npm - @aws/nx-plugin - Versions diffs - 1.0.0-rc.90 → 1.0.0-rc.91 - Mend

@aws/nx-plugin 1.0.0-rc.90 → 1.0.0-rc.91

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.

Files changed (43) hide show

package/LICENSE-THIRD-PARTY CHANGED Viewed

@@ -217,7 +217,7 @@ OTHER DEALINGS IN THE SOFTWARE.
 ---
-The following software may be included in this product: @astral-sh/ruff-wasm-nodejs (0.16.4)
+The following software may be included in this product: @astral-sh/ruff-wasm-nodejs (0.16.5)
 This software contains the following license and notice below:
 MIT License
@@ -26613,7 +26613,7 @@ OTHER DEALINGS IN THE SOFTWARE.
 ---
-The following software may be included in this product: zod (4.4.3)
+The following software may be included in this product: zod (4.5.4)
 This software contains the following license and notice below:
 MIT License

package/migrations.json CHANGED Viewed

@@ -2,31 +2,6 @@
   "$schema": "http://json-schema.org/schema",
   "name": "@aws/nx-plugin",
   "generators": {
-    "latest-add-destroy-sandbox-target": {
-      "version": "1.0.0-rc.87",
-      "description": "Add a destroy-sandbox target to CDK infrastructure projects which destroys the sandbox stage, and drop the --require-approval flag from cdk destroy, which has no such option",
-      "implementation": "./src/migrations/latest/add-destroy-sandbox-target/migration"
-    },
-    "latest-terraform-rdb-proxy-iam-connect-grant": {
-      "version": "1.0.0-rc.87",
-      "description": "Replace the MySQL RDS Proxy role's admin secret access with the rds-db:connect grant it needs for end-to-end IAM auth",
-      "implementation": "./src/migrations/latest/terraform-rdb-proxy-iam-connect-grant/migration"
-    },
-    "latest-python-version-drop-exact-patch": {
-      "version": "1.0.0-rc.88",
-      "description": "Drop the exact CPython patch from .python-version to the Lambda runtime's major.minor",
-      "implementation": "./src/migrations/latest/python-version-drop-exact-patch/migration"
-    },
-    "latest-react-website-nx-react-express-override": {
-      "version": "1.0.0-rc.88",
-      "description": "Add an npm override pinning the express @nx/react resolves to the version generated websites use, so npm can satisfy its optional peer",
-      "implementation": "./src/migrations/latest/react-website-nx-react-express-override/migration"
-    },
-    "latest-nx-parallel-default": {
-      "version": "1.0.0-rc.89",
-      "description": "Set nx.json parallel to 8 so full builds use available cores, preserving an existing value",
-      "implementation": "./src/migrations/latest/nx-parallel-default/migration"
-    },
     "latest-dev-target-depends-on-pull-image": {
       "version": "1.0.0-rc.90",
       "description": "Add dependsOn pull-image to the dev target of ts#dynamodb and ts#rdb projects",
@@ -287,8 +262,33 @@
       "description": "Add the Terraform checkov target and config, make bootstrap-destroy non-interactive, and declare required_version in the vended providers.tf",
       "implementation": "./src/migrations/v1.0.0-rc.85/0001-terraform-project-checkov-target-and-bootstrap-destroy/migration"
     },
+    "v1.0.0-rc.87-0001-add-destroy-sandbox-target": {
+      "version": "1.0.0-rc.87",
+      "description": "Add a destroy-sandbox target to CDK infrastructure projects which destroys the sandbox stage, and drop the --require-approval flag from cdk destroy, which has no such option",
+      "implementation": "./src/migrations/v1.0.0-rc.87/0001-add-destroy-sandbox-target/migration"
+    },
+    "v1.0.0-rc.87-0002-terraform-rdb-proxy-iam-connect-grant": {
+      "version": "1.0.0-rc.87",
+      "description": "Replace the MySQL RDS Proxy role's admin secret access with the rds-db:connect grant it needs for end-to-end IAM auth",
+      "implementation": "./src/migrations/v1.0.0-rc.87/0002-terraform-rdb-proxy-iam-connect-grant/migration"
+    },
+    "v1.0.0-rc.88-0001-python-version-drop-exact-patch": {
+      "version": "1.0.0-rc.88",
+      "description": "Drop the exact CPython patch from .python-version to the Lambda runtime's major.minor",
+      "implementation": "./src/migrations/v1.0.0-rc.88/0001-python-version-drop-exact-patch/migration"
+    },
+    "v1.0.0-rc.88-0002-react-website-nx-react-express-override": {
+      "version": "1.0.0-rc.88",
+      "description": "Add an npm override pinning the express @nx/react resolves to the version generated websites use, so npm can satisfy its optional peer",
+      "implementation": "./src/migrations/v1.0.0-rc.88/0002-react-website-nx-react-express-override/migration"
+    },
+    "v1.0.0-rc.89-0001-nx-parallel-default": {
+      "version": "1.0.0-rc.89",
+      "description": "Set nx.json parallel to 8 so full builds use available cores, preserving an existing value",
+      "implementation": "./src/migrations/v1.0.0-rc.89/0001-nx-parallel-default/migration"
+    },
     "sync-vended-versions": {
-      "version": "1.0.0-rc.90",
+      "version": "1.0.0-rc.91",
       "description": "Sync vended dependency versions and the tracked plugin version to those vended by this release",
       "implementation": "./src/utils/version-upgrade-migration/migration"
     }
@@ -328,7 +328,7 @@
       }
     },
     "nx-23.1.2-nx-packages": {
-      "version": "1.0.0-rc.90",
+      "version": "1.0.0-rc.88",
       "packages": {
         "nx": {
           "version": "23.1.2",

package/package.json CHANGED Viewed

@@ -1,6 +1,6 @@
 {
   "name": "@aws/nx-plugin",
-  "version": "1.0.0-rc.90",
+  "version": "1.0.0-rc.91",
   "repository": {
     "type": "git",
     "url": "https://github.com/awslabs/nx-plugin-for-aws.git",
@@ -40,9 +40,9 @@
   },
   "dependencies": {
     "@apidevtools/swagger-parser": "12.1.0",
-    "@astral-sh/ruff-wasm-nodejs": "0.16.4",
+    "@astral-sh/ruff-wasm-nodejs": "0.16.5",
     "@biomejs/js-api": "6.0.0",
-    "@biomejs/wasm-nodejs": "2.5.10",
+    "@biomejs/wasm-nodejs": "2.5.11",
     "@getgrit/gritql": "0.0.3",
     "@iarna/toml": "2.2.5",
     "@modelcontextprotocol/sdk": "1.30.0",
@@ -81,7 +81,7 @@
     "unist-util-visit": "5.1.0",
     "vite": "8.2.2",
     "vitest": "4.1.11",
-    "zod": "4.4.3"
+    "zod": "4.5.4"
   },
   "devDependencies": {
     "@types/semver": "7.8.0"

package/src/infra/app/__snapshots__/generator.spec.ts.snap CHANGED Viewed

@@ -56,7 +56,7 @@ exports[`infra generator > should configure Checkov target correctly > checkov-t
     "{workspaceRoot}/dist/{projectRoot}/cdk.out",
   ],
   "options": {
-    "command": "uvx --from checkov==3.3.15 checkov --config-file {projectRoot}/checkov.yml --directory dist/{projectRoot}/cdk.out --framework cloudformation",
+    "command": "uvx --from checkov==3.3.16 checkov --config-file {projectRoot}/checkov.yml --directory dist/{projectRoot}/cdk.out --framework cloudformation",
   },
   "outputs": [
     "{workspaceRoot}/dist/{projectRoot}/checkov",
@@ -156,7 +156,7 @@ exports[`infra generator > should configure project.json with correct targets >
         "{workspaceRoot}/dist/{projectRoot}/cdk.out",
       ],
       "options": {
-        "command": "uvx --from checkov==3.3.15 checkov --config-file {projectRoot}/checkov.yml --directory dist/{projectRoot}/cdk.out --framework cloudformation",
+        "command": "uvx --from checkov==3.3.16 checkov --config-file {projectRoot}/checkov.yml --directory dist/{projectRoot}/cdk.out --framework cloudformation",
       },
       "outputs": [
         "{workspaceRoot}/dist/{projectRoot}/checkov",
@@ -768,7 +768,7 @@ exports[`infra generator > should handle custom project names correctly > custom
         "{workspaceRoot}/dist/{projectRoot}/cdk.out",
       ],
       "options": {
-        "command": "uvx --from checkov==3.3.15 checkov --config-file {projectRoot}/checkov.yml --directory dist/{projectRoot}/cdk.out --framework cloudformation",
+        "command": "uvx --from checkov==3.3.16 checkov --config-file {projectRoot}/checkov.yml --directory dist/{projectRoot}/cdk.out --framework cloudformation",
       },
       "outputs": [
         "{workspaceRoot}/dist/{projectRoot}/checkov",

package/src/migrations/v1.0.0-rc.87/0001-add-destroy-sandbox-target/migration.js.map ADDED Viewed

@@ -0,0 +1 @@

+ {"version":3,"sources":["../../../../../../../packages/nx-plugin/src/migrations/v1.0.0-rc.87/0001-add-destroy-sandbox-target/migration.ts"],"sourcesContent":["/**\n * Copyright Amazon.com, Inc. or its affiliates. All Rights Reserved.\n * SPDX-License-Identifier: Apache-2.0\n */\nimport {\n getProjects,\n joinPathFragments,\n type MigrationReturnObject,\n type ProjectConfiguration,\n type Tree,\n updateProjectConfiguration,\n} from '@nx/devkit';\nimport { readFileSync } from 'fs';\nimport { join } from 'path';\nimport { INFRA_APP_GENERATOR_INFO } from '../../../infra/app/generator.js';\nimport { captureGritQLVariable } from '../../../utils/ast.js';\nimport { formatFilesInSubtree } from '../../../utils/format.js';\nimport { normalizeTargetKeyOrder } from '../../../utils/nx.js';\nimport { sortObjectKeys } from '../../../utils/object.js';\nimport {\n PACKAGES_DIR,\n SHARED_SCRIPTS_DIR,\n} from '../../../utils/shared-constructs-constants.js';\n\n/**\n * CDK infrastructure projects gained a `destroy-sandbox` target, mirroring\n * `deploy-sandbox`: it tears down the sandbox stage without the user having to\n * spell out its stage pattern (`nx destroy-sandbox infra` rather than\n * `nx destroy infra \"my-app-infra-sandbox/*\"`).\n *\n * The stage id is read from `main.ts` rather than recomputed from the project\n * name, so a project whose sandbox stage has been renamed gets a target that\n * destroys the stage it actually declares.\n *\n * The destroy targets also drop `--require-approval=never`. `cdk destroy` has no\n * such option, so it only warns that the flag is being ignored. The same fix\n * lands in the vended `buildCdkCommand`, which builds the command for\n * `stageConfig` workspaces.\n *\n * How to write a migration:\n * - https://nx.dev/docs/kb/migration-generators\n * - What `nextSteps` means: https://nx.dev/docs/reference/devkit/MigrationReturnObject\n */\n\nconst TARGET = 'destroy-sandbox';\n\n/** The destroy targets the ignored flag is stripped from. */\nconst DESTROY_TARGETS = ['destroy', 'destroy-ci'] as const;\n\n/** `cdk destroy` has no such option, so it only warns and carries on. */\nconst IGNORED_APPROVAL_FLAG = /\\s*--require-approval(=\\S*)?/;\n\n/**\n * Matches `new ApplicationStage(app, '<id>-sandbox', { ... })`, binding the\n * quoted stage id. The regex spans the quotes because it is matched against the\n * whole string literal node; both quote styles are accepted since the user's\n * formatter may have rewritten them.\n *\n * `main.ts` can declare several stages (beta, prod), so the pattern selects the\n * sandbox one rather than whichever comes first.\n */\nconst SANDBOX_STAGE_PATTERN =\n '`new ApplicationStage($app, $id, $props)` where { $id <: r\"[\\'\\\\\"].*-sandbox[\\'\\\\\"]\" }';\n\n/** The id of the sandbox stage a project's `main.ts` instantiates. */\nconst sandboxStageId = async (\n tree: Tree,\n projectRoot: string,\n): Promise<string | undefined> => {\n const captured = await captureGritQLVariable(\n tree,\n joinPathFragments(projectRoot, 'src', 'main.ts'),\n SANDBOX_STAGE_PATTERN,\n 'id',\n );\n // The binding keeps the quotes from the source.\n return captured?.slice(1, -1);\n};\n\n/**\n * Strip the ignored `--require-approval` from a `cdk destroy` command. Returns\n * undefined when the command isn't the shape the generator produced, or the flag\n * is already gone.\n */\nconst withoutApprovalFlag = (command: unknown): string | undefined => {\n if (typeof command !== 'string' || !command.includes('cdk destroy')) {\n return undefined;\n }\n if (!IGNORED_APPROVAL_FLAG.test(command)) return undefined;\n return command.replace(IGNORED_APPROVAL_FLAG, '');\n};\n\n/** Drops the ignored approval flag from the project's destroy targets. */\nconst migrateDestroyFlags = (project: ProjectConfiguration): boolean => {\n let changed = false;\n for (const name of DESTROY_TARGETS) {\n const target = project.targets?.[name];\n const command = withoutApprovalFlag(target?.options?.command);\n if (command) {\n target.options = { ...target.options, command };\n changed = true;\n }\n }\n return changed;\n};\n\n/** Path the shared scripts package vends the CDK command builder at. */\nconst CDK_COMMAND_PATH = joinPathFragments(\n PACKAGES_DIR,\n SHARED_SCRIPTS_DIR,\n 'src/infra/stage-credentials/cdk-command.ts',\n);\n\n/** The builder as it stands today. The template carries no EJS variables. */\nconst CDK_COMMAND_TEMPLATE = readFileSync(\n join(\n import.meta.dirname,\n '../../../utils/files/common/scripts/src/infra/stage-credentials/cdk-command.ts.template',\n ),\n 'utf-8',\n);\n\n/**\n * Re-vends the CDK command builder, which no longer adds `--require-approval`\n * for the `destroy` action. Only the shape the generator produced is replaced: a\n * customised copy is the user's, so it is reported instead.\n */\nconst migrateCdkCommandBuilder = (tree: Tree, nextSteps: string[]): void => {\n if (!tree.exists(CDK_COMMAND_PATH)) return;\n\n const current = tree.read(CDK_COMMAND_PATH)!.toString();\n // Already migrated, so a re-run is a no-op.\n if (current.includes(\"action === 'destroy'\")) return;\n\n if (!current.includes('hasRequireApproval')) {\n nextSteps.push(\n `${CDK_COMMAND_PATH}: has diverged from the generated shape — left untouched. Have it skip \\`--require-approval\\` for the \\`destroy\\` action, which has no such option.`,\n );\n return;\n }\n\n tree.write(CDK_COMMAND_PATH, CDK_COMMAND_TEMPLATE);\n};\n\n/** Adds the `destroy-sandbox` target, mirroring the project's `destroy`. */\nconst addSandboxTarget = async (\n tree: Tree,\n projectName: string,\n project: ProjectConfiguration,\n nextSteps: string[],\n): Promise<boolean> => {\n // The new target mirrors `destroy`, so it inherits whatever that resolved to\n // when the project was generated: the `tsx` credential-resolving script\n // under `stageConfig`, plain `cdk destroy` otherwise.\n const destroy = project.targets.destroy;\n const command = destroy?.options?.command;\n const mainPath = joinPathFragments(project.root, 'src/main.ts');\n const stageId = await sandboxStageId(tree, project.root);\n\n if (typeof command !== 'string') {\n nextSteps.push(\n `Add a '${TARGET}' target to ${projectName} by hand if necessary — its 'destroy' target no longer matches the shape the generator produced.`,\n );\n return false;\n }\n if (!stageId) {\n nextSteps.push(\n `Add a '${TARGET}' target to ${projectName} by hand if necessary — no sandbox stage was found in ${mainPath}.`,\n );\n return false;\n }\n\n project.targets[TARGET] = normalizeTargetKeyOrder({\n executor: destroy.executor,\n ...(destroy.dependsOn ? { dependsOn: [...destroy.dependsOn] } : {}),\n // Quoted so the shell does not glob the `*`.\n options: { ...destroy.options, command: `${command} \"${stageId}/*\"` },\n });\n return true;\n};\n\nexport default async function migration(\n tree: Tree,\n): Promise<MigrationReturnObject> {\n const nextSteps: string[] = [];\n\n for (const [projectName, project] of getProjects(tree)) {\n const generator = (project.metadata as { generator?: string } | undefined)\n ?.generator;\n // Not a CDK infrastructure project.\n if (generator !== INFRA_APP_GENERATOR_INFO.id) continue;\n\n // Corrected first so the new target inherits the fixed command.\n let changed = migrateDestroyFlags(project);\n\n if (!project.targets?.[TARGET]) {\n changed =\n (await addSandboxTarget(tree, projectName, project, nextSteps)) ||\n changed;\n }\n\n if (changed) {\n updateProjectConfiguration(tree, projectName, {\n ...project,\n targets: sortObjectKeys(project.targets),\n });\n }\n }\n\n migrateCdkCommandBuilder(tree, nextSteps);\n\n await formatFilesInSubtree(tree);\n\n return { nextSteps };\n}\n"],"names":["getProjects","joinPathFragments","updateProjectConfiguration","readFileSync","join","INFRA_APP_GENERATOR_INFO","captureGritQLVariable","formatFilesInSubtree","normalizeTargetKeyOrder","sortObjectKeys","PACKAGES_DIR","SHARED_SCRIPTS_DIR","TARGET","DESTROY_TARGETS","IGNORED_APPROVAL_FLAG","SANDBOX_STAGE_PATTERN","sandboxStageId","tree","projectRoot","captured","slice","withoutApprovalFlag","command","includes","undefined","test","replace","migrateDestroyFlags","project","changed","name","target","targets","options","CDK_COMMAND_PATH","CDK_COMMAND_TEMPLATE","dirname","migrateCdkCommandBuilder","nextSteps","exists","current","read","toString","push","write","addSandboxTarget","projectName","destroy","mainPath","root","stageId","executor","dependsOn","migration","generator","metadata","id"],"mappings":"AAAA;;;CAGC,GACD,SACEA,WAAW,EACXC,iBAAiB,EAIjBC,0BAA0B,QACrB,aAAa;AACpB,SAASC,YAAY,QAAQ,KAAK;AAClC,SAASC,IAAI,QAAQ,OAAO;AAC5B,SAASC,wBAAwB,QAAQ,kCAAkC;AAC3E,SAASC,qBAAqB,QAAQ,wBAAwB;AAC9D,SAASC,oBAAoB,QAAQ,2BAA2B;AAChE,SAASC,uBAAuB,QAAQ,uBAAuB;AAC/D,SAASC,cAAc,QAAQ,2BAA2B;AAC1D,SACEC,YAAY,EACZC,kBAAkB,QACb,gDAAgD;AAEvD;;;;;;;;;;;;;;;;;;CAkBC,GAED,MAAMC,SAAS;AAEf,2DAA2D,GAC3D,MAAMC,kBAAkB;IAAC;IAAW;CAAa;AAEjD,uEAAuE,GACvE,MAAMC,wBAAwB;AAE9B;;;;;;;;CAQC,GACD,MAAMC,wBACJ;AAEF,oEAAoE,GACpE,MAAMC,iBAAiB,OACrBC,MACAC;IAEA,MAAMC,WAAW,MAAMb,sBACrBW,MACAhB,kBAAkBiB,aAAa,OAAO,YACtCH,uBACA;IAEF,gDAAgD;IAChD,OAAOI,UAAUC,MAAM,GAAG,CAAC;AAC7B;AAEA;;;;CAIC,GACD,MAAMC,sBAAsB,CAACC;IAC3B,IAAI,OAAOA,YAAY,YAAY,CAACA,QAAQC,QAAQ,CAAC,gBAAgB;QACnE,OAAOC;IACT;IACA,IAAI,CAACV,sBAAsBW,IAAI,CAACH,UAAU,OAAOE;IACjD,OAAOF,QAAQI,OAAO,CAACZ,uBAAuB;AAChD;AAEA,wEAAwE,GACxE,MAAMa,sBAAsB,CAACC;IAC3B,IAAIC,UAAU;IACd,KAAK,MAAMC,QAAQjB,gBAAiB;QAClC,MAAMkB,SAASH,QAAQI,OAAO,EAAE,CAACF,KAAK;QACtC,MAAMR,UAAUD,oBAAoBU,QAAQE,SAASX;QACrD,IAAIA,SAAS;YACXS,OAAOE,OAAO,GAAG;gBAAE,GAAGF,OAAOE,OAAO;gBAAEX;YAAQ;YAC9CO,UAAU;QACZ;IACF;IACA,OAAOA;AACT;AAEA,sEAAsE,GACtE,MAAMK,mBAAmBjC,kBACvBS,cACAC,oBACA;AAGF,2EAA2E,GAC3E,MAAMwB,uBAAuBhC,aAC3BC,KACE,YAAYgC,OAAO,EACnB,4FAEF;AAGF;;;;CAIC,GACD,MAAMC,2BAA2B,CAACpB,MAAYqB;IAC5C,IAAI,CAACrB,KAAKsB,MAAM,CAACL,mBAAmB;IAEpC,MAAMM,UAAUvB,KAAKwB,IAAI,CAACP,kBAAmBQ,QAAQ;IACrD,4CAA4C;IAC5C,IAAIF,QAAQjB,QAAQ,CAAC,yBAAyB;IAE9C,IAAI,CAACiB,QAAQjB,QAAQ,CAAC,uBAAuB;QAC3Ce,UAAUK,IAAI,CACZ,GAAGT,iBAAiB,mJAAmJ,CAAC;QAE1K;IACF;IAEAjB,KAAK2B,KAAK,CAACV,kBAAkBC;AAC/B;AAEA,0EAA0E,GAC1E,MAAMU,mBAAmB,OACvB5B,MACA6B,aACAlB,SACAU;IAEA,6EAA6E;IAC7E,wEAAwE;IACxE,sDAAsD;IACtD,MAAMS,UAAUnB,QAAQI,OAAO,CAACe,OAAO;IACvC,MAAMzB,UAAUyB,SAASd,SAASX;IAClC,MAAM0B,WAAW/C,kBAAkB2B,QAAQqB,IAAI,EAAE;IACjD,MAAMC,UAAU,MAAMlC,eAAeC,MAAMW,QAAQqB,IAAI;IAEvD,IAAI,OAAO3B,YAAY,UAAU;QAC/BgB,UAAUK,IAAI,CACZ,CAAC,OAAO,EAAE/B,OAAO,YAAY,EAAEkC,YAAY,gGAAgG,CAAC;QAE9I,OAAO;IACT;IACA,IAAI,CAACI,SAAS;QACZZ,UAAUK,IAAI,CACZ,CAAC,OAAO,EAAE/B,OAAO,YAAY,EAAEkC,YAAY,sDAAsD,EAAEE,SAAS,CAAC,CAAC;QAEhH,OAAO;IACT;IAEApB,QAAQI,OAAO,CAACpB,OAAO,GAAGJ,wBAAwB;QAChD2C,UAAUJ,QAAQI,QAAQ;QAC1B,GAAIJ,QAAQK,SAAS,GAAG;YAAEA,WAAW;mBAAIL,QAAQK,SAAS;aAAC;QAAC,IAAI,CAAC,CAAC;QAClE,6CAA6C;QAC7CnB,SAAS;YAAE,GAAGc,QAAQd,OAAO;YAAEX,SAAS,GAAGA,QAAQ,EAAE,EAAE4B,QAAQ,GAAG,CAAC;QAAC;IACtE;IACA,OAAO;AACT;AAEA,eAAe,eAAeG,UAC5BpC,IAAU;IAEV,MAAMqB,YAAsB,EAAE;IAE9B,KAAK,MAAM,CAACQ,aAAalB,QAAQ,IAAI5B,YAAYiB,MAAO;QACtD,MAAMqC,YAAa1B,QAAQ2B,QAAQ,EAC/BD;QACJ,oCAAoC;QACpC,IAAIA,cAAcjD,yBAAyBmD,EAAE,EAAE;QAE/C,gEAAgE;QAChE,IAAI3B,UAAUF,oBAAoBC;QAElC,IAAI,CAACA,QAAQI,OAAO,EAAE,CAACpB,OAAO,EAAE;YAC9BiB,UACE,AAAC,MAAMgB,iBAAiB5B,MAAM6B,aAAalB,SAASU,cACpDT;QACJ;QAEA,IAAIA,SAAS;YACX3B,2BAA2Be,MAAM6B,aAAa;gBAC5C,GAAGlB,OAAO;gBACVI,SAASvB,eAAemB,QAAQI,OAAO;YACzC;QACF;IACF;IAEAK,yBAAyBpB,MAAMqB;IAE/B,MAAM/B,qBAAqBU;IAE3B,OAAO;QAAEqB;IAAU;AACrB"}

