@aws/nx-plugin 1.0.0-rc.22 → 1.0.0-rc.24

package/src/py/agent/__snapshots__/{generator.spec.ts.snap → generator.frameworks.spec.ts.snap}

@@ -65,7 +65,7 @@ export const createAgentCoreFetch = (): typeof fetch => {
 
 exports[`py#agent generator > chat scripts for a2a protocol > should match snapshot for chat scripts with cognito auth > chat.ts (a2a, cognito) 1`] = `
 "// Chat CLI for TestProjectAgent (A2A protocol). Connects to the local
-// \`serve-local\` server, or the deployed agent when \`RUNTIME_CONFIG_APP_ID\` is set.
+// \`dev\` server, or the deployed agent when \`RUNTIME_CONFIG_APP_ID\` is set.
 import {
   ClientFactory,
   ClientFactoryOptions,
@@ -160,7 +160,7 @@ export const createAgentCoreFetch = (region: string): typeof fetch => {
 
 exports[`py#agent generator > chat scripts for a2a protocol > should match snapshot for chat scripts with iam auth > chat.ts (a2a, iam) 1`] = `
 "// Chat CLI for TestProjectAgent (A2A protocol). Connects to the local
-// \`serve-local\` server, or the deployed agent when \`RUNTIME_CONFIG_APP_ID\` is set.
+// \`dev\` server, or the deployed agent when \`RUNTIME_CONFIG_APP_ID\` is set.
 import {
   ClientFactory,
   ClientFactoryOptions,
@@ -260,7 +260,7 @@ export const createAgentCoreFetch = (): typeof fetch => {
 
 exports[`py#agent generator > chat scripts for ag-ui protocol > should match snapshot for chat scripts with cognito auth > chat.ts (ag-ui, cognito) 1`] = `
 "// Chat CLI for TestProjectAgent (AG-UI protocol). Connects to the local
-// \`serve-local\` server, or the deployed agent when \`RUNTIME_CONFIG_APP_ID\` is set.
+// \`dev\` server, or the deployed agent when \`RUNTIME_CONFIG_APP_ID\` is set.
 import { AGUIChatAdapter, chatLoop } from 'agent-chat-cli';
 import { createAgentCoreFetch, resolveRemoteAgent } from './agentcore.js';
 
@@ -337,7 +337,7 @@ export const createAgentCoreFetch = (region: string): typeof fetch => {
 
 exports[`py#agent generator > chat scripts for ag-ui protocol > should match snapshot for chat scripts with iam auth > chat.ts (ag-ui, iam) 1`] = `
 "// Chat CLI for TestProjectAgent (AG-UI protocol). Connects to the local
-// \`serve-local\` server, or the deployed agent when \`RUNTIME_CONFIG_APP_ID\` is set.
+// \`dev\` server, or the deployed agent when \`RUNTIME_CONFIG_APP_ID\` is set.
 import { AGUIChatAdapter, chatLoop } from 'agent-chat-cli';
 import { createAgentCoreFetch, resolveRemoteAgent } from './agentcore.js';
 
@@ -419,7 +419,7 @@ export const createAgentCoreFetch = (): typeof fetch => {
 
 exports[`py#agent generator > chat scripts for http protocol > should match snapshot for chat scripts with cognito auth > chat.ts (http, cognito) 1`] = `
 "// Chat CLI for TestProjectAgent (Python FastAPI / JSONL streaming), using the
-// generated client. Connects to the local \`serve-local\` server, or the deployed
+// generated client. Connects to the local \`dev\` server, or the deployed
 // agent when \`RUNTIME_CONFIG_APP_ID\` is set.
 import { chatLoop, type ChatAdapter } from 'agent-chat-cli';
 import { TestProjectAgent } from './generated/client.gen.js';
@@ -524,7 +524,7 @@ export const createAgentCoreFetch = (region: string): typeof fetch => {
 
 exports[`py#agent generator > chat scripts for http protocol > should match snapshot for chat scripts with iam auth > chat.ts (http, iam) 1`] = `
 "// Chat CLI for TestProjectAgent (Python FastAPI / JSONL streaming), using the
-// generated client. Connects to the local \`serve-local\` server, or the deployed
+// generated client. Connects to the local \`dev\` server, or the deployed
 // agent when \`RUNTIME_CONFIG_APP_ID\` is set.
