@aws/nx-plugin 1.0.0-rc.53 → 1.0.0-rc.55

package/migrations.json

@@ -21,6 +21,56 @@
       "version": "1.0.0-rc.52",
       "description": "Count the EC2MetaDataSSRF_QUERYARGUMENTS WAF rule on the UserIdentity Web ACL so sign-in from a local dev server is not blocked",
       "implementation": "./src/migrations/latest/user-identity-waf-allow-localhost-callback/migration"
+    },
+    "latest-order-access-log-delivery-after-bucket-policy": {
+      "version": "1.0.0-rc.54",
+      "description": "Order the S3 server access log delivery source after the bucket policy to avoid a 409 from concurrent bucket configuration writes",
+      "implementation": "./src/migrations/latest/order-access-log-delivery-after-bucket-policy/migration"
+    },
+    "latest-backfill-generator-metadata": {
+      "version": "1.0.0-rc.55",
+      "description": "Backfill the project metadata the version sync reads, recovered from the files the generators left behind",
+      "implementation": "./src/migrations/latest/backfill-generator-metadata/migration"
+    },
+    "sync-vended-versions": {
+      "version": "1.0.0-rc.55",
+      "description": "Sync vended dependency versions and the tracked plugin version to those vended by this release",
+      "implementation": "./src/utils/version-upgrade-migration/migration"
+    }
+  },
+  "packageJsonUpdates": {
+    "v1.0.0-rc.55-nx-packages": {
+      "version": "1.0.0-rc.55",
+      "packages": {
+        "nx": {
+          "version": "23.1.0",
+          "alwaysAddToPackageJson": false
+        },
+        "@nx/devkit": {
+          "version": "23.1.0",
+          "alwaysAddToPackageJson": false
+        },
+        "@nx/js": {
+          "version": "23.1.0",
+          "alwaysAddToPackageJson": false
+        },
+        "@nx/react": {
+          "version": "23.1.0",
+          "alwaysAddToPackageJson": false
+        },
+        "@nx/vite": {
+          "version": "23.1.0",
+          "alwaysAddToPackageJson": false
+        },
+        "@nx/vitest": {
+          "version": "23.1.0",
+          "alwaysAddToPackageJson": false
+        },
+        "@nx/workspace": {
+          "version": "23.1.0",
+          "alwaysAddToPackageJson": false
+        }
+      }
     }
   }
 }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@aws/nx-plugin",
-  "version": "1.0.0-rc.53",
+  "version": "1.0.0-rc.55",
   "repository": {
     "type": "git",
     "url": "https://github.com/awslabs/nx-plugin-for-aws.git",

package/src/agentcore-gateway/gateway-connection/generator.js

@@ -5,7 +5,7 @@
 import { installDependencies } from "../../utils/install.js";
 import { addGeneratorMetricsIfApplicable } from "../../utils/metrics.js";
 import { kebabCase } from "../../utils/names.js";
-import { getGeneratorInfo, readProjectConfigurationUnqualified } from "../../utils/nx.js";
+import { addComponentGeneratorMetadata, getGeneratorInfo, readProjectConfigurationUnqualified } from "../../utils/nx.js";
 import { attachUpstreamToLocalGateway } from "../attach-upstream.js";
 import { AGENTCORE_GATEWAY_GENERATOR_INFO, readAgentCoreGatewayMetadata } from "../generator.js";
 export const AGENTCORE_GATEWAY_GATEWAY_CONNECTION_GENERATOR_INFO = getGeneratorInfo(import.meta.filename);
@@ -53,6 +53,8 @@ export const AGENTCORE_GATEWAY_GATEWAY_CONNECTION_GENERATOR_INFO = getGeneratorI
         upstreamProjectName: targetProject.name,
         upstreamDevTargetName: 'dev'
     });
+    // Recorded so the version sync can identify this connection.
+    addComponentGeneratorMetadata(tree, sourceProject.name, AGENTCORE_GATEWAY_GATEWAY_CONNECTION_GENERATOR_INFO, targetProject.root, targetGatewayKebabCase);
     await addGeneratorMetricsIfApplicable(tree, [
         AGENTCORE_GATEWAY_GATEWAY_CONNECTION_GENERATOR_INFO
     ]);

