@aws/nx-plugin 1.0.0-rc.6 → 1.0.0-rc.61

package/src/migrations/latest/py-agent-lifespan-construction/migration.js

@@ -0,0 +1,412 @@
+/**
+ * Copyright Amazon.com, Inc. or its affiliates. All Rights Reserved.
+ * SPDX-License-Identifier: Apache-2.0
+ */ import { getProjects, joinPathFragments } from "@nx/devkit";
+import { PY_AGENT_GENERATOR_INFO } from "../../../py/agent/generator.js";
+import { addPythonDestructuredImport, applyGritQL, captureGritQLVariable, matchGritQL } from "../../../utils/ast.js";
+import { formatFilesInSubtree } from "../../../utils/format.js";
+/**
+ * Move py#agent HTTP/AG-UI agent construction out of module import time and
+ * into a FastAPI `lifespan` handler, stored on `app.state`.
+ *
+ * Building the agent eagerly at import time breaks any codepath that imports
+ * the module before `RUNTIME_CONFIG_APP_ID`/AgentCore env vars are set (e.g.
+ * OpenAPI spec generation, tests) - and, for AgentCore, construction belongs
+ * at container/app startup rather than import, since AgentCore hands each
+ * session its own container. The A2A protocol is unaffected: `with_session_id`
+ * only touches the agent factory lazily on first use, so its eager
+ * `__enter__()` was never actually eager in practice.
+ *
+ * How to write a migration:
+ * - https://nx.dev/docs/kb/migration-generators
+ * - What `nextSteps` means: https://nx.dev/docs/reference/devkit/MigrationReturnObject
+ *
+ * Guardrails:
+ * - Pattern-match before writing: every rewrite this migration makes to a file
+ *   is preceded by a read-only `matchGritQL` check of every pattern it will
+ *   need - so a diverged file is reported via `nextSteps` and left completely
+ *   untouched, rather than partially rewritten into a broken state.
+ * - Idempotent: re-running must be a no-op (each rewrite's own shape change
+ *   means its pattern no longer matches on a second pass).
+ * - Format what you write: finish with `formatFilesInSubtree`.
+ */ /** A read-only GritQL match against a python file (no rewrite). */ const pyMatch = (snippet)=>`language python\n\`${snippet}\``;
+/** A GritQL rewrite deleting the matched python snippet entirely. */ const pyDelete = (snippet)=>`${pyMatch(snippet)} => .`;
+/**
+ * A GritQL rewrite of one python snippet into another. Multi-line
+ * replacements go through `raw` so GritQL's own reformatting doesn't fight
+ * the exact shape being written (formatFilesInSubtree normalizes it after).
+ */ const pyRewrite = (from, to, where)=>{
+    const replacement = to.includes('\n') ? `raw\`${to}\`` : `\`${to}\``;
+    return `${pyMatch(from)} => ${replacement}${where ? ` where { ${where} }` : ''}`;
+};
+/** All checks must match before anything is written for that agent. */ const allMatch = async (tree, checks)=>{
+    for (const [filePath, pattern] of checks){
+        if (!await matchGritQL(tree, filePath, pattern)) return false;
+    }
+    return true;
+};
+const AGENT_CONNECTION_MODULE_PATTERN = (names)=>pyMatch(`from $mod import ${names}`);
+const STRANDS_HTTP_MARKER = '_agent_ctx = with_session_id(';
+const LANGCHAIN_HTTP_MARKER = '_graph = get_agent()';
+const STRANDS_AGUI_MARKER = 'create_strands_app';
+const LANGCHAIN_AGUI_MARKER = '_graph = get_agent()';
+// Shared by strands/http and langchain/http - only the lifespan body differs.
+const HTTP_INIT_APP_OLD = `app = FastAPI(
+    title="$name",
+    responses={500: {"model": InternalServerErrorDetails}},
+    generate_unique_id_function=lambda route: route.name,
+)`;
+// --- Strands HTTP -----------------------------------------------------------
+const STRANDS_HTTP_MAIN_CTX_OLD = `_agent_ctx = with_session_id(
+    get_agent,
+    name="$name",
+    description="A Strands Agent exposed via HTTP streaming.",
+)`;
+const STRANDS_HTTP_INIT_APP_NEW = `@asynccontextmanager
+async def lifespan(app: FastAPI):
+    with with_session_id(
+        get_agent,
+        name="$name",
+        description="A Strands Agent exposed via HTTP streaming.",
+    ) as agent:
+        app.state.agent = agent
+        yield
+
+
+app = FastAPI(
+    title="$name",
+    responses={500: {"model": InternalServerErrorDetails}},
+    generate_unique_id_function=lambda route: route.name,
+    lifespan=lifespan,
+)`;
+const migrateStrandsHttpAgent = async (tree, dir, nextSteps)=>{
+    const initPath = joinPathFragments(dir, 'init.py');
+    const mainPath = joinPathFragments(dir, 'main.py');
+    if (!tree.exists(initPath) || !tree.exists(mainPath)) return;
+    const mainContents = tree.read(mainPath, 'utf-8') ?? '';
+    if (!mainContents.includes(STRANDS_HTTP_MARKER)) return;
+    const mod = await captureGritQLVariable(tree, mainPath, AGENT_CONNECTION_MODULE_PATTERN('session_id_context, with_session_id'), 'mod');
+    const ready = !!mod && await allMatch(tree, [
+        [
+            mainPath,
+            pyMatch(STRANDS_HTTP_MAIN_CTX_OLD)
+        ],
+        [
+            mainPath,
+            pyMatch('_agent = _agent_ctx.__enter__()')
+        ],
+        [
+            mainPath,
+            pyMatch('from .agent import get_agent')
+        ],
+        [
+            mainPath,
+            pyMatch('_agent.stream_async($prompt)')
+        ],
+        [
+            initPath,
+            pyMatch(HTTP_INIT_APP_OLD)
+        ]
+    ]);
+    if (!ready) {
+        nextSteps.push(`${mainPath}: diverged from the generated shape - left untouched, along with ${initPath}. Manually move agent construction into an \`init.py\` \`lifespan\` handler storing the agent on \`app.state.agent\` (see the py#agent generator's strands/http template).`);
+        return;
+    }
+    await addPythonDestructuredImport(tree, initPath, [
+        'asynccontextmanager'
+    ], 'contextlib');
+    await addPythonDestructuredImport(tree, initPath, [
+        'get_agent'
+    ], '.agent');
+    await addPythonDestructuredImport(tree, initPath, [
+        'with_session_id'
+    ], mod);
+    await applyGritQL(tree, initPath, pyRewrite(HTTP_INIT_APP_OLD, STRANDS_HTTP_INIT_APP_NEW));
+    await applyGritQL(tree, mainPath, pyRewrite('from $mod import session_id_context, with_session_id', 'from $mod import session_id_context'));
+    await applyGritQL(tree, mainPath, pyDelete('from .agent import get_agent'));
+    await applyGritQL(tree, mainPath, pyDelete(STRANDS_HTTP_MAIN_CTX_OLD));
+    await applyGritQL(tree, mainPath, pyDelete('_agent = _agent_ctx.__enter__()'));
+    await applyGritQL(tree, mainPath, pyRewrite('_agent.stream_async($prompt)', 'app.state.agent.stream_async($prompt)'));
+};
+// --- LangChain HTTP ----------------------------------------------------------
+const LANGCHAIN_HTTP_INIT_APP_NEW = `@asynccontextmanager
+async def lifespan(app: FastAPI):
+    app.state.graph = get_agent()
+    yield
+
+
+app = FastAPI(
+    title="$name",
+    responses={500: {"model": InternalServerErrorDetails}},
+    generate_unique_id_function=lambda route: route.name,
+    lifespan=lifespan,
+)`;
+const migrateLangchainHttpAgent = async (tree, dir, nextSteps)=>{
+    const initPath = joinPathFragments(dir, 'init.py');
+    const mainPath = joinPathFragments(dir, 'main.py');
+    if (!tree.exists(initPath) || !tree.exists(mainPath)) return;
+    const mainContents = tree.read(mainPath, 'utf-8') ?? '';
+    if (!mainContents.includes(LANGCHAIN_HTTP_MARKER)) return;
+    const ready = await allMatch(tree, [
+        [
+            mainPath,
+            pyMatch('_graph = get_agent()')
+        ],
+        [
+            mainPath,
+            pyMatch('from .agent import get_agent')
+        ],
+        [
+            mainPath,
+            pyMatch('_graph.astream($args)')
+        ],
+        [
+            initPath,
+            pyMatch(HTTP_INIT_APP_OLD)
+        ]
+    ]);
+    if (!ready) {
+        nextSteps.push(`${mainPath}: diverged from the generated shape - left untouched, along with ${initPath}. Manually wrap \`get_agent()\` in an \`init.py\` \`lifespan\` handler storing the graph on \`app.state.graph\` (see the py#agent generator's langchain/http template).`);
+        return;
+    }
+    await addPythonDestructuredImport(tree, initPath, [
+        'asynccontextmanager'
+    ], 'contextlib');
+    await addPythonDestructuredImport(tree, initPath, [
+        'get_agent'
+    ], '.agent');
+    await applyGritQL(tree, initPath, pyRewrite(HTTP_INIT_APP_OLD, LANGCHAIN_HTTP_INIT_APP_NEW));
+    await applyGritQL(tree, mainPath, pyDelete('from .agent import get_agent'));
+    await applyGritQL(tree, mainPath, pyDelete('_graph = get_agent()'));
+    await applyGritQL(tree, mainPath, pyRewrite('_graph.astream($args)', 'app.state.graph.astream($args)'));
+};
+// --- LangChain AG-UI ---------------------------------------------------------
+const LANGCHAIN_AGUI_AGENT_OLD = `agui_agent = LangGraphAgent(
+    name="$name",
+    graph=_graph,
+    description="A LangChain/LangGraph Agent exposed via the AG-UI protocol.",
+)`;
+const LANGCHAIN_AGUI_AGENT_NEW = `@asynccontextmanager
+async def lifespan(app: FastAPI):
+    graph = get_agent()
+    app.state.agui_agent = LangGraphAgent(
+        name="$name",
+        graph=graph,
+        description="A LangChain/LangGraph Agent exposed via the AG-UI protocol.",
+    )
+    yield`;
+const migrateLangchainAgUiAgent = async (tree, dir, nextSteps)=>{
+    const mainPath = joinPathFragments(dir, 'main.py');
+    if (!tree.exists(mainPath)) return;