package/src/migrations/v1.0.0-rc.87/0002-terraform-rdb-proxy-iam-connect-grant/migration.js.map ADDED Viewed

@@ -0,0 +1 @@

+ {"version":3,"sources":["../../../../../../../packages/nx-plugin/src/migrations/v1.0.0-rc.87/0002-terraform-rdb-proxy-iam-connect-grant/migration.ts"],"sourcesContent":["/**\n * Copyright Amazon.com, Inc. or its affiliates. All Rights Reserved.\n * SPDX-License-Identifier: Apache-2.0\n */\nimport {\n joinPathFragments,\n type MigrationReturnObject,\n type Tree,\n} from '@nx/devkit';\nimport { applyGritQL, matchGritQL } from '../../../utils/ast.js';\nimport { formatFilesInSubtree } from '../../../utils/format.js';\nimport {\n PACKAGES_DIR,\n SHARED_TERRAFORM_DIR,\n} from '../../../utils/shared-constructs-constants.js';\n\n/**\n * Give the RDS Proxy role in every vended Terraform Aurora app module the\n * `rds-db:connect` grant for the application database user.\n *\n * The proxy is created with `default_auth_scheme = \"IAM_AUTH\"` and no secrets\n * registered, so `rds-db:connect` on the application user is the only\n * permission it needs to reach the cluster. MySQL modules instead granted the\n * role `secretsmanager:GetSecretValue` on the admin credentials secret plus\n * `kms:Decrypt` — credentials the proxy never uses, and a far wider grant than\n * connecting as the application user.\n *\n * These files are generated with `KeepExisting`, so an upgraded MySQL workspace\n * keeps the admin secret grant until this runs. Diverged files are left\n * untouched and reported via `nextSteps`.\n */\n\nconst TERRAFORM_DBS_DIR = `${PACKAGES_DIR}/${SHARED_TERRAFORM_DIR}/src/app/dbs`;\n\nconst hcl = (pattern: string) => `language hcl\\n${pattern}`;\n\nconst CONNECT_STATEMENT_TEXT = [\n '{',\n ' Effect = \"Allow\"',\n ' Action = [\"rds-db:connect\"]',\n ' Resource = [',\n ' \"arn:aws:rds-db:${data.aws_region.current.region}:${data.aws_caller_identity.current.account_id}:dbuser:${module.aurora.cluster_resource_id}/${local.database_runtime_user}\"',\n ' ]',\n ' }',\n].join('\\n');\n\nconst divergedMessage = (filePath: string) =>\n `${filePath}: the aws_iam_role_policy.proxy_db_user_connect policy has diverged from the generated shape - left untouched. The RDS Proxy authenticates to the cluster with IAM, so replace any secretsmanager:GetSecretValue / kms:Decrypt statements on the proxy role with a single rds-db:connect statement for local.database_runtime_user (see the ts#rdb generator's database app template).`;\n\nconst proxyPolicyBlock = (body: string) =>\n hcl(`\\`resource \"aws_iam_role_policy\" \"proxy_db_user_connect\" { ${body} }\\``);\n\nconst migrateModule = async (\n tree: Tree,\n filePath: string,\n nextSteps: string[],\n): Promise<void> => {\n if (!(await matchGritQL(tree, filePath, proxyPolicyBlock('$_')))) {\n return; // No proxy policy in this module - nothing this migration owns.\n }\n\n if (\n await matchGritQL(\n tree,\n filePath,\n proxyPolicyBlock('$props') +\n ' where { $props <: contains `\"rds-db:connect\"` }',\n )\n ) {\n return; // Already granted.\n }\n\n // The whole statement list is replaced, so the policy must still hold exactly\n // the two statements the generator vended and nothing the user has added.\n const secretStatements = hcl(\n [\n '`Statement = [',\n ' {',\n ' Effect = \"Allow\"',\n ' Action = [',\n ' \"secretsmanager:GetSecretValue\"',\n ' ]',\n ' Resource = [module.aurora.secret_arn]',\n ' },',\n ' {',\n ' Effect = \"Allow\"',\n ' Action = [',\n ' \"kms:Decrypt\"',\n ' ]',\n ' Resource = [module.aurora.kms_key_arn]',\n ' }',\n ' ]`',\n ].join('\\n'),\n );\n\n if (!(await matchGritQL(tree, filePath, secretStatements))) {\n nextSteps.push(divergedMessage(filePath));\n return;\n }\n\n await applyGritQL(\n tree,\n filePath,\n `${secretStatements} => \\`Statement = [\\n ${CONNECT_STATEMENT_TEXT}\\n ]\\``,\n );\n};\n\nexport default async function migration(\n tree: Tree,\n): Promise<MigrationReturnObject> {\n const nextSteps: string[] = [];\n\n if (!tree.exists(TERRAFORM_DBS_DIR)) {\n return { nextSteps }; // This workspace has no Terraform database modules.\n }\n\n for (const dirName of tree.children(TERRAFORM_DBS_DIR)) {\n const filePath = joinPathFragments(\n TERRAFORM_DBS_DIR,\n dirName,\n `${dirName}.tf`,\n );\n if (!tree.exists(filePath)) {\n continue; // Not a database app module directory.\n }\n\n await migrateModule(tree, filePath, nextSteps);\n }\n\n await formatFilesInSubtree(tree);\n\n return { nextSteps };\n}\n"],"names":["joinPathFragments","applyGritQL","matchGritQL","formatFilesInSubtree","PACKAGES_DIR","SHARED_TERRAFORM_DIR","TERRAFORM_DBS_DIR","hcl","pattern","CONNECT_STATEMENT_TEXT","join","divergedMessage","filePath","proxyPolicyBlock","body","migrateModule","tree","nextSteps","secretStatements","push","migration","exists","dirName","children"],"mappings":"AAAA;;;CAGC,GACD,SACEA,iBAAiB,QAGZ,aAAa;AACpB,SAASC,WAAW,EAAEC,WAAW,QAAQ,wBAAwB;AACjE,SAASC,oBAAoB,QAAQ,2BAA2B;AAChE,SACEC,YAAY,EACZC,oBAAoB,QACf,gDAAgD;AAEvD;;;;;;;;;;;;;;CAcC,GAED,MAAMC,oBAAoB,GAAGF,aAAa,CAAC,EAAEC,qBAAqB,YAAY,CAAC;AAE/E,MAAME,MAAM,CAACC,UAAoB,CAAC,cAAc,EAAEA,SAAS;AAE3D,MAAMC,yBAAyB;IAC7B;IACA;IACA;IACA;IACA;IACA;IACA;CACD,CAACC,IAAI,CAAC;AAEP,MAAMC,kBAAkB,CAACC,WACvB,GAAGA,SAAS,sXAAsX,CAAC;AAErY,MAAMC,mBAAmB,CAACC,OACxBP,IAAI,CAAC,2DAA2D,EAAEO,KAAK,IAAI,CAAC;AAE9E,MAAMC,gBAAgB,OACpBC,MACAJ,UACAK;IAEA,IAAI,CAAE,MAAMf,YAAYc,MAAMJ,UAAUC,iBAAiB,QAAS;QAChE,QAAQ,gEAAgE;IAC1E;IAEA,IACE,MAAMX,YACJc,MACAJ,UACAC,iBAAiB,YACf,qDAEJ;QACA,QAAQ,mBAAmB;IAC7B;IAEA,8EAA8E;IAC9E,0EAA0E;IAC1E,MAAMK,mBAAmBX,IACvB;QACE;QACA;QACA;QACA;QACA;QACA;QACA;QACA;QACA;QACA;QACA;QACA;QACA;QACA;QACA;QACA;KACD,CAACG,IAAI,CAAC;IAGT,IAAI,CAAE,MAAMR,YAAYc,MAAMJ,UAAUM,mBAAoB;QAC1DD,UAAUE,IAAI,CAACR,gBAAgBC;QAC/B;IACF;IAEA,MAAMX,YACJe,MACAJ,UACA,GAAGM,iBAAiB,2BAA2B,EAAET,uBAAuB,SAAS,CAAC;AAEtF;AAEA,eAAe,eAAeW,UAC5BJ,IAAU;IAEV,MAAMC,YAAsB,EAAE;IAE9B,IAAI,CAACD,KAAKK,MAAM,CAACf,oBAAoB;QACnC,OAAO;YAAEW;QAAU,GAAG,oDAAoD;IAC5E;IAEA,KAAK,MAAMK,WAAWN,KAAKO,QAAQ,CAACjB,mBAAoB;QACtD,MAAMM,WAAWZ,kBACfM,mBACAgB,SACA,GAAGA,QAAQ,GAAG,CAAC;QAEjB,IAAI,CAACN,KAAKK,MAAM,CAACT,WAAW;YAC1B,UAAU,uCAAuC;QACnD;QAEA,MAAMG,cAAcC,MAAMJ,UAAUK;IACtC;IAEA,MAAMd,qBAAqBa;IAE3B,OAAO;QAAEC;IAAU;AACrB"}

package/src/migrations/v1.0.0-rc.88/0001-python-version-drop-exact-patch/migration.js.map ADDED Viewed

@@ -0,0 +1 @@

+ {"version":3,"sources":["../../../../../../../packages/nx-plugin/src/migrations/v1.0.0-rc.88/0001-python-version-drop-exact-patch/migration.ts"],"sourcesContent":["/**\n * Copyright Amazon.com, Inc. or its affiliates. All Rights Reserved.\n * SPDX-License-Identifier: Apache-2.0\n */\nimport {\n type MigrationReturnObject,\n type Tree,\n visitNotIgnoredFiles,\n} from '@nx/devkit';\nimport { formatFilesInSubtree } from '../../../utils/format.js';\n\n/**\n * A `.python-version` naming an exact CPython patch resolves only where uv has a\n * build of that patch: `3.14.7` installs on Linux but not on macOS, so `uv sync`\n * fails there on a workspace that works elsewhere.\n *\n * uv reads a bare `major.minor` as a request for any patch of that minor, so\n * dropping the patch lets each platform resolve a build it has. Lambda patches the\n * interpreter itself, so the minor is the whole of what a project needs to pin.\n *\n * Only a patch of the minor the releases in question vended is dropped — another\n * minor is the user's choice of interpreter, and the version sync moves the\n * interpreter forward when the runtime's minor itself changes.\n */\n\n/**\n * The Python runtime minor those releases vended, spelled out rather than read\n * from `LAMBDA_RUNTIME_VERSIONS`.\n *\n * A migration describes a fixed point in history: it has to keep rewriting the\n * versions those releases actually wrote, whatever the current pin is. Reading the\n * live constant would silently retarget this at whatever minor the plugin vends by\n * the time a user upgrades, and stop correcting the value it exists for.\n */\nconst VENDED_MINOR = '3.14';\n\nexport default async function migration(\n tree: Tree,\n): Promise<MigrationReturnObject> {\n // uv writes a `.python-version` per project as well as at the root, and one\n // left behind fails `uv sync` for that project alone.\n visitNotIgnoredFiles(tree, '.', (path) => {\n if (path !== '.python-version' && !path.endsWith('/.python-version')) {\n return;\n }\n const declared = (tree.read(path, 'utf-8') ?? '').trim();\n if (/^(\\d+\\.\\d+)\\.\\d+$/.exec(declared)?.[1] === VENDED_MINOR) {\n tree.write(path, `${VENDED_MINOR}\\n`);\n }\n });\n\n await formatFilesInSubtree(tree);\n\n return {};\n}\n"],"names":["visitNotIgnoredFiles","formatFilesInSubtree","VENDED_MINOR","migration","tree","path","endsWith","declared","read","trim","exec","write"],"mappings":"AAAA;;;CAGC,GACD,SAGEA,oBAAoB,QACf,aAAa;AACpB,SAASC,oBAAoB,QAAQ,2BAA2B;AAEhE;;;;;;;;;;;;CAYC,GAED;;;;;;;;CAQC,GACD,MAAMC,eAAe;AAErB,eAAe,eAAeC,UAC5BC,IAAU;IAEV,4EAA4E;IAC5E,sDAAsD;IACtDJ,qBAAqBI,MAAM,KAAK,CAACC;QAC/B,IAAIA,SAAS,qBAAqB,CAACA,KAAKC,QAAQ,CAAC,qBAAqB;YACpE;QACF;QACA,MAAMC,WAAW,AAACH,CAAAA,KAAKI,IAAI,CAACH,MAAM,YAAY,EAAC,EAAGI,IAAI;QACtD,IAAI,oBAAoBC,IAAI,CAACH,WAAW,CAAC,EAAE,KAAKL,cAAc;YAC5DE,KAAKO,KAAK,CAACN,MAAM,GAAGH,aAAa,EAAE,CAAC;QACtC;IACF;IAEA,MAAMD,qBAAqBG;IAE3B,OAAO,CAAC;AACV"}

package/src/migrations/v1.0.0-rc.88/0002-react-website-nx-react-express-override/migration.js.map ADDED Viewed

@@ -0,0 +1 @@

+ {"version":3,"sources":["../../../../../../../packages/nx-plugin/src/migrations/v1.0.0-rc.88/0002-react-website-nx-react-express-override/migration.ts"],"sourcesContent":["/**\n * Copyright Amazon.com, Inc. or its affiliates. All Rights Reserved.\n * SPDX-License-Identifier: Apache-2.0\n */\nimport {\n detectPackageManager,\n type MigrationReturnObject,\n readJson,\n type Tree,\n updateJson,\n} from '@nx/devkit';\nimport { formatFilesInSubtree } from '../../../utils/format';\nimport { TS_VERSIONS } from '../../../utils/versions';\n\n/**\n * Pin the `express` `@nx/react` resolves to the version generated websites use.\n *\n * `@nx/react` declares an optional `express` peer for its module-federation\n * dev-server, on the major behind the `express` vended here. npm is alone in\n * failing the whole install on an optional peer it cannot satisfy:\n *\n * npm error ERESOLVE could not resolve\n * npm error peerOptional express@\"^4.21.2\" from @nx/react\n * npm error Conflicting peer dependency: express@5.2.1\n *\n * so an npm workspace with a website cannot install once its nx moves onto a\n * version carrying that peer. pnpm, bun and yarn only warn, and get nothing.\n *\n * Scoped to `@nx/react` rather than pinning `express` workspace-wide: nothing\n * here loads it, the peer only has to be satisfiable, and a bare override would\n * reach every other consumer of express too.\n *\n * Guardrails:\n * - npm only, and only for a workspace that has a website — the root `@nx/react`\n * the generator adds. Anything else needs no override.\n * - A user's own `overrides['@nx/react'].express` is left alone: theirs may pin a\n * version deliberately.\n * - Idempotent: writing the same pin twice is a no-op.\n */\nexport default async function migration(\n tree: Tree,\n): Promise<MigrationReturnObject> {\n const nextSteps: string[] = [];\n\n if (detectPackageManager(tree.root) !== 'npm') {\n return { nextSteps };\n }\n\n const packageJson = readJson<{\n devDependencies?: Record<string, string>;\n dependencies?: Record<string, string>;\n overrides?: Record<string, unknown>;\n }>(tree, 'package.json');\n\n const hasNxReact = Boolean(\n packageJson.devDependencies?.['@nx/react'] ??\n packageJson.dependencies?.['@nx/react'],\n );\n if (!hasNxReact) {\n return { nextSteps }; // No website in this workspace.\n }\n\n const scoped = packageJson.overrides?.['@nx/react'] as\n | Record<string, string>\n | string\n | undefined;\n\n // The string form pins `@nx/react` itself, leaving nowhere to nest the peer.\n if (typeof scoped === 'string') {\n nextSteps.push(\n `package.json: overrides['@nx/react'] pins a version as a string, so the express override could not be nested under it - left untouched. npm fails the install on @nx/react's optional express peer, so add { \"@nx/react\": { \".\": \"${scoped}\", \"express\": \"${TS_VERSIONS.express}\" } } to keep it satisfiable.`,\n );\n return { nextSteps };\n }\n\n if (scoped?.express) {\n return { nextSteps }; // Already pinned, by this migration or by the user.\n }\n\n updateJson(tree, 'package.json', (json) => ({\n ...json,\n overrides: {\n ...json.overrides,\n '@nx/react': { ...scoped, express: TS_VERSIONS.express },\n },\n }));\n\n await formatFilesInSubtree(tree);\n\n return { nextSteps };\n}\n"],"names":["detectPackageManager","readJson","updateJson","formatFilesInSubtree","TS_VERSIONS","migration","tree","nextSteps","root","packageJson","hasNxReact","Boolean","devDependencies","dependencies","scoped","overrides","push","express","json"],"mappings":"AAAA;;;CAGC,GACD,SACEA,oBAAoB,EAEpBC,QAAQ,EAERC,UAAU,QACL,aAAa;AACpB,SAASC,oBAAoB,QAAQ,2BAAwB;AAC7D,SAASC,WAAW,QAAQ,6BAA0B;AAEtD;;;;;;;;;;;;;;;;;;;;;;;;CAwBC,GACD,eAAe,eAAeC,UAC5BC,IAAU;IAEV,MAAMC,YAAsB,EAAE;IAE9B,IAAIP,qBAAqBM,KAAKE,IAAI,MAAM,OAAO;QAC7C,OAAO;YAAED;QAAU;IACrB;IAEA,MAAME,cAAcR,SAIjBK,MAAM;IAET,MAAMI,aAAaC,QACjBF,YAAYG,eAAe,EAAE,CAAC,YAAY,IACxCH,YAAYI,YAAY,EAAE,CAAC,YAAY;IAE3C,IAAI,CAACH,YAAY;QACf,OAAO;YAAEH;QAAU,GAAG,gCAAgC;IACxD;IAEA,MAAMO,SAASL,YAAYM,SAAS,EAAE,CAAC,YAAY;IAKnD,6EAA6E;IAC7E,IAAI,OAAOD,WAAW,UAAU;QAC9BP,UAAUS,IAAI,CACZ,CAAC,kOAAkO,EAAEF,OAAO,eAAe,EAAEV,YAAYa,OAAO,CAAC,6BAA6B,CAAC;QAEjT,OAAO;YAAEV;QAAU;IACrB;IAEA,IAAIO,QAAQG,SAAS;QACnB,OAAO;YAAEV;QAAU,GAAG,oDAAoD;IAC5E;IAEAL,WAAWI,MAAM,gBAAgB,CAACY,OAAU,CAAA;YAC1C,GAAGA,IAAI;YACPH,WAAW;gBACT,GAAGG,KAAKH,SAAS;gBACjB,aAAa;oBAAE,GAAGD,MAAM;oBAAEG,SAASb,YAAYa,OAAO;gBAAC;YACzD;QACF,CAAA;IAEA,MAAMd,qBAAqBG;IAE3B,OAAO;QAAEC;IAAU;AACrB"}

package/src/migrations/v1.0.0-rc.89/0001-nx-parallel-default/migration.js.map ADDED Viewed

