@aws/nx-plugin-mcp 1.0.0-rc.0 → 1.0.0-rc.10

package/docs/guides/py-agent.mdx

@@ -47,7 +47,7 @@ First use the <Link path="/guides/python-project">`py#project`</Link> generator
 
 The generator will add the following files to your existing Python project. The files generated depend on the chosen `protocol`:
 
-<OptionFilter when={{ protocol: 'HTTP' }} description="FastAPI HTTP server layout">
+<OptionFilter when={{ protocol: 'http' }} description="FastAPI HTTP server layout">
 ### HTTP Protocol (default)
 
 <FileTree>
@@ -58,13 +58,13 @@ The generator will add the following files to your existing Python project. The
         - init.py FastAPI application setup with CORS and error handling middleware
         - agent.py Main agent definition with sample tools
         - main.py FastAPI entry point for Bedrock AgentCore Runtime
-        - Dockerfile Entry point for hosting your agent (excluded when `computeType` is set to `None`)
+        - Dockerfile Entry point for hosting your agent (excluded when `infra` is set to `None`)
     - pyproject.toml Updated with Strands dependencies
     - project.json Updated with agent serve targets
 </FileTree>
 </OptionFilter>
 
-<OptionFilter when={{ protocol: 'A2A' }} description="Strands A2A server layout">
+<OptionFilter when={{ protocol: 'a2a' }} description="Strands A2A server layout">
 ### A2A Protocol
 
 The entry point uses the [Strands A2A Server](https://strandsagents.com/docs/user-guide/concepts/multi-agent/agent-to-agent) instead of FastAPI:
@@ -76,13 +76,13 @@ The entry point uses the [Strands A2A Server](https://strandsagents.com/docs/use
         - \_\_init\_\_.py Python package initialization
         - agent.py Main agent definition with sample tools
         - main.py A2A server entry point
-        - Dockerfile Entry point for hosting your agent (excluded when `computeType` is set to `None`)
+        - Dockerfile Entry point for hosting your agent (excluded when `infra` is set to `None`)
     - pyproject.toml Updated with Strands dependencies
     - project.json Updated with agent serve targets
 </FileTree>
 </OptionFilter>
 
-<OptionFilter when={{ protocol: 'AG-UI' }} description="AG-UI / CopilotKit server layout">
+<OptionFilter when={{ protocol: 'ag-ui' }} description="AG-UI / CopilotKit server layout">
 ### AG-UI Protocol
 
 The entry point uses the [ag-ui-strands](https://docs.ag-ui.com/) integration, which exposes your agent via the AG-UI protocol for direct frontend integration with [CopilotKit](https://docs.copilotkit.ai/aws-strands):
@@ -94,7 +94,7 @@ The entry point uses the [ag-ui-strands](https://docs.ag-ui.com/) integration, w
         - \_\_init\_\_.py Python package initialization
         - agent.py Main agent definition with sample tools
         - main.py AG-UI server entry point using ag-ui-strands
-        - Dockerfile Entry point for hosting your agent (excluded when `computeType` is set to `None`)
+        - Dockerfile Entry point for hosting your agent (excluded when `infra` is set to `None`)
     - pyproject.toml Updated with Strands and AG-UI dependencies
     - project.json Updated with agent serve targets
 </FileTree>
@@ -106,7 +106,7 @@ AG-UI agents can be connected to a React frontend using the <Link path="/guides/
 
 ### Infrastructure
 
-<OptionFilter when={{ computeType: 'BedrockAgentCoreRuntime' }} description="Bedrock AgentCore Runtime deployment">
+<OptionFilter when={{ infra: 'agentcore' }} description="Bedrock AgentCore Runtime deployment">
 <Snippet name="shared-constructs" />
 
 For deploying your Agent, the following files are generated:
@@ -136,8 +136,8 @@ For deploying your Agent, the following files are generated:
 </Infrastructure>
 </OptionFilter>
 
-<OptionFilter when={{ computeType: 'None' }} description="No infrastructure is vended for computeType=None">
-If you selected `None` for `computeType`, no CDK constructs or Terraform modules are generated — the Agent can only be run locally. The `auth` option is ignored in this mode since there is no hosted endpoint to authenticate.
+<OptionFilter when={{ infra: 'none' }} description="No infrastructure is vended for infra=none">
+If you selected `none` for `infra`, no CDK constructs or Terraform modules are generated — the Agent can only be run locally. The `auth` option is ignored in this mode since there is no hosted endpoint to authenticate.
 </OptionFilter>
 
 #### Architecture
@@ -235,7 +235,7 @@ Your agent's server protocol determines how it communicates. All options are ser
 
 All protocols expose `/ping` for the AgentCore runtime health check contract. A2A agents listen on port `9000`; HTTP and AG-UI agents listen on port `8080`. The generated Dockerfile and infrastructure are configured for you.
 
