@aws/nx-plugin 1.0.4 → 1.0.6

package/src/migrations/v1.0.5/0001-api-custom-domain-runtime-config/migration.js

@@ -0,0 +1,362 @@
+/**
+ * Copyright Amazon.com, Inc. or its affiliates. All Rights Reserved.
+ * SPDX-License-Identifier: Apache-2.0
+ */ import { joinPathFragments } from "@nx/devkit";
+import { addDestructuredImport, applyGritQL, GRIT_INSERT_PLACEHOLDER, insertViaGritQL, matchGritQL } from "../../../utils/ast.js";
+import { formatFilesInSubtree } from "../../../utils/format.js";
+import { PACKAGES_DIR, SHARED_CONSTRUCTS_DIR, SHARED_TERRAFORM_DIR } from "../../../utils/shared-constructs-constants.js";
+/**
+ * Publish an API's custom domain, when one is configured, as its URL in runtime
+ * config, so clients call it rather than the generated execute-api endpoint.
+ *
+ * - The vended CDK `RestApi` publishes `https://<domainName>/[<basePath>/]` when
+ *   `domainName` is set.
+ * - The vended CDK `HttpApi` forwards `defaultDomainMapping` to the stage it
+ *   creates (previously rejected by CDK, since the construct disables the
+ *   default stage) and publishes the mapping's domain URL.
+ * - Each vended Terraform API app module (`app/apis/<name>/<name>.tf`) gains
+ *   `custom_domain_name` / `acm_certificate_arn` variables, the domain and
+ *   mapping resources, an `api_url` local published in runtime config, and
+ *   outputs for the URL and DNS record targets.
+ *
+ * These files are generated with `KeepExisting`, so an upgraded workspace keeps
+ * the old shape until this runs. Diverged files are left untouched and
+ * reported via `nextSteps`.
+ */ const CONSTRUCTS_API_DIR = `${PACKAGES_DIR}/${SHARED_CONSTRUCTS_DIR}/src/core/api`;
+const REST_API_CONSTRUCT = `${CONSTRUCTS_API_DIR}/rest-api.ts`;
+const HTTP_API_CONSTRUCT = `${CONSTRUCTS_API_DIR}/http-api.ts`;
+const TERRAFORM_APIS_DIR = `${PACKAGES_DIR}/${SHARED_TERRAFORM_DIR}/src/app/apis`;
+const hcl = (pattern)=>`language hcl\n${pattern}`;
+/** Whether the pattern matches any `.tf` file in the Terraform module directory. */ const matchesInModule = async (tree, moduleDir, pattern)=>{
+    for (const child of tree.children(moduleDir)){
+        const path = joinPathFragments(moduleDir, child);
+        if (child.endsWith('.tf') && tree.isFile(path) && await matchGritQL(tree, path, pattern)) {
+            return true;
+        }
+    }
+    return false;
+};
+/** Whether every pattern matches the file. */ const matchesAll = async (tree, file, patterns)=>{
+    for (const pattern of patterns){
+        if (!await matchGritQL(tree, file, pattern)) {
+            return false;
+        }
+    }
+    return true;
+};
+const REST_RUNTIME_CONFIG_URL = `domainName
+        ? \`https://\${domainName.domainName}/\${domainName.basePath ? \`\${domainName.basePath}/\` : ''}\`
+        : this.api.url!`;
+const REST_DOMAIN_OUTPUTS = `// Target for the custom domain's DNS record
+    if (domainName) {
+      new CfnOutput(this, \`\${apiName}DomainNameAlias\`, {
+        value: this.api.domainName!.domainNameAliasDomainName,
+        description:
+          'Domain name of the API Gateway endpoint (regional or edge) to point a CNAME record at for the custom domain, with any DNS provider',
+      });
+      new CfnOutput(this, \`\${apiName}DomainNameAliasHostedZoneId\`, {
+        value: this.api.domainName!.domainNameAliasHostedZoneId,
+        description:
+          'Hosted zone ID of that domain name, needed only for a Route 53 alias record',
+      });
+    }`;
+const HTTP_DOMAIN_OUTPUTS = `// Target for the custom domain's DNS record
+    if (defaultDomainMapping) {
+      new CfnOutput(this, \`\${apiName}DomainNameAlias\`, {
+        value: defaultDomainMapping.domainName.regionalDomainName,
+        description:
+          'Regional domain name to point a CNAME record at for the custom domain, with any DNS provider',
+      });
+      new CfnOutput(this, \`\${apiName}DomainNameAliasHostedZoneId\`, {
+        value: defaultDomainMapping.domainName.regionalHostedZoneId,
+        description:
+          'Hosted zone ID of the regional domain name, needed only for a Route 53 alias record',
+      });
+    }`;
+const HTTP_DOMAIN_MAPPING_PROP = `/**
+   * Custom domain mapped to the API's default stage
+   */
+  readonly defaultDomainMapping?: DomainMappingOptions & {
+    readonly domainName: IDomainName;
+  }`;
+/** Matches a DNS record output this migration adds. */ const DOMAIN_ALIAS_OUTPUT = '`new CfnOutput(this, $id, $_)` where { $id <: r".*DomainNameAlias.*" }';
+/** Rewrite inserting {@link GRIT_INSERT_PLACEHOLDER} after the runtime config registration. */ const AFTER_RUNTIME_CONFIG = `\`$call;\` as $statement where {
+  $call <: \`rc.set('connection', 'apis', $_)\`,
+  $statement => \`$call;\n\n    ${GRIT_INSERT_PLACEHOLDER}\`
+}`;
+const migrateRestApiConstruct = async (tree, nextSteps)=>{
+    const file = REST_API_CONSTRUCT;
+    if (!tree.exists(file)) {
+        return;
+    }
+    if (await matchGritQL(tree, file, '`[apiName]: domainName ? $_ : $_`')) {
+        return; // Already migrated.
+    }
+    const shape = [
+        '`{ $params }: RestApiProps<$_, $_>` where { $params <: contains `...props`, $params <: not contains `domainName` }',
+        "`new _RestApi(this, 'Api', { $props })` where { $props <: contains `...props`, $props <: not contains `domainName` }",
+        "`rc.set('connection', 'apis', { $entries })` where { $entries <: contains `[apiName]: this.api.url!` }"
+    ];
+    if (!await matchesAll(tree, file, shape) || await matchGritQL(tree, file, DOMAIN_ALIAS_OUTPUT)) {
+        nextSteps.push(`${file}: has diverged from the generated shape - left untouched. To publish a configured custom domain to clients, destructure \`domainName\` from the constructor props and pass it to the CDK RestApi, register \`https://\${domainName.domainName}/\` (plus any \`basePath\`) under \`[apiName]\` in the \`rc.set('connection', 'apis', ...)\` call when it is set instead of \`this.api.url\`, and output \`this.api.domainName.domainNameAliasDomainName\` / \`domainNameAliasHostedZoneId\` for the DNS record.`);
+        return;
+    }
+    // Taken out of `props` and passed explicitly, so it is in scope below.
+    await applyGritQL(tree, file, '`{ $params }: RestApiProps<$_, $_>` where { $params <: contains `...props` as $rest, $rest => `domainName,\n      ...props` }');
+    await applyGritQL(tree, file, "`new _RestApi(this, 'Api', { $props })` where { $props <: contains `...props` as $spread, $spread => `...props,\n      domainName` }");
+    await insertViaGritQL(tree, file, "`rc.set('connection', 'apis', { $entries })` where { $entries <: contains `[apiName]: this.api.url!` as $url, $url => `[apiName]: __GRIT_INSERT_PLACEHOLDER__` }", REST_RUNTIME_CONFIG_URL);
+    await insertViaGritQL(tree, file, AFTER_RUNTIME_CONFIG, REST_DOMAIN_OUTPUTS);
+    // Listed first, as the generator vends it.
+    const imported = await applyGritQL(tree, file, "`import { $names } from 'aws-cdk-lib'` where { $names <: not contains `CfnOutput` } => `import { CfnOutput, $names } from 'aws-cdk-lib'`");
+    if (!imported) {
+        await addDestructuredImport(tree, file, [
+            'CfnOutput'
+        ], 'aws-cdk-lib');
+    }
+};
+const HTTP_API_URL_FIELD = `/** The URL clients call: the custom domain's if one is mapped, otherwise the stage's */
+  private readonly apiUrl: string`;
+const HTTP_API_URL_ASSIGNMENT = `this.apiUrl = defaultDomainMapping
+      ? this.defaultStage.domainUrl
