@aws/nx-plugin 1.0.0-rc.47 → 1.0.0-rc.48

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@aws/nx-plugin",
-  "version": "1.0.0-rc.47",
+  "version": "1.0.0-rc.48",
   "repository": {
     "type": "git",
     "url": "https://github.com/awslabs/nx-plugin-for-aws.git",
@@ -27,9 +27,6 @@
   "publishConfig": {
     "access": "public"
   },
-  "bin": {
-    "aws-nx-mcp": "./src/bin/aws-nx-mcp.js"
-  },
   "generators": "./generators.json",
   "executors": "./executors.json",
   "engines": {

package/src/mcp-server/dev-server.d.ts

@@ -0,0 +1 @@
+export {};

package/src/mcp-server/dev-server.js

@@ -0,0 +1,18 @@
+/**
+ * Copyright Amazon.com, Inc. or its affiliates. All Rights Reserved.
+ * SPDX-License-Identifier: Apache-2.0
+ */ import { startMcpServer } from "./index.js";
+/**
+ * Entry point for the `mcp-inspect` target, which runs the server from source
+ * with live reload. The published server is `@aws/nx-plugin-mcp`, whose bundled
+ * entry point resolves `generators.json` relative to itself and so only works
+ * once built.
+ */ void (async ()=>{
+    try {
+        await startMcpServer();
+    } catch (e) {
+        console.error(e);
+    }
+})();
+
+//# sourceMappingURL=dev-server.js.map

package/src/mcp-server/dev-server.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../../../../../packages/nx-plugin/src/mcp-server/dev-server.ts"],"sourcesContent":["/**\n * Copyright Amazon.com, Inc. or its affiliates. All Rights Reserved.\n * SPDX-License-Identifier: Apache-2.0\n */\nimport { startMcpServer } from '.';\n\n/**\n * Entry point for the `mcp-inspect` target, which runs the server from source\n * with live reload. The published server is `@aws/nx-plugin-mcp`, whose bundled\n * entry point resolves `generators.json` relative to itself and so only works\n * once built.\n */\nvoid (async () => {\n  try {\n    await startMcpServer();\n  } catch (e) {\n    console.error(e);\n  }\n})();\n"],"names":["startMcpServer","e","console","error"],"mappings":"AAAA;;;CAGC,GACD,SAASA,cAAc,QAAQ,aAAI;AAEnC;;;;;CAKC,GACD,KAAK,AAAC,CAAA;IACJ,IAAI;QACF,MAAMA;IACR,EAAE,OAAOC,GAAG;QACVC,QAAQC,KAAK,CAACF;IAChB;AACF,CAAA"}

package/src/preset/__snapshots__/generator.spec.ts.snap

@@ -364,6 +364,8 @@ exports[`preset generator > should run successfully > package.json 1`] = `
   "name": "@proj/source",
   "dependencies": {},
   "devDependencies": {
+    "@aws/nx-plugin": "catalog:",
+    "@aws/nx-plugin-mcp": "catalog:",
     "@biomejs/biome": "catalog:",
     "@nx/js": "catalog:",
     "@nx/workspace": "catalog:",
@@ -411,6 +413,8 @@ catalog:
   '@nx/workspace': 23.1.0
   typescript: ~6.0.3
   '@biomejs/biome': 2.5.4
+  '@aws/nx-plugin': ^0.0.0
+  '@aws/nx-plugin-mcp': ^0.0.0
 "
 `;
 

package/src/ts/agent/__snapshots__/generator.spec.ts.snap

@@ -574,11 +574,15 @@ WORKDIR /app
 
 # Add AWS Distro for OpenTelemetry for observability
 # https://docs.aws.amazon.com/bedrock-agentcore/latest/devguide/observability-configure.html
-# The override pins @opentelemetry/propagator-jaeger above the version the
-# autoinstrumentation package resolves transitively, clearing CVE-2026-59892.
+# The overrides pin transitive dependencies with known HIGH/CRITICAL
+# vulnerabilities to fixed versions. npm is removed once the install is done —
+# the runtime only needs node, and npm's own bundled dependencies would
+# otherwise carry vulnerabilities into the image.
 RUN npm init -y \\
   && npm pkg set "overrides.@opentelemetry/propagator-jaeger=2.9.0" \\
-  && npm install @aws/aws-distro-opentelemetry-node-autoinstrumentation@0.12.0
+  && npm pkg set "overrides.minimatch=10.2.5" \\
+  && npm install @aws/aws-distro-opentelemetry-node-autoinstrumentation@0.12.0 \\
+  && npm uninstall -g npm
 
 # Copy bundled agent
 COPY index.js /app

package/src/ts/agent/files/deploy/Dockerfile.template

@@ -7,11 +7,15 @@ WORKDIR /app
 
 # Add AWS Distro for OpenTelemetry for observability
 # https://docs.aws.amazon.com/bedrock-agentcore/latest/devguide/observability-configure.html
-# The override pins @opentelemetry/propagator-jaeger above the version the
-# autoinstrumentation package resolves transitively, clearing CVE-2026-59892.
+# The overrides pin transitive dependencies with known HIGH/CRITICAL
+# vulnerabilities to fixed versions. npm is removed once the install is done —
+# the runtime only needs node, and npm's own bundled dependencies would
+# otherwise carry vulnerabilities into the image.
 RUN npm init -y \
   && npm pkg set "overrides.@opentelemetry/propagator-jaeger=<%- jaegerVersion %>" \
-  && npm install @aws/aws-distro-opentelemetry-node-autoinstrumentation@<%- adotVersion %>
+  && npm pkg set "overrides.minimatch=<%- minimatchVersion %>" \
+  && npm install @aws/aws-distro-opentelemetry-node-autoinstrumentation@<%- adotVersion %> \
+  && npm uninstall -g npm
 
 # Copy bundled agent
 COPY index.js /app

package/src/ts/agent/generator.js

@@ -8,7 +8,7 @@ import { addAgentInfra } from "../../utils/agent-core-constructs/agent-core-cons
 import { addTypeScriptBundleTarget } from "../../utils/bundle/bundle.js";
 import { resolveContainers } from "../../utils/containers.js";
 import { addDependenciesToPackageJson } from "../../utils/dependencies.js";
-import { addDockerScanTarget } from "../../utils/docker.js";
+import { addDockerScanTarget, nodeImageVersions } from "../../utils/docker.js";
 import { formatFilesInSubtree } from "../../utils/format.js";
 import { FsCommands } from "../../utils/fs.js";
 import { resolveIac } from "../../utils/iac.js";
@@ -81,7 +81,7 @@ export const tsAgentGenerator = async (tree, options)=>{
             adotVersion: TS_VERSIONS['@aws/aws-distro-opentelemetry-node-autoinstrumentation'],
             jaegerVersion: TS_VERSIONS['@opentelemetry/propagator-jaeger'],
             nodeBaseImage: BASE_IMAGES.node,
-            npmVersion: TS_VERSIONS.npm,
+            ...nodeImageVersions(),
             ...esmVars(tree)
         }, {
             overwriteStrategy: OverwriteStrategy.KeepExisting

