@aws/nx-plugin 1.0.0-rc.82 → 1.0.0-rc.83

package/migrations.json

@@ -32,6 +32,21 @@
       "description": "Provision AppConfig configuration profiles for every namespace the vended terraform modules write to",
       "implementation": "./src/migrations/latest/runtime-config-namespace-defaults/migration"
     },
+    "latest-dynamodb-terraform-app-module-outputs": {
+      "version": "1.0.0-rc.83",
+      "description": "Re-export the DynamoDB table and KMS key attributes from the vended Terraform per-table app module",
+      "implementation": "./src/migrations/latest/dynamodb-terraform-app-module-outputs/migration"
+    },
+    "latest-terraform-data-resource-destroy-protection": {
+      "version": "1.0.0-rc.83",
+      "description": "Add prevent_destroy and a 30 day KMS deletion window to the vended Terraform DynamoDB table and Aurora cluster modules",
+      "implementation": "./src/migrations/latest/terraform-data-resource-destroy-protection/migration"
+    },
+    "latest-terraform-gateway-cedar-render-root-ejs": {
+      "version": "1.0.0-rc.83",
+      "description": "Declare ejs at the workspace root so the Terraform gateway's Cedar render script resolves it",
+      "implementation": "./src/migrations/latest/terraform-gateway-cedar-render-root-ejs/migration"
+    },
     "v1.0.0-rc.50-0001-modernize-function-props-cast": {
       "version": "1.0.0-rc.50",
       "description": "Replace the legacy angle-bracket FunctionProps type assertion with the modern as syntax in generated API constructs",
@@ -173,7 +188,7 @@
       "implementation": "./src/migrations/v1.0.0-rc.75/0001-ts-agent-session-id-middleware-extraction/migration"
     },
     "sync-vended-versions": {
-      "version": "1.0.0-rc.82",
+      "version": "1.0.0-rc.83",
       "description": "Sync vended dependency versions and the tracked plugin version to those vended by this release",
       "implementation": "./src/utils/version-upgrade-migration/migration"
     }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@aws/nx-plugin",
-  "version": "1.0.0-rc.82",
+  "version": "1.0.0-rc.83",
   "repository": {
     "type": "git",
     "url": "https://github.com/awslabs/nx-plugin-for-aws.git",

package/src/agentcore-gateway/generator.d.ts

@@ -14,12 +14,6 @@ export declare const DEPENDENCIES: import("../utils/declared-dependencies.js").D
 }, {
     readonly name: "@types/express";
     readonly dev: true;
-}, {
-    readonly name: "ejs";
-    readonly dev: true;
-}, {
-    readonly name: "@types/ejs";
-    readonly dev: true;
 }, {
     readonly name: "tsx";
     readonly dev: true;
@@ -39,6 +33,13 @@ export declare const DEPENDENCIES: import("../utils/declared-dependencies.js").D
     readonly when: (m: IacMetadata) => boolean;
 } & {
     versionOnly: true;
+}, {
+    readonly name: "ejs";
+    readonly when: (m: IacMetadata) => boolean;
+    readonly dev: true;
+    readonly root: true;
+} & {
+    versionOnly: true;
 }, {
     readonly name: "constructs";
     readonly when: (m: IacMetadata) => boolean;

package/src/agentcore-gateway/generator.js

@@ -15,9 +15,8 @@ import { addGeneratorMetadata, getGeneratorInfo, projectExists, readProjectConfi
 import { assignPort } from "../utils/port.js";
 import { ensureProjectPackageJson } from "../utils/project-package-json.js";
 import { SHARED_CONSTRUCTS_DEPENDENCIES, sharedConstructsGenerator } from "../utils/shared-constructs.js";
-// The gateway's local-dev server and Cedar policy rendering need these
-// whatever the auth; only the MCP SDK is protocol-specific (the http local
-// gateway is a plain proxy).
+// The gateway's local-dev server needs these whatever the auth; only the MCP
+// SDK is protocol-specific (the http local gateway is a plain proxy).
 export const DEPENDENCIES = declareDependencies()({
     ts: [
         {
@@ -31,15 +30,6 @@ export const DEPENDENCIES = declareDependencies()({
             name: '@types/express',
             dev: true
         },
-        // ejs renders the Cedar policy in the shared gateway construct.
-        {
-            name: 'ejs',
-            dev: true
-        },
-        {
-            name: '@types/ejs',
-            dev: true
-        },
         // local-dev.ts runs via tsx, which is shared tooling.
         {
             name: 'tsx',

