@aws/nx-plugin 1.0.0-rc.57 → 1.0.0-rc.59

package/generators.json

@@ -30,6 +30,20 @@
       "metric": "g65",
       "hidden": true
     },
+    "agentcore-gateway#agent-connection": {
+      "factory": "./src/agentcore-gateway/agent-connection/generator",
+      "schema": "./src/agentcore-gateway/agent-connection/schema.json",
+      "description": "Connect an AgentCore Gateway to an agent, adding the agent as a gateway target",
+      "metric": "g69",
+      "hidden": true
+    },
+    "agentcore-gateway#react-connection": {
+      "factory": "./src/agentcore-gateway/react-connection/generator",
+      "schema": "./src/agentcore-gateway/react-connection/schema.json",
+      "description": "Connect a React website to an AgentCore Gateway fronting agents",
+      "metric": "g70",
+      "hidden": true
+    },
     "connection": {
       "factory": "./src/connection/generator",
       "schema": "./src/connection/schema.json",
@@ -54,7 +68,9 @@
         "connection/ts-agent-gateway",
         "connection/py-agent-gateway",
         "connection/agentcore-gateway-mcp",
-        "connection/agentcore-gateway-gateway"
+        "connection/agentcore-gateway-gateway",
+        "connection/agentcore-gateway-agent",
+        "connection/react-agentcore-gateway"
       ]
     },
     "license": {

