@aws/nx-plugin 1.0.13 → 1.0.15

package/migrations.json

@@ -2,6 +2,11 @@
   "$schema": "http://json-schema.org/schema",
   "name": "@aws/nx-plugin",
   "generators": {
+    "latest-py-agent-pillow-override": {
+      "version": "1.0.15",
+      "description": "Add the strands-agents-tools pillow override to the workspace root pyproject.toml uv override-dependencies",
+      "implementation": "./src/migrations/latest/py-agent-pillow-override/migration"
+    },
     "v1.0.0-rc.50-0001-modernize-function-props-cast": {
       "version": "1.0.0-rc.50",
       "description": "Replace the legacy angle-bracket FunctionProps type assertion with the modern as syntax in generated API constructs",
@@ -418,7 +423,7 @@
       "implementation": "./src/migrations/v1.0.9/0001-py-dynamodb-bind-base-model-meta/migration"
     },
     "sync-vended-versions": {
-      "version": "1.0.13",
+      "version": "1.0.15",
       "description": "Sync vended dependency versions and the tracked plugin version to those vended by this release",
       "implementation": "./src/utils/version-upgrade-migration/migration"
     }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@aws/nx-plugin",
-  "version": "1.0.13",
+  "version": "1.0.15",
   "repository": {
     "type": "git",
     "url": "https://github.com/awslabs/nx-plugin-for-aws.git",

package/src/agentcore-gateway/__snapshots__/generator.spec.ts.snap

@@ -7,7 +7,7 @@ exports[`agentcore-gateway generator > protocol: http > omits protocol_type from
   required_providers {
     aws = {
       source  = "hashicorp/aws"
-      version = "6.68.0"
+      version = "6.69.1"
     }
     time = {
       source  = "hashicorp/time"

package/src/migrations/latest/py-agent-pillow-override/metadata.json

@@ -0,0 +1,3 @@
+{
+  "description": "Add the strands-agents-tools pillow override to the workspace root pyproject.toml uv override-dependencies"
+}

package/src/migrations/latest/py-agent-pillow-override/migration.d.ts

@@ -0,0 +1,18 @@
+/**
+ * Copyright Amazon.com, Inc. or its affiliates. All Rights Reserved.
+ * SPDX-License-Identifier: Apache-2.0
+ */
+import { type MigrationReturnObject, type Tree } from '@nx/devkit';
+/**
+ * Add the strands-agents-tools pillow override to the workspace root
+ * pyproject.toml uv override-dependencies.
+ *
+ * strands-agents-tools caps pillow below the release that fixes its current
+ * CVEs, and uv reads `[tool.uv] override-dependencies` only from the workspace
+ * root, so the root carries the override (`PY_UV_OVERRIDES`). It applies when
+ * any project's `[project].dependencies` names strands-agents-tools. A user
+ * override for the same package is kept as written. `uv.lock` is left to the
+ * user, as the version sync leaves it, so `nextSteps` asks for `uv sync` when
+ * the root changes.
+ */
+export default function migration(tree: Tree): Promise<MigrationReturnObject>;

package/src/migrations/latest/py-agent-pillow-override/migration.js

@@ -0,0 +1,38 @@
+/**
+ * Copyright Amazon.com, Inc. or its affiliates. All Rights Reserved.
+ * SPDX-License-Identifier: Apache-2.0
+ */ import { getProjects, joinPathFragments } from "@nx/devkit";
+import { formatFilesInSubtree } from "../../../utils/format.js";
+import { addUvOverrideDependencies } from "../../../utils/py.js";
+import { tryReadToml } from "../../../utils/toml.js";
+/**
+ * Add the strands-agents-tools pillow override to the workspace root
+ * pyproject.toml uv override-dependencies.
+ *
+ * strands-agents-tools caps pillow below the release that fixes its current
+ * CVEs, and uv reads `[tool.uv] override-dependencies` only from the workspace
+ * root, so the root carries the override (`PY_UV_OVERRIDES`). It applies when
+ * any project's `[project].dependencies` names strands-agents-tools. A user
+ * override for the same package is kept as written. `uv.lock` is left to the
+ * user, as the version sync leaves it, so `nextSteps` asks for `uv sync` when
+ * the root changes.
+ */ export default async function migration(tree) {
+    const nextSteps = [];
+    if (tree.exists('pyproject.toml')) {
+        const requirements = [
+            ...getProjects(tree).values()
+        ].flatMap(({ root })=>{
+            const dependencies = tryReadToml(tree, joinPathFragments(root, 'pyproject.toml'))?.project?.dependencies;
+            return Array.isArray(dependencies) ? dependencies : [];
+        });
+        if (addUvOverrideDependencies(tree, requirements)) {
+            nextSteps.push('The workspace root pyproject.toml now overrides a dependency of strands-agents-tools. Run `uv sync` to update uv.lock.');
+        }
+    }
+    await formatFilesInSubtree(tree);
+    return {
+        nextSteps
+    };
+}
+
+//# sourceMappingURL=migration.js.map

package/src/migrations/latest/py-agent-pillow-override/migration.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../../../../../../../packages/nx-plugin/src/migrations/latest/py-agent-pillow-override/migration.ts"],"sourcesContent":["/**\n * Copyright Amazon.com, Inc. or its affiliates. All Rights Reserved.\n * SPDX-License-Identifier: Apache-2.0\n */\nimport {\n  getProjects,\n  joinPathFragments,\n  type MigrationReturnObject,\n  type Tree,\n} from '@nx/devkit';\nimport { formatFilesInSubtree } from '../../../utils/format.js';\nimport type { UVPyprojectToml } from '../../../utils/nxlv-python.js';\nimport { addUvOverrideDependencies } from '../../../utils/py.js';\nimport { tryReadToml } from '../../../utils/toml.js';\n\n/**\n * Add the strands-agents-tools pillow override to the workspace root\n * pyproject.toml uv override-dependencies.\n *\n * strands-agents-tools caps pillow below the release that fixes its current\n * CVEs, and uv reads `[tool.uv] override-dependencies` only from the workspace\n * root, so the root carries the override (`PY_UV_OVERRIDES`). It applies when\n * any project's `[project].dependencies` names strands-agents-tools. A user\n * override for the same package is kept as written. `uv.lock` is left to the\n * user, as the version sync leaves it, so `nextSteps` asks for `uv sync` when\n * the root changes.\n */\nexport default async function migration(\n  tree: Tree,\n): Promise<MigrationReturnObject> {\n  const nextSteps: string[] = [];\n\n  if (tree.exists('pyproject.toml')) {\n    const requirements = [...getProjects(tree).values()].flatMap(({ root }) => {\n      const dependencies = (\n        tryReadToml(tree, joinPathFragments(root, 'pyproject.toml')) as\n          | UVPyprojectToml\n          | undefined\n      )?.project?.dependencies;\n      return Array.isArray(dependencies) ? dependencies : [];\n    });\n    if (addUvOverrideDependencies(tree, requirements)) {\n      nextSteps.push(\n        'The workspace root pyproject.toml now overrides a dependency of strands-agents-tools. Run `uv sync` to update uv.lock.',\n      );\n    }\n  }\n\n  await formatFilesInSubtree(tree);\n\n  return { nextSteps };\n}\n"],"names":["getProjects","joinPathFragments","formatFilesInSubtree","addUvOverrideDependencies","tryReadToml","migration","tree","nextSteps","exists","requirements","values","flatMap","root","dependencies","project","Array","isArray","push"],"mappings":"AAAA;;;CAGC,GACD,SACEA,WAAW,EACXC,iBAAiB,QAGZ,aAAa;AACpB,SAASC,oBAAoB,QAAQ,2BAA2B;AAEhE,SAASC,yBAAyB,QAAQ,uBAAuB;AACjE,SAASC,WAAW,QAAQ,yBAAyB;AAErD;;;;;;;;;;;CAWC,GACD,eAAe,eAAeC,UAC5BC,IAAU;IAEV,MAAMC,YAAsB,EAAE;IAE9B,IAAID,KAAKE,MAAM,CAAC,mBAAmB;QACjC,MAAMC,eAAe;eAAIT,YAAYM,MAAMI,MAAM;SAAG,CAACC,OAAO,CAAC,CAAC,EAAEC,IAAI,EAAE;YACpE,MAAMC,eACJT,YAAYE,MAAML,kBAAkBW,MAAM,oBAGzCE,SAASD;YACZ,OAAOE,MAAMC,OAAO,CAACH,gBAAgBA,eAAe,EAAE;QACxD;QACA,IAAIV,0BAA0BG,MAAMG,eAAe;YACjDF,UAAUU,IAAI,CACZ;QAEJ;IACF;IAEA,MAAMf,qBAAqBI;IAE3B,OAAO;QAAEC;IAAU;AACrB"}

package/src/py/agent/__snapshots__/generator.protocols.spec.ts.snap

@@ -5,7 +5,7 @@ exports[`py#agent generator > should create DynamoDB checkpoint table and S3 off
   required_providers {
     aws = {
       source  = "hashicorp/aws"
-      version = "6.68.0"
+      version = "6.69.1"
     }
     random = {
       source  = "hashicorp/random"
@@ -381,7 +381,7 @@ exports[`py#agent generator > should match snapshot for Terraform generated file
   required_providers {
     aws = {
       source  = "hashicorp/aws"
-      version = "6.68.0"
+      version = "6.69.1"
     }
     random = {
       source  = "hashicorp/random"
@@ -704,7 +704,7 @@ exports[`py#agent generator > should match snapshot for Terraform generated file
   required_providers {
     aws = {
       source  = "hashicorp/aws"
-      version = "6.68.0"
+      version = "6.69.1"
     }
     null = {
       source  = "hashicorp/null"

package/src/py/dynamodb/__snapshots__/generator.spec.ts.snap

@@ -35,7 +35,7 @@ exports[`py#dynamodb generator > should generate terraform modules when iac is t
   required_providers {
     aws = {
       source  = "hashicorp/aws"
-      version = "6.68.0"
+      version = "6.69.1"
     }
   }
 }
@@ -232,7 +232,7 @@ exports[`py#dynamodb generator > should generate terraform modules when iac is t
   required_providers {
     aws = {
       source  = "hashicorp/aws"
-      version = "6.68.0"
+      version = "6.69.1"
     }
     random = {
       source  = "hashicorp/random"

package/src/py/fast-api/__snapshots__/generator.terraform.spec.ts.snap

@@ -11,7 +11,7 @@ terraform {
   required_providers {
     aws = {
       source  = "hashicorp/aws"
-      version = "6.68.0"
+      version = "6.69.1"
     }
   }
 }
@@ -262,7 +262,7 @@ output "api_log_group_arn" {
     }
     aws = {
       source  = "hashicorp/aws"
-      version = "6.68.0"
+      version = "6.69.1"
     }
     random = {
       source  = "hashicorp/random"
@@ -908,7 +908,7 @@ terraform {
   required_providers {
     aws = {
       source  = "hashicorp/aws"
-      version = "6.68.0"
+      version = "6.69.1"
     }
   }
 }
@@ -1159,7 +1159,7 @@ output "api_log_group_arn" {
     }
     aws = {
       source  = "hashicorp/aws"
-      version = "6.68.0"
+      version = "6.69.1"
     }
     random = {
       source  = "hashicorp/random"
@@ -1878,7 +1878,7 @@ terraform {
   required_providers {
     aws = {
       source  = "hashicorp/aws"
-      version = "6.68.0"
+      version = "6.69.1"
     }
   }
 }
@@ -2129,7 +2129,7 @@ output "api_log_group_arn" {
     }
     aws = {
       source  = "hashicorp/aws"
-      version = "6.68.0"
+      version = "6.69.1"
     }
     random = {
       source  = "hashicorp/random"
@@ -2752,7 +2752,7 @@ terraform {
   required_providers {
     aws = {
       source  = "hashicorp/aws"
-      version = "6.68.0"
+      version = "6.69.1"
     }
     random = {
       source  = "hashicorp/random"
@@ -3065,7 +3065,7 @@ output "waf_web_acl_arn" {
     }
     aws = {
       source  = "hashicorp/aws"
-      version = "6.68.0"
+      version = "6.69.1"
     }
     random = {
       source  = "hashicorp/random"
@@ -4162,7 +4162,7 @@ terraform {
   required_providers {
     aws = {
       source  = "hashicorp/aws"
-      version = "6.68.0"
+      version = "6.69.1"
     }
     random = {
       source  = "hashicorp/random"
@@ -4475,7 +4475,7 @@ output "waf_web_acl_arn" {
     }
     aws = {
       source  = "hashicorp/aws"
-      version = "6.68.0"
+      version = "6.69.1"
     }
     random = {
       source  = "hashicorp/random"
@@ -5561,7 +5561,7 @@ terraform {
   required_providers {
     aws = {
       source  = "hashicorp/aws"
-      version = "6.68.0"
+      version = "6.69.1"
     }
     random = {
       source  = "hashicorp/random"
@@ -5874,7 +5874,7 @@ output "waf_web_acl_arn" {
     }
     aws = {
       source  = "hashicorp/aws"
-      version = "6.68.0"
+      version = "6.69.1"
     }
     random = {
       source  = "hashicorp/random"

package/src/py/lambda-function/__snapshots__/generator.spec.ts.snap

@@ -71,7 +71,7 @@ exports[`lambda-handler project generator > terraform iac > should generate terr
   required_providers {
     aws = {
       source  = "hashicorp/aws"
-      version = "6.68.0"
+      version = "6.69.1"
     }
     archive = {
       source  = "hashicorp/archive"
@@ -256,7 +256,7 @@ exports[`lambda-handler project generator > terraform iac > should match snapsho
   required_providers {
     aws = {
       source  = "hashicorp/aws"
-      version = "6.68.0"
+      version = "6.69.1"
     }
     archive = {
       source  = "hashicorp/archive"

package/src/py/mcp-server/__snapshots__/generator.spec.ts.snap

@@ -155,7 +155,7 @@ exports[`py#mcp-server generator > should match snapshot for Terraform generated
   required_providers {
     aws = {
       source  = "hashicorp/aws"
-      version = "6.68.0"
+      version = "6.69.1"
     }
     null = {
       source  = "hashicorp/null"

package/src/py/rdb/__snapshots__/generator.spec.ts.snap

@@ -228,7 +228,7 @@ exports[`py#rdb generator > should generate Terraform modules 1`] = `
     }
     aws = {
       source  = "hashicorp/aws"
-      version = "6.68.0"
+      version = "6.69.1"
     }
     external = {
       source  = "hashicorp/external"

package/src/smithy/ts/api/__snapshots__/generator.spec.ts.snap

@@ -416,7 +416,7 @@ terraform {
   required_providers {
     aws = {
       source  = "hashicorp/aws"
-      version = "6.68.0"
+      version = "6.69.1"
     }
     random = {
       source  = "hashicorp/random"
@@ -732,7 +732,7 @@ exports[`tsSmithyApiGenerator > should generate smithy ts api with Terraform pro
     }
     aws = {
       source  = "hashicorp/aws"
-      version = "6.68.0"
+      version = "6.69.1"
     }
     random = {
       source  = "hashicorp/random"
@@ -2317,7 +2317,7 @@ terraform {
   required_providers {
     aws = {
       source  = "hashicorp/aws"
-      version = "6.68.0"
+      version = "6.69.1"
     }
     random = {
       source  = "hashicorp/random"
@@ -2630,7 +2630,7 @@ output "waf_web_acl_arn" {
     }
     aws = {
       source  = "hashicorp/aws"
-      version = "6.68.0"
+      version = "6.69.1"
     }
     random = {
       source  = "hashicorp/random"
@@ -3692,7 +3692,7 @@ terraform {
   required_providers {
     aws = {
       source  = "hashicorp/aws"
-      version = "6.68.0"
+      version = "6.69.1"
     }
     random = {
       source  = "hashicorp/random"
@@ -4005,7 +4005,7 @@ output "waf_web_acl_arn" {
     }
     aws = {
       source  = "hashicorp/aws"
-      version = "6.68.0"
+      version = "6.69.1"
     }
     random = {
       source  = "hashicorp/random"
@@ -5056,7 +5056,7 @@ exports[`tsSmithyApiGenerator > terraform iac > should generate terraform with c
     }
     aws = {
       source  = "hashicorp/aws"
-      version = "6.68.0"
+      version = "6.69.1"
     }
     random = {
       source  = "hashicorp/random"

package/src/trpc/backend/__snapshots__/generator.spec.ts.snap

@@ -3223,7 +3223,7 @@ terraform {
   required_providers {
     aws = {
       source  = "hashicorp/aws"
-      version = "6.68.0"
+      version = "6.69.1"
     }
   }
 }
@@ -3474,7 +3474,7 @@ output "api_log_group_arn" {
     }
     aws = {
       source  = "hashicorp/aws"
-      version = "6.68.0"
+      version = "6.69.1"
     }
     random = {
       source  = "hashicorp/random"
@@ -4100,7 +4100,7 @@ terraform {
   required_providers {
     aws = {
       source  = "hashicorp/aws"
-      version = "6.68.0"
+      version = "6.69.1"
     }
   }
 }
@@ -4351,7 +4351,7 @@ output "api_log_group_arn" {
     }
     aws = {
       source  = "hashicorp/aws"
-      version = "6.68.0"
+      version = "6.69.1"
     }
     random = {
       source  = "hashicorp/random"
@@ -5050,7 +5050,7 @@ terraform {
   required_providers {
     aws = {
       source  = "hashicorp/aws"
-      version = "6.68.0"
+      version = "6.69.1"
     }
   }
 }
@@ -5301,7 +5301,7 @@ output "api_log_group_arn" {
     }
     aws = {
       source  = "hashicorp/aws"
-      version = "6.68.0"
+      version = "6.69.1"
     }
     random = {
       source  = "hashicorp/random"
@@ -5904,7 +5904,7 @@ terraform {
   required_providers {
     aws = {
       source  = "hashicorp/aws"
-      version = "6.68.0"
+      version = "6.69.1"
     }
     random = {
       source  = "hashicorp/random"
@@ -6217,7 +6217,7 @@ output "waf_web_acl_arn" {
     }
     aws = {
       source  = "hashicorp/aws"
-      version = "6.68.0"
+      version = "6.69.1"
     }
     random = {
       source  = "hashicorp/random"
@@ -7280,7 +7280,7 @@ terraform {
   required_providers {
     aws = {
       source  = "hashicorp/aws"
-      version = "6.68.0"
+      version = "6.69.1"
     }
     random = {
       source  = "hashicorp/random"
@@ -7593,7 +7593,7 @@ output "waf_web_acl_arn" {
     }
     aws = {
       source  = "hashicorp/aws"
-      version = "6.68.0"
+      version = "6.69.1"
     }
     random = {
       source  = "hashicorp/random"
@@ -8645,7 +8645,7 @@ terraform {
   required_providers {
     aws = {
       source  = "hashicorp/aws"
-      version = "6.68.0"
+      version = "6.69.1"
     }
     random = {
       source  = "hashicorp/random"
@@ -8958,7 +8958,7 @@ output "waf_web_acl_arn" {
     }
     aws = {
       source  = "hashicorp/aws"
-      version = "6.68.0"
+      version = "6.69.1"
     }
     random = {
       source  = "hashicorp/random"

package/src/ts/agent/__snapshots__/generator.spec.ts.snap

@@ -984,7 +984,7 @@ exports[`ts#agent generator > should match snapshot for Terraform generated file
   required_providers {
     aws = {
       source  = "hashicorp/aws"
-      version = "6.68.0"
+      version = "6.69.1"
     }
     random = {
       source  = "hashicorp/random"
@@ -1307,7 +1307,7 @@ exports[`ts#agent generator > should match snapshot for Terraform generated file
   required_providers {
     aws = {
       source  = "hashicorp/aws"
-      version = "6.68.0"
+      version = "6.69.1"
     }
     null = {
       source  = "hashicorp/null"

package/src/ts/dcr-proxy/__snapshots__/generator.spec.ts.snap

@@ -579,7 +579,7 @@ terraform {
   required_providers {
     aws = {
       source  = "hashicorp/aws"
-      version = "6.68.0"
+      version = "6.69.1"
     }
     archive = {
       source  = "hashicorp/archive"

package/src/ts/dynamodb/__snapshots__/generator.spec.ts.snap

@@ -35,7 +35,7 @@ exports[`ts#dynamodb generator > should generate terraform modules when iac is t
   required_providers {
     aws = {
       source  = "hashicorp/aws"
-      version = "6.68.0"
+      version = "6.69.1"
     }
   }
 }
@@ -232,7 +232,7 @@ exports[`ts#dynamodb generator > should generate terraform modules when iac is t
   required_providers {
     aws = {
       source  = "hashicorp/aws"
-      version = "6.68.0"
+      version = "6.69.1"
     }
     random = {
       source  = "hashicorp/random"

package/src/ts/lambda-function/__snapshots__/generator.spec.ts.snap

@@ -141,7 +141,7 @@ exports[`ts-lambda-function generator > terraform iac > should generate terrafor
   required_providers {
     aws = {
       source  = "hashicorp/aws"
-      version = "6.68.0"
+      version = "6.69.1"
     }
     archive = {
       source  = "hashicorp/archive"
@@ -326,7 +326,7 @@ exports[`ts-lambda-function generator > terraform iac > should match snapshot fo
   required_providers {
     aws = {
       source  = "hashicorp/aws"
-      version = "6.68.0"
+      version = "6.69.1"
     }
     archive = {
       source  = "hashicorp/archive"

package/src/ts/mcp-server/__snapshots__/generator.spec.ts.snap

@@ -155,7 +155,7 @@ exports[`ts#mcp-server generator > should match snapshot for Terraform generated
   required_providers {
     aws = {
       source  = "hashicorp/aws"
-      version = "6.68.0"
+      version = "6.69.1"
     }
     null = {
       source  = "hashicorp/null"

package/src/ts/rdb/__snapshots__/generator.spec.ts.snap

@@ -848,7 +848,7 @@ terraform {
   required_providers {
     aws = {
       source  = "hashicorp/aws"
-      version = "6.68.0"
+      version = "6.69.1"
     }
     null = {
       source  = "hashicorp/null"
@@ -1519,7 +1519,7 @@ exports[`ts#rdb generator > should generate terraform modules when iac is Terraf
     }
     aws = {
       source  = "hashicorp/aws"
-      version = "6.68.0"
+      version = "6.69.1"
     }
     external = {
       source  = "hashicorp/external"
@@ -2214,7 +2214,7 @@ terraform {
   required_providers {
     aws = {
       source  = "hashicorp/aws"
-      version = "6.68.0"
+      version = "6.69.1"
     }
     null = {
       source  = "hashicorp/null"
@@ -2885,7 +2885,7 @@ exports[`ts#rdb generator > should generate terraform modules with MySQL engine
     }
     aws = {
       source  = "hashicorp/aws"
-      version = "6.68.0"
+      version = "6.69.1"
     }
     external = {
       source  = "hashicorp/external"

package/src/ts/react-website/app/__snapshots__/generator.spec.ts.snap

@@ -131,7 +131,7 @@ exports[`react-website generator > TailwindCSS integration > terraform iac > sho
   required_providers {
     aws = {
       source  = "hashicorp/aws"
-      version = "6.68.0"
+      version = "6.69.1"
       configuration_aliases = [aws.us_east_1]
     }
     null = {
@@ -954,7 +954,7 @@ output "waf_web_acl_arn" {
   required_providers {
     aws = {
       source  = "hashicorp/aws"
-      version = "6.68.0"
+      version = "6.69.1"
       configuration_aliases = [aws.us_east_1]
     }
   }

package/src/ts/react-website/cognito-auth/__snapshots__/generator.terraform.spec.ts.snap

