@aws/nx-plugin 1.0.0-rc.44 → 1.0.0-rc.45

package/generators.json

@@ -211,6 +211,12 @@
       "description": "Generate a TypeScript lambda function",
       "metric": "g21"
     },
+    "ts#dcr-proxy": {
+      "factory": "./src/ts/dcr-proxy/generator",
+      "schema": "./src/ts/dcr-proxy/schema.json",
+      "description": "Generate an OAuth Dynamic Client Registration (DCR) proxy construct for Cognito-authenticated MCP servers",
+      "metric": "g56"
+    },
     "ts#mcp-server": {
       "factory": "./src/ts/mcp-server/generator",
       "schema": "./src/ts/mcp-server/schema.json",

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@aws/nx-plugin",
-  "version": "1.0.0-rc.44",
+  "version": "1.0.0-rc.45",
   "repository": {
     "type": "git",
     "url": "https://github.com/awslabs/nx-plugin-for-aws.git",

package/src/agentcore-gateway/files/cedar/policies/README.md

@@ -7,10 +7,19 @@ runtime.
 
 ## Default policy
 
+<%_ if (auth === 'cognito') { _%>
+`permit-all.cedar` permits any Cognito-authenticated caller
+(`principal is AgentCore::OAuthUser`). The gateway's JWT authorizer already
+validates the token's user pool and client before policies are evaluated, so
+any principal that reaches the engine is an authenticated OAuth user. Tighten
+this by matching JWT claims (e.g. `principal.scope`) — see the
+[AgentCore common policy patterns](https://docs.aws.amazon.com/bedrock-agentcore/latest/devguide/policy-common-patterns.html).
+<%_ } else { _%>
 `permit-all.cedar` permits any IAM caller from the deploying AWS account.
 It is scoped to your account because AgentCore's policy validator rejects
 truly unrestricted permits (`permit (principal, action, resource)`) as
 "Overly Permissive".
+<%_ } _%>
 
 **If you delete this file without adding replacement `permit` policies, the
 gateway will deny every request** — Cedar uses a default-deny evaluation

package/src/agentcore-gateway/files/cedar/policies/permit-all.cedar

@@ -1,3 +1,17 @@
+<%_ if (auth === 'cognito') { _%>
+// Default policy: permit any Cognito-authenticated caller.
+// The gateway's JWT authorizer already validates the token's user pool and
+// client, so any principal reaching policy evaluation is an authenticated
+// OAuth user. The PolicyEngine runs in ENFORCE mode (default-deny) — deleting
+// this file without a replacement permit denies every call. See
+// policies/README.md.
+
+permit (
+  principal is AgentCore::OAuthUser,
+  action,
+  resource == AgentCore::Gateway::"<%%= gatewayArn %>"
+);
+<%_ } else { _%>
 // Default policy: permit any IAM caller from the deploying AWS account.
 // The PolicyEngine runs in ENFORCE mode (default-deny) — deleting this file
 // without a replacement permit denies every call. See policies/README.md.
@@ -9,3 +23,4 @@ permit (
 ) when {
   principal.id like "arn:aws:*::<%%= accountId %>:*"
 };
+<%_ } _%>

package/src/agentcore-gateway/generator.js

@@ -21,11 +21,13 @@ export const agentcoreGatewayGenerator = async (tree, options)=>{
     const subDir = options.subDirectory ?? name;
     const projectRoot = joinPathFragments(parentDir, subDir);
     const fullyQualifiedName = `${getNpmScopePrefix(tree)}${name}`;
-    // Protocol / auth are fixed to mcp / iam in v1 — the enums accept only
-    // these values, but we still persist the resolved value in metadata so
-    // that connection generators can read it uniformly (and future additions
-    // are non-breaking).
+    // Protocol is fixed to mcp — the enum accepts only this value, but we still
+    // persist the resolved value in metadata so connection generators can read
+    // it uniformly (and future additions are non-breaking).
     const protocol = options.protocol ?? 'mcp';
+    // Inbound auth is iam (default) or cognito. Persisted in metadata so
+    // connection generators can validate it (agent -> gateway connections
+    // require an IAM gateway).
     const auth = options.auth ?? 'iam';
     const cedarPolicy = options.cedarPolicy ?? true;
     const infra = options.infra ?? 'agentcore';
@@ -84,8 +86,12 @@ export const agentcoreGatewayGenerator = async (tree, options)=>{
         overwriteStrategy: OverwriteStrategy.KeepExisting
     });
     if (cedarPolicy) {
+        // The default permit-all policy differs by auth type: AgentCore represents
+        // IAM callers as `AgentCore::IamEntity` and Cognito/JWT callers as
+        // `AgentCore::OAuthUser`, so the two policies match different principals.
         generateFiles(tree, joinPathFragments(import.meta.dirname, 'files', 'cedar'), projectRoot, {
-            nameClassName
+            nameClassName,
+            auth
         }, {
             overwriteStrategy: OverwriteStrategy.KeepExisting
         });
@@ -121,6 +127,7 @@ export const agentcoreGatewayGenerator = async (tree, options)=>{
             projectName: fullyQualifiedName,
             projectDirectory: projectRoot,
             cedarPolicy,
+            auth,
             iac
         });
     }