 import { chatLoop, type ChatAdapter } from 'agent-chat-cli';
 import { TestProjectAgent } from './generated/client.gen.js';
@@ -614,6 +614,7 @@ from ag_ui.core import EventType, RunAgentInput, RunErrorEvent
 from ag_ui.encoder import EventEncoder
 from ag_ui_langgraph import LangGraphAgent
 from fastapi import FastAPI, Request
+from fastapi.middleware.cors import CORSMiddleware
 from fastapi.responses import JSONResponse, StreamingResponse
 from proj_agent_connection import get_current_session_id, session_id_context
 from starlette.middleware.base import BaseHTTPMiddleware
@@ -643,6 +644,15 @@ class _SessionIdMiddleware(BaseHTTPMiddleware):
 
 
 app = FastAPI(title="SnapshotAgent")
+# Allow browser-based AG-UI clients (e.g. a connected React website) to call
+# this agent cross-origin, including the CORS preflight.
+app.add_middleware(
+    CORSMiddleware,
+    allow_origins=["*"],
+    allow_credentials=True,
+    allow_methods=["*"],
+    allow_headers=["*"],
+)
 app.add_middleware(_SessionIdMiddleware)
 
 
@@ -697,7 +707,7 @@ exports[`py#agent generator > langchain framework > should match snapshot for la
 name = "proj.test_project"
 version = "0.1.0"
 dependencies = [
-  "proj.agent_connection",
+  "proj-agent-connection",
   "aws-lambda-powertools==3.29.0",
   "aws-opentelemetry-distro==0.17.1",
   "bedrock-agentcore==1.14.1",
@@ -718,844 +728,7 @@ dev = [ "fastapi[standard]==0.137.1" ]
 [tool.uv]
 dev-dependencies = [ ]
 
-[tool.uv.sources."proj.agent_connection"]
-workspace = true
-"
-`;
-
-exports[`py#agent generator > should match snapshot for BedrockAgentCoreRuntime generated constructs files > agent-Dockerfile 1`] = `
-"FROM public.ecr.aws/docker/library/python:3.14-slim
-
-WORKDIR /app
-
-# Copy bundled package
-COPY . /app
-
-EXPOSE 8080
-
-ENV PYTHONPATH=/app
-ENV PATH="/app/bin:\${PATH}"
-
-# Auto-instrument with AWS Distro for OpenTelemetry
-# https://aws-otel.github.io/docs/getting-started/python-sdk/auto-instr
-CMD ["python", "bin/opentelemetry-instrument", "python", "-m", "proj_test_project.snapshot_bedrock_agent.main"]
-"
-`;
-
-exports[`py#agent generator > should match snapshot for BedrockAgentCoreRuntime generated constructs files > agent-construct.ts 1`] = `
-"import { Lazy, Names } from 'aws-cdk-lib';
-import { Platform } from 'aws-cdk-lib/aws-ecr-assets';
-import { Connections, IConnectable } from 'aws-cdk-lib/aws-ec2';
-import { Construct } from 'constructs';
-import * as path from 'path';
-import * as url from 'url';
-import {
-  AgentRuntimeArtifact,
-  ProtocolType,
-  Runtime,
-  RuntimeProps,
-} from 'aws-cdk-lib/aws-bedrockagentcore';
-import {
-  PolicyStatement,
-  IGrantable,
-  IPrincipal,
-  Grant,
-} from 'aws-cdk-lib/aws-iam';
-import { RuntimeConfig } from '../../../core/runtime-config.js';
-import { findWorkspaceRoot } from '../../../core/workspace.js';
-
-export type SnapshotBedrockAgentProps = Omit<
-  RuntimeProps,
-  | 'runtimeName'
-  | 'protocolConfiguration'
-  | 'agentRuntimeArtifact'
-  | 'authorizerConfiguration'
->;
-
-export class SnapshotBedrockAgent
-  extends Construct
-  implements IGrantable, IConnectable
-{
-  public readonly dockerImage: AgentRuntimeArtifact;
-  public readonly agentCoreRuntime: Runtime;
-
-  constructor(scope: Construct, id: string, props?: SnapshotBedrockAgentProps) {
-    super(scope, id);
-
-    const rc = RuntimeConfig.ensure(this);
-
-    // Resolve the bundle output directory containing the Dockerfile and built artifacts
-    const bundleDir = path.join(
-      findWorkspaceRoot(url.fileURLToPath(new URL(import.meta.url))),
-      'dist/apps/test-project/docker/snapshot-bedrock-agent',
-    );
