@aws/nx-plugin 1.2.0 → 1.3.1

package/src/migrations/v1.3.0/0001-ts-agent-guardrails-terraform-version-retention/migration.js

@@ -0,0 +1,118 @@
+/**
+ * Copyright Amazon.com, Inc. or its affiliates. All Rights Reserved.
+ * SPDX-License-Identifier: Apache-2.0
+ */ import { getProjects, joinPathFragments } from "@nx/devkit";
+import { TS_AGENT_GENERATOR_INFO } from "../../../ts/agent/generator.js";
+import { TS_AGENT_GUARDRAILS_GENERATOR_INFO } from "../../../ts/agent/guardrails/generator.js";
+import { applyGritQL, GRIT_INSERT_PLACEHOLDER, insertViaGritQL, matchGritQL } from "../../../utils/ast.js";
+import { formatFilesInSubtree } from "../../../utils/format.js";
+import { kebabCase, toClassName } from "../../../utils/names.js";
+import { PACKAGES_DIR, SHARED_TERRAFORM_DIR } from "../../../utils/shared-constructs-constants.js";
+import { TERRAFORM_VERSIONS } from "../../../utils/versions.js";
+/**
+ * Keep a replaced guardrail version for 15 seconds after the runtime-config
+ * deployment in each Terraform guardrail module of a `ts#agent#guardrails`
+ * agent.
+ *
+ * When `guardrail.json` changes, `aws_bedrock_guardrail_version.this` is
+ * replaced with `create_before_destroy`, and Terraform destroyed the old
+ * version as soon as the runtime-config deployment completed. Agents cache
+ * their runtime-config entry for 5 seconds, so a request in that window used
+ * the deleted version and failed. The module now has a `time_sleep` whose
+ * `triggers` hold the guardrail ID and version, and the runtime-config entry
+ * reads both from those triggers. On a version change the sleep is replaced
+ * too: the deposed sleep is destroyed after everything that depends on the new
+ * one (the entry and, through the root module's `depends_on`, the
+ * runtime-config deployment), waits its 15-second `destroy_duration`, and only
+ * then is the deposed version, which it depends on, destroyed.
+ *
+ * Guarded agents are found from the `ts#agent#guardrails` components in project
+ * metadata, each paired with the `ts#agent` component of the same name whose
+ * IaC is Terraform. The module is written with `KeepExisting`, so an upgraded
+ * workspace keeps the older module until this runs. A module that no longer
+ * has the generated shape is left untouched and reported via `nextSteps` with
+ * the lines to add.
+ */ const TERRAFORM_GUARDRAILS_DIR = `${PACKAGES_DIR}/${SHARED_TERRAFORM_DIR}/src/app/guardrails`;
+const hcl = (pattern)=>`language hcl\n${pattern}`;
+const TIME_SLEEP = '`resource "time_sleep" "version_retention" { $_ }`';
+/** Indented as `terraform fmt` writes it, since `.tf` files are not reformatted. */ const TIME_PROVIDER_TEXT = `    time = {
+      source  = "hashicorp/time"
+      version = "${TERRAFORM_VERSIONS.time}"
+    }`;
+const TIME_SLEEP_TEXT = `resource "time_sleep" "version_retention" {
+  destroy_duration = "15s"
+
+  triggers = {
+    guardrail_id      = aws_bedrock_guardrail.this.guardrail_id
+    guardrail_version = aws_bedrock_guardrail_version.this.version
+  }
+
+  lifecycle {
+    create_before_destroy = true
+  }
+}`;
+const ENTRY_ID = 'guardrailId = aws_bedrock_guardrail.this.guardrail_id';
+const ENTRY_VERSION = 'guardrailVersion = aws_bedrock_guardrail_version.this.version';
+/** Every shape the migration rewrites, so a module missing one is reported rather than half-migrated. */ const REQUIRED_SHAPES = [
+    '`required_providers { $_ }`',
+    '`resource "aws_bedrock_guardrail_version" "this" { $_ }`',
