@aws/nx-plugin 1.0.6 → 1.0.7

package/LICENSE-THIRD-PARTY

@@ -4274,7 +4274,7 @@ SOFTWARE.
 
 ---
 
-The following software may be included in this product: @oxc-project/types (0.151.0)
+The following software may be included in this product: @oxc-project/types (0.152.0)
 This software contains the following license and notice below:
 
 MIT License
@@ -13381,7 +13381,7 @@ SOFTWARE.**
 
 ---
 
-The following software may be included in this product: proxy-addr (2.0.7)
+The following software may be included in this product: proxy-addr (2.0.8)
 This software contains the following license and notice below:
 
 (The MIT License)
@@ -14165,7 +14165,7 @@ SOFTWARE.
 
 ---
 
-The following software may be included in this product: rolldown (1.2.11)
+The following software may be included in this product: rolldown (1.2.12)
 This software contains the following license and notice below:
 
 MIT License

package/migrations.json

@@ -2,6 +2,16 @@
   "$schema": "http://json-schema.org/schema",
   "name": "@aws/nx-plugin",
   "generators": {
+    "latest-pin-strands-express-peer": {
+      "version": "1.0.7",
+      "description": "Declare express in every project that declares @strands-agents/sdk without it so @strands-agents/sdk resolves to a single peer-suffixed instance",
+      "implementation": "./src/migrations/latest/pin-strands-express-peer/migration"
+    },
+    "latest-rdb-drop-lambda-rie": {
+      "version": "1.0.7",
+      "description": "Remove the Lambda Runtime Interface Emulator from vended ts#rdb and py#rdb Dockerfiles so its known HIGH vulnerabilities are not present in the image",
+      "implementation": "./src/migrations/latest/rdb-drop-lambda-rie/migration"
+    },
     "v1.0.0-rc.50-0001-modernize-function-props-cast": {
       "version": "1.0.0-rc.50",
       "description": "Replace the legacy angle-bracket FunctionProps type assertion with the modern as syntax in generated API constructs",
@@ -383,7 +393,7 @@
       "implementation": "./src/migrations/v1.0.5/0001-api-custom-domain-runtime-config/migration"
     },
     "sync-vended-versions": {
-      "version": "1.0.6",
+      "version": "1.0.7",
       "description": "Sync vended dependency versions and the tracked plugin version to those vended by this release",
       "implementation": "./src/utils/version-upgrade-migration/migration"
     }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@aws/nx-plugin",
-  "version": "1.0.6",
+  "version": "1.0.7",
   "repository": {
     "type": "git",
     "url": "https://github.com/awslabs/nx-plugin-for-aws.git",

package/src/migrations/latest/pin-strands-express-peer/metadata.json

@@ -0,0 +1,3 @@
+{
+  "description": "Declare express in every project that declares @strands-agents/sdk without it so @strands-agents/sdk resolves to a single peer-suffixed instance"
+}

package/src/migrations/latest/pin-strands-express-peer/migration.d.ts

@@ -0,0 +1,29 @@
+/**
+ * Copyright Amazon.com, Inc. or its affiliates. All Rights Reserved.
+ * SPDX-License-Identifier: Apache-2.0
+ */
+import { type Tree } from '@nx/devkit';
+/**
+ * `express` is an optional peer of `@strands-agents/sdk` that any importer
+ * declaring strands without also declaring express can leave undeclared. pnpm
+ * suffixes each installed copy of a package by the versions of its peers, so
+ * such an importer can resolve express to a different version than the pin
+ * every other strands importer uses — splitting `@strands-agents/sdk` into two
+ * peer-suffixed instances of the same version.
+ *
+ * Anything importing both instances then sees two nominal identities of every
+ * SDK type — `Agent`, `McpClient`, `Plugin` — and fails to compile with "Types
+ * have separate declarations of a private property". Declaring express
+ * wherever strands is declared keeps the whole strands subgraph on the
+ * catalog's single pin. Mirrors the earlier `@aws-sdk/client-s3` peer fix, one
+ * optional peer further on.
+ *
+ * Detection is generic — every project's `package.json` plus the workspace
+ * root, checked for "declares @strands-agents/sdk but not express" — rather
+ * than listing the generators that currently produce that shape, so a future
+ * strands importer this migration predates is still covered. The shared
+ * agent-connection project is checked explicitly too, in case its project.json
+ * is missing or not yet registered when this runs — `getProjects` would miss
+ * it then, same as rc.95's `@aws-sdk/client-s3` migration guarded against.
+ */
+export default function migration(tree: Tree): Promise<void>;

package/src/migrations/latest/pin-strands-express-peer/migration.js

@@ -0,0 +1,58 @@
+/**
+ * Copyright Amazon.com, Inc. or its affiliates. All Rights Reserved.
+ * SPDX-License-Identifier: Apache-2.0
+ */ import { getProjects, joinPathFragments } from "@nx/devkit";
+import { AGENT_CONNECTION_PROJECT_DIR } from "../../../utils/agent-connection/agent-connection.js";
+import { addDependenciesToPackageJson } from "../../../utils/dependencies.js";
+import { formatFilesInSubtree } from "../../../utils/format.js";
+import { TS_VERSIONS } from "../../../utils/versions.js";
+const EXPRESS = 'express';
+const STRANDS_SDK = '@strands-agents/sdk';
+const ROOT_PACKAGE_JSON = 'package.json';
+/**
+ * `express` is an optional peer of `@strands-agents/sdk` that any importer
+ * declaring strands without also declaring express can leave undeclared. pnpm
+ * suffixes each installed copy of a package by the versions of its peers, so
+ * such an importer can resolve express to a different version than the pin
+ * every other strands importer uses — splitting `@strands-agents/sdk` into two
+ * peer-suffixed instances of the same version.
+ *
+ * Anything importing both instances then sees two nominal identities of every
+ * SDK type — `Agent`, `McpClient`, `Plugin` — and fails to compile with "Types
+ * have separate declarations of a private property". Declaring express
+ * wherever strands is declared keeps the whole strands subgraph on the
+ * catalog's single pin. Mirrors the earlier `@aws-sdk/client-s3` peer fix, one
+ * optional peer further on.
+ *
+ * Detection is generic — every project's `package.json` plus the workspace
+ * root, checked for "declares @strands-agents/sdk but not express" — rather
+ * than listing the generators that currently produce that shape, so a future
+ * strands importer this migration predates is still covered. The shared
+ * agent-connection project is checked explicitly too, in case its project.json
+ * is missing or not yet registered when this runs — `getProjects` would miss
+ * it then, same as rc.95's `@aws-sdk/client-s3` migration guarded against.
+ */ export default async function migration(tree) {
+    pinIfNeeded(tree, ROOT_PACKAGE_JSON);
+    pinIfNeeded(tree, joinPathFragments(AGENT_CONNECTION_PROJECT_DIR, 'package.json'));
+    for (const project of getProjects(tree).values()){
+        pinIfNeeded(tree, joinPathFragments(project.root, 'package.json'));
+    }
+    await formatFilesInSubtree(tree);
+}
+/** Declare express on the given manifest, if it declares strands but not express. */ function pinIfNeeded(tree, packageJsonPath) {
+    if (!tree.exists(packageJsonPath)) {
+        return;
+    }
+    const packageJson = JSON.parse(tree.read(packageJsonPath, 'utf-8') ?? '{}');
+    // Only where a strands client is actually declared — that is what pulls the
+    // optional peer. An already-declared express (even a stale range) is left to
+    // addDependenciesToPackageJson, which resolves it onto the catalog.
+    if (!packageJson.dependencies?.[STRANDS_SDK]) {
+        return;
+    }
+    addDependenciesToPackageJson(tree, {
+        [EXPRESS]: TS_VERSIONS[EXPRESS]
+    }, {}, packageJsonPath);
+}
+
+//# sourceMappingURL=migration.js.map

package/src/migrations/latest/pin-strands-express-peer/migration.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../../../../../../../packages/nx-plugin/src/migrations/latest/pin-strands-express-peer/migration.ts"],"sourcesContent":["/**\n * Copyright Amazon.com, Inc. or its affiliates. All Rights Reserved.\n * SPDX-License-Identifier: Apache-2.0\n */\nimport { getProjects, joinPathFragments, type Tree } from '@nx/devkit';\nimport { AGENT_CONNECTION_PROJECT_DIR } from '../../../utils/agent-connection/agent-connection.js';\nimport { addDependenciesToPackageJson } from '../../../utils/dependencies.js';\nimport { formatFilesInSubtree } from '../../../utils/format.js';\nimport { TS_VERSIONS } from '../../../utils/versions.js';\n\nconst EXPRESS = 'express';\nconst STRANDS_SDK = '@strands-agents/sdk';\nconst ROOT_PACKAGE_JSON = 'package.json';\n\n/**\n * `express` is an optional peer of `@strands-agents/sdk` that any importer\n * declaring strands without also declaring express can leave undeclared. pnpm\n * suffixes each installed copy of a package by the versions of its peers, so\n * such an importer can resolve express to a different version than the pin\n * every other strands importer uses — splitting `@strands-agents/sdk` into two\n * peer-suffixed instances of the same version.\n *\n * Anything importing both instances then sees two nominal identities of every\n * SDK type — `Agent`, `McpClient`, `Plugin` — and fails to compile with \"Types\n * have separate declarations of a private property\". Declaring express\n * wherever strands is declared keeps the whole strands subgraph on the\n * catalog's single pin. Mirrors the earlier `@aws-sdk/client-s3` peer fix, one\n * optional peer further on.\n *\n * Detection is generic — every project's `package.json` plus the workspace\n * root, checked for \"declares @strands-agents/sdk but not express\" — rather\n * than listing the generators that currently produce that shape, so a future\n * strands importer this migration predates is still covered. The shared\n * agent-connection project is checked explicitly too, in case its project.json\n * is missing or not yet registered when this runs — `getProjects` would miss\n * it then, same as rc.95's `@aws-sdk/client-s3` migration guarded against.\n */\nexport default async function migration(tree: Tree): Promise<void> {\n  pinIfNeeded(tree, ROOT_PACKAGE_JSON);\n  pinIfNeeded(\n    tree,\n    joinPathFragments(AGENT_CONNECTION_PROJECT_DIR, 'package.json'),\n  );\n\n  for (const project of getProjects(tree).values()) {\n    pinIfNeeded(tree, joinPathFragments(project.root, 'package.json'));\n  }\n\n  await formatFilesInSubtree(tree);\n}\n\n/** Declare express on the given manifest, if it declares strands but not express. */\nfunction pinIfNeeded(tree: Tree, packageJsonPath: string): void {\n  if (!tree.exists(packageJsonPath)) {\n    return;\n  }\n\n  const packageJson = JSON.parse(tree.read(packageJsonPath, 'utf-8') ?? '{}');\n  // Only where a strands client is actually declared — that is what pulls the\n  // optional peer. An already-declared express (even a stale range) is left to\n  // addDependenciesToPackageJson, which resolves it onto the catalog.\n  if (!packageJson.dependencies?.[STRANDS_SDK]) {\n    return;\n  }\n\n  addDependenciesToPackageJson(\n    tree,\n    { [EXPRESS]: TS_VERSIONS[EXPRESS] },\n    {},\n    packageJsonPath,\n  );\n}\n"],"names":["getProjects","joinPathFragments","AGENT_CONNECTION_PROJECT_DIR","addDependenciesToPackageJson","formatFilesInSubtree","TS_VERSIONS","EXPRESS","STRANDS_SDK","ROOT_PACKAGE_JSON","migration","tree","pinIfNeeded","project","values","root","packageJsonPath","exists","packageJson","JSON","parse","read","dependencies"],"mappings":"AAAA;;;CAGC,GACD,SAASA,WAAW,EAAEC,iBAAiB,QAAmB,aAAa;AACvE,SAASC,4BAA4B,QAAQ,sDAAsD;AACnG,SAASC,4BAA4B,QAAQ,iCAAiC;AAC9E,SAASC,oBAAoB,QAAQ,2BAA2B;AAChE,SAASC,WAAW,QAAQ,6BAA6B;AAEzD,MAAMC,UAAU;AAChB,MAAMC,cAAc;AACpB,MAAMC,oBAAoB;AAE1B;;;;;;;;;;;;;;;;;;;;;;CAsBC,GACD,eAAe,eAAeC,UAAUC,IAAU;IAChDC,YAAYD,MAAMF;IAClBG,YACED,MACAT,kBAAkBC,8BAA8B;IAGlD,KAAK,MAAMU,WAAWZ,YAAYU,MAAMG,MAAM,GAAI;QAChDF,YAAYD,MAAMT,kBAAkBW,QAAQE,IAAI,EAAE;IACpD;IAEA,MAAMV,qBAAqBM;AAC7B;AAEA,mFAAmF,GACnF,SAASC,YAAYD,IAAU,EAAEK,eAAuB;IACtD,IAAI,CAACL,KAAKM,MAAM,CAACD,kBAAkB;QACjC;IACF;IAEA,MAAME,cAAcC,KAAKC,KAAK,CAACT,KAAKU,IAAI,CAACL,iBAAiB,YAAY;IACtE,4EAA4E;IAC5E,6EAA6E;IAC7E,oEAAoE;IACpE,IAAI,CAACE,YAAYI,YAAY,EAAE,CAACd,YAAY,EAAE;QAC5C;IACF;IAEAJ,6BACEO,MACA;QAAE,CAACJ,QAAQ,EAAED,WAAW,CAACC,QAAQ;IAAC,GAClC,CAAC,GACDS;AAEJ"}