package/src/agentcore-gateway/generator.js.map

@@ -1 +1 @@
-{"version":3,"sources":["../../../../../packages/nx-plugin/src/agentcore-gateway/generator.ts"],"sourcesContent":["/**\n * Copyright Amazon.com, Inc. or its affiliates. All Rights Reserved.\n * SPDX-License-Identifier: Apache-2.0\n */\nimport {\n  addDependenciesToPackageJson,\n  addProjectConfiguration,\n  type GeneratorCallback,\n  generateFiles,\n  joinPathFragments,\n  OverwriteStrategy,\n  type ProjectConfiguration,\n  type Tree,\n  updateProjectConfiguration,\n} from '@nx/devkit';\nimport { addAgentCoreGatewayInfra } from '../utils/agent-core-constructs/agent-core-constructs';\nimport { formatFilesInSubtree } from '../utils/format';\nimport { resolveIac } from '../utils/iac';\nimport { installDependencies } from '../utils/install';\nimport { addGeneratorMetricsIfApplicable } from '../utils/metrics';\nimport { kebabCase, toClassName } from '../utils/names';\nimport { getNpmScopePrefix } from '../utils/npm-scope';\nimport {\n  addGeneratorMetadata,\n  getGeneratorInfo,\n  type NxGeneratorInfo,\n  projectExists,\n  readProjectConfigurationUnqualified,\n} from '../utils/nx';\nimport { assignPort } from '../utils/port';\nimport { sharedConstructsGenerator } from '../utils/shared-constructs';\nimport { withVersions } from '../utils/versions';\nimport type { AgentcoreGatewayGeneratorSchema } from './schema';\n\nexport const AGENTCORE_GATEWAY_GENERATOR_INFO: NxGeneratorInfo =\n  getGeneratorInfo(import.meta.filename);\n\nexport const agentcoreGatewayGenerator = async (\n  tree: Tree,\n  options: AgentcoreGatewayGeneratorSchema,\n): Promise<GeneratorCallback> => {\n  const name = kebabCase(options.name);\n  const nameClassName = toClassName(name);\n  const parentDir = options.directory ?? 'packages';\n  const subDir = options.subDirectory ?? name;\n  const projectRoot = joinPathFragments(parentDir, subDir);\n  const fullyQualifiedName = `${getNpmScopePrefix(tree)}${name}`;\n\n  // Protocol / auth are fixed to mcp / iam in v1 — the enums accept only\n  // these values, but we still persist the resolved value in metadata so\n  // that connection generators can read it uniformly (and future additions\n  // are non-breaking).\n  const protocol = options.protocol ?? 'mcp';\n  const auth = options.auth ?? 'iam';\n  const cedarPolicy = options.cedarPolicy ?? true;\n  const infra = options.infra ?? 'agentcore';\n\n  // local-dev.ts is the local gateway: a continuous MCP aggregator chaining\n  // onto attached MCP servers' dev targets (added by the mcp-connection\n  // generator), so a single `nx dev <gateway>` boots the gateway and every\n  // attached MCP server together.\n  //\n  // `serve` exists for parity with other generators; the deployed Gateway is\n  // a managed AWS resource, so `serve`-mode agents talk to it via runtime\n  // config and the local gateway sits idle.\n  const localGatewayTarget = (port: number) => ({\n    executor: 'nx:run-commands' as const,\n    continuous: true,\n    options: {\n      command: 'tsx local-dev.ts',\n      cwd: '{projectRoot}',\n      env: { PORT: `${port}` },\n    },\n    dependsOn: [] as Array<string | { projects: string[]; target: string }>,\n  });\n  let project: ProjectConfiguration;\n  if (projectExists(tree, fullyQualifiedName)) {\n    project = readProjectConfigurationUnqualified(tree, fullyQualifiedName);\n  } else {\n    addProjectConfiguration(tree, fullyQualifiedName, {\n      name: fullyQualifiedName,\n      root: projectRoot,\n      projectType: 'library',\n      sourceRoot: projectRoot,\n      tags: [],\n      targets: {},\n      metadata: {\n        generator: AGENTCORE_GATEWAY_GENERATOR_INFO.id,\n      } as any,\n    });\n    project = readProjectConfigurationUnqualified(tree, fullyQualifiedName);\n  }\n  const port = assignPort(tree, project, 8100);\n  // A gateway is its own standalone project, so it uses plain `serve` / `dev`\n  // targets. Re-run: keep existing targets (their dependsOn may have been\n  // populated by the mcp-connection generator), just ensure both exist.\n  project.targets ??= {};\n  project.targets['serve'] ??= localGatewayTarget(port);\n  project.targets['dev'] ??= localGatewayTarget(port);\n  updateProjectConfiguration(tree, project.name, project);\n\n  // Scaffold the gateway project: local-dev.ts (+ Cedar policies if requested)\n  generateFiles(\n    tree,\n    joinPathFragments(import.meta.dirname, 'files', 'project'),\n    projectRoot,\n    { nameClassName, nameKebabCase: name, port, attachedMcpServers: [] },\n    { overwriteStrategy: OverwriteStrategy.KeepExisting },\n  );\n  if (cedarPolicy) {\n    generateFiles(\n      tree,\n      joinPathFragments(import.meta.dirname, 'files', 'cedar'),\n      projectRoot,\n      { nameClassName },\n      { overwriteStrategy: OverwriteStrategy.KeepExisting },\n    );\n  }\n\n  addGeneratorMetadata(\n    tree,\n    fullyQualifiedName,\n    AGENTCORE_GATEWAY_GENERATOR_INFO,\n    {\n      name,\n      rc: nameClassName,\n      protocol,\n      auth,\n      port,\n    },\n  );\n\n  // local-dev.ts dependencies (+ ejs for Cedar policy rendering in the\n  // shared gateway construct)\n  addDependenciesToPackageJson(\n    tree,\n    withVersions(['@modelcontextprotocol/sdk', 'express']),\n    withVersions(['tsx', '@types/express', 'ejs', '@types/ejs']),\n  );\n\n  // Wire up infra (CDK or Terraform); re-running with infra=agentcore adds\n  // the infrastructure to a previously infra-less gateway.\n  if (infra === 'agentcore') {\n    const iac = await resolveIac(tree, options.iac);\n    await sharedConstructsGenerator(tree, { iac });\n\n    await addAgentCoreGatewayInfra(tree, {\n      gatewayNameClassName: nameClassName,\n      gatewayNameKebabCase: name,\n      projectName: fullyQualifiedName,\n      projectDirectory: projectRoot,\n      cedarPolicy,\n      iac,\n    });\n  }\n\n  await addGeneratorMetricsIfApplicable(tree, [\n    AGENTCORE_GATEWAY_GENERATOR_INFO,\n  ]);\n\n  await formatFilesInSubtree(tree);\n  return () =>\n    installDependencies(tree, options.preferInstallDependencies, {\n      languages: ['typescript'],\n    });\n};\n\n/**\n * Gateway details stored in the gateway project's metadata.\n */\nexport interface AgentCoreGatewayMetadata {\n  name: string;\n  rc: string;\n  protocol: string;\n  auth: string;\n  port: number;\n}\n\n/**\n * Read a gateway project's metadata, validating it was generated by the\n * agentcore-gateway generator.\n */\nexport const readAgentCoreGatewayMetadata = (\n  project: ProjectConfiguration,\n): AgentCoreGatewayMetadata => {\n  const metadata = project.metadata as any;\n  if (metadata?.generator !== AGENTCORE_GATEWAY_GENERATOR_INFO.id) {\n    throw new Error(\n      `Project '${project.name}' was not generated by the '${AGENTCORE_GATEWAY_GENERATOR_INFO.id}' generator.`,\n    );\n  }\n  return metadata as AgentCoreGatewayMetadata;\n};\n\nexport default agentcoreGatewayGenerator;\n"],"names":["addDependenciesToPackageJson","addProjectConfiguration","generateFiles","joinPathFragments","OverwriteStrategy","updateProjectConfiguration","addAgentCoreGatewayInfra","formatFilesInSubtree","resolveIac","installDependencies","addGeneratorMetricsIfApplicable","kebabCase","toClassName","getNpmScopePrefix","addGeneratorMetadata","getGeneratorInfo","projectExists","readProjectConfigurationUnqualified","assignPort","sharedConstructsGenerator","withVersions","AGENTCORE_GATEWAY_GENERATOR_INFO","filename","agentcoreGatewayGenerator","tree","options","name","nameClassName","parentDir","directory","subDir","subDirectory","projectRoot","fullyQualifiedName","protocol","auth","cedarPolicy","infra","localGatewayTarget","port","executor","continuous","command","cwd","env","PORT","dependsOn","project","root","projectType","sourceRoot","tags","targets","metadata","generator","id","dirname","nameKebabCase","attachedMcpServers","overwriteStrategy","KeepExisting","rc","iac","gatewayNameClassName","gatewayNameKebabCase","projectName","projectDirectory","preferInstallDependencies","languages","readAgentCoreGatewayMetadata","Error"],"mappings":"AAAA;;;CAGC,GACD,SACEA,4BAA4B,EAC5BC,uBAAuB,EAEvBC,aAAa,EACbC,iBAAiB,EACjBC,iBAAiB,EAGjBC,0BAA0B,QACrB,aAAa;AACpB,SAASC,wBAAwB,QAAQ,0DAAuD;AAChG,SAASC,oBAAoB,QAAQ,qBAAkB;AACvD,SAASC,UAAU,QAAQ,kBAAe;AAC1C,SAASC,mBAAmB,QAAQ,sBAAmB;AACvD,SAASC,+BAA+B,QAAQ,sBAAmB;AACnE,SAASC,SAAS,EAAEC,WAAW,QAAQ,oBAAiB;AACxD,SAASC,iBAAiB,QAAQ,wBAAqB;AACvD,SACEC,oBAAoB,EACpBC,gBAAgB,EAEhBC,aAAa,EACbC,mCAAmC,QAC9B,iBAAc;AACrB,SAASC,UAAU,QAAQ,mBAAgB;AAC3C,SAASC,yBAAyB,QAAQ,gCAA6B;AACvE,SAASC,YAAY,QAAQ,uBAAoB;AAGjD,OAAO,MAAMC,mCACXN,iBAAiB,YAAYO,QAAQ,EAAE;AAEzC,OAAO,MAAMC,4BAA4B,OACvCC,MACAC;IAEA,MAAMC,OAAOf,UAAUc,QAAQC,IAAI;IACnC,MAAMC,gBAAgBf,YAAYc;IAClC,MAAME,YAAYH,QAAQI,SAAS,IAAI;IACvC,MAAMC,SAASL,QAAQM,YAAY,IAAIL;IACvC,MAAMM,cAAc7B,kBAAkByB,WAAWE;IACjD,MAAMG,qBAAqB,GAAGpB,kBAAkBW,QAAQE,MAAM;IAE9D,uEAAuE;IACvE,uEAAuE;IACvE,yEAAyE;IACzE,qBAAqB;IACrB,MAAMQ,WAAWT,QAAQS,QAAQ,IAAI;IACrC,MAAMC,OAAOV,QAAQU,IAAI,IAAI;IAC7B,MAAMC,cAAcX,QAAQW,WAAW,IAAI;IAC3C,MAAMC,QAAQZ,QAAQY,KAAK,IAAI;IAE/B,0EAA0E;IAC1E,sEAAsE;IACtE,yEAAyE;IACzE,gCAAgC;IAChC,EAAE;IACF,2EAA2E;IAC3E,wEAAwE;IACxE,0CAA0C;IAC1C,MAAMC,qBAAqB,CAACC,OAAkB,CAAA;YAC5CC,UAAU;YACVC,YAAY;YACZhB,SAAS;gBACPiB,SAAS;gBACTC,KAAK;gBACLC,KAAK;oBAAEC,MAAM,GAAGN,MAAM;gBAAC;YACzB;YACAO,WAAW,EAAE;QACf,CAAA;IACA,IAAIC;IACJ,IAAI/B,cAAcQ,MAAMS,qBAAqB;QAC3Cc,UAAU9B,oCAAoCO,MAAMS;IACtD,OAAO;QACLhC,wBAAwBuB,MAAMS,oBAAoB;YAChDP,MAAMO;YACNe,MAAMhB;YACNiB,aAAa;YACbC,YAAYlB;YACZmB,MAAM,EAAE;YACRC,SAAS,CAAC;YACVC,UAAU;gBACRC,WAAWjC,iCAAiCkC,EAAE;YAChD;QACF;QACAR,UAAU9B,oCAAoCO,MAAMS;IACtD;IACA,MAAMM,OAAOrB,WAAWM,MAAMuB,SAAS;IACvC,4EAA4E;IAC5E,wEAAwE;IACxE,sEAAsE;IACtEA,QAAQK,OAAO,KAAK,CAAC;IACrBL,QAAQK,OAAO,CAAC,QAAQ,KAAKd,mBAAmBC;IAChDQ,QAAQK,OAAO,CAAC,MAAM,KAAKd,mBAAmBC;IAC9ClC,2BAA2BmB,MAAMuB,QAAQrB,IAAI,EAAEqB;IAE/C,6EAA6E;IAC7E7C,cACEsB,MACArB,kBAAkB,YAAYqD,OAAO,EAAE,SAAS,YAChDxB,aACA;QAAEL;QAAe8B,eAAe/B;QAAMa;QAAMmB,oBAAoB,EAAE;IAAC,GACnE;QAAEC,mBAAmBvD,kBAAkBwD,YAAY;IAAC;IAEtD,IAAIxB,aAAa;QACflC,cACEsB,MACArB,kBAAkB,YAAYqD,OAAO,EAAE,SAAS,UAChDxB,aACA;YAAEL;QAAc,GAChB;YAAEgC,mBAAmBvD,kBAAkBwD,YAAY;QAAC;IAExD;IAEA9C,qBACEU,MACAS,oBACAZ,kCACA;QACEK;QACAmC,IAAIlC;QACJO;QACAC;QACAI;IACF;IAGF,qEAAqE;IACrE,4BAA4B;IAC5BvC,6BACEwB,MACAJ,aAAa;QAAC;QAA6B;KAAU,GACrDA,aAAa;QAAC;QAAO;QAAkB;QAAO;KAAa;IAG7D,yEAAyE;IACzE,yDAAyD;IACzD,IAAIiB,UAAU,aAAa;QACzB,MAAMyB,MAAM,MAAMtD,WAAWgB,MAAMC,QAAQqC,GAAG;QAC9C,MAAM3C,0BAA0BK,MAAM;YAAEsC;QAAI;QAE5C,MAAMxD,yBAAyBkB,MAAM;YACnCuC,sBAAsBpC;YACtBqC,sBAAsBtC;YACtBuC,aAAahC;YACbiC,kBAAkBlC;YAClBI;YACA0B;QACF;IACF;IAEA,MAAMpD,gCAAgCc,MAAM;QAC1CH;KACD;IAED,MAAMd,qBAAqBiB;IAC3B,OAAO,IACLf,oBAAoBe,MAAMC,QAAQ0C,yBAAyB,EAAE;YAC3DC,WAAW;gBAAC;aAAa;QAC3B;AACJ,EAAE;AAaF;;;CAGC,GACD,OAAO,MAAMC,+BAA+B,CAC1CtB;IAEA,MAAMM,WAAWN,QAAQM,QAAQ;IACjC,IAAIA,UAAUC,cAAcjC,iCAAiCkC,EAAE,EAAE;QAC/D,MAAM,IAAIe,MACR,CAAC,SAAS,EAAEvB,QAAQrB,IAAI,CAAC,4BAA4B,EAAEL,iCAAiCkC,EAAE,CAAC,YAAY,CAAC;IAE5G;IACA,OAAOF;AACT,EAAE;AAEF,eAAe9B,0BAA0B"}
+{"version":3,"sources":["../../../../../packages/nx-plugin/src/agentcore-gateway/generator.ts"],"sourcesContent":["/**\n * Copyright Amazon.com, Inc. or its affiliates. All Rights Reserved.\n * SPDX-License-Identifier: Apache-2.0\n */\nimport {\n  addDependenciesToPackageJson,\n  addProjectConfiguration,\n  type GeneratorCallback,\n  generateFiles,\n  joinPathFragments,\n  OverwriteStrategy,\n  type ProjectConfiguration,\n  type Tree,\n  updateProjectConfiguration,\n} from '@nx/devkit';\nimport { addAgentCoreGatewayInfra } from '../utils/agent-core-constructs/agent-core-constructs';\nimport { formatFilesInSubtree } from '../utils/format';\nimport { resolveIac } from '../utils/iac';\nimport { installDependencies } from '../utils/install';\nimport { addGeneratorMetricsIfApplicable } from '../utils/metrics';\nimport { kebabCase, toClassName } from '../utils/names';\nimport { getNpmScopePrefix } from '../utils/npm-scope';\nimport {\n  addGeneratorMetadata,\n  getGeneratorInfo,\n  type NxGeneratorInfo,\n  projectExists,\n  readProjectConfigurationUnqualified,\n} from '../utils/nx';\nimport { assignPort } from '../utils/port';\nimport { sharedConstructsGenerator } from '../utils/shared-constructs';\nimport { withVersions } from '../utils/versions';\nimport type { AgentcoreGatewayGeneratorSchema } from './schema';\n\nexport const AGENTCORE_GATEWAY_GENERATOR_INFO: NxGeneratorInfo =\n  getGeneratorInfo(import.meta.filename);\n\nexport const agentcoreGatewayGenerator = async (\n  tree: Tree,\n  options: AgentcoreGatewayGeneratorSchema,\n): Promise<GeneratorCallback> => {\n  const name = kebabCase(options.name);\n  const nameClassName = toClassName(name);\n  const parentDir = options.directory ?? 'packages';\n  const subDir = options.subDirectory ?? name;\n  const projectRoot = joinPathFragments(parentDir, subDir);\n  const fullyQualifiedName = `${getNpmScopePrefix(tree)}${name}`;\n\n  // Protocol is fixed to mcp — the enum accepts only this value, but we still\n  // persist the resolved value in metadata so connection generators can read\n  // it uniformly (and future additions are non-breaking).\n  const protocol = options.protocol ?? 'mcp';\n  // Inbound auth is iam (default) or cognito. Persisted in metadata so\n  // connection generators can validate it (agent -> gateway connections\n  // require an IAM gateway).\n  const auth = options.auth ?? 'iam';\n  const cedarPolicy = options.cedarPolicy ?? true;\n  const infra = options.infra ?? 'agentcore';\n\n  // local-dev.ts is the local gateway: a continuous MCP aggregator chaining\n  // onto attached MCP servers' dev targets (added by the mcp-connection\n  // generator), so a single `nx dev <gateway>` boots the gateway and every\n  // attached MCP server together.\n  //\n  // `serve` exists for parity with other generators; the deployed Gateway is\n  // a managed AWS resource, so `serve`-mode agents talk to it via runtime\n  // config and the local gateway sits idle.\n  const localGatewayTarget = (port: number) => ({\n    executor: 'nx:run-commands' as const,\n    continuous: true,\n    options: {\n      command: 'tsx local-dev.ts',\n      cwd: '{projectRoot}',\n      env: { PORT: `${port}` },\n    },\n    dependsOn: [] as Array<string | { projects: string[]; target: string }>,\n  });\n  let project: ProjectConfiguration;\n  if (projectExists(tree, fullyQualifiedName)) {\n    project = readProjectConfigurationUnqualified(tree, fullyQualifiedName);\n  } else {\n    addProjectConfiguration(tree, fullyQualifiedName, {\n      name: fullyQualifiedName,\n      root: projectRoot,\n      projectType: 'library',\n      sourceRoot: projectRoot,\n      tags: [],\n      targets: {},\n      metadata: {\n        generator: AGENTCORE_GATEWAY_GENERATOR_INFO.id,\n      } as any,\n    });\n    project = readProjectConfigurationUnqualified(tree, fullyQualifiedName);\n  }\n  const port = assignPort(tree, project, 8100);\n  // A gateway is its own standalone project, so it uses plain `serve` / `dev`\n  // targets. Re-run: keep existing targets (their dependsOn may have been\n  // populated by the mcp-connection generator), just ensure both exist.\n  project.targets ??= {};\n  project.targets['serve'] ??= localGatewayTarget(port);\n  project.targets['dev'] ??= localGatewayTarget(port);\n  updateProjectConfiguration(tree, project.name, project);\n\n  // Scaffold the gateway project: local-dev.ts (+ Cedar policies if requested)\n  generateFiles(\n    tree,\n    joinPathFragments(import.meta.dirname, 'files', 'project'),\n    projectRoot,\n    { nameClassName, nameKebabCase: name, port, attachedMcpServers: [] },\n    { overwriteStrategy: OverwriteStrategy.KeepExisting },\n  );\n  if (cedarPolicy) {\n    // The default permit-all policy differs by auth type: AgentCore represents\n    // IAM callers as `AgentCore::IamEntity` and Cognito/JWT callers as\n    // `AgentCore::OAuthUser`, so the two policies match different principals.\n    generateFiles(\n      tree,\n      joinPathFragments(import.meta.dirname, 'files', 'cedar'),\n      projectRoot,\n      { nameClassName, auth },\n      { overwriteStrategy: OverwriteStrategy.KeepExisting },\n    );\n  }\n\n  addGeneratorMetadata(\n    tree,\n    fullyQualifiedName,\n    AGENTCORE_GATEWAY_GENERATOR_INFO,\n    {\n      name,\n      rc: nameClassName,\n      protocol,\n      auth,\n      port,\n    },\n  );\n\n  // local-dev.ts dependencies (+ ejs for Cedar policy rendering in the\n  // shared gateway construct)\n  addDependenciesToPackageJson(\n    tree,\n    withVersions(['@modelcontextprotocol/sdk', 'express']),\n    withVersions(['tsx', '@types/express', 'ejs', '@types/ejs']),\n  );\n\n  // Wire up infra (CDK or Terraform); re-running with infra=agentcore adds\n  // the infrastructure to a previously infra-less gateway.\n  if (infra === 'agentcore') {\n    const iac = await resolveIac(tree, options.iac);\n    await sharedConstructsGenerator(tree, { iac });\n\n    await addAgentCoreGatewayInfra(tree, {\n      gatewayNameClassName: nameClassName,\n      gatewayNameKebabCase: name,\n      projectName: fullyQualifiedName,\n      projectDirectory: projectRoot,\n      cedarPolicy,\n      auth,\n      iac,\n    });\n  }\n\n  await addGeneratorMetricsIfApplicable(tree, [\n    AGENTCORE_GATEWAY_GENERATOR_INFO,\n  ]);\n\n  await formatFilesInSubtree(tree);\n  return () =>\n    installDependencies(tree, options.preferInstallDependencies, {\n      languages: ['typescript'],\n    });\n};\n\n/**\n * Gateway details stored in the gateway project's metadata.\n */\nexport interface AgentCoreGatewayMetadata {\n  name: string;\n  rc: string;\n  protocol: string;\n  auth: string;\n  port: number;\n}\n\n/**\n * Read a gateway project's metadata, validating it was generated by the\n * agentcore-gateway generator.\n */\nexport const readAgentCoreGatewayMetadata = (\n  project: ProjectConfiguration,\n): AgentCoreGatewayMetadata => {\n  const metadata = project.metadata as any;\n  if (metadata?.generator !== AGENTCORE_GATEWAY_GENERATOR_INFO.id) {\n    throw new Error(\n      `Project '${project.name}' was not generated by the '${AGENTCORE_GATEWAY_GENERATOR_INFO.id}' generator.`,\n    );\n  }\n  return metadata as AgentCoreGatewayMetadata;\n};\n\nexport default agentcoreGatewayGenerator;\n"],"names":["addDependenciesToPackageJson","addProjectConfiguration","generateFiles","joinPathFragments","OverwriteStrategy","updateProjectConfiguration","addAgentCoreGatewayInfra","formatFilesInSubtree","resolveIac","installDependencies","addGeneratorMetricsIfApplicable","kebabCase","toClassName","getNpmScopePrefix","addGeneratorMetadata","getGeneratorInfo","projectExists","readProjectConfigurationUnqualified","assignPort","sharedConstructsGenerator","withVersions","AGENTCORE_GATEWAY_GENERATOR_INFO","filename","agentcoreGatewayGenerator","tree","options","name","nameClassName","parentDir","directory","subDir","subDirectory","projectRoot","fullyQualifiedName","protocol","auth","cedarPolicy","infra","localGatewayTarget","port","executor","continuous","command","cwd","env","PORT","dependsOn","project","root","projectType","sourceRoot","tags","targets","metadata","generator","id","dirname","nameKebabCase","attachedMcpServers","overwriteStrategy","KeepExisting","rc","iac","gatewayNameClassName","gatewayNameKebabCase","projectName","projectDirectory","preferInstallDependencies","languages","readAgentCoreGatewayMetadata","Error"],"mappings":"AAAA;;;CAGC,GACD,SACEA,4BAA4B,EAC5BC,uBAAuB,EAEvBC,aAAa,EACbC,iBAAiB,EACjBC,iBAAiB,EAGjBC,0BAA0B,QACrB,aAAa;AACpB,SAASC,wBAAwB,QAAQ,0DAAuD;AAChG,SAASC,oBAAoB,QAAQ,qBAAkB;AACvD,SAASC,UAAU,QAAQ,kBAAe;AAC1C,SAASC,mBAAmB,QAAQ,sBAAmB;AACvD,SAASC,+BAA+B,QAAQ,sBAAmB;AACnE,SAASC,SAAS,EAAEC,WAAW,QAAQ,oBAAiB;AACxD,SAASC,iBAAiB,QAAQ,wBAAqB;AACvD,SACEC,oBAAoB,EACpBC,gBAAgB,EAEhBC,aAAa,EACbC,mCAAmC,QAC9B,iBAAc;AACrB,SAASC,UAAU,QAAQ,mBAAgB;AAC3C,SAASC,yBAAyB,QAAQ,gCAA6B;AACvE,SAASC,YAAY,QAAQ,uBAAoB;AAGjD,OAAO,MAAMC,mCACXN,iBAAiB,YAAYO,QAAQ,EAAE;AAEzC,OAAO,MAAMC,4BAA4B,OACvCC,MACAC;IAEA,MAAMC,OAAOf,UAAUc,QAAQC,IAAI;IACnC,MAAMC,gBAAgBf,YAAYc;IAClC,MAAME,YAAYH,QAAQI,SAAS,IAAI;IACvC,MAAMC,SAASL,QAAQM,YAAY,IAAIL;IACvC,MAAMM,cAAc7B,kBAAkByB,WAAWE;IACjD,MAAMG,qBAAqB,GAAGpB,kBAAkBW,QAAQE,MAAM;IAE9D,4EAA4E;IAC5E,2EAA2E;IAC3E,wDAAwD;IACxD,MAAMQ,WAAWT,QAAQS,QAAQ,IAAI;IACrC,qEAAqE;IACrE,sEAAsE;IACtE,2BAA2B;IAC3B,MAAMC,OAAOV,QAAQU,IAAI,IAAI;IAC7B,MAAMC,cAAcX,QAAQW,WAAW,IAAI;IAC3C,MAAMC,QAAQZ,QAAQY,KAAK,IAAI;IAE/B,0EAA0E;IAC1E,sEAAsE;IACtE,yEAAyE;IACzE,gCAAgC;IAChC,EAAE;IACF,2EAA2E;IAC3E,wEAAwE;IACxE,0CAA0C;IAC1C,MAAMC,qBAAqB,CAACC,OAAkB,CAAA;YAC5CC,UAAU;YACVC,YAAY;YACZhB,SAAS;gBACPiB,SAAS;gBACTC,KAAK;gBACLC,KAAK;oBAAEC,MAAM,GAAGN,MAAM;gBAAC;YACzB;YACAO,WAAW,EAAE;QACf,CAAA;IACA,IAAIC;IACJ,IAAI/B,cAAcQ,MAAMS,qBAAqB;QAC3Cc,UAAU9B,oCAAoCO,MAAMS;IACtD,OAAO;QACLhC,wBAAwBuB,MAAMS,oBAAoB;YAChDP,MAAMO;YACNe,MAAMhB;YACNiB,aAAa;YACbC,YAAYlB;YACZmB,MAAM,EAAE;YACRC,SAAS,CAAC;YACVC,UAAU;gBACRC,WAAWjC,iCAAiCkC,EAAE;YAChD;QACF;QACAR,UAAU9B,oCAAoCO,MAAMS;IACtD;IACA,MAAMM,OAAOrB,WAAWM,MAAMuB,SAAS;IACvC,4EAA4E;IAC5E,wEAAwE;IACxE,sEAAsE;IACtEA,QAAQK,OAAO,KAAK,CAAC;IACrBL,QAAQK,OAAO,CAAC,QAAQ,KAAKd,mBAAmBC;IAChDQ,QAAQK,OAAO,CAAC,MAAM,KAAKd,mBAAmBC;IAC9ClC,2BAA2BmB,MAAMuB,QAAQrB,IAAI,EAAEqB;IAE/C,6EAA6E;IAC7E7C,cACEsB,MACArB,kBAAkB,YAAYqD,OAAO,EAAE,SAAS,YAChDxB,aACA;QAAEL;QAAe8B,eAAe/B;QAAMa;QAAMmB,oBAAoB,EAAE;IAAC,GACnE;QAAEC,mBAAmBvD,kBAAkBwD,YAAY;IAAC;IAEtD,IAAIxB,aAAa;QACf,2EAA2E;QAC3E,mEAAmE;QACnE,0EAA0E;QAC1ElC,cACEsB,MACArB,kBAAkB,YAAYqD,OAAO,EAAE,SAAS,UAChDxB,aACA;YAAEL;YAAeQ;QAAK,GACtB;YAAEwB,mBAAmBvD,kBAAkBwD,YAAY;QAAC;IAExD;IAEA9C,qBACEU,MACAS,oBACAZ,kCACA;QACEK;QACAmC,IAAIlC;QACJO;QACAC;QACAI;IACF;IAGF,qEAAqE;IACrE,4BAA4B;IAC5BvC,6BACEwB,MACAJ,aAAa;QAAC;QAA6B;KAAU,GACrDA,aAAa;QAAC;QAAO;QAAkB;QAAO;KAAa;IAG7D,yEAAyE;IACzE,yDAAyD;IACzD,IAAIiB,UAAU,aAAa;QACzB,MAAMyB,MAAM,MAAMtD,WAAWgB,MAAMC,QAAQqC,GAAG;QAC9C,MAAM3C,0BAA0BK,MAAM;YAAEsC;QAAI;QAE5C,MAAMxD,yBAAyBkB,MAAM;YACnCuC,sBAAsBpC;YACtBqC,sBAAsBtC;YACtBuC,aAAahC;YACbiC,kBAAkBlC;YAClBI;YACAD;YACA2B;QACF;IACF;IAEA,MAAMpD,gCAAgCc,MAAM;QAC1CH;KACD;IAED,MAAMd,qBAAqBiB;IAC3B,OAAO,IACLf,oBAAoBe,MAAMC,QAAQ0C,yBAAyB,EAAE;YAC3DC,WAAW;gBAAC;aAAa;QAC3B;AACJ,EAAE;AAaF;;;CAGC,GACD,OAAO,MAAMC,+BAA+B,CAC1CtB;IAEA,MAAMM,WAAWN,QAAQM,QAAQ;IACjC,IAAIA,UAAUC,cAAcjC,iCAAiCkC,EAAE,EAAE;QAC/D,MAAM,IAAIe,MACR,CAAC,SAAS,EAAEvB,QAAQrB,IAAI,CAAC,4BAA4B,EAAEL,iCAAiCkC,EAAE,CAAC,YAAY,CAAC;IAE5G;IACA,OAAOF;AACT,EAAE;AAEF,eAAe9B,0BAA0B"}

