@aws/nx-plugin 1.0.0-rc.8 → 1.0.0-rc.80

package/src/utils/containers.js

@@ -1,16 +1,20 @@
-"use strict";
-Object.defineProperty(exports, "__esModule", { value: true });
-exports.resolveContainers = exports.inferContainers = exports.CONTAINER_ENGINES = void 0;
-const child_process_1 = require("child_process");
-const utils_1 = require("./config/utils");
-exports.CONTAINER_ENGINES = ['docker', 'finch'];
-const isOnPath = (binary) => {
+/**
+ * Copyright Amazon.com, Inc. or its affiliates. All Rights Reserved.
+ * SPDX-License-Identifier: Apache-2.0
+ */ import { execSync } from "child_process";
+import { AWS_NX_PLUGIN_CONFIG_FILE_NAME, readAwsNxPluginConfig } from "./config/utils.js";
+export const CONTAINER_ENGINES = [
+    'docker',
+    'finch'
+];
+const isOnPath = (binary)=>{
     try {
         const which = process.platform === 'win32' ? 'where' : 'command -v';
-        (0, child_process_1.execSync)(`${which} ${binary}`, { stdio: 'ignore' });
+        execSync(`${which} ${binary}`, {
+            stdio: 'ignore'
+        });
         return true;
-    }
-    catch {
+    } catch  {
         return false;
     }
 };
@@ -18,30 +22,25 @@ const isOnPath = (binary) => {
  * Detect which container engine is available on the host. Prefers docker;
  * falls back to finch when only finch is installed; defaults to docker
  * when neither is found.
- */
-const inferContainers = () => {
-    if (isOnPath('docker'))
-        return 'docker';
-    if (isOnPath('finch'))
-        return 'finch';
+ */ export const inferContainers = ()=>{
+    if (isOnPath('docker')) return 'docker';
+    if (isOnPath('finch')) return 'finch';
     return 'docker';
 };
-exports.inferContainers = inferContainers;
 /**
  * Given a container engine option, resolve the actual engine to use.
  * `Inherit` reads the value from the workspace plugin config, defaulting
  * to docker when nothing has been configured.
- */
-const resolveContainers = async (tree, option) => {
+ */ export const resolveContainers = async (tree, option)=>{
     if (option === 'inherit') {
-        const pluginConfig = await (0, utils_1.readAwsNxPluginConfig)(tree);
+        const pluginConfig = readAwsNxPluginConfig(tree);
         const engine = pluginConfig?.containers?.engine ?? 'docker';
-        if (!exports.CONTAINER_ENGINES.includes(engine)) {
-            throw new Error(`containers.engine in ${utils_1.AWS_NX_PLUGIN_CONFIG_FILE_NAME} must be one of ${exports.CONTAINER_ENGINES.join(', ')}`);
+        if (!CONTAINER_ENGINES.includes(engine)) {
+            throw new Error(`containers.engine in ${AWS_NX_PLUGIN_CONFIG_FILE_NAME} must be one of ${CONTAINER_ENGINES.join(', ')}`);
         }
         return engine;
     }
     return option;
 };
-exports.resolveContainers = resolveContainers;
+
 //# sourceMappingURL=containers.js.map

