@aws/nx-plugin 1.0.5 → 1.0.7

package/LICENSE-THIRD-PARTY

@@ -108,7 +108,7 @@ THE SOFTWARE.
 
 ---
 
-The following software may be included in this product: @astral-sh/ruff-wasm-nodejs (0.16.9)
+The following software may be included in this product: @astral-sh/ruff-wasm-nodejs (0.16.10)
 This software contains the following license and notice below:
 
 MIT License
@@ -3898,7 +3898,7 @@ SOFTWARE.
 
 ---
 
-The following software may be included in this product: @modelcontextprotocol/sdk (1.30.1)
+The following software may be included in this product: @modelcontextprotocol/sdk (1.32.0)
 This software contains the following license and notice below:
 
 MIT License
@@ -4247,7 +4247,7 @@ USE OR OTHER DEALINGS IN THE SOFTWARE.
 
 ---
 
-The following software may be included in this product: @nxlv/python (23.1.1)
+The following software may be included in this product: @nxlv/python (23.2.1)
 This software contains the following license and notice below:
 
 MIT License
@@ -4274,7 +4274,7 @@ SOFTWARE.
 
 ---
 
-The following software may be included in this product: @oxc-project/types (0.151.0)
+The following software may be included in this product: @oxc-project/types (0.152.0)
 This software contains the following license and notice below:
 
 MIT License
@@ -13381,7 +13381,7 @@ SOFTWARE.**
 
 ---
 
-The following software may be included in this product: proxy-addr (2.0.7)
+The following software may be included in this product: proxy-addr (2.0.8)
 This software contains the following license and notice below:
 
 (The MIT License)
@@ -14165,7 +14165,7 @@ SOFTWARE.
 
 ---
 
-The following software may be included in this product: rolldown (1.2.11)
+The following software may be included in this product: rolldown (1.2.12)
 This software contains the following license and notice below:
 
 MIT License
@@ -16088,7 +16088,7 @@ SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE.
 
 ---
 
-The following software may be included in this product: vite (8.3.1)
+The following software may be included in this product: vite (8.3.2)
 This software contains the following license and notice below:
 
 # Vite core license
@@ -16767,35 +16767,6 @@ Repository: https://github.com/expressjs/cors
 
 ---------------------------------------
 
-## cross-spawn
-License: MIT
-By: André Cruz
-Repository: https://github.com/moxystudio/node-cross-spawn
-
-> The MIT License (MIT)
->
-> Copyright (c) 2018 Made With MOXY Lda <hello@moxy.studio>
->
-> Permission is hereby granted, free of charge, to any person obtaining a copy
-> of this software and associated documentation files (the "Software"), to deal
-> in the Software without restriction, including without limitation the rights
-> to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
-> copies of the Software, and to permit persons to whom the Software is
-> furnished to do so, subject to the following conditions:
->
-> The above copyright notice and this permission notice shall be included in
-> all copies or substantial portions of the Software.
->
-> THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
-> IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
-> FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
-> AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
-> LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
-> OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN
-> THE SOFTWARE.
-
----------------------------------------
-
 ## cssesc
 License: MIT
 By: Mathias Bynens
@@ -17319,29 +17290,6 @@ Repository: https://github.com/Rich-Harris/is-reference
 
 ---------------------------------------
 
-## isexe, which
-License: ISC
-By: Isaac Z. Schlueter
-Repositories: https://github.com/isaacs/isexe, https://github.com/isaacs/node-which
-
-> The ISC License
->
-> Copyright (c) Isaac Z. Schlueter and Contributors
->
-> Permission to use, copy, modify, and/or distribute this software for any
-> purpose with or without fee is hereby granted, provided that the above
-> copyright notice and this permission notice appear in all copies.
->
-> THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES
-> WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
-> MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR
-> ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
-> WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
-> ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF OR
-> IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
-
----------------------------------------
-
 ## js-tokens
 License: MIT
 By: Simon Lydell
@@ -17762,23 +17710,6 @@ Repository: https://github.com/pillarjs/parseurl
 
 ---------------------------------------
 
-## path-key, shebang-regex
-License: MIT
-By: Sindre Sorhus
-Repositories: https://github.com/sindresorhus/path-key, https://github.com/sindresorhus/shebang-regex
-
-> MIT License
->
-> Copyright (c) Sindre Sorhus <sindresorhus@gmail.com> (sindresorhus.com)
->
-> Permission is hereby granted, free of charge, to any person obtaining a copy of this software and associated documentation files (the "Software"), to deal in the Software without restriction, including without limitation the rights to use, copy, modify, merge, publish, distribute, sublicense, and/or sell copies of the Software, and to permit persons to whom the Software is furnished to do so, subject to the following conditions:
->
-> The above copyright notice and this permission notice shall be included in all copies or substantial portions of the Software.
->
-> THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE.
-
----------------------------------------
-
 ## periscopic
 License: MIT
 Repository: https://github.com/Rich-Harris/periscopic
@@ -18089,23 +18020,6 @@ Repositories: https://github.com/lukeed/resolve.exports, https://github.com/luke
 
 ---------------------------------------
 
-## shebang-command
-License: MIT
-By: Kevin Mårtensson
-Repository: https://github.com/kevva/shebang-command
-
-> MIT License
->
-> Copyright (c) Kevin Mårtensson <kevinmartensson@gmail.com> (github.com/kevva)
->
-> Permission is hereby granted, free of charge, to any person obtaining a copy of this software and associated documentation files (the "Software"), to deal in the Software without restriction, including without limitation the rights to use, copy, modify, merge, publish, distribute, sublicense, and/or sell copies of the Software, and to permit persons to whom the Software is furnished to do so, subject to the following conditions:
->
-> The above copyright notice and this permission notice shall be included in all copies or substantial portions of the Software.
->
-> THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE.
-
----------------------------------------
-
 ## shell-quote
 License: MIT
 By: James Halliday
@@ -18211,6 +18125,35 @@ Repository: https://github.com/antfu/strip-literal
 