package/src/agentcore-gateway/generator.js.map

@@ -1 +1 @@
-{"version":3,"sources":["../../../../../packages/nx-plugin/src/agentcore-gateway/generator.ts"],"sourcesContent":["/**\n * Copyright Amazon.com, Inc. or its affiliates. All Rights Reserved.\n * SPDX-License-Identifier: Apache-2.0\n */\nimport {\n  addProjectConfiguration,\n  type GeneratorCallback,\n  generateFiles,\n  joinPathFragments,\n  logger,\n  OverwriteStrategy,\n  type ProjectConfiguration,\n  type Tree,\n  updateProjectConfiguration,\n} from '@nx/devkit';\nimport { addTsDependencies } from '../utils/add-dependencies.js';\nimport {\n  AGENT_CORE_CONSTRUCTS_DEPENDENCIES,\n  AGENT_CORE_CONSTRUCTS_PY_DEPENDENCIES,\n  addAgentCoreGatewayInfra,\n} from '../utils/agent-core-constructs/agent-core-constructs.js';\nimport {\n  declareDependencies,\n  ownedElsewhere,\n} from '../utils/declared-dependencies.js';\nimport { formatFilesInSubtree } from '../utils/format.js';\nimport { resolveIac } from '../utils/iac.js';\nimport { installDependencies } from '../utils/install.js';\nimport { addGeneratorMetricsIfApplicable } from '../utils/metrics.js';\nimport { kebabCase, toClassName } from '../utils/names.js';\nimport { getNpmScopePrefix } from '../utils/npm-scope.js';\nimport {\n  addGeneratorMetadata,\n  getGeneratorInfo,\n  type NxGeneratorInfo,\n  projectExists,\n  readProjectConfigurationUnqualified,\n} from '../utils/nx.js';\nimport { assignPort } from '../utils/port.js';\nimport { ensureProjectPackageJson } from '../utils/project-package-json.js';\nimport {\n  SHARED_CONSTRUCTS_DEPENDENCIES,\n  sharedConstructsGenerator,\n} from '../utils/shared-constructs.js';\nimport type { IacMetadata } from '../utils/shared-constructs-constants.js';\nimport type { AgentcoreGatewayGeneratorSchema } from './schema';\n\n// The gateway's local-dev server and Cedar policy rendering need these\n// whatever the auth; only the MCP SDK is protocol-specific (the http local\n// gateway is a plain proxy).\nexport const DEPENDENCIES = declareDependencies<AgentCoreGatewayMetadata>()({\n  ts: [\n    { name: '@modelcontextprotocol/sdk', when: (m) => m.protocol === 'mcp' },\n    { name: 'express' },\n    { name: '@types/express', dev: true },\n    // ejs renders the Cedar policy in the shared gateway construct.\n    { name: 'ejs', dev: true },\n    { name: '@types/ejs', dev: true },\n    // local-dev.ts runs via tsx, which is shared tooling.\n    { name: 'tsx', dev: true, root: true },\n    ...ownedElsewhere(AGENT_CORE_CONSTRUCTS_DEPENDENCIES),\n    ...ownedElsewhere(SHARED_CONSTRUCTS_DEPENDENCIES),\n  ],\n  py: ownedElsewhere(AGENT_CORE_CONSTRUCTS_PY_DEPENDENCIES),\n});\n\nexport const AGENTCORE_GATEWAY_GENERATOR_INFO: NxGeneratorInfo =\n  getGeneratorInfo(import.meta.filename);\n\nexport const agentcoreGatewayGenerator = async (\n  tree: Tree,\n  options: AgentcoreGatewayGeneratorSchema,\n): Promise<GeneratorCallback> => {\n  const name = kebabCase(options.name);\n  const nameClassName = toClassName(name);\n  const parentDir = options.directory ?? 'packages';\n  const subDir = options.subDirectory ?? name;\n  const projectRoot = joinPathFragments(parentDir, subDir);\n  const fullyQualifiedName = `${getNpmScopePrefix(tree)}${name}`;\n\n  // Protocol is mcp (aggregate MCP server targets into one MCP endpoint) or\n  // http (proxy agent runtime targets via path-based routing). Persisted in\n  // metadata so connection generators can validate it.\n  const protocol = options.protocol ?? 'mcp';\n  // Inbound auth is iam (default) or cognito. Persisted in metadata so\n  // connection generators can validate it (agent -> gateway connections\n  // require an IAM gateway).\n  const auth = options.auth ?? 'iam';\n  // Cedar policies authorize MCP tool actions, which an http gateway has none\n  // of — its runtime targets are plain proxied endpoints — so the policy\n  // engine only applies to mcp gateways. cedarPolicy defaults to true in the\n  // schema, so an http gateway quietly drops it rather than requiring\n  // --cedarPolicy=false.\n  if (protocol === 'http' && options.cedarPolicy) {\n    logger.warn(\n      'Cedar policies authorize MCP tool actions, so cedarPolicy is ignored for http-protocol gateways.',\n    );\n  }\n  const cedarPolicy = protocol === 'mcp' && (options.cedarPolicy ?? true);\n  const infra = options.infra ?? 'agentcore';\n\n  // local-dev.ts is the local gateway: a continuous MCP aggregator chaining\n  // onto attached MCP servers' dev targets (added by the mcp-connection\n  // generator), so a single `nx dev <gateway>` boots the gateway and every\n  // attached MCP server together.\n  //\n  // `serve` exists for parity with other generators; the deployed Gateway is\n  // a managed AWS resource, so `serve`-mode agents talk to it via runtime\n  // config and the local gateway sits idle.\n  const localGatewayTarget = (port: number) => ({\n    executor: 'nx:run-commands' as const,\n    continuous: true,\n    options: {\n      command: 'tsx local-dev.ts',\n      cwd: '{projectRoot}',\n      env: { PORT: `${port}` },\n    },\n    dependsOn: [] as Array<string | { projects: string[]; target: string }>,\n  });\n  let project: ProjectConfiguration;\n  if (projectExists(tree, fullyQualifiedName)) {\n    project = readProjectConfigurationUnqualified(tree, fullyQualifiedName);\n  } else {\n    addProjectConfiguration(tree, fullyQualifiedName, {\n      name: fullyQualifiedName,\n      root: projectRoot,\n      projectType: 'library',\n      sourceRoot: projectRoot,\n      tags: [],\n      targets: {},\n      metadata: {\n        generator: AGENTCORE_GATEWAY_GENERATOR_INFO.id,\n      } as any,\n    });\n    project = readProjectConfigurationUnqualified(tree, fullyQualifiedName);\n  }\n  // Ensure the project has its own package.json so its runtime dependencies\n  // (added below) are declared in it rather than the workspace root.\n  ensureProjectPackageJson(tree, {\n    dir: projectRoot,\n    fullyQualifiedName,\n  });\n  const port = assignPort(tree, project, 8100);\n  // A gateway is its own standalone project, so it uses plain `serve` / `dev`\n  // targets. Re-run: keep existing targets (their dependsOn may have been\n  // populated by the mcp-connection generator), just ensure both exist.\n  project.targets ??= {};\n  project.targets['serve'] ??= localGatewayTarget(port);\n  project.targets['dev'] ??= localGatewayTarget(port);\n  updateProjectConfiguration(tree, project.name, project);\n\n  // Scaffold the gateway project: local-dev.ts (+ Cedar policies if requested)\n  generateFiles(\n    tree,\n    joinPathFragments(import.meta.dirname, 'files', 'project', protocol),\n    projectRoot,\n    {\n      nameClassName,\n      nameKebabCase: name,\n      port,\n      attachedMcpServers: [],\n      attachedAgents: [],\n    },\n    { overwriteStrategy: OverwriteStrategy.KeepExisting },\n  );\n  if (cedarPolicy) {\n    // The default permit-all policy differs by auth type: AgentCore represents\n    // IAM callers as `AgentCore::IamEntity` and Cognito/JWT callers as\n    // `AgentCore::OAuthUser`, so the two policies match different principals.\n    generateFiles(\n      tree,\n      joinPathFragments(import.meta.dirname, 'files', 'cedar'),\n      projectRoot,\n      { nameClassName, auth },\n      { overwriteStrategy: OverwriteStrategy.KeepExisting },\n    );\n  }\n\n  // Recorded in the metadata below so the version sync can tell a CDK\n  // project from a Terraform one; undefined when no infrastructure was\n  // generated, in which case neither provider's packages were added.\n  const iac =\n    infra !== 'none' ? await resolveIac(tree, options.iac) : undefined;\n\n  // Recorded below and read by the declaration's predicates, so the packages\n  // added here are exactly the ones the version sync will own.\n  const metadata: AgentCoreGatewayMetadata = {\n    name,\n    rc: nameClassName,\n    protocol,\n    auth,\n    port,\n    ...(iac ? { iac } : {}),\n  };\n\n  addGeneratorMetadata(\n    tree,\n    fullyQualifiedName,\n    AGENTCORE_GATEWAY_GENERATOR_INFO,\n    metadata,\n  );\n\n  addTsDependencies(tree, DEPENDENCIES, { metadata, projectRoot });\n\n  // Wire up infra (CDK or Terraform); re-running with infra=agentcore adds\n  // the infrastructure to a previously infra-less gateway.\n\n  if (infra === 'agentcore') {\n    await sharedConstructsGenerator(tree, { iac }, DEPENDENCIES);\n\n    await addAgentCoreGatewayInfra(\n      tree,\n      {\n        gatewayNameClassName: nameClassName,\n        gatewayNameKebabCase: name,\n        projectName: fullyQualifiedName,\n        projectDirectory: projectRoot,\n        cedarPolicy,\n        auth,\n        protocol,\n        iac,\n      },\n      DEPENDENCIES,\n    );\n  }\n\n  await addGeneratorMetricsIfApplicable(tree, [\n    AGENTCORE_GATEWAY_GENERATOR_INFO,\n  ]);\n\n  await formatFilesInSubtree(tree);\n  return () =>\n    installDependencies(tree, options.preferInstallDependencies, {\n      languages: ['typescript'],\n    });\n};\n\n/**\n * Gateway details stored in the gateway project's metadata.\n */\nexport interface AgentCoreGatewayMetadata extends IacMetadata {\n  name: string;\n  rc: string;\n  protocol: string;\n  auth: string;\n  port: number;\n}\n\n/**\n * Read a gateway project's metadata, validating it was generated by the\n * agentcore-gateway generator.\n */\nexport const readAgentCoreGatewayMetadata = (\n  project: ProjectConfiguration,\n): AgentCoreGatewayMetadata => {\n  const metadata = project.metadata as any;\n  if (metadata?.generator !== AGENTCORE_GATEWAY_GENERATOR_INFO.id) {\n    throw new Error(\n      `Project '${project.name}' was not generated by the '${AGENTCORE_GATEWAY_GENERATOR_INFO.id}' generator.`,\n    );\n  }\n  return metadata as AgentCoreGatewayMetadata;\n};\n\nexport default agentcoreGatewayGenerator;\n"],"names":["addProjectConfiguration","generateFiles","joinPathFragments","logger","OverwriteStrategy","updateProjectConfiguration","addTsDependencies","AGENT_CORE_CONSTRUCTS_DEPENDENCIES","AGENT_CORE_CONSTRUCTS_PY_DEPENDENCIES","addAgentCoreGatewayInfra","declareDependencies","ownedElsewhere","formatFilesInSubtree","resolveIac","installDependencies","addGeneratorMetricsIfApplicable","kebabCase","toClassName","getNpmScopePrefix","addGeneratorMetadata","getGeneratorInfo","projectExists","readProjectConfigurationUnqualified","assignPort","ensureProjectPackageJson","SHARED_CONSTRUCTS_DEPENDENCIES","sharedConstructsGenerator","DEPENDENCIES","ts","name","when","m","protocol","dev","root","py","AGENTCORE_GATEWAY_GENERATOR_INFO","filename","agentcoreGatewayGenerator","tree","options","nameClassName","parentDir","directory","subDir","subDirectory","projectRoot","fullyQualifiedName","auth","cedarPolicy","warn","infra","localGatewayTarget","port","executor","continuous","command","cwd","env","PORT","dependsOn","project","projectType","sourceRoot","tags","targets","metadata","generator","id","dir","dirname","nameKebabCase","attachedMcpServers","attachedAgents","overwriteStrategy","KeepExisting","iac","undefined","rc","gatewayNameClassName","gatewayNameKebabCase","projectName","projectDirectory","preferInstallDependencies","languages","readAgentCoreGatewayMetadata","Error"],"mappings":"AAAA;;;CAGC,GACD,SACEA,uBAAuB,EAEvBC,aAAa,EACbC,iBAAiB,EACjBC,MAAM,EACNC,iBAAiB,EAGjBC,0BAA0B,QACrB,aAAa;AACpB,SAASC,iBAAiB,QAAQ,+BAA+B;AACjE,SACEC,kCAAkC,EAClCC,qCAAqC,EACrCC,wBAAwB,QACnB,0DAA0D;AACjE,SACEC,mBAAmB,EACnBC,cAAc,QACT,oCAAoC;AAC3C,SAASC,oBAAoB,QAAQ,qBAAqB;AAC1D,SAASC,UAAU,QAAQ,kBAAkB;AAC7C,SAASC,mBAAmB,QAAQ,sBAAsB;AAC1D,SAASC,+BAA+B,QAAQ,sBAAsB;AACtE,SAASC,SAAS,EAAEC,WAAW,QAAQ,oBAAoB;AAC3D,SAASC,iBAAiB,QAAQ,wBAAwB;AAC1D,SACEC,oBAAoB,EACpBC,gBAAgB,EAEhBC,aAAa,EACbC,mCAAmC,QAC9B,iBAAiB;AACxB,SAASC,UAAU,QAAQ,mBAAmB;AAC9C,SAASC,wBAAwB,QAAQ,mCAAmC;AAC5E,SACEC,8BAA8B,EAC9BC,yBAAyB,QACpB,gCAAgC;AAIvC,uEAAuE;AACvE,2EAA2E;AAC3E,6BAA6B;AAC7B,OAAO,MAAMC,eAAejB,sBAAgD;IAC1EkB,IAAI;QACF;YAAEC,MAAM;YAA6BC,MAAM,CAACC,IAAMA,EAAEC,QAAQ,KAAK;QAAM;QACvE;YAAEH,MAAM;QAAU;QAClB;YAAEA,MAAM;YAAkBI,KAAK;QAAK;QACpC,gEAAgE;QAChE;YAAEJ,MAAM;YAAOI,KAAK;QAAK;QACzB;YAAEJ,MAAM;YAAcI,KAAK;QAAK;QAChC,sDAAsD;QACtD;YAAEJ,MAAM;YAAOI,KAAK;YAAMC,MAAM;QAAK;WAClCvB,eAAeJ;WACfI,eAAec;KACnB;IACDU,IAAIxB,eAAeH;AACrB,GAAG;AAEH,OAAO,MAAM4B,mCACXhB,iBAAiB,YAAYiB,QAAQ,EAAE;AAEzC,OAAO,MAAMC,4BAA4B,OACvCC,MACAC;IAEA,MAAMX,OAAOb,UAAUwB,QAAQX,IAAI;IACnC,MAAMY,gBAAgBxB,YAAYY;IAClC,MAAMa,YAAYF,QAAQG,SAAS,IAAI;IACvC,MAAMC,SAASJ,QAAQK,YAAY,IAAIhB;IACvC,MAAMiB,cAAc5C,kBAAkBwC,WAAWE;IACjD,MAAMG,qBAAqB,GAAG7B,kBAAkBqB,QAAQV,MAAM;IAE9D,0EAA0E;IAC1E,0EAA0E;IAC1E,qDAAqD;IACrD,MAAMG,WAAWQ,QAAQR,QAAQ,IAAI;IACrC,qEAAqE;IACrE,sEAAsE;IACtE,2BAA2B;IAC3B,MAAMgB,OAAOR,QAAQQ,IAAI,IAAI;IAC7B,4EAA4E;IAC5E,uEAAuE;IACvE,2EAA2E;IAC3E,oEAAoE;IACpE,uBAAuB;IACvB,IAAIhB,aAAa,UAAUQ,QAAQS,WAAW,EAAE;QAC9C9C,OAAO+C,IAAI,CACT;IAEJ;IACA,MAAMD,cAAcjB,aAAa,SAAUQ,CAAAA,QAAQS,WAAW,IAAI,IAAG;IACrE,MAAME,QAAQX,QAAQW,KAAK,IAAI;IAE/B,0EAA0E;IAC1E,sEAAsE;IACtE,yEAAyE;IACzE,gCAAgC;IAChC,EAAE;IACF,2EAA2E;IAC3E,wEAAwE;IACxE,0CAA0C;IAC1C,MAAMC,qBAAqB,CAACC,OAAkB,CAAA;YAC5CC,UAAU;YACVC,YAAY;YACZf,SAAS;gBACPgB,SAAS;gBACTC,KAAK;gBACLC,KAAK;oBAAEC,MAAM,GAAGN,MAAM;gBAAC;YACzB;YACAO,WAAW,EAAE;QACf,CAAA;IACA,IAAIC;IACJ,IAAIxC,cAAckB,MAAMQ,qBAAqB;QAC3Cc,UAAUvC,oCAAoCiB,MAAMQ;IACtD,OAAO;QACL/C,wBAAwBuC,MAAMQ,oBAAoB;YAChDlB,MAAMkB;YACNb,MAAMY;YACNgB,aAAa;YACbC,YAAYjB;YACZkB,MAAM,EAAE;YACRC,SAAS,CAAC;YACVC,UAAU;gBACRC,WAAW/B,iCAAiCgC,EAAE;YAChD;QACF;QACAP,UAAUvC,oCAAoCiB,MAAMQ;IACtD;IACA,0EAA0E;IAC1E,mEAAmE;IACnEvB,yBAAyBe,MAAM;QAC7B8B,KAAKvB;QACLC;IACF;IACA,MAAMM,OAAO9B,WAAWgB,MAAMsB,SAAS;IACvC,4EAA4E;IAC5E,wEAAwE;IACxE,sEAAsE;IACtEA,QAAQI,OAAO,KAAK,CAAC;IACrBJ,QAAQI,OAAO,CAAC,QAAQ,KAAKb,mBAAmBC;IAChDQ,QAAQI,OAAO,CAAC,MAAM,KAAKb,mBAAmBC;IAC9ChD,2BAA2BkC,MAAMsB,QAAQhC,IAAI,EAAEgC;IAE/C,6EAA6E;IAC7E5D,cACEsC,MACArC,kBAAkB,YAAYoE,OAAO,EAAE,SAAS,WAAWtC,WAC3Dc,aACA;QACEL;QACA8B,eAAe1C;QACfwB;QACAmB,oBAAoB,EAAE;QACtBC,gBAAgB,EAAE;IACpB,GACA;QAAEC,mBAAmBtE,kBAAkBuE,YAAY;IAAC;IAEtD,IAAI1B,aAAa;QACf,2EAA2E;QAC3E,mEAAmE;QACnE,0EAA0E;QAC1EhD,cACEsC,MACArC,kBAAkB,YAAYoE,OAAO,EAAE,SAAS,UAChDxB,aACA;YAAEL;YAAeO;QAAK,GACtB;YAAE0B,mBAAmBtE,kBAAkBuE,YAAY;QAAC;IAExD;IAEA,oEAAoE;IACpE,qEAAqE;IACrE,mEAAmE;IACnE,MAAMC,MACJzB,UAAU,SAAS,MAAMtC,WAAW0B,MAAMC,QAAQoC,GAAG,IAAIC;IAE3D,2EAA2E;IAC3E,6DAA6D;IAC7D,MAAMX,WAAqC;QACzCrC;QACAiD,IAAIrC;QACJT;QACAgB;QACAK;QACA,GAAIuB,MAAM;YAAEA;QAAI,IAAI,CAAC,CAAC;IACxB;IAEAzD,qBACEoB,MACAQ,oBACAX,kCACA8B;IAGF5D,kBAAkBiC,MAAMZ,cAAc;QAAEuC;QAAUpB;IAAY;IAE9D,yEAAyE;IACzE,yDAAyD;IAEzD,IAAIK,UAAU,aAAa;QACzB,MAAMzB,0BAA0Ba,MAAM;YAAEqC;QAAI,GAAGjD;QAE/C,MAAMlB,yBACJ8B,MACA;YACEwC,sBAAsBtC;YACtBuC,sBAAsBnD;YACtBoD,aAAalC;YACbmC,kBAAkBpC;YAClBG;YACAD;YACAhB;YACA4C;QACF,GACAjD;IAEJ;IAEA,MAAMZ,gCAAgCwB,MAAM;QAC1CH;KACD;IAED,MAAMxB,qBAAqB2B;IAC3B,OAAO,IACLzB,oBAAoByB,MAAMC,QAAQ2C,yBAAyB,EAAE;YAC3DC,WAAW;gBAAC;aAAa;QAC3B;AACJ,EAAE;AAaF;;;CAGC,GACD,OAAO,MAAMC,+BAA+B,CAC1CxB;IAEA,MAAMK,WAAWL,QAAQK,QAAQ;IACjC,IAAIA,UAAUC,cAAc/B,iCAAiCgC,EAAE,EAAE;QAC/D,MAAM,IAAIkB,MACR,CAAC,SAAS,EAAEzB,QAAQhC,IAAI,CAAC,4BAA4B,EAAEO,iCAAiCgC,EAAE,CAAC,YAAY,CAAC;IAE5G;IACA,OAAOF;AACT,EAAE;AAEF,eAAe5B,0BAA0B"}
+{"version":3,"sources":["../../../../../packages/nx-plugin/src/agentcore-gateway/generator.ts"],"sourcesContent":["/**\n * Copyright Amazon.com, Inc. or its affiliates. All Rights Reserved.\n * SPDX-License-Identifier: Apache-2.0\n */\nimport {\n  addProjectConfiguration,\n  type GeneratorCallback,\n  generateFiles,\n  joinPathFragments,\n  logger,\n  OverwriteStrategy,\n  type ProjectConfiguration,\n  type Tree,\n  updateProjectConfiguration,\n} from '@nx/devkit';\nimport { addTsDependencies } from '../utils/add-dependencies.js';\nimport {\n  AGENT_CORE_CONSTRUCTS_DEPENDENCIES,\n  AGENT_CORE_CONSTRUCTS_PY_DEPENDENCIES,\n  addAgentCoreGatewayInfra,\n} from '../utils/agent-core-constructs/agent-core-constructs.js';\nimport {\n  declareDependencies,\n  ownedElsewhere,\n} from '../utils/declared-dependencies.js';\nimport { formatFilesInSubtree } from '../utils/format.js';\nimport { resolveIac } from '../utils/iac.js';\nimport { installDependencies } from '../utils/install.js';\nimport { addGeneratorMetricsIfApplicable } from '../utils/metrics.js';\nimport { kebabCase, toClassName } from '../utils/names.js';\nimport { getNpmScopePrefix } from '../utils/npm-scope.js';\nimport {\n  addGeneratorMetadata,\n  getGeneratorInfo,\n  type NxGeneratorInfo,\n  projectExists,\n  readProjectConfigurationUnqualified,\n} from '../utils/nx.js';\nimport { assignPort } from '../utils/port.js';\nimport { ensureProjectPackageJson } from '../utils/project-package-json.js';\nimport {\n  SHARED_CONSTRUCTS_DEPENDENCIES,\n  sharedConstructsGenerator,\n} from '../utils/shared-constructs.js';\nimport type { IacMetadata } from '../utils/shared-constructs-constants.js';\nimport type { AgentcoreGatewayGeneratorSchema } from './schema';\n\n// The gateway's local-dev server needs these whatever the auth; only the MCP\n// SDK is protocol-specific (the http local gateway is a plain proxy).\nexport const DEPENDENCIES = declareDependencies<AgentCoreGatewayMetadata>()({\n  ts: [\n    { name: '@modelcontextprotocol/sdk', when: (m) => m.protocol === 'mcp' },\n    { name: 'express' },\n    { name: '@types/express', dev: true },\n    // local-dev.ts runs via tsx, which is shared tooling.\n    { name: 'tsx', dev: true, root: true },\n    ...ownedElsewhere(AGENT_CORE_CONSTRUCTS_DEPENDENCIES),\n    ...ownedElsewhere(SHARED_CONSTRUCTS_DEPENDENCIES),\n  ],\n  py: ownedElsewhere(AGENT_CORE_CONSTRUCTS_PY_DEPENDENCIES),\n});\n\nexport const AGENTCORE_GATEWAY_GENERATOR_INFO: NxGeneratorInfo =\n  getGeneratorInfo(import.meta.filename);\n\nexport const agentcoreGatewayGenerator = async (\n  tree: Tree,\n  options: AgentcoreGatewayGeneratorSchema,\n): Promise<GeneratorCallback> => {\n  const name = kebabCase(options.name);\n  const nameClassName = toClassName(name);\n  const parentDir = options.directory ?? 'packages';\n  const subDir = options.subDirectory ?? name;\n  const projectRoot = joinPathFragments(parentDir, subDir);\n  const fullyQualifiedName = `${getNpmScopePrefix(tree)}${name}`;\n\n  // Protocol is mcp (aggregate MCP server targets into one MCP endpoint) or\n  // http (proxy agent runtime targets via path-based routing). Persisted in\n  // metadata so connection generators can validate it.\n  const protocol = options.protocol ?? 'mcp';\n  // Inbound auth is iam (default) or cognito. Persisted in metadata so\n  // connection generators can validate it (agent -> gateway connections\n  // require an IAM gateway).\n  const auth = options.auth ?? 'iam';\n  // Cedar policies authorize MCP tool actions, which an http gateway has none\n  // of — its runtime targets are plain proxied endpoints — so the policy\n  // engine only applies to mcp gateways. cedarPolicy defaults to true in the\n  // schema, so an http gateway quietly drops it rather than requiring\n  // --cedarPolicy=false.\n  if (protocol === 'http' && options.cedarPolicy) {\n    logger.warn(\n      'Cedar policies authorize MCP tool actions, so cedarPolicy is ignored for http-protocol gateways.',\n    );\n  }\n  const cedarPolicy = protocol === 'mcp' && (options.cedarPolicy ?? true);\n  const infra = options.infra ?? 'agentcore';\n\n  // local-dev.ts is the local gateway: a continuous MCP aggregator chaining\n  // onto attached MCP servers' dev targets (added by the mcp-connection\n  // generator), so a single `nx dev <gateway>` boots the gateway and every\n  // attached MCP server together.\n  //\n  // `serve` exists for parity with other generators; the deployed Gateway is\n  // a managed AWS resource, so `serve`-mode agents talk to it via runtime\n  // config and the local gateway sits idle.\n  const localGatewayTarget = (port: number) => ({\n    executor: 'nx:run-commands' as const,\n    continuous: true,\n    options: {\n      command: 'tsx local-dev.ts',\n      cwd: '{projectRoot}',\n      env: { PORT: `${port}` },\n    },\n    dependsOn: [] as Array<string | { projects: string[]; target: string }>,\n  });\n  let project: ProjectConfiguration;\n  if (projectExists(tree, fullyQualifiedName)) {\n    project = readProjectConfigurationUnqualified(tree, fullyQualifiedName);\n  } else {\n    addProjectConfiguration(tree, fullyQualifiedName, {\n      name: fullyQualifiedName,\n      root: projectRoot,\n      projectType: 'library',\n      sourceRoot: projectRoot,\n      tags: [],\n      targets: {},\n      metadata: {\n        generator: AGENTCORE_GATEWAY_GENERATOR_INFO.id,\n      } as any,\n    });\n    project = readProjectConfigurationUnqualified(tree, fullyQualifiedName);\n  }\n  // Ensure the project has its own package.json so its runtime dependencies\n  // (added below) are declared in it rather than the workspace root.\n  ensureProjectPackageJson(tree, {\n    dir: projectRoot,\n    fullyQualifiedName,\n  });\n  const port = assignPort(tree, project, 8100);\n  // A gateway is its own standalone project, so it uses plain `serve` / `dev`\n  // targets. Re-run: keep existing targets (their dependsOn may have been\n  // populated by the mcp-connection generator), just ensure both exist.\n  project.targets ??= {};\n  project.targets['serve'] ??= localGatewayTarget(port);\n  project.targets['dev'] ??= localGatewayTarget(port);\n  updateProjectConfiguration(tree, project.name, project);\n\n  // Scaffold the gateway project: local-dev.ts (+ Cedar policies if requested)\n  generateFiles(\n    tree,\n    joinPathFragments(import.meta.dirname, 'files', 'project', protocol),\n    projectRoot,\n    {\n      nameClassName,\n      nameKebabCase: name,\n      port,\n      attachedMcpServers: [],\n      attachedAgents: [],\n    },\n    { overwriteStrategy: OverwriteStrategy.KeepExisting },\n  );\n  if (cedarPolicy) {\n    // The default permit-all policy differs by auth type: AgentCore represents\n    // IAM callers as `AgentCore::IamEntity` and Cognito/JWT callers as\n    // `AgentCore::OAuthUser`, so the two policies match different principals.\n    generateFiles(\n      tree,\n      joinPathFragments(import.meta.dirname, 'files', 'cedar'),\n      projectRoot,\n      { nameClassName, auth },\n      { overwriteStrategy: OverwriteStrategy.KeepExisting },\n    );\n  }\n\n  // Recorded in the metadata below so the version sync can tell a CDK\n  // project from a Terraform one; undefined when no infrastructure was\n  // generated, in which case neither provider's packages were added.\n  const iac =\n    infra !== 'none' ? await resolveIac(tree, options.iac) : undefined;\n\n  // Recorded below and read by the declaration's predicates, so the packages\n  // added here are exactly the ones the version sync will own.\n  const metadata: AgentCoreGatewayMetadata = {\n    name,\n    rc: nameClassName,\n    protocol,\n    auth,\n    port,\n    ...(iac ? { iac } : {}),\n  };\n\n  addGeneratorMetadata(\n    tree,\n    fullyQualifiedName,\n    AGENTCORE_GATEWAY_GENERATOR_INFO,\n    metadata,\n  );\n\n  addTsDependencies(tree, DEPENDENCIES, { metadata, projectRoot });\n\n  // Wire up infra (CDK or Terraform); re-running with infra=agentcore adds\n  // the infrastructure to a previously infra-less gateway.\n\n  if (infra === 'agentcore') {\n    await sharedConstructsGenerator(tree, { iac }, DEPENDENCIES);\n\n    await addAgentCoreGatewayInfra(\n      tree,\n      {\n        gatewayNameClassName: nameClassName,\n        gatewayNameKebabCase: name,\n        projectName: fullyQualifiedName,\n        projectDirectory: projectRoot,\n        cedarPolicy,\n        auth,\n        protocol,\n        iac,\n      },\n      DEPENDENCIES,\n    );\n  }\n\n  await addGeneratorMetricsIfApplicable(tree, [\n    AGENTCORE_GATEWAY_GENERATOR_INFO,\n  ]);\n\n  await formatFilesInSubtree(tree);\n  return () =>\n    installDependencies(tree, options.preferInstallDependencies, {\n      languages: ['typescript'],\n    });\n};\n\n/**\n * Gateway details stored in the gateway project's metadata.\n */\nexport interface AgentCoreGatewayMetadata extends IacMetadata {\n  name: string;\n  rc: string;\n  protocol: string;\n  auth: string;\n  port: number;\n}\n\n/**\n * Read a gateway project's metadata, validating it was generated by the\n * agentcore-gateway generator.\n */\nexport const readAgentCoreGatewayMetadata = (\n  project: ProjectConfiguration,\n): AgentCoreGatewayMetadata => {\n  const metadata = project.metadata as any;\n  if (metadata?.generator !== AGENTCORE_GATEWAY_GENERATOR_INFO.id) {\n    throw new Error(\n      `Project '${project.name}' was not generated by the '${AGENTCORE_GATEWAY_GENERATOR_INFO.id}' generator.`,\n    );\n  }\n  return metadata as AgentCoreGatewayMetadata;\n};\n\nexport default agentcoreGatewayGenerator;\n"],"names":["addProjectConfiguration","generateFiles","joinPathFragments","logger","OverwriteStrategy","updateProjectConfiguration","addTsDependencies","AGENT_CORE_CONSTRUCTS_DEPENDENCIES","AGENT_CORE_CONSTRUCTS_PY_DEPENDENCIES","addAgentCoreGatewayInfra","declareDependencies","ownedElsewhere","formatFilesInSubtree","resolveIac","installDependencies","addGeneratorMetricsIfApplicable","kebabCase","toClassName","getNpmScopePrefix","addGeneratorMetadata","getGeneratorInfo","projectExists","readProjectConfigurationUnqualified","assignPort","ensureProjectPackageJson","SHARED_CONSTRUCTS_DEPENDENCIES","sharedConstructsGenerator","DEPENDENCIES","ts","name","when","m","protocol","dev","root","py","AGENTCORE_GATEWAY_GENERATOR_INFO","filename","agentcoreGatewayGenerator","tree","options","nameClassName","parentDir","directory","subDir","subDirectory","projectRoot","fullyQualifiedName","auth","cedarPolicy","warn","infra","localGatewayTarget","port","executor","continuous","command","cwd","env","PORT","dependsOn","project","projectType","sourceRoot","tags","targets","metadata","generator","id","dir","dirname","nameKebabCase","attachedMcpServers","attachedAgents","overwriteStrategy","KeepExisting","iac","undefined","rc","gatewayNameClassName","gatewayNameKebabCase","projectName","projectDirectory","preferInstallDependencies","languages","readAgentCoreGatewayMetadata","Error"],"mappings":"AAAA;;;CAGC,GACD,SACEA,uBAAuB,EAEvBC,aAAa,EACbC,iBAAiB,EACjBC,MAAM,EACNC,iBAAiB,EAGjBC,0BAA0B,QACrB,aAAa;AACpB,SAASC,iBAAiB,QAAQ,+BAA+B;AACjE,SACEC,kCAAkC,EAClCC,qCAAqC,EACrCC,wBAAwB,QACnB,0DAA0D;AACjE,SACEC,mBAAmB,EACnBC,cAAc,QACT,oCAAoC;AAC3C,SAASC,oBAAoB,QAAQ,qBAAqB;AAC1D,SAASC,UAAU,QAAQ,kBAAkB;AAC7C,SAASC,mBAAmB,QAAQ,sBAAsB;AAC1D,SAASC,+BAA+B,QAAQ,sBAAsB;AACtE,SAASC,SAAS,EAAEC,WAAW,QAAQ,oBAAoB;AAC3D,SAASC,iBAAiB,QAAQ,wBAAwB;AAC1D,SACEC,oBAAoB,EACpBC,gBAAgB,EAEhBC,aAAa,EACbC,mCAAmC,QAC9B,iBAAiB;AACxB,SAASC,UAAU,QAAQ,mBAAmB;AAC9C,SAASC,wBAAwB,QAAQ,mCAAmC;AAC5E,SACEC,8BAA8B,EAC9BC,yBAAyB,QACpB,gCAAgC;AAIvC,6EAA6E;AAC7E,sEAAsE;AACtE,OAAO,MAAMC,eAAejB,sBAAgD;IAC1EkB,IAAI;QACF;YAAEC,MAAM;YAA6BC,MAAM,CAACC,IAAMA,EAAEC,QAAQ,KAAK;QAAM;QACvE;YAAEH,MAAM;QAAU;QAClB;YAAEA,MAAM;YAAkBI,KAAK;QAAK;QACpC,sDAAsD;QACtD;YAAEJ,MAAM;YAAOI,KAAK;YAAMC,MAAM;QAAK;WAClCvB,eAAeJ;WACfI,eAAec;KACnB;IACDU,IAAIxB,eAAeH;AACrB,GAAG;AAEH,OAAO,MAAM4B,mCACXhB,iBAAiB,YAAYiB,QAAQ,EAAE;AAEzC,OAAO,MAAMC,4BAA4B,OACvCC,MACAC;IAEA,MAAMX,OAAOb,UAAUwB,QAAQX,IAAI;IACnC,MAAMY,gBAAgBxB,YAAYY;IAClC,MAAMa,YAAYF,QAAQG,SAAS,IAAI;IACvC,MAAMC,SAASJ,QAAQK,YAAY,IAAIhB;IACvC,MAAMiB,cAAc5C,kBAAkBwC,WAAWE;IACjD,MAAMG,qBAAqB,GAAG7B,kBAAkBqB,QAAQV,MAAM;IAE9D,0EAA0E;IAC1E,0EAA0E;IAC1E,qDAAqD;IACrD,MAAMG,WAAWQ,QAAQR,QAAQ,IAAI;IACrC,qEAAqE;IACrE,sEAAsE;IACtE,2BAA2B;IAC3B,MAAMgB,OAAOR,QAAQQ,IAAI,IAAI;IAC7B,4EAA4E;IAC5E,uEAAuE;IACvE,2EAA2E;IAC3E,oEAAoE;IACpE,uBAAuB;IACvB,IAAIhB,aAAa,UAAUQ,QAAQS,WAAW,EAAE;QAC9C9C,OAAO+C,IAAI,CACT;IAEJ;IACA,MAAMD,cAAcjB,aAAa,SAAUQ,CAAAA,QAAQS,WAAW,IAAI,IAAG;IACrE,MAAME,QAAQX,QAAQW,KAAK,IAAI;IAE/B,0EAA0E;IAC1E,sEAAsE;IACtE,yEAAyE;IACzE,gCAAgC;IAChC,EAAE;IACF,2EAA2E;IAC3E,wEAAwE;IACxE,0CAA0C;IAC1C,MAAMC,qBAAqB,CAACC,OAAkB,CAAA;YAC5CC,UAAU;YACVC,YAAY;YACZf,SAAS;gBACPgB,SAAS;gBACTC,KAAK;gBACLC,KAAK;oBAAEC,MAAM,GAAGN,MAAM;gBAAC;YACzB;YACAO,WAAW,EAAE;QACf,CAAA;IACA,IAAIC;IACJ,IAAIxC,cAAckB,MAAMQ,qBAAqB;QAC3Cc,UAAUvC,oCAAoCiB,MAAMQ;IACtD,OAAO;QACL/C,wBAAwBuC,MAAMQ,oBAAoB;YAChDlB,MAAMkB;YACNb,MAAMY;YACNgB,aAAa;YACbC,YAAYjB;YACZkB,MAAM,EAAE;YACRC,SAAS,CAAC;YACVC,UAAU;gBACRC,WAAW/B,iCAAiCgC,EAAE;YAChD;QACF;QACAP,UAAUvC,oCAAoCiB,MAAMQ;IACtD;IACA,0EAA0E;IAC1E,mEAAmE;IACnEvB,yBAAyBe,MAAM;QAC7B8B,KAAKvB;QACLC;IACF;IACA,MAAMM,OAAO9B,WAAWgB,MAAMsB,SAAS;IACvC,4EAA4E;IAC5E,wEAAwE;IACxE,sEAAsE;IACtEA,QAAQI,OAAO,KAAK,CAAC;IACrBJ,QAAQI,OAAO,CAAC,QAAQ,KAAKb,mBAAmBC;IAChDQ,QAAQI,OAAO,CAAC,MAAM,KAAKb,mBAAmBC;IAC9ChD,2BAA2BkC,MAAMsB,QAAQhC,IAAI,EAAEgC;IAE/C,6EAA6E;IAC7E5D,cACEsC,MACArC,kBAAkB,YAAYoE,OAAO,EAAE,SAAS,WAAWtC,WAC3Dc,aACA;QACEL;QACA8B,eAAe1C;QACfwB;QACAmB,oBAAoB,EAAE;QACtBC,gBAAgB,EAAE;IACpB,GACA;QAAEC,mBAAmBtE,kBAAkBuE,YAAY;IAAC;IAEtD,IAAI1B,aAAa;QACf,2EAA2E;QAC3E,mEAAmE;QACnE,0EAA0E;QAC1EhD,cACEsC,MACArC,kBAAkB,YAAYoE,OAAO,EAAE,SAAS,UAChDxB,aACA;YAAEL;YAAeO;QAAK,GACtB;YAAE0B,mBAAmBtE,kBAAkBuE,YAAY;QAAC;IAExD;IAEA,oEAAoE;IACpE,qEAAqE;IACrE,mEAAmE;IACnE,MAAMC,MACJzB,UAAU,SAAS,MAAMtC,WAAW0B,MAAMC,QAAQoC,GAAG,IAAIC;IAE3D,2EAA2E;IAC3E,6DAA6D;IAC7D,MAAMX,WAAqC;QACzCrC;QACAiD,IAAIrC;QACJT;QACAgB;QACAK;QACA,GAAIuB,MAAM;YAAEA;QAAI,IAAI,CAAC,CAAC;IACxB;IAEAzD,qBACEoB,MACAQ,oBACAX,kCACA8B;IAGF5D,kBAAkBiC,MAAMZ,cAAc;QAAEuC;QAAUpB;IAAY;IAE9D,yEAAyE;IACzE,yDAAyD;IAEzD,IAAIK,UAAU,aAAa;QACzB,MAAMzB,0BAA0Ba,MAAM;YAAEqC;QAAI,GAAGjD;QAE/C,MAAMlB,yBACJ8B,MACA;YACEwC,sBAAsBtC;YACtBuC,sBAAsBnD;YACtBoD,aAAalC;YACbmC,kBAAkBpC;YAClBG;YACAD;YACAhB;YACA4C;QACF,GACAjD;IAEJ;IAEA,MAAMZ,gCAAgCwB,MAAM;QAC1CH;KACD;IAED,MAAMxB,qBAAqB2B;IAC3B,OAAO,IACLzB,oBAAoByB,MAAMC,QAAQ2C,yBAAyB,EAAE;YAC3DC,WAAW;gBAAC;aAAa;QAC3B;AACJ,EAAE;AAaF;;;CAGC,GACD,OAAO,MAAMC,+BAA+B,CAC1CxB;IAEA,MAAMK,WAAWL,QAAQK,QAAQ;IACjC,IAAIA,UAAUC,cAAc/B,iCAAiCgC,EAAE,EAAE;QAC/D,MAAM,IAAIkB,MACR,CAAC,SAAS,EAAEzB,QAAQhC,IAAI,CAAC,4BAA4B,EAAEO,iCAAiCgC,EAAE,CAAC,YAAY,CAAC;IAE5G;IACA,OAAOF;AACT,EAAE;AAEF,eAAe5B,0BAA0B"}

package/src/migrations/latest/dynamodb-terraform-app-module-outputs/metadata.json

