@aws/nx-plugin 1.0.9 → 1.0.11

package/src/utils/versions.js

@@ -9,7 +9,7 @@
     '@aws/aws-distro-opentelemetry-node-autoinstrumentation': '0.13.0',
     // Pinned above the version the ADOT autoinstrumentation package resolves
     // transitively (2.8.0) to clear CVE-2026-59892 (HIGH).
-    '@opentelemetry/propagator-jaeger': '2.11.0',
+    '@opentelemetry/propagator-jaeger': '2.12.0',
     // Overridden in the vended agent/MCP image builds to clear CVE-2026-14257
     // (HIGH) in brace-expansion: minimatch 10 is the lowest major depending on
     // brace-expansion 5.x, the only line Trivy's `< 5.0.8` advisory range treats
@@ -21,67 +21,68 @@
     // CVE-2026-40345 fix (HIGH) and mysql2 below the GHSA-3f6p-5ww8-9rcr fix
     // (HIGH). Neither is imported by the handler, which drives the schema engine.
     'deepmerge-ts': '8.0.2',
-    mysql2: '3.24.5',
-    '@aws-sdk/client-dynamodb': '3.1146.0',
-    '@aws-sdk/client-api-gateway': '3.1146.0',
-    '@aws-sdk/client-iam': '3.1146.0',
-    '@aws-sdk/client-bedrock-agentcore': '3.1146.0',
-    '@aws-sdk/client-bedrock-runtime': '3.1146.0',
-    '@aws-sdk/client-s3': '3.1146.0',
-    '@aws-sdk/client-sts': '3.1146.0',
-    '@aws-sdk/client-cognito-identity-provider': '3.1146.0',
-    '@aws-sdk/credential-providers': '3.1146.0',
-    '@aws-sdk/credential-provider-cognito-identity': '3.972.71',
-    '@aws-sdk/client-secrets-manager': '3.1146.0',
-    '@aws-sdk/rds-signer': '3.1146.0',
-    '@smithy/server-apigateway': '0.3.3',
-    '@smithy/server-node': '0.3.3',
-    '@aws-lambda-powertools/logger': '2.35.0',
-    '@aws-lambda-powertools/metrics': '2.35.0',
-    '@aws-lambda-powertools/parameters': '2.35.0',
-    '@aws-lambda-powertools/tracer': '2.35.0',
-    '@aws-lambda-powertools/parser': '2.35.0',
-    '@aws-sdk/client-appconfigdata': '3.1146.0',
+    mysql2: '3.24.6',
+    '@aws-sdk/client-dynamodb': '3.1151.0',
+    '@aws-sdk/client-api-gateway': '3.1151.0',
+    '@aws-sdk/client-iam': '3.1151.0',
+    '@aws-sdk/client-bedrock-agentcore': '3.1151.0',
+    '@aws-sdk/client-bedrock-runtime': '3.1151.0',
+    '@aws-sdk/client-s3': '3.1151.0',
+    '@aws-sdk/client-sts': '3.1151.0',
+    '@aws-sdk/client-cognito-identity-provider': '3.1151.0',
+    '@aws-sdk/credential-providers': '3.1151.0',
+    '@aws-sdk/credential-provider-cognito-identity': '3.972.73',
+    '@aws-sdk/client-secrets-manager': '3.1151.0',
+    '@aws-sdk/rds-signer': '3.1151.0',
+    '@smithy/server-apigateway': '0.3.4',
+    '@smithy/server-node': '0.3.4',
+    '@aws-lambda-powertools/logger': '2.36.0',
+    '@aws-lambda-powertools/metrics': '2.36.0',
+    '@aws-lambda-powertools/parameters': '2.36.0',
+    '@aws-lambda-powertools/tracer': '2.36.0',
+    '@aws-lambda-powertools/parser': '2.36.0',
+    '@aws-sdk/client-appconfigdata': '3.1151.0',
     '@middy/core': '7.9.2',
     '@nxlv/python': '23.2.1',
     '@nx-extend/terraform': '10.4.1',
     // These must all hold the same version — see NX_PACKAGES.
-    nx: '23.2.1',
-    '@nx/devkit': '23.2.1',
-    '@nx/js': '23.2.1',
-    '@nx/react': '23.2.1',
-    '@nx/vite': '23.2.1',
-    '@nx/vitest': '23.2.1',
-    '@nx/workspace': '23.2.1',
-    'create-nx-workspace': '23.2.1',
+    nx: '23.3.0',
+    '@nx/devkit': '23.3.0',
+    '@nx/js': '23.3.0',
+    '@nx/react': '23.3.0',
+    '@nx/vite': '23.3.0',
+    '@nx/vitest': '23.3.0',
+    '@nx/workspace': '23.3.0',
+    'create-nx-workspace': '23.3.0',
     '@swc-node/register': '1.12.1',
-    '@swc/core': '1.16.13',
-    '@modelcontextprotocol/sdk': '1.32.0',
-    '@modelcontextprotocol/inspector': '2.9.0',
-    '@ag-ui/a2ui-toolkit': '0.0.4',
-    '@ag-ui/aws-strands': '0.3.0',
-    '@ag-ui/client': '0.0.59',
-    '@ag-ui/core': '0.0.59',
-    '@ag-ui/encoder': '0.0.59',
+    '@swc/core': '1.16.18',
+    '@modelcontextprotocol/sdk': '1.32.1',
+    '@modelcontextprotocol/client': '2.3.1',
+    '@modelcontextprotocol/inspector': '2.10.1',
+    '@ag-ui/a2ui-toolkit': '0.0.5',
+    '@ag-ui/aws-strands': '1.0.0',
+    '@ag-ui/client': '1.0.2',
+    '@ag-ui/core': '1.0.2',
+    '@ag-ui/encoder': '1.0.2',
     'agent-chat-cli': '0.3.0',
-    '@copilotkit/react-core': '1.74.0',
+    '@copilotkit/react-core': '1.79.0',
     rxjs: '7.8.2',
-    '@strands-agents/sdk': '1.19.0',
-    '@tanstack/react-router': '1.170.41',
-    '@tanstack/router-plugin': '1.168.42',
-    '@tanstack/router-generator': '1.167.40',
+    '@strands-agents/sdk': '1.20.0',
+    '@tanstack/react-router': '1.170.44',
+    '@tanstack/router-plugin': '1.168.45',
+    '@tanstack/router-generator': '1.167.43',
     '@tanstack/virtual-file-routes': '1.162.0',
     '@tanstack/router-utils': '1.162.3',
-    '@cloudscape-design/board-components': '3.0.236',
-    '@cloudscape-design/chat-components': '1.0.177',
-    '@cloudscape-design/components': '3.0.1391',
+    '@cloudscape-design/board-components': '3.0.238',
+    '@cloudscape-design/chat-components': '1.0.179',
+    '@cloudscape-design/components': '3.0.1400',
     '@cloudscape-design/global-styles': '1.0.71',
-    '@tanstack/react-query': '5.104.1',
-    '@tanstack/react-query-devtools': '5.104.1',
+    '@tanstack/react-query': '5.104.2',
+    '@tanstack/react-query-devtools': '5.104.2',
     '@trpc/tanstack-react-query': '11.19.0',
     '@trpc/client': '11.19.0',
     '@trpc/server': '11.19.0',
-    '@types/node': '26.6.4',
+    '@types/node': '26.6.5',
     '@types/aws-lambda': '8.10.164',
     '@types/cors': '2.8.19',
     '@types/pg': '8.23.1',
@@ -94,12 +95,12 @@
     '@vitest/coverage-v8': '4.1.11',
     '@vitest/ui': '4.1.11',
     '@astrojs/react': '6.0.6',
-    '@astrojs/starlight': '0.42.5',
-    astro: '7.3.5',
+    '@astrojs/starlight': '0.42.6',
+    astro: '7.3.8',
     cookie: '2.0.1',
     aws4fetch: '1.0.20',
-    'aws-cdk': '2.1144.0',
-    'aws-cdk-lib': '2.272.0',
+    'aws-cdk': '2.1145.0',
+    'aws-cdk-lib': '2.273.0',
     'aws-xray-sdk-core': '3.12.0',
     constructs: '10.8.1',
     cors: '2.8.6',
@@ -117,40 +118,40 @@
     '@prisma/client': '7.10.0',
     ejs: '6.0.1',
     '@types/ejs': '3.1.5',
-    express: '5.2.1',
+    express: '5.3.0',
     'fast-glob': '3.3.3',
     husky: '9.1.7',
     'fs-extra': '11.4.1',
     '@types/fs-extra': '11.0.4',
     mariadb: '3.5.4',
-    mise: '2026.10.1',
+    mise: '2026.10.9',
     npm: '12.2.0',
-    'npm-check-updates': '23.1.0',
+    'npm-check-updates': '23.1.1',
     'oidc-client-ts': '3.5.0',
     pg: '8.23.1',
     prisma: '7.10.0',
     'react-oidc-context': '3.3.1',
     react: '19.3.0',
     'react-dom': '19.3.0',
-    rolldown: '1.2.12',
-    'rolldown-plugin-dts': '0.28.6',
+    rolldown: '1.2.13',
+    'rolldown-plugin-dts': '0.28.8',
     shx: '0.4.0',
     'simple-git': '4.0.2',
     'source-map-support': '0.5.21',
-    'starlight-blog': '0.30.0',
+    'starlight-blog': '0.30.1',
     tailwindcss: '4.3.3',
     '@tailwindcss/vite': '4.3.3',
     tsx: '4.23.15',
-    'lucide-react': '1.51.0',
-    'radix-ui': '1.6.7',
-    shadcn: '4.21.1',
+    'lucide-react': '1.56.0',
+    'radix-ui': '1.8.1',
+    shadcn: '4.21.4',
     'tw-animate-css': '1.4.0',
-    vite: '8.3.2',
+    vite: '8.3.4',
     typescript: '6.0.3',
     vitest: '4.1.11',
     // The `testEnvironment` @nx/vitest writes into every generated config.
     jsdom: '29.1.1',
-    zod: '4.6.5',
+    zod: '4.6.7',
     ws: '8.22.0'
 };
 /**
@@ -176,6 +177,28 @@
         'ruff'
     ]
 ];
+/**
+ * Pins the version update sets to the exact `dependencies` of another vended
+ * package, as published for the version of it being written. Followers' lockstep
+ * group mates move with them. If a peer's published `peerDependencies` reject the
+ * result, or a manifest can't be read, all of these pins stay where they are.
+ *
+ * Use this rather than a lockstep group when the packages don't share a version
+ * line.
+ */ export const EXACT_DEPENDENCY_PINS = [
+    {
+        source: '@copilotkit/react-core',
+        followers: [
+            '@ag-ui/client',
+            '@ag-ui/core'
+        ],
+        peers: [
+            '@ag-ui/aws-strands',
+            '@ag-ui/a2ui-toolkit'
+        ],
+        reason: 'a second @ag-ui/client copy fails every generated website with TS2322'
+    }
+];
 /**
  * Add versions to the given dependencies, which the declaration must own.
  *
@@ -211,7 +234,7 @@
  * Versions for Python dependencies added by generators
  */ export const PY_VERSIONS = {
     'a2a-sdk': '==0.3.26',
-    'ag-ui-langgraph': '==0.0.46',
+    'ag-ui-langgraph': '==0.0.47',
     'ag-ui-protocol': '==0.1.22',
     'ag-ui-strands': '==0.4.1',
     aiosqlite: '==0.22.1',
@@ -219,33 +242,33 @@
     'aws-lambda-powertools[tracer]': '==3.35.0',
     'aws-lambda-powertools[parser]': '==3.35.0',
     'aws-opentelemetry-distro': '==0.21.0',
-    'bedrock-agentcore': '==1.24.0',
-    boto3: '==1.43.108',
-    checkov: '==3.3.22',
-    fastapi: '==0.142.2',
-    'fastapi[standard]': '==0.142.2',
+    'bedrock-agentcore': '==1.24.1',
+    boto3: '==1.43.113',
+    checkov: '==3.3.29',
+    fastapi: '==0.143.1',
+    'fastapi[standard]': '==0.143.1',
     httpx: '==0.28.1',
-    langchain: '==1.4.3',
-    'langchain-aws': '==1.8.0',
+    langchain: '==1.4.6',
+    'langchain-aws': '==1.8.2',
     'langchain-mcp-adapters': '==0.3.2',
-    langgraph: '==1.2.12',
-    'langgraph-checkpoint-aws': '==1.2.4',
-    'langgraph-checkpoint-sqlite': '==3.1.1',
+    langgraph: '==1.2.15',
+    'langgraph-checkpoint-aws': '==1.2.5',
+    'langgraph-checkpoint-sqlite': '==3.1.2',
     mcp: '==1.28.1',
     'pip-check-updates': '==0.29.0',
     'pip-licenses': '==5.5.5',
-    pydantic: '==2.13.5',
-    ruff: '==0.16.10',
-    'strands-agents': '==1.57.2',
-    'strands-agents[a2a]': '==1.57.2',
+    pydantic: '==2.14.1',
+    ruff: '==0.17.0',
+    'strands-agents': '==1.60.0',
+    'strands-agents[a2a]': '==1.60.0',
     'strands-agents-tools': '==0.8.9',
     ty: '==0.0.87',
     pynamodb: '==6.1.0',
     uvicorn: '==0.54.0',
-    sqlmodel: '==0.0.47',
+    sqlmodel: '==0.0.48',
     alembic: '==1.20.0',
     aiomysql: '==0.3.2',
-    asyncpg: '==0.31.0',
+    asyncpg: '==0.32.0',
     // Pinned explicitly: SQLAlchemy's async engine pulls greenlet transitively,
     // and leaving it unpinned lets uv resolve to a just-released version whose
     // platform wheels may not all be published yet (breaking aarch64 installs).
@@ -386,7 +409,7 @@
  * Exact versions for Terraform providers used by generated `.tf` modules.
  * Pinned exactly (no range operator) so generated infrastructure is reproducible.