package/migrations.json

@@ -2,82 +2,92 @@
   "$schema": "http://json-schema.org/schema",
   "name": "@aws/nx-plugin",
   "generators": {
-    "latest-modernize-function-props-cast": {
+    "latest-gateway-agent-targets": {
+      "version": "1.0.0-rc.59",
+      "description": "Add agent runtime target support to the vended AgentCoreGateway construct and an agentName member to vended agent constructs",
+      "implementation": "./src/migrations/latest/gateway-agent-targets/migration"
+    },
+    "latest-smithy-ssdk-bundle-pins": {
+      "version": "1.0.0-rc.58",
+      "description": "Bump the rolldown and dts plugin pins in the Smithy build.Dockerfile so the bundled SSDK type declaration resolves",
+      "implementation": "./src/migrations/latest/smithy-ssdk-bundle-pins/migration"
+    },
+    "v1.0.0-rc.50-modernize-function-props-cast": {
       "version": "1.0.0-rc.50",
       "description": "Replace the legacy angle-bracket FunctionProps type assertion with the modern as syntax in generated API constructs",
-      "implementation": "./src/migrations/latest/modernize-function-props-cast/migration"
+      "implementation": "./src/migrations/v1.0.0-rc.50/modernize-function-props-cast/migration"
     },
-    "latest-restrict-cors-to-custom-domains": {
+    "v1.0.0-rc.50-restrict-cors-to-custom-domains": {
       "version": "1.0.0-rc.50",
       "description": "Include CloudFront custom domain aliases in restrictCorsTo and UserIdentity callback URLs",
-      "implementation": "./src/migrations/latest/restrict-cors-to-custom-domains/migration"
+      "implementation": "./src/migrations/v1.0.0-rc.50/restrict-cors-to-custom-domains/migration"
     },
-    "latest-terraform-bootstrap-adopt-existing-bucket": {
+    "v1.0.0-rc.50-terraform-bootstrap-adopt-existing-bucket": {
       "version": "1.0.0-rc.50",
       "description": "Adopt an existing Terraform state bucket in the vended bootstrap script when its state object is missing",
-      "implementation": "./src/migrations/latest/terraform-bootstrap-adopt-existing-bucket/migration"
+      "implementation": "./src/migrations/v1.0.0-rc.50/terraform-bootstrap-adopt-existing-bucket/migration"
     },
-    "latest-user-identity-waf-allow-localhost-callback": {
+    "v1.0.0-rc.52-user-identity-waf-allow-localhost-callback": {
       "version": "1.0.0-rc.52",
       "description": "Count the EC2MetaDataSSRF_QUERYARGUMENTS WAF rule on the UserIdentity Web ACL so sign-in from a local dev server is not blocked",
-      "implementation": "./src/migrations/latest/user-identity-waf-allow-localhost-callback/migration"
+      "implementation": "./src/migrations/v1.0.0-rc.52/user-identity-waf-allow-localhost-callback/migration"
     },
-    "latest-order-access-log-delivery-after-bucket-policy": {
+    "v1.0.0-rc.54-order-access-log-delivery-after-bucket-policy": {
       "version": "1.0.0-rc.54",
       "description": "Order the S3 server access log delivery source after the bucket policy to avoid a 409 from concurrent bucket configuration writes",
-      "implementation": "./src/migrations/latest/order-access-log-delivery-after-bucket-policy/migration"
+      "implementation": "./src/migrations/v1.0.0-rc.54/order-access-log-delivery-after-bucket-policy/migration"
     },
-    "latest-backfill-generator-metadata": {
+    "v1.0.0-rc.55-backfill-generator-metadata": {
       "version": "1.0.0-rc.55",
       "description": "Backfill the project metadata the version sync reads, recovered from the files the generators left behind",
-      "implementation": "./src/migrations/latest/backfill-generator-metadata/migration"
+      "implementation": "./src/migrations/v1.0.0-rc.55/backfill-generator-metadata/migration"
     },
-    "latest-dynamodb-local-remove-optimize-flag": {
+    "v1.0.0-rc.56-dynamodb-local-remove-optimize-flag": {
       "version": "1.0.0-rc.56",
       "description": "Drop -optimizeDbBeforeStartup from the vended DynamoDB Local container script, which can corrupt shared-local-instance.db",
-      "implementation": "./src/migrations/latest/dynamodb-local-remove-optimize-flag/migration"
+      "implementation": "./src/migrations/v1.0.0-rc.56/dynamodb-local-remove-optimize-flag/migration"
     },
-    "latest-ts-agent-session-management-support": {
+    "v1.0.0-rc.57-ts-agent-session-management-support": {
       "version": "1.0.0-rc.57",
       "description": "Add session management support to ts#agent",
-      "implementation": "./src/migrations/latest/ts-agent-session-management-support/migration"
+      "implementation": "./src/migrations/v1.0.0-rc.57/ts-agent-session-management-support/migration"
     },
     "sync-vended-versions": {
-      "version": "1.0.0-rc.57",
+      "version": "1.0.0-rc.59",
       "description": "Sync vended dependency versions and the tracked plugin version to those vended by this release",
       "implementation": "./src/utils/version-upgrade-migration/migration"
     }
   },
   "packageJsonUpdates": {
-    "nx-23.1.0-nx-packages": {
-      "version": "1.0.0-rc.57",
+    "nx-23.1.1-nx-packages": {
+      "version": "1.0.0-rc.59",
       "packages": {
         "nx": {
-          "version": "23.1.0",
+          "version": "23.1.1",
           "alwaysAddToPackageJson": false
         },
         "@nx/devkit": {
-          "version": "23.1.0",
+          "version": "23.1.1",
           "alwaysAddToPackageJson": false
         },
         "@nx/js": {
-          "version": "23.1.0",
+          "version": "23.1.1",
           "alwaysAddToPackageJson": false
         },
         "@nx/react": {
-          "version": "23.1.0",
+          "version": "23.1.1",
           "alwaysAddToPackageJson": false
         },
         "@nx/vite": {
-          "version": "23.1.0",
+          "version": "23.1.1",
           "alwaysAddToPackageJson": false
         },
         "@nx/vitest": {
-          "version": "23.1.0",
+          "version": "23.1.1",
           "alwaysAddToPackageJson": false
         },
         "@nx/workspace": {
-          "version": "23.1.0",
+          "version": "23.1.1",
           "alwaysAddToPackageJson": false
         }
       }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@aws/nx-plugin",
-  "version": "1.0.0-rc.57",
+  "version": "1.0.0-rc.59",
   "repository": {
     "type": "git",
     "url": "https://github.com/awslabs/nx-plugin-for-aws.git",
@@ -36,20 +36,20 @@
     "node": ">=20.19.0"
   },
   "peerDependencies": {
-    "nx": "23.1.0"
+    "nx": "23.1.1"
   },
   "dependencies": {
     "@apidevtools/swagger-parser": "12.1.0",
-    "@astral-sh/ruff-wasm-nodejs": "0.15.22",
+    "@astral-sh/ruff-wasm-nodejs": "0.16.1",
     "@biomejs/js-api": "6.0.0",
-    "@biomejs/wasm-nodejs": "2.5.4",
+    "@biomejs/wasm-nodejs": "2.5.6",
     "@getgrit/gritql": "0.0.3",
     "@iarna/toml": "2.2.5",
-    "@modelcontextprotocol/sdk": "1.29.0",
-    "@nx/devkit": "23.1.0",
-    "@nx/js": "23.1.0",
-    "@nx/react": "23.1.0",
-    "@nx/vite": "23.1.0",
+    "@modelcontextprotocol/sdk": "1.30.0",
+    "@nx/devkit": "23.1.1",
+    "@nx/js": "23.1.1",
+    "@nx/react": "23.1.1",
+    "@nx/vite": "23.1.1",
     "@nxlv/python": "22.2.2",
     "@phenomnomnominal/tsquery": "6.2.0",
     "@types/estree": "1.0.9",
@@ -58,7 +58,7 @@
     "enquirer": "2.4.1",
     "fast-glob": "3.3.3",
     "jiti": "2.7.0",
-    "js-yaml": "4.3.0",
+    "js-yaml": "4.3.1",
     "license-checker-rseidelsohn": "4.4.2",
     "lodash.camelcase": "4.3.0",
     "lodash.clonedeepwith": "4.5.0",
@@ -67,7 +67,7 @@
     "lodash.trim": "4.18.0",
     "lodash.uniqby": "4.7.0",
     "mdast-util-mdx-jsx": "3.2.0",
-    "minimatch": "10.2.5",
+    "minimatch": "10.2.6",
     "openapi-types": "12.1.3",
     "pip-requirements-js": "1.0.3",
     "remark-frontmatter": "5.0.0",
@@ -79,11 +79,11 @@
     "typescript": "6.0.3",
     "unified": "11.0.5",
     "unist-util-visit": "5.1.0",
-    "vite": "8.1.5",
+    "vite": "8.2.0",
     "vitest": "4.1.10",
     "zod": "4.4.3"
   },
   "devDependencies": {
-    "@types/semver": "7.7.1"
+    "@types/semver": "7.8.0"
   }
 }

