@aws/nx-plugin 1.0.4 → 1.0.6

package/src/ts/agent/__snapshots__/generator.spec.ts.snap

@@ -650,7 +650,7 @@ RUN apt-get update && \\
     rm -rf /var/lib/apt/lists/*
 
 # Upgrade npm to a version free of known HIGH/CRITICAL vulnerabilities
-RUN npm install -g npm@12.1.0
+RUN npm install -g npm@12.2.0
 
 WORKDIR /app
 
@@ -984,7 +984,7 @@ exports[`ts#agent generator > should match snapshot for Terraform generated file
   required_providers {
     aws = {
       source  = "hashicorp/aws"
-      version = "6.66.0"
+      version = "6.67.0"
     }
     random = {
       source  = "hashicorp/random"
@@ -1307,7 +1307,7 @@ exports[`ts#agent generator > should match snapshot for Terraform generated file
   required_providers {
     aws = {
       source  = "hashicorp/aws"
-      version = "6.66.0"
+      version = "6.67.0"
     }
     null = {
       source  = "hashicorp/null"
@@ -1666,7 +1666,7 @@ resource "null_resource" "runtime_ready" {
 
   provisioner "local-exec" {
     command = <<-EOT
-      uv run --with boto3==1.43.103 python -c "
+      uv run --with boto3==1.43.108 python -c "
 import boto3
 import json
 import os

package/src/ts/dcr-proxy/__snapshots__/generator.spec.ts.snap

@@ -579,7 +579,7 @@ terraform {
   required_providers {
     aws = {
       source  = "hashicorp/aws"
-      version = "6.66.0"
+      version = "6.67.0"
     }
     archive = {
       source  = "hashicorp/archive"

package/src/ts/dynamodb/__snapshots__/generator.spec.ts.snap

@@ -35,7 +35,7 @@ exports[`ts#dynamodb generator > should generate terraform modules when iac is t
   required_providers {
     aws = {
       source  = "hashicorp/aws"
-      version = "6.66.0"
+      version = "6.67.0"
     }
   }
 }
@@ -232,7 +232,7 @@ exports[`ts#dynamodb generator > should generate terraform modules when iac is t
   required_providers {
     aws = {
       source  = "hashicorp/aws"
-      version = "6.66.0"
+      version = "6.67.0"
     }
     random = {
       source  = "hashicorp/random"

package/src/ts/lambda-function/__snapshots__/generator.spec.ts.snap

@@ -141,7 +141,7 @@ exports[`ts-lambda-function generator > terraform iac > should generate terrafor
   required_providers {
     aws = {
       source  = "hashicorp/aws"
-      version = "6.66.0"
+      version = "6.67.0"
     }
     archive = {
       source  = "hashicorp/archive"
@@ -326,7 +326,7 @@ exports[`ts-lambda-function generator > terraform iac > should match snapshot fo
   required_providers {
     aws = {
       source  = "hashicorp/aws"
-      version = "6.66.0"
+      version = "6.67.0"
     }
     archive = {
       source  = "hashicorp/archive"

package/src/ts/mcp-server/__snapshots__/generator.spec.ts.snap

@@ -155,7 +155,7 @@ exports[`ts#mcp-server generator > should match snapshot for Terraform generated
   required_providers {
     aws = {
       source  = "hashicorp/aws"
-      version = "6.66.0"
+      version = "6.67.0"
     }
     null = {
       source  = "hashicorp/null"
@@ -514,7 +514,7 @@ resource "null_resource" "runtime_ready" {
 
   provisioner "local-exec" {
     command = <<-EOT
-      uv run --with boto3==1.43.103 python -c "
+      uv run --with boto3==1.43.108 python -c "
 import boto3
 import json
 import os

