@aws/nx-plugin 1.0.0-rc.96 → 1.0.0-rc.98

package/src/migrations/{latest/infra-deploy-express-mode → v1.0.0-rc.94/0001-infra-deploy-express-mode}/migration.js

@@ -5,29 +5,31 @@
 import { INFRA_APP_GENERATOR_INFO } from "../../../infra/app/generator.js";
 import { formatFilesInSubtree } from "../../../utils/format.js";
 /**
- * Deploy using CloudFormation express mode from the deploy and deploy-sandbox
- * targets of ts#infra projects
+ * Deploy using CloudFormation express mode from the deploy-sandbox target of
+ * ts#infra projects, and wait for full stabilization everywhere else.
  *
- * Express mode completes each resource operation as soon as its configuration
- * is applied rather than waiting for full stabilization, which is a much faster
- * iteration cycle for development deploys.
+ * Express mode completes each resource operation as soon as its configuration is
+ * applied rather than waiting for full stabilization, which is a much faster
+ * iteration cycle for development deploys. It returns before resources have
+ * settled, so it suits only the stage you iterate on.
  *
- * Two targets keep waiting for full stabilization: `deploy-ci`, since pipeline
- * deployments should never skip it, and - when stages are configured - `deploy`,
- * which deploys whichever stage is named, including beta and prod.
- */ const DEPLOY_TARGETS = [
-    'deploy',
-    'deploy-sandbox'
-];
-const EXPRESS_FLAG = '--express';
+ * `deploy-sandbox` therefore gets it, since it only ever deploys the sandbox
+ * stage. `deploy` names whichever stage you give it, including beta and prod, and
+ * `deploy-ci` runs from a pipeline - both wait for full stabilization.
+ */ const EXPRESS_FLAG = '--express';
+const NO_EXPRESS_FLAG = '--no-express';
+/** Whether `deploy-sandbox` should carry the flag, and `deploy` should not. */ const WANTS_EXPRESS = {
+    'deploy-sandbox': true,
+    deploy: false
+};
 /**
  * Whether the command is one of the deploy commands this migration vends -
  * either a direct `cdk deploy`, or the stage-config `infra-deploy.ts` script
  * that wraps it. Anything else has been hand-written and is reported rather
  * than rewritten.
  */ const isGeneratedDeployCommand = (command)=>/(^|\s)cdk\s+deploy(\s|$)/.test(command) || command.includes('infra-deploy.ts');
-/** Whether the command runs the stage-config deploy script. */ const isStageConfigDeploy = (command)=>command.includes('infra-deploy.ts');
-const divergedNextStep = (projectName, target)=>`${projectName}: its ${target} target has been customised, so it was left as it is. Add "${EXPRESS_FLAG}" to the target's command to deploy using CloudFormation express mode.`;
+const divergedNextStep = (projectName, target, wantsExpress)=>wantsExpress ? `${projectName}: its ${target} target has been customised, so it was left as it is. Add "${EXPRESS_FLAG}" to the target's command to deploy using CloudFormation express mode.` : `${projectName}: its ${target} target has been customised, so it was left as it is. Remove "${EXPRESS_FLAG}" from the target's command so it waits for full resource stabilization - this target can name any stage, including production.`;
+/** Drops the flag wherever it sits, leaving the rest of the command untouched. */ const withoutExpress = (command)=>command.split(/\s+/).filter((arg)=>arg !== EXPRESS_FLAG).join(' ');
 export default async function migration(tree) {
     const nextSteps = [];
     let migrated = false;
@@ -36,35 +38,31 @@ export default async function migration(tree) {
             continue;
         }
         let projectChanged = false;
-        for (const targetName of DEPLOY_TARGETS){
+        for (const [targetName, wantsExpress] of Object.entries(WANTS_EXPRESS)){
             const target = project.targets?.[targetName];
             const command = target?.options?.command;
             if (!target || typeof command !== 'string') {
                 continue;
             }
-            // Already migrated (or generated by a version that already passes it) -
-            // skip so re-running is a no-op.
-            if (command.split(/\s+/).includes(EXPRESS_FLAG)) {
+            const args = command.split(/\s+/);
+            const hasExpress = args.includes(EXPRESS_FLAG);
+            // Already in the wanted state, so re-running - and a project generated
+            // after this change - is a no-op.
+            if (hasExpress === wantsExpress) {
                 continue;
             }
             // `--no-express` is a deliberate opt-out, so honour it rather than
             // flipping the user back to express mode.
-            if (command.split(/\s+/).includes('--no-express')) {
+            if (wantsExpress && args.includes(NO_EXPRESS_FLAG)) {
                 continue;
             }
             if (!isGeneratedDeployCommand(command)) {
-                nextSteps.push(divergedNextStep(name, targetName));
-                continue;
-            }
-            // When stages are configured, `deploy` deploys whichever stage is named,
-            // including beta and prod, so it stays on full stabilization. Only its
-            // sandbox counterpart opts into express mode.
-            if (targetName === 'deploy' && isStageConfigDeploy(command)) {
+                nextSteps.push(divergedNextStep(name, targetName, wantsExpress));
                 continue;
             }
             // Appended last so it stays clear of the stage pattern, which the
             // stage-config deploy script reads from the first positional argument.
-            target.options.command = `${command} ${EXPRESS_FLAG}`;
+            target.options.command = wantsExpress ? `${command} ${EXPRESS_FLAG}` : withoutExpress(command);
             projectChanged = true;
         }
         if (projectChanged) {

package/src/migrations/v1.0.0-rc.94/0001-infra-deploy-express-mode/migration.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../../../../../../../packages/nx-plugin/src/migrations/v1.0.0-rc.94/0001-infra-deploy-express-mode/migration.ts"],"sourcesContent":["/**\n * Copyright Amazon.com, Inc. or its affiliates. All Rights Reserved.\n * SPDX-License-Identifier: Apache-2.0\n */\nimport {\n  getProjects,\n  type MigrationReturnObject,\n  type TargetConfiguration,\n  type Tree,\n  updateProjectConfiguration,\n} from '@nx/devkit';\nimport { INFRA_APP_GENERATOR_INFO } from '../../../infra/app/generator.js';\nimport { formatFilesInSubtree } from '../../../utils/format.js';\n\n/**\n * Deploy using CloudFormation express mode from the deploy-sandbox target of\n * ts#infra projects, and wait for full stabilization everywhere else.\n *\n * Express mode completes each resource operation as soon as its configuration is\n * applied rather than waiting for full stabilization, which is a much faster\n * iteration cycle for development deploys. It returns before resources have\n * settled, so it suits only the stage you iterate on.\n *\n * `deploy-sandbox` therefore gets it, since it only ever deploys the sandbox\n * stage. `deploy` names whichever stage you give it, including beta and prod, and\n * `deploy-ci` runs from a pipeline - both wait for full stabilization.\n */\n\nconst EXPRESS_FLAG = '--express';\nconst NO_EXPRESS_FLAG = '--no-express';\n\n/** Whether `deploy-sandbox` should carry the flag, and `deploy` should not. */\nconst WANTS_EXPRESS: Record<string, boolean> = {\n  'deploy-sandbox': true,\n  deploy: false,\n};\n\n/**\n * Whether the command is one of the deploy commands this migration vends -\n * either a direct `cdk deploy`, or the stage-config `infra-deploy.ts` script\n * that wraps it. Anything else has been hand-written and is reported rather\n * than rewritten.\n */\nconst isGeneratedDeployCommand = (command: string): boolean =>\n  /(^|\\s)cdk\\s+deploy(\\s|$)/.test(command) ||\n  command.includes('infra-deploy.ts');\n\nconst divergedNextStep = (\n  projectName: string,\n  target: string,\n  wantsExpress: boolean,\n): string =>\n  wantsExpress\n    ? `${projectName}: its ${target} target has been customised, so it was left as it is. Add \"${EXPRESS_FLAG}\" to the target's command to deploy using CloudFormation express mode.`\n    : `${projectName}: its ${target} target has been customised, so it was left as it is. Remove \"${EXPRESS_FLAG}\" from the target's command so it waits for full resource stabilization - this target can name any stage, including production.`;\n\n/** Drops the flag wherever it sits, leaving the rest of the command untouched. */\nconst withoutExpress = (command: string): string =>\n  command\n    .split(/\\s+/)\n    .filter((arg) => arg !== EXPRESS_FLAG)\n    .join(' ');\n\nexport default async function migration(\n  tree: Tree,\n): Promise<MigrationReturnObject> {\n  const nextSteps: string[] = [];\n  let migrated = false;\n\n  for (const [name, project] of getProjects(tree)) {\n    if (\n      (project.metadata as { generator?: string } | undefined)?.generator !==\n      INFRA_APP_GENERATOR_INFO.id\n    ) {\n      continue;\n    }\n\n    let projectChanged = false;\n\n    for (const [targetName, wantsExpress] of Object.entries(WANTS_EXPRESS)) {\n      const target: TargetConfiguration | undefined =\n        project.targets?.[targetName];\n      const command = target?.options?.command;\n      if (!target || typeof command !== 'string') {\n        continue;\n      }\n\n      const args = command.split(/\\s+/);\n      const hasExpress = args.includes(EXPRESS_FLAG);\n\n      // Already in the wanted state, so re-running - and a project generated\n      // after this change - is a no-op.\n      if (hasExpress === wantsExpress) {\n        continue;\n      }\n\n      // `--no-express` is a deliberate opt-out, so honour it rather than\n      // flipping the user back to express mode.\n      if (wantsExpress && args.includes(NO_EXPRESS_FLAG)) {\n        continue;\n      }\n\n      if (!isGeneratedDeployCommand(command)) {\n        nextSteps.push(divergedNextStep(name, targetName, wantsExpress));\n        continue;\n      }\n\n      // Appended last so it stays clear of the stage pattern, which the\n      // stage-config deploy script reads from the first positional argument.\n      target.options.command = wantsExpress\n        ? `${command} ${EXPRESS_FLAG}`\n        : withoutExpress(command);\n      projectChanged = true;\n    }\n\n    if (projectChanged) {\n      updateProjectConfiguration(tree, name, project);\n      migrated = true;\n    }\n  }\n\n  if (migrated) {\n    await formatFilesInSubtree(tree);\n  }\n\n  return { nextSteps };\n}\n"],"names":["getProjects","updateProjectConfiguration","INFRA_APP_GENERATOR_INFO","formatFilesInSubtree","EXPRESS_FLAG","NO_EXPRESS_FLAG","WANTS_EXPRESS","deploy","isGeneratedDeployCommand","command","test","includes","divergedNextStep","projectName","target","wantsExpress","withoutExpress","split","filter","arg","join","migration","tree","nextSteps","migrated","name","project","metadata","generator","id","projectChanged","targetName","Object","entries","targets","options","args","hasExpress","push"],"mappings":"AAAA;;;CAGC,GACD,SACEA,WAAW,EAIXC,0BAA0B,QACrB,aAAa;AACpB,SAASC,wBAAwB,QAAQ,kCAAkC;AAC3E,SAASC,oBAAoB,QAAQ,2BAA2B;AAEhE;;;;;;;;;;;;CAYC,GAED,MAAMC,eAAe;AACrB,MAAMC,kBAAkB;AAExB,6EAA6E,GAC7E,MAAMC,gBAAyC;IAC7C,kBAAkB;IAClBC,QAAQ;AACV;AAEA;;;;;CAKC,GACD,MAAMC,2BAA2B,CAACC,UAChC,2BAA2BC,IAAI,CAACD,YAChCA,QAAQE,QAAQ,CAAC;AAEnB,MAAMC,mBAAmB,CACvBC,aACAC,QACAC,eAEAA,eACI,GAAGF,YAAY,MAAM,EAAEC,OAAO,2DAA2D,EAAEV,aAAa,sEAAsE,CAAC,GAC/K,GAAGS,YAAY,MAAM,EAAEC,OAAO,8DAA8D,EAAEV,aAAa,+HAA+H,CAAC;AAEjP,gFAAgF,GAChF,MAAMY,iBAAiB,CAACP,UACtBA,QACGQ,KAAK,CAAC,OACNC,MAAM,CAAC,CAACC,MAAQA,QAAQf,cACxBgB,IAAI,CAAC;AAEV,eAAe,eAAeC,UAC5BC,IAAU;IAEV,MAAMC,YAAsB,EAAE;IAC9B,IAAIC,WAAW;IAEf,KAAK,MAAM,CAACC,MAAMC,QAAQ,IAAI1B,YAAYsB,MAAO;QAC/C,IACE,AAACI,QAAQC,QAAQ,EAAyCC,cAC1D1B,yBAAyB2B,EAAE,EAC3B;YACA;QACF;QAEA,IAAIC,iBAAiB;QAErB,KAAK,MAAM,CAACC,YAAYhB,aAAa,IAAIiB,OAAOC,OAAO,CAAC3B,eAAgB;YACtE,MAAMQ,SACJY,QAAQQ,OAAO,EAAE,CAACH,WAAW;YAC/B,MAAMtB,UAAUK,QAAQqB,SAAS1B;YACjC,IAAI,CAACK,UAAU,OAAOL,YAAY,UAAU;gBAC1C;YACF;YAEA,MAAM2B,OAAO3B,QAAQQ,KAAK,CAAC;YAC3B,MAAMoB,aAAaD,KAAKzB,QAAQ,CAACP;YAEjC,uEAAuE;YACvE,kCAAkC;YAClC,IAAIiC,eAAetB,cAAc;gBAC/B;YACF;YAEA,mEAAmE;YACnE,0CAA0C;YAC1C,IAAIA,gBAAgBqB,KAAKzB,QAAQ,CAACN,kBAAkB;gBAClD;YACF;YAEA,IAAI,CAACG,yBAAyBC,UAAU;gBACtCc,UAAUe,IAAI,CAAC1B,iBAAiBa,MAAMM,YAAYhB;gBAClD;YACF;YAEA,kEAAkE;YAClE,uEAAuE;YACvED,OAAOqB,OAAO,CAAC1B,OAAO,GAAGM,eACrB,GAAGN,QAAQ,CAAC,EAAEL,cAAc,GAC5BY,eAAeP;YACnBqB,iBAAiB;QACnB;QAEA,IAAIA,gBAAgB;YAClB7B,2BAA2BqB,MAAMG,MAAMC;YACvCF,WAAW;QACb;IACF;IAEA,IAAIA,UAAU;QACZ,MAAMrB,qBAAqBmB;IAC7B;IAEA,OAAO;QAAEC;IAAU;AACrB"}

