@aws/nx-plugin 1.0.0-rc.17 → 1.0.0-rc.19

package/src/ts/rdb/__snapshots__/generator.spec.ts.snap

@@ -1336,9 +1336,9 @@ resource "null_resource" "proxy_target_ready" {
       deadline=$((start_time + 600))
       while true; do
         target_state=$(aws rds describe-db-proxy-targets \\
-          --region \${data.aws_region.current.region} \\
-          --db-proxy-name \${self.triggers.db_proxy_name} \\
-          --target-group-name \${self.triggers.target_group_name} \\
+          --region "$AWS_REGION" \\
+          --db-proxy-name "$DB_PROXY_NAME" \\
+          --target-group-name "$TARGET_GROUP_NAME" \\
           --query "Targets[?Type=='RDS_INSTANCE'] | [0].TargetHealth.State" \\
           --output text)
 
@@ -1348,13 +1348,19 @@ resource "null_resource" "proxy_target_ready" {
 
         current_time=$(date +%s)
         if [ "$current_time" -ge "$deadline" ]; then
-          echo "RDS Proxy target \${self.triggers.db_cluster_identifier} did not become AVAILABLE within 10 minutes. Last state: $target_state"
+          echo "RDS Proxy target $DB_CLUSTER_IDENTIFIER did not become AVAILABLE within 10 minutes. Last state: $target_state"
           exit 1
         fi
 
         sleep 10
       done
     EOT
+    environment = {
+      AWS_REGION            = data.aws_region.current.region
+      DB_PROXY_NAME         = self.triggers.db_proxy_name
+      TARGET_GROUP_NAME     = self.triggers.target_group_name
+      DB_CLUSTER_IDENTIFIER = self.triggers.db_cluster_identifier
+    }
   }
 
   depends_on = [
@@ -1838,10 +1844,15 @@ resource "null_resource" "docker_publish" {
 
   provisioner "local-exec" {
     command = <<-EOT
-      aws ecr get-login-password --region \${data.aws_region.current.region} | docker login --username AWS --password-stdin \${self.triggers.repository_url}
-      docker tag \${self.triggers.docker_image_tag} \${self.triggers.repository_url}:latest
-      docker push \${self.triggers.repository_url}:latest
+      aws ecr get-login-password --region "$AWS_REGION" | docker login --username AWS --password-stdin "$REPOSITORY_URL"
+      docker tag "$DOCKER_IMAGE_TAG" "$REPOSITORY_URL:latest"
+      docker push "$REPOSITORY_URL:latest"
     EOT
+    environment = {
+      AWS_REGION       = data.aws_region.current.region
+      REPOSITORY_URL   = self.triggers.repository_url
+      DOCKER_IMAGE_TAG = self.triggers.docker_image_tag
+    }
   }
 
   depends_on = [aws_ecr_repository_policy.migration_handler]
@@ -2099,10 +2110,10 @@ resource "null_resource" "create_db_user_trigger" {
     command = <<-EOT
       output_file=$(mktemp)
       response=$(aws lambda invoke \\
-        --region \${data.aws_region.current.region} \\
-        --function-name \${self.triggers.function_name} \\
+        --region "$AWS_REGION" \\
+        --function-name "$FUNCTION_NAME" \\
         --cli-binary-format raw-in-base64-out \\
-        --payload '{"RequestType":"Create","PhysicalResourceId":"db-user:\${self.triggers.db_user}"}' \\
+        --payload "{\\"RequestType\\":\\"Create\\",\\"PhysicalResourceId\\":\\"db-user:$DB_USER\\"}" \\
         "$output_file")
       cat "$output_file"
       echo "$response"
@@ -2112,6 +2123,11 @@ resource "null_resource" "create_db_user_trigger" {
       fi
       rm -f "$output_file"
     EOT
+    environment = {
+      AWS_REGION    = data.aws_region.current.region
+      FUNCTION_NAME = self.triggers.function_name
+      DB_USER       = self.triggers.db_user
+    }
   }
 
