@aws/nx-plugin 1.0.5 → 1.0.7

package/src/migrations/v1.0.5/0001-api-custom-domain-runtime-config/migration.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../../../../../../../packages/nx-plugin/src/migrations/v1.0.5/0001-api-custom-domain-runtime-config/migration.ts"],"sourcesContent":["/**\n * Copyright Amazon.com, Inc. or its affiliates. All Rights Reserved.\n * SPDX-License-Identifier: Apache-2.0\n */\nimport {\n  joinPathFragments,\n  type MigrationReturnObject,\n  type Tree,\n} from '@nx/devkit';\nimport {\n  addDestructuredImport,\n  applyGritQL,\n  GRIT_INSERT_PLACEHOLDER,\n  insertViaGritQL,\n  matchGritQL,\n} from '../../../utils/ast.js';\nimport { formatFilesInSubtree } from '../../../utils/format.js';\nimport {\n  PACKAGES_DIR,\n  SHARED_CONSTRUCTS_DIR,\n  SHARED_TERRAFORM_DIR,\n} from '../../../utils/shared-constructs-constants.js';\n\n/**\n * Publish an API's custom domain, when one is configured, as its URL in runtime\n * config, so clients call it rather than the generated execute-api endpoint.\n *\n * - The vended CDK `RestApi` publishes `https://<domainName>/[<basePath>/]` when\n *   `domainName` is set.\n * - The vended CDK `HttpApi` forwards `defaultDomainMapping` to the stage it\n *   creates (previously rejected by CDK, since the construct disables the\n *   default stage) and publishes the mapping's domain URL.\n * - Each vended Terraform API app module (`app/apis/<name>/<name>.tf`) gains\n *   `custom_domain_name` / `acm_certificate_arn` variables, the domain and\n *   mapping resources, an `api_url` local published in runtime config, and\n *   outputs for the URL and DNS record targets.\n *\n * These files are generated with `KeepExisting`, so an upgraded workspace keeps\n * the old shape until this runs. Diverged files are left untouched and\n * reported via `nextSteps`.\n */\n\nconst CONSTRUCTS_API_DIR = `${PACKAGES_DIR}/${SHARED_CONSTRUCTS_DIR}/src/core/api`;\nconst REST_API_CONSTRUCT = `${CONSTRUCTS_API_DIR}/rest-api.ts`;\nconst HTTP_API_CONSTRUCT = `${CONSTRUCTS_API_DIR}/http-api.ts`;\nconst TERRAFORM_APIS_DIR = `${PACKAGES_DIR}/${SHARED_TERRAFORM_DIR}/src/app/apis`;\n\nconst hcl = (pattern: string) => `language hcl\\n${pattern}`;\n\n/** Whether the pattern matches any `.tf` file in the Terraform module directory. */\nconst matchesInModule = async (\n  tree: Tree,\n  moduleDir: string,\n  pattern: string,\n) => {\n  for (const child of tree.children(moduleDir)) {\n    const path = joinPathFragments(moduleDir, child);\n    if (\n      child.endsWith('.tf') &&\n      tree.isFile(path) &&\n      (await matchGritQL(tree, path, pattern))\n    ) {\n      return true;\n    }\n  }\n  return false;\n};\n\n/** Whether every pattern matches the file. */\nconst matchesAll = async (tree: Tree, file: string, patterns: string[]) => {\n  for (const pattern of patterns) {\n    if (!(await matchGritQL(tree, file, pattern))) {\n      return false;\n    }\n  }\n  return true;\n};\n\nconst REST_RUNTIME_CONFIG_URL = `domainName\n        ? \\`https://\\${domainName.domainName}/\\${domainName.basePath ? \\`\\${domainName.basePath}/\\` : ''}\\`\n        : this.api.url!`;\n\nconst REST_DOMAIN_OUTPUTS = `// Target for the custom domain's DNS record\n    if (domainName) {\n      new CfnOutput(this, \\`\\${apiName}DomainNameAlias\\`, {\n        value: this.api.domainName!.domainNameAliasDomainName,\n        description:\n          'Domain name of the API Gateway endpoint (regional or edge) to point a CNAME record at for the custom domain, with any DNS provider',\n      });\n      new CfnOutput(this, \\`\\${apiName}DomainNameAliasHostedZoneId\\`, {\n        value: this.api.domainName!.domainNameAliasHostedZoneId,\n        description:\n          'Hosted zone ID of that domain name, needed only for a Route 53 alias record',\n      });\n    }`;\n\nconst HTTP_DOMAIN_OUTPUTS = `// Target for the custom domain's DNS record\n    if (defaultDomainMapping) {\n      new CfnOutput(this, \\`\\${apiName}DomainNameAlias\\`, {\n        value: defaultDomainMapping.domainName.regionalDomainName,\n        description:\n          'Regional domain name to point a CNAME record at for the custom domain, with any DNS provider',\n      });\n      new CfnOutput(this, \\`\\${apiName}DomainNameAliasHostedZoneId\\`, {\n        value: defaultDomainMapping.domainName.regionalHostedZoneId,\n        description:\n          'Hosted zone ID of the regional domain name, needed only for a Route 53 alias record',\n      });\n    }`;\n\nconst HTTP_DOMAIN_MAPPING_PROP = `/**\n   * Custom domain mapped to the API's default stage\n   */\n  readonly defaultDomainMapping?: DomainMappingOptions & {\n    readonly domainName: IDomainName;\n  }`;\n\n/** Matches a DNS record output this migration adds. */\nconst DOMAIN_ALIAS_OUTPUT =\n  '`new CfnOutput(this, $id, $_)` where { $id <: r\".*DomainNameAlias.*\" }';\n\n/** Rewrite inserting {@link GRIT_INSERT_PLACEHOLDER} after the runtime config registration. */\nconst AFTER_RUNTIME_CONFIG = `\\`$call;\\` as $statement where {\n  $call <: \\`rc.set('connection', 'apis', $_)\\`,\n  $statement => \\`$call;\\n\\n    ${GRIT_INSERT_PLACEHOLDER}\\`\n}`;\n\nconst migrateRestApiConstruct = async (tree: Tree, nextSteps: string[]) => {\n  const file = REST_API_CONSTRUCT;\n  if (!tree.exists(file)) {\n    return;\n  }\n\n  if (await matchGritQL(tree, file, '`[apiName]: domainName ? $_ : $_`')) {\n    return; // Already migrated.\n  }\n\n  const shape = [\n    '`{ $params }: RestApiProps<$_, $_>` where { $params <: contains `...props`, $params <: not contains `domainName` }',\n    \"`new _RestApi(this, 'Api', { $props })` where { $props <: contains `...props`, $props <: not contains `domainName` }\",\n    \"`rc.set('connection', 'apis', { $entries })` where { $entries <: contains `[apiName]: this.api.url!` }\",\n  ];\n  if (\n    !(await matchesAll(tree, file, shape)) ||\n    (await matchGritQL(tree, file, DOMAIN_ALIAS_OUTPUT))\n  ) {\n    nextSteps.push(\n      `${file}: has diverged from the generated shape - left untouched. To publish a configured custom domain to clients, destructure \\`domainName\\` from the constructor props and pass it to the CDK RestApi, register \\`https://\\${domainName.domainName}/\\` (plus any \\`basePath\\`) under \\`[apiName]\\` in the \\`rc.set('connection', 'apis', ...)