@aws/nx-plugin 1.0.0-rc.93 → 1.0.0-rc.95

package/src/utils/agent-core-packaging.js

@@ -37,6 +37,18 @@ import { agentCoreRuntime, TS_VERSIONS } from "./versions.js";
         name: '@aws/aws-distro-opentelemetry-node-autoinstrumentation'
     }
 ];
+/**
+ * Name of the target that installs ADOT for the project's code packages. Every
+ * code package in a project vendors the same thing, so they share one.
+ */ export const ADOT_VENDOR_TARGET_NAME = 'agent-core-vendor';
+/**
+ * Directory the vendor target installs into, relative to the workspace root.
+ *
+ * A sibling of the `package` directory rather than a path inside it: Nx replaces
+ * a cached target's whole declared output directory on restore, so an output
+ * nested inside another target's output would have each wipe the other's work on
+ * a cache hit.
+ */ export const adotVendorDir = (projectRoot)=>joinPathFragments('dist', projectRoot, 'agent-core-vendor');
 /**
  * Add a target assembling the deployable code package for a TypeScript
  * AgentCore Runtime.
@@ -48,16 +60,39 @@ import { agentCoreRuntime, TS_VERSIONS } from "./versions.js";
  * being installed at runtime — the `opentelemetry-instrument` entry point
  * prefix resolves it from there.
  *
- * The install is scoped to the package directory with `--prefix` and
- * `--no-save`, so it never touches the project's own manifest. `--omit=dev`
- * keeps the package to what the runtime loads. ADOT is pure JavaScript with no
- * native binaries, so the package is architecture independent even though
- * AgentCore only runs arm64.
+ * The install is scoped to its own directory with `--prefix` and `--no-save`, so
+ * it never touches the project's own manifest. `--omit=dev` keeps the package to
+ * what the runtime loads. ADOT is pure JavaScript with no native binaries, so the
+ * package is architecture independent even though AgentCore only runs arm64.
+ *
+ * Vendoring is a separate target so Nx caches it independently of the source. It
+ * depends on nothing but the pinned ADOT version, which the install command
+ * carries and Nx hashes as part of the target's configuration, so it declares no
+ * `inputs`: editing an agent replays a directory copy rather than re-running the
+ * install, while bumping the version still invalidates it.
  */ export const addTypeScriptCodePackageTarget = (tree, options, declaration)=>{
     const { project, targetName, bundleTargetName, bundleOutputDir, packageOutputDir } = options;
     const fs = new FsCommands(tree, forDependencies(declaration));
     const adotVersion = TS_VERSIONS['@aws/aws-distro-opentelemetry-node-autoinstrumentation'];
+    const vendorDir = adotVendorDir(project.root);
     project.targets ??= {};
+    // Shared by every code package in the project, so only added once.
+    project.targets[ADOT_VENDOR_TARGET_NAME] ??= {
+        cache: true,
+        inputs: [],
+        outputs: [
+            `{workspaceRoot}/${vendorDir}`
+        ],
+        executor: 'nx:run-commands',
+        options: {
+            commands: [
+                fs.rm(vendorDir),
+                fs.mkdir(vendorDir),
+                `npm install --prefix ${vendorDir} --no-save --no-audit --no-fund --omit=dev @aws/aws-distro-opentelemetry-node-autoinstrumentation@${adotVersion}`
+            ],
+            parallel: false
+        }
+    };
     project.targets[targetName] = {
         cache: true,
         inputs: [
@@ -71,13 +106,14 @@ import { agentCoreRuntime, TS_VERSIONS } from "./versions.js";
             commands: [
                 fs.rm(packageOutputDir),
                 fs.mkdir(packageOutputDir),
-                fs.cp(joinPathFragments(bundleOutputDir, 'index.js'), joinPathFragments(packageOutputDir, 'index.js')),
-                `npm install --prefix ${packageOutputDir} --no-save --no-audit --no-fund --omit=dev @aws/aws-distro-opentelemetry-node-autoinstrumentation@${adotVersion}`
+                fs.cpFile(joinPathFragments(bundleOutputDir, 'index.js'), joinPathFragments(packageOutputDir, 'index.js')),
+                fs.cpDir(joinPathFragments(vendorDir, 'node_modules'), joinPathFragments(packageOutputDir, 'node_modules'))
             ],
             parallel: false
         },
         dependsOn: [
-            bundleTargetName
+            bundleTargetName,
+            ADOT_VENDOR_TARGET_NAME
         ]
     };
     addArtifactDependencyToTargets(project, targetName);
@@ -115,9 +151,9 @@ import { agentCoreRuntime, TS_VERSIONS } from "./versions.js";
             commands: [
                 fs.rm(packageOutputDir),
                 fs.mkdir(packageOutputDir),
-                fs.cp(bundleOutputDir, packageOutputDir),
-                fs.cp(sourceRoot, joinPathFragments(packageOutputDir, moduleName)),
-                fs.cp(entryPointPath, joinPathFragments(packageOutputDir, entryPointFileName))
+                fs.cpDir(bundleOutputDir, packageOutputDir),
+                fs.cpDir(sourceRoot, joinPathFragments(packageOutputDir, moduleName)),
+                fs.cpFile(entryPointPath, joinPathFragments(packageOutputDir, entryPointFileName))
             ],
             parallel: false
         },

