@aws/nx-plugin 1.3.0 → 1.3.1

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@aws/nx-plugin",
-  "version": "1.3.0",
+  "version": "1.3.1",
   "repository": {
     "type": "git",
     "url": "https://github.com/awslabs/nx-plugin-for-aws.git",
@@ -36,21 +36,21 @@
     "node": "^22.13.0 || ^24.0.0 || >=26.0.0"
   },
   "peerDependencies": {
-    "nx": "23.3.0"
+    "nx": "23.3.1"
   },
   "dependencies": {
     "@apidevtools/swagger-parser": "12.1.0",
-    "@astral-sh/ruff-wasm-nodejs": "0.17.1",
-    "@biomejs/js-api": "6.0.0",
-    "@biomejs/wasm-nodejs": "2.5.15",
+    "@astral-sh/ruff-wasm-nodejs": "0.17.2",
+    "@biomejs/js-api": "6.1.0",
+    "@biomejs/wasm-nodejs": "2.6.3",
     "@getgrit/gritql": "0.0.3",
     "@iarna/toml": "2.2.5",
-    "@modelcontextprotocol/sdk": "1.32.1",
-    "@nx/devkit": "23.3.0",
-    "@nx/js": "23.3.0",
-    "@nx/react": "23.3.0",
-    "@nx/vite": "23.3.0",
-    "@nxlv/python": "23.2.1",
+    "@modelcontextprotocol/sdk": "1.32.2",
+    "@nx/devkit": "23.3.1",
+    "@nx/js": "23.3.1",
+    "@nx/react": "23.3.1",
+    "@nx/vite": "23.3.1",
+    "@nxlv/python": "23.3.1",
     "@phenomnomnominal/tsquery": "6.2.0",
     "@types/estree": "1.0.9",
     "@types/js-yaml": "4.0.9",
@@ -78,9 +78,9 @@
     "spdx-satisfies": "6.0.0",
     "typescript": "6.0.3",
     "unified": "11.0.5",
-    "unist-util-visit": "5.1.0",
-    "vite": "8.3.4",
-    "vitest": "5.0.4",
+    "unist-util-visit": "5.2.0",
+    "vite": "8.3.5",
+    "vitest": "5.0.5",
     "zod": "4.6.7"
   },
   "devDependencies": {

package/src/agentcore-gateway/__snapshots__/generator.spec.ts.snap

@@ -7,7 +7,7 @@ exports[`agentcore-gateway generator > protocol: http > omits protocol_type from
   required_providers {
     aws = {
       source  = "hashicorp/aws"
-      version = "6.69.1"
+      version = "6.70.0"
     }
     time = {
       source  = "hashicorp/time"

package/src/greengrass/component/python/__snapshots__/generator.spec.ts.snap

@@ -217,11 +217,11 @@ def test_run_once_does_not_raise():
   - packages/common/*
 catalog:
   '@types/node': 26.6.5
-  vite: 8.3.4
-  vitest: 5.0.4
-  '@vitest/coverage-v8': 5.0.4
+  vite: 8.3.5
+  vitest: 5.0.5
+  '@vitest/coverage-v8': 5.0.5
   jsdom: 29.1.1
-  '@nx/vitest': 23.3.0
+  '@nx/vitest': 23.3.1
   js-yaml: 4.3.2
   '@types/js-yaml': 4.0.9
   tsx: 4.23.15
@@ -436,11 +436,11 @@ def test_run_once_does_not_raise():
   - packages/common/*
 catalog:
   '@types/node': 26.6.5
-  vite: 8.3.4
-  vitest: 5.0.4
-  '@vitest/coverage-v8': 5.0.4
+  vite: 8.3.5
+  vitest: 5.0.5
+  '@vitest/coverage-v8': 5.0.5
   jsdom: 29.1.1
-  '@nx/vitest': 23.3.0
+  '@nx/vitest': 23.3.1
   js-yaml: 4.3.2
   '@types/js-yaml': 4.0.9
   tsx: 4.23.15

package/src/infra/app/__snapshots__/generator.spec.ts.snap

@@ -50,7 +50,7 @@ exports[`infra generator > should configure Checkov target correctly > checkov-t
     "default",
   ],
   "options": {
-    "command": "uvx --from checkov==3.3.29 checkov --config-file {projectRoot}/checkov.yml --directory dist/{projectRoot}/cdk.out --framework cloudformation",
+    "command": "uvx --from checkov==3.3.30 checkov --config-file {projectRoot}/checkov.yml --directory dist/{projectRoot}/cdk.out --framework cloudformation",
   },
   "outputs": [
     "{workspaceRoot}/dist/{projectRoot}/checkov",
@@ -150,7 +150,7 @@ exports[`infra generator > should configure project.json with correct targets >
         "default",
       ],
       "options": {
-        "command": "uvx --from checkov==3.3.29 checkov --config-file {projectRoot}/checkov.yml --directory dist/{projectRoot}/cdk.out --framework cloudformation",
+        "command": "uvx --from checkov==3.3.30 checkov --config-file {projectRoot}/checkov.yml --directory dist/{projectRoot}/cdk.out --framework cloudformation",
       },
       "outputs": [
         "{workspaceRoot}/dist/{projectRoot}/checkov",
@@ -767,7 +767,7 @@ exports[`infra generator > should handle custom project names correctly > custom
         "default",
       ],
       "options": {
-        "command": "uvx --from checkov==3.3.29 checkov --config-file {projectRoot}/checkov.yml --directory dist/{projectRoot}/cdk.out --framework cloudformation",
+        "command": "uvx --from checkov==3.3.30 checkov --config-file {projectRoot}/checkov.yml --directory dist/{projectRoot}/cdk.out --framework cloudformation",
       },
       "outputs": [
         "{workspaceRoot}/dist/{projectRoot}/checkov",

package/src/migrations/latest/biome-markdown-yaml-formatter-off/metadata.json

@@ -0,0 +1,3 @@
+{
+  "description": "Turn off Biome 2.6's Markdown and YAML formatting in biome.json, which formats them by default"
+}