package/src/ts/agent/generator.js.map

@@ -1 +1 @@
-{"version":3,"sources":["../../../../../../packages/nx-plugin/src/ts/agent/generator.ts"],"sourcesContent":["/**\n * Copyright Amazon.com, Inc. or its affiliates. All Rights Reserved.\n * SPDX-License-Identifier: Apache-2.0\n */\nimport {\n  type GeneratorCallback,\n  generateFiles,\n  joinPathFragments,\n  OverwriteStrategy,\n  type Tree,\n  updateProjectConfiguration,\n} from '@nx/devkit';\nimport { addAgentChatScripts } from '../../utils/agent-chat/agent-chat';\nimport {\n  addTypeScriptFrameworkBase,\n  ensureTypeScriptAgentConnectionProject,\n} from '../../utils/agent-connection/agent-connection';\nimport { addAgentInfra } from '../../utils/agent-core-constructs/agent-core-constructs';\nimport { addTypeScriptBundleTarget } from '../../utils/bundle/bundle';\nimport { resolveContainers } from '../../utils/containers';\nimport { addDependenciesToPackageJson } from '../../utils/dependencies';\nimport { addDockerScanTarget } from '../../utils/docker';\nimport { formatFilesInSubtree } from '../../utils/format';\nimport { FsCommands } from '../../utils/fs';\nimport { resolveIac } from '../../utils/iac';\nimport { installDependencies } from '../../utils/install';\nimport { addGeneratorMetricsIfApplicable } from '../../utils/metrics';\nimport { esmVars } from '../../utils/module-format';\nimport { kebabCase, toClassName } from '../../utils/names';\nimport { getNpmScope } from '../../utils/npm-scope';\nimport {\n  addComponentDevTarget,\n  addComponentGeneratorMetadata,\n  addDependencyToTargetIfNotPresent,\n  getGeneratorInfo,\n  type NxGeneratorInfo,\n  readProjectConfigurationUnqualified,\n} from '../../utils/nx';\nimport { sortObjectKeys } from '../../utils/object';\nimport { assignPort } from '../../utils/port';\nimport { sharedConstructsGenerator } from '../../utils/shared-constructs';\nimport { BASE_IMAGES, TS_VERSIONS, withVersions } from '../../utils/versions';\nimport type { TsAgentGeneratorSchema } from './schema';\n\nexport const TS_AGENT_GENERATOR_INFO: NxGeneratorInfo = getGeneratorInfo(\n  import.meta.filename,\n);\n\nexport const tsAgentGenerator = async (\n  tree: Tree,\n  options: TsAgentGeneratorSchema,\n): Promise<GeneratorCallback> => {\n  const project = readProjectConfigurationUnqualified(tree, options.project);\n\n  if (!tree.exists(joinPathFragments(project.root, 'tsconfig.json'))) {\n    throw new Error(\n      `Unsupported project ${options.project}. Expected a TypeScript project (with a tsconfig.json)`,\n    );\n  }\n\n  const defaultName = `${kebabCase(project.name.split('/').pop())}-agent`;\n  const name = kebabCase(options.name || defaultName);\n  const agentNameClassName = toClassName(name);\n  const agentTargetPrefix = options.name ? name : 'agent';\n  const targetSourceDirRelativeToProjectRoot = joinPathFragments(\n    'src',\n    agentTargetPrefix,\n  );\n  const targetSourceDir = joinPathFragments(\n    project.root,\n    targetSourceDirRelativeToProjectRoot,\n  );\n  const relativeSourceDir = targetSourceDir.replace(project.root + '/', './');\n  const distDir = joinPathFragments('dist', project.root);\n\n  const infra = options.infra ?? 'agentcore';\n  const protocol = options.protocol ?? 'http';\n\n  if (infra === 'none' && options.auth && options.auth !== 'iam') {\n    console.warn(\n      'Warning: auth is ignored when no infrastructure is configured (no infrastructure is generated)',\n    );\n  }\n\n  const auth = options.auth ?? 'iam';\n\n  // Ensure the shared agent-connection project exists so the server entry\n  // point can import `runWithSessionId` and propagate the AgentCore session\n  // ID to any downstream MCP / A2A clients a later connection generator\n  // wires into this agent.\n  await ensureTypeScriptAgentConnectionProject(tree);\n  // The agent server imports the framework base helpers (session cache + model\n  // error logging) regardless of whether a connection client is wired in.\n  await addTypeScriptFrameworkBase(tree);\n\n  const templateContext = {\n    name,\n    agentNameClassName,\n    distDir,\n    agentConnectionImport: `@${getNpmScope(tree)}/agent-connection`,\n    ...esmVars(tree),\n  };\n\n  // Generate common files shared by both protocols\n  generateFiles(\n    tree,\n    joinPathFragments(import.meta.dirname, 'files', 'common'),\n    targetSourceDir,\n    templateContext,\n    { overwriteStrategy: OverwriteStrategy.KeepExisting },\n  );\n\n  // Generate protocol-specific files\n  generateFiles(\n    tree,\n    joinPathFragments(import.meta.dirname, 'files', protocol.toLowerCase()),\n    targetSourceDir,\n    templateContext,\n    { overwriteStrategy: OverwriteStrategy.KeepExisting },\n  );\n\n  if (infra === 'agentcore') {\n    const containers = await resolveContainers(tree, 'inherit');\n    const dockerImageTag = `${getNpmScope(tree)}-${name}:latest`;\n\n    // Add bundle target\n    await addTypeScriptBundleTarget(tree, project, {\n      targetFilePath: `${targetSourceDirRelativeToProjectRoot}/index.ts`,\n      bundleOutputDir: joinPathFragments('agent', name),\n    });\n\n    // Add the Dockerfile\n    generateFiles(\n      tree,\n      joinPathFragments(import.meta.dirname, 'files', 'deploy'),\n      targetSourceDir,\n      {\n        distDir,\n        name,\n        protocol,\n        adotVersion:\n          TS_VERSIONS['@aws/aws-distro-opentelemetry-node-autoinstrumentation'],\n        jaegerVersion: TS_VERSIONS['@opentelemetry/propagator-jaeger'],\n        nodeBaseImage: BASE_IMAGES.node,\n        npmVersion: TS_VERSIONS.npm,\n        ...esmVars(tree),\n      },\n      { overwriteStrategy: OverwriteStrategy.KeepExisting },\n    );\n\n    const dockerOutputDir = joinPathFragments(\n      'dist',\n      project.root,\n      'bundle',\n      'agent',\n      name,\n    );\n    const dockerTargetName = `${agentTargetPrefix}-docker`;\n\n    const fs = new FsCommands(tree);\n    project.targets[dockerTargetName] = {\n      cache: true,\n      outputs: [`{workspaceRoot}/${dockerOutputDir}/Dockerfile`],\n      executor: 'nx:run-commands',\n      options: {\n        commands: [\n          fs.cp(\n            `${targetSourceDir}/Dockerfile`,\n            `${dockerOutputDir}/Dockerfile`,\n          ),\n          `${containers} build --platform linux/arm64 -t ${dockerImageTag} ${dockerOutputDir}`,\n        ],\n        parallel: false,\n      },\n      dependsOn: ['bundle'],\n    };\n\n    addDependencyToTargetIfNotPresent(project, 'docker', dockerTargetName);\n    addDependencyToTargetIfNotPresent(project, 'build', 'docker');\n\n    addDockerScanTarget(tree, {\n      project,\n      containerEngine: containers,\n      trivyTargetName: `${agentTargetPrefix}-trivy`,\n      dockerTargetName,\n      imageTags: [dockerImageTag],\n    });\n\n    // Add shared constructs\n    const iac = await resolveIac(tree, options.iac);\n    await sharedConstructsGenerator(tree, { iac });\n\n    // AG-UI uses HTTP as the AgentCore protocol type (AG-UI is HTTP-based with SSE over POST).\n    const infraProtocol: 'http' | 'a2a' =\n      protocol === 'ag-ui' ? 'http' : (protocol as 'http' | 'a2a');\n\n    await addAgentInfra(tree, {\n      agentNameKebabCase: name,\n      agentNameClassName,\n      projectName: project.name,\n      dockerImageTag,\n      dockerOutputDir,\n      iac,\n      auth,\n      serverProtocol: infraProtocol,\n      containers,\n    });\n  }\n\n  // Add dependencies\n  addDependenciesToPackageJson(\n    tree,\n    withVersions([\n      'zod',\n      '@strands-agents/sdk',\n      '@aws-sdk/credential-providers',\n      '@aws-sdk/client-appconfigdata',\n      '@aws-lambda-powertools/parameters',\n      '@modelcontextprotocol/sdk',\n      ...(protocol === 'a2a'\n        ? (['express', '@a2a-js/sdk'] as const)\n        : protocol === 'ag-ui'\n          ? ([\n              '@ag-ui/aws-strands',\n              // @ag-ui/aws-strands declares these as peer dependencies but\n              // statically imports them, so they must be installed for the\n              // bundler to resolve and inline them into the runtime image.\n              '@ag-ui/a2ui-toolkit',\n              '@ag-ui/client',\n              '@ag-ui/core',\n              '@ag-ui/encoder',\n              'express',\n              'cors',\n            ] as const)\n          : ([\n              '@trpc/server',\n              '@trpc/client',\n              'ws',\n              'cors',\n              'aws4fetch',\n            ] as const)),\n    ]),\n    withVersions([\n      '@types/node',\n      // The chat CLI runs standalone via tsx and resolves the deployed agent\n      // from AppConfig when `RUNTIME_CONFIG_APP_ID` is set.\n      'agent-chat-cli',\n      '@aws-lambda-powertools/parameters',\n      '@aws-sdk/client-appconfigdata',\n      ...(auth === 'iam'\n        ? (['aws4fetch', '@aws-sdk/credential-providers'] as const)\n        : ([] as const)),\n      // A2A chat builds a signed @a2a-js client factory for the deployed agent.\n      ...(protocol === 'a2a' ? (['@a2a-js/sdk'] as const) : ([] as const)),\n      ...(protocol === 'a2a' || protocol === 'ag-ui'\n        ? (['@types/express', '@types/cors'] as const)\n        : (['@types/ws', '@types/cors'] as const)),\n    ]),\n    joinPathFragments(project.root, 'package.json'),\n  );\n  addDependenciesToPackageJson(tree, {}, withVersions(['tsx']));\n\n  // A2A servers use port 9000 as per the Strands A2A SDK default and AgentCore A2A contract.\n  // HTTP and AG-UI agents use port 8081+ to avoid conflict with VS Code server on 8080.\n  const localDevPortStart = protocol === 'a2a' ? 9000 : 8081;\n  const localDevPort = assignPort(tree, project, localDevPortStart, {\n    component: { info: TS_AGENT_GENERATOR_INFO, name: agentTargetPrefix },\n  });\n\n  // Every protocol gets a standalone `chat.ts`. It connects to the local\n  // `dev` server by default, or to the deployed agent (with the\n  // appropriate auth) when `RUNTIME_CONFIG_APP_ID` is set.\n  const scriptsDir = joinPathFragments(\n    project.root,\n    'scripts',\n    agentTargetPrefix,\n  );\n  addAgentChatScripts(tree, {\n    scriptsDir,\n    protocol,\n    language: 'ts',\n    agentNameClassName,\n    auth,\n    relativeAgentImport: `../../${targetSourceDirRelativeToProjectRoot}`,\n  });\n\n  const chatUrl =\n    protocol === 'http'\n      ? `ws://localhost:${localDevPort}/ws`\n      : protocol === 'ag-ui'\n        ? `http://localhost:${localDevPort}/invocations`\n        : `http://localhost:${localDevPort}`;\n  const chatCommand = `tsx ./scripts/${agentTargetPrefix}/chat.ts`;\n\n  const agentTargets = {\n    ...project.targets,\n    [`${agentTargetPrefix}-serve`]: {\n      executor: 'nx:run-commands',\n      continuous: true,\n      options: {\n        commands: [`tsx --watch ${relativeSourceDir}/index.ts`],\n        cwd: '{projectRoot}',\n        env: {\n          PORT: `${localDevPort}`,\n        },\n      },\n    },\n    [`${agentTargetPrefix}-dev`]: {\n      executor: 'nx:run-commands',\n      continuous: true,\n      options: {\n        commands: [`tsx --watch ${relativeSourceDir}/index.ts`],\n        cwd: '{projectRoot}',\n        env: {\n          PORT: `${localDevPort}`,\n          LOCAL_DEV: 'true',\n        },\n      },\n    },\n    [`${agentTargetPrefix}-chat`]: {\n      executor: 'nx:run-commands',\n      options: {\n        commands: [chatCommand],\n        cwd: '{projectRoot}',\n        env: {\n          URL: chatUrl,\n        },\n      },\n    },\n  };\n\n  // Aggregate `<agent>-dev` under the project-level `dev` target.\n  addComponentDevTarget(agentTargets, `${agentTargetPrefix}-dev`);\n\n  updateProjectConfiguration(tree, project.name, {\n    ...project,\n    // Sort targets so their order is stable regardless of insertion order on\n    // first run vs re-run.\n    targets: sortObjectKeys(agentTargets),\n  });\n\n  addComponentGeneratorMetadata(\n    tree,\n    project.name,\n    TS_AGENT_GENERATOR_INFO,\n    targetSourceDirRelativeToProjectRoot,\n    agentTargetPrefix,\n    { port: localDevPort, rc: agentNameClassName, auth, protocol },\n  );\n\n  await addGeneratorMetricsIfApplicable(tree, [TS_AGENT_GENERATOR_INFO]);\n\n  await formatFilesInSubtree(tree);\n  return () =>\n    installDependencies(tree, options.preferInstallDependencies, {\n      languages: ['typescript'],\n    });\n};\n\nexport default tsAgentGenerator;\n"],"names":["generateFiles","joinPathFragments","OverwriteStrategy","updateProjectConfiguration","addAgentChatScripts","addTypeScriptFrameworkBase","ensureTypeScriptAgentConnectionProject","addAgentInfra","addTypeScriptBundleTarget","resolveContainers","addDependenciesToPackageJson","addDockerScanTarget","formatFilesInSubtree","FsCommands","resolveIac","installDependencies","addGeneratorMetricsIfApplicable","esmVars","kebabCase","toClassName","getNpmScope","addComponentDevTarget","addComponentGeneratorMetadata","addDependencyToTargetIfNotPresent","getGeneratorInfo","readProjectConfigurationUnqualified","sortObjectKeys","assignPort","sharedConstructsGenerator","BASE_IMAGES","TS_VERSIONS","withVersions","TS_AGENT_GENERATOR_INFO","filename","tsAgentGenerator","tree","options","project","exists","root","Error","defaultName","name","split","pop","agentNameClassName","agentTargetPrefix","targetSourceDirRelativeToProjectRoot","targetSourceDir","relativeSourceDir","replace","distDir","infra","protocol","auth","console","warn","templateContext","agentConnectionImport","dirname","overwriteStrategy","KeepExisting","toLowerCase","containers","dockerImageTag","targetFilePath","bundleOutputDir","adotVersion","jaegerVersion","nodeBaseImage","node","npmVersion","npm","dockerOutputDir","dockerTargetName","fs","targets","cache","outputs","executor","commands","cp","parallel","dependsOn","containerEngine","trivyTargetName","imageTags","iac","infraProtocol","agentNameKebabCase","projectName","serverProtocol","localDevPortStart","localDevPort","component","info","scriptsDir","language","relativeAgentImport","chatUrl","chatCommand","agentTargets","continuous","cwd","env","PORT","LOCAL_DEV","URL","port","rc","preferInstallDependencies","languages"],"mappings":"AAAA;;;CAGC,GACD,SAEEA,aAAa,EACbC,iBAAiB,EACjBC,iBAAiB,EAEjBC,0BAA0B,QACrB,aAAa;AACpB,SAASC,mBAAmB,QAAQ,uCAAoC;AACxE,SACEC,0BAA0B,EAC1BC,sCAAsC,QACjC,mDAAgD;AACvD,SAASC,aAAa,QAAQ,6DAA0D;AACxF,SAASC,yBAAyB,QAAQ,+BAA4B;AACtE,SAASC,iBAAiB,QAAQ,4BAAyB;AAC3D,SAASC,4BAA4B,QAAQ,8BAA2B;AACxE,SAASC,mBAAmB,QAAQ,wBAAqB;AACzD,SAASC,oBAAoB,QAAQ,wBAAqB;AAC1D,SAASC,UAAU,QAAQ,oBAAiB;AAC5C,SAASC,UAAU,QAAQ,qBAAkB;AAC7C,SAASC,mBAAmB,QAAQ,yBAAsB;AAC1D,SAASC,+BAA+B,QAAQ,yBAAsB;AACtE,SAASC,OAAO,QAAQ,+BAA4B;AACpD,SAASC,SAAS,EAAEC,WAAW,QAAQ,uBAAoB;AAC3D,SAASC,WAAW,QAAQ,2BAAwB;AACpD,SACEC,qBAAqB,EACrBC,6BAA6B,EAC7BC,iCAAiC,EACjCC,gBAAgB,EAEhBC,mCAAmC,QAC9B,oBAAiB;AACxB,SAASC,cAAc,QAAQ,wBAAqB;AACpD,SAASC,UAAU,QAAQ,sBAAmB;AAC9C,SAASC,yBAAyB,QAAQ,mCAAgC;AAC1E,SAASC,WAAW,EAAEC,WAAW,EAAEC,YAAY,QAAQ,0BAAuB;AAG9E,OAAO,MAAMC,0BAA2CR,iBACtD,YAAYS,QAAQ,EACpB;AAEF,OAAO,MAAMC,mBAAmB,OAC9BC,MACAC;IAEA,MAAMC,UAAUZ,oCAAoCU,MAAMC,QAAQC,OAAO;IAEzE,IAAI,CAACF,KAAKG,MAAM,CAACrC,kBAAkBoC,QAAQE,IAAI,EAAE,mBAAmB;QAClE,MAAM,IAAIC,MACR,CAAC,oBAAoB,EAAEJ,QAAQC,OAAO,CAAC,sDAAsD,CAAC;IAElG;IAEA,MAAMI,cAAc,GAAGvB,UAAUmB,QAAQK,IAAI,CAACC,KAAK,CAAC,KAAKC,GAAG,IAAI,MAAM,CAAC;IACvE,MAAMF,OAAOxB,UAAUkB,QAAQM,IAAI,IAAID;IACvC,MAAMI,qBAAqB1B,YAAYuB;IACvC,MAAMI,oBAAoBV,QAAQM,IAAI,GAAGA,OAAO;IAChD,MAAMK,uCAAuC9C,kBAC3C,OACA6C;IAEF,MAAME,kBAAkB/C,kBACtBoC,QAAQE,IAAI,EACZQ;IAEF,MAAME,oBAAoBD,gBAAgBE,OAAO,CAACb,QAAQE,IAAI,GAAG,KAAK;IACtE,MAAMY,UAAUlD,kBAAkB,QAAQoC,QAAQE,IAAI;IAEtD,MAAMa,QAAQhB,QAAQgB,KAAK,IAAI;IAC/B,MAAMC,WAAWjB,QAAQiB,QAAQ,IAAI;IAErC,IAAID,UAAU,UAAUhB,QAAQkB,IAAI,IAAIlB,QAAQkB,IAAI,KAAK,OAAO;QAC9DC,QAAQC,IAAI,CACV;IAEJ;IAEA,MAAMF,OAAOlB,QAAQkB,IAAI,IAAI;IAE7B,wEAAwE;IACxE,0EAA0E;IAC1E,sEAAsE;IACtE,yBAAyB;IACzB,MAAMhD,uCAAuC6B;IAC7C,6EAA6E;IAC7E,wEAAwE;IACxE,MAAM9B,2BAA2B8B;IAEjC,MAAMsB,kBAAkB;QACtBf;QACAG;QACAM;QACAO,uBAAuB,CAAC,CAAC,EAAEtC,YAAYe,MAAM,iBAAiB,CAAC;QAC/D,GAAGlB,QAAQkB,KAAK;IAClB;IAEA,iDAAiD;IACjDnC,cACEmC,MACAlC,kBAAkB,YAAY0D,OAAO,EAAE,SAAS,WAChDX,iBACAS,iBACA;QAAEG,mBAAmB1D,kBAAkB2D,YAAY;IAAC;IAGtD,mCAAmC;IACnC7D,cACEmC,MACAlC,kBAAkB,YAAY0D,OAAO,EAAE,SAASN,SAASS,WAAW,KACpEd,iBACAS,iBACA;QAAEG,mBAAmB1D,kBAAkB2D,YAAY;IAAC;IAGtD,IAAIT,UAAU,aAAa;QACzB,MAAMW,aAAa,MAAMtD,kBAAkB0B,MAAM;QACjD,MAAM6B,iBAAiB,GAAG5C,YAAYe,MAAM,CAAC,EAAEO,KAAK,OAAO,CAAC;QAE5D,oBAAoB;QACpB,MAAMlC,0BAA0B2B,MAAME,SAAS;YAC7C4B,gBAAgB,GAAGlB,qCAAqC,SAAS,CAAC;YAClEmB,iBAAiBjE,kBAAkB,SAASyC;QAC9C;QAEA,qBAAqB;QACrB1C,cACEmC,MACAlC,kBAAkB,YAAY0D,OAAO,EAAE,SAAS,WAChDX,iBACA;YACEG;YACAT;YACAW;YACAc,aACErC,WAAW,CAAC,yDAAyD;YACvEsC,eAAetC,WAAW,CAAC,mCAAmC;YAC9DuC,eAAexC,YAAYyC,IAAI;YAC/BC,YAAYzC,YAAY0C,GAAG;YAC3B,GAAGvD,QAAQkB,KAAK;QAClB,GACA;YAAEyB,mBAAmB1D,kBAAkB2D,YAAY;QAAC;QAGtD,MAAMY,kBAAkBxE,kBACtB,QACAoC,QAAQE,IAAI,EACZ,UACA,SACAG;QAEF,MAAMgC,mBAAmB,GAAG5B,kBAAkB,OAAO,CAAC;QAEtD,MAAM6B,KAAK,IAAI9D,WAAWsB;QAC1BE,QAAQuC,OAAO,CAACF,iBAAiB,GAAG;YAClCG,OAAO;YACPC,SAAS;gBAAC,CAAC,gBAAgB,EAAEL,gBAAgB,WAAW,CAAC;aAAC;YAC1DM,UAAU;YACV3C,SAAS;gBACP4C,UAAU;oBACRL,GAAGM,EAAE,CACH,GAAGjC,gBAAgB,WAAW,CAAC,EAC/B,GAAGyB,gBAAgB,WAAW,CAAC;oBAEjC,GAAGV,WAAW,iCAAiC,EAAEC,eAAe,CAAC,EAAES,iBAAiB;iBACrF;gBACDS,UAAU;YACZ;YACAC,WAAW;gBAAC;aAAS;QACvB;QAEA5D,kCAAkCc,SAAS,UAAUqC;QACrDnD,kCAAkCc,SAAS,SAAS;QAEpD1B,oBAAoBwB,MAAM;YACxBE;YACA+C,iBAAiBrB;YACjBsB,iBAAiB,GAAGvC,kBAAkB,MAAM,CAAC;YAC7C4B;YACAY,WAAW;gBAACtB;aAAe;QAC7B;QAEA,wBAAwB;QACxB,MAAMuB,MAAM,MAAMzE,WAAWqB,MAAMC,QAAQmD,GAAG;QAC9C,MAAM3D,0BAA0BO,MAAM;YAAEoD;QAAI;QAE5C,2FAA2F;QAC3F,MAAMC,gBACJnC,aAAa,UAAU,SAAUA;QAEnC,MAAM9C,cAAc4B,MAAM;YACxBsD,oBAAoB/C;YACpBG;YACA6C,aAAarD,QAAQK,IAAI;YACzBsB;YACAS;YACAc;YACAjC;YACAqC,gBAAgBH;YAChBzB;QACF;IACF;IAEA,mBAAmB;IACnBrD,6BACEyB,MACAJ,aAAa;QACX;QACA;QACA;QACA;QACA;QACA;WACIsB,aAAa,QACZ;YAAC;YAAW;SAAc,GAC3BA,aAAa,UACV;YACC;YACA,6DAA6D;YAC7D,6DAA6D;YAC7D,6DAA6D;YAC7D;YACA;YACA;YACA;YACA;YACA;SACD,GACA;YACC;YACA;YACA;YACA;YACA;SACD;KACR,GACDtB,aAAa;QACX;QACA,uEAAuE;QACvE,sDAAsD;QACtD;QACA;QACA;WACIuB,SAAS,QACR;YAAC;YAAa;SAAgC,GAC9C,EAAE;QACP,0EAA0E;WACtED,aAAa,QAAS;YAAC;SAAc,GAAc,EAAE;WACrDA,aAAa,SAASA,aAAa,UAClC;YAAC;YAAkB;SAAc,GACjC;YAAC;YAAa;SAAc;KAClC,GACDpD,kBAAkBoC,QAAQE,IAAI,EAAE;IAElC7B,6BAA6ByB,MAAM,CAAC,GAAGJ,aAAa;QAAC;KAAM;IAE3D,2FAA2F;IAC3F,sFAAsF;IACtF,MAAM6D,oBAAoBvC,aAAa,QAAQ,OAAO;IACtD,MAAMwC,eAAelE,WAAWQ,MAAME,SAASuD,mBAAmB;QAChEE,WAAW;YAAEC,MAAM/D;YAAyBU,MAAMI;QAAkB;IACtE;IAEA,uEAAuE;IACvE,8DAA8D;IAC9D,yDAAyD;IACzD,MAAMkD,aAAa/F,kBACjBoC,QAAQE,IAAI,EACZ,WACAO;IAEF1C,oBAAoB+B,MAAM;QACxB6D;QACA3C;QACA4C,UAAU;QACVpD;QACAS;QACA4C,qBAAqB,CAAC,MAAM,EAAEnD,sCAAsC;IACtE;IAEA,MAAMoD,UACJ9C,aAAa,SACT,CAAC,eAAe,EAAEwC,aAAa,GAAG,CAAC,GACnCxC,aAAa,UACX,CAAC,iBAAiB,EAAEwC,aAAa,YAAY,CAAC,GAC9C,CAAC,iBAAiB,EAAEA,cAAc;IAC1C,MAAMO,cAAc,CAAC,cAAc,EAAEtD,kBAAkB,QAAQ,CAAC;IAEhE,MAAMuD,eAAe;QACnB,GAAGhE,QAAQuC,OAAO;QAClB,CAAC,GAAG9B,kBAAkB,MAAM,CAAC,CAAC,EAAE;YAC9BiC,UAAU;YACVuB,YAAY;YACZlE,SAAS;gBACP4C,UAAU;oBAAC,CAAC,YAAY,EAAE/B,kBAAkB,SAAS,CAAC;iBAAC;gBACvDsD,KAAK;gBACLC,KAAK;oBACHC,MAAM,GAAGZ,cAAc;gBACzB;YACF;QACF;QACA,CAAC,GAAG/C,kBAAkB,IAAI,CAAC,CAAC,EAAE;YAC5BiC,UAAU;YACVuB,YAAY;YACZlE,SAAS;gBACP4C,UAAU;oBAAC,CAAC,YAAY,EAAE/B,kBAAkB,SAAS,CAAC;iBAAC;gBACvDsD,KAAK;gBACLC,KAAK;oBACHC,MAAM,GAAGZ,cAAc;oBACvBa,WAAW;gBACb;YACF;QACF;QACA,CAAC,GAAG5D,kBAAkB,KAAK,CAAC,CAAC,EAAE;YAC7BiC,UAAU;YACV3C,SAAS;gBACP4C,UAAU;oBAACoB;iBAAY;gBACvBG,KAAK;gBACLC,KAAK;oBACHG,KAAKR;gBACP;YACF;QACF;IACF;IAEA,gEAAgE;IAChE9E,sBAAsBgF,cAAc,GAAGvD,kBAAkB,IAAI,CAAC;IAE9D3C,2BAA2BgC,MAAME,QAAQK,IAAI,EAAE;QAC7C,GAAGL,OAAO;QACV,yEAAyE;QACzE,uBAAuB;QACvBuC,SAASlD,eAAe2E;IAC1B;IAEA/E,8BACEa,MACAE,QAAQK,IAAI,EACZV,yBACAe,sCACAD,mBACA;QAAE8D,MAAMf;QAAcgB,IAAIhE;QAAoBS;QAAMD;IAAS;IAG/D,MAAMrC,gCAAgCmB,MAAM;QAACH;KAAwB;IAErE,MAAMpB,qBAAqBuB;IAC3B,OAAO,IACLpB,oBAAoBoB,MAAMC,QAAQ0E,yBAAyB,EAAE;YAC3DC,WAAW;gBAAC;aAAa;QAC3B;AACJ,EAAE;AAEF,eAAe7E,iBAAiB"}
