@aws/nx-plugin 1.0.0-rc.90 → 1.0.0-rc.92

package/src/migrations/latest/nx-parallel-default/migration.js.map

@@ -1 +0,0 @@
-{"version":3,"sources":["../../../../../../../packages/nx-plugin/src/migrations/latest/nx-parallel-default/migration.ts"],"sourcesContent":["/**\n * Copyright Amazon.com, Inc. or its affiliates. All Rights Reserved.\n * SPDX-License-Identifier: Apache-2.0\n */\nimport {\n  type MigrationReturnObject,\n  readNxJson,\n  type Tree,\n  updateNxJson,\n} from '@nx/devkit';\nimport { formatFilesInSubtree } from '../../../utils/format.js';\nimport { DEFAULT_PARALLEL } from '../../../utils/init.js';\n\n/**\n * New workspaces set `parallel` in `nx.json` so a full build uses the available\n * cores rather than Nx's default of 3. Existing workspaces have no value at all,\n * so this backfills it.\n *\n * A workspace that already declares `parallel` has made a deliberate choice —\n * often to bound memory on a smaller machine — so it is left as it is.\n */\nexport default async function migration(\n  tree: Tree,\n): Promise<MigrationReturnObject> {\n  const nextSteps: string[] = [];\n\n  const nxJson = readNxJson(tree);\n  if (nxJson && nxJson.parallel === undefined) {\n    updateNxJson(tree, { ...nxJson, parallel: DEFAULT_PARALLEL });\n  }\n\n  await formatFilesInSubtree(tree);\n\n  return { nextSteps };\n}\n"],"names":["readNxJson","updateNxJson","formatFilesInSubtree","DEFAULT_PARALLEL","migration","tree","nextSteps","nxJson","parallel","undefined"],"mappings":"AAAA;;;CAGC,GACD,SAEEA,UAAU,EAEVC,YAAY,QACP,aAAa;AACpB,SAASC,oBAAoB,QAAQ,2BAA2B;AAChE,SAASC,gBAAgB,QAAQ,yBAAyB;AAE1D;;;;;;;CAOC,GACD,eAAe,eAAeC,UAC5BC,IAAU;IAEV,MAAMC,YAAsB,EAAE;IAE9B,MAAMC,SAASP,WAAWK;IAC1B,IAAIE,UAAUA,OAAOC,QAAQ,KAAKC,WAAW;QAC3CR,aAAaI,MAAM;YAAE,GAAGE,MAAM;YAAEC,UAAUL;QAAiB;IAC7D;IAEA,MAAMD,qBAAqBG;IAE3B,OAAO;QAAEC;IAAU;AACrB"}

package/src/migrations/latest/python-version-drop-exact-patch/migration.js.map

@@ -1 +0,0 @@
-{"version":3,"sources":["../../../../../../../packages/nx-plugin/src/migrations/latest/python-version-drop-exact-patch/migration.ts"],"sourcesContent":["/**\n * Copyright Amazon.com, Inc. or its affiliates. All Rights Reserved.\n * SPDX-License-Identifier: Apache-2.0\n */\nimport {\n  type MigrationReturnObject,\n  type Tree,\n  visitNotIgnoredFiles,\n} from '@nx/devkit';\nimport { formatFilesInSubtree } from '../../../utils/format.js';\n\n/**\n * A `.python-version` naming an exact CPython patch resolves only where uv has a\n * build of that patch: `3.14.7` installs on Linux but not on macOS, so `uv sync`\n * fails there on a workspace that works elsewhere.\n *\n * uv reads a bare `major.minor` as a request for any patch of that minor, so\n * dropping the patch lets each platform resolve a build it has. Lambda patches the\n * interpreter itself, so the minor is the whole of what a project needs to pin.\n *\n * Only a patch of the minor the releases in question vended is dropped — another\n * minor is the user's choice of interpreter, and the version sync moves the\n * interpreter forward when the runtime's minor itself changes.\n */\n\n/**\n * The Python runtime minor those releases vended, spelled out rather than read\n * from `LAMBDA_RUNTIME_VERSIONS`.