package/src/agentcore-gateway/__snapshots__/generator.spec.ts.snap

@@ -0,0 +1,273 @@
+// Vitest Snapshot v1, https://vitest.dev/guide/snapshot.html
+
+exports[`agentcore-gateway generator > protocol: http > omits protocol_type from the Terraform gateway > my-gateway.tf 1`] = `
+"terraform {
+  required_version = ">= 1.0"
+
+  required_providers {
+    aws = {
+      source  = "hashicorp/aws"
+      version = "6.57.1"
+    }
+    random = {
+      source  = "hashicorp/random"
+      version = "3.9.0"
+    }
+  }
+}
+
+variable "additional_iam_policy_statements" {
+  description = "Additional IAM policy statements to attach to the gateway service role. Connection generators (e.g. agentcore-gateway#mcp-connection) append \`InvokeAgentRuntime*\` entries here."
+  type = list(object({
+    Effect   = string
+    Action   = list(string)
+    Resource = list(string)
+  }))
+  default = []
+}
+
+
+variable "enable_waf" {
+  description = "Associate a regional WAFv2 web ACL (default AWS managed rule groups) with the gateway to inspect inbound requests."
+  type        = bool
+  default     = true
+}
+
+data "aws_caller_identity" "current" {}
+data "aws_region" "current" {}
+
+locals {
+  aws_account_id = data.aws_caller_identity.current.account_id
+  aws_region     = data.aws_region.current.id
+}
+
+resource "random_id" "unique_suffix" {
+  byte_length = 4
+}
+
+# IAM role for the gateway service
+resource "aws_iam_role" "gateway_role" {
+  name = "MyGateway-GatewayRole-\${random_id.unique_suffix.hex}"
+
+  assume_role_policy = jsonencode({
+    Version = "2012-10-17"
+    Statement = [
+      {
+        Sid    = "AgentCoreGatewayAssumeRolePolicy"
+        Effect = "Allow"
+        Principal = {
+          Service = "bedrock-agentcore.amazonaws.com"
+        }
+        Action = "sts:AssumeRole"
+        Condition = {
+          StringEquals = {
+            "aws:SourceAccount" = local.aws_account_id
+          }
+          ArnLike = {
+            "aws:SourceArn" = "arn:aws:bedrock-agentcore:\${local.aws_region}:\${local.aws_account_id}:*"
+          }
+        }
+      }
+    ]
+  })
+}
+
+# Inline policy for statements appended by connection generators
+# (e.g. InvokeAgentRuntime*)
+resource "aws_iam_role_policy" "gateway_role_policy" {
+  count = length(var.additional_iam_policy_statements) > 0 ? 1 : 0
+  name  = "MyGateway-GatewayPolicy"
+  role  = aws_iam_role.gateway_role.id
+
+  policy = jsonencode({
+    Version   = "2012-10-17"
+    Statement = var.additional_iam_policy_statements
+  })
+}
+
+resource "aws_bedrockagentcore_gateway" "this" {
+  # Cap the name so the 11-char service suffix keeps the gateway id within its
+  # 50-char limit (30 prefix + "-<8 hex>" + 11 = 50).
+  name        = "\${substr("MyGateway", 0, 30)}-\${random_id.unique_suffix.hex}"
+  description = "AgentCore Gateway for MyGateway"
+  role_arn    = aws_iam_role.gateway_role.arn
+
+  # No protocol type: AgentCore Runtime targets require a gateway without one.
+  # The gateway proxies requests to its runtime targets via path-based routing
+  # (\`/<targetName>/invocations\`).
+
+  authorizer_type = "AWS_IAM"
+}
+
+# WAFv2 protection for the gateway. AgentCore Gateway requires a REGIONAL web
+# ACL; CloudFront (global) is not supported.
+resource "aws_wafv2_web_acl" "gateway_waf" {
+  #checkov:skip=CKV2_AWS_31:Logging configuration is defined below in aws_wafv2_web_acl_logging_configuration.gateway_waf_logging; Checkov does not resolve the separate resource
+  count = var.enable_waf ? 1 : 0
+
+  name  = "MyGateway-waf-\${random_id.unique_suffix.hex}"
+  scope = "REGIONAL"
+
+  default_action {
+    allow {}
+  }
+
+  rule {
+    name     = "CRSRule"
+    priority = 0
+
+    override_action {
+      none {}
+    }
+
+    statement {
+      managed_rule_group_statement {
+        name        = "AWSManagedRulesCommonRuleSet"
+        vendor_name = "AWS"
+
+        # Count instead of Block: the CRS 8 KB body limit is too restrictive
+        # for typical MCP tool payloads.
+        rule_action_override {
+          name = "SizeRestrictions_BODY"
+          action_to_use {
