@aws/nx-plugin 1.3.0 → 1.3.1

package/src/utils/format.js.map

@@ -1 +1 @@
-{"version":3,"sources":["../../../../../packages/nx-plugin/src/utils/format.ts"],"sourcesContent":["/**\n * Copyright Amazon.com, Inc. or its affiliates. All Rights Reserved.\n * SPDX-License-Identifier: Apache-2.0\n */\n\nimport { Biome } from '@biomejs/js-api/nodejs';\nimport { getProjects, type Tree } from '@nx/devkit';\nimport { createRequire } from 'module';\nimport path from 'path';\nimport { type RuffOptions, ruffFixAndFormat } from './ruff.js';\nimport { tryReadToml } from './toml.js';\nimport { TS_VERSIONS } from './versions.js';\n\n/**\n * The Biome release the wasm bindings are built from. Must match\n * `TS_VERSIONS['@biomejs/biome']`, the CLI the vended targets run.\n */\nexport const BIOME_WASM_VERSION: string = createRequire(import.meta.url)(\n  '@biomejs/wasm-nodejs/package.json',\n).version;\n\n/**\n * Excludes test reports — including the vendored scripts vitest's coverage HTML\n * reporter writes — from formatting and linting.\n */\nexport const BIOME_TEST_OUTPUT_EXCLUDE = '!**/test-output';\n\n/**\n * The transient bundle rolldown writes beside a `rolldown.config.ts` while\n * loading it.\n *\n * Loading a TypeScript config bundles it to `rolldown.config.<hash>.js` in the\n * config's own directory, imports it, then unlinks it. That file exists for as\n * long as the bundle takes, so a `format` or `lint` target running concurrently\n * in the same project sees a machine-generated file — reported unformatted,\n * failing the target for no fault of the source.\n *\n * `.*js` rather than `.js`, since the extension follows the config's own: a\n * `.mts` config bundles to `.mjs`, a `.cts` one to `.cjs`.\n */\nexport const ROLLDOWN_CONFIG_BUNDLE_GLOB = '**/rolldown.config.*.*js';\n\n/** Keeps rolldown's transient config bundle out of formatting and linting. */\nexport const BIOME_ROLLDOWN_CONFIG_BUNDLE_EXCLUDE = `!${ROLLDOWN_CONFIG_BUNDLE_GLOB}`;\n\n/**\n * The biome.json vended into a new workspace. The pnpm catalog resolver is only\n * included on pnpm workspaces, since `experimentalPnpmCatalogs` is Biome's only\n * catalog resolver and reads `pnpm-workspace.yaml` exclusively — it does nothing\n * for yarn or bun catalogs, so vending it there would be misleading.\n */\nexport const getDefaultBiomeConfig = (tree: Tree) => ({\n  $schema: `https://biomejs.dev/schemas/${TS_VERSIONS['@biomejs/biome']}/schema.json`,\n  root: true,\n  formatter: {\n    enabled: true,\n    indentStyle: 'space',\n    indentWidth: 2,\n    lineWidth: 80,\n  },\n  javascript: {\n    formatter: {\n      quoteStyle: 'single',\n      trailingCommas: 'all',\n    },\n    // Resolve `catalog:` versions from pnpm-workspace.yaml (pnpm workspaces only).\n    ...(tree.exists('pnpm-workspace.yaml')\n      ? { resolver: { experimentalPnpmCatalogs: true } }\n      : {}),\n  },\n  css: {\n    formatter: {\n      quoteStyle: 'single',\n    },\n    linter: {\n      enabled: false,\n    },\n  },\n  linter: {\n    enabled: true,\n    rules: {\n      preset: 'none',\n      correctness: {\n        // Every project must declare the third-party dependencies its source\n        // code imports in its own package.json.\n        noUndeclaredDependencies: 'error',\n      },\n    },\n  },\n  assist: {\n    actions: {\n      source: {\n        organizeImports: 'on',\n      },\n    },\n  },\n  files: {\n    includes: [\n      '**',\n      '!**/dist',\n      '!**/out-tsc',\n      BIOME_TEST_OUTPUT_EXCLUDE,\n      BIOME_ROLLDOWN_CONFIG_BUNDLE_EXCLUDE,\n      '!**/node_modules',\n      '!**/.nx',\n      '!**/.venv',\n      // GritQL codemod cache written by generators — its sample sources\n      // otherwise pollute a bare `biome check .` with parse errors.\n      '!**/.grit',\n      '!**/*.css',\n      '!**/*.gen.*',\n      '!**/generated/**',\n      '!**/tsconfig*.json',\n    ],\n  },\n  // Config files, build scripts and tests use root tooling rather than\n  // declaring it per-project, so the undeclared-dependency rule is off for them.\n  overrides: [\n    {\n      includes: [\n        '**/*.config.{ts,mts,cts,js,mjs,cjs}',\n        '**/*.{spec,test}.{ts,tsx,mts,cts,js,jsx,mjs,cjs}',\n        '**/*.stories.{ts,tsx}',\n      ],\n      linter: {\n        rules: {\n          correctness: {\n            noUndeclaredDependencies: 'off',\n          },\n        },\n      },\n    },\n  ],\n});\n\nconst BIOME_FORMATTABLE_EXTENSIONS = new Set([\n  '.ts',\n  '.tsx',\n  '.js',\n  '.jsx',\n  '.mjs',\n  '.cjs',\n  '.mts',\n  '.cts',\n  '.json',\n  '.jsonc',\n  '.css',\n]);\n\n/** Matches `tsconfig.json` and variants like `tsconfig.lib.json`. */\nconst isTsConfig = (filePath: string): boolean =>\n  /(^|\\/)tsconfig[^/]*\\.json$/.test(filePath);\n\nexport interface FormatFilesInSubtreeOptions {\n  /**\n   * Paths, relative to the workspace root, to leave untouched.\n   *\n   * For files another tool owns the formatting of: formatting them here makes\n   * generation non-idempotent, since the tool rewrites them in its own shape on\n   * the next run and the workspace flips between the two forms.\n   */\n  readonly ignore?: readonly string[];\n}\n\n/**\n * Paths declared ignored for a tree, which stay ignored for every later call.\n *\n * A call formats every change pending in the tree, not only the ones its caller\n * made, so the list cannot be scoped to the call that passes it: generators\n * composing on one tree would reformat a file an earlier generator had excluded.\n * Once the generator that owns a file declares it ignored, it stays ignored for\n * the rest of the run.\n */\nconst treeIgnoredPaths = new WeakMap<Tree, Set<string>>();\n\n/**\n * Tree paths are workspace-relative and forward-slash separated. Normalise so a\n * caller building a path with `path.join` on Windows still matches.\n */\nconst normalizeTreePath = (filePath: string): string =>\n  filePath.split(path.sep).join('/').replace(/^\\.\\//, '');\n\n/**\n * Format files in the given directory within the tree.\n * Handles both TypeScript/JavaScript/JSON (via biome) and Python (via ruff) files.\n * See https://github.com/nrwl/nx/blob/4cd640a9187954505d12de5b6d76a90d8ce4c2eb/packages/devkit/src/generators/format-files.ts#L11\n */\nexport async function formatFilesInSubtree(\n  tree: Tree,\n  dir?: string,\n  options?: FormatFilesInSubtreeOptions,\n): Promise<void> {\n  let ignored = treeIgnoredPaths.get(tree);\n  if (options?.ignore?.length) {\n    if (!ignored) {\n      ignored = new Set();\n      treeIgnoredPaths.set(tree, ignored);\n    }\n    for (const filePath of options.ignore) {\n      ignored.add(normalizeTreePath(filePath));\n    }\n  }\n  const changedFiles = tree\n    .listChanges()\n    .filter((file) => file.type !== 'DELETE')\n    .filter((file) => (dir ? file.path.startsWith(dir) : true))\n    .filter((file) => !ignored?.has(normalizeTreePath(file.path)));\n\n  const pyFiles = changedFiles.filter((file) => file.path.endsWith('.py'));\n  const otherFiles = changedFiles.filter(\n    (file) =>\n      BIOME_FORMATTABLE_EXTENSIONS.has(path.extname(file.path)) &&\n      // tsconfigs are not biome-managed: they're excluded from the vended\n      // format target (Nx's typescript-sync rewrites them without formatting),\n      // so formatting them at generation would only diverge from the form\n      // written on later runs. Leave them as updateJson/writeJson emit them so\n      // repeated generation stays idempotent.\n      !isTsConfig(file.path),\n  );\n\n  // Resolve each project's ruff settings (module names, line-length) so files\n  // are formatted to match the on-disk build (see getPythonProjectRuffConfigs).\n  const pythonProjectConfigs = pyFiles.length\n    ? getPythonProjectRuffConfigs(tree)\n    : [];\n\n  // Format Python files with ruff (lint fixes + formatting)\n  for (const file of pyFiles) {\n    try {\n      const content = ruffFixAndFormat(\n        file.content.toString('utf-8'),\n        file.path,\n        resolveRuffOptions(\n          readRuffConfig(tree, file.path),\n          getOwningProjectRuffConfig(file.path, pythonProjectConfigs),\n        ),\n      );\n      tree.write(file.path, content);\n    } catch {\n      // Silently skip ruff formatting failures\n    }\n  }\n\n  if (otherFiles.length === 0) return;\n\n  formatWithBiome(tree, otherFiles);\n}\n\n/**\n * The Biome configuration to format with: the workspace's own `biome.json`, else\n * the config we vend.\n *\n * Read through the tree, which falls back to disk for a file it doesn't hold. So\n * this resolves the most current config either way — the workspace's on-disk one,\n * or the version a generator has just written to the tree and not yet flushed,\n * which shelling out to the CLI could never see.\n */\nfunction readBiomeConfig(tree: Tree): unknown {\n  const config = tree.read('biome.json', 'utf-8');\n  if (config) {\n    try {\n      return JSON.parse(config);\n    } catch {\n      // Malformed config — fall through to the config we vend\n    }\n  }\n  return getDefaultBiomeConfig(tree);\n}\n\n/**\n * Format files with Biome in-process, reusing one instance across the batch.\n *\n * Replaces one `biome format --stdin-file-path` process per file, which\n * dominated generation at ~70ms each: `formatFilesInSubtree` formats every\n * change accumulated in the tree, not only the ones its caller made, so\n * generators sharing a tree reformat the same files once per call. In-process is\n * ~0.5ms per file. Output was verified byte-identical across the plugin's whole\n * source tree, except that the CLI corrupts control characters passed through\n * stdin (a NUL in a template literal) where formatting in-process preserves them.\n */\nfunction formatWithBiome(\n  tree: Tree,\n  files: { path: string; content: Buffer | null }[],\n): void {\n  try {\n    const biome = new Biome();\n    const { projectKey } = biome.openProject();\n    biome.applyConfiguration(projectKey, readBiomeConfig(tree));\n\n    for (const file of files) {\n      try {\n        const { content } = biome.formatContent(\n          projectKey,\n          file.content?.toString('utf-8') ?? '',\n          { filePath: file.path },\n        );\n        tree.write(file.path, content);\n      } catch {\n        // Leave individual files that fail to format untouched\n      }\n    }\n  } catch {\n    // Silently skip formatting failures\n  }\n}\n\n/**\n * Read the ruff config for a file, by walking from its directory up to the\n * workspace root looking for `.ruff.toml`, `ruff.toml`, or a `pyproject.toml`\n * with a `[tool.ruff]` section — the same files, in the same order, that ruff\n * itself resolves. The walk stops at the workspace root so a stray config in a\n * parent of the workspace (or the home directory) is never treated as the\n * project's.\n *\n * The settings are read rather than merely detected because formatting runs\n * in-process against tree content, so ruff never sees the file's location and\n * cannot resolve the config itself (see {@link resolveRuffOptions}).\n *\n * Reads go through the tree, which falls through to disk for files this run has\n * not touched, so a config the generator has just written in memory is picked up\n * as well as one already on disk.\n */\nfunction readRuffConfig(tree: Tree, filePath: string): RuffOptions | undefined {\n  let dir = path.dirname(filePath);\n  while (true) {\n    for (const name of ['.ruff.toml', 'ruff.toml']) {\n      const config = tryReadToml(tree, path.join(dir, name));\n      if (config) {\n        return config as RuffOptions;\n      }\n    }\n    const ruff = (tryReadToml(tree, path.join(dir, 'pyproject.toml')) as any)\n      ?.tool?.ruff;\n    if (ruff) {\n      return ruff as RuffOptions;\n    }\n    // Stop once the workspace root ('.') has been checked.\n    if (dir === '.' || dir === '' || dir === path.dirname(dir)) {\n      return undefined;\n    }\n    dir = path.dirname(dir);\n  }\n}\n\n/**\n * The `[tool.ruff.lint].select` generated Python projects vend. Generation\n * formats before that config lands on disk, so it is pinned here to keep\n * generated files clean under the project's own `lint` target rather than under\n * whatever ruff's defaults happen to be for the pinned release.\n */\nconst DEFAULT_RUFF_SELECT = ['E', 'F', 'UP', 'B', 'SIM', 'I'];\n\ninterface PythonProjectRuffConfig {\n  /** Project root, normalised to use forward slashes. */\n  readonly root: string;\n  /** Top-level importable module names declared by the project. */\n  readonly modules: string[];\n  /** The project's `[tool.ruff].line-length`, if set. */\n  readonly lineLength?: number;\n  /**\n   * Ruff `target-version` (eg `py314`) derived from `[project].requires-python`.\n   * Generation formats via stdin with no pyproject, so it must be passed\n   * explicitly — ruff's formatting differs by target.\n   */\n  readonly targetVersion?: string;\n  /** The project's `[tool.ruff.lint].select`, if set. */\n  readonly select?: string[];\n}\n\n/**\n * Derive ruff's `target-version` (eg `py314`) from a PEP 508\n * `requires-python` specifier (eg `>=3.14`). Ruff targets the minimum\n * supported version, so take the lowest `major.minor` mentioned.\n */\nexport const requiresPythonToRuffTarget = (\n  requiresPython: unknown,\n): string | undefined => {\n  if (typeof requiresPython !== 'string') {\n    return undefined;\n  }\n  let min: { major: number; minor: number } | undefined;\n  for (const match of requiresPython.matchAll(/(\\d+)\\.(\\d+)/g)) {\n    const major = Number(match[1]);\n    const minor = Number(match[2]);\n    if (\n      !min ||\n      major < min.major ||\n      (major === min.major && minor < min.minor)\n    ) {\n      min = { major, minor };\n    }\n  }\n  return min ? `py${min.major}${min.minor}` : undefined;\n};\n\n/**\n * Map each Nx project with a `pyproject.toml` to the ruff settings the on-disk\n * build enforces for it: its top-level module names (from\n * `[tool.hatch.build.targets.wheel].packages`), its `[tool.ruff].line-length`\n * and its `[tool.ruff.lint].select`.\n */\nfunction getPythonProjectRuffConfigs(tree: Tree): PythonProjectRuffConfig[] {\n  const configs: PythonProjectRuffConfig[] = [];\n\n  for (const project of getProjects(tree).values()) {\n    // Projects without a pyproject.toml, or whose one cannot be parsed, have no\n    // ruff settings to contribute.\n    const pyproject = tryReadToml(\n      tree,\n      path.join(project.root, 'pyproject.toml'),\n    ) as any;\n    if (!pyproject) {\n      continue;\n    }\n    const wheelPackages: unknown =\n      pyproject?.tool?.hatch?.build?.targets?.wheel?.packages;\n    // Record the top-level module segment (`pkg/sub` -> `pkg`), which is\n    // all `known-first-party` keys off.\n    const modules = Array.isArray(wheelPackages)\n      ? wheelPackages\n          .filter((pkg): pkg is string => typeof pkg === 'string' && !!pkg)\n          .map((pkg) => pkg.split('/')[0])\n      : [];\n    const lineLength: unknown = pyproject?.tool?.ruff?.['line-length'];\n    const targetVersion = requiresPythonToRuffTarget(\n      pyproject?.project?.['requires-python'],\n    );\n    const selected: unknown = pyproject?.tool?.ruff?.lint?.select;\n    const select = Array.isArray(selected)\n      ? selected.filter(\n          (rule): rule is string => typeof rule === 'string' && !!rule,\n        )\n      : undefined;\n    if (\n      modules.length ||\n      typeof lineLength === 'number' ||\n      targetVersion ||\n      select?.length\n    ) {\n      configs.push({\n        root: project.root.split(path.sep).join('/'),\n        modules,\n        lineLength: typeof lineLength === 'number' ? lineLength : undefined,\n        targetVersion,\n        select: select?.length ? select : undefined,\n      });\n    }\n  }\n\n  return configs;\n}\n\n/**\n * Resolve the ruff config for the project that owns a file (the project with\n * the longest root that is a prefix of the file path). Ruff runs per-project on\n * disk, so a file's settings come from its own project — only its own module is\n * first-party (sibling workspace packages are third-party) and its own\n * line-length applies — and scoping this way keeps in-tree formatting\n * consistent with the on-disk build.\n */\nfunction getOwningProjectRuffConfig(\n  filePath: string,\n  configs: PythonProjectRuffConfig[],\n): PythonProjectRuffConfig | undefined {\n  let owner: PythonProjectRuffConfig | undefined;\n  for (const config of configs) {\n    if (\n      (filePath === config.root || filePath.startsWith(`${config.root}/`)) &&\n      (!owner || config.root.length > owner.root.length)\n    ) {\n      owner = config;\n    }\n  }\n  return owner;\n}\n\n/**\n * Resolve the ruff settings to format a Python file with, mirroring what the\n * file's build enforces.\n *\n * Ruff's own config discovery never runs: settings are passed to the linter\n * directly rather than resolved from the file's location, which it never sees.\n * That also means a stray config above the workspace (or in the home directory)\n * can never be picked up.\n *\n * `config` is the file's nearest ruff config, whose rule selection is honoured\n * as-is. Without one, ruff would fall back to its own defaults, which change\n * between releases — 0.16 widened them from `E` and `F` to 36 rule prefixes — so\n * generation would apply fixes the project's build never asks for (eg `RUF022`\n * reordering `__all__`). Instead the project's own `lint.select` is pinned, so\n * generation enforces exactly what `lint` does and nothing more.\n *\n * `projectConfig` layers on the settings derived from the owning project rather\n * than declared under `[tool.ruff]`: `known-first-party` (the project's own\n * modules, from its wheel packages) keeps its imports in their own group, and\n * `target-version` (from its `requires-python`) matches the formatting the build\n * produces.\n */\nfunction resolveRuffOptions(\n  config: RuffOptions | undefined,\n  projectConfig?: PythonProjectRuffConfig,\n): RuffOptions {\n  const lint: Record<string, unknown> = { ...config?.lint };\n  // Pin the rule selection only when deferring to ruff's defaults would\n  // otherwise apply rules the project's build does not enforce.