@aws/nx-plugin 1.2.0 → 1.3.1

package/src/utils/test/warm-python-cache.js

@@ -3,7 +3,7 @@
  * SPDX-License-Identifier: Apache-2.0
  */ import { execFileSync } from "child_process";
 import { pyenvPythonVersion } from "../versions.js";
-import { PY_CLIENT_VERIFIER_DEPENDENCIES, PY_DYNAMODB_VERIFIER_DEPENDENCIES, PY_VERIFIER_TYPE_CHECKER } from "./python-dependencies.js";
+import { PY_AGENT_GUARDRAIL_VERIFIER_DEPENDENCIES, PY_CLIENT_VERIFIER_DEPENDENCIES, PY_DYNAMODB_VERIFIER_DEPENDENCIES, PY_VERIFIER_TYPE_CHECKER } from "./python-dependencies.js";
 /**
  * Vitest globalSetup that warms uv's cache once before any worker spawns.
  *
@@ -31,6 +31,10 @@ import { PY_CLIENT_VERIFIER_DEPENDENCIES, PY_DYNAMODB_VERIFIER_DEPENDENCIES, PY_
         {
             dependencies: PY_DYNAMODB_VERIFIER_DEPENDENCIES,
             python: pyenvPythonVersion()
+        },
+        {
+            dependencies: PY_AGENT_GUARDRAIL_VERIFIER_DEPENDENCIES,
+            python: pyenvPythonVersion()
         }
     ];
     for (const { dependencies, python } of environments){

package/src/utils/test/warm-python-cache.js.map

@@ -1 +1 @@
-{"version":3,"sources":["../../../../../../packages/nx-plugin/src/utils/test/warm-python-cache.ts"],"sourcesContent":["/**\n * Copyright Amazon.com, Inc. or its affiliates. All Rights Reserved.\n * SPDX-License-Identifier: Apache-2.0\n */\nimport { execFileSync } from 'child_process';\nimport { pyenvPythonVersion } from '../versions.js';\nimport {\n  PY_CLIENT_VERIFIER_DEPENDENCIES,\n  PY_DYNAMODB_VERIFIER_DEPENDENCIES,\n  PY_VERIFIER_TYPE_CHECKER,\n} from './python-dependencies.js';\n\n/**\n * Vitest globalSetup that warms uv's cache once before any worker spawns.\n *\n * `PythonVerifier` starts a `uv run --with …` worker per spec file. On a cold\n * cache the first invocation takes an exclusive write lock while it downloads\n * and installs those packages; with many workers racing that lock, startup\n * stalls and a worker can be torn down before it answers. Installing them once\n * up front means every worker hits a warm cache, where uv only takes shared\n * locks.\n *\n * Mirrors the pre-warm this suite used for `ruff` before it moved in-process.\n *\n * A failure here is not fatal — a missing `uv` is reported by the verifier\n * itself, with a message naming the tool — but it is warned about rather than\n * swallowed: a broken cache otherwise degrades silently to every worker racing a\n * cold one, which is the startup failure this exists to prevent.\n */\nexport default function setup() {\n  // The same sets the verifiers install, on the same interpreters, so the warm\n  // cache is the one they hit. Wheels can be interpreter-specific, so each set\n  // is warmed on the interpreter its verifier runs.\n  const environments: { dependencies: string[]; python?: string }[] = [\n    { dependencies: PY_CLIENT_VERIFIER_DEPENDENCIES },\n    {\n      dependencies: PY_DYNAMODB_VERIFIER_DEPENDENCIES,\n      python: pyenvPythonVersion(),\n    },\n  ];\n  for (const { dependencies, python } of environments) {\n    const deps = [...dependencies, PY_VERIFIER_TYPE_CHECKER].flatMap((spec) => [\n      '--with',\n      spec,\n    ]);\n    const interpreter = python ? ['--python', python] : [];\n    try {\n      execFileSync('uv', ['run', ...interpreter, ...deps, 'python', '-c', ''], {\n        stdio: 'ignore',\n      });\n    } catch (error) {\n      console.warn(\n        `Could not warm uv's cache, so each Python worker will install its own ` +\n          `dependencies and may time out starting up: ${error}`,\n      );\n    }\n  }\n}\n"],"names":["execFileSync","pyenvPythonVersion","PY_CLIENT_VERIFIER_DEPENDENCIES","PY_DYNAMODB_VERIFIER_DEPENDENCIES","PY_VERIFIER_TYPE_CHECKER","setup","environments","dependencies","python","deps","flatMap","spec","interpreter","stdio","error","console","warn"],"mappings":"AAAA;;;CAGC,GACD,SAASA,YAAY,QAAQ,gBAAgB;AAC7C,SAASC,kBAAkB,QAAQ,iBAAiB;AACpD,SACEC,+BAA+B,EAC/BC,iCAAiC,EACjCC,wBAAwB,QACnB,2BAA2B;AAElC;;;;;;;;;;;;;;;;CAgBC,GACD,eAAe,SAASC;IACtB,6EAA6E;IAC7E,6EAA6E;IAC7E,kDAAkD;IAClD,MAAMC,eAA8D;QAClE;YAAEC,cAAcL;QAAgC;QAChD;YACEK,cAAcJ;YACdK,QAAQP;QACV;KACD;IACD,KAAK,MAAM,EAAEM,YAAY,EAAEC,MAAM,EAAE,IAAIF,aAAc;QACnD,MAAMG,OAAO;eAAIF;YAAcH;SAAyB,CAACM,OAAO,CAAC,CAACC,OAAS;gBACzE;gBACAA;aACD;QACD,MAAMC,cAAcJ,SAAS;YAAC;YAAYA;SAAO,GAAG,EAAE;QACtD,IAAI;YACFR,aAAa,MAAM;gBAAC;mBAAUY;mBAAgBH;gBAAM;gBAAU;gBAAM;aAAG,EAAE;gBACvEI,OAAO;YACT;QACF,EAAE,OAAOC,OAAO;YACdC,QAAQC,IAAI,CACV,CAAC,sEAAsE,CAAC,GACtE,CAAC,2CAA2C,EAAEF,OAAO;QAE3D;IACF;AACF"}
+{"version":3,"sources":["../../../../../../packages/nx-plugin/src/utils/test/warm-python-cache.ts"],"sourcesContent":["/**\n * Copyright Amazon.com, Inc. or its affiliates. All Rights Reserved.\n * SPDX-License-Identifier: Apache-2.0\n */\nimport { execFileSync } from 'child_process';\nimport { pyenvPythonVersion } from '../versions.js';\nimport {\n  PY_AGENT_GUARDRAIL_VERIFIER_DEPENDENCIES,\n  PY_CLIENT_VERIFIER_DEPENDENCIES,\n  PY_DYNAMODB_VERIFIER_DEPENDENCIES,\n  PY_VERIFIER_TYPE_CHECKER,\n} from './python-dependencies.js';\n\n/**\n * Vitest globalSetup that warms uv's cache once before any worker spawns.\n *\n * `PythonVerifier` starts a `uv run --with …` worker per spec file. On a cold\n * cache the first invocation takes an exclusive write lock while it downloads\n * and installs those packages; with many workers racing that lock, startup\n * stalls and a worker can be torn down before it answers. Installing them once\n * up front means every worker hits a warm cache, where uv only takes shared\n * locks.\n *\n * Mirrors the pre-warm this suite used for `ruff` before it moved in-process.\n *\n * A failure here is not fatal — a missing `uv` is reported by the verifier\n * itself, with a message naming the tool — but it is warned about rather than\n * swallowed: a broken cache otherwise degrades silently to every worker racing a\n * cold one, which is the startup failure this exists to prevent.\n */\nexport default function setup() {\n  // The same sets the verifiers install, on the same interpreters, so the warm\n  // cache is the one they hit. Wheels can be interpreter-specific, so each set\n  // is warmed on the interpreter its verifier runs.\n  const environments: { dependencies: string[]; python?: string }[] = [\n    { dependencies: PY_CLIENT_VERIFIER_DEPENDENCIES },\n    {\n      dependencies: PY_DYNAMODB_VERIFIER_DEPENDENCIES,\n      python: pyenvPythonVersion(),\n    },\n    {\n      dependencies: PY_AGENT_GUARDRAIL_VERIFIER_DEPENDENCIES,\n      python: pyenvPythonVersion(),\n    },\n  ];\n  for (const { dependencies, python } of environments) {\n    const deps = [...dependencies, PY_VERIFIER_TYPE_CHECKER].flatMap((spec) => [\n      '--with',\n      spec,\n    ]);\n    const interpreter = python ? ['--python', python] : [];\n    try {\n      execFileSync('uv', ['run', ...interpreter, ...deps, 'python', '-c', ''], {\n        stdio: 'ignore',\n      });\n    } catch (error) {\n      console.warn(\n        `Could not warm uv's cache, so each Python worker will install its own ` +\n          `dependencies and may time out starting up: ${error}`,\n      );\n    }\n  }\n}\n"],"names":["execFileSync","pyenvPythonVersion","PY_AGENT_GUARDRAIL_VERIFIER_DEPENDENCIES","PY_CLIENT_VERIFIER_DEPENDENCIES","PY_DYNAMODB_VERIFIER_DEPENDENCIES","PY_VERIFIER_TYPE_CHECKER","setup","environments","dependencies","python","deps","flatMap","spec","interpreter","stdio","error","console","warn"],"mappings":"AAAA;;;CAGC,GACD,SAASA,YAAY,QAAQ,gBAAgB;AAC7C,SAASC,kBAAkB,QAAQ,iBAAiB;AACpD,SACEC,wCAAwC,EACxCC,+BAA+B,EAC/BC,iCAAiC,EACjCC,wBAAwB,QACnB,2BAA2B;AAElC;;;;;;;;;;;;;;;;CAgBC,GACD,eAAe,SAASC;IACtB,6EAA6E;IAC7E,6EAA6E;IAC7E,kDAAkD;IAClD,MAAMC,eAA8D;QAClE;YAAEC,cAAcL;QAAgC;QAChD;YACEK,cAAcJ;YACdK,QAAQR;QACV;QACA;YACEO,cAAcN;YACdO,QAAQR;QACV;KACD;IACD,KAAK,MAAM,EAAEO,YAAY,EAAEC,MAAM,EAAE,IAAIF,aAAc;QACnD,MAAMG,OAAO;eAAIF;YAAcH;SAAyB,CAACM,OAAO,CAAC,CAACC,OAAS;gBACzE;gBACAA;aACD;QACD,MAAMC,cAAcJ,SAAS;YAAC;YAAYA;SAAO,GAAG,EAAE;QACtD,IAAI;YACFT,aAAa,MAAM;gBAAC;mBAAUa;mBAAgBH;gBAAM;gBAAU;gBAAM;aAAG,EAAE;gBACvEI,OAAO;YACT;QACF,EAAE,OAAOC,OAAO;YACdC,QAAQC,IAAI,CACV,CAAC,sEAAsE,CAAC,GACtE,CAAC,2CAA2C,EAAEF,OAAO;QAE3D;IACF;AACF"}

package/src/utils/version-upgrade-migration/sync-vended-versions.d.ts

@@ -3,6 +3,14 @@
  * SPDX-License-Identifier: Apache-2.0
  */
 import { type MigrationReturnObject, type Tree } from '@nx/devkit';
+import { type OwnedDependencies } from './owned-dependencies.js';
+/**
+ * Version the sync moves a declared TypeScript dependency to, or undefined when
+ * it leaves the declaration as it is.
+ *
+ * Devkit then writes it only when it is higher than the declared version.
+ */
+export declare const syncedTsVersion: (tree: Tree, owned: OwnedDependencies, name: string, declared: unknown) => string | undefined;
 /**
  * Sync the versions this release vends, for the dependencies the workspace's
  * generators own.

package/src/utils/version-upgrade-migration/sync-vended-versions.js

@@ -76,6 +76,15 @@ import { isVendedUpgrade } from "./vended-upgrade.js";
     }
     return satisfies(vended, range);
 };
+/**
+ * Version the sync moves a declared TypeScript dependency to, or undefined when
+ * it leaves the declaration as it is.
+ *
+ * Devkit then writes it only when it is higher than the declared version.
+ */ export const syncedTsVersion = (tree, owned, name, declared)=>{
+    const vended = vendedTsVersion(owned, name);
+    return vended && isSyncableSpecifier(tree, declared) && !alreadyPermitsVended(tree, name, declared, vended) ? vended : undefined;
+};
 /**
  * Vended packages a manifest already declares, and the version to move each to.