package/src/migrations/latest/rdb-drop-lambda-rie/metadata.json

@@ -0,0 +1,3 @@
+{
+  "description": "Remove the Lambda Runtime Interface Emulator from vended ts#rdb and py#rdb Dockerfiles so its known HIGH vulnerabilities are not present in the image"
+}

package/src/migrations/latest/rdb-drop-lambda-rie/migration.d.ts

@@ -0,0 +1,6 @@
+/**
+ * Copyright Amazon.com, Inc. or its affiliates. All Rights Reserved.
+ * SPDX-License-Identifier: Apache-2.0
+ */
+import { type MigrationReturnObject, type Tree } from '@nx/devkit';
+export default function migration(tree: Tree): Promise<MigrationReturnObject>;

package/src/migrations/latest/rdb-drop-lambda-rie/migration.js

@@ -0,0 +1,105 @@
+/**
+ * Copyright Amazon.com, Inc. or its affiliates. All Rights Reserved.
+ * SPDX-License-Identifier: Apache-2.0
+ */ import { getProjects, joinPathFragments } from "@nx/devkit";
+import { PY_RDB_GENERATOR_INFO } from "../../../py/rdb/generator.js";
+import { TS_RDB_GENERATOR_INFO } from "../../../ts/rdb/generator.js";
+import { formatFilesInSubtree } from "../../../utils/format.js";
+/**
+ * Remove the Lambda Runtime Interface Emulator (RIE) from the vended ts#rdb
+ * and py#rdb Dockerfiles.
+ *
+ * `/lambda-entrypoint.sh` only invokes RIE when AWS_LAMBDA_RUNTIME_API is
+ * unset, i.e. for local `docker run` emulation outside Lambda — the deployed
+ * function never runs it. Its upstream build lags the Go toolchain, so it
+ * carries known HIGH vulnerabilities (net/http and crypto/tls DoS CVEs) the
+ * image scan flags with no fixed upstream image coming soon. Stripping it
+ * follows the same pattern the templates already use for other unused,
+ * vulnerable parts of the base image (py#rdb removing pip, ts#rdb removing
+ * the runtime's AWS SDK copy). New workspaces get this from the generator
+ * templates; this brings existing ones up to date.
+ *
+ * Only the three Dockerfiles the ts#rdb / py#rdb generators vend are touched,
+ * located from each rdb project's root (recorded in its metadata). Each is
+ * edited in place only where its comment + `RUN microdnf upgrade ...` block
+ * still has the exact shape the generator wrote before this change; one that
+ * has diverged (a customised comment or upgrade command) is left untouched
+ * and reported via `nextSteps`.
+ */ const AWS_LAMBDA_RIE = '/usr/local/bin/aws-lambda-rie';
+/**
+ * The exact comment + `RUN microdnf upgrade ...` block ts#rdb's Dockerfile had
+ * before this migration, and what it becomes.
+ */ const TS_RDB_OLD_UPGRADE = `# Patch OS packages beyond the base image's pinned release, and drop the
+# runtime's convenience copy of the AWS SDK (the handler bundle inlines its
+# own dependencies), keeping the image free of known HIGH/CRITICAL
+# vulnerabilities
+RUN microdnf upgrade -y --releasever latest && microdnf clean all \\
+    && rm -rf /var/runtime/node_modules/@aws-sdk`;
+const TS_RDB_NEW_UPGRADE = `# Patch OS packages beyond the base image's pinned release, and drop the
+# runtime's convenience copy of the AWS SDK (the handler bundle inlines its
+# own dependencies), keeping the image free of known HIGH/CRITICAL
+# vulnerabilities. Also drop the Lambda Runtime Interface Emulator: it is only
+# used for local \`docker run\` emulation outside Lambda, never by the deployed
+# function, and carries known HIGH vulnerabilities.
+RUN microdnf upgrade -y --releasever latest && microdnf clean all \\
+    && rm -rf /var/runtime/node_modules/@aws-sdk ${AWS_LAMBDA_RIE}`;
+/**
+ * The exact comment + `RUN microdnf upgrade ...` block py#rdb's two Dockerfiles
+ * had before this migration, and what it becomes. Both Dockerfile.migration and
+ * Dockerfile.create-db-user share this block verbatim.
+ */ const PY_RDB_OLD_UPGRADE = `# Patch OS packages beyond the base image's pinned release, and drop pip, whose
+# vendored copies of msgpack and setuptools carry known HIGH vulnerabilities.
+# The handler's dependencies are already installed in the image, so nothing
+# installs packages at runtime.
+RUN microdnf upgrade -y --releasever latest && microdnf clean all \\
+    && rm -rf /var/lang/lib/python*/site-packages/pip \\
+    /var/lang/lib/python*/site-packages/pip-*.dist-info`;
+const PY_RDB_NEW_UPGRADE = `# Patch OS packages beyond the base image's pinned release, and drop pip, whose
+# vendored copies of msgpack and setuptools carry known HIGH vulnerabilities.
+# The handler's dependencies are already installed in the image, so nothing
+# installs packages at runtime. Also drop the Lambda Runtime Interface
+# Emulator: it is only used for local \`docker run\` emulation outside Lambda,
+# never by the deployed function, and carries known HIGH vulnerabilities.
+RUN microdnf upgrade -y --releasever latest && microdnf clean all \\
+    && rm -rf /var/lang/lib/python*/site-packages/pip \\
+    /var/lang/lib/python*/site-packages/pip-*.dist-info \\
+    ${AWS_LAMBDA_RIE}`;
+/** The marker checked to detect an already-migrated (or user-added) removal. */ const RIE_REMOVED_MARKER = AWS_LAMBDA_RIE;
+const divergedNextStep = (filePath)=>`${filePath}: its microdnf upgrade command has been customised, so it was left unchanged. Remove the Lambda Runtime Interface Emulator by adding "${AWS_LAMBDA_RIE}" to its "rm -rf" — it is only used for local \`docker run\` emulation outside Lambda and carries known HIGH vulnerabilities.`;
+/**
+ * Replace a Dockerfile's old comment + upgrade block with the new one, only
+ * when the file still has the exact shape the generator wrote. Already
+ * migrated and diverged files are both left alone; the latter is reported via
+ * nextSteps.
+ */ const migrateDockerfile = (tree, filePath, oldBlock, newBlock, nextSteps)=>{
+    if (!tree.exists(filePath)) {
+        return;
+    }
+    const content = tree.read(filePath, 'utf-8') ?? '';
+    if (content.includes(RIE_REMOVED_MARKER)) {
+        return; // Already migrated (or user-added).
+    }
+    if (!content.includes(oldBlock)) {
+        nextSteps.push(divergedNextStep(filePath));
+        return;
+    }
+    tree.write(filePath, content.replace(oldBlock, newBlock));
+};
+export default async function migration(tree) {
+    const nextSteps = [];
+    for (const project of getProjects(tree).values()){
+        const generator = project.metadata?.generator;
+        if (generator === TS_RDB_GENERATOR_INFO.id) {
+            migrateDockerfile(tree, joinPathFragments(project.root, 'Dockerfile'), TS_RDB_OLD_UPGRADE, TS_RDB_NEW_UPGRADE, nextSteps);
+        } else if (generator === PY_RDB_GENERATOR_INFO.id) {
+            migrateDockerfile(tree, joinPathFragments(project.root, 'Dockerfile.migration'), PY_RDB_OLD_UPGRADE, PY_RDB_NEW_UPGRADE, nextSteps);
+            migrateDockerfile(tree, joinPathFragments(project.root, 'Dockerfile.create-db-user'), PY_RDB_OLD_UPGRADE, PY_RDB_NEW_UPGRADE, nextSteps);
+        }
+    }
+    await formatFilesInSubtree(tree);
+    return {
+        nextSteps
+    };
+}
+
+//# sourceMappingURL=migration.js.map

