@aws/nx-plugin 1.0.8 → 1.0.10

package/src/utils/git.d.ts

@@ -13,5 +13,10 @@ export declare const getGitIncludedFiles: (tree: Tree) => string[];
 export declare const isWithinGitRepo: (tree: Tree) => boolean;
 /**
  * Update a .gitignore file. Will create a new .gitignore file if it does not exist
+ *
+ * A trailing newline is kept rather than handed to `doUpdate` as an empty
+ * pattern. Duplicate patterns are removed, but blank lines are kept where they
+ * are. When the update adds and removes nothing the file is left untouched, so
+ * re-running a caller is a no-op.
  */
 export declare const updateGitIgnore: (tree: Tree, dir: string, doUpdate: (patterns: string[]) => string[]) => void;

package/src/utils/git.js

@@ -3,7 +3,6 @@
  * SPDX-License-Identifier: Apache-2.0
  */ import { joinPathFragments } from "@nx/devkit";
 import { execSync } from "child_process";
-import uniqBy from "lodash.uniqby";
 /**
  * Returns all files from the tree root that are not gitignored (both tracked and untracked)
  */ export const getGitIncludedFiles = (tree)=>{
@@ -37,11 +36,37 @@ import uniqBy from "lodash.uniqby";
 };
 /**
  * Update a .gitignore file. Will create a new .gitignore file if it does not exist
+ *
+ * A trailing newline is kept rather than handed to `doUpdate` as an empty
+ * pattern. Duplicate patterns are removed, but blank lines are kept where they
+ * are. When the update adds and removes nothing the file is left untouched, so
+ * re-running a caller is a no-op.
  */ export const updateGitIgnore = (tree, dir, doUpdate)=>{
     const gitIgnorePath = joinPathFragments(dir, '.gitignore');
-    const existingPatterns = tree.read(gitIgnorePath, 'utf-8')?.split('\n') ?? [];
-    const newPatterns = doUpdate(existingPatterns);
-    tree.write(gitIgnorePath, uniqBy(newPatterns, (p)=>p).join('\n'));
+    const existing = tree.read(gitIgnorePath, 'utf-8');
+    const hasTrailingNewline = existing?.endsWith('\n') ?? false;
+    const existingPatterns = existing === null ? [] : (hasTrailingNewline ? existing.slice(0, -1) : existing).split('\n');
+    const seen = new Set();
+    const newPatterns = doUpdate([
+        ...existingPatterns
+    ]).filter((p)=>{
+        if (p.trim() === '') {
+            return true;
+        }
+        if (seen.has(p)) {
+            return false;
+        }
+        seen.add(p);
+        return true;
+    });
+    if (existing !== null) {
+        const existingSet = new Set(existingPatterns);
+        const newSet = new Set(newPatterns);
+        if (newPatterns.every((p)=>existingSet.has(p)) && existingPatterns.every((p)=>newSet.has(p))) {
+            return;
+        }
+    }
+    tree.write(gitIgnorePath, newPatterns.join('\n') + (hasTrailingNewline ? '\n' : ''));
 };
 
 //# sourceMappingURL=git.js.map

package/src/utils/git.js.map

@@ -1 +1 @@
-{"version":3,"sources":["../../../../../packages/nx-plugin/src/utils/git.ts"],"sourcesContent":["/**\n * Copyright Amazon.com, Inc. or its affiliates. All Rights Reserved.\n * SPDX-License-Identifier: Apache-2.0\n */\nimport { joinPathFragments, type Tree } from '@nx/devkit';\nimport { execSync } from 'child_process';\nimport uniqBy from 'lodash.uniqby';\n\n/**\n * Returns all files from the tree root that are not gitignored (both tracked and untracked)\n */\nexport const getGitIncludedFiles = (tree: Tree): string[] => {\n  return [\n    // Git tracked files\n    ...execSync('git ls-files --exclude-standard', {\n      encoding: 'utf-8',\n      cwd: tree.root,\n    })\n      .split('\\n')\n      .filter((x) => x),\n    // Untracked files that aren't ignored\n    ...execSync('git ls-files --others --exclude-standard', {\n      encoding: 'utf-8',\n      cwd: tree.root,\n    })\n      .split('\\n')\n      .filter((x) => x),\n  ].filter((f) => tree.exists(f));\n};\n\n/**\n * Return whether or not a tree is within a git repo\n */\nexport const isWithinGitRepo = (tree: Tree): boolean => {\n  if (tree.exists('.git')) {\n    return true;\n  }\n  try {\n    return execSync('git rev-parse --is-inside-work-tree', {\n      encoding: 'utf-8',\n      cwd: tree.root,\n    }).startsWith('true');\n  } catch {\n    return false;\n  }\n};\n\n/**\n * Update a .gitignore file. Will create a new .gitignore file if it does not exist\n */\nexport const updateGitIgnore = (\n  tree: Tree,\n  dir: string,\n  doUpdate: (patterns: string[]) => string[],\n) => {\n  const gitIgnorePath = joinPathFragments(dir, '.gitignore');\n  const existingPatterns = tree.read(gitIgnorePath, 'utf-8')?.split('\\n') ?? [];\n  const newPatterns = doUpdate(existingPatterns);\n  tree.write(gitIgnorePath, uniqBy(newPatterns, (p) => p).join('\\n'));\n};\n"],"names":["joinPathFragments","execSync","uniqBy","getGitIncludedFiles","tree","encoding","cwd","root","split","filter","x","f","exists","isWithinGitRepo","startsWith","updateGitIgnore","dir","doUpdate","gitIgnorePath","existingPatterns","read","newPatterns","write","p","join"],"mappings":"AAAA;;;CAGC,GACD,SAASA,iBAAiB,QAAmB,aAAa;AAC1D,SAASC,QAAQ,QAAQ,gBAAgB;AACzC,OAAOC,YAAY,gBAAgB;AAEnC;;CAEC,GACD,OAAO,MAAMC,sBAAsB,CAACC;IAClC,OAAO;QACL,oBAAoB;WACjBH,SAAS,mCAAmC;YAC7CI,UAAU;YACVC,KAAKF,KAAKG,IAAI;QAChB,GACGC,KAAK,CAAC,MACNC,MAAM,CAAC,CAACC,IAAMA;QACjB,sCAAsC;WACnCT,SAAS,4CAA4C;YACtDI,UAAU;YACVC,KAAKF,KAAKG,IAAI;QAChB,GACGC,KAAK,CAAC,MACNC,MAAM,CAAC,CAACC,IAAMA;KAClB,CAACD,MAAM,CAAC,CAACE,IAAMP,KAAKQ,MAAM,CAACD;AAC9B,EAAE;AAEF;;CAEC,GACD,OAAO,MAAME,kBAAkB,CAACT;IAC9B,IAAIA,KAAKQ,MAAM,CAAC,SAAS;QACvB,OAAO;IACT;IACA,IAAI;QACF,OAAOX,SAAS,uCAAuC;YACrDI,UAAU;YACVC,KAAKF,KAAKG,IAAI;QAChB,GAAGO,UAAU,CAAC;IAChB,EAAE,OAAM;QACN,OAAO;IACT;AACF,EAAE;AAEF;;CAEC,GACD,OAAO,MAAMC,kBAAkB,CAC7BX,MACAY,KACAC;IAEA,MAAMC,gBAAgBlB,kBAAkBgB,KAAK;IAC7C,MAAMG,mBAAmBf,KAAKgB,IAAI,CAACF,eAAe,UAAUV,MAAM,SAAS,EAAE;IAC7E,MAAMa,cAAcJ,SAASE;IAC7Bf,KAAKkB,KAAK,CAACJ,eAAehB,OAAOmB,aAAa,CAACE,IAAMA,GAAGC,IAAI,CAAC;AAC/D,EAAE"}
+{"version":3,"sources":["../../../../../packages/nx-plugin/src/utils/git.ts"],"sourcesContent":["/**\n * Copyright Amazon.com, Inc. or its affiliates. All Rights Reserved.\n * SPDX-License-Identifier: Apache-2.0\n */\nimport { joinPathFragments, type Tree } from '@nx/devkit';\nimport { execSync } from 'child_process';\n\n/**\n * Returns all files from the tree root that are not gitignored (both tracked and untracked)\n */\nexport const getGitIncludedFiles = (tree: Tree): string[] => {\n  return [\n    // Git tracked files\n    ...execSync('git ls-files --exclude-standard', {\n      encoding: 'utf-8',\n      cwd: tree.root,\n    })\n      .split('\\n')\n      .filter((x) => x),\n    // Untracked files that aren't ignored\n    ...execSync('git ls-files --others --exclude-standard', {\n      encoding: 'utf-8',\n      cwd: tree.root,\n    })\n      .split('\\n')\n      .filter((x) => x),\n  ].filter((f) => tree.exists(f));\n};\n\n/**\n * Return whether or not a tree is within a git repo\n */\nexport const isWithinGitRepo = (tree: Tree): boolean => {\n  if (tree.exists('.git')) {\n    return true;\n  }\n  try {\n    return execSync('git rev-parse --is-inside-work-tree', {\n      encoding: 'utf-8',\n      cwd: tree.root,\n    }).startsWith('true');\n  } catch {\n    return false;\n  }\n};\n\n/**\n * Update a .gitignore file. Will create a new .gitignore file if it does not exist\n *\n * A trailing newline is kept rather than handed to `doUpdate` as an empty\n * pattern. Duplicate patterns are removed, but blank lines are kept where they\n * are. When the update adds and removes nothing the file is left untouched, so\n * re-running a caller is a no-op.\n */\nexport const updateGitIgnore = (\n  tree: Tree,\n  dir: string,\n  doUpdate: (patterns: string[]) => string[],\n) => {\n  const gitIgnorePath = joinPathFragments(dir, '.gitignore');\n  const existing = tree.read(gitIgnorePath, 'utf-8');\n  const hasTrailingNewline = existing?.endsWith('\\n') ?? false;\n  const existingPatterns =\n    existing === null\n      ? []\n      : (hasTrailingNewline ? existing.slice(0, -1) : existing).split('\\n');\n  const seen = new Set<string>();\n  const newPatterns = doUpdate([...existingPatterns]).filter((p) => {\n    if (p.trim() === '') {\n      return true;\n    }\n    if (seen.has(p)) {\n      return false;\n    }\n    seen.add(p);\n    return true;\n  });\n\n  if (existing !== null) {\n    const existingSet = new Set(existingPatterns);\n    const newSet = new Set(newPatterns);\n    if (\n      newPatterns.every((p) => existingSet.has(p)) &&\n      existingPatterns.every((p) => newSet.has(p))\n    ) {\n      return;\n    }\n  }\n\n  tree.write(\n    gitIgnorePath,\n    newPatterns.join('\\n') + (hasTrailingNewline ? '\\n' : ''),\n  );\n};\n"],"names":["joinPathFragments","execSync","getGitIncludedFiles","tree","encoding","cwd","root","split","filter","x","f","exists","isWithinGitRepo","startsWith","updateGitIgnore","dir","doUpdate","gitIgnorePath","existing","read","hasTrailingNewline","endsWith","existingPatterns","slice","seen","Set","newPatterns","p","trim","has","add","existingSet","newSet","every","write","join"],"mappings":"AAAA;;;CAGC,GACD,SAASA,iBAAiB,QAAmB,aAAa;AAC1D,SAASC,QAAQ,QAAQ,gBAAgB;AAEzC;;CAEC,GACD,OAAO,MAAMC,sBAAsB,CAACC;IAClC,OAAO;QACL,oBAAoB;WACjBF,SAAS,mCAAmC;YAC7CG,UAAU;YACVC,KAAKF,KAAKG,IAAI;QAChB,GACGC,KAAK,CAAC,MACNC,MAAM,CAAC,CAACC,IAAMA;QACjB,sCAAsC;WACnCR,SAAS,4CAA4C;YACtDG,UAAU;YACVC,KAAKF,KAAKG,IAAI;QAChB,GACGC,KAAK,CAAC,MACNC,MAAM,CAAC,CAACC,IAAMA;KAClB,CAACD,MAAM,CAAC,CAACE,IAAMP,KAAKQ,MAAM,CAACD;AAC9B,EAAE;AAEF;;CAEC,GACD,OAAO,MAAME,kBAAkB,CAACT;IAC9B,IAAIA,KAAKQ,MAAM,CAAC,SAAS;QACvB,OAAO;IACT;IACA,IAAI;QACF,OAAOV,SAAS,uCAAuC;YACrDG,UAAU;YACVC,KAAKF,KAAKG,IAAI;QAChB,GAAGO,UAAU,CAAC;IAChB,EAAE,OAAM;QACN,OAAO;IACT;AACF,EAAE;AAEF;;;;;;;CAOC,GACD,OAAO,MAAMC,kBAAkB,CAC7BX,MACAY,KACAC;IAEA,MAAMC,gBAAgBjB,kBAAkBe,KAAK;IAC7C,MAAMG,WAAWf,KAAKgB,IAAI,CAACF,eAAe;IAC1C,MAAMG,qBAAqBF,UAAUG,SAAS,SAAS;IACvD,MAAMC,mBACJJ,aAAa,OACT,EAAE,GACF,AAACE,CAAAA,qBAAqBF,SAASK,KAAK,CAAC,GAAG,CAAC,KAAKL,QAAO,EAAGX,KAAK,CAAC;IACpE,MAAMiB,OAAO,IAAIC;IACjB,MAAMC,cAAcV,SAAS;WAAIM;KAAiB,EAAEd,MAAM,CAAC,CAACmB;QAC1D,IAAIA,EAAEC,IAAI,OAAO,IAAI;YACnB,OAAO;QACT;QACA,IAAIJ,KAAKK,GAAG,CAACF,IAAI;YACf,OAAO;QACT;QACAH,KAAKM,GAAG,CAACH;QACT,OAAO;IACT;IAEA,IAAIT,aAAa,MAAM;QACrB,MAAMa,cAAc,IAAIN,IAAIH;QAC5B,MAAMU,SAAS,IAAIP,IAAIC;QACvB,IACEA,YAAYO,KAAK,CAAC,CAACN,IAAMI,YAAYF,GAAG,CAACF,OACzCL,iBAAiBW,KAAK,CAAC,CAACN,IAAMK,OAAOH,GAAG,CAACF,KACzC;YACA;QACF;IACF;IAEAxB,KAAK+B,KAAK,CACRjB,eACAS,YAAYS,IAAI,CAAC,QAASf,CAAAA,qBAAqB,OAAO,EAAC;AAE3D,EAAE"}