package/src/migrations/v1.0.0-rc.94/0002-shx-fs-commands/migration.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../../../../../../../packages/nx-plugin/src/migrations/v1.0.0-rc.94/0002-shx-fs-commands/migration.ts"],"sourcesContent":["/**\n * Copyright Amazon.com, Inc. or its affiliates. All Rights Reserved.\n * SPDX-License-Identifier: Apache-2.0\n */\nimport {\n  addDependenciesToPackageJson,\n  getProjects,\n  type MigrationReturnObject,\n  type ProjectConfiguration,\n  removeDependenciesFromPackageJson,\n  type TargetConfiguration,\n  type Tree,\n  updateProjectConfiguration,\n} from '@nx/devkit';\nimport { formatFilesInSubtree } from '../../../utils/format.js';\nimport { TS_VERSIONS } from '../../../utils/versions.js';\n\n/**\n * One `shx` replaces the four single purpose filesystem CLIs the targets ran.\n * Its `cp` is several times faster than `ncp` on a large tree, and a single\n * dependency covers every operation the generators vend.\n *\n * `shx cp -R` follows POSIX `cp`, which nests the source inside an existing\n * destination rather than merging into it, so a directory copy becomes\n * `shx cp -R <src>/. <dst>`. That form also copies dotfiles, which a `<src>/*`\n * glob would silently skip — `node_modules/.bin` depends on them. A file copy\n * needs neither, so it stays a plain `shx cp`.\n *\n * Whether an `ncp` copied a file or a directory is not recoverable from the\n * command, so each source is matched against the shapes the generators vend. A\n * command that matches none of them has been edited by the user, and is left\n * alone and reported: rewriting it with the wrong form would either nest a\n * directory a level too deep or fail outright.\n *\n * A `cpy` becomes two commands rather than one joined by `&&`, which is a shell\n * operator and so no more portable than the builtins `shx` replaces.\n */\n\n/** The four CLIs this replaces, dropped from the root manifest. */\nconst REPLACED_PACKAGES = ['ncp', 'rimraf', 'make-dir-cli', 'cpy-cli'];\n\n/**\n * Sources the generators copy as a whole directory. Everything else they copy\n * names a single file, so an unmatched source is neither and is left untouched.\n *\n * - a Python bundle (`bundle-arm`/`bundle-x86`), copied into a package or an\n *   image build context\n * - a Python module tree, copied into a code package under its module name\n * - the generated Server SDK, copied into a Smithy API's `src/generated`\n * - `prisma` and Alembic `migrations`, copied into a migration bundle\n */\nconst DIRECTORY_SOURCE = [\n  /(^|\\/)bundle-(arm|x86)$/,\n  /(^|\\/)build\\/ssdk$/,\n  /(^|\\/)prisma$/,\n  /(^|\\/)migrations$/,\n];\n\n/**\n * Files the generators copy whose name carries no extension, so the extension\n * test below would otherwise read them as directories. A `Dockerfile` variant is\n * renamed on the way in (`Dockerfile.migration` -> `Dockerfile`), so this matches\n * the source's leading segment rather than the whole name.\n */\nconst EXTENSIONLESS_FILE = /(^|\\/)Dockerfile(\\.[^/]+)?$/;\n\n/**\n * A Python code package copies the project's source root in under the module\n * name, which is the same segment repeated — `.../src/my_agent my_agent`. The\n * source is a directory whose name is the project's, so it is recognised by the\n * destination repeating the source's last segment rather than by a fixed name.\n */\nconst isModuleTreeCopy = (src: string, dst: string): boolean => {\n  const segment = src.split('/').pop();\n  return (\n    !!segment && !segment.includes('.') && dst.split('/').pop() === segment\n  );\n};\n\nconst isDirectorySource = (src: string, dst: string): boolean =>\n  !EXTENSIONLESS_FILE.test(src) &&\n  (DIRECTORY_SOURCE.some((p) => p.test(src)) || isModuleTreeCopy(src, dst));\n\n/**\n * A copy naming a file on both sides, which every other vended `ncp` does. A\n * name carrying an extension is a file — as is a `Dockerfile`, which does not.\n */\nconst isFileCopy = (src: string, dst: string): boolean => {\n  const [s, d] = [src.split('/').pop() ?? '', dst.split('/').pop() ?? ''];\n  return (\n    (s.includes('.') || EXTENSIONLESS_FILE.test(src)) &&\n    (d.includes('.') || EXTENSIONLESS_FILE.test(dst))\n  );\n};\n\nconst NCP = /^ncp\\s+(\\S+)\\s+(\\S+)$/;\nconst RIMRAF = /^rimraf\\s+(\\S+)$/;\nconst MAKE_DIR = /^make-dir\\s+(\\S+)$/;\n/** The one shape `cpGlobToFile` vends, whose glob is quoted and dest renamed. */\nconst CPY = /^cpy\\s+\"([^\"]+)\"\\s+(\\S+)\\s+--flat\\s+--rename=(\\S+)$/;\n\n/**\n * Rewrite one command into the commands that replace it, or return null to leave\n * it alone. Anything already using `shx` is returned unchanged so a re-run is a\n * no-op.\n */\nconst rewrite = (command: string): string[] | null => {\n  const trimmed = command.trim();\n\n  const rimraf = RIMRAF.exec(trimmed);\n  if (rimraf) return [`shx rm -rf ${rimraf[1]}`];\n\n  const makeDir = MAKE_DIR.exec(trimmed);\n  if (makeDir) return [`shx mkdir -p ${makeDir[1]}`];\n\n  const cpy = CPY.exec(trimmed);\n  if (cpy) {\n    // `shx cp` writes through to a named destination file and fails if its\n    // parent is missing, so the destination directory is a step of its own.\n    return [`shx mkdir -p ${cpy[2]}`, `shx cp \"${cpy[1]}\" ${cpy[2]}/${cpy[3]}`];\n  }\n\n  const ncp = NCP.exec(trimmed);\n  if (ncp) {\n    const [, src, dst] = ncp;\n    if (isDirectorySource(src, dst)) return [`shx cp -R ${src}/. ${dst}`];\n    if (isFileCopy(src, dst)) return [`shx cp ${src} ${dst}`];\n    return null;\n  }\n\n  return null;\n};\n\n/** Whether a command is one this migration is responsible for rewriting. */\nconst isReplacedCommand = (command: string): boolean =>\n  /^(ncp|rimraf|make-dir|cpy)\\s/.test(command.trim());\n\nconst divergedStep = (\n  projectName: string,\n  targetName: string,\n  command: string,\n) =>\n  `${projectName}:${targetName}: left \\`${command}\\` untouched - it does not match a copy the generator produced, so whether it copies a file or a directory could not be determined. Replace it by hand with \\`shx cp <src> <dst>\\` for a file, or \\`shx cp -R <src>/. <dst>\\` for a directory (the trailing \\`/.\\` merges the contents instead of nesting the directory inside the destination).`;\n\n/**\n * Rewrite every command a target runs, in place. Commands are either strings or\n * `{ command }` objects, and a target uses `command` for a single one.\n *\n * One command can become several, which are steps of the same operation and so\n * must run in order — the target is pinned to `parallel: false` when that\n * happens.\n */\nconst migrateTarget = (\n  projectName: string,\n  targetName: string,\n  target: TargetConfiguration,\n  nextSteps: string[],\n): boolean => {\n  const options = target.options as\n    | { command?: unknown; commands?: unknown; parallel?: unknown }\n    | undefined;\n  if (!options) return false;\n\n  let changed = false;\n  let split = false;\n\n  /** The commands replacing one, or the original where it is left alone. */\n  const rewriteOne = (command: string): string[] => {\n    if (!isReplacedCommand(command)) return [command];\n    const replacement = rewrite(command);\n    if (replacement === null) {\n      nextSteps.push(divergedStep(projectName, targetName, command.trim()));\n      return [command];\n    }\n    changed = true;\n    if (replacement.length > 1) split = true;\n    return replacement;\n  };\n\n  if (typeof options.command === 'string') {\n    const replacement = rewriteOne(options.command);\n    if (replacement.length > 1) {\n      // `commands` is the only option that runs more than one.\n      delete options.command;\n      options.commands = replacement;\n    } else {\n      options.command = replacement[0];\n    }\n  } else if (Array.isArray(options.commands)) {\n    options.commands = options.commands.flatMap((entry) => {\n      if (typeof entry === 'string') return rewriteOne(entry);\n      if (\n        entry &&\n        typeof entry === 'object' &&\n        typeof (entry as { command?: unknown }).command === 'string'\n      ) {\n        const e = entry as { command: string };\n        return rewriteOne(e.command).map((command) => ({ ...e, command }));\n      }\n      return [entry];\n    });\n  }\n\n  if (split) options.parallel = false;\n\n  return changed;\n};\n\n/** Every command every target in the workspace runs. */\nconst allCommands = (tree: Tree): string[] => {\n  const commands: string[] = [];\n  for (const [, project] of getProjects(tree)) {\n    for (const target of Object.values(project.targets ?? {})) {\n      const options = target.options as\n        | { command?: unknown; commands?: unknown }\n        | undefined;\n      if (typeof options?.command === 'string') commands.push(options.command);\n      if (Array.isArray(options?.commands)) {\n        for (const entry of options.commands) {\n          if (typeof entry === 'string') commands.push(entry);\n          else if (\n            typeof (entry as { command?: unknown })?.command === 'string'\n          )\n            commands.push((entry as { command: string }).command);\n        }\n      }\n    }\n  }\n  return commands;\n};\n\n/** The CLI a package provides, as the rewritten commands would name it. */\nconst CLI_NAME: Record<string, string> = {\n  ncp: 'ncp',\n  rimraf: 'rimraf',\n  'make-dir-cli': 'make-dir',\n  'cpy-cli': 'cpy',\n};\n\nexport default async function migration(\n  tree: Tree,\n): Promise<MigrationReturnObject> {\n  const nextSteps: string[] = [];\n\n  for (const [projectName, project] of getProjects(tree)) {\n    let changed = false;\n\n    for (const [targetName, target] of Object.entries(project.targets ?? {})) {\n      changed =\n        migrateTarget(projectName, targetName, target, nextSteps) || changed;\n    }\n\n    if (changed) {\n      updateProjectConfiguration(\n        tree,\n        projectName,\n        project as ProjectConfiguration,\n      );\n    }\n  }\n\n  addDependenciesToPackageJson(tree, {}, { shx: TS_VERSIONS.shx });\n\n  // Only the CLIs nothing runs any more: a command this migration declined to\n  // rewrite, or one the user added, still needs the package it calls.\n  const commands = allCommands(tree);\n  const unused = REPLACED_PACKAGES.filter(\n    (pkg) =>\n      !commands.some((c) =>\n        new RegExp(`(^|[^\\\\w-])${CLI_NAME[pkg]}\\\\s`).test(c),\n      ),\n  );\n  removeDependenciesFromPackageJson(tree, unused, unused);\n\n  await formatFilesInSubtree(tree);\n\n  return { nextSteps };\n}\n"],"names":["addDependenciesToPackageJson","getProjects","removeDependenciesFromPackageJson","updateProjectConfiguration","formatFilesInSubtree","TS_VERSIONS","REPLACED_PACKAGES","DIRECTORY_SOURCE","EXTENSIONLESS_FILE","isModuleTreeCopy","src","dst","segment","split","pop","includes","isDirectorySource","test","some","p","isFileCopy","s","d","NCP","RIMRAF","MAKE_DIR","CPY","rewrite","command","trimmed","trim","rimraf","exec","makeDir","cpy","ncp","isReplacedCommand","divergedStep","projectName","targetName","migrateTarget","target","nextSteps","options","changed","rewriteOne","replacement","push","length","commands","Array","isArray","flatMap","entry","e","map","parallel","allCommands","tree","project","Object","values","targets","CLI_NAME","migration","entries","shx","unused","filter","pkg","c","RegExp"],"mappings":"AAAA;;;CAGC,GACD,SACEA,4BAA4B,EAC5BC,WAAW,EAGXC,iCAAiC,EAGjCC,0BAA0B,QACrB,aAAa;AACpB,SAASC,oBAAoB,QAAQ,2BAA2B;AAChE,SAASC,WAAW,QAAQ,6BAA6B;AAEzD;;;;;;;;;;;;;;;;;;;CAmBC,GAED,iEAAiE,GACjE,MAAMC,oBAAoB;IAAC;IAAO;IAAU;IAAgB;CAAU;AAEtE;;;;;;;;;CASC,GACD,MAAMC,mBAAmB;IACvB;IACA;IACA;IACA;CACD;AAED;;;;;CAKC,GACD,MAAMC,qBAAqB;AAE3B;;;;;CAKC,GACD,MAAMC,mBAAmB,CAACC,KAAaC;IACrC,MAAMC,UAAUF,IAAIG,KAAK,CAAC,KAAKC,GAAG;IAClC,OACE,CAAC,CAACF,WAAW,CAACA,QAAQG,QAAQ,CAAC,QAAQJ,IAAIE,KAAK,CAAC,KAAKC,GAAG,OAAOF;AAEpE;AAEA,MAAMI,oBAAoB,CAACN,KAAaC,MACtC,CAACH,mBAAmBS,IAAI,CAACP,QACxBH,CAAAA,iBAAiBW,IAAI,CAAC,CAACC,IAAMA,EAAEF,IAAI,CAACP,SAASD,iBAAiBC,KAAKC,IAAG;AAEzE;;;CAGC,GACD,MAAMS,aAAa,CAACV,KAAaC;IAC/B,MAAM,CAACU,GAAGC,EAAE,GAAG;QAACZ,IAAIG,KAAK,CAAC,KAAKC,GAAG,MAAM;QAAIH,IAAIE,KAAK,CAAC,KAAKC,GAAG,MAAM;KAAG;IACvE,OACE,AAACO,CAAAA,EAAEN,QAAQ,CAAC,QAAQP,mBAAmBS,IAAI,CAACP,IAAG,KAC9CY,CAAAA,EAAEP,QAAQ,CAAC,QAAQP,mBAAmBS,IAAI,CAACN,IAAG;AAEnD;AAEA,MAAMY,MAAM;AACZ,MAAMC,SAAS;AACf,MAAMC,WAAW;AACjB,+EAA+E,GAC/E,MAAMC,MAAM;AAEZ;;;;CAIC,GACD,MAAMC,UAAU,CAACC;IACf,MAAMC,UAAUD,QAAQE,IAAI;IAE5B,MAAMC,SAASP,OAAOQ,IAAI,CAACH;IAC3B,IAAIE,QAAQ,OAAO;QAAC,CAAC,WAAW,EAAEA,MAAM,CAAC,EAAE,EAAE;KAAC;IAE9C,MAAME,UAAUR,SAASO,IAAI,CAACH;IAC9B,IAAII,SAAS,OAAO;QAAC,CAAC,aAAa,EAAEA,OAAO,CAAC,EAAE,EAAE;KAAC;IAElD,MAAMC,MAAMR,IAAIM,IAAI,CAACH;IACrB,IAAIK,KAAK;QACP,uEAAuE;QACvE,wEAAwE;QACxE,OAAO;YAAC,CAAC,aAAa,EAAEA,GAAG,CAAC,EAAE,EAAE;YAAE,CAAC,QAAQ,EAAEA,GAAG,CAAC,EAAE,CAAC,EAAE,EAAEA,GAAG,CAAC,EAAE,CAAC,CAAC,EAAEA,GAAG,CAAC,EAAE,EAAE;SAAC;IAC7E;IAEA,MAAMC,MAAMZ,IAAIS,IAAI,CAACH;IACrB,IAAIM,KAAK;QACP,MAAM,GAAGzB,KAAKC,IAAI,GAAGwB;QACrB,IAAInB,kBAAkBN,KAAKC,MAAM,OAAO;YAAC,CAAC,UAAU,EAAED,IAAI,GAAG,EAAEC,KAAK;SAAC;QACrE,IAAIS,WAAWV,KAAKC,MAAM,OAAO;YAAC,CAAC,OAAO,EAAED,IAAI,CAAC,EAAEC,KAAK;SAAC;QACzD,OAAO;IACT;IAEA,OAAO;AACT;AAEA,0EAA0E,GAC1E,MAAMyB,oBAAoB,CAACR,UACzB,+BAA+BX,IAAI,CAACW,QAAQE,IAAI;AAElD,MAAMO,eAAe,CACnBC,aACAC,YACAX,UAEA,GAAGU,YAAY,CAAC,EAAEC,WAAW,SAAS,EAAEX,QAAQ,gVAAgV,CAAC;AAEnY;;;;;;;CAOC,GACD,MAAMY,gBAAgB,CACpBF,aACAC,YACAE,QACAC;IAEA,MAAMC,UAAUF,OAAOE,OAAO;IAG9B,IAAI,CAACA,SAAS,OAAO;IAErB,IAAIC,UAAU;IACd,IAAI/B,QAAQ;IAEZ,wEAAwE,GACxE,MAAMgC,aAAa,CAACjB;QAClB,IAAI,CAACQ,kBAAkBR,UAAU,OAAO;YAACA;SAAQ;QACjD,MAAMkB,cAAcnB,QAAQC;QAC5B,IAAIkB,gBAAgB,MAAM;YACxBJ,UAAUK,IAAI,CAACV,aAAaC,aAAaC,YAAYX,QAAQE,IAAI;YACjE,OAAO;gBAACF;aAAQ;QAClB;QACAgB,UAAU;QACV,IAAIE,YAAYE,MAAM,GAAG,GAAGnC,QAAQ;QACpC,OAAOiC;IACT;IAEA,IAAI,OAAOH,QAAQf,OAAO,KAAK,UAAU;QACvC,MAAMkB,cAAcD,WAAWF,QAAQf,OAAO;QAC9C,IAAIkB,YAAYE,MAAM,GAAG,GAAG;YAC1B,yDAAyD;YACzD,OAAOL,QAAQf,OAAO;YACtBe,QAAQM,QAAQ,GAAGH;QACrB,OAAO;YACLH,QAAQf,OAAO,GAAGkB,WAAW,CAAC,EAAE;QAClC;IACF,OAAO,IAAII,MAAMC,OAAO,CAACR,QAAQM,QAAQ,GAAG;QAC1CN,QAAQM,QAAQ,GAAGN,QAAQM,QAAQ,CAACG,OAAO,CAAC,CAACC;YAC3C,IAAI,OAAOA,UAAU,UAAU,OAAOR,WAAWQ;YACjD,IACEA,SACA,OAAOA,UAAU,YACjB,OAAO,AAACA,MAAgCzB,OAAO,KAAK,UACpD;gBACA,MAAM0B,IAAID;gBACV,OAAOR,WAAWS,EAAE1B,OAAO,EAAE2B,GAAG,CAAC,CAAC3B,UAAa,CAAA;wBAAE,GAAG0B,CAAC;wBAAE1B;oBAAQ,CAAA;YACjE;YACA,OAAO;gBAACyB;aAAM;QAChB;IACF;IAEA,IAAIxC,OAAO8B,QAAQa,QAAQ,GAAG;IAE9B,OAAOZ;AACT;AAEA,sDAAsD,GACtD,MAAMa,cAAc,CAACC;IACnB,MAAMT,WAAqB,EAAE;IAC7B,KAAK,MAAM,GAAGU,QAAQ,IAAI1D,YAAYyD,MAAO;QAC3C,KAAK,MAAMjB,UAAUmB,OAAOC,MAAM,CAACF,QAAQG,OAAO,IAAI,CAAC,GAAI;YACzD,MAAMnB,UAAUF,OAAOE,OAAO;YAG9B,IAAI,OAAOA,SAASf,YAAY,UAAUqB,SAASF,IAAI,CAACJ,QAAQf,OAAO;YACvE,IAAIsB,MAAMC,OAAO,CAACR,SAASM,WAAW;gBACpC,KAAK,MAAMI,SAASV,QAAQM,QAAQ,CAAE;oBACpC,IAAI,OAAOI,UAAU,UAAUJ,SAASF,IAAI,CAACM;yBACxC,IACH,OAAQA,OAAiCzB,YAAY,UAErDqB,SAASF,IAAI,CAAC,AAACM,MAA8BzB,OAAO;gBACxD;YACF;QACF;IACF;IACA,OAAOqB;AACT;AAEA,yEAAyE,GACzE,MAAMc,WAAmC;IACvC5B,KAAK;IACLJ,QAAQ;IACR,gBAAgB;IAChB,WAAW;AACb;AAEA,eAAe,eAAeiC,UAC5BN,IAAU;IAEV,MAAMhB,YAAsB,EAAE;IAE9B,KAAK,MAAM,CAACJ,aAAaqB,QAAQ,IAAI1D,YAAYyD,MAAO;QACtD,IAAId,UAAU;QAEd,KAAK,MAAM,CAACL,YAAYE,OAAO,IAAImB,OAAOK,OAAO,CAACN,QAAQG,OAAO,IAAI,CAAC,GAAI;YACxElB,UACEJ,cAAcF,aAAaC,YAAYE,QAAQC,cAAcE;QACjE;QAEA,IAAIA,SAAS;YACXzC,2BACEuD,MACApB,aACAqB;QAEJ;IACF;IAEA3D,6BAA6B0D,MAAM,CAAC,GAAG;QAAEQ,KAAK7D,YAAY6D,GAAG;IAAC;IAE9D,4EAA4E;IAC5E,oEAAoE;IACpE,MAAMjB,WAAWQ,YAAYC;IAC7B,MAAMS,SAAS7D,kBAAkB8D,MAAM,CACrC,CAACC,MACC,CAACpB,SAAS/B,IAAI,CAAC,CAACoD,IACd,IAAIC,OAAO,CAAC,WAAW,EAAER,QAAQ,CAACM,IAAI,CAAC,GAAG,CAAC,EAAEpD,IAAI,CAACqD;IAGxDpE,kCAAkCwD,MAAMS,QAAQA;IAEhD,MAAM/D,qBAAqBsD;IAE3B,OAAO;QAAEhB;IAAU;AACrB"}

