@aws/nx-plugin 1.0.0-rc.82 → 1.0.0-rc.84

package/migrations.json

@@ -32,6 +32,46 @@
       "description": "Provision AppConfig configuration profiles for every namespace the vended terraform modules write to",
       "implementation": "./src/migrations/latest/runtime-config-namespace-defaults/migration"
     },
+    "latest-dynamodb-terraform-app-module-outputs": {
+      "version": "1.0.0-rc.83",
+      "description": "Re-export the DynamoDB table and KMS key attributes from the vended Terraform per-table app module",
+      "implementation": "./src/migrations/latest/dynamodb-terraform-app-module-outputs/migration"
+    },
+    "latest-terraform-data-resource-destroy-protection": {
+      "version": "1.0.0-rc.83",
+      "description": "Add prevent_destroy and a 30 day KMS deletion window to the vended Terraform DynamoDB table and Aurora cluster modules",
+      "implementation": "./src/migrations/latest/terraform-data-resource-destroy-protection/migration"
+    },
+    "latest-terraform-gateway-cedar-render-root-ejs": {
+      "version": "1.0.0-rc.83",
+      "description": "Declare ejs at the workspace root so the Terraform gateway's Cedar render script resolves it",
+      "implementation": "./src/migrations/latest/terraform-gateway-cedar-render-root-ejs/migration"
+    },
+    "latest-rdb-terraform-aurora-app-module-defaults": {
+      "version": "1.0.0-rc.84",
+      "description": "Align the vended Terraform Aurora app module variable defaults with the core module, enabling CloudWatch engine log export and exposing enable_key_rotation",
+      "implementation": "./src/migrations/latest/rdb-terraform-aurora-app-module-defaults/migration"
+    },
+    "latest-agentcore-harness-no-tools-by-default": {
+      "version": "1.0.0-rc.84",
+      "description": "Pin the vended AgentCore Harness construct/module to no tools by default, since AgentCore treats an absent allowedTools as every tool",
+      "implementation": "./src/migrations/latest/agentcore-harness-no-tools-by-default/migration"
+    },
+    "latest-terraform-declare-used-providers": {
+      "version": "1.0.0-rc.84",
+      "description": "Declare every provider each vended Terraform module uses in its own required_providers",
+      "implementation": "./src/migrations/latest/terraform-declare-used-providers/migration"
+    },
+    "latest-waf-log-group-cmk-encryption": {
+      "version": "1.0.0-rc.84",
+      "description": "Encrypt vended WAF log groups with a customer-managed KMS key",
+      "implementation": "./src/migrations/latest/waf-log-group-cmk-encryption/migration"
+    },
+    "latest-terraform-harness-vpc-role-and-memory-grant": {
+      "version": "1.0.0-rc.84",
+      "description": "Add VPC, execution role and native field support to the vended Terraform AgentCore Harness module, and scope its managed-memory grant to the service-assigned ARN",
+      "implementation": "./src/migrations/latest/terraform-harness-vpc-role-and-memory-grant/migration"
+    },
     "v1.0.0-rc.50-0001-modernize-function-props-cast": {
       "version": "1.0.0-rc.50",
       "description": "Replace the legacy angle-bracket FunctionProps type assertion with the modern as syntax in generated API constructs",
@@ -173,7 +213,7 @@
       "implementation": "./src/migrations/v1.0.0-rc.75/0001-ts-agent-session-id-middleware-extraction/migration"
     },
     "sync-vended-versions": {
-      "version": "1.0.0-rc.82",
+      "version": "1.0.0-rc.84",
       "description": "Sync vended dependency versions and the tracked plugin version to those vended by this release",
       "implementation": "./src/utils/version-upgrade-migration/migration"
     }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@aws/nx-plugin",
-  "version": "1.0.0-rc.82",
+  "version": "1.0.0-rc.84",
   "repository": {
     "type": "git",
     "url": "https://github.com/awslabs/nx-plugin-for-aws.git",

package/src/agentcore-gateway/__snapshots__/generator.spec.ts.snap

@@ -43,6 +43,8 @@ data "aws_region" "current" {}
 locals {
   aws_account_id = data.aws_caller_identity.current.account_id
   aws_region     = data.aws_region.current.id
+
+  gateway_waf_log_group_name = var.enable_waf ? "aws-waf-logs-my-gateway-\${random_id.unique_suffix.hex}" : null
 }
 
 resource "random_id" "unique_suffix" {
@@ -205,14 +207,61 @@ resource "aws_wafv2_web_acl_association" "gateway_waf" {
   web_acl_arn  = aws_wafv2_web_acl.gateway_waf[0].arn
 }
 
+# KMS key for encrypting WAF request logs at rest
+resource "aws_kms_key" "gateway_waf_logs" {
+  count = var.enable_waf ? 1 : 0
+
+  description             = "MyGateway gateway WAF log encryption"
+  deletion_window_in_days = 7
+  enable_key_rotation     = true
+
+  policy = jsonencode({
+    Version = "2012-10-17"
+    Statement = [
+      {
+        Sid       = "Enable IAM User Permissions"
+        Effect    = "Allow"
+        Principal = { AWS = "arn:aws:iam::\${local.aws_account_id}:root" }
+        Action    = "kms:*"
+        Resource  = "*"
+      },
+      {
+        Sid       = "Allow CloudWatch Logs"
+        Effect    = "Allow"
+        Principal = { Service = "logs.\${local.aws_region}.amazonaws.com" }
+        Action = [
+          "kms:Encrypt",
+          "kms:Decrypt",
+          "kms:ReEncrypt*",
+          "kms:GenerateDataKey*",
+          "kms:DescribeKey"
+        ]
+        Resource = "*"
+        Condition = {
+          ArnEquals = {
+            "kms:EncryptionContext:aws:logs:arn" = "arn:aws:logs:\${local.aws_region}:\${local.aws_account_id}:log-group:\${local.gateway_waf_log_group_name}"
+          }
+        }
+      }
+    ]
+  })
+}
+
+resource "aws_kms_alias" "gateway_waf_logs" {
+  count = var.enable_waf ? 1 : 0
+
+  name          = "alias/my-gateway-\${random_id.unique_suffix.hex}-waf-logs"
+  target_key_id = aws_kms_key.gateway_waf_logs[0].key_id
+}
+
 # WAF request logs. WAFv2 requires the \`aws-waf-logs-\` name prefix.
 resource "aws_cloudwatch_log_group" "gateway_waf_logs" {
-  #checkov:skip=CKV_AWS_158:Using default CloudWatch log encryption
   #checkov:skip=CKV_AWS_338:Log retention set to one year which is sufficient for WAF logs
   count = var.enable_waf ? 1 : 0
 