@@ -6,7 +6,7 @@ exports[`cognito-auth generator terraform iac > should generate terraform files
   required_providers {
     aws = {
       source  = "hashicorp/aws"
-      version = "6.68.0"
+      version = "6.69.1"
     }
     null = {
       source  = "hashicorp/null"

package/src/utils/nxlv-python.d.ts

@@ -60,6 +60,7 @@ export type UVPyprojectToml = {
                 };
             };
             index?: UVPyprojectTomlIndex[];
+            'override-dependencies'?: string[];
             workspace?: {
                 members: string[];
             };

package/src/utils/nxlv-python.js.map

@@ -1 +1 @@
-{"version":3,"sources":["../../../../../packages/nx-plugin/src/utils/nxlv-python.ts"],"sourcesContent":["/**\n * Copyright Amazon.com, Inc. or its affiliates. All Rights Reserved.\n * SPDX-License-Identifier: Apache-2.0\n */\n\n/**\n * Re-exports internal modules from @nxlv/python that are not exposed\n * via the package's \"exports\" field.\n *\n * Newer versions of Node.js and Vite strictly enforce the \"exports\" map\n * in package.json, which prevents deep imports like:\n *   import { UVProvider } from '@nxlv/python/dist/provider/uv/provider'\n *\n * This module resolves the package location and loads the internal modules\n * directly by filesystem path, bypassing the exports restriction.\n *\n * Type definitions are inlined from the @nxlv/python .d.ts files because\n * moduleResolution: \"bundler\" does not allow deep path type imports for\n * packages without proper exports.\n */\nimport type { Tree } from '@nx/devkit';\nimport { createRequire } from 'module';\nimport path from 'path';\n\nconst require = createRequire(import.meta.url);\n\n// ---------------------------------------------------------------------------\n// Inlined types from @nxlv/python (sourced from dist/**\\/*.d.ts)\n// ---------------------------------------------------------------------------\n\nexport type UVPyprojectTomlIndex = {\n  name: string;\n  url: string;\n};\n\nexport type UVPyprojectToml = {\n  project?: {\n    name: string;\n    version: string;\n    dependencies: string[];\n    'optional-dependencies': {\n      [key: string]: string[];\n    };\n  };\n  'dependency-groups': {\n    [key: string]: string[];\n  };\n  'build-system'?: {\n    requires?: string[];\n    'build-backend'?: string;\n  };\n  tool?: {\n    hatch?: {\n      build?: {\n        targets?: {\n          wheel?: {\n            packages: string[];\n          };\n        };\n      };\n      metadata?: {\n        'allow-direct-references'?: boolean;\n      };\n    };\n    uv?: {\n      sources?: {\n        [key: string]: {\n          path?: string;\n          workspace?: boolean;\n          index?: string;\n        };\n      };\n      index?: UVPyprojectTomlIndex[];\n      workspace?: {\n        members: string[];\n      };\n      'build-backend'?: {\n        'module-name'?: string[];\n        namespace?: boolean;\n      };\n    };\n  };\n};\n\ninterface ILogger {\n  setOptions(options: { silent: boolean }): void;\n  info(message: unknown): void;\n}\n\ninterface IUVProvider {\n  install(): Promise<void>;\n}\n\ninterface IUVProviderConstructor {\n  new (workspaceRoot: string, logger: ILogger, tree?: Tree): IUVProvider;\n}\n\ninterface ILoggerConstructor {\n  new (): ILogger;\n}\n\ninterface MigrateToSharedVenvSchema {\n  moveDevDependencies: boolean;\n  pyprojectPythonDependency: string;\n  pyenvPythonVersion: string | number;\n  autoActivate: boolean;\n  packageManager: 'poetry' | 'uv';\n}\n\ninterface UVProjectGeneratorSchema {\n  name: string;\n  publishable: boolean;\n  buildLockedVersions: boolean;\n  buildBundleLocalDependencies: boolean;\n  linter: 'flake8' | 'ruff' | 'none';\n  devDependenciesProject?: string;\n  rootPyprojectDependencyGroup: string;\n  templateDir?: string;\n  pyprojectPythonDependency: string;\n  projectType: 'application' | 'library';\n  projectNameAndRootFormat: 'as-provided' | 'derived';\n  packageName?: string;\n  description?: string;\n  moduleName?: string;\n  pyenvPythonVersion?: string | number;\n  tags?: string;\n  directory?: string;\n  useSyncGenerators?: boolean;\n  unitTestRunner: 'pytest' | 'none';\n  codeCoverage: boolean;\n  codeCoverageHtmlReport: boolean;\n  codeCoverageXmlReport: boolean;\n  codeCoverageThreshold?: number;\n  unitTestHtmlReport: boolean;\n  unitTestJUnitReport: boolean;\n  buildSystem: 'hatch' | 'uv';\n  srcDir: boolean;\n}\n\n// ---------------------------------------------------------------------------\n// Runtime module loading via filesystem paths\n// ---------------------------------------------------------------------------\n\n// Resolve the @nxlv/python package root by finding its package.json\n// (which IS listed in the exports map as \"./package.json\")\nconst nxlvPythonPkgJson = require.resolve('@nxlv/python/package.json');\nconst nxlvPythonRoot = path.dirname(nxlvPythonPkgJson);\n\n// eslint-disable-next-line @typescript-eslint/no-require-imports\nconst uvProviderModule = require(\n  path.join(nxlvPythonRoot, 'dist/provider/uv/provider'),\n);\n// eslint-disable-next-line @typescript-eslint/no-require-imports\nconst loggerModule = require(\n  path.join(nxlvPythonRoot, 'dist/executors/utils/logger'),\n);\n// eslint-disable-next-line @typescript-eslint/no-require-imports\nconst migrateToSharedVenvModule = require(\n  path.join(nxlvPythonRoot, 'dist/generators/migrate-to-shared-venv/generator'),\n);\n// eslint-disable-next-line @typescript-eslint/no-require-imports\nconst uvProjectModule = require(\n  path.join(nxlvPythonRoot, 'dist/generators/uv-project/generator'),\n);\n\nexport const UVProvider: IUVProviderConstructor = uvProviderModule.UVProvider;\n\nexport const Logger: ILoggerConstructor = loggerModule.Logger;\n\nexport const migrateToSharedVenvGenerator: (\n  tree: Tree,\n  options: MigrateToSharedVenvSchema,\n) => Promise<() => Promise<void>> =\n  migrateToSharedVenvModule.default ?? migrateToSharedVenvModule;\n\nexport const uvProjectGenerator: (\n  tree: Tree,\n  options: UVProjectGeneratorSchema,\n) => Promise<() => Promise<void>> = uvProjectModule.default ?? uvProjectModule;\n"],"names":["createRequire","path","require","url","nxlvPythonPkgJson","resolve","nxlvPythonRoot","dirname","uvProviderModule","join","loggerModule","migrateToSharedVenvModule","uvProjectModule","UVProvider","Logger","migrateToSharedVenvGenerator","default","uvProjectGenerator"],"mappings":"AAAA;;;CAGC,GAED;;;;;;;;;;;;;;CAcC,GAED,SAASA,aAAa,QAAQ,SAAS;AACvC,OAAOC,UAAU,OAAO;AAExB,MAAMC,UAAUF,cAAc,YAAYG,GAAG;AAmH7C,8EAA8E;AAC9E,8CAA8C;AAC9C,8EAA8E;AAE9E,oEAAoE;AACpE,2DAA2D;AAC3D,MAAMC,oBAAoBF,QAAQG,OAAO,CAAC;AAC1C,MAAMC,iBAAiBL,KAAKM,OAAO,CAACH;AAEpC,iEAAiE;AACjE,MAAMI,mBAAmBN,QACvBD,KAAKQ,IAAI,CAACH,gBAAgB;AAE5B,iEAAiE;AACjE,MAAMI,eAAeR,QACnBD,KAAKQ,IAAI,CAACH,gBAAgB;AAE5B,iEAAiE;AACjE,MAAMK,4BAA4BT,QAChCD,KAAKQ,IAAI,CAACH,gBAAgB;AAE5B,iEAAiE;AACjE,MAAMM,kBAAkBV,QACtBD,KAAKQ,IAAI,CAACH,gBAAgB;AAG5B,OAAO,MAAMO,aAAqCL,iBAAiBK,UAAU,CAAC;AAE9E,OAAO,MAAMC,SAA6BJ,aAAaI,MAAM,CAAC;AAE9D,OAAO,MAAMC,+BAIXJ,0BAA0BK,OAAO,IAAIL,0BAA0B;AAEjE,OAAO,MAAMM,qBAGuBL,gBAAgBI,OAAO,IAAIJ,gBAAgB"}
+{"version":3,"sources":["../../../../../packages/nx-plugin/src/utils/nxlv-python.ts"],"sourcesContent":["/**\n * Copyright Amazon.com, Inc. or its affiliates. All Rights Reserved.\n * SPDX-License-Identifier: Apache-2.0\n */\n\n/**\n * Re-exports internal modules from @nxlv/python that are not exposed\n * via the package's \"exports\" field.\n *\n * Newer versions of Node.js and Vite strictly enforce the \"exports\" map\n * in package.json, which prevents deep imports like:\n *   import { UVProvider } from '@nxlv/python/dist/provider/uv/provider'\n *\n * This module resolves the package location and loads the internal modules\n * directly by filesystem path, bypassing the exports restriction.\n *\n * Type definitions are inlined from the @nxlv/python .d.ts files because\n * moduleResolution: \"bundler\" does not allow deep path type imports for\n * packages without proper exports.\n */\nimport type { Tree } from '@nx/devkit';\nimport { createRequire } from 'module';\nimport path from 'path';\n\nconst require = createRequire(import.meta.url);\n\n// ---------------------------------------------------------------------------\n// Inlined types from @nxlv/python (sourced from dist/**\\/*.d.ts)\n// ---------------------------------------------------------------------------\n\nexport type UVPyprojectTomlIndex = {\n  name: string;\n  url: string;\n};\n\nexport type UVPyprojectToml = {\n  project?: {\n    name: string;\n    version: string;\n    dependencies: string[];\n    'optional-dependencies': {\n      [key: string]: string[];\n    };\n  };\n  'dependency-groups': {\n    [key: string]: string[];\n  };\n  'build-system'?: {\n    requires?: string[];\n    'build-backend'?: string;\n  };\n  tool?: {\n    hatch?: {\n      build?: {\n        targets?: {\n          wheel?: {\n            packages: string[];\n          };\n        };\n      };\n      metadata?: {\n        'allow-direct-references'?: boolean;\n      };\n    };\n    uv?: {\n      sources?: {\n        [key: string]: {\n          path?: string;\n          workspace?: boolean;\n          index?: string;\n        };\n      };\n      index?: UVPyprojectTomlIndex[];\n      'override-dependencies'?: string[];\n      workspace?: {\n        members: string[];\n      };\n      'build-backend'?: {\n        'module-name'?: string[];\n        namespace?: boolean;\n      };\n    };\n  };\n};\n\ninterface ILogger {\n  setOptions(options: { silent: boolean }): void;\n  info(message: unknown): void;\n}\n\ninterface IUVProvider {\n  install(): Promise<void>;\n}\n\ninterface IUVProviderConstructor {\n  new (workspaceRoot: string, logger: ILogger, tree?: Tree): IUVProvider;\n}\n\ninterface ILoggerConstructor {\n  new (): ILogger;\n}\n\ninterface MigrateToSharedVenvSchema {\n  moveDevDependencies: boolean;\n  pyprojectPythonDependency: string;\n  pyenvPythonVersion: string | number;\n  autoActivate: boolean;\n  packageManager: 'poetry' | 'uv';\n}\n\ninterface UVProjectGeneratorSchema {\n  name: string;\n  publishable: boolean;\n  buildLockedVersions: boolean;\n  buildBundleLocalDependencies: boolean;\n  linter: 'flake8' | 'ruff' | 'none';\n  devDependenciesProject?: string;\n  rootPyprojectDependencyGroup: string;\n  templateDir?: string;\n  pyprojectPythonDependency: string;\n  projectType: 'application' | 'library';\n  projectNameAndRootFormat: 'as-provided' | 'derived';\n  packageName?: string;\n  description?: string;\n  moduleName?: string;\n  pyenvPythonVersion?: string | number;\n  tags?: string;\n  directory?: string;\n  useSyncGenerators?: boolean;\n  unitTestRunner: 'pytest' | 'none';\n  codeCoverage: boolean;\n  codeCoverageHtmlReport: boolean;\n  codeCoverageXmlReport: boolean;\n  codeCoverageThreshold?: number;\n  unitTestHtmlReport: boolean;\n  unitTestJUnitReport: boolean;\n  buildSystem: 'hatch' | 'uv';\n  srcDir: boolean;\n}\n\n// ---------------------------------------------------------------------------\n// Runtime module loading via filesystem paths\n// ---------------------------------------------------------------------------\n\n// Resolve the @nxlv/python package root by finding its package.json\n// (which IS listed in the exports map as \"./package.json\")\nconst nxlvPythonPkgJson = require.resolve('@nxlv/python/package.json');\nconst nxlvPythonRoot = path.dirname(nxlvPythonPkgJson);\n\n// eslint-disable-next-line @typescript-eslint/no-require-imports\nconst uvProviderModule = require(\n  path.join(nxlvPythonRoot, 'dist/provider/uv/provider'),\n);\n// eslint-disable-next-line @typescript-eslint/no-require-imports\nconst loggerModule = require(\n  path.join(nxlvPythonRoot, 'dist/executors/utils/logger'),\n);\n// eslint-disable-next-line @typescript-eslint/no-require-imports\nconst migrateToSharedVenvModule = require(\n  path.join(nxlvPythonRoot, 'dist/generators/migrate-to-shared-venv/generator'),\n);\n// eslint-disable-next-line @typescript-eslint/no-require-imports\nconst uvProjectModule = require(\n  path.join(nxlvPythonRoot, 'dist/generators/uv-project/generator'),\n);\n\nexport const UVProvider: IUVProviderConstructor = uvProviderModule.UVProvider;\n\nexport const Logger: ILoggerConstructor = loggerModule.Logger;\n\nexport const migrateToSharedVenvGenerator: (\n  tree: Tree,\n  options: MigrateToSharedVenvSchema,\n) => Promise<() => Promise<void>> =\n  migrateToSharedVenvModule.default ?? migrateToSharedVenvModule;\n\nexport const uvProjectGenerator: (\n  tree: Tree,\n  options: UVProjectGeneratorSchema,\n) => Promise<() => Promise<void>> = uvProjectModule.default ?? uvProjectModule;\n"],"names":["createRequire","path","require","url","nxlvPythonPkgJson","resolve","nxlvPythonRoot","dirname","uvProviderModule","join","loggerModule","migrateToSharedVenvModule","uvProjectModule","UVProvider","Logger","migrateToSharedVenvGenerator","default","uvProjectGenerator"],"mappings":"AAAA;;;CAGC,GAED;;;;;;;;;;;;;;CAcC,GAED,SAASA,aAAa,QAAQ,SAAS;AACvC,OAAOC,UAAU,OAAO;AAExB,MAAMC,UAAUF,cAAc,YAAYG,GAAG;AAoH7C,8EAA8E;AAC9E,8CAA8C;AAC9C,8EAA8E;AAE9E,oEAAoE;AACpE,2DAA2D;AAC3D,MAAMC,oBAAoBF,QAAQG,OAAO,CAAC;AAC1C,MAAMC,iBAAiBL,KAAKM,OAAO,CAACH;AAEpC,iEAAiE;AACjE,MAAMI,mBAAmBN,QACvBD,KAAKQ,IAAI,CAACH,gBAAgB;AAE5B,iEAAiE;AACjE,MAAMI,eAAeR,QACnBD,KAAKQ,IAAI,CAACH,gBAAgB;AAE5B,iEAAiE;AACjE,MAAMK,4BAA4BT,QAChCD,KAAKQ,IAAI,CAACH,gBAAgB;AAE5B,iEAAiE;AACjE,MAAMM,kBAAkBV,QACtBD,KAAKQ,IAAI,CAACH,gBAAgB;AAG5B,OAAO,MAAMO,aAAqCL,iBAAiBK,UAAU,CAAC;AAE9E,OAAO,MAAMC,SAA6BJ,aAAaI,MAAM,CAAC;AAE9D,OAAO,MAAMC,+BAIXJ,0BAA0BK,OAAO,IAAIL,0BAA0B;AAEjE,OAAO,MAAMM,qBAGuBL,gBAAgBI,OAAO,IAAIJ,gBAAgB"}

package/src/utils/py.d.ts

@@ -5,6 +5,16 @@ import { type IPyDepVersion } from './versions.js';
  * Add dependencies to a pyproject.toml file
  */
 export declare const addDependenciesToPyProjectToml: <const D extends DependencyDeclaration>(tree: Tree, projectRoot: string, declaration: D, deps: readonly DeclaredPy<D>[]) => void;
+/**
+ * Add the `PY_UV_OVERRIDES` entries for the packages named in `requirements`
+ * to the workspace root `[tool.uv] override-dependencies`, which is the only
+ * place uv reads overrides from.
+ *
+ * Existing entries keep their order, and a package the list already overrides
+ * is left as the user wrote it. The root file is written only when an entry is
+ * added. Returns whether it was.
+ */
+export declare const addUvOverrideDependencies: (tree: Tree, requirements: readonly string[]) => boolean;
 export declare const addDependenciesToDependencyGroupInPyProjectToml: <const D extends DependencyDeclaration>(tree: Tree, projectRoot: string, group: string, declaration: D, deps: readonly DeclaredPy<D>[]) => void;
 export interface UvxWithDep {
     dep: string;

