@aws/nx-plugin 1.0.0-rc.96 → 1.0.0-rc.98

package/src/utils/docker.js.map

@@ -1 +1 @@
-{"version":3,"sources":["../../../../../packages/nx-plugin/src/utils/docker.ts"],"sourcesContent":["/**\n * Copyright Amazon.com, Inc. or its affiliates. All Rights Reserved.\n * SPDX-License-Identifier: Apache-2.0\n */\nimport {\n  joinPathFragments,\n  type ProjectConfiguration,\n  type Tree,\n} from '@nx/devkit';\nimport {\n  type DependencyDeclaration,\n  forDependencies,\n  type MustDeclare,\n} from './declared-dependencies.js';\nimport { FS_DEPENDENCIES, FsCommands } from './fs.js';\nimport { addDependencyToTargetIfNotPresent } from './nx.js';\nimport { containerImage, type ITsDepVersion, TS_VERSIONS } from './versions.js';\n\n/** Dependencies a caller must declare to add a Docker scan target. */\nexport const DOCKER_DEPENDENCIES = [...FS_DEPENDENCIES] as const;\n\n/**\n * The `cache` setting every target that builds a container image must use.\n *\n * A built image lives in the container engine's own store, not under any\n * `outputs` path, so Nx has nothing to restore a cache hit from: it would\n * report the build complete while the image is missing, and the `trivy` scan\n * that depends on it would report a cached pass against an image that isn't\n * there. The container engine's layer cache is the sound cache here — it is\n * keyed on the build context and lives alongside the image, so an unchanged\n * context rebuilds in well under a second and always leaves the image present.\n */\nexport const IMAGE_BUILD_CACHE = false;\n\nconst TRIVY_IGNORE_FILE = '.trivyignore';\n\nconst TRIVY_IGNORE_CONTENTS = `# Trivy ignore file. Add one vulnerability ID (e.g. CVE-2021-12345) per line to\n# suppress it during the image scan (\\`nx run-many --target trivy\\`).\n# https://trivy.dev/latest/docs/configuration/filtering/#by-finding-ids\n`;\n\n/**\n * Substitution variables for the vended Node `Dockerfile` templates: the npm\n * version to install globally, and the versions its dependency overrides pin.\n */\nexport const nodeImageVersions = () => ({\n  npmVersion: TS_VERSIONS.npm,\n  minimatchVersion: TS_VERSIONS.minimatch,\n});\n\n/**\n * Packages a vended Node `Dockerfile` pins, which every generator writing one\n * must declare so the version sync keeps those pins current.\n *\n * Spread through `ownedElsewhere`: the pin lives in the image build rather than\n * in any manifest, so nothing is installed into the workspace. Left undeclared\n * these would be the only vended versions never upgraded — and they are\n * precisely the ones held at a version clear of a known HIGH/CRITICAL\n * vulnerability.\n */\nexport const NODE_IMAGE_DEPENDENCIES = [\n  { name: 'npm' },\n  { name: 'minimatch' },\n] as const satisfies readonly { name: ITsDepVersion }[];\n\n/**\n * Packages the AWS Distro for OpenTelemetry install in a vended `Dockerfile`\n * pins, for the images that auto-instrument with it. Spread through\n * `ownedElsewhere` for the same reason as {@link NODE_IMAGE_DEPENDENCIES}.\n */\nexport const ADOT_IMAGE_DEPENDENCIES = [\n  { name: '@aws/aws-distro-opentelemetry-node-autoinstrumentation' },\n  { name: '@opentelemetry/propagator-jaeger' },\n] as const satisfies readonly { name: ITsDepVersion }[];\n\nexport interface DockerScanTargetOptions {\n  /**\n   * Project configuration to add the scan target to (mutated in place).\n   */\n  readonly project: ProjectConfiguration;\n  /**\n   * Container engine command to invoke (\\`docker\\` or \\`finch\\`).\n   */\n  readonly containerEngine: string;\n  /**\n   * Name of the scan target to add, e.g. \\`my-agent-trivy\\`.\n   */\n  readonly trivyTargetName: string;\n  /**\n   * Name of the docker target that builds the image(s) to scan. The scan\n   * target depends on it.\n   */\n  readonly dockerTargetName: string;\n  /**\n   * Tags of the images built by the docker target which should be scanned.\n   */\n  readonly imageTags: string[];\n}\n\n/**\n * Add a Trivy scan target for the images built by a docker target and wire it\n * under the aggregate \\`trivy\\` target. The scan is not part of \\`build\\` — run\n * \\`nx run-many --target trivy\\` (the root \\`trivy\\` script) in CI.\n *\n * The scan target depends on the docker target and is not cacheable, because\n * what it scans lives in the container engine rather than under its \\`outputs\\`.\n * Each image is saved to a tarball under \\`dist/<projectRoot>/trivy/<scan-key>\\`\n * (kept out of any Docker build context) and scanned with the pinned ECR-hosted\n * Trivy image via a workspace-relative bind mount, so the same commands work\n * under both docker and finch. The scan exits non-zero (exit code 1) on\n * HIGH/CRITICAL vulnerabilities.\n *\n * A \\`.trivyignore\\` is vended at the project root (kept if it already exists)\n * for suppressing findings.\n */\nexport const addDockerScanTarget = <const D extends DependencyDeclaration>(\n  tree: Tree,\n  options: DockerScanTargetOptions,\n  declaration: D & MustDeclare<typeof DOCKER_DEPENDENCIES, D>,\n): void => {\n  const { project, containerEngine, trivyTargetName, dockerTargetName } =\n    options;\n  const { imageTags } = options;\n  const projectRoot = project.root;\n\n  const ignoreFilePath = joinPathFragments(projectRoot, TRIVY_IGNORE_FILE);\n  if (!tree.exists(ignoreFilePath)) {\n    tree.write(ignoreFilePath, TRIVY_IGNORE_CONTENTS);\n  }\n\n  // Stage scan artifacts in a directory unique to this scan target so that\n  // sibling targets in the same project (e.g. multiple agents) don't clobber\n  // each other's tarballs when run in parallel. The first image tag is unique\n  // per target, so it makes a stable, collision-free key.\n  const scanKey = imageTags[0].replace(/[^a-zA-Z0-9-]/g, '-');\n  const scanDir = joinPathFragments('dist', projectRoot, 'trivy', scanKey);\n  const trivyImage = containerImage('trivy');\n\n  const fs = new FsCommands(\n    tree,\n    forDependencies<typeof DOCKER_DEPENDENCIES>(declaration),\n  );\n  const commands = [\n    fs.rm(scanDir),\n    fs.mkdir(scanDir),\n    fs.cpFile(ignoreFilePath, joinPathFragments(scanDir, TRIVY_IGNORE_FILE)),\n  ];\n\n  imageTags.forEach((imageTag, index) => {\n    const tarName = `image-${index}.tar`;\n    commands.push(\n      `${containerEngine} save -o ${joinPathFragments(scanDir, tarName)} ${imageTag}`,\n      `${containerEngine} run --rm -v \"./${scanDir}\":/scan ${trivyImage} image --input /scan/${tarName} --ignorefile /scan/${TRIVY_IGNORE_FILE} --scanners vuln --severity HIGH,CRITICAL --ignore-unfixed --exit-code 1 --no-progress -q`,\n    );\n  });\n\n  project.targets ??= {};\n  project.targets[trivyTargetName] = {\n    // The image being scanned is only reachable through the container engine,\n    // so a restored cache entry would report a pass for an image that may no\n    // longer exist. The scan re-runs and either scans the real image or fails.\n    // Nx only hashes a cacheable task, so declaring `inputs` here would have no\n    // effect.\n    cache: false,\n    outputs: [`{workspaceRoot}/${scanDir}`],\n    executor: 'nx:run-commands',\n    options: {\n      commands,\n      parallel: false,\n    },\n    dependsOn: [dockerTargetName],\n  };\n\n  // Aggregate per-component scan targets under a single `trivy` target. The\n  // scan is intentionally NOT wired into `build`: image scanning is slow and\n  // its result depends on the ever-changing vulnerability database (a scan\n  // that passes today can fail tomorrow when a new CVE is published), so\n  // coupling it to `build` would make local and CI builds non-deterministic.\n  // Run `nx run-many --target trivy` (the root `trivy` script) in CI instead.\n  if (trivyTargetName !== 'trivy') {\n    addDependencyToTargetIfNotPresent(project, 'trivy', trivyTargetName);\n  }\n};\n"],"names":["joinPathFragments","forDependencies","FS_DEPENDENCIES","FsCommands","addDependencyToTargetIfNotPresent","containerImage","TS_VERSIONS","DOCKER_DEPENDENCIES","IMAGE_BUILD_CACHE","TRIVY_IGNORE_FILE","TRIVY_IGNORE_CONTENTS","nodeImageVersions","npmVersion","npm","minimatchVersion","minimatch","NODE_IMAGE_DEPENDENCIES","name","ADOT_IMAGE_DEPENDENCIES","addDockerScanTarget","tree","options","declaration","project","containerEngine","trivyTargetName","dockerTargetName","imageTags","projectRoot","root","ignoreFilePath","exists","write","scanKey","replace","scanDir","trivyImage","fs","commands","rm","mkdir","cpFile","forEach","imageTag","index","tarName","push","targets","cache","outputs","executor","parallel","dependsOn"],"mappings":"AAAA;;;CAGC,GACD,SACEA,iBAAiB,QAGZ,aAAa;AACpB,SAEEC,eAAe,QAEV,6BAA6B;AACpC,SAASC,eAAe,EAAEC,UAAU,QAAQ,UAAU;AACtD,SAASC,iCAAiC,QAAQ,UAAU;AAC5D,SAASC,cAAc,EAAsBC,WAAW,QAAQ,gBAAgB;AAEhF,oEAAoE,GACpE,OAAO,MAAMC,sBAAsB;OAAIL;CAAgB,CAAU;AAEjE;;;;;;;;;;CAUC,GACD,OAAO,MAAMM,oBAAoB,MAAM;AAEvC,MAAMC,oBAAoB;AAE1B,MAAMC,wBAAwB,CAAC;;;AAG/B,CAAC;AAED;;;CAGC,GACD,OAAO,MAAMC,oBAAoB,IAAO,CAAA;QACtCC,YAAYN,YAAYO,GAAG;QAC3BC,kBAAkBR,YAAYS,SAAS;IACzC,CAAA,EAAG;AAEH;;;;;;;;;CASC,GACD,OAAO,MAAMC,0BAA0B;IACrC;QAAEC,MAAM;IAAM;IACd;QAAEA,MAAM;IAAY;CACrB,CAAuD;AAExD;;;;CAIC,GACD,OAAO,MAAMC,0BAA0B;IACrC;QAAED,MAAM;IAAyD;IACjE;QAAEA,MAAM;IAAmC;CAC5C,CAAuD;AA0BxD;;;;;;;;;;;;;;;CAeC,GACD,OAAO,MAAME,sBAAsB,CACjCC,MACAC,SACAC;IAEA,MAAM,EAAEC,OAAO,EAAEC,eAAe,EAAEC,eAAe,EAAEC,gBAAgB,EAAE,GACnEL;IACF,MAAM,EAAEM,SAAS,EAAE,GAAGN;IACtB,MAAMO,cAAcL,QAAQM,IAAI;IAEhC,MAAMC,iBAAiB9B,kBAAkB4B,aAAanB;IACtD,IAAI,CAACW,KAAKW,MAAM,CAACD,iBAAiB;QAChCV,KAAKY,KAAK,CAACF,gBAAgBpB;IAC7B;IAEA,yEAAyE;IACzE,2EAA2E;IAC3E,4EAA4E;IAC5E,wDAAwD;IACxD,MAAMuB,UAAUN,SAAS,CAAC,EAAE,CAACO,OAAO,CAAC,kBAAkB;IACvD,MAAMC,UAAUnC,kBAAkB,QAAQ4B,aAAa,SAASK;IAChE,MAAMG,aAAa/B,eAAe;IAElC,MAAMgC,KAAK,IAAIlC,WACbiB,MACAnB,gBAA4CqB;IAE9C,MAAMgB,WAAW;QACfD,GAAGE,EAAE,CAACJ;QACNE,GAAGG,KAAK,CAACL;QACTE,GAAGI,MAAM,CAACX,gBAAgB9B,kBAAkBmC,SAAS1B;KACtD;IAEDkB,UAAUe,OAAO,CAAC,CAACC,UAAUC;QAC3B,MAAMC,UAAU,CAAC,MAAM,EAAED,MAAM,IAAI,CAAC;QACpCN,SAASQ,IAAI,CACX,GAAGtB,gBAAgB,SAAS,EAAExB,kBAAkBmC,SAASU,SAAS,CAAC,EAAEF,UAAU,EAC/E,GAAGnB,gBAAgB,gBAAgB,EAAEW,QAAQ,QAAQ,EAAEC,WAAW,qBAAqB,EAAES,QAAQ,oBAAoB,EAAEpC,kBAAkB,yFAAyF,CAAC;IAEvO;IAEAc,QAAQwB,OAAO,KAAK,CAAC;IACrBxB,QAAQwB,OAAO,CAACtB,gBAAgB,GAAG;QACjC,0EAA0E;QAC1E,yEAAyE;QACzE,2EAA2E;QAC3E,4EAA4E;QAC5E,UAAU;QACVuB,OAAO;QACPC,SAAS;YAAC,CAAC,gBAAgB,EAAEd,SAAS;SAAC;QACvCe,UAAU;QACV7B,SAAS;YACPiB;YACAa,UAAU;QACZ;QACAC,WAAW;YAAC1B;SAAiB;IAC/B;IAEA,0EAA0E;IAC1E,2EAA2E;IAC3E,yEAAyE;IACzE,uEAAuE;IACvE,2EAA2E;IAC3E,4EAA4E;IAC5E,IAAID,oBAAoB,SAAS;QAC/BrB,kCAAkCmB,SAAS,SAASE;IACtD;AACF,EAAE"}
+{"version":3,"sources":["../../../../../packages/nx-plugin/src/utils/docker.ts"],"sourcesContent":["/**\n * Copyright Amazon.com, Inc. or its affiliates. All Rights Reserved.\n * SPDX-License-Identifier: Apache-2.0\n */\nimport {\n  joinPathFragments,\n  type ProjectConfiguration,\n  type Tree,\n} from '@nx/devkit';\nimport {\n  type DependencyDeclaration,\n  forDependencies,\n  type MustDeclare,\n} from './declared-dependencies.js';\nimport { FS_DEPENDENCIES, FsCommands } from './fs.js';\nimport {\n  addDependencyToTargetIfNotPresent,\n  normalizeTargetKeyOrder,\n} from './nx.js';\nimport { containerImage, type ITsDepVersion, TS_VERSIONS } from './versions.js';\n\n/** Dependencies a caller must declare to add a Docker scan target. */\nexport const DOCKER_DEPENDENCIES = [...FS_DEPENDENCIES] as const;\n\n/**\n * The `cache` setting every target that builds a container image must use.\n *\n * A built image lives in the container engine's own store, not under any\n * `outputs` path, so Nx has nothing to restore a cache hit from: it would\n * report the build complete while the image is missing, and the `trivy` scan\n * that depends on it would report a cached pass against an image that isn't\n * there. The container engine's layer cache is the sound cache here — it is\n * keyed on the build context and lives alongside the image, so an unchanged\n * context rebuilds in well under a second and always leaves the image present.\n */\nexport const IMAGE_BUILD_CACHE = false;\n\nconst TRIVY_IGNORE_FILE = '.trivyignore';\n\nconst TRIVY_IGNORE_CONTENTS = `# Trivy ignore file. Add one vulnerability ID (e.g. CVE-2021-12345) per line to\n# suppress it during the image scan (\\`nx run-many --target trivy\\`).\n# https://trivy.dev/latest/docs/configuration/filtering/#by-finding-ids\n`;\n\n/**\n * Substitution variables for the vended Node `Dockerfile` templates: the npm\n * version to install globally, and the versions its dependency overrides pin.\n */\nexport const nodeImageVersions = () => ({\n  npmVersion: TS_VERSIONS.npm,\n  minimatchVersion: TS_VERSIONS.minimatch,\n});\n\n/**\n * Packages a vended Node `Dockerfile` pins, which every generator writing one\n * must declare so the version sync keeps those pins current.\n *\n * Spread through `ownedElsewhere`: the pin lives in the image build rather than\n * in any manifest, so nothing is installed into the workspace. Left undeclared\n * these would be the only vended versions never upgraded — and they are\n * precisely the ones held at a version clear of a known HIGH/CRITICAL\n * vulnerability.\n */\nexport const NODE_IMAGE_DEPENDENCIES = [\n  { name: 'npm' },\n  { name: 'minimatch' },\n] as const satisfies readonly { name: ITsDepVersion }[];\n\n/**\n * Packages the prisma CLI install in a vended RDB migration `Dockerfile` pins.\n * The CLI's own ranges resolve both below a known HIGH vulnerability's fix, so\n * the image overrides them. Spread through `ownedElsewhere` for the same reason\n * as {@link NODE_IMAGE_DEPENDENCIES}.\n */\nexport const PRISMA_IMAGE_DEPENDENCIES = [\n  { name: 'deepmerge-ts' },\n  { name: 'mysql2' },\n] as const satisfies readonly { name: ITsDepVersion }[];\n\n/**\n * Packages the AWS Distro for OpenTelemetry install in a vended `Dockerfile`\n * pins, for the images that auto-instrument with it. Spread through\n * `ownedElsewhere` for the same reason as {@link NODE_IMAGE_DEPENDENCIES}.\n */\nexport const ADOT_IMAGE_DEPENDENCIES = [\n  { name: '@aws/aws-distro-opentelemetry-node-autoinstrumentation' },\n  { name: '@opentelemetry/propagator-jaeger' },\n] as const satisfies readonly { name: ITsDepVersion }[];\n\nexport interface DockerScanTargetOptions {\n  /**\n   * Project configuration to add the scan target to (mutated in place).\n   */\n  readonly project: ProjectConfiguration;\n  /**\n   * Container engine command to invoke (\\`docker\\` or \\`finch\\`).\n   */\n  readonly containerEngine: string;\n  /**\n   * Name of the scan target to add, e.g. \\`my-agent-trivy\\`.\n   */\n  readonly trivyTargetName: string;\n  /**\n   * Name of the docker target that builds the image(s) to scan. The scan\n   * target depends on it.\n   */\n  readonly dockerTargetName: string;\n  /**\n   * Tags of the images built by the docker target which should be scanned.\n   */\n  readonly imageTags: string[];\n}\n\n/**\n * Add a Trivy scan target for the images built by a docker target and wire it\n * under the aggregate \\`trivy\\` target. The scan is not part of \\`build\\` — run\n * \\`nx run-many --target trivy\\` (the root \\`trivy\\` script) in CI.\n *\n * The scan target depends on the docker target and is not cacheable, because\n * what it scans lives in the container engine rather than under its \\`outputs\\`.\n * Each image is saved to a tarball under \\`dist/<projectRoot>/trivy/<scan-key>\\`\n * (kept out of any Docker build context) and scanned with the pinned ECR-hosted\n * Trivy image via a workspace-relative bind mount, so the same commands work\n * under both docker and finch. The scan exits non-zero (exit code 1) on\n * HIGH/CRITICAL vulnerabilities.\n *\n * A \\`.trivyignore\\` is vended at the project root (kept if it already exists)\n * for suppressing findings.\n */\nexport const addDockerScanTarget = <const D extends DependencyDeclaration>(\n  tree: Tree,\n  options: DockerScanTargetOptions,\n  declaration: D & MustDeclare<typeof DOCKER_DEPENDENCIES, D>,\n): void => {\n  const { project, containerEngine, trivyTargetName, dockerTargetName } =\n    options;\n  const { imageTags } = options;\n  const projectRoot = project.root;\n\n  const ignoreFilePath = joinPathFragments(projectRoot, TRIVY_IGNORE_FILE);\n  if (!tree.exists(ignoreFilePath)) {\n    tree.write(ignoreFilePath, TRIVY_IGNORE_CONTENTS);\n  }\n\n  // Stage scan artifacts in a directory unique to this scan target so that\n  // sibling targets in the same project (e.g. multiple agents) don't clobber\n  // each other's tarballs when run in parallel. The first image tag is unique\n  // per target, so it makes a stable, collision-free key.\n  const scanKey = imageTags[0].replace(/[^a-zA-Z0-9-]/g, '-');\n  const scanDir = joinPathFragments('dist', projectRoot, 'trivy', scanKey);\n  const trivyImage = containerImage('trivy');\n\n  const fs = new FsCommands(\n    tree,\n    forDependencies<typeof DOCKER_DEPENDENCIES>(declaration),\n  );\n  const commands = [\n    fs.rm(scanDir),\n    fs.mkdir(scanDir),\n    fs.cpFile(ignoreFilePath, joinPathFragments(scanDir, TRIVY_IGNORE_FILE)),\n  ];\n\n  imageTags.forEach((imageTag, index) => {\n    const tarName = `image-${index}.tar`;\n    commands.push(\n      `${containerEngine} save -o ${joinPathFragments(scanDir, tarName)} ${imageTag}`,\n      `${containerEngine} run --rm -v \"./${scanDir}\":/scan ${trivyImage} image --input /scan/${tarName} --ignorefile /scan/${TRIVY_IGNORE_FILE} --scanners vuln --severity HIGH,CRITICAL --ignore-unfixed --exit-code 1 --no-progress -q`,\n    );\n  });\n\n  project.targets ??= {};\n  project.targets[trivyTargetName] = normalizeTargetKeyOrder({\n    // The image being scanned is only reachable through the container engine,\n    // so a restored cache entry would report a pass for an image that may no\n    // longer exist. The scan re-runs and either scans the real image or fails.\n    // Nx only hashes a cacheable task, so declaring `inputs` here would have no\n    // effect.\n    cache: false,\n    outputs: [`{workspaceRoot}/${scanDir}`],\n    executor: 'nx:run-commands',\n    options: {\n      commands,\n      parallel: false,\n    },\n    dependsOn: [dockerTargetName],\n  });\n\n  // Aggregate per-component scan targets under a single `trivy` target. The\n  // scan is intentionally NOT wired into `build`: image scanning is slow and\n  // its result depends on the ever-changing vulnerability database (a scan\n  // that passes today can fail tomorrow when a new CVE is published), so\n  // coupling it to `build` would make local and CI builds non-deterministic.\n  // Run `nx run-many --target trivy` (the root `trivy` script) in CI instead.\n  if (trivyTargetName !== 'trivy') {\n    addDependencyToTargetIfNotPresent(project, 'trivy', trivyTargetName);\n  }\n};\n"],"names":["joinPathFragments","forDependencies","FS_DEPENDENCIES","FsCommands","addDependencyToTargetIfNotPresent","normalizeTargetKeyOrder","containerImage","TS_VERSIONS","DOCKER_DEPENDENCIES","IMAGE_BUILD_CACHE","TRIVY_IGNORE_FILE","TRIVY_IGNORE_CONTENTS","nodeImageVersions","npmVersion","npm","minimatchVersion","minimatch","NODE_IMAGE_DEPENDENCIES","name","PRISMA_IMAGE_DEPENDENCIES","ADOT_IMAGE_DEPENDENCIES","addDockerScanTarget","tree","options","declaration","project","containerEngine","trivyTargetName","dockerTargetName","imageTags","projectRoot","root","ignoreFilePath","exists","write","scanKey","replace","scanDir","trivyImage","fs","commands","rm","mkdir","cpFile","forEach","imageTag","index","tarName","push","targets","cache","outputs","executor","parallel","dependsOn"],"mappings":"AAAA;;;CAGC,GACD,SACEA,iBAAiB,QAGZ,aAAa;AACpB,SAEEC,eAAe,QAEV,6BAA6B;AACpC,SAASC,eAAe,EAAEC,UAAU,QAAQ,UAAU;AACtD,SACEC,iCAAiC,EACjCC,uBAAuB,QAClB,UAAU;AACjB,SAASC,cAAc,EAAsBC,WAAW,QAAQ,gBAAgB;AAEhF,oEAAoE,GACpE,OAAO,MAAMC,sBAAsB;OAAIN;CAAgB,CAAU;AAEjE;;;;;;;;;;CAUC,GACD,OAAO,MAAMO,oBAAoB,MAAM;AAEvC,MAAMC,oBAAoB;AAE1B,MAAMC,wBAAwB,CAAC;;;AAG/B,CAAC;AAED;;;CAGC,GACD,OAAO,MAAMC,oBAAoB,IAAO,CAAA;QACtCC,YAAYN,YAAYO,GAAG;QAC3BC,kBAAkBR,YAAYS,SAAS;IACzC,CAAA,EAAG;AAEH;;;;;;;;;CASC,GACD,OAAO,MAAMC,0BAA0B;IACrC;QAAEC,MAAM;IAAM;IACd;QAAEA,MAAM;IAAY;CACrB,CAAuD;AAExD;;;;;CAKC,GACD,OAAO,MAAMC,4BAA4B;IACvC;QAAED,MAAM;IAAe;IACvB;QAAEA,MAAM;IAAS;CAClB,CAAuD;AAExD;;;;CAIC,GACD,OAAO,MAAME,0BAA0B;IACrC;QAAEF,MAAM;IAAyD;IACjE;QAAEA,MAAM;IAAmC;CAC5C,CAAuD;AA0BxD;;;;;;;;;;;;;;;CAeC,GACD,OAAO,MAAMG,sBAAsB,CACjCC,MACAC,SACAC;IAEA,MAAM,EAAEC,OAAO,EAAEC,eAAe,EAAEC,eAAe,EAAEC,gBAAgB,EAAE,GACnEL;IACF,MAAM,EAAEM,SAAS,EAAE,GAAGN;IACtB,MAAMO,cAAcL,QAAQM,IAAI;IAEhC,MAAMC,iBAAiBhC,kBAAkB8B,aAAapB;IACtD,IAAI,CAACY,KAAKW,MAAM,CAACD,iBAAiB;QAChCV,KAAKY,KAAK,CAACF,gBAAgBrB;IAC7B;IAEA,yEAAyE;IACzE,2EAA2E;IAC3E,4EAA4E;IAC5E,wDAAwD;IACxD,MAAMwB,UAAUN,SAAS,CAAC,EAAE,CAACO,OAAO,CAAC,kBAAkB;IACvD,MAAMC,UAAUrC,kBAAkB,QAAQ8B,aAAa,SAASK;IAChE,MAAMG,aAAahC,eAAe;IAElC,MAAMiC,KAAK,IAAIpC,WACbmB,MACArB,gBAA4CuB;IAE9C,MAAMgB,WAAW;QACfD,GAAGE,EAAE,CAACJ;QACNE,GAAGG,KAAK,CAACL;QACTE,GAAGI,MAAM,CAACX,gBAAgBhC,kBAAkBqC,SAAS3B;KACtD;IAEDmB,UAAUe,OAAO,CAAC,CAACC,UAAUC;QAC3B,MAAMC,UAAU,CAAC,MAAM,EAAED,MAAM,IAAI,CAAC;QACpCN,SAASQ,IAAI,CACX,GAAGtB,gBAAgB,SAAS,EAAE1B,kBAAkBqC,SAASU,SAAS,CAAC,EAAEF,UAAU,EAC/E,GAAGnB,gBAAgB,gBAAgB,EAAEW,QAAQ,QAAQ,EAAEC,WAAW,qBAAqB,EAAES,QAAQ,oBAAoB,EAAErC,kBAAkB,yFAAyF,CAAC;IAEvO;IAEAe,QAAQwB,OAAO,KAAK,CAAC;IACrBxB,QAAQwB,OAAO,CAACtB,gBAAgB,GAAGtB,wBAAwB;QACzD,0EAA0E;QAC1E,yEAAyE;QACzE,2EAA2E;QAC3E,4EAA4E;QAC5E,UAAU;QACV6C,OAAO;QACPC,SAAS;YAAC,CAAC,gBAAgB,EAAEd,SAAS;SAAC;QACvCe,UAAU;QACV7B,SAAS;YACPiB;YACAa,UAAU;QACZ;QACAC,WAAW;YAAC1B;SAAiB;IAC/B;IAEA,0EAA0E;IAC1E,2EAA2E;IAC3E,yEAAyE;IACzE,uEAAuE;IACvE,2EAA2E;IAC3E,4EAA4E;IAC5E,IAAID,oBAAoB,SAAS;QAC/BvB,kCAAkCqB,SAAS,SAASE;IACtD;AACF,EAAE"}