package/src/migrations/latest/rdb-drop-lambda-rie/migration.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../../../../../../../packages/nx-plugin/src/migrations/latest/rdb-drop-lambda-rie/migration.ts"],"sourcesContent":["/**\n * Copyright Amazon.com, Inc. or its affiliates. All Rights Reserved.\n * SPDX-License-Identifier: Apache-2.0\n */\nimport {\n  getProjects,\n  joinPathFragments,\n  type MigrationReturnObject,\n  type Tree,\n} from '@nx/devkit';\nimport { PY_RDB_GENERATOR_INFO } from '../../../py/rdb/generator.js';\nimport { TS_RDB_GENERATOR_INFO } from '../../../ts/rdb/generator.js';\nimport { formatFilesInSubtree } from '../../../utils/format.js';\n\n/**\n * Remove the Lambda Runtime Interface Emulator (RIE) from the vended ts#rdb\n * and py#rdb Dockerfiles.\n *\n * `/lambda-entrypoint.sh` only invokes RIE when AWS_LAMBDA_RUNTIME_API is\n * unset, i.e. for local `docker run` emulation outside Lambda — the deployed\n * function never runs it. Its upstream build lags the Go toolchain, so it\n * carries known HIGH vulnerabilities (net/http and crypto/tls DoS CVEs) the\n * image scan flags with no fixed upstream image coming soon. Stripping it\n * follows the same pattern the templates already use for other unused,\n * vulnerable parts of the base image (py#rdb removing pip, ts#rdb removing\n * the runtime's AWS SDK copy). New workspaces get this from the generator\n * templates; this brings existing ones up to date.\n *\n * Only the three Dockerfiles the ts#rdb / py#rdb generators vend are touched,\n * located from each rdb project's root (recorded in its metadata). Each is\n * edited in place only where its comment + `RUN microdnf upgrade ...` block\n * still has the exact shape the generator wrote before this change; one that\n * has diverged (a customised comment or upgrade command) is left untouched\n * and reported via `nextSteps`.\n */\n\nconst AWS_LAMBDA_RIE = '/usr/local/bin/aws-lambda-rie';\n\n/**\n * The exact comment + `RUN microdnf upgrade ...` block ts#rdb's Dockerfile had\n * before this migration, and what it becomes.\n */\nconst TS_RDB_OLD_UPGRADE = `# Patch OS packages beyond the base image's pinned release, and drop the\n# runtime's convenience copy of the AWS SDK (the handler bundle inlines its\n# own dependencies), keeping the image free of known HIGH/CRITICAL\n# vulnerabilities\nRUN microdnf upgrade -y --releasever latest && microdnf clean all \\\\\n    && rm -rf /var/runtime/node_modules/@aws-sdk`;\nconst TS_RDB_NEW_UPGRADE = `# Patch OS packages beyond the base image's pinned release, and drop the\n# runtime's convenience copy of the AWS SDK (the handler bundle inlines its\n# own dependencies), keeping the image free of known HIGH/CRITICAL\n# vulnerabilities. Also drop the Lambda Runtime Interface Emulator: it is only\n# used for local \\`docker run\\` emulation outside Lambda, never by the deployed\n# function, and carries known HIGH vulnerabilities.\nRUN microdnf upgrade -y --releasever latest && microdnf clean all \\\\\n    && rm -rf /var/runtime/node_modules/@aws-sdk ${AWS_LAMBDA_RIE}`;\n\n/**\n * The exact comment + `RUN microdnf upgrade ...` block py#rdb's two Dockerfiles\n * had before this migration, and what it becomes. Both Dockerfile.migration and\n * Dockerfile.create-db-user share this block verbatim.\n */\nconst PY_RDB_OLD_UPGRADE = `# Patch OS packages beyond the base image's pinned release, and drop pip, whose\n# vendored copies of msgpack and setuptools carry known HIGH vulnerabilities.\n# The handler's dependencies are already installed in the image, so nothing\n# installs packages at runtime.\nRUN microdnf upgrade -y --releasever latest && microdnf clean all \\\\\n    && rm -rf /var/lang/lib/python*/site-packages/pip \\\\\n    /var/lang/lib/python*/site-packages/pip-*.dist-info`;\nconst PY_RDB_NEW_UPGRADE = `# Patch OS packages beyond the base image's pinned release, and drop pip, whose\n# vendored copies of msgpack and setuptools carry known HIGH vulnerabilities.\n# The handler's dependencies are already installed in the image, so nothing\n# installs packages at runtime. Also drop the Lambda Runtime Interface\n# Emulator: it is only used for local \\`docker run\\` emulation outside Lambda,\n# never by the deployed function, and carries known HIGH vulnerabilities.\nRUN microdnf upgrade -y --releasever latest && microdnf clean all \\\\\n    && rm -rf /var/lang/lib/python*/site-packages/pip \\\\\n    /var/lang/lib/python*/site-packages/pip-*.dist-info \\\\\n    ${AWS_LAMBDA_RIE}`;\n\n/** The marker checked to detect an already-migrated (or user-added) removal. */\nconst RIE_REMOVED_MARKER = AWS_LAMBDA_RIE;\n\nconst divergedNextStep = (filePath: string): string =>\n  `${filePath}: its microdnf upgrade command has been customised, so it was left unchanged. Remove the Lambda Runtime Interface Emulator by adding \"${AWS_LAMBDA_RIE}\" to its \"rm -rf\" — it is only used for local \\`docker run\\` emulation outside Lambda and carries known HIGH vulnerabilities.`;\n\n/**\n * Replace a Dockerfile's old comment + upgrade block with the new one, only\n * when the file still has the exact shape the generator wrote. Already\n * migrated and diverged files are both left alone; the latter is reported via\n * nextSteps.\n */\nconst migrateDockerfile = (\n  tree: Tree,\n  filePath: string,\n  oldBlock: string,\n  newBlock: string,\n  nextSteps: string[],\n): void => {\n  if (!tree.exists(filePath)) {\n    return;\n  }\n\n  const content = tree.read(filePath, 'utf-8') ?? '';\n  if (content.includes(RIE_REMOVED_MARKER)) {\n    return; // Already migrated (or user-added).\n  }\n\n  if (!content.includes(oldBlock)) {\n    nextSteps.push(divergedNextStep(filePath));\n    return;\n  }\n\n  tree.write(filePath, content.replace(oldBlock, newBlock));\n};\n\nexport default async function migration(\n  tree: Tree,\n): Promise<MigrationReturnObject> {\n  const nextSteps: string[] = [];\n\n  for (const project of getProjects(tree).values()) {\n    const generator = (project.metadata as { generator?: string } | undefined)\n      ?.generator;\n\n    if (generator === TS_RDB_GENERATOR_INFO.id) {\n      migrateDockerfile(\n        tree,\n        joinPathFragments(project.root, 'Dockerfile'),\n        TS_RDB_OLD_UPGRADE,\n        TS_RDB_NEW_UPGRADE,\n        nextSteps,\n      );\n    } else if (generator === PY_RDB_GENERATOR_INFO.id) {\n      migrateDockerfile(\n        tree,\n        joinPathFragments(project.root, 'Dockerfile.migration'),\n        PY_RDB_OLD_UPGRADE,\n        PY_RDB_NEW_UPGRADE,\n        nextSteps,\n      );\n      migrateDockerfile(\n        tree,\n        joinPathFragments(project.root, 'Dockerfile.create-db-user'),\n        PY_RDB_OLD_UPGRADE,\n        PY_RDB_NEW_UPGRADE,\n        nextSteps,\n      );\n    }\n  }\n\n  await formatFilesInSubtree(tree);\n\n  return { nextSteps };\n}\n"],"names":["getProjects","joinPathFragments","PY_RDB_GENERATOR_INFO","TS_RDB_GENERATOR_INFO","formatFilesInSubtree","AWS_LAMBDA_RIE","TS_RDB_OLD_UPGRADE","TS_RDB_NEW_UPGRADE","PY_RDB_OLD_UPGRADE","PY_RDB_NEW_UPGRADE","RIE_REMOVED_MARKER","divergedNextStep","filePath","migrateDockerfile","tree","oldBlock","newBlock","nextSteps","exists","content","read","includes","push","write","replace","migration","project","values","generator","metadata","id","root"],"mappings":"AAAA;;;CAGC,GACD,SACEA,WAAW,EACXC,iBAAiB,QAGZ,aAAa;AACpB,SAASC,qBAAqB,QAAQ,+BAA+B;AACrE,SAASC,qBAAqB,QAAQ,+BAA+B;AACrE,SAASC,oBAAoB,QAAQ,2BAA2B;AAEhE;;;;;;;;;;;;;;;;;;;;CAoBC,GAED,MAAMC,iBAAiB;AAEvB;;;CAGC,GACD,MAAMC,qBAAqB,CAAC;;;;;gDAKoB,CAAC;AACjD,MAAMC,qBAAqB,CAAC;;;;;;;iDAOqB,EAAEF,gBAAgB;AAEnE;;;;CAIC,GACD,MAAMG,qBAAqB,CAAC;;;;;;uDAM2B,CAAC;AACxD,MAAMC,qBAAqB,CAAC;;;;;;;;;IASxB,EAAEJ,gBAAgB;AAEtB,8EAA8E,GAC9E,MAAMK,qBAAqBL;AAE3B,MAAMM,mBAAmB,CAACC,WACxB,GAAGA,SAAS,sIAAsI,EAAEP,eAAe,6HAA6H,CAAC;AAEnS;;;;;CAKC,GACD,MAAMQ,oBAAoB,CACxBC,MACAF,UACAG,UACAC,UACAC;IAEA,IAAI,CAACH,KAAKI,MAAM,CAACN,WAAW;QAC1B;IACF;IAEA,MAAMO,UAAUL,KAAKM,IAAI,CAACR,UAAU,YAAY;IAChD,IAAIO,QAAQE,QAAQ,CAACX,qBAAqB;QACxC,QAAQ,oCAAoC;IAC9C;IAEA,IAAI,CAACS,QAAQE,QAAQ,CAACN,WAAW;QAC/BE,UAAUK,IAAI,CAACX,iBAAiBC;QAChC;IACF;IAEAE,KAAKS,KAAK,CAACX,UAAUO,QAAQK,OAAO,CAACT,UAAUC;AACjD;AAEA,eAAe,eAAeS,UAC5BX,IAAU;IAEV,MAAMG,YAAsB,EAAE;IAE9B,KAAK,MAAMS,WAAW1B,YAAYc,MAAMa,MAAM,GAAI;QAChD,MAAMC,YAAaF,QAAQG,QAAQ,EAC/BD;QAEJ,IAAIA,cAAczB,sBAAsB2B,EAAE,EAAE;YAC1CjB,kBACEC,MACAb,kBAAkByB,QAAQK,IAAI,EAAE,eAChCzB,oBACAC,oBACAU;QAEJ,OAAO,IAAIW,cAAc1B,sBAAsB4B,EAAE,EAAE;YACjDjB,kBACEC,MACAb,kBAAkByB,QAAQK,IAAI,EAAE,yBAChCvB,oBACAC,oBACAQ;YAEFJ,kBACEC,MACAb,kBAAkByB,QAAQK,IAAI,EAAE,8BAChCvB,oBACAC,oBACAQ;QAEJ;IACF;IAEA,MAAMb,qBAAqBU;IAE3B,OAAO;QAAEG;IAAU;AACrB"}

package/src/py/rdb/__snapshots__/generator.spec.ts.snap

@@ -173,10 +173,13 @@ exports[`py#rdb generator > should generate MySQL dependencies and templates 4`]
 # Patch OS packages beyond the base image's pinned release, and drop pip, whose
 # vendored copies of msgpack and setuptools carry known HIGH vulnerabilities.
 # The handler's dependencies are already installed in the image, so nothing
-# installs packages at runtime.
+# installs packages at runtime. Also drop the Lambda Runtime Interface
+# Emulator: it is only used for local \`docker run\` emulation outside Lambda,
+# never by the deployed function, and carries known HIGH vulnerabilities.
 RUN microdnf upgrade -y --releasever latest && microdnf clean all \\
     && rm -rf /var/lang/lib/python*/site-packages/pip \\
-    /var/lang/lib/python*/site-packages/pip-*.dist-info
+    /var/lang/lib/python*/site-packages/pip-*.dist-info \\
+    /usr/local/bin/aws-lambda-rie
 
