@aws/nx-plugin 1.0.0-rc.44 → 1.0.0-rc.46

package/src/utils/agent-core-constructs/agent-core-constructs.js.map

@@ -1 +1 @@
-{"version":3,"sources":["../../../../../../packages/nx-plugin/src/utils/agent-core-constructs/agent-core-constructs.ts"],"sourcesContent":["/**\n * Copyright Amazon.com, Inc. or its affiliates. All Rights Reserved.\n * SPDX-License-Identifier: Apache-2.0\n */\nimport {\n  generateFiles,\n  joinPathFragments,\n  OverwriteStrategy,\n  type ProjectConfiguration,\n  type Tree,\n  updateJson,\n} from '@nx/devkit';\nimport { addStarExport } from '../ast';\nimport type { Containers } from '../containers';\nimport type { Iac } from '../iac';\nimport { esmVars } from '../module-format';\nimport { addDependencyToTargetIfNotPresent } from '../nx';\nimport {\n  PACKAGES_DIR,\n  SHARED_CONSTRUCTS_DIR,\n  SHARED_TERRAFORM_DIR,\n} from '../shared-constructs-constants';\nimport { PY_VERSIONS, terraformProviderVersions } from '../versions';\n\ntype IACProvider = { iac: Iac };\n\nexport type AgentCoreAuth = 'iam' | 'cognito';\n\nexport interface AddAgentCoreInfraProps {\n  nameClassName: string;\n  nameKebabCase: string;\n  projectName: string;\n  dockerImageTag: string;\n  dockerOutputDir: string;\n  appDirectory: string;\n  serverProtocol: 'mcp' | 'http' | 'a2a';\n  auth: AgentCoreAuth;\n  containers: Containers;\n}\n\nconst addAgentCoreInfra = async (\n  tree: Tree,\n  options: AddAgentCoreInfraProps & { iac: Iac },\n) => {\n  switch (options.iac) {\n    case 'cdk':\n      await addAgentCoreCDKInfra(tree, options);\n      break;\n    case 'terraform':\n      addAgentCoreTerraformInfra(tree, options);\n      break;\n  }\n\n  // Update shared constructs/terraform project configuration to depend on this project\n  updateJson(\n    tree,\n    joinPathFragments(\n      PACKAGES_DIR,\n      options.iac === 'cdk' ? SHARED_CONSTRUCTS_DIR : SHARED_TERRAFORM_DIR,\n      'project.json',\n    ),\n    (config: ProjectConfiguration) => {\n      addDependencyToTargetIfNotPresent(\n        config,\n        'build',\n        `${options.projectName}:build`,\n      );\n      return config;\n    },\n  );\n};\n\nconst addAgentCoreCDKInfra = async (\n  tree: Tree,\n  options: AddAgentCoreInfraProps,\n) => {\n  // Generate app specific CDK construct\n  generateFiles(\n    tree,\n    joinPathFragments(import.meta.dirname, 'files', 'cdk', 'app', 'agent-core'),\n    joinPathFragments(\n      PACKAGES_DIR,\n      SHARED_CONSTRUCTS_DIR,\n      'src',\n      'app',\n      options.appDirectory,\n    ),\n    { ...options, ...esmVars(tree) },\n    {\n      overwriteStrategy: OverwriteStrategy.KeepExisting,\n    },\n  );\n\n  // Export app specific CDK construct\n  await addStarExport(\n    tree,\n    joinPathFragments(\n      PACKAGES_DIR,\n      SHARED_CONSTRUCTS_DIR,\n      'src',\n      'app',\n      options.appDirectory,\n      'index.ts',\n    ),\n    `./${options.nameKebabCase}/${options.nameKebabCase}.js`,\n  );\n  await addStarExport(\n    tree,\n    joinPathFragments(\n      PACKAGES_DIR,\n      SHARED_CONSTRUCTS_DIR,\n      'src',\n      'app',\n      'index.ts',\n    ),\n    `./${options.appDirectory}/index.js`,\n  );\n};\n\nconst addAgentCoreTerraformInfra = (\n  tree: Tree,\n  options: AddAgentCoreInfraProps,\n) => {\n  // Add the AgentCore shared module\n  generateFiles(\n    tree,\n    joinPathFragments(\n      import.meta.dirname,\n      'files',\n      'terraform',\n      'core',\n      'agent-core',\n    ),\n    joinPathFragments(\n      PACKAGES_DIR,\n      SHARED_TERRAFORM_DIR,\n      'src',\n      'core',\n      'agent-core',\n    ),\n    {\n      containers: options.containers,\n      boto3Version: PY_VERSIONS.boto3,\n      ...terraformProviderVersions(),\n    },\n    {\n      overwriteStrategy: OverwriteStrategy.KeepExisting,\n    },\n  );\n\n  // Generate app specific agent core configuration\n  generateFiles(\n    tree,\n    joinPathFragments(\n      import.meta.dirname,\n      'files',\n      'terraform',\n      'app',\n      'agent-core',\n    ),\n    joinPathFragments(\n      PACKAGES_DIR,\n      SHARED_TERRAFORM_DIR,\n      'src',\n      'app',\n      options.appDirectory,\n    ),\n    options,\n    {\n      overwriteStrategy: OverwriteStrategy.KeepExisting,\n    },\n  );\n};\n\nexport interface AddMcpServerInfraProps {\n  mcpServerNameClassName: string;\n  mcpServerNameKebabCase: string;\n  projectName: string;\n  dockerImageTag: string;\n  dockerOutputDir: string;\n  auth: AgentCoreAuth;\n  containers: Containers;\n}\n\n/**\n * Add an MCP server CDK construct\n */\nexport const addMcpServerInfra = async (\n  tree: Tree,\n  options: AddMcpServerInfraProps & IACProvider,\n) => {\n  await addAgentCoreInfra(tree, {\n    nameClassName: options.mcpServerNameClassName,\n    nameKebabCase: options.mcpServerNameKebabCase,\n    dockerImageTag: options.dockerImageTag,\n    dockerOutputDir: options.dockerOutputDir,\n    projectName: options.projectName,\n    appDirectory: 'mcp-servers',\n    serverProtocol: 'mcp',\n    iac: options.iac,\n    auth: options.auth,\n    containers: options.containers,\n  });\n};\n\nexport interface AddAgentInfraProps {\n  agentNameClassName: string;\n  agentNameKebabCase: string;\n  projectName: string;\n  dockerImageTag: string;\n  dockerOutputDir: string;\n  auth: AgentCoreAuth;\n  serverProtocol?: 'http' | 'a2a';\n  containers: Containers;\n}\n\n/**\n * Add an agent CDK construct\n */\nexport const addAgentInfra = async (\n  tree: Tree,\n  options: AddAgentInfraProps & IACProvider,\n) => {\n  await addAgentCoreInfra(tree, {\n    nameClassName: options.agentNameClassName,\n    nameKebabCase: options.agentNameKebabCase,\n    projectName: options.projectName,\n    dockerImageTag: options.dockerImageTag,\n    dockerOutputDir: options.dockerOutputDir,\n    appDirectory: 'agents',\n    serverProtocol: options.serverProtocol ?? 'http',\n    iac: options.iac,\n    auth: options.auth,\n    containers: options.containers,\n  });\n};\n\nexport interface AddAgentCoreGatewayInfraProps {\n  gatewayNameClassName: string;\n  gatewayNameKebabCase: string;\n  projectName: string;\n  projectDirectory: string;\n  cedarPolicy: boolean;\n}\n\nexport const addAgentCoreGatewayInfra = async (\n  tree: Tree,\n  options: AddAgentCoreGatewayInfraProps & IACProvider,\n) => {\n  switch (options.iac) {\n    case 'cdk':\n      await addAgentCoreGatewayCDKInfra(tree, options);\n      break;\n    case 'terraform':\n      addAgentCoreGatewayTerraformInfra(tree, options);\n      break;\n  }\n\n  updateJson(\n    tree,\n    joinPathFragments(\n      PACKAGES_DIR,\n      options.iac === 'cdk' ? SHARED_CONSTRUCTS_DIR : SHARED_TERRAFORM_DIR,\n      'project.json',\n    ),\n    (config: ProjectConfiguration) => {\n      addDependencyToTargetIfNotPresent(\n        config,\n        'build',\n        `${options.projectName}:build`,\n      );\n      return config;\n    },\n  );\n};\n\nconst addAgentCoreGatewayCDKInfra = async (\n  tree: Tree,\n  options: AddAgentCoreGatewayInfraProps,\n) => {\n  // Generic gateway construct (readiness probe, policy engine, Cedar policy\n  // loading) shared by all gateways\n  generateFiles(\n    tree,\n    joinPathFragments(\n      import.meta.dirname,\n      'files',\n      'cdk',\n      'core',\n      'agentcore-gateway',\n    ),\n    joinPathFragments(\n      PACKAGES_DIR,\n      SHARED_CONSTRUCTS_DIR,\n      'src',\n      'core',\n      'agentcore-gateway',\n    ),\n    { ...esmVars(tree) },\n    {\n      overwriteStrategy: OverwriteStrategy.KeepExisting,\n    },\n  );\n\n  generateFiles(\n    tree,\n    joinPathFragments(\n      import.meta.dirname,\n      'files',\n      'cdk',\n      'app',\n      'agentcore-gateway',\n    ),\n    joinPathFragments(\n      