package/src/utils/dynamodb-config.d.ts

@@ -0,0 +1,48 @@
+/**
+ * Copyright Amazon.com, Inc. or its affiliates. All Rights Reserved.
+ * SPDX-License-Identifier: Apache-2.0
+ */
+import { type Tree } from '@nx/devkit';
+/** A Global Secondary Index as `config.json` declares it. */
+export interface DynamoDBGlobalSecondaryIndex {
+    readonly indexName: string;
+    readonly partitionKey: string;
+    readonly sortKey?: string;
+}
+export interface DynamoDBLocalDevConfig {
+    readonly port: number;
+    readonly tableName: string;
+    readonly image: string;
+    readonly containerName: string;
+    readonly containerEngine: string;
+}
+export interface DynamoDBConfig {
+    runtimeConfigKey: string;
+    localDev: DynamoDBLocalDevConfig;
+    tableConfig: {
+        globalSecondaryIndexes: DynamoDBGlobalSecondaryIndex[];
+    };
+}
+/** The image the local DynamoDB container runs. */
+export declare const DYNAMODB_LOCAL_IMAGE = "public.ecr.aws/aws-dynamodb-local/aws-dynamodb-local:latest";
+/**
+ * The two overloadable GSIs a new table starts with, following the single-table
+ * design naming convention the guides describe.
+ */
+export declare const DEFAULT_GLOBAL_SECONDARY_INDEXES: DynamoDBGlobalSecondaryIndex[];
+/**
+ * Write a DynamoDB project's `config.json`.
+ *
+ * The file has two halves with different owners, so it is merged rather than
+ * re-emitted whole:
+ *
+ * - `runtimeConfigKey` and `localDev` are derived from the generator's options,
+ *   so they converge on a re-run — changing `--tableName` still takes effect.
+ * - `tableConfig.globalSecondaryIndexes` is the user's, since the guides tell
+ *   them to add an entry per GSI. The defaults seed a new project; an existing
+ *   list is carried through untouched.
+ */
+export declare const writeDynamoDBConfig: (tree: Tree, projectRoot: string, config: {
+    runtimeConfigKey: string;
+    localDev: DynamoDBLocalDevConfig;
+}) => void;

