@aws/nx-plugin 1.0.0-rc.3 → 1.0.0-rc.30

package/src/utils/identity-constructs/files/terraform/core/user-identity/add-callback-url/add-callback-url.tf.template

@@ -2,7 +2,7 @@ terraform {
   required_providers {
     aws = {
       source  = "hashicorp/aws"
-      version = "~> 6.0"
+      version = "<%- awsProviderVersion %>"
     }
   }
 }
@@ -59,24 +59,38 @@ resource "null_resource" "add_callback_url" {
 
   provisioner "local-exec" {
     command = <<-EOT
-      uv run --with boto3 python -c "
+      uv run --with boto3<%= boto3Version %> python -c "
 import boto3
+import os
 import sys
+import time
 
 # Configuration
-user_pool_id = '${local.user_pool_id}'
-client_id = '${local.user_pool_client_id}'
-new_callback_url = '${var.callback_url}'
+user_pool_id = os.environ['USER_POOL_ID']
+client_id = os.environ['CLIENT_ID']
+new_callback_url = os.environ['NEW_CALLBACK_URL']
 
 # Initialize Cognito client
 cognito = boto3.client('cognito-idp')
 
+# A freshly created user pool / client can take several minutes to become
+# visible to describe_user_pool_client, so retry on ResourceNotFoundException.
+def describe_with_retry():
+    deadline = time.time() + 5 * 60
+    while True:
+        try:
+            return cognito.describe_user_pool_client(
+                UserPoolId=user_pool_id,
+                ClientId=client_id,
+            )
+        except cognito.exceptions.ResourceNotFoundException:
+            if time.time() >= deadline:
+                raise
+            time.sleep(5)
+
 try:
     # Get current user pool client configuration
-    response = cognito.describe_user_pool_client(
-        UserPoolId=user_pool_id,
-        ClientId=client_id
-    )
+    response = describe_with_retry()
 
     client_config = response['UserPoolClient']
     current_callback_urls = client_config.get('CallbackURLs', [])
@@ -118,6 +132,11 @@ except Exception as e:
     sys.exit(1)
 "
     EOT
+    environment = {
+      USER_POOL_ID     = local.user_pool_id
+      CLIENT_ID        = local.user_pool_client_id
+      NEW_CALLBACK_URL = var.callback_url
+    }
   }
 
   depends_on = [terraform_data.validate_cognito_props]

package/src/utils/identity-constructs/files/terraform/core/user-identity/identity/identity.tf.template

@@ -2,11 +2,11 @@ terraform {
   required_providers {
     aws = {
       source  = "hashicorp/aws"
-      version = "~> 6.0"
+      version = "<%- awsProviderVersion %>"
     }
     random = {
       source  = "hashicorp/random"
-      version = "~> 3.1"
+      version = "<%- randomProviderVersion %>"
     }
   }
 }
@@ -22,6 +22,12 @@ variable "allow_signup" {
   type        = bool
 }
 
+variable "enable_waf" {
+  description = "Whether to enable AWS WAFv2 with the default managed ruleset (AWSManagedRulesCommonRuleSet and AWSManagedRulesKnownBadInputsRuleSet) and associate it with the user pool"
+  type        = bool
+  default     = true
+}
+
 variable "callback_urls" {
   description = "Additional callback URLs for the user pool client"
   type        = list(string)
@@ -150,6 +156,11 @@ resource "aws_cognito_user_pool" "user_pool" {
   # User pool tier (equivalent to FeaturePlan.PLUS)
   user_pool_tier = "PLUS"
 
+  # Threat protection. AUDIT logs threat assessments without blocking sign-in; switch to ENFORCED to apply automatic responses.
+  user_pool_add_ons {
+    advanced_security_mode = "AUDIT"
+  }
+
   # Schema attributes
   schema {
     attribute_data_type = "String"
@@ -225,6 +236,97 @@ resource "aws_cognito_user_pool_domain" "user_pool_domain" {
   managed_login_version   = 2
 }
 
+# WAFv2 Web ACL for the user pool
+resource "aws_wafv2_web_acl" "user_pool_waf" {
+  #checkov:skip=CKV2_AWS_31:Logging configuration is defined below in aws_wafv2_web_acl_logging_configuration.user_pool_waf_logging; Checkov does not resolve the separate resource
+  count = var.enable_waf ? 1 : 0
+
+  name  = "UserPool-${random_id.unique_suffix.hex}-waf"
+  scope = "REGIONAL"
+
+  default_action {
+    allow {}
+  }
+
+  rule {
+    name     = "CRSRule"
+    priority = 0
+
+    override_action {
+      none {}
+    }
+
+    statement {
+      managed_rule_group_statement {
+        name        = "AWSManagedRulesCommonRuleSet"
+        vendor_name = "AWS"
+      }
+    }
+
+    visibility_config {
+      cloudwatch_metrics_enabled = true
+      metric_name                = "UserPoolWebAcl-CRS"
+      sampled_requests_enabled   = true
+    }
+  }
+
+  rule {
+    name     = "KnownBadInputsRule"
+    priority = 1
+
+    override_action {
+      none {}
+    }
+
+    statement {
+      managed_rule_group_statement {
+        name        = "AWSManagedRulesKnownBadInputsRuleSet"
+        vendor_name = "AWS"
+      }
+    }
+
+    visibility_config {
+      cloudwatch_metrics_enabled = true
+      metric_name                = "UserPoolWebAcl-KnownBadInputs"
+      sampled_requests_enabled   = true
+    }
+  }
+
+  visibility_config {
+    cloudwatch_metrics_enabled = true
+    metric_name                = "UserPoolWebAcl"
+    sampled_requests_enabled   = true
+  }
+
+  lifecycle {
+    create_before_destroy = true
+  }
+}
+
+resource "aws_wafv2_web_acl_association" "user_pool_waf_association" {
+  count = var.enable_waf ? 1 : 0
+
+  resource_arn = aws_cognito_user_pool.user_pool.arn
+  web_acl_arn  = aws_wafv2_web_acl.user_pool_waf[0].arn
+}
+
+# CloudWatch Log Group for WAF request logs. Name must start with `aws-waf-logs-`.
+resource "aws_cloudwatch_log_group" "user_pool_waf_logs" {
+  #checkov:skip=CKV_AWS_158:Using default CloudWatch log encryption
+  #checkov:skip=CKV_AWS_338:Log retention set to one month which is sufficient for WAF logs
+  count = var.enable_waf ? 1 : 0
+
+  name              = "aws-waf-logs-UserPool-${random_id.unique_suffix.hex}"
+  retention_in_days = 30
+}
+
+resource "aws_wafv2_web_acl_logging_configuration" "user_pool_waf_logging" {
+  count = var.enable_waf ? 1 : 0
+
+  log_destination_configs = [aws_cloudwatch_log_group.user_pool_waf_logs[0].arn]
+  resource_arn            = aws_wafv2_web_acl.user_pool_waf[0].arn
+}
+
 # User Pool Client
 resource "aws_cognito_user_pool_client" "web_client" {
   name         = "WebClient-${random_id.unique_suffix.hex}"
@@ -249,14 +351,12 @@ resource "aws_cognito_user_pool_client" "web_client" {
   # OAuth-dependent URLs - set after OAuth configuration
   callback_urls = concat([
     "http://localhost:4200",
-    "http://localhost:4300",
-    "https://${data.aws_region.current.region}.console.aws.amazon.com"
+    "http://localhost:4300"
   ], var.callback_urls)
 