@@ -0,0 +1,3 @@
+{
+  "description": "Re-export the DynamoDB table and KMS key attributes from the vended Terraform per-table app module"
+}

package/src/migrations/latest/dynamodb-terraform-app-module-outputs/migration.d.ts

@@ -0,0 +1,6 @@
+/**
+ * Copyright Amazon.com, Inc. or its affiliates. All Rights Reserved.
+ * SPDX-License-Identifier: Apache-2.0
+ */
+import { type MigrationReturnObject, type Tree } from '@nx/devkit';
+export default function migration(tree: Tree): Promise<MigrationReturnObject>;

package/src/migrations/latest/dynamodb-terraform-app-module-outputs/migration.js

@@ -0,0 +1,69 @@
+/**
+ * Copyright Amazon.com, Inc. or its affiliates. All Rights Reserved.
+ * SPDX-License-Identifier: Apache-2.0
+ */ import { joinPathFragments } from "@nx/devkit";
+import { GRIT_INSERT_PLACEHOLDER, insertViaGritQL, matchGritQL } from "../../../utils/ast.js";
+import { formatFilesInSubtree } from "../../../utils/format.js";
+import { PACKAGES_DIR, SHARED_TERRAFORM_DIR } from "../../../utils/shared-constructs-constants.js";
+/**
+ * Re-export the core dynamodb module's `table_name`, `table_arn` and
+ * `kms_key_arn` from each vended per-table Terraform app module
+ * (`app/dynamodb/<name>/<name>.tf`).
+ *
+ * The app module is what a root configuration instantiates, so without these
+ * outputs a root module cannot reference the table or its encryption key at
+ * all — for example to grant a consumer access to it.
+ *
+ * These files are generated with `KeepExisting`, so an upgraded workspace keeps
+ * a module with no outputs until this runs. Diverged files are left untouched
+ * and reported via `nextSteps`.
+ */ const TERRAFORM_DYNAMODB_APP_DIR = `${PACKAGES_DIR}/${SHARED_TERRAFORM_DIR}/src/app/dynamodb`;
+const divergedMessage = (filePath)=>`${filePath}: has diverged from the generated shape - left untouched. To reference the table from your root Terraform configuration, add table_name, table_arn and kms_key_arn outputs here forwarding the equivalent module.dynamodb_table attributes (see the ts#dynamodb generator's dynamodb app template).`;
+const hcl = (pattern)=>`language hcl\n${pattern}`;
+const OUTPUTS_TEXT = [
+    'output "table_name" {',
+    '  description = "Name of the DynamoDB table"',
+    '  value       = module.dynamodb_table.table_name',
+    '}',
+    '',
+    'output "table_arn" {',
+    '  description = "ARN of the DynamoDB table, for use in IAM policies granting access to the table. Suffix with /index/* to cover its global secondary indexes."',
+    '  value       = module.dynamodb_table.table_arn',
+    '}',
+    '',
+    'output "kms_key_arn" {',
+    '  description = "ARN of the KMS key used to encrypt the DynamoDB table, for use in IAM policies granting access to the table. Null when using the AWS owned key (encryption = DEFAULT)."',
+    '  value       = module.dynamodb_table.kms_key_arn',
+    '}'
+].join('\n');
+export default async function migration(tree) {
+    const nextSteps = [];
+    if (!tree.exists(TERRAFORM_DYNAMODB_APP_DIR)) {
+        return {
+            nextSteps
+        }; // This workspace has no Terraform dynamodb modules.
+    }
+    for (const dirName of tree.children(TERRAFORM_DYNAMODB_APP_DIR)){
+        const filePath = joinPathFragments(TERRAFORM_DYNAMODB_APP_DIR, dirName, `${dirName}.tf`);
+        if (!tree.exists(filePath)) {
+            continue; // Not a dynamodb app module directory.
+        }
+        if (await matchGritQL(tree, filePath, hcl('`output "table_arn" { $_ }`'))) {
+            continue; // Already migrated.
+        }
+        const RUNTIME_CONFIG_MODULE_BLOCK = hcl('`module "add_to_runtime_config" { $_ }`');
+        if (!await matchGritQL(tree, filePath, RUNTIME_CONFIG_MODULE_BLOCK)) {
+            nextSteps.push(divergedMessage(filePath));
+            continue;
+        }
+        // Appended after the runtime config module call, which the template ends
+        // with, matching where the generator now writes the outputs.
+        await insertViaGritQL(tree, filePath, hcl(`\`module "add_to_runtime_config" { $body }\` => \`module "add_to_runtime_config" {\n  $body\n}\n\n${GRIT_INSERT_PLACEHOLDER}\``), OUTPUTS_TEXT);
+    }
+    await formatFilesInSubtree(tree);
+    return {
+        nextSteps
+    };
+}
+
+//# sourceMappingURL=migration.js.map

package/src/migrations/latest/dynamodb-terraform-app-module-outputs/migration.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../../../../../../../packages/nx-plugin/src/migrations/latest/dynamodb-terraform-app-module-outputs/migration.ts"],"sourcesContent":["/**\n * Copyright Amazon.com, Inc. or its affiliates. All Rights Reserved.\n * SPDX-License-Identifier: Apache-2.0\n */\nimport {\n  joinPathFragments,\n  type MigrationReturnObject,\n  type Tree,\n} from '@nx/devkit';\nimport {\n  GRIT_INSERT_PLACEHOLDER,\n  insertViaGritQL,\n  matchGritQL,\n} from '../../../utils/ast.js';\nimport { formatFilesInSubtree } from '../../../utils/format.js';\nimport {\n  PACKAGES_DIR,\n  SHARED_TERRAFORM_DIR,\n} from '../../../utils/shared-constructs-constants.js';\n\n/**\n * Re-export the core dynamodb module's `table_name`, `table_arn` and\n * `kms_key_arn` from each vended per-table Terraform app module\n * (`app/dynamodb/<name>/<name>.tf`).\n *\n * The app module is what a root configuration instantiates, so without these\n * outputs a root module cannot reference the table or its encryption key at\n * all — for example to grant a consumer access to it.\n *\n * These files are generated with `KeepExisting`, so an upgraded workspace keeps\n * a module with no outputs until this runs. Diverged files are left untouched\n * and reported via `nextSteps`.\n */\n\nconst TERRAFORM_DYNAMODB_APP_DIR = `${PACKAGES_DIR}/${SHARED_TERRAFORM_DIR}/src/app/dynamodb`;\n\nconst divergedMessage = (filePath: string) =>\n  `${filePath}: has diverged from the generated shape - left untouched. To reference the table from your root Terraform configuration, add table_name, table_arn and kms_key_arn outputs here forwarding the equivalent module.dynamodb_table attributes (see the ts#dynamodb generator's dynamodb app template).`;\n\nconst hcl = (pattern: string) => `language hcl\\n${pattern}`;\n\nconst OUTPUTS_TEXT = [\n  'output \"table_name\" {',\n  '  description = \"Name of the DynamoDB table\"',\n  '  value       = module.dynamodb_table.table_name',\n  '}',\n  '',\n  'output \"table_arn\" {',\n  '  description = \"ARN of the DynamoDB table, for use in IAM policies granting access to the table. Suffix with /index/* to cover its global secondary indexes.\"',\n  '  value       = module.dynamodb_table.table_arn',\n  '}',\n  '',\n  'output \"kms_key_arn\" {',\n  '  description = \"ARN of the KMS key used to encrypt the DynamoDB table, for use in IAM policies granting access to the table. Null when using the AWS owned key (encryption = DEFAULT).\"',\n  '  value       = module.dynamodb_table.kms_key_arn',\n  '}',\n].join('\\n');\n\nexport default async function migration(\n  tree: Tree,\n): Promise<MigrationReturnObject> {\n  const nextSteps: string[] = [];\n\n  if (!tree.exists(TERRAFORM_DYNAMODB_APP_DIR)) {\n    return { nextSteps }; // This workspace has no Terraform dynamodb modules.\n  }\n\n  for (const dirName of tree.children(TERRAFORM_DYNAMODB_APP_DIR)) {\n    const filePath = joinPathFragments(\n      TERRAFORM_DYNAMODB_APP_DIR,\n      dirName,\n      `${dirName}.tf`,\n    );\n    if (!tree.exists(filePath)) {\n      continue; // Not a dynamodb app module directory.\n    }\n\n    if (await matchGritQL(tree, filePath, hcl('`output \"table_arn\" { $_ }`'))) {\n      continue; // Already migrated.\n    }\n\n    const RUNTIME_CONFIG_MODULE_BLOCK = hcl(\n      '`module \"add_to_runtime_config\" { $_ }`',\n    );\n    if (!(await matchGritQL(tree, filePath, RUNTIME_CONFIG_MODULE_BLOCK))) {\n      nextSteps.push(divergedMessage(filePath));\n      continue;\n    }\n\n    // Appended after the runtime config module call, which the template ends\n    // with, matching where the generator now writes the outputs.\n    await insertViaGritQL(\n      tree,\n      filePath,\n      hcl(\n        `\\`module \"add_to_runtime_config\" { $body }\\` => \\`module \"add_to_runtime_config\" {\\n  $body\\n}\\n\\n${GRIT_INSERT_PLACEHOLDER}\\``,\n      ),\n      OUTPUTS_TEXT,\n    );\n  }\n\n  await formatFilesInSubtree(tree);\n\n  return { nextSteps };\n}\n"],"names":["joinPathFragments","GRIT_INSERT_PLACEHOLDER","insertViaGritQL","matchGritQL","formatFilesInSubtree","PACKAGES_DIR","SHARED_TERRAFORM_DIR","TERRAFORM_DYNAMODB_APP_DIR","divergedMessage","filePath","hcl","pattern","OUTPUTS_TEXT","join","migration","tree","nextSteps","exists","dirName","children","RUNTIME_CONFIG_MODULE_BLOCK","push"],"mappings":"AAAA;;;CAGC,GACD,SACEA,iBAAiB,QAGZ,aAAa;AACpB,SACEC,uBAAuB,EACvBC,eAAe,EACfC,WAAW,QACN,wBAAwB;AAC/B,SAASC,oBAAoB,QAAQ,2BAA2B;AAChE,SACEC,YAAY,EACZC,oBAAoB,QACf,gDAAgD;AAEvD;;;;;;;;;;;;CAYC,GAED,MAAMC,6BAA6B,GAAGF,aAAa,CAAC,EAAEC,qBAAqB,iBAAiB,CAAC;AAE7F,MAAME,kBAAkB,CAACC,WACvB,GAAGA,SAAS,mSAAmS,CAAC;AAElT,MAAMC,MAAM,CAACC,UAAoB,CAAC,cAAc,EAAEA,SAAS;AAE3D,MAAMC,eAAe;IACnB;IACA;IACA;IACA;IACA;IACA;IACA;IACA;IACA;IACA;IACA;IACA;IACA;IACA;CACD,CAACC,IAAI,CAAC;AAEP,eAAe,eAAeC,UAC5BC,IAAU;IAEV,MAAMC,YAAsB,EAAE;IAE9B,IAAI,CAACD,KAAKE,MAAM,CAACV,6BAA6B;QAC5C,OAAO;YAAES;QAAU,GAAG,oDAAoD;IAC5E;IAEA,KAAK,MAAME,WAAWH,KAAKI,QAAQ,CAACZ,4BAA6B;QAC/D,MAAME,WAAWT,kBACfO,4BACAW,SACA,GAAGA,QAAQ,GAAG,CAAC;QAEjB,IAAI,CAACH,KAAKE,MAAM,CAACR,WAAW;YAC1B,UAAU,uCAAuC;QACnD;QAEA,IAAI,MAAMN,YAAYY,MAAMN,UAAUC,IAAI,iCAAiC;YACzE,UAAU,oBAAoB;QAChC;QAEA,MAAMU,8BAA8BV,IAClC;QAEF,IAAI,CAAE,MAAMP,YAAYY,MAAMN,UAAUW,8BAA+B;YACrEJ,UAAUK,IAAI,CAACb,gBAAgBC;YAC/B;QACF;QAEA,yEAAyE;QACzE,6DAA6D;QAC7D,MAAMP,gBACJa,MACAN,UACAC,IACE,CAAC,kGAAkG,EAAET,wBAAwB,EAAE,CAAC,GAElIW;IAEJ;IAEA,MAAMR,qBAAqBW;IAE3B,OAAO;QAAEC;IAAU;AACrB"}

package/src/migrations/latest/terraform-data-resource-destroy-protection/__snapshots__/migration.spec.ts.snap

@@ -0,0 +1,75 @@
+// Vitest Snapshot v1, https://vitest.dev/guide/snapshot.html
+
+exports[`terraform-data-resource-destroy-protection migration > should protect the aurora cluster and pin its key window 1`] = `
+"resource "aws_kms_key" "database" {
+  description         = "KMS key for Aurora cluster \${var.name}"
+  enable_key_rotation = var.enable_key_rotation
+
+  deletion_window_in_days = 30
+
+  tags = merge(var.tags, {
+    Name = "\${var.name}-aurora"
+  })
+}
+
+resource "aws_rds_cluster" "database" {
+  cluster_identifier  = local.cluster_name
+  engine              = var.engine
+  storage_encrypted   = true
+  kms_key_id          = aws_kms_key.database.arn
+  deletion_protection = var.deletion_protection
+  skip_final_snapshot = var.skip_final_snapshot
+
+  serverlessv2_scaling_configuration {
+    min_capacity = var.serverless_min_capacity
+    max_capacity = var.serverless_max_capacity
+  }
+
+  tags = merge(var.tags, {
+    Name = "\${var.name}-aurora"
+  })
+
+  lifecycle {
+    prevent_destroy = true
+  }
+}
+"
+`;
+
+exports[`terraform-data-resource-destroy-protection migration > should protect the dynamodb table and pin its key window 1`] = `
+"resource "aws_kms_key" "table" {
+  count = local.create_table_key ? 1 : 0
+
+  description         = "KMS key for DynamoDB table \${var.name}"
+  enable_key_rotation = var.enable_key_rotation
+
+  deletion_window_in_days = 30
+}
+
+resource "aws_dynamodb_table" "table" {
+  name                        = var.name
+  billing_mode                = var.billing_mode
+  hash_key                    = "pk"
+  range_key                   = "sk"
+  deletion_protection_enabled = var.deletion_protection_enabled
+
+  attribute {
+    name = "pk"
+    type = "S"
+  }
+
+  point_in_time_recovery {
+    enabled = var.point_in_time_recovery_enabled
+  }
+
+  server_side_encryption {
+    enabled     = var.encryption != "DEFAULT"
+    kms_key_arn = local.table_kms_key_arn
+  }
+
+  lifecycle {
+    prevent_destroy = true
+  }
+}
+"
+`;

package/src/migrations/latest/terraform-data-resource-destroy-protection/metadata.json

@@ -0,0 +1,3 @@
+{
+  "description": "Add prevent_destroy and a 30 day KMS deletion window to the vended Terraform DynamoDB table and Aurora cluster modules"
+}

package/src/migrations/latest/terraform-data-resource-destroy-protection/migration.d.ts

@@ -0,0 +1,6 @@
+/**
+ * Copyright Amazon.com, Inc. or its affiliates. All Rights Reserved.
+ * SPDX-License-Identifier: Apache-2.0
+ */
+import type { MigrationReturnObject, Tree } from '@nx/devkit';
+export default function migration(tree: Tree): Promise<MigrationReturnObject>;

package/src/migrations/latest/terraform-data-resource-destroy-protection/migration.js

@@ -0,0 +1,78 @@
+/**
+ * Copyright Amazon.com, Inc. or its affiliates. All Rights Reserved.
+ * SPDX-License-Identifier: Apache-2.0
+ */ import { applyGritQL, matchGritQL } from "../../../utils/ast.js";
+import { formatFilesInSubtree } from "../../../utils/format.js";
+import { PACKAGES_DIR, SHARED_TERRAFORM_DIR } from "../../../utils/shared-constructs-constants.js";
+/**
+ * Bring existing workspaces up to the destroy protection the generators now
+ * vend on the data-bearing Terraform resources:
+ *
+ * - The DynamoDB table and the Aurora cluster gain
+ *   `lifecycle { prevent_destroy = true }`. This is a second, independent layer
+ *   on top of the service-side `deletion_protection_enabled` /
+ *   `deletion_protection` flags, matching the two guards the CDK constructs
+ *   already have (`deletionProtection` plus `RemovalPolicy.RETAIN`). Without it,
+ *   clearing the service-side flag destroys the data in the same apply.
+ *   `prevent_destroy` cannot reference a variable, so it is vended as a literal
+ *   and removed to tear down.
+ * - Their KMS keys pin `deletion_window_in_days = 30`, the provider maximum and
+ *   the CDK default. Restoring either resource from a point-in-time backup or
+ *   snapshot requires its key, so the window in which a scheduled key deletion
+ *   can still be cancelled matters as much as the backup itself.
+ *
+ * These files are generated with `KeepExisting`, so without this an upgraded
+ * workspace keeps the weaker single-layer protection. Diverged files are left
+ * untouched and reported via `nextSteps`.
+ */ const TERRAFORM_DYNAMODB_FILE = `${PACKAGES_DIR}/${SHARED_TERRAFORM_DIR}/src/core/dynamodb/dynamodb.tf`;
+const TERRAFORM_AURORA_FILE = `${PACKAGES_DIR}/${SHARED_TERRAFORM_DIR}/src/core/rdb/aurora/aurora.tf`;
+const hcl = (pattern)=>`language hcl\n${pattern}`;
+const divergedMessage = (filePath, resource)=>`${filePath}: has diverged from the generated shape - left untouched. To protect the ${resource} from being destroyed when the service-side deletion protection flag is cleared, add \`lifecycle { prevent_destroy = true }\` to it, and set \`deletion_window_in_days = 30\` on its KMS key.`;
+/**
+ * Add the maximum KMS pending window to a key that omits it, so a scheduled
+ * deletion stays cancellable for as long as the provider allows.
+ */ const migrateKmsKey = async (tree, filePath, keyLabel)=>{
+    const keyBlock = hcl(`\`resource "aws_kms_key" "${keyLabel}" { $props }\``);
+    // Already pinned - nothing to do.
+    if (await matchGritQL(tree, filePath, hcl(`\`resource "aws_kms_key" "${keyLabel}" { $props }\` where { $props <: contains \`deletion_window_in_days = $_\` }`))) {
+        return;
+    }
+    if (!await matchGritQL(tree, filePath, keyBlock)) {
+        return; // Reported by the caller, which matches the data resource too.
+    }
+    await applyGritQL(tree, filePath, hcl(`\`resource "aws_kms_key" "${keyLabel}" { $props }\` where { $props <: contains \`enable_key_rotation = $rotation\` => \`enable_key_rotation = $rotation\n\n  deletion_window_in_days = 30\` }`));
+};
+/**
+ * Add `lifecycle { prevent_destroy = true }` to a data-bearing resource.
+ */ const migrateDataResource = async (tree, filePath, resourceType, resourceLabel, nextSteps, description)=>{
+    const resourceBlock = hcl(`\`resource "${resourceType}" "${resourceLabel}" { $props }\``);
+    if (!await matchGritQL(tree, filePath, resourceBlock)) {
+        nextSteps.push(divergedMessage(filePath, description));
+        return false;
+    }
+    // Already guarded - keep the user's block, whatever it is set to.
+    if (await matchGritQL(tree, filePath, hcl(`\`resource "${resourceType}" "${resourceLabel}" { $props }\` where { $props <: contains \`prevent_destroy = $_\` }`))) {
+        return true;
+    }
+    await applyGritQL(tree, filePath, hcl(`\`resource "${resourceType}" "${resourceLabel}" { $props }\` => \`resource "${resourceType}" "${resourceLabel}" {\n  $props\n\n  lifecycle {\n    prevent_destroy = true\n  }\n}\``));
+    return true;
+};
+export default async function migration(tree) {
+    const nextSteps = [];
+    if (tree.exists(TERRAFORM_DYNAMODB_FILE)) {
+        if (await migrateDataResource(tree, TERRAFORM_DYNAMODB_FILE, 'aws_dynamodb_table', 'table', nextSteps, 'DynamoDB table')) {
+            await migrateKmsKey(tree, TERRAFORM_DYNAMODB_FILE, 'table');
+        }
+    }
+    if (tree.exists(TERRAFORM_AURORA_FILE)) {
+        if (await migrateDataResource(tree, TERRAFORM_AURORA_FILE, 'aws_rds_cluster', 'database', nextSteps, 'Aurora cluster')) {
+            await migrateKmsKey(tree, TERRAFORM_AURORA_FILE, 'database');
+        }
+    }
+    await formatFilesInSubtree(tree);
+    return {
+        nextSteps
+    };
+}
+
+//# sourceMappingURL=migration.js.map

