@aws/nx-plugin 1.0.6 → 1.0.8

package/src/py/rdb/__snapshots__/generator.spec.ts.snap

@@ -173,10 +173,13 @@ exports[`py#rdb generator > should generate MySQL dependencies and templates 4`]
 # Patch OS packages beyond the base image's pinned release, and drop pip, whose
 # vendored copies of msgpack and setuptools carry known HIGH vulnerabilities.
 # The handler's dependencies are already installed in the image, so nothing
-# installs packages at runtime.
+# installs packages at runtime. Also drop the Lambda Runtime Interface
+# Emulator: it is only used for local \`docker run\` emulation outside Lambda,
+# never by the deployed function, and carries known HIGH vulnerabilities.
 RUN microdnf upgrade -y --releasever latest && microdnf clean all \\
     && rm -rf /var/lang/lib/python*/site-packages/pip \\
-    /var/lang/lib/python*/site-packages/pip-*.dist-info
+    /var/lang/lib/python*/site-packages/pip-*.dist-info \\
+    /usr/local/bin/aws-lambda-rie
 
 WORKDIR \${LAMBDA_TASK_ROOT}
 
@@ -195,10 +198,13 @@ exports[`py#rdb generator > should generate MySQL dependencies and templates 5`]
 # Patch OS packages beyond the base image's pinned release, and drop pip, whose
 # vendored copies of msgpack and setuptools carry known HIGH vulnerabilities.
 # The handler's dependencies are already installed in the image, so nothing
-# installs packages at runtime.
+# installs packages at runtime. Also drop the Lambda Runtime Interface
+# Emulator: it is only used for local \`docker run\` emulation outside Lambda,
+# never by the deployed function, and carries known HIGH vulnerabilities.
 RUN microdnf upgrade -y --releasever latest && microdnf clean all \\
     && rm -rf /var/lang/lib/python*/site-packages/pip \\
-    /var/lang/lib/python*/site-packages/pip-*.dist-info
+    /var/lang/lib/python*/site-packages/pip-*.dist-info \\
+    /usr/local/bin/aws-lambda-rie
 
 WORKDIR \${LAMBDA_TASK_ROOT}
 
@@ -1393,10 +1399,13 @@ exports[`py#rdb generator > should generate a PostgreSQL SQLModel project with A
 # Patch OS packages beyond the base image's pinned release, and drop pip, whose
 # vendored copies of msgpack and setuptools carry known HIGH vulnerabilities.
 # The handler's dependencies are already installed in the image, so nothing
-# installs packages at runtime.
+# installs packages at runtime. Also drop the Lambda Runtime Interface
+# Emulator: it is only used for local \`docker run\` emulation outside Lambda,
+# never by the deployed function, and carries known HIGH vulnerabilities.
 RUN microdnf upgrade -y --releasever latest && microdnf clean all \\
     && rm -rf /var/lang/lib/python*/site-packages/pip \\
-    /var/lang/lib/python*/site-packages/pip-*.dist-info
+    /var/lang/lib/python*/site-packages/pip-*.dist-info \\
+    /usr/local/bin/aws-lambda-rie
 
 WORKDIR \${LAMBDA_TASK_ROOT}
 
@@ -1415,10 +1424,13 @@ exports[`py#rdb generator > should generate a PostgreSQL SQLModel project with A
 # Patch OS packages beyond the base image's pinned release, and drop pip, whose
 # vendored copies of msgpack and setuptools carry known HIGH vulnerabilities.
 # The handler's dependencies are already installed in the image, so nothing
-# installs packages at runtime.
+# installs packages at runtime. Also drop the Lambda Runtime Interface
+# Emulator: it is only used for local \`docker run\` emulation outside Lambda,
+# never by the deployed function, and carries known HIGH vulnerabilities.
 RUN microdnf upgrade -y --releasever latest && microdnf clean all \\
     && rm -rf /var/lang/lib/python*/site-packages/pip \\
-    /var/lang/lib/python*/site-packages/pip-*.dist-info
+    /var/lang/lib/python*/site-packages/pip-*.dist-info \\
+    /usr/local/bin/aws-lambda-rie
 
 WORKDIR \${LAMBDA_TASK_ROOT}
 

package/src/py/rdb/files/Dockerfile.create-db-user.template

@@ -3,10 +3,13 @@ FROM public.ecr.aws/lambda/python:3.14
 # Patch OS packages beyond the base image's pinned release, and drop pip, whose
 # vendored copies of msgpack and setuptools carry known HIGH vulnerabilities.
 # The handler's dependencies are already installed in the image, so nothing
-# installs packages at runtime.
+# installs packages at runtime. Also drop the Lambda Runtime Interface
+# Emulator: it is only used for local `docker run` emulation outside Lambda,
+# never by the deployed function, and carries known HIGH vulnerabilities.
 RUN microdnf upgrade -y --releasever latest && microdnf clean all \
     && rm -rf /var/lang/lib/python*/site-packages/pip \
-    /var/lang/lib/python*/site-packages/pip-*.dist-info
+    /var/lang/lib/python*/site-packages/pip-*.dist-info \
+    /usr/local/bin/aws-lambda-rie
 
 WORKDIR ${LAMBDA_TASK_ROOT}
 

package/src/py/rdb/files/Dockerfile.migration.template

@@ -3,10 +3,13 @@ FROM public.ecr.aws/lambda/python:3.14
 # Patch OS packages beyond the base image's pinned release, and drop pip, whose
 # vendored copies of msgpack and setuptools carry known HIGH vulnerabilities.
 # The handler's dependencies are already installed in the image, so nothing
-# installs packages at runtime.
+# installs packages at runtime. Also drop the Lambda Runtime Interface
+# Emulator: it is only used for local `docker run` emulation outside Lambda,
+# never by the deployed function, and carries known HIGH vulnerabilities.
 RUN microdnf upgrade -y --releasever latest && microdnf clean all \
     && rm -rf /var/lang/lib/python*/site-packages/pip \
-    /var/lang/lib/python*/site-packages/pip-*.dist-info
+    /var/lang/lib/python*/site-packages/pip-*.dist-info \
+    /usr/local/bin/aws-lambda-rie
 
 WORKDIR ${LAMBDA_TASK_ROOT}
 

package/src/smithy/project/__snapshots__/generator.spec.ts.snap

@@ -35,6 +35,7 @@ exports[`smithyProjectGenerator > shape libraries > should generate a shape libr
     },
     "compile": {
       "cache": true,
+      "inputs": ["default"],
       "outputs": [
         "{workspaceRoot}/dist/{projectRoot}/smithy",
         "{workspaceRoot}/dist/{projectRoot}/build/model.json"
@@ -112,6 +113,7 @@ exports[`smithyProjectGenerator > should generate smithy project with all custom
     },
     "compile": {
       "cache": true,
+      "inputs": ["default"],
       "outputs": [
         "{workspaceRoot}/dist/{projectRoot}/smithy",
         "{workspaceRoot}/dist/{projectRoot}/build/openapi"
@@ -132,6 +134,7 @@ exports[`smithyProjectGenerator > should generate smithy project with all custom
     },
     "generate-ssdk": {
       "cache": true,
+      "inputs": ["default"],
       "outputs": ["{workspaceRoot}/dist/{projectRoot}/build/ssdk"],
       "executor": "nx:run-commands",
       "dependsOn": ["compile"],
@@ -170,6 +173,7 @@ exports[`smithyProjectGenerator > should generate smithy project with custom dir
     },
     "compile": {
       "cache": true,
+      "inputs": ["default"],
       "outputs": [
         "{workspaceRoot}/dist/{projectRoot}/smithy",
         "{workspaceRoot}/dist/{projectRoot}/build/openapi"
@@ -190,6 +194,7 @@ exports[`smithyProjectGenerator > should generate smithy project with custom dir
     },
     "generate-ssdk": {
       "cache": true,
+      "inputs": ["default"],
       "outputs": ["{workspaceRoot}/dist/{projectRoot}/build/ssdk"],
       "executor": "nx:run-commands",
       "dependsOn": ["compile"],
@@ -320,6 +325,7 @@ exports[`smithyProjectGenerator > should generate smithy project with default op
     },
     "compile": {
       "cache": true,
+      "inputs": ["default"],
       "outputs": [
         "{workspaceRoot}/dist/{projectRoot}/smithy",
         "{workspaceRoot}/dist/{projectRoot}/build/openapi"
@@ -340,6 +346,7 @@ exports[`smithyProjectGenerator > should generate smithy project with default op
     },
     "generate-ssdk": {
       "cache": true,
+      "inputs": ["default"],
       "outputs": ["{workspaceRoot}/dist/{projectRoot}/build/ssdk"],
       "executor": "nx:run-commands",
       "dependsOn": ["compile"],
@@ -464,6 +471,7 @@ exports[`smithyProjectGenerator > should generate smithy project with subdirecto
     },
     "compile": {
       "cache": true,
+      "inputs": ["default"],
       "outputs": [
         "{workspaceRoot}/dist/{projectRoot}/smithy",
         "{workspaceRoot}/dist/{projectRoot}/build/openapi"
@@ -484,6 +492,7 @@ exports[`smithyProjectGenerator > should generate smithy project with subdirecto
     },
     "generate-ssdk": {
       "cache": true,
+      "inputs": ["default"],
       "outputs": ["{workspaceRoot}/dist/{projectRoot}/build/ssdk"],
       "executor": "nx:run-commands",
       "dependsOn": ["compile"],

package/src/smithy/project/generator.d.ts

@@ -62,12 +62,21 @@ export declare const smithyGenerateSsdkCommands: () => string[];
  * restoring `compile` from cache would otherwise discard the Server SDK beside it.
  */
 export declare const smithyCompileOutputs: (type: SmithyProjectGeneratorSchema["type"]) => string[];
+/**
+ * What a Smithy build target hashes: its own sources plus the outputs of the
+ * tasks it depends on. That covers a consumed shape library's output only
+ * when nx.json's `default` named input carries the `dependentTasksOutputFiles`
+ * entry, which only ts/lib/generator.ts writes - a Smithy-only workspace has
+ * no such entry, so `default` falls back to Nx's `{projectRoot}/**\/*`.
+ */
+export declare const SMITHY_TARGET_INPUTS: string[];
 /**
  * The target that builds a service's Server SDK, shared with the migration moving
  * an existing project onto it.
  */
 export declare const smithyGenerateSsdkTarget: () => {
     cache: boolean;
+    inputs: string[];
     outputs: string[];
     executor: string;
     dependsOn: string[];

package/src/smithy/project/generator.js

@@ -112,11 +112,23 @@ const BUILD_DIR = 'dist/{projectRoot}/build';
         `{workspaceRoot}/${SMITHY_OUT_DIR}`,
         type === 'shapes' ? `{workspaceRoot}/${BUILD_DIR}/model.json` : `{workspaceRoot}/${BUILD_DIR}/openapi`
     ];
+/**
+ * What a Smithy build target hashes: its own sources plus the outputs of the
+ * tasks it depends on. That covers a consumed shape library's output only
+ * when nx.json's `default` named input carries the `dependentTasksOutputFiles`
+ * entry, which only ts/lib/generator.ts writes - a Smithy-only workspace has
+ * no such entry, so `default` falls back to Nx's `{projectRoot}/**\/*`.
+ */ export const SMITHY_TARGET_INPUTS = [
+    'default'
+];
 /**
  * The target that builds a service's Server SDK, shared with the migration moving
  * an existing project onto it.
  */ export const smithyGenerateSsdkTarget = ()=>({
         cache: true,
+        inputs: [
+            ...SMITHY_TARGET_INPUTS
+        ],
         outputs: [
             `{workspaceRoot}/${BUILD_DIR}/ssdk`
         ],
@@ -176,6 +188,9 @@ export const smithyProjectGenerator = async (tree, options)=>{
                 },
                 compile: {
                     cache: true,
+                    inputs: [
+                        ...SMITHY_TARGET_INPUTS
+                    ],
                     outputs: smithyCompileOutputs(type),
                     executor: 'nx:run-commands',
                     options: {