  */ export const TERRAFORM_VERSIONS = {
-    aws: '6.67.0',
+    aws: '6.68.0',
     random: '3.9.1',
     null: '3.3.2',
     archive: '2.8.1',

package/src/utils/versions.js.map

@@ -1 +1 @@
-{"version":3,"sources":["../../../../../packages/nx-plugin/src/utils/versions.ts"],"sourcesContent":["/**\n * Copyright Amazon.com, Inc. or its affiliates. All Rights Reserved.\n * SPDX-License-Identifier: Apache-2.0\n */\nimport {\n  type DeclaredPy,\n  type DeclaredTs,\n  type DependencyDeclaration,\n  declaredNames,\n} from './declared-dependencies.js';\n\n/**\n * Versons for TypeScript dependencies added by generators\n */\nexport const TS_VERSIONS = {\n  '@a2a-js/sdk': '0.3.14',\n  '@aws/aws-distro-opentelemetry-node-autoinstrumentation': '0.13.0',\n  // Pinned above the version the ADOT autoinstrumentation package resolves\n  // transitively (2.8.0) to clear CVE-2026-59892 (HIGH).\n  '@opentelemetry/propagator-jaeger': '2.11.0',\n  // Overridden in the vended agent/MCP image builds to clear CVE-2026-14257\n  // (HIGH) in brace-expansion: minimatch 10 is the lowest major depending on\n  // brace-expansion 5.x, the only line Trivy's `< 5.0.8` advisory range treats\n  // as fixed. Overriding brace-expansion directly is not viable — 5.x drops the\n  // CommonJS default export that minimatch 9 calls.\n  minimatch: '10.2.6',\n  // Both overridden in the vended RDB migration image build, which installs the\n  // prisma CLI to run migrations: its own ranges resolve deepmerge-ts below the\n  // CVE-2026-40345 fix (HIGH) and mysql2 below the GHSA-3f6p-5ww8-9rcr fix\n  // (HIGH). Neither is imported by the handler, which drives the schema engine.\n  'deepmerge-ts': '8.0.2',\n  mysql2: '3.24.5',\n  '@aws-sdk/client-dynamodb': '3.1146.0',\n  '@aws-sdk/client-api-gateway': '3.1146.0',\n  '@aws-sdk/client-iam': '3.1146.0',\n  '@aws-sdk/client-bedrock-agentcore': '3.1146.0',\n  '@aws-sdk/client-bedrock-runtime': '3.1146.0',\n  '@aws-sdk/client-s3': '3.1146.0',\n  '@aws-sdk/client-sts': '3.1146.0',\n  '@aws-sdk/client-cognito-identity-provider': '3.1146.0',\n  '@aws-sdk/credential-providers': '3.1146.0',\n  '@aws-sdk/credential-provider-cognito-identity': '3.972.71',\n  '@aws-sdk/client-secrets-manager': '3.1146.0',\n  '@aws-sdk/rds-signer': '3.1146.0',\n  '@smithy/server-apigateway': '0.3.3',\n  '@smithy/server-node': '0.3.3',\n  '@aws-lambda-powertools/logger': '2.35.0',\n  '@aws-lambda-powertools/metrics': '2.35.0',\n  '@aws-lambda-powertools/parameters': '2.35.0',\n  '@aws-lambda-powertools/tracer': '2.35.0',\n  '@aws-lambda-powertools/parser': '2.35.0',\n  '@aws-sdk/client-appconfigdata': '3.1146.0',\n  '@middy/core': '7.9.2',\n  '@nxlv/python': '23.2.1',\n  '@nx-extend/terraform': '10.4.1',\n  // These must all hold the same version — see NX_PACKAGES.\n  nx: '23.2.1',\n  '@nx/devkit': '23.2.1',\n  '@nx/js': '23.2.1',\n  '@nx/react': '23.2.1',\n  '@nx/vite': '23.2.1',\n  '@nx/vitest': '23.2.1',\n  '@nx/workspace': '23.2.1',\n  'create-nx-workspace': '23.2.1',\n  '@swc-node/register': '1.12.1',\n  '@swc/core': '1.16.13',\n  '@modelcontextprotocol/sdk': '1.32.0',\n  '@modelcontextprotocol/inspector': '2.9.0',\n  '@ag-ui/a2ui-toolkit': '0.0.4',\n  '@ag-ui/aws-strands': '0.3.0',\n  '@ag-ui/client': '0.0.59',\n  '@ag-ui/core': '0.0.59',\n  '@ag-ui/encoder': '0.0.59',\n  'agent-chat-cli': '0.3.0',\n  '@copilotkit/react-core': '1.74.0',\n  rxjs: '7.8.2',\n  '@strands-agents/sdk': '1.19.0',\n  '@tanstack/react-router': '1.170.41',\n  '@tanstack/router-plugin': '1.168.42',\n  '@tanstack/router-generator': '1.167.40',\n  '@tanstack/virtual-file-routes': '1.162.0',\n  '@tanstack/router-utils': '1.162.3',\n  '@cloudscape-design/board-components': '3.0.236',\n  '@cloudscape-design/chat-components': '1.0.177',\n  '@cloudscape-design/components': '3.0.1391',\n  '@cloudscape-design/global-styles': '1.0.71',\n  '@tanstack/react-query': '5.104.1',\n  '@tanstack/react-query-devtools': '5.104.1',\n  '@trpc/tanstack-react-query': '11.19.0',\n  '@trpc/client': '11.19.0',\n  '@trpc/server': '11.19.0',\n  '@types/node': '26.6.4',\n  '@types/aws-lambda': '8.10.164',\n  '@types/cors': '2.8.19',\n  '@types/pg': '8.23.1',\n  '@types/ws': '8.18.2',\n  '@types/express': '5.0.6',\n  '@smithy/config-resolver': '4.7.2',\n  '@smithy/node-config-provider': '4.6.2',\n  '@smithy/node-http-handler': '4.12.1',\n  '@smithy/types': '4.19.0',\n  '@vitest/coverage-v8': '4.1.11',\n  '@vitest/ui': '4.1.11',\n  '@astrojs/react': '6.0.6',\n  '@astrojs/starlight': '0.42.5',\n  astro: '7.3.5',\n  cookie: '2.0.1',\n  aws4fetch: '1.0.20',\n  'aws-cdk': '2.1144.0',\n  'aws-cdk-lib': '2.272.0',\n  'aws-xray-sdk-core': '3.12.0',\n  constructs: '10.8.1',\n  cors: '2.8.6',\n  chalk: '6.0.1',\n  'class-variance-authority': '0.7.1',\n  cn: '0.4.0',\n  commander: '15.0.0',\n  electrodb: '3.9.3',\n  esbuild: '0.28.2',\n  'event-source-polyfill': '1.0.31',\n  '@types/event-source-polyfill': '1.0.5',\n  '@biomejs/biome': '2.5.15',\n  '@prisma/adapter-mariadb': '7.10.0',\n  '@prisma/adapter-pg': '7.10.0',\n  '@prisma/client': '7.10.0',\n  ejs: '6.0.1',\n  '@types/ejs': '3.1.5',\n  express: '5.2.1',\n  'fast-glob': '3.3.3',\n  husky: '9.1.7',\n  'fs-extra': '11.4.1',\n  '@types/fs-extra': '11.0.4',\n  mariadb: '3.5.4',\n  mise: '2026.10.1',\n  npm: '12.2.0',\n  'npm-check-updates': '23.1.0',\n  'oidc-client-ts': '3.5.0',\n  pg: '8.23.1',\n  prisma: '7.10.0',\n  'react-oidc-context': '3.3.1',\n  react: '19.3.0',\n  'react-dom': '19.3.0',\n  rolldown: '1.2.12',\n  'rolldown-plugin-dts': '0.28.6',\n  shx: '0.4.0',\n  'simple-git': '4.0.2',\n  'source-map-support': '0.5.21',\n  'starlight-blog': '0.30.0',\n  tailwindcss: '4.3.3',\n  '@tailwindcss/vite': '4.3.3',\n  tsx: '4.23.15',\n  'lucide-react': '1.51.0',\n  'radix-ui': '1.6.7',\n  shadcn: '4.21.1',\n  'tw-animate-css': '1.4.0',\n  vite: '8.3.2',\n  typescript: '6.0.3',\n  vitest: '4.1.11',\n  // The `testEnvironment` @nx/vitest writes into every generated config.\n  jsdom: '29.1.1',\n  zod: '4.6.5',\n  ws: '8.22.0',\n} as const;\nexport type ITsDepVersion = keyof typeof TS_VERSIONS;\n\n/**\n * Dependencies that must move as a unit, held at the lowest version proposed\n * across each group by the version update. Members must share a version line.\n *\n * The wasm formatter bindings are dependencies of this repo rather than vended\n * pins, so they are named here but versioned in the manifests.\n */\nexport const LOCKSTEP_GROUPS = [\n  // A duplicate `@ag-ui/client` fails every generated website with TS2322.\n  ['@ag-ui/client', '@ag-ui/core', '@ag-ui/encoder'],\n  // The wasm bindings format generated files; the CLI checks them.\n  ['@biomejs/wasm-nodejs', '@biomejs/biome'],\n  ['@astral-sh/ruff-wasm-nodejs', 'ruff'],\n] as const satisfies readonly (readonly [string, string, ...string[]])[];\n\n/**\n * Add versions to the given dependencies, which the declaration must own.\n *\n * @param declaration the calling generator's `DEPENDENCIES`\n */\nexport const withVersions = <D extends DependencyDeclaration>(\n  declaration: D,\n  deps: readonly DeclaredTs<D>[],\n): Record<string, string> => {\n  assertDeclared(declaration.ts, deps, 'ts');\n  return Object.fromEntries(\n    deps.map((dep) => [dep, TS_VERSIONS[dep as ITsDepVersion]]),\n  );\n};\n\n/**\n * The `nx` and `@nx/*` packages a generated workspace pins, all of which must\n * hold the same version: a workspace nx even a patch apart hoists a second\n * nested nx, and the two deadlock `nx sync`.\n *\n * Bumping them in a user's workspace requires `packageJsonUpdates` rather than a\n * migration — see `version-upgrade-migration/nx-package-updates.ts`.\n */\nexport const NX_PACKAGES = [\n  'nx',\n  '@nx/devkit',\n  '@nx/js',\n  '@nx/react',\n  '@nx/vite',\n  '@nx/vitest',\n  '@nx/workspace',\n] as const satisfies readonly ITsDepVersion[];\n\n/**\n * The nx version the plugin is built against, and the single source of truth\n * for every place a workspace's nx is pinned.\n */\nexport const NX_VERSION = TS_VERSIONS.nx;\n\n/**\n * Versions for Python dependencies added by generators\n */\nexport const PY_VERSIONS = {\n  'a2a-sdk': '==0.3.26',\n  'ag-ui-langgraph': '==0.0.46',\n  'ag-ui-protocol': '==0.1.22',\n  'ag-ui-strands': '==0.4.1',\n  aiosqlite: '==0.22.1',\n  'aws-lambda-powertools': '==3.35.0',\n  'aws-lambda-powertools[tracer]': '==3.35.0',\n  'aws-lambda-powertools[parser]': '==3.35.0',\n  'aws-opentelemetry-distro': '==0.21.0',\n  'bedrock-agentcore': '==1.24.0',\n  boto3: '==1.43.108',\n  checkov: '==3.3.22',\n  fastapi: '==0.142.2',\n  'fastapi[standard]': '==0.142.2',\n  httpx: '==0.28.1',\n  langchain: '==1.4.3',\n  'langchain-aws': '==1.8.0',\n  'langchain-mcp-adapters': '==0.3.2',\n  langgraph: '==1.2.12',\n  'langgraph-checkpoint-aws': '==1.2.4',\n  'langgraph-checkpoint-sqlite': '==3.1.1',\n  mcp: '==1.28.1',\n  'pip-check-updates': '==0.29.0',\n  'pip-licenses': '==5.5.5',\n  pydantic: '==2.13.5',\n  ruff: '==0.16.10',\n  'strands-agents': '==1.57.2',\n  'strands-agents[a2a]': '==1.57.2',\n  'strands-agents-tools': '==0.8.9',\n  ty: '==0.0.87',\n  pynamodb: '==6.1.0',\n  uvicorn: '==0.54.0',\n  sqlmodel: '==0.0.47',\n  alembic: '==1.20.0',\n  aiomysql: '==0.3.2',\n  asyncpg: '==0.31.0',\n  // Pinned explicitly: SQLAlchemy's async engine pulls greenlet transitively,\n  // and leaving it unpinned lets uv resolve to a just-released version whose\n  // platform wheels may not all be published yet (breaking aarch64 installs).\n  greenlet: '==3.5.6',\n} as const;\nexport type IPyDepVersion = keyof typeof PY_VERSIONS;\n\n/**\n * Add versions to the given dependencies\n */\nexport const withPyVersions = <D extends DependencyDeclaration>(\n  declaration: D,\n  deps: readonly DeclaredPy<D>[],\n): string[] => {\n  assertDeclared(declaration.py, deps, 'py');\n  return deps.map((dep) => `${dep}${PY_VERSIONS[dep as IPyDepVersion]}`);\n};\n\n/** Catches undeclared packages that reach here past the type checker. */\nconst assertDeclared = (\n  declared: readonly { readonly name: string }[],\n  deps: readonly unknown[],\n  kind: 'ts' | 'py',\n): void => {\n  const names = declaredNames(declared);\n  const undeclared = deps.filter((dep) => !names.includes(dep as string));\n  if (undeclared.length > 0) {\n    throw new Error(\n      `Undeclared ${kind} dependencies: ${undeclared.join(', ')}. Add them to the generator's declareDependencies({ ${kind}: [...] }).`,\n    );\n  }\n};\n\n/**\n * Versions for vendored tools\n */\nexport const VENDORED_VERSIONS = {\n  'git-secrets': '1.3.0',\n} as const;\n\n/**\n * Versions of Java dependencies added by generators, keyed by Maven coordinate.\n *\n * Every entry is resolved from Maven Central by the version update and named\n * `<group>:<artifact>:<version>` where a generator writes it.\n */\nexport const JAVA_VERSIONS = {\n  'software.amazon.smithy:smithy-model': '1.74.0',\n  'software.amazon.smithy:smithy-aws-traits': '1.74.0',\n  'software.amazon.smithy:smithy-validation-model': '1.74.0',\n  'software.amazon.smithy:smithy-openapi': '1.74.0',\n  'software.amazon.smithy.typescript:smithy-aws-typescript-codegen': '0.54.0',\n} as const;\nexport type IJavaVersion = keyof typeof JAVA_VERSIONS;\n\n/** The Maven coordinates the version update resolves, in declaration order. */\nexport const JAVA_ARTIFACTS = Object.keys(JAVA_VERSIONS) as IJavaVersion[];\n\n/** A Maven coordinate as a dependency names it: `<group>:<artifact>:<version>`. */\nexport const javaMavenDependency = (artifact: IJavaVersion): string =>\n  `${artifact}:${JAVA_VERSIONS[artifact]}`;\n\n/**\n * Versions of tools resolved by mise, keyed by the tool name mise knows.\n *\n * Every entry is checked with `mise latest <tool>` by the version update. Nothing\n * is installed into the workspace: the pin travels in the `project.json` target\n * command, which is what the version sync reaches to move it forward.\n */\nexport const MISE_VERSIONS = {\n  smithy: '1.74.0',\n} as const;\nexport type IMiseVersion = keyof typeof MISE_VERSIONS;\n\n/** The tools the version update resolves through mise, in declaration order. */\nexport const MISE_TOOLS = Object.keys(MISE_VERSIONS) as IMiseVersion[];\n\n/**\n * Base container images used by generated Dockerfiles. Pinned exactly so\n * generated images are reproducible, and chosen to be free of known\n * HIGH/CRITICAL vulnerabilities at time of generation.\n */\nexport const BASE_IMAGES = {\n  node: 'public.ecr.aws/docker/library/node:lts-slim',\n  python: 'public.ecr.aws/docker/library/python:3.14-slim',\n} as const;\n\n/**\n * Versions for container tooling used by generated image build/scan targets.\n * Pinned exactly so generated images are reproducible.\n */\nexport const CONTAINER_VERSIONS = {\n  // ECR-hosted Trivy image used to scan built images during the build.\n  trivy: '0.72.0',\n} as const;\n\n/**\n * Repository each pinned tool image is pulled from, keyed as\n * {@link CONTAINER_VERSIONS}. Kept beside the versions so a tool added here is\n * one entry rather than a reference built somewhere else, which is also what\n * lets the version sync find these pins wherever a target command runs them.\n */\nexport const CONTAINER_REPOSITORIES = {\n  trivy: 'public.ecr.aws/aquasecurity/trivy',\n} as const satisfies Record<keyof typeof CONTAINER_VERSIONS, string>;\n\n/** The pinned reference for a tool image, as a target command runs it. */\nexport const containerImage = (tool: keyof typeof CONTAINER_VERSIONS): string =>\n  `${CONTAINER_REPOSITORIES[tool]}:${CONTAINER_VERSIONS[tool]}`;\n\n/**\n * The managed Lambda runtimes generated infrastructure targets, as the single\n * source both IaC providers derive from.