  *
@@ -84,8 +93,8 @@ import { isVendedUpgrade } from "./vended-upgrade.js";
  */ const declaredVendedPackages = (tree, owned, packageJsonPath)=>{
     const json = readJson(tree, packageJsonPath);
     const pick = (field)=>Object.fromEntries(Object.entries(json[field] ?? {}).flatMap(([name, declared])=>{
-            const vended = vendedTsVersion(owned, name);
-            return vended && isSyncableSpecifier(tree, declared) && !alreadyPermitsVended(tree, name, declared, vended) ? [
+            const vended = syncedTsVersion(tree, owned, name, declared);
+            return vended ? [
                 [
                     name,
                     vended

package/src/utils/version-upgrade-migration/sync-vended-versions.js.map

@@ -1 +1 @@
-{"version":3,"sources":["../../../../../../packages/nx-plugin/src/utils/version-upgrade-migration/sync-vended-versions.ts"],"sourcesContent":["/**\n * Copyright Amazon.com, Inc. or its affiliates. All Rights Reserved.\n * SPDX-License-Identifier: Apache-2.0\n */\nimport {\n  addDependenciesToPackageJson,\n  detectPackageManager,\n  type MigrationReturnObject,\n  readJson,\n  type Tree,\n  updateJson,\n  visitNotIgnoredFiles,\n} from '@nx/devkit';\nimport yaml from 'js-yaml';\nimport { getCatalogManager } from 'nx/src/utils/catalog';\nimport { parsePipRequirementsLine } from 'pip-requirements-js';\nimport { coerce, parse, satisfies, validRange } from 'semver';\nimport { applyGritQL, captureAllGritQLVariable } from '../ast.js';\nimport { buildInstallCommand } from '../commands.js';\nimport { formatFilesInSubtree } from '../format.js';\nimport {\n  PACKAGES_DIR,\n  SHARED_CONSTRUCTS_DIR,\n  SHARED_TERRAFORM_DIR,\n} from '../shared-constructs-constants.js';\nimport { updateToml } from '../toml.js';\nimport {\n  cdkLambdaRuntime,\n  PY_VERSIONS,\n  TERRAFORM_VERSIONS,\n  TS_VERSIONS,\n  terraformLambdaRuntime,\n} from '../versions.js';\nimport { isNxPackage } from './nx-package-updates.js';\nimport {\n  type OwnedDependencies,\n  ownedDependencies,\n} from './owned-dependencies.js';\nimport { syncEmbeddedVersions } from './sync-embedded-versions.js';\nimport { syncLambdaRuntimes, type VendedIac } from './sync-lambda-runtimes.js';\nimport { syncMetricsVersion } from './sync-metrics-version.js';\nimport {\n  syncProjectPythonVersion,\n  syncPythonBundleVersion,\n} from './sync-python-language-version.js';\nimport { isVendedUpgrade } from './vended-upgrade.js';\n\n/**\n * Syncs the versions a generated workspace pins to those this release vends:\n * TypeScript dependencies (including those pinned only by an override), Python\n * pins, Terraform providers, and the plugin version the metrics files report.\n *\n * nx and `@nx/*` are excluded — `packageJsonUpdates` owns them so `nx migrate`\n * collects Nx's own migrations (see `nx-package-updates.ts`).\n */\n\n/** Workspace files holding catalog definitions, and pnpm 11's overrides. */\nconst YAML_WORKSPACE_FILES = ['pnpm-workspace.yaml', '.yarnrc.yml'];\n\n/**\n * Vended version for a dependency this workspace's generators own, or undefined\n * for one the user added themselves.\n */\nconst vendedTsVersion = (\n  owned: OwnedDependencies,\n  name: string,\n): string | undefined =>\n  isNxPackage(name) || !owned.ts.has(name)\n    ? undefined\n    : TS_VERSIONS[name as keyof typeof TS_VERSIONS];\n\n/** PY_VERSIONS records the `==` operator; the pin holds the bare version. */\nconst vendedPyVersion = (\n  owned: OwnedDependencies,\n  name: string,\n): string | undefined =>\n  owned.py.has(name)\n    ? PY_VERSIONS[name as keyof typeof PY_VERSIONS]?.replace(/^==/, '')\n    : undefined;\n\n/** Protocols whose version lives elsewhere, and is synced there instead. */\nconst REFERENCE_PROTOCOL =\n  /^(?:workspace|file|link|npm|git|git\\+|github|portal|patch|exec):/;\n\n/**\n * Whether devkit may be handed this specifier.\n *\n * `catalog:` is only safe where devkit has a catalog manager (pnpm, yarn, bun).\n * Without one it rewrites the reference to a literal version, severing the\n * catalog — so those references are synced directly instead.\n */\nconst isSyncableSpecifier = (tree: Tree, declared: unknown): boolean => {\n  // A manifest is the user's file and may hold anything. A version that isn't a\n  // string is not one this can reason about, and throwing here would abort the\n  // whole `nx migrate` over a file the sync only meant to skip.\n  if (typeof declared !== 'string') {\n    return false;\n  }\n  if (REFERENCE_PROTOCOL.test(declared)) {\n    return false;\n  }\n  return (\n    !declared.startsWith('catalog:') || getCatalogManager(tree.root) !== null\n  );\n};\n\n/**\n * Whether the declared range already permits the vended version, following a\n * `catalog:` reference to the range it points at.\n *\n * Devkit would narrow such a range to an exact pin, discarding a user's widened\n * specifier without changing what resolves, so it is left alone.\n */\nconst alreadyPermitsVended = (\n  tree: Tree,\n  packageName: string,\n  declared: string,\n  vended: string,\n): boolean => {\n  let range = declared;\n  if (declared.startsWith('catalog:')) {\n    const resolved = getCatalogManager(tree.root)?.resolveCatalogReference(\n      tree,\n      packageName,\n      declared,\n    );\n    if (!resolved) {\n      return false;\n    }\n    range = resolved;\n  }\n  range = range.trim();\n  // An exact pin is the case to upgrade, not a range to preserve.\n  if (parse(range) !== null || validRange(range) === null) {\n    return false;\n  }\n  return satisfies(vended, range);\n};\n\n/**\n * Vended packages a manifest already declares, and the version to move each to.\n *\n * Only packages already present are named: devkit adds whatever it is given, so\n * passing the full vended list would inject all of it into every manifest.\n */\nconst declaredVendedPackages = (\n  tree: Tree,\n  owned: OwnedDependencies,\n  packageJsonPath: string,\n): {\n  dependencies: Record<string, string>;\n  devDependencies: Record<string, string>;\n} => {\n  const json = readJson(tree, packageJsonPath);\n  const pick = (field: 'dependencies' | 'devDependencies') =>\n    Object.fromEntries(\n      Object.entries((json[field] ?? {}) as Record<string, string>).flatMap(\n        ([name, declared]) => {\n          const vended = vendedTsVersion(owned, name);\n          return vended &&\n            isSyncableSpecifier(tree, declared) &&\n            !alreadyPermitsVended(tree, name, declared, vended)\n            ? [[name, vended] as const]\n            : [];\n        },\n      ),\n    );\n  return {\n    dependencies: pick('dependencies'),\n    devDependencies: pick('devDependencies'),\n  };\n};\n\n/**\n * Sync the TypeScript dependencies every `package.json` declares.\n *\n * Devkit does the writing: it moves a version wherever the workspace keeps it —\n * through a `catalog:` reference or directly — and refuses anything that isn't a\n * strict upgrade on what is installed.\n *\n * Called directly rather than through this plugin's wrapper, which *migrates*\n * declarations into the catalog; right when generating, wrong for a version bump.\n */\nconst syncPackageJsons = (tree: Tree, owned: OwnedDependencies): string[] => {\n  const updated: string[] = [];\n\n  visitNotIgnoredFiles(tree, '.', (path) => {\n    if (!path.endsWith('package.json')) {\n      return;\n    }\n    const { dependencies, devDependencies } = declaredVendedPackages(\n      tree,\n      owned,\n      path,\n    );\n    if (\n      Object.keys(dependencies).length === 0 &&\n      Object.keys(devDependencies).length === 0\n    ) {\n      return;\n    }\n\n    const before = tree.read(path, 'utf-8');\n    const catalogsBefore = readCatalogFiles(tree);\n    // Install callback dropped: `nx migrate` runs install itself.\n    addDependenciesToPackageJson(tree, dependencies, devDependencies, path);\n    if (\n      tree.read(path, 'utf-8') !== before ||\n      readCatalogFiles(tree) !== catalogsBefore\n    ) {\n      updated.push(path);\n    }\n  });\n\n  return updated;\n};\n\n/** Snapshot of every catalog definition file, for change detection. */\nconst readCatalogFiles = (tree: Tree): string =>\n  [...YAML_WORKSPACE_FILES, 'package.json']\n    .map((path) => (tree.exists(path) ? tree.read(path, 'utf-8') : ''))\n    .join('\\0');\n\n/**\n * Upgrade vended catalog entries devkit cannot reach: those no manifest\n * references.\n */\nconst syncOrphanCatalogEntries = (\n  tree: Tree,\n  owned: OwnedDependencies,\n): string[] => {\n  const referenced = referencedCatalogPackages(tree);\n  const updated: string[] = [];\n\n  const syncCatalog = (\n    catalog: Record<string, string> | undefined,\n  ): boolean => {\n    let changed = false;\n    for (const [name, declared] of Object.entries(catalog ?? {})) {\n      const vended = vendedTsVersion(owned, name);\n      if (!vended || referenced.has(name)) {\n        continue;\n      }\n      if (isVendedUpgrade(vended, String(declared))) {\n        catalog![name] = vended;\n        changed = true;\n      }\n    }\n    return changed;\n  };\n\n  for (const path of YAML_WORKSPACE_FILES) {\n    if (!tree.exists(path)) {\n      continue;\n    }\n    const catalogFile = (yaml.load(tree.read(path, 'utf-8') ?? '') ?? {}) as {\n      catalog?: Record<string, string>;\n      catalogs?: Record<string, Record<string, string>>;\n    };\n    const changed = [\n      syncCatalog(catalogFile.catalog),\n      ...Object.values(catalogFile.catalogs ?? {}).map(syncCatalog),\n    ].some(Boolean);\n    if (changed) {\n      tree.write(path, yaml.dump(catalogFile, { quotingType: \"'\" }));\n      updated.push(path);\n    }\n  }\n\n  // Bun keeps its catalogs in the root manifest.\n  if (tree.exists('package.json')) {\n    let changed = false;\n    updateJson(tree, 'package.json', (json) => {\n      changed = [\n        syncCatalog(json.catalog),\n        ...Object.values(\n          (json.catalogs ?? {}) as Record<string, Record<string, string>>,\n        ).map(syncCatalog),\n      ].some(Boolean);\n      return json;\n    });\n    if (changed) {\n      updated.push('package.json');\n    }\n  }\n\n  return updated;\n};\n\n/**\n * The package an override key pins, or undefined when the key names none.\n *\n * A key is a package name, optionally preceded by the path it is scoped to and\n * followed by the parent range it applies at:\n *\n *   zod                                     -> zod\n *   zod@^3                                  -> zod\n *   **&#47;@modelcontextprotocol/sdk/zod        -> zod\n *   @prisma/adapter-pg/@types/pg            -> @types/pg\n *\n * The last segment is the package, since every earlier one is a parent it is\n * scoped under — except that a scope and the name after it are one segment.\n */\nconst overriddenPackage = (key: string): string | undefined => {\n  const segments = key.split('/').reduce<string[]>((acc, part) => {\n    // A bare `@scope` is only half a name; join it to what follows.\n    const previous = acc[acc.length - 1];\n    if (previous?.startsWith('@') && !previous.includes('/')) {\n      acc[acc.length - 1] = `${previous}/${part}`;\n      return acc;\n    }\n    acc.push(part);\n    return acc;\n  }, []);\n\n  const name = segments[segments.length - 1];\n  if (!name || name === '.') {\n    return undefined;\n  }\n  // A trailing `@range` scopes the override to a parent version.\n  const at = name.lastIndexOf('@');\n  return at > 0 ? name.slice(0, at) : name;\n};\n\n/**\n * Sync the owned packages an override pins, wherever the workspace keeps them:\n * npm's `overrides`, yarn and bun's `resolutions`, and pnpm's `pnpm.overrides`\n * (10) or `pnpm-workspace.yaml` `overrides` (11).\n *\n * Devkit does not manage these fields, so an owned package pinned only here\n * would otherwise stay on the version it was generated with. Values are compared\n * with `isVendedUpgrade`, so a range the user widened is left alone.\n */\n/**\n * Where the workspace's package manager reads overrides from.\n *\n * Only the root manifest is considered: every package manager resolves overrides\n * from the workspace root, so a nested `overrides` block is inert and rewriting\n * it would imply an effect it doesn't have.\n *\n * pnpm moved the block between majors — 10 reads `pnpm.overrides` in the\n * manifest, 11 reads `overrides` in `pnpm-workspace.yaml` — so both are covered\n * rather than detecting the minor.\n */\nconst overrideLocations = (\n  tree: Tree,\n): {\n  manifestFields: readonly ('overrides' | 'resolutions' | 'pnpm.overrides')[];\n  workspaceFile?: string;\n} => {\n  switch (detectPackageManager(tree.root)) {\n    case 'npm':\n      return { manifestFields: ['overrides'] };\n    case 'yarn':\n      return { manifestFields: ['resolutions'] };\n    case 'bun':\n      // Bun reads npm's `overrides` and yarn's `resolutions` alike.