@aws/nx-plugin-mcp 1.0.0-rc.44 → 1.0.0-rc.45

package/bin/aws-nx-mcp.js

@@ -19962,6 +19962,12 @@ var generators$1 = {
 		"description": "Generate a TypeScript lambda function",
 		"metric": "g21"
 	},
+	"ts#dcr-proxy": {
+		"factory": "./src/ts/dcr-proxy/generator",
+		"schema": "./src/ts/dcr-proxy/schema.json",
+		"description": "Generate an OAuth Dynamic Client Registration (DCR) proxy construct for Cognito-authenticated MCP servers",
+		"metric": "g56"
+	},
 	"ts#mcp-server": {
 		"factory": "./src/ts/mcp-server/generator",
 		"schema": "./src/ts/mcp-server/schema.json",
@@ -21296,6 +21302,7 @@ const kebabCase = (str) => {
 const NX_VERSION = {
 	"@a2a-js/sdk": "0.3.14",
 	"@aws/aws-distro-opentelemetry-node-autoinstrumentation": "0.12.0",
+	"@opentelemetry/propagator-jaeger": "2.9.0",
 	"@aws-sdk/client-dynamodb": "3.1090.0",
 	"@aws-sdk/client-bedrock-runtime": "3.1090.0",
 	"@aws-sdk/client-s3": "3.1090.0",
@@ -21322,6 +21329,7 @@ const NX_VERSION = {
 	"@swc/core": "1.15.43",
 	"@modelcontextprotocol/sdk": "1.29.0",
 	"@modelcontextprotocol/inspector": "0.22.0",
+	"@ag-ui/a2ui-toolkit": "0.0.4",
 	"@ag-ui/aws-strands": "0.2.3",
 	"@ag-ui/client": "0.0.57",
 	"@ag-ui/core": "0.0.57",
@@ -21456,7 +21464,7 @@ const buildInstallCommand = (pm, pkg, dev) => {
 		case "pnpm": return `pnpm add ${dev ? "-D" : "-"}w ${pkg}`;
 		case "yarn": return `yarn add ${dev ? "-D " : ""}${pkg}`;
 		case "npm": return `npm install --legacy-peer-deps ${dev ? "-D " : ""}${pkg}`;
-		case "bun": return `bun install ${dev ? "-D " : ""}${pkg}`;
+		case "bun": return `bun add ${dev ? "-D " : ""}${pkg}`;
 		default: return `${pm} install ${dev ? "-D " : ""}${pkg}`;
 	}
 };
@@ -54447,7 +54455,7 @@ ${PACKAGE_MANAGERS.map((pm) => buildNxCommand("<options>", pm)).join(" - \n")}
   - pnpm add -w -D <package>
   - yarn add -D <package>
   - npm install --legacy-peer-deps -D <package>
-  - bun install -D <package>
+  - bun add -D <package>
   - (Omit -D for production dependencies)
 - When specifying project names as arguments to generators, prefer the _fully qualified_ project name, for example \`@workspace-name/project-name\`. Check the \`project.json\` file for the specific package to find its fully qualified name
 - When no generator exists for a specific framework required, use the base \`ts#project\` and \`py#project\` generators and build on top.

package/docs/get_started/tutorials/dungeon-game/1.mdx

@@ -400,7 +400,7 @@ To add a Strands agent to the project with the `py#agent` generator:
 <RunGenerator generator="py#agent" requiredParameters={{project:"story", auth:"cognito", protocol:"ag-ui"}} noInteractive />
 
 :::note[AG-UI protocol]
-We choose `--protocol=AG-UI` so the agent speaks the [Agent-User Interaction protocol](https://docs.copilotkit.ai/aws-strands/protocol) — this lets our React website talk to it directly via [CopilotKit](https://docs.copilotkit.ai/), with streaming, tool calls, and conversation history handled by the protocol instead of a hand-rolled HTTP client.
+We choose `--protocol=ag-ui` so the agent speaks the [Agent-User Interaction protocol](https://docs.copilotkit.ai/aws-strands/protocol) — this lets our React website talk to it directly via [CopilotKit](https://docs.copilotkit.ai/), with streaming, tool calls, and conversation history handled by the protocol instead of a hand-rolled HTTP client.
 :::
 