package/src/utils/agent-core-packaging.js.map

@@ -1 +1 @@
-{"version":3,"sources":["../../../../../packages/nx-plugin/src/utils/agent-core-packaging.ts"],"sourcesContent":["/**\n * Copyright Amazon.com, Inc. or its affiliates. All Rights Reserved.\n * SPDX-License-Identifier: Apache-2.0\n */\nimport {\n  joinPathFragments,\n  type ProjectConfiguration,\n  type Tree,\n} from '@nx/devkit';\nimport {\n  type DependencyDeclaration,\n  forDependencies,\n  type MustDeclare,\n} from './declared-dependencies.js';\nimport { FS_DEPENDENCIES, FsCommands } from './fs.js';\nimport { addArtifactDependencyToTargets } from './nx.js';\nimport {\n  agentCoreRuntime,\n  type ITsDepVersion,\n  TS_VERSIONS,\n} from './versions.js';\n\n/**\n * How an AgentCore Runtime's artifact is packaged and hosted.\n *\n * `agentcore` uploads a `.zip` of the built code to S3 and runs it on an\n * AgentCore managed language runtime, which skips the container build, ECR\n * repository and image push entirely — the fastest build and deploy cycle.\n * `agentcore-ecr` builds an arm64 container image and hosts it from ECR, for\n * workloads needing OS-level control (e.g. native system libraries) or an\n * established container pipeline.\n */\nexport const AGENT_CORE_INFRA = ['agentcore', 'agentcore-ecr', 'none'] as const;\n\nexport type AgentCoreInfra = (typeof AGENT_CORE_INFRA)[number];\n\n/** Whether the given infra option hosts on AgentCore Runtime at all. */\nexport const isAgentCoreHosted = (infra: AgentCoreInfra): boolean =>\n  infra === 'agentcore' || infra === 'agentcore-ecr';\n\n/** Whether the given infra option builds and hosts a container image. */\nexport const isContainerHosted = (infra: AgentCoreInfra): boolean =>\n  infra === 'agentcore-ecr';\n\n/** The AgentCore managed runtime a TypeScript component targets. */\nexport const agentCoreNodeRuntime = (): string => agentCoreRuntime('node');\n\n/** The AgentCore managed runtime a Python component targets. */\nexport const agentCorePythonRuntime = (): string => agentCoreRuntime('python');\n\n/**\n * Dependencies a caller must declare to add a code (`.zip`) packaging target.\n *\n * The TypeScript package target vendors the AWS Distro for OpenTelemetry into\n * the package directory, so its version is declared here (spread through\n * `ownedElsewhere` by callers, since the install targets the built package\n * rather than any workspace manifest).\n */\nexport const CODE_PACKAGE_DEPENDENCIES = [\n  ...FS_DEPENDENCIES,\n  { name: '@aws/aws-distro-opentelemetry-node-autoinstrumentation' },\n] as const satisfies readonly { name: ITsDepVersion }[];\n\nexport interface AddTypeScriptCodePackageTargetOptions {\n  /** Project configuration to add the target to (mutated in place). */\n  readonly project: ProjectConfiguration;\n  /** Name of the packaging target to add, e.g. `agent-package`. */\n  readonly targetName: string;\n  /** Name of the target producing the bundled `index.js`, depended on here. */\n  readonly bundleTargetName: string;\n  /** Directory holding the bundled `index.js`, relative to the workspace root. */\n  readonly bundleOutputDir: string;\n  /** Directory to assemble the deployable package in, relative to the workspace root. */\n  readonly packageOutputDir: string;\n}\n\n/**\n * Add a target assembling the deployable code package for a TypeScript\n * AgentCore Runtime.\n *\n * The package is the rolldown bundle plus a vendored AWS Distro for\n * OpenTelemetry install. AgentCore rejects a code package with no OpenTelemetry\n * dependencies present (`CREATE_FAILED`: \"OpenTelemetry instrumentation\n * executable not found\"), so ADOT must ship inside the package rather than\n * being installed at runtime — the `opentelemetry-instrument` entry point\n * prefix resolves it from there.\n *\n * The install is scoped to the package directory with `--prefix` and\n * `--no-save`, so it never touches the project's own manifest. `--omit=dev`\n * keeps the package to what the runtime loads. ADOT is pure JavaScript with no\n * native binaries, so the package is architecture independent even though\n * AgentCore only runs arm64.\n */\nexport const addTypeScriptCodePackageTarget = <\n  const D extends DependencyDeclaration,\n>(\n  tree: Tree,\n  options: AddTypeScriptCodePackageTargetOptions,\n  declaration: D & MustDeclare<typeof CODE_PACKAGE_DEPENDENCIES, D>,\n): void => {\n  const {\n    project,\n    targetName,\n    bundleTargetName,\n    bundleOutputDir,\n    packageOutputDir,\n  } = options;\n\n  const fs = new FsCommands(\n    tree,\n    forDependencies<typeof FS_DEPENDENCIES>(declaration),\n  );\n  const adotVersion =\n    TS_VERSIONS['@aws/aws-distro-opentelemetry-node-autoinstrumentation'];\n\n  project.targets ??= {};\n  project.targets[targetName] = {\n    cache: true,\n    inputs: ['default'],\n    outputs: [`{workspaceRoot}/${packageOutputDir}`],\n    executor: 'nx:run-commands',\n    options: {\n      commands: [\n        fs.rm(packageOutputDir),\n        fs.mkdir(packageOutputDir),\n        fs.cp(\n          joinPathFragments(bundleOutputDir, 'index.js'),\n          joinPathFragments(packageOutputDir, 'index.js'),\n        ),\n        `npm install --prefix ${packageOutputDir} --no-save --no-audit --no-fund --omit=dev @aws/aws-distro-opentelemetry-node-autoinstrumentation@${adotVersion}`,\n      ],\n      parallel: false,\n    },\n    dependsOn: [bundleTargetName],\n  };\n\n  addArtifactDependencyToTargets(project, targetName);\n};\n\nexport interface AddPythonCodePackageTargetOptions {\n  /** Project configuration to add the target to (mutated in place). */\n  readonly project: ProjectConfiguration;\n  /** Name of the packaging target to add, e.g. `agent-package`. */\n  readonly targetName: string;\n  /** Name of the arm64 bundle target, depended on here. */\n  readonly bundleTargetName: string;\n  /** Directory holding the arm64 bundle, relative to the workspace root. */\n  readonly bundleOutputDir: string;\n  /** Directory to assemble the deployable package in, relative to the workspace root. */\n  readonly packageOutputDir: string;\n  /**\n   * The project's source root, which is itself the module directory — copied\n   * into the package under {@link moduleName} so the agent's imports resolve.\n   */\n  readonly sourceRoot: string;\n  /** Python module name (the source root's last segment). */\n  readonly moduleName: string;\n  /**\n   * Path to the entry point script, relative to the workspace root. Copied to\n   * the package root, where AgentCore's `entryPoint` runs it.\n   */\n  readonly entryPointPath: string;\n  /** File name the entry point takes at the package root. */\n  readonly entryPointFileName: string;\n}\n\n/**\n * Add a target assembling the deployable code package for a Python AgentCore\n * Runtime.\n *\n * The package is the arm64 dependency bundle (which already carries\n * `bin/opentelemetry-instrument` from `aws-opentelemetry-distro`, satisfying\n * AgentCore's requirement that OpenTelemetry be present), the project's own\n * module tree, and a root entry point script.\n *\n * The entry point sits at the package root rather than inside the module:\n * AgentCore runs it as a file path, and Python gives a script run that way no\n * parent package, so the agent's own `from .init import app` would raise\n * `ImportError: attempted relative import with no known parent package`. The\n * root script imports the module absolutely instead, which resolves those\n * relative imports normally.\n */\nexport const addPythonCodePackageTarget = <\n  const D extends DependencyDeclaration,\n>(\n  tree: Tree,\n  options: AddPythonCodePackageTargetOptions,\n  declaration: D & MustDeclare<typeof FS_DEPENDENCIES, D>,\n): void => {\n  const {\n    project,\n    targetName,\n    bundleTargetName,\n    bundleOutputDir,\n    packageOutputDir,\n    sourceRoot,\n    moduleName,\n    entryPointPath,\n    entryPointFileName,\n  } = options;\n\n  const fs = new FsCommands(\n    tree,\n    forDependencies<typeof FS_DEPENDENCIES>(declaration),\n  );\n\n  project.targets ??= {};\n  project.targets[targetName] = {\n    cache: true,\n    inputs: ['production', '^production'],\n    outputs: [`{workspaceRoot}/${packageOutputDir}`],\n    executor: 'nx:run-commands',\n    options: {\n      commands: [\n        fs.rm(packageOutputDir),\n        fs.mkdir(packageOutputDir),\n        fs.cp(bundleOutputDir, packageOutputDir),\n        fs.cp(sourceRoot, joinPathFragments(packageOutputDir, moduleName)),\n        fs.cp(\n          entryPointPath,\n          joinPathFragments(packageOutputDir, entryPointFileName),\n        ),\n      ],\n      parallel: false,\n    },\n    dependsOn: [bundleTargetName],\n  };\n\n  addArtifactDependencyToTargets(project, targetName);\n};\n"],"names":["joinPathFragments","forDependencies","FS_DEPENDENCIES","FsCommands","addArtifactDependencyToTargets","agentCoreRuntime","TS_VERSIONS","AGENT_CORE_INFRA","isAgentCoreHosted","infra","isContainerHosted","agentCoreNodeRuntime","agentCorePythonRuntime","CODE_PACKAGE_DEPENDENCIES","name","addTypeScriptCodePackageTarget","tree","options","declaration","project","targetName","bundleTargetName","bundleOutputDir","packageOutputDir","fs","adotVersion","targets","cache","inputs","outputs","executor","commands","rm","mkdir","cp","parallel","dependsOn","addPythonCodePackageTarget","sourceRoot","moduleName","entryPointPath","entryPointFileName"],"mappings":"AAAA;;;CAGC,GACD,SACEA,iBAAiB,QAGZ,aAAa;AACpB,SAEEC,eAAe,QAEV,6BAA6B;AACpC,SAASC,eAAe,EAAEC,UAAU,QAAQ,UAAU;AACtD,SAASC,8BAA8B,QAAQ,UAAU;AACzD,SACEC,gBAAgB,EAEhBC,WAAW,QACN,gBAAgB;AAEvB;;;;;;;;;CASC,GACD,OAAO,MAAMC,mBAAmB;IAAC;IAAa;IAAiB;CAAO,CAAU;AAIhF,sEAAsE,GACtE,OAAO,MAAMC,oBAAoB,CAACC,QAChCA,UAAU,eAAeA,UAAU,gBAAgB;AAErD,uEAAuE,GACvE,OAAO,MAAMC,oBAAoB,CAACD,QAChCA,UAAU,gBAAgB;AAE5B,kEAAkE,GAClE,OAAO,MAAME,uBAAuB,IAAcN,iBAAiB,QAAQ;AAE3E,8DAA8D,GAC9D,OAAO,MAAMO,yBAAyB,IAAcP,iBAAiB,UAAU;AAE/E;;;;;;;CAOC,GACD,OAAO,MAAMQ,4BAA4B;OACpCX;IACH;QAAEY,MAAM;IAAyD;CAClE,CAAuD;AAexD;;;;;;;;;;;;;;;;CAgBC,GACD,OAAO,MAAMC,iCAAiC,CAG5CC,MACAC,SACAC;IAEA,MAAM,EACJC,OAAO,EACPC,UAAU,EACVC,gBAAgB,EAChBC,eAAe,EACfC,gBAAgB,EACjB,GAAGN;IAEJ,MAAMO,KAAK,IAAIrB,WACba,MACAf,gBAAwCiB;IAE1C,MAAMO,cACJnB,WAAW,CAAC,yDAAyD;IAEvEa,QAAQO,OAAO,KAAK,CAAC;IACrBP,QAAQO,OAAO,CAACN,WAAW,GAAG;QAC5BO,OAAO;QACPC,QAAQ;YAAC;SAAU;QACnBC,SAAS;YAAC,CAAC,gBAAgB,EAAEN,kBAAkB;SAAC;QAChDO,UAAU;QACVb,SAAS;YACPc,UAAU;gBACRP,GAAGQ,EAAE,CAACT;gBACNC,GAAGS,KAAK,CAACV;gBACTC,GAAGU,EAAE,CACHlC,kBAAkBsB,iBAAiB,aACnCtB,kBAAkBuB,kBAAkB;gBAEtC,CAAC,qBAAqB,EAAEA,iBAAiB,kGAAkG,EAAEE,aAAa;aAC3J;YACDU,UAAU;QACZ;QACAC,WAAW;YAACf;SAAiB;IAC/B;IAEAjB,+BAA+Be,SAASC;AAC1C,EAAE;AA6BF;;;;;;;;;;;;;;;CAeC,GACD,OAAO,MAAMiB,6BAA6B,CAGxCrB,MACAC,SACAC;IAEA,MAAM,EACJC,OAAO,EACPC,UAAU,EACVC,gBAAgB,EAChBC,eAAe,EACfC,gBAAgB,EAChBe,UAAU,EACVC,UAAU,EACVC,cAAc,EACdC,kBAAkB,EACnB,GAAGxB;IAEJ,MAAMO,KAAK,IAAIrB,WACba,MACAf,gBAAwCiB;IAG1CC,QAAQO,OAAO,KAAK,CAAC;IACrBP,QAAQO,OAAO,CAACN,WAAW,GAAG;QAC5BO,OAAO;QACPC,QAAQ;YAAC;YAAc;SAAc;QACrCC,SAAS;YAAC,CAAC,gBAAgB,EAAEN,kBAAkB;SAAC;QAChDO,UAAU;QACVb,SAAS;YACPc,UAAU;gBACRP,GAAGQ,EAAE,CAACT;gBACNC,GAAGS,KAAK,CAACV;gBACTC,GAAGU,EAAE,CAACZ,iBAAiBC;gBACvBC,GAAGU,EAAE,CAACI,YAAYtC,kBAAkBuB,kBAAkBgB;gBACtDf,GAAGU,EAAE,CACHM,gBACAxC,kBAAkBuB,kBAAkBkB;aAEvC;YACDN,UAAU;QACZ;QACAC,WAAW;YAACf;SAAiB;IAC/B;IAEAjB,+BAA+Be,SAASC;AAC1C,EAAE"}