\n *\n * A migration describes a fixed point in history: it has to keep rewriting the\n * versions those releases actually wrote, whatever the current pin is. Reading the\n * live constant would silently retarget this at whatever minor the plugin vends by\n * the time a user upgrades, and stop correcting the value it exists for.\n */\nconst VENDED_MINOR = '3.14';\n\nexport default async function migration(\n  tree: Tree,\n): Promise<MigrationReturnObject> {\n  // uv writes a `.python-version` per project as well as at the root, and one\n  // left behind fails `uv sync` for that project alone.\n  visitNotIgnoredFiles(tree, '.', (path) => {\n    if (path !== '.python-version' && !path.endsWith('/.python-version')) {\n      return;\n    }\n    const declared = (tree.read(path, 'utf-8') ?? '').trim();\n    if (/^(\\d+\\.\\d+)\\.\\d+$/.exec(declared)?.[1] === VENDED_MINOR) {\n      tree.write(path, `${VENDED_MINOR}\\n`);\n    }\n  });\n\n  await formatFilesInSubtree(tree);\n\n  return {};\n}\n"],"names":["visitNotIgnoredFiles","formatFilesInSubtree","VENDED_MINOR","migration","tree","path","endsWith","declared","read","trim","exec","write"],"mappings":"AAAA;;;CAGC,GACD,SAGEA,oBAAoB,QACf,aAAa;AACpB,SAASC,oBAAoB,QAAQ,2BAA2B;AAEhE;;;;;;;;;;;;CAYC,GAED;;;;;;;;CAQC,GACD,MAAMC,eAAe;AAErB,eAAe,eAAeC,UAC5BC,IAAU;IAEV,4EAA4E;IAC5E,sDAAsD;IACtDJ,qBAAqBI,MAAM,KAAK,CAACC;QAC/B,IAAIA,SAAS,qBAAqB,CAACA,KAAKC,QAAQ,CAAC,qBAAqB;YACpE;QACF;QACA,MAAMC,WAAW,AAACH,CAAAA,KAAKI,IAAI,CAACH,MAAM,YAAY,EAAC,EAAGI,IAAI;QACtD,IAAI,oBAAoBC,IAAI,CAACH,WAAW,CAAC,EAAE,KAAKL,cAAc;YAC5DE,KAAKO,KAAK,CAACN,MAAM,GAAGH,aAAa,EAAE,CAAC;QACtC;IACF;IAEA,MAAMD,qBAAqBG;IAE3B,OAAO,CAAC;AACV"}

package/src/migrations/latest/react-website-nx-react-express-override/migration.js.map

@@ -1 +0,0 @@
-{"version":3,"sources":["../../../../../../../packages/nx-plugin/src/migrations/latest/react-website-nx-react-express-override/migration.ts"],"sourcesContent":["/**\n * Copyright Amazon.com, Inc. or its affiliates. All Rights Reserved.\n * SPDX-License-Identifier: Apache-2.0\n */\nimport {\n  detectPackageManager,\n  type MigrationReturnObject,\n  readJson,\n  type Tree,\n  updateJson,\n} from '@nx/devkit';\nimport { formatFilesInSubtree } from '../../../utils/format';\nimport { TS_VERSIONS } from '../../../utils/versions';\n\n/**\n * Pin the `express` `@nx/react` resolves to the version generated websites use.\n *\n * `@nx/react` declares an optional `express` peer for its module-federation\n * dev-server, on the major behind the `express` vended here. npm is alone in\n * failing the whole install on an optional peer it cannot satisfy:\n *\n *   npm error ERESOLVE could not resolve\n *   npm error   peerOptional express@\"^4.21.2\" from @nx/react\n *   npm error Conflicting peer dependency: express@5.2.1\n *\n * so an npm workspace with a website cannot install once its nx moves onto a\n * version carrying that peer. pnpm, bun and yarn only warn, and get nothing.\n *\n * Scoped to `@nx/react` rather than pinning `express` workspace-wide: nothing\n * here loads it, the peer only has to be satisfiable, and a bare override would\n * reach every other consumer of express too.