package/src/agentcore-gateway/gateway-connection/generator.js.map

@@ -1 +1 @@
-{"version":3,"sources":["../../../../../../packages/nx-plugin/src/agentcore-gateway/gateway-connection/generator.ts"],"sourcesContent":["/**\n * Copyright Amazon.com, Inc. or its affiliates. All Rights Reserved.\n * SPDX-License-Identifier: Apache-2.0\n */\nimport type { GeneratorCallback, Tree } from '@nx/devkit';\nimport { formatFilesInSubtree } from '../../utils/format';\nimport { installDependencies } from '../../utils/install';\nimport { addGeneratorMetricsIfApplicable } from '../../utils/metrics';\nimport { kebabCase } from '../../utils/names';\nimport {\n  getGeneratorInfo,\n  type NxGeneratorInfo,\n  readProjectConfigurationUnqualified,\n} from '../../utils/nx';\nimport { attachUpstreamToLocalGateway } from '../attach-upstream';\nimport {\n  AGENTCORE_GATEWAY_GENERATOR_INFO,\n  readAgentCoreGatewayMetadata,\n} from '../generator';\nimport type { AgentcoreGatewayGatewayConnectionGeneratorSchema } from './schema';\n\nexport const AGENTCORE_GATEWAY_GATEWAY_CONNECTION_GENERATOR_INFO: NxGeneratorInfo =\n  getGeneratorInfo(import.meta.filename);\n\n/**\n * Connect an AgentCore Gateway to another AgentCore Gateway.\n *\n * Chains the source gateway's dev target to the target gateway's\n * dev target, and registers the target gateway in the source\n * gateway's local local-dev.ts so the local gateway aggregates its tools\n * (already prefixed by the target gateway) under\n * `<targetGateway>___<targetName>___<toolName>`. Users must still call\n * `gateway.addGateway(...)` in their application stack to create the\n * actual CDK/Terraform resource.\n */\nexport const agentcoreGatewayGatewayConnectionGenerator = async (\n  tree: Tree,\n  options: AgentcoreGatewayGatewayConnectionGeneratorSchema,\n): Promise<GeneratorCallback> => {\n  const sourceProject = readProjectConfigurationUnqualified(\n    tree,\n    options.sourceProject,\n  );\n  const targetProject = readProjectConfigurationUnqualified(\n    tree,\n    options.targetProject,\n  );\n\n  const sourceGateway = readAgentCoreGatewayMetadata(sourceProject);\n  const targetGateway = readAgentCoreGatewayMetadata(targetProject);\n\n  if (sourceProject.name === targetProject.name) {\n    throw new Error(\n      `Cannot connect gateway '${sourceGateway.name}' to itself.`,\n    );\n  }\n\n  for (const gateway of [sourceGateway, targetGateway]) {\n    if (gateway.protocol !== 'mcp') {\n      throw new Error(\n        `Gateway '${gateway.name}' has protocol='${gateway.protocol}'. Gateway->Gateway connections are only supported between MCP-protocol gateways.`,\n      );\n    }\n  }\n\n  // The source gateway invokes the target signing with its own IAM role, so\n  // only the target's inbound auth must be IAM. The source's inbound auth (how\n  // its own callers reach it) is irrelevant to this hop.\n  if (targetGateway.auth !== 'iam') {\n    throw new Error(\n      `Gateway '${targetGateway.name}' uses auth='${targetGateway.auth}'. Gateway->Gateway connections currently require the target gateway to use IAM authentication.`,\n    );\n  }\n\n  assertNoCycle(tree, sourceProject.name, targetProject.name);\n\n  // The target name must match the deployed Gateway target (`gatewayName` on\n  // the gateway construct, the project's class name in kebab-case) so\n  // `<targetGateway>___<target>___<tool>` resolves identically locally and\n  // deployed.\n  const targetGatewayKebabCase = kebabCase(targetGateway.rc);\n\n  await attachUpstreamToLocalGateway(tree, sourceProject, 'dev', {\n    targetName: targetGatewayKebabCase,\n    port: targetGateway.port,\n    upstreamProjectName: targetProject.name,\n    upstreamDevTargetName: 'dev',\n  });\n\n  await addGeneratorMetricsIfApplicable(tree, [\n    AGENTCORE_GATEWAY_GATEWAY_CONNECTION_GENERATOR_INFO,\n  ]);\n\n  await formatFilesInSubtree(tree);\n\n  return () =>\n    installDependencies(tree, options.preferInstallDependencies, {\n      languages: ['typescript'],\n    });\n};\n\n/**\n * Reject connections that would make the local gateway graph cyclic — a\n * cycle would recurse infinitely on tools/list both locally and deployed.\n *\n * Walks gateway dev dependsOn edges from the target gateway; the\n * source gateway must not be reachable.\n */\nconst assertNoCycle = (\n  tree: Tree,\n  sourceProjectName: string,\n  targetProjectName: string,\n) => {\n  const visited = new Set<string>();\n  const stack = [targetProjectName];\n  while (stack.length > 0) {\n    const current = stack.pop();\n    if (current === sourceProjectName) {\n      throw new Error(\n        `Connecting '${sourceProjectName}' to '${targetProjectName}' would create a cycle: '${targetProjectName}' already routes to '${sourceProjectName}'.`,\n      );\n    }\n    if (visited.has(current)) {\n      continue;\n    }\n    visited.add(current);\n    const project = readProjectConfigurationUnqualified(tree, current);\n    if (\n      (project.metadata as any)?.generator !==\n      AGENTCORE_GATEWAY_GENERATOR_INFO.id\n    ) {\n      continue;\n    }\n    readAgentCoreGatewayMetadata(project);\n    const devTarget = project.targets?.['dev'];\n    for (const dep of devTarget?.dependsOn ?? []) {\n      if (typeof dep !== 'string') {\n        stack.push(...(dep.projects ?? []));\n      }\n    }\n  }\n};\n\nexport default agentcoreGatewayGatewayConnectionGenerator;\n"],"names":["formatFilesInSubtree","installDependencies","addGeneratorMetricsIfApplicable","kebabCase","getGeneratorInfo","readProjectConfigurationUnqualified","attachUpstreamToLocalGateway","AGENTCORE_GATEWAY_GENERATOR_INFO","readAgentCoreGatewayMetadata","AGENTCORE_GATEWAY_GATEWAY_CONNECTION_GENERATOR_INFO","filename","agentcoreGatewayGatewayConnectionGenerator","tree","options","sourceProject","targetProject","sourceGateway","targetGateway","name","Error","gateway","protocol","auth","assertNoCycle","targetGatewayKebabCase","rc","targetName","port","upstreamProjectName","upstreamDevTargetName","preferInstallDependencies","languages","sourceProjectName","targetProjectName","visited","Set","stack","length","current","pop","has","add","project","metadata","generator","id","devTarget","targets","dep","dependsOn","push","projects"],"mappings":"AAAA;;;CAGC,GAED,SAASA,oBAAoB,QAAQ,wBAAqB;AAC1D,SAASC,mBAAmB,QAAQ,yBAAsB;AAC1D,SAASC,+BAA+B,QAAQ,yBAAsB;AACtE,SAASC,SAAS,QAAQ,uBAAoB;AAC9C,SACEC,gBAAgB,EAEhBC,mCAAmC,QAC9B,oBAAiB;AACxB,SAASC,4BAA4B,QAAQ,wBAAqB;AAClE,SACEC,gCAAgC,EAChCC,4BAA4B,QACvB,kBAAe;AAGtB,OAAO,MAAMC,sDACXL,iBAAiB,YAAYM,QAAQ,EAAE;AAEzC;;;;;;;;;;CAUC,GACD,OAAO,MAAMC,6CAA6C,OACxDC,MACAC;IAEA,MAAMC,gBAAgBT,oCACpBO,MACAC,QAAQC,aAAa;IAEvB,MAAMC,gBAAgBV,oCACpBO,MACAC,QAAQE,aAAa;IAGvB,MAAMC,gBAAgBR,6BAA6BM;IACnD,MAAMG,gBAAgBT,6BAA6BO;IAEnD,IAAID,cAAcI,IAAI,KAAKH,cAAcG,IAAI,EAAE;QAC7C,MAAM,IAAIC,MACR,CAAC,wBAAwB,EAAEH,cAAcE,IAAI,CAAC,YAAY,CAAC;IAE/D;IAEA,KAAK,MAAME,WAAW;QAACJ;QAAeC;KAAc,CAAE;QACpD,IAAIG,QAAQC,QAAQ,KAAK,OAAO;YAC9B,MAAM,IAAIF,MACR,CAAC,SAAS,EAAEC,QAAQF,IAAI,CAAC,gBAAgB,EAAEE,QAAQC,QAAQ,CAAC,iFAAiF,CAAC;QAElJ;IACF;IAEA,0EAA0E;IAC1E,6EAA6E;IAC7E,uDAAuD;IACvD,IAAIJ,cAAcK,IAAI,KAAK,OAAO;QAChC,MAAM,IAAIH,MACR,CAAC,SAAS,EAAEF,cAAcC,IAAI,CAAC,aAAa,EAAED,cAAcK,IAAI,CAAC,+FAA+F,CAAC;IAErK;IAEAC,cAAcX,MAAME,cAAcI,IAAI,EAAEH,cAAcG,IAAI;IAE1D,2EAA2E;IAC3E,oEAAoE;IACpE,yEAAyE;IACzE,YAAY;IACZ,MAAMM,yBAAyBrB,UAAUc,cAAcQ,EAAE;IAEzD,MAAMnB,6BAA6BM,MAAME,eAAe,OAAO;QAC7DY,YAAYF;QACZG,MAAMV,cAAcU,IAAI;QACxBC,qBAAqBb,cAAcG,IAAI;QACvCW,uBAAuB;IACzB;IAEA,MAAM3B,gCAAgCU,MAAM;QAC1CH;KACD;IAED,MAAMT,qBAAqBY;IAE3B,OAAO,IACLX,oBAAoBW,MAAMC,QAAQiB,yBAAyB,EAAE;YAC3DC,WAAW;gBAAC;aAAa;QAC3B;AACJ,EAAE;AAEF;;;;;;CAMC,GACD,MAAMR,gBAAgB,CACpBX,MACAoB,mBACAC;IAEA,MAAMC,UAAU,IAAIC;IACpB,MAAMC,QAAQ;QAACH;KAAkB;IACjC,MAAOG,MAAMC,MAAM,GAAG,EAAG;QACvB,MAAMC,UAAUF,MAAMG,GAAG;QACzB,IAAID,YAAYN,mBAAmB;YACjC,MAAM,IAAIb,MACR,CAAC,YAAY,EAAEa,kBAAkB,MAAM,EAAEC,kBAAkB,yBAAyB,EAAEA,kBAAkB,qBAAqB,EAAED,kBAAkB,EAAE,CAAC;QAExJ;QACA,IAAIE,QAAQM,GAAG,CAACF,UAAU;YACxB;QACF;QACAJ,QAAQO,GAAG,CAACH;QACZ,MAAMI,UAAUrC,oCAAoCO,MAAM0B;QAC1D,IACE,AAACI,QAAQC,QAAQ,EAAUC,cAC3BrC,iCAAiCsC,EAAE,EACnC;YACA;QACF;QACArC,6BAA6BkC;QAC7B,MAAMI,YAAYJ,QAAQK,OAAO,EAAE,CAAC,MAAM;QAC1C,KAAK,MAAMC,OAAOF,WAAWG,aAAa,EAAE,CAAE;YAC5C,IAAI,OAAOD,QAAQ,UAAU;gBAC3BZ,MAAMc,IAAI,IAAKF,IAAIG,QAAQ,IAAI,EAAE;YACnC;QACF;IACF;AACF;AAEA,eAAexC,2CAA2C"}
+{"version":3,"sources":["../../../../../../packages/nx-plugin/src/agentcore-gateway/gateway-connection/generator.ts"],"sourcesContent":["/**\n * Copyright Amazon.com, Inc. or its affiliates. All Rights Reserved.\n * SPDX-License-Identifier: Apache-2.0\n */\nimport type { GeneratorCallback, Tree } from '@nx/devkit';\nimport { formatFilesInSubtree } from '../../utils/format';\nimport { installDependencies } from '../../utils/install';\nimport { addGeneratorMetricsIfApplicable } from '../../utils/metrics';\nimport { kebabCase } from '../../utils/names';\nimport {\n  addComponentGeneratorMetadata,\n  getGeneratorInfo,\n  type NxGeneratorInfo,\n  readProjectConfigurationUnqualified,\n} from '../../utils/nx';\nimport { attachUpstreamToLocalGateway } from '../attach-upstream';\nimport {\n  AGENTCORE_GATEWAY_GENERATOR_INFO,\n  readAgentCoreGatewayMetadata,\n} from '../generator';\nimport type { AgentcoreGatewayGatewayConnectionGeneratorSchema } from './schema';\n\nexport const AGENTCORE_GATEWAY_GATEWAY_CONNECTION_GENERATOR_INFO: NxGeneratorInfo =\n  getGeneratorInfo(import.meta.filename);\n\n/**\n * Connect an AgentCore Gateway to another AgentCore Gateway.\n *\n * Chains the source gateway's dev target to the target gateway's\n * dev target, and registers the target gateway in the source\n * gateway's local local-dev.ts so the local gateway aggregates its tools\n * (already prefixed by the target gateway) under\n * `<targetGateway>___<targetName>___<toolName>`. Users must still call\n * `gateway.addGateway(...)` in their application stack to create the\n * actual CDK/Terraform resource.\n */\nexport const agentcoreGatewayGatewayConnectionGenerator = async (\n  tree: Tree,\n  options: AgentcoreGatewayGatewayConnectionGeneratorSchema,\n): Promise<GeneratorCallback> => {\n  const sourceProject = readProjectConfigurationUnqualified(\n    tree,\n    options.sourceProject,\n  );\n  const targetProject = readProjectConfigurationUnqualified(\n    tree,\n    options.targetProject,\n  );\n\n  const sourceGateway = readAgentCoreGatewayMetadata(sourceProject);\n  const targetGateway = readAgentCoreGatewayMetadata(targetProject);\n\n  if (sourceProject.name === targetProject.name) {\n    throw new Error(\n      `Cannot connect gateway '${sourceGateway.name}' to itself.`,\n    );\n  }\n\n  for (const gateway of [sourceGateway, targetGateway]) {\n    if (gateway.protocol !== 'mcp') {\n      throw new Error(\n        `Gateway '${gateway.name}' has protocol='${gateway.protocol}'. Gateway->Gateway connections are only supported between MCP-protocol gateways.`,\n      );\n    }\n  }\n\n  // The source gateway invokes the target signing with its own IAM role, so\n  // only the target's inbound auth must be IAM. The source's inbound auth (how\n  // its own callers reach it) is irrelevant to this hop.\n  if (targetGateway.auth !== 'iam') {\n    throw new Error(\n      `Gateway '${targetGateway.name}' uses auth='${targetGateway.auth}'. Gateway->Gateway connections currently require the target gateway to use IAM authentication.`,\n    );\n  }\n\n  assertNoCycle(tree, sourceProject.name, targetProject.name);\n\n  // The target name must match the deployed Gateway target (`gatewayName` on\n  // the gateway construct, the project's class name in kebab-case) so\n  // `<targetGateway>___<target>___<tool>` resolves identically locally and\n  // deployed.\n  const targetGatewayKebabCase = kebabCase(targetGateway.rc);\n\n  await attachUpstreamToLocalGateway(tree, sourceProject, 'dev', {\n    targetName: targetGatewayKebabCase,\n    port: targetGateway.port,\n    upstreamProjectName: targetProject.name,\n    upstreamDevTargetName: 'dev',\n  });\n\n  // Recorded so the version sync can identify this connection.\n  addComponentGeneratorMetadata(\n    tree,\n    sourceProject.name,\n    AGENTCORE_GATEWAY_GATEWAY_CONNECTION_GENERATOR_INFO,\n    targetProject.root,\n    targetGatewayKebabCase,\n  );\n\n  await addGeneratorMetricsIfApplicable(tree, [\n    AGENTCORE_GATEWAY_GATEWAY_CONNECTION_GENERATOR_INFO,\n  ]);\n\n  await formatFilesInSubtree(tree);\n\n  return () =>\n    installDependencies(tree, options.preferInstallDependencies, {\n      languages: ['typescript'],\n    });\n};\n\n/**\n * Reject connections that would make the local gateway graph cyclic — a\n * cycle would recurse infinitely on tools/list both locally and deployed.\n *\n * Walks gateway dev dependsOn edges from the target gateway; the\n * source gateway must not be reachable.\n */\nconst assertNoCycle = (\n  tree: Tree,\n  sourceProjectName: string,\n  targetProjectName: string,\n) => {\n  const visited = new Set<string>();\n  const stack = [targetProjectName];\n  while (stack.length > 0) {\n    const current = stack.pop();\n    if (current === sourceProjectName) {\n      throw new Error(\n        `Connecting '${sourceProjectName}' to '${targetProjectName}' would create a cycle: '${targetProjectName}' already routes to '${sourceProjectName}'.`,\n      );\n    }\n    if (visited.has(current)) {\n      continue;\n    }\n    visited.add(current);\n    const project = readProjectConfigurationUnqualified(tree, current);\n    if (\n      (project.metadata as any)?.generator !==\n      AGENTCORE_GATEWAY_GENERATOR_INFO.id\n    ) {\n      continue;\n    }\n    readAgentCoreGatewayMetadata(project);\n    const devTarget = project.targets?.['dev'];\n    for (const dep of devTarget?.dependsOn ?? []) {\n      if (typeof dep !== 'string') {\n        stack.push(...(dep.projects ?? []));\n      }\n    }\n  }\n};\n\nexport default agentcoreGatewayGatewayConnectionGenerator;\n"],"names":["formatFilesInSubtree","installDependencies","addGeneratorMetricsIfApplicable","kebabCase","addComponentGeneratorMetadata","getGeneratorInfo","readProjectConfigurationUnqualified","attachUpstreamToLocalGateway","AGENTCORE_GATEWAY_GENERATOR_INFO","readAgentCoreGatewayMetadata","AGENTCORE_GATEWAY_GATEWAY_CONNECTION_GENERATOR_INFO","filename","agentcoreGatewayGatewayConnectionGenerator","tree","options","sourceProject","targetProject","sourceGateway","targetGateway","name","Error","gateway","protocol","auth","assertNoCycle","targetGatewayKebabCase","rc","targetName","port","upstreamProjectName","upstreamDevTargetName","root","preferInstallDependencies","languages","sourceProjectName","targetProjectName","visited","Set","stack","length","current","pop","has","add","project","metadata","generator","id","devTarget","targets","dep","dependsOn","push","projects"],"mappings":"AAAA;;;CAGC,GAED,SAASA,oBAAoB,QAAQ,wBAAqB;AAC1D,SAASC,mBAAmB,QAAQ,yBAAsB;AAC1D,SAASC,+BAA+B,QAAQ,yBAAsB;AACtE,SAASC,SAAS,QAAQ,uBAAoB;AAC9C,SACEC,6BAA6B,EAC7BC,gBAAgB,EAEhBC,mCAAmC,QAC9B,oBAAiB;AACxB,SAASC,4BAA4B,QAAQ,wBAAqB;AAClE,SACEC,gCAAgC,EAChCC,4BAA4B,QACvB,kBAAe;AAGtB,OAAO,MAAMC,sDACXL,iBAAiB,YAAYM,QAAQ,EAAE;AAEzC;;;;;;;;;;CAUC,GACD,OAAO,MAAMC,6CAA6C,OACxDC,MACAC;IAEA,MAAMC,gBAAgBT,oCACpBO,MACAC,QAAQC,aAAa;IAEvB,MAAMC,gBAAgBV,oCACpBO,MACAC,QAAQE,aAAa;IAGvB,MAAMC,gBAAgBR,6BAA6BM;IACnD,MAAMG,gBAAgBT,6BAA6BO;IAEnD,IAAID,cAAcI,IAAI,KAAKH,cAAcG,IAAI,EAAE;QAC7C,MAAM,IAAIC,MACR,CAAC,wBAAwB,EAAEH,cAAcE,IAAI,CAAC,YAAY,CAAC;IAE/D;IAEA,KAAK,MAAME,WAAW;QAACJ;QAAeC;KAAc,CAAE;QACpD,IAAIG,QAAQC,QAAQ,KAAK,OAAO;YAC9B,MAAM,IAAIF,MACR,CAAC,SAAS,EAAEC,QAAQF,IAAI,CAAC,gBAAgB,EAAEE,QAAQC,QAAQ,CAAC,iFAAiF,CAAC;QAElJ;IACF;IAEA,0EAA0E;IAC1E,6EAA6E;IAC7E,uDAAuD;IACvD,IAAIJ,cAAcK,IAAI,KAAK,OAAO;QAChC,MAAM,IAAIH,MACR,CAAC,SAAS,EAAEF,cAAcC,IAAI,CAAC,aAAa,EAAED,cAAcK,IAAI,CAAC,+FAA+F,CAAC;IAErK;IAEAC,cAAcX,MAAME,cAAcI,IAAI,EAAEH,cAAcG,IAAI;IAE1D,2EAA2E;IAC3E,oEAAoE;IACpE,yEAAyE;IACzE,YAAY;IACZ,MAAMM,yBAAyBtB,UAAUe,cAAcQ,EAAE;IAEzD,MAAMnB,6BAA6BM,MAAME,eAAe,OAAO;QAC7DY,YAAYF;QACZG,MAAMV,cAAcU,IAAI;QACxBC,qBAAqBb,cAAcG,IAAI;QACvCW,uBAAuB;IACzB;IAEA,6DAA6D;IAC7D1B,8BACES,MACAE,cAAcI,IAAI,EAClBT,qDACAM,cAAce,IAAI,EAClBN;IAGF,MAAMvB,gCAAgCW,MAAM;QAC1CH;KACD;IAED,MAAMV,qBAAqBa;IAE3B,OAAO,IACLZ,oBAAoBY,MAAMC,QAAQkB,yBAAyB,EAAE;YAC3DC,WAAW;gBAAC;aAAa;QAC3B;AACJ,EAAE;AAEF;;;;;;CAMC,GACD,MAAMT,gBAAgB,CACpBX,MACAqB,mBACAC;IAEA,MAAMC,UAAU,IAAIC;IACpB,MAAMC,QAAQ;QAACH;KAAkB;IACjC,MAAOG,MAAMC,MAAM,GAAG,EAAG;QACvB,MAAMC,UAAUF,MAAMG,GAAG;QACzB,IAAID,YAAYN,mBAAmB;YACjC,MAAM,IAAId,MACR,CAAC,YAAY,EAAEc,kBAAkB,MAAM,EAAEC,kBAAkB,yBAAyB,EAAEA,kBAAkB,qBAAqB,EAAED,kBAAkB,EAAE,CAAC;QAExJ;QACA,IAAIE,QAAQM,GAAG,CAACF,UAAU;YACxB;QACF;QACAJ,QAAQO,GAAG,CAACH;QACZ,MAAMI,UAAUtC,oCAAoCO,MAAM2B;QAC1D,IACE,AAACI,QAAQC,QAAQ,EAAUC,cAC3BtC,iCAAiCuC,EAAE,EACnC;YACA;QACF;QACAtC,6BAA6BmC;QAC7B,MAAMI,YAAYJ,QAAQK,OAAO,EAAE,CAAC,MAAM;QAC1C,KAAK,MAAMC,OAAOF,WAAWG,aAAa,EAAE,CAAE;YAC5C,IAAI,OAAOD,QAAQ,UAAU;gBAC3BZ,MAAMc,IAAI,IAAKF,IAAIG,QAAQ,IAAI,EAAE;YACnC;QACF;IACF;AACF;AAEA,eAAezC,2CAA2C"}