 You will see some new files appear in your file tree.
@@ -494,7 +494,7 @@ app = create_strands_app(agui_agent, path="/invocations")
 app.add_middleware(_SessionIdMiddleware)
 ```
 
-This is the entrypoint for the agent. Because we selected `--protocol=AG-UI`, the generator wraps our Strands `Agent` with `StrandsAgent` from [`ag_ui_strands`](https://docs.copilotkit.ai/aws-strands/integration) and mounts it on a FastAPI app that speaks the [AG-UI protocol](https://docs.copilotkit.ai/aws-strands/protocol) — this is what CopilotKit will talk to from the React website. The `_SessionIdMiddleware` binds the inbound AgentCore runtime session ID onto a `ContextVar` so any downstream MCP/A2A client we wire up later (e.g. the Inventory MCP server in <Link path="get_started/tutorials/dungeon-game/2">Module 2</Link>) automatically forwards it on its outbound calls. In <Link path="get_started/tutorials/dungeon-game/3">Module 3</Link> we'll also add a `session_manager_provider` so each thread id gets its own `S3SessionManager` and conversation history persists across turns.
+This is the entrypoint for the agent. Because we selected `--protocol=ag-ui`, the generator wraps our Strands `Agent` with `StrandsAgent` from [`ag_ui_strands`](https://docs.copilotkit.ai/aws-strands/integration) and mounts it on a FastAPI app that speaks the [AG-UI protocol](https://docs.copilotkit.ai/aws-strands/protocol) — this is what CopilotKit will talk to from the React website. The `_SessionIdMiddleware` binds the inbound AgentCore runtime session ID onto a `ContextVar` so any downstream MCP/A2A client we wire up later (e.g. the Inventory MCP server in <Link path="get_started/tutorials/dungeon-game/2">Module 2</Link>) automatically forwards it on its outbound calls. In <Link path="get_started/tutorials/dungeon-game/3">Module 3</Link> we'll also add a `session_manager_provider` so each thread id gets its own `S3SessionManager` and conversation history persists across turns.
 
 ```ts
 // common/constructs/src/app/agents/story-agent.ts
@@ -715,7 +715,7 @@ The `ts#website` generates these files. Let us examine some of the key files hig
     - vite.config.mts
     - ...
   - common/
-    - shadcn/ shared shadcn/ui library (theme tokens, `Button`, `Card`, `Input`, `Sidebar`, …) imported by every `uxProvider=Shadcn` website
+    - shadcn/ shared shadcn/ui library (theme tokens, `Button`, `Card`, `Input`, `Sidebar`, …) imported by every `ux=shadcn` website
       - src/components/ui/*
       - src/styles/globals.css Tailwind + shadcn design tokens
     - ...
@@ -1033,7 +1033,7 @@ The `connection` generator generates/updates these files:
 </FileTree>
 
 The generator:
-- Detects the React website's `uxProvider` (Shadcn here) and vends matching chat components.
+- Detects the React website's `ux` (Shadcn here) and vends matching chat components.
 - Registers every connected agent on a single `CopilotKitProvider` — re-running for another agent just adds another hook.
 - Reads the agent's runtime ARN from Runtime Configuration, builds the AgentCore invocation URL, and attaches the Cognito bearer token plus the AgentCore session id header.
 

package/docs/get_started/tutorials/dungeon-game/3.mdx

@@ -23,7 +23,7 @@ import gameConversationPng from '@assets/game-conversation.png'
 
 ## Task 1: Implement the Story Agent
 
-The Story Agent is a [Strands](https://strandsagents.com/) agent generated with `--protocol=AG-UI` in <Link path="get_started/tutorials/dungeon-game/1">Module 1</Link>, so the UI can stream from it over the [Agent-User Interaction protocol](https://docs.copilotkit.ai/aws-strands/protocol) via CopilotKit. It uses the Inventory MCP Server to manage the player's items, and Strands' built-in [`S3SessionManager`](https://strandsagents.com/latest/documentation/docs/user-guide/concepts/agents/sessions/) to persist conversation history into the sessions bucket we provisioned in Module 2.
+The Story Agent is a [Strands](https://strandsagents.com/) agent generated with `--protocol=ag-ui` in <Link path="get_started/tutorials/dungeon-game/1">Module 1</Link>, so the UI can stream from it over the [Agent-User Interaction protocol](https://docs.copilotkit.ai/aws-strands/protocol) via CopilotKit. It uses the Inventory MCP Server to manage the player's items, and Strands' built-in [`S3SessionManager`](https://strandsagents.com/latest/documentation/docs/user-guide/concepts/agents/sessions/) to persist conversation history into the sessions bucket we provisioned in Module 2.
 