package/src/utils/containers.js.map

@@ -1 +1 @@
-{"version":3,"file":"containers.js","sourceRoot":"","sources":["../../../../../packages/nx-plugin/src/utils/containers.ts"],"names":[],"mappings":";;;AAKA,iDAAyC;AACzC,0CAGwB;AAEX,QAAA,iBAAiB,GAAG,CAAC,QAAQ,EAAE,OAAO,CAAU,CAAC;AAgB9D,MAAM,QAAQ,GAAG,CAAC,MAAc,EAAW,EAAE;IAC3C,IAAI,CAAC;QACH,MAAM,KAAK,GAAG,OAAO,CAAC,QAAQ,KAAK,OAAO,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,YAAY,CAAC;QACpE,IAAA,wBAAQ,EAAC,GAAG,KAAK,IAAI,MAAM,EAAE,EAAE,EAAE,KAAK,EAAE,QAAQ,EAAE,CAAC,CAAC;QACpD,OAAO,IAAI,CAAC;IACd,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,KAAK,CAAC;IACf,CAAC;AACH,CAAC,CAAC;AAEF;;;;GAIG;AACI,MAAM,eAAe,GAAG,GAAe,EAAE;IAC9C,IAAI,QAAQ,CAAC,QAAQ,CAAC;QAAE,OAAO,QAAQ,CAAC;IACxC,IAAI,QAAQ,CAAC,OAAO,CAAC;QAAE,OAAO,OAAO,CAAC;IACtC,OAAO,QAAQ,CAAC;AAClB,CAAC,CAAC;AAJW,QAAA,eAAe,mBAI1B;AAEF;;;;GAIG;AACI,MAAM,iBAAiB,GAAG,KAAK,EACpC,IAAU,EACV,MAAwB,EACH,EAAE;IACvB,IAAI,MAAM,KAAK,SAAS,EAAE,CAAC;QACzB,MAAM,YAAY,GAAG,MAAM,IAAA,6BAAqB,EAAC,IAAI,CAAC,CAAC;QACvD,MAAM,MAAM,GAAG,YAAY,EAAE,UAAU,EAAE,MAAM,IAAI,QAAQ,CAAC;QAC5D,IAAI,CAAC,yBAAiB,CAAC,QAAQ,CAAC,MAAM,CAAC,EAAE,CAAC;YACxC,MAAM,IAAI,KAAK,CACb,wBAAwB,sCAA8B,mBAAmB,yBAAiB,CAAC,IAAI,CAC7F,IAAI,CACL,EAAE,CACJ,CAAC;QACJ,CAAC;QACD,OAAO,MAAM,CAAC;IAChB,CAAC;IACD,OAAO,MAAM,CAAC;AAChB,CAAC,CAAC;AAjBW,QAAA,iBAAiB,qBAiB5B"}
+{"version":3,"sources":["../../../../../packages/nx-plugin/src/utils/containers.ts"],"sourcesContent":["/**\n * Copyright Amazon.com, Inc. or its affiliates. All Rights Reserved.\n * SPDX-License-Identifier: Apache-2.0\n */\nimport type { Tree } from '@nx/devkit';\nimport { execSync } from 'child_process';\nimport {\n  AWS_NX_PLUGIN_CONFIG_FILE_NAME,\n  readAwsNxPluginConfig,\n} from './config/utils.js';\n\nexport const CONTAINER_ENGINES = ['docker', 'finch'] as const;\n\nexport type Containers = (typeof CONTAINER_ENGINES)[number];\n\nexport type ContainersOption = Containers | 'inherit';\n\n/**\n * Configuration for container tooling\n */\nexport interface ContainersConfig {\n  /**\n   * Container engine used for build/push/login operations\n   */\n  engine: Containers;\n}\n\nconst isOnPath = (binary: string): boolean => {\n  try {\n    const which = process.platform === 'win32' ? 'where' : 'command -v';\n    execSync(`${which} ${binary}`, { stdio: 'ignore' });\n    return true;\n  } catch {\n    return false;\n  }\n};\n\n/**\n * Detect which container engine is available on the host. Prefers docker;\n * falls back to finch when only finch is installed; defaults to docker\n * when neither is found.\n */\nexport const inferContainers = (): Containers => {\n  if (isOnPath('docker')) return 'docker';\n  if (isOnPath('finch')) return 'finch';\n  return 'docker';\n};\n\n/**\n * Given a container engine option, resolve the actual engine to use.\n * `Inherit` reads the value from the workspace plugin config, defaulting\n * to docker when nothing has been configured.\n */\nexport const resolveContainers = async (\n  tree: Tree,\n  option: ContainersOption,\n): Promise<Containers> => {\n  if (option === 'inherit') {\n    const pluginConfig = readAwsNxPluginConfig(tree);\n    const engine = pluginConfig?.containers?.engine ?? 'docker';\n    if (!CONTAINER_ENGINES.includes(engine)) {\n      throw new Error(\n        `containers.engine in ${AWS_NX_PLUGIN_CONFIG_FILE_NAME} must be one of ${CONTAINER_ENGINES.join(\n          ', ',\n        )}`,\n      );\n    }\n    return engine;\n  }\n  return option;\n};\n"],"names":["execSync","AWS_NX_PLUGIN_CONFIG_FILE_NAME","readAwsNxPluginConfig","CONTAINER_ENGINES","isOnPath","binary","which","process","platform","stdio","inferContainers","resolveContainers","tree","option","pluginConfig","engine","containers","includes","Error","join"],"mappings":"AAAA;;;CAGC,GAED,SAASA,QAAQ,QAAQ,gBAAgB;AACzC,SACEC,8BAA8B,EAC9BC,qBAAqB,QAChB,oBAAoB;AAE3B,OAAO,MAAMC,oBAAoB;IAAC;IAAU;CAAQ,CAAU;AAgB9D,MAAMC,WAAW,CAACC;IAChB,IAAI;QACF,MAAMC,QAAQC,QAAQC,QAAQ,KAAK,UAAU,UAAU;QACvDR,SAAS,GAAGM,MAAM,CAAC,EAAED,QAAQ,EAAE;YAAEI,OAAO;QAAS;QACjD,OAAO;IACT,EAAE,OAAM;QACN,OAAO;IACT;AACF;AAEA;;;;CAIC,GACD,OAAO,MAAMC,kBAAkB;IAC7B,IAAIN,SAAS,WAAW,OAAO;IAC/B,IAAIA,SAAS,UAAU,OAAO;IAC9B,OAAO;AACT,EAAE;AAEF;;;;CAIC,GACD,OAAO,MAAMO,oBAAoB,OAC/BC,MACAC;IAEA,IAAIA,WAAW,WAAW;QACxB,MAAMC,eAAeZ,sBAAsBU;QAC3C,MAAMG,SAASD,cAAcE,YAAYD,UAAU;QACnD,IAAI,CAACZ,kBAAkBc,QAAQ,CAACF,SAAS;YACvC,MAAM,IAAIG,MACR,CAAC,qBAAqB,EAAEjB,+BAA+B,gBAAgB,EAAEE,kBAAkBgB,IAAI,CAC7F,OACC;QAEP;QACA,OAAOJ;IACT;IACA,OAAOF;AACT,EAAE"}

package/src/utils/dcr-proxy-constructs/dcr-proxy-constructs.d.ts

@@ -0,0 +1,38 @@
+/**
+ * Copyright Amazon.com, Inc. or its affiliates. All Rights Reserved.
+ * SPDX-License-Identifier: Apache-2.0
+ */
+import { type Tree } from '@nx/devkit';
+import type { Iac } from '../iac.js';
+/**
+ * The DCR proxy Lambda handlers. Each is bundled independently and wired to a
+ * dedicated route on the HTTP API.
+ */
+export declare const DCR_PROXY_HANDLERS: readonly ["authorization-server-metadata", "authorize", "mcp-proxy", "protected-resource-metadata", "register", "token"];
+export type DcrProxyHandler = (typeof DCR_PROXY_HANDLERS)[number];
+export interface AddDcrProxyInfraProps {
+    dcrProxyNameClassName: string;
+    dcrProxyNameKebabCase: string;
+    /**
+     * Fully qualified name of the TypeScript project that owns the bundled
+     * handlers, used to wire the shared package build to depend on it.
+     */
+    proxyProjectName: string;
+    /**
+     * Map of handler name to the workspace-root-relative path of its bundle
+     * output directory (e.g. `dist/packages/dcr-proxy/bundle/token`).
+     */
+    bundlePathsFromRoot: Record<DcrProxyHandler, string>;
+    iac: Iac;
+}
+/**
+ * Add a DCR proxy infrastructure (CDK construct or Terraform module) to the
+ * relevant shared package.
+ *
+ * The infrastructure exposes props/variables for the caller to inject their
+ * Cognito identifiers and the upstream MCP server URL from their own stack,
+ * since these may or may not be generated by this plugin. The Lambda handlers
+ * live in a standalone TypeScript project and are bundled by rolldown; both
+ * IaC providers reference the same bundle output.
+ */
+export declare const addDcrProxyInfra: (tree: Tree, options: AddDcrProxyInfraProps) => Promise<void>;