package/src/smithy/project/generator.js.map

@@ -1 +1 @@
-{"version":3,"sources":["../../../../../../packages/nx-plugin/src/smithy/project/generator.ts"],"sourcesContent":["/**\n * Copyright Amazon.com, Inc. or its affiliates. All Rights Reserved.\n * SPDX-License-Identifier: Apache-2.0\n */\nimport {\n  addProjectConfiguration,\n  type GeneratorCallback,\n  generateFiles,\n  joinPathFragments,\n  OverwriteStrategy,\n  type Tree,\n} from '@nx/devkit';\nimport { getTsLibDetails } from '../../ts/lib/generator.js';\nimport { addTsDependencies } from '../../utils/add-dependencies.js';\nimport {\n  declareDependencies,\n  ownedElsewhere,\n} from '../../utils/declared-dependencies.js';\nimport { formatFilesInSubtree } from '../../utils/format.js';\nimport { FS_DEPENDENCIES, FsCommands } from '../../utils/fs.js';\nimport { installDependencies } from '../../utils/install.js';\nimport { addGeneratorMetricsIfApplicable } from '../../utils/metrics.js';\nimport { toClassName, toKebabCase } from '../../utils/names.js';\nimport { getNpmScope } from '../../utils/npm-scope.js';\nimport {\n  addGeneratorMetadata,\n  getGeneratorInfo,\n  type NxGeneratorInfo,\n  projectExists,\n} from '../../utils/nx.js';\nimport { getRelativePathToRootByDirectory } from '../../utils/paths.js';\nimport {\n  smithyCliCommand,\n  smithyMavenVersions,\n  warnIfSmithyMissing,\n} from '../../utils/smithy.js';\nimport type { SmithyProjectGeneratorSchema } from './schema';\n\n/** The metadata this generator records, which its predicates read. */\nexport interface SmithyProjectMetadata {\n  readonly smithyType: NonNullable<SmithyProjectGeneratorSchema['type']>;\n  readonly namespace: string;\n}\n\n/**\n * Only a service project generates a Server SDK, so only a service needs the\n * bundler that turns it into the single module its backend imports. A shape\n * library assembles a model and stops.\n */\nconst isService = (metadata: SmithyProjectMetadata) =>\n  metadata.smithyType === 'service';\n\n/**\n * Everything a Smithy build runs, all of it workspace tooling in the root\n * manifest rather than anything the model itself imports.\n *\n * Neither the Smithy CLI nor `mise` is among them: the compile target fetches mise\n * with `npx` and mise resolves the CLI, so neither is a workspace dependency — see\n * `utils/smithy.ts`.\n */\nexport const DEPENDENCIES = declareDependencies<SmithyProjectMetadata>()({\n  ts: [\n    // Added to the root by `FsCommands` as it builds each command.\n    ...ownedElsewhere(FS_DEPENDENCIES),\n    { name: 'rolldown', dev: true, root: true, when: isService },\n    { name: 'rolldown-plugin-dts', dev: true, root: true, when: isService },\n    // Resolved by `rolldown-plugin-dts` to emit the bundled declaration.\n    { name: 'typescript', dev: true, root: true, when: isService },\n  ],\n});\n\nexport const SMITHY_PROJECT_GENERATOR_INFO: NxGeneratorInfo = getGeneratorInfo(\n  import.meta.filename,\n);\n\n/**\n * Where the Smithy CLI writes its artifacts, and where the build publishes the\n * ones consumers read. Both sit under `dist` so a build writes nothing into the\n * project, keeping the source tree clean and the target's outputs cacheable.\n *\n * The CLI's own output is kept beside the published tree rather than inside it:\n * it holds the generated SSDK package and its installed `node_modules`, which\n * must not be mistaken for a build artifact.\n */\nconst SMITHY_OUT_DIR = 'dist/{projectRoot}/smithy';\nconst BUILD_DIR = 'dist/{projectRoot}/build';\n\n/** The projection every generated `smithy-build.json` builds. */\nconst SOURCE_PROJECTION = `${SMITHY_OUT_DIR}/source`;\n\n/** Where the generated TypeScript Server SDK lands before it is bundled. */\nconst SSDK_CODEGEN_DIR = `${SOURCE_PROJECTION}/typescript-ssdk-codegen`;\n\n/**\n * The commands that build a Smithy project's model, run from the workspace root.\n *\n * This is the whole of a shape library's build. A service's Server SDK is built\n * separately by {@link smithyGenerateSsdkCommands}, from the codegen output this\n * leaves under {@link SMITHY_OUT_DIR}.\n */\nexport const smithyCompileCommands = (\n  cmd: FsCommands<typeof DEPENDENCIES>,\n  type: SmithyProjectGeneratorSchema['type'],\n): string[] => [\n  cmd.rm(BUILD_DIR),\n  cmd.rm(SMITHY_OUT_DIR),\n  cmd.mkdir(BUILD_DIR),\n  // `imports` in smithy-build.json resolve relative to that file, so a shape\n  // library is referenced by its path from the consuming project.\n  `${smithyCliCommand()} build -c {projectRoot}/smithy-build.json --output ${SMITHY_OUT_DIR}`,\n  ...(type === 'shapes'\n    ? [\n        cmd.cpFile(\n          `${SOURCE_PROJECTION}/model/model.json`,\n          `${BUILD_DIR}/model.json`,\n        ),\n      ]\n    : [\n        cmd.mkdir(`${BUILD_DIR}/openapi`),\n        // Named after the service shape by the OpenAPI plugin, so it is matched\n        // rather than named, and published under a stable name.\n        cmd.cpGlobToFile(\n          `${SOURCE_PROJECTION}/openapi/*.openapi.json`,\n          `${BUILD_DIR}/openapi`,\n          'openapi.json',\n        ),\n      ]),\n];\n\n/**\n * The commands that turn a service's generated TypeScript Server SDK into the\n * single module its consumer imports, run from the workspace root.\n *\n * Only a service has one, and it reads what the model build left behind, so this\n * runs after `compile`.\n */\nexport const smithyGenerateSsdkCommands = (): string[] => [\n  // `npm` regardless of the workspace's package manager: this installs a generated\n  // package under `dist` that is not a workspace member, and npm ships with Node so\n  // it is always present. It reads the user's `.npmrc`, so a private registry still\n  // applies. `--include=dev` because the bundler resolves types from the generated\n  // package's devDependencies, which `NODE_ENV=production` would otherwise omit.\n  `npm install --prefix ${SSDK_CODEGEN_DIR} --include=dev --ignore-scripts --no-audit --no-fund`,\n  // Bundled straight from the generated TypeScript sources, emitting the module and\n  // its declarations together — see ssdk.rolldown.config.mjs for why the sources\n  // rather than a `tsc` pre-pass.\n  `rolldown -c {projectRoot}/ssdk.rolldown.config.mjs`,\n];\n\n/**\n * What the model build publishes, listed per artifact rather than as the whole\n * `build` directory: a service's `generate-ssdk` writes into that directory too, and\n * restoring `compile` from cache would otherwise discard the Server SDK beside it.\n */\nexport const smithyCompileOutputs = (\n  type: SmithyProjectGeneratorSchema['type'],\n): string[] => [\n  `{workspaceRoot}/${SMITHY_OUT_DIR}`,\n  type === 'shapes'\n    ? `{workspaceRoot}/${BUILD_DIR}/model.json`\n    : `{workspaceRoot}/${BUILD_DIR}/openapi`,\n];\n\n/**\n * The target that builds a service's Server SDK, shared with the migration moving\n * an existing project onto it.\n */\nexport const smithyGenerateSsdkTarget = () => ({\n  cache: true,\n  outputs: [`{workspaceRoot}/${BUILD_DIR}/ssdk`],\n  executor: 'nx:run-commands',\n  dependsOn: ['compile'],\n  options: {\n    commands: smithyGenerateSsdkCommands(),\n    parallel: false,\n    cwd: '{workspaceRoot}',\n  },\n});\n\n/**\n * Write the rolldown config that bundles a service's generated Server SDK.\n *\n * Shared with the migration moving an existing project off the container build,\n * so a migrated project's config cannot drift from a freshly generated one.\n */\nexport const writeSsdkBundleConfig = (tree: Tree, projectRoot: string): void =>\n  generateFiles(\n    tree,\n    joinPathFragments(import.meta.dirname, 'files', 'ssdk-bundle'),\n    projectRoot,\n    // The config's paths are workspace-root relative, so it needs only the\n    // project's root — the compile target runs from the workspace root.\n    { projectRoot },\n    // Generated configuration rather than anything the user edits, so a re-run\n    // refreshes it — unlike the models beside it.\n    { overwriteStrategy: OverwriteStrategy.Overwrite },\n  );\n\nexport const smithyProjectGenerator = async (\n  tree: Tree,\n  options: SmithyProjectGeneratorSchema,\n): Promise<GeneratorCallback> => {\n  const cmd = new FsCommands(tree, DEPENDENCIES);\n  const type = options.type ?? 'service';\n\n  // Create project.json\n  const { fullyQualifiedName, dir } = getTsLibDetails(tree, options);\n\n  if (!projectExists(tree, fullyQualifiedName)) {\n    addProjectConfiguration(tree, fullyQualifiedName, {\n      name: fullyQualifiedName,\n      root: dir,\n      sourceRoot: joinPathFragments(dir, 'src'),\n      projectType: 'library',\n      targets: {\n        build: {\n          dependsOn:\n            type === 'shapes' ? ['compile'] : ['compile', 'generate-ssdk'],\n        },\n        // Everything this project's build does is artifact production, so\n        // `assemble` carries the same dependencies.\n        assemble: {\n          dependsOn:\n            type === 'shapes' ? ['compile'] : ['compile', 'generate-ssdk'],\n        },\n        compile: {\n          cache: true,\n          outputs: smithyCompileOutputs(type),\n          executor: 'nx:run-commands',\n          options: {\n            commands: smithyCompileCommands(cmd, type),\n            parallel: false,\n            cwd: '{workspaceRoot}',\n          },\n        },\n        // Only a service generates a Server SDK, and it is built from what the\n        // model build leaves behind.\n        ...(type === 'shapes'\n          ? {}\n          : { 'generate-ssdk': smithyGenerateSsdkTarget() }),\n      },\n    });\n  }\n\n  const serviceName = options.serviceName ?? options.name;\n  const serviceNameClassName = toClassName(serviceName);\n  const serviceNameKebabCase = toKebabCase(serviceName);\n  const scope = getNpmScope(tree);\n  const namespace = options.namespace ?? toKebabCase(scope).replace(/-/g, '.');\n\n  generateFiles(\n    tree,\n    joinPathFragments(import.meta.dirname, 'files', type),\n    dir,\n    {\n      namespace,\n      serviceNameClassName,\n      serviceNameKebabCase,\n      scope,\n      projectRoot: dir,\n      relativePathToWorkspaceRoot: getRelativePathToRootByDirectory(dir),\n      ...smithyMavenVersions(),\n    },\n    {\n      // Smithy models are user-owned — a re-run must not discard edits\n      overwriteStrategy: OverwriteStrategy.KeepExisting,\n    },\n  );\n\n  if (type === 'service') {\n    writeSsdkBundleConfig(tree, dir);\n  }\n\n  // Recorded here and read by the declaration's predicates, so the packages\n  // added below are exactly the ones the version sync will own.\n  const metadata: SmithyProjectMetadata = { smithyType: type, namespace };\n\n  addGeneratorMetadata(\n    tree,\n    fullyQualifiedName,\n    SMITHY_PROJECT_GENERATOR_INFO,\n    {\n      ...metadata,\n      ...(type === 'service' ? { apiName: options.name } : {}),\n    },\n  );\n\n  // No projectRoot: a Smithy model project has no manifest of its own, and every\n  // dependency here is workspace tooling the build runs rather than anything the\n  // model imports.\n  addTsDependencies(tree, DEPENDENCIES, { metadata });\n\n  await addGeneratorMetricsIfApplicable(tree, [SMITHY_PROJECT_GENERATOR_INFO]);\n\n  // On Windows the build runs the Smithy CLI from the PATH rather than through\n  // mise, so flag a missing prerequisite while the project is still being set up.\n  warnIfSmithyMissing();\n\n  await formatFilesInSubtree(tree);\n  return () =>\n    installDependencies(tree, options.preferInstallDependencies, {\n      languages: ['typescript'],\n    });\n};\n\nexport default smithyProjectGenerator;\n"],"names":["addProjectConfiguration","generateFiles","joinPathFragments","OverwriteStrategy","getTsLibDetails","addTsDependencies","declareDependencies","ownedElsewhere","formatFilesInSubtree","FS_DEPENDENCIES","FsCommands","installDependencies","addGeneratorMetricsIfApplicable","toClassName","toKebabCase","getNpmScope","addGeneratorMetadata","getGeneratorInfo","projectExists","getRelativePathToRootByDirectory","smithyCliCommand","smithyMavenVersions","warnIfSmithyMissing","isService","metadata","smithyType","DEPENDENCIES","ts","name","dev","root","when","SMITHY_PROJECT_GENERATOR_INFO","filename","SMITHY_OUT_DIR","BUILD_DIR","SOURCE_PROJECTION","SSDK_CODEGEN_DIR","smithyCompileCommands","cmd","type","rm","mkdir","cpFile","cpGlobToFile","smithyGenerateSsdkCommands","smithyCompileOutputs","smithyGenerateSsdkTarget","cache","outputs","executor","dependsOn","options","commands","parallel","cwd","writeSsdkBundleConfig","tree","projectRoot","dirname","overwriteStrategy","Overwrite","smithyProjectGenerator","fullyQualifiedName","dir","sourceRoot","projectType","targets","build","assemble","compile","serviceName","serviceNameClassName","serviceNameKebabCase","scope","namespace","replace","relativePathToWorkspaceRoot","KeepExisting","apiName","preferInstallDependencies","languages"],"mappings":"AAAA;;;CAGC,GACD,SACEA,uBAAuB,EAEvBC,aAAa,EACbC,iBAAiB,EACjBC,iBAAiB,QAEZ,aAAa;AACpB,SAASC,eAAe,QAAQ,4BAA4B;AAC5D,SAASC,iBAAiB,QAAQ,kCAAkC;AACpE,SACEC,mBAAmB,EACnBC,cAAc,QACT,uCAAuC;AAC9C,SAASC,oBAAoB,QAAQ,wBAAwB;AAC7D,SAASC,eAAe,EAAEC,UAAU,QAAQ,oBAAoB;AAChE,SAASC,mBAAmB,QAAQ,yBAAyB;AAC7D,SAASC,+BAA+B,QAAQ,yBAAyB;AACzE,SAASC,WAAW,EAAEC,WAAW,QAAQ,uBAAuB;AAChE,SAASC,WAAW,QAAQ,2BAA2B;AACvD,SACEC,oBAAoB,EACpBC,gBAAgB,EAEhBC,aAAa,QACR,oBAAoB;AAC3B,SAASC,gCAAgC,QAAQ,uBAAuB;AACxE,SACEC,gBAAgB,EAChBC,mBAAmB,EACnBC,mBAAmB,QACd,wBAAwB;AAS/B;;;;CAIC,GACD,MAAMC,YAAY,CAACC,WACjBA,SAASC,UAAU,KAAK;AAE1B;;;;;;;CAOC,GACD,OAAO,MAAMC,eAAepB,sBAA6C;IACvEqB,IAAI;QACF,+DAA+D;WAC5DpB,eAAeE;QAClB;YAAEmB,MAAM;YAAYC,KAAK;YAAMC,MAAM;YAAMC,MAAMR;QAAU;QAC3D;YAAEK,MAAM;YAAuBC,KAAK;YAAMC,MAAM;YAAMC,MAAMR;QAAU;QACtE,qEAAqE;QACrE;YAAEK,MAAM;YAAcC,KAAK;YAAMC,MAAM;YAAMC,MAAMR;QAAU;KAC9D;AACH,GAAG;AAEH,OAAO,MAAMS,gCAAiDf,iBAC5D,YAAYgB,QAAQ,EACpB;AAEF;;;;;;;;CAQC,GACD,MAAMC,iBAAiB;AACvB,MAAMC,YAAY;AAElB,+DAA+D,GAC/D,MAAMC,oBAAoB,GAAGF,eAAe,OAAO,CAAC;AAEpD,0EAA0E,GAC1E,MAAMG,mBAAmB,GAAGD,kBAAkB,wBAAwB,CAAC;AAEvE;;;;;;CAMC,GACD,OAAO,MAAME,wBAAwB,CACnCC,KACAC,OACa;QACbD,IAAIE,EAAE,CAACN;QACPI,IAAIE,EAAE,CAACP;QACPK,IAAIG,KAAK,CAACP;QACV,2EAA2E;QAC3E,gEAAgE;QAChE,GAAGf,mBAAmB,mDAAmD,EAAEc,gBAAgB;WACvFM,SAAS,WACT;YACED,IAAII,MAAM,CACR,GAAGP,kBAAkB,iBAAiB,CAAC,EACvC,GAAGD,UAAU,WAAW,CAAC;SAE5B,GACD;YACEI,IAAIG,KAAK,CAAC,GAAGP,UAAU,QAAQ,CAAC;YAChC,wEAAwE;YACxE,wDAAwD;YACxDI,IAAIK,YAAY,CACd,GAAGR,kBAAkB,uBAAuB,CAAC,EAC7C,GAAGD,UAAU,QAAQ,CAAC,EACtB;SAEH;KACN,CAAC;AAEF;;;;;;CAMC,GACD,OAAO,MAAMU,6BAA6B,IAAgB;QACxD,iFAAiF;QACjF,kFAAkF;QAClF,kFAAkF;QAClF,iFAAiF;QACjF,+EAA+E;QAC/E,CAAC,qBAAqB,EAAER,iBAAiB,oDAAoD,CAAC;QAC9F,kFAAkF;QAClF,+EAA+E;QAC/E,gCAAgC;QAChC,CAAC,kDAAkD,CAAC;KACrD,CAAC;AAEF;;;;CAIC,GACD,OAAO,MAAMS,uBAAuB,CAClCN,OACa;QACb,CAAC,gBAAgB,EAAEN,gBAAgB;QACnCM,SAAS,WACL,CAAC,gBAAgB,EAAEL,UAAU,WAAW,CAAC,GACzC,CAAC,gBAAgB,EAAEA,UAAU,QAAQ,CAAC;KAC3C,CAAC;AAEF;;;CAGC,GACD,OAAO,MAAMY,2BAA2B,IAAO,CAAA;QAC7CC,OAAO;QACPC,SAAS;YAAC,CAAC,gBAAgB,EAAEd,UAAU,KAAK,CAAC;SAAC;QAC9Ce,UAAU;QACVC,WAAW;YAAC;SAAU;QACtBC,SAAS;YACPC,UAAUR;YACVS,UAAU;YACVC,KAAK;QACP;IACF,CAAA,EAAG;AAEH;;;;;CAKC,GACD,OAAO,MAAMC,wBAAwB,CAACC,MAAYC,cAChDzD,cACEwD,MACAvD,kBAAkB,YAAYyD,OAAO,EAAE,SAAS,gBAChDD,aACA,uEAAuE;IACvE,oEAAoE;IACpE;QAAEA;IAAY,GACd,2EAA2E;IAC3E,8CAA8C;IAC9C;QAAEE,mBAAmBzD,kBAAkB0D,SAAS;IAAC,GACjD;AAEJ,OAAO,MAAMC,yBAAyB,OACpCL,MACAL;IAEA,MAAMb,MAAM,IAAI7B,WAAW+C,MAAM/B;IACjC,MAAMc,OAAOY,QAAQZ,IAAI,IAAI;IAE7B,sBAAsB;IACtB,MAAM,EAAEuB,kBAAkB,EAAEC,GAAG,EAAE,GAAG5D,gBAAgBqD,MAAML;IAE1D,IAAI,CAAClC,cAAcuC,MAAMM,qBAAqB;QAC5C/D,wBAAwByD,MAAMM,oBAAoB;YAChDnC,MAAMmC;YACNjC,MAAMkC;YACNC,YAAY/D,kBAAkB8D,KAAK;YACnCE,aAAa;YACbC,SAAS;gBACPC,OAAO;oBACLjB,WACEX,SAAS,WAAW;wBAAC;qBAAU,GAAG;wBAAC;wBAAW;qBAAgB;gBAClE;gBACA,kEAAkE;gBAClE,4CAA4C;gBAC5C6B,UAAU;oBACRlB,WACEX,SAAS,WAAW;wBAAC;qBAAU,GAAG;wBAAC;wBAAW;qBAAgB;gBAClE;gBACA8B,SAAS;oBACPtB,OAAO;oBACPC,SAASH,qBAAqBN;oBAC9BU,UAAU;oBACVE,SAAS;wBACPC,UAAUf,sBAAsBC,KAAKC;wBACrCc,UAAU;wBACVC,KAAK;oBACP;gBACF;gBACA,uEAAuE;gBACvE,6BAA6B;gBAC7B,GAAIf,SAAS,WACT,CAAC,IACD;oBAAE,iBAAiBO;gBAA2B,CAAC;YACrD;QACF;IACF;IAEA,MAAMwB,cAAcnB,QAAQmB,WAAW,IAAInB,QAAQxB,IAAI;IACvD,MAAM4C,uBAAuB3D,YAAY0D;IACzC,MAAME,uBAAuB3D,YAAYyD;IACzC,MAAMG,QAAQ3D,YAAY0C;IAC1B,MAAMkB,YAAYvB,QAAQuB,SAAS,IAAI7D,YAAY4D,OAAOE,OAAO,CAAC,MAAM;IAExE3E,cACEwD,MACAvD,kBAAkB,YAAYyD,OAAO,EAAE,SAASnB,OAChDwB,KACA;QACEW;QACAH;QACAC;QACAC;QACAhB,aAAaM;QACba,6BAA6B1D,iCAAiC6C;QAC9D,GAAG3C,qBAAqB;IAC1B,GACA;QACE,iEAAiE;QACjEuC,mBAAmBzD,kBAAkB2E,YAAY;IACnD;IAGF,IAAItC,SAAS,WAAW;QACtBgB,sBAAsBC,MAAMO;IAC9B;IAEA,0EAA0E;IAC1E,8DAA8D;IAC9D,MAAMxC,WAAkC;QAAEC,YAAYe;QAAMmC;IAAU;IAEtE3D,qBACEyC,MACAM,oBACA/B,+BACA;QACE,GAAGR,QAAQ;QACX,GAAIgB,SAAS,YAAY;YAAEuC,SAAS3B,QAAQxB,IAAI;QAAC,IAAI,CAAC,CAAC;IACzD;IAGF,+EAA+E;IAC/E,+EAA+E;IAC/E,iBAAiB;IACjBvB,kBAAkBoD,MAAM/B,cAAc;QAAEF;IAAS;IAEjD,MAAMZ,gCAAgC6C,MAAM;QAACzB;KAA8B;IAE3E,6EAA6E;IAC7E,gFAAgF;IAChFV;IAEA,MAAMd,qBAAqBiD;IAC3B,OAAO,IACL9C,oBAAoB8C,MAAML,QAAQ4B,yBAAyB,EAAE;YAC3DC,WAAW;gBAAC;aAAa;QAC3B;AACJ,EAAE;AAEF,eAAenB,uBAAuB"}