+    const mainContents = tree.read(mainPath, 'utf-8') ?? '';
+    if (!mainContents.includes(LANGCHAIN_AGUI_MARKER)) return;
+    const ready = await allMatch(tree, [
+        [
+            mainPath,
+            pyMatch('_graph = get_agent()')
+        ],
+        [
+            mainPath,
+            pyMatch(LANGCHAIN_AGUI_AGENT_OLD)
+        ],
+        [
+            mainPath,
+            pyMatch('agui_agent.run($input)')
+        ],
+        [
+            mainPath,
+            pyMatch('app = FastAPI(title="$name")')
+        ]
+    ]);
+    if (!ready) {
+        nextSteps.push(`${mainPath}: diverged from the generated shape - left untouched. Manually wrap graph + \`LangGraphAgent\` construction in a \`lifespan\` handler storing the wrapper on \`app.state.agui_agent\` (see the py#agent generator's langchain/ag-ui template).`);
+        return;
+    }
+    await addPythonDestructuredImport(tree, mainPath, [
+        'asynccontextmanager'
+    ], 'contextlib');
+    await applyGritQL(tree, mainPath, pyDelete('_graph = get_agent()'));
+    await applyGritQL(tree, mainPath, pyRewrite(LANGCHAIN_AGUI_AGENT_OLD, LANGCHAIN_AGUI_AGENT_NEW));
+    await applyGritQL(tree, mainPath, pyRewrite('agui_agent.run($input)', 'request.app.state.agui_agent.run($input)'));
+    await applyGritQL(tree, mainPath, pyRewrite('app = FastAPI(title="$name")', 'app = FastAPI(title="$name", lifespan=lifespan)'));
+};
+// --- Strands AG-UI -----------------------------------------------------------
+// The biggest of the four: `ag_ui_strands.create_strands_app` is dropped
+// entirely for an inlined FastAPI app (matching upstream `ag_ui_strands`,
+// plus a Content-Type-independent body-parsing fix and an explicit session
+// re-bind `create_strands_app` was missing), so most of the file is new.
+const STRANDS_AGUI_IMPORT_OLD = 'from ag_ui_strands import StrandsAgent, create_strands_app';
+const STRANDS_AGUI_AGENT_OLD = `agui_agent = StrandsAgent(
+    agent=_agent,
+    name="$name",
+    description="A Strands Agent exposed via the AG-UI protocol.",
+)`;
+const STRANDS_AGUI_AGENT_NEW = `@asynccontextmanager
+async def lifespan(app: FastAPI):
+    with get_agent() as agent:
+        app.state.agui_agent = StrandsAgent(
+            agent=agent,
+            name="$name",
+            description="A Strands Agent exposed via the AG-UI protocol.",
+        )
+        yield`;
+const STRANDS_AGUI_APP_OLD = 'app = create_strands_app(agui_agent, path="/invocations")';
+// `$name` isn't bound within this match (unlike STRANDS_AGUI_AGENT_OLD above),
+// so the title is built from a name captured separately rather than reused as
+// a metavariable - GritQL leaves a rewrite whose replacement references an
+// unbound metavariable unapplied.
+const strandsAguiAppNew = (name)=>`app = FastAPI(title="AWS Strands - ${name}", lifespan=lifespan)
+app.add_middleware(
+    CORSMiddleware,
+    allow_origins=["*"],
+    allow_credentials=True,
+    allow_methods=["*"],
+    allow_headers=["*"],
+)`;
+const STRANDS_AGUI_MIDDLEWARE_OLD = 'app.add_middleware(_SessionIdMiddleware)';
+const STRANDS_AGUI_ROUTES_NEW = `app.add_middleware(_SessionIdMiddleware)
+
+
+@app.post("/invocations")
+async def invocations(request: Request):
+    # Validate the body manually since AgentCore may omit Content-Type.
+    encoder = EventEncoder(accept=request.headers.get("accept") or "")
+    raw = await request.body()
+    try:
+        input_data = RunAgentInput.model_validate_json(raw)
+    except Exception as exc:
+        message = f"Invalid RunAgentInput: {str(exc)[:200]}"
+
+        async def _bad():
+            yield encoder.encode(RunErrorEvent(type=EventType.RUN_ERROR, message=message, code="BAD_REQUEST"))
+
+        return StreamingResponse(_bad(), media_type=encoder.get_content_type())
+
+    session_id = request.headers.get(SESSION_ID_HEADER) or get_current_session_id()
+
+    async def event_generator():
+        # Re-bind the session: the streaming body runs outside the middleware.
+        with session_id_context(session_id or str(uuid.uuid4())):
+            async for event in request.app.state.agui_agent.run(input_data):
+                try:
+                    yield encoder.encode(event)
+                except Exception as e:
+                    error_event = RunErrorEvent(
+                        type=EventType.RUN_ERROR,
+                        message=f"Encoding error: {e}",
+                        code="ENCODING_ERROR",
+                    )
+                    yield encoder.encode(error_event)
+                    break
+
+    return StreamingResponse(event_generator(), media_type=encoder.get_content_type())
+
+
+@app.get("/ping")
+async def ping():
+    return {"status": "healthy"}`;
+const STRANDS_AGUI_COMMENTS_OLD = [
+    '# Create AG-UI agent wrapper',
+    '# Create FastAPI app with AG-UI endpoint and health check'
+];
+const migrateStrandsAgUiAgent = async (tree, dir, nextSteps)=>{
+    const mainPath = joinPathFragments(dir, 'main.py');
+    if (!tree.exists(mainPath)) return;
+    const mainContents = tree.read(mainPath, 'utf-8') ?? '';
+    if (!mainContents.includes(STRANDS_AGUI_MARKER)) return;
+    const mod = await captureGritQLVariable(tree, mainPath, AGENT_CONNECTION_MODULE_PATTERN('session_id_context'), 'mod');
+    const agentClassName = await captureGritQLVariable(tree, mainPath, pyMatch(STRANDS_AGUI_AGENT_OLD), 'name');
+    const ready = !!mod && !!agentClassName && await allMatch(tree, [
+        [
+            mainPath,
+            pyMatch(STRANDS_AGUI_IMPORT_OLD)
+        ],
+        [
+            mainPath,
+            pyMatch('_agent_ctx = get_agent()')
+        ],
+        [
+            mainPath,
+            pyMatch('_agent = _agent_ctx.__enter__()')
+        ],
+        [
+            mainPath,
+            pyMatch(STRANDS_AGUI_AGENT_OLD)
+        ],
+        [
+            mainPath,
+            pyMatch(STRANDS_AGUI_APP_OLD)
+        ],
+        [
+            mainPath,
+            pyMatch(STRANDS_AGUI_MIDDLEWARE_OLD)
+        ]
+    ]);
+    if (!ready) {
+        nextSteps.push(`${mainPath}: diverged from the generated shape - left untouched. Manually rebuild this file without \`create_strands_app\`: a \`lifespan\` handler storing the wrapper on \`app.state.agui_agent\`, and inlined \`/invocations\`/\`/ping\` routes with Content-Type-independent body parsing (see the py#agent generator's strands/ag-ui template).`);
+        return;
+    }
+    await addPythonDestructuredImport(tree, mainPath, [
+        'asynccontextmanager'
+    ], 'contextlib');
+    await addPythonDestructuredImport(tree, mainPath, [
+        'EventType',
+        'RunAgentInput',
+        'RunErrorEvent'
+    ], 'ag_ui.core');
+    await addPythonDestructuredImport(tree, mainPath, [
+        'EventEncoder'
+    ], 'ag_ui.encoder');
+    await addPythonDestructuredImport(tree, mainPath, [
+        'FastAPI'
+    ], 'fastapi');
+    await addPythonDestructuredImport(tree, mainPath, [
+        'CORSMiddleware'
+    ], 'fastapi.middleware.cors');
+    await addPythonDestructuredImport(tree, mainPath, [
+        'StreamingResponse'
+    ], 'fastapi.responses');
+    await addPythonDestructuredImport(tree, mainPath, [
+        'get_current_session_id'
+    ], mod);
+    await applyGritQL(tree, mainPath, pyRewrite(STRANDS_AGUI_IMPORT_OLD, 'from ag_ui_strands import StrandsAgent'));
+    await applyGritQL(tree, mainPath, pyDelete('_agent_ctx = get_agent()'));
+    await applyGritQL(tree, mainPath, pyDelete('_agent = _agent_ctx.__enter__()'));
+    await applyGritQL(tree, mainPath, pyRewrite(STRANDS_AGUI_AGENT_OLD, STRANDS_AGUI_AGENT_NEW));
+    for (const comment of STRANDS_AGUI_COMMENTS_OLD){
+        await applyGritQL(tree, mainPath, pyDelete(comment));
+    }
+    await applyGritQL(tree, mainPath, pyRewrite(STRANDS_AGUI_APP_OLD, strandsAguiAppNew(agentClassName)));
+    await applyGritQL(tree, mainPath, pyRewrite(STRANDS_AGUI_MIDDLEWARE_OLD, STRANDS_AGUI_ROUTES_NEW));
+};
+/** This agent's ComponentMetadata entries. */ const findAgentComponents = (components)=>(components ?? []).filter((component)=>component.generator === PY_AGENT_GENERATOR_INFO.id);
+export default async function migration(tree) {
+    const nextSteps = [];
+    for (const project of getProjects(tree).values()){
+        const components = findAgentComponents(project.metadata?.components);
+        for (const component of components){
+            if (!component.path) continue;
+            const dir = joinPathFragments(project.root, component.path);
+            const framework = component.framework ?? 'strands';
+            if (component.protocol === 'http') {
+                if (framework === 'langchain') {
+                    await migrateLangchainHttpAgent(tree, dir, nextSteps);
+                } else {
+                    await migrateStrandsHttpAgent(tree, dir, nextSteps);
+                }
+            } else if (component.protocol === 'ag-ui') {
+                if (framework === 'langchain') {
+                    await migrateLangchainAgUiAgent(tree, dir, nextSteps);
+                } else {
+                    await migrateStrandsAgUiAgent(tree, dir, nextSteps);
+                }
+            }
+        }
+    }
+    await formatFilesInSubtree(tree);
+    return {
+        nextSteps
+    };
+}
+
+//# sourceMappingURL=migration.js.map

