fix(amplify-graphql-api-construct-tests): pin cdk init CLI and type e2e lambda scaffolds

Fixes the deterministic custom_query_mutation_extension and admin_role e2e failures.

The e2e scratch-project scaffolder pinned aws-cdk-lib but ran `npx cdk init` with a
floating CLI. The upstream template has since changed the cdk.json synth command from
`npx ts-node --prefer-ts-exts bin/app.ts` to `npx tsc && npx tsx bin/app.ts` on
TypeScript ~7.0 with strict/noImplicitAny and no tsconfig include, so synth now begins
with a whole-project typecheck of every .ts in the scratch project.

Backend templates are copied wholesale into bin/, including lambda entry points that are
only ever referenced by esbuild as a path string and never imported by app.ts. Those files
are now typechecked from a directory they were never written to resolve from, failing
before synth:
  - custom-query-mutation-extension/authorizer.ts:1:26  TS7006 (untyped event)
  - admin-role/apiInvoker.ts:6:51  TS2307 ('../../../lambda-request' escapes the project)

- Pin the aws-cdk CLI so the template cannot drift again. The CLI and aws-cdk-lib have
  used separate version lines since CLI v2.1000.0, so the CLI is pinned to its own
  constant rather than to cdkVersion (no aws-cdk release matches aws-cdk-lib 2.260.0,
  and cdkVersion may legitimately be 'latest').
- Drop the whole-project typecheck from the generated synth command, restoring the
  historical behavior where synth only loads the app's import graph. The runtime
  invocation is unchanged.
- Type the authorizer handler event, and inline the response type in apiInvoker.ts so the
  bundled lambda entry is self-contained. All previously exported names remain exported.

Author: Simone319

packages/amplify-graphql-api-construct-tests/src/__tests__/backends/admin-role/apiInvoker.ts

@@ -3,7 +3,24 @@ import { defaultProvider } from '@aws-sdk/credential-provider-node';
 import { SignatureV4 } from '@aws-sdk/signature-v4';
 import { HttpRequest } from '@aws-sdk/protocol-http';
 import { default as fetch, Request } from 'node-fetch';
-import type { GraphqlProxiedLambdaResponse } from '../../../lambda-request';
+
+/**
+ * Shape of the response this lambda returns to callers.
+ *
+ * Intentionally declared inline rather than imported from the test helpers: this file is bundled as a standalone lambda entry point and is
+ * copied into a scratch CDK project, so any relative import reaching outside its own directory cannot be resolved.
+ */
+export type GraphqlProxiedLambdaResponse<ResponseDataType> = {
+  statusCode: number;
+  body: {
+    errors: Array<{
+      status?: number;
+      message: string;
+      stack: string[];
+    }>;
+    data: ResponseDataType;
+  };
+};
 
 if (!process.env.GRAPHQL_URL) throw new Error('GRAPHQL_URL not found in environment variables');
 const graphqlEndpoint = new URL(process.env.GRAPHQL_URL);

packages/amplify-graphql-api-construct-tests/src/__tests__/backends/custom-query-mutation-extension/authorizer.ts

@@ -1,4 +1,8 @@
-exports.handler = async (event) => {
+type CustomAuthorizerEvent = {
+  authorizationToken?: string;
+};
+
+exports.handler = async (event: CustomAuthorizerEvent) => {
   const { authorizationToken } = event;
   const response = {
     isAuthorized: authorizationToken === 'custom-authorized',

packages/amplify-graphql-api-construct-tests/src/commands.ts

@@ -65,6 +65,38 @@ const appendToCDKContext = (projectPath: string, additionalContext: Record<strin
   writeFileSync(cdkJsonPath, JSON.stringify(cdkJson, null, 2));
 };
 
+/**
+ * Pinned version of the `aws-cdk` CLI used to scaffold e2e test projects.
+ *
+ * The CLI must be pinned independently of `aws-cdk-lib`: the two have used separate version lines since CLI v2.1000.0, so there is no
+ * `aws-cdk` release matching a modern `aws-cdk-lib` version. Leaving the CLI floating means `cdk init` silently picks up upstream template
+ * changes, which has broken e2e groups before (the template switched the synth command from `ts-node` to `tsc && tsx`, turning synth into a
+ * whole-project typecheck).
+ */
+const CDK_CLI_VERSION = '2.1134.0';
+
+/**
+ * Removes the whole-project `tsc` typecheck from the generated `cdk.json` synth command.
+ *
+ * Backend templates are copied wholesale into the scratch project's `bin/` directory, and some of those files are lambda entry points that
+ * are only ever referenced by esbuild as a path string -- they are never imported by `app.ts`. A whole-project typecheck compiles them
+ * anyway, in a directory they were never written to resolve from, failing synth before it starts. Transpiling only the import graph (the
+ * historical behavior) keeps synth scoped to code the app actually loads.
+ */
+const removeWholeProjectTypecheckFromSynth = (projectPath: string): void => {
+  const cdkJsonPath = path.join(projectPath, 'cdk.json');
+  const cdkJson = JSON.parse(readFileSync(cdkJsonPath, 'utf-8'));
+  if (typeof cdkJson.app !== 'string') {
+    return;
+  }
+  const appWithoutTypecheck = cdkJson.app.replace(/^\s*npx\s+tsc\s*&&\s*/, '');
+  if (appWithoutTypecheck === cdkJson.app) {
+    return;
+  }
+  cdkJson.app = appWithoutTypecheck;
+  writeFileSync(cdkJsonPath, JSON.stringify(cdkJson, null, 2));
+};
+
 export type InitCDKProjectProps = {
   construct?: CdkConstruct;
   cdkContext?: Record<string, string>;
@@ -82,7 +114,7 @@ export type InitCDKProjectProps = {
 export const initCDKProject = async (cwd: string, templatePath: string, props?: InitCDKProjectProps): Promise<string> => {
   const { cdkVersion = '2.260.0', additionalDependencies = [] } = props ?? {};
 
-  await spawn(getNpxPath(), ['cdk', 'init', 'app', '--language', 'typescript'], {
+  await spawn(getNpxPath(), [`aws-cdk@${CDK_CLI_VERSION}`, 'init', 'app', '--language', 'typescript'], {
     cwd,
     stripColors: true,
     // npx cdk does not work on verdaccio
@@ -93,6 +125,8 @@ export const initCDKProject = async (cwd: string, templatePath: string, props?:
     .sendYes()
     .runAsync();
 
+  removeWholeProjectTypecheckFromSynth(cwd);
+
   if (props?.cdkContext) {
     appendToCDKContext(cwd, props.cdkContext);
   }