\n      return { manifestFields: ['overrides', 'resolutions'] };\n    default:\n      return {\n        manifestFields: ['pnpm.overrides'],\n        workspaceFile: 'pnpm-workspace.yaml',\n      };\n  }\n};\n\nconst syncOverrides = (tree: Tree, owned: OwnedDependencies): string[] => {\n  const updated: string[] = [];\n\n  // Nested npm overrides carry the pin under `.`, with sibling keys scoping\n  // deeper, so a value may be a string or another override object.\n  const syncOverrideTree = (overrides: unknown): boolean => {\n    if (typeof overrides !== 'object' || overrides === null) {\n      return false;\n    }\n    let changed = false;\n    for (const [key, value] of Object.entries(\n      overrides as Record<string, unknown>,\n    )) {\n      if (typeof value === 'object' && value !== null) {\n        changed = syncOverrideTree(value) || changed;\n        continue;\n      }\n      if (typeof value !== 'string') {\n        continue;\n      }\n      // `.` pins the package its parent key names.\n      const name =\n        key === '.' ? undefined : (overriddenPackage(key) ?? undefined);\n      const vended = name ? vendedTsVersion(owned, name) : undefined;\n      if (vended && isVendedUpgrade(vended, value)) {\n        (overrides as Record<string, unknown>)[key] = vended;\n        changed = true;\n      }\n    }\n    return changed;\n  };\n\n  const { manifestFields, workspaceFile } = overrideLocations(tree);\n\n  if (manifestFields.length > 0) {\n    let changed = false;\n    updateJson(tree, 'package.json', (json) => {\n      changed = manifestFields\n        .map((field) =>\n          syncOverrideTree(\n            field === 'pnpm.overrides' ? json.pnpm?.overrides : json[field],\n          ),\n        )\n        .some(Boolean);\n      return json;\n    });\n    if (changed) {\n      updated.push('package.json');\n    }\n  }\n\n  if (workspaceFile && tree.exists(workspaceFile)) {\n    const contents = (yaml.load(tree.read(workspaceFile, 'utf-8') ?? '') ??\n      {}) as Record<string, unknown>;\n    if (syncOverrideTree(contents.overrides)) {\n      tree.write(workspaceFile, yaml.dump(contents, { quotingType: \"'\" }));\n      updated.push(workspaceFile);\n    }\n  }\n\n  return updated;\n};\n\n/**\n * Packages devkit already maintains through a `catalog:` reference. Empty\n * without a catalog manager, where no reference resolves.\n */\nconst referencedCatalogPackages = (tree: Tree): Set<string> => {\n  const referenced = new Set<string>();\n  if (getCatalogManager(tree.root) === null) {\n    return referenced;\n  }\n  visitNotIgnoredFiles(tree, '.', (path) => {\n    if (!path.endsWith('package.json')) {\n      return;\n    }\n    const json = readJson(tree, path);\n    for (const field of ['dependencies', 'devDependencies'] as const) {\n      for (const [name, declared] of Object.entries(\n        (json[field] ?? {}) as Record<string, string>,\n      )) {\n        if (String(declared).startsWith('catalog:')) {\n          referenced.add(name);\n        }\n      }\n    }\n  });\n  return referenced;\n};\n\n/** Pip specifier as `pip-requirements-js` reports it. */\ninterface PyVersionSpec {\n  readonly operator: string;\n  readonly version: string;\n}\n\n/**\n * Whether the declared specifiers already permit the vended version, so\n * rewriting them would discard the user's range without changing what resolves.\n *\n * This mirrors the TypeScript side: an exact pin is the case to upgrade, a range\n * that already reaches the vended version is left alone, and a range that falls\n * short is moved up.\n *\n * A `*` wildcard or a specifier semver can't read counts as already permitting,\n * so anything not understood is left as the user wrote it.\n */\nconst pyRangePermitsVended = (\n  specs: readonly PyVersionSpec[],\n  vended: string,\n): boolean =>\n  specs.every((spec) => {\n    if (spec.version.includes('*')) {\n      return true;\n    }\n    const bound = coerce(spec.version, { includePrerelease: true });\n    if (!bound) {\n      return true;\n    }\n    switch (spec.operator) {\n      // An exact pin permits only itself, so a differing vended version is an\n      // upgrade to apply.\n      case '==':\n      case '===':\n        return satisfies(vended, `=${bound.version}`, {\n          includePrerelease: true,\n        });\n      // `~=1.2.3` allows the patch series; `~=1.2` the minor series.\n      case '~=':\n        return satisfies(\n          vended,\n          spec.version.split('.').length > 2\n            ? `~${bound.version}`\n            : `^${bound.version}`,\n          { includePrerelease: true },\n        );\n      case '>=':\n      case '>':\n      case '<=':\n      case '<':\n        return satisfies(vended, `${spec.operator}${bound.version}`, {\n          includePrerelease: true,\n        });\n      // `!=` only excludes, so it never blocks the vended version by itself.\n      case '!=':\n        return true;\n      default:\n        return true;\n    }\n  });\n\n/**\n * Upgrade a pip requirement to the vended version, or return it unchanged.\n *\n * Parsed rather than pattern-matched so extras and operators are read the way\n * `uv` reads them. A requirement whose specifiers already permit the vended\n * version keeps them; one that falls short is replaced with an exact pin, which\n * is what the generators write.\n */\nconst syncPyRequirement = (\n  owned: OwnedDependencies,\n  requirement: string,\n): string => {\n  const parsed = parsePipRequirementsLine(requirement);\n  if (parsed?.type !== 'ProjectName' || !parsed.versionSpec?.length) {\n    return requirement;\n  }\n\n  const name = parsed.extras?.length\n    ? `${parsed.name}[${parsed.extras.join(',')}]`\n    : parsed.name;\n  const vended = vendedPyVersion(owned, name);\n  if (!vended) {\n    return requirement;\n  }\n\n  const specs = parsed.versionSpec as readonly PyVersionSpec[];\n  // Never move a version backwards: a pin above what this release vends is the\n  // user's, and a range already reaching it is theirs to keep.\n  const [first] = specs;\n  const isExactPin =\n    specs.length === 1 && (first.operator === '==' || first.operator === '===');\n  if (isExactPin && !isVendedUpgrade(vended, first.version)) {\n    return requirement;\n  }\n  if (!isExactPin && pyRangePermitsVended(specs, vended)) {\n    return requirement;\n  }\n  return `${name}==${vended}`;\n};\n\n/** Sync pins in every `pyproject.toml`, dependencies and groups alike. */\nconst syncPyProjects = (tree: Tree, owned: OwnedDependencies): string[] => {\n  const updated: string[] = [];\n\n  visitNotIgnoredFiles(tree, '.', (path) => {\n    if (!path.endsWith('pyproject.toml')) {\n      return;\n    }\n\n    let changed = false;\n    const syncRequirements = (requirements: unknown): unknown =>\n      Array.isArray(requirements)\n        ? requirements.map((requirement) => {\n            if (typeof requirement !== 'string') {\n              return requirement;\n            }\n            const synced = syncPyRequirement(owned, requirement);\n            changed ||= synced !== requirement;\n            return synced;\n          })\n        : requirements;\n\n    updateToml(tree, path, (toml) => {\n      const project = toml.project as Record<string, unknown> | undefined;\n      if (project?.dependencies) {\n        project.dependencies = syncRequirements(project.dependencies) as never;\n      }\n      const groups = toml['dependency-groups'] as\n        | Record<string, unknown>\n        | undefined;\n      for (const group of Object.keys(groups ?? {})) {\n        groups![group] = syncRequirements(groups![group]) as never;\n      }\n      return toml;\n    });\n\n    if (changed) {\n      updated.push(path);\n    }\n  });\n\n  return updated;\n};\n\n/**\n * GritQL matching one provider's `version` in `required_providers`, scoped by\n * the sibling `source` so an alias or another provider's version can't match.\n *\n * `language hcl` is required — without it the pattern silently matches nothing.\n */\nconst providerVersionPattern = (provider: string, rewrite = ''): string =>\n  `language hcl\\n\\`version = $version\\`${rewrite} where {` +\n  ` $version <: within \\`{ source = \"hashicorp/${provider}\" $... }\\` }`;\n\n/** Version a provider currently declares, if it declares one. */\nconst declaredProviderVersion = async (\n  tree: Tree,\n  path: string,\n  provider: string,\n): Promise<string | undefined> => {\n  const [bound] =\n    (await captureAllGritQLVariable(\n      tree,\n      path,\n      providerVersionPattern(provider),\n      'version',\n    )) ?? [];\n  // The binding is the quoted version, e.g. `\"6.40.0\"`.\n  return bound?.replace(/^\"|\"$/g, '');\n};\n\n/** Sync vended provider versions in every `.tf` file. */\nconst syncTerraformProviders = async (tree: Tree): Promise<string[]> => {\n  const updated: string[] = [];\n  const terraformFiles: string[] = [];\n\n  visitNotIgnoredFiles(tree, '.', (path) => {\n    if (path.endsWith('.tf')) {\n      terraformFiles.push(path);\n    }\n  });\n\n  for (const path of terraformFiles) {\n    let changed = false;\n    for (const [provider, vended] of Object.entries(TERRAFORM_VERSIONS)) {\n      const declared = await declaredProviderVersion(tree, path, provider);\n      if (!declared || !isVendedUpgrade(vended, declared)) {\n        continue;\n      }\n      changed =\n        (await applyGritQL(\n          tree,\n          path,\n          providerVersionPattern(provider, ` => \\`version = \"${vended}\"\\``),\n        )) || changed;\n    }\n    if (changed) {\n      updated.push(path);\n    }\n  }\n\n  return updated;\n};\n\n/**\n * The projects this plugin generates infrastructure into, per provider.\n *\n * A runtime is not a dependency, so there is no per-package ownership to consult —\n * these directories are the scope. A Lambda a user defined in their own project\n * keeps whatever runtime they chose, even though it is the same shape.\n */\nconst OWNED_INFRA_DIRS: Readonly<Record<VendedIac, string>> = {\n  cdk: `${PACKAGES_DIR}/${SHARED_CONSTRUCTS_DIR}`,\n  terraform: `${PACKAGES_DIR}/${SHARED_TERRAFORM_DIR}`,\n};\n\n/**\n * Sync the versions this release vends, for the dependencies the workspace's\n * generators own.\n */\nexport const syncVendedVersions = async (\n  tree: Tree,\n): Promise<MigrationReturnObject> => {\n  const nextSteps: string[] = [];\n  const owned = await ownedDependencies(tree);\n\n  const packageJsons = syncPackageJsons(tree, owned);\n  const catalogs = syncOrphanCatalogEntries(tree, owned);\n  const overrides = syncOverrides(tree, owned);\n  const pyProjects = syncPyProjects(tree, owned);\n  const terraformFiles = await syncTerraformProviders(tree);\n  const lambdaRuntimes = await syncLambdaRuntimes(tree, OWNED_INFRA_DIRS);\n  const projectPython = syncProjectPythonVersion(tree);\n  const pythonBundles = syncPythonBundleVersion(tree);\n  const skippedEmbedded = await syncEmbeddedVersions(tree, owned);\n  await syncMetricsVersion(tree);\n\n  // Lock files are left to the user: `nx migrate` only installs when the root\n  // manifest changes, and never runs `uv` or `terraform`.\n  if (catalogs.length > 0 || packageJsons.length > 0 || overrides.length > 0) {\n    nextSteps.push(\n      `TypeScript dependency versions were updated. Run \\`${buildInstallCommand(\n        detectPackageManager(tree.root),\n      )}\\` to update the lock file.`,\n    );\n  }\n  if (\n    pyProjects.length > 0 ||\n    projectPython.length > 0 ||\n    pythonBundles.length > 0\n  ) {\n    nextSteps.push(\n      `Python dependency versions were updated in ${[...new Set([...pyProjects, ...projectPython, ...pythonBundles])].join(', ')}. Run \\`uv sync\\` to update uv.lock.`,\n    );\n  }\n  // A runtime the sync recognised is simply moved; one it doesn't recognise is\n  // the user's choice, so it is reported rather than rewritten.\n  if (lambdaRuntimes.diverged.length > 0) {\n    nextSteps.push(\n      `Lambda runtimes in ${[...new Set(lambdaRuntimes.diverged)].join(', ')} have diverged from the generated shape and were left untouched. Set them to \\`${cdkLambdaRuntime('node')}\\` (CDK) or \\`\"${terraformLambdaRuntime('node')}\"\\` (Terraform) if you want them on the runtime this release vends.`,\n    );\n  }\n  if (terraformFiles.length > 0) {\n    nextSteps.push(\n      `Terraform provider versions were updated in ${terraformFiles.length} file(s). Run \\`terraform init -upgrade\\` in each Terraform project to update its lock file.`,\n    );\n  }\n  // A synced embedded pin needs no next step — it is read the next time the thing\n  // holding it runs. A file the sync left alone does: its versions are still the\n  // old ones, and only the user can reconcile that.\n  if (skippedEmbedded.length > 0) {\n    nextSteps.push(\n      `Version pins were left as they are in ${skippedEmbedded.join(', ')}, which repeat a pin more times than this migration rewrites at once. Update them by hand.