\n  if (!config) {\n    lint.select = projectConfig?.select ?? DEFAULT_RUFF_SELECT;\n  }\n  if (projectConfig?.modules.length) {\n    lint.isort = {\n      ...(lint.isort as object | undefined),\n      'known-first-party': projectConfig.modules,\n    };\n  }\n  return {\n    ...config,\n    ...(typeof projectConfig?.lineLength === 'number'\n      ? { 'line-length': projectConfig.lineLength }\n      : {}),\n    ...(projectConfig?.targetVersion\n      ? { 'target-version': projectConfig.targetVersion }\n      : {}),\n    lint,\n  };\n}\n"],"names":["Biome","getProjects","createRequire","path","ruffFixAndFormat","tryReadToml","TS_VERSIONS","BIOME_WASM_VERSION","url","version","BIOME_TEST_OUTPUT_EXCLUDE","ROLLDOWN_CONFIG_BUNDLE_GLOB","BIOME_ROLLDOWN_CONFIG_BUNDLE_EXCLUDE","getDefaultBiomeConfig","tree","$schema","root","formatter","enabled","indentStyle","indentWidth","lineWidth","javascript","quoteStyle","trailingCommas","exists","resolver","experimentalPnpmCatalogs","css","linter","rules","preset","correctness","noUndeclaredDependencies","assist","actions","source","organizeImports","files","includes","overrides","BIOME_FORMATTABLE_EXTENSIONS","Set","isTsConfig","filePath","test","treeIgnoredPaths","WeakMap","normalizeTreePath","split","sep","join","replace","formatFilesInSubtree","dir","options","ignored","get","ignore","length","set","add","changedFiles","listChanges","filter","file","type","startsWith","has","pyFiles","endsWith","otherFiles","extname","pythonProjectConfigs","getPythonProjectRuffConfigs","content","toString","resolveRuffOptions","readRuffConfig","getOwningProjectRuffConfig","write","formatWithBiome","readBiomeConfig","config","read","JSON","parse","biome","projectKey","openProject","applyConfiguration","formatContent","dirname","name","ruff","tool","undefined","DEFAULT_RUFF_SELECT","requiresPythonToRuffTarget","requiresPython","min","match","matchAll","major","Number","minor","configs","project","values","pyproject","wheelPackages","hatch","build","targets","wheel","packages","modules","Array","isArray","pkg","map","lineLength","targetVersion","selected","lint","select","rule","push","owner","projectConfig","isort"],"mappings":"AAAA;;;CAGC,GAED,SAASA,KAAK,QAAQ,yBAAyB;AAC/C,SAASC,WAAW,QAAmB,aAAa;AACpD,SAASC,aAAa,QAAQ,SAAS;AACvC,OAAOC,UAAU,OAAO;AACxB,SAA2BC,gBAAgB,QAAQ,YAAY;AAC/D,SAASC,WAAW,QAAQ,YAAY;AACxC,SAASC,WAAW,QAAQ,gBAAgB;AAE5C;;;CAGC,GACD,OAAO,MAAMC,qBAA6BL,cAAc,YAAYM,GAAG,EACrE,qCACAC,OAAO,CAAC;AAEV;;;CAGC,GACD,OAAO,MAAMC,4BAA4B,kBAAkB;AAE3D;;;;;;;;;;;;CAYC,GACD,OAAO,MAAMC,8BAA8B,2BAA2B;AAEtE,4EAA4E,GAC5E,OAAO,MAAMC,uCAAuC,CAAC,CAAC,EAAED,6BAA6B,CAAC;AAEtF;;;;;CAKC,GACD,OAAO,MAAME,wBAAwB,CAACC,OAAgB,CAAA;QACpDC,SAAS,CAAC,4BAA4B,EAAET,WAAW,CAAC,iBAAiB,CAAC,YAAY,CAAC;QACnFU,MAAM;QACNC,WAAW;YACTC,SAAS;YACTC,aAAa;YACbC,aAAa;YACbC,WAAW;QACb;QACAC,YAAY;YACVL,WAAW;gBACTM,YAAY;gBACZC,gBAAgB;YAClB;YACA,+EAA+E;YAC/E,GAAIV,KAAKW,MAAM,CAAC,yBACZ;gBAAEC,UAAU;oBAAEC,0BAA0B;gBAAK;YAAE,IAC/C,CAAC,CAAC;QACR;QACAC,KAAK;YACHX,WAAW;gBACTM,YAAY;YACd;YACAM,QAAQ;gBACNX,SAAS;YACX;QACF;QACAW,QAAQ;YACNX,SAAS;YACTY,OAAO;gBACLC,QAAQ;gBACRC,aAAa;oBACX,qEAAqE;oBACrE,wCAAwC;oBACxCC,0BAA0B;gBAC5B;YACF;QACF;QACAC,QAAQ;YACNC,SAAS;gBACPC,QAAQ;oBACNC,iBAAiB;gBACnB;YACF;QACF;QACAC,OAAO;YACLC,UAAU;gBACR;gBACA;gBACA;gBACA7B;gBACAE;gBACA;gBACA;gBACA;gBACA,kEAAkE;gBAClE,8DAA8D;gBAC9D;gBACA;gBACA;gBACA;gBACA;aACD;QACH;QACA,qEAAqE;QACrE,+EAA+E;QAC/E4B,WAAW;YACT;gBACED,UAAU;oBACR;oBACA;oBACA;iBACD;gBACDV,QAAQ;oBACNC,OAAO;wBACLE,aAAa;4BACXC,0BAA0B;wBAC5B;oBACF;gBACF;YACF;SACD;IACH,CAAA,EAAG;AAEH,MAAMQ,+BAA+B,IAAIC,IAAI;IAC3C;IACA;IACA;IACA;IACA;IACA;IACA;IACA;IACA;IACA;IACA;CACD;AAED,mEAAmE,GACnE,MAAMC,aAAa,CAACC,WAClB,6BAA6BC,IAAI,CAACD;AAapC;;;;;;;;CAQC,GACD,MAAME,mBAAmB,IAAIC;AAE7B;;;CAGC,GACD,MAAMC,oBAAoB,CAACJ,WACzBA,SAASK,KAAK,CAAC9C,KAAK+C,GAAG,EAAEC,IAAI,CAAC,KAAKC,OAAO,CAAC,SAAS;AAEtD;;;;CAIC,GACD,OAAO,eAAeC,qBACpBvC,IAAU,EACVwC,GAAY,EACZC,OAAqC;IAErC,IAAIC,UAAUV,iBAAiBW,GAAG,CAAC3C;IACnC,IAAIyC,SAASG,QAAQC,QAAQ;QAC3B,IAAI,CAACH,SAAS;YACZA,UAAU,IAAId;YACdI,iBAAiBc,GAAG,CAAC9C,MAAM0C;QAC7B;QACA,KAAK,MAAMZ,YAAYW,QAAQG,MAAM,CAAE;YACrCF,QAAQK,GAAG,CAACb,kBAAkBJ;QAChC;IACF;IACA,MAAMkB,eAAehD,KAClBiD,WAAW,GACXC,MAAM,CAAC,CAACC,OAASA,KAAKC,IAAI,KAAK,UAC/BF,MAAM,CAAC,CAACC,OAAUX,MAAMW,KAAK9D,IAAI,CAACgE,UAAU,CAACb,OAAO,MACpDU,MAAM,CAAC,CAACC,OAAS,CAACT,SAASY,IAAIpB,kBAAkBiB,KAAK9D,IAAI;IAE7D,MAAMkE,UAAUP,aAAaE,MAAM,CAAC,CAACC,OAASA,KAAK9D,IAAI,CAACmE,QAAQ,CAAC;IACjE,MAAMC,aAAaT,aAAaE,MAAM,CACpC,CAACC,OACCxB,6BAA6B2B,GAAG,CAACjE,KAAKqE,OAAO,CAACP,KAAK9D,IAAI,MACvD,oEAAoE;QACpE,yEAAyE;QACzE,oEAAoE;QACpE,yEAAyE;QACzE,wCAAwC;QACxC,CAACwC,WAAWsB,KAAK9D,IAAI;IAGzB,4EAA4E;IAC5E,8EAA8E;IAC9E,MAAMsE,uBAAuBJ,QAAQV,MAAM,GACvCe,4BAA4B5D,QAC5B,EAAE;IAEN,0DAA0D;IAC1D,KAAK,MAAMmD,QAAQI,QAAS;QAC1B,IAAI;YACF,MAAMM,UAAUvE,iBACd6D,KAAKU,OAAO,CAACC,QAAQ,CAAC,UACtBX,KAAK9D,IAAI,EACT0E,mBACEC,eAAehE,MAAMmD,KAAK9D,IAAI,GAC9B4E,2BAA2Bd,KAAK9D,IAAI,EAAEsE;YAG1C3D,KAAKkE,KAAK,CAACf,KAAK9D,IAAI,EAAEwE;QACxB,EAAE,OAAM;QACN,yCAAyC;QAC3C;IACF;IAEA,IAAIJ,WAAWZ,MAAM,KAAK,GAAG;IAE7BsB,gBAAgBnE,MAAMyD;AACxB;AAEA;;;;;;;;CAQC,GACD,SAASW,gBAAgBpE,IAAU;IACjC,MAAMqE,SAASrE,KAAKsE,IAAI,CAAC,cAAc;IACvC,IAAID,QAAQ;QACV,IAAI;YACF,OAAOE,KAAKC,KAAK,CAACH;QACpB,EAAE,OAAM;QACN,wDAAwD;QAC1D;IACF;IACA,OAAOtE,sBAAsBC;AAC/B;AAEA;;;;;;;;;;CAUC,GACD,SAASmE,gBACPnE,IAAU,EACVwB,KAAiD;IAEjD,IAAI;QACF,MAAMiD,QAAQ,IAAIvF;QAClB,MAAM,EAAEwF,UAAU,EAAE,GAAGD,MAAME,WAAW;QACxCF,MAAMG,kBAAkB,CAACF,YAAYN,gBAAgBpE;QAErD,KAAK,MAAMmD,QAAQ3B,MAAO;YACxB,IAAI;gBACF,MAAM,EAAEqC,OAAO,EAAE,GAAGY,MAAMI,aAAa,CACrCH,YACAvB,KAAKU,OAAO,EAAEC,SAAS,YAAY,IACnC;oBAAEhC,UAAUqB,KAAK9D,IAAI;gBAAC;gBAExBW,KAAKkE,KAAK,CAACf,KAAK9D,IAAI,EAAEwE;YACxB,EAAE,OAAM;YACN,uDAAuD;YACzD;QACF;IACF,EAAE,OAAM;IACN,oCAAoC;IACtC;AACF;AAEA;;;;;;;;;;;;;;;CAeC,GACD,SAASG,eAAehE,IAAU,EAAE8B,QAAgB;IAClD,IAAIU,MAAMnD,KAAKyF,OAAO,CAAChD;IACvB,MAAO,KAAM;QACX,KAAK,MAAMiD,QAAQ;YAAC;YAAc;SAAY,CAAE;YAC9C,MAAMV,SAAS9E,YAAYS,MAAMX,KAAKgD,IAAI,CAACG,KAAKuC;YAChD,IAAIV,QAAQ;gBACV,OAAOA;YACT;QACF;QACA,MAAMW,OAAQzF,YAAYS,MAAMX,KAAKgD,IAAI,CAACG,KAAK,oBAC3CyC,MAAMD;QACV,IAAIA,MAAM;YACR,OAAOA;QACT;QACA,uDAAuD;QACvD,IAAIxC,QAAQ,OAAOA,QAAQ,MAAMA,QAAQnD,KAAKyF,OAAO,CAACtC,MAAM;YAC1D,OAAO0C;QACT;QACA1C,MAAMnD,KAAKyF,OAAO,CAACtC;IACrB;AACF;AAEA;;;;;CAKC,GACD,MAAM2C,sBAAsB;IAAC;IAAK;IAAK;IAAM;IAAK;IAAO;CAAI;AAmB7D;;;;CAIC,GACD,OAAO,MAAMC,6BAA6B,CACxCC;IAEA,IAAI,OAAOA,mBAAmB,UAAU;QACtC,OAAOH;IACT;IACA,IAAII;IACJ,KAAK,MAAMC,SAASF,eAAeG,QAAQ,CAAC,iBAAkB;QAC5D,MAAMC,QAAQC,OAAOH,KAAK,CAAC,EAAE;QAC7B,MAAMI,QAAQD,OAAOH,KAAK,CAAC,EAAE;QAC7B,IACE,CAACD,OACDG,QAAQH,IAAIG,KAAK,IAChBA,UAAUH,IAAIG,KAAK,IAAIE,QAAQL,IAAIK,KAAK,EACzC;YACAL,MAAM;gBAAEG;gBAAOE;YAAM;QACvB;IACF;IACA,OAAOL,MAAM,CAAC,EAAE,EAAEA,IAAIG,KAAK,GAAGH,IAAIK,KAAK,EAAE,GAAGT;AAC9C,EAAE;AAEF;;;;;CAKC,GACD,SAAStB,4BAA4B5D,IAAU;IAC7C,MAAM4F,UAAqC,EAAE;IAE7C,KAAK,MAAMC,WAAW1G,YAAYa,MAAM8F,MAAM,GAAI;QAChD,4EAA4E;QAC5E,+BAA+B;QAC/B,MAAMC,YAAYxG,YAChBS,MACAX,KAAKgD,IAAI,CAACwD,QAAQ3F,IAAI,EAAE;QAE1B,IAAI,CAAC6F,WAAW;YACd;QACF;QACA,MAAMC,gBACJD,WAAWd,MAAMgB,OAAOC,OAAOC,SAASC,OAAOC;QACjD,qEAAqE;QACrE,oCAAoC;QACpC,MAAMC,UAAUC,MAAMC,OAAO,CAACR,iBAC1BA,cACG9C,MAAM,CAAC,CAACuD,MAAuB,OAAOA,QAAQ,YAAY,CAAC,CAACA,KAC5DC,GAAG,CAAC,CAACD,MAAQA,IAAItE,KAAK,CAAC,IAAI,CAAC,EAAE,IACjC,EAAE;QACN,MAAMwE,aAAsBZ,WAAWd,MAAMD,MAAM,CAAC,cAAc;QAClE,MAAM4B,gBAAgBxB,2BACpBW,WAAWF,SAAS,CAAC,kBAAkB;QAEzC,MAAMgB,WAAoBd,WAAWd,MAAMD,MAAM8B,MAAMC;QACvD,MAAMA,SAASR,MAAMC,OAAO,CAACK,YACzBA,SAAS3D,MAAM,CACb,CAAC8D,OAAyB,OAAOA,SAAS,YAAY,CAAC,CAACA,QAE1D9B;QACJ,IACEoB,QAAQzD,MAAM,IACd,OAAO8D,eAAe,YACtBC,iBACAG,QAAQlE,QACR;YACA+C,QAAQqB,IAAI,CAAC;gBACX/G,MAAM2F,QAAQ3F,IAAI,CAACiC,KAAK,CAAC9C,KAAK+C,GAAG,EAAEC,IAAI,CAAC;gBACxCiE;gBACAK,YAAY,OAAOA,eAAe,WAAWA,aAAazB;gBAC1D0B;gBACAG,QAAQA,QAAQlE,SAASkE,SAAS7B;YACpC;QACF;IACF;IAEA,OAAOU;AACT;AAEA;;;;;;;CAOC,GACD,SAAS3B,2BACPnC,QAAgB,EAChB8D,OAAkC;IAElC,IAAIsB;IACJ,KAAK,MAAM7C,UAAUuB,QAAS;QAC5B,IACE,AAAC9D,CAAAA,aAAauC,OAAOnE,IAAI,IAAI4B,SAASuB,UAAU,CAAC,GAAGgB,OAAOnE,IAAI,CAAC,CAAC,CAAC,CAAA,KACjE,CAAA,CAACgH,SAAS7C,OAAOnE,IAAI,CAAC2C,MAAM,GAAGqE,MAAMhH,IAAI,CAAC2C,MAAM,AAAD,GAChD;YACAqE,QAAQ7C;QACV;IACF;IACA,OAAO6C;AACT;AAEA;;;;;;;;;;;;;;;;;;;;;CAqBC,GACD,SAASnD,mBACPM,MAA+B,EAC/B8C,aAAuC;IAEvC,MAAML,OAAgC;QAAE,GAAGzC,QAAQyC,IAAI;IAAC;IACxD,sEAAsE;IACtE,8DAA8D;IAC9D,IAAI,CAACzC,QAAQ;QACXyC,KAAKC,MAAM,GAAGI,eAAeJ,UAAU5B;IACzC;IACA,IAAIgC,eAAeb,QAAQzD,QAAQ;QACjCiE,KAAKM,KAAK,GAAG;YACX,GAAIN,KAAKM,KAAK;YACd,qBAAqBD,cAAcb,OAAO;QAC5C;IACF;IACA,OAAO;QACL,GAAGjC,MAAM;QACT,GAAI,OAAO8C,eAAeR,eAAe,WACrC;YAAE,eAAeQ,cAAcR,UAAU;QAAC,IAC1C,CAAC,CAAC;QACN,GAAIQ,eAAeP,gBACf;YAAE,kBAAkBO,cAAcP,aAAa;QAAC,IAChD,CAAC,CAAC;QACNE;IACF;AACF"}
+{"version":3,"sources":["../../../../../packages/nx-plugin/src/utils/format.ts"],"sourcesContent":["/**\n * Copyright Amazon.com, Inc. or its affiliates. All Rights Reserved.\n * SPDX-License-Identifier: Apache-2.0\n */\n\nimport { Biome } from '@biomejs/js-api/nodejs';\nimport { getProjects, type Tree } from '@nx/devkit';\nimport { createRequire } from 'module';\nimport path from 'path';\nimport { type RuffOptions, ruffFixAndFormat } from './ruff.js';\nimport { tryReadToml } from './toml.js';\nimport { TS_VERSIONS } from './versions.js';\n\n/**\n * The Biome release the wasm bindings are built from. Must match\n * `TS_VERSIONS['@biomejs/biome']`, the CLI the vended targets run.\n */\nexport const BIOME_WASM_VERSION: string = createRequire(import.meta.url)(\n  '@biomejs/wasm-nodejs/package.json',\n).version;\n\n/**\n * Excludes test reports — including the vendored scripts vitest's coverage HTML\n * reporter writes — from formatting and linting.\n */\nexport const BIOME_TEST_OUTPUT_EXCLUDE = '!**/test-output';\n\n/**\n * The transient bundle rolldown writes beside a `rolldown.config.ts` while\n * loading it.\n *\n * Loading a TypeScript config bundles it to `rolldown.config.<hash>.js` in the\n * config's own directory, imports it, then unlinks it. That file exists for as\n * long as the bundle takes, so a `format` or `lint` target running concurrently\n * in the same project sees a machine-generated file — reported unformatted,\n * failing the target for no fault of the source.\n *\n * `.*js` rather than `.js`, since the extension follows the config's own: a\n * `.mts` config bundles to `.mjs`, a `.cts` one to `.cjs`.\n */\nexport const ROLLDOWN_CONFIG_BUNDLE_GLOB = '**/rolldown.config.*.*js';\n\n/** Keeps rolldown's transient config bundle out of formatting and linting. */\nexport const BIOME_ROLLDOWN_CONFIG_BUNDLE_EXCLUDE = `!${ROLLDOWN_CONFIG_BUNDLE_GLOB}`;\n\n/**\n * The biome.json vended into a new workspace. The pnpm catalog resolver is only\n * included on pnpm workspaces, since `experimentalPnpmCatalogs` is Biome's only\n * catalog resolver and reads `pnpm-workspace.yaml` exclusively — it does nothing\n * for yarn or bun catalogs, so vending it there would be misleading.\n */\nexport const getDefaultBiomeConfig = (tree: Tree) => ({\n  $schema: `https://biomejs.dev/schemas/${TS_VERSIONS['@biomejs/biome']}/schema.json`,\n  root: true,\n  formatter: {\n    enabled: true,\n    indentStyle: 'space',\n    indentWidth: 2,\n    lineWidth: 80,\n  },\n  javascript: {\n    formatter: {\n      quoteStyle: 'single',\n      trailingCommas: 'all',\n    },\n    // Resolve `catalog:` versions from pnpm-workspace.yaml (pnpm workspaces only).\n    ...(tree.exists('pnpm-workspace.yaml')\n      ? { resolver: { experimentalPnpmCatalogs: true } }\n      : {}),\n  },\n  css: {\n    formatter: {\n      quoteStyle: 'single',\n    },\n    linter: {\n      enabled: false,\n    },\n  },\n  // Markdown and YAML files are left as written.\n  markdown: { formatter: { enabled: false } },\n  yaml: { formatter: { enabled: false } },\n  linter: {\n    enabled: true,\n    rules: {\n      preset: 'none',\n      correctness: {\n        // Every project must declare the third-party dependencies its source\n        // code imports in its own package.json.\n        noUndeclaredDependencies: 'error',\n      },\n    },\n  },\n  assist: {\n    actions: {\n      source: {\n        organizeImports: 'on',\n      },\n    },\n  },\n  files: {\n    includes: [\n      '**',\n      '!**/dist',\n      '!**/out-tsc',\n      BIOME_TEST_OUTPUT_EXCLUDE,\n      BIOME_ROLLDOWN_CONFIG_BUNDLE_EXCLUDE,\n      '!**/node_modules',\n      '!**/.nx',\n      '!**/.venv',\n      // GritQL codemod cache written by generators — its sample sources\n      // otherwise pollute a bare `biome check .` with parse errors.\n      '!**/.grit',\n      '!**/*.css',\n      '!**/*.gen.*',\n      '!**/generated/**',\n      '!**/tsconfig*.json',\n    ],\n  },\n  // Config files, build scripts and tests use root tooling rather than\n  // declaring it per-project, so the undeclared-dependency rule is off for them.\n  overrides: [\n    {\n      includes: [\n        '**/*.config.{ts,mts,cts,js,mjs,cjs}',\n        '**/*.{spec,test}.{ts,tsx,mts,cts,js,jsx,mjs,cjs}',\n        '**/*.stories.{ts,tsx}',\n      ],\n      linter: {\n        rules: {\n          correctness: {\n            noUndeclaredDependencies: 'off',\n          },\n        },\n      },\n    },\n  ],\n});\n\nconst BIOME_FORMATTABLE_EXTENSIONS = new Set([\n  '.ts',\n  '.tsx',\n  '.js',\n  '.jsx',\n  '.mjs',\n  '.cjs',\n  '.mts',\n  '.cts',\n  '.json',\n  '.jsonc',\n  '.css',\n]);\n\n/** Matches `tsconfig.json` and variants like `tsconfig.lib.json`. */\nconst isTsConfig = (filePath: string): boolean =>\n  /(^|\\/)tsconfig[^/]*\\.json$/.test(filePath);\n\nexport interface FormatFilesInSubtreeOptions {\n  /**\n   * Paths, relative to the workspace root, to leave untouched.\n   *\n   * For files another tool owns the formatting of: formatting them here makes\n   * generation non-idempotent, since the tool rewrites them in its own shape on\n   * the next run and the workspace flips between the two forms.\n   */\n  readonly ignore?: readonly string[];\n}\n\n/**\n * Paths declared ignored for a tree, which stay ignored for every later call.\n *\n * A call formats every change pending in the tree, not only the ones its caller\n * made, so the list cannot be scoped to the call that passes it: generators\n * composing on one tree would reformat a file an earlier generator had excluded.\n * Once the generator that owns a file declares it ignored, it stays ignored for\n * the rest of the run.\n */\nconst treeIgnoredPaths = new WeakMap<Tree, Set<string>>();\n\n/**\n * Tree paths are workspace-relative and forward-slash separated. Normalise so a\n * caller building a path with `path.join` on Windows still matches.\n */\nconst normalizeTreePath = (filePath: string): string =>\n  filePath.split(path.sep).join('/').replace(/^\\.\\//, '');\n\n/**\n * Format files in the given directory within the tree.\n * Handles both TypeScript/JavaScript/JSON (via biome) and Python (via ruff) files.\n * See https://github.com/nrwl/nx/blob/4cd640a9187954505d12de5b6d76a90d8ce4c2eb/packages/devkit/src/generators/format-files.ts#L11\n */\nexport async function formatFilesInSubtree(\n  tree: Tree,\n  dir?: string,\n  options?: FormatFilesInSubtreeOptions,\n): Promise<void> {\n  let ignored = treeIgnoredPaths.get(tree);\n  if (options?.ignore?.length) {\n    if (!ignored) {\n      ignored = new Set();\n      treeIgnoredPaths.set(tree, ignored);\n    }\n    for (const filePath of options.ignore) {\n      ignored.add(normalizeTreePath(filePath));\n    }\n  }\n  const changedFiles = tree\n    .listChanges()\n    .filter((file) => file.type !== 'DELETE')\n    .filter((file) => (dir ? file.path.startsWith(dir) : true))\n    .filter((file) => !ignored?.has(normalizeTreePath(file.path)));\n\n  const pyFiles = changedFiles.filter((file) => file.path.endsWith('.py'));\n  const otherFiles = changedFiles.filter(\n    (file) =>\n      BIOME_FORMATTABLE_EXTENSIONS.has(path.extname(file.path)) &&\n      // tsconfigs are not biome-managed: they're excluded from the vended\n      // format target (Nx's typescript-sync rewrites them without formatting),\n      // so formatting them at generation would only diverge from the form\n      // written on later runs. Leave them as updateJson/writeJson emit them so\n      // repeated generation stays idempotent.\n      !isTsConfig(file.path),\n  );\n\n  // Resolve each project's ruff settings (module names, line-length) so files\n  // are formatted to match the on-disk build (see getPythonProjectRuffConfigs).\n  const pythonProjectConfigs = pyFiles.length\n    ? getPythonProjectRuffConfigs(tree)\n    : [];\n\n  // Format Python files with ruff (lint fixes + formatting)\n  for (const file of pyFiles) {\n    try {\n      const content = ruffFixAndFormat(\n        file.content.toString('utf-8'),\n        file.path,\n        resolveRuffOptions(\n          readRuffConfig(tree, file.path),\n          getOwningProjectRuffConfig(file.path, pythonProjectConfigs),\n        ),\n      );\n      tree.write(file.path, content);\n    } catch {\n      // Silently skip ruff formatting failures\n    }\n  }\n\n  if (otherFiles.length === 0) return;\n\n  formatWithBiome(tree, otherFiles);\n}\n\n/**\n * The Biome configuration to format with: the workspace's own `biome.json`, else\n * the config we vend.\n *\n * Read through the tree, which falls back to disk for a file it doesn't hold. So\n * this resolves the most current config either way — the workspace's on-disk one,\n * or the version a generator has just written to the tree and not yet flushed,\n * which shelling out to the CLI could never see.\n */\nfunction readBiomeConfig(tree: Tree): unknown {\n  const config = tree.read('biome.json', 'utf-8');\n  if (config) {\n    try {\n      return JSON.parse(config);\n    } catch {\n      // Malformed config — fall through to the config we vend\n    }\n  }\n  return getDefaultBiomeConfig(tree);\n}\n\n/**\n * Format files with Biome in-process, reusing one instance across the batch.