@aws/nx-plugin 1.1.1 → 1.3.0

package/src/utils/greengrass-constructs/files/terraform/core/greengrass/component-version/main.tf.template

@@ -0,0 +1,156 @@
+terraform {
+  required_providers {
+    aws = {
+      source  = "hashicorp/aws"
+      version = "<%- awsProviderVersion %>"
+    }
+    awscc = {
+      source  = "hashicorp/awscc"
+      version = "<%- awsccProviderVersion %>"
+    }
+  }
+}
+
+variable "recipes_dir" {
+  description = "Directory holding the one resolved recipe YAML the <c>-artifact target writes (greengrass-build/recipes). Read at plan time."
+  type        = string
+}
+
+variable "artifacts_dir" {
+  description = "Directory holding the <c>-artifact target's artifact tree (greengrass-build/artifacts), containing one file per manifest platform at <artifacts_dir>/<ComponentName>/<ComponentVersion>/."
+  type        = string
+}
+
+variable "bucket_name" {
+  # Use the artifact-bucket module output to wait for bucket hardening.
+  description = "Name of the shared artifact bucket this version's artifact is uploaded to."
+  type        = string
+}
+
+locals {
+  placeholder_prefix = "s3://BUCKET_NAME/COMPONENT_NAME/COMPONENT_VERSION/"
+
+  recipe_files      = fileset(var.recipes_dir, "*.y*ml")
+  recipe_candidate  = try(tolist(local.recipe_files)[0], null)
+  recipe_path       = "${var.recipes_dir}/${coalesce(local.recipe_candidate, "__no_recipe_found__")}"
+  recipe            = try(yamldecode(file(local.recipe_path)), {})
+  component_name    = try(local.recipe.ComponentName, "")
+  component_version = try(local.recipe.ComponentVersion, "")
+
+  artifact_dir       = "${var.artifacts_dir}/${local.component_name}/${local.component_version}"
+  artifact_files     = try(fileset(local.artifact_dir, "*"), [])
+  artifact_basenames = sort(tolist(local.artifact_files))
+  artifact_hashes    = { for f in local.artifact_basenames : f => filesha256("${local.artifact_dir}/${f}") }
+
+  # Hash the sorted artifact names and their content digests on both IaC paths.
+  sha256 = sha256(join("\n", [for f in local.artifact_basenames : "${f}:${local.artifact_hashes[f]}"]))
+
+  destination_key_prefix = "${local.component_name}/${substr(local.sha256, 0, 32)}/"
+  replacement_prefix     = "s3://${var.bucket_name}/${local.destination_key_prefix}"
+
+  # Substitute only managed artifact URIs, preserving other recipe fields
+  # and manifests without artifacts.
+  substituted_manifests = [
+    for manifest in try(local.recipe.Manifests, []) : merge(manifest, [
+      for _ in range(can(manifest.Artifacts) ? 1 : 0) : {
+        Artifacts = [
+          for artifact in manifest.Artifacts : merge(artifact, {
+            Uri = (
+              startswith(artifact.Uri, local.placeholder_prefix)
+              ? "${local.replacement_prefix}${substr(artifact.Uri, length(local.placeholder_prefix), -1)}"
+              : artifact.Uri
+            )
+          })
+        ]
+      }
+    ]...)
+  ]
+  substituted_recipe = merge(local.recipe, [
+    for _ in range(can(local.recipe.Manifests) ? 1 : 0) : {
+      Manifests = local.substituted_manifests
+    }
+  ]...)
+
+  substituted_basenames = distinct(flatten([
+    for manifest in try(local.recipe.Manifests, []) : [
+      for artifact in try(manifest.Artifacts, []) : substr(artifact.Uri, length(local.placeholder_prefix), -1)
+      if startswith(artifact.Uri, local.placeholder_prefix)
+    ]
+  ]))
+  missing_basenames      = setsubtract(toset(local.substituted_basenames), toset(local.artifact_basenames))
+  unreferenced_artifacts = setsubtract(toset(local.artifact_basenames), toset(local.substituted_basenames))
+}
+
+# Validate the recipe and artifact set before uploading or publishing.
+resource "terraform_data" "guard" {
+  lifecycle {
+    precondition {
+      condition     = length(local.recipe_files) == 1
+      error_message = "Expected exactly one resolved recipe in \"${var.recipes_dir}\" - run the component's \"-artifact\" target first. Found ${length(local.recipe_files)}."
+    }
+    precondition {
+      condition     = length(local.artifact_files) >= 1
+      error_message = "Expected at least one artifact for ${local.component_name}@${local.component_version} in \"${local.artifact_dir}\" - run the component's \"-artifact\" target first. Found ${length(local.artifact_files)}."
+    }
+    precondition {
+      condition     = length(local.missing_basenames) == 0
+      error_message = "\"${local.recipe_path}\" references artifact(s) ${join(", ", local.missing_basenames)}, but the files built for ${local.component_name}@${local.component_version} are ${join(", ", local.artifact_basenames)}. Make each recipe artifact Uri end in one of those names."
+    }
+    precondition {
+      condition     = length(local.unreferenced_artifacts) == 0
+      error_message = "The build produced artifact(s) ${join(", ", local.unreferenced_artifacts)} for ${local.component_name}@${local.component_version} that no manifest references. Add a manifest whose artifact Uri ends in each name, then bump ComponentVersion before re-applying."
+    }
+    precondition {
+      condition     = can(regex("^(0|[1-9][0-9]*)\\.(0|[1-9][0-9]*)\\.(0|[1-9][0-9]*)$", local.component_version))
+      error_message = "Terraform requires an explicit ComponentVersion such as 1.0.0; NEXT_PATCH, NEXT_MINOR and NEXT_MAJOR are supported only by CDK. Set ComponentVersion in recipe.yaml, rebuild the artifact, and plan again."
+    }
+  }
+}
+
+# Changed artifact content replaces object keys and deletes the outgoing objects.
+# Retain the publishing module before staged rollouts; see the generator guide.
+resource "aws_s3_object" "artifact" {
+  for_each = local.artifact_hashes
+
+  bucket      = var.bucket_name
+  key         = "${local.destination_key_prefix}${each.key}"
+  source      = "${local.artifact_dir}/${each.key}"
+  source_hash = each.value
+
+  depends_on = [terraform_data.guard]
+
+  # Upload the incoming object before deleting the outgoing key.
+  lifecycle {
+    create_before_destroy = true
+  }
+}
+
+# Recipe changes replace this immutable version; a reused version with changed
+# content fails creation before the outgoing version is deleted.
+resource "awscc_greengrassv2_component_version" "this" {
+  # JSON encoding keeps recipe field types intact.
+  inline_recipe = jsonencode(local.substituted_recipe)
+
+  # Publish only after all artifact uploads complete.
+  depends_on = [aws_s3_object.artifact]
+
+  # Create the new version before deleting the old one. Other fleets may still
+  # need the old version and objects; see the guide before a staged rollout.
+  lifecycle {
+    create_before_destroy = true
+  }
+}
+
+output "component_name" {
+  value = local.component_name
+}
+
+output "component_version" {
+  # Consumers wait for the published version before revising a deployment.
+  value      = local.component_version
+  depends_on = [awscc_greengrassv2_component_version.this]
+}
+
+output "arn" {
+  value = awscc_greengrassv2_component_version.this.arn
+}

package/src/utils/greengrass-constructs/files/terraform/core/greengrass/deployment/main.tf.template