package/src/utils/shared-constructs.d.ts

@@ -11,3 +11,8 @@ export interface SharedConstructsGeneratorOptions {
     iac: Iac;
 }
 export declare function sharedConstructsGenerator<const D extends DependencyDeclaration>(tree: Tree, options: SharedConstructsGeneratorOptions, declaration: D & MustDeclare<typeof SHARED_CONSTRUCTS_DEPENDENCIES, D>): Promise<void>;
+/**
+ * Ignore the root `runtime-config.json`, unless an existing entry already
+ * covers it.
+ */
+export declare const ignoreRuntimeConfig: (tree: Tree) => void;

package/src/utils/shared-constructs.js

@@ -8,6 +8,7 @@ import { addCdkTestGlobalSetup } from "./cdk-test-setup.js";
 import { readAwsNxPluginConfig } from "./config/utils.js";
 import { addDependenciesToPackageJson } from "./dependencies.js";
 import { formatFilesInSubtree } from "./format.js";
+import { updateGitIgnore } from "./git.js";
 import { esmVars } from "./module-format.js";
 import { getNpmScopePrefix } from "./npm-scope.js";
 import { getPackageManagerDisplayCommands } from "./pkg-manager.js";
@@ -17,7 +18,7 @@ import { terraformProviderVersions, withVersions } from "./versions.js";
 export async function sharedConstructsGenerator(tree, options, declaration) {
     const { iac } = options;
     const npmScopePrefix = getNpmScopePrefix(tree);
-    updateGitignore(tree);
+    ignoreRuntimeConfig(tree);
     if (iac === 'cdk') {
         if (!tree.exists(joinPathFragments(PACKAGES_DIR, SHARED_CONSTRUCTS_DIR, 'project.json'))) {
             await tsProjectGenerator(tree, {
@@ -85,14 +86,14 @@ export async function sharedConstructsGenerator(tree, options, declaration) {
         }
     }
 }
-const updateGitignore = (tree)=>{
-    const gitignore = tree.exists('.gitignore') ? tree.read('.gitignore', 'utf-8') : '';
-    const regex = /runtime-config.json/gm;
-    const hasRuntimeConfig = regex.test(gitignore ?? '');
-    if (hasRuntimeConfig) {
-        return;
-    }
-    tree.write('.gitignore', `${gitignore}\n\nruntime-config.json`);
+/**
+ * Ignore the root `runtime-config.json`, unless an existing entry already
+ * covers it.
+ */ export const ignoreRuntimeConfig = (tree)=>{
+    updateGitIgnore(tree, '.', (patterns)=>patterns.some((p)=>p.includes('runtime-config.json')) ? patterns : [
+            ...patterns,
+            'runtime-config.json'
+        ]);
 };
 