package/src/migrations/latest/py-agent-lifespan-construction/migration.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../../../../../../../packages/nx-plugin/src/migrations/latest/py-agent-lifespan-construction/migration.ts"],"sourcesContent":["/**\n * Copyright Amazon.com, Inc. or its affiliates. All Rights Reserved.\n * SPDX-License-Identifier: Apache-2.0\n */\nimport {\n  getProjects,\n  joinPathFragments,\n  type MigrationReturnObject,\n  type Tree,\n} from '@nx/devkit';\nimport { PY_AGENT_GENERATOR_INFO } from '../../../py/agent/generator';\nimport {\n  addPythonDestructuredImport,\n  applyGritQL,\n  captureGritQLVariable,\n  matchGritQL,\n} from '../../../utils/ast';\nimport { formatFilesInSubtree } from '../../../utils/format';\nimport type { ComponentMetadata } from '../../../utils/nx';\n\n/**\n * Move py#agent HTTP/AG-UI agent construction out of module import time and\n * into a FastAPI `lifespan` handler, stored on `app.state`.\n *\n * Building the agent eagerly at import time breaks any codepath that imports\n * the module before `RUNTIME_CONFIG_APP_ID`/AgentCore env vars are set (e.g.\n * OpenAPI spec generation, tests) - and, for AgentCore, construction belongs\n * at container/app startup rather than import, since AgentCore hands each\n * session its own container. The A2A protocol is unaffected: `with_session_id`\n * only touches the agent factory lazily on first use, so its eager\n * `__enter__()` was never actually eager in practice.\n *\n * How to write a migration:\n * - https://nx.dev/docs/kb/migration-generators\n * - What `nextSteps` means: https://nx.dev/docs/reference/devkit/MigrationReturnObject\n *\n * Guardrails:\n * - Pattern-match before writing: every rewrite this migration makes to a file\n *   is preceded by a read-only `matchGritQL` check of every pattern it will\n *   need - so a diverged file is reported via `nextSteps` and left completely\n *   untouched, rather than partially rewritten into a broken state.\n * - Idempotent: re-running must be a no-op (each rewrite's own shape change\n *   means its pattern no longer matches on a second pass).\n * - Format what you write: finish with `formatFilesInSubtree`.\n */\n\n/** A read-only GritQL match against a python file (no rewrite). */\nconst pyMatch = (snippet: string) => `language python\\n\\`${snippet}\\``;\n\n/** A GritQL rewrite deleting the matched python snippet entirely. */\nconst pyDelete = (snippet: string) => `${pyMatch(snippet)} => .`;\n\n/**\n * A GritQL rewrite of one python snippet into another. Multi-line\n * replacements go through `raw` so GritQL's own reformatting doesn't fight\n * the exact shape being written (formatFilesInSubtree normalizes it after).\n */\nconst pyRewrite = (from: string, to: string, where?: string): string => {\n  const replacement = to.includes('\\n') ? `raw\\`${to}\\`` : `\\`${to}\\``;\n  return `${pyMatch(from)} => ${replacement}${where ? ` where { ${where} }` : ''}`;\n};\n\n/** All checks must match before anything is written for that agent. */\nconst allMatch = async (\n  tree: Tree,\n  checks: ReadonlyArray<readonly [filePath: string, pattern: string]>,\n): Promise<boolean> => {\n  for (const [filePath, pattern] of checks) {\n    if (!(await matchGritQL(tree, filePath, pattern))) return false;\n  }\n  return true;\n};\n\nconst AGENT_CONNECTION_MODULE_PATTERN = (names: string) =>\n  pyMatch(`from $mod import ${names}`);\n\nconst STRANDS_HTTP_MARKER = '_agent_ctx = with_session_id(';\nconst LANGCHAIN_HTTP_MARKER = '_graph = get_agent()';\nconst STRANDS_AGUI_MARKER = 'create_strands_app';\nconst LANGCHAIN_AGUI_MARKER = '_graph = get_agent()';\n\n// Shared by strands/http and langchain/http - only the lifespan body differs.\nconst HTTP_INIT_APP_OLD = `app = FastAPI(\n    title=\"$name\",\n    responses={500: {\"model\": InternalServerErrorDetails}},\n    generate_unique_id_function=lambda route: route.name,\n)`;\n\n// --- Strands HTTP -----------------------------------------------------------\n\nconst STRANDS_HTTP_MAIN_CTX_OLD = `_agent_ctx = with_session_id(\n    get_agent,\n    name=\"$name\",\n    description=\"A Strands Agent exposed via HTTP streaming.\",\n)`;\n\nconst STRANDS_HTTP_INIT_APP_NEW = `@asynccontextmanager\nasync def lifespan(app: FastAPI):\n    with with_session_id(\n        get_agent,\n        name=\"$name\",\n        description=\"A Strands Agent exposed via HTTP streaming.\",\n    ) as agent:\n        app.state.agent = agent\n        yield\n\n\napp = FastAPI(\n    title=\"$name\",\n    responses={500: {\"model\": InternalServerErrorDetails}},\n    generate_unique_id_function=lambda route: route.name,\n    lifespan=lifespan,\n)`;\n\nconst migrateStrandsHttpAgent = async (\n  tree: Tree,\n  dir: string,\n  nextSteps: string[],\n): Promise<void> => {\n  const initPath = joinPathFragments(dir, 'init.py');\n  const mainPath = joinPathFragments(dir, 'main.py');\n  if (!tree.exists(initPath) || !tree.exists(mainPath)) return;\n\n  const mainContents = tree.read(mainPath, 'utf-8') ?? '';\n  if (!mainContents.includes(STRANDS_HTTP_MARKER)) return;\n\n  const mod = await captureGritQLVariable(\n    tree,\n    mainPath,\n    AGENT_CONNECTION_MODULE_PATTERN('session_id_context, with_session_id'),\n    'mod',\n  );\n\n  const ready =\n    !!mod &&\n    (await allMatch(tree, [\n      [mainPath, pyMatch(STRANDS_HTTP_MAIN_CTX_OLD)],\n      [mainPath, pyMatch('_agent = _agent_ctx.__enter__()')],\n      [mainPath, pyMatch('from .agent import get_agent')],\n      [mainPath, pyMatch('_agent.stream_async($prompt)')],\n      [initPath, pyMatch(HTTP_INIT_APP_OLD)],\n    ]));\n\n  if (!ready) {\n    nextSteps.push(\n      `${mainPath}: diverged from the generated shape - left untouched, along with ${initPath}. Manually move agent construction into an \\`init.py\\` \\`lifespan\\` handler storing the agent on \\`app.state.agent\\` (see the py#agent generator's strands/http template).`,\n    );\n    return;\n  }\n\n  await addPythonDestructuredImport(\n    tree,\n    initPath,\n    ['asynccontextmanager'],\n    'contextlib',\n  );\n  await addPythonDestructuredImport(tree, initPath, ['get_agent'], '.agent');\n  await addPythonDestructuredImport(tree, initPath, ['with_session_id'], mod);\n  await applyGritQL(\n    tree,\n    initPath,\n    pyRewrite(HTTP_INIT_APP_OLD, STRANDS_HTTP_INIT_APP_NEW),\n  );\n\n  await applyGritQL(\n    tree,\n    mainPath,\n    pyRewrite(\n      'from $mod import session_id_context, with_session_id',\n      'from $mod import session_id_context',\n    ),\n  );\n  await applyGritQL(tree, mainPath, pyDelete('from .agent import get_agent'));\n  await applyGritQL(tree, mainPath, pyDelete(STRANDS_HTTP_MAIN_CTX_OLD));\n  await applyGritQL(\n    tree,\n    mainPath,\n    pyDelete('_agent = _agent_ctx.