@aws/nx-plugin 1.0.0-rc.17 → 1.0.0-rc.19

package/src/utils/identity-constructs/files/terraform/core/user-identity/add-callback-url/add-callback-url.tf.template

@@ -61,12 +61,13 @@ resource "null_resource" "add_callback_url" {
     command = <<-EOT
       uv run --with boto3 python -c "
 import boto3
+import os
 import sys
 
 # Configuration
-user_pool_id = '${local.user_pool_id}'
-client_id = '${local.user_pool_client_id}'
-new_callback_url = '${var.callback_url}'
+user_pool_id = os.environ['USER_POOL_ID']
+client_id = os.environ['CLIENT_ID']
+new_callback_url = os.environ['NEW_CALLBACK_URL']
 
 # Initialize Cognito client
 cognito = boto3.client('cognito-idp')
@@ -118,6 +119,11 @@ except Exception as e:
     sys.exit(1)
 "
     EOT
+    environment = {
+      USER_POOL_ID     = local.user_pool_id
+      CLIENT_ID        = local.user_pool_client_id
+      NEW_CALLBACK_URL = var.callback_url
+    }
   }
 
   depends_on = [terraform_data.validate_cognito_props]

package/src/utils/rdb-constructs/files/terraform/app/dbs/__nameKebabCase__/__nameKebabCase__.tf.template

@@ -287,10 +287,15 @@ resource "null_resource" "docker_publish" {
 
   provisioner "local-exec" {
     command = <<-EOT
-      aws ecr get-login-password --region ${data.aws_region.current.region} | <%= containerEngine %> login --username AWS --password-stdin ${self.triggers.repository_url}
-      <%= containerEngine %> tag ${self.triggers.docker_image_tag} ${self.triggers.repository_url}:latest
-      <%= containerEngine %> push ${self.triggers.repository_url}:latest
+      aws ecr get-login-password --region "$AWS_REGION" | <%= containerEngine %> login --username AWS --password-stdin "$REPOSITORY_URL"
+      <%= containerEngine %> tag "$DOCKER_IMAGE_TAG" "$REPOSITORY_URL:latest"
+      <%= containerEngine %> push "$REPOSITORY_URL:latest"
     EOT
+    environment = {
+      AWS_REGION       = data.aws_region.current.region
+      REPOSITORY_URL   = self.triggers.repository_url
+      DOCKER_IMAGE_TAG = self.triggers.docker_image_tag
+    }
   }
 
   depends_on = [aws_ecr_repository_policy.migration_handler]
@@ -574,10 +579,10 @@ resource "null_resource" "create_db_user_trigger" {
     command = <<-EOT
       output_file=$(mktemp)
       response=$(aws lambda invoke \
-        --region ${data.aws_region.current.region} \
-        --function-name ${self.triggers.function_name} \
+        --region "$AWS_REGION" \
+        --function-name "$FUNCTION_NAME" \
         --cli-binary-format raw-in-base64-out \
-        --payload '{"RequestType":"Create","PhysicalResourceId":"db-user:${self.triggers.db_user}"}' \
+        --payload "{\"RequestType\":\"Create\",\"PhysicalResourceId\":\"db-user:$DB_USER\"}" \
         "$output_file")
       cat "$output_file"
       echo "$response"
@@ -587,6 +592,11 @@ resource "null_resource" "create_db_user_trigger" {
       fi
       rm -f "$output_file"
     EOT
+    environment = {
+      AWS_REGION    = data.aws_region.current.region
+      FUNCTION_NAME = self.triggers.function_name
+      DB_USER       = self.triggers.db_user
+    }
   }
 
   depends_on = [aws_lambda_function.create_db_user, module.aurora]
@@ -655,8 +665,8 @@ resource "null_resource" "migration_trigger" {
     command = <<-EOT
       output_file=$(mktemp)
       response=$(aws lambda invoke \
-        --region ${data.aws_region.current.region} \
-        --function-name ${self.triggers.function_name} \
+        --region "$AWS_REGION" \
+        --function-name "$FUNCTION_NAME" \
         --cli-binary-format raw-in-base64-out \
         "$output_file")
       cat "$output_file"
@@ -667,6 +677,10 @@ resource "null_resource" "migration_trigger" {
       fi
       rm -f "$output_file"
     EOT
+    environment = {
+      AWS_REGION    = data.aws_region.current.region
+      FUNCTION_NAME = self.triggers.function_name
+    }
   }
 
   depends_on = [

package/src/utils/rdb-constructs/files/terraform/core/rdb/aurora/aurora.tf.template

