@aws/nx-plugin 1.0.0-rc.80 → 1.0.0-rc.81

package/LICENSE-THIRD-PARTY

@@ -217,7 +217,7 @@ OTHER DEALINGS IN THE SOFTWARE.
 
 ---
 
-The following software may be included in this product: @astral-sh/ruff-wasm-nodejs (0.16.3)
+The following software may be included in this product: @astral-sh/ruff-wasm-nodejs (0.16.4)
 This software contains the following license and notice below:
 
 MIT License
@@ -7558,7 +7558,7 @@ SOFTWARE
 
 ---
 
-The following software may be included in this product: @verdaccio/auth (8.1.1)
+The following software may be included in this product: @verdaccio/auth (8.1.2)
 This software contains the following license and notice below:
 
 MIT License
@@ -7585,7 +7585,7 @@ SOFTWARE.
 
 ---
 
-The following software may be included in this product: @verdaccio/config (8.2.1)
+The following software may be included in this product: @verdaccio/config (8.2.2)
 This software contains the following license and notice below:
 
 MIT License
@@ -7612,7 +7612,7 @@ SOFTWARE.
 
 ---
 
-The following software may be included in this product: @verdaccio/core (8.2.1)
+The following software may be included in this product: @verdaccio/core (8.2.2)
 This software contains the following license and notice below:
 
 MIT License
@@ -7666,7 +7666,7 @@ SOFTWARE.
 
 ---
 
-The following software may be included in this product: @verdaccio/hooks (8.1.2)
+The following software may be included in this product: @verdaccio/hooks (8.1.3)
 This software contains the following license and notice below:
 
 MIT License
@@ -7693,7 +7693,7 @@ SOFTWARE.
 
 ---
 
-The following software may be included in this product: @verdaccio/loaders (8.1.1)
+The following software may be included in this product: @verdaccio/loaders (8.1.2)
 This software contains the following license and notice below:
 
 MIT License
@@ -7720,7 +7720,7 @@ SOFTWARE.
 
 ---
 
-The following software may be included in this product: @verdaccio/local-storage-legacy (11.4.1)
+The following software may be included in this product: @verdaccio/local-storage-legacy (11.4.2)
 This software contains the following license and notice below:
 
 MIT License
@@ -7747,7 +7747,7 @@ SOFTWARE.
 
 ---
 
-The following software may be included in this product: @verdaccio/logger (8.1.1)
+The following software may be included in this product: @verdaccio/logger (8.1.2)
 This software contains the following license and notice below:
 
 MIT License
@@ -7774,7 +7774,7 @@ SOFTWARE.
 
 ---
 
-The following software may be included in this product: @verdaccio/logger-commons (8.1.1)
+The following software may be included in this product: @verdaccio/logger-commons (8.1.2)
 This software contains the following license and notice below:
 
 MIT License
@@ -7828,7 +7828,7 @@ SOFTWARE.
 
 ---
 
-The following software may be included in this product: @verdaccio/middleware (8.1.1)
+The following software may be included in this product: @verdaccio/middleware (8.1.2)
 This software contains the following license and notice below:
 
 MIT License
@@ -7855,7 +7855,7 @@ SOFTWARE.
 
 ---
 
-The following software may be included in this product: @verdaccio/package-filter (13.1.1)
+The following software may be included in this product: @verdaccio/package-filter (13.2.0)
 This software contains the following license and notice below:
 
 MIT License
@@ -7909,7 +7909,7 @@ SOFTWARE.
 
 ---
 
-The following software may be included in this product: @verdaccio/signature (8.1.1)
+The following software may be included in this product: @verdaccio/signature (8.1.2)
 This software contains the following license and notice below:
 
 MIT License
@@ -7963,7 +7963,7 @@ SOFTWARE.
 
 ---
 
-The following software may be included in this product: @verdaccio/tarball (13.1.1)
+The following software may be included in this product: @verdaccio/tarball (13.1.2)
 This software contains the following license and notice below:
 
 MIT License
@@ -7990,7 +7990,7 @@ SOFTWARE.
 
 ---
 
-The following software may be included in this product: @verdaccio/ui-theme (9.0.0-next-9.23)
+The following software may be included in this product: @verdaccio/ui-theme (9.0.0-next-9.26)
 This software contains the following license and notice below:
 
 MIT License
@@ -8017,7 +8017,7 @@ SOFTWARE.
 
 ---
 
-The following software may be included in this product: @verdaccio/url (13.1.1)
+The following software may be included in this product: @verdaccio/url (13.1.2)
 This software contains the following license and notice below:
 
 MIT License
@@ -8044,7 +8044,7 @@ SOFTWARE.
 
 ---
 
-The following software may be included in this product: @verdaccio/utils (8.2.1)
+The following software may be included in this product: @verdaccio/utils (8.2.2)
 This software contains the following license and notice below:
 
 MIT License
@@ -8071,7 +8071,7 @@ SOFTWARE.
 
 ---
 
-The following software may be included in this product: @vitest/coverage-v8 (4.1.10)
+The following software may be included in this product: @vitest/coverage-v8 (4.1.11)
 This software contains the following license and notice below:
 
 MIT License
@@ -8098,7 +8098,7 @@ SOFTWARE.
 
 ---
 
-The following software may be included in this product: @vitest/expect (4.1.10)
+The following software may be included in this product: @vitest/expect (4.1.11)
 This software contains the following license and notice below:
 
 MIT License
@@ -8125,7 +8125,7 @@ SOFTWARE.
 
 ---
 
-The following software may be included in this product: @vitest/mocker (4.1.10)
+The following software may be included in this product: @vitest/mocker (4.1.11)
 This software contains the following license and notice below:
 
 MIT License
@@ -8152,7 +8152,7 @@ SOFTWARE.
 
 ---
 
-The following software may be included in this product: @vitest/pretty-format (4.1.10)
+The following software may be included in this product: @vitest/pretty-format (4.1.11)
 This software contains the following license and notice below:
 
 MIT License
@@ -8179,7 +8179,7 @@ SOFTWARE.
 
 ---
 
-The following software may be included in this product: @vitest/runner (4.1.10)
+The following software may be included in this product: @vitest/runner (4.1.11)
 This software contains the following license and notice below:
 
 MIT License
@@ -8206,7 +8206,7 @@ SOFTWARE.
 
 ---
 
-The following software may be included in this product: @vitest/snapshot (4.1.10)
+The following software may be included in this product: @vitest/snapshot (4.1.11)
 This software contains the following license and notice below:
 
 MIT License
@@ -8233,7 +8233,7 @@ SOFTWARE.
 
 ---
 
-The following software may be included in this product: @vitest/spy (4.1.10)
+The following software may be included in this product: @vitest/spy (4.1.11)
 This software contains the following license and notice below:
 
 MIT License
@@ -8260,7 +8260,7 @@ SOFTWARE.
 
 ---
 
-The following software may be included in this product: @vitest/ui (4.1.10)
+The following software may be included in this product: @vitest/ui (4.1.11)
 This software contains the following license and notice below:
 
 MIT License
@@ -8287,7 +8287,7 @@ SOFTWARE.
 
 ---
 
-The following software may be included in this product: @vitest/utils (4.1.10)
+The following software may be included in this product: @vitest/utils (4.1.11)
 This software contains the following license and notice below:
 
 MIT License
@@ -22492,6 +22492,32 @@ CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE.
 
 ---
 
+The following software may be included in this product: postcss (8.5.26)
+This software contains the following license and notice below:
+
+The MIT License (MIT)
+
+Copyright 2013 Andrey Sitnik <andrey@sitnik.es>
+
+Permission is hereby granted, free of charge, to any person obtaining a copy of
+this software and associated documentation files (the "Software"), to deal in
+the Software without restriction, including without limitation the rights to
+use, copy, modify, merge, publish, distribute, sublicense, and/or sell copies of
+the Software, and to permit persons to whom the Software is furnished to do so,
+subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, FITNESS
+FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR
+COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER
+IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN
+CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE.
+
+---
+
 The following software may be included in this product: postcss-modules (6.0.1)
 This software contains the following license and notice below:
 
@@ -25901,7 +25927,7 @@ SOFTWARE.
 
 ---
 
-The following software may be included in this product: tinyexec (1.0.4)
+The following software may be included in this product: tinyexec (1.2.4)
 This software contains the following license and notice below:
 
 MIT License
@@ -27163,7 +27189,7 @@ SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE.
 
 ---
 
-The following software may be included in this product: verdaccio (6.9.2)
+The following software may be included in this product: verdaccio (6.10.0)
 This software contains the following license and notice below:
 
 MIT License
@@ -27190,7 +27216,7 @@ SOFTWARE.
 