   logout_urls = concat([
     "http://localhost:4200",
-    "http://localhost:4300",
-    "https://${data.aws_region.current.region}.console.aws.amazon.com"
+    "http://localhost:4300"
   ], var.logout_urls)
 
   # Security settings

package/src/utils/identity-constructs/files/terraform/core/user-identity/main.tf.template

@@ -1,8 +1,15 @@
+variable "enable_waf" {
+  description = "Whether to enable AWS WAFv2 with the default managed ruleset and associate it with the user pool"
+  type        = bool
+  default     = true
+}
+
 module "identity" {
   source = "./identity"
 
   user_pool_domain_prefix = "<%= cognitoDomain %>"
   allow_signup = <%= allowSignup %>
+  enable_waf = var.enable_waf
 }
 
 # Outputs

package/src/utils/identity-constructs/identity-constructs.d.ts

@@ -2,8 +2,8 @@
  * Copyright Amazon.com, Inc. or its affiliates. All Rights Reserved.
  * SPDX-License-Identifier: Apache-2.0
  */
-import { Tree } from '@nx/devkit';
-import { Iac } from '../iac';
+import { type Tree } from '@nx/devkit';
+import type { Iac } from '../iac';
 export interface AddIdentityInfraOptions {
     cognitoDomain: string;
     allowSignup: boolean;

package/src/utils/identity-constructs/identity-constructs.js

@@ -1,42 +1,38 @@
-"use strict";
-Object.defineProperty(exports, "__esModule", { value: true });
-exports.addIdentityInfra = void 0;
 /**
  * Copyright Amazon.com, Inc. or its affiliates. All Rights Reserved.
  * SPDX-License-Identifier: Apache-2.0
- */
-const devkit_1 = require("@nx/devkit");
-const shared_constructs_constants_1 = require("../shared-constructs-constants");
-const ast_1 = require("../ast");
+ */ import { generateFiles, joinPathFragments, OverwriteStrategy } from "@nx/devkit";
+import { addStarExport } from "../ast.js";
+import { PACKAGES_DIR, SHARED_CONSTRUCTS_DIR, SHARED_TERRAFORM_DIR } from "../shared-constructs-constants.js";
+import { PY_VERSIONS, terraformProviderVersions } from "../versions.js";
 /**
  * Add infrastructure for a static website
- */
-const addIdentityInfra = async (tree, options) => {
+ */ export const addIdentityInfra = async (tree, options)=>{
     if (options.iac === 'cdk') {
         await addIdentityCdkConstructs(tree, options);
-    }
-    else if (options.iac === 'terraform') {
+    } else if (options.iac === 'terraform') {
         addIdentityTerraformModules(tree, options);
-    }
-    else {
+    } else {
         throw new Error(`Unsupported iac ${options.iac}`);
     }
 };
-exports.addIdentityInfra = addIdentityInfra;
-const addIdentityCdkConstructs = async (tree, options) => {
-    (0, devkit_1.generateFiles)(tree, (0, devkit_1.joinPathFragments)(__dirname, 'files', 'cdk', 'core'), (0, devkit_1.joinPathFragments)(shared_constructs_constants_1.PACKAGES_DIR, shared_constructs_constants_1.SHARED_CONSTRUCTS_DIR, 'src', 'core'), options, {
-        overwriteStrategy: devkit_1.OverwriteStrategy.KeepExisting,
+const addIdentityCdkConstructs = async (tree, options)=>{
+    generateFiles(tree, joinPathFragments(import.meta.dirname, 'files', 'cdk', 'core'), joinPathFragments(PACKAGES_DIR, SHARED_CONSTRUCTS_DIR, 'src', 'core'), options, {
+        overwriteStrategy: OverwriteStrategy.KeepExisting
     });
-    await (0, ast_1.addStarExport)(tree, (0, devkit_1.joinPathFragments)(shared_constructs_constants_1.PACKAGES_DIR, shared_constructs_constants_1.SHARED_CONSTRUCTS_DIR, 'src', 'core', 'index.ts'), './user-identity.js');
+    await addStarExport(tree, joinPathFragments(PACKAGES_DIR, SHARED_CONSTRUCTS_DIR, 'src', 'core', 'index.ts'), './user-identity.js');
 };
-const addIdentityTerraformModules = (tree, options) => {
-    (0, devkit_1.generateFiles)(tree, (0, devkit_1.joinPathFragments)(__dirname, 'files', 'terraform', 'core'), (0, devkit_1.joinPathFragments)(shared_constructs_constants_1.PACKAGES_DIR, shared_constructs_constants_1.SHARED_TERRAFORM_DIR, 'src', 'core'), options, {
-        overwriteStrategy: devkit_1.OverwriteStrategy.KeepExisting,
+const addIdentityTerraformModules = (tree, options)=>{
+    generateFiles(tree, joinPathFragments(import.meta.dirname, 'files', 'terraform', 'core'), joinPathFragments(PACKAGES_DIR, SHARED_TERRAFORM_DIR, 'src', 'core'), {
+        ...options,
+        boto3Version: PY_VERSIONS.boto3,
+        ...terraformProviderVersions()
+    }, {
+        overwriteStrategy: OverwriteStrategy.KeepExisting
     });
     // Update the static website module to add the callback url
-    const staticWebsiteModule = tree.read((0, devkit_1.joinPathFragments)(shared_constructs_constants_1.PACKAGES_DIR, shared_constructs_constants_1.SHARED_TERRAFORM_DIR, 'src', 'core', 'static-website', 'static-website.tf'), 'utf-8');
-    if (staticWebsiteModule &&
-        !staticWebsiteModule.includes('source = "../user-identity/add-callback-url"')) {
+    const staticWebsiteModule = tree.read(joinPathFragments(PACKAGES_DIR, SHARED_TERRAFORM_DIR, 'src', 'core', 'static-website', 'static-website.tf'), 'utf-8');
+    if (staticWebsiteModule && !staticWebsiteModule.includes('source = "../user-identity/add-callback-url"')) {
         // Find the aws_cloudfront_distribution.website resource and add the callback URL module after it
         const callbackUrlModule = `
 