package/src/ts/rdb/__snapshots__/generator.spec.ts.snap

@@ -848,7 +848,7 @@ terraform {
   required_providers {
     aws = {
       source  = "hashicorp/aws"
-      version = "6.66.0"
+      version = "6.67.0"
     }
     null = {
       source  = "hashicorp/null"
@@ -1519,7 +1519,7 @@ exports[`ts#rdb generator > should generate terraform modules when iac is Terraf
     }
     aws = {
       source  = "hashicorp/aws"
-      version = "6.66.0"
+      version = "6.67.0"
     }
     external = {
       source  = "hashicorp/external"
@@ -2214,7 +2214,7 @@ terraform {
   required_providers {
     aws = {
       source  = "hashicorp/aws"
-      version = "6.66.0"
+      version = "6.67.0"
     }
     null = {
       source  = "hashicorp/null"
@@ -2885,7 +2885,7 @@ exports[`ts#rdb generator > should generate terraform modules with MySQL engine
     }
     aws = {
       source  = "hashicorp/aws"
-      version = "6.66.0"
+      version = "6.67.0"
     }
     external = {
       source  = "hashicorp/external"
@@ -4520,7 +4520,7 @@ exports[`ts#rdb generator > should generate the aurora shared construct 4`] = `
 "FROM public.ecr.aws/lambda/nodejs:24
 
 # Upgrade npm to a version free of known HIGH/CRITICAL vulnerabilities
-RUN npm install -g npm@12.1.0
+RUN npm install -g npm@12.2.0
 
 # Patch OS packages beyond the base image's pinned release, and drop the
 # runtime's convenience copy of the AWS SDK (the handler bundle inlines its
@@ -4541,7 +4541,7 @@ WORKDIR \${LAMBDA_TASK_ROOT}
 RUN printf 'allow-scripts[]=prisma\\nallow-scripts[]=@prisma/engines\\n' > .npmrc \\
     && npm init -y \\
     && npm pkg set "overrides.deepmerge-ts=8.0.2" \\
-    && npm pkg set "overrides.mysql2=3.24.4" \\
+    && npm pkg set "overrides.mysql2=3.24.5" \\
     && npm install prisma@7.10.0 \\
     && rm .npmrc \\
     && npm uninstall -g npm

package/src/ts/react-website/app/__snapshots__/generator.spec.ts.snap

@@ -131,7 +131,7 @@ exports[`react-website generator > TailwindCSS integration > terraform iac > sho
   required_providers {
     aws = {
       source  = "hashicorp/aws"
-      version = "6.66.0"
+      version = "6.67.0"
       configuration_aliases = [aws.us_east_1]
     }
     null = {
@@ -745,7 +745,7 @@ resource "null_resource" "upload_website_files" {
   provisioner "local-exec" {
     command = <<-EOT
       cd "$ROOT_PATH"
-      uv run --with boto3==1.43.103 python3 -c "
+      uv run --with boto3==1.43.108 python3 -c "
 import os
 import sys
 import boto3
@@ -868,7 +868,7 @@ resource "null_resource" "cloudfront_invalidation" {
 
   provisioner "local-exec" {
     command = <<-EOT
-      uv run --with boto3==1.43.103 python3 -c "
+      uv run --with boto3==1.43.108 python3 -c "
 import boto3
 import os
 import sys
@@ -954,7 +954,7 @@ output "waf_web_acl_arn" {
   required_providers {
     aws = {
       source  = "hashicorp/aws"
-      version = "6.66.0"
+      version = "6.67.0"
       configuration_aliases = [aws.us_east_1]
     }
   }
@@ -1060,7 +1060,7 @@ runtime-config.json"
 
 exports[`react-website generator > Tanstack router integration > should generate website with no router correctly > biome.json 1`] = `
 "{
-  "$schema": "https://biomejs.dev/schemas/2.5.14/schema.json",
+  "$schema": "https://biomejs.dev/schemas/2.5.15/schema.json",
   "root": true,
   "formatter": {
     "enabled": true,
@@ -2325,19 +2325,19 @@ exports[`react-website generator > Tanstack router integration > should generate
   - test-app
   - packages/common/*
 catalog:
-  '@types/node': 26.6.3
-  vite: 8.3.1
+  '@types/node': 26.6.4
+  vite: 8.3.2
   vitest: 4.1.11
   '@vitest/coverage-v8': 4.1.11
   jsdom: 29.1.1
   '@nx/vitest': 23.2.1
   constructs: 10.8.1
-  aws-cdk-lib: 2.271.0
+  aws-cdk-lib: 2.272.0
   react: 19.3.0
   react-dom: 19.3.0
-  '@cloudscape-design/components': 3.0.1387
-  '@cloudscape-design/board-components': 3.0.234
-  '@cloudscape-design/global-styles': 1.0.70
+  '@cloudscape-design/components': 3.0.1391
+  '@cloudscape-design/board-components': 3.0.236
+  '@cloudscape-design/global-styles': 1.0.71
   tailwindcss: 4.3.3
   '@nx/react': 23.2.1
   '@vitest/ui': 4.1.11
@@ -2936,7 +2936,7 @@ runtime-config.json"
 
