@aws/nx-plugin 1.0.3 → 1.0.5

package/LICENSE-THIRD-PARTY

@@ -108,7 +108,7 @@ THE SOFTWARE.
 
 ---
 
-The following software may be included in this product: @astral-sh/ruff-wasm-nodejs (0.16.8)
+The following software may be included in this product: @astral-sh/ruff-wasm-nodejs (0.16.9)
 This software contains the following license and notice below:
 
 MIT License
@@ -3898,7 +3898,7 @@ SOFTWARE.
 
 ---
 
-The following software may be included in this product: @modelcontextprotocol/sdk (1.30.0)
+The following software may be included in this product: @modelcontextprotocol/sdk (1.30.1)
 This software contains the following license and notice below:
 
 MIT License
@@ -4274,7 +4274,7 @@ SOFTWARE.
 
 ---
 
-The following software may be included in this product: @oxc-project/types (0.148.0)
+The following software may be included in this product: @oxc-project/types (0.151.0)
 This software contains the following license and notice below:
 
 MIT License
@@ -8757,7 +8757,7 @@ THE SOFTWARE.
 
 ---
 
-The following software may be included in this product: fs-extra (11.4.0)
+The following software may be included in this product: fs-extra (11.4.1)
 This software contains the following license and notice below:
 
 (The MIT License)
@@ -9034,7 +9034,7 @@ WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE.
 
 ---
 
-The following software may be included in this product: hono (4.13.3)
+The following software may be included in this product: hono (4.13.8)
 This software contains the following license and notice below:
 
 MIT License
@@ -14165,7 +14165,7 @@ SOFTWARE.
 
 ---
 
-The following software may be included in this product: rolldown (1.2.7)
+The following software may be included in this product: rolldown (1.2.11)
 This software contains the following license and notice below:
 
 MIT License
@@ -16088,7 +16088,7 @@ SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE.
 
 ---
 
-The following software may be included in this product: vite (8.3.0)
+The following software may be included in this product: vite (8.3.1)
 This software contains the following license and notice below:
 
 # Vite core license

package/migrations.json

@@ -2,10 +2,10 @@
   "$schema": "http://json-schema.org/schema",
   "name": "@aws/nx-plugin",
   "generators": {
-    "latest-terraform-init-target": {
-      "version": "1.0.3",
-      "description": "Add the terraform-init target to Terraform projects so the shared provider plugin cache has a single writer",
-      "implementation": "./src/migrations/latest/terraform-init-target/migration"
+    "latest-api-custom-domain-runtime-config": {
+      "version": "1.0.5",
+      "description": "Publish a configured custom domain as the API URL in runtime config for vended REST/HTTP API constructs and Terraform modules, and add custom domain inputs to the Terraform API modules",
+      "implementation": "./src/migrations/latest/api-custom-domain-runtime-config/migration"
     },
     "v1.0.0-rc.50-0001-modernize-function-props-cast": {
       "version": "1.0.0-rc.50",
@@ -377,8 +377,13 @@
       "description": "Send an empty map rather than null for a vended Terraform AgentCore Harness module's environment_variables, so the first apply does not fail after creating the Harness",
       "implementation": "./src/migrations/v1.0.2/0001-terraform-harness-environment-variables/migration"
     },
-    "sync-vended-versions": {
+    "v1.0.3-0001-terraform-init-target": {
       "version": "1.0.3",
+      "description": "Add the terraform-init target to Terraform projects so the shared provider plugin cache has a single writer",
+      "implementation": "./src/migrations/v1.0.3/0001-terraform-init-target/migration"
+    },
+    "sync-vended-versions": {
+      "version": "1.0.5",
       "description": "Sync vended dependency versions and the tracked plugin version to those vended by this release",
       "implementation": "./src/utils/version-upgrade-migration/migration"
     }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@aws/nx-plugin",
-  "version": "1.0.3",
+  "version": "1.0.5",
   "repository": {
     "type": "git",
     "url": "https://github.com/awslabs/nx-plugin-for-aws.git",
@@ -40,12 +40,12 @@
   },
   "dependencies": {
     "@apidevtools/swagger-parser": "12.1.0",
-    "@astral-sh/ruff-wasm-nodejs": "0.16.8",
+    "@astral-sh/ruff-wasm-nodejs": "0.16.9",
     "@biomejs/js-api": "6.0.0",
     "@biomejs/wasm-nodejs": "2.5.14",
     "@getgrit/gritql": "0.0.3",
     "@iarna/toml": "2.2.5",
-    "@modelcontextprotocol/sdk": "1.30.0",
+    "@modelcontextprotocol/sdk": "1.30.1",
     "@nx/devkit": "23.2.1",
     "@nx/js": "23.2.1",
     "@nx/react": "23.2.1",
@@ -79,7 +79,7 @@
     "typescript": "6.0.3",
     "unified": "11.0.5",
     "unist-util-visit": "5.1.0",
-    "vite": "8.3.0",
+    "vite": "8.3.1",
     "vitest": "4.1.11",
     "zod": "4.6.5"
   },

package/src/infra/app/__snapshots__/generator.spec.ts.snap

@@ -50,7 +50,7 @@ exports[`infra generator > should configure Checkov target correctly > checkov-t
     "default",
   ],
   "options": {
-    "command": "uvx --from checkov==3.3.19 checkov --config-file {projectRoot}/checkov.yml --directory dist/{projectRoot}/cdk.out --framework cloudformation",
+    "command": "uvx --from checkov==3.3.20 checkov --config-file {projectRoot}/checkov.yml --directory dist/{projectRoot}/cdk.out --framework cloudformation",
   },
   "outputs": [
     "{workspaceRoot}/dist/{projectRoot}/checkov",
@@ -150,7 +150,7 @@ exports[`infra generator > should configure project.json with correct targets >
         "default",
       ],
       "options": {
-        "command": "uvx --from checkov==3.3.19 checkov --config-file {projectRoot}/checkov.yml --directory dist/{projectRoot}/cdk.out --framework cloudformation",
+        "command": "uvx --from checkov==3.3.20 checkov --config-file {projectRoot}/checkov.yml --directory dist/{projectRoot}/cdk.out --framework cloudformation",
       },
       "outputs": [
         "{workspaceRoot}/dist/{projectRoot}/checkov",
@@ -762,7 +762,7 @@ exports[`infra generator > should handle custom project names correctly > custom
         "default",
       ],
       "options": {
-        "command": "uvx --from checkov==3.3.19 checkov --config-file {projectRoot}/checkov.yml --directory dist/{projectRoot}/cdk.out --framework cloudformation",
+        "command": "uvx --from checkov==3.3.20 checkov --config-file {projectRoot}/checkov.yml --directory dist/{projectRoot}/cdk.out --framework cloudformation",
       },
       "outputs": [
         "{workspaceRoot}/dist/{projectRoot}/checkov",

