@aws/nx-plugin 1.0.0-rc.71 → 1.0.0-rc.72

package/src/utils/agent-connection/files/py-core-strands/base/tool_errors_strands.py.template

@@ -0,0 +1,24 @@
+import logging
+
+from strands.hooks import AfterToolCallEvent, HookRegistry
+
+logger = logging.getLogger(__name__)
+
+
+class _LogToolErrors:
+    def register_hooks(self, registry: HookRegistry, **_kwargs) -> None:
+        registry.add_callback(AfterToolCallEvent, self._on_after_tool_call)
+
+    @staticmethod
+    def _on_after_tool_call(event: AfterToolCallEvent) -> None:
+        tool_name = event.tool_use.get("name", "<unknown>")
+        if event.exception is not None:
+            logger.error("Tool '%s' failed: %s", tool_name, event.exception)
+            return
+        if event.result.get("status") != "error":
+            return
+        message = " ".join(block["text"] for block in event.result.get("content", []) if "text" in block)
+        logger.error("Tool '%s' failed%s", tool_name, f": {message}" if message else "")
+
+
+log_tool_errors = _LogToolErrors()

package/src/utils/agent-core-constructs/agent-core-constructs.d.ts

@@ -45,7 +45,7 @@ export declare const AGENT_CORE_CONSTRUCTS_PY_DEPENDENCIES: readonly [{
     readonly when: (m: IacMetadata) => boolean;
 }];
 export type AgentCoreAuth = 'iam' | 'cognito';
-export type AgentCoreSession = 's3' | 'in-memory';
+export type AgentCoreSession = 's3' | 'dynamodb-s3' | 'in-memory';
 export interface AddAgentCoreInfraProps {
     nameClassName: string;
     nameKebabCase: string;