-
-    this.dockerImage = AgentRuntimeArtifact.fromAsset(bundleDir, {
-      platform: Platform.LINUX_ARM64,
-    });
-
-    this.agentCoreRuntime = new Runtime(this, 'SnapshotBedrockAgent', {
-      runtimeName: Lazy.string({
-        produce: () =>
-          Names.uniqueResourceName(this.agentCoreRuntime, { maxLength: 40 }),
-      }),
-      protocolConfiguration: ProtocolType.HTTP,
-      agentRuntimeArtifact: this.dockerImage,
-      ...props,
-      environmentVariables: {
-        RUNTIME_CONFIG_APP_ID: rc.appConfigApplicationId,
-        ...props?.environmentVariables,
-      },
-    });
-
-    // Grant access for the agent to invoke bedrock models
-    this.agentCoreRuntime.addToRolePolicy(
-      new PolicyStatement({
-        actions: [
-          'bedrock:InvokeModel',
-          'bedrock:InvokeModelWithResponseStream',
-        ],
-        resources: [
-          'arn:aws:bedrock:*:*:foundation-model/*',
-          'arn:aws:bedrock:*:*:inference-profile/*',
-        ],
-      }),
-    );
-
-    rc.grantReadAppConfig(this.agentCoreRuntime);
-
-    rc.set('agentcore', 'agentRuntimes', {
-      ...rc.get('agentcore').agentRuntimes,
-      SnapshotBedrockAgent: this.agentCoreRuntime.agentRuntimeArn,
-    });
-  }
-
-  /**
-   * The principal to grant permissions to.
-   */
-  public get grantPrincipal(): IPrincipal {
-    return this.agentCoreRuntime.grantPrincipal;
-  }
-
-  /**
-   * Network connections for this agent runtime.
-   */
-  public get connections(): Connections {
-    return this.agentCoreRuntime.connections;
-  }
-
-  /**
-   * Grants IAM permissions to invoke this agent runtime.
-   *
-   * @param grantee - The IAM principal to grant permissions to
-   */
-  public grantInvokeAccess(grantee: IGrantable) {
-    this.agentCoreRuntime.grantInvoke(grantee);
-
-    Grant.addToPrincipal({
-      grantee,
-      actions: ['bedrock-agentcore:InvokeAgentRuntimeWithWebSocketStream'],
-      resourceArns: [
-        this.agentCoreRuntime.agentRuntimeArn,
-        \`\${this.agentCoreRuntime.agentRuntimeArn}/*\`,
-      ],
-    });
-  }
-}
-"
-`;
-
-exports[`py#agent generator > should match snapshot for BedrockAgentCoreRuntime generated constructs files > agents-index.ts 1`] = `
-"export * from './snapshot-bedrock-agent/snapshot-bedrock-agent.js';
-"
-`;
-
-exports[`py#agent generator > should match snapshot for BedrockAgentCoreRuntime generated constructs files > app-index.ts 1`] = `
-"export * from './agents/index.js';
-"
-`;
-
-exports[`py#agent generator > should match snapshot for BedrockAgentCoreRuntime generated constructs files > core-index.ts 1`] = `
-"export * from './app.js';
-export * from './checkov.js';
-export * from './runtime-config.js';
-export * from './workspace.js';
-"
-`;
-
-exports[`py#agent generator > should match snapshot for Terraform generated files > terraform-agent.tf 1`] = `
-"variable "env" {
-  description = "Environment variables to pass to the agent core runtime"
-  type        = map(string)
-  default     = {}
-}
-
-variable "additional_iam_policy_statements" {
-  description = "Additional IAM policy statements to attach to the agent core runtime role"
-  type = list(object({
-    Effect   = string
-    Action   = list(string)
-    Resource = list(string)
-  }))
-  default = []
-}
-
-variable "tags" {
-  description = "Tags to apply to resources"
-  type        = map(string)
-  default     = {}
-}
-
-variable "appconfig_application_id" {
-  description = "ID of the shared runtime-config AppConfig application (from \`core/runtime-config/appconfig.application_id\`). The agent reads its runtime configuration from this application."