   depends_on = [aws_lambda_function.create_db_user, module.aurora]
@@ -2174,8 +2190,8 @@ resource "null_resource" "migration_trigger" {
     command = <<-EOT
       output_file=$(mktemp)
       response=$(aws lambda invoke \\
-        --region \${data.aws_region.current.region} \\
-        --function-name \${self.triggers.function_name} \\
+        --region "$AWS_REGION" \\
+        --function-name "$FUNCTION_NAME" \\
         --cli-binary-format raw-in-base64-out \\
         "$output_file")
       cat "$output_file"
@@ -2186,6 +2202,10 @@ resource "null_resource" "migration_trigger" {
       fi
       rm -f "$output_file"
     EOT
+    environment = {
+      AWS_REGION    = data.aws_region.current.region
+      FUNCTION_NAME = self.triggers.function_name
+    }
   }
 
   depends_on = [
@@ -2797,9 +2817,9 @@ resource "null_resource" "proxy_target_ready" {
       deadline=$((start_time + 600))
       while true; do
         target_state=$(aws rds describe-db-proxy-targets \\
-          --region \${data.aws_region.current.region} \\
-          --db-proxy-name \${self.triggers.db_proxy_name} \\
-          --target-group-name \${self.triggers.target_group_name} \\
+          --region "$AWS_REGION" \\
+          --db-proxy-name "$DB_PROXY_NAME" \\
+          --target-group-name "$TARGET_GROUP_NAME" \\
           --query "Targets[?Type=='RDS_INSTANCE'] | [0].TargetHealth.State" \\
           --output text)
 
@@ -2809,13 +2829,19 @@ resource "null_resource" "proxy_target_ready" {
 
         current_time=$(date +%s)
         if [ "$current_time" -ge "$deadline" ]; then
-          echo "RDS Proxy target \${self.triggers.db_cluster_identifier} did not become AVAILABLE within 10 minutes. Last state: $target_state"
+          echo "RDS Proxy target $DB_CLUSTER_IDENTIFIER did not become AVAILABLE within 10 minutes. Last state: $target_state"
           exit 1
         fi
 
         sleep 10
       done
     EOT
+    environment = {
+      AWS_REGION            = data.aws_region.current.region
+      DB_PROXY_NAME         = self.triggers.db_proxy_name
+      TARGET_GROUP_NAME     = self.triggers.target_group_name
+      DB_CLUSTER_IDENTIFIER = self.triggers.db_cluster_identifier
+    }
   }
 
   depends_on = [
@@ -3299,10 +3325,15 @@ resource "null_resource" "docker_publish" {
 
   provisioner "local-exec" {
     command = <<-EOT
-      aws ecr get-login-password --region \${data.aws_region.current.region} | docker login --username AWS --password-stdin \${self.triggers.repository_url}
-      docker tag \${self.triggers.docker_image_tag} \${self.triggers.repository_url}:latest
-      docker push \${self.triggers.repository_url}:latest
+      aws ecr get-login-password --region "$AWS_REGION" | docker login --username AWS --password-stdin "$REPOSITORY_URL"
+      docker tag "$DOCKER_IMAGE_TAG" "$REPOSITORY_URL:latest"
+      docker push "$REPOSITORY_URL:latest"
     EOT
+    environment = {
+      AWS_REGION       = data.aws_region.current.region
+      REPOSITORY_URL   = self.triggers.repository_url
+      DOCKER_IMAGE_TAG = self.triggers.docker_image_tag
+    }
   }
 
   depends_on = [aws_ecr_repository_policy.migration_handler]
@@ -3565,10 +3596,10 @@ resource "null_resource" "create_db_user_trigger" {
     command = <<-EOT
       output_file=$(mktemp)
       response=$(aws lambda invoke \\
-        --region \${data.aws_region.current.region} \\
-        --function-name \${self.triggers.function_name} \\
+        --region "$AWS_REGION" \\
+        --function-name "$FUNCTION_NAME" \\
         --cli-binary-format raw-in-base64-out \\
-        --payload '{"RequestType":"Create","PhysicalResourceId":"db-user:\${self.triggers.db_user}"}' \\
+        --payload "{\\"RequestType\\":\\"Create\\",\\"PhysicalResourceId\\":\\"db-user:$DB_USER\\"}" \\
         "$output_file")
       cat "$output_file"
       echo "$response"
@@ -3578,6 +3609,11 @@ resource "null_resource" "create_db_user_trigger" {
       fi
       rm -f "$output_file"
     EOT
+    environment = {
+      AWS_REGION    = data.aws_region.current.region
+      FUNCTION_NAME = self.triggers.function_name
+      DB_USER       = self.triggers.db_user
+    }
   }
 