 exports[`react-website generator > Tanstack router integration > should generate website with router correctly > biome.json 1`] = `
 "{
-  "$schema": "https://biomejs.dev/schemas/2.5.14/schema.json",
+  "$schema": "https://biomejs.dev/schemas/2.5.15/schema.json",
   "root": true,
   "formatter": {
     "enabled": true,
@@ -4205,26 +4205,26 @@ exports[`react-website generator > Tanstack router integration > should generate
   - test-app
   - packages/common/*
 catalog:
-  '@types/node': 26.6.3
-  vite: 8.3.1
+  '@types/node': 26.6.4
+  vite: 8.3.2
   vitest: 4.1.11
   '@vitest/coverage-v8': 4.1.11
   jsdom: 29.1.1
   '@nx/vitest': 23.2.1
   constructs: 10.8.1
-  aws-cdk-lib: 2.271.0
+  aws-cdk-lib: 2.272.0
   react: 19.3.0
   react-dom: 19.3.0
-  '@cloudscape-design/components': 3.0.1387
-  '@cloudscape-design/board-components': 3.0.234
-  '@cloudscape-design/global-styles': 1.0.70
+  '@cloudscape-design/components': 3.0.1391
+  '@cloudscape-design/board-components': 3.0.236
+  '@cloudscape-design/global-styles': 1.0.71
   tailwindcss: 4.3.3
-  '@tanstack/react-router': 1.170.39
+  '@tanstack/react-router': 1.170.41
   '@nx/react': 23.2.1
   '@vitest/ui': 4.1.11
   '@tailwindcss/vite': 4.3.3
-  '@tanstack/router-plugin': 1.168.40
-  '@tanstack/router-generator': 1.167.38
+  '@tanstack/router-plugin': 1.168.42
+  '@tanstack/router-generator': 1.167.40
   '@tanstack/virtual-file-routes': 1.162.0
   '@tanstack/router-utils': 1.162.3
 "

package/src/ts/react-website/cognito-auth/__snapshots__/generator.terraform.spec.ts.snap

@@ -6,7 +6,7 @@ exports[`cognito-auth generator terraform iac > should generate terraform files
   required_providers {
     aws = {
       source  = "hashicorp/aws"
-      version = "6.66.0"
+      version = "6.67.0"
     }
     null = {
       source  = "hashicorp/null"
@@ -67,7 +67,7 @@ resource "null_resource" "add_callback_url" {
 
   provisioner "local-exec" {
     command = <<-EOT
-      uv run --with boto3==1.43.103 python -c "
+      uv run --with boto3==1.43.108 python -c "
 import boto3
 import os
 import sys

package/src/utils/api-constructs/files/cdk/core/api/http/http-api.ts.template

@@ -7,10 +7,12 @@ import {
 } from './utils<% if (esm) { %>.js<% } %>';
 import { CfnOutput, Stack } from 'aws-cdk-lib';
 import {
+  DomainMappingOptions,
   HttpApi as _HttpApi,
   HttpApiProps as _HttpApiProps,
   HttpMethod,
   HttpStage,
+  IDomainName,
   LogGroupLogDestination,
   ThrottleSettings,
 } from 'aws-cdk-lib/aws-apigatewayv2';
@@ -28,7 +30,7 @@ import { suppressRules } from '../checkov<% if (esm) { %>.js<% } %>';
 export interface HttpApiProps<
   TIntegrations extends ApiIntegrations<TOperation, HttpApiIntegration>,
   TOperation extends string,
-> extends _HttpApiProps {
+> extends Omit<_HttpApiProps, 'defaultDomainMapping'> {
   /**
    * Unique name for the API, used in runtime configuration
    */
@@ -47,6 +49,12 @@ export interface HttpApiProps<
    * @default { rateLimit: 10000, burstLimit: 5000 }
    */
   readonly throttle?: ThrottleSettings;
+  /**
+   * Custom domain mapped to the API's default stage
+   */
+  readonly defaultDomainMapping?: DomainMappingOptions & {
+    readonly domainName: IDomainName;
+  };
 }
 