PACKAGES_DIR,\n      SHARED_CONSTRUCTS_DIR,\n      'src',\n      'app',\n      'gateways',\n    ),\n    {\n      nameClassName: options.gatewayNameClassName,\n      nameKebabCase: options.gatewayNameKebabCase,\n      projectDirectory: options.projectDirectory,\n      cedarPolicy: options.cedarPolicy,\n      ...esmVars(tree),\n    },\n    {\n      overwriteStrategy: OverwriteStrategy.KeepExisting,\n    },\n  );\n\n  await addStarExport(\n    tree,\n    joinPathFragments(\n      PACKAGES_DIR,\n      SHARED_CONSTRUCTS_DIR,\n      'src',\n      'core',\n      'index.ts',\n    ),\n    './agentcore-gateway/agentcore-gateway.js',\n  );\n  await addStarExport(\n    tree,\n    joinPathFragments(\n      PACKAGES_DIR,\n      SHARED_CONSTRUCTS_DIR,\n      'src',\n      'app',\n      'gateways',\n      'index.ts',\n    ),\n    `./${options.gatewayNameKebabCase}/${options.gatewayNameKebabCase}.js`,\n  );\n  await addStarExport(\n    tree,\n    joinPathFragments(\n      PACKAGES_DIR,\n      SHARED_CONSTRUCTS_DIR,\n      'src',\n      'app',\n      'index.ts',\n    ),\n    './gateways/index.js',\n  );\n};\n\nconst addAgentCoreGatewayTerraformInfra = (\n  tree: Tree,\n  options: AddAgentCoreGatewayInfraProps,\n) => {\n  generateFiles(\n    tree,\n    joinPathFragments(\n      import.meta.dirname,\n      'files',\n      'terraform',\n      'core',\n      'agentcore-gateway',\n    ),\n    joinPathFragments(\n      PACKAGES_DIR,\n      SHARED_TERRAFORM_DIR,\n      'src',\n      'core',\n      'agentcore-gateway',\n    ),\n    { ...terraformProviderVersions() },\n    {\n      overwriteStrategy: OverwriteStrategy.KeepExisting,\n    },\n  );\n\n  generateFiles(\n    tree,\n    joinPathFragments(\n      import.meta.dirname,\n      'files',\n      'terraform',\n      'app',\n      'agentcore-gateway',\n    ),\n    joinPathFragments(\n      PACKAGES_DIR,\n      SHARED_TERRAFORM_DIR,\n      'src',\n      'app',\n      'gateways',\n    ),\n    {\n      nameClassName: options.gatewayNameClassName,\n      nameKebabCase: options.gatewayNameKebabCase,\n      projectDirectory: options.projectDirectory,\n      cedarPolicy: options.cedarPolicy,\n      boto3Version: PY_VERSIONS.boto3,\n      httpxVersion: PY_VERSIONS.httpx,\n      mcpVersion: PY_VERSIONS.mcp,\n      ...terraformProviderVersions(),\n    },\n    {\n      overwriteStrategy: OverwriteStrategy.KeepExisting,\n    },\n  );\n\n  // The Cedar render script is only needed when policies are enabled\n  if (!options.cedarPolicy) {\n    const renderScript = joinPathFragments(\n      PACKAGES_DIR,\n      SHARED_TERRAFORM_DIR,\n      'src',\n      'app',\n      'gateways',\n      options.gatewayNameKebabCase,\n      'render-cedar.cjs',\n    );\n    if (tree.exists(renderScript)) {\n      tree.delete(renderScript);\n    }\n  }\n};\n"],"names":["generateFiles","joinPathFragments","OverwriteStrategy","updateJson","addStarExport","esmVars","addDependencyToTargetIfNotPresent","PACKAGES_DIR","SHARED_CONSTRUCTS_DIR","SHARED_TERRAFORM_DIR","PY_VERSIONS","terraformProviderVersions","addAgentCoreInfra","tree","options","iac","addAgentCoreCDKInfra","addAgentCoreTerraformInfra","config","projectName","dirname","appDirectory","overwriteStrategy","KeepExisting","nameKebabCase","containers","boto3Version","boto3","addMcpServerInfra","nameClassName","mcpServerNameClassName","mcpServerNameKebabCase","dockerImageTag","dockerOutputDir","serverProtocol","auth","addAgentInfra","agentNameClassName","agentNameKebabCase","addAgentCoreGatewayInfra","addAgentCoreGatewayCDKInfra","addAgentCoreGatewayTerraformInfra","gatewayNameClassName","gatewayNameKebabCase","projectDirectory","cedarPolicy","httpxVersion","httpx","mcpVersion","mcp","renderScript","exists","delete"],"mappings":"AAAA;;;CAGC,GACD,SACEA,aAAa,EACbC,iBAAiB,EACjBC,iBAAiB,EAGjBC,UAAU,QACL,aAAa;AACpB,SAASC,aAAa,QAAQ,YAAS;AAGvC,SAASC,OAAO,QAAQ,sBAAmB;AAC3C,SAASC,iCAAiC,QAAQ,WAAQ;AAC1D,SACEC,YAAY,EACZC,qBAAqB,EACrBC,oBAAoB,QACf,oCAAiC;AACxC,SAASC,WAAW,EAAEC,yBAAyB,QAAQ,iBAAc;AAkBrE,MAAMC,oBAAoB,OACxBC,MACAC;IAEA,OAAQA,QAAQC,GAAG;QACjB,KAAK;YACH,MAAMC,qBAAqBH,MAAMC;YACjC;QACF,KAAK;YACHG,2BAA2BJ,MAAMC;YACjC;IACJ;IAEA,qFAAqF;IACrFX,WACEU,MACAZ,kBACEM,cACAO,QAAQC,GAAG,KAAK,QAAQP,wBAAwBC,sBAChD,iBAEF,CAACS;QACCZ,kCACEY,QACA,SACA,GAAGJ,QAAQK,WAAW,CAAC,MAAM,CAAC;QAEhC,OAAOD;IACT;AAEJ;AAEA,MAAMF,uBAAuB,OAC3BH,MACAC;IAEA,sCAAsC;IACtCd,cACEa,MACAZ,kBAAkB,YAAYmB,OAAO,EAAE,SAAS,OAAO,OAAO,eAC9DnB,kBACEM,cACAC,uBACA,OACA,OACAM,QAAQO,YAAY,GAEtB;QAAE,GAAGP,OAAO;QAAE,GAAGT,QAAQQ,KAAK;IAAC,GAC/B;QACES,mBAAmBpB,kBAAkBqB,YAAY;IACnD;IAGF,oCAAoC;IACpC,MAAMnB,cACJS,MACAZ,kBACEM,cACAC,uBACA,OACA,OACAM,QAAQO,YAAY,EACpB,aAEF,CAAC,EAAE,EAAEP,QAAQU,aAAa,CAAC,CAAC,EAAEV,QAAQU,aAAa,CAAC,GAAG,CAAC;IAE1D,MAAMpB,cACJS,MACAZ,kBACEM,cACAC,uBACA,OACA,OACA,aAEF,CAAC,EAAE,EAAEM,QAAQO,YAAY,CAAC,SAAS,CAAC;AAExC;AAEA,MAAMJ,6BAA6B,CACjCJ,MACAC;IAEA,kCAAkC;IAClCd,cACEa,MACAZ,kBACE,YAAYmB,OAAO,EACnB,SACA,aACA,QACA,eAEFnB,kBACEM,cACAE,sBACA,OACA,QACA,eAEF;QACEgB,YAAYX,QAAQW,UAAU;QAC9BC,cAAchB,YAAYiB,KAAK;QAC/B,GAAGhB,2BAA2B;IAChC,GACA;QACEW,mBAAmBpB,kBAAkBqB,YAAY;IACnD;IAGF,iDAAiD;IACjDvB,cACEa,MACAZ,kBACE,YAAYmB,OAAO,EACnB,SACA,aACA,OACA,eAEFnB,kBACEM,cACAE,sBACA,OACA,OACAK,QAAQO,YAAY,GAEtBP,SACA;QACEQ,mBAAmBpB,kBAAkBqB,YAAY;IACnD;AAEJ;AAYA;;CAEC,GACD,OAAO,MAAMK,oBAAoB,OAC/Bf,MACAC;IAEA,MAAMF,kBAAkBC,MAAM;QAC5BgB,eAAef,QAAQgB,sBAAsB;QAC7CN,eAAeV,QAAQiB,sBAAsB;QAC7CC,gBAAgBlB,QAAQkB,cAAc;QACtCC,iBAAiBnB,QAAQmB,eAAe;QACxCd,aAAaL,QAAQK,WAAW;QAChCE,cAAc;QACda,gBAAgB;QAChBnB,KAAKD,QAAQC,GAAG;QAChBoB,MAAMrB,QAAQqB,IAAI;QAClBV,YAAYX,QAAQW,UAAU;IAChC;AACF,EAAE;AAaF;;CAEC,GACD,OAAO,MAAMW,gBAAgB,OAC3BvB,MACAC;IAEA,MAAMF,kBAAkBC,MAAM;QAC5BgB,eAAef,QAAQuB,kBAAkB;QACzCb,eAAeV,QAAQwB,kBAAkB;QACzCnB,aAAaL,QAAQK,WAAW;QAChCa,gBAAgBlB,QAAQkB,cAAc;QACtCC,iBAAiBnB,QAAQmB,eAAe;QACxCZ,cAAc;QACda,gBAAgBpB,QAAQoB,cAAc,IAAI;QAC1CnB,KAAKD,QAAQC,GAAG;QAChBoB,MAAMrB,QAAQqB,IAAI;QAClBV,YAAYX,QAAQW,UAAU;IAChC;AACF,EAAE;AAUF,OAAO,MAAMc,2BAA2B,OACtC1B,MACAC;IAEA,OAAQA,QAAQC,GAAG;QACjB,KAAK;YACH,MAAMyB,4BAA4B3B,MAAMC;YACxC;QACF,KAAK;YACH2B,kCAAkC5B,MAAMC;YACxC;IACJ;IAEAX,WACEU,MACAZ,kBACEM,cACAO,QAAQC,GAAG,KAAK,QAAQP,wBAAwBC,sBAChD,iBAEF,CAACS;QACCZ,kCACEY,QACA,SACA,GAAGJ,QAAQK,WAAW,CAAC,MAAM,CAAC;QAEhC,OAAOD;IACT;AAEJ,EAAE;AAEF,MAAMsB,8BAA8B,OAClC3B,MACAC;IAEA,0EAA0E;IAC1E,kCAAkC;IAClCd,cACEa,MACAZ,kBACE,YAAYmB,OAAO,EACnB,SACA,OACA,QACA,sBAEFnB,kBACEM,cACAC,uBACA,OACA,QACA,sBAEF;QAAE,GAAGH,QAAQQ,KAAK;IAAC,GACnB;QACES,mBAAmBpB,kBAAkBqB,YAAY;IACnD;IAGFvB,cACEa,MACAZ,kBACE,YAAYmB,OAAO,EACnB,SACA,OACA,OACA,sBAEFnB,kBACEM,cACAC,uBACA,OACA,OACA,aAEF;QACEqB,eAAef,QAAQ4B,oBAAoB;QAC3ClB,eAAeV,QAAQ6B,oBAAoB;QAC3CC,kBAAkB9B,QAAQ8B,gBAAgB;QAC1CC,aAAa/B,QAAQ+B,WAAW;QAChC,GAAGxC,QAAQQ,KAAK;IAClB,GACA;QACES,mBAAmBpB,kBAAkBqB,YAAY;IACnD;IAGF,MAAMnB,cACJS,MACAZ,kBACEM,cACAC,uBACA,OACA,QACA,aAEF;IAEF,MAAMJ,cACJS,MACAZ,kBACEM,cACAC,uBACA,OACA,OACA,YACA,aAEF,CAAC,EAAE,EAAEM,QAAQ6B,oBAAoB,CAAC,CAAC,EAAE7B,QAAQ6B,oBAAoB,CAAC,GAAG,CAAC;IAExE,MAAMvC,cACJS,MACAZ,kBACEM,cACAC,uBACA,OACA,OACA,aAEF;AAEJ;AAEA,MAAMiC,oCAAoC,CACxC5B,MACAC;IAEAd,cACEa,MACAZ,kBACE,YAAYmB,OAAO,EACnB,SACA,aACA,QACA,sBAEFnB,kBACEM,cACAE,sBACA,OACA,QACA,sBAEF;QAAE,GAAGE,2BAA2B;IAAC,GACjC;QACEW,mBAAmBpB,kBAAkBqB,YAAY;IACnD;IAGFvB,cACEa,MACAZ,kBACE,YAAYmB,OAAO,EACnB,SACA,aACA,OACA,sBAEFnB,kBACEM,cACAE,sBACA,OACA,OACA,aAEF;QACEoB,eAAef,QAAQ4B,oBAAoB;QAC3ClB,eAAeV,QAAQ6B,oBAAoB;QAC3CC,kBAAkB9B,QAAQ8B,gBAAgB;QAC1CC,aAAa/B,QAAQ+B,WAAW;QAChCnB,cAAchB,YAAYiB,KAAK;QAC/BmB,cAAcpC,YAAYqC,KAAK;QAC/BC,YAAYtC,YAAYuC,GAAG;QAC3B,GAAGtC,2BAA2B;IAChC,GACA;QACEW,mBAAmBpB,kBAAkBqB,YAAY;IACnD;IAGF,mEAAmE;IACnE,IAAI,CAACT,QAAQ+B,WAAW,EAAE;QACxB,MAAMK,eAAejD,kBACnBM,cACAE,sBACA,OACA,OACA,YACAK,QAAQ6B,oBAAoB,EAC5B;QAEF,IAAI9B,KAAKsC,MAAM,CAACD,eAAe;YAC7BrC,KAAKuC,MAAM,CAACF;QACd;IACF;AACF"}
