@aws/nx-plugin 1.3.0 → 1.3.2

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@aws/nx-plugin",
-  "version": "1.3.0",
+  "version": "1.3.2",
   "repository": {
     "type": "git",
     "url": "https://github.com/awslabs/nx-plugin-for-aws.git",
@@ -36,21 +36,21 @@
     "node": "^22.13.0 || ^24.0.0 || >=26.0.0"
   },
   "peerDependencies": {
-    "nx": "23.3.0"
+    "nx": "23.3.1"
   },
   "dependencies": {
     "@apidevtools/swagger-parser": "12.1.0",
-    "@astral-sh/ruff-wasm-nodejs": "0.17.1",
-    "@biomejs/js-api": "6.0.0",
-    "@biomejs/wasm-nodejs": "2.5.15",
+    "@astral-sh/ruff-wasm-nodejs": "0.17.2",
+    "@biomejs/js-api": "6.1.0",
+    "@biomejs/wasm-nodejs": "2.6.3",
     "@getgrit/gritql": "0.0.3",
     "@iarna/toml": "2.2.5",
-    "@modelcontextprotocol/sdk": "1.32.1",
-    "@nx/devkit": "23.3.0",
-    "@nx/js": "23.3.0",
-    "@nx/react": "23.3.0",
-    "@nx/vite": "23.3.0",
-    "@nxlv/python": "23.2.1",
+    "@modelcontextprotocol/sdk": "1.32.2",
+    "@nx/devkit": "23.3.1",
+    "@nx/js": "23.3.1",
+    "@nx/react": "23.3.1",
+    "@nx/vite": "23.3.1",
+    "@nxlv/python": "23.3.1",
     "@phenomnomnominal/tsquery": "6.2.0",
     "@types/estree": "1.0.9",
     "@types/js-yaml": "4.0.9",
@@ -78,9 +78,9 @@
     "spdx-satisfies": "6.0.0",
     "typescript": "6.0.3",
     "unified": "11.0.5",
-    "unist-util-visit": "5.1.0",
-    "vite": "8.3.4",
-    "vitest": "5.0.4",
+    "unist-util-visit": "5.2.0",
+    "vite": "8.3.5",
+    "vitest": "5.0.5",
     "zod": "4.6.7"
   },
   "devDependencies": {

package/src/agentcore-gateway/__snapshots__/generator.spec.ts.snap

@@ -7,7 +7,7 @@ exports[`agentcore-gateway generator > protocol: http > omits protocol_type from
   required_providers {
     aws = {
       source  = "hashicorp/aws"
-      version = "6.69.1"
+      version = "6.70.0"
     }
     time = {
       source  = "hashicorp/time"

package/src/greengrass/component/python/__snapshots__/generator.spec.ts.snap

@@ -217,11 +217,11 @@ def test_run_once_does_not_raise():
   - packages/common/*
 catalog:
   '@types/node': 26.6.5
-  vite: 8.3.4
-  vitest: 5.0.4
-  '@vitest/coverage-v8': 5.0.4
+  vite: 8.3.5
+  vitest: 5.0.5
+  '@vitest/coverage-v8': 5.0.5
   jsdom: 29.1.1
-  '@nx/vitest': 23.3.0
+  '@nx/vitest': 23.3.1
   js-yaml: 4.3.2
   '@types/js-yaml': 4.0.9
   tsx: 4.23.15
@@ -436,11 +436,11 @@ def test_run_once_does_not_raise():
   - packages/common/*
 catalog:
   '@types/node': 26.6.5
-  vite: 8.3.4
-  vitest: 5.0.4
-  '@vitest/coverage-v8': 5.0.4
+  vite: 8.3.5
+  vitest: 5.0.5
+  '@vitest/coverage-v8': 5.0.5
   jsdom: 29.1.1
-  '@nx/vitest': 23.3.0
+  '@nx/vitest': 23.3.1
   js-yaml: 4.3.2
   '@types/js-yaml': 4.0.9
   tsx: 4.23.15

package/src/infra/app/__snapshots__/generator.spec.ts.snap

@@ -50,7 +50,7 @@ exports[`infra generator > should configure Checkov target correctly > checkov-t
     "default",
   ],
   "options": {
-    "command": "uvx --from checkov==3.3.29 checkov --config-file {projectRoot}/checkov.yml --directory dist/{projectRoot}/cdk.out --framework cloudformation",
+    "command": "uvx --from checkov==3.3.30 checkov --config-file {projectRoot}/checkov.yml --directory dist/{projectRoot}/cdk.out --framework cloudformation",
   },
   "outputs": [
     "{workspaceRoot}/dist/{projectRoot}/checkov",
@@ -150,7 +150,7 @@ exports[`infra generator > should configure project.json with correct targets >
         "default",
       ],
       "options": {
-        "command": "uvx --from checkov==3.3.29 checkov --config-file {projectRoot}/checkov.yml --directory dist/{projectRoot}/cdk.out --framework cloudformation",
+        "command": "uvx --from checkov==3.3.30 checkov --config-file {projectRoot}/checkov.yml --directory dist/{projectRoot}/cdk.out --framework cloudformation",
       },
       "outputs": [
         "{workspaceRoot}/dist/{projectRoot}/checkov",
@@ -767,7 +767,7 @@ exports[`infra generator > should handle custom project names correctly > custom
         "default",
       ],
       "options": {
-        "command": "uvx --from checkov==3.3.29 checkov --config-file {projectRoot}/checkov.yml --directory dist/{projectRoot}/cdk.out --framework cloudformation",
+        "command": "uvx --from checkov==3.3.30 checkov --config-file {projectRoot}/checkov.yml --directory dist/{projectRoot}/cdk.out --framework cloudformation",
       },
       "outputs": [
         "{workspaceRoot}/dist/{projectRoot}/checkov",

package/src/migrations/latest/biome-markdown-yaml-formatter-off/metadata.json

@@ -0,0 +1,3 @@
+{
+  "description": "Turn off Biome 2.6's Markdown and YAML formatting in biome.json, which formats them by default"
+}

package/src/migrations/latest/biome-markdown-yaml-formatter-off/migration.js

@@ -0,0 +1,113 @@
+/**
+ * Copyright Amazon.com, Inc. or its affiliates. All Rights Reserved.
+ * SPDX-License-Identifier: Apache-2.0
+ */ import { getDependencyVersionFromPackageJson, readJson, writeJson } from "@nx/devkit";
+import { gte, minVersion, validRange } from "semver";
+import { formatFilesInSubtree } from "../../../utils/format.js";
+import { ownedDependencies } from "../../../utils/version-upgrade-migration/owned-dependencies.js";
+import { syncedTsVersion } from "../../../utils/version-upgrade-migration/sync-vended-versions.js";
+/**
+ * Turn off Biome's Markdown and YAML formatting in `biome.json`.
+ *
+ * Biome 2.6 formats Markdown and YAML by default. The vended `format` target
+ * runs `biome format {projectRoot}`, so after the upgrade it fails on generated
+ * README.md files and the TypeScript Greengrass component's `recipe.yaml`, and
+ * `lint` and `build` stop with it.
+ *
+ * Guardrails:
+ * - A workspace without `biome.json` is left alone.
+ * - A top-level `markdown` or `yaml` key that is already present is the user's
+ *   own setting and is kept as it is. Biome 2.5 rejects both keys, so one is
+ *   only present when the user configured Biome 2.6 themselves.
+ * - Missing keys go right after `css`, where the generators place them, or at
+ *   the end when there is no `css` section.
+ * - Idempotent: a second run finds both keys present and changes nothing.
+ * - Biome 2.5 rejects both keys and then fails every `format` and `lint`
+ *   target, so they are added only when the workspace runs Biome 2.6 or later
+ *   once `nx migrate` finishes. Otherwise `biome.json` is left as it is and a
+ *   next step says what to add after moving to Biome 2.6.
+ */ const BIOME_CONFIG = 'biome.json';
+const LANGUAGES = [
+    'markdown',
+    'yaml'
+];
+const FORMATTER_OFF = {
+    formatter: {
+        enabled: false
+    }
+};
+const BIOME = '@biomejs/biome';
+/** First Biome release that accepts the `markdown` and `yaml` keys. */ const MIN_BIOME_VERSION = '2.6.0';
+/** Whether every version a semver range allows is Biome 2.6 or later. */ const allowsOnlyBiome26 = (specifier)=>{
+    if (typeof specifier !== 'string' || validRange(specifier) === null) {
+        return false;
+    }
+    const lowest = minVersion(specifier);
+    return lowest !== null && gte(lowest, MIN_BIOME_VERSION);
+};
+/**
+ * Whether the workspace runs Biome 2.6 or later once `nx migrate` finishes.
+ *
+ * The version sync runs after this migration in the same `nx migrate`, so the
+ * root `package.json` still holds the old Biome here. The check takes the lowest
+ * version the declared range (or the catalog entry it references) allows, then
+ * the version the sync will move Biome to. A tag, alias or missing declaration
+ * counts only when the sync moves it.
+ */ const runsBiome26AfterMigrate = async (tree)=>{
+    if (!tree.exists('package.json')) {
+        return false;
+    }
+    const { dependencies, devDependencies } = readJson(tree, 'package.json');
+    const declared = devDependencies?.[BIOME] ?? dependencies?.[BIOME];
+    if (declared === undefined) {
+        return false;
+    }
+    const resolved = getDependencyVersionFromPackageJson(tree, BIOME, 'package.json', [
+        'devDependencies',
+        'dependencies'
+    ]);
+    if (allowsOnlyBiome26(resolved)) {
+        return true;
+    }
+    return allowsOnlyBiome26(syncedTsVersion(tree, await ownedDependencies(tree), BIOME, declared));
+};
+const SKIPPED_NEXT_STEP = 'Biome stays below 2.6 in this workspace, and Biome 2.5 rejects the `markdown` and `yaml` keys, so biome.json was left as it is. ' + 'Biome 2.6 formats Markdown and YAML files by default. After you move `@biomejs/biome` to 2.6 or later, add ' + '`"markdown": { "formatter": { "enabled": false } }` and `"yaml": { "formatter": { "enabled": false } }` to biome.json, ' + 'or the `format` target fails on generated README.md and YAML files.';
+export default async function migration(tree) {
+    if (!tree.exists(BIOME_CONFIG)) {
+        return {
+            nextSteps: []
+        };
+    }
+    const biome = readJson(tree, BIOME_CONFIG);
+    const missing = LANGUAGES.filter((language)=>biome[language] === undefined);
+    if (missing.length === 0) {
+        return {
+            nextSteps: []
+        };
+    }
+    if (!await runsBiome26AfterMigrate(tree)) {
+        return {
+            nextSteps: [
+                SKIPPED_NEXT_STEP
+            ]
+        };
+    }
+    const additions = Object.fromEntries(missing.map((language)=>[
+            language,
+            FORMATTER_OFF
+        ]));
+    const entries = Object.entries(biome);
+    const cssIndex = entries.findIndex(([key])=>key === 'css');
+    const insertAt = cssIndex === -1 ? entries.length : cssIndex + 1;
+    writeJson(tree, BIOME_CONFIG, Object.fromEntries([
+        ...entries.slice(0, insertAt),
+        ...Object.entries(additions),
+        ...entries.slice(insertAt)
+    ]));
+    await formatFilesInSubtree(tree);
+    return {
+        nextSteps: []
+    };
+}
+
+//# sourceMappingURL=migration.js.map