+            count {}
+          }
+        }
+      }
+    }
+
+    visibility_config {
+      cloudwatch_metrics_enabled = true
+      metric_name                = "MyGatewayWebAcl-CRS"
+      sampled_requests_enabled   = true
+    }
+  }
+
+  rule {
+    name     = "KnownBadInputsRule"
+    priority = 1
+
+    override_action {
+      none {}
+    }
+
+    statement {
+      managed_rule_group_statement {
+        name        = "AWSManagedRulesKnownBadInputsRuleSet"
+        vendor_name = "AWS"
+      }
+    }
+
+    visibility_config {
+      cloudwatch_metrics_enabled = true
+      metric_name                = "MyGatewayWebAcl-KnownBadInputs"
+      sampled_requests_enabled   = true
+    }
+  }
+
+  visibility_config {
+    cloudwatch_metrics_enabled = true
+    metric_name                = "MyGatewayWebAcl"
+    sampled_requests_enabled   = true
+  }
+
+  lifecycle {
+    create_before_destroy = true
+  }
+}
+
+resource "aws_wafv2_web_acl_association" "gateway_waf" {
+  count = var.enable_waf ? 1 : 0
+
+  resource_arn = aws_bedrockagentcore_gateway.this.gateway_arn
+  web_acl_arn  = aws_wafv2_web_acl.gateway_waf[0].arn
+}
+
+# WAF request logs. WAFv2 requires the \`aws-waf-logs-\` name prefix.
+resource "aws_cloudwatch_log_group" "gateway_waf_logs" {
+  #checkov:skip=CKV_AWS_158:Using default CloudWatch log encryption
+  #checkov:skip=CKV_AWS_338:Log retention set to one year which is sufficient for WAF logs
+  count = var.enable_waf ? 1 : 0
+
+  name              = "aws-waf-logs-my-gateway-\${random_id.unique_suffix.hex}"
+  retention_in_days = 365
+}
+
+resource "aws_wafv2_web_acl_logging_configuration" "gateway_waf_logging" {
+  count = var.enable_waf ? 1 : 0
+
+  log_destination_configs = [aws_cloudwatch_log_group.gateway_waf_logs[0].arn]
+  resource_arn            = aws_wafv2_web_acl.gateway_waf[0].arn
+}
+
+
+# Add gateway URL to runtime config
+module "add_gateway_url_to_runtime_config" {
+  source = "../../../core/runtime-config/entry"
+
+  namespace = "agentcore"
+  key       = "gateways"
+  value     = { "MyGateway" = aws_bedrockagentcore_gateway.this.gateway_url }
+
+  depends_on = [aws_bedrockagentcore_gateway.this]
+}
+
+output "gateway_id" {
+  description = "ID of the Bedrock AgentCore Gateway"
+  value       = aws_bedrockagentcore_gateway.this.gateway_id
+}
+
+output "gateway_arn" {
+  description = "ARN of the Bedrock AgentCore Gateway"
+  value       = aws_bedrockagentcore_gateway.this.gateway_arn
+}
+
+output "gateway_url" {
+  description = "Endpoint URL of the Bedrock AgentCore Gateway. Runtime targets are served under \`<gateway_url minus /mcp>/<targetName>/invocations\`."
+  value       = aws_bedrockagentcore_gateway.this.gateway_url
+}
+
+output "gateway_role_arn" {
+  description = "ARN of the IAM role assumed by the gateway service"
+  value       = aws_iam_role.gateway_role.arn
+}
+
+output "waf_web_acl_arn" {
+  description = "ARN of the WAFv2 web ACL associated with the gateway, or null if WAF is disabled"
+  value       = var.enable_waf ? aws_wafv2_web_acl.gateway_waf[0].arn : null
+}
+"
+`;
+
+exports[`agentcore-gateway generator > protocol: http > wires the CDK construct with the http protocol > my-gateway.ts 1`] = `
+"import { Construct } from 'constructs';
+import {
+  AgentCoreGateway,
+  AgentCoreGatewayProps,
+} from '../../../core/agentcore-gateway/agentcore-gateway.js';
+import { RuntimeConfig } from '../../../core/runtime-config.js';
+
+export type MyGatewayProps = Omit<AgentCoreGatewayProps, 'protocol'>;
+
+/**
+ * AgentCore Gateway wired for HTTP proxying of agent runtime targets with IAM inbound auth.
+ */
+export class MyGateway extends AgentCoreGateway {
+  /** Default Gateway target name when added to another Gateway. */
+  public readonly gatewayName = 'my-gateway';
+
+  constructor(scope: Construct, id: string, props?: MyGatewayProps) {
+    super(scope, id, {
+      protocol: 'http',
+      ...props,
+    });
+
+    const rc = RuntimeConfig.ensure(this);
+    rc.set('agentcore', 'gateways', {
+      ...rc.get('agentcore').gateways,
+      MyGateway: this.gateway.gatewayUrl,
+    });
+  }
+}
+"
+`;