`,\n    );\n  }\n\n  // Without this the workspace's own format check fails on the migrated files.\n  await formatFilesInSubtree(tree);\n\n  return { nextSteps };\n};\n"],"names":["addDependenciesToPackageJson","detectPackageManager","readJson","updateJson","visitNotIgnoredFiles","yaml","getCatalogManager","parsePipRequirementsLine","coerce","parse","satisfies","validRange","applyGritQL","captureAllGritQLVariable","buildInstallCommand","formatFilesInSubtree","PACKAGES_DIR","SHARED_CONSTRUCTS_DIR","SHARED_TERRAFORM_DIR","updateToml","cdkLambdaRuntime","PY_VERSIONS","TERRAFORM_VERSIONS","TS_VERSIONS","terraformLambdaRuntime","isNxPackage","ownedDependencies","syncEmbeddedVersions","syncLambdaRuntimes","syncMetricsVersion","syncProjectPythonVersion","syncPythonBundleVersion","isVendedUpgrade","YAML_WORKSPACE_FILES","vendedTsVersion","owned","name","ts","has","undefined","vendedPyVersion","py","replace","REFERENCE_PROTOCOL","isSyncableSpecifier","tree","declared","test","startsWith","root","alreadyPermitsVended","packageName","vended","range","resolved","resolveCatalogReference","trim","declaredVendedPackages","packageJsonPath","json","pick","field","Object","fromEntries","entries","flatMap","dependencies","devDependencies","syncPackageJsons","updated","path","endsWith","keys","length","before","read","catalogsBefore","readCatalogFiles","push","map","exists","join","syncOrphanCatalogEntries","referenced","referencedCatalogPackages","syncCatalog","catalog","changed","String","catalogFile","load","values","catalogs","some","Boolean","write","dump","quotingType","overriddenPackage","key","segments","split","reduce","acc","part","previous","includes","at","lastIndexOf","slice","overrideLocations","manifestFields","workspaceFile","syncOverrides","syncOverrideTree","overrides","value","pnpm","contents","Set","add","pyRangePermitsVended","specs","every","spec","version","bound","includePrerelease","operator","syncPyRequirement","requirement","parsed","type","versionSpec","extras","first","isExactPin","syncPyProjects","syncRequirements","requirements","Array","isArray","synced","toml","project","groups","group","providerVersionPattern","provider","rewrite","declaredProviderVersion","syncTerraformProviders","terraformFiles","OWNED_INFRA_DIRS","cdk","terraform","syncVendedVersions","nextSteps","packageJsons","pyProjects","lambdaRuntimes","projectPython","pythonBundles","skippedEmbedded","diverged"],"mappings":"AAAA;;;CAGC,GACD,SACEA,4BAA4B,EAC5BC,oBAAoB,EAEpBC,QAAQ,EAERC,UAAU,EACVC,oBAAoB,QACf,aAAa;AACpB,OAAOC,UAAU,UAAU;AAC3B,SAASC,iBAAiB,QAAQ,uBAAuB;AACzD,SAASC,wBAAwB,QAAQ,sBAAsB;AAC/D,SAASC,MAAM,EAAEC,KAAK,EAAEC,SAAS,EAAEC,UAAU,QAAQ,SAAS;AAC9D,SAASC,WAAW,EAAEC,wBAAwB,QAAQ,YAAY;AAClE,SAASC,mBAAmB,QAAQ,iBAAiB;AACrD,SAASC,oBAAoB,QAAQ,eAAe;AACpD,SACEC,YAAY,EACZC,qBAAqB,EACrBC,oBAAoB,QACf,oCAAoC;AAC3C,SAASC,UAAU,QAAQ,aAAa;AACxC,SACEC,gBAAgB,EAChBC,WAAW,EACXC,kBAAkB,EAClBC,WAAW,EACXC,sBAAsB,QACjB,iBAAiB;AACxB,SAASC,WAAW,QAAQ,0BAA0B;AACtD,SAEEC,iBAAiB,QACZ,0BAA0B;AACjC,SAASC,oBAAoB,QAAQ,8BAA8B;AACnE,SAASC,kBAAkB,QAAwB,4BAA4B;AAC/E,SAASC,kBAAkB,QAAQ,4BAA4B;AAC/D,SACEC,wBAAwB,EACxBC,uBAAuB,QAClB,oCAAoC;AAC3C,SAASC,eAAe,QAAQ,sBAAsB;AAEtD;;;;;;;CAOC,GAED,0EAA0E,GAC1E,MAAMC,uBAAuB;IAAC;IAAuB;CAAc;AAEnE;;;CAGC,GACD,MAAMC,kBAAkB,CACtBC,OACAC,OAEAX,YAAYW,SAAS,CAACD,MAAME,EAAE,CAACC,GAAG,CAACF,QAC/BG,YACAhB,WAAW,CAACa,KAAiC;AAEnD,2EAA2E,GAC3E,MAAMI,kBAAkB,CACtBL,OACAC,OAEAD,MAAMM,EAAE,CAACH,GAAG,CAACF,QACTf,WAAW,CAACe,KAAiC,EAAEM,QAAQ,OAAO,MAC9DH;AAEN,0EAA0E,GAC1E,MAAMI,qBACJ;AAEF;;;;;;CAMC,GACD,MAAMC,sBAAsB,CAACC,MAAYC;IACvC,8EAA8E;IAC9E,6EAA6E;IAC7E,8DAA8D;IAC9D,IAAI,OAAOA,aAAa,UAAU;QAChC,OAAO;IACT;IACA,IAAIH,mBAAmBI,IAAI,CAACD,WAAW;QACrC,OAAO;IACT;IACA,OACE,CAACA,SAASE,UAAU,CAAC,eAAe1C,kBAAkBuC,KAAKI,IAAI,MAAM;AAEzE;AAEA;;;;;;CAMC,GACD,MAAMC,uBAAuB,CAC3BL,MACAM,aACAL,UACAM;IAEA,IAAIC,QAAQP;IACZ,IAAIA,SAASE,UAAU,CAAC,aAAa;QACnC,MAAMM,WAAWhD,kBAAkBuC,KAAKI,IAAI,GAAGM,wBAC7CV,MACAM,aACAL;QAEF,IAAI,CAACQ,UAAU;YACb,OAAO;QACT;QACAD,QAAQC;IACV;IACAD,QAAQA,MAAMG,IAAI;IAClB,gEAAgE;IAChE,IAAI/C,MAAM4C,WAAW,QAAQ1C,WAAW0C,WAAW,MAAM;QACvD,OAAO;IACT;IACA,OAAO3C,UAAU0C,QAAQC;AAC3B;AAEA;;;;;CAKC,GACD,MAAMI,yBAAyB,CAC7BZ,MACAV,OACAuB;IAKA,MAAMC,OAAOzD,SAAS2C,MAAMa;IAC5B,MAAME,OAAO,CAACC,QACZC,OAAOC,WAAW,CAChBD,OAAOE,OAAO,CAAEL,IAAI,CAACE,MAAM,IAAI,CAAC,GAA8BI,OAAO,CACnE,CAAC,CAAC7B,MAAMU,SAAS;YACf,MAAMM,SAASlB,gBAAgBC,OAAOC;YACtC,OAAOgB,UACLR,oBAAoBC,MAAMC,aAC1B,CAACI,qBAAqBL,MAAMT,MAAMU,UAAUM,UAC1C;gBAAC;oBAAChB;oBAAMgB;iBAAO;aAAU,GACzB,EAAE;QACR;IAGN,OAAO;QACLc,cAAcN,KAAK;QACnBO,iBAAiBP,KAAK;IACxB;AACF;AAEA;;;;;;;;;CASC,GACD,MAAMQ,mBAAmB,CAACvB,MAAYV;IACpC,MAAMkC,UAAoB,EAAE;IAE5BjE,qBAAqByC,MAAM,KAAK,CAACyB;QAC/B,IAAI,CAACA,KAAKC,QAAQ,CAAC,iBAAiB;YAClC;QACF;QACA,MAAM,EAAEL,YAAY,EAAEC,eAAe,EAAE,GAAGV,uBACxCZ,MACAV,OACAmC;QAEF,IACER,OAAOU,IAAI,CAACN,cAAcO,MAAM,KAAK,KACrCX,OAAOU,IAAI,CAACL,iBAAiBM,MAAM,KAAK,GACxC;YACA;QACF;QAEA,MAAMC,SAAS7B,KAAK8B,IAAI,CAACL,MAAM;QAC/B,MAAMM,iBAAiBC,iBAAiBhC;QACxC,8DAA8D;QAC9D7C,6BAA6B6C,MAAMqB,cAAcC,iBAAiBG;QAClE,IACEzB,KAAK8B,IAAI,CAACL,MAAM,aAAaI,UAC7BG,iBAAiBhC,UAAU+B,gBAC3B;YACAP,QAAQS,IAAI,CAACR;QACf;IACF;IAEA,OAAOD;AACT;AAEA,qEAAqE,GACrE,MAAMQ,mBAAmB,CAAChC,OACxB;WAAIZ;QAAsB;KAAe,CACtC8C,GAAG,CAAC,CAACT,OAAUzB,KAAKmC,MAAM,CAACV,QAAQzB,KAAK8B,IAAI,CAACL,MAAM,WAAW,IAC9DW,IAAI,CAAC;AAEV;;;CAGC,GACD,MAAMC,2BAA2B,CAC/BrC,MACAV;IAEA,MAAMgD,aAAaC,0BAA0BvC;IAC7C,MAAMwB,UAAoB,EAAE;IAE5B,MAAMgB,cAAc,CAClBC;QAEA,IAAIC,UAAU;QACd,KAAK,MAAM,CAACnD,MAAMU,SAAS,IAAIgB,OAAOE,OAAO,CAACsB,WAAW,CAAC,GAAI;YAC5D,MAAMlC,SAASlB,gBAAgBC,OAAOC;YACtC,IAAI,CAACgB,UAAU+B,WAAW7C,GAAG,CAACF,OAAO;gBACnC;YACF;YACA,IAAIJ,gBAAgBoB,QAAQoC,OAAO1C,YAAY;gBAC7CwC,OAAQ,CAAClD,KAAK,GAAGgB;gBACjBmC,UAAU;YACZ;QACF;QACA,OAAOA;IACT;IAEA,KAAK,MAAMjB,QAAQrC,qBAAsB;QACvC,IAAI,CAACY,KAAKmC,MAAM,CAACV,OAAO;YACtB;QACF;QACA,MAAMmB,cAAepF,KAAKqF,IAAI,CAAC7C,KAAK8B,IAAI,CAACL,MAAM,YAAY,OAAO,CAAC;QAInE,MAAMiB,UAAU;YACdF,YAAYI,YAAYH,OAAO;eAC5BxB,OAAO6B,MAAM,CAACF,YAAYG,QAAQ,IAAI,CAAC,GAAGb,GAAG,CAACM;SAClD,CAACQ,IAAI,CAACC;QACP,IAAIP,SAAS;YACX1C,KAAKkD,KAAK,CAACzB,MAAMjE,KAAK2F,IAAI,CAACP,aAAa;gBAAEQ,aAAa;YAAI;YAC3D5B,QAAQS,IAAI,CAACR;QACf;IACF;IAEA,+CAA+C;IAC/C,IAAIzB,KAAKmC,MAAM,CAAC,iBAAiB;QAC/B,IAAIO,UAAU;QACdpF,WAAW0C,MAAM,gBAAgB,CAACc;YAChC4B,UAAU;gBACRF,YAAY1B,KAAK2B,OAAO;mBACrBxB,OAAO6B,MAAM,CACbhC,KAAKiC,QAAQ,IAAI,CAAC,GACnBb,GAAG,CAACM;aACP,CAACQ,IAAI,CAACC;YACP,OAAOnC;QACT;QACA,IAAI4B,SAAS;YACXlB,QAAQS,IAAI,CAAC;QACf;IACF;IAEA,OAAOT;AACT;AAEA;;;;;;;;;;;;;CAaC,GACD,MAAM6B,oBAAoB,CAACC;IACzB,MAAMC,WAAWD,IAAIE,KAAK,CAAC,KAAKC,MAAM,CAAW,CAACC,KAAKC;QACrD,gEAAgE;QAChE,MAAMC,WAAWF,GAAG,CAACA,IAAI9B,MAAM,GAAG,EAAE;QACpC,IAAIgC,UAAUzD,WAAW,QAAQ,CAACyD,SAASC,QAAQ,CAAC,MAAM;YACxDH,GAAG,CAACA,IAAI9B,MAAM,GAAG,EAAE,GAAG,GAAGgC,SAAS,CAAC,EAAED,MAAM;YAC3C,OAAOD;QACT;QACAA,IAAIzB,IAAI,CAAC0B;QACT,OAAOD;IACT,GAAG,EAAE;IAEL,MAAMnE,OAAOgE,QAAQ,CAACA,SAAS3B,MAAM,GAAG,EAAE;IAC1C,IAAI,CAACrC,QAAQA,SAAS,KAAK;QACzB,OAAOG;IACT;IACA,+DAA+D;IAC/D,MAAMoE,KAAKvE,KAAKwE,WAAW,CAAC;IAC5B,OAAOD,KAAK,IAAIvE,KAAKyE,KAAK,CAAC,GAAGF,MAAMvE;AACtC;AAEA;;;;;;;;CAQC,GACD;;;;;;;;;;CAUC,GACD,MAAM0E,oBAAoB,CACxBjE;IAKA,OAAQ5C,qBAAqB4C,KAAKI,IAAI;QACpC,KAAK;YACH,OAAO;gBAAE8D,gBAAgB;oBAAC;iBAAY;YAAC;QACzC,KAAK;YACH,OAAO;gBAAEA,gBAAgB;oBAAC;iBAAc;YAAC;QAC3C,KAAK;YACH,8DAA8D;YAC9D,OAAO;gBAAEA,gBAAgB;oBAAC;oBAAa;iBAAc;YAAC;QACxD;YACE,OAAO;gBACLA,gBAAgB;oBAAC;iBAAiB;gBAClCC,eAAe;YACjB;IACJ;AACF;AAEA,MAAMC,gBAAgB,CAACpE,MAAYV;IACjC,MAAMkC,UAAoB,EAAE;IAE5B,0EAA0E;IAC1E,iEAAiE;IACjE,MAAM6C,mBAAmB,CAACC;QACxB,IAAI,OAAOA,cAAc,YAAYA,cAAc,MAAM;YACvD,OAAO;QACT;QACA,IAAI5B,UAAU;QACd,KAAK,MAAM,CAACY,KAAKiB,MAAM,IAAItD,OAAOE,OAAO,CACvCmD,WACC;YACD,IAAI,OAAOC,UAAU,YAAYA,UAAU,MAAM;gBAC/C7B,UAAU2B,iBAAiBE,UAAU7B;gBACrC;YACF;YACA,IAAI,OAAO6B,UAAU,UAAU;gBAC7B;YACF;YACA,6CAA6C;YAC7C,MAAMhF,OACJ+D,QAAQ,MAAM5D,YAAa2D,kBAAkBC,QAAQ5D;YACvD,MAAMa,SAAShB,OAAOF,gBAAgBC,OAAOC,QAAQG;YACrD,IAAIa,UAAUpB,gBAAgBoB,QAAQgE,QAAQ;gBAC3CD,SAAqC,CAAChB,IAAI,GAAG/C;gBAC9CmC,UAAU;YACZ;QACF;QACA,OAAOA;IACT;IAEA,MAAM,EAAEwB,cAAc,EAAEC,aAAa,EAAE,GAAGF,kBAAkBjE;IAE5D,IAAIkE,eAAetC,MAAM,GAAG,GAAG;QAC7B,IAAIc,UAAU;QACdpF,WAAW0C,MAAM,gBAAgB,CAACc;YAChC4B,UAAUwB,eACPhC,GAAG,CAAC,CAAClB,QACJqD,iBACErD,UAAU,mBAAmBF,KAAK0D,IAAI,EAAEF,YAAYxD,IAAI,CAACE,MAAM,GAGlEgC,IAAI,CAACC;YACR,OAAOnC;QACT;QACA,IAAI4B,SAAS;YACXlB,QAAQS,IAAI,CAAC;QACf;IACF;IAEA,IAAIkC,iBAAiBnE,KAAKmC,MAAM,CAACgC,gBAAgB;QAC/C,MAAMM,WAAYjH,KAAKqF,IAAI,CAAC7C,KAAK8B,IAAI,CAACqC,eAAe,YAAY,OAC/D,CAAC;QACH,IAAIE,iBAAiBI,SAASH,SAAS,GAAG;YACxCtE,KAAKkD,KAAK,CAACiB,eAAe3G,KAAK2F,IAAI,CAACsB,UAAU;gBAAErB,aAAa;YAAI;YACjE5B,QAAQS,IAAI,CAACkC;QACf;IACF;IAEA,OAAO3C;AACT;AAEA;;;CAGC,GACD,MAAMe,4BAA4B,CAACvC;IACjC,MAAMsC,aAAa,IAAIoC;IACvB,IAAIjH,kBAAkBuC,KAAKI,IAAI,MAAM,MAAM;QACzC,OAAOkC;IACT;IACA/E,qBAAqByC,MAAM,KAAK,CAACyB;QAC/B,IAAI,CAACA,KAAKC,QAAQ,CAAC,iBAAiB;YAClC;QACF;QACA,MAAMZ,OAAOzD,SAAS2C,MAAMyB;QAC5B,KAAK,MAAMT,SAAS;YAAC;YAAgB;SAAkB,CAAW;YAChE,KAAK,MAAM,CAACzB,MAAMU,SAAS,IAAIgB,OAAOE,OAAO,CAC1CL,IAAI,CAACE,MAAM,IAAI,CAAC,GAChB;gBACD,IAAI2B,OAAO1C,UAAUE,UAAU,CAAC,aAAa;oBAC3CmC,WAAWqC,GAAG,CAACpF;gBACjB;YACF;QACF;IACF;IACA,OAAO+C;AACT;AAQA;;;;;;;;;;CAUC,GACD,MAAMsC,uBAAuB,CAC3BC,OACAtE,SAEAsE,MAAMC,KAAK,CAAC,CAACC;QACX,IAAIA,KAAKC,OAAO,CAACnB,QAAQ,CAAC,MAAM;YAC9B,OAAO;QACT;QACA,MAAMoB,QAAQtH,OAAOoH,KAAKC,OAAO,EAAE;YAAEE,mBAAmB;QAAK;QAC7D,IAAI,CAACD,OAAO;YACV,OAAO;QACT;QACA,OAAQF,KAAKI,QAAQ;YACnB,wEAAwE;YACxE,oBAAoB;YACpB,KAAK;YACL,KAAK;gBACH,OAAOtH,UAAU0C,QAAQ,CAAC,CAAC,EAAE0E,MAAMD,OAAO,EAAE,EAAE;oBAC5CE,mBAAmB;gBACrB;YACF,+DAA+D;YAC/D,KAAK;gBACH,OAAOrH,UACL0C,QACAwE,KAAKC,OAAO,CAACxB,KAAK,CAAC,KAAK5B,MAAM,GAAG,IAC7B,CAAC,CAAC,EAAEqD,MAAMD,OAAO,EAAE,GACnB,CAAC,CAAC,EAAEC,MAAMD,OAAO,EAAE,EACvB;oBAAEE,mBAAmB;gBAAK;YAE9B,KAAK;YACL,KAAK;YACL,KAAK;YACL,KAAK;gBACH,OAAOrH,UAAU0C,QAAQ,GAAGwE,KAAKI,QAAQ,GAAGF,MAAMD,OAAO,EAAE,EAAE;oBAC3DE,mBAAmB;gBACrB;YACF,uEAAuE;YACvE,KAAK;gBACH,OAAO;YACT;gBACE,OAAO;QACX;IACF;AAEF;;;;;;;CAOC,GACD,MAAME,oBAAoB,CACxB9F,OACA+F;IAEA,MAAMC,SAAS5H,yBAAyB2H;IACxC,IAAIC,QAAQC,SAAS,iBAAiB,CAACD,OAAOE,WAAW,EAAE5D,QAAQ;QACjE,OAAOyD;IACT;IAEA,MAAM9F,OAAO+F,OAAOG,MAAM,EAAE7D,SACxB,GAAG0D,OAAO/F,IAAI,CAAC,CAAC,EAAE+F,OAAOG,MAAM,CAACrD,IAAI,CAAC,KAAK,CAAC,CAAC,GAC5CkD,OAAO/F,IAAI;IACf,MAAMgB,SAASZ,gBAAgBL,OAAOC;IACtC,IAAI,CAACgB,QAAQ;QACX,OAAO8E;IACT;IAEA,MAAMR,QAAQS,OAAOE,WAAW;IAChC,6EAA6E;IAC7E,6DAA6D;IAC7D,MAAM,CAACE,MAAM,GAAGb;IAChB,MAAMc,aACJd,MAAMjD,MAAM,KAAK,KAAM8D,CAAAA,MAAMP,QAAQ,KAAK,QAAQO,MAAMP,QAAQ,KAAK,KAAI;IAC3E,IAAIQ,cAAc,CAACxG,gBAAgBoB,QAAQmF,MAAMV,OAAO,GAAG;QACzD,OAAOK;IACT;IACA,IAAI,CAACM,cAAcf,qBAAqBC,OAAOtE,SAAS;QACtD,OAAO8E;IACT;IACA,OAAO,GAAG9F,KAAK,EAAE,EAAEgB,QAAQ;AAC7B;AAEA,wEAAwE,GACxE,MAAMqF,iBAAiB,CAAC5F,MAAYV;IAClC,MAAMkC,UAAoB,EAAE;IAE5BjE,qBAAqByC,MAAM,KAAK,CAACyB;QAC/B,IAAI,CAACA,KAAKC,QAAQ,CAAC,mBAAmB;YACpC;QACF;QAEA,IAAIgB,UAAU;QACd,MAAMmD,mBAAmB,CAACC,eACxBC,MAAMC,OAAO,CAACF,gBACVA,aAAa5D,GAAG,CAAC,CAACmD;gBAChB,IAAI,OAAOA,gBAAgB,UAAU;oBACnC,OAAOA;gBACT;gBACA,MAAMY,SAASb,kBAAkB9F,OAAO+F;gBACxC3C,YAAYuD,WAAWZ;gBACvB,OAAOY;YACT,KACAH;QAENxH,WAAW0B,MAAMyB,MAAM,CAACyE;YACtB,MAAMC,UAAUD,KAAKC,OAAO;YAC5B,IAAIA,SAAS9E,cAAc;gBACzB8E,QAAQ9E,YAAY,GAAGwE,iBAAiBM,QAAQ9E,YAAY;YAC9D;YACA,MAAM+E,SAASF,IAAI,CAAC,oBAAoB;YAGxC,KAAK,MAAMG,SAASpF,OAAOU,IAAI,CAACyE,UAAU,CAAC,GAAI;gBAC7CA,MAAO,CAACC,MAAM,GAAGR,iBAAiBO,MAAO,CAACC,MAAM;YAClD;YACA,OAAOH;QACT;QAEA,IAAIxD,SAAS;YACXlB,QAAQS,IAAI,CAACR;QACf;IACF;IAEA,OAAOD;AACT;AAEA;;;;;CAKC,GACD,MAAM8E,yBAAyB,CAACC,UAAkBC,UAAU,EAAE,GAC5D,CAAC,oCAAoC,EAAEA,QAAQ,QAAQ,CAAC,GACxD,CAAC,4CAA4C,EAAED,SAAS,YAAY,CAAC;AAEvE,+DAA+D,GAC/D,MAAME,0BAA0B,OAC9BzG,MACAyB,MACA8E;IAEA,MAAM,CAACtB,MAAM,GACX,AAAC,MAAMjH,yBACLgC,MACAyB,MACA6E,uBAAuBC,WACvB,cACI,EAAE;IACV,sDAAsD;IACtD,OAAOtB,OAAOpF,QAAQ,UAAU;AAClC;AAEA,uDAAuD,GACvD,MAAM6G,yBAAyB,OAAO1G;IACpC,MAAMwB,UAAoB,EAAE;IAC5B,MAAMmF,iBAA2B,EAAE;IAEnCpJ,qBAAqByC,MAAM,KAAK,CAACyB;QAC/B,IAAIA,KAAKC,QAAQ,CAAC,QAAQ;YACxBiF,eAAe1E,IAAI,CAACR;QACtB;IACF;IAEA,KAAK,MAAMA,QAAQkF,eAAgB;QACjC,IAAIjE,UAAU;QACd,KAAK,MAAM,CAAC6D,UAAUhG,OAAO,IAAIU,OAAOE,OAAO,CAAC1C,oBAAqB;YACnE,MAAMwB,WAAW,MAAMwG,wBAAwBzG,MAAMyB,MAAM8E;YAC3D,IAAI,CAACtG,YAAY,CAACd,gBAAgBoB,QAAQN,WAAW;gBACnD;YACF;YACAyC,UACE,AAAC,MAAM3E,YACLiC,MACAyB,MACA6E,uBAAuBC,UAAU,CAAC,iBAAiB,EAAEhG,OAAO,GAAG,CAAC,MAC5DmC;QACV;QACA,IAAIA,SAAS;YACXlB,QAAQS,IAAI,CAACR;QACf;IACF;IAEA,OAAOD;AACT;AAEA;;;;;;CAMC,GACD,MAAMoF,mBAAwD;IAC5DC,KAAK,GAAG1I,aAAa,CAAC,EAAEC,uBAAuB;IAC/C0I,WAAW,GAAG3I,aAAa,CAAC,EAAEE,sBAAsB;AACtD;AAEA;;;CAGC,GACD,OAAO,MAAM0I,qBAAqB,OAChC/G;IAEA,MAAMgH,YAAsB,EAAE;IAC9B,MAAM1H,QAAQ,MAAMT,kBAAkBmB;IAEtC,MAAMiH,eAAe1F,iBAAiBvB,MAAMV;IAC5C,MAAMyD,WAAWV,yBAAyBrC,MAAMV;IAChD,MAAMgF,YAAYF,cAAcpE,MAAMV;IACtC,MAAM4H,aAAatB,eAAe5F,MAAMV;IACxC,MAAMqH,iBAAiB,MAAMD,uBAAuB1G;IACpD,MAAMmH,iBAAiB,MAAMpI,mBAAmBiB,MAAM4G;IACtD,MAAMQ,gBAAgBnI,yBAAyBe;IAC/C,MAAMqH,gBAAgBnI,wBAAwBc;IAC9C,MAAMsH,kBAAkB,MAAMxI,qBAAqBkB,MAAMV;IACzD,MAAMN,mBAAmBgB;IAEzB,4EAA4E;IAC5E,wDAAwD;IACxD,IAAI+C,SAASnB,MAAM,GAAG,KAAKqF,aAAarF,MAAM,GAAG,KAAK0C,UAAU1C,MAAM,GAAG,GAAG;QAC1EoF,UAAU/E,IAAI,CACZ,CAAC,mDAAmD,EAAEhE,oBACpDb,qBAAqB4C,KAAKI,IAAI,GAC9B,2BAA2B,CAAC;IAElC;IACA,IACE8G,WAAWtF,MAAM,GAAG,KACpBwF,cAAcxF,MAAM,GAAG,KACvByF,cAAczF,MAAM,GAAG,GACvB;QACAoF,UAAU/E,IAAI,CACZ,CAAC,2CAA2C,EAAE;eAAI,IAAIyC,IAAI;mBAAIwC;mBAAeE;mBAAkBC;aAAc;SAAE,CAACjF,IAAI,CAAC,MAAM,oCAAoC,CAAC;IAEpK;IACA,6EAA6E;IAC7E,8DAA8D;IAC9D,IAAI+E,eAAeI,QAAQ,CAAC3F,MAAM,GAAG,GAAG;QACtCoF,UAAU/E,IAAI,CACZ,CAAC,mBAAmB,EAAE;eAAI,IAAIyC,IAAIyC,eAAeI,QAAQ;SAAE,CAACnF,IAAI,CAAC,MAAM,+EAA+E,EAAE7D,iBAAiB,QAAQ,eAAe,EAAEI,uBAAuB,QAAQ,mEAAmE,CAAC;IAEzS;IACA,IAAIgI,eAAe/E,MAAM,GAAG,GAAG;QAC7BoF,UAAU/E,IAAI,CACZ,CAAC,4CAA4C,EAAE0E,eAAe/E,MAAM,CAAC,4FAA4F,CAAC;IAEtK;IACA,gFAAgF;IAChF,+EAA+E;IAC/E,kDAAkD;IAClD,IAAI0F,gBAAgB1F,MAAM,GAAG,GAAG;QAC9BoF,UAAU/E,IAAI,CACZ,CAAC,sCAAsC,EAAEqF,gBAAgBlF,IAAI,CAAC,MAAM,0FAA0F,CAAC;IAEnK;IAEA,6EAA6E;IAC7E,MAAMlE,qBAAqB8B;IAE3B,OAAO;QAAEgH;IAAU;AACrB,EAAE"}