\\` call when it is set instead of \\`this.api.url\\`, and output \\`this.api.domainName.domainNameAliasDomainName\\` / \\`domainNameAliasHostedZoneId\\` for the DNS record.`,\n    );\n    return;\n  }\n\n  // Taken out of `props` and passed explicitly, so it is in scope below.\n  await applyGritQL(\n    tree,\n    file,\n    '`{ $params }: RestApiProps<$_, $_>` where { $params <: contains `...props` as $rest, $rest => `domainName,\\n      ...props` }',\n  );\n  await applyGritQL(\n    tree,\n    file,\n    \"`new _RestApi(this, 'Api', { $props })` where { $props <: contains `...props` as $spread, $spread => `...props,\\n      domainName` }\",\n  );\n  await insertViaGritQL(\n    tree,\n    file,\n    \"`rc.set('connection', 'apis', { $entries })` where { $entries <: contains `[apiName]: this.api.url!` as $url, $url => `[apiName]: __GRIT_INSERT_PLACEHOLDER__` }\",\n    REST_RUNTIME_CONFIG_URL,\n  );\n  await insertViaGritQL(tree, file, AFTER_RUNTIME_CONFIG, REST_DOMAIN_OUTPUTS);\n  // Listed first, as the generator vends it.\n  const imported = await applyGritQL(\n    tree,\n    file,\n    \"`import { $names } from 'aws-cdk-lib'` where { $names <: not contains `CfnOutput` } => `import { CfnOutput, $names } from 'aws-cdk-lib'`\",\n  );\n  if (!imported) {\n    await addDestructuredImport(tree, file, ['CfnOutput'], 'aws-cdk-lib');\n  }\n};\n\nconst HTTP_API_URL_FIELD = `/** The URL clients call: the custom domain's if one is mapped, otherwise the stage's */\n  private readonly apiUrl: string`;\n\nconst HTTP_API_URL_ASSIGNMENT = `this.apiUrl = defaultDomainMapping\n      ? this.defaultStage.domainUrl\n      : this.defaultStage.url!;`;\n\n/** Matches the vended `url` getter, returning the stage URL. */\nconst HTTP_URL_GETTER =\n  'method_definition(name=$name, body=$body) where { $name <: `url`, $body <: contains `return this.defaultStage.url` }';\n\nconst migrateHttpApiConstruct = async (tree: Tree, nextSteps: string[]) => {\n  const file = HTTP_API_CONSTRUCT;\n  if (!tree.exists(file)) {\n    return;\n  }\n\n  if (await matchGritQL(tree, file, '`[apiName]: this.apiUrl`')) {\n    return; // Already migrated.\n  }\n\n  const shape = [\n    'interface_declaration(name=$name, body=$body) as $interface where { $name <: `HttpApiProps`, $interface <: contains extends_type_clause() as $extends, $extends <: contains `_HttpApiProps`, $extends <: not contains `Omit`, $body <: contains `readonly throttle?: ThrottleSettings`, $body <: not contains `defaultDomainMapping` }',\n    \"`import { $names } from 'aws-cdk-lib/aws-apigatewayv2'` where { $names <: contains `HttpApi as _HttpApi`, $names <: contains `HttpStage`, $names <: not contains `DomainMappingOptions`, $names <: not contains `IDomainName` }\",\n    '`public readonly defaultStage: HttpStage`',\n    '`{ $params }: HttpApiProps<$_, $_>` where { $params <: contains `...props`, $params <: not contains `defaultDomainMapping` }',\n    \"`this.defaultStage = new HttpStage(this, 'DefaultStage', { $props })` where { $props <: contains `httpApi: this.api`, $props <: not contains `domainMapping` }\",\n    '`new CfnOutput(this, $_, { $props })` where { $props <: contains `value: this.defaultStage.url!` }',\n    \"`rc.set('connection', 'apis', { $entries })` where { $entries <: contains `[apiName]: this.defaultStage.url!` }\",\n    HTTP_URL_GETTER,\n  ];\n  if (\n    !(await matchesAll(tree, file, shape)) ||\n    (await matchGritQL(tree, file, DOMAIN_ALIAS_OUTPUT)) ||\n    (await matchGritQL(tree, file, '`this.apiUrl`'))\n  ) {\n    nextSteps.push(\n      `${file}: has diverged from the generated shape - left untouched. To support a custom domain, destructure \\`defaultDomainMapping\\` from the constructor props (so it is not passed to the CDK HttpApi, which rejects it when the default stage is disabled) and pass it as \\`domainMapping\\` to the \\`DefaultStage\\` HttpStage; use \\`this.defaultStage.domainUrl\\` instead of \\`this.defaultStage.url\\` when it is set, for the \\`<apiName>Url\\` output, runtime config and the \\`url\\` getter; and output \\`defaultDomainMapping.domainName.regionalDomainName\\` / \\`regionalHostedZoneId\\` for the DNS record.`,\n    );\n    return;\n  }\n\n  // Typed as a domain exposing its regional attributes, for the DNS outputs.\n  await insertViaGritQL(\n    tree,\n    file,\n    'interface_declaration(name=$name, body=$body) where { $name <: `HttpApiProps`, $body <: contains `readonly throttle?: ThrottleSettings` as $throttle, $throttle => `readonly throttle?: ThrottleSettings;\\n  __GRIT_INSERT_PLACEHOLDER__` }',\n    HTTP_DOMAIN_MAPPING_PROP,\n  );\n  // Only the `_HttpApiProps` base is replaced, keeping any others.\n  await applyGritQL(\n    tree,\n    file,\n    \"interface_declaration(name=$name) as $interface where { $name <: `HttpApiProps`, $interface <: contains extends_type_clause() as $extends, $extends <: contains `_HttpApiProps` as $base, $base => `Omit<_HttpApiProps, 'defaultDomainMapping'>` }\",\n  );\n  // Inserted in sorted position, as the generator vends them.\n  await applyGritQL(\n    tree,\n    file,\n    \"`import { $names } from 'aws-cdk-lib/aws-apigatewayv2'` where { $names <: contains `HttpApi as _HttpApi` as $httpApi, $httpApi => `DomainMappingOptions,\\n  HttpApi as _HttpApi` }\",\n  );\n  await applyGritQL(\n    tree,\n    file,\n    \"`import { $names } from 'aws-cdk-lib/aws-apigatewayv2'` where { $names <: contains `HttpStage` as $stage, $stage => `HttpStage,\\n  IDomainName` }\",\n  );\n  await insertViaGritQL(\n    tree,\n    file,\n    '`public readonly defaultStage: HttpStage` as $field => `public readonly defaultStage: HttpStage;\\n\\n  __GRIT_INSERT_PLACEHOLDER__`',\n    HTTP_API_URL_FIELD,\n  );\n  // Taken out of `props` so it isn't passed to the CDK HttpApi.