@aws/nx-plugin 1.0.0-rc.44 → 1.0.0-rc.45

package/src/ts/dcr-proxy/generator.d.ts

@@ -0,0 +1,10 @@
+/**
+ * Copyright Amazon.com, Inc. or its affiliates. All Rights Reserved.
+ * SPDX-License-Identifier: Apache-2.0
+ */
+import { type GeneratorCallback, type Tree } from '@nx/devkit';
+import { type NxGeneratorInfo } from '../../utils/nx';
+import type { TsDcrProxyGeneratorSchema } from './schema';
+export declare const TS_DCR_PROXY_GENERATOR_INFO: NxGeneratorInfo;
+export declare const tsDcrProxyGenerator: (tree: Tree, options: TsDcrProxyGeneratorSchema) => Promise<GeneratorCallback>;
+export default tsDcrProxyGenerator;

package/src/ts/dcr-proxy/generator.js

@@ -0,0 +1,98 @@
+/**
+ * Copyright Amazon.com, Inc. or its affiliates. All Rights Reserved.
+ * SPDX-License-Identifier: Apache-2.0
+ */ import { addDependenciesToPackageJson, generateFiles, joinPathFragments, OverwriteStrategy, updateProjectConfiguration } from "@nx/devkit";
+import tsProjectGenerator from "../lib/generator.js";
+import { addTypeScriptBundleTarget } from "../../utils/bundle/bundle.js";
+import { addDcrProxyInfra, DCR_PROXY_HANDLERS } from "../../utils/dcr-proxy-constructs/dcr-proxy-constructs.js";
+import { formatFilesInSubtree } from "../../utils/format.js";
+import { resolveIac } from "../../utils/iac.js";
+import { installDependencies } from "../../utils/install.js";
+import { addGeneratorMetricsIfApplicable } from "../../utils/metrics.js";
+import { kebabCase, toClassName } from "../../utils/names.js";
+import { getNpmScopePrefix } from "../../utils/npm-scope.js";
+import { getGeneratorInfo, readProjectConfigurationUnqualified } from "../../utils/nx.js";
+import { sortObjectKeys } from "../../utils/object.js";
+import { sharedConstructsGenerator } from "../../utils/shared-constructs.js";
+import { withVersions } from "../../utils/versions.js";
+export const TS_DCR_PROXY_GENERATOR_INFO = getGeneratorInfo(import.meta.filename);
+export const tsDcrProxyGenerator = async (tree, options)=>{
+    const name = kebabCase(options.name ? options.name : 'dcr-proxy');
+    const nameClassName = toClassName(name);
+    const iac = await resolveIac(tree, options.iac);
+    // The handlers live in a standalone TypeScript project so they can be bundled
+    // (rolldown) into deployable artifacts referenced by both CDK and Terraform.
+    const namespace = getNpmScopePrefix(tree);
+    const proxyProjectName = `${namespace}${name}`;
+    let projectExists;
+    try {
+        readProjectConfigurationUnqualified(tree, proxyProjectName);
+        projectExists = true;
+    } catch  {
+        projectExists = false;
+    }
+    if (!projectExists) {
+        await tsProjectGenerator(tree, {
+            name,
+            directory: options.directory,
+            subDirectory: options.subDirectory,
+            preferInstallDependencies: false
+        });
+    }
+    const projectConfig = readProjectConfigurationUnqualified(tree, proxyProjectName);
+    const proxyRoot = projectConfig.root;
+    // Place the Lambda handlers in the project source
+    generateFiles(tree, joinPathFragments(import.meta.dirname, '..', '..', 'utils', 'dcr-proxy-constructs', 'files', 'project'), proxyRoot, {
+        nameClassName,
+        nameKebabCase: name
+    }, {
+        overwriteStrategy: OverwriteStrategy.KeepExisting
+    });
+    // The token handler imports @aws-sdk/client-secrets-manager (provided by the
+    // Lambda runtime but needed for type-checking and local dev) and the handlers
+    // are typed against @types/aws-lambda.
+    addDependenciesToPackageJson(tree, withVersions([
+        '@aws-sdk/client-secrets-manager'
+    ]), withVersions([
+        '@types/aws-lambda'
+    ]));
+    // Bundle each handler independently to dist/<root>/bundle/<handler>/index.js
+    for (const handler of DCR_PROXY_HANDLERS){
+        await addTypeScriptBundleTarget(tree, projectConfig, {
+            targetFilePath: `src/handlers/${handler}.ts`,
+            bundleOutputDir: handler,
+            external: [
+                /@aws-sdk\/.*/
+            ],
+            platform: 'node'
+        });
+    }
+    projectConfig.targets = sortObjectKeys(projectConfig.targets);
+    updateProjectConfiguration(tree, projectConfig.name, projectConfig);
+    const bundlePathsFromRoot = Object.fromEntries(DCR_PROXY_HANDLERS.map((handler)=>[
+            handler,
+            joinPathFragments('dist', proxyRoot, 'bundle', handler)
+        ]));
+    await sharedConstructsGenerator(tree, {
+        iac
+    });
+    await addDcrProxyInfra(tree, {
+        dcrProxyNameClassName: nameClassName,
+        dcrProxyNameKebabCase: name,
+        proxyProjectName,
+        bundlePathsFromRoot,
+        iac
+    });
+    await addGeneratorMetricsIfApplicable(tree, [
+        TS_DCR_PROXY_GENERATOR_INFO
+    ]);
+    await formatFilesInSubtree(tree);
+    return ()=>installDependencies(tree, options.preferInstallDependencies, {
+            languages: [
+                'typescript'
+            ]
+        });
+};
+export default tsDcrProxyGenerator;
+
+//# sourceMappingURL=generator.js.map

package/src/ts/dcr-proxy/generator.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../../../../../../packages/nx-plugin/src/ts/dcr-proxy/generator.ts"],"sourcesContent":["/**\n * Copyright Amazon.com, Inc. or its affiliates. All Rights Reserved.\n * SPDX-License-Identifier: Apache-2.0\n */\nimport {\n  addDependenciesToPackageJson,\n  type GeneratorCallback,\n  generateFiles,\n  joinPathFragments,\n  OverwriteStrategy,\n  type Tree,\n  updateProjectConfiguration,\n} from '@nx/devkit';\nimport tsProjectGenerator from '../../ts/lib/generator';\nimport { addTypeScriptBundleTarget } from '../../utils/bundle/bundle';\nimport {\n  addDcrProxyInfra,\n  DCR_PROXY_HANDLERS,\n  type DcrProxyHandler,\n} from '../../utils/dcr-proxy-constructs/dcr-proxy-constructs';\nimport { formatFilesInSubtree } from '../../utils/format';\nimport { resolveIac } from '../../utils/iac';\nimport { installDependencies } from '../../utils/install';\nimport { addGeneratorMetricsIfApplicable } from '../../utils/metrics';\nimport { kebabCase, toClassName } from '../../utils/names';\nimport { getNpmScopePrefix } from '../../utils/npm-scope';\nimport {\n  getGeneratorInfo,\n  type NxGeneratorInfo,\n  readProjectConfigurationUnqualified,\n} from '../../utils/nx';\nimport { sortObjectKeys } from '../../utils/object';\nimport { sharedConstructsGenerator } from '../../utils/shared-constructs';\nimport { withVersions } from '../../utils/versions';\nimport type { TsDcrProxyGeneratorSchema } from './schema';\n\nexport const TS_DCR_PROXY_GENERATOR_INFO: NxGeneratorInfo = getGeneratorInfo(\n  import.meta.filename,\n);\n\nexport const tsDcrProxyGenerator = async (\n  tree: Tree,\n  options: TsDcrProxyGeneratorSchema,\n): Promise<GeneratorCallback> => {\n  const name = kebabCase(options.name ? options.name : 'dcr-proxy');\n  const nameClassName = toClassName(name);\n\n  const iac = await resolveIac(tree, options.iac);\n\n  // The handlers live in a standalone TypeScript project so they can be bundled\n  // (rolldown) into deployable artifacts referenced by both CDK and Terraform.\n  const namespace = getNpmScopePrefix(tree);\n  const proxyProjectName = `${namespace}${name}`;\n\n  let projectExists: boolean;\n  try {\n    readProjectConfigurationUnqualified(tree, proxyProjectName);\n    projectExists = true;\n  } catch {\n    projectExists = false;\n  }\n\n  if (!projectExists) {\n    await tsProjectGenerator(tree, {\n      name,\n      directory: options.directory,\n      subDirectory: options.subDirectory,\n      preferInstallDependencies: false,\n    });\n  }\n\n  const projectConfig = readProjectConfigurationUnqualified(\n    tree,\n    proxyProjectName,\n  );\n  const proxyRoot = projectConfig.root;\n\n  // Place the Lambda handlers in the project source\n  generateFiles(\n    tree,\n    joinPathFragments(\n      import.meta.dirname,\n      '..',\n      '..',\n      'utils',\n      'dcr-proxy-constructs',\n      'files',\n      'project',\n    ),\n    proxyRoot,\n    { nameClassName, nameKebabCase: name },\n    {\n      overwriteStrategy: OverwriteStrategy.KeepExisting,\n    },\n  );\n\n  // The token handler imports @aws-sdk/client-secrets-manager (provided by the\n  // Lambda runtime but needed for type-checking and local dev) and the handlers\n  // are typed against @types/aws-lambda.\n  addDependenciesToPackageJson(\n    tree,\n    withVersions(['@aws-sdk/client-secrets-manager']),\n    withVersions(['@types/aws-lambda']),\n  );\n\n  // Bundle each handler independently to dist/<root>/bundle/<handler>/index.js\n  for (const handler of DCR_PROXY_HANDLERS) {\n    await addTypeScriptBundleTarget(tree, projectConfig, {\n      targetFilePath: `src/handlers/${handler}.ts`,\n      bundleOutputDir: handler,\n      external: [/@aws-sdk\\/.*/], // lambda runtime provides the aws sdk\n      platform: 'node',\n    });\n  }\n\n  projectConfig.targets = sortObjectKeys(projectConfig.targets);\n  updateProjectConfiguration(tree, projectConfig.name, projectConfig);\n\n  const bundlePathsFromRoot = Object.fromEntries(\n    DCR_PROXY_HANDLERS.map((handler) => [\n      handler,\n      joinPathFragments('dist', proxyRoot, 'bundle', handler),\n    ]),\n  ) as Record<DcrProxyHandler, string>;\n\n  await sharedConstructsGenerator(tree, { iac });\n\n  await addDcrProxyInfra(tree, {\n    dcrProxyNameClassName: nameClassName,\n    dcrProxyNameKebabCase: name,\n    proxyProjectName,\n    bundlePathsFromRoot,\n    iac,\n  });\n\n  await addGeneratorMetricsIfApplicable(tree, [TS_DCR_PROXY_GENERATOR_INFO]);\n\n  await formatFilesInSubtree(tree);\n  return () =>\n    installDependencies(tree, options.preferInstallDependencies, {\n      languages: ['typescript'],\n    });\n};\n\nexport default tsDcrProxyGenerator;\n"],"names":["addDependenciesToPackageJson","generateFiles","joinPathFragments","OverwriteStrategy","updateProjectConfiguration","tsProjectGenerator","addTypeScriptBundleTarget","addDcrProxyInfra","DCR_PROXY_HANDLERS","formatFilesInSubtree","resolveIac","installDependencies","addGeneratorMetricsIfApplicable","kebabCase","toClassName","getNpmScopePrefix","getGeneratorInfo","readProjectConfigurationUnqualified","sortObjectKeys","sharedConstructsGenerator","withVersions","TS_DCR_PROXY_GENERATOR_INFO","filename","tsDcrProxyGenerator","tree","options","name","nameClassName","iac","namespace","proxyProjectName","projectExists","directory","subDirectory","preferInstallDependencies","projectConfig","proxyRoot","root","dirname","nameKebabCase","overwriteStrategy","KeepExisting","handler","targetFilePath","bundleOutputDir","external","platform","targets","bundlePathsFromRoot","Object","fromEntries","map","dcrProxyNameClassName","dcrProxyNameKebabCase","languages"],"mappings":"AAAA;;;CAGC,GACD,SACEA,4BAA4B,EAE5BC,aAAa,EACbC,iBAAiB,EACjBC,iBAAiB,EAEjBC,0BAA0B,QACrB,aAAa;AACpB,OAAOC,wBAAwB,sBAAyB;AACxD,SAASC,yBAAyB,QAAQ,+BAA4B;AACtE,SACEC,gBAAgB,EAChBC,kBAAkB,QAEb,2DAAwD;AAC/D,SAASC,oBAAoB,QAAQ,wBAAqB;AAC1D,SAASC,UAAU,QAAQ,qBAAkB;AAC7C,SAASC,mBAAmB,QAAQ,yBAAsB;AAC1D,SAASC,+BAA+B,QAAQ,yBAAsB;AACtE,SAASC,SAAS,EAAEC,WAAW,QAAQ,uBAAoB;AAC3D,SAASC,iBAAiB,QAAQ,2BAAwB;AAC1D,SACEC,gBAAgB,EAEhBC,mCAAmC,QAC9B,oBAAiB;AACxB,SAASC,cAAc,QAAQ,wBAAqB;AACpD,SAASC,yBAAyB,QAAQ,mCAAgC;AAC1E,SAASC,YAAY,QAAQ,0BAAuB;AAGpD,OAAO,MAAMC,8BAA+CL,iBAC1D,YAAYM,QAAQ,EACpB;AAEF,OAAO,MAAMC,sBAAsB,OACjCC,MACAC;IAEA,MAAMC,OAAOb,UAAUY,QAAQC,IAAI,GAAGD,QAAQC,IAAI,GAAG;IACrD,MAAMC,gBAAgBb,YAAYY;IAElC,MAAME,MAAM,MAAMlB,WAAWc,MAAMC,QAAQG,GAAG;IAE9C,8EAA8E;IAC9E,6EAA6E;IAC7E,MAAMC,YAAYd,kBAAkBS;IACpC,MAAMM,mBAAmB,GAAGD,YAAYH,MAAM;IAE9C,IAAIK;IACJ,IAAI;QACFd,oCAAoCO,MAAMM;QAC1CC,gBAAgB;IAClB,EAAE,OAAM;QACNA,gBAAgB;IAClB;IAEA,IAAI,CAACA,eAAe;QAClB,MAAM1B,mBAAmBmB,MAAM;YAC7BE;YACAM,WAAWP,QAAQO,SAAS;YAC5BC,cAAcR,QAAQQ,YAAY;YAClCC,2BAA2B;QAC7B;IACF;IAEA,MAAMC,gBAAgBlB,oCACpBO,MACAM;IAEF,MAAMM,YAAYD,cAAcE,IAAI;IAEpC,kDAAkD;IAClDpC,cACEuB,MACAtB,kBACE,YAAYoC,OAAO,EACnB,MACA,MACA,SACA,wBACA,SACA,YAEFF,WACA;QAAET;QAAeY,eAAeb;IAAK,GACrC;QACEc,mBAAmBrC,kBAAkBsC,YAAY;IACnD;IAGF,6EAA6E;IAC7E,8EAA8E;IAC9E,uCAAuC;IACvCzC,6BACEwB,MACAJ,aAAa;QAAC;KAAkC,GAChDA,aAAa;QAAC;KAAoB;IAGpC,6EAA6E;IAC7E,KAAK,MAAMsB,WAAWlC,mBAAoB;QACxC,MAAMF,0BAA0BkB,MAAMW,eAAe;YACnDQ,gBAAgB,CAAC,aAAa,EAAED,QAAQ,GAAG,CAAC;YAC5CE,iBAAiBF;YACjBG,UAAU;gBAAC;aAAe;YAC1BC,UAAU;QACZ;IACF;IAEAX,cAAcY,OAAO,GAAG7B,eAAeiB,cAAcY,OAAO;IAC5D3C,2BAA2BoB,MAAMW,cAAcT,IAAI,EAAES;IAErD,MAAMa,sBAAsBC,OAAOC,WAAW,CAC5C1C,mBAAmB2C,GAAG,CAAC,CAACT,UAAY;YAClCA;YACAxC,kBAAkB,QAAQkC,WAAW,UAAUM;SAChD;IAGH,MAAMvB,0BAA0BK,MAAM;QAAEI;IAAI;IAE5C,MAAMrB,iBAAiBiB,MAAM;QAC3B4B,uBAAuBzB;QACvB0B,uBAAuB3B;QACvBI;QACAkB;QACApB;IACF;IAEA,MAAMhB,gCAAgCY,MAAM;QAACH;KAA4B;IAEzE,MAAMZ,qBAAqBe;IAC3B,OAAO,IACLb,oBAAoBa,MAAMC,QAAQS,yBAAyB,EAAE;YAC3DoB,WAAW;gBAAC;aAAa;QAC3B;AACJ,EAAE;AAEF,eAAe/B,oBAAoB"}

