-deployment` call, which takes its
+ * namespaces from this module's output, out of scope.
+ */ const ROOT_MODULE_ARGUMENT = {
+    block: 'module $name { $body }',
+    attribute: 'namespaces',
+    clauses: '$body <: contains `source = $src`, $src <: r".*runtime-config/appconfig\\"", $body <: contains `namespaces = $_`'
+};
+/** A GritQL pattern matching the enclosing block, plus any extra clauses. */ const scopePattern = (list, extraClauses)=>{
+    const clauses = [
+        list.clauses,
+        extraClauses
+    ].filter(Boolean).join(', ');
+    return hcl(`\`${list.block}\`${clauses ? ` where { ${clauses} }` : ''}`);
+};
+/** Whether a namespace already appears in the list. */ const listsNamespace = (tree, filePath, list, namespace)=>matchGritQL(tree, filePath, scopePattern(list, `$body <: contains \`"${namespace}"\``));
+/**
+ * Append a namespace to the list. Appended within the list rather than
+ * re-emitting it, so no trailing hole is introduced.
+ */ const appendNamespace = (tree, filePath, list, namespace)=>applyGritQL(tree, filePath, scopePattern(list, `$body <: contains bubble \`${list.attribute} = [$items]\` where { $items <: [$..., $last], $last += \`, "${namespace}"\` }`));
+/**
+ * Add every missing namespace to a list, returning false when one could not be
+ * added. Already-listed namespaces are skipped, which is what makes a re-run a
+ * no-op.
+ */ const addMissingNamespaces = async (tree, filePath, list)=>{
+    for (const namespace of ADDED_NAMESPACES){
+        if (await listsNamespace(tree, filePath, list, namespace)) {
+            continue;
+        }
+        if (!await appendNamespace(tree, filePath, list, namespace)) {
+            return false;
+        }
+    }
+    return true;
+};
+/** The vended module's own description, updated to document the new defaults. */ const DESCRIPTION_REWRITE = scopePattern(VENDED_DEFAULT, '$body <: contains bubble `description = $desc` where { $desc <: r".*one Configuration Profile is created per namespace.*", $desc => `"List of runtime-config namespaces this AppConfig application should expose (one Configuration Profile is created per namespace). The default covers every namespace the generated modules write to, and a namespace with no contributions deploys an empty profile — when adding namespaces of your own, keep the defaults alongside them."` }');
+const missing = ADDED_NAMESPACES.map((n)=>`"${n}"`).join(' and ');
+const divergedNextStep = (filePath)=>`${filePath}: the \`namespaces\` variable has diverged from the generated shape - left untouched. Add ${missing} to its \`default\` list, otherwise no configuration profile is created for them and the entries the vended dynamodb/database modules contribute are never deployed.`;
+const rootModuleNextStep = (filePath)=>`${filePath}: passes \`namespaces\` to the runtime-config appconfig module in a shape this migration could not update - left untouched. Add ${missing} to that list, or drop the argument to take the module's defaults, otherwise the entries the vended dynamodb/database modules contribute are never deployed.`;
+/** Bring one vended appconfig module's `namespaces` default up to date. */ const migrateVendedModule = async (tree, filePath, nextSteps)=>{
+    if (!tree.exists(filePath)) {
+        return; // This workspace has no Terraform runtime config.
+    }
+    if (!await addMissingNamespaces(tree, filePath, VENDED_DEFAULT)) {
+        nextSteps.push(divergedNextStep(filePath));
+    }
+};
+/**
+ * Root modules that pass `namespaces` explicitly override the vended default, so
+ * they need the same additions.
+ */ const migrateRootModules = async (tree, nextSteps)=>{
+    const terraformFiles = [];
+    visitNotIgnoredFiles(tree, '', (filePath)=>{
+        if (filePath.endsWith('.tf') && !filePath.startsWith(RUNTIME_CONFIG_DIR)) {
+            terraformFiles.push(filePath);
+        }
+    });
+    for (const filePath of terraformFiles){
+        if (!await matchGritQL(tree, filePath, scopePattern(ROOT_MODULE_ARGUMENT))) {
+            continue; // Takes the module's defaults, so nothing to update.
