@aws/nx-plugin 1.0.0-rc.7 → 1.0.0-rc.71

package/src/ts/agent/files/ag-ui/index.ts.template

@@ -1,15 +1,32 @@
 import { StrandsAgent } from '@ag-ui/aws-strands';
-import { createStrandsApp } from '@ag-ui/aws-strands/server';
+import {
+  addStrandsExpressEndpoint,
+  addPing,
+  addCapabilities,
+} from '@ag-ui/aws-strands/server';
+import express, { type Request, type Response, type NextFunction } from 'express';
+import cors from 'cors';
 import { randomUUID } from 'node:crypto';
-import type { Request, Response, NextFunction } from 'express';
-import { runWithSessionId } from '<%- agentConnectionImport %>';
-import { getAgent } from './agent.js';
+import {
+  ModelErrorLoggingPlugin,
+  ToolErrorLoggingPlugin,
+  runWithSessionId,
+} from '<%- agentConnectionImport %>';
+import { getAgent } from './agent<% if (esm) { %>.js<% } %>';
+import { getSessionManager } from './session<% if (esm) { %>.js<% } %>';
 
 const PORT = parseInt(process.env.PORT || '8080');
 const HOST = '0.0.0.0';
 
 const SESSION_ID_HEADER = 'x-amzn-bedrock-agentcore-runtime-session-id';
 
+// Bind the inbound session (or a fresh UUID) for downstream MCP / A2A calls.
+const sessionIdMiddleware = (req: Request, _res: Response, next: NextFunction) => {
+  const header = req.headers[SESSION_ID_HEADER];
+  const sessionId = (Array.isArray(header) ? header[0] : header) ?? randomUUID();
+  runWithSessionId(sessionId, () => next());
+};
+
 void (async () => {
   const agent = await getAgent();
 
@@ -20,16 +37,24 @@ void (async () => {
     agent,
     name: '<%= agentNameClassName %>',
     description: 'A Strands Agent exposed via the AG-UI protocol.',
+    plugins: [new ModelErrorLoggingPlugin(), new ToolErrorLoggingPlugin()],
+    config: {
+      sessionManagerProvider: getSessionManager,
+    },
   });
 
-  const app = await createStrandsApp(aguiAgent, { path: '/invocations' });
+  // Built up manually (mirroring createStrandsApp's defaults) rather than via createStrandsApp
+  // https://github.com/ag-ui-protocol/ag-ui/blob/main/integrations/aws-strands/typescript/src/server.ts
+  const app = express();
+  app.use(cors({ origin: '*', credentials: true }));
+  app.use(express.json({ limit: '50mb' }));
 
-  // Bind the inbound session (or a fresh UUID) for downstream MCP / A2A calls.
-  app.use((req: Request, _res: Response, next: NextFunction) => {
-    const header = req.headers[SESSION_ID_HEADER];
-    const sessionId = (Array.isArray(header) ? header[0] : header) ?? randomUUID();
-    runWithSessionId(sessionId, () => next());
-  });
+  addPing(app, '/ping');
+  addCapabilities(app, '/capabilities', { agent: aguiAgent });
+
+  app.use(sessionIdMiddleware);
+
+  addStrandsExpressEndpoint(app, aguiAgent, { path: '/invocations' });
 
   app.listen(PORT, HOST, () => {
     console.log(`AG-UI server listening on ${HOST}:${PORT}`);

package/src/ts/agent/files/common/agent.ts.template

@@ -1,4 +1,11 @@
 import { Agent, tool } from '@strands-agents/sdk';
+<%_ if (protocol !== 'ag-ui') { _%>
+import {
+  ModelErrorLoggingPlugin,
+  ToolErrorLoggingPlugin,
+} from '<%- agentConnectionImport %>';
+import { getSessionManager } from './session<% if (esm) { %>.js<% } %>';
+<%_ } _%>
 import { z } from 'zod';
 
 const multiply = tool({
@@ -11,10 +18,16 @@ const multiply = tool({
   callback: ({ a, b }) => a * b,
 });
 