+      : this.defaultStage.url!;`;
+/** Matches the vended `url` getter, returning the stage URL. */ const HTTP_URL_GETTER = 'method_definition(name=$name, body=$body) where { $name <: `url`, $body <: contains `return this.defaultStage.url` }';
+const migrateHttpApiConstruct = async (tree, nextSteps)=>{
+    const file = HTTP_API_CONSTRUCT;
+    if (!tree.exists(file)) {
+        return;
+    }
+    if (await matchGritQL(tree, file, '`[apiName]: this.apiUrl`')) {
+        return; // Already migrated.
+    }
+    const shape = [
+        'interface_declaration(name=$name, body=$body) as $interface where { $name <: `HttpApiProps`, $interface <: contains extends_type_clause() as $extends, $extends <: contains `_HttpApiProps`, $extends <: not contains `Omit`, $body <: contains `readonly throttle?: ThrottleSettings`, $body <: not contains `defaultDomainMapping` }',
+        "`import { $names } from 'aws-cdk-lib/aws-apigatewayv2'` where { $names <: contains `HttpApi as _HttpApi`, $names <: contains `HttpStage`, $names <: not contains `DomainMappingOptions`, $names <: not contains `IDomainName` }",
+        '`public readonly defaultStage: HttpStage`',
+        '`{ $params }: HttpApiProps<$_, $_>` where { $params <: contains `...props`, $params <: not contains `defaultDomainMapping` }',
+        "`this.defaultStage = new HttpStage(this, 'DefaultStage', { $props })` where { $props <: contains `httpApi: this.api`, $props <: not contains `domainMapping` }",
+        '`new CfnOutput(this, $_, { $props })` where { $props <: contains `value: this.defaultStage.url!` }',
+        "`rc.set('connection', 'apis', { $entries })` where { $entries <: contains `[apiName]: this.defaultStage.url!` }",
+        HTTP_URL_GETTER
+    ];
+    if (!await matchesAll(tree, file, shape) || await matchGritQL(tree, file, DOMAIN_ALIAS_OUTPUT) || await matchGritQL(tree, file, '`this.apiUrl`')) {
+        nextSteps.push(`${file}: has diverged from the generated shape - left untouched. To support a custom domain, destructure \`defaultDomainMapping\` from the constructor props (so it is not passed to the CDK HttpApi, which rejects it when the default stage is disabled) and pass it as \`domainMapping\` to the \`DefaultStage\` HttpStage; use \`this.defaultStage.domainUrl\` instead of \`this.defaultStage.url\` when it is set, for the \`<apiName>Url\` output, runtime config and the \`url\` getter; and output \`defaultDomainMapping.domainName.regionalDomainName\` / \`regionalHostedZoneId\` for the DNS record.`);
+        return;
+    }
+    // Typed as a domain exposing its regional attributes, for the DNS outputs.
+    await insertViaGritQL(tree, file, 'interface_declaration(name=$name, body=$body) where { $name <: `HttpApiProps`, $body <: contains `readonly throttle?: ThrottleSettings` as $throttle, $throttle => `readonly throttle?: ThrottleSettings;\n  __GRIT_INSERT_PLACEHOLDER__` }', HTTP_DOMAIN_MAPPING_PROP);
+    // Only the `_HttpApiProps` base is replaced, keeping any others.
+    await applyGritQL(tree, file, "interface_declaration(name=$name) as $interface where { $name <: `HttpApiProps`, $interface <: contains extends_type_clause() as $extends, $extends <: contains `_HttpApiProps` as $base, $base => `Omit<_HttpApiProps, 'defaultDomainMapping'>` }");
+    // Inserted in sorted position, as the generator vends them.
+    await applyGritQL(tree, file, "`import { $names } from 'aws-cdk-lib/aws-apigatewayv2'` where { $names <: contains `HttpApi as _HttpApi` as $httpApi, $httpApi => `DomainMappingOptions,\n  HttpApi as _HttpApi` }");
+    await applyGritQL(tree, file, "`import { $names } from 'aws-cdk-lib/aws-apigatewayv2'` where { $names <: contains `HttpStage` as $stage, $stage => `HttpStage,\n  IDomainName` }");
+    await insertViaGritQL(tree, file, '`public readonly defaultStage: HttpStage` as $field => `public readonly defaultStage: HttpStage;\n\n  __GRIT_INSERT_PLACEHOLDER__`', HTTP_API_URL_FIELD);
+    // Taken out of `props` so it isn't passed to the CDK HttpApi.
+    await applyGritQL(tree, file, '`{ $params }: HttpApiProps<$_, $_>` where { $params <: contains `...props` as $rest, $rest => `defaultDomainMapping,\n      ...props` }');
+    await applyGritQL(tree, file, "`new HttpStage(this, 'DefaultStage', { $props })` where { $props <: contains `httpApi: this.api` as $httpApi, $httpApi => `httpApi: this.api,\n      domainMapping: defaultDomainMapping` }");
+    // Computed once, for the stack output, runtime config and the `url` getter.
+    await insertViaGritQL(tree, file, `expression_statement() as $statement where {
+  $statement <: contains \`this.defaultStage = new HttpStage($_, $_, $_)\` as $assignment,
+  $statement => \`$assignment;\n    ${GRIT_INSERT_PLACEHOLDER}\`
+}`, HTTP_API_URL_ASSIGNMENT);
+    await applyGritQL(tree, file, '`new CfnOutput(this, $_, { $props })` where { $props <: contains `value: this.defaultStage.url!` as $value, $value => `value: this.apiUrl` }');
+    await applyGritQL(tree, file, "`rc.set('connection', 'apis', { $entries })` where { $entries <: contains `[apiName]: this.defaultStage.url!` as $url, $url => `[apiName]: this.apiUrl` }");
+    await applyGritQL(tree, file, 'method_definition(name=$name, body=$body) where { $name <: `url`, $body <: contains `return this.defaultStage.url` as $return, $return => `return this.apiUrl` }');
+    await insertViaGritQL(tree, file, AFTER_RUNTIME_CONFIG, HTTP_DOMAIN_OUTPUTS);
+};
+const TERRAFORM_VARIABLES = `# Custom domain configuration
+variable "custom_domain_name" {
+  description = "Custom domain name for the API. Requires acm_certificate_arn."
+  type        = string
+  default     = null
+}
+
+variable "acm_certificate_arn" {
+  description = "ARN of an ACM certificate (in the API's region) for the custom domain name."
+  type        = string
+  default     = null
+}`;
+const REST_TERRAFORM = {
+    kind: 'REST',
+    identifyingBlock: '`resource "aws_api_gateway_stage" "api_stage" { $_ }`',
+    runtimeConfigUrl: '$v <: r"\\"\\$\\{aws_api_gateway_stage\\.api_stage\\.invoke_url\\}/\\""',
+    domainResourceTypes: [
+        'aws_api_gateway_domain_name',
+        'aws_api_gateway_base_path_mapping'
+    ],
+    domainResources: `# Custom domain for the API, served without the stage path prefix
+resource "aws_api_gateway_domain_name" "custom_domain" {
+  count = var.custom_domain_name == null ? 0 : 1
+
+  domain_name              = var.custom_domain_name
+  regional_certificate_arn = var.acm_certificate_arn
+  security_policy          = "TLS_1_2"
+
+  endpoint_configuration {
+    types = ["REGIONAL"]
+  }
+
+  tags = var.tags
+
+  lifecycle {
+    precondition {
+      condition     = var.acm_certificate_arn != null
+      error_message = "acm_certificate_arn is required when custom_domain_name is set."
+    }
+  }
+}
+
+resource "aws_api_gateway_base_path_mapping" "custom_domain" {
+  count = var.custom_domain_name == null ? 0 : 1
+
+  api_id      = module.rest_api.api_id
+  stage_name  = aws_api_gateway_stage.api_stage.stage_name
+  domain_name = aws_api_gateway_domain_name.custom_domain[0].domain_name
+}`,
+    apiUrlLocal: `locals {
+  api_url = var.custom_domain_name == null ? "\${aws_api_gateway_stage.api_stage.invoke_url}/" : "https://\${var.custom_domain_name}/"
+}`,
+    outputs: `output "api_url" {
+  description = "URL clients should call: the custom domain if configured, otherwise the stage invoke URL"
+  value       = local.api_url
+}
+
+output "custom_domain_target_domain_name" {