package/src/agentcore-gateway/generator.d.ts

@@ -4,13 +4,61 @@
  */
 import { type GeneratorCallback, type ProjectConfiguration, type Tree } from '@nx/devkit';
 import { type NxGeneratorInfo } from '../utils/nx';
+import type { IacMetadata } from '../utils/shared-constructs-constants';
 import type { AgentcoreGatewayGeneratorSchema } from './schema';
+export declare const DEPENDENCIES: import("../utils/declared-dependencies").DependencyDeclaration<readonly [{
+    readonly name: "@modelcontextprotocol/sdk";
+}, {
+    readonly name: "express";
+}, {
+    readonly name: "@types/express";
+    readonly dev: true;
+}, {
+    readonly name: "ejs";
+    readonly dev: true;
+}, {
+    readonly name: "@types/ejs";
+    readonly dev: true;
+}, {
+    readonly name: "tsx";
+    readonly dev: true;
+    readonly root: true;
+}, {
+    readonly name: "ejs";
+    readonly when: (m: IacMetadata) => boolean;
+} & {
+    versionOnly: true;
+}, {
+    readonly name: "@aws-sdk/client-bedrock-agentcore";
+    readonly when: (m: IacMetadata) => boolean;
+} & {
+    versionOnly: true;
+}, {
+    readonly name: "@types/ejs";
+    readonly when: (m: IacMetadata) => boolean;
+} & {
+    versionOnly: true;
+}, {
+    readonly name: "constructs";
+    readonly when: (m: IacMetadata) => boolean;
+} & {
+    versionOnly: true;
+}, {
+    readonly name: "aws-cdk-lib";
+    readonly when: (m: IacMetadata) => boolean;
+} & {
+    versionOnly: true;
+}, {
+    readonly name: "@types/node";
+} & {
+    versionOnly: true;
+}], readonly import("../utils/declared-dependencies").DeclaredPyDependency<"a2a-sdk" | "ag-ui-langgraph" | "ag-ui-protocol" | "ag-ui-strands" | "aws-lambda-powertools" | "aws-lambda-powertools[tracer]" | "aws-lambda-powertools[parser]" | "aws-opentelemetry-distro" | "bedrock-agentcore" | "boto3" | "checkov" | "fastapi" | "fastapi[standard]" | "httpx" | "langchain" | "langchain-aws" | "langchain-mcp-adapters" | "langgraph" | "mcp" | "pip-check-updates" | "pip-licenses" | "ruff" | "strands-agents" | "strands-agents[a2a]" | "strands-agents-tools" | "ty" | "pynamodb" | "uvicorn" | "sqlmodel" | "alembic" | "aiomysql" | "asyncpg" | "greenlet", AgentCoreGatewayMetadata>[]>;
 export declare const AGENTCORE_GATEWAY_GENERATOR_INFO: NxGeneratorInfo;
 export declare const agentcoreGatewayGenerator: (tree: Tree, options: AgentcoreGatewayGeneratorSchema) => Promise<GeneratorCallback>;
 /**
  * Gateway details stored in the gateway project's metadata.
  */
-export interface AgentCoreGatewayMetadata {
+export interface AgentCoreGatewayMetadata extends IacMetadata {
     name: string;
     rc: string;
     protocol: string;

package/src/agentcore-gateway/generator.js

@@ -2,8 +2,9 @@
  * Copyright Amazon.com, Inc. or its affiliates. All Rights Reserved.
  * SPDX-License-Identifier: Apache-2.0
  */ import { addProjectConfiguration, generateFiles, joinPathFragments, OverwriteStrategy, updateProjectConfiguration } from "@nx/devkit";
-import { addAgentCoreGatewayInfra } from "../utils/agent-core-constructs/agent-core-constructs.js";
-import { addDependenciesToPackageJson } from "../utils/dependencies.js";
+import { addTsDependencies } from "../utils/add-dependencies.js";
+import { AGENT_CORE_CONSTRUCTS_DEPENDENCIES, addAgentCoreGatewayInfra } from "../utils/agent-core-constructs/agent-core-constructs.js";
+import { declareDependencies, ownedElsewhere } from "../utils/declared-dependencies.js";
 import { formatFilesInSubtree } from "../utils/format.js";
 import { resolveIac } from "../utils/iac.js";
 import { installDependencies } from "../utils/install.js";
@@ -13,8 +14,40 @@ import { getNpmScopePrefix } from "../utils/npm-scope.js";
 import { addGeneratorMetadata, getGeneratorInfo, projectExists, readProjectConfigurationUnqualified } from "../utils/nx.js";
 import { assignPort } from "../utils/port.js";
 import { ensureProjectPackageJson } from "../utils/project-package-json.js";
-import { sharedConstructsGenerator } from "../utils/shared-constructs.js";
-import { withVersions } from "../utils/versions.js";
+import { SHARED_CONSTRUCTS_DEPENDENCIES, sharedConstructsGenerator } from "../utils/shared-constructs.js";
+// The gateway's local-dev server and Cedar policy rendering need these whatever
+// the protocol or auth, so no entry is conditional.
+export const DEPENDENCIES = declareDependencies()({
+    ts: [
+        {
+            name: '@modelcontextprotocol/sdk'
+        },
+        {
+            name: 'express'
+        },
+        {
+            name: '@types/express',
+            dev: true
+        },
+        // ejs renders the Cedar policy in the shared gateway construct.
+        {
+            name: 'ejs',
+            dev: true
+        },
+        {
+            name: '@types/ejs',
+            dev: true
+        },
+        // local-dev.ts runs via tsx, which is shared tooling.
+        {
+            name: 'tsx',
+            dev: true,
+            root: true
+        },
+        ...ownedElsewhere(AGENT_CORE_CONSTRUCTS_DEPENDENCIES),
+        ...ownedElsewhere(SHARED_CONSTRUCTS_DEPENDENCIES)
+    ]
+});
 export const AGENTCORE_GATEWAY_GENERATOR_INFO = getGeneratorInfo(import.meta.filename);
 export const agentcoreGatewayGenerator = async (tree, options)=>{
     const name = kebabCase(options.name);
@@ -104,33 +137,33 @@ export const agentcoreGatewayGenerator = async (tree, options)=>{
             overwriteStrategy: OverwriteStrategy.KeepExisting
         });
     }
-    addGeneratorMetadata(tree, fullyQualifiedName, AGENTCORE_GATEWAY_GENERATOR_INFO, {
+    // Recorded in the metadata below so the version sync can tell a CDK
+    // project from a Terraform one; undefined when no infrastructure was
+    // generated, in which case neither provider's packages were added.
+    const iac = infra !== 'none' ? await resolveIac(tree, options.iac) : undefined;
+    // Recorded below and read by the declaration's predicates, so the packages
+    // added here are exactly the ones the version sync will own.
+    const metadata = {
         name,
         rc: nameClassName,
         protocol,
         auth,
-        port
+        port,
+        ...iac ? {
+            iac
+        } : {}
+    };
+    addGeneratorMetadata(tree, fullyQualifiedName, AGENTCORE_GATEWAY_GENERATOR_INFO, metadata);
+    addTsDependencies(tree, DEPENDENCIES, {
+        metadata,
+        projectRoot
     });
-    // local-dev.ts dependencies (+ ejs for Cedar policy rendering in the
-    // shared gateway construct)
-    addDependenciesToPackageJson(tree, withVersions([
-        '@modelcontextprotocol/sdk',
-        'express'
-    ]), withVersions([
-        '@types/express',
-        'ejs',
-        '@types/ejs'
-    ]), joinPathFragments(projectRoot, 'package.json'));
-    addDependenciesToPackageJson(tree, {}, withVersions([
-        'tsx'
-    ]));
     // Wire up infra (CDK or Terraform); re-running with infra=agentcore adds
     // the infrastructure to a previously infra-less gateway.
     if (infra === 'agentcore') {
-        const iac = await resolveIac(tree, options.iac);
         await sharedConstructsGenerator(tree, {
             iac
-        });
+        }, DEPENDENCIES);
         await addAgentCoreGatewayInfra(tree, {
             gatewayNameClassName: nameClassName,
             gatewayNameKebabCase: name,
@@ -139,7 +172,7 @@ export const agentcoreGatewayGenerator = async (tree, options)=>{
             cedarPolicy,
             auth,
             iac
-        });
+        }, DEPENDENCIES);
     }
     await addGeneratorMetricsIfApplicable(tree, [
         AGENTCORE_GATEWAY_GENERATOR_INFO

