@aws/nx-plugin 1.0.3 → 1.0.5

package/src/ts/agent/__snapshots__/generator.spec.ts.snap

@@ -650,7 +650,7 @@ RUN apt-get update && \\
     rm -rf /var/lib/apt/lists/*
 
 # Upgrade npm to a version free of known HIGH/CRITICAL vulnerabilities
-RUN npm install -g npm@12.0.2
+RUN npm install -g npm@12.1.0
 
 WORKDIR /app
 
@@ -1666,7 +1666,7 @@ resource "null_resource" "runtime_ready" {
 
   provisioner "local-exec" {
     command = <<-EOT
-      uv run --with boto3==1.43.98 python -c "
+      uv run --with boto3==1.43.103 python -c "
 import boto3
 import json
 import os

package/src/ts/mcp-server/__snapshots__/generator.spec.ts.snap

@@ -514,7 +514,7 @@ resource "null_resource" "runtime_ready" {
 
   provisioner "local-exec" {
     command = <<-EOT
-      uv run --with boto3==1.43.98 python -c "
+      uv run --with boto3==1.43.103 python -c "
 import boto3
 import json
 import os

package/src/ts/rdb/__snapshots__/generator.spec.ts.snap

@@ -4520,7 +4520,7 @@ exports[`ts#rdb generator > should generate the aurora shared construct 4`] = `
 "FROM public.ecr.aws/lambda/nodejs:24
 
 # Upgrade npm to a version free of known HIGH/CRITICAL vulnerabilities
-RUN npm install -g npm@12.0.2
+RUN npm install -g npm@12.1.0
 
 # Patch OS packages beyond the base image's pinned release, and drop the
 # runtime's convenience copy of the AWS SDK (the handler bundle inlines its

package/src/ts/react-website/app/__snapshots__/generator.spec.ts.snap

@@ -745,7 +745,7 @@ resource "null_resource" "upload_website_files" {
   provisioner "local-exec" {
     command = <<-EOT
       cd "$ROOT_PATH"
-      uv run --with boto3==1.43.98 python3 -c "
+      uv run --with boto3==1.43.103 python3 -c "
 import os
 import sys
 import boto3
@@ -868,7 +868,7 @@ resource "null_resource" "cloudfront_invalidation" {
 
   provisioner "local-exec" {
     command = <<-EOT
-      uv run --with boto3==1.43.98 python3 -c "
+      uv run --with boto3==1.43.103 python3 -c "
 import boto3
 import os
 import sys
@@ -2325,18 +2325,18 @@ exports[`react-website generator > Tanstack router integration > should generate
   - test-app
   - packages/common/*
 catalog:
-  '@types/node': 26.6.2
-  vite: 8.3.0
+  '@types/node': 26.6.3
+  vite: 8.3.1
   vitest: 4.1.11
   '@vitest/coverage-v8': 4.1.11
   jsdom: 29.1.1
   '@nx/vitest': 23.2.1
   constructs: 10.8.1
-  aws-cdk-lib: 2.270.0
+  aws-cdk-lib: 2.271.0
   react: 19.3.0
   react-dom: 19.3.0
-  '@cloudscape-design/components': 3.0.1382
-  '@cloudscape-design/board-components': 3.0.232
+  '@cloudscape-design/components': 3.0.1387
+  '@cloudscape-design/board-components': 3.0.234
   '@cloudscape-design/global-styles': 1.0.70
   tailwindcss: 4.3.3
   '@nx/react': 23.2.1
@@ -4205,21 +4205,21 @@ exports[`react-website generator > Tanstack router integration > should generate
   - test-app
   - packages/common/*
 catalog:
-  '@types/node': 26.6.2
-  vite: 8.3.0
+  '@types/node': 26.6.3
+  vite: 8.3.1
   vitest: 4.1.11
   '@vitest/coverage-v8': 4.1.11
   jsdom: 29.1.1
   '@nx/vitest': 23.2.1
   constructs: 10.8.1
-  aws-cdk-lib: 2.270.0
+  aws-cdk-lib: 2.271.0
   react: 19.3.0
   react-dom: 19.3.0
-  '@cloudscape-design/components': 3.0.1382
-  '@cloudscape-design/board-components': 3.0.232
+  '@cloudscape-design/components': 3.0.1387
+  '@cloudscape-design/board-components': 3.0.234
   '@cloudscape-design/global-styles': 1.0.70
   tailwindcss: 4.3.3
-  '@tanstack/react-router': 1.170.38
+  '@tanstack/react-router': 1.170.39
   '@nx/react': 23.2.1
   '@vitest/ui': 4.1.11
   '@tailwindcss/vite': 4.3.3

package/src/ts/react-website/cognito-auth/__snapshots__/generator.terraform.spec.ts.snap

