@aws/nx-plugin 1.0.8 → 1.0.10

package/migrations.json

@@ -2,30 +2,15 @@
   "$schema": "http://json-schema.org/schema",
   "name": "@aws/nx-plugin",
   "generators": {
-    "latest-pin-strands-express-peer": {
-      "version": "1.0.7",
-      "description": "Declare express in every project that declares @strands-agents/sdk without it so @strands-agents/sdk resolves to a single peer-suffixed instance",
-      "implementation": "./src/migrations/latest/pin-strands-express-peer/migration"
+    "latest-py-dynamodb-bind-base-model-meta": {
+      "version": "1.0.9",
+      "description": "Bind the py#dynamodb BaseModel Meta that 1.0.8 declared as a nested MetaProtocol subclass with the inherited MetaProtocol type, so the generated project type checks with ty 0.0.87",
+      "implementation": "./src/migrations/latest/py-dynamodb-bind-base-model-meta/migration"
     },
-    "latest-rdb-drop-lambda-rie": {
-      "version": "1.0.7",
-      "description": "Remove the Lambda Runtime Interface Emulator from vended ts#rdb and py#rdb Dockerfiles so its known HIGH vulnerabilities are not present in the image",
-      "implementation": "./src/migrations/latest/rdb-drop-lambda-rie/migration"
-    },
-    "latest-infra-test-loop": {
-      "version": "1.0.8",
-      "description": "Run CDK infrastructure tests against the artifacts their stacks deploy rather than every upstream build, in a per-run temp directory with CDK asset bundling skipped",
-      "implementation": "./src/migrations/latest/infra-test-loop/migration"
-    },
-    "latest-py-dynamodb-type-base-model-meta": {
-      "version": "1.0.8",
-      "description": "Declare the py#dynamodb BaseModel Meta class as a subclass of pynamodb's MetaProtocol so the generated project type checks with ty 0.0.86",
-      "implementation": "./src/migrations/latest/py-dynamodb-type-base-model-meta/migration"
-    },
-    "latest-cache-inputs-outputs": {
-      "version": "1.0.8",
-      "description": "Keep checkov reports and vitest coverage out of downstream task hashes, declare Smithy build inputs, cache ts#rdb Prisma client generation and stop caching Terraform output",
-      "implementation": "./src/migrations/latest/cache-inputs-outputs/migration"
+    "latest-pin-strands-mcp-client-peer": {
+      "version": "1.0.10",
+      "description": "Declare @modelcontextprotocol/client in every project that declares @strands-agents/sdk without it so the required peer resolves to the vended pin",
+      "implementation": "./src/migrations/latest/pin-strands-mcp-client-peer/migration"
     },
     "v1.0.0-rc.50-0001-modernize-function-props-cast": {
       "version": "1.0.0-rc.50",
@@ -407,8 +392,33 @@
       "description": "Publish a configured custom domain as the API URL in runtime config for vended REST/HTTP API constructs and Terraform modules, and add custom domain inputs to the Terraform API modules",
       "implementation": "./src/migrations/v1.0.5/0001-api-custom-domain-runtime-config/migration"
     },
-    "sync-vended-versions": {
+    "v1.0.7-0001-pin-strands-express-peer": {
+      "version": "1.0.7",
+      "description": "Declare express in every project that declares @strands-agents/sdk without it so @strands-agents/sdk resolves to a single peer-suffixed instance",
+      "implementation": "./src/migrations/v1.0.7/0001-pin-strands-express-peer/migration"
+    },
+    "v1.0.7-0002-rdb-drop-lambda-rie": {
+      "version": "1.0.7",
+      "description": "Remove the Lambda Runtime Interface Emulator from vended ts#rdb and py#rdb Dockerfiles so its known HIGH vulnerabilities are not present in the image",
+      "implementation": "./src/migrations/v1.0.7/0002-rdb-drop-lambda-rie/migration"
+    },
+    "v1.0.8-0001-infra-test-loop": {
       "version": "1.0.8",
+      "description": "Run CDK infrastructure tests against the artifacts their stacks deploy rather than every upstream build, in a per-run temp directory with CDK asset bundling skipped",
+      "implementation": "./src/migrations/v1.0.8/0001-infra-test-loop/migration"
+    },
+    "v1.0.8-0002-py-dynamodb-type-base-model-meta": {
+      "version": "1.0.8",
+      "description": "Declare the py#dynamodb BaseModel Meta as a subclass of pynamodb's MetaProtocol bound with the inherited MetaProtocol type, so the generated project type checks with ty 0.0.86 and 0.0.87",
+      "implementation": "./src/migrations/v1.0.8/0002-py-dynamodb-type-base-model-meta/migration"
+    },
+    "v1.0.8-0003-cache-inputs-outputs": {
+      "version": "1.0.8",
+      "description": "Keep checkov reports and vitest coverage out of downstream task hashes, declare Smithy build inputs, cache ts#rdb Prisma client generation and stop caching Terraform output",
+      "implementation": "./src/migrations/v1.0.8/0003-cache-inputs-outputs/migration"
+    },
+    "sync-vended-versions": {
+      "version": "1.0.10",
       "description": "Sync vended dependency versions and the tracked plugin version to those vended by this release",
       "implementation": "./src/utils/version-upgrade-migration/migration"
     }
@@ -545,6 +555,39 @@
           "alwaysAddToPackageJson": false
         }
       }
+    },
+    "nx-23.3.0-nx-packages": {
+      "version": "1.0.10",
+      "packages": {
+        "nx": {
+          "version": "23.3.0",
+          "alwaysAddToPackageJson": false
+        },
+        "@nx/devkit": {
+          "version": "23.3.0",
+          "alwaysAddToPackageJson": false
+        },
+        "@nx/js": {
+          "version": "23.3.0",
+          "alwaysAddToPackageJson": false
+        },
+        "@nx/react": {
+          "version": "23.3.0",
+          "alwaysAddToPackageJson": false
+        },
+        "@nx/vite": {
+          "version": "23.3.0",
+          "alwaysAddToPackageJson": false
+        },
+        "@nx/vitest": {
+          "version": "23.3.0",
+          "alwaysAddToPackageJson": false
+        },
+        "@nx/workspace": {
+          "version": "23.3.0",
+          "alwaysAddToPackageJson": false
+        }
+      }
     }
   }
 }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@aws/nx-plugin",
-  "version": "1.0.8",
+  "version": "1.0.10",
   "repository": {
     "type": "git",
     "url": "https://github.com/awslabs/nx-plugin-for-aws.git",
@@ -36,20 +36,20 @@
     "node": ">=20.19.0"
   },
   "peerDependencies": {
-    "nx": "23.2.1"
+    "nx": "23.3.0"
   },
   "dependencies": {
     "@apidevtools/swagger-parser": "12.1.0",
-    "@astral-sh/ruff-wasm-nodejs": "0.16.10",
+    "@astral-sh/ruff-wasm-nodejs": "0.17.0",
     "@biomejs/js-api": "6.0.0",
     "@biomejs/wasm-nodejs": "2.5.15",
     "@getgrit/gritql": "0.0.3",
     "@iarna/toml": "2.2.5",
-    "@modelcontextprotocol/sdk": "1.32.0",
-    "@nx/devkit": "23.2.1",
-    "@nx/js": "23.2.1",
-    "@nx/react": "23.2.1",
-    "@nx/vite": "23.2.1",
+    "@modelcontextprotocol/sdk": "1.32.1",
+    "@nx/devkit": "23.3.0",
+    "@nx/js": "23.3.0",
+    "@nx/react": "23.3.0",
+    "@nx/vite": "23.3.0",
     "@nxlv/python": "23.2.1",
     "@phenomnomnominal/tsquery": "6.2.0",
     "@types/estree": "1.0.9",
@@ -79,9 +79,9 @@
     "typescript": "6.0.3",
     "unified": "11.0.5",
     "unist-util-visit": "5.1.0",
-    "vite": "8.3.2",
+    "vite": "8.3.4",
     "vitest": "4.1.11",
-    "zod": "4.6.5"
+    "zod": "4.6.7"
   },
   "devDependencies": {
     "@types/semver": "7.8.0"

package/src/agentcore-gateway/__snapshots__/generator.spec.ts.snap

@@ -7,7 +7,7 @@ exports[`agentcore-gateway generator > protocol: http > omits protocol_type from
   required_providers {
     aws = {
       source  = "hashicorp/aws"
-      version = "6.67.0"
+      version = "6.68.0"
     }
     time = {
       source  = "hashicorp/time"

package/src/infra/app/__snapshots__/generator.spec.ts.snap

@@ -50,7 +50,7 @@ exports[`infra generator > should configure Checkov target correctly > checkov-t
     "default",
   ],
   "options": {
-    "command": "uvx --from checkov==3.3.22 checkov --config-file {projectRoot}/checkov.yml --directory dist/{projectRoot}/cdk.out --framework cloudformation",
+    "command": "uvx --from checkov==3.3.29 checkov --config-file {projectRoot}/checkov.yml --directory dist/{projectRoot}/cdk.out --framework cloudformation",
   },
   "outputs": [
     "{workspaceRoot}/dist/{projectRoot}/checkov",
@@ -150,7 +150,7 @@ exports[`infra generator > should configure project.json with correct targets >
         "default",
       ],
       "options": {
-        "command": "uvx --from checkov==3.3.22 checkov --config-file {projectRoot}/checkov.yml --directory dist/{projectRoot}/cdk.out --framework cloudformation",
+        "command": "uvx --from checkov==3.3.29 checkov --config-file {projectRoot}/checkov.yml --directory dist/{projectRoot}/cdk.out --framework cloudformation",
       },
       "outputs": [
         "{workspaceRoot}/dist/{projectRoot}/checkov",
@@ -767,7 +767,7 @@ exports[`infra generator > should handle custom project names correctly > custom
         "default",
       ],
       "options": {
-        "command": "uvx --from checkov==3.3.22 checkov --config-file {projectRoot}/checkov.yml --directory dist/{projectRoot}/cdk.out --framework cloudformation",
+        "command": "uvx --from checkov==3.3.29 checkov --config-file {projectRoot}/checkov.yml --directory dist/{projectRoot}/cdk.out --framework cloudformation",
       },
       "outputs": [
         "{workspaceRoot}/dist/{projectRoot}/checkov",

package/src/migrations/latest/pin-strands-mcp-client-peer/metadata.json

@@ -0,0 +1,3 @@
+{
+  "description": "Declare @modelcontextprotocol/client in every project that declares @strands-agents/sdk without it so the required peer resolves to the vended pin"
+}

package/src/migrations/latest/pin-strands-mcp-client-peer/migration.d.ts

@@ -0,0 +1,20 @@
+/**
+ * Copyright Amazon.com, Inc. or its affiliates. All Rights Reserved.
+ * SPDX-License-Identifier: Apache-2.0
+ */
+import { type MigrationReturnObject, type Tree } from '@nx/devkit';
+/**
+ * `@strands-agents/sdk` 1.20.0 replaced its required peer
+ * `@modelcontextprotocol/sdk` with `@modelcontextprotocol/client`. Nothing in
+ * a generated workspace declared that package, so pnpm auto-installs whatever
+ * its `latest` is, while the vended `@modelcontextprotocol/inspector` pulls
+ * its own exact version into the same graph. The generators now declare it
+ * at the vended pin wherever they declare strands; this carries an existing
+ * workspace to the same shape.
+ *
+ * Detection is generic, as in the earlier express peer migration: the
+ * workspace root, the shared agent-connection project (checked explicitly in
+ * case its project.json isn't registered) and every project's
+ * `package.json`, each checked for "declares @strands-agents/sdk".
+ */
+export default function migration(tree: Tree): Promise<MigrationReturnObject>;