+{"version":3,"sources":["../../../../../../packages/nx-plugin/src/ts/agent/generator.ts"],"sourcesContent":["/**\n * Copyright Amazon.com, Inc. or its affiliates. All Rights Reserved.\n * SPDX-License-Identifier: Apache-2.0\n */\nimport {\n  type GeneratorCallback,\n  generateFiles,\n  joinPathFragments,\n  OverwriteStrategy,\n  type Tree,\n  updateProjectConfiguration,\n} from '@nx/devkit';\nimport { addAgentChatScripts } from '../../utils/agent-chat/agent-chat';\nimport {\n  addTypeScriptFrameworkBase,\n  ensureTypeScriptAgentConnectionProject,\n} from '../../utils/agent-connection/agent-connection';\nimport { addAgentInfra } from '../../utils/agent-core-constructs/agent-core-constructs';\nimport { addTypeScriptBundleTarget } from '../../utils/bundle/bundle';\nimport { resolveContainers } from '../../utils/containers';\nimport { addDependenciesToPackageJson } from '../../utils/dependencies';\nimport { addDockerScanTarget, nodeImageVersions } from '../../utils/docker';\nimport { formatFilesInSubtree } from '../../utils/format';\nimport { FsCommands } from '../../utils/fs';\nimport { resolveIac } from '../../utils/iac';\nimport { installDependencies } from '../../utils/install';\nimport { addGeneratorMetricsIfApplicable } from '../../utils/metrics';\nimport { esmVars } from '../../utils/module-format';\nimport { kebabCase, toClassName } from '../../utils/names';\nimport { getNpmScope } from '../../utils/npm-scope';\nimport {\n  addComponentDevTarget,\n  addComponentGeneratorMetadata,\n  addDependencyToTargetIfNotPresent,\n  getGeneratorInfo,\n  type NxGeneratorInfo,\n  readProjectConfigurationUnqualified,\n} from '../../utils/nx';\nimport { sortObjectKeys } from '../../utils/object';\nimport { assignPort } from '../../utils/port';\nimport { sharedConstructsGenerator } from '../../utils/shared-constructs';\nimport { BASE_IMAGES, TS_VERSIONS, withVersions } from '../../utils/versions';\nimport type { TsAgentGeneratorSchema } from './schema';\n\nexport const TS_AGENT_GENERATOR_INFO: NxGeneratorInfo = getGeneratorInfo(\n  import.meta.filename,\n);\n\nexport const tsAgentGenerator = async (\n  tree: Tree,\n  options: TsAgentGeneratorSchema,\n): Promise<GeneratorCallback> => {\n  const project = readProjectConfigurationUnqualified(tree, options.project);\n\n  if (!tree.exists(joinPathFragments(project.root, 'tsconfig.json'))) {\n    throw new Error(\n      `Unsupported project ${options.project}. Expected a TypeScript project (with a tsconfig.json)`,\n    );\n  }\n\n  const defaultName = `${kebabCase(project.name.split('/').pop())}-agent`;\n  const name = kebabCase(options.name || defaultName);\n  const agentNameClassName = toClassName(name);\n  const agentTargetPrefix = options.name ? name : 'agent';\n  const targetSourceDirRelativeToProjectRoot = joinPathFragments(\n    'src',\n    agentTargetPrefix,\n  );\n  const targetSourceDir = joinPathFragments(\n    project.root,\n    targetSourceDirRelativeToProjectRoot,\n  );\n  const relativeSourceDir = targetSourceDir.replace(project.root + '/', './');\n  const distDir = joinPathFragments('dist', project.root);\n\n  const infra = options.infra ?? 'agentcore';\n  const protocol = options.protocol ?? 'http';\n\n  if (infra === 'none' && options.auth && options.auth !== 'iam') {\n    console.warn(\n      'Warning: auth is ignored when no infrastructure is configured (no infrastructure is generated)',\n    );\n  }\n\n  const auth = options.auth ?? 'iam';\n\n  // Ensure the shared agent-connection project exists so the server entry\n  // point can import `runWithSessionId` and propagate the AgentCore session\n  // ID to any downstream MCP / A2A clients a later connection generator\n  // wires into this agent.\n  await ensureTypeScriptAgentConnectionProject(tree);\n  // The agent server imports the framework base helpers (session cache + model\n  // error logging) regardless of whether a connection client is wired in.\n  await addTypeScriptFrameworkBase(tree);\n\n  const templateContext = {\n    name,\n    agentNameClassName,\n    distDir,\n    agentConnectionImport: `@${getNpmScope(tree)}/agent-connection`,\n    ...esmVars(tree),\n  };\n\n  // Generate common files shared by both protocols\n  generateFiles(\n    tree,\n    joinPathFragments(import.meta.dirname, 'files', 'common'),\n    targetSourceDir,\n    templateContext,\n    { overwriteStrategy: OverwriteStrategy.KeepExisting },\n  );\n\n  // Generate protocol-specific files\n  generateFiles(\n    tree,\n    joinPathFragments(import.meta.dirname, 'files', protocol.toLowerCase()),\n    targetSourceDir,\n    templateContext,\n    { overwriteStrategy: OverwriteStrategy.KeepExisting },\n  );\n\n  if (infra === 'agentcore') {\n    const containers = await resolveContainers(tree, 'inherit');\n    const dockerImageTag = `${getNpmScope(tree)}-${name}:latest`;\n\n    // Add bundle target\n    await addTypeScriptBundleTarget(tree, project, {\n      targetFilePath: `${targetSourceDirRelativeToProjectRoot}/index.ts`,\n      bundleOutputDir: joinPathFragments('agent', name),\n    });\n\n    // Add the Dockerfile\n    generateFiles(\n      tree,\n      joinPathFragments(import.meta.dirname, 'files', 'deploy'),\n      targetSourceDir,\n      {\n        distDir,\n        name,\n        protocol,\n        adotVersion:\n          TS_VERSIONS['@aws/aws-distro-opentelemetry-node-autoinstrumentation'],\n        jaegerVersion: TS_VERSIONS['@opentelemetry/propagator-jaeger'],\n        nodeBaseImage: BASE_IMAGES.node,\n        ...nodeImageVersions(),\n        ...esmVars(tree),\n      },\n      { overwriteStrategy: OverwriteStrategy.KeepExisting },\n    );\n\n    const dockerOutputDir = joinPathFragments(\n      'dist',\n      project.root,\n      'bundle',\n      'agent',\n      name,\n    );\n    const dockerTargetName = `${agentTargetPrefix}-docker`;\n\n    const fs = new FsCommands(tree);\n    project.targets[dockerTargetName] = {\n      cache: true,\n      outputs: [`{workspaceRoot}/${dockerOutputDir}/Dockerfile`],\n      executor: 'nx:run-commands',\n      options: {\n        commands: [\n          fs.cp(\n            `${targetSourceDir}/Dockerfile`,\n            `${dockerOutputDir}/Dockerfile`,\n          ),\n          `${containers} build --platform linux/arm64 -t ${dockerImageTag} ${dockerOutputDir}`,\n        ],\n        parallel: false,\n      },\n      dependsOn: ['bundle'],\n    };\n\n    addDependencyToTargetIfNotPresent(project, 'docker', dockerTargetName);\n    addDependencyToTargetIfNotPresent(project, 'build', 'docker');\n\n    addDockerScanTarget(tree, {\n      project,\n      containerEngine: containers,\n      trivyTargetName: `${agentTargetPrefix}-trivy`,\n      dockerTargetName,\n      imageTags: [dockerImageTag],\n    });\n\n    // Add shared constructs\n    const iac = await resolveIac(tree, options.iac);\n    await sharedConstructsGenerator(tree, { iac });\n\n    // AG-UI uses HTTP as the AgentCore protocol type (AG-UI is HTTP-based with SSE over POST).\n    const infraProtocol: 'http' | 'a2a' =\n      protocol === 'ag-ui' ? 'http' : (protocol as 'http' | 'a2a');\n\n    await addAgentInfra(tree, {\n      agentNameKebabCase: name,\n      agentNameClassName,\n      projectName: project.name,\n      dockerImageTag,\n      dockerOutputDir,\n      iac,\n      auth,\n      serverProtocol: infraProtocol,\n      containers,\n    });\n  }\n\n  // Add dependencies\n  addDependenciesToPackageJson(\n    tree,\n    withVersions([\n      'zod',\n      '@strands-agents/sdk',\n      '@aws-sdk/credential-providers',\n      '@aws-sdk/client-appconfigdata',\n      '@aws-lambda-powertools/parameters',\n      '@modelcontextprotocol/sdk',\n      ...(protocol === 'a2a'\n        ? (['express', '@a2a-js/sdk'] as const)\n        : protocol === 'ag-ui'\n          ? ([\n              '@ag-ui/aws-strands',\n              // @ag-ui/aws-strands declares these as peer dependencies but\n              // statically imports them, so they must be installed for the\n              // bundler to resolve and inline them into the runtime image.\n              '@ag-ui/a2ui-toolkit',\n              '@ag-ui/client',\n              '@ag-ui/core',\n              '@ag-ui/encoder',\n              'express',\n              'cors',\n            ] as const)\n          : ([\n              '@trpc/server',\n              '@trpc/client',\n              'ws',\n              'cors',\n              'aws4fetch',\n            ] as const)),\n    ]),\n    withVersions([\n      '@types/node',\n      // The chat CLI runs standalone via tsx and resolves the deployed agent\n      // from AppConfig when `RUNTIME_CONFIG_APP_ID` is set.\n      'agent-chat-cli',\n      '@aws-lambda-powertools/parameters',\n      '@aws-sdk/client-appconfigdata',\n      ...(auth === 'iam'\n        ? (['aws4fetch', '@aws-sdk/credential-providers'] as const)\n        : ([] as const)),\n      // A2A chat builds a signed @a2a-js client factory for the deployed agent.\n      ...(protocol === 'a2a' ? (['@a2a-js/sdk'] as const) : ([] as const)),\n      ...(protocol === 'a2a' || protocol === 'ag-ui'\n        ? (['@types/express', '@types/cors'] as const)\n        : (['@types/ws', '@types/cors'] as const)),\n    ]),\n    joinPathFragments(project.root, 'package.json'),\n  );\n  addDependenciesToPackageJson(tree, {}, withVersions(['tsx']));\n\n  // A2A servers use port 9000 as per the Strands A2A SDK default and AgentCore A2A contract.\n  // HTTP and AG-UI agents use port 8081+ to avoid conflict with VS Code server on 8080.\n  const localDevPortStart = protocol === 'a2a' ? 9000 : 8081;\n  const localDevPort = assignPort(tree, project, localDevPortStart, {\n    component: { info: TS_AGENT_GENERATOR_INFO, name: agentTargetPrefix },\n  });\n\n  // Every protocol gets a standalone `chat.ts`. It connects to the local\n  // `dev` server by default, or to the deployed agent (with the\n  // appropriate auth) when `RUNTIME_CONFIG_APP_ID` is set.\n  const scriptsDir = joinPathFragments(\n    project.root,\n    'scripts',\n    agentTargetPrefix,\n  );\n  addAgentChatScripts(tree, {\n    scriptsDir,\n    protocol,\n    language: 'ts',\n    agentNameClassName,\n    auth,\n    relativeAgentImport: `../../${targetSourceDirRelativeToProjectRoot}`,\n  });\n\n  const chatUrl =\n    protocol === 'http'\n      ? `ws://localhost:${localDevPort}/ws`\n      : protocol === 'ag-ui'\n        ? `http://localhost:${localDevPort}/invocations`\n        : `http://localhost:${localDevPort}`;\n  const chatCommand = `tsx ./scripts/${agentTargetPrefix}/chat.ts`;\n\n  const agentTargets = {\n    ...project.targets,\n    [`${agentTargetPrefix}-serve`]: {\n      executor: 'nx:run-commands',\n      continuous: true,\n      options: {\n        commands: [`tsx --watch ${relativeSourceDir}/index.ts`],\n        cwd: '{projectRoot}',\n        env: {\n          PORT: `${localDevPort}`,\n        },\n      },\n    },\n    [`${agentTargetPrefix}-dev`]: {\n      executor: 'nx:run-commands',\n      continuous: true,\n      options: {\n        commands: [`tsx --watch ${relativeSourceDir}/index.ts`],\n        cwd: '{projectRoot}',\n        env: {\n          PORT: `${localDevPort}`,\n          LOCAL_DEV: 'true',\n        },\n      },\n    },\n    [`${agentTargetPrefix}-chat`]: {\n      executor: 'nx:run-commands',\n      options: {\n        commands: [chatCommand],\n        cwd: '{projectRoot}',\n        env: {\n          URL: chatUrl,\n        },\n      },\n    },\n  };\n\n  // Aggregate `<agent>-dev` under the project-level `dev` target.\n  addComponentDevTarget(agentTargets, `${agentTargetPrefix}-dev`);\n\n  updateProjectConfiguration(tree, project.name, {\n    ...project,\n    // Sort targets so their order is stable regardless of insertion order on\n    // first run vs re-run.\n    targets: sortObjectKeys(agentTargets),\n  });\n\n  addComponentGeneratorMetadata(\n    tree,\n    project.name,\n    TS_AGENT_GENERATOR_INFO,\n    targetSourceDirRelativeToProjectRoot,\n    agentTargetPrefix,\n    { port: localDevPort, rc: agentNameClassName, auth, protocol },\n  );\n\n  await addGeneratorMetricsIfApplicable(tree, [TS_AGENT_GENERATOR_INFO]);\n\n  await formatFilesInSubtree(tree);\n  return () =>\n    installDependencies(tree, options.preferInstallDependencies, {\n      languages: ['typescript'],\n    });\n};\n\nexport default tsAgentGenerator;\n"],"names":["generateFiles","joinPathFragments","OverwriteStrategy","updateProjectConfiguration","addAgentChatScripts","addTypeScriptFrameworkBase","ensureTypeScriptAgentConnectionProject","addAgentInfra","addTypeScriptBundleTarget","resolveContainers","addDependenciesToPackageJson","addDockerScanTarget","nodeImageVersions","formatFilesInSubtree","FsCommands","resolveIac","installDependencies","addGeneratorMetricsIfApplicable","esmVars","kebabCase","toClassName","getNpmScope","addComponentDevTarget","addComponentGeneratorMetadata","addDependencyToTargetIfNotPresent","getGeneratorInfo","readProjectConfigurationUnqualified","sortObjectKeys","assignPort","sharedConstructsGenerator","BASE_IMAGES","TS_VERSIONS","withVersions","TS_AGENT_GENERATOR_INFO","filename","tsAgentGenerator","tree","options","project","exists","root","Error","defaultName","name","split","pop","agentNameClassName","agentTargetPrefix","targetSourceDirRelativeToProjectRoot","targetSourceDir","relativeSourceDir","replace","distDir","infra","protocol","auth","console","warn","templateContext","agentConnectionImport","dirname","overwriteStrategy","KeepExisting","toLowerCase","containers","dockerImageTag","targetFilePath","bundleOutputDir","adotVersion","jaegerVersion","nodeBaseImage","node","dockerOutputDir","dockerTargetName","fs","targets","cache","outputs","executor","commands","cp","parallel","dependsOn","containerEngine","trivyTargetName","imageTags","iac","infraProtocol","agentNameKebabCase","projectName","serverProtocol","localDevPortStart","localDevPort","component","info","scriptsDir","language","relativeAgentImport","chatUrl","chatCommand","agentTargets","continuous","cwd","env","PORT","LOCAL_DEV","URL","port","rc","preferInstallDependencies","languages"],"mappings":"AAAA;;;CAGC,GACD,SAEEA,aAAa,EACbC,iBAAiB,EACjBC,iBAAiB,EAEjBC,0BAA0B,QACrB,aAAa;AACpB,SAASC,mBAAmB,QAAQ,uCAAoC;AACxE,SACEC,0BAA0B,EAC1BC,sCAAsC,QACjC,mDAAgD;AACvD,SAASC,aAAa,QAAQ,6DAA0D;AACxF,SAASC,yBAAyB,QAAQ,+BAA4B;AACtE,SAASC,iBAAiB,QAAQ,4BAAyB;AAC3D,SAASC,4BAA4B,QAAQ,8BAA2B;AACxE,SAASC,mBAAmB,EAAEC,iBAAiB,QAAQ,wBAAqB;AAC5E,SAASC,oBAAoB,QAAQ,wBAAqB;AAC1D,SAASC,UAAU,QAAQ,oBAAiB;AAC5C,SAASC,UAAU,QAAQ,qBAAkB;AAC7C,SAASC,mBAAmB,QAAQ,yBAAsB;AAC1D,SAASC,+BAA+B,QAAQ,yBAAsB;AACtE,SAASC,OAAO,QAAQ,+BAA4B;AACpD,SAASC,SAAS,EAAEC,WAAW,QAAQ,uBAAoB;AAC3D,SAASC,WAAW,QAAQ,2BAAwB;AACpD,SACEC,qBAAqB,EACrBC,6BAA6B,EAC7BC,iCAAiC,EACjCC,gBAAgB,EAEhBC,mCAAmC,QAC9B,oBAAiB;AACxB,SAASC,cAAc,QAAQ,wBAAqB;AACpD,SAASC,UAAU,QAAQ,sBAAmB;AAC9C,SAASC,yBAAyB,QAAQ,mCAAgC;AAC1E,SAASC,WAAW,EAAEC,WAAW,EAAEC,YAAY,QAAQ,0BAAuB;AAG9E,OAAO,MAAMC,0BAA2CR,iBACtD,YAAYS,QAAQ,EACpB;AAEF,OAAO,MAAMC,mBAAmB,OAC9BC,MACAC;IAEA,MAAMC,UAAUZ,oCAAoCU,MAAMC,QAAQC,OAAO;IAEzE,IAAI,CAACF,KAAKG,MAAM,CAACtC,kBAAkBqC,QAAQE,IAAI,EAAE,mBAAmB;QAClE,MAAM,IAAIC,MACR,CAAC,oBAAoB,EAAEJ,QAAQC,OAAO,CAAC,sDAAsD,CAAC;IAElG;IAEA,MAAMI,cAAc,GAAGvB,UAAUmB,QAAQK,IAAI,CAACC,KAAK,CAAC,KAAKC,GAAG,IAAI,MAAM,CAAC;IACvE,MAAMF,OAAOxB,UAAUkB,QAAQM,IAAI,IAAID;IACvC,MAAMI,qBAAqB1B,YAAYuB;IACvC,MAAMI,oBAAoBV,QAAQM,IAAI,GAAGA,OAAO;IAChD,MAAMK,uCAAuC/C,kBAC3C,OACA8C;IAEF,MAAME,kBAAkBhD,kBACtBqC,QAAQE,IAAI,EACZQ;IAEF,MAAME,oBAAoBD,gBAAgBE,OAAO,CAACb,QAAQE,IAAI,GAAG,KAAK;IACtE,MAAMY,UAAUnD,kBAAkB,QAAQqC,QAAQE,IAAI;IAEtD,MAAMa,QAAQhB,QAAQgB,KAAK,IAAI;IAC/B,MAAMC,WAAWjB,QAAQiB,QAAQ,IAAI;IAErC,IAAID,UAAU,UAAUhB,QAAQkB,IAAI,IAAIlB,QAAQkB,IAAI,KAAK,OAAO;QAC9DC,QAAQC,IAAI,CACV;IAEJ;IAEA,MAAMF,OAAOlB,QAAQkB,IAAI,IAAI;IAE7B,wEAAwE;IACxE,0EAA0E;IAC1E,sEAAsE;IACtE,yBAAyB;IACzB,MAAMjD,uCAAuC8B;IAC7C,6EAA6E;IAC7E,wEAAwE;IACxE,MAAM/B,2BAA2B+B;IAEjC,MAAMsB,kBAAkB;QACtBf;QACAG;QACAM;QACAO,uBAAuB,CAAC,CAAC,EAAEtC,YAAYe,MAAM,iBAAiB,CAAC;QAC/D,GAAGlB,QAAQkB,KAAK;IAClB;IAEA,iDAAiD;IACjDpC,cACEoC,MACAnC,kBAAkB,YAAY2D,OAAO,EAAE,SAAS,WAChDX,iBACAS,iBACA;QAAEG,mBAAmB3D,kBAAkB4D,YAAY;IAAC;IAGtD,mCAAmC;IACnC9D,cACEoC,MACAnC,kBAAkB,YAAY2D,OAAO,EAAE,SAASN,SAASS,WAAW,KACpEd,iBACAS,iBACA;QAAEG,mBAAmB3D,kBAAkB4D,YAAY;IAAC;IAGtD,IAAIT,UAAU,aAAa;QACzB,MAAMW,aAAa,MAAMvD,kBAAkB2B,MAAM;QACjD,MAAM6B,iBAAiB,GAAG5C,YAAYe,MAAM,CAAC,EAAEO,KAAK,OAAO,CAAC;QAE5D,oBAAoB;QACpB,MAAMnC,0BAA0B4B,MAAME,SAAS;YAC7C4B,gBAAgB,GAAGlB,qCAAqC,SAAS,CAAC;YAClEmB,iBAAiBlE,kBAAkB,SAAS0C;QAC9C;QAEA,qBAAqB;QACrB3C,cACEoC,MACAnC,kBAAkB,YAAY2D,OAAO,EAAE,SAAS,WAChDX,iBACA;YACEG;YACAT;YACAW;YACAc,aACErC,WAAW,CAAC,yDAAyD;YACvEsC,eAAetC,WAAW,CAAC,mCAAmC;YAC9DuC,eAAexC,YAAYyC,IAAI;YAC/B,GAAG3D,mBAAmB;YACtB,GAAGM,QAAQkB,KAAK;QAClB,GACA;YAAEyB,mBAAmB3D,kBAAkB4D,YAAY;QAAC;QAGtD,MAAMU,kBAAkBvE,kBACtB,QACAqC,QAAQE,IAAI,EACZ,UACA,SACAG;QAEF,MAAM8B,mBAAmB,GAAG1B,kBAAkB,OAAO,CAAC;QAEtD,MAAM2B,KAAK,IAAI5D,WAAWsB;QAC1BE,QAAQqC,OAAO,CAACF,iBAAiB,GAAG;YAClCG,OAAO;YACPC,SAAS;gBAAC,CAAC,gBAAgB,EAAEL,gBAAgB,WAAW,CAAC;aAAC;YAC1DM,UAAU;YACVzC,SAAS;gBACP0C,UAAU;oBACRL,GAAGM,EAAE,CACH,GAAG/B,gBAAgB,WAAW,CAAC,EAC/B,GAAGuB,gBAAgB,WAAW,CAAC;oBAEjC,GAAGR,WAAW,iCAAiC,EAAEC,eAAe,CAAC,EAAEO,iBAAiB;iBACrF;gBACDS,UAAU;YACZ;YACAC,WAAW;gBAAC;aAAS;QACvB;QAEA1D,kCAAkCc,SAAS,UAAUmC;QACrDjD,kCAAkCc,SAAS,SAAS;QAEpD3B,oBAAoByB,MAAM;YACxBE;YACA6C,iBAAiBnB;YACjBoB,iBAAiB,GAAGrC,kBAAkB,MAAM,CAAC;YAC7C0B;YACAY,WAAW;gBAACpB;aAAe;QAC7B;QAEA,wBAAwB;QACxB,MAAMqB,MAAM,MAAMvE,WAAWqB,MAAMC,QAAQiD,GAAG;QAC9C,MAAMzD,0BAA0BO,MAAM;YAAEkD;QAAI;QAE5C,2FAA2F;QAC3F,MAAMC,gBACJjC,aAAa,UAAU,SAAUA;QAEnC,MAAM/C,cAAc6B,MAAM;YACxBoD,oBAAoB7C;YACpBG;YACA2C,aAAanD,QAAQK,IAAI;YACzBsB;YACAO;YACAc;YACA/B;YACAmC,gBAAgBH;YAChBvB;QACF;IACF;IAEA,mBAAmB;IACnBtD,6BACE0B,MACAJ,aAAa;QACX;QACA;QACA;QACA;QACA;QACA;WACIsB,aAAa,QACZ;YAAC;YAAW;SAAc,GAC3BA,aAAa,UACV;YACC;YACA,6DAA6D;YAC7D,6DAA6D;YAC7D,6DAA6D;YAC7D;YACA;YACA;YACA;YACA;YACA;SACD,GACA;YACC;YACA;YACA;YACA;YACA;SACD;KACR,GACDtB,aAAa;QACX;QACA,uEAAuE;QACvE,sDAAsD;QACtD;QACA;QACA;WACIuB,SAAS,QACR;YAAC;YAAa;SAAgC,GAC9C,EAAE;QACP,0EAA0E;WACtED,aAAa,QAAS;YAAC;SAAc,GAAc,EAAE;WACrDA,aAAa,SAASA,aAAa,UAClC;YAAC;YAAkB;SAAc,GACjC;YAAC;YAAa;SAAc;KAClC,GACDrD,kBAAkBqC,QAAQE,IAAI,EAAE;IAElC9B,6BAA6B0B,MAAM,CAAC,GAAGJ,aAAa;QAAC;KAAM;IAE3D,2FAA2F;IAC3F,sFAAsF;IACtF,MAAM2D,oBAAoBrC,aAAa,QAAQ,OAAO;IACtD,MAAMsC,eAAehE,WAAWQ,MAAME,SAASqD,mBAAmB;QAChEE,WAAW;YAAEC,MAAM7D;YAAyBU,MAAMI;QAAkB;IACtE;IAEA,uEAAuE;IACvE,8DAA8D;IAC9D,yDAAyD;IACzD,MAAMgD,aAAa9F,kBACjBqC,QAAQE,IAAI,EACZ,WACAO;IAEF3C,oBAAoBgC,MAAM;QACxB2D;QACAzC;QACA0C,UAAU;QACVlD;QACAS;QACA0C,qBAAqB,CAAC,MAAM,EAAEjD,sCAAsC;IACtE;IAEA,MAAMkD,UACJ5C,aAAa,SACT,CAAC,eAAe,EAAEsC,aAAa,GAAG,CAAC,GACnCtC,aAAa,UACX,CAAC,iBAAiB,EAAEsC,aAAa,YAAY,CAAC,GAC9C,CAAC,iBAAiB,EAAEA,cAAc;IAC1C,MAAMO,cAAc,CAAC,cAAc,EAAEpD,kBAAkB,QAAQ,CAAC;IAEhE,MAAMqD,eAAe;QACnB,GAAG9D,QAAQqC,OAAO;QAClB,CAAC,GAAG5B,kBAAkB,MAAM,CAAC,CAAC,EAAE;YAC9B+B,UAAU;YACVuB,YAAY;YACZhE,SAAS;gBACP0C,UAAU;oBAAC,CAAC,YAAY,EAAE7B,kBAAkB,SAAS,CAAC;iBAAC;gBACvDoD,KAAK;gBACLC,KAAK;oBACHC,MAAM,GAAGZ,cAAc;gBACzB;YACF;QACF;QACA,CAAC,GAAG7C,kBAAkB,IAAI,CAAC,CAAC,EAAE;YAC5B+B,UAAU;YACVuB,YAAY;YACZhE,SAAS;gBACP0C,UAAU;oBAAC,CAAC,YAAY,EAAE7B,kBAAkB,SAAS,CAAC;iBAAC;gBACvDoD,KAAK;gBACLC,KAAK;oBACHC,MAAM,GAAGZ,cAAc;oBACvBa,WAAW;gBACb;YACF;QACF;QACA,CAAC,GAAG1D,kBAAkB,KAAK,CAAC,CAAC,EAAE;YAC7B+B,UAAU;YACVzC,SAAS;gBACP0C,UAAU;oBAACoB;iBAAY;gBACvBG,KAAK;gBACLC,KAAK;oBACHG,KAAKR;gBACP;YACF;QACF;IACF;IAEA,gEAAgE;IAChE5E,sBAAsB8E,cAAc,GAAGrD,kBAAkB,IAAI,CAAC;IAE9D5C,2BAA2BiC,MAAME,QAAQK,IAAI,EAAE;QAC7C,GAAGL,OAAO;QACV,yEAAyE;QACzE,uBAAuB;QACvBqC,SAAShD,eAAeyE;IAC1B;IAEA7E,8BACEa,MACAE,QAAQK,IAAI,EACZV,yBACAe,sCACAD,mBACA;QAAE4D,MAAMf;QAAcgB,IAAI9D;QAAoBS;QAAMD;IAAS;IAG/D,MAAMrC,gCAAgCmB,MAAM;QAACH;KAAwB;IAErE,MAAMpB,qBAAqBuB;IAC3B,OAAO,IACLpB,oBAAoBoB,MAAMC,QAAQwE,yBAAyB,EAAE;YAC3DC,WAAW;gBAAC;aAAa;QAC3B;AACJ,EAAE;AAEF,eAAe3E,iBAAiB"}