package/src/utils/agent-core-constructs/agent-core-constructs.js.map

@@ -1 +1 @@
-{"version":3,"sources":["../../../../../../packages/nx-plugin/src/utils/agent-core-constructs/agent-core-constructs.ts"],"sourcesContent":["/**\n * Copyright Amazon.com, Inc. or its affiliates. All Rights Reserved.\n * SPDX-License-Identifier: Apache-2.0\n */\nimport {\n  generateFiles,\n  joinPathFragments,\n  OverwriteStrategy,\n  type ProjectConfiguration,\n  type Tree,\n  updateJson,\n} from '@nx/devkit';\nimport { addStarExport } from '../ast';\nimport type { Containers } from '../containers';\nimport {\n  type DeclaredPyDependency,\n  type DeclaredTsDependency,\n  type DependencyDeclaration,\n  forDependencies,\n  type MustDeclare,\n} from '../declared-dependencies';\nimport { addDependenciesToPackageJson } from '../dependencies';\nimport type { Iac } from '../iac';\nimport { esmVars } from '../module-format';\nimport { addDependencyToTargetIfNotPresent } from '../nx';\nimport {\n  generatedInfrastructure,\n  generatedTerraform,\n  type IacMetadata,\n  PACKAGES_DIR,\n  SHARED_CONSTRUCTS_DIR,\n  SHARED_TERRAFORM_DIR,\n} from '../shared-constructs-constants';\nimport {\n  type IPyDepVersion,\n  type ITsDepVersion,\n  PY_VERSIONS,\n  terraformProviderVersions,\n  withVersions,\n} from '../versions';\n\ntype IACProvider = { iac: Iac };\n\n/**\n * Dependencies a caller must declare to add an AgentCore Gateway construct.\n *\n * Gated on infrastructure having been generated, since the construct helpers only\n * run on that branch.\n */\nexport const AGENT_CORE_CONSTRUCTS_DEPENDENCIES = [\n  { name: 'ejs', when: generatedInfrastructure },\n  { name: '@aws-sdk/client-bedrock-agentcore', when: generatedInfrastructure },\n  { name: '@types/ejs', when: generatedInfrastructure },\n] as const satisfies readonly DeclaredTsDependency<\n  ITsDepVersion,\n  IacMetadata\n>[];\n\n/**\n * Python versions the generated Terraform pins in an inline `uv run --with`\n * script, rather than in any `pyproject.toml`.\n *\n * Spread through `ownedElsewhere` because nothing installs them into the\n * workspace — the pin is owned so the version sync keeps it current, and gated on\n * Terraform since the CDK branch writes no such script.\n */\nexport const AGENT_CORE_CONSTRUCTS_PY_DEPENDENCIES = [\n  { name: 'boto3', when: generatedTerraform },\n  { name: 'httpx', when: generatedTerraform },\n  { name: 'mcp', when: generatedTerraform },\n] as const satisfies readonly DeclaredPyDependency<\n  IPyDepVersion,\n  IacMetadata\n>[];\n\nexport type AgentCoreAuth = 'iam' | 'cognito';\n\nexport type AgentCoreSession = 's3' | 'in-memory';\n\nexport interface AddAgentCoreInfraProps {\n  nameClassName: string;\n  nameKebabCase: string;\n  projectName: string;\n  dockerImageTag: string;\n  dockerOutputDir: string;\n  appDirectory: string;\n  serverProtocol: 'mcp' | 'http' | 'a2a';\n  auth: AgentCoreAuth;\n  /** How this runtime's session should be persisted. MCP servers have no session, so pass 'in-memory'. */\n  session: AgentCoreSession;\n  containers: Containers;\n}\n\nconst addAgentCoreInfra = async (\n  tree: Tree,\n  options: AddAgentCoreInfraProps & { iac: Iac },\n) => {\n  switch (options.iac) {\n    case 'cdk':\n      await addAgentCoreCDKInfra(tree, options);\n      break;\n    case 'terraform':\n      addAgentCoreTerraformInfra(tree, options);\n      break;\n  }\n\n  // Update shared constructs/terraform project configuration to depend on this project\n  updateJson(\n    tree,\n    joinPathFragments(\n      PACKAGES_DIR,\n      options.iac === 'cdk' ? SHARED_CONSTRUCTS_DIR : SHARED_TERRAFORM_DIR,\n      'project.json',\n    ),\n    (config: ProjectConfiguration) => {\n      addDependencyToTargetIfNotPresent(\n        config,\n        'build',\n        `${options.projectName}:build`,\n      );\n      return config;\n    },\n  );\n};\n\nconst addAgentCoreCDKInfra = async (\n  tree: Tree,\n  options: AddAgentCoreInfraProps,\n) => {\n  // Generate app specific CDK construct\n  generateFiles(\n    tree,\n    joinPathFragments(import.meta.dirname, 'files', 'cdk', 'app', 'agent-core'),\n    joinPathFragments(\n      PACKAGES_DIR,\n      SHARED_CONSTRUCTS_DIR,\n      'src',\n      'app',\n      options.appDirectory,\n    ),\n    { ...options, ...esmVars(tree) },\n    {\n      overwriteStrategy: OverwriteStrategy.KeepExisting,\n    },\n  );\n\n  // Export app specific CDK construct\n  await addStarExport(\n    tree,\n    joinPathFragments(\n      PACKAGES_DIR,\n      SHARED_CONSTRUCTS_DIR,\n      'src',\n      'app',\n      options.appDirectory,\n      'index.ts',\n    ),\n    `./${options.nameKebabCase}/${options.nameKebabCase}.js`,\n  );\n  await addStarExport(\n    tree,\n    joinPathFragments(\n      PACKAGES_DIR,\n      SHARED_CONSTRUCTS_DIR,\n      'src',\n      'app',\n      'index.ts',\n    ),\n    `./${options.appDirectory}/index.js`,\n  );\n};\n\nconst addAgentCoreTerraformInfra = (\n  tree: Tree,\n  options: AddAgentCoreInfraProps,\n) => {\n  // Add the AgentCore shared module\n  generateFiles(\n    tree,\n    joinPathFragments(\n      import.meta.dirname,\n      'files',\n      'terraform',\n      'core',\n      'agent-core',\n    ),\n    joinPathFragments(\n      PACKAGES_DIR,\n      SHARED_TERRAFORM_DIR,\n      'src',\n      'core',\n      'agent-core',\n    ),\n    {\n      containers: options.containers,\n      boto3Version: PY_VERSIONS.boto3,\n      ...terraformProviderVersions(),\n    },\n    {\n      overwriteStrategy: OverwriteStrategy.KeepExisting,\n    },\n  );\n\n  // Generate app specific agent core configuration\n  generateFiles(\n    tree,\n    joinPathFragments(\n      import.meta.dirname,\n      'files',\n      'terraform',\n      'app',\n      'agent-core',\n    ),\n    joinPathFragments(\n      PACKAGES_DIR,\n      SHARED_TERRAFORM_DIR,\n      'src',\n      'app',\n      options.appDirectory,\n    ),\n    { ...options, ...terraformProviderVersions() },\n    {\n      overwriteStrategy: OverwriteStrategy.KeepExisting,\n    },\n  );\n};\n\nexport interface AddMcpServerInfraProps {\n  mcpServerNameClassName: string;\n  mcpServerNameKebabCase: string;\n  projectName: string;\n  dockerImageTag: string;\n  dockerOutputDir: string;\n  auth: AgentCoreAuth;\n  containers: Containers;\n}\n\n/**\n * Add an MCP server CDK construct\n */\nexport const addMcpServerInfra = async (\n  tree: Tree,\n  options: AddMcpServerInfraProps & IACProvider,\n) => {\n  await addAgentCoreInfra(tree, {\n    nameClassName: options.mcpServerNameClassName,\n    nameKebabCase: options.mcpServerNameKebabCase,\n    dockerImageTag: options.dockerImageTag,\n    dockerOutputDir: options.dockerOutputDir,\n    projectName: options.projectName,\n    appDirectory: 'mcp-servers',\n    serverProtocol: 'mcp',\n    iac: options.iac,\n    auth: options.auth,\n    // MCP servers are stateless (no conversation session to persist).\n    session: 'in-memory',\n    containers: options.containers,\n  });\n};\n\nexport interface AddAgentInfraProps {\n  agentNameClassName: string;\n  agentNameKebabCase: string;\n  projectName: string;\n  dockerImageTag: string;\n  dockerOutputDir: string;\n  auth: AgentCoreAuth;\n  session: AgentCoreSession;\n  serverProtocol?: 'http' | 'a2a';\n  containers: Containers;\n}\n\n/**\n * Add an agent CDK construct\n */\nexport const addAgentInfra = async (\n  tree: Tree,\n  options: AddAgentInfraProps & IACProvider,\n) => {\n  await addAgentCoreInfra(tree, {\n    nameClassName: options.agentNameClassName,\n    nameKebabCase: options.agentNameKebabCase,\n    projectName: options.projectName,\n    dockerImageTag: options.dockerImageTag,\n    dockerOutputDir: options.dockerOutputDir,\n    appDirectory: 'agents',\n    session: options.session,\n    serverProtocol: options.serverProtocol ?? 'http',\n    iac: options.iac,\n    auth: options.auth,\n    containers: options.containers,\n  });\n};\n\nexport interface AddAgentCoreGatewayInfraProps {\n  gatewayNameClassName: string;\n  gatewayNameKebabCase: string;\n  projectName: string;\n  projectDirectory: string;\n  cedarPolicy: boolean;\n  auth: AgentCoreAuth;\n  /**\n   * The gateway's protocol: mcp aggregates MCP server targets, http proxies\n   * agent runtime targets via path-based routing.\n   */\n  protocol: 'mcp' | 'http';\n}\n\nexport const addAgentCoreGatewayInfra = async <\n  const D extends DependencyDeclaration,\n>(\n  tree: Tree,\n  options: AddAgentCoreGatewayInfraProps & IACProvider,\n  declaration: D & MustDeclare<typeof AGENT_CORE_CONSTRUCTS_DEPENDENCIES, D>,\n) => {\n  switch (options.iac) {\n    case 'cdk':\n      await addAgentCoreGatewayCDKInfra(tree, options, declaration);\n      break;\n    case 'terraform':\n      addAgentCoreGatewayTerraformInfra(tree, options);\n      break;\n  }\n\n  updateJson(\n    tree,\n    joinPathFragments(\n      PACKAGES_DIR,\n      options.iac === 'cdk' ? SHARED_CONSTRUCTS_DIR : SHARED_TERRAFORM_DIR,\n      'project.json',\n    ),\n    (config: ProjectConfiguration) => {\n      addDependencyToTargetIfNotPresent(\n        config,\n        'build',\n        `${options.projectName}:build`,\n      );\n      return config;\n    },\n  );\n};\n\nconst addAgentCoreGatewayCDKInfra = async (\n  tree: Tree,\n  options: AddAgentCoreGatewayInfraProps,\n  declaration: DependencyDeclaration,\n) => {\n  // Generic gateway construct (readiness probe, policy engine, Cedar policy\n  // loading) shared by all gateways\n  generateFiles(\n    tree,\n    joinPathFragments(\n      import.meta.dirname,\n      'files',\n      'cdk',\n      'core',\n      'agentcore-gateway',\n    ),\n    joinPathFragments(\n      PACKAGES_DIR,\n      SHARED_CONSTRUCTS_DIR,\n      'src',\n      'core',\n      'agentcore-gateway',\n    ),\n    { ...esmVars(tree) },\n    {\n      overwriteStrategy: OverwriteStrategy.KeepExisting,\n    },\n  );\n\n  generateFiles(\n    tree,\n    joinPathFragments(\n      import.meta.dirname,\n      'files',\n      'cdk',\n      'app',\n      'agentcore-gateway',\n    ),\n    joinPathFragments(\n      PACKAGES_DIR,\n      SHARED_CONSTRUCTS_DIR,\n      'src',\n      'app',\n      'gateways',\n    ),\n    {\n      nameClassName: options.gatewayNameClassName,\n      nameKebabCase: options.gatewayNameKebabCase,\n      projectDirectory: options.projectDirectory,\n      cedarPolicy: options.cedarPolicy,\n      auth: options.auth,\n      protocol: options.protocol,\n      ...esmVars(tree),\n    },\n    {\n      overwriteStrategy: OverwriteStrategy.KeepExisting,\n    },\n  );\n\n  await addStarExport(\n    tree,\n    joinPathFragments(\n      PACKAGES_DIR,\n      SHARED_CONSTRUCTS_DIR,\n      'src',\n      'core',\n      'index.ts',\n    ),\n    './agentcore-gateway/agentcore-gateway.js',\n  );\n  await addStarExport(\n    tree,\n    joinPathFragments(\n      PACKAGES_DIR,\n      SHARED_CONSTRUCTS_DIR,\n      'src',\n      'app',\n      'gateways',\n      'index.ts',\n    ),\n    `./${options.gatewayNameKebabCase}/${options.gatewayNameKebabCase}.js`,\n  );\n  await addStarExport(\n    tree,\n    joinPathFragments(\n      PACKAGES_DIR,\n      SHARED_CONSTRUCTS_DIR,\n      'src',\n      'app',\n      'index.ts',\n    ),\n    './gateways/index.js',\n  );\n\n  // The gateway construct renders Cedar policies with ejs and its readiness\n  // probe uses the AgentCore SDK client; declare both so the lint passes.