+{"version":3,"sources":["../../../../../packages/nx-plugin/src/utils/agent-core-packaging.ts"],"sourcesContent":["/**\n * Copyright Amazon.com, Inc. or its affiliates. All Rights Reserved.\n * SPDX-License-Identifier: Apache-2.0\n */\nimport {\n  joinPathFragments,\n  type ProjectConfiguration,\n  type Tree,\n} from '@nx/devkit';\nimport {\n  type DependencyDeclaration,\n  forDependencies,\n  type MustDeclare,\n} from './declared-dependencies.js';\nimport { FS_DEPENDENCIES, FsCommands } from './fs.js';\nimport { addArtifactDependencyToTargets } from './nx.js';\nimport {\n  agentCoreRuntime,\n  type ITsDepVersion,\n  TS_VERSIONS,\n} from './versions.js';\n\n/**\n * How an AgentCore Runtime's artifact is packaged and hosted.\n *\n * `agentcore` uploads a `.zip` of the built code to S3 and runs it on an\n * AgentCore managed language runtime, which skips the container build, ECR\n * repository and image push entirely — the fastest build and deploy cycle.\n * `agentcore-ecr` builds an arm64 container image and hosts it from ECR, for\n * workloads needing OS-level control (e.g. native system libraries) or an\n * established container pipeline.\n */\nexport const AGENT_CORE_INFRA = ['agentcore', 'agentcore-ecr', 'none'] as const;\n\nexport type AgentCoreInfra = (typeof AGENT_CORE_INFRA)[number];\n\n/** Whether the given infra option hosts on AgentCore Runtime at all. */\nexport const isAgentCoreHosted = (infra: AgentCoreInfra): boolean =>\n  infra === 'agentcore' || infra === 'agentcore-ecr';\n\n/** Whether the given infra option builds and hosts a container image. */\nexport const isContainerHosted = (infra: AgentCoreInfra): boolean =>\n  infra === 'agentcore-ecr';\n\n/** The AgentCore managed runtime a TypeScript component targets. */\nexport const agentCoreNodeRuntime = (): string => agentCoreRuntime('node');\n\n/** The AgentCore managed runtime a Python component targets. */\nexport const agentCorePythonRuntime = (): string => agentCoreRuntime('python');\n\n/**\n * Dependencies a caller must declare to add a code (`.zip`) packaging target.\n *\n * The TypeScript package target vendors the AWS Distro for OpenTelemetry into\n * the package directory, so its version is declared here (spread through\n * `ownedElsewhere` by callers, since the install targets the built package\n * rather than any workspace manifest).\n */\nexport const CODE_PACKAGE_DEPENDENCIES = [\n  ...FS_DEPENDENCIES,\n  { name: '@aws/aws-distro-opentelemetry-node-autoinstrumentation' },\n] as const satisfies readonly { name: ITsDepVersion }[];\n\nexport interface AddTypeScriptCodePackageTargetOptions {\n  /** Project configuration to add the target to (mutated in place). */\n  readonly project: ProjectConfiguration;\n  /** Name of the packaging target to add, e.g. `agent-package`. */\n  readonly targetName: string;\n  /** Name of the target producing the bundled `index.js`, depended on here. */\n  readonly bundleTargetName: string;\n  /** Directory holding the bundled `index.js`, relative to the workspace root. */\n  readonly bundleOutputDir: string;\n  /** Directory to assemble the deployable package in, relative to the workspace root. */\n  readonly packageOutputDir: string;\n}\n\n/**\n * Name of the target that installs ADOT for the project's code packages. Every\n * code package in a project vendors the same thing, so they share one.\n */\nexport const ADOT_VENDOR_TARGET_NAME = 'agent-core-vendor';\n\n/**\n * Directory the vendor target installs into, relative to the workspace root.\n *\n * A sibling of the `package` directory rather than a path inside it: Nx replaces\n * a cached target's whole declared output directory on restore, so an output\n * nested inside another target's output would have each wipe the other's work on\n * a cache hit.\n */\nexport const adotVendorDir = (projectRoot: string): string =>\n  joinPathFragments('dist', projectRoot, 'agent-core-vendor');\n\n/**\n * Add a target assembling the deployable code package for a TypeScript\n * AgentCore Runtime.\n *\n * The package is the rolldown bundle plus a vendored AWS Distro for\n * OpenTelemetry install. AgentCore rejects a code package with no OpenTelemetry\n * dependencies present (`CREATE_FAILED`: \"OpenTelemetry instrumentation\n * executable not found\"), so ADOT must ship inside the package rather than\n * being installed at runtime — the `opentelemetry-instrument` entry point\n * prefix resolves it from there.\n *\n * The install is scoped to its own directory with `--prefix` and `--no-save`, so\n * it never touches the project's own manifest. `--omit=dev` keeps the package to\n * what the runtime loads. ADOT is pure JavaScript with no native binaries, so the\n * package is architecture independent even though AgentCore only runs arm64.\n *\n * Vendoring is a separate target so Nx caches it independently of the source. It\n * depends on nothing but the pinned ADOT version, which the install command\n * carries and Nx hashes as part of the target's configuration, so it declares no\n * `inputs`: editing an agent replays a directory copy rather than re-running the\n * install, while bumping the version still invalidates it.\n */\nexport const addTypeScriptCodePackageTarget = <\n  const D extends DependencyDeclaration,\n>(\n  tree: Tree,\n  options: AddTypeScriptCodePackageTargetOptions,\n  declaration: D & MustDeclare<typeof CODE_PACKAGE_DEPENDENCIES, D>,\n): void => {\n  const {\n    project,\n    targetName,\n    bundleTargetName,\n    bundleOutputDir,\n    packageOutputDir,\n  } = options;\n\n  const fs = new FsCommands(\n    tree,\n    forDependencies<typeof FS_DEPENDENCIES>(declaration),\n  );\n  const adotVersion =\n    TS_VERSIONS['@aws/aws-distro-opentelemetry-node-autoinstrumentation'];\n  const vendorDir = adotVendorDir(project.root);\n\n  project.targets ??= {};\n\n  // Shared by every code package in the project, so only added once.\n  project.targets[ADOT_VENDOR_TARGET_NAME] ??= {\n    cache: true,\n    inputs: [],\n    outputs: [`{workspaceRoot}/${vendorDir}`],\n    executor: 'nx:run-commands',\n    options: {\n      commands: [\n        fs.rm(vendorDir),\n        fs.mkdir(vendorDir),\n        `npm install --prefix ${vendorDir} --no-save --no-audit --no-fund --omit=dev @aws/aws-distro-opentelemetry-node-autoinstrumentation@${adotVersion}`,\n      ],\n      parallel: false,\n    },\n  };\n\n  project.targets[targetName] = {\n    cache: true,\n    inputs: ['default'],\n    outputs: [`{workspaceRoot}/${packageOutputDir}`],\n    executor: 'nx:run-commands',\n    options: {\n      commands: [\n        fs.rm(packageOutputDir),\n        fs.mkdir(packageOutputDir),\n        fs.cpFile(\n          joinPathFragments(bundleOutputDir, 'index.js'),\n          joinPathFragments(packageOutputDir, 'index.js'),\n        ),\n        fs.cpDir(\n          joinPathFragments(vendorDir, 'node_modules'),\n          joinPathFragments(packageOutputDir, 'node_modules'),\n        ),\n      ],\n      parallel: false,\n    },\n    dependsOn: [bundleTargetName, ADOT_VENDOR_TARGET_NAME],\n  };\n\n  addArtifactDependencyToTargets(project, targetName);\n};\n\nexport interface AddPythonCodePackageTargetOptions {\n  /** Project configuration to add the target to (mutated in place). */\n  readonly project: ProjectConfiguration;\n  /** Name of the packaging target to add, e.g. `agent-package`. */\n  readonly targetName: string;\n  /** Name of the arm64 bundle target, depended on here. */\n  readonly bundleTargetName: string;\n  /** Directory holding the arm64 bundle, relative to the workspace root. */\n  readonly bundleOutputDir: string;\n  /** Directory to assemble the deployable package in, relative to the workspace root. */\n  readonly packageOutputDir: string;\n  /**\n   * The project's source root, which is itself the module directory — copied\n   * into the package under {@link moduleName} so the agent's imports resolve.\n   */\n  readonly sourceRoot: string;\n  /** Python module name (the source root's last segment). */\n  readonly moduleName: string;\n  /**\n   * Path to the entry point script, relative to the workspace root. Copied to\n   * the package root, where AgentCore's `entryPoint` runs it.\n   */\n  readonly entryPointPath: string;\n  /** File name the entry point takes at the package root. */\n  readonly entryPointFileName: string;\n}\n\n/**\n * Add a target assembling the deployable code package for a Python AgentCore\n * Runtime.\n *\n * The package is the arm64 dependency bundle (which already carries\n * `bin/opentelemetry-instrument` from `aws-opentelemetry-distro`, satisfying\n * AgentCore's requirement that OpenTelemetry be present), the project's own\n * module tree, and a root entry point script.\n *\n * The entry point sits at the package root rather than inside the module:\n * AgentCore runs it as a file path, and Python gives a script run that way no\n * parent package, so the agent's own `from .init import app` would raise\n * `ImportError: attempted relative import with no known parent package`. The\n * root script imports the module absolutely instead, which resolves those\n * relative imports normally.\n */\nexport const addPythonCodePackageTarget = <\n  const D extends DependencyDeclaration,\n>(\n  tree: Tree,\n  options: AddPythonCodePackageTargetOptions,\n  declaration: D & MustDeclare<typeof FS_DEPENDENCIES, D>,\n): void => {\n  const {\n    project,\n    targetName,\n    bundleTargetName,\n    bundleOutputDir,\n    packageOutputDir,\n    sourceRoot,\n    moduleName,\n    entryPointPath,\n    entryPointFileName,\n  } = options;\n\n  const fs = new FsCommands(\n    tree,\n    forDependencies<typeof FS_DEPENDENCIES>(declaration),\n  );\n\n  project.targets ??= {};\n  project.targets[targetName] = {\n    cache: true,\n    inputs: ['production', '^production'],\n    outputs: [`{workspaceRoot}/${packageOutputDir}`],\n    executor: 'nx:run-commands',\n    options: {\n      commands: [\n        fs.rm(packageOutputDir),\n        fs.mkdir(packageOutputDir),\n        fs.cpDir(bundleOutputDir, packageOutputDir),\n        fs.cpDir(sourceRoot, joinPathFragments(packageOutputDir, moduleName)),\n        fs.cpFile(\n          entryPointPath,\n          joinPathFragments(packageOutputDir, entryPointFileName),\n        ),\n      ],\n      parallel: false,\n    },\n    dependsOn: [bundleTargetName],\n  };\n\n  addArtifactDependencyToTargets(project, targetName);\n};\n"],"names":["joinPathFragments","forDependencies","FS_DEPENDENCIES","FsCommands","addArtifactDependencyToTargets","agentCoreRuntime","TS_VERSIONS","AGENT_CORE_INFRA","isAgentCoreHosted","infra","isContainerHosted","agentCoreNodeRuntime","agentCorePythonRuntime","CODE_PACKAGE_DEPENDENCIES","name","ADOT_VENDOR_TARGET_NAME","adotVendorDir","projectRoot","addTypeScriptCodePackageTarget","tree","options","declaration","project","targetName","bundleTargetName","bundleOutputDir","packageOutputDir","fs","adotVersion","vendorDir","root","targets","cache","inputs","outputs","executor","commands","rm","mkdir","parallel","cpFile","cpDir","dependsOn","addPythonCodePackageTarget","sourceRoot","moduleName","entryPointPath","entryPointFileName"],"mappings":"AAAA;;;CAGC,GACD,SACEA,iBAAiB,QAGZ,aAAa;AACpB,SAEEC,eAAe,QAEV,6BAA6B;AACpC,SAASC,eAAe,EAAEC,UAAU,QAAQ,UAAU;AACtD,SAASC,8BAA8B,QAAQ,UAAU;AACzD,SACEC,gBAAgB,EAEhBC,WAAW,QACN,gBAAgB;AAEvB;;;;;;;;;CASC,GACD,OAAO,MAAMC,mBAAmB;IAAC;IAAa;IAAiB;CAAO,CAAU;AAIhF,sEAAsE,GACtE,OAAO,MAAMC,oBAAoB,CAACC,QAChCA,UAAU,eAAeA,UAAU,gBAAgB;AAErD,uEAAuE,GACvE,OAAO,MAAMC,oBAAoB,CAACD,QAChCA,UAAU,gBAAgB;AAE5B,kEAAkE,GAClE,OAAO,MAAME,uBAAuB,IAAcN,iBAAiB,QAAQ;AAE3E,8DAA8D,GAC9D,OAAO,MAAMO,yBAAyB,IAAcP,iBAAiB,UAAU;AAE/E;;;;;;;CAOC,GACD,OAAO,MAAMQ,4BAA4B;OACpCX;IACH;QAAEY,MAAM;IAAyD;CAClE,CAAuD;AAexD;;;CAGC,GACD,OAAO,MAAMC,0BAA0B,oBAAoB;AAE3D;;;;;;;CAOC,GACD,OAAO,MAAMC,gBAAgB,CAACC,cAC5BjB,kBAAkB,QAAQiB,aAAa,qBAAqB;AAE9D;;;;;;;;;;;;;;;;;;;;;CAqBC,GACD,OAAO,MAAMC,iCAAiC,CAG5CC,MACAC,SACAC;IAEA,MAAM,EACJC,OAAO,EACPC,UAAU,EACVC,gBAAgB,EAChBC,eAAe,EACfC,gBAAgB,EACjB,GAAGN;IAEJ,MAAMO,KAAK,IAAIxB,WACbgB,MACAlB,gBAAwCoB;IAE1C,MAAMO,cACJtB,WAAW,CAAC,yDAAyD;IACvE,MAAMuB,YAAYb,cAAcM,QAAQQ,IAAI;IAE5CR,QAAQS,OAAO,KAAK,CAAC;IAErB,mEAAmE;IACnET,QAAQS,OAAO,CAAChB,wBAAwB,KAAK;QAC3CiB,OAAO;QACPC,QAAQ,EAAE;QACVC,SAAS;YAAC,CAAC,gBAAgB,EAAEL,WAAW;SAAC;QACzCM,UAAU;QACVf,SAAS;YACPgB,UAAU;gBACRT,GAAGU,EAAE,CAACR;gBACNF,GAAGW,KAAK,CAACT;gBACT,CAAC,qBAAqB,EAAEA,UAAU,kGAAkG,EAAED,aAAa;aACpJ;YACDW,UAAU;QACZ;IACF;IAEAjB,QAAQS,OAAO,CAACR,WAAW,GAAG;QAC5BS,OAAO;QACPC,QAAQ;YAAC;SAAU;QACnBC,SAAS;YAAC,CAAC,gBAAgB,EAAER,kBAAkB;SAAC;QAChDS,UAAU;QACVf,SAAS;YACPgB,UAAU;gBACRT,GAAGU,EAAE,CAACX;gBACNC,GAAGW,KAAK,CAACZ;gBACTC,GAAGa,MAAM,CACPxC,kBAAkByB,iBAAiB,aACnCzB,kBAAkB0B,kBAAkB;gBAEtCC,GAAGc,KAAK,CACNzC,kBAAkB6B,WAAW,iBAC7B7B,kBAAkB0B,kBAAkB;aAEvC;YACDa,UAAU;QACZ;QACAG,WAAW;YAAClB;YAAkBT;SAAwB;IACxD;IAEAX,+BAA+BkB,SAASC;AAC1C,EAAE;AA6BF;;;;;;;;;;;;;;;CAeC,GACD,OAAO,MAAMoB,6BAA6B,CAGxCxB,MACAC,SACAC;IAEA,MAAM,EACJC,OAAO,EACPC,UAAU,EACVC,gBAAgB,EAChBC,eAAe,EACfC,gBAAgB,EAChBkB,UAAU,EACVC,UAAU,EACVC,cAAc,EACdC,kBAAkB,EACnB,GAAG3B;IAEJ,MAAMO,KAAK,IAAIxB,WACbgB,MACAlB,gBAAwCoB;IAG1CC,QAAQS,OAAO,KAAK,CAAC;IACrBT,QAAQS,OAAO,CAACR,WAAW,GAAG;QAC5BS,OAAO;QACPC,QAAQ;YAAC;YAAc;SAAc;QACrCC,SAAS;YAAC,CAAC,gBAAgB,EAAER,kBAAkB;SAAC;QAChDS,UAAU;QACVf,SAAS;YACPgB,UAAU;gBACRT,GAAGU,EAAE,CAACX;gBACNC,GAAGW,KAAK,CAACZ;gBACTC,GAAGc,KAAK,CAAChB,iBAAiBC;gBAC1BC,GAAGc,KAAK,CAACG,YAAY5C,kBAAkB0B,kBAAkBmB;gBACzDlB,GAAGa,MAAM,CACPM,gBACA9C,kBAAkB0B,kBAAkBqB;aAEvC;YACDR,UAAU;QACZ;QACAG,WAAW;YAAClB;SAAiB;IAC/B;IAEApB,+BAA+BkB,SAASC;AAC1C,EAAE"}