package/src/migrations/v1.0.0-rc.94/0003-agent-core-vendor-target/migration.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../../../../../../../packages/nx-plugin/src/migrations/v1.0.0-rc.94/0003-agent-core-vendor-target/migration.ts"],"sourcesContent":["/**\n * Copyright Amazon.com, Inc. or its affiliates. All Rights Reserved.\n * SPDX-License-Identifier: Apache-2.0\n */\nimport {\n  getProjects,\n  joinPathFragments,\n  type MigrationReturnObject,\n  type ProjectConfiguration,\n  type TargetConfiguration,\n  type Tree,\n  updateProjectConfiguration,\n} from '@nx/devkit';\nimport {\n  ADOT_VENDOR_TARGET_NAME,\n  adotVendorDir,\n} from '../../../utils/agent-core-packaging.js';\nimport { formatFilesInSubtree } from '../../../utils/format.js';\n\n/**\n * A TypeScript AgentCore code package installed the AWS Distro for OpenTelemetry\n * into the package directory as its last packaging step. That target's `inputs`\n * are the project's source, so editing an agent re-ran the install — several\n * seconds of npm work whose result depends only on the pinned ADOT version.\n *\n * The install moves to its own target Nx caches independently. It declares no\n * `inputs`, since the version it pins is part of the command and Nx hashes a\n * target's configuration, so a version bump still invalidates it while a source\n * edit no longer does. Packaging copies the vendored tree instead.\n *\n * The vendor directory is a sibling of the package directory, not a path inside\n * it: Nx replaces a cached target's whole declared output directory on restore,\n * so nesting one target's output inside another's makes each wipe the other's\n * work on a cache hit.\n *\n * A packaging target that no longer matches the shape the generator vended has\n * been reworked by the user, so it is left untouched and reported.\n *\n * The filesystem commands are spelled with `shx`: the migration that replaced the\n * single purpose CLIs was committed first, and `latest` migrations run in the\n * order their folders were committed, so it has already run by the time this one\n * does.\n */\n\n/** The ADOT install as the packaging target ran it, capturing its `--prefix`. */\nconst ADOT_INSTALL =\n  /^npm install --prefix (\\S+) .*@aws\\/aws-distro-opentelemetry-node-autoinstrumentation@(\\S+)\\s*$/;\n\nconst divergedStep = (projectName: string, targetName: string) =>\n  `${projectName}:${targetName}: installs the OpenTelemetry distro but no longer matches the shape the generator produced - left untouched. To stop the install re-running whenever the project's source changes, move it to its own target with no \\`inputs\\` and an \\`outputs\\` directory outside this target's, and copy that directory in here instead.`;\n\n/** Commands a target runs, as plain strings. */\nconst commandsOf = (target: TargetConfiguration): string[] => {\n  const { commands } = (target.options ?? {}) as { commands?: unknown };\n  return Array.isArray(commands)\n    ? commands.filter((c): c is string => typeof c === 'string')\n    : [];\n};\n\n/**\n * Copy the vendored `node_modules` into the package. `-R` and the trailing `/.`\n * merge the directory's contents rather than nesting it inside the destination.\n */\nconst copyCommand = (vendorDir: string, packageDir: string): string =>\n  `shx cp -R ${joinPathFragments(vendorDir, 'node_modules')}/. ${joinPathFragments(packageDir, 'node_modules')}`;\n\nexport default async function migration(\n  tree: Tree,\n): Promise<MigrationReturnObject> {\n  const nextSteps: string[] = [];\n\n  for (const [projectName, project] of getProjects(tree)) {\n    let changed = false;\n    const vendorDir = adotVendorDir(project.root);\n\n    for (const [targetName, target] of Object.entries(project.targets ?? {})) {\n      if (targetName === ADOT_VENDOR_TARGET_NAME) continue;\n\n      const commands = commandsOf(target);\n      const installIndex = commands.findIndex((c) => ADOT_INSTALL.test(c));\n      if (installIndex < 0) continue;\n\n      const install = commands[installIndex];\n      const [, prefix] = ADOT_INSTALL.exec(install)!;\n\n      // The install targets the directory this target packages into, and it\n      // copies the bundle in with shx. Anything else has been reworked.\n      const packageDir = prefix;\n      const copiesBundle = commands.some(\n        (c) => c !== install && c.startsWith('shx cp '),\n      );\n      const declaresPackageOutput = (target.outputs ?? []).some((o) =>\n        o.endsWith(packageDir),\n      );\n      if (!copiesBundle || !declaresPackageOutput) {\n        nextSteps.push(divergedStep(projectName, targetName));\n        continue;\n      }\n\n      project.targets![ADOT_VENDOR_TARGET_NAME] ??= {\n        cache: true,\n        inputs: [],\n        outputs: [`{workspaceRoot}/${vendorDir}`],\n        executor: 'nx:run-commands',\n        options: {\n          commands: [\n            `shx rm -rf ${vendorDir}`,\n            `shx mkdir -p ${vendorDir}`,\n            install.replace(prefix, vendorDir),\n          ],\n          parallel: false,\n        },\n      };\n\n      const updated = [...commands];\n      updated[installIndex] = copyCommand(vendorDir, packageDir);\n      target.options!.commands = updated;\n      target.dependsOn = [\n        ...(target.dependsOn ?? []),\n        ADOT_VENDOR_TARGET_NAME,\n      ].filter((d, i, all) => all.indexOf(d) === i);\n\n      changed = true;\n    }\n\n    if (changed) {\n      updateProjectConfiguration(\n        tree,\n        projectName,\n        project as ProjectConfiguration,\n      );\n    }\n  }\n\n  await formatFilesInSubtree(tree);\n\n  return { nextSteps };\n}\n"],"names":["getProjects","joinPathFragments","updateProjectConfiguration","ADOT_VENDOR_TARGET_NAME","adotVendorDir","formatFilesInSubtree","ADOT_INSTALL","divergedStep","projectName","targetName","commandsOf","target","commands","options","Array","isArray","filter","c","copyCommand","vendorDir","packageDir","migration","tree","nextSteps","project","changed","root","Object","entries","targets","installIndex","findIndex","test","install","prefix","exec","copiesBundle","some","startsWith","declaresPackageOutput","outputs","o","endsWith","push","cache","inputs","executor","replace","parallel","updated","dependsOn","d","i","all","indexOf"],"mappings":"AAAA;;;CAGC,GACD,SACEA,WAAW,EACXC,iBAAiB,EAKjBC,0BAA0B,QACrB,aAAa;AACpB,SACEC,uBAAuB,EACvBC,aAAa,QACR,yCAAyC;AAChD,SAASC,oBAAoB,QAAQ,2BAA2B;AAEhE;;;;;;;;;;;;;;;;;;;;;;;CAuBC,GAED,+EAA+E,GAC/E,MAAMC,eACJ;AAEF,MAAMC,eAAe,CAACC,aAAqBC,aACzC,GAAGD,YAAY,CAAC,EAAEC,WAAW,4TAA4T,CAAC;AAE5V,8CAA8C,GAC9C,MAAMC,aAAa,CAACC;IAClB,MAAM,EAAEC,QAAQ,EAAE,GAAID,OAAOE,OAAO,IAAI,CAAC;IACzC,OAAOC,MAAMC,OAAO,CAACH,YACjBA,SAASI,MAAM,CAAC,CAACC,IAAmB,OAAOA,MAAM,YACjD,EAAE;AACR;AAEA;;;CAGC,GACD,MAAMC,cAAc,CAACC,WAAmBC,aACtC,CAAC,UAAU,EAAEnB,kBAAkBkB,WAAW,gBAAgB,GAAG,EAAElB,kBAAkBmB,YAAY,iBAAiB;AAEhH,eAAe,eAAeC,UAC5BC,IAAU;IAEV,MAAMC,YAAsB,EAAE;IAE9B,KAAK,MAAM,CAACf,aAAagB,QAAQ,IAAIxB,YAAYsB,MAAO;QACtD,IAAIG,UAAU;QACd,MAAMN,YAAYf,cAAcoB,QAAQE,IAAI;QAE5C,KAAK,MAAM,CAACjB,YAAYE,OAAO,IAAIgB,OAAOC,OAAO,CAACJ,QAAQK,OAAO,IAAI,CAAC,GAAI;YACxE,IAAIpB,eAAeN,yBAAyB;YAE5C,MAAMS,WAAWF,WAAWC;YAC5B,MAAMmB,eAAelB,SAASmB,SAAS,CAAC,CAACd,IAAMX,aAAa0B,IAAI,CAACf;YACjE,IAAIa,eAAe,GAAG;YAEtB,MAAMG,UAAUrB,QAAQ,CAACkB,aAAa;YACtC,MAAM,GAAGI,OAAO,GAAG5B,aAAa6B,IAAI,CAACF;YAErC,sEAAsE;YACtE,kEAAkE;YAClE,MAAMb,aAAac;YACnB,MAAME,eAAexB,SAASyB,IAAI,CAChC,CAACpB,IAAMA,MAAMgB,WAAWhB,EAAEqB,UAAU,CAAC;YAEvC,MAAMC,wBAAwB,AAAC5B,CAAAA,OAAO6B,OAAO,IAAI,EAAE,AAAD,EAAGH,IAAI,CAAC,CAACI,IACzDA,EAAEC,QAAQ,CAACtB;YAEb,IAAI,CAACgB,gBAAgB,CAACG,uBAAuB;gBAC3ChB,UAAUoB,IAAI,CAACpC,aAAaC,aAAaC;gBACzC;YACF;YAEAe,QAAQK,OAAO,AAAC,CAAC1B,wBAAwB,KAAK;gBAC5CyC,OAAO;gBACPC,QAAQ,EAAE;gBACVL,SAAS;oBAAC,CAAC,gBAAgB,EAAErB,WAAW;iBAAC;gBACzC2B,UAAU;gBACVjC,SAAS;oBACPD,UAAU;wBACR,CAAC,WAAW,EAAEO,WAAW;wBACzB,CAAC,aAAa,EAAEA,WAAW;wBAC3Bc,QAAQc,OAAO,CAACb,QAAQf;qBACzB;oBACD6B,UAAU;gBACZ;YACF;YAEA,MAAMC,UAAU;mBAAIrC;aAAS;YAC7BqC,OAAO,CAACnB,aAAa,GAAGZ,YAAYC,WAAWC;YAC/CT,OAAOE,OAAO,CAAED,QAAQ,GAAGqC;YAC3BtC,OAAOuC,SAAS,GAAG;mBACbvC,OAAOuC,SAAS,IAAI,EAAE;gBAC1B/C;aACD,CAACa,MAAM,CAAC,CAACmC,GAAGC,GAAGC,MAAQA,IAAIC,OAAO,CAACH,OAAOC;YAE3C3B,UAAU;QACZ;QAEA,IAAIA,SAAS;YACXvB,2BACEoB,MACAd,aACAgB;QAEJ;IACF;IAEA,MAAMnB,qBAAqBiB;IAE3B,OAAO;QAAEC;IAAU;AACrB"}