package/src/agentcore-gateway/schema.d.js.map

@@ -1 +1 @@
-{"version":3,"sources":["../../../../../packages/nx-plugin/src/agentcore-gateway/schema.d.ts"],"sourcesContent":["/**\n * Copyright Amazon.com, Inc. or its affiliates. All Rights Reserved.\n * SPDX-License-Identifier: Apache-2.0\n */\nimport type { IacOption } from '../utils/iac';\n\nexport interface AgentcoreGatewayGeneratorSchema {\n  name: string;\n  directory?: string;\n  subDirectory?: string;\n  protocol?: 'mcp';\n  auth?: 'iam';\n  cedarPolicy?: boolean;\n  infra?: 'agentcore' | 'none';\n  iac: IacOption;\n  preferInstallDependencies?: boolean;\n}\n"],"names":[],"mappings":"AAAA;;;CAGC,GAGD,WAUC"}
+{"version":3,"sources":["../../../../../packages/nx-plugin/src/agentcore-gateway/schema.d.ts"],"sourcesContent":["/**\n * Copyright Amazon.com, Inc. or its affiliates. All Rights Reserved.\n * SPDX-License-Identifier: Apache-2.0\n */\nimport type { IacOption } from '../utils/iac';\n\nexport interface AgentcoreGatewayGeneratorSchema {\n  name: string;\n  directory?: string;\n  subDirectory?: string;\n  protocol?: 'mcp';\n  auth?: 'iam' | 'cognito';\n  cedarPolicy?: boolean;\n  infra?: 'agentcore' | 'none';\n  iac: IacOption;\n  preferInstallDependencies?: boolean;\n}\n"],"names":[],"mappings":"AAAA;;;CAGC,GAGD,WAUC"}

package/src/agentcore-gateway/schema.d.ts

@@ -9,7 +9,7 @@ export interface AgentcoreGatewayGeneratorSchema {
   directory?: string;
   subDirectory?: string;
   protocol?: 'mcp';
-  auth?: 'iam';
+  auth?: 'iam' | 'cognito';
   cedarPolicy?: boolean;
   infra?: 'agentcore' | 'none';
   iac: IacOption;

package/src/agentcore-gateway/schema.json

@@ -33,9 +33,10 @@
     },
     "auth": {
       "type": "string",
-      "description": "The method used to authenticate inbound requests to your gateway. Only iam is supported today; cognito and custom-jwt may be added in future.",
-      "enum": ["iam"],
+      "description": "The method used to authenticate inbound requests to your gateway. Only applicable when infra is set (ignored when infra is none).",
+      "enum": ["iam", "cognito"],
       "default": "iam",
+      "x-prompt": "How would you like to authenticate inbound requests to your gateway?",
       "x-priority": "important"
     },
     "cedarPolicy": {

package/src/mcp-server/tools/general-guidance.js

@@ -46,7 +46,7 @@ ${PACKAGE_MANAGERS.map((pm)=>buildNxCommand('<options>', pm)).join(' - \n')}
   - pnpm add -w -D <package>
   - yarn add -D <package>
   - npm install --legacy-peer-deps -D <package>
-  - bun install -D <package>
+  - bun add -D <package>
   - (Omit -D for production dependencies)
 - When specifying project names as arguments to generators, prefer the _fully qualified_ project name, for example \`@workspace-name/project-name\`. Check the \`project.json\` file for the specific package to find its fully qualified name
 - When no generator exists for a specific framework required, use the base \`ts#project\` and \`py#project\` generators and build on top.

package/src/mcp-server/tools/general-guidance.js.map

@@ -1 +1 @@
-{"version":3,"sources":["../../../../../../packages/nx-plugin/src/mcp-server/tools/general-guidance.ts"],"sourcesContent":["/**\n * Copyright Amazon.com, Inc. or its affiliates. All Rights Reserved.\n * SPDX-License-Identifier: Apache-2.0\n */\nimport type { McpServer } from '@modelcontextprotocol/sdk/server/mcp.js';\nimport type { NxGeneratorInfo } from '../../utils/generators';\nimport { IAC_PROVIDERS } from '../../utils/iac-providers';\nimport { buildNxCommand, fetchGuidePages } from '../generator-info';\nimport { PACKAGE_MANAGERS } from '../schema';\n\nexport const TOOL_SELECTION_GUIDE = `## Tool Selection Guide\n\n- Use the \\`general-guidance\\` tool for guidance and best practices for working with Nx and the Nx Plugin for AWS.\n- Use the \\`create-workspace-command\\` tool to discover how to create a workspace to start a new project.\n- Use the \\`add-to-existing-project\\` tool when adding the plugin to an existing Nx workspace or non-Nx monorepo, or when troubleshooting configuration errors in such a workspace.\n- Use the \\`list-generators\\` tool to discover the available generators and how to run them.\n- Use the \\`generator-guide\\` tool to retrieve detailed information about a specific generator.`;\n\n/**\n * Add a tool which provides general guidance for using Nx and the Nx Plugin for AWS\n */\nexport const addGeneralGuidanceTool = (\n  server: McpServer,\n  generators: NxGeneratorInfo[],\n) => {\n  server.registerTool(\n    'general-guidance',\n    {\n      title: 'General Guidance',\n      description:\n        'Tool for guidance and best practices for working with Nx and the Nx Plugin for AWS',\n    },\n    async () => ({\n      content: [\n        {\n          type: 'text' as const,\n          text: `# Nx Plugin for AWS Guidance\n\n${TOOL_SELECTION_GUIDE}\n\n## Getting Started\n\n- Choose a package manager first. You can choose between ${PACKAGE_MANAGERS.join(', ')}. It's recommended to use \"pnpm\" if the user has no preference\n- Choose an infrastructure as code (IaC) provider next. You can choose between ${IAC_PROVIDERS.join(', ')}. It's recommended to use CDK if the user has no preference\n- Next, you must create an Nx workspace. Use the \\`create-workspace-command\\` tool for more details, and provide it with your chosen package manager\n- After this, you can start scaffolding the main components of your application using generators. Use the \\`list-generators\\` tool to discover available generators, and the \\`generator-guide\\` tool for more detailed information about a specific generator\n\n## Nx Primer\n\n- Prefix nx commands with the appropriate prefix for your package manager, for example:\n${PACKAGE_MANAGERS.map((pm) => buildNxCommand('<options>', pm)).join(' - \\n')}\n- Each project in your workspace has a file named \\`project.json\\` which contains important project information such as its name, and defines the \"targets\" which can be run for that project, for example building or testing the project\n- Use the command \\`nx reset\\` to reset the Nx daemon when unexpected issues arise\n- After adding dependencies between TypeScript projects, use \\`nx sync\\` to ensure project references are set up correctly\n\n## General Instructions\n\n- Workspaces contain a single \\`package.json\\` file at the root which defines the dependencies for all projects. Therefore when installing dependencies, you must add these to the root workspace using the appropriate command for your package manager:\n  - pnpm add -w -D <package>\n  - yarn add -D <package>\n  - npm install --legacy-peer-deps -D <package>\n  - bun install -D <package>\n  - (Omit -D for production dependencies)\n- When specifying project names as arguments to generators, prefer the _fully qualified_ project name, for example \\`@workspace-name/project-name\\`. Check the \\`project.json\\` file for the specific package to find its fully qualified name\n- When no generator exists for a specific framework required, use the base \\`ts#project\\` and \\`py#project\\` generators and build on top.\n- Leave the \\`--infra\\` option at its default value unless the user has explicitly instructed otherwise. Generators choose a sensible default type of infrastructure to deploy the project with, so only override \\`--infra\\` when the user has specified a particular requirement.\n\n## Useful Commands\n\n- Fix lint issues with \\`nx run-many --target lint --configuration=fix --all --output-style=stream\\`\n- Build all projects with \\`nx run-many --target build --all --output-style=stream\\`\n- Prefer importing the CDK constructs vended by generators in \\`packages/common/constructs\\` over writing your own\n\n## Best Practices\n\n- After running a generator, use the \\`nx show projects\\` command to check which projects have been added (if any)\n- Carefully examine the files that have been generated and always refer back to the generator guide when working in a generated project\n- Generate all projects into the \\`packages/\\` directory\n- After making changes to your projects, fix linting issues, then run a full build\n- When it's time to start testing a project, suggest to the user that infrastructure is deployed to AWS. For websites, if a runtime-config.json is needed, use the load:runtime-config target after a deployment to point a local website at a sandbox stack.\n\n## Batching Generators\n\nWhen scaffolding several projects in one go, chain generators to avoid a slow dependency install after every generator:\n\n- **Chain generators** with \\`&&\\` in a single command. Pass \\`--prefer-install-dependencies=false\\` on each generator except the last so dependencies install once at the end, for example:\n\n${PACKAGE_MANAGERS.map(\n  (pm) => `  \\`\\`\\`bash\n  ${buildNxCommand('g @aws/nx-plugin:ts#trpc-api --no-interactive --name=my-app-api --auth=IAM --prefer-install-dependencies=false', pm)} && \\\\\n    ${buildNxCommand('g @aws/nx-plugin:ts#react-website --no-interactive --name=my-app-website --prefer-install-dependencies=false', pm)} && \\\\\n    ${buildNxCommand('g @aws/nx-plugin:connection --no-interactive --sourceProject=@my-app/my-app-website --targetProject=@my-app/my-app-api --prefer-install-dependencies=false', pm)} && \\\\\n    ${buildNxCommand('g @aws/nx-plugin:ts#infra --no-interactive --name=infra', pm)} && \\\\\n    ${buildNxCommand('sync', pm)}\n  \\`\\`\\``,\n).join('\\n')}\n\n- **\\`--prefer-install-dependencies=false\\`** asks a generator to defer its dependency install so the batch installs once at the end (the final generator above omits the flag and installs everything).\n- **\\`nx sync\\`** is required before building — generators modify TypeScript project references.\n\n## Detailed Guides\n\nPlease refer to the below documentation for important details regarding workspaces and working with TypeScript or Python projects.\n\n${await fetchGuidePages(['workspace', 'typescript-project', 'python-project'], generators)}\n\n    `,\n        },\n      ],\n    }),\n  );\n};\n"],"names":["IAC_PROVIDERS","buildNxCommand","fetchGuidePages","PACKAGE_MANAGERS","TOOL_SELECTION_GUIDE","addGeneralGuidanceTool","server","generators","registerTool","title","description","content","type","text","join","map","pm"],"mappings":"AAAA;;;CAGC,GAGD,SAASA,aAAa,QAAQ,+BAA4B;AAC1D,SAASC,cAAc,EAAEC,eAAe,QAAQ,uBAAoB;AACpE,SAASC,gBAAgB,QAAQ,eAAY;AAE7C,OAAO,MAAMC,uBAAuB,CAAC;;;;;;+FAM0D,CAAC,CAAC;AAEjG;;CAEC,GACD,OAAO,MAAMC,yBAAyB,CACpCC,QACAC;IAEAD,OAAOE,YAAY,CACjB,oBACA;QACEC,OAAO;QACPC,aACE;IACJ,GACA,UAAa,CAAA;YACXC,SAAS;gBACP;oBACEC,MAAM;oBACNC,MAAM,CAAC;;AAEjB,EAAET,qBAAqB;;;;yDAIkC,EAAED,iBAAiBW,IAAI,CAAC,MAAM;+EACR,EAAEd,cAAcc,IAAI,CAAC,MAAM;;;;;;;AAO1G,EAAEX,iBAAiBY,GAAG,CAAC,CAACC,KAAOf,eAAe,aAAae,KAAKF,IAAI,CAAC,SAAS;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAqC9E,EAAEX,iBAAiBY,GAAG,CACpB,CAACC,KAAO,CAAC;EACT,EAAEf,eAAe,kHAAkHe,IAAI;IACrI,EAAEf,eAAe,gHAAgHe,IAAI;IACrI,EAAEf,eAAe,8JAA8Je,IAAI;IACnL,EAAEf,eAAe,2DAA2De,IAAI;IAChF,EAAEf,eAAe,QAAQe,IAAI;QACzB,CAAC,EACPF,IAAI,CAAC,MAAM;;;;;;;;;AASb,EAAE,MAAMZ,gBAAgB;wBAAC;wBAAa;wBAAsB;qBAAiB,EAAEK,YAAY;;IAEvF,CAAC;gBACG;aACD;QACH,CAAA;AAEJ,EAAE"}
+{"version":3,"sources":["../../../../../../packages/nx-plugin/src/mcp-server/tools/general-guidance.ts"],"sourcesContent":["/**\n * Copyright Amazon.com, Inc. or its affiliates. All Rights Reserved.\n * SPDX-License-Identifier: Apache-2.0\n */\nimport type { McpServer } from '@modelcontextprotocol/sdk/server/mcp.js';\nimport type { NxGeneratorInfo } from '../../utils/generators';\nimport { IAC_PROVIDERS } from '../../utils/iac-providers';\nimport { buildNxCommand, fetchGuidePages } from '../generator-info';\nimport { PACKAGE_MANAGERS } from '../schema';\n\nexport const TOOL_SELECTION_GUIDE = `## Tool Selection Guide\n\n- Use the \\`general-guidance\\` tool for guidance and best practices for working with Nx and the Nx Plugin for AWS.\n- Use the \\`create-workspace-command\\` tool to discover how to create a workspace to start a new project.\n- Use the \\`add-to-existing-project\\` tool when adding the plugin to an existing Nx workspace or non-Nx monorepo, or when troubleshooting configuration errors in such a workspace.\n- Use the \\`list-generators\\` tool to discover the available generators and how to run them.\n- Use the \\`generator-guide\\` tool to retrieve detailed information about a specific generator.`;\n\n/**\n * Add a tool which provides general guidance for using Nx and the Nx Plugin for AWS\n */\nexport const addGeneralGuidanceTool = (\n  server: McpServer,\n  generators: NxGeneratorInfo[],\n) => {\n  server.registerTool(\n    'general-guidance',\n    {\n      title: 'General Guidance',\n      description:\n        'Tool for guidance and best practices for working with Nx and the Nx Plugin for AWS',\n    },\n    async () => ({\n      content: [\n        {\n          type: 'text' as const,\n          text: `# Nx Plugin for AWS Guidance\n\n${TOOL_SELECTION_GUIDE}\n\n## Getting Started\n\n- Choose a package manager first. You can choose between ${PACKAGE_MANAGERS.join(', ')}. It's recommended to use \"pnpm\" if the user has no preference\n- Choose an infrastructure as code (IaC) provider next. You can choose between ${IAC_PROVIDERS.join(', ')}. It's recommended to use CDK if the user has no preference\n- Next, you must create an Nx workspace. Use the \\`create-workspace-command\\` tool for more details, and provide it with your chosen package manager\n- After this, you can start scaffolding the main components of your application using generators. Use the \\`list-generators\\` tool to discover available generators, and the \\`generator-guide\\` tool for more detailed information about a specific generator\n\n## Nx Primer\n\n- Prefix nx commands with the appropriate prefix for your package manager, for example:\n${PACKAGE_MANAGERS.map((pm) => buildNxCommand('<options>', pm)).join(' - \\n')}\n- Each project in your workspace has a file named \\`project.json\\` which contains important project information such as its name, and defines the \"targets\" which can be run for that project, for example building or testing the project\n- Use the command \\`nx reset\\` to reset the Nx daemon when unexpected issues arise\n- After adding dependencies between TypeScript projects, use \\`nx sync\\` to ensure project references are set up correctly\n\n## General Instructions\n\n- Workspaces contain a single \\`package.json\\` file at the root which defines the dependencies for all projects. Therefore when installing dependencies, you must add these to the root workspace using the appropriate command for your package manager:\n  - pnpm add -w -D <package>\n  - yarn add -D <package>\n  - npm install --legacy-peer-deps -D <package>\n  - bun add -D <package>\n  - (Omit -D for production dependencies)\n- When specifying project names as arguments to generators, prefer the _fully qualified_ project name, for example \\`@workspace-name/project-name\\`. Check the \\`project.json\\` file for the specific package to find its fully qualified name\n- When no generator exists for a specific framework required, use the base \\`ts#project\\` and \\`py#project\\` generators and build on top.\n- Leave the \\`--infra\\` option at its default value unless the user has explicitly instructed otherwise. Generators choose a sensible default type of infrastructure to deploy the project with, so only override \\`--infra\\` when the user has specified a particular requirement.\n\n## Useful Commands\n\n- Fix lint issues with \\`nx run-many --target lint --configuration=fix --all --output-style=stream\\`\n- Build all projects with \\`nx run-many --target build --all --output-style=stream\\`\n- Prefer importing the CDK constructs vended by generators in \\`packages/common/constructs\\` over writing your own\n\n## Best Practices\n\n- After running a generator, use the \\`nx show projects\\` command to check which projects have been added (if any)\n- Carefully examine the files that have been generated and always refer back to the generator guide when working in a generated project\n- Generate all projects into the \\`packages/\\` directory\n- After making changes to your projects, fix linting issues, then run a full build\n- When it's time to start testing a project, suggest to the user that infrastructure is deployed to AWS. For websites, if a runtime-config.json is needed, use the load:runtime-config target after a deployment to point a local website at a sandbox stack.\n\n## Batching Generators\n\nWhen scaffolding several projects in one go, chain generators to avoid a slow dependency install after every generator:\n\n- **Chain generators** with \\`&&\\` in a single command. Pass \\`--prefer-install-dependencies=false\\` on each generator except the last so dependencies install once at the end, for example:\n\n${PACKAGE_MANAGERS.map(\n  (pm) => `  \\`\\`\\`bash\n  ${buildNxCommand('g @aws/nx-plugin:ts#trpc-api --no-interactive --name=my-app-api --auth=IAM --prefer-install-dependencies=false', pm)} && \\\\\n    ${buildNxCommand('g @aws/nx-plugin:ts#react-website --no-interactive --name=my-app-website --prefer-install-dependencies=false', pm)} && \\\\\n    ${buildNxCommand('g @aws/nx-plugin:connection --no-interactive --sourceProject=@my-app/my-app-website --targetProject=@my-app/my-app-api --prefer-install-dependencies=false', pm)} && \\\\\n    ${buildNxCommand('g @aws/nx-plugin:ts#infra --no-interactive --name=infra', pm)} && \\\\\n    ${buildNxCommand('sync', pm)}\n  \\`\\`\\``,\n).join('\\n')}\n\n- **\\`--prefer-install-dependencies=false\\`** asks a generator to defer its dependency install so the batch installs once at the end (the final generator above omits the flag and installs everything).\n- **\\`nx sync\\`** is required before building — generators modify TypeScript project references.\n\n## Detailed Guides\n\nPlease refer to the below documentation for important details regarding workspaces and working with TypeScript or Python projects.\n\n${await fetchGuidePages(['workspace', 'typescript-project', 'python-project'], generators)}\n\n    `,\n        },\n      ],\n    }),\n  );\n};\n"],"names":["IAC_PROVIDERS","buildNxCommand","fetchGuidePages","PACKAGE_MANAGERS","TOOL_SELECTION_GUIDE","addGeneralGuidanceTool","server","generators","registerTool","title","description","content","type","text","join","map","pm"],"mappings":"AAAA;;;CAGC,GAGD,SAASA,aAAa,QAAQ,+BAA4B;AAC1D,SAASC,cAAc,EAAEC,eAAe,QAAQ,uBAAoB;AACpE,SAASC,gBAAgB,QAAQ,eAAY;AAE7C,OAAO,MAAMC,uBAAuB,CAAC;;;;;;+FAM0D,CAAC,CAAC;AAEjG;;CAEC,GACD,OAAO,MAAMC,yBAAyB,CACpCC,QACAC;IAEAD,OAAOE,YAAY,CACjB,oBACA;QACEC,OAAO;QACPC,aACE;IACJ,GACA,UAAa,CAAA;YACXC,SAAS;gBACP;oBACEC,MAAM;oBACNC,MAAM,CAAC;;AAEjB,EAAET,qBAAqB;;;;yDAIkC,EAAED,iBAAiBW,IAAI,CAAC,MAAM;+EACR,EAAEd,cAAcc,IAAI,CAAC,MAAM;;;;;;;AAO1G,EAAEX,iBAAiBY,GAAG,CAAC,CAACC,KAAOf,eAAe,aAAae,KAAKF,IAAI,CAAC,SAAS;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAqC9E,EAAEX,iBAAiBY,GAAG,CACpB,CAACC,KAAO,CAAC;EACT,EAAEf,eAAe,kHAAkHe,IAAI;IACrI,EAAEf,eAAe,gHAAgHe,IAAI;IACrI,EAAEf,eAAe,8JAA8Je,IAAI;IACnL,EAAEf,eAAe,2DAA2De,IAAI;IAChF,EAAEf,eAAe,QAAQe,IAAI;QACzB,CAAC,EACPF,IAAI,CAAC,MAAM;;;;;;;;;AASb,EAAE,MAAMZ,gBAAgB;wBAAC;wBAAa;wBAAsB;qBAAiB,EAAEK,YAAY;;IAEvF,CAAC;gBACG;aACD;QACH,CAAA;AAEJ,EAAE"}