package/src/migrations/latest/pin-strands-mcp-client-peer/migration.js

@@ -0,0 +1,51 @@
+/**
+ * Copyright Amazon.com, Inc. or its affiliates. All Rights Reserved.
+ * SPDX-License-Identifier: Apache-2.0
+ */ import { getProjects, joinPathFragments } from "@nx/devkit";
+import { AGENT_CONNECTION_PROJECT_DIR } from "../../../utils/agent-connection/agent-connection.js";
+import { addDependenciesToPackageJson } from "../../../utils/dependencies.js";
+import { formatFilesInSubtree } from "../../../utils/format.js";
+import { TS_VERSIONS } from "../../../utils/versions.js";
+const MCP_CLIENT = '@modelcontextprotocol/client';
+const STRANDS_SDK = '@strands-agents/sdk';
+const ROOT_PACKAGE_JSON = 'package.json';
+/**
+ * `@strands-agents/sdk` 1.20.0 replaced its required peer
+ * `@modelcontextprotocol/sdk` with `@modelcontextprotocol/client`. Nothing in
+ * a generated workspace declared that package, so pnpm auto-installs whatever
+ * its `latest` is, while the vended `@modelcontextprotocol/inspector` pulls
+ * its own exact version into the same graph. The generators now declare it
+ * at the vended pin wherever they declare strands; this carries an existing
+ * workspace to the same shape.
+ *
+ * Detection is generic, as in the earlier express peer migration: the
+ * workspace root, the shared agent-connection project (checked explicitly in
+ * case its project.json isn't registered) and every project's
+ * `package.json`, each checked for "declares @strands-agents/sdk".
+ */ export default async function migration(tree) {
+    pinIfNeeded(tree, ROOT_PACKAGE_JSON);
+    pinIfNeeded(tree, joinPathFragments(AGENT_CONNECTION_PROJECT_DIR, 'package.json'));
+    for (const project of getProjects(tree).values()){
+        pinIfNeeded(tree, joinPathFragments(project.root, 'package.json'));
+    }
+    await formatFilesInSubtree(tree);
+    return {
+        nextSteps: []
+    };
+}
+/** Declare the MCP client on the given manifest, if it declares strands. */ function pinIfNeeded(tree, packageJsonPath) {
+    if (!tree.exists(packageJsonPath)) {
+        return;
+    }
+    const packageJson = JSON.parse(tree.read(packageJsonPath, 'utf-8') ?? '{}');
+    if (!packageJson.dependencies?.[STRANDS_SDK]) {
+        return;
+    }
+    // An already-declared client (even a stale range) is left to
+    // addDependenciesToPackageJson, which resolves it onto the catalog.
+    addDependenciesToPackageJson(tree, {
+        [MCP_CLIENT]: TS_VERSIONS[MCP_CLIENT]
+    }, {}, packageJsonPath);
+}
+
+//# sourceMappingURL=migration.js.map

package/src/migrations/latest/pin-strands-mcp-client-peer/migration.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../../../../../../../packages/nx-plugin/src/migrations/latest/pin-strands-mcp-client-peer/migration.ts"],"sourcesContent":["/**\n * Copyright Amazon.com, Inc. or its affiliates. All Rights Reserved.\n * SPDX-License-Identifier: Apache-2.0\n */\nimport {\n  getProjects,\n  joinPathFragments,\n  type MigrationReturnObject,\n  type Tree,\n} from '@nx/devkit';\nimport { AGENT_CONNECTION_PROJECT_DIR } from '../../../utils/agent-connection/agent-connection.js';\nimport { addDependenciesToPackageJson } from '../../../utils/dependencies.js';\nimport { formatFilesInSubtree } from '../../../utils/format.js';\nimport { TS_VERSIONS } from '../../../utils/versions.js';\n\nconst MCP_CLIENT = '@modelcontextprotocol/client';\nconst STRANDS_SDK = '@strands-agents/sdk';\nconst ROOT_PACKAGE_JSON = 'package.json';\n\n/**\n * `@strands-agents/sdk` 1.20.0 replaced its required peer\n * `@modelcontextprotocol/sdk` with `@modelcontextprotocol/client`. Nothing in\n * a generated workspace declared that package, so pnpm auto-installs whatever\n * its `latest` is, while the vended `@modelcontextprotocol/inspector` pulls\n * its own exact version into the same graph. The generators now declare it\n * at the vended pin wherever they declare strands; this carries an existing\n * workspace to the same shape.\n *\n * Detection is generic, as in the earlier express peer migration: the\n * workspace root, the shared agent-connection project (checked explicitly in\n * case its project.json isn't registered) and every project's\n * `package.json`, each checked for \"declares @strands-agents/sdk\".\n */\nexport default async function migration(\n  tree: Tree,\n): Promise<MigrationReturnObject> {\n  pinIfNeeded(tree, ROOT_PACKAGE_JSON);\n  pinIfNeeded(\n    tree,\n    joinPathFragments(AGENT_CONNECTION_PROJECT_DIR, 'package.json'),\n  );\n\n  for (const project of getProjects(tree).values()) {\n    pinIfNeeded(tree, joinPathFragments(project.root, 'package.json'));\n  }\n\n  await formatFilesInSubtree(tree);\n\n  return { nextSteps: [] };\n}\n\n/** Declare the MCP client on the given manifest, if it declares strands. */\nfunction pinIfNeeded(tree: Tree, packageJsonPath: string): void {\n  if (!tree.exists(packageJsonPath)) {\n    return;\n  }\n\n  const packageJson = JSON.parse(tree.read(packageJsonPath, 'utf-8') ?? '{}');\n  if (!packageJson.dependencies?.[STRANDS_SDK]) {\n    return;\n  }\n\n  // An already-declared client (even a stale range) is left to\n  // addDependenciesToPackageJson, which resolves it onto the catalog.\n  addDependenciesToPackageJson(\n    tree,\n    { [MCP_CLIENT]: TS_VERSIONS[MCP_CLIENT] },\n    {},\n    packageJsonPath,\n  );\n}\n"],"names":["getProjects","joinPathFragments","AGENT_CONNECTION_PROJECT_DIR","addDependenciesToPackageJson","formatFilesInSubtree","TS_VERSIONS","MCP_CLIENT","STRANDS_SDK","ROOT_PACKAGE_JSON","migration","tree","pinIfNeeded","project","values","root","nextSteps","packageJsonPath","exists","packageJson","JSON","parse","read","dependencies"],"mappings":"AAAA;;;CAGC,GACD,SACEA,WAAW,EACXC,iBAAiB,QAGZ,aAAa;AACpB,SAASC,4BAA4B,QAAQ,sDAAsD;AACnG,SAASC,4BAA4B,QAAQ,iCAAiC;AAC9E,SAASC,oBAAoB,QAAQ,2BAA2B;AAChE,SAASC,WAAW,QAAQ,6BAA6B;AAEzD,MAAMC,aAAa;AACnB,MAAMC,cAAc;AACpB,MAAMC,oBAAoB;AAE1B;;;;;;;;;;;;;CAaC,GACD,eAAe,eAAeC,UAC5BC,IAAU;IAEVC,YAAYD,MAAMF;IAClBG,YACED,MACAT,kBAAkBC,8BAA8B;IAGlD,KAAK,MAAMU,WAAWZ,YAAYU,MAAMG,MAAM,GAAI;QAChDF,YAAYD,MAAMT,kBAAkBW,QAAQE,IAAI,EAAE;IACpD;IAEA,MAAMV,qBAAqBM;IAE3B,OAAO;QAAEK,WAAW,EAAE;IAAC;AACzB;AAEA,0EAA0E,GAC1E,SAASJ,YAAYD,IAAU,EAAEM,eAAuB;IACtD,IAAI,CAACN,KAAKO,MAAM,CAACD,kBAAkB;QACjC;IACF;IAEA,MAAME,cAAcC,KAAKC,KAAK,CAACV,KAAKW,IAAI,CAACL,iBAAiB,YAAY;IACtE,IAAI,CAACE,YAAYI,YAAY,EAAE,CAACf,YAAY,EAAE;QAC5C;IACF;IAEA,6DAA6D;IAC7D,oEAAoE;IACpEJ,6BACEO,MACA;QAAE,CAACJ,WAAW,EAAED,WAAW,CAACC,WAAW;IAAC,GACxC,CAAC,GACDU;AAEJ"}

package/src/migrations/latest/py-dynamodb-bind-base-model-meta/metadata.json

@@ -0,0 +1,3 @@
+{
+  "description": "Bind the py#dynamodb BaseModel Meta that 1.0.8 declared as a nested MetaProtocol subclass with the inherited MetaProtocol type, so the generated project type checks with ty 0.0.87"
+}

package/src/migrations/latest/{rdb-drop-lambda-rie → py-dynamodb-bind-base-model-meta}/migration.d.ts

@@ -2,5 +2,5 @@
  * Copyright Amazon.com, Inc. or its affiliates. All Rights Reserved.
  * SPDX-License-Identifier: Apache-2.0
  */
-import { type MigrationReturnObject, type Tree } from '@nx/devkit';
+import type { MigrationReturnObject, Tree } from '@nx/devkit';
 export default function migration(tree: Tree): Promise<MigrationReturnObject>;

package/src/migrations/latest/py-dynamodb-bind-base-model-meta/migration.js

@@ -0,0 +1,56 @@
+/**
+ * Copyright Amazon.com, Inc. or its affiliates. All Rights Reserved.
+ * SPDX-License-Identifier: Apache-2.0
+ */ import { bindMetaBlock, divergedMetaNextStep, findMetaBlockShape, META_BINDING, NESTED_PROTOCOL_META_HEADER, pyDynamoDbBasePyPaths, TYPED_IMPORT, UNTYPED_IMPORT, UNTYPED_META_HEADER } from "../../../py/dynamodb/base-model-meta.js";
+import { formatFilesInSubtree } from "../../../utils/format.js";
+/**
+ * Bind the `Meta` of the `BaseModel` that py#dynamodb vends in
+ * `<module>/entities/base.py` with pynamodb's declared `MetaProtocol` type.
+ *
+ * Release 1.0.8 vends, and its `py-dynamodb-type-base-model-meta` migration
+ * writes, a nested `class Meta(MetaProtocol):`. pynamodb declares
+ * `Model.Meta: MetaProtocol`, a mutable attribute, and the nested class
+ * narrows it to the class's own type, which ty 0.0.87 reports as
+ * `invalid-mutable-override`. This declares the block as
+ * `class _Meta(MetaProtocol):` and binds it with `Meta: MetaProtocol = _Meta`.
+ * `Meta` is the same class object, so pynamodb's runtime defaults apply as
+ * before.
+ *
+ * A base.py is edited only where its import line and `Meta` block still have
+ * the exact shape the generator wrote. One already bound is left alone, as is
+ * an untyped `class Meta:` in the generated shape, which
+ * `py-dynamodb-type-base-model-meta` converges on the bound shape before this
+ * runs. Any other base.py is left untouched and reported via `nextSteps`.
+ */ /**
+ * Rewrite a base.py still in the 1.0.8 shape. Already bound, untyped and
+ * missing files are left alone; a diverged one is reported via nextSteps.
+ */ const migrateBasePy = (tree, filePath, nextSteps)=>{
+    if (!tree.exists(filePath)) {
+        return;
+    }
+    const content = tree.read(filePath, 'utf-8') ?? '';
+    if (content.includes(META_BINDING)) {
+        return; // Already migrated (or user-added).
+    }
+    if (content.includes(UNTYPED_IMPORT) && findMetaBlockShape(content, UNTYPED_META_HEADER)) {
+        return; // Left to py-dynamodb-type-base-model-meta.
+    }
+    const shape = findMetaBlockShape(content, NESTED_PROTOCOL_META_HEADER);
+    if (!shape || !content.includes(TYPED_IMPORT)) {
+        nextSteps.push(divergedMetaNextStep(filePath));
+        return;
+    }
+    tree.write(filePath, bindMetaBlock(content, NESTED_PROTOCOL_META_HEADER, shape));
+};
+export default async function migration(tree) {
+    const nextSteps = [];
+    for (const filePath of pyDynamoDbBasePyPaths(tree)){
+        migrateBasePy(tree, filePath, nextSteps);
+    }
+    await formatFilesInSubtree(tree);
+    return {
+        nextSteps
+    };
+}
+
+//# sourceMappingURL=migration.js.map