package/src/utils/dynamodb-config.js

@@ -0,0 +1,44 @@
+/**
+ * Copyright Amazon.com, Inc. or its affiliates. All Rights Reserved.
+ * SPDX-License-Identifier: Apache-2.0
+ */ import { joinPathFragments, readJson, writeJson } from "@nx/devkit";
+/** The image the local DynamoDB container runs. */ export const DYNAMODB_LOCAL_IMAGE = 'public.ecr.aws/aws-dynamodb-local/aws-dynamodb-local:latest';
+/**
+ * The two overloadable GSIs a new table starts with, following the single-table
+ * design naming convention the guides describe.
+ */ export const DEFAULT_GLOBAL_SECONDARY_INDEXES = [
+    {
+        indexName: 'gsi1pk-gsi1sk-index',
+        partitionKey: 'gsi1pk',
+        sortKey: 'gsi1sk'
+    },
+    {
+        indexName: 'gsi2pk-gsi2sk-index',
+        partitionKey: 'gsi2pk',
+        sortKey: 'gsi2sk'
+    }
+];
+/**
+ * Write a DynamoDB project's `config.json`.
+ *
+ * The file has two halves with different owners, so it is merged rather than
+ * re-emitted whole:
+ *
+ * - `runtimeConfigKey` and `localDev` are derived from the generator's options,
+ *   so they converge on a re-run — changing `--tableName` still takes effect.
+ * - `tableConfig.globalSecondaryIndexes` is the user's, since the guides tell
+ *   them to add an entry per GSI. The defaults seed a new project; an existing
+ *   list is carried through untouched.
+ */ export const writeDynamoDBConfig = (tree, projectRoot, config)=>{
+    const configPath = joinPathFragments(projectRoot, 'config.json');
+    const existing = tree.exists(configPath) ? readJson(tree, configPath) : {};
+    writeJson(tree, configPath, {
+        runtimeConfigKey: config.runtimeConfigKey,
+        localDev: config.localDev,
+        tableConfig: {
+            globalSecondaryIndexes: existing.tableConfig?.globalSecondaryIndexes ?? DEFAULT_GLOBAL_SECONDARY_INDEXES
+        }
+    });
+};
+
+//# sourceMappingURL=dynamodb-config.js.map

package/src/utils/dynamodb-config.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../../../../../packages/nx-plugin/src/utils/dynamodb-config.ts"],"sourcesContent":["/**\n * Copyright Amazon.com, Inc. or its affiliates. All Rights Reserved.\n * SPDX-License-Identifier: Apache-2.0\n */\nimport { joinPathFragments, readJson, type Tree, writeJson } from '@nx/devkit';\n\n/** A Global Secondary Index as `config.json` declares it. */\nexport interface DynamoDBGlobalSecondaryIndex {\n  readonly indexName: string;\n  readonly partitionKey: string;\n  readonly sortKey?: string;\n}\n\nexport interface DynamoDBLocalDevConfig {\n  readonly port: number;\n  readonly tableName: string;\n  readonly image: string;\n  readonly containerName: string;\n  readonly containerEngine: string;\n}\n\nexport interface DynamoDBConfig {\n  runtimeConfigKey: string;\n  localDev: DynamoDBLocalDevConfig;\n  tableConfig: { globalSecondaryIndexes: DynamoDBGlobalSecondaryIndex[] };\n}\n\n/** The image the local DynamoDB container runs. */\nexport const DYNAMODB_LOCAL_IMAGE =\n  'public.ecr.aws/aws-dynamodb-local/aws-dynamodb-local:latest';\n\n/**\n * The two overloadable GSIs a new table starts with, following the single-table\n * design naming convention the guides describe.\n */\nexport const DEFAULT_GLOBAL_SECONDARY_INDEXES: DynamoDBGlobalSecondaryIndex[] =\n  [\n    {\n      indexName: 'gsi1pk-gsi1sk-index',\n      partitionKey: 'gsi1pk',\n      sortKey: 'gsi1sk',\n    },\n    {\n      indexName: 'gsi2pk-gsi2sk-index',\n      partitionKey: 'gsi2pk',\n      sortKey: 'gsi2sk',\n    },\n  ];\n\n/**\n * Write a DynamoDB project's `config.json`.\n *\n * The file has two halves with different owners, so it is merged rather than\n * re-emitted whole:\n *\n * - `runtimeConfigKey` and `localDev` are derived from the generator's options,\n *   so they converge on a re-run — changing `--tableName` still takes effect.\n * - `tableConfig.globalSecondaryIndexes` is the user's, since the guides tell\n *   them to add an entry per GSI. The defaults seed a new project; an existing\n *   list is carried through untouched.\n */\nexport const writeDynamoDBConfig = (\n  tree: Tree,\n  projectRoot: string,\n  config: {\n    runtimeConfigKey: string;\n    localDev: DynamoDBLocalDevConfig;\n  },\n): void => {\n  const configPath = joinPathFragments(projectRoot, 'config.json');\n  const existing: Partial<DynamoDBConfig> = tree.exists(configPath)\n    ? readJson(tree, configPath)\n    : {};\n\n  writeJson(tree, configPath, {\n    runtimeConfigKey: config.runtimeConfigKey,\n    localDev: config.localDev,\n    tableConfig: {\n      globalSecondaryIndexes:\n        existing.tableConfig?.globalSecondaryIndexes ??\n        DEFAULT_GLOBAL_SECONDARY_INDEXES,\n    },\n  } satisfies DynamoDBConfig);\n};\n"],"names":["joinPathFragments","readJson","writeJson","DYNAMODB_LOCAL_IMAGE","DEFAULT_GLOBAL_SECONDARY_INDEXES","indexName","partitionKey","sortKey","writeDynamoDBConfig","tree","projectRoot","config","configPath","existing","exists","runtimeConfigKey","localDev","tableConfig","globalSecondaryIndexes"],"mappings":"AAAA;;;CAGC,GACD,SAASA,iBAAiB,EAAEC,QAAQ,EAAaC,SAAS,QAAQ,aAAa;AAuB/E,iDAAiD,GACjD,OAAO,MAAMC,uBACX,8DAA8D;AAEhE;;;CAGC,GACD,OAAO,MAAMC,mCACX;IACE;QACEC,WAAW;QACXC,cAAc;QACdC,SAAS;IACX;IACA;QACEF,WAAW;QACXC,cAAc;QACdC,SAAS;IACX;CACD,CAAC;AAEJ;;;;;;;;;;;CAWC,GACD,OAAO,MAAMC,sBAAsB,CACjCC,MACAC,aACAC;IAKA,MAAMC,aAAaZ,kBAAkBU,aAAa;IAClD,MAAMG,WAAoCJ,KAAKK,MAAM,CAACF,cAClDX,SAASQ,MAAMG,cACf,CAAC;IAELV,UAAUO,MAAMG,YAAY;QAC1BG,kBAAkBJ,OAAOI,gBAAgB;QACzCC,UAAUL,OAAOK,QAAQ;QACzBC,aAAa;YACXC,wBACEL,SAASI,WAAW,EAAEC,0BACtBd;QACJ;IACF;AACF,EAAE"}

package/src/utils/dynamodb-constructs/files/cdk/app/dynamodb/__nameKebabCase__.ts.template

@@ -1,8 +1,12 @@
 import { Construct } from 'constructs';
 import { AttributeType, ProjectionType } from 'aws-cdk-lib/aws-dynamodb';
+<%_ /* Alias the core imports only when this table's name would shadow them. */ _%>
+<%_ const collides = nameClassName === 'DynamoDBTable'; _%>
+<%_ const coreTable = collides ? 'CoreDynamoDBTable' : 'DynamoDBTable'; _%>
+<%_ const coreTableProps = collides ? 'CoreDynamoDBTableProps' : 'DynamoDBTableProps'; _%>
 import {
-  DynamoDBTable,
-  DynamoDBTableProps,
+  DynamoDBTable<% if (collides) { %> as <%= coreTable %><% } %>,
+  DynamoDBTableProps<% if (collides) { %> as <%= coreTableProps %><% } %>,
 } from '../../core/dynamodb<% if (esm) { %>.js<% } %>';
 import { findWorkspaceRoot } from '../../core/workspace<% if (esm) { %>.js<% } %>';
 import { readFileSync } from 'fs';
@@ -20,11 +24,11 @@ const { runtimeConfigKey, tableConfig } = JSON.parse(
 ) as { runtimeConfigKey: string; tableConfig: { globalSecondaryIndexes: { indexName: string; partitionKey: string; sortKey?: string }[] } };
 
 export type <%= nameClassName %>Props = Omit<
-  DynamoDBTableProps,
+  <%= coreTableProps %>,
   'runtimeConfigKey'
 >;
 
-export class <%= nameClassName %> extends DynamoDBTable {
+export class <%= nameClassName %> extends <%= coreTable %> {
   constructor(scope: Construct, id: string, props?: <%= nameClassName %>Props) {
     super(scope, id, {
       ...props,

package/src/utils/files/common/shadcn/src/components/ui/alert.tsx.template

@@ -1,7 +1,6 @@
 import * as React from "react"
 import { cva, type VariantProps } from "class-variance-authority"
-
-import { cn } from "#lib/utils"
+import { cn } from "cn"
 
 const alertVariants = cva(
   "relative grid w-full grid-cols-[0_1fr] items-start gap-y-0.5 rounded-lg border px-4 py-3 text-sm has-[>svg]:grid-cols-[calc(var(--spacing)*4)_1fr] has-[>svg]:gap-x-3 [&>svg]:size-4 [&>svg]:translate-y-0.5 [&>svg]:text-current",

package/src/utils/files/common/shadcn/src/components/ui/avatar.tsx.template

@@ -1,10 +1,9 @@
 "use client"
 
 import * as React from "react"
+import { cn } from "cn"
 import { Avatar as AvatarPrimitive } from "radix-ui"
 
-import { cn } from "#lib/utils"
-
 function Avatar({
   className,
   size = "default",

package/src/utils/files/common/shadcn/src/components/ui/breadcrumb.tsx.template

@@ -1,9 +1,8 @@
 import * as React from "react"
+import { cn } from "cn"
 import { ChevronRight, MoreHorizontal } from "lucide-react"
 import { Slot } from "radix-ui"
 
-import { cn } from "#lib/utils"
-
 function Breadcrumb({ ...props }: React.ComponentProps<"nav">) {
   return <nav aria-label="breadcrumb" data-slot="breadcrumb" {...props} />
 }

package/src/utils/files/common/shadcn/src/components/ui/button.tsx.template

@@ -1,9 +1,8 @@
 import * as React from "react"
 import { cva, type VariantProps } from "class-variance-authority"
+import { cn } from "cn"
 import { Slot } from "radix-ui"
 
-import { cn } from "#lib/utils"
-
 const buttonVariants = cva(
   "inline-flex shrink-0 items-center justify-center gap-2 rounded-md text-sm font-medium whitespace-nowrap transition-all outline-none focus-visible:border-ring focus-visible:ring-[3px] focus-visible:ring-ring/50 disabled:pointer-events-none disabled:opacity-50 aria-invalid:border-destructive aria-invalid:ring-destructive/20 dark:aria-invalid:ring-destructive/40 [&_svg]:pointer-events-none [&_svg]:shrink-0 [&_svg:not([class*='size-'])]:size-4",
   {

package/src/utils/files/common/shadcn/src/components/ui/card.tsx.template

@@ -1,6 +1,5 @@
 import * as React from "react"
-
-import { cn } from "#lib/utils"
+import { cn } from "cn"
 
 function Card({ className, ...props }: React.ComponentProps<"div">) {
   return (

package/src/utils/files/common/shadcn/src/components/ui/input.tsx.template

@@ -1,6 +1,5 @@
 import * as React from "react"
-
-import { cn } from "#lib/utils"
+import { cn } from "cn"
 
 function Input({ className, type, ...props }: React.ComponentProps<"input">) {
   return (

package/src/utils/files/common/shadcn/src/components/ui/separator.tsx.template

@@ -1,10 +1,9 @@
 "use client"
 
 import * as React from "react"
+import { cn } from "cn"
 import { Separator as SeparatorPrimitive } from "radix-ui"
 
-import { cn } from "#lib/utils"
-
 function Separator({
   className,
   orientation = "horizontal",

package/src/utils/files/common/shadcn/src/components/ui/sheet.tsx.template

@@ -1,11 +1,10 @@
 "use client"
 
 import * as React from "react"
+import { cn } from "cn"
 import { XIcon } from "lucide-react"
 import { Dialog as SheetPrimitive } from "radix-ui"
 
-import { cn } from "#lib/utils"
-
 function Sheet({ ...props }: React.ComponentProps<typeof SheetPrimitive.Root>) {
   return <SheetPrimitive.Root data-slot="sheet" {...props} />
 }

package/src/utils/files/common/shadcn/src/components/ui/sidebar.tsx.template

@@ -2,11 +2,11 @@
 
 import * as React from "react"
 import { cva, type VariantProps } from "class-variance-authority"
+import { cn } from "cn"
 import { PanelLeftIcon } from "lucide-react"
 import { Slot } from "radix-ui"
 
 import { useIsMobile } from "#hooks/use-mobile"
-import { cn } from "#lib/utils"
 import { Button } from "#components/ui/button"
 import { Input } from "#components/ui/input"
 import { Separator } from "#components/ui/separator"

package/src/utils/files/common/shadcn/src/components/ui/skeleton.tsx.template

@@ -1,4 +1,4 @@
-import { cn } from "#lib/utils"
+import { cn } from "cn"
 
 function Skeleton({ className, ...props }: React.ComponentProps<"div">) {
   return (

package/src/utils/files/common/shadcn/src/components/ui/spinner.tsx.template

@@ -1,7 +1,6 @@
+import { cn } from "cn"
 import { Loader2Icon } from "lucide-react"
 
-import { cn } from "#lib/utils"
-
 function Spinner({ className, ...props }: React.ComponentProps<"svg">) {
   return (
     <Loader2Icon

package/src/utils/files/common/shadcn/src/components/ui/textarea.tsx.template

@@ -1,6 +1,5 @@
 import * as React from "react"
-
-import { cn } from "#lib/utils"
+import { cn } from "cn"
 
 function Textarea({ className, ...props }: React.ComponentProps<"textarea">) {
   return (

package/src/utils/files/common/shadcn/src/components/ui/tooltip.tsx.template

@@ -1,10 +1,9 @@
 "use client"
 
 import * as React from "react"
+import { cn } from "cn"
 import { Tooltip as TooltipPrimitive } from "radix-ui"
 