package/src/utils/bundle/bundle.js

@@ -5,6 +5,8 @@
 import { applyGritQL } from "../ast.js";
 import { forDependencies } from "../declared-dependencies.js";
 import { addDependenciesToPackageJson } from "../dependencies.js";
+import { ROLLDOWN_CONFIG_BUNDLE_GLOB } from "../format.js";
+import { updateGitIgnore } from "../git.js";
 import { addArtifactDependencyToTargets, addDependencyToTargetIfNotPresent, normalizeTargetKeyOrder } from "../nx.js";
 import { getRelativePathToRoot } from "../paths.js";
 import { LAMBDA_RUNTIME_VERSIONS, withVersions } from "../versions.js";
@@ -76,6 +78,14 @@ import { LAMBDA_RUNTIME_VERSIONS, withVersions } from "../versions.js";
     generateFiles(tree, joinPathFragments(import.meta.dirname, 'files', 'ts'), project.root, {}, {
         overwriteStrategy: OverwriteStrategy.KeepExisting
     });
+    // Loading a TypeScript config bundles it to `rolldown.config.<hash>.js` beside
+    // itself, imports it, then unlinks it. Kept out of git so the transient file
+    // can never be committed, nor picked up by `license#sync`, which builds its
+    // candidate set from git-visible files.
+    updateGitIgnore(tree, project.root, (patterns)=>patterns.includes(ROLLDOWN_CONFIG_BUNDLE_GLOB) ? patterns : [
+            ...patterns,
+            ROLLDOWN_CONFIG_BUNDLE_GLOB
+        ]);
     // Add the bundle target
     if (!project.targets.bundle) {
         project.targets.bundle = normalizeTargetKeyOrder({

