@aws/nx-plugin 1.0.0-rc.2 → 1.0.0-rc.21

package/src/utils/website-constructs/files/cdk/core/static-website.ts.template

@@ -1,5 +1,11 @@
-import { CfnOutput, CfnResource, Lazy, RemovalPolicy, Stack } from 'aws-cdk-lib';
-import { Distribution, ViewerProtocolPolicy } from 'aws-cdk-lib/aws-cloudfront';
+import { CfnOutput, CfnResource, Duration, Lazy, RemovalPolicy, Stack } from 'aws-cdk-lib';
+import {
+  Distribution,
+  HeadersFrameOption,
+  HeadersReferrerPolicy,
+  ResponseHeadersPolicy,
+  ViewerProtocolPolicy,
+} from 'aws-cdk-lib/aws-cloudfront';
 import { S3BucketOrigin } from 'aws-cdk-lib/aws-cloudfront-origins';
 import {
   BlockPublicAccess,
@@ -8,7 +14,11 @@ import {
   IBucket,
   ObjectOwnership,
 } from 'aws-cdk-lib/aws-s3';
-import { BucketDeployment, Source } from 'aws-cdk-lib/aws-s3-deployment';
+import {
+  BucketDeployment,
+  CacheControl,
+  Source,
+} from 'aws-cdk-lib/aws-s3-deployment';
 import { Construct } from 'constructs';
 import { RuntimeConfig } from './runtime-config.js';
 import { Key } from 'aws-cdk-lib/aws-kms';
@@ -17,6 +27,23 @@ import { suppressRules } from './checkov.js';
 
 const DEFAULT_RUNTIME_CONFIG_FILENAME = 'runtime-config.json';
 
+// Content-Security-Policy enforced on all responses. Restricts scripts and
+// framing to mitigate XSS and clickjacking, while permitting HTTPS/WSS calls
+// (connect-src) to AWS service endpoints such as API Gateway, Cognito and
+// Bedrock AgentCore which are only known at deploy time. Edit this to tighten
+// connect-src to your specific origins once they are known.
+const CONTENT_SECURITY_POLICY = [
+  "default-src 'self'",
+  "script-src 'self'",
+  "style-src 'self' 'unsafe-inline'",
+  "img-src 'self' data:",
+  "font-src 'self' data:",
+  "connect-src 'self' https: wss:",
+  "object-src 'none'",
+  "base-uri 'self'",
+  "frame-ancestors 'none'",
+].join('; ');
+
 export interface StaticWebsiteProps {
   readonly websiteName: string;
   readonly websiteFilePath: string;
@@ -108,6 +135,35 @@ export class StaticWebsite extends Construct {
       'Distribution log bucket does not need versioning enabled',
     );
 
+    // Security headers applied to all responses.
+    const responseHeadersPolicy = new ResponseHeadersPolicy(
+      this,
+      'ResponseHeadersPolicy',
+      {
+        securityHeadersBehavior: {
+          strictTransportSecurity: {
+            accessControlMaxAge: Duration.days(730),
+            includeSubdomains: true,
+            preload: true,
+            override: true,
+          },
+          contentTypeOptions: { override: true },
+          frameOptions: {
+            frameOption: HeadersFrameOption.DENY,
+            override: true,
+          },
+          referrerPolicy: {
+            referrerPolicy: HeadersReferrerPolicy.STRICT_ORIGIN_WHEN_CROSS_ORIGIN,
+            override: true,
+          },
+          contentSecurityPolicy: {
+            contentSecurityPolicy: CONTENT_SECURITY_POLICY,
+            override: true,
+          },
+        },
+      },
+    );
+
     const defaultRootObject = 'index.html';
     this.cloudFrontDistribution = new Distribution(
       this,
@@ -119,6 +175,7 @@ export class StaticWebsite extends Construct {
         defaultBehavior: {
           origin: S3BucketOrigin.withOriginAccessControl(this.websiteBucket),
           viewerProtocolPolicy: ViewerProtocolPolicy.REDIRECT_TO_HTTPS,
+          responseHeadersPolicy,
         },
         defaultRootObject,
         errorResponses: [
@@ -143,8 +200,17 @@ export class StaticWebsite extends Construct {
 
     // Deploy Website
     this.bucketDeployment = new BucketDeployment(this, 'WebsiteDeployment', {
+      sources: [Source.asset(websiteFilePath)],
+      destinationBucket: this.websiteBucket,
+      // Files in the distribution's edge caches will be invalidated after files are uploaded to the destination bucket.
+      distribution: this.cloudFrontDistribution,
+      memoryLimit: 1024,
+    });
+
+    // Deploy runtime-config.json separately so it is never cached - clients
+    // must always fetch the latest configuration.
+    new BucketDeployment(this, 'RuntimeConfigDeployment', {
       sources: [
-        Source.asset(websiteFilePath),
         Source.data(
           DEFAULT_RUNTIME_CONFIG_FILENAME,
           Lazy.string({
@@ -156,8 +222,9 @@ export class StaticWebsite extends Construct {
         ),
       ],
       destinationBucket: this.websiteBucket,
-      // Files in the distribution's edge caches will be invalidated after files are uploaded to the destination bucket.
       distribution: this.cloudFrontDistribution,
+      cacheControl: [CacheControl.noCache()],
+      prune: false,
       memoryLimit: 1024,
     });
 

package/src/utils/website-constructs/files/terraform/core/static-website/static-website.tf.template