+{"version":3,"sources":["../../../../../../packages/nx-plugin/src/smithy/project/generator.ts"],"sourcesContent":["/**\n * Copyright Amazon.com, Inc. or its affiliates. All Rights Reserved.\n * SPDX-License-Identifier: Apache-2.0\n */\nimport {\n  addProjectConfiguration,\n  type GeneratorCallback,\n  generateFiles,\n  joinPathFragments,\n  OverwriteStrategy,\n  type Tree,\n} from '@nx/devkit';\nimport { getTsLibDetails } from '../../ts/lib/generator.js';\nimport { addTsDependencies } from '../../utils/add-dependencies.js';\nimport {\n  declareDependencies,\n  ownedElsewhere,\n} from '../../utils/declared-dependencies.js';\nimport { formatFilesInSubtree } from '../../utils/format.js';\nimport { FS_DEPENDENCIES, FsCommands } from '../../utils/fs.js';\nimport { installDependencies } from '../../utils/install.js';\nimport { addGeneratorMetricsIfApplicable } from '../../utils/metrics.js';\nimport { toClassName, toKebabCase } from '../../utils/names.js';\nimport { getNpmScope } from '../../utils/npm-scope.js';\nimport {\n  addGeneratorMetadata,\n  getGeneratorInfo,\n  type NxGeneratorInfo,\n  projectExists,\n} from '../../utils/nx.js';\nimport { getRelativePathToRootByDirectory } from '../../utils/paths.js';\nimport {\n  smithyCliCommand,\n  smithyMavenVersions,\n  warnIfSmithyMissing,\n} from '../../utils/smithy.js';\nimport type { SmithyProjectGeneratorSchema } from './schema';\n\n/** The metadata this generator records, which its predicates read. */\nexport interface SmithyProjectMetadata {\n  readonly smithyType: NonNullable<SmithyProjectGeneratorSchema['type']>;\n  readonly namespace: string;\n}\n\n/**\n * Only a service project generates a Server SDK, so only a service needs the\n * bundler that turns it into the single module its backend imports. A shape\n * library assembles a model and stops.\n */\nconst isService = (metadata: SmithyProjectMetadata) =>\n  metadata.smithyType === 'service';\n\n/**\n * Everything a Smithy build runs, all of it workspace tooling in the root\n * manifest rather than anything the model itself imports.\n *\n * Neither the Smithy CLI nor `mise` is among them: the compile target fetches mise\n * with `npx` and mise resolves the CLI, so neither is a workspace dependency — see\n * `utils/smithy.ts`.\n */\nexport const DEPENDENCIES = declareDependencies<SmithyProjectMetadata>()({\n  ts: [\n    // Added to the root by `FsCommands` as it builds each command.\n    ...ownedElsewhere(FS_DEPENDENCIES),\n    { name: 'rolldown', dev: true, root: true, when: isService },\n    { name: 'rolldown-plugin-dts', dev: true, root: true, when: isService },\n    // Resolved by `rolldown-plugin-dts` to emit the bundled declaration.\n    { name: 'typescript', dev: true, root: true, when: isService },\n  ],\n});\n\nexport const SMITHY_PROJECT_GENERATOR_INFO: NxGeneratorInfo = getGeneratorInfo(\n  import.meta.filename,\n);\n\n/**\n * Where the Smithy CLI writes its artifacts, and where the build publishes the\n * ones consumers read. Both sit under `dist` so a build writes nothing into the\n * project, keeping the source tree clean and the target's outputs cacheable.\n *\n * The CLI's own output is kept beside the published tree rather than inside it:\n * it holds the generated SSDK package and its installed `node_modules`, which\n * must not be mistaken for a build artifact.\n */\nconst SMITHY_OUT_DIR = 'dist/{projectRoot}/smithy';\nconst BUILD_DIR = 'dist/{projectRoot}/build';\n\n/** The projection every generated `smithy-build.json` builds. */\nconst SOURCE_PROJECTION = `${SMITHY_OUT_DIR}/source`;\n\n/** Where the generated TypeScript Server SDK lands before it is bundled. */\nconst SSDK_CODEGEN_DIR = `${SOURCE_PROJECTION}/typescript-ssdk-codegen`;\n\n/**\n * The commands that build a Smithy project's model, run from the workspace root.\n *\n * This is the whole of a shape library's build. A service's Server SDK is built\n * separately by {@link smithyGenerateSsdkCommands}, from the codegen output this\n * leaves under {@link SMITHY_OUT_DIR}.\n */\nexport const smithyCompileCommands = (\n  cmd: FsCommands<typeof DEPENDENCIES>,\n  type: SmithyProjectGeneratorSchema['type'],\n): string[] => [\n  cmd.rm(BUILD_DIR),\n  cmd.rm(SMITHY_OUT_DIR),\n  cmd.mkdir(BUILD_DIR),\n  // `imports` in smithy-build.json resolve relative to that file, so a shape\n  // library is referenced by its path from the consuming project.\n  `${smithyCliCommand()} build -c {projectRoot}/smithy-build.json --output ${SMITHY_OUT_DIR}`,\n  ...(type === 'shapes'\n    ? [\n        cmd.cpFile(\n          `${SOURCE_PROJECTION}/model/model.json`,\n          `${BUILD_DIR}/model.json`,\n        ),\n      ]\n    : [\n        cmd.mkdir(`${BUILD_DIR}/openapi`),\n        // Named after the service shape by the OpenAPI plugin, so it is matched\n        // rather than named, and published under a stable name.\n        cmd.cpGlobToFile(\n          `${SOURCE_PROJECTION}/openapi/*.openapi.json`,\n          `${BUILD_DIR}/openapi`,\n          'openapi.json',\n        ),\n      ]),\n];\n\n/**\n * The commands that turn a service's generated TypeScript Server SDK into the\n * single module its consumer imports, run from the workspace root.\n *\n * Only a service has one, and it reads what the model build left behind, so this\n * runs after `compile`.\n */\nexport const smithyGenerateSsdkCommands = (): string[] => [\n  // `npm` regardless of the workspace's package manager: this installs a generated\n  // package under `dist` that is not a workspace member, and npm ships with Node so\n  // it is always present. It reads the user's `.npmrc`, so a private registry still\n  // applies. `--include=dev` because the bundler resolves types from the generated\n  // package's devDependencies, which `NODE_ENV=production` would otherwise omit.\n  `npm install --prefix ${SSDK_CODEGEN_DIR} --include=dev --ignore-scripts --no-audit --no-fund`,\n  // Bundled straight from the generated TypeScript sources, emitting the module and\n  // its declarations together — see ssdk.rolldown.config.mjs for why the sources\n  // rather than a `tsc` pre-pass.\n  `rolldown -c {projectRoot}/ssdk.rolldown.config.mjs`,\n];\n\n/**\n * What the model build publishes, listed per artifact rather than as the whole\n * `build` directory: a service's `generate-ssdk` writes into that directory too, and\n * restoring `compile` from cache would otherwise discard the Server SDK beside it.\n */\nexport const smithyCompileOutputs = (\n  type: SmithyProjectGeneratorSchema['type'],\n): string[] => [\n  `{workspaceRoot}/${SMITHY_OUT_DIR}`,\n  type === 'shapes'\n    ? `{workspaceRoot}/${BUILD_DIR}/model.json`\n    : `{workspaceRoot}/${BUILD_DIR}/openapi`,\n];\n\n/**\n * What a Smithy build target hashes: its own sources plus the outputs of the\n * tasks it depends on. That covers a consumed shape library's output only\n * when nx.json's `default` named input carries the `dependentTasksOutputFiles`\n * entry, which only ts/lib/generator.ts writes - a Smithy-only workspace has\n * no such entry, so `default` falls back to Nx's `{projectRoot}/**\\/*`.\n */\nexport const SMITHY_TARGET_INPUTS = ['default'];\n\n/**\n * The target that builds a service's Server SDK, shared with the migration moving\n * an existing project onto it.\n */\nexport const smithyGenerateSsdkTarget = () => ({\n  cache: true,\n  inputs: [...SMITHY_TARGET_INPUTS],\n  outputs: [`{workspaceRoot}/${BUILD_DIR}/ssdk`],\n  executor: 'nx:run-commands',\n  dependsOn: ['compile'],\n  options: {\n    commands: smithyGenerateSsdkCommands(),\n    parallel: false,\n    cwd: '{workspaceRoot}',\n  },\n});\n\n/**\n * Write the rolldown config that bundles a service's generated Server SDK.\n *\n * Shared with the migration moving an existing project off the container build,\n * so a migrated project's config cannot drift from a freshly generated one.\n */\nexport const writeSsdkBundleConfig = (tree: Tree, projectRoot: string): void =>\n  generateFiles(\n    tree,\n    joinPathFragments(import.meta.dirname, 'files', 'ssdk-bundle'),\n    projectRoot,\n    // The config's paths are workspace-root relative, so it needs only the\n    // project's root — the compile target runs from the workspace root.\n    { projectRoot },\n    // Generated configuration rather than anything the user edits, so a re-run\n    // refreshes it — unlike the models beside it.\n    { overwriteStrategy: OverwriteStrategy.Overwrite },\n  );\n\nexport const smithyProjectGenerator = async (\n  tree: Tree,\n  options: SmithyProjectGeneratorSchema,\n): Promise<GeneratorCallback> => {\n  const cmd = new FsCommands(tree, DEPENDENCIES);\n  const type = options.type ?? 'service';\n\n  // Create project.json\n  const { fullyQualifiedName, dir } = getTsLibDetails(tree, options);\n\n  if (!projectExists(tree, fullyQualifiedName)) {\n    addProjectConfiguration(tree, fullyQualifiedName, {\n      name: fullyQualifiedName,\n      root: dir,\n      sourceRoot: joinPathFragments(dir, 'src'),\n      projectType: 'library',\n      targets: {\n        build: {\n          dependsOn:\n            type === 'shapes' ? ['compile'] : ['compile', 'generate-ssdk'],\n        },\n        // Everything this project's build does is artifact production, so\n        // `assemble` carries the same dependencies.\n        assemble: {\n          dependsOn:\n            type === 'shapes' ? ['compile'] : ['compile', 'generate-ssdk'],\n        },\n        compile: {\n          cache: true,\n          inputs: [...SMITHY_TARGET_INPUTS],\n          outputs: smithyCompileOutputs(type),\n          executor: 'nx:run-commands',\n          options: {\n            commands: smithyCompileCommands(cmd, type),\n            parallel: false,\n            cwd: '{workspaceRoot}',\n          },\n        },\n        // Only a service generates a Server SDK, and it is built from what the\n        // model build leaves behind.\n        ...(type === 'shapes'\n          ? {}\n          : { 'generate-ssdk': smithyGenerateSsdkTarget() }),\n      },\n    });\n  }\n\n  const serviceName = options.serviceName ?? options.name;\n  const serviceNameClassName = toClassName(serviceName);\n  const serviceNameKebabCase = toKebabCase(serviceName);\n  const scope = getNpmScope(tree);\n  const namespace = options.namespace ?? toKebabCase(scope).replace(/-/g, '.');\n\n  generateFiles(\n    tree,\n    joinPathFragments(import.meta.dirname, 'files', type),\n    dir,\n    {\n      namespace,\n      serviceNameClassName,\n      serviceNameKebabCase,\n      scope,\n      projectRoot: dir,\n      relativePathToWorkspaceRoot: getRelativePathToRootByDirectory(dir),\n      ...smithyMavenVersions(),\n    },\n    {\n      // Smithy models are user-owned — a re-run must not discard edits\n      overwriteStrategy: OverwriteStrategy.KeepExisting,\n    },\n  );\n\n  if (type === 'service') {\n    writeSsdkBundleConfig(tree, dir);\n  }\n\n  // Recorded here and read by the declaration's predicates, so the packages\n  // added below are exactly the ones the version sync will own.\n  const metadata: SmithyProjectMetadata = { smithyType: type, namespace };\n\n  addGeneratorMetadata(\n    tree,\n    fullyQualifiedName,\n    SMITHY_PROJECT_GENERATOR_INFO,\n    {\n      ...metadata,\n      ...(type === 'service' ? { apiName: options.name } : {}),\n    },\n  );\n\n  // No projectRoot: a Smithy model project has no manifest of its own, and every\n  // dependency here is workspace tooling the build runs rather than anything the\n  // model imports.\n  addTsDependencies(tree, DEPENDENCIES, { metadata });\n\n  await addGeneratorMetricsIfApplicable(tree, [SMITHY_PROJECT_GENERATOR_INFO]);\n\n  // On Windows the build runs the Smithy CLI from the PATH rather than through\n  // mise, so flag a missing prerequisite while the project is still being set up.\n  warnIfSmithyMissing();\n\n  await formatFilesInSubtree(tree);\n  return () =>\n    installDependencies(tree, options.preferInstallDependencies, {\n      languages: ['typescript'],\n    });\n};\n\nexport default smithyProjectGenerator;\n"],"names":["addProjectConfiguration","generateFiles","joinPathFragments","OverwriteStrategy","getTsLibDetails","addTsDependencies","declareDependencies","ownedElsewhere","formatFilesInSubtree","FS_DEPENDENCIES","FsCommands","installDependencies","addGeneratorMetricsIfApplicable","toClassName","toKebabCase","getNpmScope","addGeneratorMetadata","getGeneratorInfo","projectExists","getRelativePathToRootByDirectory","smithyCliCommand","smithyMavenVersions","warnIfSmithyMissing","isService","metadata","smithyType","DEPENDENCIES","ts","name","dev","root","when","SMITHY_PROJECT_GENERATOR_INFO","filename","SMITHY_OUT_DIR","BUILD_DIR","SOURCE_PROJECTION","SSDK_CODEGEN_DIR","smithyCompileCommands","cmd","type","rm","mkdir","cpFile","cpGlobToFile","smithyGenerateSsdkCommands","smithyCompileOutputs","SMITHY_TARGET_INPUTS","smithyGenerateSsdkTarget","cache","inputs","outputs","executor","dependsOn","options","commands","parallel","cwd","writeSsdkBundleConfig","tree","projectRoot","dirname","overwriteStrategy","Overwrite","smithyProjectGenerator","fullyQualifiedName","dir","sourceRoot","projectType","targets","build","assemble","compile","serviceName","serviceNameClassName","serviceNameKebabCase","scope","namespace","replace","relativePathToWorkspaceRoot","KeepExisting","apiName","preferInstallDependencies","languages"],"mappings":"AAAA;;;CAGC,GACD,SACEA,uBAAuB,EAEvBC,aAAa,EACbC,iBAAiB,EACjBC,iBAAiB,QAEZ,aAAa;AACpB,SAASC,eAAe,QAAQ,4BAA4B;AAC5D,SAASC,iBAAiB,QAAQ,kCAAkC;AACpE,SACEC,mBAAmB,EACnBC,cAAc,QACT,uCAAuC;AAC9C,SAASC,oBAAoB,QAAQ,wBAAwB;AAC7D,SAASC,eAAe,EAAEC,UAAU,QAAQ,oBAAoB;AAChE,SAASC,mBAAmB,QAAQ,yBAAyB;AAC7D,SAASC,+BAA+B,QAAQ,yBAAyB;AACzE,SAASC,WAAW,EAAEC,WAAW,QAAQ,uBAAuB;AAChE,SAASC,WAAW,QAAQ,2BAA2B;AACvD,SACEC,oBAAoB,EACpBC,gBAAgB,EAEhBC,aAAa,QACR,oBAAoB;AAC3B,SAASC,gCAAgC,QAAQ,uBAAuB;AACxE,SACEC,gBAAgB,EAChBC,mBAAmB,EACnBC,mBAAmB,QACd,wBAAwB;AAS/B;;;;CAIC,GACD,MAAMC,YAAY,CAACC,WACjBA,SAASC,UAAU,KAAK;AAE1B;;;;;;;CAOC,GACD,OAAO,MAAMC,eAAepB,sBAA6C;IACvEqB,IAAI;QACF,+DAA+D;WAC5DpB,eAAeE;QAClB;YAAEmB,MAAM;YAAYC,KAAK;YAAMC,MAAM;YAAMC,MAAMR;QAAU;QAC3D;YAAEK,MAAM;YAAuBC,KAAK;YAAMC,MAAM;YAAMC,MAAMR;QAAU;QACtE,qEAAqE;QACrE;YAAEK,MAAM;YAAcC,KAAK;YAAMC,MAAM;YAAMC,MAAMR;QAAU;KAC9D;AACH,GAAG;AAEH,OAAO,MAAMS,gCAAiDf,iBAC5D,YAAYgB,QAAQ,EACpB;AAEF;;;;;;;;CAQC,GACD,MAAMC,iBAAiB;AACvB,MAAMC,YAAY;AAElB,+DAA+D,GAC/D,MAAMC,oBAAoB,GAAGF,eAAe,OAAO,CAAC;AAEpD,0EAA0E,GAC1E,MAAMG,mBAAmB,GAAGD,kBAAkB,wBAAwB,CAAC;AAEvE;;;;;;CAMC,GACD,OAAO,MAAME,wBAAwB,CACnCC,KACAC,OACa;QACbD,IAAIE,EAAE,CAACN;QACPI,IAAIE,EAAE,CAACP;QACPK,IAAIG,KAAK,CAACP;QACV,2EAA2E;QAC3E,gEAAgE;QAChE,GAAGf,mBAAmB,mDAAmD,EAAEc,gBAAgB;WACvFM,SAAS,WACT;YACED,IAAII,MAAM,CACR,GAAGP,kBAAkB,iBAAiB,CAAC,EACvC,GAAGD,UAAU,WAAW,CAAC;SAE5B,GACD;YACEI,IAAIG,KAAK,CAAC,GAAGP,UAAU,QAAQ,CAAC;YAChC,wEAAwE;YACxE,wDAAwD;YACxDI,IAAIK,YAAY,CACd,GAAGR,kBAAkB,uBAAuB,CAAC,EAC7C,GAAGD,UAAU,QAAQ,CAAC,EACtB;SAEH;KACN,CAAC;AAEF;;;;;;CAMC,GACD,OAAO,MAAMU,6BAA6B,IAAgB;QACxD,iFAAiF;QACjF,kFAAkF;QAClF,kFAAkF;QAClF,iFAAiF;QACjF,+EAA+E;QAC/E,CAAC,qBAAqB,EAAER,iBAAiB,oDAAoD,CAAC;QAC9F,kFAAkF;QAClF,+EAA+E;QAC/E,gCAAgC;QAChC,CAAC,kDAAkD,CAAC;KACrD,CAAC;AAEF;;;;CAIC,GACD,OAAO,MAAMS,uBAAuB,CAClCN,OACa;QACb,CAAC,gBAAgB,EAAEN,gBAAgB;QACnCM,SAAS,WACL,CAAC,gBAAgB,EAAEL,UAAU,WAAW,CAAC,GACzC,CAAC,gBAAgB,EAAEA,UAAU,QAAQ,CAAC;KAC3C,CAAC;AAEF;;;;;;CAMC,GACD,OAAO,MAAMY,uBAAuB;IAAC;CAAU,CAAC;AAEhD;;;CAGC,GACD,OAAO,MAAMC,2BAA2B,IAAO,CAAA;QAC7CC,OAAO;QACPC,QAAQ;eAAIH;SAAqB;QACjCI,SAAS;YAAC,CAAC,gBAAgB,EAAEhB,UAAU,KAAK,CAAC;SAAC;QAC9CiB,UAAU;QACVC,WAAW;YAAC;SAAU;QACtBC,SAAS;YACPC,UAAUV;YACVW,UAAU;YACVC,KAAK;QACP;IACF,CAAA,EAAG;AAEH;;;;;CAKC,GACD,OAAO,MAAMC,wBAAwB,CAACC,MAAYC,cAChD3D,cACE0D,MACAzD,kBAAkB,YAAY2D,OAAO,EAAE,SAAS,gBAChDD,aACA,uEAAuE;IACvE,oEAAoE;IACpE;QAAEA;IAAY,GACd,2EAA2E;IAC3E,8CAA8C;IAC9C;QAAEE,mBAAmB3D,kBAAkB4D,SAAS;IAAC,GACjD;AAEJ,OAAO,MAAMC,yBAAyB,OACpCL,MACAL;IAEA,MAAMf,MAAM,IAAI7B,WAAWiD,MAAMjC;IACjC,MAAMc,OAAOc,QAAQd,IAAI,IAAI;IAE7B,sBAAsB;IACtB,MAAM,EAAEyB,kBAAkB,EAAEC,GAAG,EAAE,GAAG9D,gBAAgBuD,MAAML;IAE1D,IAAI,CAACpC,cAAcyC,MAAMM,qBAAqB;QAC5CjE,wBAAwB2D,MAAMM,oBAAoB;YAChDrC,MAAMqC;YACNnC,MAAMoC;YACNC,YAAYjE,kBAAkBgE,KAAK;YACnCE,aAAa;YACbC,SAAS;gBACPC,OAAO;oBACLjB,WACEb,SAAS,WAAW;wBAAC;qBAAU,GAAG;wBAAC;wBAAW;qBAAgB;gBAClE;gBACA,kEAAkE;gBAClE,4CAA4C;gBAC5C+B,UAAU;oBACRlB,WACEb,SAAS,WAAW;wBAAC;qBAAU,GAAG;wBAAC;wBAAW;qBAAgB;gBAClE;gBACAgC,SAAS;oBACPvB,OAAO;oBACPC,QAAQ;2BAAIH;qBAAqB;oBACjCI,SAASL,qBAAqBN;oBAC9BY,UAAU;oBACVE,SAAS;wBACPC,UAAUjB,sBAAsBC,KAAKC;wBACrCgB,UAAU;wBACVC,KAAK;oBACP;gBACF;gBACA,uEAAuE;gBACvE,6BAA6B;gBAC7B,GAAIjB,SAAS,WACT,CAAC,IACD;oBAAE,iBAAiBQ;gBAA2B,CAAC;YACrD;QACF;IACF;IAEA,MAAMyB,cAAcnB,QAAQmB,WAAW,IAAInB,QAAQ1B,IAAI;IACvD,MAAM8C,uBAAuB7D,YAAY4D;IACzC,MAAME,uBAAuB7D,YAAY2D;IACzC,MAAMG,QAAQ7D,YAAY4C;IAC1B,MAAMkB,YAAYvB,QAAQuB,SAAS,IAAI/D,YAAY8D,OAAOE,OAAO,CAAC,MAAM;IAExE7E,cACE0D,MACAzD,kBAAkB,YAAY2D,OAAO,EAAE,SAASrB,OAChD0B,KACA;QACEW;QACAH;QACAC;QACAC;QACAhB,aAAaM;QACba,6BAA6B5D,iCAAiC+C;QAC9D,GAAG7C,qBAAqB;IAC1B,GACA;QACE,iEAAiE;QACjEyC,mBAAmB3D,kBAAkB6E,YAAY;IACnD;IAGF,IAAIxC,SAAS,WAAW;QACtBkB,sBAAsBC,MAAMO;IAC9B;IAEA,0EAA0E;IAC1E,8DAA8D;IAC9D,MAAM1C,WAAkC;QAAEC,YAAYe;QAAMqC;IAAU;IAEtE7D,qBACE2C,MACAM,oBACAjC,+BACA;QACE,GAAGR,QAAQ;QACX,GAAIgB,SAAS,YAAY;YAAEyC,SAAS3B,QAAQ1B,IAAI;QAAC,IAAI,CAAC,CAAC;IACzD;IAGF,+EAA+E;IAC/E,+EAA+E;IAC/E,iBAAiB;IACjBvB,kBAAkBsD,MAAMjC,cAAc;QAAEF;IAAS;IAEjD,MAAMZ,gCAAgC+C,MAAM;QAAC3B;KAA8B;IAE3E,6EAA6E;IAC7E,gFAAgF;IAChFV;IAEA,MAAMd,qBAAqBmD;IAC3B,OAAO,IACLhD,oBAAoBgD,MAAML,QAAQ4B,yBAAyB,EAAE;YAC3DC,WAAW;gBAAC;aAAa;QAC3B;AACJ,EAAE;AAEF,eAAenB,uBAAuB"}