package/src/ts/mcp-server/files/Dockerfile.template

@@ -7,11 +7,15 @@ WORKDIR /app
 
 # Add AWS Distro for OpenTelemetry for observability
 # https://docs.aws.amazon.com/bedrock-agentcore/latest/devguide/observability-configure.html
-# The override pins @opentelemetry/propagator-jaeger above the version the
-# autoinstrumentation package resolves transitively, clearing CVE-2026-59892.
+# The overrides pin transitive dependencies with known HIGH/CRITICAL
+# vulnerabilities to fixed versions. npm is removed once the install is done —
+# the runtime only needs node, and npm's own bundled dependencies would
+# otherwise carry vulnerabilities into the image.
 RUN npm init -y \
   && npm pkg set "overrides.@opentelemetry/propagator-jaeger=<%- jaegerVersion %>" \
-  && npm install @aws/aws-distro-opentelemetry-node-autoinstrumentation@<%- adotVersion %>
+  && npm pkg set "overrides.minimatch=<%- minimatchVersion %>" \
+  && npm install @aws/aws-distro-opentelemetry-node-autoinstrumentation@<%- adotVersion %> \
+  && npm uninstall -g npm
 
 # Copy bundled streamable http server
 COPY index.js /app

package/src/ts/mcp-server/generator.js

@@ -8,7 +8,7 @@ import { addMcpServerInfra } from "../../utils/agent-core-constructs/agent-core-
 import { addTypeScriptBundleTarget } from "../../utils/bundle/bundle.js";
 import { resolveContainers } from "../../utils/containers.js";
 import { addDependenciesToPackageJson } from "../../utils/dependencies.js";
-import { addDockerScanTarget } from "../../utils/docker.js";
+import { addDockerScanTarget, nodeImageVersions } from "../../utils/docker.js";
 import { formatFilesInSubtree } from "../../utils/format.js";
 import { FsCommands } from "../../utils/fs.js";
 import { resolveIac } from "../../utils/iac.js";
@@ -53,7 +53,7 @@ export const tsMcpServerGenerator = async (tree, options)=>{
         adotVersion: TS_VERSIONS['@aws/aws-distro-opentelemetry-node-autoinstrumentation'],
         jaegerVersion: TS_VERSIONS['@opentelemetry/propagator-jaeger'],
         nodeBaseImage: BASE_IMAGES.node,
-        npmVersion: TS_VERSIONS.npm
+        ...nodeImageVersions()
     }, {
         overwriteStrategy: OverwriteStrategy.KeepExisting
     });