-import { cn } from "#lib/utils"
-
 function TooltipProvider({
   delayDuration = 0,
   ...props

package/src/utils/files/common/shadcn/src/lib/utils.ts.template

@@ -1,6 +1 @@
-import { clsx, type ClassValue } from 'clsx';
-import { twMerge } from 'tailwind-merge';
-
-export function cn(...inputs: ClassValue[]) {
-  return twMerge(clsx(inputs));
-}
+export { cn } from 'cn';

package/src/utils/git-secrets.d.ts

@@ -0,0 +1,28 @@
+/**
+ * Copyright Amazon.com, Inc. or its affiliates. All Rights Reserved.
+ * SPDX-License-Identifier: Apache-2.0
+ */
+import { type Tree } from '@nx/devkit';
+import { type DependencyDeclaration, type MustDeclare } from './declared-dependencies.js';
+/** Dependencies a caller must declare to set up git-secrets. */
+export declare const GIT_SECRETS_DEPENDENCIES: readonly [{
+    readonly name: "husky";
+}];
+/** The vended script, which the husky pre-commit hook runs. */
+export declare const GIT_SECRETS_SCRIPT = ".git-secrets/git-secrets";
+/**
+ * Patterns allowed so a generated workspace commits cleanly, matched against
+ * `<path>:<line>:<content>`. Only the vended script, whose body contains the
+ * patterns it registers.
+ */
+export declare const GIT_SECRETS_ALLOWED: string[];
+/**
+ * Vend the git-secrets pre-commit hook: the script itself, the husky hook that
+ * runs it, and the allowlist.
+ *
+ * Re-runnable. The vendored script is always rewritten so an upgrade picks up a
+ * newer copy, while everything a user owns is preserved: `.gitallowed` only
+ * gains the entries a generated workspace needs, and an existing `pre-commit`
+ * hook or `prepare` script is left alone and reported rather than replaced.
+ */
+export declare const setUpGitSecrets: <const D extends DependencyDeclaration>(tree: Tree, declaration: D & MustDeclare<typeof GIT_SECRETS_DEPENDENCIES, D>) => void;

package/src/utils/git-secrets.js

@@ -0,0 +1,66 @@
+/**
+ * Copyright Amazon.com, Inc. or its affiliates. All Rights Reserved.
+ * SPDX-License-Identifier: Apache-2.0
+ */ import { joinPathFragments, logger, updateJson } from "@nx/devkit";
+import { readFileSync } from "fs";
+import { forDependencies } from "./declared-dependencies.js";
+import { addDependenciesToPackageJson } from "./dependencies.js";
+import { withVersions } from "./versions.js";
+/** Dependencies a caller must declare to set up git-secrets. */ export const GIT_SECRETS_DEPENDENCIES = [
+    {
+        name: 'husky'
+    }
+];
+/** The vended script, which the husky pre-commit hook runs. */ export const GIT_SECRETS_SCRIPT = '.git-secrets/git-secrets';
+const HUSKY_PRE_COMMIT = '.husky/pre-commit';
+/**
+ * Patterns allowed so a generated workspace commits cleanly, matched against
+ * `<path>:<line>:<content>`. Only the vended script, whose body contains the
+ * patterns it registers.
+ */ export const GIT_SECRETS_ALLOWED = [
+    '\\.git-secrets/git-secrets:'
+];
+/**
+ * Vend the git-secrets pre-commit hook: the script itself, the husky hook that
+ * runs it, and the allowlist.
+ *
+ * Re-runnable. The vendored script is always rewritten so an upgrade picks up a
+ * newer copy, while everything a user owns is preserved: `.gitallowed` only
+ * gains the entries a generated workspace needs, and an existing `pre-commit`
+ * hook or `prepare` script is left alone and reported rather than replaced.
+ */ export const setUpGitSecrets = (tree, declaration)=>{
+    const filesDir = joinPathFragments(import.meta.dirname, '..', 'preset', 'git-secrets-files');
+    tree.write(GIT_SECRETS_SCRIPT, readFileSync(joinPathFragments(filesDir, 'git-secrets-dir', 'git-secrets'), 'utf-8'));
+    const hook = readFileSync(joinPathFragments(filesDir, 'husky-dir', 'pre-commit'), 'utf-8');
+    const existingHook = tree.read(HUSKY_PRE_COMMIT, 'utf-8');
+    if (existingHook === null) {
+        tree.write(HUSKY_PRE_COMMIT, hook);
+    } else if (!existingHook.includes(GIT_SECRETS_SCRIPT)) {
+        logger.warn(`Your ${HUSKY_PRE_COMMIT} was left as-is. To scan staged files for AWS credentials, add:\n\n${hook}`);
+    }
+    // Preserve any entries the user has added, appending only the ones missing.
+    const existingAllowed = tree.read('.gitallowed', 'utf-8')?.split('\n').map((line)=>line.trimEnd()).filter((line)=>line !== '') ?? [];
+    const allowed = [
+        ...existingAllowed,
+        ...GIT_SECRETS_ALLOWED.filter((pattern)=>!existingAllowed.includes(pattern))
+    ];
+    tree.write('.gitallowed', `${allowed.join('\n')}\n`);
+    updateJson(tree, 'package.json', (json)=>{
+        const prepare = json.scripts?.prepare;
+        if (prepare !== undefined && !prepare.includes('husky')) {
+            logger.warn(`Your \`prepare\` script was left as-is. Git hooks are installed by husky, so add \`husky\` to it for the pre-commit hook to run.`);
+        }
+        return {
+            ...json,
+            scripts: {
+                ...json.scripts,
+                prepare: prepare ?? 'husky'
+            }
+        };
+    });
+    addDependenciesToPackageJson(tree, {}, withVersions(forDependencies(declaration), [
+        'husky'
+    ]));
+};
+
+//# sourceMappingURL=git-secrets.js.map

package/src/utils/git-secrets.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../../../../../packages/nx-plugin/src/utils/git-secrets.ts"],"sourcesContent":["/**\n * Copyright Amazon.com, Inc. or its affiliates. All Rights Reserved.\n * SPDX-License-Identifier: Apache-2.0\n */\nimport { joinPathFragments, logger, type Tree, updateJson } from '@nx/devkit';\nimport { readFileSync } from 'fs';\nimport {\n  type DependencyDeclaration,\n  forDependencies,\n  type MustDeclare,\n} from './declared-dependencies.js';\nimport { addDependenciesToPackageJson } from './dependencies.js';\nimport { type ITsDepVersion, withVersions } from './versions.js';\n\n/** Dependencies a caller must declare to set up git-secrets. */\nexport const GIT_SECRETS_DEPENDENCIES = [\n  { name: 'husky' },\n] as const satisfies readonly { name: ITsDepVersion }[];\n\n/** The vended script, which the husky pre-commit hook runs. */\nexport const GIT_SECRETS_SCRIPT = '.git-secrets/git-secrets';\n\nconst HUSKY_PRE_COMMIT = '.husky/pre-commit';\n\n/**\n * Patterns allowed so a generated workspace commits cleanly, matched against\n * `<path>:<line>:<content>`. Only the vended script, whose body contains the\n * patterns it registers.\n */\nexport const GIT_SECRETS_ALLOWED = ['\\\\.git-secrets/git-secrets:'];\n\n/**\n * Vend the git-secrets pre-commit hook: the script itself, the husky hook that\n * runs it, and the allowlist.\n *\n * Re-runnable. The vendored script is always rewritten so an upgrade picks up a\n * newer copy, while everything a user owns is preserved: `.gitallowed` only\n * gains the entries a generated workspace needs, and an existing `pre-commit`\n * hook or `prepare` script is left alone and reported rather than replaced.\n */\nexport const setUpGitSecrets = <const D extends DependencyDeclaration>(\n  tree: Tree,\n  declaration: D & MustDeclare<typeof GIT_SECRETS_DEPENDENCIES, D>,\n) => {\n  const filesDir = joinPathFragments(\n    import.meta.dirname,\n    '..',\n    'preset',\n    'git-secrets-files',\n  );\n\n  tree.write(\n    GIT_SECRETS_SCRIPT,\n    readFileSync(\n      joinPathFragments(filesDir, 'git-secrets-dir', 'git-secrets'),\n      'utf-8',\n    ),\n  );\n\n  const hook = readFileSync(\n    joinPathFragments(filesDir, 'husky-dir', 'pre-commit'),\n    'utf-8',\n  );\n  const existingHook = tree.read(HUSKY_PRE_COMMIT, 'utf-8');\n  if (existingHook === null) {\n    tree.write(HUSKY_PRE_COMMIT, hook);\n  } else if (!existingHook.includes(GIT_SECRETS_SCRIPT)) {\n    logger.warn(\n      `Your ${HUSKY_PRE_COMMIT} was left as-is. To scan staged files for AWS credentials, add:\\n\\n${hook}`,\n    );\n  }\n\n  // Preserve any entries the user has added, appending only the ones missing.\n  const existingAllowed =\n    tree\n      .read('.gitallowed', 'utf-8')\n      ?.split('\\n')\n      .map((line) => line.trimEnd())\n      .filter((line) => line !== '') ?? [];\n  const allowed = [\n    ...existingAllowed,\n    ...GIT_SECRETS_ALLOWED.filter(\n      (pattern) => !existingAllowed.includes(pattern),\n    ),\n  ];\n  tree.write('.gitallowed', `${allowed.join('\\n')}\\n`);\n\n  updateJson(tree, 'package.json', (json) => {\n    const prepare: string | undefined = json.scripts?.prepare;\n    if (prepare !== undefined && !prepare.includes('husky')) {\n      logger.warn(\n        `Your \\`prepare\\` script was left as-is. Git hooks are installed by husky, so add \\`husky\\` to it for the pre-commit hook to run.`,\n      );\n    }\n    return {\n      ...json,\n      scripts: { ...json.scripts, prepare: prepare ?? 'husky' },\n    };\n  });\n\n  addDependenciesToPackageJson(\n    tree,\n    {},\n    withVersions(\n      forDependencies<typeof GIT_SECRETS_DEPENDENCIES>(declaration),\n      ['husky'],\n    ),\n  );\n};\n"],"names":["joinPathFragments","logger","updateJson","readFileSync","forDependencies","addDependenciesToPackageJson","withVersions","GIT_SECRETS_DEPENDENCIES","name","GIT_SECRETS_SCRIPT","HUSKY_PRE_COMMIT","GIT_SECRETS_ALLOWED","setUpGitSecrets","tree","declaration","filesDir","dirname","write","hook","existingHook","read","includes","warn","existingAllowed","split","map","line","trimEnd","filter","allowed","pattern","join","json","prepare","scripts","undefined"],"mappings":"AAAA;;;CAGC,GACD,SAASA,iBAAiB,EAAEC,MAAM,EAAaC,UAAU,QAAQ,aAAa;AAC9E,SAASC,YAAY,QAAQ,KAAK;AAClC,SAEEC,eAAe,QAEV,6BAA6B;AACpC,SAASC,4BAA4B,QAAQ,oBAAoB;AACjE,SAA6BC,YAAY,QAAQ,gBAAgB;AAEjE,8DAA8D,GAC9D,OAAO,MAAMC,2BAA2B;IACtC;QAAEC,MAAM;IAAQ;CACjB,CAAuD;AAExD,6DAA6D,GAC7D,OAAO,MAAMC,qBAAqB,2BAA2B;AAE7D,MAAMC,mBAAmB;AAEzB;;;;CAIC,GACD,OAAO,MAAMC,sBAAsB;IAAC;CAA8B,CAAC;AAEnE;;;;;;;;CAQC,GACD,OAAO,MAAMC,kBAAkB,CAC7BC,MACAC;IAEA,MAAMC,WAAWf,kBACf,YAAYgB,OAAO,EACnB,MACA,UACA;IAGFH,KAAKI,KAAK,CACRR,oBACAN,aACEH,kBAAkBe,UAAU,mBAAmB,gBAC/C;IAIJ,MAAMG,OAAOf,aACXH,kBAAkBe,UAAU,aAAa,eACzC;IAEF,MAAMI,eAAeN,KAAKO,IAAI,CAACV,kBAAkB;IACjD,IAAIS,iBAAiB,MAAM;QACzBN,KAAKI,KAAK,CAACP,kBAAkBQ;IAC/B,OAAO,IAAI,CAACC,aAAaE,QAAQ,CAACZ,qBAAqB;QACrDR,OAAOqB,IAAI,CACT,CAAC,KAAK,EAAEZ,iBAAiB,mEAAmE,EAAEQ,MAAM;IAExG;IAEA,4EAA4E;IAC5E,MAAMK,kBACJV,KACGO,IAAI,CAAC,eAAe,UACnBI,MAAM,MACPC,IAAI,CAACC,OAASA,KAAKC,OAAO,IAC1BC,OAAO,CAACF,OAASA,SAAS,OAAO,EAAE;IACxC,MAAMG,UAAU;WACXN;WACAZ,oBAAoBiB,MAAM,CAC3B,CAACE,UAAY,CAACP,gBAAgBF,QAAQ,CAACS;KAE1C;IACDjB,KAAKI,KAAK,CAAC,eAAe,GAAGY,QAAQE,IAAI,CAAC,MAAM,EAAE,CAAC;IAEnD7B,WAAWW,MAAM,gBAAgB,CAACmB;QAChC,MAAMC,UAA8BD,KAAKE,OAAO,EAAED;QAClD,IAAIA,YAAYE,aAAa,CAACF,QAAQZ,QAAQ,CAAC,UAAU;YACvDpB,OAAOqB,IAAI,CACT,CAAC,gIAAgI,CAAC;QAEtI;QACA,OAAO;YACL,GAAGU,IAAI;YACPE,SAAS;gBAAE,GAAGF,KAAKE,OAAO;gBAAED,SAASA,WAAW;YAAQ;QAC1D;IACF;IAEA5B,6BACEQ,MACA,CAAC,GACDP,aACEF,gBAAiDU,cACjD;QAAC;KAAQ;AAGf,EAAE"}

package/src/utils/init.js

@@ -256,12 +256,13 @@ export const PNPM_BUILT_DEPENDENCIES = [
                 ...packageJson.scripts
             }
         }));
-    // Pin the workspace's `nx` to the version the plugin's @nx/* packages are
-    // built against. A mismatched workspace nx (even a patch apart) hoists a
-    // second nested nx under @nx/js, and the two instances deadlock `nx sync`.
-    // `@nx/js` must be a root dependency for the `@nx/js:typescript-sync`
-    // generator registered in nx.json to resolve (npm doesn't hoist the
-    // plugin's own copy reliably).
+    // Declare the `nx` version the plugin's @nx/* packages are built against. A
+    // mismatched workspace nx (even a patch apart) hoists a second nested nx
+    // under @nx/js, and the two instances deadlock `nx sync` — but a workspace
+    // already on a newer nx keeps it, since devkit never downgrades an existing
+    // range. `@nx/js` must be a root dependency for the
+    // `@nx/js:typescript-sync` generator registered in nx.json to resolve (npm
+    // doesn't hoist the plugin's own copy reliably).
     addDependenciesToPackageJson(tree, {}, {
         ...withVersions(forDependencies(declaration), [
             'nx',