 /**
@@ -70,6 +78,9 @@ export class HttpApi<
   /** Default auto-deployed stage */
   public readonly defaultStage: HttpStage;
 
+  /** The URL clients call: the custom domain's if one is mapped, otherwise the stage's */
+  private readonly apiUrl: string;
+
   /** Map of operation names to their API Gateway integrations */
   public readonly integrations: TIntegrations;
 
@@ -81,6 +92,7 @@ export class HttpApi<
       operations,
       integrations,
       throttle = { rateLimit: 10000, burstLimit: 5000 },
+      defaultDomainMapping,
       ...props
     }: HttpApiProps<TIntegrations, TOperation>,
   ) {
@@ -113,12 +125,16 @@ export class HttpApi<
 
     this.defaultStage = new HttpStage(this, 'DefaultStage', {
       httpApi: this.api,
+      domainMapping: defaultDomainMapping,
       autoDeploy: true,
       throttle,
       accessLogSettings: {
         destination: new LogGroupLogDestination(accessLogGroup),
       },
     });
+    this.apiUrl = defaultDomainMapping
+      ? this.defaultStage.domainUrl
+      : this.defaultStage.url!;
 
     // Resolve the integration for a given operation.
     // If the operation has a dedicated integration, use it; otherwise fall back to $router.
@@ -151,21 +167,35 @@ export class HttpApi<
     );
 
     new CfnOutput(this, `${apiName}Url`, {
-      value: this.defaultStage.url!,
+      value: this.apiUrl,
     });
 
     // Register the API URL in runtime configuration for client discovery
     const rc = RuntimeConfig.ensure(this);
     rc.set('connection', 'apis', {
       ...rc.get('connection').apis,
-      [apiName]: this.defaultStage.url!,
+      [apiName]: this.apiUrl,
     });
+
+    // Target for the custom domain's DNS record
+    if (defaultDomainMapping) {
+      new CfnOutput(this, `${apiName}DomainNameAlias`, {
+        value: defaultDomainMapping.domainName.regionalDomainName,
+        description:
+          'Regional domain name to point a CNAME record at for the custom domain, with any DNS provider',
+      });
+      new CfnOutput(this, `${apiName}DomainNameAliasHostedZoneId`, {
+        value: defaultDomainMapping.domainName.regionalHostedZoneId,
+        description:
+          'Hosted zone ID of the regional domain name, needed only for a Route 53 alias record',
+      });
+    }
   }
 
   /**
    * Return the API url
    */
   public get url() {
-    return this.defaultStage.url;
+    return this.apiUrl;
   }
 }

package/src/utils/api-constructs/files/cdk/core/api/rest/rest-api.ts.template

@@ -10,7 +10,7 @@ import {
   Stage,
   ThrottleSettings,
 } from 'aws-cdk-lib/aws-apigateway';
-import { IAspect, RemovalPolicy, Stack } from 'aws-cdk-lib';
+import { CfnOutput, IAspect, RemovalPolicy, Stack } from 'aws-cdk-lib';
 import {
   CfnLoggingConfiguration,
   CfnWebACL,
@@ -99,6 +99,7 @@ export class RestApi<
       integrations,
       enableWaf = true,
       throttle = { rateLimit: 10000, burstLimit: 5000 },
+      domainName,
       ...props
     }: RestApiProps<TIntegrations, TOperation>,
   ) {
@@ -124,6 +125,7 @@ export class RestApi<
     // Create the API Gateway REST API
     this.api = new _RestApi(this, 'Api', {
       ...props,
+      domainName,
       deployOptions: {
         accessLogDestination: new LogGroupLogDestination(accessLogs),
         accessLogFormat: AccessLogFormat.jsonWithStandardFields(),
@@ -265,8 +267,24 @@ export class RestApi<
     const rc = RuntimeConfig.ensure(this);
     rc.set('connection', 'apis', {
       ...rc.get('connection').apis,
-      [apiName]: this.api.url!,
+      [apiName]: domainName
+        ? `https://${domainName.domainName}/${domainName.basePath ? `${domainName.basePath}/` : ''}`
+        : this.api.url!,
     });
+
+    // Target for the custom domain's DNS record
+    if (domainName) {
+      new CfnOutput(this, `${apiName}DomainNameAlias`, {
+        value: this.api.domainName!.domainNameAliasDomainName,
+        description:
+          'Domain name of the API Gateway endpoint (regional or edge) to point a CNAME record at for the custom domain, with any DNS provider',
+      });
+      new CfnOutput(this, `${apiName}DomainNameAliasHostedZoneId`, {
+        value: this.api.domainName!.domainNameAliasHostedZoneId,
+        description:
+          'Hosted zone ID of that domain name, needed only for a Route 53 alias record',
+      });
+    }
   }
 
