@aws/nx-plugin 1.0.2 → 1.0.3

package/src/terraform/project/generator.js

@@ -112,11 +112,10 @@ export async function terraformProjectGenerator(tree, schema) {
     const distDir = joinPathFragments(outDirToRootRelativePath, 'dist', '{projectRoot}');
     const tfDistDir = joinPathFragments(distDir, 'terraform');
     const checkovReportJsonPath = joinPathFragments(distDir, 'checkov', 'checkov_report.json');
-    // `test` and `validate` each keep their `.terraform` here rather than in
-    // `src`, so initialising one never races the backend-configured targets, or
-    // the other, over the shared one.
-    const testDataDir = joinPathFragments(distDir, 'terraform-test');
-    const validateDataDir = joinPathFragments(distDir, 'terraform-validate');
+    // `terraform-init` keeps its `.terraform` here rather than in `src`, so it
+    // never races the backend-configured targets over the shared one. `test` and
+    // `validate` read this same directory rather than initialising their own.
+    const initDataDir = joinPathFragments(distDir, 'terraform-init');
     // Provider downloads persist here, so a target whose `.terraform` was cleaned
     // links the providers it already has rather than re-downloading them. Nx does
     // not interpolate `{workspaceRoot}` inside `env`, so this is relative to the
@@ -128,7 +127,8 @@ export async function terraformProjectGenerator(tree, schema) {
     // init` runs filling a shared cache concurrently each compute a different hash
     // for the same provider, because the hash covers a directory the other is
     // still writing, and terraform then rejects the mismatch against the lock
-    // file. Per project, no two writers ever meet, so the targets stay parallel.
+    // file. `terraform-init` is the only target that fills it, and the targets that
+    // need the providers depend on that one, so no two writers ever meet.
     const pluginCacheDir = joinPathFragments(outDirToRootRelativePath, '.terraform', 'plugin-cache', '{projectRoot}');
     // Calculate relative path from current project to common/terraform/metrics
     // Use forward slashes for terraform module source paths (even on Windows)
@@ -227,6 +227,7 @@ export async function terraformProjectGenerator(tree, schema) {
                 cwd: '{workspaceRoot}'
             },
             dependsOn: [
+                'terraform-init',
                 '^init'
             ]
         },
@@ -310,6 +311,32 @@ export async function terraformProjectGenerator(tree, schema) {
                 env: {
                     TF_PLUGIN_CACHE_DIR: pluginCacheDir
                 }
+            },
+            dependsOn: [
+                'terraform-init'
+            ]
+        },
+        // `-backend=false` installs the modules and providers without configuring
+        // the S3 backend, so this needs no credentials and runs on a fresh
+        // workspace before `bootstrap`. Uncached: a cache hit on another machine
+        // would report success over an empty `TF_DATA_DIR` and plugin cache.
+        'terraform-init': {
+            executor: 'nx:run-commands',
+            options: {
+                commands: [
+                    {
+                        command: `shx mkdir -p ${pluginCacheDir}`,
+                        forwardAllArgs: false
+                    },
+                    'terraform init -backend=false'
+                ],
+                forwardAllArgs: true,
+                cwd: '{projectRoot}/src',
+                parallel: false,
+                env: {
+                    TF_DATA_DIR: initDataDir,
+                    TF_PLUGIN_CACHE_DIR: pluginCacheDir
+                }
             }
         },
         // `^production` mirrors `test`: checkov resolves the relative modules a
@@ -331,14 +358,11 @@ export async function terraformProjectGenerator(tree, schema) {
             }
         },
         // Terraform's native test framework, which runs any `.tftest.hcl` files.
-        // A project with none is a no-op success.
-        //
-        // `-backend=false` installs the modules and providers the tests need
-        // without configuring the S3 backend, so this runs before `bootstrap` and
-        // needs no credentials. `TF_DATA_DIR` keeps that `.terraform` out of `src`,
-        // so it never races the backend-configured targets over the shared one.
-        // `^production` is what invalidates the cache when a consumed module
-        // changes; `{projectRoot}/**/*` alone would serve a stale pass.
+        // A project with none is a no-op success. Runs against the `TF_DATA_DIR`
+        // `terraform-init` prepared, so it needs no credentials and works on a fresh
+        // workspace before `bootstrap`. `^production` is what invalidates the cache
+        // when a consumed module changes; `{projectRoot}/**/*` alone would serve a
+        // stale pass.
         //
         // `TF_DATA_DIR` is terraform's working directory, not an artifact: its
         // provider entries are symlinks into the shared plugin cache, so restoring
@@ -354,29 +378,19 @@ export async function terraformProjectGenerator(tree, schema) {
             ],
             outputs: [],
             options: {
-                commands: [
-                    {
-                        command: `shx mkdir -p ${pluginCacheDir}`,
-                        forwardAllArgs: false
-                    },
-                    'terraform init -backend=false',
-                    'terraform test'
-                ],
+                command: 'terraform test',
                 forwardAllArgs: true,
                 cwd: '{projectRoot}/src',
-                parallel: false,
                 env: {
-                    TF_DATA_DIR: testDataDir,
-                    TF_PLUGIN_CACHE_DIR: pluginCacheDir
+                    TF_DATA_DIR: initDataDir
                 }
-            }
+            },
+            dependsOn: [
+                'terraform-init'
+            ]
         },
-        // Mirrors `test`: `-backend=false` installs the modules and providers
-        // validation needs without configuring the S3 backend, so this runs on a
-        // fresh workspace before `bootstrap` and needs no credentials. `TF_DATA_DIR`
-        // keeps that `.terraform` out of `src`, so it never races the
-        // backend-configured targets over the shared one, and declaring no outputs
-        // keeps a cache hit to what it asserts (see `test` above).
+        // Mirrors `test`: validates against the `TF_DATA_DIR` `terraform-init`
+        // prepared, and declares no outputs for the same reason (see `test` above).
         validate: {
             executor: 'nx:run-commands',
             cache: true,
@@ -386,22 +400,16 @@ export async function terraformProjectGenerator(tree, schema) {
             ],
             outputs: [],
             options: {
-                commands: [
-                    {
-                        command: `shx mkdir -p ${pluginCacheDir}`,
-                        forwardAllArgs: false
-                    },
-                    'terraform init -backend=false',
-                    'terraform validate'
-                ],
+                command: 'terraform validate',
                 forwardAllArgs: true,
                 cwd: '{projectRoot}/src',
-                parallel: false,
                 env: {
-                    TF_DATA_DIR: validateDataDir,
-                    TF_PLUGIN_CACHE_DIR: pluginCacheDir
+                    TF_DATA_DIR: initDataDir
                 }
-            }
+            },
+            dependsOn: [
+                'terraform-init'
+            ]
         }
     };
     const projectConfiguration = {