package/src/ts/dcr-proxy/schema.d.js

@@ -0,0 +1,6 @@
+/**
+ * Copyright Amazon.com, Inc. or its affiliates. All Rights Reserved.
+ * SPDX-License-Identifier: Apache-2.0
+ */ export { };
+
+//# sourceMappingURL=schema.d.js.map

package/src/ts/dcr-proxy/schema.d.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../../../../../../packages/nx-plugin/src/ts/dcr-proxy/schema.d.ts"],"sourcesContent":["/**\n * Copyright Amazon.com, Inc. or its affiliates. All Rights Reserved.\n * SPDX-License-Identifier: Apache-2.0\n */\nimport type { IacOption } from '../../utils/iac';\n\nexport interface TsDcrProxyGeneratorSchema {\n  name?: string;\n  directory?: string;\n  subDirectory?: string;\n  iac: IacOption;\n  preferInstallDependencies?: boolean;\n}\n"],"names":[],"mappings":"AAAA;;;CAGC,GAGD,WAMC"}

package/src/ts/dcr-proxy/schema.d.ts

@@ -0,0 +1,13 @@
+/**
+ * Copyright Amazon.com, Inc. or its affiliates. All Rights Reserved.
+ * SPDX-License-Identifier: Apache-2.0
+ */
+import type { IacOption } from '../../utils/iac';
+
+export interface TsDcrProxyGeneratorSchema {
+  name?: string;
+  directory?: string;
+  subDirectory?: string;
+  iac: IacOption;
+  preferInstallDependencies?: boolean;
+}

package/src/ts/dcr-proxy/schema.json

@@ -0,0 +1,44 @@
+{
+  "$schema": "https://json-schema.org/schema",
+  "$id": "ts#dcr-proxy",
+  "title": "ts#dcr-proxy",
+  "description": "Generate an OAuth Dynamic Client Registration (DCR) proxy construct for Cognito-authenticated MCP servers",
+  "type": "object",
+  "properties": {
+    "name": {
+      "type": "string",
+      "description": "The name of your DCR proxy, used for its TypeScript handler project, the construct/module class name, and its directory under common/constructs or common/terraform",
+      "default": "dcr-proxy",
+      "$default": {
+        "$source": "argv",
+        "index": 0
+      },
+      "x-prompt": "What would you like to call your DCR proxy?",
+      "x-priority": "important"
+    },
+    "directory": {
+      "description": "The directory to store the DCR proxy handler project in.",
+      "type": "string",
+      "alias": "dir",
+      "x-priority": "important",
+      "default": "packages"
+    },
+    "subDirectory": {
+      "type": "string",
+      "description": "The sub directory the handler project is placed in. By default this is the project name."
+    },
+    "iac": {
+      "type": "string",
+      "description": "The preferred IaC provider (cdk or terraform). By default this is inherited from your initial selection.",
+      "enum": ["inherit", "cdk", "terraform"],
+      "x-priority": "important",
+      "default": "inherit",
+      "x-prompt": "Which provider would you like to manage your infrastructure? (default: inherit)"
+    },
+    "preferInstallDependencies": {
+      "type": "boolean",
+      "description": "Whether to prefer installing dependencies after the generator runs. Set to false to defer installing when batching multiple generators (an install still runs if needed so subsequent generators can compute the Nx project graph); install once at the end.",
+      "default": true
+    }
+  }
+}

package/src/ts/mcp-server/files/Dockerfile.template

@@ -7,7 +7,11 @@ WORKDIR /app
 
 # Add AWS Distro for OpenTelemetry for observability
 # https://docs.aws.amazon.com/bedrock-agentcore/latest/devguide/observability-configure.html
-RUN npm install @aws/aws-distro-opentelemetry-node-autoinstrumentation@<%- adotVersion %>
+# The override pins @opentelemetry/propagator-jaeger above the version the
+# autoinstrumentation package resolves transitively, clearing CVE-2026-59892.
+RUN npm init -y \
+  && npm pkg set "overrides.@opentelemetry/propagator-jaeger=<%- jaegerVersion %>" \
+  && npm install @aws/aws-distro-opentelemetry-node-autoinstrumentation@<%- adotVersion %>
 
 # Copy bundled streamable http server
 COPY index.js /app

package/src/ts/mcp-server/generator.js

@@ -51,6 +51,7 @@ export const tsMcpServerGenerator = async (tree, options)=>{
         esm,
         distDir,
         adotVersion: TS_VERSIONS['@aws/aws-distro-opentelemetry-node-autoinstrumentation'],
+        jaegerVersion: TS_VERSIONS['@opentelemetry/propagator-jaeger'],
         nodeBaseImage: BASE_IMAGES.node,
         npmVersion: TS_VERSIONS.npm
     }, {