package/src/migrations/latest/terraform-data-resource-destroy-protection/migration.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../../../../../../../packages/nx-plugin/src/migrations/latest/terraform-data-resource-destroy-protection/migration.ts"],"sourcesContent":["/**\n * Copyright Amazon.com, Inc. or its affiliates. All Rights Reserved.\n * SPDX-License-Identifier: Apache-2.0\n */\nimport type { MigrationReturnObject, Tree } from '@nx/devkit';\nimport { applyGritQL, matchGritQL } from '../../../utils/ast.js';\nimport { formatFilesInSubtree } from '../../../utils/format.js';\nimport {\n  PACKAGES_DIR,\n  SHARED_TERRAFORM_DIR,\n} from '../../../utils/shared-constructs-constants.js';\n\n/**\n * Bring existing workspaces up to the destroy protection the generators now\n * vend on the data-bearing Terraform resources:\n *\n * - The DynamoDB table and the Aurora cluster gain\n *   `lifecycle { prevent_destroy = true }`. This is a second, independent layer\n *   on top of the service-side `deletion_protection_enabled` /\n *   `deletion_protection` flags, matching the two guards the CDK constructs\n *   already have (`deletionProtection` plus `RemovalPolicy.RETAIN`). Without it,\n *   clearing the service-side flag destroys the data in the same apply.\n *   `prevent_destroy` cannot reference a variable, so it is vended as a literal\n *   and removed to tear down.\n * - Their KMS keys pin `deletion_window_in_days = 30`, the provider maximum and\n *   the CDK default. Restoring either resource from a point-in-time backup or\n *   snapshot requires its key, so the window in which a scheduled key deletion\n *   can still be cancelled matters as much as the backup itself.\n *\n * These files are generated with `KeepExisting`, so without this an upgraded\n * workspace keeps the weaker single-layer protection. Diverged files are left\n * untouched and reported via `nextSteps`.\n */\n\nconst TERRAFORM_DYNAMODB_FILE = `${PACKAGES_DIR}/${SHARED_TERRAFORM_DIR}/src/core/dynamodb/dynamodb.tf`;\nconst TERRAFORM_AURORA_FILE = `${PACKAGES_DIR}/${SHARED_TERRAFORM_DIR}/src/core/rdb/aurora/aurora.tf`;\n\nconst hcl = (pattern: string) => `language hcl\\n${pattern}`;\n\nconst divergedMessage = (filePath: string, resource: string) =>\n  `${filePath}: has diverged from the generated shape - left untouched. To protect the ${resource} from being destroyed when the service-side deletion protection flag is cleared, add \\`lifecycle { prevent_destroy = true }\\` to it, and set \\`deletion_window_in_days = 30\\` on its KMS key.`;\n\n/**\n * Add the maximum KMS pending window to a key that omits it, so a scheduled\n * deletion stays cancellable for as long as the provider allows.\n */\nconst migrateKmsKey = async (\n  tree: Tree,\n  filePath: string,\n  keyLabel: string,\n): Promise<void> => {\n  const keyBlock = hcl(`\\`resource \"aws_kms_key\" \"${keyLabel}\" { $props }\\``);\n\n  // Already pinned - nothing to do.\n  if (\n    await matchGritQL(\n      tree,\n      filePath,\n      hcl(\n        `\\`resource \"aws_kms_key\" \"${keyLabel}\" { $props }\\` where { $props <: contains \\`deletion_window_in_days = $_\\` }`,\n      ),\n    )\n  ) {\n    return;\n  }\n\n  if (!(await matchGritQL(tree, filePath, keyBlock))) {\n    return; // Reported by the caller, which matches the data resource too.\n  }\n\n  await applyGritQL(\n    tree,\n    filePath,\n    hcl(\n      `\\`resource \"aws_kms_key\" \"${keyLabel}\" { $props }\\` where { $props <: contains \\`enable_key_rotation = $rotation\\` => \\`enable_key_rotation = $rotation\\n\\n  deletion_window_in_days = 30\\` }`,\n    ),\n  );\n};\n\n/**\n * Add `lifecycle { prevent_destroy = true }` to a data-bearing resource.\n */\nconst migrateDataResource = async (\n  tree: Tree,\n  filePath: string,\n  resourceType: string,\n  resourceLabel: string,\n  nextSteps: string[],\n  description: string,\n): Promise<boolean> => {\n  const resourceBlock = hcl(\n    `\\`resource \"${resourceType}\" \"${resourceLabel}\" { $props }\\``,\n  );\n\n  if (!(await matchGritQL(tree, filePath, resourceBlock))) {\n    nextSteps.push(divergedMessage(filePath, description));\n    return false;\n  }\n\n  // Already guarded - keep the user's block, whatever it is set to.\n  if (\n    await matchGritQL(\n      tree,\n      filePath,\n      hcl(\n        `\\`resource \"${resourceType}\" \"${resourceLabel}\" { $props }\\` where { $props <: contains \\`prevent_destroy = $_\\` }`,\n      ),\n    )\n  ) {\n    return true;\n  }\n\n  await applyGritQL(\n    tree,\n    filePath,\n    hcl(\n      `\\`resource \"${resourceType}\" \"${resourceLabel}\" { $props }\\` => \\`resource \"${resourceType}\" \"${resourceLabel}\" {\\n  $props\\n\\n  lifecycle {\\n    prevent_destroy = true\\n  }\\n}\\``,\n    ),\n  );\n\n  return true;\n};\n\nexport default async function migration(\n  tree: Tree,\n): Promise<MigrationReturnObject> {\n  const nextSteps: string[] = [];\n\n  if (tree.exists(TERRAFORM_DYNAMODB_FILE)) {\n    if (\n      await migrateDataResource(\n        tree,\n        TERRAFORM_DYNAMODB_FILE,\n        'aws_dynamodb_table',\n        'table',\n        nextSteps,\n        'DynamoDB table',\n      )\n    ) {\n      await migrateKmsKey(tree, TERRAFORM_DYNAMODB_FILE, 'table');\n    }\n  }\n\n  if (tree.exists(TERRAFORM_AURORA_FILE)) {\n    if (\n      await migrateDataResource(\n        tree,\n        TERRAFORM_AURORA_FILE,\n        'aws_rds_cluster',\n        'database',\n        nextSteps,\n        'Aurora cluster',\n      )\n    ) {\n      await migrateKmsKey(tree, TERRAFORM_AURORA_FILE, 'database');\n    }\n  }\n\n  await formatFilesInSubtree(tree);\n\n  return { nextSteps };\n}\n"],"names":["applyGritQL","matchGritQL","formatFilesInSubtree","PACKAGES_DIR","SHARED_TERRAFORM_DIR","TERRAFORM_DYNAMODB_FILE","TERRAFORM_AURORA_FILE","hcl","pattern","divergedMessage","filePath","resource","migrateKmsKey","tree","keyLabel","keyBlock","migrateDataResource","resourceType","resourceLabel","nextSteps","description","resourceBlock","push","migration","exists"],"mappings":"AAAA;;;CAGC,GAED,SAASA,WAAW,EAAEC,WAAW,QAAQ,wBAAwB;AACjE,SAASC,oBAAoB,QAAQ,2BAA2B;AAChE,SACEC,YAAY,EACZC,oBAAoB,QACf,gDAAgD;AAEvD;;;;;;;;;;;;;;;;;;;;CAoBC,GAED,MAAMC,0BAA0B,GAAGF,aAAa,CAAC,EAAEC,qBAAqB,8BAA8B,CAAC;AACvG,MAAME,wBAAwB,GAAGH,aAAa,CAAC,EAAEC,qBAAqB,8BAA8B,CAAC;AAErG,MAAMG,MAAM,CAACC,UAAoB,CAAC,cAAc,EAAEA,SAAS;AAE3D,MAAMC,kBAAkB,CAACC,UAAkBC,WACzC,GAAGD,SAAS,yEAAyE,EAAEC,SAAS,6LAA6L,CAAC;AAEhS;;;CAGC,GACD,MAAMC,gBAAgB,OACpBC,MACAH,UACAI;IAEA,MAAMC,WAAWR,IAAI,CAAC,0BAA0B,EAAEO,SAAS,cAAc,CAAC;IAE1E,kCAAkC;IAClC,IACE,MAAMb,YACJY,MACAH,UACAH,IACE,CAAC,0BAA0B,EAAEO,SAAS,4EAA4E,CAAC,IAGvH;QACA;IACF;IAEA,IAAI,CAAE,MAAMb,YAAYY,MAAMH,UAAUK,WAAY;QAClD,QAAQ,+DAA+D;IACzE;IAEA,MAAMf,YACJa,MACAH,UACAH,IACE,CAAC,0BAA0B,EAAEO,SAAS,wJAAwJ,CAAC;AAGrM;AAEA;;CAEC,GACD,MAAME,sBAAsB,OAC1BH,MACAH,UACAO,cACAC,eACAC,WACAC;IAEA,MAAMC,gBAAgBd,IACpB,CAAC,YAAY,EAAEU,aAAa,GAAG,EAAEC,cAAc,cAAc,CAAC;IAGhE,IAAI,CAAE,MAAMjB,YAAYY,MAAMH,UAAUW,gBAAiB;QACvDF,UAAUG,IAAI,CAACb,gBAAgBC,UAAUU;QACzC,OAAO;IACT;IAEA,kEAAkE;IAClE,IACE,MAAMnB,YACJY,MACAH,UACAH,IACE,CAAC,YAAY,EAAEU,aAAa,GAAG,EAAEC,cAAc,oEAAoE,CAAC,IAGxH;QACA,OAAO;IACT;IAEA,MAAMlB,YACJa,MACAH,UACAH,IACE,CAAC,YAAY,EAAEU,aAAa,GAAG,EAAEC,cAAc,8BAA8B,EAAED,aAAa,GAAG,EAAEC,cAAc,oEAAoE,CAAC;IAIxL,OAAO;AACT;AAEA,eAAe,eAAeK,UAC5BV,IAAU;IAEV,MAAMM,YAAsB,EAAE;IAE9B,IAAIN,KAAKW,MAAM,CAACnB,0BAA0B;QACxC,IACE,MAAMW,oBACJH,MACAR,yBACA,sBACA,SACAc,WACA,mBAEF;YACA,MAAMP,cAAcC,MAAMR,yBAAyB;QACrD;IACF;IAEA,IAAIQ,KAAKW,MAAM,CAAClB,wBAAwB;QACtC,IACE,MAAMU,oBACJH,MACAP,uBACA,mBACA,YACAa,WACA,mBAEF;YACA,MAAMP,cAAcC,MAAMP,uBAAuB;QACnD;IACF;IAEA,MAAMJ,qBAAqBW;IAE3B,OAAO;QAAEM;IAAU;AACrB"}

package/src/migrations/latest/terraform-gateway-cedar-render-root-ejs/metadata.json

@@ -0,0 +1,3 @@
+{
+  "description": "Declare ejs at the workspace root so the Terraform gateway's Cedar render script resolves it"
+}

package/src/migrations/latest/terraform-gateway-cedar-render-root-ejs/migration.d.ts

@@ -0,0 +1,6 @@
+/**
+ * Copyright Amazon.com, Inc. or its affiliates. All Rights Reserved.
+ * SPDX-License-Identifier: Apache-2.0
+ */
+import { type MigrationReturnObject, type Tree } from '@nx/devkit';
+export default function migration(tree: Tree): Promise<MigrationReturnObject>;

package/src/migrations/latest/terraform-gateway-cedar-render-root-ejs/migration.js

@@ -0,0 +1,38 @@
+/**
+ * Copyright Amazon.com, Inc. or its affiliates. All Rights Reserved.
+ * SPDX-License-Identifier: Apache-2.0
+ */ import { getProjects, joinPathFragments } from "@nx/devkit";
+import { AGENTCORE_GATEWAY_GENERATOR_INFO } from "../../../agentcore-gateway/generator.js";
+import { addDependenciesToPackageJson } from "../../../utils/dependencies.js";
+import { formatFilesInSubtree } from "../../../utils/format.js";
+import { PACKAGES_DIR, SHARED_TERRAFORM_DIR } from "../../../utils/shared-constructs-constants.js";
+import { TS_VERSIONS } from "../../../utils/versions.js";
+/**
+ * Declare `ejs` at the workspace root for Terraform gateways with Cedar
+ * policies, which is where `render-cedar.cjs` resolves it from: the script runs
+ * in the shared terraform project, which has no `package.json` of its own.
+ */ const RENDER_SCRIPT = 'render-cedar.cjs';
+export default async function migration(tree) {
+    const gatewaysDir = joinPathFragments(PACKAGES_DIR, SHARED_TERRAFORM_DIR, 'src', 'app', 'gateways');
+    let needsRootEjs = false;
+    for (const project of getProjects(tree).values()){
+        const metadata = project.metadata;
+        if (metadata?.generator !== AGENTCORE_GATEWAY_GENERATOR_INFO.id) {
+            continue;
+        }
+        // Only a Terraform gateway with Cedar policies vends the render script; a
+        // CDK one resolves ejs from the shared constructs project instead.
+        if (tree.exists(joinPathFragments(gatewaysDir, metadata.name ?? '', RENDER_SCRIPT))) {
+            needsRootEjs = true;
+        }
+    }
+    if (needsRootEjs) {
+        addDependenciesToPackageJson(tree, {}, {
+            ejs: TS_VERSIONS.ejs
+        });
+    }
+    await formatFilesInSubtree(tree);
+    return {};
+}
+
+//# sourceMappingURL=migration.js.map

package/src/migrations/latest/terraform-gateway-cedar-render-root-ejs/migration.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../../../../../../../packages/nx-plugin/src/migrations/latest/terraform-gateway-cedar-render-root-ejs/migration.ts"],"sourcesContent":["/**\n * Copyright Amazon.com, Inc. or its affiliates. All Rights Reserved.\n * SPDX-License-Identifier: Apache-2.0\n */\nimport {\n  getProjects,\n  joinPathFragments,\n  type MigrationReturnObject,\n  type Tree,\n} from '@nx/devkit';\nimport { AGENTCORE_GATEWAY_GENERATOR_INFO } from '../../../agentcore-gateway/generator.js';\nimport { addDependenciesToPackageJson } from '../../../utils/dependencies.js';\nimport { formatFilesInSubtree } from '../../../utils/format.js';\nimport {\n  PACKAGES_DIR,\n  SHARED_TERRAFORM_DIR,\n} from '../../../utils/shared-constructs-constants.js';\nimport { TS_VERSIONS } from '../../../utils/versions.js';\n\n/**\n * Declare `ejs` at the workspace root for Terraform gateways with Cedar\n * policies, which is where `render-cedar.cjs` resolves it from: the script runs\n * in the shared terraform project, which has no `package.json` of its own.\n */\n\nconst RENDER_SCRIPT = 'render-cedar.cjs';\n\nexport default async function migration(\n  tree: Tree,\n): Promise<MigrationReturnObject> {\n  const gatewaysDir = joinPathFragments(\n    PACKAGES_DIR,\n    SHARED_TERRAFORM_DIR,\n    'src',\n    'app',\n    'gateways',\n  );\n  let needsRootEjs = false;\n\n  for (const project of getProjects(tree).values()) {\n    const metadata = project.metadata as\n      | { generator?: string; name?: string }\n      | undefined;\n    if (metadata?.generator !== AGENTCORE_GATEWAY_GENERATOR_INFO.id) {\n      continue;\n    }\n\n    // Only a Terraform gateway with Cedar policies vends the render script; a\n    // CDK one resolves ejs from the shared constructs project instead.\n    if (\n      tree.exists(\n        joinPathFragments(gatewaysDir, metadata.name ?? '', RENDER_SCRIPT),\n      )\n    ) {\n      needsRootEjs = true;\n    }\n  }\n\n  if (needsRootEjs) {\n    addDependenciesToPackageJson(tree, {}, { ejs: TS_VERSIONS.ejs });\n  }\n\n  await formatFilesInSubtree(tree);\n\n  return {};\n}\n"],"names":["getProjects","joinPathFragments","AGENTCORE_GATEWAY_GENERATOR_INFO","addDependenciesToPackageJson","formatFilesInSubtree","PACKAGES_DIR","SHARED_TERRAFORM_DIR","TS_VERSIONS","RENDER_SCRIPT","migration","tree","gatewaysDir","needsRootEjs","project","values","metadata","generator","id","exists","name","ejs"],"mappings":"AAAA;;;CAGC,GACD,SACEA,WAAW,EACXC,iBAAiB,QAGZ,aAAa;AACpB,SAASC,gCAAgC,QAAQ,0CAA0C;AAC3F,SAASC,4BAA4B,QAAQ,iCAAiC;AAC9E,SAASC,oBAAoB,QAAQ,2BAA2B;AAChE,SACEC,YAAY,EACZC,oBAAoB,QACf,gDAAgD;AACvD,SAASC,WAAW,QAAQ,6BAA6B;AAEzD;;;;CAIC,GAED,MAAMC,gBAAgB;AAEtB,eAAe,eAAeC,UAC5BC,IAAU;IAEV,MAAMC,cAAcV,kBAClBI,cACAC,sBACA,OACA,OACA;IAEF,IAAIM,eAAe;IAEnB,KAAK,MAAMC,WAAWb,YAAYU,MAAMI,MAAM,GAAI;QAChD,MAAMC,WAAWF,QAAQE,QAAQ;QAGjC,IAAIA,UAAUC,cAAcd,iCAAiCe,EAAE,EAAE;YAC/D;QACF;QAEA,0EAA0E;QAC1E,mEAAmE;QACnE,IACEP,KAAKQ,MAAM,CACTjB,kBAAkBU,aAAaI,SAASI,IAAI,IAAI,IAAIX,iBAEtD;YACAI,eAAe;QACjB;IACF;IAEA,IAAIA,cAAc;QAChBT,6BAA6BO,MAAM,CAAC,GAAG;YAAEU,KAAKb,YAAYa,GAAG;QAAC;IAChE;IAEA,MAAMhB,qBAAqBM;IAE3B,OAAO,CAAC;AACV"}

package/src/py/dynamodb/__snapshots__/generator.spec.ts.snap

@@ -126,6 +126,8 @@ resource "aws_kms_key" "table" {
   description         = "KMS key for DynamoDB table \${var.name}"
   enable_key_rotation = var.enable_key_rotation
 
+  deletion_window_in_days = 30
+
   policy = jsonencode({
     Version = "2012-10-17"
     Statement = [
@@ -202,6 +204,10 @@ resource "aws_dynamodb_table" "table" {
     enabled     = var.encryption != "DEFAULT"
     kms_key_arn = local.table_kms_key_arn
   }
+
+  lifecycle {
+    prevent_destroy = true
+  }
 }
 
 output "table_name" {
@@ -320,6 +326,21 @@ module "add_to_runtime_config" {
     tableName = module.dynamodb_table.table_name
   }
 }
+
+output "table_name" {
+  description = "Name of the DynamoDB table"
+  value       = module.dynamodb_table.table_name
+}
+
+output "table_arn" {
+  description = "ARN of the DynamoDB table, for use in IAM policies granting access to the table. Suffix with /index/* to cover its global secondary indexes."
+  value       = module.dynamodb_table.table_arn
+}
+
+output "kms_key_arn" {
+  description = "ARN of the KMS key used to encrypt the DynamoDB table, for use in IAM policies granting access to the table. Null when using the AWS owned key (encryption = DEFAULT)."
+  value       = module.dynamodb_table.kms_key_arn
+}
 "
 `;
 

package/src/ts/dynamodb/__snapshots__/generator.spec.ts.snap

@@ -126,6 +126,8 @@ resource "aws_kms_key" "table" {
   description         = "KMS key for DynamoDB table \${var.name}"
   enable_key_rotation = var.enable_key_rotation
 
+  deletion_window_in_days = 30
+
   policy = jsonencode({
     Version = "2012-10-17"
     Statement = [
@@ -202,6 +204,10 @@ resource "aws_dynamodb_table" "table" {
     enabled     = var.encryption != "DEFAULT"
     kms_key_arn = local.table_kms_key_arn
   }
+
+  lifecycle {
+    prevent_destroy = true
+  }
 }
 
 output "table_name" {
@@ -320,6 +326,21 @@ module "add_to_runtime_config" {
     tableName = module.dynamodb_table.table_name
   }
 }
+
+output "table_name" {
+  description = "Name of the DynamoDB table"
+  value       = module.dynamodb_table.table_name
+}
+
+output "table_arn" {
+  description = "ARN of the DynamoDB table, for use in IAM policies granting access to the table. Suffix with /index/* to cover its global secondary indexes."
+  value       = module.dynamodb_table.table_arn
+}
+
+output "kms_key_arn" {
+  description = "ARN of the KMS key used to encrypt the DynamoDB table, for use in IAM policies granting access to the table. Null when using the AWS owned key (encryption = DEFAULT)."
+  value       = module.dynamodb_table.kms_key_arn
+}
 "
 `;
 

package/src/ts/rdb/__snapshots__/generator.spec.ts.snap

@@ -1008,6 +1008,8 @@ resource "aws_kms_key" "database" {
   description         = "KMS key for Aurora cluster \${var.name}"
   enable_key_rotation = var.enable_key_rotation
 
+  deletion_window_in_days = 30
+
   policy = jsonencode({
     Version = "2012-10-17"
     Statement = [
@@ -1150,6 +1152,10 @@ resource "aws_rds_cluster" "database" {
   tags = merge(var.tags, {
     Name = "\${var.name}-aurora"
   })
+
+  lifecycle {
+    prevent_destroy = true
+  }
 }
 
 resource "aws_rds_cluster_instance" "database" {
@@ -2494,6 +2500,8 @@ resource "aws_kms_key" "database" {
   description         = "KMS key for Aurora cluster \${var.name}"
   enable_key_rotation = var.enable_key_rotation
 
+  deletion_window_in_days = 30
+
   policy = jsonencode({
     Version = "2012-10-17"
     Statement = [
@@ -2636,6 +2644,10 @@ resource "aws_rds_cluster" "database" {
   tags = merge(var.tags, {
     Name = "\${var.name}-aurora"
   })
+
+  lifecycle {
+    prevent_destroy = true
+  }
 }
 
 resource "aws_rds_cluster_instance" "database" {

package/src/utils/agent-core-constructs/agent-core-constructs.d.ts

@@ -13,8 +13,10 @@ type IACProvider = {
 /**
  * Dependencies a caller must declare to add an AgentCore Gateway construct.
  *
- * Gated on infrastructure having been generated, since the construct helpers only
- * run on that branch.
+ * Both providers render Cedar policies with `ejs`, each from a different
+ * manifest: the CDK construct imports it from the shared constructs project,
+ * while Terraform's `render-cedar.cjs` resolves it from the workspace root,
+ * since the shared terraform project it runs in has no `package.json`.
  */
 export declare const AGENT_CORE_CONSTRUCTS_DEPENDENCIES: readonly [{
     readonly name: "ejs";
@@ -25,6 +27,11 @@ export declare const AGENT_CORE_CONSTRUCTS_DEPENDENCIES: readonly [{
 }, {
     readonly name: "@types/ejs";
     readonly when: (m: IacMetadata) => boolean;
+}, {
+    readonly name: "ejs";
+    readonly when: (m: IacMetadata) => boolean;
+    readonly dev: true;
+    readonly root: true;
 }];
 /**
  * Python versions the generated Terraform pins in an inline `uv run --with`

package/src/utils/agent-core-constructs/agent-core-constructs.js

@@ -7,25 +7,33 @@ import { forDependencies } from "../declared-dependencies.js";
 import { addDependenciesToPackageJson } from "../dependencies.js";
 import { esmVars } from "../module-format.js";
 import { addDependencyToTargetIfNotPresent } from "../nx.js";
-import { generatedInfrastructure, generatedTerraform, PACKAGES_DIR, SHARED_CONSTRUCTS_DIR, SHARED_TERRAFORM_DIR } from "../shared-constructs-constants.js";
+import { generatedCdk, generatedTerraform, PACKAGES_DIR, SHARED_CONSTRUCTS_DIR, SHARED_TERRAFORM_DIR } from "../shared-constructs-constants.js";
 import { PY_VERSIONS, terraformProviderVersions, withVersions } from "../versions.js";
 /**
  * Dependencies a caller must declare to add an AgentCore Gateway construct.
  *
- * Gated on infrastructure having been generated, since the construct helpers only
- * run on that branch.
+ * Both providers render Cedar policies with `ejs`, each from a different
+ * manifest: the CDK construct imports it from the shared constructs project,
+ * while Terraform's `render-cedar.cjs` resolves it from the workspace root,
+ * since the shared terraform project it runs in has no `package.json`.
  */ export const AGENT_CORE_CONSTRUCTS_DEPENDENCIES = [
     {
         name: 'ejs',
-        when: generatedInfrastructure
+        when: generatedCdk
     },
     {
         name: '@aws-sdk/client-bedrock-agentcore',
-        when: generatedInfrastructure
+        when: generatedCdk
     },
     {
         name: '@types/ejs',
-        when: generatedInfrastructure
+        when: generatedCdk
+    },
+    {
+        name: 'ejs',
+        when: generatedTerraform,
+        dev: true,
+        root: true
     }
 ];
 /**
@@ -134,7 +142,7 @@ export const addAgentCoreGatewayInfra = async (tree, options, declaration)=>{
             await addAgentCoreGatewayCDKInfra(tree, options, declaration);
             break;
         case 'terraform':
-            addAgentCoreGatewayTerraformInfra(tree, options);
+            addAgentCoreGatewayTerraformInfra(tree, options, declaration);
             break;
     }
     updateJson(tree, joinPathFragments(PACKAGES_DIR, options.iac === 'cdk' ? SHARED_CONSTRUCTS_DIR : SHARED_TERRAFORM_DIR, 'project.json'), (config)=>{
@@ -173,7 +181,7 @@ const addAgentCoreGatewayCDKInfra = async (tree, options, declaration)=>{
         '@types/ejs'
     ]), joinPathFragments(PACKAGES_DIR, SHARED_CONSTRUCTS_DIR, 'package.json'));
 };
-const addAgentCoreGatewayTerraformInfra = (tree, options)=>{
+const addAgentCoreGatewayTerraformInfra = (tree, options, declaration)=>{
     generateFiles(tree, joinPathFragments(import.meta.dirname, 'files', 'terraform', 'core', 'agentcore-gateway'), joinPathFragments(PACKAGES_DIR, SHARED_TERRAFORM_DIR, 'src', 'core', 'agentcore-gateway'), {
         ...terraformProviderVersions()
     }, {
@@ -199,7 +207,13 @@ const addAgentCoreGatewayTerraformInfra = (tree, options)=>{
         if (tree.exists(renderScript)) {
             tree.delete(renderScript);
         }
+        return;
     }
+    // render-cedar.cjs resolves ejs from the workspace root, since the shared
+    // terraform project it runs in has no package.json.
+    addDependenciesToPackageJson(tree, {}, withVersions(forDependencies(declaration), [
+        'ejs'
+    ]));
 };
 /**
  * Add AgentCore Harness infrastructure for the selected IaC provider.