 ---
 
-The following software may be included in this product: verdaccio-audit (13.1.1)
+The following software may be included in this product: verdaccio-audit (13.1.2)
 This software contains the following license and notice below:
 
 MIT License
@@ -27217,7 +27243,7 @@ SOFTWARE.
 
 ---
 
-The following software may be included in this product: verdaccio-htpasswd (13.1.1)
+The following software may be included in this product: verdaccio-htpasswd (13.1.2)
 This software contains the following license and notice below:
 
 MIT License
@@ -27324,7 +27350,7 @@ SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE.
 
 ---
 
-The following software may be included in this product: vite (8.2.1)
+The following software may be included in this product: vite (8.2.2)
 This software contains the following license and notice below:
 
 # Vite core license
@@ -29652,7 +29678,7 @@ Repository: https://github.com/sveltejs/zimmerframe
 
 ---
 
-The following software may be included in this product: vitest (4.1.10)
+The following software may be included in this product: vitest (4.1.11)
 This software contains the following license and notice below:
 
 # Vitest core license
@@ -33495,7 +33521,7 @@ under the terms of *both* these licenses.
 
 ---
 
-The following software may be included in this product: @swc/core (1.16.0)
+The following software may be included in this product: @swc/core (1.16.1)
 This software contains the following license and notice below:
 
 Apache License
@@ -41208,7 +41234,7 @@ OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
 
 ---
 
-The following software may be included in this product: @swc/core-linux-x64-gnu (1.16.0)
+The following software may be included in this product: @swc/core-linux-x64-gnu (1.16.1)
 This software contains the following license and notice below:
 
 Apache License

package/migrations.json

@@ -2,26 +2,6 @@
   "$schema": "http://json-schema.org/schema",
   "name": "@aws/nx-plugin",
   "generators": {
-    "latest-remove-mcp-inspector-license-exceptions": {
-      "version": "1.0.0-rc.73",
-      "description": "Remove the obsolete MCP Inspector license exceptions",
-      "implementation": "./src/migrations/latest/remove-mcp-inspector-license-exceptions/migration"
-    },
-    "latest-apt-security-updates-in-container-images": {
-      "version": "1.0.0-rc.73",
-      "description": "Apply the distribution's security updates in vended agent / MCP server container images",
-      "implementation": "./src/migrations/latest/apt-security-updates-in-container-images/migration"
-    },
-    "latest-py-agent-session-id-middleware-extraction": {
-      "version": "1.0.0-rc.74",
-      "description": "Extract the duplicated _SessionIdMiddleware class in py#agent's main.py into a shared middleware/session_id_middleware.py module",
-      "implementation": "./src/migrations/latest/py-agent-session-id-middleware-extraction/migration"
-    },
-    "latest-ts-agent-session-id-middleware-extraction": {
-      "version": "1.0.0-rc.75",
-      "description": "Extract the duplicated session-id Express middleware in ts#agent's ag-ui/a2a index.ts into a shared middleware/session-id-middleware.ts module",
-      "implementation": "./src/migrations/latest/ts-agent-session-id-middleware-extraction/migration"
-    },
     "latest-dynamodb-configurable-encryption": {
       "version": "1.0.0-rc.77",
       "description": "Surface encryption and encryptionKey on the vended DynamoDBTable construct/module",
@@ -162,8 +142,28 @@
       "description": "Add session management support to py#agent",
       "implementation": "./src/migrations/v1.0.0-rc.72/0001-py-agent-session-management-support/migration"
     },
+    "v1.0.0-rc.73-0001-remove-mcp-inspector-license-exceptions": {
+      "version": "1.0.0-rc.73",
+      "description": "Remove the obsolete MCP Inspector license exceptions",
+      "implementation": "./src/migrations/v1.0.0-rc.73/0001-remove-mcp-inspector-license-exceptions/migration"
+    },
+    "v1.0.0-rc.73-0002-apt-security-updates-in-container-images": {
+      "version": "1.0.0-rc.73",
+      "description": "Apply the distribution's security updates in vended agent / MCP server container images",
+      "implementation": "./src/migrations/v1.0.0-rc.73/0002-apt-security-updates-in-container-images/migration"
+    },
+    "v1.0.0-rc.74-0001-py-agent-session-id-middleware-extraction": {
+      "version": "1.0.0-rc.74",
+      "description": "Extract the duplicated _SessionIdMiddleware class in py#agent's main.py into a shared middleware/session_id_middleware.py module",
+      "implementation": "./src/migrations/v1.0.0-rc.74/0001-py-agent-session-id-middleware-extraction/migration"
+    },
+    "v1.0.0-rc.75-0001-ts-agent-session-id-middleware-extraction": {
+      "version": "1.0.0-rc.75",
+      "description": "Extract the duplicated session-id Express middleware in ts#agent's ag-ui/a2a index.ts into a shared middleware/session-id-middleware.ts module",
+      "implementation": "./src/migrations/v1.0.0-rc.75/0001-ts-agent-session-id-middleware-extraction/migration"
+    },
     "sync-vended-versions": {
-      "version": "1.0.0-rc.80",
+      "version": "1.0.0-rc.81",
       "description": "Sync vended dependency versions and the tracked plugin version to those vended by this release",
       "implementation": "./src/utils/version-upgrade-migration/migration"
     }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@aws/nx-plugin",
-  "version": "1.0.0-rc.80",
+  "version": "1.0.0-rc.81",
   "repository": {
     "type": "git",
     "url": "https://github.com/awslabs/nx-plugin-for-aws.git",
@@ -40,9 +40,9 @@
   },
   "dependencies": {
     "@apidevtools/swagger-parser": "12.1.0",
-    "@astral-sh/ruff-wasm-nodejs": "0.16.3",
+    "@astral-sh/ruff-wasm-nodejs": "0.16.4",
     "@biomejs/js-api": "6.0.0",
-    "@biomejs/wasm-nodejs": "2.5.8",
+    "@biomejs/wasm-nodejs": "2.5.10",
     "@getgrit/gritql": "0.0.3",
     "@iarna/toml": "2.2.5",
     "@modelcontextprotocol/sdk": "1.30.0",
@@ -79,8 +79,8 @@
     "typescript": "6.0.3",
     "unified": "11.0.5",
     "unist-util-visit": "5.1.0",
-    "vite": "8.2.1",
-    "vitest": "4.1.10",
+    "vite": "8.2.2",
+    "vitest": "4.1.11",
     "zod": "4.4.3"
   },
   "devDependencies": {

package/src/agentcore-gateway/__snapshots__/generator.spec.ts.snap

@@ -7,7 +7,7 @@ exports[`agentcore-gateway generator > protocol: http > omits protocol_type from
   required_providers {
     aws = {
       source  = "hashicorp/aws"
-      version = "6.60.0"
+      version = "6.61.0"
     }
     time = {
       source  = "hashicorp/time"

package/src/infra/app/__snapshots__/generator.spec.ts.snap

@@ -56,7 +56,7 @@ exports[`infra generator > should configure Checkov target correctly > checkov-t
     "{workspaceRoot}/dist/{projectRoot}/cdk.out",
   ],
   "options": {
-    "command": "uvx --from checkov==3.3.11 checkov --config-file {projectRoot}/checkov.yml --directory dist/{projectRoot}/cdk.out --framework cloudformation",
+    "command": "uvx --from checkov==3.3.13 checkov --config-file {projectRoot}/checkov.yml --directory dist/{projectRoot}/cdk.out --framework cloudformation",
   },
   "outputs": [
     "{workspaceRoot}/dist/{projectRoot}/checkov",
@@ -150,7 +150,7 @@ exports[`infra generator > should configure project.json with correct targets >
         "{workspaceRoot}/dist/{projectRoot}/cdk.out",
       ],
       "options": {
-        "command": "uvx --from checkov==3.3.11 checkov --config-file {projectRoot}/checkov.yml --directory dist/{projectRoot}/cdk.out --framework cloudformation",
+        "command": "uvx --from checkov==3.3.13 checkov --config-file {projectRoot}/checkov.yml --directory dist/{projectRoot}/cdk.out --framework cloudformation",
       },
       "outputs": [
         "{workspaceRoot}/dist/{projectRoot}/checkov",
@@ -745,7 +745,7 @@ exports[`infra generator > should handle custom project names correctly > custom
         "{workspaceRoot}/dist/{projectRoot}/cdk.out",
       ],
       "options": {
-        "command": "uvx --from checkov==3.3.11 checkov --config-file {projectRoot}/checkov.yml --directory dist/{projectRoot}/cdk.out --framework cloudformation",
+        "command": "uvx --from checkov==3.3.13 checkov --config-file {projectRoot}/checkov.yml --directory dist/{projectRoot}/cdk.out --framework cloudformation",
       },
       "outputs": [
         "{workspaceRoot}/dist/{projectRoot}/checkov",