-<OptionFilter when={{ protocol: 'HTTP' }} description="FastAPI HTTP server details">
+<OptionFilter when={{ protocol: 'http' }} description="FastAPI HTTP server details">
 ## FastAPI Server (HTTP protocol)
 
 The generated HTTP server includes:
@@ -319,7 +319,7 @@ You can find more details about the SDK's capabilities in the [documentation her
 Since the generator vends CDK or Terraform infrastructure which manages deploying your agent, you do not need to utilise the `bedrock-agentcore-starter-toolkit` which the docs mention for deploying your agent.
 :::
 
-<OptionFilter when={{ protocol: 'A2A' }} description="A2A server details">
+<OptionFilter when={{ protocol: 'a2a' }} description="A2A server details">
 ## A2A Server (A2A protocol)
 
 The generated `main.py` mounts `A2AServer.to_fastapi_app()` onto a parent FastAPI app that also exposes `/ping`. When deployed to AgentCore, the entry point resolves the runtime's public ARN from AppConfig and advertises it in the agent card.
@@ -327,7 +327,7 @@ The generated `main.py` mounts `A2AServer.to_fastapi_app()` onto a parent FastAP
 Most users will not need to modify this file — edit `agent.py` to change tools or the system prompt. The A2A server populates the agent card (`/.well-known/agent-card.json`) from the `Agent` constructor's `name` and `description`.
 </OptionFilter>
 
-<OptionFilter when={{ protocol: 'AG-UI' }} description="AG-UI / CopilotKit server details">
+<OptionFilter when={{ protocol: 'ag-ui' }} description="AG-UI / CopilotKit server details">
 ## AG-UI Server (AG-UI protocol)
 
 The generated `main.py` wraps your Strands `Agent` in an `ag_ui_strands.StrandsAgent` and creates a FastAPI app via `create_strands_app()`. The resulting app exposes a single POST endpoint that streams [AG-UI](https://docs.ag-ui.com/) events over Server-Sent Events (SSE), as well as `/ping` for the AgentCore runtime health check.
@@ -364,7 +364,7 @@ For **HTTP** agents, the generator also emits:
 
 When you customize the agent's input shape (e.g. add new fields to `InvokeInput`), update `chat.ts` to pass the new fields when invoking the agent and the rest works automatically.
 
-<OptionFilter when={{ computeType: 'BedrockAgentCoreRuntime' }} description="Bedrock AgentCore Runtime deployment details">
+<OptionFilter when={{ infra: 'agentcore' }} description="Bedrock AgentCore Runtime deployment details">
 ## Deploying Your Agent to Bedrock AgentCore Runtime
 
 <Snippet name="agent/bedrock-deployment" parentHeading="Deploying Your Agent to Bedrock AgentCore Runtime" />
@@ -389,7 +389,7 @@ For more details, refer to the [AgentCore documentation on observability](https:
 
 ## Invoking your Agent
 
-<OptionFilter when={{ protocol: 'HTTP' }} description="FastAPI HTTP invocation details">
+<OptionFilter when={{ protocol: 'http' }} description="FastAPI HTTP invocation details">
 ### Invoke the Local Server
 
 To invoke an Agent running locally via the `<your-agent-name>-serve` target, you can send a simple POST request to `/invocations` on the port your local agent is running on. For example, with `curl`:
@@ -409,7 +409,7 @@ The `-N` argument given to `curl` disables buffering the output stream, so you c
 <Snippet name="agent/runtime-arn" parentHeading="Invoke the Deployed Agent" />
 
 <Tabs syncKey="auth">
-<TabItem label="IAM" _filter={{ auth: 'IAM' }}>
+<TabItem label="IAM" _filter={{ auth: 'iam' }}>
 #### IAM Authentication
 
 For IAM Authentication, the request must be signed using AWS Signature Version 4 (SigV4).
@@ -426,7 +426,7 @@ acurl <region> bedrock-agentcore -N -X POST \
 </Drawer>
 </TabItem>
 
-<TabItem label="Cognito" _filter={{ auth: 'Cognito' }}>
+<TabItem label="Cognito" _filter={{ auth: 'cognito' }}>
 #### JWT / Cognito Authentication
 
 For Cognito Authentication, pass the Cognito Access Token in the `Authorization` header:
@@ -462,7 +462,7 @@ For invoking your Agent from a React website, you can make use of the <Link path
 Refer to the <Link path="/guides/connection/react-py-agent">`connection` generator guide</Link> for details about how the connection is set up.
 </OptionFilter>
 
-<OptionFilter when={{ protocol: 'A2A' }} description="A2A delegation details">
+<OptionFilter when={{ protocol: 'a2a' }} description="A2A delegation details">
 ### Invoking an A2A Agent as a Tool
 
 To delegate work from this agent to a remote A2A agent (either <Link path="/guides/ts-agent">TypeScript</Link> or <Link path="/guides/py-agent">Python</Link>), use the <Link path="/guides/connection/py-agent-a2a">`connection` generator</Link>. It vends a SigV4-authenticated client for the target agent and AST-transforms this agent's `agent.py` to register the remote A2A agent as a `@tool`-decorated delegate.
@@ -472,7 +472,7 @@ To delegate work from this agent to a remote A2A agent (either <Link path="/guid
 Refer to the <Link path="/guides/connection/py-agent-a2a">`connection` generator guide</Link> for details about how the connection is set up.
 </OptionFilter>
 
-<OptionFilter when={{ protocol: 'AG-UI' }} description="AG-UI / React connection details">
+<OptionFilter when={{ protocol: 'ag-ui' }} description="AG-UI / React connection details">
 ### Invoking an AG-UI Agent
 