-  type        = string
-}
-
-variable "appconfig_application_arn" {
-  description = "ARN of the shared runtime-config AppConfig application (from \`core/runtime-config/appconfig.application_arn\`). Used to scope the IAM read permission granted to the agent runtime."
-  type        = string
-}
-
-module "agent_core_runtime" {
-  source = "../../../core/agent-core"
-  agent_runtime_name = "TerraformSnapshotAgent"
-  docker_image_tag = "proj-terraform-snapshot-agent:latest"
-  server_protocol = "HTTP"
-
-  env = merge({
-    RUNTIME_CONFIG_APP_ID = var.appconfig_application_id
-  }, var.env)
-  additional_iam_policy_statements = concat([
-    {
-      Effect   = "Allow"
-      Action   = [
-        "appconfig:StartConfigurationSession",
-        "appconfig:GetLatestConfiguration"
-      ]
-      Resource = ["\${var.appconfig_application_arn}/*"]
-    },
-    # Grant access for the agent to invoke bedrock models
-    {
-      Effect = "Allow"
-      Action = [
-        "bedrock:InvokeModel",
-        "bedrock:InvokeModelWithResponseStream"
-      ]
-      Resource = [
-        "arn:aws:bedrock:*:*:foundation-model/*",
-        "arn:aws:bedrock:*:*:inference-profile/*"
-      ]
-    }
-  ], var.additional_iam_policy_statements)
-  tags = var.tags
-}
-
-# Add agent runtime ARN to runtime config
-module "add_agent_runtime_to_runtime_config" {
-  source = "../../../core/runtime-config/entry"
-
-  namespace = "agentcore"
-  key       = "agentRuntimes"
-  value     = { "TerraformSnapshotAgent" = module.agent_core_runtime.agent_core_runtime_arn }
-
-  depends_on = [module.agent_core_runtime]
-}
-
-output "agent_core_runtime_role_arn" {
-  description = "ARN of the agent core runtime role"
-  value       = module.agent_core_runtime.agent_core_runtime_role_arn
-}
-
-output "agent_core_runtime_arn" {
-  description = "ARN of the Bedrock Agent Core runtime"
-  value       = module.agent_core_runtime.agent_core_runtime_arn
-}
-
-output "appconfig_application_id" {
-  description = "AppConfig Application ID for runtime config (passthrough of the shared \`appconfig_application_id\` input)."
-  value       = var.appconfig_application_id
-}
-"
-`;
-
-exports[`py#agent generator > should match snapshot for Terraform generated files > terraform-agent-core-runtime.tf 1`] = `
-"terraform {
-  required_version = ">= 1.0"
-
-  required_providers {
-    aws = {
-      source  = "hashicorp/aws"
-      version = ">= 6.23"
-    }
-    null = {
-      source  = "hashicorp/null"
-      version = ">= 3.0"
-    }
-    random = {
-      source  = "hashicorp/random"
-      version = ">= 3.0"
-    }
-  }
-}
-
-# Variables
-variable "agent_runtime_name" {
-  description = "Name of the agent runtime"
-  type        = string
-  validation {
-    condition     = can(regex("^[a-zA-Z][a-zA-Z0-9_]{0,42}$", var.agent_runtime_name))
-    error_message = "Value must start with a letter and contain only letters, numbers, and underscores (1-43 characters)."
-  }
-}
-
-variable "server_protocol" {
-  description = "Server protocol for the agent runtime (HTTP, MCP, or A2A)"
-  type        = string
-  default     = "HTTP"
-  validation {
-    condition     = contains(["MCP", "HTTP", "A2A"], var.server_protocol)
-    error_message = "Protocol type must be either 'mcp', 'http', or 'a2a'."