package/src/agentcore-gateway/agent-connection/generator.d.ts

@@ -0,0 +1,19 @@
+/**
+ * Copyright Amazon.com, Inc. or its affiliates. All Rights Reserved.
+ * SPDX-License-Identifier: Apache-2.0
+ */
+import type { GeneratorCallback, Tree } from '@nx/devkit';
+import { type NxGeneratorInfo } from '../../utils/nx';
+import type { AgentcoreGatewayAgentConnectionGeneratorSchema } from './schema';
+export declare const AGENTCORE_GATEWAY_AGENT_CONNECTION_GENERATOR_INFO: NxGeneratorInfo;
+/**
+ * Connect an AgentCore Gateway to an agent, so the agent is added as a
+ * gateway target and served under `<gatewayUrl>/<targetName>/invocations`.
+ *
+ * Chains the gateway's dev target to the agent's dev target, and registers
+ * the agent in the gateway's local-dev.ts so the local gateway proxies to it.
+ * Users must still call `gateway.addAgent(...)` in their application stack to
+ * create the actual CDK/Terraform resource.
+ */
+export declare const agentcoreGatewayAgentConnectionGenerator: (tree: Tree, options: AgentcoreGatewayAgentConnectionGeneratorSchema) => Promise<GeneratorCallback>;
+export default agentcoreGatewayAgentConnectionGenerator;

package/src/agentcore-gateway/agent-connection/generator.js

@@ -0,0 +1,90 @@
+/**
+ * Copyright Amazon.com, Inc. or its affiliates. All Rights Reserved.
+ * SPDX-License-Identifier: Apache-2.0
+ */ import { formatFilesInSubtree } from "../../utils/format.js";
+import { installDependencies } from "../../utils/install.js";
+import { addGeneratorMetricsIfApplicable } from "../../utils/metrics.js";
+import { kebabCase, toClassName } from "../../utils/names.js";
+import { addComponentGeneratorMetadata, getGeneratorInfo, readProjectConfigurationUnqualified } from "../../utils/nx.js";
+import { attachAgentToLocalGateway } from "../attach-upstream.js";
+import { readAgentCoreGatewayMetadata } from "../generator.js";
+export const AGENTCORE_GATEWAY_AGENT_CONNECTION_GENERATOR_INFO = getGeneratorInfo(import.meta.filename);
+/**
+ * The agent protocols an http gateway can front, by agent language. The
+ * gateway proxies plain HTTP request/response and SSE streams:
+ *
+ * - `ag-ui` (ts + py) and `http` (py) serve POST /invocations with streamed
+ *   responses, which proxy cleanly.
+ * - `a2a` (ts + py) is JSON-RPC over POST, which AgentCore applies a default
+ *   schema for.
+ * - `http` (ts) is tRPC over WebSocket, and the gateway does not support
+ *   WebSocket / bidirectional streaming, so it cannot sit behind one.
+ */ const SUPPORTED_AGENT_PROTOCOLS = {
+    'ts#agent': [
+        'ag-ui',
+        'a2a'
+    ],
+    'py#agent': [
+        'ag-ui',
+        'http',
+        'a2a'
+    ]
+};
+/**
+ * Connect an AgentCore Gateway to an agent, so the agent is added as a
+ * gateway target and served under `<gatewayUrl>/<targetName>/invocations`.
+ *
+ * Chains the gateway's dev target to the agent's dev target, and registers
+ * the agent in the gateway's local-dev.ts so the local gateway proxies to it.
+ * Users must still call `gateway.addAgent(...)` in their application stack to
+ * create the actual CDK/Terraform resource.
+ */ export const agentcoreGatewayAgentConnectionGenerator = async (tree, options)=>{
+    const sourceProject = readProjectConfigurationUnqualified(tree, options.sourceProject);
+    const targetProject = readProjectConfigurationUnqualified(tree, options.targetProject);
+    const gateway = readAgentCoreGatewayMetadata(sourceProject);
+    const agentComponent = options.targetComponent;
+    if (!agentComponent) {
+        throw new Error(`Target project '${options.targetProject}' has no agent component metadata. Did you run the 'ts#agent' or 'py#agent' generator?`);
+    }
+    if (gateway.protocol !== 'http') {
+        throw new Error(`Gateway '${gateway.name}' has protocol='${gateway.protocol}'. Agent targets can only be attached to http-protocol gateways — generate one with the 'agentcore-gateway' generator and --protocol=http.`);
+    }
+    const agentGenerator = agentComponent.generator ?? 'ts#agent';
+    const agentProtocol = (agentComponent.protocol ?? 'http').toLowerCase();
+    const supportedProtocols = SUPPORTED_AGENT_PROTOCOLS[agentGenerator] ?? [];
+    if (!supportedProtocols.includes(agentProtocol)) {
+        throw new Error(`Agent '${agentComponent.name}' uses protocol='${agentProtocol}', which cannot be fronted by a gateway` + (agentGenerator === 'ts#agent' && agentProtocol === 'http' ? ` — a TypeScript HTTP agent serves tRPC over WebSocket, and AgentCore Gateway does not support WebSocket streaming. Consider the ag-ui protocol instead.` : `. Supported protocols: ${supportedProtocols.join(', ')}.`));
+    }
+    if (agentComponent.auth && agentComponent.auth !== 'iam') {
+        throw new Error(`Agent '${agentComponent.name}' uses auth='${agentComponent.auth}'. Gateway->agent connections currently require the agent to use IAM authentication.`);
+    }
+    // The target name must match what the deployed Gateway uses (`agentName` on
+    // the agent construct, derived from the project's class name) so the
+    // `/<target>/invocations` path resolves identically locally and deployed.
+    const agentComponentName = agentComponent.name ?? 'agent';
+    const agentTargetName = kebabCase(agentComponent.rc ?? toClassName(agentComponentName));
+    await attachAgentToLocalGateway(tree, sourceProject, 'dev', {
+        targetName: agentTargetName,
+        port: agentComponent.port ?? 8081,
+        upstreamProjectName: targetProject.name,
+        upstreamDevTargetName: `${agentComponentName}-dev`,
+        // The deployed gateway maps an A2A target's `/invocations/...` paths onto
+        // the agent container's root; HTTP and AG-UI agents serve /invocations
+        // themselves.
+        stripInvocations: agentProtocol === 'a2a'
+    });
+    // Recorded so the version sync can identify this connection.
+    addComponentGeneratorMetadata(tree, sourceProject.name, AGENTCORE_GATEWAY_AGENT_CONNECTION_GENERATOR_INFO, targetProject.root, agentTargetName);
+    await addGeneratorMetricsIfApplicable(tree, [
+        AGENTCORE_GATEWAY_AGENT_CONNECTION_GENERATOR_INFO
+    ]);
+    await formatFilesInSubtree(tree);
+    return ()=>installDependencies(tree, options.preferInstallDependencies, {
+            languages: [
+                'typescript'
+            ]
+        });
+};
+export default agentcoreGatewayAgentConnectionGenerator;
+
+//# sourceMappingURL=generator.js.map