package/src/utils/py.js

@@ -5,8 +5,8 @@
 import { joinPathFragments } from "@nx/devkit";
 import { parsePipRequirementsLine } from "pip-requirements-js";
 import { normalizeDistributionName } from "./names.js";
-import { readToml, updateToml } from "./toml.js";
-import { PY_VERSIONS, withPyVersions } from "./versions.js";
+import { readToml, tryReadToml, updateToml } from "./toml.js";
+import { PY_UV_OVERRIDES, PY_VERSIONS, withPyVersions } from "./versions.js";
 // Dedup key that distinguishes bare packages from the same package with
 // extras (e.g. `foo` vs `foo[bar]`), so adding a bare dep doesn't drop a
 // previously-added variant with extras.
@@ -43,6 +43,63 @@ const mergeDeps = (declaration, existing, deps)=>{
     const projectToml = parse(tree.read(joinPathFragments(projectRoot, 'pyproject.toml'), 'utf8'));
     projectToml.project.dependencies = mergeDeps(declaration, projectToml.project?.dependencies, deps);
     tree.write(joinPathFragments(projectRoot, 'pyproject.toml'), stringify(projectToml));
+    addUvOverrideDependencies(tree, projectToml.project.dependencies);
+};
+// PEP 503 name of a requirement, or undefined for one that names no package or
+// cannot be parsed.
+const requirementName = (requirement)=>{
+    if (typeof requirement !== 'string') {
+        return undefined;
+    }
+    try {
+        const parsed = parsePipRequirementsLine(requirement);
+        return parsed?.type === 'ProjectName' || parsed?.type === 'ProjectURL' ? normalizeDistributionName(parsed.name) : undefined;
+    } catch  {
+        return undefined;
+    }
+};
+/**
+ * Add the `PY_UV_OVERRIDES` entries for the packages named in `requirements`
+ * to the workspace root `[tool.uv] override-dependencies`, which is the only
+ * place uv reads overrides from.
+ *
+ * Existing entries keep their order, and a package the list already overrides
+ * is left as the user wrote it. The root file is written only when an entry is
+ * added. Returns whether it was.
+ */ export const addUvOverrideDependencies = (tree, requirements)=>{
+    const rootPyprojectPath = 'pyproject.toml';
+    const toml = tryReadToml(tree, rootPyprojectPath);
+    if (!toml) {
+        return false;
+    }
+    const names = new Set(requirements.map(requirementName));
+    const overrides = Object.entries(PY_UV_OVERRIDES).flatMap(([dependency, entries])=>names.has(normalizeDistributionName(dependency)) ? entries : []);
+    if (overrides.length === 0) {
+        return false;
+    }
+    const existing = toml.tool?.uv?.['override-dependencies'];
+    if (existing !== undefined && !Array.isArray(existing)) {
+        return false;
+    }
+    const merged = [
+        ...existing ?? []
+    ];
+    const overridden = new Set(merged.map(requirementName));
+    for (const entry of overrides){
+        const name = requirementName(entry);
+        if (!overridden.has(name)) {
+            merged.push(entry);
+            overridden.add(name);
+        }
+    }
+    if (merged.length === (existing ?? []).length) {
+        return false;
+    }
+    toml.tool ??= {};
+    toml.tool.uv ??= {};
+    toml.tool.uv['override-dependencies'] = merged;
+    tree.write(rootPyprojectPath, stringify(toml));
+    return true;
 };
 export const addDependenciesToDependencyGroupInPyProjectToml = (tree, projectRoot, group, declaration, deps)=>{
     const projectToml = parse(tree.read(joinPathFragments(projectRoot, 'pyproject.toml'), 'utf8'));

package/src/utils/py.js.map

@@ -1 +1 @@
-{"version":3,"sources":["../../../../../packages/nx-plugin/src/utils/py.ts"],"sourcesContent":["/**\n * Copyright Amazon.com, Inc. or its affiliates. All Rights Reserved.\n * SPDX-License-Identifier: Apache-2.0\n */\nimport { parse, stringify } from '@iarna/toml';\nimport { joinPathFragments, type Tree } from '@nx/devkit';\nimport { parsePipRequirementsLine } from 'pip-requirements-js';\nimport type {\n  DeclaredPy,\n  DependencyDeclaration,\n} from './declared-dependencies.js';\nimport { normalizeDistributionName } from './names.js';\nimport type { UVPyprojectToml } from './nxlv-python.js';\nimport { readToml, updateToml } from './toml.js';\nimport { type IPyDepVersion, PY_VERSIONS, withPyVersions } from './versions.js';\n\n// Dedup key that distinguishes bare packages from the same package with\n// extras (e.g. `foo` vs `foo[bar]`), so adding a bare dep doesn't drop a\n// previously-added variant with extras.\nconst depKey = (dep: string): string => {\n  const parsed = parsePipRequirementsLine(dep);\n  if (parsed?.type !== 'ProjectName') {\n    return dep;\n  }\n  const extras = [...(parsed.extras ?? [])].sort().join(',');\n  return extras ? `${parsed.name}[${extras}]` : parsed.name;\n};\n\nconst mergeDeps = (\n  declaration: DependencyDeclaration,\n  existing: readonly string[] | undefined,\n  deps: readonly IPyDepVersion[],\n): string[] => {\n  // Update deps in place by key so re-running does not reorder the list:\n  // existing deps keep their position (with their version refreshed), and only\n  // genuinely-new deps are appended.\n  const incoming = new Map(\n    withPyVersions(declaration, deps).map((d) => [depKey(d), d]),\n  );\n  const merged = (existing ?? []).map(\n    (dep) => incoming.get(depKey(dep)) ?? dep,\n  );\n  const existingKeys = new Set((existing ?? []).map(depKey));\n  for (const [key, dep] of incoming) {\n    if (!existingKeys.has(key)) {\n      merged.push(dep);\n    }\n  }\n  return merged;\n};\n\n/**\n * Add dependencies to a pyproject.toml file\n */\nexport const addDependenciesToPyProjectToml = <\n  const D extends DependencyDeclaration,\n>(\n  tree: Tree,\n  projectRoot: string,\n  declaration: D,\n  deps: readonly DeclaredPy<D>[],\n) => {\n  const projectToml = parse(\n    tree.read(joinPathFragments(projectRoot, 'pyproject.toml'), 'utf8'),\n  ) as UVPyprojectToml;\n  projectToml.project.dependencies = mergeDeps(\n    declaration,\n    projectToml.project?.dependencies,\n    deps,\n  );\n  tree.write(\n    joinPathFragments(projectRoot, 'pyproject.toml'),\n    stringify(projectToml),\n  );\n};\n\nexport const addDependenciesToDependencyGroupInPyProjectToml = <\n  const D extends DependencyDeclaration,\n>(\n  tree: Tree,\n  projectRoot: string,\n  group: string,\n  declaration: D,\n  deps: readonly DeclaredPy<D>[],\n) => {\n  const projectToml = parse(\n    tree.read(joinPathFragments(projectRoot, 'pyproject.toml'), 'utf8'),\n  ) as UVPyprojectToml;\n  projectToml['dependency-groups'] = {\n    ...projectToml['dependency-groups'],\n    [group]: mergeDeps(\n      declaration,\n      projectToml['dependency-groups']?.[group],\n      deps,\n    ),\n  };\n  tree.write(\n    joinPathFragments(projectRoot, 'pyproject.toml'),\n    stringify(projectToml),\n  );\n};\n\nexport interface UvxWithDep {\n  dep: string;\n  version: string;\n  specifier?: string;\n}\n\n/**\n * Render a uvx command for a given dependency\n * Pins the version to the one specified in versions.ts\n * Optionally specify withDeps to render uvx --with dep==version\n */\nexport const uvxCommand = (\n  dep: IPyDepVersion,\n  args?: string,\n  withDeps?: UvxWithDep[],\n): string => {\n  // Pins the tool for a one-off invocation; nothing is added to a manifest, so\n  // this needs no declaration.\n  return `uvx --from ${dep}${PY_VERSIONS[dep]} ${\n    withDeps\n      ? `${withDeps\n          .map(\n            ({ dep, version, specifier }) =>\n              `--with ${dep}${specifier ?? '=='}${version}`,\n          )\n          .join(' ')} `\n      : ''\n  }${dep}${args ? ` ${args}` : ''}`;\n};\n\n/**\n * Resolve the PEP 503 distribution name of a Python project from its\n * `pyproject.toml` `[project].name`, falling back to normalising the supplied\n * Nx project id when the project has no readable pyproject yet.\n *\n * This is the authoritative name uv writes into `uv.lock`, so it is the value\n * that must appear in a dependent's `[project].dependencies` /\n * `[tool.uv.sources]` for `@nxlv/python` to infer the workspace dependency\n * edge. Always normalised so the result is a valid distribution name even if\n * an older project still carries a dotted `[project].name`.\n */\nconst getPyDistributionName = (\n  tree: Tree,\n  project: { name?: string; root: string },\n): string => {\n  const pyprojectPath = joinPathFragments(project.root, 'pyproject.toml');\n  const projectName = tree.exists(pyprojectPath)\n    ? (readToml(tree, pyprojectPath) as unknown as UVPyprojectToml).project\n        ?.name\n    : undefined;\n  return normalizeDistributionName(projectName ?? project.name ?? '');\n};\n\n/**\n * Add a workspace dependency from one Python project to another.\n * Adds the dependency to [project].dependencies and [tool.uv.sources].\n *\n * Both projects are passed as Nx project configurations (not names): the\n * dependency's PEP 503 distribution name is derived from its own\n * `pyproject.toml` here, so callers cannot accidentally pass the dotted Nx id\n * (which @nxlv/python splits on `.` and drops, losing the project-graph edge).\n * This is the single entry point all generators use to wire a Python workspace\n * dependency.\n */\nexport const addWorkspaceDependencyToPyProject = (\n  tree: Tree,\n  dependentProject: { name?: string; root: string },\n  dependencyProject: { name?: string; root: string },\n): void => {\n  const pyprojectPath = joinPathFragments(\n    dependentProject.root,\n    'pyproject.toml',\n  );\n  if (!tree.exists(pyprojectPath)) {\n    return;\n  }\n\n  const distributionName = getPyDistributionName(tree, dependencyProject);\n\n  updateToml(tree, pyprojectPath, (toml: UVPyprojectToml) => {\n    // Add to [project].dependencies if not already present\n    const deps = toml.project?.dependencies ?? [];\n    if (\n      !deps.some(\n        (d) =>\n          d === distributionName ||\n          d.startsWith(`${distributionName}>=`) ||\n          d.startsWith(`${distributionName}==`),\n      )\n    ) {\n      toml.project.dependencies = [...deps, distributionName];\n    }\n\n    // Add to [tool.uv.sources] with workspace = true\n    toml.tool = toml.tool ?? {};\n    (toml.tool as any).uv = (toml.tool as any).uv ?? {};\n    (toml.tool as any).uv.sources = (toml.tool as any).uv.sources ?? {};\n    (toml.tool as any).uv.sources[distributionName] = {\n      workspace: true,\n    };\n\n    return toml;\n  });\n};\n"],"names":["parse","stringify","joinPathFragments","parsePipRequirementsLine","normalizeDistributionName","readToml","updateToml","PY_VERSIONS","withPyVersions","depKey","dep","parsed","type","extras","sort","join","name","mergeDeps","declaration","existing","deps","incoming","Map","map","d","merged","get","existingKeys","Set","key","has","push","addDependenciesToPyProjectToml","tree","projectRoot","projectToml","read","project","dependencies","write","addDependenciesToDependencyGroupInPyProjectToml","group","uvxCommand","args","withDeps","version","specifier","getPyDistributionName","pyprojectPath","root","projectName","exists","undefined","addWorkspaceDependencyToPyProject","dependentProject","dependencyProject","distributionName","toml","some","startsWith","tool","uv","sources","workspace"],"mappings":"AAAA;;;CAGC,GACD,SAASA,KAAK,EAAEC,SAAS,QAAQ,cAAc;AAC/C,SAASC,iBAAiB,QAAmB,aAAa;AAC1D,SAASC,wBAAwB,QAAQ,sBAAsB;AAK/D,SAASC,yBAAyB,QAAQ,aAAa;AAEvD,SAASC,QAAQ,EAAEC,UAAU,QAAQ,YAAY;AACjD,SAA6BC,WAAW,EAAEC,cAAc,QAAQ,gBAAgB;AAEhF,wEAAwE;AACxE,yEAAyE;AACzE,wCAAwC;AACxC,MAAMC,SAAS,CAACC;IACd,MAAMC,SAASR,yBAAyBO;IACxC,IAAIC,QAAQC,SAAS,eAAe;QAClC,OAAOF;IACT;IACA,MAAMG,SAAS;WAAKF,OAAOE,MAAM,IAAI,EAAE;KAAE,CAACC,IAAI,GAAGC,IAAI,CAAC;IACtD,OAAOF,SAAS,GAAGF,OAAOK,IAAI,CAAC,CAAC,EAAEH,OAAO,CAAC,CAAC,GAAGF,OAAOK,IAAI;AAC3D;AAEA,MAAMC,YAAY,CAChBC,aACAC,UACAC;IAEA,uEAAuE;IACvE,6EAA6E;IAC7E,mCAAmC;IACnC,MAAMC,WAAW,IAAIC,IACnBd,eAAeU,aAAaE,MAAMG,GAAG,CAAC,CAACC,IAAM;YAACf,OAAOe;YAAIA;SAAE;IAE7D,MAAMC,SAAS,AAACN,CAAAA,YAAY,EAAE,AAAD,EAAGI,GAAG,CACjC,CAACb,MAAQW,SAASK,GAAG,CAACjB,OAAOC,SAASA;IAExC,MAAMiB,eAAe,IAAIC,IAAI,AAACT,CAAAA,YAAY,EAAE,AAAD,EAAGI,GAAG,CAACd;IAClD,KAAK,MAAM,CAACoB,KAAKnB,IAAI,IAAIW,SAAU;QACjC,IAAI,CAACM,aAAaG,GAAG,CAACD,MAAM;YAC1BJ,OAAOM,IAAI,CAACrB;QACd;IACF;IACA,OAAOe;AACT;AAEA;;CAEC,GACD,OAAO,MAAMO,iCAAiC,CAG5CC,MACAC,aACAhB,aACAE;IAEA,MAAMe,cAAcnC,MAClBiC,KAAKG,IAAI,CAAClC,kBAAkBgC,aAAa,mBAAmB;IAE9DC,YAAYE,OAAO,CAACC,YAAY,GAAGrB,UACjCC,aACAiB,YAAYE,OAAO,EAAEC,cACrBlB;IAEFa,KAAKM,KAAK,CACRrC,kBAAkBgC,aAAa,mBAC/BjC,UAAUkC;AAEd,EAAE;AAEF,OAAO,MAAMK,kDAAkD,CAG7DP,MACAC,aACAO,OACAvB,aACAE;IAEA,MAAMe,cAAcnC,MAClBiC,KAAKG,IAAI,CAAClC,kBAAkBgC,aAAa,mBAAmB;IAE9DC,WAAW,CAAC,oBAAoB,GAAG;QACjC,GAAGA,WAAW,CAAC,oBAAoB;QACnC,CAACM,MAAM,EAAExB,UACPC,aACAiB,WAAW,CAAC,oBAAoB,EAAE,CAACM,MAAM,EACzCrB;IAEJ;IACAa,KAAKM,KAAK,CACRrC,kBAAkBgC,aAAa,mBAC/BjC,UAAUkC;AAEd,EAAE;AAQF;;;;CAIC,GACD,OAAO,MAAMO,aAAa,CACxBhC,KACAiC,MACAC;IAEA,6EAA6E;IAC7E,6BAA6B;IAC7B,OAAO,CAAC,WAAW,EAAElC,MAAMH,WAAW,CAACG,IAAI,CAAC,CAAC,EAC3CkC,WACI,GAAGA,SACArB,GAAG,CACF,CAAC,EAAEb,GAAG,EAAEmC,OAAO,EAAEC,SAAS,EAAE,GAC1B,CAAC,OAAO,EAAEpC,MAAMoC,aAAa,OAAOD,SAAS,EAEhD9B,IAAI,CAAC,KAAK,CAAC,CAAC,GACf,KACHL,MAAMiC,OAAO,CAAC,CAAC,EAAEA,MAAM,GAAG,IAAI;AACnC,EAAE;AAEF;;;;;;;;;;CAUC,GACD,MAAMI,wBAAwB,CAC5Bd,MACAI;IAEA,MAAMW,gBAAgB9C,kBAAkBmC,QAAQY,IAAI,EAAE;IACtD,MAAMC,cAAcjB,KAAKkB,MAAM,CAACH,iBAC5B,AAAC3C,SAAS4B,MAAMe,eAA8CX,OAAO,EACjErB,OACJoC;IACJ,OAAOhD,0BAA0B8C,eAAeb,QAAQrB,IAAI,IAAI;AAClE;AAEA;;;;;;;;;;CAUC,GACD,OAAO,MAAMqC,oCAAoC,CAC/CpB,MACAqB,kBACAC;IAEA,MAAMP,gBAAgB9C,kBACpBoD,iBAAiBL,IAAI,EACrB;IAEF,IAAI,CAAChB,KAAKkB,MAAM,CAACH,gBAAgB;QAC/B;IACF;IAEA,MAAMQ,mBAAmBT,sBAAsBd,MAAMsB;IAErDjD,WAAW2B,MAAMe,eAAe,CAACS;QAC/B,uDAAuD;QACvD,MAAMrC,OAAOqC,KAAKpB,OAAO,EAAEC,gBAAgB,EAAE;QAC7C,IACE,CAAClB,KAAKsC,IAAI,CACR,CAAClC,IACCA,MAAMgC,oBACNhC,EAAEmC,UAAU,CAAC,GAAGH,iBAAiB,EAAE,CAAC,KACpChC,EAAEmC,UAAU,CAAC,GAAGH,iBAAiB,EAAE,CAAC,IAExC;YACAC,KAAKpB,OAAO,CAACC,YAAY,GAAG;mBAAIlB;gBAAMoC;aAAiB;QACzD;QAEA,iDAAiD;QACjDC,KAAKG,IAAI,GAAGH,KAAKG,IAAI,IAAI,CAAC;QACzBH,KAAKG,IAAI,CAASC,EAAE,GAAG,AAACJ,KAAKG,IAAI,CAASC,EAAE,IAAI,CAAC;QACjDJ,KAAKG,IAAI,CAASC,EAAE,CAACC,OAAO,GAAG,AAACL,KAAKG,IAAI,CAASC,EAAE,CAACC,OAAO,IAAI,CAAC;QACjEL,KAAKG,IAAI,CAASC,EAAE,CAACC,OAAO,CAACN,iBAAiB,GAAG;YAChDO,WAAW;QACb;QAEA,OAAON;IACT;AACF,EAAE"}