package/src/migrations/latest/biome-markdown-yaml-formatter-off/migration.js

@@ -0,0 +1,113 @@
+/**
+ * Copyright Amazon.com, Inc. or its affiliates. All Rights Reserved.
+ * SPDX-License-Identifier: Apache-2.0
+ */ import { getDependencyVersionFromPackageJson, readJson, writeJson } from "@nx/devkit";
+import { gte, minVersion, validRange } from "semver";
+import { formatFilesInSubtree } from "../../../utils/format.js";
+import { ownedDependencies } from "../../../utils/version-upgrade-migration/owned-dependencies.js";
+import { syncedTsVersion } from "../../../utils/version-upgrade-migration/sync-vended-versions.js";
+/**
+ * Turn off Biome's Markdown and YAML formatting in `biome.json`.
+ *
+ * Biome 2.6 formats Markdown and YAML by default. The vended `format` target
+ * runs `biome format {projectRoot}`, so after the upgrade it fails on generated
+ * README.md files and the TypeScript Greengrass component's `recipe.yaml`, and
+ * `lint` and `build` stop with it.
+ *
+ * Guardrails:
+ * - A workspace without `biome.json` is left alone.
+ * - A top-level `markdown` or `yaml` key that is already present is the user's
+ *   own setting and is kept as it is. Biome 2.5 rejects both keys, so one is
+ *   only present when the user configured Biome 2.6 themselves.
+ * - Missing keys go right after `css`, where the generators place them, or at
+ *   the end when there is no `css` section.
+ * - Idempotent: a second run finds both keys present and changes nothing.
+ * - Biome 2.5 rejects both keys and then fails every `format` and `lint`
+ *   target, so they are added only when the workspace runs Biome 2.6 or later
+ *   once `nx migrate` finishes. Otherwise `biome.json` is left as it is and a
+ *   next step says what to add after moving to Biome 2.6.
+ */ const BIOME_CONFIG = 'biome.json';
+const LANGUAGES = [
+    'markdown',
+    'yaml'
+];
+const FORMATTER_OFF = {
+    formatter: {
+        enabled: false
+    }
+};
+const BIOME = '@biomejs/biome';
+/** First Biome release that accepts the `markdown` and `yaml` keys. */ const MIN_BIOME_VERSION = '2.6.0';
+/** Whether every version a semver range allows is Biome 2.6 or later. */ const allowsOnlyBiome26 = (specifier)=>{
+    if (typeof specifier !== 'string' || validRange(specifier) === null) {
+        return false;
+    }
+    const lowest = minVersion(specifier);
+    return lowest !== null && gte(lowest, MIN_BIOME_VERSION);
+};
+/**
+ * Whether the workspace runs Biome 2.6 or later once `nx migrate` finishes.
+ *
+ * The version sync runs after this migration in the same `nx migrate`, so the
+ * root `package.json` still holds the old Biome here. The check takes the lowest
+ * version the declared range (or the catalog entry it references) allows, then
+ * the version the sync will move Biome to. A tag, alias or missing declaration
+ * counts only when the sync moves it.
+ */ const runsBiome26AfterMigrate = async (tree)=>{
+    if (!tree.exists('package.json')) {
+        return false;
+    }
+    const { dependencies, devDependencies } = readJson(tree, 'package.json');
+    const declared = devDependencies?.[BIOME] ?? dependencies?.[BIOME];
+    if (declared === undefined) {
+        return false;
+    }
+    const resolved = getDependencyVersionFromPackageJson(tree, BIOME, 'package.json', [
+        'devDependencies',
+        'dependencies'
+    ]);
+    if (allowsOnlyBiome26(resolved)) {
+        return true;
+    }
+    return allowsOnlyBiome26(syncedTsVersion(tree, await ownedDependencies(tree), BIOME, declared));
+};
+const SKIPPED_NEXT_STEP = 'Biome stays below 2.6 in this workspace, and Biome 2.5 rejects the `markdown` and `yaml` keys, so biome.json was left as it is. ' + 'Biome 2.6 formats Markdown and YAML files by default. After you move `@biomejs/biome` to 2.6 or later, add ' + '`"markdown": { "formatter": { "enabled": false } }` and `"yaml": { "formatter": { "enabled": false } }` to biome.json, ' + 'or the `format` target fails on generated README.md and YAML files.';
+export default async function migration(tree) {
+    if (!tree.exists(BIOME_CONFIG)) {
+        return {
+            nextSteps: []
+        };
+    }
+    const biome = readJson(tree, BIOME_CONFIG);
+    const missing = LANGUAGES.filter((language)=>biome[language] === undefined);
+    if (missing.length === 0) {
+        return {
+            nextSteps: []
+        };
+    }
+    if (!await runsBiome26AfterMigrate(tree)) {
+        return {
+            nextSteps: [
+                SKIPPED_NEXT_STEP
+            ]
+        };
+    }
+    const additions = Object.fromEntries(missing.map((language)=>[
+            language,
+            FORMATTER_OFF
+        ]));
+    const entries = Object.entries(biome);
+    const cssIndex = entries.findIndex(([key])=>key === 'css');
+    const insertAt = cssIndex === -1 ? entries.length : cssIndex + 1;
+    writeJson(tree, BIOME_CONFIG, Object.fromEntries([
+        ...entries.slice(0, insertAt),
+        ...Object.entries(additions),
+        ...entries.slice(insertAt)
+    ]));
+    await formatFilesInSubtree(tree);
+    return {
+        nextSteps: []
+    };
+}
+
+//# sourceMappingURL=migration.js.map