 WORKDIR \${LAMBDA_TASK_ROOT}
 
@@ -195,10 +198,13 @@ exports[`py#rdb generator > should generate MySQL dependencies and templates 5`]
 # Patch OS packages beyond the base image's pinned release, and drop pip, whose
 # vendored copies of msgpack and setuptools carry known HIGH vulnerabilities.
 # The handler's dependencies are already installed in the image, so nothing
-# installs packages at runtime.
+# installs packages at runtime. Also drop the Lambda Runtime Interface
+# Emulator: it is only used for local \`docker run\` emulation outside Lambda,
+# never by the deployed function, and carries known HIGH vulnerabilities.
 RUN microdnf upgrade -y --releasever latest && microdnf clean all \\
     && rm -rf /var/lang/lib/python*/site-packages/pip \\
-    /var/lang/lib/python*/site-packages/pip-*.dist-info
+    /var/lang/lib/python*/site-packages/pip-*.dist-info \\
+    /usr/local/bin/aws-lambda-rie
 
 WORKDIR \${LAMBDA_TASK_ROOT}
 
@@ -1393,10 +1399,13 @@ exports[`py#rdb generator > should generate a PostgreSQL SQLModel project with A
 # Patch OS packages beyond the base image's pinned release, and drop pip, whose
 # vendored copies of msgpack and setuptools carry known HIGH vulnerabilities.
 # The handler's dependencies are already installed in the image, so nothing
-# installs packages at runtime.
+# installs packages at runtime. Also drop the Lambda Runtime Interface
+# Emulator: it is only used for local \`docker run\` emulation outside Lambda,
+# never by the deployed function, and carries known HIGH vulnerabilities.
 RUN microdnf upgrade -y --releasever latest && microdnf clean all \\
     && rm -rf /var/lang/lib/python*/site-packages/pip \\
-    /var/lang/lib/python*/site-packages/pip-*.dist-info
+    /var/lang/lib/python*/site-packages/pip-*.dist-info \\
+    /usr/local/bin/aws-lambda-rie
 
 WORKDIR \${LAMBDA_TASK_ROOT}
 
@@ -1415,10 +1424,13 @@ exports[`py#rdb generator > should generate a PostgreSQL SQLModel project with A
 # Patch OS packages beyond the base image's pinned release, and drop pip, whose
 # vendored copies of msgpack and setuptools carry known HIGH vulnerabilities.
 # The handler's dependencies are already installed in the image, so nothing
-# installs packages at runtime.
+# installs packages at runtime. Also drop the Lambda Runtime Interface
+# Emulator: it is only used for local \`docker run\` emulation outside Lambda,
+# never by the deployed function, and carries known HIGH vulnerabilities.
 RUN microdnf upgrade -y --releasever latest && microdnf clean all \\
     && rm -rf /var/lang/lib/python*/site-packages/pip \\
-    /var/lang/lib/python*/site-packages/pip-*.dist-info
+    /var/lang/lib/python*/site-packages/pip-*.dist-info \\
+    /usr/local/bin/aws-lambda-rie
 
 WORKDIR \${LAMBDA_TASK_ROOT}
 

package/src/py/rdb/files/Dockerfile.create-db-user.template

@@ -3,10 +3,13 @@ FROM public.ecr.aws/lambda/python:3.14
 # Patch OS packages beyond the base image's pinned release, and drop pip, whose
 # vendored copies of msgpack and setuptools carry known HIGH vulnerabilities.
 # The handler's dependencies are already installed in the image, so nothing
-# installs packages at runtime.
+# installs packages at runtime. Also drop the Lambda Runtime Interface
+# Emulator: it is only used for local `docker run` emulation outside Lambda,
+# never by the deployed function, and carries known HIGH vulnerabilities.
 RUN microdnf upgrade -y --releasever latest && microdnf clean all \
     && rm -rf /var/lang/lib/python*/site-packages/pip \
-    /var/lang/lib/python*/site-packages/pip-*.dist-info
+    /var/lang/lib/python*/site-packages/pip-*.dist-info \
+    /usr/local/bin/aws-lambda-rie
 
 WORKDIR ${LAMBDA_TASK_ROOT}
 

package/src/py/rdb/files/Dockerfile.migration.template

@@ -3,10 +3,13 @@ FROM public.ecr.aws/lambda/python:3.14
 # Patch OS packages beyond the base image's pinned release, and drop pip, whose
 # vendored copies of msgpack and setuptools carry known HIGH vulnerabilities.
 # The handler's dependencies are already installed in the image, so nothing
-# installs packages at runtime.
+# installs packages at runtime. Also drop the Lambda Runtime Interface
+# Emulator: it is only used for local `docker run` emulation outside Lambda,
+# never by the deployed function, and carries known HIGH vulnerabilities.
 RUN microdnf upgrade -y --releasever latest && microdnf clean all \
     && rm -rf /var/lang/lib/python*/site-packages/pip \
-    /var/lang/lib/python*/site-packages/pip-*.dist-info
+    /var/lang/lib/python*/site-packages/pip-*.dist-info \
+    /usr/local/bin/aws-lambda-rie
 
 WORKDIR ${LAMBDA_TASK_ROOT}
 

package/src/ts/agent/a2a-connection/generator.d.ts

@@ -8,53 +8,49 @@ import type { TsAgentA2aConnectionGeneratorSchema } from './schema';
 export declare const DEPENDENCIES: import("../../../utils/declared-dependencies.js").DependencyDeclaration<readonly [{
     readonly name: "@a2a-js/sdk";
     readonly root: true;
-}, {
-    readonly name: "@strands-agents/sdk";
-    readonly root: true;
-}, {
-    readonly name: "@aws-lambda-powertools/parameters";
-    readonly root: true;
-}, {
-    readonly name: "@aws-sdk/client-appconfigdata";
-    readonly root: true;
-}, {
-    readonly name: "aws4fetch";
-    readonly root: true;
-}, {
-    readonly name: "@aws-sdk/credential-providers";
-    readonly root: true;
-}, {
-    readonly name: "zod";
-    readonly root: true;
-}, {
+}, ...({
+    name: "@aws-sdk/client-s3" | "@strands-agents/sdk" | "express";
+    root: boolean;
+} | ({
     readonly name: "@aws-lambda-powertools/parameters";
 } & {
     versionOnly: true;
-}, {
+}) | ({
     readonly name: "@aws-sdk/credential-providers";
 } & {
     versionOnly: true;
-}, {
+}) | ({
     readonly name: "aws4fetch";
 } & {
     versionOnly: true;
-}, {
+}) | ({
     readonly name: "@modelcontextprotocol/sdk";
 } & {
     versionOnly: true;
-}, {
+}) | ({
     readonly name: "@a2a-js/sdk";
 } & {
     versionOnly: true;
-}, {
-    readonly name: "@strands-agents/sdk";
+}) | ({
+    name: "@aws-sdk/client-s3" | "@strands-agents/sdk" | "express";
 } & {
     versionOnly: true;
-}, {
-    readonly name: "@aws-sdk/client-s3";
-} & {
-    versionOnly: true;
-}], readonly import("../../../utils/declared-dependencies.js").DeclaredPyDependency<"ruff" | "a2a-sdk" | "ag-ui-langgraph" | "ag-ui-protocol" | "ag-ui-strands" | "aiosqlite" | "aws-lambda-powertools" | "aws-lambda-powertools[tracer]" | "aws-lambda-powertools[parser]" | "aws-opentelemetry-distro" | "bedrock-agentcore" | "boto3" | "checkov" | "fastapi" | "fastapi[standard]" | "httpx" | "langchain" | "langchain-aws" | "langchain-mcp-adapters" | "langgraph" | "langgraph-checkpoint-aws" | "langgraph-checkpoint-sqlite" | "mcp" | "pip-check-updates" | "pip-licenses" | "pydantic" | "strands-agents" | "strands-agents[a2a]" | "strands-agents-tools" | "ty" | "pynamodb" | "uvicorn" | "sqlmodel" | "alembic" | "aiomysql" | "asyncpg" | "greenlet", Record<string, never>>[]>;
+}) | {
+    readonly name: "@aws-lambda-powertools/parameters";
+    readonly root: true;
+} | {
+    readonly name: "@aws-sdk/client-appconfigdata";
+    readonly root: true;
+} | {
+    readonly name: "aws4fetch";
+    readonly root: true;
+} | {
+    readonly name: "@aws-sdk/credential-providers";
+    readonly root: true;
+} | {
+    readonly name: "zod";
+    readonly root: true;
+})[]], readonly import("../../../utils/declared-dependencies.js").DeclaredPyDependency<"ruff" | "a2a-sdk" | "ag-ui-langgraph" | "ag-ui-protocol" | "ag-ui-strands" | "aiosqlite" | "aws-lambda-powertools" | "aws-lambda-powertools[tracer]" | "aws-lambda-powertools[parser]" | "aws-opentelemetry-distro" | "bedrock-agentcore" | "boto3" | "checkov" | "fastapi" | "fastapi[standard]" | "httpx" | "langchain" | "langchain-aws" | "langchain-mcp-adapters" | "langgraph" | "langgraph-checkpoint-aws" | "langgraph-checkpoint-sqlite" | "mcp" | "pip-check-updates" | "pip-licenses" | "pydantic" | "strands-agents" | "strands-agents[a2a]" | "strands-agents-tools" | "ty" | "pynamodb" | "uvicorn" | "sqlmodel" | "alembic" | "aiomysql" | "asyncpg" | "greenlet", Record<string, never>>[]>;
 export declare const TS_AGENT_A2A_CONNECTION_GENERATOR_INFO: NxGeneratorInfo;
 export declare const tsAgentA2aConnectionGenerator: (tree: Tree, options: TsAgentA2aConnectionGeneratorSchema) => Promise<GeneratorCallback>;
 export default tsAgentA2aConnectionGenerator;