package/src/agentcore-gateway/generator.js.map

@@ -1 +1 @@
-{"version":3,"sources":["../../../../../packages/nx-plugin/src/agentcore-gateway/generator.ts"],"sourcesContent":["/**\n * Copyright Amazon.com, Inc. or its affiliates. All Rights Reserved.\n * SPDX-License-Identifier: Apache-2.0\n */\nimport {\n  addProjectConfiguration,\n  type GeneratorCallback,\n  generateFiles,\n  joinPathFragments,\n  OverwriteStrategy,\n  type ProjectConfiguration,\n  type Tree,\n  updateProjectConfiguration,\n} from '@nx/devkit';\nimport { addAgentCoreGatewayInfra } from '../utils/agent-core-constructs/agent-core-constructs';\nimport { addDependenciesToPackageJson } from '../utils/dependencies';\nimport { formatFilesInSubtree } from '../utils/format';\nimport { resolveIac } from '../utils/iac';\nimport { installDependencies } from '../utils/install';\nimport { addGeneratorMetricsIfApplicable } from '../utils/metrics';\nimport { kebabCase, toClassName } from '../utils/names';\nimport { getNpmScopePrefix } from '../utils/npm-scope';\nimport {\n  addGeneratorMetadata,\n  getGeneratorInfo,\n  type NxGeneratorInfo,\n  projectExists,\n  readProjectConfigurationUnqualified,\n} from '../utils/nx';\nimport { assignPort } from '../utils/port';\nimport { ensureProjectPackageJson } from '../utils/project-package-json';\nimport { sharedConstructsGenerator } from '../utils/shared-constructs';\nimport { withVersions } from '../utils/versions';\nimport type { AgentcoreGatewayGeneratorSchema } from './schema';\n\nexport const AGENTCORE_GATEWAY_GENERATOR_INFO: NxGeneratorInfo =\n  getGeneratorInfo(import.meta.filename);\n\nexport const agentcoreGatewayGenerator = async (\n  tree: Tree,\n  options: AgentcoreGatewayGeneratorSchema,\n): Promise<GeneratorCallback> => {\n  const name = kebabCase(options.name);\n  const nameClassName = toClassName(name);\n  const parentDir = options.directory ?? 'packages';\n  const subDir = options.subDirectory ?? name;\n  const projectRoot = joinPathFragments(parentDir, subDir);\n  const fullyQualifiedName = `${getNpmScopePrefix(tree)}${name}`;\n\n  // Protocol is fixed to mcp — the enum accepts only this value, but we still\n  // persist the resolved value in metadata so connection generators can read\n  // it uniformly (and future additions are non-breaking).\n  const protocol = options.protocol ?? 'mcp';\n  // Inbound auth is iam (default) or cognito. Persisted in metadata so\n  // connection generators can validate it (agent -> gateway connections\n  // require an IAM gateway).\n  const auth = options.auth ?? 'iam';\n  const cedarPolicy = options.cedarPolicy ?? true;\n  const infra = options.infra ?? 'agentcore';\n\n  // local-dev.ts is the local gateway: a continuous MCP aggregator chaining\n  // onto attached MCP servers' dev targets (added by the mcp-connection\n  // generator), so a single `nx dev <gateway>` boots the gateway and every\n  // attached MCP server together.\n  //\n  // `serve` exists for parity with other generators; the deployed Gateway is\n  // a managed AWS resource, so `serve`-mode agents talk to it via runtime\n  // config and the local gateway sits idle.\n  const localGatewayTarget = (port: number) => ({\n    executor: 'nx:run-commands' as const,\n    continuous: true,\n    options: {\n      command: 'tsx local-dev.ts',\n      cwd: '{projectRoot}',\n      env: { PORT: `${port}` },\n    },\n    dependsOn: [] as Array<string | { projects: string[]; target: string }>,\n  });\n  let project: ProjectConfiguration;\n  if (projectExists(tree, fullyQualifiedName)) {\n    project = readProjectConfigurationUnqualified(tree, fullyQualifiedName);\n  } else {\n    addProjectConfiguration(tree, fullyQualifiedName, {\n      name: fullyQualifiedName,\n      root: projectRoot,\n      projectType: 'library',\n      sourceRoot: projectRoot,\n      tags: [],\n      targets: {},\n      metadata: {\n        generator: AGENTCORE_GATEWAY_GENERATOR_INFO.id,\n      } as any,\n    });\n    project = readProjectConfigurationUnqualified(tree, fullyQualifiedName);\n  }\n  // Ensure the project has its own package.json so its runtime dependencies\n  // (added below) are declared in it rather than the workspace root.\n  ensureProjectPackageJson(tree, {\n    dir: projectRoot,\n    fullyQualifiedName,\n  });\n  const port = assignPort(tree, project, 8100);\n  // A gateway is its own standalone project, so it uses plain `serve` / `dev`\n  // targets. Re-run: keep existing targets (their dependsOn may have been\n  // populated by the mcp-connection generator), just ensure both exist.\n  project.targets ??= {};\n  project.targets['serve'] ??= localGatewayTarget(port);\n  project.targets['dev'] ??= localGatewayTarget(port);\n  updateProjectConfiguration(tree, project.name, project);\n\n  // Scaffold the gateway project: local-dev.ts (+ Cedar policies if requested)\n  generateFiles(\n    tree,\n    joinPathFragments(import.meta.dirname, 'files', 'project'),\n    projectRoot,\n    { nameClassName, nameKebabCase: name, port, attachedMcpServers: [] },\n    { overwriteStrategy: OverwriteStrategy.KeepExisting },\n  );\n  if (cedarPolicy) {\n    // The default permit-all policy differs by auth type: AgentCore represents\n    // IAM callers as `AgentCore::IamEntity` and Cognito/JWT callers as\n    // `AgentCore::OAuthUser`, so the two policies match different principals.\n    generateFiles(\n      tree,\n      joinPathFragments(import.meta.dirname, 'files', 'cedar'),\n      projectRoot,\n      { nameClassName, auth },\n      { overwriteStrategy: OverwriteStrategy.KeepExisting },\n    );\n  }\n\n  addGeneratorMetadata(\n    tree,\n    fullyQualifiedName,\n    AGENTCORE_GATEWAY_GENERATOR_INFO,\n    {\n      name,\n      rc: nameClassName,\n      protocol,\n      auth,\n      port,\n    },\n  );\n\n  // local-dev.ts dependencies (+ ejs for Cedar policy rendering in the\n  // shared gateway construct)\n  addDependenciesToPackageJson(\n    tree,\n    withVersions(['@modelcontextprotocol/sdk', 'express']),\n    withVersions(['@types/express', 'ejs', '@types/ejs']),\n    joinPathFragments(projectRoot, 'package.json'),\n  );\n  addDependenciesToPackageJson(tree, {}, withVersions(['tsx']));\n\n  // Wire up infra (CDK or Terraform); re-running with infra=agentcore adds\n  // the infrastructure to a previously infra-less gateway.\n  if (infra === 'agentcore') {\n    const iac = await resolveIac(tree, options.iac);\n    await sharedConstructsGenerator(tree, { iac });\n\n    await addAgentCoreGatewayInfra(tree, {\n      gatewayNameClassName: nameClassName,\n      gatewayNameKebabCase: name,\n      projectName: fullyQualifiedName,\n      projectDirectory: projectRoot,\n      cedarPolicy,\n      auth,\n      iac,\n    });\n  }\n\n  await addGeneratorMetricsIfApplicable(tree, [\n    AGENTCORE_GATEWAY_GENERATOR_INFO,\n  ]);\n\n  await formatFilesInSubtree(tree);\n  return () =>\n    installDependencies(tree, options.preferInstallDependencies, {\n      languages: ['typescript'],\n    });\n};\n\n/**\n * Gateway details stored in the gateway project's metadata.\n */\nexport interface AgentCoreGatewayMetadata {\n  name: string;\n  rc: string;\n  protocol: string;\n  auth: string;\n  port: number;\n}\n\n/**\n * Read a gateway project's metadata, validating it was generated by the\n * agentcore-gateway generator.\n */\nexport const readAgentCoreGatewayMetadata = (\n  project: ProjectConfiguration,\n): AgentCoreGatewayMetadata => {\n  const metadata = project.metadata as any;\n  if (metadata?.generator !== AGENTCORE_GATEWAY_GENERATOR_INFO.id) {\n    throw new Error(\n      `Project '${project.name}' was not generated by the '${AGENTCORE_GATEWAY_GENERATOR_INFO.id}' generator.`,\n    );\n  }\n  return metadata as AgentCoreGatewayMetadata;\n};\n\nexport default agentcoreGatewayGenerator;\n"],"names":["addProjectConfiguration","generateFiles","joinPathFragments","OverwriteStrategy","updateProjectConfiguration","addAgentCoreGatewayInfra","addDependenciesToPackageJson","formatFilesInSubtree","resolveIac","installDependencies","addGeneratorMetricsIfApplicable","kebabCase","toClassName","getNpmScopePrefix","addGeneratorMetadata","getGeneratorInfo","projectExists","readProjectConfigurationUnqualified","assignPort","ensureProjectPackageJson","sharedConstructsGenerator","withVersions","AGENTCORE_GATEWAY_GENERATOR_INFO","filename","agentcoreGatewayGenerator","tree","options","name","nameClassName","parentDir","directory","subDir","subDirectory","projectRoot","fullyQualifiedName","protocol","auth","cedarPolicy","infra","localGatewayTarget","port","executor","continuous","command","cwd","env","PORT","dependsOn","project","root","projectType","sourceRoot","tags","targets","metadata","generator","id","dir","dirname","nameKebabCase","attachedMcpServers","overwriteStrategy","KeepExisting","rc","iac","gatewayNameClassName","gatewayNameKebabCase","projectName","projectDirectory","preferInstallDependencies","languages","readAgentCoreGatewayMetadata","Error"],"mappings":"AAAA;;;CAGC,GACD,SACEA,uBAAuB,EAEvBC,aAAa,EACbC,iBAAiB,EACjBC,iBAAiB,EAGjBC,0BAA0B,QACrB,aAAa;AACpB,SAASC,wBAAwB,QAAQ,0DAAuD;AAChG,SAASC,4BAA4B,QAAQ,2BAAwB;AACrE,SAASC,oBAAoB,QAAQ,qBAAkB;AACvD,SAASC,UAAU,QAAQ,kBAAe;AAC1C,SAASC,mBAAmB,QAAQ,sBAAmB;AACvD,SAASC,+BAA+B,QAAQ,sBAAmB;AACnE,SAASC,SAAS,EAAEC,WAAW,QAAQ,oBAAiB;AACxD,SAASC,iBAAiB,QAAQ,wBAAqB;AACvD,SACEC,oBAAoB,EACpBC,gBAAgB,EAEhBC,aAAa,EACbC,mCAAmC,QAC9B,iBAAc;AACrB,SAASC,UAAU,QAAQ,mBAAgB;AAC3C,SAASC,wBAAwB,QAAQ,mCAAgC;AACzE,SAASC,yBAAyB,QAAQ,gCAA6B;AACvE,SAASC,YAAY,QAAQ,uBAAoB;AAGjD,OAAO,MAAMC,mCACXP,iBAAiB,YAAYQ,QAAQ,EAAE;AAEzC,OAAO,MAAMC,4BAA4B,OACvCC,MACAC;IAEA,MAAMC,OAAOhB,UAAUe,QAAQC,IAAI;IACnC,MAAMC,gBAAgBhB,YAAYe;IAClC,MAAME,YAAYH,QAAQI,SAAS,IAAI;IACvC,MAAMC,SAASL,QAAQM,YAAY,IAAIL;IACvC,MAAMM,cAAc/B,kBAAkB2B,WAAWE;IACjD,MAAMG,qBAAqB,GAAGrB,kBAAkBY,QAAQE,MAAM;IAE9D,4EAA4E;IAC5E,2EAA2E;IAC3E,wDAAwD;IACxD,MAAMQ,WAAWT,QAAQS,QAAQ,IAAI;IACrC,qEAAqE;IACrE,sEAAsE;IACtE,2BAA2B;IAC3B,MAAMC,OAAOV,QAAQU,IAAI,IAAI;IAC7B,MAAMC,cAAcX,QAAQW,WAAW,IAAI;IAC3C,MAAMC,QAAQZ,QAAQY,KAAK,IAAI;IAE/B,0EAA0E;IAC1E,sEAAsE;IACtE,yEAAyE;IACzE,gCAAgC;IAChC,EAAE;IACF,2EAA2E;IAC3E,wEAAwE;IACxE,0CAA0C;IAC1C,MAAMC,qBAAqB,CAACC,OAAkB,CAAA;YAC5CC,UAAU;YACVC,YAAY;YACZhB,SAAS;gBACPiB,SAAS;gBACTC,KAAK;gBACLC,KAAK;oBAAEC,MAAM,GAAGN,MAAM;gBAAC;YACzB;YACAO,WAAW,EAAE;QACf,CAAA;IACA,IAAIC;IACJ,IAAIhC,cAAcS,MAAMS,qBAAqB;QAC3Cc,UAAU/B,oCAAoCQ,MAAMS;IACtD,OAAO;QACLlC,wBAAwByB,MAAMS,oBAAoB;YAChDP,MAAMO;YACNe,MAAMhB;YACNiB,aAAa;YACbC,YAAYlB;YACZmB,MAAM,EAAE;YACRC,SAAS,CAAC;YACVC,UAAU;gBACRC,WAAWjC,iCAAiCkC,EAAE;YAChD;QACF;QACAR,UAAU/B,oCAAoCQ,MAAMS;IACtD;IACA,0EAA0E;IAC1E,mEAAmE;IACnEf,yBAAyBM,MAAM;QAC7BgC,KAAKxB;QACLC;IACF;IACA,MAAMM,OAAOtB,WAAWO,MAAMuB,SAAS;IACvC,4EAA4E;IAC5E,wEAAwE;IACxE,sEAAsE;IACtEA,QAAQK,OAAO,KAAK,CAAC;IACrBL,QAAQK,OAAO,CAAC,QAAQ,KAAKd,mBAAmBC;IAChDQ,QAAQK,OAAO,CAAC,MAAM,KAAKd,mBAAmBC;IAC9CpC,2BAA2BqB,MAAMuB,QAAQrB,IAAI,EAAEqB;IAE/C,6EAA6E;IAC7E/C,cACEwB,MACAvB,kBAAkB,YAAYwD,OAAO,EAAE,SAAS,YAChDzB,aACA;QAAEL;QAAe+B,eAAehC;QAAMa;QAAMoB,oBAAoB,EAAE;IAAC,GACnE;QAAEC,mBAAmB1D,kBAAkB2D,YAAY;IAAC;IAEtD,IAAIzB,aAAa;QACf,2EAA2E;QAC3E,mEAAmE;QACnE,0EAA0E;QAC1EpC,cACEwB,MACAvB,kBAAkB,YAAYwD,OAAO,EAAE,SAAS,UAChDzB,aACA;YAAEL;YAAeQ;QAAK,GACtB;YAAEyB,mBAAmB1D,kBAAkB2D,YAAY;QAAC;IAExD;IAEAhD,qBACEW,MACAS,oBACAZ,kCACA;QACEK;QACAoC,IAAInC;QACJO;QACAC;QACAI;IACF;IAGF,qEAAqE;IACrE,4BAA4B;IAC5BlC,6BACEmB,MACAJ,aAAa;QAAC;QAA6B;KAAU,GACrDA,aAAa;QAAC;QAAkB;QAAO;KAAa,GACpDnB,kBAAkB+B,aAAa;IAEjC3B,6BAA6BmB,MAAM,CAAC,GAAGJ,aAAa;QAAC;KAAM;IAE3D,yEAAyE;IACzE,yDAAyD;IACzD,IAAIiB,UAAU,aAAa;QACzB,MAAM0B,MAAM,MAAMxD,WAAWiB,MAAMC,QAAQsC,GAAG;QAC9C,MAAM5C,0BAA0BK,MAAM;YAAEuC;QAAI;QAE5C,MAAM3D,yBAAyBoB,MAAM;YACnCwC,sBAAsBrC;YACtBsC,sBAAsBvC;YACtBwC,aAAajC;YACbkC,kBAAkBnC;YAClBI;YACAD;YACA4B;QACF;IACF;IAEA,MAAMtD,gCAAgCe,MAAM;QAC1CH;KACD;IAED,MAAMf,qBAAqBkB;IAC3B,OAAO,IACLhB,oBAAoBgB,MAAMC,QAAQ2C,yBAAyB,EAAE;YAC3DC,WAAW;gBAAC;aAAa;QAC3B;AACJ,EAAE;AAaF;;;CAGC,GACD,OAAO,MAAMC,+BAA+B,CAC1CvB;IAEA,MAAMM,WAAWN,QAAQM,QAAQ;IACjC,IAAIA,UAAUC,cAAcjC,iCAAiCkC,EAAE,EAAE;QAC/D,MAAM,IAAIgB,MACR,CAAC,SAAS,EAAExB,QAAQrB,IAAI,CAAC,4BAA4B,EAAEL,iCAAiCkC,EAAE,CAAC,YAAY,CAAC;IAE5G;IACA,OAAOF;AACT,EAAE;AAEF,eAAe9B,0BAA0B"}