 To invoke your AG-UI agent from a React website, use the <Link path="/guides/connection/react-agui">`connection` generator</Link>, which wires up a [CopilotKit](https://docs.copilotkit.ai/aws-strands) client configured for your deployed agent with the correct authentication (IAM or Cognito).

package/docs/guides/py-mcp-server.mdx

@@ -49,21 +49,21 @@ The generator will add the following files to your existing Python project:
         - server.py Main server definition with sample tools and resources
         - stdio.py Entry point for STDIO transport, useful for simple local MCP servers
         - http.py Entry point for Streamable HTTP transport, useful for hosting your MCP server
-        - Dockerfile Entry point for hosting your MCP server (excluded when `computeType` is set to `None`)
+        - Dockerfile Entry point for hosting your MCP server (excluded when `infra` is set to `None`)
     - pyproject.toml Updated with MCP dependencies
     - project.json Updated with MCP server serve targets
 </FileTree>
 
 ### Infrastructure
 
-<OptionFilter when={{ computeType: 'BedrockAgentCoreRuntime' }} description="Bedrock AgentCore Runtime deployment">
+<OptionFilter when={{ infra: 'agentcore' }} description="Bedrock AgentCore Runtime deployment">
 <Snippet name="shared-constructs" />
 
 <Snippet name="mcp/shared-constructs" />
 </OptionFilter>
 
-<OptionFilter when={{ computeType: 'None' }} description="No infrastructure is vended for computeType=None">
-If you selected `None` for `computeType`, no CDK constructs or Terraform modules are generated — the MCP server is configured for local STDIO / HTTP use only. The `auth` option is ignored in this mode since there is no hosted endpoint to authenticate.
+<OptionFilter when={{ infra: 'none' }} description="No infrastructure is vended for infra=none">
+If you selected `none` for `infra`, no CDK constructs or Terraform modules are generated — the MCP server is configured for local STDIO / HTTP use only. The `auth` option is ignored in this mode since there is no hosted endpoint to authenticate.
 </OptionFilter>
 
 #### Architecture
@@ -117,12 +117,16 @@ def dynamic_resource(item_id: str) -> str:
 
 ### Inspector
 
-The generator configures a target named `<your-server-name>-inspect`, which starts the [MCP Inspector](https://github.com/modelcontextprotocol/inspector) with the configuration to connect to your MCP server using STDIO transport.
+The generator configures a target named `<your-server-name>-inspect`, which starts your MCP server locally (via the `<your-server-name>-serve-local` target, including any connected dependencies such as a local database) and launches the [MCP Inspector](https://github.com/modelcontextprotocol/inspector) pre-configured to connect to it over Streamable HTTP transport.
 
 <NxCommands commands={['your-server-name-inspect your-project']} />
 
 This will start the inspector at `http://localhost:6274`. Get started by clicking on the "Connect" button.
 
+:::tip
+To inspect the server using STDIO transport instead, use the `<your-server-name>-inspect-stdio` target, which launches the inspector against a STDIO instance of your server.
+:::
+
 ### STDIO
 
 The easiest way to test and use an MCP server is by using the inspector or configuring it with an AI assistant (as above).
@@ -141,7 +145,7 @@ If you would like to run your MCP server locally using [Streamable HTTP transpor
 
 This command uses `uv run uvicorn --reload` to run your MCP server with HTTP transport (typically on port `8000`), and automatically restarts when files change.
 
-<OptionFilter when={{ computeType: 'BedrockAgentCoreRuntime' }} description="Bedrock AgentCore Runtime deployment details">
+<OptionFilter when={{ infra: 'agentcore' }} description="Bedrock AgentCore Runtime deployment details">
 ## Deploying Your MCP Server to Bedrock AgentCore Runtime
 
 <Snippet name="mcp/bedrock-deployment" parentHeading="Deploying Your MCP Server to Bedrock AgentCore Runtime" />

package/docs/guides/python-lambda-function.mdx

@@ -163,8 +163,8 @@ Default metrics include:
 