 //# sourceMappingURL=shared-constructs.js.map

package/src/utils/shared-constructs.js.map

@@ -1 +1 @@
-{"version":3,"sources":["../../../../../packages/nx-plugin/src/utils/shared-constructs.ts"],"sourcesContent":["/**\n * Copyright Amazon.com, Inc. or its affiliates. All Rights Reserved.\n * SPDX-License-Identifier: Apache-2.0\n */\nimport {\n  generateFiles,\n  joinPathFragments,\n  OverwriteStrategy,\n  type ProjectConfiguration,\n  type Tree,\n  updateJson,\n} from '@nx/devkit';\nimport terraformProjectGenerator from '../terraform/project/generator.js';\nimport tsProjectGenerator from '../ts/lib/generator.js';\nimport { addCdkTestGlobalSetup } from './cdk-test-setup.js';\nimport { readAwsNxPluginConfig } from './config/utils.js';\nimport type {\n  DependencyDeclaration,\n  MustDeclare,\n} from './declared-dependencies.js';\nimport { addDependenciesToPackageJson } from './dependencies.js';\nimport { formatFilesInSubtree } from './format.js';\nimport type { Iac } from './iac.js';\nimport { esmVars } from './module-format.js';\nimport { getNpmScopePrefix } from './npm-scope.js';\nimport { getPackageManagerDisplayCommands } from './pkg-manager.js';\nimport {\n  PACKAGES_DIR,\n  SHARED_CONSTRUCTS_DEPENDENCIES,\n  SHARED_CONSTRUCTS_DIR,\n  SHARED_CONSTRUCTS_NAME,\n  SHARED_TERRAFORM_DIR,\n  SHARED_TERRAFORM_NAME,\n} from './shared-constructs-constants.js';\n\nexport { SHARED_CONSTRUCTS_DEPENDENCIES };\n\nimport { terraformProviderVersions, withVersions } from './versions.js';\n\nexport interface SharedConstructsGeneratorOptions {\n  iac: Iac;\n}\n\nexport async function sharedConstructsGenerator<\n  const D extends DependencyDeclaration,\n>(\n  tree: Tree,\n  options: SharedConstructsGeneratorOptions,\n  declaration: D & MustDeclare<typeof SHARED_CONSTRUCTS_DEPENDENCIES, D>,\n) {\n  const { iac } = options;\n  const npmScopePrefix = getNpmScopePrefix(tree);\n  updateGitignore(tree);\n\n  if (iac === 'cdk') {\n    if (\n      !tree.exists(\n        joinPathFragments(PACKAGES_DIR, SHARED_CONSTRUCTS_DIR, 'project.json'),\n      )\n    ) {\n      await tsProjectGenerator(tree, {\n        name: SHARED_CONSTRUCTS_NAME,\n        directory: PACKAGES_DIR,\n        subDirectory: SHARED_CONSTRUCTS_DIR,\n      });\n      tree.delete(\n        joinPathFragments(PACKAGES_DIR, SHARED_CONSTRUCTS_DIR, 'src'),\n      );\n      generateFiles(\n        tree,\n        joinPathFragments(\n          import.meta.dirname,\n          'files',\n          SHARED_CONSTRUCTS_DIR,\n          'src',\n        ),\n        joinPathFragments(PACKAGES_DIR, SHARED_CONSTRUCTS_DIR, 'src'),\n        {\n          npmScopePrefix,\n          scopeAlias: npmScopePrefix,\n          tags: readAwsNxPluginConfig(tree)?.tags ?? [],\n          ...esmVars(tree),\n        },\n        {\n          overwriteStrategy: OverwriteStrategy.KeepExisting,\n        },\n      );\n      generateFiles(\n        tree,\n        joinPathFragments(import.meta.dirname, 'files', 'common', 'readme'),\n        joinPathFragments(PACKAGES_DIR, SHARED_CONSTRUCTS_DIR),\n        {\n          fullyQualifiedName: `${npmScopePrefix}${SHARED_CONSTRUCTS_NAME}`,\n          name: SHARED_CONSTRUCTS_NAME,\n          pkgMgrCmd: getPackageManagerDisplayCommands().exec,\n        },\n        {\n          overwriteStrategy: OverwriteStrategy.Overwrite,\n        },\n      );\n      addDependenciesToPackageJson(\n        tree,\n        withVersions(\n          declaration as DependencyDeclaration<\n            typeof SHARED_CONSTRUCTS_DEPENDENCIES\n          >,\n          ['constructs', 'aws-cdk-lib'],\n        ),\n        withVersions(\n          declaration as DependencyDeclaration<\n            typeof SHARED_CONSTRUCTS_DEPENDENCIES\n          >,\n          ['@types/node'],\n        ),\n        joinPathFragments(\n          joinPathFragments(PACKAGES_DIR, SHARED_CONSTRUCTS_DIR),\n          'package.json',\n        ),\n      );\n      await addCdkTestGlobalSetup(\n        tree,\n        joinPathFragments(PACKAGES_DIR, SHARED_CONSTRUCTS_DIR),\n      );\n      await formatFilesInSubtree(tree);\n    }\n  }\n\n  // Handle Terraform provider\n  if (iac === 'terraform') {\n    const terraformLibPath = joinPathFragments(\n      PACKAGES_DIR,\n      SHARED_TERRAFORM_DIR,\n    );\n    if (!tree.exists(joinPathFragments(terraformLibPath, 'project.json'))) {\n      await terraformProjectGenerator(tree, {\n        name: SHARED_TERRAFORM_NAME,\n        directory: joinPathFragments(PACKAGES_DIR, 'common'),\n        type: 'library',\n      });\n\n      // `build` is a no-op orchestration target that produces no files of its\n      // own. Terraform writes runtime-config entries into\n      // `dist/{projectRoot}/runtime-config` at apply time, and other terraform\n      // projects contribute their own entries to the same directory. Without\n      // explicit outputs, Nx infers `dist/{projectRoot}` as this target's\n      // cached output and, on a cache hit, restores the cached copy over the\n      // freshly-applied config — wiping the very values consumers read. Declare\n      // no outputs so Nx never treats runtime config as a cacheable artifact.\n      updateJson(\n        tree,\n        joinPathFragments(PACKAGES_DIR, SHARED_TERRAFORM_DIR, 'project.json'),\n        (projectConfig: ProjectConfiguration) => {\n          projectConfig.targets ??= {};\n          projectConfig.targets.build ??= {};\n          projectConfig.targets.build.outputs = [];\n          return projectConfig;\n        },\n      );\n\n      tree.delete(joinPathFragments(terraformLibPath, 'src', 'main.tf'));\n\n      // Create the metrics.tf file with empty initial values\n      generateFiles(\n        tree,\n        joinPathFragments(import.meta.dirname, 'files', 'terraform'),\n        terraformLibPath,\n        { ...terraformProviderVersions() },\n        {\n          overwriteStrategy: OverwriteStrategy.KeepExisting,\n        },\n      );\n\n      await formatFilesInSubtree(tree);\n    }\n  }\n}\n\nconst updateGitignore = (tree: Tree) => {\n  const gitignore = tree.exists('.gitignore')\n    ? tree.read('.gitignore', 'utf-8')\n    : '';\n  const regex = /runtime-config.json/gm;\n  const hasRuntimeConfig = regex.test(gitignore ?? '');\n  if (hasRuntimeConfig) {\n    return;\n  }\n  