 ---------------------------------------
 
+## tinyexec
+License: MIT
+By: James Garbutt
+Repository: https://github.com/tinylibs/tinyexec
+
+> MIT License
+>
+> Copyright (c) 2024 Tinylibs
+>
+> Permission is hereby granted, free of charge, to any person obtaining a copy
+> of this software and associated documentation files (the "Software"), to deal
+> in the Software without restriction, including without limitation the rights
+> to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+> copies of the Software, and to permit persons to whom the Software is
+> furnished to do so, subject to the following conditions:
+>
+> The above copyright notice and this permission notice shall be included in all
+> copies or substantial portions of the Software.
+>
+> THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+> IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+> FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+> AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+> LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+> OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+> SOFTWARE.
+
+---------------------------------------
+
 ## to-regex-range
 License: MIT
 By: Jon Schlinkert, Rouven Weßling
@@ -27569,6 +27512,41 @@ OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
 
 ---
 
+The following software may be included in this product: qs (6.16.0)
+This software contains the following license and notice below:
+
+BSD 3-Clause License
+
+Copyright (c) 2014, Nathan LaFreniere and other [contributors](https://github.com/ljharb/qs/graphs/contributors)
+All rights reserved.
+
+Redistribution and use in source and binary forms, with or without
+modification, are permitted provided that the following conditions are met:
+
+1. Redistributions of source code must retain the above copyright notice, this
+   list of conditions and the following disclaimer.
+
+2. Redistributions in binary form must reproduce the above copyright notice,
+   this list of conditions and the following disclaimer in the documentation
+   and/or other materials provided with the distribution.
+
+3. Neither the name of the copyright holder nor the names of its
+   contributors may be used to endorse or promote products derived from
+   this software without specific prior written permission.
+
+THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS "AS IS"
+AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE
+DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT HOLDER OR CONTRIBUTORS BE LIABLE
+FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
+DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR
+SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER
+CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY,
+OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+
+---
+
 The following software may be included in this product: smol-toml (1.6.1)
 This software contains the following license and notice below:
 

package/migrations.json

@@ -2,10 +2,15 @@
   "$schema": "http://json-schema.org/schema",
   "name": "@aws/nx-plugin",
   "generators": {
-    "latest-api-custom-domain-runtime-config": {
-      "version": "1.0.5",
-      "description": "Publish a configured custom domain as the API URL in runtime config for vended REST/HTTP API constructs and Terraform modules, and add custom domain inputs to the Terraform API modules",
-      "implementation": "./src/migrations/latest/api-custom-domain-runtime-config/migration"
+    "latest-pin-strands-express-peer": {
+      "version": "1.0.7",
+      "description": "Declare express in every project that declares @strands-agents/sdk without it so @strands-agents/sdk resolves to a single peer-suffixed instance",
+      "implementation": "./src/migrations/latest/pin-strands-express-peer/migration"
+    },
+    "latest-rdb-drop-lambda-rie": {
+      "version": "1.0.7",
+      "description": "Remove the Lambda Runtime Interface Emulator from vended ts#rdb and py#rdb Dockerfiles so its known HIGH vulnerabilities are not present in the image",
+      "implementation": "./src/migrations/latest/rdb-drop-lambda-rie/migration"
     },
     "v1.0.0-rc.50-0001-modernize-function-props-cast": {
       "version": "1.0.0-rc.50",
@@ -382,8 +387,13 @@
       "description": "Add the terraform-init target to Terraform projects so the shared provider plugin cache has a single writer",
       "implementation": "./src/migrations/v1.0.3/0001-terraform-init-target/migration"
     },
-    "sync-vended-versions": {
+    "v1.0.5-0001-api-custom-domain-runtime-config": {
       "version": "1.0.5",
+      "description": "Publish a configured custom domain as the API URL in runtime config for vended REST/HTTP API constructs and Terraform modules, and add custom domain inputs to the Terraform API modules",
+      "implementation": "./src/migrations/v1.0.5/0001-api-custom-domain-runtime-config/migration"
+    },
+    "sync-vended-versions": {
+      "version": "1.0.7",
       "description": "Sync vended dependency versions and the tracked plugin version to those vended by this release",
       "implementation": "./src/utils/version-upgrade-migration/migration"
     }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@aws/nx-plugin",
-  "version": "1.0.5",
+  "version": "1.0.7",
   "repository": {
     "type": "git",
     "url": "https://github.com/awslabs/nx-plugin-for-aws.git",
@@ -40,17 +40,17 @@
   },
   "dependencies": {
     "@apidevtools/swagger-parser": "12.1.0",
-    "@astral-sh/ruff-wasm-nodejs": "0.16.9",
+    "@astral-sh/ruff-wasm-nodejs": "0.16.10",
     "@biomejs/js-api": "6.0.0",
-    "@biomejs/wasm-nodejs": "2.5.14",
+    "@biomejs/wasm-nodejs": "2.5.15",
     "@getgrit/gritql": "0.0.3",
     "@iarna/toml": "2.2.5",
-    "@modelcontextprotocol/sdk": "1.30.1",
+    "@modelcontextprotocol/sdk": "1.32.0",
     "@nx/devkit": "23.2.1",
     "@nx/js": "23.2.1",
     "@nx/react": "23.2.1",
     "@nx/vite": "23.2.1",
-    "@nxlv/python": "23.1.1",
+    "@nxlv/python": "23.2.1",
     "@phenomnomnominal/tsquery": "6.2.0",
     "@types/estree": "1.0.9",
     "@types/js-yaml": "4.0.9",
@@ -79,7 +79,7 @@
     "typescript": "6.0.3",
     "unified": "11.0.5",
     "unist-util-visit": "5.1.0",
-    "vite": "8.3.1",
+    "vite": "8.3.2",
     "vitest": "4.1.11",
     "zod": "4.6.5"
   },