+    `\`module "add_guardrail_to_runtime_config" { $body }\` where { $body <: and { contains \`${ENTRY_ID}\`, contains \`${ENTRY_VERSION}\` } }`
+];
+const divergedMessage = (filePath)=>`${filePath}: has diverged from the generated shape - left untouched. To keep a replaced guardrail version until agents have read the new one, add the time provider to required_providers:
+
+${TIME_PROVIDER_TEXT}
+
+add this resource:
+
+${TIME_SLEEP_TEXT}
+
+and make the runtime-config entry read guardrailId = time_sleep.version_retention.triggers.guardrail_id and guardrailVersion = time_sleep.version_retention.triggers.guardrail_version.`;
+/** The Terraform guardrail module of each Terraform-deployed `ts#agent#guardrails` agent. */ const guardedTerraformModules = (tree)=>{
+    const files = new Set();
+    for (const project of getProjects(tree).values()){
+        const components = project.metadata?.components ?? [];
+        for (const guardrail of components.filter((c)=>c.generator === TS_AGENT_GUARDRAILS_GENERATOR_INFO.id)){
+            const agent = components.find((c)=>c.generator === TS_AGENT_GENERATOR_INFO.id && (c.name ?? 'agent') === guardrail.name);
+            if (agent?.iac !== 'terraform') {
+                continue;
+            }
+            const nameKebabCase = kebabCase(agent.rc ?? toClassName(agent.name ?? 'agent'));
+            files.add(joinPathFragments(TERRAFORM_GUARDRAILS_DIR, nameKebabCase, `${nameKebabCase}-guardrail.tf`));
+        }
+    }
+    return [
+        ...files
+    ];
+};
+const migrateModule = async (tree, filePath, nextSteps)=>{
+    if (await matchGritQL(tree, filePath, hcl(TIME_SLEEP))) {
+        return; // Already migrated.
+    }
+    const shapeChecks = await Promise.all(REQUIRED_SHAPES.map((shape)=>matchGritQL(tree, filePath, hcl(shape))));
+    if (shapeChecks.includes(false)) {
+        nextSteps.push(divergedMessage(filePath));
+        return;
+    }
+    // Appended after the existing providers, so an entry the user changed is kept.
+    await insertViaGritQL(tree, filePath, hcl(`\`required_providers { $body }\` => \`required_providers {\n    $body\n    ${GRIT_INSERT_PLACEHOLDER}\n  }\`` + ' where { $body <: not contains `time = { $_ }` }'), // The placeholder already sits at the entry's indentation.
+    TIME_PROVIDER_TEXT.replace(/^ {4}/, ''));
+    // After the version it keeps, where the generator writes it.
+    await insertViaGritQL(tree, filePath, hcl(`\`resource "aws_bedrock_guardrail_version" "this" { $body }\` => \`resource "aws_bedrock_guardrail_version" "this" {\n  $body\n}\n\n${GRIT_INSERT_PLACEHOLDER}\``), TIME_SLEEP_TEXT);
+    // Only the entry reads through the sleep; the module's outputs are unchanged.
+    await applyGritQL(tree, filePath, hcl(`\`module "add_guardrail_to_runtime_config" { $body }\` where { $body <: contains bubble \`${ENTRY_ID}\` => \`guardrailId = time_sleep.version_retention.triggers.guardrail_id\`, $body <: contains bubble \`${ENTRY_VERSION}\` => \`guardrailVersion = time_sleep.version_retention.triggers.guardrail_version\` }`));
+};
+export default async function migration(tree) {
+    const nextSteps = [];
+    for (const filePath of guardedTerraformModules(tree)){
+        if (!tree.exists(filePath)) {
+            continue; // The guardrail module was removed or never added.
+        }
+        await migrateModule(tree, filePath, nextSteps);
+    }
+    await formatFilesInSubtree(tree);
+    return {
+        nextSteps
+    };
+}
+
+//# sourceMappingURL=migration.js.map