package/src/preset/__snapshots__/generator.spec.ts.snap

@@ -116,6 +116,8 @@ The following list of generators are what is currently available in the \`@aws/n
 
 - **ts#lambda-function**: Generate a TypeScript lambda function
 
+- **ts#dcr-proxy**: Generate an OAuth Dynamic Client Registration (DCR) proxy construct for Cognito-authenticated MCP servers
+
 - **ts#mcp-server**: Generate a TypeScript Model Context Protocol (MCP) server for providing context to Large Language Models
 
 - **ts#nx-generator**: Generator for adding an Nx Generator to an existing TypeScript project
@@ -243,7 +245,7 @@ export default {
 
 exports[`preset generator > should run successfully > biome.json 1`] = `
 "{
-  "$schema": "https://biomejs.dev/schemas/2.4.16/schema.json",
+  "$schema": "https://biomejs.dev/schemas/2.5.4/schema.json",
   "root": true,
   "formatter": {
     "enabled": true,
@@ -268,7 +270,7 @@ exports[`preset generator > should run successfully > biome.json 1`] = `
   "linter": {
     "enabled": true,
     "rules": {
-      "recommended": false,
+      "preset": "none",
       "correctness": {
         "noUndeclaredDependencies": "warn"
       }
@@ -354,6 +356,7 @@ exports[`preset generator > should run successfully > package.json 1`] = `
     "build": "nx run-many --target build",
     "lint": "nx run-many --target lint --configuration=fix",
     "test": "nx run-many --target test --all",
+    "trivy": "nx run-many --target trivy --all",
     "build:skip-lint": "nx run-many --target build --configuration=skip-lint",
     "build:all": "nx run-many --target build --all",
     "affected:all": "nx affected --target build"

package/src/py/agent/gateway-connection/generator.js

@@ -24,7 +24,7 @@ export const pyAgentGatewayConnectionGenerator = async (tree, options)=>{
         throw new Error(`Gateway '${gateway.name}' has protocol='${gateway.protocol}'. Only MCP-protocol gateways are supported.`);
     }
     if (gateway.auth !== 'iam') {
-        throw new Error(`Gateway '${gateway.name}' uses auth='${gateway.auth}'. Only IAM-authenticated gateways are supported in v1.`);
+        throw new Error(`Gateway '${gateway.name}' uses auth='${gateway.auth}'. Agent connections currently require the gateway to use IAM authentication.`);
     }
     if (agentComponent.auth && agentComponent.auth !== 'iam') {
         throw new Error(`Agent '${agentComponent.name}' uses auth='${agentComponent.auth}'. Only IAM-authenticated agents can connect to IAM gateways.`);