package/src/agentcore-gateway/agent-connection/generator.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../../../../../../packages/nx-plugin/src/agentcore-gateway/agent-connection/generator.ts"],"sourcesContent":["/**\n * Copyright Amazon.com, Inc. or its affiliates. All Rights Reserved.\n * SPDX-License-Identifier: Apache-2.0\n */\nimport type { GeneratorCallback, Tree } from '@nx/devkit';\nimport { formatFilesInSubtree } from '../../utils/format';\nimport { installDependencies } from '../../utils/install';\nimport { addGeneratorMetricsIfApplicable } from '../../utils/metrics';\nimport { kebabCase, toClassName } from '../../utils/names';\nimport {\n  addComponentGeneratorMetadata,\n  getGeneratorInfo,\n  type NxGeneratorInfo,\n  readProjectConfigurationUnqualified,\n} from '../../utils/nx';\nimport { attachAgentToLocalGateway } from '../attach-upstream';\nimport { readAgentCoreGatewayMetadata } from '../generator';\nimport type { AgentcoreGatewayAgentConnectionGeneratorSchema } from './schema';\n\nexport const AGENTCORE_GATEWAY_AGENT_CONNECTION_GENERATOR_INFO: NxGeneratorInfo =\n  getGeneratorInfo(import.meta.filename);\n\n/**\n * The agent protocols an http gateway can front, by agent language. The\n * gateway proxies plain HTTP request/response and SSE streams:\n *\n * - `ag-ui` (ts + py) and `http` (py) serve POST /invocations with streamed\n *   responses, which proxy cleanly.\n * - `a2a` (ts + py) is JSON-RPC over POST, which AgentCore applies a default\n *   schema for.\n * - `http` (ts) is tRPC over WebSocket, and the gateway does not support\n *   WebSocket / bidirectional streaming, so it cannot sit behind one.\n */\nconst SUPPORTED_AGENT_PROTOCOLS: Record<string, string[]> = {\n  'ts#agent': ['ag-ui', 'a2a'],\n  'py#agent': ['ag-ui', 'http', 'a2a'],\n};\n\n/**\n * Connect an AgentCore Gateway to an agent, so the agent is added as a\n * gateway target and served under `<gatewayUrl>/<targetName>/invocations`.\n *\n * Chains the gateway's dev target to the agent's dev target, and registers\n * the agent in the gateway's local-dev.ts so the local gateway proxies to it.\n * Users must still call `gateway.addAgent(...)` in their application stack to\n * create the actual CDK/Terraform resource.\n */\nexport const agentcoreGatewayAgentConnectionGenerator = async (\n  tree: Tree,\n  options: AgentcoreGatewayAgentConnectionGeneratorSchema,\n): Promise<GeneratorCallback> => {\n  const sourceProject = readProjectConfigurationUnqualified(\n    tree,\n    options.sourceProject,\n  );\n  const targetProject = readProjectConfigurationUnqualified(\n    tree,\n    options.targetProject,\n  );\n\n  const gateway = readAgentCoreGatewayMetadata(sourceProject);\n  const agentComponent = options.targetComponent;\n\n  if (!agentComponent) {\n    throw new Error(\n      `Target project '${options.targetProject}' has no agent component metadata. Did you run the 'ts#agent' or 'py#agent' generator?`,\n    );\n  }\n\n  if (gateway.protocol !== 'http') {\n    throw new Error(\n      `Gateway '${gateway.name}' has protocol='${gateway.protocol}'. Agent targets can only be attached to http-protocol gateways — generate one with the 'agentcore-gateway' generator and --protocol=http.`,\n    );\n  }\n\n  const agentGenerator = agentComponent.generator ?? 'ts#agent';\n  const agentProtocol = (\n    (agentComponent.protocol as string | undefined) ?? 'http'\n  ).toLowerCase();\n  const supportedProtocols = SUPPORTED_AGENT_PROTOCOLS[agentGenerator] ?? [];\n  if (!supportedProtocols.includes(agentProtocol)) {\n    throw new Error(\n      `Agent '${agentComponent.name}' uses protocol='${agentProtocol}', which cannot be fronted by a gateway` +\n        (agentGenerator === 'ts#agent' && agentProtocol === 'http'\n          ? ` — a TypeScript HTTP agent serves tRPC over WebSocket, and AgentCore Gateway does not support WebSocket streaming. Consider the ag-ui protocol instead.`\n          : `. Supported protocols: ${supportedProtocols.join(', ')}.`),\n    );\n  }\n  if (agentComponent.auth && agentComponent.auth !== 'iam') {\n    throw new Error(\n      `Agent '${agentComponent.name}' uses auth='${agentComponent.auth}'. Gateway->agent connections currently require the agent to use IAM authentication.