@aws/nx-plugin 1.0.1 → 1.0.3

package/src/migrations/latest/terraform-init-target/migration.js

@@ -0,0 +1,153 @@
+/**
+ * Copyright Amazon.com, Inc. or its affiliates. All Rights Reserved.
+ * SPDX-License-Identifier: Apache-2.0
+ */ import { getProjects, joinPathFragments, updateProjectConfiguration } from "@nx/devkit";
+import { relative } from "path";
+import { TERRAFORM_PROJECT_GENERATOR_INFO } from "../../../terraform/project/generator.js";
+import { formatFilesInSubtree } from "../../../utils/format.js";
+import { sortObjectKeys } from "../../../utils/object.js";
+/**
+ * Give the shared Terraform provider plugin cache a single writer.
+ *
+ * `init`, `test` and `validate` each ran their own `terraform init` against one
+ * per-project cache, and Nx schedules them concurrently — `plan` depends on both
+ * `init` and `validate`. Two `terraform init` runs filling the cache at once each
+ * compute a different hash for the same provider, because the hash covers a
+ * directory the other is still writing, and terraform then rejects the mismatch
+ * against the lock file: "the cached package ... does not match any of the
+ * checksums recorded in the dependency lock file".
+ *
+ * The new `terraform-init` target runs that init once, and `test`, `validate` and
+ * `init` depend on it — `test` and `validate` now run against the `TF_DATA_DIR`
+ * it prepared rather than initialising their own.
+ */ const TERRAFORM_INIT = 'terraform-init';
+/** `terraform init` as the pre-fix `test` and `validate` targets ran it. */ const BACKENDLESS_INIT = 'terraform init -backend=false';
+const divergedStep = (projectName, targetName)=>`${projectName}: its '${targetName}' target no longer matches the shape the generator produced - left untouched. Point it at the \`TF_DATA_DIR\` of the new \`${TERRAFORM_INIT}\` target and add \`"dependsOn": ["${TERRAFORM_INIT}"]\`, so its \`terraform init\` no longer races the other targets over the provider cache.`;
+/** Path from a target running in `{projectRoot}/src` back to the workspace root. */ const rootRelativePath = (projectRoot)=>relative(joinPathFragments(projectRoot, 'src'), '.').replace(/\\/g, '/');
+const pluginCacheDirFor = (toRoot)=>joinPathFragments(toRoot, '.terraform', 'plugin-cache', '{projectRoot}');
+const dataDirFor = (toRoot, name)=>joinPathFragments(toRoot, 'dist', '{projectRoot}', name);
+/**
+ * The target as the generator vends it: `-backend=false` needs no credentials,
+ * so this runs on a fresh workspace before `bootstrap`, and its `TF_DATA_DIR`
+ * keeps the `.terraform` it initialises out of `src`.
+ */ const terraformInitTarget = (projectRoot)=>{
+    const toRoot = rootRelativePath(projectRoot);
+    const pluginCacheDir = pluginCacheDirFor(toRoot);
+    return {
+        executor: 'nx:run-commands',
+        options: {
+            commands: [
+                {
+                    command: `shx mkdir -p ${pluginCacheDir}`,
+                    forwardAllArgs: false
+                },
+                BACKENDLESS_INIT
+            ],
+            forwardAllArgs: true,
+            cwd: '{projectRoot}/src',
+            parallel: false,
+            env: {
+                TF_DATA_DIR: dataDirFor(toRoot, TERRAFORM_INIT),
+                TF_PLUGIN_CACHE_DIR: pluginCacheDir
+            }
+        }
+    };
+};
+/** Every command a target runs, across its options and its configurations. */ const commandsOf = (target)=>[
+        target.options,
+        ...Object.values(target.configurations ?? {})
+    ].flatMap((holder)=>[
+            holder?.command,
+            ...Array.isArray(holder?.commands) ? holder.commands : []
+        ]).map((command)=>typeof command === 'string' ? command : command?.command).filter((command)=>typeof command === 'string');
+/**
+ * Whether the target still runs the `terraform init` this migration orders. A
+ * library's `init` runs it directly and an application's delegates to the vended
+ * script.
+ */ const runsTerraformInit = (target)=>commandsOf(target).some((command)=>command.includes('terraform init') || command.includes('scripts/init.ts'));
+/** Creating the plugin cache directory, which `terraform-init` now does. */ const isMakeCacheDir = (command)=>/^(shx mkdir -p|make-dir)\s/.test(command) && command.includes('plugin-cache');
+/**
+ * Rewrites `test` or `validate` to run against the `TF_DATA_DIR` `terraform-init`
+ * prepared. Only the exact shape the generator produced is rewritten: its own
+ * `terraform init` (with the cache directory the plugin-cache fix added ahead of
+ * it), then the one terraform command the target exists to run. Anything else is
+ * the user's, and is reported instead.
+ */ const migrateInitlessTarget = (target, verb, toRoot)=>{
+    const commands = commandsOf(target).filter((command)=>!isMakeCacheDir(command));
+    if (commands.length !== 2 || commands[0] !== BACKENDLESS_INIT || commands[1] !== `terraform ${verb}`) {
+        return false;
+    }
+    const options = target.options ?? {};
+    const env = options.env ?? {};
+    if (env.TF_DATA_DIR !== dataDirFor(toRoot, `terraform-${verb}`)) {
+        return false;
+    }
+    const { TF_DATA_DIR: _dataDir, TF_PLUGIN_CACHE_DIR: _cacheDir, ...rest } = env;
+    delete options.commands;
+    // `parallel: false` sequenced the init ahead of the command; one command left.
+    delete options.parallel;
+    target.options = {
+        ...options,
+        command: `terraform ${verb}`,
+        env: {
+            ...rest,
+            TF_DATA_DIR: dataDirFor(toRoot, TERRAFORM_INIT)
+        }
+    };
+    return true;
+};
+export default async function migration(tree) {
+    const nextSteps = [];
+    for (const [projectName, project] of getProjects(tree)){
+        const generator = project.metadata?.generator;
+        if (generator !== TERRAFORM_PROJECT_GENERATOR_INFO.id) continue;
+        let targets = project.targets ?? {};
+        const toRoot = rootRelativePath(project.root);
+        let changed = false;
+        // Guarded on the target being absent, so a re-run — and a project generated
+        // with it — is a no-op.
+        if (!targets[TERRAFORM_INIT]) {
+            targets = sortObjectKeys({
+                ...targets,
+                [TERRAFORM_INIT]: terraformInitTarget(project.root)
+            });
+            changed = true;
+        }
+        for (const targetName of [
+            'init',
+            'test',
+            'validate'
+        ]){
+            const target = targets[targetName];
+            if (!target) continue;
+            if (target.dependsOn?.includes(TERRAFORM_INIT)) continue;
+            // `init` keeps its own backend-configured `terraform init`; `test` and
+            // `validate` hand theirs over to `terraform-init`, so nothing is ordered
+            // after a target whose shape is no longer recognised.
+            const migrated = targetName === 'init' ? runsTerraformInit(target) : migrateInitlessTarget(target, targetName, toRoot);
+            if (!migrated) {
+                nextSteps.push(divergedStep(projectName, targetName));
+                continue;
+            }
+            // Prepended rather than appended, so a migrated workspace matches a
+            // freshly generated one.
+            target.dependsOn = [
+                TERRAFORM_INIT,
+                ...target.dependsOn ?? []
+            ];
+            changed = true;
+        }
+        if (changed) {
+            updateProjectConfiguration(tree, projectName, {
+                ...project,
+                targets
+            });
+        }
+    }
+    await formatFilesInSubtree(tree);
+    return {
+        nextSteps
+    };
+}
+
+//# sourceMappingURL=migration.js.map

