@aws/nx-plugin 1.0.0-rc.9 → 1.0.0-rc.91

package/src/migrations/latest/declare-cacheable-target-inputs/migration.d.ts

@@ -0,0 +1,6 @@
+/**
+ * Copyright Amazon.com, Inc. or its affiliates. All Rights Reserved.
+ * SPDX-License-Identifier: Apache-2.0
+ */
+import { type MigrationReturnObject, type Tree } from '@nx/devkit';
+export default function migration(tree: Tree): Promise<MigrationReturnObject>;

package/src/migrations/latest/declare-cacheable-target-inputs/migration.js

@@ -0,0 +1,94 @@
+/**
+ * Copyright Amazon.com, Inc. or its affiliates. All Rights Reserved.
+ * SPDX-License-Identifier: Apache-2.0
+ */ import { getProjects, updateProjectConfiguration } from "@nx/devkit";
+import { formatFilesInSubtree } from "../../../utils/format.js";
+/**
+ * A cacheable target declaring no `inputs` gets Nx's implicit
+ * `["default", "^default"]`, which reads a dependency's whole project directory
+ * — its README, its dev scripts, everything. That is wider than the explicit
+ * inputs its siblings carry, so editing a dependency's README re-ran targets
+ * whose output could not possibly change.
+ *
+ * Which explicit inputs are right depends on whether the target has a
+ * `dependsOn`. `default` carries a transitive `dependentTasksOutputFiles` entry,
+ * which Nx resolves against the task's upstream tasks — so a target with an
+ * upstream task still hashes the dependency output it consumes through it, and
+ * `["default"]` is enough. A target with no `dependsOn` has nothing for that
+ * entry to resolve against, so `default` collapses to the project's own files
+ * and dropping `^default` would remove the last edge to the dependency. Those
+ * keep a dependency input: `["default", "^production"]`.
+ */ /** Targets whose `dependsOn` keeps the dependency edge inside `default`. */ const DEFAULT_ONLY_NAMES = [
+    'bundle',
+    'bundle-migration',
+    'bundle-create-db-user',
+    'operations'
+];
+/**
+ * Suffix of the OpenAPI spec targets, which carry a per-agent prefix
+ * (`my-agent-openapi`) on a project hosting more than one.
+ *
+ * These have no `dependsOn`, and their spec serialises models a dependency may
+ * own, so they keep a dependency input — without it a dependency's model change
+ * serves a stale spec, and that spec feeds client generation.
+ */ const OPENAPI_SUFFIX = 'openapi';
+const CHECKOV_TARGET = 'checkov';
+/**
+ * Inputs for a target with no upstream task to resolve `default`'s transitive
+ * `dependentTasksOutputFiles` against. `^production` rather than `^default` so a
+ * dependency's test edits still do not invalidate it.
+ */ const WITH_DEPENDENCY_INPUTS = [
+    'default',
+    '^production'
+];
+/** Whether a target is one of the ones narrowed to `["default"]`. */ const isDefaultOnlyTarget = (name)=>DEFAULT_ONLY_NAMES.includes(name);
+/** Whether a target is an OpenAPI spec target, which has no `dependsOn`. */ const isOpenApiTarget = (name)=>name === OPENAPI_SUFFIX || name.endsWith(`-${OPENAPI_SUFFIX}`);
+/**
+ * Whether a target still looks like the one the generators produced: a
+ * run-commands target declaring where it writes. A target with no declared
+ * outputs is not one of ours, and is the user's to scope since only they know
+ * what it reads.
+ *
+ * The location is not checked. `operations` writes generated Terraform sources
+ * under `packages/common/terraform/src/generated/`, not `dist`, so requiring
+ * `dist` would mean this migration could never match a real one.
+ */ const matchesVendedShape = (target)=>target.executor === 'nx:run-commands' && Array.isArray(target.outputs) && target.outputs.length > 0 && target.outputs.every((output)=>typeof output === 'string');
+/** The inputs a target should declare, or undefined to leave it alone. */ const inputsFor = (name, target)=>{
+    // Only a cacheable target with no inputs at all falls back to Nx's implicit
+    // ones, so one already declaring inputs is left as it is — which also makes
+    // re-running this a no-op.
+    if (!target.cache || target.inputs) return undefined;
+    if (!matchesVendedShape(target)) return undefined;
+    // `checkov` resolves the relative Terraform modules a project consumes, so it
+    // keeps a dependency edge rather than dropping one.
+    if (name === CHECKOV_TARGET || isOpenApiTarget(name)) {
+        return WITH_DEPENDENCY_INPUTS;
+    }
+    return isDefaultOnlyTarget(name) ? [
+        'default'
+    ] : undefined;
+};
+export default async function migration(tree) {
+    const nextSteps = [];
+    for (const [projectName, project] of getProjects(tree)){
+        let changed = false;
+        for (const [name, target] of Object.entries(project.targets ?? {})){
+            const inputs = inputsFor(name, target);
+            if (!inputs) continue;
+            project.targets[name] = {
+                ...target,
+                inputs
+            };
+            changed = true;
+        }
+        if (changed) {
+            updateProjectConfiguration(tree, projectName, project);
+        }
+    }
+    await formatFilesInSubtree(tree);
+    return {
+        nextSteps
+    };
+}
+
+//# sourceMappingURL=migration.js.map

