@aws/nx-plugin 1.0.0-rc.96 → 1.0.0-rc.97

package/src/infra/app/generator.js.map

@@ -1 +1 @@
-{"version":3,"sources":["../../../../../../packages/nx-plugin/src/infra/app/generator.ts"],"sourcesContent":["/**\n * Copyright Amazon.com, Inc. or its affiliates. All Rights Reserved.\n * SPDX-License-Identifier: Apache-2.0\n */\nimport {\n  type GeneratorCallback,\n  generateFiles,\n  joinPathFragments,\n  OverwriteStrategy,\n  type ProjectConfiguration,\n  readProjectConfiguration,\n  type Tree,\n  updateJson,\n} from '@nx/devkit';\nimport path from 'path';\nimport tsProjectGenerator, { getTsLibDetails } from '../../ts/lib/generator.js';\nimport { mergeTsReferences } from '../../ts/lib/ts-project-utils.js';\nimport { addTsDependencies } from '../../utils/add-dependencies.js';\nimport { resolveContainers } from '../../utils/containers.js';\nimport {\n  declareDependencies,\n  ownedElsewhere,\n} from '../../utils/declared-dependencies.js';\nimport { formatFilesInSubtree } from '../../utils/format.js';\nimport { installDependencies } from '../../utils/install.js';\nimport { addGeneratorMetricsIfApplicable } from '../../utils/metrics.js';\nimport { esmVars } from '../../utils/module-format.js';\nimport { kebabCase } from '../../utils/names.js';\nimport { getNpmScopePrefix } from '../../utils/npm-scope.js';\nimport {\n  addArtifactDependencyToTargets,\n  addDependencyToTargetIfNotPresent,\n  addGeneratorMetadata,\n  getGeneratorInfo,\n  type NxGeneratorInfo,\n  projectExists,\n} from '../../utils/nx.js';\nimport { sortObjectKeys } from '../../utils/object.js';\nimport { getPackageManagerDisplayCommands } from '../../utils/pkg-manager.js';\nimport { uvxCommand } from '../../utils/py.js';\nimport {\n  SHARED_CONSTRUCTS_DEPENDENCIES,\n  sharedConstructsGenerator,\n} from '../../utils/shared-constructs.js';\nimport {\n  PACKAGES_DIR,\n  SHARED_CONSTRUCTS_DIR,\n  SHARED_INFRA_CONFIG_DIR,\n} from '../../utils/shared-constructs-constants.js';\nimport { sharedInfraConfigGenerator } from '../../utils/shared-infra-config.js';\nimport {\n  SHARED_INFRA_SCRIPTS_DEPENDENCIES,\n  sharedInfraScriptsGenerator,\n} from '../../utils/shared-infra-scripts.js';\nimport type { TsInfraGeneratorSchema } from './schema';\n\n// This generator records no metadata, so nothing a predicate could read: the\n// CDK app always needs the app libraries, and the CLI, bundler and tsx are\n// shared tooling.\nexport const DEPENDENCIES = declareDependencies()({\n  ts: [\n    { name: 'aws-cdk-lib' },\n    { name: 'constructs' },\n    { name: 'source-map-support' },\n    // The `aws-cdk` CLI, esbuild (CDK bundling) and tsx are shared tooling.\n    { name: 'aws-cdk', dev: true, root: true },\n    { name: 'esbuild', dev: true, root: true },\n    { name: 'tsx', dev: true, root: true },\n    ...ownedElsewhere(SHARED_CONSTRUCTS_DEPENDENCIES),\n    ...ownedElsewhere(SHARED_INFRA_SCRIPTS_DEPENDENCIES),\n  ],\n});\n\nexport const INFRA_APP_GENERATOR_INFO: NxGeneratorInfo = getGeneratorInfo(\n  import.meta.filename,\n);\n\nexport async function tsInfraGenerator(\n  tree: Tree,\n  schema: TsInfraGeneratorSchema,\n): Promise<GeneratorCallback> {\n  const lib = getTsLibDetails(tree, schema);\n\n  if (!projectExists(tree, lib.fullyQualifiedName)) {\n    await tsProjectGenerator(tree, {\n      ...schema,\n      preferInstallDependencies: false,\n    });\n  }\n\n  // CDK shells out to a container engine to build image assets. Default\n  // (docker) needs no env override; finch is set via CDK_DOCKER per\n  // https://docs.aws.amazon.com/cdk/v2/guide/build-containers.html#build-container-replace.\n  const containers = await resolveContainers(tree, 'inherit');\n  const cdkEnv: Record<string, string> | undefined =\n    containers === 'docker' ? undefined : { CDK_DOCKER: containers };\n  const withCdkEnv = <T extends Record<string, unknown>>(opts: T): T => {\n    if (!cdkEnv) return opts;\n    const existingEnv = (opts.env as Record<string, string> | undefined) ?? {};\n    return { ...opts, env: { ...existingEnv, ...cdkEnv } } as T;\n  };\n\n  // This generator IS the CDK infrastructure project, so the provider is fixed.\n  addGeneratorMetadata(tree, lib.fullyQualifiedName, INFRA_APP_GENERATOR_INFO, {\n    iac: 'cdk',\n  });\n\n  // Shared constructs always in CDK for typescript infra generator\n  await sharedConstructsGenerator(\n    tree,\n    {\n      iac: 'cdk',\n    },\n    DEPENDENCIES,\n  );\n\n  // Shared infra-config and infra-scripts packages (lazy creation, only when enabled)\n  const stageConfig = schema.stageConfig ?? false;\n  if (stageConfig) {\n    await sharedInfraConfigGenerator(tree);\n    await sharedInfraScriptsGenerator(tree, DEPENDENCIES);\n  }\n\n  const synthDirFromRoot = `/dist/${lib.dir}/cdk.out`;\n  const synthDirFromProject =\n    lib.dir\n      .split('/')\n      .map(() => '..')\n      .join('/') + `/dist/${lib.dir}/cdk.out`;\n  const distDirFromProjectRoot =\n    lib.dir\n      .split('/')\n      .map(() => '..')\n      .join('/') + '/dist/{projectRoot}/cdk.out';\n  const projectConfig = readProjectConfiguration(tree, lib.fullyQualifiedName);\n  const libraryRoot = projectConfig.root;\n  const npmScopePrefix = getNpmScopePrefix(tree);\n  const scopeAlias = npmScopePrefix;\n  const fullyQualifiedName = `${npmScopePrefix}${schema.name}`;\n  const namespace = kebabCase(fullyQualifiedName);\n  // The stage instantiated in main.ts. Quoted so the shell does not glob `*`.\n  const sandboxStagePattern = `\"${namespace}-sandbox/*\"`;\n  tree.delete(joinPathFragments(libraryRoot, 'src'));\n\n  generateFiles(\n    tree, // the virtual file system\n    joinPathFragments(import.meta.dirname, './files/app'), // path to the file templates\n    libraryRoot, // destination path of the files\n    {\n      synthDir: synthDirFromProject,\n      scopeAlias: scopeAlias,\n      namespace,\n      fullyQualifiedName,\n      pkgMgrCmd: getPackageManagerDisplayCommands().exec,\n      dir: lib.dir,\n      stageConfig,\n      ...schema,\n      ...esmVars(tree),\n    },\n    {\n      overwriteStrategy: OverwriteStrategy.Overwrite,\n    },\n  );\n\n  updateJson(\n    tree,\n    `${libraryRoot}/project.json`,\n    (config: ProjectConfiguration) => {\n      config.projectType = 'application';\n      // `synth` is the CDK artifact, so it belongs on `assemble` too; `checkov`\n      // is a quality gate, so it stays on `build` alone.\n      addArtifactDependencyToTargets(config, 'synth');\n      addDependencyToTargetIfNotPresent(config, 'build', 'checkov');\n      config.targets.compile.outputs = [\n        '{workspaceRoot}/dist/{projectRoot}/tsc',\n      ];\n      config.targets.synth = {\n        cache: true,\n        executor: 'nx:run-commands',\n        inputs: ['default'],\n        outputs: ['{workspaceRoot}/dist/{projectRoot}/cdk.out'],\n        dependsOn: ['^assemble', 'compile'], // compile clobbers dist directory, so ensure synth runs afterwards\n        options: withCdkEnv({\n          cwd: '{projectRoot}',\n          command: 'cdk synth',\n        }),\n      };\n      config.targets.checkov = {\n        cache: true,\n        executor: 'nx:run-commands',\n        inputs: ['{workspaceRoot}/dist/{projectRoot}/cdk.out'],\n        outputs: ['{workspaceRoot}/dist/{projectRoot}/checkov'],\n        dependsOn: ['synth'],\n        options: {\n          command: uvxCommand(\n            'checkov',\n            '--config-file {projectRoot}/checkov.yml --directory dist/{projectRoot}/cdk.out --framework cloudformation',\n          ),\n        },\n      };\n      config.targets.deploy = {\n        executor: 'nx:run-commands',\n        dependsOn: ['^assemble', 'compile'],\n        // No --express here when stages are configured: this target deploys\n        // whichever stage is named, including beta and prod.\n        options: stageConfig\n          ? withCdkEnv({\n              command: `tsx packages/common/scripts/src/infra/infra-deploy.ts ${libraryRoot}`,\n            })\n          : withCdkEnv({\n              cwd: '{projectRoot}',\n              command: 'cdk deploy --require-approval=never --express',\n            }),\n      };\n      config.targets['deploy-sandbox'] = {\n        executor: 'nx:run-commands',\n        dependsOn: ['^assemble', 'compile'],\n        options: stageConfig\n          ? withCdkEnv({\n              command: `tsx packages/common/scripts/src/infra/infra-deploy.ts ${libraryRoot} ${sandboxStagePattern} --express`,\n            })\n          : withCdkEnv({\n              cwd: '{projectRoot}',\n              command: `cdk deploy --require-approval=never ${sandboxStagePattern} --express`,\n            }),\n      };\n      config.targets['deploy-ci'] = {\n        executor: 'nx:run-commands',\n        options: withCdkEnv({\n          cwd: '{projectRoot}',\n          command: `cdk deploy --require-approval=never --app ${distDirFromProjectRoot}`,\n        }),\n      };\n      config.targets.destroy = {\n        executor: 'nx:run-commands',\n        dependsOn: ['^assemble', 'compile'],\n        options: stageConfig\n          ? withCdkEnv({\n              command: `tsx packages/common/scripts/src/infra/infra-destroy.ts ${libraryRoot}`,\n            })\n          : withCdkEnv({\n              cwd: '{projectRoot}',\n              command: 'cdk destroy',\n            }),\n      };\n      config.targets['destroy-sandbox'] = {\n        executor: 'nx:run-commands',\n        dependsOn: ['^assemble', 'compile'],\n        options: stageConfig\n          ? withCdkEnv({\n              command: `tsx packages/common/scripts/src/infra/infra-destroy.ts ${libraryRoot} ${sandboxStagePattern}`,\n            })\n          : withCdkEnv({\n              cwd: '{projectRoot}',\n              command: `cdk destroy ${sandboxStagePattern}`,\n            }),\n      };\n      config.targets['destroy-ci'] = {\n        executor: 'nx:run-commands',\n        options: withCdkEnv({\n          cwd: '{projectRoot}',\n          command: `cdk destroy --app ${distDirFromProjectRoot}`,\n        }),\n      };\n      config.targets.cdk = {\n        executor: 'nx:run-commands',\n        options: withCdkEnv({\n          cwd: '{projectRoot}',\n          command: 'cdk',\n        }),\n      };\n      config.targets.bootstrap = {\n        executor: 'nx:run-commands',\n        options: withCdkEnv({\n          cwd: '{projectRoot}',\n          command: 'cdk bootstrap',\n        }),\n      };\n      config.targets = sortObjectKeys(config.targets);\n      return config;\n    },\n  );\n\n  addTsDependencies(tree, DEPENDENCIES, { projectRoot: libraryRoot });\n\n  updateJson(tree, `${libraryRoot}/tsconfig.lib.json`, (tsConfig) => ({\n    ...tsConfig,\n    references: mergeTsReferences(tsConfig.references, [\n      {\n        path: `${path.relative(\n          libraryRoot,\n          `${tree.root}/${PACKAGES_DIR}`,\n        )}/${SHARED_CONSTRUCTS_DIR}/tsconfig.lib.json`,\n      },\n      ...(stageConfig\n        ? [\n            {\n              path: `${path.relative(\n                libraryRoot,\n                `${tree.root}/${PACKAGES_DIR}`,\n              )}/${SHARED_INFRA_CONFIG_DIR}/tsconfig.json`,\n            },\n          ]\n        : []),\n    ]),\n  }));\n\n  await addGeneratorMetricsIfApplicable(tree, [INFRA_APP_GENERATOR_INFO]);\n\n  await formatFilesInSubtree(tree);\n  return () =>\n    installDependencies(tree, schema.preferInstallDependencies, {\n      languages: ['typescript'],\n    });\n}\nexport default