package/src/migrations/latest/terraform-init-target/migration.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../../../../../../../packages/nx-plugin/src/migrations/latest/terraform-init-target/migration.ts"],"sourcesContent":["/**\n * Copyright Amazon.com, Inc. or its affiliates. All Rights Reserved.\n * SPDX-License-Identifier: Apache-2.0\n */\nimport {\n  getProjects,\n  joinPathFragments,\n  type MigrationReturnObject,\n  type TargetConfiguration,\n  type Tree,\n  updateProjectConfiguration,\n} from '@nx/devkit';\nimport { relative } from 'path';\nimport { TERRAFORM_PROJECT_GENERATOR_INFO } from '../../../terraform/project/generator.js';\nimport { formatFilesInSubtree } from '../../../utils/format.js';\nimport { sortObjectKeys } from '../../../utils/object.js';\n\n/**\n * Give the shared Terraform provider plugin cache a single writer.\n *\n * `init`, `test` and `validate` each ran their own `terraform init` against one\n * per-project cache, and Nx schedules them concurrently — `plan` depends on both\n * `init` and `validate`. Two `terraform init` runs filling the cache at once each\n * compute a different hash for the same provider, because the hash covers a\n * directory the other is still writing, and terraform then rejects the mismatch\n * against the lock file: \"the cached package ... does not match any of the\n * checksums recorded in the dependency lock file\".\n *\n * The new `terraform-init` target runs that init once, and `test`, `validate` and\n * `init` depend on it — `test` and `validate` now run against the `TF_DATA_DIR`\n * it prepared rather than initialising their own.\n */\n\nconst TERRAFORM_INIT = 'terraform-init';\n\n/** `terraform init` as the pre-fix `test` and `validate` targets ran it. */\nconst BACKENDLESS_INIT = 'terraform init -backend=false';\n\nconst divergedStep = (projectName: string, targetName: string) =>\n  `${projectName}: its '${targetName}' target no longer matches the shape the generator produced - left untouched. Point it at the \\`TF_DATA_DIR\\` of the new \\`${TERRAFORM_INIT}\\` target and add \\`\"dependsOn\": [\"${TERRAFORM_INIT}\"]\\`, so its \\`terraform init\\` no longer races the other targets over the provider cache.`;\n\n/** Path from a target running in `{projectRoot}/src` back to the workspace root. */\nconst rootRelativePath = (projectRoot: string) =>\n  relative(joinPathFragments(projectRoot, 'src'), '.').replace(/\\\\/g, '/');\n\nconst pluginCacheDirFor = (toRoot: string) =>\n  joinPathFragments(toRoot, '.terraform', 'plugin-cache', '{projectRoot}');\n\nconst dataDirFor = (toRoot: string, name: string) =>\n  joinPathFragments(toRoot, 'dist', '{projectRoot}', name);\n\n/**\n * The target as the generator vends it: `-backend=false` needs no credentials,\n * so this runs on a fresh workspace before `bootstrap`, and its `TF_DATA_DIR`\n * keeps the `.terraform` it initialises out of `src`.\n */\nconst terraformInitTarget = (projectRoot: string): TargetConfiguration => {\n  const toRoot = rootRelativePath(projectRoot);\n  const pluginCacheDir = pluginCacheDirFor(toRoot);\n  return {\n    executor: 'nx:run-commands',\n    options: {\n      commands: [\n        { command: `shx mkdir -p ${pluginCacheDir}`, forwardAllArgs: false },\n        BACKENDLESS_INIT,\n      ],\n      forwardAllArgs: true,\n      cwd: '{projectRoot}/src',\n      parallel: false,\n      env: {\n        TF_DATA_DIR: dataDirFor(toRoot, TERRAFORM_INIT),\n        TF_PLUGIN_CACHE_DIR: pluginCacheDir,\n      },\n    },\n  };\n};\n\n/** Every command a target runs, across its options and its configurations. */\nconst commandsOf = (target: TargetConfiguration): string[] =>\n  [target.options, ...Object.values(target.configurations ?? {})]\n    .flatMap(\n      (holder: { command?: unknown; commands?: unknown } | undefined) => [\n        holder?.command,\n        ...(Array.isArray(holder?.commands) ? holder.commands : []),\n      ],\n    )\n    .map((command) =>\n      typeof command === 'string'\n        ? command\n        : (command as { command?: unknown } | undefined)?.command,\n    )\n    .filter((command): command is string => typeof command === 'string');\n\n/**\n * Whether the target still runs the `terraform init` this migration orders. A\n * library's `init` runs it directly and an application's delegates to the vended\n * script.\n */\nconst runsTerraformInit = (target: TargetConfiguration): boolean =>\n  commandsOf(target).some(\n    (command) =>\n      command.includes('terraform init') || command.includes('scripts/init.ts'),\n  );\n\n/** Creating the plugin cache directory, which `terraform-init` now does. */\nconst isMakeCacheDir = (command: string) =>\n  /^(shx mkdir -p|make-dir)\\s/.test(command) &&\n  command.includes('plugin-cache');\n\n/**\n * Rewrites `test` or `validate` to run against the `TF_DATA_DIR` `terraform-init`\n * prepared. Only the exact shape the generator produced is rewritten: its own\n * `terraform init` (with the cache directory the plugin-cache fix added ahead of\n * it), then the one terraform command the target exists to run. Anything else is\n * the user's, and is reported instead.\n */\nconst migrateInitlessTarget = (\n  target: TargetConfiguration,\n  verb: 'test' | 'validate',\n  toRoot: string,\n): boolean => {\n  const commands = commandsOf(target).filter(\n    (command) => !isMakeCacheDir(command),\n  );\n  if (\n    commands.length !== 2 ||\n    commands[0] !== BACKENDLESS_INIT ||\n    commands[1] !== `terraform ${verb}`\n  ) {\n    return false;\n  }\n  const options = target.options ?? {};\n  const env: Record<string, string> = options.env ?? {};\n  if (env.TF_DATA_DIR !== dataDirFor(toRoot, `terraform-${verb}`)) {\n    return false;\n  }\n\n  const {\n    TF_DATA_DIR: _dataDir,\n    TF_PLUGIN_CACHE_DIR: _cacheDir,\n    ...rest\n  } = env;\n  delete options.commands;\n  // `parallel: false` sequenced the init ahead of the command; one command left.