package/src/smithy/ts/api/__snapshots__/generator.spec.ts.snap

@@ -2165,6 +2165,7 @@ exports[`tsSmithyApiGenerator > should generate smithy ts api with default optio
     },
     "compile": {
       "cache": true,
+      "inputs": ["default"],
       "outputs": [
         "{workspaceRoot}/dist/{projectRoot}/smithy",
         "{workspaceRoot}/dist/{projectRoot}/build/openapi"
@@ -2185,6 +2186,7 @@ exports[`tsSmithyApiGenerator > should generate smithy ts api with default optio
     },
     "generate-ssdk": {
       "cache": true,
+      "inputs": ["default"],
       "outputs": ["{workspaceRoot}/dist/{projectRoot}/build/ssdk"],
       "executor": "nx:run-commands",
       "dependsOn": ["compile"],

package/src/terraform/project/generator.js

@@ -231,12 +231,10 @@ export async function terraformProjectGenerator(tree, schema) {
                 '^init'
             ]
         },
+        // Reads remote state, which no input can hash.
         output: {
             executor: 'nx:run-commands',
-            cache: true,
-            inputs: [
-                'default'
-            ],
+            cache: false,
             options: {
                 command: 'terraform output -json',
                 forwardAllArgs: true,

package/src/terraform/project/generator.js.map

@@ -1 +1 @@
-{"version":3,"sources":["../../../../../../packages/nx-plugin/src/terraform/project/generator.ts"],"sourcesContent":["/**\n * Copyright Amazon.com, Inc. or its affiliates. All Rights Reserved.\n * SPDX-License-Identifier: Apache-2.0\n */\nimport {\n  addProjectConfiguration,\n  detectPackageManager,\n  type GeneratorCallback,\n  generateFiles,\n  joinPathFragments,\n  OverwriteStrategy,\n  readNxJson,\n  type TargetConfiguration,\n  type Tree,\n  updateJson,\n  updateNxJson,\n} from '@nx/devkit';\nimport { join, relative } from 'path';\nimport { addLicenseCheckToLintTarget } from '../../license/config.js';\nimport { getTsLibDetails } from '../../ts/lib/generator.js';\nimport { addTsDependencies } from '../../utils/add-dependencies.js';\nimport {\n  declareDependencies,\n  ownedElsewhere,\n} from '../../utils/declared-dependencies.js';\nimport { formatFilesInSubtree } from '../../utils/format.js';\nimport { updateGitIgnore } from '../../utils/git.js';\nimport { installDependencies } from '../../utils/install.js';\nimport { addGeneratorMetricsIfApplicable } from '../../utils/metrics.js';\nimport { kebabCase } from '../../utils/names.js';\nimport {\n  addGeneratorMetadata,\n  getGeneratorInfo,\n  type NxGeneratorInfo,\n  projectExists,\n} from '../../utils/nx.js';\nimport { sortObjectKeys } from '../../utils/object.js';\nimport { uvxCommand } from '../../utils/py.js';\nimport { sharedConstructsGenerator } from '../../utils/shared-constructs.js';\nimport {\n  SHARED_CONSTRUCTS_DEPENDENCIES,\n  SHARED_TERRAFORM_DIR,\n  SHARED_TERRAFORM_NAME,\n} from '../../utils/shared-constructs-constants.js';\nimport {\n  terraformProviderVersions,\n  withVersions,\n} from '../../utils/versions.js';\nimport type { TerraformProjectGeneratorSchema } from './schema';\n\n// Terraform projects carry no package.json, so their build tooling and the AWS\n// SDK the vended deploy scripts import are declared at the workspace root. This\n// generator records no metadata, so nothing a predicate could read.\nexport const DEPENDENCIES = declareDependencies()({\n  ts: [\n    { name: '@nx-extend/terraform', dev: true, root: true },\n    { name: 'shx', dev: true, root: true },\n    { name: 'tsx', dev: true, root: true },\n    { name: '@aws-sdk/client-s3', dev: true, root: true },\n    { name: '@aws-sdk/client-sts', dev: true, root: true },\n    { name: '@aws-sdk/credential-providers', dev: true, root: true },\n    { name: '@smithy/config-resolver', dev: true, root: true },\n    { name: '@smithy/node-config-provider', dev: true, root: true },\n    // Declared for its pinned version, which goes into npm's `overrides` below.\n    { name: '@nx/devkit', versionOnly: true },\n    ...ownedElsewhere(SHARED_CONSTRUCTS_DEPENDENCIES),\n  ],\n});\n\nconst NX_EXTEND_PLUGIN = '@nx-extend/terraform';\nexport const TERRAFORM_PROJECT_GENERATOR_INFO: NxGeneratorInfo =\n  getGeneratorInfo(import.meta.filename);\n\n/**\n * Checks formatting, mirroring the TypeScript and Python `format` targets: the\n * base target fails on an unformatted file and the `fix` configuration rewrites\n * it. Writing from the base target would rewrite the `default` input the hash is\n * computed over, so the target could never cache-hit.\n *\n * Scoped to the project's own `src` rather than `-recursive`, so it checks the\n * files the vended templates cover. `-diff` names what to fix when it fails.\n */\nexport const TERRAFORM_FORMAT_TARGET: TargetConfiguration = {\n  executor: 'nx:run-commands',\n  cache: true,\n  inputs: ['default'],\n  options: {\n    command: 'terraform fmt -check -diff',\n    forwardAllArgs: true,\n    cwd: '{projectRoot}/src',\n  },\n  configurations: {\n    fix: {\n      command: 'terraform fmt',\n    },\n    'skip-lint': {\n      // Cross-platform no-op (`true` is not available on Windows cmd).\n      command: 'node -e \"\"',\n    },\n  },\n};\n\nexport async function terraformProjectGenerator(\n  tree: Tree,\n  schema: TerraformProjectGeneratorSchema,\n): Promise<GeneratorCallback> {\n  // Just use getTsLibDetails as it isn't specific to TS\n  const lib = getTsLibDetails(tree, schema);\n  const { fullyQualifiedName: sharedTfProjectName } = getTsLibDetails(tree, {\n    name: SHARED_TERRAFORM_NAME,\n  });\n\n  const outDirToRootRelativePath = relative(\n    join(tree.root, lib.dir, 'src'),\n    tree.root,\n  ).replace(/\\\\/g, '/');\n  const distDir = joinPathFragments(\n    outDirToRootRelativePath,\n    'dist',\n    '{projectRoot}',\n  );\n  const tfDistDir = joinPathFragments(distDir, 'terraform');\n  const checkovReportJsonPath = joinPathFragments(\n    distDir,\n    'checkov',\n    'checkov_report.json',\n  );\n  // `terraform-init` keeps its `.terraform` here rather than in `src`, so it\n  // never races the backend-configured targets over the shared one. `test` and\n  // `validate` read this same directory rather than initialising their own.\n  const initDataDir = joinPathFragments(distDir, 'terraform-init');\n\n  // Provider downloads persist here, so a target whose `.terraform` was cleaned\n  // links the providers it already has rather than re-downloading them. Nx does\n  // not interpolate `{workspaceRoot}` inside `env`, so this is relative to the\n  // target's `cwd`. It sits under `.terraform`, which this generator gitignores\n  // — that is also what keeps the providers out of Nx's file walk — and unlike\n  // `.nx/cache` it survives `nx reset`.\n  //\n  // One cache per project rather than one for the workspace: two `terraform\n  // init` runs filling a shared cache concurrently each compute a different hash\n  // for the same provider, because the hash covers a directory the other is\n  // still writing, and terraform then rejects the mismatch against the lock\n  // file. `terraform-init` is the only target that fills it, and the targets that\n  // need the providers depend on that one, so no two writers ever meet.\n  const pluginCacheDir = joinPathFragments(\n    outDirToRootRelativePath,\n    '.terraform',\n    'plugin-cache',\n    '{projectRoot}',\n  );\n\n  // Calculate relative path from current project to common/terraform/metrics\n  // Use forward slashes for terraform module source paths (even on Windows)\n  const metricsModulePath = relative(\n    join(tree.root, lib.dir, 'src'),\n    join(tree.root, 'packages', SHARED_TERRAFORM_DIR, 'src', 'metrics'),\n  ).replace(/\\\\/g, '/');\n\n  updateGitIgnore(tree, '.', (patterns) => [...patterns, '.terraform']);\n\n  const applicationTargets: {\n    [targetName: string]: TargetConfiguration;\n  } = {\n    apply: {\n      executor: 'nx:run-commands',\n      defaultConfiguration: 'dev',\n      configurations: {\n        dev: {\n          command: `terraform apply ${tfDistDir}/dev.tfplan`,\n        },\n      },\n      options: {\n        forwardAllArgs: true,\n        cwd: '{projectRoot}/src',\n      },\n      dependsOn: ['plan'],\n    },\n    bootstrap: {\n      executor: 'nx:run-commands',\n      options: {\n        forwardAllArgs: true,\n        commands: ['tsx {projectRoot}/scripts/bootstrap.ts {projectRoot}'],\n        cwd: '{workspaceRoot}',\n      },\n    },\n    'bootstrap-destroy': {\n      executor: 'nx:run-commands',\n      options: {\n        forwardAllArgs: true,\n        commands: [\n          'tsx {projectRoot}/scripts/bootstrap-destroy.ts {projectRoot}',\n        ],\n        cwd: '{workspaceRoot}',\n      },\n    },\n    build: {\n      dependsOn: ['format', 'checkov', 'test', `${sharedTfProjectName}:build`],\n    },\n    deploy: {\n      dependsOn: ['apply'],\n    },\n    // The artifact-only sibling of build, which `plan` depends on.\n    assemble: {\n      dependsOn: [`${sharedTfProjectName}:assemble`],\n    },\n    destroy: {\n      executor: 'nx:run-commands',\n      defaultConfiguration: 'dev',\n      configurations: {\n        dev: {\n          command: 'terraform destroy -var-file=env/dev.tfvars',\n        },\n      },\n      options: {\n        forwardAllArgs: true,\n        cwd: '{projectRoot}/src',\n      },\n      dependsOn: ['init'],\n    },\n    init: {\n      executor: 'nx:run-commands',\n      defaultConfiguration: 'dev',\n      configurations: {\n        dev: {\n          env: { TF_ENV: 'dev' },\n        },\n      },\n      options: {\n        forwardAllArgs: true,\n        commands: ['tsx {projectRoot}/scripts/init.ts {projectRoot}'],\n        cwd: '{workspaceRoot}',\n      },\n      dependsOn: ['terraform-init', '^init'],\n    },\n    output: {\n      executor: 'nx:run-commands',\n      cache: true,\n      inputs: ['default'],\n      options: {\n        command: 'terraform output -json',\n        forwardAllArgs: true,\n        cwd: '{projectRoot}/src',\n      },\n    },\n    plan: {\n      executor: 'nx:run-commands',\n      defaultConfiguration: 'dev',\n      configurations: {\n        dev: {\n          commands: [\n            `shx mkdir -p ${tfDistDir}`,\n            `terraform plan -var-file=env/dev.tfvars -out=${tfDistDir}/dev.tfplan`,\n          ],\n        },\n      },\n      options: {\n        forwardAllArgs: true,\n        cwd: '{projectRoot}/src',\n        parallel: false,\n      },\n      dependsOn: ['init', 'validate', '^validate', 'assemble'],\n    },\n  };\n\n  const libTargets: {\n    [targetName: string]: TargetConfiguration;\n  } = {\n    build: {\n      dependsOn: ['format', 'checkov', 'test'],\n    },\n    // A Terraform library vends modules rather than a deployable artifact, so\n    // its `assemble` carries only whatever the consuming projects register on it.\n    assemble: {\n      executor: 'nx:noop',\n    },\n    format: TERRAFORM_FORMAT_TARGET,\n    // Terraform has no linter of its own, so `lint` orchestrates the format\n    // check. It exists so `nx run-many --target lint` reaches terraform\n    // projects, and so `--configuration=fix` and `--configuration=skip-lint`\n    // propagate to `format` the way they do for TypeScript and Python projects.\n    lint: {\n      dependsOn: ['format'],\n    },\n    init: {\n      executor: 'nx:run-commands',\n      defaultConfiguration: 'dev',\n      configurations: {\n        dev: {\n          commands: [\n            {\n              command: `shx mkdir -p ${pluginCacheDir}`,\n              forwardAllArgs: false,\n            },\n            'terraform init',\n          ],\n        },\n      },\n      options: {\n        forwardAllArgs: true,\n        cwd: '{projectRoot}/src',\n        parallel: false,\n        env: { TF_PLUGIN_CACHE_DIR: pluginCacheDir },\n      },\n      dependsOn: ['terraform-init'],\n    },\n    // `-backend=false` installs the modules and providers without configuring\n    // the S3 backend, so this needs no credentials and runs on a fresh\n    // workspace before `bootstrap`. Uncached: a cache hit on another machine\n    // would report success over an empty `TF_DATA_DIR` and plugin cache.\n    'terraform-init': {\n      executor: 'nx:run-commands',\n      options: {\n        commands: [\n          { command: `shx mkdir -p ${pluginCacheDir}`, forwardAllArgs: false },\n          'terraform init -backend=false',\n        ],\n        forwardAllArgs: true,\n        cwd: '{projectRoot}/src',\n        parallel: false,\n        env: {\n          TF_DATA_DIR: initDataDir,\n          TF_PLUGIN_CACHE_DIR: pluginCacheDir,\n        },\n      },\n    },\n    // `^production` mirrors `test`: checkov resolves the relative modules a\n    // project consumes, so a change in one must invalidate the scan.\n    checkov: {\n      executor: 'nx:run-commands',\n      cache: true,\n      inputs: ['default', '^production'],\n      outputs: ['{workspaceRoot}/dist/{projectRoot}/checkov'],\n      options: {\n        command: uvxCommand(\n          'checkov',\n          `--config-file ../checkov.yml --directory . -o cli -o json --output-file-path console,${checkovReportJsonPath}`,\n        ),\n        forwardAllArgs: true,\n        cwd: '{projectRoot}/src',\n      },\n    },\n    // Terraform's native test framework, which runs any `.tftest.hcl` files.