tree.write('.gitignore', `${gitignore}\\n\\nruntime-config.json`);\n};\n"],"names":["generateFiles","joinPathFragments","OverwriteStrategy","updateJson","terraformProjectGenerator","tsProjectGenerator","addCdkTestGlobalSetup","readAwsNxPluginConfig","addDependenciesToPackageJson","formatFilesInSubtree","esmVars","getNpmScopePrefix","getPackageManagerDisplayCommands","PACKAGES_DIR","SHARED_CONSTRUCTS_DEPENDENCIES","SHARED_CONSTRUCTS_DIR","SHARED_CONSTRUCTS_NAME","SHARED_TERRAFORM_DIR","SHARED_TERRAFORM_NAME","terraformProviderVersions","withVersions","sharedConstructsGenerator","tree","options","declaration","iac","npmScopePrefix","updateGitignore","exists","name","directory","subDirectory","delete","dirname","scopeAlias","tags","overwriteStrategy","KeepExisting","fullyQualifiedName","pkgMgrCmd","exec","Overwrite","terraformLibPath","type","projectConfig","targets","build","outputs","gitignore","read","regex","hasRuntimeConfig","test","write"],"mappings":"AAAA;;;CAGC,GACD,SACEA,aAAa,EACbC,iBAAiB,EACjBC,iBAAiB,EAGjBC,UAAU,QACL,aAAa;AACpB,OAAOC,+BAA+B,oCAAoC;AAC1E,OAAOC,wBAAwB,yBAAyB;AACxD,SAASC,qBAAqB,QAAQ,sBAAsB;AAC5D,SAASC,qBAAqB,QAAQ,oBAAoB;AAK1D,SAASC,4BAA4B,QAAQ,oBAAoB;AACjE,SAASC,oBAAoB,QAAQ,cAAc;AAEnD,SAASC,OAAO,QAAQ,qBAAqB;AAC7C,SAASC,iBAAiB,QAAQ,iBAAiB;AACnD,SAASC,gCAAgC,QAAQ,mBAAmB;AACpE,SACEC,YAAY,EACZC,8BAA8B,EAC9BC,qBAAqB,EACrBC,sBAAsB,EACtBC,oBAAoB,EACpBC,qBAAqB,QAChB,mCAAmC;AAE1C,SAASJ,8BAA8B,GAAG;AAE1C,SAASK,yBAAyB,EAAEC,YAAY,QAAQ,gBAAgB;AAMxE,OAAO,eAAeC,0BAGpBC,IAAU,EACVC,OAAyC,EACzCC,WAAsE;IAEtE,MAAM,EAAEC,GAAG,EAAE,GAAGF;IAChB,MAAMG,iBAAiBf,kBAAkBW;IACzCK,gBAAgBL;IAEhB,IAAIG,QAAQ,OAAO;QACjB,IACE,CAACH,KAAKM,MAAM,CACV3B,kBAAkBY,cAAcE,uBAAuB,kBAEzD;YACA,MAAMV,mBAAmBiB,MAAM;gBAC7BO,MAAMb;gBACNc,WAAWjB;gBACXkB,cAAchB;YAChB;YACAO,KAAKU,MAAM,CACT/B,kBAAkBY,cAAcE,uBAAuB;YAEzDf,cACEsB,MACArB,kBACE,YAAYgC,OAAO,EACnB,SACAlB,uBACA,QAEFd,kBAAkBY,cAAcE,uBAAuB,QACvD;gBACEW;gBACAQ,YAAYR;gBACZS,MAAM5B,sBAAsBe,OAAOa,QAAQ,EAAE;gBAC7C,GAAGzB,QAAQY,KAAK;YAClB,GACA;gBACEc,mBAAmBlC,kBAAkBmC,YAAY;YACnD;YAEFrC,cACEsB,MACArB,kBAAkB,YAAYgC,OAAO,EAAE,SAAS,UAAU,WAC1DhC,kBAAkBY,cAAcE,wBAChC;gBACEuB,oBAAoB,GAAGZ,iBAAiBV,wBAAwB;gBAChEa,MAAMb;gBACNuB,WAAW3B,mCAAmC4B,IAAI;YACpD,GACA;gBACEJ,mBAAmBlC,kBAAkBuC,SAAS;YAChD;YAEFjC,6BACEc,MACAF,aACEI,aAGA;gBAAC;gBAAc;aAAc,GAE/BJ,aACEI,aAGA;gBAAC;aAAc,GAEjBvB,kBACEA,kBAAkBY,cAAcE,wBAChC;YAGJ,MAAMT,sBACJgB,MACArB,kBAAkBY,cAAcE;YAElC,MAAMN,qBAAqBa;QAC7B;IACF;IAEA,4BAA4B;IAC5B,IAAIG,QAAQ,aAAa;QACvB,MAAMiB,mBAAmBzC,kBACvBY,cACAI;QAEF,IAAI,CAACK,KAAKM,MAAM,CAAC3B,kBAAkByC,kBAAkB,kBAAkB;YACrE,MAAMtC,0BAA0BkB,MAAM;gBACpCO,MAAMX;gBACNY,WAAW7B,kBAAkBY,cAAc;gBAC3C8B,MAAM;YACR;YAEA,wEAAwE;YACxE,oDAAoD;YACpD,yEAAyE;YACzE,uEAAuE;YACvE,oEAAoE;YACpE,uEAAuE;YACvE,0EAA0E;YAC1E,wEAAwE;YACxExC,WACEmB,MACArB,kBAAkBY,cAAcI,sBAAsB,iBACtD,CAAC2B;gBACCA,cAAcC,OAAO,KAAK,CAAC;gBAC3BD,cAAcC,OAAO,CAACC,KAAK,KAAK,CAAC;gBACjCF,cAAcC,OAAO,CAACC,KAAK,CAACC,OAAO,GAAG,EAAE;gBACxC,OAAOH;YACT;YAGFtB,KAAKU,MAAM,CAAC/B,kBAAkByC,kBAAkB,OAAO;YAEvD,uDAAuD;YACvD1C,cACEsB,MACArB,kBAAkB,YAAYgC,OAAO,EAAE,SAAS,cAChDS,kBACA;gBAAE,GAAGvB,2BAA2B;YAAC,GACjC;gBACEiB,mBAAmBlC,kBAAkBmC,YAAY;YACnD;YAGF,MAAM5B,qBAAqBa;QAC7B;IACF;AACF;AAEA,MAAMK,kBAAkB,CAACL;IACvB,MAAM0B,YAAY1B,KAAKM,MAAM,CAAC,gBAC1BN,KAAK2B,IAAI,CAAC,cAAc,WACxB;IACJ,MAAMC,QAAQ;IACd,MAAMC,mBAAmBD,MAAME,IAAI,CAACJ,aAAa;IACjD,IAAIG,kBAAkB;QACpB;IACF;IACA7B,KAAK+B,KAAK,CAAC,cAAc,GAAGL,UAAU,uBAAuB,CAAC;AAChE"}
+{"version":3,"sources":["../../../../../packages/nx-plugin/src/utils/shared-constructs.ts"],"sourcesContent":["/**\n * Copyright Amazon.com, Inc. or its affiliates. All Rights Reserved.\n * SPDX-License-Identifier: Apache-2.0\n */\nimport {\n  generateFiles,\n  joinPathFragments,\n  OverwriteStrategy,\n  type ProjectConfiguration,\n  type Tree,\n  updateJson,\n} from '@nx/devkit';\nimport terraformProjectGenerator from '../terraform/project/generator.js';\nimport tsProjectGenerator from '../ts/lib/generator.js';\nimport { addCdkTestGlobalSetup } from './cdk-test-setup.js';\nimport { readAwsNxPluginConfig } from './config/utils.js';\nimport type {\n  DependencyDeclaration,\n  MustDeclare,\n} from './declared-dependencies.js';\nimport { addDependenciesToPackageJson } from './dependencies.js';\nimport { formatFilesInSubtree } from './format.js';\nimport { updateGitIgnore } from './git.js';\nimport type { Iac } from './iac.js';\nimport { esmVars } from './module-format.js';\nimport { getNpmScopePrefix } from './npm-scope.js';\nimport { getPackageManagerDisplayCommands } from './pkg-manager.js';\nimport {\n  PACKAGES_DIR,\n  SHARED_CONSTRUCTS_DEPENDENCIES,\n  SHARED_CONSTRUCTS_DIR,\n  SHARED_CONSTRUCTS_NAME,\n  SHARED_TERRAFORM_DIR,\n  SHARED_TERRAFORM_NAME,\n} from './shared-constructs-constants.js';\n\nexport { SHARED_CONSTRUCTS_DEPENDENCIES };\n\nimport { terraformProviderVersions, withVersions } from './versions.js';\n\nexport interface SharedConstructsGeneratorOptions {\n  iac: Iac;\n}\n\nexport async function sharedConstructsGenerator<\n  const D extends DependencyDeclaration,\n>(\n  tree: Tree,\n  options: SharedConstructsGeneratorOptions,\n  declaration: D & MustDeclare<typeof SHARED_CONSTRUCTS_DEPENDENCIES, D>,\n) {\n  const { iac } = options;\n  const npmScopePrefix = getNpmScopePrefix(tree);\n  ignoreRuntimeConfig(tree);\n\n  if (iac === 'cdk') {\n    if (\n      !tree.exists(\n        joinPathFragments(PACKAGES_DIR, SHARED_CONSTRUCTS_DIR, 'project.json'),\n      )\n    ) {\n      await tsProjectGenerator(tree, {\n        name: SHARED_CONSTRUCTS_NAME,\n        directory: PACKAGES_DIR,\n        subDirectory: SHARED_CONSTRUCTS_DIR,\n      });\n      tree.delete(\n        joinPathFragments(PACKAGES_DIR, SHARED_CONSTRUCTS_DIR, 'src'),\n      );\n      generateFiles(\n        tree,\n        joinPathFragments(\n          import.meta.dirname,\n          'files',\n          SHARED_CONSTRUCTS_DIR,\n          'src',\n        ),\n        joinPathFragments(PACKAGES_DIR, SHARED_CONSTRUCTS_DIR, 'src'),\n        {\n          npmScopePrefix,\n          scopeAlias: npmScopePrefix,\n          tags: readAwsNxPluginConfig(tree)?.tags ?? [],\n          ...esmVars(tree),\n        },\n        {\n          overwriteStrategy: OverwriteStrategy.KeepExisting,\n        },\n      );\n      generateFiles(\n        tree,\n        joinPathFragments(import.meta.dirname, 'files', 'common', 'readme'),\n        joinPathFragments(PACKAGES_DIR, SHARED_CONSTRUCTS_DIR),\n        {\n          fullyQualifiedName: `${npmScopePrefix}${SHARED_CONSTRUCTS_NAME}`,\n          name: SHARED_CONSTRUCTS_NAME,\n          