+{"version":3,"sources":["../../../../../packages/nx-plugin/src/utils/py.ts"],"sourcesContent":["/**\n * Copyright Amazon.com, Inc. or its affiliates. All Rights Reserved.\n * SPDX-License-Identifier: Apache-2.0\n */\nimport { type JsonMap, parse, stringify } from '@iarna/toml';\nimport { joinPathFragments, type Tree } from '@nx/devkit';\nimport { parsePipRequirementsLine } from 'pip-requirements-js';\nimport type {\n  DeclaredPy,\n  DependencyDeclaration,\n} from './declared-dependencies.js';\nimport { normalizeDistributionName } from './names.js';\nimport type { UVPyprojectToml } from './nxlv-python.js';\nimport { readToml, tryReadToml, updateToml } from './toml.js';\nimport {\n  type IPyDepVersion,\n  PY_UV_OVERRIDES,\n  PY_VERSIONS,\n  withPyVersions,\n} from './versions.js';\n\n// Dedup key that distinguishes bare packages from the same package with\n// extras (e.g. `foo` vs `foo[bar]`), so adding a bare dep doesn't drop a\n// previously-added variant with extras.\nconst depKey = (dep: string): string => {\n  const parsed = parsePipRequirementsLine(dep);\n  if (parsed?.type !== 'ProjectName') {\n    return dep;\n  }\n  const extras = [...(parsed.extras ?? [])].sort().join(',');\n  return extras ? `${parsed.name}[${extras}]` : parsed.name;\n};\n\nconst mergeDeps = (\n  declaration: DependencyDeclaration,\n  existing: readonly string[] | undefined,\n  deps: readonly IPyDepVersion[],\n): string[] => {\n  // Update deps in place by key so re-running does not reorder the list:\n  // existing deps keep their position (with their version refreshed), and only\n  // genuinely-new deps are appended.\n  const incoming = new Map(\n    withPyVersions(declaration, deps).map((d) => [depKey(d), d]),\n  );\n  const merged = (existing ?? []).map(\n    (dep) => incoming.get(depKey(dep)) ?? dep,\n  );\n  const existingKeys = new Set((existing ?? []).map(depKey));\n  for (const [key, dep] of incoming) {\n    if (!existingKeys.has(key)) {\n      merged.push(dep);\n    }\n  }\n  return merged;\n};\n\n/**\n * Add dependencies to a pyproject.toml file\n */\nexport const addDependenciesToPyProjectToml = <\n  const D extends DependencyDeclaration,\n>(\n  tree: Tree,\n  projectRoot: string,\n  declaration: D,\n  deps: readonly DeclaredPy<D>[],\n) => {\n  const projectToml = parse(\n    tree.read(joinPathFragments(projectRoot, 'pyproject.toml'), 'utf8'),\n  ) as UVPyprojectToml;\n  projectToml.project.dependencies = mergeDeps(\n    declaration,\n    projectToml.project?.dependencies,\n    deps,\n  );\n  tree.write(\n    joinPathFragments(projectRoot, 'pyproject.toml'),\n    stringify(projectToml),\n  );\n  addUvOverrideDependencies(tree, projectToml.project.dependencies);\n};\n\n// PEP 503 name of a requirement, or undefined for one that names no package or\n// cannot be parsed.\nconst requirementName = (requirement: unknown): string | undefined => {\n  if (typeof requirement !== 'string') {\n    return undefined;\n  }\n  try {\n    const parsed = parsePipRequirementsLine(requirement);\n    return parsed?.type === 'ProjectName' || parsed?.type === 'ProjectURL'\n      ? normalizeDistributionName(parsed.name)\n      : undefined;\n  } catch {\n    return undefined;\n  }\n};\n\n/**\n * Add the `PY_UV_OVERRIDES` entries for the packages named in `requirements`\n * to the workspace root `[tool.uv] override-dependencies`, which is the only\n * place uv reads overrides from.\n *\n * Existing entries keep their order, and a package the list already overrides\n * is left as the user wrote it. The root file is written only when an entry is\n * added. Returns whether it was.\n */\nexport const addUvOverrideDependencies = (\n  tree: Tree,\n  requirements: readonly string[],\n): boolean => {\n  const rootPyprojectPath = 'pyproject.toml';\n  const toml = tryReadToml(tree, rootPyprojectPath) as\n    | UVPyprojectToml\n    | undefined;\n  if (!toml) {\n    return false;\n  }\n  const names = new Set(requirements.map(requirementName));\n  const overrides = Object.entries(PY_UV_OVERRIDES).flatMap(\n    ([dependency, entries]) =>\n      names.has(normalizeDistributionName(dependency)) ? entries : [],\n  );\n  if (overrides.length === 0) {\n    return false;\n  }\n\n  const existing = toml.tool?.uv?.['override-dependencies'];\n  if (existing !== undefined && !Array.isArray(existing)) {\n    return false;\n  }\n  const merged = [...(existing ?? [])];\n  const overridden = new Set(merged.map(requirementName));\n  for (const entry of overrides) {\n    const name = requirementName(entry);\n    if (!overridden.has(name)) {\n      merged.push(entry);\n      overridden.add(name);\n    }\n  }\n  if (merged.length === (existing ?? []).length) {\n    return false;\n  }\n\n  toml.tool ??= {};\n  toml.tool.uv ??= {};\n  toml.tool.uv['override-dependencies'] = merged;\n  tree.write(rootPyprojectPath, stringify(toml as JsonMap));\n  return true;\n};\n\nexport const addDependenciesToDependencyGroupInPyProjectToml = <\n  const D extends DependencyDeclaration,\n>(\n  tree: Tree,\n  projectRoot: string,\n  group: string,\n  declaration: D,\n  deps: readonly DeclaredPy<D>[],\n) => {\n  const projectToml = parse(\n    tree.read(joinPathFragments(projectRoot, 'pyproject.toml'), 'utf8'),\n  ) as UVPyprojectToml;\n  projectToml['dependency-groups'] = {\n    ...projectToml['dependency-groups'],\n    [group]: mergeDeps(\n      declaration,\n      projectToml['dependency-groups']?.[group],\n      deps,\n    ),\n  };\n  tree.write(\n    joinPathFragments(projectRoot, 'pyproject.toml'),\n    stringify(projectToml),\n  );\n};\n\nexport interface UvxWithDep {\n  dep: string;\n  version: string;\n  specifier?: string;\n}\n\n/**\n * Render a uvx command for a given dependency\n * Pins the version to the one specified in versions.ts\n * Optionally specify withDeps to render uvx --with dep==version\n */\nexport const uvxCommand = (\n  dep: IPyDepVersion,\n  args?: string,\n  withDeps?: UvxWithDep[],\n): string => {\n  // Pins the tool for a one-off invocation; nothing is added to a manifest, so\n  // this needs no declaration.\n  return `uvx --from ${dep}${PY_VERSIONS[dep]} ${\n    withDeps\n      ? `${withDeps\n          .map(\n            ({ dep, version, specifier }) =>\n              `--with ${dep}${specifier ?? '=='}${version}`,\n          )\n          .join(' ')} `\n      : ''\n  }${dep}${args ? ` ${args}` : ''}`;\n};\n\n/**\n * Resolve the PEP 503 distribution name of a Python project from its\n * `pyproject.toml` `[project].name`, falling back to normalising the supplied\n * Nx project id when the project has no readable pyproject yet.\n *\n * This is the authoritative name uv writes into `uv.lock`, so it is the value\n * that must appear in a dependent's `[project].dependencies` /\n * `[tool.uv.sources]` for `@nxlv/python` to infer the workspace dependency\n * edge. Always normalised so the result is a valid distribution name even if\n * an older project still carries a dotted `[project].name`.\n */\nconst getPyDistributionName = (\n  tree: Tree,\n  project: { name?: string; root: string },\n): string => {\n  const pyprojectPath = joinPathFragments(project.root, 'pyproject.toml');\n  const projectName = tree.exists(pyprojectPath)\n    ? (readToml(tree, pyprojectPath) as unknown as UVPyprojectToml).project\n        ?.name\n    : undefined;\n  return normalizeDistributionName(projectName ?? project.name ?? '');\n};\n\n/**\n * Add a workspace dependency from one Python project to another.\n * Adds the dependency to [project].dependencies and [tool.uv.sources].\n *\n * Both projects are passed as Nx project configurations (not names): the\n * dependency's PEP 503 distribution name is derived from its own\n * `pyproject.toml` here, so callers cannot accidentally pass the dotted Nx id\n * (which @nxlv/python splits on `.` and drops, losing the project-graph edge).\n * This is the single entry point all generators use to wire a Python workspace\n * dependency.\n */\nexport const addWorkspaceDependencyToPyProject = (\n  tree: Tree,\n  dependentProject: { name?: string; root: string },\n  dependencyProject: { name?: string; root: string },\n): void => {\n  const pyprojectPath = joinPathFragments(\n    dependentProject.root,\n    'pyproject.toml',\n  );\n  if (!tree.exists(pyprojectPath)) {\n    return;\n  }\n\n  const distributionName = getPyDistributionName(tree, dependencyProject);\n\n  updateToml(tree, pyprojectPath, (toml: UVPyprojectToml) => {\n    // Add to [project].dependencies if not already present\n    const deps = toml.project?.dependencies ?? [];\n    if (\n      !deps.some(\n        (d) =>\n          d === distributionName ||\n          d.startsWith(`${distributionName}>=`) ||\n          d.startsWith(`${distributionName}==`),\n      )\n    ) {\n      toml.project.dependencies = [...deps, distributionName];\n    }\n\n    // Add to [tool.uv.sources] with workspace = true\n    toml.tool = toml.tool ?? {};\n    (toml.tool as any).uv = (toml.tool as any).uv ?? {};\n    (toml.tool as any).uv.sources = (toml.tool as any).uv.sources ?? {};\n    (toml.tool as any).uv.sources[distributionName] = {\n      workspace: true,\n    };\n\n    return toml;\n  });\n};\n"],"names":["parse","stringify","joinPathFragments","parsePipRequirementsLine","normalizeDistributionName","readToml","tryReadToml","updateToml","PY_UV_OVERRIDES","PY_VERSIONS","withPyVersions","depKey","dep","parsed","type","extras","sort","join","name","mergeDeps","declaration","existing","deps","incoming","Map","map","d","merged","get","existingKeys","Set","key","has","push","addDependenciesToPyProjectToml","tree","projectRoot","projectToml","read","project","dependencies","write","addUvOverrideDependencies","requirementName","requirement","undefined","requirements","rootPyprojectPath","toml","names","overrides","Object","entries","flatMap","dependency","length","tool","uv","Array","isArray","overridden","entry","add","addDependenciesToDependencyGroupInPyProjectToml","group","uvxCommand","args","withDeps","version","specifier","getPyDistributionName","pyprojectPath","root","projectName","exists","addWorkspaceDependencyToPyProject","dependentProject","dependencyProject","distributionName","some","startsWith","sources","workspace"],"mappings":"AAAA;;;CAGC,GACD,SAAuBA,KAAK,EAAEC,SAAS,QAAQ,cAAc;AAC7D,SAASC,iBAAiB,QAAmB,aAAa;AAC1D,SAASC,wBAAwB,QAAQ,sBAAsB;AAK/D,SAASC,yBAAyB,QAAQ,aAAa;AAEvD,SAASC,QAAQ,EAAEC,WAAW,EAAEC,UAAU,QAAQ,YAAY;AAC9D,SAEEC,eAAe,EACfC,WAAW,EACXC,cAAc,QACT,gBAAgB;AAEvB,wEAAwE;AACxE,yEAAyE;AACzE,wCAAwC;AACxC,MAAMC,SAAS,CAACC;IACd,MAAMC,SAASV,yBAAyBS;IACxC,IAAIC,QAAQC,SAAS,eAAe;QAClC,OAAOF;IACT;IACA,MAAMG,SAAS;WAAKF,OAAOE,MAAM,IAAI,EAAE;KAAE,CAACC,IAAI,GAAGC,IAAI,CAAC;IACtD,OAAOF,SAAS,GAAGF,OAAOK,IAAI,CAAC,CAAC,EAAEH,OAAO,CAAC,CAAC,GAAGF,OAAOK,IAAI;AAC3D;AAEA,MAAMC,YAAY,CAChBC,aACAC,UACAC;IAEA,uEAAuE;IACvE,6EAA6E;IAC7E,mCAAmC;IACnC,MAAMC,WAAW,IAAIC,IACnBd,eAAeU,aAAaE,MAAMG,GAAG,CAAC,CAACC,IAAM;YAACf,OAAOe;YAAIA;SAAE;IAE7D,MAAMC,SAAS,AAACN,CAAAA,YAAY,EAAE,AAAD,EAAGI,GAAG,CACjC,CAACb,MAAQW,SAASK,GAAG,CAACjB,OAAOC,SAASA;IAExC,MAAMiB,eAAe,IAAIC,IAAI,AAACT,CAAAA,YAAY,EAAE,AAAD,EAAGI,GAAG,CAACd;IAClD,KAAK,MAAM,CAACoB,KAAKnB,IAAI,IAAIW,SAAU;QACjC,IAAI,CAACM,aAAaG,GAAG,CAACD,MAAM;YAC1BJ,OAAOM,IAAI,CAACrB;QACd;IACF;IACA,OAAOe;AACT;AAEA;;CAEC,GACD,OAAO,MAAMO,iCAAiC,CAG5CC,MACAC,aACAhB,aACAE;IAEA,MAAMe,cAAcrC,MAClBmC,KAAKG,IAAI,CAACpC,kBAAkBkC,aAAa,mBAAmB;IAE9DC,YAAYE,OAAO,CAACC,YAAY,GAAGrB,UACjCC,aACAiB,YAAYE,OAAO,EAAEC,cACrBlB;IAEFa,KAAKM,KAAK,CACRvC,kBAAkBkC,aAAa,mBAC/BnC,UAAUoC;IAEZK,0BAA0BP,MAAME,YAAYE,OAAO,CAACC,YAAY;AAClE,EAAE;AAEF,+EAA+E;AAC/E,oBAAoB;AACpB,MAAMG,kBAAkB,CAACC;IACvB,IAAI,OAAOA,gBAAgB,UAAU;QACnC,OAAOC;IACT;IACA,IAAI;QACF,MAAMhC,SAASV,yBAAyByC;QACxC,OAAO/B,QAAQC,SAAS,iBAAiBD,QAAQC,SAAS,eACtDV,0BAA0BS,OAAOK,IAAI,IACrC2B;IACN,EAAE,OAAM;QACN,OAAOA;IACT;AACF;AAEA;;;;;;;;CAQC,GACD,OAAO,MAAMH,4BAA4B,CACvCP,MACAW;IAEA,MAAMC,oBAAoB;IAC1B,MAAMC,OAAO1C,YAAY6B,MAAMY;IAG/B,IAAI,CAACC,MAAM;QACT,OAAO;IACT;IACA,MAAMC,QAAQ,IAAInB,IAAIgB,aAAarB,GAAG,CAACkB;IACvC,MAAMO,YAAYC,OAAOC,OAAO,CAAC5C,iBAAiB6C,OAAO,CACvD,CAAC,CAACC,YAAYF,QAAQ,GACpBH,MAAMjB,GAAG,CAAC5B,0BAA0BkD,eAAeF,UAAU,EAAE;IAEnE,IAAIF,UAAUK,MAAM,KAAK,GAAG;QAC1B,OAAO;IACT;IAEA,MAAMlC,WAAW2B,KAAKQ,IAAI,EAAEC,IAAI,CAAC,wBAAwB;IACzD,IAAIpC,aAAawB,aAAa,CAACa,MAAMC,OAAO,CAACtC,WAAW;QACtD,OAAO;IACT;IACA,MAAMM,SAAS;WAAKN,YAAY,EAAE;KAAE;IACpC,MAAMuC,aAAa,IAAI9B,IAAIH,OAAOF,GAAG,CAACkB;IACtC,KAAK,MAAMkB,SAASX,UAAW;QAC7B,MAAMhC,OAAOyB,gBAAgBkB;QAC7B,IAAI,CAACD,WAAW5B,GAAG,CAACd,OAAO;YACzBS,OAAOM,IAAI,CAAC4B;YACZD,WAAWE,GAAG,CAAC5C;QACjB;IACF;IACA,IAAIS,OAAO4B,MAAM,KAAK,AAAClC,CAAAA,YAAY,EAAE,AAAD,EAAGkC,MAAM,EAAE;QAC7C,OAAO;IACT;IAEAP,KAAKQ,IAAI,KAAK,CAAC;IACfR,KAAKQ,IAAI,CAACC,EAAE,KAAK,CAAC;IAClBT,KAAKQ,IAAI,CAACC,EAAE,CAAC,wBAAwB,GAAG9B;IACxCQ,KAAKM,KAAK,CAACM,mBAAmB9C,UAAU+C;IACxC,OAAO;AACT,EAAE;AAEF,OAAO,MAAMe,kDAAkD,CAG7D5B,MACAC,aACA4B,OACA5C,aACAE;IAEA,MAAMe,cAAcrC,MAClBmC,KAAKG,IAAI,CAACpC,kBAAkBkC,aAAa,mBAAmB;IAE9DC,WAAW,CAAC,oBAAoB,GAAG;QACjC,GAAGA,WAAW,CAAC,oBAAoB;QACnC,CAAC2B,MAAM,EAAE7C,UACPC,aACAiB,WAAW,CAAC,oBAAoB,EAAE,CAAC2B,MAAM,EACzC1C;IAEJ;IACAa,KAAKM,KAAK,CACRvC,kBAAkBkC,aAAa,mBAC/BnC,UAAUoC;AAEd,EAAE;AAQF;;;;CAIC,GACD,OAAO,MAAM4B,aAAa,CACxBrD,KACAsD,MACAC;IAEA,6EAA6E;IAC7E,6BAA6B;IAC7B,OAAO,CAAC,WAAW,EAAEvD,MAAMH,WAAW,CAACG,IAAI,CAAC,CAAC,EAC3CuD,WACI,GAAGA,SACA1C,GAAG,CACF,CAAC,EAAEb,GAAG,EAAEwD,OAAO,EAAEC,SAAS,EAAE,GAC1B,CAAC,OAAO,EAAEzD,MAAMyD,aAAa,OAAOD,SAAS,EAEhDnD,IAAI,CAAC,KAAK,CAAC,CAAC,GACf,KACHL,MAAMsD,OAAO,CAAC,CAAC,EAAEA,MAAM,GAAG,IAAI;AACnC,EAAE;AAEF;;;;;;;;;;CAUC,GACD,MAAMI,wBAAwB,CAC5BnC,MACAI;IAEA,MAAMgC,gBAAgBrE,kBAAkBqC,QAAQiC,IAAI,EAAE;IACtD,MAAMC,cAActC,KAAKuC,MAAM,CAACH,iBAC5B,AAAClE,SAAS8B,MAAMoC,eAA8ChC,OAAO,EACjErB,OACJ2B;IACJ,OAAOzC,0BAA0BqE,eAAelC,QAAQrB,IAAI,IAAI;AAClE;AAEA;;;;;;;;;;CAUC,GACD,OAAO,MAAMyD,oCAAoC,CAC/CxC,MACAyC,kBACAC;IAEA,MAAMN,gBAAgBrE,kBACpB0E,iBAAiBJ,IAAI,EACrB;IAEF,IAAI,CAACrC,KAAKuC,MAAM,CAACH,gBAAgB;QAC/B;IACF;IAEA,MAAMO,mBAAmBR,sBAAsBnC,MAAM0C;IAErDtE,WAAW4B,MAAMoC,eAAe,CAACvB;QAC/B,uDAAuD;QACvD,MAAM1B,OAAO0B,KAAKT,OAAO,EAAEC,gBAAgB,EAAE;QAC7C,IACE,CAAClB,KAAKyD,IAAI,CACR,CAACrD,IACCA,MAAMoD,oBACNpD,EAAEsD,UAAU,CAAC,GAAGF,iBAAiB,EAAE,CAAC,KACpCpD,EAAEsD,UAAU,CAAC,GAAGF,iBAAiB,EAAE,CAAC,IAExC;YACA9B,KAAKT,OAAO,CAACC,YAAY,GAAG;mBAAIlB;gBAAMwD;aAAiB;QACzD;QAEA,iDAAiD;QACjD9B,KAAKQ,IAAI,GAAGR,KAAKQ,IAAI,IAAI,CAAC;QACzBR,KAAKQ,IAAI,CAASC,EAAE,GAAG,AAACT,KAAKQ,IAAI,CAASC,EAAE,IAAI,CAAC;QACjDT,KAAKQ,IAAI,CAASC,EAAE,CAACwB,OAAO,GAAG,AAACjC,KAAKQ,IAAI,CAASC,EAAE,CAACwB,OAAO,IAAI,CAAC;QACjEjC,KAAKQ,IAAI,CAASC,EAAE,CAACwB,OAAO,CAACH,iBAAiB,GAAG;YAChDI,WAAW;QACb;QAEA,OAAOlC;IACT;AACF,EAAE"}