package/src/py/agent/gateway-connection/generator.js.map

@@ -1 +1 @@
-{"version":3,"sources":["../../../../../../../packages/nx-plugin/src/py/agent/gateway-connection/generator.ts"],"sourcesContent":["/**\n * Copyright Amazon.com, Inc. or its affiliates. All Rights Reserved.\n * SPDX-License-Identifier: Apache-2.0\n */\nimport {\n  type GeneratorCallback,\n  generateFiles,\n  joinPathFragments,\n  OverwriteStrategy,\n  type Tree,\n  updateProjectConfiguration,\n} from '@nx/devkit';\nimport { readAgentCoreGatewayMetadata } from '../../../agentcore-gateway/generator';\nimport {\n  addPythonCoreClient,\n  addPythonReExport,\n  ensurePythonAgentConnectionProject,\n  getPythonAgentConnectionModuleName,\n  getPythonAgentConnectionProject,\n  getPythonAgentConnectionProjectDir,\n  PY_MCP_FAMILY_CONNECTIONS,\n  resolveAgentFramework,\n} from '../../../utils/agent-connection/agent-connection';\nimport { addPythonDestructuredImport } from '../../../utils/ast';\nimport { formatFilesInSubtree } from '../../../utils/format';\nimport { installDependencies } from '../../../utils/install';\nimport { addGeneratorMetricsIfApplicable } from '../../../utils/metrics';\nimport { snakeCase } from '../../../utils/names';\nimport {\n  addDependencyToTargetIfNotPresent,\n  getGeneratorInfo,\n  type NxGeneratorInfo,\n  readProjectConfigurationUnqualified,\n} from '../../../utils/nx';\nimport {\n  addDependenciesToPyProjectToml,\n  addWorkspaceDependencyToPyProject,\n} from '../../../utils/py';\nimport type { PyAgentGatewayConnectionGeneratorSchema } from './schema';\n\nexport const PY_AGENT_GATEWAY_CONNECTION_GENERATOR_INFO: NxGeneratorInfo =\n  getGeneratorInfo(import.meta.filename);\n\nexport const pyAgentGatewayConnectionGenerator = async (\n  tree: Tree,\n  options: PyAgentGatewayConnectionGeneratorSchema,\n): Promise<GeneratorCallback> => {\n  const sourceProject = readProjectConfigurationUnqualified(\n    tree,\n    options.sourceProject,\n  );\n  const targetProject = readProjectConfigurationUnqualified(\n    tree,\n    options.targetProject,\n  );\n\n  const agentComponent = options.sourceComponent;\n  if (!agentComponent) {\n    throw new Error(\n      'sourceComponent must be provided for py#agent -> agentcore-gateway connections',\n    );\n  }\n  const gateway = readAgentCoreGatewayMetadata(targetProject);\n\n  if (gateway.protocol !== 'mcp') {\n    throw new Error(\n      `Gateway '${gateway.name}' has protocol='${gateway.protocol}'. Only MCP-protocol gateways are supported.`,\n    );\n  }\n  if (gateway.auth !== 'iam') {\n    throw new Error(\n      `Gateway '${gateway.name}' uses auth='${gateway.auth}'. Only IAM-authenticated gateways are supported in v1.`,\n    );\n  }\n  if (agentComponent.auth && agentComponent.auth !== 'iam') {\n    throw new Error(\n      `Agent '${agentComponent.name}' uses auth='${agentComponent.auth}'. Only IAM-authenticated agents can connect to IAM gateways.`,\n    );\n  }\n\n  const gatewayClassName = gateway.rc;\n  const gatewaySnakeCase = snakeCase(gatewayClassName);\n  // A gateway is its own standalone project, so it exposes plain serve / dev.\n  const gatewayServeTargetName = 'serve';\n  const gatewayDevTargetName = 'dev';\n\n  // The source agent's framework selects the client shape, dependencies and the\n  // agent.py transform — see PY_MCP_FAMILY_CONNECTIONS (keyed by framework, not a\n  // boolean, so a third framework is an additive entry there). A Gateway exposes\n  // its tools over MCP, so it reuses the same wiring as an MCP server connection.\n  const framework = resolveAgentFramework(agentComponent.framework);\n  const connection = PY_MCP_FAMILY_CONNECTIONS[framework];\n\n  await ensurePythonAgentConnectionProject(tree);\n  await addPythonCoreClient(tree, 'gateway', framework);\n\n  const agentConnectionProjectDir = getPythonAgentConnectionProjectDir(tree);\n  const agentConnectionModuleName = getPythonAgentConnectionModuleName(tree);\n\n  // Shared MCP transport + signed httpx auth deps, plus whatever extra deps the\n  // framework's MCP client needs (e.g. langchain-mcp-adapters for LangChain).\n  addDependenciesToPyProjectToml(tree, agentConnectionProjectDir, [\n    'boto3',\n    'httpx',\n    'mcp',\n    ...connection.deps,\n  ]);\n\n  const appDir = joinPathFragments(\n    agentConnectionProjectDir,\n    agentConnectionModuleName,\n    'app',\n  );\n  // Local mode points at the gateway project's local gateway port.\n  generateFiles(\n    tree,\n    joinPathFragments(\n      import.meta.dirname,\n      'files',\n      connection.appTemplateSubdir,\n    ),\n    appDir,\n    {\n      gatewaySnakeCase,\n      gatewayClassName,\n      agentConnectionModuleName,\n      gatewayPort: gateway.port,\n    },\n    { overwriteStrategy: OverwriteStrategy.KeepExisting },\n  );\n\n  const appInitPath = joinPathFragments(appDir, '__init__.py');\n  if (!tree.exists(appInitPath)) {\n    tree.write(appInitPath, '');\n  }\n\n  const moduleInitPath = joinPathFragments(\n    agentConnectionProjectDir,\n    agentConnectionModuleName,\n    '__init__.py',\n  );\n  await addPythonReExport(\n    tree,\n    moduleInitPath,\n    `.app.${gatewaySnakeCase}_client_${connection.clientModuleSuffix}`,\n    `${gatewayClassName}Client${connection.clientClassSuffix}`,\n  );\n\n  const agentSourceDir = joinPathFragments(\n    sourceProject.root,\n    agentComponent.path ?? 'src',\n  );\n  const agentFilePath = joinPathFragments(agentSourceDir, 'agent.py');\n\n  if (tree.exists(agentFilePath)) {\n    const clientClassName = `${gatewayClassName}Client${connection.clientClassSuffix}`;\n    const clientVarName = gatewaySnakeCase;\n\n    await addPythonDestructuredImport(\n      tree,\n      agentFilePath,\n      [clientClassName],\n      agentConnectionModuleName,\n    );\n    await connection.wireClientIntoAgent(\n      tree,\n      agentFilePath,\n      clientClassName,\n      clientVarName,\n    );\n  }\n\n  addWorkspaceDependencyToPyProject(\n    tree,\n    sourceProject,\n    getPythonAgentConnectionProject(tree),\n  );\n\n  const agentName = agentComponent.name ?? 'agent';\n  const serveTargetName = `${agentName}-serve`;\n  const devTargetName = `${agentName}-dev`;\n  let projectConfigChanged = false;\n  if (sourceProject.targets?.[serveTargetName]) {\n    addDependencyToTargetIfNotPresent(sourceProject, serveTargetName, {\n      projects: [targetProject.name],\n      target: gatewayServeTargetName,\n    });\n    projectConfigChanged = true;\n  }\n  if (sourceProject.targets?.[devTargetName]) {\n    addDependencyToTargetIfNotPresent(sourceProject, devTargetName, {\n      projects: [targetProject.name],\n      target: gatewayDevTargetName,\n    });\n    projectConfigChanged = true;\n  }\n  if (projectConfigChanged) {\n    updateProjectConfiguration(tree, sourceProject.name, sourceProject);\n  }\n\n  await addGeneratorMetricsIfApplicable(tree, [\n    PY_AGENT_GATEWAY_CONNECTION_GENERATOR_INFO,\n  ]);\n\n  await formatFilesInSubtree(tree);\n  return () =>\n    installDependencies(tree, options.preferInstallDependencies, {\n      languages: ['typescript'],\n    });\n};\n\nexport default pyAgentGatewayConnectionGenerator;\n"],"names":["generateFiles","joinPathFragments","OverwriteStrategy","updateProjectConfiguration","readAgentCoreGatewayMetadata","addPythonCoreClient","addPythonReExport","ensurePythonAgentConnectionProject","getPythonAgentConnectionModuleName","getPythonAgentConnectionProject","getPythonAgentConnectionProjectDir","PY_MCP_FAMILY_CONNECTIONS","resolveAgentFramework","addPythonDestructuredImport","formatFilesInSubtree","installDependencies","addGeneratorMetricsIfApplicable","snakeCase","addDependencyToTargetIfNotPresent","getGeneratorInfo","readProjectConfigurationUnqualified","addDependenciesToPyProjectToml","addWorkspaceDependencyToPyProject","PY_AGENT_GATEWAY_CONNECTION_GENERATOR_INFO","filename","pyAgentGatewayConnectionGenerator","tree","options","sourceProject","targetProject","agentComponent","sourceComponent","Error","gateway","protocol","name","auth","gatewayClassName","rc","gatewaySnakeCase","gatewayServeTargetName","gatewayDevTargetName","framework","connection","agentConnectionProjectDir","agentConnectionModuleName","deps","appDir","dirname","appTemplateSubdir","gatewayPort","port","overwriteStrategy","KeepExisting","appInitPath","exists","write","moduleInitPath","clientModuleSuffix","clientClassSuffix","agentSourceDir","root","path","agentFilePath","clientClassName","clientVarName","wireClientIntoAgent","agentName","serveTargetName","devTargetName","projectConfigChanged","targets","projects","target","preferInstallDependencies","languages"],"mappings":"AAAA;;;CAGC,GACD,SAEEA,aAAa,EACbC,iBAAiB,EACjBC,iBAAiB,EAEjBC,0BAA0B,QACrB,aAAa;AACpB,SAASC,4BAA4B,QAAQ,0CAAuC;AACpF,SACEC,mBAAmB,EACnBC,iBAAiB,EACjBC,kCAAkC,EAClCC,kCAAkC,EAClCC,+BAA+B,EAC/BC,kCAAkC,EAClCC,yBAAyB,EACzBC,qBAAqB,QAChB,sDAAmD;AAC1D,SAASC,2BAA2B,QAAQ,wBAAqB;AACjE,SAASC,oBAAoB,QAAQ,2BAAwB;AAC7D,SAASC,mBAAmB,QAAQ,4BAAyB;AAC7D,SAASC,+BAA+B,QAAQ,4BAAyB;AACzE,SAASC,SAAS,QAAQ,0BAAuB;AACjD,SACEC,iCAAiC,EACjCC,gBAAgB,EAEhBC,mCAAmC,QAC9B,uBAAoB;AAC3B,SACEC,8BAA8B,EAC9BC,iCAAiC,QAC5B,uBAAoB;AAG3B,OAAO,MAAMC,6CACXJ,iBAAiB,YAAYK,QAAQ,EAAE;AAEzC,OAAO,MAAMC,oCAAoC,OAC/CC,MACAC;IAEA,MAAMC,gBAAgBR,oCACpBM,MACAC,QAAQC,aAAa;IAEvB,MAAMC,gBAAgBT,oCACpBM,MACAC,QAAQE,aAAa;IAGvB,MAAMC,iBAAiBH,QAAQI,eAAe;IAC9C,IAAI,CAACD,gBAAgB;QACnB,MAAM,IAAIE,MACR;IAEJ;IACA,MAAMC,UAAU7B,6BAA6ByB;IAE7C,IAAII,QAAQC,QAAQ,KAAK,OAAO;QAC9B,MAAM,IAAIF,MACR,CAAC,SAAS,EAAEC,QAAQE,IAAI,CAAC,gBAAgB,EAAEF,QAAQC,QAAQ,CAAC,4CAA4C,CAAC;IAE7G;IACA,IAAID,QAAQG,IAAI,KAAK,OAAO;QAC1B,MAAM,IAAIJ,MACR,CAAC,SAAS,EAAEC,QAAQE,IAAI,CAAC,aAAa,EAAEF,QAAQG,IAAI,CAAC,uDAAuD,CAAC;IAEjH;IACA,IAAIN,eAAeM,IAAI,IAAIN,eAAeM,IAAI,KAAK,OAAO;QACxD,MAAM,IAAIJ,MACR,CAAC,OAAO,EAAEF,eAAeK,IAAI,CAAC,aAAa,EAAEL,eAAeM,IAAI,CAAC,6DAA6D,CAAC;IAEnI;IAEA,MAAMC,mBAAmBJ,QAAQK,EAAE;IACnC,MAAMC,mBAAmBtB,UAAUoB;IACnC,4EAA4E;IAC5E,MAAMG,yBAAyB;IAC/B,MAAMC,uBAAuB;IAE7B,8EAA8E;IAC9E,gFAAgF;IAChF,+EAA+E;IAC/E,gFAAgF;IAChF,MAAMC,YAAY9B,sBAAsBkB,eAAeY,SAAS;IAChE,MAAMC,aAAahC,yBAAyB,CAAC+B,UAAU;IAEvD,MAAMnC,mCAAmCmB;IACzC,MAAMrB,oBAAoBqB,MAAM,WAAWgB;IAE3C,MAAME,4BAA4BlC,mCAAmCgB;IACrE,MAAMmB,4BAA4BrC,mCAAmCkB;IAErE,8EAA8E;IAC9E,4EAA4E;IAC5EL,+BAA+BK,MAAMkB,2BAA2B;QAC9D;QACA;QACA;WACGD,WAAWG,IAAI;KACnB;IAED,MAAMC,SAAS9C,kBACb2C,2BACAC,2BACA;IAEF,iEAAiE;IACjE7C,cACE0B,MACAzB,kBACE,YAAY+C,OAAO,EACnB,SACAL,WAAWM,iBAAiB,GAE9BF,QACA;QACER;QACAF;QACAQ;QACAK,aAAajB,QAAQkB,IAAI;IAC3B,GACA;QAAEC,mBAAmBlD,kBAAkBmD,YAAY;IAAC;IAGtD,MAAMC,cAAcrD,kBAAkB8C,QAAQ;IAC9C,IAAI,CAACrB,KAAK6B,MAAM,CAACD,cAAc;QAC7B5B,KAAK8B,KAAK,CAACF,aAAa;IAC1B;IAEA,MAAMG,iBAAiBxD,kBACrB2C,2BACAC,2BACA;IAEF,MAAMvC,kBACJoB,MACA+B,gBACA,CAAC,KAAK,EAAElB,iBAAiB,QAAQ,EAAEI,WAAWe,kBAAkB,EAAE,EAClE,GAAGrB,iBAAiB,MAAM,EAAEM,WAAWgB,iBAAiB,EAAE;IAG5D,MAAMC,iBAAiB3D,kBACrB2B,cAAciC,IAAI,EAClB/B,eAAegC,IAAI,IAAI;IAEzB,MAAMC,gBAAgB9D,kBAAkB2D,gBAAgB;IAExD,IAAIlC,KAAK6B,MAAM,CAACQ,gBAAgB;QAC9B,MAAMC,kBAAkB,GAAG3B,iBAAiB,MAAM,EAAEM,WAAWgB,iBAAiB,EAAE;QAClF,MAAMM,gBAAgB1B;QAEtB,MAAM1B,4BACJa,MACAqC,eACA;YAACC;SAAgB,EACjBnB;QAEF,MAAMF,WAAWuB,mBAAmB,CAClCxC,MACAqC,eACAC,iBACAC;IAEJ;IAEA3C,kCACEI,MACAE,eACAnB,gCAAgCiB;IAGlC,MAAMyC,YAAYrC,eAAeK,IAAI,IAAI;IACzC,MAAMiC,kBAAkB,GAAGD,UAAU,MAAM,CAAC;IAC5C,MAAME,gBAAgB,GAAGF,UAAU,IAAI,CAAC;IACxC,IAAIG,uBAAuB;IAC3B,IAAI1C,cAAc2C,OAAO,EAAE,CAACH,gBAAgB,EAAE;QAC5ClD,kCAAkCU,eAAewC,iBAAiB;YAChEI,UAAU;gBAAC3C,cAAcM,IAAI;aAAC;YAC9BsC,QAAQjC;QACV;QACA8B,uBAAuB;IACzB;IACA,IAAI1C,cAAc2C,OAAO,EAAE,CAACF,cAAc,EAAE;QAC1CnD,kCAAkCU,eAAeyC,eAAe;YAC9DG,UAAU;gBAAC3C,cAAcM,IAAI;aAAC;YAC9BsC,QAAQhC;QACV;QACA6B,uBAAuB;IACzB;IACA,IAAIA,sBAAsB;QACxBnE,2BAA2BuB,MAAME,cAAcO,IAAI,EAAEP;IACvD;IAEA,MAAMZ,gCAAgCU,MAAM;QAC1CH;KACD;IAED,MAAMT,qBAAqBY;IAC3B,OAAO,IACLX,oBAAoBW,MAAMC,QAAQ+C,yBAAyB,EAAE;YAC3DC,WAAW;gBAAC;aAAa;QAC3B;AACJ,EAAE;AAEF,eAAelD,kCAAkC"}
+{"version":3,"sources":["../../../../../../../packages/nx-plugin/src/py/agent/gateway-connection/generator.ts"],"sourcesContent":["/**\n * Copyright Amazon.com, Inc. or its affiliates. All Rights Reserved.\n * SPDX-License-Identifier: Apache-2.0\n */\nimport {\n  type GeneratorCallback,\n  generateFiles,\n  joinPathFragments,\n  OverwriteStrategy,\n  type Tree,\n  updateProjectConfiguration,\n} from '@nx/devkit';\nimport { readAgentCoreGatewayMetadata } from '../../../agentcore-gateway/generator';\nimport {\n  addPythonCoreClient,\n  addPythonReExport,\n  ensurePythonAgentConnectionProject,\n  getPythonAgentConnectionModuleName,\n  getPythonAgentConnectionProject,\n  getPythonAgentConnectionProjectDir,\n  PY_MCP_FAMILY_CONNECTIONS,\n  resolveAgentFramework,\n} from '../../../utils/agent-connection/agent-connection';\nimport { addPythonDestructuredImport } from '../../../utils/ast';\nimport { formatFilesInSubtree } from '../../../utils/format';\nimport { installDependencies } from '../../../utils/install';\nimport { addGeneratorMetricsIfApplicable } from '../../../utils/metrics';\nimport { snakeCase } from '../../../utils/names';\nimport {\n  addDependencyToTargetIfNotPresent,\n  getGeneratorInfo,\n  type NxGeneratorInfo,\n  readProjectConfigurationUnqualified,\n} from '../../../utils/nx';\nimport {\n  addDependenciesToPyProjectToml,\n  addWorkspaceDependencyToPyProject,\n} from '../../../utils/py';\nimport type { PyAgentGatewayConnectionGeneratorSchema } from './schema';\n\nexport const PY_AGENT_GATEWAY_CONNECTION_GENERATOR_INFO: NxGeneratorInfo =\n  getGeneratorInfo(import.meta.filename);\n\nexport const pyAgentGatewayConnectionGenerator = async (\n  tree: Tree,\n  options: PyAgentGatewayConnectionGeneratorSchema,\n): Promise<GeneratorCallback> => {\n  const sourceProject = readProjectConfigurationUnqualified(\n    tree,\n    options.sourceProject,\n  );\n  const targetProject = readProjectConfigurationUnqualified(\n    tree,\n    options.targetProject,\n  );\n\n  const agentComponent = options.sourceComponent;\n  if (!agentComponent) {\n    throw new Error(\n      'sourceComponent must be provided for py#agent -> agentcore-gateway connections',\n    );\n  }\n  const gateway = readAgentCoreGatewayMetadata(targetProject);\n\n  if (gateway.protocol !== 'mcp') {\n    throw new Error(\n      `Gateway '${gateway.name}' has protocol='${gateway.protocol}'. Only MCP-protocol gateways are supported.`,\n    );\n  }\n  if (gateway.auth !== 'iam') {\n    throw new Error(\n      `Gateway '${gateway.name}' uses auth='${gateway.auth}'. Agent connections currently require the gateway to use IAM authentication.`,\n    );\n  }\n  if (agentComponent.auth && agentComponent.auth !== 'iam') {\n    throw new Error(\n      `Agent '${agentComponent.name}' uses auth='${agentComponent.auth}'. Only IAM-authenticated agents can connect to IAM gateways.`,\n    );\n  }\n\n  const gatewayClassName = gateway.rc;\n  const gatewaySnakeCase = snakeCase(gatewayClassName);\n  // A gateway is its own standalone project, so it exposes plain serve / dev.\n  const gatewayServeTargetName = 'serve';\n  const gatewayDevTargetName = 'dev';\n\n  // The source agent's framework selects the client shape, dependencies and the\n  // agent.py transform — see PY_MCP_FAMILY_CONNECTIONS (keyed by framework, not a\n  // boolean, so a third framework is an additive entry there). A Gateway exposes\n  // its tools over MCP, so it reuses the same wiring as an MCP server connection.\n  const framework = resolveAgentFramework(agentComponent.framework);\n  const connection = PY_MCP_FAMILY_CONNECTIONS[framework];\n\n  await ensurePythonAgentConnectionProject(tree);\n  await addPythonCoreClient(tree, 'gateway', framework);\n\n  const agentConnectionProjectDir = getPythonAgentConnectionProjectDir(tree);\n  const agentConnectionModuleName = getPythonAgentConnectionModuleName(tree);\n\n  // Shared MCP transport + signed httpx auth deps, plus whatever extra deps the\n  // framework's MCP client needs (e.g. langchain-mcp-adapters for LangChain).\n  addDependenciesToPyProjectToml(tree, agentConnectionProjectDir, [\n    'boto3',\n    'httpx',\n    'mcp',\n    ...connection.deps,\n  ]);\n\n  const appDir = joinPathFragments(\n    agentConnectionProjectDir,\n    agentConnectionModuleName,\n    'app',\n  );\n  // Local mode points at the gateway project's local gateway port.\n  generateFiles(\n    tree,\n    joinPathFragments(\n      import.meta.dirname,\n      'files',\n      connection.appTemplateSubdir,\n    ),\n    appDir,\n    {\n      gatewaySnakeCase,\n      gatewayClassName,\n      agentConnectionModuleName,\n      gatewayPort: gateway.port,\n    },\n    { overwriteStrategy: OverwriteStrategy.KeepExisting },\n  );\n\n  const appInitPath = joinPathFragments(appDir, '__init__.py');\n  if (!tree.exists(appInitPath)) {\n    tree.write(appInitPath, '');\n  }\n\n  const moduleInitPath = joinPathFragments(\n    agentConnectionProjectDir,\n    agentConnectionModuleName,\n    '__init__.py',\n  );\n  await addPythonReExport(\n    tree,\n    moduleInitPath,\n    `.app.${gatewaySnakeCase}_client_${connection.clientModuleSuffix}`,\n    `${gatewayClassName}Client${connection.clientClassSuffix}`,\n  );\n\n  const agentSourceDir = joinPathFragments(\n    sourceProject.root,\n    agentComponent.path ?? 'src',\n  );\n  const agentFilePath = joinPathFragments(agentSourceDir, 'agent.py');\n\n  if (tree.exists(agentFilePath)) {\n    const clientClassName = `${gatewayClassName}Client${connection.clientClassSuffix}`;\n    const clientVarName = gatewaySnakeCase;\n\n    await addPythonDestructuredImport(\n      tree,\n      agentFilePath,\n      [clientClassName],\n      agentConnectionModuleName,\n    );\n    await connection.wireClientIntoAgent(\n      tree,\n      agentFilePath,\n      clientClassName,\n      clientVarName,\n    );\n  }\n\n  addWorkspaceDependencyToPyProject(\n    tree,\n    sourceProject,\n    getPythonAgentConnectionProject(tree),\n  );\n\n  const agentName = agentComponent.name ?? 'agent';\n  const serveTargetName = `${agentName}-serve`;\n  const devTargetName = `${agentName}-dev`;\n  let projectConfigChanged = false;\n  if (sourceProject.targets?.[serveTargetName]) {\n    addDependencyToTargetIfNotPresent(sourceProject, serveTargetName, {\n      projects: [targetProject.name],\n      target: gatewayServeTargetName,\n    });\n    projectConfigChanged = true;\n  }\n  if (sourceProject.targets?.[devTargetName]) {\n    addDependencyToTargetIfNotPresent(sourceProject, devTargetName, {\n      projects: [targetProject.name],\n      target: gatewayDevTargetName,\n    });\n    projectConfigChanged = true;\n  }\n  if (projectConfigChanged) {\n    updateProjectConfiguration(tree, sourceProject.name, sourceProject);\n  }\n\n  await addGeneratorMetricsIfApplicable(tree, [\n    PY_AGENT_GATEWAY_CONNECTION_GENERATOR_INFO,\n  ]);\n\n  await formatFilesInSubtree(tree);\n  return () =>\n    installDependencies(tree, options.preferInstallDependencies, {\n      languages: ['typescript'],\n    });\n};\n\nexport default pyAgentGatewayConnectionGenerator;\n"],"names":["generateFiles","joinPathFragments","OverwriteStrategy","updateProjectConfiguration","readAgentCoreGatewayMetadata","addPythonCoreClient","addPythonReExport","ensurePythonAgentConnectionProject","getPythonAgentConnectionModuleName","getPythonAgentConnectionProject","getPythonAgentConnectionProjectDir","PY_MCP_FAMILY_CONNECTIONS","resolveAgentFramework","addPythonDestructuredImport","formatFilesInSubtree","installDependencies","addGeneratorMetricsIfApplicable","snakeCase","addDependencyToTargetIfNotPresent","getGeneratorInfo","readProjectConfigurationUnqualified","addDependenciesToPyProjectToml","addWorkspaceDependencyToPyProject","PY_AGENT_GATEWAY_CONNECTION_GENERATOR_INFO","filename","pyAgentGatewayConnectionGenerator","tree","options","sourceProject","targetProject","agentComponent","sourceComponent","Error","gateway","protocol","name","auth","gatewayClassName","rc","gatewaySnakeCase","gatewayServeTargetName","gatewayDevTargetName","framework","connection","agentConnectionProjectDir","agentConnectionModuleName","deps","appDir","dirname","appTemplateSubdir","gatewayPort","port","overwriteStrategy","KeepExisting","appInitPath","exists","write","moduleInitPath","clientModuleSuffix","clientClassSuffix","agentSourceDir","root","path","agentFilePath","clientClassName","clientVarName","wireClientIntoAgent","agentName","serveTargetName","devTargetName","projectConfigChanged","targets","projects","target","preferInstallDependencies","languages"],"mappings":"AAAA;;;CAGC,GACD,SAEEA,aAAa,EACbC,iBAAiB,EACjBC,iBAAiB,EAEjBC,0BAA0B,QACrB,aAAa;AACpB,SAASC,4BAA4B,QAAQ,0CAAuC;AACpF,SACEC,mBAAmB,EACnBC,iBAAiB,EACjBC,kCAAkC,EAClCC,kCAAkC,EAClCC,+BAA+B,EAC/BC,kCAAkC,EAClCC,yBAAyB,EACzBC,qBAAqB,QAChB,sDAAmD;AAC1D,SAASC,2BAA2B,QAAQ,wBAAqB;AACjE,SAASC,oBAAoB,QAAQ,2BAAwB;AAC7D,SAASC,mBAAmB,QAAQ,4BAAyB;AAC7D,SAASC,+BAA+B,QAAQ,4BAAyB;AACzE,SAASC,SAAS,QAAQ,0BAAuB;AACjD,SACEC,iCAAiC,EACjCC,gBAAgB,EAEhBC,mCAAmC,QAC9B,uBAAoB;AAC3B,SACEC,8BAA8B,EAC9BC,iCAAiC,QAC5B,uBAAoB;AAG3B,OAAO,MAAMC,6CACXJ,iBAAiB,YAAYK,QAAQ,EAAE;AAEzC,OAAO,MAAMC,oCAAoC,OAC/CC,MACAC;IAEA,MAAMC,gBAAgBR,oCACpBM,MACAC,QAAQC,aAAa;IAEvB,MAAMC,gBAAgBT,oCACpBM,MACAC,QAAQE,aAAa;IAGvB,MAAMC,iBAAiBH,QAAQI,eAAe;IAC9C,IAAI,CAACD,gBAAgB;QACnB,MAAM,IAAIE,MACR;IAEJ;IACA,MAAMC,UAAU7B,6BAA6ByB;IAE7C,IAAII,QAAQC,QAAQ,KAAK,OAAO;QAC9B,MAAM,IAAIF,MACR,CAAC,SAAS,EAAEC,QAAQE,IAAI,CAAC,gBAAgB,EAAEF,QAAQC,QAAQ,CAAC,4CAA4C,CAAC;IAE7G;IACA,IAAID,QAAQG,IAAI,KAAK,OAAO;QAC1B,MAAM,IAAIJ,MACR,CAAC,SAAS,EAAEC,QAAQE,IAAI,CAAC,aAAa,EAAEF,QAAQG,IAAI,CAAC,6EAA6E,CAAC;IAEvI;IACA,IAAIN,eAAeM,IAAI,IAAIN,eAAeM,IAAI,KAAK,OAAO;QACxD,MAAM,IAAIJ,MACR,CAAC,OAAO,EAAEF,eAAeK,IAAI,CAAC,aAAa,EAAEL,eAAeM,IAAI,CAAC,6DAA6D,CAAC;IAEnI;IAEA,MAAMC,mBAAmBJ,QAAQK,EAAE;IACnC,MAAMC,mBAAmBtB,UAAUoB;IACnC,4EAA4E;IAC5E,MAAMG,yBAAyB;IAC/B,MAAMC,uBAAuB;IAE7B,8EAA8E;IAC9E,gFAAgF;IAChF,+EAA+E;IAC/E,gFAAgF;IAChF,MAAMC,YAAY9B,sBAAsBkB,eAAeY,SAAS;IAChE,MAAMC,aAAahC,yBAAyB,CAAC+B,UAAU;IAEvD,MAAMnC,mCAAmCmB;IACzC,MAAMrB,oBAAoBqB,MAAM,WAAWgB;IAE3C,MAAME,4BAA4BlC,mCAAmCgB;IACrE,MAAMmB,4BAA4BrC,mCAAmCkB;IAErE,8EAA8E;IAC9E,4EAA4E;IAC5EL,+BAA+BK,MAAMkB,2BAA2B;QAC9D;QACA;QACA;WACGD,WAAWG,IAAI;KACnB;IAED,MAAMC,SAAS9C,kBACb2C,2BACAC,2BACA;IAEF,iEAAiE;IACjE7C,cACE0B,MACAzB,kBACE,YAAY+C,OAAO,EACnB,SACAL,WAAWM,iBAAiB,GAE9BF,QACA;QACER;QACAF;QACAQ;QACAK,aAAajB,QAAQkB,IAAI;IAC3B,GACA;QAAEC,mBAAmBlD,kBAAkBmD,YAAY;IAAC;IAGtD,MAAMC,cAAcrD,kBAAkB8C,QAAQ;IAC9C,IAAI,CAACrB,KAAK6B,MAAM,CAACD,cAAc;QAC7B5B,KAAK8B,KAAK,CAACF,aAAa;IAC1B;IAEA,MAAMG,iBAAiBxD,kBACrB2C,2BACAC,2BACA;IAEF,MAAMvC,kBACJoB,MACA+B,gBACA,CAAC,KAAK,EAAElB,iBAAiB,QAAQ,EAAEI,WAAWe,kBAAkB,EAAE,EAClE,GAAGrB,iBAAiB,MAAM,EAAEM,WAAWgB,iBAAiB,EAAE;IAG5D,MAAMC,iBAAiB3D,kBACrB2B,cAAciC,IAAI,EAClB/B,eAAegC,IAAI,IAAI;IAEzB,MAAMC,gBAAgB9D,kBAAkB2D,gBAAgB;IAExD,IAAIlC,KAAK6B,MAAM,CAACQ,gBAAgB;QAC9B,MAAMC,kBAAkB,GAAG3B,iBAAiB,MAAM,EAAEM,WAAWgB,iBAAiB,EAAE;QAClF,MAAMM,gBAAgB1B;QAEtB,MAAM1B,4BACJa,MACAqC,eACA;YAACC;SAAgB,EACjBnB;QAEF,MAAMF,WAAWuB,mBAAmB,CAClCxC,MACAqC,eACAC,iBACAC;IAEJ;IAEA3C,kCACEI,MACAE,eACAnB,gCAAgCiB;IAGlC,MAAMyC,YAAYrC,eAAeK,IAAI,IAAI;IACzC,MAAMiC,kBAAkB,GAAGD,UAAU,MAAM,CAAC;IAC5C,MAAME,gBAAgB,GAAGF,UAAU,IAAI,CAAC;IACxC,IAAIG,uBAAuB;IAC3B,IAAI1C,cAAc2C,OAAO,EAAE,CAACH,gBAAgB,EAAE;QAC5ClD,kCAAkCU,eAAewC,iBAAiB;YAChEI,UAAU;gBAAC3C,cAAcM,IAAI;aAAC;YAC9BsC,QAAQjC;QACV;QACA8B,uBAAuB;IACzB;IACA,IAAI1C,cAAc2C,OAAO,EAAE,CAACF,cAAc,EAAE;QAC1CnD,kCAAkCU,eAAeyC,eAAe;YAC9DG,UAAU;gBAAC3C,cAAcM,IAAI;aAAC;YAC9BsC,QAAQhC;QACV;QACA6B,uBAAuB;IACzB;IACA,IAAIA,sBAAsB;QACxBnE,2BAA2BuB,MAAME,cAAcO,IAAI,EAAEP;IACvD;IAEA,MAAMZ,gCAAgCU,MAAM;QAC1CH;KACD;IAED,MAAMT,qBAAqBY;IAC3B,OAAO,IACLX,oBAAoBW,MAAMC,QAAQ+C,yBAAyB,EAAE;YAC3DC,WAAW;gBAAC;aAAa;QAC3B;AACJ,EAAE;AAEF,eAAelD,kCAAkC"}