@@ -23,6 +23,15 @@ variable "website_file_path" {
   type        = string
 }
 
+# Content-Security-Policy enforced on all responses. Restricts scripts and
+# framing to mitigate XSS and clickjacking, while permitting HTTPS/WSS calls
+# (connect-src) to AWS service endpoints such as API Gateway, Cognito and
+# Bedrock AgentCore which are only known at deploy time. Edit this to tighten
+# connect-src to your specific origins once they are known.
+locals {
+  content_security_policy = "default-src 'self'; script-src 'self'; style-src 'self' 'unsafe-inline'; img-src 'self' data:; font-src 'self' data:; connect-src 'self' https: wss:; object-src 'none'; base-uri 'self'; frame-ancestors 'none'"
+}
+
 
 # Data sources
 data "aws_caller_identity" "current" {}
@@ -383,13 +392,41 @@ resource "aws_cloudfront_origin_access_control" "website_oac" {
   signing_protocol                  = "sigv4"
 }
 
+# Security headers applied to all responses.
+resource "aws_cloudfront_response_headers_policy" "website" {
+  name = "${aws_s3_bucket.website.bucket}-security-headers"
+
+  security_headers_config {
+    strict_transport_security {
+      access_control_max_age_sec = 63072000
+      include_subdomains         = true
+      preload                    = true
+      override                   = true
+    }
+    content_type_options {
+      override = true
+    }
+    frame_options {
+      frame_option = "DENY"
+      override     = true
+    }
+    referrer_policy {
+      referrer_policy = "strict-origin-when-cross-origin"
+      override        = true
+    }
+    content_security_policy {
+      content_security_policy = local.content_security_policy
+      override                = true
+    }
+  }
+}
+
 # CloudFront Distribution
 resource "aws_cloudfront_distribution" "website" {
   #checkov:skip=CKV_AWS_174:Using CloudFront default certificate which does not support TLS v1.2
   #checkov:skip=CKV_AWS_310:Origin failover not required for single S3 origin static website
   #checkov:skip=CKV_AWS_374:Geo restrictions not required for global web application
   #checkov:skip=CKV2_AWS_42:Custom SSL certificate not required for development - using CloudFront default
-  #checkov:skip=CKV2_AWS_32:Response headers policy not required for basic static website
   #checkov:skip=CKV2_AWS_47:WAF includes AWSManagedRulesKnownBadInputsRuleSet which provides Log4j protection
   origin {
     domain_name              = aws_s3_bucket.website.bucket_regional_domain_name
@@ -419,11 +456,12 @@ resource "aws_cloudfront_distribution" "website" {
       }
     }
 
-    viewer_protocol_policy = "redirect-to-https"
-    min_ttl                = 0
-    default_ttl            = 3600
-    max_ttl                = 86400
-    compress               = true
+    viewer_protocol_policy     = "redirect-to-https"
+    response_headers_policy_id = aws_cloudfront_response_headers_policy.website.id
+    min_ttl                    = 0
+    default_ttl                = 3600
+    max_ttl                    = 86400
+    compress                   = true
   }
 
   # Custom error responses for SPA routing
@@ -527,7 +565,7 @@ resource "null_resource" "upload_website_files" {
 
   provisioner "local-exec" {
     command = <<-EOT
-      cd "${path.root}"
+      cd "$ROOT_PATH"
       uv run --with boto3 python3 -c "
 import os
 import sys
@@ -616,9 +654,14 @@ def sync_to_s3(local_path, bucket_name):
         sys.exit(1)
 
 # Execute sync
-sync_to_s3('${var.website_file_path}', '${aws_s3_bucket.website.bucket}')
+sync_to_s3(os.environ['WEBSITE_FILE_PATH'], os.environ['BUCKET_NAME'])
 "
     EOT
+    environment = {
+      ROOT_PATH         = path.root
+      WEBSITE_FILE_PATH = var.website_file_path
+      BUCKET_NAME       = aws_s3_bucket.website.bucket
+    }
   }
 
   depends_on = [aws_s3_bucket_policy.website_cloudfront_policy]
@@ -626,11 +669,12 @@ sync_to_s3('${var.website_file_path}', '${aws_s3_bucket.website.bucket}')
 
 # Upload runtime config file
 resource "aws_s3_object" "runtime_config" {
-  bucket       = aws_s3_bucket.website.id
-  key          = "runtime-config.json"
-  content      = module.runtime_config_reader.config_json
-  content_type = "application/json"
-  etag         = md5(module.runtime_config_reader.config_json)
+  bucket        = aws_s3_bucket.website.id
+  key           = "runtime-config.json"
+  content       = module.runtime_config_reader.config_json
+  content_type  = "application/json"
+  cache_control = "no-cache"
+  etag          = md5(module.runtime_config_reader.config_json)
 
   depends_on = [null_resource.upload_website_files]
 }
@@ -647,6 +691,7 @@ resource "null_resource" "cloudfront_invalidation" {
     command = <<-EOT
       uv run --with boto3 python3 -c "
 import boto3
+import os
 import sys
 from botocore.exceptions import ClientError, NoCredentialsError
 