 ### Agent implementation
 

package/docs/guides/agentcore-gateway.mdx

@@ -15,7 +15,7 @@ import Link from '@components/link.astro';
 import NxCommands from '@components/nx-commands.astro';
 import OptionFilter from '@components/option-filter.astro';
 
-Generate an [Amazon Bedrock AgentCore Gateway](https://docs.aws.amazon.com/bedrock-agentcore/latest/devguide/gateway.html) project. An AgentCore Gateway is a managed entry point that aggregates one or more MCP server targets behind a single MCP endpoint, evaluates every tool call against a [Cedar policy engine](https://docs.aws.amazon.com/bedrock-agentcore/latest/devguide/policy.html), and signs outbound traffic to MCP servers with IAM SigV4.
+Generate an [Amazon Bedrock AgentCore Gateway](https://docs.aws.amazon.com/bedrock-agentcore/latest/devguide/gateway.html) project. An AgentCore Gateway is a managed entry point that aggregates one or more MCP server targets behind a single MCP endpoint, authenticates inbound requests (IAM or Cognito), evaluates every tool call against a [Cedar policy engine](https://docs.aws.amazon.com/bedrock-agentcore/latest/devguide/policy.html), and signs outbound traffic to MCP servers with IAM SigV4.
 
 ## Usage
 
@@ -34,7 +34,7 @@ The generator creates a new project at `packages/<name>/`, plus a CDK construct
 <FileTree>
   - packages/\<name>/
     - policies/ Cedar policy source files (omitted when `cedarPolicy: false`)
-      - permit-all.cedar Default Cedar policy that permits authenticated callers from within the same AWS account
+      - permit-all.cedar Default Cedar policy that permits authenticated callers
       - README.md Reference for writing Cedar policies
     - local-dev.ts Local gateway aggregating attached MCP servers for local development
     - project.json Adds the `serve` and `dev` targets
@@ -71,7 +71,7 @@ Infrastructure is generated when `infra` is `agentcore` (the default). With `inf
 
 The generated construct creates the following AWS resources:
 
-- An `AgentCore::Gateway` configured for the MCP protocol with `GatewayAuthorizer.usingAwsIam()` (inbound IAM authentication)
+- An `AgentCore::Gateway` configured for the MCP protocol with inbound IAM authentication (default) or Cognito JWT authentication (see <a href="#authentication">Authentication</a>)
 - An `AgentCore::PolicyEngine` running in `ENFORCE` mode, attached to the Gateway (omitted when `cedarPolicy: false`)
 - One `AgentCore::Policy` per `.cedar` file in `policies/`
 - An AWS WAFv2 Web ACL associated with the Gateway, with request logging to CloudWatch (enabled by default — see <a href="#aws-waf">AWS WAF</a>)
@@ -95,7 +95,7 @@ waf: WAF {
   icon: /nx-plugin-for-aws/icons/aws/waf.svg
 }
 
-gateway: AgentCore Gateway\n(MCP, IAM auth) {
+gateway: AgentCore Gateway\n(MCP, IAM or Cognito auth) {
   shape: image
   icon: /nx-plugin-for-aws/icons/aws/bedrock-agentcore-gateway.svg
 }
@@ -109,6 +109,61 @@ waf -> gateway
 gateway -> targets
 ```
 
+## Authentication
+
+The `auth` option configures how the Gateway authenticates inbound requests. Choose between `iam` (default) and `cognito`.
+
+### IAM
+
+By default, the Gateway is configured with `GatewayAuthorizer.usingAwsIam()`. Callers sign requests with SigV4, and the caller's IAM identity is available to Cedar policies as an `AgentCore::IamEntity` principal. This is the recommended option when your callers are agents or services running in AWS — for example an <Link path="/guides/ts-agent">agent</Link> connected via the <Link path="guides/connection/ts-agent-gateway">agent to Gateway connection generator</Link>, which signs its calls with its own execution role.
+
+### Cognito
+
+When you select `cognito`, the Gateway is configured with a Custom JWT authorizer pointing at a Cognito user pool. Callers authenticate by presenting a JWT bearer token, and the token's `sub` claim is available to Cedar policies as an `AgentCore::OAuthUser` principal. Use this when your callers authenticate through Cognito — for example a website or a coding agent connecting via the <Link path="guides/ts-dcr-proxy">`ts#dcr-proxy` generator</Link>.
+
+The generated infrastructure consumes an existing Cognito user pool and client — it does not create them. You can generate a `UserIdentity` using the <Link path="/guides/react-website-auth">`ts#website#auth` generator</Link>, or provide your own.
+
+<Infrastructure>
+<Fragment slot="cdk">
+The generated construct requires an `identity` prop supplying the user pool and client:
+
+```ts {7,9-11} title="packages/infra/src/stacks/application-stack.ts"
+import { MyGateway, UserIdentity } from ':my-scope/common-constructs';
+
+export class ApplicationStack extends Stack {
+  constructor(scope: Construct, id: string, props?: StackProps) {
+    super(scope, id, props);
+
+    const identity = new UserIdentity(this, 'Identity');
+
+    new MyGateway(this, 'MyGateway', {
+      identity,
+    });
+  }
+}
+```
+</Fragment>
+<Fragment slot="terraform">
+The generated module requires `user_pool_id` and `user_pool_client_ids` variables:
+
+```hcl {6-7} title="packages/infra/src/main.tf"
+module "user_identity" {
+  source = "../../common/terraform/src/core/user-identity"
+}
+
+module "my_gateway" {
+  source               = "../../common/terraform/src/app/gateways/my-gateway"
+  user_pool_id         = module.user_identity.user_pool_id
+  user_pool_client_ids = [module.user_identity.user_pool_client_id]
+}
+```
+</Fragment>
+</Infrastructure>
+
+:::note[Custom OIDC providers]
+To authenticate with a non-Cognito OIDC provider, modify the generated Gateway construct or Terraform module directly — swap the authorizer's discovery URL and allowed clients for your provider's. Agent to Gateway connection generators only support `IAM`-authenticated gateways, since agents sign their calls with SigV4.
+:::
+
 ## Writing Policies
 
 <OptionFilter when={{ cedarPolicy: true }} description="Cedar policies — cedarPolicy: true only">
@@ -190,7 +245,9 @@ Additionally, the Gateway filters the response of `tools/list` so that callers o
 
 ### Default `permit-all.cedar`
 
-The generator ships a default policy that permits any IAM caller from the AWS account the Gateway is deployed into:
+The generator ships a default policy scoped to the Gateway's authentication type.
+
+For an **IAM** Gateway, it permits any IAM caller from the AWS account the Gateway is deployed into:
 