package/src/ts/mcp-server/generator.js.map

@@ -1 +1 @@
-{"version":3,"sources":["../../../../../../packages/nx-plugin/src/ts/mcp-server/generator.ts"],"sourcesContent":["/**\n * Copyright Amazon.com, Inc. or its affiliates. All Rights Reserved.\n * SPDX-License-Identifier: Apache-2.0\n */\nimport {\n  detectPackageManager,\n  type GeneratorCallback,\n  generateFiles,\n  joinPathFragments,\n  OverwriteStrategy,\n  readJson,\n  type Tree,\n  updateJson,\n  updateProjectConfiguration,\n} from '@nx/devkit';\nimport { ensureLicenseExceptions } from '../../license/config';\nimport { MCP_INSPECTOR_EXCEPTIONS } from '../../license/known-exceptions';\nimport { addMcpServerInfra } from '../../utils/agent-core-constructs/agent-core-constructs';\nimport { addTypeScriptBundleTarget } from '../../utils/bundle/bundle';\nimport { resolveContainers } from '../../utils/containers';\nimport { addDependenciesToPackageJson } from '../../utils/dependencies';\nimport { addDockerScanTarget } from '../../utils/docker';\nimport { formatFilesInSubtree } from '../../utils/format';\nimport { FsCommands } from '../../utils/fs';\nimport { resolveIac } from '../../utils/iac';\nimport { installDependencies } from '../../utils/install';\nimport { addGeneratorMetricsIfApplicable } from '../../utils/metrics';\nimport { isEsmWorkspace } from '../../utils/module-format';\nimport { kebabCase, toClassName } from '../../utils/names';\nimport { getNpmScope } from '../../utils/npm-scope';\nimport {\n  addComponentDevTarget,\n  addComponentGeneratorMetadata,\n  addDependencyToTargetIfNotPresent,\n  getGeneratorInfo,\n  type NxGeneratorInfo,\n  readProjectConfigurationUnqualified,\n} from '../../utils/nx';\nimport { sortObjectKeys } from '../../utils/object';\nimport { assignPort } from '../../utils/port';\nimport { sharedConstructsGenerator } from '../../utils/shared-constructs';\nimport { BASE_IMAGES, TS_VERSIONS, withVersions } from '../../utils/versions';\nimport type { TsMcpServerGeneratorSchema } from './schema';\n\nexport const TS_MCP_SERVER_GENERATOR_INFO: NxGeneratorInfo = getGeneratorInfo(\n  import.meta.filename,\n);\n\nexport const tsMcpServerGenerator = async (\n  tree: Tree,\n  options: TsMcpServerGeneratorSchema,\n): Promise<GeneratorCallback> => {\n  const project = readProjectConfigurationUnqualified(tree, options.project);\n\n  if (!tree.exists(joinPathFragments(project.root, 'tsconfig.json'))) {\n    throw new Error(\n      `Unsupported project ${options.project}. Expected a TypeScript project (with a tsconfig.json)`,\n    );\n  }\n\n  const defaultName = `${kebabCase(project.name.split('/').pop())}-mcp-server`;\n  const name = kebabCase(options.name || defaultName);\n  const mcpServerNameClassName = toClassName(name);\n  const mcpTargetPrefix = options.name ? name : 'mcp-server';\n  const targetSourceDirRelativeToProjectRoot = joinPathFragments(\n    'src',\n    mcpTargetPrefix,\n  );\n  const targetSourceDir = joinPathFragments(\n    project.root,\n    targetSourceDirRelativeToProjectRoot,\n  );\n  const relativeSourceDir = targetSourceDir.replace(project.root + '/', './');\n  const distDir = joinPathFragments('dist', project.root);\n\n  const infra = options.infra ?? 'agentcore';\n\n  if (infra === 'none' && options.auth && options.auth !== 'iam') {\n    console.warn(\n      'Warning: auth is ignored when no infrastructure is configured (no infrastructure is generated)',\n    );\n  }\n\n  const auth = options.auth ?? 'iam';\n\n  const projectPackageJsonPath = joinPathFragments(\n    project.root,\n    'package.json',\n  );\n\n  // Generate esm if the project's package.json is `type: module`, falling\n  // back to the workspace format when the project has no manifest.\n  const esm = tree.exists(projectPackageJsonPath)\n    ? readJson(tree, projectPackageJsonPath).type === 'module'\n    : isEsmWorkspace(tree);\n\n  // Generate example server\n  generateFiles(\n    tree,\n    joinPathFragments(import.meta.dirname, 'files'),\n    targetSourceDir,\n    {\n      name,\n      esm,\n      distDir,\n      adotVersion:\n        TS_VERSIONS['@aws/aws-distro-opentelemetry-node-autoinstrumentation'],\n      jaegerVersion: TS_VERSIONS['@opentelemetry/propagator-jaeger'],\n      nodeBaseImage: BASE_IMAGES.node,\n      npmVersion: TS_VERSIONS.npm,\n    },\n    { overwriteStrategy: OverwriteStrategy.KeepExisting },\n  );\n\n  // Add dependencies\n  const deps = withVersions([\n    '@modelcontextprotocol/sdk',\n    'zod',\n    'express',\n    '@aws-lambda-powertools/parameters',\n    '@aws-sdk/client-appconfigdata',\n  ]);\n  const devDeps = withVersions(['@types/express']);\n  // tsx (local dev) and the MCP inspector are shared tooling.\n  const rootDevDeps = withVersions(['tsx', '@modelcontextprotocol/inspector']);\n\n  // Add hosting based on infra\n  if (infra === 'agentcore') {\n    const containers = await resolveContainers(tree, 'inherit');\n    const dockerImageTag = `${getNpmScope(tree)}-${name}:latest`;\n\n    // Add bundle target\n    await addTypeScriptBundleTarget(tree, project, {\n      targetFilePath: `${targetSourceDirRelativeToProjectRoot}/http.ts`,\n      bundleOutputDir: joinPathFragments('mcp', name),\n    });\n\n    const dockerOutputDir = joinPathFragments(\n      'dist',\n      project.root,\n      'bundle',\n      'mcp',\n      name,\n    );\n    const dockerTargetName = `${mcpTargetPrefix}-docker`;\n\n    const fs = new FsCommands(tree);\n    project.targets[dockerTargetName] = {\n      cache: true,\n      outputs: [`{workspaceRoot}/${dockerOutputDir}/Dockerfile`],\n      executor: 'nx:run-commands',\n      options: {\n        commands: [\n          fs.cp(\n            `${targetSourceDir}/Dockerfile`,\n            `${dockerOutputDir}/Dockerfile`,\n          ),\n          `${containers} build --platform linux/arm64 -t ${dockerImageTag} ${dockerOutputDir}`,\n        ],\n        parallel: false,\n      },\n      dependsOn: ['bundle'],\n    };\n\n    addDependencyToTargetIfNotPresent(project, 'docker', dockerTargetName);\n    addDependencyToTargetIfNotPresent(project, 'build', 'docker');\n\n    addDockerScanTarget(tree, {\n      project,\n      containerEngine: containers,\n      trivyTargetName: `${mcpTargetPrefix}-trivy`,\n      dockerTargetName,\n      imageTags: [dockerImageTag],\n    });\n\n    // Add shared constructs\n    const iac = await resolveIac(tree, options.iac);\n    await sharedConstructsGenerator(tree, { iac });\n\n    // Add the construct to deploy the mcp server\n    await addMcpServerInfra(tree, {\n      mcpServerNameKebabCase: name,\n      mcpServerNameClassName,\n      projectName: project.name,\n      dockerImageTag,\n      dockerOutputDir,\n      iac,\n      auth,\n      containers,\n    });\n  } else {\n    // No Dockerfile needed for non-hosted MCP\n    tree.delete(joinPathFragments(targetSourceDir, 'Dockerfile'));\n  }\n\n  // Runtime deps go in the project manifest; shared tooling goes to the root.\n  addDependenciesToPackageJson(tree, deps, devDeps, projectPackageJsonPath);\n  addDependenciesToPackageJson(tree, {}, rootDevDeps);\n\n  // @modelcontextprotocol/sdk declares zod as a peer dependency with a wide range\n  // (^3.25 || ^4.0). Yarn does not dedupe the peer to the workspace's pinned zod, so\n  // without a resolution it installs a separate zod under the SDK's own node_modules.\n  // The two zod copies have structurally incompatible types, which breaks type\n  // inference for registerTool inputSchema. Scope the resolution to the SDK so\n  // other consumers (e.g. @tanstack/router-generator pinning zod@3) are unaffected.\n  if (detectPackageManager() === 'yarn') {\n    updateJson(tree, 'package.json', (packageJson) => {\n      packageJson.resolutions = {\n        ...packageJson.resolutions,\n        '**/@modelcontextprotocol/sdk/zod': TS_VERSIONS['zod'],\n      };\n      return packageJson;\n    });\n  }\n\n  const localDevPort = assignPort(tree, project, 8000, {\n    component: { info: TS_MCP_SERVER_GENERATOR_INFO, name: mcpTargetPrefix },\n  });\n\n  const mcpTargets = {\n    ...project.targets,\n    // Add targets for running the MCP server\n    [`${mcpTargetPrefix}-serve-stdio`]: {\n      executor: 'nx:run-commands',\n      continuous: true,\n      options: {\n        commands: [`tsx --watch ${relativeSourceDir}/stdio.ts`],\n        cwd: '{projectRoot}',\n      },\n    },\n    [`${mcpTargetPrefix}-serve`]: {\n      executor: 'nx:run-commands',\n      continuous: true,\n      options: {\n        commands: [`tsx --watch ${relativeSourceDir}/http.ts`],\n        cwd: '{projectRoot}',\n        env: {\n          PORT: `${localDevPort}`,\n        },\n      },\n    },\n    [`${mcpTargetPrefix}-dev`]: {\n      executor: 'nx:run-commands',\n      continuous: true,\n      options: {\n        commands: [`tsx --watch ${relativeSourceDir}/http.ts`],\n        cwd: '{projectRoot}',\n        env: {\n          PORT: `${localDevPort}`,\n          LOCAL_DEV: 'true',\n        },\n      },\n    },\n    [`${mcpTargetPrefix}-inspect`]: {\n      executor: 'nx:run-commands',\n      continuous: true,\n      // Launch the inspector against the locally served HTTP server. The dev\n      // target starts the server and any connected dependencies (e.g. a local\n      // database).\n      dependsOn: [`${mcpTargetPrefix}-dev`],\n      options: {\n        commands: [\n          `mcp-inspector --transport http --server-url http://localhost:${localDevPort}/mcp`,\n        ],\n        cwd: '{projectRoot}',\n      },\n    },\n    [`${mcpTargetPrefix}-inspect-stdio`]: {\n      executor: 'nx:run-commands',\n      continuous: true,\n      options: {\n        commands: [\n          `mcp-inspector -- tsx --watch ${relativeSourceDir}/stdio.ts`,\n        ],\n        cwd: '{projectRoot}',\n      },\n    },\n  };\n\n  // Aggregate `<mcp>-dev` under the project-level `dev` target.\n  addComponentDevTarget(mcpTargets, `${mcpTargetPrefix}-dev`);\n\n  updateProjectConfiguration(tree, project.name, {\n    ...project,\n    // Sort targets so their order is stable regardless of insertion order on\n    // first run vs re-run.\n    targets: sortObjectKeys(mcpTargets),\n  });\n\n  addComponentGeneratorMetadata(\n    tree,\n    project.name,\n    TS_MCP_SERVER_GENERATOR_INFO,\n    targetSourceDirRelativeToProjectRoot,\n    mcpTargetPrefix,\n    {\n      port: localDevPort,\n      rc: mcpServerNameClassName,\n      auth,\n    },\n  );\n\n  await addGeneratorMetricsIfApplicable(tree, [TS_MCP_SERVER_GENERATOR_INFO]);\n\n  await ensureLicenseExceptions(tree, MCP_INSPECTOR_EXCEPTIONS);\n\n  await formatFilesInSubtree(tree);\n  return () =>\n    installDependencies(tree, options.preferInstallDependencies, {\n      languages: ['typescript'],\n    });\n};\n\nexport default tsMcpServerGenerator;\n"],"names":["detectPackageManager","generateFiles","joinPathFragments","OverwriteStrategy","readJson","updateJson","updateProjectConfiguration","ensureLicenseExceptions","MCP_INSPECTOR_EXCEPTIONS","addMcpServerInfra","addTypeScriptBundleTarget","resolveContainers","addDependenciesToPackageJson","addDockerScanTarget","formatFilesInSubtree","FsCommands","resolveIac","installDependencies","addGeneratorMetricsIfApplicable","isEsmWorkspace","kebabCase","toClassName","getNpmScope","addComponentDevTarget","addComponentGeneratorMetadata","addDependencyToTargetIfNotPresent","getGeneratorInfo","readProjectConfigurationUnqualified","sortObjectKeys","assignPort","sharedConstructsGenerator","BASE_IMAGES","TS_VERSIONS","withVersions","TS_MCP_SERVER_GENERATOR_INFO","filename","tsMcpServerGenerator","tree","options","project","exists","root","Error","defaultName","name","split","pop","mcpServerNameClassName","mcpTargetPrefix","targetSourceDirRelativeToProjectRoot","targetSourceDir","relativeSourceDir","replace","distDir","infra","auth","console","warn","projectPackageJsonPath","esm","type","dirname","adotVersion","jaegerVersion","nodeBaseImage","node","npmVersion","npm","overwriteStrategy","KeepExisting","deps","devDeps","rootDevDeps","containers","dockerImageTag","targetFilePath","bundleOutputDir","dockerOutputDir","dockerTargetName","fs","targets","cache","outputs","executor","commands","cp","parallel","dependsOn","containerEngine","trivyTargetName","imageTags","iac","mcpServerNameKebabCase","projectName","delete","packageJson","resolutions","localDevPort","component","info","mcpTargets","continuous","cwd","env","PORT","LOCAL_DEV","port","rc","preferInstallDependencies","languages"],"mappings":"AAAA;;;CAGC,GACD,SACEA,oBAAoB,EAEpBC,aAAa,EACbC,iBAAiB,EACjBC,iBAAiB,EACjBC,QAAQ,EAERC,UAAU,EACVC,0BAA0B,QACrB,aAAa;AACpB,SAASC,uBAAuB,QAAQ,0BAAuB;AAC/D,SAASC,wBAAwB,QAAQ,oCAAiC;AAC1E,SAASC,iBAAiB,QAAQ,6DAA0D;AAC5F,SAASC,yBAAyB,QAAQ,+BAA4B;AACtE,SAASC,iBAAiB,QAAQ,4BAAyB;AAC3D,SAASC,4BAA4B,QAAQ,8BAA2B;AACxE,SAASC,mBAAmB,QAAQ,wBAAqB;AACzD,SAASC,oBAAoB,QAAQ,wBAAqB;AAC1D,SAASC,UAAU,QAAQ,oBAAiB;AAC5C,SAASC,UAAU,QAAQ,qBAAkB;AAC7C,SAASC,mBAAmB,QAAQ,yBAAsB;AAC1D,SAASC,+BAA+B,QAAQ,yBAAsB;AACtE,SAASC,cAAc,QAAQ,+BAA4B;AAC3D,SAASC,SAAS,EAAEC,WAAW,QAAQ,uBAAoB;AAC3D,SAASC,WAAW,QAAQ,2BAAwB;AACpD,SACEC,qBAAqB,EACrBC,6BAA6B,EAC7BC,iCAAiC,EACjCC,gBAAgB,EAEhBC,mCAAmC,QAC9B,oBAAiB;AACxB,SAASC,cAAc,QAAQ,wBAAqB;AACpD,SAASC,UAAU,QAAQ,sBAAmB;AAC9C,SAASC,yBAAyB,QAAQ,mCAAgC;AAC1E,SAASC,WAAW,EAAEC,WAAW,EAAEC,YAAY,QAAQ,0BAAuB;AAG9E,OAAO,MAAMC,+BAAgDR,iBAC3D,YAAYS,QAAQ,EACpB;AAEF,OAAO,MAAMC,uBAAuB,OAClCC,MACAC;IAEA,MAAMC,UAAUZ,oCAAoCU,MAAMC,QAAQC,OAAO;IAEzE,IAAI,CAACF,KAAKG,MAAM,CAACtC,kBAAkBqC,QAAQE,IAAI,EAAE,mBAAmB;QAClE,MAAM,IAAIC,MACR,CAAC,oBAAoB,EAAEJ,QAAQC,OAAO,CAAC,sDAAsD,CAAC;IAElG;IAEA,MAAMI,cAAc,GAAGvB,UAAUmB,QAAQK,IAAI,CAACC,KAAK,CAAC,KAAKC,GAAG,IAAI,WAAW,CAAC;IAC5E,MAAMF,OAAOxB,UAAUkB,QAAQM,IAAI,IAAID;IACvC,MAAMI,yBAAyB1B,YAAYuB;IAC3C,MAAMI,kBAAkBV,QAAQM,IAAI,GAAGA,OAAO;IAC9C,MAAMK,uCAAuC/C,kBAC3C,OACA8C;IAEF,MAAME,kBAAkBhD,kBACtBqC,QAAQE,IAAI,EACZQ;IAEF,MAAME,oBAAoBD,gBAAgBE,OAAO,CAACb,QAAQE,IAAI,GAAG,KAAK;IACtE,MAAMY,UAAUnD,kBAAkB,QAAQqC,QAAQE,IAAI;IAEtD,MAAMa,QAAQhB,QAAQgB,KAAK,IAAI;IAE/B,IAAIA,UAAU,UAAUhB,QAAQiB,IAAI,IAAIjB,QAAQiB,IAAI,KAAK,OAAO;QAC9DC,QAAQC,IAAI,CACV;IAEJ;IAEA,MAAMF,OAAOjB,QAAQiB,IAAI,IAAI;IAE7B,MAAMG,yBAAyBxD,kBAC7BqC,QAAQE,IAAI,EACZ;IAGF,wEAAwE;IACxE,iEAAiE;IACjE,MAAMkB,MAAMtB,KAAKG,MAAM,CAACkB,0BACpBtD,SAASiC,MAAMqB,wBAAwBE,IAAI,KAAK,WAChDzC,eAAekB;IAEnB,0BAA0B;IAC1BpC,cACEoC,MACAnC,kBAAkB,YAAY2D,OAAO,EAAE,UACvCX,iBACA;QACEN;QACAe;QACAN;QACAS,aACE9B,WAAW,CAAC,yDAAyD;QACvE+B,eAAe/B,WAAW,CAAC,mCAAmC;QAC9DgC,eAAejC,YAAYkC,IAAI;QAC/BC,YAAYlC,YAAYmC,GAAG;IAC7B,GACA;QAAEC,mBAAmBjE,kBAAkBkE,YAAY;IAAC;IAGtD,mBAAmB;IACnB,MAAMC,OAAOrC,aAAa;QACxB;QACA;QACA;QACA;QACA;KACD;IACD,MAAMsC,UAAUtC,aAAa;QAAC;KAAiB;IAC/C,4DAA4D;IAC5D,MAAMuC,cAAcvC,aAAa;QAAC;QAAO;KAAkC;IAE3E,6BAA6B;IAC7B,IAAIqB,UAAU,aAAa;QACzB,MAAMmB,aAAa,MAAM9D,kBAAkB0B,MAAM;QACjD,MAAMqC,iBAAiB,GAAGpD,YAAYe,MAAM,CAAC,EAAEO,KAAK,OAAO,CAAC;QAE5D,oBAAoB;QACpB,MAAMlC,0BAA0B2B,MAAME,SAAS;YAC7CoC,gBAAgB,GAAG1B,qCAAqC,QAAQ,CAAC;YACjE2B,iBAAiB1E,kBAAkB,OAAO0C;QAC5C;QAEA,MAAMiC,kBAAkB3E,kBACtB,QACAqC,QAAQE,IAAI,EACZ,UACA,OACAG;QAEF,MAAMkC,mBAAmB,GAAG9B,gBAAgB,OAAO,CAAC;QAEpD,MAAM+B,KAAK,IAAIhE,WAAWsB;QAC1BE,QAAQyC,OAAO,CAACF,iBAAiB,GAAG;YAClCG,OAAO;YACPC,SAAS;gBAAC,CAAC,gBAAgB,EAAEL,gBAAgB,WAAW,CAAC;aAAC;YAC1DM,UAAU;YACV7C,SAAS;gBACP8C,UAAU;oBACRL,GAAGM,EAAE,CACH,GAAGnC,gBAAgB,WAAW,CAAC,EAC/B,GAAG2B,gBAAgB,WAAW,CAAC;oBAEjC,GAAGJ,WAAW,iCAAiC,EAAEC,eAAe,CAAC,EAAEG,iBAAiB;iBACrF;gBACDS,UAAU;YACZ;YACAC,WAAW;gBAAC;aAAS;QACvB;QAEA9D,kCAAkCc,SAAS,UAAUuC;QACrDrD,kCAAkCc,SAAS,SAAS;QAEpD1B,oBAAoBwB,MAAM;YACxBE;YACAiD,iBAAiBf;YACjBgB,iBAAiB,GAAGzC,gBAAgB,MAAM,CAAC;YAC3C8B;YACAY,WAAW;gBAAChB;aAAe;QAC7B;QAEA,wBAAwB;QACxB,MAAMiB,MAAM,MAAM3E,WAAWqB,MAAMC,QAAQqD,GAAG;QAC9C,MAAM7D,0BAA0BO,MAAM;YAAEsD;QAAI;QAE5C,6CAA6C;QAC7C,MAAMlF,kBAAkB4B,MAAM;YAC5BuD,wBAAwBhD;YACxBG;YACA8C,aAAatD,QAAQK,IAAI;YACzB8B;YACAG;YACAc;YACApC;YACAkB;QACF;IACF,OAAO;QACL,0CAA0C;QAC1CpC,KAAKyD,MAAM,CAAC5F,kBAAkBgD,iBAAiB;IACjD;IAEA,4EAA4E;IAC5EtC,6BAA6ByB,MAAMiC,MAAMC,SAASb;IAClD9C,6BAA6ByB,MAAM,CAAC,GAAGmC;IAEvC,gFAAgF;IAChF,mFAAmF;IACnF,oFAAoF;IACpF,6EAA6E;IAC7E,6EAA6E;IAC7E,kFAAkF;IAClF,IAAIxE,2BAA2B,QAAQ;QACrCK,WAAWgC,MAAM,gBAAgB,CAAC0D;YAChCA,YAAYC,WAAW,GAAG;gBACxB,GAAGD,YAAYC,WAAW;gBAC1B,oCAAoChE,WAAW,CAAC,MAAM;YACxD;YACA,OAAO+D;QACT;IACF;IAEA,MAAME,eAAepE,WAAWQ,MAAME,SAAS,MAAM;QACnD2D,WAAW;YAAEC,MAAMjE;YAA8BU,MAAMI;QAAgB;IACzE;IAEA,MAAMoD,aAAa;QACjB,GAAG7D,QAAQyC,OAAO;QAClB,yCAAyC;QACzC,CAAC,GAAGhC,gBAAgB,YAAY,CAAC,CAAC,EAAE;YAClCmC,UAAU;YACVkB,YAAY;YACZ/D,SAAS;gBACP8C,UAAU;oBAAC,CAAC,YAAY,EAAEjC,kBAAkB,SAAS,CAAC;iBAAC;gBACvDmD,KAAK;YACP;QACF;QACA,CAAC,GAAGtD,gBAAgB,MAAM,CAAC,CAAC,EAAE;YAC5BmC,UAAU;YACVkB,YAAY;YACZ/D,SAAS;gBACP8C,UAAU;oBAAC,CAAC,YAAY,EAAEjC,kBAAkB,QAAQ,CAAC;iBAAC;gBACtDmD,KAAK;gBACLC,KAAK;oBACHC,MAAM,GAAGP,cAAc;gBACzB;YACF;QACF;QACA,CAAC,GAAGjD,gBAAgB,IAAI,CAAC,CAAC,EAAE;YAC1BmC,UAAU;YACVkB,YAAY;YACZ/D,SAAS;gBACP8C,UAAU;oBAAC,CAAC,YAAY,EAAEjC,kBAAkB,QAAQ,CAAC;iBAAC;gBACtDmD,KAAK;gBACLC,KAAK;oBACHC,MAAM,GAAGP,cAAc;oBACvBQ,WAAW;gBACb;YACF;QACF;QACA,CAAC,GAAGzD,gBAAgB,QAAQ,CAAC,CAAC,EAAE;YAC9BmC,UAAU;YACVkB,YAAY;YACZ,uEAAuE;YACvE,wEAAwE;YACxE,aAAa;YACbd,WAAW;gBAAC,GAAGvC,gBAAgB,IAAI,CAAC;aAAC;YACrCV,SAAS;gBACP8C,UAAU;oBACR,CAAC,6DAA6D,EAAEa,aAAa,IAAI,CAAC;iBACnF;gBACDK,KAAK;YACP;QACF;QACA,CAAC,GAAGtD,gBAAgB,cAAc,CAAC,CAAC,EAAE;YACpCmC,UAAU;YACVkB,YAAY;YACZ/D,SAAS;gBACP8C,UAAU;oBACR,CAAC,6BAA6B,EAAEjC,kBAAkB,SAAS,CAAC;iBAC7D;gBACDmD,KAAK;YACP;QACF;IACF;IAEA,8DAA8D;IAC9D/E,sBAAsB6E,YAAY,GAAGpD,gBAAgB,IAAI,CAAC;IAE1D1C,2BAA2B+B,MAAME,QAAQK,IAAI,EAAE;QAC7C,GAAGL,OAAO;QACV,yEAAyE;QACzE,uBAAuB;QACvByC,SAASpD,eAAewE;IAC1B;IAEA5E,8BACEa,MACAE,QAAQK,IAAI,EACZV,8BACAe,sCACAD,iBACA;QACE0D,MAAMT;QACNU,IAAI5D;QACJQ;IACF;IAGF,MAAMrC,gCAAgCmB,MAAM;QAACH;KAA6B;IAE1E,MAAM3B,wBAAwB8B,MAAM7B;IAEpC,MAAMM,qBAAqBuB;IAC3B,OAAO,IACLpB,oBAAoBoB,MAAMC,QAAQsE,yBAAyB,EAAE;YAC3DC,WAAW;gBAAC;aAAa;QAC3B;AACJ,EAAE;AAEF,eAAezE,qBAAqB"}