package/src/ts/mcp-server/generator.js.map

@@ -1 +1 @@
-{"version":3,"sources":["../../../../../../packages/nx-plugin/src/ts/mcp-server/generator.ts"],"sourcesContent":["/**\n * Copyright Amazon.com, Inc. or its affiliates. All Rights Reserved.\n * SPDX-License-Identifier: Apache-2.0\n */\nimport {\n  addDependenciesToPackageJson,\n  detectPackageManager,\n  type GeneratorCallback,\n  generateFiles,\n  joinPathFragments,\n  OverwriteStrategy,\n  readJson,\n  type Tree,\n  updateJson,\n  updateProjectConfiguration,\n} from '@nx/devkit';\nimport { ensureLicenseExceptions } from '../../license/config';\nimport { MCP_INSPECTOR_EXCEPTIONS } from '../../license/known-exceptions';\nimport { addMcpServerInfra } from '../../utils/agent-core-constructs/agent-core-constructs';\nimport { addTypeScriptBundleTarget } from '../../utils/bundle/bundle';\nimport { resolveContainers } from '../../utils/containers';\nimport { addDockerScanTarget } from '../../utils/docker';\nimport { formatFilesInSubtree } from '../../utils/format';\nimport { FsCommands } from '../../utils/fs';\nimport { resolveIac } from '../../utils/iac';\nimport { installDependencies } from '../../utils/install';\nimport { addGeneratorMetricsIfApplicable } from '../../utils/metrics';\nimport { isEsmWorkspace } from '../../utils/module-format';\nimport { kebabCase, toClassName } from '../../utils/names';\nimport { getNpmScope } from '../../utils/npm-scope';\nimport {\n  addComponentDevTarget,\n  addComponentGeneratorMetadata,\n  addDependencyToTargetIfNotPresent,\n  getGeneratorInfo,\n  type NxGeneratorInfo,\n  readProjectConfigurationUnqualified,\n} from '../../utils/nx';\nimport { sortObjectKeys } from '../../utils/object';\nimport { assignPort } from '../../utils/port';\nimport { sharedConstructsGenerator } from '../../utils/shared-constructs';\nimport { BASE_IMAGES, TS_VERSIONS, withVersions } from '../../utils/versions';\nimport type { TsMcpServerGeneratorSchema } from './schema';\n\nexport const TS_MCP_SERVER_GENERATOR_INFO: NxGeneratorInfo = getGeneratorInfo(\n  import.meta.filename,\n);\n\nexport const tsMcpServerGenerator = async (\n  tree: Tree,\n  options: TsMcpServerGeneratorSchema,\n): Promise<GeneratorCallback> => {\n  const project = readProjectConfigurationUnqualified(tree, options.project);\n\n  if (!tree.exists(joinPathFragments(project.root, 'tsconfig.json'))) {\n    throw new Error(\n      `Unsupported project ${options.project}. Expected a TypeScript project (with a tsconfig.json)`,\n    );\n  }\n\n  const defaultName = `${kebabCase(project.name.split('/').pop())}-mcp-server`;\n  const name = kebabCase(options.name || defaultName);\n  const mcpServerNameClassName = toClassName(name);\n  const mcpTargetPrefix = options.name ? name : 'mcp-server';\n  const targetSourceDirRelativeToProjectRoot = joinPathFragments(\n    'src',\n    mcpTargetPrefix,\n  );\n  const targetSourceDir = joinPathFragments(\n    project.root,\n    targetSourceDirRelativeToProjectRoot,\n  );\n  const relativeSourceDir = targetSourceDir.replace(project.root + '/', './');\n  const distDir = joinPathFragments('dist', project.root);\n\n  const infra = options.infra ?? 'agentcore';\n\n  if (infra === 'none' && options.auth && options.auth !== 'iam') {\n    console.warn(\n      'Warning: auth is ignored when no infrastructure is configured (no infrastructure is generated)',\n    );\n  }\n\n  const auth = options.auth ?? 'iam';\n\n  const projectPackageJsonPath = joinPathFragments(\n    project.root,\n    'package.json',\n  );\n\n  // Generate esm if the module system is esm, otherwise commonjs. Projects\n  // don't typically have their own package.json (dependencies are declared in\n  // the workspace root), so fall back to the workspace format when absent.\n  const esm = tree.exists(projectPackageJsonPath)\n    ? readJson(tree, projectPackageJsonPath).type === 'module'\n    : isEsmWorkspace(tree);\n\n  // Generate example server\n  generateFiles(\n    tree,\n    joinPathFragments(import.meta.dirname, 'files'),\n    targetSourceDir,\n    {\n      name,\n      esm,\n      distDir,\n      adotVersion:\n        TS_VERSIONS['@aws/aws-distro-opentelemetry-node-autoinstrumentation'],\n      nodeBaseImage: BASE_IMAGES.node,\n      npmVersion: TS_VERSIONS.npm,\n    },\n    { overwriteStrategy: OverwriteStrategy.KeepExisting },\n  );\n\n  // Add dependencies\n  const deps = withVersions([\n    '@modelcontextprotocol/sdk',\n    'zod',\n    'express',\n    '@aws-lambda-powertools/parameters',\n    '@aws-sdk/client-appconfigdata',\n  ]);\n  const devDeps = withVersions([\n    'tsx',\n    '@types/express',\n    '@modelcontextprotocol/inspector',\n  ]);\n\n  // Add hosting based on infra\n  if (infra === 'agentcore') {\n    const containers = await resolveContainers(tree, 'inherit');\n    const dockerImageTag = `${getNpmScope(tree)}-${name}:latest`;\n\n    // Add bundle target\n    await addTypeScriptBundleTarget(tree, project, {\n      targetFilePath: `${targetSourceDirRelativeToProjectRoot}/http.ts`,\n      bundleOutputDir: joinPathFragments('mcp', name),\n    });\n\n    const dockerOutputDir = joinPathFragments(\n      'dist',\n      project.root,\n      'bundle',\n      'mcp',\n      name,\n    );\n    const dockerTargetName = `${mcpTargetPrefix}-docker`;\n\n    const fs = new FsCommands(tree);\n    project.targets[dockerTargetName] = {\n      cache: true,\n      outputs: [`{workspaceRoot}/${dockerOutputDir}/Dockerfile`],\n      executor: 'nx:run-commands',\n      options: {\n        commands: [\n          fs.cp(\n            `${targetSourceDir}/Dockerfile`,\n            `${dockerOutputDir}/Dockerfile`,\n          ),\n          `${containers} build --platform linux/arm64 -t ${dockerImageTag} ${dockerOutputDir}`,\n        ],\n        parallel: false,\n      },\n      dependsOn: ['bundle'],\n    };\n\n    addDependencyToTargetIfNotPresent(project, 'docker', dockerTargetName);\n    addDependencyToTargetIfNotPresent(project, 'build', 'docker');\n\n    addDockerScanTarget(tree, {\n      project,\n      containerEngine: containers,\n      trivyTargetName: `${mcpTargetPrefix}-trivy`,\n      dockerTargetName,\n      imageTags: [dockerImageTag],\n    });\n\n    // Add shared constructs\n    const iac = await resolveIac(tree, options.iac);\n    await sharedConstructsGenerator(tree, { iac });\n\n    // Add the construct to deploy the mcp server\n    await addMcpServerInfra(tree, {\n      mcpServerNameKebabCase: name,\n      mcpServerNameClassName,\n      projectName: project.name,\n      dockerImageTag,\n      dockerOutputDir,\n      iac,\n      auth,\n      containers,\n    });\n  } else {\n    // No Dockerfile needed for non-hosted MCP\n    tree.delete(joinPathFragments(targetSourceDir, 'Dockerfile'));\n  }\n\n  addDependenciesToPackageJson(tree, deps, devDeps);\n  // Add to the project's package.json too if it has one (e.g. nx plugins),\n  // otherwise dependencies live in the workspace root only.\n  if (tree.exists(projectPackageJsonPath)) {\n    addDependenciesToPackageJson(tree, deps, devDeps, projectPackageJsonPath);\n  }\n\n  // @modelcontextprotocol/sdk declares zod as a peer dependency with a wide range\n  // (^3.25 || ^4.0). Yarn does not dedupe the peer to the workspace's pinned zod, so\n  // without a resolution it installs a separate zod under the SDK's own node_modules.\n  // The two zod copies have structurally incompatible types, which breaks type\n  // inference for registerTool inputSchema. Scope the resolution to the SDK so\n  // other consumers (e.g. @tanstack/router-generator pinning zod@3) are unaffected.\n  if (detectPackageManager() === 'yarn') {\n    updateJson(tree, 'package.json', (packageJson) => {\n      packageJson.resolutions = {\n        ...packageJson.resolutions,\n        '**/@modelcontextprotocol/sdk/zod': TS_VERSIONS['zod'],\n      };\n      return packageJson;\n    });\n  }\n\n  const localDevPort = assignPort(tree, project, 8000, {\n    component: { info: TS_MCP_SERVER_GENERATOR_INFO, name: mcpTargetPrefix },\n  });\n\n  const mcpTargets = {\n    ...project.targets,\n    // Add targets for running the MCP server\n    [`${mcpTargetPrefix}-serve-stdio`]: {\n      executor: 'nx:run-commands',\n      continuous: true,\n      options: {\n        commands: [`tsx --watch ${relativeSourceDir}/stdio.ts`],\n        cwd: '{projectRoot}',\n      },\n    },\n    [`${mcpTargetPrefix}-serve`]: {\n      executor: 'nx:run-commands',\n      continuous: true,\n      options: {\n        commands: [`tsx --watch ${relativeSourceDir}/http.ts`],\n        cwd: '{projectRoot}',\n        env: {\n          PORT: `${localDevPort}`,\n        },\n      },\n    },\n    [`${mcpTargetPrefix}-dev`]: {\n      executor: 'nx:run-commands',\n      continuous: true,\n      options: {\n        commands: [`tsx --watch ${relativeSourceDir}/http.ts`],\n        cwd: '{projectRoot}',\n        env: {\n          PORT: `${localDevPort}`,\n          LOCAL_DEV: 'true',\n        },\n      },\n    },\n    [`${mcpTargetPrefix}-inspect`]: {\n      executor: 'nx:run-commands',\n      continuous: true,\n      // Launch the inspector against the locally served HTTP server. The dev\n      // target starts the server and any connected dependencies (e.g. a local\n      // database).\n      dependsOn: [`${mcpTargetPrefix}-dev`],\n      options: {\n        commands: [\n          `mcp-inspector --transport http --server-url http://localhost:${localDevPort}/mcp`,\n        ],\n        cwd: '{projectRoot}',\n      },\n    },\n    [`${mcpTargetPrefix}-inspect-stdio`]: {\n      executor: 'nx:run-commands',\n      continuous: true,\n      options: {\n        commands: [\n          `mcp-inspector -- tsx --watch ${relativeSourceDir}/stdio.ts`,\n        ],\n        cwd: '{projectRoot}',\n      },\n    },\n  };\n\n  // Aggregate `<mcp>-dev` under the project-level `dev` target.\n  addComponentDevTarget(mcpTargets, `${mcpTargetPrefix}-dev`);\n\n  updateProjectConfiguration(tree, project.name, {\n    ...project,\n    // Sort targets so their order is stable regardless of insertion order on\n    // first run vs re-run.\n    targets: sortObjectKeys(mcpTargets),\n  });\n\n  addComponentGeneratorMetadata(\n    tree,\n    project.name,\n    TS_MCP_SERVER_GENERATOR_INFO,\n    targetSourceDirRelativeToProjectRoot,\n    mcpTargetPrefix,\n    {\n      port: localDevPort,\n      rc: mcpServerNameClassName,\n      auth,\n    },\n  );\n\n  await addGeneratorMetricsIfApplicable(tree, [TS_MCP_SERVER_GENERATOR_INFO]);\n\n  await ensureLicenseExceptions(tree, MCP_INSPECTOR_EXCEPTIONS);\n\n  await formatFilesInSubtree(tree);\n  return () =>\n    installDependencies(tree, options.preferInstallDependencies, {\n      languages: ['typescript'],\n    });\n};\n\nexport default tsMcpServerGenerator;\n"],"names":["addDependenciesToPackageJson","detectPackageManager","generateFiles","joinPathFragments","OverwriteStrategy","readJson","updateJson","updateProjectConfiguration","ensureLicenseExceptions","MCP_INSPECTOR_EXCEPTIONS","addMcpServerInfra","addTypeScriptBundleTarget","resolveContainers","addDockerScanTarget","formatFilesInSubtree","FsCommands","resolveIac","installDependencies","addGeneratorMetricsIfApplicable","isEsmWorkspace","kebabCase","toClassName","getNpmScope","addComponentDevTarget","addComponentGeneratorMetadata","addDependencyToTargetIfNotPresent","getGeneratorInfo","readProjectConfigurationUnqualified","sortObjectKeys","assignPort","sharedConstructsGenerator","BASE_IMAGES","TS_VERSIONS","withVersions","TS_MCP_SERVER_GENERATOR_INFO","filename","tsMcpServerGenerator","tree","options","project","exists","root","Error","defaultName","name","split","pop","mcpServerNameClassName","mcpTargetPrefix","targetSourceDirRelativeToProjectRoot","targetSourceDir","relativeSourceDir","replace","distDir","infra","auth","console","warn","projectPackageJsonPath","esm","type","dirname","adotVersion","nodeBaseImage","node","npmVersion","npm","overwriteStrategy","KeepExisting","deps","devDeps","containers","dockerImageTag","targetFilePath","bundleOutputDir","dockerOutputDir","dockerTargetName","fs","targets","cache","outputs","executor","commands","cp","parallel","dependsOn","containerEngine","trivyTargetName","imageTags","iac","mcpServerNameKebabCase","projectName","delete","packageJson","resolutions","localDevPort","component","info","mcpTargets","continuous","cwd","env","PORT","LOCAL_DEV","port","rc","preferInstallDependencies","languages"],"mappings":"AAAA;;;CAGC,GACD,SACEA,4BAA4B,EAC5BC,oBAAoB,EAEpBC,aAAa,EACbC,iBAAiB,EACjBC,iBAAiB,EACjBC,QAAQ,EAERC,UAAU,EACVC,0BAA0B,QACrB,aAAa;AACpB,SAASC,uBAAuB,QAAQ,0BAAuB;AAC/D,SAASC,wBAAwB,QAAQ,oCAAiC;AAC1E,SAASC,iBAAiB,QAAQ,6DAA0D;AAC5F,SAASC,yBAAyB,QAAQ,+BAA4B;AACtE,SAASC,iBAAiB,QAAQ,4BAAyB;AAC3D,SAASC,mBAAmB,QAAQ,wBAAqB;AACzD,SAASC,oBAAoB,QAAQ,wBAAqB;AAC1D,SAASC,UAAU,QAAQ,oBAAiB;AAC5C,SAASC,UAAU,QAAQ,qBAAkB;AAC7C,SAASC,mBAAmB,QAAQ,yBAAsB;AAC1D,SAASC,+BAA+B,QAAQ,yBAAsB;AACtE,SAASC,cAAc,QAAQ,+BAA4B;AAC3D,SAASC,SAAS,EAAEC,WAAW,QAAQ,uBAAoB;AAC3D,SAASC,WAAW,QAAQ,2BAAwB;AACpD,SACEC,qBAAqB,EACrBC,6BAA6B,EAC7BC,iCAAiC,EACjCC,gBAAgB,EAEhBC,mCAAmC,QAC9B,oBAAiB;AACxB,SAASC,cAAc,QAAQ,wBAAqB;AACpD,SAASC,UAAU,QAAQ,sBAAmB;AAC9C,SAASC,yBAAyB,QAAQ,mCAAgC;AAC1E,SAASC,WAAW,EAAEC,WAAW,EAAEC,YAAY,QAAQ,0BAAuB;AAG9E,OAAO,MAAMC,+BAAgDR,iBAC3D,YAAYS,QAAQ,EACpB;AAEF,OAAO,MAAMC,uBAAuB,OAClCC,MACAC;IAEA,MAAMC,UAAUZ,oCAAoCU,MAAMC,QAAQC,OAAO;IAEzE,IAAI,CAACF,KAAKG,MAAM,CAACrC,kBAAkBoC,QAAQE,IAAI,EAAE,mBAAmB;QAClE,MAAM,IAAIC,MACR,CAAC,oBAAoB,EAAEJ,QAAQC,OAAO,CAAC,sDAAsD,CAAC;IAElG;IAEA,MAAMI,cAAc,GAAGvB,UAAUmB,QAAQK,IAAI,CAACC,KAAK,CAAC,KAAKC,GAAG,IAAI,WAAW,CAAC;IAC5E,MAAMF,OAAOxB,UAAUkB,QAAQM,IAAI,IAAID;IACvC,MAAMI,yBAAyB1B,YAAYuB;IAC3C,MAAMI,kBAAkBV,QAAQM,IAAI,GAAGA,OAAO;IAC9C,MAAMK,uCAAuC9C,kBAC3C,OACA6C;IAEF,MAAME,kBAAkB/C,kBACtBoC,QAAQE,IAAI,EACZQ;IAEF,MAAME,oBAAoBD,gBAAgBE,OAAO,CAACb,QAAQE,IAAI,GAAG,KAAK;IACtE,MAAMY,UAAUlD,kBAAkB,QAAQoC,QAAQE,IAAI;IAEtD,MAAMa,QAAQhB,QAAQgB,KAAK,IAAI;IAE/B,IAAIA,UAAU,UAAUhB,QAAQiB,IAAI,IAAIjB,QAAQiB,IAAI,KAAK,OAAO;QAC9DC,QAAQC,IAAI,CACV;IAEJ;IAEA,MAAMF,OAAOjB,QAAQiB,IAAI,IAAI;IAE7B,MAAMG,yBAAyBvD,kBAC7BoC,QAAQE,IAAI,EACZ;IAGF,yEAAyE;IACzE,4EAA4E;IAC5E,yEAAyE;IACzE,MAAMkB,MAAMtB,KAAKG,MAAM,CAACkB,0BACpBrD,SAASgC,MAAMqB,wBAAwBE,IAAI,KAAK,WAChDzC,eAAekB;IAEnB,0BAA0B;IAC1BnC,cACEmC,MACAlC,kBAAkB,YAAY0D,OAAO,EAAE,UACvCX,iBACA;QACEN;QACAe;QACAN;QACAS,aACE9B,WAAW,CAAC,yDAAyD;QACvE+B,eAAehC,YAAYiC,IAAI;QAC/BC,YAAYjC,YAAYkC,GAAG;IAC7B,GACA;QAAEC,mBAAmB/D,kBAAkBgE,YAAY;IAAC;IAGtD,mBAAmB;IACnB,MAAMC,OAAOpC,aAAa;QACxB;QACA;QACA;QACA;QACA;KACD;IACD,MAAMqC,UAAUrC,aAAa;QAC3B;QACA;QACA;KACD;IAED,6BAA6B;IAC7B,IAAIqB,UAAU,aAAa;QACzB,MAAMiB,aAAa,MAAM3D,kBAAkByB,MAAM;QACjD,MAAMmC,iBAAiB,GAAGlD,YAAYe,MAAM,CAAC,EAAEO,KAAK,OAAO,CAAC;QAE5D,oBAAoB;QACpB,MAAMjC,0BAA0B0B,MAAME,SAAS;YAC7CkC,gBAAgB,GAAGxB,qCAAqC,QAAQ,CAAC;YACjEyB,iBAAiBvE,kBAAkB,OAAOyC;QAC5C;QAEA,MAAM+B,kBAAkBxE,kBACtB,QACAoC,QAAQE,IAAI,EACZ,UACA,OACAG;QAEF,MAAMgC,mBAAmB,GAAG5B,gBAAgB,OAAO,CAAC;QAEpD,MAAM6B,KAAK,IAAI9D,WAAWsB;QAC1BE,QAAQuC,OAAO,CAACF,iBAAiB,GAAG;YAClCG,OAAO;YACPC,SAAS;gBAAC,CAAC,gBAAgB,EAAEL,gBAAgB,WAAW,CAAC;aAAC;YAC1DM,UAAU;YACV3C,SAAS;gBACP4C,UAAU;oBACRL,GAAGM,EAAE,CACH,GAAGjC,gBAAgB,WAAW,CAAC,EAC/B,GAAGyB,gBAAgB,WAAW,CAAC;oBAEjC,GAAGJ,WAAW,iCAAiC,EAAEC,eAAe,CAAC,EAAEG,iBAAiB;iBACrF;gBACDS,UAAU;YACZ;YACAC,WAAW;gBAAC;aAAS;QACvB;QAEA5D,kCAAkCc,SAAS,UAAUqC;QACrDnD,kCAAkCc,SAAS,SAAS;QAEpD1B,oBAAoBwB,MAAM;YACxBE;YACA+C,iBAAiBf;YACjBgB,iBAAiB,GAAGvC,gBAAgB,MAAM,CAAC;YAC3C4B;YACAY,WAAW;gBAAChB;aAAe;QAC7B;QAEA,wBAAwB;QACxB,MAAMiB,MAAM,MAAMzE,WAAWqB,MAAMC,QAAQmD,GAAG;QAC9C,MAAM3D,0BAA0BO,MAAM;YAAEoD;QAAI;QAE5C,6CAA6C;QAC7C,MAAM/E,kBAAkB2B,MAAM;YAC5BqD,wBAAwB9C;YACxBG;YACA4C,aAAapD,QAAQK,IAAI;YACzB4B;YACAG;YACAc;YACAlC;YACAgB;QACF;IACF,OAAO;QACL,0CAA0C;QAC1ClC,KAAKuD,MAAM,CAACzF,kBAAkB+C,iBAAiB;IACjD;IAEAlD,6BAA6BqC,MAAMgC,MAAMC;IACzC,yEAAyE;IACzE,0DAA0D;IAC1D,IAAIjC,KAAKG,MAAM,CAACkB,yBAAyB;QACvC1D,6BAA6BqC,MAAMgC,MAAMC,SAASZ;IACpD;IAEA,gFAAgF;IAChF,mFAAmF;IACnF,oFAAoF;IACpF,6EAA6E;IAC7E,6EAA6E;IAC7E,kFAAkF;IAClF,IAAIzD,2BAA2B,QAAQ;QACrCK,WAAW+B,MAAM,gBAAgB,CAACwD;YAChCA,YAAYC,WAAW,GAAG;gBACxB,GAAGD,YAAYC,WAAW;gBAC1B,oCAAoC9D,WAAW,CAAC,MAAM;YACxD;YACA,OAAO6D;QACT;IACF;IAEA,MAAME,eAAelE,WAAWQ,MAAME,SAAS,MAAM;QACnDyD,WAAW;YAAEC,MAAM/D;YAA8BU,MAAMI;QAAgB;IACzE;IAEA,MAAMkD,aAAa;QACjB,GAAG3D,QAAQuC,OAAO;QAClB,yCAAyC;QACzC,CAAC,GAAG9B,gBAAgB,YAAY,CAAC,CAAC,EAAE;YAClCiC,UAAU;YACVkB,YAAY;YACZ7D,SAAS;gBACP4C,UAAU;oBAAC,CAAC,YAAY,EAAE/B,kBAAkB,SAAS,CAAC;iBAAC;gBACvDiD,KAAK;YACP;QACF;QACA,CAAC,GAAGpD,gBAAgB,MAAM,CAAC,CAAC,EAAE;YAC5BiC,UAAU;YACVkB,YAAY;YACZ7D,SAAS;gBACP4C,UAAU;oBAAC,CAAC,YAAY,EAAE/B,kBAAkB,QAAQ,CAAC;iBAAC;gBACtDiD,KAAK;gBACLC,KAAK;oBACHC,MAAM,GAAGP,cAAc;gBACzB;YACF;QACF;QACA,CAAC,GAAG/C,gBAAgB,IAAI,CAAC,CAAC,EAAE;YAC1BiC,UAAU;YACVkB,YAAY;YACZ7D,SAAS;gBACP4C,UAAU;oBAAC,CAAC,YAAY,EAAE/B,kBAAkB,QAAQ,CAAC;iBAAC;gBACtDiD,KAAK;gBACLC,KAAK;oBACHC,MAAM,GAAGP,cAAc;oBACvBQ,WAAW;gBACb;YACF;QACF;QACA,CAAC,GAAGvD,gBAAgB,QAAQ,CAAC,CAAC,EAAE;YAC9BiC,UAAU;YACVkB,YAAY;YACZ,uEAAuE;YACvE,wEAAwE;YACxE,aAAa;YACbd,WAAW;gBAAC,GAAGrC,gBAAgB,IAAI,CAAC;aAAC;YACrCV,SAAS;gBACP4C,UAAU;oBACR,CAAC,6DAA6D,EAAEa,aAAa,IAAI,CAAC;iBACnF;gBACDK,KAAK;YACP;QACF;QACA,CAAC,GAAGpD,gBAAgB,cAAc,CAAC,CAAC,EAAE;YACpCiC,UAAU;YACVkB,YAAY;YACZ7D,SAAS;gBACP4C,UAAU;oBACR,CAAC,6BAA6B,EAAE/B,kBAAkB,SAAS,CAAC;iBAC7D;gBACDiD,KAAK;YACP;QACF;IACF;IAEA,8DAA8D;IAC9D7E,sBAAsB2E,YAAY,GAAGlD,gBAAgB,IAAI,CAAC;IAE1DzC,2BAA2B8B,MAAME,QAAQK,IAAI,EAAE;QAC7C,GAAGL,OAAO;QACV,yEAAyE;QACzE,uBAAuB;QACvBuC,SAASlD,eAAesE;IAC1B;IAEA1E,8BACEa,MACAE,QAAQK,IAAI,EACZV,8BACAe,sCACAD,iBACA;QACEwD,MAAMT;QACNU,IAAI1D;QACJQ;IACF;IAGF,MAAMrC,gCAAgCmB,MAAM;QAACH;KAA6B;IAE1E,MAAM1B,wBAAwB6B,MAAM5B;IAEpC,MAAMK,qBAAqBuB;IAC3B,OAAO,IACLpB,oBAAoBoB,MAAMC,QAAQoE,yBAAyB,EAAE;YAC3DC,WAAW;gBAAC;aAAa;QAC3B;AACJ,EAAE;AAEF,eAAevE,qBAAqB"}