\n  delete options.parallel;\n  target.options = {\n    ...options,\n    command: `terraform ${verb}`,\n    env: { ...rest, TF_DATA_DIR: dataDirFor(toRoot, TERRAFORM_INIT) },\n  };\n  return true;\n};\n\nexport default async function migration(\n  tree: Tree,\n): Promise<MigrationReturnObject> {\n  const nextSteps: string[] = [];\n\n  for (const [projectName, project] of getProjects(tree)) {\n    const generator = (project.metadata as { generator?: string } | undefined)\n      ?.generator;\n    if (generator !== TERRAFORM_PROJECT_GENERATOR_INFO.id) continue;\n\n    let targets = project.targets ?? {};\n    const toRoot = rootRelativePath(project.root);\n    let changed = false;\n\n    // Guarded on the target being absent, so a re-run — and a project generated\n    // with it — is a no-op.\n    if (!targets[TERRAFORM_INIT]) {\n      targets = sortObjectKeys({\n        ...targets,\n        [TERRAFORM_INIT]: terraformInitTarget(project.root),\n      });\n      changed = true;\n    }\n\n    for (const targetName of ['init', 'test', 'validate'] as const) {\n      const target = targets[targetName];\n      if (!target) continue;\n      if (target.dependsOn?.includes(TERRAFORM_INIT)) continue;\n\n      // `init` keeps its own backend-configured `terraform init`; `test` and\n      // `validate` hand theirs over to `terraform-init`, so nothing is ordered\n      // after a target whose shape is no longer recognised.\n      const migrated =\n        targetName === 'init'\n          ? runsTerraformInit(target)\n          : migrateInitlessTarget(target, targetName, toRoot);\n      if (!migrated) {\n        nextSteps.push(divergedStep(projectName, targetName));\n        continue;\n      }\n\n      // Prepended rather than appended, so a migrated workspace matches a\n      // freshly generated one.\n      target.dependsOn = [TERRAFORM_INIT, ...(target.dependsOn ?? [])];\n      changed = true;\n    }\n\n    if (changed) {\n      updateProjectConfiguration(tree, projectName, { ...project, targets });\n    }\n  }\n\n  await formatFilesInSubtree(tree);\n\n  return { nextSteps };\n}\n"],"names":["getProjects","joinPathFragments","updateProjectConfiguration","relative","TERRAFORM_PROJECT_GENERATOR_INFO","formatFilesInSubtree","sortObjectKeys","TERRAFORM_INIT","BACKENDLESS_INIT","divergedStep","projectName","targetName","rootRelativePath","projectRoot","replace","pluginCacheDirFor","toRoot","dataDirFor","name","terraformInitTarget","pluginCacheDir","executor","options","commands","command","forwardAllArgs","cwd","parallel","env","TF_DATA_DIR","TF_PLUGIN_CACHE_DIR","commandsOf","target","Object","values","configurations","flatMap","holder","Array","isArray","map","filter","runsTerraformInit","some","includes","isMakeCacheDir","test","migrateInitlessTarget","verb","length","_dataDir","_cacheDir","rest","migration","tree","nextSteps","project","generator","metadata","id","targets","root","changed","dependsOn","migrated","push"],"mappings":"AAAA;;;CAGC,GACD,SACEA,WAAW,EACXC,iBAAiB,EAIjBC,0BAA0B,QACrB,aAAa;AACpB,SAASC,QAAQ,QAAQ,OAAO;AAChC,SAASC,gCAAgC,QAAQ,0CAA0C;AAC3F,SAASC,oBAAoB,QAAQ,2BAA2B;AAChE,SAASC,cAAc,QAAQ,2BAA2B;AAE1D;;;;;;;;;;;;;;CAcC,GAED,MAAMC,iBAAiB;AAEvB,0EAA0E,GAC1E,MAAMC,mBAAmB;AAEzB,MAAMC,eAAe,CAACC,aAAqBC,aACzC,GAAGD,YAAY,OAAO,EAAEC,WAAW,2HAA2H,EAAEJ,eAAe,mCAAmC,EAAEA,eAAe,0FAA0F,CAAC;AAEhU,kFAAkF,GAClF,MAAMK,mBAAmB,CAACC,cACxBV,SAASF,kBAAkBY,aAAa,QAAQ,KAAKC,OAAO,CAAC,OAAO;AAEtE,MAAMC,oBAAoB,CAACC,SACzBf,kBAAkBe,QAAQ,cAAc,gBAAgB;AAE1D,MAAMC,aAAa,CAACD,QAAgBE,OAClCjB,kBAAkBe,QAAQ,QAAQ,iBAAiBE;AAErD;;;;CAIC,GACD,MAAMC,sBAAsB,CAACN;IAC3B,MAAMG,SAASJ,iBAAiBC;IAChC,MAAMO,iBAAiBL,kBAAkBC;IACzC,OAAO;QACLK,UAAU;QACVC,SAAS;YACPC,UAAU;gBACR;oBAAEC,SAAS,CAAC,aAAa,EAAEJ,gBAAgB;oBAAEK,gBAAgB;gBAAM;gBACnEjB;aACD;YACDiB,gBAAgB;YAChBC,KAAK;YACLC,UAAU;YACVC,KAAK;gBACHC,aAAaZ,WAAWD,QAAQT;gBAChCuB,qBAAqBV;YACvB;QACF;IACF;AACF;AAEA,4EAA4E,GAC5E,MAAMW,aAAa,CAACC,SAClB;QAACA,OAAOV,OAAO;WAAKW,OAAOC,MAAM,CAACF,OAAOG,cAAc,IAAI,CAAC;KAAG,CAC5DC,OAAO,CACN,CAACC,SAAkE;YACjEA,QAAQb;eACJc,MAAMC,OAAO,CAACF,QAAQd,YAAYc,OAAOd,QAAQ,GAAG,EAAE;SAC3D,EAEFiB,GAAG,CAAC,CAAChB,UACJ,OAAOA,YAAY,WACfA,UACCA,SAA+CA,SAErDiB,MAAM,CAAC,CAACjB,UAA+B,OAAOA,YAAY;AAE/D;;;;CAIC,GACD,MAAMkB,oBAAoB,CAACV,SACzBD,WAAWC,QAAQW,IAAI,CACrB,CAACnB,UACCA,QAAQoB,QAAQ,CAAC,qBAAqBpB,QAAQoB,QAAQ,CAAC;AAG7D,0EAA0E,GAC1E,MAAMC,iBAAiB,CAACrB,UACtB,6BAA6BsB,IAAI,CAACtB,YAClCA,QAAQoB,QAAQ,CAAC;AAEnB;;;;;;CAMC,GACD,MAAMG,wBAAwB,CAC5Bf,QACAgB,MACAhC;IAEA,MAAMO,WAAWQ,WAAWC,QAAQS,MAAM,CACxC,CAACjB,UAAY,CAACqB,eAAerB;IAE/B,IACED,SAAS0B,MAAM,KAAK,KACpB1B,QAAQ,CAAC,EAAE,KAAKf,oBAChBe,QAAQ,CAAC,EAAE,KAAK,CAAC,UAAU,EAAEyB,MAAM,EACnC;QACA,OAAO;IACT;IACA,MAAM1B,UAAUU,OAAOV,OAAO,IAAI,CAAC;IACnC,MAAMM,MAA8BN,QAAQM,GAAG,IAAI,CAAC;IACpD,IAAIA,IAAIC,WAAW,KAAKZ,WAAWD,QAAQ,CAAC,UAAU,EAAEgC,MAAM,GAAG;QAC/D,OAAO;IACT;IAEA,MAAM,EACJnB,aAAaqB,QAAQ,EACrBpB,qBAAqBqB,SAAS,EAC9B,GAAGC,MACJ,GAAGxB;IACJ,OAAON,QAAQC,QAAQ;IACvB,+EAA+E;IAC/E,OAAOD,QAAQK,QAAQ;IACvBK,OAAOV,OAAO,GAAG;QACf,GAAGA,OAAO;QACVE,SAAS,CAAC,UAAU,EAAEwB,MAAM;QAC5BpB,KAAK;YAAE,GAAGwB,IAAI;YAAEvB,aAAaZ,WAAWD,QAAQT;QAAgB;IAClE;IACA,OAAO;AACT;AAEA,eAAe,eAAe8C,UAC5BC,IAAU;IAEV,MAAMC,YAAsB,EAAE;IAE9B,KAAK,MAAM,CAAC7C,aAAa8C,QAAQ,IAAIxD,YAAYsD,MAAO;QACtD,MAAMG,YAAaD,QAAQE,QAAQ,EAC/BD;QACJ,IAAIA,cAAcrD,iCAAiCuD,EAAE,EAAE;QAEvD,IAAIC,UAAUJ,QAAQI,OAAO,IAAI,CAAC;QAClC,MAAM5C,SAASJ,iBAAiB4C,QAAQK,IAAI;QAC5C,IAAIC,UAAU;QAEd,4EAA4E;QAC5E,wBAAwB;QACxB,IAAI,CAACF,OAAO,CAACrD,eAAe,EAAE;YAC5BqD,UAAUtD,eAAe;gBACvB,GAAGsD,OAAO;gBACV,CAACrD,eAAe,EAAEY,oBAAoBqC,QAAQK,IAAI;YACpD;YACAC,UAAU;QACZ;QAEA,KAAK,MAAMnD,cAAc;YAAC;YAAQ;YAAQ;SAAW,CAAW;YAC9D,MAAMqB,SAAS4B,OAAO,CAACjD,WAAW;YAClC,IAAI,CAACqB,QAAQ;YACb,IAAIA,OAAO+B,SAAS,EAAEnB,SAASrC,iBAAiB;YAEhD,uEAAuE;YACvE,yEAAyE;YACzE,sDAAsD;YACtD,MAAMyD,WACJrD,eAAe,SACX+B,kBAAkBV,UAClBe,sBAAsBf,QAAQrB,YAAYK;YAChD,IAAI,CAACgD,UAAU;gBACbT,UAAUU,IAAI,CAACxD,aAAaC,aAAaC;gBACzC;YACF;YAEA,oEAAoE;YACpE,yBAAyB;YACzBqB,OAAO+B,SAAS,GAAG;gBAACxD;mBAAoByB,OAAO+B,SAAS,IAAI,EAAE;aAAE;YAChED,UAAU;QACZ;QAEA,IAAIA,SAAS;YACX5D,2BAA2BoD,MAAM5C,aAAa;gBAAE,GAAG8C,OAAO;gBAAEI;YAAQ;QACtE;IACF;IAEA,MAAMvD,qBAAqBiD;IAE3B,OAAO;QAAEC;IAAU;AACrB"}

