@aws/nx-plugin 1.0.0-rc.7 → 1.0.0-rc.71

package/src/agentcore-gateway/files/cedar/policies/README.md

@@ -0,0 +1,61 @@
+# Cedar policies for <%= nameClassName %>
+
+Every `.cedar` file in this directory is deployed as a separate `Policy`
+resource attached to this gateway's `PolicyEngine`. The engine runs in
+`ENFORCE` mode, so policies are evaluated and decisions are enforced at
+runtime.
+
+## Default policy
+
+<%_ if (auth === 'cognito') { _%>
+`permit-all.cedar` permits any Cognito-authenticated caller
+(`principal is AgentCore::OAuthUser`). The gateway's JWT authorizer already
+validates the token's user pool and client before policies are evaluated, so
+any principal that reaches the engine is an authenticated OAuth user. Tighten
+this by matching JWT claims (e.g. `principal.scope`) — see the
+[AgentCore common policy patterns](https://docs.aws.amazon.com/bedrock-agentcore/latest/devguide/policy-common-patterns.html).
+<%_ } else { _%>
+`permit-all.cedar` permits any IAM caller from the deploying AWS account.
+It is scoped to your account because AgentCore's policy validator rejects
+truly unrestricted permits (`permit (principal, action, resource)`) as
+"Overly Permissive".
+<%_ } _%>
+
+**If you delete this file without adding replacement `permit` policies, the
+gateway will deny every request** — Cedar uses a default-deny evaluation
+model, so every request requires at least one matching `permit` to be
+allowed.
+
+## Template variables
+
+Policies are [EJS](https://ejs.co/) templates rendered at synth/plan time
+with the following variables in scope:
+
+- `<%%= gatewayArn %>` — this gateway's ARN
+- `<%%= accountId %>` — the AWS account this gateway is deployed into
+
+Add your own variables (e.g. an agent's role name) where the policies are
+rendered:
+
+- CDK: the `cedarPolicyVariables` prop in
+  `packages/common/constructs/src/app/gateways/<name>/<name>.ts`
+- Terraform: the `query` of the `rendered_policies` data source in
+  `packages/common/terraform/src/app/gateways/<name>/<name>.tf`
+
+## Adding a new policy
+
+1. Create `policies/<my-policy>.cedar` alongside the existing files.
+2. Write Cedar rules — see the **Writing Policies** section of the
+   [AgentCore Gateway guide](https://awslabs.github.io/nx-plugin-for-aws/guides/agentcore-gateway/)
+   for valid patterns and validator gotchas.
+3. Re-synth / plan your infrastructure to deploy the new policy.
+
+Policy names are derived from file names: `my-policy.cedar` becomes the
+policy `MyPolicy` (plus a unique suffix, since policy names must be unique
+account-wide). Keep file names unique within this directory.
+
+## Further reading
+
+- [Cedar policy language reference](https://docs.cedarpolicy.com/)
+- [AgentCore policy semantics](https://docs.aws.amazon.com/bedrock-agentcore/latest/devguide/policy-understanding-cedar.html)
+- [AgentCore common policy patterns](https://docs.aws.amazon.com/bedrock-agentcore/latest/devguide/policy-common-patterns.html)

package/src/agentcore-gateway/files/cedar/policies/permit-all.cedar

@@ -0,0 +1,26 @@
+<%_ if (auth === 'cognito') { _%>
+// Default policy: permit any Cognito-authenticated caller.
+// The gateway's JWT authorizer already validates the token's user pool and
+// client, so any principal reaching policy evaluation is an authenticated
+// OAuth user. The PolicyEngine runs in ENFORCE mode (default-deny) — deleting
+// this file without a replacement permit denies every call. See
+// policies/README.md.
+
+permit (
+  principal is AgentCore::OAuthUser,
+  action,
+  resource == AgentCore::Gateway::"<%%= gatewayArn %>"
+);
+<%_ } else { _%>
+// Default policy: permit any IAM caller from the deploying AWS account.
+// The PolicyEngine runs in ENFORCE mode (default-deny) — deleting this file
+// without a replacement permit denies every call. See policies/README.md.
+
+permit (
+  principal is AgentCore::IamEntity,
+  action,
+  resource == AgentCore::Gateway::"<%%= gatewayArn %>"
+) when {
+  principal.id like "arn:aws:*::<%%= accountId %>:*"
+};
+<%_ } _%>