 ### Type Safety
 
-<OptionFilter not when={{ eventSource: 'Any' }} description="Typed eventSource wires @event_parser with a Pydantic model">
-If you chose an `eventSource` when generating your lambda function, your function is instrumented with [`@event_parser` from AWS Lambda Powertools](https://docs.powertools.aws.dev/lambda/python/latest/utilities/parser/). For example:
+<OptionFilter not when={{ event: 'Any' }} description="Typed event wires @event_parser with a Pydantic model">
+If you chose an `event` when generating your lambda function, your function is instrumented with [`@event_parser` from AWS Lambda Powertools](https://docs.powertools.aws.dev/lambda/python/latest/utilities/parser/). For example:
 
 ```python {3}
 @event_parser(model=EventBridgeModel)
@@ -179,8 +179,8 @@ If you have custom data nested within an event, for example a DynamoDB stream or
 :::
 </OptionFilter>
 
-<OptionFilter when={{ eventSource: 'Any' }} description="eventSource=Any — no parser decorator, event is untyped">
-If you selected `Any` for your `eventSource`, the `@event_parser` decorator is not applied and the handler receives an untyped event dict. Regenerate with a specific `eventSource` if you want Pydantic validation and typed field access.
+<OptionFilter when={{ event: 'Any' }} description="event=Any — no parser decorator, event is untyped">
+If you selected `Any` for your `event`, the `@event_parser` decorator is not applied and the handler receives an untyped event dict. Regenerate with a specific `event` if you want Pydantic validation and typed field access.
 </OptionFilter>
 
 ## Bundling

package/docs/guides/react-website-auth.mdx

@@ -152,6 +152,21 @@ The user identity module automatically adds the necessary <Link path="guides/rea
 </Fragment>
 </Infrastructure>
 
+:::caution[Remove localhost callback URLs for production]
+The generated User Pool client allows your CloudFront distribution URL as an OAuth callback/logout URL, plus `http://localhost:4200` and `http://localhost:4300` for local development against the deployed pool.
+
+It is recommended to **remove the `http://localhost` callback/logout URLs for production stages**, keeping the allowlist limited to your real application origins.
+
+<Infrastructure>
+<Fragment slot="cdk">
+Edit the callback/logout URLs in `packages/common/constructs/src/core/user-identity.ts`.
+</Fragment>
+<Fragment slot="terraform">
+Edit the `callback_urls`/`logout_urls` in `packages/common/terraform/src/core/user-identity/identity/identity.tf`.
+</Fragment>
+</Infrastructure>
+:::
+
 ### Granting Access to Authenticated Users
 
 In order to grant authenticated users access to perform certain actions, such as granting permissions to invoke an API, you can add IAM policy statements to the identity pool authenticated role:

package/docs/guides/react-website.mdx

@@ -1,7 +1,7 @@
 ---
 title: React Website
 description: Reference documentation for a React Website
-generator: ts#react-website
+generator: ts#website
 when:
   framework:
     - react
@@ -30,7 +30,7 @@ The default `uxProvider` is [Cloudscape](http://cloudscape.design/). You can als
 
 You can generate a new React Website in two ways:
 
-<RunGenerator generator="ts#website" />
+<RunGenerator generator="ts#website" requiredParameters={{ framework: 'react' }} />
 
 ### Options
 
@@ -126,15 +126,21 @@ waf -> cloudfront
 cloudfront -> s3
 ```
 
+#### Security Headers
+
+The CloudFront distribution applies a response headers policy that sets `Strict-Transport-Security`, `X-Content-Type-Options`, `X-Frame-Options: DENY` and `Referrer-Policy` on all responses. A `Content-Security-Policy` is intentionally not set by default, since a useful CSP is specific to your application - add one to the response headers policy (CDK) or `aws_cloudfront_response_headers_policy` resource (Terraform) once you know which origins, scripts and styles your site loads.
+
+`runtime-config.json` is served with `Cache-Control: no-cache` so that browsers always fetch the latest configuration after a redeploy, rather than using a stale cached copy.
+
 ## Implementing your React Website
 
 The [React documentation](https://react.dev/learn) is a good place to start to learn the basics of building with React.
 
-<OptionFilter when={{ uxProvider: 'Cloudscape' }} description="Cloudscape component docs pointer">
+<OptionFilter when={{ ux: 'cloudscape' }} description="Cloudscape component docs pointer">
 You can refer to the [Cloudscape documentation](https://cloudscape.design/components/) for details about the available components and how to use them.
 </OptionFilter>
 
-<OptionFilter when={{ uxProvider: 'Shadcn' }} description="Shadcn component docs pointer">
+<OptionFilter when={{ ux: 'shadcn' }} description="Shadcn component docs pointer">
 You can refer to the [shadcn/ui documentation](https://ui.shadcn.com/docs) for details about the available components and how to use them.
 </OptionFilter>
 
@@ -185,7 +191,7 @@ Configuration from your infrastructure is provided to your website via <Link hre
 
 <Infrastructure>
 <Fragment slot="cdk">
-The `RuntimeConfig` CDK construct can be used to add and retrieve configuration in your CDK infrastructure. The CDK constructs generated by `@aws/nx-plugin` generators (such as <Link path="guides/trpc">`ts#trpc-api`</Link> and <Link path="guides/fastapi">`py#fast-api`</Link>) will automatically add appropriate values to the `RuntimeConfig`.
+The `RuntimeConfig` CDK construct can be used to add and retrieve configuration in your CDK infrastructure. The CDK constructs generated by `@aws/nx-plugin` generators (such as <Link path="guides/trpc">`ts#api`</Link> and <Link path="guides/fastapi">`py#api`</Link>) will automatically add appropriate values to the `RuntimeConfig`.
 
 Your website CDK construct will deploy the `connection` namespace of the runtime configuration as a `runtime-config.json` file to the root of your S3 bucket.
 
@@ -214,7 +220,7 @@ With CDK, the website construct can be declared at any point in your stack. Runt
 :::
 </Fragment>
 <Fragment slot="terraform">
-With Terraform, runtime configuration is managed through the runtime-config modules. The Terraform modules generated by `@aws/nx-plugin` generators (such as <Link path="guides/trpc">`ts#trpc-api`</Link> and <Link path="guides/fastapi">`py#fast-api`</Link>) will automatically add appropriate values to the runtime configuration.
+With Terraform, runtime configuration is managed through the runtime-config modules. The Terraform modules generated by `@aws/nx-plugin` generators (such as <Link path="guides/trpc">`ts#api`</Link> and <Link path="guides/fastapi">`py#api`</Link>) will automatically add appropriate values to the runtime configuration.
 