\n  await applyGritQL(\n    tree,\n    file,\n    '`{ $params }: HttpApiProps<$_, $_>` where { $params <: contains `...props` as $rest, $rest => `defaultDomainMapping,\\n      ...props` }',\n  );\n  await applyGritQL(\n    tree,\n    file,\n    \"`new HttpStage(this, 'DefaultStage', { $props })` where { $props <: contains `httpApi: this.api` as $httpApi, $httpApi => `httpApi: this.api,\\n      domainMapping: defaultDomainMapping` }\",\n  );\n  // Computed once, for the stack output, runtime config and the `url` getter.\n  await insertViaGritQL(\n    tree,\n    file,\n    `expression_statement() as $statement where {\n  $statement <: contains \\`this.defaultStage = new HttpStage($_, $_, $_)\\` as $assignment,\n  $statement => \\`$assignment;\\n    ${GRIT_INSERT_PLACEHOLDER}\\`\n}`,\n    HTTP_API_URL_ASSIGNMENT,\n  );\n  await applyGritQL(\n    tree,\n    file,\n    '`new CfnOutput(this, $_, { $props })` where { $props <: contains `value: this.defaultStage.url!` as $value, $value => `value: this.apiUrl` }',\n  );\n  await applyGritQL(\n    tree,\n    file,\n    \"`rc.set('connection', 'apis', { $entries })` where { $entries <: contains `[apiName]: this.defaultStage.url!` as $url, $url => `[apiName]: this.apiUrl` }\",\n  );\n  await applyGritQL(\n    tree,\n    file,\n    'method_definition(name=$name, body=$body) where { $name <: `url`, $body <: contains `return this.defaultStage.url` as $return, $return => `return this.apiUrl` }',\n  );\n  await insertViaGritQL(tree, file, AFTER_RUNTIME_CONFIG, HTTP_DOMAIN_OUTPUTS);\n};\n\nconst TERRAFORM_VARIABLES = `# Custom domain configuration\nvariable \"custom_domain_name\" {\n  description = \"Custom domain name for the API. Requires acm_certificate_arn.\"\n  type        = string\n  default     = null\n}\n\nvariable \"acm_certificate_arn\" {\n  description = \"ARN of an ACM certificate (in the API's region) for the custom domain name.\"\n  type        = string\n  default     = null\n}`;\n\n/** The differences between the REST and HTTP Terraform app modules. */\ninterface TerraformApi {\n  kind: 'REST' | 'HTTP';\n  /** A block only this kind of app module declares. */\n  identifyingBlock: string;\n  /** Matches exactly the runtime config `value` the app module was generated with. */\n  runtimeConfigUrl: string;\n  /** Types of the custom domain and mapping resources this migration adds. */\n  domainResourceTypes: [string, string];\n  domainResources: string;\n  /** The `api_url` local, published in runtime config. */\n  apiUrlLocal: string;\n  outputs: string;\n}\n\nconst REST_TERRAFORM: TerraformApi = {\n  kind: 'REST',\n  identifyingBlock: '`resource \"aws_api_gateway_stage\" \"api_stage\" { $_ }`',\n  runtimeConfigUrl:\n    '$v <: r\"\\\\\"\\\\$\\\\{aws_api_gateway_stage\\\\.api_stage\\\\.invoke_url\\\\}/\\\\\"\"',\n  domainResourceTypes: [\n    'aws_api_gateway_domain_name',\n    'aws_api_gateway_base_path_mapping',\n  ],\n  domainResources: `# Custom domain for the API, served without the stage path prefix\nresource \"aws_api_gateway_domain_name\" \"custom_domain\" {\n  count = var.custom_domain_name == null ? 0 : 1\n\n  domain_name              = var.custom_domain_name\n  regional_certificate_arn = var.acm_certificate_arn\n  security_policy          = \"TLS_1_2\"\n\n  endpoint_configuration {\n    types = [\"REGIONAL\"]\n  }\n\n  tags = var.tags\n\n  lifecycle {\n    precondition {\n      condition     = var.acm_certificate_arn != null\n      error_message = \"acm_certificate_arn is required when custom_domain_name is set.\"\n    }\n  }\n}\n\nresource \"aws_api_gateway_base_path_mapping\" \"custom_domain\" {\n  count = var.custom_domain_name == null ? 0 : 1\n\n  api_id      = module.rest_api.api_id\n  stage_name  = aws_api_gateway_stage.api_stage.stage_name\n  domain_name = aws_api_gateway_domain_name.custom_domain[0].domain_name\n}`,\n  apiUrlLocal: `locals {\n  api_url = var.custom_domain_name == null ? \"\\${aws_api_gateway_stage.api_stage.invoke_url}/\" : \"https://\\${var.custom_domain_name}/\"\n}`,\n  outputs: `output \"api_url\" {\n  description = \"URL clients should call: the custom domain if configured, otherwise the stage invoke URL\"\n  value       = local.api_url\n}\n\noutput \"custom_domain_target_domain_name\" {\n  description = \"Target domain name to point a DNS alias or CNAME record at for the custom domain\"\n  value       = var.custom_domain_name == null ? null : aws_api_gateway_domain_name.custom_domain[0].regional_domain_name\n}\n\noutput \"custom_domain_hosted_zone_id\" {\n  description = \"Hosted zone ID to use for a Route 53 alias record for the custom domain\"\n  value       = var.custom_domain_name == null ? null : aws_api_gateway_domain_name.custom_domain[0].regional_zone_id\n}`,\n};\n\nconst HTTP_TERRAFORM: TerraformApi = {\n  kind: 'HTTP',\n  identifyingBlock: '`module \"http_api\" { $_ }`',\n  runtimeConfigUrl: '$v <: `module.http_api.stage_invoke_url`',\n  domainResourceTypes: [\n    'aws_apigatewayv2_domain_name',\n    'aws_apigatewayv2_api_mapping',\n  ],\n  domainResources: `# Custom domain for the API\nresource \"aws_apigatewayv2_domain_name\" \"custom_domain\" {\n  count = var.custom_domain_name == null ? 0 : 1\n\n  domain_name = var.custom_domain_name\n\n  domain_name_configuration {\n    certificate_arn = var.acm_certificate_arn\n    endpoint_type   = \"REGIONAL\"\n    security_policy = \"TLS_1_2\"\n  }\n\n  tags = var.tags\n\n  lifecycle {\n    precondition {\n      condition     = var.acm_certificate_arn != null\n      error_message = \"acm_certificate_arn is required when custom_domain_name is set.\"\n    }\n  }\n}\n\nresource \"aws_apigatewayv2_api_mapping\" \"custom_domain\" {\n  count = var.custom_domain_name == null ? 