@@ -0,0 +1 @@

+ {"version":3,"sources":["../../../../../../../packages/nx-plugin/src/migrations/v1.0.0-rc.89/0001-nx-parallel-default/migration.ts"],"sourcesContent":["/**\n * Copyright Amazon.com, Inc. or its affiliates. All Rights Reserved.\n * SPDX-License-Identifier: Apache-2.0\n */\nimport {\n type MigrationReturnObject,\n readNxJson,\n type Tree,\n updateNxJson,\n} from '@nx/devkit';\nimport { formatFilesInSubtree } from '../../../utils/format.js';\nimport { DEFAULT_PARALLEL } from '../../../utils/init.js';\n\n/**\n * New workspaces set `parallel` in `nx.json` so a full build uses the available\n * cores rather than Nx's default of 3. Existing workspaces have no value at all,\n * so this backfills it.\n *\n * A workspace that already declares `parallel` has made a deliberate choice —\n * often to bound memory on a smaller machine — so it is left as it is.\n */\nexport default async function migration(\n tree: Tree,\n): Promise<MigrationReturnObject> {\n const nextSteps: string[] = [];\n\n const nxJson = readNxJson(tree);\n if (nxJson && nxJson.parallel === undefined) {\n updateNxJson(tree, { ...nxJson, parallel: DEFAULT_PARALLEL });\n }\n\n await formatFilesInSubtree(tree);\n\n return { nextSteps };\n}\n"],"names":["readNxJson","updateNxJson","formatFilesInSubtree","DEFAULT_PARALLEL","migration","tree","nextSteps","nxJson","parallel","undefined"],"mappings":"AAAA;;;CAGC,GACD,SAEEA,UAAU,EAEVC,YAAY,QACP,aAAa;AACpB,SAASC,oBAAoB,QAAQ,2BAA2B;AAChE,SAASC,gBAAgB,QAAQ,yBAAyB;AAE1D;;;;;;;CAOC,GACD,eAAe,eAAeC,UAC5BC,IAAU;IAEV,MAAMC,YAAsB,EAAE;IAE9B,MAAMC,SAASP,WAAWK;IAC1B,IAAIE,UAAUA,OAAOC,QAAQ,KAAKC,WAAW;QAC3CR,aAAaI,MAAM;YAAE,GAAGE,MAAM;YAAEC,UAAUL;QAAiB;IAC7D;IAEA,MAAMD,qBAAqBG;IAE3B,OAAO;QAAEC;IAAU;AACrB"}

package/src/preset/__snapshots__/generator.spec.ts.snap CHANGED Viewed

@@ -252,7 +252,7 @@ export default {
 exports[`preset generator > should run successfully > biome.json 1`] = `
 "{
-  "$schema": "https://biomejs.dev/schemas/2.5.10/schema.json",
+  "$schema": "https://biomejs.dev/schemas/2.5.11/schema.json",
   "root": true,
   "formatter": {
     "enabled": true,
@@ -420,7 +420,7 @@ catalog:
   '@nx/js': 23.1.2
   '@nx/workspace': 23.1.2
   typescript: ~6.0.3
-  '@biomejs/biome': 2.5.10
+  '@biomejs/biome': 2.5.11
   '@aws/nx-plugin': ^0.0.0
   '@aws/nx-plugin-mcp': ^0.0.0
 "

package/src/py/agent/__snapshots__/generator.constructs.spec.ts.snap CHANGED Viewed

@@ -766,11 +766,11 @@ dependencies = [
   "aws-lambda-powertools==3.34.0",
   "aws-opentelemetry-distro==0.19.0",
   "bedrock-agentcore==1.22.0",
-  "boto3==1.43.82",
+  "boto3==1.43.83",
   "fastapi==0.141.1",
   "mcp==1.28.1",
   "strands-agents==1.54.0",
-  "strands-agents-tools==0.8.6",
+  "strands-agents-tools==0.8.7",
   "uvicorn==0.52.4"
 ]

package/src/py/agent/__snapshots__/generator.frameworks.spec.ts.snap CHANGED Viewed

@@ -704,7 +704,7 @@ dependencies = [
   "aws-lambda-powertools==3.34.0",
   "aws-opentelemetry-distro==0.19.0",
   "bedrock-agentcore==1.22.0",
-  "boto3==1.43.82",
+  "boto3==1.43.83",
   "fastapi==0.141.1",
   "mcp==1.28.1",
   "langchain==1.3.18",

package/src/py/agent/__snapshots__/generator.protocols.spec.ts.snap CHANGED Viewed

@@ -1100,7 +1100,7 @@ resource "null_resource" "runtime_ready" {
   provisioner "local-exec" {
     command = <<-EOT
-      uv run --with boto3==1.43.82 python -c "
+      uv run --with boto3==1.43.83 python -c "
 import boto3
 import json
 import os

package/src/py/mcp-server/__snapshots__/generator.spec.ts.snap CHANGED Viewed

@@ -575,7 +575,7 @@ resource "null_resource" "runtime_ready" {
   provisioner "local-exec" {
     command = <<-EOT
-      uv run --with boto3==1.43.82 python -c "
+      uv run --with boto3==1.43.83 python -c "
 import boto3
 import json
 import os
@@ -853,7 +853,7 @@ dependencies = [
   "aws-lambda-powertools==3.34.0",
   "mcp==1.28.1",
   "uvicorn==0.52.4",
-  "boto3==1.43.82",
+  "boto3==1.43.83",
   "aws-opentelemetry-distro==0.19.0"
 ]

package/src/py/rdb/__snapshots__/generator.spec.ts.snap CHANGED Viewed

@@ -1522,11 +1522,11 @@ description = "Automatically generated by Nx."
 requires-python = ">=3.14"
 readme = "README.md"
 dependencies = [
-  "sqlmodel==0.0.39",
+  "sqlmodel==0.0.42",
   "alembic==1.19.1",
   "greenlet==3.5.5",
   "asyncpg==0.31.0",
-  "boto3==1.43.82",
+  "boto3==1.43.83",
   "aws-lambda-powertools==3.34.0"
 ]

package/src/ts/agent/__snapshots__/generator.spec.ts.snap CHANGED Viewed

@@ -1715,7 +1715,7 @@ resource "null_resource" "runtime_ready" {
   provisioner "local-exec" {
     command = <<-EOT
-      uv run --with boto3==1.43.82 python -c "
+      uv run --with boto3==1.43.83 python -c "
 import boto3
 import json
 import os

package/src/ts/mcp-server/__snapshots__/generator.spec.ts.snap CHANGED Viewed

@@ -575,7 +575,7 @@ resource "null_resource" "runtime_ready" {
   provisioner "local-exec" {
     command = <<-EOT
-      uv run --with boto3==1.43.82 python -c "
+      uv run --with boto3==1.43.83 python -c "
 import boto3
 import json
 import os

package/src/ts/react-website/app/__snapshots__/generator.spec.ts.snap CHANGED Viewed

@@ -745,7 +745,7 @@ resource "null_resource" "upload_website_files" {
   provisioner "local-exec" {
     command = <<-EOT
       cd "$ROOT_PATH"
-      uv run --with boto3==1.43.82 python3 -c "
+      uv run --with boto3==1.43.83 python3 -c "
 import os
 import sys
 import boto3
@@ -868,7 +868,7 @@ resource "null_resource" "cloudfront_invalidation" {
   provisioner "local-exec" {
     command = <<-EOT
-      uv run --with boto3==1.43.82 python3 -c "
+      uv run --with boto3==1.43.83 python3 -c "
 import boto3
 import os
 import sys
@@ -1062,7 +1062,7 @@ exports[`react-website generator > Tanstack router integration > should generate
 exports[`react-website generator > Tanstack router integration > should generate website with no router correctly > biome.json 1`] = `
 "{
-  "$schema": "https://biomejs.dev/schemas/2.5.10/schema.json",
+  "$schema": "https://biomejs.dev/schemas/2.5.11/schema.json",
   "root": true,
   "formatter": {
     "enabled": true,
@@ -2330,12 +2330,12 @@ catalog:
   vitest: 4.1.11
   '@vitest/coverage-v8': 4.1.11
   constructs: 10.8.1
-  aws-cdk-lib: 2.266.0
+  aws-cdk-lib: 2.267.0
   '@types/node': 26.4.0
   react: 19.2.8
   react-dom: 19.2.8
-  '@cloudscape-design/components': 3.0.1354
-  '@cloudscape-design/board-components': 3.0.220
+  '@cloudscape-design/components': 3.0.1356
+  '@cloudscape-design/board-components': 3.0.221
   '@cloudscape-design/global-styles': 1.0.67
   tailwindcss: 4.3.3
   '@nx/react': 23.1.2
@@ -2934,7 +2934,7 @@ exports[`react-website generator > Tanstack router integration > should generate
 exports[`react-website generator > Tanstack router integration > should generate website with router correctly > biome.json 1`] = `
 "{
-  "$schema": "https://biomejs.dev/schemas/2.5.10/schema.json",
+  "$schema": "https://biomejs.dev/schemas/2.5.11/schema.json",
   "root": true,
   "formatter": {
     "enabled": true,
@@ -4206,12 +4206,12 @@ catalog:
   vitest: 4.1.11
   '@vitest/coverage-v8': 4.1.11
   constructs: 10.8.1
-  aws-cdk-lib: 2.266.0
+  aws-cdk-lib: 2.267.0
   '@types/node': 26.4.0
   react: 19.2.8
   react-dom: 19.2.8
-  '@cloudscape-design/components': 3.0.1354
-  '@cloudscape-design/board-components': 3.0.220
+  '@cloudscape-design/components': 3.0.1356
+  '@cloudscape-design/board-components': 3.0.221
   '@cloudscape-design/global-styles': 1.0.67
   tailwindcss: 4.3.3
   '@tanstack/react-router': 1.170.32

package/src/ts/react-website/cognito-auth/__snapshots__/generator.terraform.spec.ts.snap CHANGED Viewed

@@ -67,7 +67,7 @@ resource "null_resource" "add_callback_url" {
   provisioner "local-exec" {
     command = <<-EOT
-      uv run --with boto3==1.43.82 python -c "
+      uv run --with boto3==1.43.83 python -c "
 import boto3
 import os
 import sys

package/src/utils/versions.d.ts CHANGED Viewed

@@ -11,17 +11,17 @@ export declare const TS_VERSIONS: {
     readonly '@aws/aws-distro-opentelemetry-node-autoinstrumentation': "0.12.0";
     readonly '@opentelemetry/propagator-jaeger': "2.10.0";
     readonly minimatch: "10.2.6";
-    readonly '@aws-sdk/client-dynamodb': "3.1119.0";
-    readonly '@aws-sdk/client-api-gateway': "3.1119.0";
-    readonly '@aws-sdk/client-iam': "3.1119.0";
-    readonly '@aws-sdk/client-bedrock-agentcore': "3.1119.0";
-    readonly '@aws-sdk/client-bedrock-runtime': "3.1119.0";
-    readonly '@aws-sdk/client-s3': "3.1119.0";
-    readonly '@aws-sdk/client-sts': "3.1119.0";
-    readonly '@aws-sdk/credential-providers': "3.1119.0";
+    readonly '@aws-sdk/client-dynamodb': "3.1121.0";
+    readonly '@aws-sdk/client-api-gateway': "3.1121.0";
+    readonly '@aws-sdk/client-iam': "3.1121.0";
+    readonly '@aws-sdk/client-bedrock-agentcore': "3.1121.0";
+    readonly '@aws-sdk/client-bedrock-runtime': "3.1121.0";
+    readonly '@aws-sdk/client-s3': "3.1121.0";
+    readonly '@aws-sdk/client-sts': "3.1121.0";
+    readonly '@aws-sdk/credential-providers': "3.1121.0";
     readonly '@aws-sdk/credential-provider-cognito-identity': "3.972.69";
-    readonly '@aws-sdk/client-secrets-manager': "3.1119.0";
-    readonly '@aws-sdk/rds-signer': "3.1119.0";
+    readonly '@aws-sdk/client-secrets-manager': "3.1121.0";
+    readonly '@aws-sdk/rds-signer': "3.1121.0";
     readonly '@smithy/server-apigateway': "0.3.3";
     readonly '@smithy/server-node': "0.3.3";
     readonly '@aws-lambda-powertools/logger': "2.35.0";
@@ -29,8 +29,8 @@ export declare const TS_VERSIONS: {
     readonly '@aws-lambda-powertools/parameters': "2.35.0";
     readonly '@aws-lambda-powertools/tracer': "2.35.0";
     readonly '@aws-lambda-powertools/parser': "2.35.0";
-    readonly '@aws-sdk/client-appconfigdata': "3.1119.0";
-    readonly '@middy/core': "7.8.0";
+    readonly '@aws-sdk/client-appconfigdata': "3.1121.0";
+    readonly '@middy/core': "7.9.2";
     readonly '@nxlv/python': "23.0.0";
     readonly '@nx-extend/terraform': "10.4.1";
     readonly nx: "23.1.2";
@@ -51,20 +51,20 @@ export declare const TS_VERSIONS: {
     readonly '@ag-ui/core': "0.0.57";
     readonly '@ag-ui/encoder': "0.0.57";
     readonly 'agent-chat-cli': "0.3.0";
-    readonly '@copilotkit/react-core': "1.69.2";
+    readonly '@copilotkit/react-core': "1.69.3";
     readonly rxjs: "7.8.2";
-    readonly '@strands-agents/sdk': "1.14.0";
+    readonly '@strands-agents/sdk': "1.15.0";
     readonly '@tanstack/react-router': "1.170.32";
     readonly '@tanstack/router-plugin': "1.168.35";
     readonly '@tanstack/router-generator': "1.167.33";
     readonly '@tanstack/virtual-file-routes': "1.162.0";
     readonly '@tanstack/router-utils': "1.162.2";
-    readonly '@cloudscape-design/board-components': "3.0.220";
-    readonly '@cloudscape-design/chat-components': "1.0.164";
-    readonly '@cloudscape-design/components': "3.0.1354";
+    readonly '@cloudscape-design/board-components': "3.0.221";
+    readonly '@cloudscape-design/chat-components': "1.0.165";
+    readonly '@cloudscape-design/components': "3.0.1356";
     readonly '@cloudscape-design/global-styles': "1.0.67";
-    readonly '@tanstack/react-query': "5.102.6";
-    readonly '@tanstack/react-query-devtools': "5.102.6";
+    readonly '@tanstack/react-query': "5.102.8";
+    readonly '@tanstack/react-query-devtools': "5.102.8";
     readonly '@trpc/tanstack-react-query': "11.18.0";
     readonly '@trpc/client': "11.18.0";
     readonly '@trpc/server': "11.18.0";
@@ -81,12 +81,12 @@ export declare const TS_VERSIONS: {
     readonly '@vitest/coverage-v8': "4.1.11";
     readonly '@vitest/ui': "4.1.11";
     readonly '@astrojs/react': "6.0.4";
-    readonly '@astrojs/starlight': "0.41.9";
-    readonly astro: "7.2.8";
+    readonly '@astrojs/starlight': "0.41.10";
+    readonly astro: "7.2.9";
     readonly cookie: "2.0.1";
     readonly aws4fetch: "1.0.20";
     readonly 'aws-cdk': "2.1139.0";
-    readonly 'aws-cdk-lib': "2.266.0";
+    readonly 'aws-cdk-lib': "2.267.0";
     readonly 'aws-xray-sdk-core': "3.12.0";
     readonly constructs: "10.8.1";
     readonly cors: "2.8.6";
@@ -99,7 +99,7 @@ export declare const TS_VERSIONS: {
     readonly esbuild: "0.28.2";
     readonly 'event-source-polyfill': "1.0.31";
     readonly '@types/event-source-polyfill': "1.0.5";
-    readonly '@biomejs/biome': "2.5.10";
+    readonly '@biomejs/biome': "2.5.11";
     readonly '@prisma/adapter-mariadb': "7.10.0";
     readonly '@prisma/adapter-pg': "7.10.0";
     readonly '@prisma/client': "7.10.0";
@@ -124,14 +124,14 @@ export declare const TS_VERSIONS: {
     readonly 'react-dom': "19.2.8";
     readonly rimraf: "6.1.3";
     readonly rolldown: "1.2.6";
-    readonly 'rolldown-plugin-dts': "0.28.2";
+    readonly 'rolldown-plugin-dts': "0.28.3";
     readonly 'simple-git': "3.36.0";
     readonly 'source-map-support': "0.5.21";
     readonly 'starlight-blog': "0.29.0";
     readonly tailwindcss: "4.3.3";
     readonly '@tailwindcss/vite': "4.3.3";
     readonly tsx: "4.23.12";
-    readonly 'lucide-react': "1.34.0";
+    readonly 'lucide-react': "1.37.0";
     readonly 'radix-ui': "1.6.7";
     readonly shadcn: "4.19.0";
     readonly 'tw-animate-css': "1.4.0";
@@ -139,7 +139,7 @@ export declare const TS_VERSIONS: {
     readonly vite: "8.2.2";
     readonly typescript: "6.0.3";
     readonly vitest: "4.1.11";
-    readonly zod: "4.4.3";
+    readonly zod: "4.5.4";
     readonly ws: "8.21.3";
 };
 export type ITsDepVersion = keyof typeof TS_VERSIONS;
@@ -177,8 +177,8 @@ export declare const PY_VERSIONS: {
     readonly 'aws-lambda-powertools[parser]': "==3.34.0";
     readonly 'aws-opentelemetry-distro': "==0.19.0";
     readonly 'bedrock-agentcore': "==1.22.0";
-    readonly boto3: "==1.43.82";
-    readonly checkov: "==3.3.15";
+    readonly boto3: "==1.43.83";
+    readonly checkov: "==3.3.16";
     readonly fastapi: "==0.141.1";
     readonly 'fastapi[standard]': "==0.141.1";
     readonly httpx: "==0.28.1";
@@ -191,14 +191,14 @@ export declare const PY_VERSIONS: {
     readonly mcp: "==1.28.1";
     readonly 'pip-check-updates': "==0.29.0";
     readonly 'pip-licenses': "==5.5.5";
-    readonly ruff: "==0.16.4";
+    readonly ruff: "==0.16.5";
     readonly 'strands-agents': "==1.54.0";
     readonly 'strands-agents[a2a]': "==1.54.0";
-    readonly 'strands-agents-tools': "==0.8.6";
+    readonly 'strands-agents-tools': "==0.8.7";
     readonly ty: "==0.0.75";
     readonly pynamodb: "==6.1.0";
     readonly uvicorn: "==0.52.4";
-    readonly sqlmodel: "==0.0.39";
+    readonly sqlmodel: "==0.0.42";
     readonly alembic: "==1.19.1";
     readonly aiomysql: "==0.3.2";
     readonly asyncpg: "==0.31.0";

