.projenrc.ts

import * as path from 'path';
import { yarn } from 'cdklabs-projen-project-types';
import { TypeScriptWorkspace, type TypeScriptWorkspaceOptions } from 'cdklabs-projen-project-types/lib/yarn';
import * as pj from 'projen';
import { AdcPublishing } from './projenrc/adc-publishing';
import { BootstrapTemplateProtection } from './projenrc/bootstrap-template-protection';
import { BundleCli } from './projenrc/bundle';
import { CdkCliIntegTestsWorkflow, fixupTestTask } from './projenrc/cdk-cli-integ-tests';
import { CheckSdkDuplication } from './projenrc/check-sdk-duplication';
import { CodeCovWorkflow } from './projenrc/codecov';
import { configureEslint } from './projenrc/eslint';
import { IssueLabeler } from './projenrc/issue-labeler';
import { IssueRegressionLabeler } from './projenrc/issue-regression-labeler';
import { LargePrChecker } from './projenrc/large-pr-checker';
import { PrLabeler } from './projenrc/pr-labeler';
import { RecordPublishingTimestamp } from './projenrc/record-publishing-timestamp';
import { DocType, S3DocsPublishing } from './projenrc/s3-docs-publishing';
import { SelfMutationOnForks } from './projenrc/SelfMutationOnForks';
import { defineTools } from './projenrc/tools';
import { TypecheckTests } from './projenrc/TypecheckTests';
import { YarnVersion } from './projenrc/yarn-version';

// #region shared config

const TYPESCRIPT_VERSION = '5.9';
const DEPENDENCY_COOLDOWN = 3;

/**
 * Global note on customizeReference
 * ---------------------------------
 *
 * All packages references using `customizeReference()` should have an `^0.0.0`
 * dependency in `package.json` regardless of what the argument to
 * `customizeReference()` is. This because unbump will always set the range
 * specified to that value, and if it used to be something else then we will
 * introduce a git diff that stops the release. Do not worry, the bumped version
 * will have the correct range character.
 *
 * When adding a fresh package, projen sometimes inserts `"0.0.0"` there, if
 * that happens you need to edit `package.json` once by hand.
 */

/**
 * When adding an SDK dependency, use this function
 *
 * It forces the package.json to contain `@^3`. This has 2 benefits:
 *
 * - If we don't force that, projen will make it contain something like
 *   `^3.282.74` and update that version every couple of days.
 *   By forcing a large range, we provide ample opportunity for our library user's
 *   package manager to deduplicate whatever version of SDKv3 the consumer is
 *   using with the version that our library expects.
 * - The above is only necessary for libraries, but we use this for CLIs as well,
 *   so that all SDK packages have the same specifier. This increases the chances of
 *   `yarn up` updating all packages at the same time to the same version; otherwise,
 *   if one SDK library is at `3.1028.0` and the other at `3.1033.0` (or whatever),
 *   they sometimes bring different versions of Smithy packages which then take up
 *   unnecessary space and also conflict with each other.
 */
function sdkDep(name: string) {
  if (!name.startsWith('@aws-sdk/')) {
    throw new Error('Must be an SDK package');
  }
  return `${name}@^3`;
}

/**
 * Same as `sdkDepForLib`, but for smithy
 */
function smithyDep(name: string) {
  if (!name.startsWith('@smithy/')) {
    throw new Error('Must be a Smithy package');
  }
  return `${name}@^4`;
}

const BUNDLED_LICENSES = [
  'Apache-2.0',
  'MIT',
  'BSD-3-Clause',
  'ISC',
  'BSD-2-Clause',
  '0BSD',
  'MIT OR Apache-2.0',
];

/**
 * Configures a Eslint, which is a complex setup.
 *
 * We also need to override the built-in prettier dependency to prettier@2, because
 * Jest < 30 can only work with prettier 2 (https://github.com/jestjs/jest/issues/14305)
 * and 30 is not stable yet.
 */
function configureProject<A extends pj.typescript.TypeScriptProject>(x: A): A {
  // currently supported min node version
  x.package.addEngine('node', '>= 18.0.0');

  x.addDevDeps(
    'jest-junit@^16',
    'prettier@^2.8',
  );

  configureEslint(x);

  x.npmignore?.addPatterns(
    // don't inlcude config files
    '.eslintrc.js',
    // As a rule we don't include .ts sources in the NPM package
    '*.ts',
    '!*.d.ts',
    // Never include the build-tools directory
    'build-tools',
  );

  return x;
}

const POWERFUL_RUNNER = 'aws-cdk_ubuntu-latest_16-core';

// Ignore patterns that apply both to the Toolkit CLI and Library
const ADDITIONAL_CLI_IGNORE_PATTERNS = [
  'db.json.gz',
  '.init-version.json',
  'index_bg.wasm',
  'build-info.json',
  '.recommended-feature-flags.json',
  'synth.lock',
];

const defaultTsOptions: NonNullable<TypeScriptWorkspaceOptions['tsconfig']>['compilerOptions'] = {
  module: 'node18',
  target: 'es2022',
  lib: ['es2022'],
  incremental: true,
  esModuleInterop: true,
  noEmitOnError: true,
  skipLibCheck: true,
  isolatedModules: true,
};

/**
 * Shared jest config
 *
 * Must be a function because these structures will be mutated in-place inside projen
 */
function sharedJestConfig(): pj.javascript.JestConfigOptions {
  return {
    moduleFileExtensions: [
      // .ts first to prefer a ts over a js if present
      'ts',
      'js',
    ],
    maxWorkers: '80%',
    testEnvironment: 'node',
    coverageThreshold: {
      statements: 80,
      branches: 80,
      functions: 80,
      lines: 80,
    },
    collectCoverage: true,
    coverageReporters: [
      'text-summary', // for console summary
      'cobertura', // for codecov. see https://docs.codecov.com/docs/code-coverage-with-javascript
      ['html', { subdir: 'html-report' }] as any, // for local deep dive
    ],
    testMatch: ['<rootDir>/test/**/?(*.)+(test).ts'],
    coveragePathIgnorePatterns: ['\\.generated\\.[jt]s$', '<rootDir>/test/', '.warnings.jsii.js$', '/node_modules/'],
    reporters: ['default', ['jest-junit', { suiteName: 'jest tests', outputDirectory: 'coverage' }]] as any,

    // Randomize test order: this will catch tests that accidentally pass or
    // fail because they rely on shared mutable state left by other tests
    // (files on disk, global mocks, etc).
    // @ts-ignore
    randomize: true,
  };
}

/**
 * Extend default jest options for a project
 */
function jestOptionsForProject(options: pj.javascript.JestOptions): pj.javascript.JestOptions {
  const generic = genericCdkProps().jestOptions;
  return {
    ...generic,
    ...options,
    jestConfig: {
      ...generic.jestConfig,
      ...(options.jestConfig ?? {}),
      coveragePathIgnorePatterns: [
        ...(generic.jestConfig?.coveragePathIgnorePatterns ?? []),
        ...(options.jestConfig?.coveragePathIgnorePatterns ?? []),
      ],
      coverageThreshold: {
        ...(generic.jestConfig?.coverageThreshold ?? {}),
        ...(options.jestConfig?.coverageThreshold ?? {}),
      },
    },
  };
}

function transitiveFeaturesAndFixes(thisPkg: string, depPkgs: string[]) {
  return pj.ReleasableCommits.featuresAndFixes([
    '.',
    ...depPkgs.map(p => path.relative(`packages/${thisPkg}`, `packages/${p}`)),
  ].join(' '));
}

/**
 * Returns all packages that are considered part of the toolkit,
 * as relative paths from the provided package.
 */
function transitiveToolkitPackages(thisPkg: string) {
  const toolkitPackages = [
    'aws-cdk',
    '@aws-cdk/cloud-assembly-schema',
    '@aws-cdk/cloud-assembly-api',
    '@aws-cdk/cloudformation-diff',
    '@aws-cdk/toolkit-lib',
  ];

  return transitiveFeaturesAndFixes(thisPkg, toolkitPackages.filter(name => name !== thisPkg));
}