+        }
+        if (!await addMissingNamespaces(tree, filePath, ROOT_MODULE_ARGUMENT)) {
+            nextSteps.push(rootModuleNextStep(filePath));
+        }
+    }
+};
+export default async function migration(tree) {
+    const nextSteps = [];
+    await migrateVendedModule(tree, APPCONFIG_FILE, nextSteps);
+    await migrateVendedModule(tree, APPCONFIG_DEPLOYMENT_FILE, nextSteps);
+    if (tree.exists(APPCONFIG_FILE)) {
+        await applyGritQL(tree, APPCONFIG_FILE, DESCRIPTION_REWRITE);
+    }
+    await migrateRootModules(tree, nextSteps);
+    await formatFilesInSubtree(tree);
+    return {
+        nextSteps
+    };
+}
+
+//# sourceMappingURL=migration.js.map

package/src/migrations/v1.0.0-rc.82/0002-runtime-config-namespace-defaults/migration.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../../../../../../../packages/nx-plugin/src/migrations/v1.0.0-rc.82/0002-runtime-config-namespace-defaults/migration.ts"],"sourcesContent":["/**\n * Copyright Amazon.com, Inc. or its affiliates. All Rights Reserved.\n * SPDX-License-Identifier: Apache-2.0\n */\nimport {\n  type MigrationReturnObject,\n  type Tree,\n  visitNotIgnoredFiles,\n} from '@nx/devkit';\nimport { applyGritQL, matchGritQL } from '../../../utils/ast.js';\nimport { formatFilesInSubtree } from '../../../utils/format.js';\nimport {\n  PACKAGES_DIR,\n  SHARED_TERRAFORM_DIR,\n} from '../../../utils/shared-constructs-constants.js';\n\n/**\n * Provision AppConfig configuration profiles for every namespace the vended terraform modules write to\n *\n * `core/runtime-config/appconfig` creates one configuration profile per entry in\n * its `namespaces` list, and `appconfig-deployment` aggregates and deploys the\n * same list. A module contributing an entry to a namespace outside that list\n * writes its entry file to disk and nothing more — the value never reaches\n * AppConfig, so a consumer reading it back fails at runtime. The vended defaults\n * now cover `dynamodb` and `database` alongside `connection` and `agentcore`.\n *\n * Root modules that pass `namespaces` explicitly are updated too, since an\n * explicit list overrides the vended default.\n *\n * How to write a migration:\n * - https://nx.dev/docs/kb/migration-generators\n * - What `nextSteps` means: https://nx.dev/docs/reference/devkit/MigrationReturnObject\n *\n * Guardrails:\n * - Transform source with GritQL (`applyGritQL`, `matchGritQL`), not regexes or\n *   string replacements: it matches the AST, so it holds up against however the\n *   user's copy has been formatted. Use `updateJson` for JSON.\n * - Pattern-match before writing: skip files that have diverged from the shape\n *   your generators produce and report them via `nextSteps`, or consider a\n *   hybrid migration, rather than clobbering the user's changes.\n * - `nextSteps` is for work left for the user to do by hand, not a log of the\n *   edits you made: an edit that applied cleanly needs no entry.\n * - Idempotent: re-running must be a no-op.\n * - Format what you write: finish with `formatFilesInSubtree` so the files your\n *   migration wrote are formatted correctly.\n */\n\n/** Namespaces the vended modules write to that the old defaults omitted. */\nconst ADDED_NAMESPACES = ['database', 'dynamodb'];\n\nconst RUNTIME_CONFIG_DIR = `${PACKAGES_DIR}/${SHARED_TERRAFORM_DIR}/src/core/runtime-config`;\nconst APPCONFIG_FILE = `${RUNTIME_CONFIG_DIR}/appconfig/appconfig.tf`;\nconst APPCONFIG_DEPLOYMENT_FILE = `${RUNTIME_CONFIG_DIR}/appconfig-deployment/appconfig-deployment.tf`;\n\nconst hcl = (pattern: string) => `language hcl\\n${pattern}`;\n\n/**\n * Where a `namespaces` list lives, as the block that encloses it and the\n * attribute holding the list. `clauses` narrows the block further, keeping an\n * unrelated list elsewhere in the file out of scope; `$body` is the block's body\n * in every case, so the clauses below can all be written against it.