package/src/terraform/project/generator.js.map

@@ -1 +1 @@
-{"version":3,"sources":["../../../../../../packages/nx-plugin/src/terraform/project/generator.ts"],"sourcesContent":["/**\n * Copyright Amazon.com, Inc. or its affiliates. All Rights Reserved.\n * SPDX-License-Identifier: Apache-2.0\n */\nimport {\n  addProjectConfiguration,\n  detectPackageManager,\n  type GeneratorCallback,\n  generateFiles,\n  joinPathFragments,\n  OverwriteStrategy,\n  readNxJson,\n  type TargetConfiguration,\n  type Tree,\n  updateJson,\n  updateNxJson,\n} from '@nx/devkit';\nimport { join, relative } from 'path';\nimport { addLicenseCheckToLintTarget } from '../../license/config.js';\nimport { getTsLibDetails } from '../../ts/lib/generator.js';\nimport { addTsDependencies } from '../../utils/add-dependencies.js';\nimport {\n  declareDependencies,\n  ownedElsewhere,\n} from '../../utils/declared-dependencies.js';\nimport { formatFilesInSubtree } from '../../utils/format.js';\nimport { updateGitIgnore } from '../../utils/git.js';\nimport { installDependencies } from '../../utils/install.js';\nimport { addGeneratorMetricsIfApplicable } from '../../utils/metrics.js';\nimport { kebabCase } from '../../utils/names.js';\nimport {\n  addGeneratorMetadata,\n  getGeneratorInfo,\n  type NxGeneratorInfo,\n  projectExists,\n} from '../../utils/nx.js';\nimport { sortObjectKeys } from '../../utils/object.js';\nimport { uvxCommand } from '../../utils/py.js';\nimport { sharedConstructsGenerator } from '../../utils/shared-constructs.js';\nimport {\n  SHARED_CONSTRUCTS_DEPENDENCIES,\n  SHARED_TERRAFORM_DIR,\n  SHARED_TERRAFORM_NAME,\n} from '../../utils/shared-constructs-constants.js';\nimport {\n  terraformProviderVersions,\n  withVersions,\n} from '../../utils/versions.js';\nimport type { TerraformProjectGeneratorSchema } from './schema';\n\n// Terraform projects carry no package.json, so their build tooling and the AWS\n// SDK the vended deploy scripts import are declared at the workspace root. This\n// generator records no metadata, so nothing a predicate could read.\nexport const DEPENDENCIES = declareDependencies()({\n  ts: [\n    { name: '@nx-extend/terraform', dev: true, root: true },\n    { name: 'shx', dev: true, root: true },\n    { name: 'tsx', dev: true, root: true },\n    { name: '@aws-sdk/client-s3', dev: true, root: true },\n    { name: '@aws-sdk/client-sts', dev: true, root: true },\n    { name: '@aws-sdk/credential-providers', dev: true, root: true },\n    { name: '@smithy/config-resolver', dev: true, root: true },\n    { name: '@smithy/node-config-provider', dev: true, root: true },\n    // Declared for its pinned version, which goes into npm's `overrides` below.\n    { name: '@nx/devkit', versionOnly: true },\n    ...ownedElsewhere(SHARED_CONSTRUCTS_DEPENDENCIES),\n  ],\n});\n\nconst NX_EXTEND_PLUGIN = '@nx-extend/terraform';\nexport const TERRAFORM_PROJECT_GENERATOR_INFO: NxGeneratorInfo =\n  getGeneratorInfo(import.meta.filename);\n\n/**\n * Checks formatting, mirroring the TypeScript and Python `format` targets: the\n * base target fails on an unformatted file and the `fix` configuration rewrites\n * it. Writing from the base target would rewrite the `default` input the hash is\n * computed over, so the target could never cache-hit.\n *\n * Scoped to the project's own `src` rather than `-recursive`, so it checks the\n * files the vended templates cover. `-diff` names what to fix when it fails.\n */\nexport const TERRAFORM_FORMAT_TARGET: TargetConfiguration = {\n  executor: 'nx:run-commands',\n  cache: true,\n  inputs: ['default'],\n  options: {\n    command: 'terraform fmt -check -diff',\n    forwardAllArgs: true,\n    cwd: '{projectRoot}/src',\n  },\n  configurations: {\n    fix: {\n      command: 'terraform fmt',\n    },\n    'skip-lint': {\n      // Cross-platform no-op (`true` is not available on Windows cmd).\n      command: 'node -e \"\"',\n    },\n  },\n};\n\nexport async function terraformProjectGenerator(\n  tree: Tree,\n  schema: TerraformProjectGeneratorSchema,\n): Promise<GeneratorCallback> {\n  // Just use getTsLibDetails as it isn't specific to TS\n  const lib = getTsLibDetails(tree, schema);\n  const { fullyQualifiedName: sharedTfProjectName } = getTsLibDetails(tree, {\n    name: SHARED_TERRAFORM_NAME,\n  });\n\n  const outDirToRootRelativePath = relative(\n    join(tree.root, lib.dir, 'src'),\n    tree.root,\n  ).replace(/\\\\/g, '/');\n  const distDir = joinPathFragments(\n    outDirToRootRelativePath,\n    'dist',\n    '{projectRoot}',\n  );\n  const tfDistDir = joinPathFragments(distDir, 'terraform');\n  const checkovReportJsonPath = joinPathFragments(\n    distDir,\n    'checkov',\n    'checkov_report.json',\n  );\n  // `test` and `validate` each keep their `.terraform` here rather than in\n  // `src`, so initialising one never races the backend-configured targets, or\n  // the other, over the shared one.\n  const testDataDir = joinPathFragments(distDir, 'terraform-test');\n  const validateDataDir = joinPathFragments(distDir, 'terraform-validate');\n\n  // Provider downloads persist here, so a target whose `.terraform` was cleaned\n  // links the providers it already has rather than re-downloading them. Nx does\n  // not interpolate `{workspaceRoot}` inside `env`, so this is relative to the\n  // target's `cwd`. It sits under `.terraform`, which this generator gitignores\n  // — that is also what keeps the providers out of Nx's file walk — and unlike\n  // `.nx/cache` it survives `nx reset`.\n  //\n  // One cache per project rather than one for the workspace: two `terraform\n  // init` runs filling a shared cache concurrently each compute a different hash\n  // for the same provider, because the hash covers a directory the other is\n  // still writing, and terraform then rejects the mismatch against the lock\n  // file. Per project, no two writers ever meet, so the targets stay parallel.\n  const pluginCacheDir = joinPathFragments(\n    outDirToRootRelativePath,\n    '.terraform',\n    'plugin-cache',\n    '{projectRoot}',\n  );\n\n  // Calculate relative path from current project to common/terraform/metrics\n  // Use forward slashes for terraform module source paths (even on Windows)\n  const metricsModulePath = relative(\n    join(tree.root, lib.dir, 'src'),\n    join(tree.root, 'packages', SHARED_TERRAFORM_DIR, 'src', 'metrics'),\n  ).replace(/\\\\/g, '/');\n\n  updateGitIgnore(tree, '.', (patterns) => [...patterns, '.terraform']);\n\n  const applicationTargets: {\n    [targetName: string]: TargetConfiguration;\n  } = {\n    apply: {\n      executor: 'nx:run-commands',\n      defaultConfiguration: 'dev',\n      configurations: {\n        dev: {\n          command: `terraform apply ${tfDistDir}/dev.tfplan`,\n        },\n      },\n      options: {\n        forwardAllArgs: true,\n        cwd: '{projectRoot}/src',\n      },\n      dependsOn: ['plan'],\n    },\n    bootstrap: {\n      executor: 'nx:run-commands',\n      options: {\n        forwardAllArgs: true,\n        commands: ['tsx {projectRoot}/scripts/bootstrap.ts {projectRoot}'],\n        cwd: '{workspaceRoot}',\n      },\n    },\n    'bootstrap-destroy': {\n      executor: 'nx:run-commands',\n      options: {\n        forwardAllArgs: true,\n        commands: [\n          'tsx {projectRoot}/scripts/bootstrap-destroy.ts {projectRoot}',\n        ],\n        cwd: '{workspaceRoot}',\n      },\n    },\n    build: {\n      dependsOn: ['format', 'checkov', 'test', `${sharedTfProjectName}:build`],\n    },\n    deploy: {\n      dependsOn: ['apply'],\n    },\n    // The artifact-only sibling of build, which `plan` depends on.\n    assemble: {\n      dependsOn: [`${sharedTfProjectName}:assemble`],\n    },\n    destroy: {\n      executor: 'nx:run-commands',\n      defaultConfiguration: 'dev',\n      configurations: {\n        dev: {\n          command: 'terraform destroy -var-file=env/dev.tfvars',\n        },\n      },\n      options: {\n        forwardAllArgs: true,\n        cwd: '{projectRoot}/src',\n      },\n      dependsOn: ['init'],\n    },\n    init: {\n      executor: 'nx:run-commands',\n      defaultConfiguration: 'dev',\n      configurations: {\n        dev: {\n          env: { TF_ENV: 'dev' },\n        },\n      },\n      options: {\n        forwardAllArgs: true,\n        commands: ['tsx {projectRoot}/scripts/init.ts {projectRoot}'],\n        cwd: '{workspaceRoot}',\n      },\n      dependsOn: ['^init'],\n    },\n    output: {\n      executor: 'nx:run-commands',\n      cache: true,\n      inputs: ['default'],\n      options: {\n        command: 'terraform output -json',\n        forwardAllArgs: true,\n        cwd: '{projectRoot}/src',\n      },\n    },\n    plan: {\n      executor: 'nx:run-commands',\n      defaultConfiguration: 'dev',\n      configurations: {\n        dev: {\n          commands: [\n            `shx mkdir -p ${tfDistDir}`,\n            `terraform plan -var-file=env/dev.tfvars -out=${tfDistDir}/dev.tfplan`,\n          ],\n        },\n      },\n      options: {\n        forwardAllArgs: true,\n        cwd: '{projectRoot}/src',\n        parallel: false,\n      },\n      dependsOn: ['init', 'validate', '^validate', 'assemble'],\n    },\n  };\n\n  const libTargets: {\n    [targetName: string]: TargetConfiguration;\n  } = {\n    build: {\n      dependsOn: ['format', 'checkov', 'test'],\n    },\n    // A Terraform library vends modules rather than a deployable artifact, so\n    // its `assemble` carries only whatever the consuming projects register on it.