\n *\n * Replaces one `biome format --stdin-file-path` process per file, which\n * dominated generation at ~70ms each: `formatFilesInSubtree` formats every\n * change accumulated in the tree, not only the ones its caller made, so\n * generators sharing a tree reformat the same files once per call. In-process is\n * ~0.5ms per file. Output was verified byte-identical across the plugin's whole\n * source tree, except that the CLI corrupts control characters passed through\n * stdin (a NUL in a template literal) where formatting in-process preserves them.\n */\nfunction formatWithBiome(\n  tree: Tree,\n  files: { path: string; content: Buffer | null }[],\n): void {\n  try {\n    const biome = new Biome();\n    const { projectKey } = biome.openProject();\n    biome.applyConfiguration(projectKey, readBiomeConfig(tree));\n\n    for (const file of files) {\n      try {\n        const { content } = biome.formatContent(\n          projectKey,\n          file.content?.toString('utf-8') ?? '',\n          { filePath: file.path },\n        );\n        tree.write(file.path, content);\n      } catch {\n        // Leave individual files that fail to format untouched\n      }\n    }\n  } catch {\n    // Silently skip formatting failures\n  }\n}\n\n/**\n * Read the ruff config for a file, by walking from its directory up to the\n * workspace root looking for `.ruff.toml`, `ruff.toml`, or a `pyproject.toml`\n * with a `[tool.ruff]` section — the same files, in the same order, that ruff\n * itself resolves. The walk stops at the workspace root so a stray config in a\n * parent of the workspace (or the home directory) is never treated as the\n * project's.\n *\n * The settings are read rather than merely detected because formatting runs\n * in-process against tree content, so ruff never sees the file's location and\n * cannot resolve the config itself (see {@link resolveRuffOptions}).\n *\n * Reads go through the tree, which falls through to disk for files this run has\n * not touched, so a config the generator has just written in memory is picked up\n * as well as one already on disk.\n */\nfunction readRuffConfig(tree: Tree, filePath: string): RuffOptions | undefined {\n  let dir = path.dirname(filePath);\n  while (true) {\n    for (const name of ['.ruff.toml', 'ruff.toml']) {\n      const config = tryReadToml(tree, path.join(dir, name));\n      if (config) {\n        return config as RuffOptions;\n      }\n    }\n    const ruff = (tryReadToml(tree, path.join(dir, 'pyproject.toml')) as any)\n      ?.tool?.ruff;\n    if (ruff) {\n      return ruff as RuffOptions;\n    }\n    // Stop once the workspace root ('.') has been checked.\n    if (dir === '.' || dir === '' || dir === path.dirname(dir)) {\n      return undefined;\n    }\n    dir = path.dirname(dir);\n  }\n}\n\n/**\n * The `[tool.ruff.lint].select` generated Python projects vend. Generation\n * formats before that config lands on disk, so it is pinned here to keep\n * generated files clean under the project's own `lint` target rather than under\n * whatever ruff's defaults happen to be for the pinned release.\n */\nconst DEFAULT_RUFF_SELECT = ['E', 'F', 'UP', 'B', 'SIM', 'I'];\n\ninterface PythonProjectRuffConfig {\n  /** Project root, normalised to use forward slashes. */\n  readonly root: string;\n  /** Top-level importable module names declared by the project. */\n  readonly modules: string[];\n  /** The project's `[tool.ruff].line-length`, if set. */\n  readonly lineLength?: number;\n  /**\n   * Ruff `target-version` (eg `py314`) derived from `[project].requires-python`.\n   * Generation formats via stdin with no pyproject, so it must be passed\n   * explicitly — ruff's formatting differs by target.\n   */\n  readonly targetVersion?: string;\n  /** The project's `[tool.ruff.lint].select`, if set. */\n  readonly select?: string[];\n}\n\n/**\n * Derive ruff's `target-version` (eg `py314`) from a PEP 508\n * `requires-python` specifier (eg `>=3.14`). Ruff targets the minimum\n * supported version, so take the lowest `major.minor` mentioned.\n */\nexport const requiresPythonToRuffTarget = (\n  requiresPython: unknown,\n): string | undefined => {\n  if (typeof requiresPython !== 'string') {\n    return undefined;\n  }\n  let min: { major: number; minor: number } | undefined;\n  for (const match of requiresPython.matchAll(/(\\d+)\\.(\\d+)/g)) {\n    const major = Number(match[1]);\n    const minor = Number(match[2]);\n    if (\n      !min ||\n      major < min.major ||\n      (major === min.major && minor < min.minor)\n    ) {\n      min = { major, minor };\n    }\n  }\n  return min ? `py${min.major}${min.minor}` : undefined;\n};\n\n/**\n * Map each Nx project with a `pyproject.toml` to the ruff settings the on-disk\n * build enforces for it: its top-level module names (from\n * `[tool.hatch.build.targets.wheel].packages`), its `[tool.ruff].line-length`\n * and its `[tool.ruff.lint].select`.\n */\nfunction getPythonProjectRuffConfigs(tree: Tree): PythonProjectRuffConfig[] {\n  const configs: PythonProjectRuffConfig[] = [];\n\n  for (const project of getProjects(tree).values()) {\n    // Projects without a pyproject.toml, or whose one cannot be parsed, have no\n    // ruff settings to contribute.\n    const pyproject = tryReadToml(\n      tree,\n      path.join(project.root, 'pyproject.toml'),\n    ) as any;\n    if (!pyproject) {\n      continue;\n    }\n    const wheelPackages: unknown =\n      pyproject?.tool?.hatch?.build?.targets?.wheel?.packages;\n    // Record the top-level module segment (`pkg/sub` -> `pkg`), which is\n    // all `known-first-party` keys off.\n    const modules = Array.isArray(wheelPackages)\n      ? wheelPackages\n          .filter((pkg): pkg is string => typeof pkg === 'string' && !!pkg)\n          .map((pkg) => pkg.split('/')[0])\n      : [];\n    const lineLength: unknown = pyproject?.tool?.ruff?.['line-length'];\n    const targetVersion = requiresPythonToRuffTarget(\n      pyproject?.project?.['requires-python'],\n    );\n    const selected: unknown = pyproject?.tool?.ruff?.lint?.select;\n    const select = Array.isArray(selected)\n      ? selected.filter(\n          (rule): rule is string => typeof rule === 'string' && !!rule,\n        )\n      : undefined;\n    if (\n      modules.length ||\n      typeof lineLength === 'number' ||\n      targetVersion ||\n      select?.length\n    ) {\n      configs.push({\n        root: project.root.split(path.sep).join('/'),\n        modules,\n        lineLength: typeof lineLength === 'number' ? lineLength : undefined,\n        targetVersion,\n        select: select?.length ? select : undefined,\n      });\n    }\n  }\n\n  return configs;\n}\n\n/**\n * Resolve the ruff config for the project that owns a file (the project with\n * the longest root that is a prefix of the file path). Ruff runs per-project on\n * disk, so a file's settings come from its own project — only its own module is\n * first-party (sibling workspace packages are third-party) and its own\n * line-length applies — and scoping this way keeps in-tree formatting\n * consistent with the on-disk build.\n */\nfunction getOwningProjectRuffConfig(\n  filePath: string,\n  configs: PythonProjectRuffConfig[],\n): PythonProjectRuffConfig | undefined {\n  let owner: PythonProjectRuffConfig | undefined;\n  for (const config of configs) {\n    if (\n      (filePath === config.root || filePath.startsWith(`${config.root}/`)) &&\n      (!owner || config.root.length > owner.root.length)\n    ) {\n      owner = config;\n    }\n  }\n  return owner;\n}\n\n/**\n * Resolve the ruff settings to format a Python file with, mirroring what the\n * file's build enforces.\n *\n * Ruff's own config discovery never runs: settings are passed to the linter\n * directly rather than resolved from the file's location, which it never sees.\n * That also means a stray config above the workspace (or in the home directory)\n * can never be picked up.\n *\n * `config` is the file's nearest ruff config, whose rule selection is honoured\n * as-is. Without one, ruff would fall back to its own defaults, which change\n * between releases — 0.16 widened them from `E` and `F` to 36 rule prefixes — so\n * generation would apply fixes the project's build never asks for (eg `RUF022`\n * reordering `__all__`). Instead the project's own `lint.select` is pinned, so\n * generation enforces exactly what `lint` does and nothing more.\n *\n * `projectConfig` layers on the settings derived from the owning project rather\n * than declared under `[tool.ruff]`: `known-first-party` (the project's own\n * modules, from its wheel packages) keeps its imports in their own group, and\n * `target-version` (from its `requires-python`) matches the formatting the build\n * produces.\n */\nfunction resolveRuffOptions(\n  config: RuffOptions | undefined,\n  projectConfig?: PythonProjectRuffConfig,\n): RuffOptions {\n  const lint: Record<string, unknown> = { ...config?.lint };\n  // Pin the rule selection only when deferring to ruff's defaults would\n  // otherwise apply rules the project's build does not enforce.\n  if (!config) {\n    lint.select = projectConfig?.select ?? DEFAULT_RUFF_SELECT;\n  }\n  if (projectConfig?.modules.length) {\n    lint.isort = {\n      ...(lint.isort as object | undefined),\n      'known-first-party': projectConfig.modules,\n    };\n  }\n  return {\n    ...config,\n    ...(typeof projectConfig?.lineLength === 'number'\n      ? { 'line-length': projectConfig.lineLength }\n      : {}),\n    ...(projectConfig?.targetVersion\n      ? { 'target-version': projectConfig.targetVersion }\n      : {}),\n    lint,\n  };\n}\n"],"names":["Biome","getProjects","createRequire","path","ruffFixAndFormat","tryReadToml","TS_VERSIONS","BIOME_WASM_VERSION","url","version","BIOME_TEST_OUTPUT_EXCLUDE","ROLLDOWN_CONFIG_BUNDLE_GLOB","BIOME_ROLLDOWN_CONFIG_BUNDLE_EXCLUDE","getDefaultBiomeConfig","tree","$schema","root","formatter","enabled","indentStyle","indentWidth","lineWidth","javascript","quoteStyle","trailingCommas","exists","resolver","experimentalPnpmCatalogs","css","linter","markdown","yaml","rules","preset","correctness","noUndeclaredDependencies","assist","actions","source","organizeImports","files","includes","overrides","BIOME_FORMATTABLE_EXTENSIONS","Set","isTsConfig","filePath","test","treeIgnoredPaths","WeakMap","normalizeTreePath","split","sep","join","replace","formatFilesInSubtree","dir","options","ignored","get","ignore","length","set","add","changedFiles","listChanges","filter","file","type","startsWith","has","pyFiles","endsWith","otherFiles","extname","pythonProjectConfigs","getPythonProjectRuffConfigs","content","toString","resolveRuffOptions","readRuffConfig","getOwningProjectRuffConfig","write","formatWithBiome","readBiomeConfig","config","read","JSON","parse","biome","projectKey","openProject","applyConfiguration","formatContent","dirname","name","ruff","tool","undefined","DEFAULT_RUFF_SELECT","requiresPythonToRuffTarget","requiresPython","min","match","matchAll","major","Number","minor","configs","project","values","pyproject","wheelPackages","hatch","build","targets","wheel","packages","modules","Array","isArray","pkg","map","lineLength","targetVersion","selected","lint","select","rule","push","owner","projectConfig","isort"],"mappings":"AAAA;;;CAGC,GAED,SAASA,KAAK,QAAQ,yBAAyB;AAC/C,SAASC,WAAW,QAAmB,aAAa;AACpD,SAASC,aAAa,QAAQ,SAAS;AACvC,OAAOC,UAAU,OAAO;AACxB,SAA2BC,gBAAgB,QAAQ,YAAY;AAC/D,SAASC,WAAW,QAAQ,YAAY;AACxC,SAASC,WAAW,QAAQ,gBAAgB;AAE5C;;;CAGC,GACD,OAAO,MAAMC,qBAA6BL,cAAc,YAAYM,GAAG,EACrE,qCACAC,OAAO,CAAC;AAEV;;;CAGC,GACD,OAAO,MAAMC,4BAA4B,kBAAkB;AAE3D;;;;;;;;;;;;CAYC,GACD,OAAO,MAAMC,8BAA8B,2BAA2B;AAEtE,4EAA4E,GAC5E,OAAO,MAAMC,uCAAuC,CAAC,CAAC,EAAED,6BAA6B,CAAC;AAEtF;;;;;CAKC,GACD,OAAO,MAAME,wBAAwB,CAACC,OAAgB,CAAA;QACpDC,SAAS,CAAC,4BAA4B,EAAET,WAAW,CAAC,iBAAiB,CAAC,YAAY,CAAC;QACnFU,MAAM;QACNC,WAAW;YACTC,SAAS;YACTC,aAAa;YACbC,aAAa;YACbC,WAAW;QACb;QACAC,YAAY;YACVL,WAAW;gBACTM,YAAY;gBACZC,gBAAgB;YAClB;YACA,+EAA+E;YAC/E,GAAIV,KAAKW,MAAM,CAAC,yBACZ;gBAAEC,UAAU;oBAAEC,0BAA0B;gBAAK;YAAE,IAC/C,CAAC,CAAC;QACR;QACAC,KAAK;YACHX,WAAW;gBACTM,YAAY;YACd;YACAM,QAAQ;gBACNX,SAAS;YACX;QACF;QACA,+CAA+C;QAC/CY,UAAU;YAAEb,WAAW;gBAAEC,SAAS;YAAM;QAAE;QAC1Ca,MAAM;YAAEd,WAAW;gBAAEC,SAAS;YAAM;QAAE;QACtCW,QAAQ;YACNX,SAAS;YACTc,OAAO;gBACLC,QAAQ;gBACRC,aAAa;oBACX,qEAAqE;oBACrE,wCAAwC;oBACxCC,0BAA0B;gBAC5B;YACF;QACF;QACAC,QAAQ;YACNC,SAAS;gBACPC,QAAQ;oBACNC,iBAAiB;gBACnB;YACF;QACF;QACAC,OAAO;YACLC,UAAU;gBACR;gBACA;gBACA;gBACA/B;gBACAE;gBACA;gBACA;gBACA;gBACA,kEAAkE;gBAClE,8DAA8D;gBAC9D;gBACA;gBACA;gBACA;gBACA;aACD;QACH;QACA,qEAAqE;QACrE,+EAA+E;QAC/E8B,WAAW;YACT;gBACED,UAAU;oBACR;oBACA;oBACA;iBACD;gBACDZ,QAAQ;oBACNG,OAAO;wBACLE,aAAa;4BACXC,0BAA0B;wBAC5B;oBACF;gBACF;YACF;SACD;IACH,CAAA,EAAG;AAEH,MAAMQ,+BAA+B,IAAIC,IAAI;IAC3C;IACA;IACA;IACA;IACA;IACA;IACA;IACA;IACA;IACA;IACA;CACD;AAED,mEAAmE,GACnE,MAAMC,aAAa,CAACC,WAClB,6BAA6BC,IAAI,CAACD;AAapC;;;;;;;;CAQC,GACD,MAAME,mBAAmB,IAAIC;AAE7B;;;CAGC,GACD,MAAMC,oBAAoB,CAACJ,WACzBA,SAASK,KAAK,CAAChD,KAAKiD,GAAG,EAAEC,IAAI,CAAC,KAAKC,OAAO,CAAC,SAAS;AAEtD;;;;CAIC,GACD,OAAO,eAAeC,qBACpBzC,IAAU,EACV0C,GAAY,EACZC,OAAqC;IAErC,IAAIC,UAAUV,iBAAiBW,GAAG,CAAC7C;IACnC,IAAI2C,SAASG,QAAQC,QAAQ;QAC3B,IAAI,CAACH,SAAS;YACZA,UAAU,IAAId;YACdI,iBAAiBc,GAAG,CAAChD,MAAM4C;QAC7B;QACA,KAAK,MAAMZ,YAAYW,QAAQG,MAAM,CAAE;YACrCF,QAAQK,GAAG,CAACb,kBAAkBJ;QAChC;IACF;IACA,MAAMkB,eAAelD,KAClBmD,WAAW,GACXC,MAAM,CAAC,CAACC,OAASA,KAAKC,IAAI,KAAK,UAC/BF,MAAM,CAAC,CAACC,OAAUX,MAAMW,KAAKhE,IAAI,CAACkE,UAAU,CAACb,OAAO,MACpDU,MAAM,CAAC,CAACC,OAAS,CAACT,SAASY,IAAIpB,kBAAkBiB,KAAKhE,IAAI;IAE7D,MAAMoE,UAAUP,aAAaE,MAAM,CAAC,CAACC,OAASA,KAAKhE,IAAI,CAACqE,QAAQ,CAAC;IACjE,MAAMC,aAAaT,aAAaE,MAAM,CACpC,CAACC,OACCxB,6BAA6B2B,GAAG,CAACnE,KAAKuE,OAAO,CAACP,KAAKhE,IAAI,MACvD,oEAAoE;QACpE,yEAAyE;QACzE,oEAAoE;QACpE,yEAAyE;QACzE,wCAAwC;QACxC,CAAC0C,WAAWsB,KAAKhE,IAAI;IAGzB,4EAA4E;IAC5E,8EAA8E;IAC9E,MAAMwE,uBAAuBJ,QAAQV,MAAM,GACvCe,4BAA4B9D,QAC5B,EAAE;IAEN,0DAA0D;IAC1D,KAAK,MAAMqD,QAAQI,QAAS;QAC1B,IAAI;YACF,MAAMM,UAAUzE,iBACd+D,KAAKU,OAAO,CAACC,QAAQ,CAAC,UACtBX,KAAKhE,IAAI,EACT4E,mBACEC,eAAelE,MAAMqD,KAAKhE,IAAI,GAC9B8E,2BAA2Bd,KAAKhE,IAAI,EAAEwE;YAG1C7D,KAAKoE,KAAK,CAACf,KAAKhE,IAAI,EAAE0E;QACxB,EAAE,OAAM;QACN,yCAAyC;QAC3C;IACF;IAEA,IAAIJ,WAAWZ,MAAM,KAAK,GAAG;IAE7BsB,gBAAgBrE,MAAM2D;AACxB;AAEA;;;;;;;;CAQC,GACD,SAASW,gBAAgBtE,IAAU;IACjC,MAAMuE,SAASvE,KAAKwE,IAAI,CAAC,cAAc;IACvC,IAAID,QAAQ;QACV,IAAI;YACF,OAAOE,KAAKC,KAAK,CAACH;QACpB,EAAE,OAAM;QACN,wDAAwD;QAC1D;IACF;IACA,OAAOxE,sBAAsBC;AAC/B;AAEA;;;;;;;;;;CAUC,GACD,SAASqE,gBACPrE,IAAU,EACV0B,KAAiD;IAEjD,IAAI;QACF,MAAMiD,QAAQ,IAAIzF;QAClB,MAAM,EAAE0F,UAAU,EAAE,GAAGD,MAAME,WAAW;QACxCF,MAAMG,kBAAkB,CAACF,YAAYN,gBAAgBtE;QAErD,KAAK,MAAMqD,QAAQ3B,MAAO;YACxB,IAAI;gBACF,MAAM,EAAEqC,OAAO,EAAE,GAAGY,MAAMI,aAAa,CACrCH,YACAvB,KAAKU,OAAO,EAAEC,SAAS,YAAY,IACnC;oBAAEhC,UAAUqB,KAAKhE,IAAI;gBAAC;gBAExBW,KAAKoE,KAAK,CAACf,KAAKhE,IAAI,EAAE0E;YACxB,EAAE,OAAM;YACN,uDAAuD;YACzD;QACF;IACF,EAAE,OAAM;IACN,oCAAoC;IACtC;AACF;AAEA;;;;;;;;;;;;;;;CAeC,GACD,SAASG,eAAelE,IAAU,EAAEgC,QAAgB;IAClD,IAAIU,MAAMrD,KAAK2F,OAAO,CAAChD;IACvB,MAAO,KAAM;QACX,KAAK,MAAMiD,QAAQ;YAAC;YAAc;SAAY,CAAE;YAC9C,MAAMV,SAAShF,YAAYS,MAAMX,KAAKkD,IAAI,CAACG,KAAKuC;YAChD,IAAIV,QAAQ;gBACV,OAAOA;YACT;QACF;QACA,MAAMW,OAAQ3F,YAAYS,MAAMX,KAAKkD,IAAI,CAACG,KAAK,oBAC3CyC,MAAMD;QACV,IAAIA,MAAM;YACR,OAAOA;QACT;QACA,uDAAuD;QACvD,IAAIxC,QAAQ,OAAOA,QAAQ,MAAMA,QAAQrD,KAAK2F,OAAO,CAACtC,MAAM;YAC1D,OAAO0C;QACT;QACA1C,MAAMrD,KAAK2F,OAAO,CAACtC;IACrB;AACF;AAEA;;;;;CAKC,GACD,MAAM2C,sBAAsB;IAAC;IAAK;IAAK;IAAM;IAAK;IAAO;CAAI;AAmB7D;;;;CAIC,GACD,OAAO,MAAMC,6BAA6B,CACxCC;IAEA,IAAI,OAAOA,mBAAmB,UAAU;QACtC,OAAOH;IACT;IACA,IAAII;IACJ,KAAK,MAAMC,SAASF,eAAeG,QAAQ,CAAC,iBAAkB;QAC5D,MAAMC,QAAQC,OAAOH,KAAK,CAAC,EAAE;QAC7B,MAAMI,QAAQD,OAAOH,KAAK,CAAC,EAAE;QAC7B,IACE,CAACD,OACDG,QAAQH,IAAIG,KAAK,IAChBA,UAAUH,IAAIG,KAAK,IAAIE,QAAQL,IAAIK,KAAK,EACzC;YACAL,MAAM;gBAAEG;gBAAOE;YAAM;QACvB;IACF;IACA,OAAOL,MAAM,CAAC,EAAE,EAAEA,IAAIG,KAAK,GAAGH,IAAIK,KAAK,EAAE,GAAGT;AAC9C,EAAE;AAEF;;;;;CAKC,GACD,SAAStB,4BAA4B9D,IAAU;IAC7C,MAAM8F,UAAqC,EAAE;IAE7C,KAAK,MAAMC,WAAW5G,YAAYa,MAAMgG,MAAM,GAAI;QAChD,4EAA4E;QAC5E,+BAA+B;QAC/B,MAAMC,YAAY1G,YAChBS,MACAX,KAAKkD,IAAI,CAACwD,QAAQ7F,IAAI,EAAE;QAE1B,IAAI,CAAC+F,WAAW;YACd;QACF;QACA,MAAMC,gBACJD,WAAWd,MAAMgB,OAAOC,OAAOC,SAASC,OAAOC;QACjD,qEAAqE;QACrE,oCAAoC;QACpC,MAAMC,UAAUC,MAAMC,OAAO,CAACR,iBAC1BA,cACG9C,MAAM,CAAC,CAACuD,MAAuB,OAAOA,QAAQ,YAAY,CAAC,CAACA,KAC5DC,GAAG,CAAC,CAACD,MAAQA,IAAItE,KAAK,CAAC,IAAI,CAAC,EAAE,IACjC,EAAE;QACN,MAAMwE,aAAsBZ,WAAWd,MAAMD,MAAM,CAAC,cAAc;QAClE,MAAM4B,gBAAgBxB,2BACpBW,WAAWF,SAAS,CAAC,kBAAkB;QAEzC,MAAMgB,WAAoBd,WAAWd,MAAMD,MAAM8B,MAAMC;QACvD,MAAMA,SAASR,MAAMC,OAAO,CAACK,YACzBA,SAAS3D,MAAM,CACb,CAAC8D,OAAyB,OAAOA,SAAS,YAAY,CAAC,CAACA,QAE1D9B;QACJ,IACEoB,QAAQzD,MAAM,IACd,OAAO8D,eAAe,YACtBC,iBACAG,QAAQlE,QACR;YACA+C,QAAQqB,IAAI,CAAC;gBACXjH,MAAM6F,QAAQ7F,IAAI,CAACmC,KAAK,CAAChD,KAAKiD,GAAG,EAAEC,IAAI,CAAC;gBACxCiE;gBACAK,YAAY,OAAOA,eAAe,WAAWA,aAAazB;gBAC1D0B;gBACAG,QAAQA,QAAQlE,SAASkE,SAAS7B;YACpC;QACF;IACF;IAEA,OAAOU;AACT;AAEA;;;;;;;CAOC,GACD,SAAS3B,2BACPnC,QAAgB,EAChB8D,OAAkC;IAElC,IAAIsB;IACJ,KAAK,MAAM7C,UAAUuB,QAAS;QAC5B,IACE,AAAC9D,CAAAA,aAAauC,OAAOrE,IAAI,IAAI8B,SAASuB,UAAU,CAAC,GAAGgB,OAAOrE,IAAI,CAAC,CAAC,CAAC,CAAA,KACjE,CAAA,CAACkH,SAAS7C,OAAOrE,IAAI,CAAC6C,MAAM,GAAGqE,MAAMlH,IAAI,CAAC6C,MAAM,AAAD,GAChD;YACAqE,QAAQ7C;QACV;IACF;IACA,OAAO6C;AACT;AAEA;;;;;;;;;;;;;;;;;;;;;CAqBC,GACD,SAASnD,mBACPM,MAA+B,EAC/B8C,aAAuC;IAEvC,MAAML,OAAgC;QAAE,GAAGzC,QAAQyC,IAAI;IAAC;IACxD,sEAAsE;IACtE,8DAA8D;IAC9D,IAAI,CAACzC,QAAQ;QACXyC,KAAKC,MAAM,GAAGI,eAAeJ,UAAU5B;IACzC;IACA,IAAIgC,eAAeb,QAAQzD,QAAQ;QACjCiE,KAAKM,KAAK,GAAG;YACX,GAAIN,KAAKM,KAAK;YACd,qBAAqBD,cAAcb,OAAO;QAC5C;IACF;IACA,OAAO;QACL,GAAGjC,MAAM;QACT,GAAI,OAAO8C,eAAeR,eAAe,WACrC;YAAE,eAAeQ,cAAcR,UAAU;QAAC,IAC1C,CAAC,CAAC;QACN,GAAIQ,eAAeP,gBACf;YAAE,kBAAkBO,cAAcP,aAAa;QAAC,IAChD,CAAC,CAAC;QACNE;IACF;AACF"}

package/src/utils/version-upgrade-migration/sync-vended-versions.d.ts

@@ -3,6 +3,14 @@
  * SPDX-License-Identifier: Apache-2.0
  */
 import { type MigrationReturnObject, type Tree } from '@nx/devkit';
+import { type OwnedDependencies } from './owned-dependencies.js';
+/**
+ * Version the sync moves a declared TypeScript dependency to, or undefined when
+ * it leaves the declaration as it is.