package/src/utils/bundle/bundle.js.map

@@ -1 +1 @@
-{"version":3,"sources":["../../../../../../packages/nx-plugin/src/utils/bundle/bundle.ts"],"sourcesContent":["/**\n * Copyright Amazon.com, Inc. or its affiliates. All Rights Reserved.\n * SPDX-License-Identifier: Apache-2.0\n */\n\nimport {\n  generateFiles,\n  joinPathFragments,\n  OverwriteStrategy,\n  type ProjectConfiguration,\n  type TargetConfiguration,\n  type Tree,\n} from '@nx/devkit';\nimport { applyGritQL } from '../ast.js';\nimport {\n  type DependencyDeclaration,\n  forDependencies,\n  type MustDeclare,\n} from '../declared-dependencies.js';\nimport { addDependenciesToPackageJson } from '../dependencies.js';\nimport {\n  addArtifactDependencyToTargets,\n  addDependencyToTargetIfNotPresent,\n  normalizeTargetKeyOrder,\n} from '../nx.js';\nimport { getRelativePathToRoot } from '../paths.js';\nimport {\n  type ITsDepVersion,\n  LAMBDA_RUNTIME_VERSIONS,\n  withVersions,\n} from '../versions.js';\n\n/** Dependencies a caller must declare to add a TypeScript bundle target. */\nexport const BUNDLE_DEPENDENCIES = [\n  { name: 'rolldown' },\n] as const satisfies readonly { name: ITsDepVersion }[];\n\nexport interface AddPythonBundleTargetOptions {\n  /**\n   * Python platform\n   * @default x86_64-manylinux_2_28\n   */\n  pythonPlatform?: 'x86_64-manylinux_2_28' | 'aarch64-manylinux_2_28';\n}\n\ninterface CreatePythonBundleTargetOptions\n  extends Required<AddPythonBundleTargetOptions> {\n  /**\n   * Python package name\n   */\n  packageName: string;\n\n  /**\n   * Name of the bundle target, used for the outdir for the bundle\n   */\n  bundleTargetName: string;\n}\n\n/**\n * Create a target for bundling a python project\n */\nconst createPythonBundleTarget = ({\n  packageName,\n  pythonPlatform,\n  bundleTargetName,\n}: CreatePythonBundleTargetOptions): TargetConfiguration => {\n  return {\n    cache: true,\n    // The bundle holds exported dependencies and the entrypoint script, never\n    // test files, so tests are excluded via `production`.\n    inputs: ['production', '^production'],\n    executor: 'nx:run-commands',\n    outputs: [`{workspaceRoot}/dist/{projectRoot}/${bundleTargetName}`],\n    options: {\n      commands: [\n        `uv export --frozen --no-dev --no-editable --project {projectRoot} --package ${packageName} -o dist/{projectRoot}/${bundleTargetName}/requirements.txt`,\n        // `--python-version` pins wheel resolution to the Lambda Python runtime,\n        // so the bundle cannot be built against whichever interpreter happens to\n        // be on the build machine.\n        `uv pip install -n --no-deps --no-installer-metadata --no-compile-bytecode --python-platform ${pythonPlatform} --python-version ${LAMBDA_RUNTIME_VERSIONS.python} --target dist/{projectRoot}/${bundleTargetName} -r dist/{projectRoot}/${bundleTargetName}/requirements.txt`,\n      ],\n      parallel: false,\n    },\n  };\n};\n\n/**\n * Adds a bundle target to the given project if it does not exist, and updates the build target to depend on it\n */\nexport const addPythonBundleTarget = (\n  project: ProjectConfiguration,\n  opts?: AddPythonBundleTargetOptions,\n) => {\n  if (!project.targets) {\n    project.targets = {};\n  }\n\n  const pythonPlatform = opts?.pythonPlatform ?? 'x86_64-manylinux_2_28';\n  const bundleTargetName =\n    pythonPlatform === 'aarch64-manylinux_2_28' ? 'bundle-arm' : 'bundle-x86';\n\n  if (!project.targets?.[bundleTargetName]) {\n    project.targets[bundleTargetName] = normalizeTargetKeyOrder({\n      ...createPythonBundleTarget({\n        packageName: project.name,\n        pythonPlatform,\n        bundleTargetName,\n      }),\n      dependsOn: ['compile'],\n    });\n  }\n\n  // Add a \"bundle\" target which depends on either bundle-arm or bundle-x86 (or both)\n  addDependencyToTargetIfNotPresent(project, 'bundle', bundleTargetName);\n  addArtifactDependencyToTargets(project, 'bundle');\n\n  return {\n    bundleTargetName,\n    bundleOutputDir: joinPathFragments('dist', project.root, bundleTargetName),\n  };\n};\n\nexport interface AddTypeScriptBundleTargetOptions {\n  /**\n   * Path to the target file relative to the project dir\n   */\n  targetFilePath: string;\n\n  /**\n   * Sub directory to write bundled index.js file to (if any)\n   * Outputs to dist/{projectRoot}/bundle/{bundleOutputDir}/index.js\n   */\n  bundleOutputDir?: string;\n\n  /**\n   * Modules to omit from the bundle and treat as external\n   */\n  external?: (string | RegExp)[];\n\n  /**\n   * Target platform for the bundle\n   * @default 'node'\n   */\n  platform?: 'node' | 'browser' | 'neutral';\n}\n\n/**\n * Add a TypeScript bundle target using rolldown\n */\nexport const addTypeScriptBundleTarget = async <\n  const D extends DependencyDeclaration,\n>(\n  tree: Tree,\n  project: ProjectConfiguration,\n  opts: AddTypeScriptBundleTargetOptions,\n  declaration: D & MustDeclare<typeof BUNDLE_DEPENDENCIES, D>,\n) => {\n  project.targets ??= {};\n\n  // Generate empty rolldown config if it doesn't exist\n  generateFiles(\n    tree,\n    joinPathFragments(import.meta.dirname, 'files', 'ts'),\n    project.root,\n    {},\n    { overwriteStrategy: OverwriteStrategy.KeepExisting },\n  );\n\n  // Add the bundle target\n  if (!project.targets.bundle) {\n    project.targets.bundle = normalizeTargetKeyOrder({\n      cache: true,\n      // Declared rather than left to Nx's implicit `[\"default\", \"^default\"]`,\n      // which reads a dependency's whole project directory: rolldown resolves\n      // dependencies through the build artifacts `default` already tracks, so\n      // `^default` only adds files no bundle can contain.\n      inputs: ['default'],\n      outputs: [`{workspaceRoot}/dist/{projectRoot}/bundle`],\n      executor: 'nx:run-commands',\n      options: {\n        command: 'rolldown -c rolldown.config.ts',\n        cwd: '{projectRoot}',\n      },\n      dependsOn: ['compile'],\n    });\n  }\n\n  // Add bundle to the build target\n  addArtifactDependencyToTargets(project, 'bundle');\n\n  const rolldownConfigPath = joinPathFragments(\n    project.root,\n    'rolldown.config.ts',\n  );\n\n  const outputFile = joinPathFragments(\n    getRelativePathToRoot(tree, project.name),\n    'dist',\n    project.root,\n    'bundle',\n    opts.bundleOutputDir ?? '.',\n    'index.js',\n  );\n\n  const external = opts.external?.length\n    ? opts.external\n        .map((ext) =>\n          typeof ext === 'string' ? `'${ext}'` : `/${ext.source}/`,\n        )\n        .join(', ')\n    : '';\n\n  const entry = `{\n    tsconfig: 'tsconfig.lib.json',\n    input: '${opts.targetFilePath}',\n    output: { file: '${outputFile}', format: 'cjs', codeSplitting: false },\n    platform: '${opts.platform ?? 'node'}',\n    ${external ? `external: [${external}],` : ''}\n  }`;\n\n  // Use GritQL to append the config entry to the defineConfig array.\n  // First try the non-empty array case using the accumulate (+=) operator,\n  // with an idempotency guard that checks the input path is not already present.\n  const appended = await applyGritQL(\n    tree,\n    rolldownConfigPath,\n    `\\`defineConfig([$items])\\` where { $items <: not contains \\`'${opts.targetFilePath}'\\`, $items += \", ${entry}\" }`,\n  );\n\n  if (!appended) {\n    // Empty array — GritQL's += cannot accumulate into an empty list, so we\n    // first insert a placeholder to make the array non-empty, then replace\n    // the placeholder with the real entry via += (which handles regex\n    // literals that are invalid inside GritQL backtick snippets).\n    const inserted = await applyGritQL(\n      tree,\n      rolldownConfigPath,\n      `\\`defineConfig([])\\` => \\`defineConfig([__PLACEHOLDER__])\\``,\n    );\n    if (inserted) {\n      await applyGritQL(\n        tree,\n        rolldownConfigPath,\n        `\\`defineConfig([$items])\\` where { $items <: \\`__PLACEHOLDER__\\` => ., $items += \"${entry}\" }`,\n      );\n    }\n  }\n\n  addDependenciesToPackageJson(\n    tree,\n    {},\n    withVersions(forDependencies<typeof BUNDLE_DEPENDENCIES>(declaration), [\n      'rolldown',\n    ]),\n  );\n};\n"],"names":["generateFiles","joinPathFragments","OverwriteStrategy","applyGritQL","forDependencies","addDependenciesToPackageJson","addArtifactDependencyToTargets","addDependencyToTargetIfNotPresent","normalizeTargetKeyOrder","getRelativePathToRoot","LAMBDA_RUNTIME_VERSIONS","withVersions","BUNDLE_DEPENDENCIES","name","createPythonBundleTarget","packageName","pythonPlatform","bundleTargetName","cache","inputs","executor","outputs","options","commands","python","parallel","addPythonBundleTarget","project","opts","targets","dependsOn","bundleOutputDir","root","addTypeScriptBundleTarget","tree","declaration","dirname","overwriteStrategy","KeepExisting","bundle","command","cwd","rolldownConfigPath","outputFile","external","length","map","ext","source","join","entry","targetFilePath","platform","appended","inserted"],"mappings":"AAAA;;;CAGC,GAED,SACEA,aAAa,EACbC,iBAAiB,EACjBC,iBAAiB,QAIZ,aAAa;AACpB,SAASC,WAAW,QAAQ,YAAY;AACxC,SAEEC,eAAe,QAEV,8BAA8B;AACrC,SAASC,4BAA4B,QAAQ,qBAAqB;AAClE,SACEC,8BAA8B,EAC9BC,iCAAiC,EACjCC,uBAAuB,QAClB,WAAW;AAClB,SAASC,qBAAqB,QAAQ,cAAc;AACpD,SAEEC,uBAAuB,EACvBC,YAAY,QACP,iBAAiB;AAExB,0EAA0E,GAC1E,OAAO,MAAMC,sBAAsB;IACjC;QAAEC,MAAM;IAAW;CACpB,CAAuD;AAuBxD;;CAEC,GACD,MAAMC,2BAA2B,CAAC,EAChCC,WAAW,EACXC,cAAc,EACdC,gBAAgB,EACgB;IAChC,OAAO;QACLC,OAAO;QACP,0EAA0E;QAC1E,sDAAsD;QACtDC,QAAQ;YAAC;YAAc;SAAc;QACrCC,UAAU;QACVC,SAAS;YAAC,CAAC,mCAAmC,EAAEJ,kBAAkB;SAAC;QACnEK,SAAS;YACPC,UAAU;gBACR,CAAC,4EAA4E,EAAER,YAAY,uBAAuB,EAAEE,iBAAiB,iBAAiB,CAAC;gBACvJ,yEAAyE;gBACzE,yEAAyE;gBACzE,2BAA2B;gBAC3B,CAAC,4FAA4F,EAAED,eAAe,kBAAkB,EAAEN,wBAAwBc,MAAM,CAAC,6BAA6B,EAAEP,iBAAiB,uBAAuB,EAAEA,iBAAiB,iBAAiB,CAAC;aAC9Q;YACDQ,UAAU;QACZ;IACF;AACF;AAEA;;CAEC,GACD,OAAO,MAAMC,wBAAwB,CACnCC,SACAC;IAEA,IAAI,CAACD,QAAQE,OAAO,EAAE;QACpBF,QAAQE,OAAO,GAAG,CAAC;IACrB;IAEA,MAAMb,iBAAiBY,MAAMZ,kBAAkB;IAC/C,MAAMC,mBACJD,mBAAmB,2BAA2B,eAAe;IAE/D,IAAI,CAACW,QAAQE,OAAO,EAAE,CAACZ,iBAAiB,EAAE;QACxCU,QAAQE,OAAO,CAACZ,iBAAiB,GAAGT,wBAAwB;YAC1D,GAAGM,yBAAyB;gBAC1BC,aAAaY,QAAQd,IAAI;gBACzBG;gBACAC;YACF,EAAE;YACFa,WAAW;gBAAC;aAAU;QACxB;IACF;IAEA,mFAAmF;IACnFvB,kCAAkCoB,SAAS,UAAUV;IACrDX,+BAA+BqB,SAAS;IAExC,OAAO;QACLV;QACAc,iBAAiB9B,kBAAkB,QAAQ0B,QAAQK,IAAI,EAAEf;IAC3D;AACF,EAAE;AA0BF;;CAEC,GACD,OAAO,MAAMgB,4BAA4B,OAGvCC,MACAP,SACAC,MACAO;IAEAR,QAAQE,OAAO,KAAK,CAAC;IAErB,qDAAqD;IACrD7B,cACEkC,MACAjC,kBAAkB,YAAYmC,OAAO,EAAE,SAAS,OAChDT,QAAQK,IAAI,EACZ,CAAC,GACD;QAAEK,mBAAmBnC,kBAAkBoC,YAAY;IAAC;IAGtD,wBAAwB;IACxB,IAAI,CAACX,QAAQE,OAAO,CAACU,MAAM,EAAE;QAC3BZ,QAAQE,OAAO,CAACU,MAAM,GAAG/B,wBAAwB;YAC/CU,OAAO;YACP,wEAAwE;YACxE,wEAAwE;YACxE,wEAAwE;YACxE,oDAAoD;YACpDC,QAAQ;gBAAC;aAAU;YACnBE,SAAS;gBAAC,CAAC,yCAAyC,CAAC;aAAC;YACtDD,UAAU;YACVE,SAAS;gBACPkB,SAAS;gBACTC,KAAK;YACP;YACAX,WAAW;gBAAC;aAAU;QACxB;IACF;IAEA,iCAAiC;IACjCxB,+BAA+BqB,SAAS;IAExC,MAAMe,qBAAqBzC,kBACzB0B,QAAQK,IAAI,EACZ;IAGF,MAAMW,aAAa1C,kBACjBQ,sBAAsByB,MAAMP,QAAQd,IAAI,GACxC,QACAc,QAAQK,IAAI,EACZ,UACAJ,KAAKG,eAAe,IAAI,KACxB;IAGF,MAAMa,WAAWhB,KAAKgB,QAAQ,EAAEC,SAC5BjB,KAAKgB,QAAQ,CACVE,GAAG,CAAC,CAACC,MACJ,OAAOA,QAAQ,WAAW,CAAC,CAAC,EAAEA,IAAI,CAAC,CAAC,GAAG,CAAC,CAAC,EAAEA,IAAIC,MAAM,CAAC,CAAC,CAAC,EAEzDC,IAAI,CAAC,QACR;IAEJ,MAAMC,QAAQ,CAAC;;YAEL,EAAEtB,KAAKuB,cAAc,CAAC;qBACb,EAAER,WAAW;eACnB,EAAEf,KAAKwB,QAAQ,IAAI,OAAO;IACrC,EAAER,WAAW,CAAC,WAAW,EAAEA,SAAS,EAAE,CAAC,GAAG,GAAG;GAC9C,CAAC;IAEF,mEAAmE;IACnE,yEAAyE;IACzE,+EAA+E;IAC/E,MAAMS,WAAW,MAAMlD,YACrB+B,MACAQ,oBACA,CAAC,6DAA6D,EAAEd,KAAKuB,cAAc,CAAC,kBAAkB,EAAED,MAAM,GAAG,CAAC;IAGpH,IAAI,CAACG,UAAU;QACb,wEAAwE;QACxE,uEAAuE;QACvE,kEAAkE;QAClE,8DAA8D;QAC9D,MAAMC,WAAW,MAAMnD,YACrB+B,MACAQ,oBACA,CAAC,2DAA2D,CAAC;QAE/D,IAAIY,UAAU;YACZ,MAAMnD,YACJ+B,MACAQ,oBACA,CAAC,kFAAkF,EAAEQ,MAAM,GAAG,CAAC;QAEnG;IACF;IAEA7C,6BACE6B,MACA,CAAC,GACDvB,aAAaP,gBAA4C+B,cAAc;QACrE;KACD;AAEL,EAAE"}