@@ -668,7 +713,7 @@ def create_invalidation(distribution_id):
 
         invalidation_id = response['Invalidation']['Id']
         print(f'CloudFront cache invalidation created: {invalidation_id}')
-        print(f'Distribution: ${aws_cloudfront_distribution.website.id}')
+        print(f'Distribution: {distribution_id}')
         print(f'Status: {response[\"Invalidation\"][\"Status\"]}')
 
     except NoCredentialsError:
@@ -682,9 +727,12 @@ def create_invalidation(distribution_id):
         sys.exit(1)
 
 # Execute invalidation
-create_invalidation('${aws_cloudfront_distribution.website.id}')
+create_invalidation(os.environ['DISTRIBUTION_ID'])
 "
     EOT
+    environment = {
+      DISTRIBUTION_ID = aws_cloudfront_distribution.website.id
+    }
   }
 
   depends_on = [

package/src/utils/website-constructs/website-constructs.d.ts

@@ -2,8 +2,8 @@
  * Copyright Amazon.com, Inc. or its affiliates. All Rights Reserved.
  * SPDX-License-Identifier: Apache-2.0
  */
-import { Tree } from '@nx/devkit';
-import { Iac } from '../iac';
+import { type Tree } from '@nx/devkit';
+import type { Iac } from '../iac';
 export interface AddWebsiteInfraOptions {
     websiteProjectName: string;
     scopeAlias: string;

package/src/utils/website-constructs/website-constructs.js

@@ -6,9 +6,9 @@ exports.addWebsiteInfra = void 0;
  * SPDX-License-Identifier: Apache-2.0
  */
 const devkit_1 = require("@nx/devkit");
-const shared_constructs_constants_1 = require("../shared-constructs-constants");
 const ast_1 = require("../ast");
 const nx_1 = require("../nx");
+const shared_constructs_constants_1 = require("../shared-constructs-constants");
 /**
  * Add infrastructure for a static website
  */