tsInfraGenerator;\n"],"names":["generateFiles","joinPathFragments","OverwriteStrategy","readProjectConfiguration","updateJson","path","tsProjectGenerator","getTsLibDetails","mergeTsReferences","addTsDependencies","resolveContainers","declareDependencies","ownedElsewhere","formatFilesInSubtree","installDependencies","addGeneratorMetricsIfApplicable","esmVars","kebabCase","getNpmScopePrefix","addArtifactDependencyToTargets","addDependencyToTargetIfNotPresent","addGeneratorMetadata","getGeneratorInfo","projectExists","sortObjectKeys","getPackageManagerDisplayCommands","uvxCommand","SHARED_CONSTRUCTS_DEPENDENCIES","sharedConstructsGenerator","PACKAGES_DIR","SHARED_CONSTRUCTS_DIR","SHARED_INFRA_CONFIG_DIR","sharedInfraConfigGenerator","SHARED_INFRA_SCRIPTS_DEPENDENCIES","sharedInfraScriptsGenerator","DEPENDENCIES","ts","name","dev","root","INFRA_APP_GENERATOR_INFO","filename","tsInfraGenerator","tree","schema","lib","fullyQualifiedName","preferInstallDependencies","containers","cdkEnv","undefined","CDK_DOCKER","withCdkEnv","opts","existingEnv","env","iac","stageConfig","synthDirFromRoot","dir","synthDirFromProject","split","map","join","distDirFromProjectRoot","projectConfig","libraryRoot","npmScopePrefix","scopeAlias","namespace","sandboxStagePattern","delete","dirname","synthDir","pkgMgrCmd","exec","overwriteStrategy","Overwrite","config","projectType","targets","compile","outputs","synth","cache","executor","inputs","dependsOn","options","cwd","command","checkov","deploy","destroy","cdk","bootstrap","projectRoot","tsConfig","references","relative","languages"],"mappings":"AAAA;;;CAGC,GACD,SAEEA,aAAa,EACbC,iBAAiB,EACjBC,iBAAiB,EAEjBC,wBAAwB,EAExBC,UAAU,QACL,aAAa;AACpB,OAAOC,UAAU,OAAO;AACxB,OAAOC,sBAAsBC,eAAe,QAAQ,4BAA4B;AAChF,SAASC,iBAAiB,QAAQ,mCAAmC;AACrE,SAASC,iBAAiB,QAAQ,kCAAkC;AACpE,SAASC,iBAAiB,QAAQ,4BAA4B;AAC9D,SACEC,mBAAmB,EACnBC,cAAc,QACT,uCAAuC;AAC9C,SAASC,oBAAoB,QAAQ,wBAAwB;AAC7D,SAASC,mBAAmB,QAAQ,yBAAyB;AAC7D,SAASC,+BAA+B,QAAQ,yBAAyB;AACzE,SAASC,OAAO,QAAQ,+BAA+B;AACvD,SAASC,SAAS,QAAQ,uBAAuB;AACjD,SAASC,iBAAiB,QAAQ,2BAA2B;AAC7D,SACEC,8BAA8B,EAC9BC,iCAAiC,EACjCC,oBAAoB,EACpBC,gBAAgB,EAEhBC,aAAa,QACR,oBAAoB;AAC3B,SAASC,cAAc,QAAQ,wBAAwB;AACvD,SAASC,gCAAgC,QAAQ,6BAA6B;AAC9E,SAASC,UAAU,QAAQ,oBAAoB;AAC/C,SACEC,8BAA8B,EAC9BC,yBAAyB,QACpB,mCAAmC;AAC1C,SACEC,YAAY,EACZC,qBAAqB,EACrBC,uBAAuB,QAClB,6CAA6C;AACpD,SAASC,0BAA0B,QAAQ,qCAAqC;AAChF,SACEC,iCAAiC,EACjCC,2BAA2B,QACtB,sCAAsC;AAG7C,6EAA6E;AAC7E,2EAA2E;AAC3E,kBAAkB;AAClB,OAAO,MAAMC,eAAexB,sBAAsB;IAChDyB,IAAI;QACF;YAAEC,MAAM;QAAc;QACtB;YAAEA,MAAM;QAAa;QACrB;YAAEA,MAAM;QAAqB;QAC7B,wEAAwE;QACxE;YAAEA,MAAM;YAAWC,KAAK;YAAMC,MAAM;QAAK;QACzC;YAAEF,MAAM;YAAWC,KAAK;YAAMC,MAAM;QAAK;QACzC;YAAEF,MAAM;YAAOC,KAAK;YAAMC,MAAM;QAAK;WAClC3B,eAAee;WACff,eAAeqB;KACnB;AACH,GAAG;AAEH,OAAO,MAAMO,2BAA4ClB,iBACvD,YAAYmB,QAAQ,EACpB;AAEF,OAAO,eAAeC,iBACpBC,IAAU,EACVC,MAA8B;IAE9B,MAAMC,MAAMtC,gBAAgBoC,MAAMC;IAElC,IAAI,CAACrB,cAAcoB,MAAME,IAAIC,kBAAkB,GAAG;QAChD,MAAMxC,mBAAmBqC,MAAM;YAC7B,GAAGC,MAAM;YACTG,2BAA2B;QAC7B;IACF;IAEA,sEAAsE;IACtE,kEAAkE;IAClE,0FAA0F;IAC1F,MAAMC,aAAa,MAAMtC,kBAAkBiC,MAAM;IACjD,MAAMM,SACJD,eAAe,WAAWE,YAAY;QAAEC,YAAYH;IAAW;IACjE,MAAMI,aAAa,CAAoCC;QACrD,IAAI,CAACJ,QAAQ,OAAOI;QACpB,MAAMC,cAAc,AAACD,KAAKE,GAAG,IAA2C,CAAC;QACzE,OAAO;YAAE,GAAGF,IAAI;YAAEE,KAAK;gBAAE,GAAGD,WAAW;gBAAE,GAAGL,MAAM;YAAC;QAAE;IACvD;IAEA,8EAA8E;IAC9E5B,qBAAqBsB,MAAME,IAAIC,kBAAkB,EAAEN,0BAA0B;QAC3EgB,KAAK;IACP;IAEA,iEAAiE;IACjE,MAAM5B,0BACJe,MACA;QACEa,KAAK;IACP,GACArB;IAGF,oFAAoF;IACpF,MAAMsB,cAAcb,OAAOa,WAAW,IAAI;IAC1C,IAAIA,aAAa;QACf,MAAMzB,2BAA2BW;QACjC,MAAMT,4BAA4BS,MAAMR;IAC1C;IAEA,MAAMuB,mBAAmB,CAAC,MAAM,EAAEb,IAAIc,GAAG,CAAC,QAAQ,CAAC;IACnD,MAAMC,sBACJf,IAAIc,GAAG,CACJE,KAAK,CAAC,KACNC,GAAG,CAAC,IAAM,MACVC,IAAI,CAAC,OAAO,CAAC,MAAM,EAAElB,IAAIc,GAAG,CAAC,QAAQ,CAAC;IAC3C,MAAMK,yBACJnB,IAAIc,GAAG,CACJE,KAAK,CAAC,KACNC,GAAG,CAAC,IAAM,MACVC,IAAI,CAAC,OAAO;IACjB,MAAME,gBAAgB9D,yBAAyBwC,MAAME,IAAIC,kBAAkB;IAC3E,MAAMoB,cAAcD,cAAc1B,IAAI;IACtC,MAAM4B,iBAAiBjD,kBAAkByB;IACzC,MAAMyB,aAAaD;IACnB,MAAMrB,qBAAqB,GAAGqB,iBAAiBvB,OAAOP,IAAI,EAAE;IAC5D,MAAMgC,YAAYpD,UAAU6B;IAC5B,4EAA4E;IAC5E,MAAMwB,sBAAsB,CAAC,CAAC,EAAED,UAAU,WAAW,CAAC;IACtD1B,KAAK4B,MAAM,CAACtE,kBAAkBiE,aAAa;IAE3ClE,cACE2C,MACA1C,kBAAkB,YAAYuE,OAAO,EAAE,gBACvCN,aACA;QACEO,UAAUb;QACVQ,YAAYA;QACZC;QACAvB;QACA4B,WAAWjD,mCAAmCkD,IAAI;QAClDhB,KAAKd,IAAIc,GAAG;QACZF;QACA,GAAGb,MAAM;QACT,GAAG5B,QAAQ2B,KAAK;IAClB,GACA;QACEiC,mBAAmB1E,kBAAkB2E,SAAS;IAChD;IAGFzE,WACEuC,MACA,GAAGuB,YAAY,aAAa,CAAC,EAC7B,CAACY;QACCA,OAAOC,WAAW,GAAG;QACrB,0EAA0E;QAC1E,mDAAmD;QACnD5D,+BAA+B2D,QAAQ;QACvC1D,kCAAkC0D,QAAQ,SAAS;QACnDA,OAAOE,OAAO,CAACC,OAAO,CAACC,OAAO,GAAG;YAC/B;SACD;QACDJ,OAAOE,OAAO,CAACG,KAAK,GAAG;YACrBC,OAAO;YACPC,UAAU;YACVC,QAAQ;gBAAC;aAAU;YACnBJ,SAAS;gBAAC;aAA6C;YACvDK,WAAW;gBAAC;gBAAa;aAAU;YACnCC,SAASpC,WAAW;gBAClBqC,KAAK;gBACLC,SAAS;YACX;QACF;QACAZ,OAAOE,OAAO,CAACW,OAAO,GAAG;YACvBP,OAAO;YACPC,UAAU;YACVC,QAAQ;gBAAC;aAA6C;YACtDJ,SAAS;gBAAC;aAA6C;YACvDK,WAAW;gBAAC;aAAQ;YACpBC,SAAS;gBACPE,SAAShE,WACP,WACA;YAEJ;QACF;QACAoD,OAAOE,OAAO,CAACY,MAAM,GAAG;YACtBP,UAAU;YACVE,WAAW;gBAAC;gBAAa;aAAU;YACnC,oEAAoE;YACpE,qDAAqD;YACrDC,SAAS/B,cACLL,WAAW;gBACTsC,SAAS,CAAC,sDAAsD,EAAExB,aAAa;YACjF,KACAd,WAAW;gBACTqC,KAAK;gBACLC,SAAS;YACX;QACN;QACAZ,OAAOE,OAAO,CAAC,iBAAiB,GAAG;YACjCK,UAAU;YACVE,WAAW;gBAAC;gBAAa;aAAU;YACnCC,SAAS/B,cACLL,WAAW;gBACTsC,SAAS,CAAC,sDAAsD,EAAExB,YAAY,CAAC,EAAEI,oBAAoB,UAAU,CAAC;YAClH,KACAlB,WAAW;gBACTqC,KAAK;gBACLC,SAAS,CAAC,oCAAoC,EAAEpB,oBAAoB,UAAU,CAAC;YACjF;QACN;QACAQ,OAAOE,OAAO,CAAC,YAAY,GAAG;YAC5BK,UAAU;YACVG,SAASpC,WAAW;gBAClBqC,KAAK;gBACLC,SAAS,CAAC,0CAA0C,EAAE1B,wBAAwB;YAChF;QACF;QACAc,OAAOE,OAAO,CAACa,OAAO,GAAG;YACvBR,UAAU;YACVE,WAAW;gBAAC;gBAAa;aAAU;YACnCC,SAAS/B,cACLL,WAAW;gBACTsC,SAAS,CAAC,uDAAuD,EAAExB,aAAa;YAClF,KACAd,WAAW;gBACTqC,KAAK;gBACLC,SAAS;YACX;QACN;QACAZ,OAAOE,OAAO,CAAC,kBAAkB,GAAG;YAClCK,UAAU;YACVE,WAAW;gBAAC;gBAAa;aAAU;YACnCC,SAAS/B,cACLL,WAAW;gBACTsC,SAAS,CAAC,uDAAuD,EAAExB,YAAY,CAAC,EAAEI,qBAAqB;YACzG,KACAlB,WAAW;gBACTqC,KAAK;gBACLC,SAAS,CAAC,YAAY,EAAEpB,qBAAqB;YAC/C;QACN;QACAQ,OAAOE,OAAO,CAAC,aAAa,GAAG;YAC7BK,UAAU;YACVG,SAASpC,WAAW;gBAClBqC,KAAK;gBACLC,SAAS,CAAC,kBAAkB,EAAE1B,wBAAwB;YACxD;QACF;QACAc,OAAOE,OAAO,CAACc,GAAG,GAAG;YACnBT,UAAU;YACVG,SAASpC,WAAW;gBAClBqC,KAAK;gBACLC,SAAS;YACX;QACF;QACAZ,OAAOE,OAAO,CAACe,SAAS,GAAG;YACzBV,UAAU;YACVG,SAASpC,WAAW;gBAClBqC,KAAK;gBACLC,SAAS;YACX;QACF;QACAZ,OAAOE,OAAO,GAAGxD,eAAesD,OAAOE,OAAO;QAC9C,OAAOF;IACT;IAGFrE,kBAAkBkC,MAAMR,cAAc;QAAE6D,aAAa9B;IAAY;IAEjE9D,WAAWuC,MAAM,GAAGuB,YAAY,kBAAkB,CAAC,EAAE,CAAC+B,WAAc,CAAA;YAClE,GAAGA,QAAQ;YACXC,YAAY1F,kBAAkByF,SAASC,UAAU,EAAE;gBACjD;oBACE7F,MAAM,GAAGA,KAAK8F,QAAQ,CACpBjC,aACA,GAAGvB,KAAKJ,IAAI,CAAC,CAAC,EAAEV,cAAc,EAC9B,CAAC,EAAEC,sBAAsB,kBAAkB,CAAC;gBAChD;mBACI2B,cACA;oBACE;wBACEpD,MAAM,GAAGA,KAAK8F,QAAQ,CACpBjC,aACA,GAAGvB,KAAKJ,IAAI,CAAC,CAAC,EAAEV,cAAc,EAC9B,CAAC,EAAEE,wBAAwB,cAAc,CAAC;oBAC9C;iBACD,GACD,EAAE;aACP;QACH,CAAA;IAEA,MAAMhB,gCAAgC4B,MAAM;QAACH;KAAyB;IAEtE,MAAM3B,qBAAqB8B;IAC3B,OAAO,IACL7B,oBAAoB6B,MAAMC,OAAOG,yBAAyB,EAAE;YAC1DqD,WAAW;gBAAC;aAAa;QAC3B;AACJ;AACA,eAAe1D,iBAAiB"}
+{"version":3,"sources":["../../../../../../packages/nx-plugin/src/infra/app/generator.ts"],"sourcesContent":["/**\n * Copyright Amazon.com, Inc. or its affiliates. All Rights Reserved.\n * SPDX-License-Identifier: Apache-2.0\n */\nimport {\n  type GeneratorCallback,\n  generateFiles,\n  joinPathFragments,\n  OverwriteStrategy,\n  type ProjectConfiguration,\n  readProjectConfiguration,\n  type Tree,\n  updateJson,\n} from '@nx/devkit';\nimport path from 'path';\nimport tsProjectGenerator, { getTsLibDetails } from '../../ts/lib/generator.js';\nimport { mergeTsReferences } from '../../ts/lib/ts-project-utils.js';\nimport { addTsDependencies } from '../../utils/add-dependencies.js';\nimport { resolveContainers } from '../../utils/containers.js';\nimport {\n  declareDependencies,\n  ownedElsewhere,\n} from '../../utils/declared-dependencies.js';\nimport { formatFilesInSubtree } from '../../utils/format.js';\nimport { installDependencies } from '../../utils/install.js';\nimport { addLocalProjectDependency } from '../../utils/local-project-dependency.js';\nimport { addGeneratorMetricsIfApplicable } from '../../utils/metrics.js';\nimport { esmVars } from '../../utils/module-format.js';\nimport { kebabCase } from '../../utils/names.js';\nimport { getNpmScopePrefix } from '../../utils/npm-scope.js';\nimport {\n  addArtifactDependencyToTargets,\n  addDependencyToTargetIfNotPresent,\n  addGeneratorMetadata,\n  getGeneratorInfo,\n  type NxGeneratorInfo,\n  projectExists,\n} from '../../utils/nx.js';\nimport { sortObjectKeys } from '../../utils/object.js';\nimport { getPackageManagerDisplayCommands } from '../../utils/pkg-manager.js';\nimport { uvxCommand } from '../../utils/py.js';\nimport {\n  SHARED_CONSTRUCTS_DEPENDENCIES,\n  sharedConstructsGenerator,\n} from '../../utils/shared-constructs.js';\nimport {\n  PACKAGES_DIR,\n  SHARED_CONSTRUCTS_DIR,\n  SHARED_INFRA_CONFIG_DIR,\n} from '../../utils/shared-constructs-constants.js';\nimport { sharedInfraConfigGenerator } from '../../utils/shared-infra-config.js';\nimport {\n  SHARED_INFRA_SCRIPTS_DEPENDENCIES,\n  sharedInfraScriptsGenerator,\n} from '../../utils/shared-infra-scripts.js';\nimport type { TsInfraGeneratorSchema } from './schema';\n\n// This generator records no metadata, so nothing a predicate could read: the\n// CDK app always needs the app libraries, and the CLI, bundler and tsx are\n// shared tooling.\nexport const DEPENDENCIES = declareDependencies()({\n  ts: [\n    { name: 'aws-cdk-lib' },\n    { name: 'constructs' },\n    { name: 'source-map-support' },\n    // The `aws-cdk` CLI, esbuild (CDK bundling) and tsx are shared tooling.\n    { name: 'aws-cdk', dev: true, root: true },\n    { name: 'esbuild', dev: true, root: true },\n    { name: 'tsx', dev: true, root: true },\n    ...ownedElsewhere(SHARED_CONSTRUCTS_DEPENDENCIES),\n    ...ownedElsewhere(SHARED_INFRA_SCRIPTS_DEPENDENCIES),\n  ],\n});\n\nexport const INFRA_APP_GENERATOR_INFO: NxGeneratorInfo = getGeneratorInfo(\n  import.meta.filename,\n);\n\nexport async function tsInfraGenerator(\n  tree: Tree,\n  schema: TsInfraGeneratorSchema,\n): Promise<GeneratorCallback> {\n  const lib = getTsLibDetails(tree, schema);\n\n  const isNewProject = !projectExists(tree, lib.fullyQualifiedName);\n  if (isNewProject) {\n    await tsProjectGenerator(tree, {\n      ...schema,\n      preferInstallDependencies: false,\n    });\n  }\n\n  // CDK shells out to a container engine to build image assets. Default\n  // (docker) needs no env override; finch is set via CDK_DOCKER per\n  // https://docs.aws.amazon.com/cdk/v2/guide/build-containers.html#build-container-replace.\n  const containers = await resolveContainers(tree, 'inherit');\n  const cdkEnv: Record<string, string> | undefined =\n    containers === 'docker' ? undefined : { CDK_DOCKER: containers };\n  const withCdkEnv = <T extends Record<string, unknown>>(opts: T): T => {\n    if (!cdkEnv) return opts;\n    const existingEnv = (opts.env as Record<string, string> | undefined) ?? {};\n    return { ...opts, env: { ...existingEnv, ...cdkEnv } } as T;\n  };\n\n  // This generator IS the CDK infrastructure project, so the provider is fixed.\n  addGeneratorMetadata(tree, lib.fullyQualifiedName, INFRA_APP_GENERATOR_INFO, {\n    iac: 'cdk',\n  });\n\n  // Shared constructs always in CDK for typescript infra generator\n  await sharedConstructsGenerator(\n    tree,\n    {\n      iac: 'cdk',\n    },\n    DEPENDENCIES,\n  );\n\n  // Shared infra-config and infra-scripts packages (lazy creation, only when enabled)\n  const stageConfig = schema.stageConfig ?? false;\n  if (stageConfig) {\n    await sharedInfraConfigGenerator(tree);\n    await sharedInfraScriptsGenerator(tree, DEPENDENCIES);\n  }\n\n  const synthDirFromRoot = `/dist/${lib.dir}/cdk.out`;\n  const synthDirFromProject =\n    lib.dir\n      .split('/')\n      .map(() => '..')\n      .join('/') + `/dist/${lib.dir}/cdk.out`;\n  const distDirFromProjectRoot =\n    lib.dir\n      .split('/')\n      .map(() => '..')\n      .join('/') + '/dist/{projectRoot}/cdk.out';\n  const projectConfig = readProjectConfiguration(tree, lib.fullyQualifiedName);\n  const libraryRoot = projectConfig.root;\n  const npmScopePrefix = getNpmScopePrefix(tree);\n  const scopeAlias = npmScopePrefix;\n  const fullyQualifiedName = `${npmScopePrefix}${schema.name}`;\n  const namespace = kebabCase(fullyQualifiedName);\n  // The stage instantiated in main.ts. Quoted so the shell does not glob `*`.\n  const sandboxStagePattern = `\"${namespace}-sandbox/*\"`;\n\n  // `tsProjectGenerator` scaffolds a library `src`, which the CDK app layout\n  // replaces. Only on creation — on a re-run this is the user's infrastructure.\n  if (isNewProject) {\n    tree.delete(joinPathFragments(libraryRoot, 'src'));\n  }\n\n  // The guide walks through declaring resources in\n  // `src/stacks/application-stack.ts` and adding stages to `src/main.ts`, so\n  // everything here is scaffolded once and then left alone.\n  generateFiles(\n    tree,\n    joinPathFragments(import.meta.dirname, './files/app'),\n    libraryRoot,\n    {\n      synthDir: synthDirFromProject,\n      scopeAlias: scopeAlias,\n      namespace,\n      fullyQualifiedName,\n      pkgMgrCmd: getPackageManagerDisplayCommands().exec,\n      dir: lib.dir,\n      stageConfig,\n      ...schema,\n      ...esmVars(tree),\n    },\n    {\n      overwriteStrategy: OverwriteStrategy.KeepExisting,\n    },\n  );\n\n  updateJson(\n    tree,\n    `${libraryRoot}/project.json`,\n    (config: ProjectConfiguration) => {\n      config.projectType = 'application';\n      // `synth` is the CDK artifact, so it belongs on `assemble` too; `checkov`\n      // is a quality gate, so it stays on `build` alone.\n      addArtifactDependencyToTargets(config, 'synth');\n      addDependencyToTargetIfNotPresent(config, 'build', 'checkov');\n      config.targets.compile.outputs = [\n        '{workspaceRoot}/dist/{projectRoot}/tsc',\n      ];\n      config.targets.synth = {\n        cache: true,\n        executor: 'nx:run-commands',\n        inputs: ['default'],\n        outputs: ['{workspaceRoot}/dist/{projectRoot}/cdk.out'],\n        dependsOn: ['^assemble', 'compile'], // compile clobbers dist directory, so ensure synth runs afterwards\n        options: withCdkEnv({\n          cwd: '{projectRoot}',\n          command: 'cdk synth',\n        }),\n      };\n      // `default` rather than the synth directory: `dist` is gitignored, so a\n      // fileset input pointed at it matches no tracked file and hashes to a\n      // constant — the scan would cache-hit forever and pass on infrastructure\n      // it never read. `default` carries the project's own sources plus the\n      // transitive `dependentTasksOutputFiles` entry, which resolves against\n      // the upstream `synth` task and so hashes the template actually scanned.