package/src/utils/agent-core-constructs/agent-core-constructs.js.map

@@ -1 +1 @@
-{"version":3,"sources":["../../../../../../packages/nx-plugin/src/utils/agent-core-constructs/agent-core-constructs.ts"],"sourcesContent":["/**\n * Copyright Amazon.com, Inc. or its affiliates. All Rights Reserved.\n * SPDX-License-Identifier: Apache-2.0\n */\nimport {\n  generateFiles,\n  joinPathFragments,\n  OverwriteStrategy,\n  type ProjectConfiguration,\n  type Tree,\n  updateJson,\n} from '@nx/devkit';\nimport { addStarExport } from '../ast.js';\nimport type { Containers } from '../containers.js';\nimport {\n  type DeclaredPyDependency,\n  type DeclaredTsDependency,\n  type DependencyDeclaration,\n  forDependencies,\n  type MustDeclare,\n} from '../declared-dependencies.js';\nimport { addDependenciesToPackageJson } from '../dependencies.js';\nimport type { Iac } from '../iac.js';\nimport { esmVars } from '../module-format.js';\nimport { addDependencyToTargetIfNotPresent } from '../nx.js';\nimport {\n  generatedInfrastructure,\n  generatedTerraform,\n  type IacMetadata,\n  PACKAGES_DIR,\n  SHARED_CONSTRUCTS_DIR,\n  SHARED_TERRAFORM_DIR,\n} from '../shared-constructs-constants.js';\nimport {\n  type IPyDepVersion,\n  type ITsDepVersion,\n  PY_VERSIONS,\n  terraformProviderVersions,\n  withVersions,\n} from '../versions.js';\n\ntype IACProvider = { iac: Iac };\n\n/**\n * Dependencies a caller must declare to add an AgentCore Gateway construct.\n *\n * Gated on infrastructure having been generated, since the construct helpers only\n * run on that branch.\n */\nexport const AGENT_CORE_CONSTRUCTS_DEPENDENCIES = [\n  { name: 'ejs', when: generatedInfrastructure },\n  { name: '@aws-sdk/client-bedrock-agentcore', when: generatedInfrastructure },\n  { name: '@types/ejs', when: generatedInfrastructure },\n] as const satisfies readonly DeclaredTsDependency<\n  ITsDepVersion,\n  IacMetadata\n>[];\n\n/**\n * Python versions the generated Terraform pins in an inline `uv run --with`\n * script, rather than in any `pyproject.toml`.\n *\n * Spread through `ownedElsewhere` because nothing installs them into the\n * workspace — the pin is owned so the version sync keeps it current, and gated on\n * Terraform since the CDK branch writes no such script.\n */\nexport const AGENT_CORE_CONSTRUCTS_PY_DEPENDENCIES = [\n  { name: 'boto3', when: generatedTerraform },\n  { name: 'httpx', when: generatedTerraform },\n  { name: 'mcp', when: generatedTerraform },\n] as const satisfies readonly DeclaredPyDependency<\n  IPyDepVersion,\n  IacMetadata\n>[];\n\nexport type AgentCoreAuth = 'iam' | 'cognito';\n\nexport type AgentCoreSession = 's3' | 'dynamodb-s3' | 'in-memory';\n\nexport interface AddAgentCoreInfraProps {\n  nameClassName: string;\n  nameKebabCase: string;\n  projectName: string;\n  dockerImageTag: string;\n  dockerOutputDir: string;\n  appDirectory: string;\n  serverProtocol: 'mcp' | 'http' | 'a2a';\n  auth: AgentCoreAuth;\n  /** How this runtime's session should be persisted. MCP servers have no session, so pass 'in-memory'. */\n  session: AgentCoreSession;\n  containers: Containers;\n}\n\nconst addAgentCoreInfra = async (\n  tree: Tree,\n  options: AddAgentCoreInfraProps & { iac: Iac },\n) => {\n  switch (options.iac) {\n    case 'cdk':\n      await addAgentCoreCDKInfra(tree, options);\n      break;\n    case 'terraform':\n      addAgentCoreTerraformInfra(tree, options);\n      break;\n  }\n\n  // Update shared constructs/terraform project configuration to depend on this project\n  updateJson(\n    tree,\n    joinPathFragments(\n      PACKAGES_DIR,\n      options.iac === 'cdk' ? SHARED_CONSTRUCTS_DIR : SHARED_TERRAFORM_DIR,\n      'project.json',\n    ),\n    (config: ProjectConfiguration) => {\n      addDependencyToTargetIfNotPresent(\n        config,\n        'build',\n        `${options.projectName}:build`,\n      );\n      return config;\n    },\n  );\n};\n\nconst addAgentCoreCDKInfra = async (\n  tree: Tree,\n  options: AddAgentCoreInfraProps,\n) => {\n  // Generate app specific CDK construct\n  generateFiles(\n    tree,\n    joinPathFragments(import.meta.dirname, 'files', 'cdk', 'app', 'agent-core'),\n    joinPathFragments(\n      PACKAGES_DIR,\n      SHARED_CONSTRUCTS_DIR,\n      'src',\n      'app',\n      options.appDirectory,\n    ),\n    { ...options, ...esmVars(tree) },\n    {\n      overwriteStrategy: OverwriteStrategy.KeepExisting,\n    },\n  );\n\n  // Export app specific CDK construct\n  await addStarExport(\n    tree,\n    joinPathFragments(\n      PACKAGES_DIR,\n      SHARED_CONSTRUCTS_DIR,\n      'src',\n      'app',\n      options.appDirectory,\n      'index.ts',\n    ),\n    `./${options.nameKebabCase}/${options.nameKebabCase}.js`,\n  );\n  await addStarExport(\n    tree,\n    joinPathFragments(\n      PACKAGES_DIR,\n      SHARED_CONSTRUCTS_DIR,\n      'src',\n      'app',\n      'index.ts',\n    ),\n    `./${options.appDirectory}/index.js`,\n  );\n};\n\nconst addAgentCoreTerraformInfra = (\n  tree: Tree,\n  options: AddAgentCoreInfraProps,\n) => {\n  // Add the AgentCore shared module\n  generateFiles(\n    tree,\n    joinPathFragments(\n      import.meta.dirname,\n      'files',\n      'terraform',\n      'core',\n      'agent-core',\n    ),\n    joinPathFragments(\n      PACKAGES_DIR,\n      SHARED_TERRAFORM_DIR,\n      'src',\n      'core',\n      'agent-core',\n    ),\n    {\n      containers: options.containers,\n      boto3Version: PY_VERSIONS.boto3,\n      ...terraformProviderVersions(),\n    },\n    {\n      overwriteStrategy: OverwriteStrategy.KeepExisting,\n    },\n  );\n\n  // Generate app specific agent core configuration\n  generateFiles(\n    tree,\n    joinPathFragments(\n      import.meta.dirname,\n      'files',\n      'terraform',\n      'app',\n      'agent-core',\n    ),\n    joinPathFragments(\n      PACKAGES_DIR,\n      SHARED_TERRAFORM_DIR,\n      'src',\n      'app',\n      options.appDirectory,\n    ),\n    { ...options, ...terraformProviderVersions() },\n    {\n      overwriteStrategy: OverwriteStrategy.KeepExisting,\n    },\n  );\n};\n\nexport interface AddMcpServerInfraProps {\n  mcpServerNameClassName: string;\n  mcpServerNameKebabCase: string;\n  projectName: string;\n  dockerImageTag: string;\n  dockerOutputDir: string;\n  auth: AgentCoreAuth;\n  containers: Containers;\n}\n\n/**\n * Add an MCP server CDK construct\n */\nexport const addMcpServerInfra = async (\n  tree: Tree,\n  options: AddMcpServerInfraProps & IACProvider,\n) => {\n  await addAgentCoreInfra(tree, {\n    nameClassName: options.mcpServerNameClassName,\n    nameKebabCase: options.mcpServerNameKebabCase,\n    dockerImageTag: options.dockerImageTag,\n    dockerOutputDir: options.dockerOutputDir,\n    projectName: options.projectName,\n    appDirectory: 'mcp-servers',\n    serverProtocol: 'mcp',\n    iac: options.iac,\n    auth: options.auth,\n    // MCP servers are stateless (no conversation session to persist).\n    session: 'in-memory',\n    containers: options.containers,\n  });\n};\n\nexport interface AddAgentInfraProps {\n  agentNameClassName: string;\n  agentNameKebabCase: string;\n  projectName: string;\n  dockerImageTag: string;\n  dockerOutputDir: string;\n  auth: AgentCoreAuth;\n  session: AgentCoreSession;\n  serverProtocol?: 'http' | 'a2a';\n  containers: Containers;\n}\n\n/**\n * Add an agent CDK construct\n */\nexport const addAgentInfra = async (\n  tree: Tree,\n  options: AddAgentInfraProps & IACProvider,\n) => {\n  await addAgentCoreInfra(tree, {\n    nameClassName: options.agentNameClassName,\n    nameKebabCase: options.agentNameKebabCase,\n    projectName: options.projectName,\n    dockerImageTag: options.dockerImageTag,\n    dockerOutputDir: options.dockerOutputDir,\n    appDirectory: 'agents',\n    session: options.session,\n    serverProtocol: options.serverProtocol ?? 'http',\n    iac: options.iac,\n    auth: options.auth,\n    containers: options.containers,\n  });\n};\n\nexport interface AddAgentCoreGatewayInfraProps {\n  gatewayNameClassName: string;\n  gatewayNameKebabCase: string;\n  projectName: string;\n  projectDirectory: string;\n  cedarPolicy: boolean;\n  auth: AgentCoreAuth;\n  /**\n   * The gateway's protocol: mcp aggregates MCP server targets, http proxies\n   * agent runtime targets via path-based routing.\n   */\n  protocol: 'mcp' | 'http';\n}\n\nexport const addAgentCoreGatewayInfra = async <\n  const D extends DependencyDeclaration,\n>(\n  tree: Tree,\n  options: AddAgentCoreGatewayInfraProps & IACProvider,\n  declaration: D & MustDeclare<typeof AGENT_CORE_CONSTRUCTS_DEPENDENCIES, D>,\n) => {\n  switch (options.iac) {\n    case 'cdk':\n      await addAgentCoreGatewayCDKInfra(tree, options, declaration);\n      break;\n    case 'terraform':\n      addAgentCoreGatewayTerraformInfra(tree, options);\n      break;\n  }\n\n  updateJson(\n    tree,\n    joinPathFragments(\n      PACKAGES_DIR,\n      options.iac === 'cdk' ? SHARED_CONSTRUCTS_DIR : SHARED_TERRAFORM_DIR,\n      'project.json',\n    ),\n    (config: ProjectConfiguration) => {\n      addDependencyToTargetIfNotPresent(\n        config,\n        'build',\n        `${options.projectName}:build`,\n      );\n      return config;\n    },\n  );\n};\n\nconst addAgentCoreGatewayCDKInfra = async (\n  tree: Tree,\n  options: AddAgentCoreGatewayInfraProps,\n  declaration: DependencyDeclaration,\n) => {\n  // Generic gateway construct (readiness probe, policy engine, Cedar policy\n  // loading) shared by all gateways\n  generateFiles(\n    tree,\n    joinPathFragments(\n      import.meta.dirname,\n      'files',\n      'cdk',\n      'core',\n      'agentcore-gateway',\n    ),\n    joinPathFragments(\n      PACKAGES_DIR,\n      SHARED_CONSTRUCTS_DIR,\n      'src',\n      'core',\n      'agentcore-gateway',\n    ),\n    { ...esmVars(tree) },\n    {\n      overwriteStrategy: OverwriteStrategy.KeepExisting,\n    },\n  );\n\n  generateFiles(\n    tree,\n    joinPathFragments(\n      import.meta.dirname,\n      'files',\n      'cdk',\n      'app',\n      'agentcore-gateway',\n    ),\n    joinPathFragments(\n      PACKAGES_DIR,\n      SHARED_CONSTRUCTS_DIR,\n      'src',\n      'app',\n      'gateways',\n    ),\n    {\n      nameClassName: options.gatewayNameClassName,\n      nameKebabCase: options.gatewayNameKebabCase,\n      projectDirectory: options.projectDirectory,\n      cedarPolicy: options.cedarPolicy,\n      auth: options.auth,\n      protocol: options.protocol,\n      ...esmVars(tree),\n    },\n    {\n      overwriteStrategy: OverwriteStrategy.KeepExisting,\n    },\n  );\n\n  await addStarExport(\n    tree,\n    joinPathFragments(\n      PACKAGES_DIR,\n      SHARED_CONSTRUCTS_DIR,\n      'src',\n      'core',\n      'index.ts',\n    ),\n    './agentcore-gateway/agentcore-gateway.js',\n  );\n  await addStarExport(\n    tree,\n    joinPathFragments(\n      PACKAGES_DIR,\n      SHARED_CONSTRUCTS_DIR,\n      'src',\n      'app',\n      'gateways',\n      'index.ts',\n    ),\n    `./${options.gatewayNameKebabCase}/${options.gatewayNameKebabCase}.js`,\n  );\n  await addStarExport(\n    tree,\n    joinPathFragments(\n      PACKAGES_DIR,\n      SHARED_CONSTRUCTS_DIR,\n      'src',\n      'app',\n      'index.ts',\n    ),\n    './gateways/index.js',\n  );\n\n  // The gateway construct renders Cedar policies with ejs and its readiness\n  // probe uses the AgentCore SDK client; declare both so the lint passes.\n  addDependenciesToPackageJson(\n    tree,\n    withVersions(\n      forDependencies<typeof AGENT_CORE_CONSTRUCTS_DEPENDENCIES>(declaration),\n      ['ejs', '@aws-sdk/client-bedrock-agentcore'],\n    ),\n    withVersions(\n      forDependencies<typeof AGENT_CORE_CONSTRUCTS_DEPENDENCIES>(declaration),\n      ['@types/ejs'],\n    ),\n    joinPathFragments(PACKAGES_DIR, SHARED_CONSTRUCTS_DIR, 'package.json'),\n  );\n};\n\nconst addAgentCoreGatewayTerraformInfra = (\n  tree: Tree,\n  options: AddAgentCoreGatewayInfraProps,\n) => {\n  generateFiles(\n    tree,\n    joinPathFragments(\n      import.meta.dirname,\n      'files',\n      'terraform',\n      'core',\n      'agentcore-gateway',\n    ),\n    joinPathFragments(\n      PACKAGES_DIR,\n      SHARED_TERRAFORM_DIR,\n      'src',\n      'core',\n      'agentcore-gateway',\n    ),\n    { ...terraformProviderVersions() },\n    {\n      overwriteStrategy: OverwriteStrategy.KeepExisting,\n    },\n  );\n\n  generateFiles(\n    tree,\n    joinPathFragments(\n      import.meta.dirname,\n      'files',\n      'terraform',\n      'app',\n      'agentcore-gateway',\n    ),\n    joinPathFragments(\n      PACKAGES_DIR,\n      SHARED_TERRAFORM_DIR,\n      'src',\n      'app',\n      'gateways',\n    ),\n    {\n      nameClassName: options.gatewayNameClassName,\n      nameKebabCase: options.gatewayNameKebabCase,\n      projectDirectory: options.projectDirectory,\n      cedarPolicy: options.cedarPolicy,\n      auth: options.auth,\n      protocol: options.protocol,\n      boto3Version: PY_VERSIONS.boto3,\n      httpxVersion: PY_VERSIONS.httpx,\n      mcpVersion: PY_VERSIONS.mcp,\n      ...terraformProviderVersions(),\n    },\n    {\n      overwriteStrategy: OverwriteStrategy.KeepExisting,\n    },\n  );\n\n  // The Cedar render script is only needed when policies are enabled\n  if (!options.cedarPolicy) {\n    const renderScript = joinPathFragments(\n      PACKAGES_DIR,\n      SHARED_TERRAFORM_DIR,\n      'src',\n      'app',\n      'gateways',\n      options.gatewayNameKebabCase,\n      'render-cedar.cjs',\n    );\n    if (tree.exists(renderScript)) {\n      tree.delete(renderScript);\n    }\n  }\n};\n\nexport interface AddAgentCoreHarnessInfraProps {\n  harnessNameClassName: string;\n  harnessNameKebabCase: string;\n  /**\n   * Workspace-root-relative harness project root, eg `packages/my-harness`.\n   * The `src/PROMPT.md` path both templates read is derived from it.\n   */\n  projectRoot: string;\n  /** Leading-letter-guaranteed, 31-char-truncated resource name prefix. */\n  harnessNamePrefix: string;\n}\n\n/**\n * Template substitution context shared by the CDK and Terraform harness\n * branches. Both prompt path fields carry the same workspace-root-relative\n * path, named per provider so each template's usage reads on its own.\n */\ninterface HarnessTemplateContext {\n  nameClassName: string;\n  nameKebabCase: string;\n  harnessNamePrefix: string;\n  /** Joined onto `findWorkspaceRoot()` in the CDK construct. */\n  promptPathFromCdk: string;\n  /** Appended to the `path.module` walk to the workspace root in Terraform. */\n  promptPathFromTerraform: string;\n}\n\n/**\n * Add AgentCore Harness infrastructure for the selected IaC provider.\n *\n * Renders the provider-specific Harness infrastructure (a CDK construct or\n * a Terraform module) into the Shared Infrastructure Project with\n * `KeepExisting`, so existing files become user-owned and are never\n * rewritten by reruns.\n *\n * Unlike agents, MCP servers and gateways, no build dependency is added\n * from the shared infrastructure project to the Harness Project: generated\n * Harness infrastructure does not import Harness Project source, so a\n * dependency would only create false rebuild coupling.\n */\nexport const addAgentCoreHarnessInfra = async (\n  tree: Tree,\n  options: AddAgentCoreHarnessInfraProps & IACProvider,\n): Promise<void> => {\n  // One resolved template context, built once and passed to both provider\n  // branches. The prompt path is derived from the same projectRoot the\n  // Harness Project is written to, so explicit placement needs no extra logic.\n  const promptPath = joinPathFragments(options.projectRoot, 'src', 'PROMPT.md');\n  const templateContext: HarnessTemplateContext = {\n    nameClassName: options.harnessNameClassName,\n    nameKebabCase: options.harnessNameKebabCase,\n    harnessNamePrefix: options.harnessNamePrefix,\n    promptPathFromCdk: promptPath,\n    promptPathFromTerraform: promptPath,\n  };\n\n  switch (options.iac) {\n    case 'cdk':\n      await addAgentCoreHarnessCDKInfra(tree, templateContext);\n      break;\n    case 'terraform':\n      addAgentCoreHarnessTerraformInfra(tree, templateContext);\n      break;\n  }\n};\n\nconst addAgentCoreHarnessCDKInfra = async (\n  tree: Tree,\n  templateContext: HarnessTemplateContext,\n) => {\n  // Generate the app specific CDK construct under\n  // src/app/harnesses/<kebab-case-name>/\n  generateFiles(\n    tree,\n    joinPathFragments(\n      import.meta.dirname,\n      'files',\n      'cdk',\n      'app',\n      'agentcore-harness',\n    ),\n    joinPathFragments(\n      PACKAGES_DIR,\n      SHARED_CONSTRUCTS_DIR,\n      'src',\n      'app',\n      'harnesses',\n    ),\n    { ...templateContext, ...esmVars(tree) },\n    {\n      overwriteStrategy: OverwriteStrategy.KeepExisting,\n    },\n  );\n\n  // Export the construct through the harnesses app index and the shared\n  // app index. addStarExport creates a missing index file and semantically\n  // deduplicates equivalent exports on reruns.