package/src/utils/website-constructs/website-constructs.js.map

@@ -1 +1 @@
-{"version":3,"file":"website-constructs.js","sourceRoot":"","sources":["../../../../../../packages/nx-plugin/src/utils/website-constructs/website-constructs.ts"],"names":[],"mappings":";;;AAAA;;;GAGG;AACH,uCAOoB;AACpB,gFAIwC;AACxC,gCAAuC;AAEvC,8BAA0D;AAU1D;;GAEG;AACI,MAAM,eAAe,GAAG,KAAK,EAClC,IAAU,EACV,OAA8C,EAC9C,EAAE;IACF,IAAI,OAAO,CAAC,GAAG,KAAK,KAAK,EAAE,CAAC;QAC1B,MAAM,uBAAuB,CAAC,IAAI,EAAE,OAAO,CAAC,CAAC;IAC/C,CAAC;SAAM,IAAI,OAAO,CAAC,GAAG,KAAK,WAAW,EAAE,CAAC;QACvC,0BAA0B,CAAC,IAAI,EAAE,OAAO,CAAC,CAAC;IAC5C,CAAC;SAAM,CAAC;QACN,MAAM,IAAI,KAAK,CAAC,mBAAmB,OAAO,CAAC,GAAG,EAAE,CAAC,CAAC;IACpD,CAAC;IAED,IAAA,mBAAU,EACR,IAAI,EACJ,IAAA,0BAAiB,EACf,0CAAY,EACZ,OAAO,CAAC,GAAG,KAAK,KAAK,CAAC,CAAC,CAAC,mDAAqB,CAAC,CAAC,CAAC,kDAAoB,EACpE,cAAc,CACf,EACD,CAAC,MAA4B,EAAE,EAAE;QAC/B,IAAA,sCAAiC,EAC/B,MAAM,EACN,OAAO,EACP,GAAG,OAAO,CAAC,kBAAkB,QAAQ,CACtC,CAAC;QACF,OAAO,MAAM,CAAC;IAChB,CAAC,CACF,CAAC;AACJ,CAAC,CAAC;AA5BW,QAAA,eAAe,mBA4B1B;AAEF,MAAM,uBAAuB,GAAG,KAAK,EACnC,IAAU,EACV,OAA+B,EAC/B,EAAE;IACF,IAAA,sBAAa,EACX,IAAI,EACJ,IAAA,0BAAiB,EAAC,SAAS,EAAE,OAAO,EAAE,KAAK,EAAE,MAAM,CAAC,EACpD,IAAA,0BAAiB,EAAC,0CAAY,EAAE,mDAAqB,EAAE,KAAK,EAAE,MAAM,CAAC,EACrE,OAAO,EACP;QACE,iBAAiB,EAAE,0BAAiB,CAAC,YAAY;KAClD,CACF,CAAC;IAEF,IAAA,sBAAa,EACX,IAAI,EACJ,IAAA,0BAAiB,EAAC,SAAS,EAAE,OAAO,EAAE,KAAK,EAAE,KAAK,CAAC,EACnD,IAAA,0BAAiB,EAAC,0CAAY,EAAE,mDAAqB,EAAE,KAAK,EAAE,KAAK,CAAC,EACpE,OAAO,EACP;QACE,iBAAiB,EAAE,0BAAiB,CAAC,YAAY;KAClD,CACF,CAAC;IAEF,MAAM,IAAA,mBAAa,EACjB,IAAI,EACJ,IAAA,0BAAiB,EACf,0CAAY,EACZ,mDAAqB,EACrB,KAAK,EACL,KAAK,EACL,UAAU,CACX,EACD,4BAA4B,CAC7B,CAAC;IACF,MAAM,IAAA,mBAAa,EACjB,IAAI,EACJ,IAAA,0BAAiB,EACf,0CAAY,EACZ,mDAAqB,EACrB,KAAK,EACL,KAAK,EACL,iBAAiB,EACjB,UAAU,CACX,EACD,KAAK,OAAO,CAAC,oBAAoB,KAAK,CACvC,CAAC;IACF,MAAM,IAAA,mBAAa,EACjB,IAAI,EACJ,IAAA,0BAAiB,EACf,0CAAY,EACZ,mDAAqB,EACrB,KAAK,EACL,MAAM,EACN,UAAU,CACX,EACD,qBAAqB,CACtB,CAAC;AACJ,CAAC,CAAC;AAEF,MAAM,0BAA0B,GAAG,CACjC,IAAU,EACV,OAA+B,EAC/B,EAAE;IACF,IAAA,sBAAa,EACX,IAAI,EACJ,IAAA,0BAAiB,EAAC,SAAS,EAAE,OAAO,EAAE,WAAW,EAAE,MAAM,CAAC,EAC1D,IAAA,0BAAiB,EAAC,0CAAY,EAAE,kDAAoB,EAAE,KAAK,EAAE,MAAM,CAAC,EACpE,OAAO,EACP;QACE,iBAAiB,EAAE,0BAAiB,CAAC,YAAY;KAClD,CACF,CAAC;IAEF,IAAA,sBAAa,EACX,IAAI,EACJ,IAAA,0BAAiB,EAAC,SAAS,EAAE,OAAO,EAAE,WAAW,EAAE,KAAK,CAAC,EACzD,IAAA,0BAAiB,EAAC,0CAAY,EAAE,kDAAoB,EAAE,KAAK,EAAE,KAAK,CAAC,EACnE,OAAO,EACP;QACE,iBAAiB,EAAE,0BAAiB,CAAC,YAAY;KAClD,CACF,CAAC;AACJ,CAAC,CAAC"}
+{"version":3,"file":"website-constructs.js","sourceRoot":"","sources":["../../../../../../packages/nx-plugin/src/utils/website-constructs/website-constructs.ts"],"names":[],"mappings":";;;AAAA;;;GAGG;AACH,uCAOoB;AACpB,gCAAuC;AAEvC,8BAA0D;AAC1D,gFAIwC;AAUxC;;GAEG;AACI,MAAM,eAAe,GAAG,KAAK,EAClC,IAAU,EACV,OAA8C,EAC9C,EAAE;IACF,IAAI,OAAO,CAAC,GAAG,KAAK,KAAK,EAAE,CAAC;QAC1B,MAAM,uBAAuB,CAAC,IAAI,EAAE,OAAO,CAAC,CAAC;IAC/C,CAAC;SAAM,IAAI,OAAO,CAAC,GAAG,KAAK,WAAW,EAAE,CAAC;QACvC,0BAA0B,CAAC,IAAI,EAAE,OAAO,CAAC,CAAC;IAC5C,CAAC;SAAM,CAAC;QACN,MAAM,IAAI,KAAK,CAAC,mBAAmB,OAAO,CAAC,GAAG,EAAE,CAAC,CAAC;IACpD,CAAC;IAED,IAAA,mBAAU,EACR,IAAI,EACJ,IAAA,0BAAiB,EACf,0CAAY,EACZ,OAAO,CAAC,GAAG,KAAK,KAAK,CAAC,CAAC,CAAC,mDAAqB,CAAC,CAAC,CAAC,kDAAoB,EACpE,cAAc,CACf,EACD,CAAC,MAA4B,EAAE,EAAE;QAC/B,IAAA,sCAAiC,EAC/B,MAAM,EACN,OAAO,EACP,GAAG,OAAO,CAAC,kBAAkB,QAAQ,CACtC,CAAC;QACF,OAAO,MAAM,CAAC;IAChB,CAAC,CACF,CAAC;AACJ,CAAC,CAAC;AA5BW,QAAA,eAAe,mBA4B1B;AAEF,MAAM,uBAAuB,GAAG,KAAK,EACnC,IAAU,EACV,OAA+B,EAC/B,EAAE;IACF,IAAA,sBAAa,EACX,IAAI,EACJ,IAAA,0BAAiB,EAAC,SAAS,EAAE,OAAO,EAAE,KAAK,EAAE,MAAM,CAAC,EACpD,IAAA,0BAAiB,EAAC,0CAAY,EAAE,mDAAqB,EAAE,KAAK,EAAE,MAAM,CAAC,EACrE,OAAO,EACP;QACE,iBAAiB,EAAE,0BAAiB,CAAC,YAAY;KAClD,CACF,CAAC;IAEF,IAAA,sBAAa,EACX,IAAI,EACJ,IAAA,0BAAiB,EAAC,SAAS,EAAE,OAAO,EAAE,KAAK,EAAE,KAAK,CAAC,EACnD,IAAA,0BAAiB,EAAC,0CAAY,EAAE,mDAAqB,EAAE,KAAK,EAAE,KAAK,CAAC,EACpE,OAAO,EACP;QACE,iBAAiB,EAAE,0BAAiB,CAAC,YAAY;KAClD,CACF,CAAC;IAEF,MAAM,IAAA,mBAAa,EACjB,IAAI,EACJ,IAAA,0BAAiB,EACf,0CAAY,EACZ,mDAAqB,EACrB,KAAK,EACL,KAAK,EACL,UAAU,CACX,EACD,4BAA4B,CAC7B,CAAC;IACF,MAAM,IAAA,mBAAa,EACjB,IAAI,EACJ,IAAA,0BAAiB,EACf,0CAAY,EACZ,mDAAqB,EACrB,KAAK,EACL,KAAK,EACL,iBAAiB,EACjB,UAAU,CACX,EACD,KAAK,OAAO,CAAC,oBAAoB,KAAK,CACvC,CAAC;IACF,MAAM,IAAA,mBAAa,EACjB,IAAI,EACJ,IAAA,0BAAiB,EACf,0CAAY,EACZ,mDAAqB,EACrB,KAAK,EACL,MAAM,EACN,UAAU,CACX,EACD,qBAAqB,CACtB,CAAC;AACJ,CAAC,CAAC;AAEF,MAAM,0BAA0B,GAAG,CACjC,IAAU,EACV,OAA+B,EAC/B,EAAE;IACF,IAAA,sBAAa,EACX,IAAI,EACJ,IAAA,0BAAiB,EAAC,SAAS,EAAE,OAAO,EAAE,WAAW,EAAE,MAAM,CAAC,EAC1D,IAAA,0BAAiB,EAAC,0CAAY,EAAE,kDAAoB,EAAE,KAAK,EAAE,MAAM,CAAC,EACpE,OAAO,EACP;QACE,iBAAiB,EAAE,0BAAiB,CAAC,YAAY;KAClD,CACF,CAAC;IAEF,IAAA,sBAAa,EACX,IAAI,EACJ,IAAA,0BAAiB,EAAC,SAAS,EAAE,OAAO,EAAE,WAAW,EAAE,KAAK,CAAC,EACzD,IAAA,0BAAiB,EAAC,0CAAY,EAAE,kDAAoB,EAAE,KAAK,EAAE,KAAK,CAAC,EACnE,OAAO,EACP;QACE,iBAAiB,EAAE,0BAAiB,CAAC,YAAY;KAClD,CACF,CAAC;AACJ,CAAC,CAAC"}

