@aws/nx-plugin 1.0.2 → 1.0.4

package/LICENSE-THIRD-PARTY

@@ -108,7 +108,7 @@ THE SOFTWARE.
 
 ---
 
-The following software may be included in this product: @astral-sh/ruff-wasm-nodejs (0.16.6)
+The following software may be included in this product: @astral-sh/ruff-wasm-nodejs (0.16.9)
 This software contains the following license and notice below:
 
 MIT License
@@ -3898,7 +3898,7 @@ SOFTWARE.
 
 ---
 
-The following software may be included in this product: @modelcontextprotocol/sdk (1.30.0)
+The following software may be included in this product: @modelcontextprotocol/sdk (1.30.1)
 This software contains the following license and notice below:
 
 MIT License
@@ -4247,7 +4247,7 @@ USE OR OTHER DEALINGS IN THE SOFTWARE.
 
 ---
 
-The following software may be included in this product: @nxlv/python (23.0.0)
+The following software may be included in this product: @nxlv/python (23.1.1)
 This software contains the following license and notice below:
 
 MIT License
@@ -4274,7 +4274,7 @@ SOFTWARE.
 
 ---
 
-The following software may be included in this product: @oxc-project/types (0.148.0)
+The following software may be included in this product: @oxc-project/types (0.150.0)
 This software contains the following license and notice below:
 
 MIT License
@@ -6352,6 +6352,22 @@ THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR IMPLI
 
 ---
 
+The following software may be included in this product: chalk-template (1.1.2)
+This software contains the following license and notice below:
+
+MIT License
+
+Copyright (c) Josh Junon
+Copyright (c) Sindre Sorhus <sindresorhus@gmail.com> (https://sindresorhus.com)
+
+Permission is hereby granted, free of charge, to any person obtaining a copy of this software and associated documentation files (the "Software"), to deal in the Software without restriction, including without limitation the rights to use, copy, modify, merge, publish, distribute, sublicense, and/or sell copies of the Software, and to permit persons to whom the Software is furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE.
+
+---
+
 The following software may be included in this product: character-entities (2.0.2)
 This software contains the following license and notice below:
 
@@ -8741,7 +8757,7 @@ THE SOFTWARE.
 
 ---
 
-The following software may be included in this product: fs-extra (11.4.0)
+The following software may be included in this product: fs-extra (11.4.1)
 This software contains the following license and notice below:
 
 (The MIT License)
@@ -9018,7 +9034,7 @@ WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE.
 
 ---
 
-The following software may be included in this product: hono (4.13.3)
+The following software may be included in this product: hono (4.13.8)
 This software contains the following license and notice below:
 
 MIT License
@@ -12387,7 +12403,7 @@ SOFTWARE.
 
 ---
 
-The following software may be included in this product: nanoid (3.3.17)
+The following software may be included in this product: nanoid (3.3.19)
 This software contains the following license and notice below:
 
 The MIT License (MIT)
@@ -13258,7 +13274,7 @@ WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE.
 
 ---
 
-The following software may be included in this product: postcss (8.5.26)
+The following software may be included in this product: postcss (8.5.28)
 This software contains the following license and notice below:
 
 The MIT License (MIT)
@@ -13528,7 +13544,7 @@ THE SOFTWARE.
 
 ---
 
-The following software may be included in this product: react (19.2.8)
+The following software may be included in this product: react (19.3.0)
 This software contains the following license and notice below:
 
 MIT License
@@ -13555,7 +13571,7 @@ SOFTWARE.
 
 ---
 
-The following software may be included in this product: react-dom (19.2.8)
+The following software may be included in this product: react-dom (19.3.0)
 This software contains the following license and notice below:
 
 MIT License
@@ -14149,7 +14165,7 @@ SOFTWARE.
 
 ---
 
-The following software may be included in this product: rolldown (1.2.7)
+The following software may be included in this product: rolldown (1.2.9)
 This software contains the following license and notice below:
 
 MIT License
@@ -14346,7 +14362,7 @@ SOFTWARE.
 
 ---
 
-The following software may be included in this product: scheduler (0.27.0)
+The following software may be included in this product: scheduler (0.28.0)
 This software contains the following license and notice below:
 
 MIT License
@@ -16072,7 +16088,7 @@ SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE.
 
 ---
 
-The following software may be included in this product: vite (8.2.2)
+The following software may be included in this product: vite (8.3.1)
 This software contains the following license and notice below:
 
 # Vite core license
@@ -19446,7 +19462,7 @@ OTHER DEALINGS IN THE SOFTWARE.
 
 ---
 
-The following software may be included in this product: zod (4.5.4)
+The following software may be included in this product: zod (4.6.5)
 This software contains the following license and notice below:
 
 MIT License

package/migrations.json

@@ -2,21 +2,6 @@
   "$schema": "http://json-schema.org/schema",
   "name": "@aws/nx-plugin",
   "generators": {
-    "latest-sandbox-pattern-nested-stacks": {
-      "version": "1.0.0-rc.98",
-      "description": "Update the deploy-sandbox and destroy-sandbox stage patterns to match stacks nested below the stage's stacks, so cdk destroy removes the website WebACL stack",
-      "implementation": "./src/migrations/latest/sandbox-pattern-nested-stacks/migration"
-    },
-    "latest-shadcn-cn-package": {
-      "version": "1.0.0-rc.98",
-      "description": "Move the shared shadcn package's components onto the cn package the shadcn registry now depends on",
-      "implementation": "./src/migrations/latest/shadcn-cn-package/migration"
-    },
-    "latest-terraform-harness-environment-variables": {
-      "version": "1.0.2",
-      "description": "Send an empty map rather than null for a vended Terraform AgentCore Harness module's environment_variables, so the first apply does not fail after creating the Harness",
-      "implementation": "./src/migrations/latest/terraform-harness-environment-variables/migration"
-    },
     "v1.0.0-rc.50-0001-modernize-function-props-cast": {
       "version": "1.0.0-rc.50",
       "description": "Replace the legacy angle-bracket FunctionProps type assertion with the modern as syntax in generated API constructs",
@@ -372,8 +357,28 @@
       "description": "Add build, lint, format and typecheck targets plus a tsconfig.json to AgentCore Gateway and Harness projects",
       "implementation": "./src/migrations/v1.0.0-rc.97/0006-script-project-quality-gates/migration"
     },
-    "sync-vended-versions": {
+    "v1.0.0-rc.98-0001-sandbox-pattern-nested-stacks": {
+      "version": "1.0.0-rc.98",
+      "description": "Update the deploy-sandbox and destroy-sandbox stage patterns to match stacks nested below the stage's stacks, so cdk destroy removes the website WebACL stack",
+      "implementation": "./src/migrations/v1.0.0-rc.98/0001-sandbox-pattern-nested-stacks/migration"
+    },
+    "v1.0.0-rc.98-0002-shadcn-cn-package": {
+      "version": "1.0.0-rc.98",
+      "description": "Move the shared shadcn package's components onto the cn package the shadcn registry now depends on",
+      "implementation": "./src/migrations/v1.0.0-rc.98/0002-shadcn-cn-package/migration"
+    },
+    "v1.0.2-0001-terraform-harness-environment-variables": {
       "version": "1.0.2",
+      "description": "Send an empty map rather than null for a vended Terraform AgentCore Harness module's environment_variables, so the first apply does not fail after creating the Harness",
+      "implementation": "./src/migrations/v1.0.2/0001-terraform-harness-environment-variables/migration"
+    },
+    "v1.0.3-0001-terraform-init-target": {
+      "version": "1.0.3",
+      "description": "Add the terraform-init target to Terraform projects so the shared provider plugin cache has a single writer",
+      "implementation": "./src/migrations/v1.0.3/0001-terraform-init-target/migration"
+    },
+    "sync-vended-versions": {
+      "version": "1.0.4",
       "description": "Sync vended dependency versions and the tracked plugin version to those vended by this release",
       "implementation": "./src/utils/version-upgrade-migration/migration"
     }
@@ -479,7 +484,7 @@
       }
     },
     "nx-23.2.1-nx-packages": {
-      "version": "1.0.2",
+      "version": "1.0.1",
       "packages": {
         "nx": {
           "version": "23.2.1",