+{"version":3,"sources":["../../../../../../packages/nx-plugin/src/utils/version-upgrade-migration/sync-vended-versions.ts"],"sourcesContent":["/**\n * Copyright Amazon.com, Inc. or its affiliates. All Rights Reserved.\n * SPDX-License-Identifier: Apache-2.0\n */\nimport {\n  addDependenciesToPackageJson,\n  detectPackageManager,\n  type MigrationReturnObject,\n  readJson,\n  type Tree,\n  updateJson,\n  visitNotIgnoredFiles,\n} from '@nx/devkit';\nimport yaml from 'js-yaml';\nimport { getCatalogManager } from 'nx/src/utils/catalog';\nimport { parsePipRequirementsLine } from 'pip-requirements-js';\nimport { coerce, parse, satisfies, validRange } from 'semver';\nimport { applyGritQL, captureAllGritQLVariable } from '../ast.js';\nimport { buildInstallCommand } from '../commands.js';\nimport { formatFilesInSubtree } from '../format.js';\nimport {\n  PACKAGES_DIR,\n  SHARED_CONSTRUCTS_DIR,\n  SHARED_TERRAFORM_DIR,\n} from '../shared-constructs-constants.js';\nimport { updateToml } from '../toml.js';\nimport {\n  cdkLambdaRuntime,\n  PY_VERSIONS,\n  TERRAFORM_VERSIONS,\n  TS_VERSIONS,\n  terraformLambdaRuntime,\n} from '../versions.js';\nimport { isNxPackage } from './nx-package-updates.js';\nimport {\n  type OwnedDependencies,\n  ownedDependencies,\n} from './owned-dependencies.js';\nimport { syncEmbeddedVersions } from './sync-embedded-versions.js';\nimport { syncLambdaRuntimes, type VendedIac } from './sync-lambda-runtimes.js';\nimport { syncMetricsVersion } from './sync-metrics-version.js';\nimport {\n  syncProjectPythonVersion,\n  syncPythonBundleVersion,\n} from './sync-python-language-version.js';\nimport { isVendedUpgrade } from './vended-upgrade.js';\n\n/**\n * Syncs the versions a generated workspace pins to those this release vends:\n * TypeScript dependencies (including those pinned only by an override), Python\n * pins, Terraform providers, and the plugin version the metrics files report.\n *\n * nx and `@nx/*` are excluded — `packageJsonUpdates` owns them so `nx migrate`\n * collects Nx's own migrations (see `nx-package-updates.ts`).\n */\n\n/** Workspace files holding catalog definitions, and pnpm 11's overrides. */\nconst YAML_WORKSPACE_FILES = ['pnpm-workspace.yaml', '.yarnrc.yml'];\n\n/**\n * Vended version for a dependency this workspace's generators own, or undefined\n * for one the user added themselves.\n */\nconst vendedTsVersion = (\n  owned: OwnedDependencies,\n  name: string,\n): string | undefined =>\n  isNxPackage(name) || !owned.ts.has(name)\n    ? undefined\n    : TS_VERSIONS[name as keyof typeof TS_VERSIONS];\n\n/** PY_VERSIONS records the `==` operator; the pin holds the bare version. */\nconst vendedPyVersion = (\n  owned: OwnedDependencies,\n  name: string,\n): string | undefined =>\n  owned.py.has(name)\n    ? PY_VERSIONS[name as keyof typeof PY_VERSIONS]?.replace(/^==/, '')\n    : undefined;\n\n/** Protocols whose version lives elsewhere, and is synced there instead. */\nconst REFERENCE_PROTOCOL =\n  /^(?:workspace|file|link|npm|git|git\\+|github|portal|patch|exec):/;\n\n/**\n * Whether devkit may be handed this specifier.\n *\n * `catalog:` is only safe where devkit has a catalog manager (pnpm, yarn, bun).\n * Without one it rewrites the reference to a literal version, severing the\n * catalog — so those references are synced directly instead.\n */\nconst isSyncableSpecifier = (\n  tree: Tree,\n  declared: unknown,\n): declared is string => {\n  // A manifest is the user's file and may hold anything. A version that isn't a\n  // string is not one this can reason about, and throwing here would abort the\n  // whole `nx migrate` over a file the sync only meant to skip.\n  if (typeof declared !== 'string') {\n    return false;\n  }\n  if (REFERENCE_PROTOCOL.test(declared)) {\n    return false;\n  }\n  return (\n    !declared.startsWith('catalog:') || getCatalogManager(tree.root) !== null\n  );\n};\n\n/**\n * Whether the declared range already permits the vended version, following a\n * `catalog:` reference to the range it points at.\n *\n * Devkit would narrow such a range to an exact pin, discarding a user's widened\n * specifier without changing what resolves, so it is left alone.\n */\nconst alreadyPermitsVended = (\n  tree: Tree,\n  packageName: string,\n  declared: string,\n  vended: string,\n): boolean => {\n  let range = declared;\n  if (declared.startsWith('catalog:')) {\n    const resolved = getCatalogManager(tree.root)?.resolveCatalogReference(\n      tree,\n      packageName,\n      declared,\n    );\n    if (!resolved) {\n      return false;\n    }\n    range = resolved;\n  }\n  range = range.trim();\n  // An exact pin is the case to upgrade, not a range to preserve.\n  if (parse(range) !== null || validRange(range) === null) {\n    return false;\n  }\n  return satisfies(vended, range);\n};\n\n/**\n * Version the sync moves a declared TypeScript dependency to, or undefined when\n * it leaves the declaration as it is.\n *\n * Devkit then writes it only when it is higher than the declared version.\n */\nexport const syncedTsVersion = (\n  tree: Tree,\n  owned: OwnedDependencies,\n  name: string,\n  declared: unknown,\n): string | undefined => {\n  const vended = vendedTsVersion(owned, name);\n  return vended &&\n    isSyncableSpecifier(tree, declared) &&\n    !alreadyPermitsVended(tree, name, declared, vended)\n    ? vended\n    : undefined;\n};\n\n/**\n * Vended packages a manifest already declares, and the version to move each to.\n *\n * Only packages already present are named: devkit adds whatever it is given, so\n * passing the full vended list would inject all of it into every manifest.\n */\nconst declaredVendedPackages = (\n  tree: Tree,\n  owned: OwnedDependencies,\n  packageJsonPath: string,\n): {\n  dependencies: Record<string, string>;\n  devDependencies: Record<string, string>;\n} => {\n  const json = readJson(tree, packageJsonPath);\n  const pick = (field: 'dependencies' | 'devDependencies') =>\n    Object.fromEntries(\n      Object.entries((json[field] ?? {}) as Record<string, string>).flatMap(\n        ([name, declared]) => {\n          const vended = syncedTsVersion(tree, owned, name, declared);\n          return vended ? [[name, vended] as const] : [];\n        },\n      ),\n    );\n  return {\n    dependencies: pick('dependencies'),\n    devDependencies: pick('devDependencies'),\n  };\n};\n\n/**\n * Sync the TypeScript dependencies every `package.json` declares.\n *\n * Devkit does the writing: it moves a version wherever the workspace keeps it —\n * through a `catalog:` reference or directly — and refuses anything that isn't a\n * strict upgrade on what is installed.\n *\n * Called directly rather than through this plugin's wrapper, which *migrates*\n * declarations into the catalog; right when generating, wrong for a version bump.\n */\nconst syncPackageJsons = (tree: Tree, owned: OwnedDependencies): string[] => {\n  const updated: string[] = [];\n\n  visitNotIgnoredFiles(tree, '.', (path) => {\n    if (!path.endsWith('package.json')) {\n      return;\n    }\n    const { dependencies, devDependencies } = declaredVendedPackages(\n      tree,\n      owned,\n      path,\n    );\n    if (\n      Object.keys(dependencies).length === 0 &&\n      Object.keys(devDependencies).length === 0\n    ) {\n      return;\n    }\n\n    const before = tree.read(path, 'utf-8');\n    const catalogsBefore = readCatalogFiles(tree);\n    // Install callback dropped: `nx migrate` runs install itself.\n    addDependenciesToPackageJson(tree, dependencies, devDependencies, path);\n    if (\n      tree.read(path, 'utf-8') !== before ||\n      readCatalogFiles(tree) !== catalogsBefore\n    ) {\n      updated.push(path);\n    }\n  });\n\n  return updated;\n};\n\n/** Snapshot of every catalog definition file, for change detection. */\nconst readCatalogFiles = (tree: Tree): string =>\n  [...YAML_WORKSPACE_FILES, 'package.json']\n    .map((path) => (tree.exists(path) ? tree.read(path, 'utf-8') : ''))\n    .join('\\0');\n\n/**\n * Upgrade vended catalog entries devkit cannot reach: those no manifest\n * references.\n */\nconst syncOrphanCatalogEntries = (\n  tree: Tree,\n  owned: OwnedDependencies,\n): string[] => {\n  const referenced = referencedCatalogPackages(tree);\n  const updated: string[] = [];\n\n  const syncCatalog = (\n    catalog: Record<string, string> | undefined,\n  ): boolean => {\n    let changed = false;\n    for (const [name, declared] of Object.entries(catalog ?? {})) {\n      const vended = vendedTsVersion(owned, name);\n      if (!vended || referenced.has(name)) {\n        continue;\n      }\n      if (isVendedUpgrade(vended, String(declared))) {\n        catalog![name] = vended;\n        changed = true;\n      }\n    }\n    return changed;\n  };\n\n  for (const path of YAML_WORKSPACE_FILES) {\n    if (!tree.exists(path)) {\n      continue;\n    }\n    const catalogFile = (yaml.load(tree.read(path, 'utf-8') ?? '') ?? {}) as {\n      catalog?: Record<string, string>;\n      catalogs?: Record<string, Record<string, string>>;\n    };\n    const changed = [\n      syncCatalog(catalogFile.catalog),\n      ...Object.values(catalogFile.catalogs ?? {}).map(syncCatalog),\n    ].some(Boolean);\n    if (changed) {\n      tree.write(path, yaml.dump(catalogFile, { quotingType: \"'\" }));\n      updated.push(path);\n    }\n  }\n\n  // Bun keeps its catalogs in the root manifest.\n  if (tree.exists('package.json')) {\n    let changed = false;\n    updateJson(tree, 'package.json', (json) => {\n      changed = [\n        syncCatalog(json.catalog),\n        ...Object.values(\n          (json.catalogs ?? {}) as Record<string, Record<string, string>>,\n        ).map(syncCatalog),\n      ].some(Boolean);\n      return json;\n    });\n    if (changed) {\n      updated.push('package.json');\n    }\n  }\n\n  return updated;\n};\n\n/**\n * The package an override key pins, or undefined when the key names none.\n *\n * A key is a package name, optionally preceded by the path it is scoped to and\n * followed by the parent range it applies at:\n *\n *   zod                                     -> zod\n *   zod@^3                                  -> zod\n *   **&#47;@modelcontextprotocol/sdk/zod        -> zod\n *   @prisma/adapter-pg/@types/pg            -> @types/pg\n *\n * The last segment is the package, since every earlier one is a parent it is\n * scoped under — except that a scope and the name after it are one segment.\n */\nconst overriddenPackage = (key: string): string | undefined => {\n  const segments = key.split('/').reduce<string[]>((acc, part) => {\n    // A bare `@scope` is only half a name; join it to what follows.\n    const previous = acc[acc.length - 1];\n    if (previous?.startsWith('@') && !previous.includes('/')) {\n      acc[acc.length - 1] = `${previous}/${part}`;\n      return acc;\n    }\n    acc.push(part);\n    return acc;\n  }, []);\n\n  const name = segments[segments.length - 1];\n  if (!name || name === '.') {\n    return undefined;\n  }\n  // A trailing `@range` scopes the override to a parent version.\n  const at = name.lastIndexOf('@');\n  return at > 0 ? name.slice(0, at) : name;\n};\n\n/**\n * Sync the owned packages an override pins, wherever the workspace keeps them:\n * npm's `overrides`, yarn and bun's `resolutions`, and pnpm's `pnpm.overrides`\n * (10) or `pnpm-workspace.yaml` `overrides` (11).\n *\n * Devkit does not manage these fields, so an owned package pinned only here\n * would otherwise stay on the version it was generated with. Values are compared\n * with `isVendedUpgrade`, so a range the user widened is left alone.\n */\n/**\n * Where the workspace's package manager reads overrides from.\n *\n * Only the root manifest is considered: every package manager resolves overrides\n * from the workspace root, so a nested `overrides` block is inert and rewriting\n * it would imply an effect it doesn't have.\n *\n * pnpm moved the block between majors — 10 reads `pnpm.overrides` in the\n * manifest, 11 reads `overrides` in `pnpm-workspace.yaml` — so both are covered\n * rather than detecting the minor.