+{"version":3,"sources":["../../../../../../packages/nx-plugin/src/utils/agent-core-constructs/agent-core-constructs.ts"],"sourcesContent":["/**\n * Copyright Amazon.com, Inc. or its affiliates. All Rights Reserved.\n * SPDX-License-Identifier: Apache-2.0\n */\nimport {\n  generateFiles,\n  joinPathFragments,\n  OverwriteStrategy,\n  type ProjectConfiguration,\n  type Tree,\n  updateJson,\n} from '@nx/devkit';\nimport { addStarExport } from '../ast';\nimport type { Containers } from '../containers';\nimport type { Iac } from '../iac';\nimport { esmVars } from '../module-format';\nimport { addDependencyToTargetIfNotPresent } from '../nx';\nimport {\n  PACKAGES_DIR,\n  SHARED_CONSTRUCTS_DIR,\n  SHARED_TERRAFORM_DIR,\n} from '../shared-constructs-constants';\nimport { PY_VERSIONS, terraformProviderVersions } from '../versions';\n\ntype IACProvider = { iac: Iac };\n\nexport type AgentCoreAuth = 'iam' | 'cognito';\n\nexport interface AddAgentCoreInfraProps {\n  nameClassName: string;\n  nameKebabCase: string;\n  projectName: string;\n  dockerImageTag: string;\n  dockerOutputDir: string;\n  appDirectory: string;\n  serverProtocol: 'mcp' | 'http' | 'a2a';\n  auth: AgentCoreAuth;\n  containers: Containers;\n}\n\nconst addAgentCoreInfra = async (\n  tree: Tree,\n  options: AddAgentCoreInfraProps & { iac: Iac },\n) => {\n  switch (options.iac) {\n    case 'cdk':\n      await addAgentCoreCDKInfra(tree, options);\n      break;\n    case 'terraform':\n      addAgentCoreTerraformInfra(tree, options);\n      break;\n  }\n\n  // Update shared constructs/terraform project configuration to depend on this project\n  updateJson(\n    tree,\n    joinPathFragments(\n      PACKAGES_DIR,\n      options.iac === 'cdk' ? SHARED_CONSTRUCTS_DIR : SHARED_TERRAFORM_DIR,\n      'project.json',\n    ),\n    (config: ProjectConfiguration) => {\n      addDependencyToTargetIfNotPresent(\n        config,\n        'build',\n        `${options.projectName}:build`,\n      );\n      return config;\n    },\n  );\n};\n\nconst addAgentCoreCDKInfra = async (\n  tree: Tree,\n  options: AddAgentCoreInfraProps,\n) => {\n  // Generate app specific CDK construct\n  generateFiles(\n    tree,\n    joinPathFragments(import.meta.dirname, 'files', 'cdk', 'app', 'agent-core'),\n    joinPathFragments(\n      PACKAGES_DIR,\n      SHARED_CONSTRUCTS_DIR,\n      'src',\n      'app',\n      options.appDirectory,\n    ),\n    { ...options, ...esmVars(tree) },\n    {\n      overwriteStrategy: OverwriteStrategy.KeepExisting,\n    },\n  );\n\n  // Export app specific CDK construct\n  await addStarExport(\n    tree,\n    joinPathFragments(\n      PACKAGES_DIR,\n      SHARED_CONSTRUCTS_DIR,\n      'src',\n      'app',\n      options.appDirectory,\n      'index.ts',\n    ),\n    `./${options.nameKebabCase}/${options.nameKebabCase}.js`,\n  );\n  await addStarExport(\n    tree,\n    joinPathFragments(\n      PACKAGES_DIR,\n      SHARED_CONSTRUCTS_DIR,\n      'src',\n      'app',\n      'index.ts',\n    ),\n    `./${options.appDirectory}/index.js`,\n  );\n};\n\nconst addAgentCoreTerraformInfra = (\n  tree: Tree,\n  options: AddAgentCoreInfraProps,\n) => {\n  // Add the AgentCore shared module\n  generateFiles(\n    tree,\n    joinPathFragments(\n      import.meta.dirname,\n      'files',\n      'terraform',\n      'core',\n      'agent-core',\n    ),\n    joinPathFragments(\n      PACKAGES_DIR,\n      SHARED_TERRAFORM_DIR,\n      'src',\n      'core',\n      'agent-core',\n    ),\n    {\n      containers: options.containers,\n      boto3Version: PY_VERSIONS.boto3,\n      ...terraformProviderVersions(),\n    },\n    {\n      overwriteStrategy: OverwriteStrategy.KeepExisting,\n    },\n  );\n\n  // Generate app specific agent core configuration\n  generateFiles(\n    tree,\n    joinPathFragments(\n      import.meta.dirname,\n      'files',\n      'terraform',\n      'app',\n      'agent-core',\n    ),\n    joinPathFragments(\n      PACKAGES_DIR,\n      SHARED_TERRAFORM_DIR,\n      'src',\n      'app',\n      options.appDirectory,\n    ),\n    options,\n    {\n      overwriteStrategy: OverwriteStrategy.KeepExisting,\n    },\n  );\n};\n\nexport interface AddMcpServerInfraProps {\n  mcpServerNameClassName: string;\n  mcpServerNameKebabCase: string;\n  projectName: string;\n  dockerImageTag: string;\n  dockerOutputDir: string;\n  auth: AgentCoreAuth;\n  containers: Containers;\n}\n\n/**\n * Add an MCP server CDK construct\n */\nexport const addMcpServerInfra = async (\n  tree: Tree,\n  options: AddMcpServerInfraProps & IACProvider,\n) => {\n  await addAgentCoreInfra(tree, {\n    nameClassName: options.mcpServerNameClassName,\n    nameKebabCase: options.mcpServerNameKebabCase,\n    dockerImageTag: options.dockerImageTag,\n    dockerOutputDir: options.dockerOutputDir,\n    projectName: options.projectName,\n    appDirectory: 'mcp-servers',\n    serverProtocol: 'mcp',\n    iac: options.iac,\n    auth: options.auth,\n    containers: options.containers,\n  });\n};\n\nexport interface AddAgentInfraProps {\n  agentNameClassName: string;\n  agentNameKebabCase: string;\n  projectName: string;\n  dockerImageTag: string;\n  dockerOutputDir: string;\n  auth: AgentCoreAuth;\n  serverProtocol?: 'http' | 'a2a';\n  containers: Containers;\n}\n\n/**\n * Add an agent CDK construct\n */\nexport const addAgentInfra = async (\n  tree: Tree,\n  options: AddAgentInfraProps & IACProvider,\n) => {\n  await addAgentCoreInfra(tree, {\n    nameClassName: options.agentNameClassName,\n    nameKebabCase: options.agentNameKebabCase,\n    projectName: options.projectName,\n    dockerImageTag: options.dockerImageTag,\n    dockerOutputDir: options.dockerOutputDir,\n    appDirectory: 'agents',\n    serverProtocol: options.serverProtocol ?? 'http',\n    iac: options.iac,\n    auth: options.auth,\n    containers: options.containers,\n  });\n};\n\nexport interface AddAgentCoreGatewayInfraProps {\n  gatewayNameClassName: string;\n  gatewayNameKebabCase: string;\n  projectName: string;\n  projectDirectory: string;\n  cedarPolicy: boolean;\n  auth: AgentCoreAuth;\n}\n\nexport const addAgentCoreGatewayInfra = async (\n  tree: Tree,\n  options: AddAgentCoreGatewayInfraProps & IACProvider,\n) => {\n  switch (options.iac) {\n    case 'cdk':\n      await addAgentCoreGatewayCDKInfra(tree, options);\n      break;\n    case 'terraform':\n      addAgentCoreGatewayTerraformInfra(tree, options);\n      break;\n  }\n\n  updateJson(\n    tree,\n    joinPathFragments(\n      PACKAGES_DIR,\n      options.iac === 'cdk' ? SHARED_CONSTRUCTS_DIR : SHARED_TERRAFORM_DIR,\n      'project.json',\n    ),\n    (config: ProjectConfiguration) => {\n      addDependencyToTargetIfNotPresent(\n        config,\n        'build',\n        `${options.projectName}:build`,\n      );\n      return config;\n    },\n  );\n};\n\nconst addAgentCoreGatewayCDKInfra = async (\n  tree: Tree,\n  options: AddAgentCoreGatewayInfraProps,\n) => {\n  // Generic gateway construct (readiness probe, policy engine, Cedar policy\n  // loading) shared by all gateways\n  generateFiles(\n    tree,\n    joinPathFragments(\n      import.meta.dirname,\n      'files',\n      'cdk',\n      'core',\n      'agentcore-gateway',\n    ),\n    joinPathFragments(\n      PACKAGES_DIR,\n      SHARED_CONSTRUCTS_DIR,\n      'src',\n      'core',\n      'agentcore-gateway',\n    ),\n    { ...esmVars(tree) },\n    {\n      overwriteStrategy: OverwriteStrategy.KeepExisting,\n    },\n  );\n\n  generateFiles(\n    tree,\n    joinPathFragments(\n      import.meta.dirname,\n      'files',\n      'cdk',\n      'app',\n      'agentcore-gateway',\n    ),\n    joinPathFragments(\n      PACKAGES_DIR,\n      SHARED_CONSTRUCTS_DIR,\n      'src',\n      'app',\n      'gateways',\n    ),\n    {\n      nameClassName: options.gatewayNameClassName,\n      nameKebabCase: options.gatewayNameKebabCase,\n      projectDirectory: options.projectDirectory,\n      cedarPolicy: options.cedarPolicy,\n      auth: options.auth,\n      ...esmVars(tree),\n    },\n    {\n      overwriteStrategy: OverwriteStrategy.KeepExisting,\n    },\n  );\n\n  await addStarExport(\n    tree,\n    joinPathFragments(\n      PACKAGES_DIR,\n      SHARED_CONSTRUCTS_DIR,\n      'src',\n      'core',\n      'index.ts',\n    ),\n    './agentcore-gateway/agentcore-gateway.js',\n  );\n  await addStarExport(\n    tree,\n    joinPathFragments(\n      PACKAGES_DIR,\n      SHARED_CONSTRUCTS_DIR,\n      'src',\n      'app',\n      'gateways',\n      'index.ts',\n    ),\n    `./${options.gatewayNameKebabCase}/${options.gatewayNameKebabCase}.js`,\n  );\n  await addStarExport(\n    tree,\n    joinPathFragments(\n      PACKAGES_DIR,\n      SHARED_CONSTRUCTS_DIR,\n      'src',\n      'app',\n      'index.ts',\n    ),\n    './gateways/index.js',\n  );\n};\n\nconst addAgentCoreGatewayTerraformInfra = (\n  tree: Tree,\n  options: AddAgentCoreGatewayInfraProps,\n) => {\n  generateFiles(\n    tree,\n    joinPathFragments(\n      import.meta.dirname,\n      'files',\n      'terraform',\n      'core',\n      'agentcore-gateway',\n    ),\n    joinPathFragments(\n      PACKAGES_DIR,\n      SHARED_TERRAFORM_DIR,\n      'src',\n      'core',\n      'agentcore-gateway',\n    ),\n    { ...terraformProviderVersions() },\n    {\n      overwriteStrategy: OverwriteStrategy.KeepExisting,\n    },\n  );\n\n  generateFiles(\n    tree,\n    joinPathFragments(\n      import.meta.dirname,\n      'files',\n      'terraform',\n      'app',\n      'agentcore-gateway',\n    ),\n    joinPathFragments(\n      PACKAGES_DIR,\n      SHARED_TERRAFORM_DIR,\n      'src',\n      'app',\n      'gateways',\n    ),\n    {\n      nameClassName: options.gatewayNameClassName,\n      nameKebabCase: options.gatewayNameKebabCase,\n      projectDirectory: options.projectDirectory,\n      cedarPolicy: options.cedarPolicy,\n      auth: options.auth,\n      boto3Version: PY_VERSIONS.boto3,\n      httpxVersion: PY_VERSIONS.httpx,\n      mcpVersion: PY_VERSIONS.mcp,\n      ...terraformProviderVersions(),\n    },\n    {\n      overwriteStrategy: OverwriteStrategy.KeepExisting,\n    },\n  );\n\n  // The Cedar render script is only needed when policies are enabled\n  if (!options.cedarPolicy) {\n    const renderScript = joinPathFragments(\n      PACKAGES_DIR,\n      SHARED_TERRAFORM_DIR,\n      'src',\n      'app',\n      'gateways',\n      options.gatewayNameKebabCase,\n      'render-cedar.cjs',\n    );\n    if (tree.exists(renderScript)) {\n      tree.delete(renderScript);\n    }\n  }\n};\n"],"names":["generateFiles","joinPathFragments","OverwriteStrategy","updateJson","addStarExport","esmVars","addDependencyToTargetIfNotPresent","PACKAGES_DIR","SHARED_CONSTRUCTS_DIR","SHARED_TERRAFORM_DIR","PY_VERSIONS","terraformProviderVersions","addAgentCoreInfra","tree","options","iac","addAgentCoreCDKInfra","addAgentCoreTerraformInfra","config","projectName","dirname","appDirectory","overwriteStrategy","KeepExisting","nameKebabCase","containers","boto3Version","boto3","addMcpServerInfra","nameClassName","mcpServerNameClassName","mcpServerNameKebabCase","dockerImageTag","dockerOutputDir","serverProtocol","auth","addAgentInfra","agentNameClassName","agentNameKebabCase","addAgentCoreGatewayInfra","addAgentCoreGatewayCDKInfra","addAgentCoreGatewayTerraformInfra","gatewayNameClassName","gatewayNameKebabCase","projectDirectory","cedarPolicy","httpxVersion","httpx","mcpVersion","mcp","renderScript","exists","delete"],"mappings":"AAAA;;;CAGC,GACD,SACEA,aAAa,EACbC,iBAAiB,EACjBC,iBAAiB,EAGjBC,UAAU,QACL,aAAa;AACpB,SAASC,aAAa,QAAQ,YAAS;AAGvC,SAASC,OAAO,QAAQ,sBAAmB;AAC3C,SAASC,iCAAiC,QAAQ,WAAQ;AAC1D,SACEC,YAAY,EACZC,qBAAqB,EACrBC,oBAAoB,QACf,oCAAiC;AACxC,SAASC,WAAW,EAAEC,yBAAyB,QAAQ,iBAAc;AAkBrE,MAAMC,oBAAoB,OACxBC,MACAC;IAEA,OAAQA,QAAQC,GAAG;QACjB,KAAK;YACH,MAAMC,qBAAqBH,MAAMC;YACjC;QACF,KAAK;YACHG,2BAA2BJ,MAAMC;YACjC;IACJ;IAEA,qFAAqF;IACrFX,WACEU,MACAZ,kBACEM,cACAO,QAAQC,GAAG,KAAK,QAAQP,wBAAwBC,sBAChD,iBAEF,CAACS;QACCZ,kCACEY,QACA,SACA,GAAGJ,QAAQK,WAAW,CAAC,MAAM,CAAC;QAEhC,OAAOD;IACT;AAEJ;AAEA,MAAMF,uBAAuB,OAC3BH,MACAC;IAEA,sCAAsC;IACtCd,cACEa,MACAZ,kBAAkB,YAAYmB,OAAO,EAAE,SAAS,OAAO,OAAO,eAC9DnB,kBACEM,cACAC,uBACA,OACA,OACAM,QAAQO,YAAY,GAEtB;QAAE,GAAGP,OAAO;QAAE,GAAGT,QAAQQ,KAAK;IAAC,GAC/B;QACES,mBAAmBpB,kBAAkBqB,YAAY;IACnD;IAGF,oCAAoC;IACpC,MAAMnB,cACJS,MACAZ,kBACEM,cACAC,uBACA,OACA,OACAM,QAAQO,YAAY,EACpB,aAEF,CAAC,EAAE,EAAEP,QAAQU,aAAa,CAAC,CAAC,EAAEV,QAAQU,aAAa,CAAC,GAAG,CAAC;IAE1D,MAAMpB,cACJS,MACAZ,kBACEM,cACAC,uBACA,OACA,OACA,aAEF,CAAC,EAAE,EAAEM,QAAQO,YAAY,CAAC,SAAS,CAAC;AAExC;AAEA,MAAMJ,6BAA6B,CACjCJ,MACAC;IAEA,kCAAkC;IAClCd,cACEa,MACAZ,kBACE,YAAYmB,OAAO,EACnB,SACA,aACA,QACA,eAEFnB,kBACEM,cACAE,sBACA,OACA,QACA,eAEF;QACEgB,YAAYX,QAAQW,UAAU;QAC9BC,cAAchB,YAAYiB,KAAK;QAC/B,GAAGhB,2BAA2B;IAChC,GACA;QACEW,mBAAmBpB,kBAAkBqB,YAAY;IACnD;IAGF,iDAAiD;IACjDvB,cACEa,MACAZ,kBACE,YAAYmB,OAAO,EACnB,SACA,aACA,OACA,eAEFnB,kBACEM,cACAE,sBACA,OACA,OACAK,QAAQO,YAAY,GAEtBP,SACA;QACEQ,mBAAmBpB,kBAAkBqB,YAAY;IACnD;AAEJ;AAYA;;CAEC,GACD,OAAO,MAAMK,oBAAoB,OAC/Bf,MACAC;IAEA,MAAMF,kBAAkBC,MAAM;QAC5BgB,eAAef,QAAQgB,sBAAsB;QAC7CN,eAAeV,QAAQiB,sBAAsB;QAC7CC,gBAAgBlB,QAAQkB,cAAc;QACtCC,iBAAiBnB,QAAQmB,eAAe;QACxCd,aAAaL,QAAQK,WAAW;QAChCE,cAAc;QACda,gBAAgB;QAChBnB,KAAKD,QAAQC,GAAG;QAChBoB,MAAMrB,QAAQqB,IAAI;QAClBV,YAAYX,QAAQW,UAAU;IAChC;AACF,EAAE;AAaF;;CAEC,GACD,OAAO,MAAMW,gBAAgB,OAC3BvB,MACAC;IAEA,MAAMF,kBAAkBC,MAAM;QAC5BgB,eAAef,QAAQuB,kBAAkB;QACzCb,eAAeV,QAAQwB,kBAAkB;QACzCnB,aAAaL,QAAQK,WAAW;QAChCa,gBAAgBlB,QAAQkB,cAAc;QACtCC,iBAAiBnB,QAAQmB,eAAe;QACxCZ,cAAc;QACda,gBAAgBpB,QAAQoB,cAAc,IAAI;QAC1CnB,KAAKD,QAAQC,GAAG;QAChBoB,MAAMrB,QAAQqB,IAAI;QAClBV,YAAYX,QAAQW,UAAU;IAChC;AACF,EAAE;AAWF,OAAO,MAAMc,2BAA2B,OACtC1B,MACAC;IAEA,OAAQA,QAAQC,GAAG;QACjB,KAAK;YACH,MAAMyB,4BAA4B3B,MAAMC;YACxC;QACF,KAAK;YACH2B,kCAAkC5B,MAAMC;YACxC;IACJ;IAEAX,WACEU,MACAZ,kBACEM,cACAO,QAAQC,GAAG,KAAK,QAAQP,wBAAwBC,sBAChD,iBAEF,CAACS;QACCZ,kCACEY,QACA,SACA,GAAGJ,QAAQK,WAAW,CAAC,MAAM,CAAC;QAEhC,OAAOD;IACT;AAEJ,EAAE;AAEF,MAAMsB,8BAA8B,OAClC3B,MACAC;IAEA,0EAA0E;IAC1E,kCAAkC;IAClCd,cACEa,MACAZ,kBACE,YAAYmB,OAAO,EACnB,SACA,OACA,QACA,sBAEFnB,kBACEM,cACAC,uBACA,OACA,QACA,sBAEF;QAAE,GAAGH,QAAQQ,KAAK;IAAC,GACnB;QACES,mBAAmBpB,kBAAkBqB,YAAY;IACnD;IAGFvB,cACEa,MACAZ,kBACE,YAAYmB,OAAO,EACnB,SACA,OACA,OACA,sBAEFnB,kBACEM,cACAC,uBACA,OACA,OACA,aAEF;QACEqB,eAAef,QAAQ4B,oBAAoB;QAC3ClB,eAAeV,QAAQ6B,oBAAoB;QAC3CC,kBAAkB9B,QAAQ8B,gBAAgB;QAC1CC,aAAa/B,QAAQ+B,WAAW;QAChCV,MAAMrB,QAAQqB,IAAI;QAClB,GAAG9B,QAAQQ,KAAK;IAClB,GACA;QACES,mBAAmBpB,kBAAkBqB,YAAY;IACnD;IAGF,MAAMnB,cACJS,MACAZ,kBACEM,cACAC,uBACA,OACA,QACA,aAEF;IAEF,MAAMJ,cACJS,MACAZ,kBACEM,cACAC,uBACA,OACA,OACA,YACA,aAEF,CAAC,EAAE,EAAEM,QAAQ6B,oBAAoB,CAAC,CAAC,EAAE7B,QAAQ6B,oBAAoB,CAAC,GAAG,CAAC;IAExE,MAAMvC,cACJS,MACAZ,kBACEM,cACAC,uBACA,OACA,OACA,aAEF;AAEJ;AAEA,MAAMiC,oCAAoC,CACxC5B,MACAC;IAEAd,cACEa,MACAZ,kBACE,YAAYmB,OAAO,EACnB,SACA,aACA,QACA,sBAEFnB,kBACEM,cACAE,sBACA,OACA,QACA,sBAEF;QAAE,GAAGE,2BAA2B;IAAC,GACjC;QACEW,mBAAmBpB,kBAAkBqB,YAAY;IACnD;IAGFvB,cACEa,MACAZ,kBACE,YAAYmB,OAAO,EACnB,SACA,aACA,OACA,sBAEFnB,kBACEM,cACAE,sBACA,OACA,OACA,aAEF;QACEoB,eAAef,QAAQ4B,oBAAoB;QAC3ClB,eAAeV,QAAQ6B,oBAAoB;QAC3CC,kBAAkB9B,QAAQ8B,gBAAgB;QAC1CC,aAAa/B,QAAQ+B,WAAW;QAChCV,MAAMrB,QAAQqB,IAAI;QAClBT,cAAchB,YAAYiB,KAAK;QAC/BmB,cAAcpC,YAAYqC,KAAK;QAC/BC,YAAYtC,YAAYuC,GAAG;QAC3B,GAAGtC,2BAA2B;IAChC,GACA;QACEW,mBAAmBpB,kBAAkBqB,YAAY;IACnD;IAGF,mEAAmE;IACnE,IAAI,CAACT,QAAQ+B,WAAW,EAAE;QACxB,MAAMK,eAAejD,kBACnBM,cACAE,sBACA,OACA,OACA,YACAK,QAAQ6B,oBAAoB,EAC5B;QAEF,IAAI9B,KAAKsC,MAAM,CAACD,eAAe;YAC7BrC,KAAKuC,MAAM,CAACF;QACd;IACF;AACF"}