package/src/license/dependency-check/collectors/npm-collector.d.ts

@@ -7,4 +7,18 @@ export interface NpmDependency {
 export interface NpmCollectorOptions {
     start: string;
 }
+/**
+ * Resolve a license that only names a file into the license that file grants.
+ *
+ * license-checker reads a package's license file only when the package declares
+ * no license, so a package declaring `SEE LICENSE IN LICENSE` is reported as
+ * `Custom: LICENSE` and evaluates to UNKNOWN even when the file grants a
+ * pre-approved license. Read the file license-checker already located and run
+ * its text detection over it, which returns an SPDX id with the trailing `*`
+ * marking a license guessed from text.
+ *
+ * The reference is kept when the file can't be read, or when detection can't
+ * name a license, so the dependency is still reported as UNKNOWN.
+ */
+export declare const resolveFileReferencedLicense: (rawLicense: string, licenseFile: string | undefined) => string;
 export declare const collectNpmDependencies: (options: NpmCollectorOptions) => Promise<NpmDependency[]>;

package/src/license/dependency-check/collectors/npm-collector.js

@@ -3,6 +3,10 @@
  * SPDX-License-Identifier: Apache-2.0
  */ import { existsSync, readFileSync } from "fs";
 import * as licenseChecker from "license-checker-rseidelsohn";
+// license-checker's own license-from-text detection, which it applies to
+// packages that declare no license. Reused here so a `SEE LICENSE IN <file>`
+// package resolves the same way, rather than through a second implementation.
+import { getLicenseTitle } from "license-checker-rseidelsohn/lib/getLicenseTitle.js";
 import { join } from "path";
 const NAME_VERSION_RE = /^(@?[^@]+)@(.+)$/;
 const splitNameVersion = (identifier)=>{
@@ -27,6 +31,36 @@ const flattenLicense = (raw)=>{
     }
     return raw;
 };
+/**
+ * A license that names a file instead of a license: the SPDX form
+ * `SEE LICENSE IN <file>`, or the `Custom: <file>` license-checker reports it
+ * as.
+ */ const FILE_REFERENCE_RE = /^(?:custom:|see\s+license\s+in)\s+(.+)$/i;
+/**
+ * Resolve a license that only names a file into the license that file grants.
+ *
+ * license-checker reads a package's license file only when the package declares
+ * no license, so a package declaring `SEE LICENSE IN LICENSE` is reported as
+ * `Custom: LICENSE` and evaluates to UNKNOWN even when the file grants a
+ * pre-approved license. Read the file license-checker already located and run
+ * its text detection over it, which returns an SPDX id with the trailing `*`
+ * marking a license guessed from text.
+ *
+ * The reference is kept when the file can't be read, or when detection can't
+ * name a license, so the dependency is still reported as UNKNOWN.
+ */ export const resolveFileReferencedLicense = (rawLicense, licenseFile)=>{
+    if (!licenseFile || !FILE_REFERENCE_RE.test(rawLicense.trim())) {
+        return rawLicense;
+    }
+    let detected = null;
+    try {
+        detected = getLicenseTitle(readFileSync(licenseFile, 'utf-8'));
+    } catch  {
+        return rawLicense;
+    }
+    if (!detected || detected === 'Undefined' || FILE_REFERENCE_RE.test(detected)) return rawLicense;
+    return detected;
+};
 export const collectNpmDependencies = async (options)=>{
     const nodeModules = join(options.start, 'node_modules');
     if (!existsSync(nodeModules)) {
@@ -58,7 +92,7 @@ export const collectNpmDependencies = async (options)=>{
         out.push({
             name,
             version,
-            rawLicense: flattenLicense(info.licenses),
+            rawLicense: resolveFileReferencedLicense(flattenLicense(info.licenses), info.licenseFile),
             path: info.path
         });
     }