\n */\nconst overrideLocations = (\n  tree: Tree,\n): {\n  manifestFields: readonly ('overrides' | 'resolutions' | 'pnpm.overrides')[];\n  workspaceFile?: string;\n} => {\n  switch (detectPackageManager(tree.root)) {\n    case 'npm':\n      return { manifestFields: ['overrides'] };\n    case 'yarn':\n      return { manifestFields: ['resolutions'] };\n    case 'bun':\n      // Bun reads npm's `overrides` and yarn's `resolutions` alike.\n      return { manifestFields: ['overrides', 'resolutions'] };\n    default:\n      return {\n        manifestFields: ['pnpm.overrides'],\n        workspaceFile: 'pnpm-workspace.yaml',\n      };\n  }\n};\n\nconst syncOverrides = (tree: Tree, owned: OwnedDependencies): string[] => {\n  const updated: string[] = [];\n\n  // Nested npm overrides carry the pin under `.`, with sibling keys scoping\n  // deeper, so a value may be a string or another override object.\n  const syncOverrideTree = (overrides: unknown): boolean => {\n    if (typeof overrides !== 'object' || overrides === null) {\n      return false;\n    }\n    let changed = false;\n    for (const [key, value] of Object.entries(\n      overrides as Record<string, unknown>,\n    )) {\n      if (typeof value === 'object' && value !== null) {\n        changed = syncOverrideTree(value) || changed;\n        continue;\n      }\n      if (typeof value !== 'string') {\n        continue;\n      }\n      // `.` pins the package its parent key names.\n      const name =\n        key === '.' ? undefined : (overriddenPackage(key) ?? undefined);\n      const vended = name ? vendedTsVersion(owned, name) : undefined;\n      if (vended && isVendedUpgrade(vended, value)) {\n        (overrides as Record<string, unknown>)[key] = vended;\n        changed = true;\n      }\n    }\n    return changed;\n  };\n\n  const { manifestFields, workspaceFile } = overrideLocations(tree);\n\n  if (manifestFields.length > 0) {\n    let changed = false;\n    updateJson(tree, 'package.json', (json) => {\n      changed = manifestFields\n        .map((field) =>\n          syncOverrideTree(\n            field === 'pnpm.overrides' ? json.pnpm?.overrides : json[field],\n          ),\n        )\n        .some(Boolean);\n      return json;\n    });\n    if (changed) {\n      updated.push('package.json');\n    }\n  }\n\n  if (workspaceFile && tree.exists(workspaceFile)) {\n    const contents = (yaml.load(tree.read(workspaceFile, 'utf-8') ?? '') ??\n      {}) as Record<string, unknown>;\n    if (syncOverrideTree(contents.overrides)) {\n      tree.write(workspaceFile, yaml.dump(contents, { quotingType: \"'\" }));\n      updated.push(workspaceFile);\n    }\n  }\n\n  return updated;\n};\n\n/**\n * Packages devkit already maintains through a `catalog:` reference. Empty\n * without a catalog manager, where no reference resolves.\n */\nconst referencedCatalogPackages = (tree: Tree): Set<string> => {\n  const referenced = new Set<string>();\n  if (getCatalogManager(tree.root) === null) {\n    return referenced;\n  }\n  visitNotIgnoredFiles(tree, '.', (path) => {\n    if (!path.endsWith('package.json')) {\n      return;\n    }\n    const json = readJson(tree, path);\n    for (const field of ['dependencies', 'devDependencies'] as const) {\n      for (const [name, declared] of Object.entries(\n        (json[field] ?? {}) as Record<string, string>,\n      )) {\n        if (String(declared).startsWith('catalog:')) {\n          referenced.add(name);\n        }\n      }\n    }\n  });\n  return referenced;\n};\n\n/** Pip specifier as `pip-requirements-js` reports it. */\ninterface PyVersionSpec {\n  readonly operator: string;\n  readonly version: string;\n}\n\n/**\n * Whether the declared specifiers already permit the vended version, so\n * rewriting them would discard the user's range without changing what resolves.\n *\n * This mirrors the TypeScript side: an exact pin is the case to upgrade, a range\n * that already reaches the vended version is left alone, and a range that falls\n * short is moved up.\n *\n * A `*` wildcard or a specifier semver can't read counts as already permitting,\n * so anything not understood is left as the user wrote it.\n */\nconst pyRangePermitsVended = (\n  specs: readonly PyVersionSpec[],\n  vended: string,\n): boolean =>\n  specs.every((spec) => {\n    if (spec.version.includes('*')) {\n      return true;\n    }\n    const bound = coerce(spec.version, { includePrerelease: true });\n    if (!bound) {\n      return true;\n    }\n    switch (spec.operator) {\n      // An exact pin permits only itself, so a differing vended version is an\n      // upgrade to apply.\n      case '==':\n      case '===':\n        return satisfies(vended, `=${bound.version}`, {\n          includePrerelease: true,\n        });\n      // `~=1.2.3` allows the patch series; `~=1.2` the minor series.\n      case '~=':\n        return satisfies(\n          vended,\n          spec.version.split('.').length > 2\n            ? `~${bound.version}`\n            : `^${bound.version}`,\n          { includePrerelease: true },\n        );\n      case '>=':\n      case '>':\n      case '<=':\n      case '<':\n        return satisfies(vended, `${spec.operator}${bound.version}`, {\n          includePrerelease: true,\n        });\n      // `!=` only excludes, so it never blocks the vended version by itself.\n      case '!=':\n        return true;\n      default:\n        return true;\n    }\n  });\n\n/**\n * Upgrade a pip requirement to the vended version, or return it unchanged.\n *\n * Parsed rather than pattern-matched so extras and operators are read the way\n * `uv` reads them. A requirement whose specifiers already permit the vended\n * version keeps them; one that falls short is replaced with an exact pin, which\n * is what the generators write.\n */\nconst syncPyRequirement = (\n  owned: OwnedDependencies,\n  requirement: string,\n): string => {\n  const parsed = parsePipRequirementsLine(requirement);\n  if (parsed?.type !== 'ProjectName' || !parsed.versionSpec?.length) {\n    return requirement;\n  }\n\n  const name = parsed.extras?.length\n    ? `${parsed.name}[${parsed.extras.join(',')}]`\n    : parsed.name;\n  const vended = vendedPyVersion(owned, name);\n  if (!vended) {\n    return requirement;\n  }\n\n  const specs = parsed.versionSpec as readonly PyVersionSpec[];\n  // Never move a version backwards: a pin above what this release vends is the\n  // user's, and a range already reaching it is theirs to keep.\n  const [first] = specs;\n  const isExactPin =\n    specs.length === 1 && (first.operator === '==' || first.operator === '===');\n  if (isExactPin && !isVendedUpgrade(vended, first.version)) {\n    return requirement;\n  }\n  if (!isExactPin && pyRangePermitsVended(specs, vended)) {\n    return requirement;\n  }\n  return `${name}==${vended}`;\n};\n\n/** Sync pins in every `pyproject.toml`, dependencies and groups alike. */\nconst syncPyProjects = (tree: Tree, owned: OwnedDependencies): string[] => {\n  const updated: string[] = [];\n\n  visitNotIgnoredFiles(tree, '.', (path) => {\n    if (!path.endsWith('pyproject.toml')) {\n      return;\n    }\n\n    let changed = false;\n    const syncRequirements = (requirements: unknown): unknown =>\n      Array.isArray(requirements)\n        ? requirements.map((requirement) => {\n            if (typeof requirement !== 'string') {\n              return requirement;\n            }\n            const synced = syncPyRequirement(owned, requirement);\n            changed ||= synced !== requirement;\n            return synced;\n          })\n        : requirements;\n\n    updateToml(tree, path, (toml) => {\n      const project = toml.project as Record<string, unknown> | undefined;\n      if (project?.dependencies) {\n        project.dependencies = syncRequirements(project.dependencies) as never;\n      }\n      const groups = toml['dependency-groups'] as\n        | Record<string, unknown>\n        | undefined;\n      for (const group of Object.keys(groups ?? {})) {\n        groups![group] = syncRequirements(groups![group]) as never;\n      }\n      return toml;\n    });\n\n    if (changed) {\n      updated.push(path);\n    }\n  });\n\n  return updated;\n};\n\n/**\n * GritQL matching one provider's `version` in `required_providers`, scoped by\n * the sibling `source` so an alias or another provider's version can't match.\n *\n * `language hcl` is required — without it the pattern silently matches nothing.\n */\nconst providerVersionPattern = (provider: string, rewrite = ''): string =>\n  `language hcl\\n\\`version = $version\\`${rewrite} where {` +\n  ` $version <: within \\`{ source = \"hashicorp/${provider}\" $... }\\` }`;\n\n/** Version a provider currently declares, if it declares one. */\nconst declaredProviderVersion = async (\n  tree: Tree,\n  path: string,\n  provider: string,\n): Promise<string | undefined> => {\n  const [bound] =\n    (await captureAllGritQLVariable(\n      tree,\n      path,\n      providerVersionPattern(provider),\n      'version',\n    )) ?? [];\n  // The binding is the quoted version, e.g. `\"6.40.0\"`.\n  return bound?.replace(/^\"|\"$/g, '');\n};\n\n/** Sync vended provider versions in every `.tf` file. */\nconst syncTerraformProviders = async (tree: Tree): Promise<string[]> => {\n  const updated: string[] = [];\n  const terraformFiles: string[] = [];\n\n  visitNotIgnoredFiles(tree, '.', (path) => {\n    if (path.endsWith('.tf')) {\n      terraformFiles.push(path);\n    }\n  });\n\n  for (const path of terraformFiles) {\n    let changed = false;\n    for (const [provider, vended] of Object.entries(TERRAFORM_VERSIONS)) {\n      const declared = await declaredProviderVersion(tree, path, provider);\n      if (!declared || !isVendedUpgrade(vended, declared)) {\n        continue;\n      }\n      changed =\n        (await applyGritQL(\n          tree,\n          path,\n          providerVersionPattern(provider, ` => \\`version = \"${vended}\"\\``),\n        )) || changed;\n    }\n    if (changed) {\n      updated.push(path);\n    }\n  }\n\n  return updated;\n};\n\n/**\n * The projects this plugin generates infrastructure into, per provider.\n *\n * A runtime is not a dependency, so there is no per-package ownership to consult —\n * these directories are the scope. A Lambda a user defined in their own project\n * keeps whatever runtime they chose, even though it is the same shape.\n */\nconst OWNED_INFRA_DIRS: Readonly<Record<VendedIac, string>> = {\n  cdk: `${PACKAGES_DIR}/${SHARED_CONSTRUCTS_DIR}`,\n  terraform: `${PACKAGES_DIR}/${SHARED_TERRAFORM_DIR}`,\n};\n\n/**\n * Sync the versions this release vends, for the dependencies the workspace's\n * generators own.\n */\nexport const syncVendedVersions = async (\n  tree: Tree,\n): Promise<MigrationReturnObject> => {\n  const nextSteps: string[] = [];\n  const owned = await ownedDependencies(tree);\n\n  const packageJsons = syncPackageJsons(tree, owned);\n  const catalogs = syncOrphanCatalogEntries(tree, owned);\n  const overrides = syncOverrides(tree, owned);\n  const pyProjects = syncPyProjects(tree, owned);\n  const terraformFiles = await syncTerraformProviders(tree);\n  const lambdaRuntimes = await syncLambdaRuntimes(tree, OWNED_INFRA_DIRS);\n  const projectPython = syncProjectPythonVersion(tree);\n  const pythonBundles = syncPythonBundleVersion(tree);\n  const skippedEmbedded = await syncEmbeddedVersions(tree, owned);\n  await syncMetricsVersion(tree);\n\n  // Lock files are left to the user: `nx migrate` only installs when the root\n  // manifest changes, and never runs `uv` or `terraform`.\n  if (catalogs.length > 0 || packageJsons.length > 0 || overrides.length > 0) {\n    nextSteps.push(\n      `TypeScript dependency versions were updated. Run \\`${buildInstallCommand(\n        detectPackageManager(tree.root),\n      )}\\` to update the lock file.`,\n    );\n  }\n  if (\n    pyProjects.length > 0 ||\n    projectPython.length > 0 ||\n    pythonBundles.length > 0\n  ) {\n    nextSteps.push(\n      `Python dependency versions were updated in ${[...new Set([...pyProjects, ...projectPython, ...pythonBundles])].join(', ')}. Run \\`uv sync\\` to update uv.lock.`,\n    );\n  }\n  // A runtime the sync recognised is simply moved; one it doesn't recognise is\n  // the user's choice, so it is reported rather than rewritten.\n  if (lambdaRuntimes.diverged.length > 0) {\n    nextSteps.push(\n      `Lambda runtimes in ${[...new Set(lambdaRuntimes.diverged)].join(', ')} have diverged from the generated shape and were left untouched. Set them to \\`${cdkLambdaRuntime('node')}\\` (CDK) or \\`\"${terraformLambdaRuntime('node')}\"\\` (Terraform) if you want them on the runtime this release vends.`,\n    );\n  }\n  if (terraformFiles.length > 0) {\n    nextSteps.push(\n      `Terraform provider versions were updated in ${terraformFiles.length} file(s). Run \\`terraform init -upgrade\\` in each Terraform project to update its lock file.