fix(cli-internal): externalize Gen1 Lambda layer /opt/* requires in gen2-migration

[sarayev]

Problem

Gen1→Gen2 migration dropped Lambda layer handling entirely. When a Gen1 function's code references a Lambda layer via a /opt/<layer> runtime path (e.g. require('/opt/GQLUtilities')), the migration tool:

1. did not migrate the Gen1 Lambda layer package into any Gen2 layer definition, and
2. did not externalize the /opt/* requires in the generated defineFunction config.

As a result the generated Gen2 app fails at CDK asset bundling — esbuild cannot resolve /opt/* and the deploy fails with FailedToBundleAsset. Observed on customer app bpedsys (ticket V2205182405), whose migrated functions contained require("/opt/GQLUtilities").

Root cause (exact gap)

packages/amplify-cli/src/commands/gen2-migration/generate/amplify/function/function.generator.ts — FunctionGenerator.plan() built the FunctionRenderOptions (env vars, runtime, schedule, triggers, IAM grants…) but never inspected the function source for /opt/* layer imports and never emitted a layers map. There was zero layer//opt/ handling anywhere under gen2-migration/.

@aws-amplify/backend-function's factory computes esbuild externals as externalModules = Object.keys(props.layers), so populating defineFunction({ layers }) with a /opt/<layer> key is exactly what externalizes the module and unblocks bundling.

Fix (this PR — minimal, build-unblocking)

• Detect: FunctionGenerator.detectLayerModules() scans the Gen1 function source (amplify/backend/function/<name>/src, recursive, skips node_modules, .js/.jsx/.ts/.tsx/.mjs/.cjs) for require()/import()/import … from '/opt/<layer>' and normalizes each to its layer root /opt/<layer> (deduped).
• Externalize: FunctionRenderer.renderLayers() emits a layers map inside defineFunction, keyed by each /opt/<layer> module, with a REPLACE_WITH_LAYER_VERSION_ARN placeholder value and a // TODO comment (link to the layers docs). The key makes esbuild externalize the module → the build now succeeds.
• Warn: a migration warning is surfaced both in the plan's Operations Summary (describe()) and via logger.warn during execution, telling the developer to replace the placeholder ARN(s) and noting that the Gen1 layer package itself is not migrated automatically.

Scope / follow-up (honest boundaries)

This PR fixes the build-breaking externalization gap so migrated apps build with a single, clearly-documented manual step (supply the layer ARN). It does not migrate the Gen1 layer code (function/<layer>/opt/*) into a Gen2 custom CDK LayerVersion and auto-wire it — that is a larger, riskier change recommended as a follow-up PR.

Tests

Added unit tests in function.generator.test.ts using real on-disk Gen1 function fixtures (temp cwd, no mocking of the detection path):

• externalizes /opt/* requires via the layers map (and asserts it renders inside defineFunction, before the escape-hatch fn);
• normalizes nested + multiple /opt/* imports to unique layer roots (no duplicate keys);
• emits the migration warning in describe();
• no-op when the function has no /opt/* imports (no layers map, no warning).

Local results

• function.generator.test.ts: 27 passed (23 pre-existing + 4 new), no snapshot changes.
• Full gen2-migration/generate suite: 233 passed / 21 suites, zero regressions.
• tsc --noEmit on the package: clean.

🤖 Draft PR opened via Roko.