package/src/agentcore-gateway/__snapshots__/generator.spec.ts.snap

@@ -7,7 +7,7 @@ exports[`agentcore-gateway generator > protocol: http > omits protocol_type from
   required_providers {
     aws = {
       source  = "hashicorp/aws"
-      version = "6.66.0"
+      version = "6.67.0"
     }
     time = {
       source  = "hashicorp/time"

package/src/infra/app/__snapshots__/generator.spec.ts.snap

@@ -50,7 +50,7 @@ exports[`infra generator > should configure Checkov target correctly > checkov-t
     "default",
   ],
   "options": {
-    "command": "uvx --from checkov==3.3.20 checkov --config-file {projectRoot}/checkov.yml --directory dist/{projectRoot}/cdk.out --framework cloudformation",
+    "command": "uvx --from checkov==3.3.22 checkov --config-file {projectRoot}/checkov.yml --directory dist/{projectRoot}/cdk.out --framework cloudformation",
   },
   "outputs": [
     "{workspaceRoot}/dist/{projectRoot}/checkov",
@@ -150,7 +150,7 @@ exports[`infra generator > should configure project.json with correct targets >
         "default",
       ],
       "options": {
-        "command": "uvx --from checkov==3.3.20 checkov --config-file {projectRoot}/checkov.yml --directory dist/{projectRoot}/cdk.out --framework cloudformation",
+        "command": "uvx --from checkov==3.3.22 checkov --config-file {projectRoot}/checkov.yml --directory dist/{projectRoot}/cdk.out --framework cloudformation",
       },
       "outputs": [
         "{workspaceRoot}/dist/{projectRoot}/checkov",
@@ -762,7 +762,7 @@ exports[`infra generator > should handle custom project names correctly > custom
         "default",
       ],
       "options": {
-        "command": "uvx --from checkov==3.3.20 checkov --config-file {projectRoot}/checkov.yml --directory dist/{projectRoot}/cdk.out --framework cloudformation",
+        "command": "uvx --from checkov==3.3.22 checkov --config-file {projectRoot}/checkov.yml --directory dist/{projectRoot}/cdk.out --framework cloudformation",
       },
       "outputs": [
         "{workspaceRoot}/dist/{projectRoot}/checkov",

package/src/migrations/latest/pin-strands-express-peer/metadata.json

@@ -0,0 +1,3 @@
+{
+  "description": "Declare express in every project that declares @strands-agents/sdk without it so @strands-agents/sdk resolves to a single peer-suffixed instance"
+}

package/src/migrations/latest/pin-strands-express-peer/migration.d.ts

@@ -0,0 +1,29 @@
+/**
+ * Copyright Amazon.com, Inc. or its affiliates. All Rights Reserved.
+ * SPDX-License-Identifier: Apache-2.0
+ */
+import { type Tree } from '@nx/devkit';
+/**
+ * `express` is an optional peer of `@strands-agents/sdk` that any importer
+ * declaring strands without also declaring express can leave undeclared. pnpm
+ * suffixes each installed copy of a package by the versions of its peers, so
+ * such an importer can resolve express to a different version than the pin
+ * every other strands importer uses — splitting `@strands-agents/sdk` into two
+ * peer-suffixed instances of the same version.
+ *
+ * Anything importing both instances then sees two nominal identities of every
+ * SDK type — `Agent`, `McpClient`, `Plugin` — and fails to compile with "Types
+ * have separate declarations of a private property". Declaring express
+ * wherever strands is declared keeps the whole strands subgraph on the
+ * catalog's single pin. Mirrors the earlier `@aws-sdk/client-s3` peer fix, one
+ * optional peer further on.
+ *
+ * Detection is generic — every project's `package.json` plus the workspace
+ * root, checked for "declares @strands-agents/sdk but not express" — rather
+ * than listing the generators that currently produce that shape, so a future
+ * strands importer this migration predates is still covered. The shared
+ * agent-connection project is checked explicitly too, in case its project.json
+ * is missing or not yet registered when this runs — `getProjects` would miss
+ * it then, same as rc.95's `@aws-sdk/client-s3` migration guarded against.
+ */
+export default function migration(tree: Tree): Promise<void>;