__enter__()'),\n  );\n  await applyGritQL(\n    tree,\n    mainPath,\n    pyRewrite(\n      '_agent.stream_async($prompt)',\n      'app.state.agent.stream_async($prompt)',\n    ),\n  );\n};\n\n// --- LangChain HTTP ----------------------------------------------------------\n\nconst LANGCHAIN_HTTP_INIT_APP_NEW = `@asynccontextmanager\nasync def lifespan(app: FastAPI):\n    app.state.graph = get_agent()\n    yield\n\n\napp = FastAPI(\n    title=\"$name\",\n    responses={500: {\"model\": InternalServerErrorDetails}},\n    generate_unique_id_function=lambda route: route.name,\n    lifespan=lifespan,\n)`;\n\nconst migrateLangchainHttpAgent = async (\n  tree: Tree,\n  dir: string,\n  nextSteps: string[],\n): Promise<void> => {\n  const initPath = joinPathFragments(dir, 'init.py');\n  const mainPath = joinPathFragments(dir, 'main.py');\n  if (!tree.exists(initPath) || !tree.exists(mainPath)) return;\n\n  const mainContents = tree.read(mainPath, 'utf-8') ?? '';\n  if (!mainContents.includes(LANGCHAIN_HTTP_MARKER)) return;\n\n  const ready = await allMatch(tree, [\n    [mainPath, pyMatch('_graph = get_agent()')],\n    [mainPath, pyMatch('from .agent import get_agent')],\n    [mainPath, pyMatch('_graph.astream($args)')],\n    [initPath, pyMatch(HTTP_INIT_APP_OLD)],\n  ]);\n\n  if (!ready) {\n    nextSteps.push(\n      `${mainPath}: diverged from the generated shape - left untouched, along with ${initPath}. Manually wrap \\`get_agent()\\` in an \\`init.py\\` \\`lifespan\\` handler storing the graph on \\`app.state.graph\\` (see the py#agent generator's langchain/http template).`,\n    );\n    return;\n  }\n\n  await addPythonDestructuredImport(\n    tree,\n    initPath,\n    ['asynccontextmanager'],\n    'contextlib',\n  );\n  await addPythonDestructuredImport(tree, initPath, ['get_agent'], '.agent');\n  await applyGritQL(\n    tree,\n    initPath,\n    pyRewrite(HTTP_INIT_APP_OLD, LANGCHAIN_HTTP_INIT_APP_NEW),\n  );\n\n  await applyGritQL(tree, mainPath, pyDelete('from .agent import get_agent'));\n  await applyGritQL(tree, mainPath, pyDelete('_graph = get_agent()'));\n  await applyGritQL(\n    tree,\n    mainPath,\n    pyRewrite('_graph.astream($args)', 'app.state.graph.astream($args)'),\n  );\n};\n\n// --- LangChain AG-UI ---------------------------------------------------------\n\nconst LANGCHAIN_AGUI_AGENT_OLD = `agui_agent = LangGraphAgent(\n    name=\"$name\",\n    graph=_graph,\n    description=\"A LangChain/LangGraph Agent exposed via the AG-UI protocol.\",\n)`;\n\nconst LANGCHAIN_AGUI_AGENT_NEW = `@asynccontextmanager\nasync def lifespan(app: FastAPI):\n    graph = get_agent()\n    app.state.agui_agent = LangGraphAgent(\n        name=\"$name\",\n        graph=graph,\n        description=\"A LangChain/LangGraph Agent exposed via the AG-UI protocol.\",\n    )\n    yield`;\n\nconst migrateLangchainAgUiAgent = async (\n  tree: Tree,\n  dir: string,\n  nextSteps: string[],\n): Promise<void> => {\n  const mainPath = joinPathFragments(dir, 'main.py');\n  if (!tree.exists(mainPath)) return;\n\n  const mainContents = tree.read(mainPath, 'utf-8') ?? '';\n  if (!mainContents.includes(LANGCHAIN_AGUI_MARKER)) return;\n\n  const ready = await allMatch(tree, [\n    [mainPath, pyMatch('_graph = get_agent()')],\n    [mainPath, pyMatch(LANGCHAIN_AGUI_AGENT_OLD)],\n    [mainPath, pyMatch('agui_agent.run($input)')],\n    [mainPath, pyMatch('app = FastAPI(title=\"$name\")')],\n  ]);\n\n  if (!ready) {\n    nextSteps.push(\n      `${mainPath}: diverged from the generated shape - left untouched. Manually wrap graph + \\`LangGraphAgent\\` construction in a \\`lifespan\\` handler storing the wrapper on \\`app.state.agui_agent\\` (see the py#agent generator's langchain/ag-ui template).`,\n    );\n    return;\n  }\n\n  await addPythonDestructuredImport(\n    tree,\n    mainPath,\n    ['asynccontextmanager'],\n    'contextlib',\n  );\n\n  await applyGritQL(tree, mainPath, pyDelete('_graph = get_agent()'));\n  await applyGritQL(\n    tree,\n    mainPath,\n    pyRewrite(LANGCHAIN_AGUI_AGENT_OLD, LANGCHAIN_AGUI_AGENT_NEW),\n  );\n  await applyGritQL(\n    tree,\n    mainPath,\n    pyRewrite(\n      'agui_agent.run($input)',\n      'request.app.state.agui_agent.run($input)',\n    ),\n  );\n  await applyGritQL(\n    tree,\n    mainPath,\n    pyRewrite(\n      'app = FastAPI(title=\"$name\")',\n      'app = FastAPI(title=\"$name\", lifespan=lifespan)',\n    ),\n  );\n};\n\n// --- Strands AG-UI -----------------------------------------------------------\n// The biggest of the four: `ag_ui_strands.create_strands_app` is dropped\n// entirely for an inlined FastAPI app (matching upstream `ag_ui_strands`,\n// plus a Content-Type-independent body-parsing fix and an explicit session\n// re-bind `create_strands_app` was missing), so most of the file is new.\n\nconst STRANDS_AGUI_IMPORT_OLD =\n  'from ag_ui_strands import StrandsAgent, create_strands_app';\n\nconst STRANDS_AGUI_AGENT_OLD = `agui_agent = StrandsAgent(\n    agent=_agent,\n    name=\"$name\",\n    description=\"A Strands Agent exposed via the AG-UI protocol.\",\n)`;\n\nconst STRANDS_AGUI_AGENT_NEW = `@asynccontextmanager\nasync def lifespan(app: FastAPI):\n    with get_agent() as agent:\n        app.state.agui_agent = StrandsAgent(\n            agent=agent,\n            name=\"$name\",\n            description=\"A Strands Agent exposed via the AG-UI protocol.\",\n        )\n        yield`;\n\nconst STRANDS_AGUI_APP_OLD =\n  'app = create_strands_app(agui_agent, path=\"/invocations\")';\n\n// `$name` isn't bound within this match (unlike STRANDS_AGUI_AGENT_OLD above),\n// so the title is built from a name captured separately rather than reused as\n// a metavariable - GritQL leaves a rewrite whose replacement references an\n// unbound metavariable unapplied.\nconst strandsAguiAppNew = (\n  name: string,\n) => `app = FastAPI(title=\"AWS Strands - ${name}\", lifespan=lifespan)\napp.add_middleware(\n    CORSMiddleware,\n    allow_origins=[\"*\"],\n    allow_credentials=True,\n    allow_methods=[\"*\"],\n    allow_headers=[\"*\"],\n)`;\n\nconst STRANDS_AGUI_MIDDLEWARE_OLD = 'app.add_middleware(_SessionIdMiddleware)';\n\nconst STRANDS_AGUI_ROUTES_NEW = `app.add_middleware(_SessionIdMiddleware)\n\n\n@app.post(\"/invocations\")\nasync def invocations(request: Request):\n    # Validate the body manually since AgentCore may omit Content-Type.