-  }
-}
-
-variable "authorizer_configuration" {
-  description = "Authorization configuration for authenticating incoming requests"
-  type = object({
-    custom_jwt_authorizer = optional(object({
-      discovery_url    = string
-      allowed_audience = optional(list(string))
-      allowed_clients  = optional(list(string))
-    }))
-  })
-  default = null
-}
-
-variable "docker_image_tag" {
-  description = "Name of the docker image tag to use as the agent core runtime"
-  type        = string
-}
-
-variable "env" {
-  description = "Environment variables to pass to the agent core runtime"
-  type        = map(string)
-  default     = {}
-}
-
-variable "additional_iam_policy_statements" {
-  description = "Additional IAM policy statements to attach to the agent core runtime role"
-  type = list(object({
-    Effect   = string
-    Action   = list(string)
-    Resource = list(string)
-  }))
-  default = []
-}
-
-variable "tags" {
-  description = "Tags to apply to resources"
-  type        = map(string)
-  default     = {}
-}
-
-# Data sources
-data "aws_caller_identity" "current" {}
-data "aws_region" "current" {}
-
-locals {
-  aws_account_id = data.aws_caller_identity.current.account_id
-  aws_region     = data.aws_region.current.id
-}
-
-# Random ID for bucket suffix to ensure uniqueness
-resource "random_id" "unique_suffix" {
-  byte_length = 4
-}
-
-# ECR Repository
-resource "aws_ecr_repository" "agent_core_repository" {
-  #checkov:skip=CKV_AWS_136:AES256 encryption is sufficient for ECR repositories
-  name = "\${lower(var.agent_runtime_name)}_repository_\${random_id.unique_suffix.hex}"
-
-  image_tag_mutability = "IMMUTABLE"
-  force_delete         = true
-
-  image_scanning_configuration {
-    scan_on_push = true
-  }
-
-  tags = var.tags
-}
-
-# ECR Repository Policy
-resource "aws_ecr_repository_policy" "agent_core_ecr_policy" {
-  repository = aws_ecr_repository.agent_core_repository.name
-
-  policy = jsonencode({
-    Version = "2012-10-17"
-    Statement = [
-      {
-        Sid    = "AllowPushPull"
-        Effect = "Allow"
-        Principal = {
-          AWS = "arn:aws:iam::\${local.aws_account_id}:root"
-        }
-        Action = [
-          "ecr:GetDownloadUrlForLayer",
-          "ecr:BatchGetImage",
-          "ecr:BatchCheckLayerAvailability",
-          "ecr:PutImage",
-          "ecr:InitiateLayerUpload",
-          "ecr:UploadLayerPart",
-          "ecr:CompleteLayerUpload"
-        ]
-      }
-    ]
-  })
-}
-
-# IAM Role for Agent Core Runtime
-resource "aws_iam_role" "agent_core_runtime_role" {
-  name = "\${var.agent_runtime_name}-AgentCoreRuntimeRole-\${random_id.unique_suffix.hex}"
-
-  assume_role_policy = jsonencode({
-    Version = "2012-10-17"
-    Statement = [
-      {
-        Sid    = "AgentCoreAssumeRolePolicy"
-        Effect = "Allow"
-        Principal = {
-          Service = "bedrock-agentcore.amazonaws.com"
-        }
-        Action = "sts:AssumeRole"
-        Condition = {
-          StringEquals = {
-            "aws:SourceAccount" = local.aws_account_id
-          }
-          ArnLike = {
-            "aws:SourceArn" = "arn:aws:bedrock-agentcore:\${local.aws_region}:\${local.aws_account_id}:*"
-          }
-        }
-      }
-    ]
-  })
-
-  tags = var.tags
-}
-
-# IAM Policy for Agent Core Runtime
-resource "aws_iam_policy" "agent_core_runtime_policy" {
-  name        = "\${var.agent_runtime_name}-QueryAgentPolicy-\${random_id.unique_suffix.hex}"
-  description = "Restricted policy for Agent"
-
-  policy = jsonencode({
-    Version = "2012-10-17"
-    Statement = concat([
-      {
-        Sid    = "ECRImageAccess"
-        Effect = "Allow"
-        Action = [
-          "ecr:BatchGetImage",
-          "ecr:GetDownloadUrlForLayer"
-        ]
-        Resource = [
-          aws_ecr_repository.agent_core_repository.arn
-        ]
-      },
-      {
-        Sid    = "ECRTokenAccess"
-        Effect = "Allow"
-        Action = [
-          "ecr:GetAuthorizationToken"
-        ]
-        Resource = [
-          "*"
-        ]
-      },
-      {
-        "Effect" : "Allow",
-        "Action" : [
-          "logs:DescribeLogStreams",
-          "logs:CreateLogGroup"
-        ],
-        "Resource" : [
-          "arn:aws:logs:\${local.aws_region}:\${local.aws_account_id}:log-group:/aws/bedrock-agentcore/runtimes/*"
-        ]
-      },
-      {
-        "Effect" : "Allow",
-        "Action" : [
-          "logs:DescribeLogGroups"
-        ],
-        "Resource" : [
-          "arn:aws:logs:\${local.aws_region}:\${local.aws_account_id}:log-group:*"
-        ]
-      },
-      {
-        "Effect" : "Allow",
-        "Action" : [
-          "logs:CreateLogStream",