\n  await addStarExport(\n    tree,\n    joinPathFragments(\n      PACKAGES_DIR,\n      SHARED_CONSTRUCTS_DIR,\n      'src',\n      'app',\n      'harnesses',\n      'index.ts',\n    ),\n    `./${templateContext.nameKebabCase}/${templateContext.nameKebabCase}.js`,\n  );\n  await addStarExport(\n    tree,\n    joinPathFragments(\n      PACKAGES_DIR,\n      SHARED_CONSTRUCTS_DIR,\n      'src',\n      'app',\n      'index.ts',\n    ),\n    './harnesses/index.js',\n  );\n};\n\nconst addAgentCoreHarnessTerraformInfra = (\n  tree: Tree,\n  templateContext: HarnessTemplateContext,\n) => {\n  // Generate the app specific Terraform module under\n  // src/app/harnesses/<kebab-case-name>/. No CDK files or exports are\n  // created on this path.\n  generateFiles(\n    tree,\n    joinPathFragments(\n      import.meta.dirname,\n      'files',\n      'terraform',\n      'app',\n      'agentcore-harness',\n    ),\n    joinPathFragments(\n      PACKAGES_DIR,\n      SHARED_TERRAFORM_DIR,\n      'src',\n      'app',\n      'harnesses',\n    ),\n    { ...templateContext, ...terraformProviderVersions() },\n    {\n      overwriteStrategy: OverwriteStrategy.KeepExisting,\n    },\n  );\n};\n"],"names":["generateFiles","joinPathFragments","OverwriteStrategy","updateJson","addStarExport","forDependencies","addDependenciesToPackageJson","esmVars","addDependencyToTargetIfNotPresent","generatedInfrastructure","generatedTerraform","PACKAGES_DIR","SHARED_CONSTRUCTS_DIR","SHARED_TERRAFORM_DIR","PY_VERSIONS","terraformProviderVersions","withVersions","AGENT_CORE_CONSTRUCTS_DEPENDENCIES","name","when","AGENT_CORE_CONSTRUCTS_PY_DEPENDENCIES","addAgentCoreInfra","tree","options","iac","addAgentCoreCDKInfra","addAgentCoreTerraformInfra","config","projectName","dirname","appDirectory","overwriteStrategy","KeepExisting","nameKebabCase","containers","boto3Version","boto3","addMcpServerInfra","nameClassName","mcpServerNameClassName","mcpServerNameKebabCase","dockerImageTag","dockerOutputDir","serverProtocol","auth","session","addAgentInfra","agentNameClassName","agentNameKebabCase","addAgentCoreGatewayInfra","declaration","addAgentCoreGatewayCDKInfra","addAgentCoreGatewayTerraformInfra","gatewayNameClassName","gatewayNameKebabCase","projectDirectory","cedarPolicy","protocol","httpxVersion","httpx","mcpVersion","mcp","renderScript","exists","delete","addAgentCoreHarnessInfra","promptPath","projectRoot","templateContext","harnessNameClassName","harnessNameKebabCase","harnessNamePrefix","promptPathFromCdk","promptPathFromTerraform","addAgentCoreHarnessCDKInfra","addAgentCoreHarnessTerraformInfra"],"mappings":"AAAA;;;CAGC,GACD,SACEA,aAAa,EACbC,iBAAiB,EACjBC,iBAAiB,EAGjBC,UAAU,QACL,aAAa;AACpB,SAASC,aAAa,QAAQ,YAAY;AAE1C,SAIEC,eAAe,QAEV,8BAA8B;AACrC,SAASC,4BAA4B,QAAQ,qBAAqB;AAElE,SAASC,OAAO,QAAQ,sBAAsB;AAC9C,SAASC,iCAAiC,QAAQ,WAAW;AAC7D,SACEC,uBAAuB,EACvBC,kBAAkB,EAElBC,YAAY,EACZC,qBAAqB,EACrBC,oBAAoB,QACf,oCAAoC;AAC3C,SAGEC,WAAW,EACXC,yBAAyB,EACzBC,YAAY,QACP,iBAAiB;AAIxB;;;;;CAKC,GACD,OAAO,MAAMC,qCAAqC;IAChD;QAAEC,MAAM;QAAOC,MAAMV;IAAwB;IAC7C;QAAES,MAAM;QAAqCC,MAAMV;IAAwB;IAC3E;QAAES,MAAM;QAAcC,MAAMV;IAAwB;CACrD,CAGG;AAEJ;;;;;;;CAOC,GACD,OAAO,MAAMW,wCAAwC;IACnD;QAAEF,MAAM;QAASC,MAAMT;IAAmB;IAC1C;QAAEQ,MAAM;QAASC,MAAMT;IAAmB;IAC1C;QAAEQ,MAAM;QAAOC,MAAMT;IAAmB;CACzC,CAGG;AAoBJ,MAAMW,oBAAoB,OACxBC,MACAC;IAEA,OAAQA,QAAQC,GAAG;QACjB,KAAK;YACH,MAAMC,qBAAqBH,MAAMC;YACjC;QACF,KAAK;YACHG,2BAA2BJ,MAAMC;YACjC;IACJ;IAEA,qFAAqF;IACrFpB,WACEmB,MACArB,kBACEU,cACAY,QAAQC,GAAG,KAAK,QAAQZ,wBAAwBC,sBAChD,iBAEF,CAACc;QACCnB,kCACEmB,QACA,SACA,GAAGJ,QAAQK,WAAW,CAAC,MAAM,CAAC;QAEhC,OAAOD;IACT;AAEJ;AAEA,MAAMF,uBAAuB,OAC3BH,MACAC;IAEA,sCAAsC;IACtCvB,cACEsB,MACArB,kBAAkB,YAAY4B,OAAO,EAAE,SAAS,OAAO,OAAO,eAC9D5B,kBACEU,cACAC,uBACA,OACA,OACAW,QAAQO,YAAY,GAEtB;QAAE,GAAGP,OAAO;QAAE,GAAGhB,QAAQe,KAAK;IAAC,GAC/B;QACES,mBAAmB7B,kBAAkB8B,YAAY;IACnD;IAGF,oCAAoC;IACpC,MAAM5B,cACJkB,MACArB,kBACEU,cACAC,uBACA,OACA,OACAW,QAAQO,YAAY,EACpB,aAEF,CAAC,EAAE,EAAEP,QAAQU,aAAa,CAAC,CAAC,EAAEV,QAAQU,aAAa,CAAC,GAAG,CAAC;IAE1D,MAAM7B,cACJkB,MACArB,kBACEU,cACAC,uBACA,OACA,OACA,aAEF,CAAC,EAAE,EAAEW,QAAQO,YAAY,CAAC,SAAS,CAAC;AAExC;AAEA,MAAMJ,6BAA6B,CACjCJ,MACAC;IAEA,kCAAkC;IAClCvB,cACEsB,MACArB,kBACE,YAAY4B,OAAO,EACnB,SACA,aACA,QACA,eAEF5B,kBACEU,cACAE,sBACA,OACA,QACA,eAEF;QACEqB,YAAYX,QAAQW,UAAU;QAC9BC,cAAcrB,YAAYsB,KAAK;QAC/B,GAAGrB,2BAA2B;IAChC,GACA;QACEgB,mBAAmB7B,kBAAkB8B,YAAY;IACnD;IAGF,iDAAiD;IACjDhC,cACEsB,MACArB,kBACE,YAAY4B,OAAO,EACnB,SACA,aACA,OACA,eAEF5B,kBACEU,cACAE,sBACA,OACA,OACAU,QAAQO,YAAY,GAEtB;QAAE,GAAGP,OAAO;QAAE,GAAGR,2BAA2B;IAAC,GAC7C;QACEgB,mBAAmB7B,kBAAkB8B,YAAY;IACnD;AAEJ;AAYA;;CAEC,GACD,OAAO,MAAMK,oBAAoB,OAC/Bf,MACAC;IAEA,MAAMF,kBAAkBC,MAAM;QAC5BgB,eAAef,QAAQgB,sBAAsB;QAC7CN,eAAeV,QAAQiB,sBAAsB;QAC7CC,gBAAgBlB,QAAQkB,cAAc;QACtCC,iBAAiBnB,QAAQmB,eAAe;QACxCd,aAAaL,QAAQK,WAAW;QAChCE,cAAc;QACda,gBAAgB;QAChBnB,KAAKD,QAAQC,GAAG;QAChBoB,MAAMrB,QAAQqB,IAAI;QAClB,kEAAkE;QAClEC,SAAS;QACTX,YAAYX,QAAQW,UAAU;IAChC;AACF,EAAE;AAcF;;CAEC,GACD,OAAO,MAAMY,gBAAgB,OAC3BxB,MACAC;IAEA,MAAMF,kBAAkBC,MAAM;QAC5BgB,eAAef,QAAQwB,kBAAkB;QACzCd,eAAeV,QAAQyB,kBAAkB;QACzCpB,aAAaL,QAAQK,WAAW;QAChCa,gBAAgBlB,QAAQkB,cAAc;QACtCC,iBAAiBnB,QAAQmB,eAAe;QACxCZ,cAAc;QACde,SAAStB,QAAQsB,OAAO;QACxBF,gBAAgBpB,QAAQoB,cAAc,IAAI;QAC1CnB,KAAKD,QAAQC,GAAG;QAChBoB,MAAMrB,QAAQqB,IAAI;QAClBV,YAAYX,QAAQW,UAAU;IAChC;AACF,EAAE;AAgBF,OAAO,MAAMe,2BAA2B,OAGtC3B,MACAC,SACA2B;IAEA,OAAQ3B,QAAQC,GAAG;QACjB,KAAK;YACH,MAAM2B,4BAA4B7B,MAAMC,SAAS2B;YACjD;QACF,KAAK;YACHE,kCAAkC9B,MAAMC;YACxC;IACJ;IAEApB,WACEmB,MACArB,kBACEU,cACAY,QAAQC,GAAG,KAAK,QAAQZ,wBAAwBC,sBAChD,iBAEF,CAACc;QACCnB,kCACEmB,QACA,SACA,GAAGJ,QAAQK,WAAW,CAAC,MAAM,CAAC;QAEhC,OAAOD;IACT;AAEJ,EAAE;AAEF,MAAMwB,8BAA8B,OAClC7B,MACAC,SACA2B;IAEA,0EAA0E;IAC1E,kCAAkC;IAClClD,cACEsB,MACArB,kBACE,YAAY4B,OAAO,EACnB,SACA,OACA,QACA,sBAEF5B,kBACEU,cACAC,uBACA,OACA,QACA,sBAEF;QAAE,GAAGL,QAAQe,KAAK;IAAC,GACnB;QACES,mBAAmB7B,kBAAkB8B,YAAY;IACnD;IAGFhC,cACEsB,MACArB,kBACE,YAAY4B,OAAO,EACnB,SACA,OACA,OACA,sBAEF5B,kBACEU,cACAC,uBACA,OACA,OACA,aAEF;QACE0B,eAAef,QAAQ8B,oBAAoB;QAC3CpB,eAAeV,QAAQ+B,oBAAoB;QAC3CC,kBAAkBhC,QAAQgC,gBAAgB;QAC1CC,aAAajC,QAAQiC,WAAW;QAChCZ,MAAMrB,QAAQqB,IAAI;QAClBa,UAAUlC,QAAQkC,QAAQ;QAC1B,GAAGlD,QAAQe,KAAK;IAClB,GACA;QACES,mBAAmB7B,kBAAkB8B,YAAY;IACnD;IAGF,MAAM5B,cACJkB,MACArB,kBACEU,cACAC,uBACA,OACA,QACA,aAEF;IAEF,MAAMR,cACJkB,MACArB,kBACEU,cACAC,uBACA,OACA,OACA,YACA,aAEF,CAAC,EAAE,EAAEW,QAAQ+B,oBAAoB,CAAC,CAAC,EAAE/B,QAAQ+B,oBAAoB,CAAC,GAAG,CAAC;IAExE,MAAMlD,cACJkB,MACArB,kBACEU,cACAC,uBACA,OACA,OACA,aAEF;IAGF,0EAA0E;IAC1E,wEAAwE;IACxEN,6BACEgB,MACAN,aACEX,gBAA2D6C,cAC3D;QAAC;QAAO;KAAoC,GAE9ClC,aACEX,gBAA2D6C,cAC3D;QAAC;KAAa,GAEhBjD,kBAAkBU,cAAcC,uBAAuB;AAE3D;AAEA,MAAMwC,oCAAoC,CACxC9B,MACAC;IAEAvB,cACEsB,MACArB,kBACE,YAAY4B,OAAO,EACnB,SACA,aACA,QACA,sBAEF5B,kBACEU,cACAE,sBACA,OACA,QACA,sBAEF;QAAE,GAAGE,2BAA2B;IAAC,GACjC;QACEgB,mBAAmB7B,kBAAkB8B,YAAY;IACnD;IAGFhC,cACEsB,MACArB,kBACE,YAAY4B,OAAO,EACnB,SACA,aACA,OACA,sBAEF5B,kBACEU,cACAE,sBACA,OACA,OACA,aAEF;QACEyB,eAAef,QAAQ8B,oBAAoB;QAC3CpB,eAAeV,QAAQ+B,oBAAoB;QAC3CC,kBAAkBhC,QAAQgC,gBAAgB;QAC1CC,aAAajC,QAAQiC,WAAW;QAChCZ,MAAMrB,QAAQqB,IAAI;QAClBa,UAAUlC,QAAQkC,QAAQ;QAC1BtB,cAAcrB,YAAYsB,KAAK;QAC/BsB,cAAc5C,YAAY6C,KAAK;QAC/BC,YAAY9C,YAAY+C,GAAG;QAC3B,GAAG9C,2BAA2B;IAChC,GACA;QACEgB,mBAAmB7B,kBAAkB8B,YAAY;IACnD;IAGF,mEAAmE;IACnE,IAAI,CAACT,QAAQiC,WAAW,EAAE;QACxB,MAAMM,eAAe7D,kBACnBU,cACAE,sBACA,OACA,OACA,YACAU,QAAQ+B,oBAAoB,EAC5B;QAEF,IAAIhC,KAAKyC,MAAM,CAACD,eAAe;YAC7BxC,KAAK0C,MAAM,CAACF;QACd;IACF;AACF;AA6BA;;;;;;;;;;;;CAYC,GACD,OAAO,MAAMG,2BAA2B,OACtC3C,MACAC;IAEA,wEAAwE;IACxE,qEAAqE;IACrE,6EAA6E;IAC7E,MAAM2C,aAAajE,kBAAkBsB,QAAQ4C,WAAW,EAAE,OAAO;IACjE,MAAMC,kBAA0C;QAC9C9B,eAAef,QAAQ8C,oBAAoB;QAC3CpC,eAAeV,QAAQ+C,oBAAoB;QAC3CC,mBAAmBhD,QAAQgD,iBAAiB;QAC5CC,mBAAmBN;QACnBO,yBAAyBP;IAC3B;IAEA,OAAQ3C,QAAQC,GAAG;QACjB,KAAK;YACH,MAAMkD,4BAA4BpD,MAAM8C;YACxC;QACF,KAAK;YACHO,kCAAkCrD,MAAM8C;YACxC;IACJ;AACF,EAAE;AAEF,MAAMM,8BAA8B,OAClCpD,MACA8C;IAEA,gDAAgD;IAChD,uCAAuC;IACvCpE,cACEsB,MACArB,kBACE,YAAY4B,OAAO,EACnB,SACA,OACA,OACA,sBAEF5B,kBACEU,cACAC,uBACA,OACA,OACA,cAEF;QAAE,GAAGwD,eAAe;QAAE,GAAG7D,QAAQe,KAAK;IAAC,GACvC;QACES,mBAAmB7B,kBAAkB8B,YAAY;IACnD;IAGF,sEAAsE;IACtE,yEAAyE;IACzE,6CAA6C;IAC7C,MAAM5B,cACJkB,MACArB,kBACEU,cACAC,uBACA,OACA,OACA,aACA,aAEF,CAAC,EAAE,EAAEwD,gBAAgBnC,aAAa,CAAC,CAAC,EAAEmC,gBAAgBnC,aAAa,CAAC,GAAG,CAAC;IAE1E,MAAM7B,cACJkB,MACArB,kBACEU,cACAC,uBACA,OACA,OACA,aAEF;AAEJ;AAEA,MAAM+D,oCAAoC,CACxCrD,MACA8C;IAEA,mDAAmD;IACnD,oEAAoE;IACpE,wBAAwB;IACxBpE,cACEsB,MACArB,kBACE,YAAY4B,OAAO,EACnB,SACA,aACA,OACA,sBAEF5B,kBACEU,cACAE,sBACA,OACA,OACA,cAEF;QAAE,GAAGuD,eAAe;QAAE,GAAGrD,2BAA2B;IAAC,GACrD;QACEgB,mBAAmB7B,kBAAkB8B,YAAY;IACnD;AAEJ"}
+{"version":3,"sources":["../../../../../../packages/nx-plugin/src/utils/agent-core-constructs/agent-core-constructs.ts"],"sourcesContent":["/**\n * Copyright Amazon.com, Inc. or its affiliates. All Rights Reserved.\n * SPDX-License-Identifier: Apache-2.0\n */\nimport {\n  generateFiles,\n  joinPathFragments,\n  OverwriteStrategy,\n  type ProjectConfiguration,\n  type Tree,\n  updateJson,\n} from '@nx/devkit';\nimport { addStarExport } from '../ast.js';\nimport type { Containers } from '../containers.js';\nimport {\n  type DeclaredPyDependency,\n  type DeclaredTsDependency,\n  type DependencyDeclaration,\n  forDependencies,\n  type MustDeclare,\n} from '../declared-dependencies.js';\nimport { addDependenciesToPackageJson } from '../dependencies.js';\nimport type { Iac } from '../iac.js';\nimport { esmVars } from '../module-format.js';\nimport { addDependencyToTargetIfNotPresent } from '../nx.js';\nimport {\n  generatedCdk,\n  generatedTerraform,\n  type IacMetadata,\n  PACKAGES_DIR,\n  SHARED_CONSTRUCTS_DIR,\n  SHARED_TERRAFORM_DIR,\n} from '../shared-constructs-constants.js';\nimport {\n  type IPyDepVersion,\n  type ITsDepVersion,\n  PY_VERSIONS,\n  terraformProviderVersions,\n  withVersions,\n} from '../versions.js';\n\ntype IACProvider = { iac: Iac };\n\n/**\n * Dependencies a caller must declare to add an AgentCore Gateway construct.\n *\n * Both providers render Cedar policies with `ejs`, each from a different\n * manifest: the CDK construct imports it from the shared constructs project,\n * while Terraform's `render-cedar.cjs` resolves it from the workspace root,\n * since the shared terraform project it runs in has no `package.json`.\n */\nexport const AGENT_CORE_CONSTRUCTS_DEPENDENCIES = [\n  { name: 'ejs', when: generatedCdk },\n  { name: '@aws-sdk/client-bedrock-agentcore', when: generatedCdk },\n  { name: '@types/ejs', when: generatedCdk },\n  { name: 'ejs', when: generatedTerraform, dev: true, root: true },\n] as const satisfies readonly DeclaredTsDependency<\n  ITsDepVersion,\n  IacMetadata\n>[];\n\n/**\n * Python versions the generated Terraform pins in an inline `uv run --with`\n * script, rather than in any `pyproject.toml`.\n *\n * Spread through `ownedElsewhere` because nothing installs them into the\n * workspace — the pin is owned so the version sync keeps it current, and gated on\n * Terraform since the CDK branch writes no such script.\n */\nexport const AGENT_CORE_CONSTRUCTS_PY_DEPENDENCIES = [\n  { name: 'boto3', when: generatedTerraform },\n  { name: 'httpx', when: generatedTerraform },\n  { name: 'mcp', when: generatedTerraform },\n] as const satisfies readonly DeclaredPyDependency<\n  IPyDepVersion,\n  IacMetadata\n>[];\n\nexport type AgentCoreAuth = 'iam' | 'cognito';\n\nexport type AgentCoreSession = 's3' | 'dynamodb-s3' | 'in-memory';\n\nexport interface AddAgentCoreInfraProps {\n  nameClassName: string;\n  nameKebabCase: string;\n  projectName: string;\n  dockerImageTag: string;\n  dockerOutputDir: string;\n  appDirectory: string;\n  serverProtocol: 'mcp' | 'http' | 'a2a';\n  auth: AgentCoreAuth;\n  /** How this runtime's session should be persisted. MCP servers have no session, so pass 'in-memory'. */\n  session: AgentCoreSession;\n  containers: Containers;\n}\n\nconst addAgentCoreInfra = async (\n  tree: Tree,\n  options: AddAgentCoreInfraProps & { iac: Iac },\n) => {\n  switch (options.iac) {\n    case 'cdk':\n      await addAgentCoreCDKInfra(tree, options);\n      break;\n    case 'terraform':\n      addAgentCoreTerraformInfra(tree, options);\n      break;\n  }\n\n  // Update shared constructs/terraform project configuration to depend on this project\n  updateJson(\n    tree,\n    joinPathFragments(\n      PACKAGES_DIR,\n      options.iac === 'cdk' ? SHARED_CONSTRUCTS_DIR : SHARED_TERRAFORM_DIR,\n      'project.json',\n    ),\n    (config: ProjectConfiguration) => {\n      addDependencyToTargetIfNotPresent(\n        config,\n        'build',\n        `${options.projectName}:build`,\n      );\n      return config;\n    },\n  );\n};\n\nconst addAgentCoreCDKInfra = async (\n  tree: Tree,\n  options: AddAgentCoreInfraProps,\n) => {\n  // Generate app specific CDK construct\n  generateFiles(\n    tree,\n    joinPathFragments(import.meta.dirname, 'files', 'cdk', 'app', 'agent-core'),\n    joinPathFragments(\n      PACKAGES_DIR,\n      SHARED_CONSTRUCTS_DIR,\n      'src',\n      'app',\n      options.appDirectory,\n    ),\n    { ...options, ...esmVars(tree) },\n    {\n      overwriteStrategy: OverwriteStrategy.KeepExisting,\n    },\n  );\n\n  // Export app specific CDK construct\n  await addStarExport(\n    tree,\n    joinPathFragments(\n      PACKAGES_DIR,\n      SHARED_CONSTRUCTS_DIR,\n      'src',\n      'app',\n      options.appDirectory,\n      'index.ts',\n    ),\n    `./${options.nameKebabCase}/${options.nameKebabCase}.js`,\n  );\n  await addStarExport(\n    tree,\n    joinPathFragments(\n      PACKAGES_DIR,\n      SHARED_CONSTRUCTS_DIR,\n      'src',\n      'app',\n      'index.ts',\n    ),\n    `./${options.appDirectory}/index.js`,\n  );\n};\n\nconst addAgentCoreTerraformInfra = (\n  tree: Tree,\n  options: AddAgentCoreInfraProps,\n) => {\n  // Add the AgentCore shared module\n  generateFiles(\n    tree,\n    joinPathFragments(\n      import.meta.dirname,\n      'files',\n      'terraform',\n      'core',\n      'agent-core',\n    ),\n    joinPathFragments(\n      PACKAGES_DIR,\n      SHARED_TERRAFORM_DIR,\n      'src',\n      'core',\n      'agent-core',\n    ),\n    {\n      containers: options.containers,\n      boto3Version: PY_VERSIONS.boto3,\n      ...terraformProviderVersions(),\n    },\n    {\n      overwriteStrategy: OverwriteStrategy.KeepExisting,\n    },\n  );\n\n  // Generate app specific agent core configuration\n  generateFiles(\n    tree,\n    joinPathFragments(\n      import.meta.dirname,\n      'files',\n      'terraform',\n      'app',\n      'agent-core',\n    ),\n    joinPathFragments(\n      PACKAGES_DIR,\n      SHARED_TERRAFORM_DIR,\n      'src',\n      'app',\n      options.appDirectory,\n    ),\n    { ...options, ...terraformProviderVersions() },\n    {\n      overwriteStrategy: OverwriteStrategy.KeepExisting,\n    },\n  );\n};\n\nexport interface AddMcpServerInfraProps {\n  mcpServerNameClassName: string;\n  mcpServerNameKebabCase: string;\n  projectName: string;\n  dockerImageTag: string;\n  dockerOutputDir: string;\n  auth: AgentCoreAuth;\n  containers: Containers;\n}\n\n/**\n * Add an MCP server CDK construct\n */\nexport const addMcpServerInfra = async (\n  tree: Tree,\n  options: AddMcpServerInfraProps & IACProvider,\n) => {\n  await addAgentCoreInfra(tree, {\n    nameClassName: options.mcpServerNameClassName,\n    nameKebabCase: options.mcpServerNameKebabCase,\n    dockerImageTag: options.dockerImageTag,\n    dockerOutputDir: options.dockerOutputDir,\n    projectName: options.projectName,\n    appDirectory: 'mcp-servers',\n    serverProtocol: 'mcp',\n    iac: options.iac,\n    auth: options.auth,\n    // MCP servers are stateless (no conversation session to persist).\n    session: 'in-memory',\n    containers: options.containers,\n  });\n};\n\nexport interface AddAgentInfraProps {\n  agentNameClassName: string;\n  agentNameKebabCase: string;\n  projectName: string;\n  dockerImageTag: string;\n  dockerOutputDir: string;\n  auth: AgentCoreAuth;\n  session: AgentCoreSession;\n  serverProtocol?: 'http' | 'a2a';\n  containers: Containers;\n}\n\n/**\n * Add an agent CDK construct\n */\nexport const addAgentInfra = async (\n  tree: Tree,\n  options: AddAgentInfraProps & IACProvider,\n) => {\n  await addAgentCoreInfra(tree, {\n    nameClassName: options.agentNameClassName,\n    nameKebabCase: options.agentNameKebabCase,\n    projectName: options.projectName,\n    dockerImageTag: options.dockerImageTag,\n    dockerOutputDir: options.dockerOutputDir,\n    appDirectory: 'agents',\n    session: options.session,\n    serverProtocol: options.serverProtocol ?? 'http',\n    iac: options.iac,\n    auth: options.auth,\n    containers: options.containers,\n  });\n};\n\nexport interface AddAgentCoreGatewayInfraProps {\n  gatewayNameClassName: string;\n  gatewayNameKebabCase: string;\n  projectName: string;\n  projectDirectory: string;\n  cedarPolicy: boolean;\n  auth: AgentCoreAuth;\n  /**\n   * The gateway's protocol: mcp aggregates MCP server targets, http proxies\n   * agent runtime targets via path-based routing.