package/src/migrations/latest/biome-markdown-yaml-formatter-off/migration.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../../../../../../../packages/nx-plugin/src/migrations/latest/biome-markdown-yaml-formatter-off/migration.ts"],"sourcesContent":["/**\n * Copyright Amazon.com, Inc. or its affiliates. All Rights Reserved.\n * SPDX-License-Identifier: Apache-2.0\n */\nimport {\n  getDependencyVersionFromPackageJson,\n  type MigrationReturnObject,\n  readJson,\n  type Tree,\n  writeJson,\n} from '@nx/devkit';\nimport { gte, minVersion, validRange } from 'semver';\nimport { formatFilesInSubtree } from '../../../utils/format.js';\nimport { ownedDependencies } from '../../../utils/version-upgrade-migration/owned-dependencies.js';\nimport { syncedTsVersion } from '../../../utils/version-upgrade-migration/sync-vended-versions.js';\n\n/**\n * Turn off Biome's Markdown and YAML formatting in `biome.json`.\n *\n * Biome 2.6 formats Markdown and YAML by default. The vended `format` target\n * runs `biome format {projectRoot}`, so after the upgrade it fails on generated\n * README.md files and the TypeScript Greengrass component's `recipe.yaml`, and\n * `lint` and `build` stop with it.\n *\n * Guardrails:\n * - A workspace without `biome.json` is left alone.\n * - A top-level `markdown` or `yaml` key that is already present is the user's\n *   own setting and is kept as it is. Biome 2.5 rejects both keys, so one is\n *   only present when the user configured Biome 2.6 themselves.\n * - Missing keys go right after `css`, where the generators place them, or at\n *   the end when there is no `css` section.\n * - Idempotent: a second run finds both keys present and changes nothing.\n * - Biome 2.5 rejects both keys and then fails every `format` and `lint`\n *   target, so they are added only when the workspace runs Biome 2.6 or later\n *   once `nx migrate` finishes. Otherwise `biome.json` is left as it is and a\n *   next step says what to add after moving to Biome 2.6.\n */\n\nconst BIOME_CONFIG = 'biome.json';\n\nconst LANGUAGES = ['markdown', 'yaml'] as const;\n\nconst FORMATTER_OFF = { formatter: { enabled: false } };\n\nconst BIOME = '@biomejs/biome';\n\n/** First Biome release that accepts the `markdown` and `yaml` keys. */\nconst MIN_BIOME_VERSION = '2.6.0';\n\n/** Whether every version a semver range allows is Biome 2.6 or later. */\nconst allowsOnlyBiome26 = (specifier: unknown): boolean => {\n  if (typeof specifier !== 'string' || validRange(specifier) === null) {\n    return false;\n  }\n  const lowest = minVersion(specifier);\n  return lowest !== null && gte(lowest, MIN_BIOME_VERSION);\n};\n\n/**\n * Whether the workspace runs Biome 2.6 or later once `nx migrate` finishes.\n *\n * The version sync runs after this migration in the same `nx migrate`, so the\n * root `package.json` still holds the old Biome here. The check takes the lowest\n * version the declared range (or the catalog entry it references) allows, then\n * the version the sync will move Biome to. A tag, alias or missing declaration\n * counts only when the sync moves it.\n */\nconst runsBiome26AfterMigrate = async (tree: Tree): Promise<boolean> => {\n  if (!tree.exists('package.json')) {\n    return false;\n  }\n  const { dependencies, devDependencies } = readJson(tree, 'package.json');\n  const declared: unknown = devDependencies?.[BIOME] ?? dependencies?.[BIOME];\n  if (declared === undefined) {\n    return false;\n  }\n  const resolved = getDependencyVersionFromPackageJson(\n    tree,\n    BIOME,\n    'package.json',\n    ['devDependencies', 'dependencies'],\n  );\n  if (allowsOnlyBiome26(resolved)) {\n    return true;\n  }\n  return allowsOnlyBiome26(\n    syncedTsVersion(tree, await ownedDependencies(tree), BIOME, declared),\n  );\n};\n\nconst SKIPPED_NEXT_STEP =\n  'Biome stays below 2.6 in this workspace, and Biome 2.5 rejects the `markdown` and `yaml` keys, so biome.json was left as it is. ' +\n  'Biome 2.6 formats Markdown and YAML files by default. After you move `@biomejs/biome` to 2.6 or later, add ' +\n  '`\"markdown\": { \"formatter\": { \"enabled\": false } }` and `\"yaml\": { \"formatter\": { \"enabled\": false } }` to biome.json, ' +\n  'or the `format` target fails on generated README.md and YAML files.';\n\nexport default async function migration(\n  tree: Tree,\n): Promise<MigrationReturnObject> {\n  if (!tree.exists(BIOME_CONFIG)) {\n    return { nextSteps: [] };\n  }\n\n  const biome: Record<string, unknown> = readJson(tree, BIOME_CONFIG);\n  const missing = LANGUAGES.filter((language) => biome[language] === undefined);\n  if (missing.length === 0) {\n    return { nextSteps: [] };\n  }\n  if (!(await runsBiome26AfterMigrate(tree))) {\n    return { nextSteps: [SKIPPED_NEXT_STEP] };\n  }\n\n  const additions = Object.fromEntries(\n    missing.map((language) => [language, FORMATTER_OFF]),\n  );\n  const entries = Object.entries(biome);\n  const cssIndex = entries.findIndex(([key]) => key === 'css');\n  const insertAt = cssIndex === -1 ? entries.length : cssIndex + 1;\n  writeJson(\n    tree,\n    BIOME_CONFIG,\n    Object.fromEntries([\n      ...entries.slice(0, insertAt),\n      ...Object.entries(additions),\n      ...entries.slice(insertAt),\n    ]),\n  );\n\n  await formatFilesInSubtree(tree);\n\n  return { nextSteps: [] };\n}\n"],"names":["getDependencyVersionFromPackageJson","readJson","writeJson","gte","minVersion","validRange","formatFilesInSubtree","ownedDependencies","syncedTsVersion","BIOME_CONFIG","LANGUAGES","FORMATTER_OFF","formatter","enabled","BIOME","MIN_BIOME_VERSION","allowsOnlyBiome26","specifier","lowest","runsBiome26AfterMigrate","tree","exists","dependencies","devDependencies","declared","undefined","resolved","SKIPPED_NEXT_STEP","migration","nextSteps","biome","missing","filter","language","length","additions","Object","fromEntries","map","entries","cssIndex","findIndex","key","insertAt","slice"],"mappings":"AAAA;;;CAGC,GACD,SACEA,mCAAmC,EAEnCC,QAAQ,EAERC,SAAS,QACJ,aAAa;AACpB,SAASC,GAAG,EAAEC,UAAU,EAAEC,UAAU,QAAQ,SAAS;AACrD,SAASC,oBAAoB,QAAQ,2BAA2B;AAChE,SAASC,iBAAiB,QAAQ,iEAAiE;AACnG,SAASC,eAAe,QAAQ,mEAAmE;AAEnG;;;;;;;;;;;;;;;;;;;;CAoBC,GAED,MAAMC,eAAe;AAErB,MAAMC,YAAY;IAAC;IAAY;CAAO;AAEtC,MAAMC,gBAAgB;IAAEC,WAAW;QAAEC,SAAS;IAAM;AAAE;AAEtD,MAAMC,QAAQ;AAEd,qEAAqE,GACrE,MAAMC,oBAAoB;AAE1B,uEAAuE,GACvE,MAAMC,oBAAoB,CAACC;IACzB,IAAI,OAAOA,cAAc,YAAYZ,WAAWY,eAAe,MAAM;QACnE,OAAO;IACT;IACA,MAAMC,SAASd,WAAWa;IAC1B,OAAOC,WAAW,QAAQf,IAAIe,QAAQH;AACxC;AAEA;;;;;;;;CAQC,GACD,MAAMI,0BAA0B,OAAOC;IACrC,IAAI,CAACA,KAAKC,MAAM,CAAC,iBAAiB;QAChC,OAAO;IACT;IACA,MAAM,EAAEC,YAAY,EAAEC,eAAe,EAAE,GAAGtB,SAASmB,MAAM;IACzD,MAAMI,WAAoBD,iBAAiB,CAACT,MAAM,IAAIQ,cAAc,CAACR,MAAM;IAC3E,IAAIU,aAAaC,WAAW;QAC1B,OAAO;IACT;IACA,MAAMC,WAAW1B,oCACfoB,MACAN,OACA,gBACA;QAAC;QAAmB;KAAe;IAErC,IAAIE,kBAAkBU,WAAW;QAC/B,OAAO;IACT;IACA,OAAOV,kBACLR,gBAAgBY,MAAM,MAAMb,kBAAkBa,OAAON,OAAOU;AAEhE;AAEA,MAAMG,oBACJ,qIACA,gHACA,4HACA;AAEF,eAAe,eAAeC,UAC5BR,IAAU;IAEV,IAAI,CAACA,KAAKC,MAAM,CAACZ,eAAe;QAC9B,OAAO;YAAEoB,WAAW,EAAE;QAAC;IACzB;IAEA,MAAMC,QAAiC7B,SAASmB,MAAMX;IACtD,MAAMsB,UAAUrB,UAAUsB,MAAM,CAAC,CAACC,WAAaH,KAAK,CAACG,SAAS,KAAKR;IACnE,IAAIM,QAAQG,MAAM,KAAK,GAAG;QACxB,OAAO;YAAEL,WAAW,EAAE;QAAC;IACzB;IACA,IAAI,CAAE,MAAMV,wBAAwBC,OAAQ;QAC1C,OAAO;YAAES,WAAW;gBAACF;aAAkB;QAAC;IAC1C;IAEA,MAAMQ,YAAYC,OAAOC,WAAW,CAClCN,QAAQO,GAAG,CAAC,CAACL,WAAa;YAACA;YAAUtB;SAAc;IAErD,MAAM4B,UAAUH,OAAOG,OAAO,CAACT;IAC/B,MAAMU,WAAWD,QAAQE,SAAS,CAAC,CAAC,CAACC,IAAI,GAAKA,QAAQ;IACtD,MAAMC,WAAWH,aAAa,CAAC,IAAID,QAAQL,MAAM,GAAGM,WAAW;IAC/DtC,UACEkB,MACAX,cACA2B,OAAOC,WAAW,CAAC;WACdE,QAAQK,KAAK,CAAC,GAAGD;WACjBP,OAAOG,OAAO,CAACJ;WACfI,QAAQK,KAAK,CAACD;KAClB;IAGH,MAAMrC,qBAAqBc;IAE3B,OAAO;QAAES,WAAW,EAAE;IAAC;AACzB"}

