@aws/nx-plugin 1.0.0-rc.44 → 1.0.0-rc.46

package/src/ts/dcr-proxy/generator.d.ts

@@ -0,0 +1,10 @@
+/**
+ * Copyright Amazon.com, Inc. or its affiliates. All Rights Reserved.
+ * SPDX-License-Identifier: Apache-2.0
+ */
+import { type GeneratorCallback, type Tree } from '@nx/devkit';
+import { type NxGeneratorInfo } from '../../utils/nx';
+import type { TsDcrProxyGeneratorSchema } from './schema';
+export declare const TS_DCR_PROXY_GENERATOR_INFO: NxGeneratorInfo;
+export declare const tsDcrProxyGenerator: (tree: Tree, options: TsDcrProxyGeneratorSchema) => Promise<GeneratorCallback>;
+export default tsDcrProxyGenerator;

package/src/ts/dcr-proxy/generator.js

@@ -0,0 +1,98 @@
+/**
+ * Copyright Amazon.com, Inc. or its affiliates. All Rights Reserved.
+ * SPDX-License-Identifier: Apache-2.0
+ */ import { addDependenciesToPackageJson, generateFiles, joinPathFragments, OverwriteStrategy, updateProjectConfiguration } from "@nx/devkit";
+import tsProjectGenerator from "../lib/generator.js";
+import { addTypeScriptBundleTarget } from "../../utils/bundle/bundle.js";
+import { addDcrProxyInfra, DCR_PROXY_HANDLERS } from "../../utils/dcr-proxy-constructs/dcr-proxy-constructs.js";
+import { formatFilesInSubtree } from "../../utils/format.js";
+import { resolveIac } from "../../utils/iac.js";
+import { installDependencies } from "../../utils/install.js";
+import { addGeneratorMetricsIfApplicable } from "../../utils/metrics.js";
+import { kebabCase, toClassName } from "../../utils/names.js";
+import { getNpmScopePrefix } from "../../utils/npm-scope.js";
+import { getGeneratorInfo, readProjectConfigurationUnqualified } from "../../utils/nx.js";
+import { sortObjectKeys } from "../../utils/object.js";
+import { sharedConstructsGenerator } from "../../utils/shared-constructs.js";
+import { withVersions } from "../../utils/versions.js";
+export const TS_DCR_PROXY_GENERATOR_INFO = getGeneratorInfo(import.meta.filename);
+export const tsDcrProxyGenerator = async (tree, options)=>{
+    const name = kebabCase(options.name ? options.name : 'dcr-proxy');
+    const nameClassName = toClassName(name);
+    const iac = await resolveIac(tree, options.iac);
+    // The handlers live in a standalone TypeScript project so they can be bundled
+    // (rolldown) into deployable artifacts referenced by both CDK and Terraform.
+    const namespace = getNpmScopePrefix(tree);
+    const proxyProjectName = `${namespace}${name}`;
+    let projectExists;
+    try {
+        readProjectConfigurationUnqualified(tree, proxyProjectName);
+        projectExists = true;
+    } catch  {
+        projectExists = false;
+    }
+    if (!projectExists) {
+        await tsProjectGenerator(tree, {
+            name,
+            directory: options.directory,
+            subDirectory: options.subDirectory,
+            preferInstallDependencies: false
+        });
+    }
+    const projectConfig = readProjectConfigurationUnqualified(tree, proxyProjectName);
+    const proxyRoot = projectConfig.root;
+    // Place the Lambda handlers in the project source
+    generateFiles(tree, joinPathFragments(import.meta.dirname, '..', '..', 'utils', 'dcr-proxy-constructs', 'files', 'project'), proxyRoot, {
+        nameClassName,
+        nameKebabCase: name
+    }, {
+        overwriteStrategy: OverwriteStrategy.KeepExisting
+    });
+    // The token handler imports @aws-sdk/client-secrets-manager (provided by the
+    // Lambda runtime but needed for type-checking and local dev) and the handlers
+    // are typed against @types/aws-lambda.
+    addDependenciesToPackageJson(tree, withVersions([
+        '@aws-sdk/client-secrets-manager'
+    ]), withVersions([
+        '@types/aws-lambda'
+    ]));
+    // Bundle each handler independently to dist/<root>/bundle/<handler>/index.js
+    for (const handler of DCR_PROXY_HANDLERS){
+        await addTypeScriptBundleTarget(tree, projectConfig, {
+            targetFilePath: `src/handlers/${handler}.ts`,
+            bundleOutputDir: handler,
+            external: [
+                /@aws-sdk\/.*/
+            ],
+            platform: 'node'
+        });
+    }
+    projectConfig.targets = sortObjectKeys(projectConfig.targets);
+    updateProjectConfiguration(tree, projectConfig.name, projectConfig);
+    const bundlePathsFromRoot = Object.fromEntries(DCR_PROXY_HANDLERS.map((handler)=>[
+            handler,
+            joinPathFragments('dist', proxyRoot, 'bundle', handler)
+        ]));
+    await sharedConstructsGenerator(tree, {
+        iac
+    });
+    await addDcrProxyInfra(tree, {
+        dcrProxyNameClassName: nameClassName,
+        dcrProxyNameKebabCase: name,
+        proxyProjectName,
+        bundlePathsFromRoot,
+        iac
+    });
+    await addGeneratorMetricsIfApplicable(tree, [
+        TS_DCR_PROXY_GENERATOR_INFO
+    ]);
+    await formatFilesInSubtree(tree);
+    return ()=>installDependencies(tree, options.preferInstallDependencies, {
+            languages: [
+                'typescript'
+            ]
+        });
+};
+export default tsDcrProxyGenerator;
+
+//# sourceMappingURL=generator.js.map