0 : 1\n\n  api_id      = module.http_api.api_id\n  stage       = module.http_api.stage_id\n  domain_name = aws_apigatewayv2_domain_name.custom_domain[0].domain_name\n}`,\n  apiUrlLocal: `locals {\n  api_url = var.custom_domain_name == null ? module.http_api.stage_invoke_url : \"https://\\${var.custom_domain_name}/\"\n}`,\n  outputs: `output \"api_url\" {\n  description = \"URL clients should call: the custom domain if configured, otherwise the stage invoke URL\"\n  value       = local.api_url\n}\n\noutput \"custom_domain_target_domain_name\" {\n  description = \"Target domain name to point a DNS alias or CNAME record at for the custom domain\"\n  value       = var.custom_domain_name == null ? null : aws_apigatewayv2_domain_name.custom_domain[0].domain_name_configuration[0].target_domain_name\n}\n\noutput \"custom_domain_hosted_zone_id\" {\n  description = \"Hosted zone ID to use for a Route 53 alias record for the custom domain\"\n  value       = var.custom_domain_name == null ? null : aws_apigatewayv2_domain_name.custom_domain[0].domain_name_configuration[0].hosted_zone_id\n}`,\n};\n\nconst RUNTIME_CONFIG_MODULE = '`module \"add_url_to_runtime_config\" { $body }`';\n\n/** The `locals` block every vended API app module declares its IAM policy statements in. */\nconst POLICY_LOCALS =\n  '`locals { $body }` where { $body <: contains `lambda_policy_statements = $_` }';\n\n/** Rewrite matching the block's text back unchanged, then the placeholder after it. */\nconst appendAfterBlock = (header: string) =>\n  hcl(\n    `\\`${header} { $body }\\` => \\`${header} {\\n  $body\\n}\\n\\n${GRIT_INSERT_PLACEHOLDER}\\``,\n  );\n\nconst migrateTerraformApi = async (\n  tree: Tree,\n  moduleDir: string,\n  file: string,\n  nextSteps: string[],\n) => {\n  const api = (await matchGritQL(\n    tree,\n    file,\n    hcl(REST_TERRAFORM.identifyingBlock),\n  ))\n    ? REST_TERRAFORM\n    : (await matchGritQL(tree, file, hcl(HTTP_TERRAFORM.identifyingBlock)))\n      ? HTTP_TERRAFORM\n      : undefined;\n  if (!api) {\n    return; // Not a vended API app module.\n  }\n\n  // Everything this migration declares, so a re-run recognises its own output\n  // and nothing it inserts collides with an existing declaration. Terraform\n  // merges every `.tf` file in the module directory, so all are checked.\n  const [domainType, mappingType] = api.domainResourceTypes;\n  const declarations = [\n    '`variable \"custom_domain_name\" { $_ }`',\n    '`variable \"acm_certificate_arn\" { $_ }`',\n    `\\`resource \"${domainType}\" \"custom_domain\" { $_ }\\``,\n    `\\`resource \"${mappingType}\" \"custom_domain\" { $_ }\\``,\n    '`locals { $body }` where { $body <: contains `api_url = $_` }',\n    '`output \"api_url\" { $_ }`',\n    '`output \"custom_domain_target_domain_name\" { $_ }`',\n    '`output \"custom_domain_hosted_zone_id\" { $_ }`',\n  ];\n  let declared = 0;\n  for (const declaration of declarations) {\n    if (await matchesInModule(tree, moduleDir, hcl(declaration))) {\n      declared++;\n    }\n  }\n  const publishesApiUrl = await matchGritQL(\n    tree,\n    file,\n    hcl(\n      `${RUNTIME_CONFIG_MODULE} where { $body <: contains \\`value = { $_ = local.api_url }\\` }`,\n    ),\n  );\n  if (declared === declarations.length && publishesApiUrl) {\n    return; // Already migrated.\n  }\n  if (declared > 0 || publishesApiUrl) {\n    nextSteps.push(\n      `${file}: this module (${moduleDir}) already declares some of the custom domain configuration this migration adds (custom_domain_name / acm_certificate_arn variables, the custom_domain resources, local.api_url, or the api_url / custom_domain_* outputs) - left untouched. Make sure the add_url_to_runtime_config module publishes the custom domain URL when one is configured, instead of the stage invoke URL (see the ${api.kind} API app module the plugin now generates).`,\n    );\n    return;\n  }\n\n  const runtimeConfigValue = `${RUNTIME_CONFIG_MODULE} where { $body <: contains \\`value = { $_ = $v }\\`, ${api.runtimeConfigUrl} }`;\n  const shape = [\n    hcl('`variable \"tags\" { $_ }`'),\n    hcl(runtimeConfigValue),\n    hcl(POLICY_LOCALS),\n    hcl('`output \"stage_invoke_url\" { $_ }`'),\n  ];\n  if (!(await matchesAll(tree, file, shape))) {\n    nextSteps.push(\n      `${file}: has diverged from the generated shape - left untouched. To support a custom domain for this ${api.kind} API, add custom_domain_name and acm_certificate_arn variables, the custom domain and mapping resources, and publish the custom domain URL in the add_url_to_runtime_config module when it is set (see the ${api.kind} API app module the plugin now generates).`,\n    );\n    return;\n  }\n\n  await insertViaGritQL(\n    tree,\n    file,\n    appendAfterBlock('variable \"tags\"'),\n    TERRAFORM_VARIABLES,\n  );\n  // Only the URL expression is rewritten, preserving `terraform fmt` alignment.\n  await applyGritQL(\n    tree,\n    file,\n    hcl(\n      `${RUNTIME_CONFIG_MODULE} where { $body <: contains \\`value = { $_ = $v }\\`, ${api.runtimeConfigUrl}, $v => \\`local.api_url\\` }`,\n    ),\n  );\n  // Alongside the module's other locals.\n  await insertViaGritQL(\n    tree,\n    file,\n    hcl(\n      `${POLICY_LOCALS} => \\`locals {\\n  $body\\n}\\n\\n${GRIT_INSERT_PLACEHOLDER}\\``,\n    ),\n    api.apiUrlLocal,\n  );\n  await insertViaGritQL(\n    tree,\n    file,\n    appendAfterBlock('module \"add_url_to_runtime_config\"'),\n    api.domainResources,\n  );\n  await insertViaGritQL(\n    tree,\n    file,\n    appendAfterBlock('output \"stage_invoke_url\"'),\n    api.outputs,\n  );\n};\n\nexport default async function migration(\n  tree: Tree,\n): Promise<MigrationReturnObject> {\n  const nextSteps: string[] = [];\n\n  await migrateRestApiConstruct(tree, nextSteps);\n  await migrateHttpApiConstruct(tree, nextSteps);\n\n  if (tree.exists(TERRAFORM_APIS_DIR)) {\n    for (const dirName of tree.children(TERRAFORM_APIS_DIR)) {\n      const moduleDir = joinPathFragments(TERRAFORM_APIS_DIR, dirName);\n      const file = joinPathFragments(moduleDir, `${dirName}.tf`);\n      if (tree.exists(file)) {\n        await migrateTerraformApi(tree, moduleDir, file, nextSteps);\n      }\n    }\n  }\n\n  await formatFilesInSubtree(tree);\n\n  return { nextSteps };\n}\n"],"names":["joinPathFragments","addDestructuredImport","applyGritQL","GRIT_INSERT_PLACEHOLDER","insertViaGritQL","matchGritQL","formatFilesInSubtree","PACKAGES_DIR","SHARED_CONSTRUCTS_DIR","SHARED_TERRAFORM_DIR","CONSTRUCTS_API_DIR","REST_API_CONSTRUCT","HTTP_API_CONSTRUCT","TERRAFORM_APIS_DIR","hcl","pattern","matchesInModule","tree","moduleDir","child","children","path","endsWith","isFile","matchesAll","file","patterns","REST_RUNTIME_CONFIG_URL","REST_DOMAIN_OUTPUTS","HTTP_DOMAIN_OUTPUTS","HTTP_DOMAIN_MAPPING_PROP","DOMAIN_ALIAS_OUTPUT","AFTER_RUNTIME_CONFIG","migrateRestApiConstruct","nextSteps","exists","shape","push","imported","HTTP_API_URL_FIELD","HTTP_API_URL_ASSIGNMENT","HTTP_URL_GETTER","migrateHttpApiConstruct","TERRAFORM_VARIABLES","REST_TERRAFORM","kind","identifyingBlock","runtimeConfigUrl","domainResourceTypes","domainResources","apiUrlLocal","outputs","HTTP_TERRAFORM","RUNTIME_CONFIG_MODULE","POLICY_LOCALS","appendAfterBlock","header","migrateTerraformApi","api","undefined","domainType","mappingType","declarations","declared","declaration","publishesApiUrl","length","runtimeConfigValue","migration","dirName"],"mappings":"AAAA;;;CAGC,GACD,SACEA,iBAAiB,QAGZ,aAAa;AACpB,SACEC,qBAAqB,EACrBC,WAAW,EACXC,uBAAuB,EACvBC,eAAe,EACfC,WAAW,QACN,wBAAwB;AAC/B,SAASC,oBAAoB,QAAQ,2BAA2B;AAChE,SACEC,YAAY,EACZC,qBAAqB,EACrBC,oBAAoB,QACf,gDAAgD;AAEvD;;;;;;;;;;;;;;;;;CAiBC,GAED,MAAMC,qBAAqB,GAAGH,aAAa,CAAC,EAAEC,sBAAsB,aAAa,CAAC;AAClF,MAAMG,qBAAqB,GAAGD,mBAAmB,YAAY,CAAC;AAC9D,MAAME,qBAAqB,GAAGF,mBAAmB,YAAY,CAAC;AAC9D,MAAMG,qBAAqB,GAAGN,aAAa,CAAC,EAAEE,qBAAqB,aAAa,CAAC;AAEjF,MAAMK,MAAM,CAACC,UAAoB,CAAC,cAAc,EAAEA,SAAS;AAE3D,kFAAkF,GAClF,MAAMC,kBAAkB,OACtBC,MACAC,WACAH;IAEA,KAAK,MAAMI,SAASF,KAAKG,QAAQ,CAACF,WAAY;QAC5C,MAAMG,OAAOrB,kBAAkBkB,WAAWC;QAC1C,IACEA,MAAMG,QAAQ,CAAC,UACfL,KAAKM,MAAM,CAACF,SACX,MAAMhB,YAAYY,MAAMI,MAAMN,UAC/B;YACA,OAAO;QACT;IACF;IACA,OAAO;AACT;AAEA,4CAA4C,GAC5C,MAAMS,aAAa,OAAOP,MAAYQ,MAAcC;IAClD,KAAK,MAAMX,WAAWW,SAAU;QAC9B,IAAI,CAAE,MAAMrB,YAAYY,MAAMQ,MAAMV,UAAW;YAC7C,OAAO;QACT;IACF;IACA,OAAO;AACT;AAEA,MAAMY,0BAA0B,CAAC;;uBAEV,CAAC;AAExB,MAAMC,sBAAsB,CAAC;;;;;;;;;;;;KAYxB,CAAC;AAEN,MAAMC,sBAAsB,CAAC;;;;;;;;;;;;KAYxB,CAAC;AAEN,MAAMC,2BAA2B,CAAC;;;;;GAK/B,CAAC;AAEJ,qDAAqD,GACrD,MAAMC,sBACJ;AAEF,6FAA6F,GAC7F,MAAMC,uBAAuB,CAAC;;gCAEE,EAAE7B,wBAAwB;CACzD,CAAC;AAEF,MAAM8B,0BAA0B,OAAOhB,MAAYiB;IACjD,MAAMT,OAAOd;IACb,IAAI,CAACM,KAAKkB,MAAM,CAACV,OAAO;QACtB;IACF;IAEA,IAAI,MAAMpB,YAAYY,MAAMQ,MAAM,sCAAsC;QACtE,QAAQ,oBAAoB;IAC9B;IAEA,MAAMW,QAAQ;QACZ;QACA;QACA;KACD;IACD,IACE,CAAE,MAAMZ,WAAWP,MAAMQ,MAAMW,UAC9B,MAAM/B,YAAYY,MAAMQ,MAAMM,sBAC/B;QACAG,UAAUG,IAAI,CACZ,GAAGZ,KAAK,8eAA8e,CAAC;QAEzf;IACF;IAEA,uEAAuE;IACvE,MAAMvB,YACJe,MACAQ,MACA;IAEF,MAAMvB,YACJe,MACAQ,MACA;IAEF,MAAMrB,gBACJa,MACAQ,MACA,oKACAE;IAEF,MAAMvB,gBAAgBa,MAAMQ,MAAMO,sBAAsBJ;IACxD,2CAA2C;IAC3C,MAAMU,WAAW,MAAMpC,YACrBe,MACAQ,MACA;IAEF,IAAI,CAACa,UAAU;QACb,MAAMrC,sBAAsBgB,MAAMQ,MAAM;YAAC;SAAY,EAAE;IACzD;AACF;AAEA,MAAMc,qBAAqB,CAAC;iCACK,CAAC;AAElC,MAAMC,0BAA0B,CAAC;;+BAEF,CAAC;AAEhC,8DAA8D,GAC9D,MAAMC,kBACJ;AAEF,MAAMC,0BAA0B,OAAOzB,MAAYiB;IACjD,MAAMT,OAAOb;IACb,IAAI,CAACK,KAAKkB,MAAM,CAACV,OAAO;QACtB;IACF;IAEA,IAAI,MAAMpB,YAAYY,MAAMQ,MAAM,6BAA6B;QAC7D,QAAQ,oBAAoB;IAC9B;IAEA,MAAMW,QAAQ;QACZ;QACA;QACA;QACA;QACA;QACA;QACA;QACAK;KACD;IACD,IACE,CAAE,MAAMjB,WAAWP,MAAMQ,MAAMW,UAC9B,MAAM/B,YAAYY,MAAMQ,MAAMM,wBAC9B,MAAM1B,YAAYY,MAAMQ,MAAM,kBAC/B;QACAS,UAAUG,IAAI,CACZ,GAAGZ,KAAK,ykBAAykB,CAAC;QAEplB;IACF;IAEA,2EAA2E;IAC3E,MAAMrB,gBACJa,MACAQ,MACA,+OACAK;IAEF,iEAAiE;IACjE,MAAM5B,YACJe,MACAQ,MACA;IAEF,4DAA4D;IAC5D,MAAMvB,YACJe,MACAQ,MACA;IAEF,MAAMvB,YACJe,MACAQ,MACA;IAEF,MAAMrB,gBACJa,MACAQ,MACA,sIACAc;IAEF,8DAA8D;IAC9D,MAAMrC,YACJe,MACAQ,MACA;IAEF,MAAMvB,YACJe,MACAQ,MACA;IAEF,4EAA4E;IAC5E,MAAMrB,gBACJa,MACAQ,MACA,CAAC;;oCAE+B,EAAEtB,wBAAwB;CAC7D,CAAC,EACEqC;IAEF,MAAMtC,YACJe,MACAQ,MACA;IAEF,MAAMvB,YACJe,MACAQ,MACA;IAEF,MAAMvB,YACJe,MACAQ,MACA;IAEF,MAAMrB,gBAAgBa,MAAMQ,MAAMO,sBAAsBH;AAC1D;AAEA,MAAMc,sBAAsB,CAAC;;;;;;;;;;;CAW5B,CAAC;AAiBF,MAAMC,iBAA+B;IACnCC,MAAM;IACNC,kBAAkB;IAClBC,kBACE;IACFC,qBAAqB;QACnB;QACA;KACD;IACDC,iBAAiB,CAAC;;;;;;;;;;;;;;;;;;;;;;;;;;;;CA4BnB,CAAC;IACAC,aAAa,CAAC;;CAEf,CAAC;IACAC,SAAS,CAAC;;;;;;;;;;;;;CAaX,CAAC;AACF;AAEA,MAAMC,iBAA+B;IACnCP,MAAM;IACNC,kBAAkB;IAClBC,kBAAkB;IAClBC,qBAAqB;QACnB;QACA;KACD;IACDC,iBAAiB,CAAC;;;;;;;;;;;;;;;;;;;;;;;;;;;;CA4BnB,CAAC;IACAC,aAAa,CAAC;;CAEf,CAAC;IACAC,SAAS,CAAC;;;;;;;;;;;;;CAaX,CAAC;AACF;AAEA,MAAME,wBAAwB;AAE9B,0FAA0F,GAC1F,MAAMC,gBACJ;AAEF,qFAAqF,GACrF,MAAMC,mBAAmB,CAACC,SACxB1C,IACE,CAAC,EAAE,EAAE0C,OAAO,kBAAkB,EAAEA,OAAO,kBAAkB,EAAErD,wBAAwB,EAAE,CAAC;AAG1F,MAAMsD,sBAAsB,OAC1BxC,MACAC,WACAO,MACAS;IAEA,MAAMwB,MAAM,AAAC,MAAMrD,YACjBY,MACAQ,MACAX,IAAI8B,eAAeE,gBAAgB,KAEjCF,iBACA,AAAC,MAAMvC,YAAYY,MAAMQ,MAAMX,IAAIsC,eAAeN,gBAAgB,KAChEM,iBACAO;IACN,IAAI,CAACD,KAAK;QACR,QAAQ,+BAA+B;IACzC;IAEA,4EAA4E;IAC5E,0EAA0E;IAC1E,uEAAuE;IACvE,MAAM,CAACE,YAAYC,YAAY,GAAGH,IAAIV,mBAAmB;IACzD,MAAMc,eAAe;QACnB;QACA;QACA,CAAC,YAAY,EAAEF,WAAW,0BAA0B,CAAC;QACrD,CAAC,YAAY,EAAEC,YAAY,0BAA0B,CAAC;QACtD;QACA;QACA;QACA;KACD;IACD,IAAIE,WAAW;IACf,KAAK,MAAMC,eAAeF,aAAc;QACtC,IAAI,MAAM9C,gBAAgBC,MAAMC,WAAWJ,IAAIkD,eAAe;YAC5DD;QACF;IACF;IACA,MAAME,kBAAkB,MAAM5D,YAC5BY,MACAQ,MACAX,IACE,GAAGuC,sBAAsB,+DAA+D,CAAC;IAG7F,IAAIU,aAAaD,aAAaI,MAAM,IAAID,iBAAiB;QACvD,QAAQ,oBAAoB;IAC9B;IACA,IAAIF,WAAW,KAAKE,iBAAiB;QACnC/B,UAAUG,IAAI,CACZ,GAAGZ,KAAK,eAAe,EAAEP,UAAU,4XAA4X,EAAEwC,IAAIb,IAAI,CAAC,0CAA0C,CAAC;QAEvd;IACF;IAEA,MAAMsB,qBAAqB,GAAGd,sBAAsB,oDAAoD,EAAEK,IAAIX,gBAAgB,CAAC,EAAE,CAAC;IAClI,MAAMX,QAAQ;QACZtB,IAAI;QACJA,IAAIqD;QACJrD,IAAIwC;QACJxC,IAAI;KACL;IACD,IAAI,CAAE,MAAMU,WAAWP,MAAMQ,MAAMW,QAAS;QAC1CF,UAAUG,IAAI,CACZ,GAAGZ,KAAK,8FAA8F,EAAEiC,IAAIb,IAAI,CAAC,2MAA2M,EAAEa,IAAIb,IAAI,CAAC,0CAA0C,CAAC;QAEpX;IACF;IAEA,MAAMzC,gBACJa,MACAQ,MACA8B,iBAAiB,oBACjBZ;IAEF,8EAA8E;IAC9E,MAAMzC,YACJe,MACAQ,MACAX,IACE,GAAGuC,sBAAsB,oDAAoD,EAAEK,IAAIX,gBAAgB,CAAC,2BAA2B,CAAC;IAGpI,uCAAuC;IACvC,MAAM3C,gBACJa,MACAQ,MACAX,IACE,GAAGwC,cAAc,8BAA8B,EAAEnD,wBAAwB,EAAE,CAAC,GAE9EuD,IAAIR,WAAW;IAEjB,MAAM9C,gBACJa,MACAQ,MACA8B,iBAAiB,uCACjBG,IAAIT,eAAe;IAErB,MAAM7C,gBACJa,MACAQ,MACA8B,iBAAiB,8BACjBG,IAAIP,OAAO;AAEf;AAEA,eAAe,eAAeiB,UAC5BnD,IAAU;IAEV,MAAMiB,YAAsB,EAAE;IAE9B,MAAMD,wBAAwBhB,MAAMiB;IACpC,MAAMQ,wBAAwBzB,MAAMiB;IAEpC,IAAIjB,KAAKkB,MAAM,CAACtB,qBAAqB;QACnC,KAAK,MAAMwD,WAAWpD,KAAKG,QAAQ,CAACP,oBAAqB;YACvD,MAAMK,YAAYlB,kBAAkBa,oBAAoBwD;YACxD,MAAM5C,OAAOzB,kBAAkBkB,WAAW,GAAGmD,QAAQ,GAAG,CAAC;YACzD,IAAIpD,KAAKkB,MAAM,CAACV,OAAO;gBACrB,MAAMgC,oBAAoBxC,MAAMC,WAAWO,MAAMS;YACnD;QACF;IACF;IAEA,MAAM5B,qBAAqBW;IAE3B,OAAO;QAAEiB;IAAU;AACrB"}