package/src/migrations/v1.0.0-rc.73/0001-remove-mcp-inspector-license-exceptions/migration.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../../../../../../../packages/nx-plugin/src/migrations/v1.0.0-rc.73/0001-remove-mcp-inspector-license-exceptions/migration.ts"],"sourcesContent":["/**\n * Copyright Amazon.com, Inc. or its affiliates. All Rights Reserved.\n * SPDX-License-Identifier: Apache-2.0\n */\nimport { readJson, type Tree } from '@nx/devkit';\nimport { removeLicenseExceptions } from '../../../license/config.js';\nimport { registerPnpmBuiltDependencies } from '../../../utils/pnpm-workspace.js';\n\nconst INSPECTOR = '@modelcontextprotocol/inspector';\n\n/**\n * MCP Inspector v1 declared `SEE LICENSE IN LICENSE`, which resolves to no SPDX\n * identifier, so the license check needed an exception per published package.\n * v2 ships as a single package declaring `MIT`, which the allowlist already\n * covers, and the stale exceptions would override that with `Apache-2.0`.\n */\nconst OBSOLETE_EXCEPTIONS = [\n  INSPECTOR,\n  `${INSPECTOR}-cli`,\n  `${INSPECTOR}-server`,\n  `${INSPECTOR}-client`,\n];\n\n/** Whether the workspace root declares the inspector as a devDependency. */\nconst hasInspector = (tree: Tree): boolean => {\n  if (!tree.exists('package.json')) {\n    return false;\n  }\n  const packageJson = readJson(tree, 'package.json');\n  return Boolean(\n    packageJson.devDependencies?.[INSPECTOR] ??\n      packageJson.dependencies?.[INSPECTOR],\n  );\n};\n\nexport default async function migration(tree: Tree): Promise<void> {\n  await removeLicenseExceptions(tree, OBSOLETE_EXCEPTIONS);\n\n  // The version sync bumps the inspector to v2, which added a postinstall\n  // script. Register it as an explicitly-rejected build so the upgrade's\n  // install isn't failed by pnpm 11's default `strictDepBuilds=true`.\n  if (hasInspector(tree)) {\n    registerPnpmBuiltDependencies(tree, { [INSPECTOR]: false });\n  }\n}\n"],"names":["readJson","removeLicenseExceptions","registerPnpmBuiltDependencies","INSPECTOR","OBSOLETE_EXCEPTIONS","hasInspector","tree","exists","packageJson","Boolean","devDependencies","dependencies","migration"],"mappings":"AAAA;;;CAGC,GACD,SAASA,QAAQ,QAAmB,aAAa;AACjD,SAASC,uBAAuB,QAAQ,6BAA6B;AACrE,SAASC,6BAA6B,QAAQ,mCAAmC;AAEjF,MAAMC,YAAY;AAElB;;;;;CAKC,GACD,MAAMC,sBAAsB;IAC1BD;IACA,GAAGA,UAAU,IAAI,CAAC;IAClB,GAAGA,UAAU,OAAO,CAAC;IACrB,GAAGA,UAAU,OAAO,CAAC;CACtB;AAED,0EAA0E,GAC1E,MAAME,eAAe,CAACC;IACpB,IAAI,CAACA,KAAKC,MAAM,CAAC,iBAAiB;QAChC,OAAO;IACT;IACA,MAAMC,cAAcR,SAASM,MAAM;IACnC,OAAOG,QACLD,YAAYE,eAAe,EAAE,CAACP,UAAU,IACtCK,YAAYG,YAAY,EAAE,CAACR,UAAU;AAE3C;AAEA,eAAe,eAAeS,UAAUN,IAAU;IAChD,MAAML,wBAAwBK,MAAMF;IAEpC,wEAAwE;IACxE,uEAAuE;IACvE,oEAAoE;IACpE,IAAIC,aAAaC,OAAO;QACtBJ,8BAA8BI,MAAM;YAAE,CAACH,UAAU,EAAE;QAAM;IAC3D;AACF"}

package/src/migrations/v1.0.0-rc.73/0002-apt-security-updates-in-container-images/migration.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../../../../../../../packages/nx-plugin/src/migrations/v1.0.0-rc.73/0002-apt-security-updates-in-container-images/migration.ts"],"sourcesContent":["/**\n * Copyright Amazon.com, Inc. or its affiliates. All Rights Reserved.\n * SPDX-License-Identifier: Apache-2.0\n */\nimport {\n  getProjects,\n  joinPathFragments,\n  type MigrationReturnObject,\n  type ProjectConfiguration,\n  type Tree,\n} from '@nx/devkit';\nimport { formatFilesInSubtree } from '../../../utils/format.js';\nimport type { ComponentMetadata } from '../../../utils/nx.js';\n\n/**\n * Apply the distribution's security updates in the vended agent / MCP server\n * images.\n *\n * A base image tag lags behind its distribution's security suite, so the OS\n * packages it ships carry vulnerabilities that already have a fixed version\n * published — which the image scan flags as HIGH/CRITICAL. Upgrading them in the\n * image build clears those findings whenever the scan runs, rather than waiting\n * for the base image to be rebuilt. New workspaces get this from the generator\n * templates; this brings existing ones up to date.\n *\n * Only the Dockerfiles of the components whose images the generators vend are\n * touched, located from their project metadata. The Dockerfile is generated\n * `KeepExisting`, so it is edited in place: the upgrade is inserted right after\n * the `FROM` line, ahead of every other instruction, so later layers install\n * against the upgraded packages. One that already runs `apt-get upgrade`, or\n * which has been re-based onto an image `apt-get` can't upgrade, is left alone.\n */\n\n/**\n * The generators whose runtime images the vended Dockerfiles build. Hardcoded\n * rather than imported from the generators: a migration matches the ids\n * workspaces recorded at generation time, which must stay fixed even if the\n * generators' current ids change later.\n */\nconst RUNTIME_IMAGE_GENERATOR_IDS = [\n  'py#agent',\n  'py#mcp-server',\n  'ts#agent',\n  'ts#mcp-server',\n];\n\nconst APT_UPGRADE = `# Apply the distribution's security updates: base image tags lag behind the\n# security suite, so its OS packages carry fixed HIGH/CRITICAL vulnerabilities\n# flagged by the image scan.\nRUN apt-get update && \\\\\n    apt-get upgrade -y --no-install-recommends && \\\\\n    rm -rf /var/lib/apt/lists/*`;\n\n/** The apt command this migration adds; used to detect an applied fix. */\nconst APT_UPGRADE_COMMAND = 'apt-get upgrade';\n\n/**\n * The Debian-derived base images the generators vend, whose packages `apt-get`\n * upgrades. A user who has re-based onto another image (Alpine, distroless,\n * Amazon Linux) needs a different command, so theirs is left as they wrote it.\n */\nconst DEBIAN_BASE_IMAGE = /^FROM\\s+\\S*(?:node|python):\\S*\\n/m;\n\n/**\n * The Dockerfiles of every runtime image component, located from each project's\n * recorded component metadata (`path` is the component directory relative to\n * the project root).\n */\nconst runtimeImageDockerfiles = (tree: Tree): string[] => {\n  const paths: string[] = [];\n  for (const project of getProjects(tree).values()) {\n    const components = ((\n      project.metadata as { components?: ComponentMetadata[] }\n    )?.components ?? []) as ComponentMetadata[];\n    for (const component of components) {\n      if (\n        !RUNTIME_IMAGE_GENERATOR_IDS.includes(component.generator) ||\n        !component.path\n      ) {\n        continue;\n      }\n      const dockerfile = joinPathFragments(\n        projectRoot(project),\n        component.path,\n        'Dockerfile',\n      );\n      if (tree.exists(dockerfile)) {\n        paths.push(dockerfile);\n      }\n    }\n  }\n  return paths;\n};\n\n/** A project's root, falling back to sourceRoot for the TS-solution layout. */\nconst projectRoot = (project: ProjectConfiguration): string =>\n  project.root ?? project.sourceRoot ?? '';\n\nexport default async function migration(\n  tree: Tree,\n): Promise<MigrationReturnObject> {\n  for (const filePath of runtimeImageDockerfiles(tree)) {\n    const content = tree.read(filePath, 'utf-8');\n    if (!content) {\n      continue;\n    }\n    if (content.includes(APT_UPGRADE_COMMAND)) {\n      continue; // Already upgrading (migrated or user-added).\n    }\n\n    const from = content.match(DEBIAN_BASE_IMAGE);\n    if (from?.index === undefined) {\n      continue; // The user has re-based the image; theirs to patch, not ours.\n    }\n\n    // Insert the upgrade after the FROM line, ahead of every other instruction\n    // so later layers install against the upgraded packages, with the spacing a\n    // freshly generated Dockerfile has.\n    const insertAt = from.index + from[0].length;\n    tree.write(\n      filePath,\n      `${content.slice(0, insertAt)}\\n${APT_UPGRADE}\\n${content.slice(insertAt)}`,\n    );\n  }\n\n  await formatFilesInSubtree(tree);\n\n  return {};\n}\n"],"names":["getProjects","joinPathFragments","formatFilesInSubtree","RUNTIME_IMAGE_GENERATOR_IDS","APT_UPGRADE","APT_UPGRADE_COMMAND","DEBIAN_BASE_IMAGE","runtimeImageDockerfiles","tree","paths","project","values","components","metadata","component","includes","generator","path","dockerfile","projectRoot","exists","push","root","sourceRoot","migration","filePath","content","read","from","match","index","undefined","insertAt","length","write","slice"],"mappings":"AAAA;;;CAGC,GACD,SACEA,WAAW,EACXC,iBAAiB,QAIZ,aAAa;AACpB,SAASC,oBAAoB,QAAQ,2BAA2B;AAGhE;;;;;;;;;;;;;;;;;CAiBC,GAED;;;;;CAKC,GACD,MAAMC,8BAA8B;IAClC;IACA;IACA;IACA;CACD;AAED,MAAMC,cAAc,CAAC;;;;;+BAKU,CAAC;AAEhC,wEAAwE,GACxE,MAAMC,sBAAsB;AAE5B;;;;CAIC,GACD,MAAMC,oBAAoB;AAE1B;;;;CAIC,GACD,MAAMC,0BAA0B,CAACC;IAC/B,MAAMC,QAAkB,EAAE;IAC1B,KAAK,MAAMC,WAAWV,YAAYQ,MAAMG,MAAM,GAAI;QAChD,MAAMC,aAAc,AAClBF,QAAQG,QAAQ,EACfD,cAAc,EAAE;QACnB,KAAK,MAAME,aAAaF,WAAY;YAClC,IACE,CAACT,4BAA4BY,QAAQ,CAACD,UAAUE,SAAS,KACzD,CAACF,UAAUG,IAAI,EACf;gBACA;YACF;YACA,MAAMC,aAAajB,kBACjBkB,YAAYT,UACZI,UAAUG,IAAI,EACd;YAEF,IAAIT,KAAKY,MAAM,CAACF,aAAa;gBAC3BT,MAAMY,IAAI,CAACH;YACb;QACF;IACF;IACA,OAAOT;AACT;AAEA,6EAA6E,GAC7E,MAAMU,cAAc,CAACT,UACnBA,QAAQY,IAAI,IAAIZ,QAAQa,UAAU,IAAI;AAExC,eAAe,eAAeC,UAC5BhB,IAAU;IAEV,KAAK,MAAMiB,YAAYlB,wBAAwBC,MAAO;QACpD,MAAMkB,UAAUlB,KAAKmB,IAAI,CAACF,UAAU;QACpC,IAAI,CAACC,SAAS;YACZ;QACF;QACA,IAAIA,QAAQX,QAAQ,CAACV,sBAAsB;YACzC,UAAU,8CAA8C;QAC1D;QAEA,MAAMuB,OAAOF,QAAQG,KAAK,CAACvB;QAC3B,IAAIsB,MAAME,UAAUC,WAAW;YAC7B,UAAU,8DAA8D;QAC1E;QAEA,2EAA2E;QAC3E,4EAA4E;QAC5E,oCAAoC;QACpC,MAAMC,WAAWJ,KAAKE,KAAK,GAAGF,IAAI,CAAC,EAAE,CAACK,MAAM;QAC5CzB,KAAK0B,KAAK,CACRT,UACA,GAAGC,QAAQS,KAAK,CAAC,GAAGH,UAAU,EAAE,EAAE5B,YAAY,EAAE,EAAEsB,QAAQS,KAAK,CAACH,WAAW;IAE/E;IAEA,MAAM9B,qBAAqBM;IAE3B,OAAO,CAAC;AACV"}