package/src/utils/versions.js CHANGED Viewed

@@ -16,17 +16,17 @@
     // as fixed. Overriding brace-expansion directly is not viable — 5.x drops the
     // CommonJS default export that minimatch 9 calls.
     minimatch: '10.2.6',
-    '@aws-sdk/client-dynamodb': '3.1119.0',
-    '@aws-sdk/client-api-gateway': '3.1119.0',
-    '@aws-sdk/client-iam': '3.1119.0',
-    '@aws-sdk/client-bedrock-agentcore': '3.1119.0',
-    '@aws-sdk/client-bedrock-runtime': '3.1119.0',
-    '@aws-sdk/client-s3': '3.1119.0',
-    '@aws-sdk/client-sts': '3.1119.0',
-    '@aws-sdk/credential-providers': '3.1119.0',
+    '@aws-sdk/client-dynamodb': '3.1121.0',
+    '@aws-sdk/client-api-gateway': '3.1121.0',
+    '@aws-sdk/client-iam': '3.1121.0',
+    '@aws-sdk/client-bedrock-agentcore': '3.1121.0',
+    '@aws-sdk/client-bedrock-runtime': '3.1121.0',
+    '@aws-sdk/client-s3': '3.1121.0',
+    '@aws-sdk/client-sts': '3.1121.0',
+    '@aws-sdk/credential-providers': '3.1121.0',
     '@aws-sdk/credential-provider-cognito-identity': '3.972.69',
-    '@aws-sdk/client-secrets-manager': '3.1119.0',
-    '@aws-sdk/rds-signer': '3.1119.0',
+    '@aws-sdk/client-secrets-manager': '3.1121.0',
+    '@aws-sdk/rds-signer': '3.1121.0',
     '@smithy/server-apigateway': '0.3.3',
     '@smithy/server-node': '0.3.3',
     '@aws-lambda-powertools/logger': '2.35.0',
@@ -34,8 +34,8 @@
     '@aws-lambda-powertools/parameters': '2.35.0',
     '@aws-lambda-powertools/tracer': '2.35.0',
     '@aws-lambda-powertools/parser': '2.35.0',
-    '@aws-sdk/client-appconfigdata': '3.1119.0',
-    '@middy/core': '7.8.0',
+    '@aws-sdk/client-appconfigdata': '3.1121.0',
+    '@middy/core': '7.9.2',
     '@nxlv/python': '23.0.0',
     '@nx-extend/terraform': '10.4.1',
     // These must all hold the same version — see NX_PACKAGES.
@@ -57,20 +57,20 @@
     '@ag-ui/core': '0.0.57',
     '@ag-ui/encoder': '0.0.57',
     'agent-chat-cli': '0.3.0',
-    '@copilotkit/react-core': '1.69.2',
+    '@copilotkit/react-core': '1.69.3',
     rxjs: '7.8.2',
-    '@strands-agents/sdk': '1.14.0',
+    '@strands-agents/sdk': '1.15.0',
     '@tanstack/react-router': '1.170.32',
     '@tanstack/router-plugin': '1.168.35',
     '@tanstack/router-generator': '1.167.33',
     '@tanstack/virtual-file-routes': '1.162.0',
     '@tanstack/router-utils': '1.162.2',
-    '@cloudscape-design/board-components': '3.0.220',
-    '@cloudscape-design/chat-components': '1.0.164',
-    '@cloudscape-design/components': '3.0.1354',
+    '@cloudscape-design/board-components': '3.0.221',
+    '@cloudscape-design/chat-components': '1.0.165',
+    '@cloudscape-design/components': '3.0.1356',
     '@cloudscape-design/global-styles': '1.0.67',
-    '@tanstack/react-query': '5.102.6',
-    '@tanstack/react-query-devtools': '5.102.6',
+    '@tanstack/react-query': '5.102.8',
+    '@tanstack/react-query-devtools': '5.102.8',
     '@trpc/tanstack-react-query': '11.18.0',
     '@trpc/client': '11.18.0',
     '@trpc/server': '11.18.0',
@@ -87,12 +87,12 @@
     '@vitest/coverage-v8': '4.1.11',
     '@vitest/ui': '4.1.11',
     '@astrojs/react': '6.0.4',
-    '@astrojs/starlight': '0.41.9',
-    astro: '7.2.8',
+    '@astrojs/starlight': '0.41.10',
+    astro: '7.2.9',
     cookie: '2.0.1',
     aws4fetch: '1.0.20',
     'aws-cdk': '2.1139.0',
-    'aws-cdk-lib': '2.266.0',
+    'aws-cdk-lib': '2.267.0',
     'aws-xray-sdk-core': '3.12.0',
     constructs: '10.8.1',
     cors: '2.8.6',
@@ -105,7 +105,7 @@
     esbuild: '0.28.2',
     'event-source-polyfill': '1.0.31',
     '@types/event-source-polyfill': '1.0.5',
-    '@biomejs/biome': '2.5.10',
+    '@biomejs/biome': '2.5.11',
     '@prisma/adapter-mariadb': '7.10.0',
     '@prisma/adapter-pg': '7.10.0',
     '@prisma/client': '7.10.0',
@@ -130,14 +130,14 @@
     'react-dom': '19.2.8',
     rimraf: '6.1.3',
     rolldown: '1.2.6',
-    'rolldown-plugin-dts': '0.28.2',
+    'rolldown-plugin-dts': '0.28.3',
     'simple-git': '3.36.0',
     'source-map-support': '0.5.21',
     'starlight-blog': '0.29.0',
     tailwindcss: '4.3.3',
     '@tailwindcss/vite': '4.3.3',
     tsx: '4.23.12',
-    'lucide-react': '1.34.0',
+    'lucide-react': '1.37.0',
     'radix-ui': '1.6.7',
     shadcn: '4.19.0',
     'tw-animate-css': '1.4.0',
@@ -145,7 +145,7 @@
     vite: '8.2.2',
     typescript: '6.0.3',
     vitest: '4.1.11',
-    zod: '4.4.3',
+    zod: '4.5.4',
     ws: '8.21.3'
 };
 /**
@@ -192,8 +192,8 @@
     'aws-lambda-powertools[parser]': '==3.34.0',
     'aws-opentelemetry-distro': '==0.19.0',
     'bedrock-agentcore': '==1.22.0',
-    boto3: '==1.43.82',
-    checkov: '==3.3.15',
+    boto3: '==1.43.83',
+    checkov: '==3.3.16',
     fastapi: '==0.141.1',
     'fastapi[standard]': '==0.141.1',
     httpx: '==0.28.1',
@@ -206,14 +206,14 @@
     mcp: '==1.28.1',
     'pip-check-updates': '==0.29.0',
     'pip-licenses': '==5.5.5',
-    ruff: '==0.16.4',
+    ruff: '==0.16.5',
     'strands-agents': '==1.54.0',
     'strands-agents[a2a]': '==1.54.0',
-    'strands-agents-tools': '==0.8.6',
+    'strands-agents-tools': '==0.8.7',
     ty: '==0.0.75',
     pynamodb: '==6.1.0',
     uvicorn: '==0.52.4',
-    sqlmodel: '==0.0.39',
+    sqlmodel: '==0.0.42',
     alembic: '==1.19.1',
     aiomysql: '==0.3.2',
     asyncpg: '==0.31.0',