package/src/agentcore-gateway/files/project/http/local-dev.ts.template

@@ -0,0 +1,77 @@
+import express from 'express';
+import { Readable } from 'node:stream';
+
+const PORT = parseInt(process.env.PORT || '<%- port %>');
+
+interface AttachedAgent {
+  name: string;
+  url: string;
+  /**
+   * Whether to strip the `/invocations` path prefix when proxying. The
+   * deployed gateway maps an A2A target's `/invocations/...` paths onto the
+   * agent container's root; HTTP and AG-UI agents serve `/invocations`
+   * themselves.
+   */
+  stripInvocations: boolean;
+}
+
+// Upstream agent endpoints attached to this gateway, maintained by the
+// `agentcore-gateway#agent-connection` generator.
+const ATTACHED_AGENTS: AttachedAgent[] = [<% attachedAgents.forEach((a) => { %>
+  { name: '<%- a.name %>', url: 'http://localhost:<%- a.port %>', stripInvocations: <%- a.stripInvocations %> },<% }); %>
+];
+
+/**
+ * Local gateway for <%- nameClassName %>: proxies `/<targetName>/<path>` to
+ * the attached agent's local server, matching the deployed AgentCore
+ * Gateway's path-based routing for agent runtime targets.
+ */
+const app = express();
+
+app.use(async (req, res) => {
+  const [, targetName, ...rest] = req.url.split('/');
+  const upstream = ATTACHED_AGENTS.find((a) => a.name === targetName);
+  if (!upstream) {
+    res.status(404).json({ message: `Unknown gateway target: ${targetName}` });
+    return;
+  }
+  const upstreamPath = upstream.stripInvocations
+    ? rest.join('/').replace(/^invocations\/?/, '')
+    : rest.join('/');
+  try {
+    const response = await fetch(`${upstream.url}/${upstreamPath}`, {
+      method: req.method,
+      headers: Object.fromEntries(
+        Object.entries(req.headers).filter(
+          ([key, value]) => typeof value === 'string' && key !== 'host',
+        ) as [string, string][],
+      ),
+      body: ['GET', 'HEAD'].includes(req.method)
+        ? undefined
+        : Readable.toWeb(req),
+      // Node's fetch requires half-duplex for streamed request bodies.
+      duplex: 'half',
+    } as RequestInit);
+    res.status(response.status);
+    response.headers.forEach((value, key) => {
+      // The upstream body arrives decoded, so its encoding headers would be incorrect.
+      if (!['content-encoding', 'content-length'].includes(key)) {
+        res.setHeader(key, value);
+      }
+    });
+    if (response.body) {
+      Readable.fromWeb(response.body as any).pipe(res);
+    } else {
+      res.end();
+    }
+  } catch (error) {
+    console.error(`Error proxying to ${upstream.name}:`, error);
+    if (!res.headersSent) {
+      res.status(502).json({ message: 'Bad gateway' });
+    }
+  }
+});
+
+app.listen(PORT, () => {
+  console.log(`<%- nameKebabCase %>: local gateway listening on port ${PORT}`);
+});