pkgMgrCmd: getPackageManagerDisplayCommands().exec,\n        },\n        {\n          overwriteStrategy: OverwriteStrategy.Overwrite,\n        },\n      );\n      addDependenciesToPackageJson(\n        tree,\n        withVersions(\n          declaration as DependencyDeclaration<\n            typeof SHARED_CONSTRUCTS_DEPENDENCIES\n          >,\n          ['constructs', 'aws-cdk-lib'],\n        ),\n        withVersions(\n          declaration as DependencyDeclaration<\n            typeof SHARED_CONSTRUCTS_DEPENDENCIES\n          >,\n          ['@types/node'],\n        ),\n        joinPathFragments(\n          joinPathFragments(PACKAGES_DIR, SHARED_CONSTRUCTS_DIR),\n          'package.json',\n        ),\n      );\n      await addCdkTestGlobalSetup(\n        tree,\n        joinPathFragments(PACKAGES_DIR, SHARED_CONSTRUCTS_DIR),\n      );\n      await formatFilesInSubtree(tree);\n    }\n  }\n\n  // Handle Terraform provider\n  if (iac === 'terraform') {\n    const terraformLibPath = joinPathFragments(\n      PACKAGES_DIR,\n      SHARED_TERRAFORM_DIR,\n    );\n    if (!tree.exists(joinPathFragments(terraformLibPath, 'project.json'))) {\n      await terraformProjectGenerator(tree, {\n        name: SHARED_TERRAFORM_NAME,\n        directory: joinPathFragments(PACKAGES_DIR, 'common'),\n        type: 'library',\n      });\n\n      // `build` is a no-op orchestration target that produces no files of its\n      // own. Terraform writes runtime-config entries into\n      // `dist/{projectRoot}/runtime-config` at apply time, and other terraform\n      // projects contribute their own entries to the same directory. Without\n      // explicit outputs, Nx infers `dist/{projectRoot}` as this target's\n      // cached output and, on a cache hit, restores the cached copy over the\n      // freshly-applied config — wiping the very values consumers read. Declare\n      // no outputs so Nx never treats runtime config as a cacheable artifact.\n      updateJson(\n        tree,\n        joinPathFragments(PACKAGES_DIR, SHARED_TERRAFORM_DIR, 'project.json'),\n        (projectConfig: ProjectConfiguration) => {\n          projectConfig.targets ??= {};\n          projectConfig.targets.build ??= {};\n          projectConfig.targets.build.outputs = [];\n          return projectConfig;\n        },\n      );\n\n      tree.delete(joinPathFragments(terraformLibPath, 'src', 'main.tf'));\n\n      // Create the metrics.tf file with empty initial values\n      generateFiles(\n        tree,\n        joinPathFragments(import.meta.dirname, 'files', 'terraform'),\n        terraformLibPath,\n        { ...terraformProviderVersions() },\n        {\n          overwriteStrategy: OverwriteStrategy.KeepExisting,\n        },\n      );\n\n      await formatFilesInSubtree(tree);\n    }\n  }\n}\n\n/**\n * Ignore the root `runtime-config.json`, unless an existing entry already\n * covers it.\n */\nexport const ignoreRuntimeConfig = (tree: Tree) => {\n  updateGitIgnore(tree, '.', (patterns) =>\n    patterns.some((p) => p.includes('runtime-config.json'))\n      ? patterns\n      : [...patterns, 'runtime-config.json'],\n  );\n};\n"],"names":["generateFiles","joinPathFragments","OverwriteStrategy","updateJson","terraformProjectGenerator","tsProjectGenerator","addCdkTestGlobalSetup","readAwsNxPluginConfig","addDependenciesToPackageJson","formatFilesInSubtree","updateGitIgnore","esmVars","getNpmScopePrefix","getPackageManagerDisplayCommands","PACKAGES_DIR","SHARED_CONSTRUCTS_DEPENDENCIES","SHARED_CONSTRUCTS_DIR","SHARED_CONSTRUCTS_NAME","SHARED_TERRAFORM_DIR","SHARED_TERRAFORM_NAME","terraformProviderVersions","withVersions","sharedConstructsGenerator","tree","options","declaration","iac","npmScopePrefix","ignoreRuntimeConfig","exists","name","directory","subDirectory","delete","dirname","scopeAlias","tags","overwriteStrategy","KeepExisting","fullyQualifiedName","pkgMgrCmd","exec","Overwrite","terraformLibPath","type","projectConfig","targets","build","outputs","patterns","some","p","includes"],"mappings":"AAAA;;;CAGC,GACD,SACEA,aAAa,EACbC,iBAAiB,EACjBC,iBAAiB,EAGjBC,UAAU,QACL,aAAa;AACpB,OAAOC,+BAA+B,oCAAoC;AAC1E,OAAOC,wBAAwB,yBAAyB;AACxD,SAASC,qBAAqB,QAAQ,sBAAsB;AAC5D,SAASC,qBAAqB,QAAQ,oBAAoB;AAK1D,SAASC,4BAA4B,QAAQ,oBAAoB;AACjE,SAASC,oBAAoB,QAAQ,cAAc;AACnD,SAASC,eAAe,QAAQ,WAAW;AAE3C,SAASC,OAAO,QAAQ,qBAAqB;AAC7C,SAASC,iBAAiB,QAAQ,iBAAiB;AACnD,SAASC,gCAAgC,QAAQ,mBAAmB;AACpE,SACEC,YAAY,EACZC,8BAA8B,EAC9BC,qBAAqB,EACrBC,sBAAsB,EACtBC,oBAAoB,EACpBC,qBAAqB,QAChB,mCAAmC;AAE1C,SAASJ,8BAA8B,GAAG;AAE1C,SAASK,yBAAyB,EAAEC,YAAY,QAAQ,gBAAgB;AAMxE,OAAO,eAAeC,0BAGpBC,IAAU,EACVC,OAAyC,EACzCC,WAAsE;IAEtE,MAAM,EAAEC,GAAG,EAAE,GAAGF;IAChB,MAAMG,iBAAiBf,kBAAkBW;IACzCK,oBAAoBL;IAEpB,IAAIG,QAAQ,OAAO;QACjB,IACE,CAACH,KAAKM,MAAM,CACV5B,kBAAkBa,cAAcE,uBAAuB,kBAEzD;YACA,MAAMX,mBAAmBkB,MAAM;gBAC7BO,MAAMb;gBACNc,WAAWjB;gBACXkB,cAAchB;YAChB;YACAO,KAAKU,MAAM,CACThC,kBAAkBa,cAAcE,uBAAuB;YAEzDhB,cACEuB,MACAtB,kBACE,YAAYiC,OAAO,EACnB,SACAlB,uBACA,QAEFf,kBAAkBa,cAAcE,uBAAuB,QACvD;gBACEW;gBACAQ,YAAYR;gBACZS,MAAM7B,sBAAsBgB,OAAOa,QAAQ,EAAE;gBAC7C,GAAGzB,QAAQY,KAAK;YAClB,GACA;gBACEc,mBAAmBnC,kBAAkBoC,YAAY;YACnD;YAEFtC,cACEuB,MACAtB,kBAAkB,YAAYiC,OAAO,EAAE,SAAS,UAAU,WAC1DjC,kBAAkBa,cAAcE,wBAChC;gBACEuB,oBAAoB,GAAGZ,iBAAiBV,wBAAwB;gBAChEa,MAAMb;gBACNuB,WAAW3B,mCAAmC4B,IAAI;YACpD,GACA;gBACEJ,mBAAmBnC,kBAAkBwC,SAAS;YAChD;YAEFlC,6BACEe,MACAF,aACEI,aAGA;gBAAC;gBAAc;aAAc,GAE/BJ,aACEI,aAGA;gBAAC;aAAc,GAEjBxB,kBACEA,kBAAkBa,cAAcE,wBAChC;YAGJ,MAAMV,sBACJiB,MACAtB,kBAAkBa,cAAcE;YAElC,MAAMP,qBAAqBc;QAC7B;IACF;IAEA,4BAA4B;IAC5B,IAAIG,QAAQ,aAAa;QACvB,MAAMiB,mBAAmB1C,kBACvBa,cACAI;QAEF,IAAI,CAACK,KAAKM,MAAM,CAAC5B,kBAAkB0C,kBAAkB,kBAAkB;YACrE,MAAMvC,0BAA0BmB,MAAM;gBACpCO,MAAMX;gBACNY,WAAW9B,kBAAkBa,cAAc;gBAC3C8B,MAAM;YACR;YAEA,wEAAwE;YACxE,oDAAoD;YACpD,yEAAyE;YACzE,uEAAuE;YACvE,oEAAoE;YACpE,uEAAuE;YACvE,0EAA0E;YAC1E,wEAAwE;YACxEzC,WACEoB,MACAtB,kBAAkBa,cAAcI,sBAAsB,iBACtD,CAAC2B;gBACCA,cAAcC,OAAO,KAAK,CAAC;gBAC3BD,cAAcC,OAAO,CAACC,KAAK,KAAK,CAAC;gBACjCF,cAAcC,OAAO,CAACC,KAAK,CAACC,OAAO,GAAG,EAAE;gBACxC,OAAOH;YACT;YAGFtB,KAAKU,MAAM,CAAChC,kBAAkB0C,kBAAkB,OAAO;YAEvD,uDAAuD;YACvD3C,cACEuB,MACAtB,kBAAkB,YAAYiC,OAAO,EAAE,SAAS,cAChDS,kBACA;gBAAE,GAAGvB,2BAA2B;YAAC,GACjC;gBACEiB,mBAAmBnC,kBAAkBoC,YAAY;YACnD;YAGF,MAAM7B,qBAAqBc;QAC7B;IACF;AACF;AAEA;;;CAGC,GACD,OAAO,MAAMK,sBAAsB,CAACL;IAClCb,gBAAgBa,MAAM,KAAK,CAAC0B,WAC1BA,SAASC,IAAI,CAAC,CAACC,IAAMA,EAAEC,QAAQ,CAAC,0BAC5BH,WACA;eAAIA;YAAU;SAAsB;AAE5C,EAAE"}