package/src/utils/version-lockstep/hold.js

@@ -8,13 +8,7 @@
         liftWhen: 'a newer ty has been checked against all vended Python templates (run the py-client, py#dynamodb and other Python-typecheck specs with it)'
     }
 ];
-/** Terraform providers the version update keeps at their current version. */ export const TERRAFORM_VERSION_HOLDS = [
-    {
-        name: 'aws',
-        reason: 'hashicorp/aws 6.69.0 moved to aws-sdk-go-base/v2 v2.0.0-beta.75, whose bufio.Scanner response logger fails reading aws_cognito_managed_login_branding with "token too long", so the vended Cognito user identity fails apply (terraform-provider-aws#50481)',
-        liftWhen: "a hashicorp/aws release includes aws-sdk-go-base#1539 (fixes terraform-provider-aws#50481); check the provider's go.mod for aws-sdk-go-base/v2 > beta.75 or the changelog"
-    }
-];
+/** Terraform providers the version update keeps at their current version. */ export const TERRAFORM_VERSION_HOLDS = [];
 /**
  * Put each held pin the run proposed moving back to its current version.
  *

package/src/utils/version-lockstep/hold.js.map

@@ -1 +1 @@
-{"version":3,"sources":["../../../../../../packages/nx-plugin/src/utils/version-lockstep/hold.ts"],"sourcesContent":["/**\n * Copyright Amazon.com, Inc. or its affiliates. All Rights Reserved.\n * SPDX-License-Identifier: Apache-2.0\n */\nimport type { IPyDepVersion, ITerraformProviderVersion } from '../versions.js';\nimport type { IVersionedDep, LockstepNote } from './lockstep.js';\n\n/**\n * A pin the version update must not move, why, and what lets it move again.\n *\n * The npm equivalent is a `reject` entry in `.ncurc.cjs`. pip-check-updates\n * has no exclude option and Terraform providers are resolved from the\n * registry, so Python and Terraform pins are held here instead.\n */\nexport interface VersionHold<Name extends IVersionedDep = IVersionedDep> {\n  name: Name;\n  reason: string;\n  liftWhen: string;\n}\n\n/** Python pins the version update keeps at their current version. */\nexport const PY_VERSION_HOLDS: readonly VersionHold<IPyDepVersion>[] = [\n  {\n    name: 'ty',\n    reason:\n      'ty is 0.x and its releases add diagnostics that fail the vended Python templates',\n    liftWhen:\n      'a newer ty has been checked against all vended Python templates (run the py-client, py#dynamodb and other Python-typecheck specs with it)',\n  },\n];\n\n/** Terraform providers the version update keeps at their current version. */\nexport const TERRAFORM_VERSION_HOLDS: readonly VersionHold<ITerraformProviderVersion>[] =\n  [\n    {\n      name: 'aws',\n      reason:\n        'hashicorp/aws 6.69.0 moved to aws-sdk-go-base/v2 v2.0.0-beta.75, whose bufio.Scanner response logger fails reading aws_cognito_managed_login_branding with \"token too long\", so the vended Cognito user identity fails apply (terraform-provider-aws#50481)',\n      liftWhen:\n        \"a hashicorp/aws release includes aws-sdk-go-base#1539 (fixes terraform-provider-aws#50481); check the provider's go.mod for aws-sdk-go-base/v2 > beta.75 or the changelog\",\n    },\n  ];\n\n/**\n * Put each held pin the run proposed moving back to its current version.\n *\n * Mutates `proposed`, which holds versions not yet written anywhere, and\n * returns a note for each pin it held so the reason reaches the update's PR.\n */\nexport const holdPinnedVersions = <Name extends IVersionedDep>(\n  holds: readonly VersionHold<Name>[],\n  current: Readonly<Partial<Record<Name, string>>>,\n  proposed: Partial<Record<Name, string>>,\n): LockstepNote[] => {\n  const notes: LockstepNote[] = [];\n\n  for (const { name, reason, liftWhen } of holds) {\n    const held = current[name];\n    const available = proposed[name];\n    if (held === undefined || available === undefined || available === held) {\n      continue;\n    }\n    proposed[name] = held;\n    notes.push({\n      name,\n      note: `${name} held at ${held} (${available} available): ${reason}. Lift when ${liftWhen}`,\n    });\n  }\n\n  return notes;\n};\n"],"names":["PY_VERSION_HOLDS","name","reason","liftWhen","TERRAFORM_VERSION_HOLDS","holdPinnedVersions","holds","current","proposed","notes","held","available","undefined","push","note"],"mappings":"AAAA;;;CAGC,GAiBD,mEAAmE,GACnE,OAAO,MAAMA,mBAA0D;IACrE;QACEC,MAAM;QACNC,QACE;QACFC,UACE;IACJ;CACD,CAAC;AAEF,2EAA2E,GAC3E,OAAO,MAAMC,0BACX;IACE;QACEH,MAAM;QACNC,QACE;QACFC,UACE;IACJ;CACD,CAAC;AAEJ;;;;;CAKC,GACD,OAAO,MAAME,qBAAqB,CAChCC,OACAC,SACAC;IAEA,MAAMC,QAAwB,EAAE;IAEhC,KAAK,MAAM,EAAER,IAAI,EAAEC,MAAM,EAAEC,QAAQ,EAAE,IAAIG,MAAO;QAC9C,MAAMI,OAAOH,OAAO,CAACN,KAAK;QAC1B,MAAMU,YAAYH,QAAQ,CAACP,KAAK;QAChC,IAAIS,SAASE,aAAaD,cAAcC,aAAaD,cAAcD,MAAM;YACvE;QACF;QACAF,QAAQ,CAACP,KAAK,GAAGS;QACjBD,MAAMI,IAAI,CAAC;YACTZ;YACAa,MAAM,GAAGb,KAAK,SAAS,EAAES,KAAK,EAAE,EAAEC,UAAU,aAAa,EAAET,OAAO,YAAY,EAAEC,UAAU;QAC5F;IACF;IAEA,OAAOM;AACT,EAAE"}
+{"version":3,"sources":["../../../../../../packages/nx-plugin/src/utils/version-lockstep/hold.ts"],"sourcesContent":["/**\n * Copyright Amazon.com, Inc. or its affiliates. All Rights Reserved.\n * SPDX-License-Identifier: Apache-2.0\n */\nimport type { IPyDepVersion, ITerraformProviderVersion } from '../versions.js';\nimport type { IVersionedDep, LockstepNote } from './lockstep.js';\n\n/**\n * A pin the version update must not move, why, and what lets it move again.\n *\n * The npm equivalent is a `reject` entry in `.ncurc.cjs`. pip-check-updates\n * has no exclude option and Terraform providers are resolved from the\n * registry, so Python and Terraform pins are held here instead.\n */\nexport interface VersionHold<Name extends IVersionedDep = IVersionedDep> {\n  name: Name;\n  reason: string;\n  liftWhen: string;\n}\n\n/** Python pins the version update keeps at their current version. */\nexport const PY_VERSION_HOLDS: readonly VersionHold<IPyDepVersion>[] = [\n  {\n    name: 'ty',\n    reason:\n      'ty is 0.x and its releases add diagnostics that fail the vended Python templates',\n    liftWhen:\n      'a newer ty has been checked against all vended Python templates (run the py-client, py#dynamodb and other Python-typecheck specs with it)',\n  },\n];\n\n/** Terraform providers the version update keeps at their current version. */\nexport const TERRAFORM_VERSION_HOLDS: readonly VersionHold<ITerraformProviderVersion>[] =\n  [];\n\n/**\n * Put each held pin the run proposed moving back to its current version.\n *\n * Mutates `proposed`, which holds versions not yet written anywhere, and\n * returns a note for each pin it held so the reason reaches the update's PR.\n */\nexport const holdPinnedVersions = <Name extends IVersionedDep>(\n  holds: readonly VersionHold<Name>[],\n  current: Readonly<Partial<Record<Name, string>>>,\n  proposed: Partial<Record<Name, string>>,\n): LockstepNote[] => {\n  const notes: LockstepNote[] = [];\n\n  for (const { name, reason, liftWhen } of holds) {\n    const held = current[name];\n    const available = proposed[name];\n    if (held === undefined || available === undefined || available === held) {\n      continue;\n    }\n    proposed[name] = held;\n    notes.push({\n      name,\n      note: `${name} held at ${held} (${available} available): ${reason}. Lift when ${liftWhen}`,\n    });\n  }\n\n  return notes;\n};\n"],"names":["PY_VERSION_HOLDS","name","reason","liftWhen","TERRAFORM_VERSION_HOLDS","holdPinnedVersions","holds","current","proposed","notes","held","available","undefined","push","note"],"mappings":"AAAA;;;CAGC,GAiBD,mEAAmE,GACnE,OAAO,MAAMA,mBAA0D;IACrE;QACEC,MAAM;QACNC,QACE;QACFC,UACE;IACJ;CACD,CAAC;AAEF,2EAA2E,GAC3E,OAAO,MAAMC,0BACX,EAAE,CAAC;AAEL;;;;;CAKC,GACD,OAAO,MAAMC,qBAAqB,CAChCC,OACAC,SACAC;IAEA,MAAMC,QAAwB,EAAE;IAEhC,KAAK,MAAM,EAAER,IAAI,EAAEC,MAAM,EAAEC,QAAQ,EAAE,IAAIG,MAAO;QAC9C,MAAMI,OAAOH,OAAO,CAACN,KAAK;QAC1B,MAAMU,YAAYH,QAAQ,CAACP,KAAK;QAChC,IAAIS,SAASE,aAAaD,cAAcC,aAAaD,cAAcD,MAAM;YACvE;QACF;QACAF,QAAQ,CAACP,KAAK,GAAGS;QACjBD,MAAMI,IAAI,CAAC;YACTZ;YACAa,MAAM,GAAGb,KAAK,SAAS,EAAES,KAAK,EAAE,EAAEC,UAAU,aAAa,EAAET,OAAO,YAAY,EAAEC,UAAU;QAC5F;IACF;IAEA,OAAOM;AACT,EAAE"}

package/src/utils/versions.d.ts

@@ -230,6 +230,14 @@ export declare const PY_VERSIONS: {
     readonly greenlet: "==3.5.6";
 };
 export type IPyDepVersion = keyof typeof PY_VERSIONS;
+/**
+ * Entries for the workspace root `[tool.uv] override-dependencies`, keyed by
+ * the vended package whose own requirement they override. They are written
+ * whenever a project depends on the key.
+ */
+export declare const PY_UV_OVERRIDES: {
+    readonly 'strands-agents-tools': readonly ["pillow>=13.0.0"];
+};
 /**
  * Add versions to the given dependencies
  */
@@ -379,7 +387,7 @@ export declare const terraformLambdaRuntimeVars: () => {
  * Pinned exactly (no range operator) so generated infrastructure is reproducible.
  */
 export declare const TERRAFORM_VERSIONS: {
-    readonly aws: "6.68.0";
+    readonly aws: "6.69.1";
     readonly random: "3.9.1";
     readonly null: "3.3.2";
     readonly archive: "2.8.1";
@@ -393,7 +401,7 @@ export type ITerraformProviderVersion = keyof typeof TERRAFORM_VERSIONS;
  * generated `.tf` templates (e.g. `version = "<%- awsProviderVersion %>"`)
  */
 export declare const terraformProviderVersions: () => {
-    awsProviderVersion: "6.68.0";
+    awsProviderVersion: "6.69.1";
     randomProviderVersion: "3.9.1";
     nullProviderVersion: "3.3.2";
     archiveProviderVersion: "2.8.1";

package/src/utils/versions.js

@@ -280,6 +280,19 @@
     // platform wheels may not all be published yet (breaking aarch64 installs).
     greenlet: '==3.5.6'
 };
+/**
+ * Entries for the workspace root `[tool.uv] override-dependencies`, keyed by
+ * the vended package whose own requirement they override. They are written
+ * whenever a project depends on the key.
+ */ export const PY_UV_OVERRIDES = {
+    // strands-agents-tools caps pillow below 13.0.0, the release that fixes
+    // CVE-2026-112403 and other pillow CVEs. Remove this entry when the
+    // strands-agents-tools pin moves to a release that allows pillow 13
+    // (strands-agents/tools#626).
+    'strands-agents-tools': [
+        'pillow>=13.0.0'
+    ]
+};
 /**
  * Add versions to the given dependencies
  */ export const withPyVersions = (declaration, deps)=>{
@@ -415,7 +428,7 @@
  * Exact versions for Terraform providers used by generated `.tf` modules.
  * Pinned exactly (no range operator) so generated infrastructure is reproducible.
  */ export const TERRAFORM_VERSIONS = {
-    aws: '6.68.0',
+    aws: '6.69.1',
     random: '3.9.1',
     null: '3.3.2',
     archive: '2.8.1',