package/src/migrations/v1.0.15/0001-py-agent-pillow-override/migration.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../../../../../../../packages/nx-plugin/src/migrations/v1.0.15/0001-py-agent-pillow-override/migration.ts"],"sourcesContent":["/**\n * Copyright Amazon.com, Inc. or its affiliates. All Rights Reserved.\n * SPDX-License-Identifier: Apache-2.0\n */\nimport {\n  getProjects,\n  joinPathFragments,\n  type MigrationReturnObject,\n  type Tree,\n} from '@nx/devkit';\nimport { formatFilesInSubtree } from '../../../utils/format.js';\nimport type { UVPyprojectToml } from '../../../utils/nxlv-python.js';\nimport { addUvOverrideDependencies } from '../../../utils/py.js';\nimport { tryReadToml } from '../../../utils/toml.js';\n\n/**\n * Add the strands-agents-tools pillow override to the workspace root\n * pyproject.toml uv override-dependencies.\n *\n * strands-agents-tools caps pillow below the release that fixes its current\n * CVEs, and uv reads `[tool.uv] override-dependencies` only from the workspace\n * root, so the root carries the override (`PY_UV_OVERRIDES`). It applies when\n * any project's `[project].dependencies` names strands-agents-tools. A user\n * override for the same package is kept as written. `uv.lock` is left to the\n * user, as the version sync leaves it, so `nextSteps` asks for `uv sync` when\n * the root changes.\n */\nexport default async function migration(\n  tree: Tree,\n): Promise<MigrationReturnObject> {\n  const nextSteps: string[] = [];\n\n  if (tree.exists('pyproject.toml')) {\n    const requirements = [...getProjects(tree).values()].flatMap(({ root }) => {\n      const dependencies = (\n        tryReadToml(tree, joinPathFragments(root, 'pyproject.toml')) as\n          | UVPyprojectToml\n          | undefined\n      )?.project?.dependencies;\n      return Array.isArray(dependencies) ? dependencies : [];\n    });\n    if (addUvOverrideDependencies(tree, requirements)) {\n      nextSteps.push(\n        'The workspace root pyproject.toml now overrides a dependency of strands-agents-tools. Run `uv sync` to update uv.lock.',\n      );\n    }\n  }\n\n  await formatFilesInSubtree(tree);\n\n  return { nextSteps };\n}\n"],"names":["getProjects","joinPathFragments","formatFilesInSubtree","addUvOverrideDependencies","tryReadToml","migration","tree","nextSteps","exists","requirements","values","flatMap","root","dependencies","project","Array","isArray","push"],"mappings":"AAAA;;;CAGC,GACD,SACEA,WAAW,EACXC,iBAAiB,QAGZ,aAAa;AACpB,SAASC,oBAAoB,QAAQ,2BAA2B;AAEhE,SAASC,yBAAyB,QAAQ,uBAAuB;AACjE,SAASC,WAAW,QAAQ,yBAAyB;AAErD;;;;;;;;;;;CAWC,GACD,eAAe,eAAeC,UAC5BC,IAAU;IAEV,MAAMC,YAAsB,EAAE;IAE9B,IAAID,KAAKE,MAAM,CAAC,mBAAmB;QACjC,MAAMC,eAAe;eAAIT,YAAYM,MAAMI,MAAM;SAAG,CAACC,OAAO,CAAC,CAAC,EAAEC,IAAI,EAAE;YACpE,MAAMC,eACJT,YAAYE,MAAML,kBAAkBW,MAAM,oBAGzCE,SAASD;YACZ,OAAOE,MAAMC,OAAO,CAACH,gBAAgBA,eAAe,EAAE;QACxD;QACA,IAAIV,0BAA0BG,MAAMG,eAAe;YACjDF,UAAUU,IAAI,CACZ;QAEJ;IACF;IAEA,MAAMf,qBAAqBI;IAE3B,OAAO;QAAEC;IAAU;AACrB"}

package/src/migrations/v1.1.1/0001-ts-agent-guardrails-synth-input/migration.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../../../../../../../packages/nx-plugin/src/migrations/v1.1.1/0001-ts-agent-guardrails-synth-input/migration.ts"],"sourcesContent":["/**\n * Copyright Amazon.com, Inc. or its affiliates. All Rights Reserved.\n * SPDX-License-Identifier: Apache-2.0\n */\nimport {\n  getProjects,\n  joinPathFragments,\n  type MigrationReturnObject,\n  type Tree,\n} from '@nx/devkit';\nimport { TS_AGENT_GENERATOR_INFO } from '../../../ts/agent/generator.js';\nimport { TS_AGENT_GUARDRAILS_GENERATOR_INFO } from '../../../ts/agent/guardrails/generator.js';\nimport { addGuardrailPolicySynthInputs } from '../../../ts/agent/guardrails/synth-inputs.js';\nimport { formatFilesInSubtree } from '../../../utils/format.js';\nimport type { ComponentMetadata } from '../../../utils/nx.js';\n\n/**\n * Add each CDK-guarded TypeScript agent's guardrail.json to the `synth` inputs\n * of the CDK infrastructure projects.\n *\n * The CDK guardrail construct reads guardrail.json at synth time to build the\n * guardrail's rules and version description. The file belongs to the agent's\n * project and no task output the infrastructure's `synth` hashes includes it,\n * so without an explicit input a policy change is served from the Nx cache\n * and `deploy-ci` ships the stale template.\n *\n * Guarded agents are found from the `ts#agent#guardrails` components in\n * project metadata, each paired with the `ts#agent` component of the same\n * name, and kept when that agent's IaC is CDK. An infrastructure project\n * whose `synth` has no `inputs` array, or no `synth` target, is left\n * unchanged and reported via `nextSteps`.\n */\nexport default async function migration(\n  tree: Tree,\n): Promise<MigrationReturnObject> {\n  const policyPaths: string[] = [];\n  for (const project of getProjects(tree).values()) {\n    const components: ComponentMetadata[] =\n      (project.metadata as { components?: ComponentMetadata[] } | undefined)\n        ?.components ?? [];\n    for (const guardrail of components.filter(\n      (c) => c.generator === TS_AGENT_GUARDRAILS_GENERATOR_INFO.id,\n    )) {\n      const agent = components.find(\n        (c) =>\n          c.generator === TS_AGENT_GENERATOR_INFO.id &&\n          (c.name ?? 'agent') === guardrail.name,\n      );\n      if (agent?.iac === 'cdk') {\n        policyPaths.push(\n          joinPathFragments(project.root, guardrail.path, 'guardrail.json'),\n        );\n      }\n    }\n  }\n\n  const nextSteps = addGuardrailPolicySynthInputs(tree, policyPaths);\n\n  await formatFilesInSubtree(tree);\n\n  return { nextSteps };\n}\n"],"names":["getProjects","joinPathFragments","TS_AGENT_GENERATOR_INFO","TS_AGENT_GUARDRAILS_GENERATOR_INFO","addGuardrailPolicySynthInputs","formatFilesInSubtree","migration","tree","policyPaths","project","values","components","metadata","guardrail","filter","c","generator","id","agent","find","name","iac","push","root","path","nextSteps"],"mappings":"AAAA;;;CAGC,GACD,SACEA,WAAW,EACXC,iBAAiB,QAGZ,aAAa;AACpB,SAASC,uBAAuB,QAAQ,iCAAiC;AACzE,SAASC,kCAAkC,QAAQ,4CAA4C;AAC/F,SAASC,6BAA6B,QAAQ,+CAA+C;AAC7F,SAASC,oBAAoB,QAAQ,2BAA2B;AAGhE;;;;;;;;;;;;;;;CAeC,GACD,eAAe,eAAeC,UAC5BC,IAAU;IAEV,MAAMC,cAAwB,EAAE;IAChC,KAAK,MAAMC,WAAWT,YAAYO,MAAMG,MAAM,GAAI;QAChD,MAAMC,aACJ,AAACF,QAAQG,QAAQ,EACbD,cAAc,EAAE;QACtB,KAAK,MAAME,aAAaF,WAAWG,MAAM,CACvC,CAACC,IAAMA,EAAEC,SAAS,KAAKb,mCAAmCc,EAAE,EAC3D;YACD,MAAMC,QAAQP,WAAWQ,IAAI,CAC3B,CAACJ,IACCA,EAAEC,SAAS,KAAKd,wBAAwBe,EAAE,IAC1C,AAACF,CAAAA,EAAEK,IAAI,IAAI,OAAM,MAAOP,UAAUO,IAAI;YAE1C,IAAIF,OAAOG,QAAQ,OAAO;gBACxBb,YAAYc,IAAI,CACdrB,kBAAkBQ,QAAQc,IAAI,EAAEV,UAAUW,IAAI,EAAE;YAEpD;QACF;IACF;IAEA,MAAMC,YAAYrB,8BAA8BG,MAAMC;IAEtD,MAAMH,qBAAqBE;IAE3B,OAAO;QAAEkB;IAAU;AACrB"}