package/src/migrations/v1.0.0-rc.98/0001-sandbox-pattern-nested-stacks/migration.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../../../../../../../packages/nx-plugin/src/migrations/v1.0.0-rc.98/0001-sandbox-pattern-nested-stacks/migration.ts"],"sourcesContent":["/**\n * Copyright Amazon.com, Inc. or its affiliates. All Rights Reserved.\n * SPDX-License-Identifier: Apache-2.0\n */\nimport {\n  getProjects,\n  type MigrationReturnObject,\n  type TargetConfiguration,\n  type Tree,\n  updateProjectConfiguration,\n} from '@nx/devkit';\nimport { INFRA_APP_GENERATOR_INFO } from '../../../infra/app/generator.js';\nimport { formatFilesInSubtree } from '../../../utils/format.js';\n\n/**\n * Widen the stage pattern of the sandbox targets of ts#infra projects from\n * `<stage>/*` to `<stage>/**`.\n *\n * A single `*` matches the stage's own stacks but nothing below them, so it\n * misses stacks a construct creates inside a stack - such as the `us-east-1`\n * WebACL stack a website creates for its CloudFront distribution.\n * `cdk destroy` only deletes the stacks its pattern selects, so\n * `destroy-sandbox` left that stack, and the WebACL it bills for, deployed.\n */\n\nconst SANDBOX_TARGETS = ['deploy-sandbox', 'destroy-sandbox'];\n\n/** A quoted or bare stage pattern ending in a single `*`, ie `\"my-sandbox/*\"`. */\nconst SINGLE_STAR_PATTERN = /^(\"?)\\S+\\/\\*\\1$/;\n\nconst widen = (token: string): string => token.replace(/\\/\\*(\"?)$/, '/**$1');\n\n/**\n * Whether the command is one of the deploy/destroy commands this generator\n * vends - either a direct `cdk deploy`/`cdk destroy`, or the stage-config\n * script that wraps it. Anything else has been hand-written and is reported\n * rather than rewritten.\n */\nconst isGeneratedCommand = (command: string): boolean =>\n  /(^|\\s)cdk\\s+(deploy|destroy)(\\s|$)/.test(command) ||\n  command.includes('infra-deploy.ts') ||\n  command.includes('infra-destroy.ts');\n\nexport default async function migration(\n  tree: Tree,\n): Promise<MigrationReturnObject> {\n  const nextSteps: string[] = [];\n  let migrated = false;\n\n  for (const [name, project] of getProjects(tree)) {\n    if (\n      (project.metadata as { generator?: string } | undefined)?.generator !==\n      INFRA_APP_GENERATOR_INFO.id\n    ) {\n      continue;\n    }\n\n    let projectChanged = false;\n\n    for (const targetName of SANDBOX_TARGETS) {\n      const target: TargetConfiguration | undefined =\n        project.targets?.[targetName];\n      const command = target?.options?.command;\n      if (!target || typeof command !== 'string') {\n        continue;\n      }\n\n      const args = command.split(/\\s+/);\n      // Nothing to widen: already `/**`, or the pattern has been removed. Keeps\n      // re-runs - and a project generated after this change - a no-op.\n      if (!args.some((arg) => SINGLE_STAR_PATTERN.test(arg))) {\n        continue;\n      }\n\n      if (!isGeneratedCommand(command)) {\n        nextSteps.push(\n          `${name}: its ${targetName} target has been customised, so it was left as it is. Widen its stage pattern from \"<stage>/*\" to \"<stage>/**\" so it also matches stacks nested below the stage's stacks, such as a website's WebACL stack.`,\n        );\n        continue;\n      }\n\n      target.options.command = args\n        .map((arg) => (SINGLE_STAR_PATTERN.test(arg) ? widen(arg) : arg))\n        .join(' ');\n      projectChanged = true;\n    }\n\n    if (projectChanged) {\n      updateProjectConfiguration(tree, name, project);\n      migrated = true;\n    }\n  }\n\n  if (migrated) {\n    await formatFilesInSubtree(tree);\n  }\n\n  return { nextSteps };\n}\n"],"names":["getProjects","updateProjectConfiguration","INFRA_APP_GENERATOR_INFO","formatFilesInSubtree","SANDBOX_TARGETS","SINGLE_STAR_PATTERN","widen","token","replace","isGeneratedCommand","command","test","includes","migration","tree","nextSteps","migrated","name","project","metadata","generator","id","projectChanged","targetName","target","targets","options","args","split","some","arg","push","map","join"],"mappings":"AAAA;;;CAGC,GACD,SACEA,WAAW,EAIXC,0BAA0B,QACrB,aAAa;AACpB,SAASC,wBAAwB,QAAQ,kCAAkC;AAC3E,SAASC,oBAAoB,QAAQ,2BAA2B;AAEhE;;;;;;;;;CASC,GAED,MAAMC,kBAAkB;IAAC;IAAkB;CAAkB;AAE7D,gFAAgF,GAChF,MAAMC,sBAAsB;AAE5B,MAAMC,QAAQ,CAACC,QAA0BA,MAAMC,OAAO,CAAC,aAAa;AAEpE;;;;;CAKC,GACD,MAAMC,qBAAqB,CAACC,UAC1B,qCAAqCC,IAAI,CAACD,YAC1CA,QAAQE,QAAQ,CAAC,sBACjBF,QAAQE,QAAQ,CAAC;AAEnB,eAAe,eAAeC,UAC5BC,IAAU;IAEV,MAAMC,YAAsB,EAAE;IAC9B,IAAIC,WAAW;IAEf,KAAK,MAAM,CAACC,MAAMC,QAAQ,IAAIlB,YAAYc,MAAO;QAC/C,IACE,AAACI,QAAQC,QAAQ,EAAyCC,cAC1DlB,yBAAyBmB,EAAE,EAC3B;YACA;QACF;QAEA,IAAIC,iBAAiB;QAErB,KAAK,MAAMC,cAAcnB,gBAAiB;YACxC,MAAMoB,SACJN,QAAQO,OAAO,EAAE,CAACF,WAAW;YAC/B,MAAMb,UAAUc,QAAQE,SAAShB;YACjC,IAAI,CAACc,UAAU,OAAOd,YAAY,UAAU;gBAC1C;YACF;YAEA,MAAMiB,OAAOjB,QAAQkB,KAAK,CAAC;YAC3B,0EAA0E;YAC1E,iEAAiE;YACjE,IAAI,CAACD,KAAKE,IAAI,CAAC,CAACC,MAAQzB,oBAAoBM,IAAI,CAACmB,OAAO;gBACtD;YACF;YAEA,IAAI,CAACrB,mBAAmBC,UAAU;gBAChCK,UAAUgB,IAAI,CACZ,GAAGd,KAAK,MAAM,EAAEM,WAAW,2MAA2M,CAAC;gBAEzO;YACF;YAEAC,OAAOE,OAAO,CAAChB,OAAO,GAAGiB,KACtBK,GAAG,CAAC,CAACF,MAASzB,oBAAoBM,IAAI,CAACmB,OAAOxB,MAAMwB,OAAOA,KAC3DG,IAAI,CAAC;YACRX,iBAAiB;QACnB;QAEA,IAAIA,gBAAgB;YAClBrB,2BAA2Ba,MAAMG,MAAMC;YACvCF,WAAW;QACb;IACF;IAEA,IAAIA,UAAU;QACZ,MAAMb,qBAAqBW;IAC7B;IAEA,OAAO;QAAEC;IAAU;AACrB"}