\n  addDependenciesToPackageJson(\n    tree,\n    withVersions(\n      forDependencies<typeof AGENT_CORE_CONSTRUCTS_DEPENDENCIES>(declaration),\n      ['ejs', '@aws-sdk/client-bedrock-agentcore'],\n    ),\n    withVersions(\n      forDependencies<typeof AGENT_CORE_CONSTRUCTS_DEPENDENCIES>(declaration),\n      ['@types/ejs'],\n    ),\n    joinPathFragments(PACKAGES_DIR, SHARED_CONSTRUCTS_DIR, 'package.json'),\n  );\n};\n\nconst addAgentCoreGatewayTerraformInfra = (\n  tree: Tree,\n  options: AddAgentCoreGatewayInfraProps,\n) => {\n  generateFiles(\n    tree,\n    joinPathFragments(\n      import.meta.dirname,\n      'files',\n      'terraform',\n      'core',\n      'agentcore-gateway',\n    ),\n    joinPathFragments(\n      PACKAGES_DIR,\n      SHARED_TERRAFORM_DIR,\n      'src',\n      'core',\n      'agentcore-gateway',\n    ),\n    { ...terraformProviderVersions() },\n    {\n      overwriteStrategy: OverwriteStrategy.KeepExisting,\n    },\n  );\n\n  generateFiles(\n    tree,\n    joinPathFragments(\n      import.meta.dirname,\n      'files',\n      'terraform',\n      'app',\n      'agentcore-gateway',\n    ),\n    joinPathFragments(\n      PACKAGES_DIR,\n      SHARED_TERRAFORM_DIR,\n      'src',\n      'app',\n      'gateways',\n    ),\n    {\n      nameClassName: options.gatewayNameClassName,\n      nameKebabCase: options.gatewayNameKebabCase,\n      projectDirectory: options.projectDirectory,\n      cedarPolicy: options.cedarPolicy,\n      auth: options.auth,\n      protocol: options.protocol,\n      boto3Version: PY_VERSIONS.boto3,\n      httpxVersion: PY_VERSIONS.httpx,\n      mcpVersion: PY_VERSIONS.mcp,\n      ...terraformProviderVersions(),\n    },\n    {\n      overwriteStrategy: OverwriteStrategy.KeepExisting,\n    },\n  );\n\n  // The Cedar render script is only needed when policies are enabled\n  if (!options.cedarPolicy) {\n    const renderScript = joinPathFragments(\n      PACKAGES_DIR,\n      SHARED_TERRAFORM_DIR,\n      'src',\n      'app',\n      'gateways',\n      options.gatewayNameKebabCase,\n      'render-cedar.cjs',\n    );\n    if (tree.exists(renderScript)) {\n      tree.delete(renderScript);\n    }\n  }\n};\n\nexport interface AddAgentCoreHarnessInfraProps {\n  harnessNameClassName: string;\n  harnessNameKebabCase: string;\n  /**\n   * Workspace-root-relative harness project root, eg `packages/my-harness`.\n   * The `src/PROMPT.md` path both templates read is derived from it.\n   */\n  projectRoot: string;\n  /** Leading-letter-guaranteed, 31-char-truncated resource name prefix. */\n  harnessNamePrefix: string;\n}\n\n/**\n * Template substitution context shared by the CDK and Terraform harness\n * branches. Both prompt path fields carry the same workspace-root-relative\n * path, named per provider so each template's usage reads on its own.\n */\ninterface HarnessTemplateContext {\n  nameClassName: string;\n  nameKebabCase: string;\n  harnessNamePrefix: string;\n  /** Joined onto `findWorkspaceRoot()` in the CDK construct. */\n  promptPathFromCdk: string;\n  /** Appended to the `path.module` walk to the workspace root in Terraform. */\n  promptPathFromTerraform: string;\n}\n\n/**\n * Add AgentCore Harness infrastructure for the selected IaC provider.\n *\n * Renders the provider-specific Harness infrastructure (a CDK construct or\n * a Terraform module) into the Shared Infrastructure Project with\n * `KeepExisting`, so existing files become user-owned and are never\n * rewritten by reruns.\n *\n * Unlike agents, MCP servers and gateways, no build dependency is added\n * from the shared infrastructure project to the Harness Project: generated\n * Harness infrastructure does not import Harness Project source, so a\n * dependency would only create false rebuild coupling.\n */\nexport const addAgentCoreHarnessInfra = async (\n  tree: Tree,\n  options: AddAgentCoreHarnessInfraProps & IACProvider,\n): Promise<void> => {\n  // One resolved template context, built once and passed to both provider\n  // branches. The prompt path is derived from the same projectRoot the\n  // Harness Project is written to, so explicit placement needs no extra logic.\n  const promptPath = joinPathFragments(options.projectRoot, 'src', 'PROMPT.md');\n  const templateContext: HarnessTemplateContext = {\n    nameClassName: options.harnessNameClassName,\n    nameKebabCase: options.harnessNameKebabCase,\n    harnessNamePrefix: options.harnessNamePrefix,\n    promptPathFromCdk: promptPath,\n    promptPathFromTerraform: promptPath,\n  };\n\n  switch (options.iac) {\n    case 'cdk':\n      await addAgentCoreHarnessCDKInfra(tree, templateContext);\n      break;\n    case 'terraform':\n      addAgentCoreHarnessTerraformInfra(tree, templateContext);\n      break;\n  }\n};\n\nconst addAgentCoreHarnessCDKInfra = async (\n  tree: Tree,\n  templateContext: HarnessTemplateContext,\n) => {\n  // Generate the app specific CDK construct under\n  // src/app/harnesses/<kebab-case-name>/\n  generateFiles(\n    tree,\n    joinPathFragments(\n      import.meta.dirname,\n      'files',\n      'cdk',\n      'app',\n      'agentcore-harness',\n    ),\n    joinPathFragments(\n      PACKAGES_DIR,\n      SHARED_CONSTRUCTS_DIR,\n      'src',\n      'app',\n      'harnesses',\n    ),\n    { ...templateContext, ...esmVars(tree) },\n    {\n      overwriteStrategy: OverwriteStrategy.KeepExisting,\n    },\n  );\n\n  // Export the construct through the harnesses app index and the shared\n  // app index. addStarExport creates a missing index file and semantically\n  // deduplicates equivalent exports on reruns.\n  await addStarExport(\n    tree,\n    joinPathFragments(\n      PACKAGES_DIR,\n      SHARED_CONSTRUCTS_DIR,\n      'src',\n      'app',\n      'harnesses',\n      'index.ts',\n    ),\n    `./${templateContext.nameKebabCase}/${templateContext.nameKebabCase}.js`,\n  );\n  await addStarExport(\n    tree,\n    joinPathFragments(\n      PACKAGES_DIR,\n      SHARED_CONSTRUCTS_DIR,\n      'src',\n      'app',\n      'index.ts',\n    ),\n    './harnesses/index.js',\n  );\n};\n\nconst addAgentCoreHarnessTerraformInfra = (\n  tree: Tree,\n  templateContext: HarnessTemplateContext,\n) => {\n  // Generate the app specific Terraform module under\n  // src/app/harnesses/<kebab-case-name>/. No CDK files or exports are\n  // created on this path.\n  generateFiles(\n    tree,\n    joinPathFragments(\n      import.meta.dirname,\n      'files',\n      'terraform',\n      'app',\n      'agentcore-harness',\n    ),\n    joinPathFragments(\n      PACKAGES_DIR,\n      SHARED_TERRAFORM_DIR,\n      'src',\n      'app',\n      'harnesses',\n    ),\n    { ...templateContext, ...terraformProviderVersions() },\n    {\n      overwriteStrategy: OverwriteStrategy.KeepExisting,\n    },\n  );\n};\n"],"names":["generateFiles","joinPathFragments","OverwriteStrategy","updateJson","addStarExport","forDependencies","addDependenciesToPackageJson","esmVars","addDependencyToTargetIfNotPresent","generatedInfrastructure","generatedTerraform","PACKAGES_DIR","SHARED_CONSTRUCTS_DIR","SHARED_TERRAFORM_DIR","PY_VERSIONS","terraformProviderVersions","withVersions","AGENT_CORE_CONSTRUCTS_DEPENDENCIES","name","when","AGENT_CORE_CONSTRUCTS_PY_DEPENDENCIES","addAgentCoreInfra","tree","options","iac","addAgentCoreCDKInfra","addAgentCoreTerraformInfra","config","projectName","dirname","appDirectory","overwriteStrategy","KeepExisting","nameKebabCase","containers","boto3Version","boto3","addMcpServerInfra","nameClassName","mcpServerNameClassName","mcpServerNameKebabCase","dockerImageTag","dockerOutputDir","serverProtocol","auth","session","addAgentInfra","agentNameClassName","agentNameKebabCase","addAgentCoreGatewayInfra","declaration","addAgentCoreGatewayCDKInfra","addAgentCoreGatewayTerraformInfra","gatewayNameClassName","gatewayNameKebabCase","projectDirectory","cedarPolicy","protocol","httpxVersion","httpx","mcpVersion","mcp","renderScript","exists","delete","addAgentCoreHarnessInfra","promptPath","projectRoot","templateContext","harnessNameClassName","harnessNameKebabCase","harnessNamePrefix","promptPathFromCdk","promptPathFromTerraform","addAgentCoreHarnessCDKInfra","addAgentCoreHarnessTerraformInfra"],"mappings":"AAAA;;;CAGC,GACD,SACEA,aAAa,EACbC,iBAAiB,EACjBC,iBAAiB,EAGjBC,UAAU,QACL,aAAa;AACpB,SAASC,aAAa,QAAQ,YAAS;AAEvC,SAIEC,eAAe,QAEV,8BAA2B;AAClC,SAASC,4BAA4B,QAAQ,qBAAkB;AAE/D,SAASC,OAAO,QAAQ,sBAAmB;AAC3C,SAASC,iCAAiC,QAAQ,WAAQ;AAC1D,SACEC,uBAAuB,EACvBC,kBAAkB,EAElBC,YAAY,EACZC,qBAAqB,EACrBC,oBAAoB,QACf,oCAAiC;AACxC,SAGEC,WAAW,EACXC,yBAAyB,EACzBC,YAAY,QACP,iBAAc;AAIrB;;;;;CAKC,GACD,OAAO,MAAMC,qCAAqC;IAChD;QAAEC,MAAM;QAAOC,MAAMV;IAAwB;IAC7C;QAAES,MAAM;QAAqCC,MAAMV;IAAwB;IAC3E;QAAES,MAAM;QAAcC,MAAMV;IAAwB;CACrD,CAGG;AAEJ;;;;;;;CAOC,GACD,OAAO,MAAMW,wCAAwC;IACnD;QAAEF,MAAM;QAASC,MAAMT;IAAmB;IAC1C;QAAEQ,MAAM;QAASC,MAAMT;IAAmB;IAC1C;QAAEQ,MAAM;QAAOC,MAAMT;IAAmB;CACzC,CAGG;AAoBJ,MAAMW,oBAAoB,OACxBC,MACAC;IAEA,OAAQA,QAAQC,GAAG;QACjB,KAAK;YACH,MAAMC,qBAAqBH,MAAMC;YACjC;QACF,KAAK;YACHG,2BAA2BJ,MAAMC;YACjC;IACJ;IAEA,qFAAqF;IACrFpB,WACEmB,MACArB,kBACEU,cACAY,QAAQC,GAAG,KAAK,QAAQZ,wBAAwBC,sBAChD,iBAEF,CAACc;QACCnB,kCACEmB,QACA,SACA,GAAGJ,QAAQK,WAAW,CAAC,MAAM,CAAC;QAEhC,OAAOD;IACT;AAEJ;AAEA,MAAMF,uBAAuB,OAC3BH,MACAC;IAEA,sCAAsC;IACtCvB,cACEsB,MACArB,kBAAkB,YAAY4B,OAAO,EAAE,SAAS,OAAO,OAAO,eAC9D5B,kBACEU,cACAC,uBACA,OACA,OACAW,QAAQO,YAAY,GAEtB;QAAE,GAAGP,OAAO;QAAE,GAAGhB,QAAQe,KAAK;IAAC,GAC/B;QACES,mBAAmB7B,kBAAkB8B,YAAY;IACnD;IAGF,oCAAoC;IACpC,MAAM5B,cACJkB,MACArB,kBACEU,cACAC,uBACA,OACA,OACAW,QAAQO,YAAY,EACpB,aAEF,CAAC,EAAE,EAAEP,QAAQU,aAAa,CAAC,CAAC,EAAEV,QAAQU,aAAa,CAAC,GAAG,CAAC;IAE1D,MAAM7B,cACJkB,MACArB,kBACEU,cACAC,uBACA,OACA,OACA,aAEF,CAAC,EAAE,EAAEW,QAAQO,YAAY,CAAC,SAAS,CAAC;AAExC;AAEA,MAAMJ,6BAA6B,CACjCJ,MACAC;IAEA,kCAAkC;IAClCvB,cACEsB,MACArB,kBACE,YAAY4B,OAAO,EACnB,SACA,aACA,QACA,eAEF5B,kBACEU,cACAE,sBACA,OACA,QACA,eAEF;QACEqB,YAAYX,QAAQW,UAAU;QAC9BC,cAAcrB,YAAYsB,KAAK;QAC/B,GAAGrB,2BAA2B;IAChC,GACA;QACEgB,mBAAmB7B,kBAAkB8B,YAAY;IACnD;IAGF,iDAAiD;IACjDhC,cACEsB,MACArB,kBACE,YAAY4B,OAAO,EACnB,SACA,aACA,OACA,eAEF5B,kBACEU,cACAE,sBACA,OACA,OACAU,QAAQO,YAAY,GAEtB;QAAE,GAAGP,OAAO;QAAE,GAAGR,2BAA2B;IAAC,GAC7C;QACEgB,mBAAmB7B,kBAAkB8B,YAAY;IACnD;AAEJ;AAYA;;CAEC,GACD,OAAO,MAAMK,oBAAoB,OAC/Bf,MACAC;IAEA,MAAMF,kBAAkBC,MAAM;QAC5BgB,eAAef,QAAQgB,sBAAsB;QAC7CN,eAAeV,QAAQiB,sBAAsB;QAC7CC,gBAAgBlB,QAAQkB,cAAc;QACtCC,iBAAiBnB,QAAQmB,eAAe;QACxCd,aAAaL,QAAQK,WAAW;QAChCE,cAAc;QACda,gBAAgB;QAChBnB,KAAKD,QAAQC,GAAG;QAChBoB,MAAMrB,QAAQqB,IAAI;QAClB,kEAAkE;QAClEC,SAAS;QACTX,YAAYX,QAAQW,UAAU;IAChC;AACF,EAAE;AAcF;;CAEC,GACD,OAAO,MAAMY,gBAAgB,OAC3BxB,MACAC;IAEA,MAAMF,kBAAkBC,MAAM;QAC5BgB,eAAef,QAAQwB,kBAAkB;QACzCd,eAAeV,QAAQyB,kBAAkB;QACzCpB,aAAaL,QAAQK,WAAW;QAChCa,gBAAgBlB,QAAQkB,cAAc;QACtCC,iBAAiBnB,QAAQmB,eAAe;QACxCZ,cAAc;QACde,SAAStB,QAAQsB,OAAO;QACxBF,gBAAgBpB,QAAQoB,cAAc,IAAI;QAC1CnB,KAAKD,QAAQC,GAAG;QAChBoB,MAAMrB,QAAQqB,IAAI;QAClBV,YAAYX,QAAQW,UAAU;IAChC;AACF,EAAE;AAgBF,OAAO,MAAMe,2BAA2B,OAGtC3B,MACAC,SACA2B;IAEA,OAAQ3B,QAAQC,GAAG;QACjB,KAAK;YACH,MAAM2B,4BAA4B7B,MAAMC,SAAS2B;YACjD;QACF,KAAK;YACHE,kCAAkC9B,MAAMC;YACxC;IACJ;IAEApB,WACEmB,MACArB,kBACEU,cACAY,QAAQC,GAAG,KAAK,QAAQZ,wBAAwBC,sBAChD,iBAEF,CAACc;QACCnB,kCACEmB,QACA,SACA,GAAGJ,QAAQK,WAAW,CAAC,MAAM,CAAC;QAEhC,OAAOD;IACT;AAEJ,EAAE;AAEF,MAAMwB,8BAA8B,OAClC7B,MACAC,SACA2B;IAEA,0EAA0E;IAC1E,kCAAkC;IAClClD,cACEsB,MACArB,kBACE,YAAY4B,OAAO,EACnB,SACA,OACA,QACA,sBAEF5B,kBACEU,cACAC,uBACA,OACA,QACA,sBAEF;QAAE,GAAGL,QAAQe,KAAK;IAAC,GACnB;QACES,mBAAmB7B,kBAAkB8B,YAAY;IACnD;IAGFhC,cACEsB,MACArB,kBACE,YAAY4B,OAAO,EACnB,SACA,OACA,OACA,sBAEF5B,kBACEU,cACAC,uBACA,OACA,OACA,aAEF;QACE0B,eAAef,QAAQ8B,oBAAoB;QAC3CpB,eAAeV,QAAQ+B,oBAAoB;QAC3CC,kBAAkBhC,QAAQgC,gBAAgB;QAC1CC,aAAajC,QAAQiC,WAAW;QAChCZ,MAAMrB,QAAQqB,IAAI;QAClBa,UAAUlC,QAAQkC,QAAQ;QAC1B,GAAGlD,QAAQe,KAAK;IAClB,GACA;QACES,mBAAmB7B,kBAAkB8B,YAAY;IACnD;IAGF,MAAM5B,cACJkB,MACArB,kBACEU,cACAC,uBACA,OACA,QACA,aAEF;IAEF,MAAMR,cACJkB,MACArB,kBACEU,cACAC,uBACA,OACA,OACA,YACA,aAEF,CAAC,EAAE,EAAEW,QAAQ+B,oBAAoB,CAAC,CAAC,EAAE/B,QAAQ+B,oBAAoB,CAAC,GAAG,CAAC;IAExE,MAAMlD,cACJkB,MACArB,kBACEU,cACAC,uBACA,OACA,OACA,aAEF;IAGF,0EAA0E;IAC1E,wEAAwE;IACxEN,6BACEgB,MACAN,aACEX,gBAA2D6C,cAC3D;QAAC;QAAO;KAAoC,GAE9ClC,aACEX,gBAA2D6C,cAC3D;QAAC;KAAa,GAEhBjD,kBAAkBU,cAAcC,uBAAuB;AAE3D;AAEA,MAAMwC,oCAAoC,CACxC9B,MACAC;IAEAvB,cACEsB,MACArB,kBACE,YAAY4B,OAAO,EACnB,SACA,aACA,QACA,sBAEF5B,kBACEU,cACAE,sBACA,OACA,QACA,sBAEF;QAAE,GAAGE,2BAA2B;IAAC,GACjC;QACEgB,mBAAmB7B,kBAAkB8B,YAAY;IACnD;IAGFhC,cACEsB,MACArB,kBACE,YAAY4B,OAAO,EACnB,SACA,aACA,OACA,sBAEF5B,kBACEU,cACAE,sBACA,OACA,OACA,aAEF;QACEyB,eAAef,QAAQ8B,oBAAoB;QAC3CpB,eAAeV,QAAQ+B,oBAAoB;QAC3CC,kBAAkBhC,QAAQgC,gBAAgB;QAC1CC,aAAajC,QAAQiC,WAAW;QAChCZ,MAAMrB,QAAQqB,IAAI;QAClBa,UAAUlC,QAAQkC,QAAQ;QAC1BtB,cAAcrB,YAAYsB,KAAK;QAC/BsB,cAAc5C,YAAY6C,KAAK;QAC/BC,YAAY9C,YAAY+C,GAAG;QAC3B,GAAG9C,2BAA2B;IAChC,GACA;QACEgB,mBAAmB7B,kBAAkB8B,YAAY;IACnD;IAGF,mEAAmE;IACnE,IAAI,CAACT,QAAQiC,WAAW,EAAE;QACxB,MAAMM,eAAe7D,kBACnBU,cACAE,sBACA,OACA,OACA,YACAU,QAAQ+B,oBAAoB,EAC5B;QAEF,IAAIhC,KAAKyC,MAAM,CAACD,eAAe;YAC7BxC,KAAK0C,MAAM,CAACF;QACd;IACF;AACF;AA6BA;;;;;;;;;;;;CAYC,GACD,OAAO,MAAMG,2BAA2B,OACtC3C,MACAC;IAEA,wEAAwE;IACxE,qEAAqE;IACrE,6EAA6E;IAC7E,MAAM2C,aAAajE,kBAAkBsB,QAAQ4C,WAAW,EAAE,OAAO;IACjE,MAAMC,kBAA0C;QAC9C9B,eAAef,QAAQ8C,oBAAoB;QAC3CpC,eAAeV,QAAQ+C,oBAAoB;QAC3CC,mBAAmBhD,QAAQgD,iBAAiB;QAC5CC,mBAAmBN;QACnBO,yBAAyBP;IAC3B;IAEA,OAAQ3C,QAAQC,GAAG;QACjB,KAAK;YACH,MAAMkD,4BAA4BpD,MAAM8C;YACxC;QACF,KAAK;YACHO,kCAAkCrD,MAAM8C;YACxC;IACJ;AACF,EAAE;AAEF,MAAMM,8BAA8B,OAClCpD,MACA8C;IAEA,gDAAgD;IAChD,uCAAuC;IACvCpE,cACEsB,MACArB,kBACE,YAAY4B,OAAO,EACnB,SACA,OACA,OACA,sBAEF5B,kBACEU,cACAC,uBACA,OACA,OACA,cAEF;QAAE,GAAGwD,eAAe;QAAE,GAAG7D,QAAQe,KAAK;IAAC,GACvC;QACES,mBAAmB7B,kBAAkB8B,YAAY;IACnD;IAGF,sEAAsE;IACtE,yEAAyE;IACzE,6CAA6C;IAC7C,MAAM5B,cACJkB,MACArB,kBACEU,cACAC,uBACA,OACA,OACA,aACA,aAEF,CAAC,EAAE,EAAEwD,gBAAgBnC,aAAa,CAAC,CAAC,EAAEmC,gBAAgBnC,aAAa,CAAC,GAAG,CAAC;IAE1E,MAAM7B,cACJkB,MACArB,kBACEU,cACAC,uBACA,OACA,OACA,aAEF;AAEJ;AAEA,MAAM+D,oCAAoC,CACxCrD,MACA8C;IAEA,mDAAmD;IACnD,oEAAoE;IACpE,wBAAwB;IACxBpE,cACEsB,MACArB,kBACE,YAAY4B,OAAO,EACnB,SACA,aACA,OACA,sBAEF5B,kBACEU,cACAE,sBACA,OACA,OACA,cAEF;QAAE,GAAGuD,eAAe;QAAE,GAAGrD,2BAA2B;IAAC,GACrD;QACEgB,mBAAmB7B,kBAAkB8B,YAAY;IACnD;AAEJ"}
+{"version":3,"sources":["../../../../../../packages/nx-plugin/src/utils/agent-core-constructs/agent-core-constructs.ts"],"sourcesContent":["/**\n * Copyright Amazon.com, Inc. or its affiliates. All Rights Reserved.\n * SPDX-License-Identifier: Apache-2.0\n */\nimport {\n  generateFiles,\n  joinPathFragments,\n  OverwriteStrategy,\n  type ProjectConfiguration,\n  type Tree,\n  updateJson,\n} from '@nx/devkit';\nimport { addStarExport } from '../ast';\nimport type { Containers } from '../containers';\nimport {\n  type DeclaredPyDependency,\n  type DeclaredTsDependency,\n  type DependencyDeclaration,\n  forDependencies,\n  type MustDeclare,\n} from '../declared-dependencies';\nimport { addDependenciesToPackageJson } from '../dependencies';\nimport type { Iac } from '../iac';\nimport { esmVars } from '../module-format';\nimport { addDependencyToTargetIfNotPresent } from '../nx';\nimport {\n  generatedInfrastructure,\n  generatedTerraform,\n  type IacMetadata,\n  PACKAGES_DIR,\n  SHARED_CONSTRUCTS_DIR,\n  SHARED_TERRAFORM_DIR,\n} from '../shared-constructs-constants';\nimport {\n  type IPyDepVersion,\n  type ITsDepVersion,\n  PY_VERSIONS,\n  terraformProviderVersions,\n  withVersions,\n} from '../versions';\n\ntype IACProvider = { iac: Iac };\n\n/**\n * Dependencies a caller must declare to add an AgentCore Gateway construct.\n *\n * Gated on infrastructure having been generated, since the construct helpers only\n * run on that branch.\n */\nexport const AGENT_CORE_CONSTRUCTS_DEPENDENCIES = [\n  { name: 'ejs', when: generatedInfrastructure },\n  { name: '@aws-sdk/client-bedrock-agentcore', when: generatedInfrastructure },\n  { name: '@types/ejs', when: generatedInfrastructure },\n] as const satisfies readonly DeclaredTsDependency<\n  ITsDepVersion,\n  IacMetadata\n>[];\n\n/**\n * Python versions the generated Terraform pins in an inline `uv run --with`\n * script, rather than in any `pyproject.toml`.\n *\n * Spread through `ownedElsewhere` because nothing installs them into the\n * workspace — the pin is owned so the version sync keeps it current, and gated on\n * Terraform since the CDK branch writes no such script.\n */\nexport const AGENT_CORE_CONSTRUCTS_PY_DEPENDENCIES = [\n  { name: 'boto3', when: generatedTerraform },\n  { name: 'httpx', when: generatedTerraform },\n  { name: 'mcp', when: generatedTerraform },\n] as const satisfies readonly DeclaredPyDependency<\n  IPyDepVersion,\n  IacMetadata\n>[];\n\nexport type AgentCoreAuth = 'iam' | 'cognito';\n\nexport type AgentCoreSession = 's3' | 'dynamodb-s3' | 'in-memory';\n\nexport interface AddAgentCoreInfraProps {\n  nameClassName: string;\n  nameKebabCase: string;\n  projectName: string;\n  dockerImageTag: string;\n  dockerOutputDir: string;\n  appDirectory: string;\n  serverProtocol: 'mcp' | 'http' | 'a2a';\n  auth: AgentCoreAuth;\n  /** How this runtime's session should be persisted. MCP servers have no session, so pass 'in-memory'. */\n  session: AgentCoreSession;\n  containers: Containers;\n}\n\nconst addAgentCoreInfra = async (\n  tree: Tree,\n  options: AddAgentCoreInfraProps & { iac: Iac },\n) => {\n  switch (options.iac) {\n    case 'cdk':\n      await addAgentCoreCDKInfra(tree, options);\n      break;\n    case 'terraform':\n      addAgentCoreTerraformInfra(tree, options);\n      break;\n  }\n\n  // Update shared constructs/terraform project configuration to depend on this project\n  updateJson(\n    tree,\n    joinPathFragments(\n      PACKAGES_DIR,\n      options.iac === 'cdk' ? SHARED_CONSTRUCTS_DIR : SHARED_TERRAFORM_DIR,\n      'project.json',\n    ),\n    (config: ProjectConfiguration) => {\n      addDependencyToTargetIfNotPresent(\n        config,\n        'build',\n        `${options.projectName}:build`,\n      );\n      return config;\n    },\n  );\n};\n\nconst addAgentCoreCDKInfra = async (\n  tree: Tree,\n  options: AddAgentCoreInfraProps,\n) => {\n  // Generate app specific CDK construct\n  generateFiles(\n    tree,\n    joinPathFragments(import.meta.dirname, 'files', 'cdk', 'app', 'agent-core'),\n    joinPathFragments(\n      PACKAGES_DIR,\n      SHARED_CONSTRUCTS_DIR,\n      'src',\n      'app',\n      options.appDirectory,\n    ),\n    { ...options, ...esmVars(tree) },\n    {\n      overwriteStrategy: OverwriteStrategy.KeepExisting,\n    },\n  );\n\n  // Export app specific CDK construct\n  await addStarExport(\n    tree,\n    joinPathFragments(\n      PACKAGES_DIR,\n      SHARED_CONSTRUCTS_DIR,\n      'src',\n      'app',\n      options.appDirectory,\n      'index.ts',\n    ),\n    `./${options.nameKebabCase}/${options.nameKebabCase}.js`,\n  );\n  await addStarExport(\n    tree,\n    joinPathFragments(\n      PACKAGES_DIR,\n      SHARED_CONSTRUCTS_DIR,\n      'src',\n      'app',\n      'index.ts',\n    ),\n    `./${options.appDirectory}/index.js`,\n  );\n};\n\nconst addAgentCoreTerraformInfra = (\n  tree: Tree,\n  options: AddAgentCoreInfraProps,\n) => {\n  // Add the AgentCore shared module\n  generateFiles(\n    tree,\n    joinPathFragments(\n      import.meta.dirname,\n      'files',\n      