\n    // A project with none is a no-op success. Runs against the `TF_DATA_DIR`\n    // `terraform-init` prepared, so it needs no credentials and works on a fresh\n    // workspace before `bootstrap`. `^production` is what invalidates the cache\n    // when a consumed module changes; `{projectRoot}/**/*` alone would serve a\n    // stale pass.\n    //\n    // `TF_DATA_DIR` is terraform's working directory, not an artifact: its\n    // provider entries are symlinks into the shared plugin cache, so restoring\n    // it on another machine would yield dangling links while the commands that\n    // repopulate them are skipped. Declaring no outputs keeps a cache hit to\n    // what it actually asserts — that the tests passed for these inputs.\n    test: {\n      executor: 'nx:run-commands',\n      cache: true,\n      inputs: ['default', '^production'],\n      outputs: [],\n      options: {\n        command: 'terraform test',\n        forwardAllArgs: true,\n        cwd: '{projectRoot}/src',\n        env: { TF_DATA_DIR: initDataDir },\n      },\n      dependsOn: ['terraform-init'],\n    },\n    // Mirrors `test`: validates against the `TF_DATA_DIR` `terraform-init`\n    // prepared, and declares no outputs for the same reason (see `test` above).\n    validate: {\n      executor: 'nx:run-commands',\n      cache: true,\n      inputs: ['default', '^production'],\n      outputs: [],\n      options: {\n        command: 'terraform validate',\n        forwardAllArgs: true,\n        cwd: '{projectRoot}/src',\n        env: { TF_DATA_DIR: initDataDir },\n      },\n      dependsOn: ['terraform-init'],\n    },\n  };\n\n  const projectConfiguration = {\n    root: lib.dir,\n    projectType: schema.type,\n    sourceRoot: joinPathFragments(lib.dir, 'src'),\n    targets: sortObjectKeys({\n      ...libTargets,\n      ...(schema.type === 'application' ? applicationTargets : {}),\n    }),\n  };\n\n  // Only create the project configuration on first run; skip it on re-run so\n  // existing project.json customisations are preserved.\n  if (!projectExists(tree, lib.fullyQualifiedName)) {\n    addProjectConfiguration(tree, lib.fullyQualifiedName, projectConfiguration);\n  }\n\n  // The `lint` target checks licenses alongside formatting, as it does for\n  // TypeScript and Python projects.\n  addLicenseCheckToLintTarget(tree, lib.fullyQualifiedName);\n\n  // This generator IS the Terraform project, so the provider is fixed.\n  addGeneratorMetadata(\n    tree,\n    lib.fullyQualifiedName,\n    TERRAFORM_PROJECT_GENERATOR_INFO,\n    { iac: 'terraform' },\n  );\n\n  // The guides tell the reader to declare resources in `main.tf`, add variables\n  // and outputs, and configure environments in `env/*.tfvars`, so everything\n  // here is scaffolded once and then left alone. Provider version bumps reach\n  // `providers.tf` through the vended version sync, which rewrites the pin in\n  // place rather than the whole file.\n  generateFiles(\n    tree,\n    joinPathFragments(import.meta.dirname, `./files/${schema.type}`),\n    lib.dir,\n    {\n      metricsModulePath,\n      stateKeyPrefix: kebabCase(lib.fullyQualifiedName),\n      ...terraformProviderVersions(),\n    },\n    {\n      overwriteStrategy: OverwriteStrategy.KeepExisting,\n    },\n  );\n\n  // Checkov skips are the user's to curate, so preserve any they have added.\n  generateFiles(\n    tree,\n    joinPathFragments(import.meta.dirname, './files/checkov'),\n    lib.dir,\n    {},\n    {\n      overwriteStrategy: OverwriteStrategy.KeepExisting,\n    },\n  );\n\n  const nxJson = readNxJson(tree);\n\n  if (\n    !nxJson.plugins?.find((p) =>\n      typeof p === 'string'\n        ? p === NX_EXTEND_PLUGIN\n        : p.plugin === NX_EXTEND_PLUGIN,\n    )\n  ) {\n    nxJson.plugins = [...(nxJson.plugins ?? []), NX_EXTEND_PLUGIN];\n    updateNxJson(tree, nxJson);\n  }\n\n  // Ensure shared constructs for Terraform are created\n  await sharedConstructsGenerator(tree, { iac: 'terraform' }, DEPENDENCIES);\n\n  // Add Terraform metrics\n  await addGeneratorMetricsIfApplicable(tree, [\n    TERRAFORM_PROJECT_GENERATOR_INFO,\n  ]);\n\n  addTsDependencies(tree, DEPENDENCIES);\n\n  // @nx-extend/terraform has a peer dependency on @nx/devkit ^21.0.0 which causes\n  // npm install to fail, so for NPM we add a resolution\n  // Can remove when https://github.com/TriPSs/nx-extend/issues/407 is addressed\n  if (detectPackageManager() === 'npm') {\n    updateJson(tree, 'package.json', (packageJson) => {\n      packageJson.overrides = {\n        ...packageJson.overrides,\n        ...withVersions(DEPENDENCIES, ['@nx/devkit']),\n      };\n      return packageJson;\n    });\n  }\n\n  // `updateProjectConfiguration` re-serialises project.json with every inline\n  // array expanded, which the vended `format` target rejects.\n  await formatFilesInSubtree(tree);\n\n  // `@nx-extend/terraform` is registered as an Nx plugin in nx.json, so Nx\n  // loads it when computing the project graph — it must resolve even if the\n  // caller would otherwise prefer to defer installing.\n  return () =>\n    installDependencies(tree, schema.preferInstallDependencies, {\n      languages: ['typescript'],\n      ensureResolvable: [NX_EXTEND_PLUGIN],\n    });\n}\nexport default terraformProjectGenerator;\n"],"names":["addProjectConfiguration","detectPackageManager","generateFiles","joinPathFragments","OverwriteStrategy","readNxJson","updateJson","updateNxJson","join","relative","addLicenseCheckToLintTarget","getTsLibDetails","addTsDependencies","declareDependencies","ownedElsewhere","formatFilesInSubtree","updateGitIgnore","installDependencies","addGeneratorMetricsIfApplicable","kebabCase","addGeneratorMetadata","getGeneratorInfo","projectExists","sortObjectKeys","uvxCommand","sharedConstructsGenerator","SHARED_CONSTRUCTS_DEPENDENCIES","SHARED_TERRAFORM_DIR","SHARED_TERRAFORM_NAME","terraformProviderVersions","withVersions","DEPENDENCIES","ts","name","dev","root","versionOnly","NX_EXTEND_PLUGIN","TERRAFORM_PROJECT_GENERATOR_INFO","filename","TERRAFORM_FORMAT_TARGET","executor","cache","inputs","options","command","forwardAllArgs","cwd","configurations","fix","terraformProjectGenerator","tree","schema","lib","fullyQualifiedName","sharedTfProjectName","outDirToRootRelativePath","dir","replace","distDir","tfDistDir","checkovReportJsonPath","initDataDir","pluginCacheDir","metricsModulePath","patterns","applicationTargets","apply","defaultConfiguration","dependsOn","bootstrap","commands","build","deploy","assemble","destroy","init","env","TF_ENV","output","plan","parallel","libTargets","format","lint","TF_PLUGIN_CACHE_DIR","TF_DATA_DIR","checkov","outputs","test","validate","projectConfiguration","projectType","type","sourceRoot","targets","iac","dirname","stateKeyPrefix","overwriteStrategy","KeepExisting","nxJson","plugins","find","p","plugin","packageJson","overrides","preferInstallDependencies","languages","ensureResolvable"],"mappings":"AAAA;;;CAGC,GACD,SACEA,uBAAuB,EACvBC,oBAAoB,EAEpBC,aAAa,EACbC,iBAAiB,EACjBC,iBAAiB,EACjBC,UAAU,EAGVC,UAAU,EACVC,YAAY,QACP,aAAa;AACpB,SAASC,IAAI,EAAEC,QAAQ,QAAQ,OAAO;AACtC,SAASC,2BAA2B,QAAQ,0BAA0B;AACtE,SAASC,eAAe,QAAQ,4BAA4B;AAC5D,SAASC,iBAAiB,QAAQ,kCAAkC;AACpE,SACEC,mBAAmB,EACnBC,cAAc,QACT,uCAAuC;AAC9C,SAASC,oBAAoB,QAAQ,wBAAwB;AAC7D,SAASC,eAAe,QAAQ,qBAAqB;AACrD,SAASC,mBAAmB,QAAQ,yBAAyB;AAC7D,SAASC,+BAA+B,QAAQ,yBAAyB;AACzE,SAASC,SAAS,QAAQ,uBAAuB;AACjD,SACEC,oBAAoB,EACpBC,gBAAgB,EAEhBC,aAAa,QACR,oBAAoB;AAC3B,SAASC,cAAc,QAAQ,wBAAwB;AACvD,SAASC,UAAU,QAAQ,oBAAoB;AAC/C,SAASC,yBAAyB,QAAQ,mCAAmC;AAC7E,SACEC,8BAA8B,EAC9BC,oBAAoB,EACpBC,qBAAqB,QAChB,6CAA6C;AACpD,SACEC,yBAAyB,EACzBC,YAAY,QACP,0BAA0B;AAGjC,+EAA+E;AAC/E,gFAAgF;AAChF,oEAAoE;AACpE,OAAO,MAAMC,eAAelB,sBAAsB;IAChDmB,IAAI;QACF;YAAEC,MAAM;YAAwBC,KAAK;YAAMC,MAAM;QAAK;QACtD;YAAEF,MAAM;YAAOC,KAAK;YAAMC,MAAM;QAAK;QACrC;YAAEF,MAAM;YAAOC,KAAK;YAAMC,MAAM;QAAK;QACrC;YAAEF,MAAM;YAAsBC,KAAK;YAAMC,MAAM;QAAK;QACpD;YAAEF,MAAM;YAAuBC,KAAK;YAAMC,MAAM;QAAK;QACrD;YAAEF,MAAM;YAAiCC,KAAK;YAAMC,MAAM;QAAK;QAC/D;YAAEF,MAAM;YAA2BC,KAAK;YAAMC,MAAM;QAAK;QACzD;YAAEF,MAAM;YAAgCC,KAAK;YAAMC,MAAM;QAAK;QAC9D,4EAA4E;QAC5E;YAAEF,MAAM;YAAcG,aAAa;QAAK;WACrCtB,eAAeY;KACnB;AACH,GAAG;AAEH,MAAMW,mBAAmB;AACzB,OAAO,MAAMC,mCACXjB,iBAAiB,YAAYkB,QAAQ,EAAE;AAEzC;;;;;;;;CAQC,GACD,OAAO,MAAMC,0BAA+C;IAC1DC,UAAU;IACVC,OAAO;IACPC,QAAQ;QAAC;KAAU;IACnBC,SAAS;QACPC,SAAS;QACTC,gBAAgB;QAChBC,KAAK;IACP;IACAC,gBAAgB;QACdC,KAAK;YACHJ,SAAS;QACX;QACA,aAAa;YACX,iEAAiE;YACjEA,SAAS;QACX;IACF;AACF,EAAE;AAEF,OAAO,eAAeK,0BACpBC,IAAU,EACVC,MAAuC;IAEvC,sDAAsD;IACtD,MAAMC,MAAM1C,gBAAgBwC,MAAMC;IAClC,MAAM,EAAEE,oBAAoBC,mBAAmB,EAAE,GAAG5C,gBAAgBwC,MAAM;QACxElB,MAAML;IACR;IAEA,MAAM4B,2BAA2B/C,SAC/BD,KAAK2C,KAAKhB,IAAI,EAAEkB,IAAII,GAAG,EAAE,QACzBN,KAAKhB,IAAI,EACTuB,OAAO,CAAC,OAAO;IACjB,MAAMC,UAAUxD,kBACdqD,0BACA,QACA;IAEF,MAAMI,YAAYzD,kBAAkBwD,SAAS;IAC7C,MAAME,wBAAwB1D,kBAC5BwD,SACA,WACA;IAEF,2EAA2E;IAC3E,6EAA6E;IAC7E,0EAA0E;IAC1E,MAAMG,cAAc3D,kBAAkBwD,SAAS;IAE/C,8EAA8E;IAC9E,8EAA8E;IAC9E,6EAA6E;IAC7E,8EAA8E;IAC9E,6EAA6E;IAC7E,sCAAsC;IACtC,EAAE;IACF,0EAA0E;IAC1E,+EAA+E;IAC/E,0EAA0E;IAC1E,0EAA0E;IAC1E,gFAAgF;IAChF,sEAAsE;IACtE,MAAMI,iBAAiB5D,kBACrBqD,0BACA,cACA,gBACA;IAGF,2EAA2E;IAC3E,0EAA0E;IAC1E,MAAMQ,oBAAoBvD,SACxBD,KAAK2C,KAAKhB,IAAI,EAAEkB,IAAII,GAAG,EAAE,QACzBjD,KAAK2C,KAAKhB,IAAI,EAAE,YAAYR,sBAAsB,OAAO,YACzD+B,OAAO,CAAC,OAAO;IAEjB1C,gBAAgBmC,MAAM,KAAK,CAACc,WAAa;eAAIA;YAAU;SAAa;IAEpE,MAAMC,qBAEF;QACFC,OAAO;YACL1B,UAAU;YACV2B,sBAAsB;YACtBpB,gBAAgB;gBACdd,KAAK;oBACHW,SAAS,CAAC,gBAAgB,EAAEe,UAAU,WAAW,CAAC;gBACpD;YACF;YACAhB,SAAS;gBACPE,gBAAgB;gBAChBC,KAAK;YACP;YACAsB,WAAW;gBAAC;aAAO;QACrB;QACAC,WAAW;YACT7B,UAAU;YACVG,SAAS;gBACPE,gBAAgB;gBAChByB,UAAU;oBAAC;iBAAuD;gBAClExB,KAAK;YACP;QACF;QACA,qBAAqB;YACnBN,UAAU;YACVG,SAAS;gBACPE,gBAAgB;gBAChByB,UAAU;oBACR;iBACD;gBACDxB,KAAK;YACP;QACF;QACAyB,OAAO;YACLH,WAAW;gBAAC;gBAAU;gBAAW;gBAAQ,GAAGd,oBAAoB,MAAM,CAAC;aAAC;QAC1E;QACAkB,QAAQ;YACNJ,WAAW;gBAAC;aAAQ;QACtB;QACA,+DAA+D;QAC/DK,UAAU;YACRL,WAAW;gBAAC,GAAGd,oBAAoB,SAAS,CAAC;aAAC;QAChD;QACAoB,SAAS;YACPlC,UAAU;YACV2B,sBAAsB;YACtBpB,gBAAgB;gBACdd,KAAK;oBACHW,SAAS;gBACX;YACF;YACAD,SAAS;gBACPE,gBAAgB;gBAChBC,KAAK;YACP;YACAsB,WAAW;gBAAC;aAAO;QACrB;QACAO,MAAM;YACJnC,UAAU;YACV2B,sBAAsB;YACtBpB,gBAAgB;gBACdd,KAAK;oBACH2C,KAAK;wBAAEC,QAAQ;oBAAM;gBACvB;YACF;YACAlC,SAAS;gBACPE,gBAAgB;gBAChByB,UAAU;oBAAC;iBAAkD;gBAC7DxB,KAAK;YACP;YACAsB,WAAW;gBAAC;gBAAkB;aAAQ;QACxC;QACAU,QAAQ;YACNtC,UAAU;YACVC,OAAO;YACPC,QAAQ;gBAAC;aAAU;YACnBC,SAAS;gBACPC,SAAS;gBACTC,gBAAgB;gBAChBC,KAAK;YACP;QACF;QACAiC,MAAM;YACJvC,UAAU;YACV2B,sBAAsB;YACtBpB,gBAAgB;gBACdd,KAAK;oBACHqC,UAAU;wBACR,CAAC,aAAa,EAAEX,WAAW;wBAC3B,CAAC,6CAA6C,EAAEA,UAAU,WAAW,CAAC;qBACvE;gBACH;YACF;YACAhB,SAAS;gBACPE,gBAAgB;gBAChBC,KAAK;gBACLkC,UAAU;YACZ;YACAZ,WAAW;gBAAC;gBAAQ;gBAAY;gBAAa;aAAW;QAC1D;IACF;IAEA,MAAMa,aAEF;QACFV,OAAO;YACLH,WAAW;gBAAC;gBAAU;gBAAW;aAAO;QAC1C;QACA,0EAA0E;QAC1E,8EAA8E;QAC9EK,UAAU;YACRjC,UAAU;QACZ;QACA0C,QAAQ3C;QACR,wEAAwE;QACxE,oEAAoE;QACpE,yEAAyE;QACzE,4EAA4E;QAC5E4C,MAAM;YACJf,WAAW;gBAAC;aAAS;QACvB;QACAO,MAAM;YACJnC,UAAU;YACV2B,sBAAsB;YACtBpB,gBAAgB;gBACdd,KAAK;oBACHqC,UAAU;wBACR;4BACE1B,SAAS,CAAC,aAAa,EAAEkB,gBAAgB;4BACzCjB,gBAAgB;wBAClB;wBACA;qBACD;gBACH;YACF;YACAF,SAAS;gBACPE,gBAAgB;gBAChBC,KAAK;gBACLkC,UAAU;gBACVJ,KAAK;oBAAEQ,qBAAqBtB;gBAAe;YAC7C;YACAM,WAAW;gBAAC;aAAiB;QAC/B;QACA,0EAA0E;QAC1E,mEAAmE;QACnE,yEAAyE;QACzE,qEAAqE;QACrE,kBAAkB;YAChB5B,UAAU;YACVG,SAAS;gBACP2B,UAAU;oBACR;wBAAE1B,SAAS,CAAC,aAAa,EAAEkB,gBAAgB;wBAAEjB,gBAAgB;oBAAM;oBACnE;iBACD;gBACDA,gBAAgB;gBAChBC,KAAK;gBACLkC,UAAU;gBACVJ,KAAK;oBACHS,aAAaxB;oBACbuB,qBAAqBtB;gBACvB;YACF;QACF;QACA,wEAAwE;QACxE,iEAAiE;QACjEwB,SAAS;YACP9C,UAAU;YACVC,OAAO;YACPC,QAAQ;gBAAC;gBAAW;aAAc;YAClC6C,SAAS;gBAAC;aAA6C;YACvD5C,SAAS;gBACPC,SAASrB,WACP,WACA,CAAC,qFAAqF,EAAEqC,uBAAuB;gBAEjHf,gBAAgB;gBAChBC,KAAK;YACP;QACF;QACA,yEAAyE;QACzE,yEAAyE;QACzE,6EAA6E;QAC7E,4EAA4E;QAC5E,2EAA2E;QAC3E,cAAc;QACd,EAAE;QACF,uEAAuE;QACvE,2EAA2E;QAC3E,2EAA2E;QAC3E,yEAAyE;QACzE,qEAAqE;QACrE0C,MAAM;YACJhD,UAAU;YACVC,OAAO;YACPC,QAAQ;gBAAC;gBAAW;aAAc;YAClC6C,SAAS,EAAE;YACX5C,SAAS;gBACPC,SAAS;gBACTC,gBAAgB;gBAChBC,KAAK;gBACL8B,KAAK;oBAAES,aAAaxB;gBAAY;YAClC;YACAO,WAAW;gBAAC;aAAiB;QAC/B;QACA,uEAAuE;QACvE,4EAA4E;QAC5EqB,UAAU;YACRjD,UAAU;YACVC,OAAO;YACPC,QAAQ;gBAAC;gBAAW;aAAc;YAClC6C,SAAS,EAAE;YACX5C,SAAS;gBACPC,SAAS;gBACTC,gBAAgB;gBAChBC,KAAK;gBACL8B,KAAK;oBAAES,aAAaxB;gBAAY;YAClC;YACAO,WAAW;gBAAC;aAAiB;QAC/B;IACF;IAEA,MAAMsB,uBAAuB;QAC3BxD,MAAMkB,IAAII,GAAG;QACbmC,aAAaxC,OAAOyC,IAAI;QACxBC,YAAY3F,kBAAkBkD,IAAII,GAAG,EAAE;QACvCsC,SAASxE,eAAe;YACtB,GAAG2D,UAAU;YACb,GAAI9B,OAAOyC,IAAI,KAAK,gBAAgB3B,qBAAqB,CAAC,CAAC;QAC7D;IACF;IAEA,2EAA2E;IAC3E,sDAAsD;IACtD,IAAI,CAAC5C,cAAc6B,MAAME,IAAIC,kBAAkB,GAAG;QAChDtD,wBAAwBmD,MAAME,IAAIC,kBAAkB,EAAEqC;IACxD;IAEA,yEAAyE;IACzE,kCAAkC;IAClCjF,4BAA4ByC,MAAME,IAAIC,kBAAkB;IAExD,qEAAqE;IACrElC,qBACE+B,MACAE,IAAIC,kBAAkB,EACtBhB,kCACA;QAAE0D,KAAK;IAAY;IAGrB,8EAA8E;IAC9E,2EAA2E;IAC3E,4EAA4E;IAC5E,4EAA4E;IAC5E,oCAAoC;IACpC9F,cACEiD,MACAhD,kBAAkB,YAAY8F,OAAO,EAAE,CAAC,QAAQ,EAAE7C,OAAOyC,IAAI,EAAE,GAC/DxC,IAAII,GAAG,EACP;QACEO;QACAkC,gBAAgB/E,UAAUkC,IAAIC,kBAAkB;QAChD,GAAGzB,2BAA2B;IAChC,GACA;QACEsE,mBAAmB/F,kBAAkBgG,YAAY;IACnD;IAGF,2EAA2E;IAC3ElG,cACEiD,MACAhD,kBAAkB,YAAY8F,OAAO,EAAE,oBACvC5C,IAAII,GAAG,EACP,CAAC,GACD;QACE0C,mBAAmB/F,kBAAkBgG,YAAY;IACnD;IAGF,MAAMC,SAAShG,WAAW8C;IAE1B,IACE,CAACkD,OAAOC,OAAO,EAAEC,KAAK,CAACC,IACrB,OAAOA,MAAM,WACTA,MAAMnE,mBACNmE,EAAEC,MAAM,KAAKpE,mBAEnB;QACAgE,OAAOC,OAAO,GAAG;eAAKD,OAAOC,OAAO,IAAI,EAAE;YAAGjE;SAAiB;QAC9D9B,aAAa4C,MAAMkD;IACrB;IAEA,qDAAqD;IACrD,MAAM5E,0BAA0B0B,MAAM;QAAE6C,KAAK;IAAY,GAAGjE;IAE5D,wBAAwB;IACxB,MAAMb,gCAAgCiC,MAAM;QAC1Cb;KACD;IAED1B,kBAAkBuC,MAAMpB;IAExB,gFAAgF;IAChF,sDAAsD;IACtD,8EAA8E;IAC9E,IAAI9B,2BAA2B,OAAO;QACpCK,WAAW6C,MAAM,gBAAgB,CAACuD;YAChCA,YAAYC,SAAS,GAAG;gBACtB,GAAGD,YAAYC,SAAS;gBACxB,GAAG7E,aAAaC,cAAc;oBAAC;iBAAa,CAAC;YAC/C;YACA,OAAO2E;QACT;IACF;IAEA,4EAA4E;IAC5E,4DAA4D;IAC5D,MAAM3F,qBAAqBoC;IAE3B,yEAAyE;IACzE,0EAA0E;IAC1E,qDAAqD;IACrD,OAAO,IACLlC,oBAAoBkC,MAAMC,OAAOwD,yBAAyB,EAAE;YAC1DC,WAAW;gBAAC;aAAa;YACzBC,kBAAkB;gBAACzE;aAAiB;QACtC;AACJ;AACA,eAAea,0BAA0B"}