+{"version":3,"sources":["../../../../../../packages/nx-plugin/src/ts/mcp-server/generator.ts"],"sourcesContent":["/**\n * Copyright Amazon.com, Inc. or its affiliates. All Rights Reserved.\n * SPDX-License-Identifier: Apache-2.0\n */\nimport {\n  detectPackageManager,\n  type GeneratorCallback,\n  generateFiles,\n  joinPathFragments,\n  OverwriteStrategy,\n  readJson,\n  type Tree,\n  updateJson,\n  updateProjectConfiguration,\n} from '@nx/devkit';\nimport { ensureLicenseExceptions } from '../../license/config';\nimport { MCP_INSPECTOR_EXCEPTIONS } from '../../license/known-exceptions';\nimport { addMcpServerInfra } from '../../utils/agent-core-constructs/agent-core-constructs';\nimport { addTypeScriptBundleTarget } from '../../utils/bundle/bundle';\nimport { resolveContainers } from '../../utils/containers';\nimport { addDependenciesToPackageJson } from '../../utils/dependencies';\nimport { addDockerScanTarget, nodeImageVersions } from '../../utils/docker';\nimport { formatFilesInSubtree } from '../../utils/format';\nimport { FsCommands } from '../../utils/fs';\nimport { resolveIac } from '../../utils/iac';\nimport { installDependencies } from '../../utils/install';\nimport { addGeneratorMetricsIfApplicable } from '../../utils/metrics';\nimport { isEsmWorkspace } from '../../utils/module-format';\nimport { kebabCase, toClassName } from '../../utils/names';\nimport { getNpmScope } from '../../utils/npm-scope';\nimport {\n  addComponentDevTarget,\n  addComponentGeneratorMetadata,\n  addDependencyToTargetIfNotPresent,\n  getGeneratorInfo,\n  type NxGeneratorInfo,\n  readProjectConfigurationUnqualified,\n} from '../../utils/nx';\nimport { sortObjectKeys } from '../../utils/object';\nimport { assignPort } from '../../utils/port';\nimport { sharedConstructsGenerator } from '../../utils/shared-constructs';\nimport { BASE_IMAGES, TS_VERSIONS, withVersions } from '../../utils/versions';\nimport type { TsMcpServerGeneratorSchema } from './schema';\n\nexport const TS_MCP_SERVER_GENERATOR_INFO: NxGeneratorInfo = getGeneratorInfo(\n  import.meta.filename,\n);\n\nexport const tsMcpServerGenerator = async (\n  tree: Tree,\n  options: TsMcpServerGeneratorSchema,\n): Promise<GeneratorCallback> => {\n  const project = readProjectConfigurationUnqualified(tree, options.project);\n\n  if (!tree.exists(joinPathFragments(project.root, 'tsconfig.json'))) {\n    throw new Error(\n      `Unsupported project ${options.project}. Expected a TypeScript project (with a tsconfig.json)`,\n    );\n  }\n\n  const defaultName = `${kebabCase(project.name.split('/').pop())}-mcp-server`;\n  const name = kebabCase(options.name || defaultName);\n  const mcpServerNameClassName = toClassName(name);\n  const mcpTargetPrefix = options.name ? name : 'mcp-server';\n  const targetSourceDirRelativeToProjectRoot = joinPathFragments(\n    'src',\n    mcpTargetPrefix,\n  );\n  const targetSourceDir = joinPathFragments(\n    project.root,\n    targetSourceDirRelativeToProjectRoot,\n  );\n  const relativeSourceDir = targetSourceDir.replace(project.root + '/', './');\n  const distDir = joinPathFragments('dist', project.root);\n\n  const infra = options.infra ?? 'agentcore';\n\n  if (infra === 'none' && options.auth && options.auth !== 'iam') {\n    console.warn(\n      'Warning: auth is ignored when no infrastructure is configured (no infrastructure is generated)',\n    );\n  }\n\n  const auth = options.auth ?? 'iam';\n\n  const projectPackageJsonPath = joinPathFragments(\n    project.root,\n    'package.json',\n  );\n\n  // Generate esm if the project's package.json is `type: module`, falling\n  // back to the workspace format when the project has no manifest.\n  const esm = tree.exists(projectPackageJsonPath)\n    ? readJson(tree, projectPackageJsonPath).type === 'module'\n    : isEsmWorkspace(tree);\n\n  // Generate example server\n  generateFiles(\n    tree,\n    joinPathFragments(import.meta.dirname, 'files'),\n    targetSourceDir,\n    {\n      name,\n      esm,\n      distDir,\n      adotVersion:\n        TS_VERSIONS['@aws/aws-distro-opentelemetry-node-autoinstrumentation'],\n      jaegerVersion: TS_VERSIONS['@opentelemetry/propagator-jaeger'],\n      nodeBaseImage: BASE_IMAGES.node,\n      ...nodeImageVersions(),\n    },\n    { overwriteStrategy: OverwriteStrategy.KeepExisting },\n  );\n\n  // Add dependencies\n  const deps = withVersions([\n    '@modelcontextprotocol/sdk',\n    'zod',\n    'express',\n    '@aws-lambda-powertools/parameters',\n    '@aws-sdk/client-appconfigdata',\n  ]);\n  const devDeps = withVersions(['@types/express']);\n  // tsx (local dev) and the MCP inspector are shared tooling.\n  const rootDevDeps = withVersions(['tsx', '@modelcontextprotocol/inspector']);\n\n  // Add hosting based on infra\n  if (infra === 'agentcore') {\n    const containers = await resolveContainers(tree, 'inherit');\n    const dockerImageTag = `${getNpmScope(tree)}-${name}:latest`;\n\n    // Add bundle target\n    await addTypeScriptBundleTarget(tree, project, {\n      targetFilePath: `${targetSourceDirRelativeToProjectRoot}/http.ts`,\n      bundleOutputDir: joinPathFragments('mcp', name),\n    });\n\n    const dockerOutputDir = joinPathFragments(\n      'dist',\n      project.root,\n      'bundle',\n      'mcp',\n      name,\n    );\n    const dockerTargetName = `${mcpTargetPrefix}-docker`;\n\n    const fs = new FsCommands(tree);\n    project.targets[dockerTargetName] = {\n      cache: true,\n      outputs: [`{workspaceRoot}/${dockerOutputDir}/Dockerfile`],\n      executor: 'nx:run-commands',\n      options: {\n        commands: [\n          fs.cp(\n            `${targetSourceDir}/Dockerfile`,\n            `${dockerOutputDir}/Dockerfile`,\n          ),\n          `${containers} build --platform linux/arm64 -t ${dockerImageTag} ${dockerOutputDir}`,\n        ],\n        parallel: false,\n      },\n      dependsOn: ['bundle'],\n    };\n\n    addDependencyToTargetIfNotPresent(project, 'docker', dockerTargetName);\n    addDependencyToTargetIfNotPresent(project, 'build', 'docker');\n\n    addDockerScanTarget(tree, {\n      project,\n      containerEngine: containers,\n      trivyTargetName: `${mcpTargetPrefix}-trivy`,\n      dockerTargetName,\n      imageTags: [dockerImageTag],\n    });\n\n    // Add shared constructs\n    const iac = await resolveIac(tree, options.iac);\n    await sharedConstructsGenerator(tree, { iac });\n\n    // Add the construct to deploy the mcp server\n    await addMcpServerInfra(tree, {\n      mcpServerNameKebabCase: name,\n      mcpServerNameClassName,\n      projectName: project.name,\n      dockerImageTag,\n      dockerOutputDir,\n      iac,\n      auth,\n      containers,\n    });\n  } else {\n    // No Dockerfile needed for non-hosted MCP\n    tree.delete(joinPathFragments(targetSourceDir, 'Dockerfile'));\n  }\n\n  // Runtime deps go in the project manifest; shared tooling goes to the root.\n  addDependenciesToPackageJson(tree, deps, devDeps, projectPackageJsonPath);\n  addDependenciesToPackageJson(tree, {}, rootDevDeps);\n\n  // @modelcontextprotocol/sdk declares zod as a peer dependency with a wide range\n  // (^3.25 || ^4.0). Yarn does not dedupe the peer to the workspace's pinned zod, so\n  // without a resolution it installs a separate zod under the SDK's own node_modules.\n  // The two zod copies have structurally incompatible types, which breaks type\n  // inference for registerTool inputSchema. Scope the resolution to the SDK so\n  // other consumers (e.g. @tanstack/router-generator pinning zod@3) are unaffected.\n  if (detectPackageManager() === 'yarn') {\n    updateJson(tree, 'package.json', (packageJson) => {\n      packageJson.resolutions = {\n        ...packageJson.resolutions,\n        '**/@modelcontextprotocol/sdk/zod': TS_VERSIONS['zod'],\n      };\n      return packageJson;\n    });\n  }\n\n  const localDevPort = assignPort(tree, project, 8000, {\n    component: { info: TS_MCP_SERVER_GENERATOR_INFO, name: mcpTargetPrefix },\n  });\n\n  const mcpTargets = {\n    ...project.targets,\n    // Add targets for running the MCP server\n    [`${mcpTargetPrefix}-serve-stdio`]: {\n      executor: 'nx:run-commands',\n      continuous: true,\n      options: {\n        commands: [`tsx --watch ${relativeSourceDir}/stdio.ts`],\n        cwd: '{projectRoot}',\n      },\n    },\n    [`${mcpTargetPrefix}-serve`]: {\n      executor: 'nx:run-commands',\n      continuous: true,\n      options: {\n        commands: [`tsx --watch ${relativeSourceDir}/http.ts`],\n        cwd: '{projectRoot}',\n        env: {\n          PORT: `${localDevPort}`,\n        },\n      },\n    },\n    [`${mcpTargetPrefix}-dev`]: {\n      executor: 'nx:run-commands',\n      continuous: true,\n      options: {\n        commands: [`tsx --watch ${relativeSourceDir}/http.ts`],\n        cwd: '{projectRoot}',\n        env: {\n          PORT: `${localDevPort}`,\n          LOCAL_DEV: 'true',\n        },\n      },\n    },\n    [`${mcpTargetPrefix}-inspect`]: {\n      executor: 'nx:run-commands',\n      continuous: true,\n      // Launch the inspector against the locally served HTTP server. The dev\n      // target starts the server and any connected dependencies (e.g. a local\n      // database).\n      dependsOn: [`${mcpTargetPrefix}-dev`],\n      options: {\n        commands: [\n          `mcp-inspector --transport http --server-url http://localhost:${localDevPort}/mcp`,\n        ],\n        cwd: '{projectRoot}',\n      },\n    },\n    [`${mcpTargetPrefix}-inspect-stdio`]: {\n      executor: 'nx:run-commands',\n      continuous: true,\n      options: {\n        commands: [\n          `mcp-inspector -- tsx --watch ${relativeSourceDir}/stdio.ts`,\n        ],\n        cwd: '{projectRoot}',\n      },\n    },\n  };\n\n  // Aggregate `<mcp>-dev` under the project-level `dev` target.\n  addComponentDevTarget(mcpTargets, `${mcpTargetPrefix}-dev`);\n\n  updateProjectConfiguration(tree, project.name, {\n    ...project,\n    // Sort targets so their order is stable regardless of insertion order on\n    // first run vs re-run.\n    targets: sortObjectKeys(mcpTargets),\n  });\n\n  addComponentGeneratorMetadata(\n    tree,\n    project.name,\n    TS_MCP_SERVER_GENERATOR_INFO,\n    targetSourceDirRelativeToProjectRoot,\n    mcpTargetPrefix,\n    {\n      port: localDevPort,\n      rc: mcpServerNameClassName,\n      auth,\n    },\n  );\n\n  await addGeneratorMetricsIfApplicable(tree, [TS_MCP_SERVER_GENERATOR_INFO]);\n\n  await ensureLicenseExceptions(tree, MCP_INSPECTOR_EXCEPTIONS);\n\n  await formatFilesInSubtree(tree);\n  return () =>\n    installDependencies(tree, options.preferInstallDependencies, {\n      languages: ['typescript'],\n    });\n};\n\nexport default tsMcpServerGenerator;\n"],"names":["detectPackageManager","generateFiles","joinPathFragments","OverwriteStrategy","readJson","updateJson","updateProjectConfiguration","ensureLicenseExceptions","MCP_INSPECTOR_EXCEPTIONS","addMcpServerInfra","addTypeScriptBundleTarget","resolveContainers","addDependenciesToPackageJson","addDockerScanTarget","nodeImageVersions","formatFilesInSubtree","FsCommands","resolveIac","installDependencies","addGeneratorMetricsIfApplicable","isEsmWorkspace","kebabCase","toClassName","getNpmScope","addComponentDevTarget","addComponentGeneratorMetadata","addDependencyToTargetIfNotPresent","getGeneratorInfo","readProjectConfigurationUnqualified","sortObjectKeys","assignPort","sharedConstructsGenerator","BASE_IMAGES","TS_VERSIONS","withVersions","TS_MCP_SERVER_GENERATOR_INFO","filename","tsMcpServerGenerator","tree","options","project","exists","root","Error","defaultName","name","split","pop","mcpServerNameClassName","mcpTargetPrefix","targetSourceDirRelativeToProjectRoot","targetSourceDir","relativeSourceDir","replace","distDir","infra","auth","console","warn","projectPackageJsonPath","esm","type","dirname","adotVersion","jaegerVersion","nodeBaseImage","node","overwriteStrategy","KeepExisting","deps","devDeps","rootDevDeps","containers","dockerImageTag","targetFilePath","bundleOutputDir","dockerOutputDir","dockerTargetName","fs","targets","cache","outputs","executor","commands","cp","parallel","dependsOn","containerEngine","trivyTargetName","imageTags","iac","mcpServerNameKebabCase","projectName","delete","packageJson","resolutions","localDevPort","component","info","mcpTargets","continuous","cwd","env","PORT","LOCAL_DEV","port","rc","preferInstallDependencies","languages"],"mappings":"AAAA;;;CAGC,GACD,SACEA,oBAAoB,EAEpBC,aAAa,EACbC,iBAAiB,EACjBC,iBAAiB,EACjBC,QAAQ,EAERC,UAAU,EACVC,0BAA0B,QACrB,aAAa;AACpB,SAASC,uBAAuB,QAAQ,0BAAuB;AAC/D,SAASC,wBAAwB,QAAQ,oCAAiC;AAC1E,SAASC,iBAAiB,QAAQ,6DAA0D;AAC5F,SAASC,yBAAyB,QAAQ,+BAA4B;AACtE,SAASC,iBAAiB,QAAQ,4BAAyB;AAC3D,SAASC,4BAA4B,QAAQ,8BAA2B;AACxE,SAASC,mBAAmB,EAAEC,iBAAiB,QAAQ,wBAAqB;AAC5E,SAASC,oBAAoB,QAAQ,wBAAqB;AAC1D,SAASC,UAAU,QAAQ,oBAAiB;AAC5C,SAASC,UAAU,QAAQ,qBAAkB;AAC7C,SAASC,mBAAmB,QAAQ,yBAAsB;AAC1D,SAASC,+BAA+B,QAAQ,yBAAsB;AACtE,SAASC,cAAc,QAAQ,+BAA4B;AAC3D,SAASC,SAAS,EAAEC,WAAW,QAAQ,uBAAoB;AAC3D,SAASC,WAAW,QAAQ,2BAAwB;AACpD,SACEC,qBAAqB,EACrBC,6BAA6B,EAC7BC,iCAAiC,EACjCC,gBAAgB,EAEhBC,mCAAmC,QAC9B,oBAAiB;AACxB,SAASC,cAAc,QAAQ,wBAAqB;AACpD,SAASC,UAAU,QAAQ,sBAAmB;AAC9C,SAASC,yBAAyB,QAAQ,mCAAgC;AAC1E,SAASC,WAAW,EAAEC,WAAW,EAAEC,YAAY,QAAQ,0BAAuB;AAG9E,OAAO,MAAMC,+BAAgDR,iBAC3D,YAAYS,QAAQ,EACpB;AAEF,OAAO,MAAMC,uBAAuB,OAClCC,MACAC;IAEA,MAAMC,UAAUZ,oCAAoCU,MAAMC,QAAQC,OAAO;IAEzE,IAAI,CAACF,KAAKG,MAAM,CAACvC,kBAAkBsC,QAAQE,IAAI,EAAE,mBAAmB;QAClE,MAAM,IAAIC,MACR,CAAC,oBAAoB,EAAEJ,QAAQC,OAAO,CAAC,sDAAsD,CAAC;IAElG;IAEA,MAAMI,cAAc,GAAGvB,UAAUmB,QAAQK,IAAI,CAACC,KAAK,CAAC,KAAKC,GAAG,IAAI,WAAW,CAAC;IAC5E,MAAMF,OAAOxB,UAAUkB,QAAQM,IAAI,IAAID;IACvC,MAAMI,yBAAyB1B,YAAYuB;IAC3C,MAAMI,kBAAkBV,QAAQM,IAAI,GAAGA,OAAO;IAC9C,MAAMK,uCAAuChD,kBAC3C,OACA+C;IAEF,MAAME,kBAAkBjD,kBACtBsC,QAAQE,IAAI,EACZQ;IAEF,MAAME,oBAAoBD,gBAAgBE,OAAO,CAACb,QAAQE,IAAI,GAAG,KAAK;IACtE,MAAMY,UAAUpD,kBAAkB,QAAQsC,QAAQE,IAAI;IAEtD,MAAMa,QAAQhB,QAAQgB,KAAK,IAAI;IAE/B,IAAIA,UAAU,UAAUhB,QAAQiB,IAAI,IAAIjB,QAAQiB,IAAI,KAAK,OAAO;QAC9DC,QAAQC,IAAI,CACV;IAEJ;IAEA,MAAMF,OAAOjB,QAAQiB,IAAI,IAAI;IAE7B,MAAMG,yBAAyBzD,kBAC7BsC,QAAQE,IAAI,EACZ;IAGF,wEAAwE;IACxE,iEAAiE;IACjE,MAAMkB,MAAMtB,KAAKG,MAAM,CAACkB,0BACpBvD,SAASkC,MAAMqB,wBAAwBE,IAAI,KAAK,WAChDzC,eAAekB;IAEnB,0BAA0B;IAC1BrC,cACEqC,MACApC,kBAAkB,YAAY4D,OAAO,EAAE,UACvCX,iBACA;QACEN;QACAe;QACAN;QACAS,aACE9B,WAAW,CAAC,yDAAyD;QACvE+B,eAAe/B,WAAW,CAAC,mCAAmC;QAC9DgC,eAAejC,YAAYkC,IAAI;QAC/B,GAAGpD,mBAAmB;IACxB,GACA;QAAEqD,mBAAmBhE,kBAAkBiE,YAAY;IAAC;IAGtD,mBAAmB;IACnB,MAAMC,OAAOnC,aAAa;QACxB;QACA;QACA;QACA;QACA;KACD;IACD,MAAMoC,UAAUpC,aAAa;QAAC;KAAiB;IAC/C,4DAA4D;IAC5D,MAAMqC,cAAcrC,aAAa;QAAC;QAAO;KAAkC;IAE3E,6BAA6B;IAC7B,IAAIqB,UAAU,aAAa;QACzB,MAAMiB,aAAa,MAAM7D,kBAAkB2B,MAAM;QACjD,MAAMmC,iBAAiB,GAAGlD,YAAYe,MAAM,CAAC,EAAEO,KAAK,OAAO,CAAC;QAE5D,oBAAoB;QACpB,MAAMnC,0BAA0B4B,MAAME,SAAS;YAC7CkC,gBAAgB,GAAGxB,qCAAqC,QAAQ,CAAC;YACjEyB,iBAAiBzE,kBAAkB,OAAO2C;QAC5C;QAEA,MAAM+B,kBAAkB1E,kBACtB,QACAsC,QAAQE,IAAI,EACZ,UACA,OACAG;QAEF,MAAMgC,mBAAmB,GAAG5B,gBAAgB,OAAO,CAAC;QAEpD,MAAM6B,KAAK,IAAI9D,WAAWsB;QAC1BE,QAAQuC,OAAO,CAACF,iBAAiB,GAAG;YAClCG,OAAO;YACPC,SAAS;gBAAC,CAAC,gBAAgB,EAAEL,gBAAgB,WAAW,CAAC;aAAC;YAC1DM,UAAU;YACV3C,SAAS;gBACP4C,UAAU;oBACRL,GAAGM,EAAE,CACH,GAAGjC,gBAAgB,WAAW,CAAC,EAC/B,GAAGyB,gBAAgB,WAAW,CAAC;oBAEjC,GAAGJ,WAAW,iCAAiC,EAAEC,eAAe,CAAC,EAAEG,iBAAiB;iBACrF;gBACDS,UAAU;YACZ;YACAC,WAAW;gBAAC;aAAS;QACvB;QAEA5D,kCAAkCc,SAAS,UAAUqC;QACrDnD,kCAAkCc,SAAS,SAAS;QAEpD3B,oBAAoByB,MAAM;YACxBE;YACA+C,iBAAiBf;YACjBgB,iBAAiB,GAAGvC,gBAAgB,MAAM,CAAC;YAC3C4B;YACAY,WAAW;gBAAChB;aAAe;QAC7B;QAEA,wBAAwB;QACxB,MAAMiB,MAAM,MAAMzE,WAAWqB,MAAMC,QAAQmD,GAAG;QAC9C,MAAM3D,0BAA0BO,MAAM;YAAEoD;QAAI;QAE5C,6CAA6C;QAC7C,MAAMjF,kBAAkB6B,MAAM;YAC5BqD,wBAAwB9C;YACxBG;YACA4C,aAAapD,QAAQK,IAAI;YACzB4B;YACAG;YACAc;YACAlC;YACAgB;QACF;IACF,OAAO;QACL,0CAA0C;QAC1ClC,KAAKuD,MAAM,CAAC3F,kBAAkBiD,iBAAiB;IACjD;IAEA,4EAA4E;IAC5EvC,6BAA6B0B,MAAM+B,MAAMC,SAASX;IAClD/C,6BAA6B0B,MAAM,CAAC,GAAGiC;IAEvC,gFAAgF;IAChF,mFAAmF;IACnF,oFAAoF;IACpF,6EAA6E;IAC7E,6EAA6E;IAC7E,kFAAkF;IAClF,IAAIvE,2BAA2B,QAAQ;QACrCK,WAAWiC,MAAM,gBAAgB,CAACwD;YAChCA,YAAYC,WAAW,GAAG;gBACxB,GAAGD,YAAYC,WAAW;gBAC1B,oCAAoC9D,WAAW,CAAC,MAAM;YACxD;YACA,OAAO6D;QACT;IACF;IAEA,MAAME,eAAelE,WAAWQ,MAAME,SAAS,MAAM;QACnDyD,WAAW;YAAEC,MAAM/D;YAA8BU,MAAMI;QAAgB;IACzE;IAEA,MAAMkD,aAAa;QACjB,GAAG3D,QAAQuC,OAAO;QAClB,yCAAyC;QACzC,CAAC,GAAG9B,gBAAgB,YAAY,CAAC,CAAC,EAAE;YAClCiC,UAAU;YACVkB,YAAY;YACZ7D,SAAS;gBACP4C,UAAU;oBAAC,CAAC,YAAY,EAAE/B,kBAAkB,SAAS,CAAC;iBAAC;gBACvDiD,KAAK;YACP;QACF;QACA,CAAC,GAAGpD,gBAAgB,MAAM,CAAC,CAAC,EAAE;YAC5BiC,UAAU;YACVkB,YAAY;YACZ7D,SAAS;gBACP4C,UAAU;oBAAC,CAAC,YAAY,EAAE/B,kBAAkB,QAAQ,CAAC;iBAAC;gBACtDiD,KAAK;gBACLC,KAAK;oBACHC,MAAM,GAAGP,cAAc;gBACzB;YACF;QACF;QACA,CAAC,GAAG/C,gBAAgB,IAAI,CAAC,CAAC,EAAE;YAC1BiC,UAAU;YACVkB,YAAY;YACZ7D,SAAS;gBACP4C,UAAU;oBAAC,CAAC,YAAY,EAAE/B,kBAAkB,QAAQ,CAAC;iBAAC;gBACtDiD,KAAK;gBACLC,KAAK;oBACHC,MAAM,GAAGP,cAAc;oBACvBQ,WAAW;gBACb;YACF;QACF;QACA,CAAC,GAAGvD,gBAAgB,QAAQ,CAAC,CAAC,EAAE;YAC9BiC,UAAU;YACVkB,YAAY;YACZ,uEAAuE;YACvE,wEAAwE;YACxE,aAAa;YACbd,WAAW;gBAAC,GAAGrC,gBAAgB,IAAI,CAAC;aAAC;YACrCV,SAAS;gBACP4C,UAAU;oBACR,CAAC,6DAA6D,EAAEa,aAAa,IAAI,CAAC;iBACnF;gBACDK,KAAK;YACP;QACF;QACA,CAAC,GAAGpD,gBAAgB,cAAc,CAAC,CAAC,EAAE;YACpCiC,UAAU;YACVkB,YAAY;YACZ7D,SAAS;gBACP4C,UAAU;oBACR,CAAC,6BAA6B,EAAE/B,kBAAkB,SAAS,CAAC;iBAC7D;gBACDiD,KAAK;YACP;QACF;IACF;IAEA,8DAA8D;IAC9D7E,sBAAsB2E,YAAY,GAAGlD,gBAAgB,IAAI,CAAC;IAE1D3C,2BAA2BgC,MAAME,QAAQK,IAAI,EAAE;QAC7C,GAAGL,OAAO;QACV,yEAAyE;QACzE,uBAAuB;QACvBuC,SAASlD,eAAesE;IAC1B;IAEA1E,8BACEa,MACAE,QAAQK,IAAI,EACZV,8BACAe,sCACAD,iBACA;QACEwD,MAAMT;QACNU,IAAI1D;QACJQ;IACF;IAGF,MAAMrC,gCAAgCmB,MAAM;QAACH;KAA6B;IAE1E,MAAM5B,wBAAwB+B,MAAM9B;IAEpC,MAAMO,qBAAqBuB;IAC3B,OAAO,IACLpB,oBAAoBoB,MAAMC,QAAQoE,yBAAyB,EAAE;YAC3DC,WAAW;gBAAC;aAAa;QAC3B;AACJ,EAAE;AAEF,eAAevE,qBAAqB"}