package/src/utils/versions.js.map CHANGED Viewed

	@@ -1 +1 @@
1	- {"version":3,"sources":["../../../../../packages/nx-plugin/src/utils/versions.ts"],"sourcesContent":["/*\n Copyright Amazon.com, Inc. or its affiliates. All Rights Reserved.\n * SPDX-License-Identifier: Apache-2.0\n /\nimport {\n type DeclaredPy,\n type DeclaredTs,\n type DependencyDeclaration,\n declaredNames,\n} from './declared-dependencies.js';\n\n/\n Versons for TypeScript dependencies added by generators\n /\nexport const TS_VERSIONS = {\n '@a2a-js/sdk': '0.3.14',\n '@aws/aws-distro-opentelemetry-node-autoinstrumentation': '0.12.0',\n // Pinned above the version the ADOT autoinstrumentation package resolves\n // transitively (2.8.0) to clear CVE-2026-59892 (HIGH).\n '@opentelemetry/propagator-jaeger': '2.10.0',\n // Overridden in the vended agent/MCP image builds to clear CVE-2026-14257\n // (HIGH) in brace-expansion: minimatch 10 is the lowest major depending on\n // brace-expansion 5.x, the only line Trivy's `< 5.0.8` advisory range treats\n // as fixed. Overriding brace-expansion directly is not viable — 5.x drops the\n // CommonJS default export that minimatch 9 calls.\n minimatch: '10.2.6',\n '@aws-sdk/client-dynamodb': '3.1119.0',\n '@aws-sdk/client-api-gateway': '3.1119.0',\n '@aws-sdk/client-iam': '3.1119.0',\n '@aws-sdk/client-bedrock-agentcore': '3.1119.0',\n '@aws-sdk/client-bedrock-runtime': '3.1119.0',\n '@aws-sdk/client-s3': '3.1119.0',\n '@aws-sdk/client-sts': '3.1119.0',\n '@aws-sdk/credential-providers': '3.1119.0',\n '@aws-sdk/credential-provider-cognito-identity': '3.972.69',\n '@aws-sdk/client-secrets-manager': '3.1119.0',\n '@aws-sdk/rds-signer': '3.1119.0',\n '@smithy/server-apigateway': '0.3.3',\n '@smithy/server-node': '0.3.3',\n '@aws-lambda-powertools/logger': '2.35.0',\n '@aws-lambda-powertools/metrics': '2.35.0',\n '@aws-lambda-powertools/parameters': '2.35.0',\n '@aws-lambda-powertools/tracer': '2.35.0',\n '@aws-lambda-powertools/parser': '2.35.0',\n '@aws-sdk/client-appconfigdata': '3.1119.0',\n '@middy/core': '7.8.0',\n '@nxlv/python': '23.0.0',\n '@nx-extend/terraform': '10.4.1',\n // These must all hold the same version — see NX_PACKAGES.\n nx: '23.1.2',\n '@nx/devkit': '23.1.2',\n '@nx/js': '23.1.2',\n '@nx/react': '23.1.2',\n '@nx/vite': '23.1.2',\n '@nx/vitest': '23.1.2',\n '@nx/workspace': '23.1.2',\n 'create-nx-workspace': '23.1.2',\n '@swc-node/register': '1.12.1',\n '@swc/core': '1.16.1',\n '@modelcontextprotocol/sdk': '1.30.0',\n '@modelcontextprotocol/inspector': '2.4.0',\n '@ag-ui/a2ui-toolkit': '0.0.4',\n '@ag-ui/aws-strands': '0.2.3',\n '@ag-ui/client': '0.0.57',\n '@ag-ui/core': '0.0.57',\n '@ag-ui/encoder': '0.0.57',\n 'agent-chat-cli': '0.3.0',\n '@copilotkit/react-core': '1.69.2',\n rxjs: '7.8.2',\n '@strands-agents/sdk': '1.14.0',\n '@tanstack/react-router': '1.170.32',\n '@tanstack/router-plugin': '1.168.35',\n '@tanstack/router-generator': '1.167.33',\n '@tanstack/virtual-file-routes': '1.162.0',\n '@tanstack/router-utils': '1.162.2',\n '@cloudscape-design/board-components': '3.0.220',\n '@cloudscape-design/chat-components': '1.0.164',\n '@cloudscape-design/components': '3.0.1354',\n '@cloudscape-design/global-styles': '1.0.67',\n '@tanstack/react-query': '5.102.6',\n '@tanstack/react-query-devtools': '5.102.6',\n '@trpc/tanstack-react-query': '11.18.0',\n '@trpc/client': '11.18.0',\n '@trpc/server': '11.18.0',\n '@types/node': '26.4.0',\n '@types/aws-lambda': '8.10.162',\n '@types/cors': '2.8.19',\n '@types/pg': '8.23.1',\n '@types/ws': '8.18.1',\n '@types/express': '5.0.6',\n '@smithy/config-resolver': '4.7.2',\n '@smithy/node-config-provider': '4.6.2',\n '@smithy/node-http-handler': '4.11.3',\n '@smithy/types': '4.17.2',\n '@vitest/coverage-v8': '4.1.11',\n '@vitest/ui': '4.1.11',\n '@astrojs/react': '6.0.4',\n '@astrojs/starlight': '0.41.9',\n astro: '7.2.8',\n cookie: '2.0.1',\n aws4fetch: '1.0.20',\n 'aws-cdk': '2.1139.0',\n 'aws-cdk-lib': '2.266.0',\n 'aws-xray-sdk-core': '3.12.0',\n constructs: '10.8.1',\n cors: '2.8.6',\n chalk: '6.0.0',\n 'class-variance-authority': '0.7.1',\n clsx: '2.1.1',\n commander: '15.0.0',\n 'cpy-cli': '7.0.0',\n electrodb: '3.9.3',\n esbuild: '0.28.2',\n 'event-source-polyfill': '1.0.31',\n '@types/event-source-polyfill': '1.0.5',\n '@biomejs/biome': '2.5.10',\n '@prisma/adapter-mariadb': '7.10.0',\n '@prisma/adapter-pg': '7.10.0',\n '@prisma/client': '7.10.0',\n ejs: '6.0.1',\n '@types/ejs': '3.1.5',\n express: '5.2.1',\n 'fast-glob': '3.3.3',\n husky: '9.1.7',\n 'fs-extra': '11.4.0',\n '@types/fs-extra': '11.0.4',\n 'make-dir-cli': '4.0.0',\n mariadb: '3.5.3',\n mise: '2026.8.14',\n ncp: '2.0.0',\n npm: '12.0.2',\n 'npm-check-updates': '23.1.0',\n 'oidc-client-ts': '3.5.0',\n pg: '8.23.0',\n prisma: '7.10.0',\n 'react-oidc-context': '3.3.1',\n react: '19.2.8',\n 'react-dom': '19.2.8',\n rimraf: '6.1.3',\n rolldown: '1.2.6',\n 'rolldown-plugin-dts': '0.28.2',\n 'simple-git': '3.36.0',\n 'source-map-support': '0.5.21',\n 'starlight-blog': '0.29.0',\n tailwindcss: '4.3.3',\n '@tailwindcss/vite': '4.3.3',\n tsx: '4.23.12',\n 'lucide-react': '1.34.0',\n 'radix-ui': '1.6.7',\n shadcn: '4.19.0',\n 'tw-animate-css': '1.4.0',\n 'tailwind-merge': '3.6.0',\n vite: '8.2.2',\n typescript: '6.0.3',\n vitest: '4.1.11',\n zod: '4.4.3',\n ws: '8.21.3',\n} as const;\nexport type ITsDepVersion = keyof typeof TS_VERSIONS;\n\n/\n Add versions to the given dependencies, which the declaration must own.\n \n @param declaration the calling generator's `DEPENDENCIES`\n /\nexport const withVersions = <D extends DependencyDeclaration>(\n declaration: D,\n deps: readonly DeclaredTs<D>[],\n): Record<string, string> => {\n assertDeclared(declaration.ts, deps, 'ts');\n return Object.fromEntries(\n deps.map((dep) => [dep, TS_VERSIONS[dep as ITsDepVersion]]),\n );\n};\n\n/\n The `nx` and `@nx/` packages a generated workspace pins, all of which must\n hold the same version: a workspace nx even a patch apart hoists a second\n * nested nx, and the two deadlock `nx sync`.\n \n Bumping them in a user's workspace requires `packageJsonUpdates` rather than a\n * migration — see `version-upgrade-migration/nx-package-updates.ts`.\n /\nexport const NX_PACKAGES = [\n 'nx',\n '@nx/devkit',\n '@nx/js',\n '@nx/react',\n '@nx/vite',\n '@nx/vitest',\n '@nx/workspace',\n] as const satisfies readonly ITsDepVersion[];\n\n/\n The nx version the plugin is built against, and the single source of truth\n * for every place a workspace's nx is pinned.\n /\nexport const NX_VERSION = TS_VERSIONS.nx;\n\n/\n Versions for Python dependencies added by generators\n /\nexport const PY_VERSIONS = {\n 'a2a-sdk': '==0.3.26',\n 'ag-ui-langgraph': '==0.0.44',\n 'ag-ui-protocol': '==0.1.21',\n 'ag-ui-strands': '==0.3.0',\n aiosqlite: '==0.22.1',\n 'aws-lambda-powertools': '==3.34.0',\n 'aws-lambda-powertools[tracer]': '==3.34.0',\n 'aws-lambda-powertools[parser]': '==3.34.0',\n 'aws-opentelemetry-distro': '==0.19.0',\n 'bedrock-agentcore': '==1.22.0',\n boto3: '==1.43.82',\n checkov: '==3.3.15',\n fastapi: '==0.141.1',\n 'fastapi[standard]': '==0.141.1',\n httpx: '==0.28.1',\n langchain: '==1.3.18',\n 'langchain-aws': '==1.7.4',\n 'langchain-mcp-adapters': '==0.3.2',\n langgraph: '==1.2.11',\n 'langgraph-checkpoint-aws': '==1.2.2',\n 'langgraph-checkpoint-sqlite': '==3.1.1',\n mcp: '==1.28.1',\n 'pip-check-updates': '==0.29.0',\n 'pip-licenses': '==5.5.5',\n ruff: '==0.16.4',\n 'strands-agents': '==1.54.0',\n 'strands-agents[a2a]': '==1.54.0',\n 'strands-agents-tools': '==0.8.6',\n ty: '==0.0.75',\n pynamodb: '==6.1.0',\n uvicorn: '==0.52.4',\n sqlmodel: '==0.0.39',\n alembic: '==1.19.1',\n aiomysql: '==0.3.2',\n asyncpg: '==0.31.0',\n // Pinned explicitly: SQLAlchemy's async engine pulls greenlet transitively,\n // and leaving it unpinned lets uv resolve to a just-released version whose\n // platform wheels may not all be published yet (breaking aarch64 installs).\n greenlet: '==3.5.5',\n} as const;\nexport type IPyDepVersion = keyof typeof PY_VERSIONS;\n\n/\n Add versions to the given dependencies\n /\nexport const withPyVersions = <D extends DependencyDeclaration>(\n declaration: D,\n deps: readonly DeclaredPy<D>[],\n): string[] => {\n assertDeclared(declaration.py, deps, 'py');\n return deps.map((dep) => `${dep}${PY_VERSIONS[dep as IPyDepVersion]}`);\n};\n\n/* Catches undeclared packages that reach here past the type checker. /\nconst assertDeclared = (\n declared: readonly { readonly name: string }[],\n deps: readonly unknown[],\n kind: 'ts' \| 'py',\n): void => {\n const names = declaredNames(declared);\n const undeclared = deps.filter((dep) => !names.includes(dep as string));\n if (undeclared.length > 0) {\n throw new Error(\n `Undeclared ${kind} dependencies: ${undeclared.join(', ')}. Add them to the generator's declareDependencies({ ${kind}: [...] }).`,\n );\n }\n};\n\n/\n Versions for vendored tools\n /\nexport const VENDORED_VERSIONS = {\n 'git-secrets': '1.3.0',\n} as const;\n\n/\n Versions of Java dependencies added by generators, keyed by Maven coordinate.\n \n Every entry is resolved from Maven Central by the version update and named\n * `<group>:<artifact>:<version>` where a generator writes it.\n /\nexport const JAVA_VERSIONS = {\n 'software.amazon.smithy:smithy-model': '1.73.0',\n 'software.amazon.smithy:smithy-aws-traits': '1.73.0',\n 'software.amazon.smithy:smithy-validation-model': '1.73.0',\n 'software.amazon.smithy:smithy-openapi': '1.73.0',\n 'software.amazon.smithy.typescript:smithy-aws-typescript-codegen': '0.53.0',\n} as const;\nexport type IJavaVersion = keyof typeof JAVA_VERSIONS;\n\n/* The Maven coordinates the version update resolves, in declaration order. /\nexport const JAVA_ARTIFACTS = Object.keys(JAVA_VERSIONS) as IJavaVersion[];\n\n/* A Maven coordinate as a dependency names it: `<group>:<artifact>:<version>`. /\nexport const javaMavenDependency = (artifact: IJavaVersion): string =>\n `${artifact}:${JAVA_VERSIONS[artifact]}`;\n\n/\n Versions of tools resolved by mise, keyed by the tool name mise knows.\n \n Every entry is checked with `mise latest <tool>` by the version update. Nothing\n * is installed into the workspace: the pin travels in the `project.json` target\n * command, which is what the version sync reaches to move it forward.\n /\nexport const MISE_VERSIONS = {\n smithy: '1.73.0',\n} as const;\nexport type IMiseVersion = keyof typeof MISE_VERSIONS;\n\n/* The tools the version update resolves through mise, in declaration order. /\nexport const MISE_TOOLS = Object.keys(MISE_VERSIONS) as IMiseVersion[];\n\n/\n Base container images used by generated Dockerfiles. Pinned exactly so\n * generated images are reproducible, and chosen to be free of known\n * HIGH/CRITICAL vulnerabilities at time of generation.\n /\nexport const BASE_IMAGES = {\n node: 'public.ecr.aws/docker/library/node:lts-slim',\n python: 'public.ecr.aws/docker/library/python:3.14-slim',\n} as const;\n\n/\n Versions for container tooling used by generated image build/scan targets.\n * Pinned exactly so generated images are reproducible.\n /\nexport const CONTAINER_VERSIONS = {\n // ECR-hosted Trivy image used to scan built images during the build.\n trivy: '0.72.0',\n} as const;\n\n/\n Repository each pinned tool image is pulled from, keyed as\n * {@link CONTAINER_VERSIONS}. Kept beside the versions so a tool added here is\n * one entry rather than a reference built somewhere else, which is also what\n * lets the version sync find these pins wherever a target command runs them.\n /\nexport const CONTAINER_REPOSITORIES = {\n trivy: 'public.ecr.aws/aquasecurity/trivy',\n} as const satisfies Record<keyof typeof CONTAINER_VERSIONS, string>;\n\n/* The pinned reference for a tool image, as a target command runs it. /\nexport const containerImage = (tool: keyof typeof CONTAINER_VERSIONS): string =>\n `${CONTAINER_REPOSITORIES[tool]}:${CONTAINER_VERSIONS[tool]}`;\n\n/\n The managed Lambda runtimes generated infrastructure targets, as the single\n * source both IaC providers derive from.\n \n CDK and Terraform name the same runtime differently — `Runtime.NODEJS_24_X`\n * against `nodejs24.x` — so deriving both from the version here keeps a bump one\n * edit that moves them together. Resolved by the version update workflow.\n /\nexport const LAMBDA_RUNTIME_VERSIONS = {\n node: '24',\n python: '3.14',\n} as const;\nexport type ILambdaRuntime = keyof typeof LAMBDA_RUNTIME_VERSIONS;\n\n/\n The interpreter uv pins for a generated Python project, as the Lambda runtime's\n * `major.minor`.\n \n No patch: uv reads this as a request for any patch of that minor, so it resolves\n * whichever one the platform has a build for. Naming an exact patch pins one that\n * may not exist everywhere, and Lambda patches the interpreter itself, so the minor\n * is the whole of what a project needs to agree on.\n /\nexport const pyenvPythonVersion = (): string => LAMBDA_RUNTIME_VERSIONS.python;\n\n/\n The `[project].requires-python` specifier for a generated Python project.\n \n A lower bound on the Lambda runtime's `major.minor`: the deployed interpreter\n * is that version, and Ruff derives its `target-version` from this (`py314`), so\n * lint targets the same version the function runs on.\n /\nexport const pyprojectPythonDependency = (): string =>\n `>=${LAMBDA_RUNTIME_VERSIONS.python}`;\n\n/* The runtime as Terraform's `runtime` attribute names it, e.g. `nodejs24.x`. /\nexport const terraformLambdaRuntime = (runtime: ILambdaRuntime): string =>\n runtime === 'node'\n ? `nodejs${LAMBDA_RUNTIME_VERSIONS.node}.x`\n : `python${LAMBDA_RUNTIME_VERSIONS.python}`;\n\n/\n The runtime as an `aws-cdk-lib` `Runtime` member, e.g. `Runtime.NODEJS_24_X`.\n * Always an explicitly versioned member, never a `_LATEST` alias.\n /\nexport const cdkLambdaRuntime = (runtime: ILambdaRuntime): string =>\n runtime === 'node'\n ? `Runtime.NODEJS_${LAMBDA_RUNTIME_VERSIONS.node}_X`\n : `Runtime.PYTHON_${LAMBDA_RUNTIME_VERSIONS.python.replace('.', '_')}`;\n\n/\n Substitution variables exposing the pinned runtimes to generated CDK\n * templates (e.g. `runtime: <%- nodeRuntime %>`). Paired with\n * {@link terraformLambdaRuntimeVars}, which names the same variables so a\n * template reads alike under either provider.\n /\nexport const cdkLambdaRuntimeVars = () => ({\n nodeRuntime: cdkLambdaRuntime('node'),\n pythonRuntime: cdkLambdaRuntime('python'),\n});\n\n/\n Substitution variables exposing the pinned runtimes to generated `.tf`\n * templates (e.g. `runtime = \"<%- nodeRuntime %>\"`).\n /\nexport const terraformLambdaRuntimeVars = () => ({\n nodeRuntime: terraformLambdaRuntime('node'),\n pythonRuntime: terraformLambdaRuntime('python'),\n});\n\n/\n Exact versions for Terraform providers used by generated `.tf` modules.\n * Pinned exactly (no range operator) so generated infrastructure is reproducible.\n /\nexport const TERRAFORM_VERSIONS = {\n aws: '6.62.0',\n random: '3.9.0',\n null: '3.3.1',\n archive: '2.8.0',\n external: '2.4.1',\n local: '2.9.0',\n time: '0.14.1',\n} as const;\nexport type ITerraformProviderVersion = keyof typeof TERRAFORM_VERSIONS;\n\n/\n Substitution variables exposing Terraform provider version constraints to\n * generated `.tf` templates (e.g. `version = \"<%- awsProviderVersion %>\"`)\n */\nexport const terraformProviderVersions = () => ({\n awsProviderVersion: TERRAFORM_VERSIONS.aws,\n randomProviderVersion: TERRAFORM_VERSIONS.random,\n nullProviderVersion: TERRAFORM_VERSIONS.null,\n archiveProviderVersion: TERRAFORM_VERSIONS.archive,\n externalProviderVersion: TERRAFORM_VERSIONS.external,\n localProviderVersion: TERRAFORM_VERSIONS.local,\n timeProviderVersion: TERRAFORM_VERSIONS.time,\n});\n"],"names":["declaredNames","TS_VERSIONS","minimatch","nx","rxjs","astro","cookie","aws4fetch","constructs","cors","chalk","clsx","commander","electrodb","esbuild","ejs","express","husky","mariadb","mise","ncp","npm","pg","prisma","react","rimraf","rolldown","tailwindcss","tsx","shadcn","vite","typescript","vitest","zod","ws","withVersions","declaration","deps","assertDeclared","ts","Object","fromEntries","map","dep","NX_PACKAGES","NX_VERSION","PY_VERSIONS","aiosqlite","boto3","checkov","fastapi","httpx","langchain","langgraph","mcp","ruff","ty","pynamodb","uvicorn","sqlmodel","alembic","aiomysql","asyncpg","greenlet","withPyVersions","py","declared","kind","names","undeclared","filter","includes","length","Error","join","VENDORED_VERSIONS","JAVA_VERSIONS","JAVA_ARTIFACTS","keys","javaMavenDependency","artifact","MISE_VERSIONS","smithy","MISE_TOOLS","BASE_IMAGES","node","python","CONTAINER_VERSIONS","trivy","CONTAINER_REPOSITORIES","containerImage","tool","LAMBDA_RUNTIME_VERSIONS","pyenvPythonVersion","pyprojectPythonDependency","terraformLambdaRuntime","runtime","cdkLambdaRuntime","replace","cdkLambdaRuntimeVars","nodeRuntime","pythonRuntime","terraformLambdaRuntimeVars","TERRAFORM_VERSIONS","aws","random","null","archive","external","local","time","terraformProviderVersions","awsProviderVersion","randomProviderVersion","nullProviderVersion","archiveProviderVersion","externalProviderVersion","localProviderVersion","timeProviderVersion"],"mappings":"AAAA;;;CAGC,GACD,SAIEA,aAAa,QACR,6BAA6B;AAEpC;;CAEC,GACD,OAAO,MAAMC,cAAc;IACzB,eAAe;IACf,0DAA0D;IAC1D,yEAAyE;IACzE,uDAAuD;IACvD,oCAAoC;IACpC,0EAA0E;IAC1E,2EAA2E;IAC3E,6EAA6E;IAC7E,8EAA8E;IAC9E,kDAAkD;IAClDC,WAAW;IACX,4BAA4B;IAC5B,+BAA+B;IAC/B,uBAAuB;IACvB,qCAAqC;IACrC,mCAAmC;IACnC,sBAAsB;IACtB,uBAAuB;IACvB,iCAAiC;IACjC,iDAAiD;IACjD,mCAAmC;IACnC,uBAAuB;IACvB,6BAA6B;IAC7B,uBAAuB;IACvB,iCAAiC;IACjC,kCAAkC;IAClC,qCAAqC;IACrC,iCAAiC;IACjC,iCAAiC;IACjC,iCAAiC;IACjC,eAAe;IACf,gBAAgB;IAChB,wBAAwB;IACxB,0DAA0D;IAC1DC,IAAI;IACJ,cAAc;IACd,UAAU;IACV,aAAa;IACb,YAAY;IACZ,cAAc;IACd,iBAAiB;IACjB,uBAAuB;IACvB,sBAAsB;IACtB,aAAa;IACb,6BAA6B;IAC7B,mCAAmC;IACnC,uBAAuB;IACvB,sBAAsB;IACtB,iBAAiB;IACjB,eAAe;IACf,kBAAkB;IAClB,kBAAkB;IAClB,0BAA0B;IAC1BC,MAAM;IACN,uBAAuB;IACvB,0BAA0B;IAC1B,2BAA2B;IAC3B,8BAA8B;IAC9B,iCAAiC;IACjC,0BAA0B;IAC1B,uCAAuC;IACvC,sCAAsC;IACtC,iCAAiC;IACjC,oCAAoC;IACpC,yBAAyB;IACzB,kCAAkC;IAClC,8BAA8B;IAC9B,gBAAgB;IAChB,gBAAgB;IAChB,eAAe;IACf,qBAAqB;IACrB,eAAe;IACf,aAAa;IACb,aAAa;IACb,kBAAkB;IAClB,2BAA2B;IAC3B,gCAAgC;IAChC,6BAA6B;IAC7B,iBAAiB;IACjB,uBAAuB;IACvB,cAAc;IACd,kBAAkB;IAClB,sBAAsB;IACtBC,OAAO;IACPC,QAAQ;IACRC,WAAW;IACX,WAAW;IACX,eAAe;IACf,qBAAqB;IACrBC,YAAY;IACZC,MAAM;IACNC,OAAO;IACP,4BAA4B;IAC5BC,MAAM;IACNC,WAAW;IACX,WAAW;IACXC,WAAW;IACXC,SAAS;IACT,yBAAyB;IACzB,gCAAgC;IAChC,kBAAkB;IAClB,2BAA2B;IAC3B,sBAAsB;IACtB,kBAAkB;IAClBC,KAAK;IACL,cAAc;IACdC,SAAS;IACT,aAAa;IACbC,OAAO;IACP,YAAY;IACZ,mBAAmB;IACnB,gBAAgB;IAChBC,SAAS;IACTC,MAAM;IACNC,KAAK;IACLC,KAAK;IACL,qBAAqB;IACrB,kBAAkB;IAClBC,IAAI;IACJC,QAAQ;IACR,sBAAsB;IACtBC,OAAO;IACP,aAAa;IACbC,QAAQ;IACRC,UAAU;IACV,uBAAuB;IACvB,cAAc;IACd,sBAAsB;IACtB,kBAAkB;IAClBC,aAAa;IACb,qBAAqB;IACrBC,KAAK;IACL,gBAAgB;IAChB,YAAY;IACZC,QAAQ;IACR,kBAAkB;IAClB,kBAAkB;IAClBC,MAAM;IACNC,YAAY;IACZC,QAAQ;IACRC,KAAK;IACLC,IAAI;AACN,EAAW;AAGX;;;;CAIC,GACD,OAAO,MAAMC,eAAe,CAC1BC,aACAC;IAEAC,eAAeF,YAAYG,EAAE,EAAEF,MAAM;IACrC,OAAOG,OAAOC,WAAW,CACvBJ,KAAKK,GAAG,CAAC,CAACC,MAAQ;YAACA;YAAK1C,WAAW,CAAC0C,IAAqB;SAAC;AAE9D,EAAE;AAEF;;;;;;;CAOC,GACD,OAAO,MAAMC,cAAc;IACzB;IACA;IACA;IACA;IACA;IACA;IACA;CACD,CAA6C;AAE9C;;;CAGC,GACD,OAAO,MAAMC,aAAa5C,YAAYE,EAAE,CAAC;AAEzC;;CAEC,GACD,OAAO,MAAM2C,cAAc;IACzB,WAAW;IACX,mBAAmB;IACnB,kBAAkB;IAClB,iBAAiB;IACjBC,WAAW;IACX,yBAAyB;IACzB,iCAAiC;IACjC,iCAAiC;IACjC,4BAA4B;IAC5B,qBAAqB;IACrBC,OAAO;IACPC,SAAS;IACTC,SAAS;IACT,qBAAqB;IACrBC,OAAO;IACPC,WAAW;IACX,iBAAiB;IACjB,0BAA0B;IAC1BC,WAAW;IACX,4BAA4B;IAC5B,+BAA+B;IAC/BC,KAAK;IACL,qBAAqB;IACrB,gBAAgB;IAChBC,MAAM;IACN,kBAAkB;IAClB,uBAAuB;IACvB,wBAAwB;IACxBC,IAAI;IACJC,UAAU;IACVC,SAAS;IACTC,UAAU;IACVC,SAAS;IACTC,UAAU;IACVC,SAAS;IACT,4EAA4E;IAC5E,2EAA2E;IAC3E,4EAA4E;IAC5EC,UAAU;AACZ,EAAW;AAGX;;CAEC,GACD,OAAO,MAAMC,iBAAiB,CAC5B5B,aACAC;IAEAC,eAAeF,YAAY6B,EAAE,EAAE5B,MAAM;IACrC,OAAOA,KAAKK,GAAG,CAAC,CAACC,MAAQ,GAAGA,MAAMG,WAAW,CAACH,IAAqB,EAAE;AACvE,EAAE;AAEF,uEAAuE,GACvE,MAAML,iBAAiB,CACrB4B,UACA7B,MACA8B;IAEA,MAAMC,QAAQpE,cAAckE;IAC5B,MAAMG,aAAahC,KAAKiC,MAAM,CAAC,CAAC3B,MAAQ,CAACyB,MAAMG,QAAQ,CAAC5B;IACxD,IAAI0B,WAAWG,MAAM,GAAG,GAAG;QACzB,MAAM,IAAIC,MACR,CAAC,WAAW,EAAEN,KAAK,eAAe,EAAEE,WAAWK,IAAI,CAAC,MAAM,oDAAoD,EAAEP,KAAK,WAAW,CAAC;IAErI;AACF;AAEA;;CAEC,GACD,OAAO,MAAMQ,oBAAoB;IAC/B,eAAe;AACjB,EAAW;AAEX;;;;;CAKC,GACD,OAAO,MAAMC,gBAAgB;IAC3B,uCAAuC;IACvC,4CAA4C;IAC5C,kDAAkD;IAClD,yCAAyC;IACzC,mEAAmE;AACrE,EAAW;AAGX,6EAA6E,GAC7E,OAAO,MAAMC,iBAAiBrC,OAAOsC,IAAI,CAACF,eAAiC;AAE3E,iFAAiF,GACjF,OAAO,MAAMG,sBAAsB,CAACC,WAClC,GAAGA,SAAS,CAAC,EAAEJ,aAAa,CAACI,SAAS,EAAE,CAAC;AAE3C;;;;;;CAMC,GACD,OAAO,MAAMC,gBAAgB;IAC3BC,QAAQ;AACV,EAAW;AAGX,8EAA8E,GAC9E,OAAO,MAAMC,aAAa3C,OAAOsC,IAAI,CAACG,eAAiC;AAEvE;;;;CAIC,GACD,OAAO,MAAMG,cAAc;IACzBC,MAAM;IACNC,QAAQ;AACV,EAAW;AAEX;;;CAGC,GACD,OAAO,MAAMC,qBAAqB;IAChC,qEAAqE;IACrEC,OAAO;AACT,EAAW;AAEX;;;;;CAKC,GACD,OAAO,MAAMC,yBAAyB;IACpCD,OAAO;AACT,EAAqE;AAErE,wEAAwE,GACxE,OAAO,MAAME,iBAAiB,CAACC,OAC7B,GAAGF,sBAAsB,CAACE,KAAK,CAAC,CAAC,EAAEJ,kBAAkB,CAACI,KAAK,EAAE,CAAC;AAEhE;;;;;;;CAOC,GACD,OAAO,MAAMC,0BAA0B;IACrCP,MAAM;IACNC,QAAQ;AACV,EAAW;AAGX;;;;;;;;CAQC,GACD,OAAO,MAAMO,qBAAqB,IAAcD,wBAAwBN,MAAM,CAAC;AAE/E;;;;;;CAMC,GACD,OAAO,MAAMQ,4BAA4B,IACvC,CAAC,EAAE,EAAEF,wBAAwBN,MAAM,EAAE,CAAC;AAExC,gFAAgF,GAChF,OAAO,MAAMS,yBAAyB,CAACC,UACrCA,YAAY,SACR,CAAC,MAAM,EAAEJ,wBAAwBP,IAAI,CAAC,EAAE,CAAC,GACzC,CAAC,MAAM,EAAEO,wBAAwBN,MAAM,EAAE,CAAC;AAEhD;;;CAGC,GACD,OAAO,MAAMW,mBAAmB,CAACD,UAC/BA,YAAY,SACR,CAAC,eAAe,EAAEJ,wBAAwBP,IAAI,CAAC,EAAE,CAAC,GAClD,CAAC,eAAe,EAAEO,wBAAwBN,MAAM,CAACY,OAAO,CAAC,KAAK,MAAM,CAAC;AAE3E;;;;;CAKC,GACD,OAAO,MAAMC,uBAAuB,IAAO,CAAA;QACzCC,aAAaH,iBAAiB;QAC9BI,eAAeJ,iBAAiB;IAClC,CAAA,EAAG;AAEH;;;CAGC,GACD,OAAO,MAAMK,6BAA6B,IAAO,CAAA;QAC/CF,aAAaL,uBAAuB;QACpCM,eAAeN,uBAAuB;IACxC,CAAA,EAAG;AAEH;;;CAGC,GACD,OAAO,MAAMQ,qBAAqB;IAChCC,KAAK;IACLC,QAAQ;IACRC,MAAM;IACNC,SAAS;IACTC,UAAU;IACVC,OAAO;IACPC,MAAM;AACR,EAAW;AAGX;;;CAGC,GACD,OAAO,MAAMC,4BAA4B,IAAO,CAAA;QAC9CC,oBAAoBT,mBAAmBC,GAAG;QAC1CS,uBAAuBV,mBAAmBE,MAAM;QAChDS,qBAAqBX,mBAAmBG,IAAI;QAC5CS,wBAAwBZ,mBAAmBI,OAAO;QAClDS,yBAAyBb,mBAAmBK,QAAQ;QACpDS,sBAAsBd,mBAAmBM,KAAK;QAC9CS,qBAAqBf,mBAAmBO,IAAI;IAC9C,CAAA,EAAG"}