// #endregion
//////////////////////////////////////////////////////////////////////
// #region Monorepo

const repoProject = new yarn.Monorepo({
  projenrcTs: true,
  name: 'aws-cdk-cli',
  description: "Monorepo for the AWS CDK's CLI",
  repository: 'https://github.com/aws/aws-cdk-cli',

  runner: pj.typescript.TypeScriptRunner.tsx(),
  defaultReleaseBranch: 'main',
  typescriptVersion: TYPESCRIPT_VERSION,
  devDeps: [
    'cdklabs-projen-project-types',
    'fast-glob',
    'semver',
    sdkDep('@aws-sdk/client-s3'),
    sdkDep('@aws-sdk/credential-providers'),
    sdkDep('@aws-sdk/lib-storage'),
    'tsx',
    'jest',
    '@types/jest',
    'eslint-config-prettier',
    'eslint-plugin-prettier',
  ],
  allowScripts: ['node-pty', 'esbuild'],
  vscodeWorkspace: true,
  vscodeWorkspaceOptions: {
    includeRootWorkspace: true,
  },
  nx: true,
  buildWithNx: true,
  yarnBerry: true,
  consistentVersions: [
    'typescript',
    'eslint',
    'eslint-import-resolver-typescript',
    'eslint-plugin-import',
    'eslint-plugin-jest',
    'eslint-plugin-jsdoc',
    '@cdklabs/eslint-plugin',
    '@stylistic/eslint-plugin',
    '@typescript-eslint/eslint-plugin',
    '@typescript-eslint/parser',
    'prettier',
    'eslint-config-prettier',
    'eslint-plugin-prettier',
    'jest',
    'jest-junit',
    '@types/jest',
    'projen',
  ],

  eslintOptions: {
    dirs: ['lib'],
    devdirs: ['test'],
  },

  workflowNodeVersion: 'lts/*',
  workflowRunsOn: [POWERFUL_RUNNER],
  gitignore: ['.DS_Store', '.tools'],

  autoApproveUpgrades: true,
  autoApproveOptions: {
    allowedUsernames: ['aws-cdk-automation', 'dependabot[bot]'],
  },

  release: true,
  releaseOptions: {
    publishToNpm: true,
    releaseTrigger: pj.release.ReleaseTrigger.workflowDispatch(),
  },

  depsUpgradeOptions: {
    cooldown: DEPENDENCY_COOLDOWN,
    workflowOptions: {
      schedule: pj.javascript.UpgradeDependenciesSchedule.WEEKLY,
    },
  },

  githubOptions: {
    dependencyReview: true,
    projenCredentials: pj.github.GithubCredentials.fromPersonalAccessToken({
      secret: 'PROJEN_GITHUB_TOKEN',
      environment: 'automation',
    }),
    mergify: false,
    mergeQueue: true,
    mergeQueueOptions: {
      autoQueueOptions: {
        // Only autoqueue for PRs targeting the 'main' branch
        targetBranches: ['main'],
      },
    },
    pullRequestLint: true,
    pullRequestLintOptions: {
      contributorStatement: 'By submitting this pull request, I confirm that my contribution is made under the terms of the Apache-2.0 license',
      contributorStatementOptions: {
        exemptUsers: ['aws-cdk-automation', 'dependabot[bot]'],
      },
      semanticTitleOptions: {
        types: ['feat', 'fix', 'chore', 'refactor', 'test', 'docs', 'revert'],
        scopes: [], // actually set at the bottom of the file to be based on monorepo packages
      },
    },
  },

  pullRequestTemplateContents: [
    'Fixes #',
    '',
    '### Checklist',
    '- [ ] This change contains a major version upgrade for a dependency and I confirm all breaking changes are addressed',
    '  - Release notes for the new version:',
  ],

  buildWorkflowOptions: {
    preBuildSteps: [
      // Need this for the init tests
      {
        name: 'Set git identity',
        run: [
          'git config --global user.name "aws-cdk-cli"',
          'git config --global user.email "noreply@example.com"',
        ].join('\n'),
      },
    ],
  },
});

repoProject.tryFindObjectFile(`${repoProject.name}.code-workspace`)?.patch(
  pj.JsonPatch.add('/settings/jest.jestCommandLine', 'yarn jest'),
  pj.JsonPatch.add('/settings/js~1ts.tsdk.path', '<root>/node_modules/typescript/lib'),
);

new CheckSdkDuplication(repoProject);
new AdcPublishing(repoProject);
new RecordPublishingTimestamp(repoProject);
new BootstrapTemplateProtection(repoProject);
new SelfMutationOnForks(repoProject, { environment: 'automation' });

repoProject.gitignore.addPatterns('.vscode/settings.json');

// Eslint for projen config
// @ts-ignore
repoProject.eslint = new pj.javascript.Eslint(repoProject, {
  tsconfigPath: `./${repoProject.tsconfigDev.fileName}`,
  dirs: [],
  devdirs: ['projenrc', '.projenrc.ts'],
  fileExtensions: ['.ts', '.tsx'],
});

// always lint projen files as part of the build
if (repoProject.eslint?.eslintTask) {
  repoProject.tasks.tryFind('build')?.spawn(repoProject.eslint?.eslintTask);
}

// always scan for git secrets before building
const gitSecretsScan = repoProject.addTask('git-secrets-scan', {
  steps: [
    {
      exec: '/bin/bash ./projenrc/git-secrets-scan.sh',
    },
  ],
});

repoProject.tasks.tryFind('build')!.spawn(gitSecretsScan);

const repo = configureProject(repoProject);

interface GenericProps {
  private?: boolean;
}

/**
 * Generic CDK props
 *
 * Must be a function because the structures of jestConfig will be mutated
 * in-place inside projen
 */
function genericCdkProps(props: GenericProps = {}) {
  return {
    keywords: ['aws', 'cdk'],
    homepage: 'https://github.com/aws/aws-cdk',
    authorName: 'Amazon Web Services',
    authorUrl: 'https://aws.amazon.com',
    authorOrganization: true,
    releasableCommits: pj.ReleasableCommits.featuresAndFixes('.'),
    releaseEnvironment: 'releasing',
    npmTrustedPublishing: true,
    jestOptions: {
      configFilePath: 'jest.config.json',
      junitReporting: false,
      coverageText: false,
      jestConfig: sharedJestConfig(),
      preserveDefaultReporters: false,
    },
    minNodeVersion: '20',
    prettierOptions: {
      settings: {
        printWidth: 120,
        singleQuote: true,
        trailingComma: pj.javascript.TrailingComma.ALL,
      },
    },
    tsconfig: {
      compilerOptions: {
        ...defaultTsOptions,
      },
    },
    typescriptVersion: TYPESCRIPT_VERSION,
    checkLicenses: props.private ? undefined : {
      allow: ['Apache-2.0', 'MIT', 'ISC', 'BSD-3-Clause', '0BSD'],
    },
    ...props,
  } satisfies Partial<yarn.TypeScriptWorkspaceOptions>;
}

// #endregion
//////////////////////////////////////////////////////////////////////
// #region @aws-cdk/cloud-assembly-schema

const cloudAssemblySchema = configureProject(
  new yarn.TypeScriptWorkspace({
    ...genericCdkProps(),
    parent: repo,
    name: '@aws-cdk/cloud-assembly-schema',
    description: 'Schema for the protocol between CDK framework and CDK CLI',
    srcdir: 'lib',
    bundledDeps: ['jsonschema@^1.5.0', 'semver'],
    devDeps: ['@types/semver', 'mock-fs', 'typescript-json-schema', 'tsx'],
    tsconfig: {
      compilerOptions: {
        ...defaultTsOptions,
        module: 'node16',
        stripInternal: false,
        tsBuildInfoFile: 'tsconfig.tsbuildinfo',
      },
    },

    jestOptions: jestOptionsForProject({
      jestConfig: {
        coverageThreshold: {
          functions: 75,
        },
      },
    }),