package/src/migrations/v1.3.0/0001-ts-agent-guardrails-terraform-version-retention/migration.d.ts

@@ -0,0 +1,6 @@
+/**
+ * Copyright Amazon.com, Inc. or its affiliates. All Rights Reserved.
+ * SPDX-License-Identifier: Apache-2.0
+ */
+import { type MigrationReturnObject, type Tree } from '@nx/devkit';
+export default function migration(tree: Tree): Promise<MigrationReturnObject>;

package/src/migrations/v1.3.0/0001-ts-agent-guardrails-terraform-version-retention/migration.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../../../../../../../packages/nx-plugin/src/migrations/v1.3.0/0001-ts-agent-guardrails-terraform-version-retention/migration.ts"],"sourcesContent":["/**\n * Copyright Amazon.com, Inc. or its affiliates. All Rights Reserved.\n * SPDX-License-Identifier: Apache-2.0\n */\nimport {\n  getProjects,\n  joinPathFragments,\n  type MigrationReturnObject,\n  type Tree,\n} from '@nx/devkit';\nimport { TS_AGENT_GENERATOR_INFO } from '../../../ts/agent/generator.js';\nimport { TS_AGENT_GUARDRAILS_GENERATOR_INFO } from '../../../ts/agent/guardrails/generator.js';\nimport {\n  applyGritQL,\n  GRIT_INSERT_PLACEHOLDER,\n  insertViaGritQL,\n  matchGritQL,\n} from '../../../utils/ast.js';\nimport { formatFilesInSubtree } from '../../../utils/format.js';\nimport { kebabCase, toClassName } from '../../../utils/names.js';\nimport type { ComponentMetadata } from '../../../utils/nx.js';\nimport {\n  PACKAGES_DIR,\n  SHARED_TERRAFORM_DIR,\n} from '../../../utils/shared-constructs-constants.js';\nimport { TERRAFORM_VERSIONS } from '../../../utils/versions.js';\n\n/**\n * Keep a replaced guardrail version for 15 seconds after the runtime-config\n * deployment in each Terraform guardrail module of a `ts#agent#guardrails`\n * agent.\n *\n * When `guardrail.json` changes, `aws_bedrock_guardrail_version.this` is\n * replaced with `create_before_destroy`, and Terraform destroyed the old\n * version as soon as the runtime-config deployment completed. Agents cache\n * their runtime-config entry for 5 seconds, so a request in that window used\n * the deleted version and failed. The module now has a `time_sleep` whose\n * `triggers` hold the guardrail ID and version, and the runtime-config entry\n * reads both from those triggers. On a version change the sleep is replaced\n * too: the deposed sleep is destroyed after everything that depends on the new\n * one (the entry and, through the root module's `depends_on`, the\n * runtime-config deployment), waits its 15-second `destroy_duration`, and only\n * then is the deposed version, which it depends on, destroyed.\n *\n * Guarded agents are found from the `ts#agent#guardrails` components in project\n * metadata, each paired with the `ts#agent` component of the same name whose\n * IaC is Terraform. The module is written with `KeepExisting`, so an upgraded\n * workspace keeps the older module until this runs. A module that no longer\n * has the generated shape is left untouched and reported via `nextSteps` with\n * the lines to add.\n */\n\nconst TERRAFORM_GUARDRAILS_DIR = `${PACKAGES_DIR}/${SHARED_TERRAFORM_DIR}/src/app/guardrails`;\n\nconst hcl = (pattern: string) => `language hcl\\n${pattern}`;\n\nconst TIME_SLEEP = '`resource \"time_sleep\" \"version_retention\" { $_ }`';\n\n/** Indented as `terraform fmt` writes it, since `.tf` files are not reformatted. */\nconst TIME_PROVIDER_TEXT = `    time = {\n      source  = \"hashicorp/time\"\n      version = \"${TERRAFORM_VERSIONS.time}\"\n    }`;\n\nconst TIME_SLEEP_TEXT = `resource \"time_sleep\" \"version_retention\" {\n  destroy_duration = \"15s\"\n\n  triggers = {\n    guardrail_id      = aws_bedrock_guardrail.this.guardrail_id\n    guardrail_version = aws_bedrock_guardrail_version.this.version\n  }\n\n  lifecycle {\n    create_before_destroy = true\n  }\n}`;\n\nconst ENTRY_ID = 'guardrailId = aws_bedrock_guardrail.this.guardrail_id';\nconst ENTRY_VERSION =\n  'guardrailVersion = aws_bedrock_guardrail_version.this.version';\n\n/** Every shape the migration rewrites, so a module missing one is reported rather than half-migrated. */\nconst REQUIRED_SHAPES = [\n  '`required_providers { $_ }`',\n  '`resource \"aws_bedrock_guardrail_version\" \"this\" { $_ }`',\n  `\\`module \"add_guardrail_to_runtime_config\" { $body }\\` where { $body <: and { contains \\`${ENTRY_ID}\\`, contains \\`${ENTRY_VERSION}\\` } }`,\n];\n\nconst divergedMessage = (filePath: string) =>\n  `${filePath}: has diverged from the generated shape - left untouched. To keep a replaced guardrail version until agents have read the new one, add the time provider to required_providers:\n\n${TIME_PROVIDER_TEXT}\n\nadd this resource:\n\n${TIME_SLEEP_TEXT}\n\nand make the runtime-config entry read guardrailId = time_sleep.version_retention.triggers.guardrail_id and guardrailVersion = time_sleep.version_retention.triggers.guardrail_version.`;\n\n/** The Terraform guardrail module of each Terraform-deployed `ts#agent#guardrails` agent. */\nconst guardedTerraformModules = (tree: Tree): string[] => {\n  const files = new Set<string>();\n  for (const project of getProjects(tree).values()) {\n    const components: ComponentMetadata[] =\n      (project.metadata as { components?: ComponentMetadata[] } | undefined)\n        ?.components ?? [];\n    for (const guardrail of components.filter(\n      (c) => c.generator === TS_AGENT_GUARDRAILS_GENERATOR_INFO.id,\n    )) {\n      const agent = components.find(\n        (c) =>\n          c.generator === TS_AGENT_GENERATOR_INFO.id &&\n          (c.name ?? 'agent') === guardrail.name,\n      );\n      if (agent?.iac !