package/src/utils/dcr-proxy-constructs/dcr-proxy-constructs.js

@@ -0,0 +1,93 @@
+/**
+ * Copyright Amazon.com, Inc. or its affiliates. All Rights Reserved.
+ * SPDX-License-Identifier: Apache-2.0
+ */ import { generateFiles, joinPathFragments, OverwriteStrategy, updateJson } from "@nx/devkit";
+import { addStarExport } from "../ast.js";
+import { esmVars } from "../module-format.js";
+import { addDependencyToTargetIfNotPresent } from "../nx.js";
+import { PACKAGES_DIR, SHARED_CONSTRUCTS_DIR, SHARED_TERRAFORM_DIR } from "../shared-constructs-constants.js";
+import { terraformProviderVersions } from "../versions.js";
+/**
+ * The DCR proxy Lambda handlers. Each is bundled independently and wired to a
+ * dedicated route on the HTTP API.
+ */ export const DCR_PROXY_HANDLERS = [
+    'authorization-server-metadata',
+    'authorize',
+    'mcp-proxy',
+    'protected-resource-metadata',
+    'register',
+    'token'
+];
+/**
+ * Add a DCR proxy infrastructure (CDK construct or Terraform module) to the
+ * relevant shared package.
+ *
+ * The infrastructure exposes props/variables for the caller to inject their
+ * Cognito identifiers and the upstream MCP server URL from their own stack,
+ * since these may or may not be generated by this plugin. The Lambda handlers
+ * live in a standalone TypeScript project and are bundled by rolldown; both
+ * IaC providers reference the same bundle output.
+ */ export const addDcrProxyInfra = async (tree, options)=>{
+    if (options.iac === 'cdk') {
+        await addDcrProxyCdkConstructs(tree, options);
+    } else if (options.iac === 'terraform') {
+        addDcrProxyTerraformModules(tree, options);
+    } else {
+        throw new Error(`Unsupported iac ${options.iac}`);
+    }
+    // Ensure the handler bundles are built before the shared package
+    updateJson(tree, joinPathFragments(PACKAGES_DIR, options.iac === 'cdk' ? SHARED_CONSTRUCTS_DIR : SHARED_TERRAFORM_DIR, 'project.json'), (config)=>{
+        addDependencyToTargetIfNotPresent(config, 'build', `${options.proxyProjectName}:build`);
+        return config;
+    });
+};
+/**
+ * Add the DCR proxy CDK construct to the shared constructs package.
+ */ const addDcrProxyCdkConstructs = async (tree, options)=>{
+    // Ensure the core HTTP API construct + utils are available (the proxy reuses
+    // them). These are shared with the api generators and safe to (re)generate
+    // with KeepExisting.
+    for (const coreApiFile of [
+        'http',
+        'utils'
+    ]){
+        generateFiles(tree, joinPathFragments(import.meta.dirname, '..', 'api-constructs', 'files', 'cdk', 'core', 'api', coreApiFile), joinPathFragments(PACKAGES_DIR, SHARED_CONSTRUCTS_DIR, 'src', 'core', 'api'), {
+            ...esmVars(tree)
+        }, {
+            overwriteStrategy: OverwriteStrategy.KeepExisting
+        });
+    }
+    generateFiles(tree, joinPathFragments(import.meta.dirname, 'files', 'cdk', 'app', 'dcr-proxies'), joinPathFragments(PACKAGES_DIR, SHARED_CONSTRUCTS_DIR, 'src', 'app', 'dcr-proxies'), {
+        nameClassName: options.dcrProxyNameClassName,
+        nameKebabCase: options.dcrProxyNameKebabCase,
+        bundlePathsFromRoot: options.bundlePathsFromRoot,
+        ...esmVars(tree)
+    }, {
+        overwriteStrategy: OverwriteStrategy.KeepExisting
+    });
+    // Export the construct
+    await addStarExport(tree, joinPathFragments(PACKAGES_DIR, SHARED_CONSTRUCTS_DIR, 'src', 'app', 'dcr-proxies', 'index.ts'), `./${options.dcrProxyNameKebabCase}/${options.dcrProxyNameKebabCase}.js`);
+    await addStarExport(tree, joinPathFragments(PACKAGES_DIR, SHARED_CONSTRUCTS_DIR, 'src', 'app', 'index.ts'), './dcr-proxies/index.js');
+};
+/**
+ * Add the DCR proxy Terraform module to the shared terraform package.
+ */ const addDcrProxyTerraformModules = (tree, options)=>{
+    // Ensure the core HTTP API module is available (the proxy reuses it). This is
+    // shared with the api generators and safe to (re)generate with KeepExisting.
+    generateFiles(tree, joinPathFragments(import.meta.dirname, '..', 'api-constructs', 'files', 'terraform', 'core', 'api', 'http'), joinPathFragments(PACKAGES_DIR, SHARED_TERRAFORM_DIR, 'src', 'core', 'api'), {
+        ...terraformProviderVersions()
+    }, {
+        overwriteStrategy: OverwriteStrategy.KeepExisting
+    });
+    // Generate the app specific terraform module
+    generateFiles(tree, joinPathFragments(import.meta.dirname, 'files', 'terraform', 'app', 'dcr-proxies'), joinPathFragments(PACKAGES_DIR, SHARED_TERRAFORM_DIR, 'src', 'app', 'dcr-proxies'), {
+        nameClassName: options.dcrProxyNameClassName,
+        nameKebabCase: options.dcrProxyNameKebabCase,
+        bundlePathsFromRoot: options.bundlePathsFromRoot,
+        ...terraformProviderVersions()
+    }, {
+        overwriteStrategy: OverwriteStrategy.KeepExisting
+    });
+};
+
+//# sourceMappingURL=dcr-proxy-constructs.js.map