package/src/py/rdb/__snapshots__/generator.spec.ts.snap

@@ -170,6 +170,10 @@ def handler(event: dict[str, Any], _context: Any) -> dict[str, Any]:
 exports[`py#rdb generator > should generate MySQL dependencies and templates 4`] = `
 "FROM public.ecr.aws/lambda/python:3.14
 
+# Patch OS packages beyond the base image's pinned release so the image is
+# free of known HIGH/CRITICAL vulnerabilities
+RUN microdnf upgrade -y --releasever latest && microdnf clean all
+
 WORKDIR \${LAMBDA_TASK_ROOT}
 
 COPY . .
@@ -184,6 +188,10 @@ CMD ["proj_db.migration_handler.handler"]
 exports[`py#rdb generator > should generate MySQL dependencies and templates 5`] = `
 "FROM public.ecr.aws/lambda/python:3.14
 
+# Patch OS packages beyond the base image's pinned release so the image is
+# free of known HIGH/CRITICAL vulnerabilities
+RUN microdnf upgrade -y --releasever latest && microdnf clean all
+
 WORKDIR \${LAMBDA_TASK_ROOT}
 
 COPY . .
@@ -1396,6 +1404,10 @@ datefmt = %H:%M:%S
 exports[`py#rdb generator > should generate a PostgreSQL SQLModel project with Alembic 2`] = `
 "FROM public.ecr.aws/lambda/python:3.14
 
+# Patch OS packages beyond the base image's pinned release so the image is
+# free of known HIGH/CRITICAL vulnerabilities
+RUN microdnf upgrade -y --releasever latest && microdnf clean all
+
 WORKDIR \${LAMBDA_TASK_ROOT}
 
 COPY . .
@@ -1410,6 +1422,10 @@ CMD ["proj_db.migration_handler.handler"]
 exports[`py#rdb generator > should generate a PostgreSQL SQLModel project with Alembic 3`] = `
 "FROM public.ecr.aws/lambda/python:3.14
 
+# Patch OS packages beyond the base image's pinned release so the image is
+# free of known HIGH/CRITICAL vulnerabilities
+RUN microdnf upgrade -y --releasever latest && microdnf clean all
+
 WORKDIR \${LAMBDA_TASK_ROOT}
 
 COPY . .

package/src/py/rdb/files/Dockerfile.create-db-user.template

@@ -1,5 +1,9 @@
 FROM public.ecr.aws/lambda/python:3.14
 
+# Patch OS packages beyond the base image's pinned release so the image is
+# free of known HIGH/CRITICAL vulnerabilities
+RUN microdnf upgrade -y --releasever latest && microdnf clean all
+
 WORKDIR ${LAMBDA_TASK_ROOT}
 
 COPY . .

package/src/py/rdb/files/Dockerfile.migration.template

@@ -1,5 +1,9 @@
 FROM public.ecr.aws/lambda/python:3.14
 
+# Patch OS packages beyond the base image's pinned release so the image is
+# free of known HIGH/CRITICAL vulnerabilities
+RUN microdnf upgrade -y --releasever latest && microdnf clean all
+
 WORKDIR ${LAMBDA_TASK_ROOT}
 
 COPY . .

package/src/sdk/ts.d.ts

@@ -10,6 +10,8 @@ export { tsApiGenerator } from '../ts/api/generator';
 export type { TsApiGeneratorSchema } from '../ts/api/schema';
 export { tsDocsGenerator } from '../ts/docs/generator';
 export type { TsDocsGeneratorSchema } from '../ts/docs/schema';
+export { tsDcrProxyGenerator } from '../ts/dcr-proxy/generator';
+export type { TsDcrProxyGeneratorSchema } from '../ts/dcr-proxy/schema';
 export { tsDynamoDBGenerator } from '../ts/dynamodb/generator';
 export type { TsDynamoDBGeneratorSchema } from '../ts/dynamodb/schema';
 export { tsLambdaFunctionGenerator } from '../ts/lambda-function/generator';

package/src/sdk/ts.js

@@ -9,6 +9,8 @@ export { tsAgentGenerator } from "../ts/agent/generator.js";
 export { tsApiGenerator } from "../ts/api/generator.js";
 // Documentation Site Generator
 export { tsDocsGenerator } from "../ts/docs/generator.js";
+// TypeScript DCR Proxy Generator
+export { tsDcrProxyGenerator } from "../ts/dcr-proxy/generator.js";
 // DynamoDB Generator
 export { tsDynamoDBGenerator } from "../ts/dynamodb/generator.js";
 // TypeScript Lambda Function

package/src/sdk/ts.js.map

@@ -1 +1 @@
-{"version":3,"sources":["../../../../../packages/nx-plugin/src/sdk/ts.ts"],"sourcesContent":["/**\n * Copyright Amazon.com, Inc. or its affiliates. All Rights Reserved.\n * SPDX-License-Identifier: Apache-2.0\n */\n\n// TypeScript Infrastructure\nexport { tsInfraGenerator } from '../infra/app/generator';\nexport type { TsInfraGeneratorSchema } from '../infra/app/schema';\n// TypeScript Agent Generator\nexport { tsAgentGenerator } from '../ts/agent/generator';\nexport type { TsAgentGeneratorSchema } from '../ts/agent/schema';\n// TypeScript API\nexport { tsApiGenerator } from '../ts/api/generator';\nexport type { TsApiGeneratorSchema } from '../ts/api/schema';\n// Documentation Site Generator\nexport { tsDocsGenerator } from '../ts/docs/generator';\nexport type { TsDocsGeneratorSchema } from '../ts/docs/schema';\n// DynamoDB Generator\nexport { tsDynamoDBGenerator } from '../ts/dynamodb/generator';\nexport type { TsDynamoDBGeneratorSchema } from '../ts/dynamodb/schema';\n// TypeScript Lambda Function\nexport { tsLambdaFunctionGenerator } from '../ts/lambda-function/generator';\nexport type { TsLambdaFunctionGeneratorSchema } from '../ts/lambda-function/schema';\n// TypeScript Project Generator\nexport { tsProjectGenerator } from '../ts/lib/generator';\nexport type { TsProjectGeneratorSchema } from '../ts/lib/schema';\n// TypeScript MCP Server Generator\nexport { tsMcpServerGenerator } from '../ts/mcp-server/generator';\nexport type { TsMcpServerGeneratorSchema } from '../ts/mcp-server/schema';\n// TypeScript Nx Generator Generator\nexport { tsNxGeneratorGenerator } from '../ts/nx-generator/generator';\nexport type { TsNxGeneratorGeneratorSchema } from '../ts/nx-generator/schema';\n// TypeScript Nx Plugin Generator\nexport { tsNxPluginGenerator } from '../ts/nx-plugin/generator';\nexport type { TsNxPluginGeneratorSchema } from '../ts/nx-plugin/schema';\n// Relational Database Generator\nexport { tsRdbGenerator } from '../ts/rdb/generator';\nexport type { TsRdbGeneratorSchema } from '../ts/rdb/schema';\n// Runtime Config\nexport { runtimeConfigGenerator } from '../ts/react-website/runtime-config/generator';\nexport type { RuntimeConfigGeneratorSchema } from '../ts/react-website/runtime-config/schema';\n// TypeScript Website Generator\nexport { tsWebsiteGenerator } from '../ts/website/app/generator';\nexport type { TsWebsiteGeneratorSchema } from '../ts/website/app/schema';\n// TypeScript Website Auth Generator\nexport { tsWebsiteAuthGenerator } from '../ts/website/auth/generator';\nexport type { TsWebsiteAuthGeneratorSchema } from '../ts/website/auth/schema';\n\n// Shared Constructs\nexport { sharedConstructsGenerator } from '../utils/shared-constructs';\n"],"names":["tsInfraGenerator","tsAgentGenerator","tsApiGenerator","tsDocsGenerator","tsDynamoDBGenerator","tsLambdaFunctionGenerator","tsProjectGenerator","tsMcpServerGenerator","tsNxGeneratorGenerator","tsNxPluginGenerator","tsRdbGenerator","runtimeConfigGenerator","tsWebsiteGenerator","tsWebsiteAuthGenerator","sharedConstructsGenerator"],"mappings":"AAAA;;;CAGC,GAED,4BAA4B;AAC5B,SAASA,gBAAgB,QAAQ,4BAAyB;AAE1D,6BAA6B;AAC7B,SAASC,gBAAgB,QAAQ,2BAAwB;AAEzD,iBAAiB;AACjB,SAASC,cAAc,QAAQ,yBAAsB;AAErD,+BAA+B;AAC/B,SAASC,eAAe,QAAQ,0BAAuB;AAEvD,qBAAqB;AACrB,SAASC,mBAAmB,QAAQ,8BAA2B;AAE/D,6BAA6B;AAC7B,SAASC,yBAAyB,QAAQ,qCAAkC;AAE5E,+BAA+B;AAC/B,SAASC,kBAAkB,QAAQ,yBAAsB;AAEzD,kCAAkC;AAClC,SAASC,oBAAoB,QAAQ,gCAA6B;AAElE,oCAAoC;AACpC,SAASC,sBAAsB,QAAQ,kCAA+B;AAEtE,iCAAiC;AACjC,SAASC,mBAAmB,QAAQ,+BAA4B;AAEhE,gCAAgC;AAChC,SAASC,cAAc,QAAQ,yBAAsB;AAErD,iBAAiB;AACjB,SAASC,sBAAsB,QAAQ,kDAA+C;AAEtF,+BAA+B;AAC/B,SAASC,kBAAkB,QAAQ,iCAA8B;AAEjE,oCAAoC;AACpC,SAASC,sBAAsB,QAAQ,kCAA+B;AAGtE,oBAAoB;AACpB,SAASC,yBAAyB,QAAQ,gCAA6B"}
+{"version":3,"sources":["../../../../../packages/nx-plugin/src/sdk/ts.ts"],"sourcesContent":["/**\n * Copyright Amazon.com, Inc. or its affiliates. All Rights Reserved.\n * SPDX-License-Identifier: Apache-2.0\n */\n\n// TypeScript Infrastructure\nexport { tsInfraGenerator } from '../infra/app/generator';\nexport type { TsInfraGeneratorSchema } from '../infra/app/schema';\n// TypeScript Agent Generator\nexport { tsAgentGenerator } from '../ts/agent/generator';\nexport type { TsAgentGeneratorSchema } from '../ts/agent/schema';\n// TypeScript API\nexport { tsApiGenerator } from '../ts/api/generator';\nexport type { TsApiGeneratorSchema } from '../ts/api/schema';\n// Documentation Site Generator\nexport { tsDocsGenerator } from '../ts/docs/generator';\nexport type { TsDocsGeneratorSchema } from '../ts/docs/schema';\n// TypeScript DCR Proxy Generator\nexport { tsDcrProxyGenerator } from '../ts/dcr-proxy/generator';\nexport type { TsDcrProxyGeneratorSchema } from '../ts/dcr-proxy/schema';\n// DynamoDB Generator\nexport { tsDynamoDBGenerator } from '../ts/dynamodb/generator';\nexport type { TsDynamoDBGeneratorSchema } from '../ts/dynamodb/schema';\n// TypeScript Lambda Function\nexport { tsLambdaFunctionGenerator } from '../ts/lambda-function/generator';\nexport type { TsLambdaFunctionGeneratorSchema } from '../ts/lambda-function/schema';\n// TypeScript Project Generator\nexport { tsProjectGenerator } from '../ts/lib/generator';\nexport type { TsProjectGeneratorSchema } from '../ts/lib/schema';\n// TypeScript MCP Server Generator\nexport { tsMcpServerGenerator } from '../ts/mcp-server/generator';\nexport type { TsMcpServerGeneratorSchema } from '../ts/mcp-server/schema';\n// TypeScript Nx Generator Generator\nexport { tsNxGeneratorGenerator } from '../ts/nx-generator/generator';\nexport type { TsNxGeneratorGeneratorSchema } from '../ts/nx-generator/schema';\n// TypeScript Nx Plugin Generator\nexport { tsNxPluginGenerator } from '../ts/nx-plugin/generator';\nexport type { TsNxPluginGeneratorSchema } from '../ts/nx-plugin/schema';\n// Relational Database Generator\nexport { tsRdbGenerator } from '../ts/rdb/generator';\nexport type { TsRdbGeneratorSchema } from '../ts/rdb/schema';\n// Runtime Config\nexport { runtimeConfigGenerator } from '../ts/react-website/runtime-config/generator';\nexport type { RuntimeConfigGeneratorSchema } from '../ts/react-website/runtime-config/schema';\n// TypeScript Website Generator\nexport { tsWebsiteGenerator } from '../ts/website/app/generator';\nexport type { TsWebsiteGeneratorSchema } from '../ts/website/app/schema';\n// TypeScript Website Auth Generator\nexport { tsWebsiteAuthGenerator } from '../ts/website/auth/generator';\nexport type { TsWebsiteAuthGeneratorSchema } from '../ts/website/auth/schema';\n\n// Shared Constructs\nexport { sharedConstructsGenerator } from '../utils/shared-constructs';\n"],"names":["tsInfraGenerator","tsAgentGenerator","tsApiGenerator","tsDocsGenerator","tsDcrProxyGenerator","tsDynamoDBGenerator","tsLambdaFunctionGenerator","tsProjectGenerator","tsMcpServerGenerator","tsNxGeneratorGenerator","tsNxPluginGenerator","tsRdbGenerator","runtimeConfigGenerator","tsWebsiteGenerator","tsWebsiteAuthGenerator","sharedConstructsGenerator"],"mappings":"AAAA;;;CAGC,GAED,4BAA4B;AAC5B,SAASA,gBAAgB,QAAQ,4BAAyB;AAE1D,6BAA6B;AAC7B,SAASC,gBAAgB,QAAQ,2BAAwB;AAEzD,iBAAiB;AACjB,SAASC,cAAc,QAAQ,yBAAsB;AAErD,+BAA+B;AAC/B,SAASC,eAAe,QAAQ,0BAAuB;AAEvD,iCAAiC;AACjC,SAASC,mBAAmB,QAAQ,+BAA4B;AAEhE,qBAAqB;AACrB,SAASC,mBAAmB,QAAQ,8BAA2B;AAE/D,6BAA6B;AAC7B,SAASC,yBAAyB,QAAQ,qCAAkC;AAE5E,+BAA+B;AAC/B,SAASC,kBAAkB,QAAQ,yBAAsB;AAEzD,kCAAkC;AAClC,SAASC,oBAAoB,QAAQ,gCAA6B;AAElE,oCAAoC;AACpC,SAASC,sBAAsB,QAAQ,kCAA+B;AAEtE,iCAAiC;AACjC,SAASC,mBAAmB,QAAQ,+BAA4B;AAEhE,gCAAgC;AAChC,SAASC,cAAc,QAAQ,yBAAsB;AAErD,iBAAiB;AACjB,SAASC,sBAAsB,QAAQ,kDAA+C;AAEtF,+BAA+B;AAC/B,SAASC,kBAAkB,QAAQ,iCAA8B;AAEjE,oCAAoC;AACpC,SAASC,sBAAsB,QAAQ,kCAA+B;AAGtE,oBAAoB;AACpB,SAASC,yBAAyB,QAAQ,gCAA6B"}

package/src/ts/agent/__snapshots__/generator.spec.ts.snap

@@ -574,7 +574,11 @@ WORKDIR /app
 
 # Add AWS Distro for OpenTelemetry for observability
 # https://docs.aws.amazon.com/bedrock-agentcore/latest/devguide/observability-configure.html
-RUN npm install @aws/aws-distro-opentelemetry-node-autoinstrumentation@0.12.0
+# The override pins @opentelemetry/propagator-jaeger above the version the
+# autoinstrumentation package resolves transitively, clearing CVE-2026-59892.
+RUN npm init -y \\
+  && npm pkg set "overrides.@opentelemetry/propagator-jaeger=2.9.0" \\
+  && npm install @aws/aws-distro-opentelemetry-node-autoinstrumentation@0.12.0
 