\n    assemble: {\n      executor: 'nx:noop',\n    },\n    format: TERRAFORM_FORMAT_TARGET,\n    // Terraform has no linter of its own, so `lint` orchestrates the format\n    // check. It exists so `nx run-many --target lint` reaches terraform\n    // projects, and so `--configuration=fix` and `--configuration=skip-lint`\n    // propagate to `format` the way they do for TypeScript and Python projects.\n    lint: {\n      dependsOn: ['format'],\n    },\n    init: {\n      executor: 'nx:run-commands',\n      defaultConfiguration: 'dev',\n      configurations: {\n        dev: {\n          commands: [\n            {\n              command: `shx mkdir -p ${pluginCacheDir}`,\n              forwardAllArgs: false,\n            },\n            'terraform init',\n          ],\n        },\n      },\n      options: {\n        forwardAllArgs: true,\n        cwd: '{projectRoot}/src',\n        parallel: false,\n        env: { TF_PLUGIN_CACHE_DIR: pluginCacheDir },\n      },\n    },\n    // `^production` mirrors `test`: checkov resolves the relative modules a\n    // project consumes, so a change in one must invalidate the scan.\n    checkov: {\n      executor: 'nx:run-commands',\n      cache: true,\n      inputs: ['default', '^production'],\n      outputs: ['{workspaceRoot}/dist/{projectRoot}/checkov'],\n      options: {\n        command: uvxCommand(\n          'checkov',\n          `--config-file ../checkov.yml --directory . -o cli -o json --output-file-path console,${checkovReportJsonPath}`,\n        ),\n        forwardAllArgs: true,\n        cwd: '{projectRoot}/src',\n      },\n    },\n    // Terraform's native test framework, which runs any `.tftest.hcl` files.\n    // A project with none is a no-op success.\n    //\n    // `-backend=false` installs the modules and providers the tests need\n    // without configuring the S3 backend, so this runs before `bootstrap` and\n    // needs no credentials. `TF_DATA_DIR` keeps that `.terraform` out of `src`,\n    // so it never races the backend-configured targets over the shared one.\n    // `^production` is what invalidates the cache when a consumed module\n    // changes; `{projectRoot}/**/*` alone would serve a stale pass.\n    //\n    // `TF_DATA_DIR` is terraform's working directory, not an artifact: its\n    // provider entries are symlinks into the shared plugin cache, so restoring\n    // it on another machine would yield dangling links while the commands that\n    // repopulate them are skipped. Declaring no outputs keeps a cache hit to\n    // what it actually asserts — that the tests passed for these inputs.\n    test: {\n      executor: 'nx:run-commands',\n      cache: true,\n      inputs: ['default', '^production'],\n      outputs: [],\n      options: {\n        commands: [\n          { command: `shx mkdir -p ${pluginCacheDir}`, forwardAllArgs: false },\n          'terraform init -backend=false',\n          'terraform test',\n        ],\n        forwardAllArgs: true,\n        cwd: '{projectRoot}/src',\n        parallel: false,\n        env: { TF_DATA_DIR: testDataDir, TF_PLUGIN_CACHE_DIR: pluginCacheDir },\n      },\n    },\n    // Mirrors `test`: `-backend=false` installs the modules and providers\n    // validation needs without configuring the S3 backend, so this runs on a\n    // fresh workspace before `bootstrap` and needs no credentials. `TF_DATA_DIR`\n    // keeps that `.terraform` out of `src`, so it never races the\n    // backend-configured targets over the shared one, and declaring no outputs\n    // keeps a cache hit to what it asserts (see `test` above).\n    validate: {\n      executor: 'nx:run-commands',\n      cache: true,\n      inputs: ['default', '^production'],\n      outputs: [],\n      options: {\n        commands: [\n          { command: `shx mkdir -p ${pluginCacheDir}`, forwardAllArgs: false },\n          'terraform init -backend=false',\n          'terraform validate',\n        ],\n        forwardAllArgs: true,\n        cwd: '{projectRoot}/src',\n        parallel: false,\n        env: {\n          TF_DATA_DIR: validateDataDir,\n          TF_PLUGIN_CACHE_DIR: pluginCacheDir,\n        },\n      },\n    },\n  };\n\n  const projectConfiguration = {\n    root: lib.dir,\n    projectType: schema.type,\n    sourceRoot: joinPathFragments(lib.dir, 'src'),\n    targets: sortObjectKeys({\n      ...libTargets,\n      ...(schema.type === 'application' ? applicationTargets : {}),\n    }),\n  };\n\n  // Only create the project configuration on first run; skip it on re-run so\n  // existing project.json customisations are preserved.\n  if (!projectExists(tree, lib.fullyQualifiedName)) {\n    addProjectConfiguration(tree, lib.fullyQualifiedName, projectConfiguration);\n  }\n\n  // The `lint` target checks licenses alongside formatting, as it does for\n  // TypeScript and Python projects.\n  addLicenseCheckToLintTarget(tree, lib.fullyQualifiedName);\n\n  // This generator IS the Terraform project, so the provider is fixed.\n  addGeneratorMetadata(\n    tree,\n    lib.fullyQualifiedName,\n    TERRAFORM_PROJECT_GENERATOR_INFO,\n    { iac: 'terraform' },\n  );\n\n  // The guides tell the reader to declare resources in `main.tf`, add variables\n  // and outputs, and configure environments in `env/*.tfvars`, so everything\n  // here is scaffolded once and then left alone. Provider version bumps reach\n  // `providers.tf` through the vended version sync, which rewrites the pin in\n  // place rather than the whole file.\n  generateFiles(\n    tree,\n    joinPathFragments(import.meta.dirname, `./files/${schema.type}`),\n    lib.dir,\n    {\n      metricsModulePath,\n      stateKeyPrefix: kebabCase(lib.fullyQualifiedName),\n      ...terraformProviderVersions(),\n    },\n    {\n      overwriteStrategy: OverwriteStrategy.KeepExisting,\n    },\n  );\n\n  // Checkov skips are the user's to curate, so preserve any they have added.\n  generateFiles(\n    tree,\n    joinPathFragments(import.meta.dirname, './files/checkov'),\n    lib.dir,\n    {},\n    {\n      overwriteStrategy: OverwriteStrategy.KeepExisting,\n    },\n  );\n\n  const nxJson = readNxJson(tree);\n\n  if (\n    !nxJson.plugins?.find((p) =>\n      typeof p === 'string'\n        ? p === NX_EXTEND_PLUGIN\n        : p.plugin === NX_EXTEND_PLUGIN,\n    )\n  ) {\n    nxJson.plugins = [...(nxJson.plugins ?? []), NX_EXTEND_PLUGIN];\n    updateNxJson(tree, nxJson);\n  }\n\n  // Ensure shared constructs for Terraform are created\n  await sharedConstructsGenerator(tree, { iac: 'terraform' }, DEPENDENCIES);\n\n  // Add Terraform metrics\n  await addGeneratorMetricsIfApplicable(tree, [\n    TERRAFORM_PROJECT_GENERATOR_INFO,\n  ]);\n\n  addTsDependencies(tree, DEPENDENCIES);\n\n  // @nx-extend/terraform has a peer dependency on @nx/devkit ^21.0.0 which causes\n  // npm install to fail, so for NPM we add a resolution\n  // Can remove when https://github.com/TriPSs/nx-extend/issues/407 is addressed\n  if (detectPackageManager() === 'npm') {\n    updateJson(tree, 'package.json', (packageJson) => {\n      packageJson.overrides = {\n        ...packageJson.overrides,\n        ...withVersions(DEPENDENCIES, ['@nx/devkit']),\n      };\n      return packageJson;\n    });\n  }\n\n  // `updateProjectConfiguration` re-serialises project.json with every inline\n  // array expanded, which the vended `format` target rejects.\n  await formatFilesInSubtree(tree);\n\n  // `@nx-extend/terraform` is registered as an Nx plugin in nx.json, so Nx\n  // loads it when computing the project graph — it must resolve even if the\n  // caller would otherwise prefer to defer installing.