package/src/py/agent/a2a-connection/files/agent-connection/app/__targetAgentSnakeCase___client.py.template

@@ -1,22 +0,0 @@
-import os
-
-from strands.agent.a2a_agent import A2AAgent
-
-from <%- agentConnectionModuleName %>.core.agentcore_a2a_client import AgentCoreA2aClient
-from <%- agentConnectionModuleName %>.core.runtime_config import (
-    get_connected_agent_runtime_arn,
-)
-
-
-class <%- targetAgentClassName %>Client:
-    """Client for the <%- targetAgentClassName %> A2A agent."""
-
-    @staticmethod
-    def create() -> A2AAgent:
-        if os.environ.get("SERVE_LOCAL") == "true":
-            return AgentCoreA2aClient.without_auth(
-                "http://localhost:<%- targetAgentPort %>/"
-            )
-        return AgentCoreA2aClient.with_iam_auth(
-            get_connected_agent_runtime_arn("<%- targetAgentClassName %>")
-        )

package/src/py/agent/mcp-connection/files/agent-connection/app/__mcpServerSnakeCase___client.py.template

@@ -1,22 +0,0 @@
-import os
-
-from strands.tools.mcp.mcp_client import MCPClient
-
-from <%- agentConnectionModuleName %>.core.agentcore_mcp_client import AgentCoreMCPClient
-from <%- agentConnectionModuleName %>.core.runtime_config import (
-    get_connected_agent_runtime_arn,
-)
-
-
-class <%- mcpServerClassName %>Client:
-    """Client for the <%- mcpServerClassName %> MCP server."""
-
-    @staticmethod
-    def create() -> MCPClient:
-        if os.environ.get("SERVE_LOCAL") == "true":
-            return AgentCoreMCPClient.without_auth(
-                "http://localhost:<%- mcpServerPort %>/mcp"
-            )
-        return AgentCoreMCPClient.with_iam_auth(
-            get_connected_agent_runtime_arn("<%- mcpServerClassName %>")
-        )