@@ -540,9 +540,9 @@ resource "null_resource" "proxy_target_ready" {
       deadline=$((start_time + 600))
       while true; do
         target_state=$(aws rds describe-db-proxy-targets \
-          --region ${data.aws_region.current.region} \
-          --db-proxy-name ${self.triggers.db_proxy_name} \
-          --target-group-name ${self.triggers.target_group_name} \
+          --region "$AWS_REGION" \
+          --db-proxy-name "$DB_PROXY_NAME" \
+          --target-group-name "$TARGET_GROUP_NAME" \
           --query "Targets[?Type=='RDS_INSTANCE'] | [0].TargetHealth.State" \
           --output text)
 
@@ -552,13 +552,19 @@ resource "null_resource" "proxy_target_ready" {
 
         current_time=$(date +%s)
         if [ "$current_time" -ge "$deadline" ]; then
-          echo "RDS Proxy target ${self.triggers.db_cluster_identifier} did not become AVAILABLE within 10 minutes. Last state: $target_state"
+          echo "RDS Proxy target $DB_CLUSTER_IDENTIFIER did not become AVAILABLE within 10 minutes. Last state: $target_state"
           exit 1
         fi
 
         sleep 10
       done
     EOT
+    environment = {
+      AWS_REGION            = data.aws_region.current.region
+      DB_PROXY_NAME         = self.triggers.db_proxy_name
+      TARGET_GROUP_NAME     = self.triggers.target_group_name
+      DB_CLUSTER_IDENTIFIER = self.triggers.db_cluster_identifier
+    }
   }
 
   depends_on = [

package/src/utils/versions.d.ts

@@ -135,7 +135,7 @@ export declare const withVersions: (deps: ITsDepVersion[]) => {
  */
 export declare const PY_VERSIONS: {
     readonly 'ag-ui-protocol': "==0.1.19";
-    readonly 'ag-ui-strands': "==0.1.9";
+    readonly 'ag-ui-strands': "==0.2.1";
     readonly 'aws-lambda-powertools': "==3.29.0";
     readonly 'aws-lambda-powertools[tracer]': "==3.29.0";
     readonly 'aws-lambda-powertools[parser]': "==3.29.0";

package/src/utils/versions.js

@@ -136,7 +136,7 @@ exports.withVersions = withVersions;
  */
 exports.PY_VERSIONS = {
     'ag-ui-protocol': '==0.1.19',
-    'ag-ui-strands': '==0.1.9',
+    'ag-ui-strands': '==0.2.1',
     'aws-lambda-powertools': '==3.29.0',
     'aws-lambda-powertools[tracer]': '==3.29.0',
     'aws-lambda-powertools[parser]': '==3.29.0',

package/src/utils/website-constructs/files/terraform/core/static-website/static-website.tf.template

@@ -553,7 +553,7 @@ resource "null_resource" "upload_website_files" {
 
   provisioner "local-exec" {
     command = <<-EOT
-      cd "${path.root}"
+      cd "$ROOT_PATH"
       uv run --with boto3 python3 -c "
 import os
 import sys
@@ -642,9 +642,14 @@ def sync_to_s3(local_path, bucket_name):
         sys.exit(1)
 
 # Execute sync
-sync_to_s3('${var.website_file_path}', '${aws_s3_bucket.website.bucket}')
+sync_to_s3(os.environ['WEBSITE_FILE_PATH'], os.environ['BUCKET_NAME'])
 "
     EOT
+    environment = {
+      ROOT_PATH         = path.root
+      WEBSITE_FILE_PATH = var.website_file_path
+      BUCKET_NAME       = aws_s3_bucket.website.bucket
+    }
   }
 
   depends_on = [aws_s3_bucket_policy.website_cloudfront_policy]
@@ -674,6 +679,7 @@ resource "null_resource" "cloudfront_invalidation" {
     command = <<-EOT
       uv run --with boto3 python3 -c "
 import boto3
+import os
 import sys
 from botocore.exceptions import ClientError, NoCredentialsError
 
@@ -695,7 +701,7 @@ def create_invalidation(distribution_id):
 
         invalidation_id = response['Invalidation']['Id']
         print(f'CloudFront cache invalidation created: {invalidation_id}')
-        print(f'Distribution: ${aws_cloudfront_distribution.website.id}')
+        print(f'Distribution: {distribution_id}')
         print(f'Status: {response[\"Invalidation\"][\"Status\"]}')
 
     except NoCredentialsError:
@@ -709,9 +715,12 @@ def create_invalidation(distribution_id):
         sys.exit(1)
 