-export const getAgent = async () =>
-  new Agent({
+export const getAgent = async () => {
+  const agent = new Agent({
     systemPrompt: `You are a mathematical wizard.
   Use your tools for mathematical tasks.
   Refer to tools as your 'spellbook'.`,
     tools: [multiply],
+<%_ if (protocol !== 'ag-ui') { _%>
+    sessionManager: await getSessionManager(),
+    plugins: [new ModelErrorLoggingPlugin(), new ToolErrorLoggingPlugin()],
+<%_ } _%>
   });
+  return agent;
+};

package/src/ts/agent/files/common/session.ts.template

@@ -0,0 +1,43 @@
+import { SessionManager } from '@strands-agents/sdk';
+import { LocalFileStorage<% if (session === 's3') { %>, S3Storage<% } else { %>, InMemoryStorage<% } %> } from '@strands-agents/sdk/storage';
+import {
+  getCurrentSessionId,
+<%_ if (session === 's3') { _%>
+  getAgentCoreRuntimeConfig,
+<%_ } _%>
+} from '<%- agentConnectionImport %>';
+
+/**
+ * Returns a SessionManager for persisting conversation state across
+ * invocations. Local development always uses local file storage for
+ * convenience, regardless of the configured session option. Without a
+ * configured session option, conversation state is kept in memory only and
+ * does not survive process restarts.
+ */
+export const getSessionManager = async (): Promise<SessionManager> => {
+  const sessionId = getCurrentSessionId();
+  if (!sessionId) {
+    throw new Error(
+      'No current session id — cannot resolve a SessionManager outside of a request scope.',
+    );
+  }
+  if (process.env.LOCAL_DEV === 'true') {
+    return new SessionManager({
+      sessionId,
+      storage: new LocalFileStorage('<%- localSessionsDir %>'),
+    });
+  }
+<%_ if (session === 's3') { _%>
+  const config = await getAgentCoreRuntimeConfig();
+  const bucketName =
+    config.agentRuntimes?.['<%- agentNameClassName %>']?.session?.bucketName;
+  if (!bucketName) {
+    throw new Error(
+      "No S3 bucket configured for this agent's session in runtime configuration.",
+    );
+  }
+  return new SessionManager({ sessionId, storage: new S3Storage(bucketName) });
+<%_ } else { _%>
+  return new SessionManager({ sessionId, storage: new InMemoryStorage() });
+<%_ } _%>
+};

package/src/ts/agent/files/deploy/Dockerfile.template

@@ -1,10 +1,21 @@
-FROM public.ecr.aws/docker/library/node:lts-jod
+FROM <%- nodeBaseImage %>
+
+# Upgrade npm to a version free of known HIGH/CRITICAL vulnerabilities
+RUN npm install -g npm@<%- npmVersion %>
 
 WORKDIR /app
 
 # Add AWS Distro for OpenTelemetry for observability
 # https://docs.aws.amazon.com/bedrock-agentcore/latest/devguide/observability-configure.html
-RUN npm install @aws/aws-distro-opentelemetry-node-autoinstrumentation@<%- adotVersion %>
+# The overrides pin transitive dependencies with known HIGH/CRITICAL
+# vulnerabilities to fixed versions. npm is removed once the install is done —
+# the runtime only needs node, and npm's own bundled dependencies would
+# otherwise carry vulnerabilities into the image.
+RUN npm init -y \
+  && npm pkg set "overrides.@opentelemetry/propagator-jaeger=<%- jaegerVersion %>" \
+  && npm pkg set "overrides.minimatch=<%- minimatchVersion %>" \
+  && npm install @aws/aws-distro-opentelemetry-node-autoinstrumentation@<%- adotVersion %> \
+  && npm uninstall -g npm
 
 # Copy bundled agent
 COPY index.js /app

package/src/ts/agent/files/http/client.ts.template

@@ -1,5 +1,5 @@
-import { AppRouter } from './router.js';
-import { AgentCoreTrpcClient, WebSocketTrpcClient } from './agent-core-trpc-client.js';
+import { AppRouter } from './router<% if (esm) { %>.js<% } %>';
+import { AgentCoreTrpcClient, WebSocketTrpcClient } from './agent-core-trpc-client<% if (esm) { %>.js<% } %>';
 