\n    encoder = EventEncoder(accept=request.headers.get(\"accept\") or \"\")\n    raw = await request.body()\n    try:\n        input_data = RunAgentInput.model_validate_json(raw)\n    except Exception as exc:\n        message = f\"Invalid RunAgentInput: {str(exc)[:200]}\"\n\n        async def _bad():\n            yield encoder.encode(RunErrorEvent(type=EventType.RUN_ERROR, message=message, code=\"BAD_REQUEST\"))\n\n        return StreamingResponse(_bad(), media_type=encoder.get_content_type())\n\n    session_id = request.headers.get(SESSION_ID_HEADER) or get_current_session_id()\n\n    async def event_generator():\n        # Re-bind the session: the streaming body runs outside the middleware.\n        with session_id_context(session_id or str(uuid.uuid4())):\n            async for event in request.app.state.agui_agent.run(input_data):\n                try:\n                    yield encoder.encode(event)\n                except Exception as e:\n                    error_event = RunErrorEvent(\n                        type=EventType.RUN_ERROR,\n                        message=f\"Encoding error: {e}\",\n                        code=\"ENCODING_ERROR\",\n                    )\n                    yield encoder.encode(error_event)\n                    break\n\n    return StreamingResponse(event_generator(), media_type=encoder.get_content_type())\n\n\n@app.get(\"/ping\")\nasync def ping():\n    return {\"status\": \"healthy\"}`;\n\nconst STRANDS_AGUI_COMMENTS_OLD = [\n  '# Create AG-UI agent wrapper',\n  '# Create FastAPI app with AG-UI endpoint and health check',\n];\n\nconst migrateStrandsAgUiAgent = async (\n  tree: Tree,\n  dir: string,\n  nextSteps: string[],\n): Promise<void> => {\n  const mainPath = joinPathFragments(dir, 'main.py');\n  if (!tree.exists(mainPath)) return;\n\n  const mainContents = tree.read(mainPath, 'utf-8') ?? '';\n  if (!mainContents.includes(STRANDS_AGUI_MARKER)) return;\n\n  const mod = await captureGritQLVariable(\n    tree,\n    mainPath,\n    AGENT_CONNECTION_MODULE_PATTERN('session_id_context'),\n    'mod',\n  );\n  const agentClassName = await captureGritQLVariable(\n    tree,\n    mainPath,\n    pyMatch(STRANDS_AGUI_AGENT_OLD),\n    'name',\n  );\n\n  const ready =\n    !!mod &&\n    !!agentClassName &&\n    (await allMatch(tree, [\n      [mainPath, pyMatch(STRANDS_AGUI_IMPORT_OLD)],\n      [mainPath, pyMatch('_agent_ctx = get_agent()')],\n      [mainPath, pyMatch('_agent = _agent_ctx.__enter__()')],\n      [mainPath, pyMatch(STRANDS_AGUI_AGENT_OLD)],\n      [mainPath, pyMatch(STRANDS_AGUI_APP_OLD)],\n      [mainPath, pyMatch(STRANDS_AGUI_MIDDLEWARE_OLD)],\n    ]));\n\n  if (!ready) {\n    nextSteps.push(\n      `${mainPath}: diverged from the generated shape - left untouched. Manually rebuild this file without \\`create_strands_app\\`: a \\`lifespan\\` handler storing the wrapper on \\`app.state.agui_agent\\`, and inlined \\`/invocations\\`/\\`/ping\\` routes with Content-Type-independent body parsing (see the py#agent generator's strands/ag-ui template).`,\n    );\n    return;\n  }\n\n  await addPythonDestructuredImport(\n    tree,\n    mainPath,\n    ['asynccontextmanager'],\n    'contextlib',\n  );\n  await addPythonDestructuredImport(\n    tree,\n    mainPath,\n    ['EventType', 'RunAgentInput', 'RunErrorEvent'],\n    'ag_ui.core',\n  );\n  await addPythonDestructuredImport(\n    tree,\n    mainPath,\n    ['EventEncoder'],\n    'ag_ui.encoder',\n  );\n  await addPythonDestructuredImport(tree, mainPath, ['FastAPI'], 'fastapi');\n  await addPythonDestructuredImport(\n    tree,\n    mainPath,\n    ['CORSMiddleware'],\n    'fastapi.middleware.cors',\n  );\n  await addPythonDestructuredImport(\n    tree,\n    mainPath,\n    ['StreamingResponse'],\n    'fastapi.responses',\n  );\n  await addPythonDestructuredImport(\n    tree,\n    mainPath,\n    ['get_current_session_id'],\n    mod,\n  );\n\n  await applyGritQL(\n    tree,\n    mainPath,\n    pyRewrite(\n      STRANDS_AGUI_IMPORT_OLD,\n      'from ag_ui_strands import StrandsAgent',\n    ),\n  );\n  await applyGritQL(tree, mainPath, pyDelete('_agent_ctx = get_agent()'));\n  await applyGritQL(\n    tree,\n    mainPath,\n    pyDelete('_agent = _agent_ctx.__enter__()'),\n  );\n  await applyGritQL(\n    tree,\n    mainPath,\n    pyRewrite(STRANDS_AGUI_AGENT_OLD, STRANDS_AGUI_AGENT_NEW),\n  );\n  for (const comment of STRANDS_AGUI_COMMENTS_OLD) {\n    await applyGritQL(tree, mainPath, pyDelete(comment));\n  }\n  await applyGritQL(\n    tree,\n    mainPath,\n    pyRewrite(STRANDS_AGUI_APP_OLD, strandsAguiAppNew(agentClassName)),\n  );\n  await applyGritQL(\n    tree,\n    mainPath,\n    pyRewrite(STRANDS_AGUI_MIDDLEWARE_OLD, STRANDS_AGUI_ROUTES_NEW),\n  );\n};\n\n/** This agent's ComponentMetadata entries. */\nconst findAgentComponents = (\n  components: ComponentMetadata[] | undefined,\n): ComponentMetadata[] =>\n  (components ?? []).filter(\n    (component) => component.generator === PY_AGENT_GENERATOR_INFO.id,\n  );\n\nexport default async function migration(\n  tree: Tree,\n): Promise<MigrationReturnObject> {\n  const nextSteps: string[] = [];\n\n  for (const project of getProjects(tree).values()) {\n    const components = findAgentComponents(\n      (project.metadata as { components?: ComponentMetadata[] })?.components,\n    );\n\n    for (const component of components) {\n      if (!component.path) continue;\n      const dir = joinPathFragments(project.root, component.path);\n      const framework = component.framework ?? 'strands';\n\n      if (component.protocol === 'http') {\n        if (framework === 'langchain') {\n          await migrateLangchainHttpAgent(tree, dir, nextSteps);\n        } else {\n          await migrateStrandsHttpAgent(tree, dir, nextSteps);\n        }\n      } else if (component.protocol === 'ag-ui') {\n        if (framework === 'langchain') {\n          await migrateLangchainAgUiAgent(tree, dir, nextSteps);\n        } else {\n          await migrateStrandsAgUiAgent(tree, dir, nextSteps);\n        }\n      }\n    }\n  }\n\n  await formatFilesInSubtree(tree);\n\n  return { nextSteps };\n}\n"],"names":["getProjects","joinPathFragments","PY_AGENT_GENERATOR_INFO","addPythonDestructuredImport","applyGritQL","captureGritQLVariable","matchGritQL","formatFilesInSubtree","pyMatch","snippet","pyDelete","pyRewrite","from","to","where","replacement","includes","allMatch","tree","checks","filePath","pattern","AGENT_CONNECTION_MODULE_PATTERN","names","STRANDS_HTTP_MARKER","LANGCHAIN_HTTP_MARKER","STRANDS_AGUI_MARKER","LANGCHAIN_AGUI_MARKER","HTTP_INIT_APP_OLD","STRANDS_HTTP_MAIN_CTX_OLD","STRANDS_HTTP_INIT_APP_NEW","migrateStrandsHttpAgent","dir","nextSteps","initPath","mainPath","exists","mainContents","read","mod","ready","push","LANGCHAIN_HTTP_INIT_APP_NEW","migrateLangchainHttpAgent","LANGCHAIN_AGUI_AGENT_OLD","LANGCHAIN_AGUI_AGENT_NEW","migrateLangchainAgUiAgent","STRANDS_AGUI_IMPORT_OLD","STRANDS_AGUI_AGENT_OLD","STRANDS_AGUI_AGENT_NEW","STRANDS_AGUI_APP_OLD","strandsAguiAppNew","name","STRANDS_AGUI_MIDDLEWARE_OLD","STRANDS_AGUI_ROUTES_NEW","STRANDS_AGUI_COMMENTS_OLD","migrateStrandsAgUiAgent","agentClassName","comment","findAgentComponents","components","filter","component","generator","id","migration","project","values","metadata","path","root","framework","protocol"],"mappings":"AAAA;;;CAGC,GACD,SACEA,WAAW,EACXC,iBAAiB,QAGZ,aAAa;AACpB,SAASC,uBAAuB,QAAQ,iCAA8B;AACtE,SACEC,2BAA2B,EAC3BC,WAAW,EACXC,qBAAqB,EACrBC,WAAW,QACN,wBAAqB;AAC5B,SAASC,oBAAoB,QAAQ,2BAAwB;AAG7D;;;;;;;;;;;;;;;;;;;;;;;;CAwBC,GAED,iEAAiE,GACjE,MAAMC,UAAU,CAACC,UAAoB,CAAC,mBAAmB,EAAEA,QAAQ,EAAE,CAAC;AAEtE,mEAAmE,GACnE,MAAMC,WAAW,CAACD,UAAoB,GAAGD,QAAQC,SAAS,KAAK,CAAC;AAEhE;;;;CAIC,GACD,MAAME,YAAY,CAACC,MAAcC,IAAYC;IAC3C,MAAMC,cAAcF,GAAGG,QAAQ,CAAC,QAAQ,CAAC,KAAK,EAAEH,GAAG,EAAE,CAAC,GAAG,CAAC,EAAE,EAAEA,GAAG,EAAE,CAAC;IACpE,OAAO,GAAGL,QAAQI,MAAM,IAAI,EAAEG,cAAcD,QAAQ,CAAC,SAAS,EAAEA,MAAM,EAAE,CAAC,GAAG,IAAI;AAClF;AAEA,qEAAqE,GACrE,MAAMG,WAAW,OACfC,MACAC;IAEA,KAAK,MAAM,CAACC,UAAUC,QAAQ,IAAIF,OAAQ;QACxC,IAAI,CAAE,MAAMb,YAAYY,MAAME,UAAUC,UAAW,OAAO;IAC5D;IACA,OAAO;AACT;AAEA,MAAMC,kCAAkC,CAACC,QACvCf,QAAQ,CAAC,iBAAiB,EAAEe,OAAO;AAErC,MAAMC,sBAAsB;AAC5B,MAAMC,wBAAwB;AAC9B,MAAMC,sBAAsB;AAC5B,MAAMC,wBAAwB;AAE9B,8EAA8E;AAC9E,MAAMC,oBAAoB,CAAC;;;;CAI1B,CAAC;AAEF,+EAA+E;AAE/E,MAAMC,4BAA4B,CAAC;;;;CAIlC,CAAC;AAEF,MAAMC,4BAA4B,CAAC;;;;;;;;;;;;;;;;CAgBlC,CAAC;AAEF,MAAMC,0BAA0B,OAC9Bb,MACAc,KACAC;IAEA,MAAMC,WAAWjC,kBAAkB+B,KAAK;IACxC,MAAMG,WAAWlC,kBAAkB+B,KAAK;IACxC,IAAI,CAACd,KAAKkB,MAAM,CAACF,aAAa,CAAChB,KAAKkB,MAAM,CAACD,WAAW;IAEtD,MAAME,eAAenB,KAAKoB,IAAI,CAACH,UAAU,YAAY;IACrD,IAAI,CAACE,aAAarB,QAAQ,CAACQ,sBAAsB;IAEjD,MAAMe,MAAM,MAAMlC,sBAChBa,MACAiB,UACAb,gCAAgC,wCAChC;IAGF,MAAMkB,QACJ,CAAC,CAACD,OACD,MAAMtB,SAASC,MAAM;QACpB;YAACiB;YAAU3B,QAAQqB;SAA2B;QAC9C;YAACM;YAAU3B,QAAQ;SAAmC;QACtD;YAAC2B;YAAU3B,QAAQ;SAAgC;QACnD;YAAC2B;YAAU3B,QAAQ;SAAgC;QACnD;YAAC0B;YAAU1B,QAAQoB;SAAmB;KACvC;IAEH,IAAI,CAACY,OAAO;QACVP,UAAUQ,IAAI,CACZ,GAAGN,SAAS,iEAAiE,EAAED,SAAS,0KAA0K,CAAC;QAErQ;IACF;IAEA,MAAM/B,4BACJe,MACAgB,UACA;QAAC;KAAsB,EACvB;IAEF,MAAM/B,4BAA4Be,MAAMgB,UAAU;QAAC;KAAY,EAAE;IACjE,MAAM/B,4BAA4Be,MAAMgB,UAAU;QAAC;KAAkB,EAAEK;IACvE,MAAMnC,YACJc,MACAgB,UACAvB,UAAUiB,mBAAmBE;IAG/B,MAAM1B,YACJc,MACAiB,UACAxB,UACE,wDACA;IAGJ,MAAMP,YAAYc,MAAMiB,UAAUzB,SAAS;IAC3C,MAAMN,YAAYc,MAAMiB,UAAUzB,SAASmB;IAC3C,MAAMzB,YACJc,MACAiB,UACAzB,SAAS;IAEX,MAAMN,YACJc,MACAiB,UACAxB,UACE,gCACA;AAGN;AAEA,gFAAgF;AAEhF,MAAM+B,8BAA8B,CAAC;;;;;;;;;;;CAWpC,CAAC;AAEF,MAAMC,4BAA4B,OAChCzB,MACAc,KACAC;IAEA,MAAMC,WAAWjC,kBAAkB+B,KAAK;IACxC,MAAMG,WAAWlC,kBAAkB+B,KAAK;IACxC,IAAI,CAACd,KAAKkB,MAAM,CAACF,aAAa,CAAChB,KAAKkB,MAAM,CAACD,WAAW;IAEtD,MAAME,eAAenB,KAAKoB,IAAI,CAACH,UAAU,YAAY;IACrD,IAAI,CAACE,aAAarB,QAAQ,CAACS,wBAAwB;IAEnD,MAAMe,QAAQ,MAAMvB,SAASC,MAAM;QACjC;YAACiB;YAAU3B,QAAQ;SAAwB;QAC3C;YAAC2B;YAAU3B,QAAQ;SAAgC;QACnD;YAAC2B;YAAU3B,QAAQ;SAAyB;QAC5C;YAAC0B;YAAU1B,QAAQoB;SAAmB;KACvC;IAED,IAAI,CAACY,OAAO;QACVP,UAAUQ,IAAI,CACZ,GAAGN,SAAS,iEAAiE,EAAED,SAAS,uKAAuK,CAAC;QAElQ;IACF;IAEA,MAAM/B,4BACJe,MACAgB,UACA;QAAC;KAAsB,EACvB;IAEF,MAAM/B,4BAA4Be,MAAMgB,UAAU;QAAC;KAAY,EAAE;IACjE,MAAM9B,YACJc,MACAgB,UACAvB,UAAUiB,mBAAmBc;IAG/B,MAAMtC,YAAYc,MAAMiB,UAAUzB,SAAS;IAC3C,MAAMN,YAAYc,MAAMiB,UAAUzB,SAAS;IAC3C,MAAMN,YACJc,MACAiB,UACAxB,UAAU,yBAAyB;AAEvC;AAEA,gFAAgF;AAEhF,MAAMiC,2BAA2B,CAAC;;;;CAIjC,CAAC;AAEF,MAAMC,2BAA2B,CAAC;;;;;;;;SAQzB,CAAC;AAEV,MAAMC,4BAA4B,OAChC5B,MACAc,KACAC;IAEA,MAAME,WAAWlC,kBAAkB+B,KAAK;IACxC,IAAI,CAACd,KAAKkB,MAAM,CAACD,WAAW;IAE5B,MAAME,eAAenB,KAAKoB,IAAI,CAACH,UAAU,YAAY;IACrD,IAAI,CAACE,aAAarB,QAAQ,CAACW,wBAAwB;IAEnD,MAAMa,QAAQ,MAAMvB,SAASC,MAAM;QACjC;YAACiB;YAAU3B,QAAQ;SAAwB;QAC3C;YAAC2B;YAAU3B,QAAQoC;SAA0B;QAC7C;YAACT;YAAU3B,QAAQ;SAA0B;QAC7C;YAAC2B;YAAU3B,QAAQ;SAAgC;KACpD;IAED,IAAI,CAACgC,OAAO;QACVP,UAAUQ,IAAI,CACZ,GAAGN,SAAS,8OAA8O,CAAC;QAE7P;IACF;IAEA,MAAMhC,4BACJe,MACAiB,UACA;QAAC;KAAsB,EACvB;IAGF,MAAM/B,YAAYc,MAAMiB,UAAUzB,SAAS;IAC3C,MAAMN,YACJc,MACAiB,UACAxB,UAAUiC,0BAA0BC;IAEtC,MAAMzC,YACJc,MACAiB,UACAxB,UACE,0BACA;IAGJ,MAAMP,YACJc,MACAiB,UACAxB,UACE,gCACA;AAGN;AAEA,gFAAgF;AAChF,yEAAyE;AACzE,0EAA0E;AAC1E,2EAA2E;AAC3E,yEAAyE;AAEzE,MAAMoC,0BACJ;AAEF,MAAMC,yBAAyB,CAAC;;;;CAI/B,CAAC;AAEF,MAAMC,yBAAyB,CAAC;;;;;;;;aAQnB,CAAC;AAEd,MAAMC,uBACJ;AAEF,+EAA+E;AAC/E,8EAA8E;AAC9E,2EAA2E;AAC3E,kCAAkC;AAClC,MAAMC,oBAAoB,CACxBC,OACG,CAAC,mCAAmC,EAAEA,KAAK;;;;;;;CAO/C,CAAC;AAEF,MAAMC,8BAA8B;AAEpC,MAAMC,0BAA0B,CAAC;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;gCAwCD,CAAC;AAEjC,MAAMC,4BAA4B;IAChC;IACA;CACD;AAED,MAAMC,0BAA0B,OAC9BtC,MACAc,KACAC;IAEA,MAAME,WAAWlC,kBAAkB+B,KAAK;IACxC,IAAI,CAACd,KAAKkB,MAAM,CAACD,WAAW;IAE5B,MAAME,eAAenB,KAAKoB,IAAI,CAACH,UAAU,YAAY;IACrD,IAAI,CAACE,aAAarB,QAAQ,CAACU,sBAAsB;IAEjD,MAAMa,MAAM,MAAMlC,sBAChBa,MACAiB,UACAb,gCAAgC,uBAChC;IAEF,MAAMmC,iBAAiB,MAAMpD,sBAC3Ba,MACAiB,UACA3B,QAAQwC,yBACR;IAGF,MAAMR,QACJ,CAAC,CAACD,OACF,CAAC,CAACkB,kBACD,MAAMxC,SAASC,MAAM;QACpB;YAACiB;YAAU3B,QAAQuC;SAAyB;QAC5C;YAACZ;YAAU3B,QAAQ;SAA4B;QAC/C;YAAC2B;YAAU3B,QAAQ;SAAmC;QACtD;YAAC2B;YAAU3B,QAAQwC;SAAwB;QAC3C;YAACb;YAAU3B,QAAQ0C;SAAsB;QACzC;YAACf;YAAU3B,QAAQ6C;SAA6B;KACjD;IAEH,IAAI,CAACb,OAAO;QACVP,UAAUQ,IAAI,CACZ,GAAGN,SAAS,wUAAwU,CAAC;QAEvV;IACF;IAEA,MAAMhC,4BACJe,MACAiB,UACA;QAAC;KAAsB,EACvB;IAEF,MAAMhC,4BACJe,MACAiB,UACA;QAAC;QAAa;QAAiB;KAAgB,EAC/C;IAEF,MAAMhC,4BACJe,MACAiB,UACA;QAAC;KAAe,EAChB;IAEF,MAAMhC,4BAA4Be,MAAMiB,UAAU;QAAC;KAAU,EAAE;IAC/D,MAAMhC,4BACJe,MACAiB,UACA;QAAC;KAAiB,EAClB;IAEF,MAAMhC,4BACJe,MACAiB,UACA;QAAC;KAAoB,EACrB;IAEF,MAAMhC,4BACJe,MACAiB,UACA;QAAC;KAAyB,EAC1BI;IAGF,MAAMnC,YACJc,MACAiB,UACAxB,UACEoC,yBACA;IAGJ,MAAM3C,YAAYc,MAAMiB,UAAUzB,SAAS;IAC3C,MAAMN,YACJc,MACAiB,UACAzB,SAAS;IAEX,MAAMN,YACJc,MACAiB,UACAxB,UAAUqC,wBAAwBC;IAEpC,KAAK,MAAMS,WAAWH,0BAA2B;QAC/C,MAAMnD,YAAYc,MAAMiB,UAAUzB,SAASgD;IAC7C;IACA,MAAMtD,YACJc,MACAiB,UACAxB,UAAUuC,sBAAsBC,kBAAkBM;IAEpD,MAAMrD,YACJc,MACAiB,UACAxB,UAAU0C,6BAA6BC;AAE3C;AAEA,4CAA4C,GAC5C,MAAMK,sBAAsB,CAC1BC,aAEA,AAACA,CAAAA,cAAc,EAAE,AAAD,EAAGC,MAAM,CACvB,CAACC,YAAcA,UAAUC,SAAS,KAAK7D,wBAAwB8D,EAAE;AAGrE,eAAe,eAAeC,UAC5B/C,IAAU;IAEV,MAAMe,YAAsB,EAAE;IAE9B,KAAK,MAAMiC,WAAWlE,YAAYkB,MAAMiD,MAAM,GAAI;QAChD,MAAMP,aAAaD,oBAChBO,QAAQE,QAAQ,EAA2CR;QAG9D,KAAK,MAAME,aAAaF,WAAY;YAClC,IAAI,CAACE,UAAUO,IAAI,EAAE;YACrB,MAAMrC,MAAM/B,kBAAkBiE,QAAQI,IAAI,EAAER,UAAUO,IAAI;YAC1D,MAAME,YAAYT,UAAUS,SAAS,IAAI;YAEzC,IAAIT,UAAUU,QAAQ,KAAK,QAAQ;gBACjC,IAAID,cAAc,aAAa;oBAC7B,MAAM5B,0BAA0BzB,MAAMc,KAAKC;gBAC7C,OAAO;oBACL,MAAMF,wBAAwBb,MAAMc,KAAKC;gBAC3C;YACF,OAAO,IAAI6B,UAAUU,QAAQ,KAAK,SAAS;gBACzC,IAAID,cAAc,aAAa;oBAC7B,MAAMzB,0BAA0B5B,MAAMc,KAAKC;gBAC7C,OAAO;oBACL,MAAMuB,wBAAwBtC,MAAMc,KAAKC;gBAC3C;YACF;QACF;IACF;IAEA,MAAM1B,qBAAqBW;IAE3B,OAAO;QAAEe;IAAU;AACrB"}