package/src/license/dependency-check/collectors/npm-collector.js.map

@@ -1 +1 @@
-{"version":3,"sources":["../../../../../../../packages/nx-plugin/src/license/dependency-check/collectors/npm-collector.ts"],"sourcesContent":["/**\n * Copyright Amazon.com, Inc. or its affiliates. All Rights Reserved.\n * SPDX-License-Identifier: Apache-2.0\n */\nimport { existsSync, readFileSync } from 'fs';\nimport * as licenseChecker from 'license-checker-rseidelsohn';\nimport { join } from 'path';\n\nexport interface NpmDependency {\n  name: string;\n  version: string;\n  rawLicense: string;\n  path?: string;\n}\n\nexport interface NpmCollectorOptions {\n  start: string;\n}\n\nconst NAME_VERSION_RE = /^(@?[^@]+)@(.+)$/;\n\nconst splitNameVersion = (\n  identifier: string,\n): { name: string; version: string } => {\n  const match = identifier.match(NAME_VERSION_RE);\n  if (!match) {\n    return { name: identifier, version: '0.0.0' };\n  }\n  return { name: match[1], version: match[2] };\n};\n\nconst flattenLicense = (raw: string | string[] | undefined | null): string => {\n  if (!raw) return '';\n  if (Array.isArray(raw)) {\n    if (raw.length === 0) return '';\n    if (raw.length === 1) return raw[0];\n    return `(${raw.join(' OR ')})`;\n  }\n  return raw;\n};\n\nexport const collectNpmDependencies = async (\n  options: NpmCollectorOptions,\n): Promise<NpmDependency[]> => {\n  const nodeModules = join(options.start, 'node_modules');\n  if (!existsSync(nodeModules)) {\n    return [];\n  }\n\n  const exclude = new Set<string>();\n\n  const projectPackageJson = join(options.start, 'package.json');\n  if (existsSync(projectPackageJson)) {\n    try {\n      const pkg = JSON.parse(readFileSync(projectPackageJson, 'utf-8')) as {\n        name?: string;\n      };\n      if (pkg.name) exclude.add(pkg.name);\n    } catch {\n      // ignore\n    }\n  }\n\n  const packages = await new Promise<licenseChecker.ModuleInfos>(\n    (resolve, reject) => {\n      licenseChecker.init(\n        {\n          start: options.start,\n          excludePrivatePackages: true,\n        },\n        (err, results) => {\n          if (err) reject(err);\n          else resolve(results);\n        },\n      );\n    },\n  );\n\n  const out: NpmDependency[] = [];\n  for (const [identifier, info] of Object.entries(packages)) {\n    const { name, version } = splitNameVersion(identifier);\n    if (exclude.has(name)) continue;\n    out.push({\n      name,\n      version,\n      rawLicense: flattenLicense(info.licenses),\n      path: info.path,\n    });\n  }\n  return out;\n};\n"],"names":["existsSync","readFileSync","licenseChecker","join","NAME_VERSION_RE","splitNameVersion","identifier","match","name","version","flattenLicense","raw","Array","isArray","length","collectNpmDependencies","options","nodeModules","start","exclude","Set","projectPackageJson","pkg","JSON","parse","add","packages","Promise","resolve","reject","init","excludePrivatePackages","err","results","out","info","Object","entries","has","push","rawLicense","licenses","path"],"mappings":"AAAA;;;CAGC,GACD,SAASA,UAAU,EAAEC,YAAY,QAAQ,KAAK;AAC9C,YAAYC,oBAAoB,8BAA8B;AAC9D,SAASC,IAAI,QAAQ,OAAO;AAa5B,MAAMC,kBAAkB;AAExB,MAAMC,mBAAmB,CACvBC;IAEA,MAAMC,QAAQD,WAAWC,KAAK,CAACH;IAC/B,IAAI,CAACG,OAAO;QACV,OAAO;YAAEC,MAAMF;YAAYG,SAAS;QAAQ;IAC9C;IACA,OAAO;QAAED,MAAMD,KAAK,CAAC,EAAE;QAAEE,SAASF,KAAK,CAAC,EAAE;IAAC;AAC7C;AAEA,MAAMG,iBAAiB,CAACC;IACtB,IAAI,CAACA,KAAK,OAAO;IACjB,IAAIC,MAAMC,OAAO,CAACF,MAAM;QACtB,IAAIA,IAAIG,MAAM,KAAK,GAAG,OAAO;QAC7B,IAAIH,IAAIG,MAAM,KAAK,GAAG,OAAOH,GAAG,CAAC,EAAE;QACnC,OAAO,CAAC,CAAC,EAAEA,IAAIR,IAAI,CAAC,QAAQ,CAAC,CAAC;IAChC;IACA,OAAOQ;AACT;AAEA,OAAO,MAAMI,yBAAyB,OACpCC;IAEA,MAAMC,cAAcd,KAAKa,QAAQE,KAAK,EAAE;IACxC,IAAI,CAAClB,WAAWiB,cAAc;QAC5B,OAAO,EAAE;IACX;IAEA,MAAME,UAAU,IAAIC;IAEpB,MAAMC,qBAAqBlB,KAAKa,QAAQE,KAAK,EAAE;IAC/C,IAAIlB,WAAWqB,qBAAqB;QAClC,IAAI;YACF,MAAMC,MAAMC,KAAKC,KAAK,CAACvB,aAAaoB,oBAAoB;YAGxD,IAAIC,IAAId,IAAI,EAAEW,QAAQM,GAAG,CAACH,IAAId,IAAI;QACpC,EAAE,OAAM;QACN,SAAS;QACX;IACF;IAEA,MAAMkB,WAAW,MAAM,IAAIC,QACzB,CAACC,SAASC;QACR3B,eAAe4B,IAAI,CACjB;YACEZ,OAAOF,QAAQE,KAAK;YACpBa,wBAAwB;QAC1B,GACA,CAACC,KAAKC;YACJ,IAAID,KAAKH,OAAOG;iBACXJ,QAAQK;QACf;IAEJ;IAGF,MAAMC,MAAuB,EAAE;IAC/B,KAAK,MAAM,CAAC5B,YAAY6B,KAAK,IAAIC,OAAOC,OAAO,CAACX,UAAW;QACzD,MAAM,EAAElB,IAAI,EAAEC,OAAO,EAAE,GAAGJ,iBAAiBC;QAC3C,IAAIa,QAAQmB,GAAG,CAAC9B,OAAO;QACvB0B,IAAIK,IAAI,CAAC;YACP/B;YACAC;YACA+B,YAAY9B,eAAeyB,KAAKM,QAAQ;YACxCC,MAAMP,KAAKO,IAAI;QACjB;IACF;IACA,OAAOR;AACT,EAAE"}
+{"version":3,"sources":["../../../../../../../packages/nx-plugin/src/license/dependency-check/collectors/npm-collector.ts"],"sourcesContent":["/**\n * Copyright Amazon.com, Inc. or its affiliates. All Rights Reserved.\n * SPDX-License-Identifier: Apache-2.0\n */\nimport { existsSync, readFileSync } from 'fs';\nimport * as licenseChecker from 'license-checker-rseidelsohn';\n// license-checker's own license-from-text detection, which it applies to\n// packages that declare no license. Reused here so a `SEE LICENSE IN <file>`\n// package resolves the same way, rather than through a second implementation.\nimport { getLicenseTitle } from 'license-checker-rseidelsohn/lib/getLicenseTitle.js';\nimport { join } from 'path';\n\nexport interface NpmDependency {\n  name: string;\n  version: string;\n  rawLicense: string;\n  path?: string;\n}\n\nexport interface NpmCollectorOptions {\n  start: string;\n}\n\nconst NAME_VERSION_RE = /^(@?[^@]+)@(.