-  name              = "aws-waf-logs-my-gateway-\${random_id.unique_suffix.hex}"
+  name              = local.gateway_waf_log_group_name
   retention_in_days = 365
+  kms_key_id        = aws_kms_key.gateway_waf_logs[0].arn
 }
 
 resource "aws_wafv2_web_acl_logging_configuration" "gateway_waf_logging" {

package/src/agentcore-gateway/generator.d.ts

@@ -14,12 +14,6 @@ export declare const DEPENDENCIES: import("../utils/declared-dependencies.js").D
 }, {
     readonly name: "@types/express";
     readonly dev: true;
-}, {
-    readonly name: "ejs";
-    readonly dev: true;
-}, {
-    readonly name: "@types/ejs";
-    readonly dev: true;
 }, {
     readonly name: "tsx";
     readonly dev: true;
@@ -39,6 +33,13 @@ export declare const DEPENDENCIES: import("../utils/declared-dependencies.js").D
     readonly when: (m: IacMetadata) => boolean;
 } & {
     versionOnly: true;
+}, {
+    readonly name: "ejs";
+    readonly when: (m: IacMetadata) => boolean;
+    readonly dev: true;
+    readonly root: true;
+} & {
+    versionOnly: true;
 }, {
     readonly name: "constructs";
     readonly when: (m: IacMetadata) => boolean;

package/src/agentcore-gateway/generator.js

@@ -15,9 +15,8 @@ import { addGeneratorMetadata, getGeneratorInfo, projectExists, readProjectConfi
 import { assignPort } from "../utils/port.js";
 import { ensureProjectPackageJson } from "../utils/project-package-json.js";
 import { SHARED_CONSTRUCTS_DEPENDENCIES, sharedConstructsGenerator } from "../utils/shared-constructs.js";
-// The gateway's local-dev server and Cedar policy rendering need these
-// whatever the auth; only the MCP SDK is protocol-specific (the http local
-// gateway is a plain proxy).
+// The gateway's local-dev server needs these whatever the auth; only the MCP
+// SDK is protocol-specific (the http local gateway is a plain proxy).
 export const DEPENDENCIES = declareDependencies()({
     ts: [
         {
@@ -31,15 +30,6 @@ export const DEPENDENCIES = declareDependencies()({
             name: '@types/express',
             dev: true
         },
-        // ejs renders the Cedar policy in the shared gateway construct.
-        {
-            name: 'ejs',
-            dev: true
-        },
-        {
-            name: '@types/ejs',
-            dev: true
-        },
         // local-dev.ts runs via tsx, which is shared tooling.
         {
             name: 'tsx',