package/src/migrations/latest/declare-cacheable-target-inputs/migration.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../../../../../../../packages/nx-plugin/src/migrations/latest/declare-cacheable-target-inputs/migration.ts"],"sourcesContent":["/**\n * Copyright Amazon.com, Inc. or its affiliates. All Rights Reserved.\n * SPDX-License-Identifier: Apache-2.0\n */\nimport {\n  getProjects,\n  type MigrationReturnObject,\n  type TargetConfiguration,\n  type Tree,\n  updateProjectConfiguration,\n} from '@nx/devkit';\nimport { formatFilesInSubtree } from '../../../utils/format.js';\n\n/**\n * A cacheable target declaring no `inputs` gets Nx's implicit\n * `[\"default\", \"^default\"]`, which reads a dependency's whole project directory\n * — its README, its dev scripts, everything. That is wider than the explicit\n * inputs its siblings carry, so editing a dependency's README re-ran targets\n * whose output could not possibly change.\n *\n * Which explicit inputs are right depends on whether the target has a\n * `dependsOn`. `default` carries a transitive `dependentTasksOutputFiles` entry,\n * which Nx resolves against the task's upstream tasks — so a target with an\n * upstream task still hashes the dependency output it consumes through it, and\n * `[\"default\"]` is enough. A target with no `dependsOn` has nothing for that\n * entry to resolve against, so `default` collapses to the project's own files\n * and dropping `^default` would remove the last edge to the dependency. Those\n * keep a dependency input: `[\"default\", \"^production\"]`.\n */\n\n/** Targets whose `dependsOn` keeps the dependency edge inside `default`. */\nconst DEFAULT_ONLY_NAMES = [\n  'bundle',\n  'bundle-migration',\n  'bundle-create-db-user',\n  'operations',\n];\n\n/**\n * Suffix of the OpenAPI spec targets, which carry a per-agent prefix\n * (`my-agent-openapi`) on a project hosting more than one.\n *\n * These have no `dependsOn`, and their spec serialises models a dependency may\n * own, so they keep a dependency input — without it a dependency's model change\n * serves a stale spec, and that spec feeds client generation.\n */\nconst OPENAPI_SUFFIX = 'openapi';\n\nconst CHECKOV_TARGET = 'checkov';\n\n/**\n * Inputs for a target with no upstream task to resolve `default`'s transitive\n * `dependentTasksOutputFiles` against. `^production` rather than `^default` so a\n * dependency's test edits still do not invalidate it.\n */\nconst WITH_DEPENDENCY_INPUTS = ['default', '^production'];\n\n/** Whether a target is one of the ones narrowed to `[\"default\"]`. */\nconst isDefaultOnlyTarget = (name: string): boolean =>\n  DEFAULT_ONLY_NAMES.includes(name);\n\n/** Whether a target is an OpenAPI spec target, which has no `dependsOn`. */\nconst isOpenApiTarget = (name: string): boolean =>\n  name === OPENAPI_SUFFIX || name.endsWith(`-${OPENAPI_SUFFIX}`);\n\n/**\n * Whether a target still looks like the one the generators produced: a\n * run-commands target declaring where it writes. A target with no declared\n * outputs is not one of ours, and is the user's to scope since only they know\n * what it reads.\n *\n * The location is not checked. `operations` writes generated Terraform sources\n * under `packages/common/terraform/src/generated/`, not `dist`, so requiring\n * `dist` would mean this migration could never match a real one.\n */\nconst matchesVendedShape = (target: TargetConfiguration): boolean =>\n  target.executor === 'nx:run-commands' &&\n  Array.isArray(target.outputs) &&\n  target.outputs.length > 0 &&\n  target.outputs.every((output) => typeof output === 'string');\n\n/** The inputs a target should declare, or undefined to leave it alone. */\nconst inputsFor = (\n  name: string,\n  target: TargetConfiguration,\n): string[] | undefined => {\n  // Only a cacheable target with no inputs at all falls back to Nx's implicit\n  // ones, so one already declaring inputs is left as it is — which also makes\n  // re-running this a no-op.\n  if (!target.cache || target.inputs) return undefined;\n  if (!matchesVendedShape(target)) return undefined;\n  // `checkov` resolves the relative Terraform modules a project consumes, so it\n  // keeps a dependency edge rather than dropping one.\n  if (name === CHECKOV_TARGET || isOpenApiTarget(name)) {\n    return WITH_DEPENDENCY_INPUTS;\n  }\n  return isDefaultOnlyTarget(name) ? ['default'] : undefined;\n};\n\nexport default async function migration(\n  tree: Tree,\n): Promise<MigrationReturnObject> {\n  const nextSteps: string[] = [];\n\n  for (const [projectName, project] of getProjects(tree)) {\n    let changed = false;\n\n    for (const [name, target] of Object.entries(project.targets ?? {})) {\n      const inputs = inputsFor(name, target);\n      if (!inputs) continue;\n\n      project.targets[name] = { ...target, inputs };\n      changed = true;\n    }\n\n    if (changed) {\n      updateProjectConfiguration(tree, projectName, project);\n    }\n  }\n\n  await formatFilesInSubtree(tree);\n\n  return { nextSteps };\n}\n"],"names":["getProjects","updateProjectConfiguration","formatFilesInSubtree","DEFAULT_ONLY_NAMES","OPENAPI_SUFFIX","CHECKOV_TARGET","WITH_DEPENDENCY_INPUTS","isDefaultOnlyTarget","name","includes","isOpenApiTarget","endsWith","matchesVendedShape","target","executor","Array","isArray","outputs","length","every","output","inputsFor","cache","inputs","undefined","migration","tree","nextSteps","projectName","project","changed","Object","entries","targets"],"mappings":"AAAA;;;CAGC,GACD,SACEA,WAAW,EAIXC,0BAA0B,QACrB,aAAa;AACpB,SAASC,oBAAoB,QAAQ,2BAA2B;AAEhE;;;;;;;;;;;;;;;CAeC,GAED,0EAA0E,GAC1E,MAAMC,qBAAqB;IACzB;IACA;IACA;IACA;CACD;AAED;;;;;;;CAOC,GACD,MAAMC,iBAAiB;AAEvB,MAAMC,iBAAiB;AAEvB;;;;CAIC,GACD,MAAMC,yBAAyB;IAAC;IAAW;CAAc;AAEzD,mEAAmE,GACnE,MAAMC,sBAAsB,CAACC,OAC3BL,mBAAmBM,QAAQ,CAACD;AAE9B,0EAA0E,GAC1E,MAAME,kBAAkB,CAACF,OACvBA,SAASJ,kBAAkBI,KAAKG,QAAQ,CAAC,CAAC,CAAC,EAAEP,gBAAgB;AAE/D;;;;;;;;;CASC,GACD,MAAMQ,qBAAqB,CAACC,SAC1BA,OAAOC,QAAQ,KAAK,qBACpBC,MAAMC,OAAO,CAACH,OAAOI,OAAO,KAC5BJ,OAAOI,OAAO,CAACC,MAAM,GAAG,KACxBL,OAAOI,OAAO,CAACE,KAAK,CAAC,CAACC,SAAW,OAAOA,WAAW;AAErD,wEAAwE,GACxE,MAAMC,YAAY,CAChBb,MACAK;IAEA,4EAA4E;IAC5E,4EAA4E;IAC5E,2BAA2B;IAC3B,IAAI,CAACA,OAAOS,KAAK,IAAIT,OAAOU,MAAM,EAAE,OAAOC;IAC3C,IAAI,CAACZ,mBAAmBC,SAAS,OAAOW;IACxC,8EAA8E;IAC9E,oDAAoD;IACpD,IAAIhB,SAASH,kBAAkBK,gBAAgBF,OAAO;QACpD,OAAOF;IACT;IACA,OAAOC,oBAAoBC,QAAQ;QAAC;KAAU,GAAGgB;AACnD;AAEA,eAAe,eAAeC,UAC5BC,IAAU;IAEV,MAAMC,YAAsB,EAAE;IAE9B,KAAK,MAAM,CAACC,aAAaC,QAAQ,IAAI7B,YAAY0B,MAAO;QACtD,IAAII,UAAU;QAEd,KAAK,MAAM,CAACtB,MAAMK,OAAO,IAAIkB,OAAOC,OAAO,CAACH,QAAQI,OAAO,IAAI,CAAC,GAAI;YAClE,MAAMV,SAASF,UAAUb,MAAMK;YAC/B,IAAI,CAACU,QAAQ;YAEbM,QAAQI,OAAO,CAACzB,KAAK,GAAG;gBAAE,GAAGK,MAAM;gBAAEU;YAAO;YAC5CO,UAAU;QACZ;QAEA,IAAIA,SAAS;YACX7B,2BAA2ByB,MAAME,aAAaC;QAChD;IACF;IAEA,MAAM3B,qBAAqBwB;IAE3B,OAAO;QAAEC;IAAU;AACrB"}

package/src/migrations/latest/dev-target-depends-on-pull-image/metadata.json

@@ -0,0 +1,3 @@
+{
+  "description": "Add dependsOn pull-image to the dev target of ts#dynamodb and ts#rdb projects"
+}

package/src/migrations/latest/dev-target-depends-on-pull-image/migration.d.ts

@@ -0,0 +1,6 @@
+/**
+ * Copyright Amazon.com, Inc. or its affiliates. All Rights Reserved.
+ * SPDX-License-Identifier: Apache-2.0
+ */
+import { type MigrationReturnObject, type Tree } from '@nx/devkit';
+export default function migration(tree: Tree): Promise<MigrationReturnObject>;

package/src/migrations/latest/dev-target-depends-on-pull-image/migration.js

@@ -0,0 +1,67 @@
+/**
+ * Copyright Amazon.com, Inc. or its affiliates. All Rights Reserved.
+ * SPDX-License-Identifier: Apache-2.0
+ */ import { getProjects, updateProjectConfiguration } from "@nx/devkit";
+import { TS_DYNAMODB_GENERATOR_INFO } from "../../../ts/dynamodb/generator.js";
+import { TS_RDB_GENERATOR_INFO } from "../../../ts/rdb/generator.js";
+import { formatFilesInSubtree } from "../../../utils/format.js";
+import { addDependencyToTargetIfNotPresent } from "../../../utils/nx.js";
+/**
+ * Make the dev target of ts#dynamodb and ts#rdb projects depend on pull-image
+ *
+ * Without it, `nx dev` starts the container (and, for DynamoDB, creates the
+ * local table) while the image is still being fetched, so a first run on a
+ * machine without the image races the pull.
+ */ const GENERATOR_IDS = [
+    TS_DYNAMODB_GENERATOR_INFO.id,
+    TS_RDB_GENERATOR_INFO.id
+];
+const PULL_IMAGE_TARGET = 'pull-image';
+const startsGeneratedContainer = (project)=>{
+    const { command, commands } = project.targets?.dev?.options ?? {};
+    return [
+        ...commands ?? [],
+        ...command ? [
+            command
+        ] : []
+    ].some((c)=>typeof c === 'string' && c.includes('start-container.ts'));
+};
+const divergedNextStep = (projectName)=>`${projectName}: its dev target has been customised, so it was left as it is. Add "${PULL_IMAGE_TARGET}" to the target's dependsOn so the container image is fetched before the container starts.`;
+export default async function migration(tree) {
+    const nextSteps = [];
+    let migrated = false;
+    for (const [name, project] of getProjects(tree)){
+        if (!GENERATOR_IDS.includes(project.metadata?.generator)) {
+            continue;
+        }
+        const dev = project.targets?.dev;
+        if (!dev || !project.targets?.[PULL_IMAGE_TARGET]) {
+            continue;
+        }
+        // Nx requires an array here. Anything else is hand-written and is reported
+        // rather than rewritten, so a malformed value is never spread or clobbered.
+        if (dev.dependsOn !== undefined && !Array.isArray(dev.dependsOn)) {
+            nextSteps.push(divergedNextStep(name));
+            continue;
+        }
+        const alreadyDependsOnPullImage = (dev.dependsOn ?? []).some((dependency)=>dependency === PULL_IMAGE_TARGET || typeof dependency === 'object' && dependency !== null && dependency.target === PULL_IMAGE_TARGET && dependency.projects === undefined);
+        if (alreadyDependsOnPullImage) {
+            continue;
+        }
+        if (!startsGeneratedContainer(project)) {
+            nextSteps.push(divergedNextStep(name));
+            continue;
+        }
+        addDependencyToTargetIfNotPresent(project, 'dev', PULL_IMAGE_TARGET);
+        updateProjectConfiguration(tree, name, project);
+        migrated = true;
+    }
+    if (migrated) {
+        await formatFilesInSubtree(tree);
+    }
+    return {
+        nextSteps
+    };
+}
+
+//# sourceMappingURL=migration.js.map