+)$/;\n\nconst splitNameVersion = (\n  identifier: string,\n): { name: string; version: string } => {\n  const match = identifier.match(NAME_VERSION_RE);\n  if (!match) {\n    return { name: identifier, version: '0.0.0' };\n  }\n  return { name: match[1], version: match[2] };\n};\n\nconst flattenLicense = (raw: string | string[] | undefined | null): string => {\n  if (!raw) return '';\n  if (Array.isArray(raw)) {\n    if (raw.length === 0) return '';\n    if (raw.length === 1) return raw[0];\n    return `(${raw.join(' OR ')})`;\n  }\n  return raw;\n};\n\n/**\n * A license that names a file instead of a license: the SPDX form\n * `SEE LICENSE IN <file>`, or the `Custom: <file>` license-checker reports it\n * as.\n */\nconst FILE_REFERENCE_RE = /^(?:custom:|see\\s+license\\s+in)\\s+(.+)$/i;\n\n/**\n * Resolve a license that only names a file into the license that file grants.\n *\n * license-checker reads a package's license file only when the package declares\n * no license, so a package declaring `SEE LICENSE IN LICENSE` is reported as\n * `Custom: LICENSE` and evaluates to UNKNOWN even when the file grants a\n * pre-approved license. Read the file license-checker already located and run\n * its text detection over it, which returns an SPDX id with the trailing `*`\n * marking a license guessed from text.\n *\n * The reference is kept when the file can't be read, or when detection can't\n * name a license, so the dependency is still reported as UNKNOWN.\n */\nexport const resolveFileReferencedLicense = (\n  rawLicense: string,\n  licenseFile: string | undefined,\n): string => {\n  if (!licenseFile || !FILE_REFERENCE_RE.test(rawLicense.trim())) {\n    return rawLicense;\n  }\n  let detected: string | null = null;\n  try {\n    detected = getLicenseTitle(readFileSync(licenseFile, 'utf-8'));\n  } catch {\n    return rawLicense;\n  }\n  if (!detected || detected === 'Undefined' || FILE_REFERENCE_RE.test(detected))\n    return rawLicense;\n  return detected;\n};\n\nexport const collectNpmDependencies = async (\n  options: NpmCollectorOptions,\n): Promise<NpmDependency[]> => {\n  const nodeModules = join(options.start, 'node_modules');\n  if (!existsSync(nodeModules)) {\n    return [];\n  }\n\n  const exclude = new Set<string>();\n\n  const projectPackageJson = join(options.start, 'package.json');\n  if (existsSync(projectPackageJson)) {\n    try {\n      const pkg = JSON.parse(readFileSync(projectPackageJson, 'utf-8')) as {\n        name?: string;\n      };\n      if (pkg.name) exclude.add(pkg.name);\n    } catch {\n      // ignore\n    }\n  }\n\n  const packages = await new Promise<licenseChecker.ModuleInfos>(\n    (resolve, reject) => {\n      licenseChecker.init(\n        {\n          start: options.start,\n          excludePrivatePackages: true,\n        },\n        (err, results) => {\n          if (err) reject(err);\n          else resolve(results);\n        },\n      );\n    },\n  );\n\n  const out: NpmDependency[] = [];\n  for (const [identifier, info] of Object.entries(packages)) {\n    const { name, version } = splitNameVersion(identifier);\n    if (exclude.has(name)) continue;\n    out.push({\n      name,\n      version,\n      rawLicense: resolveFileReferencedLicense(\n        flattenLicense(info.licenses),\n        info.licenseFile,\n      ),\n      path: info.path,\n    });\n  }\n  return out;\n};\n"],"names":["existsSync","readFileSync","licenseChecker","getLicenseTitle","join","NAME_VERSION_RE","splitNameVersion","identifier","match","name","version","flattenLicense","raw","Array","isArray","length","FILE_REFERENCE_RE","resolveFileReferencedLicense","rawLicense","licenseFile","test","trim","detected","collectNpmDependencies","options","nodeModules","start","exclude","Set","projectPackageJson","pkg","JSON","parse","add","packages","Promise","resolve","reject","init","excludePrivatePackages","err","results","out","info","Object","entries","has","push","licenses","path"],"mappings":"AAAA;;;CAGC,GACD,SAASA,UAAU,EAAEC,YAAY,QAAQ,KAAK;AAC9C,YAAYC,oBAAoB,8BAA8B;AAC9D,yEAAyE;AACzE,6EAA6E;AAC7E,8EAA8E;AAC9E,SAASC,eAAe,QAAQ,qDAAqD;AACrF,SAASC,IAAI,QAAQ,OAAO;AAa5B,MAAMC,kBAAkB;AAExB,MAAMC,mBAAmB,CACvBC;IAEA,MAAMC,QAAQD,WAAWC,KAAK,CAACH;IAC/B,IAAI,CAACG,OAAO;QACV,OAAO;YAAEC,MAAMF;YAAYG,SAAS;QAAQ;IAC9C;IACA,OAAO;QAAED,MAAMD,KAAK,CAAC,EAAE;QAAEE,SAASF,KAAK,CAAC,EAAE;IAAC;AAC7C;AAEA,MAAMG,iBAAiB,CAACC;IACtB,IAAI,CAACA,KAAK,OAAO;IACjB,IAAIC,MAAMC,OAAO,CAACF,MAAM;QACtB,IAAIA,IAAIG,MAAM,KAAK,GAAG,OAAO;QAC7B,IAAIH,IAAIG,MAAM,KAAK,GAAG,OAAOH,GAAG,CAAC,EAAE;QACnC,OAAO,CAAC,CAAC,EAAEA,IAAIR,IAAI,CAAC,QAAQ,CAAC,CAAC;IAChC;IACA,OAAOQ;AACT;AAEA;;;;CAIC,GACD,MAAMI,oBAAoB;AAE1B;;;;;;;;;;;;CAYC,GACD,OAAO,MAAMC,+BAA+B,CAC1CC,YACAC;IAEA,IAAI,CAACA,eAAe,CAACH,kBAAkBI,IAAI,CAACF,WAAWG,IAAI,KAAK;QAC9D,OAAOH;IACT;IACA,IAAII,WAA0B;IAC9B,IAAI;QACFA,WAAWnB,gBAAgBF,aAAakB,aAAa;IACvD,EAAE,OAAM;QACN,OAAOD;IACT;IACA,IAAI,CAACI,YAAYA,aAAa,eAAeN,kBAAkBI,IAAI,CAACE,WAClE,OAAOJ;IACT,OAAOI;AACT,EAAE;AAEF,OAAO,MAAMC,yBAAyB,OACpCC;IAEA,MAAMC,cAAcrB,KAAKoB,QAAQE,KAAK,EAAE;IACxC,IAAI,CAAC1B,WAAWyB,cAAc;QAC5B,OAAO,EAAE;IACX;IAEA,MAAME,UAAU,IAAIC;IAEpB,MAAMC,qBAAqBzB,KAAKoB,QAAQE,KAAK,EAAE;IAC/C,IAAI1B,WAAW6B,qBAAqB;QAClC,IAAI;YACF,MAAMC,MAAMC,KAAKC,KAAK,CAAC/B,aAAa4B,oBAAoB;YAGxD,IAAIC,IAAIrB,IAAI,EAAEkB,QAAQM,GAAG,CAACH,IAAIrB,IAAI;QACpC,EAAE,OAAM;QACN,SAAS;QACX;IACF;IAEA,MAAMyB,WAAW,MAAM,IAAIC,QACzB,CAACC,SAASC;QACRnC,eAAeoC,IAAI,CACjB;YACEZ,OAAOF,QAAQE,KAAK;YACpBa,wBAAwB;QAC1B,GACA,CAACC,KAAKC;YACJ,IAAID,KAAKH,OAAOG;iBACXJ,QAAQK;QACf;IAEJ;IAGF,MAAMC,MAAuB,EAAE;IAC/B,KAAK,MAAM,CAACnC,YAAYoC,KAAK,IAAIC,OAAOC,OAAO,CAACX,UAAW;QACzD,MAAM,EAAEzB,IAAI,EAAEC,OAAO,EAAE,GAAGJ,iBAAiBC;QAC3C,IAAIoB,QAAQmB,GAAG,CAACrC,OAAO;QACvBiC,IAAIK,IAAI,CAAC;YACPtC;YACAC;YACAQ,YAAYD,6BACVN,eAAegC,KAAKK,QAAQ,GAC5BL,KAAKxB,WAAW;YAElB8B,MAAMN,KAAKM,IAAI;QACjB;IACF;IACA,OAAOP;AACT,EAAE"}