 # Copy bundled agent
 COPY index.js /app

package/src/ts/agent/files/deploy/Dockerfile.template

@@ -7,7 +7,11 @@ WORKDIR /app
 
 # Add AWS Distro for OpenTelemetry for observability
 # https://docs.aws.amazon.com/bedrock-agentcore/latest/devguide/observability-configure.html
-RUN npm install @aws/aws-distro-opentelemetry-node-autoinstrumentation@<%- adotVersion %>
+# The override pins @opentelemetry/propagator-jaeger above the version the
+# autoinstrumentation package resolves transitively, clearing CVE-2026-59892.
+RUN npm init -y \
+  && npm pkg set "overrides.@opentelemetry/propagator-jaeger=<%- jaegerVersion %>" \
+  && npm install @aws/aws-distro-opentelemetry-node-autoinstrumentation@<%- adotVersion %>
 
 # Copy bundled agent
 COPY index.js /app

package/src/ts/agent/gateway-connection/generator.js

@@ -26,7 +26,7 @@ export const tsAgentGatewayConnectionGenerator = async (tree, options)=>{
         throw new Error(`Gateway '${gateway.name}' has protocol='${gateway.protocol}'. Only MCP-protocol gateways are supported.`);
     }
     if (gateway.auth !== 'iam') {
-        throw new Error(`Gateway '${gateway.name}' uses auth='${gateway.auth}'. Only IAM-authenticated gateways are supported in v1.`);
+        throw new Error(`Gateway '${gateway.name}' uses auth='${gateway.auth}'. Agent connections currently require the gateway to use IAM authentication.`);
     }
     if (agentComponent.auth && agentComponent.auth !== 'iam') {
         throw new Error(`Agent '${agentComponent.name}' uses auth='${agentComponent.auth}'. Only IAM-authenticated agents can connect to IAM gateways.`);