package/src/migrations/v1.0.0-rc.95/0001-rolldown-config-bundle-transient/migration.d.ts

@@ -0,0 +1,6 @@
+/**
+ * Copyright Amazon.com, Inc. or its affiliates. All Rights Reserved.
+ * SPDX-License-Identifier: Apache-2.0
+ */
+import { type MigrationReturnObject, type Tree } from '@nx/devkit';
+export default function migration(tree: Tree): Promise<MigrationReturnObject>;

package/src/migrations/v1.0.0-rc.95/0001-rolldown-config-bundle-transient/migration.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../../../../../../../packages/nx-plugin/src/migrations/v1.0.0-rc.95/0001-rolldown-config-bundle-transient/migration.ts"],"sourcesContent":["/**\n * Copyright Amazon.com, Inc. or its affiliates. All Rights Reserved.\n * SPDX-License-Identifier: Apache-2.0\n */\nimport {\n  getProjects,\n  joinPathFragments,\n  type MigrationReturnObject,\n  type Tree,\n  updateJson,\n} from '@nx/devkit';\nimport {\n  BIOME_ROLLDOWN_CONFIG_BUNDLE_EXCLUDE,\n  formatFilesInSubtree,\n  ROLLDOWN_CONFIG_BUNDLE_GLOB,\n} from '../../../utils/format.js';\nimport { updateGitIgnore } from '../../../utils/git.js';\n\n/**\n * Keep rolldown's transient config bundle out of Biome's and git's reach.\n *\n * Loading a `rolldown.config.ts` bundles it to `rolldown.config.<hash>.js` in the\n * config's own directory, imports it, then unlinks it. The `bundle`, `format` and\n * `lint` targets of a project all run concurrently, so a `format` sweeping the\n * project mid-bundle sees a machine-generated file and reports it unformatted —\n * failing the target for no fault of the source. Being git-visible, the file\n * could also be committed, or picked up by `license#sync`, which builds its\n * candidate set from git-visible files rather than from `biome.json`.\n *\n * Guardrails:\n * - The Biome exclude is anchored to the excludes we vend. A workspace whose\n *   `files.includes` has diverged keeps its own list, and is reported via\n *   `nextSteps` instead.\n * - Only projects carrying a `rolldown.config.ts` get the git ignore, matching\n *   where the generator writes it.\n * - Idempotent: both edits are guarded on the pattern already being present.\n */\n\n/** The config filename whose loading produces the transient bundle. */\nconst ROLLDOWN_CONFIG = 'rolldown.config.ts';\n\n/**\n * Exclude the transient bundle from Biome. Anchored to `!**\\/out-tsc`, the\n * build-output exclude the vended list places these next to — without it the list\n * has diverged from the one we vend, so leave it to the user.\n */\nconst excludeFromBiome = (tree: Tree): string[] => {\n  if (!tree.exists('biome.json')) {\n    return [];\n  }\n  let unrecognised = false;\n  updateJson(tree, 'biome.json', (biome) => {\n    const includes: unknown = biome?.files?.includes;\n    if (\n      !Array.isArray(includes) ||\n      includes.includes(BIOME_ROLLDOWN_CONFIG_BUNDLE_EXCLUDE)\n    ) {\n      return biome;\n    }\n    if (!includes.includes('!**/out-tsc')) {\n      unrecognised = true;\n      return biome;\n    }\n    return {\n      ...biome,\n      files: {\n        ...biome.files,\n        includes: includes.flatMap((include) =>\n          include === '!**/out-tsc'\n            ? [include, BIOME_ROLLDOWN_CONFIG_BUNDLE_EXCLUDE]\n            : [include],\n        ),\n      },\n    };\n  });\n  return unrecognised\n    ? [\n        `\\`biome.json\\`: add \\`\"${BIOME_ROLLDOWN_CONFIG_BUNDLE_EXCLUDE}\"\\` to \\`files.includes\\` so the transient bundle rolldown writes while loading a TypeScript config is never formatted or linted. Its \\`files.includes\\` has diverged from the vended list, so it was left as it is.`,\n      ]\n    : [];\n};\n\nexport default async function migration(\n  tree: Tree,\n): Promise<MigrationReturnObject> {\n  const nextSteps: string[] = [...excludeFromBiome(tree)];\n\n  for (const [, project] of getProjects(tree)) {\n    if (!tree.exists(joinPathFragments(project.root, ROLLDOWN_CONFIG))) {\n      continue;\n    }\n    updateGitIgnore(tree, project.root, (patterns) =>\n      patterns.includes(ROLLDOWN_CONFIG_BUNDLE_GLOB)\n        ? patterns\n        : [...patterns, ROLLDOWN_CONFIG_BUNDLE_GLOB],\n    );\n  }\n\n  await formatFilesInSubtree(tree);\n\n  return { nextSteps };\n}\n"],"names":["getProjects","joinPathFragments","updateJson","BIOME_ROLLDOWN_CONFIG_BUNDLE_EXCLUDE","formatFilesInSubtree","ROLLDOWN_CONFIG_BUNDLE_GLOB","updateGitIgnore","ROLLDOWN_CONFIG","excludeFromBiome","tree","exists","unrecognised","biome","includes","files","Array","isArray","flatMap","include","migration","nextSteps","project","root","patterns"],"mappings":"AAAA;;;CAGC,GACD,SACEA,WAAW,EACXC,iBAAiB,EAGjBC,UAAU,QACL,aAAa;AACpB,SACEC,oCAAoC,EACpCC,oBAAoB,EACpBC,2BAA2B,QACtB,2BAA2B;AAClC,SAASC,eAAe,QAAQ,wBAAwB;AAExD;;;;;;;;;;;;;;;;;;CAkBC,GAED,qEAAqE,GACrE,MAAMC,kBAAkB;AAExB;;;;CAIC,GACD,MAAMC,mBAAmB,CAACC;IACxB,IAAI,CAACA,KAAKC,MAAM,CAAC,eAAe;QAC9B,OAAO,EAAE;IACX;IACA,IAAIC,eAAe;IACnBT,WAAWO,MAAM,cAAc,CAACG;QAC9B,MAAMC,WAAoBD,OAAOE,OAAOD;QACxC,IACE,CAACE,MAAMC,OAAO,CAACH,aACfA,SAASA,QAAQ,CAACV,uCAClB;YACA,OAAOS;QACT;QACA,IAAI,CAACC,SAASA,QAAQ,CAAC,gBAAgB;YACrCF,eAAe;YACf,OAAOC;QACT;QACA,OAAO;YACL,GAAGA,KAAK;YACRE,OAAO;gBACL,GAAGF,MAAME,KAAK;gBACdD,UAAUA,SAASI,OAAO,CAAC,CAACC,UAC1BA,YAAY,gBACR;wBAACA;wBAASf;qBAAqC,GAC/C;wBAACe;qBAAQ;YAEjB;QACF;IACF;IACA,OAAOP,eACH;QACE,CAAC,uBAAuB,EAAER,qCAAqC,oNAAoN,CAAC;KACrR,GACD,EAAE;AACR;AAEA,eAAe,eAAegB,UAC5BV,IAAU;IAEV,MAAMW,YAAsB;WAAIZ,iBAAiBC;KAAM;IAEvD,KAAK,MAAM,GAAGY,QAAQ,IAAIrB,YAAYS,MAAO;QAC3C,IAAI,CAACA,KAAKC,MAAM,CAACT,kBAAkBoB,QAAQC,IAAI,EAAEf,mBAAmB;YAClE;QACF;QACAD,gBAAgBG,MAAMY,QAAQC,IAAI,EAAE,CAACC,WACnCA,SAASV,QAAQ,CAACR,+BACdkB,WACA;mBAAIA;gBAAUlB;aAA4B;IAElD;IAEA,MAAMD,qBAAqBK;IAE3B,OAAO;QAAEW;IAAU;AACrB"}

