@aws/nx-plugin 1.0.0-rc.9 → 1.0.0-rc.91

package/src/migrations/v1.0.0-rc.85/0001-terraform-project-checkov-target-and-bootstrap-destroy/migration.js

@@ -0,0 +1,146 @@
+/**
+ * Copyright Amazon.com, Inc. or its affiliates. All Rights Reserved.
+ * SPDX-License-Identifier: Apache-2.0
+ */ import { generateFiles, getProjects, joinPathFragments, OverwriteStrategy, updateProjectConfiguration } from "@nx/devkit";
+import { TERRAFORM_PROJECT_GENERATOR_INFO } from "../../../terraform/project/generator.js";
+import { applyGritQL, matchGritQL } from "../../../utils/ast.js";
+import { formatFilesInSubtree } from "../../../utils/format.js";
+import { kebabCase } from "../../../utils/names.js";
+import { normalizeTargetKeyOrder } from "../../../utils/nx.js";
+import { sortObjectKeys } from "../../../utils/object.js";
+/**
+ * Terraform projects gained three fixes:
+ *
+ * - A `checkov` target carries the security scan, matching the name CDK
+ *   infrastructure projects already use, so `nx run-many --target checkov` no
+ *   longer skips Terraform projects. An existing `test` target is the user's,
+ *   so it is left exactly as it is.
+ * - A `checkov.yml` gives Terraform users the same central place to configure
+ *   skips that the CDK app has, wired in via `--config-file`.
+ * - `bootstrap-destroy` runs a script that resolves the region from the AWS SDK
+ *   credential chain and passes it as `-var=aws_region`. The vended
+ *   `aws_region` variable has no default, so the previous bare
+ *   `terraform destroy` blocked forever on an input prompt in any non-TTY
+ *   context.
+ * - Both vended `providers.tf` declare `required_version = ">= 1.0"`, matching
+ *   every other `.tf` file the plugin vends, and the bootstrap one pins the AWS
+ *   provider.
+ *
+ * How to write a migration:
+ * - https://nx.dev/docs/kb/migration-generators
+ * - What `nextSteps` means: https://nx.dev/docs/reference/devkit/MigrationReturnObject
+ */ const hcl = (pattern)=>`language hcl\n${pattern}`;
+/** The scan command, as the pre-fix generator vended it on `test`. */ const CHECKOV_COMMAND_PATTERN = /uvx --from checkov==/;
+const divergedTargetsStep = (projectName)=>`${projectName}: no 'test' target carrying the checkov scan was found, so no 'checkov' target was added - add one running checkov over the project so 'nx run-many --target checkov' includes this project.`;
+const divergedProvidersStep = (filePath)=>`${filePath}: has diverged from the generated shape - left untouched. Add \`required_version = ">= 1.0"\` to its \`terraform\` block to pin the minimum Terraform version.`;
+const divergedBootstrapDestroyStep = (projectName)=>`${projectName}: its 'bootstrap-destroy' target no longer matches the shape the generator produced - left untouched. Pass \`-var=aws_region=<region>\` to \`terraform destroy\`, otherwise it blocks on an input prompt when run without a TTY.`;
+/**
+ * Add `required_version` to a `providers.tf` that omits it.
+ *
+ * The bootstrap copy has no `terraform` block at all, so it is created;
+ * the src copy has one holding `required_providers`, so it is added to.
+ */ const migrateRequiredVersion = async (tree, filePath, nextSteps)=>{
+    if (!tree.exists(filePath)) return;
+    // Already declared - nothing to do, whatever constraint the user chose.
+    if (await matchGritQL(tree, filePath, hcl('`required_version = $_`'))) {
+        return;
+    }
+    const hasRequiredProviders = await matchGritQL(tree, filePath, hcl('`terraform { $body }` where { $body <: contains `required_providers` }'));
+    if (hasRequiredProviders) {
+        await applyGritQL(tree, filePath, hcl('`terraform { $body }` => `terraform {\n  required_version = ">= 1.0"\n\n  $body\n}`'));
+        return;
+    }
+    // No `terraform` block: prepend one ahead of the aws provider block.
+    const providerBlock = hcl('`provider "aws" { $body }`');
+    if (!await matchGritQL(tree, filePath, providerBlock)) {
+        nextSteps.push(divergedProvidersStep(filePath));
+        return;
+    }
+    await applyGritQL(tree, filePath, hcl('`provider "aws" { $body }` => `terraform {\n  required_version = ">= 1.0"\n}\n\nprovider "aws" {\n  $body\n}`'));
+};
+export default async function migration(tree) {
+    const nextSteps = [];
+    for (const [projectName, project] of getProjects(tree)){
+        const generator = project.metadata?.generator;
+        if (generator !== TERRAFORM_PROJECT_GENERATOR_INFO.id) continue;
+        const targets = project.targets ?? {};
+        let changed = false;
+        // Add `checkov`, copying the scan from the `test` target the pre-fix
+        // generator put it on. `test` itself belongs to the user and is left as it
+        // is. Guarded on `checkov` being absent so a re-run is a no-op.
+        if (!targets.checkov) {
+            const command = targets.test?.options?.command;
+            if (typeof command !== 'string' || !CHECKOV_COMMAND_PATTERN.test(command)) {
+                nextSteps.push(divergedTargetsStep(projectName));
+            } else {
+                // The config file is vended below, so wire it in at the same time.
+                const withConfigFile = command.includes('--config-file') ? command : command.replace('checkov --directory', 'checkov --config-file ../checkov.yml --directory');
+                targets.checkov = normalizeTargetKeyOrder({
+                    ...targets.test,
+                    options: {
+                        ...targets.test.options,
+                        command: withConfigFile
+                    }
+                });
+                changed = true;
+            }
+        }
+        // Point `bootstrap-destroy` at the vended script, which resolves the
+        // region rather than leaving terraform to prompt for it.
+        const bootstrapDestroy = targets['bootstrap-destroy'];
+        if (bootstrapDestroy) {
+            const scriptCommand = `tsx {projectRoot}/scripts/bootstrap-destroy.ts {projectRoot}`;
+            const alreadyMigrated = bootstrapDestroy.options?.commands?.[0] === scriptCommand;
+            if (!alreadyMigrated) {
+                const command = bootstrapDestroy.options?.command;
+                // Only rewrite the exact shape the generator produced.
+                const isVendedShape = typeof command === 'string' && /^terraform destroy -state=\S+bootstrap\.tfstate$/.test(command.trim());
+                if (!isVendedShape) {
+                    nextSteps.push(divergedBootstrapDestroyStep(projectName));
+                } else {
+                    targets['bootstrap-destroy'] = normalizeTargetKeyOrder({
+                        executor: bootstrapDestroy.executor,
+                        options: {
+                            forwardAllArgs: true,
+                            commands: [
+                                scriptCommand
+                            ],
+                            cwd: '{workspaceRoot}'
+                        }
+                    });
+                    changed = true;
+                }
+            }
+        }
+        if (changed) {
+            updateProjectConfiguration(tree, projectName, {
+                ...project,
+                targets: sortObjectKeys(targets)
+            });
+        }
+        // Vend the checkov config and the bootstrap-destroy script. KeepExisting
+        // leaves a user's own copy alone and makes a re-run a no-op.
+        generateFiles(tree, joinPathFragments(import.meta.dirname, '../../../terraform/project/files/checkov'), project.root, {}, {
+            overwriteStrategy: OverwriteStrategy.KeepExisting
+        });
+        // Only application projects have a bootstrap dir to destroy. The scripts
+        // dir is shared with the generator's templates, so `stateKeyPrefix` is
+        // resolved the same way it computes it; KeepExisting leaves the scripts
+        // that already exist untouched regardless.
+        if (tree.exists(joinPathFragments(project.root, 'bootstrap'))) {
+            generateFiles(tree, joinPathFragments(import.meta.dirname, '../../../terraform/project/files/application/scripts'), joinPathFragments(project.root, 'scripts'), {
+                stateKeyPrefix: kebabCase(projectName)
+            }, {
+                overwriteStrategy: OverwriteStrategy.KeepExisting
+            });
+        }
+        await migrateRequiredVersion(tree, joinPathFragments(project.root, 'src/providers.tf'), nextSteps);
+        await migrateRequiredVersion(tree, joinPathFragments(project.root, 'bootstrap/providers.tf'), nextSteps);
+    }
+    await formatFilesInSubtree(tree);
+    return {
+        nextSteps
+    };
+}
+
+//# sourceMappingURL=migration.js.map