@@ -57,12 +53,11 @@ module "add_callback_url" {
             let braceCount = 0;
             let insertionPoint = -1;
             // Count braces to find the end of the resource block
-            for (let i = startIndex; i < staticWebsiteModule.length; i++) {
+            for(let i = startIndex; i < staticWebsiteModule.length; i++){
                 const char = staticWebsiteModule[i];
                 if (char === '{') {
                     braceCount++;
-                }
-                else if (char === '}') {
+                } else if (char === '}') {
                     braceCount--;
                     if (braceCount === 0) {
                         // Found the closing brace of the CloudFront resource
@@ -76,9 +71,10 @@ module "add_callback_url" {
                 const beforeInsertion = staticWebsiteModule.substring(0, insertionPoint);
                 const afterInsertion = staticWebsiteModule.substring(insertionPoint);
                 const updatedContent = beforeInsertion + callbackUrlModule + afterInsertion;
-                tree.write((0, devkit_1.joinPathFragments)(shared_constructs_constants_1.PACKAGES_DIR, shared_constructs_constants_1.SHARED_TERRAFORM_DIR, 'src', 'core', 'static-website', 'static-website.tf'), updatedContent);
+                tree.write(joinPathFragments(PACKAGES_DIR, SHARED_TERRAFORM_DIR, 'src', 'core', 'static-website', 'static-website.tf'), updatedContent);
             }
         }
     }
 };
+
 //# sourceMappingURL=identity-constructs.js.map