package/src/migrations/latest/biome-markdown-yaml-formatter-off/migration.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../../../../../../../packages/nx-plugin/src/migrations/latest/biome-markdown-yaml-formatter-off/migration.ts"],"sourcesContent":["/**\n * Copyright Amazon.com, Inc. or its affiliates. All Rights Reserved.\n * SPDX-License-Identifier: Apache-2.0\n */\nimport {\n  getDependencyVersionFromPackageJson,\n  type MigrationReturnObject,\n  readJson,\n  type Tree,\n  writeJson,\n} from '@nx/devkit';\nimport { gte, minVersion, validRange } from 'semver';\nimport { formatFilesInSubtree } from '../../../utils/format.js';\nimport { ownedDependencies } from '../../../utils/version-upgrade-migration/owned-dependencies.js';\nimport { syncedTsVersion } from '../../../utils/version-upgrade-migration/sync-vended-versions.js';\n\n/**\n * Turn off Biome's Markdown and YAML formatting in `biome.json`.\n *\n * Biome 2.6 formats Markdown and YAML by default. The vended `format` target\n * runs `biome format {projectRoot}`, so after the upgrade it fails on generated\n * README.md files and the TypeScript Greengrass component's `recipe.yaml`, and\n * `lint` and `build` stop with it.\n *\n * Guardrails:\n * - A workspace without `biome.json` is left alone.\n * - A top-level `markdown` or `yaml` key that is already present is the user's\n *   own setting and is kept as it is. Biome 2.5 rejects both keys, so one is\n *   only present when the user configured Biome 2.6 themselves.\n * - Missing keys go right after `css`, where the generators place them, or at\n *   the end when there is no `css` section.\n * - Idempotent: a second run finds both keys present and changes nothing.\n * - Biome 2.5 rejects both keys and then fails every `format` and `lint`\n *   target, so they are added only when the workspace runs Biome 2.6 or later\n *   once `nx migrate` finishes. Otherwise `biome.json` is left as it is and a\n *   next step says what to add after moving to Biome 2.6.\n */\n\nconst BIOME_CONFIG = 'biome.json';\n\nconst LANGUAGES = ['markdown', 'yaml'] as const;\n\nconst FORMATTER_OFF = { formatter: { enabled: false } };\n\nconst BIOME = '@biomejs/biome';\n\n/** First Biome release that accepts the `markdown` and `yaml` keys. */\nconst MIN_BIOME_VERSION = '2.6.0';\n\n/** Whether every version a semver range allows is Biome 2.6 or later. */\nconst allowsOnlyBiome26 = (specifier: unknown): boolean => {\n  if (typeof specifier !== 'string' || validRange(specifier) === null) {\n    return false;\n  }\n  const lowest = minVersion(specifier);\n  return lowest !== null && gte(lowest, MIN_BIOME_VERSION);\n};\n\n/**\n * Whether the workspace runs Biome 2.6 or later once `nx migrate` finishes.\n *\n * The version sync runs after this migration in the same `nx migrate`, so the\n * root `package.json` still holds the old Biome here. The check takes the lowest\n * version the declared range (or the catalog entry it references) allows, then\n * the version the sync will move Biome to. A tag, alias or missing declaration\n * counts only when the sync moves it.\n */\nconst runsBiome26AfterMigrate = async (tree: Tree): Promise<boolean> => {\n  if (!tree.exists('package.json')) {\n    return false;\n  }\n  const { dependencies, devDependencies } = readJson(tree, 'package.json');\n  const declared: unknown = devDependencies?.[BIOME] ?? dependencies?.[BIOME];\n  if (declared === undefined) {\n    return false;\n  }\n  const resolved = getDependencyVersionFromPackageJson(\n    tree,\n    BIOME,\n    'package.json',\n    ['devDependencies', 'dependencies'],\n  );\n  if (allowsOnlyBiome26(resolved)) {\n    return true;\n  }\n  return allowsOnlyBiome26(\n    syncedTsVersion(tree, await ownedDependencies(tree), BIOME, declared),\n  );\n};\n\nconst SKIPPED_NEXT_STEP =\n  'Biome stays below 2.6 in this workspace, and Biome 2.5 rejects the `markdown` and `yaml` keys, so biome.json was left as it is. ' +\n  'Biome 2.6 formats Markdown and YAML files by default. After you move `@biomejs/biome` to 2.6 or later, add ' +\n  '`\"markdown\": { \"formatter\": { \"enabled\": false } }` and `\"yaml\": { \"formatter\": { \"enabled\": false } }` to biome.json, ' +\n  'or the `format` target fails on generated README.md and YAML files.';\n\nexport default async function migration(\n  tree: Tree,\n): Promise<MigrationReturnObject> {\n  if (!tree.exists(BIOME_CONFIG)) {\n    return { nextSteps: [] };\n  }\n\n  const biome: Record<string, unknown> = readJson(tree, BIOME_CONFIG);\n  const missing = LANGUAGES.filter((language) => biome[language] === undefined);\n  if (missing.length === 0) {\n    return { nextSteps: [] };\n  }\n  if (!(await runsBiome26AfterMigrate(tree))) {\n    return { nextSteps: [SKIPPED_NEXT_STEP] };\n  }\n\n  const additions = Object.fromEntries(\n    missing.map((language) => [language, FORMATTER_OFF]),\n  );\n  const entries = Object.entries(biome);\n  const cssIndex = entries.findIndex(([key]) => key === 'css');\n  const insertAt = cssIndex === -1 ? entries.length : cssIndex + 1;\n  writeJson(\n    tree,\n    BIOME_CONFIG,\n    Object.fromEntries([\n      ...entries.slice(0, insertAt),\n      ...Object.entries(additions),\n      ...entries.slice(insertAt),\n    ]),\n  );\n\n  await formatFilesInSubtree(tree);\n\n  return { nextSteps: [] };\n}\n"],"names":["getDependencyVersionFromPackageJson","readJson","writeJson","gte","minVersion","validRange","formatFilesInSubtree","ownedDependencies","syncedTsVersion","BIOME_CONFIG","LANGUAGES","FORMATTER_OFF","formatter","enabled","BIOME","MIN_BIOME_VERSION","allowsOnlyBiome26","specifier","lowest","runsBiome26AfterMigrate","tree","exists","dependencies","devDependencies","declared","undefined","resolved","SKIPPED_NEXT_STEP","migration","nextSteps","biome","missing","filter","language","length","additions","Object","fromEntries","map","entries","cssIndex","findIndex","key","insertAt","slice"],"mappings":"AAAA;;;CAGC,GACD,SACEA,mCAAmC,EAEnCC,QAAQ,EAERC,SAAS,QACJ,aAAa;AACpB,SAASC,GAAG,EAAEC,UAAU,EAAEC,UAAU,QAAQ,SAAS;AACrD,SAASC,oBAAoB,QAAQ,2BAA2B;AAChE,SAASC,iBAAiB,QAAQ,iEAAiE;AACnG,SAASC,eAAe,QAAQ,mEAAmE;AAEnG;;;;;;;;;;;;;;;;;;;;CAoBC,GAED,MAAMC,eAAe;AAErB,MAAMC,YAAY;IAAC;IAAY;CAAO;AAEtC,MAAMC,gBAAgB;IAAEC,WAAW;QAAEC,SAAS;IAAM;AAAE;AAEtD,MAAMC,QAAQ;AAEd,qEAAqE,GACrE,MAAMC,oBAAoB;AAE1B,uEAAuE,GACvE,MAAMC,oBAAoB,CAACC;IACzB,IAAI,OAAOA,cAAc,YAAYZ,WAAWY,eAAe,MAAM;QACnE,OAAO;IACT;IACA,MAAMC,SAASd,WAAWa;IAC1B,OAAOC,WAAW,QAAQf,IAAIe,QAAQH;AACxC;AAEA;;;;;;;;CAQC,GACD,MAAMI,0BAA0B,OAAOC;IACrC,IAAI,CAACA,KAAKC,MAAM,CAAC,iBAAiB;QAChC,OAAO;IACT;IACA,MAAM,EAAEC,YAAY,EAAEC,eAAe,EAAE,GAAGtB,SAASmB,MAAM;IACzD,MAAMI,WAAoBD,iBAAiB,CAACT,MAAM,IAAIQ,cAAc,CAACR,MAAM;IAC3E,IAAIU,aAAaC,WAAW;QAC1B,OAAO;IACT;IACA,MAAMC,WAAW1B,oCACfoB,MACAN,OACA,gBACA;QAAC;QAAmB;KAAe;IAErC,IAAIE,kBAAkBU,WAAW;QAC/B,OAAO;IACT;IACA,OAAOV,kBACLR,gBAAgBY,MAAM,MAAMb,kBAAkBa,OAAON,OAAOU;AAEhE;AAEA,MAAMG,oBACJ,qIACA,gHACA,4HACA;AAEF,eAAe,eAAeC,UAC5BR,IAAU;IAEV,IAAI,CAACA,KAAKC,MAAM,CAACZ,eAAe;QAC9B,OAAO;YAAEoB,WAAW,EAAE;QAAC;IACzB;IAEA,MAAMC,QAAiC7B,SAASmB,MAAMX;IACtD,MAAMsB,UAAUrB,UAAUsB,MAAM,CAAC,CAACC,WAAaH,KAAK,CAACG,SAAS,KAAKR;IACnE,IAAIM,QAAQG,MAAM,KAAK,GAAG;QACxB,OAAO;YAAEL,WAAW,EAAE;QAAC;IACzB;IACA,IAAI,CAAE,MAAMV,wBAAwBC,OAAQ;QAC1C,OAAO;YAAES,WAAW;gBAACF;aAAkB;QAAC;IAC1C;IAEA,MAAMQ,YAAYC,OAAOC,WAAW,CAClCN,QAAQO,GAAG,CAAC,CAACL,WAAa;YAACA;YAAUtB;SAAc;IAErD,MAAM4B,UAAUH,OAAOG,OAAO,CAACT;IAC/B,MAAMU,WAAWD,QAAQE,SAAS,CAAC,CAAC,CAACC,IAAI,GAAKA,QAAQ;IACtD,MAAMC,WAAWH,aAAa,CAAC,IAAID,QAAQL,MAAM,GAAGM,WAAW;IAC/DtC,UACEkB,MACAX,cACA2B,OAAOC,WAAW,CAAC;WACdE,QAAQK,KAAK,CAAC,GAAGD;WACjBP,OAAOG,OAAO,CAACJ;WACfI,QAAQK,KAAK,CAACD;KAClB;IAGH,MAAMrC,qBAAqBc;IAE3B,OAAO;QAAES,WAAW,EAAE;IAAC;AACzB"}