 Your website Terraform module will deploy the `connection` namespace of the runtime configuration as a `runtime-config.json` file to the root of your S3 bucket.
 

package/docs/guides/trpc.mdx

@@ -1,9 +1,10 @@
 ---
 title: tRPC
 description: Reference documentation for tRPC
-generator: ts#trpc-api
+generator: ts#api
 when:
   framework: [trpc]
+  infra: [rest-lambda, http-lambda]
 ---
 import { FileTree, Tabs, TabItem } from '@astrojs/starlight/components';
 import Link from '@components/link.astro';
@@ -24,16 +25,16 @@ The tRPC API generator creates a new tRPC API with AWS CDK or Terraform infrastr
 
 You can generate a new tRPC API in two ways:
 
-<RunGenerator generator="ts#trpc-api" />
+<RunGenerator generator="ts#api" requiredParameters={{ framework: 'trpc' }} />
 
 ### Options
 
-<GeneratorParameters generator="ts#trpc-api" />
+<GeneratorParameters generator="ts#api" />
 
 <Snippet name="api/api-choice-note" />
 
 :::tip[API Type]
-Select `ServerlessApiGatewayRestApi` (default) as your `computeType` if you would like to use [tRPC Subscriptions](https://trpc.io/docs/server/subscriptions) to stream responses.
+Select `rest-lambda` (default) as your `infra` if you would like to use [tRPC Subscriptions](https://trpc.io/docs/server/subscriptions) to stream responses.
 :::
 
 :::tip[Integration Pattern]
@@ -151,10 +152,10 @@ The use of `query` to define the implementation indicates that the operation is
 
 If you add a new procedure, make sure you register it by adding it to the router in `src/router.ts`.
 
-<OptionFilter when={{ computeType: 'ServerlessApiGatewayRestApi' }} description="Streaming subscriptions — REST API only, uses SSE">
+<OptionFilter when={{ infra: 'rest-lambda' }} description="Streaming subscriptions — REST API only, uses SSE">
 ### Subscriptions (Streaming)
 
-tRPC subscriptions allow you to stream data from the server to the client using [Server-Sent Events (SSE)](https://developer.mozilla.org/en-US/docs/Web/API/Server-sent_events). When you select `ServerlessApiGatewayRestApi` as your compute type, the generator automatically configures the infrastructure required for streaming, as well as a streaming Lambda handler and the `ZodAsyncIterable` schema helper.
+tRPC subscriptions allow you to stream data from the server to the client using [Server-Sent Events (SSE)](https://developer.mozilla.org/en-US/docs/Web/API/Server-sent_events). When you select `rest-lambda` as your compute type, the generator automatically configures the infrastructure required for streaming, as well as a streaming Lambda handler and the `ZodAsyncIterable` schema helper.
 
 To define a subscription procedure, use the `.subscription` method with an async generator function. Use the `ZodAsyncIterable` helper from `src/schema/z-async-iterable.ts` to define the output schema:
 
@@ -290,7 +291,7 @@ You can add additional values to the context provided to procedures by implement
 
 As an example, let's implement some middlware to extract some details about the calling user from our API in `src/middleware/identity.ts`.
 
-<OptionFilter when={{ auth: 'IAM' }} description="Identity middleware example for IAM-authenticated APIs">
+<OptionFilter when={{ auth: 'iam' }} description="Identity middleware example for IAM-authenticated APIs">
 This example walks through identity middleware for `IAM` authentication. We look up the caller in Cognito using the sub extracted from the API Gateway event.
 
 First, we define what we'll add to the context:
@@ -326,7 +327,7 @@ export const createIdentityPlugin = () => {
 In our case, we want to extract details about the calling Cognito user. We'll do that by extracting the user's subject ID (or "sub") from the API Gateway event, and retrieving user details from Cognito. The implementation varies depending on whether the event was provided to our function by a REST API or an HTTP API:
 
 <Tabs syncKey="http-rest">
-<TabItem label="REST API" _filter={{ computeType: 'ServerlessApiGatewayRestApi' }}>
+<TabItem label="REST API" _filter={{ infra: 'rest-lambda' }}>
 ```ts
 import { CognitoIdentityProvider } from '@aws-sdk/client-cognito-identity-provider';
 import { initTRPC, TRPCError } from '@trpc/server';
@@ -389,7 +390,7 @@ export const createIdentityPlugin = () => {
 };
 ```
 </TabItem>
-<TabItem label="HTTP API" _filter={{ computeType: 'ServerlessApiGatewayHttpApi' }}>
+<TabItem label="HTTP API" _filter={{ infra: 'http-lambda' }}>
 ```ts
 import { CognitoIdentityProvider } from '@aws-sdk/client-cognito-identity-provider';
 import { initTRPC, TRPCError } from '@trpc/server';
@@ -461,8 +462,8 @@ export const createIdentityPlugin = () => {
 </Tabs>
 </OptionFilter>
 
-<OptionFilter when={{ auth: 'Cognito' }} description="Identity middleware example for Cognito-authenticated APIs">
-When you deploy with `auth: 'Cognito'`, the API Gateway Cognito User Pools authorizer verifies the JWT that the caller supplies in the `Authorization` header and places the verified claims on the Lambda event at `event.requestContext.authorizer.claims`. Our middleware just reads those claims — no extra AWS SDK calls, no manual JWT verification.
+<OptionFilter when={{ auth: 'cognito' }} description="Identity middleware example for Cognito-authenticated APIs">
+When you deploy with `auth: 'cognito'`, the API Gateway Cognito User Pools authorizer verifies the JWT that the caller supplies in the `Authorization` header and places the verified claims on the Lambda event at `event.requestContext.authorizer.claims`. Our middleware just reads those claims — no extra AWS SDK calls, no manual JWT verification.
 
 First, we define what we'll add to the context:
 
@@ -553,7 +554,7 @@ The tRPC API generator creates CDK or Terraform infrastructure as code based on
 <Fragment slot="cdk">
 The CDK construct for deploying your API lives in the `common/constructs` folder. You can consume this in a CDK application, for example:
 
-<OptionFilter when={{ auth: ['IAM', 'Custom'] }} description="CDK usage for IAM or Custom authentication">
+<OptionFilter when={{ auth: ['iam', 'custom'] }} description="CDK usage for IAM or Custom authentication">
 ```ts {6-8}
 import { MyApi } from ':my-scope/common-constructs';
 