+{"version":3,"sources":["../../../../../packages/nx-plugin/src/agentcore-gateway/generator.ts"],"sourcesContent":["/**\n * Copyright Amazon.com, Inc. or its affiliates. All Rights Reserved.\n * SPDX-License-Identifier: Apache-2.0\n */\nimport {\n  addProjectConfiguration,\n  type GeneratorCallback,\n  generateFiles,\n  joinPathFragments,\n  OverwriteStrategy,\n  type ProjectConfiguration,\n  type Tree,\n  updateProjectConfiguration,\n} from '@nx/devkit';\nimport { addTsDependencies } from '../utils/add-dependencies';\nimport {\n  AGENT_CORE_CONSTRUCTS_DEPENDENCIES,\n  addAgentCoreGatewayInfra,\n} from '../utils/agent-core-constructs/agent-core-constructs';\nimport {\n  declareDependencies,\n  ownedElsewhere,\n} from '../utils/declared-dependencies';\nimport { formatFilesInSubtree } from '../utils/format';\nimport { resolveIac } from '../utils/iac';\nimport { installDependencies } from '../utils/install';\nimport { addGeneratorMetricsIfApplicable } from '../utils/metrics';\nimport { kebabCase, toClassName } from '../utils/names';\nimport { getNpmScopePrefix } from '../utils/npm-scope';\nimport {\n  addGeneratorMetadata,\n  getGeneratorInfo,\n  type NxGeneratorInfo,\n  projectExists,\n  readProjectConfigurationUnqualified,\n} from '../utils/nx';\nimport { assignPort } from '../utils/port';\nimport { ensureProjectPackageJson } from '../utils/project-package-json';\nimport {\n  SHARED_CONSTRUCTS_DEPENDENCIES,\n  sharedConstructsGenerator,\n} from '../utils/shared-constructs';\nimport type { IacMetadata } from '../utils/shared-constructs-constants';\nimport type { AgentcoreGatewayGeneratorSchema } from './schema';\n\n// The gateway's local-dev server and Cedar policy rendering need these whatever\n// the protocol or auth, so no entry is conditional.\nexport const DEPENDENCIES = declareDependencies<AgentCoreGatewayMetadata>()({\n  ts: [\n    { name: '@modelcontextprotocol/sdk' },\n    { name: 'express' },\n    { name: '@types/express', dev: true },\n    // ejs renders the Cedar policy in the shared gateway construct.\n    { name: 'ejs', dev: true },\n    { name: '@types/ejs', dev: true },\n    // local-dev.ts runs via tsx, which is shared tooling.\n    { name: 'tsx', dev: true, root: true },\n    ...ownedElsewhere(AGENT_CORE_CONSTRUCTS_DEPENDENCIES),\n    ...ownedElsewhere(SHARED_CONSTRUCTS_DEPENDENCIES),\n  ],\n});\n\nexport const AGENTCORE_GATEWAY_GENERATOR_INFO: NxGeneratorInfo =\n  getGeneratorInfo(import.meta.filename);\n\nexport const agentcoreGatewayGenerator = async (\n  tree: Tree,\n  options: AgentcoreGatewayGeneratorSchema,\n): Promise<GeneratorCallback> => {\n  const name = kebabCase(options.name);\n  const nameClassName = toClassName(name);\n  const parentDir = options.directory ?? 'packages';\n  const subDir = options.subDirectory ?? name;\n  const projectRoot = joinPathFragments(parentDir, subDir);\n  const fullyQualifiedName = `${getNpmScopePrefix(tree)}${name}`;\n\n  // Protocol is fixed to mcp — the enum accepts only this value, but we still\n  // persist the resolved value in metadata so connection generators can read\n  // it uniformly (and future additions are non-breaking).\n  const protocol = options.protocol ?? 'mcp';\n  // Inbound auth is iam (default) or cognito. Persisted in metadata so\n  // connection generators can validate it (agent -> gateway connections\n  // require an IAM gateway).\n  const auth = options.auth ?? 'iam';\n  const cedarPolicy = options.cedarPolicy ?? true;\n  const infra = options.infra ?? 'agentcore';\n\n  // local-dev.ts is the local gateway: a continuous MCP aggregator chaining\n  // onto attached MCP servers' dev targets (added by the mcp-connection\n  // generator), so a single `nx dev <gateway>` boots the gateway and every\n  // attached MCP server together.\n  //\n  // `serve` exists for parity with other generators; the deployed Gateway is\n  // a managed AWS resource, so `serve`-mode agents talk to it via runtime\n  // config and the local gateway sits idle.\n  const localGatewayTarget = (port: number) => ({\n    executor: 'nx:run-commands' as const,\n    continuous: true,\n    options: {\n      command: 'tsx local-dev.ts',\n      cwd: '{projectRoot}',\n      env: { PORT: `${port}` },\n    },\n    dependsOn: [] as Array<string | { projects: string[]; target: string }>,\n  });\n  let project: ProjectConfiguration;\n  if (projectExists(tree, fullyQualifiedName)) {\n    project = readProjectConfigurationUnqualified(tree, fullyQualifiedName);\n  } else {\n    addProjectConfiguration(tree, fullyQualifiedName, {\n      name: fullyQualifiedName,\n      root: projectRoot,\n      projectType: 'library',\n      sourceRoot: projectRoot,\n      tags: [],\n      targets: {},\n      metadata: {\n        generator: AGENTCORE_GATEWAY_GENERATOR_INFO.id,\n      } as any,\n    });\n    project = readProjectConfigurationUnqualified(tree, fullyQualifiedName);\n  }\n  // Ensure the project has its own package.json so its runtime dependencies\n  // (added below) are declared in it rather than the workspace root.\n  ensureProjectPackageJson(tree, {\n    dir: projectRoot,\n    fullyQualifiedName,\n  });\n  const port = assignPort(tree, project, 8100);\n  // A gateway is its own standalone project, so it uses plain `serve` / `dev`\n  // targets. Re-run: keep existing targets (their dependsOn may have been\n  // populated by the mcp-connection generator), just ensure both exist.\n  project.targets ??= {};\n  project.targets['serve'] ??= localGatewayTarget(port);\n  project.targets['dev'] ??= localGatewayTarget(port);\n  updateProjectConfiguration(tree, project.name, project);\n\n  // Scaffold the gateway project: local-dev.ts (+ Cedar policies if requested)\n  generateFiles(\n    tree,\n    joinPathFragments(import.meta.dirname, 'files', 'project'),\n    projectRoot,\n    { nameClassName, nameKebabCase: name, port, attachedMcpServers: [] },\n    { overwriteStrategy: OverwriteStrategy.KeepExisting },\n  );\n  if (cedarPolicy) {\n    // The default permit-all policy differs by auth type: AgentCore represents\n    // IAM callers as `AgentCore::IamEntity` and Cognito/JWT callers as\n    // `AgentCore::OAuthUser`, so the two policies match different principals.\n    generateFiles(\n      tree,\n      joinPathFragments(import.meta.dirname, 'files', 'cedar'),\n      projectRoot,\n      { nameClassName, auth },\n      { overwriteStrategy: OverwriteStrategy.KeepExisting },\n    );\n  }\n\n  // Recorded in the metadata below so the version sync can tell a CDK\n  // project from a Terraform one; undefined when no infrastructure was\n  // generated, in which case neither provider's packages were added.\n  const iac =\n    infra !== 'none' ? await resolveIac(tree, options.iac) : undefined;\n\n  // Recorded below and read by the declaration's predicates, so the packages\n  // added here are exactly the ones the version sync will own.\n  const metadata: AgentCoreGatewayMetadata = {\n    name,\n    rc: nameClassName,\n    protocol,\n    auth,\n    port,\n    ...(iac ? { iac } : {}),\n  };\n\n  addGeneratorMetadata(\n    tree,\n    fullyQualifiedName,\n    AGENTCORE_GATEWAY_GENERATOR_INFO,\n    metadata,\n  );\n\n  addTsDependencies(tree, DEPENDENCIES, { metadata, projectRoot });\n\n  // Wire up infra (CDK or Terraform); re-running with infra=agentcore adds\n  // the infrastructure to a previously infra-less gateway.\n\n  if (infra === 'agentcore') {\n    await sharedConstructsGenerator(tree, { iac }, DEPENDENCIES);\n\n    await addAgentCoreGatewayInfra(\n      tree,\n      {\n        gatewayNameClassName: nameClassName,\n        gatewayNameKebabCase: name,\n        projectName: fullyQualifiedName,\n        projectDirectory: projectRoot,\n        cedarPolicy,\n        auth,\n        iac,\n      },\n      DEPENDENCIES,\n    );\n  }\n\n  await addGeneratorMetricsIfApplicable(tree, [\n    AGENTCORE_GATEWAY_GENERATOR_INFO,\n  ]);\n\n  await formatFilesInSubtree(tree);\n  return () =>\n    installDependencies(tree, options.preferInstallDependencies, {\n      languages: ['typescript'],\n    });\n};\n\n/**\n * Gateway details stored in the gateway project's metadata.\n */\nexport interface AgentCoreGatewayMetadata extends IacMetadata {\n  name: string;\n  rc: string;\n  protocol: string;\n  auth: string;\n  port: number;\n}\n\n/**\n * Read a gateway project's metadata, validating it was generated by the\n * agentcore-gateway generator.\n */\nexport const readAgentCoreGatewayMetadata = (\n  project: ProjectConfiguration,\n): AgentCoreGatewayMetadata => {\n  const metadata = project.metadata as any;\n  if (metadata?.generator !== AGENTCORE_GATEWAY_GENERATOR_INFO.id) {\n    throw new Error(\n      `Project '${project.name}' was not generated by the '${AGENTCORE_GATEWAY_GENERATOR_INFO.id}' generator.`,\n    );\n  }\n  return metadata as AgentCoreGatewayMetadata;\n};\n\nexport default agentcoreGatewayGenerator;\n"],"names":["addProjectConfiguration","generateFiles","joinPathFragments","OverwriteStrategy","updateProjectConfiguration","addTsDependencies","AGENT_CORE_CONSTRUCTS_DEPENDENCIES","addAgentCoreGatewayInfra","declareDependencies","ownedElsewhere","formatFilesInSubtree","resolveIac","installDependencies","addGeneratorMetricsIfApplicable","kebabCase","toClassName","getNpmScopePrefix","addGeneratorMetadata","getGeneratorInfo","projectExists","readProjectConfigurationUnqualified","assignPort","ensureProjectPackageJson","SHARED_CONSTRUCTS_DEPENDENCIES","sharedConstructsGenerator","DEPENDENCIES","ts","name","dev","root","AGENTCORE_GATEWAY_GENERATOR_INFO","filename","agentcoreGatewayGenerator","tree","options","nameClassName","parentDir","directory","subDir","subDirectory","projectRoot","fullyQualifiedName","protocol","auth","cedarPolicy","infra","localGatewayTarget","port","executor","continuous","command","cwd","env","PORT","dependsOn","project","projectType","sourceRoot","tags","targets","metadata","generator","id","dir","dirname","nameKebabCase","attachedMcpServers","overwriteStrategy","KeepExisting","iac","undefined","rc","gatewayNameClassName","gatewayNameKebabCase","projectName","projectDirectory","preferInstallDependencies","languages","readAgentCoreGatewayMetadata","Error"],"mappings":"AAAA;;;CAGC,GACD,SACEA,uBAAuB,EAEvBC,aAAa,EACbC,iBAAiB,EACjBC,iBAAiB,EAGjBC,0BAA0B,QACrB,aAAa;AACpB,SAASC,iBAAiB,QAAQ,+BAA4B;AAC9D,SACEC,kCAAkC,EAClCC,wBAAwB,QACnB,0DAAuD;AAC9D,SACEC,mBAAmB,EACnBC,cAAc,QACT,oCAAiC;AACxC,SAASC,oBAAoB,QAAQ,qBAAkB;AACvD,SAASC,UAAU,QAAQ,kBAAe;AAC1C,SAASC,mBAAmB,QAAQ,sBAAmB;AACvD,SAASC,+BAA+B,QAAQ,sBAAmB;AACnE,SAASC,SAAS,EAAEC,WAAW,QAAQ,oBAAiB;AACxD,SAASC,iBAAiB,QAAQ,wBAAqB;AACvD,SACEC,oBAAoB,EACpBC,gBAAgB,EAEhBC,aAAa,EACbC,mCAAmC,QAC9B,iBAAc;AACrB,SAASC,UAAU,QAAQ,mBAAgB;AAC3C,SAASC,wBAAwB,QAAQ,mCAAgC;AACzE,SACEC,8BAA8B,EAC9BC,yBAAyB,QACpB,gCAA6B;AAIpC,gFAAgF;AAChF,oDAAoD;AACpD,OAAO,MAAMC,eAAejB,sBAAgD;IAC1EkB,IAAI;QACF;YAAEC,MAAM;QAA4B;QACpC;YAAEA,MAAM;QAAU;QAClB;YAAEA,MAAM;YAAkBC,KAAK;QAAK;QACpC,gEAAgE;QAChE;YAAED,MAAM;YAAOC,KAAK;QAAK;QACzB;YAAED,MAAM;YAAcC,KAAK;QAAK;QAChC,sDAAsD;QACtD;YAAED,MAAM;YAAOC,KAAK;YAAMC,MAAM;QAAK;WAClCpB,eAAeH;WACfG,eAAec;KACnB;AACH,GAAG;AAEH,OAAO,MAAMO,mCACXZ,iBAAiB,YAAYa,QAAQ,EAAE;AAEzC,OAAO,MAAMC,4BAA4B,OACvCC,MACAC;IAEA,MAAMP,OAAOb,UAAUoB,QAAQP,IAAI;IACnC,MAAMQ,gBAAgBpB,YAAYY;IAClC,MAAMS,YAAYF,QAAQG,SAAS,IAAI;IACvC,MAAMC,SAASJ,QAAQK,YAAY,IAAIZ;IACvC,MAAMa,cAActC,kBAAkBkC,WAAWE;IACjD,MAAMG,qBAAqB,GAAGzB,kBAAkBiB,QAAQN,MAAM;IAE9D,4EAA4E;IAC5E,2EAA2E;IAC3E,wDAAwD;IACxD,MAAMe,WAAWR,QAAQQ,QAAQ,IAAI;IACrC,qEAAqE;IACrE,sEAAsE;IACtE,2BAA2B;IAC3B,MAAMC,OAAOT,QAAQS,IAAI,IAAI;IAC7B,MAAMC,cAAcV,QAAQU,WAAW,IAAI;IAC3C,MAAMC,QAAQX,QAAQW,KAAK,IAAI;IAE/B,0EAA0E;IAC1E,sEAAsE;IACtE,yEAAyE;IACzE,gCAAgC;IAChC,EAAE;IACF,2EAA2E;IAC3E,wEAAwE;IACxE,0CAA0C;IAC1C,MAAMC,qBAAqB,CAACC,OAAkB,CAAA;YAC5CC,UAAU;YACVC,YAAY;YACZf,SAAS;gBACPgB,SAAS;gBACTC,KAAK;gBACLC,KAAK;oBAAEC,MAAM,GAAGN,MAAM;gBAAC;YACzB;YACAO,WAAW,EAAE;QACf,CAAA;IACA,IAAIC;IACJ,IAAIpC,cAAcc,MAAMQ,qBAAqB;QAC3Cc,UAAUnC,oCAAoCa,MAAMQ;IACtD,OAAO;QACLzC,wBAAwBiC,MAAMQ,oBAAoB;YAChDd,MAAMc;YACNZ,MAAMW;YACNgB,aAAa;YACbC,YAAYjB;YACZkB,MAAM,EAAE;YACRC,SAAS,CAAC;YACVC,UAAU;gBACRC,WAAW/B,iCAAiCgC,EAAE;YAChD;QACF;QACAP,UAAUnC,oCAAoCa,MAAMQ;IACtD;IACA,0EAA0E;IAC1E,mEAAmE;IACnEnB,yBAAyBW,MAAM;QAC7B8B,KAAKvB;QACLC;IACF;IACA,MAAMM,OAAO1B,WAAWY,MAAMsB,SAAS;IACvC,4EAA4E;IAC5E,wEAAwE;IACxE,sEAAsE;IACtEA,QAAQI,OAAO,KAAK,CAAC;IACrBJ,QAAQI,OAAO,CAAC,QAAQ,KAAKb,mBAAmBC;IAChDQ,QAAQI,OAAO,CAAC,MAAM,KAAKb,mBAAmBC;IAC9C3C,2BAA2B6B,MAAMsB,QAAQ5B,IAAI,EAAE4B;IAE/C,6EAA6E;IAC7EtD,cACEgC,MACA/B,kBAAkB,YAAY8D,OAAO,EAAE,SAAS,YAChDxB,aACA;QAAEL;QAAe8B,eAAetC;QAAMoB;QAAMmB,oBAAoB,EAAE;IAAC,GACnE;QAAEC,mBAAmBhE,kBAAkBiE,YAAY;IAAC;IAEtD,IAAIxB,aAAa;QACf,2EAA2E;QAC3E,mEAAmE;QACnE,0EAA0E;QAC1E3C,cACEgC,MACA/B,kBAAkB,YAAY8D,OAAO,EAAE,SAAS,UAChDxB,aACA;YAAEL;YAAeQ;QAAK,GACtB;YAAEwB,mBAAmBhE,kBAAkBiE,YAAY;QAAC;IAExD;IAEA,oEAAoE;IACpE,qEAAqE;IACrE,mEAAmE;IACnE,MAAMC,MACJxB,UAAU,SAAS,MAAMlC,WAAWsB,MAAMC,QAAQmC,GAAG,IAAIC;IAE3D,2EAA2E;IAC3E,6DAA6D;IAC7D,MAAMV,WAAqC;QACzCjC;QACA4C,IAAIpC;QACJO;QACAC;QACAI;QACA,GAAIsB,MAAM;YAAEA;QAAI,IAAI,CAAC,CAAC;IACxB;IAEApD,qBACEgB,MACAQ,oBACAX,kCACA8B;IAGFvD,kBAAkB4B,MAAMR,cAAc;QAAEmC;QAAUpB;IAAY;IAE9D,yEAAyE;IACzE,yDAAyD;IAEzD,IAAIK,UAAU,aAAa;QACzB,MAAMrB,0BAA0BS,MAAM;YAAEoC;QAAI,GAAG5C;QAE/C,MAAMlB,yBACJ0B,MACA;YACEuC,sBAAsBrC;YACtBsC,sBAAsB9C;YACtB+C,aAAajC;YACbkC,kBAAkBnC;YAClBI;YACAD;YACA0B;QACF,GACA5C;IAEJ;IAEA,MAAMZ,gCAAgCoB,MAAM;QAC1CH;KACD;IAED,MAAMpB,qBAAqBuB;IAC3B,OAAO,IACLrB,oBAAoBqB,MAAMC,QAAQ0C,yBAAyB,EAAE;YAC3DC,WAAW;gBAAC;aAAa;QAC3B;AACJ,EAAE;AAaF;;;CAGC,GACD,OAAO,MAAMC,+BAA+B,CAC1CvB;IAEA,MAAMK,WAAWL,QAAQK,QAAQ;IACjC,IAAIA,UAAUC,cAAc/B,iCAAiCgC,EAAE,EAAE;QAC/D,MAAM,IAAIiB,MACR,CAAC,SAAS,EAAExB,QAAQ5B,IAAI,CAAC,4BAA4B,EAAEG,iCAAiCgC,EAAE,CAAC,YAAY,CAAC;IAE5G;IACA,OAAOF;AACT,EAAE;AAEF,eAAe5B,0BAA0B"}