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@aws/nx-plugin",
-  "version": "1.0.2",
+  "version": "1.0.4",
   "repository": {
     "type": "git",
     "url": "https://github.com/awslabs/nx-plugin-for-aws.git",
@@ -40,17 +40,17 @@
   },
   "dependencies": {
     "@apidevtools/swagger-parser": "12.1.0",
-    "@astral-sh/ruff-wasm-nodejs": "0.16.6",
+    "@astral-sh/ruff-wasm-nodejs": "0.16.9",
     "@biomejs/js-api": "6.0.0",
-    "@biomejs/wasm-nodejs": "2.5.12",
+    "@biomejs/wasm-nodejs": "2.5.14",
     "@getgrit/gritql": "0.0.3",
     "@iarna/toml": "2.2.5",
-    "@modelcontextprotocol/sdk": "1.30.0",
+    "@modelcontextprotocol/sdk": "1.30.1",
     "@nx/devkit": "23.2.1",
     "@nx/js": "23.2.1",
     "@nx/react": "23.2.1",
     "@nx/vite": "23.2.1",
-    "@nxlv/python": "23.0.0",
+    "@nxlv/python": "23.1.1",
     "@phenomnomnominal/tsquery": "6.2.0",
     "@types/estree": "1.0.9",
     "@types/js-yaml": "4.0.9",
@@ -79,9 +79,9 @@
     "typescript": "6.0.3",
     "unified": "11.0.5",
     "unist-util-visit": "5.1.0",
-    "vite": "8.2.2",
+    "vite": "8.3.1",
     "vitest": "4.1.11",
-    "zod": "4.5.4"
+    "zod": "4.6.5"
   },
   "devDependencies": {
     "@types/semver": "7.8.0"

package/src/agentcore-gateway/__snapshots__/generator.spec.ts.snap

@@ -7,15 +7,15 @@ exports[`agentcore-gateway generator > protocol: http > omits protocol_type from
   required_providers {
     aws = {
       source  = "hashicorp/aws"
-      version = "6.63.0"
+      version = "6.66.0"
     }
     time = {
       source  = "hashicorp/time"
-      version = "0.14.1"
+      version = "0.14.2"
     }
     random = {
       source  = "hashicorp/random"
-      version = "3.9.0"
+      version = "3.9.1"
     }
   }
 }

package/src/infra/app/__snapshots__/generator.spec.ts.snap

@@ -50,7 +50,7 @@ exports[`infra generator > should configure Checkov target correctly > checkov-t
     "default",
   ],
   "options": {
-    "command": "uvx --from checkov==3.3.16 checkov --config-file {projectRoot}/checkov.yml --directory dist/{projectRoot}/cdk.out --framework cloudformation",
+    "command": "uvx --from checkov==3.3.20 checkov --config-file {projectRoot}/checkov.yml --directory dist/{projectRoot}/cdk.out --framework cloudformation",
   },
   "outputs": [
     "{workspaceRoot}/dist/{projectRoot}/checkov",
@@ -150,7 +150,7 @@ exports[`infra generator > should configure project.json with correct targets >
         "default",
       ],
       "options": {
-        "command": "uvx --from checkov==3.3.16 checkov --config-file {projectRoot}/checkov.yml --directory dist/{projectRoot}/cdk.out --framework cloudformation",
+        "command": "uvx --from checkov==3.3.20 checkov --config-file {projectRoot}/checkov.yml --directory dist/{projectRoot}/cdk.out --framework cloudformation",
       },
       "outputs": [
         "{workspaceRoot}/dist/{projectRoot}/checkov",
@@ -762,7 +762,7 @@ exports[`infra generator > should handle custom project names correctly > custom
         "default",
       ],
       "options": {
-        "command": "uvx --from checkov==3.3.16 checkov --config-file {projectRoot}/checkov.yml --directory dist/{projectRoot}/cdk.out --framework cloudformation",
+        "command": "uvx --from checkov==3.3.20 checkov --config-file {projectRoot}/checkov.yml --directory dist/{projectRoot}/cdk.out --framework cloudformation",
       },
       "outputs": [
         "{workspaceRoot}/dist/{projectRoot}/checkov",

package/src/license/dependency-check/collectors/npm-collector.d.ts

@@ -7,4 +7,18 @@ export interface NpmDependency {
 export interface NpmCollectorOptions {
     start: string;
 }
+/**
+ * Resolve a license that only names a file into the license that file grants.
+ *
+ * license-checker reads a package's license file only when the package declares
+ * no license, so a package declaring `SEE LICENSE IN LICENSE` is reported as
+ * `Custom: LICENSE` and evaluates to UNKNOWN even when the file grants a
+ * pre-approved license. Read the file license-checker already located and run
+ * its text detection over it, which returns an SPDX id with the trailing `*`
+ * marking a license guessed from text.
+ *
+ * The reference is kept when the file can't be read, or when detection can't
+ * name a license, so the dependency is still reported as UNKNOWN.
+ */
+export declare const resolveFileReferencedLicense: (rawLicense: string, licenseFile: string | undefined) => string;
 export declare const collectNpmDependencies: (options: NpmCollectorOptions) => Promise<NpmDependency[]>;

package/src/license/dependency-check/collectors/npm-collector.js

@@ -3,6 +3,10 @@
  * SPDX-License-Identifier: Apache-2.0
  */ import { existsSync, readFileSync } from "fs";
 import * as licenseChecker from "license-checker-rseidelsohn";
+// license-checker's own license-from-text detection, which it applies to
+// packages that declare no license. Reused here so a `SEE LICENSE IN <file>`
+// package resolves the same way, rather than through a second implementation.
+import { getLicenseTitle } from "license-checker-rseidelsohn/lib/getLicenseTitle.js";
 import { join } from "path";
 const NAME_VERSION_RE = /^(@?[^@]+)@(.+)$/;
 const splitNameVersion = (identifier)=>{
@@ -27,6 +31,36 @@ const flattenLicense = (raw)=>{
     }
     return raw;
 };
+/**
+ * A license that names a file instead of a license: the SPDX form
+ * `SEE LICENSE IN <file>`, or the `Custom: <file>` license-checker reports it
+ * as.
+ */ const FILE_REFERENCE_RE = /^(?:custom:|see\s+license\s+in)\s+(.+)$/i;
+/**
+ * Resolve a license that only names a file into the license that file grants.
+ *
+ * license-checker reads a package's license file only when the package declares
+ * no license, so a package declaring `SEE LICENSE IN LICENSE` is reported as
+ * `Custom: LICENSE` and evaluates to UNKNOWN even when the file grants a
+ * pre-approved license. Read the file license-checker already located and run
+ * its text detection over it, which returns an SPDX id with the trailing `*`
+ * marking a license guessed from text.
+ *
+ * The reference is kept when the file can't be read, or when detection can't
+ * name a license, so the dependency is still reported as UNKNOWN.
+ */ export const resolveFileReferencedLicense = (rawLicense, licenseFile)=>{
+    if (!licenseFile || !FILE_REFERENCE_RE.test(rawLicense.trim())) {
+        return rawLicense;
+    }
+    let detected = null;
+    try {
+        detected = getLicenseTitle(readFileSync(licenseFile, 'utf-8'));
+    } catch  {
+        return rawLicense;
+    }
+    if (!detected || detected === 'Undefined' || FILE_REFERENCE_RE.test(detected)) return rawLicense;
+    return detected;
+};
 export const collectNpmDependencies = async (options)=>{
     const nodeModules = join(options.start, 'node_modules');
     if (!existsSync(nodeModules)) {
@@ -58,7 +92,7 @@ export const collectNpmDependencies = async (options)=>{
         out.push({
             name,
             version,
-            rawLicense: flattenLicense(info.licenses),
+            rawLicense: resolveFileReferencedLicense(flattenLicense(info.licenses), info.licenseFile),
             path: info.path
         });
     }