package/src/migrations/v1.0.0-rc.85/0001-terraform-project-checkov-target-and-bootstrap-destroy/migration.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../../../../../../../packages/nx-plugin/src/migrations/v1.0.0-rc.85/0001-terraform-project-checkov-target-and-bootstrap-destroy/migration.ts"],"sourcesContent":["/**\n * Copyright Amazon.com, Inc. or its affiliates. All Rights Reserved.\n * SPDX-License-Identifier: Apache-2.0\n */\nimport {\n  generateFiles,\n  getProjects,\n  joinPathFragments,\n  type MigrationReturnObject,\n  OverwriteStrategy,\n  type Tree,\n  updateProjectConfiguration,\n} from '@nx/devkit';\nimport { TERRAFORM_PROJECT_GENERATOR_INFO } from '../../../terraform/project/generator.js';\nimport { applyGritQL, matchGritQL } from '../../../utils/ast.js';\nimport { formatFilesInSubtree } from '../../../utils/format.js';\nimport { kebabCase } from '../../../utils/names.js';\nimport { normalizeTargetKeyOrder } from '../../../utils/nx.js';\nimport { sortObjectKeys } from '../../../utils/object.js';\n\n/**\n * Terraform projects gained three fixes:\n *\n * - A `checkov` target carries the security scan, matching the name CDK\n *   infrastructure projects already use, so `nx run-many --target checkov` no\n *   longer skips Terraform projects. An existing `test` target is the user's,\n *   so it is left exactly as it is.\n * - A `checkov.yml` gives Terraform users the same central place to configure\n *   skips that the CDK app has, wired in via `--config-file`.\n * - `bootstrap-destroy` runs a script that resolves the region from the AWS SDK\n *   credential chain and passes it as `-var=aws_region`. The vended\n *   `aws_region` variable has no default, so the previous bare\n *   `terraform destroy` blocked forever on an input prompt in any non-TTY\n *   context.\n * - Both vended `providers.tf` declare `required_version = \">= 1.0\"`, matching\n *   every other `.tf` file the plugin vends, and the bootstrap one pins the AWS\n *   provider.\n *\n * How to write a migration:\n * - https://nx.dev/docs/kb/migration-generators\n * - What `nextSteps` means: https://nx.dev/docs/reference/devkit/MigrationReturnObject\n */\n\nconst hcl = (pattern: string) => `language hcl\\n${pattern}`;\n\n/** The scan command, as the pre-fix generator vended it on `test`. */\nconst CHECKOV_COMMAND_PATTERN = /uvx --from checkov==/;\n\nconst divergedTargetsStep = (projectName: string) =>\n  `${projectName}: no 'test' target carrying the checkov scan was found, so no 'checkov' target was added - add one running checkov over the project so 'nx run-many --target checkov' includes this project.`;\n\nconst divergedProvidersStep = (filePath: string) =>\n  `${filePath}: has diverged from the generated shape - left untouched. Add \\`required_version = \">= 1.0\"\\` to its \\`terraform\\` block to pin the minimum Terraform version.`;\n\nconst divergedBootstrapDestroyStep = (projectName: string) =>\n  `${projectName}: its 'bootstrap-destroy' target no longer matches the shape the generator produced - left untouched. Pass \\`-var=aws_region=<region>\\` to \\`terraform destroy\\`, otherwise it blocks on an input prompt when run without a TTY.`;\n\n/**\n * Add `required_version` to a `providers.tf` that omits it.\n *\n * The bootstrap copy has no `terraform` block at all, so it is created;\n * the src copy has one holding `required_providers`, so it is added to.\n */\nconst migrateRequiredVersion = async (\n  tree: Tree,\n  filePath: string,\n  nextSteps: string[],\n): Promise<void> => {\n  if (!tree.exists(filePath)) return;\n\n  // Already declared - nothing to do, whatever constraint the user chose.\n  if (await matchGritQL(tree, filePath, hcl('`required_version = $_`'))) {\n    return;\n  }\n\n  const hasRequiredProviders = await matchGritQL(\n    tree,\n    filePath,\n    hcl(\n      '`terraform { $body }` where { $body <: contains `required_providers` }',\n    ),\n  );\n\n  if (hasRequiredProviders) {\n    await applyGritQL(\n      tree,\n      filePath,\n      hcl(\n        '`terraform { $body }` => `terraform {\\n  required_version = \">= 1.0\"\\n\\n  $body\\n}`',\n      ),\n    );\n    return;\n  }\n\n  // No `terraform` block: prepend one ahead of the aws provider block.\n  const providerBlock = hcl('`provider \"aws\" { $body }`');\n  if (!(await matchGritQL(tree, filePath, providerBlock))) {\n    nextSteps.push(divergedProvidersStep(filePath));\n    return;\n  }\n\n  await applyGritQL(\n    tree,\n    filePath,\n    hcl(\n      '`provider \"aws\" { $body }` => `terraform {\\n  required_version = \">= 1.0\"\\n}\\n\\nprovider \"aws\" {\\n  $body\\n}`',\n    ),\n  );\n};\n\nexport default async function migration(\n  tree: Tree,\n): Promise<MigrationReturnObject> {\n  const nextSteps: string[] = [];\n\n  for (const [projectName, project] of getProjects(tree)) {\n    const generator = (project.metadata as { generator?: string } | undefined)\n      ?.generator;\n    if (generator !== TERRAFORM_PROJECT_GENERATOR_INFO.id) continue;\n\n    const targets = project.targets ?? {};\n    let changed = false;\n\n    // Add `checkov`, copying the scan from the `test` target the pre-fix\n    // generator put it on. `test` itself belongs to the user and is left as it\n    // is. Guarded on `checkov` being absent so a re-run is a no-op.\n    if (!targets.checkov) {\n      const command = targets.test?.options?.command;\n\n      if (\n        typeof command !== 'string' ||\n        !CHECKOV_COMMAND_PATTERN.test(command)\n      ) {\n        nextSteps.push(divergedTargetsStep(projectName));\n      } else {\n        // The config file is vended below, so wire it in at the same time.\n        const withConfigFile = command.includes('--config-file')\n          ? command\n          : command.replace(\n              'checkov --directory',\n              'checkov --config-file ../checkov.yml --directory',\n            );\n\n        targets.checkov = normalizeTargetKeyOrder({\n          ...targets.test,\n          options: { ...targets.test.options, command: withConfigFile },\n        });\n        changed = true;\n      }\n    }\n\n    // Point `bootstrap-destroy` at the vended script, which resolves the\n    // region rather than leaving terraform to prompt for it.