@aws/nx-plugin 1.0.0-rc.9 → 1.0.0-rc.90

package/src/migrations/v1.0.0-rc.73/0002-apt-security-updates-in-container-images/migration.js

@@ -0,0 +1,90 @@
+/**
+ * Copyright Amazon.com, Inc. or its affiliates. All Rights Reserved.
+ * SPDX-License-Identifier: Apache-2.0
+ */ import { getProjects, joinPathFragments } from "@nx/devkit";
+import { formatFilesInSubtree } from "../../../utils/format.js";
+/**
+ * Apply the distribution's security updates in the vended agent / MCP server
+ * images.
+ *
+ * A base image tag lags behind its distribution's security suite, so the OS
+ * packages it ships carry vulnerabilities that already have a fixed version
+ * published — which the image scan flags as HIGH/CRITICAL. Upgrading them in the
+ * image build clears those findings whenever the scan runs, rather than waiting
+ * for the base image to be rebuilt. New workspaces get this from the generator
+ * templates; this brings existing ones up to date.
+ *
+ * Only the Dockerfiles of the components whose images the generators vend are
+ * touched, located from their project metadata. The Dockerfile is generated
+ * `KeepExisting`, so it is edited in place: the upgrade is inserted right after
+ * the `FROM` line, ahead of every other instruction, so later layers install
+ * against the upgraded packages. One that already runs `apt-get upgrade`, or
+ * which has been re-based onto an image `apt-get` can't upgrade, is left alone.
+ */ /**
+ * The generators whose runtime images the vended Dockerfiles build. Hardcoded
+ * rather than imported from the generators: a migration matches the ids
+ * workspaces recorded at generation time, which must stay fixed even if the
+ * generators' current ids change later.
+ */ const RUNTIME_IMAGE_GENERATOR_IDS = [
+    'py#agent',
+    'py#mcp-server',
+    'ts#agent',
+    'ts#mcp-server'
+];
+const APT_UPGRADE = `# Apply the distribution's security updates: base image tags lag behind the
+# security suite, so its OS packages carry fixed HIGH/CRITICAL vulnerabilities
+# flagged by the image scan.
+RUN apt-get update && \\
+    apt-get upgrade -y --no-install-recommends && \\
+    rm -rf /var/lib/apt/lists/*`;
+/** The apt command this migration adds; used to detect an applied fix. */ const APT_UPGRADE_COMMAND = 'apt-get upgrade';
+/**
+ * The Debian-derived base images the generators vend, whose packages `apt-get`
+ * upgrades. A user who has re-based onto another image (Alpine, distroless,
+ * Amazon Linux) needs a different command, so theirs is left as they wrote it.
+ */ const DEBIAN_BASE_IMAGE = /^FROM\s+\S*(?:node|python):\S*\n/m;
+/**
+ * The Dockerfiles of every runtime image component, located from each project's
+ * recorded component metadata (`path` is the component directory relative to
+ * the project root).
+ */ const runtimeImageDockerfiles = (tree)=>{
+    const paths = [];
+    for (const project of getProjects(tree).values()){
+        const components = project.metadata?.components ?? [];
+        for (const component of components){
+            if (!RUNTIME_IMAGE_GENERATOR_IDS.includes(component.generator) || !component.path) {
+                continue;
+            }
+            const dockerfile = joinPathFragments(projectRoot(project), component.path, 'Dockerfile');
+            if (tree.exists(dockerfile)) {
+                paths.push(dockerfile);
+            }
+        }
+    }
+    return paths;
+};
+/** A project's root, falling back to sourceRoot for the TS-solution layout. */ const projectRoot = (project)=>project.root ?? project.sourceRoot ?? '';
+export default async function migration(tree) {
+    for (const filePath of runtimeImageDockerfiles(tree)){
+        const content = tree.read(filePath, 'utf-8');
+        if (!content) {
+            continue;
+        }
+        if (content.includes(APT_UPGRADE_COMMAND)) {
+            continue; // Already upgrading (migrated or user-added).
+        }
+        const from = content.match(DEBIAN_BASE_IMAGE);
+        if (from?.index === undefined) {
+            continue; // The user has re-based the image; theirs to patch, not ours.
+        }
+        // Insert the upgrade after the FROM line, ahead of every other instruction
+        // so later layers install against the upgraded packages, with the spacing a
+        // freshly generated Dockerfile has.
+        const insertAt = from.index + from[0].length;
+        tree.write(filePath, `${content.slice(0, insertAt)}\n${APT_UPGRADE}\n${content.slice(insertAt)}`);
+    }
+    await formatFilesInSubtree(tree);
+    return {};
+}
+
+//# sourceMappingURL=migration.js.map