package/src/ts/nx-plugin/utils.js

@@ -1,13 +1,10 @@
 /**
  * Copyright Amazon.com, Inc. or its affiliates. All Rights Reserved.
  * SPDX-License-Identifier: Apache-2.0
- */ import { joinPathFragments, readJson, updateJson, writeJson } from "@nx/devkit";
-import PackageJson from "../../../package.json" with {
-    type: 'json'
-};
+ */ import { joinPathFragments, updateJson, writeJson } from "@nx/devkit";
 import { addDependenciesToPackageJson } from "../../utils/dependencies.js";
 import { isEsmWorkspace } from "../../utils/module-format.js";
-import { readProjectConfigurationUnqualified } from "../../utils/nx.js";
+import { nxPluginSelfDependency, readProjectConfigurationUnqualified } from "../../utils/nx.js";
 import { withVersions } from "../../utils/versions.js";
 /**
  * Configures a TypeScript project as an Nx Plugin
@@ -42,16 +39,16 @@ import { withVersions } from "../../utils/versions.js";
         pkg.generators ??= './generators.json';
         return pkg;
     });
-    const rootPackageJson = tree.exists('package.json') ? readJson(tree, 'package.json') : undefined;
-    const isNxPluginForAws = rootPackageJson?.name === '@aws/nx-plugin-source';
-    if (!isNxPluginForAws) {
+    const selfDependency = nxPluginSelfDependency(tree);
+    // Empty inside the plugin's own monorepo, where the plugin is the source
+    // rather than a dependency.
+    if (Object.keys(selfDependency).length > 0) {
         // Add the required dependencies to the root package.json, and project's package.json
         const deps = {
             ...withVersions([
                 '@nx/devkit'
             ]),
-            // Include dependency on @aws/nx-plugin
-            [PackageJson.name]: `^${PackageJson.version}`
+            ...selfDependency
         };
         // Generated workspaces are `"type": "module"`, so Nx loads the plugin's
         // `.ts` generators as ESM via Node's native type stripping — no swc/ts-node