+{"version":3,"sources":["../../../../../../packages/nx-plugin/src/ts/mcp-server/generator.ts"],"sourcesContent":["/**\n * Copyright Amazon.com, Inc. or its affiliates. All Rights Reserved.\n * SPDX-License-Identifier: Apache-2.0\n */\nimport {\n  addDependenciesToPackageJson,\n  detectPackageManager,\n  type GeneratorCallback,\n  generateFiles,\n  joinPathFragments,\n  OverwriteStrategy,\n  readJson,\n  type Tree,\n  updateJson,\n  updateProjectConfiguration,\n} from '@nx/devkit';\nimport { ensureLicenseExceptions } from '../../license/config';\nimport { MCP_INSPECTOR_EXCEPTIONS } from '../../license/known-exceptions';\nimport { addMcpServerInfra } from '../../utils/agent-core-constructs/agent-core-constructs';\nimport { addTypeScriptBundleTarget } from '../../utils/bundle/bundle';\nimport { resolveContainers } from '../../utils/containers';\nimport { addDockerScanTarget } from '../../utils/docker';\nimport { formatFilesInSubtree } from '../../utils/format';\nimport { FsCommands } from '../../utils/fs';\nimport { resolveIac } from '../../utils/iac';\nimport { installDependencies } from '../../utils/install';\nimport { addGeneratorMetricsIfApplicable } from '../../utils/metrics';\nimport { isEsmWorkspace } from '../../utils/module-format';\nimport { kebabCase, toClassName } from '../../utils/names';\nimport { getNpmScope } from '../../utils/npm-scope';\nimport {\n  addComponentDevTarget,\n  addComponentGeneratorMetadata,\n  addDependencyToTargetIfNotPresent,\n  getGeneratorInfo,\n  type NxGeneratorInfo,\n  readProjectConfigurationUnqualified,\n} from '../../utils/nx';\nimport { sortObjectKeys } from '../../utils/object';\nimport { assignPort } from '../../utils/port';\nimport { sharedConstructsGenerator } from '../../utils/shared-constructs';\nimport { BASE_IMAGES, TS_VERSIONS, withVersions } from '../../utils/versions';\nimport type { TsMcpServerGeneratorSchema } from './schema';\n\nexport const TS_MCP_SERVER_GENERATOR_INFO: NxGeneratorInfo = getGeneratorInfo(\n  import.meta.filename,\n);\n\nexport const tsMcpServerGenerator = async (\n  tree: Tree,\n  options: TsMcpServerGeneratorSchema,\n): Promise<GeneratorCallback> => {\n  const project = readProjectConfigurationUnqualified(tree, options.project);\n\n  if (!tree.exists(joinPathFragments(project.root, 'tsconfig.json'))) {\n    throw new Error(\n      `Unsupported project ${options.project}. Expected a TypeScript project (with a tsconfig.json)`,\n    );\n  }\n\n  const defaultName = `${kebabCase(project.name.split('/').pop())}-mcp-server`;\n  const name = kebabCase(options.name || defaultName);\n  const mcpServerNameClassName = toClassName(name);\n  const mcpTargetPrefix = options.name ? name : 'mcp-server';\n  const targetSourceDirRelativeToProjectRoot = joinPathFragments(\n    'src',\n    mcpTargetPrefix,\n  );\n  const targetSourceDir = joinPathFragments(\n    project.root,\n    targetSourceDirRelativeToProjectRoot,\n  );\n  const relativeSourceDir = targetSourceDir.replace(project.root + '/', './');\n  const distDir = joinPathFragments('dist', project.root);\n\n  const infra = options.infra ?? 'agentcore';\n\n  if (infra === 'none' && options.auth && options.auth !== 'iam') {\n    console.warn(\n      'Warning: auth is ignored when no infrastructure is configured (no infrastructure is generated)',\n    );\n  }\n\n  const auth = options.auth ?? 'iam';\n\n  const projectPackageJsonPath = joinPathFragments(\n    project.root,\n    'package.json',\n  );\n\n  // Generate esm if the module system is esm, otherwise commonjs. Projects\n  // don't typically have their own package.json (dependencies are declared in\n  // the workspace root), so fall back to the workspace format when absent.\n  const esm = tree.exists(projectPackageJsonPath)\n    ? readJson(tree, projectPackageJsonPath).type === 'module'\n    : isEsmWorkspace(tree);\n\n  // Generate example server\n  generateFiles(\n    tree,\n    joinPathFragments(import.meta.dirname, 'files'),\n    targetSourceDir,\n    {\n      name,\n      esm,\n      distDir,\n      adotVersion:\n        TS_VERSIONS['@aws/aws-distro-opentelemetry-node-autoinstrumentation'],\n      jaegerVersion: TS_VERSIONS['@opentelemetry/propagator-jaeger'],\n      nodeBaseImage: BASE_IMAGES.node,\n      npmVersion: TS_VERSIONS.npm,\n    },\n    { overwriteStrategy: OverwriteStrategy.KeepExisting },\n  );\n\n  // Add dependencies\n  const deps = withVersions([\n    '@modelcontextprotocol/sdk',\n    'zod',\n    'express',\n    '@aws-lambda-powertools/parameters',\n    '@aws-sdk/client-appconfigdata',\n  ]);\n  const devDeps = withVersions([\n    'tsx',\n    '@types/express',\n    '@modelcontextprotocol/inspector',\n  ]);\n\n  // Add hosting based on infra\n  if (infra === 'agentcore') {\n    const containers = await resolveContainers(tree, 'inherit');\n    const dockerImageTag = `${getNpmScope(tree)}-${name}:latest`;\n\n    // Add bundle target\n    await addTypeScriptBundleTarget(tree, project, {\n      targetFilePath: `${targetSourceDirRelativeToProjectRoot}/http.ts`,\n      bundleOutputDir: joinPathFragments('mcp', name),\n    });\n\n    const dockerOutputDir = joinPathFragments(\n      'dist',\n      project.root,\n      'bundle',\n      'mcp',\n      name,\n    );\n    const dockerTargetName = `${mcpTargetPrefix}-docker`;\n\n    const fs = new FsCommands(tree);\n    project.targets[dockerTargetName] = {\n      cache: true,\n      outputs: [`{workspaceRoot}/${dockerOutputDir}/Dockerfile`],\n      executor: 'nx:run-commands',\n      options: {\n        commands: [\n          fs.cp(\n            `${targetSourceDir}/Dockerfile`,\n            `${dockerOutputDir}/Dockerfile`,\n          ),\n          `${containers} build --platform linux/arm64 -t ${dockerImageTag} ${dockerOutputDir}`,\n        ],\n        parallel: false,\n      },\n      dependsOn: ['bundle'],\n    };\n\n    addDependencyToTargetIfNotPresent(project, 'docker', dockerTargetName);\n    addDependencyToTargetIfNotPresent(project, 'build', 'docker');\n\n    addDockerScanTarget(tree, {\n      project,\n      containerEngine: containers,\n      trivyTargetName: `${mcpTargetPrefix}-trivy`,\n      dockerTargetName,\n      imageTags: [dockerImageTag],\n    });\n\n    // Add shared constructs\n    const iac = await resolveIac(tree, options.iac);\n    await sharedConstructsGenerator(tree, { iac });\n\n    // Add the construct to deploy the mcp server\n    await addMcpServerInfra(tree, {\n      mcpServerNameKebabCase: name,\n      mcpServerNameClassName,\n      projectName: project.name,\n      dockerImageTag,\n      dockerOutputDir,\n      iac,\n      auth,\n      containers,\n    });\n  } else {\n    // No Dockerfile needed for non-hosted MCP\n    tree.delete(joinPathFragments(targetSourceDir, 'Dockerfile'));\n  }\n\n  addDependenciesToPackageJson(tree, deps, devDeps);\n  // Add to the project's package.json too if it has one (e.g. nx plugins),\n  // otherwise dependencies live in the workspace root only.\n  if (tree.exists(projectPackageJsonPath)) {\n    addDependenciesToPackageJson(tree, deps, devDeps, projectPackageJsonPath);\n  }\n\n  // @modelcontextprotocol/sdk declares zod as a peer dependency with a wide range\n  // (^3.25 || ^4.0). Yarn does not dedupe the peer to the workspace's pinned zod, so\n  // without a resolution it installs a separate zod under the SDK's own node_modules.\n  // The two zod copies have structurally incompatible types, which breaks type\n  // inference for registerTool inputSchema. Scope the resolution to the SDK so\n  // other consumers (e.g. @tanstack/router-generator pinning zod@3) are unaffected.\n  if (detectPackageManager() === 'yarn') {\n    updateJson(tree, 'package.json', (packageJson) => {\n      packageJson.resolutions = {\n        ...packageJson.resolutions,\n        '**/@modelcontextprotocol/sdk/zod': TS_VERSIONS['zod'],\n      };\n      return packageJson;\n    });\n  }\n\n  const localDevPort = assignPort(tree, project, 8000, {\n    component: { info: TS_MCP_SERVER_GENERATOR_INFO, name: mcpTargetPrefix },\n  });\n\n  const mcpTargets = {\n    ...project.targets,\n    // Add targets for running the MCP server\n    [`${mcpTargetPrefix}-serve-stdio`]: {\n      executor: 'nx:run-commands',\n      continuous: true,\n      options: {\n        commands: [`tsx --watch ${relativeSourceDir}/stdio.ts`],\n        cwd: '{projectRoot}',\n      },\n    },\n    [`${mcpTargetPrefix}-serve`]: {\n      executor: 'nx:run-commands',\n      continuous: true,\n      options: {\n        commands: [`tsx --watch ${relativeSourceDir}/http.ts`],\n        cwd: '{projectRoot}',\n        env: {\n          PORT: `${localDevPort}`,\n        },\n      },\n    },\n    [`${mcpTargetPrefix}-dev`]: {\n      executor: 'nx:run-commands',\n      continuous: true,\n      options: {\n        commands: [`tsx --watch ${relativeSourceDir}/http.ts`],\n        cwd: '{projectRoot}',\n        env: {\n          PORT: `${localDevPort}`,\n          LOCAL_DEV: 'true',\n        },\n      },\n    },\n    [`${mcpTargetPrefix}-inspect`]: {\n      executor: 'nx:run-commands',\n      continuous: true,\n      // Launch the inspector against the locally served HTTP server. The dev\n      // target starts the server and any connected dependencies (e.g. a local\n      // database).\n      dependsOn: [`${mcpTargetPrefix}-dev`],\n      options: {\n        commands: [\n          `mcp-inspector --transport http --server-url http://localhost:${localDevPort}/mcp`,\n        ],\n        cwd: '{projectRoot}',\n      },\n    },\n    [`${mcpTargetPrefix}-inspect-stdio`]: {\n      executor: 'nx:run-commands',\n      continuous: true,\n      options: {\n        commands: [\n          `mcp-inspector -- tsx --watch ${relativeSourceDir}/stdio.ts`,\n        ],\n        cwd: '{projectRoot}',\n      },\n    },\n  };\n\n  // Aggregate `<mcp>-dev` under the project-level `dev` target.\n  addComponentDevTarget(mcpTargets, `${mcpTargetPrefix}-dev`);\n\n  updateProjectConfiguration(tree, project.name, {\n    ...project,\n    // Sort targets so their order is stable regardless of insertion order on\n    // first run vs re-run.\n    targets: sortObjectKeys(mcpTargets),\n  });\n\n  addComponentGeneratorMetadata(\n    tree,\n    project.name,\n    TS_MCP_SERVER_GENERATOR_INFO,\n    targetSourceDirRelativeToProjectRoot,\n    mcpTargetPrefix,\n    {\n      port: localDevPort,\n      rc: mcpServerNameClassName,\n      auth,\n    },\n  );\n\n  await addGeneratorMetricsIfApplicable(tree, [TS_MCP_SERVER_GENERATOR_INFO]);\n\n  await ensureLicenseExceptions(tree, MCP_INSPECTOR_EXCEPTIONS);\n\n  await formatFilesInSubtree(tree);\n  return () =>\n    installDependencies(tree, options.preferInstallDependencies, {\n      languages: ['typescript'],\n    });\n};\n\nexport default tsMcpServerGenerator;\n"],"names":["addDependenciesToPackageJson","detectPackageManager","generateFiles","joinPathFragments","OverwriteStrategy","readJson","updateJson","updateProjectConfiguration","ensureLicenseExceptions","MCP_INSPECTOR_EXCEPTIONS","addMcpServerInfra","addTypeScriptBundleTarget","resolveContainers","addDockerScanTarget","formatFilesInSubtree","FsCommands","resolveIac","installDependencies","addGeneratorMetricsIfApplicable","isEsmWorkspace","kebabCase","toClassName","getNpmScope","addComponentDevTarget","addComponentGeneratorMetadata","addDependencyToTargetIfNotPresent","getGeneratorInfo","readProjectConfigurationUnqualified","sortObjectKeys","assignPort","sharedConstructsGenerator","BASE_IMAGES","TS_VERSIONS","withVersions","TS_MCP_SERVER_GENERATOR_INFO","filename","tsMcpServerGenerator","tree","options","project","exists","root","Error","defaultName","name","split","pop","mcpServerNameClassName","mcpTargetPrefix","targetSourceDirRelativeToProjectRoot","targetSourceDir","relativeSourceDir","replace","distDir","infra","auth","console","warn","projectPackageJsonPath","esm","type","dirname","adotVersion","jaegerVersion","nodeBaseImage","node","npmVersion","npm","overwriteStrategy","KeepExisting","deps","devDeps","containers","dockerImageTag","targetFilePath","bundleOutputDir","dockerOutputDir","dockerTargetName","fs","targets","cache","outputs","executor","commands","cp","parallel","dependsOn","containerEngine","trivyTargetName","imageTags","iac","mcpServerNameKebabCase","projectName","delete","packageJson","resolutions","localDevPort","component","info","mcpTargets","continuous","cwd","env","PORT","LOCAL_DEV","port","rc","preferInstallDependencies","languages"],"mappings":"AAAA;;;CAGC,GACD,SACEA,4BAA4B,EAC5BC,oBAAoB,EAEpBC,aAAa,EACbC,iBAAiB,EACjBC,iBAAiB,EACjBC,QAAQ,EAERC,UAAU,EACVC,0BAA0B,QACrB,aAAa;AACpB,SAASC,uBAAuB,QAAQ,0BAAuB;AAC/D,SAASC,wBAAwB,QAAQ,oCAAiC;AAC1E,SAASC,iBAAiB,QAAQ,6DAA0D;AAC5F,SAASC,yBAAyB,QAAQ,+BAA4B;AACtE,SAASC,iBAAiB,QAAQ,4BAAyB;AAC3D,SAASC,mBAAmB,QAAQ,wBAAqB;AACzD,SAASC,oBAAoB,QAAQ,wBAAqB;AAC1D,SAASC,UAAU,QAAQ,oBAAiB;AAC5C,SAASC,UAAU,QAAQ,qBAAkB;AAC7C,SAASC,mBAAmB,QAAQ,yBAAsB;AAC1D,SAASC,+BAA+B,QAAQ,yBAAsB;AACtE,SAASC,cAAc,QAAQ,+BAA4B;AAC3D,SAASC,SAAS,EAAEC,WAAW,QAAQ,uBAAoB;AAC3D,SAASC,WAAW,QAAQ,2BAAwB;AACpD,SACEC,qBAAqB,EACrBC,6BAA6B,EAC7BC,iCAAiC,EACjCC,gBAAgB,EAEhBC,mCAAmC,QAC9B,oBAAiB;AACxB,SAASC,cAAc,QAAQ,wBAAqB;AACpD,SAASC,UAAU,QAAQ,sBAAmB;AAC9C,SAASC,yBAAyB,QAAQ,mCAAgC;AAC1E,SAASC,WAAW,EAAEC,WAAW,EAAEC,YAAY,QAAQ,0BAAuB;AAG9E,OAAO,MAAMC,+BAAgDR,iBAC3D,YAAYS,QAAQ,EACpB;AAEF,OAAO,MAAMC,uBAAuB,OAClCC,MACAC;IAEA,MAAMC,UAAUZ,oCAAoCU,MAAMC,QAAQC,OAAO;IAEzE,IAAI,CAACF,KAAKG,MAAM,CAACrC,kBAAkBoC,QAAQE,IAAI,EAAE,mBAAmB;QAClE,MAAM,IAAIC,MACR,CAAC,oBAAoB,EAAEJ,QAAQC,OAAO,CAAC,sDAAsD,CAAC;IAElG;IAEA,MAAMI,cAAc,GAAGvB,UAAUmB,QAAQK,IAAI,CAACC,KAAK,CAAC,KAAKC,GAAG,IAAI,WAAW,CAAC;IAC5E,MAAMF,OAAOxB,UAAUkB,QAAQM,IAAI,IAAID;IACvC,MAAMI,yBAAyB1B,YAAYuB;IAC3C,MAAMI,kBAAkBV,QAAQM,IAAI,GAAGA,OAAO;IAC9C,MAAMK,uCAAuC9C,kBAC3C,OACA6C;IAEF,MAAME,kBAAkB/C,kBACtBoC,QAAQE,IAAI,EACZQ;IAEF,MAAME,oBAAoBD,gBAAgBE,OAAO,CAACb,QAAQE,IAAI,GAAG,KAAK;IACtE,MAAMY,UAAUlD,kBAAkB,QAAQoC,QAAQE,IAAI;IAEtD,MAAMa,QAAQhB,QAAQgB,KAAK,IAAI;IAE/B,IAAIA,UAAU,UAAUhB,QAAQiB,IAAI,IAAIjB,QAAQiB,IAAI,KAAK,OAAO;QAC9DC,QAAQC,IAAI,CACV;IAEJ;IAEA,MAAMF,OAAOjB,QAAQiB,IAAI,IAAI;IAE7B,MAAMG,yBAAyBvD,kBAC7BoC,QAAQE,IAAI,EACZ;IAGF,yEAAyE;IACzE,4EAA4E;IAC5E,yEAAyE;IACzE,MAAMkB,MAAMtB,KAAKG,MAAM,CAACkB,0BACpBrD,SAASgC,MAAMqB,wBAAwBE,IAAI,KAAK,WAChDzC,eAAekB;IAEnB,0BAA0B;IAC1BnC,cACEmC,MACAlC,kBAAkB,YAAY0D,OAAO,EAAE,UACvCX,iBACA;QACEN;QACAe;QACAN;QACAS,aACE9B,WAAW,CAAC,yDAAyD;QACvE+B,eAAe/B,WAAW,CAAC,mCAAmC;QAC9DgC,eAAejC,YAAYkC,IAAI;QAC/BC,YAAYlC,YAAYmC,GAAG;IAC7B,GACA;QAAEC,mBAAmBhE,kBAAkBiE,YAAY;IAAC;IAGtD,mBAAmB;IACnB,MAAMC,OAAOrC,aAAa;QACxB;QACA;QACA;QACA;QACA;KACD;IACD,MAAMsC,UAAUtC,aAAa;QAC3B;QACA;QACA;KACD;IAED,6BAA6B;IAC7B,IAAIqB,UAAU,aAAa;QACzB,MAAMkB,aAAa,MAAM5D,kBAAkByB,MAAM;QACjD,MAAMoC,iBAAiB,GAAGnD,YAAYe,MAAM,CAAC,EAAEO,KAAK,OAAO,CAAC;QAE5D,oBAAoB;QACpB,MAAMjC,0BAA0B0B,MAAME,SAAS;YAC7CmC,gBAAgB,GAAGzB,qCAAqC,QAAQ,CAAC;YACjE0B,iBAAiBxE,kBAAkB,OAAOyC;QAC5C;QAEA,MAAMgC,kBAAkBzE,kBACtB,QACAoC,QAAQE,IAAI,EACZ,UACA,OACAG;QAEF,MAAMiC,mBAAmB,GAAG7B,gBAAgB,OAAO,CAAC;QAEpD,MAAM8B,KAAK,IAAI/D,WAAWsB;QAC1BE,QAAQwC,OAAO,CAACF,iBAAiB,GAAG;YAClCG,OAAO;YACPC,SAAS;gBAAC,CAAC,gBAAgB,EAAEL,gBAAgB,WAAW,CAAC;aAAC;YAC1DM,UAAU;YACV5C,SAAS;gBACP6C,UAAU;oBACRL,GAAGM,EAAE,CACH,GAAGlC,gBAAgB,WAAW,CAAC,EAC/B,GAAG0B,gBAAgB,WAAW,CAAC;oBAEjC,GAAGJ,WAAW,iCAAiC,EAAEC,eAAe,CAAC,EAAEG,iBAAiB;iBACrF;gBACDS,UAAU;YACZ;YACAC,WAAW;gBAAC;aAAS;QACvB;QAEA7D,kCAAkCc,SAAS,UAAUsC;QACrDpD,kCAAkCc,SAAS,SAAS;QAEpD1B,oBAAoBwB,MAAM;YACxBE;YACAgD,iBAAiBf;YACjBgB,iBAAiB,GAAGxC,gBAAgB,MAAM,CAAC;YAC3C6B;YACAY,WAAW;gBAAChB;aAAe;QAC7B;QAEA,wBAAwB;QACxB,MAAMiB,MAAM,MAAM1E,WAAWqB,MAAMC,QAAQoD,GAAG;QAC9C,MAAM5D,0BAA0BO,MAAM;YAAEqD;QAAI;QAE5C,6CAA6C;QAC7C,MAAMhF,kBAAkB2B,MAAM;YAC5BsD,wBAAwB/C;YACxBG;YACA6C,aAAarD,QAAQK,IAAI;YACzB6B;YACAG;YACAc;YACAnC;YACAiB;QACF;IACF,OAAO;QACL,0CAA0C;QAC1CnC,KAAKwD,MAAM,CAAC1F,kBAAkB+C,iBAAiB;IACjD;IAEAlD,6BAA6BqC,MAAMiC,MAAMC;IACzC,yEAAyE;IACzE,0DAA0D;IAC1D,IAAIlC,KAAKG,MAAM,CAACkB,yBAAyB;QACvC1D,6BAA6BqC,MAAMiC,MAAMC,SAASb;IACpD;IAEA,gFAAgF;IAChF,mFAAmF;IACnF,oFAAoF;IACpF,6EAA6E;IAC7E,6EAA6E;IAC7E,kFAAkF;IAClF,IAAIzD,2BAA2B,QAAQ;QACrCK,WAAW+B,MAAM,gBAAgB,CAACyD;YAChCA,YAAYC,WAAW,GAAG;gBACxB,GAAGD,YAAYC,WAAW;gBAC1B,oCAAoC/D,WAAW,CAAC,MAAM;YACxD;YACA,OAAO8D;QACT;IACF;IAEA,MAAME,eAAenE,WAAWQ,MAAME,SAAS,MAAM;QACnD0D,WAAW;YAAEC,MAAMhE;YAA8BU,MAAMI;QAAgB;IACzE;IAEA,MAAMmD,aAAa;QACjB,GAAG5D,QAAQwC,OAAO;QAClB,yCAAyC;QACzC,CAAC,GAAG/B,gBAAgB,YAAY,CAAC,CAAC,EAAE;YAClCkC,UAAU;YACVkB,YAAY;YACZ9D,SAAS;gBACP6C,UAAU;oBAAC,CAAC,YAAY,EAAEhC,kBAAkB,SAAS,CAAC;iBAAC;gBACvDkD,KAAK;YACP;QACF;QACA,CAAC,GAAGrD,gBAAgB,MAAM,CAAC,CAAC,EAAE;YAC5BkC,UAAU;YACVkB,YAAY;YACZ9D,SAAS;gBACP6C,UAAU;oBAAC,CAAC,YAAY,EAAEhC,kBAAkB,QAAQ,CAAC;iBAAC;gBACtDkD,KAAK;gBACLC,KAAK;oBACHC,MAAM,GAAGP,cAAc;gBACzB;YACF;QACF;QACA,CAAC,GAAGhD,gBAAgB,IAAI,CAAC,CAAC,EAAE;YAC1BkC,UAAU;YACVkB,YAAY;YACZ9D,SAAS;gBACP6C,UAAU;oBAAC,CAAC,YAAY,EAAEhC,kBAAkB,QAAQ,CAAC;iBAAC;gBACtDkD,KAAK;gBACLC,KAAK;oBACHC,MAAM,GAAGP,cAAc;oBACvBQ,WAAW;gBACb;YACF;QACF;QACA,CAAC,GAAGxD,gBAAgB,QAAQ,CAAC,CAAC,EAAE;YAC9BkC,UAAU;YACVkB,YAAY;YACZ,uEAAuE;YACvE,wEAAwE;YACxE,aAAa;YACbd,WAAW;gBAAC,GAAGtC,gBAAgB,IAAI,CAAC;aAAC;YACrCV,SAAS;gBACP6C,UAAU;oBACR,CAAC,6DAA6D,EAAEa,aAAa,IAAI,CAAC;iBACnF;gBACDK,KAAK;YACP;QACF;QACA,CAAC,GAAGrD,gBAAgB,cAAc,CAAC,CAAC,EAAE;YACpCkC,UAAU;YACVkB,YAAY;YACZ9D,SAAS;gBACP6C,UAAU;oBACR,CAAC,6BAA6B,EAAEhC,kBAAkB,SAAS,CAAC;iBAC7D;gBACDkD,KAAK;YACP;QACF;IACF;IAEA,8DAA8D;IAC9D9E,sBAAsB4E,YAAY,GAAGnD,gBAAgB,IAAI,CAAC;IAE1DzC,2BAA2B8B,MAAME,QAAQK,IAAI,EAAE;QAC7C,GAAGL,OAAO;QACV,yEAAyE;QACzE,uBAAuB;QACvBwC,SAASnD,eAAeuE;IAC1B;IAEA3E,8BACEa,MACAE,QAAQK,IAAI,EACZV,8BACAe,sCACAD,iBACA;QACEyD,MAAMT;QACNU,IAAI3D;QACJQ;IACF;IAGF,MAAMrC,gCAAgCmB,MAAM;QAACH;KAA6B;IAE1E,MAAM1B,wBAAwB6B,MAAM5B;IAEpC,MAAMK,qBAAqBuB;IAC3B,OAAO,IACLpB,oBAAoBoB,MAAMC,QAAQqE,yBAAyB,EAAE;YAC3DC,WAAW;gBAAC;aAAa;QAC3B;AACJ,EAAE;AAEF,eAAexE,qBAAqB"}