\n  return () =>\n    installDependencies(tree, schema.preferInstallDependencies, {\n      languages: ['typescript'],\n      ensureResolvable: [NX_EXTEND_PLUGIN],\n    });\n}\nexport default terraformProjectGenerator;\n"],"names":["addProjectConfiguration","detectPackageManager","generateFiles","joinPathFragments","OverwriteStrategy","readNxJson","updateJson","updateNxJson","join","relative","addLicenseCheckToLintTarget","getTsLibDetails","addTsDependencies","declareDependencies","ownedElsewhere","formatFilesInSubtree","updateGitIgnore","installDependencies","addGeneratorMetricsIfApplicable","kebabCase","addGeneratorMetadata","getGeneratorInfo","projectExists","sortObjectKeys","uvxCommand","sharedConstructsGenerator","SHARED_CONSTRUCTS_DEPENDENCIES","SHARED_TERRAFORM_DIR","SHARED_TERRAFORM_NAME","terraformProviderVersions","withVersions","DEPENDENCIES","ts","name","dev","root","versionOnly","NX_EXTEND_PLUGIN","TERRAFORM_PROJECT_GENERATOR_INFO","filename","TERRAFORM_FORMAT_TARGET","executor","cache","inputs","options","command","forwardAllArgs","cwd","configurations","fix","terraformProjectGenerator","tree","schema","lib","fullyQualifiedName","sharedTfProjectName","outDirToRootRelativePath","dir","replace","distDir","tfDistDir","checkovReportJsonPath","testDataDir","validateDataDir","pluginCacheDir","metricsModulePath","patterns","applicationTargets","apply","defaultConfiguration","dependsOn","bootstrap","commands","build","deploy","assemble","destroy","init","env","TF_ENV","output","plan","parallel","libTargets","format","lint","TF_PLUGIN_CACHE_DIR","checkov","outputs","test","TF_DATA_DIR","validate","projectConfiguration","projectType","type","sourceRoot","targets","iac","dirname","stateKeyPrefix","overwriteStrategy","KeepExisting","nxJson","plugins","find","p","plugin","packageJson","overrides","preferInstallDependencies","languages","ensureResolvable"],"mappings":"AAAA;;;CAGC,GACD,SACEA,uBAAuB,EACvBC,oBAAoB,EAEpBC,aAAa,EACbC,iBAAiB,EACjBC,iBAAiB,EACjBC,UAAU,EAGVC,UAAU,EACVC,YAAY,QACP,aAAa;AACpB,SAASC,IAAI,EAAEC,QAAQ,QAAQ,OAAO;AACtC,SAASC,2BAA2B,QAAQ,0BAA0B;AACtE,SAASC,eAAe,QAAQ,4BAA4B;AAC5D,SAASC,iBAAiB,QAAQ,kCAAkC;AACpE,SACEC,mBAAmB,EACnBC,cAAc,QACT,uCAAuC;AAC9C,SAASC,oBAAoB,QAAQ,wBAAwB;AAC7D,SAASC,eAAe,QAAQ,qBAAqB;AACrD,SAASC,mBAAmB,QAAQ,yBAAyB;AAC7D,SAASC,+BAA+B,QAAQ,yBAAyB;AACzE,SAASC,SAAS,QAAQ,uBAAuB;AACjD,SACEC,oBAAoB,EACpBC,gBAAgB,EAEhBC,aAAa,QACR,oBAAoB;AAC3B,SAASC,cAAc,QAAQ,wBAAwB;AACvD,SAASC,UAAU,QAAQ,oBAAoB;AAC/C,SAASC,yBAAyB,QAAQ,mCAAmC;AAC7E,SACEC,8BAA8B,EAC9BC,oBAAoB,EACpBC,qBAAqB,QAChB,6CAA6C;AACpD,SACEC,yBAAyB,EACzBC,YAAY,QACP,0BAA0B;AAGjC,+EAA+E;AAC/E,gFAAgF;AAChF,oEAAoE;AACpE,OAAO,MAAMC,eAAelB,sBAAsB;IAChDmB,IAAI;QACF;YAAEC,MAAM;YAAwBC,KAAK;YAAMC,MAAM;QAAK;QACtD;YAAEF,MAAM;YAAOC,KAAK;YAAMC,MAAM;QAAK;QACrC;YAAEF,MAAM;YAAOC,KAAK;YAAMC,MAAM;QAAK;QACrC;YAAEF,MAAM;YAAsBC,KAAK;YAAMC,MAAM;QAAK;QACpD;YAAEF,MAAM;YAAuBC,KAAK;YAAMC,MAAM;QAAK;QACrD;YAAEF,MAAM;YAAiCC,KAAK;YAAMC,MAAM;QAAK;QAC/D;YAAEF,MAAM;YAA2BC,KAAK;YAAMC,MAAM;QAAK;QACzD;YAAEF,MAAM;YAAgCC,KAAK;YAAMC,MAAM;QAAK;QAC9D,4EAA4E;QAC5E;YAAEF,MAAM;YAAcG,aAAa;QAAK;WACrCtB,eAAeY;KACnB;AACH,GAAG;AAEH,MAAMW,mBAAmB;AACzB,OAAO,MAAMC,mCACXjB,iBAAiB,YAAYkB,QAAQ,EAAE;AAEzC;;;;;;;;CAQC,GACD,OAAO,MAAMC,0BAA+C;IAC1DC,UAAU;IACVC,OAAO;IACPC,QAAQ;QAAC;KAAU;IACnBC,SAAS;QACPC,SAAS;QACTC,gBAAgB;QAChBC,KAAK;IACP;IACAC,gBAAgB;QACdC,KAAK;YACHJ,SAAS;QACX;QACA,aAAa;YACX,iEAAiE;YACjEA,SAAS;QACX;IACF;AACF,EAAE;AAEF,OAAO,eAAeK,0BACpBC,IAAU,EACVC,MAAuC;IAEvC,sDAAsD;IACtD,MAAMC,MAAM1C,gBAAgBwC,MAAMC;IAClC,MAAM,EAAEE,oBAAoBC,mBAAmB,EAAE,GAAG5C,gBAAgBwC,MAAM;QACxElB,MAAML;IACR;IAEA,MAAM4B,2BAA2B/C,SAC/BD,KAAK2C,KAAKhB,IAAI,EAAEkB,IAAII,GAAG,EAAE,QACzBN,KAAKhB,IAAI,EACTuB,OAAO,CAAC,OAAO;IACjB,MAAMC,UAAUxD,kBACdqD,0BACA,QACA;IAEF,MAAMI,YAAYzD,kBAAkBwD,SAAS;IAC7C,MAAME,wBAAwB1D,kBAC5BwD,SACA,WACA;IAEF,yEAAyE;IACzE,4EAA4E;IAC5E,kCAAkC;IAClC,MAAMG,cAAc3D,kBAAkBwD,SAAS;IAC/C,MAAMI,kBAAkB5D,kBAAkBwD,SAAS;IAEnD,8EAA8E;IAC9E,8EAA8E;IAC9E,6EAA6E;IAC7E,8EAA8E;IAC9E,6EAA6E;IAC7E,sCAAsC;IACtC,EAAE;IACF,0EAA0E;IAC1E,+EAA+E;IAC/E,0EAA0E;IAC1E,0EAA0E;IAC1E,6EAA6E;IAC7E,MAAMK,iBAAiB7D,kBACrBqD,0BACA,cACA,gBACA;IAGF,2EAA2E;IAC3E,0EAA0E;IAC1E,MAAMS,oBAAoBxD,SACxBD,KAAK2C,KAAKhB,IAAI,EAAEkB,IAAII,GAAG,EAAE,QACzBjD,KAAK2C,KAAKhB,IAAI,EAAE,YAAYR,sBAAsB,OAAO,YACzD+B,OAAO,CAAC,OAAO;IAEjB1C,gBAAgBmC,MAAM,KAAK,CAACe,WAAa;eAAIA;YAAU;SAAa;IAEpE,MAAMC,qBAEF;QACFC,OAAO;YACL3B,UAAU;YACV4B,sBAAsB;YACtBrB,gBAAgB;gBACdd,KAAK;oBACHW,SAAS,CAAC,gBAAgB,EAAEe,UAAU,WAAW,CAAC;gBACpD;YACF;YACAhB,SAAS;gBACPE,gBAAgB;gBAChBC,KAAK;YACP;YACAuB,WAAW;gBAAC;aAAO;QACrB;QACAC,WAAW;YACT9B,UAAU;YACVG,SAAS;gBACPE,gBAAgB;gBAChB0B,UAAU;oBAAC;iBAAuD;gBAClEzB,KAAK;YACP;QACF;QACA,qBAAqB;YACnBN,UAAU;YACVG,SAAS;gBACPE,gBAAgB;gBAChB0B,UAAU;oBACR;iBACD;gBACDzB,KAAK;YACP;QACF;QACA0B,OAAO;YACLH,WAAW;gBAAC;gBAAU;gBAAW;gBAAQ,GAAGf,oBAAoB,MAAM,CAAC;aAAC;QAC1E;QACAmB,QAAQ;YACNJ,WAAW;gBAAC;aAAQ;QACtB;QACA,+DAA+D;QAC/DK,UAAU;YACRL,WAAW;gBAAC,GAAGf,oBAAoB,SAAS,CAAC;aAAC;QAChD;QACAqB,SAAS;YACPnC,UAAU;YACV4B,sBAAsB;YACtBrB,gBAAgB;gBACdd,KAAK;oBACHW,SAAS;gBACX;YACF;YACAD,SAAS;gBACPE,gBAAgB;gBAChBC,KAAK;YACP;YACAuB,WAAW;gBAAC;aAAO;QACrB;QACAO,MAAM;YACJpC,UAAU;YACV4B,sBAAsB;YACtBrB,gBAAgB;gBACdd,KAAK;oBACH4C,KAAK;wBAAEC,QAAQ;oBAAM;gBACvB;YACF;YACAnC,SAAS;gBACPE,gBAAgB;gBAChB0B,UAAU;oBAAC;iBAAkD;gBAC7DzB,KAAK;YACP;YACAuB,WAAW;gBAAC;aAAQ;QACtB;QACAU,QAAQ;YACNvC,UAAU;YACVC,OAAO;YACPC,QAAQ;gBAAC;aAAU;YACnBC,SAAS;gBACPC,SAAS;gBACTC,gBAAgB;gBAChBC,KAAK;YACP;QACF;QACAkC,MAAM;YACJxC,UAAU;YACV4B,sBAAsB;YACtBrB,gBAAgB;gBACdd,KAAK;oBACHsC,UAAU;wBACR,CAAC,aAAa,EAAEZ,WAAW;wBAC3B,CAAC,6CAA6C,EAAEA,UAAU,WAAW,CAAC;qBACvE;gBACH;YACF;YACAhB,SAAS;gBACPE,gBAAgB;gBAChBC,KAAK;gBACLmC,UAAU;YACZ;YACAZ,WAAW;gBAAC;gBAAQ;gBAAY;gBAAa;aAAW;QAC1D;IACF;IAEA,MAAMa,aAEF;QACFV,OAAO;YACLH,WAAW;gBAAC;gBAAU;gBAAW;aAAO;QAC1C;QACA,0EAA0E;QAC1E,8EAA8E;QAC9EK,UAAU;YACRlC,UAAU;QACZ;QACA2C,QAAQ5C;QACR,wEAAwE;QACxE,oEAAoE;QACpE,yEAAyE;QACzE,4EAA4E;QAC5E6C,MAAM;YACJf,WAAW;gBAAC;aAAS;QACvB;QACAO,MAAM;YACJpC,UAAU;YACV4B,sBAAsB;YACtBrB,gBAAgB;gBACdd,KAAK;oBACHsC,UAAU;wBACR;4BACE3B,SAAS,CAAC,aAAa,EAAEmB,gBAAgB;4BACzClB,gBAAgB;wBAClB;wBACA;qBACD;gBACH;YACF;YACAF,SAAS;gBACPE,gBAAgB;gBAChBC,KAAK;gBACLmC,UAAU;gBACVJ,KAAK;oBAAEQ,qBAAqBtB;gBAAe;YAC7C;QACF;QACA,wEAAwE;QACxE,iEAAiE;QACjEuB,SAAS;YACP9C,UAAU;YACVC,OAAO;YACPC,QAAQ;gBAAC;gBAAW;aAAc;YAClC6C,SAAS;gBAAC;aAA6C;YACvD5C,SAAS;gBACPC,SAASrB,WACP,WACA,CAAC,qFAAqF,EAAEqC,uBAAuB;gBAEjHf,gBAAgB;gBAChBC,KAAK;YACP;QACF;QACA,yEAAyE;QACzE,0CAA0C;QAC1C,EAAE;QACF,qEAAqE;QACrE,0EAA0E;QAC1E,4EAA4E;QAC5E,wEAAwE;QACxE,qEAAqE;QACrE,gEAAgE;QAChE,EAAE;QACF,uEAAuE;QACvE,2EAA2E;QAC3E,2EAA2E;QAC3E,yEAAyE;QACzE,qEAAqE;QACrE0C,MAAM;YACJhD,UAAU;YACVC,OAAO;YACPC,QAAQ;gBAAC;gBAAW;aAAc;YAClC6C,SAAS,EAAE;YACX5C,SAAS;gBACP4B,UAAU;oBACR;wBAAE3B,SAAS,CAAC,aAAa,EAAEmB,gBAAgB;wBAAElB,gBAAgB;oBAAM;oBACnE;oBACA;iBACD;gBACDA,gBAAgB;gBAChBC,KAAK;gBACLmC,UAAU;gBACVJ,KAAK;oBAAEY,aAAa5B;oBAAawB,qBAAqBtB;gBAAe;YACvE;QACF;QACA,sEAAsE;QACtE,yEAAyE;QACzE,6EAA6E;QAC7E,8DAA8D;QAC9D,2EAA2E;QAC3E,2DAA2D;QAC3D2B,UAAU;YACRlD,UAAU;YACVC,OAAO;YACPC,QAAQ;gBAAC;gBAAW;aAAc;YAClC6C,SAAS,EAAE;YACX5C,SAAS;gBACP4B,UAAU;oBACR;wBAAE3B,SAAS,CAAC,aAAa,EAAEmB,gBAAgB;wBAAElB,gBAAgB;oBAAM;oBACnE;oBACA;iBACD;gBACDA,gBAAgB;gBAChBC,KAAK;gBACLmC,UAAU;gBACVJ,KAAK;oBACHY,aAAa3B;oBACbuB,qBAAqBtB;gBACvB;YACF;QACF;IACF;IAEA,MAAM4B,uBAAuB;QAC3BzD,MAAMkB,IAAII,GAAG;QACboC,aAAazC,OAAO0C,IAAI;QACxBC,YAAY5F,kBAAkBkD,IAAII,GAAG,EAAE;QACvCuC,SAASzE,eAAe;YACtB,GAAG4D,UAAU;YACb,GAAI/B,OAAO0C,IAAI,KAAK,gBAAgB3B,qBAAqB,CAAC,CAAC;QAC7D;IACF;IAEA,2EAA2E;IAC3E,sDAAsD;IACtD,IAAI,CAAC7C,cAAc6B,MAAME,IAAIC,kBAAkB,GAAG;QAChDtD,wBAAwBmD,MAAME,IAAIC,kBAAkB,EAAEsC;IACxD;IAEA,yEAAyE;IACzE,kCAAkC;IAClClF,4BAA4ByC,MAAME,IAAIC,kBAAkB;IAExD,qEAAqE;IACrElC,qBACE+B,MACAE,IAAIC,kBAAkB,EACtBhB,kCACA;QAAE2D,KAAK;IAAY;IAGrB,8EAA8E;IAC9E,2EAA2E;IAC3E,4EAA4E;IAC5E,4EAA4E;IAC5E,oCAAoC;IACpC/F,cACEiD,MACAhD,kBAAkB,YAAY+F,OAAO,EAAE,CAAC,QAAQ,EAAE9C,OAAO0C,IAAI,EAAE,GAC/DzC,IAAII,GAAG,EACP;QACEQ;QACAkC,gBAAgBhF,UAAUkC,IAAIC,kBAAkB;QAChD,GAAGzB,2BAA2B;IAChC,GACA;QACEuE,mBAAmBhG,kBAAkBiG,YAAY;IACnD;IAGF,2EAA2E;IAC3EnG,cACEiD,MACAhD,kBAAkB,YAAY+F,OAAO,EAAE,oBACvC7C,IAAII,GAAG,EACP,CAAC,GACD;QACE2C,mBAAmBhG,kBAAkBiG,YAAY;IACnD;IAGF,MAAMC,SAASjG,WAAW8C;IAE1B,IACE,CAACmD,OAAOC,OAAO,EAAEC,KAAK,CAACC,IACrB,OAAOA,MAAM,WACTA,MAAMpE,mBACNoE,EAAEC,MAAM,KAAKrE,mBAEnB;QACAiE,OAAOC,OAAO,GAAG;eAAKD,OAAOC,OAAO,IAAI,EAAE;YAAGlE;SAAiB;QAC9D9B,aAAa4C,MAAMmD;IACrB;IAEA,qDAAqD;IACrD,MAAM7E,0BAA0B0B,MAAM;QAAE8C,KAAK;IAAY,GAAGlE;IAE5D,wBAAwB;IACxB,MAAMb,gCAAgCiC,MAAM;QAC1Cb;KACD;IAED1B,kBAAkBuC,MAAMpB;IAExB,gFAAgF;IAChF,sDAAsD;IACtD,8EAA8E;IAC9E,IAAI9B,2BAA2B,OAAO;QACpCK,WAAW6C,MAAM,gBAAgB,CAACwD;YAChCA,YAAYC,SAAS,GAAG;gBACtB,GAAGD,YAAYC,SAAS;gBACxB,GAAG9E,aAAaC,cAAc;oBAAC;iBAAa,CAAC;YAC/C;YACA,OAAO4E;QACT;IACF;IAEA,4EAA4E;IAC5E,4DAA4D;IAC5D,MAAM5F,qBAAqBoC;IAE3B,yEAAyE;IACzE,0EAA0E;IAC1E,qDAAqD;IACrD,OAAO,IACLlC,oBAAoBkC,MAAMC,OAAOyD,yBAAyB,EAAE;YAC1DC,WAAW;gBAAC;aAAa;YACzBC,kBAAkB;gBAAC1E;aAAiB;QACtC;AACJ;AACA,eAAea,0BAA0B"}