package/src/migrations/latest/api-custom-domain-runtime-config/metadata.json

@@ -0,0 +1,3 @@
+{
+  "description": "Publish a configured custom domain as the API URL in runtime config for vended REST/HTTP API constructs and Terraform modules, and add custom domain inputs to the Terraform API modules"
+}

package/src/migrations/latest/api-custom-domain-runtime-config/migration.js

@@ -0,0 +1,362 @@
+/**
+ * Copyright Amazon.com, Inc. or its affiliates. All Rights Reserved.
+ * SPDX-License-Identifier: Apache-2.0
+ */ import { joinPathFragments } from "@nx/devkit";
+import { addDestructuredImport, applyGritQL, GRIT_INSERT_PLACEHOLDER, insertViaGritQL, matchGritQL } from "../../../utils/ast.js";
+import { formatFilesInSubtree } from "../../../utils/format.js";
+import { PACKAGES_DIR, SHARED_CONSTRUCTS_DIR, SHARED_TERRAFORM_DIR } from "../../../utils/shared-constructs-constants.js";
+/**
+ * Publish an API's custom domain, when one is configured, as its URL in runtime
+ * config, so clients call it rather than the generated execute-api endpoint.
+ *
+ * - The vended CDK `RestApi` publishes `https://<domainName>/[<basePath>/]` when
+ *   `domainName` is set.
+ * - The vended CDK `HttpApi` forwards `defaultDomainMapping` to the stage it
+ *   creates (previously rejected by CDK, since the construct disables the
+ *   default stage) and publishes the mapping's domain URL.
+ * - Each vended Terraform API app module (`app/apis/<name>/<name>.tf`) gains
+ *   `custom_domain_name` / `acm_certificate_arn` variables, the domain and
+ *   mapping resources, an `api_url` local published in runtime config, and
+ *   outputs for the URL and DNS record targets.
+ *
+ * These files are generated with `KeepExisting`, so an upgraded workspace keeps
+ * the old shape until this runs. Diverged files are left untouched and
+ * reported via `nextSteps`.
+ */ const CONSTRUCTS_API_DIR = `${PACKAGES_DIR}/${SHARED_CONSTRUCTS_DIR}/src/core/api`;
+const REST_API_CONSTRUCT = `${CONSTRUCTS_API_DIR}/rest-api.ts`;
+const HTTP_API_CONSTRUCT = `${CONSTRUCTS_API_DIR}/http-api.ts`;
+const TERRAFORM_APIS_DIR = `${PACKAGES_DIR}/${SHARED_TERRAFORM_DIR}/src/app/apis`;
+const hcl = (pattern)=>`language hcl\n${pattern}`;
+/** Whether the pattern matches any `.tf` file in the Terraform module directory. */ const matchesInModule = async (tree, moduleDir, pattern)=>{
+    for (const child of tree.children(moduleDir)){
+        const path = joinPathFragments(moduleDir, child);
+        if (child.endsWith('.tf') && tree.isFile(path) && await matchGritQL(tree, path, pattern)) {
+            return true;
+        }
+    }
+    return false;
+};
+/** Whether every pattern matches the file. */ const matchesAll = async (tree, file, patterns)=>{
+    for (const pattern of patterns){
+        if (!await matchGritQL(tree, file, pattern)) {
+            return false;
+        }
+    }
+    return true;
+};
+const REST_RUNTIME_CONFIG_URL = `domainName
+        ? \`https://\${domainName.domainName}/\${domainName.basePath ? \`\${domainName.basePath}/\` : ''}\`
+        : this.api.url!`;
+const REST_DOMAIN_OUTPUTS = `// Target for the custom domain's DNS record
+    if (domainName) {
+      new CfnOutput(this, \`\${apiName}DomainNameAlias\`, {
+        value: this.api.domainName!.domainNameAliasDomainName,
+        description:
+          'Domain name of the API Gateway endpoint (regional or edge) to point a CNAME record at for the custom domain, with any DNS provider',
+      });
+      new CfnOutput(this, \`\${apiName}DomainNameAliasHostedZoneId\`, {
+        value: this.api.domainName!.domainNameAliasHostedZoneId,
+        description:
+          'Hosted zone ID of that domain name, needed only for a Route 53 alias record',
+      });
+    }`;
+const HTTP_DOMAIN_OUTPUTS = `// Target for the custom domain's DNS record
+    if (defaultDomainMapping) {
+      new CfnOutput(this, \`\${apiName}DomainNameAlias\`, {
+        value: defaultDomainMapping.domainName.regionalDomainName,
+        description:
+          'Regional domain name to point a CNAME record at for the custom domain, with any DNS provider',
+      });
+      new CfnOutput(this, \`\${apiName}DomainNameAliasHostedZoneId\`, {
+        value: defaultDomainMapping.domainName.regionalHostedZoneId,
+        description:
+          'Hosted zone ID of the regional domain name, needed only for a Route 53 alias record',
+      });
+    }`;
+const HTTP_DOMAIN_MAPPING_PROP = `/**
+   * Custom domain mapped to the API's default stage
+   */
+  readonly defaultDomainMapping?: DomainMappingOptions & {
+    readonly domainName: IDomainName;
+  }`;
+/** Matches a DNS record output this migration adds. */ const DOMAIN_ALIAS_OUTPUT = '`new CfnOutput(this, $id, $_)` where { $id <: r".*DomainNameAlias.*" }';
+/** Rewrite inserting {@link GRIT_INSERT_PLACEHOLDER} after the runtime config registration. */ const AFTER_RUNTIME_CONFIG = `\`$call;\` as $statement where {
+  $call <: \`rc.set('connection', 'apis', $_)\`,
+  $statement => \`$call;\n\n    ${GRIT_INSERT_PLACEHOLDER}\`
+}`;
+const migrateRestApiConstruct = async (tree, nextSteps)=>{
+    const file = REST_API_CONSTRUCT;
+    if (!tree.exists(file)) {
+        return;
+    }
+    if (await matchGritQL(tree, file, '`[apiName]: domainName ? $_ : $_`')) {
+        return; // Already migrated.
+    }
+    const shape = [
+        '`{ $params }: RestApiProps<$_, $_>` where { $params <: contains `...props`, $params <: not contains `domainName` }',
+        "`new _RestApi(this, 'Api', { $props })` where { $props <: contains `...props`, $props <: not contains `domainName` }",
+        "`rc.set('connection', 'apis', { $entries })` where { $entries <: contains `[apiName]: this.api.url!` }"