@@ -0,0 +1,186 @@
+terraform {
+  required_providers {
+    aws = {
+      source  = "hashicorp/aws"
+      version = "<%- awsProviderVersion %>"
+    }
+    awscc = {
+      source  = "hashicorp/awscc"
+      version = "<%- awsccProviderVersion %>"
+    }
+  }
+}
+
+variable "thing_group_name" {
+  description = "Creates a new aws_iot_thing_group and deploys to it. Mutually exclusive with thing_name and target_arn."
+  type        = string
+  default     = null
+}
+
+variable "thing_name" {
+  description = "Deploys to an existing thing, imported by name (not created). Mutually exclusive with thing_group_name and target_arn."
+  type        = string
+  default     = null
+}
+
+variable "target_arn" {
+  description = "Deploys to an existing thing or thing group, imported by ARN (not created). Mutually exclusive with thing_group_name and thing_name."
+  type        = string
+  default     = null
+}
+
+variable "parent_target_arn" {
+  description = "ARN of the parent deployment, for a subdeployment onto a nested thing group."
+  type        = string
+  default     = null
+}
+
+variable "deployment_name" {
+  type    = string
+  default = null
+}
+
+variable "components" {
+  description = "Components to deploy, keyed by ComponentName. `configuration_update.merge`, if set, must already be a JSON-encoded string (matching the awscc schema) - use jsonencode() when building this map."
+  type = map(object({
+    component_version = optional(string)
+    configuration_update = optional(object({
+      merge = optional(string)
+      reset = optional(list(string))
+    }))
+    run_with = optional(object({
+      posix_user   = optional(string)
+      windows_user = optional(string)
+      system_resource_limits = optional(object({
+        cpus   = optional(number)
+        memory = optional(number)
+      }))
+    }))
+  }))
+  default = {}
+}
+
+variable "deployment_policies" {
+  type = object({
+    failure_handling_policy = optional(string)
+    component_update_policy = optional(object({
+      timeout_in_seconds = optional(number)
+      action             = optional(string)
+    }))
+    configuration_validation_policy = optional(object({
+      timeout_in_seconds = optional(number)
+    }))
+  })
+  default = null
+}
+
+variable "iot_job_configuration" {
+  type    = any
+  default = null
+}
+
+variable "tags" {
+  type    = map(string)
+  default = {}
+}
+
+data "aws_partition" "current" {}
+data "aws_region" "current" {}
+data "aws_caller_identity" "current" {}
+
+locals {
+  target_inputs_provided = compact([
+    var.thing_group_name != null ? "thing_group_name" : "",
+    var.thing_name != null ? "thing_name" : "",
+    var.target_arn != null ? "target_arn" : "",
+  ])
+
+  creating_thing_group = var.thing_group_name != null
+
+  target_arn = (
+    var.thing_group_name != null ? aws_iot_thing_group.this[0].arn :
+    var.thing_name != null ? "arn:${data.aws_partition.current.partition}:iot:${data.aws_region.current.region}:${data.aws_caller_identity.current.account_id}:thing/${var.thing_name}" :
+    var.target_arn
+  )
+
+  # Validate literal target ARNs against this configuration's partition,
+  # account and region.
+  target_arn_display   = var.target_arn != null ? var.target_arn : ""
+  target_arn_fields    = var.target_arn != null ? split(":", var.target_arn) : []
+  target_arn_parsed    = length(local.target_arn_fields) > 5
+  target_arn_partition = local.target_arn_parsed ? local.target_arn_fields[1] : ""
+  target_arn_service   = local.target_arn_parsed ? local.target_arn_fields[2] : ""
+  target_arn_region    = local.target_arn_parsed ? local.target_arn_fields[3] : ""
+  target_arn_account   = local.target_arn_parsed ? local.target_arn_fields[4] : ""
+
+  target_arn_mismatches = !local.target_arn_parsed ? [] : compact([
+    local.target_arn_service != "iot" ? "service \"${local.target_arn_service}\" is not \"iot\"" : "",
+    local.target_arn_partition != "" && local.target_arn_partition != data.aws_partition.current.partition ? "partition \"${local.target_arn_partition}\" does not match \"${data.aws_partition.current.partition}\"" : "",
+    local.target_arn_account != "" && local.target_arn_account != data.aws_caller_identity.current.account_id ? "account \"${local.target_arn_account}\" does not match \"${data.aws_caller_identity.current.account_id}\"" : "",
+    local.target_arn_region != "" && local.target_arn_region != data.aws_region.current.region ? "region \"${local.target_arn_region}\" does not match \"${data.aws_region.current.region}\"" : "",
+  ])
+
+  # Allow configuration-only entries without a component version.
+  next_version_sentinel_components = [
+    for component_name, component in var.components : component_name
+    if contains(["NEXT_PATCH", "NEXT_MINOR", "NEXT_MAJOR"], component.component_version == null ? "" : component.component_version)
+  ]
+}
+
+resource "terraform_data" "guard" {
+  lifecycle {
+    precondition {
+      condition     = length(local.target_inputs_provided) == 1
+      error_message = "greengrass deployment requires exactly one of thing_group_name, thing_name or target_arn, got: ${length(local.target_inputs_provided) == 0 ? "(none)" : join(", ", local.target_inputs_provided)}."
+    }
+    # Validate before creating the deployment; a module dependency can defer
+    # identity reads and this check to apply.
+    precondition {
+      condition     = length(local.target_arn_mismatches) == 0
+      error_message = "target_arn \"${local.target_arn_display}\" looks like it belongs to a different environment than this configuration: ${join(", ", local.target_arn_mismatches)}."
+    }
+    precondition {
+      condition     = length(local.next_version_sentinel_components) == 0
+      error_message = "Component(s) ${join(", ", local.next_version_sentinel_components)} use NEXT_* version markers. Terraform requires explicit versions such as 1.0.0; automatic versioning is supported only by CDK."
+    }
+  }
+}
+
+resource "aws_iot_thing_group" "this" {
+  count = local.creating_thing_group ? 1 : 0
+  name  = var.thing_group_name
+  tags  = var.tags
+
+  depends_on = [terraform_data.guard]
+}
+
+# Deleting a deployment removes cloud management state; uninstall components
+# through a deployment revision first.
+resource "awscc_greengrassv2_deployment" "this" {
+  deployment_name       = var.deployment_name
+  target_arn            = local.target_arn
+  parent_target_arn     = var.parent_target_arn
+  components            = var.components
+  deployment_policies   = var.deployment_policies
+  iot_job_configuration = var.iot_job_configuration
+  tags                  = var.tags
+
+  depends_on = [terraform_data.guard]
+
+  # Create the new deployment revision before deleting the superseded resource.
+  lifecycle {
+    create_before_destroy = true
+  }
+}
+
+output "target_arn" {
+  value = local.target_arn
+}
+
+output "deployment_id" {
+  value = awscc_greengrassv2_deployment.this.deployment_id
+}
+
+output "thing_group_arn" {
+  value = local.creating_thing_group ? aws_iot_thing_group.this[0].arn : null
+}