package/src/migrations/latest/dev-target-depends-on-pull-image/migration.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../../../../../../../packages/nx-plugin/src/migrations/latest/dev-target-depends-on-pull-image/migration.ts"],"sourcesContent":["/**\n * Copyright Amazon.com, Inc. or its affiliates. All Rights Reserved.\n * SPDX-License-Identifier: Apache-2.0\n */\nimport {\n  getProjects,\n  type MigrationReturnObject,\n  type ProjectConfiguration,\n  type Tree,\n  updateProjectConfiguration,\n} from '@nx/devkit';\nimport { TS_DYNAMODB_GENERATOR_INFO } from '../../../ts/dynamodb/generator.js';\nimport { TS_RDB_GENERATOR_INFO } from '../../../ts/rdb/generator.js';\nimport { formatFilesInSubtree } from '../../../utils/format.js';\nimport { addDependencyToTargetIfNotPresent } from '../../../utils/nx.js';\n\n/**\n * Make the dev target of ts#dynamodb and ts#rdb projects depend on pull-image\n *\n * Without it, `nx dev` starts the container (and, for DynamoDB, creates the\n * local table) while the image is still being fetched, so a first run on a\n * machine without the image races the pull.\n */\n\nconst GENERATOR_IDS = [TS_DYNAMODB_GENERATOR_INFO.id, TS_RDB_GENERATOR_INFO.id];\n\nconst PULL_IMAGE_TARGET = 'pull-image';\n\nconst startsGeneratedContainer = (project: ProjectConfiguration): boolean => {\n  const { command, commands } = project.targets?.dev?.options ?? {};\n  return [...(commands ?? []), ...(command ? [command] : [])].some(\n    (c: string) => typeof c === 'string' && c.includes('start-container.ts'),\n  );\n};\n\nconst divergedNextStep = (projectName: string): string =>\n  `${projectName}: its dev target has been customised, so it was left as it is. Add \"${PULL_IMAGE_TARGET}\" to the target's dependsOn so the container image is fetched before the container starts.`;\n\nexport default async function migration(\n  tree: Tree,\n): Promise<MigrationReturnObject> {\n  const nextSteps: string[] = [];\n  let migrated = false;\n\n  for (const [name, project] of getProjects(tree)) {\n    if (!GENERATOR_IDS.includes((project.metadata as any)?.generator)) {\n      continue;\n    }\n\n    const dev = project.targets?.dev;\n    if (!dev || !project.targets?.[PULL_IMAGE_TARGET]) {\n      continue;\n    }\n\n    // Nx requires an array here. Anything else is hand-written and is reported\n    // rather than rewritten, so a malformed value is never spread or clobbered.\n    if (dev.dependsOn !== undefined && !Array.isArray(dev.dependsOn)) {\n      nextSteps.push(divergedNextStep(name));\n      continue;\n    }\n\n    const alreadyDependsOnPullImage = (dev.dependsOn ?? []).some(\n      (dependency) =>\n        dependency === PULL_IMAGE_TARGET ||\n        (typeof dependency === 'object' &&\n          dependency !== null &&\n          dependency.target === PULL_IMAGE_TARGET &&\n          dependency.projects === undefined),\n    );\n    if (alreadyDependsOnPullImage) {\n      continue;\n    }\n\n    if (!startsGeneratedContainer(project)) {\n      nextSteps.push(divergedNextStep(name));\n      continue;\n    }\n\n    addDependencyToTargetIfNotPresent(project, 'dev', PULL_IMAGE_TARGET);\n    updateProjectConfiguration(tree, name, project);\n    migrated = true;\n  }\n\n  if (migrated) {\n    await formatFilesInSubtree(tree);\n  }\n\n  return { nextSteps };\n}\n"],"names":["getProjects","updateProjectConfiguration","TS_DYNAMODB_GENERATOR_INFO","TS_RDB_GENERATOR_INFO","formatFilesInSubtree","addDependencyToTargetIfNotPresent","GENERATOR_IDS","id","PULL_IMAGE_TARGET","startsGeneratedContainer","project","command","commands","targets","dev","options","some","c","includes","divergedNextStep","projectName","migration","tree","nextSteps","migrated","name","metadata","generator","dependsOn","undefined","Array","isArray","push","alreadyDependsOnPullImage","dependency","target","projects"],"mappings":"AAAA;;;CAGC,GACD,SACEA,WAAW,EAIXC,0BAA0B,QACrB,aAAa;AACpB,SAASC,0BAA0B,QAAQ,oCAAoC;AAC/E,SAASC,qBAAqB,QAAQ,+BAA+B;AACrE,SAASC,oBAAoB,QAAQ,2BAA2B;AAChE,SAASC,iCAAiC,QAAQ,uBAAuB;AAEzE;;;;;;CAMC,GAED,MAAMC,gBAAgB;IAACJ,2BAA2BK,EAAE;IAAEJ,sBAAsBI,EAAE;CAAC;AAE/E,MAAMC,oBAAoB;AAE1B,MAAMC,2BAA2B,CAACC;IAChC,MAAM,EAAEC,OAAO,EAAEC,QAAQ,EAAE,GAAGF,QAAQG,OAAO,EAAEC,KAAKC,WAAW,CAAC;IAChE,OAAO;WAAKH,YAAY,EAAE;WAAOD,UAAU;YAACA;SAAQ,GAAG,EAAE;KAAE,CAACK,IAAI,CAC9D,CAACC,IAAc,OAAOA,MAAM,YAAYA,EAAEC,QAAQ,CAAC;AAEvD;AAEA,MAAMC,mBAAmB,CAACC,cACxB,GAAGA,YAAY,oEAAoE,EAAEZ,kBAAkB,0FAA0F,CAAC;AAEpM,eAAe,eAAea,UAC5BC,IAAU;IAEV,MAAMC,YAAsB,EAAE;IAC9B,IAAIC,WAAW;IAEf,KAAK,MAAM,CAACC,MAAMf,QAAQ,IAAIV,YAAYsB,MAAO;QAC/C,IAAI,CAAChB,cAAcY,QAAQ,CAAER,QAAQgB,QAAQ,EAAUC,YAAY;YACjE;QACF;QAEA,MAAMb,MAAMJ,QAAQG,OAAO,EAAEC;QAC7B,IAAI,CAACA,OAAO,CAACJ,QAAQG,OAAO,EAAE,CAACL,kBAAkB,EAAE;YACjD;QACF;QAEA,2EAA2E;QAC3E,4EAA4E;QAC5E,IAAIM,IAAIc,SAAS,KAAKC,aAAa,CAACC,MAAMC,OAAO,CAACjB,IAAIc,SAAS,GAAG;YAChEL,UAAUS,IAAI,CAACb,iBAAiBM;YAChC;QACF;QAEA,MAAMQ,4BAA4B,AAACnB,CAAAA,IAAIc,SAAS,IAAI,EAAE,AAAD,EAAGZ,IAAI,CAC1D,CAACkB,aACCA,eAAe1B,qBACd,OAAO0B,eAAe,YACrBA,eAAe,QACfA,WAAWC,MAAM,KAAK3B,qBACtB0B,WAAWE,QAAQ,KAAKP;QAE9B,IAAII,2BAA2B;YAC7B;QACF;QAEA,IAAI,CAACxB,yBAAyBC,UAAU;YACtCa,UAAUS,IAAI,CAACb,iBAAiBM;YAChC;QACF;QAEApB,kCAAkCK,SAAS,OAAOF;QAClDP,2BAA2BqB,MAAMG,MAAMf;QACvCc,WAAW;IACb;IAEA,IAAIA,UAAU;QACZ,MAAMpB,qBAAqBkB;IAC7B;IAEA,OAAO;QAAEC;IAAU;AACrB"}