    // Append a specific version string for testing
    nextVersionCommand: 'tsx ../../../projenrc/next-version.ts majorFromRevision:schema/version.json maybeRc',
  }),
);
fixupTestTask(cloudAssemblySchema);

cloudAssemblySchema.with(new yarn.WorkspaceJsiiBuild({
  docgen: false,
  jsiiVersion: TYPESCRIPT_VERSION,
  excludeTypescript: ['**/test/**/*.ts'],
  rosettaDependencies: ['constructs@^10.0.0'],
  publishToMaven: {
    javaPackage: 'software.amazon.awscdk.cloudassembly.schema',
    mavenArtifactId: 'cdk-cloud-assembly-schema',
    mavenGroupId: 'software.amazon.awscdk',
    mavenServerId: 'central-ossrh',
  },
  publishToNuget: {
    dotNetNamespace: 'Amazon.CDK.CloudAssembly.Schema',
    packageId: 'Amazon.CDK.CloudAssembly.Schema',
    iconUrl: 'https://raw.githubusercontent.com/aws/aws-cdk/main/logo/default-256-dark.png',
  },
  publishToPypi: {
    distName: 'aws-cdk.cloud-assembly-schema',
    module: 'aws_cdk.cloud_assembly_schema',
    trustedPublishing: true,
  },
  pypiClassifiers: [
    'Framework :: AWS CDK',
    'Framework :: AWS CDK :: 2',
  ],
  publishToGo: {
    moduleName: 'github.com/cdklabs/cloud-assembly-schema-go',
  },
  composite: true,
}));

(() => {
  cloudAssemblySchema.addDevDeps('cdk-generate-synthetic-examples');
  cloudAssemblySchema.tasks.tryFind('rosetta:extract')!.reset('cdk-generate-synthetic-examples');
  cloudAssemblySchema.tasks.tryFind('rosetta:extract')!.exec('jsii-rosetta extract --strict');

  cloudAssemblySchema.preCompileTask.exec('tsx projenrc/update.ts');

  // This file will be generated at release time. It needs to be gitignored or it will
  // fail projen's "no tamper" check, which means it must also be generated every build time.
  //
  // Crucially, this must also run during release after bumping, but that is satisfied already
  // by making it part of preCompile, because that makes it run as part of projen build.
  cloudAssemblySchema.preCompileTask.exec('tsx ../../../projenrc/copy-cli-version-to-assembly.task.ts');
  cloudAssemblySchema.gitignore.addPatterns('cli-version.json');
  cloudAssemblySchema.gitignore.addPatterns('_generated.ts-fixture');

  cloudAssemblySchema.addPackageIgnore('*.ts');
  cloudAssemblySchema.addPackageIgnore('!*.d.ts');
  cloudAssemblySchema.addPackageIgnore('**/scripts');
})();

// #endregion
//////////////////////////////////////////////////////////////////////
// #region @aws-cdk/cloudformation-diff

const cloudFormationDiff = configureProject(
  new yarn.TypeScriptWorkspace({
    ...genericCdkProps(),
    parent: repo,
    name: '@aws-cdk/cloudformation-diff',
    description: 'Utilities to diff CDK stacks against CloudFormation templates',
    majorVersion: 2,
    srcdir: 'lib',
    devDeps: [
      'fast-check',
    ],
    peerDependencyOptions: {
      pinnedDevDependency: false,
    },
    peerDeps: [
      sdkDep('@aws-sdk/client-cloudformation'),
    ],
    deps: [
      '@aws-cdk/aws-service-spec',
      '@aws-cdk/service-spec-types',
      'chalk@^4',
      'diff',
      'fast-deep-equal',
      'string-width@^4',
      'table@^6',
    ],
    jestOptions: jestOptionsForProject({
      jestConfig: {
        coverageThreshold: {
          functions: 75,
        },
      },
    }),

    // Append a specific version string for testing
    nextVersionCommand: 'tsx ../../../projenrc/next-version.ts maybeRc',
  }),
);

fixupTestTask(cloudFormationDiff);

// #endregion

//////////////////////////////////////////////////////////////////////
// #region @aws-cdk/cloud-assembly-api

const cloudAssemblyApi = configureProject(
  new yarn.TypeScriptWorkspace({
    ...genericCdkProps(),
    parent: repo,
    name: '@aws-cdk/cloud-assembly-api',
    description: 'API for working with Cloud Assemblies',
    srcdir: 'lib',
    devDeps: [
      cloudAssemblySchema.customizeReference({ versionType: 'exact' }),
      '@types/json-source-map@^0.6.0',
    ],
    deps: [
      'json-source-map@^0.6.1',
      'jsonschema@^1.5.0',
      'semver',
    ],
    peerDeps: [
      cloudAssemblySchema.customizeReference({ versionType: 'any-future' }),
    ],

    jestOptions: jestOptionsForProject({
      jestConfig: {
        coverageThreshold: {
          functions: 75,
        },
      },
    }),

    // Append a specific version string for testing
    nextVersionCommand: 'tsx ../../../projenrc/next-version.ts atLeast:2.0.0 maybeRc',
  }),
);
fixupTestTask(cloudAssemblyApi);

// #endregion

//////////////////////////////////////////////////////////////////////
// #region @aws-cdk/cx-api

// cx-api represents the flags that the Cloud Executable expects. It is
// generated from `aws-cdk-lib` at build time.  Stay within the same MV,
// otherwise any should work
const cxApi = '@aws-cdk/cx-api@^2';

// #endregion
//////////////////////////////////////////////////////////////////////
// #region @aws-cdk/yarn-cling

const yarnCling = configureProject(
  new yarn.TypeScriptWorkspace({
    ...genericCdkProps({
      private: true,
    }),
    parent: repo,
    name: '@aws-cdk/yarn-cling',
    description: 'Tool for generating npm-shrinkwrap from yarn.lock',
    srcdir: 'lib',
    deps: ['@yarnpkg/parsers', 'semver'],
    devDeps: ['@types/semver', 'fast-check'],
    minNodeVersion: '20',
    jestOptions: jestOptionsForProject({
      jestConfig: {
        coverageThreshold: {
          branches: 78,
        },
      },
    }),
  }),
);
yarnCling.testTask.prependExec('ln -sf ../../cdk test/test-fixture/jsii/node_modules/');
yarnCling.testTask.prependExec('ln -sf ../../cdk test/test-fixture-berry/jsii/node_modules/');

// #endregion
//////////////////////////////////////////////////////////////////////
// #region @aws-cdk/user-input-gen

const yargsGen = configureProject(
  new yarn.TypeScriptWorkspace({
    ...genericCdkProps({
      private: true,
    }),
    parent: repo,
    name: '@aws-cdk/user-input-gen',
    description: 'Generate CLI arguments',
    srcdir: 'lib',
    deps: ['@cdklabs/typewriter', 'prettier@^2.8', 'lodash.clonedeep'],
    devDeps: ['@types/semver', '@types/yarnpkg__lockfile', '@types/lodash.clonedeep', '@types/prettier@^2'],
    minNodeVersion: '20', // Necessary for 'structuredClone'
  }),
);

// #endregion
//////////////////////////////////////////////////////////////////////
// #region @aws-cdk/cli-plugin-contract

// This should be deprecated, but only after the move
const cliPluginContract = configureProject(
  new yarn.TypeScriptWorkspace({
    ...genericCdkProps(),
    parent: repo,
    name: '@aws-cdk/cli-plugin-contract',
    description: 'Contract between the CLI and authentication plugins, for the exchange of AWS credentials',
    majorVersion: 2,
    srcdir: 'lib',
    deps: [
    ],
    devDeps: [
    ],
  }),
);

// #endregion
//////////////////////////////////////////////////////////////////////
// #region @aws-cdk/private-tools

/**
 * Private (unpublished) package hosting small, self-contained utilities.
 *
 * Non-bundled consumers cherry-pick a tool via `project.with(tools.<name>)`,
 * which adds a re-export shim (`lib/private/tools.ts`) and bundles only our
 * code into it at pack time. Already-bundled consumers (the CLI) take a direct
 * dependency on the package instead.
 *
 * Adding a new tool: create `packages/@aws-cdk/private-tools/lib/<tool>/index.ts`
 * (auto-discovered) and declare its dependencies in the `tools` map below.
 */
const tools = defineTools({
  ...genericCdkProps({ private: true }),
  parent: repo,
  tools: {
    'subprocess': {
      deps: ['cross-spawn@^7.0.6'],
      devDeps: ['@types/cross-spawn'],
    },
    'zip': {
      deps: ['yazl@^3.3.1', 'fast-glob@^3.3.3'],
      devDeps: ['@types/yazl', 'jszip', 'timezone-mock'],
    },
    's3-path-style': {
      deps: [],
    },
  },
});
configureProject(tools);