   depends_on = [aws_lambda_function.create_db_user, module.aurora]
@@ -3636,8 +3672,8 @@ resource "null_resource" "migration_trigger" {
     command = <<-EOT
       output_file=$(mktemp)
       response=$(aws lambda invoke \\
-        --region \${data.aws_region.current.region} \\
-        --function-name \${self.triggers.function_name} \\
+        --region "$AWS_REGION" \\
+        --function-name "$FUNCTION_NAME" \\
         --cli-binary-format raw-in-base64-out \\
         "$output_file")
       cat "$output_file"
@@ -3648,6 +3684,10 @@ resource "null_resource" "migration_trigger" {
       fi
       rm -f "$output_file"
     EOT
+    environment = {
+      AWS_REGION    = data.aws_region.current.region
+      FUNCTION_NAME = self.triggers.function_name
+    }
   }
 
   depends_on = [

package/src/ts/react-website/app/__snapshots__/generator.spec.ts.snap

@@ -690,7 +690,7 @@ resource "null_resource" "upload_website_files" {
 
   provisioner "local-exec" {
     command = <<-EOT
-      cd "\${path.root}"
+      cd "$ROOT_PATH"
       uv run --with boto3 python3 -c "
 import os
 import sys
@@ -779,9 +779,14 @@ def sync_to_s3(local_path, bucket_name):
         sys.exit(1)
 
 # Execute sync
-sync_to_s3('\${var.website_file_path}', '\${aws_s3_bucket.website.bucket}')
+sync_to_s3(os.environ['WEBSITE_FILE_PATH'], os.environ['BUCKET_NAME'])
 "
     EOT
+    environment = {
+      ROOT_PATH         = path.root
+      WEBSITE_FILE_PATH = var.website_file_path
+      BUCKET_NAME       = aws_s3_bucket.website.bucket
+    }
   }
 
   depends_on = [aws_s3_bucket_policy.website_cloudfront_policy]
@@ -811,6 +816,7 @@ resource "null_resource" "cloudfront_invalidation" {
     command = <<-EOT
       uv run --with boto3 python3 -c "
 import boto3
+import os
 import sys
 from botocore.exceptions import ClientError, NoCredentialsError
 
@@ -832,7 +838,7 @@ def create_invalidation(distribution_id):
 
         invalidation_id = response['Invalidation']['Id']
         print(f'CloudFront cache invalidation created: {invalidation_id}')
-        print(f'Distribution: \${aws_cloudfront_distribution.website.id}')
+        print(f'Distribution: {distribution_id}')
         print(f'Status: {response[\\"Invalidation\\"][\\"Status\\"]}')
 
     except NoCredentialsError:
@@ -846,9 +852,12 @@ def create_invalidation(distribution_id):
         sys.exit(1)
 
 # Execute invalidation
-create_invalidation('\${aws_cloudfront_distribution.website.id}')
+create_invalidation(os.environ['DISTRIBUTION_ID'])
 "
     EOT
+    environment = {
+      DISTRIBUTION_ID = aws_cloudfront_distribution.website.id
+    }
   }
 
   depends_on = [

package/src/ts/react-website/cognito-auth/__snapshots__/generator.terraform.spec.ts.snap

@@ -65,12 +65,13 @@ resource "null_resource" "add_callback_url" {
     command = <<-EOT
       uv run --with boto3 python -c "
 import boto3
+import os
 import sys
 
 # Configuration
-user_pool_id = '\${local.user_pool_id}'
-client_id = '\${local.user_pool_client_id}'
-new_callback_url = '\${var.callback_url}'
+user_pool_id = os.environ['USER_POOL_ID']
+client_id = os.environ['CLIENT_ID']
+new_callback_url = os.environ['NEW_CALLBACK_URL']
 