package/src/migrations/v1.0.0-rc.98/0002-shadcn-cn-package/migration.d.ts

@@ -0,0 +1,6 @@
+/**
+ * Copyright Amazon.com, Inc. or its affiliates. All Rights Reserved.
+ * SPDX-License-Identifier: Apache-2.0
+ */
+import { type MigrationReturnObject, type Tree } from '@nx/devkit';
+export default function migration(tree: Tree): Promise<MigrationReturnObject>;

package/src/migrations/v1.0.0-rc.98/0002-shadcn-cn-package/migration.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../../../../../../../packages/nx-plugin/src/migrations/v1.0.0-rc.98/0002-shadcn-cn-package/migration.ts"],"sourcesContent":["/**\n * Copyright Amazon.com, Inc. or its affiliates. All Rights Reserved.\n * SPDX-License-Identifier: Apache-2.0\n */\nimport {\n  joinPathFragments,\n  type MigrationReturnObject,\n  readJson,\n  type Tree,\n} from '@nx/devkit';\nimport { applyGritQL, matchGritQL } from '../../../utils/ast.js';\nimport {\n  addDependenciesToPackageJson,\n  removeDependenciesFromPackageJson,\n} from '../../../utils/dependencies.js';\nimport { formatFilesInSubtree } from '../../../utils/format.js';\nimport {\n  PACKAGES_DIR,\n  SHARED_SHADCN_DIR,\n} from '../../../utils/shared-constructs-constants.js';\nimport { TS_VERSIONS } from '../../../utils/versions.js';\n\n/**\n * Move the shared shadcn package onto the `cn` package.\n *\n * The shadcn registry now serves components importing `cn` from the `cn`\n * package and declares it as a registry dependency, so a component added by\n * `shadcn add` no longer resolves the package's own `#lib/utils` helper. This\n * carries an existing workspace onto that shape: the components import `cn`,\n * `src/lib/utils.ts` becomes the single-line re-export shadcn's own install\n * guide prescribes, which keeps every consumer importing `cn` through\n * `<scope>common-shadcn/lib/utils` working, and clsx / tailwind-merge are\n * dropped now that nothing imports them.\n *\n * How to write a migration:\n * - https://nx.dev/docs/kb/migration-generators\n * - What `nextSteps` means: https://nx.dev/docs/reference/devkit/MigrationReturnObject\n *\n * Guardrails:\n * - Only touches a `packages/common/shadcn` this plugin's generators produced,\n *   guarded by `components.json`'s aliases still matching the generated shape.\n * - An import is only rewritten when `cn` is its sole binding, so a file also\n *   pulling a user's own helper out of `#lib/utils` keeps resolving through the\n *   re-export.\n * - `src/lib/utils.ts` is only rewritten while it still holds the generated\n *   `twMerge(clsx(...))` helper; a customised one is reported instead.\n * - clsx / tailwind-merge are only dropped once nothing under `src` imports\n *   them.\n * - Idempotent: every write is guarded by the old shape still being present.\n */\n\nconst libraryRoot = joinPathFragments(PACKAGES_DIR, SHARED_SHADCN_DIR);\nconst componentsJsonPath = joinPathFragments(libraryRoot, 'components.json');\nconst packageJsonPath = joinPathFragments(libraryRoot, 'package.json');\nconst srcRoot = joinPathFragments(libraryRoot, 'src');\nconst utilsPath = joinPathFragments(srcRoot, 'lib', 'utils.ts');\n\n/** The aliases today's generators write, which this migration leaves in place. */\nconst generatedAliases: Record<string, string> = {\n  components: '#components',\n  utils: '#lib/utils',\n  hooks: '#hooks',\n  lib: '#lib',\n  ui: '#components/ui',\n};\n\nconst CN_IMPORT_REWRITE = `\\`import { cn } from '#lib/utils'\\` => \\`import { cn } from 'cn'\\``;\n\n/** The generated helper, whichever way the user's formatter has laid it out. */\nconst GENERATED_CN_HELPER = `\\`twMerge(clsx($_))\\``;\n\nconst importsPackage = (name: string): string => `\\`import $_ from '${name}'\\``;\n\nconst REEXPORT_UTILS = `export { cn } from 'cn';\\n`;\n\nconst DROPPED_PACKAGES = ['clsx', 'tailwind-merge'] as const;\n\n/** Every `.ts`/`.tsx` file in the package's source tree. */\nconst sourceFiles = (tree: Tree, dir: string): string[] => {\n  if (!tree.exists(dir)) {\n    return [];\n  }\n  return tree.children(dir).flatMap((entry) => {\n    const path = joinPathFragments(dir, entry);\n    if (!tree.isFile(path)) {\n      return sourceFiles(tree, path);\n    }\n    return path.endsWith('.ts') || path.endsWith('.tsx') ? [path] : [];\n  });\n};\n\nexport default async function migration(\n  tree: Tree,\n): Promise<MigrationReturnObject> {\n  const nextSteps: string[] = [];\n\n  if (!tree.exists(componentsJsonPath) || !tree.exists(packageJsonPath)) {\n    return { nextSteps };\n  }\n\n  const aliases =\n    readJson<{ aliases?: Record<string, string> }>(tree, componentsJsonPath)\n      .aliases ?? {};\n  if (Object.entries(generatedAliases).some(([k, v]) => aliases[k] !== v)) {\n    return { nextSteps };\n  }\n\n  const files = sourceFiles(tree, srcRoot);\n\n  for (const file of files) {\n    await applyGritQL(tree, file, CN_IMPORT_REWRITE);\n  }\n\n  if (tree.exists(utilsPath)) {\n    if (await matchGritQL(tree, utilsPath, GENERATED_CN_HELPER)) {\n      tree.write(utilsPath, REEXPORT_UTILS);\n    } else if (tree.read(utilsPath, 'utf-8') !== REEXPORT_UTILS) {\n      nextSteps.push(\n        `${utilsPath}: no longer holds the generated cn helper - left untouched. Re-export cn from the 'cn' package by hand so consumers importing it from here keep working.`,\n      );\n    }\n  }\n\n  addDependenciesToPackageJson(\n    tree,\n    { cn: TS_VERSIONS.cn },\n    {},\n    packageJsonPath,\n  );\n\n  const stillImported = new Set<string>();\n  for (const file of sourceFiles(tree, srcRoot)) {\n    for (const name of DROPPED_PACKAGES) {\n      if (await matchGritQL(tree, file, importsPackage(name))) {\n        stillImported.add(name);\n      }\n    }\n  }\n\n  const dropped = DROPPED_PACKAGES.filter((name) => !stillImported.has(name));\n  removeDependenciesFromPackageJson(tree, dropped, dropped, packageJsonPath);\n\n  await formatFilesInSubtree(tree);\n\n  return { nextSteps };\n}\n"],"names":["joinPathFragments","readJson","applyGritQL","matchGritQL","addDependenciesToPackageJson","removeDependenciesFromPackageJson","formatFilesInSubtree","PACKAGES_DIR","SHARED_SHADCN_DIR","TS_VERSIONS","libraryRoot","componentsJsonPath","packageJsonPath","srcRoot","utilsPath","generatedAliases","components","utils","hooks","lib","ui","CN_IMPORT_REWRITE","GENERATED_CN_HELPER","importsPackage","name","REEXPORT_UTILS","DROPPED_PACKAGES","sourceFiles","tree","dir","exists","children","flatMap","entry","path","isFile","endsWith","migration","nextSteps","aliases","Object","entries","some","k","v","files","file","write","read","push","cn","stillImported","Set","add","dropped","filter","has"],"mappings":"AAAA;;;CAGC,GACD,SACEA,iBAAiB,EAEjBC,QAAQ,QAEH,aAAa;AACpB,SAASC,WAAW,EAAEC,WAAW,QAAQ,wBAAwB;AACjE,SACEC,4BAA4B,EAC5BC,iCAAiC,QAC5B,iCAAiC;AACxC,SAASC,oBAAoB,QAAQ,2BAA2B;AAChE,SACEC,YAAY,EACZC,iBAAiB,QACZ,gDAAgD;AACvD,SAASC,WAAW,QAAQ,6BAA6B;AAEzD;;;;;;;;;;;;;;;;;;;;;;;;;;;CA2BC,GAED,MAAMC,cAAcV,kBAAkBO,cAAcC;AACpD,MAAMG,qBAAqBX,kBAAkBU,aAAa;AAC1D,MAAME,kBAAkBZ,kBAAkBU,aAAa;AACvD,MAAMG,UAAUb,kBAAkBU,aAAa;AAC/C,MAAMI,YAAYd,kBAAkBa,SAAS,OAAO;AAEpD,gFAAgF,GAChF,MAAME,mBAA2C;IAC/CC,YAAY;IACZC,OAAO;IACPC,OAAO;IACPC,KAAK;IACLC,IAAI;AACN;AAEA,MAAMC,oBAAoB,CAAC,kEAAkE,CAAC;AAE9F,8EAA8E,GAC9E,MAAMC,sBAAsB,CAAC,qBAAqB,CAAC;AAEnD,MAAMC,iBAAiB,CAACC,OAAyB,CAAC,kBAAkB,EAAEA,KAAK,GAAG,CAAC;AAE/E,MAAMC,iBAAiB,CAAC,0BAA0B,CAAC;AAEnD,MAAMC,mBAAmB;IAAC;IAAQ;CAAiB;AAEnD,0DAA0D,GAC1D,MAAMC,cAAc,CAACC,MAAYC;IAC/B,IAAI,CAACD,KAAKE,MAAM,CAACD,MAAM;QACrB,OAAO,EAAE;IACX;IACA,OAAOD,KAAKG,QAAQ,CAACF,KAAKG,OAAO,CAAC,CAACC;QACjC,MAAMC,OAAOlC,kBAAkB6B,KAAKI;QACpC,IAAI,CAACL,KAAKO,MAAM,CAACD,OAAO;YACtB,OAAOP,YAAYC,MAAMM;QAC3B;QACA,OAAOA,KAAKE,QAAQ,CAAC,UAAUF,KAAKE,QAAQ,CAAC,UAAU;YAACF;SAAK,GAAG,EAAE;IACpE;AACF;AAEA,eAAe,eAAeG,UAC5BT,IAAU;IAEV,MAAMU,YAAsB,EAAE;IAE9B,IAAI,CAACV,KAAKE,MAAM,CAACnB,uBAAuB,CAACiB,KAAKE,MAAM,CAAClB,kBAAkB;QACrE,OAAO;YAAE0B;QAAU;IACrB;IAEA,MAAMC,UACJtC,SAA+C2B,MAAMjB,oBAClD4B,OAAO,IAAI,CAAC;IACjB,IAAIC,OAAOC,OAAO,CAAC1B,kBAAkB2B,IAAI,CAAC,CAAC,CAACC,GAAGC,EAAE,GAAKL,OAAO,CAACI,EAAE,KAAKC,IAAI;QACvE,OAAO;YAAEN;QAAU;IACrB;IAEA,MAAMO,QAAQlB,YAAYC,MAAMf;IAEhC,KAAK,MAAMiC,QAAQD,MAAO;QACxB,MAAM3C,YAAY0B,MAAMkB,MAAMzB;IAChC;IAEA,IAAIO,KAAKE,MAAM,CAAChB,YAAY;QAC1B,IAAI,MAAMX,YAAYyB,MAAMd,WAAWQ,sBAAsB;YAC3DM,KAAKmB,KAAK,CAACjC,WAAWW;QACxB,OAAO,IAAIG,KAAKoB,IAAI,CAAClC,WAAW,aAAaW,gBAAgB;YAC3Da,UAAUW,IAAI,CACZ,GAAGnC,UAAU,wJAAwJ,CAAC;QAE1K;IACF;IAEAV,6BACEwB,MACA;QAAEsB,IAAIzC,YAAYyC,EAAE;IAAC,GACrB,CAAC,GACDtC;IAGF,MAAMuC,gBAAgB,IAAIC;IAC1B,KAAK,MAAMN,QAAQnB,YAAYC,MAAMf,SAAU;QAC7C,KAAK,MAAMW,QAAQE,iBAAkB;YACnC,IAAI,MAAMvB,YAAYyB,MAAMkB,MAAMvB,eAAeC,QAAQ;gBACvD2B,cAAcE,GAAG,CAAC7B;YACpB;QACF;IACF;IAEA,MAAM8B,UAAU5B,iBAAiB6B,MAAM,CAAC,CAAC/B,OAAS,CAAC2B,cAAcK,GAAG,CAAChC;IACrEnB,kCAAkCuB,MAAM0B,SAASA,SAAS1C;IAE1D,MAAMN,qBAAqBsB;IAE3B,OAAO;QAAEU;IAAU;AACrB"}