\n    const bootstrapDestroy = targets['bootstrap-destroy'];\n    if (bootstrapDestroy) {\n      const scriptCommand = `tsx {projectRoot}/scripts/bootstrap-destroy.ts {projectRoot}`;\n      const alreadyMigrated =\n        bootstrapDestroy.options?.commands?.[0] === scriptCommand;\n\n      if (!alreadyMigrated) {\n        const command = bootstrapDestroy.options?.command;\n        // Only rewrite the exact shape the generator produced.\n        const isVendedShape =\n          typeof command === 'string' &&\n          /^terraform destroy -state=\\S+bootstrap\\.tfstate$/.test(\n            command.trim(),\n          );\n\n        if (!isVendedShape) {\n          nextSteps.push(divergedBootstrapDestroyStep(projectName));\n        } else {\n          targets['bootstrap-destroy'] = normalizeTargetKeyOrder({\n            executor: bootstrapDestroy.executor,\n            options: {\n              forwardAllArgs: true,\n              commands: [scriptCommand],\n              cwd: '{workspaceRoot}',\n            },\n          });\n          changed = true;\n        }\n      }\n    }\n\n    if (changed) {\n      updateProjectConfiguration(tree, projectName, {\n        ...project,\n        targets: sortObjectKeys(targets),\n      });\n    }\n\n    // Vend the checkov config and the bootstrap-destroy script. KeepExisting\n    // leaves a user's own copy alone and makes a re-run a no-op.\n    generateFiles(\n      tree,\n      joinPathFragments(\n        import.meta.dirname,\n        '../../../terraform/project/files/checkov',\n      ),\n      project.root,\n      {},\n      { overwriteStrategy: OverwriteStrategy.KeepExisting },\n    );\n\n    // Only application projects have a bootstrap dir to destroy. The scripts\n    // dir is shared with the generator's templates, so `stateKeyPrefix` is\n    // resolved the same way it computes it; KeepExisting leaves the scripts\n    // that already exist untouched regardless.\n    if (tree.exists(joinPathFragments(project.root, 'bootstrap'))) {\n      generateFiles(\n        tree,\n        joinPathFragments(\n          import.meta.dirname,\n          '../../../terraform/project/files/application/scripts',\n        ),\n        joinPathFragments(project.root, 'scripts'),\n        { stateKeyPrefix: kebabCase(projectName) },\n        { overwriteStrategy: OverwriteStrategy.KeepExisting },\n      );\n    }\n\n    await migrateRequiredVersion(\n      tree,\n      joinPathFragments(project.root, 'src/providers.tf'),\n      nextSteps,\n    );\n    await migrateRequiredVersion(\n      tree,\n      joinPathFragments(project.root, 'bootstrap/providers.tf'),\n      nextSteps,\n    );\n  }\n\n  await formatFilesInSubtree(tree);\n\n  return { nextSteps };\n}\n"],"names":["generateFiles","getProjects","joinPathFragments","OverwriteStrategy","updateProjectConfiguration","TERRAFORM_PROJECT_GENERATOR_INFO","applyGritQL","matchGritQL","formatFilesInSubtree","kebabCase","normalizeTargetKeyOrder","sortObjectKeys","hcl","pattern","CHECKOV_COMMAND_PATTERN","divergedTargetsStep","projectName","divergedProvidersStep","filePath","divergedBootstrapDestroyStep","migrateRequiredVersion","tree","nextSteps","exists","hasRequiredProviders","providerBlock","push","migration","project","generator","metadata","id","targets","changed","checkov","command","test","options","withConfigFile","includes","replace","bootstrapDestroy","scriptCommand","alreadyMigrated","commands","isVendedShape","trim","executor","forwardAllArgs","cwd","dirname","root","overwriteStrategy","KeepExisting","stateKeyPrefix"],"mappings":"AAAA;;;CAGC,GACD,SACEA,aAAa,EACbC,WAAW,EACXC,iBAAiB,EAEjBC,iBAAiB,EAEjBC,0BAA0B,QACrB,aAAa;AACpB,SAASC,gCAAgC,QAAQ,0CAA0C;AAC3F,SAASC,WAAW,EAAEC,WAAW,QAAQ,wBAAwB;AACjE,SAASC,oBAAoB,QAAQ,2BAA2B;AAChE,SAASC,SAAS,QAAQ,0BAA0B;AACpD,SAASC,uBAAuB,QAAQ,uBAAuB;AAC/D,SAASC,cAAc,QAAQ,2BAA2B;AAE1D;;;;;;;;;;;;;;;;;;;;;CAqBC,GAED,MAAMC,MAAM,CAACC,UAAoB,CAAC,cAAc,EAAEA,SAAS;AAE3D,oEAAoE,GACpE,MAAMC,0BAA0B;AAEhC,MAAMC,sBAAsB,CAACC,cAC3B,GAAGA,YAAY,4LAA4L,CAAC;AAE9M,MAAMC,wBAAwB,CAACC,WAC7B,GAAGA,SAAS,8JAA8J,CAAC;AAE7K,MAAMC,+BAA+B,CAACH,cACpC,GAAGA,YAAY,gOAAgO,CAAC;AAElP;;;;;CAKC,GACD,MAAMI,yBAAyB,OAC7BC,MACAH,UACAI;IAEA,IAAI,CAACD,KAAKE,MAAM,CAACL,WAAW;IAE5B,wEAAwE;IACxE,IAAI,MAAMX,YAAYc,MAAMH,UAAUN,IAAI,6BAA6B;QACrE;IACF;IAEA,MAAMY,uBAAuB,MAAMjB,YACjCc,MACAH,UACAN,IACE;IAIJ,IAAIY,sBAAsB;QACxB,MAAMlB,YACJe,MACAH,UACAN,IACE;QAGJ;IACF;IAEA,qEAAqE;IACrE,MAAMa,gBAAgBb,IAAI;IAC1B,IAAI,CAAE,MAAML,YAAYc,MAAMH,UAAUO,gBAAiB;QACvDH,UAAUI,IAAI,CAACT,sBAAsBC;QACrC;IACF;IAEA,MAAMZ,YACJe,MACAH,UACAN,IACE;AAGN;AAEA,eAAe,eAAee,UAC5BN,IAAU;IAEV,MAAMC,YAAsB,EAAE;IAE9B,KAAK,MAAM,CAACN,aAAaY,QAAQ,IAAI3B,YAAYoB,MAAO;QACtD,MAAMQ,YAAaD,QAAQE,QAAQ,EAC/BD;QACJ,IAAIA,cAAcxB,iCAAiC0B,EAAE,EAAE;QAEvD,MAAMC,UAAUJ,QAAQI,OAAO,IAAI,CAAC;QACpC,IAAIC,UAAU;QAEd,qEAAqE;QACrE,2EAA2E;QAC3E,gEAAgE;QAChE,IAAI,CAACD,QAAQE,OAAO,EAAE;YACpB,MAAMC,UAAUH,QAAQI,IAAI,EAAEC,SAASF;YAEvC,IACE,OAAOA,YAAY,YACnB,CAACrB,wBAAwBsB,IAAI,CAACD,UAC9B;gBACAb,UAAUI,IAAI,CAACX,oBAAoBC;YACrC,OAAO;gBACL,mEAAmE;gBACnE,MAAMsB,iBAAiBH,QAAQI,QAAQ,CAAC,mBACpCJ,UACAA,QAAQK,OAAO,CACb,uBACA;gBAGNR,QAAQE,OAAO,GAAGxB,wBAAwB;oBACxC,GAAGsB,QAAQI,IAAI;oBACfC,SAAS;wBAAE,GAAGL,QAAQI,IAAI,CAACC,OAAO;wBAAEF,SAASG;oBAAe;gBAC9D;gBACAL,UAAU;YACZ;QACF;QAEA,qEAAqE;QACrE,yDAAyD;QACzD,MAAMQ,mBAAmBT,OAAO,CAAC,oBAAoB;QACrD,IAAIS,kBAAkB;YACpB,MAAMC,gBAAgB,CAAC,4DAA4D,CAAC;YACpF,MAAMC,kBACJF,iBAAiBJ,OAAO,EAAEO,UAAU,CAAC,EAAE,KAAKF;YAE9C,IAAI,CAACC,iBAAiB;gBACpB,MAAMR,UAAUM,iBAAiBJ,OAAO,EAAEF;gBAC1C,uDAAuD;gBACvD,MAAMU,gBACJ,OAAOV,YAAY,YACnB,mDAAmDC,IAAI,CACrDD,QAAQW,IAAI;gBAGhB,IAAI,CAACD,eAAe;oBAClBvB,UAAUI,IAAI,CAACP,6BAA6BH;gBAC9C,OAAO;oBACLgB,OAAO,CAAC,oBAAoB,GAAGtB,wBAAwB;wBACrDqC,UAAUN,iBAAiBM,QAAQ;wBACnCV,SAAS;4BACPW,gBAAgB;4BAChBJ,UAAU;gCAACF;6BAAc;4BACzBO,KAAK;wBACP;oBACF;oBACAhB,UAAU;gBACZ;YACF;QACF;QAEA,IAAIA,SAAS;YACX7B,2BAA2BiB,MAAML,aAAa;gBAC5C,GAAGY,OAAO;gBACVI,SAASrB,eAAeqB;YAC1B;QACF;QAEA,yEAAyE;QACzE,6DAA6D;QAC7DhC,cACEqB,MACAnB,kBACE,YAAYgD,OAAO,EACnB,6CAEFtB,QAAQuB,IAAI,EACZ,CAAC,GACD;YAAEC,mBAAmBjD,kBAAkBkD,YAAY;QAAC;QAGtD,yEAAyE;QACzE,uEAAuE;QACvE,wEAAwE;QACxE,2CAA2C;QAC3C,IAAIhC,KAAKE,MAAM,CAACrB,kBAAkB0B,QAAQuB,IAAI,EAAE,eAAe;YAC7DnD,cACEqB,MACAnB,kBACE,YAAYgD,OAAO,EACnB,yDAEFhD,kBAAkB0B,QAAQuB,IAAI,EAAE,YAChC;gBAAEG,gBAAgB7C,UAAUO;YAAa,GACzC;gBAAEoC,mBAAmBjD,kBAAkBkD,YAAY;YAAC;QAExD;QAEA,MAAMjC,uBACJC,MACAnB,kBAAkB0B,QAAQuB,IAAI,EAAE,qBAChC7B;QAEF,MAAMF,uBACJC,MACAnB,kBAAkB0B,QAAQuB,IAAI,EAAE,2BAChC7B;IAEJ;IAEA,MAAMd,qBAAqBa;IAE3B,OAAO;QAAEC;IAAU;AACrB"}