+{"version":3,"sources":["../../../../../../packages/nx-plugin/src/terraform/project/generator.ts"],"sourcesContent":["/**\n * Copyright Amazon.com, Inc. or its affiliates. All Rights Reserved.\n * SPDX-License-Identifier: Apache-2.0\n */\nimport {\n  addProjectConfiguration,\n  detectPackageManager,\n  type GeneratorCallback,\n  generateFiles,\n  joinPathFragments,\n  OverwriteStrategy,\n  readNxJson,\n  type TargetConfiguration,\n  type Tree,\n  updateJson,\n  updateNxJson,\n} from '@nx/devkit';\nimport { join, relative } from 'path';\nimport { addLicenseCheckToLintTarget } from '../../license/config.js';\nimport { getTsLibDetails } from '../../ts/lib/generator.js';\nimport { addTsDependencies } from '../../utils/add-dependencies.js';\nimport {\n  declareDependencies,\n  ownedElsewhere,\n} from '../../utils/declared-dependencies.js';\nimport { formatFilesInSubtree } from '../../utils/format.js';\nimport { updateGitIgnore } from '../../utils/git.js';\nimport { installDependencies } from '../../utils/install.js';\nimport { addGeneratorMetricsIfApplicable } from '../../utils/metrics.js';\nimport { kebabCase } from '../../utils/names.js';\nimport {\n  addGeneratorMetadata,\n  getGeneratorInfo,\n  type NxGeneratorInfo,\n  projectExists,\n} from '../../utils/nx.js';\nimport { sortObjectKeys } from '../../utils/object.js';\nimport { uvxCommand } from '../../utils/py.js';\nimport { sharedConstructsGenerator } from '../../utils/shared-constructs.js';\nimport {\n  SHARED_CONSTRUCTS_DEPENDENCIES,\n  SHARED_TERRAFORM_DIR,\n  SHARED_TERRAFORM_NAME,\n} from '../../utils/shared-constructs-constants.js';\nimport {\n  terraformProviderVersions,\n  withVersions,\n} from '../../utils/versions.js';\nimport type { TerraformProjectGeneratorSchema } from './schema';\n\n// Terraform projects carry no package.json, so their build tooling and the AWS\n// SDK the vended deploy scripts import are declared at the workspace root. This\n// generator records no metadata, so nothing a predicate could read.\nexport const DEPENDENCIES = declareDependencies()({\n  ts: [\n    { name: '@nx-extend/terraform', dev: true, root: true },\n    { name: 'shx', dev: true, root: true },\n    { name: 'tsx', dev: true, root: true },\n    { name: '@aws-sdk/client-s3', dev: true, root: true },\n    { name: '@aws-sdk/client-sts', dev: true, root: true },\n    { name: '@aws-sdk/credential-providers', dev: true, root: true },\n    { name: '@smithy/config-resolver', dev: true, root: true },\n    { name: '@smithy/node-config-provider', dev: true, root: true },\n    // Declared for its pinned version, which goes into npm's `overrides` below.\n    { name: '@nx/devkit', versionOnly: true },\n    ...ownedElsewhere(SHARED_CONSTRUCTS_DEPENDENCIES),\n  ],\n});\n\nconst NX_EXTEND_PLUGIN = '@nx-extend/terraform';\nexport const TERRAFORM_PROJECT_GENERATOR_INFO: NxGeneratorInfo =\n  getGeneratorInfo(import.meta.filename);\n\n/**\n * Checks formatting, mirroring the TypeScript and Python `format` targets: the\n * base target fails on an unformatted file and the `fix` configuration rewrites\n * it. Writing from the base target would rewrite the `default` input the hash is\n * computed over, so the target could never cache-hit.\n *\n * Scoped to the project's own `src` rather than `-recursive`, so it checks the\n * files the vended templates cover. `-diff` names what to fix when it fails.\n */\nexport const TERRAFORM_FORMAT_TARGET: TargetConfiguration = {\n  executor: 'nx:run-commands',\n  cache: true,\n  inputs: ['default'],\n  options: {\n    command: 'terraform fmt -check -diff',\n    forwardAllArgs: true,\n    cwd: '{projectRoot}/src',\n  },\n  configurations: {\n    fix: {\n      command: 'terraform fmt',\n    },\n    'skip-lint': {\n      // Cross-platform no-op (`true` is not available on Windows cmd).\n      command: 'node -e \"\"',\n    },\n  },\n};\n\nexport async function terraformProjectGenerator(\n  tree: Tree,\n  schema: TerraformProjectGeneratorSchema,\n): Promise<GeneratorCallback> {\n  // Just use getTsLibDetails as it isn't specific to TS\n  const lib = getTsLibDetails(tree, schema);\n  const { fullyQualifiedName: sharedTfProjectName } = getTsLibDetails(tree, {\n    name: SHARED_TERRAFORM_NAME,\n  });\n\n  const outDirToRootRelativePath = relative(\n    join(tree.root, lib.dir, 'src'),\n    tree.root,\n  ).replace(/\\\\/g, '/');\n  const distDir = joinPathFragments(\n    outDirToRootRelativePath,\n    'dist',\n    '{projectRoot}',\n  );\n  const tfDistDir = joinPathFragments(distDir, 'terraform');\n  const checkovReportJsonPath = joinPathFragments(\n    distDir,\n    'checkov',\n    'checkov_report.json',\n  );\n  // `terraform-init` keeps its `.terraform` here rather than in `src`, so it\n  // never races the backend-configured targets over the shared one. `test` and\n  // `validate` read this same directory rather than initialising their own.\n  const initDataDir = joinPathFragments(distDir, 'terraform-init');\n\n  // Provider downloads persist here, so a target whose `.terraform` was cleaned\n  // links the providers it already has rather than re-downloading them. Nx does\n  // not interpolate `{workspaceRoot}` inside `env`, so this is relative to the\n  // target's `cwd`. It sits under `.terraform`, which this generator gitignores\n  // — that is also what keeps the providers out of Nx's file walk — and unlike\n  // `.nx/cache` it survives `nx reset`.\n  //\n  // One cache per project rather than one for the workspace: two `terraform\n  // init` runs filling a shared cache concurrently each compute a different hash\n  // for the same provider, because the hash covers a directory the other is\n  // still writing, and terraform then rejects the mismatch against the lock\n  // file. `terraform-init` is the only target that fills it, and the targets that\n  // need the providers depend on that one, so no two writers ever meet.\n  const pluginCacheDir = joinPathFragments(\n    outDirToRootRelativePath,\n    '.terraform',\n    'plugin-cache',\n    '{projectRoot}',\n  );\n\n  // Calculate relative path from current project to common/terraform/metrics\n  // Use forward slashes for terraform module source paths (even on Windows)\n  const metricsModulePath = relative(\n    join(tree.root, lib.dir, 'src'),\n    join(tree.root, 'packages', SHARED_TERRAFORM_DIR, 'src', 'metrics'),\n  ).replace(/\\\\/g, '/');\n\n  updateGitIgnore(tree, '.', (patterns) => [...patterns, '.terraform']);\n\n  const applicationTargets: {\n    [targetName: string]: TargetConfiguration;\n  } = {\n    apply: {\n      executor: 'nx:run-commands',\n      defaultConfiguration: 'dev',\n      configurations: {\n        dev: {\n          command: `terraform apply ${tfDistDir}/dev.tfplan`,\n        },\n      },\n      options: {\n        forwardAllArgs: true,\n        cwd: '{projectRoot}/src',\n      },\n      dependsOn: ['plan'],\n    },\n    bootstrap: {\n      executor: 'nx:run-commands',\n      options: {\n        forwardAllArgs: true,\n        commands: ['tsx {projectRoot}/scripts/bootstrap.ts {projectRoot}'],\n        cwd: '{workspaceRoot}',\n      },\n    },\n    'bootstrap-destroy': {\n      executor: 'nx:run-commands',\n      options: {\n        forwardAllArgs: true,\n        commands: [\n          'tsx {projectRoot}/scripts/bootstrap-destroy.ts {projectRoot}',\n        ],\n        cwd: '{workspaceRoot}',\n      },\n    },\n    build: {\n      dependsOn: ['format', 'checkov', 'test', `${sharedTfProjectName}:build`],\n    },\n    deploy: {\n      dependsOn: ['apply'],\n    },\n    // The artifact-only sibling of build, which `plan` depends on.\n    assemble: {\n      dependsOn: [`${sharedTfProjectName}:assemble`],\n    },\n    destroy: {\n      executor: 'nx:run-commands',\n      defaultConfiguration: 'dev',\n      configurations: {\n        dev: {\n          command: 'terraform destroy -var-file=env/dev.tfvars',\n        },\n      },\n      options: {\n        forwardAllArgs: true,\n        cwd: '{projectRoot}/src',\n      },\n      dependsOn: ['init'],\n    },\n    init: {\n      executor: 'nx:run-commands',\n      defaultConfiguration: 'dev',\n      configurations: {\n        dev: {\n          env: { TF_ENV: 'dev' },\n        },\n      },\n      options: {\n        forwardAllArgs: true,\n        commands: ['tsx {projectRoot}/scripts/init.ts {projectRoot}'],\n        cwd: '{workspaceRoot}',\n      },\n      dependsOn: ['terraform-init', '^init'],\n    },\n    output: {\n      executor: 'nx:run-commands',\n      cache: true,\n      inputs: ['default'],\n      options: {\n        command: 'terraform output -json',\n        forwardAllArgs: true,\n        cwd: '{projectRoot}/src',\n      },\n    },\n    plan: {\n      executor: 'nx:run-commands',\n      defaultConfiguration: 'dev',\n      configurations: {\n        dev: {\n          commands: [\n            `shx mkdir -p ${tfDistDir}`,\n            `terraform plan -var-file=env/dev.tfvars -out=${tfDistDir}/dev.tfplan`,\n          ],\n        },\n      },\n      options: {\n        forwardAllArgs: true,\n        cwd: '{projectRoot}/src',\n        parallel: false,\n      },\n      dependsOn: ['init', 'validate', '^validate', 'assemble'],\n    },\n  };\n\n  const libTargets: {\n    [targetName: string]: TargetConfiguration;\n  } = {\n    build: {\n      dependsOn: ['format', 'checkov', 'test'],\n    },\n    // A Terraform library vends modules rather than a deployable artifact, so\n    // its `assemble` carries only whatever the consuming projects register on it.