@@ -67,7 +67,7 @@ resource "null_resource" "add_callback_url" {
 
   provisioner "local-exec" {
     command = <<-EOT
-      uv run --with boto3==1.43.98 python -c "
+      uv run --with boto3==1.43.103 python -c "
 import boto3
 import os
 import sys

package/src/utils/api-constructs/files/cdk/core/api/http/http-api.ts.template

@@ -7,10 +7,12 @@ import {
 } from './utils<% if (esm) { %>.js<% } %>';
 import { CfnOutput, Stack } from 'aws-cdk-lib';
 import {
+  DomainMappingOptions,
   HttpApi as _HttpApi,
   HttpApiProps as _HttpApiProps,
   HttpMethod,
   HttpStage,
+  IDomainName,
   LogGroupLogDestination,
   ThrottleSettings,
 } from 'aws-cdk-lib/aws-apigatewayv2';
@@ -28,7 +30,7 @@ import { suppressRules } from '../checkov<% if (esm) { %>.js<% } %>';
 export interface HttpApiProps<
   TIntegrations extends ApiIntegrations<TOperation, HttpApiIntegration>,
   TOperation extends string,
-> extends _HttpApiProps {
+> extends Omit<_HttpApiProps, 'defaultDomainMapping'> {
   /**
    * Unique name for the API, used in runtime configuration
    */
@@ -47,6 +49,12 @@ export interface HttpApiProps<
    * @default { rateLimit: 10000, burstLimit: 5000 }
    */
   readonly throttle?: ThrottleSettings;
+  /**
+   * Custom domain mapped to the API's default stage
+   */
+  readonly defaultDomainMapping?: DomainMappingOptions & {
+    readonly domainName: IDomainName;
+  };
 }
 
 /**
@@ -70,6 +78,9 @@ export class HttpApi<
   /** Default auto-deployed stage */
   public readonly defaultStage: HttpStage;
 
+  /** The URL clients call: the custom domain's if one is mapped, otherwise the stage's */
+  private readonly apiUrl: string;
+
   /** Map of operation names to their API Gateway integrations */
   public readonly integrations: TIntegrations;
 
@@ -81,6 +92,7 @@ export class HttpApi<
       operations,
       integrations,
       throttle = { rateLimit: 10000, burstLimit: 5000 },
+      defaultDomainMapping,
       ...props
     }: HttpApiProps<TIntegrations, TOperation>,
   ) {
@@ -113,12 +125,16 @@ export class HttpApi<
 
     this.defaultStage = new HttpStage(this, 'DefaultStage', {
       httpApi: this.api,
+      domainMapping: defaultDomainMapping,
       autoDeploy: true,
       throttle,
       accessLogSettings: {
         destination: new LogGroupLogDestination(accessLogGroup),
       },
     });
+    this.apiUrl = defaultDomainMapping
+      ? this.defaultStage.domainUrl
+      : this.defaultStage.url!;
 
     // Resolve the integration for a given operation.
     // If the operation has a dedicated integration, use it; otherwise fall back to $router.
@@ -151,21 +167,35 @@ export class HttpApi<
     );
 
     new CfnOutput(this, `${apiName}Url`, {
-      value: this.defaultStage.url!,
+      value: this.apiUrl,
     });
 
     // Register the API URL in runtime configuration for client discovery
     const rc = RuntimeConfig.ensure(this);
     rc.set('connection', 'apis', {
       ...rc.get('connection').apis,
-      [apiName]: this.defaultStage.url!,
+      [apiName]: this.apiUrl,
     });
+
+    // Target for the custom domain's DNS record
+    if (defaultDomainMapping) {
+      new CfnOutput(this, `${apiName}DomainNameAlias`, {
+        value: defaultDomainMapping.domainName.regionalDomainName,
+        description:
+          'Regional domain name to point a CNAME record at for the custom domain, with any DNS provider',
+      });
+      new CfnOutput(this, `${apiName}DomainNameAliasHostedZoneId`, {
+        value: defaultDomainMapping.domainName.regionalHostedZoneId,
+        description:
+          'Hosted zone ID of the regional domain name, needed only for a Route 53 alias record',
+      });
+    }
   }
 