 # Execute invalidation
-create_invalidation('${aws_cloudfront_distribution.website.id}')
+create_invalidation(os.environ['DISTRIBUTION_ID'])
 "
     EOT
+    environment = {
+      DISTRIBUTION_ID = aws_cloudfront_distribution.website.id
+    }
   }
 
   depends_on = [

package/src/utils/agent-connection/files/core-a2a/agentcore-a2a-client.ts.template

@@ -1,123 +0,0 @@
-import {
-  ClientFactory,
-  ClientFactoryOptions,
-  DefaultAgentCardResolver,
-  JsonRpcTransportFactory,
-} from '@a2a-js/sdk/client';
-import { fromNodeProviderChain } from '@aws-sdk/credential-providers';
-import { A2AAgent } from '@strands-agents/sdk/a2a';
-import { AwsClient } from 'aws4fetch';
-import { getCurrentSessionId } from './session-context.js';
-
-const SESSION_HEADER = 'X-Amzn-Bedrock-AgentCore-Runtime-Session-Id';
-
-/**
- * Common options for creating an AgentCore A2A client.
- */
-export interface AgentCoreA2aClientOptions {
-  /** The ARN of the Bedrock AgentCore Runtime to connect to. */
-  agentRuntimeArn: string;
-  /** Optional description for the remote agent. */
-  description?: string;
-  /** Optional friendly name for the remote agent. */
-  name?: string;
-}
-
-/** Options for an IAM-authenticated A2A client. */
-export interface AgentCoreA2aClientIamOptions
-  extends AgentCoreA2aClientOptions {
-  credentialProvider?: ReturnType<typeof fromNodeProviderChain>;
-}
-
-/** Options for a JWT-authenticated A2A client. */
-export interface AgentCoreA2aClientJwtOptions
-  extends AgentCoreA2aClientOptions {
-  accessTokenProvider: () => Promise<string>;
-}
-
-/** Options for a no-auth A2A client (local dev). */
-export interface AgentCoreA2aClientNoAuthOptions {
-  /** Full URL of the local A2A endpoint. */
-  url: string;
-  name?: string;
-  description?: string;
-}
-
-interface BuildOptions {
-  name?: string;
-  description?: string;
-}
-
-/** Factory for A2A clients that forward the current async-context session. */
-export class AgentCoreA2aClient {
-  /**
-   * Construct the A2A invocations URL for an AgentCore runtime ARN and
-   * extract the region. A2A on AgentCore is mounted at `/invocations/`
-   * (trailing slash matters).
-   */
-  private static buildUrl(agentRuntimeArn: string): {
-    region: string;
-    url: string;
-  } {
-    const region = agentRuntimeArn.split(':')[3];
-    const url = `https://bedrock-agentcore.${region}.amazonaws.com/runtimes/${encodeURIComponent(agentRuntimeArn)}/invocations/`;
-    return { region, url };
-  }
-
-  private static build(
-    url: string,
-    authFetch: typeof fetch,
-    options: BuildOptions,
-  ): A2AAgent {
-    const sessionFetch: typeof fetch = (input, init) => {
-      const headers = new Headers(init?.headers);
-      const sessionId = getCurrentSessionId();
-      if (sessionId) headers.set(SESSION_HEADER, sessionId);
-      return authFetch(input, { ...init, headers });
-    };
-    const clientFactory = new ClientFactory({
-      ...ClientFactoryOptions.default,
-      transports: [new JsonRpcTransportFactory({ fetchImpl: sessionFetch })],
-      cardResolver: new DefaultAgentCardResolver({ fetchImpl: sessionFetch }),
-    });
-    return new A2AAgent({
-      url,
-      clientFactory,
-      ...(options.name ? { name: options.name } : {}),
-      ...(options.description ? { description: options.description } : {}),
-    });
-  }
-
-  static withIamAuth(options: AgentCoreA2aClientIamOptions): A2AAgent {
-    const { region, url } = AgentCoreA2aClient.buildUrl(options.agentRuntimeArn);
-    const credentialProvider =
-      options.credentialProvider ?? fromNodeProviderChain();
-    const sigv4Fetch: typeof fetch = async (...args) => {
-      const client = new AwsClient({
-        ...(await credentialProvider()),
-        service: 'bedrock-agentcore',
-        region,
-      });
-      return client.fetch(...args);
-    };
-    return AgentCoreA2aClient.build(url, sigv4Fetch, options);
-  }
-
-  static withJwtAuth(options: AgentCoreA2aClientJwtOptions): A2AAgent {
-    const { url } = AgentCoreA2aClient.buildUrl(options.agentRuntimeArn);
-    const bearerFetch: typeof fetch = async (input, init) => {
-      const headers = new Headers(init?.headers);
-      headers.set(
-        'Authorization',
-        `Bearer ${await options.accessTokenProvider()}`,
-      );
-      return fetch(input, { ...init, headers });
-    };
-    return AgentCoreA2aClient.build(url, bearerFetch, options);
-  }
-
-  /** For local dev — plain HTTP, no auth. */
-  static withoutAuth(options: AgentCoreA2aClientNoAuthOptions): A2AAgent {
-    return AgentCoreA2aClient.build(options.url, fetch, options);
-  }
-}