package/src/ts/dcr-proxy/generator.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../../../../../../packages/nx-plugin/src/ts/dcr-proxy/generator.ts"],"sourcesContent":["/**\n * Copyright Amazon.com, Inc. or its affiliates. All Rights Reserved.\n * SPDX-License-Identifier: Apache-2.0\n */\nimport {\n  addDependenciesToPackageJson,\n  type GeneratorCallback,\n  generateFiles,\n  joinPathFragments,\n  OverwriteStrategy,\n  type Tree,\n  updateProjectConfiguration,\n} from '@nx/devkit';\nimport tsProjectGenerator from '../../ts/lib/generator';\nimport { addTypeScriptBundleTarget } from '../../utils/bundle/bundle';\nimport {\n  addDcrProxyInfra,\n  DCR_PROXY_HANDLERS,\n  type DcrProxyHandler,\n} from '../../utils/dcr-proxy-constructs/dcr-proxy-constructs';\nimport { formatFilesInSubtree } from '../../utils/format';\nimport { resolveIac } from '../../utils/iac';\nimport { installDependencies } from '../../utils/install';\nimport { addGeneratorMetricsIfApplicable } from '../../utils/metrics';\nimport { kebabCase, toClassName } from '../../utils/names';\nimport { getNpmScopePrefix } from '../../utils/npm-scope';\nimport {\n  getGeneratorInfo,\n  type NxGeneratorInfo,\n  readProjectConfigurationUnqualified,\n} from '../../utils/nx';\nimport { sortObjectKeys } from '../../utils/object';\nimport { sharedConstructsGenerator } from '../../utils/shared-constructs';\nimport { withVersions } from '../../utils/versions';\nimport type { TsDcrProxyGeneratorSchema } from './schema';\n\nexport const TS_DCR_PROXY_GENERATOR_INFO: NxGeneratorInfo = getGeneratorInfo(\n  import.meta.filename,\n);\n\nexport const tsDcrProxyGenerator = async (\n  tree: Tree,\n  options: TsDcrProxyGeneratorSchema,\n): Promise<GeneratorCallback> => {\n  const name = kebabCase(options.name ? options.name : 'dcr-proxy');\n  const nameClassName = toClassName(name);\n\n  const iac = await resolveIac(tree, options.iac);\n\n  // The handlers live in a standalone TypeScript project so they can be bundled\n  // (rolldown) into deployable artifacts referenced by both CDK and Terraform.\n  const namespace = getNpmScopePrefix(tree);\n  const proxyProjectName = `${namespace}${name}`;\n\n  let projectExists: boolean;\n  try {\n    readProjectConfigurationUnqualified(tree, proxyProjectName);\n    projectExists = true;\n  } catch {\n    projectExists = false;\n  }\n\n  if (!projectExists) {\n    await tsProjectGenerator(tree, {\n      name,\n      directory: options.directory,\n      subDirectory: options.subDirectory,\n      preferInstallDependencies: false,\n    });\n  }\n\n  const projectConfig = readProjectConfigurationUnqualified(\n    tree,\n    proxyProjectName,\n  );\n  const proxyRoot = projectConfig.root;\n\n  // Place the Lambda handlers in the project source\n  generateFiles(\n    tree,\n    joinPathFragments(\n      import.meta.dirname,\n      '..',\n      '..',\n      'utils',\n      'dcr-proxy-constructs',\n      'files',\n      'project',\n    ),\n    proxyRoot,\n    { nameClassName, nameKebabCase: name },\n    {\n      overwriteStrategy: OverwriteStrategy.KeepExisting,\n    },\n  );\n\n  // The token handler imports @aws-sdk/client-secrets-manager (provided by the\n  // Lambda runtime but needed for type-checking and local dev) and the handlers\n  // are typed against @types/aws-lambda.\n  addDependenciesToPackageJson(\n    tree,\n    withVersions(['@aws-sdk/client-secrets-manager']),\n    withVersions(['@types/aws-lambda']),\n  );\n\n  // Bundle each handler independently to dist/<root>/bundle/<handler>/index.js\n  for (const handler of DCR_PROXY_HANDLERS) {\n    await addTypeScriptBundleTarget(tree, projectConfig, {\n      targetFilePath: `src/handlers/${handler}.ts`,\n      bundleOutputDir: handler,\n      external: [/@aws-sdk\\/.*/], // lambda runtime provides the aws sdk\n      platform: 'node',\n    });\n  }\n\n  projectConfig.targets = sortObjectKeys(projectConfig.targets);\n  updateProjectConfiguration(tree, projectConfig.name, projectConfig);\n\n  const bundlePathsFromRoot = Object.fromEntries(\n    DCR_PROXY_HANDLERS.map((handler) => [\n      handler,\n      joinPathFragments('dist', proxyRoot, 'bundle', handler),\n    ]),\n  ) as Record<DcrProxyHandler, string>;\n\n  await sharedConstructsGenerator(tree, { iac });\n\n  await addDcrProxyInfra(tree, {\n    dcrProxyNameClassName: nameClassName,\n    dcrProxyNameKebabCase: name,\n    proxyProjectName,\n    bundlePathsFromRoot,\n    iac,\n  });\n\n  await addGeneratorMetricsIfApplicable(tree, [TS_DCR_PROXY_GENERATOR_INFO]);\n\n  await formatFilesInSubtree(tree);\n  return () =>\n    installDependencies(tree, options.preferInstallDependencies, {\n      languages: ['typescript'],\n    });\n};\n\nexport default tsDcrProxyGenerator;\n"],"names":["addDependenciesToPackageJson","generateFiles","joinPathFragments","OverwriteStrategy","updateProjectConfiguration","tsProjectGenerator","addTypeScriptBundleTarget","addDcrProxyInfra","DCR_PROXY_HANDLERS","formatFilesInSubtree","resolveIac","installDependencies","addGeneratorMetricsIfApplicable","kebabCase","toClassName","getNpmScopePrefix","getGeneratorInfo","readProjectConfigurationUnqualified","sortObjectKeys","sharedConstructsGenerator","withVersions","TS_DCR_PROXY_GENERATOR_INFO","filename","tsDcrProxyGenerator","tree","options","name","nameClassName","iac","namespace","proxyProjectName","projectExists","directory","subDirectory","preferInstallDependencies","projectConfig","proxyRoot","root","dirname","nameKebabCase","overwriteStrategy","KeepExisting","handler","targetFilePath","bundleOutputDir","external","platform","targets","bundlePathsFromRoot","Object","fromEntries","map","dcrProxyNameClassName","dcrProxyNameKebabCase","languages"],"mappings":"AAAA;;;CAGC,GACD,SACEA,4BAA4B,EAE5BC,aAAa,EACbC,iBAAiB,EACjBC,iBAAiB,EAEjBC,0BAA0B,QACrB,aAAa;AACpB,OAAOC,wBAAwB,sBAAyB;AACxD,SAASC,yBAAyB,QAAQ,+BAA4B;AACtE,SACEC,gBAAgB,EAChBC,kBAAkB,QAEb,2DAAwD;AAC/D,SAASC,oBAAoB,QAAQ,wBAAqB;AAC1D,SAASC,UAAU,QAAQ,qBAAkB;AAC7C,SAASC,mBAAmB,QAAQ,yBAAsB;AAC1D,SAASC,+BAA+B,QAAQ,yBAAsB;AACtE,SAASC,SAAS,EAAEC,WAAW,QAAQ,uBAAoB;AAC3D,SAASC,iBAAiB,QAAQ,2BAAwB;AAC1D,SACEC,gBAAgB,EAEhBC,mCAAmC,QAC9B,oBAAiB;AACxB,SAASC,cAAc,QAAQ,wBAAqB;AACpD,SAASC,yBAAyB,QAAQ,mCAAgC;AAC1E,SAASC,YAAY,QAAQ,0BAAuB;AAGpD,OAAO,MAAMC,8BAA+CL,iBAC1D,YAAYM,QAAQ,EACpB;AAEF,OAAO,MAAMC,sBAAsB,OACjCC,MACAC;IAEA,MAAMC,OAAOb,UAAUY,QAAQC,IAAI,GAAGD,QAAQC,IAAI,GAAG;IACrD,MAAMC,gBAAgBb,YAAYY;IAElC,MAAME,MAAM,MAAMlB,WAAWc,MAAMC,QAAQG,GAAG;IAE9C,8EAA8E;IAC9E,6EAA6E;IAC7E,MAAMC,YAAYd,kBAAkBS;IACpC,MAAMM,mBAAmB,GAAGD,YAAYH,MAAM;IAE9C,IAAIK;IACJ,IAAI;QACFd,oCAAoCO,MAAMM;QAC1CC,gBAAgB;IAClB,EAAE,OAAM;QACNA,gBAAgB;IAClB;IAEA,IAAI,CAACA,eAAe;QAClB,MAAM1B,mBAAmBmB,MAAM;YAC7BE;YACAM,WAAWP,QAAQO,SAAS;YAC5BC,cAAcR,QAAQQ,YAAY;YAClCC,2BAA2B;QAC7B;IACF;IAEA,MAAMC,gBAAgBlB,oCACpBO,MACAM;IAEF,MAAMM,YAAYD,cAAcE,IAAI;IAEpC,kDAAkD;IAClDpC,cACEuB,MACAtB,kBACE,YAAYoC,OAAO,EACnB,MACA,MACA,SACA,wBACA,SACA,YAEFF,WACA;QAAET;QAAeY,eAAeb;IAAK,GACrC;QACEc,mBAAmBrC,kBAAkBsC,YAAY;IACnD;IAGF,6EAA6E;IAC7E,8EAA8E;IAC9E,uCAAuC;IACvCzC,6BACEwB,MACAJ,aAAa;QAAC;KAAkC,GAChDA,aAAa;QAAC;KAAoB;IAGpC,6EAA6E;IAC7E,KAAK,MAAMsB,WAAWlC,mBAAoB;QACxC,MAAMF,0BAA0BkB,MAAMW,eAAe;YACnDQ,gBAAgB,CAAC,aAAa,EAAED,QAAQ,GAAG,CAAC;YAC5CE,iBAAiBF;YACjBG,UAAU;gBAAC;aAAe;YAC1BC,UAAU;QACZ;IACF;IAEAX,cAAcY,OAAO,GAAG7B,eAAeiB,cAAcY,OAAO;IAC5D3C,2BAA2BoB,MAAMW,cAAcT,IAAI,EAAES;IAErD,MAAMa,sBAAsBC,OAAOC,WAAW,CAC5C1C,mBAAmB2C,GAAG,CAAC,CAACT,UAAY;YAClCA;YACAxC,kBAAkB,QAAQkC,WAAW,UAAUM;SAChD;IAGH,MAAMvB,0BAA0BK,MAAM;QAAEI;IAAI;IAE5C,MAAMrB,iBAAiBiB,MAAM;QAC3B4B,uBAAuBzB;QACvB0B,uBAAuB3B;QACvBI;QACAkB;QACApB;IACF;IAEA,MAAMhB,gCAAgCY,MAAM;QAACH;KAA4B;IAEzE,MAAMZ,qBAAqBe;IAC3B,OAAO,IACLb,oBAAoBa,MAAMC,QAAQS,yBAAyB,EAAE;YAC3DoB,WAAW;gBAAC;aAAa;QAC3B;AACJ,EAAE;AAEF,eAAe/B,oBAAoB"}

package/src/ts/dcr-proxy/schema.d.js

@@ -0,0 +1,6 @@
+/**
+ * Copyright Amazon.com, Inc. or its affiliates. All Rights Reserved.
+ * SPDX-License-Identifier: Apache-2.0
+ */ export { };
+
+//# sourceMappingURL=schema.d.js.map

package/src/ts/dcr-proxy/schema.d.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../../../../../../packages/nx-plugin/src/ts/dcr-proxy/schema.d.ts"],"sourcesContent":["/**\n * Copyright Amazon.com, Inc. or its affiliates. All Rights Reserved.\n * SPDX-License-Identifier: Apache-2.0\n */\nimport type { IacOption } from '../../utils/iac';\n\nexport interface TsDcrProxyGeneratorSchema {\n  name?: string;\n  directory?: string;\n  subDirectory?: string;\n  iac: IacOption;\n  preferInstallDependencies?: boolean;\n}\n"],"names":[],"mappings":"AAAA;;;CAGC,GAGD,WAMC"}

package/src/ts/dcr-proxy/schema.d.ts

@@ -0,0 +1,13 @@
+/**
+ * Copyright Amazon.com, Inc. or its affiliates. All Rights Reserved.
+ * SPDX-License-Identifier: Apache-2.0
+ */
+import type { IacOption } from '../../utils/iac';
+
+export interface TsDcrProxyGeneratorSchema {
+  name?: string;
+  directory?: string;
+  subDirectory?: string;
+  iac: IacOption;
+  preferInstallDependencies?: boolean;
+}

package/src/ts/dcr-proxy/schema.json

@@ -0,0 +1,44 @@
+{
+  "$schema": "https://json-schema.org/schema",
+  "$id": "ts#dcr-proxy",
+  "title": "ts#dcr-proxy",
+  "description": "Generate an OAuth Dynamic Client Registration (DCR) proxy construct for Cognito-authenticated MCP servers",
+  "type": "object",
+  "properties": {
+    "name": {
+      "type": "string",
+      "description": "The name of your DCR proxy, used for its TypeScript handler project, the construct/module class name, and its directory under common/constructs or common/terraform",
+      "default": "dcr-proxy",
+      "$default": {
+        "$source": "argv",
+        "index": 0
+      },
+      "x-prompt": "What would you like to call your DCR proxy?",
+      "x-priority": "important"
+    },
+    "directory": {
+      "description": "The directory to store the DCR proxy handler project in.",
+      "type": "string",
+      "alias": "dir",
+      "x-priority": "important",
+      "default": "packages"
+    },
+    "subDirectory": {
+      "type": "string",
+      "description": "The sub directory the handler project is placed in. By default this is the project name."
+    },
+    "iac": {
+      "type": "string",
+      "description": "The preferred IaC provider (cdk or terraform). By default this is inherited from your initial selection.",
+      "enum": ["inherit", "cdk", "terraform"],
+      "x-priority": "important",
+      "default": "inherit",
+      "x-prompt": "Which provider would you like to manage your infrastructure? (default: inherit)"
+    },
+    "preferInstallDependencies": {
+      "type": "boolean",
+      "description": "Whether to prefer installing dependencies after the generator runs. Set to false to defer installing when batching multiple generators (an install still runs if needed so subsequent generators can compute the Nx project graph); install once at the end.",
+      "default": true
+    }
+  }
+}

package/src/ts/mcp-server/files/Dockerfile.template

@@ -7,7 +7,11 @@ WORKDIR /app
 
 # Add AWS Distro for OpenTelemetry for observability
 # https://docs.aws.amazon.com/bedrock-agentcore/latest/devguide/observability-configure.html
-RUN npm install @aws/aws-distro-opentelemetry-node-autoinstrumentation@<%- adotVersion %>
+# The override pins @opentelemetry/propagator-jaeger above the version the
+# autoinstrumentation package resolves transitively, clearing CVE-2026-59892.
+RUN npm init -y \
+  && npm pkg set "overrides.@opentelemetry/propagator-jaeger=<%- jaegerVersion %>" \
+  && npm install @aws/aws-distro-opentelemetry-node-autoinstrumentation@<%- adotVersion %>
 