   /**
    * Return the API url
    */
   public get url() {
-    return this.defaultStage.url;
+    return this.apiUrl;
   }
 }

package/src/utils/api-constructs/files/cdk/core/api/rest/rest-api.ts.template

@@ -10,7 +10,7 @@ import {
   Stage,
   ThrottleSettings,
 } from 'aws-cdk-lib/aws-apigateway';
-import { IAspect, RemovalPolicy, Stack } from 'aws-cdk-lib';
+import { CfnOutput, IAspect, RemovalPolicy, Stack } from 'aws-cdk-lib';
 import {
   CfnLoggingConfiguration,
   CfnWebACL,
@@ -99,6 +99,7 @@ export class RestApi<
       integrations,
       enableWaf = true,
       throttle = { rateLimit: 10000, burstLimit: 5000 },
+      domainName,
       ...props
     }: RestApiProps<TIntegrations, TOperation>,
   ) {
@@ -124,6 +125,7 @@ export class RestApi<
     // Create the API Gateway REST API
     this.api = new _RestApi(this, 'Api', {
       ...props,
+      domainName,
       deployOptions: {
         accessLogDestination: new LogGroupLogDestination(accessLogs),
         accessLogFormat: AccessLogFormat.jsonWithStandardFields(),
@@ -265,8 +267,24 @@ export class RestApi<
     const rc = RuntimeConfig.ensure(this);
     rc.set('connection', 'apis', {
       ...rc.get('connection').apis,
-      [apiName]: this.api.url!,
+      [apiName]: domainName
+        ? `https://${domainName.domainName}/${domainName.basePath ? `${domainName.basePath}/` : ''}`
+        : this.api.url!,
     });
+
+    // Target for the custom domain's DNS record
+    if (domainName) {
+      new CfnOutput(this, `${apiName}DomainNameAlias`, {
+        value: this.api.domainName!.domainNameAliasDomainName,
+        description:
+          'Domain name of the API Gateway endpoint (regional or edge) to point a CNAME record at for the custom domain, with any DNS provider',
+      });
+      new CfnOutput(this, `${apiName}DomainNameAliasHostedZoneId`, {
+        value: this.api.domainName!.domainNameAliasHostedZoneId,
+        description:
+          'Hosted zone ID of that domain name, needed only for a Route 53 alias record',
+      });
+    }
   }
 
   /**

package/src/utils/api-constructs/files/terraform/app/apis/http/__apiNameKebabCase__/__apiNameKebabCase__.tf.template

@@ -125,6 +125,19 @@ variable "tags" {
   default     = {}
 }
 
+# Custom domain configuration
+variable "custom_domain_name" {
+  description = "Custom domain name for the API. Requires acm_certificate_arn."
+  type        = string
+  default     = null
+}
+
+variable "acm_certificate_arn" {
+  description = "ARN of an ACM certificate (in the API's region) for the custom domain name."
+  type        = string
+  default     = null
+}
+
 # Get current AWS region and account ID
 data "aws_region" "current" {}
 data "aws_caller_identity" "current" {}
@@ -431,6 +444,10 @@ locals {
 <%_ } _%>
 }
 
+locals {
+  api_url = var.custom_domain_name == null ? module.http_api.stage_invoke_url : "https://${var.custom_domain_name}/"
+}
+
 # CloudWatch Log Group for Lambda
 resource "aws_cloudwatch_log_group" "lambda_logs" {
   #checkov:skip=CKV_AWS_158:Using default CloudWatch log encryption
@@ -674,11 +691,41 @@ module "add_url_to_runtime_config" {
 
   namespace = "connection"
   key       = "apis"
-  value     = { "<%- apiNameClassName %>" = module.http_api.stage_invoke_url }
+  value     = { "<%- apiNameClassName %>" = local.api_url }
 
   depends_on = [module.http_api]
 }
 
+# Custom domain for the API
+resource "aws_apigatewayv2_domain_name" "custom_domain" {
+  count = var.custom_domain_name == null ? 0 : 1
+
+  domain_name = var.custom_domain_name
+
+  domain_name_configuration {
+    certificate_arn = var.acm_certificate_arn
+    endpoint_type   = "REGIONAL"
+    security_policy = "TLS_1_2"
+  }
+
+  tags = var.tags
+
+  lifecycle {
+    precondition {
+      condition     = var.acm_certificate_arn != null
+      error_message = "acm_certificate_arn is required when custom_domain_name is set."
+    }
+  }
+}
+
+resource "aws_apigatewayv2_api_mapping" "custom_domain" {
+  count = var.custom_domain_name == null ? 0 : 1
+
+  api_id      = module.http_api.api_id
+  stage       = module.http_api.stage_id
+  domain_name = aws_apigatewayv2_domain_name.custom_domain[0].domain_name
+}
+
 # Lambda permission for API Gateway to invoke the function<% if (backend.type === 'fastapi') { %> via alias<% } %>
 resource "aws_lambda_permission" "api_gateway_invoke" {
   <%_ if (backend.integrationPattern === 'isolated') { _%>
@@ -738,6 +785,21 @@ output "stage_invoke_url" {
   value       = module.http_api.stage_invoke_url
 }
 