package/src/license/dependency-check/collectors/npm-collector.js.map

@@ -1 +1 @@
-{"version":3,"sources":["../../../../../../../packages/nx-plugin/src/license/dependency-check/collectors/npm-collector.ts"],"sourcesContent":["/**\n * Copyright Amazon.com, Inc. or its affiliates. All Rights Reserved.\n * SPDX-License-Identifier: Apache-2.0\n */\nimport { existsSync, readFileSync } from 'fs';\nimport * as licenseChecker from 'license-checker-rseidelsohn';\nimport { join } from 'path';\n\nexport interface NpmDependency {\n  name: string;\n  version: string;\n  rawLicense: string;\n  path?: string;\n}\n\nexport interface NpmCollectorOptions {\n  start: string;\n}\n\nconst NAME_VERSION_RE = /^(@?[^@]+)@(.+)$/;\n\nconst splitNameVersion = (\n  identifier: string,\n): { name: string; version: string } => {\n  const match = identifier.match(NAME_VERSION_RE);\n  if (!match) {\n    return { name: identifier, version: '0.0.0' };\n  }\n  return { name: match[1], version: match[2] };\n};\n\nconst flattenLicense = (raw: string | string[] | undefined | null): string => {\n  if (!raw) return '';\n  if (Array.isArray(raw)) {\n    if (raw.length === 0) return '';\n    if (raw.length === 1) return raw[0];\n    return `(${raw.join(' OR ')})`;\n  }\n  return raw;\n};\n\nexport const collectNpmDependencies = async (\n  options: NpmCollectorOptions,\n): Promise<NpmDependency[]> => {\n  const nodeModules = join(options.start, 'node_modules');\n  if (!existsSync(nodeModules)) {\n    return [];\n  }\n\n  const exclude = new Set<string>();\n\n  const projectPackageJson = join(options.start, 'package.json');\n  if (existsSync(projectPackageJson)) {\n    try {\n      const pkg = JSON.parse(readFileSync(projectPackageJson, 'utf-8')) as {\n        name?: string;\n      };\n      if (pkg.name) exclude.add(pkg.name);\n    } catch {\n      // ignore\n    }\n  }\n\n  const packages = await new Promise<licenseChecker.ModuleInfos>(\n    (resolve, reject) => {\n      licenseChecker.init(\n        {\n          start: options.start,\n          excludePrivatePackages: true,\n        },\n        (err, results) => {\n          if (err) reject(err);\n          else resolve(results);\n        },\n      );\n    },\n  );\n\n  const out: NpmDependency[] = [];\n  for (const [identifier, info] of Object.entries(packages)) {\n    const { name, version } = splitNameVersion(identifier);\n    if (exclude.has(name)) continue;\n    out.push({\n      name,\n      version,\n      rawLicense: flattenLicense(info.licenses),\n      path: info.path,\n    });\n  }\n  return out;\n};\n"],"names":["existsSync","readFileSync","licenseChecker","join","NAME_VERSION_RE","splitNameVersion","identifier","match","name","version","flattenLicense","raw","Array","isArray","length","collectNpmDependencies","options","nodeModules","start","exclude","Set","projectPackageJson","pkg","JSON","parse","add","packages","Promise","resolve","reject","init","excludePrivatePackages","err","results","out","info","Object","entries","has","push","rawLicense","licenses","path"],"mappings":"AAAA;;;CAGC,GACD,SAASA,UAAU,EAAEC,YAAY,QAAQ,KAAK;AAC9C,YAAYC,oBAAoB,8BAA8B;AAC9D,SAASC,IAAI,QAAQ,OAAO;AAa5B,MAAMC,kBAAkB;AAExB,MAAMC,mBAAmB,CACvBC;IAEA,MAAMC,QAAQD,WAAWC,KAAK,CAACH;IAC/B,IAAI,CAACG,OAAO;QACV,OAAO;YAAEC,MAAMF;YAAYG,SAAS;QAAQ;IAC9C;IACA,OAAO;QAAED,MAAMD,KAAK,CAAC,EAAE;QAAEE,SAASF,KAAK,CAAC,EAAE;IAAC;AAC7C;AAEA,MAAMG,iBAAiB,CAACC;IACtB,IAAI,CAACA,KAAK,OAAO;IACjB,IAAIC,MAAMC,OAAO,CAACF,MAAM;QACtB,IAAIA,IAAIG,MAAM,KAAK,GAAG,OAAO;QAC7B,IAAIH,IAAIG,MAAM,KAAK,GAAG,OAAOH,GAAG,CAAC,EAAE;QACnC,OAAO,CAAC,CAAC,EAAEA,IAAIR,IAAI,CAAC,QAAQ,CAAC,CAAC;IAChC;IACA,OAAOQ;AACT;AAEA,OAAO,MAAMI,yBAAyB,OACpCC;IAEA,MAAMC,cAAcd,KAAKa,QAAQE,KAAK,EAAE;IACxC,IAAI,CAAClB,WAAWiB,cAAc;QAC5B,OAAO,EAAE;IACX;IAEA,MAAME,UAAU,IAAIC;IAEpB,MAAMC,qBAAqBlB,KAAKa,QAAQE,KAAK,EAAE;IAC/C,IAAIlB,WAAWqB,qBAAqB;QAClC,IAAI;YACF,MAAMC,MAAMC,KAAKC,KAAK,CAACvB,aAAaoB,oBAAoB;YAGxD,IAAIC,IAAId,IAAI,EAAEW,QAAQM,GAAG,CAACH,IAAId,IAAI;QACpC,EAAE,OAAM;QACN,SAAS;QACX;IACF;IAEA,MAAMkB,WAAW,MAAM,IAAIC,QACzB,CAACC,SAASC;QACR3B,eAAe4B,IAAI,CACjB;YACEZ,OAAOF,QAAQE,KAAK;YACpBa,wBAAwB;QAC1B,GACA,CAACC,KAAKC;YACJ,IAAID,KAAKH,OAAOG;iBACXJ,QAAQK;QACf;IAEJ;IAGF,MAAMC,MAAuB,EAAE;IAC/B,KAAK,MAAM,CAAC5B,YAAY6B,KAAK,IAAIC,OAAOC,OAAO,CAACX,UAAW;QACzD,MAAM,EAAElB,IAAI,EAAEC,OAAO,EAAE,GAAGJ,iBAAiBC;QAC3C,IAAIa,QAAQmB,GAAG,CAAC9B,OAAO;QACvB0B,IAAIK,IAAI,CAAC;YACP/B;YACAC;YACA+B,YAAY9B,eAAeyB,KAAKM,QAAQ;YACxCC,MAAMP,KAAKO,IAAI;QACjB;IACF;IACA,OAAOR;AACT,EAAE"}
+{"version":3,"sources":["../../../../../../../packages/nx-plugin/src/license/dependency-check/collectors/npm-collector.ts"],"sourcesContent":["/**\n * Copyright Amazon.com, Inc. or its affiliates. All Rights Reserved.\n * SPDX-License-Identifier: Apache-2.0\n */\nimport { existsSync, readFileSync } from 'fs';\nimport * as licenseChecker from 'license-checker-rseidelsohn';\n// license-checker's own license-from-text detection, which it applies to\n// packages that declare no license. Reused here so a `SEE LICENSE IN <file>`\n// package resolves the same way, rather than through a second implementation.\nimport { getLicenseTitle } from 'license-checker-rseidelsohn/lib/getLicenseTitle.js';\nimport { join } from 'path';\n\nexport interface NpmDependency {\n  name: string;\n  version: string;\n  rawLicense: string;\n  path?: string;\n}\n\nexport interface NpmCollectorOptions {\n  start: string;\n}\n\nconst NAME_VERSION_RE = /^(@?[^@]+)@(.