// #endregion
//////////////////////////////////////////////////////////////////////
// #region @aws-cdk/cdk-assets-lib

const cdkAssetsLib = configureProject(
  new yarn.TypeScriptWorkspace({
    ...genericCdkProps(),
    parent: repo,
    name: '@aws-cdk/cdk-assets-lib',
    majorVersion: 1,
    description: 'CDK Asset Publishing Library',
    srcdir: 'lib',
    deps: [
      cloudAssemblySchema.customizeReference({ versionType: 'any-future' }),
      cloudAssemblyApi.customizeReference({ versionType: 'exact' }),
      'mime@^2',
      sdkDep('@aws-sdk/client-ecr'),
      sdkDep('@aws-sdk/client-s3'),
      sdkDep('@aws-sdk/client-secrets-manager'),
      sdkDep('@aws-sdk/client-sts'),
      sdkDep('@aws-sdk/credential-providers'),
      sdkDep('@aws-sdk/lib-storage'),
      smithyDep('@smithy/config-resolver'),
      smithyDep('@smithy/node-config-provider'),
      'picomatch',
    ],
    devDeps: [
      '@types/mime@^2',
      '@types/picomatch',
      'fs-extra@^11',
      'graceful-fs',
      'jszip',
      '@types/mock-fs@^4',
      'mock-fs@^5',
      'aws-sdk-client-mock',
      'aws-sdk-client-mock-jest',
    ],
    jestOptions: jestOptionsForProject({
      jestConfig: {
        // We have many tests here that commonly time out
        testTimeout: 10_000,
      },
    }),

    // Append a specific version string for testing
    nextVersionCommand: 'tsx ../../../projenrc/next-version.ts neverMajor maybeRc',

    releasableCommits: transitiveFeaturesAndFixes('@aws-cdk/cdk-assets-lib', [
      '@aws-cdk/cloud-assembly-schema',
    ]),
  }),
);
cdkAssetsLib.with(tools.subprocess);
cdkAssetsLib.with(tools.zip);
cdkAssetsLib.with(tools['s3-path-style']);
fixupTestTask(cdkAssetsLib);

// Prevent imports of private API surface
cdkAssetsLib.package.addField('exports', {
  '.': {
    types: './lib/index.d.ts',
    default: './lib/index.js',
  },
  './package.json': './package.json',
});

new TypecheckTests(cdkAssetsLib);

cdkAssetsLib.gitignore.addPatterns(
  '*.js',
  '*.d.ts',
);

// This package happens do something only slightly naughty
cdkAssetsLib.eslint?.addRules({ 'jest/no-export': ['off'] });

// #endregion
//////////////////////////////////////////////////////////////////////
// #region cdk-assets

const cdkAssetsCli = configureProject(
  new yarn.TypeScriptWorkspace({
    ...genericCdkProps(),
    parent: repo,
    name: 'cdk-assets',
    description: 'CDK Asset Publishing Tool',
    majorVersion: 4,
    srcdir: 'lib',
    deps: [
      cdkAssetsLib,
      'yargs',
    ],
    devDeps: [
      '@types/yargs',
      // These are for tests
      cloudAssemblySchema,
      sdkDep('@aws-sdk/client-s3'),
      'aws-sdk-client-mock',
    ],
    tsconfigDev: {
      compilerOptions: {
        ...defaultTsOptions,
      },
      include: ['bin/**/*.ts'],
    },
    tsconfig: {
      compilerOptions: {
        ...defaultTsOptions,
        rootDir: undefined,
        outDir: undefined,
      },
      include: ['bin/**/*.ts'],
    },

    jestOptions: jestOptionsForProject({
      jestConfig: {
        // We have many tests here that commonly time out
        testTimeout: 10_000,
        coverageThreshold: {
          branches: 74,
        },
      },
    }),

    // Append a specific version string for testing
    nextVersionCommand: 'tsx ../../projenrc/next-version.ts maybeRc',

    releasableCommits: transitiveFeaturesAndFixes('cdk-assets', [
      '@aws-cdk/cdk-assets-lib',
      '@aws-cdk/cloud-assembly-schema',
    ]),
  }),
);

fixupTestTask(cdkAssetsCli);

cdkAssetsCli.gitignore.addPatterns(
  '*.js',
  '*.d.ts',
);

new BundleCli(cdkAssetsCli, {
  allowedLicenses: BUNDLED_LICENSES,
  dontAttribute: '^@aws-cdk/|^@cdklabs/$',
  test: 'bin/cdk-assets --version',
  entryPoints: [
    'bin/cdk-assets.js',
    'bin/docker-credential-cdk-assets.js',
  ],
  minifyWhitespace: true,
});

// #endregion
//////////////////////////////////////////////////////////////////////
// #region @aws-cdk/toolkit-lib

const TOOLKIT_LIB_EXCLUDE_PATTERNS = [
  'lib/init-templates/*/typescript/*/*.template.ts',
];

const toolkitLibTsCompilerOptions = {
  ...defaultTsOptions,
  lib: ['es2022', 'esnext.disposable'],
  declarationMap: true,
};

const toolkitLib = configureProject(
  new yarn.TypeScriptWorkspace({
    ...genericCdkProps(),
    homepage: 'https://docs.aws.amazon.com/cdk/api/toolkit-lib',
    parent: repo,
    name: '@aws-cdk/toolkit-lib',
    description: 'AWS CDK Programmatic Toolkit Library',
    majorVersion: 1,
    srcdir: 'lib',
    peerDeps: [
      cliPluginContract.customizeReference({ versionType: 'any-minor' }), // allow consumers to easily de-depulicate this
    ],
    deps: [
      cloudAssemblySchema.customizeReference({ versionType: 'any-future' }), // needs to be newer than what this was build with
      cloudFormationDiff.customizeReference({ versionType: 'any-minor' }), // stay within the same MV, otherwise any should work
      cdkAssetsLib.customizeReference({ versionType: 'any-minor' }), // stay within the same MV, otherwise any should work
      cxApi,
      cloudAssemblyApi.customizeReference({ versionType: 'exact' }),
      sdkDep('@aws-sdk/client-appsync'),
      sdkDep('@aws-sdk/client-bedrock-agentcore-control'),
      sdkDep('@aws-sdk/client-cloudformation'),
      sdkDep('@aws-sdk/client-cloudwatch-logs'),
      sdkDep('@aws-sdk/client-cloudcontrol'),
      sdkDep('@aws-sdk/client-cloudtrail'),
      sdkDep('@aws-sdk/client-codebuild'),
      sdkDep('@aws-sdk/client-ec2'),
      sdkDep('@aws-sdk/client-ecr'),
      sdkDep('@aws-sdk/client-ecs'),
      sdkDep('@aws-sdk/client-elastic-load-balancing-v2'),
      sdkDep('@aws-sdk/client-iam'),
      sdkDep('@aws-sdk/client-kms'),
      sdkDep('@aws-sdk/client-lambda'),
      sdkDep('@aws-sdk/client-route-53'),
      sdkDep('@aws-sdk/client-s3'),
      sdkDep('@aws-sdk/client-secrets-manager'),
      sdkDep('@aws-sdk/client-sfn'),
      sdkDep('@aws-sdk/client-ssm'),
      sdkDep('@aws-sdk/client-sts'),
      sdkDep('@aws-sdk/credential-providers'),
      sdkDep('@aws-sdk/ec2-metadata-service'),
      sdkDep('@aws-sdk/lib-storage'),
      smithyDep('@smithy/middleware-endpoint'),
      smithyDep('@smithy/property-provider'),
      smithyDep('@smithy/shared-ini-file-loader'),
      smithyDep('@smithy/util-retry'),
      smithyDep('@smithy/util-waiter'),
      'cdk-from-cfn',
      'chalk@^4',
      'chokidar@^4',
      'fast-deep-equal',
      'fs-extra@^11',
      'picomatch',
      'p-limit@^3',
      'semver',
      'wrap-ansi@^7', // Last non-ESM version
      'yaml@^1',
    ],
    devDeps: [
      '@aws-cdk/aws-service-spec',
      '@jest/environment',
      '@jest/globals',
      '@jest/types',
      '@microsoft/api-extractor',
      '@smithy/util-stream',
      '@types/fs-extra@^11',
      '@types/picomatch',
      'aws-cdk-lib',
      'aws-sdk-client-mock',
      'aws-sdk-client-mock-jest',
      'fast-check',
      'jest-environment-node',
      '@types/jest-when',
      'jest-when',
      'nock@13',
      'tsx',
    ],
    // Watch 2 directories at once
    releasableCommits: transitiveToolkitPackages('@aws-cdk/toolkit-lib'),
    eslintOptions: {
      dirs: ['lib'],
      ignorePatterns: [
        ...TOOLKIT_LIB_EXCLUDE_PATTERNS,
        '*.d.ts',
      ],
    },
    jestOptions: jestOptionsForProject({
      jestConfig: {
        // Tests that synth an assembly usually need a bit longer
        testTimeout: 10_000,
        coverageThreshold: {
          statements: 87,
          branches: 83,
          functions: 82,
          lines: 87,
        },
        testEnvironment: './test/_helpers/jest-bufferedconsole.ts',
        setupFilesAfterEnv: [
          '<rootDir>/test/_helpers/jest-setup-after-env.ts',
          '<rootDir>/test/_helpers/jest-custom-matchers.ts',
        ],
      },
    }),
    tsconfig: {
      compilerOptions: {
        ...toolkitLibTsCompilerOptions,
      },
    },
    nextVersionCommand: 'tsx ../../../projenrc/next-version.ts maybeRc',
  }),
);
fixupTestTask(toolkitLib);
toolkitLib.with(tools.subprocess);
toolkitLib.with(tools.zip);
toolkitLib.with(tools['s3-path-style']);
toolkitLib.tasks.tryFind('test')?.updateStep(0, {
  // https://github.com/aws/aws-sdk-js-v3/issues/7420
  exec: 'NODE_OPTIONS="$NODE_OPTIONS --experimental-vm-modules" jest --passWithNoTests --updateSnapshot',
});