 ```cedar title="packages/<name>/policies/permit-all.cedar"
 permit (
@@ -202,11 +259,23 @@ permit (
 };
 ```
 
+For a **Cognito** Gateway, it permits any authenticated OAuth user (the JWT authorizer has already validated the token's user pool and client before policies are evaluated):
+
+```cedar title="packages/<name>/policies/permit-all.cedar"
+permit (
+  principal is AgentCore::OAuthUser,
+  action,
+  resource == AgentCore::Gateway::"<%= gatewayArn %>"
+);
+```
+
 To lock things down further, add narrower policies alongside it. Always retain at least one matching `permit` in the policy set, otherwise default-deny will block every call.
 
 ### Policy scope reference
 
-For Gateways generated by this plugin, all callers are IAM principals (the Gateway is configured with `GatewayAuthorizer.usingAwsIam()`):
+The principal type depends on how the Gateway authenticates callers (see <a href="#authentication">Authentication</a>).
+
+For an **IAM** Gateway, callers are IAM principals:
 
 ```
 principal is AgentCore::IamEntity
@@ -220,6 +289,24 @@ principal == AgentCore::IamEntity::"arn:aws:sts::<%= accountId %>:assumed-role/<
 
 The same value is available as `principal.id` for `when` clauses. Reserve `like` for genuine patterns, such as the account-wide match in the default `permit-all.cedar`.
 