package/src/py/agent/scripts/http/chat.ts.template

@@ -1,38 +0,0 @@
-/**
- * Minimal chat CLI for <%- agentNameClassName %> (Python FastAPI / JSONL streaming).
- *
- * Uses the type-safe TypeScript client generated from the agent's OpenAPI
- * spec. Connects to the agent at `process.env.URL` (set by the Nx
- * `<%- agentTargetPrefix %>-chat` target).
- */
-import { randomUUID } from 'node:crypto';
-import { chatLoop, type ChatAdapter } from 'agent-chat-cli';
-import { <%- agentNameClassName %> } from './generated/client.gen.js';
-
-const SESSION_ID_HEADER = 'X-Amzn-Bedrock-AgentCore-Runtime-Session-Id';
-
-class <%- agentNameClassName %>Adapter implements ChatAdapter {
-  private client!: <%- agentNameClassName %>;
-  // AgentCore session IDs must be at least 33 characters.
-  private readonly sessionId = randomUUID().replaceAll('-', '').padEnd(33, '0');
-
-  async connect(url: string) {
-    this.client = new <%- agentNameClassName %>({
-      url,
-      fetch: (input, init) => {
-        const headers = new Headers(init?.headers);
-        headers.set(SESSION_ID_HEADER, this.sessionId);
-        return fetch(input, { ...init, headers });
-      },
-    });
-    return { agentName: '<%- agentNameClassName %>' };
-  }
-
-  async *sendMessage(text: string): AsyncIterable<string> {
-    for await (const chunk of this.client.invoke({ message: text })) {
-      if (typeof chunk.content === 'string') yield chunk.content;
-    }
-  }
-}
-
-await chatLoop(new <%- agentNameClassName %>Adapter(), process.env.URL!);

package/src/ts/agent/a2a-connection/files/agent-connection/app/__targetAgentKebabCase__-client.ts.template

@@ -1,19 +0,0 @@
-import { A2AAgent } from '@strands-agents/sdk/a2a';
-import { AgentCoreA2aClient } from '../core/agentcore-a2a-client.js';
-import { getConnectedAgentRuntimeArn } from '../core/runtime-config.js';
-
-/** Client for the <%- targetAgentClassName %> A2A agent. */
-export class <%- targetAgentClassName %>Client {
-  static async create(): Promise<A2AAgent> {
-    if (process.env.SERVE_LOCAL === 'true') {
-      return AgentCoreA2aClient.withoutAuth({
-        url: 'http://localhost:<%- targetAgentPort %>/',
-      });
-    }
-    return AgentCoreA2aClient.withIamAuth({
-      agentRuntimeArn: await getConnectedAgentRuntimeArn(
-        '<%- targetAgentClassName %>',
-      ),
-    });
-  }
-}

package/src/ts/agent/mcp-connection/files/agent-connection/app/__mcpServerKebabCase__-client.ts.template

@@ -1,19 +0,0 @@
-import { McpClient } from '@strands-agents/sdk';
-import { AgentCoreMcpClient } from '../core/agentcore-mcp-client.js';
-import { getConnectedAgentRuntimeArn } from '../core/runtime-config.js';
-
-/** Client for the <%- mcpServerClassName %> MCP server. */
-export class <%- mcpServerClassName %>Client {
-  static async create(): Promise<McpClient> {
-    if (process.env.SERVE_LOCAL === 'true') {
-      return AgentCoreMcpClient.withoutAuth({
-        url: 'http://localhost:<%- mcpServerPort %>/mcp',
-      });
-    }
-    return AgentCoreMcpClient.withIamAuth({
-      agentRuntimeArn: await getConnectedAgentRuntimeArn(
-        '<%- mcpServerClassName %>',
-      ),
-    });
-  }
-}

package/src/ts/agent/scripts/http/chat.ts.template

@@ -1,35 +0,0 @@
-/**
- * Minimal chat CLI for <%- agentNameClassName %> (HTTP / tRPC WebSocket).
- *
- * Connects to the agent at `process.env.URL` (set by the Nx `<%- agentTargetPrefix %>-chat` target).
- */
-import { chatLoop, type ChatAdapter } from 'agent-chat-cli';
-import { <%- agentNameClassName %>Client } from '<%- relativeAgentImport %>/client.js';
-
-class TrpcWebSocketAdapter implements ChatAdapter {
-  private client!: ReturnType<typeof <%- agentNameClassName %>Client.local>;
-
-  async connect(url: string) {
-    this.client = <%- agentNameClassName %>Client.local({ url });
-    return { agentName: '<%- agentNameClassName %>' };
-  }
-
-  async *sendMessage(text: string): AsyncIterable<string> {
-    const stream = new ReadableStream<string>({
-      start: (controller) => {
-        this.client.invoke.subscribe(
-          { message: text },
-          {
-            onData: (chunk: string) => controller.enqueue(chunk),
-            onComplete: () => controller.close(),
-            onError: (err: unknown) => controller.error(err),
-          },
-        );
-      },
-    });
-
-    yield* stream as unknown as AsyncIterable<string>;
-  }
-}
-
-await chatLoop(new TrpcWebSocketAdapter(), process.env.URL!);