\n   */\n  protocol: 'mcp' | 'http';\n}\n\nexport const addAgentCoreGatewayInfra = async <\n  const D extends DependencyDeclaration,\n>(\n  tree: Tree,\n  options: AddAgentCoreGatewayInfraProps & IACProvider,\n  declaration: D & MustDeclare<typeof AGENT_CORE_CONSTRUCTS_DEPENDENCIES, D>,\n) => {\n  switch (options.iac) {\n    case 'cdk':\n      await addAgentCoreGatewayCDKInfra(tree, options, declaration);\n      break;\n    case 'terraform':\n      addAgentCoreGatewayTerraformInfra(tree, options, declaration);\n      break;\n  }\n\n  updateJson(\n    tree,\n    joinPathFragments(\n      PACKAGES_DIR,\n      options.iac === 'cdk' ? SHARED_CONSTRUCTS_DIR : SHARED_TERRAFORM_DIR,\n      'project.json',\n    ),\n    (config: ProjectConfiguration) => {\n      addDependencyToTargetIfNotPresent(\n        config,\n        'build',\n        `${options.projectName}:build`,\n      );\n      return config;\n    },\n  );\n};\n\nconst addAgentCoreGatewayCDKInfra = async (\n  tree: Tree,\n  options: AddAgentCoreGatewayInfraProps,\n  declaration: DependencyDeclaration,\n) => {\n  // Generic gateway construct (readiness probe, policy engine, Cedar policy\n  // loading) shared by all gateways\n  generateFiles(\n    tree,\n    joinPathFragments(\n      import.meta.dirname,\n      'files',\n      'cdk',\n      'core',\n      'agentcore-gateway',\n    ),\n    joinPathFragments(\n      PACKAGES_DIR,\n      SHARED_CONSTRUCTS_DIR,\n      'src',\n      'core',\n      'agentcore-gateway',\n    ),\n    { ...esmVars(tree) },\n    {\n      overwriteStrategy: OverwriteStrategy.KeepExisting,\n    },\n  );\n\n  generateFiles(\n    tree,\n    joinPathFragments(\n      import.meta.dirname,\n      'files',\n      'cdk',\n      'app',\n      'agentcore-gateway',\n    ),\n    joinPathFragments(\n      PACKAGES_DIR,\n      SHARED_CONSTRUCTS_DIR,\n      'src',\n      'app',\n      'gateways',\n    ),\n    {\n      nameClassName: options.gatewayNameClassName,\n      nameKebabCase: options.gatewayNameKebabCase,\n      projectDirectory: options.projectDirectory,\n      cedarPolicy: options.cedarPolicy,\n      auth: options.auth,\n      protocol: options.protocol,\n      ...esmVars(tree),\n    },\n    {\n      overwriteStrategy: OverwriteStrategy.KeepExisting,\n    },\n  );\n\n  await addStarExport(\n    tree,\n    joinPathFragments(\n      PACKAGES_DIR,\n      SHARED_CONSTRUCTS_DIR,\n      'src',\n      'core',\n      'index.ts',\n    ),\n    './agentcore-gateway/agentcore-gateway.js',\n  );\n  await addStarExport(\n    tree,\n    joinPathFragments(\n      PACKAGES_DIR,\n      SHARED_CONSTRUCTS_DIR,\n      'src',\n      'app',\n      'gateways',\n      'index.ts',\n    ),\n    `./${options.gatewayNameKebabCase}/${options.gatewayNameKebabCase}.js`,\n  );\n  await addStarExport(\n    tree,\n    joinPathFragments(\n      PACKAGES_DIR,\n      SHARED_CONSTRUCTS_DIR,\n      'src',\n      'app',\n      'index.ts',\n    ),\n    './gateways/index.js',\n  );\n\n  // The gateway construct renders Cedar policies with ejs and its readiness\n  // probe uses the AgentCore SDK client; declare both so the lint passes.\n  addDependenciesToPackageJson(\n    tree,\n    withVersions(\n      forDependencies<typeof AGENT_CORE_CONSTRUCTS_DEPENDENCIES>(declaration),\n      ['ejs', '@aws-sdk/client-bedrock-agentcore'],\n    ),\n    withVersions(\n      forDependencies<typeof AGENT_CORE_CONSTRUCTS_DEPENDENCIES>(declaration),\n      ['@types/ejs'],\n    ),\n    joinPathFragments(PACKAGES_DIR, SHARED_CONSTRUCTS_DIR, 'package.json'),\n  );\n};\n\nconst addAgentCoreGatewayTerraformInfra = (\n  tree: Tree,\n  options: AddAgentCoreGatewayInfraProps,\n  declaration: DependencyDeclaration,\n) => {\n  generateFiles(\n    tree,\n    joinPathFragments(\n      import.meta.dirname,\n      'files',\n      'terraform',\n      'core',\n      'agentcore-gateway',\n    ),\n    joinPathFragments(\n      PACKAGES_DIR,\n      SHARED_TERRAFORM_DIR,\n      'src',\n      'core',\n      'agentcore-gateway',\n    ),\n    { ...terraformProviderVersions() },\n    {\n      overwriteStrategy: OverwriteStrategy.KeepExisting,\n    },\n  );\n\n  generateFiles(\n    tree,\n    joinPathFragments(\n      import.meta.dirname,\n      'files',\n      'terraform',\n      'app',\n      'agentcore-gateway',\n    ),\n    joinPathFragments(\n      PACKAGES_DIR,\n      SHARED_TERRAFORM_DIR,\n      'src',\n      'app',\n      'gateways',\n    ),\n    {\n      nameClassName: options.gatewayNameClassName,\n      nameKebabCase: options.gatewayNameKebabCase,\n      projectDirectory: options.projectDirectory,\n      cedarPolicy: options.cedarPolicy,\n      auth: options.auth,\n      protocol: options.protocol,\n      boto3Version: PY_VERSIONS.boto3,\n      httpxVersion: PY_VERSIONS.httpx,\n      mcpVersion: PY_VERSIONS.mcp,\n      ...terraformProviderVersions(),\n    },\n    {\n      overwriteStrategy: OverwriteStrategy.KeepExisting,\n    },\n  );\n\n  // The Cedar render script is only needed when policies are enabled\n  if (!options.cedarPolicy) {\n    const renderScript = joinPathFragments(\n      PACKAGES_DIR,\n      SHARED_TERRAFORM_DIR,\n      'src',\n      'app',\n      'gateways',\n      options.gatewayNameKebabCase,\n      'render-cedar.cjs',\n    );\n    if (tree.exists(renderScript)) {\n      tree.delete(renderScript);\n    }\n    return;\n  }\n\n  // render-cedar.cjs resolves ejs from the workspace root, since the shared\n  // terraform project it runs in has no package.json.\n  addDependenciesToPackageJson(\n    tree,\n    {},\n    withVersions(\n      forDependencies<typeof AGENT_CORE_CONSTRUCTS_DEPENDENCIES>(declaration),\n      ['ejs'],\n    ),\n  );\n};\n\nexport interface AddAgentCoreHarnessInfraProps {\n  harnessNameClassName: string;\n  harnessNameKebabCase: string;\n  /**\n   * Workspace-root-relative harness project root, eg `packages/my-harness`.\n   * The `src/PROMPT.md` path both templates read is derived from it.\n   */\n  projectRoot: string;\n  /** Leading-letter-guaranteed, 31-char-truncated resource name prefix. */\n  harnessNamePrefix: string;\n}\n\n/**\n * Template substitution context shared by the CDK and Terraform harness\n * branches. Both prompt path fields carry the same workspace-root-relative\n * path, named per provider so each template's usage reads on its own.\n */\ninterface HarnessTemplateContext {\n  nameClassName: string;\n  nameKebabCase: string;\n  harnessNamePrefix: string;\n  /** Joined onto `findWorkspaceRoot()` in the CDK construct. */\n  promptPathFromCdk: string;\n  /** Appended to the `path.module` walk to the workspace root in Terraform. */\n  promptPathFromTerraform: string;\n}\n\n/**\n * Add AgentCore Harness infrastructure for the selected IaC provider.\n *\n * Renders the provider-specific Harness infrastructure (a CDK construct or\n * a Terraform module) into the Shared Infrastructure Project with\n * `KeepExisting`, so existing files become user-owned and are never\n * rewritten by reruns.\n *\n * Unlike agents, MCP servers and gateways, no build dependency is added\n * from the shared infrastructure project to the Harness Project: generated\n * Harness infrastructure does not import Harness Project source, so a\n * dependency would only create false rebuild coupling.\n */\nexport const addAgentCoreHarnessInfra = async (\n  tree: Tree,\n  options: AddAgentCoreHarnessInfraProps & IACProvider,\n): Promise<void> => {\n  // One resolved template context, built once and passed to both provider\n  // branches. The prompt path is derived from the same projectRoot the\n  // Harness Project is written to, so explicit placement needs no extra logic.\n  const promptPath = joinPathFragments(options.projectRoot, 'src', 'PROMPT.md');\n  const templateContext: HarnessTemplateContext = {\n    nameClassName: options.harnessNameClassName,\n    nameKebabCase: options.harnessNameKebabCase,\n    harnessNamePrefix: options.harnessNamePrefix,\n    promptPathFromCdk: promptPath,\n    promptPathFromTerraform: promptPath,\n  };\n\n  switch (options.iac) {\n    case 'cdk':\n      await addAgentCoreHarnessCDKInfra(tree, templateContext);\n      break;\n    case 'terraform':\n      addAgentCoreHarnessTerraformInfra(tree, templateContext);\n      break;\n  }\n};\n\nconst addAgentCoreHarnessCDKInfra = async (\n  tree: Tree,\n  templateContext: HarnessTemplateContext,\n) => {\n  // Generate the app specific CDK construct under\n  // src/app/harnesses/<kebab-case-name>/\n  generateFiles(\n    tree,\n    joinPathFragments(\n      import.meta.dirname,\n      'files',\n      'cdk',\n      'app',\n      'agentcore-harness',\n    ),\n    joinPathFragments(\n      PACKAGES_DIR,\n      SHARED_CONSTRUCTS_DIR,\n      'src',\n      'app',\n      'harnesses',\n    ),\n    { ...templateContext, ...esmVars(tree) },\n    {\n      overwriteStrategy: OverwriteStrategy.KeepExisting,\n    },\n  );\n\n  // Export the construct through the harnesses app index and the shared\n  // app index. addStarExport creates a missing index file and semantically\n  // deduplicates equivalent exports on reruns.\n  await addStarExport(\n    tree,\n    joinPathFragments(\n      PACKAGES_DIR,\n      SHARED_CONSTRUCTS_DIR,\n      'src',\n      'app',\n      'harnesses',\n      'index.ts',\n    ),\n    `./${templateContext.nameKebabCase}/${templateContext.nameKebabCase}.js`,\n  );\n  await addStarExport(\n    tree,\n    joinPathFragments(\n      PACKAGES_DIR,\n      SHARED_CONSTRUCTS_DIR,\n      'src',\n      'app',\n      'index.ts',\n    ),\n    './harnesses/index.js',\n  );\n};\n\nconst addAgentCoreHarnessTerraformInfra = (\n  tree: Tree,\n  templateContext: HarnessTemplateContext,\n) => {\n  // Generate the app specific Terraform module under\n  // src/app/harnesses/<kebab-case-name>/. No CDK files or exports are\n  // created on this path.\n  generateFiles(\n    tree,\n    joinPathFragments(\n      import.meta.dirname,\n      'files',\n      'terraform',\n      'app',\n      'agentcore-harness',\n    ),\n    joinPathFragments(\n      PACKAGES_DIR,\n      SHARED_TERRAFORM_DIR,\n      'src',\n      'app',\n      'harnesses',\n    ),\n    { ...templateContext, ...terraformProviderVersions() },\n    {\n      overwriteStrategy: OverwriteStrategy.KeepExisting,\n    },\n  );\n};\n"],"names":["generateFiles","joinPathFragments","OverwriteStrategy","updateJson","addStarExport","forDependencies","addDependenciesToPackageJson","esmVars","addDependencyToTargetIfNotPresent","generatedCdk","generatedTerraform","PACKAGES_DIR","SHARED_CONSTRUCTS_DIR","SHARED_TERRAFORM_DIR","PY_VERSIONS","terraformProviderVersions","withVersions","AGENT_CORE_CONSTRUCTS_DEPENDENCIES","name","when","dev","root","AGENT_CORE_CONSTRUCTS_PY_DEPENDENCIES","addAgentCoreInfra","tree","options","iac","addAgentCoreCDKInfra","addAgentCoreTerraformInfra","config","projectName","dirname","appDirectory","overwriteStrategy","KeepExisting","nameKebabCase","containers","boto3Version","boto3","addMcpServerInfra","nameClassName","mcpServerNameClassName","mcpServerNameKebabCase","dockerImageTag","dockerOutputDir","serverProtocol","auth","session","addAgentInfra","agentNameClassName","agentNameKebabCase","addAgentCoreGatewayInfra","declaration","addAgentCoreGatewayCDKInfra","addAgentCoreGatewayTerraformInfra","gatewayNameClassName","gatewayNameKebabCase","projectDirectory","cedarPolicy","protocol","httpxVersion","httpx","mcpVersion","mcp","renderScript","exists","delete","addAgentCoreHarnessInfra","promptPath","projectRoot","templateContext","harnessNameClassName","harnessNameKebabCase","harnessNamePrefix","promptPathFromCdk","promptPathFromTerraform","addAgentCoreHarnessCDKInfra","addAgentCoreHarnessTerraformInfra"],"mappings":"AAAA;;;CAGC,GACD,SACEA,aAAa,EACbC,iBAAiB,EACjBC,iBAAiB,EAGjBC,UAAU,QACL,aAAa;AACpB,SAASC,aAAa,QAAQ,YAAY;AAE1C,SAIEC,eAAe,QAEV,8BAA8B;AACrC,SAASC,4BAA4B,QAAQ,qBAAqB;AAElE,SAASC,OAAO,QAAQ,sBAAsB;AAC9C,SAASC,iCAAiC,QAAQ,WAAW;AAC7D,SACEC,YAAY,EACZC,kBAAkB,EAElBC,YAAY,EACZC,qBAAqB,EACrBC,oBAAoB,QACf,oCAAoC;AAC3C,SAGEC,WAAW,EACXC,yBAAyB,EACzBC,YAAY,QACP,iBAAiB;AAIxB;;;;;;;CAOC,GACD,OAAO,MAAMC,qCAAqC;IAChD;QAAEC,MAAM;QAAOC,MAAMV;IAAa;IAClC;QAAES,MAAM;QAAqCC,MAAMV;IAAa;IAChE;QAAES,MAAM;QAAcC,MAAMV;IAAa;IACzC;QAAES,MAAM;QAAOC,MAAMT;QAAoBU,KAAK;QAAMC,MAAM;IAAK;CAChE,CAGG;AAEJ;;;;;;;CAOC,GACD,OAAO,MAAMC,wCAAwC;IACnD;QAAEJ,MAAM;QAASC,MAAMT;IAAmB;IAC1C;QAAEQ,MAAM;QAASC,MAAMT;IAAmB;IAC1C;QAAEQ,MAAM;QAAOC,MAAMT;IAAmB;CACzC,CAGG;AAoBJ,MAAMa,oBAAoB,OACxBC,MACAC;IAEA,OAAQA,QAAQC,GAAG;QACjB,KAAK;YACH,MAAMC,qBAAqBH,MAAMC;YACjC;QACF,KAAK;YACHG,2BAA2BJ,MAAMC;YACjC;IACJ;IAEA,qFAAqF;IACrFtB,WACEqB,MACAvB,kBACEU,cACAc,QAAQC,GAAG,KAAK,QAAQd,wBAAwBC,sBAChD,iBAEF,CAACgB;QACCrB,kCACEqB,QACA,SACA,GAAGJ,QAAQK,WAAW,CAAC,MAAM,CAAC;QAEhC,OAAOD;IACT;AAEJ;AAEA,MAAMF,uBAAuB,OAC3BH,MACAC;IAEA,sCAAsC;IACtCzB,cACEwB,MACAvB,kBAAkB,YAAY8B,OAAO,EAAE,SAAS,OAAO,OAAO,eAC9D9B,kBACEU,cACAC,uBACA,OACA,OACAa,QAAQO,YAAY,GAEtB;QAAE,GAAGP,OAAO;QAAE,GAAGlB,QAAQiB,KAAK;IAAC,GAC/B;QACES,mBAAmB/B,kBAAkBgC,YAAY;IACnD;IAGF,oCAAoC;IACpC,MAAM9B,cACJoB,MACAvB,kBACEU,cACAC,uBACA,OACA,OACAa,QAAQO,YAAY,EACpB,aAEF,CAAC,EAAE,EAAEP,QAAQU,aAAa,CAAC,CAAC,EAAEV,QAAQU,aAAa,CAAC,GAAG,CAAC;IAE1D,MAAM/B,cACJoB,MACAvB,kBACEU,cACAC,uBACA,OACA,OACA,aAEF,CAAC,EAAE,EAAEa,QAAQO,YAAY,CAAC,SAAS,CAAC;AAExC;AAEA,MAAMJ,6BAA6B,CACjCJ,MACAC;IAEA,kCAAkC;IAClCzB,cACEwB,MACAvB,kBACE,YAAY8B,OAAO,EACnB,SACA,aACA,QACA,eAEF9B,kBACEU,cACAE,sBACA,OACA,QACA,eAEF;QACEuB,YAAYX,QAAQW,UAAU;QAC9BC,cAAcvB,YAAYwB,KAAK;QAC/B,GAAGvB,2BAA2B;IAChC,GACA;QACEkB,mBAAmB/B,kBAAkBgC,YAAY;IACnD;IAGF,iDAAiD;IACjDlC,cACEwB,MACAvB,kBACE,YAAY8B,OAAO,EACnB,SACA,aACA,OACA,eAEF9B,kBACEU,cACAE,sBACA,OACA,OACAY,QAAQO,YAAY,GAEtB;QAAE,GAAGP,OAAO;QAAE,GAAGV,2BAA2B;IAAC,GAC7C;QACEkB,mBAAmB/B,kBAAkBgC,YAAY;IACnD;AAEJ;AAYA;;CAEC,GACD,OAAO,MAAMK,oBAAoB,OAC/Bf,MACAC;IAEA,MAAMF,kBAAkBC,MAAM;QAC5BgB,eAAef,QAAQgB,sBAAsB;QAC7CN,eAAeV,QAAQiB,sBAAsB;QAC7CC,gBAAgBlB,QAAQkB,cAAc;QACtCC,iBAAiBnB,QAAQmB,eAAe;QACxCd,aAAaL,QAAQK,WAAW;QAChCE,cAAc;QACda,gBAAgB;QAChBnB,KAAKD,QAAQC,GAAG;QAChBoB,MAAMrB,QAAQqB,IAAI;QAClB,kEAAkE;QAClEC,SAAS;QACTX,YAAYX,QAAQW,UAAU;IAChC;AACF,EAAE;AAcF;;CAEC,GACD,OAAO,MAAMY,gBAAgB,OAC3BxB,MACAC;IAEA,MAAMF,kBAAkBC,MAAM;QAC5BgB,eAAef,QAAQwB,kBAAkB;QACzCd,eAAeV,QAAQyB,kBAAkB;QACzCpB,aAAaL,QAAQK,WAAW;QAChCa,gBAAgBlB,QAAQkB,cAAc;QACtCC,iBAAiBnB,QAAQmB,eAAe;QACxCZ,cAAc;QACde,SAAStB,QAAQsB,OAAO;QACxBF,gBAAgBpB,QAAQoB,cAAc,IAAI;QAC1CnB,KAAKD,QAAQC,GAAG;QAChBoB,MAAMrB,QAAQqB,IAAI;QAClBV,YAAYX,QAAQW,UAAU;IAChC;AACF,EAAE;AAgBF,OAAO,MAAMe,2BAA2B,OAGtC3B,MACAC,SACA2B;IAEA,OAAQ3B,QAAQC,GAAG;QACjB,KAAK;YACH,MAAM2B,4BAA4B7B,MAAMC,SAAS2B;YACjD;QACF,KAAK;YACHE,kCAAkC9B,MAAMC,SAAS2B;YACjD;IACJ;IAEAjD,WACEqB,MACAvB,kBACEU,cACAc,QAAQC,GAAG,KAAK,QAAQd,wBAAwBC,sBAChD,iBAEF,CAACgB;QACCrB,kCACEqB,QACA,SACA,GAAGJ,QAAQK,WAAW,CAAC,MAAM,CAAC;QAEhC,OAAOD;IACT;AAEJ,EAAE;AAEF,MAAMwB,8BAA8B,OAClC7B,MACAC,SACA2B;IAEA,0EAA0E;IAC1E,kCAAkC;IAClCpD,cACEwB,MACAvB,kBACE,YAAY8B,OAAO,EACnB,SACA,OACA,QACA,sBAEF9B,kBACEU,cACAC,uBACA,OACA,QACA,sBAEF;QAAE,GAAGL,QAAQiB,KAAK;IAAC,GACnB;QACES,mBAAmB/B,kBAAkBgC,YAAY;IACnD;IAGFlC,cACEwB,MACAvB,kBACE,YAAY8B,OAAO,EACnB,SACA,OACA,OACA,sBAEF9B,kBACEU,cACAC,uBACA,OACA,OACA,aAEF;QACE4B,eAAef,QAAQ8B,oBAAoB;QAC3CpB,eAAeV,QAAQ+B,oBAAoB;QAC3CC,kBAAkBhC,QAAQgC,gBAAgB;QAC1CC,aAAajC,QAAQiC,WAAW;QAChCZ,MAAMrB,QAAQqB,IAAI;QAClBa,UAAUlC,QAAQkC,QAAQ;QAC1B,GAAGpD,QAAQiB,KAAK;IAClB,GACA;QACES,mBAAmB/B,kBAAkBgC,YAAY;IACnD;IAGF,MAAM9B,cACJoB,MACAvB,kBACEU,cACAC,uBACA,OACA,QACA,aAEF;IAEF,MAAMR,cACJoB,MACAvB,kBACEU,cACAC,uBACA,OACA,OACA,YACA,aAEF,CAAC,EAAE,EAAEa,QAAQ+B,oBAAoB,CAAC,CAAC,EAAE/B,QAAQ+B,oBAAoB,CAAC,GAAG,CAAC;IAExE,MAAMpD,cACJoB,MACAvB,kBACEU,cACAC,uBACA,OACA,OACA,aAEF;IAGF,0EAA0E;IAC1E,wEAAwE;IACxEN,6BACEkB,MACAR,aACEX,gBAA2D+C,cAC3D;QAAC;QAAO;KAAoC,GAE9CpC,aACEX,gBAA2D+C,cAC3D;QAAC;KAAa,GAEhBnD,kBAAkBU,cAAcC,uBAAuB;AAE3D;AAEA,MAAM0C,oCAAoC,CACxC9B,MACAC,SACA2B;IAEApD,cACEwB,MACAvB,kBACE,YAAY8B,OAAO,EACnB,SACA,aACA,QACA,sBAEF9B,kBACEU,cACAE,sBACA,OACA,QACA,sBAEF;QAAE,GAAGE,2BAA2B;IAAC,GACjC;QACEkB,mBAAmB/B,kBAAkBgC,YAAY;IACnD;IAGFlC,cACEwB,MACAvB,kBACE,YAAY8B,OAAO,EACnB,SACA,aACA,OACA,sBAEF9B,kBACEU,cACAE,sBACA,OACA,OACA,aAEF;QACE2B,eAAef,QAAQ8B,oBAAoB;QAC3CpB,eAAeV,QAAQ+B,oBAAoB;QAC3CC,kBAAkBhC,QAAQgC,gBAAgB;QAC1CC,aAAajC,QAAQiC,WAAW;QAChCZ,MAAMrB,QAAQqB,IAAI;QAClBa,UAAUlC,QAAQkC,QAAQ;QAC1BtB,cAAcvB,YAAYwB,KAAK;QAC/BsB,cAAc9C,YAAY+C,KAAK;QAC/BC,YAAYhD,YAAYiD,GAAG;QAC3B,GAAGhD,2BAA2B;IAChC,GACA;QACEkB,mBAAmB/B,kBAAkBgC,YAAY;IACnD;IAGF,mEAAmE;IACnE,IAAI,CAACT,QAAQiC,WAAW,EAAE;QACxB,MAAMM,eAAe/D,kBACnBU,cACAE,sBACA,OACA,OACA,YACAY,QAAQ+B,oBAAoB,EAC5B;QAEF,IAAIhC,KAAKyC,MAAM,CAACD,eAAe;YAC7BxC,KAAK0C,MAAM,CAACF;QACd;QACA;IACF;IAEA,0EAA0E;IAC1E,oDAAoD;IACpD1D,6BACEkB,MACA,CAAC,GACDR,aACEX,gBAA2D+C,cAC3D;QAAC;KAAM;AAGb;AA6BA;;;;;;;;;;;;CAYC,GACD,OAAO,MAAMe,2BAA2B,OACtC3C,MACAC;IAEA,wEAAwE;IACxE,qEAAqE;IACrE,6EAA6E;IAC7E,MAAM2C,aAAanE,kBAAkBwB,QAAQ4C,WAAW,EAAE,OAAO;IACjE,MAAMC,kBAA0C;QAC9C9B,eAAef,QAAQ8C,oBAAoB;QAC3CpC,eAAeV,QAAQ+C,oBAAoB;QAC3CC,mBAAmBhD,QAAQgD,iBAAiB;QAC5CC,mBAAmBN;QACnBO,yBAAyBP;IAC3B;IAEA,OAAQ3C,QAAQC,GAAG;QACjB,KAAK;YACH,MAAMkD,4BAA4BpD,MAAM8C;YACxC;QACF,KAAK;YACHO,kCAAkCrD,MAAM8C;YACxC;IACJ;AACF,EAAE;AAEF,MAAMM,8BAA8B,OAClCpD,MACA8C;IAEA,gDAAgD;IAChD,uCAAuC;IACvCtE,cACEwB,MACAvB,kBACE,YAAY8B,OAAO,EACnB,SACA,OACA,OACA,sBAEF9B,kBACEU,cACAC,uBACA,OACA,OACA,cAEF;QAAE,GAAG0D,eAAe;QAAE,GAAG/D,QAAQiB,KAAK;IAAC,GACvC;QACES,mBAAmB/B,kBAAkBgC,YAAY;IACnD;IAGF,sEAAsE;IACtE,yEAAyE;IACzE,6CAA6C;IAC7C,MAAM9B,cACJoB,MACAvB,kBACEU,cACAC,uBACA,OACA,OACA,aACA,aAEF,CAAC,EAAE,EAAE0D,gBAAgBnC,aAAa,CAAC,CAAC,EAAEmC,gBAAgBnC,aAAa,CAAC,GAAG,CAAC;IAE1E,MAAM/B,cACJoB,MACAvB,kBACEU,cACAC,uBACA,OACA,OACA,aAEF;AAEJ;AAEA,MAAMiE,oCAAoC,CACxCrD,MACA8C;IAEA,mDAAmD;IACnD,oEAAoE;IACpE,wBAAwB;IACxBtE,cACEwB,MACAvB,kBACE,YAAY8B,OAAO,EACnB,SACA,aACA,OACA,sBAEF9B,kBACEU,cACAE,sBACA,OACA,OACA,cAEF;QAAE,GAAGyD,eAAe;QAAE,GAAGvD,2BAA2B;IAAC,GACrD;QACEkB,mBAAmB/B,kBAAkBgC,YAAY;IACnD;AAEJ"}