package/src/agentcore-gateway/generator.js.map

@@ -1 +1 @@
-{"version":3,"sources":["../../../../../packages/nx-plugin/src/agentcore-gateway/generator.ts"],"sourcesContent":["/**\n * Copyright Amazon.com, Inc. or its affiliates. All Rights Reserved.\n * SPDX-License-Identifier: Apache-2.0\n */\nimport {\n  addProjectConfiguration,\n  type GeneratorCallback,\n  generateFiles,\n  joinPathFragments,\n  logger,\n  OverwriteStrategy,\n  type ProjectConfiguration,\n  type Tree,\n  updateProjectConfiguration,\n} from '@nx/devkit';\nimport { addTsDependencies } from '../utils/add-dependencies.js';\nimport {\n  AGENT_CORE_CONSTRUCTS_DEPENDENCIES,\n  AGENT_CORE_CONSTRUCTS_PY_DEPENDENCIES,\n  addAgentCoreGatewayInfra,\n} from '../utils/agent-core-constructs/agent-core-constructs.js';\nimport {\n  declareDependencies,\n  ownedElsewhere,\n} from '../utils/declared-dependencies.js';\nimport { formatFilesInSubtree } from '../utils/format.js';\nimport { resolveIac } from '../utils/iac.js';\nimport { installDependencies } from '../utils/install.js';\nimport { addGeneratorMetricsIfApplicable } from '../utils/metrics.js';\nimport { kebabCase, toClassName } from '../utils/names.js';\nimport { getNpmScopePrefix } from '../utils/npm-scope.js';\nimport {\n  addGeneratorMetadata,\n  getGeneratorInfo,\n  type NxGeneratorInfo,\n  projectExists,\n  readProjectConfigurationUnqualified,\n} from '../utils/nx.js';\nimport { assignPort } from '../utils/port.js';\nimport { ensureProjectPackageJson } from '../utils/project-package-json.js';\nimport {\n  SHARED_CONSTRUCTS_DEPENDENCIES,\n  sharedConstructsGenerator,\n} from '../utils/shared-constructs.js';\nimport type { IacMetadata } from '../utils/shared-constructs-constants.js';\nimport type { AgentcoreGatewayGeneratorSchema } from './schema';\n\n// The gateway's local-dev server and Cedar policy rendering need these\n// whatever the auth; only the MCP SDK is protocol-specific (the http local\n// gateway is a plain proxy).\nexport const DEPENDENCIES = declareDependencies<AgentCoreGatewayMetadata>()({\n  ts: [\n    { name: '@modelcontextprotocol/sdk', when: (m) => m.protocol === 'mcp' },\n    { name: 'express' },\n    { name: '@types/express', dev: true },\n    // ejs renders the Cedar policy in the shared gateway construct.\n    { name: 'ejs', dev: true },\n    { name: '@types/ejs', dev: true },\n    // local-dev.ts runs via tsx, which is shared tooling.\n    { name: 'tsx', dev: true, root: true },\n    ...ownedElsewhere(AGENT_CORE_CONSTRUCTS_DEPENDENCIES),\n    ...ownedElsewhere(SHARED_CONSTRUCTS_DEPENDENCIES),\n  ],\n  py: ownedElsewhere(AGENT_CORE_CONSTRUCTS_PY_DEPENDENCIES),\n});\n\nexport const AGENTCORE_GATEWAY_GENERATOR_INFO: NxGeneratorInfo =\n  getGeneratorInfo(import.meta.filename);\n\nexport const agentcoreGatewayGenerator = async (\n  tree: Tree,\n  options: AgentcoreGatewayGeneratorSchema,\n): Promise<GeneratorCallback> => {\n  const name = kebabCase(options.name);\n  const nameClassName = toClassName(name);\n  const parentDir = options.directory ?? 'packages';\n  const subDir = options.subDirectory ?? name;\n  const projectRoot = joinPathFragments(parentDir, subDir);\n  const fullyQualifiedName = `${getNpmScopePrefix(tree)}${name}`;\n\n  // Protocol is mcp (aggregate MCP server targets into one MCP endpoint) or\n  // http (proxy agent runtime targets via path-based routing). Persisted in\n  // metadata so connection generators can validate it.\n  const protocol = options.protocol ?? 'mcp';\n  // Inbound auth is iam (default) or cognito. Persisted in metadata so\n  // connection generators can validate it (agent -> gateway connections\n  // require an IAM gateway).\n  const auth = options.auth ?? 'iam';\n  // Cedar policies authorize MCP tool actions, which an http gateway has none\n  // of — its runtime targets are plain proxied endpoints — so the policy\n  // engine only applies to mcp gateways. cedarPolicy defaults to true in the\n  // schema, so an http gateway quietly drops it rather than requiring\n  // --cedarPolicy=false.\n  if (protocol === 'http' && options.cedarPolicy) {\n    logger.warn(\n      'Cedar policies authorize MCP tool actions, so cedarPolicy is ignored for http-protocol gateways.',\n    );\n  }\n  const cedarPolicy = protocol === 'mcp' && (options.cedarPolicy ?? true);\n  const infra = options.infra ?? 'agentcore';\n\n  // local-dev.ts is the local gateway: a continuous MCP aggregator chaining\n  // onto attached MCP servers' dev targets (added by the mcp-connection\n  // generator), so a single `nx dev <gateway>` boots the gateway and every\n  // attached MCP server together.\n  //\n  // `serve` exists for parity with other generators; the deployed Gateway is\n  // a managed AWS resource, so `serve`-mode agents talk to it via runtime\n  // config and the local gateway sits idle.\n  const localGatewayTarget = (port: number) => ({\n    executor: 'nx:run-commands' as const,\n    continuous: true,\n    options: {\n      command: 'tsx local-dev.ts',\n      cwd: '{projectRoot}',\n      env: { PORT: `${port}` },\n    },\n    dependsOn: [] as Array<string | { projects: string[]; target: string }>,\n  });\n  let project: ProjectConfiguration;\n  if (projectExists(tree, fullyQualifiedName)) {\n    project = readProjectConfigurationUnqualified(tree, fullyQualifiedName);\n  } else {\n    addProjectConfiguration(tree, fullyQualifiedName, {\n      name: fullyQualifiedName,\n      root: projectRoot,\n      projectType: 'library',\n      sourceRoot: projectRoot,\n      tags: [],\n      targets: {},\n      metadata: {\n        generator: AGENTCORE_GATEWAY_GENERATOR_INFO.id,\n      } as any,\n    });\n    project = readProjectConfigurationUnqualified(tree, fullyQualifiedName);\n  }\n  // Ensure the project has its own package.json so its runtime dependencies\n  // (added below) are declared in it rather than the workspace root.