package/src/migrations/v1.0.0-rc.87/0001-add-destroy-sandbox-target/metadata.json

@@ -0,0 +1,3 @@
+{
+  "description": "Add a destroy-sandbox target to CDK infrastructure projects which destroys the sandbox stage, and drop the --require-approval flag from cdk destroy, which has no such option"
+}

package/src/migrations/v1.0.0-rc.87/0001-add-destroy-sandbox-target/migration.d.ts

@@ -0,0 +1,6 @@
+/**
+ * Copyright Amazon.com, Inc. or its affiliates. All Rights Reserved.
+ * SPDX-License-Identifier: Apache-2.0
+ */
+import { type MigrationReturnObject, type Tree } from '@nx/devkit';
+export default function migration(tree: Tree): Promise<MigrationReturnObject>;

package/src/migrations/v1.0.0-rc.87/0001-add-destroy-sandbox-target/migration.js

@@ -0,0 +1,150 @@
+/**
+ * Copyright Amazon.com, Inc. or its affiliates. All Rights Reserved.
+ * SPDX-License-Identifier: Apache-2.0
+ */ import { getProjects, joinPathFragments, updateProjectConfiguration } from "@nx/devkit";
+import { readFileSync } from "fs";
+import { join } from "path";
+import { INFRA_APP_GENERATOR_INFO } from "../../../infra/app/generator.js";
+import { captureGritQLVariable } from "../../../utils/ast.js";
+import { formatFilesInSubtree } from "../../../utils/format.js";
+import { normalizeTargetKeyOrder } from "../../../utils/nx.js";
+import { sortObjectKeys } from "../../../utils/object.js";
+import { PACKAGES_DIR, SHARED_SCRIPTS_DIR } from "../../../utils/shared-constructs-constants.js";
+/**
+ * CDK infrastructure projects gained a `destroy-sandbox` target, mirroring
+ * `deploy-sandbox`: it tears down the sandbox stage without the user having to
+ * spell out its stage pattern (`nx destroy-sandbox infra` rather than
+ * `nx destroy infra "my-app-infra-sandbox/*"`).
+ *
+ * The stage id is read from `main.ts` rather than recomputed from the project
+ * name, so a project whose sandbox stage has been renamed gets a target that
+ * destroys the stage it actually declares.
+ *
+ * The destroy targets also drop `--require-approval=never`. `cdk destroy` has no
+ * such option, so it only warns that the flag is being ignored. The same fix
+ * lands in the vended `buildCdkCommand`, which builds the command for
+ * `stageConfig` workspaces.
+ *
+ * How to write a migration:
+ * - https://nx.dev/docs/kb/migration-generators
+ * - What `nextSteps` means: https://nx.dev/docs/reference/devkit/MigrationReturnObject
+ */ const TARGET = 'destroy-sandbox';
+/** The destroy targets the ignored flag is stripped from. */ const DESTROY_TARGETS = [
+    'destroy',
+    'destroy-ci'
+];
+/** `cdk destroy` has no such option, so it only warns and carries on. */ const IGNORED_APPROVAL_FLAG = /\s*--require-approval(=\S*)?/;
+/**
+ * Matches `new ApplicationStage(app, '<id>-sandbox', { ... })`, binding the
+ * quoted stage id. The regex spans the quotes because it is matched against the
+ * whole string literal node; both quote styles are accepted since the user's
+ * formatter may have rewritten them.
+ *
+ * `main.ts` can declare several stages (beta, prod), so the pattern selects the
+ * sandbox one rather than whichever comes first.
+ */ const SANDBOX_STAGE_PATTERN = '`new ApplicationStage($app, $id, $props)` where { $id <: r"[\'\\"].*-sandbox[\'\\"]" }';
+/** The id of the sandbox stage a project's `main.ts` instantiates. */ const sandboxStageId = async (tree, projectRoot)=>{
+    const captured = await captureGritQLVariable(tree, joinPathFragments(projectRoot, 'src', 'main.ts'), SANDBOX_STAGE_PATTERN, 'id');
+    // The binding keeps the quotes from the source.
+    return captured?.slice(1, -1);
+};
+/**
+ * Strip the ignored `--require-approval` from a `cdk destroy` command. Returns
+ * undefined when the command isn't the shape the generator produced, or the flag
+ * is already gone.
+ */ const withoutApprovalFlag = (command)=>{
+    if (typeof command !== 'string' || !command.includes('cdk destroy')) {
+        return undefined;
+    }
+    if (!IGNORED_APPROVAL_FLAG.test(command)) return undefined;
+    return command.replace(IGNORED_APPROVAL_FLAG, '');
+};
+/** Drops the ignored approval flag from the project's destroy targets. */ const migrateDestroyFlags = (project)=>{
+    let changed = false;
+    for (const name of DESTROY_TARGETS){
+        const target = project.targets?.[name];
+        const command = withoutApprovalFlag(target?.options?.command);
+        if (command) {
+            target.options = {
+                ...target.options,
+                command
+            };
+            changed = true;
+        }
+    }
+    return changed;
+};
+/** Path the shared scripts package vends the CDK command builder at. */ const CDK_COMMAND_PATH = joinPathFragments(PACKAGES_DIR, SHARED_SCRIPTS_DIR, 'src/infra/stage-credentials/cdk-command.ts');
+/** The builder as it stands today. The template carries no EJS variables. */ const CDK_COMMAND_TEMPLATE = readFileSync(join(import.meta.dirname, '../../../utils/files/common/scripts/src/infra/stage-credentials/cdk-command.ts.template'), 'utf-8');
+/**
+ * Re-vends the CDK command builder, which no longer adds `--require-approval`
+ * for the `destroy` action. Only the shape the generator produced is replaced: a
+ * customised copy is the user's, so it is reported instead.
+ */ const migrateCdkCommandBuilder = (tree, nextSteps)=>{
+    if (!tree.exists(CDK_COMMAND_PATH)) return;
+    const current = tree.read(CDK_COMMAND_PATH).toString();
+    // Already migrated, so a re-run is a no-op.
+    if (current.includes("action === 'destroy'")) return;
+    if (!current.includes('hasRequireApproval')) {
+        nextSteps.push(`${CDK_COMMAND_PATH}: has diverged from the generated shape — left untouched. Have it skip \`--require-approval\` for the \`destroy\` action, which has no such option.`);
+        return;
+    }
+    tree.write(CDK_COMMAND_PATH, CDK_COMMAND_TEMPLATE);
+};
+/** Adds the `destroy-sandbox` target, mirroring the project's `destroy`. */ const addSandboxTarget = async (tree, projectName, project, nextSteps)=>{
+    // The new target mirrors `destroy`, so it inherits whatever that resolved to
+    // when the project was generated: the `tsx` credential-resolving script
+    // under `stageConfig`, plain `cdk destroy` otherwise.
+    const destroy = project.targets.destroy;
+    const command = destroy?.options?.command;
+    const mainPath = joinPathFragments(project.root, 'src/main.ts');
+    const stageId = await sandboxStageId(tree, project.root);
+    if (typeof command !== 'string') {
+        nextSteps.push(`Add a '${TARGET}' target to ${projectName} by hand if necessary — its 'destroy' target no longer matches the shape the generator produced.`);
+        return false;
+    }
+    if (!stageId) {
+        nextSteps.push(`Add a '${TARGET}' target to ${projectName} by hand if necessary — no sandbox stage was found in ${mainPath}.`);
+        return false;
+    }
+    project.targets[TARGET] = normalizeTargetKeyOrder({
+        executor: destroy.executor,
+        ...destroy.dependsOn ? {
+            dependsOn: [
+                ...destroy.dependsOn
+            ]
+        } : {},
+        // Quoted so the shell does not glob the `*`.
+        options: {
+            ...destroy.options,
+            command: `${command} "${stageId}/*"`
+        }
+    });
+    return true;
+};
+export default async function migration(tree) {
+    const nextSteps = [];
+    for (const [projectName, project] of getProjects(tree)){
+        const generator = project.metadata?.generator;
+        // Not a CDK infrastructure project.
+        if (generator !== INFRA_APP_GENERATOR_INFO.id) continue;
+        // Corrected first so the new target inherits the fixed command.
+        let changed = migrateDestroyFlags(project);
+        if (!project.targets?.[TARGET]) {
+            changed = await addSandboxTarget(tree, projectName, project, nextSteps) || changed;
+        }
+        if (changed) {
+            updateProjectConfiguration(tree, projectName, {
+                ...project,
+                targets: sortObjectKeys(project.targets)
+            });
+        }
+    }
+    migrateCdkCommandBuilder(tree, nextSteps);
+    await formatFilesInSubtree(tree);
+    return {
+        nextSteps
+    };
+}
+
+//# sourceMappingURL=migration.js.map