package/src/migrations/v1.0.0-rc.73/0002-apt-security-updates-in-container-images/migration.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../../../../../../../packages/nx-plugin/src/migrations/v1.0.0-rc.73/0002-apt-security-updates-in-container-images/migration.ts"],"sourcesContent":["/**\n * Copyright Amazon.com, Inc. or its affiliates. All Rights Reserved.\n * SPDX-License-Identifier: Apache-2.0\n */\nimport {\n  getProjects,\n  joinPathFragments,\n  type MigrationReturnObject,\n  type ProjectConfiguration,\n  type Tree,\n} from '@nx/devkit';\nimport { formatFilesInSubtree } from '../../../utils/format.js';\nimport type { ComponentMetadata } from '../../../utils/nx.js';\n\n/**\n * Apply the distribution's security updates in the vended agent / MCP server\n * images.\n *\n * A base image tag lags behind its distribution's security suite, so the OS\n * packages it ships carry vulnerabilities that already have a fixed version\n * published — which the image scan flags as HIGH/CRITICAL. Upgrading them in the\n * image build clears those findings whenever the scan runs, rather than waiting\n * for the base image to be rebuilt. New workspaces get this from the generator\n * templates; this brings existing ones up to date.\n *\n * Only the Dockerfiles of the components whose images the generators vend are\n * touched, located from their project metadata. The Dockerfile is generated\n * `KeepExisting`, so it is edited in place: the upgrade is inserted right after\n * the `FROM` line, ahead of every other instruction, so later layers install\n * against the upgraded packages. One that already runs `apt-get upgrade`, or\n * which has been re-based onto an image `apt-get` can't upgrade, is left alone.\n */\n\n/**\n * The generators whose runtime images the vended Dockerfiles build. Hardcoded\n * rather than imported from the generators: a migration matches the ids\n * workspaces recorded at generation time, which must stay fixed even if the\n * generators' current ids change later.\n */\nconst RUNTIME_IMAGE_GENERATOR_IDS = [\n  'py#agent',\n  'py#mcp-server',\n  'ts#agent',\n  'ts#mcp-server',\n];\n\nconst APT_UPGRADE = `# Apply the distribution's security updates: base image tags lag behind the\n# security suite, so its OS packages carry fixed HIGH/CRITICAL vulnerabilities\n# flagged by the image scan.\nRUN apt-get update && \\\\\n    apt-get upgrade -y --no-install-recommends && \\\\\n    rm -rf /var/lib/apt/lists/*`;\n\n/** The apt command this migration adds; used to detect an applied fix. */\nconst APT_UPGRADE_COMMAND = 'apt-get upgrade';\n\n/**\n * The Debian-derived base images the generators vend, whose packages `apt-get`\n * upgrades. A user who has re-based onto another image (Alpine, distroless,\n * Amazon Linux) needs a different command, so theirs is left as they wrote it.\n */\nconst DEBIAN_BASE_IMAGE = /^FROM\\s+\\S*(?:node|python):\\S*\\n/m;\n\n/**\n * The Dockerfiles of every runtime image component, located from each project's\n * recorded component metadata (`path` is the component directory relative to\n * the project root).\n */\nconst runtimeImageDockerfiles = (tree: Tree): string[] => {\n  const paths: string[] = [];\n  for (const project of getProjects(tree).values()) {\n    const components = ((\n      project.metadata as { components?: ComponentMetadata[] }\n    )?.components ?? []) as ComponentMetadata[];\n    for (const component of components) {\n      if (\n        !RUNTIME_IMAGE_GENERATOR_IDS.includes(component.generator) ||\n        !component.path\n      ) {\n        continue;\n      }\n      const dockerfile = joinPathFragments(\n        projectRoot(project),\n        component.path,\n        'Dockerfile',\n      );\n      if (tree.exists(dockerfile)) {\n        paths.push(dockerfile);\n      }\n    }\n  }\n  return paths;\n};\n\n/** A project's root, falling back to sourceRoot for the TS-solution layout. */\nconst projectRoot = (project: ProjectConfiguration): string =>\n  project.root ?? project.sourceRoot ?? '';\n\nexport default async function migration(\n  tree: Tree,\n): Promise<MigrationReturnObject> {\n  for (const filePath of runtimeImageDockerfiles(tree)) {\n    const content = tree.read(filePath, 'utf-8');\n    if (!content) {\n      continue;\n    }\n    if (content.includes(APT_UPGRADE_COMMAND)) {\n      continue; // Already upgrading (migrated or user-added).\n    }\n\n    const from = content.match(DEBIAN_BASE_IMAGE);\n    if (from?.index === undefined) {\n      continue; // The user has re-based the image; theirs to patch, not ours.\n    }\n\n    // Insert the upgrade after the FROM line, ahead of every other instruction\n    // so later layers install against the upgraded packages, with the spacing a\n    // freshly generated Dockerfile has.\n    const insertAt = from.index + from[0].length;\n    tree.write(\n      filePath,\n      `${content.slice(0, insertAt)}\\n${APT_UPGRADE}\\n${content.slice(insertAt)}`,\n    );\n  }\n\n  await formatFilesInSubtree(tree);\n\n  return {};\n}\n"],"names":["getProjects","joinPathFragments","formatFilesInSubtree","RUNTIME_IMAGE_GENERATOR_IDS","APT_UPGRADE","APT_UPGRADE_COMMAND","DEBIAN_BASE_IMAGE","runtimeImageDockerfiles","tree","paths","project","values","components","metadata","component","includes","generator","path","dockerfile","projectRoot","exists","push","root","sourceRoot","migration","filePath","content","read","from","match","index","undefined","insertAt","length","write","slice"],"mappings":"AAAA;;;CAGC,GACD,SACEA,WAAW,EACXC,iBAAiB,QAIZ,aAAa;AACpB,SAASC,oBAAoB,QAAQ,2BAA2B;AAGhE;;;;;;;;;;;;;;;;;CAiBC,GAED;;;;;CAKC,GACD,MAAMC,8BAA8B;IAClC;IACA;IACA;IACA;CACD;AAED,MAAMC,cAAc,CAAC;;;;;+BAKU,CAAC;AAEhC,wEAAwE,GACxE,MAAMC,sBAAsB;AAE5B;;;;CAIC,GACD,MAAMC,oBAAoB;AAE1B;;;;CAIC,GACD,MAAMC,0BAA0B,CAACC;IAC/B,MAAMC,QAAkB,EAAE;IAC1B,KAAK,MAAMC,WAAWV,YAAYQ,MAAMG,MAAM,GAAI;QAChD,MAAMC,aAAc,AAClBF,QAAQG,QAAQ,EACfD,cAAc,EAAE;QACnB,KAAK,MAAME,aAAaF,WAAY;YAClC,IACE,CAACT,4BAA4BY,QAAQ,CAACD,UAAUE,SAAS,KACzD,CAACF,UAAUG,IAAI,EACf;gBACA;YACF;YACA,MAAMC,aAAajB,kBACjBkB,YAAYT,UACZI,UAAUG,IAAI,EACd;YAEF,IAAIT,KAAKY,MAAM,CAACF,aAAa;gBAC3BT,MAAMY,IAAI,CAACH;YACb;QACF;IACF;IACA,OAAOT;AACT;AAEA,6EAA6E,GAC7E,MAAMU,cAAc,CAACT,UACnBA,QAAQY,IAAI,IAAIZ,QAAQa,UAAU,IAAI;AAExC,eAAe,eAAeC,UAC5BhB,IAAU;IAEV,KAAK,MAAMiB,YAAYlB,wBAAwBC,MAAO;QACpD,MAAMkB,UAAUlB,KAAKmB,IAAI,CAACF,UAAU;QACpC,IAAI,CAACC,SAAS;YACZ;QACF;QACA,IAAIA,QAAQX,QAAQ,CAACV,sBAAsB;YACzC,UAAU,8CAA8C;QAC1D;QAEA,MAAMuB,OAAOF,QAAQG,KAAK,CAACvB;QAC3B,IAAIsB,MAAME,UAAUC,WAAW;YAC7B,UAAU,8DAA8D;QAC1E;QAEA,2EAA2E;QAC3E,4EAA4E;QAC5E,oCAAoC;QACpC,MAAMC,WAAWJ,KAAKE,KAAK,GAAGF,IAAI,CAAC,EAAE,CAACK,MAAM;QAC5CzB,KAAK0B,KAAK,CACRT,UACA,GAAGC,QAAQS,KAAK,CAAC,GAAGH,UAAU,EAAE,EAAE5B,YAAY,EAAE,EAAEsB,QAAQS,KAAK,CAACH,WAAW;IAE/E;IAEA,MAAM9B,qBAAqBM;IAE3B,OAAO,CAAC;AACV"}

package/src/migrations/v1.0.0-rc.74/0001-py-agent-session-id-middleware-extraction/metadata.json

@@ -0,0 +1,3 @@
+{
+  "description": "Extract the duplicated _SessionIdMiddleware class in py#agent's main.py into a shared middleware/session_id_middleware.py module"
+}

package/src/migrations/v1.0.0-rc.74/0001-py-agent-session-id-middleware-extraction/migration.d.ts

@@ -0,0 +1,2 @@
+import { type MigrationReturnObject, type Tree } from '@nx/devkit';
+export default function migration(tree: Tree): Promise<MigrationReturnObject>;

package/src/migrations/v1.0.0-rc.74/0001-py-agent-session-id-middleware-extraction/migration.js