 # Copy bundled streamable http server
 COPY index.js /app

package/src/ts/mcp-server/generator.js

@@ -51,6 +51,7 @@ export const tsMcpServerGenerator = async (tree, options)=>{
         esm,
         distDir,
         adotVersion: TS_VERSIONS['@aws/aws-distro-opentelemetry-node-autoinstrumentation'],
+        jaegerVersion: TS_VERSIONS['@opentelemetry/propagator-jaeger'],
         nodeBaseImage: BASE_IMAGES.node,
         npmVersion: TS_VERSIONS.npm
     }, {

package/src/ts/mcp-server/generator.js.map

@@ -1 +1 @@
-{"version":3,"sources":["../../../../../../packages/nx-plugin/src/ts/mcp-server/generator.ts"],"sourcesContent":["/**\n * Copyright Amazon.com, Inc. or its affiliates. All Rights Reserved.\n * SPDX-License-Identifier: Apache-2.0\n */\nimport {\n  addDependenciesToPackageJson,\n  detectPackageManager,\n  type GeneratorCallback,\n  generateFiles,\n  joinPathFragments,\n  OverwriteStrategy,\n  readJson,\n  type Tree,\n  updateJson,\n  updateProjectConfiguration,\n} from '@nx/devkit';\nimport { ensureLicenseExceptions } from '../../license/config';\nimport { MCP_INSPECTOR_EXCEPTIONS } from '../../license/known-exceptions';\nimport { addMcpServerInfra } from '../../utils/agent-core-constructs/agent-core-constructs';\nimport { addTypeScriptBundleTarget } from '../../utils/bundle/bundle';\nimport { resolveContainers } from '../../utils/containers';\nimport { addDockerScanTarget } from '../../utils/docker';\nimport { formatFilesInSubtree } from '../../utils/format';\nimport { FsCommands } from '../../utils/fs';\nimport { resolveIac } from '../../utils/iac';\nimport { installDependencies } from '../../utils/install';\nimport { addGeneratorMetricsIfApplicable } from '../../utils/metrics';\nimport { isEsmWorkspace } from '../../utils/module-format';\nimport { kebabCase, toClassName } from '../../utils/names';\nimport { getNpmScope } from '../../utils/npm-scope';\nimport {\n  addComponentDevTarget,\n  addComponentGeneratorMetadata,\n  addDependencyToTargetIfNotPresent,\n  getGeneratorInfo,\n  type NxGeneratorInfo,\n  readProjectConfigurationUnqualified,\n} from '../../utils/nx';\nimport { sortObjectKeys } from '../../utils/object';\nimport { assignPort } from '../../utils/port';\nimport { sharedConstructsGenerator } from '../../utils/shared-constructs';\nimport { BASE_IMAGES, TS_VERSIONS, withVersions } from '../../utils/versions';\nimport type { TsMcpServerGeneratorSchema } from './schema';\n\nexport const TS_MCP_SERVER_GENERATOR_INFO: NxGeneratorInfo = getGeneratorInfo(\n  import.meta.filename,\n);\n\nexport const tsMcpServerGenerator = async (\n  tree: Tree,\n  options: TsMcpServerGeneratorSchema,\n): Promise<GeneratorCallback> => {\n  const project = readProjectConfigurationUnqualified(tree, options.project);\n\n  if (!tree.exists(joinPathFragments(project.root, 'tsconfig.json'))) {\n    throw new Error(\n      `Unsupported project ${options.project}. Expected a TypeScript project (with a tsconfig.json)`,\n    );\n  }\n\n  const defaultName = `${kebabCase(project.name.split('/').pop())}-mcp-server`;\n  const name = kebabCase(options.name || defaultName);\n  const mcpServerNameClassName = toClassName(name);\n  const mcpTargetPrefix = options.name ? name : 'mcp-server';\n  const targetSourceDirRelativeToProjectRoot = joinPathFragments(\n    'src',\n    mcpTargetPrefix,\n  );\n  const targetSourceDir = joinPathFragments(\n    project.root,\n    targetSourceDirRelativeToProjectRoot,\n  );\n  const relativeSourceDir = targetSourceDir.replace(project.root + '/', './');\n  const distDir = joinPathFragments('dist', project.root);\n\n  const infra = options.infra ?? 'agentcore';\n\n  if (infra === 'none' && options.auth && options.auth !== 'iam') {\n    console.warn(\n      'Warning: auth is ignored when no infrastructure is configured (no infrastructure is generated)',\n    );\n  }\n\n  const auth = options.auth ?? 'iam';\n\n  const projectPackageJsonPath = joinPathFragments(\n    project.root,\n    'package.json',\n  );\n\n  // Generate esm if the module system is esm, otherwise commonjs. Projects\n  // don't typically have their own package.json (dependencies are declared in\n  // the workspace root), so fall back to the workspace format when absent.\n  const esm = tree.exists(projectPackageJsonPath)\n    ? readJson(tree, projectPackageJsonPath).type === 'module'\n    : isEsmWorkspace(tree);\n\n  // Generate example server\n  generateFiles(\n    tree,\n    joinPathFragments(import.meta.dirname, 'files'),\n    targetSourceDir,\n    {\n      name,\n      esm,\n      distDir,\n      adotVersion:\n        TS_VERSIONS['@aws/aws-distro-opentelemetry-node-autoinstrumentation'],\n      nodeBaseImage: BASE_IMAGES.node,\n      npmVersion: TS_VERSIONS.npm,\n    },\n    { overwriteStrategy: OverwriteStrategy.KeepExisting },\n  );\n\n  // Add dependencies\n  const deps = withVersions([\n    '@modelcontextprotocol/sdk',\n    'zod',\n    'express',\n    '@aws-lambda-powertools/parameters',\n    '@aws-sdk/client-appconfigdata',\n  ]);\n  const devDeps = withVersions([\n    'tsx',\n    '@types/express',\n    '@modelcontextprotocol/inspector',\n  ]);\n\n  // Add hosting based on infra\n  if (infra === 'agentcore') {\n    const containers = await resolveContainers(tree, 'inherit');\n    const dockerImageTag = `${getNpmScope(tree)}-${name}:latest`;\n\n    // Add bundle target\n    await addTypeScriptBundleTarget(tree, project, {\n      targetFilePath: `${targetSourceDirRelativeToProjectRoot}/http.ts`,\n      bundleOutputDir: joinPathFragments('mcp', name),\n    });\n\n    const dockerOutputDir = joinPathFragments(\n      'dist',\n      project.root,\n      'bundle',\n      'mcp',\n      name,\n    );\n    const dockerTargetName = `${mcpTargetPrefix}-docker`;\n\n    const fs = new FsCommands(tree);\n    project.targets[dockerTargetName] = {\n      cache: true,\n      outputs: [`{workspaceRoot}/${dockerOutputDir}/Dockerfile`],\n      executor: 'nx:run-commands',\n      options: {\n        commands: [\n          fs.cp(\n            `${targetSourceDir}/Dockerfile`,\n            `${dockerOutputDir}/Dockerfile`,\n          ),\n          `${containers} build --platform linux/arm64 -t ${dockerImageTag} ${dockerOutputDir}`,\n        ],\n        parallel: false,\n      },\n      dependsOn: ['bundle'],\n    };\n\n    addDependencyToTargetIfNotPresent(project, 'docker', dockerTargetName);\n    addDependencyToTargetIfNotPresent(project, 'build', 'docker');\n\n    addDockerScanTarget(tree, {\n      project,\n      containerEngine: containers,\n      trivyTargetName: `${mcpTargetPrefix}-trivy`,\n      dockerTargetName,\n      imageTags: [dockerImageTag],\n    });\n\n    // Add shared constructs\n    const iac = await resolveIac(tree, options.iac);\n    await sharedConstructsGenerator(tree, { iac });\n\n    // Add the construct to deploy the mcp server\n    await addMcpServerInfra(tree, {\n      mcpServerNameKebabCase: name,\n      mcpServerNameClassName,\n      projectName: project.name,\n      dockerImageTag,\n      dockerOutputDir,\n      iac,\n      auth,\n      containers,\n    });\n  } else {\n    // No Dockerfile needed for non-hosted MCP\n    tree.delete(joinPathFragments(targetSourceDir, 'Dockerfile'));\n  }\n\n  addDependenciesToPackageJson(tree, deps, devDeps);\n  // Add to the project's package.json too if it has one (e.g. nx plugins),\n  // otherwise dependencies live in the workspace root only.\n  if (tree.exists(projectPackageJsonPath)) {\n    addDependenciesToPackageJson(tree, deps, devDeps, projectPackageJsonPath);\n  }\n\n  // @modelcontextprotocol/sdk declares zod as a peer dependency with a wide range\n  // (^3.25 || ^4.0). Yarn does not dedupe the peer to the workspace's pinned zod, so\n  // without a resolution it installs a separate zod under the SDK's own node_modules.\n  // The two zod copies have structurally incompatible types, which breaks type\n  // inference for registerTool inputSchema. Scope the resolution to the SDK so\n  // other consumers (e.g. @tanstack/router-generator pinning zod@3) are unaffected.\n  if (detectPackageManager() === 'yarn') {\n    updateJson(tree, 'package.json', (packageJson) => {\n      packageJson.resolutions = {\n        ...packageJson.resolutions,\n        '**/@modelcontextprotocol/sdk/zod': TS_VERSIONS['zod'],\n      };\n      return packageJson;\n    });\n  }\n\n  const localDevPort = assignPort(tree, project, 8000, {\n    component: { info: TS_MCP_SERVER_GENERATOR_INFO, name: mcpTargetPrefix },\n  });\n\n  const mcpTargets = {\n    ...project.targets,\n    // Add targets for running the MCP server\n    [`${mcpTargetPrefix}-serve-stdio`]: {\n      executor: 'nx:run-commands',\n      continuous: true,\n      options: {\n        commands: [`tsx --watch ${relativeSourceDir}/stdio.ts`],\n        cwd: '{projectRoot}',\n      },\n    },\n    [`${mcpTargetPrefix}-serve`]: {\n      executor: 'nx:run-commands',\n      continuous: true,\n      options: {\n        commands: [`tsx --watch ${relativeSourceDir}/http.ts`],\n        cwd: '{projectRoot}',\n        env: {\n          PORT: `${localDevPort}`,\n        },\n      },\n    },\n    [`${mcpTargetPrefix}-dev`]: {\n      executor: 'nx:run-commands',\n      continuous: true,\n      options: {\n        commands: [`tsx --watch ${relativeSourceDir}/http.ts`],\n        cwd: '{projectRoot}',\n        env: {\n          PORT: `${localDevPort}`,\n          LOCAL_DEV: 'true',\n        },\n      },\n    },\n    [`${mcpTargetPrefix}-inspect`]: {\n      executor: 'nx:run-commands',\n      continuous: true,\n      // Launch the inspector against the locally served HTTP server. The dev\n      // target starts the server and any connected dependencies (e.g. a local\n      // database).