\n      config.targets.checkov = {\n        cache: true,\n        executor: 'nx:run-commands',\n        inputs: ['default'],\n        outputs: ['{workspaceRoot}/dist/{projectRoot}/checkov'],\n        dependsOn: ['synth'],\n        options: {\n          command: uvxCommand(\n            'checkov',\n            '--config-file {projectRoot}/checkov.yml --directory dist/{projectRoot}/cdk.out --framework cloudformation',\n          ),\n        },\n      };\n      config.targets.deploy = {\n        executor: 'nx:run-commands',\n        dependsOn: ['^assemble', 'compile'],\n        // No --express: this target deploys whichever stage is named, including\n        // beta and prod, so it waits for full resource stabilization. Express\n        // mode belongs to `deploy-sandbox`, which only ever deploys a sandbox.\n        options: stageConfig\n          ? withCdkEnv({\n              command: `tsx packages/common/scripts/src/infra/infra-deploy.ts ${libraryRoot}`,\n            })\n          : withCdkEnv({\n              cwd: '{projectRoot}',\n              command: 'cdk deploy --require-approval=never',\n            }),\n      };\n      config.targets['deploy-sandbox'] = {\n        executor: 'nx:run-commands',\n        dependsOn: ['^assemble', 'compile'],\n        options: stageConfig\n          ? withCdkEnv({\n              command: `tsx packages/common/scripts/src/infra/infra-deploy.ts ${libraryRoot} ${sandboxStagePattern} --express`,\n            })\n          : withCdkEnv({\n              cwd: '{projectRoot}',\n              command: `cdk deploy --require-approval=never ${sandboxStagePattern} --express`,\n            }),\n      };\n      config.targets['deploy-ci'] = {\n        executor: 'nx:run-commands',\n        options: withCdkEnv({\n          cwd: '{projectRoot}',\n          command: `cdk deploy --require-approval=never --app ${distDirFromProjectRoot}`,\n        }),\n      };\n      config.targets.destroy = {\n        executor: 'nx:run-commands',\n        dependsOn: ['^assemble', 'compile'],\n        options: stageConfig\n          ? withCdkEnv({\n              command: `tsx packages/common/scripts/src/infra/infra-destroy.ts ${libraryRoot}`,\n            })\n          : withCdkEnv({\n              cwd: '{projectRoot}',\n              command: 'cdk destroy',\n            }),\n      };\n      config.targets['destroy-sandbox'] = {\n        executor: 'nx:run-commands',\n        dependsOn: ['^assemble', 'compile'],\n        options: stageConfig\n          ? withCdkEnv({\n              command: `tsx packages/common/scripts/src/infra/infra-destroy.ts ${libraryRoot} ${sandboxStagePattern}`,\n            })\n          : withCdkEnv({\n              cwd: '{projectRoot}',\n              command: `cdk destroy ${sandboxStagePattern}`,\n            }),\n      };\n      config.targets['destroy-ci'] = {\n        executor: 'nx:run-commands',\n        options: withCdkEnv({\n          cwd: '{projectRoot}',\n          command: `cdk destroy --app ${distDirFromProjectRoot}`,\n        }),\n      };\n      config.targets.cdk = {\n        executor: 'nx:run-commands',\n        options: withCdkEnv({\n          cwd: '{projectRoot}',\n          command: 'cdk',\n        }),\n      };\n      config.targets.bootstrap = {\n        executor: 'nx:run-commands',\n        options: withCdkEnv({\n          cwd: '{projectRoot}',\n          command: 'cdk bootstrap',\n        }),\n      };\n      config.targets = sortObjectKeys(config.targets);\n      return config;\n    },\n  );\n\n  addTsDependencies(tree, DEPENDENCIES, { projectRoot: libraryRoot });\n\n  updateJson(tree, `${libraryRoot}/tsconfig.lib.json`, (tsConfig) => ({\n    ...tsConfig,\n    references: mergeTsReferences(tsConfig.references, [\n      {\n        path: `${path.relative(\n          libraryRoot,\n          `${tree.root}/${PACKAGES_DIR}`,\n        )}/${SHARED_CONSTRUCTS_DIR}/tsconfig.lib.json`,\n      },\n      ...(stageConfig\n        ? [\n            {\n              path: `${path.relative(\n                libraryRoot,\n                `${tree.root}/${PACKAGES_DIR}`,\n              )}/${SHARED_INFRA_CONFIG_DIR}/tsconfig.json`,\n            },\n          ]\n        : []),\n    ]),\n  }));\n\n  // `main.ts` and the application stack import the shared constructs.\n  addLocalProjectDependency(tree, {\n    consumerRoot: libraryRoot,\n    dependencyRoot: joinPathFragments(PACKAGES_DIR, SHARED_CONSTRUCTS_DIR),\n  });\n  if (stageConfig) {\n    addLocalProjectDependency(tree, {\n      consumerRoot: libraryRoot,\n      dependencyRoot: joinPathFragments(PACKAGES_DIR, SHARED_INFRA_CONFIG_DIR),\n    });\n  }\n\n  await addGeneratorMetricsIfApplicable(tree, [INFRA_APP_GENERATOR_INFO]);\n\n  await formatFilesInSubtree(tree);\n  return () =>\n    installDependencies(tree, schema.preferInstallDependencies, {\n      languages: ['typescript'],\n    });\n}\nexport default tsInfraGenerator;\n"],"names":["generateFiles","joinPathFragments","OverwriteStrategy","readProjectConfiguration","updateJson","path","tsProjectGenerator","getTsLibDetails","mergeTsReferences","addTsDependencies","resolveContainers","declareDependencies","ownedElsewhere","formatFilesInSubtree","installDependencies","addLocalProjectDependency","addGeneratorMetricsIfApplicable","esmVars","kebabCase","getNpmScopePrefix","addArtifactDependencyToTargets","addDependencyToTargetIfNotPresent","addGeneratorMetadata","getGeneratorInfo","projectExists","sortObjectKeys","getPackageManagerDisplayCommands","uvxCommand","SHARED_CONSTRUCTS_DEPENDENCIES","sharedConstructsGenerator","PACKAGES_DIR","SHARED_CONSTRUCTS_DIR","SHARED_INFRA_CONFIG_DIR","sharedInfraConfigGenerator","SHARED_INFRA_SCRIPTS_DEPENDENCIES","sharedInfraScriptsGenerator","DEPENDENCIES","ts","name","dev","root","INFRA_APP_GENERATOR_INFO","filename","tsInfraGenerator","tree","schema","lib","isNewProject","fullyQualifiedName","preferInstallDependencies","containers","cdkEnv","undefined","CDK_DOCKER","withCdkEnv","opts","existingEnv","env","iac","stageConfig","synthDirFromRoot","dir","synthDirFromProject","split","map","join","distDirFromProjectRoot","projectConfig","libraryRoot","npmScopePrefix","scopeAlias","namespace","sandboxStagePattern","delete","dirname","synthDir","pkgMgrCmd","exec","overwriteStrategy","KeepExisting","config","projectType","targets","compile","outputs","synth","cache","executor","inputs","dependsOn","options","cwd","command","checkov","deploy","destroy","cdk","bootstrap","projectRoot","tsConfig","references","relative","consumerRoot","dependencyRoot","languages"],"mappings":"AAAA;;;CAGC,GACD,SAEEA,aAAa,EACbC,iBAAiB,EACjBC,iBAAiB,EAEjBC,wBAAwB,EAExBC,UAAU,QACL,aAAa;AACpB,OAAOC,UAAU,OAAO;AACxB,OAAOC,sBAAsBC,eAAe,QAAQ,4BAA4B;AAChF,SAASC,iBAAiB,QAAQ,mCAAmC;AACrE,SAASC,iBAAiB,QAAQ,kCAAkC;AACpE,SAASC,iBAAiB,QAAQ,4BAA4B;AAC9D,SACEC,mBAAmB,EACnBC,cAAc,QACT,uCAAuC;AAC9C,SAASC,oBAAoB,QAAQ,wBAAwB;AAC7D,SAASC,mBAAmB,QAAQ,yBAAyB;AAC7D,SAASC,yBAAyB,QAAQ,0CAA0C;AACpF,SAASC,+BAA+B,QAAQ,yBAAyB;AACzE,SAASC,OAAO,QAAQ,+BAA+B;AACvD,SAASC,SAAS,QAAQ,uBAAuB;AACjD,SAASC,iBAAiB,QAAQ,2BAA2B;AAC7D,SACEC,8BAA8B,EAC9BC,iCAAiC,EACjCC,oBAAoB,EACpBC,gBAAgB,EAEhBC,aAAa,QACR,oBAAoB;AAC3B,SAASC,cAAc,QAAQ,wBAAwB;AACvD,SAASC,gCAAgC,QAAQ,6BAA6B;AAC9E,SAASC,UAAU,QAAQ,oBAAoB;AAC/C,SACEC,8BAA8B,EAC9BC,yBAAyB,QACpB,mCAAmC;AAC1C,SACEC,YAAY,EACZC,qBAAqB,EACrBC,uBAAuB,QAClB,6CAA6C;AACpD,SAASC,0BAA0B,QAAQ,qCAAqC;AAChF,SACEC,iCAAiC,EACjCC,2BAA2B,QACtB,sCAAsC;AAG7C,6EAA6E;AAC7E,2EAA2E;AAC3E,kBAAkB;AAClB,OAAO,MAAMC,eAAezB,sBAAsB;IAChD0B,IAAI;QACF;YAAEC,MAAM;QAAc;QACtB;YAAEA,MAAM;QAAa;QACrB;YAAEA,MAAM;QAAqB;QAC7B,wEAAwE;QACxE;YAAEA,MAAM;YAAWC,KAAK;YAAMC,MAAM;QAAK;QACzC;YAAEF,MAAM;YAAWC,KAAK;YAAMC,MAAM;QAAK;QACzC;YAAEF,MAAM;YAAOC,KAAK;YAAMC,MAAM;QAAK;WAClC5B,eAAegB;WACfhB,eAAesB;KACnB;AACH,GAAG;AAEH,OAAO,MAAMO,2BAA4ClB,iBACvD,YAAYmB,QAAQ,EACpB;AAEF,OAAO,eAAeC,iBACpBC,IAAU,EACVC,MAA8B;IAE9B,MAAMC,MAAMvC,gBAAgBqC,MAAMC;IAElC,MAAME,eAAe,CAACvB,cAAcoB,MAAME,IAAIE,kBAAkB;IAChE,IAAID,cAAc;QAChB,MAAMzC,mBAAmBsC,MAAM;YAC7B,GAAGC,MAAM;YACTI,2BAA2B;QAC7B;IACF;IAEA,sEAAsE;IACtE,kEAAkE;IAClE,0FAA0F;IAC1F,MAAMC,aAAa,MAAMxC,kBAAkBkC,MAAM;IACjD,MAAMO,SACJD,eAAe,WAAWE,YAAY;QAAEC,YAAYH;IAAW;IACjE,MAAMI,aAAa,CAAoCC;QACrD,IAAI,CAACJ,QAAQ,OAAOI;QACpB,MAAMC,cAAc,AAACD,KAAKE,GAAG,IAA2C,CAAC;QACzE,OAAO;YAAE,GAAGF,IAAI;YAAEE,KAAK;gBAAE,GAAGD,WAAW;gBAAE,GAAGL,MAAM;YAAC;QAAE;IACvD;IAEA,8EAA8E;IAC9E7B,qBAAqBsB,MAAME,IAAIE,kBAAkB,EAAEP,0BAA0B;QAC3EiB,KAAK;IACP;IAEA,iEAAiE;IACjE,MAAM7B,0BACJe,MACA;QACEc,KAAK;IACP,GACAtB;IAGF,oFAAoF;IACpF,MAAMuB,cAAcd,OAAOc,WAAW,IAAI;IAC1C,IAAIA,aAAa;QACf,MAAM1B,2BAA2BW;QACjC,MAAMT,4BAA4BS,MAAMR;IAC1C;IAEA,MAAMwB,mBAAmB,CAAC,MAAM,EAAEd,IAAIe,GAAG,CAAC,QAAQ,CAAC;IACnD,MAAMC,sBACJhB,IAAIe,GAAG,CACJE,KAAK,CAAC,KACNC,GAAG,CAAC,IAAM,MACVC,IAAI,CAAC,OAAO,CAAC,MAAM,EAAEnB,IAAIe,GAAG,CAAC,QAAQ,CAAC;IAC3C,MAAMK,yBACJpB,IAAIe,GAAG,CACJE,KAAK,CAAC,KACNC,GAAG,CAAC,IAAM,MACVC,IAAI,CAAC,OAAO;IACjB,MAAME,gBAAgBhE,yBAAyByC,MAAME,IAAIE,kBAAkB;IAC3E,MAAMoB,cAAcD,cAAc3B,IAAI;IACtC,MAAM6B,iBAAiBlD,kBAAkByB;IACzC,MAAM0B,aAAaD;IACnB,MAAMrB,qBAAqB,GAAGqB,iBAAiBxB,OAAOP,IAAI,EAAE;IAC5D,MAAMiC,YAAYrD,UAAU8B;IAC5B,4EAA4E;IAC5E,MAAMwB,sBAAsB,CAAC,CAAC,EAAED,UAAU,WAAW,CAAC;IAEtD,2EAA2E;IAC3E,8EAA8E;IAC9E,IAAIxB,cAAc;QAChBH,KAAK6B,MAAM,CAACxE,kBAAkBmE,aAAa;IAC7C;IAEA,iDAAiD;IACjD,2EAA2E;IAC3E,0DAA0D;IAC1DpE,cACE4C,MACA3C,kBAAkB,YAAYyE,OAAO,EAAE,gBACvCN,aACA;QACEO,UAAUb;QACVQ,YAAYA;QACZC;QACAvB;QACA4B,WAAWlD,mCAAmCmD,IAAI;QAClDhB,KAAKf,IAAIe,GAAG;QACZF;QACA,GAAGd,MAAM;QACT,GAAG5B,QAAQ2B,KAAK;IAClB,GACA;QACEkC,mBAAmB5E,kBAAkB6E,YAAY;IACnD;IAGF3E,WACEwC,MACA,GAAGwB,YAAY,aAAa,CAAC,EAC7B,CAACY;QACCA,OAAOC,WAAW,GAAG;QACrB,0EAA0E;QAC1E,mDAAmD;QACnD7D,+BAA+B4D,QAAQ;QACvC3D,kCAAkC2D,QAAQ,SAAS;QACnDA,OAAOE,OAAO,CAACC,OAAO,CAACC,OAAO,GAAG;YAC/B;SACD;QACDJ,OAAOE,OAAO,CAACG,KAAK,GAAG;YACrBC,OAAO;YACPC,UAAU;YACVC,QAAQ;gBAAC;aAAU;YACnBJ,SAAS;gBAAC;aAA6C;YACvDK,WAAW;gBAAC;gBAAa;aAAU;YACnCC,SAASpC,WAAW;gBAClBqC,KAAK;gBACLC,SAAS;YACX;QACF;QACA,wEAAwE;QACxE,sEAAsE;QACtE,yEAAyE;QACzE,sEAAsE;QACtE,uEAAuE;QACvE,yEAAyE;QACzEZ,OAAOE,OAAO,CAACW,OAAO,GAAG;YACvBP,OAAO;YACPC,UAAU;YACVC,QAAQ;gBAAC;aAAU;YACnBJ,SAAS;gBAAC;aAA6C;YACvDK,WAAW;gBAAC;aAAQ;YACpBC,SAAS;gBACPE,SAASjE,WACP,WACA;YAEJ;QACF;QACAqD,OAAOE,OAAO,CAACY,MAAM,GAAG;YACtBP,UAAU;YACVE,WAAW;gBAAC;gBAAa;aAAU;YACnC,wEAAwE;YACxE,sEAAsE;YACtE,uEAAuE;YACvEC,SAAS/B,cACLL,WAAW;gBACTsC,SAAS,CAAC,sDAAsD,EAAExB,aAAa;YACjF,KACAd,WAAW;gBACTqC,KAAK;gBACLC,SAAS;YACX;QACN;QACAZ,OAAOE,OAAO,CAAC,iBAAiB,GAAG;YACjCK,UAAU;YACVE,WAAW;gBAAC;gBAAa;aAAU;YACnCC,SAAS/B,cACLL,WAAW;gBACTsC,SAAS,CAAC,sDAAsD,EAAExB,YAAY,CAAC,EAAEI,oBAAoB,UAAU,CAAC;YAClH,KACAlB,WAAW;gBACTqC,KAAK;gBACLC,SAAS,CAAC,oCAAoC,EAAEpB,oBAAoB,UAAU,CAAC;YACjF;QACN;QACAQ,OAAOE,OAAO,CAAC,YAAY,GAAG;YAC5BK,UAAU;YACVG,SAASpC,WAAW;gBAClBqC,KAAK;gBACLC,SAAS,CAAC,0CAA0C,EAAE1B,wBAAwB;YAChF;QACF;QACAc,OAAOE,OAAO,CAACa,OAAO,GAAG;YACvBR,UAAU;YACVE,WAAW;gBAAC;gBAAa;aAAU;YACnCC,SAAS/B,cACLL,WAAW;gBACTsC,SAAS,CAAC,uDAAuD,EAAExB,aAAa;YAClF,KACAd,WAAW;gBACTqC,KAAK;gBACLC,SAAS;YACX;QACN;QACAZ,OAAOE,OAAO,CAAC,kBAAkB,GAAG;YAClCK,UAAU;YACVE,WAAW;gBAAC;gBAAa;aAAU;YACnCC,SAAS/B,cACLL,WAAW;gBACTsC,SAAS,CAAC,uDAAuD,EAAExB,YAAY,CAAC,EAAEI,qBAAqB;YACzG,KACAlB,WAAW;gBACTqC,KAAK;gBACLC,SAAS,CAAC,YAAY,EAAEpB,qBAAqB;YAC/C;QACN;QACAQ,OAAOE,OAAO,CAAC,aAAa,GAAG;YAC7BK,UAAU;YACVG,SAASpC,WAAW;gBAClBqC,KAAK;gBACLC,SAAS,CAAC,kBAAkB,EAAE1B,wBAAwB;YACxD;QACF;QACAc,OAAOE,OAAO,CAACc,GAAG,GAAG;YACnBT,UAAU;YACVG,SAASpC,WAAW;gBAClBqC,KAAK;gBACLC,SAAS;YACX;QACF;QACAZ,OAAOE,OAAO,CAACe,SAAS,GAAG;YACzBV,UAAU;YACVG,SAASpC,WAAW;gBAClBqC,KAAK;gBACLC,SAAS;YACX;QACF;QACAZ,OAAOE,OAAO,GAAGzD,eAAeuD,OAAOE,OAAO;QAC9C,OAAOF;IACT;IAGFvE,kBAAkBmC,MAAMR,cAAc;QAAE8D,aAAa9B;IAAY;IAEjEhE,WAAWwC,MAAM,GAAGwB,YAAY,kBAAkB,CAAC,EAAE,CAAC+B,WAAc,CAAA;YAClE,GAAGA,QAAQ;YACXC,YAAY5F,kBAAkB2F,SAASC,UAAU,EAAE;gBACjD;oBACE/F,MAAM,GAAGA,KAAKgG,QAAQ,CACpBjC,aACA,GAAGxB,KAAKJ,IAAI,CAAC,CAAC,EAAEV,cAAc,EAC9B,CAAC,EAAEC,sBAAsB,kBAAkB,CAAC;gBAChD;mBACI4B,cACA;oBACE;wBACEtD,MAAM,GAAGA,KAAKgG,QAAQ,CACpBjC,aACA,GAAGxB,KAAKJ,IAAI,CAAC,CAAC,EAAEV,cAAc,EAC9B,CAAC,EAAEE,wBAAwB,cAAc,CAAC;oBAC9C;iBACD,GACD,EAAE;aACP;QACH,CAAA;IAEA,oEAAoE;IACpEjB,0BAA0B6B,MAAM;QAC9B0D,cAAclC;QACdmC,gBAAgBtG,kBAAkB6B,cAAcC;IAClD;IACA,IAAI4B,aAAa;QACf5C,0BAA0B6B,MAAM;YAC9B0D,cAAclC;YACdmC,gBAAgBtG,kBAAkB6B,cAAcE;QAClD;IACF;IAEA,MAAMhB,gCAAgC4B,MAAM;QAACH;KAAyB;IAEtE,MAAM5B,qBAAqB+B;IAC3B,OAAO,IACL9B,oBAAoB8B,MAAMC,OAAOI,yBAAyB,EAAE;YAC1DuD,WAAW;gBAAC;aAAa;QAC3B;AACJ;AACA,eAAe7D,iBAAiB"}