+  description = "Target domain name to point a DNS alias or CNAME record at for the custom domain"
+  value       = var.custom_domain_name == null ? null : aws_api_gateway_domain_name.custom_domain[0].regional_domain_name
+}
+
+output "custom_domain_hosted_zone_id" {
+  description = "Hosted zone ID to use for a Route 53 alias record for the custom domain"
+  value       = var.custom_domain_name == null ? null : aws_api_gateway_domain_name.custom_domain[0].regional_zone_id
+}`
+};
+const HTTP_TERRAFORM = {
+    kind: 'HTTP',
+    identifyingBlock: '`module "http_api" { $_ }`',
+    runtimeConfigUrl: '$v <: `module.http_api.stage_invoke_url`',
+    domainResourceTypes: [
+        'aws_apigatewayv2_domain_name',
+        'aws_apigatewayv2_api_mapping'
+    ],
+    domainResources: `# Custom domain for the API
+resource "aws_apigatewayv2_domain_name" "custom_domain" {
+  count = var.custom_domain_name == null ? 0 : 1
+
+  domain_name = var.custom_domain_name
+
+  domain_name_configuration {
+    certificate_arn = var.acm_certificate_arn
+    endpoint_type   = "REGIONAL"
+    security_policy = "TLS_1_2"
+  }
+
+  tags = var.tags
+
+  lifecycle {
+    precondition {
+      condition     = var.acm_certificate_arn != null
+      error_message = "acm_certificate_arn is required when custom_domain_name is set."
+    }
+  }
+}
+
+resource "aws_apigatewayv2_api_mapping" "custom_domain" {
+  count = var.custom_domain_name == null ? 0 : 1
+
+  api_id      = module.http_api.api_id
+  stage       = module.http_api.stage_id
+  domain_name = aws_apigatewayv2_domain_name.custom_domain[0].domain_name
+}`,
+    apiUrlLocal: `locals {
+  api_url = var.custom_domain_name == null ? module.http_api.stage_invoke_url : "https://\${var.custom_domain_name}/"
+}`,
+    outputs: `output "api_url" {
+  description = "URL clients should call: the custom domain if configured, otherwise the stage invoke URL"
+  value       = local.api_url
+}
+
+output "custom_domain_target_domain_name" {
+  description = "Target domain name to point a DNS alias or CNAME record at for the custom domain"
+  value       = var.custom_domain_name == null ? null : aws_apigatewayv2_domain_name.custom_domain[0].domain_name_configuration[0].target_domain_name
+}
+
+output "custom_domain_hosted_zone_id" {
+  description = "Hosted zone ID to use for a Route 53 alias record for the custom domain"
+  value       = var.custom_domain_name == null ? null : aws_apigatewayv2_domain_name.custom_domain[0].domain_name_configuration[0].hosted_zone_id
+}`
+};
+const RUNTIME_CONFIG_MODULE = '`module "add_url_to_runtime_config" { $body }`';
+/** The `locals` block every vended API app module declares its IAM policy statements in. */ const POLICY_LOCALS = '`locals { $body }` where { $body <: contains `lambda_policy_statements = $_` }';
+/** Rewrite matching the block's text back unchanged, then the placeholder after it. */ const appendAfterBlock = (header)=>hcl(`\`${header} { $body }\` => \`${header} {\n  $body\n}\n\n${GRIT_INSERT_PLACEHOLDER}\``);
+const migrateTerraformApi = async (tree, moduleDir, file, nextSteps)=>{
+    const api = await matchGritQL(tree, file, hcl(REST_TERRAFORM.identifyingBlock)) ? REST_TERRAFORM : await matchGritQL(tree, file, hcl(HTTP_TERRAFORM.identifyingBlock)) ? HTTP_TERRAFORM : undefined;
+    if (!api) {
+        return; // Not a vended API app module.
+    }
+    // Everything this migration declares, so a re-run recognises its own output
+    // and nothing it inserts collides with an existing declaration. Terraform
+    // merges every `.tf` file in the module directory, so all are checked.
+    const [domainType, mappingType] = api.domainResourceTypes;
+    const declarations = [
+        '`variable "custom_domain_name" { $_ }`',
+        '`variable "acm_certificate_arn" { $_ }`',
+        `\`resource "${domainType}" "custom_domain" { $_ }\``,
+        `\`resource "${mappingType}" "custom_domain" { $_ }\``,
+        '`locals { $body }` where { $body <: contains `api_url = $_` }',
+        '`output "api_url" { $_ }`',
+        '`output "custom_domain_target_domain_name" { $_ }`',
+        '`output "custom_domain_hosted_zone_id" { $_ }`'
+    ];
+    let declared = 0;
+    for (const declaration of declarations){
+        if (await matchesInModule(tree, moduleDir, hcl(declaration))) {
+            declared++;
+        }
+    }
+    const publishesApiUrl = await matchGritQL(tree, file, hcl(`${RUNTIME_CONFIG_MODULE} where { $body <: contains \`value = { $_ = local.api_url }\` }`));
+    if (declared === declarations.length && publishesApiUrl) {
+        return; // Already migrated.
+    }
+    if (declared > 0 || publishesApiUrl) {
+        nextSteps.push(`${file}: this module (${moduleDir}) already declares some of the custom domain configuration this migration adds (custom_domain_name / acm_certificate_arn variables, the custom_domain resources, local.api_url, or the api_url / custom_domain_* outputs) - left untouched. Make sure the add_url_to_runtime_config module publishes the custom domain URL when one is configured, instead of the stage invoke URL (see the ${api.kind} API app module the plugin now generates).`);
+        return;
+    }
+    const runtimeConfigValue = `${RUNTIME_CONFIG_MODULE} where { $body <: contains \`value = { $_ = $v }\`, ${api.runtimeConfigUrl} }`;
+    const shape = [
+        hcl('`variable "tags" { $_ }`'),
+        hcl(runtimeConfigValue),
+        hcl(POLICY_LOCALS),
+        hcl('`output "stage_invoke_url" { $_ }`')
+    ];
+    if (!await matchesAll(tree, file, shape)) {
+        nextSteps.push(`${file}: has diverged from the generated shape - left untouched. To support a custom domain for this ${api.kind} API, add custom_domain_name and acm_certificate_arn variables, the custom domain and mapping resources, and publish the custom domain URL in the add_url_to_runtime_config module when it is set (see the ${api.kind} API app module the plugin now generates).`);
+        return;
+    }
+    await insertViaGritQL(tree, file, appendAfterBlock('variable "tags"'), TERRAFORM_VARIABLES);
+    // Only the URL expression is rewritten, preserving `terraform fmt` alignment.
+    await applyGritQL(tree, file, hcl(`${RUNTIME_CONFIG_MODULE} where { $body <: contains \`value = { $_ = $v }\`, ${api.runtimeConfigUrl}, $v => \`local.api_url\` }`));
+    // Alongside the module's other locals.
+    await insertViaGritQL(tree, file, hcl(`${POLICY_LOCALS} => \`locals {\n  $body\n}\n\n${GRIT_INSERT_PLACEHOLDER}\``), api.apiUrlLocal);
+    await insertViaGritQL(tree, file, appendAfterBlock('module "add_url_to_runtime_config"'), api.domainResources);
+    await insertViaGritQL(tree, file, appendAfterBlock('output "stage_invoke_url"'), api.outputs);
+};
+export default async function migration(tree) {
+    const nextSteps = [];
+    await migrateRestApiConstruct(tree, nextSteps);
+    await migrateHttpApiConstruct(tree, nextSteps);
+    if (tree.exists(TERRAFORM_APIS_DIR)) {
+        for (const dirName of tree.children(TERRAFORM_APIS_DIR)){
+            const moduleDir = joinPathFragments(TERRAFORM_APIS_DIR, dirName);
+            const file = joinPathFragments(moduleDir, `${dirName}.tf`);
+            if (tree.exists(file)) {
+                await migrateTerraformApi(tree, moduleDir, file, nextSteps);
+            }
+        }
+    }
+    await formatFilesInSubtree(tree);
+    return {
+        nextSteps
+    };
+}
+
+//# sourceMappingURL=migration.js.map