package/src/migrations/latest/smithy-ssdk-bundle-pins/metadata.json

@@ -0,0 +1,3 @@
+{
+  "description": "Bump the rolldown and dts plugin pins in the Smithy build.Dockerfile so the bundled SSDK type declaration resolves"
+}

package/src/migrations/latest/smithy-ssdk-bundle-pins/migration.d.ts

@@ -0,0 +1,6 @@
+/**
+ * Copyright Amazon.com, Inc. or its affiliates. All Rights Reserved.
+ * SPDX-License-Identifier: Apache-2.0
+ */
+import { type MigrationReturnObject, type Tree } from '@nx/devkit';
+export default function migration(tree: Tree): Promise<MigrationReturnObject>;

package/src/migrations/latest/smithy-ssdk-bundle-pins/migration.js

@@ -0,0 +1,78 @@
+/**
+ * Copyright Amazon.com, Inc. or its affiliates. All Rights Reserved.
+ * SPDX-License-Identifier: Apache-2.0
+ */ import { getProjects, joinPathFragments } from "@nx/devkit";
+import { SMITHY_PROJECT_GENERATOR_INFO } from "../../../smithy/project/generator.js";
+import { applyGritQL } from "../../../utils/ast.js";
+import { formatFilesInSubtree } from "../../../utils/format.js";
+import { isVendedUpgrade } from "../../../utils/version-upgrade-migration/vended-upgrade.js";
+/**
+ * Hardcoded rather than read from `TS_VERSIONS`: this runs once, for the release
+ * that fixed the declaration naming, so it must keep applying that exact change
+ * however far the vended versions move afterwards. A workspace on a later release
+ * gets the newer pins from the version sync instead.
+ */ const PINS = [
+    {
+        name: 'rolldown',
+        target: '1.2.0'
+    },
+    {
+        name: 'rolldown-plugin-dts',
+        target: '0.28.0'
+    },
+    {
+        name: '@rollup/plugin-esm-shim',
+        target: '0.1.8'
+    }
+];
+/** A version ends at whitespace, a line break or the end of the command. */ const VERSION = String.raw`[^\s\\]+`;
+const escapeRegExp = (value)=>value.replace(/[.*+?^${}()|[\]\\]/g, '\\$&');
+/**
+ * Rewrite every occurrence of one pin to its target version.
+ *
+ * The pin is matched by name, so a `rolldown-plugin-dts@x` in the same command as
+ * `rolldown@y` keeps its own version — the `@` before the version terminates the
+ * match, so the shorter name does not match the longer one.
+ */ const rewritePin = ({ name, target })=>`r"[\\s\\S]*${escapeRegExp(name)}@(${VERSION})[\\s\\S]*"($version) where { $version => \`${target}\` }`;
+/** Whether the file pins this package behind the target version. */ const isBehindTarget = (contents, { name, target })=>{
+    const matches = contents.matchAll(new RegExp(`${escapeRegExp(name)}@(${VERSION})`, 'g'));
+    const declared = [
+        ...matches
+    ].flatMap((match)=>match[1] ? [
+            match[1]
+        ] : []);
+    // A rewrite replaces every occurrence at once, so this has to hold for all of
+    // them. Compared rather than tested for inequality, so a workspace a later
+    // release has already moved past the target keeps its newer pin.
+    return declared.length > 0 && declared.every((version)=>isVendedUpgrade(target, version));
+};
+const divergedNextStep = (path)=>`${path}: the Smithy build image's bundle pins have diverged from the generated shape - left untouched. Update \`rolldown\` to 1.2.0 and \`rolldown-plugin-dts\` to 0.28.0.`;
+export default async function migration(tree) {
+    const nextSteps = [];
+    // Only a Smithy service project bundles the SSDK; the shapes type builds the
+    // model alone and pins none of this.
+    const buildDockerfiles = [
+        ...getProjects(tree).values()
+    ].filter((project)=>{
+        const metadata = project.metadata;
+        return metadata?.generator === SMITHY_PROJECT_GENERATOR_INFO.id && metadata.smithyType === 'service';
+    }).map((project)=>joinPathFragments(project.root, 'build.Dockerfile')).filter((filePath)=>tree.exists(filePath));
+    for (const path of buildDockerfiles){
+        const contents = tree.read(path, 'utf-8') ?? '';
+        for (const pin of PINS){
+            if (!isBehindTarget(contents, pin)) {
+                continue;
+            }
+            if (!await applyGritQL(tree, path, rewritePin(pin))) {
+                nextSteps.push(divergedNextStep(path));
+                break;
+            }
+        }
+    }
+    await formatFilesInSubtree(tree);
+    return {
+        nextSteps
+    };
+}
+
+//# sourceMappingURL=migration.js.map