package/src/migrations/v1.0.0-rc.74/0001-py-agent-session-id-middleware-extraction/migration.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../../../../../../../packages/nx-plugin/src/migrations/v1.0.0-rc.74/0001-py-agent-session-id-middleware-extraction/migration.ts"],"sourcesContent":["/**\n * Copyright Amazon.com, Inc. or its affiliates. All Rights Reserved.\n * SPDX-License-Identifier: Apache-2.0\n */\nimport { readFileSync } from 'node:fs';\nimport { join } from 'node:path';\nimport {\n  getProjects,\n  joinPathFragments,\n  type MigrationReturnObject,\n  type Tree,\n} from '@nx/devkit';\nimport { PY_AGENT_GENERATOR_INFO } from '../../../py/agent/generator.js';\nimport {\n  addPythonDestructuredImport,\n  applyGritQL,\n  captureGritQLVariable,\n  matchGritQL,\n} from '../../../utils/ast.js';\nimport { formatFilesInSubtree } from '../../../utils/format.js';\nimport type { ComponentMetadata } from '../../../utils/nx.js';\n\n/**\n * Extract the `_SessionIdMiddleware` class - previously duplicated verbatim\n * in every py#agent `main.py` (one copy per framework/protocol combination) -\n * into a shared `middleware/session_id_middleware.py` module sitting beside\n * `main.py`, mirroring the http#/a2a#/ag-ui#'s own `common/agent.py` and\n * `common/session.py` sharing pattern.\n *\n * The transform is protocol/framework-agnostic: every generated `main.py`\n * duplicated the exact same `dispatch` body (only the docstring differs\n * between AG-UI and HTTP/A2A), so one rewrite handles all six shapes. Imports\n * that only existed to support the inlined class (`uuid`, `Request`,\n * `BaseHTTPMiddleware`, `session_id_context`) are left for the trailing\n * `formatFilesInSubtree` ruff pass to prune if they've gone unused - AG-UI's\n * `main.py` still uses several of them directly, so nothing here can safely\n * assume any one of them is dead.\n */\nconst pyMatch = (snippet: string) => `language python\\n\\`${snippet}\\``;\n\nconst pyDelete = (snippet: string) => `${pyMatch(snippet)} => .`;\n\nconst pyRewrite = (from: string, to: string): string => {\n  const replacement = to.includes('\\n') ? `raw\\`${to}\\`` : `\\`${to}\\``;\n  return `${pyMatch(from)} => ${replacement}`;\n};\n\n// Both frameworks import `session_id_context` from the shared agent-connection\n// module alongside other names, so this both confirms the old shape is\n// present and recovers the module name to import the new middleware from.\nconst SESSION_ID_CONTEXT_MOD_CAPTURE =\n  'language python\\n`from $mod import $names` where { $names <: contains `session_id_context` }';\n\nconst SESSION_ID_HEADER_LINE =\n  'SESSION_ID_HEADER = \"x-amzn-bedrock-agentcore-runtime-session-id\"';\n\nconst ADD_MIDDLEWARE_OLD = 'app.add_middleware(_SessionIdMiddleware)';\nconst ADD_MIDDLEWARE_NEW = 'app.add_middleware(SessionIdMiddleware)';\n\n// HTTP and A2A share this docstring verbatim; AG-UI's differs (see below).\nconst OLD_CLASS_INBOUND = `class _SessionIdMiddleware(BaseHTTPMiddleware):\n    \"\"\"Bind the inbound session (or a fresh UUID) to async context.\"\"\"\n\n    async def dispatch(self, request: Request, call_next):\n        session_id = request.headers.get(SESSION_ID_HEADER) or str(uuid.uuid4())\n        with session_id_context(session_id):\n            return await call_next(request)`;\n\nconst OLD_CLASS_DOWNSTREAM = `class _SessionIdMiddleware(BaseHTTPMiddleware):\n    \"\"\"Bind the session ID for this request so downstream MCP / A2A clients forward it on outbound calls.\"\"\"\n\n    async def dispatch(self, request: Request, call_next):\n        session_id = request.headers.get(SESSION_ID_HEADER) or str(uuid.uuid4())\n        with session_id_context(session_id):\n            return await call_next(request)`;\n\n// Both framework common/ dirs vend byte-identical middleware content (the\n// LangChain copy would work equally well); this one is read as the single\n// source of truth rather than hand-duplicating it here.\nconst SESSION_ID_MIDDLEWARE_TEMPLATE = readFileSync(\n  join(\n    import.meta.dirname,\n    '../../../py/agent/files/strands/common/middleware/session_id_middleware.py.template',\n  ),\n  'utf-8',\n);\n\nconst sessionIdMiddlewareContent = (agentConnectionModule: string): string =>\n  SESSION_ID_MIDDLEWARE_TEMPLATE.replace(\n    '<%- agentConnectionModuleName %>',\n    agentConnectionModule,\n  );\n\nconst findAgentComponents = (\n  components: ComponentMetadata[] | undefined,\n): ComponentMetadata[] =>\n  (components ?? []).filter(\n    (component) => component.generator === PY_AGENT_GENERATOR_INFO.id,\n  );\n\nconst migrateMain = async (\n  tree: Tree,\n  mainPath: string,\n  component: ComponentMetadata,\n  nextSteps: string[],\n): Promise<void> => {\n  if (!tree.exists(mainPath)) return;\n\n  const contents = tree.read(mainPath, 'utf-8') ?? '';\n  if (!contents.includes('class _SessionIdMiddleware(')) return;\n\n  const oldClass = contents.includes(\n    'Bind the session ID for this request so downstream MCP / A2A clients forward it on outbound calls.',\n  )\n    ? OLD_CLASS_DOWNSTREAM\n    : OLD_CLASS_INBOUND;\n\n  const ready =\n    (await matchGritQL(tree, mainPath, pyMatch(oldClass))) &&\n    (await matchGritQL(tree, mainPath, pyMatch(SESSION_ID_HEADER_LINE))) &&\n    (await matchGritQL(tree, mainPath, pyMatch(ADD_MIDDLEWARE_OLD))) &&\n    (await matchGritQL(tree, mainPath, SESSION_ID_CONTEXT_MOD_CAPTURE));\n\n  const diverged = () => {\n    const shape = [component.framework, component.protocol]\n      .filter(Boolean)\n      .join('/');\n    nextSteps.push(\n      `${mainPath}: diverged from the generated ${shape || 'py#agent'} shape - left untouched. Manually move \\`_SessionIdMiddleware\\` into a sibling \\`middleware/session_id_middleware.py\\` module and import it from there (see the py#agent generator's template).