package/src/migrations/v1.0.2/0001-terraform-harness-environment-variables/metadata.json

@@ -0,0 +1,3 @@
+{
+  "description": "Send an empty map rather than null for a vended Terraform AgentCore Harness module's environment_variables, so the first apply does not fail after creating the Harness"
+}

package/src/migrations/v1.0.2/0001-terraform-harness-environment-variables/migration.d.ts

@@ -0,0 +1,6 @@
+/**
+ * Copyright Amazon.com, Inc. or its affiliates. All Rights Reserved.
+ * SPDX-License-Identifier: Apache-2.0
+ */
+import { type MigrationReturnObject, type Tree } from '@nx/devkit';
+export default function migration(tree: Tree): Promise<MigrationReturnObject>;

package/src/migrations/v1.0.2/0001-terraform-harness-environment-variables/migration.js

@@ -0,0 +1,54 @@
+/**
+ * Copyright Amazon.com, Inc. or its affiliates. All Rights Reserved.
+ * SPDX-License-Identifier: Apache-2.0
+ */ import { joinPathFragments } from "@nx/devkit";
+import { formatFilesInSubtree } from "../../../utils/format.js";
+import { PACKAGES_DIR, SHARED_TERRAFORM_DIR } from "../../../utils/shared-constructs-constants.js";
+/**
+ * Stop each vended Terraform AgentCore Harness app module
+ * (`app/harnesses/<name>/<name>.tf`) sending a null `environment_variables`.
+ *
+ * The service stores no environment variables as an empty map and returns one,
+ * so a null fails the apply with "inconsistent values for sensitive attribute"
+ * once the Harness has already been created, leaving it tainted. Every
+ * subsequent apply fails the same way.
+ *
+ * Modules whose assignment has been edited are left untouched and reported via
+ * `nextSteps`.
+ */ const TERRAFORM_HARNESS_APP_DIR = `${PACKAGES_DIR}/${SHARED_TERRAFORM_DIR}/src/app/harnesses`;
+/** The assignment the generator used to write. */ const NULLABLE_ASSIGNMENT = 'environment_variables = var.environment_variables';
+/** What it becomes, so the value sent matches what the service returns. */ const COALESCED_ASSIGNMENT = 'environment_variables = coalesce(var.environment_variables, {})';
+const divergedMessage = (filePath)=>`${filePath}: its environment_variables assignment has been edited, so it was left as it is. Change it to \`${COALESCED_ASSIGNMENT}\` — the AgentCore service returns an empty map when a Harness has no environment variables, and sending null fails the apply after the Harness has been created.`;
+export default async function migration(tree) {
+    const nextSteps = [];
+    let migrated = false;
+    if (!tree.exists(TERRAFORM_HARNESS_APP_DIR)) {
+        return {
+            nextSteps
+        }; // This workspace has no Terraform harness modules.
+    }
+    for (const dirName of tree.children(TERRAFORM_HARNESS_APP_DIR)){
+        const filePath = joinPathFragments(TERRAFORM_HARNESS_APP_DIR, dirName, `${dirName}.tf`);
+        if (!tree.exists(filePath)) {
+            continue; // Not a harness app module directory.
+        }
+        const contents = tree.read(filePath, 'utf-8') ?? '';
+        if (contents.includes(COALESCED_ASSIGNMENT)) {
+            continue; // Already migrated, so a re-run is a no-op.
+        }
+        if (!contents.includes(NULLABLE_ASSIGNMENT)) {
+            nextSteps.push(divergedMessage(filePath));
+            continue;
+        }
+        tree.write(filePath, contents.replace(NULLABLE_ASSIGNMENT, COALESCED_ASSIGNMENT));
+        migrated = true;
+    }
+    if (migrated) {
+        await formatFilesInSubtree(tree, TERRAFORM_HARNESS_APP_DIR);
+    }
+    return {
+        nextSteps
+    };
+}
+
+//# sourceMappingURL=migration.js.map