package/src/migrations/latest/py-agentcore-launcher/metadata.json

@@ -0,0 +1,3 @@
+{
+  "description": "Launch Python AgentCore code with the managed interpreter"
+}

package/src/migrations/latest/py-agentcore-launcher/migration.d.ts

@@ -0,0 +1,7 @@
+/**
+ * Copyright Amazon.com, Inc. or its affiliates. All Rights Reserved.
+ * SPDX-License-Identifier: Apache-2.0
+ */
+import { type MigrationReturnObject, type Tree } from '@nx/devkit';
+/** Add the interpreter-safe launcher without changing the user's main.py or application. */
+export default function migration(tree: Tree): Promise<MigrationReturnObject>;

package/src/migrations/latest/py-agentcore-launcher/migration.js

@@ -0,0 +1,100 @@
+/**
+ * Copyright Amazon.com, Inc. or its affiliates. All Rights Reserved.
+ * SPDX-License-Identifier: Apache-2.0
+ */ import { basename } from "node:path";
+import { getProjects, joinPathFragments, updateProjectConfiguration } from "@nx/devkit";
+import { PY_AGENT_GENERATOR_INFO } from "../../../py/agent/generator.js";
+import { PY_MCP_SERVER_GENERATOR_INFO } from "../../../py/mcp-server/generator.js";
+import { applyGritQL, matchGritQL } from "../../../utils/ast.js";
+import { formatFilesInSubtree } from "../../../utils/format.js";
+import { kebabCase } from "../../../utils/names.js";
+const TERRAFORM_RUNTIME = 'packages/common/terraform/src/core/agent-core-code/runtime.tf';
+const PYTHON_AGENT_CORE_LAUNCHER = 'agentcore_launcher.py';
+const launcher = `\
+import sys
+from pathlib import Path
+
+from opentelemetry.instrumentation.auto_instrumentation import run
+
+if __name__ == "__main__":
+    sys.argv = [
+        "opentelemetry-instrument",
+        sys.executable,
+        str(Path(__file__).with_name("main.py")),
+        *sys.argv[1:],
+    ]
+    run()
+`;
+const terraformEntry = 'entry_point = var.code_entry_point == "agentcore_launcher.py" ? [var.code_entry_point] : ["opentelemetry-instrument", var.code_entry_point]';
+const oldTerraformEntry = 'entry_point = ["opentelemetry-instrument", var.code_entry_point]';
+const hcl = (pattern)=>`language hcl\n${pattern}`;
+const terraformInput = (entryPoint)=>`\`module "agent_core_runtime" { $body }\` where { $body <: contains \`code_runtime = $runtime\`, $runtime <: r".*PYTHON_.*", $body <: contains \`code_entry_point = "${entryPoint}"\` }`;
+const cdkInput = (entryPoint)=>`\`AgentRuntimeArtifact.fromCodeAsset({ $props })\` where { $props <: contains \`runtime: AgentCoreRuntime.$runtime\`, $runtime <: r"PYTHON_.*", $props <: contains \`entrypoint: ${entryPoint}\` }`;
+/** Add the interpreter-safe launcher without changing the user's main.py or application. */ export default async function migration(tree) {
+    const nextSteps = [];
+    if (tree.exists(TERRAFORM_RUNTIME) && await matchGritQL(tree, TERRAFORM_RUNTIME, hcl(`\`${oldTerraformEntry}\``))) {
+        await applyGritQL(tree, TERRAFORM_RUNTIME, hcl(`\`${oldTerraformEntry}\` => \`${terraformEntry}\``));
+    }
+    const coreMigrated = tree.exists(TERRAFORM_RUNTIME) && await matchGritQL(tree, TERRAFORM_RUNTIME, hcl(`\`${terraformEntry}\``));
+    for (const project of getProjects(tree).values()){
+        const components = project.metadata?.components ?? [];
+        let changed = false;
+        for (const component of components){
+            const agent = component.generator === PY_AGENT_GENERATOR_INFO.id;
+            if (!agent && component.generator !== PY_MCP_SERVER_GENERATOR_INFO.id || component.infra !== 'agentcore') {
+                continue;
+            }
+            const terraform = component.iac === 'terraform';
+            const targetName = `${component.name}-package`;
+            const target = project.targets?.[targetName];
+            const name = kebabCase(component.rc ?? '');
+            const packageDir = joinPathFragments(project.root, 'package', basename(component.path ?? ''));
+            const outputDir = joinPathFragments('dist', project.root, 'package', name);
+            const launcherPath = joinPathFragments(packageDir, PYTHON_AGENT_CORE_LAUNCHER);
+            const copyLauncher = `shx cp ${launcherPath} ${outputDir}/${PYTHON_AGENT_CORE_LAUNCHER}`;
+            const commands = target?.options?.commands;
+            const expectedCommands = [
+                `shx rm -rf ${outputDir}`,
+                `shx mkdir -p ${outputDir}`,
+                `shx cp -R dist/${project.root}/bundle-arm/. ${outputDir}`,
+                `shx cp -R ${project.sourceRoot}/. ${outputDir}/${basename(project.sourceRoot ?? '')}`,
+                `shx cp ${packageDir}/main.py ${outputDir}/main.py`
+            ];
+            const category = agent ? 'agents' : 'mcp-servers';
+            const infraPath = terraform ? `packages/common/terraform/src/app/${category}/${name}/${name}.tf` : `packages/common/constructs/src/app/${category}/${name}/${name}.ts`;
+            const report = ()=>nextSteps.push(`${project.name}/${component.name}: review customized packaging or ${infraPath}; add ${PYTHON_AGENT_CORE_LAUNCHER} calling OpenTelemetry run() with sys.executable and main.py, copy it to the package root, and select it as this Python runtime's code entrypoint.`);
+            if (!component.path || !component.rc || ![
+                'cdk',
+                'terraform'
+            ].includes(component.iac) || target?.executor !== 'nx:run-commands' || target.options?.parallel !== false || !Array.isArray(commands) || ![
+                5,
+                6
+            ].includes(commands.length) || expectedCommands.some((command, index)=>commands[index] !== command) || commands.length === 6 && commands[5] !== copyLauncher || !tree.exists(`${packageDir}/main.py`) || !tree.exists(infraPath) || tree.exists(launcherPath) && tree.read(launcherPath, 'utf-8') !== launcher || terraform && !tree.exists(TERRAFORM_RUNTIME)) {
+                report();
+                continue;
+            }
+            const oldEntry = terraform ? hcl(terraformInput('main.py')) : cdkInput("['opentelemetry-instrument', 'main.py']");
+            const newEntry = terraform ? hcl(terraformInput(PYTHON_AGENT_CORE_LAUNCHER)) : cdkInput("['agentcore_launcher.py']");
+            const alreadyMigrated = await matchGritQL(tree, infraPath, newEntry);
+            if (!alreadyMigrated && !await matchGritQL(tree, infraPath, oldEntry) || terraform && !coreMigrated) {
+                report();
+                continue;
+            }
+            if (!tree.exists(launcherPath)) tree.write(launcherPath, launcher);
+            if (commands.length === 5) {
+                commands.push(copyLauncher);
+                changed = true;
+            }
+            if (!alreadyMigrated) {
+                await applyGritQL(tree, infraPath, terraform ? hcl('`module "agent_core_runtime" { $body }` where { $body <: contains `code_runtime = $runtime`, $runtime <: r".*PYTHON_.*", $body <: contains bubble `code_entry_point = "main.py"` => `code_entry_point = "agentcore_launcher.py"` }') : "`AgentRuntimeArtifact.fromCodeAsset({ $props })` where { $props <: contains `runtime: AgentCoreRuntime.$runtime`, $runtime <: r\"PYTHON_.*\", $props <: contains bubble `entrypoint: ['opentelemetry-instrument', 'main.py']` => `entrypoint: ['agentcore_launcher.py']` }");
+            }
+        }
+        if (changed) updateProjectConfiguration(tree, project.name, project);
+    }
+    await formatFilesInSubtree(tree);
+    return {
+        nextSteps
+    };
+}
+
+//# sourceMappingURL=migration.js.map