\n */\ninterface NamespaceList {\n  readonly block: string;\n  readonly attribute: string;\n  readonly clauses?: string;\n}\n\n/** The `namespaces` variable declaration in a vended appconfig module. */\nconst VENDED_DEFAULT: NamespaceList = {\n  block: 'variable \"namespaces\" { $body }',\n  attribute: 'default',\n};\n\n/**\n * A call to the vended appconfig module that passes `namespaces` explicitly.\n * `$src` binds the quoted string, so the regex ends at the closing quote — that\n * anchor is what keeps the sibling `appconfig-deployment` call, which takes its\n * namespaces from this module's output, out of scope.\n */\nconst ROOT_MODULE_ARGUMENT: NamespaceList = {\n  block: 'module $name { $body }',\n  attribute: 'namespaces',\n  clauses:\n    '$body <: contains `source = $src`, $src <: r\".*runtime-config/appconfig\\\\\"\", $body <: contains `namespaces = $_`',\n};\n\n/** A GritQL pattern matching the enclosing block, plus any extra clauses. */\nconst scopePattern = (list: NamespaceList, extraClauses?: string) => {\n  const clauses = [list.clauses, extraClauses].filter(Boolean).join(', ');\n  return hcl(`\\`${list.block}\\`${clauses ? ` where { ${clauses} }` : ''}`);\n};\n\n/** Whether a namespace already appears in the list. */\nconst listsNamespace = (\n  tree: Tree,\n  filePath: string,\n  list: NamespaceList,\n  namespace: string,\n) =>\n  matchGritQL(\n    tree,\n    filePath,\n    scopePattern(list, `$body <: contains \\`\"${namespace}\"\\``),\n  );\n\n/**\n * Append a namespace to the list. Appended within the list rather than\n * re-emitting it, so no trailing hole is introduced.\n */\nconst appendNamespace = (\n  tree: Tree,\n  filePath: string,\n  list: NamespaceList,\n  namespace: string,\n) =>\n  applyGritQL(\n    tree,\n    filePath,\n    scopePattern(\n      list,\n      `$body <: contains bubble \\`${list.attribute} = [$items]\\` where { $items <: [$..., $last], $last += \\`, \"${namespace}\"\\` }`,\n    ),\n  );\n\n/**\n * Add every missing namespace to a list, returning false when one could not be\n * added. Already-listed namespaces are skipped, which is what makes a re-run a\n * no-op.\n */\nconst addMissingNamespaces = async (\n  tree: Tree,\n  filePath: string,\n  list: NamespaceList,\n): Promise<boolean> => {\n  for (const namespace of ADDED_NAMESPACES) {\n    if (await listsNamespace(tree, filePath, list, namespace)) {\n      continue;\n    }\n    if (!(await appendNamespace(tree, filePath, list, namespace))) {\n      return false;\n    }\n  }\n  return true;\n};\n\n/** The vended module's own description, updated to document the new defaults. */\nconst DESCRIPTION_REWRITE = scopePattern(\n  VENDED_DEFAULT,\n  '$body <: contains bubble `description = $desc` where { $desc <: r\".*one Configuration Profile is created per namespace.*\", $desc => `\"List of runtime-config namespaces this AppConfig application should expose (one Configuration Profile is created per namespace). The default covers every namespace the generated modules write to, and a namespace with no contributions deploys an empty profile — when adding namespaces of your own, keep the defaults alongside them.