package/src/migrations/v1.0.0-rc.95/0002-agent-connection-pin-strands-peers/migration.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../../../../../../../packages/nx-plugin/src/migrations/v1.0.0-rc.95/0002-agent-connection-pin-strands-peers/migration.ts"],"sourcesContent":["/**\n * Copyright Amazon.com, Inc. or its affiliates. All Rights Reserved.\n * SPDX-License-Identifier: Apache-2.0\n */\nimport { joinPathFragments, type Tree } from '@nx/devkit';\nimport { AGENT_CONNECTION_PROJECT_DIR } from '../../../utils/agent-connection/agent-connection.js';\nimport { addDependenciesToPackageJson } from '../../../utils/dependencies.js';\nimport { formatFilesInSubtree } from '../../../utils/format.js';\nimport { TS_VERSIONS } from '../../../utils/versions.js';\n\nconst CLIENT_S3 = '@aws-sdk/client-s3';\nconst STRANDS_SDK = '@strands-agents/sdk';\n\n/**\n * `@aws-sdk/client-s3` is an optional peer of `@strands-agents/sdk` that the\n * shared agent-connection project never imports, so it went undeclared. pnpm\n * then auto-installs its own copy there while a project that does declare it\n * gets the catalog's, and those two resolutions give `@strands-agents/sdk` two\n * peer-suffixed instances of the same version.\n *\n * Anything importing both projects then sees two nominal identities of every SDK\n * type — `Agent`, `McpClient`, `Plugin` — and fails to compile with \"Types have\n * separate declarations of a private property\". Declaring it keeps the version\n * on the catalog, collapsing both to one instance.\n */\nexport default async function migration(tree: Tree): Promise<void> {\n  const packageJsonPath = joinPathFragments(\n    AGENT_CONNECTION_PROJECT_DIR,\n    'package.json',\n  );\n  if (!tree.exists(packageJsonPath)) {\n    return;\n  }\n\n  // Only where a strands client is actually present — that is what pulls the peer.\n  const packageJson = JSON.parse(tree.read(packageJsonPath, 'utf-8') ?? '{}');\n  if (!packageJson.dependencies?.[STRANDS_SDK]) {\n    return;\n  }\n\n  addDependenciesToPackageJson(\n    tree,\n    { [CLIENT_S3]: TS_VERSIONS[CLIENT_S3] },\n    {},\n    packageJsonPath,\n  );\n\n  await formatFilesInSubtree(tree);\n}\n"],"names":["joinPathFragments","AGENT_CONNECTION_PROJECT_DIR","addDependenciesToPackageJson","formatFilesInSubtree","TS_VERSIONS","CLIENT_S3","STRANDS_SDK","migration","tree","packageJsonPath","exists","packageJson","JSON","parse","read","dependencies"],"mappings":"AAAA;;;CAGC,GACD,SAASA,iBAAiB,QAAmB,aAAa;AAC1D,SAASC,4BAA4B,QAAQ,sDAAsD;AACnG,SAASC,4BAA4B,QAAQ,iCAAiC;AAC9E,SAASC,oBAAoB,QAAQ,2BAA2B;AAChE,SAASC,WAAW,QAAQ,6BAA6B;AAEzD,MAAMC,YAAY;AAClB,MAAMC,cAAc;AAEpB;;;;;;;;;;;CAWC,GACD,eAAe,eAAeC,UAAUC,IAAU;IAChD,MAAMC,kBAAkBT,kBACtBC,8BACA;IAEF,IAAI,CAACO,KAAKE,MAAM,CAACD,kBAAkB;QACjC;IACF;IAEA,iFAAiF;IACjF,MAAME,cAAcC,KAAKC,KAAK,CAACL,KAAKM,IAAI,CAACL,iBAAiB,YAAY;IACtE,IAAI,CAACE,YAAYI,YAAY,EAAE,CAACT,YAAY,EAAE;QAC5C;IACF;IAEAJ,6BACEM,MACA;QAAE,CAACH,UAAU,EAAED,WAAW,CAACC,UAAU;IAAC,GACtC,CAAC,GACDI;IAGF,MAAMN,qBAAqBK;AAC7B"}

package/src/migrations/v1.0.0-rc.95/0003-ignore-package-manager-temp-files/migration.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../../../../../../../packages/nx-plugin/src/migrations/v1.0.0-rc.95/0003-ignore-package-manager-temp-files/migration.ts"],"sourcesContent":["/**\n * Copyright Amazon.com, Inc. or its affiliates. All Rights Reserved.\n * SPDX-License-Identifier: Apache-2.0\n */\nimport type { Tree } from '@nx/devkit';\nimport { formatFilesInSubtree } from '../../../utils/format.js';\nimport { updateGitIgnore } from '../../../utils/git.js';\n\n/** The temporary files pnpm writes while materialising packages. */\nconst TEMP_FILE_PATTERN = '_tmp_*';\n\n/**\n * pnpm creates `_tmp_<pid>_<hash>` files at the workspace root while it\n * materialises packages. Left unignored, Nx's watcher invalidates the project\n * graph on every install, so a watch-mode `dev` target running at the time\n * rebuilds the graph continuously and never starts the command it wraps.\n */\nexport default async function migration(tree: Tree): Promise<void> {\n  // Only pnpm writes these, so key off its lockfile rather than the workspace\n  // file — a workspace on another package manager may still carry one.\n  if (!tree.exists('pnpm-lock.yaml')) {\n    return;\n  }\n\n  updateGitIgnore(tree, '.', (patterns) =>\n    patterns.includes(TEMP_FILE_PATTERN)\n      ? patterns\n      : [...patterns, TEMP_FILE_PATTERN],\n  );\n\n  await formatFilesInSubtree(tree);\n}\n"],"names":["formatFilesInSubtree","updateGitIgnore","TEMP_FILE_PATTERN","migration","tree","exists","patterns","includes"],"mappings":"AAAA;;;CAGC,GAED,SAASA,oBAAoB,QAAQ,2BAA2B;AAChE,SAASC,eAAe,QAAQ,wBAAwB;AAExD,kEAAkE,GAClE,MAAMC,oBAAoB;AAE1B;;;;;CAKC,GACD,eAAe,eAAeC,UAAUC,IAAU;IAChD,4EAA4E;IAC5E,qEAAqE;IACrE,IAAI,CAACA,KAAKC,MAAM,CAAC,mBAAmB;QAClC;IACF;IAEAJ,gBAAgBG,MAAM,KAAK,CAACE,WAC1BA,SAASC,QAAQ,CAACL,qBACdI,WACA;eAAIA;YAAUJ;SAAkB;IAGtC,MAAMF,qBAAqBI;AAC7B"}

package/src/migrations/v1.0.0-rc.95/0004-shadcn-package-imports-exports/migration.d.ts

@@ -0,0 +1,6 @@
+/**
+ * Copyright Amazon.com, Inc. or its affiliates. All Rights Reserved.
+ * SPDX-License-Identifier: Apache-2.0
+ */
+import { type MigrationReturnObject, type Tree } from '@nx/devkit';
+export default function migration(tree: Tree): Promise<MigrationReturnObject>;