\n  ensureProjectPackageJson(tree, {\n    dir: projectRoot,\n    fullyQualifiedName,\n  });\n  const port = assignPort(tree, project, 8100);\n  // A gateway is its own standalone project, so it uses plain `serve` / `dev`\n  // targets. Re-run: keep existing targets (their dependsOn may have been\n  // populated by the mcp-connection generator), just ensure both exist.\n  project.targets ??= {};\n  project.targets['serve'] ??= localGatewayTarget(port);\n  project.targets['dev'] ??= localGatewayTarget(port);\n  updateProjectConfiguration(tree, project.name, project);\n\n  // Scaffold the gateway project: local-dev.ts (+ Cedar policies if requested)\n  generateFiles(\n    tree,\n    joinPathFragments(import.meta.dirname, 'files', 'project', protocol),\n    projectRoot,\n    {\n      nameClassName,\n      nameKebabCase: name,\n      port,\n      attachedMcpServers: [],\n      attachedAgents: [],\n    },\n    { overwriteStrategy: OverwriteStrategy.KeepExisting },\n  );\n  if (cedarPolicy) {\n    // The default permit-all policy differs by auth type: AgentCore represents\n    // IAM callers as `AgentCore::IamEntity` and Cognito/JWT callers as\n    // `AgentCore::OAuthUser`, so the two policies match different principals.\n    generateFiles(\n      tree,\n      joinPathFragments(import.meta.dirname, 'files', 'cedar'),\n      projectRoot,\n      { nameClassName, auth },\n      { overwriteStrategy: OverwriteStrategy.KeepExisting },\n    );\n  }\n\n  // Recorded in the metadata below so the version sync can tell a CDK\n  // project from a Terraform one; undefined when no infrastructure was\n  // generated, in which case neither provider's packages were added.\n  const iac =\n    infra !== 'none' ? await resolveIac(tree, options.iac) : undefined;\n\n  // Recorded below and read by the declaration's predicates, so the packages\n  // added here are exactly the ones the version sync will own.\n  const metadata: AgentCoreGatewayMetadata = {\n    name,\n    rc: nameClassName,\n    protocol,\n    auth,\n    port,\n    ...(iac ? { iac } : {}),\n  };\n\n  addGeneratorMetadata(\n    tree,\n    fullyQualifiedName,\n    AGENTCORE_GATEWAY_GENERATOR_INFO,\n    metadata,\n  );\n\n  addTsDependencies(tree, DEPENDENCIES, { metadata, projectRoot });\n\n  // Wire up infra (CDK or Terraform); re-running with infra=agentcore adds\n  // the infrastructure to a previously infra-less gateway.\n\n  if (infra === 'agentcore') {\n    await sharedConstructsGenerator(tree, { iac }, DEPENDENCIES);\n\n    await addAgentCoreGatewayInfra(\n      tree,\n      {\n        gatewayNameClassName: nameClassName,\n        gatewayNameKebabCase: name,\n        projectName: fullyQualifiedName,\n        projectDirectory: projectRoot,\n        cedarPolicy,\n        auth,\n        protocol,\n        iac,\n      },\n      DEPENDENCIES,\n    );\n  }\n\n  await addGeneratorMetricsIfApplicable(tree, [\n    AGENTCORE_GATEWAY_GENERATOR_INFO,\n  ]);\n\n  await formatFilesInSubtree(tree);\n  return () =>\n    installDependencies(tree, options.preferInstallDependencies, {\n      languages: ['typescript'],\n    });\n};\n\n/**\n * Gateway details stored in the gateway project's metadata.\n */\nexport interface AgentCoreGatewayMetadata extends IacMetadata {\n  name: string;\n  rc: string;\n  protocol: string;\n  auth: string;\n  port: number;\n}\n\n/**\n * Read a gateway project's metadata, validating it was generated by the\n * agentcore-gateway generator.\n */\nexport const readAgentCoreGatewayMetadata = (\n  project: ProjectConfiguration,\n): AgentCoreGatewayMetadata => {\n  const metadata = project.metadata as any;\n  if (metadata?.generator !== AGENTCORE_GATEWAY_GENERATOR_INFO.id) {\n    throw new Error(\n      `Project '${project.name}' was not generated by the '${AGENTCORE_GATEWAY_GENERATOR_INFO.id}' generator.`,\n    );\n  }\n  return metadata as AgentCoreGatewayMetadata;\n};\n\nexport default agentcoreGatewayGenerator;\n"],"names":["addProjectConfiguration","generateFiles","joinPathFragments","logger","OverwriteStrategy","updateProjectConfiguration","addTsDependencies","AGENT_CORE_CONSTRUCTS_DEPENDENCIES","AGENT_CORE_CONSTRUCTS_PY_DEPENDENCIES","addAgentCoreGatewayInfra","declareDependencies","ownedElsewhere","formatFilesInSubtree","resolveIac","installDependencies","addGeneratorMetricsIfApplicable","kebabCase","toClassName","getNpmScopePrefix","addGeneratorMetadata","getGeneratorInfo","projectExists","readProjectConfigurationUnqualified","assignPort","ensureProjectPackageJson","SHARED_CONSTRUCTS_DEPENDENCIES","sharedConstructsGenerator","DEPENDENCIES","ts","name","when","m","protocol","dev","root","py","AGENTCORE_GATEWAY_GENERATOR_INFO","filename","agentcoreGatewayGenerator","tree","options","nameClassName","parentDir","directory","subDir","subDirectory","projectRoot","fullyQualifiedName","auth","cedarPolicy","warn","infra","localGatewayTarget","port","executor","continuous","command","cwd","env","PORT","dependsOn","project","projectType","sourceRoot","tags","targets","metadata","generator","id","dir","dirname","nameKebabCase","attachedMcpServers","attachedAgents","overwriteStrategy","KeepExisting","iac","undefined","rc","gatewayNameClassName","gatewayNameKebabCase","projectName","projectDirectory","preferInstallDependencies","languages","readAgentCoreGatewayMetadata","Error"],"mappings":"AAAA;;;CAGC,GACD,SACEA,uBAAuB,EAEvBC,aAAa,EACbC,iBAAiB,EACjBC,MAAM,EACNC,iBAAiB,EAGjBC,0BAA0B,QACrB,aAAa;AACpB,SAASC,iBAAiB,QAAQ,+BAA+B;AACjE,SACEC,kCAAkC,EAClCC,qCAAqC,EACrCC,wBAAwB,QACnB,0DAA0D;AACjE,SACEC,mBAAmB,EACnBC,cAAc,QACT,oCAAoC;AAC3C,SAASC,oBAAoB,QAAQ,qBAAqB;AAC1D,SAASC,UAAU,QAAQ,kBAAkB;AAC7C,SAASC,mBAAmB,QAAQ,sBAAsB;AAC1D,SAASC,+BAA+B,QAAQ,sBAAsB;AACtE,SAASC,SAAS,EAAEC,WAAW,QAAQ,oBAAoB;AAC3D,SAASC,iBAAiB,QAAQ,wBAAwB;AAC1D,SACEC,oBAAoB,EACpBC,gBAAgB,EAEhBC,aAAa,EACbC,mCAAmC,QAC9B,iBAAiB;AACxB,SAASC,UAAU,QAAQ,mBAAmB;AAC9C,SAASC,wBAAwB,QAAQ,mCAAmC;AAC5E,SACEC,8BAA8B,EAC9BC,yBAAyB,QACpB,gCAAgC;AAIvC,uEAAuE;AACvE,2EAA2E;AAC3E,6BAA6B;AAC7B,OAAO,MAAMC,eAAejB,sBAAgD;IAC1EkB,IAAI;QACF;YAAEC,MAAM;YAA6BC,MAAM,CAACC,IAAMA,EAAEC,QAAQ,KAAK;QAAM;QACvE;YAAEH,MAAM;QAAU;QAClB;YAAEA,MAAM;YAAkBI,KAAK;QAAK;QACpC,gEAAgE;QAChE;YAAEJ,MAAM;YAAOI,KAAK;QAAK;QACzB;YAAEJ,MAAM;YAAcI,KAAK;QAAK;QAChC,sDAAsD;QACtD;YAAEJ,MAAM;YAAOI,KAAK;YAAMC,MAAM;QAAK;WAClCvB,eAAeJ;WACfI,eAAec;KACnB;IACDU,IAAIxB,eAAeH;AACrB,GAAG;AAEH,OAAO,MAAM4B,mCACXhB,iBAAiB,YAAYiB,QAAQ,EAAE;AAEzC,OAAO,MAAMC,4BAA4B,OACvCC,MACAC;IAEA,MAAMX,OAAOb,UAAUwB,QAAQX,IAAI;IACnC,MAAMY,gBAAgBxB,YAAYY;IAClC,MAAMa,YAAYF,QAAQG,SAAS,IAAI;IACvC,MAAMC,SAASJ,QAAQK,YAAY,IAAIhB;IACvC,MAAMiB,cAAc5C,kBAAkBwC,WAAWE;IACjD,MAAMG,qBAAqB,GAAG7B,kBAAkBqB,QAAQV,MAAM;IAE9D,0EAA0E;IAC1E,0EAA0E;IAC1E,qDAAqD;IACrD,MAAMG,WAAWQ,QAAQR,QAAQ,IAAI;IACrC,qEAAqE;IACrE,sEAAsE;IACtE,2BAA2B;IAC3B,MAAMgB,OAAOR,QAAQQ,IAAI,IAAI;IAC7B,4EAA4E;IAC5E,uEAAuE;IACvE,2EAA2E;IAC3E,oEAAoE;IACpE,uBAAuB;IACvB,IAAIhB,aAAa,UAAUQ,QAAQS,WAAW,EAAE;QAC9C9C,OAAO+C,IAAI,CACT;IAEJ;IACA,MAAMD,cAAcjB,aAAa,SAAUQ,CAAAA,QAAQS,WAAW,IAAI,IAAG;IACrE,MAAME,QAAQX,QAAQW,KAAK,IAAI;IAE/B,0EAA0E;IAC1E,sEAAsE;IACtE,yEAAyE;IACzE,gCAAgC;IAChC,EAAE;IACF,2EAA2E;IAC3E,wEAAwE;IACxE,0CAA0C;IAC1C,MAAMC,qBAAqB,CAACC,OAAkB,CAAA;YAC5CC,UAAU;YACVC,YAAY;YACZf,SAAS;gBACPgB,SAAS;gBACTC,KAAK;gBACLC,KAAK;oBAAEC,MAAM,GAAGN,MAAM;gBAAC;YACzB;YACAO,WAAW,EAAE;QACf,CAAA;IACA,IAAIC;IACJ,IAAIxC,cAAckB,MAAMQ,qBAAqB;QAC3Cc,UAAUvC,oCAAoCiB,MAAMQ;IACtD,OAAO;QACL/C,wBAAwBuC,MAAMQ,oBAAoB;YAChDlB,MAAMkB;YACNb,MAAMY;YACNgB,aAAa;YACbC,YAAYjB;YACZkB,MAAM,EAAE;YACRC,SAAS,CAAC;YACVC,UAAU;gBACRC,WAAW/B,iCAAiCgC,EAAE;YAChD;QACF;QACAP,UAAUvC,oCAAoCiB,MAAMQ;IACtD;IACA,0EAA0E;IAC1E,mEAAmE;IACnEvB,yBAAyBe,MAAM;QAC7B8B,KAAKvB;QACLC;IACF;IACA,MAAMM,OAAO9B,WAAWgB,MAAMsB,SAAS;IACvC,4EAA4E;IAC5E,wEAAwE;IACxE,sEAAsE;IACtEA,QAAQI,OAAO,KAAK,CAAC;IACrBJ,QAAQI,OAAO,CAAC,QAAQ,KAAKb,mBAAmBC;IAChDQ,QAAQI,OAAO,CAAC,MAAM,KAAKb,mBAAmBC;IAC9ChD,2BAA2BkC,MAAMsB,QAAQhC,IAAI,EAAEgC;IAE/C,6EAA6E;IAC7E5D,cACEsC,MACArC,kBAAkB,YAAYoE,OAAO,EAAE,SAAS,WAAWtC,WAC3Dc,aACA;QACEL;QACA8B,eAAe1C;QACfwB;QACAmB,oBAAoB,EAAE;QACtBC,gBAAgB,EAAE;IACpB,GACA;QAAEC,mBAAmBtE,kBAAkBuE,YAAY;IAAC;IAEtD,IAAI1B,aAAa;QACf,2EAA2E;QAC3E,mEAAmE;QACnE,0EAA0E;QAC1EhD,cACEsC,MACArC,kBAAkB,YAAYoE,OAAO,EAAE,SAAS,UAChDxB,aACA;YAAEL;YAAeO;QAAK,GACtB;YAAE0B,mBAAmBtE,kBAAkBuE,YAAY;QAAC;IAExD;IAEA,oEAAoE;IACpE,qEAAqE;IACrE,mEAAmE;IACnE,MAAMC,MACJzB,UAAU,SAAS,MAAMtC,WAAW0B,MAAMC,QAAQoC,GAAG,IAAIC;IAE3D,2EAA2E;IAC3E,6DAA6D;IAC7D,MAAMX,WAAqC;QACzCrC;QACAiD,IAAIrC;QACJT;QACAgB;QACAK;QACA,GAAIuB,MAAM;YAAEA;QAAI,IAAI,CAAC,CAAC;IACxB;IAEAzD,qBACEoB,MACAQ,oBACAX,kCACA8B;IAGF5D,kBAAkBiC,MAAMZ,cAAc;QAAEuC;QAAUpB;IAAY;IAE9D,yEAAyE;IACzE,yDAAyD;IAEzD,IAAIK,UAAU,aAAa;QACzB,MAAMzB,0BAA0Ba,MAAM;YAAEqC;QAAI,GAAGjD;QAE/C,MAAMlB,yBACJ8B,MACA;YACEwC,sBAAsBtC;YACtBuC,sBAAsBnD;YACtBoD,aAAalC;YACbmC,kBAAkBpC;YAClBG;YACAD;YACAhB;YACA4C;QACF,GACAjD;IAEJ;IAEA,MAAMZ,gCAAgCwB,MAAM;QAC1CH;KACD;IAED,MAAMxB,qBAAqB2B;IAC3B,OAAO,IACLzB,oBAAoByB,MAAMC,QAAQ2C,yBAAyB,EAAE;YAC3DC,WAAW;gBAAC;aAAa;QAC3B;AACJ,EAAE;AAaF;;;CAGC,GACD,OAAO,MAAMC,+BAA+B,CAC1CxB;IAEA,MAAMK,WAAWL,QAAQK,QAAQ;IACjC,IAAIA,UAAUC,cAAc/B,iCAAiCgC,EAAE,EAAE;QAC/D,MAAM,IAAIkB,MACR,CAAC,SAAS,EAAEzB,QAAQhC,IAAI,CAAC,4BAA4B,EAAEO,iCAAiCgC,EAAE,CAAC,YAAY,CAAC;IAE5G;IACA,OAAOF;AACT,EAAE;AAEF,eAAe5B,0BAA0B"}
+{"version":3,"sources":["../../../../../packages/nx-plugin/src/agentcore-gateway/generator.ts"],"sourcesContent":["/**\n * Copyright Amazon.com, Inc. or its affiliates. All Rights Reserved.\n * SPDX-License-Identifier: Apache-2.0\n */\nimport {\n  addProjectConfiguration,\n  type GeneratorCallback,\n  generateFiles,\n  joinPathFragments,\n  logger,\n  OverwriteStrategy,\n  type ProjectConfiguration,\n  type Tree,\n  updateProjectConfiguration,\n} from '@nx/devkit';\nimport { addTsDependencies } from '../utils/add-dependencies.js';\nimport {\n  AGENT_CORE_CONSTRUCTS_DEPENDENCIES,\n  AGENT_CORE_CONSTRUCTS_PY_DEPENDENCIES,\n  addAgentCoreGatewayInfra,\n} from '../utils/agent-core-constructs/agent-core-constructs.js';\nimport {\n  declareDependencies,\n  ownedElsewhere,\n} from '../utils/declared-dependencies.js';\nimport { formatFilesInSubtree } from '../utils/format.js';\nimport { resolveIac } from '../utils/iac.js';\nimport { installDependencies } from '../utils/install.js';\nimport { addGeneratorMetricsIfApplicable } from '../utils/metrics.js';\nimport { kebabCase, toClassName } from '../utils/names.js';\nimport { getNpmScopePrefix } from '../utils/npm-scope.js';\nimport {\n  addGeneratorMetadata,\n  getGeneratorInfo,\n  type NxGeneratorInfo,\n  projectExists,\n  readProjectConfigurationUnqualified,\n} from '../utils/nx.js';\nimport { assignPort } from '../utils/port.js';\nimport { ensureProjectPackageJson } from '../utils/project-package-json.js';\nimport {\n  SHARED_CONSTRUCTS_DEPENDENCIES,\n  sharedConstructsGenerator,\n} from '../utils/shared-constructs.js';\nimport type { IacMetadata } from '../utils/shared-constructs-constants.js';\nimport type { AgentcoreGatewayGeneratorSchema } from './schema';\n\n// The gateway's local-dev server needs these whatever the auth; only the MCP\n// SDK is protocol-specific (the http local gateway is a plain proxy).\nexport const DEPENDENCIES = declareDependencies<AgentCoreGatewayMetadata>()({\n  ts: [\n    { name: '@modelcontextprotocol/sdk', when: (m) => m.protocol === 'mcp' },\n    { name: 'express' },\n    { name: '@types/express', dev: true },\n    // local-dev.ts runs via tsx, which is shared tooling.\n    { name: 'tsx', dev: true, root: true },\n    ...ownedElsewhere(AGENT_CORE_CONSTRUCTS_DEPENDENCIES),\n    ...ownedElsewhere(SHARED_CONSTRUCTS_DEPENDENCIES),\n  ],\n  py: ownedElsewhere(AGENT_CORE_CONSTRUCTS_PY_DEPENDENCIES),\n});\n\nexport const AGENTCORE_GATEWAY_GENERATOR_INFO: NxGeneratorInfo =\n  getGeneratorInfo(import.meta.filename);\n\nexport const agentcoreGatewayGenerator = async (\n  tree: Tree,\n  options: AgentcoreGatewayGeneratorSchema,\n): Promise<GeneratorCallback> => {\n  const name = kebabCase(options.name);\n  const nameClassName = toClassName(name);\n  const parentDir = options.directory ?? 