package/src/migrations/latest/pin-strands-express-peer/migration.js

@@ -0,0 +1,58 @@
+/**
+ * Copyright Amazon.com, Inc. or its affiliates. All Rights Reserved.
+ * SPDX-License-Identifier: Apache-2.0
+ */ import { getProjects, joinPathFragments } from "@nx/devkit";
+import { AGENT_CONNECTION_PROJECT_DIR } from "../../../utils/agent-connection/agent-connection.js";
+import { addDependenciesToPackageJson } from "../../../utils/dependencies.js";
+import { formatFilesInSubtree } from "../../../utils/format.js";
+import { TS_VERSIONS } from "../../../utils/versions.js";
+const EXPRESS = 'express';
+const STRANDS_SDK = '@strands-agents/sdk';
+const ROOT_PACKAGE_JSON = 'package.json';
+/**
+ * `express` is an optional peer of `@strands-agents/sdk` that any importer
+ * declaring strands without also declaring express can leave undeclared. pnpm
+ * suffixes each installed copy of a package by the versions of its peers, so
+ * such an importer can resolve express to a different version than the pin
+ * every other strands importer uses — splitting `@strands-agents/sdk` into two
+ * peer-suffixed instances of the same version.
+ *
+ * Anything importing both instances then sees two nominal identities of every
+ * SDK type — `Agent`, `McpClient`, `Plugin` — and fails to compile with "Types
+ * have separate declarations of a private property". Declaring express
+ * wherever strands is declared keeps the whole strands subgraph on the
+ * catalog's single pin. Mirrors the earlier `@aws-sdk/client-s3` peer fix, one
+ * optional peer further on.
+ *
+ * Detection is generic — every project's `package.json` plus the workspace
+ * root, checked for "declares @strands-agents/sdk but not express" — rather
+ * than listing the generators that currently produce that shape, so a future
+ * strands importer this migration predates is still covered. The shared
+ * agent-connection project is checked explicitly too, in case its project.json
+ * is missing or not yet registered when this runs — `getProjects` would miss
+ * it then, same as rc.95's `@aws-sdk/client-s3` migration guarded against.
+ */ export default async function migration(tree) {
+    pinIfNeeded(tree, ROOT_PACKAGE_JSON);
+    pinIfNeeded(tree, joinPathFragments(AGENT_CONNECTION_PROJECT_DIR, 'package.json'));
+    for (const project of getProjects(tree).values()){
+        pinIfNeeded(tree, joinPathFragments(project.root, 'package.json'));
+    }
+    await formatFilesInSubtree(tree);
+}
+/** Declare express on the given manifest, if it declares strands but not express. */ function pinIfNeeded(tree, packageJsonPath) {
+    if (!tree.exists(packageJsonPath)) {
+        return;
+    }
+    const packageJson = JSON.parse(tree.read(packageJsonPath, 'utf-8') ?? '{}');
+    // Only where a strands client is actually declared — that is what pulls the
+    // optional peer. An already-declared express (even a stale range) is left to
+    // addDependenciesToPackageJson, which resolves it onto the catalog.
+    if (!packageJson.dependencies?.[STRANDS_SDK]) {
+        return;
+    }
+    addDependenciesToPackageJson(tree, {
+        [EXPRESS]: TS_VERSIONS[EXPRESS]
+    }, {}, packageJsonPath);
+}
+
+//# sourceMappingURL=migration.js.map

package/src/migrations/latest/pin-strands-express-peer/migration.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../../../../../../../packages/nx-plugin/src/migrations/latest/pin-strands-express-peer/migration.ts"],"sourcesContent":["/**\n * Copyright Amazon.com, Inc. or its affiliates. All Rights Reserved.