package/src/utils/agent-connection/files/core-gateway/agentcore-gateway-mcp-client.ts.template

@@ -1,78 +0,0 @@
-import { McpClient } from '@strands-agents/sdk';
-import { StreamableHTTPClientTransport } from '@modelcontextprotocol/sdk/client/streamableHttp.js';
-import { AwsClient } from 'aws4fetch';
-import { fromNodeProviderChain } from '@aws-sdk/credential-providers';
-import { getCurrentSessionId } from './session-context.js';
-
-const SESSION_HEADER = 'X-Amzn-Bedrock-AgentCore-Runtime-Session-Id';
-
-export interface AgentCoreGatewayMcpClientIamOptions {
-  /**
-   * The MCP URL of the AgentCore Gateway, of the form
-   * https://<gatewayId>.gateway.bedrock-agentcore.<region>.amazonaws.com/mcp
-   */
-  gatewayUrl: string;
-  /** AWS region override; by default parsed from `gatewayUrl`. */
-  region?: string;
-  /** AWS credential provider; defaults to the standard provider chain. */
-  credentialProvider?: ReturnType<typeof fromNodeProviderChain>;
-}
-
-/**
- * Factory for MCP clients that connect to an AgentCore Gateway. Forwards the
- * current async-context session via the AgentCore session header, which the
- * gateway propagates to downstream MCP server targets.
- */
-export class AgentCoreGatewayMcpClient {
-  /** Create a gateway MCP client authenticated with IAM SigV4. */
-  static withIamAuth(options: AgentCoreGatewayMcpClientIamOptions): McpClient {
-    const credentialProvider =
-      options.credentialProvider ?? fromNodeProviderChain();
-    const region =
-      options.region ?? parseRegionFromGatewayUrl(options.gatewayUrl);
-
-    const sigv4Fetch: typeof fetch = async (input, init) => {
-      const client = new AwsClient({
-        ...(await credentialProvider()),
-        service: 'bedrock-agentcore',
-        region,
-      });
-      return client.fetch(input, {
-        ...init,
-        headers: withSessionHeader(init?.headers),
-      });
-    };
-    return AgentCoreGatewayMcpClient.create(options.gatewayUrl, sigv4Fetch);
-  }
-
-  /** Plain-HTTP gateway client, for the local gateway started by serve-local. */
-  static withoutAuth(options: { gatewayUrl: string }): McpClient {
-    const plainFetch: typeof fetch = async (input, init) =>
-      fetch(input, { ...init, headers: withSessionHeader(init?.headers) });
-    return AgentCoreGatewayMcpClient.create(options.gatewayUrl, plainFetch);
-  }
-
-  private static create(gatewayUrl: string, fetchFn: typeof fetch): McpClient {
-    const transport = new StreamableHTTPClientTransport(new URL(gatewayUrl), {
-      fetch: fetchFn,
-    });
-    return new McpClient({ transport });
-  }
-}
-
-const withSessionHeader = (init?: RequestInit['headers']): Headers => {
-  const headers = new Headers(init);
-  const sessionId = getCurrentSessionId();
-  if (sessionId) headers.set(SESSION_HEADER, sessionId);
-  return headers;
-};
-
-const parseRegionFromGatewayUrl = (gatewayUrl: string): string => {
-  const match = /\.bedrock-agentcore\.([^.]+)\.amazonaws\.com/.exec(gatewayUrl);
-  if (!match) {
-    throw new Error(
-      `Cannot determine region from gateway URL '${gatewayUrl}'. Pass region explicitly.`,
-    );
-  }
-  return match[1];
-};

package/src/utils/agent-connection/files/core-mcp/agentcore-mcp-client.ts.template