package/src/ts/agent/a2a-connection/generator.js

@@ -3,7 +3,7 @@
  * SPDX-License-Identifier: Apache-2.0
  */ import { generateFiles, joinPathFragments, OverwriteStrategy, updateProjectConfiguration } from "@nx/devkit";
 import { addTsDependencies } from "../../../utils/add-dependencies.js";
-import { AGENT_CONNECTION_DEPENDENCIES, AGENT_CONNECTION_PROJECT_DIR, addTypeScriptCoreClient, ensureTypeScriptAgentConnectionProject } from "../../../utils/agent-connection/agent-connection.js";
+import { AGENT_CONNECTION_DEPENDENCIES, AGENT_CONNECTION_PROJECT_DIR, addTypeScriptCoreClient, ensureTypeScriptAgentConnectionProject, STRANDS_PEER_DEPENDENCY_NAMES } from "../../../utils/agent-connection/agent-connection.js";
 import { addDestructuredImport, addStarExport, appendToArrayViaGritQL, applyGritQL } from "../../../utils/ast.js";
 import { declareDependencies, ownedElsewhere } from "../../../utils/declared-dependencies.js";
 import { formatFilesInSubtree } from "../../../utils/format.js";
@@ -25,10 +25,14 @@ export const DEPENDENCIES = declareDependencies()({
             name: '@a2a-js/sdk',
             root: true
         },
-        {
-            name: '@strands-agents/sdk',
-            root: true
-        },
+        // @strands-agents/sdk and its peers (STRANDS_PEER_DEPENDENCY_NAMES),
+        // pinned at the root so the root strands copy resolves the same peers as
+        // every other importer (see agent-connection.ts's TS_TEMPLATE_DEPS for
+        // the same reasoning).
+        ...STRANDS_PEER_DEPENDENCY_NAMES.map((name)=>({
+                name,
+                root: true
+            })),
         {
             name: '@aws-lambda-powertools/parameters',
             root: true