   /**

package/src/utils/api-constructs/files/terraform/app/apis/http/__apiNameKebabCase__/__apiNameKebabCase__.tf.template

@@ -125,6 +125,19 @@ variable "tags" {
   default     = {}
 }
 
+# Custom domain configuration
+variable "custom_domain_name" {
+  description = "Custom domain name for the API. Requires acm_certificate_arn."
+  type        = string
+  default     = null
+}
+
+variable "acm_certificate_arn" {
+  description = "ARN of an ACM certificate (in the API's region) for the custom domain name."
+  type        = string
+  default     = null
+}
+
 # Get current AWS region and account ID
 data "aws_region" "current" {}
 data "aws_caller_identity" "current" {}
@@ -431,6 +444,10 @@ locals {
 <%_ } _%>
 }
 
+locals {
+  api_url = var.custom_domain_name == null ? module.http_api.stage_invoke_url : "https://${var.custom_domain_name}/"
+}
+
 # CloudWatch Log Group for Lambda
 resource "aws_cloudwatch_log_group" "lambda_logs" {
   #checkov:skip=CKV_AWS_158:Using default CloudWatch log encryption
@@ -674,11 +691,41 @@ module "add_url_to_runtime_config" {
 
   namespace = "connection"
   key       = "apis"
-  value     = { "<%- apiNameClassName %>" = module.http_api.stage_invoke_url }
+  value     = { "<%- apiNameClassName %>" = local.api_url }
 
   depends_on = [module.http_api]
 }
 
+# Custom domain for the API
+resource "aws_apigatewayv2_domain_name" "custom_domain" {
+  count = var.custom_domain_name == null ? 0 : 1
+
+  domain_name = var.custom_domain_name
+
+  domain_name_configuration {
+    certificate_arn = var.acm_certificate_arn
+    endpoint_type   = "REGIONAL"
+    security_policy = "TLS_1_2"
+  }
+
+  tags = var.tags
+
+  lifecycle {
+    precondition {
+      condition     = var.acm_certificate_arn != null
+      error_message = "acm_certificate_arn is required when custom_domain_name is set."
+    }
+  }
+}
+
+resource "aws_apigatewayv2_api_mapping" "custom_domain" {
+  count = var.custom_domain_name == null ? 0 : 1
+
+  api_id      = module.http_api.api_id
+  stage       = module.http_api.stage_id
+  domain_name = aws_apigatewayv2_domain_name.custom_domain[0].domain_name
+}
+
 # Lambda permission for API Gateway to invoke the function<% if (backend.type === 'fastapi') { %> via alias<% } %>
 resource "aws_lambda_permission" "api_gateway_invoke" {
   <%_ if (backend.integrationPattern === 'isolated') { _%>
@@ -738,6 +785,21 @@ output "stage_invoke_url" {
   value       = module.http_api.stage_invoke_url
 }
 
+output "api_url" {
+  description = "URL clients should call: the custom domain if configured, otherwise the stage invoke URL"
+  value       = local.api_url
+}
+
+output "custom_domain_target_domain_name" {
+  description = "Target domain name to point a DNS alias or CNAME record at for the custom domain"
+  value       = var.custom_domain_name == null ? null : aws_apigatewayv2_domain_name.custom_domain[0].domain_name_configuration[0].target_domain_name
+}
+
+output "custom_domain_hosted_zone_id" {
+  description = "Hosted zone ID to use for a Route 53 alias record for the custom domain"
+  value       = var.custom_domain_name == null ? null : aws_apigatewayv2_domain_name.custom_domain[0].domain_name_configuration[0].hosted_zone_id
+}
+
 output "stage_arn" {
   description = "ARN of the API Gateway stage"
   value       = module.http_api.stage_arn

package/src/utils/api-constructs/files/terraform/app/apis/rest/__apiNameKebabCase__/__apiNameKebabCase__.tf.template