package/src/ts/nx-plugin/__snapshots__/generator.spec.ts.snap

@@ -127,7 +127,7 @@ exports[`ts#nx-plugin generator > should generate MCP server files > test-plugin
   - pnpm add -w -D <package>
   - yarn add -D <package>
   - npm install --legacy-peer-deps -D <package>
-  - bun install -D <package>
+  - bun add -D <package>
   - (Omit -D for production dependencies)
 - When specifying project names as arguments to generators, prefer the _fully qualified_ project name, for example \`@workspace-name/project-name\`. Check the \`project.json\` file for the specific package to find its fully qualified name
 - When no generator exists for a specific framework required, look for more generic project generators if availalbe and build on top of these.
@@ -482,7 +482,7 @@ export const buildInstallCommand = (pm: string, pkg: string) =>
     pnpm: \`pnpm add -Dw \${pkg}\`,
     yarn: \`yarn add -D \${pkg}\`,
     npm: \`npm install --legacy-peer-deps -D \${pkg}\`,
-    bun: \`bun install -D \${pkg}\`,
+    bun: \`bun add -D \${pkg}\`,
   })[pm];
 
 const renderSchema = (schema: any) =>

package/src/ts/nx-plugin/files/mcp-server/resources/GENERAL_GUIDANCE.md.template

@@ -30,7 +30,7 @@
   - pnpm add -w -D <package>
   - yarn add -D <package>
   - npm install --legacy-peer-deps -D <package>
-  - bun install -D <package>
+  - bun add -D <package>
   - (Omit -D for production dependencies)
 - When specifying project names as arguments to generators, prefer the _fully qualified_ project name, for example `@workspace-name/project-name`. Check the `project.json` file for the specific package to find its fully qualified name
 - When no generator exists for a specific framework required, look for more generic project generators if availalbe and build on top of these.

package/src/ts/nx-plugin/files/mcp-server/utils.ts.template

@@ -56,7 +56,7 @@ export const buildInstallCommand = (pm: string, pkg: string) =>
     pnpm: `pnpm add -Dw ${pkg}`,
     yarn: `yarn add -D ${pkg}`,
     npm: `npm install --legacy-peer-deps -D ${pkg}`,
-    bun: `bun install -D ${pkg}`,
+    bun: `bun add -D ${pkg}`,
   })[pm];
 
 const renderSchema = (schema: any) =>

package/src/ts/rdb/__snapshots__/generator.spec.ts.snap

@@ -4669,6 +4669,13 @@ exports[`ts#rdb generator > should generate the aurora shared construct 4`] = `
 # Upgrade npm to a version free of known HIGH/CRITICAL vulnerabilities
 RUN npm install -g npm@12.0.1
 
+# Patch OS packages beyond the base image's pinned release, and drop the
+# runtime's convenience copy of the AWS SDK (the handler bundle inlines its
+# own dependencies), keeping the image free of known HIGH/CRITICAL
+# vulnerabilities
+RUN microdnf upgrade -y --releasever latest && microdnf clean all \\
+    && rm -rf /var/runtime/node_modules/@aws-sdk
+
 WORKDIR \${LAMBDA_TASK_ROOT}
 
 # npm blocks dependency install scripts by default; allow prisma's so its

package/src/ts/rdb/files/Dockerfile.template

@@ -3,6 +3,13 @@ FROM public.ecr.aws/lambda/nodejs:24
 # Upgrade npm to a version free of known HIGH/CRITICAL vulnerabilities
 RUN npm install -g npm@<%= npmVersion %>
 
+# Patch OS packages beyond the base image's pinned release, and drop the
+# runtime's convenience copy of the AWS SDK (the handler bundle inlines its
+# own dependencies), keeping the image free of known HIGH/CRITICAL
+# vulnerabilities
+RUN microdnf upgrade -y --releasever latest && microdnf clean all \
+    && rm -rf /var/runtime/node_modules/@aws-sdk
+
 WORKDIR ${LAMBDA_TASK_ROOT}
 
 # npm blocks dependency install scripts by default; allow prisma's so its

package/src/ts/react-website/app/__snapshots__/generator.spec.ts.snap

@@ -961,7 +961,7 @@ exports[`react-website generator > Tanstack router integration > should generate
 
 exports[`react-website generator > Tanstack router integration > should generate website with no router correctly > biome.json 1`] = `
 "{
-  "$schema": "https://biomejs.dev/schemas/2.4.16/schema.json",
+  "$schema": "https://biomejs.dev/schemas/2.5.4/schema.json",
   "root": true,
   "formatter": {
     "enabled": true,
@@ -986,7 +986,7 @@ exports[`react-website generator > Tanstack router integration > should generate
   "linter": {
     "enabled": true,
     "rules": {
-      "recommended": false,
+      "preset": "none",
       "correctness": {
         "noUndeclaredDependencies": "warn"
       }
@@ -2674,7 +2674,7 @@ exports[`react-website generator > Tanstack router integration > should generate
 
 exports[`react-website generator > Tanstack router integration > should generate website with router correctly > biome.json 1`] = `
 "{
-  "$schema": "https://biomejs.dev/schemas/2.4.16/schema.json",
+  "$schema": "https://biomejs.dev/schemas/2.5.4/schema.json",
   "root": true,
   "formatter": {
     "enabled": true,
@@ -2699,7 +2699,7 @@ exports[`react-website generator > Tanstack router integration > should generate
   "linter": {
     "enabled": true,
     "rules": {
-      "recommended": false,
+      "preset": "none",
       "correctness": {
         "noUndeclaredDependencies": "warn"
       }

package/src/utils/agent-core-constructs/agent-core-constructs.d.ts

@@ -53,6 +53,7 @@ export interface AddAgentCoreGatewayInfraProps {
     projectName: string;
     projectDirectory: string;
     cedarPolicy: boolean;
+    auth: AgentCoreAuth;
 }
 export declare const addAgentCoreGatewayInfra: (tree: Tree, options: AddAgentCoreGatewayInfraProps & IACProvider) => Promise<void>;
 export {};

package/src/utils/agent-core-constructs/agent-core-constructs.js

@@ -107,6 +107,7 @@ const addAgentCoreGatewayCDKInfra = async (tree, options)=>{
         nameKebabCase: options.gatewayNameKebabCase,
         projectDirectory: options.projectDirectory,
         cedarPolicy: options.cedarPolicy,
+        auth: options.auth,
         ...esmVars(tree)
     }, {
         overwriteStrategy: OverwriteStrategy.KeepExisting
@@ -126,6 +127,7 @@ const addAgentCoreGatewayTerraformInfra = (tree, options)=>{
         nameKebabCase: options.gatewayNameKebabCase,
         projectDirectory: options.projectDirectory,
         cedarPolicy: options.cedarPolicy,
+        auth: options.auth,
         boto3Version: PY_VERSIONS.boto3,
         httpxVersion: PY_VERSIONS.httpx,
         mcpVersion: PY_VERSIONS.mcp,