package/src/migrations/v1.3.0/0001-ts-agent-guardrails-terraform-version-retention/migration.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../../../../../../../packages/nx-plugin/src/migrations/v1.3.0/0001-ts-agent-guardrails-terraform-version-retention/migration.ts"],"sourcesContent":["/**\n * Copyright Amazon.com, Inc. or its affiliates. All Rights Reserved.\n * SPDX-License-Identifier: Apache-2.0\n */\nimport {\n  getProjects,\n  joinPathFragments,\n  type MigrationReturnObject,\n  type Tree,\n} from '@nx/devkit';\nimport { TS_AGENT_GENERATOR_INFO } from '../../../ts/agent/generator.js';\nimport { TS_AGENT_GUARDRAILS_GENERATOR_INFO } from '../../../ts/agent/guardrails/generator.js';\nimport {\n  applyGritQL,\n  GRIT_INSERT_PLACEHOLDER,\n  insertViaGritQL,\n  matchGritQL,\n} from '../../../utils/ast.js';\nimport { formatFilesInSubtree } from '../../../utils/format.js';\nimport { kebabCase, toClassName } from '../../../utils/names.js';\nimport type { ComponentMetadata } from '../../../utils/nx.js';\nimport {\n  PACKAGES_DIR,\n  SHARED_TERRAFORM_DIR,\n} from '../../../utils/shared-constructs-constants.js';\nimport { TERRAFORM_VERSIONS } from '../../../utils/versions.js';\n\n/**\n * Keep a replaced guardrail version for 15 seconds after the runtime-config\n * deployment in each Terraform guardrail module of a `ts#agent#guardrails`\n * agent.\n *\n * When `guardrail.json` changes, `aws_bedrock_guardrail_version.this` is\n * replaced with `create_before_destroy`, and Terraform destroyed the old\n * version as soon as the runtime-config deployment completed. Agents cache\n * their runtime-config entry for 5 seconds, so a request in that window used\n * the deleted version and failed. The module now has a `time_sleep` whose\n * `triggers` hold the guardrail ID and version, and the runtime-config entry\n * reads both from those triggers. On a version change the sleep is replaced\n * too: the deposed sleep is destroyed after everything that depends on the new\n * one (the entry and, through the root module's `depends_on`, the\n * runtime-config deployment), waits its 15-second `destroy_duration`, and only\n * then is the deposed version, which it depends on, destroyed.\n *\n * Guarded agents are found from the `ts#agent#guardrails` components in project\n * metadata, each paired with the `ts#agent` component of the same name whose\n * IaC is Terraform. The module is written with `KeepExisting`, so an upgraded\n * workspace keeps the older module until this runs. A module that no longer\n * has the generated shape is left untouched and reported via `nextSteps` with\n * the lines to add.\n */\n\nconst TERRAFORM_GUARDRAILS_DIR = `${PACKAGES_DIR}/${SHARED_TERRAFORM_DIR}/src/app/guardrails`;\n\nconst hcl = (pattern: string) => `language hcl\\n${pattern}`;\n\nconst TIME_SLEEP = '`resource \"time_sleep\" \"version_retention\" { $_ }`';\n\n/** Indented as `terraform fmt` writes it, since `.tf` files are not reformatted. */\nconst TIME_PROVIDER_TEXT = `    time = {\n      source  = \"hashicorp/time\"\n      version = \"${TERRAFORM_VERSIONS.time}\"\n    }`;\n\nconst TIME_SLEEP_TEXT = `resource \"time_sleep\" \"version_retention\" {\n  destroy_duration = \"15s\"\n\n  triggers = {\n    guardrail_id      = aws_bedrock_guardrail.this.guardrail_id\n    guardrail_version = aws_bedrock_guardrail_version.this.version\n  }\n\n  lifecycle {\n    create_before_destroy = true\n  }\n}`;\n\nconst ENTRY_ID = 'guardrailId = aws_bedrock_guardrail.this.guardrail_id';\nconst ENTRY_VERSION =\n  'guardrailVersion = aws_bedrock_guardrail_version.this.version';\n\n/** Every shape