package/src/agentcore-gateway/files/project/mcp/local-dev.ts.template

@@ -0,0 +1,134 @@
+import { Client } from '@modelcontextprotocol/sdk/client/index.js';
+import { StreamableHTTPClientTransport } from '@modelcontextprotocol/sdk/client/streamableHttp.js';
+import { Server } from '@modelcontextprotocol/sdk/server/index.js';
+import { StreamableHTTPServerTransport } from '@modelcontextprotocol/sdk/server/streamableHttp.js';
+import {
+  CallToolRequestSchema,
+  ListToolsRequestSchema,
+} from '@modelcontextprotocol/sdk/types.js';
+import express from 'express';
+import { AsyncLocalStorage } from 'node:async_hooks';
+
+const PORT = parseInt(process.env.PORT || '<%- port %>');
+const PREFIX_SEPARATOR = '___';
+const SESSION_HEADER = 'x-amzn-bedrock-agentcore-runtime-session-id';
+
+interface AttachedMcpServer {
+  name: string;
+  url: string;
+}
+
+// Upstream MCP endpoints attached to this gateway (MCP servers and other
+// gateways), maintained by the `agentcore-gateway#mcp-connection` and
+// `agentcore-gateway#gateway-connection` generators.
+const ATTACHED_MCP_SERVERS: AttachedMcpServer[] = [<% attachedMcpServers.forEach((s) => { %>
+  { name: '<%- s.name %>', url: 'http://localhost:<%- s.port %>/mcp' },<% }); %>
+];
+
+// Forwards the inbound request's AgentCore session header to upstream calls
+const sessionContext = new AsyncLocalStorage<string | undefined>();
+
+const createUpstreamClient = async (url: string): Promise<Client> => {
+  const fetchWithSession: typeof fetch = async (input, init) => {
+    const headers = new Headers(init?.headers);
+    const sessionId = sessionContext.getStore();
+    if (sessionId) headers.set(SESSION_HEADER, sessionId);
+    return fetch(input, { ...init, headers });
+  };
+  const client = new Client({ name: '<%- nameKebabCase %>', version: '1.0.0' });
+  await client.connect(
+    new StreamableHTTPClientTransport(new URL(url), {
+      fetch: fetchWithSession,
+    }),
+  );
+  return client;
+};
+
+/**
+ * Local gateway for <%- nameClassName %>: a single MCP endpoint aggregating
+ * every attached MCP server, with tools exposed as `<target>___<tool>` to
+ * match the deployed AgentCore Gateway. Unlike the real gateway, Cedar
+ * policies are not evaluated and there is no semantic tool search.
+ */
+const createServer = async (): Promise<Server> => {
+  const server = new Server(
+    { name: '<%- nameKebabCase %>', version: '1.0.0' },
+    { capabilities: { tools: {} } },
+  );
+
+  server.setRequestHandler(ListToolsRequestSchema, async () => {
+    const lists = await Promise.all(
+      ATTACHED_MCP_SERVERS.map(async (s) => {
+        const client = await createUpstreamClient(s.url);
+        try {
+          const { tools } = await client.listTools();
+          return tools.map((t) => ({
+            ...t,
+            name: `${s.name}${PREFIX_SEPARATOR}${t.name}`,
+          }));
+        } finally {
+          await client.close();
+        }
+      }),
+    );
+    return { tools: lists.flat() };
+  });
+
+  server.setRequestHandler(CallToolRequestSchema, async (request) => {
+    const name = request.params.name;
+    const upstream = ATTACHED_MCP_SERVERS.find((s) =>
+      name.startsWith(`${s.name}${PREFIX_SEPARATOR}`),
+    );
+    if (!upstream) {
+      throw new Error(`Unknown tool: ${name}`);
+    }
+    const client = await createUpstreamClient(upstream.url);
+    try {
+      return await client.callTool({
+        ...request.params,
+        name: name.slice(upstream.name.length + PREFIX_SEPARATOR.length),
+      });
+    } finally {
+      await client.close();
+    }
+  });
+
+  return server;
+};
+
+const app = express();
+app.use(express.json());
+
+app.post('/mcp', async (req, res) => {
+  const sessionId = req.headers[SESSION_HEADER];
+  await sessionContext.run(
+    typeof sessionId === 'string' ? sessionId : undefined,
+    async () => {
+      try {
+        const server = await createServer();
+        const transport = new StreamableHTTPServerTransport({
+          sessionIdGenerator: undefined,
+        });
+        res.on('close', () => {
+          transport.close();
+          server.close();
+        });
+        await server.connect(transport);
+        await transport.handleRequest(req, res, req.body);
+      } catch (error) {
+        console.error('Error handling MCP request:', error);
+        if (!res.headersSent) {
+          res.status(500).json({
+            jsonrpc: '2.0',
+            error: { code: -32603, message: 'Internal server error' },
+            id: null,
+          });
+        }
+      }
+    },
+  );
+});
+
+app.listen(PORT, () => {
+  console.log(`<%- nameKebabCase %>: local gateway listening on port ${PORT}`);
+});

package/src/agentcore-gateway/gateway-connection/generator.d.ts

@@ -0,0 +1,21 @@
+/**
+ * Copyright Amazon.com, Inc. or its affiliates. All Rights Reserved.
+ * SPDX-License-Identifier: Apache-2.0
+ */
+import type { GeneratorCallback, Tree } from '@nx/devkit';
+import { type NxGeneratorInfo } from '../../utils/nx';
+import type { AgentcoreGatewayGatewayConnectionGeneratorSchema } from './schema';
+export declare const AGENTCORE_GATEWAY_GATEWAY_CONNECTION_GENERATOR_INFO: NxGeneratorInfo;
+/**
+ * Connect an AgentCore Gateway to another AgentCore Gateway.
+ *
+ * Chains the source gateway's dev target to the target gateway's
+ * dev target, and registers the target gateway in the source
+ * gateway's local local-dev.ts so the local gateway aggregates its tools
+ * (already prefixed by the target gateway) under
+ * `<targetGateway>___<targetName>___<toolName>`. Users must still call
+ * `gateway.addGateway(...)` in their application stack to create the
+ * actual CDK/Terraform resource.
+ */
+export declare const agentcoreGatewayGatewayConnectionGenerator: (tree: Tree, options: AgentcoreGatewayGatewayConnectionGeneratorSchema) => Promise<GeneratorCallback>;
+export default agentcoreGatewayGatewayConnectionGenerator;