package/src/preset/__snapshots__/generator.spec.ts.snap

@@ -253,7 +253,7 @@ export default {
 
 exports[`preset generator > should run successfully > biome.json 1`] = `
 "{
-  "$schema": "https://biomejs.dev/schemas/2.5.14/schema.json",
+  "$schema": "https://biomejs.dev/schemas/2.5.15/schema.json",
   "root": true,
   "formatter": {
     "enabled": true,
@@ -422,7 +422,7 @@ catalog:
   '@nx/js': 23.2.1
   '@nx/workspace': 23.2.1
   typescript: ~6.0.3
-  '@biomejs/biome': 2.5.14
+  '@biomejs/biome': 2.5.15
   '@aws/nx-plugin': ^0.0.0
   '@aws/nx-plugin-mcp': ^0.0.0
 "

package/src/py/agent/__snapshots__/generator.constructs.spec.ts.snap

@@ -764,18 +764,18 @@ version = "0.1.0"
 dependencies = [
   "proj-agent-connection",
   "aws-lambda-powertools==3.35.0",
-  "aws-opentelemetry-distro==0.20.0",
-  "bedrock-agentcore==1.23.1",
-  "boto3==1.43.103",
-  "fastapi==0.141.1",
+  "aws-opentelemetry-distro==0.21.0",
+  "bedrock-agentcore==1.24.0",
+  "boto3==1.43.108",
+  "fastapi==0.142.2",
   "mcp==1.28.1",
-  "strands-agents==1.57.1",
+  "strands-agents==1.57.2",
   "strands-agents-tools==0.8.9",
   "uvicorn==0.54.0"
 ]
 
 [dependency-groups]
-dev = [ "fastapi[standard]==0.141.1" ]
+dev = [ "fastapi[standard]==0.142.2" ]
 
 [tool.uv]
 dev-dependencies = [ ]

package/src/py/agent/__snapshots__/generator.frameworks.spec.ts.snap

@@ -702,23 +702,23 @@ version = "0.1.0"
 dependencies = [
   "proj-agent-connection",
   "aws-lambda-powertools==3.35.0",
-  "aws-opentelemetry-distro==0.20.0",
-  "bedrock-agentcore==1.23.1",
-  "boto3==1.43.103",
-  "fastapi==0.141.1",
+  "aws-opentelemetry-distro==0.21.0",
+  "bedrock-agentcore==1.24.0",
+  "boto3==1.43.108",
+  "fastapi==0.142.2",
   "mcp==1.28.1",
-  "langchain==1.4.2",
-  "langchain-aws==1.7.9",
+  "langchain==1.4.3",
+  "langchain-aws==1.8.0",
   "langgraph==1.2.12",
   "langgraph-checkpoint-sqlite==3.1.1",
   "aiosqlite==0.22.1",
   "ag-ui-protocol==0.1.22",
-  "ag-ui-langgraph==0.0.45",
+  "ag-ui-langgraph==0.0.46",
   "uvicorn==0.54.0"
 ]
 
 [dependency-groups]
-dev = [ "fastapi[standard]==0.141.1" ]
+dev = [ "fastapi[standard]==0.142.2" ]
 
 [tool.uv]
 dev-dependencies = [ ]

package/src/py/agent/__snapshots__/generator.protocols.spec.ts.snap

@@ -5,7 +5,7 @@ exports[`py#agent generator > should create DynamoDB checkpoint table and S3 off
   required_providers {
     aws = {
       source  = "hashicorp/aws"
-      version = "6.66.0"
+      version = "6.67.0"
     }
     random = {
       source  = "hashicorp/random"
@@ -381,7 +381,7 @@ exports[`py#agent generator > should match snapshot for Terraform generated file
   required_providers {
     aws = {
       source  = "hashicorp/aws"
-      version = "6.66.0"
+      version = "6.67.0"
     }
     random = {
       source  = "hashicorp/random"
@@ -704,7 +704,7 @@ exports[`py#agent generator > should match snapshot for Terraform generated file
   required_providers {
     aws = {
       source  = "hashicorp/aws"
-      version = "6.66.0"
+      version = "6.67.0"
     }
     null = {
       source  = "hashicorp/null"
@@ -1063,7 +1063,7 @@ resource "null_resource" "runtime_ready" {
 
   provisioner "local-exec" {
     command = <<-EOT
-      uv run --with boto3==1.43.103 python -c "
+      uv run --with boto3==1.43.108 python -c "
 import boto3
 import json
 import os

package/src/py/dynamodb/__snapshots__/generator.spec.ts.snap

@@ -35,7 +35,7 @@ exports[`py#dynamodb generator > should generate terraform modules when iac is t
   required_providers {
     aws = {
       source  = "hashicorp/aws"
-      version = "6.66.0"
+      version = "6.67.0"
     }
   }
 }
@@ -232,7 +232,7 @@ exports[`py#dynamodb generator > should generate terraform modules when iac is t
   required_providers {
     aws = {
       source  = "hashicorp/aws"
-      version = "6.66.0"
+      version = "6.67.0"
     }
     random = {
       source  = "hashicorp/random"

package/src/py/fast-api/__snapshots__/generator.terraform.spec.ts.snap

@@ -11,7 +11,7 @@ terraform {
   required_providers {
     aws = {
       source  = "hashicorp/aws"
-      version = "6.66.0"
+      version = "6.67.0"
     }
   }
 }
@@ -262,7 +262,7 @@ output "api_log_group_arn" {
     }
     aws = {
       source  = "hashicorp/aws"
-      version = "6.66.0"
+      version = "6.67.0"
     }
     random = {
       source  = "hashicorp/random"
@@ -908,7 +908,7 @@ terraform {
   required_providers {
     aws = {
       source  = "hashicorp/aws"
-      version = "6.66.0"
+      version = "6.67.0"
     }
   }
 }
@@ -1159,7 +1159,7 @@ output "api_log_group_arn" {
     }
     aws = {
       source  = "hashicorp/aws"
-      version = "6.66.0"
+      version = "6.67.0"
     }
     random = {
       source  = "hashicorp/random"
@@ -1878,7 +1878,7 @@ terraform {
   required_providers {
     aws = {
       source  = "hashicorp/aws"
-      version = "6.66.0"
+      version = "6.67.0"
     }
   }
 }
@@ -2129,7 +2129,7 @@ output "api_log_group_arn" {
     }
     aws = {
       source  = "hashicorp/aws"
-      version = "6.66.0"
+      version = "6.67.0"
     }
     random = {
       source  = "hashicorp/random"
@@ -2752,7 +2752,7 @@ terraform {
   required_providers {
     aws = {
       source  = "hashicorp/aws"
-      version = "6.66.0"
+      version = "6.67.0"
     }
     random = {
       source  = "hashicorp/random"
@@ -3065,7 +3065,7 @@ output "waf_web_acl_arn" {
     }
     aws = {
       source  = "hashicorp/aws"
-      version = "6.66.0"
+      version = "6.67.0"
     }
     random = {
       source  = "hashicorp/random"
@@ -4162,7 +4162,7 @@ terraform {
   required_providers {
     aws = {
       source  = "hashicorp/aws"
-      version = "6.66.0"
+      version = "6.67.0"
     }
     random = {
       source  = "hashicorp/random"
@@ -4475,7 +4475,7 @@ output "waf_web_acl_arn" {
     }
     aws = {
       source  = "hashicorp/aws"
-      version = "6.66.0"
+      version = "6.67.0"
     }
     random = {
       source  = "hashicorp/random"
@@ -5561,7 +5561,7 @@ terraform {
   required_providers {
     aws = {
       source  = "hashicorp/aws"
-      version = "6.66.0"
+      version = "6.67.0"
     }
     random = {
       source  = "hashicorp/random"
@@ -5874,7 +5874,7 @@ output "waf_web_acl_arn" {
     }
     aws = {
       source  = "hashicorp/aws"
-      version = "6.66.0"
+      version = "6.67.0"
     }
     random = {
       source  = "hashicorp/random"