package/src/ts/agent/a2a-connection/generator.js.map

@@ -1 +1 @@
-{"version":3,"sources":["../../../../../../../packages/nx-plugin/src/ts/agent/a2a-connection/generator.ts"],"sourcesContent":["/**\n * Copyright Amazon.com, Inc. or its affiliates. All Rights Reserved.\n * SPDX-License-Identifier: Apache-2.0\n */\nimport {\n  type GeneratorCallback,\n  generateFiles,\n  joinPathFragments,\n  OverwriteStrategy,\n  type Tree,\n  updateProjectConfiguration,\n} from '@nx/devkit';\nimport { addTsDependencies } from '../../../utils/add-dependencies.js';\nimport {\n  AGENT_CONNECTION_DEPENDENCIES,\n  AGENT_CONNECTION_PROJECT_DIR,\n  addTypeScriptCoreClient,\n  ensureTypeScriptAgentConnectionProject,\n} from '../../../utils/agent-connection/agent-connection.js';\nimport {\n  addDestructuredImport,\n  addStarExport,\n  appendToArrayViaGritQL,\n  applyGritQL,\n} from '../../../utils/ast.js';\nimport {\n  declareDependencies,\n  ownedElsewhere,\n} from '../../../utils/declared-dependencies.js';\nimport { formatFilesInSubtree } from '../../../utils/format.js';\nimport { installDependencies } from '../../../utils/install.js';\nimport { addGeneratorMetricsIfApplicable } from '../../../utils/metrics.js';\nimport { esmVars } from '../../../utils/module-format.js';\nimport { kebabCase } from '../../../utils/names.js';\nimport { getNpmScope } from '../../../utils/npm-scope.js';\nimport {\n  addComponentGeneratorMetadata,\n  addDependencyToTargetIfNotPresent,\n  getGeneratorInfo,\n  type NxGeneratorInfo,\n  readProjectConfigurationUnqualified,\n} from '../../../utils/nx.js';\nimport { toProjectRelativePath } from '../../../utils/paths.js';\nimport type { TsAgentA2aConnectionGeneratorSchema } from './schema';\n\n// The A2A core client + vended client need these whatever the connection's\n// options, so no entry is conditional.\n// The A2A client the generated agent code imports, plus the AppConfig lookup and\n// sigv4 signing it resolves the remote agent with. Added to the workspace root,\n// where this connection has always put them.\nexport const DEPENDENCIES = declareDependencies()({\n  ts: [\n    { name: '@a2a-js/sdk', root: true },\n    { name: '@strands-agents/sdk', root: true },\n    { name: '@aws-lambda-powertools/parameters', root: true },\n    { name: '@aws-sdk/client-appconfigdata', root: true },\n    { name: 'aws4fetch', root: true },\n    { name: '@aws-sdk/credential-providers', root: true },\n    { name: 'zod', root: true },\n    ...ownedElsewhere(AGENT_CONNECTION_DEPENDENCIES),\n  ],\n});\n\nexport const TS_AGENT_A2A_CONNECTION_GENERATOR_INFO: NxGeneratorInfo =\n  getGeneratorInfo(import.meta.filename);\n\nexport const tsAgentA2aConnectionGenerator = async (\n  tree: Tree,\n  options: TsAgentA2aConnectionGeneratorSchema,\n): Promise<GeneratorCallback> => {\n  const sourceProject = readProjectConfigurationUnqualified(\n    tree,\n    options.sourceProject,\n  );\n  const targetProject = readProjectConfigurationUnqualified(\n    tree,\n    options.targetProject,\n  );\n\n  const agentComponent = options.sourceComponent;\n  const targetAgentComponent = options.targetComponent;\n\n  if (!agentComponent || !targetAgentComponent) {\n    throw new Error(\n      'Both sourceComponent and targetComponent must be provided for ts#agent -> a2a connections',\n    );\n  }\n\n  if ((targetAgentComponent.protocol ?? '').toLowerCase() !== 'a2a') {\n    throw new Error(\n      `Target agent '${targetAgentComponent.name}' uses the ${targetAgentComponent.protocol ?? 'http'} protocol — only A2A agents can be connected as tools.`,\n    );\n  }\n\n  if (\n    targetAgentComponent.auth &&\n    targetAgentComponent.auth.toLowerCase() !== 'iam'\n  ) {\n    throw new Error(\n      `A2A agent connection currently only supports IAM authentication, but '${targetAgentComponent.name}' uses '${targetAgentComponent.auth}' authentication.`,\n    );\n  }\n\n  const targetAgentComponentName = targetAgentComponent.name ?? 'agent';\n  const targetAgentClassName = targetAgentComponent.rc as string;\n  const targetAgentKebabCase = kebabCase(targetAgentClassName);\n  const targetAgentPort = targetAgentComponent.port ?? 9000;\n\n  const npmScope = getNpmScope(tree);\n\n  // 1. Ensure the shared agent-connection project exists + has the A2A core client\n  await ensureTypeScriptAgentConnectionProject(tree, DEPENDENCIES);\n  await addTypeScriptCoreClient(tree, 'a2a', DEPENDENCIES);\n\n  // 2. Generate the per-connection <Name>Client into app/\n  generateFiles(\n    tree,\n    joinPathFragments(import.meta.dirname, 'files', 'agent-connection', 'app'),\n    joinPathFragments(AGENT_CONNECTION_PROJECT_DIR, 'src', 'app'),\n    {\n      targetAgentKebabCase,\n      targetAgentClassName,\n      targetAgentPort,\n      ...esmVars(tree),\n    },\n    { overwriteStrategy: OverwriteStrategy.KeepExisting },\n  );\n\n  // Add re-export to index.ts\n  await addStarExport(\n    tree,\n    joinPathFragments(AGENT_CONNECTION_PROJECT_DIR, 'src', 'index.ts'),\n    `./app/${targetAgentKebabCase}-client-strands.js`,\n  );\n\n  // 3. AST transform agent.ts to add the remote A2A agent as a tool\n  const agentSourceDir = joinPathFragments(\n    sourceProject.root,\n    agentComponent.path ?? 'src',\n  );\n  const agentFilePath = joinPathFragments(agentSourceDir, 'agent.ts');\n\n  if (tree.exists(agentFilePath)) {\n    const clientClassName = `${targetAgentClassName}ClientStrands`;\n    const clientVarName =\n      targetAgentClassName.charAt(0).toLowerCase() +\n      targetAgentClassName.slice(1);\n    const toolName = `ask${targetAgentClassName}`;\n    const toolVarName = `${clientVarName}Tool`;\n\n    // Ensure tool + z imports are available\n    await addDestructuredImport(\n      tree,\n      agentFilePath,\n      ['tool'],\n      '@strands-agents/sdk',\n    );\n    await addDestructuredImport(tree, agentFilePath, ['z'], 'zod');\n    await addDestructuredImport(\n      tree,\n      agentFilePath,\n      [clientClassName],\n      `@${npmScope}/agent-connection`,\n    );\n\n    // Build the tool creation + Agent wiring.\n    const toolCreationBlock = `const ${clientVarName} = await ${clientClassName}.create();\n  const ${toolVarName} = tool({\n    name: '${toolName}',\n    description: 'Delegate a question to the remote ${targetAgentClassName} A2A agent and return its reply.',\n    inputSchema: z.object({ prompt: z.string() }),\n    callback: async ({ prompt }) => (await ${clientVarName}.invoke(prompt)).toString(),\n  });`;\n\n    // Transform the arrow function that contains `new Agent`:\n    // - Expression body: wrap in block with tool creation and return\n    // - Block body: prepend tool creation statement\n    await applyGritQL(\n      tree,\n      agentFilePath,\n      `or { \\`async ($p) => new Agent($args)\\` => raw\\`async ($p) => {\n  ${toolCreationBlock}\n  return new Agent($args);\n}\\` where { $program <: not contains \\`${clientClassName}.create\\` }, \\`async ($p) => { $body }\\` => raw\\`async ($p) => {\n  ${toolCreationBlock}\n  $body\n}\\` where { $body <: contains \\`new Agent($_)\\`, $program <: not contains \\`${clientClassName}.create\\` } }`,\n    );\n\n    // Append the tool to the tools array (after existing items)\n    await appendToArrayViaGritQL(tree, agentFilePath, 'tools:', toolVarName, {\n      scope: 'new Agent($_)',\n    });\n  }\n\n  // 4. Set up dev target — depend on the target agent's dev\n  //    so running the host's dev also spins up the remote A2A agent.\n  const agentName = agentComponent.name ?? 'agent';\n  const devTargetName = `${agentName}-dev`;\n  const targetDevTargetName = `${targetAgentComponentName}-dev`;\n\n  if (sourceProject.targets?.[devTargetName]) {\n    addDependencyToTargetIfNotPresent(sourceProject, devTargetName, {\n      projects: [targetProject.name],\n      target: targetDevTargetName,\n    });\n    updateProjectConfiguration(tree, sourceProject.name, sourceProject);\n  }\n\n  // 5. Add dependencies to the workspace root manifest\n  addTsDependencies(tree, DEPENDENCIES);\n\n  // Recorded so the version sync knows this connection's dependencies are ours.\n  addComponentGeneratorMetadata(\n    tree,\n    sourceProject.name,\n    TS_AGENT_A2A_CONNECTION_GENERATOR_INFO,\n    toProjectRelativePath(sourceProject, agentFilePath),\n    targetAgentClassName,\n    // The source component this connection is made from, so the pair is\n    // identifiable rather than just the two projects.