package/src/migrations/v1.0.5/0001-api-custom-domain-runtime-config/migration.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../../../../../../../packages/nx-plugin/src/migrations/v1.0.5/0001-api-custom-domain-runtime-config/migration.ts"],"sourcesContent":["/**\n * Copyright Amazon.com, Inc. or its affiliates. All Rights Reserved.\n * SPDX-License-Identifier: Apache-2.0\n */\nimport {\n  joinPathFragments,\n  type MigrationReturnObject,\n  type Tree,\n} from '@nx/devkit';\nimport {\n  addDestructuredImport,\n  applyGritQL,\n  GRIT_INSERT_PLACEHOLDER,\n  insertViaGritQL,\n  matchGritQL,\n} from '../../../utils/ast.js';\nimport { formatFilesInSubtree } from '../../../utils/format.js';\nimport {\n  PACKAGES_DIR,\n  SHARED_CONSTRUCTS_DIR,\n  SHARED_TERRAFORM_DIR,\n} from '../../../utils/shared-constructs-constants.js';\n\n/**\n * Publish an API's custom domain, when one is configured, as its URL in runtime\n * config, so clients call it rather than the generated execute-api endpoint.\n *\n * - The vended CDK `RestApi` publishes `https://<domainName>/[<basePath>/]` when\n *   `domainName` is set.\n * - The vended CDK `HttpApi` forwards `defaultDomainMapping` to the stage it\n *   creates (previously rejected by CDK, since the construct disables the\n *   default stage) and publishes the mapping's domain URL.\n * - Each vended Terraform API app module (`app/apis/<name>/<name>.tf`) gains\n *   `custom_domain_name` / `acm_certificate_arn` variables, the domain and\n *   mapping resources, an `api_url` local published in runtime config, and\n *   outputs for the URL and DNS record targets.\n *\n * These files are generated with `KeepExisting`, so an upgraded workspace keeps\n * the old shape until this runs. Diverged files are left untouched and\n * reported via `nextSteps`.\n */\n\nconst CONSTRUCTS_API_DIR = `${PACKAGES_DIR}/${SHARED_CONSTRUCTS_DIR}/src/core/api`;\nconst REST_API_CONSTRUCT = `${CONSTRUCTS_API_DIR}/rest-api.ts`;\nconst HTTP_API_CONSTRUCT = `${CONSTRUCTS_API_DIR}/http-api.ts`;\nconst TERRAFORM_APIS_DIR = `${PACKAGES_DIR}/${SHARED_TERRAFORM_DIR}/src/app/apis`;\n\nconst hcl = (pattern: string) => `language hcl\\n${pattern}`;\n\n/** Whether the pattern matches any `.tf` file in the Terraform module directory. */\nconst matchesInModule = async (\n  tree: Tree,\n  moduleDir: string,\n  pattern: string,\n) => {\n  for (const child of tree.children(moduleDir)) {\n    const path = joinPathFragments(moduleDir, child);\n    if (\n      child.endsWith('.tf') &&\n      tree.isFile(path) &&\n      (await matchGritQL(tree, path, pattern))\n    ) {\n      return true;\n    }\n  }\n  return false;\n};\n\n/** Whether every pattern matches the file. */\nconst matchesAll = async (tree: Tree, file: string, patterns: string[]) => {\n  for (const pattern of patterns) {\n    if (!(await matchGritQL(tree, file, pattern))) {\n      return false;\n    }\n  }\n  return true;\n};\n\nconst REST_RUNTIME_CONFIG_URL = `domainName\n        ? \\`https://\\${domainName.domainName}/\\${domainName.basePath ? \\`\\${domainName.basePath}/\\` : ''}\\`\n        : this.api.url!`;\n\nconst REST_DOMAIN_OUTPUTS = `// Target for the custom domain's DNS record\n    if (domainName) {\n      new CfnOutput(this, \\`\\${apiName}DomainNameAlias\\`, {\n        value: this.api.domainName!.domainNameAliasDomainName,\n        description:\n          'Domain name of the API Gateway endpoint (regional or edge) to point a CNAME record at for the custom domain, with any DNS provider',\n      });\n      new CfnOutput(this, \\`\\${apiName}DomainNameAliasHostedZoneId\\`, {\n        value: this.api.domainName!.domainNameAliasHostedZoneId,\n        description:\n          'Hosted zone ID of that domain name, needed only for a Route 53 alias record',\n      });\n    }`;\n\nconst HTTP_DOMAIN_OUTPUTS = `// Target for the custom domain's DNS record\n    if (defaultDomainMapping) {\n      new CfnOutput(this, \\`\\${apiName}DomainNameAlias\\`, {\n        value: defaultDomainMapping.domainName.regionalDomainName,\n        description:\n          'Regional domain name to point a CNAME record at for the custom domain, with any DNS provider',\n      });\n      new CfnOutput(this, \\`\\${apiName}DomainNameAliasHostedZoneId\\`, {\n        value: defaultDomainMapping.domainName.regionalHostedZoneId,\n        description:\n          'Hosted zone ID of the regional domain name, needed only for a Route 53 alias record',\n      });\n    }`;\n\nconst HTTP_DOMAIN_MAPPING_PROP = `/**\n   * Custom domain mapped to the API's default stage\n   */\n  readonly defaultDomainMapping?: DomainMappingOptions & {\n    readonly domainName: IDomainName;\n  }`;\n\n/** Matches a DNS record output this migration adds. */\nconst DOMAIN_ALIAS_OUTPUT =\n  '`new CfnOutput(this, $id, $_)` where { $id <: r\".*DomainNameAlias.*\" }';\n\n/** Rewrite inserting {@link GRIT_INSERT_PLACEHOLDER} after the runtime config registration. */\nconst AFTER_RUNTIME_CONFIG = `\\`$call;\\` as $statement where {\n  $call <: \\`rc.set('connection', 'apis', $_)\\`,\n  $statement => \\`$call;\\n\\n    ${GRIT_INSERT_PLACEHOLDER}\\`\n}`;\n\nconst migrateRestApiConstruct = async (tree: Tree, nextSteps: string[]) => {\n  const file = REST_API_CONSTRUCT;\n  if (!tree.exists(file)) {\n    return;\n  }\n\n  if (await matchGritQL(tree, file, '`[apiName]: domainName ? $_ : $_`')) {\n    return; // Already migrated.\n  }\n\n  const shape = [\n    '`{ $params }: RestApiProps<$_, $_>` where { $params <: contains `...props`, $params <: not contains `domainName` }',\n    \"`new _RestApi(this, 'Api', { $props })` where { $props <: contains `...props`, $props <: not contains `domainName` }\",\n    \"`rc.set('connection', 'apis', { $entries })` where { $entries <: contains `[apiName]: this.api.url!` }\",\n  ];\n  if (\n    !(await matchesAll(tree, file, shape)) ||\n    (await matchGritQL(tree, file, DOMAIN_ALIAS_OUTPUT))\n  ) {\n    nextSteps.push(\n      `${file}: has diverged from the generated shape - left untouched. To publish a configured custom domain to clients, destructure \\`domainName\\` from the constructor props and pass it to the CDK RestApi, register \\`https://\\${domainName.domainName}/\\` (plus any \\`basePath\\`) under \\`[apiName]\\` in the \\`rc.set('connection', 'apis', ...)\\` call when it is set instead of \\`this.api.url\\`, and output \\`this.api.domainName.domainNameAliasDomainName\\` / \\`domainNameAliasHostedZoneId\\` for the DNS record.`,\n    );\n    return;\n  }\n\n  // Taken out of `props` and passed explicitly, so it is in scope below.\n  await applyGritQL(\n    tree,\n    file,\n    '`{ $params }: RestApiProps<$_, $_>` where { $params <: contains `...props` as $rest, $rest => `domainName,\\n      ...props` }',\n  );\n  await applyGritQL(\n    tree,\n    file,\n    \"`new _RestApi(this, 'Api', { $props })` where { $props <: contains `...props` as $spread, $spread => `...props,\\n      domainName` }\",\n  );\n  await insertViaGritQL(\n    tree,\n    file,\n    \"`rc.set('connection', 'apis', { $entries })` where { $entries <: contains `[apiName]: this.api.url!` as $url, $url => `[apiName]: __GRIT_INSERT_PLACEHOLDER__` }\",\n    REST_RUNTIME_CONFIG_URL,\n  );\n  await insertViaGritQL(tree, file, AFTER_RUNTIME_CONFIG, REST_DOMAIN_OUTPUTS);\n  // Listed first, as the generator vends it.