package/src/migrations/v1.0.0-rc.87/0001-add-destroy-sandbox-target/migration.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../../../../../../../packages/nx-plugin/src/migrations/v1.0.0-rc.87/0001-add-destroy-sandbox-target/migration.ts"],"sourcesContent":["/**\n * Copyright Amazon.com, Inc. or its affiliates. All Rights Reserved.\n * SPDX-License-Identifier: Apache-2.0\n */\nimport {\n  getProjects,\n  joinPathFragments,\n  type MigrationReturnObject,\n  type ProjectConfiguration,\n  type Tree,\n  updateProjectConfiguration,\n} from '@nx/devkit';\nimport { readFileSync } from 'fs';\nimport { join } from 'path';\nimport { INFRA_APP_GENERATOR_INFO } from '../../../infra/app/generator.js';\nimport { captureGritQLVariable } from '../../../utils/ast.js';\nimport { formatFilesInSubtree } from '../../../utils/format.js';\nimport { normalizeTargetKeyOrder } from '../../../utils/nx.js';\nimport { sortObjectKeys } from '../../../utils/object.js';\nimport {\n  PACKAGES_DIR,\n  SHARED_SCRIPTS_DIR,\n} from '../../../utils/shared-constructs-constants.js';\n\n/**\n * CDK infrastructure projects gained a `destroy-sandbox` target, mirroring\n * `deploy-sandbox`: it tears down the sandbox stage without the user having to\n * spell out its stage pattern (`nx destroy-sandbox infra` rather than\n * `nx destroy infra \"my-app-infra-sandbox/*\"`).\n *\n * The stage id is read from `main.ts` rather than recomputed from the project\n * name, so a project whose sandbox stage has been renamed gets a target that\n * destroys the stage it actually declares.\n *\n * The destroy targets also drop `--require-approval=never`. `cdk destroy` has no\n * such option, so it only warns that the flag is being ignored. The same fix\n * lands in the vended `buildCdkCommand`, which builds the command for\n * `stageConfig` workspaces.\n *\n * How to write a migration:\n * - https://nx.dev/docs/kb/migration-generators\n * - What `nextSteps` means: https://nx.dev/docs/reference/devkit/MigrationReturnObject\n */\n\nconst TARGET = 'destroy-sandbox';\n\n/** The destroy targets the ignored flag is stripped from. */\nconst DESTROY_TARGETS = ['destroy', 'destroy-ci'] as const;\n\n/** `cdk destroy` has no such option, so it only warns and carries on. */\nconst IGNORED_APPROVAL_FLAG = /\\s*--require-approval(=\\S*)?/;\n\n/**\n * Matches `new ApplicationStage(app, '<id>-sandbox', { ... })`, binding the\n * quoted stage id. The regex spans the quotes because it is matched against the\n * whole string literal node; both quote styles are accepted since the user's\n * formatter may have rewritten them.\n *\n * `main.ts` can declare several stages (beta, prod), so the pattern selects the\n * sandbox one rather than whichever comes first.\n */\nconst SANDBOX_STAGE_PATTERN =\n  '`new ApplicationStage($app, $id, $props)` where { $id <: r\"[\\'\\\\\"].*-sandbox[\\'\\\\\"]\" }';\n\n/** The id of the sandbox stage a project's `main.ts` instantiates. */\nconst sandboxStageId = async (\n  tree: Tree,\n  projectRoot: string,\n): Promise<string | undefined> => {\n  const captured = await captureGritQLVariable(\n    tree,\n    joinPathFragments(projectRoot, 'src', 'main.ts'),\n    SANDBOX_STAGE_PATTERN,\n    'id',\n  );\n  // The binding keeps the quotes from the source.\n  return captured?.slice(1, -1);\n};\n\n/**\n * Strip the ignored `--require-approval` from a `cdk destroy` command. Returns\n * undefined when the command isn't the shape the generator produced, or the flag\n * is already gone.\n */\nconst withoutApprovalFlag = (command: unknown): string | undefined => {\n  if (typeof command !== 'string' || !command.includes('cdk destroy')) {\n    return undefined;\n  }\n  if (!IGNORED_APPROVAL_FLAG.test(command)) return undefined;\n  return command.replace(IGNORED_APPROVAL_FLAG, '');\n};\n\n/** Drops the ignored approval flag from the project's destroy targets. */\nconst migrateDestroyFlags = (project: ProjectConfiguration): boolean => {\n  let changed = false;\n  for (const name of DESTROY_TARGETS) {\n    const target = project.targets?.[name];\n    const command = withoutApprovalFlag(target?.options?.command);\n    if (command) {\n      target.options = { ...target.options, command };\n      changed = true;\n    }\n  }\n  return changed;\n};\n\n/** Path the shared scripts package vends the CDK command builder at. */\nconst CDK_COMMAND_PATH = joinPathFragments(\n  PACKAGES_DIR,\n  SHARED_SCRIPTS_DIR,\n  'src/infra/stage-credentials/cdk-command.ts',\n);\n\n/** The builder as it stands today. The template carries no EJS variables. */\nconst CDK_COMMAND_TEMPLATE = readFileSync(\n  join(\n    import.meta.dirname,\n    '../../../utils/files/common/scripts/src/infra/stage-credentials/cdk-command.ts.template',\n  ),\n  'utf-8',\n);\n\n/**\n * Re-vends the CDK command builder, which no longer adds `--require-approval`\n * for the `destroy` action. Only the shape the generator produced is replaced: a\n * customised copy is the user's, so it is reported instead.\n */\nconst migrateCdkCommandBuilder = (tree: Tree, nextSteps: string[]): void => {\n  if (!tree.exists(CDK_COMMAND_PATH)) return;\n\n  const current = tree.read(CDK_COMMAND_PATH)!.toString();\n  // Already migrated, so a re-run is a no-op.\n  if (current.includes(\"action === 'destroy'\")) return;\n\n  if (!current.includes('hasRequireApproval')) {\n    nextSteps.push(\n      `${CDK_COMMAND_PATH}: has diverged from the generated shape — left untouched. Have it skip \\`--require-approval\\` for the \\`destroy\\` action, which has no such option.`,\n    );\n    return;\n  }\n\n  tree.write(CDK_COMMAND_PATH, CDK_COMMAND_TEMPLATE);\n};\n\n/** Adds the `destroy-sandbox` target, mirroring the project's `destroy`. */\nconst addSandboxTarget = async (\n  tree: Tree,\n  projectName: string,\n  project: ProjectConfiguration,\n  nextSteps: string[],\n): Promise<boolean> => {\n  // The new target mirrors `destroy`, so it inherits whatever that resolved to\n  // when the project was generated: the `tsx` credential-resolving script\n  // under `stageConfig`, plain `cdk destroy` otherwise.\n  const destroy = project.targets.destroy;\n  const command = destroy?.options?.command;\n  const mainPath = joinPathFragments(project.root, 'src/main.ts');\n  const stageId = await sandboxStageId(tree, project.root);\n\n  if (typeof command !== 'string') {\n    nextSteps.push(\n      `Add a '${TARGET}' target to ${projectName} by hand if necessary — its 'destroy' target no longer matches the shape the generator produced.`,\n    );\n    return false;\n  }\n  if (!stageId) {\n    nextSteps.push(\n      `Add a '${TARGET}' target to ${projectName} by hand if necessary — no sandbox stage was found in ${mainPath}.`,\n    );\n    return false;\n  }\n\n  project.targets[TARGET] = normalizeTargetKeyOrder({\n    executor: destroy.executor,\n    ...(destroy.dependsOn ? { dependsOn: [...destroy.dependsOn] } : {}),\n    // Quoted so the shell does not glob the `*`.\n    options: { ...destroy.options, command: `${command} \"${stageId}/*\"` },\n  });\n  return true;\n};\n\nexport default async function migration(\n  tree: Tree,\n): Promise<MigrationReturnObject> {\n  const nextSteps: string[] = [];\n\n  for (const [projectName, project] of getProjects(tree)) {\n    const generator = (project.metadata as { generator?: string } | undefined)\n      ?.generator;\n    // Not a CDK infrastructure project.\n    if (generator !== INFRA_APP_GENERATOR_INFO.id) continue;\n\n    // Corrected first so the new target inherits the fixed command.\n    let changed = migrateDestroyFlags(project);\n\n    if (!project.targets?.[TARGET]) {\n      changed =\n        (await addSandboxTarget(tree, projectName, project, nextSteps)) ||\n        changed;\n    }\n\n    if (changed) {\n      updateProjectConfiguration(tree, projectName, {\n        ...project,\n        targets: sortObjectKeys(project.targets),\n      });\n    }\n  }\n\n  migrateCdkCommandBuilder(tree, nextSteps);\n\n  await formatFilesInSubtree(tree);\n\n  return { nextSteps };\n}\n"],"names":["getProjects","joinPathFragments","updateProjectConfiguration","readFileSync","join","INFRA_APP_GENERATOR_INFO","captureGritQLVariable","formatFilesInSubtree","normalizeTargetKeyOrder","sortObjectKeys","PACKAGES_DIR","SHARED_SCRIPTS_DIR","TARGET","DESTROY_TARGETS","IGNORED_APPROVAL_FLAG","SANDBOX_STAGE_PATTERN","sandboxStageId","tree","projectRoot","captured","slice","withoutApprovalFlag","command","includes","undefined","test","replace","migrateDestroyFlags","project","changed","name","target","targets","options","CDK_COMMAND_PATH","CDK_COMMAND_TEMPLATE","dirname","migrateCdkCommandBuilder","nextSteps","exists","current","read","toString","push","write","addSandboxTarget","projectName","destroy","mainPath","root","stageId","executor","dependsOn","migration","generator","metadata","id"],"mappings":"AAAA;;;CAGC,GACD,SACEA,WAAW,EACXC,iBAAiB,EAIjBC,0BAA0B,QACrB,aAAa;AACpB,SAASC,YAAY,QAAQ,KAAK;AAClC,SAASC,IAAI,QAAQ,OAAO;AAC5B,SAASC,wBAAwB,QAAQ,kCAAkC;AAC3E,SAASC,qBAAqB,QAAQ,wBAAwB;AAC9D,SAASC,oBAAoB,QAAQ,2BAA2B;AAChE,SAASC,uBAAuB,QAAQ,uBAAuB;AAC/D,SAASC,cAAc,QAAQ,2BAA2B;AAC1D,SACEC,YAAY,EACZC,kBAAkB,QACb,gDAAgD;AAEvD;;;;;;;;;;;;;;;;;;CAkBC,GAED,MAAMC,SAAS;AAEf,2DAA2D,GAC3D,MAAMC,kBAAkB;IAAC;IAAW;CAAa;AAEjD,uEAAuE,GACvE,MAAMC,wBAAwB;AAE9B;;;;;;;;CAQC,GACD,MAAMC,wBACJ;AAEF,oEAAoE,GACpE,MAAMC,iBAAiB,OACrBC,MACAC;IAEA,MAAMC,WAAW,MAAMb,sBACrBW,MACAhB,kBAAkBiB,aAAa,OAAO,YACtCH,uBACA;IAEF,gDAAgD;IAChD,OAAOI,UAAUC,MAAM,GAAG,CAAC;AAC7B;AAEA;;;;CAIC,GACD,MAAMC,sBAAsB,CAACC;IAC3B,IAAI,OAAOA,YAAY,YAAY,CAACA,QAAQC,QAAQ,CAAC,gBAAgB;QACnE,OAAOC;IACT;IACA,IAAI,CAACV,sBAAsBW,IAAI,CAACH,UAAU,OAAOE;IACjD,OAAOF,QAAQI,OAAO,CAACZ,uBAAuB;AAChD;AAEA,wEAAwE,GACxE,MAAMa,sBAAsB,CAACC;IAC3B,IAAIC,UAAU;IACd,KAAK,MAAMC,QAAQjB,gBAAiB;QAClC,MAAMkB,SAASH,QAAQI,OAAO,EAAE,CAACF,KAAK;QACtC,MAAMR,UAAUD,oBAAoBU,QAAQE,SAASX;QACrD,IAAIA,SAAS;YACXS,OAAOE,OAAO,GAAG;gBAAE,GAAGF,OAAOE,OAAO;gBAAEX;YAAQ;YAC9CO,UAAU;QACZ;IACF;IACA,OAAOA;AACT;AAEA,sEAAsE,GACtE,MAAMK,mBAAmBjC,kBACvBS,cACAC,oBACA;AAGF,2EAA2E,GAC3E,MAAMwB,uBAAuBhC,aAC3BC,KACE,YAAYgC,OAAO,EACnB,4FAEF;AAGF;;;;CAIC,GACD,MAAMC,2BAA2B,CAACpB,MAAYqB;IAC5C,IAAI,CAACrB,KAAKsB,MAAM,CAACL,mBAAmB;IAEpC,MAAMM,UAAUvB,KAAKwB,IAAI,CAACP,kBAAmBQ,QAAQ;IACrD,4CAA4C;IAC5C,IAAIF,QAAQjB,QAAQ,CAAC,yBAAyB;IAE9C,IAAI,CAACiB,QAAQjB,QAAQ,CAAC,uBAAuB;QAC3Ce,UAAUK,IAAI,CACZ,GAAGT,iBAAiB,mJAAmJ,CAAC;QAE1K;IACF;IAEAjB,KAAK2B,KAAK,CAACV,kBAAkBC;AAC/B;AAEA,0EAA0E,GAC1E,MAAMU,mBAAmB,OACvB5B,MACA6B,aACAlB,SACAU;IAEA,6EAA6E;IAC7E,wEAAwE;IACxE,sDAAsD;IACtD,MAAMS,UAAUnB,QAAQI,OAAO,CAACe,OAAO;IACvC,MAAMzB,UAAUyB,SAASd,SAASX;IAClC,MAAM0B,WAAW/C,kBAAkB2B,QAAQqB,IAAI,EAAE;IACjD,MAAMC,UAAU,MAAMlC,eAAeC,MAAMW,QAAQqB,IAAI;IAEvD,IAAI,OAAO3B,YAAY,UAAU;QAC/BgB,UAAUK,IAAI,CACZ,CAAC,OAAO,EAAE/B,OAAO,YAAY,EAAEkC,YAAY,gGAAgG,CAAC;QAE9I,OAAO;IACT;IACA,IAAI,CAACI,SAAS;QACZZ,UAAUK,IAAI,CACZ,CAAC,OAAO,EAAE/B,OAAO,YAAY,EAAEkC,YAAY,sDAAsD,EAAEE,SAAS,CAAC,CAAC;QAEhH,OAAO;IACT;IAEApB,QAAQI,OAAO,CAACpB,OAAO,GAAGJ,wBAAwB;QAChD2C,UAAUJ,QAAQI,QAAQ;QAC1B,GAAIJ,QAAQK,SAAS,GAAG;YAAEA,WAAW;mBAAIL,QAAQK,SAAS;aAAC;QAAC,IAAI,CAAC,CAAC;QAClE,6CAA6C;QAC7CnB,SAAS;YAAE,GAAGc,QAAQd,OAAO;YAAEX,SAAS,GAAGA,QAAQ,EAAE,EAAE4B,QAAQ,GAAG,CAAC;QAAC;IACtE;IACA,OAAO;AACT;AAEA,eAAe,eAAeG,UAC5BpC,IAAU;IAEV,MAAMqB,YAAsB,EAAE;IAE9B,KAAK,MAAM,CAACQ,aAAalB,QAAQ,IAAI5B,YAAYiB,MAAO;QACtD,MAAMqC,YAAa1B,QAAQ2B,QAAQ,EAC/BD;QACJ,oCAAoC;QACpC,IAAIA,cAAcjD,yBAAyBmD,EAAE,EAAE;QAE/C,gEAAgE;QAChE,IAAI3B,UAAUF,oBAAoBC;QAElC,IAAI,CAACA,QAAQI,OAAO,EAAE,CAACpB,OAAO,EAAE;YAC9BiB,UACE,AAAC,MAAMgB,iBAAiB5B,MAAM6B,aAAalB,SAASU,cACpDT;QACJ;QAEA,IAAIA,SAAS;YACX3B,2BAA2Be,MAAM6B,aAAa;gBAC5C,GAAGlB,OAAO;gBACVI,SAASvB,eAAemB,QAAQI,OAAO;YACzC;QACF;IACF;IAEAK,yBAAyBpB,MAAMqB;IAE/B,MAAM/B,qBAAqBU;IAE3B,OAAO;QAAEqB;IAAU;AACrB"}