package/src/utils/dcr-proxy-constructs/dcr-proxy-constructs.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../../../../../../packages/nx-plugin/src/utils/dcr-proxy-constructs/dcr-proxy-constructs.ts"],"sourcesContent":["/**\n * Copyright Amazon.com, Inc. or its affiliates. All Rights Reserved.\n * SPDX-License-Identifier: Apache-2.0\n */\nimport {\n  generateFiles,\n  joinPathFragments,\n  OverwriteStrategy,\n  type ProjectConfiguration,\n  type Tree,\n  updateJson,\n} from '@nx/devkit';\nimport { addStarExport } from '../ast.js';\nimport type { Iac } from '../iac.js';\nimport { esmVars } from '../module-format.js';\nimport { addDependencyToTargetIfNotPresent } from '../nx.js';\nimport {\n  PACKAGES_DIR,\n  SHARED_CONSTRUCTS_DIR,\n  SHARED_TERRAFORM_DIR,\n} from '../shared-constructs-constants.js';\nimport { terraformProviderVersions } from '../versions.js';\n\n/**\n * The DCR proxy Lambda handlers. Each is bundled independently and wired to a\n * dedicated route on the HTTP API.\n */\nexport const DCR_PROXY_HANDLERS = [\n  'authorization-server-metadata',\n  'authorize',\n  'mcp-proxy',\n  'protected-resource-metadata',\n  'register',\n  'token',\n] as const;\n\nexport type DcrProxyHandler = (typeof DCR_PROXY_HANDLERS)[number];\n\nexport interface AddDcrProxyInfraProps {\n  dcrProxyNameClassName: string;\n  dcrProxyNameKebabCase: string;\n\n  /**\n   * Fully qualified name of the TypeScript project that owns the bundled\n   * handlers, used to wire the shared package build to depend on it.\n   */\n  proxyProjectName: string;\n\n  /**\n   * Map of handler name to the workspace-root-relative path of its bundle\n   * output directory (e.g. `dist/packages/dcr-proxy/bundle/token`).\n   */\n  bundlePathsFromRoot: Record<DcrProxyHandler, string>;\n\n  iac: Iac;\n}\n\n/**\n * Add a DCR proxy infrastructure (CDK construct or Terraform module) to the\n * relevant shared package.\n *\n * The infrastructure exposes props/variables for the caller to inject their\n * Cognito identifiers and the upstream MCP server URL from their own stack,\n * since these may or may not be generated by this plugin. The Lambda handlers\n * live in a standalone TypeScript project and are bundled by rolldown; both\n * IaC providers reference the same bundle output.\n */\nexport const addDcrProxyInfra = async (\n  tree: Tree,\n  options: AddDcrProxyInfraProps,\n) => {\n  if (options.iac === 'cdk') {\n    await addDcrProxyCdkConstructs(tree, options);\n  } else if (options.iac === 'terraform') {\n    addDcrProxyTerraformModules(tree, options);\n  } else {\n    throw new Error(`Unsupported iac ${options.iac}`);\n  }\n\n  // Ensure the handler bundles are built before the shared package\n  updateJson(\n    tree,\n    joinPathFragments(\n      PACKAGES_DIR,\n      options.iac === 'cdk' ? SHARED_CONSTRUCTS_DIR : SHARED_TERRAFORM_DIR,\n      'project.json',\n    ),\n    (config: ProjectConfiguration) => {\n      addDependencyToTargetIfNotPresent(\n        config,\n        'build',\n        `${options.proxyProjectName}:build`,\n      );\n      return config;\n    },\n  );\n};\n\n/**\n * Add the DCR proxy CDK construct to the shared constructs package.\n */\nconst addDcrProxyCdkConstructs = async (\n  tree: Tree,\n  options: AddDcrProxyInfraProps,\n) => {\n  // Ensure the core HTTP API construct + utils are available (the proxy reuses\n  // them). These are shared with the api generators and safe to (re)generate\n  // with KeepExisting.\n  for (const coreApiFile of ['http', 'utils']) {\n    generateFiles(\n      tree,\n      joinPathFragments(\n        import.meta.dirname,\n        '..',\n        'api-constructs',\n        'files',\n        'cdk',\n        'core',\n        'api',\n        coreApiFile,\n      ),\n      joinPathFragments(\n        PACKAGES_DIR,\n        SHARED_CONSTRUCTS_DIR,\n        'src',\n        'core',\n        'api',\n      ),\n      { ...esmVars(tree) },\n      {\n        overwriteStrategy: OverwriteStrategy.KeepExisting,\n      },\n    );\n  }\n\n  generateFiles(\n    tree,\n    joinPathFragments(\n      import.meta.dirname,\n      'files',\n      'cdk',\n      'app',\n      'dcr-proxies',\n    ),\n    joinPathFragments(\n      PACKAGES_DIR,\n      SHARED_CONSTRUCTS_DIR,\n      'src',\n      'app',\n      'dcr-proxies',\n    ),\n    {\n      nameClassName: options.dcrProxyNameClassName,\n      nameKebabCase: options.dcrProxyNameKebabCase,\n      bundlePathsFromRoot: options.bundlePathsFromRoot,\n      ...esmVars(tree),\n    },\n    {\n      overwriteStrategy: OverwriteStrategy.KeepExisting,\n    },\n  );\n\n  // Export the construct\n  await addStarExport(\n    tree,\n    joinPathFragments(\n      PACKAGES_DIR,\n      SHARED_CONSTRUCTS_DIR,\n      'src',\n      'app',\n      'dcr-proxies',\n      'index.ts',\n    ),\n    `./${options.dcrProxyNameKebabCase}/${options.dcrProxyNameKebabCase}.js`,\n  );\n  await addStarExport(\n    tree,\n    joinPathFragments(\n      PACKAGES_DIR,\n      SHARED_CONSTRUCTS_DIR,\n      'src',\n      'app',\n      'index.ts',\n    ),\n    './dcr-proxies/index.js',\n  );\n};\n\n/**\n * Add the DCR proxy Terraform module to the shared terraform package.