\n  const imported = await applyGritQL(\n    tree,\n    file,\n    \"`import { $names } from 'aws-cdk-lib'` where { $names <: not contains `CfnOutput` } => `import { CfnOutput, $names } from 'aws-cdk-lib'`\",\n  );\n  if (!imported) {\n    await addDestructuredImport(tree, file, ['CfnOutput'], 'aws-cdk-lib');\n  }\n};\n\nconst HTTP_API_URL_FIELD = `/** The URL clients call: the custom domain's if one is mapped, otherwise the stage's */\n  private readonly apiUrl: string`;\n\nconst HTTP_API_URL_ASSIGNMENT = `this.apiUrl = defaultDomainMapping\n      ? this.defaultStage.domainUrl\n      : this.defaultStage.url!;`;\n\n/** Matches the vended `url` getter, returning the stage URL. */\nconst HTTP_URL_GETTER =\n  'method_definition(name=$name, body=$body) where { $name <: `url`, $body <: contains `return this.defaultStage.url` }';\n\nconst migrateHttpApiConstruct = async (tree: Tree, nextSteps: string[]) => {\n  const file = HTTP_API_CONSTRUCT;\n  if (!tree.exists(file)) {\n    return;\n  }\n\n  if (await matchGritQL(tree, file, '`[apiName]: this.apiUrl`')) {\n    return; // Already migrated.\n  }\n\n  const shape = [\n    'interface_declaration(name=$name, body=$body) as $interface where { $name <: `HttpApiProps`, $interface <: contains extends_type_clause() as $extends, $extends <: contains `_HttpApiProps`, $extends <: not contains `Omit`, $body <: contains `readonly throttle?: ThrottleSettings`, $body <: not contains `defaultDomainMapping` }',\n    \"`import { $names } from 'aws-cdk-lib/aws-apigatewayv2'` where { $names <: contains `HttpApi as _HttpApi`, $names <: contains `HttpStage`, $names <: not contains `DomainMappingOptions`, $names <: not contains `IDomainName` }\",\n    '`public readonly defaultStage: HttpStage`',\n    '`{ $params }: HttpApiProps<$_, $_>` where { $params <: contains `...props`, $params <: not contains `defaultDomainMapping` }',\n    \"`this.defaultStage = new HttpStage(this, 'DefaultStage', { $props })` where { $props <: contains `httpApi: this.api`, $props <: not contains `domainMapping` }\",\n    '`new CfnOutput(this, $_, { $props })` where { $props <: contains `value: this.defaultStage.url!` }',\n    \"`rc.set('connection', 'apis', { $entries })` where { $entries <: contains `[apiName]: this.defaultStage.url!` }\",\n    HTTP_URL_GETTER,\n  ];\n  if (\n    !(await matchesAll(tree, file, shape)) ||\n    (await matchGritQL(tree, file, DOMAIN_ALIAS_OUTPUT)) ||\n    (await matchGritQL(tree, file, '`this.apiUrl`'))\n  ) {\n    nextSteps.push(\n      `${file}: has diverged from the generated shape - left untouched. To support a custom domain, destructure \\`defaultDomainMapping\\` from the constructor props (so it is not passed to the CDK HttpApi, which rejects it when the default stage is disabled) and pass it as \\`domainMapping\\` to the \\`DefaultStage\\` HttpStage; use \\`this.defaultStage.domainUrl\\` instead of \\`this.defaultStage.url\\` when it is set, for the \\`<apiName>Url\\` output, runtime config and the \\`url\\` getter; and output \\`defaultDomainMapping.domainName.regionalDomainName\\` / \\`regionalHostedZoneId\\` for the DNS record.`,\n    );\n    return;\n  }\n\n  // Typed as a domain exposing its regional attributes, for the DNS outputs.\n  await insertViaGritQL(\n    tree,\n    file,\n    'interface_declaration(name=$name, body=$body) where { $name <: `HttpApiProps`, $body <: contains `readonly throttle?: ThrottleSettings` as $throttle, $throttle => `readonly throttle?: ThrottleSettings;\\n  __GRIT_INSERT_PLACEHOLDER__` }',\n    HTTP_DOMAIN_MAPPING_PROP,\n  );\n  // Only the `_HttpApiProps` base is replaced, keeping any others.\n  await applyGritQL(\n    tree,\n    file,\n    \"interface_declaration(name=$name) as $interface where { $name <: `HttpApiProps`, $interface <: contains extends_type_clause() as $extends, $extends <: contains `_HttpApiProps` as $base, $base => `Omit<_HttpApiProps, 'defaultDomainMapping'>` }\",\n  );\n  // Inserted in sorted position, as the generator vends them.\n  await applyGritQL(\n    tree,\n    file,\n    \"`import { $names } from 'aws-cdk-lib/aws-apigatewayv2'` where { $names <: contains `HttpApi as _HttpApi` as $httpApi, $httpApi => `DomainMappingOptions,\\n  HttpApi as _HttpApi` }\",\n  );\n  await applyGritQL(\n    tree,\n    file,\n    \"`import { $names } from 'aws-cdk-lib/aws-apigatewayv2'` where { $names <: contains `HttpStage` as $stage, $stage => `HttpStage,\\n  IDomainName` }\",\n  );\n  await insertViaGritQL(\n    tree,\n    file,\n    '`public readonly defaultStage: HttpStage` as $field => `public readonly defaultStage: HttpStage;\\n\\n  __GRIT_INSERT_PLACEHOLDER__`',\n    HTTP_API_URL_FIELD,\n  );\n  // Taken out of `props` so it isn't passed to the CDK HttpApi.\n  await applyGritQL(\n    tree,\n    file,\n    '`{ $params }: HttpApiProps<$_, $_>` where { $params <: contains `...props` as $rest, $rest => `defaultDomainMapping,\\n      ...props` }',\n  );\n  await applyGritQL(\n    tree,\n    file,\n    \"`new HttpStage(this, 'DefaultStage', { $props })` where { $props <: contains `httpApi: this.api` as $httpApi, $httpApi => `httpApi: this.api,\\n      domainMapping: defaultDomainMapping` }\",\n  );\n  // Computed once, for the stack output, runtime config and the `url` getter.\n  await insertViaGritQL(\n    tree,\n    file,\n    `expression_statement() as $statement where {\n  $statement <: contains \\`this.defaultStage = new HttpStage($_, $_, $_)\\` as $assignment,\n  $statement => \\`$assignment;\\n    ${GRIT_INSERT_PLACEHOLDER}\\`\n}`,\n    HTTP_API_URL_ASSIGNMENT,\n  );\n  await applyGritQL(\n    tree,\n    file,\n    '`new CfnOutput(this, $_, { $props })` where { $props <: contains `value: this.defaultStage.url!` as $value, $value => `value: this.apiUrl` }',\n  );\n  await applyGritQL(\n    tree,\n    file,\n    \"`rc.set('connection', 'apis', { $entries })` where { $entries <: contains `[apiName]: this.defaultStage.url!` as $url, $url => `[apiName]: this.apiUrl` }\",\n  );\n  await applyGritQL(\n    tree,\n    file,\n    'method_definition(name=$name, body=$body) where { $name <: `url`, $body <: contains `return this.defaultStage.url` as $return, $return => `return this.apiUrl` }',\n  );\n  await insertViaGritQL(tree, file, AFTER_RUNTIME_CONFIG, HTTP_DOMAIN_OUTPUTS);\n};\n\nconst TERRAFORM_VARIABLES = `# Custom domain configuration\nvariable \"custom_domain_name\" {\n  description = \"Custom domain name for the API. Requires acm_certificate_arn.\"\n  type        = string\n  default     = null\n}\n\nvariable \"acm_certificate_arn\" {\n  description = \"ARN of an ACM certificate (in the API's region) for the custom domain name.\"\n  type        = string\n  default     = null\n}`;\n\n/** The differences between the REST and HTTP Terraform app modules. */\ninterface TerraformApi {\n  kind: 'REST' | 'HTTP';\n  /** A block only this kind of app module declares. */\n  identifyingBlock: string;\n  /** Matches exactly the runtime config `value` the app module was generated with. */\n  runtimeConfigUrl: string;\n  /** Types of the custom domain and mapping resources this migration adds. */\n  domainResourceTypes: [string, string];\n  domainResources: string;\n  /** The `api_url` local, published in runtime config. */\n  apiUrlLocal: string;\n  outputs: string;\n}\n\nconst REST_TERRAFORM: TerraformApi = {\n  kind: 'REST',\n  identifyingBlock: '`resource \"aws_api_gateway_stage\" \"api_stage\" { $_ }`',\n  runtimeConfigUrl:\n    '$v <: r\"\\\\\"\\\\$\\\\{aws_api_gateway_stage\\\\.api_stage\\\\.invoke_url\\\\}/\\\\\"\"',\n  domainResourceTypes: [\n    'aws_api_gateway_domain_name',\n    'aws_api_gateway_base_path_mapping',\n  ],\n  domainResources: `# Custom domain for the API, served without the stage path prefix\nresource \"aws_api_gateway_domain_name\" \"custom_domain\" {\n  count = var.custom_domain_name == null ? 