package/src/utils/version-lockstep/hold.d.ts

@@ -0,0 +1,29 @@
+/**
+ * Copyright Amazon.com, Inc. or its affiliates. All Rights Reserved.
+ * SPDX-License-Identifier: Apache-2.0
+ */
+import type { IPyDepVersion, ITerraformProviderVersion } from '../versions.js';
+import type { IVersionedDep, LockstepNote } from './lockstep.js';
+/**
+ * A pin the version update must not move, why, and what lets it move again.
+ *
+ * The npm equivalent is a `reject` entry in `.ncurc.cjs`. pip-check-updates
+ * has no exclude option and Terraform providers are resolved from the
+ * registry, so Python and Terraform pins are held here instead.
+ */
+export interface VersionHold<Name extends IVersionedDep = IVersionedDep> {
+    name: Name;
+    reason: string;
+    liftWhen: string;
+}
+/** Python pins the version update keeps at their current version. */
+export declare const PY_VERSION_HOLDS: readonly VersionHold<IPyDepVersion>[];
+/** Terraform providers the version update keeps at their current version. */
+export declare const TERRAFORM_VERSION_HOLDS: readonly VersionHold<ITerraformProviderVersion>[];
+/**
+ * Put each held pin the run proposed moving back to its current version.
+ *
+ * Mutates `proposed`, which holds versions not yet written anywhere, and
+ * returns a note for each pin it held so the reason reaches the update's PR.
+ */
+export declare const holdPinnedVersions: <Name extends IVersionedDep>(holds: readonly VersionHold<Name>[], current: Readonly<Partial<Record<Name, string>>>, proposed: Partial<Record<Name, string>>) => LockstepNote[];

package/src/utils/version-lockstep/hold.js

@@ -0,0 +1,40 @@
+/**
+ * Copyright Amazon.com, Inc. or its affiliates. All Rights Reserved.
+ * SPDX-License-Identifier: Apache-2.0
+ */ /** Python pins the version update keeps at their current version. */ export const PY_VERSION_HOLDS = [
+    {
+        name: 'ty',
+        reason: 'ty is 0.x and its releases add diagnostics that fail the vended Python templates',
+        liftWhen: 'a newer ty has been checked against all vended Python templates (run the py-client, py#dynamodb and other Python-typecheck specs with it)'
+    }
+];
+/** Terraform providers the version update keeps at their current version. */ export const TERRAFORM_VERSION_HOLDS = [
+    {
+        name: 'aws',
+        reason: 'hashicorp/aws 6.69.0 moved to aws-sdk-go-base/v2 v2.0.0-beta.75, whose bufio.Scanner response logger fails reading aws_cognito_managed_login_branding with "token too long", so the vended Cognito user identity fails apply (terraform-provider-aws#50481)',
+        liftWhen: "a hashicorp/aws release includes aws-sdk-go-base#1539 (fixes terraform-provider-aws#50481); check the provider's go.mod for aws-sdk-go-base/v2 > beta.75 or the changelog"
+    }
+];
+/**
+ * Put each held pin the run proposed moving back to its current version.
+ *
+ * Mutates `proposed`, which holds versions not yet written anywhere, and
+ * returns a note for each pin it held so the reason reaches the update's PR.
+ */ export const holdPinnedVersions = (holds, current, proposed)=>{
+    const notes = [];
+    for (const { name, reason, liftWhen } of holds){
+        const held = current[name];
+        const available = proposed[name];
+        if (held === undefined || available === undefined || available === held) {
+            continue;
+        }
+        proposed[name] = held;
+        notes.push({
+            name,
+            note: `${name} held at ${held} (${available} available): ${reason}. Lift when ${liftWhen}`
+        });
+    }
+    return notes;
+};
+
+//# sourceMappingURL=hold.js.map