`,\n    );\n  };\n\n  if (!ready) {\n    diverged();\n    return;\n  }\n\n  const mod = await captureGritQLVariable(\n    tree,\n    mainPath,\n    SESSION_ID_CONTEXT_MOD_CAPTURE,\n    'mod',\n  );\n  if (!mod) {\n    diverged();\n    return;\n  }\n\n  const dir = mainPath.split('/').slice(0, -1).join('/');\n  const middlewareInitPath = joinPathFragments(\n    dir,\n    'middleware',\n    '__init__.py',\n  );\n  const middlewarePath = joinPathFragments(\n    dir,\n    'middleware',\n    'session_id_middleware.py',\n  );\n\n  if (!tree.exists(middlewareInitPath)) {\n    tree.write(middlewareInitPath, '');\n  }\n  if (!tree.exists(middlewarePath)) {\n    tree.write(middlewarePath, sessionIdMiddlewareContent(mod));\n  }\n\n  await applyGritQL(tree, mainPath, pyDelete(SESSION_ID_HEADER_LINE));\n  await applyGritQL(tree, mainPath, pyDelete(oldClass));\n  await applyGritQL(\n    tree,\n    mainPath,\n    pyRewrite(ADD_MIDDLEWARE_OLD, ADD_MIDDLEWARE_NEW),\n  );\n  // Imported unconditionally - SESSION_ID_HEADER is only still referenced by\n  // AG-UI's main.py after the class is gone; the ruff pass below prunes it\n  // from HTTP/A2A's now-unused import list.\n  await addPythonDestructuredImport(\n    tree,\n    mainPath,\n    ['SESSION_ID_HEADER', 'SessionIdMiddleware'],\n    '.middleware.session_id_middleware',\n  );\n};\n\nexport default async function migration(\n  tree: Tree,\n): Promise<MigrationReturnObject> {\n  const nextSteps: string[] = [];\n\n  for (const project of getProjects(tree).values()) {\n    const components = findAgentComponents(\n      (project.metadata as { components?: ComponentMetadata[] })?.components,\n    );\n\n    for (const component of components) {\n      if (!component.path) continue;\n\n      const componentDir = component.path.endsWith('/agent.py')\n        ? component.path.slice(0, -'/agent.py'.length)\n        : component.path;\n      const mainPath = joinPathFragments(project.root, componentDir, 'main.py');\n\n      await migrateMain(tree, mainPath, component, nextSteps);\n    }\n  }\n\n  await formatFilesInSubtree(tree);\n\n  return { nextSteps };\n}\n"],"names":["readFileSync","join","getProjects","joinPathFragments","PY_AGENT_GENERATOR_INFO","addPythonDestructuredImport","applyGritQL","captureGritQLVariable","matchGritQL","formatFilesInSubtree","pyMatch","snippet","pyDelete","pyRewrite","from","to","replacement","includes","SESSION_ID_CONTEXT_MOD_CAPTURE","SESSION_ID_HEADER_LINE","ADD_MIDDLEWARE_OLD","ADD_MIDDLEWARE_NEW","OLD_CLASS_INBOUND","OLD_CLASS_DOWNSTREAM","SESSION_ID_MIDDLEWARE_TEMPLATE","dirname","sessionIdMiddlewareContent","agentConnectionModule","replace","findAgentComponents","components","filter","component","generator","id","migrateMain","tree","mainPath","nextSteps","exists","contents","read","oldClass","ready","diverged","shape","framework","protocol","Boolean","push","mod","dir","split","slice","middlewareInitPath","middlewarePath","write","migration","project","values","metadata","path","componentDir","endsWith","length","root"],"mappings":"AAAA;;;CAGC,GACD,SAASA,YAAY,QAAQ,UAAU;AACvC,SAASC,IAAI,QAAQ,YAAY;AACjC,SACEC,WAAW,EACXC,iBAAiB,QAGZ,aAAa;AACpB,SAASC,uBAAuB,QAAQ,iCAAiC;AACzE,SACEC,2BAA2B,EAC3BC,WAAW,EACXC,qBAAqB,EACrBC,WAAW,QACN,wBAAwB;AAC/B,SAASC,oBAAoB,QAAQ,2BAA2B;AAGhE;;;;;;;;;;;;;;;CAeC,GACD,MAAMC,UAAU,CAACC,UAAoB,CAAC,mBAAmB,EAAEA,QAAQ,EAAE,CAAC;AAEtE,MAAMC,WAAW,CAACD,UAAoB,GAAGD,QAAQC,SAAS,KAAK,CAAC;AAEhE,MAAME,YAAY,CAACC,MAAcC;IAC/B,MAAMC,cAAcD,GAAGE,QAAQ,CAAC,QAAQ,CAAC,KAAK,EAAEF,GAAG,EAAE,CAAC,GAAG,CAAC,EAAE,EAAEA,GAAG,EAAE,CAAC;IACpE,OAAO,GAAGL,QAAQI,MAAM,IAAI,EAAEE,aAAa;AAC7C;AAEA,+EAA+E;AAC/E,uEAAuE;AACvE,0EAA0E;AAC1E,MAAME,iCACJ;AAEF,MAAMC,yBACJ;AAEF,MAAMC,qBAAqB;AAC3B,MAAMC,qBAAqB;AAE3B,2EAA2E;AAC3E,MAAMC,oBAAoB,CAAC;;;;;;2CAMgB,CAAC;AAE5C,MAAMC,uBAAuB,CAAC;;;;;;2CAMa,CAAC;AAE5C,0EAA0E;AAC1E,0EAA0E;AAC1E,wDAAwD;AACxD,MAAMC,iCAAiCxB,aACrCC,KACE,YAAYwB,OAAO,EACnB,wFAEF;AAGF,MAAMC,6BAA6B,CAACC,wBAClCH,+BAA+BI,OAAO,CACpC,oCACAD;AAGJ,MAAME,sBAAsB,CAC1BC,aAEA,AAACA,CAAAA,cAAc,EAAE,AAAD,EAAGC,MAAM,CACvB,CAACC,YAAcA,UAAUC,SAAS,KAAK7B,wBAAwB8B,EAAE;AAGrE,MAAMC,cAAc,OAClBC,MACAC,UACAL,WACAM;IAEA,IAAI,CAACF,KAAKG,MAAM,CAACF,WAAW;IAE5B,MAAMG,WAAWJ,KAAKK,IAAI,CAACJ,UAAU,YAAY;IACjD,IAAI,CAACG,SAASvB,QAAQ,CAAC,gCAAgC;IAEvD,MAAMyB,WAAWF,SAASvB,QAAQ,CAChC,wGAEEM,uBACAD;IAEJ,MAAMqB,QACJ,AAAC,MAAMnC,YAAY4B,MAAMC,UAAU3B,QAAQgC,cAC1C,MAAMlC,YAAY4B,MAAMC,UAAU3B,QAAQS,4BAC1C,MAAMX,YAAY4B,MAAMC,UAAU3B,QAAQU,wBAC1C,MAAMZ,YAAY4B,MAAMC,UAAUnB;IAErC,MAAM0B,WAAW;QACf,MAAMC,QAAQ;YAACb,UAAUc,SAAS;YAAEd,UAAUe,QAAQ;SAAC,CACpDhB,MAAM,CAACiB,SACP/C,IAAI,CAAC;QACRqC,UAAUW,IAAI,CACZ,GAAGZ,SAAS,8BAA8B,EAAEQ,SAAS,WAAW,+LAA+L,CAAC;IAEpQ;IAEA,IAAI,CAACF,OAAO;QACVC;QACA;IACF;IAEA,MAAMM,MAAM,MAAM3C,sBAChB6B,MACAC,UACAnB,gCACA;IAEF,IAAI,CAACgC,KAAK;QACRN;QACA;IACF;IAEA,MAAMO,MAAMd,SAASe,KAAK,CAAC,KAAKC,KAAK,CAAC,GAAG,CAAC,GAAGpD,IAAI,CAAC;IAClD,MAAMqD,qBAAqBnD,kBACzBgD,KACA,cACA;IAEF,MAAMI,iBAAiBpD,kBACrBgD,KACA,cACA;IAGF,IAAI,CAACf,KAAKG,MAAM,CAACe,qBAAqB;QACpClB,KAAKoB,KAAK,CAACF,oBAAoB;IACjC;IACA,IAAI,CAAClB,KAAKG,MAAM,CAACgB,iBAAiB;QAChCnB,KAAKoB,KAAK,CAACD,gBAAgB7B,2BAA2BwB;IACxD;IAEA,MAAM5C,YAAY8B,MAAMC,UAAUzB,SAASO;IAC3C,MAAMb,YAAY8B,MAAMC,UAAUzB,SAAS8B;IAC3C,MAAMpC,YACJ8B,MACAC,UACAxB,UAAUO,oBAAoBC;IAEhC,2EAA2E;IAC3E,yEAAyE;IACzE,0CAA0C;IAC1C,MAAMhB,4BACJ+B,MACAC,UACA;QAAC;QAAqB;KAAsB,EAC5C;AAEJ;AAEA,eAAe,eAAeoB,UAC5BrB,IAAU;IAEV,MAAME,YAAsB,EAAE;IAE9B,KAAK,MAAMoB,WAAWxD,YAAYkC,MAAMuB,MAAM,GAAI;QAChD,MAAM7B,aAAaD,oBAChB6B,QAAQE,QAAQ,EAA2C9B;QAG9D,KAAK,MAAME,aAAaF,WAAY;YAClC,IAAI,CAACE,UAAU6B,IAAI,EAAE;YAErB,MAAMC,eAAe9B,UAAU6B,IAAI,CAACE,QAAQ,CAAC,eACzC/B,UAAU6B,IAAI,CAACR,KAAK,CAAC,GAAG,CAAC,YAAYW,MAAM,IAC3ChC,UAAU6B,IAAI;YAClB,MAAMxB,WAAWlC,kBAAkBuD,QAAQO,IAAI,EAAEH,cAAc;YAE/D,MAAM3B,YAAYC,MAAMC,UAAUL,WAAWM;QAC/C;IACF;IAEA,MAAM7B,qBAAqB2B;IAE3B,OAAO;QAAEE;IAAU;AACrB"}