+)$/;\n\nconst splitNameVersion = (\n  identifier: string,\n): { name: string; version: string } => {\n  const match = identifier.match(NAME_VERSION_RE);\n  if (!match) {\n    return { name: identifier, version: '0.0.0' };\n  }\n  return { name: match[1], version: match[2] };\n};\n\nconst flattenLicense = (raw: string | string[] | undefined | null): string => {\n  if (!raw) return '';\n  if (Array.isArray(raw)) {\n    if (raw.length === 0) return '';\n    if (raw.length === 1) return raw[0];\n    return `(${raw.join(' OR ')})`;\n  }\n  return raw;\n};\n\n/**\n * A license that names a file instead of a license: the SPDX form\n * `SEE LICENSE IN <file>`, or the `Custom: <file>` license-checker reports it\n * as.\n */\nconst FILE_REFERENCE_RE = /^(?:custom:|see\\s+license\\s+in)\\s+(.+)$/i;\n\n/**\n * Resolve a license that only names a file into the license that file grants.\n *\n * license-checker reads a package's license file only when the package declares\n * no license, so a package declaring `SEE LICENSE IN LICENSE` is reported as\n * `Custom: LICENSE` and evaluates to UNKNOWN even when the file grants a\n * pre-approved license. Read the file license-checker already located and run\n * its text detection over it, which returns an SPDX id with the trailing `*`\n * marking a license guessed from text.\n *\n * The reference is kept when the file can't be read, or when detection can't\n * name a license, so the dependency is still reported as UNKNOWN.\n */\nexport const resolveFileReferencedLicense = (\n  rawLicense: string,\n  licenseFile: string | undefined,\n): string => {\n  if (!licenseFile || !FILE_REFERENCE_RE.test(rawLicense.trim())) {\n    return rawLicense;\n  }\n  let detected: string | null = null;\n  try {\n    detected = getLicenseTitle(readFileSync(licenseFile, 'utf-8'));\n  } catch {\n    return rawLicense;\n  }\n  if (!detected || detected === 'Undefined' || FILE_REFERENCE_RE.test(detected))\n    return rawLicense;\n  return detected;\n};\n\nexport const collectNpmDependencies = async (\n  options: NpmCollectorOptions,\n): Promise<NpmDependency[]> => {\n  const nodeModules = join(options.start, 'node_modules');\n  if (!existsSync(nodeModules)) {\n    return [];\n  }\n\n  const exclude = new Set<string>();\n\n  const projectPackageJson = join(options.start, 'package.json');\n  if (existsSync(projectPackageJson)) {\n    try {\n      const pkg = JSON.parse(readFileSync(projectPackageJson, 'utf-8')) as {\n        name?: string;\n      };\n      if (pkg.name) exclude.add(pkg.name);\n    } catch {\n      // ignore\n    }\n  }\n\n  const packages = await new Promise<licenseChecker.ModuleInfos>(\n    (resolve, reject) => {\n      licenseChecker.init(\n        {\n          start: options.start,\n          excludePrivatePackages: true,\n        },\n        (err, results) => {\n          if (err) reject(err);\n          else resolve(results);\n        },\n      );\n    },\n  );\n\n  const out: NpmDependency[] = [];\n  for (const [identifier, info] of Object.entries(packages)) {\n    const { name, version } = splitNameVersion(identifier);\n    if (exclude.has(name)) continue;\n    out.push({\n      name,\n      version,\n      rawLicense: resolveFileReferencedLicense(\n        flattenLicense(info.licenses),\n        info.licenseFile,\n      ),\n      path: info.path,\n    });\n  }\n  return out;\n};\n"],"names":["existsSync","readFileSync","licenseChecker","getLicenseTitle","join","NAME_VERSION_RE","splitNameVersion","identifier","match","name","version","flattenLicense","raw","Array","isArray","length","FILE_REFERENCE_RE","resolveFileReferencedLicense","rawLicense","licenseFile","test","trim","detected","collectNpmDependencies","options","nodeModules","start","exclude","Set","projectPackageJson","pkg","JSON","parse","add","packages","Promise","resolve","reject","init","excludePrivatePackages","err","results","out","info","Object","entries","has","push","licenses","path"],"mappings":"AAAA;;;CAGC,GACD,SAASA,UAAU,EAAEC,YAAY,QAAQ,KAAK;AAC9C,YAAYC,oBAAoB,8BAA8B;AAC9D,yEAAyE;AACzE,6EAA6E;AAC7E,8EAA8E;AAC9E,SAASC,eAAe,QAAQ,qDAAqD;AACrF,SAASC,IAAI,QAAQ,OAAO;AAa5B,MAAMC,kBAAkB;AAExB,MAAMC,mBAAmB,CACvBC;IAEA,MAAMC,QAAQD,WAAWC,KAAK,CAACH;IAC/B,IAAI,CAACG,OAAO;QACV,OAAO;YAAEC,MAAMF;YAAYG,SAAS;QAAQ;IAC9C;IACA,OAAO;QAAED,MAAMD,KAAK,CAAC,EAAE;QAAEE,SAASF,KAAK,CAAC,EAAE;IAAC;AAC7C;AAEA,MAAMG,iBAAiB,CAACC;IACtB,IAAI,CAACA,KAAK,OAAO;IACjB,IAAIC,MAAMC,OAAO,CAACF,MAAM;QACtB,IAAIA,IAAIG,MAAM,KAAK,GAAG,OAAO;QAC7B,IAAIH,IAAIG,MAAM,KAAK,GAAG,OAAOH,GAAG,CAAC,EAAE;QACnC,OAAO,CAAC,CAAC,EAAEA,IAAIR,IAAI,CAAC,QAAQ,CAAC,CAAC;IAChC;IACA,OAAOQ;AACT;AAEA;;;;CAIC,GACD,MAAMI,oBAAoB;AAE1B;;;;;;;;;;;;CAYC,GACD,OAAO,MAAMC,+BAA+B,CAC1CC,YACAC;IAEA,IAAI,CAACA,eAAe,CAACH,kBAAkBI,IAAI,CAACF,WAAWG,IAAI,KAAK;QAC9D,OAAOH;IACT;IACA,IAAII,WAA0B;IAC9B,IAAI;QACFA,WAAWnB,gBAAgBF,aAAakB,aAAa;IACvD,EAAE,OAAM;QACN,OAAOD;IACT;IACA,IAAI,CAACI,YAAYA,aAAa,eAAeN,kBAAkBI,IAAI,CAACE,WAClE,OAAOJ;IACT,OAAOI;AACT,EAAE;AAEF,OAAO,MAAMC,yBAAyB,OACpCC;IAEA,MAAMC,cAAcrB,KAAKoB,QAAQE,KAAK,EAAE;IACxC,IAAI,CAAC1B,WAAWyB,cAAc;QAC5B,OAAO,EAAE;IACX;IAEA,MAAME,UAAU,IAAIC;IAEpB,MAAMC,qBAAqBzB,KAAKoB,QAAQE,KAAK,EAAE;IAC/C,IAAI1B,WAAW6B,qBAAqB;QAClC,IAAI;YACF,MAAMC,MAAMC,KAAKC,KAAK,CAAC/B,aAAa4B,oBAAoB;YAGxD,IAAIC,IAAIrB,IAAI,EAAEkB,QAAQM,GAAG,CAACH,IAAIrB,IAAI;QACpC,EAAE,OAAM;QACN,SAAS;QACX;IACF;IAEA,MAAMyB,WAAW,MAAM,IAAIC,QACzB,CAACC,SAASC;QACRnC,eAAeoC,IAAI,CACjB;YACEZ,OAAOF,QAAQE,KAAK;YACpBa,wBAAwB;QAC1B,GACA,CAACC,KAAKC;YACJ,IAAID,KAAKH,OAAOG;iBACXJ,QAAQK;QACf;IAEJ;IAGF,MAAMC,MAAuB,EAAE;IAC/B,KAAK,MAAM,CAACnC,YAAYoC,KAAK,IAAIC,OAAOC,OAAO,CAACX,UAAW;QACzD,MAAM,EAAEzB,IAAI,EAAEC,OAAO,EAAE,GAAGJ,iBAAiBC;QAC3C,IAAIoB,QAAQmB,GAAG,CAACrC,OAAO;QACvBiC,IAAIK,IAAI,CAAC;YACPtC;YACAC;YACAQ,YAAYD,6BACVN,eAAegC,KAAKK,QAAQ,GAC5BL,KAAKxB,WAAW;YAElB8B,MAAMN,KAAKM,IAAI;QACjB;IACF;IACA,OAAOP;AACT,EAAE"}