package/src/agentcore-gateway/mcp-connection/generator.js

@@ -5,7 +5,7 @@
 import { installDependencies } from "../../utils/install.js";
 import { addGeneratorMetricsIfApplicable } from "../../utils/metrics.js";
 import { kebabCase } from "../../utils/names.js";
-import { getGeneratorInfo, readProjectConfigurationUnqualified } from "../../utils/nx.js";
+import { addComponentGeneratorMetadata, getGeneratorInfo, readProjectConfigurationUnqualified } from "../../utils/nx.js";
 import { attachUpstreamToLocalGateway } from "../attach-upstream.js";
 import { readAgentCoreGatewayMetadata } from "../generator.js";
 export const AGENTCORE_GATEWAY_MCP_CONNECTION_GENERATOR_INFO = getGeneratorInfo(import.meta.filename);
@@ -44,6 +44,8 @@ export const AGENTCORE_GATEWAY_MCP_CONNECTION_GENERATOR_INFO = getGeneratorInfo(
         upstreamProjectName: targetProject.name,
         upstreamDevTargetName: `${mcpComponentName}-dev`
     });
+    // Recorded so the version sync can identify this connection.
+    addComponentGeneratorMetadata(tree, sourceProject.name, AGENTCORE_GATEWAY_MCP_CONNECTION_GENERATOR_INFO, targetProject.root, mcpTargetName);
     await addGeneratorMetricsIfApplicable(tree, [
         AGENTCORE_GATEWAY_MCP_CONNECTION_GENERATOR_INFO
     ]);