+{"version":3,"sources":["../../../../../../packages/nx-plugin/src/utils/bundle/bundle.ts"],"sourcesContent":["/**\n * Copyright Amazon.com, Inc. or its affiliates. All Rights Reserved.\n * SPDX-License-Identifier: Apache-2.0\n */\n\nimport {\n  generateFiles,\n  joinPathFragments,\n  OverwriteStrategy,\n  type ProjectConfiguration,\n  type TargetConfiguration,\n  type Tree,\n} from '@nx/devkit';\nimport { applyGritQL } from '../ast.js';\nimport {\n  type DependencyDeclaration,\n  forDependencies,\n  type MustDeclare,\n} from '../declared-dependencies.js';\nimport { addDependenciesToPackageJson } from '../dependencies.js';\nimport { ROLLDOWN_CONFIG_BUNDLE_GLOB } from '../format.js';\nimport { updateGitIgnore } from '../git.js';\nimport {\n  addArtifactDependencyToTargets,\n  addDependencyToTargetIfNotPresent,\n  normalizeTargetKeyOrder,\n} from '../nx.js';\nimport { getRelativePathToRoot } from '../paths.js';\nimport {\n  type ITsDepVersion,\n  LAMBDA_RUNTIME_VERSIONS,\n  withVersions,\n} from '../versions.js';\n\n/** Dependencies a caller must declare to add a TypeScript bundle target. */\nexport const BUNDLE_DEPENDENCIES = [\n  { name: 'rolldown' },\n] as const satisfies readonly { name: ITsDepVersion }[];\n\nexport interface AddPythonBundleTargetOptions {\n  /**\n   * Python platform\n   * @default x86_64-manylinux_2_28\n   */\n  pythonPlatform?: 'x86_64-manylinux_2_28' | 'aarch64-manylinux_2_28';\n}\n\ninterface CreatePythonBundleTargetOptions\n  extends Required<AddPythonBundleTargetOptions> {\n  /**\n   * Python package name\n   */\n  packageName: string;\n\n  /**\n   * Name of the bundle target, used for the outdir for the bundle\n   */\n  bundleTargetName: string;\n}\n\n/**\n * Create a target for bundling a python project\n */\nconst createPythonBundleTarget = ({\n  packageName,\n  pythonPlatform,\n  bundleTargetName,\n}: CreatePythonBundleTargetOptions): TargetConfiguration => {\n  return {\n    cache: true,\n    // The bundle holds exported dependencies and the entrypoint script, never\n    // test files, so tests are excluded via `production`.\n    inputs: ['production', '^production'],\n    executor: 'nx:run-commands',\n    outputs: [`{workspaceRoot}/dist/{projectRoot}/${bundleTargetName}`],\n    options: {\n      commands: [\n        `uv export --frozen --no-dev --no-editable --project {projectRoot} --package ${packageName} -o dist/{projectRoot}/${bundleTargetName}/requirements.txt`,\n        // `--python-version` pins wheel resolution to the Lambda Python runtime,\n        // so the bundle cannot be built against whichever interpreter happens to\n        // be on the build machine.\n        `uv pip install -n --no-deps --no-installer-metadata --no-compile-bytecode --python-platform ${pythonPlatform} --python-version ${LAMBDA_RUNTIME_VERSIONS.python} --target dist/{projectRoot}/${bundleTargetName} -r dist/{projectRoot}/${bundleTargetName}/requirements.txt`,\n      ],\n      parallel: false,\n    },\n  };\n};\n\n/**\n * Adds a bundle target to the given project if it does not exist, and updates the build target to depend on it\n */\nexport const addPythonBundleTarget = (\n  project: ProjectConfiguration,\n  opts?: AddPythonBundleTargetOptions,\n) => {\n  if (!project.targets) {\n    project.targets = {};\n  }\n\n  const pythonPlatform = opts?.pythonPlatform ?? 'x86_64-manylinux_2_28';\n  const bundleTargetName =\n    pythonPlatform === 'aarch64-manylinux_2_28' ? 'bundle-arm' : 'bundle-x86';\n\n  if (!project.targets?.[bundleTargetName]) {\n    project.targets[bundleTargetName] = normalizeTargetKeyOrder({\n      ...createPythonBundleTarget({\n        packageName: project.name,\n        pythonPlatform,\n        bundleTargetName,\n      }),\n      dependsOn: ['compile'],\n    });\n  }\n\n  // Add a \"bundle\" target which depends on either bundle-arm or bundle-x86 (or both)\n  addDependencyToTargetIfNotPresent(project, 'bundle', bundleTargetName);\n  addArtifactDependencyToTargets(project, 'bundle');\n\n  return {\n    bundleTargetName,\n    bundleOutputDir: joinPathFragments('dist', project.root, bundleTargetName),\n  };\n};\n\nexport interface AddTypeScriptBundleTargetOptions {\n  /**\n   * Path to the target file relative to the project dir\n   */\n  targetFilePath: string;\n\n  /**\n   * Sub directory to write bundled index.js file to (if any)\n   * Outputs to dist/{projectRoot}/bundle/{bundleOutputDir}/index.js\n   */\n  bundleOutputDir?: string;\n\n  /**\n   * Modules to omit from the bundle and treat as external\n   */\n  external?: (string | RegExp)[];\n\n  /**\n   * Target platform for the bundle\n   * @default 'node'\n   */\n  platform?: 'node' | 'browser' | 'neutral';\n}\n\n/**\n * Add a TypeScript bundle target using rolldown\n */\nexport const addTypeScriptBundleTarget = async <\n  const D extends DependencyDeclaration,\n>(\n  tree: Tree,\n  project: ProjectConfiguration,\n  opts: AddTypeScriptBundleTargetOptions,\n  declaration: D & MustDeclare<typeof BUNDLE_DEPENDENCIES, D>,\n) => {\n  project.targets ??= {};\n\n  // Generate empty rolldown config if it doesn't exist\n  generateFiles(\n    tree,\n    joinPathFragments(import.meta.dirname, 'files', 'ts'),\n    project.root,\n    {},\n    { overwriteStrategy: OverwriteStrategy.KeepExisting },\n  );\n\n  // Loading a TypeScript config bundles it to `rolldown.config.<hash>.js` beside\n  // itself, imports it, then unlinks it. Kept out of git so the transient file\n  // can never be committed, nor picked up by `license#sync`, which builds its\n  // candidate set from git-visible files.\n  updateGitIgnore(tree, project.root, (patterns) =>\n    patterns.includes(ROLLDOWN_CONFIG_BUNDLE_GLOB)\n      ? patterns\n      : [...patterns, ROLLDOWN_CONFIG_BUNDLE_GLOB],\n  );\n\n  // Add the bundle target\n  if (!project.targets.bundle) {\n    project.targets.bundle = normalizeTargetKeyOrder({\n      cache: true,\n      // Declared rather than left to Nx's implicit `[\"default\", \"^default\"]`,\n      // which reads a dependency's whole project directory: rolldown resolves\n      // dependencies through the build artifacts `default` already tracks, so\n      // `^default` only adds files no bundle can contain.\n      inputs: ['default'],\n      outputs: [`{workspaceRoot}/dist/{projectRoot}/bundle`],\n      executor: 'nx:run-commands',\n      options: {\n        command: 'rolldown -c rolldown.config.ts',\n        cwd: '{projectRoot}',\n      },\n      dependsOn: ['compile'],\n    });\n  }\n\n  // Add bundle to the build target\n  addArtifactDependencyToTargets(project, 'bundle');\n\n  const rolldownConfigPath = joinPathFragments(\n    project.root,\n    'rolldown.config.ts',\n  );\n\n  const outputFile = joinPathFragments(\n    getRelativePathToRoot(tree, project.name),\n    'dist',\n    project.root,\n    'bundle',\n    opts.bundleOutputDir ?? '.',\n    'index.js',\n  );\n\n  const external = opts.external?.length\n    ? opts.external\n        .map((ext) =>\n          typeof ext === 'string' ? `'${ext}'` : `/${ext.source}/`,\n        )\n        .join(', ')\n    : '';\n\n  const entry = `{\n    tsconfig: 'tsconfig.lib.json',\n    input: '${opts.targetFilePath}',\n    output: { file: '${outputFile}', format: 'cjs', codeSplitting: false },\n    platform: '${opts.platform ?? 'node'}',\n    ${external ? `external: [${external}],` : ''}\n  }`;\n\n  // Use GritQL to append the config entry to the defineConfig array.\n  // First try the non-empty array case using the accumulate (+=) operator,\n  // with an idempotency guard that checks the input path is not already present.\n  const appended = await applyGritQL(\n    tree,\n    rolldownConfigPath,\n    `\\`defineConfig([$items])\\` where { $items <: not contains \\`'${opts.targetFilePath}'\\`, $items += \", ${entry}\" }`,\n  );\n\n  if (!appended) {\n    // Empty array — GritQL's += cannot accumulate into an empty list, so we\n    // first insert a placeholder to make the array non-empty, then replace\n    // the placeholder with the real entry via += (which handles regex\n    // literals that are invalid inside GritQL backtick snippets).\n    const inserted = await applyGritQL(\n      tree,\n      rolldownConfigPath,\n      `\\`defineConfig([])\\` => \\`defineConfig([__PLACEHOLDER__])\\``,\n    );\n    if (inserted) {\n      await applyGritQL(\n        tree,\n        rolldownConfigPath,\n        `\\`defineConfig([$items])\\` where { $items <: \\`__PLACEHOLDER__\\` => ., $items += \"${entry}\" }`,\n      );\n    }\n  }\n\n  addDependenciesToPackageJson(\n    tree,\n    {},\n    withVersions(forDependencies<typeof BUNDLE_DEPENDENCIES>(declaration), [\n      'rolldown',\n    ]),\n  );\n};\n"],"names":["generateFiles","joinPathFragments","OverwriteStrategy","applyGritQL","forDependencies","addDependenciesToPackageJson","ROLLDOWN_CONFIG_BUNDLE_GLOB","updateGitIgnore","addArtifactDependencyToTargets","addDependencyToTargetIfNotPresent","normalizeTargetKeyOrder","getRelativePathToRoot","LAMBDA_RUNTIME_VERSIONS","withVersions","BUNDLE_DEPENDENCIES","name","createPythonBundleTarget","packageName","pythonPlatform","bundleTargetName","cache","inputs","executor","outputs","options","commands","python","parallel","addPythonBundleTarget","project","opts","targets","dependsOn","bundleOutputDir","root","addTypeScriptBundleTarget","tree","declaration","dirname","overwriteStrategy","KeepExisting","patterns","includes","bundle","command","cwd","rolldownConfigPath","outputFile","external","length","map","ext","source","join","entry","targetFilePath","platform","appended","inserted"],"mappings":"AAAA;;;CAGC,GAED,SACEA,aAAa,EACbC,iBAAiB,EACjBC,iBAAiB,QAIZ,aAAa;AACpB,SAASC,WAAW,QAAQ,YAAY;AACxC,SAEEC,eAAe,QAEV,8BAA8B;AACrC,SAASC,4BAA4B,QAAQ,qBAAqB;AAClE,SAASC,2BAA2B,QAAQ,eAAe;AAC3D,SAASC,eAAe,QAAQ,YAAY;AAC5C,SACEC,8BAA8B,EAC9BC,iCAAiC,EACjCC,uBAAuB,QAClB,WAAW;AAClB,SAASC,qBAAqB,QAAQ,cAAc;AACpD,SAEEC,uBAAuB,EACvBC,YAAY,QACP,iBAAiB;AAExB,0EAA0E,GAC1E,OAAO,MAAMC,sBAAsB;IACjC;QAAEC,MAAM;IAAW;CACpB,CAAuD;AAuBxD;;CAEC,GACD,MAAMC,2BAA2B,CAAC,EAChCC,WAAW,EACXC,cAAc,EACdC,gBAAgB,EACgB;IAChC,OAAO;QACLC,OAAO;QACP,0EAA0E;QAC1E,sDAAsD;QACtDC,QAAQ;YAAC;YAAc;SAAc;QACrCC,UAAU;QACVC,SAAS;YAAC,CAAC,mCAAmC,EAAEJ,kBAAkB;SAAC;QACnEK,SAAS;YACPC,UAAU;gBACR,CAAC,4EAA4E,EAAER,YAAY,uBAAuB,EAAEE,iBAAiB,iBAAiB,CAAC;gBACvJ,yEAAyE;gBACzE,yEAAyE;gBACzE,2BAA2B;gBAC3B,CAAC,4FAA4F,EAAED,eAAe,kBAAkB,EAAEN,wBAAwBc,MAAM,CAAC,6BAA6B,EAAEP,iBAAiB,uBAAuB,EAAEA,iBAAiB,iBAAiB,CAAC;aAC9Q;YACDQ,UAAU;QACZ;IACF;AACF;AAEA;;CAEC,GACD,OAAO,MAAMC,wBAAwB,CACnCC,SACAC;IAEA,IAAI,CAACD,QAAQE,OAAO,EAAE;QACpBF,QAAQE,OAAO,GAAG,CAAC;IACrB;IAEA,MAAMb,iBAAiBY,MAAMZ,kBAAkB;IAC/C,MAAMC,mBACJD,mBAAmB,2BAA2B,eAAe;IAE/D,IAAI,CAACW,QAAQE,OAAO,EAAE,CAACZ,iBAAiB,EAAE;QACxCU,QAAQE,OAAO,CAACZ,iBAAiB,GAAGT,wBAAwB;YAC1D,GAAGM,yBAAyB;gBAC1BC,aAAaY,QAAQd,IAAI;gBACzBG;gBACAC;YACF,EAAE;YACFa,WAAW;gBAAC;aAAU;QACxB;IACF;IAEA,mFAAmF;IACnFvB,kCAAkCoB,SAAS,UAAUV;IACrDX,+BAA+BqB,SAAS;IAExC,OAAO;QACLV;QACAc,iBAAiBhC,kBAAkB,QAAQ4B,QAAQK,IAAI,EAAEf;IAC3D;AACF,EAAE;AA0BF;;CAEC,GACD,OAAO,MAAMgB,4BAA4B,OAGvCC,MACAP,SACAC,MACAO;IAEAR,QAAQE,OAAO,KAAK,CAAC;IAErB,qDAAqD;IACrD/B,cACEoC,MACAnC,kBAAkB,YAAYqC,OAAO,EAAE,SAAS,OAChDT,QAAQK,IAAI,EACZ,CAAC,GACD;QAAEK,mBAAmBrC,kBAAkBsC,YAAY;IAAC;IAGtD,+EAA+E;IAC/E,6EAA6E;IAC7E,4EAA4E;IAC5E,wCAAwC;IACxCjC,gBAAgB6B,MAAMP,QAAQK,IAAI,EAAE,CAACO,WACnCA,SAASC,QAAQ,CAACpC,+BACdmC,WACA;eAAIA;YAAUnC;SAA4B;IAGhD,wBAAwB;IACxB,IAAI,CAACuB,QAAQE,OAAO,CAACY,MAAM,EAAE;QAC3Bd,QAAQE,OAAO,CAACY,MAAM,GAAGjC,wBAAwB;YAC/CU,OAAO;YACP,wEAAwE;YACxE,wEAAwE;YACxE,wEAAwE;YACxE,oDAAoD;YACpDC,QAAQ;gBAAC;aAAU;YACnBE,SAAS;gBAAC,CAAC,yCAAyC,CAAC;aAAC;YACtDD,UAAU;YACVE,SAAS;gBACPoB,SAAS;gBACTC,KAAK;YACP;YACAb,WAAW;gBAAC;aAAU;QACxB;IACF;IAEA,iCAAiC;IACjCxB,+BAA+BqB,SAAS;IAExC,MAAMiB,qBAAqB7C,kBACzB4B,QAAQK,IAAI,EACZ;IAGF,MAAMa,aAAa9C,kBACjBU,sBAAsByB,MAAMP,QAAQd,IAAI,GACxC,QACAc,QAAQK,IAAI,EACZ,UACAJ,KAAKG,eAAe,IAAI,KACxB;IAGF,MAAMe,WAAWlB,KAAKkB,QAAQ,EAAEC,SAC5BnB,KAAKkB,QAAQ,CACVE,GAAG,CAAC,CAACC,MACJ,OAAOA,QAAQ,WAAW,CAAC,CAAC,EAAEA,IAAI,CAAC,CAAC,GAAG,CAAC,CAAC,EAAEA,IAAIC,MAAM,CAAC,CAAC,CAAC,EAEzDC,IAAI,CAAC,QACR;IAEJ,MAAMC,QAAQ,CAAC;;YAEL,EAAExB,KAAKyB,cAAc,CAAC;qBACb,EAAER,WAAW;eACnB,EAAEjB,KAAK0B,QAAQ,IAAI,OAAO;IACrC,EAAER,WAAW,CAAC,WAAW,EAAEA,SAAS,EAAE,CAAC,GAAG,GAAG;GAC9C,CAAC;IAEF,mEAAmE;IACnE,yEAAyE;IACzE,+EAA+E;IAC/E,MAAMS,WAAW,MAAMtD,YACrBiC,MACAU,oBACA,CAAC,6DAA6D,EAAEhB,KAAKyB,cAAc,CAAC,kBAAkB,EAAED,MAAM,GAAG,CAAC;IAGpH,IAAI,CAACG,UAAU;QACb,wEAAwE;QACxE,uEAAuE;QACvE,kEAAkE;QAClE,8DAA8D;QAC9D,MAAMC,WAAW,MAAMvD,YACrBiC,MACAU,oBACA,CAAC,2DAA2D,CAAC;QAE/D,IAAIY,UAAU;YACZ,MAAMvD,YACJiC,MACAU,oBACA,CAAC,kFAAkF,EAAEQ,MAAM,GAAG,CAAC;QAEnG;IACF;IAEAjD,6BACE+B,MACA,CAAC,GACDvB,aAAaT,gBAA4CiC,cAAc;QACrE;KACD;AAEL,EAAE"}