== 'terraform') {\n        continue;\n      }\n      const nameKebabCase = kebabCase(\n        agent.rc ?? toClassName(agent.name ?? 'agent'),\n      );\n      files.add(\n        joinPathFragments(\n          TERRAFORM_GUARDRAILS_DIR,\n          nameKebabCase,\n          `${nameKebabCase}-guardrail.tf`,\n        ),\n      );\n    }\n  }\n  return [...files];\n};\n\nconst migrateModule = async (\n  tree: Tree,\n  filePath: string,\n  nextSteps: string[],\n): Promise<void> => {\n  if (await matchGritQL(tree, filePath, hcl(TIME_SLEEP))) {\n    return; // Already migrated.\n  }\n\n  const shapeChecks = await Promise.all(\n    REQUIRED_SHAPES.map((shape) => matchGritQL(tree, filePath, hcl(shape))),\n  );\n  if (shapeChecks.includes(false)) {\n    nextSteps.push(divergedMessage(filePath));\n    return;\n  }\n\n  // Appended after the existing providers, so an entry the user changed is kept.\n  await insertViaGritQL(\n    tree,\n    filePath,\n    hcl(\n      `\\`required_providers { $body }\\` => \\`required_providers {\\n    $body\\n    ${GRIT_INSERT_PLACEHOLDER}\\n  }\\`` +\n        ' where { $body <: not contains `time = { $_ }` }',\n    ),\n    // The placeholder already sits at the entry's indentation.\n    TIME_PROVIDER_TEXT.replace(/^ {4}/, ''),\n  );\n\n  // After the version it keeps, where the generator writes it.\n  await insertViaGritQL(\n    tree,\n    filePath,\n    hcl(\n      `\\`resource \"aws_bedrock_guardrail_version\" \"this\" { $body }\\` => \\`resource \"aws_bedrock_guardrail_version\" \"this\" {\\n  $body\\n}\\n\\n${GRIT_INSERT_PLACEHOLDER}\\``,\n    ),\n    TIME_SLEEP_TEXT,\n  );\n\n  // Only the entry reads through the sleep; the module's outputs are unchanged.\n  await applyGritQL(\n    tree,\n    filePath,\n    hcl(\n      `\\`module \"add_guardrail_to_runtime_config\" { $body }\\` where { $body <: contains bubble \\`${ENTRY_ID}\\` => \\`guardrailId = time_sleep.version_retention.triggers.guardrail_id\\`, $body <: contains bubble \\`${ENTRY_VERSION}\\` => \\`guardrailVersion = time_sleep.version_retention.triggers.guardrail_version\\` }`,\n    ),\n  );\n};\n\nexport default async function migration(\n  tree: Tree,\n): Promise<MigrationReturnObject> {\n  const nextSteps: string[] = [];\n\n  for (const filePath of guardedTerraformModules(tree)) {\n    if (!tree.exists(filePath)) {\n      continue; // The guardrail module was removed or never added.\n    }\n    await migrateModule(tree, filePath, nextSteps);\n  }\n\n  await formatFilesInSubtree(tree);\n\n  return { nextSteps };\n}\n"],"names":["getProjects","joinPathFragments","TS_AGENT_GENERATOR_INFO","TS_AGENT_GUARDRAILS_GENERATOR_INFO","applyGritQL","GRIT_INSERT_PLACEHOLDER","insertViaGritQL","matchGritQL","formatFilesInSubtree","kebabCase","toClassName","PACKAGES_DIR","SHARED_TERRAFORM_DIR","TERRAFORM_VERSIONS","TERRAFORM_GUARDRAILS_DIR","hcl","pattern","TIME_SLEEP","TIME_PROVIDER_TEXT","time","TIME_SLEEP_TEXT","ENTRY_ID","ENTRY_VERSION","REQUIRED_SHAPES","divergedMessage","filePath","guardedTerraformModules","tree","files","Set","project","values","components","metadata","guardrail","filter","c","generator","id","agent","find","name","iac","nameKebabCase","rc","add","migrateModule","nextSteps","shapeChecks","Promise","all","map","shape","includes","push","replace","migration","exists"],"mappings":"AAAA;;;CAGC,GACD,SACEA,WAAW,EACXC,iBAAiB,QAGZ,aAAa;AACpB,SAASC,uBAAuB,QAAQ,iCAAiC;AACzE,SAASC,kCAAkC,QAAQ,4CAA4C;AAC/F,SACEC,WAAW,EACXC,uBAAuB,EACvBC,eAAe,EACfC,WAAW,QACN,wBAAwB;AAC/B,SAASC,oBAAoB,QAAQ,2BAA2B;AAChE,SAASC,SAAS,EAAEC,WAAW,QAAQ,0BAA0B;AAEjE,SACEC,YAAY,EACZC,oBAAoB,QACf,gDAAgD;AACvD,SAASC,kBAAkB,QAAQ,6BAA6B;AAEhE;;;;;;;;;;;;;;;;;;;;;;;CAuBC,GAED,MAAMC,2BAA2B,GAAGH,aAAa,CAAC,EAAEC,qBAAqB,mBAAmB,CAAC;AAE7F,MAAMG,MAAM,CAACC,UAAoB,CAAC,cAAc,EAAEA,SAAS;AAE3D,MAAMC,aAAa;AAEnB,kFAAkF,GAClF,MAAMC,qBAAqB,CAAC;;iBAEX,EAAEL,mBAAmBM,IAAI,CAAC;KACtC,CAAC;AAEN,MAAMC,kBAAkB,CAAC;;;;;;;;;;;CAWxB,CAAC;AAEF,MAAMC,WAAW;AACjB,MAAMC,gBACJ;AAEF,uGAAuG,GACvG,MAAMC,kBAAkB;IACtB;IACA;IACA,CAAC,yFAAyF,EAAEF,SAAS,eAAe,EAAEC,cAAc,MAAM,CAAC;CAC5I;AAED,MAAME,kBAAkB,CAACC,WACvB,GAAGA,SAAS;;AAEd,EAAEP,mBAAmB;;;;AAIrB,EAAEE,gBAAgB;;uLAEqK,CAAC;AAExL,2FAA2F,GAC3F,MAAMM,0BAA0B,CAACC;IAC/B,MAAMC,QAAQ,IAAIC;IAClB,KAAK,MAAMC,WAAW9B,YAAY2B,MAAMI,MAAM,GAAI;QAChD,MAAMC,aACJ,AAACF,QAAQG,QAAQ,EACbD,cAAc,EAAE;QACtB,KAAK,MAAME,aAAaF,WAAWG,MAAM,CACvC,CAACC,IAAMA,EAAEC,SAAS,KAAKlC,mCAAmCmC,EAAE,EAC3D;YACD,MAAMC,QAAQP,WAAWQ,IAAI,CAC3B,CAACJ,IACCA,EAAEC,SAAS,KAAKnC,wBAAwBoC,EAAE,IAC1C,AAACF,CAAAA,EAAEK,IAAI,IAAI,OAAM,MAAOP,UAAUO,IAAI;YAE1C,IAAIF,OAAOG,QAAQ,aAAa;gBAC9B;YACF;YACA,MAAMC,gBAAgBlC,UACpB8B,MAAMK,EAAE,IAAIlC,YAAY6B,MAAME,IAAI,IAAI;YAExCb,MAAMiB,GAAG,CACP5C,kBACEa,0BACA6B,eACA,GAAGA,cAAc,aAAa,CAAC;QAGrC;IACF;IACA,OAAO;WAAIf;KAAM;AACnB;AAEA,MAAMkB,gBAAgB,OACpBnB,MACAF,UACAsB;IAEA,IAAI,MAAMxC,YAAYoB,MAAMF,UAAUV,IAAIE,cAAc;QACtD,QAAQ,oBAAoB;IAC9B;IAEA,MAAM+B,cAAc,MAAMC,QAAQC,GAAG,CACnC3B,gBAAgB4B,GAAG,CAAC,CAACC,QAAU7C,YAAYoB,MAAMF,UAAUV,IAAIqC;IAEjE,IAAIJ,YAAYK,QAAQ,CAAC,QAAQ;QAC/BN,UAAUO,IAAI,CAAC9B,gBAAgBC;QAC/B;IACF;IAEA,+EAA+E;IAC/E,MAAMnB,gBACJqB,MACAF,UACAV,IACE,CAAC,2EAA2E,EAAEV,wBAAwB,OAAO,CAAC,GAC5G,qDAEJ,2DAA2D;IAC3Da,mBAAmBqC,OAAO,CAAC,SAAS;IAGtC,6DAA6D;IAC7D,MAAMjD,gBACJqB,MACAF,UACAV,IACE,CAAC,oIAAoI,EAAEV,wBAAwB,EAAE,CAAC,GAEpKe;IAGF,8EAA8E;IAC9E,MAAMhB,YACJuB,MACAF,UACAV,IACE,CAAC,0FAA0F,EAAEM,SAAS,uGAAuG,EAAEC,cAAc,sFAAsF,CAAC;AAG1T;AAEA,eAAe,eAAekC,UAC5B7B,IAAU;IAEV,MAAMoB,YAAsB,EAAE;IAE9B,KAAK,MAAMtB,YAAYC,wBAAwBC,MAAO;QACpD,IAAI,CAACA,KAAK8B,MAAM,CAAChC,WAAW;YAC1B,UAAU,mDAAmD;QAC/D;QACA,MAAMqB,cAAcnB,MAAMF,UAAUsB;IACtC;IAEA,MAAMvC,qBAAqBmB;IAE3B,OAAO;QAAEoB;IAAU;AACrB"}