new TypecheckTests(toolkitLib);

// API Extractor documentation publishing
new S3DocsPublishing(toolkitLib, {
  docsStream: 'toolkit-lib-api-model',
  artifactPath: 'api-extractor-docs.zip',
  bucketName: '${{ vars.DOCS_BUCKET_NAME }}',
  roleToAssume: '${{ vars.PUBLISH_TOOLKIT_LIB_DOCS_ROLE_ARN }}',
  docType: DocType.API_EXTRACTOR,
});

// Add API Extractor configuration
new pj.JsonFile(toolkitLib, 'api-extractor.json', {
  marker: false,
  obj: {
    projectFolder: '.',
    mainEntryPointFilePath: '<projectFolder>/lib/index.d.ts',
    bundledPackages: [],
    apiReport: {
      enabled: false,
    },
    docModel: {
      enabled: true,
      apiJsonFilePath: './dist/<unscopedPackageName>.api.json',
      projectFolderUrl: 'https://github.com/aws/aws-cdk-cli/tree/main/packages/%40aws-cdk/toolkit-lib',
    },
    dtsRollup: {
      enabled: false,
    },
    tsdocMetadata: {
      enabled: false,
    },
    messages: {
      compilerMessageReporting: {
        default: {
          logLevel: 'error',
        },
      },
      extractorMessageReporting: {
        'default': {
          logLevel: 'error',
        },
        'ae-missing-release-tag': {
          logLevel: 'none',
        },
        'ae-forgotten-export': {
          logLevel: 'error',
        },
      },
      tsdocMessageReporting: {
        default: {
          logLevel: 'error',
        },
      },
    },
  },
  committed: true,
});

// TsDoc config (required by API Extractor)
new pj.JsonFile(toolkitLib, 'tsdoc.json', {
  marker: false,
  obj: {
    $schema: 'https://developer.microsoft.com/json-schemas/tsdoc/v0/tsdoc.schema.json',
    // Inherit the TSDoc configuration for API Extractor
    extends: ['@microsoft/api-extractor/extends/tsdoc-base.json'],
    // custom config
    tagDefinitions: [
      {
        tagName: '@default',
        syntaxKind: 'block',
      },
      {
        tagName: '@module',
        syntaxKind: 'block',
      },
    ],
    supportForTags: {
      '@default': true,
      '@module': true,
    },
  },
});

// Eslint rules
toolkitLib.eslint?.addRules({
  '@cdklabs/no-throw-default-error': 'error',
});
toolkitLib.eslint?.addOverride({
  files: ['./test/**'],
  rules: {
    '@cdklabs/no-throw-default-error': 'off',
    '@typescript-eslint/unbound-method': 'off',
  },
});

// Prevent imports of private API surface
toolkitLib.package.addField('exports', {
  '.': {
    types: './lib/index.d.ts',
    default: './lib/index.js',
  },
  './package.json': './package.json',
});

toolkitLib.addTask('gen-fixture', {
  description: 'Generate cdk.out for test fixtures',
  exec: 'tsx scripts/gen-fixture-cdk-out.ts',
  receiveArgs: true,
});
const registryTask = toolkitLib.addTask('registry', { exec: 'tsx scripts/gen-code-registry.ts' });
toolkitLib.postCompileTask.spawn(registryTask);
toolkitLib.postCompileTask.exec('build-tools/build-info.sh');
toolkitLib.postCompileTask.exec('node build-tools/bundle.mjs');
// Smoke test exported js files
toolkitLib.postCompileTask.exec('node ./lib/index.js &>/dev/null');

// Do include all .ts files inside init-templates
toolkitLib.npmignore?.addPatterns(
  'assets',
  'docs',
  'docs_html',
  '*.d.ts.map',
  // Explicitly allow all required files
  '!build-info.json',
  '!db.json.gz',
  '!lib/init-templates/**/*.ts',
  '!lib/api/bootstrap/bootstrap-template.yaml',
  '!lib/*.js',
  '!lib/*.d.ts',
  '!LICENSE',
  '!NOTICE',
  '!THIRD_PARTY_LICENSES',
);

toolkitLib.gitignore.addPatterns(
  ...ADDITIONAL_CLI_IGNORE_PATTERNS,
  'docs_html',
  'build-info.json',
  'lib/**/*.wasm',
  'lib/**/*.yaml',
  'lib/**/*.yml',
  'lib/**/*.js.map',
  'lib/init-templates/**',
  '!test/_fixtures/**/app.js',
  '!test/_fixtures/**/cdk.out',
  'test/_fixtures/**/cdk.out/*.lock',
);

// Add commands for the API Extractor docs
const apiExtractorDocsTask = toolkitLib.addTask('docs', {
  exec: [
    // Run api-extractor to generate the API model
    'api-extractor run',
    // Create a directory for the API model
    'mkdir -p dist/api-extractor-docs/cdk/api/toolkit-lib',
    // Copy the API model to the directory (with error handling)
    'if [ -f dist/toolkit-lib.api.json ]; then cp dist/toolkit-lib.api.json dist/api-extractor-docs/cdk/api/toolkit-lib/; else echo "Warning: API JSON file not found"; fi',
    // Add version file
    '(cat dist/version.txt 2>/dev/null || echo "latest") > dist/api-extractor-docs/cdk/api/toolkit-lib/VERSION',
    // Copy README.md if it exists
    'if [ -f README.md ]; then cp README.md dist/api-extractor-docs/cdk/api/toolkit-lib/; fi',
    // Copy all files from docs directory if it exists
    'if [ -d docs ]; then mkdir -p dist/api-extractor-docs/cdk/api/toolkit-lib/docs && cp -r docs/* dist/api-extractor-docs/cdk/api/toolkit-lib/docs/; fi',
    // Copy all files from assets directory if it exists
    'if [ -d assets ]; then mkdir -p dist/api-extractor-docs/cdk/api/toolkit-lib/assets && cp -r assets/* dist/api-extractor-docs/cdk/api/toolkit-lib/assets/; fi',
    // Zip the API model and docs files
    'cd dist/api-extractor-docs && zip -r -q ../api-extractor-docs.zip cdk',
  ].join(' && '),
  shell: pj.TaskShell.bash(),
});
// Add the API Extractor docs task to the package task
toolkitLib.packageTask.spawn(apiExtractorDocsTask);

toolkitLib.addTask('publish-local', {
  exec: './build-tools/package.sh',
  receiveArgs: true,
});