\n */\nconst addDcrProxyTerraformModules = (\n  tree: Tree,\n  options: AddDcrProxyInfraProps,\n) => {\n  // Ensure the core HTTP API module is available (the proxy reuses it). This is\n  // shared with the api generators and safe to (re)generate with KeepExisting.\n  generateFiles(\n    tree,\n    joinPathFragments(\n      import.meta.dirname,\n      '..',\n      'api-constructs',\n      'files',\n      'terraform',\n      'core',\n      'api',\n      'http',\n    ),\n    joinPathFragments(PACKAGES_DIR, SHARED_TERRAFORM_DIR, 'src', 'core', 'api'),\n    { ...terraformProviderVersions() },\n    {\n      overwriteStrategy: OverwriteStrategy.KeepExisting,\n    },\n  );\n\n  // Generate the app specific terraform module\n  generateFiles(\n    tree,\n    joinPathFragments(\n      import.meta.dirname,\n      'files',\n      'terraform',\n      'app',\n      'dcr-proxies',\n    ),\n    joinPathFragments(\n      PACKAGES_DIR,\n      SHARED_TERRAFORM_DIR,\n      'src',\n      'app',\n      'dcr-proxies',\n    ),\n    {\n      nameClassName: options.dcrProxyNameClassName,\n      nameKebabCase: options.dcrProxyNameKebabCase,\n      bundlePathsFromRoot: options.bundlePathsFromRoot,\n      ...terraformProviderVersions(),\n    },\n    {\n      overwriteStrategy: OverwriteStrategy.KeepExisting,\n    },\n  );\n};\n"],"names":["generateFiles","joinPathFragments","OverwriteStrategy","updateJson","addStarExport","esmVars","addDependencyToTargetIfNotPresent","PACKAGES_DIR","SHARED_CONSTRUCTS_DIR","SHARED_TERRAFORM_DIR","terraformProviderVersions","DCR_PROXY_HANDLERS","addDcrProxyInfra","tree","options","iac","addDcrProxyCdkConstructs","addDcrProxyTerraformModules","Error","config","proxyProjectName","coreApiFile","dirname","overwriteStrategy","KeepExisting","nameClassName","dcrProxyNameClassName","nameKebabCase","dcrProxyNameKebabCase","bundlePathsFromRoot"],"mappings":"AAAA;;;CAGC,GACD,SACEA,aAAa,EACbC,iBAAiB,EACjBC,iBAAiB,EAGjBC,UAAU,QACL,aAAa;AACpB,SAASC,aAAa,QAAQ,YAAY;AAE1C,SAASC,OAAO,QAAQ,sBAAsB;AAC9C,SAASC,iCAAiC,QAAQ,WAAW;AAC7D,SACEC,YAAY,EACZC,qBAAqB,EACrBC,oBAAoB,QACf,oCAAoC;AAC3C,SAASC,yBAAyB,QAAQ,iBAAiB;AAE3D;;;CAGC,GACD,OAAO,MAAMC,qBAAqB;IAChC;IACA;IACA;IACA;IACA;IACA;CACD,CAAU;AAuBX;;;;;;;;;CASC,GACD,OAAO,MAAMC,mBAAmB,OAC9BC,MACAC;IAEA,IAAIA,QAAQC,GAAG,KAAK,OAAO;QACzB,MAAMC,yBAAyBH,MAAMC;IACvC,OAAO,IAAIA,QAAQC,GAAG,KAAK,aAAa;QACtCE,4BAA4BJ,MAAMC;IACpC,OAAO;QACL,MAAM,IAAII,MAAM,CAAC,gBAAgB,EAAEJ,QAAQC,GAAG,EAAE;IAClD;IAEA,iEAAiE;IACjEZ,WACEU,MACAZ,kBACEM,cACAO,QAAQC,GAAG,KAAK,QAAQP,wBAAwBC,sBAChD,iBAEF,CAACU;QACCb,kCACEa,QACA,SACA,GAAGL,QAAQM,gBAAgB,CAAC,MAAM,CAAC;QAErC,OAAOD;IACT;AAEJ,EAAE;AAEF;;CAEC,GACD,MAAMH,2BAA2B,OAC/BH,MACAC;IAEA,6EAA6E;IAC7E,2EAA2E;IAC3E,qBAAqB;IACrB,KAAK,MAAMO,eAAe;QAAC;QAAQ;KAAQ,CAAE;QAC3CrB,cACEa,MACAZ,kBACE,YAAYqB,OAAO,EACnB,MACA,kBACA,SACA,OACA,QACA,OACAD,cAEFpB,kBACEM,cACAC,uBACA,OACA,QACA,QAEF;YAAE,GAAGH,QAAQQ,KAAK;QAAC,GACnB;YACEU,mBAAmBrB,kBAAkBsB,YAAY;QACnD;IAEJ;IAEAxB,cACEa,MACAZ,kBACE,YAAYqB,OAAO,EACnB,SACA,OACA,OACA,gBAEFrB,kBACEM,cACAC,uBACA,OACA,OACA,gBAEF;QACEiB,eAAeX,QAAQY,qBAAqB;QAC5CC,eAAeb,QAAQc,qBAAqB;QAC5CC,qBAAqBf,QAAQe,mBAAmB;QAChD,GAAGxB,QAAQQ,KAAK;IAClB,GACA;QACEU,mBAAmBrB,kBAAkBsB,YAAY;IACnD;IAGF,uBAAuB;IACvB,MAAMpB,cACJS,MACAZ,kBACEM,cACAC,uBACA,OACA,OACA,eACA,aAEF,CAAC,EAAE,EAAEM,QAAQc,qBAAqB,CAAC,CAAC,EAAEd,QAAQc,qBAAqB,CAAC,GAAG,CAAC;IAE1E,MAAMxB,cACJS,MACAZ,kBACEM,cACAC,uBACA,OACA,OACA,aAEF;AAEJ;AAEA;;CAEC,GACD,MAAMS,8BAA8B,CAClCJ,MACAC;IAEA,8EAA8E;IAC9E,6EAA6E;IAC7Ed,cACEa,MACAZ,kBACE,YAAYqB,OAAO,EACnB,MACA,kBACA,SACA,aACA,QACA,OACA,SAEFrB,kBAAkBM,cAAcE,sBAAsB,OAAO,QAAQ,QACrE;QAAE,GAAGC,2BAA2B;IAAC,GACjC;QACEa,mBAAmBrB,kBAAkBsB,YAAY;IACnD;IAGF,6CAA6C;IAC7CxB,cACEa,MACAZ,kBACE,YAAYqB,OAAO,EACnB,SACA,aACA,OACA,gBAEFrB,kBACEM,cACAE,sBACA,OACA,OACA,gBAEF;QACEgB,eAAeX,QAAQY,qBAAqB;QAC5CC,eAAeb,QAAQc,qBAAqB;QAC5CC,qBAAqBf,QAAQe,mBAAmB;QAChD,GAAGnB,2BAA2B;IAChC,GACA;QACEa,mBAAmBrB,kBAAkBsB,YAAY;IACnD;AAEJ"}