+    ];
+    if (!await matchesAll(tree, file, shape) || await matchGritQL(tree, file, DOMAIN_ALIAS_OUTPUT)) {
+        nextSteps.push(`${file}: has diverged from the generated shape - left untouched. To publish a configured custom domain to clients, destructure \`domainName\` from the constructor props and pass it to the CDK RestApi, register \`https://\${domainName.domainName}/\` (plus any \`basePath\`) under \`[apiName]\` in the \`rc.set('connection', 'apis', ...)\` call when it is set instead of \`this.api.url\`, and output \`this.api.domainName.domainNameAliasDomainName\` / \`domainNameAliasHostedZoneId\` for the DNS record.`);
+        return;
+    }
+    // Taken out of `props` and passed explicitly, so it is in scope below.
+    await applyGritQL(tree, file, '`{ $params }: RestApiProps<$_, $_>` where { $params <: contains `...props` as $rest, $rest => `domainName,\n      ...props` }');
+    await applyGritQL(tree, file, "`new _RestApi(this, 'Api', { $props })` where { $props <: contains `...props` as $spread, $spread => `...props,\n      domainName` }");
+    await insertViaGritQL(tree, file, "`rc.set('connection', 'apis', { $entries })` where { $entries <: contains `[apiName]: this.api.url!` as $url, $url => `[apiName]: __GRIT_INSERT_PLACEHOLDER__` }", REST_RUNTIME_CONFIG_URL);
+    await insertViaGritQL(tree, file, AFTER_RUNTIME_CONFIG, REST_DOMAIN_OUTPUTS);
+    // Listed first, as the generator vends it.
+    const imported = await applyGritQL(tree, file, "`import { $names } from 'aws-cdk-lib'` where { $names <: not contains `CfnOutput` } => `import { CfnOutput, $names } from 'aws-cdk-lib'`");
+    if (!imported) {
+        await addDestructuredImport(tree, file, [
+            'CfnOutput'
+        ], 'aws-cdk-lib');
+    }
+};
+const HTTP_API_URL_FIELD = `/** The URL clients call: the custom domain's if one is mapped, otherwise the stage's */
+  private readonly apiUrl: string`;
+const HTTP_API_URL_ASSIGNMENT = `this.apiUrl = defaultDomainMapping
+      ? this.defaultStage.domainUrl
+      : this.defaultStage.url!;`;
+/** Matches the vended `url` getter, returning the stage URL. */ const HTTP_URL_GETTER = 'method_definition(name=$name, body=$body) where { $name <: `url`, $body <: contains `return this.defaultStage.url` }';
+const migrateHttpApiConstruct = async (tree, nextSteps)=>{
+    const file = HTTP_API_CONSTRUCT;
+    if (!tree.exists(file)) {
+        return;
+    }
+    if (await matchGritQL(tree, file, '`[apiName]: this.apiUrl`')) {
+        return; // Already migrated.
+    }
+    const shape = [
+        'interface_declaration(name=$name, body=$body) as $interface where { $name <: `HttpApiProps`, $interface <: contains extends_type_clause() as $extends, $extends <: contains `_HttpApiProps`, $extends <: not contains `Omit`, $body <: contains `readonly throttle?: ThrottleSettings`, $body <: not contains `defaultDomainMapping` }',
+        "`import { $names } from 'aws-cdk-lib/aws-apigatewayv2'` where { $names <: contains `HttpApi as _HttpApi`, $names <: contains `HttpStage`, $names <: not contains `DomainMappingOptions`, $names <: not contains `IDomainName` }",
+        '`public readonly defaultStage: HttpStage`',
+        '`{ $params }: HttpApiProps<$_, $_>` where { $params <: contains `...props`, $params <: not contains `defaultDomainMapping` }',
+        "`this.defaultStage = new HttpStage(this, 'DefaultStage', { $props })` where { $props <: contains `httpApi: this.api`, $props <: not contains `domainMapping` }",
+        '`new CfnOutput(this, $_, { $props })` where { $props <: contains `value: this.defaultStage.url!` }',
+        "`rc.set('connection', 'apis', { $entries })` where { $entries <: contains `[apiName]: this.defaultStage.url!` }",
+        HTTP_URL_GETTER
+    ];
+    if (!await matchesAll(tree, file, shape) || await matchGritQL(tree, file, DOMAIN_ALIAS_OUTPUT) || await matchGritQL(tree, file, '`this.apiUrl`')) {
+        nextSteps.push(`${file}: has diverged from the generated shape - left untouched. To support a custom domain, destructure \`defaultDomainMapping\` from the constructor props (so it is not passed to the CDK HttpApi, which rejects it when the default stage is disabled) and pass it as \`domainMapping\` to the \`DefaultStage\` HttpStage; use \`this.defaultStage.domainUrl\` instead of \`this.defaultStage.url\` when it is set, for the \`<apiName>Url\` output, runtime config and the \`url\` getter; and output \`defaultDomainMapping.domainName.regionalDomainName\` / \`regionalHostedZoneId\` for the DNS record.`);
+        return;
+    }
+    // Typed as a domain exposing its regional attributes, for the DNS outputs.
+    await insertViaGritQL(tree, file, 'interface_declaration(name=$name, body=$body) where { $name <: `HttpApiProps`, $body <: contains `readonly throttle?: ThrottleSettings` as $throttle, $throttle => `readonly throttle?: ThrottleSettings;\n  __GRIT_INSERT_PLACEHOLDER__` }', HTTP_DOMAIN_MAPPING_PROP);
+    // Only the `_HttpApiProps` base is replaced, keeping any others.
+    await applyGritQL(tree, file, "interface_declaration(name=$name) as $interface where { $name <: `HttpApiProps`, $interface <: contains extends_type_clause() as $extends, $extends <: contains `_HttpApiProps` as $base, $base => `Omit<_HttpApiProps, 'defaultDomainMapping'>` }");
+    // Inserted in sorted position, as the generator vends them.
+    await applyGritQL(tree, file, "`import { $names } from 'aws-cdk-lib/aws-apigatewayv2'` where { $names <: contains `HttpApi as _HttpApi` as $httpApi, $httpApi => `DomainMappingOptions,\n  HttpApi as _HttpApi` }");