package/src/utils/identity-constructs/identity-constructs.js.map

@@ -1 +1 @@
-{"version":3,"file":"identity-constructs.js","sourceRoot":"","sources":["../../../../../../packages/nx-plugin/src/utils/identity-constructs/identity-constructs.ts"],"names":[],"mappings":";;;AAAA;;;GAGG;AACH,uCAKoB;AACpB,gFAIwC;AACxC,gCAAuC;AAQvC;;GAEG;AACI,MAAM,gBAAgB,GAAG,KAAK,EACnC,IAAU,EACV,OAA+C,EAC/C,EAAE;IACF,IAAI,OAAO,CAAC,GAAG,KAAK,KAAK,EAAE,CAAC;QAC1B,MAAM,wBAAwB,CAAC,IAAI,EAAE,OAAO,CAAC,CAAC;IAChD,CAAC;SAAM,IAAI,OAAO,CAAC,GAAG,KAAK,WAAW,EAAE,CAAC;QACvC,2BAA2B,CAAC,IAAI,EAAE,OAAO,CAAC,CAAC;IAC7C,CAAC;SAAM,CAAC;QACN,MAAM,IAAI,KAAK,CAAC,mBAAmB,OAAO,CAAC,GAAG,EAAE,CAAC,CAAC;IACpD,CAAC;AACH,CAAC,CAAC;AAXW,QAAA,gBAAgB,oBAW3B;AAEF,MAAM,wBAAwB,GAAG,KAAK,EACpC,IAAU,EACV,OAAgC,EAChC,EAAE;IACF,IAAA,sBAAa,EACX,IAAI,EACJ,IAAA,0BAAiB,EAAC,SAAS,EAAE,OAAO,EAAE,KAAK,EAAE,MAAM,CAAC,EACpD,IAAA,0BAAiB,EAAC,0CAAY,EAAE,mDAAqB,EAAE,KAAK,EAAE,MAAM,CAAC,EACrE,OAAO,EACP;QACE,iBAAiB,EAAE,0BAAiB,CAAC,YAAY;KAClD,CACF,CAAC;IAEF,MAAM,IAAA,mBAAa,EACjB,IAAI,EACJ,IAAA,0BAAiB,EACf,0CAAY,EACZ,mDAAqB,EACrB,KAAK,EACL,MAAM,EACN,UAAU,CACX,EACD,oBAAoB,CACrB,CAAC;AACJ,CAAC,CAAC;AAEF,MAAM,2BAA2B,GAAG,CAClC,IAAU,EACV,OAAgC,EAChC,EAAE;IACF,IAAA,sBAAa,EACX,IAAI,EACJ,IAAA,0BAAiB,EAAC,SAAS,EAAE,OAAO,EAAE,WAAW,EAAE,MAAM,CAAC,EAC1D,IAAA,0BAAiB,EAAC,0CAAY,EAAE,kDAAoB,EAAE,KAAK,EAAE,MAAM,CAAC,EACpE,OAAO,EACP;QACE,iBAAiB,EAAE,0BAAiB,CAAC,YAAY;KAClD,CACF,CAAC;IAEF,2DAA2D;IAC3D,MAAM,mBAAmB,GAAG,IAAI,CAAC,IAAI,CACnC,IAAA,0BAAiB,EACf,0CAAY,EACZ,kDAAoB,EACpB,KAAK,EACL,MAAM,EACN,gBAAgB,EAChB,mBAAmB,CACpB,EACD,OAAO,CACR,CAAC;IACF,IACE,mBAAmB;QACnB,CAAC,mBAAmB,CAAC,QAAQ,CAC3B,8CAA8C,CAC/C,EACD,CAAC;QACD,iGAAiG;QACjG,MAAM,iBAAiB,GAAG;;;;;;;;;EAS5B,CAAC;QAEC,wEAAwE;QACxE,kDAAkD;QAClD,MAAM,oBAAoB,GACxB,2DAA2D,CAAC;QAC9D,MAAM,kBAAkB,GAAG,mBAAmB,CAAC,KAAK,CAAC,oBAAoB,CAAC,CAAC;QAE3E,IAAI,kBAAkB,EAAE,CAAC;YACvB,MAAM,UAAU,GACd,kBAAkB,CAAC,KAAM,GAAG,kBAAkB,CAAC,CAAC,CAAC,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,4BAA4B;YAC5F,IAAI,UAAU,GAAG,CAAC,CAAC;YACnB,IAAI,cAAc,GAAG,CAAC,CAAC,CAAC;YAExB,qDAAqD;YACrD,KAAK,IAAI,CAAC,GAAG,UAAU,EAAE,CAAC,GAAG,mBAAmB,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;gBAC7D,MAAM,IAAI,GAAG,mBAAmB,CAAC,CAAC,CAAC,CAAC;gBACpC,IAAI,IAAI,KAAK,GAAG,EAAE,CAAC;oBACjB,UAAU,EAAE,CAAC;gBACf,CAAC;qBAAM,IAAI,IAAI,KAAK,GAAG,EAAE,CAAC;oBACxB,UAAU,EAAE,CAAC;oBACb,IAAI,UAAU,KAAK,CAAC,EAAE,CAAC;wBACrB,qDAAqD;wBACrD,cAAc,GAAG,CAAC,GAAG,CAAC,CAAC;wBACvB,MAAM;oBACR,CAAC;gBACH,CAAC;YACH,CAAC;YAED,IAAI,cAAc,KAAK,CAAC,CAAC,EAAE,CAAC;gBAC1B,yEAAyE;gBACzE,MAAM,eAAe,GAAG,mBAAmB,CAAC,SAAS,CACnD,CAAC,EACD,cAAc,CACf,CAAC;gBACF,MAAM,cAAc,GAAG,mBAAmB,CAAC,SAAS,CAAC,cAAc,CAAC,CAAC;gBACrE,MAAM,cAAc,GAClB,eAAe,GAAG,iBAAiB,GAAG,cAAc,CAAC;gBAEvD,IAAI,CAAC,KAAK,CACR,IAAA,0BAAiB,EACf,0CAAY,EACZ,kDAAoB,EACpB,KAAK,EACL,MAAM,EACN,gBAAgB,EAChB,mBAAmB,CACpB,EACD,cAAc,CACf,CAAC;YACJ,CAAC;QACH,CAAC;IACH,CAAC;AACH,CAAC,CAAC"}
+{"version":3,"sources":["../../../../../../packages/nx-plugin/src/utils/identity-constructs/identity-constructs.ts"],"sourcesContent":["/**\n * Copyright Amazon.com, Inc. or its affiliates. All Rights Reserved.\n * SPDX-License-Identifier: Apache-2.0\n */\nimport {\n  generateFiles,\n  joinPathFragments,\n  OverwriteStrategy,\n  type Tree,\n} from '@nx/devkit';\nimport { addStarExport } from '../ast';\nimport type { Iac } from '../iac';\nimport {\n  PACKAGES_DIR,\n  SHARED_CONSTRUCTS_DIR,\n  SHARED_TERRAFORM_DIR,\n} from '../shared-constructs-constants';\nimport { PY_VERSIONS, terraformProviderVersions } from '../versions';\n\nexport interface AddIdentityInfraOptions {\n  cognitoDomain: string;\n  allowSignup: boolean;\n}\n\n/**\n * Add infrastructure for a static website\n */\nexport const addIdentityInfra = async (\n  tree: Tree,\n  options: AddIdentityInfraOptions & { iac: Iac },\n) => {\n  if (options.iac === 'cdk') {\n    await addIdentityCdkConstructs(tree, options);\n  } else if (options.iac === 'terraform') {\n    addIdentityTerraformModules(tree, options);\n  } else {\n    throw new Error(`Unsupported iac ${options.iac}`);\n  }\n};\n\nconst addIdentityCdkConstructs = async (\n  tree: Tree,\n  options: AddIdentityInfraOptions,\n) => {\n  generateFiles(\n    tree,\n    joinPathFragments(import.meta.dirname, 'files', 'cdk', 'core'),\n    joinPathFragments(PACKAGES_DIR, SHARED_CONSTRUCTS_DIR, 'src', 'core'),\n    options,\n    {\n      overwriteStrategy: OverwriteStrategy.KeepExisting,\n    },\n  );\n\n  await addStarExport(\n    tree,\n    joinPathFragments(\n      PACKAGES_DIR,\n      SHARED_CONSTRUCTS_DIR,\n      'src',\n      'core',\n      'index.ts',\n    ),\n    './user-identity.js',\n  );\n};\n\nconst addIdentityTerraformModules = (\n  tree: Tree,\n  options: AddIdentityInfraOptions,\n) => {\n  generateFiles(\n    tree,\n    joinPathFragments(import.meta.dirname, 'files', 'terraform', 'core'),\n    joinPathFragments(PACKAGES_DIR, SHARED_TERRAFORM_DIR, 'src', 'core'),\n    {\n      ...options,\n      boto3Version: PY_VERSIONS.boto3,\n      ...terraformProviderVersions(),\n    },\n    {\n      overwriteStrategy: OverwriteStrategy.KeepExisting,\n    },\n  );\n\n  // Update the static website module to add the callback url\n  const staticWebsiteModule = tree.read(\n    joinPathFragments(\n      PACKAGES_DIR,\n      SHARED_TERRAFORM_DIR,\n      'src',\n      'core',\n      'static-website',\n      'static-website.tf',\n    ),\n    'utf-8',\n  );\n  if (\n    staticWebsiteModule &&\n    !staticWebsiteModule.includes(\n      'source = \"../user-identity/add-callback-url\"',\n    )\n  ) {\n    // Find the aws_cloudfront_distribution.website resource and add the callback URL module after it\n    const callbackUrlModule = `\n\n# Add CloudFront domain to user pool client callback URLs\nmodule \"add_callback_url\" {\n  source = \"../user-identity/add-callback-url\"\n\n  callback_url = \"https://\\${aws_cloudfront_distribution.website.domain_name}\"\n\n  depends_on = [aws_cloudfront_distribution.website]\n}`;\n\n    // Find the CloudFront distribution resource using proper brace counting\n    // This handles deeply nested structures correctly\n    const resourceStartPattern =\n      /resource\\s+\"aws_cloudfront_distribution\"\\s+\"website\"\\s*\\{/;\n    const resourceStartMatch = staticWebsiteModule.match(resourceStartPattern);\n\n    if (resourceStartMatch) {\n      const startIndex =\n        resourceStartMatch.index! + resourceStartMatch[0].length - 1; // Position at opening brace\n      let braceCount = 0;\n      let insertionPoint = -1;\n\n      // Count braces to find the end of the resource block\n      for (let i = startIndex; i < staticWebsiteModule.length; i++) {\n        const char = staticWebsiteModule[i];\n        if (char === '{') {\n          braceCount++;\n        } else if (char === '}') {\n          braceCount--;\n          if (braceCount === 0) {\n            // Found the closing brace of the CloudFront resource\n            insertionPoint = i + 1;\n            break;\n          }\n        }\n      }\n\n      if (insertionPoint !== -1) {\n        // Insert the callback URL module right after the CloudFront distribution\n        const beforeInsertion = staticWebsiteModule.substring(\n          0,\n          insertionPoint,\n        );\n        const afterInsertion = staticWebsiteModule.substring(insertionPoint);\n        const updatedContent =\n          beforeInsertion + callbackUrlModule + afterInsertion;\n\n        tree.write(\n          joinPathFragments(\n            PACKAGES_DIR,\n            SHARED_TERRAFORM_DIR,\n            'src',\n            'core',\n            'static-website',\n            'static-website.tf',\n          ),\n          updatedContent,\n        );\n      }\n    }\n  }\n};\n"],"names":["generateFiles","joinPathFragments","OverwriteStrategy","addStarExport","PACKAGES_DIR","SHARED_CONSTRUCTS_DIR","SHARED_TERRAFORM_DIR","PY_VERSIONS","terraformProviderVersions","addIdentityInfra","tree","options","iac","addIdentityCdkConstructs","addIdentityTerraformModules","Error","dirname","overwriteStrategy","KeepExisting","boto3Version","boto3","staticWebsiteModule","read","includes","callbackUrlModule","resourceStartPattern","resourceStartMatch","match","startIndex","index","length","braceCount","insertionPoint","i","char","beforeInsertion","substring","afterInsertion","updatedContent","write"],"mappings":"AAAA;;;CAGC,GACD,SACEA,aAAa,EACbC,iBAAiB,EACjBC,iBAAiB,QAEZ,aAAa;AACpB,SAASC,aAAa,QAAQ,YAAS;AAEvC,SACEC,YAAY,EACZC,qBAAqB,EACrBC,oBAAoB,QACf,oCAAiC;AACxC,SAASC,WAAW,EAAEC,yBAAyB,QAAQ,iBAAc;AAOrE;;CAEC,GACD,OAAO,MAAMC,mBAAmB,OAC9BC,MACAC;IAEA,IAAIA,QAAQC,GAAG,KAAK,OAAO;QACzB,MAAMC,yBAAyBH,MAAMC;IACvC,OAAO,IAAIA,QAAQC,GAAG,KAAK,aAAa;QACtCE,4BAA4BJ,MAAMC;IACpC,OAAO;QACL,MAAM,IAAII,MAAM,CAAC,gBAAgB,EAAEJ,QAAQC,GAAG,EAAE;IAClD;AACF,EAAE;AAEF,MAAMC,2BAA2B,OAC/BH,MACAC;IAEAX,cACEU,MACAT,kBAAkB,YAAYe,OAAO,EAAE,SAAS,OAAO,SACvDf,kBAAkBG,cAAcC,uBAAuB,OAAO,SAC9DM,SACA;QACEM,mBAAmBf,kBAAkBgB,YAAY;IACnD;IAGF,MAAMf,cACJO,MACAT,kBACEG,cACAC,uBACA,OACA,QACA,aAEF;AAEJ;AAEA,MAAMS,8BAA8B,CAClCJ,MACAC;IAEAX,cACEU,MACAT,kBAAkB,YAAYe,OAAO,EAAE,SAAS,aAAa,SAC7Df,kBAAkBG,cAAcE,sBAAsB,OAAO,SAC7D;QACE,GAAGK,OAAO;QACVQ,cAAcZ,YAAYa,KAAK;QAC/B,GAAGZ,2BAA2B;IAChC,GACA;QACES,mBAAmBf,kBAAkBgB,YAAY;IACnD;IAGF,2DAA2D;IAC3D,MAAMG,sBAAsBX,KAAKY,IAAI,CACnCrB,kBACEG,cACAE,sBACA,OACA,QACA,kBACA,sBAEF;IAEF,IACEe,uBACA,CAACA,oBAAoBE,QAAQ,CAC3B,iDAEF;QACA,iGAAiG;QACjG,MAAMC,oBAAoB,CAAC;;;;;;;;;CAS9B,CAAC;QAEE,wEAAwE;QACxE,kDAAkD;QAClD,MAAMC,uBACJ;QACF,MAAMC,qBAAqBL,oBAAoBM,KAAK,CAACF;QAErD,IAAIC,oBAAoB;YACtB,MAAME,aACJF,mBAAmBG,KAAK,GAAIH,kBAAkB,CAAC,EAAE,CAACI,MAAM,GAAG,GAAG,4BAA4B;YAC5F,IAAIC,aAAa;YACjB,IAAIC,iBAAiB,CAAC;YAEtB,qDAAqD;YACrD,IAAK,IAAIC,IAAIL,YAAYK,IAAIZ,oBAAoBS,MAAM,EAAEG,IAAK;gBAC5D,MAAMC,OAAOb,mBAAmB,CAACY,EAAE;gBACnC,IAAIC,SAAS,KAAK;oBAChBH;gBACF,OAAO,IAAIG,SAAS,KAAK;oBACvBH;oBACA,IAAIA,eAAe,GAAG;wBACpB,qDAAqD;wBACrDC,iBAAiBC,IAAI;wBACrB;oBACF;gBACF;YACF;YAEA,IAAID,mBAAmB,CAAC,GAAG;gBACzB,yEAAyE;gBACzE,MAAMG,kBAAkBd,oBAAoBe,SAAS,CACnD,GACAJ;gBAEF,MAAMK,iBAAiBhB,oBAAoBe,SAAS,CAACJ;gBACrD,MAAMM,iBACJH,kBAAkBX,oBAAoBa;gBAExC3B,KAAK6B,KAAK,CACRtC,kBACEG,cACAE,sBACA,OACA,QACA,kBACA,sBAEFgC;YAEJ;QACF;IACF;AACF"}