package/src/migrations/latest/docker-target-cache-soundness/metadata.json

@@ -0,0 +1,3 @@
+{
+  "description": "Make container image build and scan targets non-cacheable, so a cache hit can never report success for an image the container engine no longer has"
+}

package/src/migrations/latest/docker-target-cache-soundness/migration.d.ts

@@ -0,0 +1,6 @@
+/**
+ * Copyright Amazon.com, Inc. or its affiliates. All Rights Reserved.
+ * SPDX-License-Identifier: Apache-2.0
+ */
+import { type MigrationReturnObject, type Tree } from '@nx/devkit';
+export default function migration(tree: Tree): Promise<MigrationReturnObject>;

package/src/migrations/latest/docker-target-cache-soundness/migration.js

@@ -0,0 +1,95 @@
+/**
+ * Copyright Amazon.com, Inc. or its affiliates. All Rights Reserved.
+ * SPDX-License-Identifier: Apache-2.0
+ */ import { getProjects, updateProjectConfiguration } from "@nx/devkit";
+import { IMAGE_BUILD_CACHE } from "../../../utils/docker.js";
+import { formatFilesInSubtree } from "../../../utils/format.js";
+/**
+ * Stop Nx caching the targets that build and scan container images.
+ *
+ * A built image lives in the container engine's store, not under any `outputs`
+ * path, so there was nothing for Nx to restore on a cache hit: `build` reported
+ * success for an image the engine no longer had, and the `trivy` target that
+ * depends on it reported a cached pass against that missing image — so a stale
+ * or absent image could clear both a build and a vulnerability scan.
+ *
+ * The container engine's layer cache already makes the rebuild cheap and, unlike
+ * Nx's, it cannot claim a hit for an image that isn't there.
+ *
+ * A target named as one of these but no longer running the engine has been
+ * reworked by the user, so it is left untouched and reported via `nextSteps`.
+ */ /** Names the generators give the targets that build or scan an image. */ const IMAGE_TARGET_NAME = /(^|-)(docker|trivy)$/;
+/** Commands that build an image, or read one back out of the engine to scan it. */ const CONTAINER_ENGINE_COMMAND = /\b(docker|finch)\s+(build|save)\b/;
+/**
+ * The `Dockerfile` the TypeScript image targets declared as their output. It is
+ * a copy made on the way into the build context, never a product of the build,
+ * so it is dropped along with the caching it existed to support.
+ */ const VENDED_DOCKERFILE_OUTPUT = /\/bundle\/(agent|mcp)\/[^/]+\/Dockerfile$/;
+/** The directory the scan target stages its tarball and ignore file in. */ const VENDED_SCAN_OUTPUT = /\/trivy\/[^/]+$/;
+/**
+ * Outputs the generators declare on these targets. Neither is the artifact the
+ * target's success stands for, so dropping their caching loses nothing. An
+ * output beyond these belongs to a target the user has repurposed, whose product
+ * may genuinely be on disk and soundly cacheable.
+ */ const isVendedOutput = (output)=>VENDED_DOCKERFILE_OUTPUT.test(output) || VENDED_SCAN_OUTPUT.test(output);
+/** Every command a target runs, however its options spell them. */ const targetCommands = (target)=>{
+    const { command, commands } = target.options ?? {};
+    return [
+        ...typeof command === 'string' ? [
+            command
+        ] : [],
+        ...Array.isArray(commands) ? commands : []
+    ].filter((c)=>typeof c === 'string');
+};
+const divergedMessage = (projectName, targetName)=>`${projectName}:${targetName}: has diverged from the generated shape - left untouched. Set \`"cache": false\` on it by hand if it builds or scans a container image: the image lives in the container engine rather than under the target's \`outputs\`, so a cache hit can report success for an image that is no longer there.`;
+const ownOutputsMessage = (projectName, targetName)=>`${projectName}:${targetName}: declares outputs of its own, so it was left cacheable. If its result depends on a container image rather than only on those outputs, set \`"cache": false\` on it by hand: the image lives in the container engine, so a cache hit can report success for an image that is no longer there.`;
+/** Applies the fix to one target, reporting one it declines to touch. */ const migrateTarget = (projectName, targetName, target, nextSteps)=>{
+    // A target with `cache` unset is not cached unless `targetDefaults` opts it
+    // in, and one already set to false is sound, so only an explicitly cacheable
+    // one needs rewriting. Both leave a re-run a no-op.
+    if (target.cache !== true) return false;
+    if (!targetCommands(target).some((c)=>CONTAINER_ENGINE_COMMAND.test(c))) {
+        nextSteps.push(divergedMessage(projectName, targetName));
+        return false;
+    }
+    // Running the engine does not by itself make a target's result uncacheable:
+    // one that also declares outputs of its own may well produce the artifact its
+    // success stands for on disk (a `docker save` tarball, a test report), and
+    // that is soundly cacheable. Only the shapes the generators vend are rewritten.
+    const ownOutputs = target.outputs?.filter((o)=>!isVendedOutput(o)) ?? [];
+    if (ownOutputs.length > 0) {
+        nextSteps.push(ownOutputsMessage(projectName, targetName));
+        return false;
+    }
+    target.cache = IMAGE_BUILD_CACHE;
+    // The scan keeps its staging directory: it is a real directory on disk, and
+    // dropping it would leave the tarball behind on a later run.
+    const outputs = target.outputs?.filter((o)=>!VENDED_DOCKERFILE_OUTPUT.test(o));
+    if (outputs && outputs.length === 0) {
+        delete target.outputs;
+    } else if (outputs) {
+        target.outputs = outputs;
+    }
+    return true;
+};
+export default async function migration(tree) {
+    const nextSteps = [];
+    for (const [projectName, project] of getProjects(tree)){
+        let changed = false;
+        for (const [targetName, target] of Object.entries(project.targets ?? {})){
+            // Matched on the name so a target reworked to no longer run the engine is
+            // still found and reported, rather than silently left cacheable.
+            if (!IMAGE_TARGET_NAME.test(targetName)) continue;
+            changed = migrateTarget(projectName, targetName, target, nextSteps) || changed;
+        }
+        if (changed) {
+            updateProjectConfiguration(tree, projectName, project);
+        }
+    }
+    await formatFilesInSubtree(tree);
+    return {
+        nextSteps
+    };
+}
+
+//# sourceMappingURL=migration.js.map