+{"version":3,"sources":["../../../../../../packages/nx-plugin/src/terraform/project/generator.ts"],"sourcesContent":["/**\n * Copyright Amazon.com, Inc. or its affiliates. All Rights Reserved.\n * SPDX-License-Identifier: Apache-2.0\n */\nimport {\n  addProjectConfiguration,\n  detectPackageManager,\n  type GeneratorCallback,\n  generateFiles,\n  joinPathFragments,\n  OverwriteStrategy,\n  readNxJson,\n  type TargetConfiguration,\n  type Tree,\n  updateJson,\n  updateNxJson,\n} from '@nx/devkit';\nimport { join, relative } from 'path';\nimport { addLicenseCheckToLintTarget } from '../../license/config.js';\nimport { getTsLibDetails } from '../../ts/lib/generator.js';\nimport { addTsDependencies } from '../../utils/add-dependencies.js';\nimport {\n  declareDependencies,\n  ownedElsewhere,\n} from '../../utils/declared-dependencies.js';\nimport { formatFilesInSubtree } from '../../utils/format.js';\nimport { updateGitIgnore } from '../../utils/git.js';\nimport { installDependencies } from '../../utils/install.js';\nimport { addGeneratorMetricsIfApplicable } from '../../utils/metrics.js';\nimport { kebabCase } from '../../utils/names.js';\nimport {\n  addGeneratorMetadata,\n  getGeneratorInfo,\n  type NxGeneratorInfo,\n  projectExists,\n} from '../../utils/nx.js';\nimport { sortObjectKeys } from '../../utils/object.js';\nimport { uvxCommand } from '../../utils/py.js';\nimport { sharedConstructsGenerator } from '../../utils/shared-constructs.js';\nimport {\n  SHARED_CONSTRUCTS_DEPENDENCIES,\n  SHARED_TERRAFORM_DIR,\n  SHARED_TERRAFORM_NAME,\n} from '../../utils/shared-constructs-constants.js';\nimport {\n  terraformProviderVersions,\n  withVersions,\n} from '../../utils/versions.js';\nimport type { TerraformProjectGeneratorSchema } from './schema';\n\n// Terraform projects carry no package.json, so their build tooling and the AWS\n// SDK the vended deploy scripts import are declared at the workspace root. This\n// generator records no metadata, so nothing a predicate could read.\nexport const DEPENDENCIES = declareDependencies()({\n  ts: [\n    { name: '@nx-extend/terraform', dev: true, root: true },\n    { name: 'shx', dev: true, root: true },\n    { name: 'tsx', dev: true, root: true },\n    { name: '@aws-sdk/client-s3', dev: true, root: true },\n    { name: '@aws-sdk/client-sts', dev: true, root: true },\n    { name: '@aws-sdk/credential-providers', dev: true, root: true },\n    { name: '@smithy/config-resolver', dev: true, root: true },\n    { name: '@smithy/node-config-provider', dev: true, root: true },\n    // Declared for its pinned version, which goes into npm's `overrides` below.\n    { name: '@nx/devkit', versionOnly: true },\n    ...ownedElsewhere(SHARED_CONSTRUCTS_DEPENDENCIES),\n  ],\n});\n\nconst NX_EXTEND_PLUGIN = '@nx-extend/terraform';\nexport const TERRAFORM_PROJECT_GENERATOR_INFO: NxGeneratorInfo =\n  getGeneratorInfo(import.meta.filename);\n\n/**\n * Checks formatting, mirroring the TypeScript and Python `format` targets: the\n * base target fails on an unformatted file and the `fix` configuration rewrites\n * it. Writing from the base target would rewrite the `default` input the hash is\n * computed over, so the target could never cache-hit.\n *\n * Scoped to the project's own `src` rather than `-recursive`, so it checks the\n * files the vended templates cover. `-diff` names what to fix when it fails.\n */\nexport const TERRAFORM_FORMAT_TARGET: TargetConfiguration = {\n  executor: 'nx:run-commands',\n  cache: true,\n  inputs: ['default'],\n  options: {\n    command: 'terraform fmt -check -diff',\n    forwardAllArgs: true,\n    cwd: '{projectRoot}/src',\n  },\n  configurations: {\n    fix: {\n      command: 'terraform fmt',\n    },\n    'skip-lint': {\n      // Cross-platform no-op (`true` is not available on Windows cmd).\n      command: 'node -e \"\"',\n    },\n  },\n};\n\nexport async function terraformProjectGenerator(\n  tree: Tree,\n  schema: TerraformProjectGeneratorSchema,\n): Promise<GeneratorCallback> {\n  // Just use getTsLibDetails as it isn't specific to TS\n  const lib = getTsLibDetails(tree, schema);\n  const { fullyQualifiedName: sharedTfProjectName } = getTsLibDetails(tree, {\n    name: SHARED_TERRAFORM_NAME,\n  });\n\n  const outDirToRootRelativePath = relative(\n    join(tree.root, lib.dir, 'src'),\n    tree.root,\n  ).replace(/\\\\/g, '/');\n  const distDir = joinPathFragments(\n    outDirToRootRelativePath,\n    'dist',\n    '{projectRoot}',\n  );\n  const tfDistDir = joinPathFragments(distDir, 'terraform');\n  const checkovReportJsonPath = joinPathFragments(\n    distDir,\n    'checkov',\n    'checkov_report.json',\n  );\n  // `terraform-init` keeps its `.terraform` here rather than in `src`, so it\n  // never races the backend-configured targets over the shared one. `test` and\n  // `validate` read this same directory rather than initialising their own.\n  const initDataDir = joinPathFragments(distDir, 'terraform-init');\n\n  // Provider downloads persist here, so a target whose `.terraform` was cleaned\n  // links the providers it already has rather than re-downloading them. Nx does\n  // not interpolate `{workspaceRoot}` inside `env`, so this is relative to the\n  // target's `cwd`. It sits under `.terraform`, which this generator gitignores\n  // — that is also what keeps the providers out of Nx's file walk — and unlike\n  // `.nx/cache` it survives `nx reset`.\n  //\n  // One cache per project rather than one for the workspace: two `terraform\n  // init` runs filling a shared cache concurrently each compute a different hash\n  // for the same provider, because the hash covers a directory the other is\n  // still writing, and terraform then rejects the mismatch against the lock\n  // file. `terraform-init` is the only target that fills it, and the targets that\n  // need the providers depend on that one, so no two writers ever meet.\n  const pluginCacheDir = joinPathFragments(\n    outDirToRootRelativePath,\n    '.terraform',\n    'plugin-cache',\n    '{projectRoot}',\n  );\n\n  // Calculate relative path from current project to common/terraform/metrics\n  // Use forward slashes for terraform module source paths (even on Windows)\n  const metricsModulePath = relative(\n    join(tree.root, lib.dir, 'src'),\n    join(tree.root, 'packages', SHARED_TERRAFORM_DIR, 'src', 'metrics'),\n  ).replace(/\\\\/g, '/');\n\n  updateGitIgnore(tree, '.', (patterns) => [...patterns, '.terraform']);\n\n  const applicationTargets: {\n    [targetName: string]: TargetConfiguration;\n  } = {\n    apply: {\n      executor: 'nx:run-commands',\n      defaultConfiguration: 'dev',\n      configurations: {\n        dev: {\n          command: `terraform apply ${tfDistDir}/dev.tfplan`,\n        },\n      },\n      options: {\n        forwardAllArgs: true,\n        cwd: '{projectRoot}/src',\n      },\n      dependsOn: ['plan'],\n    },\n    bootstrap: {\n      executor: 'nx:run-commands',\n      options: {\n        forwardAllArgs: true,\n        commands: ['tsx {projectRoot}/scripts/bootstrap.ts {projectRoot}'],\n        cwd: '{workspaceRoot}',\n      },\n    },\n    'bootstrap-destroy': {\n      executor: 'nx:run-commands',\n      options: {\n        forwardAllArgs: true,\n        commands: [\n          'tsx {projectRoot}/scripts/bootstrap-destroy.ts {projectRoot}',\n        ],\n        cwd: '{workspaceRoot}',\n      },\n    },\n    build: {\n      dependsOn: ['format', 'checkov', 'test', `${sharedTfProjectName}:build`],\n    },\n    deploy: {\n      dependsOn: ['apply'],\n    },\n    // The artifact-only sibling of build, which `plan` depends on.\n    assemble: {\n      dependsOn: [`${sharedTfProjectName}:assemble`],\n    },\n    destroy: {\n      executor: 'nx:run-commands',\n      defaultConfiguration: 'dev',\n      configurations: {\n        dev: {\n          command: 'terraform destroy -var-file=env/dev.tfvars',\n        },\n      },\n      options: {\n        forwardAllArgs: true,\n        cwd: '{projectRoot}/src',\n      },\n      dependsOn: ['init'],\n    },\n    init: {\n      executor: 'nx:run-commands',\n      defaultConfiguration: 'dev',\n      configurations: {\n        dev: {\n          env: { TF_ENV: 'dev' },\n        },\n      },\n      options: {\n        forwardAllArgs: true,\n        commands: ['tsx {projectRoot}/scripts/init.ts {projectRoot}'],\n        cwd: '{workspaceRoot}',\n      },\n      dependsOn: ['terraform-init', '^init'],\n    },\n    // Reads remote state, which no input can hash.\n    output: {\n      executor: 'nx:run-commands',\n      cache: false,\n      options: {\n        command: 'terraform output -json',\n        forwardAllArgs: true,\n        cwd: '{projectRoot}/src',\n      },\n    },\n    plan: {\n      executor: 'nx:run-commands',\n      defaultConfiguration: 'dev',\n      configurations: {\n        dev: {\n          commands: [\n            `shx mkdir -p ${tfDistDir}`,\n            `terraform plan -var-file=env/dev.tfvars -out=${tfDistDir}/dev.tfplan`,\n          ],\n        },\n      },\n      options: {\n        forwardAllArgs: true,\n        cwd: '{projectRoot}/src',\n        parallel: false,\n      },\n      dependsOn: ['init', 'validate', '^validate', 'assemble'],\n    },\n  };\n\n  const libTargets: {\n    [targetName: string]: TargetConfiguration;\n  } = {\n    build: {\n      dependsOn: ['format', 'checkov', 'test'],\n    },\n    // A Terraform library vends modules rather than a deployable artifact, so\n    // its `assemble` carries only whatever the consuming projects register on it.\n    assemble: {\n      executor: 'nx:noop',\n    },\n    format: TERRAFORM_FORMAT_TARGET,\n    // Terraform has no linter of its own, so `lint` orchestrates the format\n    // check. It exists so `nx run-many --target lint` reaches terraform\n    // projects, and so `--configuration=fix` and `--configuration=skip-lint`\n    // propagate to `format` the way they do for TypeScript and Python projects.\n    lint: {\n      dependsOn: ['format'],\n    },\n    init: {\n      executor: 'nx:run-commands',\n      defaultConfiguration: 'dev',\n      configurations: {\n        dev: {\n          commands: [\n            {\n              command: `shx mkdir -p ${pluginCacheDir}`,\n              forwardAllArgs: false,\n            },\n            'terraform init',\n          ],\n        },\n      },\n      options: {\n        forwardAllArgs: true,\n        cwd: '{projectRoot}/src',\n        parallel: false,\n        env: { TF_PLUGIN_CACHE_DIR: pluginCacheDir },\n      },\n      dependsOn: ['terraform-init'],\n    },\n    // `-backend=false` installs the modules and providers without configuring\n    // the S3 backend, so this needs no credentials and runs on a fresh\n    // workspace before `bootstrap`. Uncached: a cache hit on another machine\n    // would report success over an empty `TF_DATA_DIR` and plugin cache.\n    'terraform-init': {\n      executor: 'nx:run-commands',\n      options: {\n        commands: [\n          { command: `shx mkdir -p ${pluginCacheDir}`, forwardAllArgs: false },\n          'terraform init -backend=false',\n        ],\n        forwardAllArgs: true,\n        cwd: '{projectRoot}/src',\n        parallel: false,\n        env: {\n          TF_DATA_DIR: initDataDir,\n          TF_PLUGIN_CACHE_DIR: pluginCacheDir,\n        },\n      },\n    },\n    // `^production` mirrors `test`: checkov resolves the relative modules a\n    // project consumes, so a change in one must invalidate the scan.\n    checkov: {\n      executor: 'nx:run-commands',\n      cache: true,\n      inputs: ['default', '^production'],\n      outputs: ['{workspaceRoot}/dist/{projectRoot}/checkov'],\n      options: {\n        command: uvxCommand(\n          'checkov',\n          `--config-file ../checkov.yml --directory . -o cli -o json --output-file-path console,${checkovReportJsonPath}`,\n        ),\n        forwardAllArgs: true,\n        cwd: '{projectRoot}/src',\n      },\n    },\n    // Terraform's native test framework, which runs any `.tftest.hcl` files.\n    // A project with none is a no-op success. Runs against the `TF_DATA_DIR`\n    // `terraform-init` prepared, so it needs no credentials and works on a fresh\n    // workspace before `bootstrap`. `^production` is what invalidates the cache\n    // when a consumed module changes; `{projectRoot}/**/*` alone would serve a\n    // stale pass.\n    //\n    // `TF_DATA_DIR` is terraform's working directory, not an artifact: its\n    // provider entries are symlinks into the shared plugin cache, so restoring\n    // it on another machine would yield dangling links while the commands that\n    // repopulate them are skipped. Declaring no outputs keeps a cache hit to\n    // what it actually asserts — that the tests passed for these inputs.