\"` }',\n);\n\nconst missing = ADDED_NAMESPACES.map((n) => `\"${n}\"`).join(' and ');\n\nconst divergedNextStep = (filePath: string) =>\n  `${filePath}: the \\`namespaces\\` variable has diverged from the generated shape - left untouched. Add ${missing} to its \\`default\\` list, otherwise no configuration profile is created for them and the entries the vended dynamodb/database modules contribute are never deployed.`;\n\nconst rootModuleNextStep = (filePath: string) =>\n  `${filePath}: passes \\`namespaces\\` to the runtime-config appconfig module in a shape this migration could not update - left untouched. Add ${missing} to that list, or drop the argument to take the module's defaults, otherwise the entries the vended dynamodb/database modules contribute are never deployed.`;\n\n/** Bring one vended appconfig module's `namespaces` default up to date. */\nconst migrateVendedModule = async (\n  tree: Tree,\n  filePath: string,\n  nextSteps: string[],\n): Promise<void> => {\n  if (!tree.exists(filePath)) {\n    return; // This workspace has no Terraform runtime config.\n  }\n\n  if (!(await addMissingNamespaces(tree, filePath, VENDED_DEFAULT))) {\n    nextSteps.push(divergedNextStep(filePath));\n  }\n};\n\n/**\n * Root modules that pass `namespaces` explicitly override the vended default, so\n * they need the same additions.\n */\nconst migrateRootModules = async (\n  tree: Tree,\n  nextSteps: string[],\n): Promise<void> => {\n  const terraformFiles: string[] = [];\n  visitNotIgnoredFiles(tree, '', (filePath) => {\n    if (filePath.endsWith('.tf') && !filePath.startsWith(RUNTIME_CONFIG_DIR)) {\n      terraformFiles.push(filePath);\n    }\n  });\n\n  for (const filePath of terraformFiles) {\n    if (\n      !(await matchGritQL(tree, filePath, scopePattern(ROOT_MODULE_ARGUMENT)))\n    ) {\n      continue; // Takes the module's defaults, so nothing to update.\n    }\n\n    if (!(await addMissingNamespaces(tree, filePath, ROOT_MODULE_ARGUMENT))) {\n      nextSteps.push(rootModuleNextStep(filePath));\n    }\n  }\n};\n\nexport default async function migration(\n  tree: Tree,\n): Promise<MigrationReturnObject> {\n  const nextSteps: string[] = [];\n\n  await migrateVendedModule(tree, APPCONFIG_FILE, nextSteps);\n  await migrateVendedModule(tree, APPCONFIG_DEPLOYMENT_FILE, nextSteps);\n\n  if (tree.exists(APPCONFIG_FILE)) {\n    await applyGritQL(tree, APPCONFIG_FILE, DESCRIPTION_REWRITE);\n  }\n\n  await migrateRootModules(tree, nextSteps);\n\n  await formatFilesInSubtree(tree);\n\n  return { nextSteps };\n}\n"],"names":["visitNotIgnoredFiles","applyGritQL","matchGritQL","formatFilesInSubtree","PACKAGES_DIR","SHARED_TERRAFORM_DIR","ADDED_NAMESPACES","RUNTIME_CONFIG_DIR","APPCONFIG_FILE","APPCONFIG_DEPLOYMENT_FILE","hcl","pattern","VENDED_DEFAULT","block","attribute","ROOT_MODULE_ARGUMENT","clauses","scopePattern","list","extraClauses","filter","Boolean","join","listsNamespace","tree","filePath","namespace","appendNamespace","addMissingNamespaces","DESCRIPTION_REWRITE","missing","map","n","divergedNextStep","rootModuleNextStep","migrateVendedModule","nextSteps","exists","push","migrateRootModules","terraformFiles","endsWith","startsWith","migration"],"mappings":"AAAA;;;CAGC,GACD,SAGEA,oBAAoB,QACf,aAAa;AACpB,SAASC,WAAW,EAAEC,WAAW,QAAQ,wBAAwB;AACjE,SAASC,oBAAoB,QAAQ,2BAA2B;AAChE,SACEC,YAAY,EACZC,oBAAoB,QACf,gDAAgD;AAEvD;;;;;;;;;;;;;;;;;;;;;;;;;;;;;CA6BC,GAED,0EAA0E,GAC1E,MAAMC,mBAAmB;IAAC;IAAY;CAAW;AAEjD,MAAMC,qBAAqB,GAAGH,aAAa,CAAC,EAAEC,qBAAqB,wBAAwB,CAAC;AAC5F,MAAMG,iBAAiB,GAAGD,mBAAmB,uBAAuB,CAAC;AACrE,MAAME,4BAA4B,GAAGF,mBAAmB,6CAA6C,CAAC;AAEtG,MAAMG,MAAM,CAACC,UAAoB,CAAC,cAAc,EAAEA,SAAS;AAc3D,wEAAwE,GACxE,MAAMC,iBAAgC;IACpCC,OAAO;IACPC,WAAW;AACb;AAEA;;;;;CAKC,GACD,MAAMC,uBAAsC;IAC1CF,OAAO;IACPC,WAAW;IACXE,SACE;AACJ;AAEA,2EAA2E,GAC3E,MAAMC,eAAe,CAACC,MAAqBC;IACzC,MAAMH,UAAU;QAACE,KAAKF,OAAO;QAAEG;KAAa,CAACC,MAAM,CAACC,SAASC,IAAI,CAAC;IAClE,OAAOZ,IAAI,CAAC,EAAE,EAAEQ,KAAKL,KAAK,CAAC,EAAE,EAAEG,UAAU,CAAC,SAAS,EAAEA,QAAQ,EAAE,CAAC,GAAG,IAAI;AACzE;AAEA,qDAAqD,GACrD,MAAMO,iBAAiB,CACrBC,MACAC,UACAP,MACAQ,YAEAxB,YACEsB,MACAC,UACAR,aAAaC,MAAM,CAAC,qBAAqB,EAAEQ,UAAU,GAAG,CAAC;AAG7D;;;CAGC,GACD,MAAMC,kBAAkB,CACtBH,MACAC,UACAP,MACAQ,YAEAzB,YACEuB,MACAC,UACAR,aACEC,MACA,CAAC,2BAA2B,EAAEA,KAAKJ,SAAS,CAAC,6DAA6D,EAAEY,UAAU,KAAK,CAAC;AAIlI;;;;CAIC,GACD,MAAME,uBAAuB,OAC3BJ,MACAC,UACAP;IAEA,KAAK,MAAMQ,aAAapB,iBAAkB;QACxC,IAAI,MAAMiB,eAAeC,MAAMC,UAAUP,MAAMQ,YAAY;YACzD;QACF;QACA,IAAI,CAAE,MAAMC,gBAAgBH,MAAMC,UAAUP,MAAMQ,YAAa;YAC7D,OAAO;QACT;IACF;IACA,OAAO;AACT;AAEA,+EAA+E,GAC/E,MAAMG,sBAAsBZ,aAC1BL,gBACA;AAGF,MAAMkB,UAAUxB,iBAAiByB,GAAG,CAAC,CAACC,IAAM,CAAC,CAAC,EAAEA,EAAE,CAAC,CAAC,EAAEV,IAAI,CAAC;AAE3D,MAAMW,mBAAmB,CAACR,WACxB,GAAGA,SAAS,0FAA0F,EAAEK,QAAQ,oKAAoK,CAAC;AAEvR,MAAMI,qBAAqB,CAACT,WAC1B,GAAGA,SAAS,gIAAgI,EAAEK,QAAQ,4JAA4J,CAAC;AAErT,yEAAyE,GACzE,MAAMK,sBAAsB,OAC1BX,MACAC,UACAW;IAEA,IAAI,CAACZ,KAAKa,MAAM,CAACZ,WAAW;QAC1B,QAAQ,kDAAkD;IAC5D;IAEA,IAAI,CAAE,MAAMG,qBAAqBJ,MAAMC,UAAUb,iBAAkB;QACjEwB,UAAUE,IAAI,CAACL,iBAAiBR;IAClC;AACF;AAEA;;;CAGC,GACD,MAAMc,qBAAqB,OACzBf,MACAY;IAEA,MAAMI,iBAA2B,EAAE;IACnCxC,qBAAqBwB,MAAM,IAAI,CAACC;QAC9B,IAAIA,SAASgB,QAAQ,CAAC,UAAU,CAAChB,SAASiB,UAAU,CAACnC,qBAAqB;YACxEiC,eAAeF,IAAI,CAACb;QACtB;IACF;IAEA,KAAK,MAAMA,YAAYe,eAAgB;QACrC,IACE,CAAE,MAAMtC,YAAYsB,MAAMC,UAAUR,aAAaF,wBACjD;YACA,UAAU,qDAAqD;QACjE;QAEA,IAAI,CAAE,MAAMa,qBAAqBJ,MAAMC,UAAUV,uBAAwB;YACvEqB,UAAUE,IAAI,CAACJ,mBAAmBT;QACpC;IACF;AACF;AAEA,eAAe,eAAekB,UAC5BnB,IAAU;IAEV,MAAMY,YAAsB,EAAE;IAE9B,MAAMD,oBAAoBX,MAAMhB,gBAAgB4B;IAChD,MAAMD,oBAAoBX,MAAMf,2BAA2B2B;IAE3D,IAAIZ,KAAKa,MAAM,CAAC7B,iBAAiB;QAC/B,MAAMP,YAAYuB,MAAMhB,gBAAgBqB;IAC1C;IAEA,MAAMU,mBAAmBf,MAAMY;IAE/B,MAAMjC,qBAAqBqB;IAE3B,OAAO;QAAEY;IAAU;AACrB"}

package/src/migrations/v1.0.0-rc.83/0001-dynamodb-terraform-app-module-outputs/metadata.json

@@ -0,0 +1,3 @@
+{
+  "description": "Re-export the DynamoDB table and KMS key attributes from the vended Terraform per-table app module"
+}

package/src/migrations/v1.0.0-rc.83/0001-dynamodb-terraform-app-module-outputs/migration.d.ts

@@ -0,0 +1,6 @@
+/**
+ * Copyright Amazon.com, Inc. or its affiliates. All Rights Reserved.
+ * SPDX-License-Identifier: Apache-2.0
+ */
+import { type MigrationReturnObject, type Tree } from '@nx/devkit';
+export default function migration(tree: Tree): Promise<MigrationReturnObject>;

package/src/migrations/v1.0.0-rc.83/0001-dynamodb-terraform-app-module-outputs/migration.js

@@ -0,0 +1,69 @@
+/**
+ * Copyright Amazon.com, Inc. or its affiliates. All Rights Reserved.
+ * SPDX-License-Identifier: Apache-2.0
+ */ import { joinPathFragments } from "@nx/devkit";
+import { GRIT_INSERT_PLACEHOLDER, insertViaGritQL, matchGritQL } from "../../../utils/ast.js";
+import { formatFilesInSubtree } from "../../../utils/format.js";
+import { PACKAGES_DIR, SHARED_TERRAFORM_DIR } from "../../../utils/shared-constructs-constants.js";
+/**
+ * Re-export the core dynamodb module's `table_name`, `table_arn` and
+ * `kms_key_arn` from each vended per-table Terraform app module
+ * (`app/dynamodb/<name>/<name>.tf`).
+ *
+ * The app module is what a root configuration instantiates, so without these
+ * outputs a root module cannot reference the table or its encryption key at
+ * all — for example to grant a consumer access to it.
+ *
+ * These files are generated with `KeepExisting`, so an upgraded workspace keeps
+ * a module with no outputs until this runs. Diverged files are left untouched
+ * and reported via `nextSteps`.