package/src/migrations/v1.0.2/0001-terraform-harness-environment-variables/migration.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../../../../../../../packages/nx-plugin/src/migrations/v1.0.2/0001-terraform-harness-environment-variables/migration.ts"],"sourcesContent":["/**\n * Copyright Amazon.com, Inc. or its affiliates. All Rights Reserved.\n * SPDX-License-Identifier: Apache-2.0\n */\nimport {\n  joinPathFragments,\n  type MigrationReturnObject,\n  type Tree,\n} from '@nx/devkit';\nimport { formatFilesInSubtree } from '../../../utils/format.js';\nimport {\n  PACKAGES_DIR,\n  SHARED_TERRAFORM_DIR,\n} from '../../../utils/shared-constructs-constants.js';\n\n/**\n * Stop each vended Terraform AgentCore Harness app module\n * (`app/harnesses/<name>/<name>.tf`) sending a null `environment_variables`.\n *\n * The service stores no environment variables as an empty map and returns one,\n * so a null fails the apply with \"inconsistent values for sensitive attribute\"\n * once the Harness has already been created, leaving it tainted. Every\n * subsequent apply fails the same way.\n *\n * Modules whose assignment has been edited are left untouched and reported via\n * `nextSteps`.\n */\n\nconst TERRAFORM_HARNESS_APP_DIR = `${PACKAGES_DIR}/${SHARED_TERRAFORM_DIR}/src/app/harnesses`;\n\n/** The assignment the generator used to write. */\nconst NULLABLE_ASSIGNMENT = 'environment_variables = var.environment_variables';\n\n/** What it becomes, so the value sent matches what the service returns. */\nconst COALESCED_ASSIGNMENT =\n  'environment_variables = coalesce(var.environment_variables, {})';\n\nconst divergedMessage = (filePath: string) =>\n  `${filePath}: its environment_variables assignment has been edited, so it was left as it is. Change it to \\`${COALESCED_ASSIGNMENT}\\` — the AgentCore service returns an empty map when a Harness has no environment variables, and sending null fails the apply after the Harness has been created.`;\n\nexport default async function migration(\n  tree: Tree,\n): Promise<MigrationReturnObject> {\n  const nextSteps: string[] = [];\n  let migrated = false;\n\n  if (!tree.exists(TERRAFORM_HARNESS_APP_DIR)) {\n    return { nextSteps }; // This workspace has no Terraform harness modules.\n  }\n\n  for (const dirName of tree.children(TERRAFORM_HARNESS_APP_DIR)) {\n    const filePath = joinPathFragments(\n      TERRAFORM_HARNESS_APP_DIR,\n      dirName,\n      `${dirName}.tf`,\n    );\n    if (!tree.exists(filePath)) {\n      continue; // Not a harness app module directory.\n    }\n\n    const contents = tree.read(filePath, 'utf-8') ?? '';\n\n    if (contents.includes(COALESCED_ASSIGNMENT)) {\n      continue; // Already migrated, so a re-run is a no-op.\n    }\n\n    if (!contents.includes(NULLABLE_ASSIGNMENT)) {\n      nextSteps.push(divergedMessage(filePath));\n      continue;\n    }\n\n    tree.write(\n      filePath,\n      contents.replace(NULLABLE_ASSIGNMENT, COALESCED_ASSIGNMENT),\n    );\n    migrated = true;\n  }\n\n  if (migrated) {\n    await formatFilesInSubtree(tree, TERRAFORM_HARNESS_APP_DIR);\n  }\n\n  return { nextSteps };\n}\n"],"names":["joinPathFragments","formatFilesInSubtree","PACKAGES_DIR","SHARED_TERRAFORM_DIR","TERRAFORM_HARNESS_APP_DIR","NULLABLE_ASSIGNMENT","COALESCED_ASSIGNMENT","divergedMessage","filePath","migration","tree","nextSteps","migrated","exists","dirName","children","contents","read","includes","push","write","replace"],"mappings":"AAAA;;;CAGC,GACD,SACEA,iBAAiB,QAGZ,aAAa;AACpB,SAASC,oBAAoB,QAAQ,2BAA2B;AAChE,SACEC,YAAY,EACZC,oBAAoB,QACf,gDAAgD;AAEvD;;;;;;;;;;;CAWC,GAED,MAAMC,4BAA4B,GAAGF,aAAa,CAAC,EAAEC,qBAAqB,kBAAkB,CAAC;AAE7F,gDAAgD,GAChD,MAAME,sBAAsB;AAE5B,yEAAyE,GACzE,MAAMC,uBACJ;AAEF,MAAMC,kBAAkB,CAACC,WACvB,GAAGA,SAAS,gGAAgG,EAAEF,qBAAqB,iKAAiK,CAAC;AAEvS,eAAe,eAAeG,UAC5BC,IAAU;IAEV,MAAMC,YAAsB,EAAE;IAC9B,IAAIC,WAAW;IAEf,IAAI,CAACF,KAAKG,MAAM,CAACT,4BAA4B;QAC3C,OAAO;YAAEO;QAAU,GAAG,mDAAmD;IAC3E;IAEA,KAAK,MAAMG,WAAWJ,KAAKK,QAAQ,CAACX,2BAA4B;QAC9D,MAAMI,WAAWR,kBACfI,2BACAU,SACA,GAAGA,QAAQ,GAAG,CAAC;QAEjB,IAAI,CAACJ,KAAKG,MAAM,CAACL,WAAW;YAC1B,UAAU,sCAAsC;QAClD;QAEA,MAAMQ,WAAWN,KAAKO,IAAI,CAACT,UAAU,YAAY;QAEjD,IAAIQ,SAASE,QAAQ,CAACZ,uBAAuB;YAC3C,UAAU,4CAA4C;QACxD;QAEA,IAAI,CAACU,SAASE,QAAQ,CAACb,sBAAsB;YAC3CM,UAAUQ,IAAI,CAACZ,gBAAgBC;YAC/B;QACF;QAEAE,KAAKU,KAAK,CACRZ,UACAQ,SAASK,OAAO,CAAChB,qBAAqBC;QAExCM,WAAW;IACb;IAEA,IAAIA,UAAU;QACZ,MAAMX,qBAAqBS,MAAMN;IACnC;IAEA,OAAO;QAAEO;IAAU;AACrB"}

package/src/preset/__snapshots__/generator.spec.ts.snap

@@ -253,7 +253,7 @@ export default {
 
 exports[`preset generator > should run successfully > biome.json 1`] = `
 "{
-  "$schema": "https://biomejs.dev/schemas/2.5.12/schema.json",
+  "$schema": "https://biomejs.dev/schemas/2.5.14/schema.json",
   "root": true,
   "formatter": {
     "enabled": true,
@@ -422,7 +422,7 @@ catalog:
   '@nx/js': 23.2.1
   '@nx/workspace': 23.2.1
   typescript: ~6.0.3
-  '@biomejs/biome': 2.5.12
+  '@biomejs/biome': 2.5.14
   '@aws/nx-plugin': ^0.0.0
   '@aws/nx-plugin-mcp': ^0.0.0
 "

package/src/py/agent/__snapshots__/generator.constructs.spec.ts.snap

@@ -763,15 +763,15 @@ name = "proj.test_project"
 version = "0.1.0"
 dependencies = [
   "proj-agent-connection",
-  "aws-lambda-powertools==3.34.0",
-  "aws-opentelemetry-distro==0.19.0",
-  "bedrock-agentcore==1.22.0",
-  "boto3==1.43.89",
+  "aws-lambda-powertools==3.35.0",
+  "aws-opentelemetry-distro==0.20.0",
+  "bedrock-agentcore==1.23.1",
+  "boto3==1.43.98",
   "fastapi==0.141.1",
   "mcp==1.28.1",
-  "strands-agents==1.54.0",
-  "strands-agents-tools==0.8.8",
-  "uvicorn==0.52.4"
+  "strands-agents==1.56.0",
+  "strands-agents-tools==0.8.9",
+  "uvicorn==0.53.0"
 ]
 