package/src/utils/dcr-proxy-constructs/files/cdk/app/dcr-proxies/__nameKebabCase__/__nameKebabCase__.ts.template

@@ -0,0 +1,227 @@
+import * as url from 'node:url';
+import { Construct } from 'constructs';
+import { Duration, Stack } from 'aws-cdk-lib';
+import * as apigwv2 from 'aws-cdk-lib/aws-apigatewayv2';
+import * as integrations from 'aws-cdk-lib/aws-apigatewayv2-integrations';
+import * as lambda from 'aws-cdk-lib/aws-lambda';
+import * as secretsmanager from 'aws-cdk-lib/aws-secretsmanager';
+import { HttpApi } from '../../../core/api/http-api<% if (esm) { %>.js<% } %>';
+import {
+  HttpApiIntegration,
+  OperationDetails,
+} from '../../../core/api/utils<% if (esm) { %>.js<% } %>';
+
+export interface <%- nameClassName %>Props {
+  /**
+   * Cognito User Pool id (e.g. `us-east-1_abc123`).
+   */
+  readonly userPoolId: string;
+
+  /**
+   * Cognito User Pool App Client id.
+   */
+  readonly userPoolClientId: string;
+
+  /**
+   * ARN of the Secrets Manager secret holding the Cognito App Client secret.
+   * The token handler reads this at runtime to complete the token exchange;
+   * the secret is never exposed to the client. Create the secret in your own
+   * stack (from your App Client's generated secret) and pass its ARN here.
+   */
+  readonly cognitoClientSecretArn: string;
+
+  /**
+   * Base URL of the Cognito Hosted UI domain, without a trailing slash
+   * (e.g. `https://my-domain.auth.us-east-1.amazoncognito.com`). The proxy
+   * forwards `/authorize` and `/oauth/token` to this host.
+   */
+  readonly cognitoHostedUiBase: string;
+
+  /**
+   * Full URL of the upstream MCP server (e.g. AgentCore Runtime/Gateway
+   * endpoint). The proxy forwards requests on its `/mcp` path to this URL and
+   * rewrites the upstream `WWW-Authenticate` header so MCP clients discover
+   * this proxy as the protected-resource metadata host.
+   */
+  readonly upstreamUrl: string;
+}
+
+// The proxy operations wired to the shared HttpApi construct. The
+// openid-configuration route reuses the authorization-server-metadata handler.
+type <%- nameClassName %>Operation =
+  | 'protectedResourceMetadata'
+  | 'authServerMetadata'
+  | 'openIdConfiguration'
+  | 'register'
+  | 'authorize'
+  | 'token'
+  | 'mcp';
+
+const OPERATIONS: Record<<%- nameClassName %>Operation, OperationDetails> = {
+  protectedResourceMetadata: {
+    path: '/.well-known/oauth-protected-resource',
+    method: 'GET',
+  },
+  authServerMetadata: {
+    path: '/.well-known/oauth-authorization-server',
+    method: 'GET',
+  },
+  openIdConfiguration: {
+    path: '/.well-known/openid-configuration',
+    method: 'GET',
+  },
+  register: { path: '/register', method: 'POST' },
+  authorize: { path: '/authorize', method: 'GET' },
+  token: { path: '/oauth/token', method: 'POST' },
+  mcp: { path: '/mcp', method: 'ANY' },
+};
+
+// Resolve a handler's rolldown bundle output directory, relative to this
+// compiled construct file, back to the workspace root.
+const asset = (bundlePathFromRoot: string): lambda.Code =>
+  lambda.Code.fromAsset(
+    url.fileURLToPath(
+      new URL(
+        `../../../../../../../${bundlePathFromRoot}`,
+        <% if (esm) { %>import.meta.url<% } else { %>require('url').pathToFileURL(__filename).href<% } %>,
+      ),
+    ),
+  );
+
+/**
+ * OAuth Dynamic Client Registration (DCR) proxy for Amazon Cognito.
+ *
+ * Lets MCP clients (Claude Code, Kiro CLI, MCP Inspector, ...) authenticate
+ * against an Amazon Cognito User Pool while keeping the Hosted UI flow intact,
+ * supporting RFC 7591 Dynamic Client Registration, and never exposing the
+ * Cognito App Client secret to the client.
+ */
+export class <%- nameClassName %> extends Construct {
+  readonly httpApi: HttpApi<
+    <%- nameClassName %>Operation,
+    Record<<%- nameClassName %>Operation, HttpApiIntegration>
+  >;
+  readonly proxyUrl: string;
+  readonly mcpUrl: string;
+  readonly metadataUrl: string;
+  readonly authServerMetadataUrl: string;
+  readonly tokenEndpoint: string;
+  readonly registrationEndpoint: string;
+
+  constructor(scope: Construct, id: string, props: <%- nameClassName %>Props) {
+    super(scope, id);