\n *\n * Guardrails:\n * - npm only, and only for a workspace that has a website — the root `@nx/react`\n *   the generator adds. Anything else needs no override.\n * - A user's own `overrides['@nx/react'].express` is left alone: theirs may pin a\n *   version deliberately.\n * - Idempotent: writing the same pin twice is a no-op.\n */\nexport default async function migration(\n  tree: Tree,\n): Promise<MigrationReturnObject> {\n  const nextSteps: string[] = [];\n\n  if (detectPackageManager(tree.root) !== 'npm') {\n    return { nextSteps };\n  }\n\n  const packageJson = readJson<{\n    devDependencies?: Record<string, string>;\n    dependencies?: Record<string, string>;\n    overrides?: Record<string, unknown>;\n  }>(tree, 'package.json');\n\n  const hasNxReact = Boolean(\n    packageJson.devDependencies?.['@nx/react'] ??\n      packageJson.dependencies?.['@nx/react'],\n  );\n  if (!hasNxReact) {\n    return { nextSteps }; // No website in this workspace.\n  }\n\n  const scoped = packageJson.overrides?.['@nx/react'] as\n    | Record<string, string>\n    | string\n    | undefined;\n\n  // The string form pins `@nx/react` itself, leaving nowhere to nest the peer.\n  if (typeof scoped === 'string') {\n    nextSteps.push(\n      `package.json: overrides['@nx/react'] pins a version as a string, so the express override could not be nested under it - left untouched. npm fails the install on @nx/react's optional express peer, so add { \"@nx/react\": { \".\": \"${scoped}\", \"express\": \"${TS_VERSIONS.express}\" } } to keep it satisfiable.`,\n    );\n    return { nextSteps };\n  }\n\n  if (scoped?.express) {\n    return { nextSteps }; // Already pinned, by this migration or by the user.\n  }\n\n  updateJson(tree, 'package.json', (json) => ({\n    ...json,\n    overrides: {\n      ...json.overrides,\n      '@nx/react': { ...scoped, express: TS_VERSIONS.express },\n    },\n  }));\n\n  await formatFilesInSubtree(tree);\n\n  return { nextSteps };\n}\n"],"names":["detectPackageManager","readJson","updateJson","formatFilesInSubtree","TS_VERSIONS","migration","tree","nextSteps","root","packageJson","hasNxReact","Boolean","devDependencies","dependencies","scoped","overrides","push","express","json"],"mappings":"AAAA;;;CAGC,GACD,SACEA,oBAAoB,EAEpBC,QAAQ,EAERC,UAAU,QACL,aAAa;AACpB,SAASC,oBAAoB,QAAQ,2BAAwB;AAC7D,SAASC,WAAW,QAAQ,6BAA0B;AAEtD;;;;;;;;;;;;;;;;;;;;;;;;CAwBC,GACD,eAAe,eAAeC,UAC5BC,IAAU;IAEV,MAAMC,YAAsB,EAAE;IAE9B,IAAIP,qBAAqBM,KAAKE,IAAI,MAAM,OAAO;QAC7C,OAAO;YAAED;QAAU;IACrB;IAEA,MAAME,cAAcR,SAIjBK,MAAM;IAET,MAAMI,aAAaC,QACjBF,YAAYG,eAAe,EAAE,CAAC,YAAY,IACxCH,YAAYI,YAAY,EAAE,CAAC,YAAY;IAE3C,IAAI,CAACH,YAAY;QACf,OAAO;YAAEH;QAAU,GAAG,gCAAgC;IACxD;IAEA,MAAMO,SAASL,YAAYM,SAAS,EAAE,CAAC,YAAY;IAKnD,6EAA6E;IAC7E,IAAI,OAAOD,WAAW,UAAU;QAC9BP,UAAUS,IAAI,CACZ,CAAC,kOAAkO,EAAEF,OAAO,eAAe,EAAEV,YAAYa,OAAO,CAAC,6BAA6B,CAAC;QAEjT,OAAO;YAAEV;QAAU;IACrB;IAEA,IAAIO,QAAQG,SAAS;QACnB,OAAO;YAAEV;QAAU,GAAG,oDAAoD;IAC5E;IAEAL,WAAWI,MAAM,gBAAgB,CAACY,OAAU,CAAA;YAC1C,GAAGA,IAAI;YACPH,WAAW;gBACT,GAAGG,KAAKH,SAAS;gBACjB,aAAa;oBAAE,GAAGD,MAAM;oBAAEG,SAASb,YAAYa,OAAO;gBAAC;YACzD;QACF,CAAA;IAEA,MAAMd,qBAAqBG;IAE3B,OAAO;QAAEC;IAAU;AACrB"}

package/src/migrations/latest/terraform-rdb-proxy-iam-connect-grant/migration.js.map