@@ -0,0 +1,118 @@
+/**
+ * Copyright Amazon.com, Inc. or its affiliates. All Rights Reserved.
+ * SPDX-License-Identifier: Apache-2.0
+ */ import { readFileSync } from "node:fs";
+import { join } from "node:path";
+import { getProjects, joinPathFragments } from "@nx/devkit";
+import { PY_AGENT_GENERATOR_INFO } from "../../../py/agent/generator.js";
+import { addPythonDestructuredImport, applyGritQL, captureGritQLVariable, matchGritQL } from "../../../utils/ast.js";
+import { formatFilesInSubtree } from "../../../utils/format.js";
+/**
+ * Extract the `_SessionIdMiddleware` class - previously duplicated verbatim
+ * in every py#agent `main.py` (one copy per framework/protocol combination) -
+ * into a shared `middleware/session_id_middleware.py` module sitting beside
+ * `main.py`, mirroring the http#/a2a#/ag-ui#'s own `common/agent.py` and
+ * `common/session.py` sharing pattern.
+ *
+ * The transform is protocol/framework-agnostic: every generated `main.py`
+ * duplicated the exact same `dispatch` body (only the docstring differs
+ * between AG-UI and HTTP/A2A), so one rewrite handles all six shapes. Imports
+ * that only existed to support the inlined class (`uuid`, `Request`,
+ * `BaseHTTPMiddleware`, `session_id_context`) are left for the trailing
+ * `formatFilesInSubtree` ruff pass to prune if they've gone unused - AG-UI's
+ * `main.py` still uses several of them directly, so nothing here can safely
+ * assume any one of them is dead.
+ */ const pyMatch = (snippet)=>`language python\n\`${snippet}\``;
+const pyDelete = (snippet)=>`${pyMatch(snippet)} => .`;
+const pyRewrite = (from, to)=>{
+    const replacement = to.includes('\n') ? `raw\`${to}\`` : `\`${to}\``;
+    return `${pyMatch(from)} => ${replacement}`;
+};
+// Both frameworks import `session_id_context` from the shared agent-connection
+// module alongside other names, so this both confirms the old shape is
+// present and recovers the module name to import the new middleware from.
+const SESSION_ID_CONTEXT_MOD_CAPTURE = 'language python\n`from $mod import $names` where { $names <: contains `session_id_context` }';
+const SESSION_ID_HEADER_LINE = 'SESSION_ID_HEADER = "x-amzn-bedrock-agentcore-runtime-session-id"';
+const ADD_MIDDLEWARE_OLD = 'app.add_middleware(_SessionIdMiddleware)';
+const ADD_MIDDLEWARE_NEW = 'app.add_middleware(SessionIdMiddleware)';
+// HTTP and A2A share this docstring verbatim; AG-UI's differs (see below).
+const OLD_CLASS_INBOUND = `class _SessionIdMiddleware(BaseHTTPMiddleware):
+    """Bind the inbound session (or a fresh UUID) to async context."""
+
+    async def dispatch(self, request: Request, call_next):
+        session_id = request.headers.get(SESSION_ID_HEADER) or str(uuid.uuid4())
+        with session_id_context(session_id):
+            return await call_next(request)`;
+const OLD_CLASS_DOWNSTREAM = `class _SessionIdMiddleware(BaseHTTPMiddleware):
+    """Bind the session ID for this request so downstream MCP / A2A clients forward it on outbound calls."""
+
+    async def dispatch(self, request: Request, call_next):
+        session_id = request.headers.get(SESSION_ID_HEADER) or str(uuid.uuid4())
+        with session_id_context(session_id):
+            return await call_next(request)`;
+// Both framework common/ dirs vend byte-identical middleware content (the
+// LangChain copy would work equally well); this one is read as the single
+// source of truth rather than hand-duplicating it here.
+const SESSION_ID_MIDDLEWARE_TEMPLATE = readFileSync(join(import.meta.dirname, '../../../py/agent/files/strands/common/middleware/session_id_middleware.py.template'), 'utf-8');
+const sessionIdMiddlewareContent = (agentConnectionModule)=>SESSION_ID_MIDDLEWARE_TEMPLATE.replace('<%- agentConnectionModuleName %>', agentConnectionModule);
+const findAgentComponents = (components)=>(components ?? []).filter((component)=>component.generator === PY_AGENT_GENERATOR_INFO.id);
+const migrateMain = async (tree, mainPath, component, nextSteps)=>{
+    if (!tree.exists(mainPath)) return;
+    const contents = tree.read(mainPath, 'utf-8') ?? '';
+    if (!contents.includes('class _SessionIdMiddleware(')) return;
+    const oldClass = contents.includes('Bind the session ID for this request so downstream MCP / A2A clients forward it on outbound calls.') ? OLD_CLASS_DOWNSTREAM : OLD_CLASS_INBOUND;
+    const ready = await matchGritQL(tree, mainPath, pyMatch(oldClass)) && await matchGritQL(tree, mainPath, pyMatch(SESSION_ID_HEADER_LINE)) && await matchGritQL(tree, mainPath, pyMatch(ADD_MIDDLEWARE_OLD)) && await matchGritQL(tree, mainPath, SESSION_ID_CONTEXT_MOD_CAPTURE);
+    const diverged = ()=>{
+        const shape = [
+            component.framework,
+            component.protocol
+        ].filter(Boolean).join('/');
+        nextSteps.push(`${mainPath}: diverged from the generated ${shape || 'py#agent'} shape - left untouched. Manually move \`_SessionIdMiddleware\` into a sibling \`middleware/session_id_middleware.py\` module and import it from there (see the py#agent generator's template).`);
+    };
+    if (!ready) {
+        diverged();
+        return;
+    }
+    const mod = await captureGritQLVariable(tree, mainPath, SESSION_ID_CONTEXT_MOD_CAPTURE, 'mod');
+    if (!mod) {
+        diverged();
+        return;
+    }
+    const dir = mainPath.split('/').slice(0, -1).join('/');
+    const middlewareInitPath = joinPathFragments(dir, 'middleware', '__init__.py');
+    const middlewarePath = joinPathFragments(dir, 'middleware', 'session_id_middleware.py');
+    if (!tree.exists(middlewareInitPath)) {
+        tree.write(middlewareInitPath, '');
+    }
+    if (!tree.exists(middlewarePath)) {
+        tree.write(middlewarePath, sessionIdMiddlewareContent(mod));
+    }
+    await applyGritQL(tree, mainPath, pyDelete(SESSION_ID_HEADER_LINE));
+    await applyGritQL(tree, mainPath, pyDelete(oldClass));
+    await applyGritQL(tree, mainPath, pyRewrite(ADD_MIDDLEWARE_OLD, ADD_MIDDLEWARE_NEW));
+    // Imported unconditionally - SESSION_ID_HEADER is only still referenced by
+    // AG-UI's main.py after the class is gone; the ruff pass below prunes it
+    // from HTTP/A2A's now-unused import list.
+    await addPythonDestructuredImport(tree, mainPath, [
+        'SESSION_ID_HEADER',
+        'SessionIdMiddleware'
+    ], '.middleware.session_id_middleware');
+};
+export default async function migration(tree) {
+    const nextSteps = [];
+    for (const project of getProjects(tree).values()){
+        const components = findAgentComponents(project.metadata?.components);
+        for (const component of components){
+            if (!component.path) continue;
+            const componentDir = component.path.endsWith('/agent.py') ? component.path.slice(0, -'/agent.py'.length) : component.path;
+            const mainPath = joinPathFragments(project.root, componentDir, 'main.py');
+            await migrateMain(tree, mainPath, component, nextSteps);
+        }
+    }
+    await formatFilesInSubtree(tree);
+    return {
+        nextSteps
+    };
+}
+
+//# sourceMappingURL=migration.js.map