+ *
+ * Devkit then writes it only when it is higher than the declared version.
+ */
+export declare const syncedTsVersion: (tree: Tree, owned: OwnedDependencies, name: string, declared: unknown) => string | undefined;
 /**
  * Sync the versions this release vends, for the dependencies the workspace's
  * generators own.

package/src/utils/version-upgrade-migration/sync-vended-versions.js

@@ -76,6 +76,15 @@ import { isVendedUpgrade } from "./vended-upgrade.js";
     }
     return satisfies(vended, range);
 };
+/**
+ * Version the sync moves a declared TypeScript dependency to, or undefined when
+ * it leaves the declaration as it is.
+ *
+ * Devkit then writes it only when it is higher than the declared version.
+ */ export const syncedTsVersion = (tree, owned, name, declared)=>{
+    const vended = vendedTsVersion(owned, name);
+    return vended && isSyncableSpecifier(tree, declared) && !alreadyPermitsVended(tree, name, declared, vended) ? vended : undefined;
+};
 /**
  * Vended packages a manifest already declares, and the version to move each to.
  *
@@ -84,8 +93,8 @@ import { isVendedUpgrade } from "./vended-upgrade.js";
  */ const declaredVendedPackages = (tree, owned, packageJsonPath)=>{
     const json = readJson(tree, packageJsonPath);
     const pick = (field)=>Object.fromEntries(Object.entries(json[field] ?? {}).flatMap(([name, declared])=>{
-            const vended = vendedTsVersion(owned, name);
-            return vended && isSyncableSpecifier(tree, declared) && !alreadyPermitsVended(tree, name, declared, vended) ? [
+            const vended = syncedTsVersion(tree, owned, name, declared);
+            return vended ? [
                 [
                     name,
                     vended

package/src/utils/version-upgrade-migration/sync-vended-versions.js.map

@@ -1 +1 @@
-{"version":3,"sources":["../../../../../../packages/nx-plugin/src/utils/version-upgrade-migration/sync-vended-versions.ts"],"sourcesContent":["/**\n * Copyright Amazon.com, Inc. or its affiliates. All Rights Reserved.\n * SPDX-License-Identifier: Apache-2.0\n */\nimport {\n  addDependenciesToPackageJson,\n  detectPackageManager,\n  type MigrationReturnObject,\n  readJson,\n  type Tree,\n  updateJson,\n  visitNotIgnoredFiles,\n} from '@nx/devkit';\nimport yaml from 'js-yaml';\nimport { getCatalogManager } from 'nx/src/utils/catalog';\nimport { parsePipRequirementsLine } from 'pip-requirements-js';\nimport { coerce, parse, satisfies, validRange } from 'semver';\nimport { applyGritQL, captureAllGritQLVariable } from '../ast.js';\nimport { buildInstallCommand } from '../commands.js';\nimport { formatFilesInSubtree } from '../format.js';\nimport {\n  PACKAGES_DIR,\n  SHARED_CONSTRUCTS_DIR,\n  SHARED_TERRAFORM_DIR,\n} from '../shared-constructs-constants.js';\nimport { updateToml } from '../toml.js';\nimport {\n  cdkLambdaRuntime,\n  PY_VERSIONS,\n  TERRAFORM_VERSIONS,\n  TS_VERSIONS,\n  terraformLambdaRuntime,\n} from '../versions.js';\nimport { isNxPackage } from './nx-package-updates.js';\nimport {\n  type OwnedDependencies,\n  ownedDependencies,\n} from './owned-dependencies.js';\nimport { syncEmbeddedVersions } from './sync-embedded-versions.js';\nimport { syncLambdaRuntimes, type VendedIac } from './sync-lambda-runtimes.js';\nimport { syncMetricsVersion } from './sync-metrics-version.js';\nimport {\n  syncProjectPythonVersion,\n  syncPythonBundleVersion,\n} from './sync-python-language-version.js';\nimport { isVendedUpgrade } from './vended-upgrade.js';\n\n/**\n * Syncs the versions a generated workspace pins to those this release vends:\n * TypeScript dependencies (including those pinned only by an override), Python\n * pins, Terraform providers, and the plugin version the metrics files report.\n *\n * nx and `@nx/*` are excluded — `packageJsonUpdates` owns them so `nx migrate`\n * collects Nx's own migrations (see `nx-package-updates.ts`).\n */\n\n/** Workspace files holding catalog definitions, and pnpm 11's overrides. */\nconst YAML_WORKSPACE_FILES = ['pnpm-workspace.yaml', '.yarnrc.yml'];\n\n/**\n * Vended version for a dependency this workspace's generators own, or undefined\n * for one the user added themselves.\n */\nconst vendedTsVersion = (\n  owned: OwnedDependencies,\n  name: string,\n): string | undefined =>\n  isNxPackage(name) || !owned.ts.has(name)\n    ? undefined\n    : TS_VERSIONS[name as keyof typeof TS_VERSIONS];\n\n/** PY_VERSIONS records the `==` operator; the pin holds the bare version. */\nconst vendedPyVersion = (\n  owned: OwnedDependencies,\n  name: string,\n): string | undefined =>\n  owned.py.has(name)\n    ? PY_VERSIONS[name as keyof typeof PY_VERSIONS]?.replace(/^==/, '')\n    : undefined;\n\n/** Protocols whose version lives elsewhere, and is synced there instead. */\nconst REFERENCE_PROTOCOL =\n  /^(?:workspace|file|link|npm|git|git\\+|github|portal|patch|exec):/;\n\n/**\n * Whether devkit may be handed this specifier.\n *\n * `catalog:` is only safe where devkit has a catalog manager (pnpm, yarn, bun).\n * Without one it rewrites the reference to a literal version, severing the\n * catalog — so those references are synced directly instead.\n */\nconst isSyncableSpecifier = (tree: Tree, declared: unknown): boolean => {\n  // A manifest is the user's file and may hold anything. A version that isn't a\n  // string is not one this can reason about, and throwing here would abort the\n  // whole `nx migrate` over a file the sync only meant to skip.\n  if (typeof declared !== 'string') {\n    return false;\n  }\n  if (REFERENCE_PROTOCOL.test(declared)) {\n    return false;\n  }\n  return (\n    !declared.startsWith('catalog:') || getCatalogManager(tree.root) !== null\n  );\n};\n\n/**\n * Whether the declared range already permits the vended version, following a\n * `catalog:` reference to the range it points at.\n *\n * Devkit would narrow such a range to an exact pin, discarding a user's widened\n * specifier without changing what resolves, so it is left alone.\n */\nconst alreadyPermitsVended = (\n  tree: Tree,\n  packageName: string,\n  declared: string,\n  vended: string,\n): boolean => {\n  let range = declared;\n  if (declared.startsWith('catalog:')) {\n    const resolved = getCatalogManager(tree.root)?.resolveCatalogReference(\n      tree,\n      packageName,\n      declared,\n    );\n    if (!resolved) {\n      return false;\n    }\n    range = resolved;\n  }\n  range = range.trim();\n  // An exact pin is the case to upgrade, not a range to preserve.\n  if (parse(range) !== null || validRange(range) === null) {\n    return false;\n  }\n  return satisfies(vended, range);\n};\n\n/**\n * Vended packages a manifest already declares, and the version to move each to.\n *\n * Only packages already present are named: devkit adds whatever it is given, so\n * passing the full vended list would inject all of it into every manifest.\n */\nconst declaredVendedPackages = (\n  tree: Tree,\n  owned: OwnedDependencies,\n  packageJsonPath: string,\n): {\n  dependencies: Record<string, string>;\n  devDependencies: Record<string, string>;\n} => {\n  const json = readJson(tree, packageJsonPath);\n  const pick = (field: 'dependencies' | 'devDependencies') =>\n    Object.fromEntries(\n      Object.entries((json[field] ?? {}) as Record<string, string>).flatMap(\n        ([name, declared]) => {\n          const vended = vendedTsVersion(owned, name);\n          return vended &&\n            isSyncableSpecifier(tree, declared) &&\n            !alreadyPermitsVended(tree, name, declared, vended)\n            ? [[name, vended] as const]\n            : [];\n        },\n      ),\n    );\n  return {\n    dependencies: pick('dependencies'),\n    devDependencies: pick('devDependencies'),\n  };\n};\n\n/**\n * Sync the TypeScript dependencies every `package.json` declares.\n *\n * Devkit does the writing: it moves a version wherever the workspace keeps it —\n * through a `catalog:` reference or directly — and refuses anything that isn't a\n * strict upgrade on what is installed.\n *\n * Called directly rather than through this plugin's wrapper, which *migrates*\n * declarations into the catalog; right when generating, wrong for a version bump.\n */\nconst syncPackageJsons = (tree: Tree, owned: OwnedDependencies): string[] => {\n  const updated: string[] = [];\n\n  visitNotIgnoredFiles(tree, '.', (path) => {\n    if (!path.endsWith('package.json')) {\n      return;\n    }\n    const { dependencies, devDependencies } = declaredVendedPackages(\n      tree,\n      owned,\n      path,\n    );\n    if (\n      Object.keys(dependencies).length === 0 &&\n      Object.keys(devDependencies).length === 0\n    ) {\n      return;\n    }\n\n    const before = tree.read(path, 'utf-8');\n    const catalogsBefore = readCatalogFiles(tree);\n    // Install callback dropped: `nx migrate` runs install itself.\n    addDependenciesToPackageJson(tree, dependencies, devDependencies, path);\n    if (\n      tree.read(path, 'utf-8') !== before ||\n      readCatalogFiles(tree) !== catalogsBefore\n    ) {\n      updated.push(path);\n    }\n  });\n\n  return updated;\n};\n\n/** Snapshot of every catalog definition file, for change detection. */\nconst readCatalogFiles = (tree: Tree): string =>\n  [...YAML_WORKSPACE_FILES, 'package.json']\n    .map((path) => (tree.exists(path) ? tree.read(path, 'utf-8') : ''))\n    .join('\\0');\n\n/**\n * Upgrade vended catalog entries devkit cannot reach: those no manifest\n * references.\n */\nconst syncOrphanCatalogEntries = (\n  tree: Tree,\n  owned: OwnedDependencies,\n): string[] => {\n  const referenced = referencedCatalogPackages(tree);\n  const updated: string[] = [];\n\n  const syncCatalog = (\n    catalog: Record<string, string> | undefined,\n  ): boolean => {\n    let changed = false;\n    for (const [name, declared] of Object.entries(catalog ?? {})) {\n      const vended = vendedTsVersion(owned, name);\n      if (!vended || referenced.has(name)) {\n        continue;\n      }\n      if (isVendedUpgrade(vended, String(declared))) {\n        catalog![name] = vended;\n        changed = true;\n      }\n    }\n    return changed;\n  };\n\n  for (const path of YAML_WORKSPACE_FILES) {\n    if (!tree.exists(path)) {\n      continue;\n    }\n    const catalogFile = (yaml.load(tree.read(path, 'utf-8') ?? '') ?? {}) as {\n      catalog?: Record<string, string>;\n      catalogs?: Record<string, Record<string, string>>;\n    };\n    const changed = [\n      syncCatalog(catalogFile.catalog),\n      ...Object.values(catalogFile.catalogs ?? {}).map(syncCatalog),\n    ].some(Boolean);\n    if (changed) {\n      tree.write(path, yaml.dump(catalogFile, { quotingType: \"'\" }));\n      updated.push(path);\n    }\n  }\n\n  // Bun keeps its catalogs in the root manifest.\n  if (tree.exists('package.json')) {\n    let changed = false;\n    updateJson(tree, 'package.json', (json) => {\n      changed = [\n        syncCatalog(json.catalog),\n        ...Object.values(\n          (json.catalogs ?? {}) as Record<string, Record<string, string>>,\n        ).map(syncCatalog),\n      ].some(Boolean);\n      return json;\n    });\n    if (changed) {\n      updated.push('package.json');\n    }\n  }\n\n  return updated;\n};\n\n/**\n * The package an override key pins, or undefined when the key names none.\n *\n * A key is a package name, optionally preceded by the path it is scoped to and\n * followed by the parent range it applies at:\n *\n *   zod                                     -> zod\n *   zod@^3                                  -> zod\n *   **&#47;@modelcontextprotocol/sdk/zod        -> zod\n *   @prisma/adapter-pg/@types/pg            -> @types/pg\n *\n * The last segment is the package, since every earlier one is a parent it is\n * scoped under — except that a scope and the name after it are one segment.\n */\nconst overriddenPackage = (key: string): string | undefined => {\n  const segments = key.split('/').reduce<string[]>((acc, part) => {\n    // A bare `@scope` is only half a name; join it to what follows.\n    const previous = acc[acc.length - 1];\n    if (previous?.startsWith('@') && !previous.includes('/')) {\n      acc[acc.length - 1] = `${previous}/${part}`;\n      return acc;\n    }\n    acc.push(part);\n    return acc;\n  }, []);\n\n  const name = segments[segments.length - 1];\n  if (!name || name === '.') {\n    return undefined;\n  }\n  // A trailing `@range` scopes the override to a parent version.\n  const at = name.lastIndexOf('@');\n  return at > 0 ? name.slice(0, at) : name;\n};\n\n/**\n * Sync the owned packages an override pins, wherever the workspace keeps them:\n * npm's `overrides`, yarn and bun's `resolutions`, and pnpm's `pnpm.overrides`\n * (10) or `pnpm-workspace.yaml` `overrides` (11).\n *\n * Devkit does not manage these fields, so an owned package pinned only here\n * would otherwise stay on the version it was generated with. Values are compared\n * with `isVendedUpgrade`, so a range the user widened is left alone.\n */\n/**\n * Where the workspace's package manager reads overrides from.\n *\n * Only the root manifest is considered: every package manager resolves overrides\n * from the workspace root, so a nested `overrides` block is inert and rewriting\n * it would imply an effect it doesn't have.\n *\n * pnpm moved the block between majors — 10 reads `pnpm.overrides` in the\n * manifest, 11 reads `overrides` in `pnpm-workspace.yaml` — so both are covered\n * rather than detecting the minor.\n */\nconst overrideLocations = (\n  tree: Tree,\n): {\n  manifestFields: readonly ('overrides' | 'resolutions' | 'pnpm.overrides')[];\n  workspaceFile?: string;\n} => {\n  switch (detectPackageManager(tree.root)) {\n    case 'npm':\n      return { manifestFields: ['overrides'] };\n    case 'yarn':\n      return { manifestFields: ['resolutions'] };\n    case 'bun':\n      // Bun reads npm's `overrides` and yarn's `resolutions` alike.\n      return { manifestFields: ['overrides', 'resolutions'] };\n    default:\n      return {\n        manifestFields: ['pnpm.overrides'],\n        workspaceFile: 'pnpm-workspace.yaml',\n      };\n  }\n};\n\nconst syncOverrides = (tree: Tree, owned: OwnedDependencies): string[] => {\n  const updated: string[] = [];\n\n  // Nested npm overrides carry the pin under `.`, with sibling keys scoping\n  // deeper, so a value may be a string or another override object.\n  const syncOverrideTree = (overrides: unknown): boolean => {\n    if (typeof overrides !== 'object' || overrides === null) {\n      return false;\n    }\n    let changed = false;\n    for (const [key, value] of Object.entries(\n      overrides as Record<string, unknown>,\n    )) {\n      if (typeof value === 'object' && value !== null) {\n        changed = syncOverrideTree(value) || changed;\n        continue;\n      }\n      if (typeof value !== 'string') {\n        continue;\n      }\n      // `.` pins the package its parent key names.\n      const name =\n        key === '.' ? undefined : (overriddenPackage(key) ?? undefined);\n      const vended = name ? vendedTsVersion(owned, name) : undefined;\n      if (vended && isVendedUpgrade(vended, value)) {\n        (overrides as Record<string, unknown>)[key] = vended;\n        changed = true;\n      }\n    }\n    return changed;\n  };\n\n  const { manifestFields, workspaceFile } = overrideLocations(tree);\n\n  if (manifestFields.length > 0) {\n    let changed = false;\n    updateJson(tree, 'package.json', (json) => {\n      changed = manifestFields\n        .map((field) =>\n          syncOverrideTree(\n            field === 'pnpm.overrides' ? json.pnpm?.overrides : json[field],\n          ),\n        )\n        .some(Boolean);\n      return json;\n    });\n    if (changed) {\n      updated.push('package.json');\n    }\n  }\n\n  if (workspaceFile && tree.exists(workspaceFile)) {\n    const contents = (yaml.load(tree.read(workspaceFile, 'utf-8') ?? '') ??