 /**
  * Client for connecting to <%- agentNameClassName %> on Bedrock AgentCore Runtime via WebSocket from a NodeJS environment

package/src/ts/agent/files/http/index.ts.template

@@ -4,14 +4,14 @@ import {
   CreateHTTPContextOptions,
   createHTTPHandler,
 } from '@trpc/server/adapters/standalone';
-import { appRouter, AppRouter } from './router.js';
+import { appRouter, AppRouter } from './router<% if (esm) { %>.js<% } %>';
 import { WebSocketServer } from 'ws';
 import cors from 'cors';
 import {
   CreateWSSContextFnOptions,
   applyWSSHandler,
 } from '@trpc/server/adapters/ws';
-import { Context } from './init.js';
+import { Context } from './init<% if (esm) { %>.js<% } %>';
 
 const PORT = parseInt(process.env.PORT || '8080');
 

package/src/ts/agent/files/http/router.ts.template

@@ -1,8 +1,8 @@
-import { publicProcedure, t } from './init.js';
+import { publicProcedure, t } from './init<% if (esm) { %>.js<% } %>';
 import { z } from 'zod';
-import { zAsyncIterable } from './schema/z-async-iterable.js';
+import { zAsyncIterable } from './schema/z-async-iterable<% if (esm) { %>.js<% } %>';
 import { enterSessionContext, withSessionId } from '<%- agentConnectionImport %>';
-import { getAgent } from './agent.js';
+import { getAgent } from './agent<% if (esm) { %>.js<% } %>';
 
 export const router = t.router;
 
@@ -10,7 +10,7 @@ const agent = withSessionId(getAgent);
 
 export const appRouter = router({
   invoke: publicProcedure
-    .input(z.object({ message: z.string() }))
+    .input(z.object({ prompt: z.string().max(100000) }))
     .output(
       zAsyncIterable({
         yield: z.string(),
@@ -20,7 +20,7 @@ export const appRouter = router({
     .subscription(async function* (opts) {
       // Bind the session ID for this subscription so downstream MCP / A2A clients forward it on outbound calls.
       enterSessionContext(opts.ctx.sessionId);
-      for await (const event of agent.stream(opts.input.message)) {
+      for await (const event of agent.stream(opts.input.prompt)) {
         if (
           event.type === 'modelStreamUpdateEvent' &&
           event.event.type === 'modelContentBlockDeltaEvent' &&