 # Initialize Cognito client
 cognito = boto3.client('cognito-idp')
@@ -122,6 +123,11 @@ except Exception as e:
     sys.exit(1)
 "
     EOT
+    environment = {
+      USER_POOL_ID     = local.user_pool_id
+      CLIENT_ID        = local.user_pool_client_id
+      NEW_CALLBACK_URL = var.callback_url
+    }
   }
 
   depends_on = [terraform_data.validate_cognito_props]

package/src/utils/agent-connection/agent-connection.d.ts

@@ -17,34 +17,46 @@ export declare function getPythonAgentConnectionModuleName(tree: Tree): string;
  */
 export declare function getPythonAgentConnectionPackageName(tree: Tree): string;
 /**
- * Directories (relative to this file) holding per-protocol core client
- * template files. Per-connection generators select which set to emit so
- * the MCP connection doesn't pull in the A2A client (or vice versa).
+ * The connection protocols an agent framework can connect over. Each maps to a
+ * framework-agnostic Layer-0/1 template directory plus a per-framework Layer-2
+ * client directory (see `FRAMEWORKS`).
  */
-export declare const TS_CORE_TEMPLATES: {
-    readonly mcp: "core-mcp";
-    readonly a2a: "core-a2a";
-    readonly gateway: "core-gateway";
-};
-export declare const PY_CORE_TEMPLATES: {
-    readonly mcp: "py-core-mcp";
-    readonly a2a: "py-core-a2a";
-    readonly gateway: "py-core-gateway";
-    /** Shared SigV4 `httpx.Auth` used by both MCP and A2A clients. */
-    readonly auth: "py-core-auth";
-};
+export type ConnectionProtocol = 'mcp' | 'gateway' | 'a2a';
+/**
+ * The agent frameworks we can generate connection clients for. Adding a new
+ * framework is an additive change: append an entry to `FRAMEWORKS` with its
+ * Layer-2 template directories and dependencies — the framework-agnostic
+ * Layer-0/1 (`core-auth`, `core-shared`, the per-protocol transports/configs)
+ * is reused unchanged.
+ */
+export type AgentFramework = 'strands';
 /**
  * Ensure the shared TypeScript agent-connection project exists and has the
- * shared core helpers (runtime-config loader). Per-connection generators
- * are responsible for emitting their own per-protocol core client templates.
+ * framework-agnostic core helpers (runtime-config loader, session context).
+ * Per-connection generators emit their own protocol + framework client
+ * templates via `addTypeScriptCoreClient`.
  */
 export declare function ensureTypeScriptAgentConnectionProject(tree: Tree): Promise<void>;
 /**
- * Emit one of the TypeScript core client templates (mcp or a2a) into the
- * agent-connection project's `src/core/` directory. Safe to call multiple
- * times — `KeepExisting` preserves customised files.
+ * Emit a framework's base Layer-2 helpers (model-error logging + per-session
+ * agent cache) into the agent-connection project and re-export them. The agent
+ * server entry point imports these regardless of whether any connection client
+ * is wired in, so the agent generator calls this directly; connection
+ * generators call it transitively via `addTypeScriptCoreClient`.
+ */
+export declare function addTypeScriptFrameworkBase(tree: Tree, framework?: AgentFramework): Promise<void>;
+/**
+ * Emit the TypeScript client templates for a connection protocol and agent
+ * framework into the agent-connection project's `src/core/` directory. Safe to
+ * call multiple times — `KeepExisting` preserves customised files.
+ *
+ * Layers emitted:
+ *  - Layer 0 `core-auth` (signed fetch + endpoint resolution) — always
+ *  - Layer 1 `core-shared` MCP transport — for mcp/gateway protocols
+ *  - Layer 1 the protocol's transport/client-config — always
+ *  - Layer 2 the framework's base helpers + protocol client — per framework
  */
-export declare function addTypeScriptCoreClient(tree: Tree, kind: keyof typeof TS_CORE_TEMPLATES): void;
+export declare function addTypeScriptCoreClient(tree: Tree, protocol: ConnectionProtocol, framework?: AgentFramework): Promise<void>;
 /**
  * Ensure the shared Python agent-connection project exists.
  * Only creates the project shell — per-connection generators are responsible
@@ -52,10 +64,24 @@ export declare function addTypeScriptCoreClient(tree: Tree, kind: keyof typeof T
  */
 export declare function ensurePythonAgentConnectionProject(tree: Tree): Promise<void>;
 /**
- * Emit a Python core client template (mcp / a2a / shared auth) into the
- * agent-connection project's core directory.
+ * Emit a framework's base Layer-2 helpers (model-error logging + per-session
+ * agent cache) into the Python agent-connection project and re-export them.
+ * The agent server entry point imports these regardless of whether a connection
+ * client is wired in, so the agent generator calls this directly; connection
+ * generators call it transitively via `addPythonCoreClient`.
+ */
+export declare function addPythonFrameworkBase(tree: Tree, framework?: AgentFramework): Promise<void>;
+/**
+ * Emit the Python client templates for a connection protocol and agent
+ * framework into the agent-connection project's core directory.
+ *
+ * Layers emitted:
+ *  - Layer 0 `py-core-auth` (SigV4 httpx.Auth, session auth, endpoints) — always
+ *  - Layer 1 `py-core-shared` MCP transport — for mcp/gateway protocols
+ *  - Layer 1 the protocol's transport/client-config — always
+ *  - Layer 2 the framework's base helpers + protocol client — per framework
  */
-export declare function addPythonCoreClient(tree: Tree, kind: keyof typeof PY_CORE_TEMPLATES): void;
+export declare function addPythonCoreClient(tree: Tree, protocol: ConnectionProtocol, framework?: AgentFramework): Promise<void>;
 /**
  * Patch a TypeScript agent.ts to create a connection client and register it
  * in the Agent's tools. Used by the MCP and gateway connection generators —