package/src/py/lambda-function/__snapshots__/generator.spec.ts.snap

@@ -71,7 +71,7 @@ exports[`lambda-handler project generator > terraform iac > should generate terr
   required_providers {
     aws = {
       source  = "hashicorp/aws"
-      version = "6.66.0"
+      version = "6.67.0"
     }
     archive = {
       source  = "hashicorp/archive"
@@ -256,7 +256,7 @@ exports[`lambda-handler project generator > terraform iac > should match snapsho
   required_providers {
     aws = {
       source  = "hashicorp/aws"
-      version = "6.66.0"
+      version = "6.67.0"
     }
     archive = {
       source  = "hashicorp/archive"

package/src/py/mcp-server/__snapshots__/generator.spec.ts.snap

@@ -155,7 +155,7 @@ exports[`py#mcp-server generator > should match snapshot for Terraform generated
   required_providers {
     aws = {
       source  = "hashicorp/aws"
-      version = "6.66.0"
+      version = "6.67.0"
     }
     null = {
       source  = "hashicorp/null"
@@ -514,7 +514,7 @@ resource "null_resource" "runtime_ready" {
 
   provisioner "local-exec" {
     command = <<-EOT
-      uv run --with boto3==1.43.103 python -c "
+      uv run --with boto3==1.43.108 python -c "
 import boto3
 import json
 import os
@@ -804,8 +804,8 @@ dependencies = [
   "aws-lambda-powertools==3.35.0",
   "mcp==1.28.1",
   "uvicorn==0.54.0",
-  "boto3==1.43.103",
-  "aws-opentelemetry-distro==0.20.0"
+  "boto3==1.43.108",
+  "aws-opentelemetry-distro==0.21.0"
 ]
 
 [dependency-groups]

package/src/py/rdb/__snapshots__/generator.spec.ts.snap

@@ -173,10 +173,13 @@ exports[`py#rdb generator > should generate MySQL dependencies and templates 4`]
 # Patch OS packages beyond the base image's pinned release, and drop pip, whose
 # vendored copies of msgpack and setuptools carry known HIGH vulnerabilities.
 # The handler's dependencies are already installed in the image, so nothing
-# installs packages at runtime.
+# installs packages at runtime. Also drop the Lambda Runtime Interface
+# Emulator: it is only used for local \`docker run\` emulation outside Lambda,
+# never by the deployed function, and carries known HIGH vulnerabilities.
 RUN microdnf upgrade -y --releasever latest && microdnf clean all \\
     && rm -rf /var/lang/lib/python*/site-packages/pip \\
-    /var/lang/lib/python*/site-packages/pip-*.dist-info
+    /var/lang/lib/python*/site-packages/pip-*.dist-info \\
+    /usr/local/bin/aws-lambda-rie
 
 WORKDIR \${LAMBDA_TASK_ROOT}
 
@@ -195,10 +198,13 @@ exports[`py#rdb generator > should generate MySQL dependencies and templates 5`]
 # Patch OS packages beyond the base image's pinned release, and drop pip, whose
 # vendored copies of msgpack and setuptools carry known HIGH vulnerabilities.
 # The handler's dependencies are already installed in the image, so nothing
-# installs packages at runtime.
+# installs packages at runtime. Also drop the Lambda Runtime Interface
+# Emulator: it is only used for local \`docker run\` emulation outside Lambda,
+# never by the deployed function, and carries known HIGH vulnerabilities.
 RUN microdnf upgrade -y --releasever latest && microdnf clean all \\
     && rm -rf /var/lang/lib/python*/site-packages/pip \\
-    /var/lang/lib/python*/site-packages/pip-*.dist-info
+    /var/lang/lib/python*/site-packages/pip-*.dist-info \\
+    /usr/local/bin/aws-lambda-rie
 
 WORKDIR \${LAMBDA_TASK_ROOT}
 
@@ -222,7 +228,7 @@ exports[`py#rdb generator > should generate Terraform modules 1`] = `
     }
     aws = {
       source  = "hashicorp/aws"
-      version = "6.66.0"
+      version = "6.67.0"
     }
     external = {
       source  = "hashicorp/external"
@@ -1393,10 +1399,13 @@ exports[`py#rdb generator > should generate a PostgreSQL SQLModel project with A
 # Patch OS packages beyond the base image's pinned release, and drop pip, whose
 # vendored copies of msgpack and setuptools carry known HIGH vulnerabilities.
 # The handler's dependencies are already installed in the image, so nothing
-# installs packages at runtime.
+# installs packages at runtime. Also drop the Lambda Runtime Interface
+# Emulator: it is only used for local \`docker run\` emulation outside Lambda,
+# never by the deployed function, and carries known HIGH vulnerabilities.
 RUN microdnf upgrade -y --releasever latest && microdnf clean all \\
     && rm -rf /var/lang/lib/python*/site-packages/pip \\
-    /var/lang/lib/python*/site-packages/pip-*.dist-info
+    /var/lang/lib/python*/site-packages/pip-*.dist-info \\
+    /usr/local/bin/aws-lambda-rie
 
 WORKDIR \${LAMBDA_TASK_ROOT}
 
@@ -1415,10 +1424,13 @@ exports[`py#rdb generator > should generate a PostgreSQL SQLModel project with A
 # Patch OS packages beyond the base image's pinned release, and drop pip, whose
 # vendored copies of msgpack and setuptools carry known HIGH vulnerabilities.
 # The handler's dependencies are already installed in the image, so nothing
-# installs packages at runtime.
+# installs packages at runtime. Also drop the Lambda Runtime Interface
+# Emulator: it is only used for local \`docker run\` emulation outside Lambda,
+# never by the deployed function, and carries known HIGH vulnerabilities.
 RUN microdnf upgrade -y --releasever latest && microdnf clean all \\
     && rm -rf /var/lang/lib/python*/site-packages/pip \\
-    /var/lang/lib/python*/site-packages/pip-*.dist-info
+    /var/lang/lib/python*/site-packages/pip-*.dist-info \\
+    /usr/local/bin/aws-lambda-rie
 
 WORKDIR \${LAMBDA_TASK_ROOT}
 
@@ -1495,7 +1507,7 @@ dependencies = [
   "alembic==1.20.0",
   "greenlet==3.5.6",
   "asyncpg==0.31.0",
-  "boto3==1.43.103",
+  "boto3==1.43.108",
   "aws-lambda-powertools==3.35.0"
 ]
 

package/src/py/rdb/files/Dockerfile.create-db-user.template

@@ -3,10 +3,13 @@ FROM public.ecr.aws/lambda/python:3.14
 # Patch OS packages beyond the base image's pinned release, and drop pip, whose
 # vendored copies of msgpack and setuptools carry known HIGH vulnerabilities.
 # The handler's dependencies are already installed in the image, so nothing
-# installs packages at runtime.
+# installs packages at runtime. Also drop the Lambda Runtime Interface
+# Emulator: it is only used for local `docker run` emulation outside Lambda,
+# never by the deployed function, and carries known HIGH vulnerabilities.
 RUN microdnf upgrade -y --releasever latest && microdnf clean all \
     && rm -rf /var/lang/lib/python*/site-packages/pip \
-    /var/lang/lib/python*/site-packages/pip-*.dist-info
+    /var/lang/lib/python*/site-packages/pip-*.dist-info \
+    /usr/local/bin/aws-lambda-rie
 