1	+ {"version":3,"sources":["../../../../../packages/nx-plugin/src/utils/versions.ts"],"sourcesContent":["/*\n Copyright Amazon.com, Inc. or its affiliates. All Rights Reserved.\n * SPDX-License-Identifier: Apache-2.0\n /\nimport {\n type DeclaredPy,\n type DeclaredTs,\n type DependencyDeclaration,\n declaredNames,\n} from './declared-dependencies.js';\n\n/\n Versons for TypeScript dependencies added by generators\n /\nexport const TS_VERSIONS = {\n '@a2a-js/sdk': '0.3.14',\n '@aws/aws-distro-opentelemetry-node-autoinstrumentation': '0.12.0',\n // Pinned above the version the ADOT autoinstrumentation package resolves\n // transitively (2.8.0) to clear CVE-2026-59892 (HIGH).\n '@opentelemetry/propagator-jaeger': '2.10.0',\n // Overridden in the vended agent/MCP image builds to clear CVE-2026-14257\n // (HIGH) in brace-expansion: minimatch 10 is the lowest major depending on\n // brace-expansion 5.x, the only line Trivy's `< 5.0.8` advisory range treats\n // as fixed. Overriding brace-expansion directly is not viable — 5.x drops the\n // CommonJS default export that minimatch 9 calls.\n minimatch: '10.2.6',\n '@aws-sdk/client-dynamodb': '3.1121.0',\n '@aws-sdk/client-api-gateway': '3.1121.0',\n '@aws-sdk/client-iam': '3.1121.0',\n '@aws-sdk/client-bedrock-agentcore': '3.1121.0',\n '@aws-sdk/client-bedrock-runtime': '3.1121.0',\n '@aws-sdk/client-s3': '3.1121.0',\n '@aws-sdk/client-sts': '3.1121.0',\n '@aws-sdk/credential-providers': '3.1121.0',\n '@aws-sdk/credential-provider-cognito-identity': '3.972.69',\n '@aws-sdk/client-secrets-manager': '3.1121.0',\n '@aws-sdk/rds-signer': '3.1121.0',\n '@smithy/server-apigateway': '0.3.3',\n '@smithy/server-node': '0.3.3',\n '@aws-lambda-powertools/logger': '2.35.0',\n '@aws-lambda-powertools/metrics': '2.35.0',\n '@aws-lambda-powertools/parameters': '2.35.0',\n '@aws-lambda-powertools/tracer': '2.35.0',\n '@aws-lambda-powertools/parser': '2.35.0',\n '@aws-sdk/client-appconfigdata': '3.1121.0',\n '@middy/core': '7.9.2',\n '@nxlv/python': '23.0.0',\n '@nx-extend/terraform': '10.4.1',\n // These must all hold the same version — see NX_PACKAGES.\n nx: '23.1.2',\n '@nx/devkit': '23.1.2',\n '@nx/js': '23.1.2',\n '@nx/react': '23.1.2',\n '@nx/vite': '23.1.2',\n '@nx/vitest': '23.1.2',\n '@nx/workspace': '23.1.2',\n 'create-nx-workspace': '23.1.2',\n '@swc-node/register': '1.12.1',\n '@swc/core': '1.16.1',\n '@modelcontextprotocol/sdk': '1.30.0',\n '@modelcontextprotocol/inspector': '2.4.0',\n '@ag-ui/a2ui-toolkit': '0.0.4',\n '@ag-ui/aws-strands': '0.2.3',\n '@ag-ui/client': '0.0.57',\n '@ag-ui/core': '0.0.57',\n '@ag-ui/encoder': '0.0.57',\n 'agent-chat-cli': '0.3.0',\n '@copilotkit/react-core': '1.69.3',\n rxjs: '7.8.2',\n '@strands-agents/sdk': '1.15.0',\n '@tanstack/react-router': '1.170.32',\n '@tanstack/router-plugin': '1.168.35',\n '@tanstack/router-generator': '1.167.33',\n '@tanstack/virtual-file-routes': '1.162.0',\n '@tanstack/router-utils': '1.162.2',\n '@cloudscape-design/board-components': '3.0.221',\n '@cloudscape-design/chat-components': '1.0.165',\n '@cloudscape-design/components': '3.0.1356',\n '@cloudscape-design/global-styles': '1.0.67',\n '@tanstack/react-query': '5.102.8',\n '@tanstack/react-query-devtools': '5.102.8',\n '@trpc/tanstack-react-query': '11.18.0',\n '@trpc/client': '11.18.0',\n '@trpc/server': '11.18.0',\n '@types/node': '26.4.0',\n '@types/aws-lambda': '8.10.162',\n '@types/cors': '2.8.19',\n '@types/pg': '8.23.1',\n '@types/ws': '8.18.1',\n '@types/express': '5.0.6',\n '@smithy/config-resolver': '4.7.2',\n '@smithy/node-config-provider': '4.6.2',\n '@smithy/node-http-handler': '4.11.3',\n '@smithy/types': '4.17.2',\n '@vitest/coverage-v8': '4.1.11',\n '@vitest/ui': '4.1.11',\n '@astrojs/react': '6.0.4',\n '@astrojs/starlight': '0.41.10',\n astro: '7.2.9',\n cookie: '2.0.1',\n aws4fetch: '1.0.20',\n 'aws-cdk': '2.1139.0',\n 'aws-cdk-lib': '2.267.0',\n 'aws-xray-sdk-core': '3.12.0',\n constructs: '10.8.1',\n cors: '2.8.6',\n chalk: '6.0.0',\n 'class-variance-authority': '0.7.1',\n clsx: '2.1.1',\n commander: '15.0.0',\n 'cpy-cli': '7.0.0',\n electrodb: '3.9.3',\n esbuild: '0.28.2',\n 'event-source-polyfill': '1.0.31',\n '@types/event-source-polyfill': '1.0.5',\n '@biomejs/biome': '2.5.11',\n '@prisma/adapter-mariadb': '7.10.0',\n '@prisma/adapter-pg': '7.10.0',\n '@prisma/client': '7.10.0',\n ejs: '6.0.1',\n '@types/ejs': '3.1.5',\n express: '5.2.1',\n 'fast-glob': '3.3.3',\n husky: '9.1.7',\n 'fs-extra': '11.4.0',\n '@types/fs-extra': '11.0.4',\n 'make-dir-cli': '4.0.0',\n mariadb: '3.5.3',\n mise: '2026.8.14',\n ncp: '2.0.0',\n npm: '12.0.2',\n 'npm-check-updates': '23.1.0',\n 'oidc-client-ts': '3.5.0',\n pg: '8.23.0',\n prisma: '7.10.0',\n 'react-oidc-context': '3.3.1',\n react: '19.2.8',\n 'react-dom': '19.2.8',\n rimraf: '6.1.3',\n rolldown: '1.2.6',\n 'rolldown-plugin-dts': '0.28.3',\n 'simple-git': '3.36.0',\n 'source-map-support': '0.5.21',\n 'starlight-blog': '0.29.0',\n tailwindcss: '4.3.3',\n '@tailwindcss/vite': '4.3.3',\n tsx: '4.23.12',\n 'lucide-react': '1.37.0',\n 'radix-ui': '1.6.7',\n shadcn: '4.19.0',\n 'tw-animate-css': '1.4.0',\n 'tailwind-merge': '3.6.0',\n vite: '8.2.2',\n typescript: '6.0.3',\n vitest: '4.1.11',\n zod: '4.5.4',\n ws: '8.21.3',\n} as const;\nexport type ITsDepVersion = keyof typeof TS_VERSIONS;\n\n/\n Add versions to the given dependencies, which the declaration must own.\n \n @param declaration the calling generator's `DEPENDENCIES`\n /\nexport const withVersions = <D extends DependencyDeclaration>(\n declaration: D,\n deps: readonly DeclaredTs<D>[],\n): Record<string, string> => {\n assertDeclared(declaration.ts, deps, 'ts');\n return Object.fromEntries(\n deps.map((dep) => [dep, TS_VERSIONS[dep as ITsDepVersion]]),\n );\n};\n\n/\n The `nx` and `@nx/` packages a generated workspace pins, all of which must\n hold the same version: a workspace nx even a patch apart hoists a second\n * nested nx, and the two deadlock `nx sync`.\n \n Bumping them in a user's workspace requires `packageJsonUpdates` rather than a\n * migration — see `version-upgrade-migration/nx-package-updates.ts`.\n /\nexport const NX_PACKAGES = [\n 'nx',\n '@nx/devkit',\n '@nx/js',\n '@nx/react',\n '@nx/vite',\n '@nx/vitest',\n '@nx/workspace',\n] as const satisfies readonly ITsDepVersion[];\n\n/\n The nx version the plugin is built against, and the single source of truth\n * for every place a workspace's nx is pinned.\n /\nexport const NX_VERSION = TS_VERSIONS.nx;\n\n/\n Versions for Python dependencies added by generators\n /\nexport const PY_VERSIONS = {\n 'a2a-sdk': '==0.3.26',\n 'ag-ui-langgraph': '==0.0.44',\n 'ag-ui-protocol': '==0.1.21',\n 'ag-ui-strands': '==0.3.0',\n aiosqlite: '==0.22.1',\n 'aws-lambda-powertools': '==3.34.0',\n 'aws-lambda-powertools[tracer]': '==3.34.0',\n 'aws-lambda-powertools[parser]': '==3.34.0',\n 'aws-opentelemetry-distro': '==0.19.0',\n 'bedrock-agentcore': '==1.22.0',\n boto3: '==1.43.83',\n checkov: '==3.3.16',\n fastapi: '==0.141.1',\n 'fastapi[standard]': '==0.141.1',\n httpx: '==0.28.1',\n langchain: '==1.3.18',\n 'langchain-aws': '==1.7.4',\n 'langchain-mcp-adapters': '==0.3.2',\n langgraph: '==1.2.11',\n 'langgraph-checkpoint-aws': '==1.2.2',\n 'langgraph-checkpoint-sqlite': '==3.1.1',\n mcp: '==1.28.1',\n 'pip-check-updates': '==0.29.0',\n 'pip-licenses': '==5.5.5',\n ruff: '==0.16.5',\n 'strands-agents': '==1.54.0',\n 'strands-agents[a2a]': '==1.54.0',\n 'strands-agents-tools': '==0.8.7',\n ty: '==0.0.75',\n pynamodb: '==6.1.0',\n uvicorn: '==0.52.4',\n sqlmodel: '==0.0.42',\n alembic: '==1.19.1',\n aiomysql: '==0.3.2',\n asyncpg: '==0.31.0',\n // Pinned explicitly: SQLAlchemy's async engine pulls greenlet transitively,\n // and leaving it unpinned lets uv resolve to a just-released version whose\n // platform wheels may not all be published yet (breaking aarch64 installs).\n greenlet: '==3.5.5',\n} as const;\nexport type IPyDepVersion = keyof typeof PY_VERSIONS;\n\n/\n Add versions to the given dependencies\n /\nexport const withPyVersions = <D extends DependencyDeclaration>(\n declaration: D,\n deps: readonly DeclaredPy<D>[],\n): string[] => {\n assertDeclared(declaration.py, deps, 'py');\n return deps.map((dep) => `${dep}${PY_VERSIONS[dep as IPyDepVersion]}`);\n};\n\n/* Catches undeclared packages that reach here past the type checker. /\nconst assertDeclared = (\n declared: readonly { readonly name: string }[],\n deps: readonly unknown[],\n kind: 'ts' \| 'py',\n): void => {\n const names = declaredNames(declared);\n const undeclared = deps.filter((dep) => !names.includes(dep as string));\n if (undeclared.length > 0) {\n throw new Error(\n `Undeclared ${kind} dependencies: ${undeclared.join(', ')}. Add them to the generator's declareDependencies({ ${kind}: [...] }).`,\n );\n }\n};\n\n/\n Versions for vendored tools\n /\nexport const VENDORED_VERSIONS = {\n 'git-secrets': '1.3.0',\n} as const;\n\n/\n Versions of Java dependencies added by generators, keyed by Maven coordinate.\n \n Every entry is resolved from Maven Central by the version update and named\n * `<group>:<artifact>:<version>` where a generator writes it.\n /\nexport const JAVA_VERSIONS = {\n 'software.amazon.smithy:smithy-model': '1.73.0',\n 'software.amazon.smithy:smithy-aws-traits': '1.73.0',\n 'software.amazon.smithy:smithy-validation-model': '1.73.0',\n 'software.amazon.smithy:smithy-openapi': '1.73.0',\n 'software.amazon.smithy.typescript:smithy-aws-typescript-codegen': '0.53.0',\n} as const;\nexport type IJavaVersion = keyof typeof JAVA_VERSIONS;\n\n/* The Maven coordinates the version update resolves, in declaration order. /\nexport const JAVA_ARTIFACTS = Object.keys(JAVA_VERSIONS) as IJavaVersion[];\n\n/* A Maven coordinate as a dependency names it: `<group>:<artifact>:<version>`. /\nexport const javaMavenDependency = (artifact: IJavaVersion): string =>\n `${artifact}:${JAVA_VERSIONS[artifact]}`;\n\n/\n Versions of tools resolved by mise, keyed by the tool name mise knows.\n \n Every entry is checked with `mise latest <tool>` by the version update. Nothing\n * is installed into the workspace: the pin travels in the `project.json` target\n * command, which is what the version sync reaches to move it forward.\n /\nexport const MISE_VERSIONS = {\n smithy: '1.73.0',\n} as const;\nexport type IMiseVersion = keyof typeof MISE_VERSIONS;\n\n/* The tools the version update resolves through mise, in declaration order. /\nexport const MISE_TOOLS = Object.keys(MISE_VERSIONS) as IMiseVersion[];\n\n/\n Base container images used by generated Dockerfiles. Pinned exactly so\n * generated images are reproducible, and chosen to be free of known\n * HIGH/CRITICAL vulnerabilities at time of generation.\n /\nexport const BASE_IMAGES = {\n node: 'public.ecr.aws/docker/library/node:lts-slim',\n python: 'public.ecr.aws/docker/library/python:3.14-slim',\n} as const;\n\n/\n Versions for container tooling used by generated image build/scan targets.\n * Pinned exactly so generated images are reproducible.\n /\nexport const CONTAINER_VERSIONS = {\n // ECR-hosted Trivy image used to scan built images during the build.\n trivy: '0.72.0',\n} as const;\n\n/\n Repository each pinned tool image is pulled from, keyed as\n * {@link CONTAINER_VERSIONS}. Kept beside the versions so a tool added here is\n * one entry rather than a reference built somewhere else, which is also what\n * lets the version sync find these pins wherever a target command runs them.\n /\nexport const CONTAINER_REPOSITORIES = {\n trivy: 'public.ecr.aws/aquasecurity/trivy',\n} as const satisfies Record<keyof typeof CONTAINER_VERSIONS, string>;\n\n/* The pinned reference for a tool image, as a target command runs it. /\nexport const containerImage = (tool: keyof typeof CONTAINER_VERSIONS): string =>\n `${CONTAINER_REPOSITORIES[tool]}:${CONTAINER_VERSIONS[tool]}`;\n\n/\n The managed Lambda runtimes generated infrastructure targets, as the single\n * source both IaC providers derive from.\n \n CDK and Terraform name the same runtime differently — `Runtime.NODEJS_24_X`\n * against `nodejs24.x` — so deriving both from the version here keeps a bump one\n * edit that moves them together. Resolved by the version update workflow.\n /\nexport const LAMBDA_RUNTIME_VERSIONS = {\n node: '24',\n python: '3.14',\n} as const;\nexport type ILambdaRuntime = keyof typeof LAMBDA_RUNTIME_VERSIONS;\n\n/\n The interpreter uv pins for a generated Python project, as the Lambda runtime's\n * `major.minor`.\n \n No patch: uv reads this as a request for any patch of that minor, so it resolves\n * whichever one the platform has a build for. Naming an exact patch pins one that\n * may not exist everywhere, and Lambda patches the interpreter itself, so the minor\n * is the whole of what a project needs to agree on.\n /\nexport const pyenvPythonVersion = (): string => LAMBDA_RUNTIME_VERSIONS.python;\n\n/\n The `[project].requires-python` specifier for a generated Python project.\n \n A lower bound on the Lambda runtime's `major.minor`: the deployed interpreter\n * is that version, and Ruff derives its `target-version` from this (`py314`), so\n * lint targets the same version the function runs on.\n /\nexport const pyprojectPythonDependency = (): string =>\n `>=${LAMBDA_RUNTIME_VERSIONS.python}`;\n\n/* The runtime as Terraform's `runtime` attribute names it, e.g. `nodejs24.x`. /\nexport const terraformLambdaRuntime = (runtime: ILambdaRuntime): string =>\n runtime === 'node'\n ? `nodejs${LAMBDA_RUNTIME_VERSIONS.node}.x`\n : `python${LAMBDA_RUNTIME_VERSIONS.python}`;\n\n/\n The runtime as an `aws-cdk-lib` `Runtime` member, e.g. `Runtime.NODEJS_24_X`.\n * Always an explicitly versioned member, never a `_LATEST` alias.\n /\nexport const cdkLambdaRuntime = (runtime: ILambdaRuntime): string =>\n runtime === 'node'\n ? `Runtime.NODEJS_${LAMBDA_RUNTIME_VERSIONS.node}_X`\n : `Runtime.PYTHON_${LAMBDA_RUNTIME_VERSIONS.python.replace('.', '_')}`;\n\n/\n Substitution variables exposing the pinned runtimes to generated CDK\n * templates (e.g. `runtime: <%- nodeRuntime %>`). Paired with\n * {@link terraformLambdaRuntimeVars}, which names the same variables so a\n * template reads alike under either provider.\n /\nexport const cdkLambdaRuntimeVars = () => ({\n nodeRuntime: cdkLambdaRuntime('node'),\n pythonRuntime: cdkLambdaRuntime('python'),\n});\n\n/\n Substitution variables exposing the pinned runtimes to generated `.tf`\n * templates (e.g. `runtime = \"<%- nodeRuntime %>\"`).\n /\nexport const terraformLambdaRuntimeVars = () => ({\n nodeRuntime: terraformLambdaRuntime('node'),\n pythonRuntime: terraformLambdaRuntime('python'),\n});\n\n/\n Exact versions for Terraform providers used by generated `.tf` modules.\n * Pinned exactly (no range operator) so generated infrastructure is reproducible.\n /\nexport const TERRAFORM_VERSIONS = {\n aws: '6.62.0',\n random: '3.9.0',\n null: '3.3.1',\n archive: '2.8.0',\n external: '2.4.1',\n local: '2.9.0',\n time: '0.14.1',\n} as const;\nexport type ITerraformProviderVersion = keyof typeof TERRAFORM_VERSIONS;\n\n/\n Substitution variables exposing Terraform provider version constraints to\n * generated `.tf` templates (e.g. `version = \"<%- awsProviderVersion %>\"`)\n */\nexport const terraformProviderVersions = () => ({\n awsProviderVersion: TERRAFORM_VERSIONS.aws,\n randomProviderVersion: TERRAFORM_VERSIONS.random,\n nullProviderVersion: TERRAFORM_VERSIONS.null,\n archiveProviderVersion: TERRAFORM_VERSIONS.archive,\n externalProviderVersion: TERRAFORM_VERSIONS.external,\n localProviderVersion: TERRAFORM_VERSIONS.local,\n timeProviderVersion: TERRAFORM_VERSIONS.time,\n});\n"],"names":["declaredNames","TS_VERSIONS","minimatch","nx","rxjs","astro","cookie","aws4fetch","constructs","cors","chalk","clsx","commander","electrodb","esbuild","ejs","express","husky","mariadb","mise","ncp","npm","pg","prisma","react","rimraf","rolldown","tailwindcss","tsx","shadcn","vite","typescript","vitest","zod","ws","withVersions","declaration","deps","assertDeclared","ts","Object","fromEntries","map","dep","NX_PACKAGES","NX_VERSION","PY_VERSIONS","aiosqlite","boto3","checkov","fastapi","httpx","langchain","langgraph","mcp","ruff","ty","pynamodb","uvicorn","sqlmodel","alembic","aiomysql","asyncpg","greenlet","withPyVersions","py","declared","kind","names","undeclared","filter","includes","length","Error","join","VENDORED_VERSIONS","JAVA_VERSIONS","JAVA_ARTIFACTS","keys","javaMavenDependency","artifact","MISE_VERSIONS","smithy","MISE_TOOLS","BASE_IMAGES","node","python","CONTAINER_VERSIONS","trivy","CONTAINER_REPOSITORIES","containerImage","tool","LAMBDA_RUNTIME_VERSIONS","pyenvPythonVersion","pyprojectPythonDependency","terraformLambdaRuntime","runtime","cdkLambdaRuntime","replace","cdkLambdaRuntimeVars","nodeRuntime","pythonRuntime","terraformLambdaRuntimeVars","TERRAFORM_VERSIONS","aws","random","null","archive","external","local","time","terraformProviderVersions","awsProviderVersion","randomProviderVersion","nullProviderVersion","archiveProviderVersion","externalProviderVersion","localProviderVersion","timeProviderVersion"],"mappings":"AAAA;;;CAGC,GACD,SAIEA,aAAa,QACR,6BAA6B;AAEpC;;CAEC,GACD,OAAO,MAAMC,cAAc;IACzB,eAAe;IACf,0DAA0D;IAC1D,yEAAyE;IACzE,uDAAuD;IACvD,oCAAoC;IACpC,0EAA0E;IAC1E,2EAA2E;IAC3E,6EAA6E;IAC7E,8EAA8E;IAC9E,kDAAkD;IAClDC,WAAW;IACX,4BAA4B;IAC5B,+BAA+B;IAC/B,uBAAuB;IACvB,qCAAqC;IACrC,mCAAmC;IACnC,sBAAsB;IACtB,uBAAuB;IACvB,iCAAiC;IACjC,iDAAiD;IACjD,mCAAmC;IACnC,uBAAuB;IACvB,6BAA6B;IAC7B,uBAAuB;IACvB,iCAAiC;IACjC,kCAAkC;IAClC,qCAAqC;IACrC,iCAAiC;IACjC,iCAAiC;IACjC,iCAAiC;IACjC,eAAe;IACf,gBAAgB;IAChB,wBAAwB;IACxB,0DAA0D;IAC1DC,IAAI;IACJ,cAAc;IACd,UAAU;IACV,aAAa;IACb,YAAY;IACZ,cAAc;IACd,iBAAiB;IACjB,uBAAuB;IACvB,sBAAsB;IACtB,aAAa;IACb,6BAA6B;IAC7B,mCAAmC;IACnC,uBAAuB;IACvB,sBAAsB;IACtB,iBAAiB;IACjB,eAAe;IACf,kBAAkB;IAClB,kBAAkB;IAClB,0BAA0B;IAC1BC,MAAM;IACN,uBAAuB;IACvB,0BAA0B;IAC1B,2BAA2B;IAC3B,8BAA8B;IAC9B,iCAAiC;IACjC,0BAA0B;IAC1B,uCAAuC;IACvC,sCAAsC;IACtC,iCAAiC;IACjC,oCAAoC;IACpC,yBAAyB;IACzB,kCAAkC;IAClC,8BAA8B;IAC9B,gBAAgB;IAChB,gBAAgB;IAChB,eAAe;IACf,qBAAqB;IACrB,eAAe;IACf,aAAa;IACb,aAAa;IACb,kBAAkB;IAClB,2BAA2B;IAC3B,gCAAgC;IAChC,6BAA6B;IAC7B,iBAAiB;IACjB,uBAAuB;IACvB,cAAc;IACd,kBAAkB;IAClB,sBAAsB;IACtBC,OAAO;IACPC,QAAQ;IACRC,WAAW;IACX,WAAW;IACX,eAAe;IACf,qBAAqB;IACrBC,YAAY;IACZC,MAAM;IACNC,OAAO;IACP,4BAA4B;IAC5BC,MAAM;IACNC,WAAW;IACX,WAAW;IACXC,WAAW;IACXC,SAAS;IACT,yBAAyB;IACzB,gCAAgC;IAChC,kBAAkB;IAClB,2BAA2B;IAC3B,sBAAsB;IACtB,kBAAkB;IAClBC,KAAK;IACL,cAAc;IACdC,SAAS;IACT,aAAa;IACbC,OAAO;IACP,YAAY;IACZ,mBAAmB;IACnB,gBAAgB;IAChBC,SAAS;IACTC,MAAM;IACNC,KAAK;IACLC,KAAK;IACL,qBAAqB;IACrB,kBAAkB;IAClBC,IAAI;IACJC,QAAQ;IACR,sBAAsB;IACtBC,OAAO;IACP,aAAa;IACbC,QAAQ;IACRC,UAAU;IACV,uBAAuB;IACvB,cAAc;IACd,sBAAsB;IACtB,kBAAkB;IAClBC,aAAa;IACb,qBAAqB;IACrBC,KAAK;IACL,gBAAgB;IAChB,YAAY;IACZC,QAAQ;IACR,kBAAkB;IAClB,kBAAkB;IAClBC,MAAM;IACNC,YAAY;IACZC,QAAQ;IACRC,KAAK;IACLC,IAAI;AACN,EAAW;AAGX;;;;CAIC,GACD,OAAO,MAAMC,eAAe,CAC1BC,aACAC;IAEAC,eAAeF,YAAYG,EAAE,EAAEF,MAAM;IACrC,OAAOG,OAAOC,WAAW,CACvBJ,KAAKK,GAAG,CAAC,CAACC,MAAQ;YAACA;YAAK1C,WAAW,CAAC0C,IAAqB;SAAC;AAE9D,EAAE;AAEF;;;;;;;CAOC,GACD,OAAO,MAAMC,cAAc;IACzB;IACA;IACA;IACA;IACA;IACA;IACA;CACD,CAA6C;AAE9C;;;CAGC,GACD,OAAO,MAAMC,aAAa5C,YAAYE,EAAE,CAAC;AAEzC;;CAEC,GACD,OAAO,MAAM2C,cAAc;IACzB,WAAW;IACX,mBAAmB;IACnB,kBAAkB;IAClB,iBAAiB;IACjBC,WAAW;IACX,yBAAyB;IACzB,iCAAiC;IACjC,iCAAiC;IACjC,4BAA4B;IAC5B,qBAAqB;IACrBC,OAAO;IACPC,SAAS;IACTC,SAAS;IACT,qBAAqB;IACrBC,OAAO;IACPC,WAAW;IACX,iBAAiB;IACjB,0BAA0B;IAC1BC,WAAW;IACX,4BAA4B;IAC5B,+BAA+B;IAC/BC,KAAK;IACL,qBAAqB;IACrB,gBAAgB;IAChBC,MAAM;IACN,kBAAkB;IAClB,uBAAuB;IACvB,wBAAwB;IACxBC,IAAI;IACJC,UAAU;IACVC,SAAS;IACTC,UAAU;IACVC,SAAS;IACTC,UAAU;IACVC,SAAS;IACT,4EAA4E;IAC5E,2EAA2E;IAC3E,4EAA4E;IAC5EC,UAAU;AACZ,EAAW;AAGX;;CAEC,GACD,OAAO,MAAMC,iBAAiB,CAC5B5B,aACAC;IAEAC,eAAeF,YAAY6B,EAAE,EAAE5B,MAAM;IACrC,OAAOA,KAAKK,GAAG,CAAC,CAACC,MAAQ,GAAGA,MAAMG,WAAW,CAACH,IAAqB,EAAE;AACvE,EAAE;AAEF,uEAAuE,GACvE,MAAML,iBAAiB,CACrB4B,UACA7B,MACA8B;IAEA,MAAMC,QAAQpE,cAAckE;IAC5B,MAAMG,aAAahC,KAAKiC,MAAM,CAAC,CAAC3B,MAAQ,CAACyB,MAAMG,QAAQ,CAAC5B;IACxD,IAAI0B,WAAWG,MAAM,GAAG,GAAG;QACzB,MAAM,IAAIC,MACR,CAAC,WAAW,EAAEN,KAAK,eAAe,EAAEE,WAAWK,IAAI,CAAC,MAAM,oDAAoD,EAAEP,KAAK,WAAW,CAAC;IAErI;AACF;AAEA;;CAEC,GACD,OAAO,MAAMQ,oBAAoB;IAC/B,eAAe;AACjB,EAAW;AAEX;;;;;CAKC,GACD,OAAO,MAAMC,gBAAgB;IAC3B,uCAAuC;IACvC,4CAA4C;IAC5C,kDAAkD;IAClD,yCAAyC;IACzC,mEAAmE;AACrE,EAAW;AAGX,6EAA6E,GAC7E,OAAO,MAAMC,iBAAiBrC,OAAOsC,IAAI,CAACF,eAAiC;AAE3E,iFAAiF,GACjF,OAAO,MAAMG,sBAAsB,CAACC,WAClC,GAAGA,SAAS,CAAC,EAAEJ,aAAa,CAACI,SAAS,EAAE,CAAC;AAE3C;;;;;;CAMC,GACD,OAAO,MAAMC,gBAAgB;IAC3BC,QAAQ;AACV,EAAW;AAGX,8EAA8E,GAC9E,OAAO,MAAMC,aAAa3C,OAAOsC,IAAI,CAACG,eAAiC;AAEvE;;;;CAIC,GACD,OAAO,MAAMG,cAAc;IACzBC,MAAM;IACNC,QAAQ;AACV,EAAW;AAEX;;;CAGC,GACD,OAAO,MAAMC,qBAAqB;IAChC,qEAAqE;IACrEC,OAAO;AACT,EAAW;AAEX;;;;;CAKC,GACD,OAAO,MAAMC,yBAAyB;IACpCD,OAAO;AACT,EAAqE;AAErE,wEAAwE,GACxE,OAAO,MAAME,iBAAiB,CAACC,OAC7B,GAAGF,sBAAsB,CAACE,KAAK,CAAC,CAAC,EAAEJ,kBAAkB,CAACI,KAAK,EAAE,CAAC;AAEhE;;;;;;;CAOC,GACD,OAAO,MAAMC,0BAA0B;IACrCP,MAAM;IACNC,QAAQ;AACV,EAAW;AAGX;;;;;;;;CAQC,GACD,OAAO,MAAMO,qBAAqB,IAAcD,wBAAwBN,MAAM,CAAC;AAE/E;;;;;;CAMC,GACD,OAAO,MAAMQ,4BAA4B,IACvC,CAAC,EAAE,EAAEF,wBAAwBN,MAAM,EAAE,CAAC;AAExC,gFAAgF,GAChF,OAAO,MAAMS,yBAAyB,CAACC,UACrCA,YAAY,SACR,CAAC,MAAM,EAAEJ,wBAAwBP,IAAI,CAAC,EAAE,CAAC,GACzC,CAAC,MAAM,EAAEO,wBAAwBN,MAAM,EAAE,CAAC;AAEhD;;;CAGC,GACD,OAAO,MAAMW,mBAAmB,CAACD,UAC/BA,YAAY,SACR,CAAC,eAAe,EAAEJ,wBAAwBP,IAAI,CAAC,EAAE,CAAC,GAClD,CAAC,eAAe,EAAEO,wBAAwBN,MAAM,CAACY,OAAO,CAAC,KAAK,MAAM,CAAC;AAE3E;;;;;CAKC,GACD,OAAO,MAAMC,uBAAuB,IAAO,CAAA;QACzCC,aAAaH,iBAAiB;QAC9BI,eAAeJ,iBAAiB;IAClC,CAAA,EAAG;AAEH;;;CAGC,GACD,OAAO,MAAMK,6BAA6B,IAAO,CAAA;QAC/CF,aAAaL,uBAAuB;QACpCM,eAAeN,uBAAuB;IACxC,CAAA,EAAG;AAEH;;;CAGC,GACD,OAAO,MAAMQ,qBAAqB;IAChCC,KAAK;IACLC,QAAQ;IACRC,MAAM;IACNC,SAAS;IACTC,UAAU;IACVC,OAAO;IACPC,MAAM;AACR,EAAW;AAGX;;;CAGC,GACD,OAAO,MAAMC,4BAA4B,IAAO,CAAA;QAC9CC,oBAAoBT,mBAAmBC,GAAG;QAC1CS,uBAAuBV,mBAAmBE,MAAM;QAChDS,qBAAqBX,mBAAmBG,IAAI;QAC5CS,wBAAwBZ,mBAAmBI,OAAO;QAClDS,yBAAyBb,mBAAmBK,QAAQ;QACpDS,sBAAsBd,mBAAmBM,KAAK;QAC9CS,qBAAqBf,mBAAmBO,IAAI;IAC9C,CAAA,EAAG"}