the migration rewrites, so a module missing one is reported rather than half-migrated. */\nconst REQUIRED_SHAPES = [\n  '`required_providers { $_ }`',\n  '`resource \"aws_bedrock_guardrail_version\" \"this\" { $_ }`',\n  `\\`module \"add_guardrail_to_runtime_config\" { $body }\\` where { $body <: and { contains \\`${ENTRY_ID}\\`, contains \\`${ENTRY_VERSION}\\` } }`,\n];\n\nconst divergedMessage = (filePath: string) =>\n  `${filePath}: has diverged from the generated shape - left untouched. To keep a replaced guardrail version until agents have read the new one, add the time provider to required_providers:\n\n${TIME_PROVIDER_TEXT}\n\nadd this resource:\n\n${TIME_SLEEP_TEXT}\n\nand make the runtime-config entry read guardrailId = time_sleep.version_retention.triggers.guardrail_id and guardrailVersion = time_sleep.version_retention.triggers.guardrail_version.`;\n\n/** The Terraform guardrail module of each Terraform-deployed `ts#agent#guardrails` agent. */\nconst guardedTerraformModules = (tree: Tree): string[] => {\n  const files = new Set<string>();\n  for (const project of getProjects(tree).values()) {\n    const components: ComponentMetadata[] =\n      (project.metadata as { components?: ComponentMetadata[] } | undefined)\n        ?.components ?? [];\n    for (const guardrail of components.filter(\n      (c) => c.generator === TS_AGENT_GUARDRAILS_GENERATOR_INFO.id,\n    )) {\n      const agent = components.find(\n        (c) =>\n          c.generator === TS_AGENT_GENERATOR_INFO.id &&\n          (c.name ?? 'agent') === guardrail.name,\n      );\n      if (agent?.iac !== 'terraform') {\n        continue;\n      }\n      const nameKebabCase = kebabCase(\n        agent.rc ?? toClassName(agent.name ?? 'agent'),\n      );\n      files.add(\n        joinPathFragments(\n          TERRAFORM_GUARDRAILS_DIR,\n          nameKebabCase,\n          `${nameKebabCase}-guardrail.tf`,\n        ),\n      );\n    }\n  }\n  return [...files];\n};\n\nconst migrateModule = async (\n  tree: Tree,\n  filePath: string,\n  nextSteps: string[],\n): Promise<void> => {\n  if (await matchGritQL(tree, filePath, hcl(TIME_SLEEP))) {\n    return; // Already migrated.\n  }\n\n  const shapeChecks = await Promise.all(\n    REQUIRED_SHAPES.map((shape) => matchGritQL(tree, filePath, hcl(shape))),\n  );\n  if (shapeChecks.includes(false)) {\n    nextSteps.push(divergedMessage(filePath));\n    return;\n  }\n\n  // Appended after the existing providers, so an entry the user changed is kept.\n  await insertViaGritQL(\n    tree,\n    filePath,\n    hcl(\n      `\\`required_providers { $body }\\` => \\`required_providers {\\n    $body\\n    ${GRIT_INSERT_PLACEHOLDER}\\n  }\\`` +\n        ' where { $body <: not contains `time = { $_ }` }',\n    ),\n    // The placeholder already sits at the entry's indentation.\n    TIME_PROVIDER_TEXT.replace(/^ {4}/, ''),\n  );\n\n  // After the version it keeps, where the generator writes it.\n  await insertViaGritQL(\n    tree,\n    filePath,\n    hcl(\n      `\\`resource \"aws_bedrock_guardrail_version\" \"this\" { $body }\\` => \\`resource \"aws_bedrock_guardrail_version\" \"this\" {\\n  $body\\n}\\n\\n${GRIT_INSERT_PLACEHOLDER}\\``,\n    ),\n    TIME_SLEEP_TEXT,\n  );\n\n  // Only the entry reads through the sleep; the module's outputs are unchanged.