 WORKDIR ${LAMBDA_TASK_ROOT}
 

package/src/py/rdb/files/Dockerfile.migration.template

@@ -3,10 +3,13 @@ FROM public.ecr.aws/lambda/python:3.14
 # Patch OS packages beyond the base image's pinned release, and drop pip, whose
 # vendored copies of msgpack and setuptools carry known HIGH vulnerabilities.
 # The handler's dependencies are already installed in the image, so nothing
-# installs packages at runtime.
+# installs packages at runtime. Also drop the Lambda Runtime Interface
+# Emulator: it is only used for local `docker run` emulation outside Lambda,
+# never by the deployed function, and carries known HIGH vulnerabilities.
 RUN microdnf upgrade -y --releasever latest && microdnf clean all \
     && rm -rf /var/lang/lib/python*/site-packages/pip \
-    /var/lang/lib/python*/site-packages/pip-*.dist-info
+    /var/lang/lib/python*/site-packages/pip-*.dist-info \
+    /usr/local/bin/aws-lambda-rie
 
 WORKDIR ${LAMBDA_TASK_ROOT}
 

package/src/smithy/project/__snapshots__/generator.spec.ts.snap

@@ -45,7 +45,7 @@ exports[`smithyProjectGenerator > shape libraries > should generate a shape libr
           "shx rm -rf dist/{projectRoot}/build",
           "shx rm -rf dist/{projectRoot}/smithy",
           "shx mkdir -p dist/{projectRoot}/build",
-          "npx -y mise@2026.9.14 exec smithy@1.74.0 -- smithy build -c {projectRoot}/smithy-build.json --output dist/{projectRoot}/smithy",
+          "npx -y mise@2026.10.1 exec smithy@1.74.0 -- smithy build -c {projectRoot}/smithy-build.json --output dist/{projectRoot}/smithy",
           "shx cp dist/{projectRoot}/smithy/source/model/model.json dist/{projectRoot}/build/model.json"
         ],
         "parallel": false,
@@ -122,7 +122,7 @@ exports[`smithyProjectGenerator > should generate smithy project with all custom
           "shx rm -rf dist/{projectRoot}/build",
           "shx rm -rf dist/{projectRoot}/smithy",
           "shx mkdir -p dist/{projectRoot}/build",
-          "npx -y mise@2026.9.14 exec smithy@1.74.0 -- smithy build -c {projectRoot}/smithy-build.json --output dist/{projectRoot}/smithy",
+          "npx -y mise@2026.10.1 exec smithy@1.74.0 -- smithy build -c {projectRoot}/smithy-build.json --output dist/{projectRoot}/smithy",
           "shx mkdir -p dist/{projectRoot}/build/openapi",
           "shx cp \\"dist/{projectRoot}/smithy/source/openapi/*.openapi.json\\" dist/{projectRoot}/build/openapi/openapi.json"
         ],
@@ -180,7 +180,7 @@ exports[`smithyProjectGenerator > should generate smithy project with custom dir
           "shx rm -rf dist/{projectRoot}/build",
           "shx rm -rf dist/{projectRoot}/smithy",
           "shx mkdir -p dist/{projectRoot}/build",
-          "npx -y mise@2026.9.14 exec smithy@1.74.0 -- smithy build -c {projectRoot}/smithy-build.json --output dist/{projectRoot}/smithy",
+          "npx -y mise@2026.10.1 exec smithy@1.74.0 -- smithy build -c {projectRoot}/smithy-build.json --output dist/{projectRoot}/smithy",
           "shx mkdir -p dist/{projectRoot}/build/openapi",
           "shx cp \\"dist/{projectRoot}/smithy/source/openapi/*.openapi.json\\" dist/{projectRoot}/build/openapi/openapi.json"
         ],
@@ -330,7 +330,7 @@ exports[`smithyProjectGenerator > should generate smithy project with default op
           "shx rm -rf dist/{projectRoot}/build",
           "shx rm -rf dist/{projectRoot}/smithy",
           "shx mkdir -p dist/{projectRoot}/build",
-          "npx -y mise@2026.9.14 exec smithy@1.74.0 -- smithy build -c {projectRoot}/smithy-build.json --output dist/{projectRoot}/smithy",
+          "npx -y mise@2026.10.1 exec smithy@1.74.0 -- smithy build -c {projectRoot}/smithy-build.json --output dist/{projectRoot}/smithy",
           "shx mkdir -p dist/{projectRoot}/build/openapi",
           "shx cp \\"dist/{projectRoot}/smithy/source/openapi/*.openapi.json\\" dist/{projectRoot}/build/openapi/openapi.json"
         ],
@@ -474,7 +474,7 @@ exports[`smithyProjectGenerator > should generate smithy project with subdirecto
           "shx rm -rf dist/{projectRoot}/build",
           "shx rm -rf dist/{projectRoot}/smithy",
           "shx mkdir -p dist/{projectRoot}/build",
-          "npx -y mise@2026.9.14 exec smithy@1.74.0 -- smithy build -c {projectRoot}/smithy-build.json --output dist/{projectRoot}/smithy",
+          "npx -y mise@2026.10.1 exec smithy@1.74.0 -- smithy build -c {projectRoot}/smithy-build.json --output dist/{projectRoot}/smithy",
           "shx mkdir -p dist/{projectRoot}/build/openapi",
           "shx cp \\"dist/{projectRoot}/smithy/source/openapi/*.openapi.json\\" dist/{projectRoot}/build/openapi/openapi.json"
         ],

package/src/smithy/ts/api/__snapshots__/generator.spec.ts.snap

@@ -416,7 +416,7 @@ terraform {
   required_providers {
     aws = {
       source  = "hashicorp/aws"
-      version = "6.66.0"
+      version = "6.67.0"
     }
     random = {
       source  = "hashicorp/random"
@@ -732,7 +732,7 @@ exports[`tsSmithyApiGenerator > should generate smithy ts api with Terraform pro
     }
     aws = {
       source  = "hashicorp/aws"
-      version = "6.66.0"
+      version = "6.67.0"
     }
     random = {
       source  = "hashicorp/random"
@@ -2175,7 +2175,7 @@ exports[`tsSmithyApiGenerator > should generate smithy ts api with default optio
           "shx rm -rf dist/{projectRoot}/build",
           "shx rm -rf dist/{projectRoot}/smithy",
           "shx mkdir -p dist/{projectRoot}/build",
-          "npx -y mise@2026.9.14 exec smithy@1.74.0 -- smithy build -c {projectRoot}/smithy-build.json --output dist/{projectRoot}/smithy",
+          "npx -y mise@2026.10.1 exec smithy@1.74.0 -- smithy build -c {projectRoot}/smithy-build.json --output dist/{projectRoot}/smithy",
           "shx mkdir -p dist/{projectRoot}/build/openapi",
           "shx cp \\"dist/{projectRoot}/smithy/source/openapi/*.openapi.json\\" dist/{projectRoot}/build/openapi/openapi.json"
         ],
@@ -2315,7 +2315,7 @@ terraform {
   required_providers {
     aws = {
       source  = "hashicorp/aws"
-      version = "6.66.0"
+      version = "6.67.0"
     }
     random = {
       source  = "hashicorp/random"
@@ -2628,7 +2628,7 @@ output "waf_web_acl_arn" {
     }
     aws = {
       source  = "hashicorp/aws"
-      version = "6.66.0"
+      version = "6.67.0"
     }
     random = {
       source  = "hashicorp/random"
@@ -3690,7 +3690,7 @@ terraform {
   required_providers {
     aws = {
       source  = "hashicorp/aws"
-      version = "6.66.0"
+      version = "6.67.0"
     }
     random = {
       source  = "hashicorp/random"
@@ -4003,7 +4003,7 @@ output "waf_web_acl_arn" {
     }
     aws = {
       source  = "hashicorp/aws"
-      version = "6.66.0"
+      version = "6.67.0"
     }
     random = {
       source  = "hashicorp/random"
@@ -5054,7 +5054,7 @@ exports[`tsSmithyApiGenerator > terraform iac > should generate terraform with c
     }
     aws = {
       source  = "hashicorp/aws"
-      version = "6.66.0"
+      version = "6.67.0"
     }
     random = {
       source  = "hashicorp/random"