'packages';\n  const subDir = options.subDirectory ?? name;\n  const projectRoot = joinPathFragments(parentDir, subDir);\n  const fullyQualifiedName = `${getNpmScopePrefix(tree)}${name}`;\n\n  // Protocol is mcp (aggregate MCP server targets into one MCP endpoint) or\n  // http (proxy agent runtime targets via path-based routing). Persisted in\n  // metadata so connection generators can validate it.\n  const protocol = options.protocol ?? 'mcp';\n  // Inbound auth is iam (default) or cognito. Persisted in metadata so\n  // connection generators can validate it (agent -> gateway connections\n  // require an IAM gateway).\n  const auth = options.auth ?? 'iam';\n  // Cedar policies authorize MCP tool actions, which an http gateway has none\n  // of — its runtime targets are plain proxied endpoints — so the policy\n  // engine only applies to mcp gateways. cedarPolicy defaults to true in the\n  // schema, so an http gateway quietly drops it rather than requiring\n  // --cedarPolicy=false.\n  if (protocol === 'http' && options.cedarPolicy) {\n    logger.warn(\n      'Cedar policies authorize MCP tool actions, so cedarPolicy is ignored for http-protocol gateways.',\n    );\n  }\n  const cedarPolicy = protocol === 'mcp' && (options.cedarPolicy ?? true);\n  const infra = options.infra ?? 'agentcore';\n\n  // local-dev.ts is the local gateway: a continuous MCP aggregator chaining\n  // onto attached MCP servers' dev targets (added by the mcp-connection\n  // generator), so a single `nx dev <gateway>` boots the gateway and every\n  // attached MCP server together.\n  //\n  // `serve` exists for parity with other generators; the deployed Gateway is\n  // a managed AWS resource, so `serve`-mode agents talk to it via runtime\n  // config and the local gateway sits idle.\n  const localGatewayTarget = (port: number) => ({\n    executor: 'nx:run-commands' as const,\n    continuous: true,\n    options: {\n      command: 'tsx local-dev.ts',\n      cwd: '{projectRoot}',\n      env: { PORT: `${port}` },\n    },\n    dependsOn: [] as Array<string | { projects: string[]; target: string }>,\n  });\n  let project: ProjectConfiguration;\n  if (projectExists(tree, fullyQualifiedName)) {\n    project = readProjectConfigurationUnqualified(tree, fullyQualifiedName);\n  } else {\n    addProjectConfiguration(tree, fullyQualifiedName, {\n      name: fullyQualifiedName,\n      root: projectRoot,\n      projectType: 'library',\n      sourceRoot: projectRoot,\n      tags: [],\n      targets: {},\n      metadata: {\n        generator: AGENTCORE_GATEWAY_GENERATOR_INFO.id,\n      } as any,\n    });\n    project = readProjectConfigurationUnqualified(tree, fullyQualifiedName);\n  }\n  // Ensure the project has its own package.json so its runtime dependencies\n  // (added below) are declared in it rather than the workspace root.\n  ensureProjectPackageJson(tree, {\n    dir: projectRoot,\n    fullyQualifiedName,\n  });\n  const port = assignPort(tree, project, 8100);\n  // A gateway is its own standalone project, so it uses plain `serve` / `dev`\n  // targets. Re-run: keep existing targets (their dependsOn may have been\n  // populated by the mcp-connection generator), just ensure both exist.\n  project.targets ??= {};\n  project.targets['serve'] ??= localGatewayTarget(port);\n  project.targets['dev'] ??= localGatewayTarget(port);\n  updateProjectConfiguration(tree, project.name, project);\n\n  // Scaffold the gateway project: local-dev.ts (+ Cedar policies if requested)\n  generateFiles(\n    tree,\n    joinPathFragments(import.meta.dirname, 'files', 'project', protocol),\n    projectRoot,\n    {\n      nameClassName,\n      nameKebabCase: name,\n      port,\n      attachedMcpServers: [],\n      attachedAgents: [],\n    },\n    { overwriteStrategy: OverwriteStrategy.KeepExisting },\n  );\n  if (cedarPolicy) {\n    // The default permit-all policy differs by auth type: AgentCore represents\n    // IAM callers as `AgentCore::IamEntity` and Cognito/JWT callers as\n    // `AgentCore::OAuthUser`, so the two policies match different principals.\n    generateFiles(\n      tree,\n      joinPathFragments(import.meta.dirname, 'files', 'cedar'),\n      projectRoot,\n      { nameClassName, auth },\n      { overwriteStrategy: OverwriteStrategy.KeepExisting },\n    );\n  }\n\n  // Recorded in the metadata below so the version sync can tell a CDK\n  // project from a Terraform one; undefined when no infrastructure was\n  // generated, in which case neither provider's packages were added.\n  const iac =\n    infra !== 'none' ? await resolveIac(tree, options.iac) : undefined;\n\n  // Recorded below and read by the declaration's predicates, so the packages\n  // added here are exactly the ones the version sync will own.\n  const metadata: AgentCoreGatewayMetadata = {\n    name,\n    rc: nameClassName,\n    protocol,\n    auth,\n    port,\n    ...(iac ? { iac } : {}),\n  };\n\n  addGeneratorMetadata(\n    tree,\n    fullyQualifiedName,\n    AGENTCORE_GATEWAY_GENERATOR_INFO,\n    metadata,\n  );\n\n  addTsDependencies(tree, DEPENDENCIES, { metadata, projectRoot });\n\n  // Wire up infra (CDK or Terraform); re-running with infra=agentcore adds\n  // the infrastructure to a previously infra-less gateway.\n\n  if (infra === 'agentcore') {\n    await sharedConstructsGenerator(tree, { iac }, DEPENDENCIES);\n\n    await addAgentCoreGatewayInfra(\n      tree,\n      {\n        gatewayNameClassName: nameClassName,\n        gatewayNameKebabCase: name,\n        projectName: fullyQualifiedName,\n        projectDirectory: projectRoot,\n        cedarPolicy,\n        auth,\n        protocol,\n        iac,\n      },\n      DEPENDENCIES,\n    );\n  }\n\n  await addGeneratorMetricsIfApplicable(tree, [\n    AGENTCORE_GATEWAY_GENERATOR_INFO,\n  ]);\n\n  await formatFilesInSubtree(tree);\n  return () =>\n    installDependencies(tree, options.preferInstallDependencies, {\n      languages: ['typescript'],\n    });\n};\n\n/**\n * Gateway details stored in the gateway project's metadata.