\n  await applyGritQL(\n    tree,\n    filePath,\n    hcl(\n      `\\`module \"add_guardrail_to_runtime_config\" { $body }\\` where { $body <: contains bubble \\`${ENTRY_ID}\\` => \\`guardrailId = time_sleep.version_retention.triggers.guardrail_id\\`, $body <: contains bubble \\`${ENTRY_VERSION}\\` => \\`guardrailVersion = time_sleep.version_retention.triggers.guardrail_version\\` }`,\n    ),\n  );\n};\n\nexport default async function migration(\n  tree: Tree,\n): Promise<MigrationReturnObject> {\n  const nextSteps: string[] = [];\n\n  for (const filePath of guardedTerraformModules(tree)) {\n    if (!tree.exists(filePath)) {\n      continue; // The guardrail module was removed or never added.\n    }\n    await migrateModule(tree, filePath, nextSteps);\n  }\n\n  await formatFilesInSubtree(tree);\n\n  return { nextSteps };\n}\n"],"names":["getProjects","joinPathFragments","TS_AGENT_GENERATOR_INFO","TS_AGENT_GUARDRAILS_GENERATOR_INFO","applyGritQL","GRIT_INSERT_PLACEHOLDER","insertViaGritQL","matchGritQL","formatFilesInSubtree","kebabCase","toClassName","PACKAGES_DIR","SHARED_TERRAFORM_DIR","TERRAFORM_VERSIONS","TERRAFORM_GUARDRAILS_DIR","hcl","pattern","TIME_SLEEP","TIME_PROVIDER_TEXT","time","TIME_SLEEP_TEXT","ENTRY_ID","ENTRY_VERSION","REQUIRED_SHAPES","divergedMessage","filePath","guardedTerraformModules","tree","files","Set","project","values","components","metadata","guardrail","filter","c","generator","id","agent","find","name","iac","nameKebabCase","rc","add","migrateModule","nextSteps","shapeChecks","Promise","all","map","shape","includes","push","replace","migration","exists"],"mappings":"AAAA;;;CAGC,GACD,SACEA,WAAW,EACXC,iBAAiB,QAGZ,aAAa;AACpB,SAASC,uBAAuB,QAAQ,iCAAiC;AACzE,SAASC,kCAAkC,QAAQ,4CAA4C;AAC/F,SACEC,WAAW,EACXC,uBAAuB,EACvBC,eAAe,EACfC,WAAW,QACN,wBAAwB;AAC/B,SAASC,oBAAoB,QAAQ,2BAA2B;AAChE,SAASC,SAAS,EAAEC,WAAW,QAAQ,0BAA0B;AAEjE,SACEC,YAAY,EACZC,oBAAoB,QACf,gDAAgD;AACvD,SAASC,kBAAkB,QAAQ,6BAA6B;AAEhE;;;;;;;;;;;;;;;;;;;;;;;CAuBC,GAED,MAAMC,2BAA2B,GAAGH,aAAa,CAAC,EAAEC,qBAAqB,mBAAmB,CAAC;AAE7F,MAAMG,MAAM,CAACC,UAAoB,CAAC,cAAc,EAAEA,SAAS;AAE3D,MAAMC,aAAa;AAEnB,kFAAkF,GAClF,MAAMC,qBAAqB,CAAC;;iBAEX,EAAEL,mBAAmBM,IAAI,CAAC;KACtC,CAAC;AAEN,MAAMC,kBAAkB,CAAC;;;;;;;;;;;CAWxB,CAAC;AAEF,MAAMC,WAAW;AACjB,MAAMC,gBACJ;AAEF,uGAAuG,GACvG,MAAMC,kBAAkB;IACtB;IACA;IACA,CAAC,yFAAyF,EAAEF,SAAS,eAAe,EAAEC,cAAc,MAAM,CAAC;CAC5I;AAED,MAAME,kBAAkB,CAACC,WACvB,GAAGA,SAAS;;AAEd,EAAEP,mBAAmB;;;;AAIrB,EAAEE,gBAAgB;;uLAEqK,CAAC;AAExL,2FAA2F,GAC3F,MAAMM,0BAA0B,CAACC;IAC/B,MAAMC,QAAQ,IAAIC;IAClB,KAAK,MAAMC,WAAW9B,YAAY2B,MAAMI,MAAM,GAAI;QAChD,MAAMC,aACJ,AAACF,QAAQG,QAAQ,EACbD,cAAc,EAAE;QACtB,KAAK,MAAME,aAAaF,WAAWG,MAAM,CACvC,CAACC,IAAMA,EAAEC,SAAS,KAAKlC,mCAAmCmC,EAAE,EAC3D;YACD,MAAMC,QAAQP,WAAWQ,IAAI,CAC3B,CAACJ,IACCA,EAAEC,SAAS,KAAKnC,wBAAwBoC,EAAE,IAC1C,AAACF,CAAAA,EAAEK,IAAI,IAAI,OAAM,MAAOP,UAAUO,IAAI;YAE1C,IAAIF,OAAOG,QAAQ,aAAa;gBAC9B;YACF;YACA,MAAMC,gBAAgBlC,UACpB8B,MAAMK,EAAE,IAAIlC,YAAY6B,MAAME,IAAI,IAAI;YAExCb,MAAMiB,GAAG,CACP5C,kBACEa,0BACA6B,eACA,GAAGA,cAAc,aAAa,CAAC;QAGrC;IACF;IACA,OAAO;WAAIf;KAAM;AACnB;AAEA,MAAMkB,gBAAgB,OACpBnB,MACAF,UACAsB;IAEA,IAAI,MAAMxC,YAAYoB,MAAMF,UAAUV,IAAIE,cAAc;QACtD,QAAQ,oBAAoB;IAC9B;IAEA,MAAM+B,cAAc,MAAMC,QAAQC,GAAG,CACnC3B,gBAAgB4B,GAAG,CAAC,CAACC,QAAU7C,YAAYoB,MAAMF,UAAUV,IAAIqC;IAEjE,IAAIJ,YAAYK,QAAQ,CAAC,QAAQ;QAC/BN,UAAUO,IAAI,CAAC9B,gBAAgBC;QAC/B;IACF;IAEA,+EAA+E;IAC/E,MAAMnB,gBACJqB,MACAF,UACAV,IACE,CAAC,2EAA2E,EAAEV,wBAAwB,OAAO,CAAC,GAC5G,qDAEJ,2DAA2D;IAC3Da,mBAAmBqC,OAAO,CAAC,SAAS;IAGtC,6DAA6D;IAC7D,MAAMjD,gBACJqB,MACAF,UACAV,IACE,CAAC,oIAAoI,EAAEV,wBAAwB,EAAE,CAAC,GAEpKe;IAGF,8EAA8E;IAC9E,MAAMhB,YACJuB,MACAF,UACAV,IACE,CAAC,0FAA0F,EAAEM,SAAS,uGAAuG,EAAEC,cAAc,sFAAsF,CAAC;AAG1T;AAEA,eAAe,eAAekC,UAC5B7B,IAAU;IAEV,MAAMoB,YAAsB,EAAE;IAE9B,KAAK,MAAMtB,YAAYC,wBAAwBC,MAAO;QACpD,IAAI,CAACA,KAAK8B,MAAM,CAAChC,WAAW;YAC1B,UAAU,mDAAmD;QAC/D;QACA,MAAMqB,cAAcnB,MAAMF,UAAUsB;IACtC;IAEA,MAAMvC,qBAAqBmB;IAE3B,OAAO;QAAEoB;IAAU;AACrB"}