package/src/utils/greengrass-constructs/greengrass-constructs.d.ts

@@ -0,0 +1,57 @@
+/**
+ * Copyright Amazon.com, Inc. or its affiliates. All Rights Reserved.
+ * SPDX-License-Identifier: Apache-2.0
+ */
+import { type Tree } from '@nx/devkit';
+import type { DependencyDeclaration, MustDeclare } from '../declared-dependencies.js';
+import type { Iac } from '../iac.js';
+import type { IacMetadata } from '../shared-constructs-constants.js';
+/** CDK recipe parsing and the deploy-time version resolver dependencies. */
+export declare const GREENGRASS_CONSTRUCTS_DEPENDENCIES: readonly [{
+    readonly name: "js-yaml";
+    readonly when: (m: IacMetadata) => boolean;
+}, {
+    readonly name: "@types/js-yaml";
+    readonly dev: true;
+    readonly when: (m: IacMetadata) => boolean;
+}, {
+    readonly name: "@aws-sdk/client-greengrassv2";
+    readonly when: (m: IacMetadata) => boolean;
+}];
+/**
+ * Vends the shared `GreengrassArtifactBucket` / `GreengrassComponentVersion` /
+ * `GreengrassDeployment` / recipe-reader constructs (CDK) or modules
+ * (Terraform, via the `hashicorp/awscc` provider - neither
+ * `AWS::GreengrassV2::ComponentVersion` nor `AWS::GreengrassV2::Deployment`
+ * exists in the pinned `hashicorp/aws` provider) into
+ * `common/constructs/src/core/greengrass/` or
+ * `common/terraform/src/core/greengrass/`. Existing core files are preserved
+ * on later component runs; missing files are added. Idempotent: called from
+ * every component generator run.
+ */
+export declare const addGreengrassCoreConstructs: <const D extends DependencyDeclaration>(tree: Tree, { iac }: {
+    iac: Iac;
+}, declaration: D & MustDeclare<typeof GREENGRASS_CONSTRUCTS_DEPENDENCIES, D>) => Promise<void>;
+export interface AddGreengrassComponentAppConstructOptions {
+    readonly iac: Iac;
+    readonly componentNameClassName: string;
+    readonly componentDisplayName: string;
+    readonly componentDirName: string;
+    readonly project: string;
+    /** The host project whose `<c>-artifact` target this construct reads at synth time. */
+    readonly hostProjectName: string;
+    readonly recipesDirFromRoot: string;
+    readonly artifactsDirFromRoot: string;
+}
+/**
+ * Vends the per-component app construct/module: a thin
+ * `GreengrassComponentVersion` wrapper pinning this component's build output
+ * paths, at `common/constructs/src/app/greengrass/<componentDirName>.ts`
+ * (CDK) or `common/terraform/src/app/greengrass-component/<componentDirName>/`
+ * (Terraform, taking the artifact bucket's name as a plain input variable so
+ * user IaC can own or import the shared artifact repository).
+ * `OverwriteStrategy.KeepExisting` either way. Registers the host project on
+ * the shared iac project's `build`/`assemble` targets so `nx run
+ * <infra>:deploy` always deploys a freshly built artifact.
+ */
+export declare const addGreengrassComponentAppConstruct: <const D extends DependencyDeclaration>(tree: Tree, options: AddGreengrassComponentAppConstructOptions, declaration: D & MustDeclare<typeof GREENGRASS_CONSTRUCTS_DEPENDENCIES, D>) => Promise<void>;