\n    assemble: {\n      executor: 'nx:noop',\n    },\n    format: TERRAFORM_FORMAT_TARGET,\n    // Terraform has no linter of its own, so `lint` orchestrates the format\n    // check. It exists so `nx run-many --target lint` reaches terraform\n    // projects, and so `--configuration=fix` and `--configuration=skip-lint`\n    // propagate to `format` the way they do for TypeScript and Python projects.\n    lint: {\n      dependsOn: ['format'],\n    },\n    init: {\n      executor: 'nx:run-commands',\n      defaultConfiguration: 'dev',\n      configurations: {\n        dev: {\n          commands: [\n            {\n              command: `shx mkdir -p ${pluginCacheDir}`,\n              forwardAllArgs: false,\n            },\n            'terraform init',\n          ],\n        },\n      },\n      options: {\n        forwardAllArgs: true,\n        cwd: '{projectRoot}/src',\n        parallel: false,\n        env: { TF_PLUGIN_CACHE_DIR: pluginCacheDir },\n      },\n      dependsOn: ['terraform-init'],\n    },\n    // `-backend=false` installs the modules and providers without configuring\n    // the S3 backend, so this needs no credentials and runs on a fresh\n    // workspace before `bootstrap`. Uncached: a cache hit on another machine\n    // would report success over an empty `TF_DATA_DIR` and plugin cache.\n    'terraform-init': {\n      executor: 'nx:run-commands',\n      options: {\n        commands: [\n          { command: `shx mkdir -p ${pluginCacheDir}`, forwardAllArgs: false },\n          'terraform init -backend=false',\n        ],\n        forwardAllArgs: true,\n        cwd: '{projectRoot}/src',\n        parallel: false,\n        env: {\n          TF_DATA_DIR: initDataDir,\n          TF_PLUGIN_CACHE_DIR: pluginCacheDir,\n        },\n      },\n    },\n    // `^production` mirrors `test`: checkov resolves the relative modules a\n    // project consumes, so a change in one must invalidate the scan.\n    checkov: {\n      executor: 'nx:run-commands',\n      cache: true,\n      inputs: ['default', '^production'],\n      outputs: ['{workspaceRoot}/dist/{projectRoot}/checkov'],\n      options: {\n        command: uvxCommand(\n          'checkov',\n          `--config-file ../checkov.yml --directory . -o cli -o json --output-file-path console,${checkovReportJsonPath}`,\n        ),\n        forwardAllArgs: true,\n        cwd: '{projectRoot}/src',\n      },\n    },\n    // Terraform's native test framework, which runs any `.tftest.hcl` files.\n    // A project with none is a no-op success. Runs against the `TF_DATA_DIR`\n    // `terraform-init` prepared, so it needs no credentials and works on a fresh\n    // workspace before `bootstrap`. `^production` is what invalidates the cache\n    // when a consumed module changes; `{projectRoot}/**/*` alone would serve a\n    // stale pass.\n    //\n    // `TF_DATA_DIR` is terraform's working directory, not an artifact: its\n    // provider entries are symlinks into the shared plugin cache, so restoring\n    // it on another machine would yield dangling links while the commands that\n    // repopulate them are skipped. Declaring no outputs keeps a cache hit to\n    // what it actually asserts — that the tests passed for these inputs.\n    test: {\n      executor: 'nx:run-commands',\n      cache: true,\n      inputs: ['default', '^production'],\n      outputs: [],\n      options: {\n        command: 'terraform test',\n        forwardAllArgs: true,\n        cwd: '{projectRoot}/src',\n        env: { TF_DATA_DIR: initDataDir },\n      },\n      dependsOn: ['terraform-init'],\n    },\n    // Mirrors `test`: validates against the `TF_DATA_DIR` `terraform-init`\n    // prepared, and declares no outputs for the same reason (see `test` above).\n    validate: {\n      executor: 'nx:run-commands',\n      cache: true,\n      inputs: ['default', '^production'],\n      outputs: [],\n      options: {\n        command: 'terraform validate',\n        forwardAllArgs: true,\n        cwd: '{projectRoot}/src',\n        env: { TF_DATA_DIR: initDataDir },\n      },\n      dependsOn: ['terraform-init'],\n    },\n  };\n\n  const projectConfiguration = {\n    root: lib.dir,\n    projectType: schema.type,\n    sourceRoot: joinPathFragments(lib.dir, 'src'),\n    targets: sortObjectKeys({\n      ...libTargets,\n      ...(schema.type === 'application' ? applicationTargets : {}),\n    }),\n  };\n\n  // Only create the project configuration on first run; skip it on re-run so\n  // existing project.json customisations are preserved.\n  if (!projectExists(tree, lib.fullyQualifiedName)) {\n    addProjectConfiguration(tree, lib.fullyQualifiedName, projectConfiguration);\n  }\n\n  // The `lint` target checks licenses alongside formatting, as it does for\n  // TypeScript and Python projects.\n  addLicenseCheckToLintTarget(tree, lib.fullyQualifiedName);\n\n  // This generator IS the Terraform project, so the provider is fixed.\n  addGeneratorMetadata(\n    tree,\n    lib.fullyQualifiedName,\n    TERRAFORM_PROJECT_GENERATOR_INFO,\n    { iac: 'terraform' },\n  );\n\n  // The guides tell the reader to declare resources in `main.tf`, add variables\n  // and outputs, and configure environments in `env/*.tfvars`, so everything\n  // here is scaffolded once and then left alone. Provider version bumps reach\n  // `providers.tf` through the vended version sync, which rewrites the pin in\n  // place rather than the whole file.\n  generateFiles(\n    tree,\n    joinPathFragments(import.meta.dirname, `./files/${schema.type}`),\n    lib.dir,\n    {\n      metricsModulePath,\n      stateKeyPrefix: kebabCase(lib.fullyQualifiedName),\n      ...terraformProviderVersions(),\n    },\n    {\n      overwriteStrategy: OverwriteStrategy.KeepExisting,\n    },\n  );\n\n  // Checkov skips are the user's to curate, so preserve any they have added.\n  generateFiles(\n    tree,\n    joinPathFragments(import.meta.dirname, './files/checkov'),\n    lib.dir,\n    {},\n    {\n      overwriteStrategy: OverwriteStrategy.KeepExisting,\n    },\n  );\n\n  const nxJson = readNxJson(tree);\n\n  if (\n    !nxJson.plugins?.find((p) =>\n      typeof p === 'string'\n        ? p === NX_EXTEND_PLUGIN\n        : p.plugin === NX_EXTEND_PLUGIN,\n    )\n  ) {\n    nxJson.plugins = [...(nxJson.plugins ?? []), NX_EXTEND_PLUGIN];\n    updateNxJson(tree, nxJson);\n  }\n\n  // Ensure shared constructs for Terraform are created\n  await sharedConstructsGenerator(tree, { iac: 'terraform' }, DEPENDENCIES);\n\n  // Add Terraform metrics\n  await addGeneratorMetricsIfApplicable(tree, [\n    TERRAFORM_PROJECT_GENERATOR_INFO,\n  ]);\n\n  addTsDependencies(tree, DEPENDENCIES);\n\n  // @nx-extend/terraform has a peer dependency on @nx/devkit ^21.0.0 which causes\n  // npm install to fail, so for NPM we add a resolution\n  // Can remove when https://github.com/TriPSs/nx-extend/issues/407 is addressed\n  if (detectPackageManager() === 'npm') {\n    updateJson(tree, 'package.json', (packageJson) => {\n      packageJson.overrides = {\n        ...packageJson.overrides,\n        ...withVersions(DEPENDENCIES, ['@nx/devkit']),\n      };\n      return packageJson;\n    });\n  }\n\n  // `updateProjectConfiguration` re-serialises project.json with every inline\n  // array expanded, which the vended `format` target rejects.\n  await formatFilesInSubtree(tree);\n\n  // `@nx-extend/terraform` is registered as an Nx plugin in nx.json, so Nx\n  // loads it when computing the project graph — it must resolve even if the\n  // caller would otherwise prefer to defer installing.