+ */ const TERRAFORM_DYNAMODB_APP_DIR = `${PACKAGES_DIR}/${SHARED_TERRAFORM_DIR}/src/app/dynamodb`;
+const divergedMessage = (filePath)=>`${filePath}: has diverged from the generated shape - left untouched. To reference the table from your root Terraform configuration, add table_name, table_arn and kms_key_arn outputs here forwarding the equivalent module.dynamodb_table attributes (see the ts#dynamodb generator's dynamodb app template).`;
+const hcl = (pattern)=>`language hcl\n${pattern}`;
+const OUTPUTS_TEXT = [
+    'output "table_name" {',
+    '  description = "Name of the DynamoDB table"',
+    '  value       = module.dynamodb_table.table_name',
+    '}',
+    '',
+    'output "table_arn" {',
+    '  description = "ARN of the DynamoDB table, for use in IAM policies granting access to the table. Suffix with /index/* to cover its global secondary indexes."',
+    '  value       = module.dynamodb_table.table_arn',
+    '}',
+    '',
+    'output "kms_key_arn" {',
+    '  description = "ARN of the KMS key used to encrypt the DynamoDB table, for use in IAM policies granting access to the table. Null when using the AWS owned key (encryption = DEFAULT)."',
+    '  value       = module.dynamodb_table.kms_key_arn',
+    '}'
+].join('\n');
+export default async function migration(tree) {
+    const nextSteps = [];
+    if (!tree.exists(TERRAFORM_DYNAMODB_APP_DIR)) {
+        return {
+            nextSteps
+        }; // This workspace has no Terraform dynamodb modules.
+    }
+    for (const dirName of tree.children(TERRAFORM_DYNAMODB_APP_DIR)){
+        const filePath = joinPathFragments(TERRAFORM_DYNAMODB_APP_DIR, dirName, `${dirName}.tf`);
+        if (!tree.exists(filePath)) {
+            continue; // Not a dynamodb app module directory.
+        }
+        if (await matchGritQL(tree, filePath, hcl('`output "table_arn" { $_ }`'))) {
+            continue; // Already migrated.
+        }
+        const RUNTIME_CONFIG_MODULE_BLOCK = hcl('`module "add_to_runtime_config" { $_ }`');
+        if (!await matchGritQL(tree, filePath, RUNTIME_CONFIG_MODULE_BLOCK)) {
+            nextSteps.push(divergedMessage(filePath));
+            continue;
+        }
+        // Appended after the runtime config module call, which the template ends
+        // with, matching where the generator now writes the outputs.
+        await insertViaGritQL(tree, filePath, hcl(`\`module "add_to_runtime_config" { $body }\` => \`module "add_to_runtime_config" {\n  $body\n}\n\n${GRIT_INSERT_PLACEHOLDER}\``), OUTPUTS_TEXT);
+    }
+    await formatFilesInSubtree(tree);
+    return {
+        nextSteps
+    };
+}
+
+//# sourceMappingURL=migration.js.map

package/src/migrations/v1.0.0-rc.83/0001-dynamodb-terraform-app-module-outputs/migration.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../../../../../../../packages/nx-plugin/src/migrations/v1.0.0-rc.83/0001-dynamodb-terraform-app-module-outputs/migration.ts"],"sourcesContent":["/**\n * Copyright Amazon.com, Inc. or its affiliates. All Rights Reserved.\n * SPDX-License-Identifier: Apache-2.0\n */\nimport {\n  joinPathFragments,\n  type MigrationReturnObject,\n  type Tree,\n} from '@nx/devkit';\nimport {\n  GRIT_INSERT_PLACEHOLDER,\n  insertViaGritQL,\n  matchGritQL,\n} from '../../../utils/ast.js';\nimport { formatFilesInSubtree } from '../../../utils/format.js';\nimport {\n  PACKAGES_DIR,\n  SHARED_TERRAFORM_DIR,\n} from '../../../utils/shared-constructs-constants.js';\n\n/**\n * Re-export the core dynamodb module's `table_name`, `table_arn` and\n * `kms_key_arn` from each vended per-table Terraform app module\n * (`app/dynamodb/<name>/<name>.tf`).