package/src/init/generator.d.ts

@@ -27,5 +27,5 @@ export declare const INIT_GENERATOR_INFO: NxGeneratorInfo;
  * their workspace. Every step is idempotent — re-running against an
  * already-initialised workspace is a safe no-op.
  */
-export declare const initGenerator: (tree: Tree, { iac, mcp, containers, preferInstallDependencies }: InitGeneratorSchema) => Promise<GeneratorCallback>;
+export declare const initGenerator: (tree: Tree, { iac, mcp, containers, gitSecrets, preferInstallDependencies, }: InitGeneratorSchema) => Promise<GeneratorCallback>;
 export default initGenerator;

package/src/init/generator.js

@@ -3,17 +3,16 @@
  * SPDX-License-Identifier: Apache-2.0
  */ import { declareDependencies } from "../utils/declared-dependencies.js";
 import { formatFilesInSubtree } from "../utils/format.js";
+import { GIT_SECRETS_DEPENDENCIES, setUpGitSecrets } from "../utils/git-secrets.js";
 import { applyWorkspaceInit, INIT_DEPENDENCIES } from "../utils/init.js";
 import { installDependencies } from "../utils/install.js";
 import { addGeneratorMetricsIfApplicable } from "../utils/metrics.js";
 import { getGeneratorInfo } from "../utils/nx.js";
-// `husky` comes from the preset, which is discovered as init: both mark the
-// workspace by writing aws-nx-plugin.config.mts, and only init has an id there.
+// `husky` is owned here rather than by the preset: both mark the workspace by
+// writing aws-nx-plugin.config.mts, and only init has an id there.
 export const DEPENDENCIES = declareDependencies()({
     ts: [
-        {
-            name: 'husky'
-        },
+        ...GIT_SECRETS_DEPENDENCIES,
         ...INIT_DEPENDENCIES
     ]
 });
@@ -25,12 +24,15 @@ export const INIT_GENERATOR_INFO = getGeneratorInfo(import.meta.filename);
  * with an established Nx workspace can adopt the plugin without recreating
  * their workspace. Every step is idempotent — re-running against an
  * already-initialised workspace is a safe no-op.
- */ export const initGenerator = async (tree, { iac, mcp, containers, preferInstallDependencies })=>{
+ */ export const initGenerator = async (tree, { iac, mcp, containers, gitSecrets, preferInstallDependencies })=>{
     await applyWorkspaceInit(tree, {
         iac,
         containers,
         mcp
     }, DEPENDENCIES);
+    if (gitSecrets !== false) {
+        setUpGitSecrets(tree, DEPENDENCIES);
+    }
     await addGeneratorMetricsIfApplicable(tree, [
         INIT_GENERATOR_INFO
     ]);

package/src/init/generator.js.map

@@ -1 +1 @@
-{"version":3,"sources":["../../../../../packages/nx-plugin/src/init/generator.ts"],"sourcesContent":["/**\n * Copyright Amazon.com, Inc. or its affiliates. All Rights Reserved.\n * SPDX-License-Identifier: Apache-2.0\n */\nimport type { GeneratorCallback, Tree } from '@nx/devkit';\nimport { declareDependencies } from '../utils/declared-dependencies.js';\nimport { formatFilesInSubtree } from '../utils/format.js';\nimport { applyWorkspaceInit, INIT_DEPENDENCIES } from '../utils/init.js';\nimport { installDependencies } from '../utils/install.js';\nimport { addGeneratorMetricsIfApplicable } from '../utils/metrics.js';\nimport { getGeneratorInfo, type NxGeneratorInfo } from '../utils/nx.js';\nimport type { InitGeneratorSchema } from './schema';\n\n// `husky` comes from the preset, which is discovered as init: both mark the\n// workspace by writing aws-nx-plugin.config.mts, and only init has an id there.\nexport const DEPENDENCIES = declareDependencies()({\n  ts: [{ name: 'husky' }, ...INIT_DEPENDENCIES],\n});\n\nexport const INIT_GENERATOR_INFO: NxGeneratorInfo = getGeneratorInfo(\n  import.meta.filename,\n);\n\n/**\n * Configure an existing Nx workspace to use the @aws/nx-plugin.\n *\n * Runs the same deterministic setup the workspace preset performs, so teams\n * with an established Nx workspace can adopt the plugin without recreating\n * their workspace. Every step is idempotent — re-running against an\n * already-initialised workspace is a safe no-op.\n */\nexport const initGenerator = async (\n  tree: Tree,\n  { iac, mcp, containers, preferInstallDependencies }: InitGeneratorSchema,\n): Promise<GeneratorCallback> => {\n  await applyWorkspaceInit(tree, { iac, containers, mcp }, DEPENDENCIES);\n\n  await addGeneratorMetricsIfApplicable(tree, [INIT_GENERATOR_INFO]);\n\n  await formatFilesInSubtree(tree);\n  return () =>\n    installDependencies(tree, preferInstallDependencies, {\n      languages: ['typescript'],\n    });\n};\n\nexport default initGenerator;\n"],"names":["declareDependencies","formatFilesInSubtree","applyWorkspaceInit","INIT_DEPENDENCIES","installDependencies","addGeneratorMetricsIfApplicable","getGeneratorInfo","DEPENDENCIES","ts","name","INIT_GENERATOR_INFO","filename","initGenerator","tree","iac","mcp","containers","preferInstallDependencies","languages"],"mappings":"AAAA;;;CAGC,GAED,SAASA,mBAAmB,QAAQ,oCAAoC;AACxE,SAASC,oBAAoB,QAAQ,qBAAqB;AAC1D,SAASC,kBAAkB,EAAEC,iBAAiB,QAAQ,mBAAmB;AACzE,SAASC,mBAAmB,QAAQ,sBAAsB;AAC1D,SAASC,+BAA+B,QAAQ,sBAAsB;AACtE,SAASC,gBAAgB,QAA8B,iBAAiB;AAGxE,4EAA4E;AAC5E,gFAAgF;AAChF,OAAO,MAAMC,eAAeP,sBAAsB;IAChDQ,IAAI;QAAC;YAAEC,MAAM;QAAQ;WAAMN;KAAkB;AAC/C,GAAG;AAEH,OAAO,MAAMO,sBAAuCJ,iBAClD,YAAYK,QAAQ,EACpB;AAEF;;;;;;;CAOC,GACD,OAAO,MAAMC,gBAAgB,OAC3BC,MACA,EAAEC,GAAG,EAAEC,GAAG,EAAEC,UAAU,EAAEC,yBAAyB,EAAuB;IAExE,MAAMf,mBAAmBW,MAAM;QAAEC;QAAKE;QAAYD;IAAI,GAAGR;IAEzD,MAAMF,gCAAgCQ,MAAM;QAACH;KAAoB;IAEjE,MAAMT,qBAAqBY;IAC3B,OAAO,IACLT,oBAAoBS,MAAMI,2BAA2B;YACnDC,WAAW;gBAAC;aAAa;QAC3B;AACJ,EAAE;AAEF,eAAeN,cAAc"}
+{"version":3,"sources":["../../../../../packages/nx-plugin/src/init/generator.ts"],"sourcesContent":["/**\n * Copyright Amazon.com, Inc. or its affiliates. All Rights Reserved.\n * SPDX-License-Identifier: Apache-2.0\n */\nimport type { GeneratorCallback, Tree } from '@nx/devkit';\nimport { declareDependencies } from '../utils/declared-dependencies.js';\nimport { formatFilesInSubtree } from '../utils/format.js';\nimport {\n  GIT_SECRETS_DEPENDENCIES,\n  setUpGitSecrets,\n} from '../utils/git-secrets.js';\nimport { applyWorkspaceInit, INIT_DEPENDENCIES } from '../utils/init.js';\nimport { installDependencies } from '../utils/install.js';\nimport { addGeneratorMetricsIfApplicable } from '../utils/metrics.js';\nimport { getGeneratorInfo, type NxGeneratorInfo } from '../utils/nx.js';\nimport type { InitGeneratorSchema } from './schema';\n\n// `husky` is owned here rather than by the preset: both mark the workspace by\n// writing aws-nx-plugin.config.mts, and only init has an id there.\nexport const DEPENDENCIES = declareDependencies()({\n  ts: [...GIT_SECRETS_DEPENDENCIES, ...INIT_DEPENDENCIES],\n});\n\nexport const INIT_GENERATOR_INFO: NxGeneratorInfo = getGeneratorInfo(\n  import.meta.filename,\n);\n\n/**\n * Configure an existing Nx workspace to use the @aws/nx-plugin.\n *\n * Runs the same deterministic setup the workspace preset performs, so teams\n * with an established Nx workspace can adopt the plugin without recreating\n * their workspace. Every step is idempotent — re-running against an\n * already-initialised workspace is a safe no-op.\n */\nexport const initGenerator = async (\n  tree: Tree,\n  {\n    iac,\n    mcp,\n    containers,\n    gitSecrets,\n    preferInstallDependencies,\n  }: InitGeneratorSchema,\n): Promise<GeneratorCallback> => {\n  await applyWorkspaceInit(tree, { iac, containers, mcp }, DEPENDENCIES);\n\n  if (gitSecrets !== false) {\n    setUpGitSecrets(tree, DEPENDENCIES);\n  }\n\n  await addGeneratorMetricsIfApplicable(tree, [INIT_GENERATOR_INFO]);\n\n  await formatFilesInSubtree(tree);\n  return () =>\n    installDependencies(tree, preferInstallDependencies, {\n      languages: ['typescript'],\n    });\n};\n\nexport default initGenerator;\n"],"names":["declareDependencies","formatFilesInSubtree","GIT_SECRETS_DEPENDENCIES","setUpGitSecrets","applyWorkspaceInit","INIT_DEPENDENCIES","installDependencies","addGeneratorMetricsIfApplicable","getGeneratorInfo","DEPENDENCIES","ts","INIT_GENERATOR_INFO","filename","initGenerator","tree","iac","mcp","containers","gitSecrets","preferInstallDependencies","languages"],"mappings":"AAAA;;;CAGC,GAED,SAASA,mBAAmB,QAAQ,oCAAoC;AACxE,SAASC,oBAAoB,QAAQ,qBAAqB;AAC1D,SACEC,wBAAwB,EACxBC,eAAe,QACV,0BAA0B;AACjC,SAASC,kBAAkB,EAAEC,iBAAiB,QAAQ,mBAAmB;AACzE,SAASC,mBAAmB,QAAQ,sBAAsB;AAC1D,SAASC,+BAA+B,QAAQ,sBAAsB;AACtE,SAASC,gBAAgB,QAA8B,iBAAiB;AAGxE,8EAA8E;AAC9E,mEAAmE;AACnE,OAAO,MAAMC,eAAeT,sBAAsB;IAChDU,IAAI;WAAIR;WAA6BG;KAAkB;AACzD,GAAG;AAEH,OAAO,MAAMM,sBAAuCH,iBAClD,YAAYI,QAAQ,EACpB;AAEF;;;;;;;CAOC,GACD,OAAO,MAAMC,gBAAgB,OAC3BC,MACA,EACEC,GAAG,EACHC,GAAG,EACHC,UAAU,EACVC,UAAU,EACVC,yBAAyB,EACL;IAEtB,MAAMf,mBAAmBU,MAAM;QAAEC;QAAKE;QAAYD;IAAI,GAAGP;IAEzD,IAAIS,eAAe,OAAO;QACxBf,gBAAgBW,MAAML;IACxB;IAEA,MAAMF,gCAAgCO,MAAM;QAACH;KAAoB;IAEjE,MAAMV,qBAAqBa;IAC3B,OAAO,IACLR,oBAAoBQ,MAAMK,2BAA2B;YACnDC,WAAW;gBAAC;aAAa;QAC3B;AACJ,EAAE;AAEF,eAAeP,cAAc"}