package/src/utils/agent-connection/agent-connection.js

@@ -1,12 +1,14 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.PY_CORE_TEMPLATES = exports.TS_CORE_TEMPLATES = exports.AGENT_CONNECTION_PROJECT_DIR = void 0;
+exports.AGENT_CONNECTION_PROJECT_DIR = void 0;
 exports.getPythonAgentConnectionProjectDir = getPythonAgentConnectionProjectDir;
 exports.getPythonAgentConnectionModuleName = getPythonAgentConnectionModuleName;
 exports.getPythonAgentConnectionPackageName = getPythonAgentConnectionPackageName;
 exports.ensureTypeScriptAgentConnectionProject = ensureTypeScriptAgentConnectionProject;
+exports.addTypeScriptFrameworkBase = addTypeScriptFrameworkBase;
 exports.addTypeScriptCoreClient = addTypeScriptCoreClient;
 exports.ensurePythonAgentConnectionProject = ensurePythonAgentConnectionProject;
+exports.addPythonFrameworkBase = addPythonFrameworkBase;
 exports.addPythonCoreClient = addPythonCoreClient;
 exports.addTypeScriptClientToAgent = addTypeScriptClientToAgent;
 exports.addPythonClientToAgent = addPythonClientToAgent;
@@ -59,26 +61,63 @@ function getPythonAgentConnectionPackageName(tree) {
     return fullyQualifiedName;
 }
 /**
- * Directories (relative to this file) holding per-protocol core client
- * template files. Per-connection generators select which set to emit so
- * the MCP connection doesn't pull in the A2A client (or vice versa).
+ * Framework-agnostic Layer-1 templates, keyed by protocol. These resolve the
+ * endpoint and build the signed transport/client-config; they contain no
+ * framework dependency.
  */
-exports.TS_CORE_TEMPLATES = {
+const TS_PROTOCOL_TEMPLATES = {
     mcp: 'core-mcp',
-    a2a: 'core-a2a',
     gateway: 'core-gateway',
+    a2a: 'core-a2a',
 };
-exports.PY_CORE_TEMPLATES = {
+const PY_PROTOCOL_TEMPLATES = {
     mcp: 'py-core-mcp',
-    a2a: 'py-core-a2a',
     gateway: 'py-core-gateway',
-    /** Shared SigV4 `httpx.Auth` used by both MCP and A2A clients. */
-    auth: 'py-core-auth',
+    a2a: 'py-core-a2a',
+};
+const FRAMEWORKS = {
+    strands: {
+        ts: {
+            base: 'core-strands/base',
+            protocols: {
+                mcp: 'core-strands/mcp',
+                gateway: 'core-strands/gateway',
+                a2a: 'core-strands/a2a',
+            },
+            deps: [],
+        },
+        py: {
+            base: 'py-core-strands/base',
+            protocols: {
+                mcp: 'py-core-strands/mcp',
+                gateway: 'py-core-strands/gateway',
+                a2a: 'py-core-strands/a2a',
+            },
+            deps: ['strands-agents'],
+        },
+    },
 };
+/** Resolve a framework's templates for a language + protocol, or throw. */
+function frameworkLanguage(framework, language, protocol) {
+    const lang = FRAMEWORKS[framework][language];
+    if (!lang) {
+        throw new Error(`The '${framework}' framework does not support ${language === 'ts' ? 'TypeScript' : 'Python'} agents.`);
+    }
+    const protocolDir = lang.protocols[protocol];
+    if (!protocolDir) {
+        throw new Error(`The '${framework}' framework does not support ${protocol} connections for ${language === 'ts' ? 'TypeScript' : 'Python'} agents.`);
+    }
+    return { ...lang, protocol: protocolDir };
+}
+/** Protocols whose Layer-1 needs the shared MCP transport (`core-shared`). */
+const MCP_TRANSPORT_PROTOCOLS = ['mcp', 'gateway'];