\n      {}) as Record<string, unknown>;\n    if (syncOverrideTree(contents.overrides)) {\n      tree.write(workspaceFile, yaml.dump(contents, { quotingType: \"'\" }));\n      updated.push(workspaceFile);\n    }\n  }\n\n  return updated;\n};\n\n/**\n * Packages devkit already maintains through a `catalog:` reference. Empty\n * without a catalog manager, where no reference resolves.\n */\nconst referencedCatalogPackages = (tree: Tree): Set<string> => {\n  const referenced = new Set<string>();\n  if (getCatalogManager(tree.root) === null) {\n    return referenced;\n  }\n  visitNotIgnoredFiles(tree, '.', (path) => {\n    if (!path.endsWith('package.json')) {\n      return;\n    }\n    const json = readJson(tree, path);\n    for (const field of ['dependencies', 'devDependencies'] as const) {\n      for (const [name, declared] of Object.entries(\n        (json[field] ?? {}) as Record<string, string>,\n      )) {\n        if (String(declared).startsWith('catalog:')) {\n          referenced.add(name);\n        }\n      }\n    }\n  });\n  return referenced;\n};\n\n/** Pip specifier as `pip-requirements-js` reports it. */\ninterface PyVersionSpec {\n  readonly operator: string;\n  readonly version: string;\n}\n\n/**\n * Whether the declared specifiers already permit the vended version, so\n * rewriting them would discard the user's range without changing what resolves.\n *\n * This mirrors the TypeScript side: an exact pin is the case to upgrade, a range\n * that already reaches the vended version is left alone, and a range that falls\n * short is moved up.\n *\n * A `*` wildcard or a specifier semver can't read counts as already permitting,\n * so anything not understood is left as the user wrote it.\n */\nconst pyRangePermitsVended = (\n  specs: readonly PyVersionSpec[],\n  vended: string,\n): boolean =>\n  specs.every((spec) => {\n    if (spec.version.includes('*')) {\n      return true;\n    }\n    const bound = coerce(spec.version, { includePrerelease: true });\n    if (!bound) {\n      return true;\n    }\n    switch (spec.operator) {\n      // An exact pin permits only itself, so a differing vended version is an\n      // upgrade to apply.\n      case '==':\n      case '===':\n        return satisfies(vended, `=${bound.version}`, {\n          includePrerelease: true,\n        });\n      // `~=1.2.3` allows the patch series; `~=1.2` the minor series.\n      case '~=':\n        return satisfies(\n          vended,\n          spec.version.split('.').length > 2\n            ? `~${bound.version}`\n            : `^${bound.version}`,\n          { includePrerelease: true },\n        );\n      case '>=':\n      case '>':\n      case '<=':\n      case '<':\n        return satisfies(vended, `${spec.operator}${bound.version}`, {\n          includePrerelease: true,\n        });\n      // `!=` only excludes, so it never blocks the vended version by itself.\n      case '!=':\n        return true;\n      default:\n        return true;\n    }\n  });\n\n/**\n * Upgrade a pip requirement to the vended version, or return it unchanged.\n *\n * Parsed rather than pattern-matched so extras and operators are read the way\n * `uv` reads them. A requirement whose specifiers already permit the vended\n * version keeps them; one that falls short is replaced with an exact pin, which\n * is what the generators write.\n */\nconst syncPyRequirement = (\n  owned: OwnedDependencies,\n  requirement: string,\n): string => {\n  const parsed = parsePipRequirementsLine(requirement);\n  if (parsed?.type !== 'ProjectName' || !parsed.versionSpec?.length) {\n    return requirement;\n  }\n\n  const name = parsed.extras?.length\n    ? `${parsed.name}[${parsed.extras.join(',')}]`\n    : parsed.name;\n  const vended = vendedPyVersion(owned, name);\n  if (!vended) {\n    return requirement;\n  }\n\n  const specs = parsed.versionSpec as readonly PyVersionSpec[];\n  // Never move a version backwards: a pin above what this release vends is the\n  // user's, and a range already reaching it is theirs to keep.\n  const [first] = specs;\n  const isExactPin =\n    specs.length === 1 && (first.operator === '==' || first.operator === '===');\n  if (isExactPin && !isVendedUpgrade(vended, first.version)) {\n    return requirement;\n  }\n  if (!isExactPin && pyRangePermitsVended(specs, vended)) {\n    return requirement;\n  }\n  return `${name}==${vended}`;\n};\n\n/** Sync pins in every `pyproject.toml`, dependencies and groups alike. */\nconst syncPyProjects = (tree: Tree, owned: OwnedDependencies): string[] => {\n  const updated: string[] = [];\n\n  visitNotIgnoredFiles(tree, '.', (path) => {\n    if (!path.endsWith('pyproject.toml')) {\n      return;\n    }\n\n    let changed = false;\n    const syncRequirements = (requirements: unknown): unknown =>\n      Array.isArray(requirements)\n        ? requirements.map((requirement) => {\n            if (typeof requirement !== 'string') {\n              return requirement;\n            }\n            const synced = syncPyRequirement(owned, requirement);\n            changed ||= synced !== requirement;\n            return synced;\n          })\n        : requirements;\n\n    updateToml(tree, path, (toml) => {\n      const project = toml.project as Record<string, unknown> | undefined;\n      if (project?.dependencies) {\n        project.dependencies = syncRequirements(project.dependencies) as never;\n      }\n      const groups = toml['dependency-groups'] as\n        | Record<string, unknown>\n        | undefined;\n      for (const group of Object.keys(groups ?? {})) {\n        groups![group] = syncRequirements(groups![group]) as never;\n      }\n      return toml;\n    });\n\n    if (changed) {\n      updated.push(path);\n    }\n  });\n\n  return updated;\n};\n\n/**\n * GritQL matching one provider's `version` in `required_providers`, scoped by\n * the sibling `source` so an alias or another provider's version can't match.\n *\n * `language hcl` is required — without it the pattern silently matches nothing.\n */\nconst providerVersionPattern = (provider: string, rewrite = ''): string =>\n  `language hcl\\n\\`version = $version\\`${rewrite} where {` +\n  ` $version <: within \\`{ source = \"hashicorp/${provider}\" $... }\\` }`;\n\n/** Version a provider currently declares, if it declares one. */\nconst declaredProviderVersion = async (\n  tree: Tree,\n  path: string,\n  provider: string,\n): Promise<string | undefined> => {\n  const [bound] =\n    (await captureAllGritQLVariable(\n      tree,\n      path,\n      providerVersionPattern(provider),\n      'version',\n    )) ?? [];\n  // The binding is the quoted version, e.g. `\"6.40.0\"`.\n  return bound?.replace(/^\"|\"$/g, '');\n};\n\n/** Sync vended provider versions in every `.tf` file. */\nconst syncTerraformProviders = async (tree: Tree): Promise<string[]> => {\n  const updated: string[] = [];\n  const terraformFiles: string[] = [];\n\n  visitNotIgnoredFiles(tree, '.', (path) => {\n    if (path.endsWith('.tf')) {\n      terraformFiles.push(path);\n    }\n  });\n\n  for (const path of terraformFiles) {\n    let changed = false;\n    for (const [provider, vended] of Object.entries(TERRAFORM_VERSIONS)) {\n      const declared = await declaredProviderVersion(tree, path, provider);\n      if (!declared || !isVendedUpgrade(vended, declared)) {\n        continue;\n      }\n      changed =\n        (await applyGritQL(\n          tree,\n          path,\n          providerVersionPattern(provider, ` => \\`version = \"${vended}\"\\``),\n        )) || changed;\n    }\n    if (changed) {\n      updated.push(path);\n    }\n  }\n\n  return updated;\n};\n\n/**\n * The projects this plugin generates infrastructure into, per provider.\n *\n * A runtime is not a dependency, so there is no per-package ownership to consult —\n * these directories are the scope. A Lambda a user defined in their own project\n * keeps whatever runtime they chose, even though it is the same shape.\n */\nconst OWNED_INFRA_DIRS: Readonly<Record<VendedIac, string>> = {\n  cdk: `${PACKAGES_DIR}/${SHARED_CONSTRUCTS_DIR}`,\n  terraform: `${PACKAGES_DIR}/${SHARED_TERRAFORM_DIR}`,\n};\n\n/**\n * Sync the versions this release vends, for the dependencies the workspace's\n * generators own.\n */\nexport const syncVendedVersions = async (\n  tree: Tree,\n): Promise<MigrationReturnObject> => {\n  const nextSteps: string[] = [];\n  const owned = await ownedDependencies(tree);\n\n  const packageJsons = syncPackageJsons(tree, owned);\n  const catalogs = syncOrphanCatalogEntries(tree, owned);\n  const overrides = syncOverrides(tree, owned);\n  const pyProjects = syncPyProjects(tree, owned);\n  const terraformFiles = await syncTerraformProviders(tree);\n  const lambdaRuntimes = await syncLambdaRuntimes(tree, OWNED_INFRA_DIRS);\n  const projectPython = syncProjectPythonVersion(tree);\n  const pythonBundles = syncPythonBundleVersion(tree);\n  const skippedEmbedded = await syncEmbeddedVersions(tree, owned);\n  await syncMetricsVersion(tree);\n\n  // Lock files are left to the user: `nx migrate` only installs when the root\n  // manifest changes, and never runs `uv` or `terraform`.\n  if (catalogs.length > 0 || packageJsons.length > 0 || overrides.length > 0) {\n    nextSteps.push(\n      `TypeScript dependency versions were updated. Run \\`${buildInstallCommand(\n        detectPackageManager(tree.root),\n      )}\\` to update the lock file.`,\n    );\n  }\n  if (\n    pyProjects.length > 0 ||\n    projectPython.length > 0 ||\n    pythonBundles.length > 0\n  ) {\n    nextSteps.push(\n      `Python dependency versions were updated in ${[...new Set([...pyProjects, ...projectPython, ...pythonBundles])].join(', ')}. Run \\`uv sync\\` to update uv.lock.`,\n    );\n  }\n  // A runtime the sync recognised is simply moved; one it doesn't recognise is\n  // the user's choice, so it is reported rather than rewritten.\n  if (lambdaRuntimes.diverged.length > 0) {\n    nextSteps.push(\n      `Lambda runtimes in ${[...new Set(lambdaRuntimes.diverged)].join(', ')} have diverged from the generated shape and were left untouched. Set them to \\`${cdkLambdaRuntime('node')}\\` (CDK) or \\`\"${terraformLambdaRuntime('node')}\"\\` (Terraform) if you want them on the runtime this release vends.`,\n    );\n  }\n  if (terraformFiles.length > 0) {\n    nextSteps.push(\n      `Terraform provider versions were updated in ${terraformFiles.length} file(s). Run \\`terraform init -upgrade\\` in each Terraform project to update its lock file.`,\n    );\n  }\n  // A synced embedded pin needs no next step — it is read the next time the thing\n  // holding it runs. A file the sync left alone does: its versions are still the\n  // old ones, and only the user can reconcile that.\n  if (skippedEmbedded.length > 0) {\n    nextSteps.push(\n      `Version pins were left as they are in ${skippedEmbedded.join(', ')}, which repeat a pin more times than this migration rewrites at once. Update them by hand.`,\n    );\n  }\n\n  // Without this the workspace's own format check fails on the migrated files.\n  await formatFilesInSubtree(tree);\n\n  return { nextSteps };\n};\n"],"names":["addDependenciesToPackageJson","detectPackageManager","readJson","updateJson","visitNotIgnoredFiles","yaml","getCatalogManager","parsePipRequirementsLine","coerce","parse","satisfies","validRange","applyGritQL","captureAllGritQLVariable","buildInstallCommand","formatFilesInSubtree","PACKAGES_DIR","SHARED_CONSTRUCTS_DIR","SHARED_TERRAFORM_DIR","updateToml","cdkLambdaRuntime","PY_VERSIONS","TERRAFORM_VERSIONS","TS_VERSIONS","terraformLambdaRuntime","isNxPackage","ownedDependencies","syncEmbeddedVersions","syncLambdaRuntimes","syncMetricsVersion","syncProjectPythonVersion","syncPythonBundleVersion","isVendedUpgrade","YAML_WORKSPACE_FILES","vendedTsVersion","owned","name","ts","has","undefined","vendedPyVersion","py","replace","REFERENCE_PROTOCOL","isSyncableSpecifier","tree","declared","test","startsWith","root","alreadyPermitsVended","packageName","vended","range","resolved","resolveCatalogReference","trim","declaredVendedPackages","packageJsonPath","json","pick","field","Object","fromEntries","entries","flatMap","dependencies","devDependencies","syncPackageJsons","updated","path","endsWith","keys","length","before","read","catalogsBefore","readCatalogFiles","push","map","exists","join","syncOrphanCatalogEntries","referenced","referencedCatalogPackages","syncCatalog","catalog","changed","String","catalogFile","load","values","catalogs","some","Boolean","write","dump","quotingType","overriddenPackage","key","segments","split","reduce","acc","part","previous","includes","at","lastIndexOf","slice","overrideLocations","manifestFields","workspaceFile","syncOverrides","syncOverrideTree","overrides","value","pnpm","contents","Set","add","pyRangePermitsVended","specs","every","spec","version","bound","includePrerelease","operator","syncPyRequirement","requirement","parsed","type","versionSpec","extras","first","isExactPin","syncPyProjects","syncRequirements","requirements","Array","isArray","synced","toml","project","groups","group","providerVersionPattern","provider","rewrite","declaredProviderVersion","syncTerraformProviders","terraformFiles","OWNED_INFRA_DIRS","cdk","terraform","syncVendedVersions","nextSteps","packageJsons","pyProjects","lambdaRuntimes","projectPython","pythonBundles","skippedEmbedded","diverged"],"mappings":"AAAA;;;CAGC,GACD,SACEA,4BAA4B,EAC5BC,oBAAoB,EAEpBC,QAAQ,EAERC,UAAU,EACVC,oBAAoB,QACf,aAAa;AACpB,OAAOC,UAAU,UAAU;AAC3B,SAASC,iBAAiB,QAAQ,uBAAuB;AACzD,SAASC,wBAAwB,QAAQ,sBAAsB;AAC/D,SAASC,MAAM,EAAEC,KAAK,EAAEC,SAAS,EAAEC,UAAU,QAAQ,SAAS;AAC9D,SAASC,WAAW,EAAEC,wBAAwB,QAAQ,YAAY;AAClE,SAASC,mBAAmB,QAAQ,iBAAiB;AACrD,SAASC,oBAAoB,QAAQ,eAAe;AACpD,SACEC,YAAY,EACZC,qBAAqB,EACrBC,oBAAoB,QACf,oCAAoC;AAC3C,SAASC,UAAU,QAAQ,aAAa;AACxC,SACEC,gBAAgB,EAChBC,WAAW,EACXC,kBAAkB,EAClBC,WAAW,EACXC,sBAAsB,QACjB,iBAAiB;AACxB,SAASC,WAAW,QAAQ,0BAA0B;AACtD,SAEEC,iBAAiB,QACZ,0BAA0B;AACjC,SAASC,oBAAoB,QAAQ,8BAA8B;AACnE,SAASC,kBAAkB,QAAwB,4BAA4B;AAC/E,SAASC,kBAAkB,QAAQ,4BAA4B;AAC/D,SACEC,wBAAwB,EACxBC,uBAAuB,QAClB,oCAAoC;AAC3C,SAASC,eAAe,QAAQ,sBAAsB;AAEtD;;;;;;;CAOC,GAED,0EAA0E,GAC1E,MAAMC,uBAAuB;IAAC;IAAuB;CAAc;AAEnE;;;CAGC,GACD,MAAMC,kBAAkB,CACtBC,OACAC,OAEAX,YAAYW,SAAS,CAACD,MAAME,EAAE,CAACC,GAAG,CAACF,QAC/BG,YACAhB,WAAW,CAACa,KAAiC;AAEnD,2EAA2E,GAC3E,MAAMI,kBAAkB,CACtBL,OACAC,OAEAD,MAAMM,EAAE,CAACH,GAAG,CAACF,QACTf,WAAW,CAACe,KAAiC,EAAEM,QAAQ,OAAO,MAC9DH;AAEN,0EAA0E,GAC1E,MAAMI,qBACJ;AAEF;;;;;;CAMC,GACD,MAAMC,sBAAsB,CAACC,MAAYC;IACvC,8EAA8E;IAC9E,6EAA6E;IAC7E,8DAA8D;IAC9D,IAAI,OAAOA,aAAa,UAAU;QAChC,OAAO;IACT;IACA,IAAIH,mBAAmBI,IAAI,CAACD,WAAW;QACrC,OAAO;IACT;IACA,OACE,CAACA,SAASE,UAAU,CAAC,eAAe1C,kBAAkBuC,KAAKI,IAAI,MAAM;AAEzE;AAEA;;;;;;CAMC,GACD,MAAMC,uBAAuB,CAC3BL,MACAM,aACAL,UACAM;IAEA,IAAIC,QAAQP;IACZ,IAAIA,SAASE,UAAU,CAAC,aAAa;QACnC,MAAMM,WAAWhD,kBAAkBuC,KAAKI,IAAI,GAAGM,wBAC7CV,MACAM,aACAL;QAEF,IAAI,CAACQ,UAAU;YACb,OAAO;QACT;QACAD,QAAQC;IACV;IACAD,QAAQA,MAAMG,IAAI;IAClB,gEAAgE;IAChE,IAAI/C,MAAM4C,WAAW,QAAQ1C,WAAW0C,WAAW,MAAM;QACvD,OAAO;IACT;IACA,OAAO3C,UAAU0C,QAAQC;AAC3B;AAEA;;;;;CAKC,GACD,MAAMI,yBAAyB,CAC7BZ,MACAV,OACAuB;IAKA,MAAMC,OAAOzD,SAAS2C,MAAMa;IAC5B,MAAME,OAAO,CAACC,QACZC,OAAOC,WAAW,CAChBD,OAAOE,OAAO,CAAEL,IAAI,CAACE,MAAM,IAAI,CAAC,GAA8BI,OAAO,CACnE,CAAC,CAAC7B,MAAMU,SAAS;YACf,MAAMM,SAASlB,gBAAgBC,OAAOC;YACtC,OAAOgB,UACLR,oBAAoBC,MAAMC,aAC1B,CAACI,qBAAqBL,MAAMT,MAAMU,UAAUM,UAC1C;gBAAC;oBAAChB;oBAAMgB;iBAAO;aAAU,GACzB,EAAE;QACR;IAGN,OAAO;QACLc,cAAcN,KAAK;QACnBO,iBAAiBP,KAAK;IACxB;AACF;AAEA;;;;;;;;;CASC,GACD,MAAMQ,mBAAmB,CAACvB,MAAYV;IACpC,MAAMkC,UAAoB,EAAE;IAE5BjE,qBAAqByC,MAAM,KAAK,CAACyB;QAC/B,IAAI,CAACA,KAAKC,QAAQ,CAAC,iBAAiB;YAClC;QACF;QACA,MAAM,EAAEL,YAAY,EAAEC,eAAe,EAAE,GAAGV,uBACxCZ,MACAV,OACAmC;QAEF,IACER,OAAOU,IAAI,CAACN,cAAcO,MAAM,KAAK,KACrCX,OAAOU,IAAI,CAACL,iBAAiBM,MAAM,KAAK,GACxC;YACA;QACF;QAEA,MAAMC,SAAS7B,KAAK8B,IAAI,CAACL,MAAM;QAC/B,MAAMM,iBAAiBC,iBAAiBhC;QACxC,8DAA8D;QAC9D7C,6BAA6B6C,MAAMqB,cAAcC,iBAAiBG;QAClE,IACEzB,KAAK8B,IAAI,CAACL,MAAM,aAAaI,UAC7BG,iBAAiBhC,UAAU+B,gBAC3B;YACAP,QAAQS,IAAI,CAACR;QACf;IACF;IAEA,OAAOD;AACT;AAEA,qEAAqE,GACrE,MAAMQ,mBAAmB,CAAChC,OACxB;WAAIZ;QAAsB;KAAe,CACtC8C,GAAG,CAAC,CAACT,OAAUzB,KAAKmC,MAAM,CAACV,QAAQzB,KAAK8B,IAAI,CAACL,MAAM,WAAW,IAC9DW,IAAI,CAAC;AAEV;;;CAGC,GACD,MAAMC,2BAA2B,CAC/BrC,MACAV;IAEA,MAAMgD,aAAaC,0BAA0BvC;IAC7C,MAAMwB,UAAoB,EAAE;IAE5B,MAAMgB,cAAc,CAClBC;QAEA,IAAIC,UAAU;QACd,KAAK,MAAM,CAACnD,MAAMU,SAAS,IAAIgB,OAAOE,OAAO,CAACsB,WAAW,CAAC,GAAI;YAC5D,MAAMlC,SAASlB,gBAAgBC,OAAOC;YACtC,IAAI,CAACgB,UAAU+B,WAAW7C,GAAG,CAACF,OAAO;gBACnC;YACF;YACA,IAAIJ,gBAAgBoB,QAAQoC,OAAO1C,YAAY;gBAC7CwC,OAAQ,CAAClD,KAAK,GAAGgB;gBACjBmC,UAAU;YACZ;QACF;QACA,OAAOA;IACT;IAEA,KAAK,MAAMjB,QAAQrC,qBAAsB;QACvC,IAAI,CAACY,KAAKmC,MAAM,CAACV,OAAO;YACtB;QACF;QACA,MAAMmB,cAAepF,KAAKqF,IAAI,CAAC7C,KAAK8B,IAAI,CAACL,MAAM,YAAY,OAAO,CAAC;QAInE,MAAMiB,UAAU;YACdF,YAAYI,YAAYH,OAAO;eAC5BxB,OAAO6B,MAAM,CAACF,YAAYG,QAAQ,IAAI,CAAC,GAAGb,GAAG,CAACM;SAClD,CAACQ,IAAI,CAACC;QACP,IAAIP,SAAS;YACX1C,KAAKkD,KAAK,CAACzB,MAAMjE,KAAK2F,IAAI,CAACP,aAAa;gBAAEQ,aAAa;YAAI;YAC3D5B,QAAQS,IAAI,CAACR;QACf;IACF;IAEA,+CAA+C;IAC/C,IAAIzB,KAAKmC,MAAM,CAAC,iBAAiB;QAC/B,IAAIO,UAAU;QACdpF,WAAW0C,MAAM,gBAAgB,CAACc;YAChC4B,UAAU;gBACRF,YAAY1B,KAAK2B,OAAO;mBACrBxB,OAAO6B,MAAM,CACbhC,KAAKiC,QAAQ,IAAI,CAAC,GACnBb,GAAG,CAACM;aACP,CAACQ,IAAI,CAACC;YACP,OAAOnC;QACT;QACA,IAAI4B,SAAS;YACXlB,QAAQS,IAAI,CAAC;QACf;IACF;IAEA,OAAOT;AACT;AAEA;;;;;;;;;;;;;CAaC,GACD,MAAM6B,oBAAoB,CAACC;IACzB,MAAMC,WAAWD,IAAIE,KAAK,CAAC,KAAKC,MAAM,CAAW,CAACC,KAAKC;QACrD,gEAAgE;QAChE,MAAMC,WAAWF,GAAG,CAACA,IAAI9B,MAAM,GAAG,EAAE;QACpC,IAAIgC,UAAUzD,WAAW,QAAQ,CAACyD,SAASC,QAAQ,CAAC,MAAM;YACxDH,GAAG,CAACA,IAAI9B,MAAM,GAAG,EAAE,GAAG,GAAGgC,SAAS,CAAC,EAAED,MAAM;YAC3C,OAAOD;QACT;QACAA,IAAIzB,IAAI,CAAC0B;QACT,OAAOD;IACT,GAAG,EAAE;IAEL,MAAMnE,OAAOgE,QAAQ,CAACA,SAAS3B,MAAM,GAAG,EAAE;IAC1C,IAAI,CAACrC,QAAQA,SAAS,KAAK;QACzB,OAAOG;IACT;IACA,+DAA+D;IAC/D,MAAMoE,KAAKvE,KAAKwE,WAAW,CAAC;IAC5B,OAAOD,KAAK,IAAIvE,KAAKyE,KAAK,CAAC,GAAGF,MAAMvE;AACtC;AAEA;;;;;;;;CAQC,GACD;;;;;;;;;;CAUC,GACD,MAAM0E,oBAAoB,CACxBjE;IAKA,OAAQ5C,qBAAqB4C,KAAKI,IAAI;QACpC,KAAK;YACH,OAAO;gBAAE8D,gBAAgB;oBAAC;iBAAY;YAAC;QACzC,KAAK;YACH,OAAO;gBAAEA,gBAAgB;oBAAC;iBAAc;YAAC;QAC3C,KAAK;YACH,8DAA8D;YAC9D,OAAO;gBAAEA,gBAAgB;oBAAC;oBAAa;iBAAc;YAAC;QACxD;YACE,OAAO;gBACLA,gBAAgB;oBAAC;iBAAiB;gBAClCC,eAAe;YACjB;IACJ;AACF;AAEA,MAAMC,gBAAgB,CAACpE,MAAYV;IACjC,MAAMkC,UAAoB,EAAE;IAE5B,0EAA0E;IAC1E,iEAAiE;IACjE,MAAM6C,mBAAmB,CAACC;QACxB,IAAI,OAAOA,cAAc,YAAYA,cAAc,MAAM;YACvD,OAAO;QACT;QACA,IAAI5B,UAAU;QACd,KAAK,MAAM,CAACY,KAAKiB,MAAM,IAAItD,OAAOE,OAAO,CACvCmD,WACC;YACD,IAAI,OAAOC,UAAU,YAAYA,UAAU,MAAM;gBAC/C7B,UAAU2B,iBAAiBE,UAAU7B;gBACrC;YACF;YACA,IAAI,OAAO6B,UAAU,UAAU;gBAC7B;YACF;YACA,6CAA6C;YAC7C,MAAMhF,OACJ+D,QAAQ,MAAM5D,YAAa2D,kBAAkBC,QAAQ5D;YACvD,MAAMa,SAAShB,OAAOF,gBAAgBC,OAAOC,QAAQG;YACrD,IAAIa,UAAUpB,gBAAgBoB,QAAQgE,QAAQ;gBAC3CD,SAAqC,CAAChB,IAAI,GAAG/C;gBAC9CmC,UAAU;YACZ;QACF;QACA,OAAOA;IACT;IAEA,MAAM,EAAEwB,cAAc,EAAEC,aAAa,EAAE,GAAGF,kBAAkBjE;IAE5D,IAAIkE,eAAetC,MAAM,GAAG,GAAG;QAC7B,IAAIc,UAAU;QACdpF,WAAW0C,MAAM,gBAAgB,CAACc;YAChC4B,UAAUwB,eACPhC,GAAG,CAAC,CAAClB,QACJqD,iBACErD,UAAU,mBAAmBF,KAAK0D,IAAI,EAAEF,YAAYxD,IAAI,CAACE,MAAM,GAGlEgC,IAAI,CAACC;YACR,OAAOnC;QACT;QACA,IAAI4B,SAAS;YACXlB,QAAQS,IAAI,CAAC;QACf;IACF;IAEA,IAAIkC,iBAAiBnE,KAAKmC,MAAM,CAACgC,gBAAgB;QAC/C,MAAMM,WAAYjH,KAAKqF,IAAI,CAAC7C,KAAK8B,IAAI,CAACqC,eAAe,YAAY,OAC/D,CAAC;QACH,IAAIE,iBAAiBI,SAASH,SAAS,GAAG;YACxCtE,KAAKkD,KAAK,CAACiB,eAAe3G,KAAK2F,IAAI,CAACsB,UAAU;gBAAErB,aAAa;YAAI;YACjE5B,QAAQS,IAAI,CAACkC;QACf;IACF;IAEA,OAAO3C;AACT;AAEA;;;CAGC,GACD,MAAMe,4BAA4B,CAACvC;IACjC,MAAMsC,aAAa,IAAIoC;IACvB,IAAIjH,kBAAkBuC,KAAKI,IAAI,MAAM,MAAM;QACzC,OAAOkC;IACT;IACA/E,qBAAqByC,MAAM,KAAK,CAACyB;QAC/B,IAAI,CAACA,KAAKC,QAAQ,CAAC,iBAAiB;YAClC;QACF;QACA,MAAMZ,OAAOzD,SAAS2C,MAAMyB;QAC5B,KAAK,MAAMT,SAAS;YAAC;YAAgB;SAAkB,CAAW;YAChE,KAAK,MAAM,CAACzB,MAAMU,SAAS,IAAIgB,OAAOE,OAAO,CAC1CL,IAAI,CAACE,MAAM,IAAI,CAAC,GAChB;gBACD,IAAI2B,OAAO1C,UAAUE,UAAU,CAAC,aAAa;oBAC3CmC,WAAWqC,GAAG,CAACpF;gBACjB;YACF;QACF;IACF;IACA,OAAO+C;AACT;AAQA;;;;;;;;;;CAUC,GACD,MAAMsC,uBAAuB,CAC3BC,OACAtE,SAEAsE,MAAMC,KAAK,CAAC,CAACC;QACX,IAAIA,KAAKC,OAAO,CAACnB,QAAQ,CAAC,MAAM;YAC9B,OAAO;QACT;QACA,MAAMoB,QAAQtH,OAAOoH,KAAKC,OAAO,EAAE;YAAEE,mBAAmB;QAAK;QAC7D,IAAI,CAACD,OAAO;YACV,OAAO;QACT;QACA,OAAQF,KAAKI,QAAQ;YACnB,wEAAwE;YACxE,oBAAoB;YACpB,KAAK;YACL,KAAK;gBACH,OAAOtH,UAAU0C,QAAQ,CAAC,CAAC,EAAE0E,MAAMD,OAAO,EAAE,EAAE;oBAC5CE,mBAAmB;gBACrB;YACF,+DAA+D;YAC/D,KAAK;gBACH,OAAOrH,UACL0C,QACAwE,KAAKC,OAAO,CAACxB,KAAK,CAAC,KAAK5B,MAAM,GAAG,IAC7B,CAAC,CAAC,EAAEqD,MAAMD,OAAO,EAAE,GACnB,CAAC,CAAC,EAAEC,MAAMD,OAAO,EAAE,EACvB;oBAAEE,mBAAmB;gBAAK;YAE9B,KAAK;YACL,KAAK;YACL,KAAK;YACL,KAAK;gBACH,OAAOrH,UAAU0C,QAAQ,GAAGwE,KAAKI,QAAQ,GAAGF,MAAMD,OAAO,EAAE,EAAE;oBAC3DE,mBAAmB;gBACrB;YACF,uEAAuE;YACvE,KAAK;gBACH,OAAO;YACT;gBACE,OAAO;QACX;IACF;AAEF;;;;;;;CAOC,GACD,MAAME,oBAAoB,CACxB9F,OACA+F;IAEA,MAAMC,SAAS5H,yBAAyB2H;IACxC,IAAIC,QAAQC,SAAS,iBAAiB,CAACD,OAAOE,WAAW,EAAE5D,QAAQ;QACjE,OAAOyD;IACT;IAEA,MAAM9F,OAAO+F,OAAOG,MAAM,EAAE7D,SACxB,GAAG0D,OAAO/F,IAAI,CAAC,CAAC,EAAE+F,OAAOG,MAAM,CAACrD,IAAI,CAAC,KAAK,CAAC,CAAC,GAC5CkD,OAAO/F,IAAI;IACf,MAAMgB,SAASZ,gBAAgBL,OAAOC;IACtC,IAAI,CAACgB,QAAQ;QACX,OAAO8E;IACT;IAEA,MAAMR,QAAQS,OAAOE,WAAW;IAChC,6EAA6E;IAC7E,6DAA6D;IAC7D,MAAM,CAACE,MAAM,GAAGb;IAChB,MAAMc,aACJd,MAAMjD,MAAM,KAAK,KAAM8D,CAAAA,MAAMP,QAAQ,KAAK,QAAQO,MAAMP,QAAQ,KAAK,KAAI;IAC3E,IAAIQ,cAAc,CAACxG,gBAAgBoB,QAAQmF,MAAMV,OAAO,GAAG;QACzD,OAAOK;IACT;IACA,IAAI,CAACM,cAAcf,qBAAqBC,OAAOtE,SAAS;QACtD,OAAO8E;IACT;IACA,OAAO,GAAG9F,KAAK,EAAE,EAAEgB,QAAQ;AAC7B;AAEA,wEAAwE,GACxE,MAAMqF,iBAAiB,CAAC5F,MAAYV;IAClC,MAAMkC,UAAoB,EAAE;IAE5BjE,qBAAqByC,MAAM,KAAK,CAACyB;QAC/B,IAAI,CAACA,KAAKC,QAAQ,CAAC,mBAAmB;YACpC;QACF;QAEA,IAAIgB,UAAU;QACd,MAAMmD,mBAAmB,CAACC,eACxBC,MAAMC,OAAO,CAACF,gBACVA,aAAa5D,GAAG,CAAC,CAACmD;gBAChB,IAAI,OAAOA,gBAAgB,UAAU;oBACnC,OAAOA;gBACT;gBACA,MAAMY,SAASb,kBAAkB9F,OAAO+F;gBACxC3C,YAAYuD,WAAWZ;gBACvB,OAAOY;YACT,KACAH;QAENxH,WAAW0B,MAAMyB,MAAM,CAACyE;YACtB,MAAMC,UAAUD,KAAKC,OAAO;YAC5B,IAAIA,SAAS9E,cAAc;gBACzB8E,QAAQ9E,YAAY,GAAGwE,iBAAiBM,QAAQ9E,YAAY;YAC9D;YACA,MAAM+E,SAASF,IAAI,CAAC,oBAAoB;YAGxC,KAAK,MAAMG,SAASpF,OAAOU,IAAI,CAACyE,UAAU,CAAC,GAAI;gBAC7CA,MAAO,CAACC,MAAM,GAAGR,iBAAiBO,MAAO,CAACC,MAAM;YAClD;YACA,OAAOH;QACT;QAEA,IAAIxD,SAAS;YACXlB,QAAQS,IAAI,CAACR;QACf;IACF;IAEA,OAAOD;AACT;AAEA;;;;;CAKC,GACD,MAAM8E,yBAAyB,CAACC,UAAkBC,UAAU,EAAE,GAC5D,CAAC,oCAAoC,EAAEA,QAAQ,QAAQ,CAAC,GACxD,CAAC,4CAA4C,EAAED,SAAS,YAAY,CAAC;AAEvE,+DAA+D,GAC/D,MAAME,0BAA0B,OAC9BzG,MACAyB,MACA8E;IAEA,MAAM,CAACtB,MAAM,GACX,AAAC,MAAMjH,yBACLgC,MACAyB,MACA6E,uBAAuBC,WACvB,cACI,EAAE;IACV,sDAAsD;IACtD,OAAOtB,OAAOpF,QAAQ,UAAU;AAClC;AAEA,uDAAuD,GACvD,MAAM6G,yBAAyB,OAAO1G;IACpC,MAAMwB,UAAoB,EAAE;IAC5B,MAAMmF,iBAA2B,EAAE;IAEnCpJ,qBAAqByC,MAAM,KAAK,CAACyB;QAC/B,IAAIA,KAAKC,QAAQ,CAAC,QAAQ;YACxBiF,eAAe1E,IAAI,CAACR;QACtB;IACF;IAEA,KAAK,MAAMA,QAAQkF,eAAgB;QACjC,IAAIjE,UAAU;QACd,KAAK,MAAM,CAAC6D,UAAUhG,OAAO,IAAIU,OAAOE,OAAO,CAAC1C,oBAAqB;YACnE,MAAMwB,WAAW,MAAMwG,wBAAwBzG,MAAMyB,MAAM8E;YAC3D,IAAI,CAACtG,YAAY,CAACd,gBAAgBoB,QAAQN,WAAW;gBACnD;YACF;YACAyC,UACE,AAAC,MAAM3E,YACLiC,MACAyB,MACA6E,uBAAuBC,UAAU,CAAC,iBAAiB,EAAEhG,OAAO,GAAG,CAAC,MAC5DmC;QACV;QACA,IAAIA,SAAS;YACXlB,QAAQS,IAAI,CAACR;QACf;IACF;IAEA,OAAOD;AACT;AAEA;;;;;;CAMC,GACD,MAAMoF,mBAAwD;IAC5DC,KAAK,GAAG1I,aAAa,CAAC,EAAEC,uBAAuB;IAC/C0I,WAAW,GAAG3I,aAAa,CAAC,EAAEE,sBAAsB;AACtD;AAEA;;;CAGC,GACD,OAAO,MAAM0I,qBAAqB,OAChC/G;IAEA,MAAMgH,YAAsB,EAAE;IAC9B,MAAM1H,QAAQ,MAAMT,kBAAkBmB;IAEtC,MAAMiH,eAAe1F,iBAAiBvB,MAAMV;IAC5C,MAAMyD,WAAWV,yBAAyBrC,MAAMV;IAChD,MAAMgF,YAAYF,cAAcpE,MAAMV;IACtC,MAAM4H,aAAatB,eAAe5F,MAAMV;IACxC,MAAMqH,iBAAiB,MAAMD,uBAAuB1G;IACpD,MAAMmH,iBAAiB,MAAMpI,mBAAmBiB,MAAM4G;IACtD,MAAMQ,gBAAgBnI,yBAAyBe;IAC/C,MAAMqH,gBAAgBnI,wBAAwBc;IAC9C,MAAMsH,kBAAkB,MAAMxI,qBAAqBkB,MAAMV;IACzD,MAAMN,mBAAmBgB;IAEzB,4EAA4E;IAC5E,wDAAwD;IACxD,IAAI+C,SAASnB,MAAM,GAAG,KAAKqF,aAAarF,MAAM,GAAG,KAAK0C,UAAU1C,MAAM,GAAG,GAAG;QAC1EoF,UAAU/E,IAAI,CACZ,CAAC,mDAAmD,EAAEhE,oBACpDb,qBAAqB4C,KAAKI,IAAI,GAC9B,2BAA2B,CAAC;IAElC;IACA,IACE8G,WAAWtF,MAAM,GAAG,KACpBwF,cAAcxF,MAAM,GAAG,KACvByF,cAAczF,MAAM,GAAG,GACvB;QACAoF,UAAU/E,IAAI,CACZ,CAAC,2CAA2C,EAAE;eAAI,IAAIyC,IAAI;mBAAIwC;mBAAeE;mBAAkBC;aAAc;SAAE,CAACjF,IAAI,CAAC,MAAM,oCAAoC,CAAC;IAEpK;IACA,6EAA6E;IAC7E,8DAA8D;IAC9D,IAAI+E,eAAeI,QAAQ,CAAC3F,MAAM,GAAG,GAAG;QACtCoF,UAAU/E,IAAI,CACZ,CAAC,mBAAmB,EAAE;eAAI,IAAIyC,IAAIyC,eAAeI,QAAQ;SAAE,CAACnF,IAAI,CAAC,MAAM,+EAA+E,EAAE7D,iBAAiB,QAAQ,eAAe,EAAEI,uBAAuB,QAAQ,mEAAmE,CAAC;IAEzS;IACA,IAAIgI,eAAe/E,MAAM,GAAG,GAAG;QAC7BoF,UAAU/E,IAAI,CACZ,CAAC,4CAA4C,EAAE0E,eAAe/E,MAAM,CAAC,4FAA4F,CAAC;IAEtK;IACA,gFAAgF;IAChF,+EAA+E;IAC/E,kDAAkD;IAClD,IAAI0F,gBAAgB1F,MAAM,GAAG,GAAG;QAC9BoF,UAAU/E,IAAI,CACZ,CAAC,sCAAsC,EAAEqF,gBAAgBlF,IAAI,CAAC,MAAM,0FAA0F,CAAC;IAEnK;IAEA,6EAA6E;IAC7E,MAAMlE,qBAAqB8B;IAE3B,OAAO;QAAEgH;IAAU;AACrB,EAAE"}
+{"version":3,"sources":["../../../../../../packages/nx-plugin/src/utils/version-upgrade-migration/sync-vended-versions.ts"],"sourcesContent":["/**\n * Copyright Amazon.com, Inc. or its affiliates. All Rights Reserved.\n * SPDX-License-Identifier: Apache-2.0\n */\nimport {\n  addDependenciesToPackageJson,\n  detectPackageManager,\n  type MigrationReturnObject,\n  readJson,\n  type Tree,\n  updateJson,\n  visitNotIgnoredFiles,\n} from '@nx/devkit';\nimport yaml from 'js-yaml';\nimport { getCatalogManager } from 'nx/src/utils/catalog';\nimport { parsePipRequirementsLine } from 'pip-requirements-js';\nimport { coerce, parse, satisfies, validRange } from 'semver';\nimport { applyGritQL, captureAllGritQLVariable } from '../ast.js';\nimport { buildInstallCommand } from '../commands.js';\nimport { formatFilesInSubtree } from '../format.js';\nimport {\n  PACKAGES_DIR,\n  SHARED_CONSTRUCTS_DIR,\n  SHARED_TERRAFORM_DIR,\n} from '../shared-constructs-constants.js';\nimport { updateToml } from '../toml.js';\nimport {\n  cdkLambdaRuntime,\n  PY_VERSIONS,\n  TERRAFORM_VERSIONS,\n  TS_VERSIONS,\n  terraformLambdaRuntime,\n} from '../versions.js';\nimport { isNxPackage } from './nx-package-updates.js';\nimport {\n  type OwnedDependencies,\n  ownedDependencies,\n} from './owned-dependencies.js';\nimport { syncEmbeddedVersions } from './sync-embedded-versions.js';\nimport { syncLambdaRuntimes, type VendedIac } from './sync-lambda-runtimes.js';\nimport { syncMetricsVersion } from './sync-metrics-version.js';\nimport {\n  syncProjectPythonVersion,\n  syncPythonBundleVersion,\n} from './sync-python-language-version.js';\nimport { isVendedUpgrade } from './vended-upgrade.js';\n\n/**\n * Syncs the versions a generated workspace pins to those this release vends:\n * TypeScript dependencies (including those pinned only by an override), Python\n * pins, Terraform providers, and the plugin version the metrics files report.\n *\n * nx and `@nx/*` are excluded — `packageJsonUpdates` owns them so `nx migrate`\n * collects Nx's own migrations (see `nx-package-updates.ts`).\n */\n\n/** Workspace files holding catalog definitions, and pnpm 11's overrides. */\nconst YAML_WORKSPACE_FILES = ['pnpm-workspace.yaml', '.yarnrc.yml'];\n\n/**\n * Vended version for a dependency this workspace's generators own, or undefined\n * for one the user added themselves.\n */\nconst vendedTsVersion = (\n  owned: OwnedDependencies,\n  name: string,\n): string | undefined =>\n  isNxPackage(name) || !owned.ts.has(name)\n    ? undefined\n    : TS_VERSIONS[name as keyof typeof TS_VERSIONS];\n\n/** PY_VERSIONS records the `==` operator; the pin holds the bare version. */\nconst vendedPyVersion = (\n  owned: OwnedDependencies,\n  name: string,\n): string | undefined =>\n  owned.py.has(name)\n    ? PY_VERSIONS[name as keyof typeof PY_VERSIONS]?.replace(/^==/, '')\n    : undefined;\n\n/** Protocols whose version lives elsewhere, and is synced there instead. */\nconst REFERENCE_PROTOCOL =\n  /^(?:workspace|file|link|npm|git|git\\+|github|portal|patch|exec):/;\n\n/**\n * Whether devkit may be handed this specifier.\n *\n * `catalog:` is only safe where devkit has a catalog manager (pnpm, yarn, bun).\n * Without one it rewrites the reference to a literal version, severing the\n * catalog — so those references are synced directly instead.\n */\nconst isSyncableSpecifier = (\n  tree: Tree,\n  declared: unknown,\n): declared is string => {\n  // A manifest is the user's file and may hold anything. A version that isn't a\n  // string is not one this can reason about, and throwing here would abort the\n  // whole `nx migrate` over a file the sync only meant to skip.\n  if (typeof declared !== 'string') {\n    return false;\n  }\n  if (REFERENCE_PROTOCOL.test(declared)) {\n    return false;\n  }\n  return (\n    !declared.startsWith('catalog:') || getCatalogManager(tree.root) !== null\n  );\n};\n\n/**\n * Whether the declared range already permits the vended version, following a\n * `catalog:` reference to the range it points at.\n *\n * Devkit would narrow such a range to an exact pin, discarding a user's widened\n * specifier without changing what resolves, so it is left alone.\n */\nconst alreadyPermitsVended = (\n  tree: Tree,\n  packageName: string,\n  declared: string,\n  vended: string,\n): boolean => {\n  let range = declared;\n  if (declared.startsWith('catalog:')) {\n    const resolved = getCatalogManager(tree.root)?.resolveCatalogReference(\n      tree,\n      packageName,\n      declared,\n    );\n    if (!resolved) {\n      return false;\n    }\n    range = resolved;\n  }\n  range = range.trim();\n  // An exact pin is the case to upgrade, not a range to preserve.\n  if (parse(range) !== null || validRange(range) === null) {\n    return false;\n  }\n  return satisfies(vended, range);\n};\n\n/**\n * Version the sync moves a declared TypeScript dependency to, or undefined when\n * it leaves the declaration as it is.\n *\n * Devkit then writes it only when it is higher than the declared version.\n */\nexport const syncedTsVersion = (\n  tree: Tree,\n  owned: OwnedDependencies,\n  name: string,\n  declared: unknown,\n): string | undefined => {\n  const vended = vendedTsVersion(owned, name);\n  return vended &&\n    isSyncableSpecifier(tree, declared) &&\n    !alreadyPermitsVended(tree, name, declared, vended)\n    ? vended\n    : undefined;\n};\n\n/**\n * Vended packages a manifest already declares, and the version to move each to.\n *\n * Only packages already present are named: devkit adds whatever it is given, so\n * passing the full vended list would inject all of it into every manifest.\n */\nconst declaredVendedPackages = (\n  tree: Tree,\n  owned: OwnedDependencies,\n  packageJsonPath: string,\n): {\n  dependencies: Record<string, string>;\n  devDependencies: Record<string, string>;\n} => {\n  const json = readJson(tree, packageJsonPath);\n  const pick = (field: 'dependencies' | 'devDependencies') =>\n    Object.fromEntries(\n      Object.entries((json[field] ?? {}) as Record<string, string>).flatMap(\n        ([name, declared]) => {\n          const vended = syncedTsVersion(tree, owned, name, declared);\n          return vended ? [[name, vended] as const] : [];\n        },\n      ),\n    );\n  return {\n    dependencies: pick('dependencies'),\n    devDependencies: pick('devDependencies'),\n  };\n};\n\n/**\n * Sync the TypeScript dependencies every `package.json` declares.\n *\n * Devkit does the writing: it moves a version wherever the workspace keeps it —\n * through a `catalog:` reference or directly — and refuses anything that isn't a\n * strict upgrade on what is installed.\n *\n * Called directly rather than through this plugin's wrapper, which *migrates*\n * declarations into the catalog; right when generating, wrong for a version bump.\n */\nconst syncPackageJsons = (tree: Tree, owned: OwnedDependencies): string[] => {\n  const updated: string[] = [];\n\n  visitNotIgnoredFiles(tree, '.', (path) => {\n    if (!path.endsWith('package.json')) {\n      return;\n    }\n    const { dependencies, devDependencies } = declaredVendedPackages(\n      tree,\n      owned,\n      path,\n    );\n    if (\n      Object.keys(dependencies).length === 0 &&\n      Object.keys(devDependencies).length === 0\n    ) {\n      return;\n    }\n\n    const before = tree.read(path, 'utf-8');\n    const catalogsBefore = readCatalogFiles(tree);\n    // Install callback dropped: `nx migrate` runs install itself.