package/src/migrations/v1.0.0-rc.87/0002-terraform-rdb-proxy-iam-connect-grant/__snapshots__/migration.spec.ts.snap

@@ -0,0 +1,23 @@
+// Vitest Snapshot v1, https://vitest.dev/guide/snapshot.html
+
+exports[`terraform-rdb-proxy-iam-connect-grant migration > should replace the mysql admin secret grant with rds-db:connect 1`] = `
+"resource "aws_iam_role_policy" "proxy_db_user_connect" {
+  count = var.enable_rds_proxy ? 1 : 0
+
+  role = module.aurora.proxy_role_name
+
+  policy = jsonencode({
+    Version = "2012-10-17"
+    Statement = [
+      {
+        Effect = "Allow"
+        Action = ["rds-db:connect"]
+        Resource = [
+          "arn:aws:rds-db:\${data.aws_region.current.region}:\${data.aws_caller_identity.current.account_id}:dbuser:\${module.aurora.cluster_resource_id}/\${local.database_runtime_user}"
+        ]
+      }
+    ]
+  })
+}
+"
+`;

package/src/migrations/v1.0.0-rc.87/0002-terraform-rdb-proxy-iam-connect-grant/metadata.json

@@ -0,0 +1,3 @@
+{
+  "description": "Replace the MySQL RDS Proxy role's admin secret access with the rds-db:connect grant it needs for end-to-end IAM auth"
+}

package/src/migrations/v1.0.0-rc.87/0002-terraform-rdb-proxy-iam-connect-grant/migration.d.ts

@@ -0,0 +1,6 @@
+/**
+ * Copyright Amazon.com, Inc. or its affiliates. All Rights Reserved.
+ * SPDX-License-Identifier: Apache-2.0
+ */
+import { type MigrationReturnObject, type Tree } from '@nx/devkit';
+export default function migration(tree: Tree): Promise<MigrationReturnObject>;

package/src/migrations/v1.0.0-rc.87/0002-terraform-rdb-proxy-iam-connect-grant/migration.js

@@ -0,0 +1,88 @@
+/**
+ * Copyright Amazon.com, Inc. or its affiliates. All Rights Reserved.
+ * SPDX-License-Identifier: Apache-2.0
+ */ import { joinPathFragments } from "@nx/devkit";
+import { applyGritQL, matchGritQL } from "../../../utils/ast.js";
+import { formatFilesInSubtree } from "../../../utils/format.js";
+import { PACKAGES_DIR, SHARED_TERRAFORM_DIR } from "../../../utils/shared-constructs-constants.js";
+/**
+ * Give the RDS Proxy role in every vended Terraform Aurora app module the
+ * `rds-db:connect` grant for the application database user.
+ *
+ * The proxy is created with `default_auth_scheme = "IAM_AUTH"` and no secrets
+ * registered, so `rds-db:connect` on the application user is the only
+ * permission it needs to reach the cluster. MySQL modules instead granted the
+ * role `secretsmanager:GetSecretValue` on the admin credentials secret plus
+ * `kms:Decrypt` — credentials the proxy never uses, and a far wider grant than
+ * connecting as the application user.
+ *
+ * These files are generated with `KeepExisting`, so an upgraded MySQL workspace
+ * keeps the admin secret grant until this runs. Diverged files are left
+ * untouched and reported via `nextSteps`.
+ */ const TERRAFORM_DBS_DIR = `${PACKAGES_DIR}/${SHARED_TERRAFORM_DIR}/src/app/dbs`;
+const hcl = (pattern)=>`language hcl\n${pattern}`;
+const CONNECT_STATEMENT_TEXT = [
+    '{',
+    '        Effect = "Allow"',
+    '        Action = ["rds-db:connect"]',
+    '        Resource = [',
+    '          "arn:aws:rds-db:${data.aws_region.current.region}:${data.aws_caller_identity.current.account_id}:dbuser:${module.aurora.cluster_resource_id}/${local.database_runtime_user}"',
+    '        ]',
+    '      }'
+].join('\n');
+const divergedMessage = (filePath)=>`${filePath}: the aws_iam_role_policy.proxy_db_user_connect policy has diverged from the generated shape - left untouched. The RDS Proxy authenticates to the cluster with IAM, so replace any secretsmanager:GetSecretValue / kms:Decrypt statements on the proxy role with a single rds-db:connect statement for local.database_runtime_user (see the ts#rdb generator's database app template).`;
+const proxyPolicyBlock = (body)=>hcl(`\`resource "aws_iam_role_policy" "proxy_db_user_connect" { ${body} }\``);
+const migrateModule = async (tree, filePath, nextSteps)=>{
+    if (!await matchGritQL(tree, filePath, proxyPolicyBlock('$_'))) {
+        return; // No proxy policy in this module - nothing this migration owns.
+    }
+    if (await matchGritQL(tree, filePath, proxyPolicyBlock('$props') + ' where { $props <: contains `"rds-db:connect"` }')) {
+        return; // Already granted.
+    }
+    // The whole statement list is replaced, so the policy must still hold exactly
+    // the two statements the generator vended and nothing the user has added.
+    const secretStatements = hcl([
+        '`Statement = [',
+        '      {',
+        '        Effect = "Allow"',
+        '        Action = [',
+        '          "secretsmanager:GetSecretValue"',
+        '        ]',
+        '        Resource = [module.aurora.secret_arn]',
+        '      },',
+        '      {',
+        '        Effect = "Allow"',
+        '        Action = [',
+        '          "kms:Decrypt"',
+        '        ]',
+        '        Resource = [module.aurora.kms_key_arn]',
+        '      }',
+        '    ]`'
+    ].join('\n'));
+    if (!await matchGritQL(tree, filePath, secretStatements)) {
+        nextSteps.push(divergedMessage(filePath));
+        return;
+    }
+    await applyGritQL(tree, filePath, `${secretStatements} => \`Statement = [\n      ${CONNECT_STATEMENT_TEXT}\n    ]\``);
+};
+export default async function migration(tree) {
+    const nextSteps = [];
+    if (!tree.exists(TERRAFORM_DBS_DIR)) {
+        return {
+            nextSteps
+        }; // This workspace has no Terraform database modules.
+    }
+    for (const dirName of tree.children(TERRAFORM_DBS_DIR)){
+        const filePath = joinPathFragments(TERRAFORM_DBS_DIR, dirName, `${dirName}.tf`);
+        if (!tree.exists(filePath)) {
+            continue; // Not a database app module directory.
+        }
+        await migrateModule(tree, filePath, nextSteps);
+    }
+    await formatFilesInSubtree(tree);
+    return {
+        nextSteps
+    };
+}
+
+//# sourceMappingURL=migration.js.map