+const tsCoreDir = () => (0, devkit_1.joinPathFragments)(exports.AGENT_CONNECTION_PROJECT_DIR, 'src', 'core');
+const emitTs = (tree, templateDir) => (0, devkit_1.generateFiles)(tree, (0, devkit_1.joinPathFragments)(__dirname, 'files', templateDir), tsCoreDir(), {}, { overwriteStrategy: devkit_1.OverwriteStrategy.KeepExisting });
 /**
  * Ensure the shared TypeScript agent-connection project exists and has the
- * shared core helpers (runtime-config loader). Per-connection generators
- * are responsible for emitting their own per-protocol core client templates.
+ * framework-agnostic core helpers (runtime-config loader, session context).
+ * Per-connection generators emit their own protocol + framework client
+ * templates via `addTypeScriptCoreClient`.
  */
 async function ensureTypeScriptAgentConnectionProject(tree) {
     const projectJsonPath = (0, devkit_1.joinPathFragments)(exports.AGENT_CONNECTION_PROJECT_DIR, 'project.json');
@@ -88,23 +127,51 @@ async function ensureTypeScriptAgentConnectionProject(tree) {
             directory: (0, devkit_1.joinPathFragments)(PACKAGES_DIR, COMMON_DIR),
         });
     }
-    // Shared core helpers — emitted regardless of which per-protocol core
-    // client the caller needs, so both MCP and A2A clients can import from them.
-    (0, devkit_1.generateFiles)(tree, (0, devkit_1.joinPathFragments)(__dirname, 'files', 'core-runtime-config'), (0, devkit_1.joinPathFragments)(exports.AGENT_CONNECTION_PROJECT_DIR, 'src', 'core'), {}, { overwriteStrategy: devkit_1.OverwriteStrategy.KeepExisting });
-    // Re-export session-context helpers so agent server entry points
-    // can set the current session on each inbound request without pulling in
-    // the agent-connection internals.
+    // Framework-agnostic runtime-config + session-context helpers.
+    emitTs(tree, 'core-runtime-config');
+    // Re-export session-context helpers so agent server entry points can set the
+    // current session on each inbound request without pulling in internals.
     await (0, ast_1.addStarExport)(tree, (0, devkit_1.joinPathFragments)(exports.AGENT_CONNECTION_PROJECT_DIR, 'src', 'index.ts'), './core/session-context.js');
-    await (0, ast_1.addStarExport)(tree, (0, devkit_1.joinPathFragments)(exports.AGENT_CONNECTION_PROJECT_DIR, 'src', 'index.ts'), './core/with-session-id.js');
-    await (0, ast_1.addStarExport)(tree, (0, devkit_1.joinPathFragments)(exports.AGENT_CONNECTION_PROJECT_DIR, 'src', 'index.ts'), './core/model-errors.js');
 }
 /**
- * Emit one of the TypeScript core client templates (mcp or a2a) into the
- * agent-connection project's `src/core/` directory. Safe to call multiple
- * times — `KeepExisting` preserves customised files.
+ * Emit a framework's base Layer-2 helpers (model-error logging + per-session
+ * agent cache) into the agent-connection project and re-export them. The agent
+ * server entry point imports these regardless of whether any connection client
+ * is wired in, so the agent generator calls this directly; connection
+ * generators call it transitively via `addTypeScriptCoreClient`.
  */
-function addTypeScriptCoreClient(tree, kind) {
-    (0, devkit_1.generateFiles)(tree, (0, devkit_1.joinPathFragments)(__dirname, 'files', exports.TS_CORE_TEMPLATES[kind]), (0, devkit_1.joinPathFragments)(exports.AGENT_CONNECTION_PROJECT_DIR, 'src', 'core'), {}, { overwriteStrategy: devkit_1.OverwriteStrategy.KeepExisting });