package/src/preset/__snapshots__/generator.spec.ts.snap

@@ -113,6 +113,8 @@ The following list of generators are what is currently available in the \`@aws/n
 
 - **py#agent**: Add an AI Agent to a Python project
 
+- **py#agent#guardrails**: Add an Amazon Bedrock Guardrail to a Python Agent (experimental)
+
 - **smithy#project**: Generate a Smithy model project, either defining a service or a library of reusable shapes
 
 - **terraform#project**: Generates a Terraform project
@@ -257,7 +259,7 @@ export default {
 
 exports[`preset generator > should run successfully > biome.json 1`] = `
 "{
-  "$schema": "https://biomejs.dev/schemas/2.5.15/schema.json",
+  "$schema": "https://biomejs.dev/schemas/2.6.3/schema.json",
   "root": true,
   "formatter": {
     "enabled": true,
@@ -282,6 +284,16 @@ exports[`preset generator > should run successfully > biome.json 1`] = `
       "enabled": false
     }
   },
+  "markdown": {
+    "formatter": {
+      "enabled": false
+    }
+  },
+  "yaml": {
+    "formatter": {
+      "enabled": false
+    }
+  },
   "linter": {
     "enabled": true,
     "rules": {
@@ -422,11 +434,11 @@ onlyBuiltDependencies:
   - sharp
 catalogMode: strict
 catalog:
-  nx: 23.3.0
-  '@nx/js': 23.3.0
-  '@nx/workspace': 23.3.0
+  nx: 23.3.1
+  '@nx/js': 23.3.1
+  '@nx/workspace': 23.3.1
   typescript: ~6.0.3
-  '@biomejs/biome': 2.5.15
+  '@biomejs/biome': 2.6.3
   '@aws/nx-plugin': ^0.0.0
   '@aws/nx-plugin-mcp': ^0.0.0
 "