package/src/migrations/v1.0.0-rc.74/0001-py-agent-session-id-middleware-extraction/migration.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../../../../../../../packages/nx-plugin/src/migrations/v1.0.0-rc.74/0001-py-agent-session-id-middleware-extraction/migration.ts"],"sourcesContent":["/**\n * Copyright Amazon.com, Inc. or its affiliates. All Rights Reserved.\n * SPDX-License-Identifier: Apache-2.0\n */\nimport { readFileSync } from 'node:fs';\nimport { join } from 'node:path';\nimport {\n  getProjects,\n  joinPathFragments,\n  type MigrationReturnObject,\n  type Tree,\n} from '@nx/devkit';\nimport { PY_AGENT_GENERATOR_INFO } from '../../../py/agent/generator.js';\nimport {\n  addPythonDestructuredImport,\n  applyGritQL,\n  captureGritQLVariable,\n  matchGritQL,\n} from '../../../utils/ast.js';\nimport { formatFilesInSubtree } from '../../../utils/format.js';\nimport type { ComponentMetadata } from '../../../utils/nx.js';\n\n/**\n * Extract the `_SessionIdMiddleware` class - previously duplicated verbatim\n * in every py#agent `main.py` (one copy per framework/protocol combination) -\n * into a shared `middleware/session_id_middleware.py` module sitting beside\n * `main.py`, mirroring the http#/a2a#/ag-ui#'s own `common/agent.py` and\n * `common/session.py` sharing pattern.\n *\n * The transform is protocol/framework-agnostic: every generated `main.py`\n * duplicated the exact same `dispatch` body (only the docstring differs\n * between AG-UI and HTTP/A2A), so one rewrite handles all six shapes. Imports\n * that only existed to support the inlined class (`uuid`, `Request`,\n * `BaseHTTPMiddleware`, `session_id_context`) are left for the trailing\n * `formatFilesInSubtree` ruff pass to prune if they've gone unused - AG-UI's\n * `main.py` still uses several of them directly, so nothing here can safely\n * assume any one of them is dead.\n */\nconst pyMatch = (snippet: string) => `language python\\n\\`${snippet}\\``;\n\nconst pyDelete = (snippet: string) => `${pyMatch(snippet)} => .`;\n\nconst pyRewrite = (from: string, to: string): string => {\n  const replacement = to.includes('\\n') ? `raw\\`${to}\\`` : `\\`${to}\\``;\n  return `${pyMatch(from)} => ${replacement}`;\n};\n\n// Both frameworks import `session_id_context` from the shared agent-connection\n// module alongside other names, so this both confirms the old shape is\n// present and recovers the module name to import the new middleware from.\nconst SESSION_ID_CONTEXT_MOD_CAPTURE =\n  'language python\\n`from $mod import $names` where { $names <: contains `session_id_context` }';\n\nconst SESSION_ID_HEADER_LINE =\n  'SESSION_ID_HEADER = \"x-amzn-bedrock-agentcore-runtime-session-id\"';\n\nconst ADD_MIDDLEWARE_OLD = 'app.add_middleware(_SessionIdMiddleware)';\nconst ADD_MIDDLEWARE_NEW = 'app.add_middleware(SessionIdMiddleware)';\n\n// HTTP and A2A share this docstring verbatim; AG-UI's differs (see below).\nconst OLD_CLASS_INBOUND = `class _SessionIdMiddleware(BaseHTTPMiddleware):\n    \"\"\"Bind the inbound session (or a fresh UUID) to async context.\"\"\"\n\n    async def dispatch(self, request: Request, call_next):\n        session_id = request.headers.get(SESSION_ID_HEADER) or str(uuid.uuid4())\n        with session_id_context(session_id):\n            return await call_next(request)`;\n\nconst OLD_CLASS_DOWNSTREAM = `class _SessionIdMiddleware(BaseHTTPMiddleware):\n    \"\"\"Bind the session ID for this request so downstream MCP / A2A clients forward it on outbound calls.\"\"\"\n\n    async def dispatch(self, request: Request, call_next):\n        session_id = request.headers.get(SESSION_ID_HEADER) or str(uuid.uuid4())\n        with session_id_context(session_id):\n            return await call_next(request)`;\n\n// Both framework common/ dirs vend byte-identical middleware content (the\n// LangChain copy would work equally well); this one is read as the single\n// source of truth rather than hand-duplicating it here.\nconst SESSION_ID_MIDDLEWARE_TEMPLATE = readFileSync(\n  join(\n    import.meta.dirname,\n    '../../../py/agent/files/strands/common/middleware/session_id_middleware.py.template',\n  ),\n  'utf-8',\n);\n\nconst sessionIdMiddlewareContent = (agentConnectionModule: string): string =>\n  SESSION_ID_MIDDLEWARE_TEMPLATE.replace(\n    '<%- agentConnectionModuleName %>',\n    agentConnectionModule,\n  );\n\nconst findAgentComponents = (\n  components: ComponentMetadata[] | undefined,\n): ComponentMetadata[] =>\n  (components ?? []).filter(\n    (component) => component.generator === PY_AGENT_GENERATOR_INFO.id,\n  );\n\nconst migrateMain = async (\n  tree: Tree,\n  mainPath: string,\n  component: ComponentMetadata,\n  nextSteps: string[],\n): Promise<void> => {\n  if (!tree.exists(mainPath)) return;\n\n  const contents = tree.read(mainPath, 'utf-8') ?? '';\n  if (!contents.includes('class _SessionIdMiddleware(')) return;\n\n  const oldClass = contents.includes(\n    'Bind the session ID for this request so downstream MCP / A2A clients forward it on outbound calls.',\n  )\n    ? OLD_CLASS_DOWNSTREAM\n    : OLD_CLASS_INBOUND;\n\n  const ready =\n    (await matchGritQL(tree, mainPath, pyMatch(oldClass))) &&\n    (await matchGritQL(tree, mainPath, pyMatch(SESSION_ID_HEADER_LINE))) &&\n    (await matchGritQL(tree, mainPath, pyMatch(ADD_MIDDLEWARE_OLD))) &&\n    (await matchGritQL(tree, mainPath, SESSION_ID_CONTEXT_MOD_CAPTURE));\n\n  const diverged = () => {\n    const shape = [component.framework, component.protocol]\n      .filter(Boolean)\n      .join('/');\n    nextSteps.push(\n      `${mainPath}: diverged from the generated ${shape || 'py#agent'} shape - left untouched. Manually move \\`_SessionIdMiddleware\\` into a sibling \\`middleware/session_id_middleware.py\\` module and import it from there (see the py#agent generator's template).