package/src/migrations/v1.0.0-rc.75/0001-ts-agent-session-id-middleware-extraction/migration.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../../../../../../../packages/nx-plugin/src/migrations/v1.0.0-rc.75/0001-ts-agent-session-id-middleware-extraction/migration.ts"],"sourcesContent":["/**\n * Copyright Amazon.com, Inc. or its affiliates. All Rights Reserved.\n * SPDX-License-Identifier: Apache-2.0\n */\nimport { readFileSync } from 'node:fs';\nimport { join } from 'node:path';\nimport {\n  getProjects,\n  joinPathFragments,\n  type MigrationReturnObject,\n  type Tree,\n} from '@nx/devkit';\nimport { TS_AGENT_GENERATOR_INFO } from '../../../ts/agent/generator.js';\nimport {\n  addDestructuredImport,\n  applyGritQL,\n  captureGritQLVariable,\n  matchGritQL,\n} from '../../../utils/ast.js';\nimport { formatFilesInSubtree } from '../../../utils/format.js';\nimport type { ComponentMetadata } from '../../../utils/nx.js';\n\n/**\n * Extract the inline session-id Express middleware - previously duplicated\n * verbatim in every ts#agent AG-UI/A2A `index.ts` - into a shared\n * `middleware/session-id-middleware.ts` module sitting beside `index.ts`,\n * mirroring how `agent.ts`/`session.ts` are already shared siblings.\n *\n * HTTP is untouched: its one procedure is a tRPC subscription served over\n * WebSocket, which bypasses Express entirely, so it never had this middleware\n * to begin with (see `enterSessionContext` in its `router.ts` instead).\n *\n * AG-UI and A2A wire the same logic up differently - AG-UI binds it to a\n * named `sessionIdMiddleware` const before use, while A2A inlines it directly\n * at the `app.use` call site - so each gets its own old-shape pattern below,\n * even though both resolve to the same shared middleware content.\n *\n * Guardrails:\n * - Pattern-match before writing: skip files that have diverged from the\n *   generated shape and report them via `nextSteps`, rather than clobbering\n *   the user's changes.\n * - Idempotent: re-running is a no-op once migrated.\n */\n\n// The consuming repo's formatter/linter (e.g. Biome, ESLint import/order) may\n// alphabetize these three named type imports, so match/rewrite any of their\n// orderings rather than only the literal order the generator emits. Fixed-\n// arity destructuring (`[$a, $b, $c]`) pins the specifier count to exactly\n// three - so a 4th merged-in specifier fails to match - while constraining\n// each slot independently makes the check order-independent.\nconst EXPRESS_IMPORT_OLD_WHERE = `{\n  $clause <: import_clause(default=\\`express\\`, name=named_imports(imports=[$a, $b, $c])),\n  $a <: or { \\`type Request\\`, \\`type Response\\`, \\`type NextFunction\\` },\n  $b <: or { \\`type Request\\`, \\`type Response\\`, \\`type NextFunction\\` },\n  $c <: or { \\`type Request\\`, \\`type Response\\`, \\`type NextFunction\\` }\n}`;\nconst EXPRESS_IMPORT_OLD_MATCH = `\\`import $clause from 'express';\\` where ${EXPRESS_IMPORT_OLD_WHERE}`;\nconst EXPRESS_IMPORT_OLD_REWRITE = `\\`import $clause from 'express';\\` => \\`import express from 'express';\\` where ${EXPRESS_IMPORT_OLD_WHERE}`;\n\nconst RANDOM_UUID_IMPORT = \"import { randomUUID } from 'node:crypto';\";\n\nconst SESSION_ID_HEADER_LINE =\n  \"const SESSION_ID_HEADER = 'x-amzn-bedrock-agentcore-runtime-session-id';\";\n\n// The leading comment sits directly above both shapes below. GritQL can only\n// match it as its own comment node - folding it into the same backtick\n// snippet as the statement that follows fails to parse as one construct - so\n// it's matched/deleted as a separate step from the statement/expression.\nconst MIDDLEWARE_LEADING_COMMENT =\n  '// Bind the inbound session (or a fresh UUID) for downstream MCP / A2A calls.';\n\n// AG-UI binds the middleware to a named const, used later via `app.use(sessionIdMiddleware)`.\nconst AGUI_MIDDLEWARE_DEFINITION_OLD = `const sessionIdMiddleware = (req: Request, _res: Response, next: NextFunction) => {\n  const header = req.headers[SESSION_ID_HEADER];\n  const sessionId = (Array.isArray(header) ? header[0] : header) ?? randomUUID();\n  runWithSessionId(sessionId, () => next());\n};`;\n\n// A2A inlines the same logic directly at the `app.use` call site instead.\nconst A2A_MIDDLEWARE_USE_OLD = `app.use((req: Request, _res: Response, next: NextFunction) => {\n    const header = req.headers[SESSION_ID_HEADER];\n    const sessionId = (Array.isArray(header) ? header[0] : header) ?? randomUUID();\n    runWithSessionId(sessionId, () => next());\n  });`;\nconst A2A_MIDDLEWARE_USE_NEW = 'app.use(sessionIdMiddleware);';\n\n// Captures the agent-connection package specifier so the new middleware\n// module targets the same one. Generic over `$names` since a connection\n// generator may have merged its own import into this same statement.\nconst RUNWITHSESSIONID_IMPORT_CAPTURE =\n  \"`import { $names } from '$mod';` where { $names <: contains `runWithSessionId` }\";\n\n// Removes `runWithSessionId` from the named import, preserving any other\n// merged specifiers (or the whole statement if it was the only one).\n// Decomposed via `import_clause(name=named_imports($imports))` since a naive\n// `$rest`-based rewrite silently fails once other specifiers are involved.\nconst REMOVE_RUNWITHSESSIONID_IMPORT_PATTERN = `\\`import $clause from '$mod';\\` as $import where {\n  $clause <: import_clause(name=named_imports($imports)),\n  $imports <: contains \\`runWithSessionId\\`,\n  if ($imports <: [\\`runWithSessionId\\`]) { $import => . } else { $imports <: some import_specifier(name=\\`runWithSessionId\\`) => . }\n}`;\n\n// Both protocols' `common-express/` dir vends byte-identical middleware\n// content; read as the single source of truth rather than hand-duplicating\n// it here.\nconst SESSION_ID_MIDDLEWARE_TEMPLATE = readFileSync(\n  join(\n    import.meta.dirname,\n    '../../../ts/agent/files/common-express/middleware/session-id-middleware.ts.template',\n  ),\n  'utf-8',\n);\n\nconst sessionIdMiddlewareContent = (agentConnectionImport: string): string =>\n  SESSION_ID_MIDDLEWARE_TEMPLATE.replace(\n    '<%- agentConnectionImport %>',\n    agentConnectionImport,\n  );\n\nconst findAgentComponents = (\n  components: ComponentMetadata[] | undefined,\n): ComponentMetadata[] =>\n  (components ?? []).filter(\n    (component) =>\n      component.generator === TS_AGENT_GENERATOR_INFO.id &&\n      (component.protocol === 'ag-ui' || component.protocol === 'a2a'),\n  );\n\nconst migrateIndex = async (\n  tree: Tree,\n  indexPath: string,\n  protocol: 'ag-ui' | 'a2a',\n  nextSteps: string[],\n): Promise<void> => {\n  if (!tree.exists(indexPath)) return;\n\n  const contents = tree.read(indexPath, 'utf-8') ?? '';\n  if (!contents.includes(SESSION_ID_HEADER_LINE)) return;\n\n  const middlewarePattern =\n    protocol === 'ag-ui'\n      ? AGUI_MIDDLEWARE_DEFINITION_OLD\n      : A2A_MIDDLEWARE_USE_OLD;\n\n  const diverged = () => {\n    nextSteps.push(\n      `${indexPath}: diverged from the generated ts#agent ${protocol} shape - left untouched. Manually move the inline session-id middleware into a sibling \\`middleware/session-id-middleware.ts\\` module and import \\`sessionIdMiddleware\\` from there (see the ts#agent generator's template).