package/src/utils/version-lockstep/hold.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../../../../../../packages/nx-plugin/src/utils/version-lockstep/hold.ts"],"sourcesContent":["/**\n * Copyright Amazon.com, Inc. or its affiliates. All Rights Reserved.\n * SPDX-License-Identifier: Apache-2.0\n */\nimport type { IPyDepVersion, ITerraformProviderVersion } from '../versions.js';\nimport type { IVersionedDep, LockstepNote } from './lockstep.js';\n\n/**\n * A pin the version update must not move, why, and what lets it move again.\n *\n * The npm equivalent is a `reject` entry in `.ncurc.cjs`. pip-check-updates\n * has no exclude option and Terraform providers are resolved from the\n * registry, so Python and Terraform pins are held here instead.\n */\nexport interface VersionHold<Name extends IVersionedDep = IVersionedDep> {\n  name: Name;\n  reason: string;\n  liftWhen: string;\n}\n\n/** Python pins the version update keeps at their current version. */\nexport const PY_VERSION_HOLDS: readonly VersionHold<IPyDepVersion>[] = [\n  {\n    name: 'ty',\n    reason:\n      'ty is 0.x and its releases add diagnostics that fail the vended Python templates',\n    liftWhen:\n      'a newer ty has been checked against all vended Python templates (run the py-client, py#dynamodb and other Python-typecheck specs with it)',\n  },\n];\n\n/** Terraform providers the version update keeps at their current version. */\nexport const TERRAFORM_VERSION_HOLDS: readonly VersionHold<ITerraformProviderVersion>[] =\n  [\n    {\n      name: 'aws',\n      reason:\n        'hashicorp/aws 6.69.0 moved to aws-sdk-go-base/v2 v2.0.0-beta.75, whose bufio.Scanner response logger fails reading aws_cognito_managed_login_branding with \"token too long\", so the vended Cognito user identity fails apply (terraform-provider-aws#50481)',\n      liftWhen:\n        \"a hashicorp/aws release includes aws-sdk-go-base#1539 (fixes terraform-provider-aws#50481); check the provider's go.mod for aws-sdk-go-base/v2 > beta.75 or the changelog\",\n    },\n  ];\n\n/**\n * Put each held pin the run proposed moving back to its current version.\n *\n * Mutates `proposed`, which holds versions not yet written anywhere, and\n * returns a note for each pin it held so the reason reaches the update's PR.\n */\nexport const holdPinnedVersions = <Name extends IVersionedDep>(\n  holds: readonly VersionHold<Name>[],\n  current: Readonly<Partial<Record<Name, string>>>,\n  proposed: Partial<Record<Name, string>>,\n): LockstepNote[] => {\n  const notes: LockstepNote[] = [];\n\n  for (const { name, reason, liftWhen } of holds) {\n    const held = current[name];\n    const available = proposed[name];\n    if (held === undefined || available === undefined || available === held) {\n      continue;\n    }\n    proposed[name] = held;\n    notes.push({\n      name,\n      note: `${name} held at ${held} (${available} available): ${reason}. Lift when ${liftWhen}`,\n    });\n  }\n\n  return notes;\n};\n"],"names":["PY_VERSION_HOLDS","name","reason","liftWhen","TERRAFORM_VERSION_HOLDS","holdPinnedVersions","holds","current","proposed","notes","held","available","undefined","push","note"],"mappings":"AAAA;;;CAGC,GAiBD,mEAAmE,GACnE,OAAO,MAAMA,mBAA0D;IACrE;QACEC,MAAM;QACNC,QACE;QACFC,UACE;IACJ;CACD,CAAC;AAEF,2EAA2E,GAC3E,OAAO,MAAMC,0BACX;IACE;QACEH,MAAM;QACNC,QACE;QACFC,UACE;IACJ;CACD,CAAC;AAEJ;;;;;CAKC,GACD,OAAO,MAAME,qBAAqB,CAChCC,OACAC,SACAC;IAEA,MAAMC,QAAwB,EAAE;IAEhC,KAAK,MAAM,EAAER,IAAI,EAAEC,MAAM,EAAEC,QAAQ,EAAE,IAAIG,MAAO;QAC9C,MAAMI,OAAOH,OAAO,CAACN,KAAK;QAC1B,MAAMU,YAAYH,QAAQ,CAACP,KAAK;QAChC,IAAIS,SAASE,aAAaD,cAAcC,aAAaD,cAAcD,MAAM;YACvE;QACF;QACAF,QAAQ,CAACP,KAAK,GAAGS;QACjBD,MAAMI,IAAI,CAAC;YACTZ;YACAa,MAAM,GAAGb,KAAK,SAAS,EAAES,KAAK,EAAE,EAAEC,UAAU,aAAa,EAAET,OAAO,YAAY,EAAEC,UAAU;QAC5F;IACF;IAEA,OAAOM;AACT,EAAE"}

package/src/utils/version-lockstep/lockstep.d.ts

@@ -1,6 +1,6 @@
-import type { IJavaVersion, IMiseVersion, IPyDepVersion, ITsDepVersion } from '../versions.js';
+import type { IJavaVersion, IMiseVersion, IPyDepVersion, ITerraformProviderVersion, ITsDepVersion } from '../versions.js';
 /** Any dependency a version table pins. */
-export type IVersionedDep = ITsDepVersion | IPyDepVersion | IJavaVersion | IMiseVersion;
+export type IVersionedDep = ITsDepVersion | IPyDepVersion | IJavaVersion | IMiseVersion | ITerraformProviderVersion;
 /** A pin the run deliberately did not take, and why. */
 export interface LockstepNote {
     name: IVersionedDep;

package/src/utils/version-lockstep/lockstep.js.map

@@ -1 +1 @@
-{"version":3,"sources":["../../../../../../packages/nx-plugin/src/utils/version-lockstep/lockstep.ts"],"sourcesContent":["/**\n * Copyright Amazon.com, Inc. or its affiliates. All Rights Reserved.\n * SPDX-License-Identifier: Apache-2.0\n */\nimport { coerce, compare } from 'semver';\nimport type {\n  IJavaVersion,\n  IMiseVersion,\n  IPyDepVersion,\n  ITsDepVersion,\n} from '../versions.js';\n\n/** Any dependency a version table pins. */\nexport type IVersionedDep =\n  | ITsDepVersion\n  | IPyDepVersion\n  | IJavaVersion\n  | IMiseVersion;\n\n/** A pin the run deliberately did not take, and why. */\nexport interface LockstepNote {\n  name: IVersionedDep;\n  note: string;\n}\n\n/** Proposed versions from a run, keyed by dependency name. */\nexport type ProposedVersions = Partial<Record<IVersionedDep, string>>;\n\n/**\n * Dependencies that must move as a unit. At least two, since one pin has nothing\n * to stay in step with.\n */\nexport type LockstepGroup = readonly [\n  IVersionedDep,\n  IVersionedDep,\n  ...IVersionedDep[],\n];\n\n/** The bare version in a pin, whatever range syntax it was written with. */\nconst bare = (version: string): string | undefined =>\n  coerce(version, { includePrerelease: true })?.version;\n\n/** The range prefix a pin was written with, so it is preserved. */\nconst prefixOf = (version: string, bareVersion: string): string =>\n  version.slice(0, version.indexOf(bareVersion));\n\n/**\n * Hold every member of each group at the lowest version proposed across it, so a\n * group only moves once all of its members can.\n *\n * Mutates the tables, which hold proposed versions not yet written anywhere.\n * Groups the run proposed fewer than two comparable versions for are left alone.\n */\nexport const holdGroupsInLockstep = (\n  groups: readonly LockstepGroup[],\n  ...tables: readonly ProposedVersions[]\n): LockstepNote[] => {\n  const notes: LockstepNote[] = [];\n\n  for (const group of groups) {\n    const members = group.flatMap((name) => {\n      const table = tables.find((candidate) => candidate[name] !== undefined);\n      const proposed = table?.[name];\n      const version = proposed && bare(proposed);\n      return table && proposed && version\n        ? [{ name, table, proposed, version }]\n        : [];\n    });\n    if (members.length < 2) continue;\n\n    const lowest = members\n      .map(({ version }) => version)\n      .reduce((min, version) => (compare(version, min) < 0 ? version : min));\n\n    for (const { name, table, proposed, version } of members) {\n      if (version === lowest) continue;\n      const held = `${prefixOf(proposed, version)}${lowest}`;\n      table[name] = held;\n      notes.push({\n        name,\n        note: `${name} held at ${held} (${proposed} available): must move in step with ${group\n          .filter((other) => other !== name)\n          .join(', ')}`,\n      });\n    }\n  }\n\n  return notes;\n};\n"],"names":["coerce","compare","bare","version","includePrerelease","prefixOf","bareVersion","slice","indexOf","holdGroupsInLockstep","groups","tables","notes","group","members","flatMap","name","table","find","candidate","undefined","proposed","length","lowest","map","reduce","min","held","push","note","filter","other","join"],"mappings":"AAAA;;;CAGC,GACD,SAASA,MAAM,EAAEC,OAAO,QAAQ,SAAS;AAkCzC,0EAA0E,GAC1E,MAAMC,OAAO,CAACC,UACZH,OAAOG,SAAS;QAAEC,mBAAmB;IAAK,IAAID;AAEhD,iEAAiE,GACjE,MAAME,WAAW,CAACF,SAAiBG,cACjCH,QAAQI,KAAK,CAAC,GAAGJ,QAAQK,OAAO,CAACF;AAEnC;;;;;;CAMC,GACD,OAAO,MAAMG,uBAAuB,CAClCC,QACA,GAAGC;IAEH,MAAMC,QAAwB,EAAE;IAEhC,KAAK,MAAMC,SAASH,OAAQ;QAC1B,MAAMI,UAAUD,MAAME,OAAO,CAAC,CAACC;YAC7B,MAAMC,QAAQN,OAAOO,IAAI,CAAC,CAACC,YAAcA,SAAS,CAACH,KAAK,KAAKI;YAC7D,MAAMC,WAAWJ,OAAO,CAACD,KAAK;YAC9B,MAAMb,UAAUkB,YAAYnB,KAAKmB;YACjC,OAAOJ,SAASI,YAAYlB,UACxB;gBAAC;oBAAEa;oBAAMC;oBAAOI;oBAAUlB;gBAAQ;aAAE,GACpC,EAAE;QACR;QACA,IAAIW,QAAQQ,MAAM,GAAG,GAAG;QAExB,MAAMC,SAAST,QACZU,GAAG,CAAC,CAAC,EAAErB,OAAO,EAAE,GAAKA,SACrBsB,MAAM,CAAC,CAACC,KAAKvB,UAAaF,QAAQE,SAASuB,OAAO,IAAIvB,UAAUuB;QAEnE,KAAK,MAAM,EAAEV,IAAI,EAAEC,KAAK,EAAEI,QAAQ,EAAElB,OAAO,EAAE,IAAIW,QAAS;YACxD,IAAIX,YAAYoB,QAAQ;YACxB,MAAMI,OAAO,GAAGtB,SAASgB,UAAUlB,WAAWoB,QAAQ;YACtDN,KAAK,CAACD,KAAK,GAAGW;YACdf,MAAMgB,IAAI,CAAC;gBACTZ;gBACAa,MAAM,GAAGb,KAAK,SAAS,EAAEW,KAAK,EAAE,EAAEN,SAAS,oCAAoC,EAAER,MAC9EiB,MAAM,CAAC,CAACC,QAAUA,UAAUf,MAC5BgB,IAAI,CAAC,OAAO;YACjB;QACF;IACF;IAEA,OAAOpB;AACT,EAAE"}
+{"version":3,"sources":["../../../../../../packages/nx-plugin/src/utils/version-lockstep/lockstep.ts"],"sourcesContent":["/**\n * Copyright Amazon.com, Inc. or its affiliates. All Rights Reserved.\n * SPDX-License-Identifier: Apache-2.0\n */\nimport { coerce, compare } from 'semver';\nimport type {\n  IJavaVersion,\n  IMiseVersion,\n  IPyDepVersion,\n  ITerraformProviderVersion,\n  ITsDepVersion,\n} from '../versions.js';\n\n/** Any dependency a version table pins. */\nexport type IVersionedDep =\n  | ITsDepVersion\n  | IPyDepVersion\n  | IJavaVersion\n  | IMiseVersion\n  | ITerraformProviderVersion;\n\n/** A pin the run deliberately did not take, and why. */\nexport interface LockstepNote {\n  name: IVersionedDep;\n  note: string;\n}\n\n/** Proposed versions from a run, keyed by dependency name. */\nexport type ProposedVersions = Partial<Record<IVersionedDep, string>>;\n\n/**\n * Dependencies that must move as a unit. At least two, since one pin has nothing\n * to stay in step with.\n */\nexport type LockstepGroup = readonly [\n  IVersionedDep,\n  IVersionedDep,\n  ...IVersionedDep[],\n];\n\n/** The bare version in a pin, whatever range syntax it was written with. */\nconst bare = (version: string): string | undefined =>\n  coerce(version, { includePrerelease: true })?.version;\n\n/** The range prefix a pin was written with, so it is preserved. */\nconst prefixOf = (version: string, bareVersion: string): string =>\n  version.slice(0, version.indexOf(bareVersion));\n\n/**\n * Hold every member of each group at the lowest version proposed across it, so a\n * group only moves once all of its members can.\n *\n * Mutates the tables, which hold proposed versions not yet written anywhere.\n * Groups the run proposed fewer than two comparable versions for are left alone.\n */\nexport const holdGroupsInLockstep = (\n  groups: readonly LockstepGroup[],\n  ...tables: readonly ProposedVersions[]\n): LockstepNote[] => {\n  const notes: LockstepNote[] = [];\n\n  for (const group of groups) {\n    const members = group.flatMap((name) => {\n      const table = tables.find((candidate) => candidate[name] !== undefined);\n      const proposed = table?.[name];\n      const version = proposed && bare(proposed);\n      return table && proposed && version\n        ? [{ name, table, proposed, version }]\n        : [];\n    });\n    if (members.length < 2) continue;\n\n    const lowest = members\n      .map(({ version }) => version)\n      .reduce((min, version) => (compare(version, min) < 0 ? version : min));\n\n    for (const { name, table, proposed, version } of members) {\n      if (version === lowest) continue;\n      const held = `${prefixOf(proposed, version)}${lowest}`;\n      table[name] = held;\n      notes.push({\n        name,\n        note: `${name} held at ${held} (${proposed} available): must move in step with ${group\n          .filter((other) => other !== name)\n          .join(', ')}`,\n      });\n    }\n  }\n\n  return notes;\n};\n"],"names":["coerce","compare","bare","version","includePrerelease","prefixOf","bareVersion","slice","indexOf","holdGroupsInLockstep","groups","tables","notes","group","members","flatMap","name","table","find","candidate","undefined","proposed","length","lowest","map","reduce","min","held","push","note","filter","other","join"],"mappings":"AAAA;;;CAGC,GACD,SAASA,MAAM,EAAEC,OAAO,QAAQ,SAAS;AAoCzC,0EAA0E,GAC1E,MAAMC,OAAO,CAACC,UACZH,OAAOG,SAAS;QAAEC,mBAAmB;IAAK,IAAID;AAEhD,iEAAiE,GACjE,MAAME,WAAW,CAACF,SAAiBG,cACjCH,QAAQI,KAAK,CAAC,GAAGJ,QAAQK,OAAO,CAACF;AAEnC;;;;;;CAMC,GACD,OAAO,MAAMG,uBAAuB,CAClCC,QACA,GAAGC;IAEH,MAAMC,QAAwB,EAAE;IAEhC,KAAK,MAAMC,SAASH,OAAQ;QAC1B,MAAMI,UAAUD,MAAME,OAAO,CAAC,CAACC;YAC7B,MAAMC,QAAQN,OAAOO,IAAI,CAAC,CAACC,YAAcA,SAAS,CAACH,KAAK,KAAKI;YAC7D,MAAMC,WAAWJ,OAAO,CAACD,KAAK;YAC9B,MAAMb,UAAUkB,YAAYnB,KAAKmB;YACjC,OAAOJ,SAASI,YAAYlB,UACxB;gBAAC;oBAAEa;oBAAMC;oBAAOI;oBAAUlB;gBAAQ;aAAE,GACpC,EAAE;QACR;QACA,IAAIW,QAAQQ,MAAM,GAAG,GAAG;QAExB,MAAMC,SAAST,QACZU,GAAG,CAAC,CAAC,EAAErB,OAAO,EAAE,GAAKA,SACrBsB,MAAM,CAAC,CAACC,KAAKvB,UAAaF,QAAQE,SAASuB,OAAO,IAAIvB,UAAUuB;QAEnE,KAAK,MAAM,EAAEV,IAAI,EAAEC,KAAK,EAAEI,QAAQ,EAAElB,OAAO,EAAE,IAAIW,QAAS;YACxD,IAAIX,YAAYoB,QAAQ;YACxB,MAAMI,OAAO,GAAGtB,SAASgB,UAAUlB,WAAWoB,QAAQ;YACtDN,KAAK,CAACD,KAAK,GAAGW;YACdf,MAAMgB,IAAI,CAAC;gBACTZ;gBACAa,MAAM,GAAGb,KAAK,SAAS,EAAEW,KAAK,EAAE,EAAEN,SAAS,oCAAoC,EAAER,MAC9EiB,MAAM,CAAC,CAACC,QAAUA,UAAUf,MAC5BgB,IAAI,CAAC,OAAO;YACjB;QACF;IACF;IAEA,OAAOpB;AACT,EAAE"}