+async function addTypeScriptFrameworkBase(tree, framework = 'strands') {
+    const lang = FRAMEWORKS[framework].ts;
+    if (!lang) {
+        throw new Error(`The '${framework}' framework does not support TypeScript agents.`);
+    }
+    emitTs(tree, lang.base);
+    const indexPath = (0, devkit_1.joinPathFragments)(exports.AGENT_CONNECTION_PROJECT_DIR, 'src', 'index.ts');
+    await (0, ast_1.addStarExport)(tree, indexPath, './core/with-session-id-strands.js');
+    await (0, ast_1.addStarExport)(tree, indexPath, './core/model-errors-strands.js');
+}
+/**
+ * Emit the TypeScript client templates for a connection protocol and agent
+ * framework into the agent-connection project's `src/core/` directory. Safe to
+ * call multiple times — `KeepExisting` preserves customised files.
+ *
+ * Layers emitted:
+ *  - Layer 0 `core-auth` (signed fetch + endpoint resolution) — always
+ *  - Layer 1 `core-shared` MCP transport — for mcp/gateway protocols
+ *  - Layer 1 the protocol's transport/client-config — always
+ *  - Layer 2 the framework's base helpers + protocol client — per framework
+ */
+async function addTypeScriptCoreClient(tree, protocol, framework = 'strands') {
+    const fw = frameworkLanguage(framework, 'ts', protocol);
+    emitTs(tree, 'core-auth');
+    if (MCP_TRANSPORT_PROTOCOLS.includes(protocol)) {
+        emitTs(tree, 'core-shared');
+    }
+    emitTs(tree, TS_PROTOCOL_TEMPLATES[protocol]);
+    // Framework Layer 2: base helpers (re-exported for the agent server) + the
+    // thin protocol client.
+    await addTypeScriptFrameworkBase(tree, framework);
+    emitTs(tree, fw.protocol);
 }
 /**
  * Ensure the shared Python agent-connection project exists.
@@ -134,33 +201,58 @@ async function ensurePythonAgentConnectionProject(tree) {
     if (!tree.exists(appInitPath)) {
         tree.write(appInitPath, '');
     }
-    // Shared core helpers — emitted regardless of which per-protocol core
-    // client the caller needs, so both MCP and A2A clients can import them.
+    // Framework-agnostic runtime-config + session-context helpers.
     (0, devkit_1.generateFiles)(tree, (0, devkit_1.joinPathFragments)(__dirname, 'files', 'py-core-runtime-config'), coreDir, {}, { overwriteStrategy: devkit_1.OverwriteStrategy.KeepExisting });
-    // Re-export session-context helpers so agent server entry points
-    // can set the current session on each inbound request without importing
-    // the agent-connection internals directly.
+    // Re-export the session id context so agent server entry points can set the
+    // current session on each inbound request without importing internals.
     const moduleInitPath = (0, devkit_1.joinPathFragments)(moduleDir, '__init__.py');
     await addPythonReExport(tree, moduleInitPath, '.core.session_context', 'get_current_session_id');
     await addPythonReExport(tree, moduleInitPath, '.core.session_context', 'session_id_context');
-    await addPythonReExport(tree, moduleInitPath, '.core.with_session_id', 'with_session_id');
-    await addPythonReExport(tree, moduleInitPath, '.core.model_errors', 'log_model_errors');
-    // Shared core helpers depend on aws-lambda-powertools for AppConfig access
-    // and strands-agents for the model error-logging hook.
-    (0, py_1.addDependenciesToPyProjectToml)(tree, projectDir, [
-        'aws-lambda-powertools',