package/src/migrations/v1.0.0-rc.95/0004-shadcn-package-imports-exports/migration.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../../../../../../../packages/nx-plugin/src/migrations/v1.0.0-rc.95/0004-shadcn-package-imports-exports/migration.ts"],"sourcesContent":["/**\n * Copyright Amazon.com, Inc. or its affiliates. All Rights Reserved.\n * SPDX-License-Identifier: Apache-2.0\n */\nimport {\n  getProjects,\n  joinPathFragments,\n  type MigrationReturnObject,\n  readJson,\n  type Tree,\n  updateJson,\n} from '@nx/devkit';\nimport { REACT_WEBSITE_APP_GENERATOR_INFO } from '../../../ts/react-website/app/generator.js';\nimport { applyGritQL, matchGritQL } from '../../../utils/ast.js';\nimport {\n  addDependenciesToPackageJson,\n  getLocalDependencySpecifier,\n} from '../../../utils/dependencies.js';\nimport { formatFilesInSubtree } from '../../../utils/format.js';\nimport {\n  PACKAGES_DIR,\n  SHARED_SHADCN_DIR,\n} from '../../../utils/shared-constructs-constants.js';\nimport { getSharedShadcnFullyQualifiedName } from '../../../utils/shared-shadcn.js';\n\n/**\n * Move the shared shadcn package off a `tsconfig.base.json` `paths` alias onto\n * `package.json` `imports`/`exports`.\n *\n * shadcn 4.x's CLI resolves `components.json`'s aliases via Node's package\n * resolution (`imports`/`exports`), not tsconfig `paths` - its own resolver\n * naively joins a tsconfig-declared alias against whichever directory it's\n * invoked from, so the repo-root-relative `paths` mapping this plugin used to\n * vend breaks the moment `shadcn add` is run with `-c packages/common/shadcn`\n * (as its own monorepo-root preflight now tells the user to). This migration\n * carries an existing workspace onto the shape today's generators produce:\n * local `#...` imports for the package's own internal component references,\n * a public `exports` map for every other consumer, and a real `workspace:*`\n * dependency on each consumer so that map actually resolves.\n *\n * How to write a migration:\n * - https://nx.dev/docs/kb/migration-generators\n * - What `nextSteps` means: https://nx.dev/docs/reference/devkit/MigrationReturnObject\n *\n * Guardrails:\n * - Only touches a `packages/common/shadcn` this plugin's generators produced\n *   (guarded by `components.json`'s aliases still matching the old shape).\n * - Internal imports are rewritten by exact module specifier per file found\n *   under `src/{components/ui,lib,hooks}`, so a component a user added by hand\n *   after the original generation is covered too, and a specifier the\n *   migration doesn't recognise is left alone and reported.\n * - Idempotent: every write is guarded by the old shape still being present.\n */\n\nconst libraryRoot = joinPathFragments(PACKAGES_DIR, SHARED_SHADCN_DIR);\nconst componentsJsonPath = joinPathFragments(libraryRoot, 'components.json');\nconst packageJsonPath = joinPathFragments(libraryRoot, 'package.json');\n\ninterface ComponentsJsonAliases {\n  readonly components?: string;\n  readonly utils?: string;\n  readonly hooks?: string;\n  readonly lib?: string;\n  readonly ui?: string;\n}\n\nconst oldAliases = (fqn: string): ComponentsJsonAliases => ({\n  components: `${fqn}/components`,\n  utils: `${fqn}/lib/utils`,\n  hooks: `${fqn}/hooks`,\n  lib: `${fqn}/lib`,\n  ui: `${fqn}/components/ui`,\n});\n\nconst newAliases: Required<ComponentsJsonAliases> = {\n  components: '#components',\n  utils: '#lib/utils',\n  hooks: '#hooks',\n  lib: '#lib',\n  ui: '#components/ui',\n};\n\nconst newPackageManifestFields = {\n  imports: {\n    '#components/*': './src/components/*.tsx',\n    '#lib/*': './src/lib/*.ts',\n    '#hooks/*': './src/hooks/*.ts',\n  },\n  exports: {\n    '.': './src/index.ts',\n    './styles/*': './src/styles/*',\n    './components/*': './src/components/*.tsx',\n    './lib/*': './src/lib/*.ts',\n    './hooks/*': './src/hooks/*.ts',\n  },\n};\n\n/**\n * Rewrite an import's module specifier, keeping its bindings - `$bindings`\n * holds whatever the file imports, so a binding a user added survives.\n */\nconst importPattern = (from: string, to: string): string =>\n  `\\`import { $bindings } from '${from}'\\` => \\`import { $bindings } from '${to}'\\``;\n\n/** Whether the file still imports the old specifier under any other form. */\nconst hasRemainingImport = (from: string): string =>\n  `\\`import $_ from '${from}'\\``;\n\nexport default async function migration(\n  tree: Tree,\n): Promise<MigrationReturnObject> {\n  const nextSteps: string[] = [];\n\n  if (!tree.exists(componentsJsonPath) || !tree.exists(packageJsonPath)) {\n    return { nextSteps };\n  }\n\n  const fullyQualifiedName = getSharedShadcnFullyQualifiedName(tree);\n  const currentAliases =\n    readJson<{ aliases?: ComponentsJsonAliases }>(tree, componentsJsonPath)\n      .aliases ?? {};\n  const expectedOldAliases = oldAliases(fullyQualifiedName);\n  const onOldShape = (\n    Object.keys(newAliases) as (keyof ComponentsJsonAliases)[]\n  ).every((key) => currentAliases[key] === expectedOldAliases[key]);\n\n  if (!onOldShape) {\n    if (\n      (Object.keys(newAliases) as (keyof ComponentsJsonAliases)[]).some(\n        (key) => currentAliases[key] !== newAliases[key],\n      )\n    ) {\n      nextSteps.push(\n        `${componentsJsonPath}: aliases have diverged from both the old and current generated shape - left untouched. Migrate them to the shadcn CLI's imports/exports monorepo pattern by hand: https://ui.shadcn.com/docs/monorepo`,\n      );\n    }\n    await formatFilesInSubtree(tree);\n    return { nextSteps };\n  }\n\n  // Rewrite every source file's internal references to this package's own\n  // components/lib/hooks, keyed off the files actually present so a\n  // hand-added component is covered too.\n  const internalDirs: Array<{\n    dir: string;\n    extension: string;\n    oldSubpath: string;\n    newPrefix: string;\n  }> = [\n    {\n      dir: joinPathFragments(libraryRoot, 'src', 'components', 'ui'),\n      extension: '.tsx',\n      oldSubpath: 'components/ui',\n      newPrefix: '#components/ui',\n    },\n    {\n      dir: joinPathFragments(libraryRoot, 'src', 'lib'),\n      extension: '.ts',\n      oldSubpath: 'lib',\n      newPrefix: '#lib',\n    },\n    {\n      dir: joinPathFragments(libraryRoot, 'src', 'hooks'),\n      extension: '.ts',\n      oldSubpath: 'hooks',\n      newPrefix: '#hooks',\n    },\n  ];\n\n  const renames: Array<{ old: string; renamed: string }> = [];\n  const sourceFiles: string[] = [];\n  for (const { dir, extension, oldSubpath, newPrefix } of internalDirs) {\n    if (!tree.exists(dir)) {\n      continue;\n    }\n    for (const entry of tree.children(dir)) {\n      if (!entry.endsWith(extension)) {\n        continue;\n      }\n      const baseName = entry.slice(0, -extension.length);\n      renames.push({\n        old: `${fullyQualifiedName}/${oldSubpath}/${baseName}`,\n        renamed: `${newPrefix}/${baseName}`,\n      });\n      sourceFiles.push(joinPathFragments(dir, entry));\n    }\n  }\n\n  for (const sourceFile of sourceFiles) {\n    for (const { old, renamed } of renames) {\n      await applyGritQL(tree, sourceFile, importPattern(old, renamed));\n      // A namespace or default import of the same specifier is left as it\n      // is - reported rather than rewritten, so a diverged file is never\n      // clobbered.\n      if (await matchGritQL(tree, sourceFile, hasRemainingImport(old))) {\n        nextSteps.push(\n          `${sourceFile}: still imports '${old}' in a form this migration does not rewrite - update it to '${renamed}' by hand.`,\n        );\n      }\n    }\n  }\n\n  updateJson(tree, componentsJsonPath, (json) => ({\n    ...json,\n    aliases: newAliases,\n  }));\n\n  updateJson(tree, packageJsonPath, (json) => ({\n    ...json,\n    ...newPackageManifestFields,\n  }));\n\n  updateJson(tree, 'tsconfig.base.json', (json) => {\n    const paths = { ...(json.compilerOptions?.paths ?? {}) };\n    delete paths[`${fullyQualifiedName}/*`];\n    return {\n      ...json,\n      compilerOptions: {\n        ...json.compilerOptions,\n        paths,\n      },\n    };\n  });\n\n  // Every website generated with ux=shadcn needs a real dependency on the\n  // shared package now that it resolves through `exports`, not `paths`.\n  for (const project of getProjects(tree).values()) {\n    const metadata = project.metadata as\n      | { generator?: string; ux?: string }\n      | undefined;\n    if (\n      metadata?.generator !== REACT_WEBSITE_APP_GENERATOR_INFO.id ||\n      metadata.ux !== 'shadcn'\n    ) {\n      continue;\n    }\n    addDependenciesToPackageJson(\n      tree,\n      { [fullyQualifiedName]: getLocalDependencySpecifier(tree) },\n      {},\n      joinPathFragments(project.root, 'package.json'),\n    );\n  }\n\n  await formatFilesInSubtree(tree);\n\n  return { nextSteps };\n}\n"],"names":["getProjects","joinPathFragments","readJson","updateJson","REACT_WEBSITE_APP_GENERATOR_INFO","applyGritQL","matchGritQL","addDependenciesToPackageJson","getLocalDependencySpecifier","formatFilesInSubtree","PACKAGES_DIR","SHARED_SHADCN_DIR","getSharedShadcnFullyQualifiedName","libraryRoot","componentsJsonPath","packageJsonPath","oldAliases","fqn","components","utils","hooks","lib","ui","newAliases","newPackageManifestFields","imports","exports","importPattern","from","to","hasRemainingImport","migration","tree","nextSteps","exists","fullyQualifiedName","currentAliases","aliases","expectedOldAliases","onOldShape","Object","keys","every","key","some","push","internalDirs","dir","extension","oldSubpath","newPrefix","renames","sourceFiles","entry","children","endsWith","baseName","slice","length","old","renamed","sourceFile","json","paths","compilerOptions","project","values","metadata","generator","id","ux","root"],"mappings":"AAAA;;;CAGC,GACD,SACEA,WAAW,EACXC,iBAAiB,EAEjBC,QAAQ,EAERC,UAAU,QACL,aAAa;AACpB,SAASC,gCAAgC,QAAQ,6CAA6C;AAC9F,SAASC,WAAW,EAAEC,WAAW,QAAQ,wBAAwB;AACjE,SACEC,4BAA4B,EAC5BC,2BAA2B,QACtB,iCAAiC;AACxC,SAASC,oBAAoB,QAAQ,2BAA2B;AAChE,SACEC,YAAY,EACZC,iBAAiB,QACZ,gDAAgD;AACvD,SAASC,iCAAiC,QAAQ,kCAAkC;AAEpF;;;;;;;;;;;;;;;;;;;;;;;;;;;CA2BC,GAED,MAAMC,cAAcZ,kBAAkBS,cAAcC;AACpD,MAAMG,qBAAqBb,kBAAkBY,aAAa;AAC1D,MAAME,kBAAkBd,kBAAkBY,aAAa;AAUvD,MAAMG,aAAa,CAACC,MAAwC,CAAA;QAC1DC,YAAY,GAAGD,IAAI,WAAW,CAAC;QAC/BE,OAAO,GAAGF,IAAI,UAAU,CAAC;QACzBG,OAAO,GAAGH,IAAI,MAAM,CAAC;QACrBI,KAAK,GAAGJ,IAAI,IAAI,CAAC;QACjBK,IAAI,GAAGL,IAAI,cAAc,CAAC;IAC5B,CAAA;AAEA,MAAMM,aAA8C;IAClDL,YAAY;IACZC,OAAO;IACPC,OAAO;IACPC,KAAK;IACLC,IAAI;AACN;AAEA,MAAME,2BAA2B;IAC/BC,SAAS;QACP,iBAAiB;QACjB,UAAU;QACV,YAAY;IACd;IACAC,SAAS;QACP,KAAK;QACL,cAAc;QACd,kBAAkB;QAClB,WAAW;QACX,aAAa;IACf;AACF;AAEA;;;CAGC,GACD,MAAMC,gBAAgB,CAACC,MAAcC,KACnC,CAAC,6BAA6B,EAAED,KAAK,oCAAoC,EAAEC,GAAG,GAAG,CAAC;AAEpF,2EAA2E,GAC3E,MAAMC,qBAAqB,CAACF,OAC1B,CAAC,kBAAkB,EAAEA,KAAK,GAAG,CAAC;AAEhC,eAAe,eAAeG,UAC5BC,IAAU;IAEV,MAAMC,YAAsB,EAAE;IAE9B,IAAI,CAACD,KAAKE,MAAM,CAACpB,uBAAuB,CAACkB,KAAKE,MAAM,CAACnB,kBAAkB;QACrE,OAAO;YAAEkB;QAAU;IACrB;IAEA,MAAME,qBAAqBvB,kCAAkCoB;IAC7D,MAAMI,iBACJlC,SAA8C8B,MAAMlB,oBACjDuB,OAAO,IAAI,CAAC;IACjB,MAAMC,qBAAqBtB,WAAWmB;IACtC,MAAMI,aAAa,AACjBC,OAAOC,IAAI,CAAClB,YACZmB,KAAK,CAAC,CAACC,MAAQP,cAAc,CAACO,IAAI,KAAKL,kBAAkB,CAACK,IAAI;IAEhE,IAAI,CAACJ,YAAY;QACf,IACE,AAACC,OAAOC,IAAI,CAAClB,YAAgDqB,IAAI,CAC/D,CAACD,MAAQP,cAAc,CAACO,IAAI,KAAKpB,UAAU,CAACoB,IAAI,GAElD;YACAV,UAAUY,IAAI,CACZ,GAAG/B,mBAAmB,sMAAsM,CAAC;QAEjO;QACA,MAAML,qBAAqBuB;QAC3B,OAAO;YAAEC;QAAU;IACrB;IAEA,wEAAwE;IACxE,kEAAkE;IAClE,uCAAuC;IACvC,MAAMa,eAKD;QACH;YACEC,KAAK9C,kBAAkBY,aAAa,OAAO,cAAc;YACzDmC,WAAW;YACXC,YAAY;YACZC,WAAW;QACb;QACA;YACEH,KAAK9C,kBAAkBY,aAAa,OAAO;YAC3CmC,WAAW;YACXC,YAAY;YACZC,WAAW;QACb;QACA;YACEH,KAAK9C,kBAAkBY,aAAa,OAAO;YAC3CmC,WAAW;YACXC,YAAY;YACZC,WAAW;QACb;KACD;IAED,MAAMC,UAAmD,EAAE;IAC3D,MAAMC,cAAwB,EAAE;IAChC,KAAK,MAAM,EAAEL,GAAG,EAAEC,SAAS,EAAEC,UAAU,EAAEC,SAAS,EAAE,IAAIJ,aAAc;QACpE,IAAI,CAACd,KAAKE,MAAM,CAACa,MAAM;YACrB;QACF;QACA,KAAK,MAAMM,SAASrB,KAAKsB,QAAQ,CAACP,KAAM;YACtC,IAAI,CAACM,MAAME,QAAQ,CAACP,YAAY;gBAC9B;YACF;YACA,MAAMQ,WAAWH,MAAMI,KAAK,CAAC,GAAG,CAACT,UAAUU,MAAM;YACjDP,QAAQN,IAAI,CAAC;gBACXc,KAAK,GAAGxB,mBAAmB,CAAC,EAAEc,WAAW,CAAC,EAAEO,UAAU;gBACtDI,SAAS,GAAGV,UAAU,CAAC,EAAEM,UAAU;YACrC;YACAJ,YAAYP,IAAI,CAAC5C,kBAAkB8C,KAAKM;QAC1C;IACF;IAEA,KAAK,MAAMQ,cAAcT,YAAa;QACpC,KAAK,MAAM,EAAEO,GAAG,EAAEC,OAAO,EAAE,IAAIT,QAAS;YACtC,MAAM9C,YAAY2B,MAAM6B,YAAYlC,cAAcgC,KAAKC;YACvD,oEAAoE;YACpE,mEAAmE;YACnE,aAAa;YACb,IAAI,MAAMtD,YAAY0B,MAAM6B,YAAY/B,mBAAmB6B,OAAO;gBAChE1B,UAAUY,IAAI,CACZ,GAAGgB,WAAW,iBAAiB,EAAEF,IAAI,4DAA4D,EAAEC,QAAQ,UAAU,CAAC;YAE1H;QACF;IACF;IAEAzD,WAAW6B,MAAMlB,oBAAoB,CAACgD,OAAU,CAAA;YAC9C,GAAGA,IAAI;YACPzB,SAASd;QACX,CAAA;IAEApB,WAAW6B,MAAMjB,iBAAiB,CAAC+C,OAAU,CAAA;YAC3C,GAAGA,IAAI;YACP,GAAGtC,wBAAwB;QAC7B,CAAA;IAEArB,WAAW6B,MAAM,sBAAsB,CAAC8B;QACtC,MAAMC,QAAQ;YAAE,GAAID,KAAKE,eAAe,EAAED,SAAS,CAAC,CAAC;QAAE;QACvD,OAAOA,KAAK,CAAC,GAAG5B,mBAAmB,EAAE,CAAC,CAAC;QACvC,OAAO;YACL,GAAG2B,IAAI;YACPE,iBAAiB;gBACf,GAAGF,KAAKE,eAAe;gBACvBD;YACF;QACF;IACF;IAEA,wEAAwE;IACxE,sEAAsE;IACtE,KAAK,MAAME,WAAWjE,YAAYgC,MAAMkC,MAAM,GAAI;QAChD,MAAMC,WAAWF,QAAQE,QAAQ;QAGjC,IACEA,UAAUC,cAAchE,iCAAiCiE,EAAE,IAC3DF,SAASG,EAAE,KAAK,UAChB;YACA;QACF;QACA/D,6BACEyB,MACA;YAAE,CAACG,mBAAmB,EAAE3B,4BAA4BwB;QAAM,GAC1D,CAAC,GACD/B,kBAAkBgE,QAAQM,IAAI,EAAE;IAEpC;IAEA,MAAM9D,qBAAqBuB;IAE3B,OAAO;QAAEC;IAAU;AACrB"}

package/src/migrations/v1.0.0-rc.97/0001-gateway-url-accessor/__snapshots__/migration.spec.ts.snap

@@ -0,0 +1,84 @@
+// Vitest Snapshot v1, https://vitest.dev/guide/snapshot.html
+
+exports[`gateway-url-accessor migration > should add the gatewayUrl accessor to the vended core construct 1`] = `
+"import * as agentcore from 'aws-cdk-lib/aws-bedrockagentcore';
+import * as iam from 'aws-cdk-lib/aws-iam';
+import { Construct } from 'constructs';
+
+export class AgentCoreGateway extends Construct implements iam.IGrantable {
+  public readonly gateway: agentcore.Gateway;
+
+  constructor(scope: Construct, id: string) {
+    super(scope, id);
+    this.gateway = undefined as any;
+  }
+
+  /**
+   * The principal to grant permissions to.
+   */
+  public get grantPrincipal(): iam.IPrincipal {
+    return this.gateway.role.grantPrincipal;
+  }
+
+  /**
+   * The gateway's URL endpoint. The Gateway L2 types its own \`gatewayUrl\` as
+   * optional and only populates it when created from its own props, so fall
+   * back to the CloudFormation attribute.
+   */
+  public get gatewayUrl(): string {
+    return (
+      this.gateway.gatewayUrl ??
+      (this.gateway.node.defaultChild as agentcore.CfnGateway).attrGatewayUrl
+    );
+  }
+
+  public addGateway(
+    gateway: Construct & {
+      readonly gateway: agentcore.Gateway;
+      readonly gatewayName: string;
+      readonly gatewayUrl: string;
+    },
+    props?: {
+      gatewayTargetName?: string;
+    },
+  ): agentcore.CfnGatewayTarget {
+    const target = this.addGatewayTarget({
+      gatewayTargetName: props?.gatewayTargetName ?? gateway.gatewayName,
+      gatewayUrl: gateway.gatewayUrl,
+      gatewayArn: gateway.gateway.gatewayArn,
+    });
+    target.node.addDependency(gateway);
+    return target;
+  }
+
+  public addGatewayTarget(props: {
+    gatewayTargetName: string;
+    gatewayUrl: string;
+    gatewayArn: string;
+  }): agentcore.CfnGatewayTarget {
+    return undefined as any;
+  }
+}
+"
+`;
+
+exports[`gateway-url-accessor migration > should point vended app-level gateway constructs at the accessor 1`] = `
+"import { Construct } from 'constructs';
+import { AgentCoreGateway } from '../../../core/agentcore-gateway/agentcore-gateway';
+import { RuntimeConfig } from '../../../core/runtime-config';
+
+export class MyGateway extends AgentCoreGateway {
+  public readonly gatewayName = 'my-gateway';
+
+  constructor(scope: Construct, id: string) {
+    super(scope, id);
+
+    const rc = RuntimeConfig.ensure(this);
+    rc.set('agentcore', 'gateways', {
+      ...rc.get('agentcore').gateways,
+      MyGateway: this.gatewayUrl,
+    });
+  }
+}
+"
+`;