// #endregion
//////////////////////////////////////////////////////////////////////
// #region @aws-cdk/cdk-explorer

const cdkExplorer = configureProject(
  new yarn.TypeScriptWorkspace({
    ...genericCdkProps({
      private: true,
    }),
    parent: repo,
    name: '@aws-cdk/cdk-explorer',
    description: 'CDK Explorer — LSP server and web interface for AWS CDK',
    srcdir: 'lib',
    deps: [
      cloudAssemblySchema.customizeReference({ versionType: 'any-future' }),
      cloudAssemblyApi.customizeReference({ versionType: 'exact' }),
      toolkitLib.customizeReference({ versionType: 'exact' }),
      'vscode-languageserver@^9',
      'vscode-languageserver-textdocument@^1',
      'vscode-jsonrpc@^8',
      'chokidar@^4',
      '@jridgewell/trace-mapping@^0.3',
      'convert-source-map@^2',
    ],
    devDeps: [
      'vscode-languageserver-protocol@^3',
      '@types/convert-source-map@^2',
    ],
    tsconfig: {
      compilerOptions: {
        ...defaultTsOptions,
      },
    },
    jestOptions: jestOptionsForProject({
      jestConfig: {
        coverageThreshold: {
          statements: 80,
          branches: 80,
          functions: 80,
          lines: 80,
        },
      },
    }),
  }),
);
fixupTestTask(cdkExplorer);

// #endregion
//////////////////////////////////////////////////////////////////////
// #region aws-cdk

const cli = configureProject(
  new yarn.TypeScriptWorkspace({
    ...genericCdkProps(),
    parent: repo,
    name: 'aws-cdk',
    description: 'AWS CDK CLI, the command line tool for CDK apps',
    majorVersion: 2,
    srcdir: 'lib',
    devDeps: [
      yargsGen,
      cliPluginContract,
      cdkExplorer,
      '@types/yazl',
      '@types/fs-extra@^11',
      '@types/mockery',
      '@types/picomatch',
      '@types/promptly',
      '@types/semver',
      '@types/sinon',
      '@types/yargs@^15',
      'aws-cdk-lib',
      'aws-sdk-client-mock',
      'aws-sdk-client-mock-jest',
      'constructs',
      'fast-check',
      'jest-environment-node',
      'jest-mock',
      'nock@13',
      'sinon',
      'ts-mock-imports',
      'tsx',
    ],
    deps: [
      cloudAssemblySchema.customizeReference({ versionType: 'any-future' }),
      cloudFormationDiff.customizeReference({ versionType: 'exact' }),
      cxApi,
      cloudAssemblyApi.customizeReference({ versionType: 'exact' }),
      toolkitLib,
      'yazl',
      sdkDep('@aws-sdk/client-appsync'),
      sdkDep('@aws-sdk/client-bedrock-agentcore-control'),
      sdkDep('@aws-sdk/client-cloudformation'),
      sdkDep('@aws-sdk/client-cloudwatch-logs'),
      sdkDep('@aws-sdk/client-cloudcontrol'),
      sdkDep('@aws-sdk/client-codebuild'),
      sdkDep('@aws-sdk/client-ec2'),
      sdkDep('@aws-sdk/client-ecr'),
      sdkDep('@aws-sdk/client-ecs'),
      sdkDep('@aws-sdk/client-elastic-load-balancing-v2'),
      sdkDep('@aws-sdk/client-iam'),
      sdkDep('@aws-sdk/client-kms'),
      sdkDep('@aws-sdk/client-lambda'),
      sdkDep('@aws-sdk/client-route-53'),
      sdkDep('@aws-sdk/client-s3'),
      sdkDep('@aws-sdk/client-secrets-manager'),
      sdkDep('@aws-sdk/client-sfn'),
      sdkDep('@aws-sdk/client-ssm'),
      sdkDep('@aws-sdk/client-sts'),
      sdkDep('@aws-sdk/credential-providers'),
      sdkDep('@aws-sdk/ec2-metadata-service'),
      sdkDep('@aws-sdk/lib-storage'),
      smithyDep('@smithy/smithy-client'),
      smithyDep('@smithy/middleware-endpoint'),
      smithyDep('@smithy/property-provider'),
      smithyDep('@smithy/shared-ini-file-loader'),
      smithyDep('@smithy/types'),
      smithyDep('@smithy/util-retry'),
      smithyDep('@smithy/util-waiter'),
      'camelcase@^6', // Non-ESM
      cdkAssetsLib,
      'cdk-from-cfn',
      'chalk@^4',
      'chokidar@^4',
      'decamelize@^5', // Non-ESM
      'enquirer',
      'fs-extra@^11',
      'fast-glob',
      'picomatch',
      'p-limit@^3',
      'p-queue@^6',
      'promptly',
      'proxy-agent',
      'semver',
      'strip-ansi@^6',
      'wrap-ansi@^7', // Last non-ESM version
      'yaml@^1',
      'yargs@^15',
    ],
    excludeDepsFromUpgrade: ['aws-cdk-lib'], // this is handled separately further down
    tsconfigDev: {
      compilerOptions: {
        ...defaultTsOptions,
        lib: ['es2022', 'esnext.disposable'],
      },
    },
    eslintOptions: {
      dirs: ['lib'],
      ignorePatterns: ['*.template.ts', '*.d.ts'],
    },
    jestOptions: jestOptionsForProject({
      jestConfig: {
        coverageThreshold: {
          // We want to improve our test coverage
          // DO NOT LOWER THESE VALUES!
          // If you need to break glass, open an issue to re-up the values with additional test coverage
          statements: 81,
          branches: 76,
          functions: 87,
          lines: 81,
        },
        // We have many tests here that commonly time out
        testTimeout: 60_000,
        coveragePathIgnorePatterns: [
          // legacy files
          '<rootDir>/lib/legacy-*.ts',
          '<rootDir>/lib/init-templates/',

          // Files generated by cli-args-gen
          '<rootDir>/lib/cli/parse-command-line-arguments.ts',
          '<rootDir>/lib/cli/user-input.ts',
          '<rootDir>/lib/cli/convert-to-user-input.ts',
        ],
        testEnvironment: './test/_helpers/jest-bufferedconsole.ts',
        setupFilesAfterEnv: ['<rootDir>/test/_helpers/jest-setup-after-env.ts'],
      },
    }),

    nextVersionCommand: 'tsx ../../projenrc/next-version.ts neverMajor maybeRc',

    releasableCommits: transitiveToolkitPackages('aws-cdk'),
  }),
);
cli.with(tools.subprocess);
cli.with(tools.zip);

new pj.javascript.UpgradeDependencies(cli, {
  include: ['aws-cdk-lib'],
  cooldown: 1, // we trust aws-cdk-lib (it's us!) more than other deps, but 1 day wait time is still a good idea
  semanticCommit: 'feat',
  pullRequestTitle: 'upgrade aws-cdk-lib',
  target: 'minor',
  taskName: 'upgrade-aws-cdk-lib',
  workflow: true,
  workflowOptions: {
    schedule: pj.javascript.UpgradeDependenciesSchedule.WEEKDAY,
    labels: ['auto-approve'],
  },
});

new TypecheckTests(cli);
fixupTestTask(cli);

// Eslint rules
cli.eslint?.addRules({
  '@cdklabs/no-throw-default-error': 'error',
});
cli.eslint?.addOverride({
  files: ['./test/**'],
  rules: {
    '@cdklabs/no-throw-default-error': 'off',
    '@typescript-eslint/unbound-method': 'off',
  },
});

// Do include all .ts files inside init-templates
cli.npmignore?.addPatterns('!lib/init-templates/**/*.ts');

// Exclude other scripts and files from the npm package
cli.npmignore?.addPatterns(
  'images/',
  'CONTRIBUTING.md',
  'generate.sh',
);

cli.gitignore.addPatterns(
  ...ADDITIONAL_CLI_IGNORE_PATTERNS,
  '!lib/init-templates/**',
);