@@ -1 +0,0 @@
-{"version":3,"sources":["../../../../../../../packages/nx-plugin/src/migrations/latest/terraform-rdb-proxy-iam-connect-grant/migration.ts"],"sourcesContent":["/**\n * Copyright Amazon.com, Inc. or its affiliates. All Rights Reserved.\n * SPDX-License-Identifier: Apache-2.0\n */\nimport {\n  joinPathFragments,\n  type MigrationReturnObject,\n  type Tree,\n} from '@nx/devkit';\nimport { applyGritQL, matchGritQL } from '../../../utils/ast.js';\nimport { formatFilesInSubtree } from '../../../utils/format.js';\nimport {\n  PACKAGES_DIR,\n  SHARED_TERRAFORM_DIR,\n} from '../../../utils/shared-constructs-constants.js';\n\n/**\n * Give the RDS Proxy role in every vended Terraform Aurora app module the\n * `rds-db:connect` grant for the application database user.\n *\n * The proxy is created with `default_auth_scheme = \"IAM_AUTH\"` and no secrets\n * registered, so `rds-db:connect` on the application user is the only\n * permission it needs to reach the cluster. MySQL modules instead granted the\n * role `secretsmanager:GetSecretValue` on the admin credentials secret plus\n * `kms:Decrypt` — credentials the proxy never uses, and a far wider grant than\n * connecting as the application user.\n *\n * These files are generated with `KeepExisting`, so an upgraded MySQL workspace\n * keeps the admin secret grant until this runs. Diverged files are left\n * untouched and reported via `nextSteps`.\n */\n\nconst TERRAFORM_DBS_DIR = `${PACKAGES_DIR}/${SHARED_TERRAFORM_DIR}/src/app/dbs`;\n\nconst hcl = (pattern: string) => `language hcl\\n${pattern}`;\n\nconst CONNECT_STATEMENT_TEXT = [\n  '{',\n  '        Effect = \"Allow\"',\n  '        Action = [\"rds-db:connect\"]',\n  '        Resource = [',\n  '          \"arn:aws:rds-db:${data.aws_region.current.region}:${data.aws_caller_identity.current.account_id}:dbuser:${module.aurora.cluster_resource_id}/${local.database_runtime_user}\"',\n  '        ]',\n  '      }',\n].join('\\n');\n\nconst divergedMessage = (filePath: string) =>\n  `${filePath}: the aws_iam_role_policy.proxy_db_user_connect policy has diverged from the generated shape - left untouched. The RDS Proxy authenticates to the cluster with IAM, so replace any secretsmanager:GetSecretValue / kms:Decrypt statements on the proxy role with a single rds-db:connect statement for local.database_runtime_user (see the ts#rdb generator's database app template).`;\n\nconst proxyPolicyBlock = (body: string) =>\n  hcl(`\\`resource \"aws_iam_role_policy\" \"proxy_db_user_connect\" { ${body} }\\``);\n\nconst migrateModule = async (\n  tree: Tree,\n  filePath: string,\n  nextSteps: string[],\n): Promise<void> => {\n  if (!(await matchGritQL(tree, filePath, proxyPolicyBlock('$_')))) {\n    return; // No proxy policy in this module - nothing this migration owns.\n  }\n\n  if (\n    await matchGritQL(\n      tree,\n      filePath,\n      proxyPolicyBlock('$props') +\n        ' where { $props <: contains `\"rds-db:connect\"` }',\n    )\n  ) {\n    return; // Already granted.\n  }\n\n  // The whole statement list is replaced, so the policy must still hold exactly\n  // the two statements the generator vended and nothing the user has added.