package/src/utils/agent-core-constructs/files/cdk/app/agentcore-gateway/__nameKebabCase__/__nameKebabCase__.ts.template

@@ -3,6 +3,10 @@ import { Construct } from 'constructs';
 import * as path from 'node:path';
 import * as url from 'node:url';
 <%_ } _%>
+<%_ if (auth === 'cognito') { _%>
+import { GatewayAuthorizer } from 'aws-cdk-lib/aws-bedrockagentcore';
+import { IUserPool, IUserPoolClient } from 'aws-cdk-lib/aws-cognito';
+<%_ } _%>
 import {
   AgentCoreGateway,
   AgentCoreGatewayProps,
@@ -12,14 +16,28 @@ import { RuntimeConfig } from '../../../core/runtime-config<% if (esm) { %>.js<%
 import { findWorkspaceRoot } from '../../../core/workspace<% if (esm) { %>.js<% } %>';
 <%_ } _%>
 
-<%_ if (cedarPolicy) { _%>
+<%_ if (auth === 'cognito') { _%>
+export type <%- nameClassName %>Props = Omit<
+  AgentCoreGatewayProps,
+  <%_ if (cedarPolicy) { _%>'cedarPolicyPath' | <%_ } _%>'authorizer'
+> & {
+  /**
+   * Identity details for Cognito authentication. Callers authenticate with a
+   * JWT bearer token issued by this user pool.
+   */
+  identity: {
+    userPool: IUserPool;
+    userPoolClient: IUserPoolClient;
+  };
+};
+<%_ } else if (cedarPolicy) { _%>
 export type <%- nameClassName %>Props = Omit<AgentCoreGatewayProps, 'cedarPolicyPath'>;
 <%_ } else { _%>
 export type <%- nameClassName %>Props = AgentCoreGatewayProps;
 <%_ } _%>
 
 /**
- * AgentCore Gateway wired for MCP protocol with IAM inbound auth.
+ * AgentCore Gateway wired for MCP protocol with <%- auth === 'cognito' ? 'Cognito (JWT)' : 'IAM' %> inbound auth.
 <%_ if (cedarPolicy) { _%>
  *
  * Cedar policies are loaded from the gateway project's policies/ directory
@@ -30,7 +48,23 @@ export class <%- nameClassName %> extends AgentCoreGateway {
   /** Default Gateway target name when added to another Gateway. */
   public readonly gatewayName = '<%- nameKebabCase %>';
 
-  constructor(scope: Construct, id: string, props?: <%- nameClassName %>Props) {
+  constructor(scope: Construct, id: string, props<%_ if (auth !== 'cognito') { _%>?<%_ } _%>: <%- nameClassName %>Props) {
+<%_ if (auth === 'cognito') { _%>
+    const { identity, ...restProps } = props;
+    super(scope, id, {
+<%_ if (cedarPolicy) { _%>
+      cedarPolicyPath: path.join(
+        findWorkspaceRoot(url.fileURLToPath(new URL(<% if (esm) { %>import.meta.url<% } else { %>require('url').pathToFileURL(__filename).href<% } %>))),
+        '<%- projectDirectory %>/policies',
+      ),
+<%_ } _%>
+      authorizer: GatewayAuthorizer.usingCognito({
+        userPool: identity.userPool,
+        allowedClients: [identity.userPoolClient],
+      }),
+      ...restProps,
+    });
+<%_ } else { _%>
     super(scope, id, {
 <%_ if (cedarPolicy) { _%>
       cedarPolicyPath: path.join(
@@ -40,6 +74,7 @@ export class <%- nameClassName %> extends AgentCoreGateway {
 <%_ } _%>
       ...props,
     });
+<%_ } _%>
 
     const rc = RuntimeConfig.ensure(this);
     rc.set('agentcore', 'gateways', {

package/src/utils/agent-core-constructs/files/cdk/core/agentcore-gateway/agentcore-gateway.ts.template

@@ -34,11 +34,20 @@ export interface AgentCoreGatewayProps {
    * @default true
    */
   readonly enableWaf?: boolean;
+  /**
+   * Inbound authorizer for the gateway. Defaults to IAM (SigV4) authentication;
+   * pass `GatewayAuthorizer.usingCognito(...)` or `usingCustomJwt(...)` to
+   * authenticate callers with JWT bearer tokens instead.
+   *
+   * @default GatewayAuthorizer.usingAwsIam()
+   */
+  readonly authorizer?: agentcore.IGatewayAuthorizerConfig;
 }
 
 /**
- * AgentCore Gateway wired for MCP protocol with IAM inbound auth, exposing
- * attached MCP servers' tools under `<targetName>___<toolName>` names.
+ * AgentCore Gateway wired for MCP protocol, exposing attached MCP servers'
+ * tools under `<targetName>___<toolName>` names. Inbound auth defaults to IAM
+ * (SigV4); pass an `authorizer` to use Cognito/JWT instead.
  */
 export class AgentCoreGateway extends Construct implements iam.IGrantable {
   public readonly gateway: agentcore.Gateway;
@@ -60,7 +69,8 @@ export class AgentCoreGateway extends Construct implements iam.IGrantable {
         searchType: agentcore.McpGatewaySearchType.SEMANTIC,
         supportedVersions: [agentcore.MCPProtocolVersion.MCP_2025_03_26],
       }),
-      authorizerConfiguration: agentcore.GatewayAuthorizer.usingAwsIam(),
+      authorizerConfiguration:
+        props?.authorizer ?? agentcore.GatewayAuthorizer.usingAwsIam(),
     });
 
     if (props?.cedarPolicyPath) {

package/src/utils/agent-core-constructs/files/terraform/app/agentcore-gateway/__nameKebabCase__/__nameKebabCase__.tf.template

@@ -40,6 +40,18 @@ variable "enable_waf" {
   type        = bool
   default     = true
 }
+<%_ if (auth === 'cognito') { _%>
+
+variable "user_pool_id" {
+  description = "ID of the Cognito user pool used to authenticate inbound requests to the gateway."
+  type        = string
+}
+
+variable "user_pool_client_ids" {
+  description = "IDs of the Cognito user pool clients allowed to authenticate inbound requests to the gateway."
+  type        = list(string)
+}
+<%_ } _%>
 <%_ if (cedarPolicy) { _%>
 
 variable "policy_dependencies" {
@@ -161,7 +173,16 @@ resource "aws_bedrockagentcore_gateway" "this" {
     }
   }
 
-  authorizer_type = "AWS_IAM"
+  authorizer_type = "<%- auth === 'cognito' ? 'CUSTOM_JWT' : 'AWS_IAM' %>"
+<%_ if (auth === 'cognito') { _%>
+
+  authorizer_configuration {
+    custom_jwt_authorizer {
+      discovery_url   = "https://cognito-idp.${local.aws_region}.amazonaws.com/${var.user_pool_id}/.well-known/openid-configuration"
+      allowed_clients = var.user_pool_client_ids
+    }
+  }
+<%_ } _%>
 <%_ if (cedarPolicy) { _%>
 
   policy_engine_configuration {

package/src/utils/commands.js

@@ -52,7 +52,7 @@ export const PACKAGE_MANAGER_COMMANDS = {
         case 'npm':
             return `npm install --legacy-peer-deps ${dev ? '-D ' : ''}${pkg}`;
         case 'bun':
-            return `bun install ${dev ? '-D ' : ''}${pkg}`;
+            return `bun add ${dev ? '-D ' : ''}${pkg}`;
         default:
             return `${pm} install ${dev ? '-D ' : ''}${pkg}`;
     }