package/src/utils/init.js.map

@@ -1 +1 @@
-{"version":3,"sources":["../../../../../packages/nx-plugin/src/utils/init.ts"],"sourcesContent":["/**\n * Copyright Amazon.com, Inc. or its affiliates. All Rights Reserved.\n * SPDX-License-Identifier: Apache-2.0\n */\nimport {\n  generateFiles,\n  joinPathFragments,\n  OverwriteStrategy,\n  readNxJson,\n  type Tree,\n  updateJson,\n  updateNxJson,\n} from '@nx/devkit';\nimport { initGenerator } from '@nx/js';\nimport { readFileSync } from 'fs';\nimport yaml from 'js-yaml';\nimport { SYNC_GENERATOR_NAME as TS_SYNC_GENERATOR_NAME } from '../ts/sync/generator.js';\nimport { BASE_TSCONFIG_COMPILER_OPTIONS } from './base-tsconfig.js';\nimport {\n  ensureAwsNxPluginConfig,\n  updateAwsNxPluginConfig,\n} from './config/utils.js';\nimport { type Containers, inferContainers } from './containers.js';\nimport {\n  type DependencyDeclaration,\n  forDependencies,\n  type MustDeclare,\n} from './declared-dependencies.js';\nimport {\n  addDependenciesToPackageJson,\n  detectWorkspacePackageManager,\n} from './dependencies.js';\nimport { getDefaultBiomeConfig } from './format.js';\nimport {\n  describeGeneratorForCatalogue,\n  generatorsJsonEntries,\n} from './generators.js';\nimport { updateGitIgnore } from './git.js';\nimport type { Iac } from './iac.js';\nimport { configureMcpServers } from './mcp.js';\nimport { getNpmScope } from './npm-scope.js';\nimport {\n  mergeTargetDefault,\n  nxPluginMcpDependency,\n  nxPluginSelfDependency,\n} from './nx.js';\nimport { getPackageManagerDisplayCommands } from './pkg-manager.js';\nimport { workspaceGlobs } from './project-package-json.js';\nimport { type ITsDepVersion, withVersions } from './versions.js';\n\nconst WORKSPACES = ['packages/*'];\nconst NX_TYPESCRIPT_SYNC_GENERATOR = '@nx/js:typescript-sync';\n\nexport const DEFAULT_PARALLEL = 8;\n\n/** Dependencies a caller must declare to apply the workspace init. */\nexport const INIT_DEPENDENCIES = [\n  { name: 'nx' },\n  { name: '@nx/js' },\n  { name: '@nx/workspace' },\n  { name: 'typescript' },\n  { name: '@biomejs/biome' },\n] as const satisfies readonly { name: ITsDepVersion }[];\n\n// Built dependencies whose install scripts the generated workspace trusts.\n// `onlyBuiltDependencies` is the pnpm 10 key (silently ignored from pnpm 11\n// onwards); pnpm 11 and above read `allowBuilds` instead. Any dep NOT in this\n// allowlist will have its install scripts skipped with a warning — matching\n// pnpm 10's default behaviour. The user can opt-in later via\n// `pnpm approve-builds`.\nexport const PNPM_BUILT_DEPENDENCIES = ['@swc/core', 'esbuild', 'nx', 'sharp'];\n\n/**\n * Options controlling how the workspace is initialised. These mirror the\n * preset schema so a workspace created via the preset and one initialised via\n * the `init` generator end up in the same shape.\n */\nexport interface ApplyWorkspaceInitOptions {\n  /** The IaC provider to record in the plugin config. */\n  readonly iac: Iac;\n  /**\n   * The container engine to record. `undefined`/`'infer'` picks docker when\n   * installed, else finch.\n   */\n  readonly containers?: Containers | 'infer';\n  /** Whether to configure MCP servers for coding agents. Defaults to true. */\n  readonly mcp?: boolean;\n  /**\n   * How to treat the generated workspace README. The preset owns the README of\n   * a greenfield workspace (`Overwrite`); the `init` generator must not clobber\n   * an existing workspace's README (`KeepExisting`, the default).\n   */\n  readonly readmeOverwriteStrategy?: OverwriteStrategy;\n  /**\n   * Whether to overwrite root package.json scripts that already exist. The\n   * preset owns a greenfield workspace's scripts (`true`); the `init`\n   * generator must not clobber an existing workspace's scripts (`false`,\n   * the default) — it only adds the convenience scripts that are absent.\n   */\n  readonly overwriteScripts?: boolean;\n  /**\n   * Whether generators use the package manager's dependency catalog. On pnpm\n   * this also sets `catalogMode: strict` so `pnpm add` records new deps in the\n   * catalog. Defaults to true.\n   */\n  readonly catalogs?: boolean;\n}\n\n/**\n * Add or repair the pnpm `allowBuilds` / `onlyBuiltDependencies` allowlist for\n * the workspace's `packages` globs, without clobbering any packages the user\n * has already declared.\n *\n * A workspace not created by the preset commonly has either no\n * `pnpm-workspace.yaml`, one missing the `packages` globs, or one carrying the\n * broken `set this to true or false` placeholder pnpm writes when it skips a\n * build script. This makes the file self-consistent so the first generator's\n * install doesn't fail with `ERR_PNPM_IGNORED_BUILDS`.\n */\nconst setUpPnpmWorkspace = (tree: Tree, catalogs: boolean) => {\n  const existing = tree.exists('pnpm-workspace.yaml')\n    ? ((yaml.load(tree.read('pnpm-workspace.yaml', 'utf-8') ?? '') as Record<\n        string,\n        unknown\n      >) ?? {})\n    : {};\n\n  // Preserve any packages globs the user already has, ensuring ours are present.\n  const packages = Array.from(\n    new Set([...((existing.packages as string[]) ?? []), ...WORKSPACES]),\n  );\n\n  const allowBuilds = {\n    ...(typeof existing.allowBuilds === 'object' && existing.allowBuilds\n      ? (existing.allowBuilds as Record<string, unknown>)\n      : {}),\n    // Overwrite any non-boolean (e.g. the \"set this to true or false\"\n    // placeholder) with an explicit true for the deps we trust.\n    ...Object.fromEntries(PNPM_BUILT_DEPENDENCIES.map((dep) => [dep, true])),\n  };\n\n  // `strict` makes `pnpm add` record new deps in the catalog; it only gates\n  // that flow, so pre-declared direct ranges (e.g. tslib) still install.\n  // Preserve an explicit user choice.\n  const catalogMode = catalogs\n    ? (existing.catalogMode ?? 'strict')\n    : existing.catalogMode;\n\n  tree.write(\n    'pnpm-workspace.yaml',\n    yaml.dump(\n      {\n        ...existing,\n        packages,\n        allowBuilds,\n        onlyBuiltDependencies: PNPM_BUILT_DEPENDENCIES,\n        ...(catalogMode ? { catalogMode } : {}),\n      },\n      { quotingType: \"'\" },\n    ),\n  );\n};\n\n/**\n * Configure the workspace's package manager for a monorepo layout.\n *\n * pnpm workspaces are declared in `pnpm-workspace.yaml`; every other package\n * manager reads the `workspaces` field of the root `package.json`.\n */\nconst setUpWorkspaces = (tree: Tree, catalogs: boolean) => {\n  if (detectWorkspacePackageManager(tree) === 'pnpm') {\n    setUpPnpmWorkspace(tree, catalogs);\n    // pnpm creates these at the workspace root while it materialises packages.\n    updateGitIgnore(tree, '.', (patterns) => [...patterns, '_tmp_*']);\n  } else {\n    updateJson(tree, 'package.json', (json) => {\n      // The `workspaces` field may be the object form ({ \"packages\": [...] })\n      // accepted by yarn and bun — extend the globs while preserving the form.\n      const globs = Array.from(\n        new Set([...workspaceGlobs(json.workspaces), ...WORKSPACES]),\n      );\n      return {\n        ...json,\n        workspaces:\n          json.workspaces !== undefined && !Array.isArray(json.workspaces)\n            ? { ...json.workspaces, packages: globs }\n            : globs,\n      };\n    });\n  }\n};\n\n/**\n * Ensure the workspace has a `tsconfig.base.json`.\n *\n * `@nx/js` `initGenerator` (with `addTsPlugin`) normally creates this, but it\n * short-circuits when the workspace already has a root `tsconfig.json` — in\n * which case no base file is written and the next project generator fails with\n * `Cannot find tsconfig.base.json`. So we create a compatible one when it's\n * absent. An existing base is left untouched: the user may have tuned it, and\n * rewriting shared compiler options can break other projects (see the\n * \"add to an existing workspace\" guide).\n */\nconst ensureBaseTsConfig = (tree: Tree) => {\n  if (tree.exists('tsconfig.base.json')) {\n    return;\n  }\n  tree.write(\n    'tsconfig.base.json',\n    JSON.stringify(\n      {\n        compilerOptions: {\n          ...BASE_TSCONFIG_COMPILER_OPTIONS,\n          customConditions: [getNpmScope(tree)],\n        },\n      },\n      null,\n      2,\n    ),\n  );\n};\n\n/**\n * Ensure the workspace has a root `tsconfig.json`.\n *\n * Nx's `@nx/js:typescript-sync` generator hard-fails with\n * `Missing root \"tsconfig.json\"` when it's absent. The plugin's TypeScript\n * projects reference each other via this file, so we guarantee a minimal one\n * exists (sync populates its `references`).\n */\nconst ensureRootTsConfig = (tree: Tree) => {\n  if (tree.exists('tsconfig.json')) {\n    return;\n  }\n  tree.write(\n    'tsconfig.json',\n    JSON.stringify(\n      {\n        extends: './tsconfig.base.json',\n        files: [],\n        references: [],\n      },\n      null,\n      2,\n    ),\n  );\n};\n\n/**\n * Transform an Nx workspace into one ready to run `@aws/nx-plugin` generators.\n *\n * This is the deterministic core shared by the workspace preset and the `init`\n * generator. It is safe to re-run: every step is idempotent (config merges,\n * keyed nx.json / package.json entries, create-if-missing files), so running\n * it against an already-initialised workspace is a no-op.\n *\n * It preserves the workspace's module format: the root package.json `type`\n * field is owned by the preset (written from its `--module` option) and left\n * untouched here. It does NOT rewrite an existing `tsconfig.base.json`'s\n * compiler options, migrate a workspace's package manager, or restructure\n * existing projects — those are decisions for the user (see the \"add to an\n * existing workspace\" guide).\n */\nexport const applyWorkspaceInit = async <const D extends DependencyDeclaration>(\n  tree: Tree,\n  {\n    iac,\n    containers,\n    mcp,\n    readmeOverwriteStrategy = OverwriteStrategy.KeepExisting,\n    overwriteScripts = false,\n    catalogs = true,\n  }: ApplyWorkspaceInitOptions,\n  declaration: D & MustDeclare<typeof INIT_DEPENDENCIES, D>,\n) => {\n  const resolvedContainers =\n    !containers || containers === 'infer' ? inferContainers() : containers;\n\n  // The catalogs flag is written explicitly (even when true) so the workspace\n  // records its dependency-management choice.\n  await ensureAwsNxPluginConfig(tree);\n  await updateAwsNxPluginConfig(tree, {\n    iac: { provider: iac },\n    containers: { engine: resolvedContainers },\n    packageManager: { catalogs },\n  });\n\n  // Set up the TypeScript plugin, base tsconfig, formatter etc. `@nx/js`\n  // creates `tsconfig.base.json` when absent, but skips it when a root\n  // `tsconfig.json` already exists — so we ensure both explicitly below.\n  await initGenerator(tree, {\n    formatter: 'none',\n    addTsPlugin: true,\n  });\n\n  ensureBaseTsConfig(tree);\n  ensureRootTsConfig(tree);\n\n  setUpWorkspaces(tree, catalogs);\n\n  const nxJson = readNxJson(tree);\n  updateNxJson(tree, {\n    ...nxJson,\n    // Preserve an explicit analytics choice in an existing workspace.