package/src/migrations/v1.0.0-rc.98/0001-sandbox-pattern-nested-stacks/migration.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../../../../../../../packages/nx-plugin/src/migrations/v1.0.0-rc.98/0001-sandbox-pattern-nested-stacks/migration.ts"],"sourcesContent":["/**\n * Copyright Amazon.com, Inc. or its affiliates. All Rights Reserved.\n * SPDX-License-Identifier: Apache-2.0\n */\nimport {\n  getProjects,\n  type MigrationReturnObject,\n  type TargetConfiguration,\n  type Tree,\n  updateProjectConfiguration,\n} from '@nx/devkit';\nimport { INFRA_APP_GENERATOR_INFO } from '../../../infra/app/generator.js';\nimport { formatFilesInSubtree } from '../../../utils/format.js';\n\n/**\n * Widen the stage pattern of the sandbox targets of ts#infra projects from\n * `<stage>/*` to `<stage>/**`.\n *\n * A single `*` matches the stage's own stacks but nothing below them, so it\n * misses stacks a construct creates inside a stack - such as the `us-east-1`\n * WebACL stack a website creates for its CloudFront distribution.\n * `cdk destroy` only deletes the stacks its pattern selects, so\n * `destroy-sandbox` left that stack, and the WebACL it bills for, deployed.\n */\n\nconst SANDBOX_TARGETS = ['deploy-sandbox', 'destroy-sandbox'];\n\n/** A quoted or bare stage pattern ending in a single `*`, ie `\"my-sandbox/*\"`. */\nconst SINGLE_STAR_PATTERN = /^(\"?)\\S+\\/\\*\\1$/;\n\nconst widen = (token: string): string => token.replace(/\\/\\*(\"?)$/, '/**$1');\n\n/**\n * Whether the command is one of the deploy/destroy commands this generator\n * vends - either a direct `cdk deploy`/`cdk destroy`, or the stage-config\n * script that wraps it. Anything else has been hand-written and is reported\n * rather than rewritten.\n */\nconst isGeneratedCommand = (command: string): boolean =>\n  /(^|\\s)cdk\\s+(deploy|destroy)(\\s|$)/.test(command) ||\n  command.includes('infra-deploy.ts') ||\n  command.includes('infra-destroy.ts');\n\nexport default async function migration(\n  tree: Tree,\n): Promise<MigrationReturnObject> {\n  const nextSteps: string[] = [];\n  let migrated = false;\n\n  for (const [name, project] of getProjects(tree)) {\n    if (\n      (project.metadata as { generator?: string } | undefined)?.generator !==\n      INFRA_APP_GENERATOR_INFO.id\n    ) {\n      continue;\n    }\n\n    let projectChanged = false;\n\n    for (const targetName of SANDBOX_TARGETS) {\n      const target: TargetConfiguration | undefined =\n        project.targets?.[targetName];\n      const command = target?.options?.command;\n      if (!target || typeof command !== 'string') {\n        continue;\n      }\n\n      const args = command.split(/\\s+/);\n      // Nothing to widen: already `/**`, or the pattern has been removed. Keeps\n      // re-runs - and a project generated after this change - a no-op.\n      if (!args.some((arg) => SINGLE_STAR_PATTERN.test(arg))) {\n        continue;\n      }\n\n      if (!isGeneratedCommand(command)) {\n        nextSteps.push(\n          `${name}: its ${targetName} target has been customised, so it was left as it is. Widen its stage pattern from \"<stage>/*\" to \"<stage>/**\" so it also matches stacks nested below the stage's stacks, such as a website's WebACL stack.`,\n        );\n        continue;\n      }\n\n      target.options.command = args\n        .map((arg) => (SINGLE_STAR_PATTERN.test(arg) ? widen(arg) : arg))\n        .join(' ');\n      projectChanged = true;\n    }\n\n    if (projectChanged) {\n      updateProjectConfiguration(tree, name, project);\n      migrated = true;\n    }\n  }\n\n  if (migrated) {\n    await formatFilesInSubtree(tree);\n  }\n\n  return { nextSteps };\n}\n"],"names":["getProjects","updateProjectConfiguration","INFRA_APP_GENERATOR_INFO","formatFilesInSubtree","SANDBOX_TARGETS","SINGLE_STAR_PATTERN","widen","token","replace","isGeneratedCommand","command","test","includes","migration","tree","nextSteps","migrated","name","project","metadata","generator","id","projectChanged","targetName","target","targets","options","args","split","some","arg","push","map","join"],"mappings":"AAAA;;;CAGC,GACD,SACEA,WAAW,EAIXC,0BAA0B,QACrB,aAAa;AACpB,SAASC,wBAAwB,QAAQ,kCAAkC;AAC3E,SAASC,oBAAoB,QAAQ,2BAA2B;AAEhE;;;;;;;;;CASC,GAED,MAAMC,kBAAkB;IAAC;IAAkB;CAAkB;AAE7D,gFAAgF,GAChF,MAAMC,sBAAsB;AAE5B,MAAMC,QAAQ,CAACC,QAA0BA,MAAMC,OAAO,CAAC,aAAa;AAEpE;;;;;CAKC,GACD,MAAMC,qBAAqB,CAACC,UAC1B,qCAAqCC,IAAI,CAACD,YAC1CA,QAAQE,QAAQ,CAAC,sBACjBF,QAAQE,QAAQ,CAAC;AAEnB,eAAe,eAAeC,UAC5BC,IAAU;IAEV,MAAMC,YAAsB,EAAE;IAC9B,IAAIC,WAAW;IAEf,KAAK,MAAM,CAACC,MAAMC,QAAQ,IAAIlB,YAAYc,MAAO;QAC/C,IACE,AAACI,QAAQC,QAAQ,EAAyCC,cAC1DlB,yBAAyBmB,EAAE,EAC3B;YACA;QACF;QAEA,IAAIC,iBAAiB;QAErB,KAAK,MAAMC,cAAcnB,gBAAiB;YACxC,MAAMoB,SACJN,QAAQO,OAAO,EAAE,CAACF,WAAW;YAC/B,MAAMb,UAAUc,QAAQE,SAAShB;YACjC,IAAI,CAACc,UAAU,OAAOd,YAAY,UAAU;gBAC1C;YACF;YAEA,MAAMiB,OAAOjB,QAAQkB,KAAK,CAAC;YAC3B,0EAA0E;YAC1E,iEAAiE;YACjE,IAAI,CAACD,KAAKE,IAAI,CAAC,CAACC,MAAQzB,oBAAoBM,IAAI,CAACmB,OAAO;gBACtD;YACF;YAEA,IAAI,CAACrB,mBAAmBC,UAAU;gBAChCK,UAAUgB,IAAI,CACZ,GAAGd,KAAK,MAAM,EAAEM,WAAW,2MAA2M,CAAC;gBAEzO;YACF;YAEAC,OAAOE,OAAO,CAAChB,OAAO,GAAGiB,KACtBK,GAAG,CAAC,CAACF,MAASzB,oBAAoBM,IAAI,CAACmB,OAAOxB,MAAMwB,OAAOA,KAC3DG,IAAI,CAAC;YACRX,iBAAiB;QACnB;QAEA,IAAIA,gBAAgB;YAClBrB,2BAA2Ba,MAAMG,MAAMC;YACvCF,WAAW;QACb;IACF;IAEA,IAAIA,UAAU;QACZ,MAAMb,qBAAqBW;IAC7B;IAEA,OAAO;QAAEC;IAAU;AACrB"}