0 : 1\n\n  domain_name              = var.custom_domain_name\n  regional_certificate_arn = var.acm_certificate_arn\n  security_policy          = \"TLS_1_2\"\n\n  endpoint_configuration {\n    types = [\"REGIONAL\"]\n  }\n\n  tags = var.tags\n\n  lifecycle {\n    precondition {\n      condition     = var.acm_certificate_arn != null\n      error_message = \"acm_certificate_arn is required when custom_domain_name is set.\"\n    }\n  }\n}\n\nresource \"aws_api_gateway_base_path_mapping\" \"custom_domain\" {\n  count = var.custom_domain_name == null ? 0 : 1\n\n  api_id      = module.rest_api.api_id\n  stage_name  = aws_api_gateway_stage.api_stage.stage_name\n  domain_name = aws_api_gateway_domain_name.custom_domain[0].domain_name\n}`,\n  apiUrlLocal: `locals {\n  api_url = var.custom_domain_name == null ? \"\\${aws_api_gateway_stage.api_stage.invoke_url}/\" : \"https://\\${var.custom_domain_name}/\"\n}`,\n  outputs: `output \"api_url\" {\n  description = \"URL clients should call: the custom domain if configured, otherwise the stage invoke URL\"\n  value       = local.api_url\n}\n\noutput \"custom_domain_target_domain_name\" {\n  description = \"Target domain name to point a DNS alias or CNAME record at for the custom domain\"\n  value       = var.custom_domain_name == null ? null : aws_api_gateway_domain_name.custom_domain[0].regional_domain_name\n}\n\noutput \"custom_domain_hosted_zone_id\" {\n  description = \"Hosted zone ID to use for a Route 53 alias record for the custom domain\"\n  value       = var.custom_domain_name == null ? null : aws_api_gateway_domain_name.custom_domain[0].regional_zone_id\n}`,\n};\n\nconst HTTP_TERRAFORM: TerraformApi = {\n  kind: 'HTTP',\n  identifyingBlock: '`module \"http_api\" { $_ }`',\n  runtimeConfigUrl: '$v <: `module.http_api.stage_invoke_url`',\n  domainResourceTypes: [\n    'aws_apigatewayv2_domain_name',\n    'aws_apigatewayv2_api_mapping',\n  ],\n  domainResources: `# Custom domain for the API\nresource \"aws_apigatewayv2_domain_name\" \"custom_domain\" {\n  count = var.custom_domain_name == null ? 0 : 1\n\n  domain_name = var.custom_domain_name\n\n  domain_name_configuration {\n    certificate_arn = var.acm_certificate_arn\n    endpoint_type   = \"REGIONAL\"\n    security_policy = \"TLS_1_2\"\n  }\n\n  tags = var.tags\n\n  lifecycle {\n    precondition {\n      condition     = var.acm_certificate_arn != null\n      error_message = \"acm_certificate_arn is required when custom_domain_name is set.\"\n    }\n  }\n}\n\nresource \"aws_apigatewayv2_api_mapping\" \"custom_domain\" {\n  count = var.custom_domain_name == null ? 0 : 1\n\n  api_id      = module.http_api.api_id\n  stage       = module.http_api.stage_id\n  domain_name = aws_apigatewayv2_domain_name.custom_domain[0].domain_name\n}`,\n  apiUrlLocal: `locals {\n  api_url = var.custom_domain_name == null ? module.http_api.stage_invoke_url : \"https://\\${var.custom_domain_name}/\"\n}`,\n  outputs: `output \"api_url\" {\n  description = \"URL clients should call: the custom domain if configured, otherwise the stage invoke URL\"\n  value       = local.api_url\n}\n\noutput \"custom_domain_target_domain_name\" {\n  description = \"Target domain name to point a DNS alias or CNAME record at for the custom domain\"\n  value       = var.custom_domain_name == null ? null : aws_apigatewayv2_domain_name.custom_domain[0].domain_name_configuration[0].target_domain_name\n}\n\noutput \"custom_domain_hosted_zone_id\" {\n  description = \"Hosted zone ID to use for a Route 53 alias record for the custom domain\"\n  value       = var.custom_domain_name == null ? null : aws_apigatewayv2_domain_name.custom_domain[0].domain_name_configuration[0].hosted_zone_id\n}`,\n};\n\nconst RUNTIME_CONFIG_MODULE = '`module \"add_url_to_runtime_config\" { $body }`';\n\n/** The `locals` block every vended API app module declares its IAM policy statements in. */\nconst POLICY_LOCALS =\n  '`locals { $body }` where { $body <: contains `lambda_policy_statements = $_` }';\n\n/** Rewrite matching the block's text back unchanged, then the placeholder after it. */\nconst appendAfterBlock = (header: string) =>\n  hcl(\n    `\\`${header} { $body }\\` => \\`${header} {\\n  $body\\n}\\n\\n${GRIT_INSERT_PLACEHOLDER}\\``,\n  );\n\nconst migrateTerraformApi = async (\n  tree: Tree,\n  moduleDir: string,\n  file: string,\n  nextSteps: string[],\n) => {\n  const api = (await matchGritQL(\n    tree,\n    file,\n    hcl(REST_TERRAFORM.identifyingBlock),\n  ))\n    ? REST_TERRAFORM\n    : (await matchGritQL(tree, file, hcl(HTTP_TERRAFORM.identifyingBlock)))\n      ? HTTP_TERRAFORM\n      : undefined;\n  if (!api) {\n    return; // Not a vended API app module.\n  }\n\n  // Everything this migration declares, so a re-run recognises its own output\n  // and nothing it inserts collides with an existing declaration. Terraform\n  // merges every `.tf` file in the module directory, so all are checked.\n  const [domainType, mappingType] = api.domainResourceTypes;\n  const declarations = [\n    '`variable \"custom_domain_name\" { $_ }`',\n    '`variable \"acm_certificate_arn\" { $_ }`',\n    `\\`resource \"${domainType}\" \"custom_domain\" { $_ }\\``,\n    `\\`resource \"${mappingType}\" \"custom_domain\" { $_ }\\``,\n    '`locals { $body }` where { $body <: contains `api_url = $_` }',\n    '`output \"api_url\" { $_ }`',\n    '`output \"custom_domain_target_domain_name\" { $_ }`',\n    '`output \"custom_domain_hosted_zone_id\" { $_ }`',\n  ];\n  let declared = 0;\n  for (const declaration of declarations) {\n    if (await matchesInModule(tree, moduleDir, hcl(declaration))) {\n      declared++;\n    }\n  }\n  const publishesApiUrl = await matchGritQL(\n    tree,\n    file,\n    hcl(\n      `${RUNTIME_CONFIG_MODULE} where { $body <: contains \\`value = { $_ = local.api_url }\\` }`,\n    ),\n  );\n  if (declared === declarations.length && publishesApiUrl) {\n    return; // Already migrated.\n  }\n  if (declared > 0 || publishesApiUrl) {\n    nextSteps.push(\n      `${file}: this module (${moduleDir}) already declares some of the custom domain configuration this migration adds (custom_domain_name / acm_certificate_arn variables, the custom_domain resources, local.api_url, or the api_url / custom_domain_* outputs) - left untouched. Make sure the add_url_to_runtime_config module publishes the custom domain URL when one is configured, instead of the stage invoke URL (see the ${api.kind} API app module the plugin now generates).`,\n    );\n    return;\n  }\n\n  const runtimeConfigValue = `${RUNTIME_CONFIG_MODULE} where { $body <: contains \\`value = { $_ = $v }\\`, ${api.runtimeConfigUrl} }`;\n  const shape = [\n    hcl('`variable \"tags\" { $_ }`'),\n    hcl(runtimeConfigValue),\n    hcl(POLICY_LOCALS),\n    hcl('`output \"stage_invoke_url\" { $_ }`'),\n  ];\n  if (!(await matchesAll(tree, file, shape))) {\n    nextSteps.push(\n      `${file}: has diverged from the generated shape - left untouched. To support a custom domain for this ${api.kind} API, add custom_domain_name and acm_certificate_arn variables, the custom domain and mapping resources, and publish the custom domain URL in the add_url_to_runtime_config module when it is set (see the ${api.kind} API app module the plugin now generates).`,\n    );\n    return;\n  }\n\n  await insertViaGritQL(\n    tree,\n    file,\n    appendAfterBlock('variable \"tags\"'),\n    TERRAFORM_VARIABLES,\n  );\n  // Only the URL expression is rewritten, preserving `terraform fmt` alignment.\n  await applyGritQL(\n    tree,\n    file,\n    hcl(\n      `${RUNTIME_CONFIG_MODULE} where { $body <: contains \\`value = { $_ = $v }\\`, ${api.runtimeConfigUrl}, $v => \\`local.api_url\\` }`,\n    ),\n  );\n  // Alongside the module's other locals.