\n    { sourcePath: options.sourceComponent?.path },\n  );\n\n  await addGeneratorMetricsIfApplicable(tree, [\n    TS_AGENT_A2A_CONNECTION_GENERATOR_INFO,\n  ]);\n\n  await formatFilesInSubtree(tree);\n  return () =>\n    installDependencies(tree, options.preferInstallDependencies, {\n      languages: ['typescript'],\n    });\n};\n\nexport default tsAgentA2aConnectionGenerator;\n"],"names":["generateFiles","joinPathFragments","OverwriteStrategy","updateProjectConfiguration","addTsDependencies","AGENT_CONNECTION_DEPENDENCIES","AGENT_CONNECTION_PROJECT_DIR","addTypeScriptCoreClient","ensureTypeScriptAgentConnectionProject","addDestructuredImport","addStarExport","appendToArrayViaGritQL","applyGritQL","declareDependencies","ownedElsewhere","formatFilesInSubtree","installDependencies","addGeneratorMetricsIfApplicable","esmVars","kebabCase","getNpmScope","addComponentGeneratorMetadata","addDependencyToTargetIfNotPresent","getGeneratorInfo","readProjectConfigurationUnqualified","toProjectRelativePath","DEPENDENCIES","ts","name","root","TS_AGENT_A2A_CONNECTION_GENERATOR_INFO","filename","tsAgentA2aConnectionGenerator","tree","options","sourceProject","targetProject","agentComponent","sourceComponent","targetAgentComponent","targetComponent","Error","protocol","toLowerCase","auth","targetAgentComponentName","targetAgentClassName","rc","targetAgentKebabCase","targetAgentPort","port","npmScope","dirname","overwriteStrategy","KeepExisting","agentSourceDir","path","agentFilePath","exists","clientClassName","clientVarName","charAt","slice","toolName","toolVarName","toolCreationBlock","scope","agentName","devTargetName","targetDevTargetName","targets","projects","target","sourcePath","preferInstallDependencies","languages"],"mappings":"AAAA;;;CAGC,GACD,SAEEA,aAAa,EACbC,iBAAiB,EACjBC,iBAAiB,EAEjBC,0BAA0B,QACrB,aAAa;AACpB,SAASC,iBAAiB,QAAQ,qCAAqC;AACvE,SACEC,6BAA6B,EAC7BC,4BAA4B,EAC5BC,uBAAuB,EACvBC,sCAAsC,QACjC,sDAAsD;AAC7D,SACEC,qBAAqB,EACrBC,aAAa,EACbC,sBAAsB,EACtBC,WAAW,QACN,wBAAwB;AAC/B,SACEC,mBAAmB,EACnBC,cAAc,QACT,0CAA0C;AACjD,SAASC,oBAAoB,QAAQ,2BAA2B;AAChE,SAASC,mBAAmB,QAAQ,4BAA4B;AAChE,SAASC,+BAA+B,QAAQ,4BAA4B;AAC5E,SAASC,OAAO,QAAQ,kCAAkC;AAC1D,SAASC,SAAS,QAAQ,0BAA0B;AACpD,SAASC,WAAW,QAAQ,8BAA8B;AAC1D,SACEC,6BAA6B,EAC7BC,iCAAiC,EACjCC,gBAAgB,EAEhBC,mCAAmC,QAC9B,uBAAuB;AAC9B,SAASC,qBAAqB,QAAQ,0BAA0B;AAGhE,2EAA2E;AAC3E,uCAAuC;AACvC,iFAAiF;AACjF,gFAAgF;AAChF,6CAA6C;AAC7C,OAAO,MAAMC,eAAeb,sBAAsB;IAChDc,IAAI;QACF;YAAEC,MAAM;YAAeC,MAAM;QAAK;QAClC;YAAED,MAAM;YAAuBC,MAAM;QAAK;QAC1C;YAAED,MAAM;YAAqCC,MAAM;QAAK;QACxD;YAAED,MAAM;YAAiCC,MAAM;QAAK;QACpD;YAAED,MAAM;YAAaC,MAAM;QAAK;QAChC;YAAED,MAAM;YAAiCC,MAAM;QAAK;QACpD;YAAED,MAAM;YAAOC,MAAM;QAAK;WACvBf,eAAeT;KACnB;AACH,GAAG;AAEH,OAAO,MAAMyB,yCACXP,iBAAiB,YAAYQ,QAAQ,EAAE;AAEzC,OAAO,MAAMC,gCAAgC,OAC3CC,MACAC;IAEA,MAAMC,gBAAgBX,oCACpBS,MACAC,QAAQC,aAAa;IAEvB,MAAMC,gBAAgBZ,oCACpBS,MACAC,QAAQE,aAAa;IAGvB,MAAMC,iBAAiBH,QAAQI,eAAe;IAC9C,MAAMC,uBAAuBL,QAAQM,eAAe;IAEpD,IAAI,CAACH,kBAAkB,CAACE,sBAAsB;QAC5C,MAAM,IAAIE,MACR;IAEJ;IAEA,IAAI,AAACF,CAAAA,qBAAqBG,QAAQ,IAAI,EAAC,EAAGC,WAAW,OAAO,OAAO;QACjE,MAAM,IAAIF,MACR,CAAC,cAAc,EAAEF,qBAAqBX,IAAI,CAAC,WAAW,EAAEW,qBAAqBG,QAAQ,IAAI,OAAO,sDAAsD,CAAC;IAE3J;IAEA,IACEH,qBAAqBK,IAAI,IACzBL,qBAAqBK,IAAI,CAACD,WAAW,OAAO,OAC5C;QACA,MAAM,IAAIF,MACR,CAAC,sEAAsE,EAAEF,qBAAqBX,IAAI,CAAC,QAAQ,EAAEW,qBAAqBK,IAAI,CAAC,iBAAiB,CAAC;IAE7J;IAEA,MAAMC,2BAA2BN,qBAAqBX,IAAI,IAAI;IAC9D,MAAMkB,uBAAuBP,qBAAqBQ,EAAE;IACpD,MAAMC,uBAAuB7B,UAAU2B;IACvC,MAAMG,kBAAkBV,qBAAqBW,IAAI,IAAI;IAErD,MAAMC,WAAW/B,YAAYa;IAE7B,iFAAiF;IACjF,MAAMzB,uCAAuCyB,MAAMP;IACnD,MAAMnB,wBAAwB0B,MAAM,OAAOP;IAE3C,wDAAwD;IACxD1B,cACEiC,MACAhC,kBAAkB,YAAYmD,OAAO,EAAE,SAAS,oBAAoB,QACpEnD,kBAAkBK,8BAA8B,OAAO,QACvD;QACE0C;QACAF;QACAG;QACA,GAAG/B,QAAQe,KAAK;IAClB,GACA;QAAEoB,mBAAmBnD,kBAAkBoD,YAAY;IAAC;IAGtD,4BAA4B;IAC5B,MAAM5C,cACJuB,MACAhC,kBAAkBK,8BAA8B,OAAO,aACvD,CAAC,MAAM,EAAE0C,qBAAqB,kBAAkB,CAAC;IAGnD,kEAAkE;IAClE,MAAMO,iBAAiBtD,kBACrBkC,cAAcN,IAAI,EAClBQ,eAAemB,IAAI,IAAI;IAEzB,MAAMC,gBAAgBxD,kBAAkBsD,gBAAgB;IAExD,IAAItB,KAAKyB,MAAM,CAACD,gBAAgB;QAC9B,MAAME,kBAAkB,GAAGb,qBAAqB,aAAa,CAAC;QAC9D,MAAMc,gBACJd,qBAAqBe,MAAM,CAAC,GAAGlB,WAAW,KAC1CG,qBAAqBgB,KAAK,CAAC;QAC7B,MAAMC,WAAW,CAAC,GAAG,EAAEjB,sBAAsB;QAC7C,MAAMkB,cAAc,GAAGJ,cAAc,IAAI,CAAC;QAE1C,wCAAwC;QACxC,MAAMnD,sBACJwB,MACAwB,eACA;YAAC;SAAO,EACR;QAEF,MAAMhD,sBAAsBwB,MAAMwB,eAAe;YAAC;SAAI,EAAE;QACxD,MAAMhD,sBACJwB,MACAwB,eACA;YAACE;SAAgB,EACjB,CAAC,CAAC,EAAER,SAAS,iBAAiB,CAAC;QAGjC,0CAA0C;QAC1C,MAAMc,oBAAoB,CAAC,MAAM,EAAEL,cAAc,SAAS,EAAED,gBAAgB;QACxE,EAAEK,YAAY;WACX,EAAED,SAAS;oDAC8B,EAAEjB,qBAAqB;;2CAEhC,EAAEc,cAAc;KACtD,CAAC;QAEF,0DAA0D;QAC1D,iEAAiE;QACjE,gDAAgD;QAChD,MAAMhD,YACJqB,MACAwB,eACA,CAAC;EACL,EAAEQ,kBAAkB;;uCAEiB,EAAEN,gBAAgB;EACvD,EAAEM,kBAAkB;;4EAEsD,EAAEN,gBAAgB,aAAa,CAAC;QAGxG,4DAA4D;QAC5D,MAAMhD,uBAAuBsB,MAAMwB,eAAe,UAAUO,aAAa;YACvEE,OAAO;QACT;IACF;IAEA,0DAA0D;IAC1D,mEAAmE;IACnE,MAAMC,YAAY9B,eAAeT,IAAI,IAAI;IACzC,MAAMwC,gBAAgB,GAAGD,UAAU,IAAI,CAAC;IACxC,MAAME,sBAAsB,GAAGxB,yBAAyB,IAAI,CAAC;IAE7D,IAAIV,cAAcmC,OAAO,EAAE,CAACF,cAAc,EAAE;QAC1C9C,kCAAkCa,eAAeiC,eAAe;YAC9DG,UAAU;gBAACnC,cAAcR,IAAI;aAAC;YAC9B4C,QAAQH;QACV;QACAlE,2BAA2B8B,MAAME,cAAcP,IAAI,EAAEO;IACvD;IAEA,qDAAqD;IACrD/B,kBAAkB6B,MAAMP;IAExB,8EAA8E;IAC9EL,8BACEY,MACAE,cAAcP,IAAI,EAClBE,wCACAL,sBAAsBU,eAAesB,gBACrCX,sBACA,oEAAoE;IACpE,kDAAkD;IAClD;QAAE2B,YAAYvC,QAAQI,eAAe,EAAEkB;IAAK;IAG9C,MAAMvC,gCAAgCgB,MAAM;QAC1CH;KACD;IAED,MAAMf,qBAAqBkB;IAC3B,OAAO,IACLjB,oBAAoBiB,MAAMC,QAAQwC,yBAAyB,EAAE;YAC3DC,WAAW;gBAAC;aAAa;QAC3B;AACJ,EAAE;AAEF,eAAe3C,8BAA8B"}
+{"version":3,"sources":["../../../../../../../packages/nx-plugin/src/ts/agent/a2a-connection/generator.ts"],"sourcesContent":["/**\n * Copyright Amazon.com, Inc. or its affiliates. All Rights Reserved.\n * SPDX-License-Identifier: Apache-2.0\n */\nimport {\n  type GeneratorCallback,\n  generateFiles,\n  joinPathFragments,\n  OverwriteStrategy,\n  type Tree,\n  updateProjectConfiguration,\n} from '@nx/devkit';\nimport { addTsDependencies } from '../../../utils/add-dependencies.js';\nimport {\n  AGENT_CONNECTION_DEPENDENCIES,\n  AGENT_CONNECTION_PROJECT_DIR,\n  addTypeScriptCoreClient,\n  ensureTypeScriptAgentConnectionProject,\n  STRANDS_PEER_DEPENDENCY_NAMES,\n} from '../../../utils/agent-connection/agent-connection.js';\nimport {\n  addDestructuredImport,\n  addStarExport,\n  appendToArrayViaGritQL,\n  applyGritQL,\n} from '../../../utils/ast.js';\nimport {\n  declareDependencies,\n  ownedElsewhere,\n} from '../../../utils/declared-dependencies.js';\nimport { formatFilesInSubtree } from '../../../utils/format.js';\nimport { installDependencies } from '../../../utils/install.js';\nimport { addGeneratorMetricsIfApplicable } from '../../../utils/metrics.js';\nimport { esmVars } from '../../../utils/module-format.js';\nimport { kebabCase } from '../../../utils/names.js';\nimport { getNpmScope } from '../../../utils/npm-scope.js';\nimport {\n  addComponentGeneratorMetadata,\n  addDependencyToTargetIfNotPresent,\n  getGeneratorInfo,\n  type NxGeneratorInfo,\n  readProjectConfigurationUnqualified,\n} from '../../../utils/nx.js';\nimport { toProjectRelativePath } from '../../../utils/paths.js';\nimport type { TsAgentA2aConnectionGeneratorSchema } from './schema';\n\n// The A2A core client + vended client need these whatever the connection's\n// options, so no entry is conditional.\n// The A2A client the generated agent code imports, plus the AppConfig lookup and\n// sigv4 signing it resolves the remote agent with. Added to the workspace root,\n// where this connection has always put them.\nexport const DEPENDENCIES = declareDependencies()({\n  ts: [\n    { name: '@a2a-js/sdk', root: true },\n    // @strands-agents/sdk and its peers (STRANDS_PEER_DEPENDENCY_NAMES),\n    // pinned at the root so the root strands copy resolves the same peers as\n    // every other importer (see agent-connection.ts's TS_TEMPLATE_DEPS for\n    // the same reasoning).\n    ...STRANDS_PEER_DEPENDENCY_NAMES.map((name) => ({ name, root: true })),\n    { name: '@aws-lambda-powertools/parameters', root: true },\n    { name: '@aws-sdk/client-appconfigdata', root: true },\n    { name: 'aws4fetch', root: true },\n    { name: '@aws-sdk/credential-providers', root: true },\n    { name: 'zod', root: true },\n    ...ownedElsewhere(AGENT_CONNECTION_DEPENDENCIES),\n  ],\n});\n\nexport const TS_AGENT_A2A_CONNECTION_GENERATOR_INFO: NxGeneratorInfo =\n  getGeneratorInfo(import.meta.filename);\n\nexport const tsAgentA2aConnectionGenerator = async (\n  tree: Tree,\n  options: TsAgentA2aConnectionGeneratorSchema,\n): Promise<GeneratorCallback> => {\n  const sourceProject = readProjectConfigurationUnqualified(\n    tree,\n    options.sourceProject,\n  );\n  const targetProject = readProjectConfigurationUnqualified(\n    tree,\n    options.targetProject,\n  );\n\n  const agentComponent = options.sourceComponent;\n  const targetAgentComponent = options.targetComponent;\n\n  if (!agentComponent || !targetAgentComponent) {\n    throw new Error(\n      'Both sourceComponent and targetComponent must be provided for ts#agent -> a2a connections',\n    );\n  }\n\n  if ((targetAgentComponent.protocol ?? '').toLowerCase() !== 'a2a') {\n    throw new Error(\n      `Target agent '${targetAgentComponent.name}' uses the ${targetAgentComponent.protocol ?? 'http'} protocol — only A2A agents can be connected as tools.`,\n    );\n  }\n\n  if (\n    targetAgentComponent.auth &&\n    targetAgentComponent.auth.toLowerCase() !== 'iam'\n  ) {\n    throw new Error(\n      `A2A agent connection currently only supports IAM authentication, but '${targetAgentComponent.name}' uses '${targetAgentComponent.auth}' authentication.`,\n    );\n  }\n\n  const targetAgentComponentName = targetAgentComponent.name ?? 'agent';\n  const targetAgentClassName = targetAgentComponent.rc as string;\n  const targetAgentKebabCase = kebabCase(targetAgentClassName);\n  const targetAgentPort = targetAgentComponent.port ?? 