package/src/migrations/latest/py-agentcore-launcher/migration.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../../../../../../../packages/nx-plugin/src/migrations/latest/py-agentcore-launcher/migration.ts"],"sourcesContent":["/**\n * Copyright Amazon.com, Inc. or its affiliates. All Rights Reserved.\n * SPDX-License-Identifier: Apache-2.0\n */\n\nimport { basename } from 'node:path';\nimport {\n  getProjects,\n  joinPathFragments,\n  type MigrationReturnObject,\n  type Tree,\n  updateProjectConfiguration,\n} from '@nx/devkit';\nimport { PY_AGENT_GENERATOR_INFO } from '../../../py/agent/generator.js';\nimport { PY_MCP_SERVER_GENERATOR_INFO } from '../../../py/mcp-server/generator.js';\nimport { applyGritQL, matchGritQL } from '../../../utils/ast.js';\nimport { formatFilesInSubtree } from '../../../utils/format.js';\nimport { kebabCase } from '../../../utils/names.js';\nimport type { ComponentMetadata } from '../../../utils/nx.js';\n\nconst TERRAFORM_RUNTIME =\n  'packages/common/terraform/src/core/agent-core-code/runtime.tf';\nconst PYTHON_AGENT_CORE_LAUNCHER = 'agentcore_launcher.py';\nconst launcher = `\\\nimport sys\nfrom pathlib import Path\n\nfrom opentelemetry.instrumentation.auto_instrumentation import run\n\nif __name__ == \"__main__\":\n    sys.argv = [\n        \"opentelemetry-instrument\",\n        sys.executable,\n        str(Path(__file__).with_name(\"main.py\")),\n        *sys.argv[1:],\n    ]\n    run()\n`;\nconst terraformEntry =\n  'entry_point = var.code_entry_point == \"agentcore_launcher.py\" ? [var.code_entry_point] : [\"opentelemetry-instrument\", var.code_entry_point]';\nconst oldTerraformEntry =\n  'entry_point = [\"opentelemetry-instrument\", var.code_entry_point]';\nconst hcl = (pattern: string) => `language hcl\\n${pattern}`;\nconst terraformInput = (entryPoint: string) =>\n  `\\`module \"agent_core_runtime\" { $body }\\` where { $body <: contains \\`code_runtime = $runtime\\`, $runtime <: r\".*PYTHON_.*\", $body <: contains \\`code_entry_point = \"${entryPoint}\"\\` }`;\nconst cdkInput = (entryPoint: string) =>\n  `\\`AgentRuntimeArtifact.fromCodeAsset({ $props })\\` where { $props <: contains \\`runtime: AgentCoreRuntime.$runtime\\`, $runtime <: r\"PYTHON_.*\", $props <: contains \\`entrypoint: ${entryPoint}\\` }`;\n\n/** Add the interpreter-safe launcher without changing the user's main.py or application. */\nexport default async function migration(\n  tree: Tree,\n): Promise<MigrationReturnObject> {\n  const nextSteps: string[] = [];\n  if (\n    tree.exists(TERRAFORM_RUNTIME) &&\n    (await matchGritQL(\n      tree,\n      TERRAFORM_RUNTIME,\n      hcl(`\\`${oldTerraformEntry}\\``),\n    ))\n  ) {\n    await applyGritQL(\n      tree,\n      TERRAFORM_RUNTIME,\n      hcl(`\\`${oldTerraformEntry}\\` => \\`${terraformEntry}\\``),\n    );\n  }\n  const coreMigrated =\n    tree.exists(TERRAFORM_RUNTIME) &&\n    (await matchGritQL(tree, TERRAFORM_RUNTIME, hcl(`\\`${terraformEntry}\\``)));\n  for (const project of getProjects(tree).values()) {\n    const components: ComponentMetadata[] = project.metadata?.components ?? [];\n    let changed = false;\n    for (const component of components) {\n      const agent = component.generator === PY_AGENT_GENERATOR_INFO.id;\n      if (\n        (!agent && component.generator !== PY_MCP_SERVER_GENERATOR_INFO.id) ||\n        component.infra !== 'agentcore'\n      ) {\n        continue;\n      }\n      const terraform = component.iac === 'terraform';\n      const targetName = `${component.name}-package`;\n      const target = project.targets?.[targetName];\n      const name = kebabCase(component.rc ?? '');\n      const packageDir = joinPathFragments(\n        project.root,\n        'package',\n        basename(component.path ?? ''),\n      );\n      const outputDir = joinPathFragments(\n        'dist',\n        project.root,\n        'package',\n        name,\n      );\n      const launcherPath = joinPathFragments(\n        packageDir,\n        PYTHON_AGENT_CORE_LAUNCHER,\n      );\n      const copyLauncher = `shx cp ${launcherPath} ${outputDir}/${PYTHON_AGENT_CORE_LAUNCHER}`;\n      const commands = target?.options?.commands;\n      const expectedCommands = [\n        `shx rm -rf ${outputDir}`,\n        `shx mkdir -p ${outputDir}`,\n        `shx cp -R dist/${project.root}/bundle-arm/. ${outputDir}`,\n        `shx cp -R ${project.sourceRoot}/. ${outputDir}/${basename(project.sourceRoot ?? '')}`,\n        `shx cp ${packageDir}/main.py ${outputDir}/main.py`,\n      ];\n      const category = agent ? 'agents' : 'mcp-servers';\n      const infraPath = terraform\n        ? `packages/common/terraform/src/app/${category}/${name}/${name}.tf`\n        : `packages/common/constructs/src/app/${category}/${name}/${name}.ts`;\n      const report = () =>\n        nextSteps.push(\n          `${project.name}/${component.name}: review customized packaging or ${infraPath}; add ${PYTHON_AGENT_CORE_LAUNCHER} calling OpenTelemetry run() with sys.executable and main.py, copy it to the package root, and select it as this Python runtime's code entrypoint.`,\n        );\n      if (\n        !component.path ||\n        !component.rc ||\n        !['cdk', 'terraform'].includes(component.iac) ||\n        target?.executor !== 'nx:run-commands' ||\n        target.options?.parallel !== false ||\n        !Array.isArray(commands) ||\n        ![5, 6].includes(commands.length) ||\n        expectedCommands.some(\n          (command, index) => commands[index] !== command,\n        ) ||\n        (commands.length === 6 && commands[5] !== copyLauncher) ||\n        !tree.exists(`${packageDir}/main.py`) ||\n        !tree.exists(infraPath) ||\n        (tree.exists(launcherPath) &&\n          tree.read(launcherPath, 'utf-8') !== launcher) ||\n        (terraform && !tree.exists(TERRAFORM_RUNTIME))\n      ) {\n        report();\n        continue;\n      }\n      const oldEntry = terraform\n        ? hcl(terraformInput('main.py'))\n        : cdkInput(\"['opentelemetry-instrument', 'main.py']\");\n      const newEntry = terraform\n        ? hcl(terraformInput(PYTHON_AGENT_CORE_LAUNCHER))\n        : cdkInput(\"['agentcore_launcher.py']\");\n      const alreadyMigrated = await matchGritQL(tree, infraPath, newEntry);\n      if (\n        (!alreadyMigrated && !(await matchGritQL(tree, infraPath, oldEntry))) ||\n        (terraform && !coreMigrated)\n      ) {\n        report();\n        continue;\n      }\n      if (!tree.exists(launcherPath)) tree.write(launcherPath, launcher);\n      if (commands.length === 5) {\n        commands.push(copyLauncher);\n        changed = true;\n      }\n      if (!alreadyMigrated) {\n        await applyGritQL(\n          tree,\n          infraPath,\n          terraform\n            ? hcl(\n                '`module \"agent_core_runtime\" { $body }` where { $body <: contains `code_runtime = $runtime`, $runtime <: r\".*PYTHON_.*\", $body <: contains bubble `code_entry_point = \"main.py\"` => `code_entry_point = \"agentcore_launcher.py\"` }',\n              )\n            : \"`AgentRuntimeArtifact.fromCodeAsset({ $props })` where { $props <: contains `runtime: AgentCoreRuntime.$runtime`, $runtime <: r\\\"PYTHON_.*\\\", $props <: contains bubble `entrypoint: ['opentelemetry-instrument', 'main.py']` => `entrypoint: ['agentcore_launcher.py']` }\",\n        );\n      }\n    }\n    if (changed) updateProjectConfiguration(tree, project.name, project);\n  }\n  await formatFilesInSubtree(tree);\n  return { nextSteps };\n}\n"],"names":["basename","getProjects","joinPathFragments","updateProjectConfiguration","PY_AGENT_GENERATOR_INFO","PY_MCP_SERVER_GENERATOR_INFO","applyGritQL","matchGritQL","formatFilesInSubtree","kebabCase","TERRAFORM_RUNTIME","PYTHON_AGENT_CORE_LAUNCHER","launcher","terraformEntry","oldTerraformEntry","hcl","pattern","terraformInput","entryPoint","cdkInput","migration","tree","nextSteps","exists","coreMigrated","project","values","components","metadata","changed","component","agent","generator","id","infra","terraform","iac","targetName","name","target","targets","rc","packageDir","root","path","outputDir","launcherPath","copyLauncher","commands","options","expectedCommands","sourceRoot","category","infraPath","report","push","includes","executor","parallel","Array","isArray","length","some","command","index","read","oldEntry","newEntry","alreadyMigrated","write"],"mappings":"AAAA;;;CAGC,GAED,SAASA,QAAQ,QAAQ,YAAY;AACrC,SACEC,WAAW,EACXC,iBAAiB,EAGjBC,0BAA0B,QACrB,aAAa;AACpB,SAASC,uBAAuB,QAAQ,iCAAiC;AACzE,SAASC,4BAA4B,QAAQ,sCAAsC;AACnF,SAASC,WAAW,EAAEC,WAAW,QAAQ,wBAAwB;AACjE,SAASC,oBAAoB,QAAQ,2BAA2B;AAChE,SAASC,SAAS,QAAQ,0BAA0B;AAGpD,MAAMC,oBACJ;AACF,MAAMC,6BAA6B;AACnC,MAAMC,WAAW,CAAC;;;;;;;;;;;;;;AAclB,CAAC;AACD,MAAMC,iBACJ;AACF,MAAMC,oBACJ;AACF,MAAMC,MAAM,CAACC,UAAoB,CAAC,cAAc,EAAEA,SAAS;AAC3D,MAAMC,iBAAiB,CAACC,aACtB,CAAC,qKAAqK,EAAEA,WAAW,KAAK,CAAC;AAC3L,MAAMC,WAAW,CAACD,aAChB,CAAC,iLAAiL,EAAEA,WAAW,IAAI,CAAC;AAEtM,0FAA0F,GAC1F,eAAe,eAAeE,UAC5BC,IAAU;IAEV,MAAMC,YAAsB,EAAE;IAC9B,IACED,KAAKE,MAAM,CAACb,sBACX,MAAMH,YACLc,MACAX,mBACAK,IAAI,CAAC,EAAE,EAAED,kBAAkB,EAAE,CAAC,IAEhC;QACA,MAAMR,YACJe,MACAX,mBACAK,IAAI,CAAC,EAAE,EAAED,kBAAkB,QAAQ,EAAED,eAAe,EAAE,CAAC;IAE3D;IACA,MAAMW,eACJH,KAAKE,MAAM,CAACb,sBACX,MAAMH,YAAYc,MAAMX,mBAAmBK,IAAI,CAAC,EAAE,EAAEF,eAAe,EAAE,CAAC;IACzE,KAAK,MAAMY,WAAWxB,YAAYoB,MAAMK,MAAM,GAAI;QAChD,MAAMC,aAAkCF,QAAQG,QAAQ,EAAED,cAAc,EAAE;QAC1E,IAAIE,UAAU;QACd,KAAK,MAAMC,aAAaH,WAAY;YAClC,MAAMI,QAAQD,UAAUE,SAAS,KAAK5B,wBAAwB6B,EAAE;YAChE,IACE,AAAC,CAACF,SAASD,UAAUE,SAAS,KAAK3B,6BAA6B4B,EAAE,IAClEH,UAAUI,KAAK,KAAK,aACpB;gBACA;YACF;YACA,MAAMC,YAAYL,UAAUM,GAAG,KAAK;YACpC,MAAMC,aAAa,GAAGP,UAAUQ,IAAI,CAAC,QAAQ,CAAC;YAC9C,MAAMC,SAASd,QAAQe,OAAO,EAAE,CAACH,WAAW;YAC5C,MAAMC,OAAO7B,UAAUqB,UAAUW,EAAE,IAAI;YACvC,MAAMC,aAAaxC,kBACjBuB,QAAQkB,IAAI,EACZ,WACA3C,SAAS8B,UAAUc,IAAI,IAAI;YAE7B,MAAMC,YAAY3C,kBAChB,QACAuB,QAAQkB,IAAI,EACZ,WACAL;YAEF,MAAMQ,eAAe5C,kBACnBwC,YACA/B;YAEF,MAAMoC,eAAe,CAAC,OAAO,EAAED,aAAa,CAAC,EAAED,UAAU,CAAC,EAAElC,4BAA4B;YACxF,MAAMqC,WAAWT,QAAQU,SAASD;YAClC,MAAME,mBAAmB;gBACvB,CAAC,WAAW,EAAEL,WAAW;gBACzB,CAAC,aAAa,EAAEA,WAAW;gBAC3B,CAAC,eAAe,EAAEpB,QAAQkB,IAAI,CAAC,cAAc,EAAEE,WAAW;gBAC1D,CAAC,UAAU,EAAEpB,QAAQ0B,UAAU,CAAC,GAAG,EAAEN,UAAU,CAAC,EAAE7C,SAASyB,QAAQ0B,UAAU,IAAI,KAAK;gBACtF,CAAC,OAAO,EAAET,WAAW,SAAS,EAAEG,UAAU,QAAQ,CAAC;aACpD;YACD,MAAMO,WAAWrB,QAAQ,WAAW;YACpC,MAAMsB,YAAYlB,YACd,CAAC,kCAAkC,EAAEiB,SAAS,CAAC,EAAEd,KAAK,CAAC,EAAEA,KAAK,GAAG,CAAC,GAClE,CAAC,mCAAmC,EAAEc,SAAS,CAAC,EAAEd,KAAK,CAAC,EAAEA,KAAK,GAAG,CAAC;YACvE,MAAMgB,SAAS,IACbhC,UAAUiC,IAAI,CACZ,GAAG9B,QAAQa,IAAI,CAAC,CAAC,EAAER,UAAUQ,IAAI,CAAC,iCAAiC,EAAEe,UAAU,MAAM,EAAE1C,2BAA2B,kJAAkJ,CAAC;YAEzQ,IACE,CAACmB,UAAUc,IAAI,IACf,CAACd,UAAUW,EAAE,IACb,CAAC;gBAAC;gBAAO;aAAY,CAACe,QAAQ,CAAC1B,UAAUM,GAAG,KAC5CG,QAAQkB,aAAa,qBACrBlB,OAAOU,OAAO,EAAES,aAAa,SAC7B,CAACC,MAAMC,OAAO,CAACZ,aACf,CAAC;gBAAC;gBAAG;aAAE,CAACQ,QAAQ,CAACR,SAASa,MAAM,KAChCX,iBAAiBY,IAAI,CACnB,CAACC,SAASC,QAAUhB,QAAQ,CAACgB,MAAM,KAAKD,YAEzCf,SAASa,MAAM,KAAK,KAAKb,QAAQ,CAAC,EAAE,KAAKD,gBAC1C,CAAC1B,KAAKE,MAAM,CAAC,GAAGmB,WAAW,QAAQ,CAAC,KACpC,CAACrB,KAAKE,MAAM,CAAC8B,cACZhC,KAAKE,MAAM,CAACuB,iBACXzB,KAAK4C,IAAI,CAACnB,cAAc,aAAalC,YACtCuB,aAAa,CAACd,KAAKE,MAAM,CAACb,oBAC3B;gBACA4C;gBACA;YACF;YACA,MAAMY,WAAW/B,YACbpB,IAAIE,eAAe,cACnBE,SAAS;YACb,MAAMgD,WAAWhC,YACbpB,IAAIE,eAAeN,+BACnBQ,SAAS;YACb,MAAMiD,kBAAkB,MAAM7D,YAAYc,MAAMgC,WAAWc;YAC3D,IACE,AAAC,CAACC,mBAAmB,CAAE,MAAM7D,YAAYc,MAAMgC,WAAWa,aACzD/B,aAAa,CAACX,cACf;gBACA8B;gBACA;YACF;YACA,IAAI,CAACjC,KAAKE,MAAM,CAACuB,eAAezB,KAAKgD,KAAK,CAACvB,cAAclC;YACzD,IAAIoC,SAASa,MAAM,KAAK,GAAG;gBACzBb,SAASO,IAAI,CAACR;gBACdlB,UAAU;YACZ;YACA,IAAI,CAACuC,iBAAiB;gBACpB,MAAM9D,YACJe,MACAgC,WACAlB,YACIpB,IACE,wOAEF;YAER;QACF;QACA,IAAIc,SAAS1B,2BAA2BkB,MAAMI,QAAQa,IAAI,EAAEb;IAC9D;IACA,MAAMjB,qBAAqBa;IAC3B,OAAO;QAAEC;IAAU;AACrB"}