\n    test: {\n      executor: 'nx:run-commands',\n      cache: true,\n      inputs: ['default', '^production'],\n      outputs: [],\n      options: {\n        command: 'terraform test',\n        forwardAllArgs: true,\n        cwd: '{projectRoot}/src',\n        env: { TF_DATA_DIR: initDataDir },\n      },\n      dependsOn: ['terraform-init'],\n    },\n    // Mirrors `test`: validates against the `TF_DATA_DIR` `terraform-init`\n    // prepared, and declares no outputs for the same reason (see `test` above).\n    validate: {\n      executor: 'nx:run-commands',\n      cache: true,\n      inputs: ['default', '^production'],\n      outputs: [],\n      options: {\n        command: 'terraform validate',\n        forwardAllArgs: true,\n        cwd: '{projectRoot}/src',\n        env: { TF_DATA_DIR: initDataDir },\n      },\n      dependsOn: ['terraform-init'],\n    },\n  };\n\n  const projectConfiguration = {\n    root: lib.dir,\n    projectType: schema.type,\n    sourceRoot: joinPathFragments(lib.dir, 'src'),\n    targets: sortObjectKeys({\n      ...libTargets,\n      ...(schema.type === 'application' ? applicationTargets : {}),\n    }),\n  };\n\n  // Only create the project configuration on first run; skip it on re-run so\n  // existing project.json customisations are preserved.\n  if (!projectExists(tree, lib.fullyQualifiedName)) {\n    addProjectConfiguration(tree, lib.fullyQualifiedName, projectConfiguration);\n  }\n\n  // The `lint` target checks licenses alongside formatting, as it does for\n  // TypeScript and Python projects.\n  addLicenseCheckToLintTarget(tree, lib.fullyQualifiedName);\n\n  // This generator IS the Terraform project, so the provider is fixed.\n  addGeneratorMetadata(\n    tree,\n    lib.fullyQualifiedName,\n    TERRAFORM_PROJECT_GENERATOR_INFO,\n    { iac: 'terraform' },\n  );\n\n  // The guides tell the reader to declare resources in `main.tf`, add variables\n  // and outputs, and configure environments in `env/*.tfvars`, so everything\n  // here is scaffolded once and then left alone. Provider version bumps reach\n  // `providers.tf` through the vended version sync, which rewrites the pin in\n  // place rather than the whole file.\n  generateFiles(\n    tree,\n    joinPathFragments(import.meta.dirname, `./files/${schema.type}`),\n    lib.dir,\n    {\n      metricsModulePath,\n      stateKeyPrefix: kebabCase(lib.fullyQualifiedName),\n      ...terraformProviderVersions(),\n    },\n    {\n      overwriteStrategy: OverwriteStrategy.KeepExisting,\n    },\n  );\n\n  // Checkov skips are the user's to curate, so preserve any they have added.\n  generateFiles(\n    tree,\n    joinPathFragments(import.meta.dirname, './files/checkov'),\n    lib.dir,\n    {},\n    {\n      overwriteStrategy: OverwriteStrategy.KeepExisting,\n    },\n  );\n\n  const nxJson = readNxJson(tree);\n\n  if (\n    !nxJson.plugins?.find((p) =>\n      typeof p === 'string'\n        ? p === NX_EXTEND_PLUGIN\n        : p.plugin === NX_EXTEND_PLUGIN,\n    )\n  ) {\n    nxJson.plugins = [...(nxJson.plugins ?? []), NX_EXTEND_PLUGIN];\n    updateNxJson(tree, nxJson);\n  }\n\n  // Ensure shared constructs for Terraform are created\n  await sharedConstructsGenerator(tree, { iac: 'terraform' }, DEPENDENCIES);\n\n  // Add Terraform metrics\n  await addGeneratorMetricsIfApplicable(tree, [\n    TERRAFORM_PROJECT_GENERATOR_INFO,\n  ]);\n\n  addTsDependencies(tree, DEPENDENCIES);\n\n  // @nx-extend/terraform has a peer dependency on @nx/devkit ^21.0.0 which causes\n  // npm install to fail, so for NPM we add a resolution\n  // Can remove when https://github.com/TriPSs/nx-extend/issues/407 is addressed\n  if (detectPackageManager() === 'npm') {\n    updateJson(tree, 'package.json', (packageJson) => {\n      packageJson.overrides = {\n        ...packageJson.overrides,\n        ...withVersions(DEPENDENCIES, ['@nx/devkit']),\n      };\n      return packageJson;\n    });\n  }\n\n  // `updateProjectConfiguration` re-serialises project.json with every inline\n  // array expanded, which the vended `format` target rejects.\n  await formatFilesInSubtree(tree);\n\n  // `@nx-extend/terraform` is registered as an Nx plugin in nx.json, so Nx\n  // loads it when computing the project graph — it must resolve even if the\n  // caller would otherwise prefer to defer installing.\n  return () =>\n    installDependencies(tree, schema.preferInstallDependencies, {\n      languages: ['typescript'],\n      ensureResolvable: [NX_EXTEND_PLUGIN],\n    });\n}\nexport default terraformProjectGenerator;\n"],"names":["addProjectConfiguration","detectPackageManager","generateFiles","joinPathFragments","OverwriteStrategy","readNxJson","updateJson","updateNxJson","join","relative","addLicenseCheckToLintTarget","getTsLibDetails","addTsDependencies","declareDependencies","ownedElsewhere","formatFilesInSubtree","updateGitIgnore","installDependencies","addGeneratorMetricsIfApplicable","kebabCase","addGeneratorMetadata","getGeneratorInfo","projectExists","sortObjectKeys","uvxCommand","sharedConstructsGenerator","SHARED_CONSTRUCTS_DEPENDENCIES","SHARED_TERRAFORM_DIR","SHARED_TERRAFORM_NAME","terraformProviderVersions","withVersions","DEPENDENCIES","ts","name","dev","root","versionOnly","NX_EXTEND_PLUGIN","TERRAFORM_PROJECT_GENERATOR_INFO","filename","TERRAFORM_FORMAT_TARGET","executor","cache","inputs","options","command","forwardAllArgs","cwd","configurations","fix","terraformProjectGenerator","tree","schema","lib","fullyQualifiedName","sharedTfProjectName","outDirToRootRelativePath","dir","replace","distDir","tfDistDir","checkovReportJsonPath","initDataDir","pluginCacheDir","metricsModulePath","patterns","applicationTargets","apply","defaultConfiguration","dependsOn","bootstrap","commands","build","deploy","assemble","destroy","init","env","TF_ENV","output","plan","parallel","libTargets","format","lint","TF_PLUGIN_CACHE_DIR","TF_DATA_DIR","checkov","outputs","test","validate","projectConfiguration","projectType","type","sourceRoot","targets","iac","dirname","stateKeyPrefix","overwriteStrategy","KeepExisting","nxJson","plugins","find","p","plugin","packageJson","overrides","preferInstallDependencies","languages","ensureResolvable"],"mappings":"AAAA;;;CAGC,GACD,SACEA,uBAAuB,EACvBC,oBAAoB,EAEpBC,aAAa,EACbC,iBAAiB,EACjBC,iBAAiB,EACjBC,UAAU,EAGVC,UAAU,EACVC,YAAY,QACP,aAAa;AACpB,SAASC,IAAI,EAAEC,QAAQ,QAAQ,OAAO;AACtC,SAASC,2BAA2B,QAAQ,0BAA0B;AACtE,SAASC,eAAe,QAAQ,4BAA4B;AAC5D,SAASC,iBAAiB,QAAQ,kCAAkC;AACpE,SACEC,mBAAmB,EACnBC,cAAc,QACT,uCAAuC;AAC9C,SAASC,oBAAoB,QAAQ,wBAAwB;AAC7D,SAASC,eAAe,QAAQ,qBAAqB;AACrD,SAASC,mBAAmB,QAAQ,yBAAyB;AAC7D,SAASC,+BAA+B,QAAQ,yBAAyB;AACzE,SAASC,SAAS,QAAQ,uBAAuB;AACjD,SACEC,oBAAoB,EACpBC,gBAAgB,EAEhBC,aAAa,QACR,oBAAoB;AAC3B,SAASC,cAAc,QAAQ,wBAAwB;AACvD,SAASC,UAAU,QAAQ,oBAAoB;AAC/C,SAASC,yBAAyB,QAAQ,mCAAmC;AAC7E,SACEC,8BAA8B,EAC9BC,oBAAoB,EACpBC,qBAAqB,QAChB,6CAA6C;AACpD,SACEC,yBAAyB,EACzBC,YAAY,QACP,0BAA0B;AAGjC,+EAA+E;AAC/E,gFAAgF;AAChF,oEAAoE;AACpE,OAAO,MAAMC,eAAelB,sBAAsB;IAChDmB,IAAI;QACF;YAAEC,MAAM;YAAwBC,KAAK;YAAMC,MAAM;QAAK;QACtD;YAAEF,MAAM;YAAOC,KAAK;YAAMC,MAAM;QAAK;QACrC;YAAEF,MAAM;YAAOC,KAAK;YAAMC,MAAM;QAAK;QACrC;YAAEF,MAAM;YAAsBC,KAAK;YAAMC,MAAM;QAAK;QACpD;YAAEF,MAAM;YAAuBC,KAAK;YAAMC,MAAM;QAAK;QACrD;YAAEF,MAAM;YAAiCC,KAAK;YAAMC,MAAM;QAAK;QAC/D;YAAEF,MAAM;YAA2BC,KAAK;YAAMC,MAAM;QAAK;QACzD;YAAEF,MAAM;YAAgCC,KAAK;YAAMC,MAAM;QAAK;QAC9D,4EAA4E;QAC5E;YAAEF,MAAM;YAAcG,aAAa;QAAK;WACrCtB,eAAeY;KACnB;AACH,GAAG;AAEH,MAAMW,mBAAmB;AACzB,OAAO,MAAMC,mCACXjB,iBAAiB,YAAYkB,QAAQ,EAAE;AAEzC;;;;;;;;CAQC,GACD,OAAO,MAAMC,0BAA+C;IAC1DC,UAAU;IACVC,OAAO;IACPC,QAAQ;QAAC;KAAU;IACnBC,SAAS;QACPC,SAAS;QACTC,gBAAgB;QAChBC,KAAK;IACP;IACAC,gBAAgB;QACdC,KAAK;YACHJ,SAAS;QACX;QACA,aAAa;YACX,iEAAiE;YACjEA,SAAS;QACX;IACF;AACF,EAAE;AAEF,OAAO,eAAeK,0BACpBC,IAAU,EACVC,MAAuC;IAEvC,sDAAsD;IACtD,MAAMC,MAAM1C,gBAAgBwC,MAAMC;IAClC,MAAM,EAAEE,oBAAoBC,mBAAmB,EAAE,GAAG5C,gBAAgBwC,MAAM;QACxElB,MAAML;IACR;IAEA,MAAM4B,2BAA2B/C,SAC/BD,KAAK2C,KAAKhB,IAAI,EAAEkB,IAAII,GAAG,EAAE,QACzBN,KAAKhB,IAAI,EACTuB,OAAO,CAAC,OAAO;IACjB,MAAMC,UAAUxD,kBACdqD,0BACA,QACA;IAEF,MAAMI,YAAYzD,kBAAkBwD,SAAS;IAC7C,MAAME,wBAAwB1D,kBAC5BwD,SACA,WACA;IAEF,2EAA2E;IAC3E,6EAA6E;IAC7E,0EAA0E;IAC1E,MAAMG,cAAc3D,kBAAkBwD,SAAS;IAE/C,8EAA8E;IAC9E,8EAA8E;IAC9E,6EAA6E;IAC7E,8EAA8E;IAC9E,6EAA6E;IAC7E,sCAAsC;IACtC,EAAE;IACF,0EAA0E;IAC1E,+EAA+E;IAC/E,0EAA0E;IAC1E,0EAA0E;IAC1E,gFAAgF;IAChF,sEAAsE;IACtE,MAAMI,iBAAiB5D,kBACrBqD,0BACA,cACA,gBACA;IAGF,2EAA2E;IAC3E,0EAA0E;IAC1E,MAAMQ,oBAAoBvD,SACxBD,KAAK2C,KAAKhB,IAAI,EAAEkB,IAAII,GAAG,EAAE,QACzBjD,KAAK2C,KAAKhB,IAAI,EAAE,YAAYR,sBAAsB,OAAO,YACzD+B,OAAO,CAAC,OAAO;IAEjB1C,gBAAgBmC,MAAM,KAAK,CAACc,WAAa;eAAIA;YAAU;SAAa;IAEpE,MAAMC,qBAEF;QACFC,OAAO;YACL1B,UAAU;YACV2B,sBAAsB;YACtBpB,gBAAgB;gBACdd,KAAK;oBACHW,SAAS,CAAC,gBAAgB,EAAEe,UAAU,WAAW,CAAC;gBACpD;YACF;YACAhB,SAAS;gBACPE,gBAAgB;gBAChBC,KAAK;YACP;YACAsB,WAAW;gBAAC;aAAO;QACrB;QACAC,WAAW;YACT7B,UAAU;YACVG,SAAS;gBACPE,gBAAgB;gBAChByB,UAAU;oBAAC;iBAAuD;gBAClExB,KAAK;YACP;QACF;QACA,qBAAqB;YACnBN,UAAU;YACVG,SAAS;gBACPE,gBAAgB;gBAChByB,UAAU;oBACR;iBACD;gBACDxB,KAAK;YACP;QACF;QACAyB,OAAO;YACLH,WAAW;gBAAC;gBAAU;gBAAW;gBAAQ,GAAGd,oBAAoB,MAAM,CAAC;aAAC;QAC1E;QACAkB,QAAQ;YACNJ,WAAW;gBAAC;aAAQ;QACtB;QACA,+DAA+D;QAC/DK,UAAU;YACRL,WAAW;gBAAC,GAAGd,oBAAoB,SAAS,CAAC;aAAC;QAChD;QACAoB,SAAS;YACPlC,UAAU;YACV2B,sBAAsB;YACtBpB,gBAAgB;gBACdd,KAAK;oBACHW,SAAS;gBACX;YACF;YACAD,SAAS;gBACPE,gBAAgB;gBAChBC,KAAK;YACP;YACAsB,WAAW;gBAAC;aAAO;QACrB;QACAO,MAAM;YACJnC,UAAU;YACV2B,sBAAsB;YACtBpB,gBAAgB;gBACdd,KAAK;oBACH2C,KAAK;wBAAEC,QAAQ;oBAAM;gBACvB;YACF;YACAlC,SAAS;gBACPE,gBAAgB;gBAChByB,UAAU;oBAAC;iBAAkD;gBAC7DxB,KAAK;YACP;YACAsB,WAAW;gBAAC;gBAAkB;aAAQ;QACxC;QACA,+CAA+C;QAC/CU,QAAQ;YACNtC,UAAU;YACVC,OAAO;YACPE,SAAS;gBACPC,SAAS;gBACTC,gBAAgB;gBAChBC,KAAK;YACP;QACF;QACAiC,MAAM;YACJvC,UAAU;YACV2B,sBAAsB;YACtBpB,gBAAgB;gBACdd,KAAK;oBACHqC,UAAU;wBACR,CAAC,aAAa,EAAEX,WAAW;wBAC3B,CAAC,6CAA6C,EAAEA,UAAU,WAAW,CAAC;qBACvE;gBACH;YACF;YACAhB,SAAS;gBACPE,gBAAgB;gBAChBC,KAAK;gBACLkC,UAAU;YACZ;YACAZ,WAAW;gBAAC;gBAAQ;gBAAY;gBAAa;aAAW;QAC1D;IACF;IAEA,MAAMa,aAEF;QACFV,OAAO;YACLH,WAAW;gBAAC;gBAAU;gBAAW;aAAO;QAC1C;QACA,0EAA0E;QAC1E,8EAA8E;QAC9EK,UAAU;YACRjC,UAAU;QACZ;QACA0C,QAAQ3C;QACR,wEAAwE;QACxE,oEAAoE;QACpE,yEAAyE;QACzE,4EAA4E;QAC5E4C,MAAM;YACJf,WAAW;gBAAC;aAAS;QACvB;QACAO,MAAM;YACJnC,UAAU;YACV2B,sBAAsB;YACtBpB,gBAAgB;gBACdd,KAAK;oBACHqC,UAAU;wBACR;4BACE1B,SAAS,CAAC,aAAa,EAAEkB,gBAAgB;4BACzCjB,gBAAgB;wBAClB;wBACA;qBACD;gBACH;YACF;YACAF,SAAS;gBACPE,gBAAgB;gBAChBC,KAAK;gBACLkC,UAAU;gBACVJ,KAAK;oBAAEQ,qBAAqBtB;gBAAe;YAC7C;YACAM,WAAW;gBAAC;aAAiB;QAC/B;QACA,0EAA0E;QAC1E,mEAAmE;QACnE,yEAAyE;QACzE,qEAAqE;QACrE,kBAAkB;YAChB5B,UAAU;YACVG,SAAS;gBACP2B,UAAU;oBACR;wBAAE1B,SAAS,CAAC,aAAa,EAAEkB,gBAAgB;wBAAEjB,gBAAgB;oBAAM;oBACnE;iBACD;gBACDA,gBAAgB;gBAChBC,KAAK;gBACLkC,UAAU;gBACVJ,KAAK;oBACHS,aAAaxB;oBACbuB,qBAAqBtB;gBACvB;YACF;QACF;QACA,wEAAwE;QACxE,iEAAiE;QACjEwB,SAAS;YACP9C,UAAU;YACVC,OAAO;YACPC,QAAQ;gBAAC;gBAAW;aAAc;YAClC6C,SAAS;gBAAC;aAA6C;YACvD5C,SAAS;gBACPC,SAASrB,WACP,WACA,CAAC,qFAAqF,EAAEqC,uBAAuB;gBAEjHf,gBAAgB;gBAChBC,KAAK;YACP;QACF;QACA,yEAAyE;QACzE,yEAAyE;QACzE,6EAA6E;QAC7E,4EAA4E;QAC5E,2EAA2E;QAC3E,cAAc;QACd,EAAE;QACF,uEAAuE;QACvE,2EAA2E;QAC3E,2EAA2E;QAC3E,yEAAyE;QACzE,qEAAqE;QACrE0C,MAAM;YACJhD,UAAU;YACVC,OAAO;YACPC,QAAQ;gBAAC;gBAAW;aAAc;YAClC6C,SAAS,EAAE;YACX5C,SAAS;gBACPC,SAAS;gBACTC,gBAAgB;gBAChBC,KAAK;gBACL8B,KAAK;oBAAES,aAAaxB;gBAAY;YAClC;YACAO,WAAW;gBAAC;aAAiB;QAC/B;QACA,uEAAuE;QACvE,4EAA4E;QAC5EqB,UAAU;YACRjD,UAAU;YACVC,OAAO;YACPC,QAAQ;gBAAC;gBAAW;aAAc;YAClC6C,SAAS,EAAE;YACX5C,SAAS;gBACPC,SAAS;gBACTC,gBAAgB;gBAChBC,KAAK;gBACL8B,KAAK;oBAAES,aAAaxB;gBAAY;YAClC;YACAO,WAAW;gBAAC;aAAiB;QAC/B;IACF;IAEA,MAAMsB,uBAAuB;QAC3BxD,MAAMkB,IAAII,GAAG;QACbmC,aAAaxC,OAAOyC,IAAI;QACxBC,YAAY3F,kBAAkBkD,IAAII,GAAG,EAAE;QACvCsC,SAASxE,eAAe;YACtB,GAAG2D,UAAU;YACb,GAAI9B,OAAOyC,IAAI,KAAK,gBAAgB3B,qBAAqB,CAAC,CAAC;QAC7D;IACF;IAEA,2EAA2E;IAC3E,sDAAsD;IACtD,IAAI,CAAC5C,cAAc6B,MAAME,IAAIC,kBAAkB,GAAG;QAChDtD,wBAAwBmD,MAAME,IAAIC,kBAAkB,EAAEqC;IACxD;IAEA,yEAAyE;IACzE,kCAAkC;IAClCjF,4BAA4ByC,MAAME,IAAIC,kBAAkB;IAExD,qEAAqE;IACrElC,qBACE+B,MACAE,IAAIC,kBAAkB,EACtBhB,kCACA;QAAE0D,KAAK;IAAY;IAGrB,8EAA8E;IAC9E,2EAA2E;IAC3E,4EAA4E;IAC5E,4EAA4E;IAC5E,oCAAoC;IACpC9F,cACEiD,MACAhD,kBAAkB,YAAY8F,OAAO,EAAE,CAAC,QAAQ,EAAE7C,OAAOyC,IAAI,EAAE,GAC/DxC,IAAII,GAAG,EACP;QACEO;QACAkC,gBAAgB/E,UAAUkC,IAAIC,kBAAkB;QAChD,GAAGzB,2BAA2B;IAChC,GACA;QACEsE,mBAAmB/F,kBAAkBgG,YAAY;IACnD;IAGF,2EAA2E;IAC3ElG,cACEiD,MACAhD,kBAAkB,YAAY8F,OAAO,EAAE,oBACvC5C,IAAII,GAAG,EACP,CAAC,GACD;QACE0C,mBAAmB/F,kBAAkBgG,YAAY;IACnD;IAGF,MAAMC,SAAShG,WAAW8C;IAE1B,IACE,CAACkD,OAAOC,OAAO,EAAEC,KAAK,CAACC,IACrB,OAAOA,MAAM,WACTA,MAAMnE,mBACNmE,EAAEC,MAAM,KAAKpE,mBAEnB;QACAgE,OAAOC,OAAO,GAAG;eAAKD,OAAOC,OAAO,IAAI,EAAE;YAAGjE;SAAiB;QAC9D9B,aAAa4C,MAAMkD;IACrB;IAEA,qDAAqD;IACrD,MAAM5E,0BAA0B0B,MAAM;QAAE6C,KAAK;IAAY,GAAGjE;IAE5D,wBAAwB;IACxB,MAAMb,gCAAgCiC,MAAM;QAC1Cb;KACD;IAED1B,kBAAkBuC,MAAMpB;IAExB,gFAAgF;IAChF,sDAAsD;IACtD,8EAA8E;IAC9E,IAAI9B,2BAA2B,OAAO;QACpCK,WAAW6C,MAAM,gBAAgB,CAACuD;YAChCA,YAAYC,SAAS,GAAG;gBACtB,GAAGD,YAAYC,SAAS;gBACxB,GAAG7E,aAAaC,cAAc;oBAAC;iBAAa,CAAC;YAC/C;YACA,OAAO2E;QACT;IACF;IAEA,4EAA4E;IAC5E,4DAA4D;IAC5D,MAAM3F,qBAAqBoC;IAE3B,yEAAyE;IACzE,0EAA0E;IAC1E,qDAAqD;IACrD,OAAO,IACLlC,oBAAoBkC,MAAMC,OAAOwD,yBAAyB,EAAE;YAC1DC,WAAW;gBAAC;aAAa;YACzBC,kBAAkB;gBAACzE;aAAiB;QACtC;AACJ;AACA,eAAea,0BAA0B"}