package/src/utils/commands.js.map

@@ -1 +1 @@
-{"version":3,"sources":["../../../../../packages/nx-plugin/src/utils/commands.ts"],"sourcesContent":["/**\n * Copyright Amazon.com, Inc. or its affiliates. All Rights Reserved.\n * SPDX-License-Identifier: Apache-2.0\n */\nimport { TS_VERSIONS } from './versions';\n\n/**\n * The nx version the plugin is built against. Commands that download nx\n * (e.g. `nx init`) pin to this version so the workspace's nx matches the\n * plugin's `@nx/*` packages — a mismatch deadlocks `nx sync`.\n */\nexport const NX_VERSION = TS_VERSIONS['@nx/devkit'];\n\n/**\n * Display-friendly command prefixes for each package manager.\n *\n * - `exec`: prefix for running local binaries (e.g. `npx nx`, `pnpm nx`, `bunx nx`)\n * - `run`: prefix for running package.json scripts (e.g. `npm run build`, `pnpm build`)\n *\n * @see docs/src/components/package-manager-exec-command.astro\n * @see docs/src/components/package-manager-short-command.astro\n */\nexport interface PackageManagerDisplayCommands {\n  /** Prefix for running local binaries: npx, pnpm, yarn, bunx */\n  exec: string;\n  /** Prefix for running package.json scripts: `npm run`, pnpm, yarn, bun */\n  run: string;\n  /** Prefix for `create` commands: `npm create`, `pnpm create`, etc. */\n  create: string;\n}\n\nexport const PACKAGE_MANAGER_COMMANDS: Record<\n  string,\n  PackageManagerDisplayCommands\n> = {\n  npm: { exec: 'npx', run: 'npm run', create: 'npm create' },\n  pnpm: { exec: 'pnpm', run: 'pnpm', create: 'pnpm create' },\n  yarn: { exec: 'yarn', run: 'yarn', create: 'yarn create' },\n  bun: { exec: 'bunx', run: 'bun', create: 'bun create' },\n};\n\n/**\n * Build a package manager exec command (e.g. pnpm cmd, npx cmd, bunx cmd)\n */\nexport const buildPackageManagerExecCommand = (pm: string, command: string) => {\n  const prefix = PACKAGE_MANAGER_COMMANDS[pm]?.exec ?? pm;\n  return `${prefix} ${command}`;\n};\n\n/**\n * Build a short package manager command (e.g. pnpm build, npm run build)\n */\nexport const buildPackageManagerShortCommand = (\n  pm: string,\n  command: string,\n) => {\n  const prefix = PACKAGE_MANAGER_COMMANDS[pm]?.run ?? pm;\n  return `${prefix} ${command}`;\n};\n\n/**\n * Build an install command for a given package manager\n */\nexport const buildInstallCommand = (pm: string, pkg: string, dev: boolean) => {\n  switch (pm) {\n    case 'pnpm':\n      return `pnpm add ${dev ? '-D' : '-'}w ${pkg}`;\n    case 'yarn':\n      return `yarn add ${dev ? '-D ' : ''}${pkg}`;\n    case 'npm':\n      return `npm install --legacy-peer-deps ${dev ? '-D ' : ''}${pkg}`;\n    case 'bun':\n      return `bun install ${dev ? '-D ' : ''}${pkg}`;\n    default:\n      return `${pm} install ${dev ? '-D ' : ''}${pkg}`;\n  }\n};\n\n/**\n * Build the command that adds Nx to a non-Nx project, pinned to the nx\n * version the plugin is built against.\n */\nexport const buildNxInitCommand = (pm: string) => {\n  const dlxPrefix =\n    { npm: 'npx', pnpm: 'pnpm dlx', yarn: 'yarn dlx', bun: 'bunx' }[pm] ??\n    'npx';\n  return `${dlxPrefix} nx@${NX_VERSION} init`;\n};\n\n/**\n * Build a command to create a new workspace using @aws/create-nx-workspace.\n *\n * Uses the `create` shorthand for each package manager:\n *   npm create @aws/nx-workspace my-project\n *   pnpm create @aws/nx-workspace my-project\n *   yarn create @aws/nx-workspace my-project\n *   bun create @aws/nx-workspace my-project\n *\n * The package manager is auto-detected by @aws/create-nx-workspace from the\n * invoking command, so --pm is not needed.\n */\nexport const buildCreateNxWorkspaceCommand = (\n  pm: string,\n  workspace: string,\n  iac?: 'cdk' | 'terraform',\n  tag?: string,\n  module?: 'esm' | 'cjs',\n) => {\n  const createPrefix = PACKAGE_MANAGER_COMMANDS[pm]?.create ?? `${pm} create`;\n  const pkgName = tag ? `@aws/nx-workspace@${tag}` : '@aws/nx-workspace';\n  const parts = [\n    createPrefix,\n    pkgName,\n    // npm requires '--' to stop interpreting subsequent flags as npm config\n    ...(pm === 'npm' ? ['--'] : []),\n    workspace,\n    ...(iac ? [`--iac=${iac}`] : []),\n    ...(module ? [`--module=${module}`] : []),\n  ];\n  return parts.join(' ');\n};\n"],"names":["TS_VERSIONS","NX_VERSION","PACKAGE_MANAGER_COMMANDS","npm","exec","run","create","pnpm","yarn","bun","buildPackageManagerExecCommand","pm","command","prefix","buildPackageManagerShortCommand","buildInstallCommand","pkg","dev","buildNxInitCommand","dlxPrefix","buildCreateNxWorkspaceCommand","workspace","iac","tag","module","createPrefix","pkgName","parts","join"],"mappings":"AAAA;;;CAGC,GACD,SAASA,WAAW,QAAQ,gBAAa;AAEzC;;;;CAIC,GACD,OAAO,MAAMC,aAAaD,WAAW,CAAC,aAAa,CAAC;AAoBpD,OAAO,MAAME,2BAGT;IACFC,KAAK;QAAEC,MAAM;QAAOC,KAAK;QAAWC,QAAQ;IAAa;IACzDC,MAAM;QAAEH,MAAM;QAAQC,KAAK;QAAQC,QAAQ;IAAc;IACzDE,MAAM;QAAEJ,MAAM;QAAQC,KAAK;QAAQC,QAAQ;IAAc;IACzDG,KAAK;QAAEL,MAAM;QAAQC,KAAK;QAAOC,QAAQ;IAAa;AACxD,EAAE;AAEF;;CAEC,GACD,OAAO,MAAMI,iCAAiC,CAACC,IAAYC;IACzD,MAAMC,SAASX,wBAAwB,CAACS,GAAG,EAAEP,QAAQO;IACrD,OAAO,GAAGE,OAAO,CAAC,EAAED,SAAS;AAC/B,EAAE;AAEF;;CAEC,GACD,OAAO,MAAME,kCAAkC,CAC7CH,IACAC;IAEA,MAAMC,SAASX,wBAAwB,CAACS,GAAG,EAAEN,OAAOM;IACpD,OAAO,GAAGE,OAAO,CAAC,EAAED,SAAS;AAC/B,EAAE;AAEF;;CAEC,GACD,OAAO,MAAMG,sBAAsB,CAACJ,IAAYK,KAAaC;IAC3D,OAAQN;QACN,KAAK;YACH,OAAO,CAAC,SAAS,EAAEM,MAAM,OAAO,IAAI,EAAE,EAAED,KAAK;QAC/C,KAAK;YACH,OAAO,CAAC,SAAS,EAAEC,MAAM,QAAQ,KAAKD,KAAK;QAC7C,KAAK;YACH,OAAO,CAAC,+BAA+B,EAAEC,MAAM,QAAQ,KAAKD,KAAK;QACnE,KAAK;YACH,OAAO,CAAC,YAAY,EAAEC,MAAM,QAAQ,KAAKD,KAAK;QAChD;YACE,OAAO,GAAGL,GAAG,SAAS,EAAEM,MAAM,QAAQ,KAAKD,KAAK;IACpD;AACF,EAAE;AAEF;;;CAGC,GACD,OAAO,MAAME,qBAAqB,CAACP;IACjC,MAAMQ,YACJ;QAAEhB,KAAK;QAAOI,MAAM;QAAYC,MAAM;QAAYC,KAAK;IAAO,CAAC,CAACE,GAAG,IACnE;IACF,OAAO,GAAGQ,UAAU,IAAI,EAAElB,WAAW,KAAK,CAAC;AAC7C,EAAE;AAEF;;;;;;;;;;;CAWC,GACD,OAAO,MAAMmB,gCAAgC,CAC3CT,IACAU,WACAC,KACAC,KACAC;IAEA,MAAMC,eAAevB,wBAAwB,CAACS,GAAG,EAAEL,UAAU,GAAGK,GAAG,OAAO,CAAC;IAC3E,MAAMe,UAAUH,MAAM,CAAC,kBAAkB,EAAEA,KAAK,GAAG;IACnD,MAAMI,QAAQ;QACZF;QACAC;QACA,wEAAwE;WACpEf,OAAO,QAAQ;YAAC;SAAK,GAAG,EAAE;QAC9BU;WACIC,MAAM;YAAC,CAAC,MAAM,EAAEA,KAAK;SAAC,GAAG,EAAE;WAC3BE,SAAS;YAAC,CAAC,SAAS,EAAEA,QAAQ;SAAC,GAAG,EAAE;KACzC;IACD,OAAOG,MAAMC,IAAI,CAAC;AACpB,EAAE"}
+{"version":3,"sources":["../../../../../packages/nx-plugin/src/utils/commands.ts"],"sourcesContent":["/**\n * Copyright Amazon.com, Inc. or its affiliates. All Rights Reserved.\n * SPDX-License-Identifier: Apache-2.0\n */\nimport { TS_VERSIONS } from './versions';\n\n/**\n * The nx version the plugin is built against. Commands that download nx\n * (e.g. `nx init`) pin to this version so the workspace's nx matches the\n * plugin's `@nx/*` packages — a mismatch deadlocks `nx sync`.\n */\nexport const NX_VERSION = TS_VERSIONS['@nx/devkit'];\n\n/**\n * Display-friendly command prefixes for each package manager.\n *\n * - `exec`: prefix for running local binaries (e.g. `npx nx`, `pnpm nx`, `bunx nx`)\n * - `run`: prefix for running package.json scripts (e.g. `npm run build`, `pnpm build`)\n *\n * @see docs/src/components/package-manager-exec-command.astro\n * @see docs/src/components/package-manager-short-command.astro\n */\nexport interface PackageManagerDisplayCommands {\n  /** Prefix for running local binaries: npx, pnpm, yarn, bunx */\n  exec: string;\n  /** Prefix for running package.json scripts: `npm run`, pnpm, yarn, bun */\n  run: string;\n  /** Prefix for `create` commands: `npm create`, `pnpm create`, etc. */\n  create: string;\n}\n\nexport const PACKAGE_MANAGER_COMMANDS: Record<\n  string,\n  PackageManagerDisplayCommands\n> = {\n  npm: { exec: 'npx', run: 'npm run', create: 'npm create' },\n  pnpm: { exec: 'pnpm', run: 'pnpm', create: 'pnpm create' },\n  yarn: { exec: 'yarn', run: 'yarn', create: 'yarn create' },\n  bun: { exec: 'bunx', run: 'bun', create: 'bun create' },\n};\n\n/**\n * Build a package manager exec command (e.g. pnpm cmd, npx cmd, bunx cmd)\n */\nexport const buildPackageManagerExecCommand = (pm: string, command: string) => {\n  const prefix = PACKAGE_MANAGER_COMMANDS[pm]?.exec ?? pm;\n  return `${prefix} ${command}`;\n};\n\n/**\n * Build a short package manager command (e.g. pnpm build, npm run build)\n */\nexport const buildPackageManagerShortCommand = (\n  pm: string,\n  command: string,\n) => {\n  const prefix = PACKAGE_MANAGER_COMMANDS[pm]?.run ?? pm;\n  return `${prefix} ${command}`;\n};\n\n/**\n * Build an install command for a given package manager\n */\nexport const buildInstallCommand = (pm: string, pkg: string, dev: boolean) => {\n  switch (pm) {\n    case 'pnpm':\n      return `pnpm add ${dev ? '-D' : '-'}w ${pkg}`;\n    case 'yarn':\n      return `yarn add ${dev ? '-D ' : ''}${pkg}`;\n    case 'npm':\n      return `npm install --legacy-peer-deps ${dev ? '-D ' : ''}${pkg}`;\n    case 'bun':\n      return `bun add ${dev ? '-D ' : ''}${pkg}`;\n    default:\n      return `${pm} install ${dev ? '-D ' : ''}${pkg}`;\n  }\n};\n\n/**\n * Build the command that adds Nx to a non-Nx project, pinned to the nx\n * version the plugin is built against.\n */\nexport const buildNxInitCommand = (pm: string) => {\n  const dlxPrefix =\n    { npm: 'npx', pnpm: 'pnpm dlx', yarn: 'yarn dlx', bun: 'bunx' }[pm] ??\n    'npx';\n  return `${dlxPrefix} nx@${NX_VERSION} init`;\n};\n\n/**\n * Build a command to create a new workspace using @aws/create-nx-workspace.\n *\n * Uses the `create` shorthand for each package manager:\n *   npm create @aws/nx-workspace my-project\n *   pnpm create @aws/nx-workspace my-project\n *   yarn create @aws/nx-workspace my-project\n *   bun create @aws/nx-workspace my-project\n *\n * The package manager is auto-detected by @aws/create-nx-workspace from the\n * invoking command, so --pm is not needed.\n */\nexport const buildCreateNxWorkspaceCommand = (\n  pm: string,\n  workspace: string,\n  iac?: 'cdk' | 'terraform',\n  tag?: string,\n  module?: 'esm' | 'cjs',\n) => {\n  const createPrefix = PACKAGE_MANAGER_COMMANDS[pm]?.create ?? `${pm} create`;\n  const pkgName = tag ? `@aws/nx-workspace@${tag}` : '@aws/nx-workspace';\n  const parts = [\n    createPrefix,\n    pkgName,\n    // npm requires '--' to stop interpreting subsequent flags as npm config\n    ...(pm === 'npm' ? ['--'] : []),\n    workspace,\n    ...(iac ? [`--iac=${iac}`] : []),\n    ...(module ? [`--module=${module}`] : []),\n  ];\n  return parts.join(' ');\n};\n"],"names":["TS_VERSIONS","NX_VERSION","PACKAGE_MANAGER_COMMANDS","npm","exec","run","create","pnpm","yarn","bun","buildPackageManagerExecCommand","pm","command","prefix","buildPackageManagerShortCommand","buildInstallCommand","pkg","dev","buildNxInitCommand","dlxPrefix","buildCreateNxWorkspaceCommand","workspace","iac","tag","module","createPrefix","pkgName","parts","join"],"mappings":"AAAA;;;CAGC,GACD,SAASA,WAAW,QAAQ,gBAAa;AAEzC;;;;CAIC,GACD,OAAO,MAAMC,aAAaD,WAAW,CAAC,aAAa,CAAC;AAoBpD,OAAO,MAAME,2BAGT;IACFC,KAAK;QAAEC,MAAM;QAAOC,KAAK;QAAWC,QAAQ;IAAa;IACzDC,MAAM;QAAEH,MAAM;QAAQC,KAAK;QAAQC,QAAQ;IAAc;IACzDE,MAAM;QAAEJ,MAAM;QAAQC,KAAK;QAAQC,QAAQ;IAAc;IACzDG,KAAK;QAAEL,MAAM;QAAQC,KAAK;QAAOC,QAAQ;IAAa;AACxD,EAAE;AAEF;;CAEC,GACD,OAAO,MAAMI,iCAAiC,CAACC,IAAYC;IACzD,MAAMC,SAASX,wBAAwB,CAACS,GAAG,EAAEP,QAAQO;IACrD,OAAO,GAAGE,OAAO,CAAC,EAAED,SAAS;AAC/B,EAAE;AAEF;;CAEC,GACD,OAAO,MAAME,kCAAkC,CAC7CH,IACAC;IAEA,MAAMC,SAASX,wBAAwB,CAACS,GAAG,EAAEN,OAAOM;IACpD,OAAO,GAAGE,OAAO,CAAC,EAAED,SAAS;AAC/B,EAAE;AAEF;;CAEC,GACD,OAAO,MAAMG,sBAAsB,CAACJ,IAAYK,KAAaC;IAC3D,OAAQN;QACN,KAAK;YACH,OAAO,CAAC,SAAS,EAAEM,MAAM,OAAO,IAAI,EAAE,EAAED,KAAK;QAC/C,KAAK;YACH,OAAO,CAAC,SAAS,EAAEC,MAAM,QAAQ,KAAKD,KAAK;QAC7C,KAAK;YACH,OAAO,CAAC,+BAA+B,EAAEC,MAAM,QAAQ,KAAKD,KAAK;QACnE,KAAK;YACH,OAAO,CAAC,QAAQ,EAAEC,MAAM,QAAQ,KAAKD,KAAK;QAC5C;YACE,OAAO,GAAGL,GAAG,SAAS,EAAEM,MAAM,QAAQ,KAAKD,KAAK;IACpD;AACF,EAAE;AAEF;;;CAGC,GACD,OAAO,MAAME,qBAAqB,CAACP;IACjC,MAAMQ,YACJ;QAAEhB,KAAK;QAAOI,MAAM;QAAYC,MAAM;QAAYC,KAAK;IAAO,CAAC,CAACE,GAAG,IACnE;IACF,OAAO,GAAGQ,UAAU,IAAI,EAAElB,WAAW,KAAK,CAAC;AAC7C,EAAE;AAEF;;;;;;;;;;;CAWC,GACD,OAAO,MAAMmB,gCAAgC,CAC3CT,IACAU,WACAC,KACAC,KACAC;IAEA,MAAMC,eAAevB,wBAAwB,CAACS,GAAG,EAAEL,UAAU,GAAGK,GAAG,OAAO,CAAC;IAC3E,MAAMe,UAAUH,MAAM,CAAC,kBAAkB,EAAEA,KAAK,GAAG;IACnD,MAAMI,QAAQ;QACZF;QACAC;QACA,wEAAwE;WACpEf,OAAO,QAAQ;YAAC;SAAK,GAAG,EAAE;QAC9BU;WACIC,MAAM;YAAC,CAAC,MAAM,EAAEA,KAAK;SAAC,GAAG,EAAE;WAC3BE,SAAS;YAAC,CAAC,SAAS,EAAEA,QAAQ;SAAC,GAAG,EAAE;KACzC;IACD,OAAOG,MAAMC,IAAI,CAAC;AACpB,EAAE"}