\n  await insertViaGritQL(\n    tree,\n    file,\n    hcl(\n      `${POLICY_LOCALS} => \\`locals {\\n  $body\\n}\\n\\n${GRIT_INSERT_PLACEHOLDER}\\``,\n    ),\n    api.apiUrlLocal,\n  );\n  await insertViaGritQL(\n    tree,\n    file,\n    appendAfterBlock('module \"add_url_to_runtime_config\"'),\n    api.domainResources,\n  );\n  await insertViaGritQL(\n    tree,\n    file,\n    appendAfterBlock('output \"stage_invoke_url\"'),\n    api.outputs,\n  );\n};\n\nexport default async function migration(\n  tree: Tree,\n): Promise<MigrationReturnObject> {\n  const nextSteps: string[] = [];\n\n  await migrateRestApiConstruct(tree, nextSteps);\n  await migrateHttpApiConstruct(tree, nextSteps);\n\n  if (tree.exists(TERRAFORM_APIS_DIR)) {\n    for (const dirName of tree.children(TERRAFORM_APIS_DIR)) {\n      const moduleDir = joinPathFragments(TERRAFORM_APIS_DIR, dirName);\n      const file = joinPathFragments(moduleDir, `${dirName}.tf`);\n      if (tree.exists(file)) {\n        await migrateTerraformApi(tree, moduleDir, file, nextSteps);\n      }\n    }\n  }\n\n  await formatFilesInSubtree(tree);\n\n  return { nextSteps };\n}\n"],"names":["joinPathFragments","addDestructuredImport","applyGritQL","GRIT_INSERT_PLACEHOLDER","insertViaGritQL","matchGritQL","formatFilesInSubtree","PACKAGES_DIR","SHARED_CONSTRUCTS_DIR","SHARED_TERRAFORM_DIR","CONSTRUCTS_API_DIR","REST_API_CONSTRUCT","HTTP_API_CONSTRUCT","TERRAFORM_APIS_DIR","hcl","pattern","matchesInModule","tree","moduleDir","child","children","path","endsWith","isFile","matchesAll","file","patterns","REST_RUNTIME_CONFIG_URL","REST_DOMAIN_OUTPUTS","HTTP_DOMAIN_OUTPUTS","HTTP_DOMAIN_MAPPING_PROP","DOMAIN_ALIAS_OUTPUT","AFTER_RUNTIME_CONFIG","migrateRestApiConstruct","nextSteps","exists","shape","push","imported","HTTP_API_URL_FIELD","HTTP_API_URL_ASSIGNMENT","HTTP_URL_GETTER","migrateHttpApiConstruct","TERRAFORM_VARIABLES","REST_TERRAFORM","kind","identifyingBlock","runtimeConfigUrl","domainResourceTypes","domainResources","apiUrlLocal","outputs","HTTP_TERRAFORM","RUNTIME_CONFIG_MODULE","POLICY_LOCALS","appendAfterBlock","header","migrateTerraformApi","api","undefined","domainType","mappingType","declarations","declared","declaration","publishesApiUrl","length","runtimeConfigValue","migration","dirName"],"mappings":"AAAA;;;CAGC,GACD,SACEA,iBAAiB,QAGZ,aAAa;AACpB,SACEC,qBAAqB,EACrBC,WAAW,EACXC,uBAAuB,EACvBC,eAAe,EACfC,WAAW,QACN,wBAAwB;AAC/B,SAASC,oBAAoB,QAAQ,2BAA2B;AAChE,SACEC,YAAY,EACZC,qBAAqB,EACrBC,oBAAoB,QACf,gDAAgD;AAEvD;;;;;;;;;;;;;;;;;CAiBC,GAED,MAAMC,qBAAqB,GAAGH,aAAa,CAAC,EAAEC,sBAAsB,aAAa,CAAC;AAClF,MAAMG,qBAAqB,GAAGD,mBAAmB,YAAY,CAAC;AAC9D,MAAME,qBAAqB,GAAGF,mBAAmB,YAAY,CAAC;AAC9D,MAAMG,qBAAqB,GAAGN,aAAa,CAAC,EAAEE,qBAAqB,aAAa,CAAC;AAEjF,MAAMK,MAAM,CAACC,UAAoB,CAAC,cAAc,EAAEA,SAAS;AAE3D,kFAAkF,GAClF,MAAMC,kBAAkB,OACtBC,MACAC,WACAH;IAEA,KAAK,MAAMI,SAASF,KAAKG,QAAQ,CAACF,WAAY;QAC5C,MAAMG,OAAOrB,kBAAkBkB,WAAWC;QAC1C,IACEA,MAAMG,QAAQ,CAAC,UACfL,KAAKM,MAAM,CAACF,SACX,MAAMhB,YAAYY,MAAMI,MAAMN,UAC/B;YACA,OAAO;QACT;IACF;IACA,OAAO;AACT;AAEA,4CAA4C,GAC5C,MAAMS,aAAa,OAAOP,MAAYQ,MAAcC;IAClD,KAAK,MAAMX,WAAWW,SAAU;QAC9B,IAAI,CAAE,MAAMrB,YAAYY,MAAMQ,MAAMV,UAAW;YAC7C,OAAO;QACT;IACF;IACA,OAAO;AACT;AAEA,MAAMY,0BAA0B,CAAC;;uBAEV,CAAC;AAExB,MAAMC,sBAAsB,CAAC;;;;;;;;;;;;KAYxB,CAAC;AAEN,MAAMC,sBAAsB,CAAC;;;;;;;;;;;;KAYxB,CAAC;AAEN,MAAMC,2BAA2B,CAAC;;;;;GAK/B,CAAC;AAEJ,qDAAqD,GACrD,MAAMC,sBACJ;AAEF,6FAA6F,GAC7F,MAAMC,uBAAuB,CAAC;;gCAEE,EAAE7B,wBAAwB;CACzD,CAAC;AAEF,MAAM8B,0BAA0B,OAAOhB,MAAYiB;IACjD,MAAMT,OAAOd;IACb,IAAI,CAACM,KAAKkB,MAAM,CAACV,OAAO;QACtB;IACF;IAEA,IAAI,MAAMpB,YAAYY,MAAMQ,MAAM,sCAAsC;QACtE,QAAQ,oBAAoB;IAC9B;IAEA,MAAMW,QAAQ;QACZ;QACA;QACA;KACD;IACD,IACE,CAAE,MAAMZ,WAAWP,MAAMQ,MAAMW,UAC9B,MAAM/B,YAAYY,MAAMQ,MAAMM,sBAC/B;QACAG,UAAUG,IAAI,CACZ,GAAGZ,KAAK,8eAA8e,CAAC;QAEzf;IACF;IAEA,uEAAuE;IACvE,MAAMvB,YACJe,MACAQ,MACA;IAEF,MAAMvB,YACJe,MACAQ,MACA;IAEF,MAAMrB,gBACJa,MACAQ,MACA,oKACAE;IAEF,MAAMvB,gBAAgBa,MAAMQ,MAAMO,sBAAsBJ;IACxD,2CAA2C;IAC3C,MAAMU,WAAW,MAAMpC,YACrBe,MACAQ,MACA;IAEF,IAAI,CAACa,UAAU;QACb,MAAMrC,sBAAsBgB,MAAMQ,MAAM;YAAC;SAAY,EAAE;IACzD;AACF;AAEA,MAAMc,qBAAqB,CAAC;iCACK,CAAC;AAElC,MAAMC,0BAA0B,CAAC;;+BAEF,CAAC;AAEhC,8DAA8D,GAC9D,MAAMC,kBACJ;AAEF,MAAMC,0BAA0B,OAAOzB,MAAYiB;IACjD,MAAMT,OAAOb;IACb,IAAI,CAACK,KAAKkB,MAAM,CAACV,OAAO;QACtB;IACF;IAEA,IAAI,MAAMpB,YAAYY,MAAMQ,MAAM,6BAA6B;QAC7D,QAAQ,oBAAoB;IAC9B;IAEA,MAAMW,QAAQ;QACZ;QACA;QACA;QACA;QACA;QACA;QACA;QACAK;KACD;IACD,IACE,CAAE,MAAMjB,WAAWP,MAAMQ,MAAMW,UAC9B,MAAM/B,YAAYY,MAAMQ,MAAMM,wBAC9B,MAAM1B,YAAYY,MAAMQ,MAAM,kBAC/B;QACAS,UAAUG,IAAI,CACZ,GAAGZ,KAAK,ykBAAykB,CAAC;QAEplB;IACF;IAEA,2EAA2E;IAC3E,MAAMrB,gBACJa,MACAQ,MACA,+OACAK;IAEF,iEAAiE;IACjE,MAAM5B,YACJe,MACAQ,MACA;IAEF,4DAA4D;IAC5D,MAAMvB,YACJe,MACAQ,MACA;IAEF,MAAMvB,YACJe,MACAQ,MACA;IAEF,MAAMrB,gBACJa,MACAQ,MACA,sIACAc;IAEF,8DAA8D;IAC9D,MAAMrC,YACJe,MACAQ,MACA;IAEF,MAAMvB,YACJe,MACAQ,MACA;IAEF,4EAA4E;IAC5E,MAAMrB,gBACJa,MACAQ,MACA,CAAC;;oCAE+B,EAAEtB,wBAAwB;CAC7D,CAAC,EACEqC;IAEF,MAAMtC,YACJe,MACAQ,MACA;IAEF,MAAMvB,YACJe,MACAQ,MACA;IAEF,MAAMvB,YACJe,MACAQ,MACA;IAEF,MAAMrB,gBAAgBa,MAAMQ,MAAMO,sBAAsBH;AAC1D;AAEA,MAAMc,sBAAsB,CAAC;;;;;;;;;;;CAW5B,CAAC;AAiBF,MAAMC,iBAA+B;IACnCC,MAAM;IACNC,kBAAkB;IAClBC,kBACE;IACFC,qBAAqB;QACnB;QACA;KACD;IACDC,iBAAiB,CAAC;;;;;;;;;;;;;;;;;;;;;;;;;;;;CA4BnB,CAAC;IACAC,aAAa,CAAC;;CAEf,CAAC;IACAC,SAAS,CAAC;;;;;;;;;;;;;CAaX,CAAC;AACF;AAEA,MAAMC,iBAA+B;IACnCP,MAAM;IACNC,kBAAkB;IAClBC,kBAAkB;IAClBC,qBAAqB;QACnB;QACA;KACD;IACDC,iBAAiB,CAAC;;;;;;;;;;;;;;;;;;;;;;;;;;;;CA4BnB,CAAC;IACAC,aAAa,CAAC;;CAEf,CAAC;IACAC,SAAS,CAAC;;;;;;;;;;;;;CAaX,CAAC;AACF;AAEA,MAAME,wBAAwB;AAE9B,0FAA0F,GAC1F,MAAMC,gBACJ;AAEF,qFAAqF,GACrF,MAAMC,mBAAmB,CAACC,SACxB1C,IACE,CAAC,EAAE,EAAE0C,OAAO,kBAAkB,EAAEA,OAAO,kBAAkB,EAAErD,wBAAwB,EAAE,CAAC;AAG1F,MAAMsD,sBAAsB,OAC1BxC,MACAC,WACAO,MACAS;IAEA,MAAMwB,MAAM,AAAC,MAAMrD,YACjBY,MACAQ,MACAX,IAAI8B,eAAeE,gBAAgB,KAEjCF,iBACA,AAAC,MAAMvC,YAAYY,MAAMQ,MAAMX,IAAIsC,eAAeN,gBAAgB,KAChEM,iBACAO;IACN,IAAI,CAACD,KAAK;QACR,QAAQ,+BAA+B;IACzC;IAEA,4EAA4E;IAC5E,0EAA0E;IAC1E,uEAAuE;IACvE,MAAM,CAACE,YAAYC,YAAY,GAAGH,IAAIV,mBAAmB;IACzD,MAAMc,eAAe;QACnB;QACA;QACA,CAAC,YAAY,EAAEF,WAAW,0BAA0B,CAAC;QACrD,CAAC,YAAY,EAAEC,YAAY,0BAA0B,CAAC;QACtD;QACA;QACA;QACA;KACD;IACD,IAAIE,WAAW;IACf,KAAK,MAAMC,eAAeF,aAAc;QACtC,IAAI,MAAM9C,gBAAgBC,MAAMC,WAAWJ,IAAIkD,eAAe;YAC5DD;QACF;IACF;IACA,MAAME,kBAAkB,MAAM5D,YAC5BY,MACAQ,MACAX,IACE,GAAGuC,sBAAsB,+DAA+D,CAAC;IAG7F,IAAIU,aAAaD,aAAaI,MAAM,IAAID,iBAAiB;QACvD,QAAQ,oBAAoB;IAC9B;IACA,IAAIF,WAAW,KAAKE,iBAAiB;QACnC/B,UAAUG,IAAI,CACZ,GAAGZ,KAAK,eAAe,EAAEP,UAAU,4XAA4X,EAAEwC,IAAIb,IAAI,CAAC,0CAA0C,CAAC;QAEvd;IACF;IAEA,MAAMsB,qBAAqB,GAAGd,sBAAsB,oDAAoD,EAAEK,IAAIX,gBAAgB,CAAC,EAAE,CAAC;IAClI,MAAMX,QAAQ;QACZtB,IAAI;QACJA,IAAIqD;QACJrD,IAAIwC;QACJxC,IAAI;KACL;IACD,IAAI,CAAE,MAAMU,WAAWP,MAAMQ,MAAMW,QAAS;QAC1CF,UAAUG,IAAI,CACZ,GAAGZ,KAAK,8FAA8F,EAAEiC,IAAIb,IAAI,CAAC,2MAA2M,EAAEa,IAAIb,IAAI,CAAC,0CAA0C,CAAC;QAEpX;IACF;IAEA,MAAMzC,gBACJa,MACAQ,MACA8B,iBAAiB,oBACjBZ;IAEF,8EAA8E;IAC9E,MAAMzC,YACJe,MACAQ,MACAX,IACE,GAAGuC,sBAAsB,oDAAoD,EAAEK,IAAIX,gBAAgB,CAAC,2BAA2B,CAAC;IAGpI,uCAAuC;IACvC,MAAM3C,gBACJa,MACAQ,MACAX,IACE,GAAGwC,cAAc,8BAA8B,EAAEnD,wBAAwB,EAAE,CAAC,GAE9EuD,IAAIR,WAAW;IAEjB,MAAM9C,gBACJa,MACAQ,MACA8B,iBAAiB,uCACjBG,IAAIT,eAAe;IAErB,MAAM7C,gBACJa,MACAQ,MACA8B,iBAAiB,8BACjBG,IAAIP,OAAO;AAEf;AAEA,eAAe,eAAeiB,UAC5BnD,IAAU;IAEV,MAAMiB,YAAsB,EAAE;IAE9B,MAAMD,wBAAwBhB,MAAMiB;IACpC,MAAMQ,wBAAwBzB,MAAMiB;IAEpC,IAAIjB,KAAKkB,MAAM,CAACtB,qBAAqB;QACnC,KAAK,MAAMwD,WAAWpD,KAAKG,QAAQ,CAACP,oBAAqB;YACvD,MAAMK,YAAYlB,kBAAkBa,oBAAoBwD;YACxD,MAAM5C,OAAOzB,kBAAkBkB,WAAW,GAAGmD,QAAQ,GAAG,CAAC;YACzD,IAAIpD,KAAKkB,MAAM,CAACV,OAAO;gBACrB,MAAMgC,oBAAoBxC,MAAMC,WAAWO,MAAMS;YACnD;QACF;IACF;IAEA,MAAM5B,qBAAqBW;IAE3B,OAAO;QAAEiB;IAAU;AACrB"}