\n    analytics: (nxJson as { analytics?: boolean }).analytics ?? false,\n    parallel: nxJson.parallel ?? DEFAULT_PARALLEL,\n    targetDefaults: {\n      ...nxJson.targetDefaults,\n      compile: mergeTargetDefault(nxJson.targetDefaults?.compile, (base) => ({\n        ...base,\n        syncGenerators: [\n          ...(base.syncGenerators ?? []).filter(\n            (g) =>\n              ![TS_SYNC_GENERATOR_NAME, NX_TYPESCRIPT_SYNC_GENERATOR].includes(\n                g,\n              ),\n          ),\n          NX_TYPESCRIPT_SYNC_GENERATOR,\n          TS_SYNC_GENERATOR_NAME,\n        ],\n      })),\n    },\n  });\n\n  const CONVENIENCE_SCRIPTS = {\n    dev: 'nx run-many --target dev',\n    build: 'nx run-many --target build',\n    lint: 'nx run-many --target lint --configuration=fix',\n    test: 'nx run-many --target test --all',\n    // Trivy container image scanning is not part of `build` (its result\n    // depends on the ever-changing vulnerability database); run it explicitly,\n    // e.g. in CI.\n    trivy: 'nx run-many --target trivy --all',\n    'build:skip-lint': 'nx run-many --target build --configuration=skip-lint',\n    'build:all': 'nx run-many --target build --all',\n    'affected:all': 'nx affected --target build',\n  };\n  updateJson(tree, 'package.json', (packageJson) => ({\n    ...packageJson,\n    // The root `type` field is owned by the preset (written explicitly from\n    // its `--module` option). `init` preserves an existing workspace's field\n    // as-is: an ESM workspace already carries `type: \"module\"` (that is how\n    // the format is inferred), and introducing a `type` into a CommonJS\n    // workspace that lacks one changes behaviour for frameworks that parse it\n    // (e.g. Next.js starts treating the app's ESM source as CJS).\n    scripts: overwriteScripts\n      ? { ...packageJson.scripts, ...CONVENIENCE_SCRIPTS }\n      : { ...CONVENIENCE_SCRIPTS, ...packageJson.scripts },\n  }));\n\n  // Pin the workspace's `nx` to the version the plugin's @nx/* packages are\n  // built against. A mismatched workspace nx (even a patch apart) hoists a\n  // second nested nx under @nx/js, and the two instances deadlock `nx sync`.\n  // `@nx/js` must be a root dependency for the `@nx/js:typescript-sync`\n  // generator registered in nx.json to resolve (npm doesn't hoist the\n  // plugin's own copy reliably).\n  addDependenciesToPackageJson(\n    tree,\n    {},\n    {\n      ...withVersions(forDependencies<typeof INIT_DEPENDENCIES>(declaration), [\n        'nx',\n        '@nx/js',\n        '@nx/workspace',\n      ]),\n      ...withVersions(forDependencies<typeof INIT_DEPENDENCIES>(declaration), [\n        'typescript',\n        '@biomejs/biome',\n      ]),\n      // Declare the plugin the generators are running from, plus the MCP server\n      // package the vended config runs, so both are pinned in the workspace's\n      // lockfile and upgrading them upgrades what the agents use.\n      ...nxPluginSelfDependency(tree),\n      ...nxPluginMcpDependency(tree),\n    },\n  );\n\n  // Write biome.json for formatting and linting\n  if (!tree.exists('biome.json')) {\n    tree.write(\n      'biome.json',\n      JSON.stringify(getDefaultBiomeConfig(tree), null, 2),\n    );\n  }\n\n  generateFiles(\n    tree, // the virtual file system\n    joinPathFragments(import.meta.dirname, '..', 'preset', 'files'),\n    '.',\n    {\n      projectName: getNpmScope(tree),\n      generators: Object.entries(generatorsJsonEntries)\n        .filter(([, info]) => !info.hidden)\n        .map(([id, info]) => ({\n          name: id,\n          description: describeGeneratorForCatalogue(info),\n        })),\n      ...(() => {\n        const cmds = getPackageManagerDisplayCommands();\n        return {\n          pkgMgrCmd: cmds.exec,\n          buildCmd: `${cmds.run} build`,\n          lintCmd: `${cmds.run} lint`,\n        };\n      })(),\n    },\n    {\n      overwriteStrategy: readmeOverwriteStrategy,\n    },\n  );\n\n  if (mcp !== false) {\n    configureMcpServers(tree);\n  }\n};\n"],"names":["generateFiles","joinPathFragments","OverwriteStrategy","readNxJson","updateJson","updateNxJson","initGenerator","yaml","SYNC_GENERATOR_NAME","TS_SYNC_GENERATOR_NAME","BASE_TSCONFIG_COMPILER_OPTIONS","ensureAwsNxPluginConfig","updateAwsNxPluginConfig","inferContainers","forDependencies","addDependenciesToPackageJson","detectWorkspacePackageManager","getDefaultBiomeConfig","describeGeneratorForCatalogue","generatorsJsonEntries","updateGitIgnore","configureMcpServers","getNpmScope","mergeTargetDefault","nxPluginMcpDependency","nxPluginSelfDependency","getPackageManagerDisplayCommands","workspaceGlobs","withVersions","WORKSPACES","NX_TYPESCRIPT_SYNC_GENERATOR","DEFAULT_PARALLEL","INIT_DEPENDENCIES","name","PNPM_BUILT_DEPENDENCIES","setUpPnpmWorkspace","tree","catalogs","existing","exists","load","read","packages","Array","from","Set","allowBuilds","Object","fromEntries","map","dep","catalogMode","write","dump","onlyBuiltDependencies","quotingType","setUpWorkspaces","patterns","json","globs","workspaces","undefined","isArray","ensureBaseTsConfig","JSON","stringify","compilerOptions","customConditions","ensureRootTsConfig","extends","files","references","applyWorkspaceInit","iac","containers","mcp","readmeOverwriteStrategy","KeepExisting","overwriteScripts","declaration","resolvedContainers","provider","engine","packageManager","formatter","addTsPlugin","nxJson","analytics","parallel","targetDefaults","compile","base","syncGenerators","filter","g","includes","CONVENIENCE_SCRIPTS","dev","build","lint","test","trivy","packageJson","scripts","dirname","projectName","generators","entries","info","hidden","id","description","cmds","pkgMgrCmd","exec","buildCmd","run","lintCmd","overwriteStrategy"],"mappings":"AAAA;;;CAGC,GACD,SACEA,aAAa,EACbC,iBAAiB,EACjBC,iBAAiB,EACjBC,UAAU,EAEVC,UAAU,EACVC,YAAY,QACP,aAAa;AACpB,SAASC,aAAa,QAAQ,SAAS;AAEvC,OAAOC,UAAU,UAAU;AAC3B,SAASC,uBAAuBC,sBAAsB,QAAQ,0BAA0B;AACxF,SAASC,8BAA8B,QAAQ,qBAAqB;AACpE,SACEC,uBAAuB,EACvBC,uBAAuB,QAClB,oBAAoB;AAC3B,SAA0BC,eAAe,QAAQ,kBAAkB;AACnE,SAEEC,eAAe,QAEV,6BAA6B;AACpC,SACEC,4BAA4B,EAC5BC,6BAA6B,QACxB,oBAAoB;AAC3B,SAASC,qBAAqB,QAAQ,cAAc;AACpD,SACEC,6BAA6B,EAC7BC,qBAAqB,QAChB,kBAAkB;AACzB,SAASC,eAAe,QAAQ,WAAW;AAE3C,SAASC,mBAAmB,QAAQ,WAAW;AAC/C,SAASC,WAAW,QAAQ,iBAAiB;AAC7C,SACEC,kBAAkB,EAClBC,qBAAqB,EACrBC,sBAAsB,QACjB,UAAU;AACjB,SAASC,gCAAgC,QAAQ,mBAAmB;AACpE,SAASC,cAAc,QAAQ,4BAA4B;AAC3D,SAA6BC,YAAY,QAAQ,gBAAgB;AAEjE,MAAMC,aAAa;IAAC;CAAa;AACjC,MAAMC,+BAA+B;AAErC,OAAO,MAAMC,mBAAmB,EAAE;AAElC,oEAAoE,GACpE,OAAO,MAAMC,oBAAoB;IAC/B;QAAEC,MAAM;IAAK;IACb;QAAEA,MAAM;IAAS;IACjB;QAAEA,MAAM;IAAgB;IACxB;QAAEA,MAAM;IAAa;IACrB;QAAEA,MAAM;IAAiB;CAC1B,CAAuD;AAExD,2EAA2E;AAC3E,4EAA4E;AAC5E,8EAA8E;AAC9E,4EAA4E;AAC5E,6DAA6D;AAC7D,yBAAyB;AACzB,OAAO,MAAMC,0BAA0B;IAAC;IAAa;IAAW;IAAM;CAAQ,CAAC;AAsC/E;;;;;;;;;;CAUC,GACD,MAAMC,qBAAqB,CAACC,MAAYC;IACtC,MAAMC,WAAWF,KAAKG,MAAM,CAAC,yBACxB,AAAChC,KAAKiC,IAAI,CAACJ,KAAKK,IAAI,CAAC,uBAAuB,YAAY,OAGnD,CAAC,IACP,CAAC;IAEL,+EAA+E;IAC/E,MAAMC,WAAWC,MAAMC,IAAI,CACzB,IAAIC,IAAI;WAAK,AAACP,SAASI,QAAQ,IAAiB,EAAE;WAAMb;KAAW;IAGrE,MAAMiB,cAAc;QAClB,GAAI,OAAOR,SAASQ,WAAW,KAAK,YAAYR,SAASQ,WAAW,GAC/DR,SAASQ,WAAW,GACrB,CAAC,CAAC;QACN,kEAAkE;QAClE,4DAA4D;QAC5D,GAAGC,OAAOC,WAAW,CAACd,wBAAwBe,GAAG,CAAC,CAACC,MAAQ;gBAACA;gBAAK;aAAK,EAAE;IAC1E;IAEA,0EAA0E;IAC1E,uEAAuE;IACvE,oCAAoC;IACpC,MAAMC,cAAcd,WACfC,SAASa,WAAW,IAAI,WACzBb,SAASa,WAAW;IAExBf,KAAKgB,KAAK,CACR,uBACA7C,KAAK8C,IAAI,CACP;QACE,GAAGf,QAAQ;QACXI;QACAI;QACAQ,uBAAuBpB;QACvB,GAAIiB,cAAc;YAAEA;QAAY,IAAI,CAAC,CAAC;IACxC,GACA;QAAEI,aAAa;IAAI;AAGzB;AAEA;;;;;CAKC,GACD,MAAMC,kBAAkB,CAACpB,MAAYC;IACnC,IAAIrB,8BAA8BoB,UAAU,QAAQ;QAClDD,mBAAmBC,MAAMC;QACzB,2EAA2E;QAC3EjB,gBAAgBgB,MAAM,KAAK,CAACqB,WAAa;mBAAIA;gBAAU;aAAS;IAClE,OAAO;QACLrD,WAAWgC,MAAM,gBAAgB,CAACsB;YAChC,wEAAwE;YACxE,yEAAyE;YACzE,MAAMC,QAAQhB,MAAMC,IAAI,CACtB,IAAIC,IAAI;mBAAIlB,eAAe+B,KAAKE,UAAU;mBAAM/B;aAAW;YAE7D,OAAO;gBACL,GAAG6B,IAAI;gBACPE,YACEF,KAAKE,UAAU,KAAKC,aAAa,CAAClB,MAAMmB,OAAO,CAACJ,KAAKE,UAAU,IAC3D;oBAAE,GAAGF,KAAKE,UAAU;oBAAElB,UAAUiB;gBAAM,IACtCA;YACR;QACF;IACF;AACF;AAEA;;;;;;;;;;CAUC,GACD,MAAMI,qBAAqB,CAAC3B;IAC1B,IAAIA,KAAKG,MAAM,CAAC,uBAAuB;QACrC;IACF;IACAH,KAAKgB,KAAK,CACR,sBACAY,KAAKC,SAAS,CACZ;QACEC,iBAAiB;YACf,GAAGxD,8BAA8B;YACjCyD,kBAAkB;gBAAC7C,YAAYc;aAAM;QACvC;IACF,GACA,MACA;AAGN;AAEA;;;;;;;CAOC,GACD,MAAMgC,qBAAqB,CAAChC;IAC1B,IAAIA,KAAKG,MAAM,CAAC,kBAAkB;QAChC;IACF;IACAH,KAAKgB,KAAK,CACR,iBACAY,KAAKC,SAAS,CACZ;QACEI,SAAS;QACTC,OAAO,EAAE;QACTC,YAAY,EAAE;IAChB,GACA,MACA;AAGN;AAEA;;;;;;;;;;;;;;CAcC,GACD,OAAO,MAAMC,qBAAqB,OAChCpC,MACA,EACEqC,GAAG,EACHC,UAAU,EACVC,GAAG,EACHC,0BAA0B1E,kBAAkB2E,YAAY,EACxDC,mBAAmB,KAAK,EACxBzC,WAAW,IAAI,EACW,EAC5B0C;IAEA,MAAMC,qBACJ,CAACN,cAAcA,eAAe,UAAU7D,oBAAoB6D;IAE9D,4EAA4E;IAC5E,4CAA4C;IAC5C,MAAM/D,wBAAwByB;IAC9B,MAAMxB,wBAAwBwB,MAAM;QAClCqC,KAAK;YAAEQ,UAAUR;QAAI;QACrBC,YAAY;YAAEQ,QAAQF;QAAmB;QACzCG,gBAAgB;YAAE9C;QAAS;IAC7B;IAEA,uEAAuE;IACvE,qEAAqE;IACrE,uEAAuE;IACvE,MAAM/B,cAAc8B,MAAM;QACxBgD,WAAW;QACXC,aAAa;IACf;IAEAtB,mBAAmB3B;IACnBgC,mBAAmBhC;IAEnBoB,gBAAgBpB,MAAMC;IAEtB,MAAMiD,SAASnF,WAAWiC;IAC1B/B,aAAa+B,MAAM;QACjB,GAAGkD,MAAM;QACT,kEAAkE;QAClEC,WAAW,AAACD,OAAmCC,SAAS,IAAI;QAC5DC,UAAUF,OAAOE,QAAQ,IAAIzD;QAC7B0D,gBAAgB;YACd,GAAGH,OAAOG,cAAc;YACxBC,SAASnE,mBAAmB+D,OAAOG,cAAc,EAAEC,SAAS,CAACC,OAAU,CAAA;oBACrE,GAAGA,IAAI;oBACPC,gBAAgB;2BACX,AAACD,CAAAA,KAAKC,cAAc,IAAI,EAAE,AAAD,EAAGC,MAAM,CACnC,CAACC,IACC,CAAC;gCAACrF;gCAAwBqB;6BAA6B,CAACiE,QAAQ,CAC9DD;wBAGNhE;wBACArB;qBACD;gBACH,CAAA;QACF;IACF;IAEA,MAAMuF,sBAAsB;QAC1BC,KAAK;QACLC,OAAO;QACPC,MAAM;QACNC,MAAM;QACN,oEAAoE;QACpE,2EAA2E;QAC3E,cAAc;QACdC,OAAO;QACP,mBAAmB;QACnB,aAAa;QACb,gBAAgB;IAClB;IACAjG,WAAWgC,MAAM,gBAAgB,CAACkE,cAAiB,CAAA;YACjD,GAAGA,WAAW;YACd,wEAAwE;YACxE,yEAAyE;YACzE,wEAAwE;YACxE,oEAAoE;YACpE,0EAA0E;YAC1E,8DAA8D;YAC9DC,SAASzB,mBACL;gBAAE,GAAGwB,YAAYC,OAAO;gBAAE,GAAGP,mBAAmB;YAAC,IACjD;gBAAE,GAAGA,mBAAmB;gBAAE,GAAGM,YAAYC,OAAO;YAAC;QACvD,CAAA;IAEA,0EAA0E;IAC1E,yEAAyE;IACzE,2EAA2E;IAC3E,sEAAsE;IACtE,oEAAoE;IACpE,+BAA+B;IAC/BxF,6BACEqB,MACA,CAAC,GACD;QACE,GAAGR,aAAad,gBAA0CiE,cAAc;YACtE;YACA;YACA;SACD,CAAC;QACF,GAAGnD,aAAad,gBAA0CiE,cAAc;YACtE;YACA;SACD,CAAC;QACF,0EAA0E;QAC1E,wEAAwE;QACxE,4DAA4D;QAC5D,GAAGtD,uBAAuBW,KAAK;QAC/B,GAAGZ,sBAAsBY,KAAK;IAChC;IAGF,8CAA8C;IAC9C,IAAI,CAACA,KAAKG,MAAM,CAAC,eAAe;QAC9BH,KAAKgB,KAAK,CACR,cACAY,KAAKC,SAAS,CAAChD,sBAAsBmB,OAAO,MAAM;IAEtD;IAEApC,cACEoC,MACAnC,kBAAkB,YAAYuG,OAAO,EAAE,MAAM,UAAU,UACvD,KACA;QACEC,aAAanF,YAAYc;QACzBsE,YAAY3D,OAAO4D,OAAO,CAACxF,uBACxB0E,MAAM,CAAC,CAAC,GAAGe,KAAK,GAAK,CAACA,KAAKC,MAAM,EACjC5D,GAAG,CAAC,CAAC,CAAC6D,IAAIF,KAAK,GAAM,CAAA;gBACpB3E,MAAM6E;gBACNC,aAAa7F,8BAA8B0F;YAC7C,CAAA;QACF,GAAG,AAAC,CAAA;YACF,MAAMI,OAAOtF;YACb,OAAO;gBACLuF,WAAWD,KAAKE,IAAI;gBACpBC,UAAU,GAAGH,KAAKI,GAAG,CAAC,MAAM,CAAC;gBAC7BC,SAAS,GAAGL,KAAKI,GAAG,CAAC,KAAK,CAAC;YAC7B;QACF,CAAA,GAAI;IACN,GACA;QACEE,mBAAmB1C;IACrB;IAGF,IAAID,QAAQ,OAAO;QACjBtD,oBAAoBe;IACtB;AACF,EAAE"}