package/src/ts/lib/eslint.d.ts

@@ -1,14 +0,0 @@
-/**
- * Copyright Amazon.com, Inc. or its affiliates. All Rights Reserved.
- * SPDX-License-Identifier: Apache-2.0
- */
-import { Tree } from '@nx/devkit';
-import { ConfigureProjectOptions } from './types';
-export declare const configureEslint: (tree: Tree, options: ConfigureProjectOptions) => Promise<void>;
-/**
- * Adds ignore patterns to the eslint config file
- * @param tree - The file system tree
- * @param eslintConfigPath - Path to the eslint config file
- * @param ignorePatterns - Array of ignore patterns to add
- */
-export declare const addIgnoresToEslintConfig: (tree: Tree, eslintConfigPath: string, ignorePatterns: string[]) => Promise<void>;

package/src/ts/lib/eslint.js

@@ -1,90 +0,0 @@
-"use strict";
-Object.defineProperty(exports, "__esModule", { value: true });
-exports.addIgnoresToEslintConfig = exports.configureEslint = void 0;
-/**
- * Copyright Amazon.com, Inc. or its affiliates. All Rights Reserved.
- * SPDX-License-Identifier: Apache-2.0
- */
-const devkit_1 = require("@nx/devkit");
-const versions_1 = require("../../utils/versions");
-const ast_1 = require("../../utils/ast");
-const nx_1 = require("../../utils/nx");
-const configureEslint = async (tree, options) => {
-    // Configure the lint task
-    const projectJson = (0, nx_1.readProjectConfigurationUnqualified)(tree, options.fullyQualifiedName);
-    (0, devkit_1.updateProjectConfiguration)(tree, options.fullyQualifiedName, {
-        ...projectJson,
-        targets: {
-            ...projectJson?.targets,
-            lint: {
-                executor: '@nx/eslint:lint',
-                cache: true,
-                inputs: ['eslint'],
-                configurations: {
-                    fix: {
-                        fix: true,
-                    },
-                    'skip-lint': {
-                        force: true,
-                    },
-                },
-            },
-        },
-    });
-    (0, devkit_1.addDependenciesToPackageJson)(tree, {}, (0, versions_1.withVersions)(['prettier', 'eslint-plugin-prettier', 'jsonc-eslint-parser']));
-    // Update or create eslint.config.mjs
-    const eslintConfigPath = 'eslint.config.mjs';
-    if (tree.exists(eslintConfigPath)) {
-        // Add import if it doesn't exist
-        await (0, ast_1.addSingleImport)(tree, eslintConfigPath, 'eslintPluginPrettierRecommended', 'eslint-plugin-prettier/recommended');
-        // Prepend eslintPluginPrettierRecommended to the exports array if not present
-        await (0, ast_1.applyGritQL)(tree, eslintConfigPath, 'or { `export default []` => `export default [eslintPluginPrettierRecommended]`, `export default [$items]` => `export default [eslintPluginPrettierRecommended, $items]` where { $items <: not contains `eslintPluginPrettierRecommended` } }');
-        // Add ignore patterns to eslint config
-        await (0, exports.addIgnoresToEslintConfig)(tree, eslintConfigPath, [
-            '**/vite.config.*.timestamp*',
-        ]);
-        const nxJson = (0, devkit_1.readNxJson)(tree);
-        (0, devkit_1.updateNxJson)(tree, {
-            ...nxJson,
-            namedInputs: {
-                ...nxJson.namedInputs,
-                eslint: [
-                    'default',
-                    '{workspaceRoot}/eslint.config.mjs',
-                    '{projectRoot}/eslint.config.mjs',
-                ],
-            },
-        });
-    }
-};
-exports.configureEslint = configureEslint;
-/**
- * Adds ignore patterns to the eslint config file
- * @param tree - The file system tree
- * @param eslintConfigPath - Path to the eslint config file
- * @param ignorePatterns - Array of ignore patterns to add
- */
-const addIgnoresToEslintConfig = async (tree, eslintConfigPath, ignorePatterns) => {
-    for (const pattern of ignorePatterns) {
-        const escaped = pattern.replace(/`/g, '\\`');
-        // Single or{} per pattern handles all cases:
-        // 1. No ignores object → add { ignores: ['pattern'] } to the exports array
-        // 2. Empty ignores: [] → rewrite to ignores: ['pattern']
-        // 3. Non-empty ignores: [items] → append 'pattern' to existing items
-        await (0, ast_1.applyGritQL)(tree, eslintConfigPath, `or {
-        \`export default [$items]\` where {
-          $items <: not some \`{ ignores: $_ }\`,
-          $items += \`{ ignores: ['${escaped}'] }\`
-        },
-        \`export default [$items]\` where {
-          $items <: contains \`ignores: []\` => \`ignores: ['${escaped}']\`
-        },
-        \`ignores: [$items]\` => \`ignores: [$items, '${escaped}']\` where {
-          $items <: within \`export default [$_]\`,
-          $items <: not some \`'${escaped}'\`
-        }
-      }`);
-    }
-};
-exports.addIgnoresToEslintConfig = addIgnoresToEslintConfig;
-//# sourceMappingURL=eslint.js.map