package/src/ts/agent/gateway-connection/__snapshots__/generator.spec.ts.snap

@@ -0,0 +1,222 @@
+// Vitest Snapshot v1, https://vitest.dev/guide/snapshot.html
+
+exports[`ts#agent#gateway-connection generator > should match snapshot for agent-connection src files > agent-connection-index.ts 1`] = `
+"export * from './app/my-gateway-client-strands.js';
+export * from './core/tool-errors-strands.js';
+export * from './core/model-errors-strands.js';
+export * from './core/with-session-id-strands.js';
+export * from './core/runtime-config.js';
+export * from './core/session-context.js';
+// Export your library code here
+"
+`;
+
+exports[`ts#agent#gateway-connection generator > should match snapshot for agent-connection src files > agentcore-fetch.ts 1`] = `
+"import { AwsClient } from 'aws4fetch';
+import { fromNodeProviderChain } from '@aws-sdk/credential-providers';
+import { getCurrentSessionId } from './session-context.js';
+
+const SESSION_HEADER = 'X-Amzn-Bedrock-AgentCore-Runtime-Session-Id';
+
+/** Wrap a fetch so each request carries the current async-context session id. */
+const withSessionHeader =
+  (inner: typeof fetch): typeof fetch =>
+  async (input, init) => {
+    const headers = new Headers(init?.headers);
+    const sessionId = getCurrentSessionId();
+    if (sessionId) headers.set(SESSION_HEADER, sessionId);
+    return inner(input, { ...init, headers });
+  };
+
+/** Options for a SigV4-signing fetch. */
+export interface SigV4FetchOptions {
+  /** AWS region to sign for. */
+  region: string;
+  /** AWS service to sign for. Defaults to \`bedrock-agentcore\`. */
+  service?: string;
+  /** AWS credential provider; defaults to the standard provider chain. */
+  credentialProvider?: ReturnType<typeof fromNodeProviderChain>;
+}
+
+/** A fetch that signs every request with AWS SigV4 (per-request, body-aware). */
+export const createSigV4Fetch = (options: SigV4FetchOptions): typeof fetch => {
+  const { region, service = 'bedrock-agentcore' } = options;
+  const credentialProvider =
+    options.credentialProvider ?? fromNodeProviderChain();
+  const signedFetch: typeof fetch = async (...args) => {
+    const client = new AwsClient({
+      ...(await credentialProvider()),
+      service,
+      region,
+    });
+    return client.fetch(...args);
+  };
+  return withSessionHeader(signedFetch);
+};
+
+/** A fetch that adds a bearer token from the given async provider. */
+export const createJwtFetch = (
+  accessTokenProvider: () => Promise<string>,
+): typeof fetch =>
+  withSessionHeader(async (input, init) => {
+    const headers = new Headers(init?.headers);
+    headers.set('Authorization', \`Bearer \${await accessTokenProvider()}\`);
+    return fetch(input, { ...init, headers });
+  });
+
+/** A plain fetch (local dev) that still forwards the session id. */
+export const createPlainFetch = (): typeof fetch => withSessionHeader(fetch);
+"
+`;
+
+exports[`ts#agent#gateway-connection generator > should match snapshot for agent-connection src files > agentcore-gateway-mcp-client-strands.ts 1`] = `
+"import { McpClient } from '@strands-agents/sdk';
+import {
+  AgentCoreGatewayMcpTransport,
+  type AgentCoreGatewayMcpTransportIamOptions,
+} from './agentcore-gateway-mcp-transport.js';
+
+/**
+ * Strands MCP clients that connect to an AgentCore Gateway.
+ */
+export class AgentCoreGatewayMcpClientStrands {
+  /** Create a gateway MCP client authenticated with IAM SigV4. */
+  static withIamAuth(
+    options: AgentCoreGatewayMcpTransportIamOptions,
+  ): McpClient {
+    return new McpClient({
+      transport: AgentCoreGatewayMcpTransport.withIamAuth(options),
+    });
+  }
+
+  /** Plain-HTTP gateway client, for the local gateway started by the dev target. */
+  static withoutAuth(options: { gatewayUrl: string }): McpClient {
+    return new McpClient({
+      transport: AgentCoreGatewayMcpTransport.withoutAuth(options),
+    });
+  }
+}
+"
+`;
+
+exports[`ts#agent#gateway-connection generator > should match snapshot for agent-connection src files > agentcore-gateway-mcp-transport.ts 1`] = `
+"import type { StreamableHTTPClientTransport } from '@modelcontextprotocol/sdk/client/streamableHttp.js';
+import { fromNodeProviderChain } from '@aws-sdk/credential-providers';
+import { regionFromGatewayUrl } from './agentcore-endpoints.js';