package/src/migrations/v1.0.15/0001-py-agent-pillow-override/migration.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../../../../../../../packages/nx-plugin/src/migrations/v1.0.15/0001-py-agent-pillow-override/migration.ts"],"sourcesContent":["/**\n * Copyright Amazon.com, Inc. or its affiliates. All Rights Reserved.\n * SPDX-License-Identifier: Apache-2.0\n */\nimport {\n  getProjects,\n  joinPathFragments,\n  type MigrationReturnObject,\n  type Tree,\n} from '@nx/devkit';\nimport { formatFilesInSubtree } from '../../../utils/format.js';\nimport type { UVPyprojectToml } from '../../../utils/nxlv-python.js';\nimport { addUvOverrideDependencies } from '../../../utils/py.js';\nimport { tryReadToml } from '../../../utils/toml.js';\n\n/**\n * Add the strands-agents-tools pillow override to the workspace root\n * pyproject.toml uv override-dependencies.\n *\n * strands-agents-tools caps pillow below the release that fixes its current\n * CVEs, and uv reads `[tool.uv] override-dependencies` only from the workspace\n * root, so the root carries the override (`PY_UV_OVERRIDES`). It applies when\n * any project's `[project].dependencies` names strands-agents-tools. A user\n * override for the same package is kept as written. `uv.lock` is left to the\n * user, as the version sync leaves it, so `nextSteps` asks for `uv sync` when\n * the root changes.\n */\nexport default async function migration(\n  tree: Tree,\n): Promise<MigrationReturnObject> {\n  const nextSteps: string[] = [];\n\n  if (tree.exists('pyproject.toml')) {\n    const requirements = [...getProjects(tree).values()].flatMap(({ root }) => {\n      const dependencies = (\n        tryReadToml(tree, joinPathFragments(root, 'pyproject.toml')) as\n          | UVPyprojectToml\n          | undefined\n      )?.project?.dependencies;\n      return Array.isArray(dependencies) ? dependencies : [];\n    });\n    if (addUvOverrideDependencies(tree, requirements)) {\n      nextSteps.push(\n        'The workspace root pyproject.toml now overrides a dependency of strands-agents-tools. Run `uv sync` to update uv.lock.',\n      );\n    }\n  }\n\n  await formatFilesInSubtree(tree);\n\n  return { nextSteps };\n}\n"],"names":["getProjects","joinPathFragments","formatFilesInSubtree","addUvOverrideDependencies","tryReadToml","migration","tree","nextSteps","exists","requirements","values","flatMap","root","dependencies","project","Array","isArray","push"],"mappings":"AAAA;;;CAGC,GACD,SACEA,WAAW,EACXC,iBAAiB,QAGZ,aAAa;AACpB,SAASC,oBAAoB,QAAQ,2BAA2B;AAEhE,SAASC,yBAAyB,QAAQ,uBAAuB;AACjE,SAASC,WAAW,QAAQ,yBAAyB;AAErD;;;;;;;;;;;CAWC,GACD,eAAe,eAAeC,UAC5BC,IAAU;IAEV,MAAMC,YAAsB,EAAE;IAE9B,IAAID,KAAKE,MAAM,CAAC,mBAAmB;QACjC,MAAMC,eAAe;eAAIT,YAAYM,MAAMI,MAAM;SAAG,CAACC,OAAO,CAAC,CAAC,EAAEC,IAAI,EAAE;YACpE,MAAMC,eACJT,YAAYE,MAAML,kBAAkBW,MAAM,oBAGzCE,SAASD;YACZ,OAAOE,MAAMC,OAAO,CAACH,gBAAgBA,eAAe,EAAE;QACxD;QACA,IAAIV,0BAA0BG,MAAMG,eAAe;YACjDF,UAAUU,IAAI,CACZ;QAEJ;IACF;IAEA,MAAMf,qBAAqBI;IAE3B,OAAO;QAAEC;IAAU;AACrB"}