package/src/migrations/v1.0.0-rc.97/0001-gateway-url-accessor/metadata.json

@@ -0,0 +1,3 @@
+{
+  "description": "Expose a non-optional gatewayUrl accessor on the vended AgentCoreGateway construct"
+}

package/src/migrations/v1.0.0-rc.97/0001-gateway-url-accessor/migration.d.ts

@@ -0,0 +1,6 @@
+/**
+ * Copyright Amazon.com, Inc. or its affiliates. All Rights Reserved.
+ * SPDX-License-Identifier: Apache-2.0
+ */
+import type { MigrationReturnObject, Tree } from '@nx/devkit';
+export default function migration(tree: Tree): Promise<MigrationReturnObject>;

package/src/migrations/v1.0.0-rc.97/0001-gateway-url-accessor/migration.js

@@ -0,0 +1,94 @@
+/**
+ * Copyright Amazon.com, Inc. or its affiliates. All Rights Reserved.
+ * SPDX-License-Identifier: Apache-2.0
+ */ import { applyGritQL, GRIT_INSERT_PLACEHOLDER, insertViaGritQL, matchGritQL } from "../../../utils/ast.js";
+import { formatFilesInSubtree } from "../../../utils/format.js";
+import { PACKAGES_DIR, SHARED_CONSTRUCTS_DIR } from "../../../utils/shared-constructs-constants.js";
+/**
+ * The CDK `Gateway` L2 types its `gatewayUrl` as `string | undefined`, so
+ * reaching through the vended `AgentCoreGateway` construct to
+ * `gateway.gateway.gatewayUrl` does not typecheck where a `string` is required —
+ * the DCR proxy's `upstreamUrl`, for example. `AgentCoreGateway` gains a
+ * non-optional `gatewayUrl` accessor falling back to the CloudFormation
+ * attribute, which `addGateway` and the vended app-level gateway constructs then
+ * read.
+ */ const CONSTRUCTS_SRC = `${PACKAGES_DIR}/${SHARED_CONSTRUCTS_DIR}/src`;
+const GATEWAY_CONSTRUCT_FILE = `${CONSTRUCTS_SRC}/core/agentcore-gateway/agentcore-gateway.ts`;
+const GATEWAYS_DIR = `${CONSTRUCTS_SRC}/app/gateways`;
+const GATEWAY_URL_ACCESSOR = `/**
+   * The gateway's URL endpoint. The Gateway L2 types its own \`gatewayUrl\` as
+   * optional and only populates it when created from its own props, so fall
+   * back to the CloudFormation attribute.
+   */
+  public get gatewayUrl(): string {
+    return (
+      this.gateway.gatewayUrl ??
+      (this.gateway.node.defaultChild as agentcore.CfnGateway).attrGatewayUrl
+    );
+  }`;
+const divergedCoreMessage = `${GATEWAY_CONSTRUCT_FILE}: the AgentCoreGateway construct has diverged from the generated shape - left untouched. To use a gateway's URL where a \`string\` is required, add a \`public get gatewayUrl(): string\` accessor returning \`this.gateway.gatewayUrl ?? (this.gateway.node.defaultChild as agentcore.CfnGateway).attrGatewayUrl\`.`;
+/**
+ * Add the `gatewayUrl` accessor to the vended core construct, and route
+ * `addGateway` and the shape it requires of its argument through it. Returns
+ * whether the core construct ends up carrying the accessor — app-level
+ * constructs may only be pointed at it once it exists.
+ */ const migrateCoreConstruct = async (tree, nextSteps)=>{
+    if (!tree.exists(GATEWAY_CONSTRUCT_FILE)) {
+        return false;
+    }
+    const hasAccessor = await matchGritQL(tree, GATEWAY_CONSTRUCT_FILE, '`public get gatewayUrl(): string { $_ }`');
+    if (!hasAccessor) {
+        // Anchored on the grantPrincipal accessor, present in every vended version.
+        const added = await insertViaGritQL(tree, GATEWAY_CONSTRUCT_FILE, `\`public get grantPrincipal(): iam.IPrincipal { $body }\` as $accessor => \`$accessor
+
+  ${GRIT_INSERT_PLACEHOLDER}\``, GATEWAY_URL_ACCESSOR);
+        if (!added) {
+            nextSteps.push(divergedCoreMessage);
+            return false;
+        }
+    }
+    const addGatewayUsesAccessor = await matchGritQL(tree, GATEWAY_CONSTRUCT_FILE, '`gatewayUrl: gateway.gatewayUrl`');
+    if (!addGatewayUsesAccessor) {
+        // The accessor is part of the shape addGateway requires of its argument.
+        await applyGritQL(tree, GATEWAY_CONSTRUCT_FILE, `\`readonly gatewayName: string\` as $member => \`$member;
+      readonly gatewayUrl: string\``);
+        // addGateway reads the accessor rather than repeating the fallback inline.
+        await applyGritQL(tree, GATEWAY_CONSTRUCT_FILE, `\`this.addGatewayTarget({ gatewayTargetName: $name, gatewayUrl: $url, gatewayArn: $arn })\` where {
+  $url <: contains \`attrGatewayUrl\`
+} => \`this.addGatewayTarget({
+      gatewayTargetName: $name,
+      gatewayUrl: gateway.gatewayUrl,
+      gatewayArn: $arn,
+    })\``);
+    }
+    return true;
+};
+/**
+ * Point each vended app-level gateway construct's runtime config entry at the
+ * accessor.
+ */ const migrateAppConstructs = async (tree)=>{
+    if (!tree.exists(GATEWAYS_DIR)) {
+        return;
+    }
+    for (const dir of tree.children(GATEWAYS_DIR)){
+        const constructFile = `${GATEWAYS_DIR}/${dir}/${dir}.ts`;
+        if (!tree.exists(constructFile)) {
+            continue;
+        }
+        await applyGritQL(tree, constructFile, '`this.gateway.gatewayUrl` => `this.gatewayUrl`');
+    }
+};
+export default async function migration(tree) {
+    const nextSteps = [];
+    // The app constructs read the accessor, so they may only be migrated once the
+    // core construct carries it.
+    if (await migrateCoreConstruct(tree, nextSteps)) {
+        await migrateAppConstructs(tree);
+    }
+    await formatFilesInSubtree(tree);
+    return {
+        nextSteps
+    };
+}
+
+//# sourceMappingURL=migration.js.map

package/src/migrations/v1.0.0-rc.97/0001-gateway-url-accessor/migration.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../../../../../../../packages/nx-plugin/src/migrations/v1.0.0-rc.97/0001-gateway-url-accessor/migration.ts"],"sourcesContent":["/**\n * Copyright Amazon.com, Inc. or its affiliates. All Rights Reserved.\n * SPDX-License-Identifier: Apache-2.0\n */\nimport type { MigrationReturnObject, Tree } from '@nx/devkit';\nimport {\n  applyGritQL,\n  GRIT_INSERT_PLACEHOLDER,\n  insertViaGritQL,\n  matchGritQL,\n} from '../../../utils/ast.js';\nimport { formatFilesInSubtree } from '../../../utils/format.js';\nimport {\n  PACKAGES_DIR,\n  SHARED_CONSTRUCTS_DIR,\n} from '../../../utils/shared-constructs-constants.js';\n\n/**\n * The CDK `Gateway` L2 types its `gatewayUrl` as `string | undefined`, so\n * reaching through the vended `AgentCoreGateway` construct to\n * `gateway.gateway.gatewayUrl` does not typecheck where a `string` is required —\n * the DCR proxy's `upstreamUrl`, for example. `AgentCoreGateway` gains a\n * non-optional `gatewayUrl` accessor falling back to the CloudFormation\n * attribute, which `addGateway` and the vended app-level gateway constructs then\n * read.\n */\n\nconst CONSTRUCTS_SRC = `${PACKAGES_DIR}/${SHARED_CONSTRUCTS_DIR}/src`;\n\nconst GATEWAY_CONSTRUCT_FILE = `${CONSTRUCTS_SRC}/core/agentcore-gateway/agentcore-gateway.ts`;\n\nconst GATEWAYS_DIR = `${CONSTRUCTS_SRC}/app/gateways`;\n\nconst GATEWAY_URL_ACCESSOR = `/**\n   * The gateway's URL endpoint. The Gateway L2 types its own \\`gatewayUrl\\` as\n   * optional and only populates it when created from its own props, so fall\n   * back to the CloudFormation attribute.\n   */\n  public get gatewayUrl(): string {\n    return (\n      this.gateway.gatewayUrl ??\n      (this.gateway.node.defaultChild as agentcore.CfnGateway).attrGatewayUrl\n    );\n  }`;\n\nconst divergedCoreMessage = `${GATEWAY_CONSTRUCT_FILE}: the AgentCoreGateway construct has diverged from the generated shape - left untouched. To use a gateway's URL where a \\`string\\` is required, add a \\`public get gatewayUrl(): string\\` accessor returning \\`this.gateway.gatewayUrl ?? (this.gateway.node.defaultChild as agentcore.CfnGateway).attrGatewayUrl\\`.`;\n\n/**\n * Add the `gatewayUrl` accessor to the vended core construct, and route\n * `addGateway` and the shape it requires of its argument through it. Returns\n * whether the core construct ends up carrying the accessor — app-level\n * constructs may only be pointed at it once it exists.\n */\nconst migrateCoreConstruct = async (\n  tree: Tree,\n  nextSteps: string[],\n): Promise<boolean> => {\n  if (!tree.exists(GATEWAY_CONSTRUCT_FILE)) {\n    return false;\n  }\n\n  const hasAccessor = await matchGritQL(\n    tree,\n    GATEWAY_CONSTRUCT_FILE,\n    '`public get gatewayUrl(): string { $_ }`',\n  );\n\n  if (!hasAccessor) {\n    // Anchored on the grantPrincipal accessor, present in every vended version.\n    const added = await insertViaGritQL(\n      tree,\n      GATEWAY_CONSTRUCT_FILE,\n      `\\`public get grantPrincipal(): iam.IPrincipal { $body }\\` as $accessor => \\`$accessor\n\n  ${GRIT_INSERT_PLACEHOLDER}\\``,\n      GATEWAY_URL_ACCESSOR,\n    );\n    if (!added) {\n      nextSteps.push(divergedCoreMessage);\n      return false;\n    }\n  }\n\n  const addGatewayUsesAccessor = await matchGritQL(\n    tree,\n    GATEWAY_CONSTRUCT_FILE,\n    '`gatewayUrl: gateway.gatewayUrl`',\n  );\n\n  if (!addGatewayUsesAccessor) {\n    // The accessor is part of the shape addGateway requires of its argument.\n    await applyGritQL(\n      tree,\n      GATEWAY_CONSTRUCT_FILE,\n      `\\`readonly gatewayName: string\\` as $member => \\`$member;\n      readonly gatewayUrl: string\\``,\n    );\n\n    // addGateway reads the accessor rather than repeating the fallback inline.\n    await applyGritQL(\n      tree,\n      GATEWAY_CONSTRUCT_FILE,\n      `\\`this.addGatewayTarget({ gatewayTargetName: $name, gatewayUrl: $url, gatewayArn: $arn })\\` where {\n  $url <: contains \\`attrGatewayUrl\\`\n} => \\`this.addGatewayTarget({\n      gatewayTargetName: $name,\n      gatewayUrl: gateway.gatewayUrl,\n      gatewayArn: $arn,\n    })\\``,\n    );\n  }\n\n  return true;\n};\n\n/**\n * Point each vended app-level gateway construct's runtime config entry at the\n * accessor.\n */\nconst migrateAppConstructs = async (tree: Tree): Promise<void> => {\n  if (!tree.exists(GATEWAYS_DIR)) {\n    return;\n  }\n  for (const dir of tree.children(GATEWAYS_DIR)) {\n    const constructFile = `${GATEWAYS_DIR}/${dir}/${dir}.ts`;\n    if (!tree.exists(constructFile)) {\n      continue;\n    }\n    await applyGritQL(\n      tree,\n      constructFile,\n      '`this.gateway.gatewayUrl` => `this.gatewayUrl`',\n    );\n  }\n};\n\nexport default async function migration(\n  tree: Tree,\n): Promise<MigrationReturnObject> {\n  const nextSteps: string[] = [];\n\n  // The app constructs read the accessor, so they may only be migrated once the\n  // core construct carries it.\n  if (await migrateCoreConstruct(tree, nextSteps)) {\n    await migrateAppConstructs(tree);\n  }\n\n  await formatFilesInSubtree(tree);\n\n  return { nextSteps };\n}\n"],"names":["applyGritQL","GRIT_INSERT_PLACEHOLDER","insertViaGritQL","matchGritQL","formatFilesInSubtree","PACKAGES_DIR","SHARED_CONSTRUCTS_DIR","CONSTRUCTS_SRC","GATEWAY_CONSTRUCT_FILE","GATEWAYS_DIR","GATEWAY_URL_ACCESSOR","divergedCoreMessage","migrateCoreConstruct","tree","nextSteps","exists","hasAccessor","added","push","addGatewayUsesAccessor","migrateAppConstructs","dir","children","constructFile","migration"],"mappings":"AAAA;;;CAGC,GAED,SACEA,WAAW,EACXC,uBAAuB,EACvBC,eAAe,EACfC,WAAW,QACN,wBAAwB;AAC/B,SAASC,oBAAoB,QAAQ,2BAA2B;AAChE,SACEC,YAAY,EACZC,qBAAqB,QAChB,gDAAgD;AAEvD;;;;;;;;CAQC,GAED,MAAMC,iBAAiB,GAAGF,aAAa,CAAC,EAAEC,sBAAsB,IAAI,CAAC;AAErE,MAAME,yBAAyB,GAAGD,eAAe,4CAA4C,CAAC;AAE9F,MAAME,eAAe,GAAGF,eAAe,aAAa,CAAC;AAErD,MAAMG,uBAAuB,CAAC;;;;;;;;;;GAU3B,CAAC;AAEJ,MAAMC,sBAAsB,GAAGH,uBAAuB,oTAAoT,CAAC;AAE3W;;;;;CAKC,GACD,MAAMI,uBAAuB,OAC3BC,MACAC;IAEA,IAAI,CAACD,KAAKE,MAAM,CAACP,yBAAyB;QACxC,OAAO;IACT;IAEA,MAAMQ,cAAc,MAAMb,YACxBU,MACAL,wBACA;IAGF,IAAI,CAACQ,aAAa;QAChB,4EAA4E;QAC5E,MAAMC,QAAQ,MAAMf,gBAClBW,MACAL,wBACA,CAAC;;EAEL,EAAEP,wBAAwB,EAAE,CAAC,EACzBS;QAEF,IAAI,CAACO,OAAO;YACVH,UAAUI,IAAI,CAACP;YACf,OAAO;QACT;IACF;IAEA,MAAMQ,yBAAyB,MAAMhB,YACnCU,MACAL,wBACA;IAGF,IAAI,CAACW,wBAAwB;QAC3B,yEAAyE;QACzE,MAAMnB,YACJa,MACAL,wBACA,CAAC;mCAC4B,CAAC;QAGhC,2EAA2E;QAC3E,MAAMR,YACJa,MACAL,wBACA,CAAC;;;;;;QAMC,CAAC;IAEP;IAEA,OAAO;AACT;AAEA;;;CAGC,GACD,MAAMY,uBAAuB,OAAOP;IAClC,IAAI,CAACA,KAAKE,MAAM,CAACN,eAAe;QAC9B;IACF;IACA,KAAK,MAAMY,OAAOR,KAAKS,QAAQ,CAACb,cAAe;QAC7C,MAAMc,gBAAgB,GAAGd,aAAa,CAAC,EAAEY,IAAI,CAAC,EAAEA,IAAI,GAAG,CAAC;QACxD,IAAI,CAACR,KAAKE,MAAM,CAACQ,gBAAgB;YAC/B;QACF;QACA,MAAMvB,YACJa,MACAU,eACA;IAEJ;AACF;AAEA,eAAe,eAAeC,UAC5BX,IAAU;IAEV,MAAMC,YAAsB,EAAE;IAE9B,8EAA8E;IAC9E,6BAA6B;IAC7B,IAAI,MAAMF,qBAAqBC,MAAMC,YAAY;QAC/C,MAAMM,qBAAqBP;IAC7B;IAEA,MAAMT,qBAAqBS;IAE3B,OAAO;QAAEC;IAAU;AACrB"}