-          "logs:PutLogEvents"
-        ],
-        "Resource" : [
-          "arn:aws:logs:\${local.aws_region}:\${local.aws_account_id}:log-group:/aws/bedrock-agentcore/runtimes/*:log-stream:*"
-        ]
-      },
-      {
-        "Effect" : "Allow",
-        "Action" : [
-          "xray:PutTraceSegments",
-          "xray:PutTelemetryRecords",
-          "xray:GetSamplingRules",
-          "xray:GetSamplingTargets"
-        ],
-        "Resource" : ["*"]
-      },
-      {
-        "Effect" : "Allow",
-        "Resource" : "*",
-        "Action" : "cloudwatch:PutMetricData",
-        "Condition" : {
-          "StringEquals" : {
-            "cloudwatch:namespace" : "bedrock-agentcore"
-          }
-        }
-      },
-      {
-        "Sid" : "GetAgentAccessToken",
-        "Effect" : "Allow",
-        "Action" : [
-          "bedrock-agentcore:GetWorkloadAccessToken",
-          "bedrock-agentcore:GetWorkloadAccessTokenForJWT",
-          "bedrock-agentcore:GetWorkloadAccessTokenForUserId"
-        ],
-        "Resource" : [
-          "arn:aws:bedrock-agentcore:\${local.aws_region}:\${local.aws_account_id}:workload-identity-directory/default",
-          "arn:aws:bedrock-agentcore:\${local.aws_region}:\${local.aws_account_id}:workload-identity-directory/default/workload-identity/*"
-        ]
-      }
-    ], var.additional_iam_policy_statements)
-  })
-
-  tags = var.tags
-}
-
-# Attach the restricted policy to the role
-resource "aws_iam_role_policy_attachment" "agent_core_policy" {
-  role       = aws_iam_role.agent_core_runtime_role.name
-  policy_arn = aws_iam_policy.agent_core_runtime_policy.arn
-}
-
-# Data source to get container image digest
-data "external" "docker_digest" {
-  program = ["sh", "-c", "echo '{\\"digest\\":\\"'$(docker inspect \${var.docker_image_tag} --format '{{.Id}}')'\\"}' "]
-}
-
-locals {
-  # Content-based, immutable image tag derived from the local image digest
-  image_tag = replace(data.external.docker_digest.result.digest, "sha256:", "")
-}
-
-# Null resource for container image publish
-resource "null_resource" "docker_publish" {
-  triggers = {
-    docker_digest    = data.external.docker_digest.result.digest
-    repository_url   = aws_ecr_repository.agent_core_repository.repository_url
-    docker_image_tag = var.docker_image_tag
-    image_tag        = local.image_tag
-  }
-
-  provisioner "local-exec" {
-    command = <<-EOT
-      # Get ECR login token
-      aws ecr get-login-password --region "$AWS_REGION" | docker login --username AWS --password-stdin "$REPOSITORY_URL"
-
-      # Tag the image with the immutable content-based tag
-      docker tag "$DOCKER_IMAGE_TAG" "$REPOSITORY_URL:$IMAGE_TAG"
-
-      # Push the image
-      docker push "$REPOSITORY_URL:$IMAGE_TAG"
-    EOT
-    environment = {
-      AWS_REGION       = local.aws_region
-      REPOSITORY_URL   = self.triggers.repository_url
-      DOCKER_IMAGE_TAG = self.triggers.docker_image_tag
-      IMAGE_TAG        = self.triggers.image_tag
-    }
-  }
-
-  depends_on = [aws_ecr_repository_policy.agent_core_ecr_policy]
-}
-
-# Bedrock AgentCore Agent Runtime
-resource "aws_bedrockagentcore_agent_runtime" "agent_runtime" {
-  agent_runtime_name = "\${var.agent_runtime_name}_\${random_id.unique_suffix.hex}"
-  description        = "Agent Runtime for \${var.agent_runtime_name}"
-  role_arn           = aws_iam_role.agent_core_runtime_role.arn
-
-  agent_runtime_artifact {
-    container_configuration {
-      container_uri = "\${aws_ecr_repository.agent_core_repository.repository_url}:\${local.image_tag}"
-    }
-  }
-
-  environment_variables = length(var.env) > 0 ? var.env : null
-
-  dynamic "authorizer_configuration" {
-    for_each = var.authorizer_configuration != null && try(var.authorizer_configuration.custom_jwt_authorizer, null) != null ? [var.authorizer_configuration.custom_jwt_authorizer] : []
-    content {
-      custom_jwt_authorizer {
-        discovery_url    = authorizer_configuration.value.discovery_url
-        allowed_audience = authorizer_configuration.value.allowed_audience
-        allowed_clients  = authorizer_configuration.value.allowed_clients
-      }
-    }
-  }
-
-  network_configuration {
-    network_mode = "PUBLIC"
-  }
-
-  protocol_configuration {
-    server_protocol = var.server_protocol
-  }
-
-  tags = var.tags
-
-  depends_on = [
-    null_resource.docker_publish,
-    aws_iam_role_policy_attachment.agent_core_policy
-  ]
-}
-
-# MCP consumers (e.g. gateway targets, which fetch tools at creation) can race
-# the runtime's first cold start, so probe it until it serves MCP. The ARN
-# output is routed through this resource so consumers wait for readiness.