package/src/agentcore-gateway/mcp-connection/generator.js.map

@@ -1 +1 @@
-{"version":3,"sources":["../../../../../../packages/nx-plugin/src/agentcore-gateway/mcp-connection/generator.ts"],"sourcesContent":["/**\n * Copyright Amazon.com, Inc. or its affiliates. All Rights Reserved.\n * SPDX-License-Identifier: Apache-2.0\n */\nimport type { GeneratorCallback, Tree } from '@nx/devkit';\nimport { formatFilesInSubtree } from '../../utils/format';\nimport { installDependencies } from '../../utils/install';\nimport { addGeneratorMetricsIfApplicable } from '../../utils/metrics';\nimport { kebabCase } from '../../utils/names';\nimport {\n  getGeneratorInfo,\n  type NxGeneratorInfo,\n  readProjectConfigurationUnqualified,\n} from '../../utils/nx';\nimport { attachUpstreamToLocalGateway } from '../attach-upstream';\nimport { readAgentCoreGatewayMetadata } from '../generator';\nimport type { AgentcoreGatewayMcpConnectionGeneratorSchema } from './schema';\n\nexport const AGENTCORE_GATEWAY_MCP_CONNECTION_GENERATOR_INFO: NxGeneratorInfo =\n  getGeneratorInfo(import.meta.filename);\n\n/**\n * Connect an AgentCore Gateway to an MCP server.\n *\n * Chains the gateway's dev target to the MCP server's dev\n * target, and registers the server in the gateway's local local-dev.ts so\n * the local gateway aggregates its tools. Users must still call\n * `gateway.addMcpServer(...)` in their application stack to create the\n * actual CDK/Terraform resource.\n */\nexport const agentcoreGatewayMcpConnectionGenerator = async (\n  tree: Tree,\n  options: AgentcoreGatewayMcpConnectionGeneratorSchema,\n): Promise<GeneratorCallback> => {\n  const sourceProject = readProjectConfigurationUnqualified(\n    tree,\n    options.sourceProject,\n  );\n  const targetProject = readProjectConfigurationUnqualified(\n    tree,\n    options.targetProject,\n  );\n\n  const gateway = readAgentCoreGatewayMetadata(sourceProject);\n  const mcpComponent = options.targetComponent;\n\n  if (!mcpComponent) {\n    throw new Error(\n      `Target project '${options.targetProject}' has no MCP server component metadata. Did you run the 'ts#mcp-server' or 'py#mcp-server' generator?`,\n    );\n  }\n\n  if (gateway.protocol !== 'mcp') {\n    throw new Error(\n      `Gateway '${gateway.name}' has protocol='${gateway.protocol}'. MCP server targets can only be attached to MCP-protocol gateways.`,\n    );\n  }\n  if (mcpComponent.auth && mcpComponent.auth !== 'iam') {\n    throw new Error(\n      `MCP server '${mcpComponent.name}' uses auth='${mcpComponent.auth}'. Gateway->MCP connections currently require the MCP server to use IAM authentication.`,\n    );\n  }\n\n  // The target name must match what the deployed Gateway uses\n  // (`mcpServerName` on the MCP construct, derived from the project's class\n  // name) so `<target>___<tool>` resolves identically locally and deployed.\n  // Component-level `name` would clash whenever two MCP server projects\n  // both default to `mcp-server`.\n  const mcpTargetName = kebabCase(mcpComponent.rc as string);\n  const mcpComponentName = mcpComponent.name ?? 'mcp-server';\n\n  await attachUpstreamToLocalGateway(tree, sourceProject, 'dev', {\n    targetName: mcpTargetName,\n    port: (mcpComponent.port as number | undefined) ?? 8000,\n    upstreamProjectName: targetProject.name,\n    upstreamDevTargetName: `${mcpComponentName}-dev`,\n  });\n\n  await addGeneratorMetricsIfApplicable(tree, [\n    AGENTCORE_GATEWAY_MCP_CONNECTION_GENERATOR_INFO,\n  ]);\n\n  await formatFilesInSubtree(tree);\n\n  return () =>\n    installDependencies(tree, options.preferInstallDependencies, {\n      languages: ['typescript'],\n    });\n};\n\nexport default agentcoreGatewayMcpConnectionGenerator;\n"],"names":["formatFilesInSubtree","installDependencies","addGeneratorMetricsIfApplicable","kebabCase","getGeneratorInfo","readProjectConfigurationUnqualified","attachUpstreamToLocalGateway","readAgentCoreGatewayMetadata","AGENTCORE_GATEWAY_MCP_CONNECTION_GENERATOR_INFO","filename","agentcoreGatewayMcpConnectionGenerator","tree","options","sourceProject","targetProject","gateway","mcpComponent","targetComponent","Error","protocol","name","auth","mcpTargetName","rc","mcpComponentName","targetName","port","upstreamProjectName","upstreamDevTargetName","preferInstallDependencies","languages"],"mappings":"AAAA;;;CAGC,GAED,SAASA,oBAAoB,QAAQ,wBAAqB;AAC1D,SAASC,mBAAmB,QAAQ,yBAAsB;AAC1D,SAASC,+BAA+B,QAAQ,yBAAsB;AACtE,SAASC,SAAS,QAAQ,uBAAoB;AAC9C,SACEC,gBAAgB,EAEhBC,mCAAmC,QAC9B,oBAAiB;AACxB,SAASC,4BAA4B,QAAQ,wBAAqB;AAClE,SAASC,4BAA4B,QAAQ,kBAAe;AAG5D,OAAO,MAAMC,kDACXJ,iBAAiB,YAAYK,QAAQ,EAAE;AAEzC;;;;;;;;CAQC,GACD,OAAO,MAAMC,yCAAyC,OACpDC,MACAC;IAEA,MAAMC,gBAAgBR,oCACpBM,MACAC,QAAQC,aAAa;IAEvB,MAAMC,gBAAgBT,oCACpBM,MACAC,QAAQE,aAAa;IAGvB,MAAMC,UAAUR,6BAA6BM;IAC7C,MAAMG,eAAeJ,QAAQK,eAAe;IAE5C,IAAI,CAACD,cAAc;QACjB,MAAM,IAAIE,MACR,CAAC,gBAAgB,EAAEN,QAAQE,aAAa,CAAC,qGAAqG,CAAC;IAEnJ;IAEA,IAAIC,QAAQI,QAAQ,KAAK,OAAO;QAC9B,MAAM,IAAID,MACR,CAAC,SAAS,EAAEH,QAAQK,IAAI,CAAC,gBAAgB,EAAEL,QAAQI,QAAQ,CAAC,oEAAoE,CAAC;IAErI;IACA,IAAIH,aAAaK,IAAI,IAAIL,aAAaK,IAAI,KAAK,OAAO;QACpD,MAAM,IAAIH,MACR,CAAC,YAAY,EAAEF,aAAaI,IAAI,CAAC,aAAa,EAAEJ,aAAaK,IAAI,CAAC,uFAAuF,CAAC;IAE9J;IAEA,4DAA4D;IAC5D,0EAA0E;IAC1E,0EAA0E;IAC1E,sEAAsE;IACtE,gCAAgC;IAChC,MAAMC,gBAAgBnB,UAAUa,aAAaO,EAAE;IAC/C,MAAMC,mBAAmBR,aAAaI,IAAI,IAAI;IAE9C,MAAMd,6BAA6BK,MAAME,eAAe,OAAO;QAC7DY,YAAYH;QACZI,MAAM,AAACV,aAAaU,IAAI,IAA2B;QACnDC,qBAAqBb,cAAcM,IAAI;QACvCQ,uBAAuB,GAAGJ,iBAAiB,IAAI,CAAC;IAClD;IAEA,MAAMtB,gCAAgCS,MAAM;QAC1CH;KACD;IAED,MAAMR,qBAAqBW;IAE3B,OAAO,IACLV,oBAAoBU,MAAMC,QAAQiB,yBAAyB,EAAE;YAC3DC,WAAW;gBAAC;aAAa;QAC3B;AACJ,EAAE;AAEF,eAAepB,uCAAuC"}
+{"version":3,"sources":["../../../../../../packages/nx-plugin/src/agentcore-gateway/mcp-connection/generator.ts"],"sourcesContent":["/**\n * Copyright Amazon.com, Inc. or its affiliates. All Rights Reserved.\n * SPDX-License-Identifier: Apache-2.0\n */\nimport type { GeneratorCallback, Tree } from '@nx/devkit';\nimport { formatFilesInSubtree } from '../../utils/format';\nimport { installDependencies } from '../../utils/install';\nimport { addGeneratorMetricsIfApplicable } from '../../utils/metrics';\nimport { kebabCase } from '../../utils/names';\nimport {\n  addComponentGeneratorMetadata,\n  getGeneratorInfo,\n  type NxGeneratorInfo,\n  readProjectConfigurationUnqualified,\n} from '../../utils/nx';\nimport { attachUpstreamToLocalGateway } from '../attach-upstream';\nimport { readAgentCoreGatewayMetadata } from '../generator';\nimport type { AgentcoreGatewayMcpConnectionGeneratorSchema } from './schema';\n\nexport const AGENTCORE_GATEWAY_MCP_CONNECTION_GENERATOR_INFO: NxGeneratorInfo =\n  getGeneratorInfo(import.meta.filename);\n\n/**\n * Connect an AgentCore Gateway to an MCP server.\n *\n * Chains the gateway's dev target to the MCP server's dev\n * target, and registers the server in the gateway's local local-dev.ts so\n * the local gateway aggregates its tools. Users must still call\n * `gateway.addMcpServer(...)` in their application stack to create the\n * actual CDK/Terraform resource.\n */\nexport const agentcoreGatewayMcpConnectionGenerator = async (\n  tree: Tree,\n  options: AgentcoreGatewayMcpConnectionGeneratorSchema,\n): Promise<GeneratorCallback> => {\n  const sourceProject = readProjectConfigurationUnqualified(\n    tree,\n    options.sourceProject,\n  );\n  const targetProject = readProjectConfigurationUnqualified(\n    tree,\n    options.targetProject,\n  );\n\n  const gateway = readAgentCoreGatewayMetadata(sourceProject);\n  const mcpComponent = options.targetComponent;\n\n  if (!mcpComponent) {\n    throw new Error(\n      `Target project '${options.targetProject}' has no MCP server component metadata. Did you run the 'ts#mcp-server' or 'py#mcp-server' generator?`,\n    );\n  }\n\n  if (gateway.protocol !== 'mcp') {\n    throw new Error(\n      `Gateway '${gateway.name}' has protocol='${gateway.protocol}'. MCP server targets can only be attached to MCP-protocol gateways.`,\n    );\n  }\n  if (mcpComponent.auth && mcpComponent.auth !== 'iam') {\n    throw new Error(\n      `MCP server '${mcpComponent.name}' uses auth='${mcpComponent.auth}'. Gateway->MCP connections currently require the MCP server to use IAM authentication.`,\n    );\n  }\n\n  // The target name must match what the deployed Gateway uses\n  // (`mcpServerName` on the MCP construct, derived from the project's class\n  // name) so `<target>___<tool>` resolves identically locally and deployed.\n  // Component-level `name` would clash whenever two MCP server projects\n  // both default to `mcp-server`.\n  const mcpTargetName = kebabCase(mcpComponent.rc as string);\n  const mcpComponentName = mcpComponent.name ?? 'mcp-server';\n\n  await attachUpstreamToLocalGateway(tree, sourceProject, 'dev', {\n    targetName: mcpTargetName,\n    port: (mcpComponent.port as number | undefined) ?? 8000,\n    upstreamProjectName: targetProject.name,\n    upstreamDevTargetName: `${mcpComponentName}-dev`,\n  });\n\n  // Recorded so the version sync can identify this connection.\n  addComponentGeneratorMetadata(\n    tree,\n    sourceProject.name,\n    AGENTCORE_GATEWAY_MCP_CONNECTION_GENERATOR_INFO,\n    targetProject.root,\n    mcpTargetName,\n  );\n\n  await addGeneratorMetricsIfApplicable(tree, [\n    AGENTCORE_GATEWAY_MCP_CONNECTION_GENERATOR_INFO,\n  ]);\n\n  await formatFilesInSubtree(tree);\n\n  return () =>\n    installDependencies(tree, options.preferInstallDependencies, {\n      languages: ['typescript'],\n    });\n};\n\nexport default agentcoreGatewayMcpConnectionGenerator;\n"],"names":["formatFilesInSubtree","installDependencies","addGeneratorMetricsIfApplicable","kebabCase","addComponentGeneratorMetadata","getGeneratorInfo","readProjectConfigurationUnqualified","attachUpstreamToLocalGateway","readAgentCoreGatewayMetadata","AGENTCORE_GATEWAY_MCP_CONNECTION_GENERATOR_INFO","filename","agentcoreGatewayMcpConnectionGenerator","tree","options","sourceProject","targetProject","gateway","mcpComponent","targetComponent","Error","protocol","name","auth","mcpTargetName","rc","mcpComponentName","targetName","port","upstreamProjectName","upstreamDevTargetName","root","preferInstallDependencies","languages"],"mappings":"AAAA;;;CAGC,GAED,SAASA,oBAAoB,QAAQ,wBAAqB;AAC1D,SAASC,mBAAmB,QAAQ,yBAAsB;AAC1D,SAASC,+BAA+B,QAAQ,yBAAsB;AACtE,SAASC,SAAS,QAAQ,uBAAoB;AAC9C,SACEC,6BAA6B,EAC7BC,gBAAgB,EAEhBC,mCAAmC,QAC9B,oBAAiB;AACxB,SAASC,4BAA4B,QAAQ,wBAAqB;AAClE,SAASC,4BAA4B,QAAQ,kBAAe;AAG5D,OAAO,MAAMC,kDACXJ,iBAAiB,YAAYK,QAAQ,EAAE;AAEzC;;;;;;;;CAQC,GACD,OAAO,MAAMC,yCAAyC,OACpDC,MACAC;IAEA,MAAMC,gBAAgBR,oCACpBM,MACAC,QAAQC,aAAa;IAEvB,MAAMC,gBAAgBT,oCACpBM,MACAC,QAAQE,aAAa;IAGvB,MAAMC,UAAUR,6BAA6BM;IAC7C,MAAMG,eAAeJ,QAAQK,eAAe;IAE5C,IAAI,CAACD,cAAc;QACjB,MAAM,IAAIE,MACR,CAAC,gBAAgB,EAAEN,QAAQE,aAAa,CAAC,qGAAqG,CAAC;IAEnJ;IAEA,IAAIC,QAAQI,QAAQ,KAAK,OAAO;QAC9B,MAAM,IAAID,MACR,CAAC,SAAS,EAAEH,QAAQK,IAAI,CAAC,gBAAgB,EAAEL,QAAQI,QAAQ,CAAC,oEAAoE,CAAC;IAErI;IACA,IAAIH,aAAaK,IAAI,IAAIL,aAAaK,IAAI,KAAK,OAAO;QACpD,MAAM,IAAIH,MACR,CAAC,YAAY,EAAEF,aAAaI,IAAI,CAAC,aAAa,EAAEJ,aAAaK,IAAI,CAAC,uFAAuF,CAAC;IAE9J;IAEA,4DAA4D;IAC5D,0EAA0E;IAC1E,0EAA0E;IAC1E,sEAAsE;IACtE,gCAAgC;IAChC,MAAMC,gBAAgBpB,UAAUc,aAAaO,EAAE;IAC/C,MAAMC,mBAAmBR,aAAaI,IAAI,IAAI;IAE9C,MAAMd,6BAA6BK,MAAME,eAAe,OAAO;QAC7DY,YAAYH;QACZI,MAAM,AAACV,aAAaU,IAAI,IAA2B;QACnDC,qBAAqBb,cAAcM,IAAI;QACvCQ,uBAAuB,GAAGJ,iBAAiB,IAAI,CAAC;IAClD;IAEA,6DAA6D;IAC7DrB,8BACEQ,MACAE,cAAcO,IAAI,EAClBZ,iDACAM,cAAce,IAAI,EAClBP;IAGF,MAAMrB,gCAAgCU,MAAM;QAC1CH;KACD;IAED,MAAMT,qBAAqBY;IAE3B,OAAO,IACLX,oBAAoBW,MAAMC,QAAQkB,yBAAyB,EAAE;YAC3DC,WAAW;gBAAC;aAAa;QAC3B;AACJ,EAAE;AAEF,eAAerB,uCAAuC"}