package/src/utils/install.d.ts

@@ -0,0 +1,32 @@
+import { type Tree } from '@nx/devkit';
+import type { ITsDepVersion } from './versions';
+/**
+ * Languages whose dependencies a generator may install.
+ */
+export type InstallLanguage = 'typescript' | 'python';
+export interface InstallDependenciesOptions {
+    /** Languages to install dependencies for. */
+    languages: InstallLanguage[];
+    /**
+     * Packages that must resolve from the workspace after this generator, because
+     * a config file it writes (e.g. `vite.config.mts`) imports them and Nx loads
+     * that config when computing the project graph. When the caller prefers to
+     * defer installing, we honour that only if these already resolve.
+     *
+     * The per-language graph deps in `LANGUAGE_GRAPH_DEPS` are always included, so
+     * callers only list packages beyond those.
+     */
+    ensureResolvable?: ITsDepVersion[];
+}
+/**
+ * Installs dependencies for the given languages.
+ *
+ * Call from a generator's returned callback:
+ * `return () => installDependencies(tree, options.preferInstallDependencies, { ... })`.
+ *
+ * `preferInstallDependencies` is a preference: when `false` the install is
+ * deferred so a batch installs once at the end — unless an `ensureResolvable`
+ * package is missing, in which case it runs anyway so the next `nx` command can
+ * still compute the project graph.
+ */
+export declare const installDependencies: (tree: Tree, preferInstallDependencies: boolean | undefined, options: InstallDependenciesOptions) => Promise<void>;

package/src/utils/install.js

@@ -0,0 +1,56 @@
+/**
+ * Copyright Amazon.com, Inc. or its affiliates. All Rights Reserved.
+ * SPDX-License-Identifier: Apache-2.0
+ */ import { existsSync } from "node:fs";
+import { join } from "node:path";
+import { installPackagesTask } from "@nx/devkit";
+import { Logger, UVProvider } from "./nxlv-python.js";
+/**
+ * Packages each language always needs resolvable for Nx to compute the project
+ * graph, so a deferred install still runs whenever it would otherwise break.
+ */ const LANGUAGE_GRAPH_DEPS = {
+    typescript: [
+        'vitest'
+    ],
+    python: [
+        '@nxlv/python'
+    ]
+};
+/**
+ * Returns true if every package is linked at `<root>/node_modules/<pkg>`.
+ *
+ * This is the condition Nx's inferred plugins need when they load a generated
+ * config (e.g. `vite.config.mts`) during graph computation: the config's
+ * imports resolve from inside the workspace's own `node_modules`. We avoid
+ * `require.resolve`, which can succeed via an ancestor `node_modules` even when
+ * the package isn't linked here. `existsSync` follows symlinks, so pnpm's store
+ * links resolve, and Nx always uses a `node_modules` linker (never PnP).
+ */ const allResolvable = (root, packages)=>packages.every((pkg)=>existsSync(join(root, 'node_modules', pkg)));
+/**
+ * Installs dependencies for the given languages.
+ *
+ * Call from a generator's returned callback:
+ * `return () => installDependencies(tree, options.preferInstallDependencies, { ... })`.
+ *
+ * `preferInstallDependencies` is a preference: when `false` the install is
+ * deferred so a batch installs once at the end — unless an `ensureResolvable`
+ * package is missing, in which case it runs anyway so the next `nx` command can
+ * still compute the project graph.
+ */ export const installDependencies = async (tree, preferInstallDependencies, options)=>{
+    const { languages, ensureResolvable = [] } = options;
+    const mustResolve = [
+        ...ensureResolvable,
+        ...languages.flatMap((language)=>LANGUAGE_GRAPH_DEPS[language])
+    ];
+    if (preferInstallDependencies === false && allResolvable(tree.root, mustResolve)) {
+        return;
+    }
+    if (languages.includes('typescript')) {
+        installPackagesTask(tree);
+    }
+    if (languages.includes('python')) {
+        await new UVProvider(tree.root, new Logger(), tree).install();
+    }
+};
+
+//# sourceMappingURL=install.js.map

package/src/utils/install.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../../../../../packages/nx-plugin/src/utils/install.ts"],"sourcesContent":["/**\n * Copyright Amazon.com, Inc. or its affiliates. All Rights Reserved.\n * SPDX-License-Identifier: Apache-2.0\n */\nimport { existsSync } from 'node:fs';\nimport { join } from 'node:path';\nimport { installPackagesTask, type Tree } from '@nx/devkit';\nimport { Logger, UVProvider } from './nxlv-python';\nimport type { ITsDepVersion } from './versions';\n\n/**\n * Languages whose dependencies a generator may install.\n */\nexport type InstallLanguage = 'typescript' | 'python';\n\nexport interface InstallDependenciesOptions {\n  /** Languages to install dependencies for. */\n  languages: InstallLanguage[];\n  /**\n   * Packages that must resolve from the workspace after this generator, because\n   * a config file it writes (e.g. `vite.config.mts`) imports them and Nx loads\n   * that config when computing the project graph. When the caller prefers to\n   * defer installing, we honour that only if these already resolve.\n   *\n   * The per-language graph deps in `LANGUAGE_GRAPH_DEPS` are always included, so\n   * callers only list packages beyond those.\n   */\n  ensureResolvable?: ITsDepVersion[];\n}\n\n/**\n * Packages each language always needs resolvable for Nx to compute the project\n * graph, so a deferred install still runs whenever it would otherwise break.\n */\nconst LANGUAGE_GRAPH_DEPS: Record<InstallLanguage, string[]> = {\n  typescript: ['vitest'], // every TypeScript project has a `vitest.config.mts`\n  python: ['@nxlv/python'], // every Python project registers this inference plugin\n};\n\n/**\n * Returns true if every package is linked at `<root>/node_modules/<pkg>`.\n *\n * This is the condition Nx's inferred plugins need when they load a generated\n * config (e.g. `vite.config.mts`) during graph computation: the config's\n * imports resolve from inside the workspace's own `node_modules`. We avoid\n * `require.resolve`, which can succeed via an ancestor `node_modules` even when\n * the package isn't linked here. `existsSync` follows symlinks, so pnpm's store\n * links resolve, and Nx always uses a `node_modules` linker (never PnP).\n */\nconst allResolvable = (root: string, packages: string[]): boolean =>\n  packages.every((pkg) => existsSync(join(root, 'node_modules', pkg)));\n\n/**\n * Installs dependencies for the given languages.\n *\n * Call from a generator's returned callback:\n * `return () => installDependencies(tree, options.preferInstallDependencies, { ... })`.\n *\n * `preferInstallDependencies` is a preference: when `false` the install is\n * deferred so a batch installs once at the end — unless an `ensureResolvable`\n * package is missing, in which case it runs anyway so the next `nx` command can\n * still compute the project graph.\n */\nexport const installDependencies = async (\n  tree: Tree,\n  preferInstallDependencies: boolean | undefined,\n  options: InstallDependenciesOptions,\n): Promise<void> => {\n  const { languages, ensureResolvable = [] } = options;\n  const mustResolve = [\n    ...ensureResolvable,\n    ...languages.flatMap((language) => LANGUAGE_GRAPH_DEPS[language]),\n  ];\n  if (\n    preferInstallDependencies === false &&\n    allResolvable(tree.root, mustResolve)\n  ) {\n    return;\n  }\n  if (languages.includes('typescript')) {\n    installPackagesTask(tree);\n  }\n  if (languages.includes('python')) {\n    await new UVProvider(tree.root, new Logger(), tree).install();\n  }\n};\n"],"names":["existsSync","join","installPackagesTask","Logger","UVProvider","LANGUAGE_GRAPH_DEPS","typescript","python","allResolvable","root","packages","every","pkg","installDependencies","tree","preferInstallDependencies","options","languages","ensureResolvable","mustResolve","flatMap","language","includes","install"],"mappings":"AAAA;;;CAGC,GACD,SAASA,UAAU,QAAQ,UAAU;AACrC,SAASC,IAAI,QAAQ,YAAY;AACjC,SAASC,mBAAmB,QAAmB,aAAa;AAC5D,SAASC,MAAM,EAAEC,UAAU,QAAQ,mBAAgB;AAuBnD;;;CAGC,GACD,MAAMC,sBAAyD;IAC7DC,YAAY;QAAC;KAAS;IACtBC,QAAQ;QAAC;KAAe;AAC1B;AAEA;;;;;;;;;CASC,GACD,MAAMC,gBAAgB,CAACC,MAAcC,WACnCA,SAASC,KAAK,CAAC,CAACC,MAAQZ,WAAWC,KAAKQ,MAAM,gBAAgBG;AAEhE;;;;;;;;;;CAUC,GACD,OAAO,MAAMC,sBAAsB,OACjCC,MACAC,2BACAC;IAEA,MAAM,EAAEC,SAAS,EAAEC,mBAAmB,EAAE,EAAE,GAAGF;IAC7C,MAAMG,cAAc;WACfD;WACAD,UAAUG,OAAO,CAAC,CAACC,WAAahB,mBAAmB,CAACgB,SAAS;KACjE;IACD,IACEN,8BAA8B,SAC9BP,cAAcM,KAAKL,IAAI,EAAEU,cACzB;QACA;IACF;IACA,IAAIF,UAAUK,QAAQ,CAAC,eAAe;QACpCpB,oBAAoBY;IACtB;IACA,IAAIG,UAAUK,QAAQ,CAAC,WAAW;QAChC,MAAM,IAAIlB,WAAWU,KAAKL,IAAI,EAAE,IAAIN,UAAUW,MAAMS,OAAO;IAC7D;AACF,EAAE"}