@@ -572,7 +573,7 @@ When using `Custom` auth, the construct creates a Lambda Authorizer internally f
 :::
 </OptionFilter>
 
-<OptionFilter when={{ auth: 'Cognito' }} description="CDK usage with Cognito authentication — pass the identity construct">
+<OptionFilter when={{ auth: 'cognito' }} description="CDK usage with Cognito authentication — pass the identity construct">
 ```ts {6,9}
 import { MyApi, UserIdentity } from ':my-scope/common-constructs';
 
@@ -601,7 +602,7 @@ The Terraform modules for deploying your API are in the `common/terraform` folde
 
 The API module stages its Lambda deployment zip in a shared S3 asset bucket — see the <Link path="/guides/terraform-project">Terraform infrastructure guide</Link> for details. Instantiate the `core/asset-bucket` module once per deployment and pass its `bucket_name` output into every API / Lambda module via the `asset_bucket_name` input:
 
-<OptionFilter when={{ auth: ['IAM', 'Custom'] }} description="Terraform usage for IAM or Custom authentication">
+<OptionFilter when={{ auth: ['iam', 'custom'] }} description="Terraform usage for IAM or Custom authentication">
 ```hcl {1-3, 8}
 module "asset_bucket" {
   source = "../../common/terraform/src/core/asset-bucket"
@@ -628,7 +629,7 @@ module "my_api" {
 ```
 </OptionFilter>
 
-<OptionFilter when={{ auth: 'Cognito' }} description="Terraform usage with Cognito authentication — supply user pool and client">
+<OptionFilter when={{ auth: 'cognito' }} description="Terraform usage with Cognito authentication — supply user pool and client">
 ```hcl {1-3, 8-9}
 module "asset_bucket" {
   source = "../../common/terraform/src/core/asset-bucket"
@@ -711,7 +712,7 @@ module "my_api" {
 }
 ```
 
-<OptionFilter when={{ auth: 'Custom' }} description="Custom Lambda Authorizer usage with Terraform">
+<OptionFilter when={{ auth: 'custom' }} description="Custom Lambda Authorizer usage with Terraform">
 :::caution[Custom Lambda Authorizer]
 When using `Custom` auth, your API is protected by a Lambda Authorizer that **denies all requests by default**. You must implement your authorization logic in the generated `src/authorizer.ts` file before your API will accept any traffic.
 :::
@@ -719,7 +720,7 @@ When using `Custom` auth, your API is protected by a Lambda Authorizer that **de
 </Fragment>
 </Infrastructure>
 
-<OptionFilter when={{ computeType: 'ServerlessApiGatewayRestApi' }} description="WAF — REST APIs get a WAF Web ACL by default">
+<OptionFilter when={{ infra: 'rest-lambda' }} description="WAF — REST APIs get a WAF Web ACL by default">
 ### WAF
 
 <Snippet name="api/waf-configuration" parentHeading="WAF" />
@@ -733,7 +734,7 @@ When using `Custom` auth, your API is protected by a Lambda Authorizer that **de
 If you selected CDK for your `iacProvider`, when you add or remove a procedure in your tRPC API, these changes will be reflected immediately in the CDK construct without the need to rebuild.
 :::
 
-<OptionFilter when={{ auth: 'IAM' }} description="Granting API invoke access — IAM-authenticated APIs only">
+<OptionFilter when={{ auth: 'iam' }} description="Granting API invoke access — IAM-authenticated APIs only">
 ### Granting Access (IAM Only)
 
 You can grant access to your API as follows:

package/docs/guides/ts-agent.mdx

@@ -47,7 +47,7 @@ First use the <Link path="/guides/typescript-project">`ts#project`</Link> genera
 
 The generator will add the following files to your existing TypeScript project. The files generated depend on the chosen `protocol`:
 
-<OptionFilter when={{ protocol: 'HTTP' }} description="tRPC-over-WebSocket layout">
+<OptionFilter when={{ protocol: 'http' }} description="tRPC-over-WebSocket layout">
 ### HTTP Protocol (default)
 
 <FileTree>
@@ -60,13 +60,13 @@ The generator will add the following files to your existing TypeScript project.
         - agent.ts Main agent definition with sample tools
         - client.ts Vended client for invoking your agent
         - agent-core-trpc-client.ts Client factory for connecting to agents on AgentCore Runtime
-        - Dockerfile Entry point for hosting your agent (excluded when `computeType` is set to `None`)
+        - Dockerfile Entry point for hosting your agent (excluded when `infra` is set to `None`)
     - package.json Updated with Strands dependencies
     - project.json Updated with agent serve targets
 </FileTree>
 </OptionFilter>
 
-<OptionFilter when={{ protocol: 'A2A' }} description="Strands A2A Express server layout">
+<OptionFilter when={{ protocol: 'a2a' }} description="Strands A2A Express server layout">