package/src/migrations/latest/add-destroy-sandbox-target/migration.js.map DELETED Viewed

@@ -1 +0,0 @@

- {"version":3,"sources":["../../../../../../../packages/nx-plugin/src/migrations/latest/add-destroy-sandbox-target/migration.ts"],"sourcesContent":["/**\n * Copyright Amazon.com, Inc. or its affiliates. All Rights Reserved.\n * SPDX-License-Identifier: Apache-2.0\n */\nimport {\n getProjects,\n joinPathFragments,\n type MigrationReturnObject,\n type ProjectConfiguration,\n type Tree,\n updateProjectConfiguration,\n} from '@nx/devkit';\nimport { readFileSync } from 'fs';\nimport { join } from 'path';\nimport { INFRA_APP_GENERATOR_INFO } from '../../../infra/app/generator.js';\nimport { captureGritQLVariable } from '../../../utils/ast.js';\nimport { formatFilesInSubtree } from '../../../utils/format.js';\nimport { normalizeTargetKeyOrder } from '../../../utils/nx.js';\nimport { sortObjectKeys } from '../../../utils/object.js';\nimport {\n PACKAGES_DIR,\n SHARED_SCRIPTS_DIR,\n} from '../../../utils/shared-constructs-constants.js';\n\n/**\n * CDK infrastructure projects gained a `destroy-sandbox` target, mirroring\n * `deploy-sandbox`: it tears down the sandbox stage without the user having to\n * spell out its stage pattern (`nx destroy-sandbox infra` rather than\n * `nx destroy infra \"my-app-infra-sandbox/*\"`).\n *\n * The stage id is read from `main.ts` rather than recomputed from the project\n * name, so a project whose sandbox stage has been renamed gets a target that\n * destroys the stage it actually declares.\n *\n * The destroy targets also drop `--require-approval=never`. `cdk destroy` has no\n * such option, so it only warns that the flag is being ignored. The same fix\n * lands in the vended `buildCdkCommand`, which builds the command for\n * `stageConfig` workspaces.\n *\n * How to write a migration:\n * - https://nx.dev/docs/kb/migration-generators\n * - What `nextSteps` means: https://nx.dev/docs/reference/devkit/MigrationReturnObject\n */\n\nconst TARGET = 'destroy-sandbox';\n\n/** The destroy targets the ignored flag is stripped from. */\nconst DESTROY_TARGETS = ['destroy', 'destroy-ci'] as const;\n\n/** `cdk destroy` has no such option, so it only warns and carries on. */\nconst IGNORED_APPROVAL_FLAG = /\\s*--require-approval(=\\S*)?/;\n\n/**\n * Matches `new ApplicationStage(app, '<id>-sandbox', { ... })`, binding the\n * quoted stage id. The regex spans the quotes because it is matched against the\n * whole string literal node; both quote styles are accepted since the user's\n * formatter may have rewritten them.\n *\n * `main.ts` can declare several stages (beta, prod), so the pattern selects the\n * sandbox one rather than whichever comes first.\n */\nconst SANDBOX_STAGE_PATTERN =\n '`new ApplicationStage($app, $id, $props)` where { $id <: r\"[\\'\\\\\"].*-sandbox[\\'\\\\\"]\" }';\n\n/** The id of the sandbox stage a project's `main.ts` instantiates. */\nconst sandboxStageId = async (\n tree: Tree,\n projectRoot: string,\n): Promise<string | undefined> => {\n const captured = await captureGritQLVariable(\n tree,\n joinPathFragments(projectRoot, 'src', 'main.ts'),\n SANDBOX_STAGE_PATTERN,\n 'id',\n );\n // The binding keeps the quotes from the source.\n return captured?.slice(1, -1);\n};\n\n/**\n * Strip the ignored `--require-approval` from a `cdk destroy` command. Returns\n * undefined when the command isn't the shape the generator produced, or the flag\n * is already gone.\n */\nconst withoutApprovalFlag = (command: unknown): string | undefined => {\n if (typeof command !== 'string' || !command.includes('cdk destroy')) {\n return undefined;\n }\n if (!IGNORED_APPROVAL_FLAG.test(command)) return undefined;\n return command.replace(IGNORED_APPROVAL_FLAG, '');\n};\n\n/** Drops the ignored approval flag from the project's destroy targets. */\nconst migrateDestroyFlags = (project: ProjectConfiguration): boolean => {\n let changed = false;\n for (const name of DESTROY_TARGETS) {\n const target = project.targets?.[name];\n const command = withoutApprovalFlag(target?.options?.command);\n if (command) {\n target.options = { ...target.options, command };\n changed = true;\n }\n }\n return changed;\n};\n\n/** Path the shared scripts package vends the CDK command builder at. */\nconst CDK_COMMAND_PATH = joinPathFragments(\n PACKAGES_DIR,\n SHARED_SCRIPTS_DIR,\n 'src/infra/stage-credentials/cdk-command.ts',\n);\n\n/** The builder as it stands today. The template carries no EJS variables. */\nconst CDK_COMMAND_TEMPLATE = readFileSync(\n join(\n import.meta.dirname,\n '../../../utils/files/common/scripts/src/infra/stage-credentials/cdk-command.ts.template',\n ),\n 'utf-8',\n);\n\n/**\n * Re-vends the CDK command builder, which no longer adds `--require-approval`\n * for the `destroy` action. Only the shape the generator produced is replaced: a\n * customised copy is the user's, so it is reported instead.\n */\nconst migrateCdkCommandBuilder = (tree: Tree, nextSteps: string[]): void => {\n if (!tree.exists(CDK_COMMAND_PATH)) return;\n\n const current = tree.read(CDK_COMMAND_PATH)!.toString();\n // Already migrated, so a re-run is a no-op.\n if (current.includes(\"action === 'destroy'\")) return;\n\n if (!current.includes('hasRequireApproval')) {\n nextSteps.push(\n `${CDK_COMMAND_PATH}: has diverged from the generated shape — left untouched. Have it skip \\`--require-approval\\` for the \\`destroy\\` action, which has no such option.`,\n );\n return;\n }\n\n tree.write(CDK_COMMAND_PATH, CDK_COMMAND_TEMPLATE);\n};\n\n/** Adds the `destroy-sandbox` target, mirroring the project's `destroy`. */\nconst addSandboxTarget = async (\n tree: Tree,\n projectName: string,\n project: ProjectConfiguration,\n nextSteps: string[],\n): Promise<boolean> => {\n // The new target mirrors `destroy`, so it inherits whatever that resolved to\n // when the project was generated: the `tsx` credential-resolving script\n // under `stageConfig`, plain `cdk destroy` otherwise.\n const destroy = project.targets.destroy;\n const command = destroy?.options?.command;\n const mainPath = joinPathFragments(project.root, 'src/main.ts');\n const stageId = await sandboxStageId(tree, project.root);\n\n if (typeof command !== 'string') {\n nextSteps.push(\n `Add a '${TARGET}' target to ${projectName} by hand if necessary — its 'destroy' target no longer matches the shape the generator produced.`,\n );\n return false;\n }\n if (!stageId) {\n nextSteps.push(\n `Add a '${TARGET}' target to ${projectName} by hand if necessary — no sandbox stage was found in ${mainPath}.`,\n );\n return false;\n }\n\n project.targets[TARGET] = normalizeTargetKeyOrder({\n executor: destroy.executor,\n ...(destroy.dependsOn ? { dependsOn: [...destroy.dependsOn] } : {}),\n // Quoted so the shell does not glob the `*`.\n options: { ...destroy.options, command: `${command} \"${stageId}/*\"` },\n });\n return true;\n};\n\nexport default async function migration(\n tree: Tree,\n): Promise<MigrationReturnObject> {\n const nextSteps: string[] = [];\n\n for (const [projectName, project] of getProjects(tree)) {\n const generator = (project.metadata as { generator?: string } | undefined)\n ?.generator;\n // Not a CDK infrastructure project.\n if (generator !== INFRA_APP_GENERATOR_INFO.id) continue;\n\n // Corrected first so the new target inherits the fixed command.\n let changed = migrateDestroyFlags(project);\n\n if (!project.targets?.[TARGET]) {\n changed =\n (await addSandboxTarget(tree, projectName, project, nextSteps)) ||\n changed;\n }\n\n if (changed) {\n updateProjectConfiguration(tree, projectName, {\n ...project,\n targets: sortObjectKeys(project.targets),\n });\n }\n }\n\n migrateCdkCommandBuilder(tree, nextSteps);\n\n await formatFilesInSubtree(tree);\n\n return { nextSteps };\n}\n"],"names":["getProjects","joinPathFragments","updateProjectConfiguration","readFileSync","join","INFRA_APP_GENERATOR_INFO","captureGritQLVariable","formatFilesInSubtree","normalizeTargetKeyOrder","sortObjectKeys","PACKAGES_DIR","SHARED_SCRIPTS_DIR","TARGET","DESTROY_TARGETS","IGNORED_APPROVAL_FLAG","SANDBOX_STAGE_PATTERN","sandboxStageId","tree","projectRoot","captured","slice","withoutApprovalFlag","command","includes","undefined","test","replace","migrateDestroyFlags","project","changed","name","target","targets","options","CDK_COMMAND_PATH","CDK_COMMAND_TEMPLATE","dirname","migrateCdkCommandBuilder","nextSteps","exists","current","read","toString","push","write","addSandboxTarget","projectName","destroy","mainPath","root","stageId","executor","dependsOn","migration","generator","metadata","id"],"mappings":"AAAA;;;CAGC,GACD,SACEA,WAAW,EACXC,iBAAiB,EAIjBC,0BAA0B,QACrB,aAAa;AACpB,SAASC,YAAY,QAAQ,KAAK;AAClC,SAASC,IAAI,QAAQ,OAAO;AAC5B,SAASC,wBAAwB,QAAQ,kCAAkC;AAC3E,SAASC,qBAAqB,QAAQ,wBAAwB;AAC9D,SAASC,oBAAoB,QAAQ,2BAA2B;AAChE,SAASC,uBAAuB,QAAQ,uBAAuB;AAC/D,SAASC,cAAc,QAAQ,2BAA2B;AAC1D,SACEC,YAAY,EACZC,kBAAkB,QACb,gDAAgD;AAEvD;;;;;;;;;;;;;;;;;;CAkBC,GAED,MAAMC,SAAS;AAEf,2DAA2D,GAC3D,MAAMC,kBAAkB;IAAC;IAAW;CAAa;AAEjD,uEAAuE,GACvE,MAAMC,wBAAwB;AAE9B;;;;;;;;CAQC,GACD,MAAMC,wBACJ;AAEF,oEAAoE,GACpE,MAAMC,iBAAiB,OACrBC,MACAC;IAEA,MAAMC,WAAW,MAAMb,sBACrBW,MACAhB,kBAAkBiB,aAAa,OAAO,YACtCH,uBACA;IAEF,gDAAgD;IAChD,OAAOI,UAAUC,MAAM,GAAG,CAAC;AAC7B;AAEA;;;;CAIC,GACD,MAAMC,sBAAsB,CAACC;IAC3B,IAAI,OAAOA,YAAY,YAAY,CAACA,QAAQC,QAAQ,CAAC,gBAAgB;QACnE,OAAOC;IACT;IACA,IAAI,CAACV,sBAAsBW,IAAI,CAACH,UAAU,OAAOE;IACjD,OAAOF,QAAQI,OAAO,CAACZ,uBAAuB;AAChD;AAEA,wEAAwE,GACxE,MAAMa,sBAAsB,CAACC;IAC3B,IAAIC,UAAU;IACd,KAAK,MAAMC,QAAQjB,gBAAiB;QAClC,MAAMkB,SAASH,QAAQI,OAAO,EAAE,CAACF,KAAK;QACtC,MAAMR,UAAUD,oBAAoBU,QAAQE,SAASX;QACrD,IAAIA,SAAS;YACXS,OAAOE,OAAO,GAAG;gBAAE,GAAGF,OAAOE,OAAO;gBAAEX;YAAQ;YAC9CO,UAAU;QACZ;IACF;IACA,OAAOA;AACT;AAEA,sEAAsE,GACtE,MAAMK,mBAAmBjC,kBACvBS,cACAC,oBACA;AAGF,2EAA2E,GAC3E,MAAMwB,uBAAuBhC,aAC3BC,KACE,YAAYgC,OAAO,EACnB,4FAEF;AAGF;;;;CAIC,GACD,MAAMC,2BAA2B,CAACpB,MAAYqB;IAC5C,IAAI,CAACrB,KAAKsB,MAAM,CAACL,mBAAmB;IAEpC,MAAMM,UAAUvB,KAAKwB,IAAI,CAACP,kBAAmBQ,QAAQ;IACrD,4CAA4C;IAC5C,IAAIF,QAAQjB,QAAQ,CAAC,yBAAyB;IAE9C,IAAI,CAACiB,QAAQjB,QAAQ,CAAC,uBAAuB;QAC3Ce,UAAUK,IAAI,CACZ,GAAGT,iBAAiB,mJAAmJ,CAAC;QAE1K;IACF;IAEAjB,KAAK2B,KAAK,CAACV,kBAAkBC;AAC/B;AAEA,0EAA0E,GAC1E,MAAMU,mBAAmB,OACvB5B,MACA6B,aACAlB,SACAU;IAEA,6EAA6E;IAC7E,wEAAwE;IACxE,sDAAsD;IACtD,MAAMS,UAAUnB,QAAQI,OAAO,CAACe,OAAO;IACvC,MAAMzB,UAAUyB,SAASd,SAASX;IAClC,MAAM0B,WAAW/C,kBAAkB2B,QAAQqB,IAAI,EAAE;IACjD,MAAMC,UAAU,MAAMlC,eAAeC,MAAMW,QAAQqB,IAAI;IAEvD,IAAI,OAAO3B,YAAY,UAAU;QAC/BgB,UAAUK,IAAI,CACZ,CAAC,OAAO,EAAE/B,OAAO,YAAY,EAAEkC,YAAY,gGAAgG,CAAC;QAE9I,OAAO;IACT;IACA,IAAI,CAACI,SAAS;QACZZ,UAAUK,IAAI,CACZ,CAAC,OAAO,EAAE/B,OAAO,YAAY,EAAEkC,YAAY,sDAAsD,EAAEE,SAAS,CAAC,CAAC;QAEhH,OAAO;IACT;IAEApB,QAAQI,OAAO,CAACpB,OAAO,GAAGJ,wBAAwB;QAChD2C,UAAUJ,QAAQI,QAAQ;QAC1B,GAAIJ,QAAQK,SAAS,GAAG;YAAEA,WAAW;mBAAIL,QAAQK,SAAS;aAAC;QAAC,IAAI,CAAC,CAAC;QAClE,6CAA6C;QAC7CnB,SAAS;YAAE,GAAGc,QAAQd,OAAO;YAAEX,SAAS,GAAGA,QAAQ,EAAE,EAAE4B,QAAQ,GAAG,CAAC;QAAC;IACtE;IACA,OAAO;AACT;AAEA,eAAe,eAAeG,UAC5BpC,IAAU;IAEV,MAAMqB,YAAsB,EAAE;IAE9B,KAAK,MAAM,CAACQ,aAAalB,QAAQ,IAAI5B,YAAYiB,MAAO;QACtD,MAAMqC,YAAa1B,QAAQ2B,QAAQ,EAC/BD;QACJ,oCAAoC;QACpC,IAAIA,cAAcjD,yBAAyBmD,EAAE,EAAE;QAE/C,gEAAgE;QAChE,IAAI3B,UAAUF,oBAAoBC;QAElC,IAAI,CAACA,QAAQI,OAAO,EAAE,CAACpB,OAAO,EAAE;YAC9BiB,UACE,AAAC,MAAMgB,iBAAiB5B,MAAM6B,aAAalB,SAASU,cACpDT;QACJ;QAEA,IAAIA,SAAS;YACX3B,2BAA2Be,MAAM6B,aAAa;gBAC5C,GAAGlB,OAAO;gBACVI,SAASvB,eAAemB,QAAQI,OAAO;YACzC;QACF;IACF;IAEAK,yBAAyBpB,MAAMqB;IAE/B,MAAM/B,qBAAqBU;IAE3B,OAAO;QAAEqB;IAAU;AACrB"}

package/src/migrations/latest/nx-parallel-default/migration.js.map DELETED Viewed