package/src/migrations/v1.0.0-rc.98/0002-shadcn-cn-package/migration.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../../../../../../../packages/nx-plugin/src/migrations/v1.0.0-rc.98/0002-shadcn-cn-package/migration.ts"],"sourcesContent":["/**\n * Copyright Amazon.com, Inc. or its affiliates. All Rights Reserved.\n * SPDX-License-Identifier: Apache-2.0\n */\nimport {\n  joinPathFragments,\n  type MigrationReturnObject,\n  readJson,\n  type Tree,\n} from '@nx/devkit';\nimport { applyGritQL, matchGritQL } from '../../../utils/ast.js';\nimport {\n  addDependenciesToPackageJson,\n  removeDependenciesFromPackageJson,\n} from '../../../utils/dependencies.js';\nimport { formatFilesInSubtree } from '../../../utils/format.js';\nimport {\n  PACKAGES_DIR,\n  SHARED_SHADCN_DIR,\n} from '../../../utils/shared-constructs-constants.js';\nimport { TS_VERSIONS } from '../../../utils/versions.js';\n\n/**\n * Move the shared shadcn package onto the `cn` package.\n *\n * The shadcn registry now serves components importing `cn` from the `cn`\n * package and declares it as a registry dependency, so a component added by\n * `shadcn add` no longer resolves the package's own `#lib/utils` helper. This\n * carries an existing workspace onto that shape: the components import `cn`,\n * `src/lib/utils.ts` becomes the single-line re-export shadcn's own install\n * guide prescribes, which keeps every consumer importing `cn` through\n * `<scope>common-shadcn/lib/utils` working, and clsx / tailwind-merge are\n * dropped now that nothing imports them.\n *\n * How to write a migration:\n * - https://nx.dev/docs/kb/migration-generators\n * - What `nextSteps` means: https://nx.dev/docs/reference/devkit/MigrationReturnObject\n *\n * Guardrails:\n * - Only touches a `packages/common/shadcn` this plugin's generators produced,\n *   guarded by `components.json`'s aliases still matching the generated shape.\n * - An import is only rewritten when `cn` is its sole binding, so a file also\n *   pulling a user's own helper out of `#lib/utils` keeps resolving through the\n *   re-export.\n * - `src/lib/utils.ts` is only rewritten while it still holds the generated\n *   `twMerge(clsx(...))` helper; a customised one is reported instead.\n * - clsx / tailwind-merge are only dropped once nothing under `src` imports\n *   them.\n * - Idempotent: every write is guarded by the old shape still being present.\n */\n\nconst libraryRoot = joinPathFragments(PACKAGES_DIR, SHARED_SHADCN_DIR);\nconst componentsJsonPath = joinPathFragments(libraryRoot, 'components.json');\nconst packageJsonPath = joinPathFragments(libraryRoot, 'package.json');\nconst srcRoot = joinPathFragments(libraryRoot, 'src');\nconst utilsPath = joinPathFragments(srcRoot, 'lib', 'utils.ts');\n\n/** The aliases today's generators write, which this migration leaves in place. */\nconst generatedAliases: Record<string, string> = {\n  components: '#components',\n  utils: '#lib/utils',\n  hooks: '#hooks',\n  lib: '#lib',\n  ui: '#components/ui',\n};\n\nconst CN_IMPORT_REWRITE = `\\`import { cn } from '#lib/utils'\\` => \\`import { cn } from 'cn'\\``;\n\n/** The generated helper, whichever way the user's formatter has laid it out. */\nconst GENERATED_CN_HELPER = `\\`twMerge(clsx($_))\\``;\n\nconst importsPackage = (name: string): string => `\\`import $_ from '${name}'\\``;\n\nconst REEXPORT_UTILS = `export { cn } from 'cn';\\n`;\n\nconst DROPPED_PACKAGES = ['clsx', 'tailwind-merge'] as const;\n\n/** Every `.ts`/`.tsx` file in the package's source tree. */\nconst sourceFiles = (tree: Tree, dir: string): string[] => {\n  if (!tree.exists(dir)) {\n    return [];\n  }\n  return tree.children(dir).flatMap((entry) => {\n    const path = joinPathFragments(dir, entry);\n    if (!tree.isFile(path)) {\n      return sourceFiles(tree, path);\n    }\n    return path.endsWith('.ts') || path.endsWith('.tsx') ? [path] : [];\n  });\n};\n\nexport default async function migration(\n  tree: Tree,\n): Promise<MigrationReturnObject> {\n  const nextSteps: string[] = [];\n\n  if (!tree.exists(componentsJsonPath) || !tree.exists(packageJsonPath)) {\n    return { nextSteps };\n  }\n\n  const aliases =\n    readJson<{ aliases?: Record<string, string> }>(tree, componentsJsonPath)\n      .aliases ?? {};\n  if (Object.entries(generatedAliases).some(([k, v]) => aliases[k] !== v)) {\n    return { nextSteps };\n  }\n\n  const files = sourceFiles(tree, srcRoot);\n\n  for (const file of files) {\n    await applyGritQL(tree, file, CN_IMPORT_REWRITE);\n  }\n\n  if (tree.exists(utilsPath)) {\n    if (await matchGritQL(tree, utilsPath, GENERATED_CN_HELPER)) {\n      tree.write(utilsPath, REEXPORT_UTILS);\n    } else if (tree.read(utilsPath, 'utf-8') !== REEXPORT_UTILS) {\n      nextSteps.push(\n        `${utilsPath}: no longer holds the generated cn helper - left untouched. Re-export cn from the 'cn' package by hand so consumers importing it from here keep working.`,\n      );\n    }\n  }\n\n  addDependenciesToPackageJson(\n    tree,\n    { cn: TS_VERSIONS.cn },\n    {},\n    packageJsonPath,\n  );\n\n  const stillImported = new Set<string>();\n  for (const file of sourceFiles(tree, srcRoot)) {\n    for (const name of DROPPED_PACKAGES) {\n      if (await matchGritQL(tree, file, importsPackage(name))) {\n        stillImported.add(name);\n      }\n    }\n  }\n\n  const dropped = DROPPED_PACKAGES.filter((name) => !stillImported.has(name));\n  removeDependenciesFromPackageJson(tree, dropped, dropped, packageJsonPath);\n\n  await formatFilesInSubtree(tree);\n\n  return { nextSteps };\n}\n"],"names":["joinPathFragments","readJson","applyGritQL","matchGritQL","addDependenciesToPackageJson","removeDependenciesFromPackageJson","formatFilesInSubtree","PACKAGES_DIR","SHARED_SHADCN_DIR","TS_VERSIONS","libraryRoot","componentsJsonPath","packageJsonPath","srcRoot","utilsPath","generatedAliases","components","utils","hooks","lib","ui","CN_IMPORT_REWRITE","GENERATED_CN_HELPER","importsPackage","name","REEXPORT_UTILS","DROPPED_PACKAGES","sourceFiles","tree","dir","exists","children","flatMap","entry","path","isFile","endsWith","migration","nextSteps","aliases","Object","entries","some","k","v","files","file","write","read","push","cn","stillImported","Set","add","dropped","filter","has"],"mappings":"AAAA;;;CAGC,GACD,SACEA,iBAAiB,EAEjBC,QAAQ,QAEH,aAAa;AACpB,SAASC,WAAW,EAAEC,WAAW,QAAQ,wBAAwB;AACjE,SACEC,4BAA4B,EAC5BC,iCAAiC,QAC5B,iCAAiC;AACxC,SAASC,oBAAoB,QAAQ,2BAA2B;AAChE,SACEC,YAAY,EACZC,iBAAiB,QACZ,gDAAgD;AACvD,SAASC,WAAW,QAAQ,6BAA6B;AAEzD;;;;;;;;;;;;;;;;;;;;;;;;;;;CA2BC,GAED,MAAMC,cAAcV,kBAAkBO,cAAcC;AACpD,MAAMG,qBAAqBX,kBAAkBU,aAAa;AAC1D,MAAME,kBAAkBZ,kBAAkBU,aAAa;AACvD,MAAMG,UAAUb,kBAAkBU,aAAa;AAC/C,MAAMI,YAAYd,kBAAkBa,SAAS,OAAO;AAEpD,gFAAgF,GAChF,MAAME,mBAA2C;IAC/CC,YAAY;IACZC,OAAO;IACPC,OAAO;IACPC,KAAK;IACLC,IAAI;AACN;AAEA,MAAMC,oBAAoB,CAAC,kEAAkE,CAAC;AAE9F,8EAA8E,GAC9E,MAAMC,sBAAsB,CAAC,qBAAqB,CAAC;AAEnD,MAAMC,iBAAiB,CAACC,OAAyB,CAAC,kBAAkB,EAAEA,KAAK,GAAG,CAAC;AAE/E,MAAMC,iBAAiB,CAAC,0BAA0B,CAAC;AAEnD,MAAMC,mBAAmB;IAAC;IAAQ;CAAiB;AAEnD,0DAA0D,GAC1D,MAAMC,cAAc,CAACC,MAAYC;IAC/B,IAAI,CAACD,KAAKE,MAAM,CAACD,MAAM;QACrB,OAAO,EAAE;IACX;IACA,OAAOD,KAAKG,QAAQ,CAACF,KAAKG,OAAO,CAAC,CAACC;QACjC,MAAMC,OAAOlC,kBAAkB6B,KAAKI;QACpC,IAAI,CAACL,KAAKO,MAAM,CAACD,OAAO;YACtB,OAAOP,YAAYC,MAAMM;QAC3B;QACA,OAAOA,KAAKE,QAAQ,CAAC,UAAUF,KAAKE,QAAQ,CAAC,UAAU;YAACF;SAAK,GAAG,EAAE;IACpE;AACF;AAEA,eAAe,eAAeG,UAC5BT,IAAU;IAEV,MAAMU,YAAsB,EAAE;IAE9B,IAAI,CAACV,KAAKE,MAAM,CAACnB,uBAAuB,CAACiB,KAAKE,MAAM,CAAClB,kBAAkB;QACrE,OAAO;YAAE0B;QAAU;IACrB;IAEA,MAAMC,UACJtC,SAA+C2B,MAAMjB,oBAClD4B,OAAO,IAAI,CAAC;IACjB,IAAIC,OAAOC,OAAO,CAAC1B,kBAAkB2B,IAAI,CAAC,CAAC,CAACC,GAAGC,EAAE,GAAKL,OAAO,CAACI,EAAE,KAAKC,IAAI;QACvE,OAAO;YAAEN;QAAU;IACrB;IAEA,MAAMO,QAAQlB,YAAYC,MAAMf;IAEhC,KAAK,MAAMiC,QAAQD,MAAO;QACxB,MAAM3C,YAAY0B,MAAMkB,MAAMzB;IAChC;IAEA,IAAIO,KAAKE,MAAM,CAAChB,YAAY;QAC1B,IAAI,MAAMX,YAAYyB,MAAMd,WAAWQ,sBAAsB;YAC3DM,KAAKmB,KAAK,CAACjC,WAAWW;QACxB,OAAO,IAAIG,KAAKoB,IAAI,CAAClC,WAAW,aAAaW,gBAAgB;YAC3Da,UAAUW,IAAI,CACZ,GAAGnC,UAAU,wJAAwJ,CAAC;QAE1K;IACF;IAEAV,6BACEwB,MACA;QAAEsB,IAAIzC,YAAYyC,EAAE;IAAC,GACrB,CAAC,GACDtC;IAGF,MAAMuC,gBAAgB,IAAIC;IAC1B,KAAK,MAAMN,QAAQnB,YAAYC,MAAMf,SAAU;QAC7C,KAAK,MAAMW,QAAQE,iBAAkB;YACnC,IAAI,MAAMvB,YAAYyB,MAAMkB,MAAMvB,eAAeC,QAAQ;gBACvD2B,cAAcE,GAAG,CAAC7B;YACpB;QACF;IACF;IAEA,MAAM8B,UAAU5B,iBAAiB6B,MAAM,CAAC,CAAC/B,OAAS,CAAC2B,cAAcK,GAAG,CAAChC;IACrEnB,kCAAkCuB,MAAM0B,SAASA,SAAS1C;IAE1D,MAAMN,qBAAqBsB;IAE3B,OAAO;QAAEU;IAAU;AACrB"}