package/src/utils/versions.d.ts

@@ -9,46 +9,47 @@ import { type DeclaredPy, type DeclaredTs, type DependencyDeclaration } from './
 export declare const TS_VERSIONS: {
     readonly '@a2a-js/sdk': "0.3.14";
     readonly '@aws/aws-distro-opentelemetry-node-autoinstrumentation': "0.13.0";
-    readonly '@opentelemetry/propagator-jaeger': "2.11.0";
+    readonly '@opentelemetry/propagator-jaeger': "2.12.0";
     readonly minimatch: "10.2.6";
     readonly 'deepmerge-ts': "8.0.2";
-    readonly mysql2: "3.24.5";
-    readonly '@aws-sdk/client-dynamodb': "3.1146.0";
-    readonly '@aws-sdk/client-api-gateway': "3.1146.0";
-    readonly '@aws-sdk/client-iam': "3.1146.0";
-    readonly '@aws-sdk/client-bedrock-agentcore': "3.1146.0";
-    readonly '@aws-sdk/client-bedrock-runtime': "3.1146.0";
-    readonly '@aws-sdk/client-s3': "3.1146.0";
-    readonly '@aws-sdk/client-sts': "3.1146.0";
-    readonly '@aws-sdk/client-cognito-identity-provider': "3.1146.0";
-    readonly '@aws-sdk/credential-providers': "3.1146.0";
-    readonly '@aws-sdk/credential-provider-cognito-identity': "3.972.71";
-    readonly '@aws-sdk/client-secrets-manager': "3.1146.0";
-    readonly '@aws-sdk/rds-signer': "3.1146.0";
-    readonly '@smithy/server-apigateway': "0.3.3";
-    readonly '@smithy/server-node': "0.3.3";
-    readonly '@aws-lambda-powertools/logger': "2.35.0";
-    readonly '@aws-lambda-powertools/metrics': "2.35.0";
-    readonly '@aws-lambda-powertools/parameters': "2.35.0";
-    readonly '@aws-lambda-powertools/tracer': "2.35.0";
-    readonly '@aws-lambda-powertools/parser': "2.35.0";
-    readonly '@aws-sdk/client-appconfigdata': "3.1146.0";
+    readonly mysql2: "3.24.6";
+    readonly '@aws-sdk/client-dynamodb': "3.1151.0";
+    readonly '@aws-sdk/client-api-gateway': "3.1151.0";
+    readonly '@aws-sdk/client-iam': "3.1151.0";
+    readonly '@aws-sdk/client-bedrock-agentcore': "3.1151.0";
+    readonly '@aws-sdk/client-bedrock-runtime': "3.1151.0";
+    readonly '@aws-sdk/client-s3': "3.1151.0";
+    readonly '@aws-sdk/client-sts': "3.1151.0";
+    readonly '@aws-sdk/client-cognito-identity-provider': "3.1151.0";
+    readonly '@aws-sdk/credential-providers': "3.1151.0";
+    readonly '@aws-sdk/credential-provider-cognito-identity': "3.972.73";
+    readonly '@aws-sdk/client-secrets-manager': "3.1151.0";
+    readonly '@aws-sdk/rds-signer': "3.1151.0";
+    readonly '@smithy/server-apigateway': "0.3.4";
+    readonly '@smithy/server-node': "0.3.4";
+    readonly '@aws-lambda-powertools/logger': "2.36.0";
+    readonly '@aws-lambda-powertools/metrics': "2.36.0";
+    readonly '@aws-lambda-powertools/parameters': "2.36.0";
+    readonly '@aws-lambda-powertools/tracer': "2.36.0";
+    readonly '@aws-lambda-powertools/parser': "2.36.0";
+    readonly '@aws-sdk/client-appconfigdata': "3.1151.0";
     readonly '@middy/core': "7.9.2";
     readonly '@nxlv/python': "23.2.1";
     readonly '@nx-extend/terraform': "10.4.1";
-    readonly nx: "23.2.1";
-    readonly '@nx/devkit': "23.2.1";
-    readonly '@nx/js': "23.2.1";
-    readonly '@nx/react': "23.2.1";
-    readonly '@nx/vite': "23.2.1";
-    readonly '@nx/vitest': "23.2.1";
-    readonly '@nx/workspace': "23.2.1";
-    readonly 'create-nx-workspace': "23.2.1";
+    readonly nx: "23.3.0";
+    readonly '@nx/devkit': "23.3.0";
+    readonly '@nx/js': "23.3.0";
+    readonly '@nx/react': "23.3.0";
+    readonly '@nx/vite': "23.3.0";
+    readonly '@nx/vitest': "23.3.0";
+    readonly '@nx/workspace': "23.3.0";
+    readonly 'create-nx-workspace': "23.3.0";
     readonly '@swc-node/register': "1.12.1";
-    readonly '@swc/core': "1.16.13";
-    readonly '@modelcontextprotocol/sdk': "1.32.0";
-    readonly '@modelcontextprotocol/inspector': "2.9.0";
-    readonly '@ag-ui/a2ui-toolkit': "0.0.4";
+    readonly '@swc/core': "1.16.18";
+    readonly '@modelcontextprotocol/sdk': "1.32.1";
+    readonly '@modelcontextprotocol/client': "2.3.1";
+    readonly '@modelcontextprotocol/inspector': "2.10.1";
+    readonly '@ag-ui/a2ui-toolkit': "0.0.5";
     readonly '@ag-ui/aws-strands': "0.3.0";
     readonly '@ag-ui/client': "0.0.59";
     readonly '@ag-ui/core': "0.0.59";
@@ -56,22 +57,22 @@ export declare const TS_VERSIONS: {
     readonly 'agent-chat-cli': "0.3.0";
     readonly '@copilotkit/react-core': "1.74.0";
     readonly rxjs: "7.8.2";
-    readonly '@strands-agents/sdk': "1.19.0";
-    readonly '@tanstack/react-router': "1.170.41";
-    readonly '@tanstack/router-plugin': "1.168.42";
-    readonly '@tanstack/router-generator': "1.167.40";
+    readonly '@strands-agents/sdk': "1.20.0";
+    readonly '@tanstack/react-router': "1.170.44";
+    readonly '@tanstack/router-plugin': "1.168.45";
+    readonly '@tanstack/router-generator': "1.167.43";
     readonly '@tanstack/virtual-file-routes': "1.162.0";
     readonly '@tanstack/router-utils': "1.162.3";
-    readonly '@cloudscape-design/board-components': "3.0.236";
-    readonly '@cloudscape-design/chat-components': "1.0.177";
-    readonly '@cloudscape-design/components': "3.0.1391";
+    readonly '@cloudscape-design/board-components': "3.0.238";
+    readonly '@cloudscape-design/chat-components': "1.0.179";
+    readonly '@cloudscape-design/components': "3.0.1400";
     readonly '@cloudscape-design/global-styles': "1.0.71";
-    readonly '@tanstack/react-query': "5.104.1";
-    readonly '@tanstack/react-query-devtools': "5.104.1";
+    readonly '@tanstack/react-query': "5.104.2";
+    readonly '@tanstack/react-query-devtools': "5.104.2";
     readonly '@trpc/tanstack-react-query': "11.19.0";
     readonly '@trpc/client': "11.19.0";
     readonly '@trpc/server': "11.19.0";
-    readonly '@types/node': "26.6.4";
+    readonly '@types/node': "26.6.5";
     readonly '@types/aws-lambda': "8.10.164";
     readonly '@types/cors': "2.8.19";
     readonly '@types/pg': "8.23.1";
@@ -84,12 +85,12 @@ export declare const TS_VERSIONS: {
     readonly '@vitest/coverage-v8': "4.1.11";
     readonly '@vitest/ui': "4.1.11";
     readonly '@astrojs/react': "6.0.6";
-    readonly '@astrojs/starlight': "0.42.5";
-    readonly astro: "7.3.5";
+    readonly '@astrojs/starlight': "0.42.6";
+    readonly astro: "7.3.8";
     readonly cookie: "2.0.1";
     readonly aws4fetch: "1.0.20";
-    readonly 'aws-cdk': "2.1144.0";
-    readonly 'aws-cdk-lib': "2.272.0";
+    readonly 'aws-cdk': "2.1145.0";
+    readonly 'aws-cdk-lib': "2.273.0";
     readonly 'aws-xray-sdk-core': "3.12.0";
     readonly constructs: "10.8.1";
     readonly cors: "2.8.6";
@@ -107,39 +108,39 @@ export declare const TS_VERSIONS: {
     readonly '@prisma/client': "7.10.0";
     readonly ejs: "6.0.1";
     readonly '@types/ejs': "3.1.5";
-    readonly express: "5.2.1";
+    readonly express: "5.3.0";
     readonly 'fast-glob': "3.3.3";
     readonly husky: "9.1.7";
     readonly 'fs-extra': "11.4.1";
     readonly '@types/fs-extra': "11.0.4";
     readonly mariadb: "3.5.4";
-    readonly mise: "2026.10.1";
+    readonly mise: "2026.10.9";
     readonly npm: "12.2.0";
-    readonly 'npm-check-updates': "23.1.0";
+    readonly 'npm-check-updates': "23.1.1";
     readonly 'oidc-client-ts': "3.5.0";
     readonly pg: "8.23.1";
     readonly prisma: "7.10.0";
     readonly 'react-oidc-context': "3.3.1";
     readonly react: "19.3.0";
     readonly 'react-dom': "19.3.0";
-    readonly rolldown: "1.2.12";
-    readonly 'rolldown-plugin-dts': "0.28.6";
+    readonly rolldown: "1.2.13";
+    readonly 'rolldown-plugin-dts': "0.28.8";
     readonly shx: "0.4.0";
     readonly 'simple-git': "4.0.2";
     readonly 'source-map-support': "0.5.21";
-    readonly 'starlight-blog': "0.30.0";
+    readonly 'starlight-blog': "0.30.1";
     readonly tailwindcss: "4.3.3";
     readonly '@tailwindcss/vite': "4.3.3";
     readonly tsx: "4.23.15";
-    readonly 'lucide-react': "1.51.0";
-    readonly 'radix-ui': "1.6.7";
-    readonly shadcn: "4.21.1";
+    readonly 'lucide-react': "1.56.0";
+    readonly 'radix-ui': "1.8.1";
+    readonly shadcn: "4.21.4";
     readonly 'tw-animate-css': "1.4.0";
-    readonly vite: "8.3.2";
+    readonly vite: "8.3.4";
     readonly typescript: "6.0.3";
     readonly vitest: "4.1.11";
     readonly jsdom: "29.1.1";
-    readonly zod: "4.6.5";
+    readonly zod: "4.6.7";
     readonly ws: "8.22.0";
 };
 export type ITsDepVersion = keyof typeof TS_VERSIONS;
@@ -170,13 +171,13 @@ export declare const NX_PACKAGES: readonly ["nx", "@nx/devkit", "@nx/js", "@nx/r
  * The nx version the plugin is built against, and the single source of truth
  * for every place a workspace's nx is pinned.
  */
-export declare const NX_VERSION: "23.2.1";
+export declare const NX_VERSION: "23.3.0";
 /**
  * Versions for Python dependencies added by generators
  */
 export declare const PY_VERSIONS: {
     readonly 'a2a-sdk': "==0.3.26";
-    readonly 'ag-ui-langgraph': "==0.0.46";
+    readonly 'ag-ui-langgraph': "==0.0.47";
     readonly 'ag-ui-protocol': "==0.1.22";
     readonly 'ag-ui-strands': "==0.4.1";
     readonly aiosqlite: "==0.22.1";
@@ -184,33 +185,33 @@ export declare const PY_VERSIONS: {
     readonly 'aws-lambda-powertools[tracer]': "==3.35.0";
     readonly 'aws-lambda-powertools[parser]': "==3.35.0";
     readonly 'aws-opentelemetry-distro': "==0.21.0";
-    readonly 'bedrock-agentcore': "==1.24.0";
-    readonly boto3: "==1.43.108";
-    readonly checkov: "==3.3.22";
-    readonly fastapi: "==0.142.2";
-    readonly 'fastapi[standard]': "==0.142.2";
+    readonly 'bedrock-agentcore': "==1.24.1";
+    readonly boto3: "==1.43.113";
+    readonly checkov: "==3.3.29";
+    readonly fastapi: "==0.143.1";
+    readonly 'fastapi[standard]': "==0.143.1";
     readonly httpx: "==0.28.1";
-    readonly langchain: "==1.4.3";
-    readonly 'langchain-aws': "==1.8.0";
+    readonly langchain: "==1.4.6";
+    readonly 'langchain-aws': "==1.8.2";
     readonly 'langchain-mcp-adapters': "==0.3.2";
-    readonly langgraph: "==1.2.12";
-    readonly 'langgraph-checkpoint-aws': "==1.2.4";
-    readonly 'langgraph-checkpoint-sqlite': "==3.1.1";
+    readonly langgraph: "==1.2.15";
+    readonly 'langgraph-checkpoint-aws': "==1.2.5";
+    readonly 'langgraph-checkpoint-sqlite': "==3.1.2";
     readonly mcp: "==1.28.1";
     readonly 'pip-check-updates': "==0.29.0";
     readonly 'pip-licenses': "==5.5.5";
-    readonly pydantic: "==2.13.5";
-    readonly ruff: "==0.16.10";
-    readonly 'strands-agents': "==1.57.2";
-    readonly 'strands-agents[a2a]': "==1.57.2";
+    readonly pydantic: "==2.14.1";
+    readonly ruff: "==0.17.0";
+    readonly 'strands-agents': "==1.60.0";
+    readonly 'strands-agents[a2a]': "==1.60.0";
     readonly 'strands-agents-tools': "==0.8.9";
-    readonly ty: "==0.0.86";
+    readonly ty: "==0.0.87";
     readonly pynamodb: "==6.1.0";
     readonly uvicorn: "==0.54.0";
-    readonly sqlmodel: "==0.0.47";
+    readonly sqlmodel: "==0.0.48";
     readonly alembic: "==1.20.0";
     readonly aiomysql: "==0.3.2";
-    readonly asyncpg: "==0.31.0";
+    readonly asyncpg: "==0.32.0";
     readonly greenlet: "==3.5.6";
 };
 export type IPyDepVersion = keyof typeof PY_VERSIONS;
@@ -363,7 +364,7 @@ export declare const terraformLambdaRuntimeVars: () => {
  * Pinned exactly (no range operator) so generated infrastructure is reproducible.
  */
 export declare const TERRAFORM_VERSIONS: {
-    readonly aws: "6.67.0";
+    readonly aws: "6.68.0";
     readonly random: "3.9.1";
     readonly null: "3.3.2";
     readonly archive: "2.8.1";
@@ -377,7 +378,7 @@ export type ITerraformProviderVersion = keyof typeof TERRAFORM_VERSIONS;
  * generated `.tf` templates (e.g. `version = "<%- awsProviderVersion %>"`)
  */
 export declare const terraformProviderVersions: () => {
-    awsProviderVersion: "6.67.0";
+    awsProviderVersion: "6.68.0";
     randomProviderVersion: "3.9.1";
     nullProviderVersion: "3.3.2";
     archiveProviderVersion: "2.8.1";