+For a **Cognito** Gateway, callers are OAuth users built from the JWT token's `sub` claim, and JWT claims (username, scope, etc.) are available as principal tags:
+
+```
+principal is AgentCore::OAuthUser
+```
+
+Match individual claims in `when` clauses — for example to require a scope:
+
+```cedar
+permit (
+  principal is AgentCore::OAuthUser,
+  action,
+  resource == AgentCore::Gateway::"<%= gatewayArn %>"
+) when {
+  principal.scope == "gateway/invoke"
+};
+```
+
 Tool invocations reach the policy engine as actions with the form:
 
 ```
@@ -268,7 +355,7 @@ See the connection guide for the full local development story.
 
 ## Deploying your AgentCore Gateway
 
-The AgentCore Gateway generator creates CDK or Terraform infrastructure as code based on your selected `iacProvider`. You can use this to deploy your Gateway.
+The AgentCore Gateway generator creates CDK or Terraform infrastructure as code based on your selected `iac`. You can use this to deploy your Gateway.
 
 <Infrastructure>
 <Fragment slot="cdk">

package/docs/guides/connection/py-agent-a2a.mdx

@@ -23,7 +23,7 @@ The generator sets up all the necessary wiring so your agent can discover and in
 Before using this generator, ensure you have:
 
 1. A Python project with a <Link path="guides/py-agent">Python Agent</Link> component (Strands or LangChain)
-2. A project with an Agent component generated with `--protocol=A2A` and `--auth=IAM` (either <Link path="guides/ts-agent">`ts#agent`</Link> or <Link path="guides/py-agent">`py#agent`</Link>)
+2. A project with an Agent component generated with `--protocol=a2a` and `--auth=iam` (either <Link path="guides/ts-agent">`ts#agent`</Link> or <Link path="guides/py-agent">`py#agent`</Link>)
 3. Both components created with `infra: agentcore`
 
 ## Usage

package/docs/guides/connection/py-agent-gateway.mdx

@@ -21,7 +21,9 @@ The generator wires the agent so it authenticates to the Gateway with IAM SigV4
 Before using this generator, ensure you have:
 
 1. A Python project with a <Link path="guides/py-agent">Agent</Link> component (`infra: agentcore`)
-2. A <Link path="guides/agentcore-gateway">`agentcore-gateway`</Link> project
+2. A <Link path="guides/agentcore-gateway">`agentcore-gateway`</Link> project with `auth: iam`
+
+The Gateway must use IAM authentication — the agent signs its requests with SigV4 using its own execution role. The generator rejects Cognito-authenticated gateways.
 
 ## Usage
 

package/docs/guides/connection/react-agui.mdx

@@ -22,7 +22,7 @@ Nx Plugin for AWS provides a generator to connect a React website to an Agent th
 Before using this generator, ensure you have:
 
 1. A React website (generated using the <Link path="guides/react-website">`ts#website` generator</Link>)
-2. A TypeScript or Python Agent with `protocol=AG-UI` (generated using the <Link path="guides/ts-agent">`ts#agent`</Link> or <Link path="guides/py-agent">`py#agent`</Link> generator)
+2. A TypeScript or Python Agent with `protocol=ag-ui` (generated using the <Link path="guides/ts-agent">`ts#agent`</Link> or <Link path="guides/py-agent">`py#agent`</Link> generator)
 3. For deployed agents, Cognito Auth added via the <Link path="/guides/react-website-auth">`ts#website#auth` generator</Link>
 
 ## Usage
@@ -47,8 +47,8 @@ The generator creates a **single shared** `AguiProvider` component, one hook per
   - components
     - AguiProvider.tsx Single `CopilotKitProvider` for every AG-UI agent. Created on the first `connection` run and updated on subsequent runs to register each new agent.
     - copilot
-      - index.tsx Re-exports `CopilotChat`, `CopilotSidebar` and `CopilotPopup` with slot defaults that match your website's `uxProvider` (Cloudscape, Shadcn, or no theme at all).
-      - *ThemeComponents*.tsx Per-slot theme components (e.g. `CloudscapeAssistantMessage.tsx`, `ShadcnChatInput.tsx`). Only vended when `uxProvider` is `Cloudscape` or `Shadcn`.
+      - index.tsx Re-exports `CopilotChat`, `CopilotSidebar` and `CopilotPopup` with slot defaults that match your website's `ux` (Cloudscape, Shadcn, or no theme at all).
+      - *ThemeComponents*.tsx Per-slot theme components (e.g. `CloudscapeAssistantMessage.tsx`, `ShadcnChatInput.tsx`). Only vended when `ux` is `cloudscape` or `shadcn`.
   - hooks
     - useAgui\<AgentName>.tsx Registers one AG-UI agent. One file per `connection` run.
     - useSigV4.tsx SigV4 signing (IAM only)
@@ -102,7 +102,7 @@ The generated code handles authentication depending on your agent's configuratio
 
 Instantiate CopilotKit components with `agentId` to select which agent to use. The id is the agent's name — the same one you chose when you ran the <Link path="guides/ts-agent">`ts#agent`</Link> or <Link path="guides/py-agent">`py#agent`</Link> generator — and you can also find it in the generated hook file (e.g. the key returned from `packages/web/src/hooks/useAgui<AgentName>.tsx`).
 
-Import the chat components from the generated `./components/copilot` module so the theme that matches your website's `uxProvider` is applied automatically:
+Import the chat components from the generated `./components/copilot` module so the theme that matches your website's `ux` is applied automatically:
 
 ```tsx
 import { CopilotChat } from './components/copilot';
@@ -137,13 +137,13 @@ import { CopilotChat } from './components/copilot';
 
 ### Built-in Themes
 
-The generator reads `metadata.uxProvider` from your React website project and vends a themed wrapper module at `src/components/copilot/index.tsx` so the chat components match the rest of your UI without any extra configuration:
+The generator reads `metadata.ux` from your React website project and vends a themed wrapper module at `src/components/copilot/index.tsx` so the chat components match the rest of your UI without any extra configuration:
 