+
+    const region = Stack.of(this).region;
+
+    const clientSecret = secretsmanager.Secret.fromSecretCompleteArn(
+      this,
+      'CognitoClientSecret',
+      props.cognitoClientSecretArn,
+    );
+
+    const cognitoIssuer = `https://cognito-idp.${region}.amazonaws.com/${props.userPoolId}`;
+
+    const baseEnv: Record<string, string> = {
+      COGNITO_CLIENT_ID: props.userPoolClientId,
+      COGNITO_CLIENT_SECRET_ARN: clientSecret.secretArn,
+      COGNITO_ISSUER: cognitoIssuer,
+      COGNITO_HOSTED_UI_BASE: props.cognitoHostedUiBase,
+      COGNITO_REGION: region,
+    };
+
+    // Lambda functions use their auto-created log group; access logging for the
+    // API is handled by the shared HttpApi construct's KMS-encrypted log group.
+    const makeFn = (
+      id_: string,
+      bundlePathFromRoot: string,
+      overrides?: Partial<lambda.FunctionProps>,
+    ): lambda.Function =>
+      new lambda.Function(this, id_, {
+        code: asset(bundlePathFromRoot),
+        handler: 'index.handler',
+        runtime: lambda.Runtime.NODEJS_22_X,
+        architecture: lambda.Architecture.ARM_64,
+        timeout: Duration.seconds(10),
+        memorySize: 256,
+        environment: baseEnv,
+        tracing: lambda.Tracing.ACTIVE,
+        ...overrides,
+      });
+
+    const protectedResourceFn = makeFn(
+      'ProtectedResourceFn',
+      '<%- bundlePathsFromRoot['protected-resource-metadata'] %>',
+    );
+    const authServerFn = makeFn(
+      'AuthServerFn',
+      '<%- bundlePathsFromRoot['authorization-server-metadata'] %>',
+    );
+    const registerFn = makeFn(
+      'RegisterFn',
+      '<%- bundlePathsFromRoot['register'] %>',
+    );
+    const authorizeFn = makeFn(
+      'AuthorizeFn',
+      '<%- bundlePathsFromRoot['authorize'] %>',
+    );
+    const tokenFn = makeFn('TokenFn', '<%- bundlePathsFromRoot['token'] %>');
+
+    clientSecret.grantRead(tokenFn);
+
+    // The MCP proxy Lambda buffers upstream responses, so it is given more time
+    // (up to the API Gateway HTTP API integration limit) and memory.
+    const mcpProxyFn = makeFn(
+      'McpProxyFn',
+      '<%- bundlePathsFromRoot['mcp-proxy'] %>',
+      {
+        timeout: Duration.seconds(29),
+        memorySize: 512,
+      },
+    );
+
+    const int = (id_: string, fn: lambda.Function): HttpApiIntegration => ({
+      integration: new integrations.HttpLambdaIntegration(id_, fn),
+    });
+
+    this.httpApi = new HttpApi(this, 'HttpApi', {
+      apiName: `${id}-mcp-auth-proxy`,
+      description: 'MCP-compatible OAuth proxy for Amazon Cognito',
+      corsPreflight: {
+        allowOrigins: ['*'],
+        allowMethods: [
+          apigwv2.CorsHttpMethod.GET,
+          apigwv2.CorsHttpMethod.POST,
+          apigwv2.CorsHttpMethod.DELETE,
+          apigwv2.CorsHttpMethod.OPTIONS,
+        ],
+        allowHeaders: ['authorization', 'content-type', 'mcp-protocol-version'],
+        maxAge: Duration.minutes(10),
+      },
+      operations: OPERATIONS,
+      integrations: {
+        protectedResourceMetadata: int(
+          'ProtectedResourceInt',
+          protectedResourceFn,
+        ),
+        authServerMetadata: int('AuthServerInt', authServerFn),
+        openIdConfiguration: int('OpenIdConfigInt', authServerFn),
+        register: int('RegisterInt', registerFn),
+        authorize: int('AuthorizeInt', authorizeFn),
+        token: int('TokenInt', tokenFn),
+        mcp: int('McpProxyInt', mcpProxyFn),
+      },
+    });
+
+    this.proxyUrl = this.httpApi.api.apiEndpoint;
+    this.mcpUrl = `${this.proxyUrl}/mcp`;
+    this.metadataUrl = `${this.proxyUrl}/.well-known/oauth-protected-resource`;
+    this.authServerMetadataUrl = `${this.proxyUrl}/.well-known/oauth-authorization-server`;
+    this.tokenEndpoint = `${this.proxyUrl}/oauth/token`;
+    this.registrationEndpoint = `${this.proxyUrl}/register`;
+
+    // Wire the MCP proxy handler's upstream + metadata URLs after the API is
+    // created so its endpoint is resolvable.
+    mcpProxyFn.addEnvironment('UPSTREAM_URL', props.upstreamUrl);
+    mcpProxyFn.addEnvironment('PROXY_METADATA_URL', this.metadataUrl);
+  }
+}