'terraform',\n      'core',\n      'agent-core',\n    ),\n    joinPathFragments(\n      PACKAGES_DIR,\n      SHARED_TERRAFORM_DIR,\n      'src',\n      'core',\n      'agent-core',\n    ),\n    {\n      containers: options.containers,\n      boto3Version: PY_VERSIONS.boto3,\n      ...terraformProviderVersions(),\n    },\n    {\n      overwriteStrategy: OverwriteStrategy.KeepExisting,\n    },\n  );\n\n  // Generate app specific agent core configuration\n  generateFiles(\n    tree,\n    joinPathFragments(\n      import.meta.dirname,\n      'files',\n      'terraform',\n      'app',\n      'agent-core',\n    ),\n    joinPathFragments(\n      PACKAGES_DIR,\n      SHARED_TERRAFORM_DIR,\n      'src',\n      'app',\n      options.appDirectory,\n    ),\n    { ...options, ...terraformProviderVersions() },\n    {\n      overwriteStrategy: OverwriteStrategy.KeepExisting,\n    },\n  );\n};\n\nexport interface AddMcpServerInfraProps {\n  mcpServerNameClassName: string;\n  mcpServerNameKebabCase: string;\n  projectName: string;\n  dockerImageTag: string;\n  dockerOutputDir: string;\n  auth: AgentCoreAuth;\n  containers: Containers;\n}\n\n/**\n * Add an MCP server CDK construct\n */\nexport const addMcpServerInfra = async (\n  tree: Tree,\n  options: AddMcpServerInfraProps & IACProvider,\n) => {\n  await addAgentCoreInfra(tree, {\n    nameClassName: options.mcpServerNameClassName,\n    nameKebabCase: options.mcpServerNameKebabCase,\n    dockerImageTag: options.dockerImageTag,\n    dockerOutputDir: options.dockerOutputDir,\n    projectName: options.projectName,\n    appDirectory: 'mcp-servers',\n    serverProtocol: 'mcp',\n    iac: options.iac,\n    auth: options.auth,\n    // MCP servers are stateless (no conversation session to persist).\n    session: 'in-memory',\n    containers: options.containers,\n  });\n};\n\nexport interface AddAgentInfraProps {\n  agentNameClassName: string;\n  agentNameKebabCase: string;\n  projectName: string;\n  dockerImageTag: string;\n  dockerOutputDir: string;\n  auth: AgentCoreAuth;\n  session: AgentCoreSession;\n  serverProtocol?: 'http' | 'a2a';\n  containers: Containers;\n}\n\n/**\n * Add an agent CDK construct\n */\nexport const addAgentInfra = async (\n  tree: Tree,\n  options: AddAgentInfraProps & IACProvider,\n) => {\n  await addAgentCoreInfra(tree, {\n    nameClassName: options.agentNameClassName,\n    nameKebabCase: options.agentNameKebabCase,\n    projectName: options.projectName,\n    dockerImageTag: options.dockerImageTag,\n    dockerOutputDir: options.dockerOutputDir,\n    appDirectory: 'agents',\n    session: options.session,\n    serverProtocol: options.serverProtocol ?? 'http',\n    iac: options.iac,\n    auth: options.auth,\n    containers: options.containers,\n  });\n};\n\nexport interface AddAgentCoreGatewayInfraProps {\n  gatewayNameClassName: string;\n  gatewayNameKebabCase: string;\n  projectName: string;\n  projectDirectory: string;\n  cedarPolicy: boolean;\n  auth: AgentCoreAuth;\n  /**\n   * The gateway's protocol: mcp aggregates MCP server targets, http proxies\n   * agent runtime targets via path-based routing.\n   */\n  protocol: 'mcp' | 'http';\n}\n\nexport const addAgentCoreGatewayInfra = async <\n  const D extends DependencyDeclaration,\n>(\n  tree: Tree,\n  options: AddAgentCoreGatewayInfraProps & IACProvider,\n  declaration: D & MustDeclare<typeof AGENT_CORE_CONSTRUCTS_DEPENDENCIES, D>,\n) => {\n  switch (options.iac) {\n    case 'cdk':\n      await addAgentCoreGatewayCDKInfra(tree, options, declaration);\n      break;\n    case 'terraform':\n      addAgentCoreGatewayTerraformInfra(tree, options);\n      break;\n  }\n\n  updateJson(\n    tree,\n    joinPathFragments(\n      PACKAGES_DIR,\n      options.iac === 'cdk' ? SHARED_CONSTRUCTS_DIR : SHARED_TERRAFORM_DIR,\n      'project.json',\n    ),\n    (config: ProjectConfiguration) => {\n      addDependencyToTargetIfNotPresent(\n        config,\n        'build',\n        `${options.projectName}:build`,\n      );\n      return config;\n    },\n  );\n};\n\nconst addAgentCoreGatewayCDKInfra = async (\n  tree: Tree,\n  options: AddAgentCoreGatewayInfraProps,\n  declaration: DependencyDeclaration,\n) => {\n  // Generic gateway construct (readiness probe, policy engine, Cedar policy\n  // loading) shared by all gateways\n  generateFiles(\n    tree,\n    joinPathFragments(\n      import.meta.dirname,\n      'files',\n      'cdk',\n      'core',\n      'agentcore-gateway',\n    ),\n    joinPathFragments(\n      PACKAGES_DIR,\n      SHARED_CONSTRUCTS_DIR,\n      'src',\n      'core',\n      'agentcore-gateway',\n    ),\n    { ...esmVars(tree) },\n    {\n      overwriteStrategy: OverwriteStrategy.KeepExisting,\n    },\n  );\n\n  generateFiles(\n    tree,\n    joinPathFragments(\n      import.meta.dirname,\n      'files',\n      'cdk',\n      'app',\n      'agentcore-gateway',\n    ),\n    joinPathFragments(\n      PACKAGES_DIR,\n      SHARED_CONSTRUCTS_DIR,\n      'src',\n      'app',\n      'gateways',\n    ),\n    {\n      nameClassName: options.gatewayNameClassName,\n      nameKebabCase: options.gatewayNameKebabCase,\n      projectDirectory: options.projectDirectory,\n      cedarPolicy: options.cedarPolicy,\n      auth: options.auth,\n      protocol: options.protocol,\n      ...esmVars(tree),\n    },\n    {\n      overwriteStrategy: OverwriteStrategy.KeepExisting,\n    },\n  );\n\n  await addStarExport(\n    tree,\n    joinPathFragments(\n      PACKAGES_DIR,\n      SHARED_CONSTRUCTS_DIR,\n      'src',\n      'core',\n      'index.ts',\n    ),\n    './agentcore-gateway/agentcore-gateway.js',\n  );\n  await addStarExport(\n    tree,\n    joinPathFragments(\n      PACKAGES_DIR,\n      SHARED_CONSTRUCTS_DIR,\n      'src',\n      'app',\n      'gateways',\n      'index.ts',\n    ),\n    `./${options.gatewayNameKebabCase}/${options.gatewayNameKebabCase}.js`,\n  );\n  await addStarExport(\n    tree,\n    joinPathFragments(\n      PACKAGES_DIR,\n      SHARED_CONSTRUCTS_DIR,\n      'src',\n      'app',\n      'index.ts',\n    ),\n    './gateways/index.js',\n  );\n\n  // The gateway construct renders Cedar policies with ejs and its readiness\n  // probe uses the AgentCore SDK client; declare both so the lint passes.\n  addDependenciesToPackageJson(\n    tree,\n    withVersions(\n      forDependencies<typeof AGENT_CORE_CONSTRUCTS_DEPENDENCIES>(declaration),\n      ['ejs', '@aws-sdk/client-bedrock-agentcore'],\n    ),\n    withVersions(\n      forDependencies<typeof AGENT_CORE_CONSTRUCTS_DEPENDENCIES>(declaration),\n      ['@types/ejs'],\n    ),\n    joinPathFragments(PACKAGES_DIR, SHARED_CONSTRUCTS_DIR, 'package.json'),\n  );\n};\n\nconst addAgentCoreGatewayTerraformInfra = (\n  tree: Tree,\n  options: AddAgentCoreGatewayInfraProps,\n) => {\n  generateFiles(\n    tree,\n    joinPathFragments(\n      import.meta.dirname,\n      'files',\n      'terraform',\n      'core',\n      'agentcore-gateway',\n    ),\n    joinPathFragments(\n      PACKAGES_DIR,\n      SHARED_TERRAFORM_DIR,\n      'src',\n      'core',\n      'agentcore-gateway',\n    ),\n    { ...terraformProviderVersions() },\n    {\n      overwriteStrategy: OverwriteStrategy.KeepExisting,\n    },\n  );\n\n  generateFiles(\n    tree,\n    joinPathFragments(\n      import.meta.dirname,\n      'files',\n      'terraform',\n      'app',\n      'agentcore-gateway',\n    ),\n    joinPathFragments(\n      PACKAGES_DIR,\n      SHARED_TERRAFORM_DIR,\n      'src',\n      'app',\n      'gateways',\n    ),\n    {\n      nameClassName: options.gatewayNameClassName,\n      nameKebabCase: options.gatewayNameKebabCase,\n      projectDirectory: options.projectDirectory,\n      cedarPolicy: options.cedarPolicy,\n      auth: options.auth,\n      protocol: options.protocol,\n      boto3Version: PY_VERSIONS.boto3,\n      httpxVersion: PY_VERSIONS.httpx,\n      mcpVersion: PY_VERSIONS.mcp,\n      ...terraformProviderVersions(),\n    },\n    {\n      overwriteStrategy: OverwriteStrategy.KeepExisting,\n    },\n  );\n\n  // The Cedar render script is only needed when policies are enabled\n  if (!options.cedarPolicy) {\n    const renderScript = joinPathFragments(\n      PACKAGES_DIR,\n      SHARED_TERRAFORM_DIR,\n      'src',\n      'app',\n      'gateways',\n      options.gatewayNameKebabCase,\n      'render-cedar.cjs',\n    );\n    if (tree.exists(renderScript)) {\n      tree.delete(renderScript);\n    }\n  }\n};\n\nexport interface AddAgentCoreHarnessInfraProps {\n  harnessNameClassName: string;\n  harnessNameKebabCase: string;\n  /**\n   * Workspace-root-relative harness project root, eg `packages/my-harness`.\n   * The `src/PROMPT.md` path both templates read is derived from it.\n   */\n  projectRoot: string;\n  /** Leading-letter-guaranteed, 31-char-truncated resource name prefix. */\n  harnessNamePrefix: string;\n}\n\n/**\n * Template substitution context shared by the CDK and Terraform harness\n * branches. Both prompt path fields carry the same workspace-root-relative\n * path, named per provider so each template's usage reads on its own.\n */\ninterface HarnessTemplateContext {\n  nameClassName: string;\n  nameKebabCase: string;\n  harnessNamePrefix: string;\n  /** Joined onto `findWorkspaceRoot()` in the CDK construct. */\n  promptPathFromCdk: string;\n  /** Appended to the `path.module` walk to the workspace root in Terraform. */\n  promptPathFromTerraform: string;\n}\n\n/**\n * Add AgentCore Harness infrastructure for the selected IaC provider.\n *\n * Renders the provider-specific Harness infrastructure (a CDK construct or\n * a Terraform module) into the Shared Infrastructure Project with\n * `KeepExisting`, so existing files become user-owned and are never\n * rewritten by reruns.\n *\n * Unlike agents, MCP servers and gateways, no build dependency is added\n * from the shared infrastructure project to the Harness Project: generated\n * Harness infrastructure does not import Harness Project source, so a\n * dependency would only create false rebuild coupling.\n */\nexport const addAgentCoreHarnessInfra = async (\n  tree: Tree,\n  options: AddAgentCoreHarnessInfraProps & IACProvider,\n): Promise<void> => {\n  // One resolved template context, built once and passed to both provider\n  // branches. The prompt path is derived from the same projectRoot the\n  // Harness Project is written to, so explicit placement needs no extra logic.