package/src/migrations/latest/docker-target-cache-soundness/migration.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../../../../../../../packages/nx-plugin/src/migrations/latest/docker-target-cache-soundness/migration.ts"],"sourcesContent":["/**\n * Copyright Amazon.com, Inc. or its affiliates. All Rights Reserved.\n * SPDX-License-Identifier: Apache-2.0\n */\nimport {\n  getProjects,\n  type MigrationReturnObject,\n  type ProjectConfiguration,\n  type TargetConfiguration,\n  type Tree,\n  updateProjectConfiguration,\n} from '@nx/devkit';\nimport { IMAGE_BUILD_CACHE } from '../../../utils/docker.js';\nimport { formatFilesInSubtree } from '../../../utils/format.js';\n\n/**\n * Stop Nx caching the targets that build and scan container images.\n *\n * A built image lives in the container engine's store, not under any `outputs`\n * path, so there was nothing for Nx to restore on a cache hit: `build` reported\n * success for an image the engine no longer had, and the `trivy` target that\n * depends on it reported a cached pass against that missing image — so a stale\n * or absent image could clear both a build and a vulnerability scan.\n *\n * The container engine's layer cache already makes the rebuild cheap and, unlike\n * Nx's, it cannot claim a hit for an image that isn't there.\n *\n * A target named as one of these but no longer running the engine has been\n * reworked by the user, so it is left untouched and reported via `nextSteps`.\n */\n\n/** Names the generators give the targets that build or scan an image. */\nconst IMAGE_TARGET_NAME = /(^|-)(docker|trivy)$/;\n\n/** Commands that build an image, or read one back out of the engine to scan it. */\nconst CONTAINER_ENGINE_COMMAND = /\\b(docker|finch)\\s+(build|save)\\b/;\n\n/**\n * The `Dockerfile` the TypeScript image targets declared as their output. It is\n * a copy made on the way into the build context, never a product of the build,\n * so it is dropped along with the caching it existed to support.\n */\nconst VENDED_DOCKERFILE_OUTPUT = /\\/bundle\\/(agent|mcp)\\/[^/]+\\/Dockerfile$/;\n\n/** The directory the scan target stages its tarball and ignore file in. */\nconst VENDED_SCAN_OUTPUT = /\\/trivy\\/[^/]+$/;\n\n/**\n * Outputs the generators declare on these targets. Neither is the artifact the\n * target's success stands for, so dropping their caching loses nothing. An\n * output beyond these belongs to a target the user has repurposed, whose product\n * may genuinely be on disk and soundly cacheable.\n */\nconst isVendedOutput = (output: string): boolean =>\n  VENDED_DOCKERFILE_OUTPUT.test(output) || VENDED_SCAN_OUTPUT.test(output);\n\n/** Every command a target runs, however its options spell them. */\nconst targetCommands = (target: TargetConfiguration): string[] => {\n  const { command, commands } = (target.options ?? {}) as {\n    command?: unknown;\n    commands?: unknown;\n  };\n  return [\n    ...(typeof command === 'string' ? [command] : []),\n    ...(Array.isArray(commands) ? commands : []),\n  ].filter((c): c is string => typeof c === 'string');\n};\n\nconst divergedMessage = (projectName: string, targetName: string) =>\n  `${projectName}:${targetName}: has diverged from the generated shape - left untouched. Set \\`\"cache\": false\\` on it by hand if it builds or scans a container image: the image lives in the container engine rather than under the target's \\`outputs\\`, so a cache hit can report success for an image that is no longer there.`;\n\nconst ownOutputsMessage = (projectName: string, targetName: string) =>\n  `${projectName}:${targetName}: declares outputs of its own, so it was left cacheable. If its result depends on a container image rather than only on those outputs, set \\`\"cache\": false\\` on it by hand: the image lives in the container engine, so a cache hit can report success for an image that is no longer there.`;\n\n/** Applies the fix to one target, reporting one it declines to touch. */\nconst migrateTarget = (\n  projectName: string,\n  targetName: string,\n  target: TargetConfiguration,\n  nextSteps: string[],\n): boolean => {\n  // A target with `cache` unset is not cached unless `targetDefaults` opts it\n  // in, and one already set to false is sound, so only an explicitly cacheable\n  // one needs rewriting. Both leave a re-run a no-op.\n  if (target.cache !== true) return false;\n\n  if (!targetCommands(target).some((c) => CONTAINER_ENGINE_COMMAND.test(c))) {\n    nextSteps.push(divergedMessage(projectName, targetName));\n    return false;\n  }\n\n  // Running the engine does not by itself make a target's result uncacheable:\n  // one that also declares outputs of its own may well produce the artifact its\n  // success stands for on disk (a `docker save` tarball, a test report), and\n  // that is soundly cacheable. Only the shapes the generators vend are rewritten.\n  const ownOutputs = target.outputs?.filter((o) => !isVendedOutput(o)) ?? [];\n  if (ownOutputs.length > 0) {\n    nextSteps.push(ownOutputsMessage(projectName, targetName));\n    return false;\n  }\n\n  target.cache = IMAGE_BUILD_CACHE;\n\n  // The scan keeps its staging directory: it is a real directory on disk, and\n  // dropping it would leave the tarball behind on a later run.\n  const outputs = target.outputs?.filter(\n    (o) => !VENDED_DOCKERFILE_OUTPUT.test(o),\n  );\n  if (outputs && outputs.length === 0) {\n    delete target.outputs;\n  } else if (outputs) {\n    target.outputs = outputs;\n  }\n\n  return true;\n};\n\nexport default async function migration(\n  tree: Tree,\n): Promise<MigrationReturnObject> {\n  const nextSteps: string[] = [];\n\n  for (const [projectName, project] of getProjects(tree)) {\n    let changed = false;\n\n    for (const [targetName, target] of Object.entries(project.targets ?? {})) {\n      // Matched on the name so a target reworked to no longer run the engine is\n      // still found and reported, rather than silently left cacheable.\n      if (!IMAGE_TARGET_NAME.test(targetName)) continue;\n\n      changed =\n        migrateTarget(projectName, targetName, target, nextSteps) || changed;\n    }\n\n    if (changed) {\n      updateProjectConfiguration(\n        tree,\n        projectName,\n        project as ProjectConfiguration,\n      );\n    }\n  }\n\n  await formatFilesInSubtree(tree);\n\n  return { nextSteps };\n}\n"],"names":["getProjects","updateProjectConfiguration","IMAGE_BUILD_CACHE","formatFilesInSubtree","IMAGE_TARGET_NAME","CONTAINER_ENGINE_COMMAND","VENDED_DOCKERFILE_OUTPUT","VENDED_SCAN_OUTPUT","isVendedOutput","output","test","targetCommands","target","command","commands","options","Array","isArray","filter","c","divergedMessage","projectName","targetName","ownOutputsMessage","migrateTarget","nextSteps","cache","some","push","ownOutputs","outputs","o","length","migration","tree","project","changed","Object","entries","targets"],"mappings":"AAAA;;;CAGC,GACD,SACEA,WAAW,EAKXC,0BAA0B,QACrB,aAAa;AACpB,SAASC,iBAAiB,QAAQ,2BAA2B;AAC7D,SAASC,oBAAoB,QAAQ,2BAA2B;AAEhE;;;;;;;;;;;;;;CAcC,GAED,uEAAuE,GACvE,MAAMC,oBAAoB;AAE1B,iFAAiF,GACjF,MAAMC,2BAA2B;AAEjC;;;;CAIC,GACD,MAAMC,2BAA2B;AAEjC,yEAAyE,GACzE,MAAMC,qBAAqB;AAE3B;;;;;CAKC,GACD,MAAMC,iBAAiB,CAACC,SACtBH,yBAAyBI,IAAI,CAACD,WAAWF,mBAAmBG,IAAI,CAACD;AAEnE,iEAAiE,GACjE,MAAME,iBAAiB,CAACC;IACtB,MAAM,EAAEC,OAAO,EAAEC,QAAQ,EAAE,GAAIF,OAAOG,OAAO,IAAI,CAAC;IAIlD,OAAO;WACD,OAAOF,YAAY,WAAW;YAACA;SAAQ,GAAG,EAAE;WAC5CG,MAAMC,OAAO,CAACH,YAAYA,WAAW,EAAE;KAC5C,CAACI,MAAM,CAAC,CAACC,IAAmB,OAAOA,MAAM;AAC5C;AAEA,MAAMC,kBAAkB,CAACC,aAAqBC,aAC5C,GAAGD,YAAY,CAAC,EAAEC,WAAW,mSAAmS,CAAC;AAEnU,MAAMC,oBAAoB,CAACF,aAAqBC,aAC9C,GAAGD,YAAY,CAAC,EAAEC,WAAW,6RAA6R,CAAC;AAE7T,uEAAuE,GACvE,MAAME,gBAAgB,CACpBH,aACAC,YACAV,QACAa;IAEA,4EAA4E;IAC5E,6EAA6E;IAC7E,oDAAoD;IACpD,IAAIb,OAAOc,KAAK,KAAK,MAAM,OAAO;IAElC,IAAI,CAACf,eAAeC,QAAQe,IAAI,CAAC,CAACR,IAAMd,yBAAyBK,IAAI,CAACS,KAAK;QACzEM,UAAUG,IAAI,CAACR,gBAAgBC,aAAaC;QAC5C,OAAO;IACT;IAEA,4EAA4E;IAC5E,8EAA8E;IAC9E,2EAA2E;IAC3E,gFAAgF;IAChF,MAAMO,aAAajB,OAAOkB,OAAO,EAAEZ,OAAO,CAACa,IAAM,CAACvB,eAAeuB,OAAO,EAAE;IAC1E,IAAIF,WAAWG,MAAM,GAAG,GAAG;QACzBP,UAAUG,IAAI,CAACL,kBAAkBF,aAAaC;QAC9C,OAAO;IACT;IAEAV,OAAOc,KAAK,GAAGxB;IAEf,4EAA4E;IAC5E,6DAA6D;IAC7D,MAAM4B,UAAUlB,OAAOkB,OAAO,EAAEZ,OAC9B,CAACa,IAAM,CAACzB,yBAAyBI,IAAI,CAACqB;IAExC,IAAID,WAAWA,QAAQE,MAAM,KAAK,GAAG;QACnC,OAAOpB,OAAOkB,OAAO;IACvB,OAAO,IAAIA,SAAS;QAClBlB,OAAOkB,OAAO,GAAGA;IACnB;IAEA,OAAO;AACT;AAEA,eAAe,eAAeG,UAC5BC,IAAU;IAEV,MAAMT,YAAsB,EAAE;IAE9B,KAAK,MAAM,CAACJ,aAAac,QAAQ,IAAInC,YAAYkC,MAAO;QACtD,IAAIE,UAAU;QAEd,KAAK,MAAM,CAACd,YAAYV,OAAO,IAAIyB,OAAOC,OAAO,CAACH,QAAQI,OAAO,IAAI,CAAC,GAAI;YACxE,0EAA0E;YAC1E,iEAAiE;YACjE,IAAI,CAACnC,kBAAkBM,IAAI,CAACY,aAAa;YAEzCc,UACEZ,cAAcH,aAAaC,YAAYV,QAAQa,cAAcW;QACjE;QAEA,IAAIA,SAAS;YACXnC,2BACEiC,MACAb,aACAc;QAEJ;IACF;IAEA,MAAMhC,qBAAqB+B;IAE3B,OAAO;QAAET;IAAU;AACrB"}