package/src/migrations/v1.0.0-rc.97/0002-checkov-scan-cache-inputs/metadata.json

@@ -0,0 +1,3 @@
+{
+  "description": "Scope the CDK infrastructure checkov target's cache inputs so the security scan cannot serve a stale pass"
+}

package/src/migrations/v1.0.0-rc.97/0002-checkov-scan-cache-inputs/migration.d.ts

@@ -0,0 +1,6 @@
+/**
+ * Copyright Amazon.com, Inc. or its affiliates. All Rights Reserved.
+ * SPDX-License-Identifier: Apache-2.0
+ */
+import { type MigrationReturnObject, type Tree } from '@nx/devkit';
+export default function migration(tree: Tree): Promise<MigrationReturnObject>;

package/src/migrations/v1.0.0-rc.97/0002-checkov-scan-cache-inputs/migration.js

@@ -0,0 +1,58 @@
+/**
+ * Copyright Amazon.com, Inc. or its affiliates. All Rights Reserved.
+ * SPDX-License-Identifier: Apache-2.0
+ */ import { getProjects, updateProjectConfiguration } from "@nx/devkit";
+import { INFRA_APP_GENERATOR_INFO } from "../../../infra/app/generator.js";
+import { formatFilesInSubtree } from "../../../utils/format.js";
+/**
+ * Point the CDK infrastructure `checkov` target's cache inputs at the project
+ * rather than at the synth output directory.
+ *
+ * The target declared `["{workspaceRoot}/dist/{projectRoot}/cdk.out"]`, a
+ * fileset input. Nx resolves a fileset against the files it tracks, and `dist`
+ * is gitignored — so the input matched nothing and hashed to a constant. Once
+ * the scan had been cached, every later run was a hit: adding a non-compliant
+ * resource to a stack left `build` reporting success, and restored a
+ * `checkov_report.json` recording zero resources scanned.
+ *
+ * `["default"]` is what its `synth` sibling declares. It covers the project's
+ * own sources and carries the transitive `dependentTasksOutputFiles` entry from
+ * `nx.json`, which Nx resolves against the upstream `synth` task — so the hash
+ * follows the template the scan actually reads.
+ */ const CHECKOV_TARGET = 'checkov';
+/** The inputs the pre-fix generator declared, replaced in place. */ const VENDED_INPUTS = [
+    '{workspaceRoot}/dist/{projectRoot}/cdk.out'
+];
+/** The inputs the generator declares now, matching the `synth` sibling. */ const FIXED_INPUTS = [
+    'default'
+];
+const divergedMessage = (projectName)=>`${projectName}:${CHECKOV_TARGET}: its \`inputs\` have diverged from the generated shape - left untouched. Confirm they cover the synthesized template the scan reads: an input pointed only at \`dist\` matches no tracked file, so the scan can report a cached pass on infrastructure it never scanned.`;
+/** Whether a target's inputs are exactly the ones the generator vended. */ const hasVendedInputs = (target)=>Array.isArray(target.inputs) && target.inputs.length === VENDED_INPUTS.length && target.inputs.every((input, index)=>input === VENDED_INPUTS[index]);
+export default async function migration(tree) {
+    const nextSteps = [];
+    for (const [projectName, project] of getProjects(tree)){
+        const generator = project.metadata?.generator;
+        if (generator !== INFRA_APP_GENERATOR_INFO.id) continue;
+        const target = project.targets?.[CHECKOV_TARGET];
+        if (!target) continue;
+        // A target already declaring the fixed inputs needs nothing, which also
+        // makes a re-run — and a project generated after the fix — a no-op.
+        if (Array.isArray(target.inputs) && target.inputs.length === FIXED_INPUTS.length && target.inputs.every((input, index)=>input === FIXED_INPUTS[index])) {
+            continue;
+        }
+        if (!hasVendedInputs(target)) {
+            nextSteps.push(divergedMessage(projectName));
+            continue;
+        }
+        target.inputs = [
+            ...FIXED_INPUTS
+        ];
+        updateProjectConfiguration(tree, projectName, project);
+    }
+    await formatFilesInSubtree(tree);
+    return {
+        nextSteps
+    };
+}
+
+//# sourceMappingURL=migration.js.map

package/src/migrations/v1.0.0-rc.97/0002-checkov-scan-cache-inputs/migration.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../../../../../../../packages/nx-plugin/src/migrations/v1.0.0-rc.97/0002-checkov-scan-cache-inputs/migration.ts"],"sourcesContent":["/**\n * Copyright Amazon.com, Inc. or its affiliates. All Rights Reserved.\n * SPDX-License-Identifier: Apache-2.0\n */\nimport {\n  getProjects,\n  type MigrationReturnObject,\n  type ProjectConfiguration,\n  type TargetConfiguration,\n  type Tree,\n  updateProjectConfiguration,\n} from '@nx/devkit';\nimport { INFRA_APP_GENERATOR_INFO } from '../../../infra/app/generator.js';\nimport { formatFilesInSubtree } from '../../../utils/format.js';\n\n/**\n * Point the CDK infrastructure `checkov` target's cache inputs at the project\n * rather than at the synth output directory.\n *\n * The target declared `[\"{workspaceRoot}/dist/{projectRoot}/cdk.out\"]`, a\n * fileset input. Nx resolves a fileset against the files it tracks, and `dist`\n * is gitignored — so the input matched nothing and hashed to a constant. Once\n * the scan had been cached, every later run was a hit: adding a non-compliant\n * resource to a stack left `build` reporting success, and restored a\n * `checkov_report.json` recording zero resources scanned.\n *\n * `[\"default\"]` is what its `synth` sibling declares. It covers the project's\n * own sources and carries the transitive `dependentTasksOutputFiles` entry from\n * `nx.json`, which Nx resolves against the upstream `synth` task — so the hash\n * follows the template the scan actually reads.\n */\n\nconst CHECKOV_TARGET = 'checkov';\n\n/** The inputs the pre-fix generator declared, replaced in place. */\nconst VENDED_INPUTS = ['{workspaceRoot}/dist/{projectRoot}/cdk.out'];\n\n/** The inputs the generator declares now, matching the `synth` sibling. */\nconst FIXED_INPUTS = ['default'];\n\nconst divergedMessage = (projectName: string) =>\n  `${projectName}:${CHECKOV_TARGET}: its \\`inputs\\` have diverged from the generated shape - left untouched. Confirm they cover the synthesized template the scan reads: an input pointed only at \\`dist\\` matches no tracked file, so the scan can report a cached pass on infrastructure it never scanned.`;\n\n/** Whether a target's inputs are exactly the ones the generator vended. */\nconst hasVendedInputs = (target: TargetConfiguration): boolean =>\n  Array.isArray(target.inputs) &&\n  target.inputs.length === VENDED_INPUTS.length &&\n  target.inputs.every((input, index) => input === VENDED_INPUTS[index]);\n\nexport default async function migration(\n  tree: Tree,\n): Promise<MigrationReturnObject> {\n  const nextSteps: string[] = [];\n\n  for (const [projectName, project] of getProjects(tree)) {\n    const generator = (project.metadata as { generator?: string } | undefined)\n      ?.generator;\n    if (generator !== INFRA_APP_GENERATOR_INFO.id) continue;\n\n    const target = project.targets?.[CHECKOV_TARGET];\n    if (!target) continue;\n\n    // A target already declaring the fixed inputs needs nothing, which also\n    // makes a re-run — and a project generated after the fix — a no-op.\n    if (\n      Array.isArray(target.inputs) &&\n      target.inputs.length === FIXED_INPUTS.length &&\n      target.inputs.every((input, index) => input === FIXED_INPUTS[index])\n    ) {\n      continue;\n    }\n\n    if (!hasVendedInputs(target)) {\n      nextSteps.push(divergedMessage(projectName));\n      continue;\n    }\n\n    target.inputs = [...FIXED_INPUTS];\n    updateProjectConfiguration(\n      tree,\n      projectName,\n      project as ProjectConfiguration,\n    );\n  }\n\n  await formatFilesInSubtree(tree);\n\n  return { nextSteps };\n}\n"],"names":["getProjects","updateProjectConfiguration","INFRA_APP_GENERATOR_INFO","formatFilesInSubtree","CHECKOV_TARGET","VENDED_INPUTS","FIXED_INPUTS","divergedMessage","projectName","hasVendedInputs","target","Array","isArray","inputs","length","every","input","index","migration","tree","nextSteps","project","generator","metadata","id","targets","push"],"mappings":"AAAA;;;CAGC,GACD,SACEA,WAAW,EAKXC,0BAA0B,QACrB,aAAa;AACpB,SAASC,wBAAwB,QAAQ,kCAAkC;AAC3E,SAASC,oBAAoB,QAAQ,2BAA2B;AAEhE;;;;;;;;;;;;;;;CAeC,GAED,MAAMC,iBAAiB;AAEvB,kEAAkE,GAClE,MAAMC,gBAAgB;IAAC;CAA6C;AAEpE,yEAAyE,GACzE,MAAMC,eAAe;IAAC;CAAU;AAEhC,MAAMC,kBAAkB,CAACC,cACvB,GAAGA,YAAY,CAAC,EAAEJ,eAAe,yQAAyQ,CAAC;AAE7S,yEAAyE,GACzE,MAAMK,kBAAkB,CAACC,SACvBC,MAAMC,OAAO,CAACF,OAAOG,MAAM,KAC3BH,OAAOG,MAAM,CAACC,MAAM,KAAKT,cAAcS,MAAM,IAC7CJ,OAAOG,MAAM,CAACE,KAAK,CAAC,CAACC,OAAOC,QAAUD,UAAUX,aAAa,CAACY,MAAM;AAEtE,eAAe,eAAeC,UAC5BC,IAAU;IAEV,MAAMC,YAAsB,EAAE;IAE9B,KAAK,MAAM,CAACZ,aAAaa,QAAQ,IAAIrB,YAAYmB,MAAO;QACtD,MAAMG,YAAaD,QAAQE,QAAQ,EAC/BD;QACJ,IAAIA,cAAcpB,yBAAyBsB,EAAE,EAAE;QAE/C,MAAMd,SAASW,QAAQI,OAAO,EAAE,CAACrB,eAAe;QAChD,IAAI,CAACM,QAAQ;QAEb,wEAAwE;QACxE,oEAAoE;QACpE,IACEC,MAAMC,OAAO,CAACF,OAAOG,MAAM,KAC3BH,OAAOG,MAAM,CAACC,MAAM,KAAKR,aAAaQ,MAAM,IAC5CJ,OAAOG,MAAM,CAACE,KAAK,CAAC,CAACC,OAAOC,QAAUD,UAAUV,YAAY,CAACW,MAAM,GACnE;YACA;QACF;QAEA,IAAI,CAACR,gBAAgBC,SAAS;YAC5BU,UAAUM,IAAI,CAACnB,gBAAgBC;YAC/B;QACF;QAEAE,OAAOG,MAAM,GAAG;eAAIP;SAAa;QACjCL,2BACEkB,MACAX,aACAa;IAEJ;IAEA,MAAMlB,qBAAqBgB;IAE3B,OAAO;QAAEC;IAAU;AACrB"}

package/src/migrations/v1.0.0-rc.97/0003-terraform-validate-without-backend/metadata.json

@@ -0,0 +1,3 @@
+{
+  "description": "Run the Terraform validate target with -backend=false so it works before bootstrap"
+}

package/src/migrations/v1.0.0-rc.97/0003-terraform-validate-without-backend/migration.d.ts

@@ -0,0 +1,6 @@
+/**
+ * Copyright Amazon.com, Inc. or its affiliates. All Rights Reserved.
+ * SPDX-License-Identifier: Apache-2.0
+ */
+import { type MigrationReturnObject, type Tree } from '@nx/devkit';
+export default function migration(tree: Tree): Promise<MigrationReturnObject>;