\n *\n * CDK and Terraform name the same runtime differently — `Runtime.NODEJS_24_X`\n * against `nodejs24.x` — so deriving both from the version here keeps a bump one\n * edit that moves them together. Resolved by the version update workflow.\n */\nexport const LAMBDA_RUNTIME_VERSIONS = {\n  node: '24',\n  python: '3.14',\n} as const;\nexport type ILambdaRuntime = keyof typeof LAMBDA_RUNTIME_VERSIONS;\n\n/**\n * The managed AgentCore Runtime runtimes generated infrastructure targets, for\n * agents and MCP servers packaged as code rather than as a container image.\n *\n * Tracked separately from {@link LAMBDA_RUNTIME_VERSIONS}: AgentCore publishes\n * its own, smaller set, so a Lambda bump would otherwise move these to a runtime\n * AgentCore rejects at create time. Resolved by the version update workflow from\n * the `AgentCoreRuntime` members `aws-cdk-lib` publishes, the same source the\n * Lambda runtimes come from.\n */\nexport const AGENT_CORE_RUNTIME_VERSIONS = {\n  node: '22',\n  python: '3.14',\n} as const;\nexport type IAgentCoreRuntime = keyof typeof AGENT_CORE_RUNTIME_VERSIONS;\n\n/**\n * The runtime as AgentCore's `runtime` field names it, e.g. `NODE_22` or\n * `PYTHON_3_14`.\n */\nexport const agentCoreRuntime = (runtime: IAgentCoreRuntime): string =>\n  runtime === 'node'\n    ? `NODE_${AGENT_CORE_RUNTIME_VERSIONS.node}`\n    : `PYTHON_${AGENT_CORE_RUNTIME_VERSIONS.python.replace('.', '_')}`;\n\n/**\n * The interpreter uv pins for a generated Python project, as the Lambda runtime's\n * `major.minor`.\n *\n * No patch: uv reads this as a request for any patch of that minor, so it resolves\n * whichever one the platform has a build for. Naming an exact patch pins one that\n * may not exist everywhere, and Lambda patches the interpreter itself, so the minor\n * is the whole of what a project needs to agree on.\n */\nexport const pyenvPythonVersion = (): string => LAMBDA_RUNTIME_VERSIONS.python;\n\n/**\n * The `[project].requires-python` specifier for a generated Python project.\n *\n * A lower bound on the Lambda runtime's `major.minor`: the deployed interpreter\n * is that version, and Ruff derives its `target-version` from this (`py314`), so\n * lint targets the same version the function runs on.\n */\nexport const pyprojectPythonDependency = (): string =>\n  `>=${LAMBDA_RUNTIME_VERSIONS.python}`;\n\n/** The runtime as Terraform's `runtime` attribute names it, e.g. `nodejs24.x`. */\nexport const terraformLambdaRuntime = (runtime: ILambdaRuntime): string =>\n  runtime === 'node'\n    ? `nodejs${LAMBDA_RUNTIME_VERSIONS.node}.x`\n    : `python${LAMBDA_RUNTIME_VERSIONS.python}`;\n\n/**\n * The runtime as an `aws-cdk-lib` `Runtime` member, e.g. `Runtime.NODEJS_24_X`.\n * Always an explicitly versioned member, never a `_LATEST` alias.\n */\nexport const cdkLambdaRuntime = (runtime: ILambdaRuntime): string =>\n  runtime === 'node'\n    ? `Runtime.NODEJS_${LAMBDA_RUNTIME_VERSIONS.node}_X`\n    : `Runtime.PYTHON_${LAMBDA_RUNTIME_VERSIONS.python.replace('.', '_')}`;\n\n/**\n * Substitution variables exposing the pinned runtimes to generated CDK\n * templates (e.g. `runtime: <%- nodeRuntime %>`). Paired with\n * {@link terraformLambdaRuntimeVars}, which names the same variables so a\n * template reads alike under either provider.\n */\nexport const cdkLambdaRuntimeVars = () => ({\n  nodeRuntime: cdkLambdaRuntime('node'),\n  pythonRuntime: cdkLambdaRuntime('python'),\n});\n\n/**\n * Substitution variables exposing the pinned runtimes to generated `.tf`\n * templates (e.g. `runtime = \"<%- nodeRuntime %>\"`).\n */\nexport const terraformLambdaRuntimeVars = () => ({\n  nodeRuntime: terraformLambdaRuntime('node'),\n  pythonRuntime: terraformLambdaRuntime('python'),\n});\n\n/**\n * Exact versions for Terraform providers used by generated `.tf` modules.\n * Pinned exactly (no range operator) so generated infrastructure is reproducible.\n */\nexport const TERRAFORM_VERSIONS = {\n  aws: '6.67.0',\n  random: '3.9.1',\n  null: '3.3.2',\n  archive: '2.8.1',\n  external: '2.4.2',\n  local: '2.9.1',\n  time: '0.14.2',\n} as const;\nexport type ITerraformProviderVersion = keyof typeof TERRAFORM_VERSIONS;\n\n/**\n * Substitution variables exposing Terraform provider version constraints to\n * generated `.tf` templates (e.g. `version = \"<%- awsProviderVersion %>\"`)\n */\nexport const terraformProviderVersions = () => ({\n  awsProviderVersion: TERRAFORM_VERSIONS.aws,\n  randomProviderVersion: TERRAFORM_VERSIONS.random,\n  nullProviderVersion: TERRAFORM_VERSIONS.null,\n  archiveProviderVersion: TERRAFORM_VERSIONS.archive,\n  externalProviderVersion: TERRAFORM_VERSIONS.external,\n  localProviderVersion: TERRAFORM_VERSIONS.local,\n  timeProviderVersion: TERRAFORM_VERSIONS.time,\n});\n"],"names":["declaredNames","TS_VERSIONS","minimatch","mysql2","nx","rxjs","astro","cookie","aws4fetch","constructs","cors","chalk","cn","commander","electrodb","esbuild","ejs","express","husky","mariadb","mise","npm","pg","prisma","react","rolldown","shx","tailwindcss","tsx","shadcn","vite","typescript","vitest","jsdom","zod","ws","LOCKSTEP_GROUPS","withVersions","declaration","deps","assertDeclared","ts","Object","fromEntries","map","dep","NX_PACKAGES","NX_VERSION","PY_VERSIONS","aiosqlite","boto3","checkov","fastapi","httpx","langchain","langgraph","mcp","pydantic","ruff","ty","pynamodb","uvicorn","sqlmodel","alembic","aiomysql","asyncpg","greenlet","withPyVersions","py","declared","kind","names","undeclared","filter","includes","length","Error","join","VENDORED_VERSIONS","JAVA_VERSIONS","JAVA_ARTIFACTS","keys","javaMavenDependency","artifact","MISE_VERSIONS","smithy","MISE_TOOLS","BASE_IMAGES","node","python","CONTAINER_VERSIONS","trivy","CONTAINER_REPOSITORIES","containerImage","tool","LAMBDA_RUNTIME_VERSIONS","AGENT_CORE_RUNTIME_VERSIONS","agentCoreRuntime","runtime","replace","pyenvPythonVersion","pyprojectPythonDependency","terraformLambdaRuntime","cdkLambdaRuntime","cdkLambdaRuntimeVars","nodeRuntime","pythonRuntime","terraformLambdaRuntimeVars","TERRAFORM_VERSIONS","aws","random","null","archive","external","local","time","terraformProviderVersions","awsProviderVersion","randomProviderVersion","nullProviderVersion","archiveProviderVersion","externalProviderVersion","localProviderVersion","timeProviderVersion"],"mappings":"AAAA;;;CAGC,GACD,SAIEA,aAAa,QACR,6BAA6B;AAEpC;;CAEC,GACD,OAAO,MAAMC,cAAc;IACzB,eAAe;IACf,0DAA0D;IAC1D,yEAAyE;IACzE,uDAAuD;IACvD,oCAAoC;IACpC,0EAA0E;IAC1E,2EAA2E;IAC3E,6EAA6E;IAC7E,8EAA8E;IAC9E,kDAAkD;IAClDC,WAAW;IACX,8EAA8E;IAC9E,8EAA8E;IAC9E,yEAAyE;IACzE,8EAA8E;IAC9E,gBAAgB;IAChBC,QAAQ;IACR,4BAA4B;IAC5B,+BAA+B;IAC/B,uBAAuB;IACvB,qCAAqC;IACrC,mCAAmC;IACnC,sBAAsB;IACtB,uBAAuB;IACvB,6CAA6C;IAC7C,iCAAiC;IACjC,iDAAiD;IACjD,mCAAmC;IACnC,uBAAuB;IACvB,6BAA6B;IAC7B,uBAAuB;IACvB,iCAAiC;IACjC,kCAAkC;IAClC,qCAAqC;IACrC,iCAAiC;IACjC,iCAAiC;IACjC,iCAAiC;IACjC,eAAe;IACf,gBAAgB;IAChB,wBAAwB;IACxB,0DAA0D;IAC1DC,IAAI;IACJ,cAAc;IACd,UAAU;IACV,aAAa;IACb,YAAY;IACZ,cAAc;IACd,iBAAiB;IACjB,uBAAuB;IACvB,sBAAsB;IACtB,aAAa;IACb,6BAA6B;IAC7B,mCAAmC;IACnC,uBAAuB;IACvB,sBAAsB;IACtB,iBAAiB;IACjB,eAAe;IACf,kBAAkB;IAClB,kBAAkB;IAClB,0BAA0B;IAC1BC,MAAM;IACN,uBAAuB;IACvB,0BAA0B;IAC1B,2BAA2B;IAC3B,8BAA8B;IAC9B,iCAAiC;IACjC,0BAA0B;IAC1B,uCAAuC;IACvC,sCAAsC;IACtC,iCAAiC;IACjC,oCAAoC;IACpC,yBAAyB;IACzB,kCAAkC;IAClC,8BAA8B;IAC9B,gBAAgB;IAChB,gBAAgB;IAChB,eAAe;IACf,qBAAqB;IACrB,eAAe;IACf,aAAa;IACb,aAAa;IACb,kBAAkB;IAClB,2BAA2B;IAC3B,gCAAgC;IAChC,6BAA6B;IAC7B,iBAAiB;IACjB,uBAAuB;IACvB,cAAc;IACd,kBAAkB;IAClB,sBAAsB;IACtBC,OAAO;IACPC,QAAQ;IACRC,WAAW;IACX,WAAW;IACX,eAAe;IACf,qBAAqB;IACrBC,YAAY;IACZC,MAAM;IACNC,OAAO;IACP,4BAA4B;IAC5BC,IAAI;IACJC,WAAW;IACXC,WAAW;IACXC,SAAS;IACT,yBAAyB;IACzB,gCAAgC;IAChC,kBAAkB;IAClB,2BAA2B;IAC3B,sBAAsB;IACtB,kBAAkB;IAClBC,KAAK;IACL,cAAc;IACdC,SAAS;IACT,aAAa;IACbC,OAAO;IACP,YAAY;IACZ,mBAAmB;IACnBC,SAAS;IACTC,MAAM;IACNC,KAAK;IACL,qBAAqB;IACrB,kBAAkB;IAClBC,IAAI;IACJC,QAAQ;IACR,sBAAsB;IACtBC,OAAO;IACP,aAAa;IACbC,UAAU;IACV,uBAAuB;IACvBC,KAAK;IACL,cAAc;IACd,sBAAsB;IACtB,kBAAkB;IAClBC,aAAa;IACb,qBAAqB;IACrBC,KAAK;IACL,gBAAgB;IAChB,YAAY;IACZC,QAAQ;IACR,kBAAkB;IAClBC,MAAM;IACNC,YAAY;IACZC,QAAQ;IACR,uEAAuE;IACvEC,OAAO;IACPC,KAAK;IACLC,IAAI;AACN,EAAW;AAGX;;;;;;CAMC,GACD,OAAO,MAAMC,kBAAkB;IAC7B,yEAAyE;IACzE;QAAC;QAAiB;QAAe;KAAiB;IAClD,iEAAiE;IACjE;QAAC;QAAwB;KAAiB;IAC1C;QAAC;QAA+B;KAAO;CACxC,CAAwE;AAEzE;;;;CAIC,GACD,OAAO,MAAMC,eAAe,CAC1BC,aACAC;IAEAC,eAAeF,YAAYG,EAAE,EAAEF,MAAM;IACrC,OAAOG,OAAOC,WAAW,CACvBJ,KAAKK,GAAG,CAAC,CAACC,MAAQ;YAACA;YAAK5C,WAAW,CAAC4C,IAAqB;SAAC;AAE9D,EAAE;AAEF;;;;;;;CAOC,GACD,OAAO,MAAMC,cAAc;IACzB;IACA;IACA;IACA;IACA;IACA;IACA;CACD,CAA6C;AAE9C;;;CAGC,GACD,OAAO,MAAMC,aAAa9C,YAAYG,EAAE,CAAC;AAEzC;;CAEC,GACD,OAAO,MAAM4C,cAAc;IACzB,WAAW;IACX,mBAAmB;IACnB,kBAAkB;IAClB,iBAAiB;IACjBC,WAAW;IACX,yBAAyB;IACzB,iCAAiC;IACjC,iCAAiC;IACjC,4BAA4B;IAC5B,qBAAqB;IACrBC,OAAO;IACPC,SAAS;IACTC,SAAS;IACT,qBAAqB;IACrBC,OAAO;IACPC,WAAW;IACX,iBAAiB;IACjB,0BAA0B;IAC1BC,WAAW;IACX,4BAA4B;IAC5B,+BAA+B;IAC/BC,KAAK;IACL,qBAAqB;IACrB,gBAAgB;IAChBC,UAAU;IACVC,MAAM;IACN,kBAAkB;IAClB,uBAAuB;IACvB,wBAAwB;IACxBC,IAAI;IACJC,UAAU;IACVC,SAAS;IACTC,UAAU;IACVC,SAAS;IACTC,UAAU;IACVC,SAAS;IACT,4EAA4E;IAC5E,2EAA2E;IAC3E,4EAA4E;IAC5EC,UAAU;AACZ,EAAW;AAGX;;CAEC,GACD,OAAO,MAAMC,iBAAiB,CAC5B7B,aACAC;IAEAC,eAAeF,YAAY8B,EAAE,EAAE7B,MAAM;IACrC,OAAOA,KAAKK,GAAG,CAAC,CAACC,MAAQ,GAAGA,MAAMG,WAAW,CAACH,IAAqB,EAAE;AACvE,EAAE;AAEF,uEAAuE,GACvE,MAAML,iBAAiB,CACrB6B,UACA9B,MACA+B;IAEA,MAAMC,QAAQvE,cAAcqE;IAC5B,MAAMG,aAAajC,KAAKkC,MAAM,CAAC,CAAC5B,MAAQ,CAAC0B,MAAMG,QAAQ,CAAC7B;IACxD,IAAI2B,WAAWG,MAAM,GAAG,GAAG;QACzB,MAAM,IAAIC,MACR,CAAC,WAAW,EAAEN,KAAK,eAAe,EAAEE,WAAWK,IAAI,CAAC,MAAM,oDAAoD,EAAEP,KAAK,WAAW,CAAC;IAErI;AACF;AAEA;;CAEC,GACD,OAAO,MAAMQ,oBAAoB;IAC/B,eAAe;AACjB,EAAW;AAEX;;;;;CAKC,GACD,OAAO,MAAMC,gBAAgB;IAC3B,uCAAuC;IACvC,4CAA4C;IAC5C,kDAAkD;IAClD,yCAAyC;IACzC,mEAAmE;AACrE,EAAW;AAGX,6EAA6E,GAC7E,OAAO,MAAMC,iBAAiBtC,OAAOuC,IAAI,CAACF,eAAiC;AAE3E,iFAAiF,GACjF,OAAO,MAAMG,sBAAsB,CAACC,WAClC,GAAGA,SAAS,CAAC,EAAEJ,aAAa,CAACI,SAAS,EAAE,CAAC;AAE3C;;;;;;CAMC,GACD,OAAO,MAAMC,gBAAgB;IAC3BC,QAAQ;AACV,EAAW;AAGX,8EAA8E,GAC9E,OAAO,MAAMC,aAAa5C,OAAOuC,IAAI,CAACG,eAAiC;AAEvE;;;;CAIC,GACD,OAAO,MAAMG,cAAc;IACzBC,MAAM;IACNC,QAAQ;AACV,EAAW;AAEX;;;CAGC,GACD,OAAO,MAAMC,qBAAqB;IAChC,qEAAqE;IACrEC,OAAO;AACT,EAAW;AAEX;;;;;CAKC,GACD,OAAO,MAAMC,yBAAyB;IACpCD,OAAO;AACT,EAAqE;AAErE,wEAAwE,GACxE,OAAO,MAAME,iBAAiB,CAACC,OAC7B,GAAGF,sBAAsB,CAACE,KAAK,CAAC,CAAC,EAAEJ,kBAAkB,CAACI,KAAK,EAAE,CAAC;AAEhE;;;;;;;CAOC,GACD,OAAO,MAAMC,0BAA0B;IACrCP,MAAM;IACNC,QAAQ;AACV,EAAW;AAGX;;;;;;;;;CASC,GACD,OAAO,MAAMO,8BAA8B;IACzCR,MAAM;IACNC,QAAQ;AACV,EAAW;AAGX;;;CAGC,GACD,OAAO,MAAMQ,mBAAmB,CAACC,UAC/BA,YAAY,SACR,CAAC,KAAK,EAAEF,4BAA4BR,IAAI,EAAE,GAC1C,CAAC,OAAO,EAAEQ,4BAA4BP,MAAM,CAACU,OAAO,CAAC,KAAK,MAAM,CAAC;AAEvE;;;;;;;;CAQC,GACD,OAAO,MAAMC,qBAAqB,IAAcL,wBAAwBN,MAAM,CAAC;AAE/E;;;;;;CAMC,GACD,OAAO,MAAMY,4BAA4B,IACvC,CAAC,EAAE,EAAEN,wBAAwBN,MAAM,EAAE,CAAC;AAExC,gFAAgF,GAChF,OAAO,MAAMa,yBAAyB,CAACJ,UACrCA,YAAY,SACR,CAAC,MAAM,EAAEH,wBAAwBP,IAAI,CAAC,EAAE,CAAC,GACzC,CAAC,MAAM,EAAEO,wBAAwBN,MAAM,EAAE,CAAC;AAEhD;;;CAGC,GACD,OAAO,MAAMc,mBAAmB,CAACL,UAC/BA,YAAY,SACR,CAAC,eAAe,EAAEH,wBAAwBP,IAAI,CAAC,EAAE,CAAC,GAClD,CAAC,eAAe,EAAEO,wBAAwBN,MAAM,CAACU,OAAO,CAAC,KAAK,MAAM,CAAC;AAE3E;;;;;CAKC,GACD,OAAO,MAAMK,uBAAuB,IAAO,CAAA;QACzCC,aAAaF,iBAAiB;QAC9BG,eAAeH,iBAAiB;IAClC,CAAA,EAAG;AAEH;;;CAGC,GACD,OAAO,MAAMI,6BAA6B,IAAO,CAAA;QAC/CF,aAAaH,uBAAuB;QACpCI,eAAeJ,uBAAuB;IACxC,CAAA,EAAG;AAEH;;;CAGC,GACD,OAAO,MAAMM,qBAAqB;IAChCC,KAAK;IACLC,QAAQ;IACRC,MAAM;IACNC,SAAS;IACTC,UAAU;IACVC,OAAO;IACPC,MAAM;AACR,EAAW;AAGX;;;CAGC,GACD,OAAO,MAAMC,4BAA4B,IAAO,CAAA;QAC9CC,oBAAoBT,mBAAmBC,GAAG;QAC1CS,uBAAuBV,mBAAmBE,MAAM;QAChDS,qBAAqBX,mBAAmBG,IAAI;QAC5CS,wBAAwBZ,mBAAmBI,OAAO;QAClDS,yBAAyBb,mBAAmBK,QAAQ;QACpDS,sBAAsBd,mBAAmBM,KAAK;QAC9CS,qBAAqBf,mBAAmBO,IAAI;IAC9C,CAAA,EAAG"}