`,\n    );\n  };\n\n  const ready =\n    (await matchGritQL(tree, indexPath, EXPRESS_IMPORT_OLD_MATCH)) &&\n    (await matchGritQL(tree, indexPath, `\\`${RANDOM_UUID_IMPORT}\\``)) &&\n    (await matchGritQL(tree, indexPath, `\\`${SESSION_ID_HEADER_LINE}\\``)) &&\n    (await matchGritQL(tree, indexPath, `\\`${MIDDLEWARE_LEADING_COMMENT}\\``)) &&\n    (await matchGritQL(tree, indexPath, `\\`${middlewarePattern}\\``)) &&\n    (await matchGritQL(tree, indexPath, RUNWITHSESSIONID_IMPORT_CAPTURE));\n\n  if (!ready) {\n    diverged();\n    return;\n  }\n\n  const mod = await captureGritQLVariable(\n    tree,\n    indexPath,\n    RUNWITHSESSIONID_IMPORT_CAPTURE,\n    'mod',\n  );\n  if (!mod) {\n    diverged();\n    return;\n  }\n\n  const dir = indexPath.split('/').slice(0, -1).join('/');\n  const middlewarePath = joinPathFragments(\n    dir,\n    'middleware',\n    'session-id-middleware.ts',\n  );\n\n  if (!tree.exists(middlewarePath)) {\n    tree.write(middlewarePath, sessionIdMiddlewareContent(mod));\n  }\n\n  await applyGritQL(tree, indexPath, EXPRESS_IMPORT_OLD_REWRITE);\n  await applyGritQL(tree, indexPath, `\\`${RANDOM_UUID_IMPORT}\\` => .`);\n  await applyGritQL(tree, indexPath, `\\`${SESSION_ID_HEADER_LINE}\\` => .`);\n  await applyGritQL(tree, indexPath, REMOVE_RUNWITHSESSIONID_IMPORT_PATTERN);\n  await applyGritQL(tree, indexPath, `\\`${MIDDLEWARE_LEADING_COMMENT}\\` => .`);\n\n  if (protocol === 'ag-ui') {\n    await applyGritQL(\n      tree,\n      indexPath,\n      `\\`${AGUI_MIDDLEWARE_DEFINITION_OLD}\\` => .`,\n    );\n  } else {\n    await applyGritQL(\n      tree,\n      indexPath,\n      `\\`${A2A_MIDDLEWARE_USE_OLD}\\` => \\`${A2A_MIDDLEWARE_USE_NEW}\\``,\n    );\n  }\n\n  await addDestructuredImport(\n    tree,\n    indexPath,\n    ['sessionIdMiddleware'],\n    './middleware/session-id-middleware.js',\n  );\n};\n\nexport default async function migration(\n  tree: Tree,\n): Promise<MigrationReturnObject> {\n  const nextSteps: string[] = [];\n\n  for (const project of getProjects(tree).values()) {\n    const components = findAgentComponents(\n      (project.metadata as { components?: ComponentMetadata[] })?.components,\n    );\n\n    for (const component of components) {\n      if (!component.path) continue;\n\n      const indexPath = joinPathFragments(\n        project.root,\n        component.path,\n        'index.ts',\n      );\n\n      await migrateIndex(\n        tree,\n        indexPath,\n        component.protocol as 'ag-ui' | 'a2a',\n        nextSteps,\n      );\n    }\n  }\n\n  await formatFilesInSubtree(tree);\n\n  return { nextSteps };\n}\n"],"names":["readFileSync","join","getProjects","joinPathFragments","TS_AGENT_GENERATOR_INFO","addDestructuredImport","applyGritQL","captureGritQLVariable","matchGritQL","formatFilesInSubtree","EXPRESS_IMPORT_OLD_WHERE","EXPRESS_IMPORT_OLD_MATCH","EXPRESS_IMPORT_OLD_REWRITE","RANDOM_UUID_IMPORT","SESSION_ID_HEADER_LINE","MIDDLEWARE_LEADING_COMMENT","AGUI_MIDDLEWARE_DEFINITION_OLD","A2A_MIDDLEWARE_USE_OLD","A2A_MIDDLEWARE_USE_NEW","RUNWITHSESSIONID_IMPORT_CAPTURE","REMOVE_RUNWITHSESSIONID_IMPORT_PATTERN","SESSION_ID_MIDDLEWARE_TEMPLATE","dirname","sessionIdMiddlewareContent","agentConnectionImport","replace","findAgentComponents","components","filter","component","generator","id","protocol","migrateIndex","tree","indexPath","nextSteps","exists","contents","read","includes","middlewarePattern","diverged","push","ready","mod","dir","split","slice","middlewarePath","write","migration","project","values","metadata","path","root"],"mappings":"AAAA;;;CAGC,GACD,SAASA,YAAY,QAAQ,UAAU;AACvC,SAASC,IAAI,QAAQ,YAAY;AACjC,SACEC,WAAW,EACXC,iBAAiB,QAGZ,aAAa;AACpB,SAASC,uBAAuB,QAAQ,iCAAiC;AACzE,SACEC,qBAAqB,EACrBC,WAAW,EACXC,qBAAqB,EACrBC,WAAW,QACN,wBAAwB;AAC/B,SAASC,oBAAoB,QAAQ,2BAA2B;AAGhE;;;;;;;;;;;;;;;;;;;;CAoBC,GAED,8EAA8E;AAC9E,4EAA4E;AAC5E,2EAA2E;AAC3E,2EAA2E;AAC3E,2EAA2E;AAC3E,6DAA6D;AAC7D,MAAMC,2BAA2B,CAAC;;;;;CAKjC,CAAC;AACF,MAAMC,2BAA2B,CAAC,yCAAyC,EAAED,0BAA0B;AACvG,MAAME,6BAA6B,CAAC,+EAA+E,EAAEF,0BAA0B;AAE/I,MAAMG,qBAAqB;AAE3B,MAAMC,yBACJ;AAEF,6EAA6E;AAC7E,uEAAuE;AACvE,6EAA6E;AAC7E,yEAAyE;AACzE,MAAMC,6BACJ;AAEF,8FAA8F;AAC9F,MAAMC,iCAAiC,CAAC;;;;EAItC,CAAC;AAEH,0EAA0E;AAC1E,MAAMC,yBAAyB,CAAC;;;;KAI3B,CAAC;AACN,MAAMC,yBAAyB;AAE/B,wEAAwE;AACxE,wEAAwE;AACxE,qEAAqE;AACrE,MAAMC,kCACJ;AAEF,yEAAyE;AACzE,qEAAqE;AACrE,6EAA6E;AAC7E,2EAA2E;AAC3E,MAAMC,yCAAyC,CAAC;;;;CAI/C,CAAC;AAEF,wEAAwE;AACxE,2EAA2E;AAC3E,WAAW;AACX,MAAMC,iCAAiCrB,aACrCC,KACE,YAAYqB,OAAO,EACnB,wFAEF;AAGF,MAAMC,6BAA6B,CAACC,wBAClCH,+BAA+BI,OAAO,CACpC,gCACAD;AAGJ,MAAME,sBAAsB,CAC1BC,aAEA,AAACA,CAAAA,cAAc,EAAE,AAAD,EAAGC,MAAM,CACvB,CAACC,YACCA,UAAUC,SAAS,KAAK1B,wBAAwB2B,EAAE,IACjDF,CAAAA,UAAUG,QAAQ,KAAK,WAAWH,UAAUG,QAAQ,KAAK,KAAI;AAGpE,MAAMC,eAAe,OACnBC,MACAC,WACAH,UACAI;IAEA,IAAI,CAACF,KAAKG,MAAM,CAACF,YAAY;IAE7B,MAAMG,WAAWJ,KAAKK,IAAI,CAACJ,WAAW,YAAY;IAClD,IAAI,CAACG,SAASE,QAAQ,CAAC1B,yBAAyB;IAEhD,MAAM2B,oBACJT,aAAa,UACThB,iCACAC;IAEN,MAAMyB,WAAW;QACfN,UAAUO,IAAI,CACZ,GAAGR,UAAU,uCAAuC,EAAEH,SAAS,4NAA4N,CAAC;IAEhS;IAEA,MAAMY,QACJ,AAAC,MAAMpC,YAAY0B,MAAMC,WAAWxB,6BACnC,MAAMH,YAAY0B,MAAMC,WAAW,CAAC,EAAE,EAAEtB,mBAAmB,EAAE,CAAC,KAC9D,MAAML,YAAY0B,MAAMC,WAAW,CAAC,EAAE,EAAErB,uBAAuB,EAAE,CAAC,KAClE,MAAMN,YAAY0B,MAAMC,WAAW,CAAC,EAAE,EAAEpB,2BAA2B,EAAE,CAAC,KACtE,MAAMP,YAAY0B,MAAMC,WAAW,CAAC,EAAE,EAAEM,kBAAkB,EAAE,CAAC,KAC7D,MAAMjC,YAAY0B,MAAMC,WAAWhB;IAEtC,IAAI,CAACyB,OAAO;QACVF;QACA;IACF;IAEA,MAAMG,MAAM,MAAMtC,sBAChB2B,MACAC,WACAhB,iCACA;IAEF,IAAI,CAAC0B,KAAK;QACRH;QACA;IACF;IAEA,MAAMI,MAAMX,UAAUY,KAAK,CAAC,KAAKC,KAAK,CAAC,GAAG,CAAC,GAAG/C,IAAI,CAAC;IACnD,MAAMgD,iBAAiB9C,kBACrB2C,KACA,cACA;IAGF,IAAI,CAACZ,KAAKG,MAAM,CAACY,iBAAiB;QAChCf,KAAKgB,KAAK,CAACD,gBAAgB1B,2BAA2BsB;IACxD;IAEA,MAAMvC,YAAY4B,MAAMC,WAAWvB;IACnC,MAAMN,YAAY4B,MAAMC,WAAW,CAAC,EAAE,EAAEtB,mBAAmB,OAAO,CAAC;IACnE,MAAMP,YAAY4B,MAAMC,WAAW,CAAC,EAAE,EAAErB,uBAAuB,OAAO,CAAC;IACvE,MAAMR,YAAY4B,MAAMC,WAAWf;IACnC,MAAMd,YAAY4B,MAAMC,WAAW,CAAC,EAAE,EAAEpB,2BAA2B,OAAO,CAAC;IAE3E,IAAIiB,aAAa,SAAS;QACxB,MAAM1B,YACJ4B,MACAC,WACA,CAAC,EAAE,EAAEnB,+BAA+B,OAAO,CAAC;IAEhD,OAAO;QACL,MAAMV,YACJ4B,MACAC,WACA,CAAC,EAAE,EAAElB,uBAAuB,QAAQ,EAAEC,uBAAuB,EAAE,CAAC;IAEpE;IAEA,MAAMb,sBACJ6B,MACAC,WACA;QAAC;KAAsB,EACvB;AAEJ;AAEA,eAAe,eAAegB,UAC5BjB,IAAU;IAEV,MAAME,YAAsB,EAAE;IAE9B,KAAK,MAAMgB,WAAWlD,YAAYgC,MAAMmB,MAAM,GAAI;QAChD,MAAM1B,aAAaD,oBAChB0B,QAAQE,QAAQ,EAA2C3B;QAG9D,KAAK,MAAME,aAAaF,WAAY;YAClC,IAAI,CAACE,UAAU0B,IAAI,EAAE;YAErB,MAAMpB,YAAYhC,kBAChBiD,QAAQI,IAAI,EACZ3B,UAAU0B,IAAI,EACd;YAGF,MAAMtB,aACJC,MACAC,WACAN,UAAUG,QAAQ,EAClBI;QAEJ;IACF;IAEA,MAAM3B,qBAAqByB;IAE3B,OAAO;QAAEE;IAAU;AACrB"}