 [dependency-groups]

package/src/py/agent/__snapshots__/generator.frameworks.spec.ts.snap

@@ -701,20 +701,20 @@ name = "proj.test_project"
 version = "0.1.0"
 dependencies = [
   "proj-agent-connection",
-  "aws-lambda-powertools==3.34.0",
-  "aws-opentelemetry-distro==0.19.0",
-  "bedrock-agentcore==1.22.0",
-  "boto3==1.43.89",
+  "aws-lambda-powertools==3.35.0",
+  "aws-opentelemetry-distro==0.20.0",
+  "bedrock-agentcore==1.23.1",
+  "boto3==1.43.98",
   "fastapi==0.141.1",
   "mcp==1.28.1",
-  "langchain==1.4.0",
-  "langchain-aws==1.7.5",
-  "langgraph==1.2.11",
+  "langchain==1.4.2",
+  "langchain-aws==1.7.8",
+  "langgraph==1.2.12",
   "langgraph-checkpoint-sqlite==3.1.1",
   "aiosqlite==0.22.1",
   "ag-ui-protocol==0.1.22",
-  "ag-ui-langgraph==0.0.44",
-  "uvicorn==0.52.4"
+  "ag-ui-langgraph==0.0.45",
+  "uvicorn==0.53.0"
 ]
 
 [dependency-groups]

package/src/py/agent/__snapshots__/generator.protocols.spec.ts.snap

@@ -5,11 +5,11 @@ exports[`py#agent generator > should create DynamoDB checkpoint table and S3 off
   required_providers {
     aws = {
       source  = "hashicorp/aws"
-      version = "6.63.0"
+      version = "6.66.0"
     }
     random = {
       source  = "hashicorp/random"
-      version = "3.9.0"
+      version = "3.9.1"
     }
   }
 }
@@ -381,11 +381,11 @@ exports[`py#agent generator > should match snapshot for Terraform generated file
   required_providers {
     aws = {
       source  = "hashicorp/aws"
-      version = "6.63.0"
+      version = "6.66.0"
     }
     random = {
       source  = "hashicorp/random"
-      version = "3.9.0"
+      version = "3.9.1"
     }
   }
 }
@@ -704,15 +704,15 @@ exports[`py#agent generator > should match snapshot for Terraform generated file
   required_providers {
     aws = {
       source  = "hashicorp/aws"
-      version = "6.63.0"
+      version = "6.66.0"
     }
     null = {
       source  = "hashicorp/null"
-      version = "3.3.1"
+      version = "3.3.2"
     }
     random = {
       source  = "hashicorp/random"
-      version = "3.9.0"
+      version = "3.9.1"
     }
   }
 }
@@ -1063,7 +1063,7 @@ resource "null_resource" "runtime_ready" {
 
   provisioner "local-exec" {
     command = <<-EOT
-      uv run --with boto3==1.43.89 python -c "
+      uv run --with boto3==1.43.98 python -c "
 import boto3
 import json
 import os

package/src/py/dynamodb/__snapshots__/generator.spec.ts.snap

@@ -35,7 +35,7 @@ exports[`py#dynamodb generator > should generate terraform modules when iac is t
   required_providers {
     aws = {
       source  = "hashicorp/aws"
-      version = "6.63.0"
+      version = "6.66.0"
     }
   }
 }
@@ -232,11 +232,11 @@ exports[`py#dynamodb generator > should generate terraform modules when iac is t
   required_providers {
     aws = {
       source  = "hashicorp/aws"
-      version = "6.63.0"
+      version = "6.66.0"
     }
     random = {
       source  = "hashicorp/random"
-      version = "3.9.0"
+      version = "3.9.1"
     }
   }
 }

package/src/py/fast-api/__snapshots__/generator.terraform.spec.ts.snap

@@ -11,7 +11,7 @@ terraform {
   required_providers {
     aws = {
       source  = "hashicorp/aws"
-      version = "6.63.0"
+      version = "6.66.0"
     }
   }
 }
@@ -258,15 +258,15 @@ output "api_log_group_arn" {
   required_providers {
     archive = {
       source  = "hashicorp/archive"
-      version = "2.8.0"
+      version = "2.8.1"
     }
     aws = {
       source  = "hashicorp/aws"
-      version = "6.63.0"
+      version = "6.66.0"
     }
     random = {
       source  = "hashicorp/random"
-      version = "3.9.0"
+      version = "3.9.1"
     }
   }
 }
@@ -846,7 +846,7 @@ terraform {
   required_providers {
     aws = {
       source  = "hashicorp/aws"
-      version = "6.63.0"
+      version = "6.66.0"
     }
   }
 }
@@ -1093,15 +1093,15 @@ output "api_log_group_arn" {
   required_providers {
     archive = {
       source  = "hashicorp/archive"
-      version = "2.8.0"
+      version = "2.8.1"
     }
     aws = {
       source  = "hashicorp/aws"
-      version = "6.63.0"
+      version = "6.66.0"
     }
     random = {
       source  = "hashicorp/random"
-      version = "3.9.0"
+      version = "3.9.1"
     }
   }
 }
@@ -1754,7 +1754,7 @@ terraform {
   required_providers {
     aws = {
       source  = "hashicorp/aws"
-      version = "6.63.0"
+      version = "6.66.0"
     }
   }
 }
@@ -2001,15 +2001,15 @@ output "api_log_group_arn" {
   required_providers {
     archive = {
       source  = "hashicorp/archive"
-      version = "2.8.0"
+      version = "2.8.1"
     }
     aws = {
       source  = "hashicorp/aws"
-      version = "6.63.0"
+      version = "6.66.0"
     }
     random = {
       source  = "hashicorp/random"
-      version = "3.9.0"
+      version = "3.9.1"
     }
   }
 }
@@ -2566,11 +2566,11 @@ terraform {
   required_providers {
     aws = {
       source  = "hashicorp/aws"
-      version = "6.63.0"
+      version = "6.66.0"
     }
     random = {
       source  = "hashicorp/random"
-      version = "3.9.0"
+      version = "3.9.1"
     }
   }
 }
@@ -2875,15 +2875,15 @@ output "waf_web_acl_arn" {
   required_providers {
     archive = {
       source  = "hashicorp/archive"
-      version = "2.8.0"
+      version = "2.8.1"
     }
     aws = {
       source  = "hashicorp/aws"
-      version = "6.63.0"
+      version = "6.66.0"
     }
     random = {
       source  = "hashicorp/random"
-      version = "3.9.0"
+      version = "3.9.1"
     }
   }
 }
@@ -3914,11 +3914,11 @@ terraform {
   required_providers {
     aws = {
       source  = "hashicorp/aws"
-      version = "6.63.0"
+      version = "6.66.0"
     }
     random = {
       source  = "hashicorp/random"
-      version = "3.9.0"
+      version = "3.9.1"
     }
   }
 }
@@ -4223,15 +4223,15 @@ output "waf_web_acl_arn" {
   required_providers {
     archive = {
       source  = "hashicorp/archive"
-      version = "2.8.0"
+      version = "2.8.1"
     }
     aws = {
       source  = "hashicorp/aws"
-      version = "6.63.0"
+      version = "6.66.0"
     }
     random = {
       source  = "hashicorp/random"
-      version = "3.9.0"
+      version = "3.9.1"
     }
   }
 }
@@ -5251,11 +5251,11 @@ terraform {
   required_providers {
     aws = {
       source  = "hashicorp/aws"
-      version = "6.63.0"
+      version = "6.66.0"
     }
     random = {
       source  = "hashicorp/random"
-      version = "3.9.0"
+      version = "3.9.1"
     }
   }
 }
@@ -5560,15 +5560,15 @@ output "waf_web_acl_arn" {
   required_providers {
     archive = {
       source  = "hashicorp/archive"
-      version = "2.8.0"
+      version = "2.8.1"
     }
     aws = {
       source  = "hashicorp/aws"
-      version = "6.63.0"
+      version = "6.66.0"
     }
     random = {
       source  = "hashicorp/random"
-      version = "3.9.0"
+      version = "3.9.1"
     }
   }
 }