+{"version":3,"sources":["../../../../../packages/nx-plugin/src/utils/versions.ts"],"sourcesContent":["/**\n * Copyright Amazon.com, Inc. or its affiliates. All Rights Reserved.\n * SPDX-License-Identifier: Apache-2.0\n */\nimport {\n  type DeclaredPy,\n  type DeclaredTs,\n  type DependencyDeclaration,\n  declaredNames,\n} from './declared-dependencies.js';\n\n/**\n * Versons for TypeScript dependencies added by generators\n */\nexport const TS_VERSIONS = {\n  '@a2a-js/sdk': '0.3.14',\n  '@aws/aws-distro-opentelemetry-node-autoinstrumentation': '0.13.0',\n  // Pinned above the version the ADOT autoinstrumentation package resolves\n  // transitively (2.8.0) to clear CVE-2026-59892 (HIGH).\n  '@opentelemetry/propagator-jaeger': '2.12.0',\n  // Overridden in the vended agent/MCP image builds to clear CVE-2026-14257\n  // (HIGH) in brace-expansion: minimatch 10 is the lowest major depending on\n  // brace-expansion 5.x, the only line Trivy's `< 5.0.8` advisory range treats\n  // as fixed. Overriding brace-expansion directly is not viable — 5.x drops the\n  // CommonJS default export that minimatch 9 calls.\n  minimatch: '10.2.6',\n  // Both overridden in the vended RDB migration image build, which installs the\n  // prisma CLI to run migrations: its own ranges resolve deepmerge-ts below the\n  // CVE-2026-40345 fix (HIGH) and mysql2 below the GHSA-3f6p-5ww8-9rcr fix\n  // (HIGH). Neither is imported by the handler, which drives the schema engine.\n  'deepmerge-ts': '8.0.2',\n  mysql2: '3.24.6',\n  '@aws-sdk/client-dynamodb': '3.1151.0',\n  '@aws-sdk/client-api-gateway': '3.1151.0',\n  '@aws-sdk/client-iam': '3.1151.0',\n  '@aws-sdk/client-bedrock-agentcore': '3.1151.0',\n  '@aws-sdk/client-bedrock-runtime': '3.1151.0',\n  '@aws-sdk/client-s3': '3.1151.0',\n  '@aws-sdk/client-sts': '3.1151.0',\n  '@aws-sdk/client-cognito-identity-provider': '3.1151.0',\n  '@aws-sdk/credential-providers': '3.1151.0',\n  '@aws-sdk/credential-provider-cognito-identity': '3.972.73',\n  '@aws-sdk/client-secrets-manager': '3.1151.0',\n  '@aws-sdk/rds-signer': '3.1151.0',\n  '@smithy/server-apigateway': '0.3.4',\n  '@smithy/server-node': '0.3.4',\n  '@aws-lambda-powertools/logger': '2.36.0',\n  '@aws-lambda-powertools/metrics': '2.36.0',\n  '@aws-lambda-powertools/parameters': '2.36.0',\n  '@aws-lambda-powertools/tracer': '2.36.0',\n  '@aws-lambda-powertools/parser': '2.36.0',\n  '@aws-sdk/client-appconfigdata': '3.1151.0',\n  '@middy/core': '7.9.2',\n  '@nxlv/python': '23.2.1',\n  '@nx-extend/terraform': '10.4.1',\n  // These must all hold the same version — see NX_PACKAGES.\n  nx: '23.3.0',\n  '@nx/devkit': '23.3.0',\n  '@nx/js': '23.3.0',\n  '@nx/react': '23.3.0',\n  '@nx/vite': '23.3.0',\n  '@nx/vitest': '23.3.0',\n  '@nx/workspace': '23.3.0',\n  'create-nx-workspace': '23.3.0',\n  '@swc-node/register': '1.12.1',\n  '@swc/core': '1.16.18',\n  '@modelcontextprotocol/sdk': '1.32.1',\n  '@modelcontextprotocol/client': '2.3.1',\n  '@modelcontextprotocol/inspector': '2.10.1',\n  '@ag-ui/a2ui-toolkit': '0.0.5',\n  '@ag-ui/aws-strands': '1.0.0',\n  '@ag-ui/client': '1.0.2',\n  '@ag-ui/core': '1.0.2',\n  '@ag-ui/encoder': '1.0.2',\n  'agent-chat-cli': '0.3.0',\n  '@copilotkit/react-core': '1.79.0',\n  rxjs: '7.8.2',\n  '@strands-agents/sdk': '1.20.0',\n  '@tanstack/react-router': '1.170.44',\n  '@tanstack/router-plugin': '1.168.45',\n  '@tanstack/router-generator': '1.167.43',\n  '@tanstack/virtual-file-routes': '1.162.0',\n  '@tanstack/router-utils': '1.162.3',\n  '@cloudscape-design/board-components': '3.0.238',\n  '@cloudscape-design/chat-components': '1.0.179',\n  '@cloudscape-design/components': '3.0.1400',\n  '@cloudscape-design/global-styles': '1.0.71',\n  '@tanstack/react-query': '5.104.2',\n  '@tanstack/react-query-devtools': '5.104.2',\n  '@trpc/tanstack-react-query': '11.19.0',\n  '@trpc/client': '11.19.0',\n  '@trpc/server': '11.19.0',\n  '@types/node': '26.6.5',\n  '@types/aws-lambda': '8.10.164',\n  '@types/cors': '2.8.19',\n  '@types/pg': '8.23.1',\n  '@types/ws': '8.18.2',\n  '@types/express': '5.0.6',\n  '@smithy/config-resolver': '4.7.2',\n  '@smithy/node-config-provider': '4.6.2',\n  '@smithy/node-http-handler': '4.12.1',\n  '@smithy/types': '4.19.0',\n  '@vitest/coverage-v8': '4.1.11',\n  '@vitest/ui': '4.1.11',\n  '@astrojs/react': '6.0.6',\n  '@astrojs/starlight': '0.42.6',\n  astro: '7.3.8',\n  cookie: '2.0.1',\n  aws4fetch: '1.0.20',\n  'aws-cdk': '2.1145.0',\n  'aws-cdk-lib': '2.273.0',\n  'aws-xray-sdk-core': '3.12.0',\n  constructs: '10.8.1',\n  cors: '2.8.6',\n  chalk: '6.0.1',\n  'class-variance-authority': '0.7.1',\n  cn: '0.4.0',\n  commander: '15.0.0',\n  electrodb: '3.9.3',\n  esbuild: '0.28.2',\n  'event-source-polyfill': '1.0.31',\n  '@types/event-source-polyfill': '1.0.5',\n  '@biomejs/biome': '2.5.15',\n  '@prisma/adapter-mariadb': '7.10.0',\n  '@prisma/adapter-pg': '7.10.0',\n  '@prisma/client': '7.10.0',\n  ejs: '6.0.1',\n  '@types/ejs': '3.1.5',\n  express: '5.3.0',\n  'fast-glob': '3.3.3',\n  husky: '9.1.7',\n  'fs-extra': '11.4.1',\n  '@types/fs-extra': '11.0.4',\n  mariadb: '3.5.4',\n  mise: '2026.10.9',\n  npm: '12.2.0',\n  'npm-check-updates': '23.1.1',\n  'oidc-client-ts': '3.5.0',\n  pg: '8.23.1',\n  prisma: '7.10.0',\n  'react-oidc-context': '3.3.1',\n  react: '19.3.0',\n  'react-dom': '19.3.0',\n  rolldown: '1.2.13',\n  'rolldown-plugin-dts': '0.28.8',\n  shx: '0.4.0',\n  'simple-git': '4.0.2',\n  'source-map-support': '0.5.21',\n  'starlight-blog': '0.30.1',\n  tailwindcss: '4.3.3',\n  '@tailwindcss/vite': '4.3.3',\n  tsx: '4.23.15',\n  'lucide-react': '1.56.0',\n  'radix-ui': '1.8.1',\n  shadcn: '4.21.4',\n  'tw-animate-css': '1.4.0',\n  vite: '8.3.4',\n  typescript: '6.0.3',\n  vitest: '4.1.11',\n  // The `testEnvironment` @nx/vitest writes into every generated config.\n  jsdom: '29.1.1',\n  zod: '4.6.7',\n  ws: '8.22.0',\n} as const;\nexport type ITsDepVersion = keyof typeof TS_VERSIONS;\n\n/**\n * Dependencies that must move as a unit, held at the lowest version proposed\n * across each group by the version update. Members must share a version line.\n *\n * The wasm formatter bindings are dependencies of this repo rather than vended\n * pins, so they are named here but versioned in the manifests.\n */\nexport const LOCKSTEP_GROUPS = [\n  // A duplicate `@ag-ui/client` fails every generated website with TS2322.\n  ['@ag-ui/client', '@ag-ui/core', '@ag-ui/encoder'],\n  // The wasm bindings format generated files; the CLI checks them.\n  ['@biomejs/wasm-nodejs', '@biomejs/biome'],\n  ['@astral-sh/ruff-wasm-nodejs', 'ruff'],\n] as const satisfies readonly (readonly [string, string, ...string[]])[];\n\n/**\n * Pins the version update sets to the exact `dependencies` of another vended\n * package, as published for the version of it being written. Followers' lockstep\n * group mates move with them. If a peer's published `peerDependencies` reject the\n * result, or a manifest can't be read, all of these pins stay where they are.\n *\n * Use this rather than a lockstep group when the packages don't share a version\n * line.\n */\nexport const EXACT_DEPENDENCY_PINS = [\n  {\n    source: '@copilotkit/react-core',\n    followers: ['@ag-ui/client', '@ag-ui/core'],\n    peers: ['@ag-ui/aws-strands', '@ag-ui/a2ui-toolkit'],\n    reason:\n      'a second @ag-ui/client copy fails every generated website with TS2322',\n  },\n] as const satisfies readonly {\n  source: ITsDepVersion;\n  followers: readonly [ITsDepVersion, ...ITsDepVersion[]];\n  peers: readonly ITsDepVersion[];\n  reason: string;\n}[];\n\n/**\n * Add versions to the given dependencies, which the declaration must own.\n *\n * @param declaration the calling generator's `DEPENDENCIES`\n */\nexport const withVersions = <D extends DependencyDeclaration>(\n  declaration: D,\n  deps: readonly DeclaredTs<D>[],\n): Record<string, string> => {\n  assertDeclared(declaration.ts, deps, 'ts');\n  return Object.fromEntries(\n    deps.map((dep) => [dep, TS_VERSIONS[dep as ITsDepVersion]]),\n  );\n};\n\n/**\n * The `nx` and `@nx/*` packages a generated workspace pins, all of which must\n * hold the same version: a workspace nx even a patch apart hoists a second\n * nested nx, and the two deadlock `nx sync`.\n *\n * Bumping them in a user's workspace requires `packageJsonUpdates` rather than a\n * migration — see `version-upgrade-migration/nx-package-updates.ts`.\n */\nexport const NX_PACKAGES = [\n  'nx',\n  '@nx/devkit',\n  '@nx/js',\n  '@nx/react',\n  '@nx/vite',\n  '@nx/vitest',\n  '@nx/workspace',\n] as const satisfies readonly ITsDepVersion[];\n\n/**\n * The nx version the plugin is built against, and the single source of truth\n * for every place a workspace's nx is pinned.\n */\nexport const NX_VERSION = TS_VERSIONS.nx;\n\n/**\n * Versions for Python dependencies added by generators\n */\nexport const PY_VERSIONS = {\n  'a2a-sdk': '==0.3.26',\n  'ag-ui-langgraph': '==0.0.47',\n  'ag-ui-protocol': '==0.1.22',\n  'ag-ui-strands': '==0.4.1',\n  aiosqlite: '==0.22.1',\n  'aws-lambda-powertools': '==3.35.0',\n  'aws-lambda-powertools[tracer]': '==3.35.0',\n  'aws-lambda-powertools[parser]': '==3.35.0',\n  'aws-opentelemetry-distro': '==0.21.0',\n  'bedrock-agentcore': '==1.24.1',\n  boto3: '==1.43.113',\n  checkov: '==3.3.29',\n  fastapi: '==0.143.1',\n  'fastapi[standard]': '==0.143.1',\n  httpx: '==0.28.1',\n  langchain: '==1.4.6',\n  'langchain-aws': '==1.8.2',\n  'langchain-mcp-adapters': '==0.3.2',\n  langgraph: '==1.2.15',\n  'langgraph-checkpoint-aws': '==1.2.5',\n  'langgraph-checkpoint-sqlite': '==3.1.2',\n  mcp: '==1.28.1',\n  'pip-check-updates': '==0.29.0',\n  'pip-licenses': '==5.5.5',\n  pydantic: '==2.14.1',\n  ruff: '==0.17.0',\n  'strands-agents': '==1.60.0',\n  'strands-agents[a2a]': '==1.60.0',\n  'strands-agents-tools': '==0.8.9',\n  ty: '==0.0.87',\n  pynamodb: '==6.1.0',\n  uvicorn: '==0.54.0',\n  sqlmodel: '==0.0.48',\n  alembic: '==1.20.0',\n  aiomysql: '==0.3.2',\n  asyncpg: '==0.32.0',\n  // Pinned explicitly: SQLAlchemy's async engine pulls greenlet transitively,\n  // and leaving it unpinned lets uv resolve to a just-released version whose\n  // platform wheels may not all be published yet (breaking aarch64 installs).\n  greenlet: '==3.5.6',\n} as const;\nexport type IPyDepVersion = keyof typeof PY_VERSIONS;\n\n/**\n * Add versions to the given dependencies\n */\nexport const withPyVersions = <D extends DependencyDeclaration>(\n  declaration: D,\n  deps: readonly DeclaredPy<D>[],\n): string[] => {\n  assertDeclared(declaration.py, deps, 'py');\n  return deps.map((dep) => `${dep}${PY_VERSIONS[dep as IPyDepVersion]}`);\n};\n\n/** Catches undeclared packages that reach here past the type checker. */\nconst assertDeclared = (\n  declared: readonly { readonly name: string }[],\n  deps: readonly unknown[],\n  kind: 'ts' | 'py',\n): void => {\n  const names = declaredNames(declared);\n  const undeclared = deps.filter((dep) => !names.includes(dep as string));\n  if (undeclared.length > 0) {\n    throw new Error(\n      `Undeclared ${kind} dependencies: ${undeclared.join(', ')}. Add them to the generator's declareDependencies({ ${kind}: [...] }).`,\n    );\n  }\n};\n\n/**\n * Versions for vendored tools\n */\nexport const VENDORED_VERSIONS = {\n  'git-secrets': '1.3.0',\n} as const;\n\n/**\n * Versions of Java dependencies added by generators, keyed by Maven coordinate.\n *\n * Every entry is resolved from Maven Central by the version update and named\n * `<group>:<artifact>:<version>` where a generator writes it.\n */\nexport const JAVA_VERSIONS = {\n  'software.amazon.smithy:smithy-model': '1.74.0',\n  'software.amazon.smithy:smithy-aws-traits': '1.74.0',\n  'software.amazon.smithy:smithy-validation-model': '1.74.0',\n  'software.amazon.smithy:smithy-openapi': '1.74.0',\n  'software.amazon.smithy.typescript:smithy-aws-typescript-codegen': '0.54.0',\n} as const;\nexport type IJavaVersion = keyof typeof JAVA_VERSIONS;\n\n/** The Maven coordinates the version update resolves, in declaration order. */\nexport const JAVA_ARTIFACTS = Object.keys(JAVA_VERSIONS) as IJavaVersion[];\n\n/** A Maven coordinate as a dependency names it: `<group>:<artifact>:<version>`. */\nexport const javaMavenDependency = (artifact: IJavaVersion): string =>\n  `${artifact}:${JAVA_VERSIONS[artifact]}`;\n\n/**\n * Versions of tools resolved by mise, keyed by the tool name mise knows.\n *\n * Every entry is checked with `mise latest <tool>` by the version update. Nothing\n * is installed into the workspace: the pin travels in the `project.json` target\n * command, which is what the version sync reaches to move it forward.\n */\nexport const MISE_VERSIONS = {\n  smithy: '1.74.0',\n} as const;\nexport type IMiseVersion = keyof typeof MISE_VERSIONS;\n\n/** The tools the version update resolves through mise, in declaration order. */\nexport const MISE_TOOLS = Object.keys(MISE_VERSIONS) as IMiseVersion[];\n\n/**\n * Base container images used by generated Dockerfiles. Pinned exactly so\n * generated images are reproducible, and chosen to be free of known\n * HIGH/CRITICAL vulnerabilities at time of generation.\n */\nexport const BASE_IMAGES = {\n  node: 'public.ecr.aws/docker/library/node:lts-slim',\n  python: 'public.ecr.aws/docker/library/python:3.14-slim',\n} as const;\n\n/**\n * Versions for container tooling used by generated image build/scan targets.\n * Pinned exactly so generated images are reproducible.\n */\nexport const CONTAINER_VERSIONS = {\n  // ECR-hosted Trivy image used to scan built images during the build.\n  trivy: '0.72.0',\n} as const;\n\n/**\n * Repository each pinned tool image is pulled from, keyed as\n * {@link CONTAINER_VERSIONS}. Kept beside the versions so a tool added here is\n * one entry rather than a reference built somewhere else, which is also what\n * lets the version sync find these pins wherever a target command runs them.\n */\nexport const CONTAINER_REPOSITORIES = {\n  trivy: 'public.ecr.aws/aquasecurity/trivy',\n} as const satisfies Record<keyof typeof CONTAINER_VERSIONS, string>;\n\n/** The pinned reference for a tool image, as a target command runs it. */\nexport const containerImage = (tool: keyof typeof CONTAINER_VERSIONS): string =>\n  `${CONTAINER_REPOSITORIES[tool]}:${CONTAINER_VERSIONS[tool]}`;\n\n/**\n * The managed Lambda runtimes generated infrastructure targets, as the single\n * source both IaC providers derive from.\n *\n * CDK and Terraform name the same runtime differently — `Runtime.NODEJS_24_X`\n * against `nodejs24.x` — so deriving both from the version here keeps a bump one\n * edit that moves them together. Resolved by the version update workflow.\n */\nexport const LAMBDA_RUNTIME_VERSIONS = {\n  node: '24',\n  python: '3.14',\n} as const;\nexport type ILambdaRuntime = keyof typeof LAMBDA_RUNTIME_VERSIONS;\n\n/**\n * The managed AgentCore Runtime runtimes generated infrastructure targets, for\n * agents and MCP servers packaged as code rather than as a container image.\n *\n * Tracked separately from {@link LAMBDA_RUNTIME_VERSIONS}: AgentCore publishes\n * its own, smaller set, so a Lambda bump would otherwise move these to a runtime\n * AgentCore rejects at create time. Resolved by the version update workflow from\n * the `AgentCoreRuntime` members `aws-cdk-lib` publishes, the same source the\n * Lambda runtimes come from.