package/src/migrations/latest/open-api-codegen-executor/metadata.json

@@ -0,0 +1,3 @@
+{
+  "description": "Switch generated OpenAPI codegen targets to the in-process open-api-codegen executor"
+}

package/src/migrations/latest/open-api-codegen-executor/migration.d.ts

@@ -0,0 +1,6 @@
+/**
+ * Copyright Amazon.com, Inc. or its affiliates. All Rights Reserved.
+ * SPDX-License-Identifier: Apache-2.0
+ */
+import { type MigrationReturnObject, type Tree } from '@nx/devkit';
+export default function migration(tree: Tree): Promise<MigrationReturnObject>;

package/src/migrations/latest/open-api-codegen-executor/migration.js

@@ -0,0 +1,100 @@
+/**
+ * Copyright Amazon.com, Inc. or its affiliates. All Rights Reserved.
+ * SPDX-License-Identifier: Apache-2.0
+ */ import { getProjects, updateProjectConfiguration } from "@nx/devkit";
+import { formatFilesInSubtree } from "../../../utils/format.js";
+import { normalizeTargetKeyOrder } from "../../../utils/nx.js";
+import { OPEN_API_CODEGEN_EXECUTOR } from "../../../utils/open-api-codegen-target.js";
+/**
+ * Codegen targets ran `nx g @aws/nx-plugin:open-api#<generator>` through
+ * `nx:run-commands`, paying a second full Nx bootstrap — project graph, plugin
+ * resolution and schema validation — for every codegen step. They now use the
+ * `open-api-codegen` executor, which runs the same generator in the Nx process
+ * that is already running.
+ *
+ * Only the command shape the generators produced is rewritten. A target that has
+ * been customised — an extra flag, a chained command, options beyond `commands` —
+ * is the user's, so it is left as it is and reported.
+ *
+ * How to write a migration:
+ * - https://nx.dev/docs/kb/migration-generators
+ * - What `nextSteps` means: https://nx.dev/docs/reference/devkit/MigrationReturnObject
+ */ /** The generators the executor can run, by the collection name they had. */ const GENERATORS = {
+    'open-api#ts-client': 'ts-client',
+    'open-api#ts-hooks': 'ts-hooks',
+    'open-api#ts-metadata': 'ts-metadata',
+    'open-api#json-metadata': 'json-metadata'
+};
+/**
+ * Matches a whole generated codegen command, binding the generator name and its
+ * two paths. Anchored, so a command carrying anything else does not match and is
+ * reported instead of rewritten.
+ */ const CODEGEN_COMMAND = /^nx g @aws\/nx-plugin:(?<generator>[\w#-]+) --openApiSpecPath="(?<specPath>[^"]+)" --outputPath="(?<outputPath>[^"]+)" --no-interactive$/;
+/**
+ * The command a target runs, when it is a single-command `nx:run-commands` — the
+ * shape the generators produced. A target carrying several commands, or options
+ * beyond `commands`, has diverged.
+ */ const singleCommand = (target)=>{
+    if (target.executor !== 'nx:run-commands') return undefined;
+    const options = target.options;
+    if (!options || Object.keys(options).length !== 1) return undefined;
+    const commands = options.commands;
+    if (!Array.isArray(commands) || commands.length !== 1) return undefined;
+    return typeof commands[0] === 'string' ? commands[0] : undefined;
+};
+/** Parses a generated codegen command, or undefined if it is not one. */ const parseCodegenCommand = (command)=>{
+    const groups = CODEGEN_COMMAND.exec(command)?.groups;
+    if (!groups) return undefined;
+    const generator = GENERATORS[groups.generator];
+    if (!generator) return undefined;
+    return {
+        generator,
+        openApiSpecPath: groups.specPath,
+        outputPath: groups.outputPath
+    };
+};
+/**
+ * Whether a target invokes an OpenAPI generator without being the shape the
+ * generators produced, so it must be reported rather than rewritten.
+ *
+ * Continuous targets are excluded. The vended `watch-generate:<api>-client`
+ * wraps `nx watch -- nx run <project>:<codegen target>`, which references the
+ * codegen target rather than the generator, so it never matches here anyway. But
+ * a watch target rewritten to invoke the generator directly would, and telling
+ * its owner to switch to the executor would be wrong advice: `nx watch` runs
+ * until interrupted, which a single executor invocation cannot express.
+ *
+ * `continuous` is the property that makes that true, so it is what is checked —
+ * rather than the `watch-` name prefix, which is only a convention.
+ */ const hasCustomisedCodegenCommand = (target)=>target.executor === 'nx:run-commands' && !target.continuous && JSON.stringify(target.options ?? {}).includes('@aws/nx-plugin:open-api#');
+export default async function migration(tree) {
+    const nextSteps = [];
+    for (const [projectName, project] of getProjects(tree)){
+        let changed = false;
+        for (const [targetName, target] of Object.entries(project.targets ?? {})){
+            const command = singleCommand(target);
+            const options = command ? parseCodegenCommand(command) : undefined;
+            if (!options) {
+                if (hasCustomisedCodegenCommand(target)) {
+                    nextSteps.push(`${projectName}:${targetName} has diverged from the generated shape — left untouched. Switch it to the '${OPEN_API_CODEGEN_EXECUTOR}' executor to avoid a nested Nx invocation.`);
+                }
+                continue;
+            }
+            project.targets[targetName] = normalizeTargetKeyOrder({
+                ...target,
+                executor: OPEN_API_CODEGEN_EXECUTOR,
+                options
+            });
+            changed = true;
+        }
+        if (changed) {
+            updateProjectConfiguration(tree, projectName, project);
+        }
+    }
+    await formatFilesInSubtree(tree);
+    return {
+        nextSteps
+    };
+}
+
+//# sourceMappingURL=migration.js.map

package/src/migrations/latest/open-api-codegen-executor/migration.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../../../../../../../packages/nx-plugin/src/migrations/latest/open-api-codegen-executor/migration.ts"],"sourcesContent":["/**\n * Copyright Amazon.com, Inc. or its affiliates. All Rights Reserved.\n * SPDX-License-Identifier: Apache-2.0\n */\nimport {\n  getProjects,\n  type MigrationReturnObject,\n  type TargetConfiguration,\n  type Tree,\n  updateProjectConfiguration,\n} from '@nx/devkit';\nimport type { OpenApiCodegenTarget } from '../../../open-api/codegen/executor-schema';\nimport { formatFilesInSubtree } from '../../../utils/format.js';\nimport { normalizeTargetKeyOrder } from '../../../utils/nx.js';\nimport { OPEN_API_CODEGEN_EXECUTOR } from '../../../utils/open-api-codegen-target.js';\n\n/**\n * Codegen targets ran `nx g @aws/nx-plugin:open-api#<generator>` through\n * `nx:run-commands`, paying a second full Nx bootstrap — project graph, plugin\n * resolution and schema validation — for every codegen step. They now use the\n * `open-api-codegen` executor, which runs the same generator in the Nx process\n * that is already running.\n *\n * Only the command shape the generators produced is rewritten. A target that has\n * been customised — an extra flag, a chained command, options beyond `commands` —\n * is the user's, so it is left as it is and reported.\n *\n * How to write a migration:\n * - https://nx.dev/docs/kb/migration-generators\n * - What `nextSteps` means: https://nx.dev/docs/reference/devkit/MigrationReturnObject\n */\n\n/** The generators the executor can run, by the collection name they had. */\nconst GENERATORS: Record<string, OpenApiCodegenTarget> = {\n  'open-api#ts-client': 'ts-client',\n  'open-api#ts-hooks': 'ts-hooks',\n  'open-api#ts-metadata': 'ts-metadata',\n  'open-api#json-metadata': 'json-metadata',\n};\n\n/**\n * Matches a whole generated codegen command, binding the generator name and its\n * two paths. Anchored, so a command carrying anything else does not match and is\n * reported instead of rewritten.\n */\nconst CODEGEN_COMMAND =\n  /^nx g @aws\\/nx-plugin:(?<generator>[\\w#-]+) --openApiSpecPath=\"(?<specPath>[^\"]+)\" --outputPath=\"(?<outputPath>[^\"]+)\" --no-interactive$/;\n\ninterface CodegenOptions {\n  readonly generator: OpenApiCodegenTarget;\n  readonly openApiSpecPath: string;\n  readonly outputPath: string;\n}\n\n/**\n * The command a target runs, when it is a single-command `nx:run-commands` — the\n * shape the generators produced. A target carrying several commands, or options\n * beyond `commands`, has diverged.\n */\nconst singleCommand = (target: TargetConfiguration): string | undefined => {\n  if (target.executor !== 'nx:run-commands') return undefined;\n  const options = target.options as Record<string, unknown> | undefined;\n  if (!options || Object.keys(options).length !== 1) return undefined;\n  const commands = options.commands;\n  if (!Array.isArray(commands) || commands.length !== 1) return undefined;\n  return typeof commands[0] === 'string' ? commands[0] : undefined;\n};\n\n/** Parses a generated codegen command, or undefined if it is not one. */\nconst parseCodegenCommand = (command: string): CodegenOptions | undefined => {\n  const groups = CODEGEN_COMMAND.exec(command)?.groups;\n  if (!groups) return undefined;\n  const generator = GENERATORS[groups.generator];\n  if (!generator) return undefined;\n  return {\n    generator,\n    openApiSpecPath: groups.specPath,\n    outputPath: groups.outputPath,\n  };\n};\n\n/**\n * Whether a target invokes an OpenAPI generator without being the shape the\n * generators produced, so it must be reported rather than rewritten.\n *\n * Continuous targets are excluded. The vended `watch-generate:<api>-client`\n * wraps `nx watch -- nx run <project>:<codegen target>`, which references the\n * codegen target rather than the generator, so it never matches here anyway. But\n * a watch target rewritten to invoke the generator directly would, and telling\n * its owner to switch to the executor would be wrong advice: `nx watch` runs\n * until interrupted, which a single executor invocation cannot express.\n *\n * `continuous` is the property that makes that true, so it is what is checked —\n * rather than the `watch-` name prefix, which is only a convention.\n */\nconst hasCustomisedCodegenCommand = (target: TargetConfiguration): boolean =>\n  target.executor === 'nx:run-commands' &&\n  !target.continuous &&\n  JSON.stringify(target.options ?? {}).includes('@aws/nx-plugin:open-api#');\n\nexport default async function migration(\n  tree: Tree,\n): Promise<MigrationReturnObject> {\n  const nextSteps: string[] = [];\n\n  for (const [projectName, project] of getProjects(tree)) {\n    let changed = false;\n\n    for (const [targetName, target] of Object.entries(project.targets ?? {})) {\n      const command = singleCommand(target);\n      const options = command ? parseCodegenCommand(command) : undefined;\n\n      if (!options) {\n        if (hasCustomisedCodegenCommand(target)) {\n          nextSteps.push(\n            `${projectName}:${targetName} has diverged from the generated shape — left untouched. Switch it to the '${OPEN_API_CODEGEN_EXECUTOR}' executor to avoid a nested Nx invocation.`,\n          );\n        }\n        continue;\n      }\n\n      project.targets[targetName] = normalizeTargetKeyOrder({\n        ...target,\n        executor: OPEN_API_CODEGEN_EXECUTOR,\n        options,\n      });\n      changed = true;\n    }\n\n    if (changed) {\n      updateProjectConfiguration(tree, projectName, project);\n    }\n  }\n\n  await formatFilesInSubtree(tree);\n\n  return { nextSteps };\n}\n"],"names":["getProjects","updateProjectConfiguration","formatFilesInSubtree","normalizeTargetKeyOrder","OPEN_API_CODEGEN_EXECUTOR","GENERATORS","CODEGEN_COMMAND","singleCommand","target","executor","undefined","options","Object","keys","length","commands","Array","isArray","parseCodegenCommand","command","groups","exec","generator","openApiSpecPath","specPath","outputPath","hasCustomisedCodegenCommand","continuous","JSON","stringify","includes","migration","tree","nextSteps","projectName","project","changed","targetName","entries","targets","push"],"mappings":"AAAA;;;CAGC,GACD,SACEA,WAAW,EAIXC,0BAA0B,QACrB,aAAa;AAEpB,SAASC,oBAAoB,QAAQ,2BAA2B;AAChE,SAASC,uBAAuB,QAAQ,uBAAuB;AAC/D,SAASC,yBAAyB,QAAQ,4CAA4C;AAEtF;;;;;;;;;;;;;;CAcC,GAED,0EAA0E,GAC1E,MAAMC,aAAmD;IACvD,sBAAsB;IACtB,qBAAqB;IACrB,wBAAwB;IACxB,0BAA0B;AAC5B;AAEA;;;;CAIC,GACD,MAAMC,kBACJ;AAQF;;;;CAIC,GACD,MAAMC,gBAAgB,CAACC;IACrB,IAAIA,OAAOC,QAAQ,KAAK,mBAAmB,OAAOC;IAClD,MAAMC,UAAUH,OAAOG,OAAO;IAC9B,IAAI,CAACA,WAAWC,OAAOC,IAAI,CAACF,SAASG,MAAM,KAAK,GAAG,OAAOJ;IAC1D,MAAMK,WAAWJ,QAAQI,QAAQ;IACjC,IAAI,CAACC,MAAMC,OAAO,CAACF,aAAaA,SAASD,MAAM,KAAK,GAAG,OAAOJ;IAC9D,OAAO,OAAOK,QAAQ,CAAC,EAAE,KAAK,WAAWA,QAAQ,CAAC,EAAE,GAAGL;AACzD;AAEA,uEAAuE,GACvE,MAAMQ,sBAAsB,CAACC;IAC3B,MAAMC,SAASd,gBAAgBe,IAAI,CAACF,UAAUC;IAC9C,IAAI,CAACA,QAAQ,OAAOV;IACpB,MAAMY,YAAYjB,UAAU,CAACe,OAAOE,SAAS,CAAC;IAC9C,IAAI,CAACA,WAAW,OAAOZ;IACvB,OAAO;QACLY;QACAC,iBAAiBH,OAAOI,QAAQ;QAChCC,YAAYL,OAAOK,UAAU;IAC/B;AACF;AAEA;;;;;;;;;;;;;CAaC,GACD,MAAMC,8BAA8B,CAAClB,SACnCA,OAAOC,QAAQ,KAAK,qBACpB,CAACD,OAAOmB,UAAU,IAClBC,KAAKC,SAAS,CAACrB,OAAOG,OAAO,IAAI,CAAC,GAAGmB,QAAQ,CAAC;AAEhD,eAAe,eAAeC,UAC5BC,IAAU;IAEV,MAAMC,YAAsB,EAAE;IAE9B,KAAK,MAAM,CAACC,aAAaC,QAAQ,IAAInC,YAAYgC,MAAO;QACtD,IAAII,UAAU;QAEd,KAAK,MAAM,CAACC,YAAY7B,OAAO,IAAII,OAAO0B,OAAO,CAACH,QAAQI,OAAO,IAAI,CAAC,GAAI;YACxE,MAAMpB,UAAUZ,cAAcC;YAC9B,MAAMG,UAAUQ,UAAUD,oBAAoBC,WAAWT;YAEzD,IAAI,CAACC,SAAS;gBACZ,IAAIe,4BAA4BlB,SAAS;oBACvCyB,UAAUO,IAAI,CACZ,GAAGN,YAAY,CAAC,EAAEG,WAAW,2EAA2E,EAAEjC,0BAA0B,2CAA2C,CAAC;gBAEpL;gBACA;YACF;YAEA+B,QAAQI,OAAO,CAACF,WAAW,GAAGlC,wBAAwB;gBACpD,GAAGK,MAAM;gBACTC,UAAUL;gBACVO;YACF;YACAyB,UAAU;QACZ;QAEA,IAAIA,SAAS;YACXnC,2BAA2B+B,MAAME,aAAaC;QAChD;IACF;IAEA,MAAMjC,qBAAqB8B;IAE3B,OAAO;QAAEC;IAAU;AACrB"}