package/src/ts/lib/eslint.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"eslint.js","sourceRoot":"","sources":["../../../../../../packages/nx-plugin/src/ts/lib/eslint.ts"],"names":[],"mappings":";;;AAAA;;;GAGG;AACH,uCAMoB;AACpB,mDAAoD;AACpD,yCAA+D;AAE/D,uCAAqE;AAE9D,MAAM,eAAe,GAAG,KAAK,EAClC,IAAU,EACV,OAAgC,EAChC,EAAE;IACF,0BAA0B;IAC1B,MAAM,WAAW,GAAG,IAAA,wCAAmC,EACrD,IAAI,EACJ,OAAO,CAAC,kBAAkB,CAC3B,CAAC;IACF,IAAA,mCAA0B,EAAC,IAAI,EAAE,OAAO,CAAC,kBAAkB,EAAE;QAC3D,GAAG,WAAW;QACd,OAAO,EAAE;YACP,GAAG,WAAW,EAAE,OAAO;YACvB,IAAI,EAAE;gBACJ,QAAQ,EAAE,iBAAiB;gBAC3B,KAAK,EAAE,IAAI;gBACX,MAAM,EAAE,CAAC,QAAQ,CAAC;gBAClB,cAAc,EAAE;oBACd,GAAG,EAAE;wBACH,GAAG,EAAE,IAAI;qBACV;oBACD,WAAW,EAAE;wBACX,KAAK,EAAE,IAAI;qBACZ;iBACF;aACF;SACF;KACF,CAAC,CAAC;IAEH,IAAA,qCAA4B,EAC1B,IAAI,EACJ,EAAE,EACF,IAAA,uBAAY,EAAC,CAAC,UAAU,EAAE,wBAAwB,EAAE,qBAAqB,CAAC,CAAC,CAC5E,CAAC;IAEF,qCAAqC;IACrC,MAAM,gBAAgB,GAAG,mBAAmB,CAAC;IAE7C,IAAI,IAAI,CAAC,MAAM,CAAC,gBAAgB,CAAC,EAAE,CAAC;QAClC,iCAAiC;QACjC,MAAM,IAAA,qBAAe,EACnB,IAAI,EACJ,gBAAgB,EAChB,iCAAiC,EACjC,oCAAoC,CACrC,CAAC;QAEF,8EAA8E;QAC9E,MAAM,IAAA,iBAAW,EACf,IAAI,EACJ,gBAAgB,EAChB,8OAA8O,CAC/O,CAAC;QAEF,uCAAuC;QACvC,MAAM,IAAA,gCAAwB,EAAC,IAAI,EAAE,gBAAgB,EAAE;YACrD,6BAA6B;SAC9B,CAAC,CAAC;QAEH,MAAM,MAAM,GAAG,IAAA,mBAAU,EAAC,IAAI,CAAC,CAAC;QAChC,IAAA,qBAAY,EAAC,IAAI,EAAE;YACjB,GAAG,MAAM;YACT,WAAW,EAAE;gBACX,GAAG,MAAM,CAAC,WAAW;gBACrB,MAAM,EAAE;oBACN,SAAS;oBACT,mCAAmC;oBACnC,iCAAiC;iBAClC;aACF;SACF,CAAC,CAAC;IACL,CAAC;AACH,CAAC,CAAC;AAxEW,QAAA,eAAe,mBAwE1B;AAEF;;;;;GAKG;AACI,MAAM,wBAAwB,GAAG,KAAK,EAC3C,IAAU,EACV,gBAAwB,EACxB,cAAwB,EACT,EAAE;IACjB,KAAK,MAAM,OAAO,IAAI,cAAc,EAAE,CAAC;QACrC,MAAM,OAAO,GAAG,OAAO,CAAC,OAAO,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC;QAC7C,6CAA6C;QAC7C,2EAA2E;QAC3E,yDAAyD;QACzD,qEAAqE;QACrE,MAAM,IAAA,iBAAW,EACf,IAAI,EACJ,gBAAgB,EAChB;;;qCAG+B,OAAO;;;+DAGmB,OAAO;;wDAEd,OAAO;;kCAE7B,OAAO;;QAEjC,CACH,CAAC;IACJ,CAAC;AACH,CAAC,CAAC;AA7BW,QAAA,wBAAwB,4BA6BnC"}

package/src/ts/lib/grit/eslint-dependency-checks-warn.grit

@@ -1 +0,0 @@
-`'@nx/dependency-checks': ['error', $rest]` => `'@nx/dependency-checks': ['warn', $rest]`

package/src/ts/rdb/files/scripts/docker-pull.ts.template

@@ -1,15 +0,0 @@
-import { spawnSync } from 'child_process';
-
-const ENGINE = '<%= containers %>';
-const image = process.argv[2];
-
-const inspect = spawnSync(ENGINE, ['image', 'inspect', image], {
-  stdio: 'ignore',
-});
-
-if (inspect.status !== 0) {
-  const pull = spawnSync(ENGINE, ['pull', image], { stdio: 'inherit' });
-  if (pull.status !== 0) {
-    process.exit(pull.status ?? 1);
-  }
-}