\n    addDependenciesToPackageJson(tree, dependencies, devDependencies, path);\n    if (\n      tree.read(path, 'utf-8') !== before ||\n      readCatalogFiles(tree) !== catalogsBefore\n    ) {\n      updated.push(path);\n    }\n  });\n\n  return updated;\n};\n\n/** Snapshot of every catalog definition file, for change detection. */\nconst readCatalogFiles = (tree: Tree): string =>\n  [...YAML_WORKSPACE_FILES, 'package.json']\n    .map((path) => (tree.exists(path) ? tree.read(path, 'utf-8') : ''))\n    .join('\\0');\n\n/**\n * Upgrade vended catalog entries devkit cannot reach: those no manifest\n * references.\n */\nconst syncOrphanCatalogEntries = (\n  tree: Tree,\n  owned: OwnedDependencies,\n): string[] => {\n  const referenced = referencedCatalogPackages(tree);\n  const updated: string[] = [];\n\n  const syncCatalog = (\n    catalog: Record<string, string> | undefined,\n  ): boolean => {\n    let changed = false;\n    for (const [name, declared] of Object.entries(catalog ?? {})) {\n      const vended = vendedTsVersion(owned, name);\n      if (!vended || referenced.has(name)) {\n        continue;\n      }\n      if (isVendedUpgrade(vended, String(declared))) {\n        catalog![name] = vended;\n        changed = true;\n      }\n    }\n    return changed;\n  };\n\n  for (const path of YAML_WORKSPACE_FILES) {\n    if (!tree.exists(path)) {\n      continue;\n    }\n    const catalogFile = (yaml.load(tree.read(path, 'utf-8') ?? '') ?? {}) as {\n      catalog?: Record<string, string>;\n      catalogs?: Record<string, Record<string, string>>;\n    };\n    const changed = [\n      syncCatalog(catalogFile.catalog),\n      ...Object.values(catalogFile.catalogs ?? {}).map(syncCatalog),\n    ].some(Boolean);\n    if (changed) {\n      tree.write(path, yaml.dump(catalogFile, { quotingType: \"'\" }));\n      updated.push(path);\n    }\n  }\n\n  // Bun keeps its catalogs in the root manifest.\n  if (tree.exists('package.json')) {\n    let changed = false;\n    updateJson(tree, 'package.json', (json) => {\n      changed = [\n        syncCatalog(json.catalog),\n        ...Object.values(\n          (json.catalogs ?? {}) as Record<string, Record<string, string>>,\n        ).map(syncCatalog),\n      ].some(Boolean);\n      return json;\n    });\n    if (changed) {\n      updated.push('package.json');\n    }\n  }\n\n  return updated;\n};\n\n/**\n * The package an override key pins, or undefined when the key names none.\n *\n * A key is a package name, optionally preceded by the path it is scoped to and\n * followed by the parent range it applies at:\n *\n *   zod                                     -> zod\n *   zod@^3                                  -> zod\n *   **&#47;@modelcontextprotocol/sdk/zod        -> zod\n *   @prisma/adapter-pg/@types/pg            -> @types/pg\n *\n * The last segment is the package, since every earlier one is a parent it is\n * scoped under — except that a scope and the name after it are one segment.\n */\nconst overriddenPackage = (key: string): string | undefined => {\n  const segments = key.split('/').reduce<string[]>((acc, part) => {\n    // A bare `@scope` is only half a name; join it to what follows.\n    const previous = acc[acc.length - 1];\n    if (previous?.startsWith('@') && !previous.includes('/')) {\n      acc[acc.length - 1] = `${previous}/${part}`;\n      return acc;\n    }\n    acc.push(part);\n    return acc;\n  }, []);\n\n  const name = segments[segments.length - 1];\n  if (!name || name === '.') {\n    return undefined;\n  }\n  // A trailing `@range` scopes the override to a parent version.\n  const at = name.lastIndexOf('@');\n  return at > 0 ? name.slice(0, at) : name;\n};\n\n/**\n * Sync the owned packages an override pins, wherever the workspace keeps them:\n * npm's `overrides`, yarn and bun's `resolutions`, and pnpm's `pnpm.overrides`\n * (10) or `pnpm-workspace.yaml` `overrides` (11).\n *\n * Devkit does not manage these fields, so an owned package pinned only here\n * would otherwise stay on the version it was generated with. Values are compared\n * with `isVendedUpgrade`, so a range the user widened is left alone.\n */\n/**\n * Where the workspace's package manager reads overrides from.\n *\n * Only the root manifest is considered: every package manager resolves overrides\n * from the workspace root, so a nested `overrides` block is inert and rewriting\n * it would imply an effect it doesn't have.\n *\n * pnpm moved the block between majors — 10 reads `pnpm.overrides` in the\n * manifest, 11 reads `overrides` in `pnpm-workspace.yaml` — so both are covered\n * rather than detecting the minor.\n */\nconst overrideLocations = (\n  tree: Tree,\n): {\n  manifestFields: readonly ('overrides' | 'resolutions' | 'pnpm.overrides')[];\n  workspaceFile?: string;\n} => {\n  switch (detectPackageManager(tree.root)) {\n    case 'npm':\n      return { manifestFields: ['overrides'] };\n    case 'yarn':\n      return { manifestFields: ['resolutions'] };\n    case 'bun':\n      // Bun reads npm's `overrides` and yarn's `resolutions` alike.\n      return { manifestFields: ['overrides', 'resolutions'] };\n    default:\n      return {\n        manifestFields: ['pnpm.overrides'],\n        workspaceFile: 'pnpm-workspace.yaml',\n      };\n  }\n};\n\nconst syncOverrides = (tree: Tree, owned: OwnedDependencies): string[] => {\n  const updated: string[] = [];\n\n  // Nested npm overrides carry the pin under `.`, with sibling keys scoping\n  // deeper, so a value may be a string or another override object.\n  const syncOverrideTree = (overrides: unknown): boolean => {\n    if (typeof overrides !== 'object' || overrides === null) {\n      return false;\n    }\n    let changed = false;\n    for (const [key, value] of Object.entries(\n      overrides as Record<string, unknown>,\n    )) {\n      if (typeof value === 'object' && value !== null) {\n        changed = syncOverrideTree(value) || changed;\n        continue;\n      }\n      if (typeof value !== 'string') {\n        continue;\n      }\n      // `.` pins the package its parent key names.\n      const name =\n        key === '.' ? undefined : (overriddenPackage(key) ?? undefined);\n      const vended = name ? vendedTsVersion(owned, name) : undefined;\n      if (vended && isVendedUpgrade(vended, value)) {\n        (overrides as Record<string, unknown>)[key] = vended;\n        changed = true;\n      }\n    }\n    return changed;\n  };\n\n  const { manifestFields, workspaceFile } = overrideLocations(tree);\n\n  if (manifestFields.length > 0) {\n    let changed = false;\n    updateJson(tree, 'package.json', (json) => {\n      changed = manifestFields\n        .map((field) =>\n          syncOverrideTree(\n            field === 'pnpm.overrides' ? json.pnpm?.overrides : json[field],\n          ),\n        )\n        .some(Boolean);\n      return json;\n    });\n    if (changed) {\n      updated.push('package.json');\n    }\n  }\n\n  if (workspaceFile && tree.exists(workspaceFile)) {\n    const contents = (yaml.load(tree.read(workspaceFile, 'utf-8') ?? '') ??\n      {}) as Record<string, unknown>;\n    if (syncOverrideTree(contents.overrides)) {\n      tree.write(workspaceFile, yaml.dump(contents, { quotingType: \"'\" }));\n      updated.push(workspaceFile);\n    }\n  }\n\n  return updated;\n};\n\n/**\n * Packages devkit already maintains through a `catalog:` reference. Empty\n * without a catalog manager, where no reference resolves.\n */\nconst referencedCatalogPackages = (tree: Tree): Set<string> => {\n  const referenced = new Set<string>();\n  if (getCatalogManager(tree.root) === null) {\n    return referenced;\n  }\n  visitNotIgnoredFiles(tree, '.', (path) => {\n    if (!path.endsWith('package.json')) {\n      return;\n    }\n    const json = readJson(tree, path);\n    for (const field of ['dependencies', 'devDependencies'] as const) {\n      for (const [name, declared] of Object.entries(\n        (json[field] ?? {}) as Record<string, string>,\n      )) {\n        if (String(declared).startsWith('catalog:')) {\n          referenced.add(name);\n        }\n      }\n    }\n  });\n  return referenced;\n};\n\n/** Pip specifier as `pip-requirements-js` reports it. */\ninterface PyVersionSpec {\n  readonly operator: string;\n  readonly version: string;\n}\n\n/**\n * Whether the declared specifiers already permit the vended version, so\n * rewriting them would discard the user's range without changing what resolves.\n *\n * This mirrors the TypeScript side: an exact pin is the case to upgrade, a range\n * that already reaches the vended version is left alone, and a range that falls\n * short is moved up.\n *\n * A `*` wildcard or a specifier semver can't read counts as already permitting,\n * so anything not understood is left as the user wrote it.\n */\nconst pyRangePermitsVended = (\n  specs: readonly PyVersionSpec[],\n  vended: string,\n): boolean =>\n  specs.every((spec) => {\n    if (spec.version.includes('*')) {\n      return true;\n    }\n    const bound = coerce(spec.version, { includePrerelease: true });\n    if (!bound) {\n      return true;\n    }\n    switch (spec.operator) {\n      // An exact pin permits only itself, so a differing vended version is an\n      // upgrade to apply.\n      case '==':\n      case '===':\n        return satisfies(vended, `=${bound.version}`, {\n          includePrerelease: true,\n        });\n      // `~=1.2.3` allows the patch series; `~=1.2` the minor series.\n      case '~=':\n        return satisfies(\n          vended,\n          spec.version.split('.').length > 2\n            ? `~${bound.version}`\n            : `^${bound.version}`,\n          { includePrerelease: true },\n        );\n      case '>=':\n      case '>':\n      case '<=':\n      case '<':\n        return satisfies(vended, `${spec.operator}${bound.version}`, {\n          includePrerelease: true,\n        });\n      // `!=` only excludes, so it never blocks the vended version by itself.\n      case '!=':\n        return true;\n      default:\n        return true;\n    }\n  });\n\n/**\n * Upgrade a pip requirement to the vended version, or return it unchanged.\n *\n * Parsed rather than pattern-matched so extras and operators are read the way\n * `uv` reads them. A requirement whose specifiers already permit the vended\n * version keeps them; one that falls short is replaced with an exact pin, which\n * is what the generators write.\n */\nconst syncPyRequirement = (\n  owned: OwnedDependencies,\n  requirement: string,\n): string => {\n  const parsed = parsePipRequirementsLine(requirement);\n  if (parsed?.type !== 'ProjectName' || !parsed.versionSpec?.length) {\n    return requirement;\n  }\n\n  const name = parsed.extras?.length\n    ? `${parsed.name}[${parsed.extras.join(',')}]`\n    : parsed.name;\n  const vended = vendedPyVersion(owned, name);\n  if (!vended) {\n    return requirement;\n  }\n\n  const specs = parsed.versionSpec as readonly PyVersionSpec[];\n  // Never move a version backwards: a pin above what this release vends is the\n  // user's, and a range already reaching it is theirs to keep.\n  const [first] = specs;\n  const isExactPin =\n    specs.length === 1 && (first.operator === '==' || first.operator === '===');\n  if (isExactPin && !isVendedUpgrade(vended, first.version)) {\n    return requirement;\n  }\n  if (!isExactPin && pyRangePermitsVended(specs, vended)) {\n    return requirement;\n  }\n  return `${name}==${vended}`;\n};\n\n/** Sync pins in every `pyproject.toml`, dependencies and groups alike. */\nconst syncPyProjects = (tree: Tree, owned: OwnedDependencies): string[] => {\n  const updated: string[] = [];\n\n  visitNotIgnoredFiles(tree, '.', (path) => {\n    if (!path.endsWith('pyproject.toml')) {\n      return;\n    }\n\n    let changed = false;\n    const syncRequirements = (requirements: unknown): unknown =>\n      Array.isArray(requirements)\n        ? requirements.map((requirement) => {\n            if (typeof requirement !== 'string') {\n              return requirement;\n            }\n            const synced = syncPyRequirement(owned, requirement);\n            changed ||= synced !== requirement;\n            return synced;\n          })\n        : requirements;\n\n    updateToml(tree, path, (toml) => {\n      const project = toml.project as Record<string, unknown> | undefined;\n      if (project?.dependencies) {\n        project.dependencies = syncRequirements(project.dependencies) as never;\n      }\n      const groups = toml['dependency-groups'] as\n        | Record<string, unknown>\n        | undefined;\n      for (const group of Object.keys(groups ?? {})) {\n        groups![group] = syncRequirements(groups![group]) as never;\n      }\n      return toml;\n    });\n\n    if (changed) {\n      updated.push(path);\n    }\n  });\n\n  return updated;\n};\n\n/**\n * GritQL matching one provider's `version` in `required_providers`, scoped by\n * the sibling `source` so an alias or another provider's version can't match.\n *\n * `language hcl` is required — without it the pattern silently matches nothing.\n */\nconst providerVersionPattern = (provider: string, rewrite = ''): string =>\n  `language hcl\\n\\`version = $version\\`${rewrite} where {` +\n  ` $version <: within \\`{ source = \"hashicorp/${provider}\" $... }\\` }`;\n\n/** Version a provider currently declares, if it declares one. */\nconst declaredProviderVersion = async (\n  tree: Tree,\n  path: string,\n  provider: string,\n): Promise<string | undefined> => {\n  const [bound] =\n    (await captureAllGritQLVariable(\n      tree,\n      path,\n      providerVersionPattern(provider),\n      'version',\n    )) ?? [];\n  // The binding is the quoted version, e.g. `\"6.40.0\"`.\n  return bound?.replace(/^\"|\"$/g, '');\n};\n\n/** Sync vended provider versions in every `.tf` file. */\nconst syncTerraformProviders = async (tree: Tree): Promise<string[]> => {\n  const updated: string[] = [];\n  const terraformFiles: string[] = [];\n\n  visitNotIgnoredFiles(tree, '.', (path) => {\n    if (path.endsWith('.tf')) {\n      terraformFiles.push(path);\n    }\n  });\n\n  for (const path of terraformFiles) {\n    let changed = false;\n    for (const [provider, vended] of Object.entries(TERRAFORM_VERSIONS)) {\n      const declared = await declaredProviderVersion(tree, path, provider);\n      if (!declared || !isVendedUpgrade(vended, declared)) {\n        continue;\n      }\n      changed =\n        (await applyGritQL(\n          tree,\n          path,\n          providerVersionPattern(provider, ` => \\`version = \"${vended}\"\\``),\n        )) || changed;\n    }\n    if (changed) {\n      updated.push(path);\n    }\n  }\n\n  return updated;\n};\n\n/**\n * The projects this plugin generates infrastructure into, per provider.\n *\n * A runtime is not a dependency, so there is no per-package ownership to consult —\n * these directories are the scope. A Lambda a user defined in their own project\n * keeps whatever runtime they chose, even though it is the same shape.\n */\nconst OWNED_INFRA_DIRS: Readonly<Record<VendedIac, string>> = {\n  cdk: `${PACKAGES_DIR}/${SHARED_CONSTRUCTS_DIR}`,\n  terraform: `${PACKAGES_DIR}/${SHARED_TERRAFORM_DIR}`,\n};\n\n/**\n * Sync the versions this release vends, for the dependencies the workspace's\n * generators own.\n */\nexport const syncVendedVersions = async (\n  tree: Tree,\n): Promise<MigrationReturnObject> => {\n  const nextSteps: string[] = [];\n  const owned = await ownedDependencies(tree);\n\n  const packageJsons = syncPackageJsons(tree, owned);\n  const catalogs = syncOrphanCatalogEntries(tree, owned);\n  const overrides = syncOverrides(tree, owned);\n  const pyProjects = syncPyProjects(tree, owned);\n  const terraformFiles = await syncTerraformProviders(tree);\n  const lambdaRuntimes = await syncLambdaRuntimes(tree, OWNED_INFRA_DIRS);\n  const projectPython = syncProjectPythonVersion(tree);\n  const pythonBundles = syncPythonBundleVersion(tree);\n  const skippedEmbedded = await syncEmbeddedVersions(tree, owned);\n  await syncMetricsVersion(tree);\n\n  // Lock files are left to the user: `nx migrate` only installs when the root\n  // manifest changes, and never runs `uv` or `terraform`.