\n  const promptPath = joinPathFragments(options.projectRoot, 'src', 'PROMPT.md');\n  const templateContext: HarnessTemplateContext = {\n    nameClassName: options.harnessNameClassName,\n    nameKebabCase: options.harnessNameKebabCase,\n    harnessNamePrefix: options.harnessNamePrefix,\n    promptPathFromCdk: promptPath,\n    promptPathFromTerraform: promptPath,\n  };\n\n  switch (options.iac) {\n    case 'cdk':\n      await addAgentCoreHarnessCDKInfra(tree, templateContext);\n      break;\n    case 'terraform':\n      addAgentCoreHarnessTerraformInfra(tree, templateContext);\n      break;\n  }\n};\n\nconst addAgentCoreHarnessCDKInfra = async (\n  tree: Tree,\n  templateContext: HarnessTemplateContext,\n) => {\n  // Generate the app specific CDK construct under\n  // src/app/harnesses/<kebab-case-name>/\n  generateFiles(\n    tree,\n    joinPathFragments(\n      import.meta.dirname,\n      'files',\n      'cdk',\n      'app',\n      'agentcore-harness',\n    ),\n    joinPathFragments(\n      PACKAGES_DIR,\n      SHARED_CONSTRUCTS_DIR,\n      'src',\n      'app',\n      'harnesses',\n    ),\n    { ...templateContext, ...esmVars(tree) },\n    {\n      overwriteStrategy: OverwriteStrategy.KeepExisting,\n    },\n  );\n\n  // Export the construct through the harnesses app index and the shared\n  // app index. addStarExport creates a missing index file and semantically\n  // deduplicates equivalent exports on reruns.\n  await addStarExport(\n    tree,\n    joinPathFragments(\n      PACKAGES_DIR,\n      SHARED_CONSTRUCTS_DIR,\n      'src',\n      'app',\n      'harnesses',\n      'index.ts',\n    ),\n    `./${templateContext.nameKebabCase}/${templateContext.nameKebabCase}.js`,\n  );\n  await addStarExport(\n    tree,\n    joinPathFragments(\n      PACKAGES_DIR,\n      SHARED_CONSTRUCTS_DIR,\n      'src',\n      'app',\n      'index.ts',\n    ),\n    './harnesses/index.js',\n  );\n};\n\nconst addAgentCoreHarnessTerraformInfra = (\n  tree: Tree,\n  templateContext: HarnessTemplateContext,\n) => {\n  // Generate the app specific Terraform module under\n  // src/app/harnesses/<kebab-case-name>/. No CDK files or exports are\n  // created on this path.\n  generateFiles(\n    tree,\n    joinPathFragments(\n      import.meta.dirname,\n      'files',\n      'terraform',\n      'app',\n      'agentcore-harness',\n    ),\n    joinPathFragments(\n      PACKAGES_DIR,\n      SHARED_TERRAFORM_DIR,\n      'src',\n      'app',\n      'harnesses',\n    ),\n    { ...templateContext, ...terraformProviderVersions() },\n    {\n      overwriteStrategy: OverwriteStrategy.KeepExisting,\n    },\n  );\n};\n"],"names":["generateFiles","joinPathFragments","OverwriteStrategy","updateJson","addStarExport","forDependencies","addDependenciesToPackageJson","esmVars","addDependencyToTargetIfNotPresent","generatedInfrastructure","generatedTerraform","PACKAGES_DIR","SHARED_CONSTRUCTS_DIR","SHARED_TERRAFORM_DIR","PY_VERSIONS","terraformProviderVersions","withVersions","AGENT_CORE_CONSTRUCTS_DEPENDENCIES","name","when","AGENT_CORE_CONSTRUCTS_PY_DEPENDENCIES","addAgentCoreInfra","tree","options","iac","addAgentCoreCDKInfra","addAgentCoreTerraformInfra","config","projectName","dirname","appDirectory","overwriteStrategy","KeepExisting","nameKebabCase","containers","boto3Version","boto3","addMcpServerInfra","nameClassName","mcpServerNameClassName","mcpServerNameKebabCase","dockerImageTag","dockerOutputDir","serverProtocol","auth","session","addAgentInfra","agentNameClassName","agentNameKebabCase","addAgentCoreGatewayInfra","declaration","addAgentCoreGatewayCDKInfra","addAgentCoreGatewayTerraformInfra","gatewayNameClassName","gatewayNameKebabCase","projectDirectory","cedarPolicy","protocol","httpxVersion","httpx","mcpVersion","mcp","renderScript","exists","delete","addAgentCoreHarnessInfra","promptPath","projectRoot","templateContext","harnessNameClassName","harnessNameKebabCase","harnessNamePrefix","promptPathFromCdk","promptPathFromTerraform","addAgentCoreHarnessCDKInfra","addAgentCoreHarnessTerraformInfra"],"mappings":"AAAA;;;CAGC,GACD,SACEA,aAAa,EACbC,iBAAiB,EACjBC,iBAAiB,EAGjBC,UAAU,QACL,aAAa;AACpB,SAASC,aAAa,QAAQ,YAAS;AAEvC,SAIEC,eAAe,QAEV,8BAA2B;AAClC,SAASC,4BAA4B,QAAQ,qBAAkB;AAE/D,SAASC,OAAO,QAAQ,sBAAmB;AAC3C,SAASC,iCAAiC,QAAQ,WAAQ;AAC1D,SACEC,uBAAuB,EACvBC,kBAAkB,EAElBC,YAAY,EACZC,qBAAqB,EACrBC,oBAAoB,QACf,oCAAiC;AACxC,SAGEC,WAAW,EACXC,yBAAyB,EACzBC,YAAY,QACP,iBAAc;AAIrB;;;;;CAKC,GACD,OAAO,MAAMC,qCAAqC;IAChD;QAAEC,MAAM;QAAOC,MAAMV;IAAwB;IAC7C;QAAES,MAAM;QAAqCC,MAAMV;IAAwB;IAC3E;QAAES,MAAM;QAAcC,MAAMV;IAAwB;CACrD,CAGG;AAEJ;;;;;;;CAOC,GACD,OAAO,MAAMW,wCAAwC;IACnD;QAAEF,MAAM;QAASC,MAAMT;IAAmB;IAC1C;QAAEQ,MAAM;QAASC,MAAMT;IAAmB;IAC1C;QAAEQ,MAAM;QAAOC,MAAMT;IAAmB;CACzC,CAGG;AAoBJ,MAAMW,oBAAoB,OACxBC,MACAC;IAEA,OAAQA,QAAQC,GAAG;QACjB,KAAK;YACH,MAAMC,qBAAqBH,MAAMC;YACjC;QACF,KAAK;YACHG,2BAA2BJ,MAAMC;YACjC;IACJ;IAEA,qFAAqF;IACrFpB,WACEmB,MACArB,kBACEU,cACAY,QAAQC,GAAG,KAAK,QAAQZ,wBAAwBC,sBAChD,iBAEF,CAACc;QACCnB,kCACEmB,QACA,SACA,GAAGJ,QAAQK,WAAW,CAAC,MAAM,CAAC;QAEhC,OAAOD;IACT;AAEJ;AAEA,MAAMF,uBAAuB,OAC3BH,MACAC;IAEA,sCAAsC;IACtCvB,cACEsB,MACArB,kBAAkB,YAAY4B,OAAO,EAAE,SAAS,OAAO,OAAO,eAC9D5B,kBACEU,cACAC,uBACA,OACA,OACAW,QAAQO,YAAY,GAEtB;QAAE,GAAGP,OAAO;QAAE,GAAGhB,QAAQe,KAAK;IAAC,GAC/B;QACES,mBAAmB7B,kBAAkB8B,YAAY;IACnD;IAGF,oCAAoC;IACpC,MAAM5B,cACJkB,MACArB,kBACEU,cACAC,uBACA,OACA,OACAW,QAAQO,YAAY,EACpB,aAEF,CAAC,EAAE,EAAEP,QAAQU,aAAa,CAAC,CAAC,EAAEV,QAAQU,aAAa,CAAC,GAAG,CAAC;IAE1D,MAAM7B,cACJkB,MACArB,kBACEU,cACAC,uBACA,OACA,OACA,aAEF,CAAC,EAAE,EAAEW,QAAQO,YAAY,CAAC,SAAS,CAAC;AAExC;AAEA,MAAMJ,6BAA6B,CACjCJ,MACAC;IAEA,kCAAkC;IAClCvB,cACEsB,MACArB,kBACE,YAAY4B,OAAO,EACnB,SACA,aACA,QACA,eAEF5B,kBACEU,cACAE,sBACA,OACA,QACA,eAEF;QACEqB,YAAYX,QAAQW,UAAU;QAC9BC,cAAcrB,YAAYsB,KAAK;QAC/B,GAAGrB,2BAA2B;IAChC,GACA;QACEgB,mBAAmB7B,kBAAkB8B,YAAY;IACnD;IAGF,iDAAiD;IACjDhC,cACEsB,MACArB,kBACE,YAAY4B,OAAO,EACnB,SACA,aACA,OACA,eAEF5B,kBACEU,cACAE,sBACA,OACA,OACAU,QAAQO,YAAY,GAEtB;QAAE,GAAGP,OAAO;QAAE,GAAGR,2BAA2B;IAAC,GAC7C;QACEgB,mBAAmB7B,kBAAkB8B,YAAY;IACnD;AAEJ;AAYA;;CAEC,GACD,OAAO,MAAMK,oBAAoB,OAC/Bf,MACAC;IAEA,MAAMF,kBAAkBC,MAAM;QAC5BgB,eAAef,QAAQgB,sBAAsB;QAC7CN,eAAeV,QAAQiB,sBAAsB;QAC7CC,gBAAgBlB,QAAQkB,cAAc;QACtCC,iBAAiBnB,QAAQmB,eAAe;QACxCd,aAAaL,QAAQK,WAAW;QAChCE,cAAc;QACda,gBAAgB;QAChBnB,KAAKD,QAAQC,GAAG;QAChBoB,MAAMrB,QAAQqB,IAAI;QAClB,kEAAkE;QAClEC,SAAS;QACTX,YAAYX,QAAQW,UAAU;IAChC;AACF,EAAE;AAcF;;CAEC,GACD,OAAO,MAAMY,gBAAgB,OAC3BxB,MACAC;IAEA,MAAMF,kBAAkBC,MAAM;QAC5BgB,eAAef,QAAQwB,kBAAkB;QACzCd,eAAeV,QAAQyB,kBAAkB;QACzCpB,aAAaL,QAAQK,WAAW;QAChCa,gBAAgBlB,QAAQkB,cAAc;QACtCC,iBAAiBnB,QAAQmB,eAAe;QACxCZ,cAAc;QACde,SAAStB,QAAQsB,OAAO;QACxBF,gBAAgBpB,QAAQoB,cAAc,IAAI;QAC1CnB,KAAKD,QAAQC,GAAG;QAChBoB,MAAMrB,QAAQqB,IAAI;QAClBV,YAAYX,QAAQW,UAAU;IAChC;AACF,EAAE;AAgBF,OAAO,MAAMe,2BAA2B,OAGtC3B,MACAC,SACA2B;IAEA,OAAQ3B,QAAQC,GAAG;QACjB,KAAK;YACH,MAAM2B,4BAA4B7B,MAAMC,SAAS2B;YACjD;QACF,KAAK;YACHE,kCAAkC9B,MAAMC;YACxC;IACJ;IAEApB,WACEmB,MACArB,kBACEU,cACAY,QAAQC,GAAG,KAAK,QAAQZ,wBAAwBC,sBAChD,iBAEF,CAACc;QACCnB,kCACEmB,QACA,SACA,GAAGJ,QAAQK,WAAW,CAAC,MAAM,CAAC;QAEhC,OAAOD;IACT;AAEJ,EAAE;AAEF,MAAMwB,8BAA8B,OAClC7B,MACAC,SACA2B;IAEA,0EAA0E;IAC1E,kCAAkC;IAClClD,cACEsB,MACArB,kBACE,YAAY4B,OAAO,EACnB,SACA,OACA,QACA,sBAEF5B,kBACEU,cACAC,uBACA,OACA,QACA,sBAEF;QAAE,GAAGL,QAAQe,KAAK;IAAC,GACnB;QACES,mBAAmB7B,kBAAkB8B,YAAY;IACnD;IAGFhC,cACEsB,MACArB,kBACE,YAAY4B,OAAO,EACnB,SACA,OACA,OACA,sBAEF5B,kBACEU,cACAC,uBACA,OACA,OACA,aAEF;QACE0B,eAAef,QAAQ8B,oBAAoB;QAC3CpB,eAAeV,QAAQ+B,oBAAoB;QAC3CC,kBAAkBhC,QAAQgC,gBAAgB;QAC1CC,aAAajC,QAAQiC,WAAW;QAChCZ,MAAMrB,QAAQqB,IAAI;QAClBa,UAAUlC,QAAQkC,QAAQ;QAC1B,GAAGlD,QAAQe,KAAK;IAClB,GACA;QACES,mBAAmB7B,kBAAkB8B,YAAY;IACnD;IAGF,MAAM5B,cACJkB,MACArB,kBACEU,cACAC,uBACA,OACA,QACA,aAEF;IAEF,MAAMR,cACJkB,MACArB,kBACEU,cACAC,uBACA,OACA,OACA,YACA,aAEF,CAAC,EAAE,EAAEW,QAAQ+B,oBAAoB,CAAC,CAAC,EAAE/B,QAAQ+B,oBAAoB,CAAC,GAAG,CAAC;IAExE,MAAMlD,cACJkB,MACArB,kBACEU,cACAC,uBACA,OACA,OACA,aAEF;IAGF,0EAA0E;IAC1E,wEAAwE;IACxEN,6BACEgB,MACAN,aACEX,gBAA2D6C,cAC3D;QAAC;QAAO;KAAoC,GAE9ClC,aACEX,gBAA2D6C,cAC3D;QAAC;KAAa,GAEhBjD,kBAAkBU,cAAcC,uBAAuB;AAE3D;AAEA,MAAMwC,oCAAoC,CACxC9B,MACAC;IAEAvB,cACEsB,MACArB,kBACE,YAAY4B,OAAO,EACnB,SACA,aACA,QACA,sBAEF5B,kBACEU,cACAE,sBACA,OACA,QACA,sBAEF;QAAE,GAAGE,2BAA2B;IAAC,GACjC;QACEgB,mBAAmB7B,kBAAkB8B,YAAY;IACnD;IAGFhC,cACEsB,MACArB,kBACE,YAAY4B,OAAO,EACnB,SACA,aACA,OACA,sBAEF5B,kBACEU,cACAE,sBACA,OACA,OACA,aAEF;QACEyB,eAAef,QAAQ8B,oBAAoB;QAC3CpB,eAAeV,QAAQ+B,oBAAoB;QAC3CC,kBAAkBhC,QAAQgC,gBAAgB;QAC1CC,aAAajC,QAAQiC,WAAW;QAChCZ,MAAMrB,QAAQqB,IAAI;QAClBa,UAAUlC,QAAQkC,QAAQ;QAC1BtB,cAAcrB,YAAYsB,KAAK;QAC/BsB,cAAc5C,YAAY6C,KAAK;QAC/BC,YAAY9C,YAAY+C,GAAG;QAC3B,GAAG9C,2BAA2B;IAChC,GACA;QACEgB,mBAAmB7B,kBAAkB8B,YAAY;IACnD;IAGF,mEAAmE;IACnE,IAAI,CAACT,QAAQiC,WAAW,EAAE;QACxB,MAAMM,eAAe7D,kBACnBU,cACAE,sBACA,OACA,OACA,YACAU,QAAQ+B,oBAAoB,EAC5B;QAEF,IAAIhC,KAAKyC,MAAM,CAACD,eAAe;YAC7BxC,KAAK0C,MAAM,CAACF;QACd;IACF;AACF;AA6BA;;;;;;;;;;;;CAYC,GACD,OAAO,MAAMG,2BAA2B,OACtC3C,MACAC;IAEA,wEAAwE;IACxE,qEAAqE;IACrE,6EAA6E;IAC7E,MAAM2C,aAAajE,kBAAkBsB,QAAQ4C,WAAW,EAAE,OAAO;IACjE,MAAMC,kBAA0C;QAC9C9B,eAAef,QAAQ8C,oBAAoB;QAC3CpC,eAAeV,QAAQ+C,oBAAoB;QAC3CC,mBAAmBhD,QAAQgD,iBAAiB;QAC5CC,mBAAmBN;QACnBO,yBAAyBP;IAC3B;IAEA,OAAQ3C,QAAQC,GAAG;QACjB,KAAK;YACH,MAAMkD,4BAA4BpD,MAAM8C;YACxC;QACF,KAAK;YACHO,kCAAkCrD,MAAM8C;YACxC;IACJ;AACF,EAAE;AAEF,MAAMM,8BAA8B,OAClCpD,MACA8C;IAEA,gDAAgD;IAChD,uCAAuC;IACvCpE,cACEsB,MACArB,kBACE,YAAY4B,OAAO,EACnB,SACA,OACA,OACA,sBAEF5B,kBACEU,cACAC,uBACA,OACA,OACA,cAEF;QAAE,GAAGwD,eAAe;QAAE,GAAG7D,QAAQe,KAAK;IAAC,GACvC;QACES,mBAAmB7B,kBAAkB8B,YAAY;IACnD;IAGF,sEAAsE;IACtE,yEAAyE;IACzE,6CAA6C;IAC7C,MAAM5B,cACJkB,MACArB,kBACEU,cACAC,uBACA,OACA,OACA,aACA,aAEF,CAAC,EAAE,EAAEwD,gBAAgBnC,aAAa,CAAC,CAAC,EAAEmC,gBAAgBnC,aAAa,CAAC,GAAG,CAAC;IAE1E,MAAM7B,cACJkB,MACArB,kBACEU,cACAC,uBACA,OACA,OACA,aAEF;AAEJ;AAEA,MAAM+D,oCAAoC,CACxCrD,MACA8C;IAEA,mDAAmD;IACnD,oEAAoE;IACpE,wBAAwB;IACxBpE,cACEsB,MACArB,kBACE,YAAY4B,OAAO,EACnB,SACA,aACA,OACA,sBAEF5B,kBACEU,cACAE,sBACA,OACA,OACA,cAEF;QAAE,GAAGuD,eAAe;QAAE,GAAGrD,2BAA2B;IAAC,GACrD;QACEgB,mBAAmB7B,kBAAkB8B,YAAY;IACnD;AAEJ"}