package/src/agentcore-gateway/gateway-connection/generator.js

@@ -0,0 +1,103 @@
+/**
+ * Copyright Amazon.com, Inc. or its affiliates. All Rights Reserved.
+ * SPDX-License-Identifier: Apache-2.0
+ */ import { formatFilesInSubtree } from "../../utils/format.js";
+import { installDependencies } from "../../utils/install.js";
+import { addGeneratorMetricsIfApplicable } from "../../utils/metrics.js";
+import { kebabCase } from "../../utils/names.js";
+import { addComponentGeneratorMetadata, getGeneratorInfo, readProjectConfigurationUnqualified } from "../../utils/nx.js";
+import { attachUpstreamToLocalGateway } from "../attach-upstream.js";
+import { AGENTCORE_GATEWAY_GENERATOR_INFO, readAgentCoreGatewayMetadata } from "../generator.js";
+export const AGENTCORE_GATEWAY_GATEWAY_CONNECTION_GENERATOR_INFO = getGeneratorInfo(import.meta.filename);
+/**
+ * Connect an AgentCore Gateway to another AgentCore Gateway.
+ *
+ * Chains the source gateway's dev target to the target gateway's
+ * dev target, and registers the target gateway in the source
+ * gateway's local local-dev.ts so the local gateway aggregates its tools
+ * (already prefixed by the target gateway) under
+ * `<targetGateway>___<targetName>___<toolName>`. Users must still call
+ * `gateway.addGateway(...)` in their application stack to create the
+ * actual CDK/Terraform resource.
+ */ export const agentcoreGatewayGatewayConnectionGenerator = async (tree, options)=>{
+    const sourceProject = readProjectConfigurationUnqualified(tree, options.sourceProject);
+    const targetProject = readProjectConfigurationUnqualified(tree, options.targetProject);
+    const sourceGateway = readAgentCoreGatewayMetadata(sourceProject);
+    const targetGateway = readAgentCoreGatewayMetadata(targetProject);
+    if (sourceProject.name === targetProject.name) {
+        throw new Error(`Cannot connect gateway '${sourceGateway.name}' to itself.`);
+    }
+    for (const gateway of [
+        sourceGateway,
+        targetGateway
+    ]){
+        if (gateway.protocol !== 'mcp') {
+            throw new Error(`Gateway '${gateway.name}' has protocol='${gateway.protocol}'. Gateway->Gateway connections are only supported between MCP-protocol gateways.`);
+        }
+    }
+    // The source gateway invokes the target signing with its own IAM role, so
+    // only the target's inbound auth must be IAM. The source's inbound auth (how
+    // its own callers reach it) is irrelevant to this hop.
+    if (targetGateway.auth !== 'iam') {
+        throw new Error(`Gateway '${targetGateway.name}' uses auth='${targetGateway.auth}'. Gateway->Gateway connections currently require the target gateway to use IAM authentication.`);
+    }
+    assertNoCycle(tree, sourceProject.name, targetProject.name);
+    // The target name must match the deployed Gateway target (`gatewayName` on
+    // the gateway construct, the project's class name in kebab-case) so
+    // `<targetGateway>___<target>___<tool>` resolves identically locally and
+    // deployed.
+    const targetGatewayKebabCase = kebabCase(targetGateway.rc);
+    await attachUpstreamToLocalGateway(tree, sourceProject, 'dev', {
+        targetName: targetGatewayKebabCase,
+        port: targetGateway.port,
+        upstreamProjectName: targetProject.name,
+        upstreamDevTargetName: 'dev'
+    });
+    // Recorded so the version sync can identify this connection.
+    addComponentGeneratorMetadata(tree, sourceProject.name, AGENTCORE_GATEWAY_GATEWAY_CONNECTION_GENERATOR_INFO, targetProject.root, targetGatewayKebabCase);
+    await addGeneratorMetricsIfApplicable(tree, [
+        AGENTCORE_GATEWAY_GATEWAY_CONNECTION_GENERATOR_INFO
+    ]);
+    await formatFilesInSubtree(tree);
+    return ()=>installDependencies(tree, options.preferInstallDependencies, {
+            languages: [
+                'typescript'
+            ]
+        });
+};
+/**
+ * Reject connections that would make the local gateway graph cyclic — a
+ * cycle would recurse infinitely on tools/list both locally and deployed.
+ *
+ * Walks gateway dev dependsOn edges from the target gateway; the
+ * source gateway must not be reachable.
+ */ const assertNoCycle = (tree, sourceProjectName, targetProjectName)=>{
+    const visited = new Set();
+    const stack = [
+        targetProjectName
+    ];
+    while(stack.length > 0){
+        const current = stack.pop();
+        if (current === sourceProjectName) {
+            throw new Error(`Connecting '${sourceProjectName}' to '${targetProjectName}' would create a cycle: '${targetProjectName}' already routes to '${sourceProjectName}'.`);
+        }
+        if (visited.has(current)) {
+            continue;
+        }
+        visited.add(current);
+        const project = readProjectConfigurationUnqualified(tree, current);
+        if (project.metadata?.generator !== AGENTCORE_GATEWAY_GENERATOR_INFO.id) {
+            continue;
+        }
+        readAgentCoreGatewayMetadata(project);
+        const devTarget = project.targets?.['dev'];
+        for (const dep of devTarget?.dependsOn ?? []){
+            if (typeof dep !== 'string') {
+                stack.push(...dep.projects ?? []);
+            }
+        }
+    }
+};
+export default agentcoreGatewayGatewayConnectionGenerator;
+
+//# sourceMappingURL=generator.js.map