package/src/utils/versions.js.map

@@ -1 +1 @@
-{"version":3,"sources":["../../../../../packages/nx-plugin/src/utils/versions.ts"],"sourcesContent":["/**\n * Copyright Amazon.com, Inc. or its affiliates. All Rights Reserved.\n * SPDX-License-Identifier: Apache-2.0\n */\nimport {\n  type DeclaredPy,\n  type DeclaredTs,\n  type DependencyDeclaration,\n  declaredNames,\n} from './declared-dependencies.js';\n\n/**\n * Versons for TypeScript dependencies added by generators\n */\nexport const TS_VERSIONS = {\n  '@a2a-js/sdk': '0.3.14',\n  '@aws/aws-distro-opentelemetry-node-autoinstrumentation': '0.13.0',\n  // Pinned above the version the ADOT autoinstrumentation package resolves\n  // transitively (2.8.0) to clear CVE-2026-59892 (HIGH).\n  '@opentelemetry/propagator-jaeger': '2.12.0',\n  // Overridden in the vended agent/MCP image builds to clear CVE-2026-14257\n  // (HIGH) in brace-expansion: minimatch 10 is the lowest major depending on\n  // brace-expansion 5.x, the only line Trivy's `< 5.0.8` advisory range treats\n  // as fixed. Overriding brace-expansion directly is not viable — 5.x drops the\n  // CommonJS default export that minimatch 9 calls.\n  minimatch: '10.2.6',\n  // Both overridden in the vended RDB migration image build, which installs the\n  // prisma CLI to run migrations: its own ranges resolve deepmerge-ts below the\n  // CVE-2026-40345 fix (HIGH) and mysql2 below the GHSA-3f6p-5ww8-9rcr fix\n  // (HIGH). Neither is imported by the handler, which drives the schema engine.\n  'deepmerge-ts': '8.0.2',\n  mysql2: '3.24.6',\n  '@aws-sdk/client-dynamodb': '3.1152.0',\n  '@aws-sdk/client-api-gateway': '3.1152.0',\n  '@aws-sdk/client-iam': '3.1152.0',\n  '@aws-sdk/client-bedrock-agentcore': '3.1152.0',\n  '@aws-sdk/client-bedrock-runtime': '3.1152.0',\n  '@aws-sdk/client-s3': '3.1152.0',\n  '@aws-sdk/client-sts': '3.1152.0',\n  '@aws-sdk/client-cognito-identity-provider': '3.1152.0',\n  '@aws-sdk/credential-providers': '3.1152.0',\n  '@aws-sdk/credential-provider-cognito-identity': '3.972.73',\n  '@aws-sdk/client-secrets-manager': '3.1152.0',\n  '@aws-sdk/rds-signer': '3.1152.0',\n  '@smithy/server-apigateway': '0.3.4',\n  '@smithy/server-node': '0.3.4',\n  '@aws-lambda-powertools/logger': '2.36.0',\n  '@aws-lambda-powertools/metrics': '2.36.0',\n  '@aws-lambda-powertools/parameters': '2.36.0',\n  '@aws-lambda-powertools/tracer': '2.36.0',\n  '@aws-lambda-powertools/parser': '2.36.0',\n  '@aws-sdk/client-appconfigdata': '3.1152.0',\n  '@middy/core': '7.9.2',\n  '@nxlv/python': '23.2.1',\n  '@nx-extend/terraform': '10.4.1',\n  // These must all hold the same version — see NX_PACKAGES.\n  nx: '23.3.0',\n  '@nx/devkit': '23.3.0',\n  '@nx/js': '23.3.0',\n  '@nx/react': '23.3.0',\n  '@nx/vite': '23.3.0',\n  '@nx/vitest': '23.3.0',\n  '@nx/workspace': '23.3.0',\n  'create-nx-workspace': '23.3.0',\n  '@swc-node/register': '1.12.1',\n  '@swc/core': '1.16.18',\n  '@modelcontextprotocol/sdk': '1.32.1',\n  '@modelcontextprotocol/client': '2.3.1',\n  '@modelcontextprotocol/inspector': '2.11.0',\n  '@ag-ui/a2ui-toolkit': '0.0.5',\n  '@ag-ui/aws-strands': '1.0.0',\n  '@ag-ui/client': '1.0.2',\n  '@ag-ui/core': '1.0.2',\n  '@ag-ui/encoder': '1.0.2',\n  'agent-chat-cli': '0.3.0',\n  '@copilotkit/react-core': '1.79.1',\n  rxjs: '7.8.2',\n  '@strands-agents/sdk': '1.21.0',\n  '@tanstack/react-router': '1.170.45',\n  '@tanstack/router-plugin': '1.168.47',\n  '@tanstack/router-generator': '1.167.45',\n  '@tanstack/virtual-file-routes': '1.162.0',\n  '@tanstack/router-utils': '1.162.4',\n  '@cloudscape-design/board-components': '3.0.238',\n  '@cloudscape-design/chat-components': '1.0.179',\n  '@cloudscape-design/components': '3.0.1401',\n  '@cloudscape-design/global-styles': '1.0.71',\n  '@tanstack/react-query': '5.104.4',\n  '@tanstack/react-query-devtools': '5.104.4',\n  '@trpc/tanstack-react-query': '11.19.0',\n  '@trpc/client': '11.19.0',\n  '@trpc/server': '11.19.0',\n  '@types/node': '26.6.5',\n  '@types/aws-lambda': '8.10.164',\n  '@types/cors': '2.8.19',\n  '@types/pg': '8.23.1',\n  '@types/ws': '8.18.2',\n  '@types/express': '5.0.6',\n  '@smithy/config-resolver': '4.7.2',\n  '@smithy/node-config-provider': '4.6.2',\n  '@smithy/node-http-handler': '4.12.1',\n  '@smithy/types': '4.19.0',\n  '@vitest/coverage-v8': '5.0.4',\n  '@vitest/ui': '5.0.4',\n  '@astrojs/react': '6.0.6',\n  '@astrojs/starlight': '0.42.6',\n  astro: '7.4.0',\n  cookie: '2.0.1',\n  aws4fetch: '1.0.20',\n  'aws-cdk': '2.1145.0',\n  'aws-cdk-lib': '2.273.0',\n  'aws-xray-sdk-core': '3.12.0',\n  constructs: '10.8.1',\n  cors: '2.8.6',\n  chalk: '6.0.1',\n  'class-variance-authority': '0.7.1',\n  cn: '0.5.0',\n  commander: '15.0.0',\n  electrodb: '3.9.3',\n  esbuild: '0.28.2',\n  'event-source-polyfill': '1.0.31',\n  '@types/event-source-polyfill': '1.0.5',\n  '@biomejs/biome': '2.5.15',\n  '@prisma/adapter-mariadb': '7.10.1',\n  '@prisma/adapter-pg': '7.10.1',\n  '@prisma/client': '7.10.1',\n  ejs: '6.0.1',\n  '@types/ejs': '3.1.5',\n  express: '5.3.0',\n  'fast-glob': '3.3.3',\n  husky: '9.1.7',\n  'fs-extra': '11.4.1',\n  '@types/fs-extra': '11.0.4',\n  mariadb: '3.5.4',\n  mise: '2026.10.14',\n  npm: '12.2.1',\n  'npm-check-updates': '23.1.1',\n  'oidc-client-ts': '3.5.0',\n  pg: '8.23.1',\n  prisma: '7.10.1',\n  'react-oidc-context': '3.3.1',\n  react: '19.3.1',\n  'react-dom': '19.3.1',\n  rolldown: '1.2.14',\n  'rolldown-plugin-dts': '0.28.8',\n  shx: '0.4.0',\n  'simple-git': '4.0.2',\n  'source-map-support': '0.5.21',\n  'starlight-blog': '0.30.2',\n  tailwindcss: '4.3.3',\n  '@tailwindcss/vite': '4.3.3',\n  tsx: '4.23.15',\n  'lucide-react': '1.59.0',\n  'radix-ui': '1.8.1',\n  shadcn: '4.22.1',\n  'tw-animate-css': '1.4.0',\n  vite: '8.3.4',\n  typescript: '6.0.3',\n  vitest: '5.0.4',\n  // The `testEnvironment` @nx/vitest writes into every generated config.\n  jsdom: '29.1.1',\n  zod: '4.6.7',\n  ws: '8.22.0',\n} as const;\nexport type ITsDepVersion = keyof typeof TS_VERSIONS;\n\n/**\n * Dependencies that must move as a unit, held at the lowest version proposed\n * across each group by the version update. Members must share a version line.\n *\n * The wasm formatter bindings are dependencies of this repo rather than vended\n * pins, so they are named here but versioned in the manifests.\n */\nexport const LOCKSTEP_GROUPS = [\n  // A duplicate `@ag-ui/client` fails every generated website with TS2322.\n  ['@ag-ui/client', '@ag-ui/core', '@ag-ui/encoder'],\n  // The wasm bindings format generated files; the CLI checks them.\n  ['@biomejs/wasm-nodejs', '@biomejs/biome'],\n  ['@astral-sh/ruff-wasm-nodejs', 'ruff'],\n  // vitest pins its coverage provider and UI at its own exact version.\n  ['vitest', '@vitest/coverage-v8', '@vitest/ui'],\n] as const satisfies readonly (readonly [string, string, ...string[]])[];\n\n/**\n * Pins the version update sets to the exact `dependencies` of another vended\n * package, as published for the version of it being written. Followers' lockstep\n * group mates move with them. If a peer's published `peerDependencies` reject the\n * result, or a manifest can't be read, all of these pins stay where they are.\n *\n * Use this rather than a lockstep group when the packages don't share a version\n * line.\n */\nexport const EXACT_DEPENDENCY_PINS = [\n  {\n    source: '@copilotkit/react-core',\n    followers: ['@ag-ui/client', '@ag-ui/core'],\n    peers: ['@ag-ui/aws-strands', '@ag-ui/a2ui-toolkit'],\n    reason:\n      'a second @ag-ui/client copy fails every generated website with TS2322',\n  },\n] as const satisfies readonly {\n  source: ITsDepVersion;\n  followers: readonly [ITsDepVersion, ...ITsDepVersion[]];\n  peers: readonly ITsDepVersion[];\n  reason: string;\n}[];\n\n/**\n * Add versions to the given dependencies, which the declaration must own.\n *\n * @param declaration the calling generator's `DEPENDENCIES`\n */\nexport const withVersions = <D extends DependencyDeclaration>(\n  declaration: D,\n  deps: readonly DeclaredTs<D>[],\n): Record<string, string> => {\n  assertDeclared(declaration.ts, deps, 'ts');\n  return Object.fromEntries(\n    deps.map((dep) => [dep, TS_VERSIONS[dep as ITsDepVersion]]),\n  );\n};\n\n/**\n * The `nx` and `@nx/*` packages a generated workspace pins, all of which must\n * hold the same version: a workspace nx even a patch apart hoists a second\n * nested nx, and the two deadlock `nx sync`.\n *\n * Bumping them in a user's workspace requires `packageJsonUpdates` rather than a\n * migration — see `version-upgrade-migration/nx-package-updates.ts`.\n */\nexport const NX_PACKAGES = [\n  'nx',\n  '@nx/devkit',\n  '@nx/js',\n  '@nx/react',\n  '@nx/vite',\n  '@nx/vitest',\n  '@nx/workspace',\n] as const satisfies readonly ITsDepVersion[];\n\n/**\n * The nx version the plugin is built against, and the single source of truth\n * for every place a workspace's nx is pinned.\n */\nexport const NX_VERSION = TS_VERSIONS.nx;\n\n/**\n * Versions for Python dependencies added by generators\n */\nexport const PY_VERSIONS = {\n  'a2a-sdk': '==0.3.26',\n  'ag-ui-langgraph': '==0.0.47',\n  'ag-ui-protocol': '==0.1.22',\n  'ag-ui-strands': '==0.4.1',\n  aiosqlite: '==0.22.1',\n  'aws-lambda-powertools': '==3.36.0',\n  'aws-lambda-powertools[tracer]': '==3.36.0',\n  'aws-lambda-powertools[parser]': '==3.36.0',\n  'aws-opentelemetry-distro': '==0.21.0',\n  'bedrock-agentcore': '==1.24.2',\n  boto3: '==1.43.115',\n  checkov: '==3.3.29',\n  fastapi: '==0.150.0',\n  'fastapi[standard]': '==0.150.0',\n  httpx: '==0.28.1',\n  langchain: '==1.4.6',\n  'langchain-aws': '==1.9.0',\n  'langchain-mcp-adapters': '==0.3.2',\n  langgraph: '==1.2.16',\n  'langgraph-checkpoint-aws': '==1.2.5',\n  'langgraph-checkpoint-sqlite': '==3.1.2',\n  mcp: '==1.28.1',\n  'pip-check-updates': '==0.29.0',\n  'pip-licenses': '==5.5.5',\n  pydantic: '==2.14.1',\n  ruff: '==0.17.1',\n  'strands-agents': '==1.61.1',\n  'strands-agents[a2a]': '==1.61.1',\n  'strands-agents-tools': '==0.8.9',\n  ty: '==0.0.89',\n  pynamodb: '==6.1.0',\n  uvicorn: '==0.54.0',\n  sqlmodel: '==0.0.48',\n  alembic: '==1.20.0',\n  aiomysql: '==0.3.2',\n  asyncpg: '==0.32.0',\n  // Pinned explicitly: SQLAlchemy's async engine pulls greenlet transitively,\n  // and leaving it unpinned lets uv resolve to a just-released version whose\n  // platform wheels may not all be published yet (breaking aarch64 installs).\n  greenlet: '==3.5.6',\n} as const;\nexport type IPyDepVersion = keyof typeof PY_VERSIONS;\n\n/**\n * Add versions to the given dependencies\n */\nexport const withPyVersions = <D extends DependencyDeclaration>(\n  declaration: D,\n  deps: readonly DeclaredPy<D>[],\n): string[] => {\n  assertDeclared(declaration.py, deps, 'py');\n  return deps.map((dep) => `${dep}${PY_VERSIONS[dep as IPyDepVersion]}`);\n};\n\n/** Catches undeclared packages that reach here past the type checker. */\nconst assertDeclared = (\n  declared: readonly { readonly name: string }[],\n  deps: readonly unknown[],\n  kind: 'ts' | 'py',\n): void => {\n  const names = declaredNames(declared);\n  const undeclared = deps.filter((dep) => !names.includes(dep as string));\n  if (undeclared.length > 0) {\n    throw new Error(\n      `Undeclared ${kind} dependencies: ${undeclared.join(', ')}. Add them to the generator's declareDependencies({ ${kind}: [...] }).`,\n    );\n  }\n};\n\n/**\n * Versions for vendored tools\n */\nexport const VENDORED_VERSIONS = {\n  'git-secrets': '1.3.0',\n} as const;\n\n/**\n * Versions of Java dependencies added by generators, keyed by Maven coordinate.\n *\n * Every entry is resolved from Maven Central by the version update and named\n * `<group>:<artifact>:<version>` where a generator writes it.\n */\nexport const JAVA_VERSIONS = {\n  'software.amazon.smithy:smithy-model': '1.74.1',\n  'software.amazon.smithy:smithy-aws-traits': '1.74.1',\n  'software.amazon.smithy:smithy-validation-model': '1.74.1',\n  'software.amazon.smithy:smithy-openapi': '1.74.1',\n  'software.amazon.smithy.typescript:smithy-aws-typescript-codegen': '0.54.0',\n} as const;\nexport type IJavaVersion = keyof typeof JAVA_VERSIONS;\n\n/** The Maven coordinates the version update resolves, in declaration order. */\nexport const JAVA_ARTIFACTS = Object.keys(JAVA_VERSIONS) as IJavaVersion[];\n\n/** A Maven coordinate as a dependency names it: `<group>:<artifact>:<version>`. */\nexport const javaMavenDependency = (artifact: IJavaVersion): string =>\n  `${artifact}:${JAVA_VERSIONS[artifact]}`;\n\n/**\n * Versions of tools resolved by mise, keyed by the tool name mise knows.\n *\n * Every entry is checked with `mise latest <tool>` by the version update. Nothing\n * is installed into the workspace: the pin travels in the `project.json` target\n * command, which is what the version sync reaches to move it forward.\n */\nexport const MISE_VERSIONS = {\n  smithy: '1.74.1',\n} as const;\nexport type IMiseVersion = keyof typeof MISE_VERSIONS;\n\n/** The tools the version update resolves through mise, in declaration order. */\nexport const MISE_TOOLS = Object.keys(MISE_VERSIONS) as IMiseVersion[];\n\n/**\n * Base container images used by generated Dockerfiles. Pinned exactly so\n * generated images are reproducible, and chosen to be free of known\n * HIGH/CRITICAL vulnerabilities at time of generation.\n */\nexport const BASE_IMAGES = {\n  node: 'public.ecr.aws/docker/library/node:lts-slim',\n  python: 'public.ecr.aws/docker/library/python:3.14-slim',\n} as const;\n\n/**\n * Versions for container tooling used by generated image build/scan targets.\n * Pinned exactly so generated images are reproducible.\n */\nexport const CONTAINER_VERSIONS = {\n  // ECR-hosted Trivy image used to scan built images during the build.\n  trivy: '0.72.0',\n} as const;\n\n/**\n * Repository each pinned tool image is pulled from, keyed as\n * {@link CONTAINER_VERSIONS}. Kept beside the versions so a tool added here is\n * one entry rather than a reference built somewhere else, which is also what\n * lets the version sync find these pins wherever a target command runs them.\n */\nexport const CONTAINER_REPOSITORIES = {\n  trivy: 'public.ecr.aws/aquasecurity/trivy',\n} as const satisfies Record<keyof typeof CONTAINER_VERSIONS, string>;\n\n/** The pinned reference for a tool image, as a target command runs it. */\nexport const containerImage = (tool: keyof typeof CONTAINER_VERSIONS): string =>\n  `${CONTAINER_REPOSITORIES[tool]}:${CONTAINER_VERSIONS[tool]}`;\n\n/**\n * The managed Lambda runtimes generated infrastructure targets, as the single\n * source both IaC providers derive from.\n *\n * CDK and Terraform name the same runtime differently — `Runtime.NODEJS_24_X`\n * against `nodejs24.x` — so deriving both from the version here keeps a bump one\n * edit that moves them together. Resolved by the version update workflow.\n */\nexport const LAMBDA_RUNTIME_VERSIONS = {\n  node: '24',\n  python: '3.14',\n} as const;\nexport type ILambdaRuntime = keyof typeof LAMBDA_RUNTIME_VERSIONS;\n\n/**\n * The managed AgentCore Runtime runtimes generated infrastructure targets, for\n * agents and MCP servers packaged as code rather than as a container image.\n *\n * Tracked separately from {@link LAMBDA_RUNTIME_VERSIONS}: AgentCore publishes\n * its own, smaller set, so a Lambda bump would otherwise move these to a runtime\n * AgentCore rejects at create time. Resolved by the version update workflow from\n * the `AgentCoreRuntime` members `aws-cdk-lib` publishes, the same source the\n * Lambda runtimes come from.\n */\nexport const AGENT_CORE_RUNTIME_VERSIONS = {\n  node: '22',\n  python: '3.14',\n} as const;\nexport type IAgentCoreRuntime = keyof typeof AGENT_CORE_RUNTIME_VERSIONS;\n\n/**\n * The runtime as AgentCore's `runtime` field names it, e.g. `NODE_22` or\n * `PYTHON_3_14`.\n */\nexport const agentCoreRuntime = (runtime: IAgentCoreRuntime): string =>\n  runtime === 'node'\n    ? `NODE_${AGENT_CORE_RUNTIME_VERSIONS.node}`\n    : `PYTHON_${AGENT_CORE_RUNTIME_VERSIONS.python.replace('.', '_')}`;\n\n/**\n * The interpreter uv pins for a generated Python project, as the Lambda runtime's\n * `major.minor`.\n *\n * No patch: uv reads this as a request for any patch of that minor, so it resolves\n * whichever one the platform has a build for. Naming an exact patch pins one that\n * may not exist everywhere, and Lambda patches the interpreter itself, so the minor\n * is the whole of what a project needs to agree on.\n */\nexport const pyenvPythonVersion = (): string => LAMBDA_RUNTIME_VERSIONS.python;\n\n/**\n * The `[project].requires-python` specifier for a generated Python project.\n *\n * A lower bound on the Lambda runtime's `major.minor`: the deployed interpreter\n * is that version, and Ruff derives its `target-version` from this (`py314`), so\n * lint targets the same version the function runs on.\n */\nexport const pyprojectPythonDependency = (): string =>\n  `>=${LAMBDA_RUNTIME_VERSIONS.python}`;\n\n/** The runtime as Terraform's `runtime` attribute names it, e.g. `nodejs24.x`. */\nexport const terraformLambdaRuntime = (runtime: ILambdaRuntime): string =>\n  runtime === 'node'\n    ? `nodejs${LAMBDA_RUNTIME_VERSIONS.node}.x`\n    : `python${LAMBDA_RUNTIME_VERSIONS.python}`;\n\n/**\n * The runtime as an `aws-cdk-lib` `Runtime` member, e.g. `Runtime.NODEJS_24_X`.\n * Always an explicitly versioned member, never a `_LATEST` alias.\n */\nexport const cdkLambdaRuntime = (runtime: ILambdaRuntime): string =>\n  runtime === 'node'\n    ? `Runtime.NODEJS_${LAMBDA_RUNTIME_VERSIONS.node}_X`\n    : `Runtime.PYTHON_${LAMBDA_RUNTIME_VERSIONS.python.replace('.', '_')}`;\n\n/**\n * Substitution variables exposing the pinned runtimes to generated CDK\n * templates (e.g. `runtime: <%- nodeRuntime %>`). Paired with\n * {@link terraformLambdaRuntimeVars}, which names the same variables so a\n * template reads alike under either provider.