package/src/utils/agent-core-constructs/files/cdk/app/agent-core/__nameKebabCase__/__nameKebabCase__.ts.template

@@ -1,7 +1,8 @@
-import { Fn, Lazy, Names<%_ if (session === 's3') { _%>, RemovalPolicy<%_ } _%>, Stack } from 'aws-cdk-lib';
+<%_ const hasSessionBucket = session === 's3' || session === 'dynamodb-s3'; _%>
+import { Fn, Lazy, Names<%_ if (hasSessionBucket) { _%>, RemovalPolicy<%_ } _%>, Stack } from 'aws-cdk-lib';
 import { Platform } from 'aws-cdk-lib/aws-ecr-assets';
 import { Connections, IConnectable } from 'aws-cdk-lib/aws-ec2';
-<%_ if (session === 's3') { _%>
+<%_ if (hasSessionBucket) { _%>
 import { BlockPublicAccess, Bucket, BucketEncryption } from 'aws-cdk-lib/aws-s3';
 import { Key } from 'aws-cdk-lib/aws-kms';
 import {
@@ -12,6 +13,14 @@ import {
   RetentionDays,
 } from 'aws-cdk-lib/aws-logs';
 <%_ } _%>
+<%_ if (session === 'dynamodb-s3') { _%>
+import {
+  AttributeType,
+  BillingMode,
+  Table,
+  TableEncryption,
+} from 'aws-cdk-lib/aws-dynamodb';
+<%_ } _%>
 import { Construct } from 'constructs';
 import * as path from 'path';
 import * as url from 'url';
@@ -24,11 +33,11 @@ import {
   RuntimeAuthorizerConfiguration,
 <%_ } _%>
 } from 'aws-cdk-lib/aws-bedrockagentcore';
-import { <%_ if (serverProtocol !== 'mcp') { _%>PolicyStatement, <%_ } _%><%_ if (session === 's3') { _%>Effect, ServicePrincipal, <%_ } _%>IGrantable, IPrincipal<%_ if (auth === 'iam') { _%>, Grant<%_ } _%> } from 'aws-cdk-lib/aws-iam';
+import { <%_ if (serverProtocol !== 'mcp') { _%>PolicyStatement, <%_ } _%><%_ if (hasSessionBucket) { _%>Effect, ServicePrincipal, <%_ } _%>IGrantable, IPrincipal<%_ if (auth === 'iam') { _%>, Grant<%_ } _%> } from 'aws-cdk-lib/aws-iam';
 <%_ if (auth === 'cognito') { _%>
 import { IUserPool, IUserPoolClient } from 'aws-cdk-lib/aws-cognito';
 <%_ } _%>
-<%_ if (session === 's3') { _%>
+<%_ if (hasSessionBucket) { _%>
 import { suppressRules } from '../../../core/checkov<% if (esm) { %>.js<% } %>';
 <%_ } _%>
 import { RuntimeConfig } from '../../../core/runtime-config<% if (esm) { %>.js<% } %>';
@@ -41,7 +50,34 @@ export type <%- nameClassName %>Props = Omit<
   | 'protocolConfiguration'
   | 'agentRuntimeArtifact'
   | 'authorizerConfiguration'
->;
+><%_ if (hasSessionBucket) { _%> & {
+<%_ if (hasSessionBucket) { _%>
+  /**
+   * Removal policy for the session bucket holding the agent's conversation
+   * history. Defaults to retaining it so a stack `destroy` doesn't silently
+   * delete session data — set to `RemovalPolicy.DESTROY` for sandbox/CI teardown.
+   *
+   * @default RemovalPolicy.RETAIN
+   */
+  readonly sessionBucketRemovalPolicy?: RemovalPolicy;
+<%_ } _%>
+<%_ if (session === 'dynamodb-s3') { _%>
+  /**
+   * Whether to enable deletion protection on the session checkpoint table.
+   * Set to `false` to allow a stack `destroy` to remove it (e.g. for
+   * sandbox/CI teardown).
+   *
+   * @default true
+   */
+  readonly sessionTableDeletionProtection?: boolean;
+  /**
+   * Removal policy for the session checkpoint table.
+   *
+   * @default RemovalPolicy.RETAIN
+   */
+  readonly sessionTableRemovalPolicy?: RemovalPolicy;
+<%_ } _%>
+}<%_ } _%>;
 <%_ } else if (auth === 'cognito') { _%>
 export type <%- nameClassName %>Props = Omit<
   RuntimeProps,
@@ -57,6 +93,32 @@ export type <%- nameClassName %>Props = Omit<
     userPool: IUserPool;
     userPoolClient: IUserPoolClient;
   };
+<%_ if (hasSessionBucket) { _%>
+  /**
+   * Removal policy for the session bucket holding the agent's conversation
+   * history. Defaults to retaining it so a stack `destroy` doesn't silently
+   * delete session data — set to `RemovalPolicy.DESTROY` for sandbox/CI teardown.
+   *
+   * @default RemovalPolicy.RETAIN
+   */
+  readonly sessionBucketRemovalPolicy?: RemovalPolicy;
+<%_ } _%>
+<%_ if (session === 'dynamodb-s3') { _%>
+  /**
+   * Whether to enable deletion protection on the session checkpoint table.
+   * Set to `false` to allow a stack `destroy` to remove it (e.g. for
+   * sandbox/CI teardown).
+   *
+   * @default true
+   */
+  readonly sessionTableDeletionProtection?: boolean;
+  /**
+   * Removal policy for the session checkpoint table.
+   *
+   * @default RemovalPolicy.RETAIN
+   */
+  readonly sessionTableRemovalPolicy?: RemovalPolicy;
+<%_ } _%>
 };
 <%_ } _%>
 