\n  if (catalogs.length > 0 || packageJsons.length > 0 || overrides.length > 0) {\n    nextSteps.push(\n      `TypeScript dependency versions were updated. Run \\`${buildInstallCommand(\n        detectPackageManager(tree.root),\n      )}\\` to update the lock file.`,\n    );\n  }\n  if (\n    pyProjects.length > 0 ||\n    projectPython.length > 0 ||\n    pythonBundles.length > 0\n  ) {\n    nextSteps.push(\n      `Python dependency versions were updated in ${[...new Set([...pyProjects, ...projectPython, ...pythonBundles])].join(', ')}. Run \\`uv sync\\` to update uv.lock.`,\n    );\n  }\n  // A runtime the sync recognised is simply moved; one it doesn't recognise is\n  // the user's choice, so it is reported rather than rewritten.\n  if (lambdaRuntimes.diverged.length > 0) {\n    nextSteps.push(\n      `Lambda runtimes in ${[...new Set(lambdaRuntimes.diverged)].join(', ')} have diverged from the generated shape and were left untouched. Set them to \\`${cdkLambdaRuntime('node')}\\` (CDK) or \\`\"${terraformLambdaRuntime('node')}\"\\` (Terraform) if you want them on the runtime this release vends.`,\n    );\n  }\n  if (terraformFiles.length > 0) {\n    nextSteps.push(\n      `Terraform provider versions were updated in ${terraformFiles.length} file(s). Run \\`terraform init -upgrade\\` in each Terraform project to update its lock file.`,\n    );\n  }\n  // A synced embedded pin needs no next step — it is read the next time the thing\n  // holding it runs. A file the sync left alone does: its versions are still the\n  // old ones, and only the user can reconcile that.\n  if (skippedEmbedded.length > 0) {\n    nextSteps.push(\n      `Version pins were left as they are in ${skippedEmbedded.join(', ')}, which repeat a pin more times than this migration rewrites at once. Update them by hand.`,\n    );\n  }\n\n  // Without this the workspace's own format check fails on the migrated files.\n  await formatFilesInSubtree(tree);\n\n  return { nextSteps };\n};\n"],"names":["addDependenciesToPackageJson","detectPackageManager","readJson","updateJson","visitNotIgnoredFiles","yaml","getCatalogManager","parsePipRequirementsLine","coerce","parse","satisfies","validRange","applyGritQL","captureAllGritQLVariable","buildInstallCommand","formatFilesInSubtree","PACKAGES_DIR","SHARED_CONSTRUCTS_DIR","SHARED_TERRAFORM_DIR","updateToml","cdkLambdaRuntime","PY_VERSIONS","TERRAFORM_VERSIONS","TS_VERSIONS","terraformLambdaRuntime","isNxPackage","ownedDependencies","syncEmbeddedVersions","syncLambdaRuntimes","syncMetricsVersion","syncProjectPythonVersion","syncPythonBundleVersion","isVendedUpgrade","YAML_WORKSPACE_FILES","vendedTsVersion","owned","name","ts","has","undefined","vendedPyVersion","py","replace","REFERENCE_PROTOCOL","isSyncableSpecifier","tree","declared","test","startsWith","root","alreadyPermitsVended","packageName","vended","range","resolved","resolveCatalogReference","trim","syncedTsVersion","declaredVendedPackages","packageJsonPath","json","pick","field","Object","fromEntries","entries","flatMap","dependencies","devDependencies","syncPackageJsons","updated","path","endsWith","keys","length","before","read","catalogsBefore","readCatalogFiles","push","map","exists","join","syncOrphanCatalogEntries","referenced","referencedCatalogPackages","syncCatalog","catalog","changed","String","catalogFile","load","values","catalogs","some","Boolean","write","dump","quotingType","overriddenPackage","key","segments","split","reduce","acc","part","previous","includes","at","lastIndexOf","slice","overrideLocations","manifestFields","workspaceFile","syncOverrides","syncOverrideTree","overrides","value","pnpm","contents","Set","add","pyRangePermitsVended","specs","every","spec","version","bound","includePrerelease","operator","syncPyRequirement","requirement","parsed","type","versionSpec","extras","first","isExactPin","syncPyProjects","syncRequirements","requirements","Array","isArray","synced","toml","project","groups","group","providerVersionPattern","provider","rewrite","declaredProviderVersion","syncTerraformProviders","terraformFiles","OWNED_INFRA_DIRS","cdk","terraform","syncVendedVersions","nextSteps","packageJsons","pyProjects","lambdaRuntimes","projectPython","pythonBundles","skippedEmbedded","diverged"],"mappings":"AAAA;;;CAGC,GACD,SACEA,4BAA4B,EAC5BC,oBAAoB,EAEpBC,QAAQ,EAERC,UAAU,EACVC,oBAAoB,QACf,aAAa;AACpB,OAAOC,UAAU,UAAU;AAC3B,SAASC,iBAAiB,QAAQ,uBAAuB;AACzD,SAASC,wBAAwB,QAAQ,sBAAsB;AAC/D,SAASC,MAAM,EAAEC,KAAK,EAAEC,SAAS,EAAEC,UAAU,QAAQ,SAAS;AAC9D,SAASC,WAAW,EAAEC,wBAAwB,QAAQ,YAAY;AAClE,SAASC,mBAAmB,QAAQ,iBAAiB;AACrD,SAASC,oBAAoB,QAAQ,eAAe;AACpD,SACEC,YAAY,EACZC,qBAAqB,EACrBC,oBAAoB,QACf,oCAAoC;AAC3C,SAASC,UAAU,QAAQ,aAAa;AACxC,SACEC,gBAAgB,EAChBC,WAAW,EACXC,kBAAkB,EAClBC,WAAW,EACXC,sBAAsB,QACjB,iBAAiB;AACxB,SAASC,WAAW,QAAQ,0BAA0B;AACtD,SAEEC,iBAAiB,QACZ,0BAA0B;AACjC,SAASC,oBAAoB,QAAQ,8BAA8B;AACnE,SAASC,kBAAkB,QAAwB,4BAA4B;AAC/E,SAASC,kBAAkB,QAAQ,4BAA4B;AAC/D,SACEC,wBAAwB,EACxBC,uBAAuB,QAClB,oCAAoC;AAC3C,SAASC,eAAe,QAAQ,sBAAsB;AAEtD;;;;;;;CAOC,GAED,0EAA0E,GAC1E,MAAMC,uBAAuB;IAAC;IAAuB;CAAc;AAEnE;;;CAGC,GACD,MAAMC,kBAAkB,CACtBC,OACAC,OAEAX,YAAYW,SAAS,CAACD,MAAME,EAAE,CAACC,GAAG,CAACF,QAC/BG,YACAhB,WAAW,CAACa,KAAiC;AAEnD,2EAA2E,GAC3E,MAAMI,kBAAkB,CACtBL,OACAC,OAEAD,MAAMM,EAAE,CAACH,GAAG,CAACF,QACTf,WAAW,CAACe,KAAiC,EAAEM,QAAQ,OAAO,MAC9DH;AAEN,0EAA0E,GAC1E,MAAMI,qBACJ;AAEF;;;;;;CAMC,GACD,MAAMC,sBAAsB,CAC1BC,MACAC;IAEA,8EAA8E;IAC9E,6EAA6E;IAC7E,8DAA8D;IAC9D,IAAI,OAAOA,aAAa,UAAU;QAChC,OAAO;IACT;IACA,IAAIH,mBAAmBI,IAAI,CAACD,WAAW;QACrC,OAAO;IACT;IACA,OACE,CAACA,SAASE,UAAU,CAAC,eAAe1C,kBAAkBuC,KAAKI,IAAI,MAAM;AAEzE;AAEA;;;;;;CAMC,GACD,MAAMC,uBAAuB,CAC3BL,MACAM,aACAL,UACAM;IAEA,IAAIC,QAAQP;IACZ,IAAIA,SAASE,UAAU,CAAC,aAAa;QACnC,MAAMM,WAAWhD,kBAAkBuC,KAAKI,IAAI,GAAGM,wBAC7CV,MACAM,aACAL;QAEF,IAAI,CAACQ,UAAU;YACb,OAAO;QACT;QACAD,QAAQC;IACV;IACAD,QAAQA,MAAMG,IAAI;IAClB,gEAAgE;IAChE,IAAI/C,MAAM4C,WAAW,QAAQ1C,WAAW0C,WAAW,MAAM;QACvD,OAAO;IACT;IACA,OAAO3C,UAAU0C,QAAQC;AAC3B;AAEA;;;;;CAKC,GACD,OAAO,MAAMI,kBAAkB,CAC7BZ,MACAV,OACAC,MACAU;IAEA,MAAMM,SAASlB,gBAAgBC,OAAOC;IACtC,OAAOgB,UACLR,oBAAoBC,MAAMC,aAC1B,CAACI,qBAAqBL,MAAMT,MAAMU,UAAUM,UAC1CA,SACAb;AACN,EAAE;AAEF;;;;;CAKC,GACD,MAAMmB,yBAAyB,CAC7Bb,MACAV,OACAwB;IAKA,MAAMC,OAAO1D,SAAS2C,MAAMc;IAC5B,MAAME,OAAO,CAACC,QACZC,OAAOC,WAAW,CAChBD,OAAOE,OAAO,CAAEL,IAAI,CAACE,MAAM,IAAI,CAAC,GAA8BI,OAAO,CACnE,CAAC,CAAC9B,MAAMU,SAAS;YACf,MAAMM,SAASK,gBAAgBZ,MAAMV,OAAOC,MAAMU;YAClD,OAAOM,SAAS;gBAAC;oBAAChB;oBAAMgB;iBAAO;aAAU,GAAG,EAAE;QAChD;IAGN,OAAO;QACLe,cAAcN,KAAK;QACnBO,iBAAiBP,KAAK;IACxB;AACF;AAEA;;;;;;;;;CASC,GACD,MAAMQ,mBAAmB,CAACxB,MAAYV;IACpC,MAAMmC,UAAoB,EAAE;IAE5BlE,qBAAqByC,MAAM,KAAK,CAAC0B;QAC/B,IAAI,CAACA,KAAKC,QAAQ,CAAC,iBAAiB;YAClC;QACF;QACA,MAAM,EAAEL,YAAY,EAAEC,eAAe,EAAE,GAAGV,uBACxCb,MACAV,OACAoC;QAEF,IACER,OAAOU,IAAI,CAACN,cAAcO,MAAM,KAAK,KACrCX,OAAOU,IAAI,CAACL,iBAAiBM,MAAM,KAAK,GACxC;YACA;QACF;QAEA,MAAMC,SAAS9B,KAAK+B,IAAI,CAACL,MAAM;QAC/B,MAAMM,iBAAiBC,iBAAiBjC;QACxC,8DAA8D;QAC9D7C,6BAA6B6C,MAAMsB,cAAcC,iBAAiBG;QAClE,IACE1B,KAAK+B,IAAI,CAACL,MAAM,aAAaI,UAC7BG,iBAAiBjC,UAAUgC,gBAC3B;YACAP,QAAQS,IAAI,CAACR;QACf;IACF;IAEA,OAAOD;AACT;AAEA,qEAAqE,GACrE,MAAMQ,mBAAmB,CAACjC,OACxB;WAAIZ;QAAsB;KAAe,CACtC+C,GAAG,CAAC,CAACT,OAAU1B,KAAKoC,MAAM,CAACV,QAAQ1B,KAAK+B,IAAI,CAACL,MAAM,WAAW,IAC9DW,IAAI,CAAC;AAEV;;;CAGC,GACD,MAAMC,2BAA2B,CAC/BtC,MACAV;IAEA,MAAMiD,aAAaC,0BAA0BxC;IAC7C,MAAMyB,UAAoB,EAAE;IAE5B,MAAMgB,cAAc,CAClBC;QAEA,IAAIC,UAAU;QACd,KAAK,MAAM,CAACpD,MAAMU,SAAS,IAAIiB,OAAOE,OAAO,CAACsB,WAAW,CAAC,GAAI;YAC5D,MAAMnC,SAASlB,gBAAgBC,OAAOC;YACtC,IAAI,CAACgB,UAAUgC,WAAW9C,GAAG,CAACF,OAAO;gBACnC;YACF;YACA,IAAIJ,gBAAgBoB,QAAQqC,OAAO3C,YAAY;gBAC7CyC,OAAQ,CAACnD,KAAK,GAAGgB;gBACjBoC,UAAU;YACZ;QACF;QACA,OAAOA;IACT;IAEA,KAAK,MAAMjB,QAAQtC,qBAAsB;QACvC,IAAI,CAACY,KAAKoC,MAAM,CAACV,OAAO;YACtB;QACF;QACA,MAAMmB,cAAerF,KAAKsF,IAAI,CAAC9C,KAAK+B,IAAI,CAACL,MAAM,YAAY,OAAO,CAAC;QAInE,MAAMiB,UAAU;YACdF,YAAYI,YAAYH,OAAO;eAC5BxB,OAAO6B,MAAM,CAACF,YAAYG,QAAQ,IAAI,CAAC,GAAGb,GAAG,CAACM;SAClD,CAACQ,IAAI,CAACC;QACP,IAAIP,SAAS;YACX3C,KAAKmD,KAAK,CAACzB,MAAMlE,KAAK4F,IAAI,CAACP,aAAa;gBAAEQ,aAAa;YAAI;YAC3D5B,QAAQS,IAAI,CAACR;QACf;IACF;IAEA,+CAA+C;IAC/C,IAAI1B,KAAKoC,MAAM,CAAC,iBAAiB;QAC/B,IAAIO,UAAU;QACdrF,WAAW0C,MAAM,gBAAgB,CAACe;YAChC4B,UAAU;gBACRF,YAAY1B,KAAK2B,OAAO;mBACrBxB,OAAO6B,MAAM,CACbhC,KAAKiC,QAAQ,IAAI,CAAC,GACnBb,GAAG,CAACM;aACP,CAACQ,IAAI,CAACC;YACP,OAAOnC;QACT;QACA,IAAI4B,SAAS;YACXlB,QAAQS,IAAI,CAAC;QACf;IACF;IAEA,OAAOT;AACT;AAEA;;;;;;;;;;;;;CAaC,GACD,MAAM6B,oBAAoB,CAACC;IACzB,MAAMC,WAAWD,IAAIE,KAAK,CAAC,KAAKC,MAAM,CAAW,CAACC,KAAKC;QACrD,gEAAgE;QAChE,MAAMC,WAAWF,GAAG,CAACA,IAAI9B,MAAM,GAAG,EAAE;QACpC,IAAIgC,UAAU1D,WAAW,QAAQ,CAAC0D,SAASC,QAAQ,CAAC,MAAM;YACxDH,GAAG,CAACA,IAAI9B,MAAM,GAAG,EAAE,GAAG,GAAGgC,SAAS,CAAC,EAAED,MAAM;YAC3C,OAAOD;QACT;QACAA,IAAIzB,IAAI,CAAC0B;QACT,OAAOD;IACT,GAAG,EAAE;IAEL,MAAMpE,OAAOiE,QAAQ,CAACA,SAAS3B,MAAM,GAAG,EAAE;IAC1C,IAAI,CAACtC,QAAQA,SAAS,KAAK;QACzB,OAAOG;IACT;IACA,+DAA+D;IAC/D,MAAMqE,KAAKxE,KAAKyE,WAAW,CAAC;IAC5B,OAAOD,KAAK,IAAIxE,KAAK0E,KAAK,CAAC,GAAGF,MAAMxE;AACtC;AAEA;;;;;;;;CAQC,GACD;;;;;;;;;;CAUC,GACD,MAAM2E,oBAAoB,CACxBlE;IAKA,OAAQ5C,qBAAqB4C,KAAKI,IAAI;QACpC,KAAK;YACH,OAAO;gBAAE+D,gBAAgB;oBAAC;iBAAY;YAAC;QACzC,KAAK;YACH,OAAO;gBAAEA,gBAAgB;oBAAC;iBAAc;YAAC;QAC3C,KAAK;YACH,8DAA8D;YAC9D,OAAO;gBAAEA,gBAAgB;oBAAC;oBAAa;iBAAc;YAAC;QACxD;YACE,OAAO;gBACLA,gBAAgB;oBAAC;iBAAiB;gBAClCC,eAAe;YACjB;IACJ;AACF;AAEA,MAAMC,gBAAgB,CAACrE,MAAYV;IACjC,MAAMmC,UAAoB,EAAE;IAE5B,0EAA0E;IAC1E,iEAAiE;IACjE,MAAM6C,mBAAmB,CAACC;QACxB,IAAI,OAAOA,cAAc,YAAYA,cAAc,MAAM;YACvD,OAAO;QACT;QACA,IAAI5B,UAAU;QACd,KAAK,MAAM,CAACY,KAAKiB,MAAM,IAAItD,OAAOE,OAAO,CACvCmD,WACC;YACD,IAAI,OAAOC,UAAU,YAAYA,UAAU,MAAM;gBAC/C7B,UAAU2B,iBAAiBE,UAAU7B;gBACrC;YACF;YACA,IAAI,OAAO6B,UAAU,UAAU;gBAC7B;YACF;YACA,6CAA6C;YAC7C,MAAMjF,OACJgE,QAAQ,MAAM7D,YAAa4D,kBAAkBC,QAAQ7D;YACvD,MAAMa,SAAShB,OAAOF,gBAAgBC,OAAOC,QAAQG;YACrD,IAAIa,UAAUpB,gBAAgBoB,QAAQiE,QAAQ;gBAC3CD,SAAqC,CAAChB,IAAI,GAAGhD;gBAC9CoC,UAAU;YACZ;QACF;QACA,OAAOA;IACT;IAEA,MAAM,EAAEwB,cAAc,EAAEC,aAAa,EAAE,GAAGF,kBAAkBlE;IAE5D,IAAImE,eAAetC,MAAM,GAAG,GAAG;QAC7B,IAAIc,UAAU;QACdrF,WAAW0C,MAAM,gBAAgB,CAACe;YAChC4B,UAAUwB,eACPhC,GAAG,CAAC,CAAClB,QACJqD,iBACErD,UAAU,mBAAmBF,KAAK0D,IAAI,EAAEF,YAAYxD,IAAI,CAACE,MAAM,GAGlEgC,IAAI,CAACC;YACR,OAAOnC;QACT;QACA,IAAI4B,SAAS;YACXlB,QAAQS,IAAI,CAAC;QACf;IACF;IAEA,IAAIkC,iBAAiBpE,KAAKoC,MAAM,CAACgC,gBAAgB;QAC/C,MAAMM,WAAYlH,KAAKsF,IAAI,CAAC9C,KAAK+B,IAAI,CAACqC,eAAe,YAAY,OAC/D,CAAC;QACH,IAAIE,iBAAiBI,SAASH,SAAS,GAAG;YACxCvE,KAAKmD,KAAK,CAACiB,eAAe5G,KAAK4F,IAAI,CAACsB,UAAU;gBAAErB,aAAa;YAAI;YACjE5B,QAAQS,IAAI,CAACkC;QACf;IACF;IAEA,OAAO3C;AACT;AAEA;;;CAGC,GACD,MAAMe,4BAA4B,CAACxC;IACjC,MAAMuC,aAAa,IAAIoC;IACvB,IAAIlH,kBAAkBuC,KAAKI,IAAI,MAAM,MAAM;QACzC,OAAOmC;IACT;IACAhF,qBAAqByC,MAAM,KAAK,CAAC0B;QAC/B,IAAI,CAACA,KAAKC,QAAQ,CAAC,iBAAiB;YAClC;QACF;QACA,MAAMZ,OAAO1D,SAAS2C,MAAM0B;QAC5B,KAAK,MAAMT,SAAS;YAAC;YAAgB;SAAkB,CAAW;YAChE,KAAK,MAAM,CAAC1B,MAAMU,SAAS,IAAIiB,OAAOE,OAAO,CAC1CL,IAAI,CAACE,MAAM,IAAI,CAAC,GAChB;gBACD,IAAI2B,OAAO3C,UAAUE,UAAU,CAAC,aAAa;oBAC3CoC,WAAWqC,GAAG,CAACrF;gBACjB;YACF;QACF;IACF;IACA,OAAOgD;AACT;AAQA;;;;;;;;;;CAUC,GACD,MAAMsC,uBAAuB,CAC3BC,OACAvE,SAEAuE,MAAMC,KAAK,CAAC,CAACC;QACX,IAAIA,KAAKC,OAAO,CAACnB,QAAQ,CAAC,MAAM;YAC9B,OAAO;QACT;QACA,MAAMoB,QAAQvH,OAAOqH,KAAKC,OAAO,EAAE;YAAEE,mBAAmB;QAAK;QAC7D,IAAI,CAACD,OAAO;YACV,OAAO;QACT;QACA,OAAQF,KAAKI,QAAQ;YACnB,wEAAwE;YACxE,oBAAoB;YACpB,KAAK;YACL,KAAK;gBACH,OAAOvH,UAAU0C,QAAQ,CAAC,CAAC,EAAE2E,MAAMD,OAAO,EAAE,EAAE;oBAC5CE,mBAAmB;gBACrB;YACF,+DAA+D;YAC/D,KAAK;gBACH,OAAOtH,UACL0C,QACAyE,KAAKC,OAAO,CAACxB,KAAK,CAAC,KAAK5B,MAAM,GAAG,IAC7B,CAAC,CAAC,EAAEqD,MAAMD,OAAO,EAAE,GACnB,CAAC,CAAC,EAAEC,MAAMD,OAAO,EAAE,EACvB;oBAAEE,mBAAmB;gBAAK;YAE9B,KAAK;YACL,KAAK;YACL,KAAK;YACL,KAAK;gBACH,OAAOtH,UAAU0C,QAAQ,GAAGyE,KAAKI,QAAQ,GAAGF,MAAMD,OAAO,EAAE,EAAE;oBAC3DE,mBAAmB;gBACrB;YACF,uEAAuE;YACvE,KAAK;gBACH,OAAO;YACT;gBACE,OAAO;QACX;IACF;AAEF;;;;;;;CAOC,GACD,MAAME,oBAAoB,CACxB/F,OACAgG;IAEA,MAAMC,SAAS7H,yBAAyB4H;IACxC,IAAIC,QAAQC,SAAS,iBAAiB,CAACD,OAAOE,WAAW,EAAE5D,QAAQ;QACjE,OAAOyD;IACT;IAEA,MAAM/F,OAAOgG,OAAOG,MAAM,EAAE7D,SACxB,GAAG0D,OAAOhG,IAAI,CAAC,CAAC,EAAEgG,OAAOG,MAAM,CAACrD,IAAI,CAAC,KAAK,CAAC,CAAC,GAC5CkD,OAAOhG,IAAI;IACf,MAAMgB,SAASZ,gBAAgBL,OAAOC;IACtC,IAAI,CAACgB,QAAQ;QACX,OAAO+E;IACT;IAEA,MAAMR,QAAQS,OAAOE,WAAW;IAChC,6EAA6E;IAC7E,6DAA6D;IAC7D,MAAM,CAACE,MAAM,GAAGb;IAChB,MAAMc,aACJd,MAAMjD,MAAM,KAAK,KAAM8D,CAAAA,MAAMP,QAAQ,KAAK,QAAQO,MAAMP,QAAQ,KAAK,KAAI;IAC3E,IAAIQ,cAAc,CAACzG,gBAAgBoB,QAAQoF,MAAMV,OAAO,GAAG;QACzD,OAAOK;IACT;IACA,IAAI,CAACM,cAAcf,qBAAqBC,OAAOvE,SAAS;QACtD,OAAO+E;IACT;IACA,OAAO,GAAG/F,KAAK,EAAE,EAAEgB,QAAQ;AAC7B;AAEA,wEAAwE,GACxE,MAAMsF,iBAAiB,CAAC7F,MAAYV;IAClC,MAAMmC,UAAoB,EAAE;IAE5BlE,qBAAqByC,MAAM,KAAK,CAAC0B;QAC/B,IAAI,CAACA,KAAKC,QAAQ,CAAC,mBAAmB;YACpC;QACF;QAEA,IAAIgB,UAAU;QACd,MAAMmD,mBAAmB,CAACC,eACxBC,MAAMC,OAAO,CAACF,gBACVA,aAAa5D,GAAG,CAAC,CAACmD;gBAChB,IAAI,OAAOA,gBAAgB,UAAU;oBACnC,OAAOA;gBACT;gBACA,MAAMY,SAASb,kBAAkB/F,OAAOgG;gBACxC3C,YAAYuD,WAAWZ;gBACvB,OAAOY;YACT,KACAH;QAENzH,WAAW0B,MAAM0B,MAAM,CAACyE;YACtB,MAAMC,UAAUD,KAAKC,OAAO;YAC5B,IAAIA,SAAS9E,cAAc;gBACzB8E,QAAQ9E,YAAY,GAAGwE,iBAAiBM,QAAQ9E,YAAY;YAC9D;YACA,MAAM+E,SAASF,IAAI,CAAC,oBAAoB;YAGxC,KAAK,MAAMG,SAASpF,OAAOU,IAAI,CAACyE,UAAU,CAAC,GAAI;gBAC7CA,MAAO,CAACC,MAAM,GAAGR,iBAAiBO,MAAO,CAACC,MAAM;YAClD;YACA,OAAOH;QACT;QAEA,IAAIxD,SAAS;YACXlB,QAAQS,IAAI,CAACR;QACf;IACF;IAEA,OAAOD;AACT;AAEA;;;;;CAKC,GACD,MAAM8E,yBAAyB,CAACC,UAAkBC,UAAU,EAAE,GAC5D,CAAC,oCAAoC,EAAEA,QAAQ,QAAQ,CAAC,GACxD,CAAC,4CAA4C,EAAED,SAAS,YAAY,CAAC;AAEvE,+DAA+D,GAC/D,MAAME,0BAA0B,OAC9B1G,MACA0B,MACA8E;IAEA,MAAM,CAACtB,MAAM,GACX,AAAC,MAAMlH,yBACLgC,MACA0B,MACA6E,uBAAuBC,WACvB,cACI,EAAE;IACV,sDAAsD;IACtD,OAAOtB,OAAOrF,QAAQ,UAAU;AAClC;AAEA,uDAAuD,GACvD,MAAM8G,yBAAyB,OAAO3G;IACpC,MAAMyB,UAAoB,EAAE;IAC5B,MAAMmF,iBAA2B,EAAE;IAEnCrJ,qBAAqByC,MAAM,KAAK,CAAC0B;QAC/B,IAAIA,KAAKC,QAAQ,CAAC,QAAQ;YACxBiF,eAAe1E,IAAI,CAACR;QACtB;IACF;IAEA,KAAK,MAAMA,QAAQkF,eAAgB;QACjC,IAAIjE,UAAU;QACd,KAAK,MAAM,CAAC6D,UAAUjG,OAAO,IAAIW,OAAOE,OAAO,CAAC3C,oBAAqB;YACnE,MAAMwB,WAAW,MAAMyG,wBAAwB1G,MAAM0B,MAAM8E;YAC3D,IAAI,CAACvG,YAAY,CAACd,gBAAgBoB,QAAQN,WAAW;gBACnD;YACF;YACA0C,UACE,AAAC,MAAM5E,YACLiC,MACA0B,MACA6E,uBAAuBC,UAAU,CAAC,iBAAiB,EAAEjG,OAAO,GAAG,CAAC,MAC5DoC;QACV;QACA,IAAIA,SAAS;YACXlB,QAAQS,IAAI,CAACR;QACf;IACF;IAEA,OAAOD;AACT;AAEA;;;;;;CAMC,GACD,MAAMoF,mBAAwD;IAC5DC,KAAK,GAAG3I,aAAa,CAAC,EAAEC,uBAAuB;IAC/C2I,WAAW,GAAG5I,aAAa,CAAC,EAAEE,sBAAsB;AACtD;AAEA;;;CAGC,GACD,OAAO,MAAM2I,qBAAqB,OAChChH;IAEA,MAAMiH,YAAsB,EAAE;IAC9B,MAAM3H,QAAQ,MAAMT,kBAAkBmB;IAEtC,MAAMkH,eAAe1F,iBAAiBxB,MAAMV;IAC5C,MAAM0D,WAAWV,yBAAyBtC,MAAMV;IAChD,MAAMiF,YAAYF,cAAcrE,MAAMV;IACtC,MAAM6H,aAAatB,eAAe7F,MAAMV;IACxC,MAAMsH,iBAAiB,MAAMD,uBAAuB3G;IACpD,MAAMoH,iBAAiB,MAAMrI,mBAAmBiB,MAAM6G;IACtD,MAAMQ,gBAAgBpI,yBAAyBe;IAC/C,MAAMsH,gBAAgBpI,wBAAwBc;IAC9C,MAAMuH,kBAAkB,MAAMzI,qBAAqBkB,MAAMV;IACzD,MAAMN,mBAAmBgB;IAEzB,4EAA4E;IAC5E,wDAAwD;IACxD,IAAIgD,SAASnB,MAAM,GAAG,KAAKqF,aAAarF,MAAM,GAAG,KAAK0C,UAAU1C,MAAM,GAAG,GAAG;QAC1EoF,UAAU/E,IAAI,CACZ,CAAC,mDAAmD,EAAEjE,oBACpDb,qBAAqB4C,KAAKI,IAAI,GAC9B,2BAA2B,CAAC;IAElC;IACA,IACE+G,WAAWtF,MAAM,GAAG,KACpBwF,cAAcxF,MAAM,GAAG,KACvByF,cAAczF,MAAM,GAAG,GACvB;QACAoF,UAAU/E,IAAI,CACZ,CAAC,2CAA2C,EAAE;eAAI,IAAIyC,IAAI;mBAAIwC;mBAAeE;mBAAkBC;aAAc;SAAE,CAACjF,IAAI,CAAC,MAAM,oCAAoC,CAAC;IAEpK;IACA,6EAA6E;IAC7E,8DAA8D;IAC9D,IAAI+E,eAAeI,QAAQ,CAAC3F,MAAM,GAAG,GAAG;QACtCoF,UAAU/E,IAAI,CACZ,CAAC,mBAAmB,EAAE;eAAI,IAAIyC,IAAIyC,eAAeI,QAAQ;SAAE,CAACnF,IAAI,CAAC,MAAM,+EAA+E,EAAE9D,iBAAiB,QAAQ,eAAe,EAAEI,uBAAuB,QAAQ,mEAAmE,CAAC;IAEzS;IACA,IAAIiI,eAAe/E,MAAM,GAAG,GAAG;QAC7BoF,UAAU/E,IAAI,CACZ,CAAC,4CAA4C,EAAE0E,eAAe/E,MAAM,CAAC,4FAA4F,CAAC;IAEtK;IACA,gFAAgF;IAChF,+EAA+E;IAC/E,kDAAkD;IAClD,IAAI0F,gBAAgB1F,MAAM,GAAG,GAAG;QAC9BoF,UAAU/E,IAAI,CACZ,CAAC,sCAAsC,EAAEqF,gBAAgBlF,IAAI,CAAC,MAAM,0FAA0F,CAAC;IAEnK;IAEA,6EAA6E;IAC7E,MAAMnE,qBAAqB8B;IAE3B,OAAO;QAAEiH;IAAU;AACrB,EAAE"}