+{"version":3,"sources":["../../../../../packages/nx-plugin/src/utils/init.ts"],"sourcesContent":["/**\n * Copyright Amazon.com, Inc. or its affiliates. All Rights Reserved.\n * SPDX-License-Identifier: Apache-2.0\n */\nimport {\n  generateFiles,\n  joinPathFragments,\n  OverwriteStrategy,\n  readNxJson,\n  type Tree,\n  updateJson,\n  updateNxJson,\n} from '@nx/devkit';\nimport { initGenerator } from '@nx/js';\nimport { readFileSync } from 'fs';\nimport yaml from 'js-yaml';\nimport { SYNC_GENERATOR_NAME as TS_SYNC_GENERATOR_NAME } from '../ts/sync/generator.js';\nimport { BASE_TSCONFIG_COMPILER_OPTIONS } from './base-tsconfig.js';\nimport {\n  ensureAwsNxPluginConfig,\n  updateAwsNxPluginConfig,\n} from './config/utils.js';\nimport { type Containers, inferContainers } from './containers.js';\nimport {\n  type DependencyDeclaration,\n  forDependencies,\n  type MustDeclare,\n} from './declared-dependencies.js';\nimport {\n  addDependenciesToPackageJson,\n  detectWorkspacePackageManager,\n} from './dependencies.js';\nimport { getDefaultBiomeConfig } from './format.js';\nimport {\n  describeGeneratorForCatalogue,\n  generatorsJsonEntries,\n} from './generators.js';\nimport { updateGitIgnore } from './git.js';\nimport type { Iac } from './iac.js';\nimport { configureMcpServers } from './mcp.js';\nimport { getNpmScope } from './npm-scope.js';\nimport {\n  mergeTargetDefault,\n  nxPluginMcpDependency,\n  nxPluginSelfDependency,\n} from './nx.js';\nimport { getPackageManagerDisplayCommands } from './pkg-manager.js';\nimport { workspaceGlobs } from './project-package-json.js';\nimport { type ITsDepVersion, withVersions } from './versions.js';\n\nconst WORKSPACES = ['packages/*'];\nconst NX_TYPESCRIPT_SYNC_GENERATOR = '@nx/js:typescript-sync';\n\nexport const DEFAULT_PARALLEL = 8;\n\n/** Dependencies a caller must declare to apply the workspace init. */\nexport const INIT_DEPENDENCIES = [\n  { name: 'nx' },\n  { name: '@nx/js' },\n  { name: '@nx/workspace' },\n  { name: 'typescript' },\n  { name: '@biomejs/biome' },\n] as const satisfies readonly { name: ITsDepVersion }[];\n\n// Built dependencies whose install scripts the generated workspace trusts.\n// `onlyBuiltDependencies` is the pnpm 10 key (silently ignored from pnpm 11\n// onwards); pnpm 11 and above read `allowBuilds` instead. Any dep NOT in this\n// allowlist will have its install scripts skipped with a warning — matching\n// pnpm 10's default behaviour. The user can opt-in later via\n// `pnpm approve-builds`.\nexport const PNPM_BUILT_DEPENDENCIES = ['@swc/core', 'esbuild', 'nx', 'sharp'];\n\n/**\n * Options controlling how the workspace is initialised. These mirror the\n * preset schema so a workspace created via the preset and one initialised via\n * the `init` generator end up in the same shape.\n */\nexport interface ApplyWorkspaceInitOptions {\n  /** The IaC provider to record in the plugin config. */\n  readonly iac: Iac;\n  /**\n   * The container engine to record. `undefined`/`'infer'` picks docker when\n   * installed, else finch.\n   */\n  readonly containers?: Containers | 'infer';\n  /** Whether to configure MCP servers for coding agents. Defaults to true. */\n  readonly mcp?: boolean;\n  /**\n   * How to treat the generated workspace README. The preset owns the README of\n   * a greenfield workspace (`Overwrite`); the `init` generator must not clobber\n   * an existing workspace's README (`KeepExisting`, the default).\n   */\n  readonly readmeOverwriteStrategy?: OverwriteStrategy;\n  /**\n   * Whether to overwrite root package.json scripts that already exist. The\n   * preset owns a greenfield workspace's scripts (`true`); the `init`\n   * generator must not clobber an existing workspace's scripts (`false`,\n   * the default) — it only adds the convenience scripts that are absent.\n   */\n  readonly overwriteScripts?: boolean;\n  /**\n   * Whether generators use the package manager's dependency catalog. On pnpm\n   * this also sets `catalogMode: strict` so `pnpm add` records new deps in the\n   * catalog. Defaults to true.\n   */\n  readonly catalogs?: boolean;\n}\n\n/**\n * Add or repair the pnpm `allowBuilds` / `onlyBuiltDependencies` allowlist for\n * the workspace's `packages` globs, without clobbering any packages the user\n * has already declared.\n *\n * A workspace not created by the preset commonly has either no\n * `pnpm-workspace.yaml`, one missing the `packages` globs, or one carrying the\n * broken `set this to true or false` placeholder pnpm writes when it skips a\n * build script. This makes the file self-consistent so the first generator's\n * install doesn't fail with `ERR_PNPM_IGNORED_BUILDS`.\n */\nconst setUpPnpmWorkspace = (tree: Tree, catalogs: boolean) => {\n  const existing = tree.exists('pnpm-workspace.yaml')\n    ? ((yaml.load(tree.read('pnpm-workspace.yaml', 'utf-8') ?? '') as Record<\n        string,\n        unknown\n      >) ?? {})\n    : {};\n\n  // Preserve any packages globs the user already has, ensuring ours are present.\n  const packages = Array.from(\n    new Set([...((existing.packages as string[]) ?? []), ...WORKSPACES]),\n  );\n\n  const allowBuilds = {\n    ...(typeof existing.allowBuilds === 'object' && existing.allowBuilds\n      ? (existing.allowBuilds as Record<string, unknown>)\n      : {}),\n    // Overwrite any non-boolean (e.g. the \"set this to true or false\"\n    // placeholder) with an explicit true for the deps we trust.\n    ...Object.fromEntries(PNPM_BUILT_DEPENDENCIES.map((dep) => [dep, true])),\n  };\n\n  // `strict` makes `pnpm add` record new deps in the catalog; it only gates\n  // that flow, so pre-declared direct ranges (e.g. tslib) still install.\n  // Preserve an explicit user choice.\n  const catalogMode = catalogs\n    ? (existing.catalogMode ?? 'strict')\n    : existing.catalogMode;\n\n  tree.write(\n    'pnpm-workspace.yaml',\n    yaml.dump(\n      {\n        ...existing,\n        packages,\n        allowBuilds,\n        onlyBuiltDependencies: PNPM_BUILT_DEPENDENCIES,\n        ...(catalogMode ? { catalogMode } : {}),\n      },\n      { quotingType: \"'\" },\n    ),\n  );\n};\n\n/**\n * Configure the workspace's package manager for a monorepo layout.\n *\n * pnpm workspaces are declared in `pnpm-workspace.yaml`; every other package\n * manager reads the `workspaces` field of the root `package.json`.\n */\nconst setUpWorkspaces = (tree: Tree, catalogs: boolean) => {\n  if (detectWorkspacePackageManager(tree) === 'pnpm') {\n    setUpPnpmWorkspace(tree, catalogs);\n    // pnpm creates these at the workspace root while it materialises packages.\n    updateGitIgnore(tree, '.', (patterns) => [...patterns, '_tmp_*']);\n  } else {\n    updateJson(tree, 'package.json', (json) => {\n      // The `workspaces` field may be the object form ({ \"packages\": [...] })\n      // accepted by yarn and bun — extend the globs while preserving the form.\n      const globs = Array.from(\n        new Set([...workspaceGlobs(json.workspaces), ...WORKSPACES]),\n      );\n      return {\n        ...json,\n        workspaces:\n          json.workspaces !== undefined && !Array.isArray(json.workspaces)\n            ? { ...json.workspaces, packages: globs }\n            : globs,\n      };\n    });\n  }\n};\n\n/**\n * Ensure the workspace has a `tsconfig.base.json`.\n *\n * `@nx/js` `initGenerator` (with `addTsPlugin`) normally creates this, but it\n * short-circuits when the workspace already has a root `tsconfig.json` — in\n * which case no base file is written and the next project generator fails with\n * `Cannot find tsconfig.base.json`. So we create a compatible one when it's\n * absent. An existing base is left untouched: the user may have tuned it, and\n * rewriting shared compiler options can break other projects (see the\n * \"add to an existing workspace\" guide).\n */\nconst ensureBaseTsConfig = (tree: Tree) => {\n  if (tree.exists('tsconfig.base.json')) {\n    return;\n  }\n  tree.write(\n    'tsconfig.base.json',\n    JSON.stringify(\n      {\n        compilerOptions: {\n          ...BASE_TSCONFIG_COMPILER_OPTIONS,\n          customConditions: [getNpmScope(tree)],\n        },\n      },\n      null,\n      2,\n    ),\n  );\n};\n\n/**\n * Ensure the workspace has a root `tsconfig.json`.\n *\n * Nx's `@nx/js:typescript-sync` generator hard-fails with\n * `Missing root \"tsconfig.json\"` when it's absent. The plugin's TypeScript\n * projects reference each other via this file, so we guarantee a minimal one\n * exists (sync populates its `references`).\n */\nconst ensureRootTsConfig = (tree: Tree) => {\n  if (tree.exists('tsconfig.json')) {\n    return;\n  }\n  tree.write(\n    'tsconfig.json',\n    JSON.stringify(\n      {\n        extends: './tsconfig.base.json',\n        files: [],\n        references: [],\n      },\n      null,\n      2,\n    ),\n  );\n};\n\n/**\n * Transform an Nx workspace into one ready to run `@aws/nx-plugin` generators.\n *\n * This is the deterministic core shared by the workspace preset and the `init`\n * generator. It is safe to re-run: every step is idempotent (config merges,\n * keyed nx.json / package.json entries, create-if-missing files), so running\n * it against an already-initialised workspace is a no-op.\n *\n * It preserves the workspace's module format: the root package.json `type`\n * field is owned by the preset (written from its `--module` option) and left\n * untouched here. It does NOT rewrite an existing `tsconfig.base.json`'s\n * compiler options, migrate a workspace's package manager, or restructure\n * existing projects — those are decisions for the user (see the \"add to an\n * existing workspace\" guide).\n */\nexport const applyWorkspaceInit = async <const D extends DependencyDeclaration>(\n  tree: Tree,\n  {\n    iac,\n    containers,\n    mcp,\n    readmeOverwriteStrategy = OverwriteStrategy.KeepExisting,\n    overwriteScripts = false,\n    catalogs = true,\n  }: ApplyWorkspaceInitOptions,\n  declaration: D & MustDeclare<typeof INIT_DEPENDENCIES, D>,\n) => {\n  const resolvedContainers =\n    !containers || containers === 'infer' ? inferContainers() : containers;\n\n  // The catalogs flag is written explicitly (even when true) so the workspace\n  // records its dependency-management choice.\n  await ensureAwsNxPluginConfig(tree);\n  await updateAwsNxPluginConfig(tree, {\n    iac: { provider: iac },\n    containers: { engine: resolvedContainers },\n    packageManager: { catalogs },\n  });\n\n  // Set up the TypeScript plugin, base tsconfig, formatter etc. `@nx/js`\n  // creates `tsconfig.base.json` when absent, but skips it when a root\n  // `tsconfig.json` already exists — so we ensure both explicitly below.\n  await initGenerator(tree, {\n    formatter: 'none',\n    addTsPlugin: true,\n  });\n\n  ensureBaseTsConfig(tree);\n  ensureRootTsConfig(tree);\n\n  setUpWorkspaces(tree, catalogs);\n\n  const nxJson = readNxJson(tree);\n  updateNxJson(tree, {\n    ...nxJson,\n    // Preserve an explicit analytics choice in an existing workspace.