\n */\nexport const cdkLambdaRuntimeVars = () => ({\n  nodeRuntime: cdkLambdaRuntime('node'),\n  pythonRuntime: cdkLambdaRuntime('python'),\n});\n\n/**\n * Substitution variables exposing the pinned runtimes to generated `.tf`\n * templates (e.g. `runtime = \"<%- nodeRuntime %>\"`).\n */\nexport const terraformLambdaRuntimeVars = () => ({\n  nodeRuntime: terraformLambdaRuntime('node'),\n  pythonRuntime: terraformLambdaRuntime('python'),\n});\n\n/**\n * Exact versions for Terraform providers used by generated `.tf` modules.\n * Pinned exactly (no range operator) so generated infrastructure is reproducible.\n */\nexport const TERRAFORM_VERSIONS = {\n  aws: '6.68.0',\n  random: '3.9.1',\n  null: '3.3.2',\n  archive: '2.8.1',\n  external: '2.4.2',\n  local: '2.9.1',\n  time: '0.14.2',\n} as const;\nexport type ITerraformProviderVersion = keyof typeof TERRAFORM_VERSIONS;\n\n/**\n * Substitution variables exposing Terraform provider version constraints to\n * generated `.tf` templates (e.g. `version = \"<%- awsProviderVersion %>\"`)\n */\nexport const terraformProviderVersions = () => ({\n  awsProviderVersion: TERRAFORM_VERSIONS.aws,\n  randomProviderVersion: TERRAFORM_VERSIONS.random,\n  nullProviderVersion: TERRAFORM_VERSIONS.null,\n  archiveProviderVersion: TERRAFORM_VERSIONS.archive,\n  externalProviderVersion: TERRAFORM_VERSIONS.external,\n  localProviderVersion: TERRAFORM_VERSIONS.local,\n  timeProviderVersion: TERRAFORM_VERSIONS.time,\n});\n"],"names":["declaredNames","TS_VERSIONS","minimatch","mysql2","nx","rxjs","astro","cookie","aws4fetch","constructs","cors","chalk","cn","commander","electrodb","esbuild","ejs","express","husky","mariadb","mise","npm","pg","prisma","react","rolldown","shx","tailwindcss","tsx","shadcn","vite","typescript","vitest","jsdom","zod","ws","LOCKSTEP_GROUPS","EXACT_DEPENDENCY_PINS","source","followers","peers","reason","withVersions","declaration","deps","assertDeclared","ts","Object","fromEntries","map","dep","NX_PACKAGES","NX_VERSION","PY_VERSIONS","aiosqlite","boto3","checkov","fastapi","httpx","langchain","langgraph","mcp","pydantic","ruff","ty","pynamodb","uvicorn","sqlmodel","alembic","aiomysql","asyncpg","greenlet","withPyVersions","py","declared","kind","names","undeclared","filter","includes","length","Error","join","VENDORED_VERSIONS","JAVA_VERSIONS","JAVA_ARTIFACTS","keys","javaMavenDependency","artifact","MISE_VERSIONS","smithy","MISE_TOOLS","BASE_IMAGES","node","python","CONTAINER_VERSIONS","trivy","CONTAINER_REPOSITORIES","containerImage","tool","LAMBDA_RUNTIME_VERSIONS","AGENT_CORE_RUNTIME_VERSIONS","agentCoreRuntime","runtime","replace","pyenvPythonVersion","pyprojectPythonDependency","terraformLambdaRuntime","cdkLambdaRuntime","cdkLambdaRuntimeVars","nodeRuntime","pythonRuntime","terraformLambdaRuntimeVars","TERRAFORM_VERSIONS","aws","random","null","archive","external","local","time","terraformProviderVersions","awsProviderVersion","randomProviderVersion","nullProviderVersion","archiveProviderVersion","externalProviderVersion","localProviderVersion","timeProviderVersion"],"mappings":"AAAA;;;CAGC,GACD,SAIEA,aAAa,QACR,6BAA6B;AAEpC;;CAEC,GACD,OAAO,MAAMC,cAAc;IACzB,eAAe;IACf,0DAA0D;IAC1D,yEAAyE;IACzE,uDAAuD;IACvD,oCAAoC;IACpC,0EAA0E;IAC1E,2EAA2E;IAC3E,6EAA6E;IAC7E,8EAA8E;IAC9E,kDAAkD;IAClDC,WAAW;IACX,8EAA8E;IAC9E,8EAA8E;IAC9E,yEAAyE;IACzE,8EAA8E;IAC9E,gBAAgB;IAChBC,QAAQ;IACR,4BAA4B;IAC5B,+BAA+B;IAC/B,uBAAuB;IACvB,qCAAqC;IACrC,mCAAmC;IACnC,sBAAsB;IACtB,uBAAuB;IACvB,6CAA6C;IAC7C,iCAAiC;IACjC,iDAAiD;IACjD,mCAAmC;IACnC,uBAAuB;IACvB,6BAA6B;IAC7B,uBAAuB;IACvB,iCAAiC;IACjC,kCAAkC;IAClC,qCAAqC;IACrC,iCAAiC;IACjC,iCAAiC;IACjC,iCAAiC;IACjC,eAAe;IACf,gBAAgB;IAChB,wBAAwB;IACxB,0DAA0D;IAC1DC,IAAI;IACJ,cAAc;IACd,UAAU;IACV,aAAa;IACb,YAAY;IACZ,cAAc;IACd,iBAAiB;IACjB,uBAAuB;IACvB,sBAAsB;IACtB,aAAa;IACb,6BAA6B;IAC7B,gCAAgC;IAChC,mCAAmC;IACnC,uBAAuB;IACvB,sBAAsB;IACtB,iBAAiB;IACjB,eAAe;IACf,kBAAkB;IAClB,kBAAkB;IAClB,0BAA0B;IAC1BC,MAAM;IACN,uBAAuB;IACvB,0BAA0B;IAC1B,2BAA2B;IAC3B,8BAA8B;IAC9B,iCAAiC;IACjC,0BAA0B;IAC1B,uCAAuC;IACvC,sCAAsC;IACtC,iCAAiC;IACjC,oCAAoC;IACpC,yBAAyB;IACzB,kCAAkC;IAClC,8BAA8B;IAC9B,gBAAgB;IAChB,gBAAgB;IAChB,eAAe;IACf,qBAAqB;IACrB,eAAe;IACf,aAAa;IACb,aAAa;IACb,kBAAkB;IAClB,2BAA2B;IAC3B,gCAAgC;IAChC,6BAA6B;IAC7B,iBAAiB;IACjB,uBAAuB;IACvB,cAAc;IACd,kBAAkB;IAClB,sBAAsB;IACtBC,OAAO;IACPC,QAAQ;IACRC,WAAW;IACX,WAAW;IACX,eAAe;IACf,qBAAqB;IACrBC,YAAY;IACZC,MAAM;IACNC,OAAO;IACP,4BAA4B;IAC5BC,IAAI;IACJC,WAAW;IACXC,WAAW;IACXC,SAAS;IACT,yBAAyB;IACzB,gCAAgC;IAChC,kBAAkB;IAClB,2BAA2B;IAC3B,sBAAsB;IACtB,kBAAkB;IAClBC,KAAK;IACL,cAAc;IACdC,SAAS;IACT,aAAa;IACbC,OAAO;IACP,YAAY;IACZ,mBAAmB;IACnBC,SAAS;IACTC,MAAM;IACNC,KAAK;IACL,qBAAqB;IACrB,kBAAkB;IAClBC,IAAI;IACJC,QAAQ;IACR,sBAAsB;IACtBC,OAAO;IACP,aAAa;IACbC,UAAU;IACV,uBAAuB;IACvBC,KAAK;IACL,cAAc;IACd,sBAAsB;IACtB,kBAAkB;IAClBC,aAAa;IACb,qBAAqB;IACrBC,KAAK;IACL,gBAAgB;IAChB,YAAY;IACZC,QAAQ;IACR,kBAAkB;IAClBC,MAAM;IACNC,YAAY;IACZC,QAAQ;IACR,uEAAuE;IACvEC,OAAO;IACPC,KAAK;IACLC,IAAI;AACN,EAAW;AAGX;;;;;;CAMC,GACD,OAAO,MAAMC,kBAAkB;IAC7B,yEAAyE;IACzE;QAAC;QAAiB;QAAe;KAAiB;IAClD,iEAAiE;IACjE;QAAC;QAAwB;KAAiB;IAC1C;QAAC;QAA+B;KAAO;IACvC,qEAAqE;IACrE;QAAC;QAAU;QAAuB;KAAa;CAChD,CAAwE;AAEzE;;;;;;;;CAQC,GACD,OAAO,MAAMC,wBAAwB;IACnC;QACEC,QAAQ;QACRC,WAAW;YAAC;YAAiB;SAAc;QAC3CC,OAAO;YAAC;YAAsB;SAAsB;QACpDC,QACE;IACJ;CACD,CAKG;AAEJ;;;;CAIC,GACD,OAAO,MAAMC,eAAe,CAC1BC,aACAC;IAEAC,eAAeF,YAAYG,EAAE,EAAEF,MAAM;IACrC,OAAOG,OAAOC,WAAW,CACvBJ,KAAKK,GAAG,CAAC,CAACC,MAAQ;YAACA;YAAKjD,WAAW,CAACiD,IAAqB;SAAC;AAE9D,EAAE;AAEF;;;;;;;CAOC,GACD,OAAO,MAAMC,cAAc;IACzB;IACA;IACA;IACA;IACA;IACA;IACA;CACD,CAA6C;AAE9C;;;CAGC,GACD,OAAO,MAAMC,aAAanD,YAAYG,EAAE,CAAC;AAEzC;;CAEC,GACD,OAAO,MAAMiD,cAAc;IACzB,WAAW;IACX,mBAAmB;IACnB,kBAAkB;IAClB,iBAAiB;IACjBC,WAAW;IACX,yBAAyB;IACzB,iCAAiC;IACjC,iCAAiC;IACjC,4BAA4B;IAC5B,qBAAqB;IACrBC,OAAO;IACPC,SAAS;IACTC,SAAS;IACT,qBAAqB;IACrBC,OAAO;IACPC,WAAW;IACX,iBAAiB;IACjB,0BAA0B;IAC1BC,WAAW;IACX,4BAA4B;IAC5B,+BAA+B;IAC/BC,KAAK;IACL,qBAAqB;IACrB,gBAAgB;IAChBC,UAAU;IACVC,MAAM;IACN,kBAAkB;IAClB,uBAAuB;IACvB,wBAAwB;IACxBC,IAAI;IACJC,UAAU;IACVC,SAAS;IACTC,UAAU;IACVC,SAAS;IACTC,UAAU;IACVC,SAAS;IACT,4EAA4E;IAC5E,2EAA2E;IAC3E,4EAA4E;IAC5EC,UAAU;AACZ,EAAW;AAGX;;CAEC,GACD,OAAO,MAAMC,iBAAiB,CAC5B7B,aACAC;IAEAC,eAAeF,YAAY8B,EAAE,EAAE7B,MAAM;IACrC,OAAOA,KAAKK,GAAG,CAAC,CAACC,MAAQ,GAAGA,MAAMG,WAAW,CAACH,IAAqB,EAAE;AACvE,EAAE;AAEF,uEAAuE,GACvE,MAAML,iBAAiB,CACrB6B,UACA9B,MACA+B;IAEA,MAAMC,QAAQ5E,cAAc0E;IAC5B,MAAMG,aAAajC,KAAKkC,MAAM,CAAC,CAAC5B,MAAQ,CAAC0B,MAAMG,QAAQ,CAAC7B;IACxD,IAAI2B,WAAWG,MAAM,GAAG,GAAG;QACzB,MAAM,IAAIC,MACR,CAAC,WAAW,EAAEN,KAAK,eAAe,EAAEE,WAAWK,IAAI,CAAC,MAAM,oDAAoD,EAAEP,KAAK,WAAW,CAAC;IAErI;AACF;AAEA;;CAEC,GACD,OAAO,MAAMQ,oBAAoB;IAC/B,eAAe;AACjB,EAAW;AAEX;;;;;CAKC,GACD,OAAO,MAAMC,gBAAgB;IAC3B,uCAAuC;IACvC,4CAA4C;IAC5C,kDAAkD;IAClD,yCAAyC;IACzC,mEAAmE;AACrE,EAAW;AAGX,6EAA6E,GAC7E,OAAO,MAAMC,iBAAiBtC,OAAOuC,IAAI,CAACF,eAAiC;AAE3E,iFAAiF,GACjF,OAAO,MAAMG,sBAAsB,CAACC,WAClC,GAAGA,SAAS,CAAC,EAAEJ,aAAa,CAACI,SAAS,EAAE,CAAC;AAE3C;;;;;;CAMC,GACD,OAAO,MAAMC,gBAAgB;IAC3BC,QAAQ;AACV,EAAW;AAGX,8EAA8E,GAC9E,OAAO,MAAMC,aAAa5C,OAAOuC,IAAI,CAACG,eAAiC;AAEvE;;;;CAIC,GACD,OAAO,MAAMG,cAAc;IACzBC,MAAM;IACNC,QAAQ;AACV,EAAW;AAEX;;;CAGC,GACD,OAAO,MAAMC,qBAAqB;IAChC,qEAAqE;IACrEC,OAAO;AACT,EAAW;AAEX;;;;;CAKC,GACD,OAAO,MAAMC,yBAAyB;IACpCD,OAAO;AACT,EAAqE;AAErE,wEAAwE,GACxE,OAAO,MAAME,iBAAiB,CAACC,OAC7B,GAAGF,sBAAsB,CAACE,KAAK,CAAC,CAAC,EAAEJ,kBAAkB,CAACI,KAAK,EAAE,CAAC;AAEhE;;;;;;;CAOC,GACD,OAAO,MAAMC,0BAA0B;IACrCP,MAAM;IACNC,QAAQ;AACV,EAAW;AAGX;;;;;;;;;CASC,GACD,OAAO,MAAMO,8BAA8B;IACzCR,MAAM;IACNC,QAAQ;AACV,EAAW;AAGX;;;CAGC,GACD,OAAO,MAAMQ,mBAAmB,CAACC,UAC/BA,YAAY,SACR,CAAC,KAAK,EAAEF,4BAA4BR,IAAI,EAAE,GAC1C,CAAC,OAAO,EAAEQ,4BAA4BP,MAAM,CAACU,OAAO,CAAC,KAAK,MAAM,CAAC;AAEvE;;;;;;;;CAQC,GACD,OAAO,MAAMC,qBAAqB,IAAcL,wBAAwBN,MAAM,CAAC;AAE/E;;;;;;CAMC,GACD,OAAO,MAAMY,4BAA4B,IACvC,CAAC,EAAE,EAAEN,wBAAwBN,MAAM,EAAE,CAAC;AAExC,gFAAgF,GAChF,OAAO,MAAMa,yBAAyB,CAACJ,UACrCA,YAAY,SACR,CAAC,MAAM,EAAEH,wBAAwBP,IAAI,CAAC,EAAE,CAAC,GACzC,CAAC,MAAM,EAAEO,wBAAwBN,MAAM,EAAE,CAAC;AAEhD;;;CAGC,GACD,OAAO,MAAMc,mBAAmB,CAACL,UAC/BA,YAAY,SACR,CAAC,eAAe,EAAEH,wBAAwBP,IAAI,CAAC,EAAE,CAAC,GAClD,CAAC,eAAe,EAAEO,wBAAwBN,MAAM,CAACU,OAAO,CAAC,KAAK,MAAM,CAAC;AAE3E;;;;;CAKC,GACD,OAAO,MAAMK,uBAAuB,IAAO,CAAA;QACzCC,aAAaF,iBAAiB;QAC9BG,eAAeH,iBAAiB;IAClC,CAAA,EAAG;AAEH;;;CAGC,GACD,OAAO,MAAMI,6BAA6B,IAAO,CAAA;QAC/CF,aAAaH,uBAAuB;QACpCI,eAAeJ,uBAAuB;IACxC,CAAA,EAAG;AAEH;;;CAGC,GACD,OAAO,MAAMM,qBAAqB;IAChCC,KAAK;IACLC,QAAQ;IACRC,MAAM;IACNC,SAAS;IACTC,UAAU;IACVC,OAAO;IACPC,MAAM;AACR,EAAW;AAGX;;;CAGC,GACD,OAAO,MAAMC,4BAA4B,IAAO,CAAA;QAC9CC,oBAAoBT,mBAAmBC,GAAG;QAC1CS,uBAAuBV,mBAAmBE,MAAM;QAChDS,qBAAqBX,mBAAmBG,IAAI;QAC5CS,wBAAwBZ,mBAAmBI,OAAO;QAClDS,yBAAyBb,mBAAmBK,QAAQ;QACpDS,sBAAsBd,mBAAmBM,KAAK;QAC9CS,qBAAqBf,mBAAmBO,IAAI;IAC9C,CAAA,EAAG"}
+{"version":3,"sources":["../../../../../packages/nx-plugin/src/utils/versions.ts"],"sourcesContent":["/**\n * Copyright Amazon.com, Inc. or its affiliates. All Rights Reserved.\n * SPDX-License-Identifier: Apache-2.0\n */\nimport {\n  type DeclaredPy,\n  type DeclaredTs,\n  type DependencyDeclaration,\n  declaredNames,\n} from './declared-dependencies.js';\n\n/**\n * Versons for TypeScript dependencies added by generators\n */\nexport const TS_VERSIONS = {\n  '@a2a-js/sdk': '0.3.14',\n  '@aws/aws-distro-opentelemetry-node-autoinstrumentation': '0.13.0',\n  // Pinned above the version the ADOT autoinstrumentation package resolves\n  // transitively (2.8.0) to clear CVE-2026-59892 (HIGH).\n  '@opentelemetry/propagator-jaeger': '2.12.0',\n  // Overridden in the vended agent/MCP image builds to clear CVE-2026-14257\n  // (HIGH) in brace-expansion: minimatch 10 is the lowest major depending on\n  // brace-expansion 5.x, the only line Trivy's `< 5.0.8` advisory range treats\n  // as fixed. Overriding brace-expansion directly is not viable — 5.x drops the\n  // CommonJS default export that minimatch 9 calls.\n  minimatch: '10.2.6',\n  // Both overridden in the vended RDB migration image build, which installs the\n  // prisma CLI to run migrations: its own ranges resolve deepmerge-ts below the\n  // CVE-2026-40345 fix (HIGH) and mysql2 below the GHSA-3f6p-5ww8-9rcr fix\n  // (HIGH). Neither is imported by the handler, which drives the schema engine.\n  'deepmerge-ts': '8.0.2',\n  mysql2: '3.24.6',\n  '@aws-sdk/client-dynamodb': '3.1152.0',\n  '@aws-sdk/client-api-gateway': '3.1152.0',\n  '@aws-sdk/client-iam': '3.1152.0',\n  '@aws-sdk/client-bedrock-agentcore': '3.1152.0',\n  '@aws-sdk/client-bedrock-runtime': '3.1152.0',\n  '@aws-sdk/client-s3': '3.1152.0',\n  '@aws-sdk/client-sts': '3.1152.0',\n  '@aws-sdk/client-cognito-identity-provider': '3.1152.0',\n  '@aws-sdk/credential-providers': '3.1152.0',\n  '@aws-sdk/credential-provider-cognito-identity': '3.972.73',\n  '@aws-sdk/client-secrets-manager': '3.1152.0',\n  '@aws-sdk/rds-signer': '3.1152.0',\n  '@smithy/server-apigateway': '0.3.4',\n  '@smithy/server-node': '0.3.4',\n  '@aws-lambda-powertools/logger': '2.36.0',\n  '@aws-lambda-powertools/metrics': '2.36.0',\n  '@aws-lambda-powertools/parameters': '2.36.0',\n  '@aws-lambda-powertools/tracer': '2.36.0',\n  '@aws-lambda-powertools/parser': '2.36.0',\n  '@aws-sdk/client-appconfigdata': '3.1152.0',\n  '@middy/core': '7.9.2',\n  '@nxlv/python': '23.2.1',\n  '@nx-extend/terraform': '10.4.1',\n  // These must all hold the same version — see NX_PACKAGES.\n  nx: '23.3.0',\n  '@nx/devkit': '23.3.0',\n  '@nx/js': '23.3.0',\n  '@nx/react': '23.3.0',\n  '@nx/vite': '23.3.0',\n  '@nx/vitest': '23.3.0',\n  '@nx/workspace': '23.3.0',\n  'create-nx-workspace': '23.3.0',\n  '@swc-node/register': '1.12.1',\n  '@swc/core': '1.16.18',\n  '@modelcontextprotocol/sdk': '1.32.1',\n  '@modelcontextprotocol/client': '2.3.1',\n  '@modelcontextprotocol/inspector': '2.11.0',\n  '@ag-ui/a2ui-toolkit': '0.0.5',\n  '@ag-ui/aws-strands': '1.0.0',\n  '@ag-ui/client': '1.0.2',\n  '@ag-ui/core': '1.0.2',\n  '@ag-ui/encoder': '1.0.2',\n  'agent-chat-cli': '0.3.0',\n  '@copilotkit/react-core': '1.79.1',\n  rxjs: '7.8.2',\n  '@strands-agents/sdk': '1.21.0',\n  '@tanstack/react-router': '1.170.45',\n  '@tanstack/router-plugin': '1.168.47',\n  '@tanstack/router-generator': '1.167.45',\n  '@tanstack/virtual-file-routes': '1.162.0',\n  '@tanstack/router-utils': '1.162.4',\n  '@cloudscape-design/board-components': '3.0.238',\n  '@cloudscape-design/chat-components': '1.0.179',\n  '@cloudscape-design/components': '3.0.1401',\n  '@cloudscape-design/global-styles': '1.0.71',\n  '@tanstack/react-query': '5.104.4',\n  '@tanstack/react-query-devtools': '5.104.4',\n  '@trpc/tanstack-react-query': '11.19.0',\n  '@trpc/client': '11.19.0',\n  '@trpc/server': '11.19.0',\n  '@types/node': '26.6.5',\n  '@types/aws-lambda': '8.10.164',\n  '@types/cors': '2.8.19',\n  '@types/pg': '8.23.1',\n  '@types/ws': '8.18.2',\n  '@types/express': '5.0.6',\n  '@smithy/config-resolver': '4.7.2',\n  '@smithy/node-config-provider': '4.6.2',\n  '@smithy/node-http-handler': '4.12.1',\n  '@smithy/types': '4.19.0',\n  '@vitest/coverage-v8': '5.0.4',\n  '@vitest/ui': '5.0.4',\n  '@astrojs/react': '6.0.6',\n  '@astrojs/starlight': '0.42.6',\n  astro: '7.4.0',\n  cookie: '2.0.1',\n  aws4fetch: '1.0.20',\n  'aws-cdk': '2.1145.0',\n  'aws-cdk-lib': '2.273.0',\n  'aws-xray-sdk-core': '3.12.0',\n  constructs: '10.8.1',\n  cors: '2.8.6',\n  chalk: '6.0.1',\n  'class-variance-authority': '0.7.1',\n  cn: '0.5.0',\n  commander: '15.0.0',\n  electrodb: '3.9.3',\n  esbuild: '0.28.2',\n  'event-source-polyfill': '1.0.31',\n  '@types/event-source-polyfill': '1.0.5',\n  '@biomejs/biome': '2.5.15',\n  '@prisma/adapter-mariadb': '7.10.1',\n  '@prisma/adapter-pg': '7.10.1',\n  '@prisma/client': '7.10.1',\n  ejs: '6.0.1',\n  '@types/ejs': '3.1.5',\n  express: '5.3.0',\n  'fast-glob': '3.3.3',\n  husky: '9.1.7',\n  'fs-extra': '11.4.1',\n  '@types/fs-extra': '11.0.4',\n  mariadb: '3.5.4',\n  mise: '2026.10.14',\n  npm: '12.2.1',\n  'npm-check-updates': '23.1.1',\n  'oidc-client-ts': '3.5.0',\n  pg: '8.23.1',\n  prisma: '7.10.1',\n  'react-oidc-context': '3.3.1',\n  react: '19.3.1',\n  'react-dom': '19.3.1',\n  rolldown: '1.2.14',\n  'rolldown-plugin-dts': '0.28.8',\n  shx: '0.4.0',\n  'simple-git': '4.0.2',\n  'source-map-support': '0.5.21',\n  'starlight-blog': '0.30.2',\n  tailwindcss: '4.3.3',\n  '@tailwindcss/vite': '4.3.3',\n  tsx: '4.23.15',\n  'lucide-react': '1.59.0',\n  'radix-ui': '1.8.1',\n  shadcn: '4.22.1',\n  'tw-animate-css': '1.4.0',\n  vite: '8.3.4',\n  typescript: '6.0.3',\n  vitest: '5.0.4',\n  // The `testEnvironment` @nx/vitest writes into every generated config.\n  jsdom: '29.1.1',\n  zod: '4.6.7',\n  ws: '8.22.0',\n} as const;\nexport type ITsDepVersion = keyof typeof TS_VERSIONS;\n\n/**\n * Dependencies that must move as a unit, held at the lowest version proposed\n * across each group by the version update. Members must share a version line.\n *\n * The wasm formatter bindings are dependencies of this repo rather than vended\n * pins, so they are named here but versioned in the manifests.\n */\nexport const LOCKSTEP_GROUPS = [\n  // A duplicate `@ag-ui/client` fails every generated website with TS2322.\n  ['@ag-ui/client', '@ag-ui/core', '@ag-ui/encoder'],\n  // The wasm bindings format generated files; the CLI checks them.\n  ['@biomejs/wasm-nodejs', '@biomejs/biome'],\n  ['@astral-sh/ruff-wasm-nodejs', 'ruff'],\n  // vitest pins its coverage provider and UI at its own exact version.\n  ['vitest', '@vitest/coverage-v8', '@vitest/ui'],\n] as const satisfies readonly (readonly [string, string, ...string[]])[];\n\n/**\n * Pins the version update sets to the exact `dependencies` of another vended\n * package, as published for the version of it being written. Followers' lockstep\n * group mates move with them. If a peer's published `peerDependencies` reject the\n * result, or a manifest can't be read, all of these pins stay where they are.\n *\n * Use this rather than a lockstep group when the packages don't share a version\n * line.\n */\nexport const EXACT_DEPENDENCY_PINS = [\n  {\n    source: '@copilotkit/react-core',\n    followers: ['@ag-ui/client', '@ag-ui/core'],\n    peers: ['@ag-ui/aws-strands', '@ag-ui/a2ui-toolkit'],\n    reason:\n      'a second @ag-ui/client copy fails every generated website with TS2322',\n  },\n] as const satisfies readonly {\n  source: ITsDepVersion;\n  followers: readonly [ITsDepVersion, ...ITsDepVersion[]];\n  peers: readonly ITsDepVersion[];\n  reason: string;\n}[];\n\n/**\n * Add versions to the given dependencies, which the declaration must own.\n *\n * @param declaration the calling generator's `DEPENDENCIES`\n */\nexport const withVersions = <D extends DependencyDeclaration>(\n  declaration: D,\n  deps: readonly DeclaredTs<D>[],\n): Record<string, string> => {\n  assertDeclared(declaration.ts, deps, 'ts');\n  return Object.fromEntries(\n    deps.map((dep) => [dep, TS_VERSIONS[dep as ITsDepVersion]]),\n  );\n};\n\n/**\n * The `nx` and `@nx/*` packages a generated workspace pins, all of which must\n * hold the same version: a workspace nx even a patch apart hoists a second\n * nested nx, and the two deadlock `nx sync`.\n *\n * Bumping them in a user's workspace requires `packageJsonUpdates` rather than a\n * migration — see `version-upgrade-migration/nx-package-updates.ts`.\n */\nexport const NX_PACKAGES = [\n  'nx',\n  '@nx/devkit',\n  '@nx/js',\n  '@nx/react',\n  '@nx/vite',\n  '@nx/vitest',\n  '@nx/workspace',\n] as const satisfies readonly ITsDepVersion[];\n\n/**\n * The nx version the plugin is built against, and the single source of truth\n * for every place a workspace's nx is pinned.