package/src/migrations/latest/py-dynamodb-bind-base-model-meta/migration.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../../../../../../../packages/nx-plugin/src/migrations/latest/py-dynamodb-bind-base-model-meta/migration.ts"],"sourcesContent":["/**\n * Copyright Amazon.com, Inc. or its affiliates. All Rights Reserved.\n * SPDX-License-Identifier: Apache-2.0\n */\nimport type { MigrationReturnObject, Tree } from '@nx/devkit';\nimport {\n  bindMetaBlock,\n  divergedMetaNextStep,\n  findMetaBlockShape,\n  META_BINDING,\n  NESTED_PROTOCOL_META_HEADER,\n  pyDynamoDbBasePyPaths,\n  TYPED_IMPORT,\n  UNTYPED_IMPORT,\n  UNTYPED_META_HEADER,\n} from '../../../py/dynamodb/base-model-meta.js';\nimport { formatFilesInSubtree } from '../../../utils/format.js';\n\n/**\n * Bind the `Meta` of the `BaseModel` that py#dynamodb vends in\n * `<module>/entities/base.py` with pynamodb's declared `MetaProtocol` type.\n *\n * Release 1.0.8 vends, and its `py-dynamodb-type-base-model-meta` migration\n * writes, a nested `class Meta(MetaProtocol):`. pynamodb declares\n * `Model.Meta: MetaProtocol`, a mutable attribute, and the nested class\n * narrows it to the class's own type, which ty 0.0.87 reports as\n * `invalid-mutable-override`. This declares the block as\n * `class _Meta(MetaProtocol):` and binds it with `Meta: MetaProtocol = _Meta`.\n * `Meta` is the same class object, so pynamodb's runtime defaults apply as\n * before.\n *\n * A base.py is edited only where its import line and `Meta` block still have\n * the exact shape the generator wrote. One already bound is left alone, as is\n * an untyped `class Meta:` in the generated shape, which\n * `py-dynamodb-type-base-model-meta` converges on the bound shape before this\n * runs. Any other base.py is left untouched and reported via `nextSteps`.\n */\n\n/**\n * Rewrite a base.py still in the 1.0.8 shape. Already bound, untyped and\n * missing files are left alone; a diverged one is reported via nextSteps.\n */\nconst migrateBasePy = (\n  tree: Tree,\n  filePath: string,\n  nextSteps: string[],\n): void => {\n  if (!tree.exists(filePath)) {\n    return;\n  }\n\n  const content = tree.read(filePath, 'utf-8') ?? '';\n  if (content.includes(META_BINDING)) {\n    return; // Already migrated (or user-added).\n  }\n\n  if (\n    content.includes(UNTYPED_IMPORT) &&\n    findMetaBlockShape(content, UNTYPED_META_HEADER)\n  ) {\n    return; // Left to py-dynamodb-type-base-model-meta.\n  }\n\n  const shape = findMetaBlockShape(content, NESTED_PROTOCOL_META_HEADER);\n  if (!shape || !content.includes(TYPED_IMPORT)) {\n    nextSteps.push(divergedMetaNextStep(filePath));\n    return;\n  }\n\n  tree.write(\n    filePath,\n    bindMetaBlock(content, NESTED_PROTOCOL_META_HEADER, shape),\n  );\n};\n\nexport default async function migration(\n  tree: Tree,\n): Promise<MigrationReturnObject> {\n  const nextSteps: string[] = [];\n\n  for (const filePath of pyDynamoDbBasePyPaths(tree)) {\n    migrateBasePy(tree, filePath, nextSteps);\n  }\n\n  await formatFilesInSubtree(tree);\n\n  return { nextSteps };\n}\n"],"names":["bindMetaBlock","divergedMetaNextStep","findMetaBlockShape","META_BINDING","NESTED_PROTOCOL_META_HEADER","pyDynamoDbBasePyPaths","TYPED_IMPORT","UNTYPED_IMPORT","UNTYPED_META_HEADER","formatFilesInSubtree","migrateBasePy","tree","filePath","nextSteps","exists","content","read","includes","shape","push","write","migration"],"mappings":"AAAA;;;CAGC,GAED,SACEA,aAAa,EACbC,oBAAoB,EACpBC,kBAAkB,EAClBC,YAAY,EACZC,2BAA2B,EAC3BC,qBAAqB,EACrBC,YAAY,EACZC,cAAc,EACdC,mBAAmB,QACd,0CAA0C;AACjD,SAASC,oBAAoB,QAAQ,2BAA2B;AAEhE;;;;;;;;;;;;;;;;;;CAkBC,GAED;;;CAGC,GACD,MAAMC,gBAAgB,CACpBC,MACAC,UACAC;IAEA,IAAI,CAACF,KAAKG,MAAM,CAACF,WAAW;QAC1B;IACF;IAEA,MAAMG,UAAUJ,KAAKK,IAAI,CAACJ,UAAU,YAAY;IAChD,IAAIG,QAAQE,QAAQ,CAACd,eAAe;QAClC,QAAQ,oCAAoC;IAC9C;IAEA,IACEY,QAAQE,QAAQ,CAACV,mBACjBL,mBAAmBa,SAASP,sBAC5B;QACA,QAAQ,4CAA4C;IACtD;IAEA,MAAMU,QAAQhB,mBAAmBa,SAASX;IAC1C,IAAI,CAACc,SAAS,CAACH,QAAQE,QAAQ,CAACX,eAAe;QAC7CO,UAAUM,IAAI,CAAClB,qBAAqBW;QACpC;IACF;IAEAD,KAAKS,KAAK,CACRR,UACAZ,cAAce,SAASX,6BAA6Bc;AAExD;AAEA,eAAe,eAAeG,UAC5BV,IAAU;IAEV,MAAME,YAAsB,EAAE;IAE9B,KAAK,MAAMD,YAAYP,sBAAsBM,MAAO;QAClDD,cAAcC,MAAMC,UAAUC;IAChC;IAEA,MAAMJ,qBAAqBE;IAE3B,OAAO;QAAEE;IAAU;AACrB"}

package/src/migrations/v1.0.7/0001-pin-strands-express-peer/migration.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../../../../../../../packages/nx-plugin/src/migrations/v1.0.7/0001-pin-strands-express-peer/migration.ts"],"sourcesContent":["/**\n * Copyright Amazon.com, Inc. or its affiliates. All Rights Reserved.\n * SPDX-License-Identifier: Apache-2.0\n */\nimport { getProjects, joinPathFragments, type Tree } from '@nx/devkit';\nimport { AGENT_CONNECTION_PROJECT_DIR } from '../../../utils/agent-connection/agent-connection.js';\nimport { addDependenciesToPackageJson } from '../../../utils/dependencies.js';\nimport { formatFilesInSubtree } from '../../../utils/format.js';\nimport { TS_VERSIONS } from '../../../utils/versions.js';\n\nconst EXPRESS = 'express';\nconst STRANDS_SDK = '@strands-agents/sdk';\nconst ROOT_PACKAGE_JSON = 'package.json';\n\n/**\n * `express` is an optional peer of `@strands-agents/sdk` that any importer\n * declaring strands without also declaring express can leave undeclared. pnpm\n * suffixes each installed copy of a package by the versions of its peers, so\n * such an importer can resolve express to a different version than the pin\n * every other strands importer uses — splitting `@strands-agents/sdk` into two\n * peer-suffixed instances of the same version.\n *\n * Anything importing both instances then sees two nominal identities of every\n * SDK type — `Agent`, `McpClient`, `Plugin` — and fails to compile with \"Types\n * have separate declarations of a private property\". Declaring express\n * wherever strands is declared keeps the whole strands subgraph on the\n * catalog's single pin. Mirrors the earlier `@aws-sdk/client-s3` peer fix, one\n * optional peer further on.\n *\n * Detection is generic — every project's `package.json` plus the workspace\n * root, checked for \"declares @strands-agents/sdk but not express\" — rather\n * than listing the generators that currently produce that shape, so a future\n * strands importer this migration predates is still covered. The shared\n * agent-connection project is checked explicitly too, in case its project.json\n * is missing or not yet registered when this runs — `getProjects` would miss\n * it then, same as rc.95's `@aws-sdk/client-s3` migration guarded against.\n */\nexport default async function migration(tree: Tree): Promise<void> {\n  pinIfNeeded(tree, ROOT_PACKAGE_JSON);\n  pinIfNeeded(\n    tree,\n    joinPathFragments(AGENT_CONNECTION_PROJECT_DIR, 'package.json'),\n  );\n\n  for (const project of getProjects(tree).values()) {\n    pinIfNeeded(tree, joinPathFragments(project.root, 'package.json'));\n  }\n\n  await formatFilesInSubtree(tree);\n}\n\n/** Declare express on the given manifest, if it declares strands but not express. */\nfunction pinIfNeeded(tree: Tree, packageJsonPath: string): void {\n  if (!tree.exists(packageJsonPath)) {\n    return;\n  }\n\n  const packageJson = JSON.parse(tree.read(packageJsonPath, 'utf-8') ?? '{}');\n  // Only where a strands client is actually declared — that is what pulls the\n  // optional peer. An already-declared express (even a stale range) is left to\n  // addDependenciesToPackageJson, which resolves it onto the catalog.\n  if (!packageJson.dependencies?.[STRANDS_SDK]) {\n    return;\n  }\n\n  addDependenciesToPackageJson(\n    tree,\n    { [EXPRESS]: TS_VERSIONS[EXPRESS] },\n    {},\n    packageJsonPath,\n  );\n}\n"],"names":["getProjects","joinPathFragments","AGENT_CONNECTION_PROJECT_DIR","addDependenciesToPackageJson","formatFilesInSubtree","TS_VERSIONS","EXPRESS","STRANDS_SDK","ROOT_PACKAGE_JSON","migration","tree","pinIfNeeded","project","values","root","packageJsonPath","exists","packageJson","JSON","parse","read","dependencies"],"mappings":"AAAA;;;CAGC,GACD,SAASA,WAAW,EAAEC,iBAAiB,QAAmB,aAAa;AACvE,SAASC,4BAA4B,QAAQ,sDAAsD;AACnG,SAASC,4BAA4B,QAAQ,iCAAiC;AAC9E,SAASC,oBAAoB,QAAQ,2BAA2B;AAChE,SAASC,WAAW,QAAQ,6BAA6B;AAEzD,MAAMC,UAAU;AAChB,MAAMC,cAAc;AACpB,MAAMC,oBAAoB;AAE1B;;;;;;;;;;;;;;;;;;;;;;CAsBC,GACD,eAAe,eAAeC,UAAUC,IAAU;IAChDC,YAAYD,MAAMF;IAClBG,YACED,MACAT,kBAAkBC,8BAA8B;IAGlD,KAAK,MAAMU,WAAWZ,YAAYU,MAAMG,MAAM,GAAI;QAChDF,YAAYD,MAAMT,kBAAkBW,QAAQE,IAAI,EAAE;IACpD;IAEA,MAAMV,qBAAqBM;AAC7B;AAEA,mFAAmF,GACnF,SAASC,YAAYD,IAAU,EAAEK,eAAuB;IACtD,IAAI,CAACL,KAAKM,MAAM,CAACD,kBAAkB;QACjC;IACF;IAEA,MAAME,cAAcC,KAAKC,KAAK,CAACT,KAAKU,IAAI,CAACL,iBAAiB,YAAY;IACtE,4EAA4E;IAC5E,6EAA6E;IAC7E,oEAAoE;IACpE,IAAI,CAACE,YAAYI,YAAY,EAAE,CAACd,YAAY,EAAE;QAC5C;IACF;IAEAJ,6BACEO,MACA;QAAE,CAACJ,QAAQ,EAAED,WAAW,CAACC,QAAQ;IAAC,GAClC,CAAC,GACDS;AAEJ"}