\n  return () =>\n    installDependencies(tree, schema.preferInstallDependencies, {\n      languages: ['typescript'],\n      ensureResolvable: [NX_EXTEND_PLUGIN],\n    });\n}\nexport default terraformProjectGenerator;\n"],"names":["addProjectConfiguration","detectPackageManager","generateFiles","joinPathFragments","OverwriteStrategy","readNxJson","updateJson","updateNxJson","join","relative","addLicenseCheckToLintTarget","getTsLibDetails","addTsDependencies","declareDependencies","ownedElsewhere","formatFilesInSubtree","updateGitIgnore","installDependencies","addGeneratorMetricsIfApplicable","kebabCase","addGeneratorMetadata","getGeneratorInfo","projectExists","sortObjectKeys","uvxCommand","sharedConstructsGenerator","SHARED_CONSTRUCTS_DEPENDENCIES","SHARED_TERRAFORM_DIR","SHARED_TERRAFORM_NAME","terraformProviderVersions","withVersions","DEPENDENCIES","ts","name","dev","root","versionOnly","NX_EXTEND_PLUGIN","TERRAFORM_PROJECT_GENERATOR_INFO","filename","TERRAFORM_FORMAT_TARGET","executor","cache","inputs","options","command","forwardAllArgs","cwd","configurations","fix","terraformProjectGenerator","tree","schema","lib","fullyQualifiedName","sharedTfProjectName","outDirToRootRelativePath","dir","replace","distDir","tfDistDir","checkovReportJsonPath","initDataDir","pluginCacheDir","metricsModulePath","patterns","applicationTargets","apply","defaultConfiguration","dependsOn","bootstrap","commands","build","deploy","assemble","destroy","init","env","TF_ENV","output","plan","parallel","libTargets","format","lint","TF_PLUGIN_CACHE_DIR","TF_DATA_DIR","checkov","outputs","test","validate","projectConfiguration","projectType","type","sourceRoot","targets","iac","dirname","stateKeyPrefix","overwriteStrategy","KeepExisting","nxJson","plugins","find","p","plugin","packageJson","overrides","preferInstallDependencies","languages","ensureResolvable"],"mappings":"AAAA;;;CAGC,GACD,SACEA,uBAAuB,EACvBC,oBAAoB,EAEpBC,aAAa,EACbC,iBAAiB,EACjBC,iBAAiB,EACjBC,UAAU,EAGVC,UAAU,EACVC,YAAY,QACP,aAAa;AACpB,SAASC,IAAI,EAAEC,QAAQ,QAAQ,OAAO;AACtC,SAASC,2BAA2B,QAAQ,0BAA0B;AACtE,SAASC,eAAe,QAAQ,4BAA4B;AAC5D,SAASC,iBAAiB,QAAQ,kCAAkC;AACpE,SACEC,mBAAmB,EACnBC,cAAc,QACT,uCAAuC;AAC9C,SAASC,oBAAoB,QAAQ,wBAAwB;AAC7D,SAASC,eAAe,QAAQ,qBAAqB;AACrD,SAASC,mBAAmB,QAAQ,yBAAyB;AAC7D,SAASC,+BAA+B,QAAQ,yBAAyB;AACzE,SAASC,SAAS,QAAQ,uBAAuB;AACjD,SACEC,oBAAoB,EACpBC,gBAAgB,EAEhBC,aAAa,QACR,oBAAoB;AAC3B,SAASC,cAAc,QAAQ,wBAAwB;AACvD,SAASC,UAAU,QAAQ,oBAAoB;AAC/C,SAASC,yBAAyB,QAAQ,mCAAmC;AAC7E,SACEC,8BAA8B,EAC9BC,oBAAoB,EACpBC,qBAAqB,QAChB,6CAA6C;AACpD,SACEC,yBAAyB,EACzBC,YAAY,QACP,0BAA0B;AAGjC,+EAA+E;AAC/E,gFAAgF;AAChF,oEAAoE;AACpE,OAAO,MAAMC,eAAelB,sBAAsB;IAChDmB,IAAI;QACF;YAAEC,MAAM;YAAwBC,KAAK;YAAMC,MAAM;QAAK;QACtD;YAAEF,MAAM;YAAOC,KAAK;YAAMC,MAAM;QAAK;QACrC;YAAEF,MAAM;YAAOC,KAAK;YAAMC,MAAM;QAAK;QACrC;YAAEF,MAAM;YAAsBC,KAAK;YAAMC,MAAM;QAAK;QACpD;YAAEF,MAAM;YAAuBC,KAAK;YAAMC,MAAM;QAAK;QACrD;YAAEF,MAAM;YAAiCC,KAAK;YAAMC,MAAM;QAAK;QAC/D;YAAEF,MAAM;YAA2BC,KAAK;YAAMC,MAAM;QAAK;QACzD;YAAEF,MAAM;YAAgCC,KAAK;YAAMC,MAAM;QAAK;QAC9D,4EAA4E;QAC5E;YAAEF,MAAM;YAAcG,aAAa;QAAK;WACrCtB,eAAeY;KACnB;AACH,GAAG;AAEH,MAAMW,mBAAmB;AACzB,OAAO,MAAMC,mCACXjB,iBAAiB,YAAYkB,QAAQ,EAAE;AAEzC;;;;;;;;CAQC,GACD,OAAO,MAAMC,0BAA+C;IAC1DC,UAAU;IACVC,OAAO;IACPC,QAAQ;QAAC;KAAU;IACnBC,SAAS;QACPC,SAAS;QACTC,gBAAgB;QAChBC,KAAK;IACP;IACAC,gBAAgB;QACdC,KAAK;YACHJ,SAAS;QACX;QACA,aAAa;YACX,iEAAiE;YACjEA,SAAS;QACX;IACF;AACF,EAAE;AAEF,OAAO,eAAeK,0BACpBC,IAAU,EACVC,MAAuC;IAEvC,sDAAsD;IACtD,MAAMC,MAAM1C,gBAAgBwC,MAAMC;IAClC,MAAM,EAAEE,oBAAoBC,mBAAmB,EAAE,GAAG5C,gBAAgBwC,MAAM;QACxElB,MAAML;IACR;IAEA,MAAM4B,2BAA2B/C,SAC/BD,KAAK2C,KAAKhB,IAAI,EAAEkB,IAAII,GAAG,EAAE,QACzBN,KAAKhB,IAAI,EACTuB,OAAO,CAAC,OAAO;IACjB,MAAMC,UAAUxD,kBACdqD,0BACA,QACA;IAEF,MAAMI,YAAYzD,kBAAkBwD,SAAS;IAC7C,MAAME,wBAAwB1D,kBAC5BwD,SACA,WACA;IAEF,2EAA2E;IAC3E,6EAA6E;IAC7E,0EAA0E;IAC1E,MAAMG,cAAc3D,kBAAkBwD,SAAS;IAE/C,8EAA8E;IAC9E,8EAA8E;IAC9E,6EAA6E;IAC7E,8EAA8E;IAC9E,6EAA6E;IAC7E,sCAAsC;IACtC,EAAE;IACF,0EAA0E;IAC1E,+EAA+E;IAC/E,0EAA0E;IAC1E,0EAA0E;IAC1E,gFAAgF;IAChF,sEAAsE;IACtE,MAAMI,iBAAiB5D,kBACrBqD,0BACA,cACA,gBACA;IAGF,2EAA2E;IAC3E,0EAA0E;IAC1E,MAAMQ,oBAAoBvD,SACxBD,KAAK2C,KAAKhB,IAAI,EAAEkB,IAAII,GAAG,EAAE,QACzBjD,KAAK2C,KAAKhB,IAAI,EAAE,YAAYR,sBAAsB,OAAO,YACzD+B,OAAO,CAAC,OAAO;IAEjB1C,gBAAgBmC,MAAM,KAAK,CAACc,WAAa;eAAIA;YAAU;SAAa;IAEpE,MAAMC,qBAEF;QACFC,OAAO;YACL1B,UAAU;YACV2B,sBAAsB;YACtBpB,gBAAgB;gBACdd,KAAK;oBACHW,SAAS,CAAC,gBAAgB,EAAEe,UAAU,WAAW,CAAC;gBACpD;YACF;YACAhB,SAAS;gBACPE,gBAAgB;gBAChBC,KAAK;YACP;YACAsB,WAAW;gBAAC;aAAO;QACrB;QACAC,WAAW;YACT7B,UAAU;YACVG,SAAS;gBACPE,gBAAgB;gBAChByB,UAAU;oBAAC;iBAAuD;gBAClExB,KAAK;YACP;QACF;QACA,qBAAqB;YACnBN,UAAU;YACVG,SAAS;gBACPE,gBAAgB;gBAChByB,UAAU;oBACR;iBACD;gBACDxB,KAAK;YACP;QACF;QACAyB,OAAO;YACLH,WAAW;gBAAC;gBAAU;gBAAW;gBAAQ,GAAGd,oBAAoB,MAAM,CAAC;aAAC;QAC1E;QACAkB,QAAQ;YACNJ,WAAW;gBAAC;aAAQ;QACtB;QACA,+DAA+D;QAC/DK,UAAU;YACRL,WAAW;gBAAC,GAAGd,oBAAoB,SAAS,CAAC;aAAC;QAChD;QACAoB,SAAS;YACPlC,UAAU;YACV2B,sBAAsB;YACtBpB,gBAAgB;gBACdd,KAAK;oBACHW,SAAS;gBACX;YACF;YACAD,SAAS;gBACPE,gBAAgB;gBAChBC,KAAK;YACP;YACAsB,WAAW;gBAAC;aAAO;QACrB;QACAO,MAAM;YACJnC,UAAU;YACV2B,sBAAsB;YACtBpB,gBAAgB;gBACdd,KAAK;oBACH2C,KAAK;wBAAEC,QAAQ;oBAAM;gBACvB;YACF;YACAlC,SAAS;gBACPE,gBAAgB;gBAChByB,UAAU;oBAAC;iBAAkD;gBAC7DxB,KAAK;YACP;YACAsB,WAAW;gBAAC;gBAAkB;aAAQ;QACxC;QACAU,QAAQ;YACNtC,UAAU;YACVC,OAAO;YACPC,QAAQ;gBAAC;aAAU;YACnBC,SAAS;gBACPC,SAAS;gBACTC,gBAAgB;gBAChBC,KAAK;YACP;QACF;QACAiC,MAAM;YACJvC,UAAU;YACV2B,sBAAsB;YACtBpB,gBAAgB;gBACdd,KAAK;oBACHqC,UAAU;wBACR,CAAC,aAAa,EAAEX,WAAW;wBAC3B,CAAC,6CAA6C,EAAEA,UAAU,WAAW,CAAC;qBACvE;gBACH;YACF;YACAhB,SAAS;gBACPE,gBAAgB;gBAChBC,KAAK;gBACLkC,UAAU;YACZ;YACAZ,WAAW;gBAAC;gBAAQ;gBAAY;gBAAa;aAAW;QAC1D;IACF;IAEA,MAAMa,aAEF;QACFV,OAAO;YACLH,WAAW;gBAAC;gBAAU;gBAAW;aAAO;QAC1C;QACA,0EAA0E;QAC1E,8EAA8E;QAC9EK,UAAU;YACRjC,UAAU;QACZ;QACA0C,QAAQ3C;QACR,wEAAwE;QACxE,oEAAoE;QACpE,yEAAyE;QACzE,4EAA4E;QAC5E4C,MAAM;YACJf,WAAW;gBAAC;aAAS;QACvB;QACAO,MAAM;YACJnC,UAAU;YACV2B,sBAAsB;YACtBpB,gBAAgB;gBACdd,KAAK;oBACHqC,UAAU;wBACR;4BACE1B,SAAS,CAAC,aAAa,EAAEkB,gBAAgB;4BACzCjB,gBAAgB;wBAClB;wBACA;qBACD;gBACH;YACF;YACAF,SAAS;gBACPE,gBAAgB;gBAChBC,KAAK;gBACLkC,UAAU;gBACVJ,KAAK;oBAAEQ,qBAAqBtB;gBAAe;YAC7C;YACAM,WAAW;gBAAC;aAAiB;QAC/B;QACA,0EAA0E;QAC1E,mEAAmE;QACnE,yEAAyE;QACzE,qEAAqE;QACrE,kBAAkB;YAChB5B,UAAU;YACVG,SAAS;gBACP2B,UAAU;oBACR;wBAAE1B,SAAS,CAAC,aAAa,EAAEkB,gBAAgB;wBAAEjB,gBAAgB;oBAAM;oBACnE;iBACD;gBACDA,gBAAgB;gBAChBC,KAAK;gBACLkC,UAAU;gBACVJ,KAAK;oBACHS,aAAaxB;oBACbuB,qBAAqBtB;gBACvB;YACF;QACF;QACA,wEAAwE;QACxE,iEAAiE;QACjEwB,SAAS;YACP9C,UAAU;YACVC,OAAO;YACPC,QAAQ;gBAAC;gBAAW;aAAc;YAClC6C,SAAS;gBAAC;aAA6C;YACvD5C,SAAS;gBACPC,SAASrB,WACP,WACA,CAAC,qFAAqF,EAAEqC,uBAAuB;gBAEjHf,gBAAgB;gBAChBC,KAAK;YACP;QACF;QACA,yEAAyE;QACzE,yEAAyE;QACzE,6EAA6E;QAC7E,4EAA4E;QAC5E,2EAA2E;QAC3E,cAAc;QACd,EAAE;QACF,uEAAuE;QACvE,2EAA2E;QAC3E,2EAA2E;QAC3E,yEAAyE;QACzE,qEAAqE;QACrE0C,MAAM;YACJhD,UAAU;YACVC,OAAO;YACPC,QAAQ;gBAAC;gBAAW;aAAc;YAClC6C,SAAS,EAAE;YACX5C,SAAS;gBACPC,SAAS;gBACTC,gBAAgB;gBAChBC,KAAK;gBACL8B,KAAK;oBAAES,aAAaxB;gBAAY;YAClC;YACAO,WAAW;gBAAC;aAAiB;QAC/B;QACA,uEAAuE;QACvE,4EAA4E;QAC5EqB,UAAU;YACRjD,UAAU;YACVC,OAAO;YACPC,QAAQ;gBAAC;gBAAW;aAAc;YAClC6C,SAAS,EAAE;YACX5C,SAAS;gBACPC,SAAS;gBACTC,gBAAgB;gBAChBC,KAAK;gBACL8B,KAAK;oBAAES,aAAaxB;gBAAY;YAClC;YACAO,WAAW;gBAAC;aAAiB;QAC/B;IACF;IAEA,MAAMsB,uBAAuB;QAC3BxD,MAAMkB,IAAII,GAAG;QACbmC,aAAaxC,OAAOyC,IAAI;QACxBC,YAAY3F,kBAAkBkD,IAAII,GAAG,EAAE;QACvCsC,SAASxE,eAAe;YACtB,GAAG2D,UAAU;YACb,GAAI9B,OAAOyC,IAAI,KAAK,gBAAgB3B,qBAAqB,CAAC,CAAC;QAC7D;IACF;IAEA,2EAA2E;IAC3E,sDAAsD;IACtD,IAAI,CAAC5C,cAAc6B,MAAME,IAAIC,kBAAkB,GAAG;QAChDtD,wBAAwBmD,MAAME,IAAIC,kBAAkB,EAAEqC;IACxD;IAEA,yEAAyE;IACzE,kCAAkC;IAClCjF,4BAA4ByC,MAAME,IAAIC,kBAAkB;IAExD,qEAAqE;IACrElC,qBACE+B,MACAE,IAAIC,kBAAkB,EACtBhB,kCACA;QAAE0D,KAAK;IAAY;IAGrB,8EAA8E;IAC9E,2EAA2E;IAC3E,4EAA4E;IAC5E,4EAA4E;IAC5E,oCAAoC;IACpC9F,cACEiD,MACAhD,kBAAkB,YAAY8F,OAAO,EAAE,CAAC,QAAQ,EAAE7C,OAAOyC,IAAI,EAAE,GAC/DxC,IAAII,GAAG,EACP;QACEO;QACAkC,gBAAgB/E,UAAUkC,IAAIC,kBAAkB;QAChD,GAAGzB,2BAA2B;IAChC,GACA;QACEsE,mBAAmB/F,kBAAkBgG,YAAY;IACnD;IAGF,2EAA2E;IAC3ElG,cACEiD,MACAhD,kBAAkB,YAAY8F,OAAO,EAAE,oBACvC5C,IAAII,GAAG,EACP,CAAC,GACD;QACE0C,mBAAmB/F,kBAAkBgG,YAAY;IACnD;IAGF,MAAMC,SAAShG,WAAW8C;IAE1B,IACE,CAACkD,OAAOC,OAAO,EAAEC,KAAK,CAACC,IACrB,OAAOA,MAAM,WACTA,MAAMnE,mBACNmE,EAAEC,MAAM,KAAKpE,mBAEnB;QACAgE,OAAOC,OAAO,GAAG;eAAKD,OAAOC,OAAO,IAAI,EAAE;YAAGjE;SAAiB;QAC9D9B,aAAa4C,MAAMkD;IACrB;IAEA,qDAAqD;IACrD,MAAM5E,0BAA0B0B,MAAM;QAAE6C,KAAK;IAAY,GAAGjE;IAE5D,wBAAwB;IACxB,MAAMb,gCAAgCiC,MAAM;QAC1Cb;KACD;IAED1B,kBAAkBuC,MAAMpB;IAExB,gFAAgF;IAChF,sDAAsD;IACtD,8EAA8E;IAC9E,IAAI9B,2BAA2B,OAAO;QACpCK,WAAW6C,MAAM,gBAAgB,CAACuD;YAChCA,YAAYC,SAAS,GAAG;gBACtB,GAAGD,YAAYC,SAAS;gBACxB,GAAG7E,aAAaC,cAAc;oBAAC;iBAAa,CAAC;YAC/C;YACA,OAAO2E;QACT;IACF;IAEA,4EAA4E;IAC5E,4DAA4D;IAC5D,MAAM3F,qBAAqBoC;IAE3B,yEAAyE;IACzE,0EAA0E;IAC1E,qDAAqD;IACrD,OAAO,IACLlC,oBAAoBkC,MAAMC,OAAOwD,yBAAyB,EAAE;YAC1DC,WAAW;gBAAC;aAAa;YACzBC,kBAAkB;gBAACzE;aAAiB;QACtC;AACJ;AACA,eAAea,0BAA0B"}