package/src/utils/js.d.ts

@@ -1,3 +1,7 @@
+/**
+ * Copyright Amazon.com, Inc. or its affiliates. All Rights Reserved.
+ * SPDX-License-Identifier: Apache-2.0
+ */
 /**
  * Imports a javascript module from a string of js code
  */

package/src/utils/js.js

@@ -1,33 +1,40 @@
-"use strict";
-Object.defineProperty(exports, "__esModule", { value: true });
-exports.importTypeScriptModule = exports.importJavaScriptModule = void 0;
-const tslib_1 = require("tslib");
 /**
  * Copyright Amazon.com, Inc. or its affiliates. All Rights Reserved.
  * SPDX-License-Identifier: Apache-2.0
- */
-const typescript_1 = tslib_1.__importDefault(require("typescript"));
-const config_utils_1 = require("@nx/devkit/src/utils/config-utils");
+ */ import ts from "typescript";
+// A real runtime `import()`, wrapped in `new Function` so transpilers (tsc's
+// CommonJS output, @swc-node/register) cannot rewrite it to `require()` —
+// `require()` cannot load the `data:` urls we import below. Under a test VM
+// (vitest) this `new Function` import has no dynamic-import callback, so we
+// fall back to a literal `import()` which the test runner wires up correctly.
+const nodeImport = new Function('modulePath', 'return import(modulePath);');
+const dynamicImport = async (modulePath)=>{
+    try {
+        return await nodeImport(modulePath);
+    } catch (e) {
+        if (e instanceof TypeError && e.message.includes('dynamic import callback')) {
+            return import(/* @vite-ignore */ modulePath);
+        }
+        throw e;
+    }
+};
 /**
  * Imports a javascript module from a string of js code
- */
-const importJavaScriptModule = async (jsCode) => {
-    // Use nx's dynamic import to ensure that transpilers (namely @swc-node/register) don't process the import and it's
-    // instead processed by node at runtime, which allows for data urls
-    const module = await (0, config_utils_1.dynamicImport)(`data:text/javascript,${encodeURIComponent(jsCode)}`);
+ */ export const importJavaScriptModule = async (jsCode)=>{
+    const module = await dynamicImport(`data:text/javascript,${encodeURIComponent(jsCode)}`);
     // Return the default export if available, otherwise the full module
-    return (module.default ?? module);
+    return module.default ?? module;
 };
-exports.importJavaScriptModule = importJavaScriptModule;
 /**
  * Imports a typescript module from a string of typescript code
- */
-const importTypeScriptModule = async (tsCode) => {
+ */ export const importTypeScriptModule = async (tsCode)=>{
     // Transpile to js and then import as a js module
-    const jsCode = typescript_1.default.transpileModule(tsCode, {
-        compilerOptions: { module: typescript_1.default.ModuleKind.ESNext },
+    const jsCode = ts.transpileModule(tsCode, {
+        compilerOptions: {
+            module: ts.ModuleKind.ESNext
+        }
     }).outputText;
-    return await (0, exports.importJavaScriptModule)(jsCode);
+    return await importJavaScriptModule(jsCode);
 };
-exports.importTypeScriptModule = importTypeScriptModule;
+
 //# sourceMappingURL=js.js.map