package/src/migrations/v1.0.7/0002-rdb-drop-lambda-rie/migration.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../../../../../../../packages/nx-plugin/src/migrations/v1.0.7/0002-rdb-drop-lambda-rie/migration.ts"],"sourcesContent":["/**\n * Copyright Amazon.com, Inc. or its affiliates. All Rights Reserved.\n * SPDX-License-Identifier: Apache-2.0\n */\nimport {\n  getProjects,\n  joinPathFragments,\n  type MigrationReturnObject,\n  type Tree,\n} from '@nx/devkit';\nimport { PY_RDB_GENERATOR_INFO } from '../../../py/rdb/generator.js';\nimport { TS_RDB_GENERATOR_INFO } from '../../../ts/rdb/generator.js';\nimport { formatFilesInSubtree } from '../../../utils/format.js';\n\n/**\n * Remove the Lambda Runtime Interface Emulator (RIE) from the vended ts#rdb\n * and py#rdb Dockerfiles.\n *\n * `/lambda-entrypoint.sh` only invokes RIE when AWS_LAMBDA_RUNTIME_API is\n * unset, i.e. for local `docker run` emulation outside Lambda — the deployed\n * function never runs it. Its upstream build lags the Go toolchain, so it\n * carries known HIGH vulnerabilities (net/http and crypto/tls DoS CVEs) the\n * image scan flags with no fixed upstream image coming soon. Stripping it\n * follows the same pattern the templates already use for other unused,\n * vulnerable parts of the base image (py#rdb removing pip, ts#rdb removing\n * the runtime's AWS SDK copy). New workspaces get this from the generator\n * templates; this brings existing ones up to date.\n *\n * Only the three Dockerfiles the ts#rdb / py#rdb generators vend are touched,\n * located from each rdb project's root (recorded in its metadata). Each is\n * edited in place only where its comment + `RUN microdnf upgrade ...` block\n * still has the exact shape the generator wrote before this change; one that\n * has diverged (a customised comment or upgrade command) is left untouched\n * and reported via `nextSteps`.\n */\n\nconst AWS_LAMBDA_RIE = '/usr/local/bin/aws-lambda-rie';\n\n/**\n * The exact comment + `RUN microdnf upgrade ...` block ts#rdb's Dockerfile had\n * before this migration, and what it becomes.\n */\nconst TS_RDB_OLD_UPGRADE = `# Patch OS packages beyond the base image's pinned release, and drop the\n# runtime's convenience copy of the AWS SDK (the handler bundle inlines its\n# own dependencies), keeping the image free of known HIGH/CRITICAL\n# vulnerabilities\nRUN microdnf upgrade -y --releasever latest && microdnf clean all \\\\\n    && rm -rf /var/runtime/node_modules/@aws-sdk`;\nconst TS_RDB_NEW_UPGRADE = `# Patch OS packages beyond the base image's pinned release, and drop the\n# runtime's convenience copy of the AWS SDK (the handler bundle inlines its\n# own dependencies), keeping the image free of known HIGH/CRITICAL\n# vulnerabilities. Also drop the Lambda Runtime Interface Emulator: it is only\n# used for local \\`docker run\\` emulation outside Lambda, never by the deployed\n# function, and carries known HIGH vulnerabilities.\nRUN microdnf upgrade -y --releasever latest && microdnf clean all \\\\\n    && rm -rf /var/runtime/node_modules/@aws-sdk ${AWS_LAMBDA_RIE}`;\n\n/**\n * The exact comment + `RUN microdnf upgrade ...` block py#rdb's two Dockerfiles\n * had before this migration, and what it becomes. Both Dockerfile.migration and\n * Dockerfile.create-db-user share this block verbatim.\n */\nconst PY_RDB_OLD_UPGRADE = `# Patch OS packages beyond the base image's pinned release, and drop pip, whose\n# vendored copies of msgpack and setuptools carry known HIGH vulnerabilities.\n# The handler's dependencies are already installed in the image, so nothing\n# installs packages at runtime.\nRUN microdnf upgrade -y --releasever latest && microdnf clean all \\\\\n    && rm -rf /var/lang/lib/python*/site-packages/pip \\\\\n    /var/lang/lib/python*/site-packages/pip-*.dist-info`;\nconst PY_RDB_NEW_UPGRADE = `# Patch OS packages beyond the base image's pinned release, and drop pip, whose\n# vendored copies of msgpack and setuptools carry known HIGH vulnerabilities.\n# The handler's dependencies are already installed in the image, so nothing\n# installs packages at runtime. Also drop the Lambda Runtime Interface\n# Emulator: it is only used for local \\`docker run\\` emulation outside Lambda,\n# never by the deployed function, and carries known HIGH vulnerabilities.\nRUN microdnf upgrade -y --releasever latest && microdnf clean all \\\\\n    && rm -rf /var/lang/lib/python*/site-packages/pip \\\\\n    /var/lang/lib/python*/site-packages/pip-*.dist-info \\\\\n    ${AWS_LAMBDA_RIE}`;\n\n/** The marker checked to detect an already-migrated (or user-added) removal. */\nconst RIE_REMOVED_MARKER = AWS_LAMBDA_RIE;\n\nconst divergedNextStep = (filePath: string): string =>\n  `${filePath}: its microdnf upgrade command has been customised, so it was left unchanged. Remove the Lambda Runtime Interface Emulator by adding \"${AWS_LAMBDA_RIE}\" to its \"rm -rf\" — it is only used for local \\`docker run\\` emulation outside Lambda and carries known HIGH vulnerabilities.`;\n\n/**\n * Replace a Dockerfile's old comment + upgrade block with the new one, only\n * when the file still has the exact shape the generator wrote. Already\n * migrated and diverged files are both left alone; the latter is reported via\n * nextSteps.\n */\nconst migrateDockerfile = (\n  tree: Tree,\n  filePath: string,\n  oldBlock: string,\n  newBlock: string,\n  nextSteps: string[],\n): void => {\n  if (!tree.exists(filePath)) {\n    return;\n  }\n\n  const content = tree.read(filePath, 'utf-8') ?? '';\n  if (content.includes(RIE_REMOVED_MARKER)) {\n    return; // Already migrated (or user-added).\n  }\n\n  if (!content.includes(oldBlock)) {\n    nextSteps.push(divergedNextStep(filePath));\n    return;\n  }\n\n  tree.write(filePath, content.replace(oldBlock, newBlock));\n};\n\nexport default async function migration(\n  tree: Tree,\n): Promise<MigrationReturnObject> {\n  const nextSteps: string[] = [];\n\n  for (const project of getProjects(tree).values()) {\n    const generator = (project.metadata as { generator?: string } | undefined)\n      ?.generator;\n\n    if (generator === TS_RDB_GENERATOR_INFO.id) {\n      migrateDockerfile(\n        tree,\n        joinPathFragments(project.root, 'Dockerfile'),\n        TS_RDB_OLD_UPGRADE,\n        TS_RDB_NEW_UPGRADE,\n        nextSteps,\n      );\n    } else if (generator === PY_RDB_GENERATOR_INFO.id) {\n      migrateDockerfile(\n        tree,\n        joinPathFragments(project.root, 'Dockerfile.migration'),\n        PY_RDB_OLD_UPGRADE,\n        PY_RDB_NEW_UPGRADE,\n        nextSteps,\n      );\n      migrateDockerfile(\n        tree,\n        joinPathFragments(project.root, 'Dockerfile.create-db-user'),\n        PY_RDB_OLD_UPGRADE,\n        PY_RDB_NEW_UPGRADE,\n        nextSteps,\n      );\n    }\n  }\n\n  await formatFilesInSubtree(tree);\n\n  return { nextSteps };\n}\n"],"names":["getProjects","joinPathFragments","PY_RDB_GENERATOR_INFO","TS_RDB_GENERATOR_INFO","formatFilesInSubtree","AWS_LAMBDA_RIE","TS_RDB_OLD_UPGRADE","TS_RDB_NEW_UPGRADE","PY_RDB_OLD_UPGRADE","PY_RDB_NEW_UPGRADE","RIE_REMOVED_MARKER","divergedNextStep","filePath","migrateDockerfile","tree","oldBlock","newBlock","nextSteps","exists","content","read","includes","push","write","replace","migration","project","values","generator","metadata","id","root"],"mappings":"AAAA;;;CAGC,GACD,SACEA,WAAW,EACXC,iBAAiB,QAGZ,aAAa;AACpB,SAASC,qBAAqB,QAAQ,+BAA+B;AACrE,SAASC,qBAAqB,QAAQ,+BAA+B;AACrE,SAASC,oBAAoB,QAAQ,2BAA2B;AAEhE;;;;;;;;;;;;;;;;;;;;CAoBC,GAED,MAAMC,iBAAiB;AAEvB;;;CAGC,GACD,MAAMC,qBAAqB,CAAC;;;;;gDAKoB,CAAC;AACjD,MAAMC,qBAAqB,CAAC;;;;;;;iDAOqB,EAAEF,gBAAgB;AAEnE;;;;CAIC,GACD,MAAMG,qBAAqB,CAAC;;;;;;uDAM2B,CAAC;AACxD,MAAMC,qBAAqB,CAAC;;;;;;;;;IASxB,EAAEJ,gBAAgB;AAEtB,8EAA8E,GAC9E,MAAMK,qBAAqBL;AAE3B,MAAMM,mBAAmB,CAACC,WACxB,GAAGA,SAAS,sIAAsI,EAAEP,eAAe,6HAA6H,CAAC;AAEnS;;;;;CAKC,GACD,MAAMQ,oBAAoB,CACxBC,MACAF,UACAG,UACAC,UACAC;IAEA,IAAI,CAACH,KAAKI,MAAM,CAACN,WAAW;QAC1B;IACF;IAEA,MAAMO,UAAUL,KAAKM,IAAI,CAACR,UAAU,YAAY;IAChD,IAAIO,QAAQE,QAAQ,CAACX,qBAAqB;QACxC,QAAQ,oCAAoC;IAC9C;IAEA,IAAI,CAACS,QAAQE,QAAQ,CAACN,WAAW;QAC/BE,UAAUK,IAAI,CAACX,iBAAiBC;QAChC;IACF;IAEAE,KAAKS,KAAK,CAACX,UAAUO,QAAQK,OAAO,CAACT,UAAUC;AACjD;AAEA,eAAe,eAAeS,UAC5BX,IAAU;IAEV,MAAMG,YAAsB,EAAE;IAE9B,KAAK,MAAMS,WAAW1B,YAAYc,MAAMa,MAAM,GAAI;QAChD,MAAMC,YAAaF,QAAQG,QAAQ,EAC/BD;QAEJ,IAAIA,cAAczB,sBAAsB2B,EAAE,EAAE;YAC1CjB,kBACEC,MACAb,kBAAkByB,QAAQK,IAAI,EAAE,eAChCzB,oBACAC,oBACAU;QAEJ,OAAO,IAAIW,cAAc1B,sBAAsB4B,EAAE,EAAE;YACjDjB,kBACEC,MACAb,kBAAkByB,QAAQK,IAAI,EAAE,yBAChCvB,oBACAC,oBACAQ;YAEFJ,kBACEC,MACAb,kBAAkByB,QAAQK,IAAI,EAAE,8BAChCvB,oBACAC,oBACAQ;QAEJ;IACF;IAEA,MAAMb,qBAAqBU;IAE3B,OAAO;QAAEG;IAAU;AACrB"}