package/src/preset/__snapshots__/generator.spec.ts.snap

@@ -252,7 +252,7 @@ export default {
 
 exports[`preset generator > should run successfully > biome.json 1`] = `
 "{
-  "$schema": "https://biomejs.dev/schemas/2.5.8/schema.json",
+  "$schema": "https://biomejs.dev/schemas/2.5.10/schema.json",
   "root": true,
   "formatter": {
     "enabled": true,
@@ -418,7 +418,7 @@ catalog:
   '@nx/js': 23.1.1
   '@nx/workspace': 23.1.1
   typescript: ~6.0.3
-  '@biomejs/biome': 2.5.8
+  '@biomejs/biome': 2.5.10
   '@aws/nx-plugin': ^0.0.0
   '@aws/nx-plugin-mcp': ^0.0.0
 "

package/src/py/agent/__snapshots__/generator.constructs.spec.ts.snap

@@ -765,13 +765,13 @@ dependencies = [
   "proj-agent-connection",
   "aws-lambda-powertools==3.34.0",
   "aws-opentelemetry-distro==0.19.0",
-  "bedrock-agentcore==1.21.0",
-  "boto3==1.43.72",
+  "bedrock-agentcore==1.22.0",
+  "boto3==1.43.78",
   "fastapi==0.141.1",
   "mcp==1.28.1",
-  "strands-agents==1.52.0",
+  "strands-agents==1.53.0",
   "strands-agents-tools==0.8.6",
-  "uvicorn==0.52.3"
+  "uvicorn==0.52.4"
 ]
 
 [dependency-groups]

package/src/py/agent/__snapshots__/generator.frameworks.spec.ts.snap

@@ -703,18 +703,18 @@ dependencies = [
   "proj-agent-connection",
   "aws-lambda-powertools==3.34.0",
   "aws-opentelemetry-distro==0.19.0",
-  "bedrock-agentcore==1.21.0",
-  "boto3==1.43.72",
+  "bedrock-agentcore==1.22.0",
+  "boto3==1.43.78",
   "fastapi==0.141.1",
   "mcp==1.28.1",
-  "langchain==1.3.15",
-  "langchain-aws==1.7.1",
+  "langchain==1.3.16",
+  "langchain-aws==1.7.3",
   "langgraph==1.2.11",
   "langgraph-checkpoint-sqlite==3.1.1",
   "aiosqlite==0.22.1",
   "ag-ui-protocol==0.1.20",
   "ag-ui-langgraph==0.0.43",
-  "uvicorn==0.52.3"
+  "uvicorn==0.52.4"
 ]
 
 [dependency-groups]

package/src/py/agent/__snapshots__/generator.protocols.spec.ts.snap

@@ -672,7 +672,7 @@ exports[`py#agent generator > should match snapshot for Terraform generated file
   required_providers {
     aws = {
       source  = "hashicorp/aws"
-      version = "6.60.0"
+      version = "6.61.0"
     }
     null = {
       source  = "hashicorp/null"
@@ -1088,7 +1088,7 @@ resource "null_resource" "runtime_ready" {
 
   provisioner "local-exec" {
     command = <<-EOT
-      uv run --with boto3==1.43.72 python -c "
+      uv run --with boto3==1.43.78 python -c "
 import boto3
 import json
 import os