\n      dependsOn: [`${mcpTargetPrefix}-dev`],\n      options: {\n        commands: [\n          `mcp-inspector --transport http --server-url http://localhost:${localDevPort}/mcp`,\n        ],\n        cwd: '{projectRoot}',\n      },\n    },\n    [`${mcpTargetPrefix}-inspect-stdio`]: {\n      executor: 'nx:run-commands',\n      continuous: true,\n      options: {\n        commands: [\n          `mcp-inspector -- tsx --watch ${relativeSourceDir}/stdio.ts`,\n        ],\n        cwd: '{projectRoot}',\n      },\n    },\n  };\n\n  // Aggregate `<mcp>-dev` under the project-level `dev` target.\n  addComponentDevTarget(mcpTargets, `${mcpTargetPrefix}-dev`);\n\n  updateProjectConfiguration(tree, project.name, {\n    ...project,\n    // Sort targets so their order is stable regardless of insertion order on\n    // first run vs re-run.\n    targets: sortObjectKeys(mcpTargets),\n  });\n\n  addComponentGeneratorMetadata(\n    tree,\n    project.name,\n    TS_MCP_SERVER_GENERATOR_INFO,\n    targetSourceDirRelativeToProjectRoot,\n    mcpTargetPrefix,\n    {\n      port: localDevPort,\n      rc: mcpServerNameClassName,\n      auth,\n    },\n  );\n\n  await addGeneratorMetricsIfApplicable(tree, [TS_MCP_SERVER_GENERATOR_INFO]);\n\n  await ensureLicenseExceptions(tree, MCP_INSPECTOR_EXCEPTIONS);\n\n  await formatFilesInSubtree(tree);\n  return () =>\n    installDependencies(tree, options.preferInstallDependencies, {\n      languages: ['typescript'],\n    });\n};\n\nexport default tsMcpServerGenerator;\n"],"names":["addDependenciesToPackageJson","detectPackageManager","generateFiles","joinPathFragments","OverwriteStrategy","readJson","updateJson","updateProjectConfiguration","ensureLicenseExceptions","MCP_INSPECTOR_EXCEPTIONS","addMcpServerInfra","addTypeScriptBundleTarget","resolveContainers","addDockerScanTarget","formatFilesInSubtree","FsCommands","resolveIac","installDependencies","addGeneratorMetricsIfApplicable","isEsmWorkspace","kebabCase","toClassName","getNpmScope","addComponentDevTarget","addComponentGeneratorMetadata","addDependencyToTargetIfNotPresent","getGeneratorInfo","readProjectConfigurationUnqualified","sortObjectKeys","assignPort","sharedConstructsGenerator","BASE_IMAGES","TS_VERSIONS","withVersions","TS_MCP_SERVER_GENERATOR_INFO","filename","tsMcpServerGenerator","tree","options","project","exists","root","Error","defaultName","name","split","pop","mcpServerNameClassName","mcpTargetPrefix","targetSourceDirRelativeToProjectRoot","targetSourceDir","relativeSourceDir","replace","distDir","infra","auth","console","warn","projectPackageJsonPath","esm","type","dirname","adotVersion","nodeBaseImage","node","npmVersion","npm","overwriteStrategy","KeepExisting","deps","devDeps","containers","dockerImageTag","targetFilePath","bundleOutputDir","dockerOutputDir","dockerTargetName","fs","targets","cache","outputs","executor","commands","cp","parallel","dependsOn","containerEngine","trivyTargetName","imageTags","iac","mcpServerNameKebabCase","projectName","delete","packageJson","resolutions","localDevPort","component","info","mcpTargets","continuous","cwd","env","PORT","LOCAL_DEV","port","rc","preferInstallDependencies","languages"],"mappings":"AAAA;;;CAGC,GACD,SACEA,4BAA4B,EAC5BC,oBAAoB,EAEpBC,aAAa,EACbC,iBAAiB,EACjBC,iBAAiB,EACjBC,QAAQ,EAERC,UAAU,EACVC,0BAA0B,QACrB,aAAa;AACpB,SAASC,uBAAuB,QAAQ,0BAAuB;AAC/D,SAASC,wBAAwB,QAAQ,oCAAiC;AAC1E,SAASC,iBAAiB,QAAQ,6DAA0D;AAC5F,SAASC,yBAAyB,QAAQ,+BAA4B;AACtE,SAASC,iBAAiB,QAAQ,4BAAyB;AAC3D,SAASC,mBAAmB,QAAQ,wBAAqB;AACzD,SAASC,oBAAoB,QAAQ,wBAAqB;AAC1D,SAASC,UAAU,QAAQ,oBAAiB;AAC5C,SAASC,UAAU,QAAQ,qBAAkB;AAC7C,SAASC,mBAAmB,QAAQ,yBAAsB;AAC1D,SAASC,+BAA+B,QAAQ,yBAAsB;AACtE,SAASC,cAAc,QAAQ,+BAA4B;AAC3D,SAASC,SAAS,EAAEC,WAAW,QAAQ,uBAAoB;AAC3D,SAASC,WAAW,QAAQ,2BAAwB;AACpD,SACEC,qBAAqB,EACrBC,6BAA6B,EAC7BC,iCAAiC,EACjCC,gBAAgB,EAEhBC,mCAAmC,QAC9B,oBAAiB;AACxB,SAASC,cAAc,QAAQ,wBAAqB;AACpD,SAASC,UAAU,QAAQ,sBAAmB;AAC9C,SAASC,yBAAyB,QAAQ,mCAAgC;AAC1E,SAASC,WAAW,EAAEC,WAAW,EAAEC,YAAY,QAAQ,0BAAuB;AAG9E,OAAO,MAAMC,+BAAgDR,iBAC3D,YAAYS,QAAQ,EACpB;AAEF,OAAO,MAAMC,uBAAuB,OAClCC,MACAC;IAEA,MAAMC,UAAUZ,oCAAoCU,MAAMC,QAAQC,OAAO;IAEzE,IAAI,CAACF,KAAKG,MAAM,CAACrC,kBAAkBoC,QAAQE,IAAI,EAAE,mBAAmB;QAClE,MAAM,IAAIC,MACR,CAAC,oBAAoB,EAAEJ,QAAQC,OAAO,CAAC,sDAAsD,CAAC;IAElG;IAEA,MAAMI,cAAc,GAAGvB,UAAUmB,QAAQK,IAAI,CAACC,KAAK,CAAC,KAAKC,GAAG,IAAI,WAAW,CAAC;IAC5E,MAAMF,OAAOxB,UAAUkB,QAAQM,IAAI,IAAID;IACvC,MAAMI,yBAAyB1B,YAAYuB;IAC3C,MAAMI,kBAAkBV,QAAQM,IAAI,GAAGA,OAAO;IAC9C,MAAMK,uCAAuC9C,kBAC3C,OACA6C;IAEF,MAAME,kBAAkB/C,kBACtBoC,QAAQE,IAAI,EACZQ;IAEF,MAAME,oBAAoBD,gBAAgBE,OAAO,CAACb,QAAQE,IAAI,GAAG,KAAK;IACtE,MAAMY,UAAUlD,kBAAkB,QAAQoC,QAAQE,IAAI;IAEtD,MAAMa,QAAQhB,QAAQgB,KAAK,IAAI;IAE/B,IAAIA,UAAU,UAAUhB,QAAQiB,IAAI,IAAIjB,QAAQiB,IAAI,KAAK,OAAO;QAC9DC,QAAQC,IAAI,CACV;IAEJ;IAEA,MAAMF,OAAOjB,QAAQiB,IAAI,IAAI;IAE7B,MAAMG,yBAAyBvD,kBAC7BoC,QAAQE,IAAI,EACZ;IAGF,yEAAyE;IACzE,4EAA4E;IAC5E,yEAAyE;IACzE,MAAMkB,MAAMtB,KAAKG,MAAM,CAACkB,0BACpBrD,SAASgC,MAAMqB,wBAAwBE,IAAI,KAAK,WAChDzC,eAAekB;IAEnB,0BAA0B;IAC1BnC,cACEmC,MACAlC,kBAAkB,YAAY0D,OAAO,EAAE,UACvCX,iBACA;QACEN;QACAe;QACAN;QACAS,aACE9B,WAAW,CAAC,yDAAyD;QACvE+B,eAAehC,YAAYiC,IAAI;QAC/BC,YAAYjC,YAAYkC,GAAG;IAC7B,GACA;QAAEC,mBAAmB/D,kBAAkBgE,YAAY;IAAC;IAGtD,mBAAmB;IACnB,MAAMC,OAAOpC,aAAa;QACxB;QACA;QACA;QACA;QACA;KACD;IACD,MAAMqC,UAAUrC,aAAa;QAC3B;QACA;QACA;KACD;IAED,6BAA6B;IAC7B,IAAIqB,UAAU,aAAa;QACzB,MAAMiB,aAAa,MAAM3D,kBAAkByB,MAAM;QACjD,MAAMmC,iBAAiB,GAAGlD,YAAYe,MAAM,CAAC,EAAEO,KAAK,OAAO,CAAC;QAE5D,oBAAoB;QACpB,MAAMjC,0BAA0B0B,MAAME,SAAS;YAC7CkC,gBAAgB,GAAGxB,qCAAqC,QAAQ,CAAC;YACjEyB,iBAAiBvE,kBAAkB,OAAOyC;QAC5C;QAEA,MAAM+B,kBAAkBxE,kBACtB,QACAoC,QAAQE,IAAI,EACZ,UACA,OACAG;QAEF,MAAMgC,mBAAmB,GAAG5B,gBAAgB,OAAO,CAAC;QAEpD,MAAM6B,KAAK,IAAI9D,WAAWsB;QAC1BE,QAAQuC,OAAO,CAACF,iBAAiB,GAAG;YAClCG,OAAO;YACPC,SAAS;gBAAC,CAAC,gBAAgB,EAAEL,gBAAgB,WAAW,CAAC;aAAC;YAC1DM,UAAU;YACV3C,SAAS;gBACP4C,UAAU;oBACRL,GAAGM,EAAE,CACH,GAAGjC,gBAAgB,WAAW,CAAC,EAC/B,GAAGyB,gBAAgB,WAAW,CAAC;oBAEjC,GAAGJ,WAAW,iCAAiC,EAAEC,eAAe,CAAC,EAAEG,iBAAiB;iBACrF;gBACDS,UAAU;YACZ;YACAC,WAAW;gBAAC;aAAS;QACvB;QAEA5D,kCAAkCc,SAAS,UAAUqC;QACrDnD,kCAAkCc,SAAS,SAAS;QAEpD1B,oBAAoBwB,MAAM;YACxBE;YACA+C,iBAAiBf;YACjBgB,iBAAiB,GAAGvC,gBAAgB,MAAM,CAAC;YAC3C4B;YACAY,WAAW;gBAAChB;aAAe;QAC7B;QAEA,wBAAwB;QACxB,MAAMiB,MAAM,MAAMzE,WAAWqB,MAAMC,QAAQmD,GAAG;QAC9C,MAAM3D,0BAA0BO,MAAM;YAAEoD;QAAI;QAE5C,6CAA6C;QAC7C,MAAM/E,kBAAkB2B,MAAM;YAC5BqD,wBAAwB9C;YACxBG;YACA4C,aAAapD,QAAQK,IAAI;YACzB4B;YACAG;YACAc;YACAlC;YACAgB;QACF;IACF,OAAO;QACL,0CAA0C;QAC1ClC,KAAKuD,MAAM,CAACzF,kBAAkB+C,iBAAiB;IACjD;IAEAlD,6BAA6BqC,MAAMgC,MAAMC;IACzC,yEAAyE;IACzE,0DAA0D;IAC1D,IAAIjC,KAAKG,MAAM,CAACkB,yBAAyB;QACvC1D,6BAA6BqC,MAAMgC,MAAMC,SAASZ;IACpD;IAEA,gFAAgF;IAChF,mFAAmF;IACnF,oFAAoF;IACpF,6EAA6E;IAC7E,6EAA6E;IAC7E,kFAAkF;IAClF,IAAIzD,2BAA2B,QAAQ;QACrCK,WAAW+B,MAAM,gBAAgB,CAACwD;YAChCA,YAAYC,WAAW,GAAG;gBACxB,GAAGD,YAAYC,WAAW;gBAC1B,oCAAoC9D,WAAW,CAAC,MAAM;YACxD;YACA,OAAO6D;QACT;IACF;IAEA,MAAME,eAAelE,WAAWQ,MAAME,SAAS,MAAM;QACnDyD,WAAW;YAAEC,MAAM/D;YAA8BU,MAAMI;QAAgB;IACzE;IAEA,MAAMkD,aAAa;QACjB,GAAG3D,QAAQuC,OAAO;QAClB,yCAAyC;QACzC,CAAC,GAAG9B,gBAAgB,YAAY,CAAC,CAAC,EAAE;YAClCiC,UAAU;YACVkB,YAAY;YACZ7D,SAAS;gBACP4C,UAAU;oBAAC,CAAC,YAAY,EAAE/B,kBAAkB,SAAS,CAAC;iBAAC;gBACvDiD,KAAK;YACP;QACF;QACA,CAAC,GAAGpD,gBAAgB,MAAM,CAAC,CAAC,EAAE;YAC5BiC,UAAU;YACVkB,YAAY;YACZ7D,SAAS;gBACP4C,UAAU;oBAAC,CAAC,YAAY,EAAE/B,kBAAkB,QAAQ,CAAC;iBAAC;gBACtDiD,KAAK;gBACLC,KAAK;oBACHC,MAAM,GAAGP,cAAc;gBACzB;YACF;QACF;QACA,CAAC,GAAG/C,gBAAgB,IAAI,CAAC,CAAC,EAAE;YAC1BiC,UAAU;YACVkB,YAAY;YACZ7D,SAAS;gBACP4C,UAAU;oBAAC,CAAC,YAAY,EAAE/B,kBAAkB,QAAQ,CAAC;iBAAC;gBACtDiD,KAAK;gBACLC,KAAK;oBACHC,MAAM,GAAGP,cAAc;oBACvBQ,WAAW;gBACb;YACF;QACF;QACA,CAAC,GAAGvD,gBAAgB,QAAQ,CAAC,CAAC,EAAE;YAC9BiC,UAAU;YACVkB,YAAY;YACZ,uEAAuE;YACvE,wEAAwE;YACxE,aAAa;YACbd,WAAW;gBAAC,GAAGrC,gBAAgB,IAAI,CAAC;aAAC;YACrCV,SAAS;gBACP4C,UAAU;oBACR,CAAC,6DAA6D,EAAEa,aAAa,IAAI,CAAC;iBACnF;gBACDK,KAAK;YACP;QACF;QACA,CAAC,GAAGpD,gBAAgB,cAAc,CAAC,CAAC,EAAE;YACpCiC,UAAU;YACVkB,YAAY;YACZ7D,SAAS;gBACP4C,UAAU;oBACR,CAAC,6BAA6B,EAAE/B,kBAAkB,SAAS,CAAC;iBAC7D;gBACDiD,KAAK;YACP;QACF;IACF;IAEA,8DAA8D;IAC9D7E,sBAAsB2E,YAAY,GAAGlD,gBAAgB,IAAI,CAAC;IAE1DzC,2BAA2B8B,MAAME,QAAQK,IAAI,EAAE;QAC7C,GAAGL,OAAO;QACV,yEAAyE;QACzE,uBAAuB;QACvBuC,SAASlD,eAAesE;IAC1B;IAEA1E,8BACEa,MACAE,QAAQK,IAAI,EACZV,8BACAe,sCACAD,iBACA;QACEwD,MAAMT;QACNU,IAAI1D;QACJQ;IACF;IAGF,MAAMrC,gCAAgCmB,MAAM;QAACH;KAA6B;IAE1E,MAAM1B,wBAAwB6B,MAAM5B;IAEpC,MAAMK,qBAAqBuB;IAC3B,OAAO,IACLpB,oBAAoBoB,MAAMC,QAAQoE,yBAAyB,EAAE;YAC3DC,WAAW;gBAAC;aAAa;QAC3B;AACJ,EAAE;AAEF,eAAevE,qBAAqB"}