+    await applyGritQL(tree, file, "`import { $names } from 'aws-cdk-lib/aws-apigatewayv2'` where { $names <: contains `HttpStage` as $stage, $stage => `HttpStage,\n  IDomainName` }");
+    await insertViaGritQL(tree, file, '`public readonly defaultStage: HttpStage` as $field => `public readonly defaultStage: HttpStage;\n\n  __GRIT_INSERT_PLACEHOLDER__`', HTTP_API_URL_FIELD);
+    // Taken out of `props` so it isn't passed to the CDK HttpApi.
+    await applyGritQL(tree, file, '`{ $params }: HttpApiProps<$_, $_>` where { $params <: contains `...props` as $rest, $rest => `defaultDomainMapping,\n      ...props` }');
+    await applyGritQL(tree, file, "`new HttpStage(this, 'DefaultStage', { $props })` where { $props <: contains `httpApi: this.api` as $httpApi, $httpApi => `httpApi: this.api,\n      domainMapping: defaultDomainMapping` }");
+    // Computed once, for the stack output, runtime config and the `url` getter.
+    await insertViaGritQL(tree, file, `expression_statement() as $statement where {
+  $statement <: contains \`this.defaultStage = new HttpStage($_, $_, $_)\` as $assignment,
+  $statement => \`$assignment;\n    ${GRIT_INSERT_PLACEHOLDER}\`
+}`, HTTP_API_URL_ASSIGNMENT);
+    await applyGritQL(tree, file, '`new CfnOutput(this, $_, { $props })` where { $props <: contains `value: this.defaultStage.url!` as $value, $value => `value: this.apiUrl` }');
+    await applyGritQL(tree, file, "`rc.set('connection', 'apis', { $entries })` where { $entries <: contains `[apiName]: this.defaultStage.url!` as $url, $url => `[apiName]: this.apiUrl` }");
+    await applyGritQL(tree, file, 'method_definition(name=$name, body=$body) where { $name <: `url`, $body <: contains `return this.defaultStage.url` as $return, $return => `return this.apiUrl` }');
+    await insertViaGritQL(tree, file, AFTER_RUNTIME_CONFIG, HTTP_DOMAIN_OUTPUTS);
+};
+const TERRAFORM_VARIABLES = `# Custom domain configuration
+variable "custom_domain_name" {
+  description = "Custom domain name for the API. Requires acm_certificate_arn."
+  type        = string
+  default     = null
+}
+
+variable "acm_certificate_arn" {
+  description = "ARN of an ACM certificate (in the API's region) for the custom domain name."
+  type        = string
+  default     = null
+}`;
+const REST_TERRAFORM = {
+    kind: 'REST',
+    identifyingBlock: '`resource "aws_api_gateway_stage" "api_stage" { $_ }`',
+    runtimeConfigUrl: '$v <: r"\\"\\$\\{aws_api_gateway_stage\\.api_stage\\.invoke_url\\}/\\""',
+    domainResourceTypes: [
+        'aws_api_gateway_domain_name',
+        'aws_api_gateway_base_path_mapping'
+    ],
+    domainResources: `# Custom domain for the API, served without the stage path prefix
+resource "aws_api_gateway_domain_name" "custom_domain" {
+  count = var.custom_domain_name == null ? 0 : 1
+
+  domain_name              = var.custom_domain_name
+  regional_certificate_arn = var.acm_certificate_arn
+  security_policy          = "TLS_1_2"
+
+  endpoint_configuration {
+    types = ["REGIONAL"]
+  }
+
+  tags = var.tags
+
+  lifecycle {
+    precondition {
+      condition     = var.acm_certificate_arn != null
+      error_message = "acm_certificate_arn is required when custom_domain_name is set."
+    }
+  }
+}
+
+resource "aws_api_gateway_base_path_mapping" "custom_domain" {
+  count = var.custom_domain_name == null ? 0 : 1
+
+  api_id      = module.rest_api.api_id
+  stage_name  = aws_api_gateway_stage.api_stage.stage_name
+  domain_name = aws_api_gateway_domain_name.custom_domain[0].domain_name
+}`,
+    apiUrlLocal: `locals {
+  api_url = var.custom_domain_name == null ? "\${aws_api_gateway_stage.api_stage.invoke_url}/" : "https://\${var.custom_domain_name}/"
+}`,
+    outputs: `output "api_url" {
+  description = "URL clients should call: the custom domain if configured, otherwise the stage invoke URL"
+  value       = local.api_url
+}
+
+output "custom_domain_target_domain_name" {
+  description = "Target domain name to point a DNS alias or CNAME record at for the custom domain"
+  value       = var.custom_domain_name == null ? null : aws_api_gateway_domain_name.custom_domain[0].regional_domain_name
+}
+
+output "custom_domain_hosted_zone_id" {
+  description = "Hosted zone ID to use for a Route 53 alias record for the custom domain"
+  value       = var.custom_domain_name == null ? null : aws_api_gateway_domain_name.custom_domain[0].regional_zone_id
+}`
+};
+const HTTP_TERRAFORM = {
+    kind: 'HTTP',
+    identifyingBlock: '`module "http_api" { $_ }`',
+    runtimeConfigUrl: '$v <: `module.http_api.stage_invoke_url`',
+    domainResourceTypes: [
+        'aws_apigatewayv2_domain_name',
+        'aws_apigatewayv2_api_mapping'
+    ],
+    domainResources: `# Custom domain for the API
+resource "aws_apigatewayv2_domain_name" "custom_domain" {
+  count = var.custom_domain_name == null ? 0 : 1
+
+  domain_name = var.custom_domain_name
+
+  domain_name_configuration {
+    certificate_arn = var.acm_certificate_arn
+    endpoint_type   = "REGIONAL"
+    security_policy = "TLS_1_2"
+  }
+
+  tags = var.tags
+
+  lifecycle {
+    precondition {
+      condition     = var.acm_certificate_arn != null
+      error_message = "acm_certificate_arn is required when custom_domain_name is set."
+    }
+  }
+}
+
+resource "aws_apigatewayv2_api_mapping" "custom_domain" {
+  count = var.custom_domain_name == null ? 0 : 1
+
+  api_id      = module.http_api.api_id
+  stage       = module.http_api.stage_id
+  domain_name = aws_apigatewayv2_domain_name.custom_domain[0].domain_name
+}`,
+    apiUrlLocal: `locals {
+  api_url = var.custom_domain_name == null ? module.http_api.stage_invoke_url : "https://\${var.custom_domain_name}/"
+}`,
+    outputs: `output "api_url" {