`,\n    );\n  }\n\n  // The target name must match what the deployed Gateway uses (`agentName` on\n  // the agent construct, derived from the project's class name) so the\n  // `/<target>/invocations` path resolves identically locally and deployed.\n  const agentComponentName = agentComponent.name ?? 'agent';\n  const agentTargetName = kebabCase(\n    (agentComponent.rc as string | undefined) ??\n      toClassName(agentComponentName),\n  );\n\n  await attachAgentToLocalGateway(tree, sourceProject, 'dev', {\n    targetName: agentTargetName,\n    port: (agentComponent.port as number | undefined) ?? 8081,\n    upstreamProjectName: targetProject.name,\n    upstreamDevTargetName: `${agentComponentName}-dev`,\n    // The deployed gateway maps an A2A target's `/invocations/...` paths onto\n    // the agent container's root; HTTP and AG-UI agents serve /invocations\n    // themselves.\n    stripInvocations: agentProtocol === 'a2a',\n  });\n\n  // Recorded so the version sync can identify this connection.\n  addComponentGeneratorMetadata(\n    tree,\n    sourceProject.name,\n    AGENTCORE_GATEWAY_AGENT_CONNECTION_GENERATOR_INFO,\n    targetProject.root,\n    agentTargetName,\n  );\n\n  await addGeneratorMetricsIfApplicable(tree, [\n    AGENTCORE_GATEWAY_AGENT_CONNECTION_GENERATOR_INFO,\n  ]);\n\n  await formatFilesInSubtree(tree);\n\n  return () =>\n    installDependencies(tree, options.preferInstallDependencies, {\n      languages: ['typescript'],\n    });\n};\n\nexport default agentcoreGatewayAgentConnectionGenerator;\n"],"names":["formatFilesInSubtree","installDependencies","addGeneratorMetricsIfApplicable","kebabCase","toClassName","addComponentGeneratorMetadata","getGeneratorInfo","readProjectConfigurationUnqualified","attachAgentToLocalGateway","readAgentCoreGatewayMetadata","AGENTCORE_GATEWAY_AGENT_CONNECTION_GENERATOR_INFO","filename","SUPPORTED_AGENT_PROTOCOLS","agentcoreGatewayAgentConnectionGenerator","tree","options","sourceProject","targetProject","gateway","agentComponent","targetComponent","Error","protocol","name","agentGenerator","generator","agentProtocol","toLowerCase","supportedProtocols","includes","join","auth","agentComponentName","agentTargetName","rc","targetName","port","upstreamProjectName","upstreamDevTargetName","stripInvocations","root","preferInstallDependencies","languages"],"mappings":"AAAA;;;CAGC,GAED,SAASA,oBAAoB,QAAQ,wBAAqB;AAC1D,SAASC,mBAAmB,QAAQ,yBAAsB;AAC1D,SAASC,+BAA+B,QAAQ,yBAAsB;AACtE,SAASC,SAAS,EAAEC,WAAW,QAAQ,uBAAoB;AAC3D,SACEC,6BAA6B,EAC7BC,gBAAgB,EAEhBC,mCAAmC,QAC9B,oBAAiB;AACxB,SAASC,yBAAyB,QAAQ,wBAAqB;AAC/D,SAASC,4BAA4B,QAAQ,kBAAe;AAG5D,OAAO,MAAMC,oDACXJ,iBAAiB,YAAYK,QAAQ,EAAE;AAEzC;;;;;;;;;;CAUC,GACD,MAAMC,4BAAsD;IAC1D,YAAY;QAAC;QAAS;KAAM;IAC5B,YAAY;QAAC;QAAS;QAAQ;KAAM;AACtC;AAEA;;;;;;;;CAQC,GACD,OAAO,MAAMC,2CAA2C,OACtDC,MACAC;IAEA,MAAMC,gBAAgBT,oCACpBO,MACAC,QAAQC,aAAa;IAEvB,MAAMC,gBAAgBV,oCACpBO,MACAC,QAAQE,aAAa;IAGvB,MAAMC,UAAUT,6BAA6BO;IAC7C,MAAMG,iBAAiBJ,QAAQK,eAAe;IAE9C,IAAI,CAACD,gBAAgB;QACnB,MAAM,IAAIE,MACR,CAAC,gBAAgB,EAAEN,QAAQE,aAAa,CAAC,sFAAsF,CAAC;IAEpI;IAEA,IAAIC,QAAQI,QAAQ,KAAK,QAAQ;QAC/B,MAAM,IAAID,MACR,CAAC,SAAS,EAAEH,QAAQK,IAAI,CAAC,gBAAgB,EAAEL,QAAQI,QAAQ,CAAC,0IAA0I,CAAC;IAE3M;IAEA,MAAME,iBAAiBL,eAAeM,SAAS,IAAI;IACnD,MAAMC,gBAAgB,AACpB,CAAA,AAACP,eAAeG,QAAQ,IAA2B,MAAK,EACxDK,WAAW;IACb,MAAMC,qBAAqBhB,yBAAyB,CAACY,eAAe,IAAI,EAAE;IAC1E,IAAI,CAACI,mBAAmBC,QAAQ,CAACH,gBAAgB;QAC/C,MAAM,IAAIL,MACR,CAAC,OAAO,EAAEF,eAAeI,IAAI,CAAC,iBAAiB,EAAEG,cAAc,uCAAuC,CAAC,GACpGF,CAAAA,mBAAmB,cAAcE,kBAAkB,SAChD,CAAC,uJAAuJ,CAAC,GACzJ,CAAC,uBAAuB,EAAEE,mBAAmBE,IAAI,CAAC,MAAM,CAAC,CAAC,AAAD;IAEnE;IACA,IAAIX,eAAeY,IAAI,IAAIZ,eAAeY,IAAI,KAAK,OAAO;QACxD,MAAM,IAAIV,MACR,CAAC,OAAO,EAAEF,eAAeI,IAAI,CAAC,aAAa,EAAEJ,eAAeY,IAAI,CAAC,oFAAoF,CAAC;IAE1J;IAEA,4EAA4E;IAC5E,qEAAqE;IACrE,0EAA0E;IAC1E,MAAMC,qBAAqBb,eAAeI,IAAI,IAAI;IAClD,MAAMU,kBAAkB9B,UACtB,AAACgB,eAAee,EAAE,IAChB9B,YAAY4B;IAGhB,MAAMxB,0BAA0BM,MAAME,eAAe,OAAO;QAC1DmB,YAAYF;QACZG,MAAM,AAACjB,eAAeiB,IAAI,IAA2B;QACrDC,qBAAqBpB,cAAcM,IAAI;QACvCe,uBAAuB,GAAGN,mBAAmB,IAAI,CAAC;QAClD,0EAA0E;QAC1E,uEAAuE;QACvE,cAAc;QACdO,kBAAkBb,kBAAkB;IACtC;IAEA,6DAA6D;IAC7DrB,8BACES,MACAE,cAAcO,IAAI,EAClBb,mDACAO,cAAcuB,IAAI,EAClBP;IAGF,MAAM/B,gCAAgCY,MAAM;QAC1CJ;KACD;IAED,MAAMV,qBAAqBc;IAE3B,OAAO,IACLb,oBAAoBa,MAAMC,QAAQ0B,yBAAyB,EAAE;YAC3DC,WAAW;gBAAC;aAAa;QAC3B;AACJ,EAAE;AAEF,eAAe7B,yCAAyC"}