-        'strands-agents',
-    ]);
+    // The runtime-config loader reads AppConfig via aws-lambda-powertools.
+    (0, py_1.addDependenciesToPyProjectToml)(tree, projectDir, ['aws-lambda-powertools']);
 }
+const pyCoreDir = (tree) => (0, devkit_1.joinPathFragments)(getPythonAgentConnectionProjectDir(tree), getPythonAgentConnectionModuleName(tree), 'core');
+const emitPy = (tree, templateDir) => (0, devkit_1.generateFiles)(tree, (0, devkit_1.joinPathFragments)(__dirname, 'files', templateDir), pyCoreDir(tree), {}, { overwriteStrategy: devkit_1.OverwriteStrategy.KeepExisting });
 /**
- * Emit a Python core client template (mcp / a2a / shared auth) into the
- * agent-connection project's core directory.
+ * Emit a framework's base Layer-2 helpers (model-error logging + per-session
+ * agent cache) into the Python agent-connection project and re-export them.
+ * The agent server entry point imports these regardless of whether a connection
+ * client is wired in, so the agent generator calls this directly; connection
+ * generators call it transitively via `addPythonCoreClient`.
  */
-function addPythonCoreClient(tree, kind) {
-    const projectDir = getPythonAgentConnectionProjectDir(tree);
-    const moduleName = getPythonAgentConnectionModuleName(tree);
-    const coreDir = (0, devkit_1.joinPathFragments)(projectDir, moduleName, 'core');
-    (0, devkit_1.generateFiles)(tree, (0, devkit_1.joinPathFragments)(__dirname, 'files', exports.PY_CORE_TEMPLATES[kind]), coreDir, {}, { overwriteStrategy: devkit_1.OverwriteStrategy.KeepExisting });
+async function addPythonFrameworkBase(tree, framework = 'strands') {
+    const lang = FRAMEWORKS[framework].py;
+    if (!lang) {
+        throw new Error(`The '${framework}' framework does not support Python agents.`);
+    }
+    emitPy(tree, lang.base);
+    const moduleInitPath = (0, devkit_1.joinPathFragments)(getPythonAgentConnectionProjectDir(tree), getPythonAgentConnectionModuleName(tree), '__init__.py');
+    await addPythonReExport(tree, moduleInitPath, '.core.with_session_id_strands', 'with_session_id');
+    await addPythonReExport(tree, moduleInitPath, '.core.model_errors_strands', 'log_model_errors');
+    if (lang.deps.length > 0) {
+        (0, py_1.addDependenciesToPyProjectToml)(tree, getPythonAgentConnectionProjectDir(tree), lang.deps);
+    }
+}
+/**
+ * Emit the Python client templates for a connection protocol and agent
+ * framework into the agent-connection project's core directory.
+ *
+ * Layers emitted:
+ *  - Layer 0 `py-core-auth` (SigV4 httpx.Auth, session auth, endpoints) — always
+ *  - Layer 1 `py-core-shared` MCP transport — for mcp/gateway protocols
+ *  - Layer 1 the protocol's transport/client-config — always
+ *  - Layer 2 the framework's base helpers + protocol client — per framework
+ */
+async function addPythonCoreClient(tree, protocol, framework = 'strands') {
+    const fw = frameworkLanguage(framework, 'py', protocol);
+    emitPy(tree, 'py-core-auth');
+    if (MCP_TRANSPORT_PROTOCOLS.includes(protocol)) {
+        emitPy(tree, 'py-core-shared');
+    }
+    emitPy(tree, PY_PROTOCOL_TEMPLATES[protocol]);
+    // Framework Layer 2: base helpers + the thin protocol client.
+    await addPythonFrameworkBase(tree, framework);
+    emitPy(tree, fw.protocol);
 }
 /**
  * Patch a TypeScript agent.ts to create a connection client and register it