-| `uxProvider` | Styling applied to `CopilotChat` / `CopilotSidebar` / `CopilotPopup` |
+| `ux` | Styling applied to `CopilotChat` / `CopilotSidebar` / `CopilotPopup` |
 | ------------ | -------------------------------------------------------------------- |
-| `Cloudscape` | Messages render inside Cloudscape `ChatBubble`s with gen-AI `Avatar`s (matching the [Cloudscape generative AI chat pattern](https://cloudscape.design/patterns/genai/generative-AI-chat/)); the typing indicator becomes a `LoadingBar` and the input is a `PromptInput`. Built from `@cloudscape-design/components` and `@cloudscape-design/chat-components`. |
-| `Shadcn` | Assistant messages render in a `bg-muted` bubble with a `Sparkles` avatar; user messages render right-aligned in a `bg-primary` bubble with a `User` avatar. The input is a rounded `Textarea` + pill-shaped send/stop `Button` (Enter submits, Shift+Enter newlines). Uses shadcn primitives from the shared `common-shadcn` package. |
-| `None` (or anything else) | No theme — the module just re-exports the default CopilotKit components. |
+| `cloudscape` | Messages render inside Cloudscape `ChatBubble`s with gen-AI `Avatar`s (matching the [Cloudscape generative AI chat pattern](https://cloudscape.design/patterns/genai/generative-AI-chat/)); the typing indicator becomes a `LoadingBar` and the input is a `PromptInput`. Built from `@cloudscape-design/components` and `@cloudscape-design/chat-components`. |
+| `shadcn` | Assistant messages render in a `bg-muted` bubble with a `Sparkles` avatar; user messages render right-aligned in a `bg-primary` bubble with a `User` avatar. The input is a rounded `Textarea` + pill-shaped send/stop `Button` (Enter submits, Shift+Enter newlines). Uses shadcn primitives from the shared `common-shadcn` package. |
+| `none` (or anything else) | No theme — the module just re-exports the default CopilotKit components. |
 
 Import the themed components from the **local theme module** (not `@copilotkit/react-core/v2` directly) so the theme is applied automatically:
 

package/docs/guides/connection/react-py-agent.mdx

@@ -16,7 +16,7 @@ import Snippet from '@components/snippet.astro';
 Nx Plugin for AWS provides a generator to quickly integrate your <Link path="guides/py-agent">Python Agent</Link> with a React website. It sets up all necessary configuration for connecting to your agent via a type-safe OpenAPI-generated client, including AWS IAM and Cognito authentication support.
 
 :::tip[AG-UI agents]
-If your Python Agent was generated with `protocol=AG-UI`, the connection generator instead wires up [CopilotKit](https://docs.copilotkit.ai/aws-strands) and an [`@ag-ui/client`](https://docs.ag-ui.com/) `HttpAgent` on the React website. See the <Link path="guides/connection/react-agui">React to AG-UI Agent</Link> guide for details.
+If your Python Agent was generated with `protocol=ag-ui`, the connection generator instead wires up [CopilotKit](https://docs.copilotkit.ai/aws-strands) and an [`@ag-ui/client`](https://docs.ag-ui.com/) `HttpAgent` on the React website. See the <Link path="guides/connection/react-agui">React to AG-UI Agent</Link> guide for details.
 :::
 
 ## Prerequisites
@@ -24,7 +24,7 @@ If your Python Agent was generated with `protocol=AG-UI`, the connection generat
 Before using this generator, ensure you have:
 
 1. A React website (generated using the <Link path="guides/react-website">`ts#website` generator</Link>)
-2. A Python Agent with `protocol=HTTP` (generated using the <Link path="guides/py-agent">`py#agent` generator</Link>)
+2. A Python Agent with `protocol=http` (generated using the <Link path="guides/py-agent">`py#agent` generator</Link>)
 3. Cognito Auth added via the <Link path="/guides/react-website-auth">`ts#website#auth` generator</Link>
 
 ## Usage

package/docs/guides/connection/ts-agent-a2a.mdx

@@ -23,7 +23,7 @@ The generator sets up all the necessary wiring so your agent can discover and in
 Before using this generator, ensure you have:
 
 1. A TypeScript project with a <Link path="guides/ts-agent">Strands Agent</Link> component (any protocol)
-2. A project with an Agent component generated with `--protocol=A2A` and `--auth=IAM` (either <Link path="guides/ts-agent">`ts#agent`</Link> or <Link path="guides/py-agent">`py#agent`</Link>)
+2. A project with an Agent component generated with `--protocol=a2a` and `--auth=iam` (either <Link path="guides/ts-agent">`ts#agent`</Link> or <Link path="guides/py-agent">`py#agent`</Link>)
 3. Both components created with `infra: agentcore`
 
 ## Usage

package/docs/guides/connection/ts-agent-gateway.mdx

@@ -21,7 +21,9 @@ The generator wires the agent so it authenticates to the Gateway with IAM SigV4
 Before using this generator, ensure you have:
 
 1. A TypeScript project with a <Link path="guides/ts-agent">Agent</Link> component (`infra: agentcore`)
-2. A <Link path="guides/agentcore-gateway">`agentcore-gateway`</Link> project
+2. A <Link path="guides/agentcore-gateway">`agentcore-gateway`</Link> project with `auth: iam`
+
+The Gateway must use IAM authentication — the agent signs its requests with SigV4 using its own execution role. The generator rejects Cognito-authenticated gateways.
 