package/src/ts/agent/a2a-connection/generator.d.ts

@@ -8,53 +8,49 @@ import type { TsAgentA2aConnectionGeneratorSchema } from './schema';
 export declare const DEPENDENCIES: import("../../../utils/declared-dependencies.js").DependencyDeclaration<readonly [{
     readonly name: "@a2a-js/sdk";
     readonly root: true;
-}, {
-    readonly name: "@strands-agents/sdk";
-    readonly root: true;
-}, {
-    readonly name: "@aws-lambda-powertools/parameters";
-    readonly root: true;
-}, {
-    readonly name: "@aws-sdk/client-appconfigdata";
-    readonly root: true;
-}, {
-    readonly name: "aws4fetch";
-    readonly root: true;
-}, {
-    readonly name: "@aws-sdk/credential-providers";
-    readonly root: true;
-}, {
-    readonly name: "zod";
-    readonly root: true;
-}, {
+}, ...({
+    name: "@aws-sdk/client-s3" | "@strands-agents/sdk" | "express";
+    root: boolean;
+} | ({
     readonly name: "@aws-lambda-powertools/parameters";
 } & {
     versionOnly: true;
-}, {
+}) | ({
     readonly name: "@aws-sdk/credential-providers";
 } & {
     versionOnly: true;
-}, {
+}) | ({
     readonly name: "aws4fetch";
 } & {
     versionOnly: true;
-}, {
+}) | ({
     readonly name: "@modelcontextprotocol/sdk";
 } & {
     versionOnly: true;
-}, {
+}) | ({
     readonly name: "@a2a-js/sdk";
 } & {
     versionOnly: true;
-}, {
-    readonly name: "@strands-agents/sdk";
+}) | ({
+    name: "@aws-sdk/client-s3" | "@strands-agents/sdk" | "express";
 } & {
     versionOnly: true;
-}, {
-    readonly name: "@aws-sdk/client-s3";
-} & {
-    versionOnly: true;
-}], readonly import("../../../utils/declared-dependencies.js").DeclaredPyDependency<"ruff" | "a2a-sdk" | "ag-ui-langgraph" | "ag-ui-protocol" | "ag-ui-strands" | "aiosqlite" | "aws-lambda-powertools" | "aws-lambda-powertools[tracer]" | "aws-lambda-powertools[parser]" | "aws-opentelemetry-distro" | "bedrock-agentcore" | "boto3" | "checkov" | "fastapi" | "fastapi[standard]" | "httpx" | "langchain" | "langchain-aws" | "langchain-mcp-adapters" | "langgraph" | "langgraph-checkpoint-aws" | "langgraph-checkpoint-sqlite" | "mcp" | "pip-check-updates" | "pip-licenses" | "pydantic" | "strands-agents" | "strands-agents[a2a]" | "strands-agents-tools" | "ty" | "pynamodb" | "uvicorn" | "sqlmodel" | "alembic" | "aiomysql" | "asyncpg" | "greenlet", Record<string, never>>[]>;
+}) | {
+    readonly name: "@aws-lambda-powertools/parameters";
+    readonly root: true;
+} | {
+    readonly name: "@aws-sdk/client-appconfigdata";
+    readonly root: true;
+} | {
+    readonly name: "aws4fetch";
+    readonly root: true;
+} | {
+    readonly name: "@aws-sdk/credential-providers";
+    readonly root: true;
+} | {
+    readonly name: "zod";
+    readonly root: true;
+})[]], readonly import("../../../utils/declared-dependencies.js").DeclaredPyDependency<"ruff" | "a2a-sdk" | "ag-ui-langgraph" | "ag-ui-protocol" | "ag-ui-strands" | "aiosqlite" | "aws-lambda-powertools" | "aws-lambda-powertools[tracer]" | "aws-lambda-powertools[parser]" | "aws-opentelemetry-distro" | "bedrock-agentcore" | "boto3" | "checkov" | "fastapi" | "fastapi[standard]" | "httpx" | "langchain" | "langchain-aws" | "langchain-mcp-adapters" | "langgraph" | "langgraph-checkpoint-aws" | "langgraph-checkpoint-sqlite" | "mcp" | "pip-check-updates" | "pip-licenses" | "pydantic" | "strands-agents" | "strands-agents[a2a]" | "strands-agents-tools" | "ty" | "pynamodb" | "uvicorn" | "sqlmodel" | "alembic" | "aiomysql" | "asyncpg" | "greenlet", Record<string, never>>[]>;
 export declare const TS_AGENT_A2A_CONNECTION_GENERATOR_INFO: NxGeneratorInfo;
 export declare const tsAgentA2aConnectionGenerator: (tree: Tree, options: TsAgentA2aConnectionGeneratorSchema) => Promise<GeneratorCallback>;
 export default tsAgentA2aConnectionGenerator;

package/src/ts/agent/a2a-connection/generator.js

@@ -3,7 +3,7 @@
  * SPDX-License-Identifier: Apache-2.0
  */ import { generateFiles, joinPathFragments, OverwriteStrategy, updateProjectConfiguration } from "@nx/devkit";
 import { addTsDependencies } from "../../../utils/add-dependencies.js";
-import { AGENT_CONNECTION_DEPENDENCIES, AGENT_CONNECTION_PROJECT_DIR, addTypeScriptCoreClient, ensureTypeScriptAgentConnectionProject } from "../../../utils/agent-connection/agent-connection.js";
+import { AGENT_CONNECTION_DEPENDENCIES, AGENT_CONNECTION_PROJECT_DIR, addTypeScriptCoreClient, ensureTypeScriptAgentConnectionProject, STRANDS_PEER_DEPENDENCY_NAMES } from "../../../utils/agent-connection/agent-connection.js";
 import { addDestructuredImport, addStarExport, appendToArrayViaGritQL, applyGritQL } from "../../../utils/ast.js";
 import { declareDependencies, ownedElsewhere } from "../../../utils/declared-dependencies.js";
 import { formatFilesInSubtree } from "../../../utils/format.js";
@@ -25,10 +25,14 @@ export const DEPENDENCIES = declareDependencies()({
             name: '@a2a-js/sdk',
             root: true
         },
-        {
-            name: '@strands-agents/sdk',
-            root: true
-        },
+        // @strands-agents/sdk and its peers (STRANDS_PEER_DEPENDENCY_NAMES),
+        // pinned at the root so the root strands copy resolves the same peers as
+        // every other importer (see agent-connection.ts's TS_TEMPLATE_DEPS for
+        // the same reasoning).
+        ...STRANDS_PEER_DEPENDENCY_NAMES.map((name)=>({
+                name,
+                root: true
+            })),
         {
             name: '@aws-lambda-powertools/parameters',
             root: true