package/src/preset/__snapshots__/generator.spec.ts.snap

@@ -259,7 +259,7 @@ export default {
 
 exports[`preset generator > should run successfully > biome.json 1`] = `
 "{
-  "$schema": "https://biomejs.dev/schemas/2.5.15/schema.json",
+  "$schema": "https://biomejs.dev/schemas/2.6.3/schema.json",
   "root": true,
   "formatter": {
     "enabled": true,
@@ -284,6 +284,16 @@ exports[`preset generator > should run successfully > biome.json 1`] = `
       "enabled": false
     }
   },
+  "markdown": {
+    "formatter": {
+      "enabled": false
+    }
+  },
+  "yaml": {
+    "formatter": {
+      "enabled": false
+    }
+  },
   "linter": {
     "enabled": true,
     "rules": {
@@ -424,11 +434,11 @@ onlyBuiltDependencies:
   - sharp
 catalogMode: strict
 catalog:
-  nx: 23.3.0
-  '@nx/js': 23.3.0
-  '@nx/workspace': 23.3.0
+  nx: 23.3.1
+  '@nx/js': 23.3.1
+  '@nx/workspace': 23.3.1
   typescript: ~6.0.3
-  '@biomejs/biome': 2.5.15
+  '@biomejs/biome': 2.6.3
   '@aws/nx-plugin': ^0.0.0
   '@aws/nx-plugin-mcp': ^0.0.0
 "

package/src/py/agent/__snapshots__/generator.constructs.spec.ts.snap

@@ -763,19 +763,19 @@ name = "proj.test_project"
 version = "0.1.0"
 dependencies = [
   "proj-agent-connection",
-  "aws-lambda-powertools==3.36.0",
+  "aws-lambda-powertools==3.37.0",
   "aws-opentelemetry-distro==0.21.0",
-  "bedrock-agentcore==1.24.2",
-  "boto3==1.43.115",
-  "fastapi==0.150.0",
+  "bedrock-agentcore==1.25.0",
+  "boto3==1.43.118",
+  "fastapi==0.162.0",
   "mcp==1.28.1",
-  "strands-agents==1.61.1",
-  "strands-agents-tools==0.8.9",
+  "strands-agents==1.62.0",
+  "strands-agents-tools==0.8.10",
   "uvicorn==0.54.0"
 ]
 
 [dependency-groups]
-dev = [ "fastapi[standard]==0.150.0" ]
+dev = [ "fastapi[standard]==0.162.0" ]
 
 [tool.uv]
 dev-dependencies = [ ]

package/src/py/agent/__snapshots__/generator.frameworks.spec.ts.snap

@@ -701,15 +701,15 @@ name = "proj.test_project"
 version = "0.1.0"
 dependencies = [
   "proj-agent-connection",
-  "aws-lambda-powertools==3.36.0",
+  "aws-lambda-powertools==3.37.0",
   "aws-opentelemetry-distro==0.21.0",
-  "bedrock-agentcore==1.24.2",
-  "boto3==1.43.115",
-  "fastapi==0.150.0",
+  "bedrock-agentcore==1.25.0",
+  "boto3==1.43.118",
+  "fastapi==0.162.0",
   "mcp==1.28.1",
-  "langchain==1.4.6",
+  "langchain==1.4.7",
   "langchain-aws==1.9.0",
-  "langgraph==1.2.16",
+  "langgraph==1.2.17",
   "langgraph-checkpoint-sqlite==3.1.2",
   "aiosqlite==0.22.1",
   "ag-ui-protocol==0.1.22",
@@ -718,7 +718,7 @@ dependencies = [
 ]
 
 [dependency-groups]
-dev = [ "fastapi[standard]==0.150.0" ]
+dev = [ "fastapi[standard]==0.162.0" ]
 