\n    analytics: (nxJson as { analytics?: boolean }).analytics ?? false,\n    parallel: nxJson.parallel ?? DEFAULT_PARALLEL,\n    targetDefaults: {\n      ...nxJson.targetDefaults,\n      compile: mergeTargetDefault(nxJson.targetDefaults?.compile, (base) => ({\n        ...base,\n        syncGenerators: [\n          ...(base.syncGenerators ?? []).filter(\n            (g) =>\n              ![TS_SYNC_GENERATOR_NAME, NX_TYPESCRIPT_SYNC_GENERATOR].includes(\n                g,\n              ),\n          ),\n          NX_TYPESCRIPT_SYNC_GENERATOR,\n          TS_SYNC_GENERATOR_NAME,\n        ],\n      })),\n    },\n  });\n\n  const CONVENIENCE_SCRIPTS = {\n    dev: 'nx run-many --target dev',\n    build: 'nx run-many --target build',\n    lint: 'nx run-many --target lint --configuration=fix',\n    test: 'nx run-many --target test --all',\n    // Trivy container image scanning is not part of `build` (its result\n    // depends on the ever-changing vulnerability database); run it explicitly,\n    // e.g. in CI.\n    trivy: 'nx run-many --target trivy --all',\n    'build:skip-lint': 'nx run-many --target build --configuration=skip-lint',\n    'build:all': 'nx run-many --target build --all',\n    'affected:all': 'nx affected --target build',\n  };\n  updateJson(tree, 'package.json', (packageJson) => ({\n    ...packageJson,\n    // The root `type` field is owned by the preset (written explicitly from\n    // its `--module` option). `init` preserves an existing workspace's field\n    // as-is: an ESM workspace already carries `type: \"module\"` (that is how\n    // the format is inferred), and introducing a `type` into a CommonJS\n    // workspace that lacks one changes behaviour for frameworks that parse it\n    // (e.g. Next.js starts treating the app's ESM source as CJS).\n    scripts: overwriteScripts\n      ? { ...packageJson.scripts, ...CONVENIENCE_SCRIPTS }\n      : { ...CONVENIENCE_SCRIPTS, ...packageJson.scripts },\n  }));\n\n  // Declare the `nx` version the plugin's @nx/* packages are built against. A\n  // mismatched workspace nx (even a patch apart) hoists a second nested nx\n  // under @nx/js, and the two instances deadlock `nx sync` — but a workspace\n  // already on a newer nx keeps it, since devkit never downgrades an existing\n  // range. `@nx/js` must be a root dependency for the\n  // `@nx/js:typescript-sync` generator registered in nx.json to resolve (npm\n  // doesn't hoist the plugin's own copy reliably).\n  addDependenciesToPackageJson(\n    tree,\n    {},\n    {\n      ...withVersions(forDependencies<typeof INIT_DEPENDENCIES>(declaration), [\n        'nx',\n        '@nx/js',\n        '@nx/workspace',\n      ]),\n      ...withVersions(forDependencies<typeof INIT_DEPENDENCIES>(declaration), [\n        'typescript',\n        '@biomejs/biome',\n      ]),\n      // Declare the plugin the generators are running from, plus the MCP server\n      // package the vended config runs, so both are pinned in the workspace's\n      // lockfile and upgrading them upgrades what the agents use.\n      ...nxPluginSelfDependency(tree),\n      ...nxPluginMcpDependency(tree),\n    },\n  );\n\n  // Write biome.json for formatting and linting\n  if (!tree.exists('biome.json')) {\n    tree.write(\n      'biome.json',\n      JSON.stringify(getDefaultBiomeConfig(tree), null, 2),\n    );\n  }\n\n  generateFiles(\n    tree, // the virtual file system\n    joinPathFragments(import.meta.dirname, '..', 'preset', 'files'),\n    '.',\n    {\n      projectName: getNpmScope(tree),\n      generators: Object.entries(generatorsJsonEntries)\n        .filter(([, info]) => !info.hidden)\n        .map(([id, info]) => ({\n          name: id,\n          description: describeGeneratorForCatalogue(info),\n        })),\n      ...(() => {\n        const cmds = getPackageManagerDisplayCommands();\n        return {\n          pkgMgrCmd: cmds.exec,\n          buildCmd: `${cmds.run} build`,\n          lintCmd: `${cmds.run} lint`,\n        };\n      })(),\n    },\n    {\n      overwriteStrategy: readmeOverwriteStrategy,\n    },\n  );\n\n  if (mcp !== false) {\n    configureMcpServers(tree);\n  }\n};\n"],"names":["generateFiles","joinPathFragments","OverwriteStrategy","readNxJson","updateJson","updateNxJson","initGenerator","yaml","SYNC_GENERATOR_NAME","TS_SYNC_GENERATOR_NAME","BASE_TSCONFIG_COMPILER_OPTIONS","ensureAwsNxPluginConfig","updateAwsNxPluginConfig","inferContainers","forDependencies","addDependenciesToPackageJson","detectWorkspacePackageManager","getDefaultBiomeConfig","describeGeneratorForCatalogue","generatorsJsonEntries","updateGitIgnore","configureMcpServers","getNpmScope","mergeTargetDefault","nxPluginMcpDependency","nxPluginSelfDependency","getPackageManagerDisplayCommands","workspaceGlobs","withVersions","WORKSPACES","NX_TYPESCRIPT_SYNC_GENERATOR","DEFAULT_PARALLEL","INIT_DEPENDENCIES","name","PNPM_BUILT_DEPENDENCIES","setUpPnpmWorkspace","tree","catalogs","existing","exists","load","read","packages","Array","from","Set","allowBuilds","Object","fromEntries","map","dep","catalogMode","write","dump","onlyBuiltDependencies","quotingType","setUpWorkspaces","patterns","json","globs","workspaces","undefined","isArray","ensureBaseTsConfig","JSON","stringify","compilerOptions","customConditions","ensureRootTsConfig","extends","files","references","applyWorkspaceInit","iac","containers","mcp","readmeOverwriteStrategy","KeepExisting","overwriteScripts","declaration","resolvedContainers","provider","engine","packageManager","formatter","addTsPlugin","nxJson","analytics","parallel","targetDefaults","compile","base","syncGenerators","filter","g","includes","CONVENIENCE_SCRIPTS","dev","build","lint","test","trivy","packageJson","scripts","dirname","projectName","generators","entries","info","hidden","id","description","cmds","pkgMgrCmd","exec","buildCmd","run","lintCmd","overwriteStrategy"],"mappings":"AAAA;;;CAGC,GACD,SACEA,aAAa,EACbC,iBAAiB,EACjBC,iBAAiB,EACjBC,UAAU,EAEVC,UAAU,EACVC,YAAY,QACP,aAAa;AACpB,SAASC,aAAa,QAAQ,SAAS;AAEvC,OAAOC,UAAU,UAAU;AAC3B,SAASC,uBAAuBC,sBAAsB,QAAQ,0BAA0B;AACxF,SAASC,8BAA8B,QAAQ,qBAAqB;AACpE,SACEC,uBAAuB,EACvBC,uBAAuB,QAClB,oBAAoB;AAC3B,SAA0BC,eAAe,QAAQ,kBAAkB;AACnE,SAEEC,eAAe,QAEV,6BAA6B;AACpC,SACEC,4BAA4B,EAC5BC,6BAA6B,QACxB,oBAAoB;AAC3B,SAASC,qBAAqB,QAAQ,cAAc;AACpD,SACEC,6BAA6B,EAC7BC,qBAAqB,QAChB,kBAAkB;AACzB,SAASC,eAAe,QAAQ,WAAW;AAE3C,SAASC,mBAAmB,QAAQ,WAAW;AAC/C,SAASC,WAAW,QAAQ,iBAAiB;AAC7C,SACEC,kBAAkB,EAClBC,qBAAqB,EACrBC,sBAAsB,QACjB,UAAU;AACjB,SAASC,gCAAgC,QAAQ,mBAAmB;AACpE,SAASC,cAAc,QAAQ,4BAA4B;AAC3D,SAA6BC,YAAY,QAAQ,gBAAgB;AAEjE,MAAMC,aAAa;IAAC;CAAa;AACjC,MAAMC,+BAA+B;AAErC,OAAO,MAAMC,mBAAmB,EAAE;AAElC,oEAAoE,GACpE,OAAO,MAAMC,oBAAoB;IAC/B;QAAEC,MAAM;IAAK;IACb;QAAEA,MAAM;IAAS;IACjB;QAAEA,MAAM;IAAgB;IACxB;QAAEA,MAAM;IAAa;IACrB;QAAEA,MAAM;IAAiB;CAC1B,CAAuD;AAExD,2EAA2E;AAC3E,4EAA4E;AAC5E,8EAA8E;AAC9E,4EAA4E;AAC5E,6DAA6D;AAC7D,yBAAyB;AACzB,OAAO,MAAMC,0BAA0B;IAAC;IAAa;IAAW;IAAM;CAAQ,CAAC;AAsC/E;;;;;;;;;;CAUC,GACD,MAAMC,qBAAqB,CAACC,MAAYC;IACtC,MAAMC,WAAWF,KAAKG,MAAM,CAAC,yBACxB,AAAChC,KAAKiC,IAAI,CAACJ,KAAKK,IAAI,CAAC,uBAAuB,YAAY,OAGnD,CAAC,IACP,CAAC;IAEL,+EAA+E;IAC/E,MAAMC,WAAWC,MAAMC,IAAI,CACzB,IAAIC,IAAI;WAAK,AAACP,SAASI,QAAQ,IAAiB,EAAE;WAAMb;KAAW;IAGrE,MAAMiB,cAAc;QAClB,GAAI,OAAOR,SAASQ,WAAW,KAAK,YAAYR,SAASQ,WAAW,GAC/DR,SAASQ,WAAW,GACrB,CAAC,CAAC;QACN,kEAAkE;QAClE,4DAA4D;QAC5D,GAAGC,OAAOC,WAAW,CAACd,wBAAwBe,GAAG,CAAC,CAACC,MAAQ;gBAACA;gBAAK;aAAK,EAAE;IAC1E;IAEA,0EAA0E;IAC1E,uEAAuE;IACvE,oCAAoC;IACpC,MAAMC,cAAcd,WACfC,SAASa,WAAW,IAAI,WACzBb,SAASa,WAAW;IAExBf,KAAKgB,KAAK,CACR,uBACA7C,KAAK8C,IAAI,CACP;QACE,GAAGf,QAAQ;QACXI;QACAI;QACAQ,uBAAuBpB;QACvB,GAAIiB,cAAc;YAAEA;QAAY,IAAI,CAAC,CAAC;IACxC,GACA;QAAEI,aAAa;IAAI;AAGzB;AAEA;;;;;CAKC,GACD,MAAMC,kBAAkB,CAACpB,MAAYC;IACnC,IAAIrB,8BAA8BoB,UAAU,QAAQ;QAClDD,mBAAmBC,MAAMC;QACzB,2EAA2E;QAC3EjB,gBAAgBgB,MAAM,KAAK,CAACqB,WAAa;mBAAIA;gBAAU;aAAS;IAClE,OAAO;QACLrD,WAAWgC,MAAM,gBAAgB,CAACsB;YAChC,wEAAwE;YACxE,yEAAyE;YACzE,MAAMC,QAAQhB,MAAMC,IAAI,CACtB,IAAIC,IAAI;mBAAIlB,eAAe+B,KAAKE,UAAU;mBAAM/B;aAAW;YAE7D,OAAO;gBACL,GAAG6B,IAAI;gBACPE,YACEF,KAAKE,UAAU,KAAKC,aAAa,CAAClB,MAAMmB,OAAO,CAACJ,KAAKE,UAAU,IAC3D;oBAAE,GAAGF,KAAKE,UAAU;oBAAElB,UAAUiB;gBAAM,IACtCA;YACR;QACF;IACF;AACF;AAEA;;;;;;;;;;CAUC,GACD,MAAMI,qBAAqB,CAAC3B;IAC1B,IAAIA,KAAKG,MAAM,CAAC,uBAAuB;QACrC;IACF;IACAH,KAAKgB,KAAK,CACR,sBACAY,KAAKC,SAAS,CACZ;QACEC,iBAAiB;YACf,GAAGxD,8BAA8B;YACjCyD,kBAAkB;gBAAC7C,YAAYc;aAAM;QACvC;IACF,GACA,MACA;AAGN;AAEA;;;;;;;CAOC,GACD,MAAMgC,qBAAqB,CAAChC;IAC1B,IAAIA,KAAKG,MAAM,CAAC,kBAAkB;QAChC;IACF;IACAH,KAAKgB,KAAK,CACR,iBACAY,KAAKC,SAAS,CACZ;QACEI,SAAS;QACTC,OAAO,EAAE;QACTC,YAAY,EAAE;IAChB,GACA,MACA;AAGN;AAEA;;;;;;;;;;;;;;CAcC,GACD,OAAO,MAAMC,qBAAqB,OAChCpC,MACA,EACEqC,GAAG,EACHC,UAAU,EACVC,GAAG,EACHC,0BAA0B1E,kBAAkB2E,YAAY,EACxDC,mBAAmB,KAAK,EACxBzC,WAAW,IAAI,EACW,EAC5B0C;IAEA,MAAMC,qBACJ,CAACN,cAAcA,eAAe,UAAU7D,oBAAoB6D;IAE9D,4EAA4E;IAC5E,4CAA4C;IAC5C,MAAM/D,wBAAwByB;IAC9B,MAAMxB,wBAAwBwB,MAAM;QAClCqC,KAAK;YAAEQ,UAAUR;QAAI;QACrBC,YAAY;YAAEQ,QAAQF;QAAmB;QACzCG,gBAAgB;YAAE9C;QAAS;IAC7B;IAEA,uEAAuE;IACvE,qEAAqE;IACrE,uEAAuE;IACvE,MAAM/B,cAAc8B,MAAM;QACxBgD,WAAW;QACXC,aAAa;IACf;IAEAtB,mBAAmB3B;IACnBgC,mBAAmBhC;IAEnBoB,gBAAgBpB,MAAMC;IAEtB,MAAMiD,SAASnF,WAAWiC;IAC1B/B,aAAa+B,MAAM;QACjB,GAAGkD,MAAM;QACT,kEAAkE;QAClEC,WAAW,AAACD,OAAmCC,SAAS,IAAI;QAC5DC,UAAUF,OAAOE,QAAQ,IAAIzD;QAC7B0D,gBAAgB;YACd,GAAGH,OAAOG,cAAc;YACxBC,SAASnE,mBAAmB+D,OAAOG,cAAc,EAAEC,SAAS,CAACC,OAAU,CAAA;oBACrE,GAAGA,IAAI;oBACPC,gBAAgB;2BACX,AAACD,CAAAA,KAAKC,cAAc,IAAI,EAAE,AAAD,EAAGC,MAAM,CACnC,CAACC,IACC,CAAC;gCAACrF;gCAAwBqB;6BAA6B,CAACiE,QAAQ,CAC9DD;wBAGNhE;wBACArB;qBACD;gBACH,CAAA;QACF;IACF;IAEA,MAAMuF,sBAAsB;QAC1BC,KAAK;QACLC,OAAO;QACPC,MAAM;QACNC,MAAM;QACN,oEAAoE;QACpE,2EAA2E;QAC3E,cAAc;QACdC,OAAO;QACP,mBAAmB;QACnB,aAAa;QACb,gBAAgB;IAClB;IACAjG,WAAWgC,MAAM,gBAAgB,CAACkE,cAAiB,CAAA;YACjD,GAAGA,WAAW;YACd,wEAAwE;YACxE,yEAAyE;YACzE,wEAAwE;YACxE,oEAAoE;YACpE,0EAA0E;YAC1E,8DAA8D;YAC9DC,SAASzB,mBACL;gBAAE,GAAGwB,YAAYC,OAAO;gBAAE,GAAGP,mBAAmB;YAAC,IACjD;gBAAE,GAAGA,mBAAmB;gBAAE,GAAGM,YAAYC,OAAO;YAAC;QACvD,CAAA;IAEA,4EAA4E;IAC5E,yEAAyE;IACzE,2EAA2E;IAC3E,4EAA4E;IAC5E,oDAAoD;IACpD,2EAA2E;IAC3E,iDAAiD;IACjDxF,6BACEqB,MACA,CAAC,GACD;QACE,GAAGR,aAAad,gBAA0CiE,cAAc;YACtE;YACA;YACA;SACD,CAAC;QACF,GAAGnD,aAAad,gBAA0CiE,cAAc;YACtE;YACA;SACD,CAAC;QACF,0EAA0E;QAC1E,wEAAwE;QACxE,4DAA4D;QAC5D,GAAGtD,uBAAuBW,KAAK;QAC/B,GAAGZ,sBAAsBY,KAAK;IAChC;IAGF,8CAA8C;IAC9C,IAAI,CAACA,KAAKG,MAAM,CAAC,eAAe;QAC9BH,KAAKgB,KAAK,CACR,cACAY,KAAKC,SAAS,CAAChD,sBAAsBmB,OAAO,MAAM;IAEtD;IAEApC,cACEoC,MACAnC,kBAAkB,YAAYuG,OAAO,EAAE,MAAM,UAAU,UACvD,KACA;QACEC,aAAanF,YAAYc;QACzBsE,YAAY3D,OAAO4D,OAAO,CAACxF,uBACxB0E,MAAM,CAAC,CAAC,GAAGe,KAAK,GAAK,CAACA,KAAKC,MAAM,EACjC5D,GAAG,CAAC,CAAC,CAAC6D,IAAIF,KAAK,GAAM,CAAA;gBACpB3E,MAAM6E;gBACNC,aAAa7F,8BAA8B0F;YAC7C,CAAA;QACF,GAAG,AAAC,CAAA;YACF,MAAMI,OAAOtF;YACb,OAAO;gBACLuF,WAAWD,KAAKE,IAAI;gBACpBC,UAAU,GAAGH,KAAKI,GAAG,CAAC,MAAM,CAAC;gBAC7BC,SAAS,GAAGL,KAAKI,GAAG,CAAC,KAAK,CAAC;YAC7B;QACF,CAAA,GAAI;IACN,GACA;QACEE,mBAAmB1C;IACrB;IAGF,IAAID,QAAQ,OAAO;QACjBtD,oBAAoBe;IACtB;AACF,EAAE"}