@@ -1,128 +0,0 @@
-import { McpClient } from '@strands-agents/sdk';
-import { StreamableHTTPClientTransport } from '@modelcontextprotocol/sdk/client/streamableHttp.js';
-import { AwsClient } from 'aws4fetch';
-import { fromNodeProviderChain } from '@aws-sdk/credential-providers';
-import { getCurrentSessionId } from './session-context.js';
-
-const SESSION_HEADER = 'X-Amzn-Bedrock-AgentCore-Runtime-Session-Id';
-
-/**
- * Common options for creating an AgentCore MCP client.
- */
-export interface AgentCoreMcpClientOptions {
-  /**
-   * The ARN of the Bedrock AgentCore Runtime to connect to.
-   */
-  agentRuntimeArn: string;
-}
-
-/**
- * Options for creating an AgentCore MCP client with IAM authentication.
- */
-export interface AgentCoreMcpClientIamOptions
-  extends AgentCoreMcpClientOptions {
-  /**
-   * Optional AWS credential provider. If not provided, uses the default
-   * credential provider chain from the AWS SDK.
-   */
-  credentialProvider?: ReturnType<typeof fromNodeProviderChain>;
-}
-
-/**
- * Options for creating an AgentCore MCP client with JWT authentication.
- */
-export interface AgentCoreMcpClientJwtOptions
-  extends AgentCoreMcpClientOptions {
-  /**
-   * A function which returns the JWT access token used to authenticate.
-   */
-  accessTokenProvider: () => Promise<string>;
-}
-
-/**
- * Options for creating an MCP client with no auth (local dev).
- */
-export interface AgentCoreMcpClientNoAuthOptions {
-  /** Full URL of the local MCP endpoint. */
-  url: string;
-}
-
-interface CreateOptions {
-  url: string;
-  buildHeaders?: () => Promise<Record<string, string>>;
-  fetch?: typeof fetch;
-}
-
-/** Factory for MCP clients that forward the current async-context session. */
-export class AgentCoreMcpClient {
-  /**
-   * Construct the invocation URL for an AgentCore runtime ARN and extract
-   * the region. ARN format: arn:partition:service:region:account-id:resource
-   */
-  private static buildUrl(agentRuntimeArn: string): {
-    region: string;
-    url: string;
-  } {
-    const region = agentRuntimeArn.split(':')[3];
-    const url = `https://bedrock-agentcore.${region}.amazonaws.com/runtimes/${encodeURIComponent(agentRuntimeArn)}/invocations?qualifier=DEFAULT`;
-    return { region, url };
-  }
-
-  private static create(options: CreateOptions): McpClient {
-    const {
-      url,
-      buildHeaders = async (): Promise<Record<string, string>> => ({}),
-      fetch: customFetch,
-    } = options;
-    const fetchWithHeaders: typeof fetch = async (input, init) => {
-      const headers = new Headers(init?.headers);
-      const sessionId = getCurrentSessionId();
-      if (sessionId) headers.set(SESSION_HEADER, sessionId);
-      const extra = await buildHeaders();
-      for (const k of Object.keys(extra)) {
-        headers.set(k, extra[k]);
-      }
-      return (customFetch ?? fetch)(input, { ...init, headers });
-    };
-    const transport = new StreamableHTTPClientTransport(new URL(url), {
-      fetch: fetchWithHeaders,
-    });
-    return new McpClient({ transport });
-  }
-
-  /**
-   * SigV4-authenticated client for a Bedrock AgentCore runtime.
-   */
-  static withIamAuth(options: AgentCoreMcpClientIamOptions): McpClient {
-    const { region, url } = AgentCoreMcpClient.buildUrl(options.agentRuntimeArn);
-    const credentialProvider =
-      options.credentialProvider ?? fromNodeProviderChain();
-    const sigv4Fetch: typeof fetch = async (...args) => {
-      const client = new AwsClient({
-        ...(await credentialProvider()),
-        service: 'bedrock-agentcore',
-        region,
-      });
-      return client.fetch(...args);
-    };
-    return AgentCoreMcpClient.create({ url, fetch: sigv4Fetch });
-  }
-
-  /**
-   * Bearer-authenticated client for a Bedrock AgentCore runtime.
-   */
-  static withJwtAuth(options: AgentCoreMcpClientJwtOptions): McpClient {
-    const { url } = AgentCoreMcpClient.buildUrl(options.agentRuntimeArn);
-    return AgentCoreMcpClient.create({
-      url,
-      buildHeaders: async () => ({
-        Authorization: `Bearer ${await options.accessTokenProvider()}`,
-      }),
-    });
-  }
-
-  /** For local dev — plain HTTP, no auth. */
-  static withoutAuth(options: AgentCoreMcpClientNoAuthOptions): McpClient {
-    return AgentCoreMcpClient.create({ url: options.url });
-  }
-}

package/src/utils/agent-connection/files/py-core-a2a/agentcore_a2a_client.py.template