package/src/init/schema.d.js.map

@@ -1 +1 @@
-{"version":3,"sources":["../../../../../packages/nx-plugin/src/init/schema.d.ts"],"sourcesContent":["/**\n * Copyright Amazon.com, Inc. or its affiliates. All Rights Reserved.\n * SPDX-License-Identifier: Apache-2.0\n */\n\nimport { Containers } from '../utils/containers.js';\nimport { Iac } from '../utils/iac.js';\n\nexport type InitContainersOption = Containers | 'infer';\n\nexport interface InitGeneratorSchema {\n  readonly iac: Iac;\n  readonly mcp?: boolean;\n  readonly containers?: InitContainersOption;\n  readonly preferInstallDependencies?: boolean;\n}\n"],"names":[],"mappings":"AAAA;;;CAGC,GAOD,WAKC"}
+{"version":3,"sources":["../../../../../packages/nx-plugin/src/init/schema.d.ts"],"sourcesContent":["/**\n * Copyright Amazon.com, Inc. or its affiliates. All Rights Reserved.\n * SPDX-License-Identifier: Apache-2.0\n */\n\nimport { Containers } from '../utils/containers.js';\nimport { Iac } from '../utils/iac.js';\n\nexport type InitContainersOption = Containers | 'infer';\n\nexport interface InitGeneratorSchema {\n  readonly iac: Iac;\n  readonly mcp?: boolean;\n  readonly containers?: InitContainersOption;\n  readonly gitSecrets?: boolean;\n  readonly preferInstallDependencies?: boolean;\n}\n"],"names":[],"mappings":"AAAA;;;CAGC,GAOD,WAMC"}

package/src/init/schema.d.ts

@@ -12,5 +12,6 @@ export interface InitGeneratorSchema {
   readonly iac: Iac;
   readonly mcp?: boolean;
   readonly containers?: InitContainersOption;
+  readonly gitSecrets?: boolean;
   readonly preferInstallDependencies?: boolean;
 }

package/src/init/schema.json

@@ -13,6 +13,11 @@
       "x-priority": "important",
       "x-prompt": "Which provider would you like to manage your infrastructure?"
     },
+    "gitSecrets": {
+      "type": "boolean",
+      "description": "Whether to configure git-secrets to prevent committing AWS credentials.",
+      "default": true
+    },
     "mcp": {
       "type": "boolean",
       "description": "Whether to configure the Nx Plugin for AWS MCP server for use by coding agents.",

package/src/mcp-server/server.js

@@ -7,6 +7,7 @@ import PackageJson from "../../package.json" with {
 };
 import { listGenerators } from "../utils/nx.js";
 import { addToExistingProjectTool } from "./tools/add-to-existing-project.js";
+import { addBestPracticesTool } from "./tools/best-practices.js";
 import { addCreateWorkspaceCommandTool } from "./tools/create-workspace-command.js";
 import { addGeneralGuidanceTool, TOOL_SELECTION_GUIDE } from "./tools/general-guidance.js";
 import { addGeneratorGuideTool } from "./tools/generator-guide.js";
@@ -31,6 +32,7 @@ ${TOOL_SELECTION_GUIDE}
 `
     });
     addGeneralGuidanceTool(server, generators);
+    addBestPracticesTool(server, generators);
     addCreateWorkspaceCommandTool(server);
     addListGeneratorsTool(server, generators);
     addGeneratorGuideTool(server, generators);

package/src/mcp-server/server.js.map

@@ -1 +1 @@
-{"version":3,"sources":["../../../../../packages/nx-plugin/src/mcp-server/server.ts"],"sourcesContent":["/**\n * Copyright Amazon.com, Inc. or its affiliates. All Rights Reserved.\n * SPDX-License-Identifier: Apache-2.0\n */\nimport { McpServer } from '@modelcontextprotocol/sdk/server/mcp.js';\nimport PackageJson from '../../package.json' with { type: 'json' };\nimport { listGenerators } from '../utils/nx.js';\nimport { addToExistingProjectTool } from './tools/add-to-existing-project.js';\nimport { addCreateWorkspaceCommandTool } from './tools/create-workspace-command.js';\nimport {\n  addGeneralGuidanceTool,\n  TOOL_SELECTION_GUIDE,\n} from './tools/general-guidance.js';\nimport { addGeneratorGuideTool } from './tools/generator-guide.js';\nimport { addListGeneratorsTool } from './tools/list-generators.js';\nimport { addUpgradeWorkspaceTool } from './tools/upgrade-workspace.js';\n\n/**\n * Create the MCP Server\n */\nexport const createServer = () => {\n  const generators = listGenerators();\n\n  const server = new McpServer(\n    {\n      name: 'nx-plugin-for-aws',\n      version: PackageJson.version,\n    },\n    {\n      instructions: `# Nx Plugin for AWS MCP Server\n\nThis server provides resources and tools for quickly scaffolding AWS projects within an Nx workspace (monorepo), using the Nx Plugin for AWS (@aws/nx-plugin).\n\nThe Nx Plugin for AWS provides \"generators\" to add projects or functionality to your workspace. Use this to build the foundations of any project you are building\non AWS, if the generators apply to your use case.\n\n${TOOL_SELECTION_GUIDE}\n`,\n    },\n  );\n\n  addGeneralGuidanceTool(server, generators);\n  addCreateWorkspaceCommandTool(server);\n  addListGeneratorsTool(server, generators);\n  addGeneratorGuideTool(server, generators);\n  addToExistingProjectTool(server, generators);\n  addUpgradeWorkspaceTool(server, generators);\n\n  return server;\n};\n"],"names":["McpServer","PackageJson","type","listGenerators","addToExistingProjectTool","addCreateWorkspaceCommandTool","addGeneralGuidanceTool","TOOL_SELECTION_GUIDE","addGeneratorGuideTool","addListGeneratorsTool","addUpgradeWorkspaceTool","createServer","generators","server","name","version","instructions"],"mappings":"AAAA;;;CAGC,GACD,SAASA,SAAS,QAAQ,0CAA0C;AACpE,OAAOC,iBAAiB,0BAA0B;IAAEC,MAAM;AAAO,EAAE;AACnE,SAASC,cAAc,QAAQ,iBAAiB;AAChD,SAASC,wBAAwB,QAAQ,qCAAqC;AAC9E,SAASC,6BAA6B,QAAQ,sCAAsC;AACpF,SACEC,sBAAsB,EACtBC,oBAAoB,QACf,8BAA8B;AACrC,SAASC,qBAAqB,QAAQ,6BAA6B;AACnE,SAASC,qBAAqB,QAAQ,6BAA6B;AACnE,SAASC,uBAAuB,QAAQ,+BAA+B;AAEvE;;CAEC,GACD,OAAO,MAAMC,eAAe;IAC1B,MAAMC,aAAaT;IAEnB,MAAMU,SAAS,IAAIb,UACjB;QACEc,MAAM;QACNC,SAASd,YAAYc,OAAO;IAC9B,GACA;QACEC,cAAc,CAAC;;;;;;;AAOrB,EAAET,qBAAqB;AACvB,CAAC;IACG;IAGFD,uBAAuBO,QAAQD;IAC/BP,8BAA8BQ;IAC9BJ,sBAAsBI,QAAQD;IAC9BJ,sBAAsBK,QAAQD;IAC9BR,yBAAyBS,QAAQD;IACjCF,wBAAwBG,QAAQD;IAEhC,OAAOC;AACT,EAAE"}
+{"version":3,"sources":["../../../../../packages/nx-plugin/src/mcp-server/server.ts"],"sourcesContent":["/**\n * Copyright Amazon.com, Inc. or its affiliates. All Rights Reserved.\n * SPDX-License-Identifier: Apache-2.0\n */\nimport { McpServer } from '@modelcontextprotocol/sdk/server/mcp.js';\nimport PackageJson from '../../package.json' with { type: 'json' };\nimport { listGenerators } from '../utils/nx.js';\nimport { addToExistingProjectTool } from './tools/add-to-existing-project.js';\nimport { addBestPracticesTool } from './tools/best-practices.js';\nimport { addCreateWorkspaceCommandTool } from './tools/create-workspace-command.js';\nimport {\n  addGeneralGuidanceTool,\n  TOOL_SELECTION_GUIDE,\n} from './tools/general-guidance.js';\nimport { addGeneratorGuideTool } from './tools/generator-guide.js';\nimport { addListGeneratorsTool } from './tools/list-generators.js';\nimport { addUpgradeWorkspaceTool } from './tools/upgrade-workspace.js';\n\n/**\n * Create the MCP Server\n */\nexport const createServer = () => {\n  const generators = listGenerators();\n\n  const server = new McpServer(\n    {\n      name: 'nx-plugin-for-aws',\n      version: PackageJson.version,\n    },\n    {\n      instructions: `# Nx Plugin for AWS MCP Server\n\nThis server provides resources and tools for quickly scaffolding AWS projects within an Nx workspace (monorepo), using the Nx Plugin for AWS (@aws/nx-plugin).\n\nThe Nx Plugin for AWS provides \"generators\" to add projects or functionality to your workspace. Use this to build the foundations of any project you are building\non AWS, if the generators apply to your use case.\n\n${TOOL_SELECTION_GUIDE}\n`,\n    },\n  );\n\n  addGeneralGuidanceTool(server, generators);\n  addBestPracticesTool(server, generators);\n  addCreateWorkspaceCommandTool(server);\n  addListGeneratorsTool(server, generators);\n  addGeneratorGuideTool(server, generators);\n  addToExistingProjectTool(server, generators);\n  addUpgradeWorkspaceTool(server, generators);\n\n  return server;\n};\n"],"names":["McpServer","PackageJson","type","listGenerators","addToExistingProjectTool","addBestPracticesTool","addCreateWorkspaceCommandTool","addGeneralGuidanceTool","TOOL_SELECTION_GUIDE","addGeneratorGuideTool","addListGeneratorsTool","addUpgradeWorkspaceTool","createServer","generators","server","name","version","instructions"],"mappings":"AAAA;;;CAGC,GACD,SAASA,SAAS,QAAQ,0CAA0C;AACpE,OAAOC,iBAAiB,0BAA0B;IAAEC,MAAM;AAAO,EAAE;AACnE,SAASC,cAAc,QAAQ,iBAAiB;AAChD,SAASC,wBAAwB,QAAQ,qCAAqC;AAC9E,SAASC,oBAAoB,QAAQ,4BAA4B;AACjE,SAASC,6BAA6B,QAAQ,sCAAsC;AACpF,SACEC,sBAAsB,EACtBC,oBAAoB,QACf,8BAA8B;AACrC,SAASC,qBAAqB,QAAQ,6BAA6B;AACnE,SAASC,qBAAqB,QAAQ,6BAA6B;AACnE,SAASC,uBAAuB,QAAQ,+BAA+B;AAEvE;;CAEC,GACD,OAAO,MAAMC,eAAe;IAC1B,MAAMC,aAAaV;IAEnB,MAAMW,SAAS,IAAId,UACjB;QACEe,MAAM;QACNC,SAASf,YAAYe,OAAO;IAC9B,GACA;QACEC,cAAc,CAAC;;;;;;;AAOrB,EAAET,qBAAqB;AACvB,CAAC;IACG;IAGFD,uBAAuBO,QAAQD;IAC/BR,qBAAqBS,QAAQD;IAC7BP,8BAA8BQ;IAC9BJ,sBAAsBI,QAAQD;IAC9BJ,sBAAsBK,QAAQD;IAC9BT,yBAAyBU,QAAQD;IACjCF,wBAAwBG,QAAQD;IAEhC,OAAOC;AACT,EAAE"}