\n */\nexport interface AgentCoreGatewayMetadata extends IacMetadata {\n  name: string;\n  rc: string;\n  protocol: string;\n  auth: string;\n  port: number;\n}\n\n/**\n * Read a gateway project's metadata, validating it was generated by the\n * agentcore-gateway generator.\n */\nexport const readAgentCoreGatewayMetadata = (\n  project: ProjectConfiguration,\n): AgentCoreGatewayMetadata => {\n  const metadata = project.metadata as any;\n  if (metadata?.generator !== AGENTCORE_GATEWAY_GENERATOR_INFO.id) {\n    throw new Error(\n      `Project '${project.name}' was not generated by the '${AGENTCORE_GATEWAY_GENERATOR_INFO.id}' generator.`,\n    );\n  }\n  return metadata as AgentCoreGatewayMetadata;\n};\n\nexport default agentcoreGatewayGenerator;\n"],"names":["addProjectConfiguration","generateFiles","joinPathFragments","logger","OverwriteStrategy","updateProjectConfiguration","addTsDependencies","AGENT_CORE_CONSTRUCTS_DEPENDENCIES","AGENT_CORE_CONSTRUCTS_PY_DEPENDENCIES","addAgentCoreGatewayInfra","declareDependencies","ownedElsewhere","formatFilesInSubtree","resolveIac","installDependencies","addGeneratorMetricsIfApplicable","kebabCase","toClassName","getNpmScopePrefix","addGeneratorMetadata","getGeneratorInfo","projectExists","readProjectConfigurationUnqualified","assignPort","ensureProjectPackageJson","SHARED_CONSTRUCTS_DEPENDENCIES","sharedConstructsGenerator","DEPENDENCIES","ts","name","when","m","protocol","dev","root","py","AGENTCORE_GATEWAY_GENERATOR_INFO","filename","agentcoreGatewayGenerator","tree","options","nameClassName","parentDir","directory","subDir","subDirectory","projectRoot","fullyQualifiedName","auth","cedarPolicy","warn","infra","localGatewayTarget","port","executor","continuous","command","cwd","env","PORT","dependsOn","project","projectType","sourceRoot","tags","targets","metadata","generator","id","dir","dirname","nameKebabCase","attachedMcpServers","attachedAgents","overwriteStrategy","KeepExisting","iac","undefined","rc","gatewayNameClassName","gatewayNameKebabCase","projectName","projectDirectory","preferInstallDependencies","languages","readAgentCoreGatewayMetadata","Error"],"mappings":"AAAA;;;CAGC,GACD,SACEA,uBAAuB,EAEvBC,aAAa,EACbC,iBAAiB,EACjBC,MAAM,EACNC,iBAAiB,EAGjBC,0BAA0B,QACrB,aAAa;AACpB,SAASC,iBAAiB,QAAQ,+BAA+B;AACjE,SACEC,kCAAkC,EAClCC,qCAAqC,EACrCC,wBAAwB,QACnB,0DAA0D;AACjE,SACEC,mBAAmB,EACnBC,cAAc,QACT,oCAAoC;AAC3C,SAASC,oBAAoB,QAAQ,qBAAqB;AAC1D,SAASC,UAAU,QAAQ,kBAAkB;AAC7C,SAASC,mBAAmB,QAAQ,sBAAsB;AAC1D,SAASC,+BAA+B,QAAQ,sBAAsB;AACtE,SAASC,SAAS,EAAEC,WAAW,QAAQ,oBAAoB;AAC3D,SAASC,iBAAiB,QAAQ,wBAAwB;AAC1D,SACEC,oBAAoB,EACpBC,gBAAgB,EAEhBC,aAAa,EACbC,mCAAmC,QAC9B,iBAAiB;AACxB,SAASC,UAAU,QAAQ,mBAAmB;AAC9C,SAASC,wBAAwB,QAAQ,mCAAmC;AAC5E,SACEC,8BAA8B,EAC9BC,yBAAyB,QACpB,gCAAgC;AAIvC,6EAA6E;AAC7E,sEAAsE;AACtE,OAAO,MAAMC,eAAejB,sBAAgD;IAC1EkB,IAAI;QACF;YAAEC,MAAM;YAA6BC,MAAM,CAACC,IAAMA,EAAEC,QAAQ,KAAK;QAAM;QACvE;YAAEH,MAAM;QAAU;QAClB;YAAEA,MAAM;YAAkBI,KAAK;QAAK;QACpC,sDAAsD;QACtD;YAAEJ,MAAM;YAAOI,KAAK;YAAMC,MAAM;QAAK;WAClCvB,eAAeJ;WACfI,eAAec;KACnB;IACDU,IAAIxB,eAAeH;AACrB,GAAG;AAEH,OAAO,MAAM4B,mCACXhB,iBAAiB,YAAYiB,QAAQ,EAAE;AAEzC,OAAO,MAAMC,4BAA4B,OACvCC,MACAC;IAEA,MAAMX,OAAOb,UAAUwB,QAAQX,IAAI;IACnC,MAAMY,gBAAgBxB,YAAYY;IAClC,MAAMa,YAAYF,QAAQG,SAAS,IAAI;IACvC,MAAMC,SAASJ,QAAQK,YAAY,IAAIhB;IACvC,MAAMiB,cAAc5C,kBAAkBwC,WAAWE;IACjD,MAAMG,qBAAqB,GAAG7B,kBAAkBqB,QAAQV,MAAM;IAE9D,0EAA0E;IAC1E,0EAA0E;IAC1E,qDAAqD;IACrD,MAAMG,WAAWQ,QAAQR,QAAQ,IAAI;IACrC,qEAAqE;IACrE,sEAAsE;IACtE,2BAA2B;IAC3B,MAAMgB,OAAOR,QAAQQ,IAAI,IAAI;IAC7B,4EAA4E;IAC5E,uEAAuE;IACvE,2EAA2E;IAC3E,oEAAoE;IACpE,uBAAuB;IACvB,IAAIhB,aAAa,UAAUQ,QAAQS,WAAW,EAAE;QAC9C9C,OAAO+C,IAAI,CACT;IAEJ;IACA,MAAMD,cAAcjB,aAAa,SAAUQ,CAAAA,QAAQS,WAAW,IAAI,IAAG;IACrE,MAAME,QAAQX,QAAQW,KAAK,IAAI;IAE/B,0EAA0E;IAC1E,sEAAsE;IACtE,yEAAyE;IACzE,gCAAgC;IAChC,EAAE;IACF,2EAA2E;IAC3E,wEAAwE;IACxE,0CAA0C;IAC1C,MAAMC,qBAAqB,CAACC,OAAkB,CAAA;YAC5CC,UAAU;YACVC,YAAY;YACZf,SAAS;gBACPgB,SAAS;gBACTC,KAAK;gBACLC,KAAK;oBAAEC,MAAM,GAAGN,MAAM;gBAAC;YACzB;YACAO,WAAW,EAAE;QACf,CAAA;IACA,IAAIC;IACJ,IAAIxC,cAAckB,MAAMQ,qBAAqB;QAC3Cc,UAAUvC,oCAAoCiB,MAAMQ;IACtD,OAAO;QACL/C,wBAAwBuC,MAAMQ,oBAAoB;YAChDlB,MAAMkB;YACNb,MAAMY;YACNgB,aAAa;YACbC,YAAYjB;YACZkB,MAAM,EAAE;YACRC,SAAS,CAAC;YACVC,UAAU;gBACRC,WAAW/B,iCAAiCgC,EAAE;YAChD;QACF;QACAP,UAAUvC,oCAAoCiB,MAAMQ;IACtD;IACA,0EAA0E;IAC1E,mEAAmE;IACnEvB,yBAAyBe,MAAM;QAC7B8B,KAAKvB;QACLC;IACF;IACA,MAAMM,OAAO9B,WAAWgB,MAAMsB,SAAS;IACvC,4EAA4E;IAC5E,wEAAwE;IACxE,sEAAsE;IACtEA,QAAQI,OAAO,KAAK,CAAC;IACrBJ,QAAQI,OAAO,CAAC,QAAQ,KAAKb,mBAAmBC;IAChDQ,QAAQI,OAAO,CAAC,MAAM,KAAKb,mBAAmBC;IAC9ChD,2BAA2BkC,MAAMsB,QAAQhC,IAAI,EAAEgC;IAE/C,6EAA6E;IAC7E5D,cACEsC,MACArC,kBAAkB,YAAYoE,OAAO,EAAE,SAAS,WAAWtC,WAC3Dc,aACA;QACEL;QACA8B,eAAe1C;QACfwB;QACAmB,oBAAoB,EAAE;QACtBC,gBAAgB,EAAE;IACpB,GACA;QAAEC,mBAAmBtE,kBAAkBuE,YAAY;IAAC;IAEtD,IAAI1B,aAAa;QACf,2EAA2E;QAC3E,mEAAmE;QACnE,0EAA0E;QAC1EhD,cACEsC,MACArC,kBAAkB,YAAYoE,OAAO,EAAE,SAAS,UAChDxB,aACA;YAAEL;YAAeO;QAAK,GACtB;YAAE0B,mBAAmBtE,kBAAkBuE,YAAY;QAAC;IAExD;IAEA,oEAAoE;IACpE,qEAAqE;IACrE,mEAAmE;IACnE,MAAMC,MACJzB,UAAU,SAAS,MAAMtC,WAAW0B,MAAMC,QAAQoC,GAAG,IAAIC;IAE3D,2EAA2E;IAC3E,6DAA6D;IAC7D,MAAMX,WAAqC;QACzCrC;QACAiD,IAAIrC;QACJT;QACAgB;QACAK;QACA,GAAIuB,MAAM;YAAEA;QAAI,IAAI,CAAC,CAAC;IACxB;IAEAzD,qBACEoB,MACAQ,oBACAX,kCACA8B;IAGF5D,kBAAkBiC,MAAMZ,cAAc;QAAEuC;QAAUpB;IAAY;IAE9D,yEAAyE;IACzE,yDAAyD;IAEzD,IAAIK,UAAU,aAAa;QACzB,MAAMzB,0BAA0Ba,MAAM;YAAEqC;QAAI,GAAGjD;QAE/C,MAAMlB,yBACJ8B,MACA;YACEwC,sBAAsBtC;YACtBuC,sBAAsBnD;YACtBoD,aAAalC;YACbmC,kBAAkBpC;YAClBG;YACAD;YACAhB;YACA4C;QACF,GACAjD;IAEJ;IAEA,MAAMZ,gCAAgCwB,MAAM;QAC1CH;KACD;IAED,MAAMxB,qBAAqB2B;IAC3B,OAAO,IACLzB,oBAAoByB,MAAMC,QAAQ2C,yBAAyB,EAAE;YAC3DC,WAAW;gBAAC;aAAa;QAC3B;AACJ,EAAE;AAaF;;;CAGC,GACD,OAAO,MAAMC,+BAA+B,CAC1CxB;IAEA,MAAMK,WAAWL,QAAQK,QAAQ;IACjC,IAAIA,UAAUC,cAAc/B,iCAAiCgC,EAAE,EAAE;QAC/D,MAAM,IAAIkB,MACR,CAAC,SAAS,EAAEzB,QAAQhC,IAAI,CAAC,4BAA4B,EAAEO,iCAAiCgC,EAAE,CAAC,YAAY,CAAC;IAE5G;IACA,OAAOF;AACT,EAAE;AAEF,eAAe5B,0BAA0B"}