+{"version":3,"sources":["../../../../../../packages/nx-plugin/src/ts/mcp-server/generator.ts"],"sourcesContent":["/**\n * Copyright Amazon.com, Inc. or its affiliates. All Rights Reserved.\n * SPDX-License-Identifier: Apache-2.0\n */\nimport {\n  addDependenciesToPackageJson,\n  detectPackageManager,\n  type GeneratorCallback,\n  generateFiles,\n  joinPathFragments,\n  OverwriteStrategy,\n  readJson,\n  type Tree,\n  updateJson,\n  updateProjectConfiguration,\n} from '@nx/devkit';\nimport { ensureLicenseExceptions } from '../../license/config';\nimport { MCP_INSPECTOR_EXCEPTIONS } from '../../license/known-exceptions';\nimport { addMcpServerInfra } from '../../utils/agent-core-constructs/agent-core-constructs';\nimport { addTypeScriptBundleTarget } from '../../utils/bundle/bundle';\nimport { resolveContainers } from '../../utils/containers';\nimport { addDockerScanTarget } from '../../utils/docker';\nimport { formatFilesInSubtree } from '../../utils/format';\nimport { FsCommands } from '../../utils/fs';\nimport { resolveIac } from '../../utils/iac';\nimport { installDependencies } from '../../utils/install';\nimport { addGeneratorMetricsIfApplicable } from '../../utils/metrics';\nimport { isEsmWorkspace } from '../../utils/module-format';\nimport { kebabCase, toClassName } from '../../utils/names';\nimport { getNpmScope } from '../../utils/npm-scope';\nimport {\n  addComponentDevTarget,\n  addComponentGeneratorMetadata,\n  addDependencyToTargetIfNotPresent,\n  getGeneratorInfo,\n  type NxGeneratorInfo,\n  readProjectConfigurationUnqualified,\n} from '../../utils/nx';\nimport { sortObjectKeys } from '../../utils/object';\nimport { assignPort } from '../../utils/port';\nimport { sharedConstructsGenerator } from '../../utils/shared-constructs';\nimport { BASE_IMAGES, TS_VERSIONS, withVersions } from '../../utils/versions';\nimport type { TsMcpServerGeneratorSchema } from './schema';\n\nexport const TS_MCP_SERVER_GENERATOR_INFO: NxGeneratorInfo = getGeneratorInfo(\n  import.meta.filename,\n);\n\nexport const tsMcpServerGenerator = async (\n  tree: Tree,\n  options: TsMcpServerGeneratorSchema,\n): Promise<GeneratorCallback> => {\n  const project = readProjectConfigurationUnqualified(tree, options.project);\n\n  if (!tree.exists(joinPathFragments(project.root, 'tsconfig.json'))) {\n    throw new Error(\n      `Unsupported project ${options.project}. Expected a TypeScript project (with a tsconfig.json)`,\n    );\n  }\n\n  const defaultName = `${kebabCase(project.name.split('/').pop())}-mcp-server`;\n  const name = kebabCase(options.name || defaultName);\n  const mcpServerNameClassName = toClassName(name);\n  const mcpTargetPrefix = options.name ? name : 'mcp-server';\n  const targetSourceDirRelativeToProjectRoot = joinPathFragments(\n    'src',\n    mcpTargetPrefix,\n  );\n  const targetSourceDir = joinPathFragments(\n    project.root,\n    targetSourceDirRelativeToProjectRoot,\n  );\n  const relativeSourceDir = targetSourceDir.replace(project.root + '/', './');\n  const distDir = joinPathFragments('dist', project.root);\n\n  const infra = options.infra ?? 'agentcore';\n\n  if (infra === 'none' && options.auth && options.auth !== 'iam') {\n    console.warn(\n      'Warning: auth is ignored when no infrastructure is configured (no infrastructure is generated)',\n    );\n  }\n\n  const auth = options.auth ?? 'iam';\n\n  const projectPackageJsonPath = joinPathFragments(\n    project.root,\n    'package.json',\n  );\n\n  // Generate esm if the module system is esm, otherwise commonjs. Projects\n  // don't typically have their own package.json (dependencies are declared in\n  // the workspace root), so fall back to the workspace format when absent.\n  const esm = tree.exists(projectPackageJsonPath)\n    ? readJson(tree, projectPackageJsonPath).type === 'module'\n    : isEsmWorkspace(tree);\n\n  // Generate example server\n  generateFiles(\n    tree,\n    joinPathFragments(import.meta.dirname, 'files'),\n    targetSourceDir,\n    {\n      name,\n      esm,\n      distDir,\n      adotVersion:\n        TS_VERSIONS['@aws/aws-distro-opentelemetry-node-autoinstrumentation'],\n      jaegerVersion: TS_VERSIONS['@opentelemetry/propagator-jaeger'],\n      nodeBaseImage: BASE_IMAGES.node,\n      npmVersion: TS_VERSIONS.npm,\n    },\n    { overwriteStrategy: OverwriteStrategy.KeepExisting },\n  );\n\n  // Add dependencies\n  const deps = withVersions([\n    '@modelcontextprotocol/sdk',\n    'zod',\n    'express',\n    '@aws-lambda-powertools/parameters',\n    '@aws-sdk/client-appconfigdata',\n  ]);\n  const devDeps = withVersions([\n    'tsx',\n    '@types/express',\n    '@modelcontextprotocol/inspector',\n  ]);\n\n  // Add hosting based on infra\n  if (infra === 'agentcore') {\n    const containers = await resolveContainers(tree, 'inherit');\n    const dockerImageTag = `${getNpmScope(tree)}-${name}:latest`;\n\n    // Add bundle target\n    await addTypeScriptBundleTarget(tree, project, {\n      targetFilePath: `${targetSourceDirRelativeToProjectRoot}/http.ts`,\n      bundleOutputDir: joinPathFragments('mcp', name),\n    });\n\n    const dockerOutputDir = joinPathFragments(\n      'dist',\n      project.root,\n      'bundle',\n      'mcp',\n      name,\n    );\n    const dockerTargetName = `${mcpTargetPrefix}-docker`;\n\n    const fs = new FsCommands(tree);\n    project.targets[dockerTargetName] = {\n      cache: true,\n      outputs: [`{workspaceRoot}/${dockerOutputDir}/Dockerfile`],\n      executor: 'nx:run-commands',\n      options: {\n        commands: [\n          fs.cp(\n            `${targetSourceDir}/Dockerfile`,\n            `${dockerOutputDir}/Dockerfile`,\n          ),\n          `${containers} build --platform linux/arm64 -t ${dockerImageTag} ${dockerOutputDir}`,\n        ],\n        parallel: false,\n      },\n      dependsOn: ['bundle'],\n    };\n\n    addDependencyToTargetIfNotPresent(project, 'docker', dockerTargetName);\n    addDependencyToTargetIfNotPresent(project, 'build', 'docker');\n\n    addDockerScanTarget(tree, {\n      project,\n      containerEngine: containers,\n      trivyTargetName: `${mcpTargetPrefix}-trivy`,\n      dockerTargetName,\n      imageTags: [dockerImageTag],\n    });\n\n    // Add shared constructs\n    const iac = await resolveIac(tree, options.iac);\n    await sharedConstructsGenerator(tree, { iac });\n\n    // Add the construct to deploy the mcp server\n    await addMcpServerInfra(tree, {\n      mcpServerNameKebabCase: name,\n      mcpServerNameClassName,\n      projectName: project.name,\n      dockerImageTag,\n      dockerOutputDir,\n      iac,\n      auth,\n      containers,\n    });\n  } else {\n    // No Dockerfile needed for non-hosted MCP\n    tree.delete(joinPathFragments(targetSourceDir, 'Dockerfile'));\n  }\n\n  addDependenciesToPackageJson(tree, deps, devDeps);\n  // Add to the project's package.json too if it has one (e.g. nx plugins),\n  // otherwise dependencies live in the workspace root only.\n  if (tree.exists(projectPackageJsonPath)) {\n    addDependenciesToPackageJson(tree, deps, devDeps, projectPackageJsonPath);\n  }\n\n  // @modelcontextprotocol/sdk declares zod as a peer dependency with a wide range\n  // (^3.25 || ^4.0). Yarn does not dedupe the peer to the workspace's pinned zod, so\n  // without a resolution it installs a separate zod under the SDK's own node_modules.\n  // The two zod copies have structurally incompatible types, which breaks type\n  // inference for registerTool inputSchema. Scope the resolution to the SDK so\n  // other consumers (e.g. @tanstack/router-generator pinning zod@3) are unaffected.\n  if (detectPackageManager() === 'yarn') {\n    updateJson(tree, 'package.json', (packageJson) => {\n      packageJson.resolutions = {\n        ...packageJson.resolutions,\n        '**/@modelcontextprotocol/sdk/zod': TS_VERSIONS['zod'],\n      };\n      return packageJson;\n    });\n  }\n\n  const localDevPort = assignPort(tree, project, 8000, {\n    component: { info: TS_MCP_SERVER_GENERATOR_INFO, name: mcpTargetPrefix },\n  });\n\n  const mcpTargets = {\n    ...project.targets,\n    // Add targets for running the MCP server\n    [`${mcpTargetPrefix}-serve-stdio`]: {\n      executor: 'nx:run-commands',\n      continuous: true,\n      options: {\n        commands: [`tsx --watch ${relativeSourceDir}/stdio.ts`],\n        cwd: '{projectRoot}',\n      },\n    },\n    [`${mcpTargetPrefix}-serve`]: {\n      executor: 'nx:run-commands',\n      continuous: true,\n      options: {\n        commands: [`tsx --watch ${relativeSourceDir}/http.ts`],\n        cwd: '{projectRoot}',\n        env: {\n          PORT: `${localDevPort}`,\n        },\n      },\n    },\n    [`${mcpTargetPrefix}-dev`]: {\n      executor: 'nx:run-commands',\n      continuous: true,\n      options: {\n        commands: [`tsx --watch ${relativeSourceDir}/http.ts`],\n        cwd: '{projectRoot}',\n        env: {\n          PORT: `${localDevPort}`,\n          LOCAL_DEV: 'true',\n        },\n      },\n    },\n    [`${mcpTargetPrefix}-inspect`]: {\n      executor: 'nx:run-commands',\n      continuous: true,\n      // Launch the inspector against the locally served HTTP server. The dev\n      // target starts the server and any connected dependencies (e.g. a local\n      // database).