package/src/agentcore-gateway/gateway-connection/generator.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../../../../../../packages/nx-plugin/src/agentcore-gateway/gateway-connection/generator.ts"],"sourcesContent":["/**\n * Copyright Amazon.com, Inc. or its affiliates. All Rights Reserved.\n * SPDX-License-Identifier: Apache-2.0\n */\nimport type { GeneratorCallback, Tree } from '@nx/devkit';\nimport { formatFilesInSubtree } from '../../utils/format';\nimport { installDependencies } from '../../utils/install';\nimport { addGeneratorMetricsIfApplicable } from '../../utils/metrics';\nimport { kebabCase } from '../../utils/names';\nimport {\n  addComponentGeneratorMetadata,\n  getGeneratorInfo,\n  type NxGeneratorInfo,\n  readProjectConfigurationUnqualified,\n} from '../../utils/nx';\nimport { attachUpstreamToLocalGateway } from '../attach-upstream';\nimport {\n  AGENTCORE_GATEWAY_GENERATOR_INFO,\n  readAgentCoreGatewayMetadata,\n} from '../generator';\nimport type { AgentcoreGatewayGatewayConnectionGeneratorSchema } from './schema';\n\nexport const AGENTCORE_GATEWAY_GATEWAY_CONNECTION_GENERATOR_INFO: NxGeneratorInfo =\n  getGeneratorInfo(import.meta.filename);\n\n/**\n * Connect an AgentCore Gateway to another AgentCore Gateway.\n *\n * Chains the source gateway's dev target to the target gateway's\n * dev target, and registers the target gateway in the source\n * gateway's local local-dev.ts so the local gateway aggregates its tools\n * (already prefixed by the target gateway) under\n * `<targetGateway>___<targetName>___<toolName>`. Users must still call\n * `gateway.addGateway(...)` in their application stack to create the\n * actual CDK/Terraform resource.\n */\nexport const agentcoreGatewayGatewayConnectionGenerator = async (\n  tree: Tree,\n  options: AgentcoreGatewayGatewayConnectionGeneratorSchema,\n): Promise<GeneratorCallback> => {\n  const sourceProject = readProjectConfigurationUnqualified(\n    tree,\n    options.sourceProject,\n  );\n  const targetProject = readProjectConfigurationUnqualified(\n    tree,\n    options.targetProject,\n  );\n\n  const sourceGateway = readAgentCoreGatewayMetadata(sourceProject);\n  const targetGateway = readAgentCoreGatewayMetadata(targetProject);\n\n  if (sourceProject.name === targetProject.name) {\n    throw new Error(\n      `Cannot connect gateway '${sourceGateway.name}' to itself.`,\n    );\n  }\n\n  for (const gateway of [sourceGateway, targetGateway]) {\n    if (gateway.protocol !== 'mcp') {\n      throw new Error(\n        `Gateway '${gateway.name}' has protocol='${gateway.protocol}'. Gateway->Gateway connections are only supported between MCP-protocol gateways.`,\n      );\n    }\n  }\n\n  // The source gateway invokes the target signing with its own IAM role, so\n  // only the target's inbound auth must be IAM. The source's inbound auth (how\n  // its own callers reach it) is irrelevant to this hop.\n  if (targetGateway.auth !== 'iam') {\n    throw new Error(\n      `Gateway '${targetGateway.name}' uses auth='${targetGateway.auth}'. Gateway->Gateway connections currently require the target gateway to use IAM authentication.`,\n    );\n  }\n\n  assertNoCycle(tree, sourceProject.name, targetProject.name);\n\n  // The target name must match the deployed Gateway target (`gatewayName` on\n  // the gateway construct, the project's class name in kebab-case) so\n  // `<targetGateway>___<target>___<tool>` resolves identically locally and\n  // deployed.\n  const targetGatewayKebabCase = kebabCase(targetGateway.rc);\n\n  await attachUpstreamToLocalGateway(tree, sourceProject, 'dev', {\n    targetName: targetGatewayKebabCase,\n    port: targetGateway.port,\n    upstreamProjectName: targetProject.name,\n    upstreamDevTargetName: 'dev',\n  });\n\n  // Recorded so the version sync can identify this connection.\n  addComponentGeneratorMetadata(\n    tree,\n    sourceProject.name,\n    AGENTCORE_GATEWAY_GATEWAY_CONNECTION_GENERATOR_INFO,\n    targetProject.root,\n    targetGatewayKebabCase,\n  );\n\n  await addGeneratorMetricsIfApplicable(tree, [\n    AGENTCORE_GATEWAY_GATEWAY_CONNECTION_GENERATOR_INFO,\n  ]);\n\n  await formatFilesInSubtree(tree);\n\n  return () =>\n    installDependencies(tree, options.preferInstallDependencies, {\n      languages: ['typescript'],\n    });\n};\n\n/**\n * Reject connections that would make the local gateway graph cyclic — a\n * cycle would recurse infinitely on tools/list both locally and deployed.