package/src/py/agent/__snapshots__/generator.constructs.spec.ts.snap

@@ -763,19 +763,19 @@ name = "proj.test_project"
 version = "0.1.0"
 dependencies = [
   "proj-agent-connection",
-  "aws-lambda-powertools==3.36.0",
+  "aws-lambda-powertools==3.37.0",
   "aws-opentelemetry-distro==0.21.0",
-  "bedrock-agentcore==1.24.2",
-  "boto3==1.43.115",
-  "fastapi==0.150.0",
+  "bedrock-agentcore==1.25.0",
+  "boto3==1.43.118",
+  "fastapi==0.162.0",
   "mcp==1.28.1",
-  "strands-agents==1.61.1",
-  "strands-agents-tools==0.8.9",
+  "strands-agents==1.62.0",
+  "strands-agents-tools==0.8.10",
   "uvicorn==0.54.0"
 ]
 
 [dependency-groups]
-dev = [ "fastapi[standard]==0.150.0" ]
+dev = [ "fastapi[standard]==0.162.0" ]
 
 [tool.uv]
 dev-dependencies = [ ]

package/src/py/agent/__snapshots__/generator.frameworks.spec.ts.snap

@@ -701,15 +701,15 @@ name = "proj.test_project"
 version = "0.1.0"
 dependencies = [
   "proj-agent-connection",
-  "aws-lambda-powertools==3.36.0",
+  "aws-lambda-powertools==3.37.0",
   "aws-opentelemetry-distro==0.21.0",
-  "bedrock-agentcore==1.24.2",
-  "boto3==1.43.115",
-  "fastapi==0.150.0",
+  "bedrock-agentcore==1.25.0",
+  "boto3==1.43.118",
+  "fastapi==0.162.0",
   "mcp==1.28.1",
-  "langchain==1.4.6",
+  "langchain==1.4.7",
   "langchain-aws==1.9.0",
-  "langgraph==1.2.16",
+  "langgraph==1.2.17",
   "langgraph-checkpoint-sqlite==3.1.2",
   "aiosqlite==0.22.1",
   "ag-ui-protocol==0.1.22",
@@ -718,7 +718,7 @@ dependencies = [
 ]
 
 [dependency-groups]
-dev = [ "fastapi[standard]==0.150.0" ]
+dev = [ "fastapi[standard]==0.162.0" ]
 
 [tool.uv]
 dev-dependencies = [ ]

package/src/py/agent/__snapshots__/generator.protocols.spec.ts.snap

@@ -5,7 +5,7 @@ exports[`py#agent generator > should create DynamoDB checkpoint table and S3 off
   required_providers {
     aws = {
       source  = "hashicorp/aws"
-      version = "6.69.1"
+      version = "6.70.0"
     }
     random = {
       source  = "hashicorp/random"
@@ -381,7 +381,7 @@ exports[`py#agent generator > should match snapshot for Terraform generated file
   required_providers {
     aws = {
       source  = "hashicorp/aws"
-      version = "6.69.1"
+      version = "6.70.0"
     }
     random = {
       source  = "hashicorp/random"
@@ -704,7 +704,7 @@ exports[`py#agent generator > should match snapshot for Terraform generated file
   required_providers {
     aws = {
       source  = "hashicorp/aws"
-      version = "6.69.1"
+      version = "6.70.0"
     }
     null = {
       source  = "hashicorp/null"
@@ -1063,7 +1063,7 @@ resource "null_resource" "runtime_ready" {
 
   provisioner "local-exec" {
     command = <<-EOT
-      uv run --with boto3==1.43.115 python -c "
+      uv run --with boto3==1.43.118 python -c "
 import boto3
 import json
 import os