\n */\nexport const AGENT_CORE_RUNTIME_VERSIONS = {\n  node: '22',\n  python: '3.14',\n} as const;\nexport type IAgentCoreRuntime = keyof typeof AGENT_CORE_RUNTIME_VERSIONS;\n\n/**\n * The runtime as AgentCore's `runtime` field names it, e.g. `NODE_22` or\n * `PYTHON_3_14`.\n */\nexport const agentCoreRuntime = (runtime: IAgentCoreRuntime): string =>\n  runtime === 'node'\n    ? `NODE_${AGENT_CORE_RUNTIME_VERSIONS.node}`\n    : `PYTHON_${AGENT_CORE_RUNTIME_VERSIONS.python.replace('.', '_')}`;\n\n/**\n * The interpreter uv pins for a generated Python project, as the Lambda runtime's\n * `major.minor`.\n *\n * No patch: uv reads this as a request for any patch of that minor, so it resolves\n * whichever one the platform has a build for. Naming an exact patch pins one that\n * may not exist everywhere, and Lambda patches the interpreter itself, so the minor\n * is the whole of what a project needs to agree on.\n */\nexport const pyenvPythonVersion = (): string => LAMBDA_RUNTIME_VERSIONS.python;\n\n/**\n * The `[project].requires-python` specifier for a generated Python project.\n *\n * A lower bound on the Lambda runtime's `major.minor`: the deployed interpreter\n * is that version, and Ruff derives its `target-version` from this (`py314`), so\n * lint targets the same version the function runs on.\n */\nexport const pyprojectPythonDependency = (): string =>\n  `>=${LAMBDA_RUNTIME_VERSIONS.python}`;\n\n/** The runtime as Terraform's `runtime` attribute names it, e.g. `nodejs24.x`. */\nexport const terraformLambdaRuntime = (runtime: ILambdaRuntime): string =>\n  runtime === 'node'\n    ? `nodejs${LAMBDA_RUNTIME_VERSIONS.node}.x`\n    : `python${LAMBDA_RUNTIME_VERSIONS.python}`;\n\n/**\n * The runtime as an `aws-cdk-lib` `Runtime` member, e.g. `Runtime.NODEJS_24_X`.\n * Always an explicitly versioned member, never a `_LATEST` alias.\n */\nexport const cdkLambdaRuntime = (runtime: ILambdaRuntime): string =>\n  runtime === 'node'\n    ? `Runtime.NODEJS_${LAMBDA_RUNTIME_VERSIONS.node}_X`\n    : `Runtime.PYTHON_${LAMBDA_RUNTIME_VERSIONS.python.replace('.', '_')}`;\n\n/**\n * Substitution variables exposing the pinned runtimes to generated CDK\n * templates (e.g. `runtime: <%- nodeRuntime %>`). Paired with\n * {@link terraformLambdaRuntimeVars}, which names the same variables so a\n * template reads alike under either provider.\n */\nexport const cdkLambdaRuntimeVars = () => ({\n  nodeRuntime: cdkLambdaRuntime('node'),\n  pythonRuntime: cdkLambdaRuntime('python'),\n});\n\n/**\n * Substitution variables exposing the pinned runtimes to generated `.tf`\n * templates (e.g. `runtime = \"<%- nodeRuntime %>\"`).\n */\nexport const terraformLambdaRuntimeVars = () => ({\n  nodeRuntime: terraformLambdaRuntime('node'),\n  pythonRuntime: terraformLambdaRuntime('python'),\n});\n\n/**\n * Exact versions for Terraform providers used by generated `.tf` modules.\n * Pinned exactly (no range operator) so generated infrastructure is reproducible.\n */\nexport const TERRAFORM_VERSIONS = {\n  aws: '6.68.0',\n  random: '3.9.1',\n  null: '3.3.2',\n  archive: '2.8.1',\n  external: '2.4.2',\n  local: '2.9.1',\n  time: '0.14.2',\n} as const;\nexport type ITerraformProviderVersion = keyof typeof TERRAFORM_VERSIONS;\n\n/**\n * Substitution variables exposing Terraform provider version constraints to\n * generated `.tf` templates (e.g. `version = \"<%- awsProviderVersion %>\"`)\n */\nexport const terraformProviderVersions = () => ({\n  awsProviderVersion: TERRAFORM_VERSIONS.aws,\n  randomProviderVersion: TERRAFORM_VERSIONS.random,\n  nullProviderVersion: TERRAFORM_VERSIONS.null,\n  archiveProviderVersion: TERRAFORM_VERSIONS.archive,\n  externalProviderVersion: TERRAFORM_VERSIONS.external,\n  localProviderVersion: TERRAFORM_VERSIONS.local,\n  timeProviderVersion: TERRAFORM_VERSIONS.time,\n});\n"],"names":["declaredNames","TS_VERSIONS","minimatch","mysql2","nx","rxjs","astro","cookie","aws4fetch","constructs","cors","chalk","cn","commander","electrodb","esbuild","ejs","express","husky","mariadb","mise","npm","pg","prisma","react","rolldown","shx","tailwindcss","tsx","shadcn","vite","typescript","vitest","jsdom","zod","ws","LOCKSTEP_GROUPS","EXACT_DEPENDENCY_PINS","source","followers","peers","reason","withVersions","declaration","deps","assertDeclared","ts","Object","fromEntries","map","dep","NX_PACKAGES","NX_VERSION","PY_VERSIONS","aiosqlite","boto3","checkov","fastapi","httpx","langchain","langgraph","mcp","pydantic","ruff","ty","pynamodb","uvicorn","sqlmodel","alembic","aiomysql","asyncpg","greenlet","withPyVersions","py","declared","kind","names","undeclared","filter","includes","length","Error","join","VENDORED_VERSIONS","JAVA_VERSIONS","JAVA_ARTIFACTS","keys","javaMavenDependency","artifact","MISE_VERSIONS","smithy","MISE_TOOLS","BASE_IMAGES","node","python","CONTAINER_VERSIONS","trivy","CONTAINER_REPOSITORIES","containerImage","tool","LAMBDA_RUNTIME_VERSIONS","AGENT_CORE_RUNTIME_VERSIONS","agentCoreRuntime","runtime","replace","pyenvPythonVersion","pyprojectPythonDependency","terraformLambdaRuntime","cdkLambdaRuntime","cdkLambdaRuntimeVars","nodeRuntime","pythonRuntime","terraformLambdaRuntimeVars","TERRAFORM_VERSIONS","aws","random","null","archive","external","local","time","terraformProviderVersions","awsProviderVersion","randomProviderVersion","nullProviderVersion","archiveProviderVersion","externalProviderVersion","localProviderVersion","timeProviderVersion"],"mappings":"AAAA;;;CAGC,GACD,SAIEA,aAAa,QACR,6BAA6B;AAEpC;;CAEC,GACD,OAAO,MAAMC,cAAc;IACzB,eAAe;IACf,0DAA0D;IAC1D,yEAAyE;IACzE,uDAAuD;IACvD,oCAAoC;IACpC,0EAA0E;IAC1E,2EAA2E;IAC3E,6EAA6E;IAC7E,8EAA8E;IAC9E,kDAAkD;IAClDC,WAAW;IACX,8EAA8E;IAC9E,8EAA8E;IAC9E,yEAAyE;IACzE,8EAA8E;IAC9E,gBAAgB;IAChBC,QAAQ;IACR,4BAA4B;IAC5B,+BAA+B;IAC/B,uBAAuB;IACvB,qCAAqC;IACrC,mCAAmC;IACnC,sBAAsB;IACtB,uBAAuB;IACvB,6CAA6C;IAC7C,iCAAiC;IACjC,iDAAiD;IACjD,mCAAmC;IACnC,uBAAuB;IACvB,6BAA6B;IAC7B,uBAAuB;IACvB,iCAAiC;IACjC,kCAAkC;IAClC,qCAAqC;IACrC,iCAAiC;IACjC,iCAAiC;IACjC,iCAAiC;IACjC,eAAe;IACf,gBAAgB;IAChB,wBAAwB;IACxB,0DAA0D;IAC1DC,IAAI;IACJ,cAAc;IACd,UAAU;IACV,aAAa;IACb,YAAY;IACZ,cAAc;IACd,iBAAiB;IACjB,uBAAuB;IACvB,sBAAsB;IACtB,aAAa;IACb,6BAA6B;IAC7B,gCAAgC;IAChC,mCAAmC;IACnC,uBAAuB;IACvB,sBAAsB;IACtB,iBAAiB;IACjB,eAAe;IACf,kBAAkB;IAClB,kBAAkB;IAClB,0BAA0B;IAC1BC,MAAM;IACN,uBAAuB;IACvB,0BAA0B;IAC1B,2BAA2B;IAC3B,8BAA8B;IAC9B,iCAAiC;IACjC,0BAA0B;IAC1B,uCAAuC;IACvC,sCAAsC;IACtC,iCAAiC;IACjC,oCAAoC;IACpC,yBAAyB;IACzB,kCAAkC;IAClC,8BAA8B;IAC9B,gBAAgB;IAChB,gBAAgB;IAChB,eAAe;IACf,qBAAqB;IACrB,eAAe;IACf,aAAa;IACb,aAAa;IACb,kBAAkB;IAClB,2BAA2B;IAC3B,gCAAgC;IAChC,6BAA6B;IAC7B,iBAAiB;IACjB,uBAAuB;IACvB,cAAc;IACd,kBAAkB;IAClB,sBAAsB;IACtBC,OAAO;IACPC,QAAQ;IACRC,WAAW;IACX,WAAW;IACX,eAAe;IACf,qBAAqB;IACrBC,YAAY;IACZC,MAAM;IACNC,OAAO;IACP,4BAA4B;IAC5BC,IAAI;IACJC,WAAW;IACXC,WAAW;IACXC,SAAS;IACT,yBAAyB;IACzB,gCAAgC;IAChC,kBAAkB;IAClB,2BAA2B;IAC3B,sBAAsB;IACtB,kBAAkB;IAClBC,KAAK;IACL,cAAc;IACdC,SAAS;IACT,aAAa;IACbC,OAAO;IACP,YAAY;IACZ,mBAAmB;IACnBC,SAAS;IACTC,MAAM;IACNC,KAAK;IACL,qBAAqB;IACrB,kBAAkB;IAClBC,IAAI;IACJC,QAAQ;IACR,sBAAsB;IACtBC,OAAO;IACP,aAAa;IACbC,UAAU;IACV,uBAAuB;IACvBC,KAAK;IACL,cAAc;IACd,sBAAsB;IACtB,kBAAkB;IAClBC,aAAa;IACb,qBAAqB;IACrBC,KAAK;IACL,gBAAgB;IAChB,YAAY;IACZC,QAAQ;IACR,kBAAkB;IAClBC,MAAM;IACNC,YAAY;IACZC,QAAQ;IACR,uEAAuE;IACvEC,OAAO;IACPC,KAAK;IACLC,IAAI;AACN,EAAW;AAGX;;;;;;CAMC,GACD,OAAO,MAAMC,kBAAkB;IAC7B,yEAAyE;IACzE;QAAC;QAAiB;QAAe;KAAiB;IAClD,iEAAiE;IACjE;QAAC;QAAwB;KAAiB;IAC1C;QAAC;QAA+B;KAAO;CACxC,CAAwE;AAEzE;;;;;;;;CAQC,GACD,OAAO,MAAMC,wBAAwB;IACnC;QACEC,QAAQ;QACRC,WAAW;YAAC;YAAiB;SAAc;QAC3CC,OAAO;YAAC;YAAsB;SAAsB;QACpDC,QACE;IACJ;CACD,CAKG;AAEJ;;;;CAIC,GACD,OAAO,MAAMC,eAAe,CAC1BC,aACAC;IAEAC,eAAeF,YAAYG,EAAE,EAAEF,MAAM;IACrC,OAAOG,OAAOC,WAAW,CACvBJ,KAAKK,GAAG,CAAC,CAACC,MAAQ;YAACA;YAAKjD,WAAW,CAACiD,IAAqB;SAAC;AAE9D,EAAE;AAEF;;;;;;;CAOC,GACD,OAAO,MAAMC,cAAc;IACzB;IACA;IACA;IACA;IACA;IACA;IACA;CACD,CAA6C;AAE9C;;;CAGC,GACD,OAAO,MAAMC,aAAanD,YAAYG,EAAE,CAAC;AAEzC;;CAEC,GACD,OAAO,MAAMiD,cAAc;IACzB,WAAW;IACX,mBAAmB;IACnB,kBAAkB;IAClB,iBAAiB;IACjBC,WAAW;IACX,yBAAyB;IACzB,iCAAiC;IACjC,iCAAiC;IACjC,4BAA4B;IAC5B,qBAAqB;IACrBC,OAAO;IACPC,SAAS;IACTC,SAAS;IACT,qBAAqB;IACrBC,OAAO;IACPC,WAAW;IACX,iBAAiB;IACjB,0BAA0B;IAC1BC,WAAW;IACX,4BAA4B;IAC5B,+BAA+B;IAC/BC,KAAK;IACL,qBAAqB;IACrB,gBAAgB;IAChBC,UAAU;IACVC,MAAM;IACN,kBAAkB;IAClB,uBAAuB;IACvB,wBAAwB;IACxBC,IAAI;IACJC,UAAU;IACVC,SAAS;IACTC,UAAU;IACVC,SAAS;IACTC,UAAU;IACVC,SAAS;IACT,4EAA4E;IAC5E,2EAA2E;IAC3E,4EAA4E;IAC5EC,UAAU;AACZ,EAAW;AAGX;;CAEC,GACD,OAAO,MAAMC,iBAAiB,CAC5B7B,aACAC;IAEAC,eAAeF,YAAY8B,EAAE,EAAE7B,MAAM;IACrC,OAAOA,KAAKK,GAAG,CAAC,CAACC,MAAQ,GAAGA,MAAMG,WAAW,CAACH,IAAqB,EAAE;AACvE,EAAE;AAEF,uEAAuE,GACvE,MAAML,iBAAiB,CACrB6B,UACA9B,MACA+B;IAEA,MAAMC,QAAQ5E,cAAc0E;IAC5B,MAAMG,aAAajC,KAAKkC,MAAM,CAAC,CAAC5B,MAAQ,CAAC0B,MAAMG,QAAQ,CAAC7B;IACxD,IAAI2B,WAAWG,MAAM,GAAG,GAAG;QACzB,MAAM,IAAIC,MACR,CAAC,WAAW,EAAEN,KAAK,eAAe,EAAEE,WAAWK,IAAI,CAAC,MAAM,oDAAoD,EAAEP,KAAK,WAAW,CAAC;IAErI;AACF;AAEA;;CAEC,GACD,OAAO,MAAMQ,oBAAoB;IAC/B,eAAe;AACjB,EAAW;AAEX;;;;;CAKC,GACD,OAAO,MAAMC,gBAAgB;IAC3B,uCAAuC;IACvC,4CAA4C;IAC5C,kDAAkD;IAClD,yCAAyC;IACzC,mEAAmE;AACrE,EAAW;AAGX,6EAA6E,GAC7E,OAAO,MAAMC,iBAAiBtC,OAAOuC,IAAI,CAACF,eAAiC;AAE3E,iFAAiF,GACjF,OAAO,MAAMG,sBAAsB,CAACC,WAClC,GAAGA,SAAS,CAAC,EAAEJ,aAAa,CAACI,SAAS,EAAE,CAAC;AAE3C;;;;;;CAMC,GACD,OAAO,MAAMC,gBAAgB;IAC3BC,QAAQ;AACV,EAAW;AAGX,8EAA8E,GAC9E,OAAO,MAAMC,aAAa5C,OAAOuC,IAAI,CAACG,eAAiC;AAEvE;;;;CAIC,GACD,OAAO,MAAMG,cAAc;IACzBC,MAAM;IACNC,QAAQ;AACV,EAAW;AAEX;;;CAGC,GACD,OAAO,MAAMC,qBAAqB;IAChC,qEAAqE;IACrEC,OAAO;AACT,EAAW;AAEX;;;;;CAKC,GACD,OAAO,MAAMC,yBAAyB;IACpCD,OAAO;AACT,EAAqE;AAErE,wEAAwE,GACxE,OAAO,MAAME,iBAAiB,CAACC,OAC7B,GAAGF,sBAAsB,CAACE,KAAK,CAAC,CAAC,EAAEJ,kBAAkB,CAACI,KAAK,EAAE,CAAC;AAEhE;;;;;;;CAOC,GACD,OAAO,MAAMC,0BAA0B;IACrCP,MAAM;IACNC,QAAQ;AACV,EAAW;AAGX;;;;;;;;;CASC,GACD,OAAO,MAAMO,8BAA8B;IACzCR,MAAM;IACNC,QAAQ;AACV,EAAW;AAGX;;;CAGC,GACD,OAAO,MAAMQ,mBAAmB,CAACC,UAC/BA,YAAY,SACR,CAAC,KAAK,EAAEF,4BAA4BR,IAAI,EAAE,GAC1C,CAAC,OAAO,EAAEQ,4BAA4BP,MAAM,CAACU,OAAO,CAAC,KAAK,MAAM,CAAC;AAEvE;;;;;;;;CAQC,GACD,OAAO,MAAMC,qBAAqB,IAAcL,wBAAwBN,MAAM,CAAC;AAE/E;;;;;;CAMC,GACD,OAAO,MAAMY,4BAA4B,IACvC,CAAC,EAAE,EAAEN,wBAAwBN,MAAM,EAAE,CAAC;AAExC,gFAAgF,GAChF,OAAO,MAAMa,yBAAyB,CAACJ,UACrCA,YAAY,SACR,CAAC,MAAM,EAAEH,wBAAwBP,IAAI,CAAC,EAAE,CAAC,GACzC,CAAC,MAAM,EAAEO,wBAAwBN,MAAM,EAAE,CAAC;AAEhD;;;CAGC,GACD,OAAO,MAAMc,mBAAmB,CAACL,UAC/BA,YAAY,SACR,CAAC,eAAe,EAAEH,wBAAwBP,IAAI,CAAC,EAAE,CAAC,GAClD,CAAC,eAAe,EAAEO,wBAAwBN,MAAM,CAACU,OAAO,CAAC,KAAK,MAAM,CAAC;AAE3E;;;;;CAKC,GACD,OAAO,MAAMK,uBAAuB,IAAO,CAAA;QACzCC,aAAaF,iBAAiB;QAC9BG,eAAeH,iBAAiB;IAClC,CAAA,EAAG;AAEH;;;CAGC,GACD,OAAO,MAAMI,6BAA6B,IAAO,CAAA;QAC/CF,aAAaH,uBAAuB;QACpCI,eAAeJ,uBAAuB;IACxC,CAAA,EAAG;AAEH;;;CAGC,GACD,OAAO,MAAMM,qBAAqB;IAChCC,KAAK;IACLC,QAAQ;IACRC,MAAM;IACNC,SAAS;IACTC,UAAU;IACVC,OAAO;IACPC,MAAM;AACR,EAAW;AAGX;;;CAGC,GACD,OAAO,MAAMC,4BAA4B,IAAO,CAAA;QAC9CC,oBAAoBT,mBAAmBC,GAAG;QAC1CS,uBAAuBV,mBAAmBE,MAAM;QAChDS,qBAAqBX,mBAAmBG,IAAI;QAC5CS,wBAAwBZ,mBAAmBI,OAAO;QAClDS,yBAAyBb,mBAAmBK,QAAQ;QACpDS,sBAAsBd,mBAAmBM,KAAK;QAC9CS,qBAAqBf,mBAAmBO,IAAI;IAC9C,CAAA,EAAG"}

package/src/migrations/latest/cache-inputs-outputs/migration.js.map

@@ -1 +0,0 @@
-{"version":3,"sources":["../../../../../../../packages/nx-plugin/src/migrations/latest/cache-inputs-outputs/migration.ts"],"sourcesContent":["/**\n * Copyright Amazon.com, Inc. or its affiliates. All Rights Reserved.\n * SPDX-License-Identifier: Apache-2.0\n */\nimport {\n  getProjects,\n  type MigrationReturnObject,\n  type ProjectConfiguration,\n  readNxJson,\n  type TargetConfiguration,\n  type Tree,\n  updateNxJson,\n  updateProjectConfiguration,\n} from '@nx/devkit';\nimport {\n  SMITHY_PROJECT_GENERATOR_INFO,\n  SMITHY_TARGET_INPUTS,\n} from '../../../smithy/project/generator.js';\nimport { TERRAFORM_PROJECT_GENERATOR_INFO } from '../../../terraform/project/generator.js';\nimport {\n  DEPENDENT_TASKS_OUTPUT_FILES_INPUT,\n  VENDED_DEPENDENT_TASKS_OUTPUT_GLOBS,\n} from '../../../ts/lib/generator.js';\nimport { TS_RDB_GENERATOR_INFO } from '../../../ts/rdb/generator.js';\nimport { formatFilesInSubtree } from '../../../utils/format.js';\n\n/**\n * Fix what four generated targets hash, so cached results follow what each\n * task actually reads:\n *\n * - `nx.json`'s `default` input no longer hashes checkov reports\n *   (`dist/<project>/checkov/checkov_report.json`, CDK and Terraform) or vitest\n *   coverage (`dist/<project>/test-output/vitest/coverage/`) from upstream\n *   tasks. Nothing downstream reads them, and an uncached scan or coverage run\n *   rewrites them, which missed every dependent task.\n * - A Smithy project's `compile` and `generate-ssdk` declare `[\"default\"]`,\n *   their own sources plus the outputs of the tasks they depend on, rather\n *   than relying on whatever target default applies. That hashes a consumed\n *   shape library's output only in a workspace where nx.json's `default`\n *   carries the `dependentTasksOutputFiles` entry, which only\n *   ts/lib/generator.ts writes.\n * - A ts#rdb project's `generate` (`prisma generate`) is cached on\n *   `[\"default\"]`, which covers the Prisma schema and config. The Prisma\n *   version is hashed through the lockfile.\n * - A Terraform project's `output` is no longer cached: it reads remote state,\n *   which no input can hash, so a hit could replay values from before an apply.