+import { sigV4Transport, noAuthTransport } from './agentcore-transport.js';
+
+export interface AgentCoreGatewayMcpTransportIamOptions {
+  /**
+   * The MCP URL of the AgentCore Gateway, of the form
+   * https://<gatewayId>.gateway.bedrock-agentcore.<region>.amazonaws.com/mcp
+   */
+  gatewayUrl: string;
+  /** AWS region override; by default parsed from \`gatewayUrl\`. */
+  region?: string;
+  /** AWS credential provider; defaults to the standard provider chain. */
+  credentialProvider?: ReturnType<typeof fromNodeProviderChain>;
+}
+
+/**
+ * Factory for MCP transports that connect to an AgentCore Gateway. Forwards the
+ * current async-context session via the AgentCore session header, which the
+ * gateway propagates to downstream MCP server targets.
+ */
+export class AgentCoreGatewayMcpTransport {
+  /** Create a gateway MCP transport authenticated with IAM SigV4. */
+  static withIamAuth(
+    options: AgentCoreGatewayMcpTransportIamOptions,
+  ): StreamableHTTPClientTransport {
+    return sigV4Transport({
+      region: options.region ?? regionFromGatewayUrl(options.gatewayUrl),
+      url: options.gatewayUrl,
+      credentialProvider: options.credentialProvider,
+    });
+  }
+
+  /** Plain-HTTP gateway transport, for the local gateway started by the dev target. */
+  static withoutAuth(options: {
+    gatewayUrl: string;
+  }): StreamableHTTPClientTransport {
+    return noAuthTransport({ url: options.gatewayUrl });
+  }
+}
+"
+`;
+
+exports[`ts#agent#gateway-connection generator > should match snapshot for agent-connection src files > agentcore-transport.ts 1`] = `
+"import { StreamableHTTPClientTransport } from '@modelcontextprotocol/sdk/client/streamableHttp.js';
+import { fromNodeProviderChain } from '@aws-sdk/credential-providers';
+import {
+  createSigV4Fetch,
+  createJwtFetch,
+  createPlainFetch,
+} from './agentcore-fetch.js';
+
+const build = (
+  url: string,
+  fetchFn: typeof fetch,
+): StreamableHTTPClientTransport =>
+  new StreamableHTTPClientTransport(new URL(url), { fetch: fetchFn });
+
+/** SigV4-signed transport for a resolved AgentCore endpoint. */
+export const sigV4Transport = (options: {
+  region: string;
+  url: string;
+  credentialProvider?: ReturnType<typeof fromNodeProviderChain>;
+}): StreamableHTTPClientTransport =>
+  build(
+    options.url,
+    createSigV4Fetch({
+      region: options.region,
+      credentialProvider: options.credentialProvider,
+    }),
+  );
+
+/** Bearer-token transport for a resolved AgentCore endpoint. */
+export const jwtTransport = (options: {
+  url: string;
+  accessTokenProvider: () => Promise<string>;
+}): StreamableHTTPClientTransport =>
+  build(options.url, createJwtFetch(options.accessTokenProvider));
+
+/** Plain-HTTP transport — for local dev. */
+export const noAuthTransport = (options: {
+  url: string;
+}): StreamableHTTPClientTransport => build(options.url, createPlainFetch());
+"
+`;
+
+exports[`ts#agent#gateway-connection generator > should match snapshot for agent-connection src files > my-gateway-client-strands.ts 1`] = `
+"import { McpClient } from '@strands-agents/sdk';
+import { AgentCoreGatewayMcpClientStrands } from '../core/agentcore-gateway-mcp-client-strands.js';
+import { getAgentCoreRuntimeConfig } from '../core/runtime-config.js';
+
+/**
+ * Strands client for the MyGateway AgentCore Gateway.
+ *
+ * Deployed: a SigV4-signed MCP client pointing at the gateway URL.
+ * Local (\`LOCAL_DEV=true\`): a plain-HTTP client pointing at the local
+ * gateway started by the gateway project's dev target. The local
+ * gateway aggregates every attached MCP server but does not evaluate
+ * Cedar policies.
+ */
+export class MyGatewayClientStrands {
+  static async create(): Promise<McpClient> {
+    if (process.env.LOCAL_DEV === 'true') {
+      return AgentCoreGatewayMcpClientStrands.withoutAuth({
+        gatewayUrl: 'http://localhost:8100/mcp',
+      });
+    }
+    const config = await getAgentCoreRuntimeConfig();
+    const gatewayUrl = config.gateways?.['MyGateway'];
+    if (!gatewayUrl) {
+      throw new Error(
+        \`No connected gateway named 'MyGateway' found in runtime configuration.\`,
+      );
+    }
+    return AgentCoreGatewayMcpClientStrands.withIamAuth({ gatewayUrl });
+  }
+}
+"
+`;