\n *\n * Walks gateway dev dependsOn edges from the target gateway; the\n * source gateway must not be reachable.\n */\nconst assertNoCycle = (\n  tree: Tree,\n  sourceProjectName: string,\n  targetProjectName: string,\n) => {\n  const visited = new Set<string>();\n  const stack = [targetProjectName];\n  while (stack.length > 0) {\n    const current = stack.pop();\n    if (current === sourceProjectName) {\n      throw new Error(\n        `Connecting '${sourceProjectName}' to '${targetProjectName}' would create a cycle: '${targetProjectName}' already routes to '${sourceProjectName}'.`,\n      );\n    }\n    if (visited.has(current)) {\n      continue;\n    }\n    visited.add(current);\n    const project = readProjectConfigurationUnqualified(tree, current);\n    if (\n      (project.metadata as any)?.generator !==\n      AGENTCORE_GATEWAY_GENERATOR_INFO.id\n    ) {\n      continue;\n    }\n    readAgentCoreGatewayMetadata(project);\n    const devTarget = project.targets?.['dev'];\n    for (const dep of devTarget?.dependsOn ?? []) {\n      if (typeof dep !== 'string') {\n        stack.push(...(dep.projects ?? []));\n      }\n    }\n  }\n};\n\nexport default agentcoreGatewayGatewayConnectionGenerator;\n"],"names":["formatFilesInSubtree","installDependencies","addGeneratorMetricsIfApplicable","kebabCase","addComponentGeneratorMetadata","getGeneratorInfo","readProjectConfigurationUnqualified","attachUpstreamToLocalGateway","AGENTCORE_GATEWAY_GENERATOR_INFO","readAgentCoreGatewayMetadata","AGENTCORE_GATEWAY_GATEWAY_CONNECTION_GENERATOR_INFO","filename","agentcoreGatewayGatewayConnectionGenerator","tree","options","sourceProject","targetProject","sourceGateway","targetGateway","name","Error","gateway","protocol","auth","assertNoCycle","targetGatewayKebabCase","rc","targetName","port","upstreamProjectName","upstreamDevTargetName","root","preferInstallDependencies","languages","sourceProjectName","targetProjectName","visited","Set","stack","length","current","pop","has","add","project","metadata","generator","id","devTarget","targets","dep","dependsOn","push","projects"],"mappings":"AAAA;;;CAGC,GAED,SAASA,oBAAoB,QAAQ,wBAAqB;AAC1D,SAASC,mBAAmB,QAAQ,yBAAsB;AAC1D,SAASC,+BAA+B,QAAQ,yBAAsB;AACtE,SAASC,SAAS,QAAQ,uBAAoB;AAC9C,SACEC,6BAA6B,EAC7BC,gBAAgB,EAEhBC,mCAAmC,QAC9B,oBAAiB;AACxB,SAASC,4BAA4B,QAAQ,wBAAqB;AAClE,SACEC,gCAAgC,EAChCC,4BAA4B,QACvB,kBAAe;AAGtB,OAAO,MAAMC,sDACXL,iBAAiB,YAAYM,QAAQ,EAAE;AAEzC;;;;;;;;;;CAUC,GACD,OAAO,MAAMC,6CAA6C,OACxDC,MACAC;IAEA,MAAMC,gBAAgBT,oCACpBO,MACAC,QAAQC,aAAa;IAEvB,MAAMC,gBAAgBV,oCACpBO,MACAC,QAAQE,aAAa;IAGvB,MAAMC,gBAAgBR,6BAA6BM;IACnD,MAAMG,gBAAgBT,6BAA6BO;IAEnD,IAAID,cAAcI,IAAI,KAAKH,cAAcG,IAAI,EAAE;QAC7C,MAAM,IAAIC,MACR,CAAC,wBAAwB,EAAEH,cAAcE,IAAI,CAAC,YAAY,CAAC;IAE/D;IAEA,KAAK,MAAME,WAAW;QAACJ;QAAeC;KAAc,CAAE;QACpD,IAAIG,QAAQC,QAAQ,KAAK,OAAO;YAC9B,MAAM,IAAIF,MACR,CAAC,SAAS,EAAEC,QAAQF,IAAI,CAAC,gBAAgB,EAAEE,QAAQC,QAAQ,CAAC,iFAAiF,CAAC;QAElJ;IACF;IAEA,0EAA0E;IAC1E,6EAA6E;IAC7E,uDAAuD;IACvD,IAAIJ,cAAcK,IAAI,KAAK,OAAO;QAChC,MAAM,IAAIH,MACR,CAAC,SAAS,EAAEF,cAAcC,IAAI,CAAC,aAAa,EAAED,cAAcK,IAAI,CAAC,+FAA+F,CAAC;IAErK;IAEAC,cAAcX,MAAME,cAAcI,IAAI,EAAEH,cAAcG,IAAI;IAE1D,2EAA2E;IAC3E,oEAAoE;IACpE,yEAAyE;IACzE,YAAY;IACZ,MAAMM,yBAAyBtB,UAAUe,cAAcQ,EAAE;IAEzD,MAAMnB,6BAA6BM,MAAME,eAAe,OAAO;QAC7DY,YAAYF;QACZG,MAAMV,cAAcU,IAAI;QACxBC,qBAAqBb,cAAcG,IAAI;QACvCW,uBAAuB;IACzB;IAEA,6DAA6D;IAC7D1B,8BACES,MACAE,cAAcI,IAAI,EAClBT,qDACAM,cAAce,IAAI,EAClBN;IAGF,MAAMvB,gCAAgCW,MAAM;QAC1CH;KACD;IAED,MAAMV,qBAAqBa;IAE3B,OAAO,IACLZ,oBAAoBY,MAAMC,QAAQkB,yBAAyB,EAAE;YAC3DC,WAAW;gBAAC;aAAa;QAC3B;AACJ,EAAE;AAEF;;;;;;CAMC,GACD,MAAMT,gBAAgB,CACpBX,MACAqB,mBACAC;IAEA,MAAMC,UAAU,IAAIC;IACpB,MAAMC,QAAQ;QAACH;KAAkB;IACjC,MAAOG,MAAMC,MAAM,GAAG,EAAG;QACvB,MAAMC,UAAUF,MAAMG,GAAG;QACzB,IAAID,YAAYN,mBAAmB;YACjC,MAAM,IAAId,MACR,CAAC,YAAY,EAAEc,kBAAkB,MAAM,EAAEC,kBAAkB,yBAAyB,EAAEA,kBAAkB,qBAAqB,EAAED,kBAAkB,EAAE,CAAC;QAExJ;QACA,IAAIE,QAAQM,GAAG,CAACF,UAAU;YACxB;QACF;QACAJ,QAAQO,GAAG,CAACH;QACZ,MAAMI,UAAUtC,oCAAoCO,MAAM2B;QAC1D,IACE,AAACI,QAAQC,QAAQ,EAAUC,cAC3BtC,iCAAiCuC,EAAE,EACnC;YACA;QACF;QACAtC,6BAA6BmC;QAC7B,MAAMI,YAAYJ,QAAQK,OAAO,EAAE,CAAC,MAAM;QAC1C,KAAK,MAAMC,OAAOF,WAAWG,aAAa,EAAE,CAAE;YAC5C,IAAI,OAAOD,QAAQ,UAAU;gBAC3BZ,MAAMc,IAAI,IAAKF,IAAIG,QAAQ,IAAI,EAAE;YACnC;QACF;IACF;AACF;AAEA,eAAezC,2CAA2C"}