package/src/migrations/v1.0.0-rc.87/0002-terraform-rdb-proxy-iam-connect-grant/migration.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../../../../../../../packages/nx-plugin/src/migrations/v1.0.0-rc.87/0002-terraform-rdb-proxy-iam-connect-grant/migration.ts"],"sourcesContent":["/**\n * Copyright Amazon.com, Inc. or its affiliates. All Rights Reserved.\n * SPDX-License-Identifier: Apache-2.0\n */\nimport {\n  joinPathFragments,\n  type MigrationReturnObject,\n  type Tree,\n} from '@nx/devkit';\nimport { applyGritQL, matchGritQL } from '../../../utils/ast.js';\nimport { formatFilesInSubtree } from '../../../utils/format.js';\nimport {\n  PACKAGES_DIR,\n  SHARED_TERRAFORM_DIR,\n} from '../../../utils/shared-constructs-constants.js';\n\n/**\n * Give the RDS Proxy role in every vended Terraform Aurora app module the\n * `rds-db:connect` grant for the application database user.\n *\n * The proxy is created with `default_auth_scheme = \"IAM_AUTH\"` and no secrets\n * registered, so `rds-db:connect` on the application user is the only\n * permission it needs to reach the cluster. MySQL modules instead granted the\n * role `secretsmanager:GetSecretValue` on the admin credentials secret plus\n * `kms:Decrypt` — credentials the proxy never uses, and a far wider grant than\n * connecting as the application user.\n *\n * These files are generated with `KeepExisting`, so an upgraded MySQL workspace\n * keeps the admin secret grant until this runs. Diverged files are left\n * untouched and reported via `nextSteps`.\n */\n\nconst TERRAFORM_DBS_DIR = `${PACKAGES_DIR}/${SHARED_TERRAFORM_DIR}/src/app/dbs`;\n\nconst hcl = (pattern: string) => `language hcl\\n${pattern}`;\n\nconst CONNECT_STATEMENT_TEXT = [\n  '{',\n  '        Effect = \"Allow\"',\n  '        Action = [\"rds-db:connect\"]',\n  '        Resource = [',\n  '          \"arn:aws:rds-db:${data.aws_region.current.region}:${data.aws_caller_identity.current.account_id}:dbuser:${module.aurora.cluster_resource_id}/${local.database_runtime_user}\"',\n  '        ]',\n  '      }',\n].join('\\n');\n\nconst divergedMessage = (filePath: string) =>\n  `${filePath}: the aws_iam_role_policy.proxy_db_user_connect policy has diverged from the generated shape - left untouched. The RDS Proxy authenticates to the cluster with IAM, so replace any secretsmanager:GetSecretValue / kms:Decrypt statements on the proxy role with a single rds-db:connect statement for local.database_runtime_user (see the ts#rdb generator's database app template).`;\n\nconst proxyPolicyBlock = (body: string) =>\n  hcl(`\\`resource \"aws_iam_role_policy\" \"proxy_db_user_connect\" { ${body} }\\``);\n\nconst migrateModule = async (\n  tree: Tree,\n  filePath: string,\n  nextSteps: string[],\n): Promise<void> => {\n  if (!(await matchGritQL(tree, filePath, proxyPolicyBlock('$_')))) {\n    return; // No proxy policy in this module - nothing this migration owns.\n  }\n\n  if (\n    await matchGritQL(\n      tree,\n      filePath,\n      proxyPolicyBlock('$props') +\n        ' where { $props <: contains `\"rds-db:connect\"` }',\n    )\n  ) {\n    return; // Already granted.\n  }\n\n  // The whole statement list is replaced, so the policy must still hold exactly\n  // the two statements the generator vended and nothing the user has added.\n  const secretStatements = hcl(\n    [\n      '`Statement = [',\n      '      {',\n      '        Effect = \"Allow\"',\n      '        Action = [',\n      '          \"secretsmanager:GetSecretValue\"',\n      '        ]',\n      '        Resource = [module.aurora.secret_arn]',\n      '      },',\n      '      {',\n      '        Effect = \"Allow\"',\n      '        Action = [',\n      '          \"kms:Decrypt\"',\n      '        ]',\n      '        Resource = [module.aurora.kms_key_arn]',\n      '      }',\n      '    ]`',\n    ].join('\\n'),\n  );\n\n  if (!(await matchGritQL(tree, filePath, secretStatements))) {\n    nextSteps.push(divergedMessage(filePath));\n    return;\n  }\n\n  await applyGritQL(\n    tree,\n    filePath,\n    `${secretStatements} => \\`Statement = [\\n      ${CONNECT_STATEMENT_TEXT}\\n    ]\\``,\n  );\n};\n\nexport default async function migration(\n  tree: Tree,\n): Promise<MigrationReturnObject> {\n  const nextSteps: string[] = [];\n\n  if (!tree.exists(TERRAFORM_DBS_DIR)) {\n    return { nextSteps }; // This workspace has no Terraform database modules.\n  }\n\n  for (const dirName of tree.children(TERRAFORM_DBS_DIR)) {\n    const filePath = joinPathFragments(\n      TERRAFORM_DBS_DIR,\n      dirName,\n      `${dirName}.tf`,\n    );\n    if (!tree.exists(filePath)) {\n      continue; // Not a database app module directory.\n    }\n\n    await migrateModule(tree, filePath, nextSteps);\n  }\n\n  await formatFilesInSubtree(tree);\n\n  return { nextSteps };\n}\n"],"names":["joinPathFragments","applyGritQL","matchGritQL","formatFilesInSubtree","PACKAGES_DIR","SHARED_TERRAFORM_DIR","TERRAFORM_DBS_DIR","hcl","pattern","CONNECT_STATEMENT_TEXT","join","divergedMessage","filePath","proxyPolicyBlock","body","migrateModule","tree","nextSteps","secretStatements","push","migration","exists","dirName","children"],"mappings":"AAAA;;;CAGC,GACD,SACEA,iBAAiB,QAGZ,aAAa;AACpB,SAASC,WAAW,EAAEC,WAAW,QAAQ,wBAAwB;AACjE,SAASC,oBAAoB,QAAQ,2BAA2B;AAChE,SACEC,YAAY,EACZC,oBAAoB,QACf,gDAAgD;AAEvD;;;;;;;;;;;;;;CAcC,GAED,MAAMC,oBAAoB,GAAGF,aAAa,CAAC,EAAEC,qBAAqB,YAAY,CAAC;AAE/E,MAAME,MAAM,CAACC,UAAoB,CAAC,cAAc,EAAEA,SAAS;AAE3D,MAAMC,yBAAyB;IAC7B;IACA;IACA;IACA;IACA;IACA;IACA;CACD,CAACC,IAAI,CAAC;AAEP,MAAMC,kBAAkB,CAACC,WACvB,GAAGA,SAAS,sXAAsX,CAAC;AAErY,MAAMC,mBAAmB,CAACC,OACxBP,IAAI,CAAC,2DAA2D,EAAEO,KAAK,IAAI,CAAC;AAE9E,MAAMC,gBAAgB,OACpBC,MACAJ,UACAK;IAEA,IAAI,CAAE,MAAMf,YAAYc,MAAMJ,UAAUC,iBAAiB,QAAS;QAChE,QAAQ,gEAAgE;IAC1E;IAEA,IACE,MAAMX,YACJc,MACAJ,UACAC,iBAAiB,YACf,qDAEJ;QACA,QAAQ,mBAAmB;IAC7B;IAEA,8EAA8E;IAC9E,0EAA0E;IAC1E,MAAMK,mBAAmBX,IACvB;QACE;QACA;QACA;QACA;QACA;QACA;QACA;QACA;QACA;QACA;QACA;QACA;QACA;QACA;QACA;QACA;KACD,CAACG,IAAI,CAAC;IAGT,IAAI,CAAE,MAAMR,YAAYc,MAAMJ,UAAUM,mBAAoB;QAC1DD,UAAUE,IAAI,CAACR,gBAAgBC;QAC/B;IACF;IAEA,MAAMX,YACJe,MACAJ,UACA,GAAGM,iBAAiB,2BAA2B,EAAET,uBAAuB,SAAS,CAAC;AAEtF;AAEA,eAAe,eAAeW,UAC5BJ,IAAU;IAEV,MAAMC,YAAsB,EAAE;IAE9B,IAAI,CAACD,KAAKK,MAAM,CAACf,oBAAoB;QACnC,OAAO;YAAEW;QAAU,GAAG,oDAAoD;IAC5E;IAEA,KAAK,MAAMK,WAAWN,KAAKO,QAAQ,CAACjB,mBAAoB;QACtD,MAAMM,WAAWZ,kBACfM,mBACAgB,SACA,GAAGA,QAAQ,GAAG,CAAC;QAEjB,IAAI,CAACN,KAAKK,MAAM,CAACT,WAAW;YAC1B,UAAU,uCAAuC;QACnD;QAEA,MAAMG,cAAcC,MAAMJ,UAAUK;IACtC;IAEA,MAAMd,qBAAqBa;IAE3B,OAAO;QAAEC;IAAU;AACrB"}

package/src/migrations/v1.0.0-rc.88/0001-python-version-drop-exact-patch/metadata.json