`,\n    );\n  };\n\n  if (!ready) {\n    diverged();\n    return;\n  }\n\n  const mod = await captureGritQLVariable(\n    tree,\n    mainPath,\n    SESSION_ID_CONTEXT_MOD_CAPTURE,\n    'mod',\n  );\n  if (!mod) {\n    diverged();\n    return;\n  }\n\n  const dir = mainPath.split('/').slice(0, -1).join('/');\n  const middlewareInitPath = joinPathFragments(\n    dir,\n    'middleware',\n    '__init__.py',\n  );\n  const middlewarePath = joinPathFragments(\n    dir,\n    'middleware',\n    'session_id_middleware.py',\n  );\n\n  if (!tree.exists(middlewareInitPath)) {\n    tree.write(middlewareInitPath, '');\n  }\n  if (!tree.exists(middlewarePath)) {\n    tree.write(middlewarePath, sessionIdMiddlewareContent(mod));\n  }\n\n  await applyGritQL(tree, mainPath, pyDelete(SESSION_ID_HEADER_LINE));\n  await applyGritQL(tree, mainPath, pyDelete(oldClass));\n  await applyGritQL(\n    tree,\n    mainPath,\n    pyRewrite(ADD_MIDDLEWARE_OLD, ADD_MIDDLEWARE_NEW),\n  );\n  // Imported unconditionally - SESSION_ID_HEADER is only still referenced by\n  // AG-UI's main.py after the class is gone; the ruff pass below prunes it\n  // from HTTP/A2A's now-unused import list.\n  await addPythonDestructuredImport(\n    tree,\n    mainPath,\n    ['SESSION_ID_HEADER', 'SessionIdMiddleware'],\n    '.middleware.session_id_middleware',\n  );\n};\n\nexport default async function migration(\n  tree: Tree,\n): Promise<MigrationReturnObject> {\n  const nextSteps: string[] = [];\n\n  for (const project of getProjects(tree).values()) {\n    const components = findAgentComponents(\n      (project.metadata as { components?: ComponentMetadata[] })?.components,\n    );\n\n    for (const component of components) {\n      if (!component.path) continue;\n\n      const componentDir = component.path.endsWith('/agent.py')\n        ? component.path.slice(0, -'/agent.py'.length)\n        : component.path;\n      const mainPath = joinPathFragments(project.root, componentDir, 'main.py');\n\n      await migrateMain(tree, mainPath, component, nextSteps);\n    }\n  }\n\n  await formatFilesInSubtree(tree);\n\n  return { nextSteps };\n}\n"],"names":["readFileSync","join","getProjects","joinPathFragments","PY_AGENT_GENERATOR_INFO","addPythonDestructuredImport","applyGritQL","captureGritQLVariable","matchGritQL","formatFilesInSubtree","pyMatch","snippet","pyDelete","pyRewrite","from","to","replacement","includes","SESSION_ID_CONTEXT_MOD_CAPTURE","SESSION_ID_HEADER_LINE","ADD_MIDDLEWARE_OLD","ADD_MIDDLEWARE_NEW","OLD_CLASS_INBOUND","OLD_CLASS_DOWNSTREAM","SESSION_ID_MIDDLEWARE_TEMPLATE","dirname","sessionIdMiddlewareContent","agentConnectionModule","replace","findAgentComponents","components","filter","component","generator","id","migrateMain","tree","mainPath","nextSteps","exists","contents","read","oldClass","ready","diverged","shape","framework","protocol","Boolean","push","mod","dir","split","slice","middlewareInitPath","middlewarePath","write","migration","project","values","metadata","path","componentDir","endsWith","length","root"],"mappings":"AAAA;;;CAGC,GACD,SAASA,YAAY,QAAQ,UAAU;AACvC,SAASC,IAAI,QAAQ,YAAY;AACjC,SACEC,WAAW,EACXC,iBAAiB,QAGZ,aAAa;AACpB,SAASC,uBAAuB,QAAQ,iCAAiC;AACzE,SACEC,2BAA2B,EAC3BC,WAAW,EACXC,qBAAqB,EACrBC,WAAW,QACN,wBAAwB;AAC/B,SAASC,oBAAoB,QAAQ,2BAA2B;AAGhE;;;;;;;;;;;;;;;CAeC,GACD,MAAMC,UAAU,CAACC,UAAoB,CAAC,mBAAmB,EAAEA,QAAQ,EAAE,CAAC;AAEtE,MAAMC,WAAW,CAACD,UAAoB,GAAGD,QAAQC,SAAS,KAAK,CAAC;AAEhE,MAAME,YAAY,CAACC,MAAcC;IAC/B,MAAMC,cAAcD,GAAGE,QAAQ,CAAC,QAAQ,CAAC,KAAK,EAAEF,GAAG,EAAE,CAAC,GAAG,CAAC,EAAE,EAAEA,GAAG,EAAE,CAAC;IACpE,OAAO,GAAGL,QAAQI,MAAM,IAAI,EAAEE,aAAa;AAC7C;AAEA,+EAA+E;AAC/E,uEAAuE;AACvE,0EAA0E;AAC1E,MAAME,iCACJ;AAEF,MAAMC,yBACJ;AAEF,MAAMC,qBAAqB;AAC3B,MAAMC,qBAAqB;AAE3B,2EAA2E;AAC3E,MAAMC,oBAAoB,CAAC;;;;;;2CAMgB,CAAC;AAE5C,MAAMC,uBAAuB,CAAC;;;;;;2CAMa,CAAC;AAE5C,0EAA0E;AAC1E,0EAA0E;AAC1E,wDAAwD;AACxD,MAAMC,iCAAiCxB,aACrCC,KACE,YAAYwB,OAAO,EACnB,wFAEF;AAGF,MAAMC,6BAA6B,CAACC,wBAClCH,+BAA+BI,OAAO,CACpC,oCACAD;AAGJ,MAAME,sBAAsB,CAC1BC,aAEA,AAACA,CAAAA,cAAc,EAAE,AAAD,EAAGC,MAAM,CACvB,CAACC,YAAcA,UAAUC,SAAS,KAAK7B,wBAAwB8B,EAAE;AAGrE,MAAMC,cAAc,OAClBC,MACAC,UACAL,WACAM;IAEA,IAAI,CAACF,KAAKG,MAAM,CAACF,WAAW;IAE5B,MAAMG,WAAWJ,KAAKK,IAAI,CAACJ,UAAU,YAAY;IACjD,IAAI,CAACG,SAASvB,QAAQ,CAAC,gCAAgC;IAEvD,MAAMyB,WAAWF,SAASvB,QAAQ,CAChC,wGAEEM,uBACAD;IAEJ,MAAMqB,QACJ,AAAC,MAAMnC,YAAY4B,MAAMC,UAAU3B,QAAQgC,cAC1C,MAAMlC,YAAY4B,MAAMC,UAAU3B,QAAQS,4BAC1C,MAAMX,YAAY4B,MAAMC,UAAU3B,QAAQU,wBAC1C,MAAMZ,YAAY4B,MAAMC,UAAUnB;IAErC,MAAM0B,WAAW;QACf,MAAMC,QAAQ;YAACb,UAAUc,SAAS;YAAEd,UAAUe,QAAQ;SAAC,CACpDhB,MAAM,CAACiB,SACP/C,IAAI,CAAC;QACRqC,UAAUW,IAAI,CACZ,GAAGZ,SAAS,8BAA8B,EAAEQ,SAAS,WAAW,+LAA+L,CAAC;IAEpQ;IAEA,IAAI,CAACF,OAAO;QACVC;QACA;IACF;IAEA,MAAMM,MAAM,MAAM3C,sBAChB6B,MACAC,UACAnB,gCACA;IAEF,IAAI,CAACgC,KAAK;QACRN;QACA;IACF;IAEA,MAAMO,MAAMd,SAASe,KAAK,CAAC,KAAKC,KAAK,CAAC,GAAG,CAAC,GAAGpD,IAAI,CAAC;IAClD,MAAMqD,qBAAqBnD,kBACzBgD,KACA,cACA;IAEF,MAAMI,iBAAiBpD,kBACrBgD,KACA,cACA;IAGF,IAAI,CAACf,KAAKG,MAAM,CAACe,qBAAqB;QACpClB,KAAKoB,KAAK,CAACF,oBAAoB;IACjC;IACA,IAAI,CAAClB,KAAKG,MAAM,CAACgB,iBAAiB;QAChCnB,KAAKoB,KAAK,CAACD,gBAAgB7B,2BAA2BwB;IACxD;IAEA,MAAM5C,YAAY8B,MAAMC,UAAUzB,SAASO;IAC3C,MAAMb,YAAY8B,MAAMC,UAAUzB,SAAS8B;IAC3C,MAAMpC,YACJ8B,MACAC,UACAxB,UAAUO,oBAAoBC;IAEhC,2EAA2E;IAC3E,yEAAyE;IACzE,0CAA0C;IAC1C,MAAMhB,4BACJ+B,MACAC,UACA;QAAC;QAAqB;KAAsB,EAC5C;AAEJ;AAEA,eAAe,eAAeoB,UAC5BrB,IAAU;IAEV,MAAME,YAAsB,EAAE;IAE9B,KAAK,MAAMoB,WAAWxD,YAAYkC,MAAMuB,MAAM,GAAI;QAChD,MAAM7B,aAAaD,oBAChB6B,QAAQE,QAAQ,EAA2C9B;QAG9D,KAAK,MAAME,aAAaF,WAAY;YAClC,IAAI,CAACE,UAAU6B,IAAI,EAAE;YAErB,MAAMC,eAAe9B,UAAU6B,IAAI,CAACE,QAAQ,CAAC,eACzC/B,UAAU6B,IAAI,CAACR,KAAK,CAAC,GAAG,CAAC,YAAYW,MAAM,IAC3ChC,UAAU6B,IAAI;YAClB,MAAMxB,WAAWlC,kBAAkBuD,QAAQO,IAAI,EAAEH,cAAc;YAE/D,MAAM3B,YAAYC,MAAMC,UAAUL,WAAWM;QAC/C;IACF;IAEA,MAAM7B,qBAAqB2B;IAE3B,OAAO;QAAEE;IAAU;AACrB"}