package/src/ts/agent/gateway-connection/files/agent-connection/app/__gatewayKebabCase__-client-strands.ts.template

@@ -0,0 +1,30 @@
+import { McpClient } from '@strands-agents/sdk';
+import { AgentCoreGatewayMcpClientStrands } from '../core/agentcore-gateway-mcp-client-strands<% if (esm) { %>.js<% } %>';
+import { getAgentCoreRuntimeConfig } from '../core/runtime-config<% if (esm) { %>.js<% } %>';
+
+/**
+ * Strands client for the <%- gatewayClassName %> AgentCore Gateway.
+ *
+ * Deployed: a SigV4-signed MCP client pointing at the gateway URL.
+ * Local (`LOCAL_DEV=true`): a plain-HTTP client pointing at the local
+ * gateway started by the gateway project's dev target. The local
+ * gateway aggregates every attached MCP server but does not evaluate
+ * Cedar policies.
+ */
+export class <%- gatewayClassName %>ClientStrands {
+  static async create(): Promise<McpClient> {
+    if (process.env.LOCAL_DEV === 'true') {
+      return AgentCoreGatewayMcpClientStrands.withoutAuth({
+        gatewayUrl: 'http://localhost:<%- gatewayPort %>/mcp',
+      });
+    }
+    const config = await getAgentCoreRuntimeConfig();
+    const gatewayUrl = config.gateways?.['<%- gatewayClassName %>'];
+    if (!gatewayUrl) {
+      throw new Error(
+        `No connected gateway named '<%- gatewayClassName %>' found in runtime configuration.`,
+      );
+    }
+    return AgentCoreGatewayMcpClientStrands.withIamAuth({ gatewayUrl });
+  }
+}

package/src/ts/agent/gateway-connection/generator.d.ts

@@ -0,0 +1,47 @@
+/**
+ * Copyright Amazon.com, Inc. or its affiliates. All Rights Reserved.
+ * SPDX-License-Identifier: Apache-2.0
+ */
+import { type GeneratorCallback, type Tree } from '@nx/devkit';
+import { type NxGeneratorInfo } from '../../../utils/nx';
+import type { TsAgentGatewayConnectionGeneratorSchema } from './schema';
+export declare const DEPENDENCIES: import("../../../utils/declared-dependencies").DependencyDeclaration<readonly [{
+    readonly name: "@modelcontextprotocol/sdk";
+}, {
+    readonly name: "@strands-agents/sdk";
+}, {
+    readonly name: "@aws-lambda-powertools/parameters";
+}, {
+    readonly name: "@aws-sdk/client-appconfigdata";
+}, {
+    readonly name: "aws4fetch";
+}, {
+    readonly name: "@aws-sdk/credential-providers";
+}, {
+    readonly name: "@aws-lambda-powertools/parameters";
+} & {
+    versionOnly: true;
+}, {
+    readonly name: "@aws-sdk/credential-providers";
+} & {
+    versionOnly: true;
+}, {
+    readonly name: "aws4fetch";
+} & {
+    versionOnly: true;
+}, {
+    readonly name: "@modelcontextprotocol/sdk";
+} & {
+    versionOnly: true;
+}, {
+    readonly name: "@a2a-js/sdk";
+} & {
+    versionOnly: true;
+}, {
+    readonly name: "@strands-agents/sdk";
+} & {
+    versionOnly: true;
+}], readonly import("../../../utils/declared-dependencies").DeclaredPyDependency<"a2a-sdk" | "ag-ui-langgraph" | "ag-ui-protocol" | "ag-ui-strands" | "aws-lambda-powertools" | "aws-lambda-powertools[tracer]" | "aws-lambda-powertools[parser]" | "aws-opentelemetry-distro" | "bedrock-agentcore" | "boto3" | "checkov" | "fastapi" | "fastapi[standard]" | "httpx" | "langchain" | "langchain-aws" | "langchain-mcp-adapters" | "langgraph" | "mcp" | "pip-check-updates" | "pip-licenses" | "ruff" | "strands-agents" | "strands-agents[a2a]" | "strands-agents-tools" | "ty" | "pynamodb" | "uvicorn" | "sqlmodel" | "alembic" | "aiomysql" | "asyncpg" | "greenlet", Record<string, never>>[]>;
+export declare const TS_AGENT_GATEWAY_CONNECTION_GENERATOR_INFO: NxGeneratorInfo;
+export declare const tsAgentGatewayConnectionGenerator: (tree: Tree, options: TsAgentGatewayConnectionGeneratorSchema) => Promise<GeneratorCallback>;
+export default tsAgentGatewayConnectionGenerator;