package/src/migrations/v1.1.1/0001-ts-agent-guardrails-synth-input/migration.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../../../../../../../packages/nx-plugin/src/migrations/v1.1.1/0001-ts-agent-guardrails-synth-input/migration.ts"],"sourcesContent":["/**\n * Copyright Amazon.com, Inc. or its affiliates. All Rights Reserved.\n * SPDX-License-Identifier: Apache-2.0\n */\nimport {\n  getProjects,\n  joinPathFragments,\n  type MigrationReturnObject,\n  type Tree,\n} from '@nx/devkit';\nimport { TS_AGENT_GENERATOR_INFO } from '../../../ts/agent/generator.js';\nimport { TS_AGENT_GUARDRAILS_GENERATOR_INFO } from '../../../ts/agent/guardrails/generator.js';\nimport { addGuardrailPolicySynthInputs } from '../../../ts/agent/guardrails/synth-inputs.js';\nimport { formatFilesInSubtree } from '../../../utils/format.js';\nimport type { ComponentMetadata } from '../../../utils/nx.js';\n\n/**\n * Add each CDK-guarded TypeScript agent's guardrail.json to the `synth` inputs\n * of the CDK infrastructure projects.\n *\n * The CDK guardrail construct reads guardrail.json at synth time to build the\n * guardrail's rules and version description. The file belongs to the agent's\n * project and no task output the infrastructure's `synth` hashes includes it,\n * so without an explicit input a policy change is served from the Nx cache\n * and `deploy-ci` ships the stale template.\n *\n * Guarded agents are found from the `ts#agent#guardrails` components in\n * project metadata, each paired with the `ts#agent` component of the same\n * name, and kept when that agent's IaC is CDK. An infrastructure project\n * whose `synth` has no `inputs` array, or no `synth` target, is left\n * unchanged and reported via `nextSteps`.\n */\nexport default async function migration(\n  tree: Tree,\n): Promise<MigrationReturnObject> {\n  const policyPaths: string[] = [];\n  for (const project of getProjects(tree).values()) {\n    const components: ComponentMetadata[] =\n      (project.metadata as { components?: ComponentMetadata[] } | undefined)\n        ?.components ?? [];\n    for (const guardrail of components.filter(\n      (c) => c.generator === TS_AGENT_GUARDRAILS_GENERATOR_INFO.id,\n    )) {\n      const agent = components.find(\n        (c) =>\n          c.generator === TS_AGENT_GENERATOR_INFO.id &&\n          (c.name ?? 'agent') === guardrail.name,\n      );\n      if (agent?.iac === 'cdk') {\n        policyPaths.push(\n          joinPathFragments(project.root, guardrail.path, 'guardrail.json'),\n        );\n      }\n    }\n  }\n\n  const nextSteps = addGuardrailPolicySynthInputs(tree, policyPaths);\n\n  await formatFilesInSubtree(tree);\n\n  return { nextSteps };\n}\n"],"names":["getProjects","joinPathFragments","TS_AGENT_GENERATOR_INFO","TS_AGENT_GUARDRAILS_GENERATOR_INFO","addGuardrailPolicySynthInputs","formatFilesInSubtree","migration","tree","policyPaths","project","values","components","metadata","guardrail","filter","c","generator","id","agent","find","name","iac","push","root","path","nextSteps"],"mappings":"AAAA;;;CAGC,GACD,SACEA,WAAW,EACXC,iBAAiB,QAGZ,aAAa;AACpB,SAASC,uBAAuB,QAAQ,iCAAiC;AACzE,SAASC,kCAAkC,QAAQ,4CAA4C;AAC/F,SAASC,6BAA6B,QAAQ,+CAA+C;AAC7F,SAASC,oBAAoB,QAAQ,2BAA2B;AAGhE;;;;;;;;;;;;;;;CAeC,GACD,eAAe,eAAeC,UAC5BC,IAAU;IAEV,MAAMC,cAAwB,EAAE;IAChC,KAAK,MAAMC,WAAWT,YAAYO,MAAMG,MAAM,GAAI;QAChD,MAAMC,aACJ,AAACF,QAAQG,QAAQ,EACbD,cAAc,EAAE;QACtB,KAAK,MAAME,aAAaF,WAAWG,MAAM,CACvC,CAACC,IAAMA,EAAEC,SAAS,KAAKb,mCAAmCc,EAAE,EAC3D;YACD,MAAMC,QAAQP,WAAWQ,IAAI,CAC3B,CAACJ,IACCA,EAAEC,SAAS,KAAKd,wBAAwBe,EAAE,IAC1C,AAACF,CAAAA,EAAEK,IAAI,IAAI,OAAM,MAAOP,UAAUO,IAAI;YAE1C,IAAIF,OAAOG,QAAQ,OAAO;gBACxBb,YAAYc,IAAI,CACdrB,kBAAkBQ,QAAQc,IAAI,EAAEV,UAAUW,IAAI,EAAE;YAEpD;QACF;IACF;IAEA,MAAMC,YAAYrB,8BAA8BG,MAAMC;IAEtD,MAAMH,qBAAqBE;IAE3B,OAAO;QAAEkB;IAAU;AACrB"}

package/src/migrations/v1.3.0/0001-ts-agent-guardrails-terraform-version-retention/migration.d.ts

@@ -0,0 +1,6 @@
+/**
+ * Copyright Amazon.com, Inc. or its affiliates. All Rights Reserved.
+ * SPDX-License-Identifier: Apache-2.0
+ */
+import { type MigrationReturnObject, type Tree } from '@nx/devkit';
+export default function migration(tree: Tree): Promise<MigrationReturnObject>;