package/src/utils/greengrass-constructs/greengrass-constructs.js

@@ -0,0 +1,154 @@
+/**
+ * Copyright Amazon.com, Inc. or its affiliates. All Rights Reserved.
+ * SPDX-License-Identifier: Apache-2.0
+ */ import { generateFiles, getProjects, joinPathFragments, logger, OverwriteStrategy, updateJson } from "@nx/devkit";
+import { addStarExport, applyGritQL, matchGritQL } from "../ast.js";
+import { forDependencies } from "../declared-dependencies.js";
+import { addDependenciesToPackageJson } from "../dependencies.js";
+import { buildDefaultComponentName } from "../greengrass/naming.js";
+import { esmVars } from "../module-format.js";
+import { addArtifactProjectToTargets } from "../nx.js";
+import { PACKAGES_DIR, SHARED_CONSTRUCTS_DIR, SHARED_TERRAFORM_DIR } from "../shared-constructs-constants.js";
+import { cdkLambdaRuntimeVars, terraformProviderVersions, withVersions } from "../versions.js";
+/** CDK recipe parsing and the deploy-time version resolver dependencies. */ export const GREENGRASS_CONSTRUCTS_DEPENDENCIES = [
+    {
+        name: 'js-yaml',
+        when: (m)=>m.iac === 'cdk'
+    },
+    {
+        name: '@types/js-yaml',
+        dev: true,
+        when: (m)=>m.iac === 'cdk'
+    },
+    {
+        name: '@aws-sdk/client-greengrassv2',
+        when: (m)=>m.iac === 'cdk'
+    }
+];
+const CORE_GREENGRASS_DIR = joinPathFragments(PACKAGES_DIR, SHARED_CONSTRUCTS_DIR, 'src', 'core', 'greengrass');
+const APP_GREENGRASS_DIR = joinPathFragments(PACKAGES_DIR, SHARED_CONSTRUCTS_DIR, 'src', 'app', 'greengrass');
+const CORE_GREENGRASS_TERRAFORM_DIR = joinPathFragments(PACKAGES_DIR, SHARED_TERRAFORM_DIR, 'src', 'core', 'greengrass');
+const APP_GREENGRASS_COMPONENT_TERRAFORM_DIR = joinPathFragments(PACKAGES_DIR, SHARED_TERRAFORM_DIR, 'src', 'app', 'greengrass-component');
+/** Add the awscc requirement and default configuration to existing root modules. */ const configureGreengrassTerraformProviders = async (tree)=>{
+    const roots = [
+        ...getProjects(tree).values()
+    ].filter((project)=>project.projectType === 'application').map((project)=>project.sourceRoot ?? joinPathFragments(project.root, 'src')).filter((root)=>tree.children(root).some((name)=>name.endsWith('.tf')));
+    if (roots.length === 0) {
+        logger.warn('Create a terraform#project application and re-run greengrass#component to configure awscc, ' + 'or declare hashicorp/awscc and provider "awscc" { region = var.aws_region } in your root module.');
+    }
+    for (const root of roots){
+        const paths = tree.children(root).filter((name)=>name.endsWith('.tf')).map((name)=>joinPathFragments(root, name));
+        const requirement = `awscc = {
+      source  = "hashicorp/awscc"
+      version = "${terraformProviderVersions().awsccProviderVersion}"
+    }`;
+        let requirementPath;
+        let configured = false;
+        for (const path of paths){
+            if (await matchGritQL(tree, path, 'language hcl\n`required_providers { $_ }`')) {
+                requirementPath ??= path;
+            }
+            configured ||= await matchGritQL(tree, path, 'language hcl\n`provider "awscc" { $config }` where { $config <: not contains `alias = $_` }');
+        }
+        if (!requirementPath) {
+            requirementPath = joinPathFragments(root, 'greengrass-providers.tf');
+            if (tree.exists(requirementPath)) {
+                throw new Error(`Cannot add awscc required_providers: ${requirementPath} already exists without a terraform block. Configure awscc in the root module.`);
+            }
+            tree.write(requirementPath, `terraform {\n  required_providers {\n    ${requirement}\n  }\n}\n`);
+        } else {
+            const filledEmptyBlock = await applyGritQL(tree, requirementPath, `language hcl\n\`required_providers {}\` => \`required_providers {\n    ${requirement}\n  }\``);
+            if (!filledEmptyBlock) {
+                await applyGritQL(tree, requirementPath, 'language hcl\n`required_providers { $providers }` where { ' + '$providers <: not contains `awscc = $_`, ' + `$providers += \`\n    ${requirement}\` }`);
+            }
+        }
+        if (!configured) {
+            tree.write(requirementPath, `${tree.read(requirementPath, 'utf-8').trimEnd()}\n\nprovider "awscc" {\n  region = var.aws_region\n}\n`);
+        }
+    }
+};
+/** Registers `projectName`'s artifact target on the shared iac project the caller vended into. */ const addArtifactProjectToSharedTargets = (tree, iac, projectName)=>{
+    updateJson(tree, joinPathFragments(PACKAGES_DIR, iac === 'cdk' ? SHARED_CONSTRUCTS_DIR : SHARED_TERRAFORM_DIR, 'project.json'), (config)=>{
+        addArtifactProjectToTargets(config, projectName);
+        return config;
+    });
+};
+/**
+ * Vends the shared `GreengrassArtifactBucket` / `GreengrassComponentVersion` /
+ * `GreengrassDeployment` / recipe-reader constructs (CDK) or modules
+ * (Terraform, via the `hashicorp/awscc` provider - neither
+ * `AWS::GreengrassV2::ComponentVersion` nor `AWS::GreengrassV2::Deployment`
+ * exists in the pinned `hashicorp/aws` provider) into
+ * `common/constructs/src/core/greengrass/` or
+ * `common/terraform/src/core/greengrass/`. Existing core files are preserved
+ * on later component runs; missing files are added. Idempotent: called from
+ * every component generator run.
+ */ export const addGreengrassCoreConstructs = async (tree, { iac }, declaration)=>{
+    const componentName = buildDefaultComponentName(tree, 'Namespace');
+    const componentKeyPrefix = `${componentName.slice(0, componentName.lastIndexOf('.'))}.*`;
+    if (iac === 'terraform') {
+        await configureGreengrassTerraformProviders(tree);
+        generateFiles(tree, joinPathFragments(import.meta.dirname, 'files', 'terraform', 'core', 'greengrass'), CORE_GREENGRASS_TERRAFORM_DIR, {
+            ...terraformProviderVersions(),
+            componentKeyPrefix
+        }, {
+            overwriteStrategy: OverwriteStrategy.KeepExisting
+        });
+        return;
+    }
+    if (iac !== 'cdk') {
+        throw new Error(`Unsupported iac ${iac}`);
+    }
+    generateFiles(tree, joinPathFragments(import.meta.dirname, 'files', 'cdk', 'core', 'greengrass'), CORE_GREENGRASS_DIR, {
+        ...esmVars(tree),
+        ...cdkLambdaRuntimeVars(),
+        componentKeyPrefix
+    }, {
+        overwriteStrategy: OverwriteStrategy.KeepExisting
+    });
+    generateFiles(tree, joinPathFragments(import.meta.dirname, 'files', 'next-version'), joinPathFragments(CORE_GREENGRASS_DIR, 'next-version'), {
+        nextVersionFileName: 'index.js'
+    }, {
+        overwriteStrategy: OverwriteStrategy.KeepExisting
+    });
+    await addStarExport(tree, joinPathFragments(PACKAGES_DIR, SHARED_CONSTRUCTS_DIR, 'src', 'core', 'index.ts'), './greengrass/index.js');
+    addDependenciesToPackageJson(tree, withVersions(forDependencies(declaration), [
+        'js-yaml',
+        '@aws-sdk/client-greengrassv2'
+    ]), withVersions(forDependencies(declaration), [
+        '@types/js-yaml'
+    ]), joinPathFragments(PACKAGES_DIR, SHARED_CONSTRUCTS_DIR, 'package.json'));
+};
+/**
+ * Vends the per-component app construct/module: a thin
+ * `GreengrassComponentVersion` wrapper pinning this component's build output
+ * paths, at `common/constructs/src/app/greengrass/<componentDirName>.ts`
+ * (CDK) or `common/terraform/src/app/greengrass-component/<componentDirName>/`
+ * (Terraform, taking the artifact bucket's name as a plain input variable so
+ * user IaC can own or import the shared artifact repository).
+ * `OverwriteStrategy.KeepExisting` either way. Registers the host project on
+ * the shared iac project's `build`/`assemble` targets so `nx run
+ * <infra>:deploy` always deploys a freshly built artifact.
+ */ export const addGreengrassComponentAppConstruct = async (tree, options, declaration)=>{
+    await addGreengrassCoreConstructs(tree, {
+        iac: options.iac
+    }, forDependencies(declaration));
+    if (options.iac === 'terraform') {
+        generateFiles(tree, joinPathFragments(import.meta.dirname, 'files', 'terraform', 'app', 'greengrass-component'), APP_GREENGRASS_COMPONENT_TERRAFORM_DIR, options, {
+            overwriteStrategy: OverwriteStrategy.KeepExisting
+        });
+        addArtifactProjectToSharedTargets(tree, 'terraform', options.hostProjectName);
+        return;
+    }
+    generateFiles(tree, joinPathFragments(import.meta.dirname, 'files', 'cdk', 'app', 'greengrass-component'), APP_GREENGRASS_DIR, {
+        ...options,
+        ...esmVars(tree)
+    }, {
+        overwriteStrategy: OverwriteStrategy.KeepExisting
+    });
+    await addStarExport(tree, joinPathFragments(APP_GREENGRASS_DIR, 'index.ts'), `./${options.componentDirName}.js`);
+    await addStarExport(tree, joinPathFragments(PACKAGES_DIR, SHARED_CONSTRUCTS_DIR, 'src', 'app', 'index.ts'), './greengrass/index.js');
+    addArtifactProjectToSharedTargets(tree, 'cdk', options.hostProjectName);
+};
+
+//# sourceMappingURL=greengrass-constructs.js.map