package/src/migrations/v1.0.2/0001-terraform-harness-environment-variables/migration.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../../../../../../../packages/nx-plugin/src/migrations/v1.0.2/0001-terraform-harness-environment-variables/migration.ts"],"sourcesContent":["/**\n * Copyright Amazon.com, Inc. or its affiliates. All Rights Reserved.\n * SPDX-License-Identifier: Apache-2.0\n */\nimport {\n  joinPathFragments,\n  type MigrationReturnObject,\n  type Tree,\n} from '@nx/devkit';\nimport { formatFilesInSubtree } from '../../../utils/format.js';\nimport {\n  PACKAGES_DIR,\n  SHARED_TERRAFORM_DIR,\n} from '../../../utils/shared-constructs-constants.js';\n\n/**\n * Stop each vended Terraform AgentCore Harness app module\n * (`app/harnesses/<name>/<name>.tf`) sending a null `environment_variables`.\n *\n * The service stores no environment variables as an empty map and returns one,\n * so a null fails the apply with \"inconsistent values for sensitive attribute\"\n * once the Harness has already been created, leaving it tainted. Every\n * subsequent apply fails the same way.\n *\n * Modules whose assignment has been edited are left untouched and reported via\n * `nextSteps`.\n */\n\nconst TERRAFORM_HARNESS_APP_DIR = `${PACKAGES_DIR}/${SHARED_TERRAFORM_DIR}/src/app/harnesses`;\n\n/** The assignment the generator used to write. */\nconst NULLABLE_ASSIGNMENT = 'environment_variables = var.environment_variables';\n\n/** What it becomes, so the value sent matches what the service returns. */\nconst COALESCED_ASSIGNMENT =\n  'environment_variables = coalesce(var.environment_variables, {})';\n\nconst divergedMessage = (filePath: string) =>\n  `${filePath}: its environment_variables assignment has been edited, so it was left as it is. Change it to \\`${COALESCED_ASSIGNMENT}\\` — the AgentCore service returns an empty map when a Harness has no environment variables, and sending null fails the apply after the Harness has been created.`;\n\nexport default async function migration(\n  tree: Tree,\n): Promise<MigrationReturnObject> {\n  const nextSteps: string[] = [];\n  let migrated = false;\n\n  if (!tree.exists(TERRAFORM_HARNESS_APP_DIR)) {\n    return { nextSteps }; // This workspace has no Terraform harness modules.\n  }\n\n  for (const dirName of tree.children(TERRAFORM_HARNESS_APP_DIR)) {\n    const filePath = joinPathFragments(\n      TERRAFORM_HARNESS_APP_DIR,\n      dirName,\n      `${dirName}.tf`,\n    );\n    if (!tree.exists(filePath)) {\n      continue; // Not a harness app module directory.\n    }\n\n    const contents = tree.read(filePath, 'utf-8') ?? '';\n\n    if (contents.includes(COALESCED_ASSIGNMENT)) {\n      continue; // Already migrated, so a re-run is a no-op.\n    }\n\n    if (!contents.includes(NULLABLE_ASSIGNMENT)) {\n      nextSteps.push(divergedMessage(filePath));\n      continue;\n    }\n\n    tree.write(\n      filePath,\n      contents.replace(NULLABLE_ASSIGNMENT, COALESCED_ASSIGNMENT),\n    );\n    migrated = true;\n  }\n\n  if (migrated) {\n    await formatFilesInSubtree(tree, TERRAFORM_HARNESS_APP_DIR);\n  }\n\n  return { nextSteps };\n}\n"],"names":["joinPathFragments","formatFilesInSubtree","PACKAGES_DIR","SHARED_TERRAFORM_DIR","TERRAFORM_HARNESS_APP_DIR","NULLABLE_ASSIGNMENT","COALESCED_ASSIGNMENT","divergedMessage","filePath","migration","tree","nextSteps","migrated","exists","dirName","children","contents","read","includes","push","write","replace"],"mappings":"AAAA;;;CAGC,GACD,SACEA,iBAAiB,QAGZ,aAAa;AACpB,SAASC,oBAAoB,QAAQ,2BAA2B;AAChE,SACEC,YAAY,EACZC,oBAAoB,QACf,gDAAgD;AAEvD;;;;;;;;;;;CAWC,GAED,MAAMC,4BAA4B,GAAGF,aAAa,CAAC,EAAEC,qBAAqB,kBAAkB,CAAC;AAE7F,gDAAgD,GAChD,MAAME,sBAAsB;AAE5B,yEAAyE,GACzE,MAAMC,uBACJ;AAEF,MAAMC,kBAAkB,CAACC,WACvB,GAAGA,SAAS,gGAAgG,EAAEF,qBAAqB,iKAAiK,CAAC;AAEvS,eAAe,eAAeG,UAC5BC,IAAU;IAEV,MAAMC,YAAsB,EAAE;IAC9B,IAAIC,WAAW;IAEf,IAAI,CAACF,KAAKG,MAAM,CAACT,4BAA4B;QAC3C,OAAO;YAAEO;QAAU,GAAG,mDAAmD;IAC3E;IAEA,KAAK,MAAMG,WAAWJ,KAAKK,QAAQ,CAACX,2BAA4B;QAC9D,MAAMI,WAAWR,kBACfI,2BACAU,SACA,GAAGA,QAAQ,GAAG,CAAC;QAEjB,IAAI,CAACJ,KAAKG,MAAM,CAACL,WAAW;YAC1B,UAAU,sCAAsC;QAClD;QAEA,MAAMQ,WAAWN,KAAKO,IAAI,CAACT,UAAU,YAAY;QAEjD,IAAIQ,SAASE,QAAQ,CAACZ,uBAAuB;YAC3C,UAAU,4CAA4C;QACxD;QAEA,IAAI,CAACU,SAASE,QAAQ,CAACb,sBAAsB;YAC3CM,UAAUQ,IAAI,CAACZ,gBAAgBC;YAC/B;QACF;QAEAE,KAAKU,KAAK,CACRZ,UACAQ,SAASK,OAAO,CAAChB,qBAAqBC;QAExCM,WAAW;IACb;IAEA,IAAIA,UAAU;QACZ,MAAMX,qBAAqBS,MAAMN;IACnC;IAEA,OAAO;QAAEO;IAAU;AACrB"}