package/src/migrations/v1.0.8/0001-infra-test-loop/migration.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../../../../../../../packages/nx-plugin/src/migrations/v1.0.8/0001-infra-test-loop/migration.ts"],"sourcesContent":["/**\n * Copyright Amazon.com, Inc. or its affiliates. All Rights Reserved.\n * SPDX-License-Identifier: Apache-2.0\n */\nimport {\n  getProjects,\n  joinPathFragments,\n  type MigrationReturnObject,\n  type ProjectConfiguration,\n  type TargetConfiguration,\n  type Tree,\n  updateProjectConfiguration,\n} from '@nx/devkit';\nimport { INFRA_APP_GENERATOR_INFO } from '../../../infra/app/generator.js';\nimport { matchGritQL } from '../../../utils/ast.js';\nimport {\n  addCdkTestGlobalSetup,\n  CDK_TEST_GLOBAL_SETUP,\n  CDK_TEST_GLOBAL_SETUP_ENTRY,\n  findVitestConfig,\n  renderCdkTestGlobalSetup,\n} from '../../../utils/cdk-test-setup.js';\nimport { formatFilesInSubtree } from '../../../utils/format.js';\nimport { sortObjectKeys } from '../../../utils/object.js';\nimport {\n  PACKAGES_DIR,\n  SHARED_CONSTRUCTS_DIR,\n} from '../../../utils/shared-constructs-constants.js';\n\n/**\n * Run CDK infrastructure tests against the artifacts their stacks deploy, in a\n * per-run temp directory with CDK asset bundling skipped.\n *\n * The infra `test` target inherited the `^build` target default, so every\n * infra test run first ran every deployed project's lint, test, type-check and\n * bundle. The stacks only need the bundles: `Code.fromAsset` and its siblings\n * throw on a missing asset path, so the edge is narrowed to `^assemble` (the\n * artifact-only chain `synth` and `deploy` already use) rather than removed.\n *\n * Each `new App()` in a test synthesizes into a fresh `cdk.out*` directory\n * under the OS temp dir, which nothing removed, so a workspace's tests leaked\n * into the shared `/tmp`. The vended `tests/global-setup.ts` points `TMPDIR`,\n * `TEMP` and `TMP` at a directory of its own for the run and removes it in\n * teardown. aws-cdk-lib deletes the `cdk.out*` directories an `App` created\n * from a `process.on('exit')` handler, and vitest runs the global teardown\n * while its forked workers are still exiting, so a single `rmSync` can race\n * that delete and return with the directory still there. The teardown\n * therefore retries every 50 ms for up to 2 s, and warns (naming the\n * directory) rather than failing the run if it is still there. It also merges `aws:cdk:bundling-stacks: []` into\n * `CDK_CONTEXT_JSON`, which only affects user-written bundling constructs\n * (`NodejsFunction`, `PythonFunction`); the vended constructs read prebuilt\n * bundles. The setup is registered in the infra project's and the shared\n * constructs' vitest configs.\n *\n * Only the exact shape the generator wrote before is changed. A `test` target,\n * a `globalSetup`, a vitest config or a `tests/global-setup.ts` that differs is\n * left untouched and reported, and a setup file the plugin did not write is\n * never registered. The migration writes the generator's own template, so a migrated project is\n * byte-identical to a freshly generated one. Infra READMEs are left alone: the\n * generator writes them `KeepExisting`, and users edit them.\n */\n\nconst TEST_TARGET = 'test';\nconst TEST_DEPENDS_ON = ['^assemble'];\n\nconst isFixedTestTarget = (target: TargetConfiguration): boolean =>\n  Object.keys(target).length === 1 &&\n  Array.isArray(target.dependsOn) &&\n  target.dependsOn.length === TEST_DEPENDS_ON.length &&\n  target.dependsOn.every((dep, index) => dep === TEST_DEPENDS_ON[index]);\n\n/** Any `globalSetup` property in the config. */\nconst ANY_GLOBAL_SETUP = '`globalSetup: $_`';\n\n/** Exactly the entry the generator registers. */\nconst VENDED_GLOBAL_SETUP = `\\`globalSetup: ['${CDK_TEST_GLOBAL_SETUP_ENTRY}']\\``;\n\n/** The `defineConfig(() => ({ test: { ... } }))` shape the generator inserts into. */\nconst RECOGNISED_CONFIG = `\\`test: { $props }\\` where { $props <: within \\`defineConfig($_)\\` }`;\n\n/**\n * Vend and register the global setup for one project, unless any of its files\n * has diverged from the generated shape. Returns the reason it was skipped.\n */\nconst migrateGlobalSetup = async (\n  tree: Tree,\n  projectName: string,\n  root: string,\n): Promise<string | undefined> => {\n  const setupPath = joinPathFragments(root, CDK_TEST_GLOBAL_SETUP);\n  const configPath = findVitestConfig(tree, root);\n\n  if (!configPath) {\n    return `${projectName}: no vitest config found in ${root} - add \\`globalSetup: ['${CDK_TEST_GLOBAL_SETUP_ENTRY}']\\` to its \\`test\\` options to give each test run its own temp directory.`;\n  }\n\n  if (\n    tree.exists(setupPath) &&\n    (tree.read(setupPath, 'utf-8') ?? '') !== renderCdkTestGlobalSetup()\n  ) {\n    return `${projectName}: ${setupPath} differs from the vended global setup - left untouched and not registered. Compare it with a freshly generated one, which gives each test run its own temp directory and skips CDK asset bundling, then add \\`globalSetup: ['${CDK_TEST_GLOBAL_SETUP_ENTRY}']\\` to ${configPath}.`;\n  }\n\n  if (await matchGritQL(tree, configPath, ANY_GLOBAL_SETUP)) {\n    if (await matchGritQL(tree, configPath, VENDED_GLOBAL_SETUP)) {\n      await addCdkTestGlobalSetup(tree, root);\n      return undefined;\n    }\n    return `${projectName}: ${configPath} already declares a \\`globalSetup\\` - left untouched. Add '${CDK_TEST_GLOBAL_SETUP_ENTRY}' to it to give each test run its own temp directory.`;\n  }\n\n  if (!(await matchGritQL(tree, configPath, RECOGNISED_CONFIG))) {\n    return `${projectName}: ${configPath} has diverged from the generated shape - left untouched. Add \\`globalSetup: ['${CDK_TEST_GLOBAL_SETUP_ENTRY}']\\` to its \\`test\\` options to give each test run its own temp directory.`;\n  }\n\n  await addCdkTestGlobalSetup(tree, root);\n  return undefined;\n};\n\nexport default async function migration(\n  tree: Tree,\n): Promise<MigrationReturnObject> {\n  const nextSteps: string[] = [];\n\n  for (const [projectName, project] of getProjects(tree)) {\n    const generator = (project.metadata as { generator?: string } | undefined)\n      ?.generator;\n    if (generator !== INFRA_APP_GENERATOR_INFO.id) continue;\n\n    const testTarget = project.targets?.[TEST_TARGET];\n    if (!testTarget) {\n      updateProjectConfiguration(tree, projectName, {\n        ...project,\n        targets: sortObjectKeys({\n          ...project.targets,\n          [TEST_TARGET]: { dependsOn: [...TEST_DEPENDS_ON] },\n        }),\n      } as ProjectConfiguration);\n    } else if (!isFixedTestTarget(testTarget)) {\n      nextSteps.push(\n        `${projectName}: the \\`test\\` target in ${joinPathFragments(project.root, 'project.json')} has diverged from the generated shape - left untouched. Set its \\`dependsOn\\` to [\"^assemble\"] so tests build the deployed projects' artifacts rather than every upstream build.`,\n      );\n    }\n\n    const skipped = await migrateGlobalSetup(tree, projectName, project.root);\n    if (skipped) nextSteps.push(skipped);\n  }\n\n  const constructsRoot = joinPathFragments(PACKAGES_DIR, SHARED_CONSTRUCTS_DIR);\n  if (tree.exists(joinPathFragments(constructsRoot, 'project.json'))) {\n    const skipped = await migrateGlobalSetup(\n      tree,\n      constructsRoot,\n      constructsRoot,\n    );\n    if (skipped) nextSteps.push(skipped);\n  }\n\n  await formatFilesInSubtree(tree);\n\n  return { nextSteps };\n}\n"],"names":["getProjects","joinPathFragments","updateProjectConfiguration","INFRA_APP_GENERATOR_INFO","matchGritQL","addCdkTestGlobalSetup","CDK_TEST_GLOBAL_SETUP","CDK_TEST_GLOBAL_SETUP_ENTRY","findVitestConfig","renderCdkTestGlobalSetup","formatFilesInSubtree","sortObjectKeys","PACKAGES_DIR","SHARED_CONSTRUCTS_DIR","TEST_TARGET","TEST_DEPENDS_ON","isFixedTestTarget","target","Object","keys","length","Array","isArray","dependsOn","every","dep","index","ANY_GLOBAL_SETUP","VENDED_GLOBAL_SETUP","RECOGNISED_CONFIG","migrateGlobalSetup","tree","projectName","root","setupPath","configPath","exists","read","undefined","migration","nextSteps","project","generator","metadata","id","testTarget","targets","push","skipped","constructsRoot"],"mappings":"AAAA;;;CAGC,GACD,SACEA,WAAW,EACXC,iBAAiB,EAKjBC,0BAA0B,QACrB,aAAa;AACpB,SAASC,wBAAwB,QAAQ,kCAAkC;AAC3E,SAASC,WAAW,QAAQ,wBAAwB;AACpD,SACEC,qBAAqB,EACrBC,qBAAqB,EACrBC,2BAA2B,EAC3BC,gBAAgB,EAChBC,wBAAwB,QACnB,mCAAmC;AAC1C,SAASC,oBAAoB,QAAQ,2BAA2B;AAChE,SAASC,cAAc,QAAQ,2BAA2B;AAC1D,SACEC,YAAY,EACZC,qBAAqB,QAChB,gDAAgD;AAEvD;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;CA+BC,GAED,MAAMC,cAAc;AACpB,MAAMC,kBAAkB;IAAC;CAAY;AAErC,MAAMC,oBAAoB,CAACC,SACzBC,OAAOC,IAAI,CAACF,QAAQG,MAAM,KAAK,KAC/BC,MAAMC,OAAO,CAACL,OAAOM,SAAS,KAC9BN,OAAOM,SAAS,CAACH,MAAM,KAAKL,gBAAgBK,MAAM,IAClDH,OAAOM,SAAS,CAACC,KAAK,CAAC,CAACC,KAAKC,QAAUD,QAAQV,eAAe,CAACW,MAAM;AAEvE,8CAA8C,GAC9C,MAAMC,mBAAmB;AAEzB,+CAA+C,GAC/C,MAAMC,sBAAsB,CAAC,iBAAiB,EAAErB,4BAA4B,IAAI,CAAC;AAEjF,oFAAoF,GACpF,MAAMsB,oBAAoB,CAAC,oEAAoE,CAAC;AAEhG;;;CAGC,GACD,MAAMC,qBAAqB,OACzBC,MACAC,aACAC;IAEA,MAAMC,YAAYjC,kBAAkBgC,MAAM3B;IAC1C,MAAM6B,aAAa3B,iBAAiBuB,MAAME;IAE1C,IAAI,CAACE,YAAY;QACf,OAAO,GAAGH,YAAY,4BAA4B,EAAEC,KAAK,wBAAwB,EAAE1B,4BAA4B,0EAA0E,CAAC;IAC5L;IAEA,IACEwB,KAAKK,MAAM,CAACF,cACZ,AAACH,CAAAA,KAAKM,IAAI,CAACH,WAAW,YAAY,EAAC,MAAOzB,4BAC1C;QACA,OAAO,GAAGuB,YAAY,EAAE,EAAEE,UAAU,6NAA6N,EAAE3B,4BAA4B,QAAQ,EAAE4B,WAAW,CAAC,CAAC;IACxT;IAEA,IAAI,MAAM/B,YAAY2B,MAAMI,YAAYR,mBAAmB;QACzD,IAAI,MAAMvB,YAAY2B,MAAMI,YAAYP,sBAAsB;YAC5D,MAAMvB,sBAAsB0B,MAAME;YAClC,OAAOK;QACT;QACA,OAAO,GAAGN,YAAY,EAAE,EAAEG,WAAW,2DAA2D,EAAE5B,4BAA4B,qDAAqD,CAAC;IACtL;IAEA,IAAI,CAAE,MAAMH,YAAY2B,MAAMI,YAAYN,oBAAqB;QAC7D,OAAO,GAAGG,YAAY,EAAE,EAAEG,WAAW,8EAA8E,EAAE5B,4BAA4B,0EAA0E,CAAC;IAC9N;IAEA,MAAMF,sBAAsB0B,MAAME;IAClC,OAAOK;AACT;AAEA,eAAe,eAAeC,UAC5BR,IAAU;IAEV,MAAMS,YAAsB,EAAE;IAE9B,KAAK,MAAM,CAACR,aAAaS,QAAQ,IAAIzC,YAAY+B,MAAO;QACtD,MAAMW,YAAaD,QAAQE,QAAQ,EAC/BD;QACJ,IAAIA,cAAcvC,yBAAyByC,EAAE,EAAE;QAE/C,MAAMC,aAAaJ,QAAQK,OAAO,EAAE,CAAChC,YAAY;QACjD,IAAI,CAAC+B,YAAY;YACf3C,2BAA2B6B,MAAMC,aAAa;gBAC5C,GAAGS,OAAO;gBACVK,SAASnC,eAAe;oBACtB,GAAG8B,QAAQK,OAAO;oBAClB,CAAChC,YAAY,EAAE;wBAAES,WAAW;+BAAIR;yBAAgB;oBAAC;gBACnD;YACF;QACF,OAAO,IAAI,CAACC,kBAAkB6B,aAAa;YACzCL,UAAUO,IAAI,CACZ,GAAGf,YAAY,yBAAyB,EAAE/B,kBAAkBwC,QAAQR,IAAI,EAAE,gBAAgB,iLAAiL,CAAC;QAEhR;QAEA,MAAMe,UAAU,MAAMlB,mBAAmBC,MAAMC,aAAaS,QAAQR,IAAI;QACxE,IAAIe,SAASR,UAAUO,IAAI,CAACC;IAC9B;IAEA,MAAMC,iBAAiBhD,kBAAkBW,cAAcC;IACvD,IAAIkB,KAAKK,MAAM,CAACnC,kBAAkBgD,gBAAgB,kBAAkB;QAClE,MAAMD,UAAU,MAAMlB,mBACpBC,MACAkB,gBACAA;QAEF,IAAID,SAASR,UAAUO,IAAI,CAACC;IAC9B;IAEA,MAAMtC,qBAAqBqB;IAE3B,OAAO;QAAES;IAAU;AACrB"}