-resource "null_resource" "runtime_ready" {
-  count = var.server_protocol == "MCP" ? 1 : 0
-
-  triggers = {
-    runtime_arn = aws_bedrockagentcore_agent_runtime.agent_runtime.agent_runtime_arn
-  }
-
-  provisioner "local-exec" {
-    command = <<-EOT
-      uv run --with boto3 python -c "
-import boto3
-import json
-import os
-import time
-import uuid
-
-runtime_arn = os.environ['RUNTIME_ARN']
-client = boto3.client('bedrock-agentcore')
-initialize_request = json.dumps({
-    'jsonrpc': '2.0',
-    'id': 1,
-    'method': 'initialize',
-    'params': {
-        'protocolVersion': '2025-03-26',
-        'capabilities': {},
-        'clientInfo': {'name': 'readiness-probe', 'version': '1.0'},
-    },
-})
-
-deadline = time.time() + 3 * 60
-while True:
-    try:
-        client.invoke_agent_runtime(
-            agentRuntimeArn=runtime_arn,
-            runtimeSessionId=f'readiness-probe-{uuid.uuid4()}',
-            contentType='application/json',
-            accept='application/json, text/event-stream',
-            payload=initialize_request,
-        )
-        break
-    except Exception:
-        if time.time() >= deadline:
-            raise
-        time.sleep(5)
-
-print(f'Runtime {runtime_arn} is serving MCP')
-"
-    EOT
-    environment = {
-      RUNTIME_ARN = self.triggers.runtime_arn
-    }
-  }
-}
-
-# Outputs
-output "agent_core_runtime_role_arn" {
-  description = "ARN of the Agent Core Runtime IAM role"
-  value       = aws_iam_role.agent_core_runtime_role.arn
-}
-
-output "agent_core_runtime_role_name" {
-  description = "Name of the Agent Core Runtime IAM role"
-  value       = aws_iam_role.agent_core_runtime_role.name
-}
-
-output "agent_runtime_name" {
-  description = "Name of the deployed agent runtime"
-  value       = aws_bedrockagentcore_agent_runtime.agent_runtime.agent_runtime_name
-}
-
-output "agent_core_runtime_arn" {
-  description = "ARN of the Bedrock Agent Core runtime. For MCP runtimes the value flows through the readiness probe, so consumers wait until the runtime serves MCP."
-  value       = var.server_protocol == "MCP" ? null_resource.runtime_ready[0].triggers.runtime_arn : aws_bedrockagentcore_agent_runtime.agent_runtime.agent_runtime_arn
-}
-
-output "agent_runtime_id" {
-  description = "ID of the Bedrock Agent Core runtime"
-  value       = aws_bedrockagentcore_agent_runtime.agent_runtime.agent_runtime_id
-}
-
-output "agent_runtime_version" {
-  description = "Version of the Bedrock Agent Core runtime"
-  value       = aws_bedrockagentcore_agent_runtime.agent_runtime.agent_runtime_version
-}
-"
-`;
-
-exports[`py#agent generator > should match snapshot for generated files > agent-__init__.py 1`] = `""`;
-
-exports[`py#agent generator > should match snapshot for generated files > agent-agent.py 1`] = `
-"from contextlib import contextmanager
-
-from strands import Agent, tool
-from strands_tools import current_time
-from proj_agent_connection import log_model_errors
-
-
-@tool
-def subtract(a: int, b: int) -> int:
-    return a - b
-
-
-@contextmanager
-def get_agent():
-    yield Agent(
-        name="SnapshotAgent",
-        description="SnapshotAgent Strands Agent",
-        system_prompt="""
-You are a mathematical wizard.