 ### A2A Protocol
 
 The entry point uses the [Strands A2A Express Server](https://strandsagents.com/docs/user-guide/concepts/multi-agent/agent-to-agent) instead of tRPC:
@@ -77,13 +77,13 @@ The entry point uses the [Strands A2A Express Server](https://strandsagents.com/
       - agent/ (or custom name if specified)
         - index.ts A2A Express server entry point
         - agent.ts Main agent definition with sample tools
-        - Dockerfile Entry point for hosting your agent (excluded when `computeType` is set to `None`)
+        - Dockerfile Entry point for hosting your agent (excluded when `infra` is set to `None`)
     - package.json Updated with Strands and Express dependencies
     - project.json Updated with agent serve targets
 </FileTree>
 </OptionFilter>
 
-<OptionFilter when={{ protocol: 'AG-UI' }} description="AG-UI SSE-over-POST server layout">
+<OptionFilter when={{ protocol: 'ag-ui' }} description="AG-UI SSE-over-POST server layout">
 ### AG-UI Protocol
 
 The entry point uses [`@ag-ui/aws-strands`](https://www.npmjs.com/package/@ag-ui/aws-strands) to expose the agent via the [AG-UI protocol](https://docs.ag-ui.com/) (SSE over POST), compatible with [CopilotKit](https://docs.copilotkit.ai/aws-strands):
@@ -94,7 +94,7 @@ The entry point uses [`@ag-ui/aws-strands`](https://www.npmjs.com/package/@ag-ui
       - agent/ (or custom name if specified)
         - index.ts AG-UI server entry point (Express + SSE)
         - agent.ts Main agent definition with sample tools
-        - Dockerfile Entry point for hosting your agent (excluded when `computeType` is set to `None`)
+        - Dockerfile Entry point for hosting your agent (excluded when `infra` is set to `None`)
     - package.json Updated with Strands and AG-UI dependencies
     - project.json Updated with agent serve targets
 </FileTree>
@@ -102,7 +102,7 @@ The entry point uses [`@ag-ui/aws-strands`](https://www.npmjs.com/package/@ag-ui
 
 ### Infrastructure
 
-<OptionFilter when={{ computeType: 'BedrockAgentCoreRuntime' }} description="Bedrock AgentCore Runtime deployment">
+<OptionFilter when={{ infra: 'agentcore' }} description="Bedrock AgentCore Runtime deployment">
 <Snippet name="shared-constructs" />
 
 For deploying your Agent, the following files are generated:
@@ -132,8 +132,8 @@ For deploying your Agent, the following files are generated:
 </Infrastructure>
 </OptionFilter>
 
-<OptionFilter when={{ computeType: 'None' }} description="No infrastructure is vended for computeType=None">
-If you selected `None` for `computeType`, no CDK constructs or Terraform modules are generated — the Agent can only be run locally. The `auth` option is ignored in this mode since there is no hosted endpoint to authenticate.
+<OptionFilter when={{ infra: 'none' }} description="No infrastructure is vended for infra=none">
+If you selected `none` for `infra`, no CDK constructs or Terraform modules are generated — the Agent can only be run locally. The `auth` option is ignored in this mode since there is no hosted endpoint to authenticate.
 </OptionFilter>
 
 #### Architecture
@@ -152,7 +152,7 @@ Your agent's server protocol determines how it communicates. You can choose betw
 
 The protocol is set in the CDK/Terraform infrastructure, and the application code is generated accordingly.
 
-<OptionFilter when={{ protocol: 'HTTP' }} description="tRPC over WebSocket details">
+<OptionFilter when={{ protocol: 'http' }} description="tRPC over WebSocket details">
 ### tRPC over WebSocket (HTTP protocol)
 
 The TypeScript Agent uses [tRPC](https://trpc.io/) over WebSocket, leveraging [AgentCore's bidirectional streaming support](https://docs.aws.amazon.com/bedrock-agentcore/latest/devguide/runtime-get-started-websocket.html) to enable real-time, type-safe communication between clients and your agent.
@@ -239,7 +239,7 @@ For other MCP servers, please refer to the [Strands Documentation](https://stran
 
 For a more in-depth guide to writing Strands agents, refer to the [Strands documentation](https://strandsagents.com/docs/user-guide/quickstart/overview/).
 
-<OptionFilter when={{ protocol: 'A2A' }} description="A2A Express server details">
+<OptionFilter when={{ protocol: 'a2a' }} description="A2A Express server details">
 ## A2A Server (A2A protocol)
 
 The generated `index.ts` mounts the [Strands A2A Express Server](https://strandsagents.com/docs/user-guide/concepts/multi-agent/agent-to-agent) onto an Express app so the generated agent exposes the A2A protocol endpoints alongside a `/ping` health check. When deployed to AgentCore, the entry point resolves the runtime's public ARN from AppConfig and advertises it in the agent card.