@@ -121,6 +121,19 @@ variable "tags" {
   default     = {}
 }
 
+# Custom domain configuration
+variable "custom_domain_name" {
+  description = "Custom domain name for the API. Requires acm_certificate_arn."
+  type        = string
+  default     = null
+}
+
+variable "acm_certificate_arn" {
+  description = "ARN of an ACM certificate (in the API's region) for the custom domain name."
+  type        = string
+  default     = null
+}
+
 # Get current AWS region and account ID
 data "aws_region" "current" {}
 data "aws_caller_identity" "current" {}
@@ -485,6 +498,10 @@ locals {
 <%_ } _%>
 }
 
+locals {
+  api_url = var.custom_domain_name == null ? "${aws_api_gateway_stage.api_stage.invoke_url}/" : "https://${var.custom_domain_name}/"
+}
+
 # CloudWatch Log Group for Lambda
 resource "aws_cloudwatch_log_group" "lambda_logs" {
   #checkov:skip=CKV_AWS_158:Using default CloudWatch log encryption
@@ -1139,11 +1156,41 @@ module "add_url_to_runtime_config" {
 
   namespace = "connection"
   key       = "apis"
-  value     = { "<%- apiNameClassName %>" = "${aws_api_gateway_stage.api_stage.invoke_url}/" }
+  value     = { "<%- apiNameClassName %>" = local.api_url }
 
   depends_on = [aws_api_gateway_stage.api_stage]
 }
 
+# Custom domain for the API, served without the stage path prefix
+resource "aws_api_gateway_domain_name" "custom_domain" {
+  count = var.custom_domain_name == null ? 0 : 1
+
+  domain_name              = var.custom_domain_name
+  regional_certificate_arn = var.acm_certificate_arn
+  security_policy          = "TLS_1_2"
+
+  endpoint_configuration {
+    types = ["REGIONAL"]
+  }
+
+  tags = var.tags
+
+  lifecycle {
+    precondition {
+      condition     = var.acm_certificate_arn != null
+      error_message = "acm_certificate_arn is required when custom_domain_name is set."
+    }
+  }
+}
+
+resource "aws_api_gateway_base_path_mapping" "custom_domain" {
+  count = var.custom_domain_name == null ? 0 : 1
+
+  api_id      = module.rest_api.api_id
+  stage_name  = aws_api_gateway_stage.api_stage.stage_name
+  domain_name = aws_api_gateway_domain_name.custom_domain[0].domain_name
+}
+
 # Outputs
 
 # API Gateway Outputs (from core module)
@@ -1172,6 +1219,21 @@ output "stage_invoke_url" {
   value       = aws_api_gateway_stage.api_stage.invoke_url
 }
 
+output "api_url" {
+  description = "URL clients should call: the custom domain if configured, otherwise the stage invoke URL"
+  value       = local.api_url
+}
+
+output "custom_domain_target_domain_name" {
+  description = "Target domain name to point a DNS alias or CNAME record at for the custom domain"
+  value       = var.custom_domain_name == null ? null : aws_api_gateway_domain_name.custom_domain[0].regional_domain_name
+}
+
+output "custom_domain_hosted_zone_id" {
+  description = "Hosted zone ID to use for a Route 53 alias record for the custom domain"
+  value       = var.custom_domain_name == null ? null : aws_api_gateway_domain_name.custom_domain[0].regional_zone_id
+}
+
 output "stage_arn" {
   description = "ARN of the API Gateway stage"
   value       = aws_api_gateway_stage.api_stage.arn

package/src/utils/docker.d.ts

@@ -25,7 +25,7 @@ export declare const IMAGE_BUILD_CACHE = false;
  * version to install globally, and the versions its dependency overrides pin.
  */
 export declare const nodeImageVersions: () => {
-    npmVersion: "12.1.0";
+    npmVersion: "12.2.0";
     minimatchVersion: "10.2.6";
 };
 /**