\n *\n * Each edit uses the generator's own constants, so a migrated workspace is\n * byte-identical to a freshly generated one, keys in the same order. A target\n * or glob that has diverged from the generated shape is left untouched and\n * reported.\n *\n * Changing `namedInputs.default` changes every task hash, so the first build\n * after migrating misses the cache throughout. Removing a churning input can\n * also let a target that reads a file it does not declare replay a stale\n * result, so that risk is reported whenever the glob is rewritten.\n */\n\nconst CURRENT_GLOB =\n  DEPENDENT_TASKS_OUTPUT_FILES_INPUT.dependentTasksOutputFiles;\n\nconst STALE_PASS_ADVISORY =\n  \"nx.json's 'default' input no longer hashes checkov reports or vitest coverage from upstream tasks. A target that reads a file it does not declare as an input (for example a test reading README.md) can now replay a cached result after that file changes; add such files to the target's inputs.\";\n\nconst SMITHY_TARGETS = ['compile', 'generate-ssdk'];\nconst RDB_INPUTS = ['default'];\nconst PRE_FIX_TERRAFORM_OUTPUT_INPUTS = ['default'];\n\nconst sameInputs = (\n  inputs: TargetConfiguration['inputs'],\n  expected: string[],\n): boolean =>\n  Array.isArray(inputs) &&\n  inputs.length === expected.length &&\n  inputs.every((input, index) => input === expected[index]);\n\nconst command = (target: TargetConfiguration): unknown =>\n  target.options?.command;\n\n/** Rewrites a previously vended glob; returns whether it did. */\nconst migrateGlob = (tree: Tree, nextSteps: string[]): boolean => {\n  const nxJson = readNxJson(tree);\n  const defaultInputs = nxJson?.namedInputs?.default;\n  if (!nxJson || !Array.isArray(defaultInputs)) return false;\n\n  // A dependentTasksOutputFiles entry is \"vended\" if it is already current or\n  // is one of the globs this plugin has shipped (and so would be rewritten to\n  // the current one below). An extra entry a user added beside it - neither\n  // current nor vended - is their own scoping decision and is reported only\n  // when no vended-or-current entry exists; otherwise it would be reported on\n  // every run with advice that could widen hashing.\n  const hasVendedOrCurrentEntry = defaultInputs.some(\n    (input) =>\n      typeof input === 'object' &&\n      input !== null &&\n      'dependentTasksOutputFiles' in input &&\n      (input.dependentTasksOutputFiles === CURRENT_GLOB ||\n        (input.transitive &&\n          VENDED_DEPENDENT_TASKS_OUTPUT_GLOBS.includes(\n            input.dependentTasksOutputFiles,\n          ))),\n  );\n\n  let rewrote = false;\n  nxJson.namedInputs.default = defaultInputs.map((input) => {\n    if (typeof input !== 'object' || !('dependentTasksOutputFiles' in input)) {\n      return input;\n    }\n    const glob = input.dependentTasksOutputFiles;\n    if (glob === CURRENT_GLOB) return input;\n    if (\n      input.transitive &&\n      VENDED_DEPENDENT_TASKS_OUTPUT_GLOBS.includes(glob)\n    ) {\n      rewrote = true;\n      return { ...input, dependentTasksOutputFiles: CURRENT_GLOB };\n    }\n    if (!hasVendedOrCurrentEntry) {\n      nextSteps.push(\n        `nx.json: the 'default' input's dependentTasksOutputFiles '${glob}' has diverged from the generated shape - left untouched. Consider excluding checkov reports and vitest coverage ('${CURRENT_GLOB}'), which otherwise miss every dependent task whenever a scan or coverage run rewrites them.`,\n      );\n    }\n    return input;\n  });\n\n  if (rewrote) updateNxJson(tree, nxJson);\n  return rewrote;\n};\n\nconst diverged = (projectName: string, targetName: string, advice: string) =>\n  `${projectName}:${targetName}: has diverged from the generated shape - left untouched. ${advice}`;\n\n/** Inserts `inputs` after `cache`, where the generator writes it. */\nconst migrateSmithyTarget = (\n  projectName: string,\n  targetName: string,\n  target: TargetConfiguration,\n  nextSteps: string[],\n): TargetConfiguration | undefined => {\n  if (sameInputs(target.inputs, SMITHY_TARGET_INPUTS)) return undefined;\n  if (target.inputs !== undefined || target.executor !== 'nx:run-commands') {\n    nextSteps.push(\n      diverged(\n        projectName,\n        targetName,\n        \"Confirm its inputs cover the Smithy sources and the outputs of the tasks it depends on, as ['default'] does.\",\n      ),\n    );\n    return undefined;\n  }\n  const { cache, ...rest } = target;\n  return { cache, inputs: [...SMITHY_TARGET_INPUTS], ...rest };\n};\n\n/** Inserts `cache` and `inputs` after `executor`, where the generator writes them. */\nconst migrateRdbGenerate = (\n  projectName: string,\n  target: TargetConfiguration,\n  nextSteps: string[],\n): TargetConfiguration | undefined => {\n  if (target.cache === true && sameInputs(target.inputs, RDB_INPUTS)) {\n    return undefined;\n  }\n  if (\n    target.executor !== 'nx:run-commands' ||\n    command(target) !== 'prisma generate' ||\n    target.cache !== undefined ||\n    target.inputs !== undefined\n  ) {\n    nextSteps.push(\n      diverged(\n        projectName,\n        'generate',\n        \"To cache Prisma client generation, set cache: true and inputs: ['default'], which covers the Prisma schema and config.\",\n      ),\n    );\n    return undefined;\n  }\n  const { executor, ...rest } = target;\n  return { executor, cache: true, inputs: [...RDB_INPUTS], ...rest };\n};\n\n/** Stops caching `output` in place and drops its inputs. */\nconst migrateTerraformOutput = (\n  projectName: string,\n  target: TargetConfiguration,\n  nextSteps: string[],\n): TargetConfiguration | undefined => {\n  if (target.cache !== true) return undefined;\n  if (\n    !sameInputs(target.inputs, PRE_FIX_TERRAFORM_OUTPUT_INPUTS) ||\n    command(target) !== 'terraform output -json'\n  ) {\n    nextSteps.push(\n      diverged(\n        projectName,\n        'output',\n        'A cached output can replay stale values after an apply; set cache: false.',\n      ),\n    );\n    return undefined;\n  }\n  const { inputs: _inputs, ...rest } = target;\n  return { ...rest, cache: false };\n};\n\nconst migrateProject = (\n  projectName: string,\n  project: ProjectConfiguration,\n  nextSteps: string[],\n): boolean => {\n  const generator = (project.metadata as { generator?: string } | undefined)\n    ?.generator;\n  const targets = project.targets ?? {};\n\n  const migrations: [string, () => TargetConfiguration | undefined][] =\n    generator === SMITHY_PROJECT_GENERATOR_INFO.id\n      ? SMITHY_TARGETS.map((name) => [\n          name,\n          () =>\n            migrateSmithyTarget(projectName, name, targets[name], nextSteps),\n        ])\n      : generator === TS_RDB_GENERATOR_INFO.id\n        ? [\n            [\n              'generate',\n              () =>\n                migrateRdbGenerate(projectName, targets.generate, nextSteps),\n            ],\n          ]\n        : generator === TERRAFORM_PROJECT_GENERATOR_INFO.id\n          ? [\n              [\n                'output',\n                () =>\n                  migrateTerraformOutput(\n                    projectName,\n                    targets.output,\n                    nextSteps,\n                  ),\n              ],\n            ]\n          : [];\n\n  let changed = false;\n  for (const [name, migrate] of migrations) {\n    if (!targets[name]) continue;\n    const migrated = migrate();\n    if (migrated) {\n      targets[name] = migrated;\n      changed = true;\n    }\n  }\n  return changed;\n};\n\nexport default async function migration(\n  tree: Tree,\n): Promise<MigrationReturnObject> {\n  const nextSteps: string[] = [];\n\n  const rewroteGlob = migrateGlob(tree, nextSteps);\n\n  for (const [projectName, project] of getProjects(tree)) {\n    if (migrateProject(projectName, project, nextSteps)) {\n      updateProjectConfiguration(tree, projectName, project);\n    }\n  }\n\n  if (rewroteGlob) nextSteps.push(STALE_PASS_ADVISORY);\n\n  await formatFilesInSubtree(tree);\n\n  return { nextSteps };\n}\n"],"names":["getProjects","readNxJson","updateNxJson","updateProjectConfiguration","SMITHY_PROJECT_GENERATOR_INFO","SMITHY_TARGET_INPUTS","TERRAFORM_PROJECT_GENERATOR_INFO","DEPENDENT_TASKS_OUTPUT_FILES_INPUT","VENDED_DEPENDENT_TASKS_OUTPUT_GLOBS","TS_RDB_GENERATOR_INFO","formatFilesInSubtree","CURRENT_GLOB","dependentTasksOutputFiles","STALE_PASS_ADVISORY","SMITHY_TARGETS","RDB_INPUTS","PRE_FIX_TERRAFORM_OUTPUT_INPUTS","sameInputs","inputs","expected","Array","isArray","length","every","input","index","command","target","options","migrateGlob","tree","nextSteps","nxJson","defaultInputs","namedInputs","default","hasVendedOrCurrentEntry","some","transitive","includes","rewrote","map","glob","push","diverged","projectName","targetName","advice","migrateSmithyTarget","undefined","executor","cache","rest","migrateRdbGenerate","migrateTerraformOutput","_inputs","migrateProject","project","generator","metadata","targets","migrations","id","name","generate","output","changed","migrate","migrated","migration","rewroteGlob"],"mappings":"AAAA;;;CAGC,GACD,SACEA,WAAW,EAGXC,UAAU,EAGVC,YAAY,EACZC,0BAA0B,QACrB,aAAa;AACpB,SACEC,6BAA6B,EAC7BC,oBAAoB,QACf,uCAAuC;AAC9C,SAASC,gCAAgC,QAAQ,0CAA0C;AAC3F,SACEC,kCAAkC,EAClCC,mCAAmC,QAC9B,+BAA+B;AACtC,SAASC,qBAAqB,QAAQ,+BAA+B;AACrE,SAASC,oBAAoB,QAAQ,2BAA2B;AAEhE;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;CA8BC,GAED,MAAMC,eACJJ,mCAAmCK,yBAAyB;AAE9D,MAAMC,sBACJ;AAEF,MAAMC,iBAAiB;IAAC;IAAW;CAAgB;AACnD,MAAMC,aAAa;IAAC;CAAU;AAC9B,MAAMC,kCAAkC;IAAC;CAAU;AAEnD,MAAMC,aAAa,CACjBC,QACAC,WAEAC,MAAMC,OAAO,CAACH,WACdA,OAAOI,MAAM,KAAKH,SAASG,MAAM,IACjCJ,OAAOK,KAAK,CAAC,CAACC,OAAOC,QAAUD,UAAUL,QAAQ,CAACM,MAAM;AAE1D,MAAMC,UAAU,CAACC,SACfA,OAAOC,OAAO,EAAEF;AAElB,+DAA+D,GAC/D,MAAMG,cAAc,CAACC,MAAYC;IAC/B,MAAMC,SAAS/B,WAAW6B;IAC1B,MAAMG,gBAAgBD,QAAQE,aAAaC;IAC3C,IAAI,CAACH,UAAU,CAACZ,MAAMC,OAAO,CAACY,gBAAgB,OAAO;IAErD,4EAA4E;IAC5E,4EAA4E;IAC5E,0EAA0E;IAC1E,0EAA0E;IAC1E,4EAA4E;IAC5E,kDAAkD;IAClD,MAAMG,0BAA0BH,cAAcI,IAAI,CAChD,CAACb,QACC,OAAOA,UAAU,YACjBA,UAAU,QACV,+BAA+BA,SAC9BA,CAAAA,MAAMZ,yBAAyB,KAAKD,gBAClCa,MAAMc,UAAU,IACf9B,oCAAoC+B,QAAQ,CAC1Cf,MAAMZ,yBAAyB,CAChC;IAGT,IAAI4B,UAAU;IACdR,OAAOE,WAAW,CAACC,OAAO,GAAGF,cAAcQ,GAAG,CAAC,CAACjB;QAC9C,IAAI,OAAOA,UAAU,YAAY,CAAE,CAAA,+BAA+BA,KAAI,GAAI;YACxE,OAAOA;QACT;QACA,MAAMkB,OAAOlB,MAAMZ,yBAAyB;QAC5C,IAAI8B,SAAS/B,cAAc,OAAOa;QAClC,IACEA,MAAMc,UAAU,IAChB9B,oCAAoC+B,QAAQ,CAACG,OAC7C;YACAF,UAAU;YACV,OAAO;gBAAE,GAAGhB,KAAK;gBAAEZ,2BAA2BD;YAAa;QAC7D;QACA,IAAI,CAACyB,yBAAyB;YAC5BL,UAAUY,IAAI,CACZ,CAAC,0DAA0D,EAAED,KAAK,mHAAmH,EAAE/B,aAAa,4FAA4F,CAAC;QAErS;QACA,OAAOa;IACT;IAEA,IAAIgB,SAAStC,aAAa4B,MAAME;IAChC,OAAOQ;AACT;AAEA,MAAMI,WAAW,CAACC,aAAqBC,YAAoBC,SACzD,GAAGF,YAAY,CAAC,EAAEC,WAAW,0DAA0D,EAAEC,QAAQ;AAEnG,mEAAmE,GACnE,MAAMC,sBAAsB,CAC1BH,aACAC,YACAnB,QACAI;IAEA,IAAId,WAAWU,OAAOT,MAAM,EAAEb,uBAAuB,OAAO4C;IAC5D,IAAItB,OAAOT,MAAM,KAAK+B,aAAatB,OAAOuB,QAAQ,KAAK,mBAAmB;QACxEnB,UAAUY,IAAI,CACZC,SACEC,aACAC,YACA;QAGJ,OAAOG;IACT;IACA,MAAM,EAAEE,KAAK,EAAE,GAAGC,MAAM,GAAGzB;IAC3B,OAAO;QAAEwB;QAAOjC,QAAQ;eAAIb;SAAqB;QAAE,GAAG+C,IAAI;IAAC;AAC7D;AAEA,oFAAoF,GACpF,MAAMC,qBAAqB,CACzBR,aACAlB,QACAI;IAEA,IAAIJ,OAAOwB,KAAK,KAAK,QAAQlC,WAAWU,OAAOT,MAAM,EAAEH,aAAa;QAClE,OAAOkC;IACT;IACA,IACEtB,OAAOuB,QAAQ,KAAK,qBACpBxB,QAAQC,YAAY,qBACpBA,OAAOwB,KAAK,KAAKF,aACjBtB,OAAOT,MAAM,KAAK+B,WAClB;QACAlB,UAAUY,IAAI,CACZC,SACEC,aACA,YACA;QAGJ,OAAOI;IACT;IACA,MAAM,EAAEC,QAAQ,EAAE,GAAGE,MAAM,GAAGzB;IAC9B,OAAO;QAAEuB;QAAUC,OAAO;QAAMjC,QAAQ;eAAIH;SAAW;QAAE,GAAGqC,IAAI;IAAC;AACnE;AAEA,0DAA0D,GAC1D,MAAME,yBAAyB,CAC7BT,aACAlB,QACAI;IAEA,IAAIJ,OAAOwB,KAAK,KAAK,MAAM,OAAOF;IAClC,IACE,CAAChC,WAAWU,OAAOT,MAAM,EAAEF,oCAC3BU,QAAQC,YAAY,0BACpB;QACAI,UAAUY,IAAI,CACZC,SACEC,aACA,UACA;QAGJ,OAAOI;IACT;IACA,MAAM,EAAE/B,QAAQqC,OAAO,EAAE,GAAGH,MAAM,GAAGzB;IACrC,OAAO;QAAE,GAAGyB,IAAI;QAAED,OAAO;IAAM;AACjC;AAEA,MAAMK,iBAAiB,CACrBX,aACAY,SACA1B;IAEA,MAAM2B,YAAaD,QAAQE,QAAQ,EAC/BD;IACJ,MAAME,UAAUH,QAAQG,OAAO,IAAI,CAAC;IAEpC,MAAMC,aACJH,cAActD,8BAA8B0D,EAAE,GAC1ChD,eAAe2B,GAAG,CAAC,CAACsB,OAAS;YAC3BA;YACA,IACEf,oBAAoBH,aAAakB,MAAMH,OAAO,CAACG,KAAK,EAAEhC;SACzD,IACD2B,cAAcjD,sBAAsBqD,EAAE,GACpC;QACE;YACE;YACA,IACET,mBAAmBR,aAAae,QAAQI,QAAQ,EAAEjC;SACrD;KACF,GACD2B,cAAcpD,iCAAiCwD,EAAE,GAC/C;QACE;YACE;YACA,IACER,uBACET,aACAe,QAAQK,MAAM,EACdlC;SAEL;KACF,GACD,EAAE;IAEZ,IAAImC,UAAU;IACd,KAAK,MAAM,CAACH,MAAMI,QAAQ,IAAIN,WAAY;QACxC,IAAI,CAACD,OAAO,CAACG,KAAK,EAAE;QACpB,MAAMK,WAAWD;QACjB,IAAIC,UAAU;YACZR,OAAO,CAACG,KAAK,GAAGK;YAChBF,UAAU;QACZ;IACF;IACA,OAAOA;AACT;AAEA,eAAe,eAAeG,UAC5BvC,IAAU;IAEV,MAAMC,YAAsB,EAAE;IAE9B,MAAMuC,cAAczC,YAAYC,MAAMC;IAEtC,KAAK,MAAM,CAACc,aAAaY,QAAQ,IAAIzD,YAAY8B,MAAO;QACtD,IAAI0B,eAAeX,aAAaY,SAAS1B,YAAY;YACnD5B,2BAA2B2B,MAAMe,aAAaY;QAChD;IACF;IAEA,IAAIa,aAAavC,UAAUY,IAAI,CAAC9B;IAEhC,MAAMH,qBAAqBoB;IAE3B,OAAO;QAAEC;IAAU;AACrB"}

package/src/migrations/latest/infra-test-loop/migration.js.map

@@ -1 +0,0 @@