`,\n    );\n  }\n  // A synced embedded pin needs no next step — it is read the next time the thing\n  // holding it runs. A file the sync left alone does: its versions are still the\n  // old ones, and only the user can reconcile that.\n  if (skippedEmbedded.length > 0) {\n    nextSteps.push(\n      `Version pins were left as they are in ${skippedEmbedded.join(', ')}, which repeat a pin more times than this migration rewrites at once. Update them by hand.`,\n    );\n  }\n\n  // Without this the workspace's own format check fails on the migrated files.\n  await formatFilesInSubtree(tree);\n\n  return { nextSteps };\n};\n"],"names":["addDependenciesToPackageJson","detectPackageManager","readJson","updateJson","visitNotIgnoredFiles","yaml","getCatalogManager","parsePipRequirementsLine","coerce","parse","satisfies","validRange","applyGritQL","captureAllGritQLVariable","buildInstallCommand","formatFilesInSubtree","PACKAGES_DIR","SHARED_CONSTRUCTS_DIR","SHARED_TERRAFORM_DIR","updateToml","cdkLambdaRuntime","PY_VERSIONS","TERRAFORM_VERSIONS","TS_VERSIONS","terraformLambdaRuntime","isNxPackage","ownedDependencies","syncEmbeddedVersions","syncLambdaRuntimes","syncMetricsVersion","syncProjectPythonVersion","syncPythonBundleVersion","isVendedUpgrade","YAML_WORKSPACE_FILES","vendedTsVersion","owned","name","ts","has","undefined","vendedPyVersion","py","replace","REFERENCE_PROTOCOL","isSyncableSpecifier","tree","declared","test","startsWith","root","alreadyPermitsVended","packageName","vended","range","resolved","resolveCatalogReference","trim","syncedTsVersion","declaredVendedPackages","packageJsonPath","json","pick","field","Object","fromEntries","entries","flatMap","dependencies","devDependencies","syncPackageJsons","updated","path","endsWith","keys","length","before","read","catalogsBefore","readCatalogFiles","push","map","exists","join","syncOrphanCatalogEntries","referenced","referencedCatalogPackages","syncCatalog","catalog","changed","String","catalogFile","load","values","catalogs","some","Boolean","write","dump","quotingType","overriddenPackage","key","segments","split","reduce","acc","part","previous","includes","at","lastIndexOf","slice","overrideLocations","manifestFields","workspaceFile","syncOverrides","syncOverrideTree","overrides","value","pnpm","contents","Set","add","pyRangePermitsVended","specs","every","spec","version","bound","includePrerelease","operator","syncPyRequirement","requirement","parsed","type","versionSpec","extras","first","isExactPin","syncPyProjects","syncRequirements","requirements","Array","isArray","synced","toml","project","groups","group","providerVersionPattern","provider","rewrite","declaredProviderVersion","syncTerraformProviders","terraformFiles","OWNED_INFRA_DIRS","cdk","terraform","syncVendedVersions","nextSteps","packageJsons","pyProjects","lambdaRuntimes","projectPython","pythonBundles","skippedEmbedded","diverged"],"mappings":"AAAA;;;CAGC,GACD,SACEA,4BAA4B,EAC5BC,oBAAoB,EAEpBC,QAAQ,EAERC,UAAU,EACVC,oBAAoB,QACf,aAAa;AACpB,OAAOC,UAAU,UAAU;AAC3B,SAASC,iBAAiB,QAAQ,uBAAuB;AACzD,SAASC,wBAAwB,QAAQ,sBAAsB;AAC/D,SAASC,MAAM,EAAEC,KAAK,EAAEC,SAAS,EAAEC,UAAU,QAAQ,SAAS;AAC9D,SAASC,WAAW,EAAEC,wBAAwB,QAAQ,YAAY;AAClE,SAASC,mBAAmB,QAAQ,iBAAiB;AACrD,SAASC,oBAAoB,QAAQ,eAAe;AACpD,SACEC,YAAY,EACZC,qBAAqB,EACrBC,oBAAoB,QACf,oCAAoC;AAC3C,SAASC,UAAU,QAAQ,aAAa;AACxC,SACEC,gBAAgB,EAChBC,WAAW,EACXC,kBAAkB,EAClBC,WAAW,EACXC,sBAAsB,QACjB,iBAAiB;AACxB,SAASC,WAAW,QAAQ,0BAA0B;AACtD,SAEEC,iBAAiB,QACZ,0BAA0B;AACjC,SAASC,oBAAoB,QAAQ,8BAA8B;AACnE,SAASC,kBAAkB,QAAwB,4BAA4B;AAC/E,SAASC,kBAAkB,QAAQ,4BAA4B;AAC/D,SACEC,wBAAwB,EACxBC,uBAAuB,QAClB,oCAAoC;AAC3C,SAASC,eAAe,QAAQ,sBAAsB;AAEtD;;;;;;;CAOC,GAED,0EAA0E,GAC1E,MAAMC,uBAAuB;IAAC;IAAuB;CAAc;AAEnE;;;CAGC,GACD,MAAMC,kBAAkB,CACtBC,OACAC,OAEAX,YAAYW,SAAS,CAACD,MAAME,EAAE,CAACC,GAAG,CAACF,QAC/BG,YACAhB,WAAW,CAACa,KAAiC;AAEnD,2EAA2E,GAC3E,MAAMI,kBAAkB,CACtBL,OACAC,OAEAD,MAAMM,EAAE,CAACH,GAAG,CAACF,QACTf,WAAW,CAACe,KAAiC,EAAEM,QAAQ,OAAO,MAC9DH;AAEN,0EAA0E,GAC1E,MAAMI,qBACJ;AAEF;;;;;;CAMC,GACD,MAAMC,sBAAsB,CAC1BC,MACAC;IAEA,8EAA8E;IAC9E,6EAA6E;IAC7E,8DAA8D;IAC9D,IAAI,OAAOA,aAAa,UAAU;QAChC,OAAO;IACT;IACA,IAAIH,mBAAmBI,IAAI,CAACD,WAAW;QACrC,OAAO;IACT;IACA,OACE,CAACA,SAASE,UAAU,CAAC,eAAe1C,kBAAkBuC,KAAKI,IAAI,MAAM;AAEzE;AAEA;;;;;;CAMC,GACD,MAAMC,uBAAuB,CAC3BL,MACAM,aACAL,UACAM;IAEA,IAAIC,QAAQP;IACZ,IAAIA,SAASE,UAAU,CAAC,aAAa;QACnC,MAAMM,WAAWhD,kBAAkBuC,KAAKI,IAAI,GAAGM,wBAC7CV,MACAM,aACAL;QAEF,IAAI,CAACQ,UAAU;YACb,OAAO;QACT;QACAD,QAAQC;IACV;IACAD,QAAQA,MAAMG,IAAI;IAClB,gEAAgE;IAChE,IAAI/C,MAAM4C,WAAW,QAAQ1C,WAAW0C,WAAW,MAAM;QACvD,OAAO;IACT;IACA,OAAO3C,UAAU0C,QAAQC;AAC3B;AAEA;;;;;CAKC,GACD,OAAO,MAAMI,kBAAkB,CAC7BZ,MACAV,OACAC,MACAU;IAEA,MAAMM,SAASlB,gBAAgBC,OAAOC;IACtC,OAAOgB,UACLR,oBAAoBC,MAAMC,aAC1B,CAACI,qBAAqBL,MAAMT,MAAMU,UAAUM,UAC1CA,SACAb;AACN,EAAE;AAEF;;;;;CAKC,GACD,MAAMmB,yBAAyB,CAC7Bb,MACAV,OACAwB;IAKA,MAAMC,OAAO1D,SAAS2C,MAAMc;IAC5B,MAAME,OAAO,CAACC,QACZC,OAAOC,WAAW,CAChBD,OAAOE,OAAO,CAAEL,IAAI,CAACE,MAAM,IAAI,CAAC,GAA8BI,OAAO,CACnE,CAAC,CAAC9B,MAAMU,SAAS;YACf,MAAMM,SAASK,gBAAgBZ,MAAMV,OAAOC,MAAMU;YAClD,OAAOM,SAAS;gBAAC;oBAAChB;oBAAMgB;iBAAO;aAAU,GAAG,EAAE;QAChD;IAGN,OAAO;QACLe,cAAcN,KAAK;QACnBO,iBAAiBP,KAAK;IACxB;AACF;AAEA;;;;;;;;;CASC,GACD,MAAMQ,mBAAmB,CAACxB,MAAYV;IACpC,MAAMmC,UAAoB,EAAE;IAE5BlE,qBAAqByC,MAAM,KAAK,CAAC0B;QAC/B,IAAI,CAACA,KAAKC,QAAQ,CAAC,iBAAiB;YAClC;QACF;QACA,MAAM,EAAEL,YAAY,EAAEC,eAAe,EAAE,GAAGV,uBACxCb,MACAV,OACAoC;QAEF,IACER,OAAOU,IAAI,CAACN,cAAcO,MAAM,KAAK,KACrCX,OAAOU,IAAI,CAACL,iBAAiBM,MAAM,KAAK,GACxC;YACA;QACF;QAEA,MAAMC,SAAS9B,KAAK+B,IAAI,CAACL,MAAM;QAC/B,MAAMM,iBAAiBC,iBAAiBjC;QACxC,8DAA8D;QAC9D7C,6BAA6B6C,MAAMsB,cAAcC,iBAAiBG;QAClE,IACE1B,KAAK+B,IAAI,CAACL,MAAM,aAAaI,UAC7BG,iBAAiBjC,UAAUgC,gBAC3B;YACAP,QAAQS,IAAI,CAACR;QACf;IACF;IAEA,OAAOD;AACT;AAEA,qEAAqE,GACrE,MAAMQ,mBAAmB,CAACjC,OACxB;WAAIZ;QAAsB;KAAe,CACtC+C,GAAG,CAAC,CAACT,OAAU1B,KAAKoC,MAAM,CAACV,QAAQ1B,KAAK+B,IAAI,CAACL,MAAM,WAAW,IAC9DW,IAAI,CAAC;AAEV;;;CAGC,GACD,MAAMC,2BAA2B,CAC/BtC,MACAV;IAEA,MAAMiD,aAAaC,0BAA0BxC;IAC7C,MAAMyB,UAAoB,EAAE;IAE5B,MAAMgB,cAAc,CAClBC;QAEA,IAAIC,UAAU;QACd,KAAK,MAAM,CAACpD,MAAMU,SAAS,IAAIiB,OAAOE,OAAO,CAACsB,WAAW,CAAC,GAAI;YAC5D,MAAMnC,SAASlB,gBAAgBC,OAAOC;YACtC,IAAI,CAACgB,UAAUgC,WAAW9C,GAAG,CAACF,OAAO;gBACnC;YACF;YACA,IAAIJ,gBAAgBoB,QAAQqC,OAAO3C,YAAY;gBAC7CyC,OAAQ,CAACnD,KAAK,GAAGgB;gBACjBoC,UAAU;YACZ;QACF;QACA,OAAOA;IACT;IAEA,KAAK,MAAMjB,QAAQtC,qBAAsB;QACvC,IAAI,CAACY,KAAKoC,MAAM,CAACV,OAAO;YACtB;QACF;QACA,MAAMmB,cAAerF,KAAKsF,IAAI,CAAC9C,KAAK+B,IAAI,CAACL,MAAM,YAAY,OAAO,CAAC;QAInE,MAAMiB,UAAU;YACdF,YAAYI,YAAYH,OAAO;eAC5BxB,OAAO6B,MAAM,CAACF,YAAYG,QAAQ,IAAI,CAAC,GAAGb,GAAG,CAACM;SAClD,CAACQ,IAAI,CAACC;QACP,IAAIP,SAAS;YACX3C,KAAKmD,KAAK,CAACzB,MAAMlE,KAAK4F,IAAI,CAACP,aAAa;gBAAEQ,aAAa;YAAI;YAC3D5B,QAAQS,IAAI,CAACR;QACf;IACF;IAEA,+CAA+C;IAC/C,IAAI1B,KAAKoC,MAAM,CAAC,iBAAiB;QAC/B,IAAIO,UAAU;QACdrF,WAAW0C,MAAM,gBAAgB,CAACe;YAChC4B,UAAU;gBACRF,YAAY1B,KAAK2B,OAAO;mBACrBxB,OAAO6B,MAAM,CACbhC,KAAKiC,QAAQ,IAAI,CAAC,GACnBb,GAAG,CAACM;aACP,CAACQ,IAAI,CAACC;YACP,OAAOnC;QACT;QACA,IAAI4B,SAAS;YACXlB,QAAQS,IAAI,CAAC;QACf;IACF;IAEA,OAAOT;AACT;AAEA;;;;;;;;;;;;;CAaC,GACD,MAAM6B,oBAAoB,CAACC;IACzB,MAAMC,WAAWD,IAAIE,KAAK,CAAC,KAAKC,MAAM,CAAW,CAACC,KAAKC;QACrD,gEAAgE;QAChE,MAAMC,WAAWF,GAAG,CAACA,IAAI9B,MAAM,GAAG,EAAE;QACpC,IAAIgC,UAAU1D,WAAW,QAAQ,CAAC0D,SAASC,QAAQ,CAAC,MAAM;YACxDH,GAAG,CAACA,IAAI9B,MAAM,GAAG,EAAE,GAAG,GAAGgC,SAAS,CAAC,EAAED,MAAM;YAC3C,OAAOD;QACT;QACAA,IAAIzB,IAAI,CAAC0B;QACT,OAAOD;IACT,GAAG,EAAE;IAEL,MAAMpE,OAAOiE,QAAQ,CAACA,SAAS3B,MAAM,GAAG,EAAE;IAC1C,IAAI,CAACtC,QAAQA,SAAS,KAAK;QACzB,OAAOG;IACT;IACA,+DAA+D;IAC/D,MAAMqE,KAAKxE,KAAKyE,WAAW,CAAC;IAC5B,OAAOD,KAAK,IAAIxE,KAAK0E,KAAK,CAAC,GAAGF,MAAMxE;AACtC;AAEA;;;;;;;;CAQC,GACD;;;;;;;;;;CAUC,GACD,MAAM2E,oBAAoB,CACxBlE;IAKA,OAAQ5C,qBAAqB4C,KAAKI,IAAI;QACpC,KAAK;YACH,OAAO;gBAAE+D,gBAAgB;oBAAC;iBAAY;YAAC;QACzC,KAAK;YACH,OAAO;gBAAEA,gBAAgB;oBAAC;iBAAc;YAAC;QAC3C,KAAK;YACH,8DAA8D;YAC9D,OAAO;gBAAEA,gBAAgB;oBAAC;oBAAa;iBAAc;YAAC;QACxD;YACE,OAAO;gBACLA,gBAAgB;oBAAC;iBAAiB;gBAClCC,eAAe;YACjB;IACJ;AACF;AAEA,MAAMC,gBAAgB,CAACrE,MAAYV;IACjC,MAAMmC,UAAoB,EAAE;IAE5B,0EAA0E;IAC1E,iEAAiE;IACjE,MAAM6C,mBAAmB,CAACC;QACxB,IAAI,OAAOA,cAAc,YAAYA,cAAc,MAAM;YACvD,OAAO;QACT;QACA,IAAI5B,UAAU;QACd,KAAK,MAAM,CAACY,KAAKiB,MAAM,IAAItD,OAAOE,OAAO,CACvCmD,WACC;YACD,IAAI,OAAOC,UAAU,YAAYA,UAAU,MAAM;gBAC/C7B,UAAU2B,iBAAiBE,UAAU7B;gBACrC;YACF;YACA,IAAI,OAAO6B,UAAU,UAAU;gBAC7B;YACF;YACA,6CAA6C;YAC7C,MAAMjF,OACJgE,QAAQ,MAAM7D,YAAa4D,kBAAkBC,QAAQ7D;YACvD,MAAMa,SAAShB,OAAOF,gBAAgBC,OAAOC,QAAQG;YACrD,IAAIa,UAAUpB,gBAAgBoB,QAAQiE,QAAQ;gBAC3CD,SAAqC,CAAChB,IAAI,GAAGhD;gBAC9CoC,UAAU;YACZ;QACF;QACA,OAAOA;IACT;IAEA,MAAM,EAAEwB,cAAc,EAAEC,aAAa,EAAE,GAAGF,kBAAkBlE;IAE5D,IAAImE,eAAetC,MAAM,GAAG,GAAG;QAC7B,IAAIc,UAAU;QACdrF,WAAW0C,MAAM,gBAAgB,CAACe;YAChC4B,UAAUwB,eACPhC,GAAG,CAAC,CAAClB,QACJqD,iBACErD,UAAU,mBAAmBF,KAAK0D,IAAI,EAAEF,YAAYxD,IAAI,CAACE,MAAM,GAGlEgC,IAAI,CAACC;YACR,OAAOnC;QACT;QACA,IAAI4B,SAAS;YACXlB,QAAQS,IAAI,CAAC;QACf;IACF;IAEA,IAAIkC,iBAAiBpE,KAAKoC,MAAM,CAACgC,gBAAgB;QAC/C,MAAMM,WAAYlH,KAAKsF,IAAI,CAAC9C,KAAK+B,IAAI,CAACqC,eAAe,YAAY,OAC/D,CAAC;QACH,IAAIE,iBAAiBI,SAASH,SAAS,GAAG;YACxCvE,KAAKmD,KAAK,CAACiB,eAAe5G,KAAK4F,IAAI,CAACsB,UAAU;gBAAErB,aAAa;YAAI;YACjE5B,QAAQS,IAAI,CAACkC;QACf;IACF;IAEA,OAAO3C;AACT;AAEA;;;CAGC,GACD,MAAMe,4BAA4B,CAACxC;IACjC,MAAMuC,aAAa,IAAIoC;IACvB,IAAIlH,kBAAkBuC,KAAKI,IAAI,MAAM,MAAM;QACzC,OAAOmC;IACT;IACAhF,qBAAqByC,MAAM,KAAK,CAAC0B;QAC/B,IAAI,CAACA,KAAKC,QAAQ,CAAC,iBAAiB;YAClC;QACF;QACA,MAAMZ,OAAO1D,SAAS2C,MAAM0B;QAC5B,KAAK,MAAMT,SAAS;YAAC;YAAgB;SAAkB,CAAW;YAChE,KAAK,MAAM,CAAC1B,MAAMU,SAAS,IAAIiB,OAAOE,OAAO,CAC1CL,IAAI,CAACE,MAAM,IAAI,CAAC,GAChB;gBACD,IAAI2B,OAAO3C,UAAUE,UAAU,CAAC,aAAa;oBAC3CoC,WAAWqC,GAAG,CAACrF;gBACjB;YACF;QACF;IACF;IACA,OAAOgD;AACT;AAQA;;;;;;;;;;CAUC,GACD,MAAMsC,uBAAuB,CAC3BC,OACAvE,SAEAuE,MAAMC,KAAK,CAAC,CAACC;QACX,IAAIA,KAAKC,OAAO,CAACnB,QAAQ,CAAC,MAAM;YAC9B,OAAO;QACT;QACA,MAAMoB,QAAQvH,OAAOqH,KAAKC,OAAO,EAAE;YAAEE,mBAAmB;QAAK;QAC7D,IAAI,CAACD,OAAO;YACV,OAAO;QACT;QACA,OAAQF,KAAKI,QAAQ;YACnB,wEAAwE;YACxE,oBAAoB;YACpB,KAAK;YACL,KAAK;gBACH,OAAOvH,UAAU0C,QAAQ,CAAC,CAAC,EAAE2E,MAAMD,OAAO,EAAE,EAAE;oBAC5CE,mBAAmB;gBACrB;YACF,+DAA+D;YAC/D,KAAK;gBACH,OAAOtH,UACL0C,QACAyE,KAAKC,OAAO,CAACxB,KAAK,CAAC,KAAK5B,MAAM,GAAG,IAC7B,CAAC,CAAC,EAAEqD,MAAMD,OAAO,EAAE,GACnB,CAAC,CAAC,EAAEC,MAAMD,OAAO,EAAE,EACvB;oBAAEE,mBAAmB;gBAAK;YAE9B,KAAK;YACL,KAAK;YACL,KAAK;YACL,KAAK;gBACH,OAAOtH,UAAU0C,QAAQ,GAAGyE,KAAKI,QAAQ,GAAGF,MAAMD,OAAO,EAAE,EAAE;oBAC3DE,mBAAmB;gBACrB;YACF,uEAAuE;YACvE,KAAK;gBACH,OAAO;YACT;gBACE,OAAO;QACX;IACF;AAEF;;;;;;;CAOC,GACD,MAAME,oBAAoB,CACxB/F,OACAgG;IAEA,MAAMC,SAAS7H,yBAAyB4H;IACxC,IAAIC,QAAQC,SAAS,iBAAiB,CAACD,OAAOE,WAAW,EAAE5D,QAAQ;QACjE,OAAOyD;IACT;IAEA,MAAM/F,OAAOgG,OAAOG,MAAM,EAAE7D,SACxB,GAAG0D,OAAOhG,IAAI,CAAC,CAAC,EAAEgG,OAAOG,MAAM,CAACrD,IAAI,CAAC,KAAK,CAAC,CAAC,GAC5CkD,OAAOhG,IAAI;IACf,MAAMgB,SAASZ,gBAAgBL,OAAOC;IACtC,IAAI,CAACgB,QAAQ;QACX,OAAO+E;IACT;IAEA,MAAMR,QAAQS,OAAOE,WAAW;IAChC,6EAA6E;IAC7E,6DAA6D;IAC7D,MAAM,CAACE,MAAM,GAAGb;IAChB,MAAMc,aACJd,MAAMjD,MAAM,KAAK,KAAM8D,CAAAA,MAAMP,QAAQ,KAAK,QAAQO,MAAMP,QAAQ,KAAK,KAAI;IAC3E,IAAIQ,cAAc,CAACzG,gBAAgBoB,QAAQoF,MAAMV,OAAO,GAAG;QACzD,OAAOK;IACT;IACA,IAAI,CAACM,cAAcf,qBAAqBC,OAAOvE,SAAS;QACtD,OAAO+E;IACT;IACA,OAAO,GAAG/F,KAAK,EAAE,EAAEgB,QAAQ;AAC7B;AAEA,wEAAwE,GACxE,MAAMsF,iBAAiB,CAAC7F,MAAYV;IAClC,MAAMmC,UAAoB,EAAE;IAE5BlE,qBAAqByC,MAAM,KAAK,CAAC0B;QAC/B,IAAI,CAACA,KAAKC,QAAQ,CAAC,mBAAmB;YACpC;QACF;QAEA,IAAIgB,UAAU;QACd,MAAMmD,mBAAmB,CAACC,eACxBC,MAAMC,OAAO,CAACF,gBACVA,aAAa5D,GAAG,CAAC,CAACmD;gBAChB,IAAI,OAAOA,gBAAgB,UAAU;oBACnC,OAAOA;gBACT;gBACA,MAAMY,SAASb,kBAAkB/F,OAAOgG;gBACxC3C,YAAYuD,WAAWZ;gBACvB,OAAOY;YACT,KACAH;QAENzH,WAAW0B,MAAM0B,MAAM,CAACyE;YACtB,MAAMC,UAAUD,KAAKC,OAAO;YAC5B,IAAIA,SAAS9E,cAAc;gBACzB8E,QAAQ9E,YAAY,GAAGwE,iBAAiBM,QAAQ9E,YAAY;YAC9D;YACA,MAAM+E,SAASF,IAAI,CAAC,oBAAoB;YAGxC,KAAK,MAAMG,SAASpF,OAAOU,IAAI,CAACyE,UAAU,CAAC,GAAI;gBAC7CA,MAAO,CAACC,MAAM,GAAGR,iBAAiBO,MAAO,CAACC,MAAM;YAClD;YACA,OAAOH;QACT;QAEA,IAAIxD,SAAS;YACXlB,QAAQS,IAAI,CAACR;QACf;IACF;IAEA,OAAOD;AACT;AAEA;;;;;CAKC,GACD,MAAM8E,yBAAyB,CAACC,UAAkBC,UAAU,EAAE,GAC5D,CAAC,oCAAoC,EAAEA,QAAQ,QAAQ,CAAC,GACxD,CAAC,4CAA4C,EAAED,SAAS,YAAY,CAAC;AAEvE,+DAA+D,GAC/D,MAAME,0BAA0B,OAC9B1G,MACA0B,MACA8E;IAEA,MAAM,CAACtB,MAAM,GACX,AAAC,MAAMlH,yBACLgC,MACA0B,MACA6E,uBAAuBC,WACvB,cACI,EAAE;IACV,sDAAsD;IACtD,OAAOtB,OAAOrF,QAAQ,UAAU;AAClC;AAEA,uDAAuD,GACvD,MAAM8G,yBAAyB,OAAO3G;IACpC,MAAMyB,UAAoB,EAAE;IAC5B,MAAMmF,iBAA2B,EAAE;IAEnCrJ,qBAAqByC,MAAM,KAAK,CAAC0B;QAC/B,IAAIA,KAAKC,QAAQ,CAAC,QAAQ;YACxBiF,eAAe1E,IAAI,CAACR;QACtB;IACF;IAEA,KAAK,MAAMA,QAAQkF,eAAgB;QACjC,IAAIjE,UAAU;QACd,KAAK,MAAM,CAAC6D,UAAUjG,OAAO,IAAIW,OAAOE,OAAO,CAAC3C,oBAAqB;YACnE,MAAMwB,WAAW,MAAMyG,wBAAwB1G,MAAM0B,MAAM8E;YAC3D,IAAI,CAACvG,YAAY,CAACd,gBAAgBoB,QAAQN,WAAW;gBACnD;YACF;YACA0C,UACE,AAAC,MAAM5E,YACLiC,MACA0B,MACA6E,uBAAuBC,UAAU,CAAC,iBAAiB,EAAEjG,OAAO,GAAG,CAAC,MAC5DoC;QACV;QACA,IAAIA,SAAS;YACXlB,QAAQS,IAAI,CAACR;QACf;IACF;IAEA,OAAOD;AACT;AAEA;;;;;;CAMC,GACD,MAAMoF,mBAAwD;IAC5DC,KAAK,GAAG3I,aAAa,CAAC,EAAEC,uBAAuB;IAC/C2I,WAAW,GAAG5I,aAAa,CAAC,EAAEE,sBAAsB;AACtD;AAEA;;;CAGC,GACD,OAAO,MAAM2I,qBAAqB,OAChChH;IAEA,MAAMiH,YAAsB,EAAE;IAC9B,MAAM3H,QAAQ,MAAMT,kBAAkBmB;IAEtC,MAAMkH,eAAe1F,iBAAiBxB,MAAMV;IAC5C,MAAM0D,WAAWV,yBAAyBtC,MAAMV;IAChD,MAAMiF,YAAYF,cAAcrE,MAAMV;IACtC,MAAM6H,aAAatB,eAAe7F,MAAMV;IACxC,MAAMsH,iBAAiB,MAAMD,uBAAuB3G;IACpD,MAAMoH,iBAAiB,MAAMrI,mBAAmBiB,MAAM6G;IACtD,MAAMQ,gBAAgBpI,yBAAyBe;IAC/C,MAAMsH,gBAAgBpI,wBAAwBc;IAC9C,MAAMuH,kBAAkB,MAAMzI,qBAAqBkB,MAAMV;IACzD,MAAMN,mBAAmBgB;IAEzB,4EAA4E;IAC5E,wDAAwD;IACxD,IAAIgD,SAASnB,MAAM,GAAG,KAAKqF,aAAarF,MAAM,GAAG,KAAK0C,UAAU1C,MAAM,GAAG,GAAG;QAC1EoF,UAAU/E,IAAI,CACZ,CAAC,mDAAmD,EAAEjE,oBACpDb,qBAAqB4C,KAAKI,IAAI,GAC9B,2BAA2B,CAAC;IAElC;IACA,IACE+G,WAAWtF,MAAM,GAAG,KACpBwF,cAAcxF,MAAM,GAAG,KACvByF,cAAczF,MAAM,GAAG,GACvB;QACAoF,UAAU/E,IAAI,CACZ,CAAC,2CAA2C,EAAE;eAAI,IAAIyC,IAAI;mBAAIwC;mBAAeE;mBAAkBC;aAAc;SAAE,CAACjF,IAAI,CAAC,MAAM,oCAAoC,CAAC;IAEpK;IACA,6EAA6E;IAC7E,8DAA8D;IAC9D,IAAI+E,eAAeI,QAAQ,CAAC3F,MAAM,GAAG,GAAG;QACtCoF,UAAU/E,IAAI,CACZ,CAAC,mBAAmB,EAAE;eAAI,IAAIyC,IAAIyC,eAAeI,QAAQ;SAAE,CAACnF,IAAI,CAAC,MAAM,+EAA+E,EAAE9D,iBAAiB,QAAQ,eAAe,EAAEI,uBAAuB,QAAQ,mEAAmE,CAAC;IAEzS;IACA,IAAIiI,eAAe/E,MAAM,GAAG,GAAG;QAC7BoF,UAAU/E,IAAI,CACZ,CAAC,4CAA4C,EAAE0E,eAAe/E,MAAM,CAAC,4FAA4F,CAAC;IAEtK;IACA,gFAAgF;IAChF,+EAA+E;IAC/E,kDAAkD;IAClD,IAAI0F,gBAAgB1F,MAAM,GAAG,GAAG;QAC9BoF,UAAU/E,IAAI,CACZ,CAAC,sCAAsC,EAAEqF,gBAAgBlF,IAAI,CAAC,MAAM,0FAA0F,CAAC;IAEnK;IAEA,6EAA6E;IAC7E,MAAMnE,qBAAqB8B;IAE3B,OAAO;QAAEiH;IAAU;AACrB,EAAE"}