package/src/ts/agent/gateway-connection/generator.js

@@ -0,0 +1,144 @@
+/**
+ * Copyright Amazon.com, Inc. or its affiliates. All Rights Reserved.
+ * SPDX-License-Identifier: Apache-2.0
+ */ import { generateFiles, joinPathFragments, OverwriteStrategy, updateProjectConfiguration } from "@nx/devkit";
+import { readAgentCoreGatewayMetadata } from "../../../agentcore-gateway/generator.js";
+import { addTsDependencies } from "../../../utils/add-dependencies.js";
+import { AGENT_CONNECTION_DEPENDENCIES, AGENT_CONNECTION_PROJECT_DIR, addTypeScriptClientToAgent, addTypeScriptCoreClient, ensureTypeScriptAgentConnectionProject } from "../../../utils/agent-connection/agent-connection.js";
+import { addDestructuredImport, addStarExport } from "../../../utils/ast.js";
+import { declareDependencies, ownedElsewhere } from "../../../utils/declared-dependencies.js";
+import { formatFilesInSubtree } from "../../../utils/format.js";
+import { installDependencies } from "../../../utils/install.js";
+import { addGeneratorMetricsIfApplicable } from "../../../utils/metrics.js";
+import { esmVars } from "../../../utils/module-format.js";
+import { kebabCase } from "../../../utils/names.js";
+import { getNpmScope } from "../../../utils/npm-scope.js";
+import { addComponentGeneratorMetadata, addDependencyToTargetIfNotPresent, getGeneratorInfo, readProjectConfigurationUnqualified } from "../../../utils/nx.js";
+import { toProjectRelativePath } from "../../../utils/paths.js";
+// The gateway core client + vended client need these whatever the connection's
+// options, so no entry is conditional.
+export const DEPENDENCIES = declareDependencies()({
+    ts: [
+        {
+            name: '@modelcontextprotocol/sdk'
+        },
+        {
+            name: '@strands-agents/sdk'
+        },
+        {
+            name: '@aws-lambda-powertools/parameters'
+        },
+        {
+            name: '@aws-sdk/client-appconfigdata'
+        },
+        {
+            name: 'aws4fetch'
+        },
+        {
+            name: '@aws-sdk/credential-providers'
+        },
+        ...ownedElsewhere(AGENT_CONNECTION_DEPENDENCIES)
+    ]
+});
+export const TS_AGENT_GATEWAY_CONNECTION_GENERATOR_INFO = getGeneratorInfo(import.meta.filename);
+export const tsAgentGatewayConnectionGenerator = async (tree, options)=>{
+    const sourceProject = readProjectConfigurationUnqualified(tree, options.sourceProject);
+    const targetProject = readProjectConfigurationUnqualified(tree, options.targetProject);
+    const agentComponent = options.sourceComponent;
+    if (!agentComponent) {
+        throw new Error('sourceComponent must be provided for ts#agent -> agentcore-gateway connections');
+    }
+    const gateway = readAgentCoreGatewayMetadata(targetProject);
+    if (gateway.protocol !== 'mcp') {
+        throw new Error(`Gateway '${gateway.name}' has protocol='${gateway.protocol}'. Only MCP-protocol gateways are supported.`);
+    }
+    if (gateway.auth !== 'iam') {
+        throw new Error(`Gateway '${gateway.name}' uses auth='${gateway.auth}'. Agent connections currently require the gateway to use IAM authentication.`);
+    }
+    if (agentComponent.auth && agentComponent.auth !== 'iam') {
+        throw new Error(`Agent '${agentComponent.name}' uses auth='${agentComponent.auth}'. Only IAM-authenticated agents can connect to IAM gateways.`);
+    }
+    const gatewayClassName = gateway.rc;
+    const gatewayKebabCase = kebabCase(gatewayClassName);
+    // A gateway is its own standalone project, so it exposes plain serve / dev.
+    const gatewayServeTargetName = 'serve';
+    const gatewayDevTargetName = 'dev';
+    const npmScope = getNpmScope(tree);