package/src/utils/agent-core-constructs/agent-core-constructs.js.map

@@ -1 +1 @@
-{"version":3,"sources":["../../../../../../packages/nx-plugin/src/utils/agent-core-constructs/agent-core-constructs.ts"],"sourcesContent":["/**\n * Copyright Amazon.com, Inc. or its affiliates. All Rights Reserved.\n * SPDX-License-Identifier: Apache-2.0\n */\nimport {\n  generateFiles,\n  joinPathFragments,\n  OverwriteStrategy,\n  type ProjectConfiguration,\n  type Tree,\n  updateJson,\n} from '@nx/devkit';\nimport { addStarExport } from '../ast';\nimport type { Containers } from '../containers';\nimport type { Iac } from '../iac';\nimport { esmVars } from '../module-format';\nimport { addDependencyToTargetIfNotPresent } from '../nx';\nimport {\n  PACKAGES_DIR,\n  SHARED_CONSTRUCTS_DIR,\n  SHARED_TERRAFORM_DIR,\n} from '../shared-constructs-constants';\nimport { PY_VERSIONS, terraformProviderVersions } from '../versions';\n\ntype IACProvider = { iac: Iac };\n\nexport type AgentCoreAuth = 'iam' | 'cognito';\n\nexport interface AddAgentCoreInfraProps {\n  nameClassName: string;\n  nameKebabCase: string;\n  projectName: string;\n  dockerImageTag: string;\n  dockerOutputDir: string;\n  appDirectory: string;\n  serverProtocol: 'mcp' | 'http' | 'a2a';\n  auth: AgentCoreAuth;\n  containers: Containers;\n}\n\nconst addAgentCoreInfra = async (\n  tree: Tree,\n  options: AddAgentCoreInfraProps & { iac: Iac },\n) => {\n  switch (options.iac) {\n    case 'cdk':\n      await addAgentCoreCDKInfra(tree, options);\n      break;\n    case 'terraform':\n      addAgentCoreTerraformInfra(tree, options);\n      break;\n  }\n\n  // Update shared constructs/terraform project configuration to depend on this project\n  updateJson(\n    tree,\n    joinPathFragments(\n      PACKAGES_DIR,\n      options.iac === 'cdk' ? SHARED_CONSTRUCTS_DIR : SHARED_TERRAFORM_DIR,\n      'project.json',\n    ),\n    (config: ProjectConfiguration) => {\n      addDependencyToTargetIfNotPresent(\n        config,\n        'build',\n        `${options.projectName}:build`,\n      );\n      return config;\n    },\n  );\n};\n\nconst addAgentCoreCDKInfra = async (\n  tree: Tree,\n  options: AddAgentCoreInfraProps,\n) => {\n  // Generate app specific CDK construct\n  generateFiles(\n    tree,\n    joinPathFragments(import.meta.dirname, 'files', 'cdk', 'app', 'agent-core'),\n    joinPathFragments(\n      PACKAGES_DIR,\n      SHARED_CONSTRUCTS_DIR,\n      'src',\n      'app',\n      options.appDirectory,\n    ),\n    { ...options, ...esmVars(tree) },\n    {\n      overwriteStrategy: OverwriteStrategy.KeepExisting,\n    },\n  );\n\n  // Export app specific CDK construct\n  await addStarExport(\n    tree,\n    joinPathFragments(\n      PACKAGES_DIR,\n      SHARED_CONSTRUCTS_DIR,\n      'src',\n      'app',\n      options.appDirectory,\n      'index.ts',\n    ),\n    `./${options.nameKebabCase}/${options.nameKebabCase}.js`,\n  );\n  await addStarExport(\n    tree,\n    joinPathFragments(\n      PACKAGES_DIR,\n      SHARED_CONSTRUCTS_DIR,\n      'src',\n      'app',\n      'index.ts',\n    ),\n    `./${options.appDirectory}/index.js`,\n  );\n};\n\nconst addAgentCoreTerraformInfra = (\n  tree: Tree,\n  options: AddAgentCoreInfraProps,\n) => {\n  // Add the AgentCore shared module\n  generateFiles(\n    tree,\n    joinPathFragments(\n      import.meta.dirname,\n      'files',\n      'terraform',\n      'core',\n      'agent-core',\n    ),\n    joinPathFragments(\n      PACKAGES_DIR,\n      SHARED_TERRAFORM_DIR,\n      'src',\n      'core',\n      'agent-core',\n    ),\n    {\n      containers: options.containers,\n      boto3Version: PY_VERSIONS.boto3,\n      ...terraformProviderVersions(),\n    },\n    {\n      overwriteStrategy: OverwriteStrategy.KeepExisting,\n    },\n  );\n\n  // Generate app specific agent core configuration\n  generateFiles(\n    tree,\n    joinPathFragments(\n      import.meta.dirname,\n      'files',\n      'terraform',\n      'app',\n      'agent-core',\n    ),\n    joinPathFragments(\n      PACKAGES_DIR,\n      SHARED_TERRAFORM_DIR,\n      'src',\n      'app',\n      options.appDirectory,\n    ),\n    options,\n    {\n      overwriteStrategy: OverwriteStrategy.KeepExisting,\n    },\n  );\n};\n\nexport interface AddMcpServerInfraProps {\n  mcpServerNameClassName: string;\n  mcpServerNameKebabCase: string;\n  projectName: string;\n  dockerImageTag: string;\n  dockerOutputDir: string;\n  auth: AgentCoreAuth;\n  containers: Containers;\n}\n\n/**\n * Add an MCP server CDK construct\n */\nexport const addMcpServerInfra = async (\n  tree: Tree,\n  options: AddMcpServerInfraProps & IACProvider,\n) => {\n  await addAgentCoreInfra(tree, {\n    nameClassName: options.mcpServerNameClassName,\n    nameKebabCase: options.mcpServerNameKebabCase,\n    dockerImageTag: options.dockerImageTag,\n    dockerOutputDir: options.dockerOutputDir,\n    projectName: options.projectName,\n    appDirectory: 'mcp-servers',\n    serverProtocol: 'mcp',\n    iac: options.iac,\n    auth: options.auth,\n    containers: options.containers,\n  });\n};\n\nexport interface AddAgentInfraProps {\n  agentNameClassName: string;\n  agentNameKebabCase: string;\n  projectName: string;\n  dockerImageTag: string;\n  dockerOutputDir: string;\n  auth: AgentCoreAuth;\n  serverProtocol?: 'http' | 'a2a';\n  containers: Containers;\n}\n\n/**\n * Add an agent CDK construct\n */\nexport const addAgentInfra = async (\n  tree: Tree,\n  options: AddAgentInfraProps & IACProvider,\n) => {\n  await addAgentCoreInfra(tree, {\n    nameClassName: options.agentNameClassName,\n    nameKebabCase: options.agentNameKebabCase,\n    projectName: options.projectName,\n    dockerImageTag: options.dockerImageTag,\n    dockerOutputDir: options.dockerOutputDir,\n    appDirectory: 'agents',\n    serverProtocol: options.serverProtocol ?? 'http',\n    iac: options.iac,\n    auth: options.auth,\n    containers: options.containers,\n  });\n};\n\nexport interface AddAgentCoreGatewayInfraProps {\n  gatewayNameClassName: string;\n  gatewayNameKebabCase: string;\n  projectName: string;\n  projectDirectory: string;\n  cedarPolicy: boolean;\n}\n\nexport const addAgentCoreGatewayInfra = async (\n  tree: Tree,\n  options: AddAgentCoreGatewayInfraProps & IACProvider,\n) => {\n  switch (options.iac) {\n    case 'cdk':\n      await addAgentCoreGatewayCDKInfra(tree, options);\n      break;\n    case 'terraform':\n      addAgentCoreGatewayTerraformInfra(tree, options);\n      break;\n  }\n\n  updateJson(\n    tree,\n    joinPathFragments(\n      PACKAGES_DIR,\n      options.iac === 'cdk' ? SHARED_CONSTRUCTS_DIR : SHARED_TERRAFORM_DIR,\n      'project.json',\n    ),\n    (config: ProjectConfiguration) => {\n      addDependencyToTargetIfNotPresent(\n        config,\n        'build',\n        `${options.projectName}:build`,\n      );\n      return config;\n    },\n  );\n};\n\nconst addAgentCoreGatewayCDKInfra = async (\n  tree: Tree,\n  options: AddAgentCoreGatewayInfraProps,\n) => {\n  // Generic gateway construct (readiness probe, policy engine, Cedar policy\n  // loading) shared by all gateways\n  generateFiles(\n    tree,\n    joinPathFragments(\n      import.meta.dirname,\n      'files',\n      'cdk',\n      'core',\n      'agentcore-gateway',\n    ),\n    joinPathFragments(\n      PACKAGES_DIR,\n      SHARED_CONSTRUCTS_DIR,\n      'src',\n      'core',\n      'agentcore-gateway',\n    ),\n    { ...esmVars(tree) },\n    {\n      overwriteStrategy: OverwriteStrategy.KeepExisting,\n    },\n  );\n\n  generateFiles(\n    tree,\n    joinPathFragments(\n      import.meta.dirname,\n      'files',\n      'cdk',\n      'app',\n      'agentcore-gateway',\n    ),\n    joinPathFragments(\n      PACKAGES_DIR,\n      SHARED_CONSTRUCTS_DIR,\n      'src',\n      'app',\n      'gateways',\n    ),\n    {\n      nameClassName: options.gatewayNameClassName,\n      nameKebabCase: options.gatewayNameKebabCase,\n      projectDirectory: options.projectDirectory,\n      cedarPolicy: options.cedarPolicy,\n      ...esmVars(tree),\n    },\n    {\n      overwriteStrategy: OverwriteStrategy.KeepExisting,\n    },\n  );\n\n  await addStarExport(\n    tree,\n    joinPathFragments(\n      PACKAGES_DIR,\n      SHARED_CONSTRUCTS_DIR,\n      'src',\n      'core',\n      'index.ts',\n    ),\n    './agentcore-gateway/agentcore-gateway.js',\n  );\n  await addStarExport(\n    tree,\n    joinPathFragments(\n      PACKAGES_DIR,\n      SHARED_CONSTRUCTS_DIR,\n      'src',\n      'app',\n      'gateways',\n      'index.ts',\n    ),\n    `./${options.gatewayNameKebabCase}/${options.gatewayNameKebabCase}.js`,\n  );\n  await addStarExport(\n    tree,\n    joinPathFragments(\n      PACKAGES_DIR,\n      SHARED_CONSTRUCTS_DIR,\n      'src',\n      'app',\n      'index.ts',\n    ),\n    './gateways/index.js',\n  );\n};\n\nconst addAgentCoreGatewayTerraformInfra = (\n  tree: Tree,\n  options: AddAgentCoreGatewayInfraProps,\n) => {\n  generateFiles(\n    tree,\n    joinPathFragments(\n      import.meta.dirname,\n      'files',\n      'terraform',\n      'core',\n      'agentcore-gateway',\n    ),\n    joinPathFragments(\n      PACKAGES_DIR,\n      SHARED_TERRAFORM_DIR,\n      'src',\n      'core',\n      'agentcore-gateway',\n    ),\n    { ...terraformProviderVersions() },\n    {\n      overwriteStrategy: OverwriteStrategy.KeepExisting,\n    },\n  );\n\n  generateFiles(\n    tree,\n    joinPathFragments(\n      import.meta.dirname,\n      'files',\n      'terraform',\n      'app',\n      'agentcore-gateway',\n    ),\n    joinPathFragments(\n      PACKAGES_DIR,\n      SHARED_TERRAFORM_DIR,\n      'src',\n      'app',\n      'gateways',\n    ),\n    {\n      nameClassName: options.gatewayNameClassName,\n      nameKebabCase: options.gatewayNameKebabCase,\n      projectDirectory: options.projectDirectory,\n      cedarPolicy: options.cedarPolicy,\n      boto3Version: PY_VERSIONS.boto3,\n      httpxVersion: PY_VERSIONS.httpx,\n      mcpVersion: PY_VERSIONS.mcp,\n      ...terraformProviderVersions(),\n    },\n    {\n      overwriteStrategy: OverwriteStrategy.KeepExisting,\n    },\n  );\n\n  // The Cedar render script is only needed when policies are enabled\n  if (!options.cedarPolicy) {\n    const renderScript = joinPathFragments(\n      PACKAGES_DIR,\n      SHARED_TERRAFORM_DIR,\n      'src',\n      'app',\n      'gateways',\n      options.gatewayNameKebabCase,\n      'render-cedar.cjs',\n    );\n    if (tree.exists(renderScript)) {\n      tree.delete(renderScript);\n    }\n  }\n};\n"],"names":["generateFiles","joinPathFragments","OverwriteStrategy","updateJson","addStarExport","esmVars","addDependencyToTargetIfNotPresent","PACKAGES_DIR","SHARED_CONSTRUCTS_DIR","SHARED_TERRAFORM_DIR","PY_VERSIONS","terraformProviderVersions","addAgentCoreInfra","tree","options","iac","addAgentCoreCDKInfra","addAgentCoreTerraformInfra","config","projectName","dirname","appDirectory","overwriteStrategy","KeepExisting","nameKebabCase","containers","boto3Version","boto3","addMcpServerInfra","nameClassName","mcpServerNameClassName","mcpServerNameKebabCase","dockerImageTag","dockerOutputDir","serverProtocol","auth","addAgentInfra","agentNameClassName","agentNameKebabCase","addAgentCoreGatewayInfra","addAgentCoreGatewayCDKInfra","addAgentCoreGatewayTerraformInfra","gatewayNameClassName","gatewayNameKebabCase","projectDirectory","cedarPolicy","httpxVersion","httpx","mcpVersion","mcp","renderScript","exists","delete"],"mappings":"AAAA;;;CAGC,GACD,SACEA,aAAa,EACbC,iBAAiB,EACjBC,iBAAiB,EAGjBC,UAAU,QACL,aAAa;AACpB,SAASC,aAAa,QAAQ,YAAS;AAGvC,SAASC,OAAO,QAAQ,sBAAmB;AAC3C,SAASC,iCAAiC,QAAQ,WAAQ;AAC1D,SACEC,YAAY,EACZC,qBAAqB,EACrBC,oBAAoB,QACf,oCAAiC;AACxC,SAASC,WAAW,EAAEC,yBAAyB,QAAQ,iBAAc;AAkBrE,MAAMC,oBAAoB,OACxBC,MACAC;IAEA,OAAQA,QAAQC,GAAG;QACjB,KAAK;YACH,MAAMC,qBAAqBH,MAAMC;YACjC;QACF,KAAK;YACHG,2BAA2BJ,MAAMC;YACjC;IACJ;IAEA,qFAAqF;IACrFX,WACEU,MACAZ,kBACEM,cACAO,QAAQC,GAAG,KAAK,QAAQP,wBAAwBC,sBAChD,iBAEF,CAACS;QACCZ,kCACEY,QACA,SACA,GAAGJ,QAAQK,WAAW,CAAC,MAAM,CAAC;QAEhC,OAAOD;IACT;AAEJ;AAEA,MAAMF,uBAAuB,OAC3BH,MACAC;IAEA,sCAAsC;IACtCd,cACEa,MACAZ,kBAAkB,YAAYmB,OAAO,EAAE,SAAS,OAAO,OAAO,eAC9DnB,kBACEM,cACAC,uBACA,OACA,OACAM,QAAQO,YAAY,GAEtB;QAAE,GAAGP,OAAO;QAAE,GAAGT,QAAQQ,KAAK;IAAC,GAC/B;QACES,mBAAmBpB,kBAAkBqB,YAAY;IACnD;IAGF,oCAAoC;IACpC,MAAMnB,cACJS,MACAZ,kBACEM,cACAC,uBACA,OACA,OACAM,QAAQO,YAAY,EACpB,aAEF,CAAC,EAAE,EAAEP,QAAQU,aAAa,CAAC,CAAC,EAAEV,QAAQU,aAAa,CAAC,GAAG,CAAC;IAE1D,MAAMpB,cACJS,MACAZ,kBACEM,cACAC,uBACA,OACA,OACA,aAEF,CAAC,EAAE,EAAEM,QAAQO,YAAY,CAAC,SAAS,CAAC;AAExC;AAEA,MAAMJ,6BAA6B,CACjCJ,MACAC;IAEA,kCAAkC;IAClCd,cACEa,MACAZ,kBACE,YAAYmB,OAAO,EACnB,SACA,aACA,QACA,eAEFnB,kBACEM,cACAE,sBACA,OACA,QACA,eAEF;QACEgB,YAAYX,QAAQW,UAAU;QAC9BC,cAAchB,YAAYiB,KAAK;QAC/B,GAAGhB,2BAA2B;IAChC,GACA;QACEW,mBAAmBpB,kBAAkBqB,YAAY;IACnD;IAGF,iDAAiD;IACjDvB,cACEa,MACAZ,kBACE,YAAYmB,OAAO,EACnB,SACA,aACA,OACA,eAEFnB,kBACEM,cACAE,sBACA,OACA,OACAK,QAAQO,YAAY,GAEtBP,SACA;QACEQ,mBAAmBpB,kBAAkBqB,YAAY;IACnD;AAEJ;AAYA;;CAEC,GACD,OAAO,MAAMK,oBAAoB,OAC/Bf,MACAC;IAEA,MAAMF,kBAAkBC,MAAM;QAC5BgB,eAAef,QAAQgB,sBAAsB;QAC7CN,eAAeV,QAAQiB,sBAAsB;QAC7CC,gBAAgBlB,QAAQkB,cAAc;QACtCC,iBAAiBnB,QAAQmB,eAAe;QACxCd,aAAaL,QAAQK,WAAW;QAChCE,cAAc;QACda,gBAAgB;QAChBnB,KAAKD,QAAQC,GAAG;QAChBoB,MAAMrB,QAAQqB,IAAI;QAClBV,YAAYX,QAAQW,UAAU;IAChC;AACF,EAAE;AAaF;;CAEC,GACD,OAAO,MAAMW,gBAAgB,OAC3BvB,MACAC;IAEA,MAAMF,kBAAkBC,MAAM;QAC5BgB,eAAef,QAAQuB,kBAAkB;QACzCb,eAAeV,QAAQwB,kBAAkB;QACzCnB,aAAaL,QAAQK,WAAW;QAChCa,gBAAgBlB,QAAQkB,cAAc;QACtCC,iBAAiBnB,QAAQmB,eAAe;QACxCZ,cAAc;QACda,gBAAgBpB,QAAQoB,cAAc,IAAI;QAC1CnB,KAAKD,QAAQC,GAAG;QAChBoB,MAAMrB,QAAQqB,IAAI;QAClBV,YAAYX,QAAQW,UAAU;IAChC;AACF,EAAE;AAUF,OAAO,MAAMc,2BAA2B,OACtC1B,MACAC;IAEA,OAAQA,QAAQC,GAAG;QACjB,KAAK;YACH,MAAMyB,4BAA4B3B,MAAMC;YACxC;QACF,KAAK;YACH2B,kCAAkC5B,MAAMC;YACxC;IACJ;IAEAX,WACEU,MACAZ,kBACEM,cACAO,QAAQC,GAAG,KAAK,QAAQP,wBAAwBC,sBAChD,iBAEF,CAACS;QACCZ,kCACEY,QACA,SACA,GAAGJ,QAAQK,WAAW,CAAC,MAAM,CAAC;QAEhC,OAAOD;IACT;AAEJ,EAAE;AAEF,MAAMsB,8BAA8B,OAClC3B,MACAC;IAEA,0EAA0E;IAC1E,kCAAkC;IAClCd,cACEa,MACAZ,kBACE,YAAYmB,OAAO,EACnB,SACA,OACA,QACA,sBAEFnB,kBACEM,cACAC,uBACA,OACA,QACA,sBAEF;QAAE,GAAGH,QAAQQ,KAAK;IAAC,GACnB;QACES,mBAAmBpB,kBAAkBqB,YAAY;IACnD;IAGFvB,cACEa,MACAZ,kBACE,YAAYmB,OAAO,EACnB,SACA,OACA,OACA,sBAEFnB,kBACEM,cACAC,uBACA,OACA,OACA,aAEF;QACEqB,eAAef,QAAQ4B,oBAAoB;QAC3ClB,eAAeV,QAAQ6B,oBAAoB;QAC3CC,kBAAkB9B,QAAQ8B,gBAAgB;QAC1CC,aAAa/B,QAAQ+B,WAAW;QAChC,GAAGxC,QAAQQ,KAAK;IAClB,GACA;QACES,mBAAmBpB,kBAAkBqB,YAAY;IACnD;IAGF,MAAMnB,cACJS,MACAZ,kBACEM,cACAC,uBACA,OACA,QACA,aAEF;IAEF,MAAMJ,cACJS,MACAZ,kBACEM,cACAC,uBACA,OACA,OACA,YACA,aAEF,CAAC,EAAE,EAAEM,QAAQ6B,oBAAoB,CAAC,CAAC,EAAE7B,QAAQ6B,oBAAoB,CAAC,GAAG,CAAC;IAExE,MAAMvC,cACJS,MACAZ,kBACEM,cACAC,uBACA,OACA,OACA,aAEF;AAEJ;AAEA,MAAMiC,oCAAoC,CACxC5B,MACAC;IAEAd,cACEa,MACAZ,kBACE,YAAYmB,OAAO,EACnB,SACA,aACA,QACA,sBAEFnB,kBACEM,cACAE,sBACA,OACA,QACA,sBAEF;QAAE,GAAGE,2BAA2B;IAAC,GACjC;QACEW,mBAAmBpB,kBAAkBqB,YAAY;IACnD;IAGFvB,cACEa,MACAZ,kBACE,YAAYmB,OAAO,EACnB,SACA,aACA,OACA,sBAEFnB,kBACEM,cACAE,sBACA,OACA,OACA,aAEF;QACEoB,eAAef,QAAQ4B,oBAAoB;QAC3ClB,eAAeV,QAAQ6B,oBAAoB;QAC3CC,kBAAkB9B,QAAQ8B,gBAAgB;QAC1CC,aAAa/B,QAAQ+B,WAAW;QAChCnB,cAAchB,YAAYiB,KAAK;QAC/BmB,cAAcpC,YAAYqC,KAAK;QAC/BC,YAAYtC,YAAYuC,GAAG;QAC3B,GAAGtC,2BAA2B;IAChC,GACA;QACEW,mBAAmBpB,kBAAkBqB,YAAY;IACnD;IAGF,mEAAmE;IACnE,IAAI,CAACT,QAAQ+B,WAAW,EAAE;QACxB,MAAMK,eAAejD,kBACnBM,cACAE,sBACA,OACA,OACA,YACAK,QAAQ6B,oBAAoB,EAC5B;QAEF,IAAI9B,KAAKsC,MAAM,CAACD,eAAe;YAC7BrC,KAAKuC,MAAM,CAACF;QACd;IACF;AACF"}