package/src/utils/greengrass-constructs/greengrass-constructs.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../../../../../../packages/nx-plugin/src/utils/greengrass-constructs/greengrass-constructs.ts"],"sourcesContent":["/**\n * Copyright Amazon.com, Inc. or its affiliates. All Rights Reserved.\n * SPDX-License-Identifier: Apache-2.0\n */\nimport {\n  generateFiles,\n  getProjects,\n  joinPathFragments,\n  logger,\n  OverwriteStrategy,\n  type ProjectConfiguration,\n  type Tree,\n  updateJson,\n} from '@nx/devkit';\nimport { addStarExport, applyGritQL, matchGritQL } from '../ast.js';\nimport type {\n  DependencyDeclaration,\n  MustDeclare,\n} from '../declared-dependencies.js';\nimport { forDependencies } from '../declared-dependencies.js';\nimport { addDependenciesToPackageJson } from '../dependencies.js';\nimport { buildDefaultComponentName } from '../greengrass/naming.js';\nimport type { Iac } from '../iac.js';\nimport { esmVars } from '../module-format.js';\nimport { addArtifactProjectToTargets } from '../nx.js';\nimport type { IacMetadata } from '../shared-constructs-constants.js';\nimport {\n  PACKAGES_DIR,\n  SHARED_CONSTRUCTS_DIR,\n  SHARED_TERRAFORM_DIR,\n} from '../shared-constructs-constants.js';\nimport {\n  cdkLambdaRuntimeVars,\n  type ITsDepVersion,\n  terraformProviderVersions,\n  withVersions,\n} from '../versions.js';\n\n/** CDK recipe parsing and the deploy-time version resolver dependencies. */\nexport const GREENGRASS_CONSTRUCTS_DEPENDENCIES = [\n  { name: 'js-yaml', when: (m: IacMetadata) => m.iac === 'cdk' },\n  {\n    name: '@types/js-yaml',\n    dev: true,\n    when: (m: IacMetadata) => m.iac === 'cdk',\n  },\n  {\n    name: '@aws-sdk/client-greengrassv2',\n    when: (m: IacMetadata) => m.iac === 'cdk',\n  },\n] as const satisfies readonly {\n  name: ITsDepVersion;\n  dev?: boolean;\n  root?: boolean;\n  when?: (m: IacMetadata) => boolean;\n}[];\n\nconst CORE_GREENGRASS_DIR = joinPathFragments(\n  PACKAGES_DIR,\n  SHARED_CONSTRUCTS_DIR,\n  'src',\n  'core',\n  'greengrass',\n);\nconst APP_GREENGRASS_DIR = joinPathFragments(\n  PACKAGES_DIR,\n  SHARED_CONSTRUCTS_DIR,\n  'src',\n  'app',\n  'greengrass',\n);\nconst CORE_GREENGRASS_TERRAFORM_DIR = joinPathFragments(\n  PACKAGES_DIR,\n  SHARED_TERRAFORM_DIR,\n  'src',\n  'core',\n  'greengrass',\n);\nconst APP_GREENGRASS_COMPONENT_TERRAFORM_DIR = joinPathFragments(\n  PACKAGES_DIR,\n  SHARED_TERRAFORM_DIR,\n  'src',\n  'app',\n  'greengrass-component',\n);\n/** Add the awscc requirement and default configuration to existing root modules. */\nconst configureGreengrassTerraformProviders = async (\n  tree: Tree,\n): Promise<void> => {\n  const roots = [...getProjects(tree).values()]\n    .filter((project) => project.projectType === 'application')\n    .map(\n      (project) => project.sourceRoot ?? joinPathFragments(project.root, 'src'),\n    )\n    .filter((root) => tree.children(root).some((name) => name.endsWith('.tf')));\n  if (roots.length === 0) {\n    logger.warn(\n      'Create a terraform#project application and re-run greengrass#component to configure awscc, ' +\n        'or declare hashicorp/awscc and provider \"awscc\" { region = var.aws_region } in your root module.',\n    );\n  }\n  for (const root of roots) {\n    const paths = tree\n      .children(root)\n      .filter((name) => name.endsWith('.tf'))\n      .map((name) => joinPathFragments(root, name));\n    const requirement = `awscc = {\n      source  = \"hashicorp/awscc\"\n      version = \"${terraformProviderVersions().awsccProviderVersion}\"\n    }`;\n    let requirementPath: string | undefined;\n    let configured = false;\n    for (const path of paths) {\n      if (\n        await matchGritQL(\n          tree,\n          path,\n          'language hcl\\n`required_providers { $_ }`',\n        )\n      ) {\n        requirementPath ??= path;\n      }\n      configured ||= await matchGritQL(\n        tree,\n        path,\n        'language hcl\\n`provider \"awscc\" { $config }` where { $config <: not contains `alias = $_` }',\n      );\n    }\n    if (!requirementPath) {\n      requirementPath = joinPathFragments(root, 'greengrass-providers.tf');\n      if (tree.exists(requirementPath)) {\n        throw new Error(\n          `Cannot add awscc required_providers: ${requirementPath} already exists without a terraform block. Configure awscc in the root module.`,\n        );\n      }\n      tree.write(\n        requirementPath,\n        `terraform {\\n  required_providers {\\n    ${requirement}\\n  }\\n}\\n`,\n      );\n    } else {\n      const filledEmptyBlock = await applyGritQL(\n        tree,\n        requirementPath,\n        `language hcl\\n\\`required_providers {}\\` => \\`required_providers {\\n    ${requirement}\\n  }\\``,\n      );\n      if (!filledEmptyBlock) {\n        await applyGritQL(\n          tree,\n          requirementPath,\n          'language hcl\\n`required_providers { $providers }` where { ' +\n            '$providers <: not contains `awscc = $_`, ' +\n            `$providers += \\`\\n    ${requirement}\\` }`,\n        );\n      }\n    }\n    if (!configured) {\n      tree.write(\n        requirementPath,\n        `${tree.read(requirementPath, 'utf-8')!.trimEnd()}\\n\\nprovider \"awscc\" {\\n  region = var.aws_region\\n}\\n`,\n      );\n    }\n  }\n};\n\n/** Registers `projectName`'s artifact target on the shared iac project the caller vended into. */\nconst addArtifactProjectToSharedTargets = (\n  tree: Tree,\n  iac: Iac,\n  projectName: string,\n): void => {\n  updateJson(\n    tree,\n    joinPathFragments(\n      PACKAGES_DIR,\n      iac === 'cdk' ? SHARED_CONSTRUCTS_DIR : SHARED_TERRAFORM_DIR,\n      'project.json',\n    ),\n    (config: ProjectConfiguration) => {\n      addArtifactProjectToTargets(config, projectName);\n      return config;\n    },\n  );\n};\n\n/**\n * Vends the shared `GreengrassArtifactBucket` / `GreengrassComponentVersion` /\n * `GreengrassDeployment` / recipe-reader constructs (CDK) or modules\n * (Terraform, via the `hashicorp/awscc` provider - neither\n * `AWS::GreengrassV2::ComponentVersion` nor `AWS::GreengrassV2::Deployment`\n * exists in the pinned `hashicorp/aws` provider) into\n * `common/constructs/src/core/greengrass/` or\n * `common/terraform/src/core/greengrass/`. Existing core files are preserved\n * on later component runs; missing files are added. Idempotent: called from\n * every component generator run.\n */\nexport const addGreengrassCoreConstructs = async <\n  const D extends DependencyDeclaration,\n>(\n  tree: Tree,\n  { iac }: { iac: Iac },\n  declaration: D & MustDeclare<typeof GREENGRASS_CONSTRUCTS_DEPENDENCIES, D>,\n): Promise<void> => {\n  const componentName = buildDefaultComponentName(tree, 'Namespace');\n  const componentKeyPrefix = `${componentName.slice(0, componentName.lastIndexOf('.'))}.*`;\n  if (iac === 'terraform') {\n    await configureGreengrassTerraformProviders(tree);\n    generateFiles(\n      tree,\n      joinPathFragments(\n        import.meta.dirname,\n        'files',\n        'terraform',\n        'core',\n        'greengrass',\n      ),\n      CORE_GREENGRASS_TERRAFORM_DIR,\n      { ...terraformProviderVersions(), componentKeyPrefix },\n      { overwriteStrategy: OverwriteStrategy.KeepExisting },\n    );\n    return;\n  }\n  if (iac !== 'cdk') {\n    throw new Error(`Unsupported iac ${iac}`);\n  }\n\n  generateFiles(\n    tree,\n    joinPathFragments(\n      import.meta.dirname,\n      'files',\n      'cdk',\n      'core',\n      'greengrass',\n    ),\n    CORE_GREENGRASS_DIR,\n    { ...esmVars(tree), ...cdkLambdaRuntimeVars(), componentKeyPrefix },\n    { overwriteStrategy: OverwriteStrategy.KeepExisting },\n  );\n  generateFiles(\n    tree,\n    joinPathFragments(import.meta.dirname, 'files', 'next-version'),\n    joinPathFragments(CORE_GREENGRASS_DIR, 'next-version'),\n    { nextVersionFileName: 'index.js' },\n    { overwriteStrategy: OverwriteStrategy.KeepExisting },\n  );\n\n  await addStarExport(\n    tree,\n    joinPathFragments(\n      PACKAGES_DIR,\n      SHARED_CONSTRUCTS_DIR,\n      'src',\n      'core',\n      'index.ts',\n    ),\n    './greengrass/index.js',\n  );\n\n  addDependenciesToPackageJson(\n    tree,\n    withVersions(\n      forDependencies<typeof GREENGRASS_CONSTRUCTS_DEPENDENCIES>(declaration),\n      ['js-yaml', '@aws-sdk/client-greengrassv2'],\n    ),\n    withVersions(\n      forDependencies<typeof GREENGRASS_CONSTRUCTS_DEPENDENCIES>(declaration),\n      ['@types/js-yaml'],\n    ),\n    joinPathFragments(PACKAGES_DIR, SHARED_CONSTRUCTS_DIR, 'package.json'),\n  );\n};\n\nexport interface AddGreengrassComponentAppConstructOptions {\n  readonly iac: Iac;\n  readonly componentNameClassName: string;\n  readonly componentDisplayName: string;\n  readonly componentDirName: string;\n  readonly project: string;\n  /** The host project whose `<c>-artifact` target this construct reads at synth time. */\n  readonly hostProjectName: string;\n  readonly recipesDirFromRoot: string;\n  readonly artifactsDirFromRoot: string;\n}\n\n/**\n * Vends the per-component app construct/module: a thin\n * `GreengrassComponentVersion` wrapper pinning this component's build output\n * paths, at `common/constructs/src/app/greengrass/<componentDirName>.ts`\n * (CDK) or `common/terraform/src/app/greengrass-component/<componentDirName>/`\n * (Terraform, taking the artifact bucket's name as a plain input variable so\n * user IaC can own or import the shared artifact repository).\n * `OverwriteStrategy.KeepExisting` either way. Registers the host project on\n * the shared iac project's `build`/`assemble` targets so `nx run\n * <infra>:deploy` always deploys a freshly built artifact.\n */\nexport const addGreengrassComponentAppConstruct = async <\n  const D extends DependencyDeclaration,\n>(\n  tree: Tree,\n  options: AddGreengrassComponentAppConstructOptions,\n  declaration: D & MustDeclare<typeof GREENGRASS_CONSTRUCTS_DEPENDENCIES, D>,\n): Promise<void> => {\n  await addGreengrassCoreConstructs(\n    tree,\n    { iac: options.iac },\n    forDependencies<typeof GREENGRASS_CONSTRUCTS_DEPENDENCIES>(declaration),\n  );\n\n  if (options.iac === 'terraform') {\n    generateFiles(\n      tree,\n      joinPathFragments(\n        import.meta.dirname,\n        'files',\n        'terraform',\n        'app',\n        'greengrass-component',\n      ),\n      APP_GREENGRASS_COMPONENT_TERRAFORM_DIR,\n      options,\n      { overwriteStrategy: OverwriteStrategy.KeepExisting },\n    );\n    addArtifactProjectToSharedTargets(\n      tree,\n      'terraform',\n      options.hostProjectName,\n    );\n    return;\n  }\n\n  generateFiles(\n    tree,\n    joinPathFragments(\n      import.meta.dirname,\n      'files',\n      'cdk',\n      'app',\n      'greengrass-component',\n    ),\n    APP_GREENGRASS_DIR,\n    { ...options, ...esmVars(tree) },\n    { overwriteStrategy: OverwriteStrategy.KeepExisting },\n  );\n\n  await addStarExport(\n    tree,\n    joinPathFragments(APP_GREENGRASS_DIR, 'index.ts'),\n    `./${options.componentDirName}.js`,\n  );\n  await addStarExport(\n    tree,\n    joinPathFragments(\n      PACKAGES_DIR,\n      SHARED_CONSTRUCTS_DIR,\n      'src',\n      'app',\n      'index.ts',\n    ),\n    './greengrass/index.js',\n  );\n\n  addArtifactProjectToSharedTargets(tree, 'cdk', options.hostProjectName);\n};\n"],"names":["generateFiles","getProjects","joinPathFragments","logger","OverwriteStrategy","updateJson","addStarExport","applyGritQL","matchGritQL","forDependencies","addDependenciesToPackageJson","buildDefaultComponentName","esmVars","addArtifactProjectToTargets","PACKAGES_DIR","SHARED_CONSTRUCTS_DIR","SHARED_TERRAFORM_DIR","cdkLambdaRuntimeVars","terraformProviderVersions","withVersions","GREENGRASS_CONSTRUCTS_DEPENDENCIES","name","when","m","iac","dev","CORE_GREENGRASS_DIR","APP_GREENGRASS_DIR","CORE_GREENGRASS_TERRAFORM_DIR","APP_GREENGRASS_COMPONENT_TERRAFORM_DIR","configureGreengrassTerraformProviders","tree","roots","values","filter","project","projectType","map","sourceRoot","root","children","some","endsWith","length","warn","paths","requirement","awsccProviderVersion","requirementPath","configured","path","exists","Error","write","filledEmptyBlock","read","trimEnd","addArtifactProjectToSharedTargets","projectName","config","addGreengrassCoreConstructs","declaration","componentName","componentKeyPrefix","slice","lastIndexOf","dirname","overwriteStrategy","KeepExisting","nextVersionFileName","addGreengrassComponentAppConstruct","options","hostProjectName","componentDirName"],"mappings":"AAAA;;;CAGC,GACD,SACEA,aAAa,EACbC,WAAW,EACXC,iBAAiB,EACjBC,MAAM,EACNC,iBAAiB,EAGjBC,UAAU,QACL,aAAa;AACpB,SAASC,aAAa,EAAEC,WAAW,EAAEC,WAAW,QAAQ,YAAY;AAKpE,SAASC,eAAe,QAAQ,8BAA8B;AAC9D,SAASC,4BAA4B,QAAQ,qBAAqB;AAClE,SAASC,yBAAyB,QAAQ,0BAA0B;AAEpE,SAASC,OAAO,QAAQ,sBAAsB;AAC9C,SAASC,2BAA2B,QAAQ,WAAW;AAEvD,SACEC,YAAY,EACZC,qBAAqB,EACrBC,oBAAoB,QACf,oCAAoC;AAC3C,SACEC,oBAAoB,EAEpBC,yBAAyB,EACzBC,YAAY,QACP,iBAAiB;AAExB,0EAA0E,GAC1E,OAAO,MAAMC,qCAAqC;IAChD;QAAEC,MAAM;QAAWC,MAAM,CAACC,IAAmBA,EAAEC,GAAG,KAAK;IAAM;IAC7D;QACEH,MAAM;QACNI,KAAK;QACLH,MAAM,CAACC,IAAmBA,EAAEC,GAAG,KAAK;IACtC;IACA;QACEH,MAAM;QACNC,MAAM,CAACC,IAAmBA,EAAEC,GAAG,KAAK;IACtC;CACD,CAKG;AAEJ,MAAME,sBAAsBxB,kBAC1BY,cACAC,uBACA,OACA,QACA;AAEF,MAAMY,qBAAqBzB,kBACzBY,cACAC,uBACA,OACA,OACA;AAEF,MAAMa,gCAAgC1B,kBACpCY,cACAE,sBACA,OACA,QACA;AAEF,MAAMa,yCAAyC3B,kBAC7CY,cACAE,sBACA,OACA,OACA;AAEF,kFAAkF,GAClF,MAAMc,wCAAwC,OAC5CC;IAEA,MAAMC,QAAQ;WAAI/B,YAAY8B,MAAME,MAAM;KAAG,CAC1CC,MAAM,CAAC,CAACC,UAAYA,QAAQC,WAAW,KAAK,eAC5CC,GAAG,CACF,CAACF,UAAYA,QAAQG,UAAU,IAAIpC,kBAAkBiC,QAAQI,IAAI,EAAE,QAEpEL,MAAM,CAAC,CAACK,OAASR,KAAKS,QAAQ,CAACD,MAAME,IAAI,CAAC,CAACpB,OAASA,KAAKqB,QAAQ,CAAC;IACrE,IAAIV,MAAMW,MAAM,KAAK,GAAG;QACtBxC,OAAOyC,IAAI,CACT,gGACE;IAEN;IACA,KAAK,MAAML,QAAQP,MAAO;QACxB,MAAMa,QAAQd,KACXS,QAAQ,CAACD,MACTL,MAAM,CAAC,CAACb,OAASA,KAAKqB,QAAQ,CAAC,QAC/BL,GAAG,CAAC,CAAChB,OAASnB,kBAAkBqC,MAAMlB;QACzC,MAAMyB,cAAc,CAAC;;iBAER,EAAE5B,4BAA4B6B,oBAAoB,CAAC;KAC/D,CAAC;QACF,IAAIC;QACJ,IAAIC,aAAa;QACjB,KAAK,MAAMC,QAAQL,MAAO;YACxB,IACE,MAAMrC,YACJuB,MACAmB,MACA,8CAEF;gBACAF,oBAAoBE;YACtB;YACAD,eAAe,MAAMzC,YACnBuB,MACAmB,MACA;QAEJ;QACA,IAAI,CAACF,iBAAiB;YACpBA,kBAAkB9C,kBAAkBqC,MAAM;YAC1C,IAAIR,KAAKoB,MAAM,CAACH,kBAAkB;gBAChC,MAAM,IAAII,MACR,CAAC,qCAAqC,EAAEJ,gBAAgB,8EAA8E,CAAC;YAE3I;YACAjB,KAAKsB,KAAK,CACRL,iBACA,CAAC,yCAAyC,EAAEF,YAAY,UAAU,CAAC;QAEvE,OAAO;YACL,MAAMQ,mBAAmB,MAAM/C,YAC7BwB,MACAiB,iBACA,CAAC,uEAAuE,EAAEF,YAAY,OAAO,CAAC;YAEhG,IAAI,CAACQ,kBAAkB;gBACrB,MAAM/C,YACJwB,MACAiB,iBACA,+DACE,8CACA,CAAC,sBAAsB,EAAEF,YAAY,IAAI,CAAC;YAEhD;QACF;QACA,IAAI,CAACG,YAAY;YACflB,KAAKsB,KAAK,CACRL,iBACA,GAAGjB,KAAKwB,IAAI,CAACP,iBAAiB,SAAUQ,OAAO,GAAG,sDAAsD,CAAC;QAE7G;IACF;AACF;AAEA,gGAAgG,GAChG,MAAMC,oCAAoC,CACxC1B,MACAP,KACAkC;IAEArD,WACE0B,MACA7B,kBACEY,cACAU,QAAQ,QAAQT,wBAAwBC,sBACxC,iBAEF,CAAC2C;QACC9C,4BAA4B8C,QAAQD;QACpC,OAAOC;IACT;AAEJ;AAEA;;;;;;;;;;CAUC,GACD,OAAO,MAAMC,8BAA8B,OAGzC7B,MACA,EAAEP,GAAG,EAAgB,EACrBqC;IAEA,MAAMC,gBAAgBnD,0BAA0BoB,MAAM;IACtD,MAAMgC,qBAAqB,GAAGD,cAAcE,KAAK,CAAC,GAAGF,cAAcG,WAAW,CAAC,MAAM,EAAE,CAAC;IACxF,IAAIzC,QAAQ,aAAa;QACvB,MAAMM,sCAAsCC;QAC5C/B,cACE+B,MACA7B,kBACE,YAAYgE,OAAO,EACnB,SACA,aACA,QACA,eAEFtC,+BACA;YAAE,GAAGV,2BAA2B;YAAE6C;QAAmB,GACrD;YAAEI,mBAAmB/D,kBAAkBgE,YAAY;QAAC;QAEtD;IACF;IACA,IAAI5C,QAAQ,OAAO;QACjB,MAAM,IAAI4B,MAAM,CAAC,gBAAgB,EAAE5B,KAAK;IAC1C;IAEAxB,cACE+B,MACA7B,kBACE,YAAYgE,OAAO,EACnB,SACA,OACA,QACA,eAEFxC,qBACA;QAAE,GAAGd,QAAQmB,KAAK;QAAE,GAAGd,sBAAsB;QAAE8C;IAAmB,GAClE;QAAEI,mBAAmB/D,kBAAkBgE,YAAY;IAAC;IAEtDpE,cACE+B,MACA7B,kBAAkB,YAAYgE,OAAO,EAAE,SAAS,iBAChDhE,kBAAkBwB,qBAAqB,iBACvC;QAAE2C,qBAAqB;IAAW,GAClC;QAAEF,mBAAmB/D,kBAAkBgE,YAAY;IAAC;IAGtD,MAAM9D,cACJyB,MACA7B,kBACEY,cACAC,uBACA,OACA,QACA,aAEF;IAGFL,6BACEqB,MACAZ,aACEV,gBAA2DoD,cAC3D;QAAC;QAAW;KAA+B,GAE7C1C,aACEV,gBAA2DoD,cAC3D;QAAC;KAAiB,GAEpB3D,kBAAkBY,cAAcC,uBAAuB;AAE3D,EAAE;AAcF;;;;;;;;;;CAUC,GACD,OAAO,MAAMuD,qCAAqC,OAGhDvC,MACAwC,SACAV;IAEA,MAAMD,4BACJ7B,MACA;QAAEP,KAAK+C,QAAQ/C,GAAG;IAAC,GACnBf,gBAA2DoD;IAG7D,IAAIU,QAAQ/C,GAAG,KAAK,aAAa;QAC/BxB,cACE+B,MACA7B,kBACE,YAAYgE,OAAO,EACnB,SACA,aACA,OACA,yBAEFrC,wCACA0C,SACA;YAAEJ,mBAAmB/D,kBAAkBgE,YAAY;QAAC;QAEtDX,kCACE1B,MACA,aACAwC,QAAQC,eAAe;QAEzB;IACF;IAEAxE,cACE+B,MACA7B,kBACE,YAAYgE,OAAO,EACnB,SACA,OACA,OACA,yBAEFvC,oBACA;QAAE,GAAG4C,OAAO;QAAE,GAAG3D,QAAQmB,KAAK;IAAC,GAC/B;QAAEoC,mBAAmB/D,kBAAkBgE,YAAY;IAAC;IAGtD,MAAM9D,cACJyB,MACA7B,kBAAkByB,oBAAoB,aACtC,CAAC,EAAE,EAAE4C,QAAQE,gBAAgB,CAAC,GAAG,CAAC;IAEpC,MAAMnE,cACJyB,MACA7B,kBACEY,cACAC,uBACA,OACA,OACA,aAEF;IAGF0C,kCAAkC1B,MAAM,OAAOwC,QAAQC,eAAe;AACxE,EAAE"}