package/src/mcp-server/tools/best-practices.d.ts

@@ -0,0 +1,28 @@
+/**
+ * Copyright Amazon.com, Inc. or its affiliates. All Rights Reserved.
+ * SPDX-License-Identifier: Apache-2.0
+ */
+import type { McpServer } from '@modelcontextprotocol/sdk/server/mcp.js';
+import type { NxGeneratorInfo } from '../../utils/generators.js';
+/**
+ * Guide pages documenting behaviour that spans generators, so no single
+ * generator owns them and `generator-guide` never returns them. Each is
+ * described for the agent so it can pick the ones relevant to its task.
+ */
+export declare const BEST_PRACTICE_PAGES: {
+    readonly workspace: "Workspace layout, configuration and common commands";
+    readonly 'typescript-project': "Conventions for TypeScript projects";
+    readonly 'python-project': "Conventions for Python projects";
+    readonly security: "Security controls vended infrastructure carries, and the shared responsibility model";
+    readonly 'runtime-config': "How generated projects discover one another through AWS AppConfig";
+    readonly 'docker-bundling': "Building and deploying container images";
+    readonly 'local-development': "Running projects locally with the serve and dev targets";
+};
+export type BestPracticePage = keyof typeof BEST_PRACTICE_PAGES;
+export declare const BEST_PRACTICE_PAGE_NAMES: BestPracticePage[];
+/**
+ * Add a tool which serves the cross-cutting guide pages. Kept separate from
+ * `general-guidance` so an agent fetches only the pages its task needs rather
+ * than every page on every call.
+ */
+export declare const addBestPracticesTool: (server: McpServer, generators: NxGeneratorInfo[]) => void;

package/src/mcp-server/tools/best-practices.js

@@ -0,0 +1,43 @@
+/**
+ * Copyright Amazon.com, Inc. or its affiliates. All Rights Reserved.
+ * SPDX-License-Identifier: Apache-2.0
+ */ import { z } from "zod";
+import { fetchGuidePages } from "../generator-info.js";
+import { PackageManagerSchema } from "../schema.js";
+/**
+ * Guide pages documenting behaviour that spans generators, so no single
+ * generator owns them and `generator-guide` never returns them. Each is
+ * described for the agent so it can pick the ones relevant to its task.
+ */ export const BEST_PRACTICE_PAGES = {
+    workspace: 'Workspace layout, configuration and common commands',
+    'typescript-project': 'Conventions for TypeScript projects',
+    'python-project': 'Conventions for Python projects',
+    security: 'Security controls vended infrastructure carries, and the shared responsibility model',
+    'runtime-config': 'How generated projects discover one another through AWS AppConfig',
+    'docker-bundling': 'Building and deploying container images',
+    'local-development': 'Running projects locally with the serve and dev targets'
+};
+export const BEST_PRACTICE_PAGE_NAMES = Object.keys(BEST_PRACTICE_PAGES);
+/**
+ * Add a tool which serves the cross-cutting guide pages. Kept separate from
+ * `general-guidance` so an agent fetches only the pages its task needs rather
+ * than every page on every call.
+ */ export const addBestPracticesTool = (server, generators)=>{
+    server.registerTool('best-practices', {
+        title: 'Best Practices',
+        description: 'Tool to retrieve guidance which spans generators, rather than applying to one in particular. ' + 'Request the pages relevant to your task:\n' + Object.entries(BEST_PRACTICE_PAGES).map(([page, description])=>`- \`${page}\`: ${description}`).join('\n'),
+        inputSchema: {
+            packageManager: PackageManagerSchema.optional(),
+            pages: z.array(z.enum(BEST_PRACTICE_PAGE_NAMES)).min(1).describe('The guide pages to retrieve.')
+        }
+    }, async ({ packageManager, pages })=>({
+            content: [
+                {
+                    type: 'text',
+                    text: await fetchGuidePages(pages, generators, packageManager)
+                }
+            ]
+        }));
+};
+
+//# sourceMappingURL=best-practices.js.map

package/src/mcp-server/tools/best-practices.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../../../../../../packages/nx-plugin/src/mcp-server/tools/best-practices.ts"],"sourcesContent":["/**\n * Copyright Amazon.com, Inc. or its affiliates. All Rights Reserved.\n * SPDX-License-Identifier: Apache-2.0\n */\nimport type { McpServer } from '@modelcontextprotocol/sdk/server/mcp.js';\nimport { z } from 'zod';\nimport type { NxGeneratorInfo } from '../../utils/generators.js';\nimport { fetchGuidePages } from '../generator-info.js';\nimport { PackageManagerSchema } from '../schema.js';\n\n/**\n * Guide pages documenting behaviour that spans generators, so no single\n * generator owns them and `generator-guide` never returns them. Each is\n * described for the agent so it can pick the ones relevant to its task.\n */\nexport const BEST_PRACTICE_PAGES = {\n  workspace: 'Workspace layout, configuration and common commands',\n  'typescript-project': 'Conventions for TypeScript projects',\n  'python-project': 'Conventions for Python projects',\n  security:\n    'Security controls vended infrastructure carries, and the shared responsibility model',\n  'runtime-config':\n    'How generated projects discover one another through AWS AppConfig',\n  'docker-bundling': 'Building and deploying container images',\n  'local-development':\n    'Running projects locally with the serve and dev targets',\n} as const satisfies Record<string, string>;\n\nexport type BestPracticePage = keyof typeof BEST_PRACTICE_PAGES;\n\nexport const BEST_PRACTICE_PAGE_NAMES = Object.keys(\n  BEST_PRACTICE_PAGES,\n) as BestPracticePage[];\n\n/**\n * Add a tool which serves the cross-cutting guide pages. Kept separate from\n * `general-guidance` so an agent fetches only the pages its task needs rather\n * than every page on every call.\n */\nexport const addBestPracticesTool = (\n  server: McpServer,\n  generators: NxGeneratorInfo[],\n) => {\n  server.registerTool(\n    'best-practices',\n    {\n      title: 'Best Practices',\n      description:\n        'Tool to retrieve guidance which spans generators, rather than applying to one in particular. ' +\n        'Request the pages relevant to your task:\\n' +\n        Object.entries(BEST_PRACTICE_PAGES)\n          .map(([page, description]) => `- \\`${page}\\`: ${description}`)\n          .join('\\n'),\n      inputSchema: {\n        packageManager: PackageManagerSchema.optional(),\n        pages: z\n          .array(z.enum(BEST_PRACTICE_PAGE_NAMES))\n          .min(1)\n          .describe('The guide pages to retrieve.'),\n      },\n    },\n    async ({ packageManager, pages }) => ({\n      content: [\n        {\n          type: 'text' as const,\n          text: await fetchGuidePages(pages, generators, packageManager),\n        },\n      ],\n    }),\n  );\n};\n"],"names":["z","fetchGuidePages","PackageManagerSchema","BEST_PRACTICE_PAGES","workspace","security","BEST_PRACTICE_PAGE_NAMES","Object","keys","addBestPracticesTool","server","generators","registerTool","title","description","entries","map","page","join","inputSchema","packageManager","optional","pages","array","enum","min","describe","content","type","text"],"mappings":"AAAA;;;CAGC,GAED,SAASA,CAAC,QAAQ,MAAM;AAExB,SAASC,eAAe,QAAQ,uBAAuB;AACvD,SAASC,oBAAoB,QAAQ,eAAe;AAEpD;;;;CAIC,GACD,OAAO,MAAMC,sBAAsB;IACjCC,WAAW;IACX,sBAAsB;IACtB,kBAAkB;IAClBC,UACE;IACF,kBACE;IACF,mBAAmB;IACnB,qBACE;AACJ,EAA4C;AAI5C,OAAO,MAAMC,2BAA2BC,OAAOC,IAAI,CACjDL,qBACsB;AAExB;;;;CAIC,GACD,OAAO,MAAMM,uBAAuB,CAClCC,QACAC;IAEAD,OAAOE,YAAY,CACjB,kBACA;QACEC,OAAO;QACPC,aACE,kGACA,+CACAP,OAAOQ,OAAO,CAACZ,qBACZa,GAAG,CAAC,CAAC,CAACC,MAAMH,YAAY,GAAK,CAAC,IAAI,EAAEG,KAAK,IAAI,EAAEH,aAAa,EAC5DI,IAAI,CAAC;QACVC,aAAa;YACXC,gBAAgBlB,qBAAqBmB,QAAQ;YAC7CC,OAAOtB,EACJuB,KAAK,CAACvB,EAAEwB,IAAI,CAAClB,2BACbmB,GAAG,CAAC,GACJC,QAAQ,CAAC;QACd;IACF,GACA,OAAO,EAAEN,cAAc,EAAEE,KAAK,EAAE,GAAM,CAAA;YACpCK,SAAS;gBACP;oBACEC,MAAM;oBACNC,MAAM,MAAM5B,gBAAgBqB,OAAOX,YAAYS;gBACjD;aACD;QACH,CAAA;AAEJ,EAAE"}

package/src/mcp-server/tools/general-guidance.d.ts

@@ -4,7 +4,7 @@
  */
 import type { McpServer } from '@modelcontextprotocol/sdk/server/mcp.js';
 import type { NxGeneratorInfo } from '../../utils/generators.js';
-export declare const TOOL_SELECTION_GUIDE = "## Tool Selection Guide\n\n- Use the `general-guidance` tool for guidance and best practices for working with Nx and the Nx Plugin for AWS.\n- Use the `create-workspace-command` tool to discover how to create a workspace to start a new project.\n- Use the `add-to-existing-project` tool when adding the plugin to an existing Nx workspace or non-Nx monorepo, or when troubleshooting configuration errors in such a workspace.\n- Use the `upgrade-workspace` tool when upgrading Nx or the Nx Plugin for AWS to a newer version.\n- Use the `list-generators` tool to discover the available generators and how to run them.\n- Use the `generator-guide` tool to retrieve detailed information about a specific generator.";
+export declare const TOOL_SELECTION_GUIDE = "## Tool Selection Guide\n\n- Use the `general-guidance` tool for guidance and best practices for working with Nx and the Nx Plugin for AWS.\n- Use the `best-practices` tool for guidance which spans generators rather than applying to one in particular, such as workspace layout, security, runtime configuration, container builds and local development.\n- Use the `create-workspace-command` tool to discover how to create a workspace to start a new project.\n- Use the `add-to-existing-project` tool when adding the plugin to an existing Nx workspace or non-Nx monorepo, or when troubleshooting configuration errors in such a workspace.\n- Use the `upgrade-workspace` tool when upgrading Nx or the Nx Plugin for AWS to a newer version.\n- Use the `list-generators` tool to discover the available generators and how to run them.\n- Use the `generator-guide` tool to retrieve detailed information about a specific generator.";
 /**
  * Add a tool which provides general guidance for using Nx and the Nx Plugin for AWS
  */

package/src/mcp-server/tools/general-guidance.js

@@ -4,9 +4,20 @@
  */ import { IAC_PROVIDERS } from "../../utils/iac-providers.js";
 import { buildNxCommand, fetchGuidePages } from "../generator-info.js";
 import { PACKAGE_MANAGERS } from "../schema.js";
+import { BEST_PRACTICE_PAGE_NAMES } from "./best-practices.js";
+/**
+ * The cross-cutting pages every agent needs regardless of task, inlined here
+ * so a workspace's conventions land without a second tool call. The rest are
+ * served on demand by `best-practices`.
+ */ const GENERAL_GUIDANCE_PAGES = [
+    'workspace',
+    'typescript-project',
+    'python-project'
+];
 export const TOOL_SELECTION_GUIDE = `## Tool Selection Guide
 
 - Use the \`general-guidance\` tool for guidance and best practices for working with Nx and the Nx Plugin for AWS.
+- Use the \`best-practices\` tool for guidance which spans generators rather than applying to one in particular, such as workspace layout, security, runtime configuration, container builds and local development.
 - Use the \`create-workspace-command\` tool to discover how to create a workspace to start a new project.
 - Use the \`add-to-existing-project\` tool when adding the plugin to an existing Nx workspace or non-Nx monorepo, or when troubleshooting configuration errors in such a workspace.
 - Use the \`upgrade-workspace\` tool when upgrading Nx or the Nx Plugin for AWS to a newer version.
@@ -86,12 +97,10 @@ ${PACKAGE_MANAGERS.map((pm)=>`  \`\`\`bash
 
 ## Detailed Guides
 
-Please refer to the below documentation for important details regarding workspaces and working with TypeScript or Python projects.
+Please refer to the below documentation for important details regarding workspaces and working with TypeScript or Python projects. Use the \`best-practices\` tool for the remaining cross-cutting guides (${BEST_PRACTICE_PAGE_NAMES.filter((p)=>!GENERAL_GUIDANCE_PAGES.includes(p)).map((p)=>`\`${p}\``).join(', ')}).
 
 ${await fetchGuidePages([
-                        'workspace',
-                        'typescript-project',
-                        'python-project'
+                        ...GENERAL_GUIDANCE_PAGES
                     ], generators)}
 