+{"version":3,"sources":["../../../../../../packages/nx-plugin/src/utils/agent-core-constructs/agent-core-constructs.ts"],"sourcesContent":["/**\n * Copyright Amazon.com, Inc. or its affiliates. All Rights Reserved.\n * SPDX-License-Identifier: Apache-2.0\n */\nimport {\n  generateFiles,\n  joinPathFragments,\n  OverwriteStrategy,\n  type ProjectConfiguration,\n  type Tree,\n  updateJson,\n} from '@nx/devkit';\nimport { addStarExport } from '../ast';\nimport type { Containers } from '../containers';\nimport type { Iac } from '../iac';\nimport { esmVars } from '../module-format';\nimport { addDependencyToTargetIfNotPresent } from '../nx';\nimport {\n  PACKAGES_DIR,\n  SHARED_CONSTRUCTS_DIR,\n  SHARED_TERRAFORM_DIR,\n} from '../shared-constructs-constants';\nimport { PY_VERSIONS, terraformProviderVersions } from '../versions';\n\ntype IACProvider = { iac: Iac };\n\nexport type AgentCoreAuth = 'iam' | 'cognito';\n\nexport interface AddAgentCoreInfraProps {\n  nameClassName: string;\n  nameKebabCase: string;\n  projectName: string;\n  dockerImageTag: string;\n  dockerOutputDir: string;\n  appDirectory: string;\n  serverProtocol: 'mcp' | 'http' | 'a2a';\n  auth: AgentCoreAuth;\n  containers: Containers;\n}\n\nconst addAgentCoreInfra = async (\n  tree: Tree,\n  options: AddAgentCoreInfraProps & { iac: Iac },\n) => {\n  switch (options.iac) {\n    case 'cdk':\n      await addAgentCoreCDKInfra(tree, options);\n      break;\n    case 'terraform':\n      addAgentCoreTerraformInfra(tree, options);\n      break;\n  }\n\n  // Update shared constructs/terraform project configuration to depend on this project\n  updateJson(\n    tree,\n    joinPathFragments(\n      PACKAGES_DIR,\n      options.iac === 'cdk' ? SHARED_CONSTRUCTS_DIR : SHARED_TERRAFORM_DIR,\n      'project.json',\n    ),\n    (config: ProjectConfiguration) => {\n      addDependencyToTargetIfNotPresent(\n        config,\n        'build',\n        `${options.projectName}:build`,\n      );\n      return config;\n    },\n  );\n};\n\nconst addAgentCoreCDKInfra = async (\n  tree: Tree,\n  options: AddAgentCoreInfraProps,\n) => {\n  // Generate app specific CDK construct\n  generateFiles(\n    tree,\n    joinPathFragments(import.meta.dirname, 'files', 'cdk', 'app', 'agent-core'),\n    joinPathFragments(\n      PACKAGES_DIR,\n      SHARED_CONSTRUCTS_DIR,\n      'src',\n      'app',\n      options.appDirectory,\n    ),\n    { ...options, ...esmVars(tree) },\n    {\n      overwriteStrategy: OverwriteStrategy.KeepExisting,\n    },\n  );\n\n  // Export app specific CDK construct\n  await addStarExport(\n    tree,\n    joinPathFragments(\n      PACKAGES_DIR,\n      SHARED_CONSTRUCTS_DIR,\n      'src',\n      'app',\n      options.appDirectory,\n      'index.ts',\n    ),\n    `./${options.nameKebabCase}/${options.nameKebabCase}.js`,\n  );\n  await addStarExport(\n    tree,\n    joinPathFragments(\n      PACKAGES_DIR,\n      SHARED_CONSTRUCTS_DIR,\n      'src',\n      'app',\n      'index.ts',\n    ),\n    `./${options.appDirectory}/index.js`,\n  );\n};\n\nconst addAgentCoreTerraformInfra = (\n  tree: Tree,\n  options: AddAgentCoreInfraProps,\n) => {\n  // Add the AgentCore shared module\n  generateFiles(\n    tree,\n    joinPathFragments(\n      import.meta.dirname,\n      'files',\n      'terraform',\n      'core',\n      'agent-core',\n    ),\n    joinPathFragments(\n      PACKAGES_DIR,\n      SHARED_TERRAFORM_DIR,\n      'src',\n      'core',\n      'agent-core',\n    ),\n    {\n      containers: options.containers,\n      boto3Version: PY_VERSIONS.boto3,\n      ...terraformProviderVersions(),\n    },\n    {\n      overwriteStrategy: OverwriteStrategy.KeepExisting,\n    },\n  );\n\n  // Generate app specific agent core configuration\n  generateFiles(\n    tree,\n    joinPathFragments(\n      import.meta.dirname,\n      'files',\n      'terraform',\n      'app',\n      'agent-core',\n    ),\n    joinPathFragments(\n      PACKAGES_DIR,\n      SHARED_TERRAFORM_DIR,\n      'src',\n      'app',\n      options.appDirectory,\n    ),\n    options,\n    {\n      overwriteStrategy: OverwriteStrategy.KeepExisting,\n    },\n  );\n};\n\nexport interface AddMcpServerInfraProps {\n  mcpServerNameClassName: string;\n  mcpServerNameKebabCase: string;\n  projectName: string;\n  dockerImageTag: string;\n  dockerOutputDir: string;\n  auth: AgentCoreAuth;\n  containers: Containers;\n}\n\n/**\n * Add an MCP server CDK construct\n */\nexport const addMcpServerInfra = async (\n  tree: Tree,\n  options: AddMcpServerInfraProps & IACProvider,\n) => {\n  await addAgentCoreInfra(tree, {\n    nameClassName: options.mcpServerNameClassName,\n    nameKebabCase: options.mcpServerNameKebabCase,\n    dockerImageTag: options.dockerImageTag,\n    dockerOutputDir: options.dockerOutputDir,\n    projectName: options.projectName,\n    appDirectory: 'mcp-servers',\n    serverProtocol: 'mcp',\n    iac: options.iac,\n    auth: options.auth,\n    containers: options.containers,\n  });\n};\n\nexport interface AddAgentInfraProps {\n  agentNameClassName: string;\n  agentNameKebabCase: string;\n  projectName: string;\n  dockerImageTag: string;\n  dockerOutputDir: string;\n  auth: AgentCoreAuth;\n  serverProtocol?: 'http' | 'a2a';\n  containers: Containers;\n}\n\n/**\n * Add an agent CDK construct\n */\nexport const addAgentInfra = async (\n  tree: Tree,\n  options: AddAgentInfraProps & IACProvider,\n) => {\n  await addAgentCoreInfra(tree, {\n    nameClassName: options.agentNameClassName,\n    nameKebabCase: options.agentNameKebabCase,\n    projectName: options.projectName,\n    dockerImageTag: options.dockerImageTag,\n    dockerOutputDir: options.dockerOutputDir,\n    appDirectory: 'agents',\n    serverProtocol: options.serverProtocol ?? 'http',\n    iac: options.iac,\n    auth: options.auth,\n    containers: options.containers,\n  });\n};\n\nexport interface AddAgentCoreGatewayInfraProps {\n  gatewayNameClassName: string;\n  gatewayNameKebabCase: string;\n  projectName: string;\n  projectDirectory: string;\n  cedarPolicy: boolean;\n  auth: AgentCoreAuth;\n}\n\nexport const addAgentCoreGatewayInfra = async (\n  tree: Tree,\n  options: AddAgentCoreGatewayInfraProps & IACProvider,\n) => {\n  switch (options.iac) {\n    case 'cdk':\n      await addAgentCoreGatewayCDKInfra(tree, options);\n      break;\n    case 'terraform':\n      addAgentCoreGatewayTerraformInfra(tree, options);\n      break;\n  }\n\n  updateJson(\n    tree,\n    joinPathFragments(\n      PACKAGES_DIR,\n      options.iac === 'cdk' ? SHARED_CONSTRUCTS_DIR : SHARED_TERRAFORM_DIR,\n      'project.json',\n    ),\n    (config: ProjectConfiguration) => {\n      addDependencyToTargetIfNotPresent(\n        config,\n        'build',\n        `${options.projectName}:build`,\n      );\n      return config;\n    },\n  );\n};\n\nconst addAgentCoreGatewayCDKInfra = async (\n  tree: Tree,\n  options: AddAgentCoreGatewayInfraProps,\n) => {\n  // Generic gateway construct (readiness probe, policy engine, Cedar policy\n  // loading) shared by all gateways\n  generateFiles(\n    tree,\n    joinPathFragments(\n      import.meta.dirname,\n      'files',\n      'cdk',\n      'core',\n      'agentcore-gateway',\n    ),\n    joinPathFragments(\n      PACKAGES_DIR,\n      SHARED_CONSTRUCTS_DIR,\n      'src',\n      'core',\n      'agentcore-gateway',\n    ),\n    { ...esmVars(tree) },\n    {\n      overwriteStrategy: OverwriteStrategy.KeepExisting,\n    },\n  );\n\n  generateFiles(\n    tree,\n    joinPathFragments(\n      import.meta.dirname,\n      'files',\n      'cdk',\n      'app',\n      'agentcore-gateway',\n    ),\n    joinPathFragments(\n      PACKAGES_DIR,\n      SHARED_CONSTRUCTS_DIR,\n      'src',\n      'app',\n      'gateways',\n    ),\n    {\n      nameClassName: options.gatewayNameClassName,\n      nameKebabCase: options.gatewayNameKebabCase,\n      projectDirectory: options.projectDirectory,\n      cedarPolicy: options.cedarPolicy,\n      auth: options.auth,\n      ...esmVars(tree),\n    },\n    {\n      overwriteStrategy: OverwriteStrategy.KeepExisting,\n    },\n  );\n\n  await addStarExport(\n    tree,\n    joinPathFragments(\n      PACKAGES_DIR,\n      SHARED_CONSTRUCTS_DIR,\n      'src',\n      'core',\n      'index.ts',\n    ),\n    './agentcore-gateway/agentcore-gateway.js',\n  );\n  await addStarExport(\n    tree,\n    joinPathFragments(\n      PACKAGES_DIR,\n      SHARED_CONSTRUCTS_DIR,\n      'src',\n      'app',\n      'gateways',\n      'index.ts',\n    ),\n    `./${options.gatewayNameKebabCase}/${options.gatewayNameKebabCase}.js`,\n  );\n  await addStarExport(\n    tree,\n    joinPathFragments(\n      PACKAGES_DIR,\n      SHARED_CONSTRUCTS_DIR,\n      'src',\n      'app',\n      'index.ts',\n    ),\n    './gateways/index.js',\n  );\n};\n\nconst addAgentCoreGatewayTerraformInfra = (\n  tree: Tree,\n  options: AddAgentCoreGatewayInfraProps,\n) => {\n  generateFiles(\n    tree,\n    joinPathFragments(\n      import.meta.dirname,\n      'files',\n      'terraform',\n      'core',\n      'agentcore-gateway',\n    ),\n    joinPathFragments(\n      PACKAGES_DIR,\n      SHARED_TERRAFORM_DIR,\n      'src',\n      'core',\n      'agentcore-gateway',\n    ),\n    { ...terraformProviderVersions() },\n    {\n      overwriteStrategy: OverwriteStrategy.KeepExisting,\n    },\n  );\n\n  generateFiles(\n    tree,\n    joinPathFragments(\n      import.meta.dirname,\n      'files',\n      'terraform',\n      'app',\n      'agentcore-gateway',\n    ),\n    joinPathFragments(\n      PACKAGES_DIR,\n      SHARED_TERRAFORM_DIR,\n      'src',\n      'app',\n      'gateways',\n    ),\n    {\n      nameClassName: options.gatewayNameClassName,\n      nameKebabCase: options.gatewayNameKebabCase,\n      projectDirectory: options.projectDirectory,\n      cedarPolicy: options.cedarPolicy,\n      auth: options.auth,\n      boto3Version: PY_VERSIONS.boto3,\n      httpxVersion: PY_VERSIONS.httpx,\n      mcpVersion: PY_VERSIONS.mcp,\n      ...terraformProviderVersions(),\n    },\n    {\n      overwriteStrategy: OverwriteStrategy.KeepExisting,\n    },\n  );\n\n  // The Cedar render script is only needed when policies are enabled\n  if (!options.cedarPolicy) {\n    const renderScript = joinPathFragments(\n      PACKAGES_DIR,\n      SHARED_TERRAFORM_DIR,\n      'src',\n      'app',\n      'gateways',\n      options.gatewayNameKebabCase,\n      'render-cedar.cjs',\n    );\n    if (tree.exists(renderScript)) {\n      tree.delete(renderScript);\n    }\n  }\n};\n"],"names":["generateFiles","joinPathFragments","OverwriteStrategy","updateJson","addStarExport","esmVars","addDependencyToTargetIfNotPresent","PACKAGES_DIR","SHARED_CONSTRUCTS_DIR","SHARED_TERRAFORM_DIR","PY_VERSIONS","terraformProviderVersions","addAgentCoreInfra","tree","options","iac","addAgentCoreCDKInfra","addAgentCoreTerraformInfra","config","projectName","dirname","appDirectory","overwriteStrategy","KeepExisting","nameKebabCase","containers","boto3Version","boto3","addMcpServerInfra","nameClassName","mcpServerNameClassName","mcpServerNameKebabCase","dockerImageTag","dockerOutputDir","serverProtocol","auth","addAgentInfra","agentNameClassName","agentNameKebabCase","addAgentCoreGatewayInfra","addAgentCoreGatewayCDKInfra","addAgentCoreGatewayTerraformInfra","gatewayNameClassName","gatewayNameKebabCase","projectDirectory","cedarPolicy","httpxVersion","httpx","mcpVersion","mcp","renderScript","exists","delete"],"mappings":"AAAA;;;CAGC,GACD,SACEA,aAAa,EACbC,iBAAiB,EACjBC,iBAAiB,EAGjBC,UAAU,QACL,aAAa;AACpB,SAASC,aAAa,QAAQ,YAAS;AAGvC,SAASC,OAAO,QAAQ,sBAAmB;AAC3C,SAASC,iCAAiC,QAAQ,WAAQ;AAC1D,SACEC,YAAY,EACZC,qBAAqB,EACrBC,oBAAoB,QACf,oCAAiC;AACxC,SAASC,WAAW,EAAEC,yBAAyB,QAAQ,iBAAc;AAkBrE,MAAMC,oBAAoB,OACxBC,MACAC;IAEA,OAAQA,QAAQC,GAAG;QACjB,KAAK;YACH,MAAMC,qBAAqBH,MAAMC;YACjC;QACF,KAAK;YACHG,2BAA2BJ,MAAMC;YACjC;IACJ;IAEA,qFAAqF;IACrFX,WACEU,MACAZ,kBACEM,cACAO,QAAQC,GAAG,KAAK,QAAQP,wBAAwBC,sBAChD,iBAEF,CAACS;QACCZ,kCACEY,QACA,SACA,GAAGJ,QAAQK,WAAW,CAAC,MAAM,CAAC;QAEhC,OAAOD;IACT;AAEJ;AAEA,MAAMF,uBAAuB,OAC3BH,MACAC;IAEA,sCAAsC;IACtCd,cACEa,MACAZ,kBAAkB,YAAYmB,OAAO,EAAE,SAAS,OAAO,OAAO,eAC9DnB,kBACEM,cACAC,uBACA,OACA,OACAM,QAAQO,YAAY,GAEtB;QAAE,GAAGP,OAAO;QAAE,GAAGT,QAAQQ,KAAK;IAAC,GAC/B;QACES,mBAAmBpB,kBAAkBqB,YAAY;IACnD;IAGF,oCAAoC;IACpC,MAAMnB,cACJS,MACAZ,kBACEM,cACAC,uBACA,OACA,OACAM,QAAQO,YAAY,EACpB,aAEF,CAAC,EAAE,EAAEP,QAAQU,aAAa,CAAC,CAAC,EAAEV,QAAQU,aAAa,CAAC,GAAG,CAAC;IAE1D,MAAMpB,cACJS,MACAZ,kBACEM,cACAC,uBACA,OACA,OACA,aAEF,CAAC,EAAE,EAAEM,QAAQO,YAAY,CAAC,SAAS,CAAC;AAExC;AAEA,MAAMJ,6BAA6B,CACjCJ,MACAC;IAEA,kCAAkC;IAClCd,cACEa,MACAZ,kBACE,YAAYmB,OAAO,EACnB,SACA,aACA,QACA,eAEFnB,kBACEM,cACAE,sBACA,OACA,QACA,eAEF;QACEgB,YAAYX,QAAQW,UAAU;QAC9BC,cAAchB,YAAYiB,KAAK;QAC/B,GAAGhB,2BAA2B;IAChC,GACA;QACEW,mBAAmBpB,kBAAkBqB,YAAY;IACnD;IAGF,iDAAiD;IACjDvB,cACEa,MACAZ,kBACE,YAAYmB,OAAO,EACnB,SACA,aACA,OACA,eAEFnB,kBACEM,cACAE,sBACA,OACA,OACAK,QAAQO,YAAY,GAEtBP,SACA;QACEQ,mBAAmBpB,kBAAkBqB,YAAY;IACnD;AAEJ;AAYA;;CAEC,GACD,OAAO,MAAMK,oBAAoB,OAC/Bf,MACAC;IAEA,MAAMF,kBAAkBC,MAAM;QAC5BgB,eAAef,QAAQgB,sBAAsB;QAC7CN,eAAeV,QAAQiB,sBAAsB;QAC7CC,gBAAgBlB,QAAQkB,cAAc;QACtCC,iBAAiBnB,QAAQmB,eAAe;QACxCd,aAAaL,QAAQK,WAAW;QAChCE,cAAc;QACda,gBAAgB;QAChBnB,KAAKD,QAAQC,GAAG;QAChBoB,MAAMrB,QAAQqB,IAAI;QAClBV,YAAYX,QAAQW,UAAU;IAChC;AACF,EAAE;AAaF;;CAEC,GACD,OAAO,MAAMW,gBAAgB,OAC3BvB,MACAC;IAEA,MAAMF,kBAAkBC,MAAM;QAC5BgB,eAAef,QAAQuB,kBAAkB;QACzCb,eAAeV,QAAQwB,kBAAkB;QACzCnB,aAAaL,QAAQK,WAAW;QAChCa,gBAAgBlB,QAAQkB,cAAc;QACtCC,iBAAiBnB,QAAQmB,eAAe;QACxCZ,cAAc;QACda,gBAAgBpB,QAAQoB,cAAc,IAAI;QAC1CnB,KAAKD,QAAQC,GAAG;QAChBoB,MAAMrB,QAAQqB,IAAI;QAClBV,YAAYX,QAAQW,UAAU;IAChC;AACF,EAAE;AAWF,OAAO,MAAMc,2BAA2B,OACtC1B,MACAC;IAEA,OAAQA,QAAQC,GAAG;QACjB,KAAK;YACH,MAAMyB,4BAA4B3B,MAAMC;YACxC;QACF,KAAK;YACH2B,kCAAkC5B,MAAMC;YACxC;IACJ;IAEAX,WACEU,MACAZ,kBACEM,cACAO,QAAQC,GAAG,KAAK,QAAQP,wBAAwBC,sBAChD,iBAEF,CAACS;QACCZ,kCACEY,QACA,SACA,GAAGJ,QAAQK,WAAW,CAAC,MAAM,CAAC;QAEhC,OAAOD;IACT;AAEJ,EAAE;AAEF,MAAMsB,8BAA8B,OAClC3B,MACAC;IAEA,0EAA0E;IAC1E,kCAAkC;IAClCd,cACEa,MACAZ,kBACE,YAAYmB,OAAO,EACnB,SACA,OACA,QACA,sBAEFnB,kBACEM,cACAC,uBACA,OACA,QACA,sBAEF;QAAE,GAAGH,QAAQQ,KAAK;IAAC,GACnB;QACES,mBAAmBpB,kBAAkBqB,YAAY;IACnD;IAGFvB,cACEa,MACAZ,kBACE,YAAYmB,OAAO,EACnB,SACA,OACA,OACA,sBAEFnB,kBACEM,cACAC,uBACA,OACA,OACA,aAEF;QACEqB,eAAef,QAAQ4B,oBAAoB;QAC3ClB,eAAeV,QAAQ6B,oBAAoB;QAC3CC,kBAAkB9B,QAAQ8B,gBAAgB;QAC1CC,aAAa/B,QAAQ+B,WAAW;QAChCV,MAAMrB,QAAQqB,IAAI;QAClB,GAAG9B,QAAQQ,KAAK;IAClB,GACA;QACES,mBAAmBpB,kBAAkBqB,YAAY;IACnD;IAGF,MAAMnB,cACJS,MACAZ,kBACEM,cACAC,uBACA,OACA,QACA,aAEF;IAEF,MAAMJ,cACJS,MACAZ,kBACEM,cACAC,uBACA,OACA,OACA,YACA,aAEF,CAAC,EAAE,EAAEM,QAAQ6B,oBAAoB,CAAC,CAAC,EAAE7B,QAAQ6B,oBAAoB,CAAC,GAAG,CAAC;IAExE,MAAMvC,cACJS,MACAZ,kBACEM,cACAC,uBACA,OACA,OACA,aAEF;AAEJ;AAEA,MAAMiC,oCAAoC,CACxC5B,MACAC;IAEAd,cACEa,MACAZ,kBACE,YAAYmB,OAAO,EACnB,SACA,aACA,QACA,sBAEFnB,kBACEM,cACAE,sBACA,OACA,QACA,sBAEF;QAAE,GAAGE,2BAA2B;IAAC,GACjC;QACEW,mBAAmBpB,kBAAkBqB,YAAY;IACnD;IAGFvB,cACEa,MACAZ,kBACE,YAAYmB,OAAO,EACnB,SACA,aACA,OACA,sBAEFnB,kBACEM,cACAE,sBACA,OACA,OACA,aAEF;QACEoB,eAAef,QAAQ4B,oBAAoB;QAC3ClB,eAAeV,QAAQ6B,oBAAoB;QAC3CC,kBAAkB9B,QAAQ8B,gBAAgB;QAC1CC,aAAa/B,QAAQ+B,WAAW;QAChCV,MAAMrB,QAAQqB,IAAI;QAClBT,cAAchB,YAAYiB,KAAK;QAC/BmB,cAAcpC,YAAYqC,KAAK;QAC/BC,YAAYtC,YAAYuC,GAAG;QAC3B,GAAGtC,2BAA2B;IAChC,GACA;QACEW,mBAAmBpB,kBAAkBqB,YAAY;IACnD;IAGF,mEAAmE;IACnE,IAAI,CAACT,QAAQ+B,WAAW,EAAE;QACxB,MAAMK,eAAejD,kBACnBM,cACAE,sBACA,OACA,OACA,YACAK,QAAQ6B,oBAAoB,EAC5B;QAEF,IAAI9B,KAAKsC,MAAM,CAACD,eAAe;YAC7BrC,KAAKuC,MAAM,CAACF;QACd;IACF;AACF"}