\n * SPDX-License-Identifier: Apache-2.0\n */\nimport { getProjects, joinPathFragments, type Tree } from '@nx/devkit';\nimport { AGENT_CONNECTION_PROJECT_DIR } from '../../../utils/agent-connection/agent-connection.js';\nimport { addDependenciesToPackageJson } from '../../../utils/dependencies.js';\nimport { formatFilesInSubtree } from '../../../utils/format.js';\nimport { TS_VERSIONS } from '../../../utils/versions.js';\n\nconst EXPRESS = 'express';\nconst STRANDS_SDK = '@strands-agents/sdk';\nconst ROOT_PACKAGE_JSON = 'package.json';\n\n/**\n * `express` is an optional peer of `@strands-agents/sdk` that any importer\n * declaring strands without also declaring express can leave undeclared. pnpm\n * suffixes each installed copy of a package by the versions of its peers, so\n * such an importer can resolve express to a different version than the pin\n * every other strands importer uses — splitting `@strands-agents/sdk` into two\n * peer-suffixed instances of the same version.\n *\n * Anything importing both instances then sees two nominal identities of every\n * SDK type — `Agent`, `McpClient`, `Plugin` — and fails to compile with \"Types\n * have separate declarations of a private property\". Declaring express\n * wherever strands is declared keeps the whole strands subgraph on the\n * catalog's single pin. Mirrors the earlier `@aws-sdk/client-s3` peer fix, one\n * optional peer further on.\n *\n * Detection is generic — every project's `package.json` plus the workspace\n * root, checked for \"declares @strands-agents/sdk but not express\" — rather\n * than listing the generators that currently produce that shape, so a future\n * strands importer this migration predates is still covered. The shared\n * agent-connection project is checked explicitly too, in case its project.json\n * is missing or not yet registered when this runs — `getProjects` would miss\n * it then, same as rc.95's `@aws-sdk/client-s3` migration guarded against.\n */\nexport default async function migration(tree: Tree): Promise<void> {\n  pinIfNeeded(tree, ROOT_PACKAGE_JSON);\n  pinIfNeeded(\n    tree,\n    joinPathFragments(AGENT_CONNECTION_PROJECT_DIR, 'package.json'),\n  );\n\n  for (const project of getProjects(tree).values()) {\n    pinIfNeeded(tree, joinPathFragments(project.root, 'package.json'));\n  }\n\n  await formatFilesInSubtree(tree);\n}\n\n/** Declare express on the given manifest, if it declares strands but not express. */\nfunction pinIfNeeded(tree: Tree, packageJsonPath: string): void {\n  if (!tree.exists(packageJsonPath)) {\n    return;\n  }\n\n  const packageJson = JSON.parse(tree.read(packageJsonPath, 'utf-8') ?? '{}');\n  // Only where a strands client is actually declared — that is what pulls the\n  // optional peer. An already-declared express (even a stale range) is left to\n  // addDependenciesToPackageJson, which resolves it onto the catalog.\n  if (!packageJson.dependencies?.[STRANDS_SDK]) {\n    return;\n  }\n\n  addDependenciesToPackageJson(\n    tree,\n    { [EXPRESS]: TS_VERSIONS[EXPRESS] },\n    {},\n    packageJsonPath,\n  );\n}\n"],"names":["getProjects","joinPathFragments","AGENT_CONNECTION_PROJECT_DIR","addDependenciesToPackageJson","formatFilesInSubtree","TS_VERSIONS","EXPRESS","STRANDS_SDK","ROOT_PACKAGE_JSON","migration","tree","pinIfNeeded","project","values","root","packageJsonPath","exists","packageJson","JSON","parse","read","dependencies"],"mappings":"AAAA;;;CAGC,GACD,SAASA,WAAW,EAAEC,iBAAiB,QAAmB,aAAa;AACvE,SAASC,4BAA4B,QAAQ,sDAAsD;AACnG,SAASC,4BAA4B,QAAQ,iCAAiC;AAC9E,SAASC,oBAAoB,QAAQ,2BAA2B;AAChE,SAASC,WAAW,QAAQ,6BAA6B;AAEzD,MAAMC,UAAU;AAChB,MAAMC,cAAc;AACpB,MAAMC,oBAAoB;AAE1B;;;;;;;;;;;;;;;;;;;;;;CAsBC,GACD,eAAe,eAAeC,UAAUC,IAAU;IAChDC,YAAYD,MAAMF;IAClBG,YACED,MACAT,kBAAkBC,8BAA8B;IAGlD,KAAK,MAAMU,WAAWZ,YAAYU,MAAMG,MAAM,GAAI;QAChDF,YAAYD,MAAMT,kBAAkBW,QAAQE,IAAI,EAAE;IACpD;IAEA,MAAMV,qBAAqBM;AAC7B;AAEA,mFAAmF,GACnF,SAASC,YAAYD,IAAU,EAAEK,eAAuB;IACtD,IAAI,CAACL,KAAKM,MAAM,CAACD,kBAAkB;QACjC;IACF;IAEA,MAAME,cAAcC,KAAKC,KAAK,CAACT,KAAKU,IAAI,CAACL,iBAAiB,YAAY;IACtE,4EAA4E;IAC5E,6EAA6E;IAC7E,oEAAoE;IACpE,IAAI,CAACE,YAAYI,YAAY,EAAE,CAACd,YAAY,EAAE;QAC5C;IACF;IAEAJ,6BACEO,MACA;QAAE,CAACJ,QAAQ,EAAED,WAAW,CAACC,QAAQ;IAAC,GAClC,CAAC,GACDS;AAEJ"}