package/src/trpc/backend/__snapshots__/generator.spec.ts.snap

@@ -3175,7 +3175,7 @@ terraform {
   required_providers {
     aws = {
       source  = "hashicorp/aws"
-      version = "6.63.0"
+      version = "6.66.0"
     }
   }
 }
@@ -3422,15 +3422,15 @@ output "api_log_group_arn" {
   required_providers {
     archive = {
       source  = "hashicorp/archive"
-      version = "2.8.0"
+      version = "2.8.1"
     }
     aws = {
       source  = "hashicorp/aws"
-      version = "6.63.0"
+      version = "6.66.0"
     }
     random = {
       source  = "hashicorp/random"
-      version = "3.9.0"
+      version = "3.9.1"
     }
   }
 }
@@ -3990,7 +3990,7 @@ terraform {
   required_providers {
     aws = {
       source  = "hashicorp/aws"
-      version = "6.63.0"
+      version = "6.66.0"
     }
   }
 }
@@ -4237,15 +4237,15 @@ output "api_log_group_arn" {
   required_providers {
     archive = {
       source  = "hashicorp/archive"
-      version = "2.8.0"
+      version = "2.8.1"
     }
     aws = {
       source  = "hashicorp/aws"
-      version = "6.63.0"
+      version = "6.66.0"
     }
     random = {
       source  = "hashicorp/random"
-      version = "3.9.0"
+      version = "3.9.1"
     }
   }
 }
@@ -4878,7 +4878,7 @@ terraform {
   required_providers {
     aws = {
       source  = "hashicorp/aws"
-      version = "6.63.0"
+      version = "6.66.0"
     }
   }
 }
@@ -5125,15 +5125,15 @@ output "api_log_group_arn" {
   required_providers {
     archive = {
       source  = "hashicorp/archive"
-      version = "2.8.0"
+      version = "2.8.1"
     }
     aws = {
       source  = "hashicorp/aws"
-      version = "6.63.0"
+      version = "6.66.0"
     }
     random = {
       source  = "hashicorp/random"
-      version = "3.9.0"
+      version = "3.9.1"
     }
   }
 }
@@ -5670,11 +5670,11 @@ terraform {
   required_providers {
     aws = {
       source  = "hashicorp/aws"
-      version = "6.63.0"
+      version = "6.66.0"
     }
     random = {
       source  = "hashicorp/random"
-      version = "3.9.0"
+      version = "3.9.1"
     }
   }
 }
@@ -5979,15 +5979,15 @@ output "waf_web_acl_arn" {
   required_providers {
     archive = {
       source  = "hashicorp/archive"
-      version = "2.8.0"
+      version = "2.8.1"
     }
     aws = {
       source  = "hashicorp/aws"
-      version = "6.63.0"
+      version = "6.66.0"
     }
     random = {
       source  = "hashicorp/random"
-      version = "3.9.0"
+      version = "3.9.1"
     }
   }
 }
@@ -6984,11 +6984,11 @@ terraform {
   required_providers {
     aws = {
       source  = "hashicorp/aws"
-      version = "6.63.0"
+      version = "6.66.0"
     }
     random = {
       source  = "hashicorp/random"
-      version = "3.9.0"
+      version = "3.9.1"
     }
   }
 }
@@ -7293,15 +7293,15 @@ output "waf_web_acl_arn" {
   required_providers {
     archive = {
       source  = "hashicorp/archive"
-      version = "2.8.0"
+      version = "2.8.1"
     }
     aws = {
       source  = "hashicorp/aws"
-      version = "6.63.0"
+      version = "6.66.0"
     }
     random = {
       source  = "hashicorp/random"
-      version = "3.9.0"
+      version = "3.9.1"
     }
   }
 }
@@ -8287,11 +8287,11 @@ terraform {
   required_providers {
     aws = {
       source  = "hashicorp/aws"
-      version = "6.63.0"
+      version = "6.66.0"
     }
     random = {
       source  = "hashicorp/random"
-      version = "3.9.0"
+      version = "3.9.1"
     }
   }
 }
@@ -8596,15 +8596,15 @@ output "waf_web_acl_arn" {
   required_providers {
     archive = {
       source  = "hashicorp/archive"
-      version = "2.8.0"
+      version = "2.8.1"
     }
     aws = {
       source  = "hashicorp/aws"
-      version = "6.63.0"
+      version = "6.66.0"
     }
     random = {
       source  = "hashicorp/random"
-      version = "3.9.0"
+      version = "3.9.1"
     }
   }
 }

package/src/ts/agent/__snapshots__/generator.spec.ts.snap

@@ -663,7 +663,7 @@ WORKDIR /app
 RUN npm init -y \\
   && npm pkg set "overrides.@opentelemetry/propagator-jaeger=2.11.0" \\
   && npm pkg set "overrides.minimatch=10.2.6" \\
-  && npm install @aws/aws-distro-opentelemetry-node-autoinstrumentation@0.12.0 \\
+  && npm install @aws/aws-distro-opentelemetry-node-autoinstrumentation@0.13.0 \\
   && npm uninstall -g npm
 
 # Copy bundled agent
@@ -984,11 +984,11 @@ exports[`ts#agent generator > should match snapshot for Terraform generated file
   required_providers {
     aws = {
       source  = "hashicorp/aws"
-      version = "6.63.0"
+      version = "6.66.0"
     }
     random = {
       source  = "hashicorp/random"
-      version = "3.9.0"
+      version = "3.9.1"
     }
   }
 }
@@ -1307,15 +1307,15 @@ exports[`ts#agent generator > should match snapshot for Terraform generated file
   required_providers {
     aws = {
       source  = "hashicorp/aws"
-      version = "6.63.0"
+      version = "6.66.0"
     }
     null = {
       source  = "hashicorp/null"
-      version = "3.3.1"
+      version = "3.3.2"
     }
     random = {
       source  = "hashicorp/random"
-      version = "3.9.0"
+      version = "3.9.1"
     }
   }
 }
@@ -1666,7 +1666,7 @@ resource "null_resource" "runtime_ready" {
 
   provisioner "local-exec" {
     command = <<-EOT
-      uv run --with boto3==1.43.89 python -c "
+      uv run --with boto3==1.43.98 python -c "
 import boto3
 import json
 import os

package/src/ts/dcr-proxy/__snapshots__/generator.spec.ts.snap

@@ -579,15 +579,15 @@ terraform {
   required_providers {
     aws = {
       source  = "hashicorp/aws"
-      version = "6.63.0"
+      version = "6.66.0"
     }
     archive = {
       source  = "hashicorp/archive"
-      version = "2.8.0"
+      version = "2.8.1"
     }
     random = {
       source  = "hashicorp/random"
-      version = "3.9.0"
+      version = "3.9.1"
     }
   }
 }

package/src/ts/dynamodb/__snapshots__/generator.spec.ts.snap

@@ -35,7 +35,7 @@ exports[`ts#dynamodb generator > should generate terraform modules when iac is t
   required_providers {
     aws = {
       source  = "hashicorp/aws"
-      version = "6.63.0"
+      version = "6.66.0"
     }
   }
 }
@@ -232,11 +232,11 @@ exports[`ts#dynamodb generator > should generate terraform modules when iac is t
   required_providers {
     aws = {
       source  = "hashicorp/aws"
-      version = "6.63.0"
+      version = "6.66.0"
     }
     random = {
       source  = "hashicorp/random"
-      version = "3.9.0"
+      version = "3.9.1"
     }
   }
 }

package/src/ts/lambda-function/__snapshots__/generator.spec.ts.snap

@@ -141,15 +141,15 @@ exports[`ts-lambda-function generator > terraform iac > should generate terrafor
   required_providers {
     aws = {
       source  = "hashicorp/aws"
-      version = "6.63.0"
+      version = "6.66.0"
     }
     archive = {
       source  = "hashicorp/archive"
-      version = "2.8.0"
+      version = "2.8.1"
     }
     random = {
       source  = "hashicorp/random"
-      version = "3.9.0"
+      version = "3.9.1"
     }
   }
 }
@@ -326,15 +326,15 @@ exports[`ts-lambda-function generator > terraform iac > should match snapshot fo
   required_providers {
     aws = {
       source  = "hashicorp/aws"
-      version = "6.63.0"
+      version = "6.66.0"
     }
     archive = {
       source  = "hashicorp/archive"
-      version = "2.8.0"
+      version = "2.8.1"
     }
     random = {
       source  = "hashicorp/random"
-      version = "3.9.0"
+      version = "3.9.1"
     }
   }
 }

package/src/ts/mcp-server/__snapshots__/generator.spec.ts.snap

@@ -155,15 +155,15 @@ exports[`ts#mcp-server generator > should match snapshot for Terraform generated
   required_providers {
     aws = {
       source  = "hashicorp/aws"
-      version = "6.63.0"
+      version = "6.66.0"
     }
     null = {
       source  = "hashicorp/null"
-      version = "3.3.1"
+      version = "3.3.2"
     }
     random = {
       source  = "hashicorp/random"
-      version = "3.9.0"
+      version = "3.9.1"
     }
   }
 }
@@ -514,7 +514,7 @@ resource "null_resource" "runtime_ready" {
 
   provisioner "local-exec" {
     command = <<-EOT
-      uv run --with boto3==1.43.89 python -c "
+      uv run --with boto3==1.43.98 python -c "
 import boto3
 import json
 import os