package/src/utils/dynamodb-constructs/files/terraform/app/dynamodb/__nameKebabCase__/__nameKebabCase__.tf.template

@@ -96,3 +96,18 @@ module "add_to_runtime_config" {
     tableName = module.dynamodb_table.table_name
   }
 }
+
+output "table_name" {
+  description = "Name of the DynamoDB table"
+  value       = module.dynamodb_table.table_name
+}
+
+output "table_arn" {
+  description = "ARN of the DynamoDB table, for use in IAM policies granting access to the table. Suffix with /index/* to cover its global secondary indexes."
+  value       = module.dynamodb_table.table_arn
+}
+
+output "kms_key_arn" {
+  description = "ARN of the KMS key used to encrypt the DynamoDB table, for use in IAM policies granting access to the table. Null when using the AWS owned key (encryption = DEFAULT)."
+  value       = module.dynamodb_table.kms_key_arn
+}

package/src/utils/dynamodb-constructs/files/terraform/core/dynamodb/dynamodb.tf.template

@@ -95,6 +95,8 @@ resource "aws_kms_key" "table" {
   description         = "KMS key for DynamoDB table ${var.name}"
   enable_key_rotation = var.enable_key_rotation
 
+  deletion_window_in_days = 30
+
   policy = jsonencode({
     Version = "2012-10-17"
     Statement = [
@@ -171,6 +173,10 @@ resource "aws_dynamodb_table" "table" {
     enabled     = var.encryption != "DEFAULT"
     kms_key_arn = local.table_kms_key_arn
   }
+
+  lifecycle {
+    prevent_destroy = true
+  }
 }
 
 output "table_name" {

package/src/utils/rdb-constructs/files/terraform/core/rdb/aurora/aurora.tf.template

@@ -215,6 +215,8 @@ resource "aws_kms_key" "database" {
   description         = "KMS key for Aurora cluster ${var.name}"
   enable_key_rotation = var.enable_key_rotation
 
+  deletion_window_in_days = 30
+
   policy = jsonencode({
     Version = "2012-10-17"
     Statement = [
@@ -357,6 +359,10 @@ resource "aws_rds_cluster" "database" {
   tags = merge(var.tags, {
     Name = "${var.name}-aurora"
   })
+
+  lifecycle {
+    prevent_destroy = true
+  }
 }
 
 resource "aws_rds_cluster_instance" "database" {

package/src/utils/shared-constructs-constants.d.ts

@@ -54,6 +54,11 @@ export declare const generatedInfrastructure: (m: IacMetadata) => boolean;
  * branch never writes.
  */
 export declare const generatedTerraform: (m: IacMetadata) => boolean;
+/**
+ * Whether CDK infrastructure was generated, for the packages only a construct
+ * imports.
+ */
+export declare const generatedCdk: (m: IacMetadata) => boolean;
 /**
  * Dependencies a caller must declare to use the shared constructs project.
  * Lives here so generators can spread it without importing the generator.

package/src/utils/shared-constructs-constants.js

@@ -43,6 +43,10 @@ export const DYNAMODB_GENERATOR_IDS = [
  * module pins — a Terraform inline script's `uv run --with` pins, which the CDK
  * branch never writes.
  */ export const generatedTerraform = (m)=>m.iac === 'terraform';
+/**
+ * Whether CDK infrastructure was generated, for the packages only a construct
+ * imports.
+ */ export const generatedCdk = (m)=>m.iac === 'cdk';
 /**
  * Dependencies a caller must declare to use the shared constructs project.
  * Lives here so generators can spread it without importing the generator.

package/src/utils/shared-constructs-constants.js.map

@@ -1 +1 @@
-{"version":3,"sources":["../../../../../packages/nx-plugin/src/utils/shared-constructs-constants.ts"],"sourcesContent":["/**\n * Copyright Amazon.com, Inc. or its affiliates. All Rights Reserved.\n * SPDX-License-Identifier: Apache-2.0\n */\nimport type { DeclaredTsDependency } from './declared-dependencies.js';\nimport type { ITsDepVersion } from './versions.js';\n\nexport const PACKAGES_DIR = 'packages';\nexport const SHARED_CONSTRUCTS_NAME = 'common-constructs';\nexport const SHARED_CONSTRUCTS_DIR = 'common/constructs';\nexport const SHARED_TERRAFORM_NAME = 'terraform';\nexport const SHARED_TERRAFORM_DIR = 'common/terraform';\nexport const SHARED_SHADCN_NAME = 'common-shadcn';\nexport const SHARED_SHADCN_DIR = 'common/shadcn';\nexport const SHARED_INFRA_CONFIG_NAME = 'common-infra-config';\nexport const SHARED_INFRA_CONFIG_DIR = 'common/infra-config';\nexport const SHARED_SCRIPTS_NAME = 'common-scripts';\nexport const SHARED_SCRIPTS_DIR = 'common/scripts';\n\nexport const DYNAMODB_GENERATOR_IDS = ['ts#dynamodb', 'py#dynamodb'];\n\n/**\n * Directory the vended Terraform runtime-config modules aggregate into at apply\n * time, relative to the workspace root. The `entry` module writes leaf files\n * under `entries/<namespace>/`, and the `read` / `appconfig-deployment` modules\n * merge those into one `<namespace>.json` here.\n */\nexport const TERRAFORM_RUNTIME_CONFIG_DIR = `dist/${PACKAGES_DIR}/${SHARED_TERRAFORM_DIR}/runtime-config`;\n\n/**\n * Runtime-config namespace the static website publishes to and reads back, as\n * passed to the `read` module by the vended static-website Terraform module.\n */\nexport const WEBSITE_RUNTIME_CONFIG_NAMESPACE = 'connection';\n\n/**\n * File the Terraform aggregation writes the website's runtime config to,\n * relative to the workspace root.\n */\nexport const TERRAFORM_WEBSITE_RUNTIME_CONFIG_FILE = `${TERRAFORM_RUNTIME_CONFIG_DIR}/${WEBSITE_RUNTIME_CONFIG_NAMESPACE}.json`;\n\n/**\n * What a generator records about the infrastructure it generated.\n *\n * Every generator that creates infrastructure records the `iac` it used, so a\n * predicate can tell a CDK project from a Terraform one at upgrade time. Absent\n * when the generator was run with no infrastructure, so its presence doubles as\n * \"infrastructure was generated\" — which is what gates the packages an infra\n * helper adds.\n */\nexport interface IacMetadata {\n  readonly iac?: string;\n}\n\n/**\n * Whether infrastructure was generated at all, so the packages an infra helper\n * adds are only claimed where that helper ran.\n *\n * Reads `iac` rather than the generator's own `infra` option: every generator\n * resolves `iac` only on the infra branch, so one recorded field answers both\n * questions and no generator needs a second one.\n */\nexport const generatedInfrastructure = (m: IacMetadata): boolean =>\n  m.iac !== undefined;\n\n/**\n * Whether Terraform infrastructure was generated, for the versions only a `.tf`\n * module pins — a Terraform inline script's `uv run --with` pins, which the CDK\n * branch never writes.\n */\nexport const generatedTerraform = (m: IacMetadata): boolean =>\n  m.iac === 'terraform';\n\n/**\n * Dependencies a caller must declare to use the shared constructs project.\n * Lives here so generators can spread it without importing the generator.\n *\n * `constructs` and `aws-cdk-lib` are gated on CDK because\n * `sharedConstructsGenerator` creates the TypeScript constructs project on that\n * branch alone — a Terraform workspace gets the shared Terraform project and\n * never receives them.\n */\nexport const SHARED_CONSTRUCTS_DEPENDENCIES = [\n  { name: 'constructs', when: (m: IacMetadata) => m.iac === 'cdk' },\n  { name: 'aws-cdk-lib', when: (m: IacMetadata) => m.iac === 'cdk' },\n  { name: '@types/node' },\n] as const satisfies readonly DeclaredTsDependency<\n  ITsDepVersion,\n  IacMetadata\n>[];\n"],"names":["PACKAGES_DIR","SHARED_CONSTRUCTS_NAME","SHARED_CONSTRUCTS_DIR","SHARED_TERRAFORM_NAME","SHARED_TERRAFORM_DIR","SHARED_SHADCN_NAME","SHARED_SHADCN_DIR","SHARED_INFRA_CONFIG_NAME","SHARED_INFRA_CONFIG_DIR","SHARED_SCRIPTS_NAME","SHARED_SCRIPTS_DIR","DYNAMODB_GENERATOR_IDS","TERRAFORM_RUNTIME_CONFIG_DIR","WEBSITE_RUNTIME_CONFIG_NAMESPACE","TERRAFORM_WEBSITE_RUNTIME_CONFIG_FILE","generatedInfrastructure","m","iac","undefined","generatedTerraform","SHARED_CONSTRUCTS_DEPENDENCIES","name","when"],"mappings":"AAAA;;;CAGC,GAID,OAAO,MAAMA,eAAe,WAAW;AACvC,OAAO,MAAMC,yBAAyB,oBAAoB;AAC1D,OAAO,MAAMC,wBAAwB,oBAAoB;AACzD,OAAO,MAAMC,wBAAwB,YAAY;AACjD,OAAO,MAAMC,uBAAuB,mBAAmB;AACvD,OAAO,MAAMC,qBAAqB,gBAAgB;AAClD,OAAO,MAAMC,oBAAoB,gBAAgB;AACjD,OAAO,MAAMC,2BAA2B,sBAAsB;AAC9D,OAAO,MAAMC,0BAA0B,sBAAsB;AAC7D,OAAO,MAAMC,sBAAsB,iBAAiB;AACpD,OAAO,MAAMC,qBAAqB,iBAAiB;AAEnD,OAAO,MAAMC,yBAAyB;IAAC;IAAe;CAAc,CAAC;AAErE;;;;;CAKC,GACD,OAAO,MAAMC,+BAA+B,CAAC,KAAK,EAAEZ,aAAa,CAAC,EAAEI,qBAAqB,eAAe,CAAC,CAAC;AAE1G;;;CAGC,GACD,OAAO,MAAMS,mCAAmC,aAAa;AAE7D;;;CAGC,GACD,OAAO,MAAMC,wCAAwC,GAAGF,6BAA6B,CAAC,EAAEC,iCAAiC,KAAK,CAAC,CAAC;AAehI;;;;;;;CAOC,GACD,OAAO,MAAME,0BAA0B,CAACC,IACtCA,EAAEC,GAAG,KAAKC,UAAU;AAEtB;;;;CAIC,GACD,OAAO,MAAMC,qBAAqB,CAACH,IACjCA,EAAEC,GAAG,KAAK,YAAY;AAExB;;;;;;;;CAQC,GACD,OAAO,MAAMG,iCAAiC;IAC5C;QAAEC,MAAM;QAAcC,MAAM,CAACN,IAAmBA,EAAEC,GAAG,KAAK;IAAM;IAChE;QAAEI,MAAM;QAAeC,MAAM,CAACN,IAAmBA,EAAEC,GAAG,KAAK;IAAM;IACjE;QAAEI,MAAM;IAAc;CACvB,CAGG"}
+{"version":3,"sources":["../../../../../packages/nx-plugin/src/utils/shared-constructs-constants.ts"],"sourcesContent":["/**\n * Copyright Amazon.com, Inc. or its affiliates. All Rights Reserved.\n * SPDX-License-Identifier: Apache-2.0\n */\nimport type { DeclaredTsDependency } from './declared-dependencies.js';\nimport type { ITsDepVersion } from './versions.js';\n\nexport const PACKAGES_DIR = 'packages';\nexport const SHARED_CONSTRUCTS_NAME = 'common-constructs';\nexport const SHARED_CONSTRUCTS_DIR = 'common/constructs';\nexport const SHARED_TERRAFORM_NAME = 'terraform';\nexport const SHARED_TERRAFORM_DIR = 'common/terraform';\nexport const SHARED_SHADCN_NAME = 'common-shadcn';\nexport const SHARED_SHADCN_DIR = 'common/shadcn';\nexport const SHARED_INFRA_CONFIG_NAME = 'common-infra-config';\nexport const SHARED_INFRA_CONFIG_DIR = 'common/infra-config';\nexport const SHARED_SCRIPTS_NAME = 'common-scripts';\nexport const SHARED_SCRIPTS_DIR = 'common/scripts';\n\nexport const DYNAMODB_GENERATOR_IDS = ['ts#dynamodb', 'py#dynamodb'];\n\n/**\n * Directory the vended Terraform runtime-config modules aggregate into at apply\n * time, relative to the workspace root. The `entry` module writes leaf files\n * under `entries/<namespace>/`, and the `read` / `appconfig-deployment` modules\n * merge those into one `<namespace>.json` here.\n */\nexport const TERRAFORM_RUNTIME_CONFIG_DIR = `dist/${PACKAGES_DIR}/${SHARED_TERRAFORM_DIR}/runtime-config`;\n\n/**\n * Runtime-config namespace the static website publishes to and reads back, as\n * passed to the `read` module by the vended static-website Terraform module.\n */\nexport const WEBSITE_RUNTIME_CONFIG_NAMESPACE = 'connection';\n\n/**\n * File the Terraform aggregation writes the website's runtime config to,\n * relative to the workspace root.\n */\nexport const TERRAFORM_WEBSITE_RUNTIME_CONFIG_FILE = `${TERRAFORM_RUNTIME_CONFIG_DIR}/${WEBSITE_RUNTIME_CONFIG_NAMESPACE}.json`;\n\n/**\n * What a generator records about the infrastructure it generated.\n *\n * Every generator that creates infrastructure records the `iac` it used, so a\n * predicate can tell a CDK project from a Terraform one at upgrade time. Absent\n * when the generator was run with no infrastructure, so its presence doubles as\n * \"infrastructure was generated\" — which is what gates the packages an infra\n * helper adds.\n */\nexport interface IacMetadata {\n  readonly iac?: string;\n}\n\n/**\n * Whether infrastructure was generated at all, so the packages an infra helper\n * adds are only claimed where that helper ran.\n *\n * Reads `iac` rather than the generator's own `infra` option: every generator\n * resolves `iac` only on the infra branch, so one recorded field answers both\n * questions and no generator needs a second one.\n */\nexport const generatedInfrastructure = (m: IacMetadata): boolean =>\n  m.iac !== undefined;\n\n/**\n * Whether Terraform infrastructure was generated, for the versions only a `.tf`\n * module pins — a Terraform inline script's `uv run --with` pins, which the CDK\n * branch never writes.\n */\nexport const generatedTerraform = (m: IacMetadata): boolean =>\n  m.iac === 'terraform';\n\n/**\n * Whether CDK infrastructure was generated, for the packages only a construct\n * imports.\n */\nexport const generatedCdk = (m: IacMetadata): boolean => m.iac === 'cdk';\n\n/**\n * Dependencies a caller must declare to use the shared constructs project.\n * Lives here so generators can spread it without importing the generator.\n *\n * `constructs` and `aws-cdk-lib` are gated on CDK because\n * `sharedConstructsGenerator` creates the TypeScript constructs project on that\n * branch alone — a Terraform workspace gets the shared Terraform project and\n * never receives them.\n */\nexport const SHARED_CONSTRUCTS_DEPENDENCIES = [\n  { name: 'constructs', when: (m: IacMetadata) => m.iac === 'cdk' },\n  { name: 'aws-cdk-lib', when: (m: IacMetadata) => m.iac === 'cdk' },\n  { name: '@types/node' },\n] as const satisfies readonly DeclaredTsDependency<\n  ITsDepVersion,\n  IacMetadata\n>[];\n"],"names":["PACKAGES_DIR","SHARED_CONSTRUCTS_NAME","SHARED_CONSTRUCTS_DIR","SHARED_TERRAFORM_NAME","SHARED_TERRAFORM_DIR","SHARED_SHADCN_NAME","SHARED_SHADCN_DIR","SHARED_INFRA_CONFIG_NAME","SHARED_INFRA_CONFIG_DIR","SHARED_SCRIPTS_NAME","SHARED_SCRIPTS_DIR","DYNAMODB_GENERATOR_IDS","TERRAFORM_RUNTIME_CONFIG_DIR","WEBSITE_RUNTIME_CONFIG_NAMESPACE","TERRAFORM_WEBSITE_RUNTIME_CONFIG_FILE","generatedInfrastructure","m","iac","undefined","generatedTerraform","generatedCdk","SHARED_CONSTRUCTS_DEPENDENCIES","name","when"],"mappings":"AAAA;;;CAGC,GAID,OAAO,MAAMA,eAAe,WAAW;AACvC,OAAO,MAAMC,yBAAyB,oBAAoB;AAC1D,OAAO,MAAMC,wBAAwB,oBAAoB;AACzD,OAAO,MAAMC,wBAAwB,YAAY;AACjD,OAAO,MAAMC,uBAAuB,mBAAmB;AACvD,OAAO,MAAMC,qBAAqB,gBAAgB;AAClD,OAAO,MAAMC,oBAAoB,gBAAgB;AACjD,OAAO,MAAMC,2BAA2B,sBAAsB;AAC9D,OAAO,MAAMC,0BAA0B,sBAAsB;AAC7D,OAAO,MAAMC,sBAAsB,iBAAiB;AACpD,OAAO,MAAMC,qBAAqB,iBAAiB;AAEnD,OAAO,MAAMC,yBAAyB;IAAC;IAAe;CAAc,CAAC;AAErE;;;;;CAKC,GACD,OAAO,MAAMC,+BAA+B,CAAC,KAAK,EAAEZ,aAAa,CAAC,EAAEI,qBAAqB,eAAe,CAAC,CAAC;AAE1G;;;CAGC,GACD,OAAO,MAAMS,mCAAmC,aAAa;AAE7D;;;CAGC,GACD,OAAO,MAAMC,wCAAwC,GAAGF,6BAA6B,CAAC,EAAEC,iCAAiC,KAAK,CAAC,CAAC;AAehI;;;;;;;CAOC,GACD,OAAO,MAAME,0BAA0B,CAACC,IACtCA,EAAEC,GAAG,KAAKC,UAAU;AAEtB;;;;CAIC,GACD,OAAO,MAAMC,qBAAqB,CAACH,IACjCA,EAAEC,GAAG,KAAK,YAAY;AAExB;;;CAGC,GACD,OAAO,MAAMG,eAAe,CAACJ,IAA4BA,EAAEC,GAAG,KAAK,MAAM;AAEzE;;;;;;;;CAQC,GACD,OAAO,MAAMI,iCAAiC;IAC5C;QAAEC,MAAM;QAAcC,MAAM,CAACP,IAAmBA,EAAEC,GAAG,KAAK;IAAM;IAChE;QAAEK,MAAM;QAAeC,MAAM,CAACP,IAAmBA,EAAEC,GAAG,KAAK;IAAM;IACjE;QAAEK,MAAM;IAAc;CACvB,CAGG"}