package/src/utils/docker.d.ts

@@ -6,13 +6,7 @@ import { type ProjectConfiguration, type Tree } from '@nx/devkit';
 import { type DependencyDeclaration, type MustDeclare } from './declared-dependencies.js';
 /** Dependencies a caller must declare to add a Docker scan target. */
 export declare const DOCKER_DEPENDENCIES: readonly [{
-    readonly name: "ncp";
-}, {
-    readonly name: "rimraf";
-}, {
-    readonly name: "make-dir-cli";
-}, {
-    readonly name: "cpy-cli";
+    readonly name: "shx";
 }];
 /**
  * The `cache` setting every target that builds a container image must use.

package/src/utils/docker.js

@@ -95,7 +95,7 @@ const TRIVY_IGNORE_CONTENTS = `# Trivy ignore file. Add one vulnerability ID (e.
     const commands = [
         fs.rm(scanDir),
         fs.mkdir(scanDir),
-        fs.cp(ignoreFilePath, joinPathFragments(scanDir, TRIVY_IGNORE_FILE))
+        fs.cpFile(ignoreFilePath, joinPathFragments(scanDir, TRIVY_IGNORE_FILE))
     ];
     imageTags.forEach((imageTag, index)=>{
         const tarName = `image-${index}.tar`;

package/src/utils/docker.js.map

@@ -1 +1 @@
-{"version":3,"sources":["../../../../../packages/nx-plugin/src/utils/docker.ts"],"sourcesContent":["/**\n * Copyright Amazon.com, Inc. or its affiliates. All Rights Reserved.\n * SPDX-License-Identifier: Apache-2.0\n */\nimport {\n  joinPathFragments,\n  type ProjectConfiguration,\n  type Tree,\n} from '@nx/devkit';\nimport {\n  type DependencyDeclaration,\n  forDependencies,\n  type MustDeclare,\n} from './declared-dependencies.js';\nimport { FS_DEPENDENCIES, FsCommands } from './fs.js';\nimport { addDependencyToTargetIfNotPresent } from './nx.js';\nimport { containerImage, type ITsDepVersion, TS_VERSIONS } from './versions.js';\n\n/** Dependencies a caller must declare to add a Docker scan target. */\nexport const DOCKER_DEPENDENCIES = [...FS_DEPENDENCIES] as const;\n\n/**\n * The `cache` setting every target that builds a container image must use.\n *\n * A built image lives in the container engine's own store, not under any\n * `outputs` path, so Nx has nothing to restore a cache hit from: it would\n * report the build complete while the image is missing, and the `trivy` scan\n * that depends on it would report a cached pass against an image that isn't\n * there. The container engine's layer cache is the sound cache here — it is\n * keyed on the build context and lives alongside the image, so an unchanged\n * context rebuilds in well under a second and always leaves the image present.\n */\nexport const IMAGE_BUILD_CACHE = false;\n\nconst TRIVY_IGNORE_FILE = '.trivyignore';\n\nconst TRIVY_IGNORE_CONTENTS = `# Trivy ignore file. Add one vulnerability ID (e.g. CVE-2021-12345) per line to\n# suppress it during the image scan (\\`nx run-many --target trivy\\`).\n# https://trivy.dev/latest/docs/configuration/filtering/#by-finding-ids\n`;\n\n/**\n * Substitution variables for the vended Node `Dockerfile` templates: the npm\n * version to install globally, and the versions its dependency overrides pin.\n */\nexport const nodeImageVersions = () => ({\n  npmVersion: TS_VERSIONS.npm,\n  minimatchVersion: TS_VERSIONS.minimatch,\n});\n\n/**\n * Packages a vended Node `Dockerfile` pins, which every generator writing one\n * must declare so the version sync keeps those pins current.\n *\n * Spread through `ownedElsewhere`: the pin lives in the image build rather than\n * in any manifest, so nothing is installed into the workspace. Left undeclared\n * these would be the only vended versions never upgraded — and they are\n * precisely the ones held at a version clear of a known HIGH/CRITICAL\n * vulnerability.\n */\nexport const NODE_IMAGE_DEPENDENCIES = [\n  { name: 'npm' },\n  { name: 'minimatch' },\n] as const satisfies readonly { name: ITsDepVersion }[];\n\n/**\n * Packages the AWS Distro for OpenTelemetry install in a vended `Dockerfile`\n * pins, for the images that auto-instrument with it. Spread through\n * `ownedElsewhere` for the same reason as {@link NODE_IMAGE_DEPENDENCIES}.\n */\nexport const ADOT_IMAGE_DEPENDENCIES = [\n  { name: '@aws/aws-distro-opentelemetry-node-autoinstrumentation' },\n  { name: '@opentelemetry/propagator-jaeger' },\n] as const satisfies readonly { name: ITsDepVersion }[];\n\nexport interface DockerScanTargetOptions {\n  /**\n   * Project configuration to add the scan target to (mutated in place).\n   */\n  readonly project: ProjectConfiguration;\n  /**\n   * Container engine command to invoke (\\`docker\\` or \\`finch\\`).\n   */\n  readonly containerEngine: string;\n  /**\n   * Name of the scan target to add, e.g. \\`my-agent-trivy\\`.\n   */\n  readonly trivyTargetName: string;\n  /**\n   * Name of the docker target that builds the image(s) to scan. The scan\n   * target depends on it.\n   */\n  readonly dockerTargetName: string;\n  /**\n   * Tags of the images built by the docker target which should be scanned.\n   */\n  readonly imageTags: string[];\n}\n\n/**\n * Add a Trivy scan target for the images built by a docker target and wire it\n * under the aggregate \\`trivy\\` target. The scan is not part of \\`build\\` — run\n * \\`nx run-many --target trivy\\` (the root \\`trivy\\` script) in CI.\n *\n * The scan target depends on the docker target and is not cacheable, because\n * what it scans lives in the container engine rather than under its \\`outputs\\`.\n * Each image is saved to a tarball under \\`dist/<projectRoot>/trivy/<scan-key>\\`\n * (kept out of any Docker build context) and scanned with the pinned ECR-hosted\n * Trivy image via a workspace-relative bind mount, so the same commands work\n * under both docker and finch. The scan exits non-zero (exit code 1) on\n * HIGH/CRITICAL vulnerabilities.\n *\n * A \\`.trivyignore\\` is vended at the project root (kept if it already exists)\n * for suppressing findings.\n */\nexport const addDockerScanTarget = <const D extends DependencyDeclaration>(\n  tree: Tree,\n  options: DockerScanTargetOptions,\n  declaration: D & MustDeclare<typeof DOCKER_DEPENDENCIES, D>,\n): void => {\n  const { project, containerEngine, trivyTargetName, dockerTargetName } =\n    options;\n  const { imageTags } = options;\n  const projectRoot = project.root;\n\n  const ignoreFilePath = joinPathFragments(projectRoot, TRIVY_IGNORE_FILE);\n  if (!tree.exists(ignoreFilePath)) {\n    tree.write(ignoreFilePath, TRIVY_IGNORE_CONTENTS);\n  }\n\n  // Stage scan artifacts in a directory unique to this scan target so that\n  // sibling targets in the same project (e.g. multiple agents) don't clobber\n  // each other's tarballs when run in parallel. The first image tag is unique\n  // per target, so it makes a stable, collision-free key.\n  const scanKey = imageTags[0].replace(/[^a-zA-Z0-9-]/g, '-');\n  const scanDir = joinPathFragments('dist', projectRoot, 'trivy', scanKey);\n  const trivyImage = containerImage('trivy');\n\n  const fs = new FsCommands(\n    tree,\n    forDependencies<typeof DOCKER_DEPENDENCIES>(declaration),\n  );\n  const commands = [\n    fs.rm(scanDir),\n    fs.mkdir(scanDir),\n    fs.cp(ignoreFilePath, joinPathFragments(scanDir, TRIVY_IGNORE_FILE)),\n  ];\n\n  imageTags.forEach((imageTag, index) => {\n    const tarName = `image-${index}.tar`;\n    commands.push(\n      `${containerEngine} save -o ${joinPathFragments(scanDir, tarName)} ${imageTag}`,\n      `${containerEngine} run --rm -v \"./${scanDir}\":/scan ${trivyImage} image --input /scan/${tarName} --ignorefile /scan/${TRIVY_IGNORE_FILE} --scanners vuln --severity HIGH,CRITICAL --ignore-unfixed --exit-code 1 --no-progress -q`,\n    );\n  });\n\n  project.targets ??= {};\n  project.targets[trivyTargetName] = {\n    // The image being scanned is only reachable through the container engine,\n    // so a restored cache entry would report a pass for an image that may no\n    // longer exist. The scan re-runs and either scans the real image or fails.\n    // Nx only hashes a cacheable task, so declaring `inputs` here would have no\n    // effect.\n    cache: false,\n    outputs: [`{workspaceRoot}/${scanDir}`],\n    executor: 'nx:run-commands',\n    options: {\n      commands,\n      parallel: false,\n    },\n    dependsOn: [dockerTargetName],\n  };\n\n  // Aggregate per-component scan targets under a single `trivy` target. The\n  // scan is intentionally NOT wired into `build`: image scanning is slow and\n  // its result depends on the ever-changing vulnerability database (a scan\n  // that passes today can fail tomorrow when a new CVE is published), so\n  // coupling it to `build` would make local and CI builds non-deterministic.\n  // Run `nx run-many --target trivy` (the root `trivy` script) in CI instead.\n  if (trivyTargetName !== 'trivy') {\n    addDependencyToTargetIfNotPresent(project, 'trivy', trivyTargetName);\n  }\n};\n"],"names":["joinPathFragments","forDependencies","FS_DEPENDENCIES","FsCommands","addDependencyToTargetIfNotPresent","containerImage","TS_VERSIONS","DOCKER_DEPENDENCIES","IMAGE_BUILD_CACHE","TRIVY_IGNORE_FILE","TRIVY_IGNORE_CONTENTS","nodeImageVersions","npmVersion","npm","minimatchVersion","minimatch","NODE_IMAGE_DEPENDENCIES","name","ADOT_IMAGE_DEPENDENCIES","addDockerScanTarget","tree","options","declaration","project","containerEngine","trivyTargetName","dockerTargetName","imageTags","projectRoot","root","ignoreFilePath","exists","write","scanKey","replace","scanDir","trivyImage","fs","commands","rm","mkdir","cp","forEach","imageTag","index","tarName","push","targets","cache","outputs","executor","parallel","dependsOn"],"mappings":"AAAA;;;CAGC,GACD,SACEA,iBAAiB,QAGZ,aAAa;AACpB,SAEEC,eAAe,QAEV,6BAA6B;AACpC,SAASC,eAAe,EAAEC,UAAU,QAAQ,UAAU;AACtD,SAASC,iCAAiC,QAAQ,UAAU;AAC5D,SAASC,cAAc,EAAsBC,WAAW,QAAQ,gBAAgB;AAEhF,oEAAoE,GACpE,OAAO,MAAMC,sBAAsB;OAAIL;CAAgB,CAAU;AAEjE;;;;;;;;;;CAUC,GACD,OAAO,MAAMM,oBAAoB,MAAM;AAEvC,MAAMC,oBAAoB;AAE1B,MAAMC,wBAAwB,CAAC;;;AAG/B,CAAC;AAED;;;CAGC,GACD,OAAO,MAAMC,oBAAoB,IAAO,CAAA;QACtCC,YAAYN,YAAYO,GAAG;QAC3BC,kBAAkBR,YAAYS,SAAS;IACzC,CAAA,EAAG;AAEH;;;;;;;;;CASC,GACD,OAAO,MAAMC,0BAA0B;IACrC;QAAEC,MAAM;IAAM;IACd;QAAEA,MAAM;IAAY;CACrB,CAAuD;AAExD;;;;CAIC,GACD,OAAO,MAAMC,0BAA0B;IACrC;QAAED,MAAM;IAAyD;IACjE;QAAEA,MAAM;IAAmC;CAC5C,CAAuD;AA0BxD;;;;;;;;;;;;;;;CAeC,GACD,OAAO,MAAME,sBAAsB,CACjCC,MACAC,SACAC;IAEA,MAAM,EAAEC,OAAO,EAAEC,eAAe,EAAEC,eAAe,EAAEC,gBAAgB,EAAE,GACnEL;IACF,MAAM,EAAEM,SAAS,EAAE,GAAGN;IACtB,MAAMO,cAAcL,QAAQM,IAAI;IAEhC,MAAMC,iBAAiB9B,kBAAkB4B,aAAanB;IACtD,IAAI,CAACW,KAAKW,MAAM,CAACD,iBAAiB;QAChCV,KAAKY,KAAK,CAACF,gBAAgBpB;IAC7B;IAEA,yEAAyE;IACzE,2EAA2E;IAC3E,4EAA4E;IAC5E,wDAAwD;IACxD,MAAMuB,UAAUN,SAAS,CAAC,EAAE,CAACO,OAAO,CAAC,kBAAkB;IACvD,MAAMC,UAAUnC,kBAAkB,QAAQ4B,aAAa,SAASK;IAChE,MAAMG,aAAa/B,eAAe;IAElC,MAAMgC,KAAK,IAAIlC,WACbiB,MACAnB,gBAA4CqB;IAE9C,MAAMgB,WAAW;QACfD,GAAGE,EAAE,CAACJ;QACNE,GAAGG,KAAK,CAACL;QACTE,GAAGI,EAAE,CAACX,gBAAgB9B,kBAAkBmC,SAAS1B;KAClD;IAEDkB,UAAUe,OAAO,CAAC,CAACC,UAAUC;QAC3B,MAAMC,UAAU,CAAC,MAAM,EAAED,MAAM,IAAI,CAAC;QACpCN,SAASQ,IAAI,CACX,GAAGtB,gBAAgB,SAAS,EAAExB,kBAAkBmC,SAASU,SAAS,CAAC,EAAEF,UAAU,EAC/E,GAAGnB,gBAAgB,gBAAgB,EAAEW,QAAQ,QAAQ,EAAEC,WAAW,qBAAqB,EAAES,QAAQ,oBAAoB,EAAEpC,kBAAkB,yFAAyF,CAAC;IAEvO;IAEAc,QAAQwB,OAAO,KAAK,CAAC;IACrBxB,QAAQwB,OAAO,CAACtB,gBAAgB,GAAG;QACjC,0EAA0E;QAC1E,yEAAyE;QACzE,2EAA2E;QAC3E,4EAA4E;QAC5E,UAAU;QACVuB,OAAO;QACPC,SAAS;YAAC,CAAC,gBAAgB,EAAEd,SAAS;SAAC;QACvCe,UAAU;QACV7B,SAAS;YACPiB;YACAa,UAAU;QACZ;QACAC,WAAW;YAAC1B;SAAiB;IAC/B;IAEA,0EAA0E;IAC1E,2EAA2E;IAC3E,yEAAyE;IACzE,uEAAuE;IACvE,2EAA2E;IAC3E,4EAA4E;IAC5E,IAAID,oBAAoB,SAAS;QAC/BrB,kCAAkCmB,SAAS,SAASE;IACtD;AACF,EAAE"}
+{"version":3,"sources":["../../../../../packages/nx-plugin/src/utils/docker.ts"],"sourcesContent":["/**\n * Copyright Amazon.com, Inc. or its affiliates. All Rights Reserved.\n * SPDX-License-Identifier: Apache-2.0\n */\nimport {\n  joinPathFragments,\n  type ProjectConfiguration,\n  type Tree,\n} from '@nx/devkit';\nimport {\n  type DependencyDeclaration,\n  forDependencies,\n  type MustDeclare,\n} from './declared-dependencies.js';\nimport { FS_DEPENDENCIES, FsCommands } from './fs.js';\nimport { addDependencyToTargetIfNotPresent } from './nx.js';\nimport { containerImage, type ITsDepVersion, TS_VERSIONS } from './versions.js';\n\n/** Dependencies a caller must declare to add a Docker scan target. */\nexport const DOCKER_DEPENDENCIES = [...FS_DEPENDENCIES] as const;\n\n/**\n * The `cache` setting every target that builds a container image must use.\n *\n * A built image lives in the container engine's own store, not under any\n * `outputs` path, so Nx has nothing to restore a cache hit from: it would\n * report the build complete while the image is missing, and the `trivy` scan\n * that depends on it would report a cached pass against an image that isn't\n * there. The container engine's layer cache is the sound cache here — it is\n * keyed on the build context and lives alongside the image, so an unchanged\n * context rebuilds in well under a second and always leaves the image present.\n */\nexport const IMAGE_BUILD_CACHE = false;\n\nconst TRIVY_IGNORE_FILE = '.trivyignore';\n\nconst TRIVY_IGNORE_CONTENTS = `# Trivy ignore file. Add one vulnerability ID (e.g. CVE-2021-12345) per line to\n# suppress it during the image scan (\\`nx run-many --target trivy\\`).\n# https://trivy.dev/latest/docs/configuration/filtering/#by-finding-ids\n`;\n\n/**\n * Substitution variables for the vended Node `Dockerfile` templates: the npm\n * version to install globally, and the versions its dependency overrides pin.\n */\nexport const nodeImageVersions = () => ({\n  npmVersion: TS_VERSIONS.npm,\n  minimatchVersion: TS_VERSIONS.minimatch,\n});\n\n/**\n * Packages a vended Node `Dockerfile` pins, which every generator writing one\n * must declare so the version sync keeps those pins current.\n *\n * Spread through `ownedElsewhere`: the pin lives in the image build rather than\n * in any manifest, so nothing is installed into the workspace. Left undeclared\n * these would be the only vended versions never upgraded — and they are\n * precisely the ones held at a version clear of a known HIGH/CRITICAL\n * vulnerability.\n */\nexport const NODE_IMAGE_DEPENDENCIES = [\n  { name: 'npm' },\n  { name: 'minimatch' },\n] as const satisfies readonly { name: ITsDepVersion }[];\n\n/**\n * Packages the AWS Distro for OpenTelemetry install in a vended `Dockerfile`\n * pins, for the images that auto-instrument with it. Spread through\n * `ownedElsewhere` for the same reason as {@link NODE_IMAGE_DEPENDENCIES}.\n */\nexport const ADOT_IMAGE_DEPENDENCIES = [\n  { name: '@aws/aws-distro-opentelemetry-node-autoinstrumentation' },\n  { name: '@opentelemetry/propagator-jaeger' },\n] as const satisfies readonly { name: ITsDepVersion }[];\n\nexport interface DockerScanTargetOptions {\n  /**\n   * Project configuration to add the scan target to (mutated in place).\n   */\n  readonly project: ProjectConfiguration;\n  /**\n   * Container engine command to invoke (\\`docker\\` or \\`finch\\`).\n   */\n  readonly containerEngine: string;\n  /**\n   * Name of the scan target to add, e.g. \\`my-agent-trivy\\`.\n   */\n  readonly trivyTargetName: string;\n  /**\n   * Name of the docker target that builds the image(s) to scan. The scan\n   * target depends on it.\n   */\n  readonly dockerTargetName: string;\n  /**\n   * Tags of the images built by the docker target which should be scanned.\n   */\n  readonly imageTags: string[];\n}\n\n/**\n * Add a Trivy scan target for the images built by a docker target and wire it\n * under the aggregate \\`trivy\\` target. The scan is not part of \\`build\\` — run\n * \\`nx run-many --target trivy\\` (the root \\`trivy\\` script) in CI.\n *\n * The scan target depends on the docker target and is not cacheable, because\n * what it scans lives in the container engine rather than under its \\`outputs\\`.\n * Each image is saved to a tarball under \\`dist/<projectRoot>/trivy/<scan-key>\\`\n * (kept out of any Docker build context) and scanned with the pinned ECR-hosted\n * Trivy image via a workspace-relative bind mount, so the same commands work\n * under both docker and finch. The scan exits non-zero (exit code 1) on\n * HIGH/CRITICAL vulnerabilities.\n *\n * A \\`.trivyignore\\` is vended at the project root (kept if it already exists)\n * for suppressing findings.\n */\nexport const addDockerScanTarget = <const D extends DependencyDeclaration>(\n  tree: Tree,\n  options: DockerScanTargetOptions,\n  declaration: D & MustDeclare<typeof DOCKER_DEPENDENCIES, D>,\n): void => {\n  const { project, containerEngine, trivyTargetName, dockerTargetName } =\n    options;\n  const { imageTags } = options;\n  const projectRoot = project.root;\n\n  const ignoreFilePath = joinPathFragments(projectRoot, TRIVY_IGNORE_FILE);\n  if (!tree.exists(ignoreFilePath)) {\n    tree.write(ignoreFilePath, TRIVY_IGNORE_CONTENTS);\n  }\n\n  // Stage scan artifacts in a directory unique to this scan target so that\n  // sibling targets in the same project (e.g. multiple agents) don't clobber\n  // each other's tarballs when run in parallel. The first image tag is unique\n  // per target, so it makes a stable, collision-free key.\n  const scanKey = imageTags[0].replace(/[^a-zA-Z0-9-]/g, '-');\n  const scanDir = joinPathFragments('dist', projectRoot, 'trivy', scanKey);\n  const trivyImage = containerImage('trivy');\n\n  const fs = new FsCommands(\n    tree,\n    forDependencies<typeof DOCKER_DEPENDENCIES>(declaration),\n  );\n  const commands = [\n    fs.rm(scanDir),\n    fs.mkdir(scanDir),\n    fs.cpFile(ignoreFilePath, joinPathFragments(scanDir, TRIVY_IGNORE_FILE)),\n  ];\n\n  imageTags.forEach((imageTag, index) => {\n    const tarName = `image-${index}.tar`;\n    commands.push(\n      `${containerEngine} save -o ${joinPathFragments(scanDir, tarName)} ${imageTag}`,\n      `${containerEngine} run --rm -v \"./${scanDir}\":/scan ${trivyImage} image --input /scan/${tarName} --ignorefile /scan/${TRIVY_IGNORE_FILE} --scanners vuln --severity HIGH,CRITICAL --ignore-unfixed --exit-code 1 --no-progress -q`,\n    );\n  });\n\n  project.targets ??= {};\n  project.targets[trivyTargetName] = {\n    // The image being scanned is only reachable through the container engine,\n    // so a restored cache entry would report a pass for an image that may no\n    // longer exist. The scan re-runs and either scans the real image or fails.\n    // Nx only hashes a cacheable task, so declaring `inputs` here would have no\n    // effect.\n    cache: false,\n    outputs: [`{workspaceRoot}/${scanDir}`],\n    executor: 'nx:run-commands',\n    options: {\n      commands,\n      parallel: false,\n    },\n    dependsOn: [dockerTargetName],\n  };\n\n  // Aggregate per-component scan targets under a single `trivy` target. The\n  // scan is intentionally NOT wired into `build`: image scanning is slow and\n  // its result depends on the ever-changing vulnerability database (a scan\n  // that passes today can fail tomorrow when a new CVE is published), so\n  // coupling it to `build` would make local and CI builds non-deterministic.\n  // Run `nx run-many --target trivy` (the root `trivy` script) in CI instead.\n  if (trivyTargetName !== 'trivy') {\n    addDependencyToTargetIfNotPresent(project, 'trivy', trivyTargetName);\n  }\n};\n"],"names":["joinPathFragments","forDependencies","FS_DEPENDENCIES","FsCommands","addDependencyToTargetIfNotPresent","containerImage","TS_VERSIONS","DOCKER_DEPENDENCIES","IMAGE_BUILD_CACHE","TRIVY_IGNORE_FILE","TRIVY_IGNORE_CONTENTS","nodeImageVersions","npmVersion","npm","minimatchVersion","minimatch","NODE_IMAGE_DEPENDENCIES","name","ADOT_IMAGE_DEPENDENCIES","addDockerScanTarget","tree","options","declaration","project","containerEngine","trivyTargetName","dockerTargetName","imageTags","projectRoot","root","ignoreFilePath","exists","write","scanKey","replace","scanDir","trivyImage","fs","commands","rm","mkdir","cpFile","forEach","imageTag","index","tarName","push","targets","cache","outputs","executor","parallel","dependsOn"],"mappings":"AAAA;;;CAGC,GACD,SACEA,iBAAiB,QAGZ,aAAa;AACpB,SAEEC,eAAe,QAEV,6BAA6B;AACpC,SAASC,eAAe,EAAEC,UAAU,QAAQ,UAAU;AACtD,SAASC,iCAAiC,QAAQ,UAAU;AAC5D,SAASC,cAAc,EAAsBC,WAAW,QAAQ,gBAAgB;AAEhF,oEAAoE,GACpE,OAAO,MAAMC,sBAAsB;OAAIL;CAAgB,CAAU;AAEjE;;;;;;;;;;CAUC,GACD,OAAO,MAAMM,oBAAoB,MAAM;AAEvC,MAAMC,oBAAoB;AAE1B,MAAMC,wBAAwB,CAAC;;;AAG/B,CAAC;AAED;;;CAGC,GACD,OAAO,MAAMC,oBAAoB,IAAO,CAAA;QACtCC,YAAYN,YAAYO,GAAG;QAC3BC,kBAAkBR,YAAYS,SAAS;IACzC,CAAA,EAAG;AAEH;;;;;;;;;CASC,GACD,OAAO,MAAMC,0BAA0B;IACrC;QAAEC,MAAM;IAAM;IACd;QAAEA,MAAM;IAAY;CACrB,CAAuD;AAExD;;;;CAIC,GACD,OAAO,MAAMC,0BAA0B;IACrC;QAAED,MAAM;IAAyD;IACjE;QAAEA,MAAM;IAAmC;CAC5C,CAAuD;AA0BxD;;;;;;;;;;;;;;;CAeC,GACD,OAAO,MAAME,sBAAsB,CACjCC,MACAC,SACAC;IAEA,MAAM,EAAEC,OAAO,EAAEC,eAAe,EAAEC,eAAe,EAAEC,gBAAgB,EAAE,GACnEL;IACF,MAAM,EAAEM,SAAS,EAAE,GAAGN;IACtB,MAAMO,cAAcL,QAAQM,IAAI;IAEhC,MAAMC,iBAAiB9B,kBAAkB4B,aAAanB;IACtD,IAAI,CAACW,KAAKW,MAAM,CAACD,iBAAiB;QAChCV,KAAKY,KAAK,CAACF,gBAAgBpB;IAC7B;IAEA,yEAAyE;IACzE,2EAA2E;IAC3E,4EAA4E;IAC5E,wDAAwD;IACxD,MAAMuB,UAAUN,SAAS,CAAC,EAAE,CAACO,OAAO,CAAC,kBAAkB;IACvD,MAAMC,UAAUnC,kBAAkB,QAAQ4B,aAAa,SAASK;IAChE,MAAMG,aAAa/B,eAAe;IAElC,MAAMgC,KAAK,IAAIlC,WACbiB,MACAnB,gBAA4CqB;IAE9C,MAAMgB,WAAW;QACfD,GAAGE,EAAE,CAACJ;QACNE,GAAGG,KAAK,CAACL;QACTE,GAAGI,MAAM,CAACX,gBAAgB9B,kBAAkBmC,SAAS1B;KACtD;IAEDkB,UAAUe,OAAO,CAAC,CAACC,UAAUC;QAC3B,MAAMC,UAAU,CAAC,MAAM,EAAED,MAAM,IAAI,CAAC;QACpCN,SAASQ,IAAI,CACX,GAAGtB,gBAAgB,SAAS,EAAExB,kBAAkBmC,SAASU,SAAS,CAAC,EAAEF,UAAU,EAC/E,GAAGnB,gBAAgB,gBAAgB,EAAEW,QAAQ,QAAQ,EAAEC,WAAW,qBAAqB,EAAES,QAAQ,oBAAoB,EAAEpC,kBAAkB,yFAAyF,CAAC;IAEvO;IAEAc,QAAQwB,OAAO,KAAK,CAAC;IACrBxB,QAAQwB,OAAO,CAACtB,gBAAgB,GAAG;QACjC,0EAA0E;QAC1E,yEAAyE;QACzE,2EAA2E;QAC3E,4EAA4E;QAC5E,UAAU;QACVuB,OAAO;QACPC,SAAS;YAAC,CAAC,gBAAgB,EAAEd,SAAS;SAAC;QACvCe,UAAU;QACV7B,SAAS;YACPiB;YACAa,UAAU;QACZ;QACAC,WAAW;YAAC1B;SAAiB;IAC/B;IAEA,0EAA0E;IAC1E,2EAA2E;IAC3E,yEAAyE;IACzE,uEAAuE;IACvE,2EAA2E;IAC3E,4EAA4E;IAC5E,IAAID,oBAAoB,SAAS;QAC/BrB,kCAAkCmB,SAAS,SAASE;IACtD;AACF,EAAE"}