package/src/preset/__snapshots__/generator.spec.ts.snap

@@ -253,7 +253,7 @@ export default {
 
 exports[`preset generator > should run successfully > biome.json 1`] = `
 "{
-  "$schema": "https://biomejs.dev/schemas/2.5.14/schema.json",
+  "$schema": "https://biomejs.dev/schemas/2.5.15/schema.json",
   "root": true,
   "formatter": {
     "enabled": true,
@@ -422,7 +422,7 @@ catalog:
   '@nx/js': 23.2.1
   '@nx/workspace': 23.2.1
   typescript: ~6.0.3
-  '@biomejs/biome': 2.5.14
+  '@biomejs/biome': 2.5.15
   '@aws/nx-plugin': ^0.0.0
   '@aws/nx-plugin-mcp': ^0.0.0
 "

package/src/py/agent/__snapshots__/generator.constructs.spec.ts.snap

@@ -764,18 +764,18 @@ version = "0.1.0"
 dependencies = [
   "proj-agent-connection",
   "aws-lambda-powertools==3.35.0",
-  "aws-opentelemetry-distro==0.20.0",
-  "bedrock-agentcore==1.23.1",
-  "boto3==1.43.103",
-  "fastapi==0.141.1",
+  "aws-opentelemetry-distro==0.21.0",
+  "bedrock-agentcore==1.24.0",
+  "boto3==1.43.108",
+  "fastapi==0.142.2",
   "mcp==1.28.1",
-  "strands-agents==1.57.1",
+  "strands-agents==1.57.2",
   "strands-agents-tools==0.8.9",
   "uvicorn==0.54.0"
 ]
 
 [dependency-groups]
-dev = [ "fastapi[standard]==0.141.1" ]
+dev = [ "fastapi[standard]==0.142.2" ]
 
 [tool.uv]
 dev-dependencies = [ ]

package/src/py/agent/__snapshots__/generator.frameworks.spec.ts.snap

@@ -702,23 +702,23 @@ version = "0.1.0"
 dependencies = [
   "proj-agent-connection",
   "aws-lambda-powertools==3.35.0",
-  "aws-opentelemetry-distro==0.20.0",
-  "bedrock-agentcore==1.23.1",
-  "boto3==1.43.103",
-  "fastapi==0.141.1",
+  "aws-opentelemetry-distro==0.21.0",
+  "bedrock-agentcore==1.24.0",
+  "boto3==1.43.108",
+  "fastapi==0.142.2",
   "mcp==1.28.1",
-  "langchain==1.4.2",
-  "langchain-aws==1.7.9",
+  "langchain==1.4.3",
+  "langchain-aws==1.8.0",
   "langgraph==1.2.12",
   "langgraph-checkpoint-sqlite==3.1.1",
   "aiosqlite==0.22.1",
   "ag-ui-protocol==0.1.22",
-  "ag-ui-langgraph==0.0.45",
+  "ag-ui-langgraph==0.0.46",
   "uvicorn==0.54.0"
 ]
 
 [dependency-groups]
-dev = [ "fastapi[standard]==0.141.1" ]
+dev = [ "fastapi[standard]==0.142.2" ]
 
 [tool.uv]
 dev-dependencies = [ ]

package/src/py/agent/__snapshots__/generator.protocols.spec.ts.snap

@@ -5,7 +5,7 @@ exports[`py#agent generator > should create DynamoDB checkpoint table and S3 off
   required_providers {
     aws = {
       source  = "hashicorp/aws"
-      version = "6.66.0"
+      version = "6.67.0"
     }
     random = {
       source  = "hashicorp/random"
@@ -381,7 +381,7 @@ exports[`py#agent generator > should match snapshot for Terraform generated file
   required_providers {
     aws = {
       source  = "hashicorp/aws"
-      version = "6.66.0"
+      version = "6.67.0"
     }
     random = {
       source  = "hashicorp/random"
@@ -704,7 +704,7 @@ exports[`py#agent generator > should match snapshot for Terraform generated file
   required_providers {
     aws = {
       source  = "hashicorp/aws"
-      version = "6.66.0"
+      version = "6.67.0"
     }
     null = {
       source  = "hashicorp/null"
@@ -1063,7 +1063,7 @@ resource "null_resource" "runtime_ready" {
 
   provisioner "local-exec" {
     command = <<-EOT
-      uv run --with boto3==1.43.103 python -c "
+      uv run --with boto3==1.43.108 python -c "
 import boto3
 import json
 import os

package/src/py/dynamodb/__snapshots__/generator.spec.ts.snap

@@ -35,7 +35,7 @@ exports[`py#dynamodb generator > should generate terraform modules when iac is t
   required_providers {
     aws = {
       source  = "hashicorp/aws"
-      version = "6.66.0"
+      version = "6.67.0"
     }
   }
 }
@@ -232,7 +232,7 @@ exports[`py#dynamodb generator > should generate terraform modules when iac is t
   required_providers {
     aws = {
       source  = "hashicorp/aws"
-      version = "6.66.0"
+      version = "6.67.0"
     }
     random = {
       source  = "hashicorp/random"