\n      dependsOn: [`${mcpTargetPrefix}-dev`],\n      options: {\n        commands: [\n          `mcp-inspector --transport http --server-url http://localhost:${localDevPort}/mcp`,\n        ],\n        cwd: '{projectRoot}',\n      },\n    },\n    [`${mcpTargetPrefix}-inspect-stdio`]: {\n      executor: 'nx:run-commands',\n      continuous: true,\n      options: {\n        commands: [\n          `mcp-inspector -- tsx --watch ${relativeSourceDir}/stdio.ts`,\n        ],\n        cwd: '{projectRoot}',\n      },\n    },\n  };\n\n  // Aggregate `<mcp>-dev` under the project-level `dev` target.\n  addComponentDevTarget(mcpTargets, `${mcpTargetPrefix}-dev`);\n\n  updateProjectConfiguration(tree, project.name, {\n    ...project,\n    // Sort targets so their order is stable regardless of insertion order on\n    // first run vs re-run.\n    targets: sortObjectKeys(mcpTargets),\n  });\n\n  addComponentGeneratorMetadata(\n    tree,\n    project.name,\n    TS_MCP_SERVER_GENERATOR_INFO,\n    targetSourceDirRelativeToProjectRoot,\n    mcpTargetPrefix,\n    {\n      port: localDevPort,\n      rc: mcpServerNameClassName,\n      auth,\n    },\n  );\n\n  await addGeneratorMetricsIfApplicable(tree, [TS_MCP_SERVER_GENERATOR_INFO]);\n\n  await ensureLicenseExceptions(tree, MCP_INSPECTOR_EXCEPTIONS);\n\n  await formatFilesInSubtree(tree);\n  return () =>\n    installDependencies(tree, options.preferInstallDependencies, {\n      languages: ['typescript'],\n    });\n};\n\nexport default tsMcpServerGenerator;\n"],"names":["addDependenciesToPackageJson","detectPackageManager","generateFiles","joinPathFragments","OverwriteStrategy","readJson","updateJson","updateProjectConfiguration","ensureLicenseExceptions","MCP_INSPECTOR_EXCEPTIONS","addMcpServerInfra","addTypeScriptBundleTarget","resolveContainers","addDockerScanTarget","formatFilesInSubtree","FsCommands","resolveIac","installDependencies","addGeneratorMetricsIfApplicable","isEsmWorkspace","kebabCase","toClassName","getNpmScope","addComponentDevTarget","addComponentGeneratorMetadata","addDependencyToTargetIfNotPresent","getGeneratorInfo","readProjectConfigurationUnqualified","sortObjectKeys","assignPort","sharedConstructsGenerator","BASE_IMAGES","TS_VERSIONS","withVersions","TS_MCP_SERVER_GENERATOR_INFO","filename","tsMcpServerGenerator","tree","options","project","exists","root","Error","defaultName","name","split","pop","mcpServerNameClassName","mcpTargetPrefix","targetSourceDirRelativeToProjectRoot","targetSourceDir","relativeSourceDir","replace","distDir","infra","auth","console","warn","projectPackageJsonPath","esm","type","dirname","adotVersion","jaegerVersion","nodeBaseImage","node","npmVersion","npm","overwriteStrategy","KeepExisting","deps","devDeps","containers","dockerImageTag","targetFilePath","bundleOutputDir","dockerOutputDir","dockerTargetName","fs","targets","cache","outputs","executor","commands","cp","parallel","dependsOn","containerEngine","trivyTargetName","imageTags","iac","mcpServerNameKebabCase","projectName","delete","packageJson","resolutions","localDevPort","component","info","mcpTargets","continuous","cwd","env","PORT","LOCAL_DEV","port","rc","preferInstallDependencies","languages"],"mappings":"AAAA;;;CAGC,GACD,SACEA,4BAA4B,EAC5BC,oBAAoB,EAEpBC,aAAa,EACbC,iBAAiB,EACjBC,iBAAiB,EACjBC,QAAQ,EAERC,UAAU,EACVC,0BAA0B,QACrB,aAAa;AACpB,SAASC,uBAAuB,QAAQ,0BAAuB;AAC/D,SAASC,wBAAwB,QAAQ,oCAAiC;AAC1E,SAASC,iBAAiB,QAAQ,6DAA0D;AAC5F,SAASC,yBAAyB,QAAQ,+BAA4B;AACtE,SAASC,iBAAiB,QAAQ,4BAAyB;AAC3D,SAASC,mBAAmB,QAAQ,wBAAqB;AACzD,SAASC,oBAAoB,QAAQ,wBAAqB;AAC1D,SAASC,UAAU,QAAQ,oBAAiB;AAC5C,SAASC,UAAU,QAAQ,qBAAkB;AAC7C,SAASC,mBAAmB,QAAQ,yBAAsB;AAC1D,SAASC,+BAA+B,QAAQ,yBAAsB;AACtE,SAASC,cAAc,QAAQ,+BAA4B;AAC3D,SAASC,SAAS,EAAEC,WAAW,QAAQ,uBAAoB;AAC3D,SAASC,WAAW,QAAQ,2BAAwB;AACpD,SACEC,qBAAqB,EACrBC,6BAA6B,EAC7BC,iCAAiC,EACjCC,gBAAgB,EAEhBC,mCAAmC,QAC9B,oBAAiB;AACxB,SAASC,cAAc,QAAQ,wBAAqB;AACpD,SAASC,UAAU,QAAQ,sBAAmB;AAC9C,SAASC,yBAAyB,QAAQ,mCAAgC;AAC1E,SAASC,WAAW,EAAEC,WAAW,EAAEC,YAAY,QAAQ,0BAAuB;AAG9E,OAAO,MAAMC,+BAAgDR,iBAC3D,YAAYS,QAAQ,EACpB;AAEF,OAAO,MAAMC,uBAAuB,OAClCC,MACAC;IAEA,MAAMC,UAAUZ,oCAAoCU,MAAMC,QAAQC,OAAO;IAEzE,IAAI,CAACF,KAAKG,MAAM,CAACrC,kBAAkBoC,QAAQE,IAAI,EAAE,mBAAmB;QAClE,MAAM,IAAIC,MACR,CAAC,oBAAoB,EAAEJ,QAAQC,OAAO,CAAC,sDAAsD,CAAC;IAElG;IAEA,MAAMI,cAAc,GAAGvB,UAAUmB,QAAQK,IAAI,CAACC,KAAK,CAAC,KAAKC,GAAG,IAAI,WAAW,CAAC;IAC5E,MAAMF,OAAOxB,UAAUkB,QAAQM,IAAI,IAAID;IACvC,MAAMI,yBAAyB1B,YAAYuB;IAC3C,MAAMI,kBAAkBV,QAAQM,IAAI,GAAGA,OAAO;IAC9C,MAAMK,uCAAuC9C,kBAC3C,OACA6C;IAEF,MAAME,kBAAkB/C,kBACtBoC,QAAQE,IAAI,EACZQ;IAEF,MAAME,oBAAoBD,gBAAgBE,OAAO,CAACb,QAAQE,IAAI,GAAG,KAAK;IACtE,MAAMY,UAAUlD,kBAAkB,QAAQoC,QAAQE,IAAI;IAEtD,MAAMa,QAAQhB,QAAQgB,KAAK,IAAI;IAE/B,IAAIA,UAAU,UAAUhB,QAAQiB,IAAI,IAAIjB,QAAQiB,IAAI,KAAK,OAAO;QAC9DC,QAAQC,IAAI,CACV;IAEJ;IAEA,MAAMF,OAAOjB,QAAQiB,IAAI,IAAI;IAE7B,MAAMG,yBAAyBvD,kBAC7BoC,QAAQE,IAAI,EACZ;IAGF,yEAAyE;IACzE,4EAA4E;IAC5E,yEAAyE;IACzE,MAAMkB,MAAMtB,KAAKG,MAAM,CAACkB,0BACpBrD,SAASgC,MAAMqB,wBAAwBE,IAAI,KAAK,WAChDzC,eAAekB;IAEnB,0BAA0B;IAC1BnC,cACEmC,MACAlC,kBAAkB,YAAY0D,OAAO,EAAE,UACvCX,iBACA;QACEN;QACAe;QACAN;QACAS,aACE9B,WAAW,CAAC,yDAAyD;QACvE+B,eAAe/B,WAAW,CAAC,mCAAmC;QAC9DgC,eAAejC,YAAYkC,IAAI;QAC/BC,YAAYlC,YAAYmC,GAAG;IAC7B,GACA;QAAEC,mBAAmBhE,kBAAkBiE,YAAY;IAAC;IAGtD,mBAAmB;IACnB,MAAMC,OAAOrC,aAAa;QACxB;QACA;QACA;QACA;QACA;KACD;IACD,MAAMsC,UAAUtC,aAAa;QAC3B;QACA;QACA;KACD;IAED,6BAA6B;IAC7B,IAAIqB,UAAU,aAAa;QACzB,MAAMkB,aAAa,MAAM5D,kBAAkByB,MAAM;QACjD,MAAMoC,iBAAiB,GAAGnD,YAAYe,MAAM,CAAC,EAAEO,KAAK,OAAO,CAAC;QAE5D,oBAAoB;QACpB,MAAMjC,0BAA0B0B,MAAME,SAAS;YAC7CmC,gBAAgB,GAAGzB,qCAAqC,QAAQ,CAAC;YACjE0B,iBAAiBxE,kBAAkB,OAAOyC;QAC5C;QAEA,MAAMgC,kBAAkBzE,kBACtB,QACAoC,QAAQE,IAAI,EACZ,UACA,OACAG;QAEF,MAAMiC,mBAAmB,GAAG7B,gBAAgB,OAAO,CAAC;QAEpD,MAAM8B,KAAK,IAAI/D,WAAWsB;QAC1BE,QAAQwC,OAAO,CAACF,iBAAiB,GAAG;YAClCG,OAAO;YACPC,SAAS;gBAAC,CAAC,gBAAgB,EAAEL,gBAAgB,WAAW,CAAC;aAAC;YAC1DM,UAAU;YACV5C,SAAS;gBACP6C,UAAU;oBACRL,GAAGM,EAAE,CACH,GAAGlC,gBAAgB,WAAW,CAAC,EAC/B,GAAG0B,gBAAgB,WAAW,CAAC;oBAEjC,GAAGJ,WAAW,iCAAiC,EAAEC,eAAe,CAAC,EAAEG,iBAAiB;iBACrF;gBACDS,UAAU;YACZ;YACAC,WAAW;gBAAC;aAAS;QACvB;QAEA7D,kCAAkCc,SAAS,UAAUsC;QACrDpD,kCAAkCc,SAAS,SAAS;QAEpD1B,oBAAoBwB,MAAM;YACxBE;YACAgD,iBAAiBf;YACjBgB,iBAAiB,GAAGxC,gBAAgB,MAAM,CAAC;YAC3C6B;YACAY,WAAW;gBAAChB;aAAe;QAC7B;QAEA,wBAAwB;QACxB,MAAMiB,MAAM,MAAM1E,WAAWqB,MAAMC,QAAQoD,GAAG;QAC9C,MAAM5D,0BAA0BO,MAAM;YAAEqD;QAAI;QAE5C,6CAA6C;QAC7C,MAAMhF,kBAAkB2B,MAAM;YAC5BsD,wBAAwB/C;YACxBG;YACA6C,aAAarD,QAAQK,IAAI;YACzB6B;YACAG;YACAc;YACAnC;YACAiB;QACF;IACF,OAAO;QACL,0CAA0C;QAC1CnC,KAAKwD,MAAM,CAAC1F,kBAAkB+C,iBAAiB;IACjD;IAEAlD,6BAA6BqC,MAAMiC,MAAMC;IACzC,yEAAyE;IACzE,0DAA0D;IAC1D,IAAIlC,KAAKG,MAAM,CAACkB,yBAAyB;QACvC1D,6BAA6BqC,MAAMiC,MAAMC,SAASb;IACpD;IAEA,gFAAgF;IAChF,mFAAmF;IACnF,oFAAoF;IACpF,6EAA6E;IAC7E,6EAA6E;IAC7E,kFAAkF;IAClF,IAAIzD,2BAA2B,QAAQ;QACrCK,WAAW+B,MAAM,gBAAgB,CAACyD;YAChCA,YAAYC,WAAW,GAAG;gBACxB,GAAGD,YAAYC,WAAW;gBAC1B,oCAAoC/D,WAAW,CAAC,MAAM;YACxD;YACA,OAAO8D;QACT;IACF;IAEA,MAAME,eAAenE,WAAWQ,MAAME,SAAS,MAAM;QACnD0D,WAAW;YAAEC,MAAMhE;YAA8BU,MAAMI;QAAgB;IACzE;IAEA,MAAMmD,aAAa;QACjB,GAAG5D,QAAQwC,OAAO;QAClB,yCAAyC;QACzC,CAAC,GAAG/B,gBAAgB,YAAY,CAAC,CAAC,EAAE;YAClCkC,UAAU;YACVkB,YAAY;YACZ9D,SAAS;gBACP6C,UAAU;oBAAC,CAAC,YAAY,EAAEhC,kBAAkB,SAAS,CAAC;iBAAC;gBACvDkD,KAAK;YACP;QACF;QACA,CAAC,GAAGrD,gBAAgB,MAAM,CAAC,CAAC,EAAE;YAC5BkC,UAAU;YACVkB,YAAY;YACZ9D,SAAS;gBACP6C,UAAU;oBAAC,CAAC,YAAY,EAAEhC,kBAAkB,QAAQ,CAAC;iBAAC;gBACtDkD,KAAK;gBACLC,KAAK;oBACHC,MAAM,GAAGP,cAAc;gBACzB;YACF;QACF;QACA,CAAC,GAAGhD,gBAAgB,IAAI,CAAC,CAAC,EAAE;YAC1BkC,UAAU;YACVkB,YAAY;YACZ9D,SAAS;gBACP6C,UAAU;oBAAC,CAAC,YAAY,EAAEhC,kBAAkB,QAAQ,CAAC;iBAAC;gBACtDkD,KAAK;gBACLC,KAAK;oBACHC,MAAM,GAAGP,cAAc;oBACvBQ,WAAW;gBACb;YACF;QACF;QACA,CAAC,GAAGxD,gBAAgB,QAAQ,CAAC,CAAC,EAAE;YAC9BkC,UAAU;YACVkB,YAAY;YACZ,uEAAuE;YACvE,wEAAwE;YACxE,aAAa;YACbd,WAAW;gBAAC,GAAGtC,gBAAgB,IAAI,CAAC;aAAC;YACrCV,SAAS;gBACP6C,UAAU;oBACR,CAAC,6DAA6D,EAAEa,aAAa,IAAI,CAAC;iBACnF;gBACDK,KAAK;YACP;QACF;QACA,CAAC,GAAGrD,gBAAgB,cAAc,CAAC,CAAC,EAAE;YACpCkC,UAAU;YACVkB,YAAY;YACZ9D,SAAS;gBACP6C,UAAU;oBACR,CAAC,6BAA6B,EAAEhC,kBAAkB,SAAS,CAAC;iBAC7D;gBACDkD,KAAK;YACP;QACF;IACF;IAEA,8DAA8D;IAC9D9E,sBAAsB4E,YAAY,GAAGnD,gBAAgB,IAAI,CAAC;IAE1DzC,2BAA2B8B,MAAME,QAAQK,IAAI,EAAE;QAC7C,GAAGL,OAAO;QACV,yEAAyE;QACzE,uBAAuB;QACvBwC,SAASnD,eAAeuE;IAC1B;IAEA3E,8BACEa,MACAE,QAAQK,IAAI,EACZV,8BACAe,sCACAD,iBACA;QACEyD,MAAMT;QACNU,IAAI3D;QACJQ;IACF;IAGF,MAAMrC,gCAAgCmB,MAAM;QAACH;KAA6B;IAE1E,MAAM1B,wBAAwB6B,MAAM5B;IAEpC,MAAMK,qBAAqBuB;IAC3B,OAAO,IACLpB,oBAAoBoB,MAAMC,QAAQqE,yBAAyB,EAAE;YAC3DC,WAAW;gBAAC;aAAa;QAC3B;AACJ,EAAE;AAEF,eAAexE,qBAAqB"}