package/src/migrations/v1.3.0/0001-ts-agent-guardrails-terraform-version-retention/migration.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../../../../../../../packages/nx-plugin/src/migrations/v1.3.0/0001-ts-agent-guardrails-terraform-version-retention/migration.ts"],"sourcesContent":["/**\n * Copyright Amazon.com, Inc. or its affiliates. All Rights Reserved.\n * SPDX-License-Identifier: Apache-2.0\n */\nimport {\n  getProjects,\n  joinPathFragments,\n  type MigrationReturnObject,\n  type Tree,\n} from '@nx/devkit';\nimport { TS_AGENT_GENERATOR_INFO } from '../../../ts/agent/generator.js';\nimport { TS_AGENT_GUARDRAILS_GENERATOR_INFO } from '../../../ts/agent/guardrails/generator.js';\nimport {\n  applyGritQL,\n  GRIT_INSERT_PLACEHOLDER,\n  insertViaGritQL,\n  matchGritQL,\n} from '../../../utils/ast.js';\nimport { formatFilesInSubtree } from '../../../utils/format.js';\nimport { kebabCase, toClassName } from '../../../utils/names.js';\nimport type { ComponentMetadata } from '../../../utils/nx.js';\nimport {\n  PACKAGES_DIR,\n  SHARED_TERRAFORM_DIR,\n} from '../../../utils/shared-constructs-constants.js';\nimport { TERRAFORM_VERSIONS } from '../../../utils/versions.js';\n\n/**\n * Keep a replaced guardrail version for 15 seconds after the runtime-config\n * deployment in each Terraform guardrail module of a `ts#agent#guardrails`\n * agent.\n *\n * When `guardrail.json` changes, `aws_bedrock_guardrail_version.this` is\n * replaced with `create_before_destroy`, and Terraform destroyed the old\n * version as soon as the runtime-config deployment completed. Agents cache\n * their runtime-config entry for 5 seconds, so a request in that window used\n * the deleted version and failed. The module now has a `time_sleep` whose\n * `triggers` hold the guardrail ID and version, and the runtime-config entry\n * reads both from those triggers. On a version change the sleep is replaced\n * too: the deposed sleep is destroyed after everything that depends on the new\n * one (the entry and, through the root module's `depends_on`, the\n * runtime-config deployment), waits its 15-second `destroy_duration`, and only\n * then is the deposed version, which it depends on, destroyed.\n *\n * Guarded agents are found from the `ts#agent#guardrails` components in project\n * metadata, each paired with the `ts#agent` component of the same name whose\n * IaC is Terraform. The module is written with `KeepExisting`, so an upgraded\n * workspace keeps the older module until this runs. A module that no longer\n * has the generated shape is left untouched and reported via `nextSteps` with\n * the lines to add.\n */\n\nconst TERRAFORM_GUARDRAILS_DIR = `${PACKAGES_DIR}/${SHARED_TERRAFORM_DIR}/src/app/guardrails`;\n\nconst hcl = (pattern: string) => `language hcl\\n${pattern}`;\n\nconst TIME_SLEEP = '`resource \"time_sleep\" \"version_retention\" { $_ }`';\n\n/** Indented as `terraform fmt` writes it, since `.tf` files are not reformatted. */\nconst TIME_PROVIDER_TEXT = `    time = {\n      source  = \"hashicorp/time\"\n      version = \"${TERRAFORM_VERSIONS.time}\"\n    }`;\n\nconst TIME_SLEEP_TEXT = `resource \"time_sleep\" \"version_retention\" {\n  destroy_duration = \"15s\"\n\n  triggers = {\n    guardrail_id      = aws_bedrock_guardrail.this.guardrail_id\n    guardrail_version = aws_bedrock_guardrail_version.this.version\n  }\n\n  lifecycle {\n    create_before_destroy = true\n  }\n}`;\n\nconst ENTRY_ID = 'guardrailId = aws_bedrock_guardrail.this.guardrail_id';\nconst ENTRY_VERSION =\n  'guardrailVersion = aws_bedrock_guardrail_version.this.version';\n\n/** Every shape the migration rewrites, so a module missing one is reported rather than half-migrated. */\nconst REQUIRED_SHAPES = [\n  '`required_providers { $_ }`',\n  '`resource \"aws_bedrock_guardrail_version\" \"this\" { $_ }`',\n  `\\`module \"add_guardrail_to_runtime_config\" { $body }\\` where { $body <: and { contains \\`${ENTRY_ID}\\`, contains \\`${ENTRY_VERSION}\\` } }`,\n];\n\nconst divergedMessage = (filePath: string) =>\n  `${filePath}: has diverged from the generated shape - left untouched. To keep a replaced guardrail version until agents have read the new one, add the time provider to required_providers:\n\n${TIME_PROVIDER_TEXT}\n\nadd this resource:\n\n${TIME_SLEEP_TEXT}\n\nand make the runtime-config entry read guardrailId = time_sleep.version_retention.triggers.guardrail_id and guardrailVersion = time_sleep.version_retention.triggers.guardrail_version.`;\n\n/** The Terraform guardrail module of each Terraform-deployed `ts#agent#guardrails` agent. */\nconst guardedTerraformModules = (tree: Tree): string[] => {\n  const files = new Set<string>();\n  for (const project of getProjects(tree).values()) {\n    const components: ComponentMetadata[] =\n      (project.metadata as { components?: ComponentMetadata[] } | undefined)\n        ?.components ?? [];\n    for (const guardrail of components.filter(\n      (c) => c.generator === TS_AGENT_GUARDRAILS_GENERATOR_INFO.id,\n    )) {\n      const agent = components.find(\n        (c) =>\n          c.generator === TS_AGENT_GENERATOR_INFO.id &&\n          (c.name ?? 'agent') === guardrail.name,\n      );\n      if (agent?.iac !== 'terraform') {\n        continue;\n      }\n      const nameKebabCase = kebabCase(\n        agent.rc ?? toClassName(agent.name ?? 'agent'),\n      );\n      files.add(\n        joinPathFragments(\n          TERRAFORM_GUARDRAILS_DIR,\n          nameKebabCase,\n          `${nameKebabCase}-guardrail.tf`,\n        ),\n      );\n    }\n  }\n  return [...files];\n};\n\nconst migrateModule = async (\n  tree: Tree,\n  filePath: string,\n  nextSteps: string[],\n): Promise<void> => {\n  if (await matchGritQL(tree, filePath, hcl(TIME_SLEEP))) {\n    return; // Already migrated.\n  }\n\n  const shapeChecks = await Promise.all(\n    REQUIRED_SHAPES.map((shape) => matchGritQL(tree, filePath, hcl(shape))),\n  );\n  if (shapeChecks.includes(false)) {\n    nextSteps.push(divergedMessage(filePath));\n    return;\n  }\n\n  // Appended after the existing providers, so an entry the user changed is kept.\n  await insertViaGritQL(\n    tree,\n    filePath,\n    hcl(\n      `\\`required_providers { $body }\\` => \\`required_providers {\\n    $body\\n    ${GRIT_INSERT_PLACEHOLDER}\\n  }\\`` +\n        ' where { $body <: not contains `time = { $_ }` }',\n    ),\n    // The placeholder already sits at the entry's indentation.\n    TIME_PROVIDER_TEXT.replace(/^ {4}/, ''),\n  );\n\n  // After the version it keeps, where the generator writes it.\n  await insertViaGritQL(\n    tree,\n    filePath,\n    hcl(\n      `\\`resource \"aws_bedrock_guardrail_version\" \"this\" { $body }\\` => \\`resource \"aws_bedrock_guardrail_version\" \"this\" {\\n  $body\\n}\\n\\n${GRIT_INSERT_PLACEHOLDER}\\``,\n    ),\n    TIME_SLEEP_TEXT,\n  );\n\n  // Only the entry reads through the sleep; the module's outputs are unchanged.\n  await applyGritQL(\n    tree,\n    filePath,\n    hcl(\n      `\\`module \"add_guardrail_to_runtime_config\" { $body }\\` where { $body <: contains bubble \\`${ENTRY_ID}\\` => \\`guardrailId = time_sleep.version_retention.triggers.guardrail_id\\`, $body <: contains bubble \\`${ENTRY_VERSION}\\` => \\`guardrailVersion = time_sleep.version_retention.triggers.guardrail_version\\` }`,\n    ),\n  );\n};\n\nexport default async function migration(\n  tree: Tree,\n): Promise<MigrationReturnObject> {\n  const nextSteps: string[] = [];\n\n  for (const filePath of guardedTerraformModules(tree)) {\n    if (!tree.exists(filePath)) {\n      continue; // The guardrail module was removed or never added.\n    }\n    await migrateModule(tree, filePath, nextSteps);\n  }\n\n  await formatFilesInSubtree(tree);\n\n  return { nextSteps };\n}\n"],"names":["getProjects","joinPathFragments","TS_AGENT_GENERATOR_INFO","TS_AGENT_GUARDRAILS_GENERATOR_INFO","applyGritQL","GRIT_INSERT_PLACEHOLDER","insertViaGritQL","matchGritQL","formatFilesInSubtree","kebabCase","toClassName","PACKAGES_DIR","SHARED_TERRAFORM_DIR","TERRAFORM_VERSIONS","TERRAFORM_GUARDRAILS_DIR","hcl","pattern","TIME_SLEEP","TIME_PROVIDER_TEXT","time","TIME_SLEEP_TEXT","ENTRY_ID","ENTRY_VERSION","REQUIRED_SHAPES","divergedMessage","filePath","guardedTerraformModules","tree","files","Set","project","values","components","metadata","guardrail","filter","c","generator","id","agent","find","name","iac","nameKebabCase","rc","add","migrateModule","nextSteps","shapeChecks","Promise","all","map","shape","includes","push","replace","migration","exists"],"mappings":"AAAA;;;CAGC,GACD,SACEA,WAAW,EACXC,iBAAiB,QAGZ,aAAa;AACpB,SAASC,uBAAuB,QAAQ,iCAAiC;AACzE,SAASC,kCAAkC,QAAQ,4CAA4C;AAC/F,SACEC,WAAW,EACXC,uBAAuB,EACvBC,eAAe,EACfC,WAAW,QACN,wBAAwB;AAC/B,SAASC,oBAAoB,QAAQ,2BAA2B;AAChE,SAASC,SAAS,EAAEC,WAAW,QAAQ,0BAA0B;AAEjE,SACEC,YAAY,EACZC,oBAAoB,QACf,gDAAgD;AACvD,SAASC,kBAAkB,QAAQ,6BAA6B;AAEhE;;;;;;;;;;;;;;;;;;;;;;;CAuBC,GAED,MAAMC,2BAA2B,GAAGH,aAAa,CAAC,EAAEC,qBAAqB,mBAAmB,CAAC;AAE7F,MAAMG,MAAM,CAACC,UAAoB,CAAC,cAAc,EAAEA,SAAS;AAE3D,MAAMC,aAAa;AAEnB,kFAAkF,GAClF,MAAMC,qBAAqB,CAAC;;iBAEX,EAAEL,mBAAmBM,IAAI,CAAC;KACtC,CAAC;AAEN,MAAMC,kBAAkB,CAAC;;;;;;;;;;;CAWxB,CAAC;AAEF,MAAMC,WAAW;AACjB,MAAMC,gBACJ;AAEF,uGAAuG,GACvG,MAAMC,kBAAkB;IACtB;IACA;IACA,CAAC,yFAAyF,EAAEF,SAAS,eAAe,EAAEC,cAAc,MAAM,CAAC;CAC5I;AAED,MAAME,kBAAkB,CAACC,WACvB,GAAGA,SAAS;;AAEd,EAAEP,mBAAmB;;;;AAIrB,EAAEE,gBAAgB;;uLAEqK,CAAC;AAExL,2FAA2F,GAC3F,MAAMM,0BAA0B,CAACC;IAC/B,MAAMC,QAAQ,IAAIC;IAClB,KAAK,MAAMC,WAAW9B,YAAY2B,MAAMI,MAAM,GAAI;QAChD,MAAMC,aACJ,AAACF,QAAQG,QAAQ,EACbD,cAAc,EAAE;QACtB,KAAK,MAAME,aAAaF,WAAWG,MAAM,CACvC,CAACC,IAAMA,EAAEC,SAAS,KAAKlC,mCAAmCmC,EAAE,EAC3D;YACD,MAAMC,QAAQP,WAAWQ,IAAI,CAC3B,CAACJ,IACCA,EAAEC,SAAS,KAAKnC,wBAAwBoC,EAAE,IAC1C,AAACF,CAAAA,EAAEK,IAAI,IAAI,OAAM,MAAOP,UAAUO,IAAI;YAE1C,IAAIF,OAAOG,QAAQ,aAAa;gBAC9B;YACF;YACA,MAAMC,gBAAgBlC,UACpB8B,MAAMK,EAAE,IAAIlC,YAAY6B,MAAME,IAAI,IAAI;YAExCb,MAAMiB,GAAG,CACP5C,kBACEa,0BACA6B,eACA,GAAGA,cAAc,aAAa,CAAC;QAGrC;IACF;IACA,OAAO;WAAIf;KAAM;AACnB;AAEA,MAAMkB,gBAAgB,OACpBnB,MACAF,UACAsB;IAEA,IAAI,MAAMxC,YAAYoB,MAAMF,UAAUV,IAAIE,cAAc;QACtD,QAAQ,oBAAoB;IAC9B;IAEA,MAAM+B,cAAc,MAAMC,QAAQC,GAAG,CACnC3B,gBAAgB4B,GAAG,CAAC,CAACC,QAAU7C,YAAYoB,MAAMF,UAAUV,IAAIqC;IAEjE,IAAIJ,YAAYK,QAAQ,CAAC,QAAQ;QAC/BN,UAAUO,IAAI,CAAC9B,gBAAgBC;QAC/B;IACF;IAEA,+EAA+E;IAC/E,MAAMnB,gBACJqB,MACAF,UACAV,IACE,CAAC,2EAA2E,EAAEV,wBAAwB,OAAO,CAAC,GAC5G,qDAEJ,2DAA2D;IAC3Da,mBAAmBqC,OAAO,CAAC,SAAS;IAGtC,6DAA6D;IAC7D,MAAMjD,gBACJqB,MACAF,UACAV,IACE,CAAC,oIAAoI,EAAEV,wBAAwB,EAAE,CAAC,GAEpKe;IAGF,8EAA8E;IAC9E,MAAMhB,YACJuB,MACAF,UACAV,IACE,CAAC,0FAA0F,EAAEM,SAAS,uGAAuG,EAAEC,cAAc,sFAAsF,CAAC;AAG1T;AAEA,eAAe,eAAekC,UAC5B7B,IAAU;IAEV,MAAMoB,YAAsB,EAAE;IAE9B,KAAK,MAAMtB,YAAYC,wBAAwBC,MAAO;QACpD,IAAI,CAACA,KAAK8B,MAAM,CAAChC,WAAW;YAC1B,UAAU,mDAAmD;QAC/D;QACA,MAAMqB,cAAcnB,MAAMF,UAAUsB;IACtC;IAEA,MAAMvC,qBAAqBmB;IAE3B,OAAO;QAAEoB;IAAU;AACrB"}