// We are exporting some metadata from the CLI to make it more accessible for users.
// Beyond that, this is a CLI package and users MUST NOT use the code directly.
// Instead, they should use @aws-cdk/toolkit-lib.
cli.package.addField('exports', {
  './package.json': './package.json',
  './build-info.json': './build-info.json',

  // Required for some node setups, though unclear why exactly.
  // @see https://github.com/aws/aws-cdk-cli/issues/1263
  './bin/cdk': './bin/cdk',

  // We are keeping the historic bootstrap-template.yaml import path.
  // This could probably be handled better, but is good enough and easy to maintain.
  './lib/api/bootstrap/bootstrap-template.yaml': './lib/api/bootstrap/bootstrap-template.yaml',
});

cli.gitignore.addPatterns('build-info.json');

const cliPackageJson = `${cli.workspaceDirectory}/package.json`;

cli.preCompileTask.prependExec('./generate.sh');
cli.preCompileTask.prependExec('tsx --tsconfig test/tsconfig.json scripts/user-input-gen.ts');

const includeCliResourcesCommands = [
  'cp $(node -p \'require.resolve("cdk-from-cfn/index_bg.wasm")\') ./lib/',
  'cp $(node -p \'require.resolve("@aws-cdk/aws-service-spec/db.json.gz")\') ./',
];

for (const resourceCommand of includeCliResourcesCommands) {
  cli.postCompileTask.exec(resourceCommand);
}

new BundleCli(cli, {
  allowedLicenses: BUNDLED_LICENSES,
  dontAttribute: '^@aws-cdk/|^@cdklabs/|^cdk-assets$',
  test: 'bin/cdk --version',
  entryPoints: [
    'lib/index.js',
  ],
  minifyWhitespace: true,
});

// Exclude takes precedence over include
for (const tsconfig of [cli.tsconfig, cli.tsconfigDev]) {
  tsconfig?.addExclude('lib/init-templates/*/typescript/*/*.template.ts');
  tsconfig?.addExclude('test/integ/cli/sam_cdk_integ_app/**/*');
  tsconfig?.addExclude('vendor/**/*');
}

// #endregion
//////////////////////////////////////////////////////////////////////
// #region cdk

const cdkAliasPackage = configureProject(
  new yarn.TypeScriptWorkspace({
    ...genericCdkProps(),
    parent: repo,
    name: 'cdk',
    description: 'AWS CDK Toolkit',
    srcdir: 'lib',
    deps: [cli.customizeReference({ versionType: 'exact' })],
    nextVersionCommand: `tsx ../../projenrc/next-version.ts copyVersion:../../${cliPackageJson}`,
    releasableCommits: transitiveToolkitPackages('cdk'),
    majorVersion: 2,
  }),
);
void cdkAliasPackage;

// #endregion
//////////////////////////////////////////////////////////////////////
// #region @aws-cdk/integ-runner

const integRunner = configureProject(
  new yarn.TypeScriptWorkspace({
    ...genericCdkProps(),
    parent: repo,
    name: '@aws-cdk/integ-runner',
    description: 'CDK Integration Testing Tool',
    majorVersion: 2,
    srcdir: 'lib',
    deps: [
      cloudAssemblySchema.customizeReference({ versionType: 'any-future' }),
      cloudAssemblyApi.customizeReference({ versionType: 'exact' }),
      cdkAssetsLib.customizeReference({ versionType: 'exact' }),
      cloudFormationDiff.customizeReference({ versionType: 'exact' }),
      toolkitLib.customizeReference({ versionType: 'exact' }),
      'workerpool@^6',
      'chokidar@^4',
      'chalk@^4',
      'fs-extra@^11',
      'yargs@^16',
      'proxy-agent',
      '@aws-cdk/aws-service-spec',
      sdkDep('@aws-sdk/client-cloudformation'),
    ],
    devDeps: [
      'aws-cdk-lib',
      '@types/fs-extra@^11',
      '@types/mock-fs@^4',
      'mock-fs@^5',
      '@types/workerpool@^6',
      '@types/yargs',
      'constructs@^10',
      '@aws-cdk/integ-tests-alpha@2.184.1-alpha.0',
      'ts-node', // integ-runner defaults to ts-node to execute test fixtures
    ],
    tsconfig: {
      compilerOptions: {
        ...toolkitLibTsCompilerOptions,
      },
    },
    jestOptions: jestOptionsForProject({
      jestConfig: {
        coverageThreshold: {
          branches: 79,
        },
      },
    }),
    releasableCommits: transitiveToolkitPackages('@aws-cdk/integ-runner'),
  }),
);
integRunner.gitignore?.addPatterns(
  // Ignore this symlink, we recreate it at test time
  'test/test-archive-follow/data/linked',

  // These files are needed for unit tests
  '!test/test-data/cdk-integ.out*/',

  '!**/*.snapshot/**/asset.*/*.js',
  '!**/*.snapshot/**/asset.*/*.d.ts',
  '!**/*.snapshot/**/asset.*/**',

  'lib/recommended-feature-flags.json',
);
integRunner.tsconfig?.addInclude('lib/*.json');
integRunner.tsconfigDev?.addInclude('lib/*.json');
integRunner.tsconfig?.addInclude('lib/init-templates/*/*/add-project.hook.ts');
integRunner.tsconfig?.addExclude('lib/init-templates/*/typescript/**/*.ts');
integRunner.tsconfig?.addExclude('test/language-tests/**/integ.*.ts');

integRunner.preCompileTask.prependExec('./build-tools/generate.sh');

new TypecheckTests(integRunner);
fixupTestTask(integRunner);

new BundleCli(integRunner, {
  externals: {
    dependencies: [
      '@aws-cdk/aws-service-spec',
    ],
  },
  allowedLicenses: BUNDLED_LICENSES,
  dontAttribute: '^@aws-cdk/|^@cdklabs/|^cdk-assets$',
  test: 'bin/integ-runner --version',
  entryPoints: [
    'lib/index.js',
    'lib/workers/extract/index.js',
  ],
  minifyWhitespace: true,
});

// #endregion
//////////////////////////////////////////////////////////////////////
// #region @aws-cdk-testing/cli-integ

const cliInteg = configureProject(
  new yarn.TypeScriptWorkspace({
    ...genericCdkProps(),
    parent: repo,
    name: '@aws-cdk-testing/cli-integ',
    description: 'Integration tests for the AWS CDK CLI',

    // We set the majorVersion of this to 3.x, so that we can release
    // it already without interfering with the current crop of CDK
    // integ tests.
    majorVersion: 3,

    // For our integ tests we can just release anything, doesn't matter if it
    // is a dependency update or something else. In fact we often incorrectly
    // label changes updates as 'chore' and then our canaries start failing
    // because we didn't release the integ tests package.
    //
    // Cannot be set to `ReleasableCommits.everyCommit()` because that would
    // actually include very commit in the monorepo.
    releasableCommits: pj.ReleasableCommits.exec('git log --no-merges --oneline $LATEST_TAG..HEAD -- .'),