package/src/migrations/latest/smithy-ssdk-bundle-pins/migration.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../../../../../../../packages/nx-plugin/src/migrations/latest/smithy-ssdk-bundle-pins/migration.ts"],"sourcesContent":["/**\n * Copyright Amazon.com, Inc. or its affiliates. All Rights Reserved.\n * SPDX-License-Identifier: Apache-2.0\n */\nimport {\n  getProjects,\n  joinPathFragments,\n  type MigrationReturnObject,\n  type Tree,\n} from '@nx/devkit';\nimport { SMITHY_PROJECT_GENERATOR_INFO } from '../../../smithy/project/generator';\nimport { applyGritQL } from '../../../utils/ast';\nimport { formatFilesInSubtree } from '../../../utils/format';\nimport { isVendedUpgrade } from '../../../utils/version-upgrade-migration/vended-upgrade';\n\n/**\n * Move a Smithy `build.Dockerfile` onto the SSDK bundle pins this release fixes.\n *\n * `rolldown-plugin-dts` named the bundled declaration after its content hash\n * before 0.20.0, so the generated handler's `./generated/ssdk/index.js` import\n * found no `index.d.ts` beside it and `compile` failed with TS7016. The two pins\n * move together: the plugin release that fixed the naming needs a rolldown past\n * the pin this shipped with.\n *\n * There is no Dockerfile grammar, so each pin is matched as an anchored rewrite\n * over the whole file with the version captured — `${...}` in these patterns is\n * GritQL metavariable syntax, not interpolation.\n */\n\n/** A pin in the file body, and the version this migration moves it to. */\ninterface Pin {\n  /** The package as the install command names it. */\n  readonly name: string;\n  readonly target: string;\n}\n\n/**\n * Hardcoded rather than read from `TS_VERSIONS`: this runs once, for the release\n * that fixed the declaration naming, so it must keep applying that exact change\n * however far the vended versions move afterwards. A workspace on a later release\n * gets the newer pins from the version sync instead.\n */\nconst PINS: readonly Pin[] = [\n  { name: 'rolldown', target: '1.2.0' },\n  { name: 'rolldown-plugin-dts', target: '0.28.0' },\n  { name: '@rollup/plugin-esm-shim', target: '0.1.8' },\n];\n\n/** A version ends at whitespace, a line break or the end of the command. */\nconst VERSION = String.raw`[^\\s\\\\]+`;\n\nconst escapeRegExp = (value: string): string =>\n  value.replace(/[.*+?^${}()|[\\]\\\\]/g, '\\\\$&');\n\n/**\n * Rewrite every occurrence of one pin to its target version.\n *\n * The pin is matched by name, so a `rolldown-plugin-dts@x` in the same command as\n * `rolldown@y` keeps its own version — the `@` before the version terminates the\n * match, so the shorter name does not match the longer one.\n */\nconst rewritePin = ({ name, target }: Pin): string =>\n  `r\"[\\\\s\\\\S]*${escapeRegExp(name)}@(${VERSION})[\\\\s\\\\S]*\"($version) where { $version => \\`${target}\\` }`;\n\n/** Whether the file pins this package behind the target version. */\nconst isBehindTarget = (contents: string, { name, target }: Pin): boolean => {\n  const matches = contents.matchAll(\n    new RegExp(`${escapeRegExp(name)}@(${VERSION})`, 'g'),\n  );\n  const declared = [...matches].flatMap((match) =>\n    match[1] ? [match[1]] : [],\n  );\n  // A rewrite replaces every occurrence at once, so this has to hold for all of\n  // them. Compared rather than tested for inequality, so a workspace a later\n  // release has already moved past the target keeps its newer pin.\n  return (\n    declared.length > 0 &&\n    declared.every((version) => isVendedUpgrade(target, version))\n  );\n};\n\nconst divergedNextStep = (path: string): string =>\n  `${path}: the Smithy build image's bundle pins have diverged from the generated shape - left untouched. Update \\`rolldown\\` to 1.2.0 and \\`rolldown-plugin-dts\\` to 0.28.0.`;\n\nexport default async function migration(\n  tree: Tree,\n): Promise<MigrationReturnObject> {\n  const nextSteps: string[] = [];\n\n  // Only a Smithy service project bundles the SSDK; the shapes type builds the\n  // model alone and pins none of this.\n  const buildDockerfiles = [...getProjects(tree).values()]\n    .filter((project) => {\n      const metadata = project.metadata as\n        | { generator?: string; smithyType?: string }\n        | undefined;\n      return (\n        metadata?.generator === SMITHY_PROJECT_GENERATOR_INFO.id &&\n        metadata.smithyType === 'service'\n      );\n    })\n    .map((project) => joinPathFragments(project.root, 'build.Dockerfile'))\n    .filter((filePath) => tree.exists(filePath));\n\n  for (const path of buildDockerfiles) {\n    const contents = tree.read(path, 'utf-8') ?? '';\n\n    for (const pin of PINS) {\n      if (!isBehindTarget(contents, pin)) {\n        continue;\n      }\n      if (!(await applyGritQL(tree, path, rewritePin(pin)))) {\n        nextSteps.push(divergedNextStep(path));\n        break;\n      }\n    }\n  }\n\n  await formatFilesInSubtree(tree);\n\n  return { nextSteps };\n}\n"],"names":["getProjects","joinPathFragments","SMITHY_PROJECT_GENERATOR_INFO","applyGritQL","formatFilesInSubtree","isVendedUpgrade","PINS","name","target","VERSION","String","raw","escapeRegExp","value","replace","rewritePin","isBehindTarget","contents","matches","matchAll","RegExp","declared","flatMap","match","length","every","version","divergedNextStep","path","migration","tree","nextSteps","buildDockerfiles","values","filter","project","metadata","generator","id","smithyType","map","root","filePath","exists","read","pin","push"],"mappings":"AAAA;;;CAGC,GACD,SACEA,WAAW,EACXC,iBAAiB,QAGZ,aAAa;AACpB,SAASC,6BAA6B,QAAQ,uCAAoC;AAClF,SAASC,WAAW,QAAQ,wBAAqB;AACjD,SAASC,oBAAoB,QAAQ,2BAAwB;AAC7D,SAASC,eAAe,QAAQ,6DAA0D;AAuB1F;;;;;CAKC,GACD,MAAMC,OAAuB;IAC3B;QAAEC,MAAM;QAAYC,QAAQ;IAAQ;IACpC;QAAED,MAAM;QAAuBC,QAAQ;IAAS;IAChD;QAAED,MAAM;QAA2BC,QAAQ;IAAQ;CACpD;AAED,0EAA0E,GAC1E,MAAMC,UAAUC,OAAOC,GAAG,CAAC,QAAQ,CAAC;AAEpC,MAAMC,eAAe,CAACC,QACpBA,MAAMC,OAAO,CAAC,uBAAuB;AAEvC;;;;;;CAMC,GACD,MAAMC,aAAa,CAAC,EAAER,IAAI,EAAEC,MAAM,EAAO,GACvC,CAAC,WAAW,EAAEI,aAAaL,MAAM,EAAE,EAAEE,QAAQ,4CAA4C,EAAED,OAAO,IAAI,CAAC;AAEzG,kEAAkE,GAClE,MAAMQ,iBAAiB,CAACC,UAAkB,EAAEV,IAAI,EAAEC,MAAM,EAAO;IAC7D,MAAMU,UAAUD,SAASE,QAAQ,CAC/B,IAAIC,OAAO,GAAGR,aAAaL,MAAM,EAAE,EAAEE,QAAQ,CAAC,CAAC,EAAE;IAEnD,MAAMY,WAAW;WAAIH;KAAQ,CAACI,OAAO,CAAC,CAACC,QACrCA,KAAK,CAAC,EAAE,GAAG;YAACA,KAAK,CAAC,EAAE;SAAC,GAAG,EAAE;IAE5B,8EAA8E;IAC9E,2EAA2E;IAC3E,iEAAiE;IACjE,OACEF,SAASG,MAAM,GAAG,KAClBH,SAASI,KAAK,CAAC,CAACC,UAAYrB,gBAAgBG,QAAQkB;AAExD;AAEA,MAAMC,mBAAmB,CAACC,OACxB,GAAGA,KAAK,mKAAmK,CAAC;AAE9K,eAAe,eAAeC,UAC5BC,IAAU;IAEV,MAAMC,YAAsB,EAAE;IAE9B,6EAA6E;IAC7E,qCAAqC;IACrC,MAAMC,mBAAmB;WAAIhC,YAAY8B,MAAMG,MAAM;KAAG,CACrDC,MAAM,CAAC,CAACC;QACP,MAAMC,WAAWD,QAAQC,QAAQ;QAGjC,OACEA,UAAUC,cAAcnC,8BAA8BoC,EAAE,IACxDF,SAASG,UAAU,KAAK;IAE5B,GACCC,GAAG,CAAC,CAACL,UAAYlC,kBAAkBkC,QAAQM,IAAI,EAAE,qBACjDP,MAAM,CAAC,CAACQ,WAAaZ,KAAKa,MAAM,CAACD;IAEpC,KAAK,MAAMd,QAAQI,iBAAkB;QACnC,MAAMf,WAAWa,KAAKc,IAAI,CAAChB,MAAM,YAAY;QAE7C,KAAK,MAAMiB,OAAOvC,KAAM;YACtB,IAAI,CAACU,eAAeC,UAAU4B,MAAM;gBAClC;YACF;YACA,IAAI,CAAE,MAAM1C,YAAY2B,MAAMF,MAAMb,WAAW8B,OAAQ;gBACrDd,UAAUe,IAAI,CAACnB,iBAAiBC;gBAChC;YACF;QACF;IACF;IAEA,MAAMxB,qBAAqB0B;IAE3B,OAAO;QAAEC;IAAU;AACrB"}

package/src/migrations/latest/strip-pip-from-python-images/__snapshots__/migration.spec.ts.snap

@@ -0,0 +1,48 @@
+// Vitest Snapshot v1, https://vitest.dev/guide/snapshot.html
+
+exports[`strip-pip-from-python-images migration > strips pip from a py#agent Dockerfile 1`] = `
+"FROM public.ecr.aws/docker/library/python:3.14-slim
+
+# Remove the base image's pip: the runtime runs from the bundled environment and
+# never needs it, and pip's vendored packages carry known HIGH/CRITICAL
+# vulnerabilities flagged by the image scan.
+RUN python -m pip uninstall -y pip && \\
+    rm -rf /usr/local/lib/python*/site-packages/pip \\
+           /usr/local/lib/python*/site-packages/pip-*.dist-info
+
+WORKDIR /app
+
+# Copy bundled package
+COPY . /app
+
+EXPOSE 8080
+
+ENV PYTHONPATH=/app
+ENV PATH="/app/bin:\${PATH}"
+
+CMD ["python", "bin/opentelemetry-instrument", "python", "-m", "proj_py_project.my_agent.main"]
+"
+`;
+
+exports[`strip-pip-from-python-images migration > strips pip from a py#mcp-server Dockerfile 1`] = `
+"FROM public.ecr.aws/docker/library/python:3.14-slim
+
+# Remove the base image's pip: the runtime runs from the bundled environment and
+# never needs it, and pip's vendored packages carry known HIGH/CRITICAL
+# vulnerabilities flagged by the image scan.
+RUN python -m pip uninstall -y pip && \\
+    rm -rf /usr/local/lib/python*/site-packages/pip \\
+           /usr/local/lib/python*/site-packages/pip-*.dist-info
+
+WORKDIR /app
+
+# Copy bundled package
+COPY . /app
+
+EXPOSE 8000
+
+ENV PYTHONPATH=/app
+
+CMD ["python", "bin/opentelemetry-instrument", "python", "-m", "uvicorn", "proj_py_project.my_mcp.http:app", "--host", "0.0.0.0", "--port", "8000"]
+"
+`;

package/src/migrations/latest/strip-pip-from-python-images/metadata.json

@@ -0,0 +1,3 @@
+{
+  "description": "Remove pip from vended Python agent / MCP server images so its vulnerable vendored packages are not present at runtime"
+}

package/src/migrations/latest/strip-pip-from-python-images/migration.d.ts

@@ -0,0 +1,6 @@
+/**
+ * Copyright Amazon.com, Inc. or its affiliates. All Rights Reserved.
+ * SPDX-License-Identifier: Apache-2.0
+ */
+import { type MigrationReturnObject, type Tree } from '@nx/devkit';
+export default function migration(tree: Tree): Promise<MigrationReturnObject>;