package/src/agentcore-gateway/gateway-connection/schema.d.js

@@ -0,0 +1,6 @@
+/**
+ * Copyright Amazon.com, Inc. or its affiliates. All Rights Reserved.
+ * SPDX-License-Identifier: Apache-2.0
+ */ export { };
+
+//# sourceMappingURL=schema.d.js.map

package/src/agentcore-gateway/gateway-connection/schema.d.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../../../../../../packages/nx-plugin/src/agentcore-gateway/gateway-connection/schema.d.ts"],"sourcesContent":["/**\n * Copyright Amazon.com, Inc. or its affiliates. All Rights Reserved.\n * SPDX-License-Identifier: Apache-2.0\n */\nimport type { ComponentMetadata } from '../../utils/nx';\n\nexport interface AgentcoreGatewayGatewayConnectionGeneratorSchema {\n  sourceProject: string;\n  targetProject: string;\n  sourceComponent?: ComponentMetadata;\n  targetComponent?: ComponentMetadata;\n  preferInstallDependencies?: boolean;\n}\n"],"names":[],"mappings":"AAAA;;;CAGC,GAGD,WAMC"}

package/src/agentcore-gateway/gateway-connection/schema.d.ts

@@ -0,0 +1,13 @@
+/**
+ * Copyright Amazon.com, Inc. or its affiliates. All Rights Reserved.
+ * SPDX-License-Identifier: Apache-2.0
+ */
+import type { ComponentMetadata } from '../../utils/nx';
+
+export interface AgentcoreGatewayGatewayConnectionGeneratorSchema {
+  sourceProject: string;
+  targetProject: string;
+  sourceComponent?: ComponentMetadata;
+  targetComponent?: ComponentMetadata;
+  preferInstallDependencies?: boolean;
+}