package/src/infra/app/__snapshots__/generator.spec.ts.snap

@@ -109,6 +109,7 @@ exports[`infra generator > should configure project.json with correct targets >
   "$schema": "../../node_modules/nx/schemas/project-schema.json",
   "metadata": {
     "generator": "ts#infra",
+    "iac": "cdk",
   },
   "name": "@proj/test",
   "projectType": "application",
@@ -686,6 +687,7 @@ exports[`infra generator > should handle custom project names correctly > custom
   "$schema": "../../node_modules/nx/schemas/project-schema.json",
   "metadata": {
     "generator": "ts#infra",
+    "iac": "cdk",
   },
   "name": "@proj/custom-infra",
   "projectType": "application",

package/src/infra/app/generator.d.ts

@@ -5,6 +5,49 @@
 import { type GeneratorCallback, type Tree } from '@nx/devkit';
 import { type NxGeneratorInfo } from '../../utils/nx';
 import type { TsInfraGeneratorSchema } from './schema';
+export declare const DEPENDENCIES: import("../../utils/declared-dependencies").DependencyDeclaration<readonly [{
+    readonly name: "aws-cdk-lib";
+}, {
+    readonly name: "constructs";
+}, {
+    readonly name: "source-map-support";
+}, {
+    readonly name: "aws-cdk";
+    readonly dev: true;
+    readonly root: true;
+}, {
+    readonly name: "esbuild";
+    readonly dev: true;
+    readonly root: true;
+}, {
+    readonly name: "tsx";
+    readonly dev: true;
+    readonly root: true;
+}, {
+    readonly name: "constructs";
+    readonly when: (m: import("../../utils/shared-constructs-constants").IacMetadata) => boolean;
+} & {
+    versionOnly: true;
+}, {
+    readonly name: "aws-cdk-lib";
+    readonly when: (m: import("../../utils/shared-constructs-constants").IacMetadata) => boolean;
+} & {
+    versionOnly: true;
+}, {
+    readonly name: "@types/node";
+} & {
+    versionOnly: true;
+}, {
+    readonly name: "@aws-sdk/client-sts";
+    readonly when: (m: import("../../utils/shared-constructs-constants").IacMetadata) => boolean;
+} & {
+    versionOnly: true;
+}, {
+    readonly name: "@aws-sdk/credential-providers";
+    readonly when: (m: import("../../utils/shared-constructs-constants").IacMetadata) => boolean;
+} & {
+    versionOnly: true;
+}], readonly import("../../utils/declared-dependencies").DeclaredPyDependency<"a2a-sdk" | "ag-ui-langgraph" | "ag-ui-protocol" | "ag-ui-strands" | "aws-lambda-powertools" | "aws-lambda-powertools[tracer]" | "aws-lambda-powertools[parser]" | "aws-opentelemetry-distro" | "bedrock-agentcore" | "boto3" | "checkov" | "fastapi" | "fastapi[standard]" | "httpx" | "langchain" | "langchain-aws" | "langchain-mcp-adapters" | "langgraph" | "mcp" | "pip-check-updates" | "pip-licenses" | "ruff" | "strands-agents" | "strands-agents[a2a]" | "strands-agents-tools" | "ty" | "pynamodb" | "uvicorn" | "sqlmodel" | "alembic" | "aiomysql" | "asyncpg" | "greenlet", Record<string, never>>[]>;
 export declare const INFRA_APP_GENERATOR_INFO: NxGeneratorInfo;
 export declare function tsInfraGenerator(tree: Tree, schema: TsInfraGeneratorSchema): Promise<GeneratorCallback>;
 export default tsInfraGenerator;

package/src/infra/app/generator.js

@@ -5,8 +5,9 @@
 import path from "path";
 import tsProjectGenerator, { getTsLibDetails } from "../../ts/lib/generator.js";
 import { mergeTsReferences } from "../../ts/lib/ts-project-utils.js";
+import { addTsDependencies } from "../../utils/add-dependencies.js";
 import { resolveContainers } from "../../utils/containers.js";
-import { addDependenciesToPackageJson } from "../../utils/dependencies.js";
+import { declareDependencies, ownedElsewhere } from "../../utils/declared-dependencies.js";
 import { formatFilesInSubtree } from "../../utils/format.js";
 import { installDependencies } from "../../utils/install.js";
 import { addGeneratorMetricsIfApplicable } from "../../utils/metrics.js";
@@ -17,11 +18,44 @@ import { addDependencyToTargetIfNotPresent, addGeneratorMetadata, getGeneratorIn
 import { sortObjectKeys } from "../../utils/object.js";
 import { getPackageManagerDisplayCommands } from "../../utils/pkg-manager.js";
 import { uvxCommand } from "../../utils/py.js";
-import { sharedConstructsGenerator } from "../../utils/shared-constructs.js";
+import { SHARED_CONSTRUCTS_DEPENDENCIES, sharedConstructsGenerator } from "../../utils/shared-constructs.js";
 import { PACKAGES_DIR, SHARED_CONSTRUCTS_DIR, SHARED_INFRA_CONFIG_DIR } from "../../utils/shared-constructs-constants.js";
 import { sharedInfraConfigGenerator } from "../../utils/shared-infra-config.js";
-import { sharedInfraScriptsGenerator } from "../../utils/shared-infra-scripts.js";
-import { withVersions } from "../../utils/versions.js";
+import { SHARED_INFRA_SCRIPTS_DEPENDENCIES, sharedInfraScriptsGenerator } from "../../utils/shared-infra-scripts.js";
+// This generator records no metadata, so nothing a predicate could read: the
+// CDK app always needs the app libraries, and the CLI, bundler and tsx are
+// shared tooling.
+export const DEPENDENCIES = declareDependencies()({
+    ts: [
+        {
+            name: 'aws-cdk-lib'
+        },
+        {
+            name: 'constructs'
+        },
+        {
+            name: 'source-map-support'
+        },
+        // The `aws-cdk` CLI, esbuild (CDK bundling) and tsx are shared tooling.
+        {
+            name: 'aws-cdk',
+            dev: true,
+            root: true
+        },
+        {
+            name: 'esbuild',
+            dev: true,
+            root: true
+        },
+        {
+            name: 'tsx',
+            dev: true,
+            root: true
+        },
+        ...ownedElsewhere(SHARED_CONSTRUCTS_DEPENDENCIES),
+        ...ownedElsewhere(SHARED_INFRA_SCRIPTS_DEPENDENCIES)
+    ]
+});
 export const INFRA_APP_GENERATOR_INFO = getGeneratorInfo(import.meta.filename);
 export async function tsInfraGenerator(tree, schema) {
     const lib = getTsLibDetails(tree, schema);
@@ -49,16 +83,19 @@ export async function tsInfraGenerator(tree, schema) {
             }
         };
     };
-    addGeneratorMetadata(tree, lib.fullyQualifiedName, INFRA_APP_GENERATOR_INFO);
+    // This generator IS the CDK infrastructure project, so the provider is fixed.
+    addGeneratorMetadata(tree, lib.fullyQualifiedName, INFRA_APP_GENERATOR_INFO, {
+        iac: 'cdk'
+    });
     // Shared constructs always in CDK for typescript infra generator
     await sharedConstructsGenerator(tree, {
         iac: 'cdk'
-    });
+    }, DEPENDENCIES);
     // Shared infra-config and infra-scripts packages (lazy creation, only when enabled)
     const stageConfig = schema.stageConfig ?? false;
     if (stageConfig) {
         await sharedInfraConfigGenerator(tree);
-        await sharedInfraScriptsGenerator(tree);
+        await sharedInfraScriptsGenerator(tree, DEPENDENCIES);
     }
     const synthDirFromRoot = `/dist/${lib.dir}/cdk.out`;
     const synthDirFromProject = lib.dir.split('/').map(()=>'..').join('/') + `/dist/${lib.dir}/cdk.out`;
@@ -180,17 +217,9 @@ export async function tsInfraGenerator(tree, schema) {
         config.targets = sortObjectKeys(config.targets);
         return config;
     });
-    addDependenciesToPackageJson(tree, withVersions([
-        'aws-cdk-lib',
-        'constructs',
-        'source-map-support'
-    ]), {}, joinPathFragments(libraryRoot, 'package.json'));
-    // The `aws-cdk` CLI, esbuild (CDK bundling) and tsx are shared tooling.
-    addDependenciesToPackageJson(tree, {}, withVersions([
-        'aws-cdk',
-        'esbuild',
-        'tsx'
-    ]));
+    addTsDependencies(tree, DEPENDENCIES, {
+        projectRoot: libraryRoot
+    });
     updateJson(tree, `${libraryRoot}/tsconfig.lib.json`, (tsConfig)=>({
             ...tsConfig,
             references: mergeTsReferences(tsConfig.references, [