package/src/ts/nx-plugin/utils.js.map

@@ -1 +1 @@
-{"version":3,"sources":["../../../../../../packages/nx-plugin/src/ts/nx-plugin/utils.ts"],"sourcesContent":["/**\n * Copyright Amazon.com, Inc. or its affiliates. All Rights Reserved.\n * SPDX-License-Identifier: Apache-2.0\n */\nimport {\n  joinPathFragments,\n  readJson,\n  type Tree,\n  updateJson,\n  writeJson,\n} from '@nx/devkit';\nimport PackageJson from '../../../package.json' with { type: 'json' };\nimport { addDependenciesToPackageJson } from '../../utils/dependencies';\nimport { isEsmWorkspace } from '../../utils/module-format';\nimport { readProjectConfigurationUnqualified } from '../../utils/nx';\nimport { withVersions } from '../../utils/versions';\n\n/**\n * Configures a TypeScript project as an Nx Plugin\n */\nexport const configureTsProjectAsNxPlugin = (\n  tree: Tree,\n  projectName: string,\n) => {\n  const project = readProjectConfigurationUnqualified(tree, projectName);\n\n  const tsConfigPath = joinPathFragments(project.root, 'tsconfig.json');\n  if (!tree.exists(tsConfigPath)) {\n    throw new Error(\n      `Selected plugin project ${projectName} is not a TypeScript project`,\n    );\n  }\n\n  // Create an empty generators.json if one dosn't exist\n  const generatorsJsonPath = joinPathFragments(project.root, 'generators.json');\n  if (!tree.exists(generatorsJsonPath)) {\n    writeJson(tree, generatorsJsonPath, {\n      generators: {},\n    });\n  }\n\n  // Create a package.json if one doesn't exist, and configure \"type\", \"main\"\n  // and \"generators\"\n  const pluginPackageJsonPath = joinPathFragments(project.root, 'package.json');\n  if (!tree.exists(pluginPackageJsonPath)) {\n    writeJson(tree, pluginPackageJsonPath, {\n      name: project.name,\n    });\n  }\n  const esm = isEsmWorkspace(tree);\n  updateJson(tree, pluginPackageJsonPath, (pkg) => {\n    // Match the plugin's module system to the workspace. Nx loads `.ts`\n    // generators via Node's native type stripping, as ESM (workspace root is\n    // `type: module`) or CommonJS accordingly.\n    pkg.type ??= esm ? 'module' : 'commonjs';\n    pkg.main ??= esm ? './src/index.js' : './src/index';\n    pkg.generators ??= './generators.json';\n    return pkg;\n  });\n\n  const rootPackageJson = tree.exists('package.json')\n    ? readJson(tree, 'package.json')\n    : undefined;\n  const isNxPluginForAws = rootPackageJson?.name === '@aws/nx-plugin-source';\n\n  if (!isNxPluginForAws) {\n    // Add the required dependencies to the root package.json, and project's package.json\n    const deps = {\n      ...withVersions(['@nx/devkit']),\n      // Include dependency on @aws/nx-plugin\n      [PackageJson.name]: `^${PackageJson.version}`,\n    };\n    // Generated workspaces are `\"type\": \"module\"`, so Nx loads the plugin's\n    // `.ts` generators as ESM via Node's native type stripping — no swc/ts-node\n    // transpiler is required.\n    addDependenciesToPackageJson(tree, {}, deps);\n    addDependenciesToPackageJson(tree, deps, {}, pluginPackageJsonPath);\n  }\n};\n"],"names":["joinPathFragments","readJson","updateJson","writeJson","PackageJson","type","addDependenciesToPackageJson","isEsmWorkspace","readProjectConfigurationUnqualified","withVersions","configureTsProjectAsNxPlugin","tree","projectName","project","tsConfigPath","root","exists","Error","generatorsJsonPath","generators","pluginPackageJsonPath","name","esm","pkg","main","rootPackageJson","undefined","isNxPluginForAws","deps","version"],"mappings":"AAAA;;;CAGC,GACD,SACEA,iBAAiB,EACjBC,QAAQ,EAERC,UAAU,EACVC,SAAS,QACJ,aAAa;AACpB,OAAOC,iBAAiB,6BAA6B;IAAEC,MAAM;AAAO,EAAE;AACtE,SAASC,4BAA4B,QAAQ,8BAA2B;AACxE,SAASC,cAAc,QAAQ,+BAA4B;AAC3D,SAASC,mCAAmC,QAAQ,oBAAiB;AACrE,SAASC,YAAY,QAAQ,0BAAuB;AAEpD;;CAEC,GACD,OAAO,MAAMC,+BAA+B,CAC1CC,MACAC;IAEA,MAAMC,UAAUL,oCAAoCG,MAAMC;IAE1D,MAAME,eAAed,kBAAkBa,QAAQE,IAAI,EAAE;IACrD,IAAI,CAACJ,KAAKK,MAAM,CAACF,eAAe;QAC9B,MAAM,IAAIG,MACR,CAAC,wBAAwB,EAAEL,YAAY,4BAA4B,CAAC;IAExE;IAEA,sDAAsD;IACtD,MAAMM,qBAAqBlB,kBAAkBa,QAAQE,IAAI,EAAE;IAC3D,IAAI,CAACJ,KAAKK,MAAM,CAACE,qBAAqB;QACpCf,UAAUQ,MAAMO,oBAAoB;YAClCC,YAAY,CAAC;QACf;IACF;IAEA,2EAA2E;IAC3E,mBAAmB;IACnB,MAAMC,wBAAwBpB,kBAAkBa,QAAQE,IAAI,EAAE;IAC9D,IAAI,CAACJ,KAAKK,MAAM,CAACI,wBAAwB;QACvCjB,UAAUQ,MAAMS,uBAAuB;YACrCC,MAAMR,QAAQQ,IAAI;QACpB;IACF;IACA,MAAMC,MAAMf,eAAeI;IAC3BT,WAAWS,MAAMS,uBAAuB,CAACG;QACvC,oEAAoE;QACpE,yEAAyE;QACzE,2CAA2C;QAC3CA,IAAIlB,IAAI,KAAKiB,MAAM,WAAW;QAC9BC,IAAIC,IAAI,KAAKF,MAAM,mBAAmB;QACtCC,IAAIJ,UAAU,KAAK;QACnB,OAAOI;IACT;IAEA,MAAME,kBAAkBd,KAAKK,MAAM,CAAC,kBAChCf,SAASU,MAAM,kBACfe;IACJ,MAAMC,mBAAmBF,iBAAiBJ,SAAS;IAEnD,IAAI,CAACM,kBAAkB;QACrB,qFAAqF;QACrF,MAAMC,OAAO;YACX,GAAGnB,aAAa;gBAAC;aAAa,CAAC;YAC/B,uCAAuC;YACvC,CAACL,YAAYiB,IAAI,CAAC,EAAE,CAAC,CAAC,EAAEjB,YAAYyB,OAAO,EAAE;QAC/C;QACA,wEAAwE;QACxE,4EAA4E;QAC5E,0BAA0B;QAC1BvB,6BAA6BK,MAAM,CAAC,GAAGiB;QACvCtB,6BAA6BK,MAAMiB,MAAM,CAAC,GAAGR;IAC/C;AACF,EAAE"}
+{"version":3,"sources":["../../../../../../packages/nx-plugin/src/ts/nx-plugin/utils.ts"],"sourcesContent":["/**\n * Copyright Amazon.com, Inc. or its affiliates. All Rights Reserved.\n * SPDX-License-Identifier: Apache-2.0\n */\nimport {\n  joinPathFragments,\n  type Tree,\n  updateJson,\n  writeJson,\n} from '@nx/devkit';\nimport { addDependenciesToPackageJson } from '../../utils/dependencies';\nimport { isEsmWorkspace } from '../../utils/module-format';\nimport {\n  nxPluginSelfDependency,\n  readProjectConfigurationUnqualified,\n} from '../../utils/nx';\nimport { withVersions } from '../../utils/versions';\n\n/**\n * Configures a TypeScript project as an Nx Plugin\n */\nexport const configureTsProjectAsNxPlugin = (\n  tree: Tree,\n  projectName: string,\n) => {\n  const project = readProjectConfigurationUnqualified(tree, projectName);\n\n  const tsConfigPath = joinPathFragments(project.root, 'tsconfig.json');\n  if (!tree.exists(tsConfigPath)) {\n    throw new Error(\n      `Selected plugin project ${projectName} is not a TypeScript project`,\n    );\n  }\n\n  // Create an empty generators.json if one dosn't exist\n  const generatorsJsonPath = joinPathFragments(project.root, 'generators.json');\n  if (!tree.exists(generatorsJsonPath)) {\n    writeJson(tree, generatorsJsonPath, {\n      generators: {},\n    });\n  }\n\n  // Create a package.json if one doesn't exist, and configure \"type\", \"main\"\n  // and \"generators\"\n  const pluginPackageJsonPath = joinPathFragments(project.root, 'package.json');\n  if (!tree.exists(pluginPackageJsonPath)) {\n    writeJson(tree, pluginPackageJsonPath, {\n      name: project.name,\n    });\n  }\n  const esm = isEsmWorkspace(tree);\n  updateJson(tree, pluginPackageJsonPath, (pkg) => {\n    // Match the plugin's module system to the workspace. Nx loads `.ts`\n    // generators via Node's native type stripping, as ESM (workspace root is\n    // `type: module`) or CommonJS accordingly.\n    pkg.type ??= esm ? 'module' : 'commonjs';\n    pkg.main ??= esm ? './src/index.js' : './src/index';\n    pkg.generators ??= './generators.json';\n    return pkg;\n  });\n\n  const selfDependency = nxPluginSelfDependency(tree);\n\n  // Empty inside the plugin's own monorepo, where the plugin is the source\n  // rather than a dependency.\n  if (Object.keys(selfDependency).length > 0) {\n    // Add the required dependencies to the root package.json, and project's package.json\n    const deps = {\n      ...withVersions(['@nx/devkit']),\n      ...selfDependency,\n    };\n    // Generated workspaces are `\"type\": \"module\"`, so Nx loads the plugin's\n    // `.ts` generators as ESM via Node's native type stripping — no swc/ts-node\n    // transpiler is required.\n    addDependenciesToPackageJson(tree, {}, deps);\n    addDependenciesToPackageJson(tree, deps, {}, pluginPackageJsonPath);\n  }\n};\n"],"names":["joinPathFragments","updateJson","writeJson","addDependenciesToPackageJson","isEsmWorkspace","nxPluginSelfDependency","readProjectConfigurationUnqualified","withVersions","configureTsProjectAsNxPlugin","tree","projectName","project","tsConfigPath","root","exists","Error","generatorsJsonPath","generators","pluginPackageJsonPath","name","esm","pkg","type","main","selfDependency","Object","keys","length","deps"],"mappings":"AAAA;;;CAGC,GACD,SACEA,iBAAiB,EAEjBC,UAAU,EACVC,SAAS,QACJ,aAAa;AACpB,SAASC,4BAA4B,QAAQ,8BAA2B;AACxE,SAASC,cAAc,QAAQ,+BAA4B;AAC3D,SACEC,sBAAsB,EACtBC,mCAAmC,QAC9B,oBAAiB;AACxB,SAASC,YAAY,QAAQ,0BAAuB;AAEpD;;CAEC,GACD,OAAO,MAAMC,+BAA+B,CAC1CC,MACAC;IAEA,MAAMC,UAAUL,oCAAoCG,MAAMC;IAE1D,MAAME,eAAeZ,kBAAkBW,QAAQE,IAAI,EAAE;IACrD,IAAI,CAACJ,KAAKK,MAAM,CAACF,eAAe;QAC9B,MAAM,IAAIG,MACR,CAAC,wBAAwB,EAAEL,YAAY,4BAA4B,CAAC;IAExE;IAEA,sDAAsD;IACtD,MAAMM,qBAAqBhB,kBAAkBW,QAAQE,IAAI,EAAE;IAC3D,IAAI,CAACJ,KAAKK,MAAM,CAACE,qBAAqB;QACpCd,UAAUO,MAAMO,oBAAoB;YAClCC,YAAY,CAAC;QACf;IACF;IAEA,2EAA2E;IAC3E,mBAAmB;IACnB,MAAMC,wBAAwBlB,kBAAkBW,QAAQE,IAAI,EAAE;IAC9D,IAAI,CAACJ,KAAKK,MAAM,CAACI,wBAAwB;QACvChB,UAAUO,MAAMS,uBAAuB;YACrCC,MAAMR,QAAQQ,IAAI;QACpB;IACF;IACA,MAAMC,MAAMhB,eAAeK;IAC3BR,WAAWQ,MAAMS,uBAAuB,CAACG;QACvC,oEAAoE;QACpE,yEAAyE;QACzE,2CAA2C;QAC3CA,IAAIC,IAAI,KAAKF,MAAM,WAAW;QAC9BC,IAAIE,IAAI,KAAKH,MAAM,mBAAmB;QACtCC,IAAIJ,UAAU,KAAK;QACnB,OAAOI;IACT;IAEA,MAAMG,iBAAiBnB,uBAAuBI;IAE9C,yEAAyE;IACzE,4BAA4B;IAC5B,IAAIgB,OAAOC,IAAI,CAACF,gBAAgBG,MAAM,GAAG,GAAG;QAC1C,qFAAqF;QACrF,MAAMC,OAAO;YACX,GAAGrB,aAAa;gBAAC;aAAa,CAAC;YAC/B,GAAGiB,cAAc;QACnB;QACA,wEAAwE;QACxE,4EAA4E;QAC5E,0BAA0B;QAC1BrB,6BAA6BM,MAAM,CAAC,GAAGmB;QACvCzB,6BAA6BM,MAAMmB,MAAM,CAAC,GAAGV;IAC/C;AACF,EAAE"}

package/src/ts/rdb/__snapshots__/generator.spec.ts.snap

@@ -105,6 +105,7 @@ exports[`ts#rdb generator > should add mysql prisma dependencies when engine is
 
 exports[`ts#rdb generator > should add mysql prisma dependencies when engine is MySQL > packages/db/src/migration-handler.ts 1`] = `
 "import { execFile } from 'node:child_process';
+import { join } from 'node:path';
 import { promisify } from 'node:util';
 import { getDatabaseSecret, withConnectionRetry } from './utils.js';
 
@@ -122,7 +123,8 @@ const buildDatabaseUrl = async (): Promise<string> => {
 export const handler = async () => {
   await withConnectionRetry(async () => {
     const databaseUrl = await buildDatabaseUrl();
-    await promisify(execFile)('npx', ['prisma', 'migrate', 'deploy'], {
+    const prisma = join(__dirname, 'node_modules', '.bin', 'prisma');
+    await promisify(execFile)(prisma, ['migrate', 'deploy'], {
       cwd: __dirname,
       env: {
         ...process.env,
@@ -3882,6 +3884,7 @@ exports[`ts#rdb generator > should generate the aurora shared construct > packag
 
 exports[`ts#rdb generator > should generate the aurora shared construct > packages/db/src/migration-handler.ts 1`] = `
 "import { execFile } from 'node:child_process';
+import { join } from 'node:path';
 import { promisify } from 'node:util';
 import { getDatabaseSecret, withConnectionRetry } from './utils.js';
 
@@ -3899,7 +3902,8 @@ const buildDatabaseUrl = async (): Promise<string> => {
 export const handler = async () => {
   await withConnectionRetry(async () => {
     const databaseUrl = await buildDatabaseUrl();
-    await promisify(execFile)('npx', ['prisma', 'migrate', 'deploy'], {
+    const prisma = join(__dirname, 'node_modules', '.bin', 'prisma');
+    await promisify(execFile)(prisma, ['migrate', 'deploy'], {
       cwd: __dirname,
       env: {
         ...process.env,
@@ -4680,9 +4684,13 @@ WORKDIR \${LAMBDA_TASK_ROOT}
 
 # npm blocks dependency install scripts by default; allow prisma's so its
 # postinstall downloads the schema-engine binary needed to run migrations.
+# npm is removed once prisma is installed — the handler runs prisma's own
+# binary directly, and npm's bundled dependencies would otherwise carry known
+# HIGH/CRITICAL vulnerabilities into the image.
 RUN printf 'allow-scripts[]=prisma\\nallow-scripts[]=@prisma/engines\\n' > .npmrc \\
     && npm install prisma@7.8.0 \\
-    && rm .npmrc
+    && rm .npmrc \\
+    && npm uninstall -g npm
 
 COPY index.js ./index.js
 COPY prisma ./prisma

package/src/ts/rdb/files/Dockerfile.template

@@ -14,9 +14,13 @@ WORKDIR ${LAMBDA_TASK_ROOT}
 
 # npm blocks dependency install scripts by default; allow prisma's so its
 # postinstall downloads the schema-engine binary needed to run migrations.
+# npm is removed once prisma is installed — the handler runs prisma's own
+# binary directly, and npm's bundled dependencies would otherwise carry known
+# HIGH/CRITICAL vulnerabilities into the image.
 RUN printf 'allow-scripts[]=prisma\nallow-scripts[]=@prisma/engines\n' > .npmrc \
     && npm install prisma@<%= prismaVersion %> \
-    && rm .npmrc
+    && rm .npmrc \
+    && npm uninstall -g npm
 
 COPY index.js ./index.js
 COPY prisma ./prisma

package/src/ts/rdb/files/src/migration-handler.ts.template

@@ -1,4 +1,5 @@
 import { execFile } from 'node:child_process';
+import { join } from 'node:path';
 import { promisify } from 'node:util';
 import { getDatabaseSecret, withConnectionRetry } from './utils<% if (esm) { %>.js<% } %>';
 
@@ -16,7 +17,8 @@ const buildDatabaseUrl = async (): Promise<string> => {
 export const handler = async () => {
   await withConnectionRetry(async () => {
     const databaseUrl = await buildDatabaseUrl();
-    await promisify(execFile)('npx', ['prisma', 'migrate', 'deploy'], {
+    const prisma = join(__dirname, 'node_modules', '.bin', 'prisma');
+    await promisify(execFile)(prisma, ['migrate', 'deploy'], {
       cwd: __dirname,
       env: {
         ...process.env,

package/src/ts/rdb/generator.js

@@ -6,7 +6,7 @@ import { generateFiles, joinPathFragments, readProjectConfiguration, updateJson,
 import { addTypeScriptBundleTarget } from "../../utils/bundle/bundle.js";
 import { resolveContainers } from "../../utils/containers.js";
 import { addDependenciesToPackageJson } from "../../utils/dependencies.js";
-import { addDockerScanTarget } from "../../utils/docker.js";
+import { addDockerScanTarget, nodeImageVersions } from "../../utils/docker.js";
 import { formatFilesInSubtree } from "../../utils/format.js";
 import { FsCommands } from "../../utils/fs.js";
 import { updateGitIgnore } from "../../utils/git.js";
@@ -72,7 +72,7 @@ export const tsRdbGenerator = async (tree, options)=>{
         databasePackageAlias: fullyQualifiedName,
         databaseProvider: options.engine === 'mysql' ? 'mysql' : 'postgresql',
         prismaVersion: TS_VERSIONS.prisma,
-        npmVersion: TS_VERSIONS.npm,
+        ...nodeImageVersions(),
         prismaAdapterPackage: options.engine === 'mysql' ? '@prisma/adapter-mariadb' : '@prisma/adapter-pg',
         prismaAdapterClassName: options.engine === 'mysql' ? 'PrismaMariaDb' : 'PrismaPg',
         localDbPort,