package/src/utils/dcr-proxy-constructs/dcr-proxy-constructs.d.ts

@@ -0,0 +1,38 @@
+/**
+ * Copyright Amazon.com, Inc. or its affiliates. All Rights Reserved.
+ * SPDX-License-Identifier: Apache-2.0
+ */
+import { type Tree } from '@nx/devkit';
+import type { Iac } from '../iac';
+/**
+ * The DCR proxy Lambda handlers. Each is bundled independently and wired to a
+ * dedicated route on the HTTP API.
+ */
+export declare const DCR_PROXY_HANDLERS: readonly ["authorization-server-metadata", "authorize", "mcp-proxy", "protected-resource-metadata", "register", "token"];
+export type DcrProxyHandler = (typeof DCR_PROXY_HANDLERS)[number];
+export interface AddDcrProxyInfraProps {
+    dcrProxyNameClassName: string;
+    dcrProxyNameKebabCase: string;
+    /**
+     * Fully qualified name of the TypeScript project that owns the bundled
+     * handlers, used to wire the shared package build to depend on it.
+     */
+    proxyProjectName: string;
+    /**
+     * Map of handler name to the workspace-root-relative path of its bundle
+     * output directory (e.g. `dist/packages/dcr-proxy/bundle/token`).
+     */
+    bundlePathsFromRoot: Record<DcrProxyHandler, string>;
+    iac: Iac;
+}
+/**
+ * Add a DCR proxy infrastructure (CDK construct or Terraform module) to the
+ * relevant shared package.
+ *
+ * The infrastructure exposes props/variables for the caller to inject their
+ * Cognito identifiers and the upstream MCP server URL from their own stack,
+ * since these may or may not be generated by this plugin. The Lambda handlers
+ * live in a standalone TypeScript project and are bundled by rolldown; both
+ * IaC providers reference the same bundle output.
+ */
+export declare const addDcrProxyInfra: (tree: Tree, options: AddDcrProxyInfraProps) => Promise<void>;

package/src/utils/dcr-proxy-constructs/dcr-proxy-constructs.js

@@ -0,0 +1,93 @@
+/**
+ * Copyright Amazon.com, Inc. or its affiliates. All Rights Reserved.
+ * SPDX-License-Identifier: Apache-2.0
+ */ import { generateFiles, joinPathFragments, OverwriteStrategy, updateJson } from "@nx/devkit";
+import { addStarExport } from "../ast.js";
+import { esmVars } from "../module-format.js";
+import { addDependencyToTargetIfNotPresent } from "../nx.js";
+import { PACKAGES_DIR, SHARED_CONSTRUCTS_DIR, SHARED_TERRAFORM_DIR } from "../shared-constructs-constants.js";
+import { terraformProviderVersions } from "../versions.js";
+/**
+ * The DCR proxy Lambda handlers. Each is bundled independently and wired to a
+ * dedicated route on the HTTP API.
+ */ export const DCR_PROXY_HANDLERS = [
+    'authorization-server-metadata',
+    'authorize',
+    'mcp-proxy',
+    'protected-resource-metadata',
+    'register',
+    'token'
+];
+/**
+ * Add a DCR proxy infrastructure (CDK construct or Terraform module) to the
+ * relevant shared package.
+ *
+ * The infrastructure exposes props/variables for the caller to inject their
+ * Cognito identifiers and the upstream MCP server URL from their own stack,
+ * since these may or may not be generated by this plugin. The Lambda handlers
+ * live in a standalone TypeScript project and are bundled by rolldown; both
+ * IaC providers reference the same bundle output.
+ */ export const addDcrProxyInfra = async (tree, options)=>{
+    if (options.iac === 'cdk') {
+        await addDcrProxyCdkConstructs(tree, options);
+    } else if (options.iac === 'terraform') {
+        addDcrProxyTerraformModules(tree, options);
+    } else {
+        throw new Error(`Unsupported iac ${options.iac}`);
+    }
+    // Ensure the handler bundles are built before the shared package
+    updateJson(tree, joinPathFragments(PACKAGES_DIR, options.iac === 'cdk' ? SHARED_CONSTRUCTS_DIR : SHARED_TERRAFORM_DIR, 'project.json'), (config)=>{
+        addDependencyToTargetIfNotPresent(config, 'build', `${options.proxyProjectName}:build`);
+        return config;
+    });
+};
+/**
+ * Add the DCR proxy CDK construct to the shared constructs package.
+ */ const addDcrProxyCdkConstructs = async (tree, options)=>{
+    // Ensure the core HTTP API construct + utils are available (the proxy reuses
+    // them). These are shared with the api generators and safe to (re)generate
+    // with KeepExisting.
+    for (const coreApiFile of [
+        'http',
+        'utils'
+    ]){
+        generateFiles(tree, joinPathFragments(import.meta.dirname, '..', 'api-constructs', 'files', 'cdk', 'core', 'api', coreApiFile), joinPathFragments(PACKAGES_DIR, SHARED_CONSTRUCTS_DIR, 'src', 'core', 'api'), {
+            ...esmVars(tree)
+        }, {
+            overwriteStrategy: OverwriteStrategy.KeepExisting
+        });
+    }
+    generateFiles(tree, joinPathFragments(import.meta.dirname, 'files', 'cdk', 'app', 'dcr-proxies'), joinPathFragments(PACKAGES_DIR, SHARED_CONSTRUCTS_DIR, 'src', 'app', 'dcr-proxies'), {
+        nameClassName: options.dcrProxyNameClassName,
+        nameKebabCase: options.dcrProxyNameKebabCase,
+        bundlePathsFromRoot: options.bundlePathsFromRoot,
+        ...esmVars(tree)
+    }, {
+        overwriteStrategy: OverwriteStrategy.KeepExisting
+    });
+    // Export the construct
+    await addStarExport(tree, joinPathFragments(PACKAGES_DIR, SHARED_CONSTRUCTS_DIR, 'src', 'app', 'dcr-proxies', 'index.ts'), `./${options.dcrProxyNameKebabCase}/${options.dcrProxyNameKebabCase}.js`);
+    await addStarExport(tree, joinPathFragments(PACKAGES_DIR, SHARED_CONSTRUCTS_DIR, 'src', 'app', 'index.ts'), './dcr-proxies/index.js');
+};
+/**
+ * Add the DCR proxy Terraform module to the shared terraform package.
+ */ const addDcrProxyTerraformModules = (tree, options)=>{
+    // Ensure the core HTTP API module is available (the proxy reuses it). This is
+    // shared with the api generators and safe to (re)generate with KeepExisting.
+    generateFiles(tree, joinPathFragments(import.meta.dirname, '..', 'api-constructs', 'files', 'terraform', 'core', 'api', 'http'), joinPathFragments(PACKAGES_DIR, SHARED_TERRAFORM_DIR, 'src', 'core', 'api'), {
+        ...terraformProviderVersions()
+    }, {
+        overwriteStrategy: OverwriteStrategy.KeepExisting
+    });
+    // Generate the app specific terraform module
+    generateFiles(tree, joinPathFragments(import.meta.dirname, 'files', 'terraform', 'app', 'dcr-proxies'), joinPathFragments(PACKAGES_DIR, SHARED_TERRAFORM_DIR, 'src', 'app', 'dcr-proxies'), {
+        nameClassName: options.dcrProxyNameClassName,
+        nameKebabCase: options.dcrProxyNameKebabCase,
+        bundlePathsFromRoot: options.bundlePathsFromRoot,
+        ...terraformProviderVersions()
+    }, {
+        overwriteStrategy: OverwriteStrategy.KeepExisting
+    });
+};
+
+//# sourceMappingURL=dcr-proxy-constructs.js.map