package/src/migrations/v1.0.8/0002-py-dynamodb-type-base-model-meta/metadata.json

@@ -0,0 +1,3 @@
+{
+  "description": "Declare the py#dynamodb BaseModel Meta as a subclass of pynamodb's MetaProtocol bound with the inherited MetaProtocol type, so the generated project type checks with ty 0.0.86 and 0.0.87"
+}

package/src/migrations/v1.0.8/0002-py-dynamodb-type-base-model-meta/migration.d.ts

@@ -0,0 +1,6 @@
+/**
+ * Copyright Amazon.com, Inc. or its affiliates. All Rights Reserved.
+ * SPDX-License-Identifier: Apache-2.0
+ */
+import type { MigrationReturnObject, Tree } from '@nx/devkit';
+export default function migration(tree: Tree): Promise<MigrationReturnObject>;

package/src/migrations/v1.0.8/0002-py-dynamodb-type-base-model-meta/migration.js

@@ -0,0 +1,54 @@
+/**
+ * Copyright Amazon.com, Inc. or its affiliates. All Rights Reserved.
+ * SPDX-License-Identifier: Apache-2.0
+ */ import { bindMetaBlock, divergedMetaNextStep, findMetaBlockShape, META_BINDING, pyDynamoDbBasePyPaths, TYPED_IMPORT, UNTYPED_IMPORT, UNTYPED_META_HEADER } from "../../../py/dynamodb/base-model-meta.js";
+import { formatFilesInSubtree } from "../../../utils/format.js";
+/**
+ * Type the `Meta` of the `BaseModel` that py#dynamodb vends in
+ * `<module>/entities/base.py` as pynamodb's `MetaProtocol`.
+ *
+ * pynamodb declares `Model.Meta: MetaProtocol`, a mutable attribute. A nested
+ * `class Meta:` defines only some of the protocol's members, which ty reports
+ * as `invalid-attribute-override`; and any nested `class Meta`, even one
+ * subclassing the protocol, declares `Meta` with the narrower type of that
+ * class, which ty 0.0.87 reports as `invalid-mutable-override`. So the block is
+ * declared as `class _Meta(MetaProtocol):` and bound with
+ * `Meta: MetaProtocol = _Meta`, keeping the inherited type. Subclassing the
+ * protocol declares every member with the protocol's type; the members it only
+ * annotates are not set on the class, so pynamodb's runtime defaults apply as
+ * before, and `Meta` is the same class object it was.
+ *
+ * The generator writes base.py once and keeps the user's copy, so this brings
+ * existing workspaces up to date. A base.py is edited only where its import
+ * line and `Meta` block still have the exact shape the generator wrote. One
+ * that has diverged is left untouched and reported via `nextSteps`.
+ */ /**
+ * Rewrite a base.py still in the generated shape. Already migrated and missing
+ * files are left alone; a diverged one is reported via nextSteps.
+ */ const migrateBasePy = (tree, filePath, nextSteps)=>{
+    if (!tree.exists(filePath)) {
+        return;
+    }
+    const content = tree.read(filePath, 'utf-8') ?? '';
+    if (content.includes(META_BINDING)) {
+        return; // Already migrated (or user-added).
+    }
+    const shape = findMetaBlockShape(content, UNTYPED_META_HEADER);
+    if (!shape || !content.includes(UNTYPED_IMPORT)) {
+        nextSteps.push(divergedMetaNextStep(filePath));
+        return;
+    }
+    tree.write(filePath, bindMetaBlock(content.replace(UNTYPED_IMPORT, TYPED_IMPORT), UNTYPED_META_HEADER, shape));
+};
+export default async function migration(tree) {
+    const nextSteps = [];
+    for (const filePath of pyDynamoDbBasePyPaths(tree)){
+        migrateBasePy(tree, filePath, nextSteps);
+    }
+    await formatFilesInSubtree(tree);
+    return {
+        nextSteps
+    };
+}
+
+//# sourceMappingURL=migration.js.map

package/src/migrations/v1.0.8/0002-py-dynamodb-type-base-model-meta/migration.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../../../../../../../packages/nx-plugin/src/migrations/v1.0.8/0002-py-dynamodb-type-base-model-meta/migration.ts"],"sourcesContent":["/**\n * Copyright Amazon.com, Inc. or its affiliates. All Rights Reserved.\n * SPDX-License-Identifier: Apache-2.0\n */\nimport type { MigrationReturnObject, Tree } from '@nx/devkit';\nimport {\n  bindMetaBlock,\n  divergedMetaNextStep,\n  findMetaBlockShape,\n  META_BINDING,\n  pyDynamoDbBasePyPaths,\n  TYPED_IMPORT,\n  UNTYPED_IMPORT,\n  UNTYPED_META_HEADER,\n} from '../../../py/dynamodb/base-model-meta.js';\nimport { formatFilesInSubtree } from '../../../utils/format.js';\n\n/**\n * Type the `Meta` of the `BaseModel` that py#dynamodb vends in\n * `<module>/entities/base.py` as pynamodb's `MetaProtocol`.\n *\n * pynamodb declares `Model.Meta: MetaProtocol`, a mutable attribute. A nested\n * `class Meta:` defines only some of the protocol's members, which ty reports\n * as `invalid-attribute-override`; and any nested `class Meta`, even one\n * subclassing the protocol, declares `Meta` with the narrower type of that\n * class, which ty 0.0.87 reports as `invalid-mutable-override`. So the block is\n * declared as `class _Meta(MetaProtocol):` and bound with\n * `Meta: MetaProtocol = _Meta`, keeping the inherited type. Subclassing the\n * protocol declares every member with the protocol's type; the members it only\n * annotates are not set on the class, so pynamodb's runtime defaults apply as\n * before, and `Meta` is the same class object it was.\n *\n * The generator writes base.py once and keeps the user's copy, so this brings\n * existing workspaces up to date. A base.py is edited only where its import\n * line and `Meta` block still have the exact shape the generator wrote. One\n * that has diverged is left untouched and reported via `nextSteps`.\n */\n\n/**\n * Rewrite a base.py still in the generated shape. Already migrated and missing\n * files are left alone; a diverged one is reported via nextSteps.\n */\nconst migrateBasePy = (\n  tree: Tree,\n  filePath: string,\n  nextSteps: string[],\n): void => {\n  if (!tree.exists(filePath)) {\n    return;\n  }\n\n  const content = tree.read(filePath, 'utf-8') ?? '';\n  if (content.includes(META_BINDING)) {\n    return; // Already migrated (or user-added).\n  }\n\n  const shape = findMetaBlockShape(content, UNTYPED_META_HEADER);\n  if (!shape || !content.includes(UNTYPED_IMPORT)) {\n    nextSteps.push(divergedMetaNextStep(filePath));\n    return;\n  }\n\n  tree.write(\n    filePath,\n    bindMetaBlock(\n      content.replace(UNTYPED_IMPORT, TYPED_IMPORT),\n      UNTYPED_META_HEADER,\n      shape,\n    ),\n  );\n};\n\nexport default async function migration(\n  tree: Tree,\n): Promise<MigrationReturnObject> {\n  const nextSteps: string[] = [];\n\n  for (const filePath of pyDynamoDbBasePyPaths(tree)) {\n    migrateBasePy(tree, filePath, nextSteps);\n  }\n\n  await formatFilesInSubtree(tree);\n\n  return { nextSteps };\n}\n"],"names":["bindMetaBlock","divergedMetaNextStep","findMetaBlockShape","META_BINDING","pyDynamoDbBasePyPaths","TYPED_IMPORT","UNTYPED_IMPORT","UNTYPED_META_HEADER","formatFilesInSubtree","migrateBasePy","tree","filePath","nextSteps","exists","content","read","includes","shape","push","write","replace","migration"],"mappings":"AAAA;;;CAGC,GAED,SACEA,aAAa,EACbC,oBAAoB,EACpBC,kBAAkB,EAClBC,YAAY,EACZC,qBAAqB,EACrBC,YAAY,EACZC,cAAc,EACdC,mBAAmB,QACd,0CAA0C;AACjD,SAASC,oBAAoB,QAAQ,2BAA2B;AAEhE;;;;;;;;;;;;;;;;;;;CAmBC,GAED;;;CAGC,GACD,MAAMC,gBAAgB,CACpBC,MACAC,UACAC;IAEA,IAAI,CAACF,KAAKG,MAAM,CAACF,WAAW;QAC1B;IACF;IAEA,MAAMG,UAAUJ,KAAKK,IAAI,CAACJ,UAAU,YAAY;IAChD,IAAIG,QAAQE,QAAQ,CAACb,eAAe;QAClC,QAAQ,oCAAoC;IAC9C;IAEA,MAAMc,QAAQf,mBAAmBY,SAASP;IAC1C,IAAI,CAACU,SAAS,CAACH,QAAQE,QAAQ,CAACV,iBAAiB;QAC/CM,UAAUM,IAAI,CAACjB,qBAAqBU;QACpC;IACF;IAEAD,KAAKS,KAAK,CACRR,UACAX,cACEc,QAAQM,OAAO,CAACd,gBAAgBD,eAChCE,qBACAU;AAGN;AAEA,eAAe,eAAeI,UAC5BX,IAAU;IAEV,MAAME,YAAsB,EAAE;IAE9B,KAAK,MAAMD,YAAYP,sBAAsBM,MAAO;QAClDD,cAAcC,MAAMC,UAAUC;IAChC;IAEA,MAAMJ,qBAAqBE;IAE3B,OAAO;QAAEE;IAAU;AACrB"}