package/src/agentcore-gateway/agent-connection/schema.d.js

@@ -0,0 +1,6 @@
+/**
+ * Copyright Amazon.com, Inc. or its affiliates. All Rights Reserved.
+ * SPDX-License-Identifier: Apache-2.0
+ */ export { };
+
+//# sourceMappingURL=schema.d.js.map

package/src/agentcore-gateway/agent-connection/schema.d.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../../../../../../packages/nx-plugin/src/agentcore-gateway/agent-connection/schema.d.ts"],"sourcesContent":["/**\n * Copyright Amazon.com, Inc. or its affiliates. All Rights Reserved.\n * SPDX-License-Identifier: Apache-2.0\n */\nimport type { ComponentMetadata } from '../../utils/nx';\n\nexport interface AgentcoreGatewayAgentConnectionGeneratorSchema {\n  sourceProject: string;\n  targetProject: string;\n  sourceComponent?: ComponentMetadata;\n  targetComponent?: ComponentMetadata;\n  preferInstallDependencies?: boolean;\n}\n"],"names":[],"mappings":"AAAA;;;CAGC,GAGD,WAMC"}

package/src/agentcore-gateway/agent-connection/schema.d.ts

@@ -0,0 +1,13 @@
+/**
+ * Copyright Amazon.com, Inc. or its affiliates. All Rights Reserved.
+ * SPDX-License-Identifier: Apache-2.0
+ */
+import type { ComponentMetadata } from '../../utils/nx';
+
+export interface AgentcoreGatewayAgentConnectionGeneratorSchema {
+  sourceProject: string;
+  targetProject: string;
+  sourceComponent?: ComponentMetadata;
+  targetComponent?: ComponentMetadata;
+  preferInstallDependencies?: boolean;
+}