9000;\n\n  const npmScope = getNpmScope(tree);\n\n  // 1. Ensure the shared agent-connection project exists + has the A2A core client\n  await ensureTypeScriptAgentConnectionProject(tree, DEPENDENCIES);\n  await addTypeScriptCoreClient(tree, 'a2a', DEPENDENCIES);\n\n  // 2. Generate the per-connection <Name>Client into app/\n  generateFiles(\n    tree,\n    joinPathFragments(import.meta.dirname, 'files', 'agent-connection', 'app'),\n    joinPathFragments(AGENT_CONNECTION_PROJECT_DIR, 'src', 'app'),\n    {\n      targetAgentKebabCase,\n      targetAgentClassName,\n      targetAgentPort,\n      ...esmVars(tree),\n    },\n    { overwriteStrategy: OverwriteStrategy.KeepExisting },\n  );\n\n  // Add re-export to index.ts\n  await addStarExport(\n    tree,\n    joinPathFragments(AGENT_CONNECTION_PROJECT_DIR, 'src', 'index.ts'),\n    `./app/${targetAgentKebabCase}-client-strands.js`,\n  );\n\n  // 3. AST transform agent.ts to add the remote A2A agent as a tool\n  const agentSourceDir = joinPathFragments(\n    sourceProject.root,\n    agentComponent.path ?? 'src',\n  );\n  const agentFilePath = joinPathFragments(agentSourceDir, 'agent.ts');\n\n  if (tree.exists(agentFilePath)) {\n    const clientClassName = `${targetAgentClassName}ClientStrands`;\n    const clientVarName =\n      targetAgentClassName.charAt(0).toLowerCase() +\n      targetAgentClassName.slice(1);\n    const toolName = `ask${targetAgentClassName}`;\n    const toolVarName = `${clientVarName}Tool`;\n\n    // Ensure tool + z imports are available\n    await addDestructuredImport(\n      tree,\n      agentFilePath,\n      ['tool'],\n      '@strands-agents/sdk',\n    );\n    await addDestructuredImport(tree, agentFilePath, ['z'], 'zod');\n    await addDestructuredImport(\n      tree,\n      agentFilePath,\n      [clientClassName],\n      `@${npmScope}/agent-connection`,\n    );\n\n    // Build the tool creation + Agent wiring.\n    const toolCreationBlock = `const ${clientVarName} = await ${clientClassName}.create();\n  const ${toolVarName} = tool({\n    name: '${toolName}',\n    description: 'Delegate a question to the remote ${targetAgentClassName} A2A agent and return its reply.',\n    inputSchema: z.object({ prompt: z.string() }),\n    callback: async ({ prompt }) => (await ${clientVarName}.invoke(prompt)).toString(),\n  });`;\n\n    // Transform the arrow function that contains `new Agent`:\n    // - Expression body: wrap in block with tool creation and return\n    // - Block body: prepend tool creation statement\n    await applyGritQL(\n      tree,\n      agentFilePath,\n      `or { \\`async ($p) => new Agent($args)\\` => raw\\`async ($p) => {\n  ${toolCreationBlock}\n  return new Agent($args);\n}\\` where { $program <: not contains \\`${clientClassName}.create\\` }, \\`async ($p) => { $body }\\` => raw\\`async ($p) => {\n  ${toolCreationBlock}\n  $body\n}\\` where { $body <: contains \\`new Agent($_)\\`, $program <: not contains \\`${clientClassName}.create\\` } }`,\n    );\n\n    // Append the tool to the tools array (after existing items)\n    await appendToArrayViaGritQL(tree, agentFilePath, 'tools:', toolVarName, {\n      scope: 'new Agent($_)',\n    });\n  }\n\n  // 4. Set up dev target — depend on the target agent's dev\n  //    so running the host's dev also spins up the remote A2A agent.\n  const agentName = agentComponent.name ?? 'agent';\n  const devTargetName = `${agentName}-dev`;\n  const targetDevTargetName = `${targetAgentComponentName}-dev`;\n\n  if (sourceProject.targets?.[devTargetName]) {\n    addDependencyToTargetIfNotPresent(sourceProject, devTargetName, {\n      projects: [targetProject.name],\n      target: targetDevTargetName,\n    });\n    updateProjectConfiguration(tree, sourceProject.name, sourceProject);\n  }\n\n  // 5. Add dependencies to the workspace root manifest\n  addTsDependencies(tree, DEPENDENCIES);\n\n  // Recorded so the version sync knows this connection's dependencies are ours.\n  addComponentGeneratorMetadata(\n    tree,\n    sourceProject.name,\n    TS_AGENT_A2A_CONNECTION_GENERATOR_INFO,\n    toProjectRelativePath(sourceProject, agentFilePath),\n    targetAgentClassName,\n    // The source component this connection is made from, so the pair is\n    // identifiable rather than just the two projects.\n    { sourcePath: options.sourceComponent?.path },\n  );\n\n  await addGeneratorMetricsIfApplicable(tree, [\n    TS_AGENT_A2A_CONNECTION_GENERATOR_INFO,\n  ]);\n\n  await formatFilesInSubtree(tree);\n  return () =>\n    installDependencies(tree, options.preferInstallDependencies, {\n      languages: ['typescript'],\n    });\n};\n\nexport default tsAgentA2aConnectionGenerator;\n"],"names":["generateFiles","joinPathFragments","OverwriteStrategy","updateProjectConfiguration","addTsDependencies","AGENT_CONNECTION_DEPENDENCIES","AGENT_CONNECTION_PROJECT_DIR","addTypeScriptCoreClient","ensureTypeScriptAgentConnectionProject","STRANDS_PEER_DEPENDENCY_NAMES","addDestructuredImport","addStarExport","appendToArrayViaGritQL","applyGritQL","declareDependencies","ownedElsewhere","formatFilesInSubtree","installDependencies","addGeneratorMetricsIfApplicable","esmVars","kebabCase","getNpmScope","addComponentGeneratorMetadata","addDependencyToTargetIfNotPresent","getGeneratorInfo","readProjectConfigurationUnqualified","toProjectRelativePath","DEPENDENCIES","ts","name","root","map","TS_AGENT_A2A_CONNECTION_GENERATOR_INFO","filename","tsAgentA2aConnectionGenerator","tree","options","sourceProject","targetProject","agentComponent","sourceComponent","targetAgentComponent","targetComponent","Error","protocol","toLowerCase","auth","targetAgentComponentName","targetAgentClassName","rc","targetAgentKebabCase","targetAgentPort","port","npmScope","dirname","overwriteStrategy","KeepExisting","agentSourceDir","path","agentFilePath","exists","clientClassName","clientVarName","charAt","slice","toolName","toolVarName","toolCreationBlock","scope","agentName","devTargetName","targetDevTargetName","targets","projects","target","sourcePath","preferInstallDependencies","languages"],"mappings":"AAAA;;;CAGC,GACD,SAEEA,aAAa,EACbC,iBAAiB,EACjBC,iBAAiB,EAEjBC,0BAA0B,QACrB,aAAa;AACpB,SAASC,iBAAiB,QAAQ,qCAAqC;AACvE,SACEC,6BAA6B,EAC7BC,4BAA4B,EAC5BC,uBAAuB,EACvBC,sCAAsC,EACtCC,6BAA6B,QACxB,sDAAsD;AAC7D,SACEC,qBAAqB,EACrBC,aAAa,EACbC,sBAAsB,EACtBC,WAAW,QACN,wBAAwB;AAC/B,SACEC,mBAAmB,EACnBC,cAAc,QACT,0CAA0C;AACjD,SAASC,oBAAoB,QAAQ,2BAA2B;AAChE,SAASC,mBAAmB,QAAQ,4BAA4B;AAChE,SAASC,+BAA+B,QAAQ,4BAA4B;AAC5E,SAASC,OAAO,QAAQ,kCAAkC;AAC1D,SAASC,SAAS,QAAQ,0BAA0B;AACpD,SAASC,WAAW,QAAQ,8BAA8B;AAC1D,SACEC,6BAA6B,EAC7BC,iCAAiC,EACjCC,gBAAgB,EAEhBC,mCAAmC,QAC9B,uBAAuB;AAC9B,SAASC,qBAAqB,QAAQ,0BAA0B;AAGhE,2EAA2E;AAC3E,uCAAuC;AACvC,iFAAiF;AACjF,gFAAgF;AAChF,6CAA6C;AAC7C,OAAO,MAAMC,eAAeb,sBAAsB;IAChDc,IAAI;QACF;YAAEC,MAAM;YAAeC,MAAM;QAAK;QAClC,qEAAqE;QACrE,yEAAyE;QACzE,uEAAuE;QACvE,uBAAuB;WACpBrB,8BAA8BsB,GAAG,CAAC,CAACF,OAAU,CAAA;gBAAEA;gBAAMC,MAAM;YAAK,CAAA;QACnE;YAAED,MAAM;YAAqCC,MAAM;QAAK;QACxD;YAAED,MAAM;YAAiCC,MAAM;QAAK;QACpD;YAAED,MAAM;YAAaC,MAAM;QAAK;QAChC;YAAED,MAAM;YAAiCC,MAAM;QAAK;QACpD;YAAED,MAAM;YAAOC,MAAM;QAAK;WACvBf,eAAeV;KACnB;AACH,GAAG;AAEH,OAAO,MAAM2B,yCACXR,iBAAiB,YAAYS,QAAQ,EAAE;AAEzC,OAAO,MAAMC,gCAAgC,OAC3CC,MACAC;IAEA,MAAMC,gBAAgBZ,oCACpBU,MACAC,QAAQC,aAAa;IAEvB,MAAMC,gBAAgBb,oCACpBU,MACAC,QAAQE,aAAa;IAGvB,MAAMC,iBAAiBH,QAAQI,eAAe;IAC9C,MAAMC,uBAAuBL,QAAQM,eAAe;IAEpD,IAAI,CAACH,kBAAkB,CAACE,sBAAsB;QAC5C,MAAM,IAAIE,MACR;IAEJ;IAEA,IAAI,AAACF,CAAAA,qBAAqBG,QAAQ,IAAI,EAAC,EAAGC,WAAW,OAAO,OAAO;QACjE,MAAM,IAAIF,MACR,CAAC,cAAc,EAAEF,qBAAqBZ,IAAI,CAAC,WAAW,EAAEY,qBAAqBG,QAAQ,IAAI,OAAO,sDAAsD,CAAC;IAE3J;IAEA,IACEH,qBAAqBK,IAAI,IACzBL,qBAAqBK,IAAI,CAACD,WAAW,OAAO,OAC5C;QACA,MAAM,IAAIF,MACR,CAAC,sEAAsE,EAAEF,qBAAqBZ,IAAI,CAAC,QAAQ,EAAEY,qBAAqBK,IAAI,CAAC,iBAAiB,CAAC;IAE7J;IAEA,MAAMC,2BAA2BN,qBAAqBZ,IAAI,IAAI;IAC9D,MAAMmB,uBAAuBP,qBAAqBQ,EAAE;IACpD,MAAMC,uBAAuB9B,UAAU4B;IACvC,MAAMG,kBAAkBV,qBAAqBW,IAAI,IAAI;IAErD,MAAMC,WAAWhC,YAAYc;IAE7B,iFAAiF;IACjF,MAAM3B,uCAAuC2B,MAAMR;IACnD,MAAMpB,wBAAwB4B,MAAM,OAAOR;IAE3C,wDAAwD;IACxD3B,cACEmC,MACAlC,kBAAkB,YAAYqD,OAAO,EAAE,SAAS,oBAAoB,QACpErD,kBAAkBK,8BAA8B,OAAO,QACvD;QACE4C;QACAF;QACAG;QACA,GAAGhC,QAAQgB,KAAK;IAClB,GACA;QAAEoB,mBAAmBrD,kBAAkBsD,YAAY;IAAC;IAGtD,4BAA4B;IAC5B,MAAM7C,cACJwB,MACAlC,kBAAkBK,8BAA8B,OAAO,aACvD,CAAC,MAAM,EAAE4C,qBAAqB,kBAAkB,CAAC;IAGnD,kEAAkE;IAClE,MAAMO,iBAAiBxD,kBACrBoC,cAAcP,IAAI,EAClBS,eAAemB,IAAI,IAAI;IAEzB,MAAMC,gBAAgB1D,kBAAkBwD,gBAAgB;IAExD,IAAItB,KAAKyB,MAAM,CAACD,gBAAgB;QAC9B,MAAME,kBAAkB,GAAGb,qBAAqB,aAAa,CAAC;QAC9D,MAAMc,gBACJd,qBAAqBe,MAAM,CAAC,GAAGlB,WAAW,KAC1CG,qBAAqBgB,KAAK,CAAC;QAC7B,MAAMC,WAAW,CAAC,GAAG,EAAEjB,sBAAsB;QAC7C,MAAMkB,cAAc,GAAGJ,cAAc,IAAI,CAAC;QAE1C,wCAAwC;QACxC,MAAMpD,sBACJyB,MACAwB,eACA;YAAC;SAAO,EACR;QAEF,MAAMjD,sBAAsByB,MAAMwB,eAAe;YAAC;SAAI,EAAE;QACxD,MAAMjD,sBACJyB,MACAwB,eACA;YAACE;SAAgB,EACjB,CAAC,CAAC,EAAER,SAAS,iBAAiB,CAAC;QAGjC,0CAA0C;QAC1C,MAAMc,oBAAoB,CAAC,MAAM,EAAEL,cAAc,SAAS,EAAED,gBAAgB;QACxE,EAAEK,YAAY;WACX,EAAED,SAAS;oDAC8B,EAAEjB,qBAAqB;;2CAEhC,EAAEc,cAAc;KACtD,CAAC;QAEF,0DAA0D;QAC1D,iEAAiE;QACjE,gDAAgD;QAChD,MAAMjD,YACJsB,MACAwB,eACA,CAAC;EACL,EAAEQ,kBAAkB;;uCAEiB,EAAEN,gBAAgB;EACvD,EAAEM,kBAAkB;;4EAEsD,EAAEN,gBAAgB,aAAa,CAAC;QAGxG,4DAA4D;QAC5D,MAAMjD,uBAAuBuB,MAAMwB,eAAe,UAAUO,aAAa;YACvEE,OAAO;QACT;IACF;IAEA,0DAA0D;IAC1D,mEAAmE;IACnE,MAAMC,YAAY9B,eAAeV,IAAI,IAAI;IACzC,MAAMyC,gBAAgB,GAAGD,UAAU,IAAI,CAAC;IACxC,MAAME,sBAAsB,GAAGxB,yBAAyB,IAAI,CAAC;IAE7D,IAAIV,cAAcmC,OAAO,EAAE,CAACF,cAAc,EAAE;QAC1C/C,kCAAkCc,eAAeiC,eAAe;YAC9DG,UAAU;gBAACnC,cAAcT,IAAI;aAAC;YAC9B6C,QAAQH;QACV;QACApE,2BAA2BgC,MAAME,cAAcR,IAAI,EAAEQ;IACvD;IAEA,qDAAqD;IACrDjC,kBAAkB+B,MAAMR;IAExB,8EAA8E;IAC9EL,8BACEa,MACAE,cAAcR,IAAI,EAClBG,wCACAN,sBAAsBW,eAAesB,gBACrCX,sBACA,oEAAoE;IACpE,kDAAkD;IAClD;QAAE2B,YAAYvC,QAAQI,eAAe,EAAEkB;IAAK;IAG9C,MAAMxC,gCAAgCiB,MAAM;QAC1CH;KACD;IAED,MAAMhB,qBAAqBmB;IAC3B,OAAO,IACLlB,oBAAoBkB,MAAMC,QAAQwC,yBAAyB,EAAE;YAC3DC,WAAW;gBAAC;aAAa;QAC3B;AACJ,EAAE;AAEF,eAAe3C,8BAA8B"}