 ## Usage
 

package/docs/guides/docker-bundling.mdx

@@ -5,6 +5,7 @@ description: Build and deploy Docker images for TypeScript and Python projects i
 
 import { FileTree, Tabs, TabItem, Code } from '@astrojs/starlight/components';
 import NxCommands from '@components/nx-commands.astro';
+import PackageManagerShortCommand from '@components/package-manager-short-command.astro';
 import Link from '@components/link.astro';
 import Infrastructure from '@components/infrastructure.astro';
 import TrivyVersion from '@components/trivy-version.astro';
@@ -35,7 +36,7 @@ export const trivyTarget = `{
 Several generators (such as <Link path="/guides/ts-agent">`ts#agent`</Link> and <Link path="/guides/py-agent">`py#agent`</Link>) produce a Docker image that is pushed to Amazon ECR and consumed by AWS infrastructure. This guide describes the pattern they follow so that you can apply it to other use cases — for example, running a <Link path="/guides/fastapi">FastAPI</Link> project on Amazon ECS, or deploying a containerised Express server.
 
 :::tip[Docker or Finch]
-The container engine used to build images is chosen at workspace creation time via the `--containerEngine` flag (`docker`, `finch`, or `infer` — the default — which auto-detects what's installed). [Finch](https://runfinch.com/) is an open-source, drop-in alternative to Docker. The selection is recorded in `aws-nx-plugin.config.mts` and applied to every generator that emits container build commands. CDK image asset builds honour the choice via the `CDK_DOCKER` environment variable.
+The container engine used to build images is chosen at workspace creation time via the `--containers` flag (`docker`, `finch`, or `infer` — the default — which auto-detects what's installed). [Finch](https://runfinch.com/) is an open-source, drop-in alternative to Docker. The selection is recorded in `aws-nx-plugin.config.mts` and applied to every generator that emits container build commands. CDK image asset builds honour the choice via the `CDK_DOCKER` environment variable.
 :::
 
 ## The Pattern
@@ -279,25 +280,21 @@ This clears the output directory, then copies both the bundle contents and the `
 
 ## Scanning Images with Trivy
 
-It's good practice to scan your images for known vulnerabilities. The generators that follow this pattern add a `trivy` target which scans the built image with [Trivy](https://trivy.dev/), running from the [ECR-hosted Trivy image](https://gallery.ecr.aws/aquasecurity/trivy), and fails the build on `HIGH` or `CRITICAL` findings.
+It's good practice to scan your images for known vulnerabilities. The generators that follow this pattern add a `trivy` target which scans the built image with [Trivy](https://trivy.dev/), running from the [ECR-hosted Trivy image](https://gallery.ecr.aws/aquasecurity/trivy), and exits non-zero on `HIGH` or `CRITICAL` findings.
 
 Add a `trivy` target which `dependsOn` your `docker` target. It saves the built image to a tarball and scans it via a workspace-relative bind mount, so the same command works under both `docker` and `finch`:
 
 <Code lang="json" code={trivyTarget} />
 
-Then make `build` depend on `trivy` so the scan runs as part of a build:
+Each project's per-image scan targets are aggregated under a workspace-wide `trivy` target, which the vended `trivy` root script runs (`nx run-many --target trivy`).
 
-```json
-{
-  "targets": {
-    "build": {
-      "dependsOn": ["trivy"]
-    }
-  }
-}
-```
+<PackageManagerShortCommand commands={['trivy']} />
 
-<NxCommands commands={['trivy my-project']} />
+:::tip[Run Trivy in CI]
+The scan is intentionally not wired into `build` since this can introduce unnecessary friction when iterating during development, as Trivy's vulnerabilty database is continually updated with new CVEs.
+
+Instead we recommend running the above command as a dedicated step in your CI pipeline prior to deployment to production stages.
+:::
 
 :::tip[Caching skips unchanged images]
 Because the image is fully determined by your project source, declaring `inputs` (here `default` and `^production`, matching the `bundle` target) lets Nx cache the scan and skip re-scanning an image that hasn't changed. Pin the Trivy image version (e.g. <code>trivy:<TrivyVersion /></code>) so scans are reproducible.

package/docs/guides/fastapi.mdx

@@ -438,7 +438,7 @@ To consume a stream of responses, you can make use of the <Link path="guides/con
 
 ## Deploying your FastAPI
 
-The FastAPI generator creates CDK or Terraform infrastructure as code based on your selected `iacProvider`. You can use this to deploy your FastAPI.
+The FastAPI generator creates CDK or Terraform infrastructure as code based on your selected `iac`. You can use this to deploy your FastAPI.
 