-{"version":3,"sources":["../../../../../../../packages/nx-plugin/src/migrations/latest/infra-test-loop/migration.ts"],"sourcesContent":["/**\n * Copyright Amazon.com, Inc. or its affiliates. All Rights Reserved.\n * SPDX-License-Identifier: Apache-2.0\n */\nimport {\n  getProjects,\n  joinPathFragments,\n  type MigrationReturnObject,\n  type ProjectConfiguration,\n  type TargetConfiguration,\n  type Tree,\n  updateProjectConfiguration,\n} from '@nx/devkit';\nimport { INFRA_APP_GENERATOR_INFO } from '../../../infra/app/generator.js';\nimport { matchGritQL } from '../../../utils/ast.js';\nimport {\n  addCdkTestGlobalSetup,\n  CDK_TEST_GLOBAL_SETUP,\n  CDK_TEST_GLOBAL_SETUP_ENTRY,\n  findVitestConfig,\n  renderCdkTestGlobalSetup,\n} from '../../../utils/cdk-test-setup.js';\nimport { formatFilesInSubtree } from '../../../utils/format.js';\nimport { sortObjectKeys } from '../../../utils/object.js';\nimport {\n  PACKAGES_DIR,\n  SHARED_CONSTRUCTS_DIR,\n} from '../../../utils/shared-constructs-constants.js';\n\n/**\n * Run CDK infrastructure tests against the artifacts their stacks deploy, in a\n * per-run temp directory with CDK asset bundling skipped.\n *\n * The infra `test` target inherited the `^build` target default, so every\n * infra test run first ran every deployed project's lint, test, type-check and\n * bundle. The stacks only need the bundles: `Code.fromAsset` and its siblings\n * throw on a missing asset path, so the edge is narrowed to `^assemble` (the\n * artifact-only chain `synth` and `deploy` already use) rather than removed.\n *\n * Each `new App()` in a test synthesizes into a fresh `cdk.out*` directory\n * under the OS temp dir, which nothing removed, so a workspace's tests leaked\n * into the shared `/tmp`. The vended `tests/global-setup.ts` points `TMPDIR`,\n * `TEMP` and `TMP` at a directory of its own for the run and removes it in\n * teardown. aws-cdk-lib deletes the `cdk.out*` directories an `App` created\n * from a `process.on('exit')` handler, and vitest runs the global teardown\n * while its forked workers are still exiting, so a single `rmSync` can race\n * that delete and return with the directory still there. The teardown\n * therefore retries every 50 ms for up to 2 s, and warns (naming the\n * directory) rather than failing the run if it is still there. It also merges `aws:cdk:bundling-stacks: []` into\n * `CDK_CONTEXT_JSON`, which only affects user-written bundling constructs\n * (`NodejsFunction`, `PythonFunction`); the vended constructs read prebuilt\n * bundles. The setup is registered in the infra project's and the shared\n * constructs' vitest configs.\n *\n * Only the exact shape the generator wrote before is changed. A `test` target,\n * a `globalSetup`, a vitest config or a `tests/global-setup.ts` that differs is\n * left untouched and reported, and a setup file the plugin did not write is\n * never registered. The migration writes the generator's own template, so a migrated project is\n * byte-identical to a freshly generated one. Infra READMEs are left alone: the\n * generator writes them `KeepExisting`, and users edit them.\n */\n\nconst TEST_TARGET = 'test';\nconst TEST_DEPENDS_ON = ['^assemble'];\n\nconst isFixedTestTarget = (target: TargetConfiguration): boolean =>\n  Object.keys(target).length === 1 &&\n  Array.isArray(target.dependsOn) &&\n  target.dependsOn.length === TEST_DEPENDS_ON.length &&\n  target.dependsOn.every((dep, index) => dep === TEST_DEPENDS_ON[index]);\n\n/** Any `globalSetup` property in the config. */\nconst ANY_GLOBAL_SETUP = '`globalSetup: $_`';\n\n/** Exactly the entry the generator registers. */\nconst VENDED_GLOBAL_SETUP = `\\`globalSetup: ['${CDK_TEST_GLOBAL_SETUP_ENTRY}']\\``;\n\n/** The `defineConfig(() => ({ test: { ... } }))` shape the generator inserts into. */\nconst RECOGNISED_CONFIG = `\\`test: { $props }\\` where { $props <: within \\`defineConfig($_)\\` }`;\n\n/**\n * Vend and register the global setup for one project, unless any of its files\n * has diverged from the generated shape. Returns the reason it was skipped.\n */\nconst migrateGlobalSetup = async (\n  tree: Tree,\n  projectName: string,\n  root: string,\n): Promise<string | undefined> => {\n  const setupPath = joinPathFragments(root, CDK_TEST_GLOBAL_SETUP);\n  const configPath = findVitestConfig(tree, root);\n\n  if (!configPath) {\n    return `${projectName}: no vitest config found in ${root} - add \\`globalSetup: ['${CDK_TEST_GLOBAL_SETUP_ENTRY}']\\` to its \\`test\\` options to give each test run its own temp directory.`;\n  }\n\n  if (\n    tree.exists(setupPath) &&\n    (tree.read(setupPath, 'utf-8') ?? '') !== renderCdkTestGlobalSetup()\n  ) {\n    return `${projectName}: ${setupPath} differs from the vended global setup - left untouched and not registered. Compare it with a freshly generated one, which gives each test run its own temp directory and skips CDK asset bundling, then add \\`globalSetup: ['${CDK_TEST_GLOBAL_SETUP_ENTRY}']\\` to ${configPath}.`;\n  }\n\n  if (await matchGritQL(tree, configPath, ANY_GLOBAL_SETUP)) {\n    if (await matchGritQL(tree, configPath, VENDED_GLOBAL_SETUP)) {\n      await addCdkTestGlobalSetup(tree, root);\n      return undefined;\n    }\n    return `${projectName}: ${configPath} already declares a \\`globalSetup\\` - left untouched. Add '${CDK_TEST_GLOBAL_SETUP_ENTRY}' to it to give each test run its own temp directory.`;\n  }\n\n  if (!(await matchGritQL(tree, configPath, RECOGNISED_CONFIG))) {\n    return `${projectName}: ${configPath} has diverged from the generated shape - left untouched. Add \\`globalSetup: ['${CDK_TEST_GLOBAL_SETUP_ENTRY}']\\` to its \\`test\\` options to give each test run its own temp directory.`;\n  }\n\n  await addCdkTestGlobalSetup(tree, root);\n  return undefined;\n};\n\nexport default async function migration(\n  tree: Tree,\n): Promise<MigrationReturnObject> {\n  const nextSteps: string[] = [];\n\n  for (const [projectName, project] of getProjects(tree)) {\n    const generator = (project.metadata as { generator?: string } | undefined)\n      ?.generator;\n    if (generator !== INFRA_APP_GENERATOR_INFO.id) continue;\n\n    const testTarget = project.targets?.[TEST_TARGET];\n    if (!testTarget) {\n      updateProjectConfiguration(tree, projectName, {\n        ...project,\n        targets: sortObjectKeys({\n          ...project.targets,\n          [TEST_TARGET]: { dependsOn: [...TEST_DEPENDS_ON] },\n        }),\n      } as ProjectConfiguration);\n    } else if (!isFixedTestTarget(testTarget)) {\n      nextSteps.push(\n        `${projectName}: the \\`test\\` target in ${joinPathFragments(project.root, 'project.json')} has diverged from the generated shape - left untouched. Set its \\`dependsOn\\` to [\"^assemble\"] so tests build the deployed projects' artifacts rather than every upstream build.`,\n      );\n    }\n\n    const skipped = await migrateGlobalSetup(tree, projectName, project.root);\n    if (skipped) nextSteps.push(skipped);\n  }\n\n  const constructsRoot = joinPathFragments(PACKAGES_DIR, SHARED_CONSTRUCTS_DIR);\n  if (tree.exists(joinPathFragments(constructsRoot, 'project.json'))) {\n    const skipped = await migrateGlobalSetup(\n      tree,\n      constructsRoot,\n      constructsRoot,\n    );\n    if (skipped) nextSteps.push(skipped);\n  }\n\n  await formatFilesInSubtree(tree);\n\n  return { nextSteps };\n}\n"],"names":["getProjects","joinPathFragments","updateProjectConfiguration","INFRA_APP_GENERATOR_INFO","matchGritQL","addCdkTestGlobalSetup","CDK_TEST_GLOBAL_SETUP","CDK_TEST_GLOBAL_SETUP_ENTRY","findVitestConfig","renderCdkTestGlobalSetup","formatFilesInSubtree","sortObjectKeys","PACKAGES_DIR","SHARED_CONSTRUCTS_DIR","TEST_TARGET","TEST_DEPENDS_ON","isFixedTestTarget","target","Object","keys","length","Array","isArray","dependsOn","every","dep","index","ANY_GLOBAL_SETUP","VENDED_GLOBAL_SETUP","RECOGNISED_CONFIG","migrateGlobalSetup","tree","projectName","root","setupPath","configPath","exists","read","undefined","migration","nextSteps","project","generator","metadata","id","testTarget","targets","push","skipped","constructsRoot"],"mappings":"AAAA;;;CAGC,GACD,SACEA,WAAW,EACXC,iBAAiB,EAKjBC,0BAA0B,QACrB,aAAa;AACpB,SAASC,wBAAwB,QAAQ,kCAAkC;AAC3E,SAASC,WAAW,QAAQ,wBAAwB;AACpD,SACEC,qBAAqB,EACrBC,qBAAqB,EACrBC,2BAA2B,EAC3BC,gBAAgB,EAChBC,wBAAwB,QACnB,mCAAmC;AAC1C,SAASC,oBAAoB,QAAQ,2BAA2B;AAChE,SAASC,cAAc,QAAQ,2BAA2B;AAC1D,SACEC,YAAY,EACZC,qBAAqB,QAChB,gDAAgD;AAEvD;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;CA+BC,GAED,MAAMC,cAAc;AACpB,MAAMC,kBAAkB;IAAC;CAAY;AAErC,MAAMC,oBAAoB,CAACC,SACzBC,OAAOC,IAAI,CAACF,QAAQG,MAAM,KAAK,KAC/BC,MAAMC,OAAO,CAACL,OAAOM,SAAS,KAC9BN,OAAOM,SAAS,CAACH,MAAM,KAAKL,gBAAgBK,MAAM,IAClDH,OAAOM,SAAS,CAACC,KAAK,CAAC,CAACC,KAAKC,QAAUD,QAAQV,eAAe,CAACW,MAAM;AAEvE,8CAA8C,GAC9C,MAAMC,mBAAmB;AAEzB,+CAA+C,GAC/C,MAAMC,sBAAsB,CAAC,iBAAiB,EAAErB,4BAA4B,IAAI,CAAC;AAEjF,oFAAoF,GACpF,MAAMsB,oBAAoB,CAAC,oEAAoE,CAAC;AAEhG;;;CAGC,GACD,MAAMC,qBAAqB,OACzBC,MACAC,aACAC;IAEA,MAAMC,YAAYjC,kBAAkBgC,MAAM3B;IAC1C,MAAM6B,aAAa3B,iBAAiBuB,MAAME;IAE1C,IAAI,CAACE,YAAY;QACf,OAAO,GAAGH,YAAY,4BAA4B,EAAEC,KAAK,wBAAwB,EAAE1B,4BAA4B,0EAA0E,CAAC;IAC5L;IAEA,IACEwB,KAAKK,MAAM,CAACF,cACZ,AAACH,CAAAA,KAAKM,IAAI,CAACH,WAAW,YAAY,EAAC,MAAOzB,4BAC1C;QACA,OAAO,GAAGuB,YAAY,EAAE,EAAEE,UAAU,6NAA6N,EAAE3B,4BAA4B,QAAQ,EAAE4B,WAAW,CAAC,CAAC;IACxT;IAEA,IAAI,MAAM/B,YAAY2B,MAAMI,YAAYR,mBAAmB;QACzD,IAAI,MAAMvB,YAAY2B,MAAMI,YAAYP,sBAAsB;YAC5D,MAAMvB,sBAAsB0B,MAAME;YAClC,OAAOK;QACT;QACA,OAAO,GAAGN,YAAY,EAAE,EAAEG,WAAW,2DAA2D,EAAE5B,4BAA4B,qDAAqD,CAAC;IACtL;IAEA,IAAI,CAAE,MAAMH,YAAY2B,MAAMI,YAAYN,oBAAqB;QAC7D,OAAO,GAAGG,YAAY,EAAE,EAAEG,WAAW,8EAA8E,EAAE5B,4BAA4B,0EAA0E,CAAC;IAC9N;IAEA,MAAMF,sBAAsB0B,MAAME;IAClC,OAAOK;AACT;AAEA,eAAe,eAAeC,UAC5BR,IAAU;IAEV,MAAMS,YAAsB,EAAE;IAE9B,KAAK,MAAM,CAACR,aAAaS,QAAQ,IAAIzC,YAAY+B,MAAO;QACtD,MAAMW,YAAaD,QAAQE,QAAQ,EAC/BD;QACJ,IAAIA,cAAcvC,yBAAyByC,EAAE,EAAE;QAE/C,MAAMC,aAAaJ,QAAQK,OAAO,EAAE,CAAChC,YAAY;QACjD,IAAI,CAAC+B,YAAY;YACf3C,2BAA2B6B,MAAMC,aAAa;gBAC5C,GAAGS,OAAO;gBACVK,SAASnC,eAAe;oBACtB,GAAG8B,QAAQK,OAAO;oBAClB,CAAChC,YAAY,EAAE;wBAAES,WAAW;+BAAIR;yBAAgB;oBAAC;gBACnD;YACF;QACF,OAAO,IAAI,CAACC,kBAAkB6B,aAAa;YACzCL,UAAUO,IAAI,CACZ,GAAGf,YAAY,yBAAyB,EAAE/B,kBAAkBwC,QAAQR,IAAI,EAAE,gBAAgB,iLAAiL,CAAC;QAEhR;QAEA,MAAMe,UAAU,MAAMlB,mBAAmBC,MAAMC,aAAaS,QAAQR,IAAI;QACxE,IAAIe,SAASR,UAAUO,IAAI,CAACC;IAC9B;IAEA,MAAMC,iBAAiBhD,kBAAkBW,cAAcC;IACvD,IAAIkB,KAAKK,MAAM,CAACnC,kBAAkBgD,gBAAgB,kBAAkB;QAClE,MAAMD,UAAU,MAAMlB,mBACpBC,MACAkB,gBACAA;QAEF,IAAID,SAASR,UAAUO,IAAI,CAACC;IAC9B;IAEA,MAAMtC,qBAAqBqB;IAE3B,OAAO;QAAES;IAAU;AACrB"}

package/src/migrations/latest/pin-strands-express-peer/migration.js.map

@@ -1 +0,0 @@
-{"version":3,"sources":["../../../../../../../packages/nx-plugin/src/migrations/latest/pin-strands-express-peer/migration.ts"],"sourcesContent":["/**\n * Copyright Amazon.com, Inc. or its affiliates. All Rights Reserved.\n * SPDX-License-Identifier: Apache-2.0\n */\nimport { getProjects, joinPathFragments, type Tree } from '@nx/devkit';\nimport { AGENT_CONNECTION_PROJECT_DIR } from '../../../utils/agent-connection/agent-connection.js';\nimport { addDependenciesToPackageJson } from '../../../utils/dependencies.js';\nimport { formatFilesInSubtree } from '../../../utils/format.js';\nimport { TS_VERSIONS } from '../../../utils/versions.js';\n\nconst EXPRESS = 'express';\nconst STRANDS_SDK = '@strands-agents/sdk';\nconst ROOT_PACKAGE_JSON = 'package.json';\n\n/**\n * `express` is an optional peer of `@strands-agents/sdk` that any importer\n * declaring strands without also declaring express can leave undeclared. pnpm\n * suffixes each installed copy of a package by the versions of its peers, so\n * such an importer can resolve express to a different version than the pin\n * every other strands importer uses — splitting `@strands-agents/sdk` into two\n * peer-suffixed instances of the same version.\n *\n * Anything importing both instances then sees two nominal identities of every\n * SDK type — `Agent`, `McpClient`, `Plugin` — and fails to compile with \"Types\n * have separate declarations of a private property\". Declaring express\n * wherever strands is declared keeps the whole strands subgraph on the\n * catalog's single pin. Mirrors the earlier `@aws-sdk/client-s3` peer fix, one\n * optional peer further on.\n *\n * Detection is generic — every project's `package.json` plus the workspace\n * root, checked for \"declares @strands-agents/sdk but not express\" — rather\n * than listing the generators that currently produce that shape, so a future\n * strands importer this migration predates is still covered. The shared\n * agent-connection project is checked explicitly too, in case its project.json\n * is missing or not yet registered when this runs — `getProjects` would miss\n * it then, same as rc.95's `@aws-sdk/client-s3` migration guarded against.\n */\nexport default async function migration(tree: Tree): Promise<void> {\n  pinIfNeeded(tree, ROOT_PACKAGE_JSON);\n  pinIfNeeded(\n    tree,\n    joinPathFragments(AGENT_CONNECTION_PROJECT_DIR, 'package.json'),\n  );\n\n  for (const project of getProjects(tree).values()) {\n    pinIfNeeded(tree, joinPathFragments(project.root, 'package.json'));\n  }\n\n  await formatFilesInSubtree(tree);\n}\n\n/** Declare express on the given manifest, if it declares strands but not express. */\nfunction pinIfNeeded(tree: Tree, packageJsonPath: string): void {\n  if (!tree.exists(packageJsonPath)) {\n    return;\n  }\n\n  const packageJson = JSON.parse(tree.read(packageJsonPath, 'utf-8') ?? '{}');\n  // Only where a strands client is actually declared — that is what pulls the\n  // optional peer. An already-declared express (even a stale range) is left to\n  // addDependenciesToPackageJson, which resolves it onto the catalog.\n  if (!packageJson.dependencies?.[STRANDS_SDK]) {\n    return;\n  }\n\n  addDependenciesToPackageJson(\n    tree,\n    { [EXPRESS]: TS_VERSIONS[EXPRESS] },\n    {},\n    packageJsonPath,\n  );\n}\n"],"names":["getProjects","joinPathFragments","AGENT_CONNECTION_PROJECT_DIR","addDependenciesToPackageJson","formatFilesInSubtree","TS_VERSIONS","EXPRESS","STRANDS_SDK","ROOT_PACKAGE_JSON","migration","tree","pinIfNeeded","project","values","root","packageJsonPath","exists","packageJson","JSON","parse","read","dependencies"],"mappings":"AAAA;;;CAGC,GACD,SAASA,WAAW,EAAEC,iBAAiB,QAAmB,aAAa;AACvE,SAASC,4BAA4B,QAAQ,sDAAsD;AACnG,SAASC,4BAA4B,QAAQ,iCAAiC;AAC9E,SAASC,oBAAoB,QAAQ,2BAA2B;AAChE,SAASC,WAAW,QAAQ,6BAA6B;AAEzD,MAAMC,UAAU;AAChB,MAAMC,cAAc;AACpB,MAAMC,oBAAoB;AAE1B;;;;;;;;;;;;;;;;;;;;;;CAsBC,GACD,eAAe,eAAeC,UAAUC,IAAU;IAChDC,YAAYD,MAAMF;IAClBG,YACED,MACAT,kBAAkBC,8BAA8B;IAGlD,KAAK,MAAMU,WAAWZ,YAAYU,MAAMG,MAAM,GAAI;QAChDF,YAAYD,MAAMT,kBAAkBW,QAAQE,IAAI,EAAE;IACpD;IAEA,MAAMV,qBAAqBM;AAC7B;AAEA,mFAAmF,GACnF,SAASC,YAAYD,IAAU,EAAEK,eAAuB;IACtD,IAAI,CAACL,KAAKM,MAAM,CAACD,kBAAkB;QACjC;IACF;IAEA,MAAME,cAAcC,KAAKC,KAAK,CAACT,KAAKU,IAAI,CAACL,iBAAiB,YAAY;IACtE,4EAA4E;IAC5E,6EAA6E;IAC7E,oEAAoE;IACpE,IAAI,CAACE,YAAYI,YAAY,EAAE,CAACd,YAAY,EAAE;QAC5C;IACF;IAEAJ,6BACEO,MACA;QAAE,CAACJ,QAAQ,EAAED,WAAW,CAACC,QAAQ;IAAC,GAClC,CAAC,GACDS;AAEJ"}