package/src/utils/guardrail-constructs/files/terraform/app/guardrails/__nameKebabCase__/__nameKebabCase__-guardrail.tf.template

@@ -8,6 +8,10 @@ terraform {
       source  = "hashicorp/random"
       version = "<%- randomProviderVersion %>"
     }
+    time = {
+      source  = "hashicorp/time"
+      version = "<%- timeProviderVersion %>"
+    }
   }
 }
 
@@ -72,12 +76,25 @@ resource "aws_bedrock_guardrail_version" "this" {
   }
 }
 
+resource "time_sleep" "version_retention" {
+  destroy_duration = "15s"
+
+  triggers = {
+    guardrail_id      = aws_bedrock_guardrail.this.guardrail_id
+    guardrail_version = aws_bedrock_guardrail_version.this.version
+  }
+
+  lifecycle {
+    create_before_destroy = true
+  }
+}
+
 module "add_guardrail_to_runtime_config" {
   source = "../../../core/runtime-config/entry"
 
   namespace = "agentcore"
   key       = "guardrails"
-  value     = { "<%= nameClassName %>" = { guardrailId = aws_bedrock_guardrail.this.guardrail_id, guardrailVersion = aws_bedrock_guardrail_version.this.version } }
+  value     = { "<%= nameClassName %>" = { guardrailId = time_sleep.version_retention.triggers.guardrail_id, guardrailVersion = time_sleep.version_retention.triggers.guardrail_version } }
 }
 
 output "guardrail_id" {

package/src/utils/guardrail-constructs/guardrail-constructs.d.ts

@@ -16,6 +16,11 @@ export interface AddGuardrailInfraOptions {
     /** Workspace-root-relative path of the guardrail.json policy file. */
     policyPath: string;
 }
+/**
+ * Write the guardrail.json policy next to the agent. The policy is the
+ * user's to edit, so a re-run never touches an existing file.
+ */
+export declare const addGuardrailPolicy: (tree: Tree, agentDir: string) => void;
 /**
  * Add the Amazon Bedrock Guardrail infrastructure for the selected IaC
  * provider: a CDK construct in the shared constructs project, or a Terraform

package/src/utils/guardrail-constructs/guardrail-constructs.js

@@ -6,6 +6,14 @@ import { addStarExport } from "../ast.js";
 import { esmVars } from "../module-format.js";
 import { PACKAGES_DIR, SHARED_CONSTRUCTS_DIR, SHARED_TERRAFORM_DIR } from "../shared-constructs-constants.js";
 import { terraformProviderVersions } from "../versions.js";
+/**
+ * Write the guardrail.json policy next to the agent. The policy is the
+ * user's to edit, so a re-run never touches an existing file.
+ */ export const addGuardrailPolicy = (tree, agentDir)=>{
+    generateFiles(tree, joinPathFragments(import.meta.dirname, 'files', 'policy'), agentDir, {}, {
+        overwriteStrategy: OverwriteStrategy.KeepExisting
+    });
+};
 /**
  * Add the Amazon Bedrock Guardrail infrastructure for the selected IaC
  * provider: a CDK construct in the shared constructs project, or a Terraform