package/src/migrations/v1.0.8/0003-cache-inputs-outputs/migration.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../../../../../../../packages/nx-plugin/src/migrations/v1.0.8/0003-cache-inputs-outputs/migration.ts"],"sourcesContent":["/**\n * Copyright Amazon.com, Inc. or its affiliates. All Rights Reserved.\n * SPDX-License-Identifier: Apache-2.0\n */\nimport {\n  getProjects,\n  type MigrationReturnObject,\n  type ProjectConfiguration,\n  readNxJson,\n  type TargetConfiguration,\n  type Tree,\n  updateNxJson,\n  updateProjectConfiguration,\n} from '@nx/devkit';\nimport {\n  SMITHY_PROJECT_GENERATOR_INFO,\n  SMITHY_TARGET_INPUTS,\n} from '../../../smithy/project/generator.js';\nimport { TERRAFORM_PROJECT_GENERATOR_INFO } from '../../../terraform/project/generator.js';\nimport {\n  DEPENDENT_TASKS_OUTPUT_FILES_INPUT,\n  VENDED_DEPENDENT_TASKS_OUTPUT_GLOBS,\n} from '../../../ts/lib/generator.js';\nimport { TS_RDB_GENERATOR_INFO } from '../../../ts/rdb/generator.js';\nimport { formatFilesInSubtree } from '../../../utils/format.js';\n\n/**\n * Fix what four generated targets hash, so cached results follow what each\n * task actually reads:\n *\n * - `nx.json`'s `default` input no longer hashes checkov reports\n *   (`dist/<project>/checkov/checkov_report.json`, CDK and Terraform) or vitest\n *   coverage (`dist/<project>/test-output/vitest/coverage/`) from upstream\n *   tasks. Nothing downstream reads them, and an uncached scan or coverage run\n *   rewrites them, which missed every dependent task.\n * - A Smithy project's `compile` and `generate-ssdk` declare `[\"default\"]`,\n *   their own sources plus the outputs of the tasks they depend on, rather\n *   than relying on whatever target default applies. That hashes a consumed\n *   shape library's output only in a workspace where nx.json's `default`\n *   carries the `dependentTasksOutputFiles` entry, which only\n *   ts/lib/generator.ts writes.\n * - A ts#rdb project's `generate` (`prisma generate`) is cached on\n *   `[\"default\"]`, which covers the Prisma schema and config. The Prisma\n *   version is hashed through the lockfile.\n * - A Terraform project's `output` is no longer cached: it reads remote state,\n *   which no input can hash, so a hit could replay values from before an apply.\n *\n * Each edit uses the generator's own constants, so a migrated workspace is\n * byte-identical to a freshly generated one, keys in the same order. A target\n * or glob that has diverged from the generated shape is left untouched and\n * reported.\n *\n * Changing `namedInputs.default` changes every task hash, so the first build\n * after migrating misses the cache throughout. Removing a churning input can\n * also let a target that reads a file it does not declare replay a stale\n * result, so that risk is reported whenever the glob is rewritten.\n */\n\nconst CURRENT_GLOB =\n  DEPENDENT_TASKS_OUTPUT_FILES_INPUT.dependentTasksOutputFiles;\n\nconst STALE_PASS_ADVISORY =\n  \"nx.json's 'default' input no longer hashes checkov reports or vitest coverage from upstream tasks. A target that reads a file it does not declare as an input (for example a test reading README.md) can now replay a cached result after that file changes; add such files to the target's inputs.\";\n\nconst SMITHY_TARGETS = ['compile', 'generate-ssdk'];\nconst RDB_INPUTS = ['default'];\nconst PRE_FIX_TERRAFORM_OUTPUT_INPUTS = ['default'];\n\nconst sameInputs = (\n  inputs: TargetConfiguration['inputs'],\n  expected: string[],\n): boolean =>\n  Array.isArray(inputs) &&\n  inputs.length === expected.length &&\n  inputs.every((input, index) => input === expected[index]);\n\nconst command = (target: TargetConfiguration): unknown =>\n  target.options?.command;\n\n/** Rewrites a previously vended glob; returns whether it did. */\nconst migrateGlob = (tree: Tree, nextSteps: string[]): boolean => {\n  const nxJson = readNxJson(tree);\n  const defaultInputs = nxJson?.namedInputs?.default;\n  if (!nxJson || !Array.isArray(defaultInputs)) return false;\n\n  // A dependentTasksOutputFiles entry is \"vended\" if it is already current or\n  // is one of the globs this plugin has shipped (and so would be rewritten to\n  // the current one below). An extra entry a user added beside it - neither\n  // current nor vended - is their own scoping decision and is reported only\n  // when no vended-or-current entry exists; otherwise it would be reported on\n  // every run with advice that could widen hashing.\n  const hasVendedOrCurrentEntry = defaultInputs.some(\n    (input) =>\n      typeof input === 'object' &&\n      input !== null &&\n      'dependentTasksOutputFiles' in input &&\n      (input.dependentTasksOutputFiles === CURRENT_GLOB ||\n        (input.transitive &&\n          VENDED_DEPENDENT_TASKS_OUTPUT_GLOBS.includes(\n            input.dependentTasksOutputFiles,\n          ))),\n  );\n\n  let rewrote = false;\n  nxJson.namedInputs.default = defaultInputs.map((input) => {\n    if (typeof input !== 'object' || !('dependentTasksOutputFiles' in input)) {\n      return input;\n    }\n    const glob = input.dependentTasksOutputFiles;\n    if (glob === CURRENT_GLOB) return input;\n    if (\n      input.transitive &&\n      VENDED_DEPENDENT_TASKS_OUTPUT_GLOBS.includes(glob)\n    ) {\n      rewrote = true;\n      return { ...input, dependentTasksOutputFiles: CURRENT_GLOB };\n    }\n    if (!hasVendedOrCurrentEntry) {\n      nextSteps.push(\n        `nx.json: the 'default' input's dependentTasksOutputFiles '${glob}' has diverged from the generated shape - left untouched. Consider excluding checkov reports and vitest coverage ('${CURRENT_GLOB}'), which otherwise miss every dependent task whenever a scan or coverage run rewrites them.`,\n      );\n    }\n    return input;\n  });\n\n  if (rewrote) updateNxJson(tree, nxJson);\n  return rewrote;\n};\n\nconst diverged = (projectName: string, targetName: string, advice: string) =>\n  `${projectName}:${targetName}: has diverged from the generated shape - left untouched. ${advice}`;\n\n/** Inserts `inputs` after `cache`, where the generator writes it. */\nconst migrateSmithyTarget = (\n  projectName: string,\n  targetName: string,\n  target: TargetConfiguration,\n  nextSteps: string[],\n): TargetConfiguration | undefined => {\n  if (sameInputs(target.inputs, SMITHY_TARGET_INPUTS)) return undefined;\n  if (target.inputs !== undefined || target.executor !== 'nx:run-commands') {\n    nextSteps.push(\n      diverged(\n        projectName,\n        targetName,\n        \"Confirm its inputs cover the Smithy sources and the outputs of the tasks it depends on, as ['default'] does.\",\n      ),\n    );\n    return undefined;\n  }\n  const { cache, ...rest } = target;\n  return { cache, inputs: [...SMITHY_TARGET_INPUTS], ...rest };\n};\n\n/** Inserts `cache` and `inputs` after `executor`, where the generator writes them. */\nconst migrateRdbGenerate = (\n  projectName: string,\n  target: TargetConfiguration,\n  nextSteps: string[],\n): TargetConfiguration | undefined => {\n  if (target.cache === true && sameInputs(target.inputs, RDB_INPUTS)) {\n    return undefined;\n  }\n  if (\n    target.executor !== 'nx:run-commands' ||\n    command(target) !== 'prisma generate' ||\n    target.cache !== undefined ||\n    target.inputs !== undefined\n  ) {\n    nextSteps.push(\n      diverged(\n        projectName,\n        'generate',\n        \"To cache Prisma client generation, set cache: true and inputs: ['default'], which covers the Prisma schema and config.\",\n      ),\n    );\n    return undefined;\n  }\n  const { executor, ...rest } = target;\n  return { executor, cache: true, inputs: [...RDB_INPUTS], ...rest };\n};\n\n/** Stops caching `output` in place and drops its inputs. */\nconst migrateTerraformOutput = (\n  projectName: string,\n  target: TargetConfiguration,\n  nextSteps: string[],\n): TargetConfiguration | undefined => {\n  if (target.cache !== true) return undefined;\n  if (\n    !sameInputs(target.inputs, PRE_FIX_TERRAFORM_OUTPUT_INPUTS) ||\n    command(target) !