package/src/migrations/latest/rdb-drop-lambda-rie/metadata.json

@@ -0,0 +1,3 @@
+{
+  "description": "Remove the Lambda Runtime Interface Emulator from vended ts#rdb and py#rdb Dockerfiles so its known HIGH vulnerabilities are not present in the image"
+}

package/src/migrations/latest/rdb-drop-lambda-rie/migration.js

@@ -0,0 +1,105 @@
+/**
+ * Copyright Amazon.com, Inc. or its affiliates. All Rights Reserved.
+ * SPDX-License-Identifier: Apache-2.0
+ */ import { getProjects, joinPathFragments } from "@nx/devkit";
+import { PY_RDB_GENERATOR_INFO } from "../../../py/rdb/generator.js";
+import { TS_RDB_GENERATOR_INFO } from "../../../ts/rdb/generator.js";
+import { formatFilesInSubtree } from "../../../utils/format.js";
+/**
+ * Remove the Lambda Runtime Interface Emulator (RIE) from the vended ts#rdb
+ * and py#rdb Dockerfiles.
+ *
+ * `/lambda-entrypoint.sh` only invokes RIE when AWS_LAMBDA_RUNTIME_API is
+ * unset, i.e. for local `docker run` emulation outside Lambda — the deployed
+ * function never runs it. Its upstream build lags the Go toolchain, so it
+ * carries known HIGH vulnerabilities (net/http and crypto/tls DoS CVEs) the
+ * image scan flags with no fixed upstream image coming soon. Stripping it
+ * follows the same pattern the templates already use for other unused,
+ * vulnerable parts of the base image (py#rdb removing pip, ts#rdb removing
+ * the runtime's AWS SDK copy). New workspaces get this from the generator
+ * templates; this brings existing ones up to date.
+ *
+ * Only the three Dockerfiles the ts#rdb / py#rdb generators vend are touched,
+ * located from each rdb project's root (recorded in its metadata). Each is
+ * edited in place only where its comment + `RUN microdnf upgrade ...` block
+ * still has the exact shape the generator wrote before this change; one that
+ * has diverged (a customised comment or upgrade command) is left untouched
+ * and reported via `nextSteps`.
+ */ const AWS_LAMBDA_RIE = '/usr/local/bin/aws-lambda-rie';
+/**
+ * The exact comment + `RUN microdnf upgrade ...` block ts#rdb's Dockerfile had
+ * before this migration, and what it becomes.
+ */ const TS_RDB_OLD_UPGRADE = `# Patch OS packages beyond the base image's pinned release, and drop the
+# runtime's convenience copy of the AWS SDK (the handler bundle inlines its
+# own dependencies), keeping the image free of known HIGH/CRITICAL
+# vulnerabilities
+RUN microdnf upgrade -y --releasever latest && microdnf clean all \\
+    && rm -rf /var/runtime/node_modules/@aws-sdk`;
+const TS_RDB_NEW_UPGRADE = `# Patch OS packages beyond the base image's pinned release, and drop the
+# runtime's convenience copy of the AWS SDK (the handler bundle inlines its
+# own dependencies), keeping the image free of known HIGH/CRITICAL
+# vulnerabilities. Also drop the Lambda Runtime Interface Emulator: it is only
+# used for local \`docker run\` emulation outside Lambda, never by the deployed
+# function, and carries known HIGH vulnerabilities.
+RUN microdnf upgrade -y --releasever latest && microdnf clean all \\
+    && rm -rf /var/runtime/node_modules/@aws-sdk ${AWS_LAMBDA_RIE}`;
+/**
+ * The exact comment + `RUN microdnf upgrade ...` block py#rdb's two Dockerfiles
+ * had before this migration, and what it becomes. Both Dockerfile.migration and
+ * Dockerfile.create-db-user share this block verbatim.
+ */ const PY_RDB_OLD_UPGRADE = `# Patch OS packages beyond the base image's pinned release, and drop pip, whose
+# vendored copies of msgpack and setuptools carry known HIGH vulnerabilities.
+# The handler's dependencies are already installed in the image, so nothing
+# installs packages at runtime.
+RUN microdnf upgrade -y --releasever latest && microdnf clean all \\
+    && rm -rf /var/lang/lib/python*/site-packages/pip \\
+    /var/lang/lib/python*/site-packages/pip-*.dist-info`;
+const PY_RDB_NEW_UPGRADE = `# Patch OS packages beyond the base image's pinned release, and drop pip, whose
+# vendored copies of msgpack and setuptools carry known HIGH vulnerabilities.
+# The handler's dependencies are already installed in the image, so nothing
+# installs packages at runtime. Also drop the Lambda Runtime Interface
+# Emulator: it is only used for local \`docker run\` emulation outside Lambda,
+# never by the deployed function, and carries known HIGH vulnerabilities.
+RUN microdnf upgrade -y --releasever latest && microdnf clean all \\
+    && rm -rf /var/lang/lib/python*/site-packages/pip \\
+    /var/lang/lib/python*/site-packages/pip-*.dist-info \\
+    ${AWS_LAMBDA_RIE}`;
+/** The marker checked to detect an already-migrated (or user-added) removal. */ const RIE_REMOVED_MARKER = AWS_LAMBDA_RIE;
+const divergedNextStep = (filePath)=>`${filePath}: its microdnf upgrade command has been customised, so it was left unchanged. Remove the Lambda Runtime Interface Emulator by adding "${AWS_LAMBDA_RIE}" to its "rm -rf" — it is only used for local \`docker run\` emulation outside Lambda and carries known HIGH vulnerabilities.`;
+/**
+ * Replace a Dockerfile's old comment + upgrade block with the new one, only
+ * when the file still has the exact shape the generator wrote. Already
+ * migrated and diverged files are both left alone; the latter is reported via
+ * nextSteps.
+ */ const migrateDockerfile = (tree, filePath, oldBlock, newBlock, nextSteps)=>{
+    if (!tree.exists(filePath)) {
+        return;
+    }
+    const content = tree.read(filePath, 'utf-8') ?? '';
+    if (content.includes(RIE_REMOVED_MARKER)) {
+        return; // Already migrated (or user-added).
+    }
+    if (!content.includes(oldBlock)) {
+        nextSteps.push(divergedNextStep(filePath));
+        return;
+    }
+    tree.write(filePath, content.replace(oldBlock, newBlock));
+};
+export default async function migration(tree) {
+    const nextSteps = [];
+    for (const project of getProjects(tree).values()){
+        const generator = project.metadata?.generator;
+        if (generator === TS_RDB_GENERATOR_INFO.id) {
+            migrateDockerfile(tree, joinPathFragments(project.root, 'Dockerfile'), TS_RDB_OLD_UPGRADE, TS_RDB_NEW_UPGRADE, nextSteps);
+        } else if (generator === PY_RDB_GENERATOR_INFO.id) {
+            migrateDockerfile(tree, joinPathFragments(project.root, 'Dockerfile.migration'), PY_RDB_OLD_UPGRADE, PY_RDB_NEW_UPGRADE, nextSteps);
+            migrateDockerfile(tree, joinPathFragments(project.root, 'Dockerfile.create-db-user'), PY_RDB_OLD_UPGRADE, PY_RDB_NEW_UPGRADE, nextSteps);
+        }
+    }
+    await formatFilesInSubtree(tree);
+    return {
+        nextSteps
+    };
+}
+
+//# sourceMappingURL=migration.js.map