+output "api_url" {
+  description = "URL clients should call: the custom domain if configured, otherwise the stage invoke URL"
+  value       = local.api_url
+}
+
+output "custom_domain_target_domain_name" {
+  description = "Target domain name to point a DNS alias or CNAME record at for the custom domain"
+  value       = var.custom_domain_name == null ? null : aws_apigatewayv2_domain_name.custom_domain[0].domain_name_configuration[0].target_domain_name
+}
+
+output "custom_domain_hosted_zone_id" {
+  description = "Hosted zone ID to use for a Route 53 alias record for the custom domain"
+  value       = var.custom_domain_name == null ? null : aws_apigatewayv2_domain_name.custom_domain[0].domain_name_configuration[0].hosted_zone_id
+}
+
 output "stage_arn" {
   description = "ARN of the API Gateway stage"
   value       = module.http_api.stage_arn

package/src/utils/api-constructs/files/terraform/app/apis/rest/__apiNameKebabCase__/__apiNameKebabCase__.tf.template

@@ -121,6 +121,19 @@ variable "tags" {
   default     = {}
 }
 
+# Custom domain configuration
+variable "custom_domain_name" {
+  description = "Custom domain name for the API. Requires acm_certificate_arn."
+  type        = string
+  default     = null
+}
+
+variable "acm_certificate_arn" {
+  description = "ARN of an ACM certificate (in the API's region) for the custom domain name."
+  type        = string
+  default     = null
+}
+
 # Get current AWS region and account ID
 data "aws_region" "current" {}
 data "aws_caller_identity" "current" {}
@@ -485,6 +498,10 @@ locals {
 <%_ } _%>
 }
 
+locals {
+  api_url = var.custom_domain_name == null ? "${aws_api_gateway_stage.api_stage.invoke_url}/" : "https://${var.custom_domain_name}/"
+}
+
 # CloudWatch Log Group for Lambda
 resource "aws_cloudwatch_log_group" "lambda_logs" {
   #checkov:skip=CKV_AWS_158:Using default CloudWatch log encryption
@@ -1139,11 +1156,41 @@ module "add_url_to_runtime_config" {
 
   namespace = "connection"
   key       = "apis"
-  value     = { "<%- apiNameClassName %>" = "${aws_api_gateway_stage.api_stage.invoke_url}/" }
+  value     = { "<%- apiNameClassName %>" = local.api_url }
 
   depends_on = [aws_api_gateway_stage.api_stage]
 }
 
+# Custom domain for the API, served without the stage path prefix
+resource "aws_api_gateway_domain_name" "custom_domain" {
+  count = var.custom_domain_name == null ? 0 : 1
+
+  domain_name              = var.custom_domain_name
+  regional_certificate_arn = var.acm_certificate_arn
+  security_policy          = "TLS_1_2"
+
+  endpoint_configuration {
+    types = ["REGIONAL"]
+  }
+
+  tags = var.tags
+
+  lifecycle {
+    precondition {
+      condition     = var.acm_certificate_arn != null
+      error_message = "acm_certificate_arn is required when custom_domain_name is set."
+    }
+  }
+}
+
+resource "aws_api_gateway_base_path_mapping" "custom_domain" {
+  count = var.custom_domain_name == null ? 0 : 1
+
+  api_id      = module.rest_api.api_id
+  stage_name  = aws_api_gateway_stage.api_stage.stage_name
+  domain_name = aws_api_gateway_domain_name.custom_domain[0].domain_name
+}
+
 # Outputs
 
 # API Gateway Outputs (from core module)
@@ -1172,6 +1219,21 @@ output "stage_invoke_url" {
   value       = aws_api_gateway_stage.api_stage.invoke_url
 }
 
+output "api_url" {
+  description = "URL clients should call: the custom domain if configured, otherwise the stage invoke URL"
+  value       = local.api_url
+}
+
+output "custom_domain_target_domain_name" {
+  description = "Target domain name to point a DNS alias or CNAME record at for the custom domain"
+  value       = var.custom_domain_name == null ? null : aws_api_gateway_domain_name.custom_domain[0].regional_domain_name
+}
+
+output "custom_domain_hosted_zone_id" {
+  description = "Hosted zone ID to use for a Route 53 alias record for the custom domain"
+  value       = var.custom_domain_name == null ? null : aws_api_gateway_domain_name.custom_domain[0].regional_zone_id
+}
+
 output "stage_arn" {
   description = "ARN of the API Gateway stage"
   value       = aws_api_gateway_stage.api_stage.arn

package/src/utils/docker.d.ts

@@ -25,7 +25,7 @@ export declare const IMAGE_BUILD_CACHE = false;
  * version to install globally, and the versions its dependency overrides pin.
  */
 export declare const nodeImageVersions: () => {
-    npmVersion: "12.0.2";
+    npmVersion: "12.1.0";
     minimatchVersion: "10.2.6";
 };
 /**