\n *\n * The app module is what a root configuration instantiates, so without these\n * outputs a root module cannot reference the table or its encryption key at\n * all — for example to grant a consumer access to it.\n *\n * These files are generated with `KeepExisting`, so an upgraded workspace keeps\n * a module with no outputs until this runs. Diverged files are left untouched\n * and reported via `nextSteps`.\n */\n\nconst TERRAFORM_DYNAMODB_APP_DIR = `${PACKAGES_DIR}/${SHARED_TERRAFORM_DIR}/src/app/dynamodb`;\n\nconst divergedMessage = (filePath: string) =>\n  `${filePath}: has diverged from the generated shape - left untouched. To reference the table from your root Terraform configuration, add table_name, table_arn and kms_key_arn outputs here forwarding the equivalent module.dynamodb_table attributes (see the ts#dynamodb generator's dynamodb app template).`;\n\nconst hcl = (pattern: string) => `language hcl\\n${pattern}`;\n\nconst OUTPUTS_TEXT = [\n  'output \"table_name\" {',\n  '  description = \"Name of the DynamoDB table\"',\n  '  value       = module.dynamodb_table.table_name',\n  '}',\n  '',\n  'output \"table_arn\" {',\n  '  description = \"ARN of the DynamoDB table, for use in IAM policies granting access to the table. Suffix with /index/* to cover its global secondary indexes.\"',\n  '  value       = module.dynamodb_table.table_arn',\n  '}',\n  '',\n  'output \"kms_key_arn\" {',\n  '  description = \"ARN of the KMS key used to encrypt the DynamoDB table, for use in IAM policies granting access to the table. Null when using the AWS owned key (encryption = DEFAULT).\"',\n  '  value       = module.dynamodb_table.kms_key_arn',\n  '}',\n].join('\\n');\n\nexport default async function migration(\n  tree: Tree,\n): Promise<MigrationReturnObject> {\n  const nextSteps: string[] = [];\n\n  if (!tree.exists(TERRAFORM_DYNAMODB_APP_DIR)) {\n    return { nextSteps }; // This workspace has no Terraform dynamodb modules.\n  }\n\n  for (const dirName of tree.children(TERRAFORM_DYNAMODB_APP_DIR)) {\n    const filePath = joinPathFragments(\n      TERRAFORM_DYNAMODB_APP_DIR,\n      dirName,\n      `${dirName}.tf`,\n    );\n    if (!tree.exists(filePath)) {\n      continue; // Not a dynamodb app module directory.\n    }\n\n    if (await matchGritQL(tree, filePath, hcl('`output \"table_arn\" { $_ }`'))) {\n      continue; // Already migrated.\n    }\n\n    const RUNTIME_CONFIG_MODULE_BLOCK = hcl(\n      '`module \"add_to_runtime_config\" { $_ }`',\n    );\n    if (!(await matchGritQL(tree, filePath, RUNTIME_CONFIG_MODULE_BLOCK))) {\n      nextSteps.push(divergedMessage(filePath));\n      continue;\n    }\n\n    // Appended after the runtime config module call, which the template ends\n    // with, matching where the generator now writes the outputs.\n    await insertViaGritQL(\n      tree,\n      filePath,\n      hcl(\n        `\\`module \"add_to_runtime_config\" { $body }\\` => \\`module \"add_to_runtime_config\" {\\n  $body\\n}\\n\\n${GRIT_INSERT_PLACEHOLDER}\\``,\n      ),\n      OUTPUTS_TEXT,\n    );\n  }\n\n  await formatFilesInSubtree(tree);\n\n  return { nextSteps };\n}\n"],"names":["joinPathFragments","GRIT_INSERT_PLACEHOLDER","insertViaGritQL","matchGritQL","formatFilesInSubtree","PACKAGES_DIR","SHARED_TERRAFORM_DIR","TERRAFORM_DYNAMODB_APP_DIR","divergedMessage","filePath","hcl","pattern","OUTPUTS_TEXT","join","migration","tree","nextSteps","exists","dirName","children","RUNTIME_CONFIG_MODULE_BLOCK","push"],"mappings":"AAAA;;;CAGC,GACD,SACEA,iBAAiB,QAGZ,aAAa;AACpB,SACEC,uBAAuB,EACvBC,eAAe,EACfC,WAAW,QACN,wBAAwB;AAC/B,SAASC,oBAAoB,QAAQ,2BAA2B;AAChE,SACEC,YAAY,EACZC,oBAAoB,QACf,gDAAgD;AAEvD;;;;;;;;;;;;CAYC,GAED,MAAMC,6BAA6B,GAAGF,aAAa,CAAC,EAAEC,qBAAqB,iBAAiB,CAAC;AAE7F,MAAME,kBAAkB,CAACC,WACvB,GAAGA,SAAS,mSAAmS,CAAC;AAElT,MAAMC,MAAM,CAACC,UAAoB,CAAC,cAAc,EAAEA,SAAS;AAE3D,MAAMC,eAAe;IACnB;IACA;IACA;IACA;IACA;IACA;IACA;IACA;IACA;IACA;IACA;IACA;IACA;IACA;CACD,CAACC,IAAI,CAAC;AAEP,eAAe,eAAeC,UAC5BC,IAAU;IAEV,MAAMC,YAAsB,EAAE;IAE9B,IAAI,CAACD,KAAKE,MAAM,CAACV,6BAA6B;QAC5C,OAAO;YAAES;QAAU,GAAG,oDAAoD;IAC5E;IAEA,KAAK,MAAME,WAAWH,KAAKI,QAAQ,CAACZ,4BAA6B;QAC/D,MAAME,WAAWT,kBACfO,4BACAW,SACA,GAAGA,QAAQ,GAAG,CAAC;QAEjB,IAAI,CAACH,KAAKE,MAAM,CAACR,WAAW;YAC1B,UAAU,uCAAuC;QACnD;QAEA,IAAI,MAAMN,YAAYY,MAAMN,UAAUC,IAAI,iCAAiC;YACzE,UAAU,oBAAoB;QAChC;QAEA,MAAMU,8BAA8BV,IAClC;QAEF,IAAI,CAAE,MAAMP,YAAYY,MAAMN,UAAUW,8BAA+B;YACrEJ,UAAUK,IAAI,CAACb,gBAAgBC;YAC/B;QACF;QAEA,yEAAyE;QACzE,6DAA6D;QAC7D,MAAMP,gBACJa,MACAN,UACAC,IACE,CAAC,kGAAkG,EAAET,wBAAwB,EAAE,CAAC,GAElIW;IAEJ;IAEA,MAAMR,qBAAqBW;IAE3B,OAAO;QAAEC;IAAU;AACrB"}

package/src/migrations/v1.0.0-rc.83/0002-terraform-data-resource-destroy-protection/__snapshots__/migration.spec.ts.snap

@@ -0,0 +1,75 @@
+// Vitest Snapshot v1, https://vitest.dev/guide/snapshot.html
+
+exports[`terraform-data-resource-destroy-protection migration > should protect the aurora cluster and pin its key window 1`] = `
+"resource "aws_kms_key" "database" {
+  description         = "KMS key for Aurora cluster \${var.name}"
+  enable_key_rotation = var.enable_key_rotation
+
+  deletion_window_in_days = 30
+
+  tags = merge(var.tags, {
+    Name = "\${var.name}-aurora"
+  })
+}
+
+resource "aws_rds_cluster" "database" {
+  cluster_identifier  = local.cluster_name
+  engine              = var.engine
+  storage_encrypted   = true
+  kms_key_id          = aws_kms_key.database.arn
+  deletion_protection = var.deletion_protection
+  skip_final_snapshot = var.skip_final_snapshot
+
+  serverlessv2_scaling_configuration {
+    min_capacity = var.serverless_min_capacity
+    max_capacity = var.serverless_max_capacity
+  }
+
+  tags = merge(var.tags, {
+    Name = "\${var.name}-aurora"
+  })
+
+  lifecycle {
+    prevent_destroy = true
+  }
+}
+"
+`;
+
+exports[`terraform-data-resource-destroy-protection migration > should protect the dynamodb table and pin its key window 1`] = `
+"resource "aws_kms_key" "table" {
+  count = local.create_table_key ? 1 : 0
+
+  description         = "KMS key for DynamoDB table \${var.name}"
+  enable_key_rotation = var.enable_key_rotation
+
+  deletion_window_in_days = 30
+}
+
+resource "aws_dynamodb_table" "table" {
+  name                        = var.name
+  billing_mode                = var.billing_mode
+  hash_key                    = "pk"
+  range_key                   = "sk"
+  deletion_protection_enabled = var.deletion_protection_enabled
+
+  attribute {
+    name = "pk"
+    type = "S"
+  }
+
+  point_in_time_recovery {
+    enabled = var.point_in_time_recovery_enabled
+  }
+
+  server_side_encryption {
+    enabled     = var.encryption != "DEFAULT"
+    kms_key_arn = local.table_kms_key_arn
+  }
+
+  lifecycle {
+    prevent_destroy = true
+  }
+}
+"
+`;

package/src/migrations/v1.0.0-rc.83/0002-terraform-data-resource-destroy-protection/metadata.json

@@ -0,0 +1,3 @@
+{
+  "description": "Add prevent_destroy and a 30 day KMS deletion window to the vended Terraform DynamoDB table and Aurora cluster modules"
+}

package/src/migrations/v1.0.0-rc.83/0002-terraform-data-resource-destroy-protection/migration.d.ts

@@ -0,0 +1,6 @@
+/**
+ * Copyright Amazon.com, Inc. or its affiliates. All Rights Reserved.
+ * SPDX-License-Identifier: Apache-2.0
+ */
+import type { MigrationReturnObject, Tree } from '@nx/devkit';
+export default function migration(tree: Tree): Promise<MigrationReturnObject>;