@@ -1,120 +0,0 @@
-from collections.abc import Callable
-from urllib.parse import quote
-
-import boto3
-import httpx
-from a2a.client import ClientConfig
-from strands.agent.a2a_agent import A2AAgent
-
-from .auth import SigV4HTTPXAuth
-from .session_context import get_current_session_id
-
-SESSION_HEADER = "X-Amzn-Bedrock-AgentCore-Runtime-Session-Id"
-
-
-class _SessionHeaderAuth(httpx.Auth):
-    """Stamps the AgentCore session header from the current async context."""
-
-    requires_request_body = True
-    requires_response_body = True
-
-    def __init__(self, inner: httpx.Auth | None = None):
-        self._inner = inner
-
-    def auth_flow(self, request: httpx.Request):  # type: ignore[override]
-        sid = get_current_session_id()
-        if sid:
-            request.headers[SESSION_HEADER] = sid
-        if self._inner is None:
-            yield request
-            return
-        yield from self._inner.auth_flow(request)
-
-
-class AgentCoreA2aClient:
-    """Factory for A2A clients that forward the current async-context session."""
-
-    @staticmethod
-    def _build_url(agent_runtime_arn: str) -> tuple[str, str]:
-        """Extract region from ARN and construct the A2A invocations URL.
-
-        ARN format: arn:partition:service:region:account-id:resource
-        A2A on AgentCore is mounted at `/invocations/` (trailing slash matters).
-        """
-        region = agent_runtime_arn.split(":")[3]
-        encoded_arn = quote(agent_runtime_arn, safe="")
-        url = (
-            f"https://bedrock-agentcore.{region}.amazonaws.com/runtimes/"
-            f"{encoded_arn}/invocations/"
-        )
-        return region, url
-
-    @staticmethod
-    def _build(
-        url: str,
-        auth: httpx.Auth | None,
-        headers: dict | None,
-        *,
-        name: str | None,
-        description: str | None,
-    ) -> A2AAgent:
-        httpx_client = httpx.AsyncClient(
-            auth=_SessionHeaderAuth(auth),
-            headers=headers or {},
-            timeout=120,
-        )
-        client_config = ClientConfig(httpx_client=httpx_client, streaming=False)
-        kwargs: dict = {"endpoint": url, "client_config": client_config}
-        if name:
-            kwargs["name"] = name
-        if description:
-            kwargs["description"] = description
-        return A2AAgent(**kwargs)
-
-    @staticmethod
-    def with_iam_auth(
-        agent_runtime_arn: str,
-        *,
-        name: str | None = None,
-        description: str | None = None,
-    ) -> A2AAgent:
-        """SigV4-authenticated client for a Bedrock AgentCore runtime."""
-        region, url = AgentCoreA2aClient._build_url(agent_runtime_arn)
-        credentials = boto3.Session(region_name=region).get_credentials()
-        return AgentCoreA2aClient._build(
-            url,
-            SigV4HTTPXAuth(credentials, "bedrock-agentcore", region),
-            None,
-            name=name,
-            description=description,
-        )
-
-    @staticmethod
-    def with_jwt_auth(
-        agent_runtime_arn: str,
-        access_token_provider: Callable[[], str],
-        *,
-        name: str | None = None,
-        description: str | None = None,
-    ) -> A2AAgent:
-        """Bearer-authenticated client for a Bedrock AgentCore runtime."""
-        _, url = AgentCoreA2aClient._build_url(agent_runtime_arn)
-        return AgentCoreA2aClient._build(
-            url,
-            None,
-            {"Authorization": f"Bearer {access_token_provider()}"},
-            name=name,
-            description=description,
-        )
-
-    @staticmethod
-    def without_auth(
-        url: str,
-        *,
-        name: str | None = None,
-        description: str | None = None,
-    ) -> A2AAgent:
-        """Plain-HTTP client — for local dev."""
-        return AgentCoreA2aClient._build(
-            url, None, None, name=name, description=description
-        )