@@ -1 +0,0 @@

- {"version":3,"sources":["../../../../../../../packages/nx-plugin/src/migrations/latest/nx-parallel-default/migration.ts"],"sourcesContent":["/**\n * Copyright Amazon.com, Inc. or its affiliates. All Rights Reserved.\n * SPDX-License-Identifier: Apache-2.0\n */\nimport {\n type MigrationReturnObject,\n readNxJson,\n type Tree,\n updateNxJson,\n} from '@nx/devkit';\nimport { formatFilesInSubtree } from '../../../utils/format.js';\nimport { DEFAULT_PARALLEL } from '../../../utils/init.js';\n\n/**\n * New workspaces set `parallel` in `nx.json` so a full build uses the available\n * cores rather than Nx's default of 3. Existing workspaces have no value at all,\n * so this backfills it.\n *\n * A workspace that already declares `parallel` has made a deliberate choice —\n * often to bound memory on a smaller machine — so it is left as it is.\n */\nexport default async function migration(\n tree: Tree,\n): Promise<MigrationReturnObject> {\n const nextSteps: string[] = [];\n\n const nxJson = readNxJson(tree);\n if (nxJson && nxJson.parallel === undefined) {\n updateNxJson(tree, { ...nxJson, parallel: DEFAULT_PARALLEL });\n }\n\n await formatFilesInSubtree(tree);\n\n return { nextSteps };\n}\n"],"names":["readNxJson","updateNxJson","formatFilesInSubtree","DEFAULT_PARALLEL","migration","tree","nextSteps","nxJson","parallel","undefined"],"mappings":"AAAA;;;CAGC,GACD,SAEEA,UAAU,EAEVC,YAAY,QACP,aAAa;AACpB,SAASC,oBAAoB,QAAQ,2BAA2B;AAChE,SAASC,gBAAgB,QAAQ,yBAAyB;AAE1D;;;;;;;CAOC,GACD,eAAe,eAAeC,UAC5BC,IAAU;IAEV,MAAMC,YAAsB,EAAE;IAE9B,MAAMC,SAASP,WAAWK;IAC1B,IAAIE,UAAUA,OAAOC,QAAQ,KAAKC,WAAW;QAC3CR,aAAaI,MAAM;YAAE,GAAGE,MAAM;YAAEC,UAAUL;QAAiB;IAC7D;IAEA,MAAMD,qBAAqBG;IAE3B,OAAO;QAAEC;IAAU;AACrB"}

package/src/migrations/latest/python-version-drop-exact-patch/migration.js.map DELETED Viewed

@@ -1 +0,0 @@

- {"version":3,"sources":["../../../../../../../packages/nx-plugin/src/migrations/latest/python-version-drop-exact-patch/migration.ts"],"sourcesContent":["/**\n * Copyright Amazon.com, Inc. or its affiliates. All Rights Reserved.\n * SPDX-License-Identifier: Apache-2.0\n */\nimport {\n type MigrationReturnObject,\n type Tree,\n visitNotIgnoredFiles,\n} from '@nx/devkit';\nimport { formatFilesInSubtree } from '../../../utils/format.js';\n\n/**\n * A `.python-version` naming an exact CPython patch resolves only where uv has a\n * build of that patch: `3.14.7` installs on Linux but not on macOS, so `uv sync`\n * fails there on a workspace that works elsewhere.\n *\n * uv reads a bare `major.minor` as a request for any patch of that minor, so\n * dropping the patch lets each platform resolve a build it has. Lambda patches the\n * interpreter itself, so the minor is the whole of what a project needs to pin.\n *\n * Only a patch of the minor the releases in question vended is dropped — another\n * minor is the user's choice of interpreter, and the version sync moves the\n * interpreter forward when the runtime's minor itself changes.\n */\n\n/**\n * The Python runtime minor those releases vended, spelled out rather than read\n * from `LAMBDA_RUNTIME_VERSIONS`.\n *\n * A migration describes a fixed point in history: it has to keep rewriting the\n * versions those releases actually wrote, whatever the current pin is. Reading the\n * live constant would silently retarget this at whatever minor the plugin vends by\n * the time a user upgrades, and stop correcting the value it exists for.\n */\nconst VENDED_MINOR = '3.14';\n\nexport default async function migration(\n tree: Tree,\n): Promise<MigrationReturnObject> {\n // uv writes a `.python-version` per project as well as at the root, and one\n // left behind fails `uv sync` for that project alone.\n visitNotIgnoredFiles(tree, '.', (path) => {\n if (path !== '.python-version' && !path.endsWith('/.python-version')) {\n return;\n }\n const declared = (tree.read(path, 'utf-8') ?? '').trim();\n if (/^(\\d+\\.\\d+)\\.\\d+$/.exec(declared)?.[1] === VENDED_MINOR) {\n tree.write(path, `${VENDED_MINOR}\\n`);\n }\n });\n\n await formatFilesInSubtree(tree);\n\n return {};\n}\n"],"names":["visitNotIgnoredFiles","formatFilesInSubtree","VENDED_MINOR","migration","tree","path","endsWith","declared","read","trim","exec","write"],"mappings":"AAAA;;;CAGC,GACD,SAGEA,oBAAoB,QACf,aAAa;AACpB,SAASC,oBAAoB,QAAQ,2BAA2B;AAEhE;;;;;;;;;;;;CAYC,GAED;;;;;;;;CAQC,GACD,MAAMC,eAAe;AAErB,eAAe,eAAeC,UAC5BC,IAAU;IAEV,4EAA4E;IAC5E,sDAAsD;IACtDJ,qBAAqBI,MAAM,KAAK,CAACC;QAC/B,IAAIA,SAAS,qBAAqB,CAACA,KAAKC,QAAQ,CAAC,qBAAqB;YACpE;QACF;QACA,MAAMC,WAAW,AAACH,CAAAA,KAAKI,IAAI,CAACH,MAAM,YAAY,EAAC,EAAGI,IAAI;QACtD,IAAI,oBAAoBC,IAAI,CAACH,WAAW,CAAC,EAAE,KAAKL,cAAc;YAC5DE,KAAKO,KAAK,CAACN,MAAM,GAAGH,aAAa,EAAE,CAAC;QACtC;IACF;IAEA,MAAMD,qBAAqBG;IAE3B,OAAO,CAAC;AACV"}

package/src/migrations/latest/react-website-nx-react-express-override/migration.js.map DELETED Viewed

@@ -1 +0,0 @@

- {"version":3,"sources":["../../../../../../../packages/nx-plugin/src/migrations/latest/react-website-nx-react-express-override/migration.ts"],"sourcesContent":["/**\n * Copyright Amazon.com, Inc. or its affiliates. All Rights Reserved.\n * SPDX-License-Identifier: Apache-2.0\n */\nimport {\n detectPackageManager,\n type MigrationReturnObject,\n readJson,\n type Tree,\n updateJson,\n} from '@nx/devkit';\nimport { formatFilesInSubtree } from '../../../utils/format';\nimport { TS_VERSIONS } from '../../../utils/versions';\n\n/**\n * Pin the `express` `@nx/react` resolves to the version generated websites use.\n *\n * `@nx/react` declares an optional `express` peer for its module-federation\n * dev-server, on the major behind the `express` vended here. npm is alone in\n * failing the whole install on an optional peer it cannot satisfy:\n *\n * npm error ERESOLVE could not resolve\n * npm error peerOptional express@\"^4.21.2\" from @nx/react\n * npm error Conflicting peer dependency: express@5.2.1\n *\n * so an npm workspace with a website cannot install once its nx moves onto a\n * version carrying that peer. pnpm, bun and yarn only warn, and get nothing.\n *\n * Scoped to `@nx/react` rather than pinning `express` workspace-wide: nothing\n * here loads it, the peer only has to be satisfiable, and a bare override would\n * reach every other consumer of express too.\n *\n * Guardrails:\n * - npm only, and only for a workspace that has a website — the root `@nx/react`\n * the generator adds. Anything else needs no override.\n * - A user's own `overrides['@nx/react'].express` is left alone: theirs may pin a\n * version deliberately.\n * - Idempotent: writing the same pin twice is a no-op.\n */\nexport default async function migration(\n tree: Tree,\n): Promise<MigrationReturnObject> {\n const nextSteps: string[] = [];\n\n if (detectPackageManager(tree.root) !== 'npm') {\n return { nextSteps };\n }\n\n const packageJson = readJson<{\n devDependencies?: Record<string, string>;\n dependencies?: Record<string, string>;\n overrides?: Record<string, unknown>;\n }>(tree, 'package.json');\n\n const hasNxReact = Boolean(\n packageJson.devDependencies?.['@nx/react'] ??\n packageJson.dependencies?.['@nx/react'],\n );\n if (!hasNxReact) {\n return { nextSteps }; // No website in this workspace.\n }\n\n const scoped = packageJson.overrides?.['@nx/react'] as\n | Record<string, string>\n | string\n | undefined;\n\n // The string form pins `@nx/react` itself, leaving nowhere to nest the peer.\n if (typeof scoped === 'string') {\n nextSteps.push(\n `package.json: overrides['@nx/react'] pins a version as a string, so the express override could not be nested under it - left untouched. npm fails the install on @nx/react's optional express peer, so add { \"@nx/react\": { \".\": \"${scoped}\", \"express\": \"${TS_VERSIONS.express}\" } } to keep it satisfiable.`,\n );\n return { nextSteps };\n }\n\n if (scoped?.express) {\n return { nextSteps }; // Already pinned, by this migration or by the user.\n }\n\n updateJson(tree, 'package.json', (json) => ({\n ...json,\n overrides: {\n ...json.overrides,\n '@nx/react': { ...scoped, express: TS_VERSIONS.express },\n },\n }));\n\n await formatFilesInSubtree(tree);\n\n return { nextSteps };\n}\n"],"names":["detectPackageManager","readJson","updateJson","formatFilesInSubtree","TS_VERSIONS","migration","tree","nextSteps","root","packageJson","hasNxReact","Boolean","devDependencies","dependencies","scoped","overrides","push","express","json"],"mappings":"AAAA;;;CAGC,GACD,SACEA,oBAAoB,EAEpBC,QAAQ,EAERC,UAAU,QACL,aAAa;AACpB,SAASC,oBAAoB,QAAQ,2BAAwB;AAC7D,SAASC,WAAW,QAAQ,6BAA0B;AAEtD;;;;;;;;;;;;;;;;;;;;;;;;CAwBC,GACD,eAAe,eAAeC,UAC5BC,IAAU;IAEV,MAAMC,YAAsB,EAAE;IAE9B,IAAIP,qBAAqBM,KAAKE,IAAI,MAAM,OAAO;QAC7C,OAAO;YAAED;QAAU;IACrB;IAEA,MAAME,cAAcR,SAIjBK,MAAM;IAET,MAAMI,aAAaC,QACjBF,YAAYG,eAAe,EAAE,CAAC,YAAY,IACxCH,YAAYI,YAAY,EAAE,CAAC,YAAY;IAE3C,IAAI,CAACH,YAAY;QACf,OAAO;YAAEH;QAAU,GAAG,gCAAgC;IACxD;IAEA,MAAMO,SAASL,YAAYM,SAAS,EAAE,CAAC,YAAY;IAKnD,6EAA6E;IAC7E,IAAI,OAAOD,WAAW,UAAU;QAC9BP,UAAUS,IAAI,CACZ,CAAC,kOAAkO,EAAEF,OAAO,eAAe,EAAEV,YAAYa,OAAO,CAAC,6BAA6B,CAAC;QAEjT,OAAO;YAAEV;QAAU;IACrB;IAEA,IAAIO,QAAQG,SAAS;QACnB,OAAO;YAAEV;QAAU,GAAG,oDAAoD;IAC5E;IAEAL,WAAWI,MAAM,gBAAgB,CAACY,OAAU,CAAA;YAC1C,GAAGA,IAAI;YACPH,WAAW;gBACT,GAAGG,KAAKH,SAAS;gBACjB,aAAa;oBAAE,GAAGD,MAAM;oBAAEG,SAASb,YAAYa,OAAO;gBAAC;YACzD;QACF,CAAA;IAEA,MAAMd,qBAAqBG;IAE3B,OAAO;QAAEC;IAAU;AACrB"}

package/src/migrations/latest/terraform-rdb-proxy-iam-connect-grant/migration.js.map DELETED Viewed

@@ -1 +0,0 @@

- {"version":3,"sources":["../../../../../../../packages/nx-plugin/src/migrations/latest/terraform-rdb-proxy-iam-connect-grant/migration.ts"],"sourcesContent":["/**\n * Copyright Amazon.com, Inc. or its affiliates. All Rights Reserved.\n * SPDX-License-Identifier: Apache-2.0\n */\nimport {\n joinPathFragments,\n type MigrationReturnObject,\n type Tree,\n} from '@nx/devkit';\nimport { applyGritQL, matchGritQL } from '../../../utils/ast.js';\nimport { formatFilesInSubtree } from '../../../utils/format.js';\nimport {\n PACKAGES_DIR,\n SHARED_TERRAFORM_DIR,\n} from '../../../utils/shared-constructs-constants.js';\n\n/**\n * Give the RDS Proxy role in every vended Terraform Aurora app module the\n * `rds-db:connect` grant for the application database user.\n *\n * The proxy is created with `default_auth_scheme = \"IAM_AUTH\"` and no secrets\n * registered, so `rds-db:connect` on the application user is the only\n * permission it needs to reach the cluster. MySQL modules instead granted the\n * role `secretsmanager:GetSecretValue` on the admin credentials secret plus\n * `kms:Decrypt` — credentials the proxy never uses, and a far wider grant than\n * connecting as the application user.\n *\n * These files are generated with `KeepExisting`, so an upgraded MySQL workspace\n * keeps the admin secret grant until this runs. Diverged files are left\n * untouched and reported via `nextSteps`.\n */\n\nconst TERRAFORM_DBS_DIR = `${PACKAGES_DIR}/${SHARED_TERRAFORM_DIR}/src/app/dbs`;\n\nconst hcl = (pattern: string) => `language hcl\\n${pattern}`;\n\nconst CONNECT_STATEMENT_TEXT = [\n '{',\n ' Effect = \"Allow\"',\n ' Action = [\"rds-db:connect\"]',\n ' Resource = [',\n ' \"arn:aws:rds-db:${data.aws_region.current.region}:${data.aws_caller_identity.current.account_id}:dbuser:${module.aurora.cluster_resource_id}/${local.database_runtime_user}\"',\n ' ]',\n ' }',\n].join('\\n');\n\nconst divergedMessage = (filePath: string) =>\n `${filePath}: the aws_iam_role_policy.proxy_db_user_connect policy has diverged from the generated shape - left untouched. The RDS Proxy authenticates to the cluster with IAM, so replace any secretsmanager:GetSecretValue / kms:Decrypt statements on the proxy role with a single rds-db:connect statement for local.database_runtime_user (see the ts#rdb generator's database app template).`;\n\nconst proxyPolicyBlock = (body: string) =>\n hcl(`\\`resource \"aws_iam_role_policy\" \"proxy_db_user_connect\" { ${body} }\\``);\n\nconst migrateModule = async (\n tree: Tree,\n filePath: string,\n nextSteps: string[],\n): Promise<void> => {\n if (!(await matchGritQL(tree, filePath, proxyPolicyBlock('$_')))) {\n return; // No proxy policy in this module - nothing this migration owns.\n }\n\n if (\n await matchGritQL(\n tree,\n filePath,\n proxyPolicyBlock('$props') +\n ' where { $props <: contains `\"rds-db:connect\"` }',\n )\n ) {\n return; // Already granted.\n }\n\n // The whole statement list is replaced, so the policy must still hold exactly\n // the two statements the generator vended and nothing the user has added.\n const secretStatements = hcl(\n [\n '`Statement = [',\n ' {',\n ' Effect = \"Allow\"',\n ' Action = [',\n ' \"secretsmanager:GetSecretValue\"',\n ' ]',\n ' Resource = [module.aurora.secret_arn]',\n ' },',\n ' {',\n ' Effect = \"Allow\"',\n ' Action = [',\n ' \"kms:Decrypt\"',\n ' ]',\n ' Resource = [module.aurora.kms_key_arn]',\n ' }',\n ' ]`',\n ].join('\\n'),\n );\n\n if (!(await matchGritQL(tree, filePath, secretStatements))) {\n nextSteps.push(divergedMessage(filePath));\n return;\n }\n\n await applyGritQL(\n tree,\n filePath,\n `${secretStatements} => \\`Statement = [\\n ${CONNECT_STATEMENT_TEXT}\\n ]\\``,\n );\n};\n\nexport default async function migration(\n tree: Tree,\n): Promise<MigrationReturnObject> {\n const nextSteps: string[] = [];\n\n if (!tree.exists(TERRAFORM_DBS_DIR)) {\n return { nextSteps }; // This workspace has no Terraform database modules.\n }\n\n for (const dirName of tree.children(TERRAFORM_DBS_DIR)) {\n const filePath = joinPathFragments(\n TERRAFORM_DBS_DIR,\n dirName,\n `${dirName}.tf`,\n );\n if (!tree.exists(filePath)) {\n continue; // Not a database app module directory.\n }\n\n await migrateModule(tree, filePath, nextSteps);\n }\n\n await formatFilesInSubtree(tree);\n\n return { nextSteps };\n}\n"],"names":["joinPathFragments","applyGritQL","matchGritQL","formatFilesInSubtree","PACKAGES_DIR","SHARED_TERRAFORM_DIR","TERRAFORM_DBS_DIR","hcl","pattern","CONNECT_STATEMENT_TEXT","join","divergedMessage","filePath","proxyPolicyBlock","body","migrateModule","tree","nextSteps","secretStatements","push","migration","exists","dirName","children"],"mappings":"AAAA;;;CAGC,GACD,SACEA,iBAAiB,QAGZ,aAAa;AACpB,SAASC,WAAW,EAAEC,WAAW,QAAQ,wBAAwB;AACjE,SAASC,oBAAoB,QAAQ,2BAA2B;AAChE,SACEC,YAAY,EACZC,oBAAoB,QACf,gDAAgD;AAEvD;;;;;;;;;;;;;;CAcC,GAED,MAAMC,oBAAoB,GAAGF,aAAa,CAAC,EAAEC,qBAAqB,YAAY,CAAC;AAE/E,MAAME,MAAM,CAACC,UAAoB,CAAC,cAAc,EAAEA,SAAS;AAE3D,MAAMC,yBAAyB;IAC7B;IACA;IACA;IACA;IACA;IACA;IACA;CACD,CAACC,IAAI,CAAC;AAEP,MAAMC,kBAAkB,CAACC,WACvB,GAAGA,SAAS,sXAAsX,CAAC;AAErY,MAAMC,mBAAmB,CAACC,OACxBP,IAAI,CAAC,2DAA2D,EAAEO,KAAK,IAAI,CAAC;AAE9E,MAAMC,gBAAgB,OACpBC,MACAJ,UACAK;IAEA,IAAI,CAAE,MAAMf,YAAYc,MAAMJ,UAAUC,iBAAiB,QAAS;QAChE,QAAQ,gEAAgE;IAC1E;IAEA,IACE,MAAMX,YACJc,MACAJ,UACAC,iBAAiB,YACf,qDAEJ;QACA,QAAQ,mBAAmB;IAC7B;IAEA,8EAA8E;IAC9E,0EAA0E;IAC1E,MAAMK,mBAAmBX,IACvB;QACE;QACA;QACA;QACA;QACA;QACA;QACA;QACA;QACA;QACA;QACA;QACA;QACA;QACA;QACA;QACA;KACD,CAACG,IAAI,CAAC;IAGT,IAAI,CAAE,MAAMR,YAAYc,MAAMJ,UAAUM,mBAAoB;QAC1DD,UAAUE,IAAI,CAACR,gBAAgBC;QAC/B;IACF;IAEA,MAAMX,YACJe,MACAJ,UACA,GAAGM,iBAAiB,2BAA2B,EAAET,uBAAuB,SAAS,CAAC;AAEtF;AAEA,eAAe,eAAeW,UAC5BJ,IAAU;IAEV,MAAMC,YAAsB,EAAE;IAE9B,IAAI,CAACD,KAAKK,MAAM,CAACf,oBAAoB;QACnC,OAAO;YAAEW;QAAU,GAAG,oDAAoD;IAC5E;IAEA,KAAK,MAAMK,WAAWN,KAAKO,QAAQ,CAACjB,mBAAoB;QACtD,MAAMM,WAAWZ,kBACfM,mBACAgB,SACA,GAAGA,QAAQ,GAAG,CAAC;QAEjB,IAAI,CAACN,KAAKK,MAAM,CAACT,WAAW;YAC1B,UAAU,uCAAuC;QACnD;QAEA,MAAMG,cAAcC,MAAMJ,UAAUK;IACtC;IAEA,MAAMd,qBAAqBa;IAE3B,OAAO;QAAEC;IAAU;AACrB"}

/package/src/migrations/{latest/add-destroy-sandbox-target → v1.0.0-rc.87/0001-add-destroy-sandbox-target}/metadata.json RENAMED Viewed

File without changes

/package/src/migrations/{latest/add-destroy-sandbox-target → v1.0.0-rc.87/0001-add-destroy-sandbox-target}/migration.d.ts RENAMED Viewed

File without changes

/package/src/migrations/{latest/add-destroy-sandbox-target → v1.0.0-rc.87/0001-add-destroy-sandbox-target}/migration.js RENAMED Viewed

File without changes

/package/src/migrations/{latest/terraform-rdb-proxy-iam-connect-grant → v1.0.0-rc.87/0002-terraform-rdb-proxy-iam-connect-grant}/__snapshots__/migration.spec.ts.snap RENAMED Viewed

File without changes

/package/src/migrations/{latest/terraform-rdb-proxy-iam-connect-grant → v1.0.0-rc.87/0002-terraform-rdb-proxy-iam-connect-grant}/metadata.json RENAMED Viewed

File without changes

/package/src/migrations/{latest/python-version-drop-exact-patch → v1.0.0-rc.87/0002-terraform-rdb-proxy-iam-connect-grant}/migration.d.ts RENAMED Viewed

File without changes