 [tool.uv]
 dev-dependencies = [ ]

package/src/py/agent/__snapshots__/generator.protocols.spec.ts.snap

@@ -5,7 +5,7 @@ exports[`py#agent generator > should create DynamoDB checkpoint table and S3 off
   required_providers {
     aws = {
       source  = "hashicorp/aws"
-      version = "6.69.1"
+      version = "6.70.0"
     }
     random = {
       source  = "hashicorp/random"
@@ -381,7 +381,7 @@ exports[`py#agent generator > should match snapshot for Terraform generated file
   required_providers {
     aws = {
       source  = "hashicorp/aws"
-      version = "6.69.1"
+      version = "6.70.0"
     }
     random = {
       source  = "hashicorp/random"
@@ -704,7 +704,7 @@ exports[`py#agent generator > should match snapshot for Terraform generated file
   required_providers {
     aws = {
       source  = "hashicorp/aws"
-      version = "6.69.1"
+      version = "6.70.0"
     }
     null = {
       source  = "hashicorp/null"
@@ -1063,7 +1063,7 @@ resource "null_resource" "runtime_ready" {
 
   provisioner "local-exec" {
     command = <<-EOT
-      uv run --with boto3==1.43.115 python -c "
+      uv run --with boto3==1.43.118 python -c "
 import boto3
 import json
 import os

package/src/py/agent/guardrails/__snapshots__/generator.spec.ts.snap

@@ -559,7 +559,7 @@ exports[`py#agent#guardrails generator > framework langchain > protocol a2a > sh
   required_providers {
     aws = {
       source  = "hashicorp/aws"
-      version = "6.69.1"
+      version = "6.70.0"
     }
     random = {
       source  = "hashicorp/random"
@@ -1242,7 +1242,7 @@ exports[`py#agent#guardrails generator > framework langchain > protocol ag-ui >
   required_providers {
     aws = {
       source  = "hashicorp/aws"
-      version = "6.69.1"
+      version = "6.70.0"
     }
     random = {
       source  = "hashicorp/random"
@@ -1925,7 +1925,7 @@ exports[`py#agent#guardrails generator > framework langchain > protocol http > s
   required_providers {
     aws = {
       source  = "hashicorp/aws"
-      version = "6.69.1"
+      version = "6.70.0"
     }
     random = {
       source  = "hashicorp/random"
@@ -2514,7 +2514,7 @@ exports[`py#agent#guardrails generator > framework strands > protocol a2a > shou
   required_providers {
     aws = {
       source  = "hashicorp/aws"
-      version = "6.69.1"
+      version = "6.70.0"
     }
     random = {
       source  = "hashicorp/random"
@@ -3099,7 +3099,7 @@ exports[`py#agent#guardrails generator > framework strands > protocol ag-ui > sh
   required_providers {
     aws = {
       source  = "hashicorp/aws"
-      version = "6.69.1"
+      version = "6.70.0"
     }
     random = {
       source  = "hashicorp/random"
@@ -3688,7 +3688,7 @@ exports[`py#agent#guardrails generator > framework strands > protocol http > sho
   required_providers {
     aws = {
       source  = "hashicorp/aws"
-      version = "6.69.1"
+      version = "6.70.0"
     }
     random = {
       source  = "hashicorp/random"

package/src/py/dynamodb/__snapshots__/generator.spec.ts.snap

@@ -35,7 +35,7 @@ exports[`py#dynamodb generator > should generate terraform modules when iac is t
   required_providers {
     aws = {
       source  = "hashicorp/aws"
-      version = "6.69.1"
+      version = "6.70.0"
     }
   }
 }
@@ -232,7 +232,7 @@ exports[`py#dynamodb generator > should generate terraform modules when iac is t
   required_providers {
     aws = {
       source  = "hashicorp/aws"
-      version = "6.69.1"
+      version = "6.70.0"
     }
     random = {
       source  = "hashicorp/random"

package/src/py/fast-api/__snapshots__/generator.terraform.spec.ts.snap

@@ -11,7 +11,7 @@ terraform {
   required_providers {
     aws = {
       source  = "hashicorp/aws"
-      version = "6.69.1"
+      version = "6.70.0"
     }
   }
 }
@@ -262,7 +262,7 @@ output "api_log_group_arn" {
     }
     aws = {
       source  = "hashicorp/aws"
-      version = "6.69.1"
+      version = "6.70.0"
     }
     random = {
       source  = "hashicorp/random"
@@ -908,7 +908,7 @@ terraform {
   required_providers {
     aws = {
       source  = "hashicorp/aws"
-      version = "6.69.1"
+      version = "6.70.0"
     }
   }
 }
@@ -1159,7 +1159,7 @@ output "api_log_group_arn" {
     }
     aws = {
       source  = "hashicorp/aws"
-      version = "6.69.1"
+      version = "6.70.0"
     }
     random = {
       source  = "hashicorp/random"
@@ -1878,7 +1878,7 @@ terraform {
   required_providers {
     aws = {
       source  = "hashicorp/aws"
-      version = "6.69.1"
+      version = "6.70.0"
     }
   }
 }
@@ -2129,7 +2129,7 @@ output "api_log_group_arn" {
     }
     aws = {
       source  = "hashicorp/aws"
-      version = "6.69.1"
+      version = "6.70.0"
     }
     random = {
       source  = "hashicorp/random"
@@ -2752,7 +2752,7 @@ terraform {
   required_providers {
     aws = {
       source  = "hashicorp/aws"
-      version = "6.69.1"
+      version = "6.70.0"
     }
     random = {
       source  = "hashicorp/random"
@@ -3065,7 +3065,7 @@ output "waf_web_acl_arn" {
     }
     aws = {
       source  = "hashicorp/aws"
-      version = "6.69.1"
+      version = "6.70.0"
     }
     random = {
       source  = "hashicorp/random"
@@ -4162,7 +4162,7 @@ terraform {
   required_providers {
     aws = {
       source  = "hashicorp/aws"
-      version = "6.69.1"
+      version = "6.70.0"
     }
     random = {
       source  = "hashicorp/random"
@@ -4475,7 +4475,7 @@ output "waf_web_acl_arn" {
     }
     aws = {
       source  = "hashicorp/aws"
-      version = "6.69.1"
+      version = "6.70.0"
     }
     random = {
       source  = "hashicorp/random"
@@ -5561,7 +5561,7 @@ terraform {
   required_providers {
     aws = {
       source  = "hashicorp/aws"
-      version = "6.69.1"
+      version = "6.70.0"
     }
     random = {
       source  = "hashicorp/random"
@@ -5874,7 +5874,7 @@ output "waf_web_acl_arn" {
     }
     aws = {
       source  = "hashicorp/aws"
-      version = "6.69.1"
+      version = "6.70.0"
     }
     random = {
       source  = "hashicorp/random"

package/src/py/lambda-function/__snapshots__/generator.spec.ts.snap

@@ -71,7 +71,7 @@ exports[`lambda-handler project generator > terraform iac > should generate terr
   required_providers {
     aws = {
       source  = "hashicorp/aws"
-      version = "6.69.1"
+      version = "6.70.0"
     }
     archive = {
       source  = "hashicorp/archive"
@@ -256,7 +256,7 @@ exports[`lambda-handler project generator > terraform iac > should match snapsho
   required_providers {
     aws = {
       source  = "hashicorp/aws"
-      version = "6.69.1"
+      version = "6.70.0"
     }
     archive = {
       source  = "hashicorp/archive"