package/src/migrations/v1.0.0-rc.75/0001-ts-agent-session-id-middleware-extraction/metadata.json

@@ -0,0 +1,3 @@
+{
+  "description": "Extract the duplicated session-id Express middleware in ts#agent's ag-ui/a2a index.ts into a shared middleware/session-id-middleware.ts module"
+}

package/src/migrations/v1.0.0-rc.75/0001-ts-agent-session-id-middleware-extraction/migration.d.ts

@@ -0,0 +1,2 @@
+import { type MigrationReturnObject, type Tree } from '@nx/devkit';
+export default function migration(tree: Tree): Promise<MigrationReturnObject>;

package/src/migrations/v1.0.0-rc.75/0001-ts-agent-session-id-middleware-extraction/migration.js

@@ -0,0 +1,136 @@
+/**
+ * Copyright Amazon.com, Inc. or its affiliates. All Rights Reserved.
+ * SPDX-License-Identifier: Apache-2.0
+ */ import { readFileSync } from "node:fs";
+import { join } from "node:path";
+import { getProjects, joinPathFragments } from "@nx/devkit";
+import { TS_AGENT_GENERATOR_INFO } from "../../../ts/agent/generator.js";
+import { addDestructuredImport, applyGritQL, captureGritQLVariable, matchGritQL } from "../../../utils/ast.js";
+import { formatFilesInSubtree } from "../../../utils/format.js";
+/**
+ * Extract the inline session-id Express middleware - previously duplicated
+ * verbatim in every ts#agent AG-UI/A2A `index.ts` - into a shared
+ * `middleware/session-id-middleware.ts` module sitting beside `index.ts`,
+ * mirroring how `agent.ts`/`session.ts` are already shared siblings.
+ *
+ * HTTP is untouched: its one procedure is a tRPC subscription served over
+ * WebSocket, which bypasses Express entirely, so it never had this middleware
+ * to begin with (see `enterSessionContext` in its `router.ts` instead).
+ *
+ * AG-UI and A2A wire the same logic up differently - AG-UI binds it to a
+ * named `sessionIdMiddleware` const before use, while A2A inlines it directly
+ * at the `app.use` call site - so each gets its own old-shape pattern below,
+ * even though both resolve to the same shared middleware content.
+ *
+ * Guardrails:
+ * - Pattern-match before writing: skip files that have diverged from the
+ *   generated shape and report them via `nextSteps`, rather than clobbering
+ *   the user's changes.
+ * - Idempotent: re-running is a no-op once migrated.
+ */ // The consuming repo's formatter/linter (e.g. Biome, ESLint import/order) may
+// alphabetize these three named type imports, so match/rewrite any of their
+// orderings rather than only the literal order the generator emits. Fixed-
+// arity destructuring (`[$a, $b, $c]`) pins the specifier count to exactly
+// three - so a 4th merged-in specifier fails to match - while constraining
+// each slot independently makes the check order-independent.
+const EXPRESS_IMPORT_OLD_WHERE = `{
+  $clause <: import_clause(default=\`express\`, name=named_imports(imports=[$a, $b, $c])),
+  $a <: or { \`type Request\`, \`type Response\`, \`type NextFunction\` },
+  $b <: or { \`type Request\`, \`type Response\`, \`type NextFunction\` },
+  $c <: or { \`type Request\`, \`type Response\`, \`type NextFunction\` }
+}`;
+const EXPRESS_IMPORT_OLD_MATCH = `\`import $clause from 'express';\` where ${EXPRESS_IMPORT_OLD_WHERE}`;
+const EXPRESS_IMPORT_OLD_REWRITE = `\`import $clause from 'express';\` => \`import express from 'express';\` where ${EXPRESS_IMPORT_OLD_WHERE}`;
+const RANDOM_UUID_IMPORT = "import { randomUUID } from 'node:crypto';";
+const SESSION_ID_HEADER_LINE = "const SESSION_ID_HEADER = 'x-amzn-bedrock-agentcore-runtime-session-id';";
+// The leading comment sits directly above both shapes below. GritQL can only
+// match it as its own comment node - folding it into the same backtick
+// snippet as the statement that follows fails to parse as one construct - so
+// it's matched/deleted as a separate step from the statement/expression.
+const MIDDLEWARE_LEADING_COMMENT = '// Bind the inbound session (or a fresh UUID) for downstream MCP / A2A calls.';
+// AG-UI binds the middleware to a named const, used later via `app.use(sessionIdMiddleware)`.
+const AGUI_MIDDLEWARE_DEFINITION_OLD = `const sessionIdMiddleware = (req: Request, _res: Response, next: NextFunction) => {
+  const header = req.headers[SESSION_ID_HEADER];
+  const sessionId = (Array.isArray(header) ? header[0] : header) ?? randomUUID();
+  runWithSessionId(sessionId, () => next());
+};`;
+// A2A inlines the same logic directly at the `app.use` call site instead.
+const A2A_MIDDLEWARE_USE_OLD = `app.use((req: Request, _res: Response, next: NextFunction) => {
+    const header = req.headers[SESSION_ID_HEADER];
+    const sessionId = (Array.isArray(header) ? header[0] : header) ?? randomUUID();
+    runWithSessionId(sessionId, () => next());
+  });`;
+const A2A_MIDDLEWARE_USE_NEW = 'app.use(sessionIdMiddleware);';
+// Captures the agent-connection package specifier so the new middleware
+// module targets the same one. Generic over `$names` since a connection
+// generator may have merged its own import into this same statement.
+const RUNWITHSESSIONID_IMPORT_CAPTURE = "`import { $names } from '$mod';` where { $names <: contains `runWithSessionId` }";
+// Removes `runWithSessionId` from the named import, preserving any other
+// merged specifiers (or the whole statement if it was the only one).
+// Decomposed via `import_clause(name=named_imports($imports))` since a naive
+// `$rest`-based rewrite silently fails once other specifiers are involved.
+const REMOVE_RUNWITHSESSIONID_IMPORT_PATTERN = `\`import $clause from '$mod';\` as $import where {
+  $clause <: import_clause(name=named_imports($imports)),
+  $imports <: contains \`runWithSessionId\`,
+  if ($imports <: [\`runWithSessionId\`]) { $import => . } else { $imports <: some import_specifier(name=\`runWithSessionId\`) => . }
+}`;
+// Both protocols' `common-express/` dir vends byte-identical middleware
+// content; read as the single source of truth rather than hand-duplicating
+// it here.
+const SESSION_ID_MIDDLEWARE_TEMPLATE = readFileSync(join(import.meta.dirname, '../../../ts/agent/files/common-express/middleware/session-id-middleware.ts.template'), 'utf-8');
+const sessionIdMiddlewareContent = (agentConnectionImport)=>SESSION_ID_MIDDLEWARE_TEMPLATE.replace('<%- agentConnectionImport %>', agentConnectionImport);
+const findAgentComponents = (components)=>(components ?? []).filter((component)=>component.generator === TS_AGENT_GENERATOR_INFO.id && (component.protocol === 'ag-ui' || component.protocol === 'a2a'));
+const migrateIndex = async (tree, indexPath, protocol, nextSteps)=>{
+    if (!tree.exists(indexPath)) return;
+    const contents = tree.read(indexPath, 'utf-8') ?? '';
+    if (!contents.includes(SESSION_ID_HEADER_LINE)) return;
+    const middlewarePattern = protocol === 'ag-ui' ? AGUI_MIDDLEWARE_DEFINITION_OLD : A2A_MIDDLEWARE_USE_OLD;
+    const diverged = ()=>{
+        nextSteps.push(`${indexPath}: diverged from the generated ts#agent ${protocol} shape - left untouched. Manually move the inline session-id middleware into a sibling \`middleware/session-id-middleware.ts\` module and import \`sessionIdMiddleware\` from there (see the ts#agent generator's template).`);
+    };
+    const ready = await matchGritQL(tree, indexPath, EXPRESS_IMPORT_OLD_MATCH) && await matchGritQL(tree, indexPath, `\`${RANDOM_UUID_IMPORT}\``) && await matchGritQL(tree, indexPath, `\`${SESSION_ID_HEADER_LINE}\``) && await matchGritQL(tree, indexPath, `\`${MIDDLEWARE_LEADING_COMMENT}\``) && await matchGritQL(tree, indexPath, `\`${middlewarePattern}\``) && await matchGritQL(tree, indexPath, RUNWITHSESSIONID_IMPORT_CAPTURE);
+    if (!ready) {
+        diverged();
+        return;
+    }
+    const mod = await captureGritQLVariable(tree, indexPath, RUNWITHSESSIONID_IMPORT_CAPTURE, 'mod');
+    if (!mod) {
+        diverged();
+        return;
+    }
+    const dir = indexPath.split('/').slice(0, -1).join('/');
+    const middlewarePath = joinPathFragments(dir, 'middleware', 'session-id-middleware.ts');
+    if (!tree.exists(middlewarePath)) {
+        tree.write(middlewarePath, sessionIdMiddlewareContent(mod));
+    }
+    await applyGritQL(tree, indexPath, EXPRESS_IMPORT_OLD_REWRITE);
+    await applyGritQL(tree, indexPath, `\`${RANDOM_UUID_IMPORT}\` => .`);
+    await applyGritQL(tree, indexPath, `\`${SESSION_ID_HEADER_LINE}\` => .`);
+    await applyGritQL(tree, indexPath, REMOVE_RUNWITHSESSIONID_IMPORT_PATTERN);
+    await applyGritQL(tree, indexPath, `\`${MIDDLEWARE_LEADING_COMMENT}\` => .`);
+    if (protocol === 'ag-ui') {
+        await applyGritQL(tree, indexPath, `\`${AGUI_MIDDLEWARE_DEFINITION_OLD}\` => .`);
+    } else {
+        await applyGritQL(tree, indexPath, `\`${A2A_MIDDLEWARE_USE_OLD}\` => \`${A2A_MIDDLEWARE_USE_NEW}\``);
+    }
+    await addDestructuredImport(tree, indexPath, [
+        'sessionIdMiddleware'
+    ], './middleware/session-id-middleware.js');
+};
+export default async function migration(tree) {
+    const nextSteps = [];
+    for (const project of getProjects(tree).values()){
+        const components = findAgentComponents(project.metadata?.components);
+        for (const component of components){
+            if (!component.path) continue;
+            const indexPath = joinPathFragments(project.root, component.path, 'index.ts');
+            await migrateIndex(tree, indexPath, component.protocol, nextSteps);
+        }
+    }
+    await formatFilesInSubtree(tree);
+    return {
+        nextSteps
+    };
+}
+
+//# sourceMappingURL=migration.js.map