-Use your tools for mathematical tasks.
-Refer to tools as your 'spellbook'.
-""",
-        tools=[subtract, current_time],
-        hooks=[log_model_errors],
-    )
-"
-`;
-
-exports[`py#agent generator > should match snapshot for generated files > agent-main.py 1`] = `
-"import uuid
-
-import uvicorn
-from bedrock_agentcore.runtime.models import PingStatus
-from fastapi import Request
-from pydantic import BaseModel, Field
-from starlette.middleware.base import BaseHTTPMiddleware
-from proj_agent_connection import session_id_context, with_session_id
-
-from .agent import get_agent
-from .init import JsonStreamingResponse, app
-
-SESSION_ID_HEADER = "x-amzn-bedrock-agentcore-runtime-session-id"
-
-_agent_ctx = with_session_id(
-    get_agent,
-    name="SnapshotAgent",
-    description="A Strands Agent exposed via HTTP streaming.",
-)
-_agent = _agent_ctx.__enter__()
-
-
-class InvokeInput(BaseModel):
-    message: str = Field(max_length=100000)
-
-
-class StreamChunk(BaseModel):
-    content: str
-
-
-async def handle_invoke(input: InvokeInput):
-    """Streaming handler for agent invocation"""
-    stream = _agent.stream_async(input.message)
-    async for event in stream:
-        text = (
-            event.get("event", {})
-            .get("contentBlockDelta", {})
-            .get("delta", {})
-            .get("text")
-        )
-        if text is not None:
-            yield StreamChunk(content=text)
-        elif event.get("event", {}).get("messageStop") is not None:
-            yield StreamChunk(content="\\n")
-
-
-@app.post(
-    "/invocations",
-    response_class=JsonStreamingResponse,
-    responses={
-        200: JsonStreamingResponse.openapi_response(
-            StreamChunk, "Stream of agent response chunks"
-        )
-    },
-)
-async def invoke(input: InvokeInput) -> JsonStreamingResponse:
-    """Entry point for agent invocation"""
-    return JsonStreamingResponse(handle_invoke(input))
-
-
-class _SessionIdMiddleware(BaseHTTPMiddleware):
-    """Bind the inbound session (or a fresh UUID) to async context."""
-
-    async def dispatch(self, request: Request, call_next):
-        session_id = request.headers.get(SESSION_ID_HEADER) or str(uuid.uuid4())
-        with session_id_context(session_id):
-            return await call_next(request)
-
-
-app.add_middleware(_SessionIdMiddleware)
-
-
-@app.get("/ping")
-def ping() -> str:
-    # TODO: if running an async task, return PingStatus.HEALTHY_BUSY
-    return PingStatus.HEALTHY
-
-
-if __name__ == "__main__":
-    uvicorn.run("proj_test_project.snapshot_agent.main:app", port=8080)
-"
-`;
-
-exports[`py#agent generator > should match snapshot for generated files > updated-pyproject.toml 1`] = `
-"[project]
-name = "proj.test_project"
-version = "0.1.0"
-dependencies = [
-  "proj.agent_connection",
-  "aws-lambda-powertools==3.29.0",
-  "aws-opentelemetry-distro==0.17.1",
-  "bedrock-agentcore==1.14.1",
-  "boto3==1.43.29",
-  "fastapi==0.137.1",
-  "mcp==1.27.2",
-  "strands-agents==1.43.0",
-  "strands-agents-tools==0.8.0",
-  "uvicorn==0.49.0"
-]
-
-[dependency-groups]
-dev = [ "fastapi[standard]==0.137.1" ]
-
-[tool.uv]
-dev-dependencies = [ ]
-
-[tool.uv.sources."proj.agent_connection"]
+[tool.uv.sources.proj-agent-connection]
 workspace = true
 "
 `;