package/src/migrations/latest/py-dynamodb-type-base-model-meta/migration.js.map

@@ -1 +0,0 @@
-{"version":3,"sources":["../../../../../../../packages/nx-plugin/src/migrations/latest/py-dynamodb-type-base-model-meta/migration.ts"],"sourcesContent":["/**\n * Copyright Amazon.com, Inc. or its affiliates. All Rights Reserved.\n * SPDX-License-Identifier: Apache-2.0\n */\nimport type { MigrationReturnObject, Tree } from '@nx/devkit';\nimport {\n  bindMetaBlock,\n  divergedMetaNextStep,\n  findMetaBlockShape,\n  META_BINDING,\n  pyDynamoDbBasePyPaths,\n  TYPED_IMPORT,\n  UNTYPED_IMPORT,\n  UNTYPED_META_HEADER,\n} from '../../../py/dynamodb/base-model-meta.js';\nimport { formatFilesInSubtree } from '../../../utils/format.js';\n\n/**\n * Type the `Meta` of the `BaseModel` that py#dynamodb vends in\n * `<module>/entities/base.py` as pynamodb's `MetaProtocol`.\n *\n * pynamodb declares `Model.Meta: MetaProtocol`, a mutable attribute. A nested\n * `class Meta:` defines only some of the protocol's members, which ty reports\n * as `invalid-attribute-override`; and any nested `class Meta`, even one\n * subclassing the protocol, declares `Meta` with the narrower type of that\n * class, which ty 0.0.87 reports as `invalid-mutable-override`. So the block is\n * declared as `class _Meta(MetaProtocol):` and bound with\n * `Meta: MetaProtocol = _Meta`, keeping the inherited type. Subclassing the\n * protocol declares every member with the protocol's type; the members it only\n * annotates are not set on the class, so pynamodb's runtime defaults apply as\n * before, and `Meta` is the same class object it was.\n *\n * The generator writes base.py once and keeps the user's copy, so this brings\n * existing workspaces up to date. A base.py is edited only where its import\n * line and `Meta` block still have the exact shape the generator wrote. One\n * that has diverged is left untouched and reported via `nextSteps`.\n */\n\n/**\n * Rewrite a base.py still in the generated shape. Already migrated and missing\n * files are left alone; a diverged one is reported via nextSteps.\n */\nconst migrateBasePy = (\n  tree: Tree,\n  filePath: string,\n  nextSteps: string[],\n): void => {\n  if (!tree.exists(filePath)) {\n    return;\n  }\n\n  const content = tree.read(filePath, 'utf-8') ?? '';\n  if (content.includes(META_BINDING)) {\n    return; // Already migrated (or user-added).\n  }\n\n  const shape = findMetaBlockShape(content, UNTYPED_META_HEADER);\n  if (!shape || !content.includes(UNTYPED_IMPORT)) {\n    nextSteps.push(divergedMetaNextStep(filePath));\n    return;\n  }\n\n  tree.write(\n    filePath,\n    bindMetaBlock(\n      content.replace(UNTYPED_IMPORT, TYPED_IMPORT),\n      UNTYPED_META_HEADER,\n      shape,\n    ),\n  );\n};\n\nexport default async function migration(\n  tree: Tree,\n): Promise<MigrationReturnObject> {\n  const nextSteps: string[] = [];\n\n  for (const filePath of pyDynamoDbBasePyPaths(tree)) {\n    migrateBasePy(tree, filePath, nextSteps);\n  }\n\n  await formatFilesInSubtree(tree);\n\n  return { nextSteps };\n}\n"],"names":["bindMetaBlock","divergedMetaNextStep","findMetaBlockShape","META_BINDING","pyDynamoDbBasePyPaths","TYPED_IMPORT","UNTYPED_IMPORT","UNTYPED_META_HEADER","formatFilesInSubtree","migrateBasePy","tree","filePath","nextSteps","exists","content","read","includes","shape","push","write","replace","migration"],"mappings":"AAAA;;;CAGC,GAED,SACEA,aAAa,EACbC,oBAAoB,EACpBC,kBAAkB,EAClBC,YAAY,EACZC,qBAAqB,EACrBC,YAAY,EACZC,cAAc,EACdC,mBAAmB,QACd,0CAA0C;AACjD,SAASC,oBAAoB,QAAQ,2BAA2B;AAEhE;;;;;;;;;;;;;;;;;;;CAmBC,GAED;;;CAGC,GACD,MAAMC,gBAAgB,CACpBC,MACAC,UACAC;IAEA,IAAI,CAACF,KAAKG,MAAM,CAACF,WAAW;QAC1B;IACF;IAEA,MAAMG,UAAUJ,KAAKK,IAAI,CAACJ,UAAU,YAAY;IAChD,IAAIG,QAAQE,QAAQ,CAACb,eAAe;QAClC,QAAQ,oCAAoC;IAC9C;IAEA,MAAMc,QAAQf,mBAAmBY,SAASP;IAC1C,IAAI,CAACU,SAAS,CAACH,QAAQE,QAAQ,CAACV,iBAAiB;QAC/CM,UAAUM,IAAI,CAACjB,qBAAqBU;QACpC;IACF;IAEAD,KAAKS,KAAK,CACRR,UACAX,cACEc,QAAQM,OAAO,CAACd,gBAAgBD,eAChCE,qBACAU;AAGN;AAEA,eAAe,eAAeI,UAC5BX,IAAU;IAEV,MAAME,YAAsB,EAAE;IAE9B,KAAK,MAAMD,YAAYP,sBAAsBM,MAAO;QAClDD,cAAcC,MAAMC,UAAUC;IAChC;IAEA,MAAMJ,qBAAqBE;IAE3B,OAAO;QAAEE;IAAU;AACrB"}

package/src/migrations/latest/rdb-drop-lambda-rie/migration.js.map

@@ -1 +0,0 @@
-{"version":3,"sources":["../../../../../../../packages/nx-plugin/src/migrations/latest/rdb-drop-lambda-rie/migration.ts"],"sourcesContent":["/**\n * Copyright Amazon.com, Inc. or its affiliates. All Rights Reserved.\n * SPDX-License-Identifier: Apache-2.0\n */\nimport {\n  getProjects,\n  joinPathFragments,\n  type MigrationReturnObject,\n  type Tree,\n} from '@nx/devkit';\nimport { PY_RDB_GENERATOR_INFO } from '../../../py/rdb/generator.js';\nimport { TS_RDB_GENERATOR_INFO } from '../../../ts/rdb/generator.js';\nimport { formatFilesInSubtree } from '../../../utils/format.js';\n\n/**\n * Remove the Lambda Runtime Interface Emulator (RIE) from the vended ts#rdb\n * and py#rdb Dockerfiles.\n *\n * `/lambda-entrypoint.sh` only invokes RIE when AWS_LAMBDA_RUNTIME_API is\n * unset, i.e. for local `docker run` emulation outside Lambda — the deployed\n * function never runs it. Its upstream build lags the Go toolchain, so it\n * carries known HIGH vulnerabilities (net/http and crypto/tls DoS CVEs) the\n * image scan flags with no fixed upstream image coming soon. Stripping it\n * follows the same pattern the templates already use for other unused,\n * vulnerable parts of the base image (py#rdb removing pip, ts#rdb removing\n * the runtime's AWS SDK copy). New workspaces get this from the generator\n * templates; this brings existing ones up to date.\n *\n * Only the three Dockerfiles the ts#rdb / py#rdb generators vend are touched,\n * located from each rdb project's root (recorded in its metadata). Each is\n * edited in place only where its comment + `RUN microdnf upgrade ...` block\n * still has the exact shape the generator wrote before this change; one that\n * has diverged (a customised comment or upgrade command) is left untouched\n * and reported via `nextSteps`.\n */\n\nconst AWS_LAMBDA_RIE = '/usr/local/bin/aws-lambda-rie';\n\n/**\n * The exact comment + `RUN microdnf upgrade ...` block ts#rdb's Dockerfile had\n * before this migration, and what it becomes.\n */\nconst TS_RDB_OLD_UPGRADE = `# Patch OS packages beyond the base image's pinned release, and drop the\n# runtime's convenience copy of the AWS SDK (the handler bundle inlines its\n# own dependencies), keeping the image free of known HIGH/CRITICAL\n# vulnerabilities\nRUN microdnf upgrade -y --releasever latest && microdnf clean all \\\\\n    && rm -rf /var/runtime/node_modules/@aws-sdk`;\nconst TS_RDB_NEW_UPGRADE = `# Patch OS packages beyond the base image's pinned release, and drop the\n# runtime's convenience copy of the AWS SDK (the handler bundle inlines its\n# own dependencies), keeping the image free of known HIGH/CRITICAL\n# vulnerabilities. Also drop the Lambda Runtime Interface Emulator: it is only\n# used for local \\`docker run\\` emulation outside Lambda, never by the deployed\n# function, and carries known HIGH vulnerabilities.\nRUN microdnf upgrade -y --releasever latest && microdnf clean all \\\\\n    && rm -rf /var/runtime/node_modules/@aws-sdk ${AWS_LAMBDA_RIE}`;\n\n/**\n * The exact comment + `RUN microdnf upgrade ...` block py#rdb's two Dockerfiles\n * had before this migration, and what it becomes. Both Dockerfile.migration and\n * Dockerfile.create-db-user share this block verbatim.\n */\nconst PY_RDB_OLD_UPGRADE = `# Patch OS packages beyond the base image's pinned release, and drop pip, whose\n# vendored copies of msgpack and setuptools carry known HIGH vulnerabilities.\n# The handler's dependencies are already installed in the image, so nothing\n# installs packages at runtime.\nRUN microdnf upgrade -y --releasever latest && microdnf clean all \\\\\n    && rm -rf /var/lang/lib/python*/site-packages/pip \\\\\n    /var/lang/lib/python*/site-packages/pip-*.dist-info`;\nconst PY_RDB_NEW_UPGRADE = `# Patch OS packages beyond the base image's pinned release, and drop pip, whose\n# vendored copies of msgpack and setuptools carry known HIGH vulnerabilities.\n# The handler's dependencies are already installed in the image, so nothing\n# installs packages at runtime. Also drop the Lambda Runtime Interface\n# Emulator: it is only used for local \\`docker run\\` emulation outside Lambda,\n# never by the deployed function, and carries known HIGH vulnerabilities.\nRUN microdnf upgrade -y --releasever latest && microdnf clean all \\\\\n    && rm -rf /var/lang/lib/python*/site-packages/pip \\\\\n    /var/lang/lib/python*/site-packages/pip-*.dist-info \\\\\n    ${AWS_LAMBDA_RIE}`;\n\n/** The marker checked to detect an already-migrated (or user-added) removal. */\nconst RIE_REMOVED_MARKER = AWS_LAMBDA_RIE;\n\nconst divergedNextStep = (filePath: string): string =>\n  `${filePath}: its microdnf upgrade command has been customised, so it was left unchanged. Remove the Lambda Runtime Interface Emulator by adding \"${AWS_LAMBDA_RIE}\" to its \"rm -rf\" — it is only used for local \\`docker run\\` emulation outside Lambda and carries known HIGH vulnerabilities.`;\n\n/**\n * Replace a Dockerfile's old comment + upgrade block with the new one, only\n * when the file still has the exact shape the generator wrote. Already\n * migrated and diverged files are both left alone; the latter is reported via\n * nextSteps.\n */\nconst migrateDockerfile = (\n  tree: Tree,\n  filePath: string,\n  oldBlock: string,\n  newBlock: string,\n  nextSteps: string[],\n): void => {\n  if (!tree.exists(filePath)) {\n    return;\n  }\n\n  const content = tree.read(filePath, 'utf-8') ?? '';\n  if (content.includes(RIE_REMOVED_MARKER)) {\n    return; // Already migrated (or user-added).\n  }\n\n  if (!content.includes(oldBlock)) {\n    nextSteps.push(divergedNextStep(filePath));\n    return;\n  }\n\n  tree.write(filePath, content.replace(oldBlock, newBlock));\n};\n\nexport default async function migration(\n  tree: Tree,\n): Promise<MigrationReturnObject> {\n  const nextSteps: string[] = [];\n\n  for (const project of getProjects(tree).values()) {\n    const generator = (project.metadata as { generator?: string } | undefined)\n      ?.generator;\n\n    if (generator === TS_RDB_GENERATOR_INFO.id) {\n      migrateDockerfile(\n        tree,\n        joinPathFragments(project.root, 'Dockerfile'),\n        TS_RDB_OLD_UPGRADE,\n        TS_RDB_NEW_UPGRADE,\n        nextSteps,\n      );\n    } else if (generator === PY_RDB_GENERATOR_INFO.id) {\n      migrateDockerfile(\n        tree,\n        joinPathFragments(project.root, 'Dockerfile.migration'),\n        PY_RDB_OLD_UPGRADE,\n        PY_RDB_NEW_UPGRADE,\n        nextSteps,\n      );\n      migrateDockerfile(\n        tree,\n        joinPathFragments(project.root, 'Dockerfile.create-db-user'),\n        PY_RDB_OLD_UPGRADE,\n        PY_RDB_NEW_UPGRADE,\n        nextSteps,\n      );\n    }\n  }\n\n  await formatFilesInSubtree(tree);\n\n  return { nextSteps };\n}\n"],"names":["getProjects","joinPathFragments","PY_RDB_GENERATOR_INFO","TS_RDB_GENERATOR_INFO","formatFilesInSubtree","AWS_LAMBDA_RIE","TS_RDB_OLD_UPGRADE","TS_RDB_NEW_UPGRADE","PY_RDB_OLD_UPGRADE","PY_RDB_NEW_UPGRADE","RIE_REMOVED_MARKER","divergedNextStep","filePath","migrateDockerfile","tree","oldBlock","newBlock","nextSteps","exists","content","read","includes","push","write","replace","migration","project","values","generator","metadata","id","root"],"mappings":"AAAA;;;CAGC,GACD,SACEA,WAAW,EACXC,iBAAiB,QAGZ,aAAa;AACpB,SAASC,qBAAqB,QAAQ,+BAA+B;AACrE,SAASC,qBAAqB,QAAQ,+BAA+B;AACrE,SAASC,oBAAoB,QAAQ,2BAA2B;AAEhE;;;;;;;;;;;;;;;;;;;;CAoBC,GAED,MAAMC,iBAAiB;AAEvB;;;CAGC,GACD,MAAMC,qBAAqB,CAAC;;;;;gDAKoB,CAAC;AACjD,MAAMC,qBAAqB,CAAC;;;;;;;iDAOqB,EAAEF,gBAAgB;AAEnE;;;;CAIC,GACD,MAAMG,qBAAqB,CAAC;;;;;;uDAM2B,CAAC;AACxD,MAAMC,qBAAqB,CAAC;;;;;;;;;IASxB,EAAEJ,gBAAgB;AAEtB,8EAA8E,GAC9E,MAAMK,qBAAqBL;AAE3B,MAAMM,mBAAmB,CAACC,WACxB,GAAGA,SAAS,sIAAsI,EAAEP,eAAe,6HAA6H,CAAC;AAEnS;;;;;CAKC,GACD,MAAMQ,oBAAoB,CACxBC,MACAF,UACAG,UACAC,UACAC;IAEA,IAAI,CAACH,KAAKI,MAAM,CAACN,WAAW;QAC1B;IACF;IAEA,MAAMO,UAAUL,KAAKM,IAAI,CAACR,UAAU,YAAY;IAChD,IAAIO,QAAQE,QAAQ,CAACX,qBAAqB;QACxC,QAAQ,oCAAoC;IAC9C;IAEA,IAAI,CAACS,QAAQE,QAAQ,CAACN,WAAW;QAC/BE,UAAUK,IAAI,CAACX,iBAAiBC;QAChC;IACF;IAEAE,KAAKS,KAAK,CAACX,UAAUO,QAAQK,OAAO,CAACT,UAAUC;AACjD;AAEA,eAAe,eAAeS,UAC5BX,IAAU;IAEV,MAAMG,YAAsB,EAAE;IAE9B,KAAK,MAAMS,WAAW1B,YAAYc,MAAMa,MAAM,GAAI;QAChD,MAAMC,YAAaF,QAAQG,QAAQ,EAC/BD;QAEJ,IAAIA,cAAczB,sBAAsB2B,EAAE,EAAE;YAC1CjB,kBACEC,MACAb,kBAAkByB,QAAQK,IAAI,EAAE,eAChCzB,oBACAC,oBACAU;QAEJ,OAAO,IAAIW,cAAc1B,sBAAsB4B,EAAE,EAAE;YACjDjB,kBACEC,MACAb,kBAAkByB,QAAQK,IAAI,EAAE,yBAChCvB,oBACAC,oBACAQ;YAEFJ,kBACEC,MACAb,kBAAkByB,QAAQK,IAAI,EAAE,8BAChCvB,oBACAC,oBACAQ;QAEJ;IACF;IAEA,MAAMb,qBAAqBU;IAE3B,OAAO;QAAEG;IAAU;AACrB"}