package/src/ts/nx-plugin/__snapshots__/generator.spec.ts.snap

@@ -127,7 +127,7 @@ exports[`ts#nx-plugin generator > should generate MCP server files > test-plugin
   - pnpm add -w -D <package>
   - yarn add -D <package>
   - npm install --legacy-peer-deps -D <package>
-  - bun install -D <package>
+  - bun add -D <package>
   - (Omit -D for production dependencies)
 - When specifying project names as arguments to generators, prefer the _fully qualified_ project name, for example \`@workspace-name/project-name\`. Check the \`project.json\` file for the specific package to find its fully qualified name
 - When no generator exists for a specific framework required, look for more generic project generators if availalbe and build on top of these.
@@ -482,7 +482,7 @@ export const buildInstallCommand = (pm: string, pkg: string) =>
     pnpm: \`pnpm add -Dw \${pkg}\`,
     yarn: \`yarn add -D \${pkg}\`,
     npm: \`npm install --legacy-peer-deps -D \${pkg}\`,
-    bun: \`bun install -D \${pkg}\`,
+    bun: \`bun add -D \${pkg}\`,
   })[pm];
 
 const renderSchema = (schema: any) =>

package/src/ts/nx-plugin/files/mcp-server/resources/GENERAL_GUIDANCE.md.template

@@ -30,7 +30,7 @@
   - pnpm add -w -D <package>
   - yarn add -D <package>
   - npm install --legacy-peer-deps -D <package>
-  - bun install -D <package>
+  - bun add -D <package>
   - (Omit -D for production dependencies)
 - When specifying project names as arguments to generators, prefer the _fully qualified_ project name, for example `@workspace-name/project-name`. Check the `project.json` file for the specific package to find its fully qualified name
 - When no generator exists for a specific framework required, look for more generic project generators if availalbe and build on top of these.