== 'terraform output -json'\n  ) {\n    nextSteps.push(\n      diverged(\n        projectName,\n        'output',\n        'A cached output can replay stale values after an apply; set cache: false.',\n      ),\n    );\n    return undefined;\n  }\n  const { inputs: _inputs, ...rest } = target;\n  return { ...rest, cache: false };\n};\n\nconst migrateProject = (\n  projectName: string,\n  project: ProjectConfiguration,\n  nextSteps: string[],\n): boolean => {\n  const generator = (project.metadata as { generator?: string } | undefined)\n    ?.generator;\n  const targets = project.targets ?? {};\n\n  const migrations: [string, () => TargetConfiguration | undefined][] =\n    generator === SMITHY_PROJECT_GENERATOR_INFO.id\n      ? SMITHY_TARGETS.map((name) => [\n          name,\n          () =>\n            migrateSmithyTarget(projectName, name, targets[name], nextSteps),\n        ])\n      : generator === TS_RDB_GENERATOR_INFO.id\n        ? [\n            [\n              'generate',\n              () =>\n                migrateRdbGenerate(projectName, targets.generate, nextSteps),\n            ],\n          ]\n        : generator === TERRAFORM_PROJECT_GENERATOR_INFO.id\n          ? [\n              [\n                'output',\n                () =>\n                  migrateTerraformOutput(\n                    projectName,\n                    targets.output,\n                    nextSteps,\n                  ),\n              ],\n            ]\n          : [];\n\n  let changed = false;\n  for (const [name, migrate] of migrations) {\n    if (!targets[name]) continue;\n    const migrated = migrate();\n    if (migrated) {\n      targets[name] = migrated;\n      changed = true;\n    }\n  }\n  return changed;\n};\n\nexport default async function migration(\n  tree: Tree,\n): Promise<MigrationReturnObject> {\n  const nextSteps: string[] = [];\n\n  const rewroteGlob = migrateGlob(tree, nextSteps);\n\n  for (const [projectName, project] of getProjects(tree)) {\n    if (migrateProject(projectName, project, nextSteps)) {\n      updateProjectConfiguration(tree, projectName, project);\n    }\n  }\n\n  if (rewroteGlob) nextSteps.push(STALE_PASS_ADVISORY);\n\n  await formatFilesInSubtree(tree);\n\n  return { nextSteps };\n}\n"],"names":["getProjects","readNxJson","updateNxJson","updateProjectConfiguration","SMITHY_PROJECT_GENERATOR_INFO","SMITHY_TARGET_INPUTS","TERRAFORM_PROJECT_GENERATOR_INFO","DEPENDENT_TASKS_OUTPUT_FILES_INPUT","VENDED_DEPENDENT_TASKS_OUTPUT_GLOBS","TS_RDB_GENERATOR_INFO","formatFilesInSubtree","CURRENT_GLOB","dependentTasksOutputFiles","STALE_PASS_ADVISORY","SMITHY_TARGETS","RDB_INPUTS","PRE_FIX_TERRAFORM_OUTPUT_INPUTS","sameInputs","inputs","expected","Array","isArray","length","every","input","index","command","target","options","migrateGlob","tree","nextSteps","nxJson","defaultInputs","namedInputs","default","hasVendedOrCurrentEntry","some","transitive","includes","rewrote","map","glob","push","diverged","projectName","targetName","advice","migrateSmithyTarget","undefined","executor","cache","rest","migrateRdbGenerate","migrateTerraformOutput","_inputs","migrateProject","project","generator","metadata","targets","migrations","id","name","generate","output","changed","migrate","migrated","migration","rewroteGlob"],"mappings":"AAAA;;;CAGC,GACD,SACEA,WAAW,EAGXC,UAAU,EAGVC,YAAY,EACZC,0BAA0B,QACrB,aAAa;AACpB,SACEC,6BAA6B,EAC7BC,oBAAoB,QACf,uCAAuC;AAC9C,SAASC,gCAAgC,QAAQ,0CAA0C;AAC3F,SACEC,kCAAkC,EAClCC,mCAAmC,QAC9B,+BAA+B;AACtC,SAASC,qBAAqB,QAAQ,+BAA+B;AACrE,SAASC,oBAAoB,QAAQ,2BAA2B;AAEhE;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;CA8BC,GAED,MAAMC,eACJJ,mCAAmCK,yBAAyB;AAE9D,MAAMC,sBACJ;AAEF,MAAMC,iBAAiB;IAAC;IAAW;CAAgB;AACnD,MAAMC,aAAa;IAAC;CAAU;AAC9B,MAAMC,kCAAkC;IAAC;CAAU;AAEnD,MAAMC,aAAa,CACjBC,QACAC,WAEAC,MAAMC,OAAO,CAACH,WACdA,OAAOI,MAAM,KAAKH,SAASG,MAAM,IACjCJ,OAAOK,KAAK,CAAC,CAACC,OAAOC,QAAUD,UAAUL,QAAQ,CAACM,MAAM;AAE1D,MAAMC,UAAU,CAACC,SACfA,OAAOC,OAAO,EAAEF;AAElB,+DAA+D,GAC/D,MAAMG,cAAc,CAACC,MAAYC;IAC/B,MAAMC,SAAS/B,WAAW6B;IAC1B,MAAMG,gBAAgBD,QAAQE,aAAaC;IAC3C,IAAI,CAACH,UAAU,CAACZ,MAAMC,OAAO,CAACY,gBAAgB,OAAO;IAErD,4EAA4E;IAC5E,4EAA4E;IAC5E,0EAA0E;IAC1E,0EAA0E;IAC1E,4EAA4E;IAC5E,kDAAkD;IAClD,MAAMG,0BAA0BH,cAAcI,IAAI,CAChD,CAACb,QACC,OAAOA,UAAU,YACjBA,UAAU,QACV,+BAA+BA,SAC9BA,CAAAA,MAAMZ,yBAAyB,KAAKD,gBAClCa,MAAMc,UAAU,IACf9B,oCAAoC+B,QAAQ,CAC1Cf,MAAMZ,yBAAyB,CAChC;IAGT,IAAI4B,UAAU;IACdR,OAAOE,WAAW,CAACC,OAAO,GAAGF,cAAcQ,GAAG,CAAC,CAACjB;QAC9C,IAAI,OAAOA,UAAU,YAAY,CAAE,CAAA,+BAA+BA,KAAI,GAAI;YACxE,OAAOA;QACT;QACA,MAAMkB,OAAOlB,MAAMZ,yBAAyB;QAC5C,IAAI8B,SAAS/B,cAAc,OAAOa;QAClC,IACEA,MAAMc,UAAU,IAChB9B,oCAAoC+B,QAAQ,CAACG,OAC7C;YACAF,UAAU;YACV,OAAO;gBAAE,GAAGhB,KAAK;gBAAEZ,2BAA2BD;YAAa;QAC7D;QACA,IAAI,CAACyB,yBAAyB;YAC5BL,UAAUY,IAAI,CACZ,CAAC,0DAA0D,EAAED,KAAK,mHAAmH,EAAE/B,aAAa,4FAA4F,CAAC;QAErS;QACA,OAAOa;IACT;IAEA,IAAIgB,SAAStC,aAAa4B,MAAME;IAChC,OAAOQ;AACT;AAEA,MAAMI,WAAW,CAACC,aAAqBC,YAAoBC,SACzD,GAAGF,YAAY,CAAC,EAAEC,WAAW,0DAA0D,EAAEC,QAAQ;AAEnG,mEAAmE,GACnE,MAAMC,sBAAsB,CAC1BH,aACAC,YACAnB,QACAI;IAEA,IAAId,WAAWU,OAAOT,MAAM,EAAEb,uBAAuB,OAAO4C;IAC5D,IAAItB,OAAOT,MAAM,KAAK+B,aAAatB,OAAOuB,QAAQ,KAAK,mBAAmB;QACxEnB,UAAUY,IAAI,CACZC,SACEC,aACAC,YACA;QAGJ,OAAOG;IACT;IACA,MAAM,EAAEE,KAAK,EAAE,GAAGC,MAAM,GAAGzB;IAC3B,OAAO;QAAEwB;QAAOjC,QAAQ;eAAIb;SAAqB;QAAE,GAAG+C,IAAI;IAAC;AAC7D;AAEA,oFAAoF,GACpF,MAAMC,qBAAqB,CACzBR,aACAlB,QACAI;IAEA,IAAIJ,OAAOwB,KAAK,KAAK,QAAQlC,WAAWU,OAAOT,MAAM,EAAEH,aAAa;QAClE,OAAOkC;IACT;IACA,IACEtB,OAAOuB,QAAQ,KAAK,qBACpBxB,QAAQC,YAAY,qBACpBA,OAAOwB,KAAK,KAAKF,aACjBtB,OAAOT,MAAM,KAAK+B,WAClB;QACAlB,UAAUY,IAAI,CACZC,SACEC,aACA,YACA;QAGJ,OAAOI;IACT;IACA,MAAM,EAAEC,QAAQ,EAAE,GAAGE,MAAM,GAAGzB;IAC9B,OAAO;QAAEuB;QAAUC,OAAO;QAAMjC,QAAQ;eAAIH;SAAW;QAAE,GAAGqC,IAAI;IAAC;AACnE;AAEA,0DAA0D,GAC1D,MAAME,yBAAyB,CAC7BT,aACAlB,QACAI;IAEA,IAAIJ,OAAOwB,KAAK,KAAK,MAAM,OAAOF;IAClC,IACE,CAAChC,WAAWU,OAAOT,MAAM,EAAEF,oCAC3BU,QAAQC,YAAY,0BACpB;QACAI,UAAUY,IAAI,CACZC,SACEC,aACA,UACA;QAGJ,OAAOI;IACT;IACA,MAAM,EAAE/B,QAAQqC,OAAO,EAAE,GAAGH,MAAM,GAAGzB;IACrC,OAAO;QAAE,GAAGyB,IAAI;QAAED,OAAO;IAAM;AACjC;AAEA,MAAMK,iBAAiB,CACrBX,aACAY,SACA1B;IAEA,MAAM2B,YAAaD,QAAQE,QAAQ,EAC/BD;IACJ,MAAME,UAAUH,QAAQG,OAAO,IAAI,CAAC;IAEpC,MAAMC,aACJH,cAActD,8BAA8B0D,EAAE,GAC1ChD,eAAe2B,GAAG,CAAC,CAACsB,OAAS;YAC3BA;YACA,IACEf,oBAAoBH,aAAakB,MAAMH,OAAO,CAACG,KAAK,EAAEhC;SACzD,IACD2B,cAAcjD,sBAAsBqD,EAAE,GACpC;QACE;YACE;YACA,IACET,mBAAmBR,aAAae,QAAQI,QAAQ,EAAEjC;SACrD;KACF,GACD2B,cAAcpD,iCAAiCwD,EAAE,GAC/C;QACE;YACE;YACA,IACER,uBACET,aACAe,QAAQK,MAAM,EACdlC;SAEL;KACF,GACD,EAAE;IAEZ,IAAImC,UAAU;IACd,KAAK,MAAM,CAACH,MAAMI,QAAQ,IAAIN,WAAY;QACxC,IAAI,CAACD,OAAO,CAACG,KAAK,EAAE;QACpB,MAAMK,WAAWD;QACjB,IAAIC,UAAU;YACZR,OAAO,CAACG,KAAK,GAAGK;YAChBF,UAAU;QACZ;IACF;IACA,OAAOA;AACT;AAEA,eAAe,eAAeG,UAC5BvC,IAAU;IAEV,MAAMC,YAAsB,EAAE;IAE9B,MAAMuC,cAAczC,YAAYC,MAAMC;IAEtC,KAAK,MAAM,CAACc,aAAaY,QAAQ,IAAIzD,YAAY8B,MAAO;QACtD,IAAI0B,eAAeX,aAAaY,SAAS1B,YAAY;YACnD5B,2BAA2B2B,MAAMe,aAAaY;QAChD;IACF;IAEA,IAAIa,aAAavC,UAAUY,IAAI,CAAC9B;IAEhC,MAAMH,qBAAqBoB;IAE3B,OAAO;QAAEC;IAAU;AACrB"}

package/src/open-api/py-client/files/shared/errors.py.template

@@ -9,7 +9,7 @@ from typing import Any<%- hasNeverErrorType ? ', Never' : '' %>
 from . import types
 
 
-class ApiError(Exception):
+class ApiError[ErrorT](Exception):
     """Base class for all API errors.
 
     Subclasses are generated per-operation so `error` can be narrowed by the
@@ -18,7 +18,7 @@ class ApiError(Exception):
     """
 
     status: int
-    error: Any
+    error: ErrorT
 
     def __init__(self, status: int, error: Any = None) -> None:
         super().__init__(f"API returned status {status}")
@@ -30,8 +30,6 @@ class ApiError(Exception):
 _%>
 
 
-class <%- shape.exceptionClassName %>(ApiError):
+class <%- shape.exceptionClassName %>(ApiError[<% if (shape.entries.length === 0) { %>Never<% } else { %>types.<%- shape.unionTypeName %><% } %>]):
     """Raised when `<%- op.operationIdSnakeCase || op.name %>` returns a non-success status."""
-
-    error: <% if (shape.entries.length === 0) { %>Never<% } else { %>types.<%- shape.unionTypeName %><% } %>
 <%_ }); _%>