\n  const secretStatements = hcl(\n    [\n      '`Statement = [',\n      '      {',\n      '        Effect = \"Allow\"',\n      '        Action = [',\n      '          \"secretsmanager:GetSecretValue\"',\n      '        ]',\n      '        Resource = [module.aurora.secret_arn]',\n      '      },',\n      '      {',\n      '        Effect = \"Allow\"',\n      '        Action = [',\n      '          \"kms:Decrypt\"',\n      '        ]',\n      '        Resource = [module.aurora.kms_key_arn]',\n      '      }',\n      '    ]`',\n    ].join('\\n'),\n  );\n\n  if (!(await matchGritQL(tree, filePath, secretStatements))) {\n    nextSteps.push(divergedMessage(filePath));\n    return;\n  }\n\n  await applyGritQL(\n    tree,\n    filePath,\n    `${secretStatements} => \\`Statement = [\\n      ${CONNECT_STATEMENT_TEXT}\\n    ]\\``,\n  );\n};\n\nexport default async function migration(\n  tree: Tree,\n): Promise<MigrationReturnObject> {\n  const nextSteps: string[] = [];\n\n  if (!tree.exists(TERRAFORM_DBS_DIR)) {\n    return { nextSteps }; // This workspace has no Terraform database modules.\n  }\n\n  for (const dirName of tree.children(TERRAFORM_DBS_DIR)) {\n    const filePath = joinPathFragments(\n      TERRAFORM_DBS_DIR,\n      dirName,\n      `${dirName}.tf`,\n    );\n    if (!tree.exists(filePath)) {\n      continue; // Not a database app module directory.\n    }\n\n    await migrateModule(tree, filePath, nextSteps);\n  }\n\n  await formatFilesInSubtree(tree);\n\n  return { nextSteps };\n}\n"],"names":["joinPathFragments","applyGritQL","matchGritQL","formatFilesInSubtree","PACKAGES_DIR","SHARED_TERRAFORM_DIR","TERRAFORM_DBS_DIR","hcl","pattern","CONNECT_STATEMENT_TEXT","join","divergedMessage","filePath","proxyPolicyBlock","body","migrateModule","tree","nextSteps","secretStatements","push","migration","exists","dirName","children"],"mappings":"AAAA;;;CAGC,GACD,SACEA,iBAAiB,QAGZ,aAAa;AACpB,SAASC,WAAW,EAAEC,WAAW,QAAQ,wBAAwB;AACjE,SAASC,oBAAoB,QAAQ,2BAA2B;AAChE,SACEC,YAAY,EACZC,oBAAoB,QACf,gDAAgD;AAEvD;;;;;;;;;;;;;;CAcC,GAED,MAAMC,oBAAoB,GAAGF,aAAa,CAAC,EAAEC,qBAAqB,YAAY,CAAC;AAE/E,MAAME,MAAM,CAACC,UAAoB,CAAC,cAAc,EAAEA,SAAS;AAE3D,MAAMC,yBAAyB;IAC7B;IACA;IACA;IACA;IACA;IACA;IACA;CACD,CAACC,IAAI,CAAC;AAEP,MAAMC,kBAAkB,CAACC,WACvB,GAAGA,SAAS,sXAAsX,CAAC;AAErY,MAAMC,mBAAmB,CAACC,OACxBP,IAAI,CAAC,2DAA2D,EAAEO,KAAK,IAAI,CAAC;AAE9E,MAAMC,gBAAgB,OACpBC,MACAJ,UACAK;IAEA,IAAI,CAAE,MAAMf,YAAYc,MAAMJ,UAAUC,iBAAiB,QAAS;QAChE,QAAQ,gEAAgE;IAC1E;IAEA,IACE,MAAMX,YACJc,MACAJ,UACAC,iBAAiB,YACf,qDAEJ;QACA,QAAQ,mBAAmB;IAC7B;IAEA,8EAA8E;IAC9E,0EAA0E;IAC1E,MAAMK,mBAAmBX,IACvB;QACE;QACA;QACA;QACA;QACA;QACA;QACA;QACA;QACA;QACA;QACA;QACA;QACA;QACA;QACA;QACA;KACD,CAACG,IAAI,CAAC;IAGT,IAAI,CAAE,MAAMR,YAAYc,MAAMJ,UAAUM,mBAAoB;QAC1DD,UAAUE,IAAI,CAACR,gBAAgBC;QAC/B;IACF;IAEA,MAAMX,YACJe,MACAJ,UACA,GAAGM,iBAAiB,2BAA2B,EAAET,uBAAuB,SAAS,CAAC;AAEtF;AAEA,eAAe,eAAeW,UAC5BJ,IAAU;IAEV,MAAMC,YAAsB,EAAE;IAE9B,IAAI,CAACD,KAAKK,MAAM,CAACf,oBAAoB;QACnC,OAAO;YAAEW;QAAU,GAAG,oDAAoD;IAC5E;IAEA,KAAK,MAAMK,WAAWN,KAAKO,QAAQ,CAACjB,mBAAoB;QACtD,MAAMM,WAAWZ,kBACfM,mBACAgB,SACA,GAAGA,QAAQ,GAAG,CAAC;QAEjB,IAAI,CAACN,KAAKK,MAAM,CAACT,WAAW;YAC1B,UAAU,uCAAuC;QACnD;QAEA,MAAMG,cAAcC,MAAMJ,UAAUK;IACtC;IAEA,MAAMd,qBAAqBa;IAE3B,OAAO;QAAEC;IAAU;AACrB"}