package/src/agentcore-gateway/gateway-connection/schema.json

@@ -0,0 +1,31 @@
+{
+  "$schema": "https://json-schema.org/schema",
+  "$id": "agentcore-gateway#gateway-connection",
+  "title": "agentcore-gateway#gateway-connection",
+  "description": "Connect an AgentCore Gateway to another AgentCore Gateway",
+  "type": "object",
+  "properties": {
+    "sourceProject": {
+      "type": "string",
+      "description": "The gateway project to add the target gateway to"
+    },
+    "targetProject": {
+      "type": "string",
+      "description": "The gateway project to register as a target"
+    },
+    "sourceComponent": {
+      "type": "string",
+      "description": "The gateway component in the source project"
+    },
+    "targetComponent": {
+      "type": "string",
+      "description": "The gateway component in the target project"
+    },
+    "preferInstallDependencies": {
+      "type": "boolean",
+      "description": "Whether to prefer installing dependencies after the generator runs. Set to false to defer installing when batching multiple generators (an install still runs if needed so subsequent generators can compute the Nx project graph); install once at the end.",
+      "default": true
+    }
+  },
+  "required": ["sourceProject", "targetProject"]
+}

package/src/agentcore-gateway/generator.d.ts

@@ -0,0 +1,89 @@
+/**
+ * Copyright Amazon.com, Inc. or its affiliates. All Rights Reserved.
+ * SPDX-License-Identifier: Apache-2.0
+ */
+import { type GeneratorCallback, type ProjectConfiguration, type Tree } from '@nx/devkit';
+import { type NxGeneratorInfo } from '../utils/nx';
+import type { IacMetadata } from '../utils/shared-constructs-constants';
+import type { AgentcoreGatewayGeneratorSchema } from './schema';
+export declare const DEPENDENCIES: import("../utils/declared-dependencies").DependencyDeclaration<readonly [{
+    readonly name: "@modelcontextprotocol/sdk";
+    readonly when: (m: AgentCoreGatewayMetadata) => boolean;
+}, {
+    readonly name: "express";
+}, {
+    readonly name: "@types/express";
+    readonly dev: true;
+}, {
+    readonly name: "ejs";
+    readonly dev: true;
+}, {
+    readonly name: "@types/ejs";
+    readonly dev: true;
+}, {
+    readonly name: "tsx";
+    readonly dev: true;
+    readonly root: true;
+}, {
+    readonly name: "ejs";
+    readonly when: (m: IacMetadata) => boolean;
+} & {
+    versionOnly: true;
+}, {
+    readonly name: "@aws-sdk/client-bedrock-agentcore";
+    readonly when: (m: IacMetadata) => boolean;
+} & {
+    versionOnly: true;
+}, {
+    readonly name: "@types/ejs";
+    readonly when: (m: IacMetadata) => boolean;
+} & {
+    versionOnly: true;
+}, {
+    readonly name: "constructs";
+    readonly when: (m: IacMetadata) => boolean;
+} & {
+    versionOnly: true;
+}, {
+    readonly name: "aws-cdk-lib";
+    readonly when: (m: IacMetadata) => boolean;
+} & {
+    versionOnly: true;
+}, {
+    readonly name: "@types/node";
+} & {
+    versionOnly: true;
+}], readonly [{
+    readonly name: "boto3";
+    readonly when: (m: IacMetadata) => boolean;
+} & {
+    versionOnly: true;
+}, {
+    readonly name: "httpx";
+    readonly when: (m: IacMetadata) => boolean;
+} & {
+    versionOnly: true;
+}, {
+    readonly name: "mcp";
+    readonly when: (m: IacMetadata) => boolean;
+} & {
+    versionOnly: true;
+}]>;
+export declare const AGENTCORE_GATEWAY_GENERATOR_INFO: NxGeneratorInfo;
+export declare const agentcoreGatewayGenerator: (tree: Tree, options: AgentcoreGatewayGeneratorSchema) => Promise<GeneratorCallback>;
+/**
+ * Gateway details stored in the gateway project's metadata.
+ */
+export interface AgentCoreGatewayMetadata extends IacMetadata {
+    name: string;
+    rc: string;
+    protocol: string;
+    auth: string;
+    port: number;
+}
+/**
+ * Read a gateway project's metadata, validating it was generated by the
+ * agentcore-gateway generator.
+ */
+export declare const readAgentCoreGatewayMetadata: (project: ProjectConfiguration) => AgentCoreGatewayMetadata;
+export default agentcoreGatewayGenerator;