package/src/migrations/v1.0.0-rc.75/0001-ts-agent-session-id-middleware-extraction/migration.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../../../../../../../packages/nx-plugin/src/migrations/v1.0.0-rc.75/0001-ts-agent-session-id-middleware-extraction/migration.ts"],"sourcesContent":["/**\n * Copyright Amazon.com, Inc. or its affiliates. All Rights Reserved.\n * SPDX-License-Identifier: Apache-2.0\n */\nimport { readFileSync } from 'node:fs';\nimport { join } from 'node:path';\nimport {\n  getProjects,\n  joinPathFragments,\n  type MigrationReturnObject,\n  type Tree,\n} from '@nx/devkit';\nimport { TS_AGENT_GENERATOR_INFO } from '../../../ts/agent/generator.js';\nimport {\n  addDestructuredImport,\n  applyGritQL,\n  captureGritQLVariable,\n  matchGritQL,\n} from '../../../utils/ast.js';\nimport { formatFilesInSubtree } from '../../../utils/format.js';\nimport type { ComponentMetadata } from '../../../utils/nx.js';\n\n/**\n * Extract the inline session-id Express middleware - previously duplicated\n * verbatim in every ts#agent AG-UI/A2A `index.ts` - into a shared\n * `middleware/session-id-middleware.ts` module sitting beside `index.ts`,\n * mirroring how `agent.ts`/`session.ts` are already shared siblings.\n *\n * HTTP is untouched: its one procedure is a tRPC subscription served over\n * WebSocket, which bypasses Express entirely, so it never had this middleware\n * to begin with (see `enterSessionContext` in its `router.ts` instead).\n *\n * AG-UI and A2A wire the same logic up differently - AG-UI binds it to a\n * named `sessionIdMiddleware` const before use, while A2A inlines it directly\n * at the `app.use` call site - so each gets its own old-shape pattern below,\n * even though both resolve to the same shared middleware content.\n *\n * Guardrails:\n * - Pattern-match before writing: skip files that have diverged from the\n *   generated shape and report them via `nextSteps`, rather than clobbering\n *   the user's changes.\n * - Idempotent: re-running is a no-op once migrated.\n */\n\n// The consuming repo's formatter/linter (e.g. Biome, ESLint import/order) may\n// alphabetize these three named type imports, so match/rewrite any of their\n// orderings rather than only the literal order the generator emits. Fixed-\n// arity destructuring (`[$a, $b, $c]`) pins the specifier count to exactly\n// three - so a 4th merged-in specifier fails to match - while constraining\n// each slot independently makes the check order-independent.\nconst EXPRESS_IMPORT_OLD_WHERE = `{\n  $clause <: import_clause(default=\\`express\\`, name=named_imports(imports=[$a, $b, $c])),\n  $a <: or { \\`type Request\\`, \\`type Response\\`, \\`type NextFunction\\` },\n  $b <: or { \\`type Request\\`, \\`type Response\\`, \\`type NextFunction\\` },\n  $c <: or { \\`type Request\\`, \\`type Response\\`, \\`type NextFunction\\` }\n}`;\nconst EXPRESS_IMPORT_OLD_MATCH = `\\`import $clause from 'express';\\` where ${EXPRESS_IMPORT_OLD_WHERE}`;\nconst EXPRESS_IMPORT_OLD_REWRITE = `\\`import $clause from 'express';\\` => \\`import express from 'express';\\` where ${EXPRESS_IMPORT_OLD_WHERE}`;\n\nconst RANDOM_UUID_IMPORT = \"import { randomUUID } from 'node:crypto';\";\n\nconst SESSION_ID_HEADER_LINE =\n  \"const SESSION_ID_HEADER = 'x-amzn-bedrock-agentcore-runtime-session-id';\";\n\n// The leading comment sits directly above both shapes below. GritQL can only\n// match it as its own comment node - folding it into the same backtick\n// snippet as the statement that follows fails to parse as one construct - so\n// it's matched/deleted as a separate step from the statement/expression.\nconst MIDDLEWARE_LEADING_COMMENT =\n  '// Bind the inbound session (or a fresh UUID) for downstream MCP / A2A calls.';\n\n// AG-UI binds the middleware to a named const, used later via `app.use(sessionIdMiddleware)`.\nconst AGUI_MIDDLEWARE_DEFINITION_OLD = `const sessionIdMiddleware = (req: Request, _res: Response, next: NextFunction) => {\n  const header = req.headers[SESSION_ID_HEADER];\n  const sessionId = (Array.isArray(header) ? header[0] : header) ?? randomUUID();\n  runWithSessionId(sessionId, () => next());\n};`;\n\n// A2A inlines the same logic directly at the `app.use` call site instead.\nconst A2A_MIDDLEWARE_USE_OLD = `app.use((req: Request, _res: Response, next: NextFunction) => {\n    const header = req.headers[SESSION_ID_HEADER];\n    const sessionId = (Array.isArray(header) ? header[0] : header) ?? randomUUID();\n    runWithSessionId(sessionId, () => next());\n  });`;\nconst A2A_MIDDLEWARE_USE_NEW = 'app.use(sessionIdMiddleware);';\n\n// Captures the agent-connection package specifier so the new middleware\n// module targets the same one. Generic over `$names` since a connection\n// generator may have merged its own import into this same statement.\nconst RUNWITHSESSIONID_IMPORT_CAPTURE =\n  \"`import { $names } from '$mod';` where { $names <: contains `runWithSessionId` }\";\n\n// Removes `runWithSessionId` from the named import, preserving any other\n// merged specifiers (or the whole statement if it was the only one).\n// Decomposed via `import_clause(name=named_imports($imports))` since a naive\n// `$rest`-based rewrite silently fails once other specifiers are involved.\nconst REMOVE_RUNWITHSESSIONID_IMPORT_PATTERN = `\\`import $clause from '$mod';\\` as $import where {\n  $clause <: import_clause(name=named_imports($imports)),\n  $imports <: contains \\`runWithSessionId\\`,\n  if ($imports <: [\\`runWithSessionId\\`]) { $import => . } else { $imports <: some import_specifier(name=\\`runWithSessionId\\`) => . }\n}`;\n\n// Both protocols' `common-express/` dir vends byte-identical middleware\n// content; read as the single source of truth rather than hand-duplicating\n// it here.\nconst SESSION_ID_MIDDLEWARE_TEMPLATE = readFileSync(\n  join(\n    import.meta.dirname,\n    '../../../ts/agent/files/common-express/middleware/session-id-middleware.ts.template',\n  ),\n  'utf-8',\n);\n\nconst sessionIdMiddlewareContent = (agentConnectionImport: string): string =>\n  SESSION_ID_MIDDLEWARE_TEMPLATE.replace(\n    '<%- agentConnectionImport %>',\n    agentConnectionImport,\n  );\n\nconst findAgentComponents = (\n  components: ComponentMetadata[] | undefined,\n): ComponentMetadata[] =>\n  (components ?? []).filter(\n    (component) =>\n      component.generator === TS_AGENT_GENERATOR_INFO.id &&\n      (component.protocol === 'ag-ui' || component.protocol === 'a2a'),\n  );\n\nconst migrateIndex = async (\n  tree: Tree,\n  indexPath: string,\n  protocol: 'ag-ui' | 'a2a',\n  nextSteps: string[],\n): Promise<void> => {\n  if (!tree.exists(indexPath)) return;\n\n  const contents = tree.read(indexPath, 'utf-8') ?? '';\n  if (!contents.includes(SESSION_ID_HEADER_LINE)) return;\n\n  const middlewarePattern =\n    protocol === 'ag-ui'\n      ? AGUI_MIDDLEWARE_DEFINITION_OLD\n      : A2A_MIDDLEWARE_USE_OLD;\n\n  const diverged = () => {\n    nextSteps.push(\n      `${indexPath}: diverged from the generated ts#agent ${protocol} shape - left untouched. Manually move the inline session-id middleware into a sibling \\`middleware/session-id-middleware.ts\\` module and import \\`sessionIdMiddleware\\` from there (see the ts#agent generator's template).