package/src/ts/agent/gateway-connection/generator.js.map

@@ -1 +1 @@
-{"version":3,"sources":["../../../../../../../packages/nx-plugin/src/ts/agent/gateway-connection/generator.ts"],"sourcesContent":["/**\n * Copyright Amazon.com, Inc. or its affiliates. All Rights Reserved.\n * SPDX-License-Identifier: Apache-2.0\n */\nimport {\n  addDependenciesToPackageJson,\n  type GeneratorCallback,\n  generateFiles,\n  joinPathFragments,\n  OverwriteStrategy,\n  type Tree,\n  updateProjectConfiguration,\n} from '@nx/devkit';\nimport { readAgentCoreGatewayMetadata } from '../../../agentcore-gateway/generator';\nimport {\n  AGENT_CONNECTION_PROJECT_DIR,\n  addTypeScriptClientToAgent,\n  addTypeScriptCoreClient,\n  ensureTypeScriptAgentConnectionProject,\n} from '../../../utils/agent-connection/agent-connection';\nimport { addDestructuredImport, addStarExport } from '../../../utils/ast';\nimport { formatFilesInSubtree } from '../../../utils/format';\nimport { installDependencies } from '../../../utils/install';\nimport { addGeneratorMetricsIfApplicable } from '../../../utils/metrics';\nimport { esmVars } from '../../../utils/module-format';\nimport { kebabCase } from '../../../utils/names';\nimport { getNpmScope } from '../../../utils/npm-scope';\nimport {\n  addDependencyToTargetIfNotPresent,\n  getGeneratorInfo,\n  type NxGeneratorInfo,\n  readProjectConfigurationUnqualified,\n} from '../../../utils/nx';\nimport { withVersions } from '../../../utils/versions';\nimport type { TsAgentGatewayConnectionGeneratorSchema } from './schema';\n\nexport const TS_AGENT_GATEWAY_CONNECTION_GENERATOR_INFO: NxGeneratorInfo =\n  getGeneratorInfo(import.meta.filename);\n\nexport const tsAgentGatewayConnectionGenerator = async (\n  tree: Tree,\n  options: TsAgentGatewayConnectionGeneratorSchema,\n): Promise<GeneratorCallback> => {\n  const sourceProject = readProjectConfigurationUnqualified(\n    tree,\n    options.sourceProject,\n  );\n  const targetProject = readProjectConfigurationUnqualified(\n    tree,\n    options.targetProject,\n  );\n\n  const agentComponent = options.sourceComponent;\n  if (!agentComponent) {\n    throw new Error(\n      'sourceComponent must be provided for ts#agent -> agentcore-gateway connections',\n    );\n  }\n  const gateway = readAgentCoreGatewayMetadata(targetProject);\n\n  if (gateway.protocol !== 'mcp') {\n    throw new Error(\n      `Gateway '${gateway.name}' has protocol='${gateway.protocol}'. Only MCP-protocol gateways are supported.`,\n    );\n  }\n  if (gateway.auth !== 'iam') {\n    throw new Error(\n      `Gateway '${gateway.name}' uses auth='${gateway.auth}'. Only IAM-authenticated gateways are supported in v1.`,\n    );\n  }\n  if (agentComponent.auth && agentComponent.auth !== 'iam') {\n    throw new Error(\n      `Agent '${agentComponent.name}' uses auth='${agentComponent.auth}'. Only IAM-authenticated agents can connect to IAM gateways.`,\n    );\n  }\n\n  const gatewayClassName = gateway.rc;\n  const gatewayKebabCase = kebabCase(gatewayClassName);\n  // A gateway is its own standalone project, so it exposes plain serve / dev.\n  const gatewayServeTargetName = 'serve';\n  const gatewayDevTargetName = 'dev';\n\n  const npmScope = getNpmScope(tree);\n\n  // 1. Ensure the shared agent-connection project exists + has the gateway\n  //    core client template.\n  await ensureTypeScriptAgentConnectionProject(tree);\n  await addTypeScriptCoreClient(tree, 'gateway');\n\n  // 2. Generate the per-connection <Gateway>Client into app/. Local mode\n  //    points at the gateway project's local gateway port.\n  generateFiles(\n    tree,\n    joinPathFragments(import.meta.dirname, 'files', 'agent-connection', 'app'),\n    joinPathFragments(AGENT_CONNECTION_PROJECT_DIR, 'src', 'app'),\n    {\n      gatewayKebabCase,\n      gatewayClassName,\n      gatewayPort: gateway.port,\n      ...esmVars(tree),\n    },\n    { overwriteStrategy: OverwriteStrategy.KeepExisting },\n  );\n\n  // Re-export from the agent-connection index\n  await addStarExport(\n    tree,\n    joinPathFragments(AGENT_CONNECTION_PROJECT_DIR, 'src', 'index.ts'),\n    `./app/${gatewayKebabCase}-client-strands.js`,\n  );\n\n  // 3. AST-transform agent.ts to add the gateway client (an McpClient in\n  //    both deployed and local modes) to the agent's tools.\n  const agentSourceDir = joinPathFragments(\n    sourceProject.root,\n    agentComponent.path ?? 'src',\n  );\n  const agentFilePath = joinPathFragments(agentSourceDir, 'agent.ts');\n\n  if (tree.exists(agentFilePath)) {\n    const clientClassName = `${gatewayClassName}ClientStrands`;\n    const clientVarName =\n      gatewayClassName.charAt(0).toLowerCase() + gatewayClassName.slice(1);\n\n    await addDestructuredImport(\n      tree,\n      agentFilePath,\n      [clientClassName],\n      `:${npmScope}/agent-connection`,\n    );\n    await addTypeScriptClientToAgent(\n      tree,\n      agentFilePath,\n      clientClassName,\n      clientVarName,\n    );\n  }\n\n  // 4. Wire dev chain — agent's dev depends on gateway's\n  //    aggregator target, which transitively starts each attached MCP server.\n  const agentName = agentComponent.name ?? 'agent';\n  const serveTargetName = `${agentName}-serve`;\n  const devTargetName = `${agentName}-dev`;\n  let projectConfigChanged = false;\n  if (sourceProject.targets?.[serveTargetName]) {\n    addDependencyToTargetIfNotPresent(sourceProject, serveTargetName, {\n      projects: [targetProject.name],\n      target: gatewayServeTargetName,\n    });\n    projectConfigChanged = true;\n  }\n  if (sourceProject.targets?.[devTargetName]) {\n    addDependencyToTargetIfNotPresent(sourceProject, devTargetName, {\n      projects: [targetProject.name],\n      target: gatewayDevTargetName,\n    });\n    projectConfigChanged = true;\n  }\n  if (projectConfigChanged) {\n    updateProjectConfiguration(tree, sourceProject.name, sourceProject);\n  }\n\n  // 5. Dependencies\n  addDependenciesToPackageJson(\n    tree,\n    withVersions([\n      '@modelcontextprotocol/sdk',\n      '@strands-agents/sdk',\n      '@aws-lambda-powertools/parameters',\n      '@aws-sdk/client-appconfigdata',\n      'aws4fetch',\n      '@aws-sdk/credential-providers',\n    ]),\n    {},\n  );\n\n  await addGeneratorMetricsIfApplicable(tree, [\n    TS_AGENT_GATEWAY_CONNECTION_GENERATOR_INFO,\n  ]);\n\n  await formatFilesInSubtree(tree);\n  return () =>\n    installDependencies(tree, options.preferInstallDependencies, {\n      languages: ['typescript'],\n    });\n};\n\nexport default tsAgentGatewayConnectionGenerator;\n"],"names":["addDependenciesToPackageJson","generateFiles","joinPathFragments","OverwriteStrategy","updateProjectConfiguration","readAgentCoreGatewayMetadata","AGENT_CONNECTION_PROJECT_DIR","addTypeScriptClientToAgent","addTypeScriptCoreClient","ensureTypeScriptAgentConnectionProject","addDestructuredImport","addStarExport","formatFilesInSubtree","installDependencies","addGeneratorMetricsIfApplicable","esmVars","kebabCase","getNpmScope","addDependencyToTargetIfNotPresent","getGeneratorInfo","readProjectConfigurationUnqualified","withVersions","TS_AGENT_GATEWAY_CONNECTION_GENERATOR_INFO","filename","tsAgentGatewayConnectionGenerator","tree","options","sourceProject","targetProject","agentComponent","sourceComponent","Error","gateway","protocol","name","auth","gatewayClassName","rc","gatewayKebabCase","gatewayServeTargetName","gatewayDevTargetName","npmScope","dirname","gatewayPort","port","overwriteStrategy","KeepExisting","agentSourceDir","root","path","agentFilePath","exists","clientClassName","clientVarName","charAt","toLowerCase","slice","agentName","serveTargetName","devTargetName","projectConfigChanged","targets","projects","target","preferInstallDependencies","languages"],"mappings":"AAAA;;;CAGC,GACD,SACEA,4BAA4B,EAE5BC,aAAa,EACbC,iBAAiB,EACjBC,iBAAiB,EAEjBC,0BAA0B,QACrB,aAAa;AACpB,SAASC,4BAA4B,QAAQ,0CAAuC;AACpF,SACEC,4BAA4B,EAC5BC,0BAA0B,EAC1BC,uBAAuB,EACvBC,sCAAsC,QACjC,sDAAmD;AAC1D,SAASC,qBAAqB,EAAEC,aAAa,QAAQ,wBAAqB;AAC1E,SAASC,oBAAoB,QAAQ,2BAAwB;AAC7D,SAASC,mBAAmB,QAAQ,4BAAyB;AAC7D,SAASC,+BAA+B,QAAQ,4BAAyB;AACzE,SAASC,OAAO,QAAQ,kCAA+B;AACvD,SAASC,SAAS,QAAQ,0BAAuB;AACjD,SAASC,WAAW,QAAQ,8BAA2B;AACvD,SACEC,iCAAiC,EACjCC,gBAAgB,EAEhBC,mCAAmC,QAC9B,uBAAoB;AAC3B,SAASC,YAAY,QAAQ,6BAA0B;AAGvD,OAAO,MAAMC,6CACXH,iBAAiB,YAAYI,QAAQ,EAAE;AAEzC,OAAO,MAAMC,oCAAoC,OAC/CC,MACAC;IAEA,MAAMC,gBAAgBP,oCACpBK,MACAC,QAAQC,aAAa;IAEvB,MAAMC,gBAAgBR,oCACpBK,MACAC,QAAQE,aAAa;IAGvB,MAAMC,iBAAiBH,QAAQI,eAAe;IAC9C,IAAI,CAACD,gBAAgB;QACnB,MAAM,IAAIE,MACR;IAEJ;IACA,MAAMC,UAAU3B,6BAA6BuB;IAE7C,IAAII,QAAQC,QAAQ,KAAK,OAAO;QAC9B,MAAM,IAAIF,MACR,CAAC,SAAS,EAAEC,QAAQE,IAAI,CAAC,gBAAgB,EAAEF,QAAQC,QAAQ,CAAC,4CAA4C,CAAC;IAE7G;IACA,IAAID,QAAQG,IAAI,KAAK,OAAO;QAC1B,MAAM,IAAIJ,MACR,CAAC,SAAS,EAAEC,QAAQE,IAAI,CAAC,aAAa,EAAEF,QAAQG,IAAI,CAAC,uDAAuD,CAAC;IAEjH;IACA,IAAIN,eAAeM,IAAI,IAAIN,eAAeM,IAAI,KAAK,OAAO;QACxD,MAAM,IAAIJ,MACR,CAAC,OAAO,EAAEF,eAAeK,IAAI,CAAC,aAAa,EAAEL,eAAeM,IAAI,CAAC,6DAA6D,CAAC;IAEnI;IAEA,MAAMC,mBAAmBJ,QAAQK,EAAE;IACnC,MAAMC,mBAAmBtB,UAAUoB;IACnC,4EAA4E;IAC5E,MAAMG,yBAAyB;IAC/B,MAAMC,uBAAuB;IAE7B,MAAMC,WAAWxB,YAAYQ;IAE7B,yEAAyE;IACzE,2BAA2B;IAC3B,MAAMhB,uCAAuCgB;IAC7C,MAAMjB,wBAAwBiB,MAAM;IAEpC,uEAAuE;IACvE,yDAAyD;IACzDxB,cACEwB,MACAvB,kBAAkB,YAAYwC,OAAO,EAAE,SAAS,oBAAoB,QACpExC,kBAAkBI,8BAA8B,OAAO,QACvD;QACEgC;QACAF;QACAO,aAAaX,QAAQY,IAAI;QACzB,GAAG7B,QAAQU,KAAK;IAClB,GACA;QAAEoB,mBAAmB1C,kBAAkB2C,YAAY;IAAC;IAGtD,4CAA4C;IAC5C,MAAMnC,cACJc,MACAvB,kBAAkBI,8BAA8B,OAAO,aACvD,CAAC,MAAM,EAAEgC,iBAAiB,kBAAkB,CAAC;IAG/C,uEAAuE;IACvE,0DAA0D;IAC1D,MAAMS,iBAAiB7C,kBACrByB,cAAcqB,IAAI,EAClBnB,eAAeoB,IAAI,IAAI;IAEzB,MAAMC,gBAAgBhD,kBAAkB6C,gBAAgB;IAExD,IAAItB,KAAK0B,MAAM,CAACD,gBAAgB;QAC9B,MAAME,kBAAkB,GAAGhB,iBAAiB,aAAa,CAAC;QAC1D,MAAMiB,gBACJjB,iBAAiBkB,MAAM,CAAC,GAAGC,WAAW,KAAKnB,iBAAiBoB,KAAK,CAAC;QAEpE,MAAM9C,sBACJe,MACAyB,eACA;YAACE;SAAgB,EACjB,CAAC,CAAC,EAAEX,SAAS,iBAAiB,CAAC;QAEjC,MAAMlC,2BACJkB,MACAyB,eACAE,iBACAC;IAEJ;IAEA,uDAAuD;IACvD,4EAA4E;IAC5E,MAAMI,YAAY5B,eAAeK,IAAI,IAAI;IACzC,MAAMwB,kBAAkB,GAAGD,UAAU,MAAM,CAAC;IAC5C,MAAME,gBAAgB,GAAGF,UAAU,IAAI,CAAC;IACxC,IAAIG,uBAAuB;IAC3B,IAAIjC,cAAckC,OAAO,EAAE,CAACH,gBAAgB,EAAE;QAC5CxC,kCAAkCS,eAAe+B,iBAAiB;YAChEI,UAAU;gBAAClC,cAAcM,IAAI;aAAC;YAC9B6B,QAAQxB;QACV;QACAqB,uBAAuB;IACzB;IACA,IAAIjC,cAAckC,OAAO,EAAE,CAACF,cAAc,EAAE;QAC1CzC,kCAAkCS,eAAegC,eAAe;YAC9DG,UAAU;gBAAClC,cAAcM,IAAI;aAAC;YAC9B6B,QAAQvB;QACV;QACAoB,uBAAuB;IACzB;IACA,IAAIA,sBAAsB;QACxBxD,2BAA2BqB,MAAME,cAAcO,IAAI,EAAEP;IACvD;IAEA,kBAAkB;IAClB3B,6BACEyB,MACAJ,aAAa;QACX;QACA;QACA;QACA;QACA;QACA;KACD,GACD,CAAC;IAGH,MAAMP,gCAAgCW,MAAM;QAC1CH;KACD;IAED,MAAMV,qBAAqBa;IAC3B,OAAO,IACLZ,oBAAoBY,MAAMC,QAAQsC,yBAAyB,EAAE;YAC3DC,WAAW;gBAAC;aAAa;QAC3B;AACJ,EAAE;AAEF,eAAezC,kCAAkC"}
+{"version":3,"sources":["../../../../../../../packages/nx-plugin/src/ts/agent/gateway-connection/generator.ts"],"sourcesContent":["/**\n * Copyright Amazon.com, Inc. or its affiliates. All Rights Reserved.\n * SPDX-License-Identifier: Apache-2.0\n */\nimport {\n  addDependenciesToPackageJson,\n  type GeneratorCallback,\n  generateFiles,\n  joinPathFragments,\n  OverwriteStrategy,\n  type Tree,\n  updateProjectConfiguration,\n} from '@nx/devkit';\nimport { readAgentCoreGatewayMetadata } from '../../../agentcore-gateway/generator';\nimport {\n  AGENT_CONNECTION_PROJECT_DIR,\n  addTypeScriptClientToAgent,\n  addTypeScriptCoreClient,\n  ensureTypeScriptAgentConnectionProject,\n} from '../../../utils/agent-connection/agent-connection';\nimport { addDestructuredImport, addStarExport } from '../../../utils/ast';\nimport { formatFilesInSubtree } from '../../../utils/format';\nimport { installDependencies } from '../../../utils/install';\nimport { addGeneratorMetricsIfApplicable } from '../../../utils/metrics';\nimport { esmVars } from '../../../utils/module-format';\nimport { kebabCase } from '../../../utils/names';\nimport { getNpmScope } from '../../../utils/npm-scope';\nimport {\n  addDependencyToTargetIfNotPresent,\n  getGeneratorInfo,\n  type NxGeneratorInfo,\n  readProjectConfigurationUnqualified,\n} from '../../../utils/nx';\nimport { withVersions } from '../../../utils/versions';\nimport type { TsAgentGatewayConnectionGeneratorSchema } from './schema';\n\nexport const TS_AGENT_GATEWAY_CONNECTION_GENERATOR_INFO: NxGeneratorInfo =\n  getGeneratorInfo(import.meta.filename);\n\nexport const tsAgentGatewayConnectionGenerator = async (\n  tree: Tree,\n  options: TsAgentGatewayConnectionGeneratorSchema,\n): Promise<GeneratorCallback> => {\n  const sourceProject = readProjectConfigurationUnqualified(\n    tree,\n    options.sourceProject,\n  );\n  const targetProject = readProjectConfigurationUnqualified(\n    tree,\n    options.targetProject,\n  );\n\n  const agentComponent = options.sourceComponent;\n  if (!agentComponent) {\n    throw new Error(\n      'sourceComponent must be provided for ts#agent -> agentcore-gateway connections',\n    );\n  }\n  const gateway = readAgentCoreGatewayMetadata(targetProject);\n\n  if (gateway.protocol !== 'mcp') {\n    throw new Error(\n      `Gateway '${gateway.name}' has protocol='${gateway.protocol}'. Only MCP-protocol gateways are supported.`,\n    );\n  }\n  if (gateway.auth !== 'iam') {\n    throw new Error(\n      `Gateway '${gateway.name}' uses auth='${gateway.auth}'. Agent connections currently require the gateway to use IAM authentication.`,\n    );\n  }\n  if (agentComponent.auth && agentComponent.auth !== 'iam') {\n    throw new Error(\n      `Agent '${agentComponent.name}' uses auth='${agentComponent.auth}'. Only IAM-authenticated agents can connect to IAM gateways.`,\n    );\n  }\n\n  const gatewayClassName = gateway.rc;\n  const gatewayKebabCase = kebabCase(gatewayClassName);\n  // A gateway is its own standalone project, so it exposes plain serve / dev.\n  const gatewayServeTargetName = 'serve';\n  const gatewayDevTargetName = 'dev';\n\n  const npmScope = getNpmScope(tree);\n\n  // 1. Ensure the shared agent-connection project exists + has the gateway\n  //    core client template.\n  await ensureTypeScriptAgentConnectionProject(tree);\n  await addTypeScriptCoreClient(tree, 'gateway');\n\n  // 2. Generate the per-connection <Gateway>Client into app/. Local mode\n  //    points at the gateway project's local gateway port.\n  generateFiles(\n    tree,\n    joinPathFragments(import.meta.dirname, 'files', 'agent-connection', 'app'),\n    joinPathFragments(AGENT_CONNECTION_PROJECT_DIR, 'src', 'app'),\n    {\n      gatewayKebabCase,\n      gatewayClassName,\n      gatewayPort: gateway.port,\n      ...esmVars(tree),\n    },\n    { overwriteStrategy: OverwriteStrategy.KeepExisting },\n  );\n\n  // Re-export from the agent-connection index\n  await addStarExport(\n    tree,\n    joinPathFragments(AGENT_CONNECTION_PROJECT_DIR, 'src', 'index.ts'),\n    `./app/${gatewayKebabCase}-client-strands.js`,\n  );\n\n  // 3. AST-transform agent.ts to add the gateway client (an McpClient in\n  //    both deployed and local modes) to the agent's tools.\n  const agentSourceDir = joinPathFragments(\n    sourceProject.root,\n    agentComponent.path ?? 'src',\n  );\n  const agentFilePath = joinPathFragments(agentSourceDir, 'agent.ts');\n\n  if (tree.exists(agentFilePath)) {\n    const clientClassName = `${gatewayClassName}ClientStrands`;\n    const clientVarName =\n      gatewayClassName.charAt(0).toLowerCase() + gatewayClassName.slice(1);\n\n    await addDestructuredImport(\n      tree,\n      agentFilePath,\n      [clientClassName],\n      `:${npmScope}/agent-connection`,\n    );\n    await addTypeScriptClientToAgent(\n      tree,\n      agentFilePath,\n      clientClassName,\n      clientVarName,\n    );\n  }\n\n  // 4. Wire dev chain — agent's dev depends on gateway's\n  //    aggregator target, which transitively starts each attached MCP server.\n  const agentName = agentComponent.name ?? 'agent';\n  const serveTargetName = `${agentName}-serve`;\n  const devTargetName = `${agentName}-dev`;\n  let projectConfigChanged = false;\n  if (sourceProject.targets?.[serveTargetName]) {\n    addDependencyToTargetIfNotPresent(sourceProject, serveTargetName, {\n      projects: [targetProject.name],\n      target: gatewayServeTargetName,\n    });\n    projectConfigChanged = true;\n  }\n  if (sourceProject.targets?.[devTargetName]) {\n    addDependencyToTargetIfNotPresent(sourceProject, devTargetName, {\n      projects: [targetProject.name],\n      target: gatewayDevTargetName,\n    });\n    projectConfigChanged = true;\n  }\n  if (projectConfigChanged) {\n    updateProjectConfiguration(tree, sourceProject.name, sourceProject);\n  }\n\n  // 5. Dependencies\n  addDependenciesToPackageJson(\n    tree,\n    withVersions([\n      '@modelcontextprotocol/sdk',\n      '@strands-agents/sdk',\n      '@aws-lambda-powertools/parameters',\n      '@aws-sdk/client-appconfigdata',\n      'aws4fetch',\n      '@aws-sdk/credential-providers',\n    ]),\n    {},\n  );\n\n  await addGeneratorMetricsIfApplicable(tree, [\n    TS_AGENT_GATEWAY_CONNECTION_GENERATOR_INFO,\n  ]);\n\n  await formatFilesInSubtree(tree);\n  return () =>\n    installDependencies(tree, options.preferInstallDependencies, {\n      languages: ['typescript'],\n    });\n};\n\nexport default tsAgentGatewayConnectionGenerator;\n"],"names":["addDependenciesToPackageJson","generateFiles","joinPathFragments","OverwriteStrategy","updateProjectConfiguration","readAgentCoreGatewayMetadata","AGENT_CONNECTION_PROJECT_DIR","addTypeScriptClientToAgent","addTypeScriptCoreClient","ensureTypeScriptAgentConnectionProject","addDestructuredImport","addStarExport","formatFilesInSubtree","installDependencies","addGeneratorMetricsIfApplicable","esmVars","kebabCase","getNpmScope","addDependencyToTargetIfNotPresent","getGeneratorInfo","readProjectConfigurationUnqualified","withVersions","TS_AGENT_GATEWAY_CONNECTION_GENERATOR_INFO","filename","tsAgentGatewayConnectionGenerator","tree","options","sourceProject","targetProject","agentComponent","sourceComponent","Error","gateway","protocol","name","auth","gatewayClassName","rc","gatewayKebabCase","gatewayServeTargetName","gatewayDevTargetName","npmScope","dirname","gatewayPort","port","overwriteStrategy","KeepExisting","agentSourceDir","root","path","agentFilePath","exists","clientClassName","clientVarName","charAt","toLowerCase","slice","agentName","serveTargetName","devTargetName","projectConfigChanged","targets","projects","target","preferInstallDependencies","languages"],"mappings":"AAAA;;;CAGC,GACD,SACEA,4BAA4B,EAE5BC,aAAa,EACbC,iBAAiB,EACjBC,iBAAiB,EAEjBC,0BAA0B,QACrB,aAAa;AACpB,SAASC,4BAA4B,QAAQ,0CAAuC;AACpF,SACEC,4BAA4B,EAC5BC,0BAA0B,EAC1BC,uBAAuB,EACvBC,sCAAsC,QACjC,sDAAmD;AAC1D,SAASC,qBAAqB,EAAEC,aAAa,QAAQ,wBAAqB;AAC1E,SAASC,oBAAoB,QAAQ,2BAAwB;AAC7D,SAASC,mBAAmB,QAAQ,4BAAyB;AAC7D,SAASC,+BAA+B,QAAQ,4BAAyB;AACzE,SAASC,OAAO,QAAQ,kCAA+B;AACvD,SAASC,SAAS,QAAQ,0BAAuB;AACjD,SAASC,WAAW,QAAQ,8BAA2B;AACvD,SACEC,iCAAiC,EACjCC,gBAAgB,EAEhBC,mCAAmC,QAC9B,uBAAoB;AAC3B,SAASC,YAAY,QAAQ,6BAA0B;AAGvD,OAAO,MAAMC,6CACXH,iBAAiB,YAAYI,QAAQ,EAAE;AAEzC,OAAO,MAAMC,oCAAoC,OAC/CC,MACAC;IAEA,MAAMC,gBAAgBP,oCACpBK,MACAC,QAAQC,aAAa;IAEvB,MAAMC,gBAAgBR,oCACpBK,MACAC,QAAQE,aAAa;IAGvB,MAAMC,iBAAiBH,QAAQI,eAAe;IAC9C,IAAI,CAACD,gBAAgB;QACnB,MAAM,IAAIE,MACR;IAEJ;IACA,MAAMC,UAAU3B,6BAA6BuB;IAE7C,IAAII,QAAQC,QAAQ,KAAK,OAAO;QAC9B,MAAM,IAAIF,MACR,CAAC,SAAS,EAAEC,QAAQE,IAAI,CAAC,gBAAgB,EAAEF,QAAQC,QAAQ,CAAC,4CAA4C,CAAC;IAE7G;IACA,IAAID,QAAQG,IAAI,KAAK,OAAO;QAC1B,MAAM,IAAIJ,MACR,CAAC,SAAS,EAAEC,QAAQE,IAAI,CAAC,aAAa,EAAEF,QAAQG,IAAI,CAAC,6EAA6E,CAAC;IAEvI;IACA,IAAIN,eAAeM,IAAI,IAAIN,eAAeM,IAAI,KAAK,OAAO;QACxD,MAAM,IAAIJ,MACR,CAAC,OAAO,EAAEF,eAAeK,IAAI,CAAC,aAAa,EAAEL,eAAeM,IAAI,CAAC,6DAA6D,CAAC;IAEnI;IAEA,MAAMC,mBAAmBJ,QAAQK,EAAE;IACnC,MAAMC,mBAAmBtB,UAAUoB;IACnC,4EAA4E;IAC5E,MAAMG,yBAAyB;IAC/B,MAAMC,uBAAuB;IAE7B,MAAMC,WAAWxB,YAAYQ;IAE7B,yEAAyE;IACzE,2BAA2B;IAC3B,MAAMhB,uCAAuCgB;IAC7C,MAAMjB,wBAAwBiB,MAAM;IAEpC,uEAAuE;IACvE,yDAAyD;IACzDxB,cACEwB,MACAvB,kBAAkB,YAAYwC,OAAO,EAAE,SAAS,oBAAoB,QACpExC,kBAAkBI,8BAA8B,OAAO,QACvD;QACEgC;QACAF;QACAO,aAAaX,QAAQY,IAAI;QACzB,GAAG7B,QAAQU,KAAK;IAClB,GACA;QAAEoB,mBAAmB1C,kBAAkB2C,YAAY;IAAC;IAGtD,4CAA4C;IAC5C,MAAMnC,cACJc,MACAvB,kBAAkBI,8BAA8B,OAAO,aACvD,CAAC,MAAM,EAAEgC,iBAAiB,kBAAkB,CAAC;IAG/C,uEAAuE;IACvE,0DAA0D;IAC1D,MAAMS,iBAAiB7C,kBACrByB,cAAcqB,IAAI,EAClBnB,eAAeoB,IAAI,IAAI;IAEzB,MAAMC,gBAAgBhD,kBAAkB6C,gBAAgB;IAExD,IAAItB,KAAK0B,MAAM,CAACD,gBAAgB;QAC9B,MAAME,kBAAkB,GAAGhB,iBAAiB,aAAa,CAAC;QAC1D,MAAMiB,gBACJjB,iBAAiBkB,MAAM,CAAC,GAAGC,WAAW,KAAKnB,iBAAiBoB,KAAK,CAAC;QAEpE,MAAM9C,sBACJe,MACAyB,eACA;YAACE;SAAgB,EACjB,CAAC,CAAC,EAAEX,SAAS,iBAAiB,CAAC;QAEjC,MAAMlC,2BACJkB,MACAyB,eACAE,iBACAC;IAEJ;IAEA,uDAAuD;IACvD,4EAA4E;IAC5E,MAAMI,YAAY5B,eAAeK,IAAI,IAAI;IACzC,MAAMwB,kBAAkB,GAAGD,UAAU,MAAM,CAAC;IAC5C,MAAME,gBAAgB,GAAGF,UAAU,IAAI,CAAC;IACxC,IAAIG,uBAAuB;IAC3B,IAAIjC,cAAckC,OAAO,EAAE,CAACH,gBAAgB,EAAE;QAC5CxC,kCAAkCS,eAAe+B,iBAAiB;YAChEI,UAAU;gBAAClC,cAAcM,IAAI;aAAC;YAC9B6B,QAAQxB;QACV;QACAqB,uBAAuB;IACzB;IACA,IAAIjC,cAAckC,OAAO,EAAE,CAACF,cAAc,EAAE;QAC1CzC,kCAAkCS,eAAegC,eAAe;YAC9DG,UAAU;gBAAClC,cAAcM,IAAI;aAAC;YAC9B6B,QAAQvB;QACV;QACAoB,uBAAuB;IACzB;IACA,IAAIA,sBAAsB;QACxBxD,2BAA2BqB,MAAME,cAAcO,IAAI,EAAEP;IACvD;IAEA,kBAAkB;IAClB3B,6BACEyB,MACAJ,aAAa;QACX;QACA;QACA;QACA;QACA;QACA;KACD,GACD,CAAC;IAGH,MAAMP,gCAAgCW,MAAM;QAC1CH;KACD;IAED,MAAMV,qBAAqBa;IAC3B,OAAO,IACLZ,oBAAoBY,MAAMC,QAAQsC,yBAAyB,EAAE;YAC3DC,WAAW;gBAAC;aAAa;QAC3B;AACJ,EAAE;AAEF,eAAezC,kCAAkC"}

package/src/ts/agent/generator.js

@@ -78,6 +78,7 @@ export const tsAgentGenerator = async (tree, options)=>{
             name,
             protocol,
             adotVersion: TS_VERSIONS['@aws/aws-distro-opentelemetry-node-autoinstrumentation'],
+            jaegerVersion: TS_VERSIONS['@opentelemetry/propagator-jaeger'],
             nodeBaseImage: BASE_IMAGES.node,
             npmVersion: TS_VERSIONS.npm,
             ...esmVars(tree)
@@ -147,6 +148,11 @@ export const tsAgentGenerator = async (tree, options)=>{
             '@a2a-js/sdk'
         ] : protocol === 'ag-ui' ? [
             '@ag-ui/aws-strands',
+            // @ag-ui/aws-strands declares these as peer dependencies but
+            // statically imports them, so they must be installed for the
+            // bundler to resolve and inline them into the runtime image.
+            '@ag-ui/a2ui-toolkit',
+            '@ag-ui/client',
             '@ag-ui/core',
             '@ag-ui/encoder',
             'express',