package/src/preset/__snapshots__/generator.spec.ts.snap

@@ -259,7 +259,7 @@ export default {
 
 exports[`preset generator > should run successfully > biome.json 1`] = `
 "{
-  "$schema": "https://biomejs.dev/schemas/2.5.15/schema.json",
+  "$schema": "https://biomejs.dev/schemas/2.6.3/schema.json",
   "root": true,
   "formatter": {
     "enabled": true,
@@ -284,6 +284,16 @@ exports[`preset generator > should run successfully > biome.json 1`] = `
       "enabled": false
     }
   },
+  "markdown": {
+    "formatter": {
+      "enabled": false
+    }
+  },
+  "yaml": {
+    "formatter": {
+      "enabled": false
+    }
+  },
   "linter": {
     "enabled": true,
     "rules": {
@@ -424,11 +434,11 @@ onlyBuiltDependencies:
   - sharp
 catalogMode: strict
 catalog:
-  nx: 23.3.0
-  '@nx/js': 23.3.0
-  '@nx/workspace': 23.3.0
+  nx: 23.3.1
+  '@nx/js': 23.3.1
+  '@nx/workspace': 23.3.1
   typescript: ~6.0.3
-  '@biomejs/biome': 2.5.15
+  '@biomejs/biome': 2.6.3
   '@aws/nx-plugin': ^0.0.0
   '@aws/nx-plugin-mcp': ^0.0.0
 "

package/src/py/agent/__snapshots__/generator.constructs.spec.ts.snap

@@ -763,19 +763,19 @@ name = "proj.test_project"
 version = "0.1.0"
 dependencies = [
   "proj-agent-connection",
-  "aws-lambda-powertools==3.36.0",
+  "aws-lambda-powertools==3.37.0",
   "aws-opentelemetry-distro==0.21.0",
-  "bedrock-agentcore==1.24.2",
-  "boto3==1.43.115",
-  "fastapi==0.150.0",
+  "bedrock-agentcore==1.25.0",
+  "boto3==1.43.118",
+  "fastapi==0.162.0",
   "mcp==1.28.1",
-  "strands-agents==1.61.1",
-  "strands-agents-tools==0.8.9",
+  "strands-agents==1.62.0",
+  "strands-agents-tools==0.8.10",
   "uvicorn==0.54.0"
 ]
 
 [dependency-groups]
-dev = [ "fastapi[standard]==0.150.0" ]
+dev = [ "fastapi[standard]==0.162.0" ]
 
 [tool.uv]
 dev-dependencies = [ ]

package/src/py/agent/__snapshots__/generator.frameworks.spec.ts.snap

@@ -701,15 +701,15 @@ name = "proj.test_project"
 version = "0.1.0"
 dependencies = [
   "proj-agent-connection",
-  "aws-lambda-powertools==3.36.0",
+  "aws-lambda-powertools==3.37.0",
   "aws-opentelemetry-distro==0.21.0",
-  "bedrock-agentcore==1.24.2",
-  "boto3==1.43.115",
-  "fastapi==0.150.0",
+  "bedrock-agentcore==1.25.0",
+  "boto3==1.43.118",
+  "fastapi==0.162.0",
   "mcp==1.28.1",
-  "langchain==1.4.6",
+  "langchain==1.4.7",
   "langchain-aws==1.9.0",
-  "langgraph==1.2.16",
+  "langgraph==1.2.17",
   "langgraph-checkpoint-sqlite==3.1.2",
   "aiosqlite==0.22.1",
   "ag-ui-protocol==0.1.22",
@@ -718,7 +718,7 @@ dependencies = [
 ]
 
 [dependency-groups]
-dev = [ "fastapi[standard]==0.150.0" ]
+dev = [ "fastapi[standard]==0.162.0" ]
 
 [tool.uv]
 dev-dependencies = [ ]

package/src/py/agent/__snapshots__/generator.protocols.spec.ts.snap

@@ -5,7 +5,7 @@ exports[`py#agent generator > should create DynamoDB checkpoint table and S3 off
   required_providers {
     aws = {
       source  = "hashicorp/aws"
-      version = "6.69.1"
+      version = "6.70.0"
     }
     random = {
       source  = "hashicorp/random"
@@ -381,7 +381,7 @@ exports[`py#agent generator > should match snapshot for Terraform generated file
   required_providers {
     aws = {
       source  = "hashicorp/aws"
-      version = "6.69.1"
+      version = "6.70.0"
     }
     random = {
       source  = "hashicorp/random"
@@ -704,7 +704,7 @@ exports[`py#agent generator > should match snapshot for Terraform generated file
   required_providers {
     aws = {
       source  = "hashicorp/aws"
-      version = "6.69.1"
+      version = "6.70.0"
     }
     null = {
       source  = "hashicorp/null"
@@ -1063,7 +1063,7 @@ resource "null_resource" "runtime_ready" {
 
   provisioner "local-exec" {
     command = <<-EOT
-      uv run --with boto3==1.43.115 python -c "
+      uv run --with boto3==1.43.118 python -c "
 import boto3
 import json
 import os

package/src/py/agent/generator.js

@@ -8,7 +8,7 @@ import { addPyDependencies, addTsDependencies } from "../../utils/add-dependenci
 import { addAgentChatScripts } from "../../utils/agent-chat/agent-chat.js";
 import { AGENT_CONNECTION_PY_DEPENDENCIES, addPythonFrameworkBase, ensureLangchainS3CheckpointSaver, ensurePythonAgentConnectionProject, getPythonAgentConnectionModuleName, getPythonAgentConnectionProject } from "../../utils/agent-connection/agent-connection.js";
 import { addAgentInfra } from "../../utils/agent-core-constructs/agent-core-constructs.js";
-import { addPythonCodePackageTarget, agentCorePythonRuntime, isAgentCoreHosted, isContainerHosted } from "../../utils/agent-core-packaging.js";
+import { addPythonCodePackageTarget, agentCorePythonRuntime, isAgentCoreHosted, isContainerHosted, PYTHON_AGENT_CORE_LAUNCHER } from "../../utils/agent-core-packaging.js";
 import { addPythonBundleTarget } from "../../utils/bundle/bundle.js";
 import { resolveContainers } from "../../utils/containers.js";
 import { declareDependencies, ownedElsewhere } from "../../utils/declared-dependencies.js";
@@ -372,7 +372,7 @@ export const pyAgentGenerator = async (tree, options)=>{
                 type: 'code',
                 outputDir: packageOutputDir,
                 runtime: agentCorePythonRuntime(),
-                entryPoint: 'main.py'
+                entryPoint: PYTHON_AGENT_CORE_LAUNCHER
             };
         }
         // Add shared constructs