package/src/utils/dcr-proxy-constructs/files/project/src/handlers/authorization-server-metadata.ts.template

@@ -0,0 +1,39 @@
+import type { APIGatewayProxyHandlerV2 } from 'aws-lambda';
+
+const COGNITO_ISSUER = process.env.COGNITO_ISSUER!;
+
+let cached: Record<string, unknown> | undefined;
+
+async function fetchUpstream(): Promise<Record<string, unknown>> {
+  if (cached) return cached;
+  const res = await fetch(`${COGNITO_ISSUER}/.well-known/openid-configuration`);
+  if (!res.ok) {
+    throw new Error(`Cognito discovery failed: ${res.status} ${res.statusText}`);
+  }
+  cached = (await res.json()) as Record<string, unknown>;
+  return cached;
+}
+
+export const handler: APIGatewayProxyHandlerV2 = async (event) => {
+  const proxyUrl = `https://${event.requestContext.domainName}`;
+  const upstream = await fetchUpstream();
+
+  // Override the proxy-handled endpoints.
+  // jwks_uri is kept as Cognito's so JWT verification works directly against
+  // Cognito. issuer is kept as Cognito's so JWT.iss validation matches.
+  // authorization_endpoint points to the proxy so we can strip the RFC 8707
+  // `resource` parameter that some MCP clients send (Cognito rejects token
+  // exchange for unregistered resource server URLs).
+  const metadata = {
+    ...upstream,
+    authorization_endpoint: `${proxyUrl}/authorize`,
+    token_endpoint: `${proxyUrl}/oauth/token`,
+    registration_endpoint: `${proxyUrl}/register`,
+  };
+
+  return {
+    statusCode: 200,
+    headers: { 'content-type': 'application/json' },
+    body: JSON.stringify(metadata),
+  };
+};

package/src/utils/dcr-proxy-constructs/files/project/src/handlers/authorize.ts.template

@@ -0,0 +1,26 @@
+import type { APIGatewayProxyHandlerV2 } from 'aws-lambda';
+
+const COGNITO_HOSTED_UI_BASE = process.env.COGNITO_HOSTED_UI_BASE!;
+
+export const handler: APIGatewayProxyHandlerV2 = async (event) => {
+  const params = new URLSearchParams(event.rawQueryString ?? '');
+
+  console.log('[authorize]', {
+    scope: params.get('scope'),
+    redirect_uri: params.get('redirect_uri'),
+    has_resource: params.has('resource'),
+  });
+
+  // RFC 8707 `resource` parameter binds the access token's `aud` claim to
+  // the given URL. Cognito accepts it at /authorize but rejects the token
+  // exchange with `invalid_grant` when the URL is not registered as a
+  // resource server. MCP clients send this unconditionally, so strip it.
+  params.delete('resource');
+
+  const target = `${COGNITO_HOSTED_UI_BASE}/oauth2/authorize?${params.toString()}`;
+  return {
+    statusCode: 302,
+    headers: { location: target },
+    body: '',
+  };
+};

package/src/utils/dcr-proxy-constructs/files/project/src/handlers/mcp-proxy.ts.template

@@ -0,0 +1,89 @@
+import type {
+  APIGatewayProxyHandlerV2,
+  APIGatewayProxyStructuredResultV2,
+} from 'aws-lambda';
+
+const UPSTREAM_URL = process.env.UPSTREAM_URL!;
+const PROXY_METADATA_URL = process.env.PROXY_METADATA_URL!;
+
+// Headers stripped when relaying requests/responses through the proxy:
+// RFC 7230 hop-by-hop headers (scoped to a single connection, not the next
+// hop), plus entity headers that fetch() re-derives from the actual body -
+// forwarding stale values would corrupt the response.
+const HOP_BY_HOP = new Set([
+  'connection',
+  'keep-alive',
+  'proxy-authenticate',
+  'proxy-authorization',
+  'te',
+  'trailers',
+  'transfer-encoding',
+  'upgrade',
+  'content-length',
+  'content-encoding',
+  'host',
+]);
+
+export const handler: APIGatewayProxyHandlerV2 = async (
+  event,
+): Promise<APIGatewayProxyStructuredResultV2> => {
+  const method = event.requestContext.http.method;
+  const qs = event.rawQueryString ? `?${event.rawQueryString}` : '';
+  const url = `${UPSTREAM_URL}${qs}`;
+
+  const fwdHeaders = new Headers();
+  for (const [k, v] of Object.entries(event.headers ?? {})) {
+    if (!v) continue;
+    if (HOP_BY_HOP.has(k.toLowerCase())) continue;
+    fwdHeaders.set(k, v);
+  }
+
+  const reqBody = event.body
+    ? event.isBase64Encoded
+      ? Buffer.from(event.body, 'base64')
+      : event.body
+    : undefined;
+
+  const upstream = await fetch(url, {
+    method,
+    headers: fwdHeaders,
+    body: reqBody as unknown as ArrayBuffer | string | undefined,
+  });
+
+  const respHeaders: Record<string, string> = {};
+  upstream.headers.forEach((v, k) => {
+    if (HOP_BY_HOP.has(k.toLowerCase())) return;
+    respHeaders[k] = v;
+  });
+
+  // Rewrite WWW-Authenticate so MCP clients discover this proxy
+  // as the protected-resource metadata host instead of the upstream.
+  const authKey = Object.keys(respHeaders).find(
+    (k) => k.toLowerCase() === 'www-authenticate',
+  );
+  if (authKey) {
+    respHeaders[authKey] = respHeaders[authKey].replace(
+      /resource_metadata="[^"]*"/i,
+      `resource_metadata="${PROXY_METADATA_URL}"`,
+    );
+  }
+
+  const buf = Buffer.from(await upstream.arrayBuffer());
+  const contentType = (
+    respHeaders['content-type'] ??
+    respHeaders['Content-Type'] ??
+    ''
+  ).toLowerCase();
+  const isText =
+    contentType.includes('json') ||
+    contentType.includes('text') ||
+    contentType.includes('xml') ||
+    contentType.includes('event-stream');
+
+  return {
+    statusCode: upstream.status,
+    headers: respHeaders,
+    body: isText ? buf.toString('utf-8') : buf.toString('base64'),
+    isBase64Encoded: !isText,
+  };
+};

package/src/utils/dcr-proxy-constructs/files/project/src/handlers/protected-resource-metadata.ts.template

@@ -0,0 +1,13 @@
+import type { APIGatewayProxyHandlerV2 } from 'aws-lambda';
+
+export const handler: APIGatewayProxyHandlerV2 = async (event) => {
+  const proxyUrl = `https://${event.requestContext.domainName}`;
+  return {
+    statusCode: 200,
+    headers: { 'content-type': 'application/json' },
+    body: JSON.stringify({
+      resource: `${proxyUrl}/mcp`,
+      authorization_servers: [proxyUrl],
+    }),
+  };
+};