package/src/utils/files/common/shadcn/src/components/ui/alert.tsx.template

@@ -1,7 +1,7 @@
 import * as React from "react"
 import { cva, type VariantProps } from "class-variance-authority"
 
-import { cn } from "<%= scopeAlias %>common-shadcn/lib/utils"
+import { cn } from "#lib/utils"
 
 const alertVariants = cva(
   "relative grid w-full grid-cols-[0_1fr] items-start gap-y-0.5 rounded-lg border px-4 py-3 text-sm has-[>svg]:grid-cols-[calc(var(--spacing)*4)_1fr] has-[>svg]:gap-x-3 [&>svg]:size-4 [&>svg]:translate-y-0.5 [&>svg]:text-current",

package/src/utils/files/common/shadcn/src/components/ui/avatar.tsx.template

@@ -3,7 +3,7 @@
 import * as React from "react"
 import { Avatar as AvatarPrimitive } from "radix-ui"
 
-import { cn } from "<%= scopeAlias %>common-shadcn/lib/utils"
+import { cn } from "#lib/utils"
 
 function Avatar({
   className,

package/src/utils/files/common/shadcn/src/components/ui/breadcrumb.tsx.template

@@ -2,7 +2,7 @@ import * as React from "react"
 import { ChevronRight, MoreHorizontal } from "lucide-react"
 import { Slot } from "radix-ui"
 
-import { cn } from "<%= scopeAlias %>common-shadcn/lib/utils"
+import { cn } from "#lib/utils"
 
 function Breadcrumb({ ...props }: React.ComponentProps<"nav">) {
   return <nav aria-label="breadcrumb" data-slot="breadcrumb" {...props} />

package/src/utils/files/common/shadcn/src/components/ui/button.tsx.template

@@ -2,7 +2,7 @@ import * as React from "react"
 import { cva, type VariantProps } from "class-variance-authority"
 import { Slot } from "radix-ui"
 
-import { cn } from "<%= scopeAlias %>common-shadcn/lib/utils"
+import { cn } from "#lib/utils"
 
 const buttonVariants = cva(
   "inline-flex shrink-0 items-center justify-center gap-2 rounded-md text-sm font-medium whitespace-nowrap transition-all outline-none focus-visible:border-ring focus-visible:ring-[3px] focus-visible:ring-ring/50 disabled:pointer-events-none disabled:opacity-50 aria-invalid:border-destructive aria-invalid:ring-destructive/20 dark:aria-invalid:ring-destructive/40 [&_svg]:pointer-events-none [&_svg]:shrink-0 [&_svg:not([class*='size-'])]:size-4",

package/src/utils/files/common/shadcn/src/components/ui/card.tsx.template

@@ -1,6 +1,6 @@
 import * as React from "react"
 
-import { cn } from "<%= scopeAlias %>common-shadcn/lib/utils"
+import { cn } from "#lib/utils"
 
 function Card({ className, ...props }: React.ComponentProps<"div">) {
   return (

package/src/utils/files/common/shadcn/src/components/ui/input.tsx.template

@@ -1,6 +1,6 @@
 import * as React from "react"
 
-import { cn } from "<%= scopeAlias %>common-shadcn/lib/utils"
+import { cn } from "#lib/utils"
 
 function Input({ className, type, ...props }: React.ComponentProps<"input">) {
   return (

package/src/utils/files/common/shadcn/src/components/ui/separator.tsx.template

@@ -3,7 +3,7 @@
 import * as React from "react"
 import { Separator as SeparatorPrimitive } from "radix-ui"
 
-import { cn } from "<%= scopeAlias %>common-shadcn/lib/utils"
+import { cn } from "#lib/utils"
 
 function Separator({
   className,

package/src/utils/files/common/shadcn/src/components/ui/sheet.tsx.template

@@ -4,7 +4,7 @@ import * as React from "react"
 import { XIcon } from "lucide-react"
 import { Dialog as SheetPrimitive } from "radix-ui"
 
-import { cn } from "<%= scopeAlias %>common-shadcn/lib/utils"
+import { cn } from "#lib/utils"
 
 function Sheet({ ...props }: React.ComponentProps<typeof SheetPrimitive.Root>) {
   return <SheetPrimitive.Root data-slot="sheet" {...props} />

package/src/utils/files/common/shadcn/src/components/ui/sidebar.tsx.template

@@ -5,25 +5,25 @@ import { cva, type VariantProps } from "class-variance-authority"
 import { PanelLeftIcon } from "lucide-react"
 import { Slot } from "radix-ui"
 
-import { useIsMobile } from "<%= scopeAlias %>common-shadcn/hooks/use-mobile"
-import { cn } from "<%= scopeAlias %>common-shadcn/lib/utils"
-import { Button } from "<%= scopeAlias %>common-shadcn/components/ui/button"
-import { Input } from "<%= scopeAlias %>common-shadcn/components/ui/input"
-import { Separator } from "<%= scopeAlias %>common-shadcn/components/ui/separator"
+import { useIsMobile } from "#hooks/use-mobile"
+import { cn } from "#lib/utils"
+import { Button } from "#components/ui/button"
+import { Input } from "#components/ui/input"
+import { Separator } from "#components/ui/separator"
 import {
   Sheet,
   SheetContent,
   SheetDescription,
   SheetHeader,
   SheetTitle,
-} from "<%= scopeAlias %>common-shadcn/components/ui/sheet"
-import { Skeleton } from "<%= scopeAlias %>common-shadcn/components/ui/skeleton"
+} from "#components/ui/sheet"
+import { Skeleton } from "#components/ui/skeleton"
 import {
   Tooltip,
   TooltipContent,
   TooltipProvider,
   TooltipTrigger,
-} from "<%= scopeAlias %>common-shadcn/components/ui/tooltip"
+} from "#components/ui/tooltip"
 
 const SIDEBAR_COOKIE_NAME = "sidebar_state"
 const SIDEBAR_COOKIE_MAX_AGE = 60 * 60 * 24 * 7

package/src/utils/files/common/shadcn/src/components/ui/skeleton.tsx.template

@@ -1,4 +1,4 @@
-import { cn } from "<%= scopeAlias %>common-shadcn/lib/utils"
+import { cn } from "#lib/utils"
 
 function Skeleton({ className, ...props }: React.ComponentProps<"div">) {
   return (

package/src/utils/files/common/shadcn/src/components/ui/spinner.tsx.template

@@ -1,6 +1,6 @@
 import { Loader2Icon } from "lucide-react"
 
-import { cn } from "<%= scopeAlias %>common-shadcn/lib/utils"
+import { cn } from "#lib/utils"
 
 function Spinner({ className, ...props }: React.ComponentProps<"svg">) {
   return (

package/src/utils/files/common/shadcn/src/components/ui/textarea.tsx.template

@@ -1,6 +1,6 @@
 import * as React from "react"
 
-import { cn } from "<%= scopeAlias %>common-shadcn/lib/utils"
+import { cn } from "#lib/utils"
 
 function Textarea({ className, ...props }: React.ComponentProps<"textarea">) {
   return (

package/src/utils/files/common/shadcn/src/components/ui/tooltip.tsx.template

@@ -3,7 +3,7 @@
 import * as React from "react"
 import { Tooltip as TooltipPrimitive } from "radix-ui"
 
-import { cn } from "<%= scopeAlias %>common-shadcn/lib/utils"
+import { cn } from "#lib/utils"
 
 function TooltipProvider({
   delayDuration = 0,

package/src/utils/files/shadcn/components.json.template

@@ -11,10 +11,10 @@
   },
   "iconLibrary": "lucide",
   "aliases": {
-    "components": "<%= sharedShadcnAlias %>/components",
-    "utils": "<%= sharedShadcnAlias %>/lib/utils",
-    "hooks": "<%= sharedShadcnAlias %>/hooks",
-    "lib": "<%= sharedShadcnAlias %>/lib",
-    "ui": "<%= sharedShadcnAlias %>/components/ui"
+    "components": "#components",
+    "utils": "#lib/utils",
+    "hooks": "#hooks",
+    "lib": "#lib",
+    "ui": "#components/ui"
   }
 }

package/src/utils/format.d.ts

@@ -3,11 +3,32 @@
  * SPDX-License-Identifier: Apache-2.0
  */
 import { type Tree } from '@nx/devkit';
+/**
+ * The Biome release the wasm bindings are built from. Must match
+ * `TS_VERSIONS['@biomejs/biome']`, the CLI the vended targets run.
+ */
+export declare const BIOME_WASM_VERSION: string;
 /**
  * Excludes test reports — including the vendored scripts vitest's coverage HTML
  * reporter writes — from formatting and linting.
  */
 export declare const BIOME_TEST_OUTPUT_EXCLUDE = "!**/test-output";
+/**
+ * The transient bundle rolldown writes beside a `rolldown.config.ts` while
+ * loading it.
+ *
+ * Loading a TypeScript config bundles it to `rolldown.config.<hash>.js` in the
+ * config's own directory, imports it, then unlinks it. That file exists for as
+ * long as the bundle takes, so a `format` or `lint` target running concurrently
+ * in the same project sees a machine-generated file — reported unformatted,
+ * failing the target for no fault of the source.
+ *
+ * `.*js` rather than `.js`, since the extension follows the config's own: a
+ * `.mts` config bundles to `.mjs`, a `.cts` one to `.cjs`.
+ */
+export declare const ROLLDOWN_CONFIG_BUNDLE_GLOB = "**/rolldown.config.*.*js";
+/** Keeps rolldown's transient config bundle out of formatting and linting. */
+export declare const BIOME_ROLLDOWN_CONFIG_BUNDLE_EXCLUDE = "!**/rolldown.config.*.*js";
 /**
  * The biome.json vended into a new workspace. The pnpm catalog resolver is only
  * included on pnpm workspaces, since `experimentalPnpmCatalogs` is Biome's only

package/src/utils/format.js

@@ -3,14 +3,33 @@
  * SPDX-License-Identifier: Apache-2.0
  */ import { Biome } from "@biomejs/js-api/nodejs";
 import { getProjects } from "@nx/devkit";
+import { createRequire } from "module";
 import path from "path";
 import { ruffFixAndFormat } from "./ruff.js";
 import { tryReadToml } from "./toml.js";
 import { TS_VERSIONS } from "./versions.js";
+/**
+ * The Biome release the wasm bindings are built from. Must match
+ * `TS_VERSIONS['@biomejs/biome']`, the CLI the vended targets run.
+ */ export const BIOME_WASM_VERSION = createRequire(import.meta.url)('@biomejs/wasm-nodejs/package.json').version;
 /**
  * Excludes test reports — including the vendored scripts vitest's coverage HTML
  * reporter writes — from formatting and linting.
  */ export const BIOME_TEST_OUTPUT_EXCLUDE = '!**/test-output';
+/**
+ * The transient bundle rolldown writes beside a `rolldown.config.ts` while
+ * loading it.
+ *
+ * Loading a TypeScript config bundles it to `rolldown.config.<hash>.js` in the
+ * config's own directory, imports it, then unlinks it. That file exists for as
+ * long as the bundle takes, so a `format` or `lint` target running concurrently
+ * in the same project sees a machine-generated file — reported unformatted,
+ * failing the target for no fault of the source.
+ *
+ * `.*js` rather than `.js`, since the extension follows the config's own: a
+ * `.mts` config bundles to `.mjs`, a `.cts` one to `.cjs`.
+ */ export const ROLLDOWN_CONFIG_BUNDLE_GLOB = '**/rolldown.config.*.*js';
+/** Keeps rolldown's transient config bundle out of formatting and linting. */ export const BIOME_ROLLDOWN_CONFIG_BUNDLE_EXCLUDE = `!${ROLLDOWN_CONFIG_BUNDLE_GLOB}`;
 /**
  * The biome.json vended into a new workspace. The pnpm catalog resolver is only
  * included on pnpm workspaces, since `experimentalPnpmCatalogs` is Biome's only
@@ -69,6 +88,7 @@ import { TS_VERSIONS } from "./versions.js";
                 '!**/dist',
                 '!**/out-tsc',
                 BIOME_TEST_OUTPUT_EXCLUDE,
+                BIOME_ROLLDOWN_CONFIG_BUNDLE_EXCLUDE,
                 '!**/node_modules',
                 '!**/.nx',
                 '!**/.venv',