 <Infrastructure>
 <Fragment slot="cdk">
@@ -655,7 +655,7 @@ If you are actively working on both your CDK infrastructure and FastAPI together
 </Fragment>
 <Fragment slot="terraform">
 :::note[Terraform Limitations]
-We do not support type-safe integrations for Terraform, and therefore no code generation targets are configured if you selected Terraform for your `iacProvider`.
+We do not support type-safe integrations for Terraform, and therefore no code generation targets are configured if you selected Terraform for your `iac`.
 :::
 </Fragment>
 </Infrastructure>

package/docs/guides/python-lambda-function.mdx

@@ -54,7 +54,7 @@ If the `functionPath` option is provided, the generater will add the necessary f
 
 <Snippet name="shared-constructs" />
 
-The generator creates infrastructure as code for deploying your function based on your selected `iacProvider`:
+The generator creates infrastructure as code for deploying your function based on your selected `iac`:
 
 <Infrastructure>
 <Fragment slot="cdk">

package/docs/guides/react-website-auth.mdx

@@ -43,7 +43,7 @@ You will find the following changes in your React website:
 
 <Snippet name="shared-constructs" />
 
-You will also find the following infrastructure code generated based on your selected `iacProvider`:
+You will also find the following infrastructure code generated based on your selected `iac`:
 
 <Infrastructure>
 <Fragment slot="cdk">

package/docs/guides/react-website.mdx

@@ -23,7 +23,7 @@ This generator creates a new [React](https://react.dev/) website with [shadcn/ui
 The generated application uses [Vite](https://vite.dev/) as the build tool and bundler. It uses [TanStack Router](https://tanstack.com/router/v1) for type-safe routing.
 
 :::note[UX Provider]
-The default `uxProvider` is [shadcn/ui](https://ui.shadcn.com/). You can also select [Cloudscape](http://cloudscape.design/) or `None` (bring your own component library).
+The default `ux` is [shadcn/ui](https://ui.shadcn.com/). You can also select [Cloudscape](http://cloudscape.design/) or `none` (bring your own component library).
 :::
 
 ## Usage
@@ -69,7 +69,7 @@ If you opted not to use [TanStack Router](https://tanstack.com/router/v1), you w
 
 <Snippet name="shared-constructs" />
 
-The generator creates infrastructure as code for deploying your website based on your selected `iacProvider`:
+The generator creates infrastructure as code for deploying your website based on your selected `iac`:
 
 <Infrastructure>
 <Fragment slot="cdk">
@@ -416,7 +416,7 @@ You can run your tests using the `test` target:
 
 ## Deploying Your Website
 
-The React website generator creates CDK or Terraform infrastructure as code based on your selected `iacProvider`. You can use this to deploy your website.
+The React website generator creates CDK or Terraform infrastructure as code based on your selected `iac`. You can use this to deploy your website.
 
 <Infrastructure>
 <Fragment slot="cdk">

package/docs/guides/security.mdx

@@ -24,7 +24,7 @@ Where vended infrastructure suppresses a Checkov rule, the suppression is scoped
 
 ### Container Image Scanning
 
-Projects which build container images (for example agents, MCP servers, and database migration images) include a `trivy` target which scans images for HIGH and CRITICAL vulnerabilities before they are deployed, failing the build on findings. See <Link path="/guides/docker-bundling">Docker Bundling</Link> for details, including how to suppress findings with a `.trivyignore` file.
+Projects which build container images (for example agents, MCP servers, and database migration images) include a `trivy` target which scans images for HIGH and CRITICAL vulnerabilities, exiting non-zero on findings. See <Link path="/guides/docker-bundling">Docker Bundling</Link> for details, including how to suppress findings with a `.trivyignore` file.
 
 ### Credential Scanning
 

package/docs/guides/trpc.mdx

@@ -550,7 +550,7 @@ You don't need `aws-jwt-verify` or any other JWT-verification library here — t
 
 ## Deploying your tRPC API
 
-The tRPC API generator creates CDK or Terraform infrastructure as code based on your selected `iacProvider`. You can use this to deploy your tRPC API.
+The tRPC API generator creates CDK or Terraform infrastructure as code based on your selected `iac`. You can use this to deploy your tRPC API.
 
 <Infrastructure>
 <Fragment slot="cdk">
@@ -739,7 +739,7 @@ When using `Custom` auth, your API is protected by a Lambda Authorizer that **de
 <Snippet name="api/type-safe-api-integrations" parentHeading="Integrations" />
 
 :::tip[CDK Type-Safe Integrations]
-If you selected CDK for your `iacProvider`, when you add or remove a procedure in your tRPC API, these changes will be reflected immediately in the CDK construct without the need to rebuild.
+If you selected CDK for your `iac`, when you add or remove a procedure in your tRPC API, these changes will be reflected immediately in the CDK construct without the need to rebuild.
 :::
 
 <OptionFilter when={{ auth: 'iam' }} description="Granting API invoke access — IAM-authenticated APIs only">