`,\n    );\n  };\n\n  const ready =\n    (await matchGritQL(tree, indexPath, EXPRESS_IMPORT_OLD_MATCH)) &&\n    (await matchGritQL(tree, indexPath, `\\`${RANDOM_UUID_IMPORT}\\``)) &&\n    (await matchGritQL(tree, indexPath, `\\`${SESSION_ID_HEADER_LINE}\\``)) &&\n    (await matchGritQL(tree, indexPath, `\\`${MIDDLEWARE_LEADING_COMMENT}\\``)) &&\n    (await matchGritQL(tree, indexPath, `\\`${middlewarePattern}\\``)) &&\n    (await matchGritQL(tree, indexPath, RUNWITHSESSIONID_IMPORT_CAPTURE));\n\n  if (!ready) {\n    diverged();\n    return;\n  }\n\n  const mod = await captureGritQLVariable(\n    tree,\n    indexPath,\n    RUNWITHSESSIONID_IMPORT_CAPTURE,\n    'mod',\n  );\n  if (!mod) {\n    diverged();\n    return;\n  }\n\n  const dir = indexPath.split('/').slice(0, -1).join('/');\n  const middlewarePath = joinPathFragments(\n    dir,\n    'middleware',\n    'session-id-middleware.ts',\n  );\n\n  if (!tree.exists(middlewarePath)) {\n    tree.write(middlewarePath, sessionIdMiddlewareContent(mod));\n  }\n\n  await applyGritQL(tree, indexPath, EXPRESS_IMPORT_OLD_REWRITE);\n  await applyGritQL(tree, indexPath, `\\`${RANDOM_UUID_IMPORT}\\` => .`);\n  await applyGritQL(tree, indexPath, `\\`${SESSION_ID_HEADER_LINE}\\` => .`);\n  await applyGritQL(tree, indexPath, REMOVE_RUNWITHSESSIONID_IMPORT_PATTERN);\n  await applyGritQL(tree, indexPath, `\\`${MIDDLEWARE_LEADING_COMMENT}\\` => .`);\n\n  if (protocol === 'ag-ui') {\n    await applyGritQL(\n      tree,\n      indexPath,\n      `\\`${AGUI_MIDDLEWARE_DEFINITION_OLD}\\` => .`,\n    );\n  } else {\n    await applyGritQL(\n      tree,\n      indexPath,\n      `\\`${A2A_MIDDLEWARE_USE_OLD}\\` => \\`${A2A_MIDDLEWARE_USE_NEW}\\``,\n    );\n  }\n\n  await addDestructuredImport(\n    tree,\n    indexPath,\n    ['sessionIdMiddleware'],\n    './middleware/session-id-middleware.js',\n  );\n};\n\nexport default async function migration(\n  tree: Tree,\n): Promise<MigrationReturnObject> {\n  const nextSteps: string[] = [];\n\n  for (const project of getProjects(tree).values()) {\n    const components = findAgentComponents(\n      (project.metadata as { components?: ComponentMetadata[] })?.components,\n    );\n\n    for (const component of components) {\n      if (!component.path) continue;\n\n      const indexPath = joinPathFragments(\n        project.root,\n        component.path,\n        'index.ts',\n      );\n\n      await migrateIndex(\n        tree,\n        indexPath,\n        component.protocol as 'ag-ui' | 'a2a',\n        nextSteps,\n      );\n    }\n  }\n\n  await formatFilesInSubtree(tree);\n\n  return { nextSteps };\n}\n"],"names":["readFileSync","join","getProjects","joinPathFragments","TS_AGENT_GENERATOR_INFO","addDestructuredImport","applyGritQL","captureGritQLVariable","matchGritQL","formatFilesInSubtree","EXPRESS_IMPORT_OLD_WHERE","EXPRESS_IMPORT_OLD_MATCH","EXPRESS_IMPORT_OLD_REWRITE","RANDOM_UUID_IMPORT","SESSION_ID_HEADER_LINE","MIDDLEWARE_LEADING_COMMENT","AGUI_MIDDLEWARE_DEFINITION_OLD","A2A_MIDDLEWARE_USE_OLD","A2A_MIDDLEWARE_USE_NEW","RUNWITHSESSIONID_IMPORT_CAPTURE","REMOVE_RUNWITHSESSIONID_IMPORT_PATTERN","SESSION_ID_MIDDLEWARE_TEMPLATE","dirname","sessionIdMiddlewareContent","agentConnectionImport","replace","findAgentComponents","components","filter","component","generator","id","protocol","migrateIndex","tree","indexPath","nextSteps","exists","contents","read","includes","middlewarePattern","diverged","push","ready","mod","dir","split","slice","middlewarePath","write","migration","project","values","metadata","path","root"],"mappings":"AAAA;;;CAGC,GACD,SAASA,YAAY,QAAQ,UAAU;AACvC,SAASC,IAAI,QAAQ,YAAY;AACjC,SACEC,WAAW,EACXC,iBAAiB,QAGZ,aAAa;AACpB,SAASC,uBAAuB,QAAQ,iCAAiC;AACzE,SACEC,qBAAqB,EACrBC,WAAW,EACXC,qBAAqB,EACrBC,WAAW,QACN,wBAAwB;AAC/B,SAASC,oBAAoB,QAAQ,2BAA2B;AAGhE;;;;;;;;;;;;;;;;;;;;CAoBC,GAED,8EAA8E;AAC9E,4EAA4E;AAC5E,2EAA2E;AAC3E,2EAA2E;AAC3E,2EAA2E;AAC3E,6DAA6D;AAC7D,MAAMC,2BAA2B,CAAC;;;;;CAKjC,CAAC;AACF,MAAMC,2BAA2B,CAAC,yCAAyC,EAAED,0BAA0B;AACvG,MAAME,6BAA6B,CAAC,+EAA+E,EAAEF,0BAA0B;AAE/I,MAAMG,qBAAqB;AAE3B,MAAMC,yBACJ;AAEF,6EAA6E;AAC7E,uEAAuE;AACvE,6EAA6E;AAC7E,yEAAyE;AACzE,MAAMC,6BACJ;AAEF,8FAA8F;AAC9F,MAAMC,iCAAiC,CAAC;;;;EAItC,CAAC;AAEH,0EAA0E;AAC1E,MAAMC,yBAAyB,CAAC;;;;KAI3B,CAAC;AACN,MAAMC,yBAAyB;AAE/B,wEAAwE;AACxE,wEAAwE;AACxE,qEAAqE;AACrE,MAAMC,kCACJ;AAEF,yEAAyE;AACzE,qEAAqE;AACrE,6EAA6E;AAC7E,2EAA2E;AAC3E,MAAMC,yCAAyC,CAAC;;;;CAI/C,CAAC;AAEF,wEAAwE;AACxE,2EAA2E;AAC3E,WAAW;AACX,MAAMC,iCAAiCrB,aACrCC,KACE,YAAYqB,OAAO,EACnB,wFAEF;AAGF,MAAMC,6BAA6B,CAACC,wBAClCH,+BAA+BI,OAAO,CACpC,gCACAD;AAGJ,MAAME,sBAAsB,CAC1BC,aAEA,AAACA,CAAAA,cAAc,EAAE,AAAD,EAAGC,MAAM,CACvB,CAACC,YACCA,UAAUC,SAAS,KAAK1B,wBAAwB2B,EAAE,IACjDF,CAAAA,UAAUG,QAAQ,KAAK,WAAWH,UAAUG,QAAQ,KAAK,KAAI;AAGpE,MAAMC,eAAe,OACnBC,MACAC,WACAH,UACAI;IAEA,IAAI,CAACF,KAAKG,MAAM,CAACF,YAAY;IAE7B,MAAMG,WAAWJ,KAAKK,IAAI,CAACJ,WAAW,YAAY;IAClD,IAAI,CAACG,SAASE,QAAQ,CAAC1B,yBAAyB;IAEhD,MAAM2B,oBACJT,aAAa,UACThB,iCACAC;IAEN,MAAMyB,WAAW;QACfN,UAAUO,IAAI,CACZ,GAAGR,UAAU,uCAAuC,EAAEH,SAAS,4NAA4N,CAAC;IAEhS;IAEA,MAAMY,QACJ,AAAC,MAAMpC,YAAY0B,MAAMC,WAAWxB,6BACnC,MAAMH,YAAY0B,MAAMC,WAAW,CAAC,EAAE,EAAEtB,mBAAmB,EAAE,CAAC,KAC9D,MAAML,YAAY0B,MAAMC,WAAW,CAAC,EAAE,EAAErB,uBAAuB,EAAE,CAAC,KAClE,MAAMN,YAAY0B,MAAMC,WAAW,CAAC,EAAE,EAAEpB,2BAA2B,EAAE,CAAC,KACtE,MAAMP,YAAY0B,MAAMC,WAAW,CAAC,EAAE,EAAEM,kBAAkB,EAAE,CAAC,KAC7D,MAAMjC,YAAY0B,MAAMC,WAAWhB;IAEtC,IAAI,CAACyB,OAAO;QACVF;QACA;IACF;IAEA,MAAMG,MAAM,MAAMtC,sBAChB2B,MACAC,WACAhB,iCACA;IAEF,IAAI,CAAC0B,KAAK;QACRH;QACA;IACF;IAEA,MAAMI,MAAMX,UAAUY,KAAK,CAAC,KAAKC,KAAK,CAAC,GAAG,CAAC,GAAG/C,IAAI,CAAC;IACnD,MAAMgD,iBAAiB9C,kBACrB2C,KACA,cACA;IAGF,IAAI,CAACZ,KAAKG,MAAM,CAACY,iBAAiB;QAChCf,KAAKgB,KAAK,CAACD,gBAAgB1B,2BAA2BsB;IACxD;IAEA,MAAMvC,YAAY4B,MAAMC,WAAWvB;IACnC,MAAMN,YAAY4B,MAAMC,WAAW,CAAC,EAAE,EAAEtB,mBAAmB,OAAO,CAAC;IACnE,MAAMP,YAAY4B,MAAMC,WAAW,CAAC,EAAE,EAAErB,uBAAuB,OAAO,CAAC;IACvE,MAAMR,YAAY4B,MAAMC,WAAWf;IACnC,MAAMd,YAAY4B,MAAMC,WAAW,CAAC,EAAE,EAAEpB,2BAA2B,OAAO,CAAC;IAE3E,IAAIiB,aAAa,SAAS;QACxB,MAAM1B,YACJ4B,MACAC,WACA,CAAC,EAAE,EAAEnB,+BAA+B,OAAO,CAAC;IAEhD,OAAO;QACL,MAAMV,YACJ4B,MACAC,WACA,CAAC,EAAE,EAAElB,uBAAuB,QAAQ,EAAEC,uBAAuB,EAAE,CAAC;IAEpE;IAEA,MAAMb,sBACJ6B,MACAC,WACA;QAAC;KAAsB,EACvB;AAEJ;AAEA,eAAe,eAAegB,UAC5BjB,IAAU;IAEV,MAAME,YAAsB,EAAE;IAE9B,KAAK,MAAMgB,WAAWlD,YAAYgC,MAAMmB,MAAM,GAAI;QAChD,MAAM1B,aAAaD,oBAChB0B,QAAQE,QAAQ,EAA2C3B;QAG9D,KAAK,MAAME,aAAaF,WAAY;YAClC,IAAI,CAACE,UAAU0B,IAAI,EAAE;YAErB,MAAMpB,YAAYhC,kBAChBiD,QAAQI,IAAI,EACZ3B,UAAU0B,IAAI,EACd;YAGF,MAAMtB,aACJC,MACAC,WACAN,UAAUG,QAAQ,EAClBI;QAEJ;IACF;IAEA,MAAM3B,qBAAqByB;IAE3B,OAAO;QAAEE;IAAU;AACrB"}