+  description = "URL clients should call: the custom domain if configured, otherwise the stage invoke URL"
+  value       = local.api_url
+}
+
+output "custom_domain_target_domain_name" {
+  description = "Target domain name to point a DNS alias or CNAME record at for the custom domain"
+  value       = var.custom_domain_name == null ? null : aws_apigatewayv2_domain_name.custom_domain[0].domain_name_configuration[0].target_domain_name
+}
+
+output "custom_domain_hosted_zone_id" {
+  description = "Hosted zone ID to use for a Route 53 alias record for the custom domain"
+  value       = var.custom_domain_name == null ? null : aws_apigatewayv2_domain_name.custom_domain[0].domain_name_configuration[0].hosted_zone_id
+}`
+};
+const RUNTIME_CONFIG_MODULE = '`module "add_url_to_runtime_config" { $body }`';
+/** The `locals` block every vended API app module declares its IAM policy statements in. */ const POLICY_LOCALS = '`locals { $body }` where { $body <: contains `lambda_policy_statements = $_` }';
+/** Rewrite matching the block's text back unchanged, then the placeholder after it. */ const appendAfterBlock = (header)=>hcl(`\`${header} { $body }\` => \`${header} {\n  $body\n}\n\n${GRIT_INSERT_PLACEHOLDER}\``);
+const migrateTerraformApi = async (tree, moduleDir, file, nextSteps)=>{
+    const api = await matchGritQL(tree, file, hcl(REST_TERRAFORM.identifyingBlock)) ? REST_TERRAFORM : await matchGritQL(tree, file, hcl(HTTP_TERRAFORM.identifyingBlock)) ? HTTP_TERRAFORM : undefined;
+    if (!api) {
+        return; // Not a vended API app module.
+    }
+    // Everything this migration declares, so a re-run recognises its own output
+    // and nothing it inserts collides with an existing declaration. Terraform
+    // merges every `.tf` file in the module directory, so all are checked.
+    const [domainType, mappingType] = api.domainResourceTypes;
+    const declarations = [
+        '`variable "custom_domain_name" { $_ }`',
+        '`variable "acm_certificate_arn" { $_ }`',
+        `\`resource "${domainType}" "custom_domain" { $_ }\``,
+        `\`resource "${mappingType}" "custom_domain" { $_ }\``,
+        '`locals { $body }` where { $body <: contains `api_url = $_` }',
+        '`output "api_url" { $_ }`',
+        '`output "custom_domain_target_domain_name" { $_ }`',
+        '`output "custom_domain_hosted_zone_id" { $_ }`'
+    ];
+    let declared = 0;
+    for (const declaration of declarations){
+        if (await matchesInModule(tree, moduleDir, hcl(declaration))) {
+            declared++;
+        }
+    }
+    const publishesApiUrl = await matchGritQL(tree, file, hcl(`${RUNTIME_CONFIG_MODULE} where { $body <: contains \`value = { $_ = local.api_url }\` }`));
+    if (declared === declarations.length && publishesApiUrl) {
+        return; // Already migrated.
+    }
+    if (declared > 0 || publishesApiUrl) {
+        nextSteps.push(`${file}: this module (${moduleDir}) already declares some of the custom domain configuration this migration adds (custom_domain_name / acm_certificate_arn variables, the custom_domain resources, local.api_url, or the api_url / custom_domain_* outputs) - left untouched. Make sure the add_url_to_runtime_config module publishes the custom domain URL when one is configured, instead of the stage invoke URL (see the ${api.kind} API app module the plugin now generates).`);
+        return;
+    }
+    const runtimeConfigValue = `${RUNTIME_CONFIG_MODULE} where { $body <: contains \`value = { $_ = $v }\`, ${api.runtimeConfigUrl} }`;
+    const shape = [
+        hcl('`variable "tags" { $_ }`'),
+        hcl(runtimeConfigValue),
+        hcl(POLICY_LOCALS),
+        hcl('`output "stage_invoke_url" { $_ }`')
+    ];
+    if (!await matchesAll(tree, file, shape)) {
+        nextSteps.push(`${file}: has diverged from the generated shape - left untouched. To support a custom domain for this ${api.kind} API, add custom_domain_name and acm_certificate_arn variables, the custom domain and mapping resources, and publish the custom domain URL in the add_url_to_runtime_config module when it is set (see the ${api.kind} API app module the plugin now generates).`);
+        return;
+    }
+    await insertViaGritQL(tree, file, appendAfterBlock('variable "tags"'), TERRAFORM_VARIABLES);
+    // Only the URL expression is rewritten, preserving `terraform fmt` alignment.
+    await applyGritQL(tree, file, hcl(`${RUNTIME_CONFIG_MODULE} where { $body <: contains \`value = { $_ = $v }\`, ${api.runtimeConfigUrl}, $v => \`local.api_url\` }`));
+    // Alongside the module's other locals.
+    await insertViaGritQL(tree, file, hcl(`${POLICY_LOCALS} => \`locals {\n  $body\n}\n\n${GRIT_INSERT_PLACEHOLDER}\``), api.apiUrlLocal);
+    await insertViaGritQL(tree, file, appendAfterBlock('module "add_url_to_runtime_config"'), api.domainResources);
+    await insertViaGritQL(tree, file, appendAfterBlock('output "stage_invoke_url"'), api.outputs);
+};
+export default async function migration(tree) {
+    const nextSteps = [];
+    await migrateRestApiConstruct(tree, nextSteps);
+    await migrateHttpApiConstruct(tree, nextSteps);
+    if (tree.exists(TERRAFORM_APIS_DIR)) {
+        for (const dirName of tree.children(TERRAFORM_APIS_DIR)){
+            const moduleDir = joinPathFragments(TERRAFORM_APIS_DIR, dirName);
+            const file = joinPathFragments(moduleDir, `${dirName}.tf`);
+            if (tree.exists(file)) {
+                await migrateTerraformApi(tree, moduleDir, file, nextSteps);
+            }
+        }
+    }
+    await formatFilesInSubtree(tree);
+    return {
+        nextSteps
+    };
+}
+
+//# sourceMappingURL=migration.js.map