    srcdir: '.',
    libdir: '.',
    deps: [
      '@octokit/rest@^20', // newer versions are ESM only
      sdkDep('@aws-sdk/client-codeartifact'),
      sdkDep('@aws-sdk/client-cloudformation'),
      sdkDep('@aws-sdk/client-dynamodb'),
      sdkDep('@aws-sdk/client-ecr'),
      sdkDep('@aws-sdk/client-ecr-public'),
      sdkDep('@aws-sdk/client-ecs'),
      sdkDep('@aws-sdk/client-iam'),
      sdkDep('@aws-sdk/client-lambda'),
      sdkDep('@aws-sdk/client-s3'),
      sdkDep('@aws-sdk/client-sns'),
      sdkDep('@aws-sdk/client-sso'),
      sdkDep('@aws-sdk/client-ssm'),
      sdkDep('@aws-sdk/client-sts'),
      sdkDep('@aws-sdk/client-secrets-manager'),
      sdkDep('@aws-sdk/credential-providers'),
      smithyDep('@smithy/util-retry'),
      smithyDep('@smithy/types'),
      '@cdklabs/cdk-atmosphere-client',
      'chalk@^4',
      'fs-extra@^11',
      'fast-glob',
      'make-runnable@^1',
      'mockttp@^3',
      'npm@^11',
      'p-queue@^6',
      'semver@^7',
      'sinon@^9',
      'ts-mock-imports@^1',
      'yaml@1',
      'yargs@^16',
      // Jest is a runtime dependency here!
      'jest@^29',
      'jest-junit@^16',
      'ts-jest@^29',
      'proxy-agent',
      'node-pty',
    ],
    devDeps: [
      yarnCling,
      toolkitLib.customizeReference({ versionType: 'exact' }),
      '@types/semver@^7',
      '@types/yargs@^16',
      '@types/fs-extra@^11',
    ],
    bin: {
      'run-suite': 'bin/run-suite',
      'download-and-run-old-tests': 'bin/download-and-run-old-tests',
      'query-github': 'bin/query-github',
      'apply-patches': 'bin/apply-patches',
      'test-root': 'bin/test-root',
      'stage-distribution': 'bin/stage-distribution',
    },
    tsconfig: {
      compilerOptions: {
        ...defaultTsOptions,
        target: 'es2022',
        lib: ['es2022', 'esnext.disposable', 'dom'],
      },
      include: ['**/*.ts'],
      exclude: ['resources/**/*'],
    },
    jestOptions: jestOptionsForProject({
      jestConfig: {
        coverageThreshold: {
          statements: 25,
          lines: 25,
          functions: 10,
          branches: 25,
        },
      },
    }),

    // Append a specific version string for testing
    nextVersionCommand: 'tsx ../../../projenrc/next-version.ts neverMajor maybeRc',
  }),
);
cliInteg.eslint?.addIgnorePattern('resources/**/*.ts');

cliInteg.deps.addDependency('@aws-cdk/toolkit-lib', pj.DependencyType.OPTIONAL);

const compiledDirs = ['tests', 'test', 'lib'];
for (const compiledDir of compiledDirs) {
  cliInteg.gitignore.addPatterns(`${compiledDir}/**/*.js`);
  cliInteg.gitignore.addPatterns(`${compiledDir}/**/*.d.ts`);
}
cliInteg.gitignore.addPatterns('!resources/**/*.js');
cliInteg.npmignore?.addPatterns('!resources/**/*');

cliInteg.postCompileTask.exec('yarn-cling');
cliInteg.gitignore.addPatterns('npm-shrinkwrap.json');

// #endregion
//////////////////////////////////////////////////////////////////////
// #region shared setup

// The pj.github.Dependabot component is only for a single Node project,
// but we need multiple non-Node projects.

// We also want daily dependabot PRs in case they resolve
// security alerts - and those need to be auto-approved as well.

// configure a cooldown period so we don't grab fresh package versions
// that haven't been battletested for security vulnurabilities yet.
// note that for PRs that FIX a security alert, we skip the cooldown
// since those are normally patches on top of already "cold" versions.
const dependabotCooldown = 7;

// for PRs resolving security alerts we accept the shorter standard cooldown
// given those are normally patch versions on top of already "cold" versions.
const dependabotSecurityCooldown = DEPENDENCY_COOLDOWN;

new pj.YamlFile(repo, '.github/dependabot.yml', {
  obj: {
    version: 2,
    updates: [
      {
        'package-ecosystem': 'npm',
        'schedule': { interval: 'daily' },
        'cooldown': {
          'default-days': dependabotSecurityCooldown,
        },
        // disable version updates, leaving only security updates.
        // see https://docs.github.com/en/code-security/how-tos/secure-your-supply-chain/secure-your-dependencies/configure-security-updates#overriding-the-default-behavior-with-a-configuration-file
        'open-pull-requests-limit': 0,
        'labels': ['auto-approve'],
        'ignore': repoProject.subprojects
          .map(p => ({ 'dependency-name': p.name }))
          .sort((a, b) => a['dependency-name'].localeCompare(b['dependency-name'])),
        'directories': ['/', ...repoProject.node.children
          .filter(child => child instanceof TypeScriptWorkspace)
          .map(ts => `/${path.relative(repoProject.outdir, ts.outdir)}`)
          .sort()],
      },
      // init-templates
      ...['pip', 'maven', 'nuget'].map((pkgEco) => ({
        'package-ecosystem': pkgEco,
        'directory': '/packages/aws-cdk/lib/init-templates',
        'schedule': { interval: 'weekly' },
        'cooldown': {
          'default-days': dependabotCooldown,
        },
        'labels': ['auto-approve'],
        'open-pull-requests-limit': 5,
      })),
    ],
  },
  committed: true,
});

// By default, projen ignores any directories named 'logs', but we have a source directory
// like that in the CLI (https://github.com/projen/projen/issues/4059).
for (const gi of [repo.gitignore, cli.gitignore]) {
  gi.removePatterns('logs');
}
const APPROVAL_ENVIRONMENT = 'integ-approval';
const TEST_ENVIRONMENT = 'run-tests';

new CdkCliIntegTestsWorkflow(repo, {
  sourceRepo: 'aws/aws-cdk-cli',
  approvalEnvironment: APPROVAL_ENVIRONMENT,
  testEnvironment: TEST_ENVIRONMENT,
  buildRunsOn: POWERFUL_RUNNER,
  testRunsOn: POWERFUL_RUNNER,

  allowUpstreamVersions: [
    // cloud-assembly-schema gets referenced under multiple versions
    // - Candidate version for cdk-assets
    // - Previously released version for aws-cdk-lib
    cloudAssemblySchema,

    // toolkit-lib can get referenced under multiple versions,
    // and during the 0.x period most likely *will*.
    // - The Amplify CLI will only depend on versions that are already published.
    //   These can be `0.3.2` or `^1`. We can't hijack the NPM install so this has to
    //   resolve to a proper version.
    // - If they use `^1` then our prerelease version will be automatically installed...
    //   unless we are releasing a breaking change, in which case they will depend
    //   on `^1` but we will be testing `2.0.999`, so the upstream still needs to
    //   be available to make this test succeed.
    toolkitLib,

    // The `tool-integrations` job installs the amplify-cli package,
    // which depends on @aws-cdk/cloudformation-diff and @aws-cdk/cloud-assembly-api
    // as a transitive dependency through toolkit-lib.
    // Since we are not enforcing the use of the local version of toolkit-lib in this test,
    // it might attempt to install a version of these that's not locally available.
    cloudFormationDiff,
    cloudAssemblyApi,
  ],
  enableAtmosphere: {
    oidcRoleArn: '${{ vars.CDK_ATMOSPHERE_PROD_OIDC_ROLE }}',
    endpoint: '${{ vars.CDK_ATMOSPHERE_PROD_ENDPOINT }}',
    pool: '${{ vars.CDK_INTEG_ATMOSPHERE_POOL }}',
  },
  additionalNodeVersionsToTest: [
    '20', '22', '24',
  ],
});

new CodeCovWorkflow(repo, {
  restrictToRepos: ['aws/aws-cdk-cli'],
  packages: [cli.name],
});

new IssueLabeler(repo);
new IssueRegressionLabeler(repo);
new PrLabeler(repo);

new LargePrChecker(repo, {
  excludeFiles: ['*.md', '*.test.ts', '*.yml', '*.lock', '*THIRD_PARTY_LICENSES'],
});

// Set allowed scopes based on monorepo packages
const disallowed = new Set([
  'cdk', // use aws-cdk or cli
  'user-input-gen', // use cli
]);
repoProject.github?.tryFindWorkflow('pull-request-lint')?.file?.patch(
  pj.JsonPatch.replace('/jobs/validate/steps/0/with/scopes', [
    'cli',
    'deps',
    'dev-deps', // projen
    'deps-dev', // dependabot
    'docs',
    'bootstrap',
    'integ-testing',
    ...repoProject.subprojects
      .filter(p => p instanceof yarn.TypeScriptWorkspace)
      .map(p => p.name)
      .map(n => n.split('/').pop()),
  ].filter(s => s && !disallowed.has(s)).sort().join('\n')),
);

// enforce same node types everywhere
[repo, ...repo.subprojects].forEach(p => p.addDevDeps('@types/node@^20'));

(repo
  .with(new YarnVersion('4.17.1')) as yarn.Monorepo)
  .synth();

// #endregion