package/src/migrations/latest/python-test-input-scoping/metadata.json

@@ -0,0 +1,3 @@
+{
+  "description": "Exclude Python test files from the production named input and scope dependent task outputs to dist so Python test edits do not invalidate build tasks"
+}

package/src/migrations/latest/python-test-input-scoping/migration.d.ts

@@ -0,0 +1,6 @@
+/**
+ * Copyright Amazon.com, Inc. or its affiliates. All Rights Reserved.
+ * SPDX-License-Identifier: Apache-2.0
+ */
+import { type MigrationReturnObject, type Tree } from '@nx/devkit';
+export default function migration(tree: Tree): Promise<MigrationReturnObject>;

package/src/migrations/latest/python-test-input-scoping/migration.js

@@ -0,0 +1,142 @@
+/**
+ * Copyright Amazon.com, Inc. or its affiliates. All Rights Reserved.
+ * SPDX-License-Identifier: Apache-2.0
+ */ import { getProjects, readNxJson, updateNxJson, updateProjectConfiguration } from "@nx/devkit";
+import { PYTHON_TEST_FILE_EXCLUSIONS } from "../../../py/project/generator.js";
+import { DEPENDENT_TASKS_OUTPUT_FILES_INPUT } from "../../../ts/lib/generator.js";
+import { formatFilesInSubtree } from "../../../utils/format.js";
+/**
+ * Editing a Python test file used to invalidate the whole build chain for its
+ * project, and cascade into every downstream project. Two independent causes:
+ *
+ * 1. The `production` named input excluded TypeScript specs but nothing Python,
+ *    and the Python build targets read `default` (every file in the project), so
+ *    a test file was a build input by construction.
+ * 2. `default` consumed *every* output of a dependency task. The Python `test`
+ *    target writes JUnit and coverage reports that pytest stamps wall-clock time
+ *    into, so each test run minted a new hash that propagated downstream.
+ *
+ * Targets whose output genuinely cannot contain a test file move to
+ * `production`; `typecheck` deliberately stays on `default`, because `ty` checks
+ * the tests directory and must re-run when a test changes.
+ */ /** The Python targets whose declared output cannot contain a test file. */ const PRODUCTION_SCOPED_TARGETS = [
+    'compile',
+    'bundle-x86',
+    'bundle-arm'
+];
+/** The inputs those targets read once scoped to production sources. */ const PRODUCTION_INPUTS = [
+    'production',
+    '^production'
+];
+/** The inputs those targets previously read. */ const PREVIOUS_INPUTS = [
+    'default',
+    '^production'
+];
+/**
+ * Dependent-task-output globs this plugin has vended. Any of them is rewritten
+ * to the current one; anything else is the user's own scoping decision.
+ */ const PREVIOUSLY_VENDED_GLOBS = [
+    '**/*',
+    'dist/**'
+];
+const isPythonProject = (project)=>Object.values(project.targets ?? {}).some((target)=>String(target?.executor ?? '').startsWith('@nxlv/python'));
+/**
+ * An OpenAPI spec generation target as the generators vend it: named `openapi`
+ * or `<agent>-openapi`, running a command, and writing its spec under
+ * `dist/.../openapi`. The extra checks keep a user-authored target that merely
+ * shares the suffix from being rescoped, since these targets are identified by
+ * declaring no `inputs` at all.
+ */ const isOpenApiTarget = (name, target)=>{
+    if (name !== 'openapi' && !name.endsWith('-openapi')) return false;
+    if (!target) return true;
+    return target.executor === 'nx:run-commands' && (target.outputs ?? []).some((output)=>output.includes('/openapi'));
+};
+const arraysEqual = (a, b)=>a.length === b.length && a.every((entry, index)=>entry === b[index]);
+/**
+ * Excludes Python test files from the `production` named input, and narrows the
+ * dependent-task-output input so test reports no longer propagate downstream.
+ */ const migrateNamedInputs = (tree, nextSteps)=>{
+    const nxJson = readNxJson(tree);
+    if (!nxJson) return;
+    // Seeded as `['default']` when absent, exactly as the generator does. The
+    // targets below are rewritten to read `production`, and Nx fails hard on a
+    // named input that is not defined, so the two must not diverge.
+    const production = nxJson.namedInputs?.production ?? [
+        'default'
+    ];
+    const nextProduction = [
+        ...production,
+        ...PYTHON_TEST_FILE_EXCLUSIONS.filter((exclusion)=>!production.includes(exclusion))
+    ];
+    const defaultInput = nxJson.namedInputs?.default;
+    let nextDefault = defaultInput;
+    if (defaultInput) {
+        const glob = DEPENDENT_TASKS_OUTPUT_FILES_INPUT.dependentTasksOutputFiles;
+        // Only an entry this plugin vended is rewritten; a different glob is the
+        // user's own scoping decision.
+        nextDefault = defaultInput.map((input)=>typeof input === 'object' && input !== null && 'dependentTasksOutputFiles' in input && PREVIOUSLY_VENDED_GLOBS.includes(input.dependentTasksOutputFiles) ? {
+                ...input,
+                dependentTasksOutputFiles: glob
+            } : input);
+        const hadVendedEntry = nextDefault.some((input)=>typeof input === 'object' && input !== null && 'dependentTasksOutputFiles' in input && input.dependentTasksOutputFiles === glob);
+        const hasCustomEntry = defaultInput.some((input)=>typeof input === 'object' && input !== null && 'dependentTasksOutputFiles' in input && !PREVIOUSLY_VENDED_GLOBS.includes(input.dependentTasksOutputFiles) && input.dependentTasksOutputFiles !== glob);
+        if (!hadVendedEntry && hasCustomEntry) {
+            nextSteps.push(`nx.json's 'default' named input scopes 'dependentTasksOutputFiles' to a custom glob — left untouched. Narrow it to '${glob}' so timestamped test reports do not invalidate downstream tasks.`);
+        }
+    }
+    updateNxJson(tree, {
+        ...nxJson,
+        namedInputs: {
+            ...nxJson.namedInputs,
+            production: nextProduction,
+            ...nextDefault ? {
+                default: nextDefault
+            } : {}
+        }
+    });
+};
+/**
+ * Scopes a Python project's build-chain targets to production sources. Only
+ * targets still carrying the inputs the generator vended are rewritten, so a
+ * project whose inputs the user has tuned is reported rather than clobbered.
+ */ const migrateProjectTargets = (tree, projectName, project, nextSteps)=>{
+    let changed = false;
+    for (const [targetName, target] of Object.entries(project.targets ?? {})){
+        if (!PRODUCTION_SCOPED_TARGETS.includes(targetName) && !isOpenApiTarget(targetName, target)) {
+            continue;
+        }
+        const inputs = target.inputs;
+        // Already migrated, so a re-run is a no-op.
+        if (inputs && arraysEqual(inputs, PRODUCTION_INPUTS)) {
+            continue;
+        }
+        // The OpenAPI targets declared no inputs at all, so they fell back to
+        // `default`. Everything else carried the vended pair.
+        const isVendedShape = inputs ? arraysEqual(inputs, PREVIOUS_INPUTS) : isOpenApiTarget(targetName, target);
+        if (!isVendedShape) {
+            nextSteps.push(`${projectName}:${targetName}: 'inputs' has diverged from the generated shape — left untouched. Scope it to ['production', '^production'] so Python test edits do not invalidate it.`);
+            continue;
+        }
+        target.inputs = [
+            ...PRODUCTION_INPUTS
+        ];
+        changed = true;
+    }
+    if (changed) {
+        updateProjectConfiguration(tree, projectName, project);
+    }
+};
+export default async function migration(tree) {
+    const nextSteps = [];
+    migrateNamedInputs(tree, nextSteps);
+    for (const [projectName, project] of getProjects(tree)){
+        if (!isPythonProject(project)) continue;
+        migrateProjectTargets(tree, projectName, project, nextSteps);
+    }
+    await formatFilesInSubtree(tree);
+    return {
+        nextSteps
+    };
+}
+
+//# sourceMappingURL=migration.js.map