     `

package/src/mcp-server/tools/general-guidance.js.map

@@ -1 +1 @@
-{"version":3,"sources":["../../../../../../packages/nx-plugin/src/mcp-server/tools/general-guidance.ts"],"sourcesContent":["/**\n * Copyright Amazon.com, Inc. or its affiliates. All Rights Reserved.\n * SPDX-License-Identifier: Apache-2.0\n */\nimport type { McpServer } from '@modelcontextprotocol/sdk/server/mcp.js';\nimport type { NxGeneratorInfo } from '../../utils/generators.js';\nimport { IAC_PROVIDERS } from '../../utils/iac-providers.js';\nimport { buildNxCommand, fetchGuidePages } from '../generator-info.js';\nimport { PACKAGE_MANAGERS } from '../schema.js';\n\nexport const TOOL_SELECTION_GUIDE = `## Tool Selection Guide\n\n- Use the \\`general-guidance\\` tool for guidance and best practices for working with Nx and the Nx Plugin for AWS.\n- Use the \\`create-workspace-command\\` tool to discover how to create a workspace to start a new project.\n- Use the \\`add-to-existing-project\\` tool when adding the plugin to an existing Nx workspace or non-Nx monorepo, or when troubleshooting configuration errors in such a workspace.\n- Use the \\`upgrade-workspace\\` tool when upgrading Nx or the Nx Plugin for AWS to a newer version.\n- Use the \\`list-generators\\` tool to discover the available generators and how to run them.\n- Use the \\`generator-guide\\` tool to retrieve detailed information about a specific generator.`;\n\n/**\n * Add a tool which provides general guidance for using Nx and the Nx Plugin for AWS\n */\nexport const addGeneralGuidanceTool = (\n  server: McpServer,\n  generators: NxGeneratorInfo[],\n) => {\n  server.registerTool(\n    'general-guidance',\n    {\n      title: 'General Guidance',\n      description:\n        'Tool for guidance and best practices for working with Nx and the Nx Plugin for AWS',\n    },\n    async () => ({\n      content: [\n        {\n          type: 'text' as const,\n          text: `# Nx Plugin for AWS Guidance\n\n${TOOL_SELECTION_GUIDE}\n\n## Getting Started\n\n- Choose a package manager first. You can choose between ${PACKAGE_MANAGERS.join(', ')}. It's recommended to use \"pnpm\" if the user has no preference\n- Choose an infrastructure as code (IaC) provider next. You can choose between ${IAC_PROVIDERS.join(', ')}. It's recommended to use CDK if the user has no preference\n- Next, you must create an Nx workspace. Use the \\`create-workspace-command\\` tool for more details, and provide it with your chosen package manager\n- After this, you can start scaffolding the main components of your application using generators. Use the \\`list-generators\\` tool to discover available generators, and the \\`generator-guide\\` tool for more detailed information about a specific generator\n\n## Nx Primer\n\n- Prefix nx commands with the appropriate prefix for your package manager, for example:\n${PACKAGE_MANAGERS.map((pm) => buildNxCommand('<options>', pm)).join(' - \\n')}\n- Each project in your workspace has a file named \\`project.json\\` which contains important project information such as its name, and defines the \"targets\" which can be run for that project, for example building or testing the project\n- Use the command \\`nx reset\\` to reset the Nx daemon when unexpected issues arise\n- After adding dependencies between TypeScript projects, use \\`nx sync\\` to ensure project references are set up correctly\n\n## General Instructions\n\n- Each project declares the third-party runtime dependencies its source imports in its own \\`package.json\\`; shared build/test tooling (test runners, bundlers, etc.) is declared in the root \\`package.json\\` \\`devDependencies\\`. Versions follow a single version policy, recorded in the package manager's dependency catalog where supported (referenced as \\`catalog:\\`). Install with the appropriate command for your package manager:\n  - Add a project runtime dependency: \\`pnpm add <package> --filter <project>\\` / \\`yarn workspace <project> add <package>\\` / \\`npm install <package> -w <project>\\` / \\`bun add <package> --cwd <project-directory>\\`\n  - Add a shared dev tool at the root: \\`pnpm add -Dw <package>\\` / \\`yarn add -D <package>\\` / \\`npm install --legacy-peer-deps -D <package>\\` / \\`bun install -D <package>\\`\n- The \\`noUndeclaredDependencies\\` lint rule enforces that a project's source only imports packages declared in its own \\`package.json\\`\n- Projects in the same workspace can import one another directly by package name (eg \\`@workspace-name/project-name\\`) without declaring a dependency in \\`package.json\\` — TypeScript path aliases in \\`tsconfig.base.json\\` resolve these imports\n- When specifying project names as arguments to generators, prefer the _fully qualified_ project name, for example \\`@workspace-name/project-name\\`. Check the \\`project.json\\` file for the specific package to find its fully qualified name\n- When no generator exists for a specific framework required, use the base \\`ts#project\\` and \\`py#project\\` generators and build on top.\n- Leave the \\`--infra\\` option at its default value unless the user has explicitly instructed otherwise. Generators choose a sensible default type of infrastructure to deploy the project with, so only override \\`--infra\\` when the user has specified a particular requirement.\n\n## Useful Commands\n\n- Fix lint issues with \\`nx run-many --target lint --configuration=fix --all --output-style=stream\\`\n- Build all projects with \\`nx run-many --target build --all --output-style=stream\\`\n- Prefer importing the CDK constructs vended by generators in \\`packages/common/constructs\\` over writing your own\n\n## Best Practices\n\n- After running a generator, use the \\`nx show projects\\` command to check which projects have been added (if any)\n- Carefully examine the files that have been generated and always refer back to the generator guide when working in a generated project\n- Generate all projects into the \\`packages/\\` directory\n- After making changes to your projects, fix linting issues, then run a full build\n- When it's time to start testing a project, suggest to the user that infrastructure is deployed to AWS. For websites, if a runtime-config.json is needed, use the load-runtime-config target after a deployment to point a local website at a sandbox stack.\n- For CDK infrastructure projects, deploy the sandbox stage with the \\`deploy-sandbox\\` target (eg \\`nx deploy-sandbox infra\\`) rather than passing a stage pattern to \\`deploy\\` — it already targets the sandbox stage declared in \\`main.ts\\`. Likewise \\`destroy-sandbox\\` tears that stage back down.\n\n## Batching Generators\n\nWhen scaffolding several projects in one go, chain generators to avoid a slow dependency install after every generator:\n\n- **Chain generators** with \\`&&\\` in a single command. Pass \\`--prefer-install-dependencies=false\\` on each generator except the last so dependencies install once at the end, for example:\n\n${PACKAGE_MANAGERS.map(\n  (pm) => `  \\`\\`\\`bash\n  ${buildNxCommand('g @aws/nx-plugin:ts#trpc-api --no-interactive --name=my-app-api --auth=iam --prefer-install-dependencies=false', pm)} && \\\\\n    ${buildNxCommand('g @aws/nx-plugin:ts#react-website --no-interactive --name=my-app-website --prefer-install-dependencies=false', pm)} && \\\\\n    ${buildNxCommand('g @aws/nx-plugin:connection --no-interactive --sourceProject=@my-app/my-app-website --targetProject=@my-app/my-app-api --prefer-install-dependencies=false', pm)} && \\\\\n    ${buildNxCommand('g @aws/nx-plugin:ts#infra --no-interactive --name=infra', pm)} && \\\\\n    ${buildNxCommand('sync', pm)}\n  \\`\\`\\``,\n).join('\\n')}\n\n- **\\`--prefer-install-dependencies=false\\`** asks a generator to defer its dependency install so the batch installs once at the end (the final generator above omits the flag and installs everything).\n- **\\`nx sync\\`** is required before building — generators modify TypeScript project references.\n\n## Detailed Guides\n\nPlease refer to the below documentation for important details regarding workspaces and working with TypeScript or Python projects.\n\n${await fetchGuidePages(['workspace', 'typescript-project', 'python-project'], generators)}\n\n    `,\n        },\n      ],\n    }),\n  );\n};\n"],"names":["IAC_PROVIDERS","buildNxCommand","fetchGuidePages","PACKAGE_MANAGERS","TOOL_SELECTION_GUIDE","addGeneralGuidanceTool","server","generators","registerTool","title","description","content","type","text","join","map","pm"],"mappings":"AAAA;;;CAGC,GAGD,SAASA,aAAa,QAAQ,+BAA+B;AAC7D,SAASC,cAAc,EAAEC,eAAe,QAAQ,uBAAuB;AACvE,SAASC,gBAAgB,QAAQ,eAAe;AAEhD,OAAO,MAAMC,uBAAuB,CAAC;;;;;;;+FAO0D,CAAC,CAAC;AAEjG;;CAEC,GACD,OAAO,MAAMC,yBAAyB,CACpCC,QACAC;IAEAD,OAAOE,YAAY,CACjB,oBACA;QACEC,OAAO;QACPC,aACE;IACJ,GACA,UAAa,CAAA;YACXC,SAAS;gBACP;oBACEC,MAAM;oBACNC,MAAM,CAAC;;AAEjB,EAAET,qBAAqB;;;;yDAIkC,EAAED,iBAAiBW,IAAI,CAAC,MAAM;+EACR,EAAEd,cAAcc,IAAI,CAAC,MAAM;;;;;;;AAO1G,EAAEX,iBAAiBY,GAAG,CAAC,CAACC,KAAOf,eAAe,aAAae,KAAKF,IAAI,CAAC,SAAS;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAqC9E,EAAEX,iBAAiBY,GAAG,CACpB,CAACC,KAAO,CAAC;EACT,EAAEf,eAAe,kHAAkHe,IAAI;IACrI,EAAEf,eAAe,gHAAgHe,IAAI;IACrI,EAAEf,eAAe,8JAA8Je,IAAI;IACnL,EAAEf,eAAe,2DAA2De,IAAI;IAChF,EAAEf,eAAe,QAAQe,IAAI;QACzB,CAAC,EACPF,IAAI,CAAC,MAAM;;;;;;;;;AASb,EAAE,MAAMZ,gBAAgB;wBAAC;wBAAa;wBAAsB;qBAAiB,EAAEK,YAAY;;IAEvF,CAAC;gBACG;aACD;QACH,CAAA;AAEJ,EAAE"}
+{"version":3,"sources":["../../../../../../packages/nx-plugin/src/mcp-server/tools/general-guidance.ts"],"sourcesContent":["/**\n * Copyright Amazon.com, Inc. or its affiliates. All Rights Reserved.\n * SPDX-License-Identifier: Apache-2.0\n */\nimport type { McpServer } from '@modelcontextprotocol/sdk/server/mcp.js';\nimport type { NxGeneratorInfo } from '../../utils/generators.js';\nimport { IAC_PROVIDERS } from '../../utils/iac-providers.js';\nimport { buildNxCommand, fetchGuidePages } from '../generator-info.js';\nimport { PACKAGE_MANAGERS } from '../schema.js';\nimport { BEST_PRACTICE_PAGE_NAMES } from './best-practices.js';\n\n/**\n * The cross-cutting pages every agent needs regardless of task, inlined here\n * so a workspace's conventions land without a second tool call. The rest are\n * served on demand by `best-practices`.\n */\nconst GENERAL_GUIDANCE_PAGES = [\n  'workspace',\n  'typescript-project',\n  'python-project',\n] as const;\n\nexport const TOOL_SELECTION_GUIDE = `## Tool Selection Guide\n\n- Use the \\`general-guidance\\` tool for guidance and best practices for working with Nx and the Nx Plugin for AWS.\n- Use the \\`best-practices\\` tool for guidance which spans generators rather than applying to one in particular, such as workspace layout, security, runtime configuration, container builds and local development.\n- Use the \\`create-workspace-command\\` tool to discover how to create a workspace to start a new project.\n- Use the \\`add-to-existing-project\\` tool when adding the plugin to an existing Nx workspace or non-Nx monorepo, or when troubleshooting configuration errors in such a workspace.\n- Use the \\`upgrade-workspace\\` tool when upgrading Nx or the Nx Plugin for AWS to a newer version.\n- Use the \\`list-generators\\` tool to discover the available generators and how to run them.\n- Use the \\`generator-guide\\` tool to retrieve detailed information about a specific generator.`;\n\n/**\n * Add a tool which provides general guidance for using Nx and the Nx Plugin for AWS\n */\nexport const addGeneralGuidanceTool = (\n  server: McpServer,\n  generators: NxGeneratorInfo[],\n) => {\n  server.registerTool(\n    'general-guidance',\n    {\n      title: 'General Guidance',\n      description:\n        'Tool for guidance and best practices for working with Nx and the Nx Plugin for AWS',\n    },\n    async () => ({\n      content: [\n        {\n          type: 'text' as const,\n          text: `# Nx Plugin for AWS Guidance\n\n${TOOL_SELECTION_GUIDE}\n\n## Getting Started\n\n- Choose a package manager first. You can choose between ${PACKAGE_MANAGERS.join(', ')}. It's recommended to use \"pnpm\" if the user has no preference\n- Choose an infrastructure as code (IaC) provider next. You can choose between ${IAC_PROVIDERS.join(', ')}. It's recommended to use CDK if the user has no preference\n- Next, you must create an Nx workspace. Use the \\`create-workspace-command\\` tool for more details, and provide it with your chosen package manager\n- After this, you can start scaffolding the main components of your application using generators. Use the \\`list-generators\\` tool to discover available generators, and the \\`generator-guide\\` tool for more detailed information about a specific generator\n\n## Nx Primer\n\n- Prefix nx commands with the appropriate prefix for your package manager, for example:\n${PACKAGE_MANAGERS.map((pm) => buildNxCommand('<options>', pm)).join(' - \\n')}\n- Each project in your workspace has a file named \\`project.json\\` which contains important project information such as its name, and defines the \"targets\" which can be run for that project, for example building or testing the project\n- Use the command \\`nx reset\\` to reset the Nx daemon when unexpected issues arise\n- After adding dependencies between TypeScript projects, use \\`nx sync\\` to ensure project references are set up correctly\n\n## General Instructions\n\n- Each project declares the third-party runtime dependencies its source imports in its own \\`package.json\\`; shared build/test tooling (test runners, bundlers, etc.) is declared in the root \\`package.json\\` \\`devDependencies\\`. Versions follow a single version policy, recorded in the package manager's dependency catalog where supported (referenced as \\`catalog:\\`). Install with the appropriate command for your package manager:\n  - Add a project runtime dependency: \\`pnpm add <package> --filter <project>\\` / \\`yarn workspace <project> add <package>\\` / \\`npm install <package> -w <project>\\` / \\`bun add <package> --cwd <project-directory>\\`\n  - Add a shared dev tool at the root: \\`pnpm add -Dw <package>\\` / \\`yarn add -D <package>\\` / \\`npm install --legacy-peer-deps -D <package>\\` / \\`bun install -D <package>\\`\n- The \\`noUndeclaredDependencies\\` lint rule enforces that a project's source only imports packages declared in its own \\`package.json\\`\n- Projects in the same workspace can import one another directly by package name (eg \\`@workspace-name/project-name\\`) without declaring a dependency in \\`package.json\\` — TypeScript path aliases in \\`tsconfig.base.json\\` resolve these imports\n- When specifying project names as arguments to generators, prefer the _fully qualified_ project name, for example \\`@workspace-name/project-name\\`. Check the \\`project.json\\` file for the specific package to find its fully qualified name\n- When no generator exists for a specific framework required, use the base \\`ts#project\\` and \\`py#project\\` generators and build on top.\n- Leave the \\`--infra\\` option at its default value unless the user has explicitly instructed otherwise. Generators choose a sensible default type of infrastructure to deploy the project with, so only override \\`--infra\\` when the user has specified a particular requirement.\n\n## Useful Commands\n\n- Fix lint issues with \\`nx run-many --target lint --configuration=fix --all --output-style=stream\\`\n- Build all projects with \\`nx run-many --target build --all --output-style=stream\\`\n- Prefer importing the CDK constructs vended by generators in \\`packages/common/constructs\\` over writing your own\n\n## Best Practices\n\n- After running a generator, use the \\`nx show projects\\` command to check which projects have been added (if any)\n- Carefully examine the files that have been generated and always refer back to the generator guide when working in a generated project\n- Generate all projects into the \\`packages/\\` directory\n- After making changes to your projects, fix linting issues, then run a full build\n- When it's time to start testing a project, suggest to the user that infrastructure is deployed to AWS. For websites, if a runtime-config.json is needed, use the load-runtime-config target after a deployment to point a local website at a sandbox stack.\n- For CDK infrastructure projects, deploy the sandbox stage with the \\`deploy-sandbox\\` target (eg \\`nx deploy-sandbox infra\\`) rather than passing a stage pattern to \\`deploy\\` — it already targets the sandbox stage declared in \\`main.ts\\`. Likewise \\`destroy-sandbox\\` tears that stage back down.\n\n## Batching Generators\n\nWhen scaffolding several projects in one go, chain generators to avoid a slow dependency install after every generator:\n\n- **Chain generators** with \\`&&\\` in a single command. Pass \\`--prefer-install-dependencies=false\\` on each generator except the last so dependencies install once at the end, for example:\n\n${PACKAGE_MANAGERS.map(\n  (pm) => `  \\`\\`\\`bash\n  ${buildNxCommand('g @aws/nx-plugin:ts#trpc-api --no-interactive --name=my-app-api --auth=iam --prefer-install-dependencies=false', pm)} && \\\\\n    ${buildNxCommand('g @aws/nx-plugin:ts#react-website --no-interactive --name=my-app-website --prefer-install-dependencies=false', pm)} && \\\\\n    ${buildNxCommand('g @aws/nx-plugin:connection --no-interactive --sourceProject=@my-app/my-app-website --targetProject=@my-app/my-app-api --prefer-install-dependencies=false', pm)} && \\\\\n    ${buildNxCommand('g @aws/nx-plugin:ts#infra --no-interactive --name=infra', pm)} && \\\\\n    ${buildNxCommand('sync', pm)}\n  \\`\\`\\``,\n).join('\\n')}\n\n- **\\`--prefer-install-dependencies=false\\`** asks a generator to defer its dependency install so the batch installs once at the end (the final generator above omits the flag and installs everything).\n- **\\`nx sync\\`** is required before building — generators modify TypeScript project references.\n\n## Detailed Guides\n\nPlease refer to the below documentation for important details regarding workspaces and working with TypeScript or Python projects. Use the \\`best-practices\\` tool for the remaining cross-cutting guides (${BEST_PRACTICE_PAGE_NAMES.filter(\n            (p) => !GENERAL_GUIDANCE_PAGES.includes(p as never),\n          )\n            .map((p) => `\\`${p}\\``)\n            .join(', ')}).\n\n${await fetchGuidePages([...GENERAL_GUIDANCE_PAGES], generators)}\n\n    `,\n        },\n      ],\n    }),\n  );\n};\n"],"names":["IAC_PROVIDERS","buildNxCommand","fetchGuidePages","PACKAGE_MANAGERS","BEST_PRACTICE_PAGE_NAMES","GENERAL_GUIDANCE_PAGES","TOOL_SELECTION_GUIDE","addGeneralGuidanceTool","server","generators","registerTool","title","description","content","type","text","join","map","pm","filter","p","includes"],"mappings":"AAAA;;;CAGC,GAGD,SAASA,aAAa,QAAQ,+BAA+B;AAC7D,SAASC,cAAc,EAAEC,eAAe,QAAQ,uBAAuB;AACvE,SAASC,gBAAgB,QAAQ,eAAe;AAChD,SAASC,wBAAwB,QAAQ,sBAAsB;AAE/D;;;;CAIC,GACD,MAAMC,yBAAyB;IAC7B;IACA;IACA;CACD;AAED,OAAO,MAAMC,uBAAuB,CAAC;;;;;;;;+FAQ0D,CAAC,CAAC;AAEjG;;CAEC,GACD,OAAO,MAAMC,yBAAyB,CACpCC,QACAC;IAEAD,OAAOE,YAAY,CACjB,oBACA;QACEC,OAAO;QACPC,aACE;IACJ,GACA,UAAa,CAAA;YACXC,SAAS;gBACP;oBACEC,MAAM;oBACNC,MAAM,CAAC;;AAEjB,EAAET,qBAAqB;;;;yDAIkC,EAAEH,iBAAiBa,IAAI,CAAC,MAAM;+EACR,EAAEhB,cAAcgB,IAAI,CAAC,MAAM;;;;;;;AAO1G,EAAEb,iBAAiBc,GAAG,CAAC,CAACC,KAAOjB,eAAe,aAAaiB,KAAKF,IAAI,CAAC,SAAS;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAqC9E,EAAEb,iBAAiBc,GAAG,CACpB,CAACC,KAAO,CAAC;EACT,EAAEjB,eAAe,kHAAkHiB,IAAI;IACrI,EAAEjB,eAAe,gHAAgHiB,IAAI;IACrI,EAAEjB,eAAe,8JAA8JiB,IAAI;IACnL,EAAEjB,eAAe,2DAA2DiB,IAAI;IAChF,EAAEjB,eAAe,QAAQiB,IAAI;QACzB,CAAC,EACPF,IAAI,CAAC,MAAM;;;;;;;2MAO8L,EAAEZ,yBAAyBe,MAAM,CAChO,CAACC,IAAM,CAACf,uBAAuBgB,QAAQ,CAACD,IAEvCH,GAAG,CAAC,CAACG,IAAM,CAAC,EAAE,EAAEA,EAAE,EAAE,CAAC,EACrBJ,IAAI,CAAC,MAAM;;AAExB,EAAE,MAAMd,gBAAgB;2BAAIG;qBAAuB,EAAEI,YAAY;;IAE7D,CAAC;gBACG;aACD;QACH,CAAA;AAEJ,EAAE"}