@@ -247,7 +247,7 @@ The generated `index.ts` mounts the [Strands A2A Express Server](https://strands
 Most users will not need to modify this file — edit `agent.ts` to change tools or the system prompt. A2A agents listen on port `9000` (vs `8080` for HTTP), which the generated Dockerfile and infrastructure are already configured for.
 </OptionFilter>
 
-<OptionFilter when={{ protocol: 'AG-UI' }} description="AG-UI server details">
+<OptionFilter when={{ protocol: 'ag-ui' }} description="AG-UI server details">
 ## AG-UI Server (AG-UI protocol)
 
 The generated `index.ts` wraps your Strands `Agent` in an [`@ag-ui/aws-strands`](https://www.npmjs.com/package/@ag-ui/aws-strands) `StrandsAgent` and creates an Express app via `createStrandsApp()`. The resulting app exposes a single POST endpoint that streams [AG-UI](https://docs.ag-ui.com/) events over Server-Sent Events (SSE), as well as `/ping` for the AgentCore runtime health check.
@@ -275,7 +275,7 @@ The generator configures a `<your-agent-name>-chat` Nx target that depends on `<
 
 For **HTTP** (tRPC over WebSocket) agents, the generator also emits a tiny `scripts/<your-agent-name>/chat.ts` that wraps the generated `<Agent>Client.local({ url })` so you can customize it as you evolve the agent's input shape.
 
-<OptionFilter when={{ computeType: 'BedrockAgentCoreRuntime' }} description="Bedrock AgentCore Runtime deployment details">
+<OptionFilter when={{ infra: 'agentcore' }} description="Bedrock AgentCore Runtime deployment details">
 ## Deploying Your Agent to Bedrock AgentCore Runtime
 
 <Snippet name="agent/bedrock-deployment" parentHeading="Deploying Your Agent to Bedrock AgentCore Runtime" />
@@ -305,7 +305,7 @@ For more details, refer to the [AgentCore documentation on observability](https:
 
 Agent communication is transmitted via tRPC over WebSocket. As such, it's recommended to use the generated type-safe client factory in `client.ts`.
 
-<OptionFilter when={{ protocol: 'HTTP' }} description="tRPC-over-WebSocket client factory invocation details">
+<OptionFilter when={{ protocol: 'http' }} description="tRPC-over-WebSocket client factory invocation details">
 ### Invoke the Local Server
 
 You can invoke a locally running agent using the `.local` factory method from the client factory.
@@ -340,7 +340,7 @@ The client factory uses HTTP headers in the WebSocket handshake to authenticate
 :::
 
 <Tabs syncKey="auth">
-<TabItem label="IAM" _filter={{ auth: 'IAM' }}>
+<TabItem label="IAM" _filter={{ auth: 'iam' }}>
 ##### IAM Authentication
 
 You can invoke your deployed agent by passing its ARN to the `withIamAuth` factory method:
@@ -364,7 +364,7 @@ This will use the default AWS credential provider chain to authenticate requests
 :::
 </TabItem>
 
-<TabItem label="Cognito" _filter={{ auth: 'Cognito' }}>
+<TabItem label="Cognito" _filter={{ auth: 'cognito' }}>
 ##### JWT / Cognito Authentication
 
 Use the `withJwtAuth` factory method to authenticate with the JWT / Cognito access token.
@@ -415,7 +415,7 @@ For invoking your Agent from a React website, you can make use of the <Link path
 Refer to the <Link path="/guides/connection/react-ts-agent">`connection` generator guide</Link> for details about how the connection is set up.
 </OptionFilter>
 
-<OptionFilter when={{ protocol: 'A2A' }} description="A2A delegation details">
+<OptionFilter when={{ protocol: 'a2a' }} description="A2A delegation details">
 ### Invoking an A2A Agent as a Tool
 
 To delegate work from this agent to a remote A2A agent (either <Link path="/guides/ts-agent">TypeScript</Link> or <Link path="/guides/py-agent">Python</Link>), use the <Link path="/guides/connection/ts-agent-a2a">`connection` generator</Link>. It vends a SigV4-authenticated client for the target agent and AST-transforms this agent's `agent.ts` to register the remote A2A agent as a Strands `tool`.
@@ -425,7 +425,7 @@ To delegate work from this agent to a remote A2A agent (either <Link path="/guid
 Refer to the <Link path="/guides/connection/ts-agent-a2a">`connection` generator guide</Link> for details about how the connection is set up.
 </OptionFilter>
 
-<OptionFilter when={{ protocol: 'AG-UI' }} description="AG-UI / React connection details">
+<OptionFilter when={{ protocol: 'ag-ui' }} description="AG-UI / React connection details">
 ### Invoking an AG-UI Agent
 
 To invoke your AG-UI agent from a React website, use the <Link path="/guides/connection/react-agui">`connection` generator</Link>, which wires up a [CopilotKit](https://docs.copilotkit.ai/aws-strands) client configured for your deployed agent with the correct authentication (IAM or Cognito).