@@ -88,11 +150,23 @@ export class <%- nameClassName %> extends Construct implements IGrantable, IConn
       platform: Platform.LINUX_ARM64,
     });
 
+<%_ if (auth === 'cognito' || hasSessionBucket) { _%>
+    const {
 <%_ if (auth === 'cognito') { _%>
-    const { identity, ...restProps } = props;
+      identity,
+<%_ } _%>
+<%_ if (hasSessionBucket) { _%>
+      sessionBucketRemovalPolicy = RemovalPolicy.RETAIN,
+<%_ } _%>
+<%_ if (session === 'dynamodb-s3') { _%>
+      sessionTableDeletionProtection = true,
+      sessionTableRemovalPolicy = RemovalPolicy.RETAIN,
+<%_ } _%>
+      ...restProps
+    } = props ?? {};
 
 <%_ } _%>
-<%_ if (session === 's3') { _%>
+<%_ if (hasSessionBucket) { _%>
     const sessionKey = new Key(this, 'SessionKey', {
       enableKeyRotation: true,
     });
@@ -127,7 +201,7 @@ export class <%- nameClassName %> extends Construct implements IGrantable, IConn
 
     const sessionBucket = new Bucket(this, 'SessionBucket', {
       enforceSSL: true,
-      removalPolicy: RemovalPolicy.RETAIN,
+      removalPolicy: sessionBucketRemovalPolicy,
       encryption: BucketEncryption.KMS,
       encryptionKey: sessionKey,
       blockPublicAccess: BlockPublicAccess.BLOCK_ALL,
@@ -196,6 +270,22 @@ export class <%- nameClassName %> extends Construct implements IGrantable, IConn
     );
     sessionAccessLogsDelivery.addDependency(sessionAccessLogsSource);
 
+<%_ } _%>
+<%_ if (session === 'dynamodb-s3') { _%>
+    // Unified checkpoints/writes table, matching the schema
+    // langgraph_checkpoint_aws.DynamoDBSaver expects (PK/SK, TTL on `ttl`).
+    const sessionTable = new Table(this, 'SessionTable', {
+      partitionKey: { name: 'PK', type: AttributeType.STRING },
+      sortKey: { name: 'SK', type: AttributeType.STRING },
+      billingMode: BillingMode.PAY_PER_REQUEST,
+      pointInTimeRecoverySpecification: { pointInTimeRecoveryEnabled: true },
+      timeToLiveAttribute: 'ttl',
+      encryption: TableEncryption.CUSTOMER_MANAGED,
+      encryptionKey: sessionKey,
+      deletionProtection: sessionTableDeletionProtection,
+      removalPolicy: sessionTableRemovalPolicy,
+    });
+
 <%_ } _%>
     this.agentCoreRuntime = new Runtime(this, '<%- nameClassName %>', {
       runtimeName: Lazy.string({
@@ -213,13 +303,15 @@ export class <%- nameClassName %> extends Construct implements IGrantable, IConn
       requestHeaderConfiguration: {
         allowlistedHeaders: ['Authorization'],
       },
+<%_ } _%>
+<%_ if (auth === 'cognito' || hasSessionBucket) { _%>
       ...restProps,
 <%_ } else { _%>
       ...props,
 <%_ } _%>
       environmentVariables: {
         RUNTIME_CONFIG_APP_ID: rc.appConfigApplicationId,
-<%_ if (auth === 'cognito') { _%>
+<%_ if (auth === 'cognito' || hasSessionBucket) { _%>
         ...restProps?.environmentVariables,
 <%_ } else { _%>
         ...props?.environmentVariables,
@@ -243,18 +335,26 @@ export class <%- nameClassName %> extends Construct implements IGrantable, IConn
     );
 
 <%_ } _%>
-<%_ if (session === 's3') { _%>
+<%_ if (session === 'dynamodb-s3') { _%>
+    sessionTable.grantReadWriteData(this.agentCoreRuntime);
+<%_ } _%>
+<%_ if (hasSessionBucket) { _%>
     sessionBucket.grantReadWrite(this.agentCoreRuntime);
-
 <%_ } _%>
+
     rc.grantReadAppConfig(this.agentCoreRuntime);
 
     rc.set('agentcore', 'agentRuntimes', {
       ...rc.get('agentcore').agentRuntimes,
       <%- nameClassName %>: {
         arn: this.agentCoreRuntime.agentRuntimeArn,
-<%_ if (session === 's3') { _%>
-        session: { bucketName: sessionBucket.bucketName },
+<%_ if (hasSessionBucket) { _%>
+        session: {
+<%_ if (session === 'dynamodb-s3') { _%>
+          tableName: sessionTable.tableName,
+<%_ } _%>
+          bucketName: sessionBucket.bucketName,
+        },
 <%_ } _%>
       },
     });

package/src/utils/agent-core-constructs/files/terraform/app/agent-core/__nameKebabCase__/__nameKebabCase__.tf.template

@@ -1,4 +1,5 @@
-<%_ if (session === 's3') { _%>
+<%_ const hasSessionBucket = session === 's3' || session === 'dynamodb-s3'; _%>
+<%_ if (hasSessionBucket) { _%>
 terraform {
   required_providers {
     random = {
@@ -55,6 +56,22 @@ variable "appconfig_application_id" {
   type        = string
 }
 
+<%_ if (hasSessionBucket) { _%>
+variable "session_force_destroy" {
+  description = "Whether to allow the session bucket to be destroyed even if it still contains objects."
+  type        = bool
+  default     = false
+}
+
+<%_ } _%>
+<%_ if (session === 'dynamodb-s3') { _%>
+variable "session_deletion_protection_enabled" {
+  description = "Whether to enable deletion protection on the session checkpoint table."
+  type        = bool
+  default     = true
+}
+
+<%_ } _%>
 variable "appconfig_application_arn" {
   description = "ARN of the shared runtime-config AppConfig application (from `core/runtime-config/appconfig.application_arn`). Used to scope the IAM read permission granted to the agent runtime."
   type        = string
@@ -72,10 +89,10 @@ variable "user_pool_client_ids" {
 }
 
 <%_ } _%>
-<%_ if (auth === 'cognito' || session === 's3') { _%>
+<%_ if (auth === 'cognito' || hasSessionBucket) { _%>
 data "aws_region" "current" {}
 <%_ } _%>
-<%_ if (session === 's3') { _%>
+<%_ if (hasSessionBucket) { _%>
 data "aws_caller_identity" "current" {}
 <%_ } _%>
 <%_ if (auth === 'cognito') { _%>
@@ -84,7 +101,7 @@ locals {
   aws_region = data.aws_region.current.id
 }
 <%_ } _%>
-<%_ if (session === 's3') { _%>
+<%_ if (hasSessionBucket) { _%>
 
 locals {
   # Delivery source/destination names have a 60 character maximum. Truncate
@@ -149,12 +166,13 @@ resource "aws_cloudwatch_log_group" "session_access_logs" {
 
 # Bucket storing the agent's session data
 resource "aws_s3_bucket" "session" {
+  bucket = "<%= nameKebabCase %>-sessions-${random_id.session_unique_suffix.hex}"
   #checkov:skip=CKV2_AWS_61:Lifecycle configuration not required for session data
   #checkov:skip=CKV_AWS_144:Cross-region replication not required for session data
   #checkov:skip=CKV2_AWS_62:Event notifications not required for session data
   #checkov:skip=CKV_AWS_18:Server access logs are delivered to CloudWatch Logs (see aws_cloudwatch_log_delivery.session)
   #checkov:skip=CKV_AWS_21:Session data does not need versioning enabled
-  force_destroy = false
+  force_destroy = var.session_force_destroy
 }
 
 resource "aws_s3_bucket_server_side_encryption_configuration" "session" {
@@ -222,6 +240,45 @@ resource "aws_cloudwatch_log_delivery" "session" {
   delivery_destination_arn = aws_cloudwatch_log_delivery_destination.session.arn
 }
 
+<%_ } _%>
+<%_ if (session === 'dynamodb-s3') { _%>
+# Unified checkpoints/writes table, matching the schema
+# langgraph_checkpoint_aws.DynamoDBSaver expects (PK/SK, TTL on `ttl`).
+resource "aws_dynamodb_table" "session" {
+  name         = "<%= nameKebabCase %>-checkpoints-${random_id.session_unique_suffix.hex}"
+  billing_mode = "PAY_PER_REQUEST"
+  hash_key     = "PK"
+  range_key    = "SK"
+
+  attribute {
+    name = "PK"
+    type = "S"
+  }
+
+  attribute {
+    name = "SK"
+    type = "S"
+  }
+
+  ttl {
+    attribute_name = "ttl"
+    enabled        = true
+  }
+
+  point_in_time_recovery {
+    enabled = true
+  }
+
+  server_side_encryption {
+    enabled     = true
+    kms_key_arn = aws_kms_key.session.arn
+  }
+
+  deletion_protection_enabled = var.session_deletion_protection_enabled
+
+  tags = var.tags
+}
+
 <%_ } _%>
 module "agent_core_runtime" {
   source = "../../../core/agent-core"
@@ -263,7 +320,7 @@ module "agent_core_runtime" {
         "arn:aws:bedrock:*:*:foundation-model/*",
         "arn:aws:bedrock:*:*:inference-profile/*"
       ]
-    }<% } %><% if (session === 's3') { %>,
+    }<% } %><% if (hasSessionBucket) { %>,
     # Grant access for the agent to read/write its session data
     {
       Effect = "Allow"
@@ -286,6 +343,18 @@ module "agent_core_runtime" {
         "kms:GenerateDataKey*"
       ]
       Resource = [aws_kms_key.session.arn]
+    }<% } %><% if (session === 'dynamodb-s3') { %>,
+    # Grant access for the agent to read/write its checkpoint table
+    {
+      Effect = "Allow"
+      Action = [
+        "dynamodb:GetItem",
+        "dynamodb:PutItem",
+        "dynamodb:Query",
+        "dynamodb:BatchGetItem",
+        "dynamodb:BatchWriteItem"
+      ]
+      Resource = [aws_dynamodb_table.session.arn]
     }<% } %>
   ], var.additional_iam_policy_statements)
   tags = var.tags
@@ -297,7 +366,7 @@ module "add_agent_runtime_to_runtime_config" {
 
   namespace = "agentcore"
   key       = "agentRuntimes"
-  value     = { "<%= nameClassName %>" = { arn = module.agent_core_runtime.agent_core_runtime_arn<% if (session === 's3') { %>, session = { bucketName = aws_s3_bucket.session.bucket }<% } %> } }
+  value     = { "<%= nameClassName %>" = { arn = module.agent_core_runtime.agent_core_runtime_arn<% if (hasSessionBucket) { %>, session = { <% if (session === 'dynamodb-s3') { %>tableName = aws_dynamodb_table.session.name, <% } %>bucketName = aws_s3_bucket.session.bucket }<% } %> } }
 
   depends_on = [module.agent_core_runtime]
 }

package/src/utils/versions.d.ts

@@ -170,6 +170,7 @@ export declare const PY_VERSIONS: {
     readonly 'ag-ui-langgraph': "==0.0.42";
     readonly 'ag-ui-protocol': "==0.1.19";
     readonly 'ag-ui-strands': "==0.2.4";
+    readonly aiosqlite: "==0.22.1";
     readonly 'aws-lambda-powertools': "==3.31.1";
     readonly 'aws-lambda-powertools[tracer]': "==3.31.1";
     readonly 'aws-lambda-powertools[parser]': "==3.31.1";
@@ -184,6 +185,8 @@ export declare const PY_VERSIONS: {
     readonly 'langchain-aws': "==1.7.0";
     readonly 'langchain-mcp-adapters': "==0.3.2";
     readonly langgraph: "==1.2.10";
+    readonly 'langgraph-checkpoint-aws': "==1.2.0";
+    readonly 'langgraph-checkpoint-sqlite': "==3.1.1";
     readonly mcp: "==1.28.1";
     readonly 'pip-check-updates': "==0.29.0";
     readonly 'pip-licenses': "==5.5.5";

package/src/utils/versions.js

@@ -185,6 +185,7 @@
     'ag-ui-langgraph': '==0.0.42',
     'ag-ui-protocol': '==0.1.19',
     'ag-ui-strands': '==0.2.4',
+    aiosqlite: '==0.22.1',
     'aws-lambda-powertools': '==3.31.1',
     'aws-lambda-powertools[tracer]': '==3.31.1',
     'aws-lambda-powertools[parser]': '==3.31.1',
@@ -199,6 +200,8 @@
     'langchain-aws': '==1.7.0',
     'langchain-mcp-adapters': '==0.3.2',
     langgraph: '==1.2.10',
+    'langgraph-checkpoint-aws': '==1.2.0',
+    'langgraph-checkpoint-sqlite': '==3.1.1',
     mcp: '==1.28.1',
     'pip-check-updates': '==0.29.0',
     'pip-licenses': '==5.5.5',