package/src/migrations/v1.0.3/0001-terraform-init-target/metadata.json

@@ -0,0 +1,3 @@
+{
+  "description": "Add the terraform-init target to Terraform projects so the shared provider plugin cache has a single writer"
+}

package/src/migrations/v1.0.3/0001-terraform-init-target/migration.d.ts

@@ -0,0 +1,6 @@
+/**
+ * Copyright Amazon.com, Inc. or its affiliates. All Rights Reserved.
+ * SPDX-License-Identifier: Apache-2.0
+ */
+import { type MigrationReturnObject, type Tree } from '@nx/devkit';
+export default function migration(tree: Tree): Promise<MigrationReturnObject>;

package/src/migrations/v1.0.3/0001-terraform-init-target/migration.js

@@ -0,0 +1,153 @@
+/**
+ * Copyright Amazon.com, Inc. or its affiliates. All Rights Reserved.
+ * SPDX-License-Identifier: Apache-2.0
+ */ import { getProjects, joinPathFragments, updateProjectConfiguration } from "@nx/devkit";
+import { relative } from "path";
+import { TERRAFORM_PROJECT_GENERATOR_INFO } from "../../../terraform/project/generator.js";
+import { formatFilesInSubtree } from "../../../utils/format.js";
+import { sortObjectKeys } from "../../../utils/object.js";
+/**
+ * Give the shared Terraform provider plugin cache a single writer.
+ *
+ * `init`, `test` and `validate` each ran their own `terraform init` against one
+ * per-project cache, and Nx schedules them concurrently — `plan` depends on both
+ * `init` and `validate`. Two `terraform init` runs filling the cache at once each
+ * compute a different hash for the same provider, because the hash covers a
+ * directory the other is still writing, and terraform then rejects the mismatch
+ * against the lock file: "the cached package ... does not match any of the
+ * checksums recorded in the dependency lock file".
+ *
+ * The new `terraform-init` target runs that init once, and `test`, `validate` and
+ * `init` depend on it — `test` and `validate` now run against the `TF_DATA_DIR`
+ * it prepared rather than initialising their own.
+ */ const TERRAFORM_INIT = 'terraform-init';
+/** `terraform init` as the pre-fix `test` and `validate` targets ran it. */ const BACKENDLESS_INIT = 'terraform init -backend=false';
+const divergedStep = (projectName, targetName)=>`${projectName}: its '${targetName}' target no longer matches the shape the generator produced - left untouched. Point it at the \`TF_DATA_DIR\` of the new \`${TERRAFORM_INIT}\` target and add \`"dependsOn": ["${TERRAFORM_INIT}"]\`, so its \`terraform init\` no longer races the other targets over the provider cache.`;
+/** Path from a target running in `{projectRoot}/src` back to the workspace root. */ const rootRelativePath = (projectRoot)=>relative(joinPathFragments(projectRoot, 'src'), '.').replace(/\\/g, '/');
+const pluginCacheDirFor = (toRoot)=>joinPathFragments(toRoot, '.terraform', 'plugin-cache', '{projectRoot}');
+const dataDirFor = (toRoot, name)=>joinPathFragments(toRoot, 'dist', '{projectRoot}', name);
+/**
+ * The target as the generator vends it: `-backend=false` needs no credentials,
+ * so this runs on a fresh workspace before `bootstrap`, and its `TF_DATA_DIR`
+ * keeps the `.terraform` it initialises out of `src`.
+ */ const terraformInitTarget = (projectRoot)=>{
+    const toRoot = rootRelativePath(projectRoot);
+    const pluginCacheDir = pluginCacheDirFor(toRoot);
+    return {
+        executor: 'nx:run-commands',
+        options: {
+            commands: [
+                {
+                    command: `shx mkdir -p ${pluginCacheDir}`,
+                    forwardAllArgs: false
+                },
+                BACKENDLESS_INIT
+            ],
+            forwardAllArgs: true,
+            cwd: '{projectRoot}/src',
+            parallel: false,
+            env: {
+                TF_DATA_DIR: dataDirFor(toRoot, TERRAFORM_INIT),
+                TF_PLUGIN_CACHE_DIR: pluginCacheDir
+            }
+        }
+    };
+};
+/** Every command a target runs, across its options and its configurations. */ const commandsOf = (target)=>[
+        target.options,
+        ...Object.values(target.configurations ?? {})
+    ].flatMap((holder)=>[
+            holder?.command,
+            ...Array.isArray(holder?.commands) ? holder.commands : []
+        ]).map((command)=>typeof command === 'string' ? command : command?.command).filter((command)=>typeof command === 'string');
+/**
+ * Whether the target still runs the `terraform init` this migration orders. A
+ * library's `init` runs it directly and an application's delegates to the vended
+ * script.
+ */ const runsTerraformInit = (target)=>commandsOf(target).some((command)=>command.includes('terraform init') || command.includes('scripts/init.ts'));
+/** Creating the plugin cache directory, which `terraform-init` now does. */ const isMakeCacheDir = (command)=>/^(shx mkdir -p|make-dir)\s/.test(command) && command.includes('plugin-cache');
+/**
+ * Rewrites `test` or `validate` to run against the `TF_DATA_DIR` `terraform-init`
+ * prepared. Only the exact shape the generator produced is rewritten: its own
+ * `terraform init` (with the cache directory the plugin-cache fix added ahead of
+ * it), then the one terraform command the target exists to run. Anything else is
+ * the user's, and is reported instead.
+ */ const migrateInitlessTarget = (target, verb, toRoot)=>{
+    const commands = commandsOf(target).filter((command)=>!isMakeCacheDir(command));
+    if (commands.length !== 2 || commands[0] !== BACKENDLESS_INIT || commands[1] !== `terraform ${verb}`) {
+        return false;
+    }
+    const options = target.options ?? {};
+    const env = options.env ?? {};
+    if (env.TF_DATA_DIR !== dataDirFor(toRoot, `terraform-${verb}`)) {
+        return false;
+    }
+    const { TF_DATA_DIR: _dataDir, TF_PLUGIN_CACHE_DIR: _cacheDir, ...rest } = env;
+    delete options.commands;
+    // `parallel: false` sequenced the init ahead of the command; one command left.
+    delete options.parallel;
+    target.options = {
+        ...options,
+        command: `terraform ${verb}`,
+        env: {
+            ...rest,
+            TF_DATA_DIR: dataDirFor(toRoot, TERRAFORM_INIT)
+        }
+    };
+    return true;
+};
+export default async function migration(tree) {
+    const nextSteps = [];
+    for (const [projectName, project] of getProjects(tree)){
+        const generator = project.metadata?.generator;
+        if (generator !== TERRAFORM_PROJECT_GENERATOR_INFO.id) continue;
+        let targets = project.targets ?? {};
+        const toRoot = rootRelativePath(project.root);
+        let changed = false;
+        // Guarded on the target being absent, so a re-run — and a project generated
+        // with it — is a no-op.
+        if (!targets[TERRAFORM_INIT]) {
+            targets = sortObjectKeys({
+                ...targets,
+                [TERRAFORM_INIT]: terraformInitTarget(project.root)
+            });
+            changed = true;
+        }
+        for (const targetName of [
+            'init',
+            'test',
+            'validate'
+        ]){
+            const target = targets[targetName];
+            if (!target) continue;
+            if (target.dependsOn?.includes(TERRAFORM_INIT)) continue;
+            // `init` keeps its own backend-configured `terraform init`; `test` and
+            // `validate` hand theirs over to `terraform-init`, so nothing is ordered
+            // after a target whose shape is no longer recognised.
+            const migrated = targetName === 'init' ? runsTerraformInit(target) : migrateInitlessTarget(target, targetName, toRoot);
+            if (!migrated) {
+                nextSteps.push(divergedStep(projectName, targetName));
+                continue;
+            }
+            // Prepended rather than appended, so a migrated workspace matches a
+            // freshly generated one.
+            target.dependsOn = [
+                TERRAFORM_INIT,
+                ...target.dependsOn ?? []
+            ];
+            changed = true;
+        }
+        if (changed) {
+            updateProjectConfiguration(tree, projectName, {
+                ...project,
+                targets
+            });
+        }
+    }
+    await formatFilesInSubtree(tree);
+    return {
+        nextSteps
+    };
+}
+
+//# sourceMappingURL=migration.js.map