package/src/migrations/latest/checkov-scan-cache-inputs/metadata.json

@@ -0,0 +1,3 @@
+{
+  "description": "Scope the CDK infrastructure checkov target's cache inputs so the security scan cannot serve a stale pass"
+}

package/src/migrations/latest/checkov-scan-cache-inputs/migration.d.ts

@@ -0,0 +1,6 @@
+/**
+ * Copyright Amazon.com, Inc. or its affiliates. All Rights Reserved.
+ * SPDX-License-Identifier: Apache-2.0
+ */
+import { type MigrationReturnObject, type Tree } from '@nx/devkit';
+export default function migration(tree: Tree): Promise<MigrationReturnObject>;

package/src/migrations/latest/checkov-scan-cache-inputs/migration.js

@@ -0,0 +1,58 @@
+/**
+ * Copyright Amazon.com, Inc. or its affiliates. All Rights Reserved.
+ * SPDX-License-Identifier: Apache-2.0
+ */ import { getProjects, updateProjectConfiguration } from "@nx/devkit";
+import { INFRA_APP_GENERATOR_INFO } from "../../../infra/app/generator.js";
+import { formatFilesInSubtree } from "../../../utils/format.js";
+/**
+ * Point the CDK infrastructure `checkov` target's cache inputs at the project
+ * rather than at the synth output directory.
+ *
+ * The target declared `["{workspaceRoot}/dist/{projectRoot}/cdk.out"]`, a
+ * fileset input. Nx resolves a fileset against the files it tracks, and `dist`
+ * is gitignored — so the input matched nothing and hashed to a constant. Once
+ * the scan had been cached, every later run was a hit: adding a non-compliant
+ * resource to a stack left `build` reporting success, and restored a
+ * `checkov_report.json` recording zero resources scanned.
+ *
+ * `["default"]` is what its `synth` sibling declares. It covers the project's
+ * own sources and carries the transitive `dependentTasksOutputFiles` entry from
+ * `nx.json`, which Nx resolves against the upstream `synth` task — so the hash
+ * follows the template the scan actually reads.
+ */ const CHECKOV_TARGET = 'checkov';
+/** The inputs the pre-fix generator declared, replaced in place. */ const VENDED_INPUTS = [
+    '{workspaceRoot}/dist/{projectRoot}/cdk.out'
+];
+/** The inputs the generator declares now, matching the `synth` sibling. */ const FIXED_INPUTS = [
+    'default'
+];
+const divergedMessage = (projectName)=>`${projectName}:${CHECKOV_TARGET}: its \`inputs\` have diverged from the generated shape - left untouched. Confirm they cover the synthesized template the scan reads: an input pointed only at \`dist\` matches no tracked file, so the scan can report a cached pass on infrastructure it never scanned.`;
+/** Whether a target's inputs are exactly the ones the generator vended. */ const hasVendedInputs = (target)=>Array.isArray(target.inputs) && target.inputs.length === VENDED_INPUTS.length && target.inputs.every((input, index)=>input === VENDED_INPUTS[index]);
+export default async function migration(tree) {
+    const nextSteps = [];
+    for (const [projectName, project] of getProjects(tree)){
+        const generator = project.metadata?.generator;
+        if (generator !== INFRA_APP_GENERATOR_INFO.id) continue;
+        const target = project.targets?.[CHECKOV_TARGET];
+        if (!target) continue;
+        // A target already declaring the fixed inputs needs nothing, which also
+        // makes a re-run — and a project generated after the fix — a no-op.
+        if (Array.isArray(target.inputs) && target.inputs.length === FIXED_INPUTS.length && target.inputs.every((input, index)=>input === FIXED_INPUTS[index])) {
+            continue;
+        }
+        if (!hasVendedInputs(target)) {
+            nextSteps.push(divergedMessage(projectName));
+            continue;
+        }
+        target.inputs = [
+            ...FIXED_INPUTS
+        ];
+        updateProjectConfiguration(tree, projectName, project);
+    }
+    await formatFilesInSubtree(tree);
+    return {
+        nextSteps
+    };
+}
+
+//# sourceMappingURL=migration.js.map

package/src/migrations/latest/checkov-scan-cache-inputs/migration.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../../../../../../../packages/nx-plugin/src/migrations/latest/checkov-scan-cache-inputs/migration.ts"],"sourcesContent":["/**\n * Copyright Amazon.com, Inc. or its affiliates. All Rights Reserved.\n * SPDX-License-Identifier: Apache-2.0\n */\nimport {\n  getProjects,\n  type MigrationReturnObject,\n  type ProjectConfiguration,\n  type TargetConfiguration,\n  type Tree,\n  updateProjectConfiguration,\n} from '@nx/devkit';\nimport { INFRA_APP_GENERATOR_INFO } from '../../../infra/app/generator.js';\nimport { formatFilesInSubtree } from '../../../utils/format.js';\n\n/**\n * Point the CDK infrastructure `checkov` target's cache inputs at the project\n * rather than at the synth output directory.\n *\n * The target declared `[\"{workspaceRoot}/dist/{projectRoot}/cdk.out\"]`, a\n * fileset input. Nx resolves a fileset against the files it tracks, and `dist`\n * is gitignored — so the input matched nothing and hashed to a constant. Once\n * the scan had been cached, every later run was a hit: adding a non-compliant\n * resource to a stack left `build` reporting success, and restored a\n * `checkov_report.json` recording zero resources scanned.\n *\n * `[\"default\"]` is what its `synth` sibling declares. It covers the project's\n * own sources and carries the transitive `dependentTasksOutputFiles` entry from\n * `nx.json`, which Nx resolves against the upstream `synth` task — so the hash\n * follows the template the scan actually reads.\n */\n\nconst CHECKOV_TARGET = 'checkov';\n\n/** The inputs the pre-fix generator declared, replaced in place. */\nconst VENDED_INPUTS = ['{workspaceRoot}/dist/{projectRoot}/cdk.out'];\n\n/** The inputs the generator declares now, matching the `synth` sibling. */\nconst FIXED_INPUTS = ['default'];\n\nconst divergedMessage = (projectName: string) =>\n  `${projectName}:${CHECKOV_TARGET}: its \\`inputs\\` have diverged from the generated shape - left untouched. Confirm they cover the synthesized template the scan reads: an input pointed only at \\`dist\\` matches no tracked file, so the scan can report a cached pass on infrastructure it never scanned.`;\n\n/** Whether a target's inputs are exactly the ones the generator vended. */\nconst hasVendedInputs = (target: TargetConfiguration): boolean =>\n  Array.isArray(target.inputs) &&\n  target.inputs.length === VENDED_INPUTS.length &&\n  target.inputs.every((input, index) => input === VENDED_INPUTS[index]);\n\nexport default async function migration(\n  tree: Tree,\n): Promise<MigrationReturnObject> {\n  const nextSteps: string[] = [];\n\n  for (const [projectName, project] of getProjects(tree)) {\n    const generator = (project.metadata as { generator?: string } | undefined)\n      ?.generator;\n    if (generator !== INFRA_APP_GENERATOR_INFO.id) continue;\n\n    const target = project.targets?.[CHECKOV_TARGET];\n    if (!target) continue;\n\n    // A target already declaring the fixed inputs needs nothing, which also\n    // makes a re-run — and a project generated after the fix — a no-op.\n    if (\n      Array.isArray(target.inputs) &&\n      target.inputs.length === FIXED_INPUTS.length &&\n      target.inputs.every((input, index) => input === FIXED_INPUTS[index])\n    ) {\n      continue;\n    }\n\n    if (!hasVendedInputs(target)) {\n      nextSteps.push(divergedMessage(projectName));\n      continue;\n    }\n\n    target.inputs = [...FIXED_INPUTS];\n    updateProjectConfiguration(\n      tree,\n      projectName,\n      project as ProjectConfiguration,\n    );\n  }\n\n  await formatFilesInSubtree(tree);\n\n  return { nextSteps };\n}\n"],"names":["getProjects","updateProjectConfiguration","INFRA_APP_GENERATOR_INFO","formatFilesInSubtree","CHECKOV_TARGET","VENDED_INPUTS","FIXED_INPUTS","divergedMessage","projectName","hasVendedInputs","target","Array","isArray","inputs","length","every","input","index","migration","tree","nextSteps","project","generator","metadata","id","targets","push"],"mappings":"AAAA;;;CAGC,GACD,SACEA,WAAW,EAKXC,0BAA0B,QACrB,aAAa;AACpB,SAASC,wBAAwB,QAAQ,kCAAkC;AAC3E,SAASC,oBAAoB,QAAQ,2BAA2B;AAEhE;;;;;;;;;;;;;;;CAeC,GAED,MAAMC,iBAAiB;AAEvB,kEAAkE,GAClE,MAAMC,gBAAgB;IAAC;CAA6C;AAEpE,yEAAyE,GACzE,MAAMC,eAAe;IAAC;CAAU;AAEhC,MAAMC,kBAAkB,CAACC,cACvB,GAAGA,YAAY,CAAC,EAAEJ,eAAe,yQAAyQ,CAAC;AAE7S,yEAAyE,GACzE,MAAMK,kBAAkB,CAACC,SACvBC,MAAMC,OAAO,CAACF,OAAOG,MAAM,KAC3BH,OAAOG,MAAM,CAACC,MAAM,KAAKT,cAAcS,MAAM,IAC7CJ,OAAOG,MAAM,CAACE,KAAK,CAAC,CAACC,OAAOC,QAAUD,UAAUX,aAAa,CAACY,MAAM;AAEtE,eAAe,eAAeC,UAC5BC,IAAU;IAEV,MAAMC,YAAsB,EAAE;IAE9B,KAAK,MAAM,CAACZ,aAAaa,QAAQ,IAAIrB,YAAYmB,MAAO;QACtD,MAAMG,YAAaD,QAAQE,QAAQ,EAC/BD;QACJ,IAAIA,cAAcpB,yBAAyBsB,EAAE,EAAE;QAE/C,MAAMd,SAASW,QAAQI,OAAO,EAAE,CAACrB,eAAe;QAChD,IAAI,CAACM,QAAQ;QAEb,wEAAwE;QACxE,oEAAoE;QACpE,IACEC,MAAMC,OAAO,CAACF,OAAOG,MAAM,KAC3BH,OAAOG,MAAM,CAACC,MAAM,KAAKR,aAAaQ,MAAM,IAC5CJ,OAAOG,MAAM,CAACE,KAAK,CAAC,CAACC,OAAOC,QAAUD,UAAUV,YAAY,CAACW,MAAM,GACnE;YACA;QACF;QAEA,IAAI,CAACR,gBAAgBC,SAAS;YAC5BU,UAAUM,IAAI,CAACnB,gBAAgBC;YAC/B;QACF;QAEAE,OAAOG,MAAM,GAAG;eAAIP;SAAa;QACjCL,2BACEkB,MACAX,aACAa;IAEJ;IAEA,MAAMlB,qBAAqBgB;IAE3B,OAAO;QAAEC;IAAU;AACrB"}

package/src/migrations/latest/gateway-url-accessor/__snapshots__/migration.spec.ts.snap

@@ -0,0 +1,84 @@
+// Vitest Snapshot v1, https://vitest.dev/guide/snapshot.html
+
+exports[`gateway-url-accessor migration > should add the gatewayUrl accessor to the vended core construct 1`] = `
+"import * as agentcore from 'aws-cdk-lib/aws-bedrockagentcore';
+import * as iam from 'aws-cdk-lib/aws-iam';
+import { Construct } from 'constructs';
+
+export class AgentCoreGateway extends Construct implements iam.IGrantable {
+  public readonly gateway: agentcore.Gateway;
+
+  constructor(scope: Construct, id: string) {
+    super(scope, id);
+    this.gateway = undefined as any;
+  }
+
+  /**
+   * The principal to grant permissions to.
+   */
+  public get grantPrincipal(): iam.IPrincipal {
+    return this.gateway.role.grantPrincipal;
+  }
+
+  /**
+   * The gateway's URL endpoint. The Gateway L2 types its own \`gatewayUrl\` as
+   * optional and only populates it when created from its own props, so fall
+   * back to the CloudFormation attribute.
+   */
+  public get gatewayUrl(): string {
+    return (
+      this.gateway.gatewayUrl ??
+      (this.gateway.node.defaultChild as agentcore.CfnGateway).attrGatewayUrl
+    );
+  }
+
+  public addGateway(
+    gateway: Construct & {
+      readonly gateway: agentcore.Gateway;
+      readonly gatewayName: string;
+      readonly gatewayUrl: string;
+    },
+    props?: {
+      gatewayTargetName?: string;
+    },
+  ): agentcore.CfnGatewayTarget {
+    const target = this.addGatewayTarget({
+      gatewayTargetName: props?.gatewayTargetName ?? gateway.gatewayName,
+      gatewayUrl: gateway.gatewayUrl,
+      gatewayArn: gateway.gateway.gatewayArn,
+    });
+    target.node.addDependency(gateway);
+    return target;
+  }
+
+  public addGatewayTarget(props: {
+    gatewayTargetName: string;
+    gatewayUrl: string;
+    gatewayArn: string;
+  }): agentcore.CfnGatewayTarget {
+    return undefined as any;
+  }
+}
+"
+`;
+
+exports[`gateway-url-accessor migration > should point vended app-level gateway constructs at the accessor 1`] = `
+"import { Construct } from 'constructs';
+import { AgentCoreGateway } from '../../../core/agentcore-gateway/agentcore-gateway';
+import { RuntimeConfig } from '../../../core/runtime-config';
+
+export class MyGateway extends AgentCoreGateway {
+  public readonly gatewayName = 'my-gateway';
+
+  constructor(scope: Construct, id: string) {
+    super(scope, id);
+
+    const rc = RuntimeConfig.ensure(this);
+    rc.set('agentcore', 'gateways', {
+      ...rc.get('agentcore').gateways,
+      MyGateway: this.gatewayUrl,
+    });
+  }
+}
+"
+`;

package/src/migrations/latest/gateway-url-accessor/metadata.json

@@ -0,0 +1,3 @@
+{
+  "description": "Expose a non-optional gatewayUrl accessor on the vended AgentCoreGateway construct"
+}

package/src/migrations/latest/gateway-url-accessor/migration.d.ts

@@ -0,0 +1,6 @@
+/**
+ * Copyright Amazon.com, Inc. or its affiliates. All Rights Reserved.
+ * SPDX-License-Identifier: Apache-2.0
+ */
+import type { MigrationReturnObject, Tree } from '@nx/devkit';
+export default function migration(tree: Tree): Promise<MigrationReturnObject>;