+    // 1. Ensure the shared agent-connection project exists + has the gateway
+    //    core client template.
+    await ensureTypeScriptAgentConnectionProject(tree, DEPENDENCIES);
+    await addTypeScriptCoreClient(tree, 'gateway', DEPENDENCIES);
+    // 2. Generate the per-connection <Gateway>Client into app/. Local mode
+    //    points at the gateway project's local gateway port.
+    generateFiles(tree, joinPathFragments(import.meta.dirname, 'files', 'agent-connection', 'app'), joinPathFragments(AGENT_CONNECTION_PROJECT_DIR, 'src', 'app'), {
+        gatewayKebabCase,
+        gatewayClassName,
+        gatewayPort: gateway.port,
+        ...esmVars(tree)
+    }, {
+        overwriteStrategy: OverwriteStrategy.KeepExisting
+    });
+    // Re-export from the agent-connection index
+    await addStarExport(tree, joinPathFragments(AGENT_CONNECTION_PROJECT_DIR, 'src', 'index.ts'), `./app/${gatewayKebabCase}-client-strands.js`);
+    // 3. AST-transform agent.ts to add the gateway client (an McpClient in
+    //    both deployed and local modes) to the agent's tools.
+    const agentSourceDir = joinPathFragments(sourceProject.root, agentComponent.path ?? 'src');
+    const agentFilePath = joinPathFragments(agentSourceDir, 'agent.ts');
+    if (tree.exists(agentFilePath)) {
+        const clientClassName = `${gatewayClassName}ClientStrands`;
+        const clientVarName = gatewayClassName.charAt(0).toLowerCase() + gatewayClassName.slice(1);
+        await addDestructuredImport(tree, agentFilePath, [
+            clientClassName
+        ], `@${npmScope}/agent-connection`);
+        await addTypeScriptClientToAgent(tree, agentFilePath, clientClassName, clientVarName);
+    }
+    // 4. Wire dev chain — agent's dev depends on gateway's
+    //    aggregator target, which transitively starts each attached MCP server.
+    const agentName = agentComponent.name ?? 'agent';
+    const serveTargetName = `${agentName}-serve`;
+    const devTargetName = `${agentName}-dev`;
+    let projectConfigChanged = false;
+    if (sourceProject.targets?.[serveTargetName]) {
+        addDependencyToTargetIfNotPresent(sourceProject, serveTargetName, {
+            projects: [
+                targetProject.name
+            ],
+            target: gatewayServeTargetName
+        });
+        projectConfigChanged = true;
+    }
+    if (sourceProject.targets?.[devTargetName]) {
+        addDependencyToTargetIfNotPresent(sourceProject, devTargetName, {
+            projects: [
+                targetProject.name
+            ],
+            target: gatewayDevTargetName
+        });
+        projectConfigChanged = true;
+    }
+    if (projectConfigChanged) {
+        updateProjectConfiguration(tree, sourceProject.name, sourceProject);
+    }
+    // 5. Dependencies
+    addTsDependencies(tree, DEPENDENCIES, {
+        projectRoot: sourceProject.root
+    });
+    // Recorded so the version sync knows this connection's dependencies are ours.
+    addComponentGeneratorMetadata(tree, sourceProject.name, TS_AGENT_GATEWAY_CONNECTION_GENERATOR_INFO, toProjectRelativePath(sourceProject, agentFilePath), gatewayClassName, // The source component this connection is made from, so the pair is
+    // identifiable rather than just the two projects.
+    {
+        sourcePath: options.sourceComponent?.path
+    });
+    await addGeneratorMetricsIfApplicable(tree, [
+        TS_AGENT_GATEWAY_CONNECTION_GENERATOR_INFO
+    ]);
+    await formatFilesInSubtree(tree);
+    return ()=>installDependencies(tree, options.preferInstallDependencies, {
+            languages: [
+                'typescript'
+            ]
+        });
+};
+export default tsAgentGatewayConnectionGenerator;
+
+//# sourceMappingURL=generator.js.map