package/src/utils/agent-core-constructs/files/cdk/app/agentcore-gateway/__nameKebabCase__/__nameKebabCase__.ts.template

@@ -3,6 +3,10 @@ import { Construct } from 'constructs';
 import * as path from 'node:path';
 import * as url from 'node:url';
 <%_ } _%>
+<%_ if (auth === 'cognito') { _%>
+import { GatewayAuthorizer } from 'aws-cdk-lib/aws-bedrockagentcore';
+import { IUserPool, IUserPoolClient } from 'aws-cdk-lib/aws-cognito';
+<%_ } _%>
 import {
   AgentCoreGateway,
   AgentCoreGatewayProps,
@@ -12,14 +16,28 @@ import { RuntimeConfig } from '../../../core/runtime-config<% if (esm) { %>.js<%
 import { findWorkspaceRoot } from '../../../core/workspace<% if (esm) { %>.js<% } %>';
 <%_ } _%>
 
-<%_ if (cedarPolicy) { _%>
+<%_ if (auth === 'cognito') { _%>
+export type <%- nameClassName %>Props = Omit<
+  AgentCoreGatewayProps,
+  <%_ if (cedarPolicy) { _%>'cedarPolicyPath' | <%_ } _%>'authorizer'
+> & {
+  /**
+   * Identity details for Cognito authentication. Callers authenticate with a
+   * JWT bearer token issued by this user pool.
+   */
+  identity: {
+    userPool: IUserPool;
+    userPoolClient: IUserPoolClient;
+  };
+};
+<%_ } else if (cedarPolicy) { _%>
 export type <%- nameClassName %>Props = Omit<AgentCoreGatewayProps, 'cedarPolicyPath'>;
 <%_ } else { _%>
 export type <%- nameClassName %>Props = AgentCoreGatewayProps;
 <%_ } _%>
 
 /**
- * AgentCore Gateway wired for MCP protocol with IAM inbound auth.
+ * AgentCore Gateway wired for MCP protocol with <%- auth === 'cognito' ? 'Cognito (JWT)' : 'IAM' %> inbound auth.
 <%_ if (cedarPolicy) { _%>
  *
  * Cedar policies are loaded from the gateway project's policies/ directory
@@ -30,7 +48,23 @@ export class <%- nameClassName %> extends AgentCoreGateway {
   /** Default Gateway target name when added to another Gateway. */
   public readonly gatewayName = '<%- nameKebabCase %>';
 
-  constructor(scope: Construct, id: string, props?: <%- nameClassName %>Props) {
+  constructor(scope: Construct, id: string, props<%_ if (auth !== 'cognito') { _%>?<%_ } _%>: <%- nameClassName %>Props) {
+<%_ if (auth === 'cognito') { _%>
+    const { identity, ...restProps } = props;
+    super(scope, id, {
+<%_ if (cedarPolicy) { _%>
+      cedarPolicyPath: path.join(
+        findWorkspaceRoot(url.fileURLToPath(new URL(<% if (esm) { %>import.meta.url<% } else { %>require('url').pathToFileURL(__filename).href<% } %>))),
+        '<%- projectDirectory %>/policies',
+      ),
+<%_ } _%>
+      authorizer: GatewayAuthorizer.usingCognito({
+        userPool: identity.userPool,
+        allowedClients: [identity.userPoolClient],
+      }),
+      ...restProps,
+    });
+<%_ } else { _%>
     super(scope, id, {
 <%_ if (cedarPolicy) { _%>
       cedarPolicyPath: path.join(
@@ -40,6 +74,7 @@ export class <%- nameClassName %> extends AgentCoreGateway {
 <%_ } _%>
       ...props,
     });
+<%_ } _%>
 
     const rc = RuntimeConfig.ensure(this);
     rc.set('agentcore', 'gateways', {