@@ -0,0 +1,3 @@
+{
+  "description": "Drop the exact CPython patch from .python-version to the Lambda runtime's major.minor"
+}

package/src/migrations/v1.0.0-rc.88/0001-python-version-drop-exact-patch/migration.d.ts

@@ -0,0 +1,6 @@
+/**
+ * Copyright Amazon.com, Inc. or its affiliates. All Rights Reserved.
+ * SPDX-License-Identifier: Apache-2.0
+ */
+import { type MigrationReturnObject, type Tree } from '@nx/devkit';
+export default function migration(tree: Tree): Promise<MigrationReturnObject>;

package/src/migrations/v1.0.0-rc.88/0001-python-version-drop-exact-patch/migration.js

@@ -0,0 +1,43 @@
+/**
+ * Copyright Amazon.com, Inc. or its affiliates. All Rights Reserved.
+ * SPDX-License-Identifier: Apache-2.0
+ */ import { visitNotIgnoredFiles } from "@nx/devkit";
+import { formatFilesInSubtree } from "../../../utils/format.js";
+/**
+ * A `.python-version` naming an exact CPython patch resolves only where uv has a
+ * build of that patch: `3.14.7` installs on Linux but not on macOS, so `uv sync`
+ * fails there on a workspace that works elsewhere.
+ *
+ * uv reads a bare `major.minor` as a request for any patch of that minor, so
+ * dropping the patch lets each platform resolve a build it has. Lambda patches the
+ * interpreter itself, so the minor is the whole of what a project needs to pin.
+ *
+ * Only a patch of the minor the releases in question vended is dropped — another
+ * minor is the user's choice of interpreter, and the version sync moves the
+ * interpreter forward when the runtime's minor itself changes.
+ */ /**
+ * The Python runtime minor those releases vended, spelled out rather than read
+ * from `LAMBDA_RUNTIME_VERSIONS`.
+ *
+ * A migration describes a fixed point in history: it has to keep rewriting the
+ * versions those releases actually wrote, whatever the current pin is. Reading the
+ * live constant would silently retarget this at whatever minor the plugin vends by
+ * the time a user upgrades, and stop correcting the value it exists for.
+ */ const VENDED_MINOR = '3.14';
+export default async function migration(tree) {
+    // uv writes a `.python-version` per project as well as at the root, and one
+    // left behind fails `uv sync` for that project alone.
+    visitNotIgnoredFiles(tree, '.', (path)=>{
+        if (path !== '.python-version' && !path.endsWith('/.python-version')) {
+            return;
+        }
+        const declared = (tree.read(path, 'utf-8') ?? '').trim();
+        if (/^(\d+\.\d+)\.\d+$/.exec(declared)?.[1] === VENDED_MINOR) {
+            tree.write(path, `${VENDED_MINOR}\n`);
+        }
+    });
+    await formatFilesInSubtree(tree);
+    return {};
+}
+
+//# sourceMappingURL=migration.js.map

package/src/migrations/v1.0.0-rc.88/0001-python-version-drop-exact-patch/migration.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../../../../../../../packages/nx-plugin/src/migrations/v1.0.0-rc.88/0001-python-version-drop-exact-patch/migration.ts"],"sourcesContent":["/**\n * Copyright Amazon.com, Inc. or its affiliates. All Rights Reserved.\n * SPDX-License-Identifier: Apache-2.0\n */\nimport {\n  type MigrationReturnObject,\n  type Tree,\n  visitNotIgnoredFiles,\n} from '@nx/devkit';\nimport { formatFilesInSubtree } from '../../../utils/format.js';\n\n/**\n * A `.python-version` naming an exact CPython patch resolves only where uv has a\n * build of that patch: `3.14.7` installs on Linux but not on macOS, so `uv sync`\n * fails there on a workspace that works elsewhere.\n *\n * uv reads a bare `major.minor` as a request for any patch of that minor, so\n * dropping the patch lets each platform resolve a build it has. Lambda patches the\n * interpreter itself, so the minor is the whole of what a project needs to pin.\n *\n * Only a patch of the minor the releases in question vended is dropped — another\n * minor is the user's choice of interpreter, and the version sync moves the\n * interpreter forward when the runtime's minor itself changes.\n */\n\n/**\n * The Python runtime minor those releases vended, spelled out rather than read\n * from `LAMBDA_RUNTIME_VERSIONS`.\n *\n * A migration describes a fixed point in history: it has to keep rewriting the\n * versions those releases actually wrote, whatever the current pin is. Reading the\n * live constant would silently retarget this at whatever minor the plugin vends by\n * the time a user upgrades, and stop correcting the value it exists for.\n */\nconst VENDED_MINOR = '3.14';\n\nexport default async function migration(\n  tree: Tree,\n): Promise<MigrationReturnObject> {\n  // uv writes a `.python-version` per project as well as at the root, and one\n  // left behind fails `uv sync` for that project alone.\n  visitNotIgnoredFiles(tree, '.', (path) => {\n    if (path !== '.python-version' && !path.endsWith('/.python-version')) {\n      return;\n    }\n    const declared = (tree.read(path, 'utf-8') ?? '').trim();\n    if (/^(\\d+\\.\\d+)\\.\\d+$/.exec(declared)?.[1] === VENDED_MINOR) {\n      tree.write(path, `${VENDED_MINOR}\\n`);\n    }\n  });\n\n  await formatFilesInSubtree(tree);\n\n  return {};\n}\n"],"names":["visitNotIgnoredFiles","formatFilesInSubtree","VENDED_MINOR","migration","tree","path","endsWith","declared","read","trim","exec","write"],"mappings":"AAAA;;;CAGC,GACD,SAGEA,oBAAoB,QACf,aAAa;AACpB,SAASC,oBAAoB,QAAQ,2BAA2B;AAEhE;;;;;;;;;;;;CAYC,GAED;;;;;;;;CAQC,GACD,MAAMC,eAAe;AAErB,eAAe,eAAeC,UAC5BC,IAAU;IAEV,4EAA4E;IAC5E,sDAAsD;IACtDJ,qBAAqBI,MAAM,KAAK,CAACC;QAC/B,IAAIA,SAAS,qBAAqB,CAACA,KAAKC,QAAQ,CAAC,qBAAqB;YACpE;QACF;QACA,MAAMC,WAAW,AAACH,CAAAA,KAAKI,IAAI,CAACH,MAAM,YAAY,EAAC,EAAGI,IAAI;QACtD,IAAI,oBAAoBC,IAAI,CAACH,WAAW,CAAC,EAAE,KAAKL,cAAc;YAC5DE,KAAKO,KAAK,CAACN,MAAM,GAAGH,aAAa,EAAE,CAAC;QACtC;IACF;IAEA,MAAMD,qBAAqBG;IAE3B,OAAO,CAAC;AACV"}

package/src/migrations/v1.0.0-rc.88/0002-react-website-nx-react-express-override/metadata.json

@@ -0,0 +1,3 @@
+{
+  "description": "Add an npm override pinning the express @nx/react resolves to the version generated websites use, so npm can satisfy its optional peer"
+}

package/src/migrations/v1.0.0-rc.88/0002-react-website-nx-react-express-override/migration.d.ts

@@ -0,0 +1,31 @@
+/**
+ * Copyright Amazon.com, Inc. or its affiliates. All Rights Reserved.
+ * SPDX-License-Identifier: Apache-2.0
+ */
+import { type MigrationReturnObject, type Tree } from '@nx/devkit';
+/**
+ * Pin the `express` `@nx/react` resolves to the version generated websites use.
+ *
+ * `@nx/react` declares an optional `express` peer for its module-federation
+ * dev-server, on the major behind the `express` vended here. npm is alone in
+ * failing the whole install on an optional peer it cannot satisfy:
+ *
+ *   npm error ERESOLVE could not resolve
+ *   npm error   peerOptional express@"^4.21.2" from @nx/react
+ *   npm error Conflicting peer dependency: express@5.2.1
+ *
+ * so an npm workspace with a website cannot install once its nx moves onto a
+ * version carrying that peer. pnpm, bun and yarn only warn, and get nothing.
+ *
+ * Scoped to `@nx/react` rather than pinning `express` workspace-wide: nothing
+ * here loads it, the peer only has to be satisfiable, and a bare override would
+ * reach every other consumer of express too.
+ *
+ * Guardrails:
+ * - npm only, and only for a workspace that has a website — the root `@nx/react`
+ *   the generator adds. Anything else needs no override.
+ * - A user's own `overrides['@nx/react'].express` is left alone: theirs may pin a
+ *   version deliberately.
+ * - Idempotent: writing the same pin twice is a no-op.
+ */
+export default function migration(tree: Tree): Promise<MigrationReturnObject>;