package/src/ts/nx-plugin/files/mcp-server/utils.ts.template

@@ -56,7 +56,7 @@ export const buildInstallCommand = (pm: string, pkg: string) =>
     pnpm: `pnpm add -Dw ${pkg}`,
     yarn: `yarn add -D ${pkg}`,
     npm: `npm install --legacy-peer-deps -D ${pkg}`,
-    bun: `bun install -D ${pkg}`,
+    bun: `bun add -D ${pkg}`,
   })[pm];
 
 const renderSchema = (schema: any) =>

package/src/ts/rdb/__snapshots__/generator.spec.ts.snap

@@ -4669,6 +4669,13 @@ exports[`ts#rdb generator > should generate the aurora shared construct 4`] = `
 # Upgrade npm to a version free of known HIGH/CRITICAL vulnerabilities
 RUN npm install -g npm@12.0.1
 
+# Patch OS packages beyond the base image's pinned release, and drop the
+# runtime's convenience copy of the AWS SDK (the handler bundle inlines its
+# own dependencies), keeping the image free of known HIGH/CRITICAL
+# vulnerabilities
+RUN microdnf upgrade -y --releasever latest && microdnf clean all \\
+    && rm -rf /var/runtime/node_modules/@aws-sdk
+
 WORKDIR \${LAMBDA_TASK_ROOT}
 
 # npm blocks dependency install scripts by default; allow prisma's so its

package/src/ts/rdb/files/Dockerfile.template

@@ -3,6 +3,13 @@ FROM public.ecr.aws/lambda/nodejs:24
 # Upgrade npm to a version free of known HIGH/CRITICAL vulnerabilities
 RUN npm install -g npm@<%= npmVersion %>
 
+# Patch OS packages beyond the base image's pinned release, and drop the
+# runtime's convenience copy of the AWS SDK (the handler bundle inlines its
+# own dependencies), keeping the image free of known HIGH/CRITICAL
+# vulnerabilities
+RUN microdnf upgrade -y --releasever latest && microdnf clean all \
+    && rm -rf /var/runtime/node_modules/@aws-sdk
+
 WORKDIR ${LAMBDA_TASK_ROOT}
 
 # npm blocks dependency install scripts by default; allow prisma's so its

package/src/ts/react-website/app/__snapshots__/generator.spec.ts.snap

@@ -961,7 +961,7 @@ exports[`react-website generator > Tanstack router integration > should generate
 
 exports[`react-website generator > Tanstack router integration > should generate website with no router correctly > biome.json 1`] = `
 "{
-  "$schema": "https://biomejs.dev/schemas/2.4.16/schema.json",
+  "$schema": "https://biomejs.dev/schemas/2.5.4/schema.json",
   "root": true,
   "formatter": {
     "enabled": true,
@@ -986,7 +986,7 @@ exports[`react-website generator > Tanstack router integration > should generate
   "linter": {
     "enabled": true,
     "rules": {
-      "recommended": false,
+      "preset": "none",
       "correctness": {
         "noUndeclaredDependencies": "warn"
       }
@@ -1820,6 +1820,9 @@ export class StaticWebsite extends Construct {
       destinationBucket: this.websiteBucket,
       // Files in the distribution's edge caches will be invalidated after files are uploaded to the destination bucket.
       distribution: this.cloudFrontDistribution,
+      // Exclude the runtime config from this deployment's sync so its default pruning
+      // never deletes the file managed separately by RuntimeConfigDeployment below.
+      exclude: [DEFAULT_RUNTIME_CONFIG_FILENAME],
       memoryLimit: 1024,
     });
 
@@ -2674,7 +2677,7 @@ exports[`react-website generator > Tanstack router integration > should generate
 
 exports[`react-website generator > Tanstack router integration > should generate website with router correctly > biome.json 1`] = `
 "{
-  "$schema": "https://biomejs.dev/schemas/2.4.16/schema.json",
+  "$schema": "https://biomejs.dev/schemas/2.5.4/schema.json",
   "root": true,
   "formatter": {
     "enabled": true,
@@ -2699,7 +2702,7 @@ exports[`react-website generator > Tanstack router integration > should generate
   "linter": {
     "enabled": true,
     "rules": {
-      "recommended": false,
+      "preset": "none",
       "correctness": {
         "noUndeclaredDependencies": "warn"
       }
@@ -3538,6 +3541,9 @@ export class StaticWebsite extends Construct {
       destinationBucket: this.websiteBucket,
       // Files in the distribution's edge caches will be invalidated after files are uploaded to the destination bucket.
       distribution: this.cloudFrontDistribution,
+      // Exclude the runtime config from this deployment's sync so its default pruning
+      // never deletes the file managed separately by RuntimeConfigDeployment below.
+      exclude: [DEFAULT_RUNTIME_CONFIG_FILENAME],
       memoryLimit: 1024,
     });
 
@@ -5163,6 +5169,9 @@ export class StaticWebsite extends Construct {
       destinationBucket: this.websiteBucket,
       // Files in the distribution's edge caches will be invalidated after files are uploaded to the destination bucket.
       distribution: this.cloudFrontDistribution,
+      // Exclude the runtime config from this deployment's sync so its default pruning
+      // never deletes the file managed separately by RuntimeConfigDeployment below.
+      exclude: [DEFAULT_RUNTIME_CONFIG_FILENAME],
       memoryLimit: 1024,
     });
 

package/src/ts/react-website/cognito-auth/__snapshots__/generator.spec.ts.snap

@@ -118,7 +118,7 @@ import {
 import { LogGroup, RetentionDays } from 'aws-cdk-lib/aws-logs';
 import { Construct } from 'constructs';
 import { RuntimeConfig } from './runtime-config.js';
-import { Distribution } from 'aws-cdk-lib/aws-cloudfront';
+import { CfnDistribution, Distribution } from 'aws-cdk-lib/aws-cloudfront';
 import { suppressRules } from './checkov.js';
 
 const WEB_CLIENT_ID = 'WebClient';
@@ -334,9 +334,7 @@ export class UserIdentity extends Construct {
     const lazilyComputedCallbackUrls = Lazy.list({
       produce: () =>
         ['http://localhost:4200', 'http://localhost:4300'].concat(
-          this.findCloudFrontDistributions().map(
-            (d) => \`https://\${d.domainName}\`,
-          ),
+          this.findCloudFrontDomainNames().map((domain) => \`https://\${domain}\`),
         ),
     });
 
@@ -386,10 +384,17 @@ export class UserIdentity extends Construct {
     }).node.addDependency(userPoolClient, userPool, userPoolDomain);
   };
 
-  private findCloudFrontDistributions = (): Distribution[] =>
+  // Includes each distribution's default domain name plus any custom domain names (aliases) configured on it.
+  private findCloudFrontDomainNames = (): string[] =>
     Stack.of(this)
       .node.findAll()
-      .filter((child) => child instanceof Distribution);
+      .filter((child): child is Distribution => child instanceof Distribution)
+      .flatMap((d) => {
+        const cfnDistribution = d.node.defaultChild as CfnDistribution;
+        const distributionConfig =
+          cfnDistribution.distributionConfig as CfnDistribution.DistributionConfigProperty;
+        return [d.domainName, ...(distributionConfig.aliases ?? [])];
+      });
 }
 "
 `;

package/src/ts/react-website/cognito-auth/__snapshots__/generator.terraform.spec.ts.snap

@@ -241,11 +241,21 @@ resource "aws_cloudfront_distribution" "website" {
   }
 }
 
-# Add CloudFront domain to user pool client callback URLs
+# Add CloudFront domain and any custom domain names to user pool client callback URLs.
+# Keyed by statically-known values so for_each keys are resolvable at plan time; the
+# CloudFront domain is only known at apply time, so it appears in the value, not the key.
+locals {
+  callback_urls = merge(
+    { cloudfront = "https://\${aws_cloudfront_distribution.website.domain_name}" },
+    { for domain in var.custom_domain_names : domain => "https://\${domain}" },
+  )
+}
+
 module "add_callback_url" {
   source = "../user-identity/add-callback-url"
+  for_each = local.callback_urls
 
-  callback_url = "https://\${aws_cloudfront_distribution.website.domain_name}"
+  callback_url = each.value
 
   depends_on = [aws_cloudfront_distribution.website]
 }

package/src/utils/agent-core-constructs/agent-core-constructs.d.ts

@@ -53,6 +53,7 @@ export interface AddAgentCoreGatewayInfraProps {
     projectName: string;
     projectDirectory: string;
     cedarPolicy: boolean;
+    auth: AgentCoreAuth;
 }
 export declare const addAgentCoreGatewayInfra: (tree: Tree, options: AddAgentCoreGatewayInfraProps & IACProvider) => Promise<void>;
 export {};

package/src/utils/agent-core-constructs/agent-core-constructs.js

@@ -107,6 +107,7 @@ const addAgentCoreGatewayCDKInfra = async (tree, options)=>{
         nameKebabCase: options.gatewayNameKebabCase,
         projectDirectory: options.projectDirectory,
         cedarPolicy: options.cedarPolicy,
+        auth: options.auth,
         ...esmVars(tree)
     }, {
         overwriteStrategy: OverwriteStrategy.KeepExisting
@@ -126,6 +127,7 @@ const addAgentCoreGatewayTerraformInfra = (tree, options)=>{
         nameKebabCase: options.gatewayNameKebabCase,
         projectDirectory: options.projectDirectory,
         cedarPolicy: options.cedarPolicy,
+        auth: options.auth,
         boto3Version: PY_VERSIONS.boto3,
         httpxVersion: PY_VERSIONS.httpx,
         mcpVersion: PY_VERSIONS.mcp,