package/src/utils/dcr-proxy-constructs/dcr-proxy-constructs.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../../../../../../packages/nx-plugin/src/utils/dcr-proxy-constructs/dcr-proxy-constructs.ts"],"sourcesContent":["/**\n * Copyright Amazon.com, Inc. or its affiliates. All Rights Reserved.\n * SPDX-License-Identifier: Apache-2.0\n */\nimport {\n  generateFiles,\n  joinPathFragments,\n  OverwriteStrategy,\n  type ProjectConfiguration,\n  type Tree,\n  updateJson,\n} from '@nx/devkit';\nimport { addStarExport } from '../ast';\nimport type { Iac } from '../iac';\nimport { esmVars } from '../module-format';\nimport { addDependencyToTargetIfNotPresent } from '../nx';\nimport {\n  PACKAGES_DIR,\n  SHARED_CONSTRUCTS_DIR,\n  SHARED_TERRAFORM_DIR,\n} from '../shared-constructs-constants';\nimport { terraformProviderVersions } from '../versions';\n\n/**\n * The DCR proxy Lambda handlers. Each is bundled independently and wired to a\n * dedicated route on the HTTP API.\n */\nexport const DCR_PROXY_HANDLERS = [\n  'authorization-server-metadata',\n  'authorize',\n  'mcp-proxy',\n  'protected-resource-metadata',\n  'register',\n  'token',\n] as const;\n\nexport type DcrProxyHandler = (typeof DCR_PROXY_HANDLERS)[number];\n\nexport interface AddDcrProxyInfraProps {\n  dcrProxyNameClassName: string;\n  dcrProxyNameKebabCase: string;\n\n  /**\n   * Fully qualified name of the TypeScript project that owns the bundled\n   * handlers, used to wire the shared package build to depend on it.\n   */\n  proxyProjectName: string;\n\n  /**\n   * Map of handler name to the workspace-root-relative path of its bundle\n   * output directory (e.g. `dist/packages/dcr-proxy/bundle/token`).\n   */\n  bundlePathsFromRoot: Record<DcrProxyHandler, string>;\n\n  iac: Iac;\n}\n\n/**\n * Add a DCR proxy infrastructure (CDK construct or Terraform module) to the\n * relevant shared package.\n *\n * The infrastructure exposes props/variables for the caller to inject their\n * Cognito identifiers and the upstream MCP server URL from their own stack,\n * since these may or may not be generated by this plugin. The Lambda handlers\n * live in a standalone TypeScript project and are bundled by rolldown; both\n * IaC providers reference the same bundle output.\n */\nexport const addDcrProxyInfra = async (\n  tree: Tree,\n  options: AddDcrProxyInfraProps,\n) => {\n  if (options.iac === 'cdk') {\n    await addDcrProxyCdkConstructs(tree, options);\n  } else if (options.iac === 'terraform') {\n    addDcrProxyTerraformModules(tree, options);\n  } else {\n    throw new Error(`Unsupported iac ${options.iac}`);\n  }\n\n  // Ensure the handler bundles are built before the shared package\n  updateJson(\n    tree,\n    joinPathFragments(\n      PACKAGES_DIR,\n      options.iac === 'cdk' ? SHARED_CONSTRUCTS_DIR : SHARED_TERRAFORM_DIR,\n      'project.json',\n    ),\n    (config: ProjectConfiguration) => {\n      addDependencyToTargetIfNotPresent(\n        config,\n        'build',\n        `${options.proxyProjectName}:build`,\n      );\n      return config;\n    },\n  );\n};\n\n/**\n * Add the DCR proxy CDK construct to the shared constructs package.\n */\nconst addDcrProxyCdkConstructs = async (\n  tree: Tree,\n  options: AddDcrProxyInfraProps,\n) => {\n  // Ensure the core HTTP API construct + utils are available (the proxy reuses\n  // them). These are shared with the api generators and safe to (re)generate\n  // with KeepExisting.\n  for (const coreApiFile of ['http', 'utils']) {\n    generateFiles(\n      tree,\n      joinPathFragments(\n        import.meta.dirname,\n        '..',\n        'api-constructs',\n        'files',\n        'cdk',\n        'core',\n        'api',\n        coreApiFile,\n      ),\n      joinPathFragments(\n        PACKAGES_DIR,\n        SHARED_CONSTRUCTS_DIR,\n        'src',\n        'core',\n        'api',\n      ),\n      { ...esmVars(tree) },\n      {\n        overwriteStrategy: OverwriteStrategy.KeepExisting,\n      },\n    );\n  }\n\n  generateFiles(\n    tree,\n    joinPathFragments(\n      import.meta.dirname,\n      'files',\n      'cdk',\n      'app',\n      'dcr-proxies',\n    ),\n    joinPathFragments(\n      PACKAGES_DIR,\n      SHARED_CONSTRUCTS_DIR,\n      'src',\n      'app',\n      'dcr-proxies',\n    ),\n    {\n      nameClassName: options.dcrProxyNameClassName,\n      nameKebabCase: options.dcrProxyNameKebabCase,\n      bundlePathsFromRoot: options.bundlePathsFromRoot,\n      ...esmVars(tree),\n    },\n    {\n      overwriteStrategy: OverwriteStrategy.KeepExisting,\n    },\n  );\n\n  // Export the construct\n  await addStarExport(\n    tree,\n    joinPathFragments(\n      PACKAGES_DIR,\n      SHARED_CONSTRUCTS_DIR,\n      'src',\n      'app',\n      'dcr-proxies',\n      'index.ts',\n    ),\n    `./${options.dcrProxyNameKebabCase}/${options.dcrProxyNameKebabCase}.js`,\n  );\n  await addStarExport(\n    tree,\n    joinPathFragments(\n      PACKAGES_DIR,\n      SHARED_CONSTRUCTS_DIR,\n      'src',\n      'app',\n      'index.ts',\n    ),\n    './dcr-proxies/index.js',\n  );\n};\n\n/**\n * Add the DCR proxy Terraform module to the shared terraform package.\n */\nconst addDcrProxyTerraformModules = (\n  tree: Tree,\n  options: AddDcrProxyInfraProps,\n) => {\n  // Ensure the core HTTP API module is available (the proxy reuses it). This is\n  // shared with the api generators and safe to (re)generate with KeepExisting.\n  generateFiles(\n    tree,\n    joinPathFragments(\n      import.meta.dirname,\n      '..',\n      'api-constructs',\n      'files',\n      'terraform',\n      'core',\n      'api',\n      'http',\n    ),\n    joinPathFragments(PACKAGES_DIR, SHARED_TERRAFORM_DIR, 'src', 'core', 'api'),\n    { ...terraformProviderVersions() },\n    {\n      overwriteStrategy: OverwriteStrategy.KeepExisting,\n    },\n  );\n\n  // Generate the app specific terraform module\n  generateFiles(\n    tree,\n    joinPathFragments(\n      import.meta.dirname,\n      'files',\n      'terraform',\n      'app',\n      'dcr-proxies',\n    ),\n    joinPathFragments(\n      PACKAGES_DIR,\n      SHARED_TERRAFORM_DIR,\n      'src',\n      'app',\n      'dcr-proxies',\n    ),\n    {\n      nameClassName: options.dcrProxyNameClassName,\n      nameKebabCase: options.dcrProxyNameKebabCase,\n      bundlePathsFromRoot: options.bundlePathsFromRoot,\n      ...terraformProviderVersions(),\n    },\n    {\n      overwriteStrategy: OverwriteStrategy.KeepExisting,\n    },\n  );\n};\n"],"names":["generateFiles","joinPathFragments","OverwriteStrategy","updateJson","addStarExport","esmVars","addDependencyToTargetIfNotPresent","PACKAGES_DIR","SHARED_CONSTRUCTS_DIR","SHARED_TERRAFORM_DIR","terraformProviderVersions","DCR_PROXY_HANDLERS","addDcrProxyInfra","tree","options","iac","addDcrProxyCdkConstructs","addDcrProxyTerraformModules","Error","config","proxyProjectName","coreApiFile","dirname","overwriteStrategy","KeepExisting","nameClassName","dcrProxyNameClassName","nameKebabCase","dcrProxyNameKebabCase","bundlePathsFromRoot"],"mappings":"AAAA;;;CAGC,GACD,SACEA,aAAa,EACbC,iBAAiB,EACjBC,iBAAiB,EAGjBC,UAAU,QACL,aAAa;AACpB,SAASC,aAAa,QAAQ,YAAS;AAEvC,SAASC,OAAO,QAAQ,sBAAmB;AAC3C,SAASC,iCAAiC,QAAQ,WAAQ;AAC1D,SACEC,YAAY,EACZC,qBAAqB,EACrBC,oBAAoB,QACf,oCAAiC;AACxC,SAASC,yBAAyB,QAAQ,iBAAc;AAExD;;;CAGC,GACD,OAAO,MAAMC,qBAAqB;IAChC;IACA;IACA;IACA;IACA;IACA;CACD,CAAU;AAuBX;;;;;;;;;CASC,GACD,OAAO,MAAMC,mBAAmB,OAC9BC,MACAC;IAEA,IAAIA,QAAQC,GAAG,KAAK,OAAO;QACzB,MAAMC,yBAAyBH,MAAMC;IACvC,OAAO,IAAIA,QAAQC,GAAG,KAAK,aAAa;QACtCE,4BAA4BJ,MAAMC;IACpC,OAAO;QACL,MAAM,IAAII,MAAM,CAAC,gBAAgB,EAAEJ,QAAQC,GAAG,EAAE;IAClD;IAEA,iEAAiE;IACjEZ,WACEU,MACAZ,kBACEM,cACAO,QAAQC,GAAG,KAAK,QAAQP,wBAAwBC,sBAChD,iBAEF,CAACU;QACCb,kCACEa,QACA,SACA,GAAGL,QAAQM,gBAAgB,CAAC,MAAM,CAAC;QAErC,OAAOD;IACT;AAEJ,EAAE;AAEF;;CAEC,GACD,MAAMH,2BAA2B,OAC/BH,MACAC;IAEA,6EAA6E;IAC7E,2EAA2E;IAC3E,qBAAqB;IACrB,KAAK,MAAMO,eAAe;QAAC;QAAQ;KAAQ,CAAE;QAC3CrB,cACEa,MACAZ,kBACE,YAAYqB,OAAO,EACnB,MACA,kBACA,SACA,OACA,QACA,OACAD,cAEFpB,kBACEM,cACAC,uBACA,OACA,QACA,QAEF;YAAE,GAAGH,QAAQQ,KAAK;QAAC,GACnB;YACEU,mBAAmBrB,kBAAkBsB,YAAY;QACnD;IAEJ;IAEAxB,cACEa,MACAZ,kBACE,YAAYqB,OAAO,EACnB,SACA,OACA,OACA,gBAEFrB,kBACEM,cACAC,uBACA,OACA,OACA,gBAEF;QACEiB,eAAeX,QAAQY,qBAAqB;QAC5CC,eAAeb,QAAQc,qBAAqB;QAC5CC,qBAAqBf,QAAQe,mBAAmB;QAChD,GAAGxB,QAAQQ,KAAK;IAClB,GACA;QACEU,mBAAmBrB,kBAAkBsB,YAAY;IACnD;IAGF,uBAAuB;IACvB,MAAMpB,cACJS,MACAZ,kBACEM,cACAC,uBACA,OACA,OACA,eACA,aAEF,CAAC,EAAE,EAAEM,QAAQc,qBAAqB,CAAC,CAAC,EAAEd,QAAQc,qBAAqB,CAAC,GAAG,CAAC;IAE1E,MAAMxB,cACJS,MACAZ,kBACEM,cACAC,uBACA,OACA,OACA,aAEF;AAEJ;AAEA;;CAEC,GACD,MAAMS,8BAA8B,CAClCJ,MACAC;IAEA,8EAA8E;IAC9E,6EAA6E;IAC7Ed,cACEa,MACAZ,kBACE,YAAYqB,OAAO,EACnB,MACA,kBACA,SACA,aACA,QACA,OACA,SAEFrB,kBAAkBM,cAAcE,sBAAsB,OAAO,QAAQ,QACrE;QAAE,GAAGC,2BAA2B;IAAC,GACjC;QACEa,mBAAmBrB,kBAAkBsB,YAAY;IACnD;IAGF,6CAA6C;IAC7CxB,cACEa,MACAZ,kBACE,YAAYqB,OAAO,EACnB,SACA,aACA,OACA,gBAEFrB,kBACEM,cACAE,sBACA,OACA,OACA,gBAEF;QACEgB,eAAeX,QAAQY,qBAAqB;QAC5CC,eAAeb,QAAQc,qBAAqB;QAC5CC,qBAAqBf,QAAQe,mBAAmB;QAChD,GAAGnB,2BAA2B;IAChC,GACA;QACEa,mBAAmBrB,kBAAkBsB,YAAY;IACnD;AAEJ"}