package/src/utils/versions.d.ts

@@ -13,19 +13,19 @@ export declare const TS_VERSIONS: {
     readonly minimatch: "10.2.6";
     readonly 'deepmerge-ts': "8.0.2";
     readonly mysql2: "3.24.6";
-    readonly '@aws-sdk/client-dynamodb': "3.1152.0";
-    readonly '@aws-sdk/client-api-gateway': "3.1152.0";
-    readonly '@aws-sdk/client-iam': "3.1152.0";
-    readonly '@aws-sdk/client-bedrock-agentcore': "3.1152.0";
-    readonly '@aws-sdk/client-bedrock-runtime': "3.1152.0";
-    readonly '@aws-sdk/client-greengrassv2': "3.1152.0";
-    readonly '@aws-sdk/client-s3': "3.1152.0";
-    readonly '@aws-sdk/client-sts': "3.1152.0";
-    readonly '@aws-sdk/client-cognito-identity-provider': "3.1152.0";
-    readonly '@aws-sdk/credential-providers': "3.1152.0";
-    readonly '@aws-sdk/credential-provider-cognito-identity': "3.972.73";
-    readonly '@aws-sdk/client-secrets-manager': "3.1152.0";
-    readonly '@aws-sdk/rds-signer': "3.1152.0";
+    readonly '@aws-sdk/client-dynamodb': "3.1156.0";
+    readonly '@aws-sdk/client-api-gateway': "3.1156.0";
+    readonly '@aws-sdk/client-iam': "3.1156.0";
+    readonly '@aws-sdk/client-bedrock-agentcore': "3.1156.0";
+    readonly '@aws-sdk/client-bedrock-runtime': "3.1156.0";
+    readonly '@aws-sdk/client-greengrassv2': "3.1156.0";
+    readonly '@aws-sdk/client-s3': "3.1156.0";
+    readonly '@aws-sdk/client-sts': "3.1156.0";
+    readonly '@aws-sdk/client-cognito-identity-provider': "3.1156.0";
+    readonly '@aws-sdk/credential-providers': "3.1156.0";
+    readonly '@aws-sdk/credential-provider-cognito-identity': "3.972.75";
+    readonly '@aws-sdk/client-secrets-manager': "3.1156.0";
+    readonly '@aws-sdk/rds-signer': "3.1156.0";
     readonly '@smithy/server-apigateway': "0.3.4";
     readonly '@smithy/server-node': "0.3.4";
     readonly '@aws-lambda-powertools/logger': "2.36.0";
@@ -33,43 +33,43 @@ export declare const TS_VERSIONS: {
     readonly '@aws-lambda-powertools/parameters': "2.36.0";
     readonly '@aws-lambda-powertools/tracer': "2.36.0";
     readonly '@aws-lambda-powertools/parser': "2.36.0";
-    readonly '@aws-sdk/client-appconfigdata': "3.1152.0";
+    readonly '@aws-sdk/client-appconfigdata': "3.1156.0";
     readonly '@middy/core': "7.9.2";
-    readonly '@nxlv/python': "23.2.1";
+    readonly '@nxlv/python': "23.3.1";
     readonly '@nx-extend/terraform': "10.4.1";
-    readonly nx: "23.3.0";
-    readonly '@nx/devkit': "23.3.0";
-    readonly '@nx/js': "23.3.0";
-    readonly '@nx/react': "23.3.0";
-    readonly '@nx/vite': "23.3.0";
-    readonly '@nx/vitest': "23.3.0";
-    readonly '@nx/workspace': "23.3.0";
-    readonly 'create-nx-workspace': "23.3.0";
+    readonly nx: "23.3.1";
+    readonly '@nx/devkit': "23.3.1";
+    readonly '@nx/js': "23.3.1";
+    readonly '@nx/react': "23.3.1";
+    readonly '@nx/vite': "23.3.1";
+    readonly '@nx/vitest': "23.3.1";
+    readonly '@nx/workspace': "23.3.1";
+    readonly 'create-nx-workspace': "23.3.1";
     readonly '@swc-node/register': "1.12.1";
-    readonly '@swc/core': "1.16.18";
-    readonly '@modelcontextprotocol/sdk': "1.32.1";
-    readonly '@modelcontextprotocol/client': "2.3.1";
-    readonly '@modelcontextprotocol/inspector': "2.11.0";
+    readonly '@swc/core': "1.16.20";
+    readonly '@modelcontextprotocol/sdk': "1.32.2";
+    readonly '@modelcontextprotocol/client': "2.4.0";
+    readonly '@modelcontextprotocol/inspector': "2.12.0";
     readonly '@ag-ui/a2ui-toolkit': "0.0.5";
-    readonly '@ag-ui/aws-strands': "1.0.0";
+    readonly '@ag-ui/aws-strands': "1.0.1";
     readonly '@ag-ui/client': "1.0.2";
     readonly '@ag-ui/core': "1.0.2";
     readonly '@ag-ui/encoder': "1.0.2";
     readonly 'agent-chat-cli': "0.3.0";
     readonly '@copilotkit/react-core': "1.79.1";
     readonly rxjs: "7.8.2";
-    readonly '@strands-agents/sdk': "1.21.0";
-    readonly '@tanstack/react-router': "1.170.45";
-    readonly '@tanstack/router-plugin': "1.168.47";
-    readonly '@tanstack/router-generator': "1.167.45";
+    readonly '@strands-agents/sdk': "1.22.0";
+    readonly '@tanstack/react-router': "1.170.46";
+    readonly '@tanstack/router-plugin': "1.168.48";
+    readonly '@tanstack/router-generator': "1.167.46";
     readonly '@tanstack/virtual-file-routes': "1.162.0";
     readonly '@tanstack/router-utils': "1.162.4";
-    readonly '@cloudscape-design/board-components': "3.0.238";
-    readonly '@cloudscape-design/chat-components': "1.0.179";
-    readonly '@cloudscape-design/components': "3.0.1401";
+    readonly '@cloudscape-design/board-components': "3.0.240";
+    readonly '@cloudscape-design/chat-components': "1.0.182";
+    readonly '@cloudscape-design/components': "3.0.1404";
     readonly '@cloudscape-design/global-styles': "1.0.71";
-    readonly '@tanstack/react-query': "5.104.4";
-    readonly '@tanstack/react-query-devtools': "5.104.4";
+    readonly '@tanstack/react-query': "5.104.5";
+    readonly '@tanstack/react-query-devtools': "5.104.5";
     readonly '@trpc/tanstack-react-query': "11.19.0";
     readonly '@trpc/client': "11.19.0";
     readonly '@trpc/server': "11.19.0";
@@ -84,16 +84,16 @@ export declare const TS_VERSIONS: {
     readonly '@smithy/node-config-provider': "4.6.2";
     readonly '@smithy/node-http-handler': "4.12.1";
     readonly '@smithy/types': "4.19.0";
-    readonly '@vitest/coverage-v8': "5.0.4";
-    readonly '@vitest/ui': "5.0.4";
+    readonly '@vitest/coverage-v8': "5.0.5";
+    readonly '@vitest/ui': "5.0.5";
     readonly '@astrojs/react': "6.0.6";
-    readonly '@astrojs/starlight': "0.42.6";
-    readonly astro: "7.4.0";
+    readonly '@astrojs/starlight': "0.42.7";
+    readonly astro: "7.4.2";
     readonly cookie: "2.0.1";
     readonly aws4fetch: "1.0.20";
-    readonly 'aws-cdk': "2.1145.0";
-    readonly 'aws-cdk-lib': "2.273.0";
-    readonly 'aws-iot-device-sdk-v2': "1.28.0";
+    readonly 'aws-cdk': "2.1146.1";
+    readonly 'aws-cdk-lib': "2.274.0";
+    readonly 'aws-iot-device-sdk-v2': "1.28.2";
     readonly 'aws-xray-sdk-core': "3.12.0";
     readonly constructs: "10.8.1";
     readonly cors: "2.8.6";
@@ -105,7 +105,7 @@ export declare const TS_VERSIONS: {
     readonly esbuild: "0.28.2";
     readonly 'event-source-polyfill': "1.0.31";
     readonly '@types/event-source-polyfill': "1.0.5";
-    readonly '@biomejs/biome': "2.5.15";
+    readonly '@biomejs/biome': "2.6.3";
     readonly '@prisma/adapter-mariadb': "7.10.1";
     readonly '@prisma/adapter-pg': "7.10.1";
     readonly '@prisma/client': "7.10.1";
@@ -118,7 +118,7 @@ export declare const TS_VERSIONS: {
     readonly '@types/fs-extra': "11.0.4";
     readonly 'js-yaml': "4.3.2";
     readonly mariadb: "3.5.4";
-    readonly mise: "2026.10.14";
+    readonly mise: "2026.10.19";
     readonly npm: "12.2.1";
     readonly 'npm-check-updates': "23.1.1";
     readonly 'oidc-client-ts': "3.5.0";
@@ -127,7 +127,7 @@ export declare const TS_VERSIONS: {
     readonly 'react-oidc-context': "3.3.1";
     readonly react: "19.3.1";
     readonly 'react-dom': "19.3.1";
-    readonly rolldown: "1.2.14";
+    readonly rolldown: "1.2.15";
     readonly 'rolldown-plugin-dts': "0.28.8";
     readonly shx: "0.4.0";
     readonly 'simple-git': "4.0.2";
@@ -136,13 +136,13 @@ export declare const TS_VERSIONS: {
     readonly tailwindcss: "4.3.3";
     readonly '@tailwindcss/vite': "4.3.3";
     readonly tsx: "4.23.15";
-    readonly 'lucide-react': "1.59.0";
+    readonly 'lucide-react': "1.61.0";
     readonly 'radix-ui': "1.8.1";
     readonly shadcn: "4.22.1";
     readonly 'tw-animate-css': "1.4.0";
-    readonly vite: "8.3.4";
+    readonly vite: "8.3.5";
     readonly typescript: "6.0.3";
-    readonly vitest: "5.0.4";
+    readonly vitest: "5.0.5";
     readonly jsdom: "29.1.1";
     readonly zod: "4.6.7";
     readonly ws: "8.22.0";
@@ -190,7 +190,7 @@ export declare const NX_PACKAGES: readonly ["nx", "@nx/devkit", "@nx/js", "@nx/r
  * The nx version the plugin is built against, and the single source of truth
  * for every place a workspace's nx is pinned.
  */
-export declare const NX_VERSION: "23.3.0";
+export declare const NX_VERSION: "23.3.1";
 /**
  * Versions for Python dependencies added by generators
  */
@@ -200,36 +200,36 @@ export declare const PY_VERSIONS: {
     readonly 'ag-ui-protocol': "==0.1.22";
     readonly 'ag-ui-strands': "==0.4.1";
     readonly aiosqlite: "==0.22.1";
-    readonly 'aws-lambda-powertools': "==3.36.0";
-    readonly 'aws-lambda-powertools[tracer]': "==3.36.0";
-    readonly 'aws-lambda-powertools[parser]': "==3.36.0";
+    readonly 'aws-lambda-powertools': "==3.37.0";
+    readonly 'aws-lambda-powertools[tracer]': "==3.37.0";
+    readonly 'aws-lambda-powertools[parser]': "==3.37.0";
     readonly 'aws-opentelemetry-distro': "==0.21.0";
     readonly awsiotsdk: "==1.31.0";
-    readonly 'bedrock-agentcore': "==1.24.2";
-    readonly boto3: "==1.43.115";
-    readonly checkov: "==3.3.29";
-    readonly fastapi: "==0.150.0";
-    readonly 'fastapi[standard]': "==0.150.0";
+    readonly 'bedrock-agentcore': "==1.25.0";
+    readonly boto3: "==1.43.118";
+    readonly checkov: "==3.3.30";
+    readonly fastapi: "==0.162.0";
+    readonly 'fastapi[standard]': "==0.162.0";
     readonly httpx: "==0.28.1";
-    readonly langchain: "==1.4.6";
+    readonly langchain: "==1.4.7";
     readonly 'langchain-aws': "==1.9.0";
     readonly 'langchain-mcp-adapters': "==0.3.2";
-    readonly langgraph: "==1.2.16";
-    readonly 'langgraph-checkpoint-aws': "==1.2.5";
+    readonly langgraph: "==1.2.17";
+    readonly 'langgraph-checkpoint-aws': "==1.2.6";
     readonly 'langgraph-checkpoint-sqlite': "==3.1.2";
     readonly mcp: "==1.28.1";
     readonly 'pip-check-updates': "==0.29.0";
     readonly 'pip-licenses': "==5.5.5";
     readonly pydantic: "==2.14.1";
-    readonly ruff: "==0.17.1";
-    readonly 'strands-agents': "==1.61.1";
-    readonly 'strands-agents[a2a]': "==1.61.1";
-    readonly 'strands-agents-tools': "==0.8.9";
+    readonly ruff: "==0.17.2";
+    readonly 'strands-agents': "==1.62.0";
+    readonly 'strands-agents[a2a]': "==1.62.0";
+    readonly 'strands-agents-tools': "==0.8.10";
     readonly ty: "==0.0.89";
     readonly pynamodb: "==6.1.0";
     readonly uvicorn: "==0.54.0";
     readonly sqlmodel: "==0.0.48";
-    readonly alembic: "==1.20.0";
+    readonly alembic: "==1.20.1";
     readonly aiomysql: "==0.3.2";
     readonly asyncpg: "==0.32.0";
     readonly greenlet: "==3.5.6";
@@ -392,8 +392,8 @@ export declare const terraformLambdaRuntimeVars: () => {
  * Pinned exactly (no range operator) so generated infrastructure is reproducible.
  */
 export declare const TERRAFORM_VERSIONS: {
-    readonly aws: "6.69.1";
-    readonly awscc: "1.100.0";
+    readonly aws: "6.70.0";
+    readonly awscc: "1.107.0";
     readonly random: "3.9.1";
     readonly null: "3.3.2";
     readonly archive: "2.8.1";
@@ -407,8 +407,8 @@ export type ITerraformProviderVersion = keyof typeof TERRAFORM_VERSIONS;
  * generated `.tf` templates (e.g. `version = "<%- awsProviderVersion %>"`)
  */
 export declare const terraformProviderVersions: () => {
-    awsProviderVersion: "6.69.1";
-    awsccProviderVersion: "1.100.0";
+    awsProviderVersion: "6.70.0";
+    awsccProviderVersion: "1.107.0";
     randomProviderVersion: "3.9.1";
     nullProviderVersion: "3.3.2";
     archiveProviderVersion: "2.8.1";