package/src/utils/js.js.map

@@ -1 +1 @@
-{"version":3,"file":"js.js","sourceRoot":"","sources":["../../../../../packages/nx-plugin/src/utils/js.ts"],"names":[],"mappings":";;;;AAAA;;;GAGG;AACH,oEAA4B;AAC5B,oEAAkE;AAElE;;GAEG;AACI,MAAM,sBAAsB,GAAG,KAAK,EAAK,MAAc,EAAc,EAAE;IAC5E,mHAAmH;IACnH,mEAAmE;IACnE,MAAM,MAAM,GAAG,MAAM,IAAA,4BAAa,EAChC,wBAAwB,kBAAkB,CAAC,MAAM,CAAC,EAAE,CACrD,CAAC;IAEF,oEAAoE;IACpE,OAAO,CAAC,MAAM,CAAC,OAAO,IAAI,MAAM,CAAM,CAAC;AACzC,CAAC,CAAC;AATW,QAAA,sBAAsB,0BASjC;AAEF;;GAEG;AACI,MAAM,sBAAsB,GAAG,KAAK,EAAK,MAAc,EAAc,EAAE;IAC5E,iDAAiD;IACjD,MAAM,MAAM,GAAG,oBAAE,CAAC,eAAe,CAAC,MAAM,EAAE;QACxC,eAAe,EAAE,EAAE,MAAM,EAAE,oBAAE,CAAC,UAAU,CAAC,MAAM,EAAE;KAClD,CAAC,CAAC,UAAU,CAAC;IACd,OAAO,MAAM,IAAA,8BAAsB,EAAI,MAAM,CAAC,CAAC;AACjD,CAAC,CAAC;AANW,QAAA,sBAAsB,0BAMjC"}
+{"version":3,"sources":["../../../../../packages/nx-plugin/src/utils/js.ts"],"sourcesContent":["/**\n * Copyright Amazon.com, Inc. or its affiliates. All Rights Reserved.\n * SPDX-License-Identifier: Apache-2.0\n */\n\nimport ts from 'typescript';\n\n// A real runtime `import()`, wrapped in `new Function` so transpilers (tsc's\n// CommonJS output, @swc-node/register) cannot rewrite it to `require()` —\n// `require()` cannot load the `data:` urls we import below. Under a test VM\n// (vitest) this `new Function` import has no dynamic-import callback, so we\n// fall back to a literal `import()` which the test runner wires up correctly.\nconst nodeImport = new Function('modulePath', 'return import(modulePath);') as (\n  modulePath: string,\n) => Promise<Record<string, unknown>>;\n\nconst dynamicImport = async (\n  modulePath: string,\n): Promise<Record<string, unknown>> => {\n  try {\n    return await nodeImport(modulePath);\n  } catch (e) {\n    if (\n      e instanceof TypeError &&\n      e.message.includes('dynamic import callback')\n    ) {\n      return import(/* @vite-ignore */ modulePath);\n    }\n    throw e;\n  }\n};\n\n/**\n * Imports a javascript module from a string of js code\n */\nexport const importJavaScriptModule = async <T>(jsCode: string): Promise<T> => {\n  const module = await dynamicImport(\n    `data:text/javascript,${encodeURIComponent(jsCode)}`,\n  );\n\n  // Return the default export if available, otherwise the full module\n  return (module.default ?? module) as T;\n};\n\n/**\n * Imports a typescript module from a string of typescript code\n */\nexport const importTypeScriptModule = async <T>(tsCode: string): Promise<T> => {\n  // Transpile to js and then import as a js module\n  const jsCode = ts.transpileModule(tsCode, {\n    compilerOptions: { module: ts.ModuleKind.ESNext },\n  }).outputText;\n  return await importJavaScriptModule<T>(jsCode);\n};\n"],"names":["ts","nodeImport","Function","dynamicImport","modulePath","e","TypeError","message","includes","importJavaScriptModule","jsCode","module","encodeURIComponent","default","importTypeScriptModule","tsCode","transpileModule","compilerOptions","ModuleKind","ESNext","outputText"],"mappings":"AAAA;;;CAGC,GAED,OAAOA,QAAQ,aAAa;AAE5B,6EAA6E;AAC7E,0EAA0E;AAC1E,4EAA4E;AAC5E,4EAA4E;AAC5E,8EAA8E;AAC9E,MAAMC,aAAa,IAAIC,SAAS,cAAc;AAI9C,MAAMC,gBAAgB,OACpBC;IAEA,IAAI;QACF,OAAO,MAAMH,WAAWG;IAC1B,EAAE,OAAOC,GAAG;QACV,IACEA,aAAaC,aACbD,EAAEE,OAAO,CAACC,QAAQ,CAAC,4BACnB;YACA,OAAO,MAAM,CAAC,gBAAgB,GAAGJ;QACnC;QACA,MAAMC;IACR;AACF;AAEA;;CAEC,GACD,OAAO,MAAMI,yBAAyB,OAAUC;IAC9C,MAAMC,SAAS,MAAMR,cACnB,CAAC,qBAAqB,EAAES,mBAAmBF,SAAS;IAGtD,oEAAoE;IACpE,OAAQC,OAAOE,OAAO,IAAIF;AAC5B,EAAE;AAEF;;CAEC,GACD,OAAO,MAAMG,yBAAyB,OAAUC;IAC9C,iDAAiD;IACjD,MAAML,SAASV,GAAGgB,eAAe,CAACD,QAAQ;QACxCE,iBAAiB;YAAEN,QAAQX,GAAGkB,UAAU,CAACC,MAAM;QAAC;IAClD,GAAGC,UAAU;IACb,OAAO,MAAMX,uBAA0BC;AACzC,EAAE"}

package/src/utils/mcp.d.ts

@@ -0,0 +1,25 @@
+/**
+ * Copyright Amazon.com, Inc. or its affiliates. All Rights Reserved.
+ * SPDX-License-Identifier: Apache-2.0
+ */
+import { type Tree } from '@nx/devkit';
+/**
+ * Name of the Nx Plugin for AWS MCP server, used as the key in each agent's config.
+ */
+export declare const NX_PLUGIN_MCP_SERVER_NAME = "nx-plugin-for-aws";
+/**
+ * Command used to launch the Nx Plugin for AWS MCP server.
+ */
+export declare const NX_PLUGIN_MCP_SERVER_COMMAND = "npx";
+/**
+ * Arguments used to launch the Nx Plugin for AWS MCP server.
+ */
+export declare const NX_PLUGIN_MCP_SERVER_ARGS: string[];
+/**
+ * Configure the Nx Plugin for AWS MCP server across the project-level config locations
+ * used by common coding agents, so agents working in the workspace can use it to scaffold
+ * AWS projects with the Nx Plugin for AWS.
+ *
+ * Existing servers and unrelated config in each file are preserved.
+ */
+export declare const configureMcpServers: (tree: Tree) => void;