\n */\nexport const NX_VERSION = TS_VERSIONS.nx;\n\n/**\n * Versions for Python dependencies added by generators\n */\nexport const PY_VERSIONS = {\n  'a2a-sdk': '==0.3.26',\n  'ag-ui-langgraph': '==0.0.47',\n  'ag-ui-protocol': '==0.1.22',\n  'ag-ui-strands': '==0.4.1',\n  aiosqlite: '==0.22.1',\n  'aws-lambda-powertools': '==3.36.0',\n  'aws-lambda-powertools[tracer]': '==3.36.0',\n  'aws-lambda-powertools[parser]': '==3.36.0',\n  'aws-opentelemetry-distro': '==0.21.0',\n  'bedrock-agentcore': '==1.24.2',\n  boto3: '==1.43.115',\n  checkov: '==3.3.29',\n  fastapi: '==0.150.0',\n  'fastapi[standard]': '==0.150.0',\n  httpx: '==0.28.1',\n  langchain: '==1.4.6',\n  'langchain-aws': '==1.9.0',\n  'langchain-mcp-adapters': '==0.3.2',\n  langgraph: '==1.2.16',\n  'langgraph-checkpoint-aws': '==1.2.5',\n  'langgraph-checkpoint-sqlite': '==3.1.2',\n  mcp: '==1.28.1',\n  'pip-check-updates': '==0.29.0',\n  'pip-licenses': '==5.5.5',\n  pydantic: '==2.14.1',\n  ruff: '==0.17.1',\n  'strands-agents': '==1.61.1',\n  'strands-agents[a2a]': '==1.61.1',\n  'strands-agents-tools': '==0.8.9',\n  ty: '==0.0.89',\n  pynamodb: '==6.1.0',\n  uvicorn: '==0.54.0',\n  sqlmodel: '==0.0.48',\n  alembic: '==1.20.0',\n  aiomysql: '==0.3.2',\n  asyncpg: '==0.32.0',\n  // Pinned explicitly: SQLAlchemy's async engine pulls greenlet transitively,\n  // and leaving it unpinned lets uv resolve to a just-released version whose\n  // platform wheels may not all be published yet (breaking aarch64 installs).\n  greenlet: '==3.5.6',\n} as const;\nexport type IPyDepVersion = keyof typeof PY_VERSIONS;\n\n/**\n * Entries for the workspace root `[tool.uv] override-dependencies`, keyed by\n * the vended package whose own requirement they override. They are written\n * whenever a project depends on the key.\n */\nexport const PY_UV_OVERRIDES = {\n  // strands-agents-tools caps pillow below 13.0.0, the release that fixes\n  // CVE-2026-112403 and other pillow CVEs. Remove this entry when the\n  // strands-agents-tools pin moves to a release that allows pillow 13\n  // (strands-agents/tools#626).\n  'strands-agents-tools': ['pillow>=13.0.0'],\n} as const satisfies Partial<Record<IPyDepVersion, readonly string[]>>;\n\n/**\n * Add versions to the given dependencies\n */\nexport const withPyVersions = <D extends DependencyDeclaration>(\n  declaration: D,\n  deps: readonly DeclaredPy<D>[],\n): string[] => {\n  assertDeclared(declaration.py, deps, 'py');\n  return deps.map((dep) => `${dep}${PY_VERSIONS[dep as IPyDepVersion]}`);\n};\n\n/** Catches undeclared packages that reach here past the type checker. */\nconst assertDeclared = (\n  declared: readonly { readonly name: string }[],\n  deps: readonly unknown[],\n  kind: 'ts' | 'py',\n): void => {\n  const names = declaredNames(declared);\n  const undeclared = deps.filter((dep) => !names.includes(dep as string));\n  if (undeclared.length > 0) {\n    throw new Error(\n      `Undeclared ${kind} dependencies: ${undeclared.join(', ')}. Add them to the generator's declareDependencies({ ${kind}: [...] }).`,\n    );\n  }\n};\n\n/**\n * Versions for vendored tools\n */\nexport const VENDORED_VERSIONS = {\n  'git-secrets': '1.3.0',\n} as const;\n\n/**\n * Versions of Java dependencies added by generators, keyed by Maven coordinate.\n *\n * Every entry is resolved from Maven Central by the version update and named\n * `<group>:<artifact>:<version>` where a generator writes it.\n */\nexport const JAVA_VERSIONS = {\n  'software.amazon.smithy:smithy-model': '1.74.1',\n  'software.amazon.smithy:smithy-aws-traits': '1.74.1',\n  'software.amazon.smithy:smithy-validation-model': '1.74.1',\n  'software.amazon.smithy:smithy-openapi': '1.74.1',\n  'software.amazon.smithy.typescript:smithy-aws-typescript-codegen': '0.54.0',\n} as const;\nexport type IJavaVersion = keyof typeof JAVA_VERSIONS;\n\n/** The Maven coordinates the version update resolves, in declaration order. */\nexport const JAVA_ARTIFACTS = Object.keys(JAVA_VERSIONS) as IJavaVersion[];\n\n/** A Maven coordinate as a dependency names it: `<group>:<artifact>:<version>`. */\nexport const javaMavenDependency = (artifact: IJavaVersion): string =>\n  `${artifact}:${JAVA_VERSIONS[artifact]}`;\n\n/**\n * Versions of tools resolved by mise, keyed by the tool name mise knows.\n *\n * Every entry is checked with `mise latest <tool>` by the version update. Nothing\n * is installed into the workspace: the pin travels in the `project.json` target\n * command, which is what the version sync reaches to move it forward.\n */\nexport const MISE_VERSIONS = {\n  smithy: '1.74.1',\n} as const;\nexport type IMiseVersion = keyof typeof MISE_VERSIONS;\n\n/** The tools the version update resolves through mise, in declaration order. */\nexport const MISE_TOOLS = Object.keys(MISE_VERSIONS) as IMiseVersion[];\n\n/**\n * Base container images used by generated Dockerfiles. Pinned exactly so\n * generated images are reproducible, and chosen to be free of known\n * HIGH/CRITICAL vulnerabilities at time of generation.\n */\nexport const BASE_IMAGES = {\n  node: 'public.ecr.aws/docker/library/node:lts-slim',\n  python: 'public.ecr.aws/docker/library/python:3.14-slim',\n} as const;\n\n/**\n * Versions for container tooling used by generated image build/scan targets.\n * Pinned exactly so generated images are reproducible.\n */\nexport const CONTAINER_VERSIONS = {\n  // ECR-hosted Trivy image used to scan built images during the build.\n  trivy: '0.72.0',\n} as const;\n\n/**\n * Repository each pinned tool image is pulled from, keyed as\n * {@link CONTAINER_VERSIONS}. Kept beside the versions so a tool added here is\n * one entry rather than a reference built somewhere else, which is also what\n * lets the version sync find these pins wherever a target command runs them.\n */\nexport const CONTAINER_REPOSITORIES = {\n  trivy: 'public.ecr.aws/aquasecurity/trivy',\n} as const satisfies Record<keyof typeof CONTAINER_VERSIONS, string>;\n\n/** The pinned reference for a tool image, as a target command runs it. */\nexport const containerImage = (tool: keyof typeof CONTAINER_VERSIONS): string =>\n  `${CONTAINER_REPOSITORIES[tool]}:${CONTAINER_VERSIONS[tool]}`;\n\n/**\n * The managed Lambda runtimes generated infrastructure targets, as the single\n * source both IaC providers derive from.\n *\n * CDK and Terraform name the same runtime differently — `Runtime.NODEJS_24_X`\n * against `nodejs24.x` — so deriving both from the version here keeps a bump one\n * edit that moves them together. Resolved by the version update workflow.\n */\nexport const LAMBDA_RUNTIME_VERSIONS = {\n  node: '24',\n  python: '3.14',\n} as const;\nexport type ILambdaRuntime = keyof typeof LAMBDA_RUNTIME_VERSIONS;\n\n/**\n * The managed AgentCore Runtime runtimes generated infrastructure targets, for\n * agents and MCP servers packaged as code rather than as a container image.\n *\n * Tracked separately from {@link LAMBDA_RUNTIME_VERSIONS}: AgentCore publishes\n * its own, smaller set, so a Lambda bump would otherwise move these to a runtime\n * AgentCore rejects at create time. Resolved by the version update workflow from\n * the `AgentCoreRuntime` members `aws-cdk-lib` publishes, the same source the\n * Lambda runtimes come from.\n */\nexport const AGENT_CORE_RUNTIME_VERSIONS = {\n  node: '22',\n  python: '3.14',\n} as const;\nexport type IAgentCoreRuntime = keyof typeof AGENT_CORE_RUNTIME_VERSIONS;\n\n/**\n * The runtime as AgentCore's `runtime` field names it, e.g. `NODE_22` or\n * `PYTHON_3_14`.\n */\nexport const agentCoreRuntime = (runtime: IAgentCoreRuntime): string =>\n  runtime === 'node'\n    ? `NODE_${AGENT_CORE_RUNTIME_VERSIONS.node}`\n    : `PYTHON_${AGENT_CORE_RUNTIME_VERSIONS.python.replace('.', '_')}`;\n\n/**\n * The interpreter uv pins for a generated Python project, as the Lambda runtime's\n * `major.minor`.\n *\n * No patch: uv reads this as a request for any patch of that minor, so it resolves\n * whichever one the platform has a build for. Naming an exact patch pins one that\n * may not exist everywhere, and Lambda patches the interpreter itself, so the minor\n * is the whole of what a project needs to agree on.\n */\nexport const pyenvPythonVersion = (): string => LAMBDA_RUNTIME_VERSIONS.python;\n\n/**\n * The `[project].requires-python` specifier for a generated Python project.\n *\n * A lower bound on the Lambda runtime's `major.minor`: the deployed interpreter\n * is that version, and Ruff derives its `target-version` from this (`py314`), so\n * lint targets the same version the function runs on.\n */\nexport const pyprojectPythonDependency = (): string =>\n  `>=${LAMBDA_RUNTIME_VERSIONS.python}`;\n\n/** The runtime as Terraform's `runtime` attribute names it, e.g. `nodejs24.x`. */\nexport const terraformLambdaRuntime = (runtime: ILambdaRuntime): string =>\n  runtime === 'node'\n    ? `nodejs${LAMBDA_RUNTIME_VERSIONS.node}.x`\n    : `python${LAMBDA_RUNTIME_VERSIONS.python}`;\n\n/**\n * The runtime as an `aws-cdk-lib` `Runtime` member, e.g. `Runtime.NODEJS_24_X`.\n * Always an explicitly versioned member, never a `_LATEST` alias.\n */\nexport const cdkLambdaRuntime = (runtime: ILambdaRuntime): string =>\n  runtime === 'node'\n    ? `Runtime.NODEJS_${LAMBDA_RUNTIME_VERSIONS.node}_X`\n    : `Runtime.PYTHON_${LAMBDA_RUNTIME_VERSIONS.python.replace('.', '_')}`;\n\n/**\n * Substitution variables exposing the pinned runtimes to generated CDK\n * templates (e.g. `runtime: <%- nodeRuntime %>`). Paired with\n * {@link terraformLambdaRuntimeVars}, which names the same variables so a\n * template reads alike under either provider.\n */\nexport const cdkLambdaRuntimeVars = () => ({\n  nodeRuntime: cdkLambdaRuntime('node'),\n  pythonRuntime: cdkLambdaRuntime('python'),\n});\n\n/**\n * Substitution variables exposing the pinned runtimes to generated `.tf`\n * templates (e.g. `runtime = \"<%- nodeRuntime %>\"`).\n */\nexport const terraformLambdaRuntimeVars = () => ({\n  nodeRuntime: terraformLambdaRuntime('node'),\n  pythonRuntime: terraformLambdaRuntime('python'),\n});\n\n/**\n * Exact versions for Terraform providers used by generated `.tf` modules.\n * Pinned exactly (no range operator) so generated infrastructure is reproducible.\n */\nexport const TERRAFORM_VERSIONS = {\n  aws: '6.69.1',\n  random: '3.9.1',\n  null: '3.3.2',\n  archive: '2.8.1',\n  external: '2.4.2',\n  local: '2.9.1',\n  time: '0.14.2',\n} as const;\nexport type ITerraformProviderVersion = keyof typeof TERRAFORM_VERSIONS;\n\n/**\n * Substitution variables exposing Terraform provider version constraints to\n * generated `.tf` templates (e.g. `version = \"<%- awsProviderVersion %>\"`)\n */\nexport const terraformProviderVersions = () => ({\n  awsProviderVersion: TERRAFORM_VERSIONS.aws,\n  randomProviderVersion: TERRAFORM_VERSIONS.random,\n  nullProviderVersion: TERRAFORM_VERSIONS.null,\n  archiveProviderVersion: TERRAFORM_VERSIONS.archive,\n  externalProviderVersion: TERRAFORM_VERSIONS.external,\n  localProviderVersion: TERRAFORM_VERSIONS.local,\n  timeProviderVersion: TERRAFORM_VERSIONS.time,\n});\n"],"names":["declaredNames","TS_VERSIONS","minimatch","mysql2","nx","rxjs","astro","cookie","aws4fetch","constructs","cors","chalk","cn","commander","electrodb","esbuild","ejs","express","husky","mariadb","mise","npm","pg","prisma","react","rolldown","shx","tailwindcss","tsx","shadcn","vite","typescript","vitest","jsdom","zod","ws","LOCKSTEP_GROUPS","EXACT_DEPENDENCY_PINS","source","followers","peers","reason","withVersions","declaration","deps","assertDeclared","ts","Object","fromEntries","map","dep","NX_PACKAGES","NX_VERSION","PY_VERSIONS","aiosqlite","boto3","checkov","fastapi","httpx","langchain","langgraph","mcp","pydantic","ruff","ty","pynamodb","uvicorn","sqlmodel","alembic","aiomysql","asyncpg","greenlet","PY_UV_OVERRIDES","withPyVersions","py","declared","kind","names","undeclared","filter","includes","length","Error","join","VENDORED_VERSIONS","JAVA_VERSIONS","JAVA_ARTIFACTS","keys","javaMavenDependency","artifact","MISE_VERSIONS","smithy","MISE_TOOLS","BASE_IMAGES","node","python","CONTAINER_VERSIONS","trivy","CONTAINER_REPOSITORIES","containerImage","tool","LAMBDA_RUNTIME_VERSIONS","AGENT_CORE_RUNTIME_VERSIONS","agentCoreRuntime","runtime","replace","pyenvPythonVersion","pyprojectPythonDependency","terraformLambdaRuntime","cdkLambdaRuntime","cdkLambdaRuntimeVars","nodeRuntime","pythonRuntime","terraformLambdaRuntimeVars","TERRAFORM_VERSIONS","aws","random","null","archive","external","local","time","terraformProviderVersions","awsProviderVersion","randomProviderVersion","nullProviderVersion","archiveProviderVersion","externalProviderVersion","localProviderVersion","timeProviderVersion"],"mappings":"AAAA;;;CAGC,GACD,SAIEA,aAAa,QACR,6BAA6B;AAEpC;;CAEC,GACD,OAAO,MAAMC,cAAc;IACzB,eAAe;IACf,0DAA0D;IAC1D,yEAAyE;IACzE,uDAAuD;IACvD,oCAAoC;IACpC,0EAA0E;IAC1E,2EAA2E;IAC3E,6EAA6E;IAC7E,8EAA8E;IAC9E,kDAAkD;IAClDC,WAAW;IACX,8EAA8E;IAC9E,8EAA8E;IAC9E,yEAAyE;IACzE,8EAA8E;IAC9E,gBAAgB;IAChBC,QAAQ;IACR,4BAA4B;IAC5B,+BAA+B;IAC/B,uBAAuB;IACvB,qCAAqC;IACrC,mCAAmC;IACnC,sBAAsB;IACtB,uBAAuB;IACvB,6CAA6C;IAC7C,iCAAiC;IACjC,iDAAiD;IACjD,mCAAmC;IACnC,uBAAuB;IACvB,6BAA6B;IAC7B,uBAAuB;IACvB,iCAAiC;IACjC,kCAAkC;IAClC,qCAAqC;IACrC,iCAAiC;IACjC,iCAAiC;IACjC,iCAAiC;IACjC,eAAe;IACf,gBAAgB;IAChB,wBAAwB;IACxB,0DAA0D;IAC1DC,IAAI;IACJ,cAAc;IACd,UAAU;IACV,aAAa;IACb,YAAY;IACZ,cAAc;IACd,iBAAiB;IACjB,uBAAuB;IACvB,sBAAsB;IACtB,aAAa;IACb,6BAA6B;IAC7B,gCAAgC;IAChC,mCAAmC;IACnC,uBAAuB;IACvB,sBAAsB;IACtB,iBAAiB;IACjB,eAAe;IACf,kBAAkB;IAClB,kBAAkB;IAClB,0BAA0B;IAC1BC,MAAM;IACN,uBAAuB;IACvB,0BAA0B;IAC1B,2BAA2B;IAC3B,8BAA8B;IAC9B,iCAAiC;IACjC,0BAA0B;IAC1B,uCAAuC;IACvC,sCAAsC;IACtC,iCAAiC;IACjC,oCAAoC;IACpC,yBAAyB;IACzB,kCAAkC;IAClC,8BAA8B;IAC9B,gBAAgB;IAChB,gBAAgB;IAChB,eAAe;IACf,qBAAqB;IACrB,eAAe;IACf,aAAa;IACb,aAAa;IACb,kBAAkB;IAClB,2BAA2B;IAC3B,gCAAgC;IAChC,6BAA6B;IAC7B,iBAAiB;IACjB,uBAAuB;IACvB,cAAc;IACd,kBAAkB;IAClB,sBAAsB;IACtBC,OAAO;IACPC,QAAQ;IACRC,WAAW;IACX,WAAW;IACX,eAAe;IACf,qBAAqB;IACrBC,YAAY;IACZC,MAAM;IACNC,OAAO;IACP,4BAA4B;IAC5BC,IAAI;IACJC,WAAW;IACXC,WAAW;IACXC,SAAS;IACT,yBAAyB;IACzB,gCAAgC;IAChC,kBAAkB;IAClB,2BAA2B;IAC3B,sBAAsB;IACtB,kBAAkB;IAClBC,KAAK;IACL,cAAc;IACdC,SAAS;IACT,aAAa;IACbC,OAAO;IACP,YAAY;IACZ,mBAAmB;IACnBC,SAAS;IACTC,MAAM;IACNC,KAAK;IACL,qBAAqB;IACrB,kBAAkB;IAClBC,IAAI;IACJC,QAAQ;IACR,sBAAsB;IACtBC,OAAO;IACP,aAAa;IACbC,UAAU;IACV,uBAAuB;IACvBC,KAAK;IACL,cAAc;IACd,sBAAsB;IACtB,kBAAkB;IAClBC,aAAa;IACb,qBAAqB;IACrBC,KAAK;IACL,gBAAgB;IAChB,YAAY;IACZC,QAAQ;IACR,kBAAkB;IAClBC,MAAM;IACNC,YAAY;IACZC,QAAQ;IACR,uEAAuE;IACvEC,OAAO;IACPC,KAAK;IACLC,IAAI;AACN,EAAW;AAGX;;;;;;CAMC,GACD,OAAO,MAAMC,kBAAkB;IAC7B,yEAAyE;IACzE;QAAC;QAAiB;QAAe;KAAiB;IAClD,iEAAiE;IACjE;QAAC;QAAwB;KAAiB;IAC1C;QAAC;QAA+B;KAAO;IACvC,qEAAqE;IACrE;QAAC;QAAU;QAAuB;KAAa;CAChD,CAAwE;AAEzE;;;;;;;;CAQC,GACD,OAAO,MAAMC,wBAAwB;IACnC;QACEC,QAAQ;QACRC,WAAW;YAAC;YAAiB;SAAc;QAC3CC,OAAO;YAAC;YAAsB;SAAsB;QACpDC,QACE;IACJ;CACD,CAKG;AAEJ;;;;CAIC,GACD,OAAO,MAAMC,eAAe,CAC1BC,aACAC;IAEAC,eAAeF,YAAYG,EAAE,EAAEF,MAAM;IACrC,OAAOG,OAAOC,WAAW,CACvBJ,KAAKK,GAAG,CAAC,CAACC,MAAQ;YAACA;YAAKjD,WAAW,CAACiD,IAAqB;SAAC;AAE9D,EAAE;AAEF;;;;;;;CAOC,GACD,OAAO,MAAMC,cAAc;IACzB;IACA;IACA;IACA;IACA;IACA;IACA;CACD,CAA6C;AAE9C;;;CAGC,GACD,OAAO,MAAMC,aAAanD,YAAYG,EAAE,CAAC;AAEzC;;CAEC,GACD,OAAO,MAAMiD,cAAc;IACzB,WAAW;IACX,mBAAmB;IACnB,kBAAkB;IAClB,iBAAiB;IACjBC,WAAW;IACX,yBAAyB;IACzB,iCAAiC;IACjC,iCAAiC;IACjC,4BAA4B;IAC5B,qBAAqB;IACrBC,OAAO;IACPC,SAAS;IACTC,SAAS;IACT,qBAAqB;IACrBC,OAAO;IACPC,WAAW;IACX,iBAAiB;IACjB,0BAA0B;IAC1BC,WAAW;IACX,4BAA4B;IAC5B,+BAA+B;IAC/BC,KAAK;IACL,qBAAqB;IACrB,gBAAgB;IAChBC,UAAU;IACVC,MAAM;IACN,kBAAkB;IAClB,uBAAuB;IACvB,wBAAwB;IACxBC,IAAI;IACJC,UAAU;IACVC,SAAS;IACTC,UAAU;IACVC,SAAS;IACTC,UAAU;IACVC,SAAS;IACT,4EAA4E;IAC5E,2EAA2E;IAC3E,4EAA4E;IAC5EC,UAAU;AACZ,EAAW;AAGX;;;;CAIC,GACD,OAAO,MAAMC,kBAAkB;IAC7B,wEAAwE;IACxE,oEAAoE;IACpE,oEAAoE;IACpE,8BAA8B;IAC9B,wBAAwB;QAAC;KAAiB;AAC5C,EAAuE;AAEvE;;CAEC,GACD,OAAO,MAAMC,iBAAiB,CAC5B9B,aACAC;IAEAC,eAAeF,YAAY+B,EAAE,EAAE9B,MAAM;IACrC,OAAOA,KAAKK,GAAG,CAAC,CAACC,MAAQ,GAAGA,MAAMG,WAAW,CAACH,IAAqB,EAAE;AACvE,EAAE;AAEF,uEAAuE,GACvE,MAAML,iBAAiB,CACrB8B,UACA/B,MACAgC;IAEA,MAAMC,QAAQ7E,cAAc2E;IAC5B,MAAMG,aAAalC,KAAKmC,MAAM,CAAC,CAAC7B,MAAQ,CAAC2B,MAAMG,QAAQ,CAAC9B;IACxD,IAAI4B,WAAWG,MAAM,GAAG,GAAG;QACzB,MAAM,IAAIC,MACR,CAAC,WAAW,EAAEN,KAAK,eAAe,EAAEE,WAAWK,IAAI,CAAC,MAAM,oDAAoD,EAAEP,KAAK,WAAW,CAAC;IAErI;AACF;AAEA;;CAEC,GACD,OAAO,MAAMQ,oBAAoB;IAC/B,eAAe;AACjB,EAAW;AAEX;;;;;CAKC,GACD,OAAO,MAAMC,gBAAgB;IAC3B,uCAAuC;IACvC,4CAA4C;IAC5C,kDAAkD;IAClD,yCAAyC;IACzC,mEAAmE;AACrE,EAAW;AAGX,6EAA6E,GAC7E,OAAO,MAAMC,iBAAiBvC,OAAOwC,IAAI,CAACF,eAAiC;AAE3E,iFAAiF,GACjF,OAAO,MAAMG,sBAAsB,CAACC,WAClC,GAAGA,SAAS,CAAC,EAAEJ,aAAa,CAACI,SAAS,EAAE,CAAC;AAE3C;;;;;;CAMC,GACD,OAAO,MAAMC,gBAAgB;IAC3BC,QAAQ;AACV,EAAW;AAGX,8EAA8E,GAC9E,OAAO,MAAMC,aAAa7C,OAAOwC,IAAI,CAACG,eAAiC;AAEvE;;;;CAIC,GACD,OAAO,MAAMG,cAAc;IACzBC,MAAM;IACNC,QAAQ;AACV,EAAW;AAEX;;;CAGC,GACD,OAAO,MAAMC,qBAAqB;IAChC,qEAAqE;IACrEC,OAAO;AACT,EAAW;AAEX;;;;;CAKC,GACD,OAAO,MAAMC,yBAAyB;IACpCD,OAAO;AACT,EAAqE;AAErE,wEAAwE,GACxE,OAAO,MAAME,iBAAiB,CAACC,OAC7B,GAAGF,sBAAsB,CAACE,KAAK,CAAC,CAAC,EAAEJ,kBAAkB,CAACI,KAAK,EAAE,CAAC;AAEhE;;;;;;;CAOC,GACD,OAAO,MAAMC,0BAA0B;IACrCP,MAAM;IACNC,QAAQ;AACV,EAAW;AAGX;;;;;;;;;CASC,GACD,OAAO,MAAMO,8BAA8B;IACzCR,MAAM;IACNC,QAAQ;AACV,EAAW;AAGX;;;CAGC,GACD,OAAO,MAAMQ,mBAAmB,CAACC,UAC/BA,YAAY,SACR,CAAC,KAAK,EAAEF,4BAA4BR,IAAI,EAAE,GAC1C,CAAC,OAAO,EAAEQ,4BAA4BP,MAAM,CAACU,OAAO,CAAC,KAAK,MAAM,CAAC;AAEvE;;;;;;;;CAQC,GACD,OAAO,MAAMC,qBAAqB,IAAcL,wBAAwBN,MAAM,CAAC;AAE/E;;;;;;CAMC,GACD,OAAO,MAAMY,4BAA4B,IACvC,CAAC,EAAE,EAAEN,wBAAwBN,MAAM,EAAE,CAAC;AAExC,gFAAgF,GAChF,OAAO,MAAMa,yBAAyB,CAACJ,UACrCA,YAAY,SACR,CAAC,MAAM,EAAEH,wBAAwBP,IAAI,CAAC,EAAE,CAAC,GACzC,CAAC,MAAM,EAAEO,wBAAwBN,MAAM,EAAE,CAAC;AAEhD;;;CAGC,GACD,OAAO,MAAMc,mBAAmB,CAACL,UAC/BA,YAAY,SACR,CAAC,eAAe,EAAEH,wBAAwBP,IAAI,CAAC,EAAE,CAAC,GAClD,CAAC,eAAe,EAAEO,wBAAwBN,MAAM,CAACU,OAAO,CAAC,KAAK,MAAM,CAAC;AAE3E;;;;;CAKC,GACD,OAAO,MAAMK,uBAAuB,IAAO,CAAA;QACzCC,aAAaF,iBAAiB;QAC9BG,eAAeH,iBAAiB;IAClC,CAAA,EAAG;AAEH;;;CAGC,GACD,OAAO,MAAMI,6BAA6B,IAAO,CAAA;QAC/CF,aAAaH,uBAAuB;QACpCI,eAAeJ,uBAAuB;IACxC,CAAA,EAAG;AAEH;;;CAGC,GACD,OAAO,MAAMM,qBAAqB;IAChCC,KAAK;IACLC,QAAQ;IACRC,MAAM;IACNC,SAAS;IACTC,UAAU;IACVC,OAAO;IACPC,MAAM;AACR,EAAW;AAGX;;;CAGC,GACD,OAAO,MAAMC,4BAA4B,IAAO,CAAA;QAC9CC,oBAAoBT,mBAAmBC,GAAG;QAC1CS,uBAAuBV,mBAAmBE,MAAM;QAChDS,qBAAqBX,mBAAmBG,IAAI;QAC5CS,wBAAwBZ,mBAAmBI,OAAO;QAClDS,yBAAyBb,mBAAmBK,QAAQ;QACpDS,sBAAsBd,mBAAmBM,KAAK;QAC9CS,qBAAqBf,mBAAmBO,IAAI;IAC9C,CAAA,EAAG"}