package/src/migrations/latest/rdb-drop-lambda-rie/migration.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../../../../../../../packages/nx-plugin/src/migrations/latest/rdb-drop-lambda-rie/migration.ts"],"sourcesContent":["/**\n * Copyright Amazon.com, Inc. or its affiliates. All Rights Reserved.\n * SPDX-License-Identifier: Apache-2.0\n */\nimport {\n  getProjects,\n  joinPathFragments,\n  type MigrationReturnObject,\n  type Tree,\n} from '@nx/devkit';\nimport { PY_RDB_GENERATOR_INFO } from '../../../py/rdb/generator.js';\nimport { TS_RDB_GENERATOR_INFO } from '../../../ts/rdb/generator.js';\nimport { formatFilesInSubtree } from '../../../utils/format.js';\n\n/**\n * Remove the Lambda Runtime Interface Emulator (RIE) from the vended ts#rdb\n * and py#rdb Dockerfiles.\n *\n * `/lambda-entrypoint.sh` only invokes RIE when AWS_LAMBDA_RUNTIME_API is\n * unset, i.e. for local `docker run` emulation outside Lambda — the deployed\n * function never runs it. Its upstream build lags the Go toolchain, so it\n * carries known HIGH vulnerabilities (net/http and crypto/tls DoS CVEs) the\n * image scan flags with no fixed upstream image coming soon. Stripping it\n * follows the same pattern the templates already use for other unused,\n * vulnerable parts of the base image (py#rdb removing pip, ts#rdb removing\n * the runtime's AWS SDK copy). New workspaces get this from the generator\n * templates; this brings existing ones up to date.\n *\n * Only the three Dockerfiles the ts#rdb / py#rdb generators vend are touched,\n * located from each rdb project's root (recorded in its metadata). Each is\n * edited in place only where its comment + `RUN microdnf upgrade ...` block\n * still has the exact shape the generator wrote before this change; one that\n * has diverged (a customised comment or upgrade command) is left untouched\n * and reported via `nextSteps`.\n */\n\nconst AWS_LAMBDA_RIE = '/usr/local/bin/aws-lambda-rie';\n\n/**\n * The exact comment + `RUN microdnf upgrade ...` block ts#rdb's Dockerfile had\n * before this migration, and what it becomes.\n */\nconst TS_RDB_OLD_UPGRADE = `# Patch OS packages beyond the base image's pinned release, and drop the\n# runtime's convenience copy of the AWS SDK (the handler bundle inlines its\n# own dependencies), keeping the image free of known HIGH/CRITICAL\n# vulnerabilities\nRUN microdnf upgrade -y --releasever latest && microdnf clean all \\\\\n    && rm -rf /var/runtime/node_modules/@aws-sdk`;\nconst TS_RDB_NEW_UPGRADE = `# Patch OS packages beyond the base image's pinned release, and drop the\n# runtime's convenience copy of the AWS SDK (the handler bundle inlines its\n# own dependencies), keeping the image free of known HIGH/CRITICAL\n# vulnerabilities. Also drop the Lambda Runtime Interface Emulator: it is only\n# used for local \\`docker run\\` emulation outside Lambda, never by the deployed\n# function, and carries known HIGH vulnerabilities.\nRUN microdnf upgrade -y --releasever latest && microdnf clean all \\\\\n    && rm -rf /var/runtime/node_modules/@aws-sdk ${AWS_LAMBDA_RIE}`;\n\n/**\n * The exact comment + `RUN microdnf upgrade ...` block py#rdb's two Dockerfiles\n * had before this migration, and what it becomes. Both Dockerfile.migration and\n * Dockerfile.create-db-user share this block verbatim.\n */\nconst PY_RDB_OLD_UPGRADE = `# Patch OS packages beyond the base image's pinned release, and drop pip, whose\n# vendored copies of msgpack and setuptools carry known HIGH vulnerabilities.\n# The handler's dependencies are already installed in the image, so nothing\n# installs packages at runtime.\nRUN microdnf upgrade -y --releasever latest && microdnf clean all \\\\\n    && rm -rf /var/lang/lib/python*/site-packages/pip \\\\\n    /var/lang/lib/python*/site-packages/pip-*.dist-info`;\nconst PY_RDB_NEW_UPGRADE = `# Patch OS packages beyond the base image's pinned release, and drop pip, whose\n# vendored copies of msgpack and setuptools carry known HIGH vulnerabilities.\n# The handler's dependencies are already installed in the image, so nothing\n# installs packages at runtime. Also drop the Lambda Runtime Interface\n# Emulator: it is only used for local \\`docker run\\` emulation outside Lambda,\n# never by the deployed function, and carries known HIGH vulnerabilities.\nRUN microdnf upgrade -y --releasever latest && microdnf clean all \\\\\n    && rm -rf /var/lang/lib/python*/site-packages/pip \\\\\n    /var/lang/lib/python*/site-packages/pip-*.dist-info \\\\\n    ${AWS_LAMBDA_RIE}`;\n\n/** The marker checked to detect an already-migrated (or user-added) removal. */\nconst RIE_REMOVED_MARKER = AWS_LAMBDA_RIE;\n\nconst divergedNextStep = (filePath: string): string =>\n  `${filePath}: its microdnf upgrade command has been customised, so it was left unchanged. Remove the Lambda Runtime Interface Emulator by adding \"${AWS_LAMBDA_RIE}\" to its \"rm -rf\" — it is only used for local \\`docker run\\` emulation outside Lambda and carries known HIGH vulnerabilities.`;\n\n/**\n * Replace a Dockerfile's old comment + upgrade block with the new one, only\n * when the file still has the exact shape the generator wrote. Already\n * migrated and diverged files are both left alone; the latter is reported via\n * nextSteps.\n */\nconst migrateDockerfile = (\n  tree: Tree,\n  filePath: string,\n  oldBlock: string,\n  newBlock: string,\n  nextSteps: string[],\n): void => {\n  if (!tree.exists(filePath)) {\n    return;\n  }\n\n  const content = tree.read(filePath, 'utf-8') ?? '';\n  if (content.includes(RIE_REMOVED_MARKER)) {\n    return; // Already migrated (or user-added).\n  }\n\n  if (!content.includes(oldBlock)) {\n    nextSteps.push(divergedNextStep(filePath));\n    return;\n  }\n\n  tree.write(filePath, content.replace(oldBlock, newBlock));\n};\n\nexport default async function migration(\n  tree: Tree,\n): Promise<MigrationReturnObject> {\n  const nextSteps: string[] = [];\n\n  for (const project of getProjects(tree).values()) {\n    const generator = (project.metadata as { generator?: string } | undefined)\n      ?.generator;\n\n    if (generator === TS_RDB_GENERATOR_INFO.id) {\n      migrateDockerfile(\n        tree,\n        joinPathFragments(project.root, 'Dockerfile'),\n        TS_RDB_OLD_UPGRADE,\n        TS_RDB_NEW_UPGRADE,\n        nextSteps,\n      );\n    } else if (generator === PY_RDB_GENERATOR_INFO.id) {\n      migrateDockerfile(\n        tree,\n        joinPathFragments(project.root, 'Dockerfile.migration'),\n        PY_RDB_OLD_UPGRADE,\n        PY_RDB_NEW_UPGRADE,\n        nextSteps,\n      );\n      migrateDockerfile(\n        tree,\n        joinPathFragments(project.root, 'Dockerfile.create-db-user'),\n        PY_RDB_OLD_UPGRADE,\n        PY_RDB_NEW_UPGRADE,\n        nextSteps,\n      );\n    }\n  }\n\n  await formatFilesInSubtree(tree);\n\n  return { nextSteps };\n}\n"],"names":["getProjects","joinPathFragments","PY_RDB_GENERATOR_INFO","TS_RDB_GENERATOR_INFO","formatFilesInSubtree","AWS_LAMBDA_RIE","TS_RDB_OLD_UPGRADE","TS_RDB_NEW_UPGRADE","PY_RDB_OLD_UPGRADE","PY_RDB_NEW_UPGRADE","RIE_REMOVED_MARKER","divergedNextStep","filePath","migrateDockerfile","tree","oldBlock","newBlock","nextSteps","exists","content","read","includes","push","write","replace","migration","project","values","generator","metadata","id","root"],"mappings":"AAAA;;;CAGC,GACD,SACEA,WAAW,EACXC,iBAAiB,QAGZ,aAAa;AACpB,SAASC,qBAAqB,QAAQ,+BAA+B;AACrE,SAASC,qBAAqB,QAAQ,+BAA+B;AACrE,SAASC,oBAAoB,QAAQ,2BAA2B;AAEhE;;;;;;;;;;;;;;;;;;;;CAoBC,GAED,MAAMC,iBAAiB;AAEvB;;;CAGC,GACD,MAAMC,qBAAqB,CAAC;;;;;gDAKoB,CAAC;AACjD,MAAMC,qBAAqB,CAAC;;;;;;;iDAOqB,EAAEF,gBAAgB;AAEnE;;;;CAIC,GACD,MAAMG,qBAAqB,CAAC;;;;;;uDAM2B,CAAC;AACxD,MAAMC,qBAAqB,CAAC;;;;;;;;;IASxB,EAAEJ,gBAAgB;AAEtB,8EAA8E,GAC9E,MAAMK,qBAAqBL;AAE3B,MAAMM,mBAAmB,CAACC,WACxB,GAAGA,SAAS,sIAAsI,EAAEP,eAAe,6HAA6H,CAAC;AAEnS;;;;;CAKC,GACD,MAAMQ,oBAAoB,CACxBC,MACAF,UACAG,UACAC,UACAC;IAEA,IAAI,CAACH,KAAKI,MAAM,CAACN,WAAW;QAC1B;IACF;IAEA,MAAMO,UAAUL,KAAKM,IAAI,CAACR,UAAU,YAAY;IAChD,IAAIO,QAAQE,QAAQ,CAACX,qBAAqB;QACxC,QAAQ,oCAAoC;IAC9C;IAEA,IAAI,CAACS,QAAQE,QAAQ,CAACN,WAAW;QAC/BE,UAAUK,IAAI,CAACX,iBAAiBC;QAChC;IACF;IAEAE,KAAKS,KAAK,CAACX,UAAUO,QAAQK,OAAO,CAACT,UAAUC;AACjD;AAEA,eAAe,eAAeS,UAC5BX,IAAU;IAEV,MAAMG,YAAsB,EAAE;IAE9B,KAAK,MAAMS,WAAW1B,YAAYc,MAAMa,MAAM,GAAI;QAChD,MAAMC,YAAaF,QAAQG,QAAQ,EAC/BD;QAEJ,IAAIA,cAAczB,sBAAsB2B,EAAE,EAAE;YAC1CjB,kBACEC,MACAb,kBAAkByB,QAAQK,IAAI,EAAE,eAChCzB,oBACAC,oBACAU;QAEJ,OAAO,IAAIW,cAAc1B,sBAAsB4B,EAAE,EAAE;YACjDjB,kBACEC,MACAb,kBAAkByB,QAAQK,IAAI,EAAE,yBAChCvB,oBACAC,oBACAQ;YAEFJ,kBACEC,MACAb,kBAAkByB,QAAQK,IAAI,EAAE,8BAChCvB,oBACAC,oBACAQ;QAEJ;IACF;IAEA,MAAMb,qBAAqBU;IAE3B,OAAO;QAAEG;IAAU;AACrB"}

package/src/migrations/v1.0.5/0001-api-custom-domain-runtime-config/migration.d.ts

@@ -0,0 +1,6 @@
+/**
+ * Copyright Amazon.com, Inc. or its affiliates. All Rights Reserved.
+ * SPDX-License-Identifier: Apache-2.0
+ */
+import { type MigrationReturnObject, type Tree } from '@nx/devkit';
+export default function migration(tree: Tree): Promise<MigrationReturnObject>;