package/src/agentcore-harness/__snapshots__/generator.spec.ts.snap

@@ -62,14 +62,13 @@ construct's \`grantInvokeAccess\` grants exactly those two actions.
 ## Customizing your Harness
 
 Edit \`src/PROMPT.md\` for the system prompt. Everything else is configured
-where you instantiate the infrastructure — including tools, which the
-Harness deploys without:
+where you instantiate the infrastructure — including tools, which default
+to none:
 
 - CDK construct props, for example
   \`new MyHarness(this, 'MyHarness', { allowedTools: ['@builtin'] })\`
-- Terraform, by setting \`allowed_tools = ["@builtin"]\` on the module's
-  \`aws_bedrockagentcore_harness\` resource, or by adding an \`allowed_tools\`
-  variable if you would rather set it as a module argument
+- Terraform, by setting the module's \`allowed_tools\` variable, for example
+  \`allowed_tools = ["@builtin"]\`
 
 The generated infrastructure is also yours to edit directly:
 

package/src/agentcore-harness/files/project/README.md.template

@@ -59,14 +59,13 @@ construct's `grantInvokeAccess` grants exactly those two actions.
 ## Customizing your Harness
 
 Edit `src/PROMPT.md` for the system prompt. Everything else is configured
-where you instantiate the infrastructure — including tools, which the
-Harness deploys without:
+where you instantiate the infrastructure — including tools, which default
+to none:
 
 - CDK construct props, for example
   `new <%- nameClassName %>(this, '<%- nameClassName %>', { allowedTools: ['@builtin'] })`
-- Terraform, by setting `allowed_tools = ["@builtin"]` on the module's
-  `aws_bedrockagentcore_harness` resource, or by adding an `allowed_tools`
-  variable if you would rather set it as a module argument
+- Terraform, by setting the module's `allowed_tools` variable, for example
+  `allowed_tools = ["@builtin"]`
 
 The generated infrastructure is also yours to edit directly:
 

package/src/migrations/latest/agentcore-harness-no-tools-by-default/__snapshots__/migration.spec.ts.snap

@@ -0,0 +1,79 @@
+// Vitest Snapshot v1, https://vitest.dev/guide/snapshot.html
+
+exports[`agentcore-harness-no-tools-by-default migration > cdk > defaults allowedTools to none and passes it explicitly 1`] = `
+"import * as agentcore from 'aws-cdk-lib/aws-bedrockagentcore';
+import { Construct } from 'constructs';
+
+export class MyHarness extends Construct {
+  public readonly harness: agentcore.CfnHarness;
+
+  constructor(scope: Construct, id: string, props?: MyHarnessProps) {
+    super(scope, id);
+
+    const stack = Stack.of(this);
+    const {
+      // The service treats an absent allowedTools as every tool, so this
+      // defaults to none and is always passed explicitly.
+      allowedTools = [],
+      executionRole,
+      modelResourceArns = [
+        \`arn:\${stack.partition}:bedrock:*::foundation-model/*\`,
+      ],
+      vpc,
+      vpcSubnets,
+      securityGroups,
+      ...harnessProps
+    } = props ?? {};
+
+    this.harness = new agentcore.CfnHarness(this, 'Harness', {
+      model: {
+        bedrockModelConfig: {
+          modelId: 'global.anthropic.claude-sonnet-4-6',
+        },
+      },
+      systemPrompt: [{ text: systemPrompt }],
+      ...harnessProps,
+      allowedTools,
+      // Set after harnessProps so the deployed name always matches the
+      // execution role's workload-identity resource pattern.
+      harnessName,
+      executionRoleArn: this.executionRole.roleArn,
+      environment,
+    });
+  }
+}
+"
+`;
+
+exports[`agentcore-harness-no-tools-by-default migration > terraform > declares allowed_tools defaulting to none and assigns it 1`] = `
+"variable "model_id" {
+  description = "Amazon Bedrock model or inference profile used by default."
+  type        = string
+  default     = "global.anthropic.claude-sonnet-4-6"
+}
+
+variable "allowed_tools" {
+  description = "Tools the Harness may use. Defaults to none; set [\\"@builtin\\"] for every built-in tool, or name individual tools. Always sent explicitly, since the service treats an absent value as every tool."
+  type        = list(string)
+  default     = []
+}
+
+variable "model_resource_arns" {
+  description = "Bedrock model and inference-profile ARNs the execution role may invoke."
+  type        = set(string)
+  default     = null
+}
+
+resource "aws_bedrockagentcore_harness" "this" {
+  harness_name       = local.harness_name
+  execution_role_arn = aws_iam_role.execution_role.arn
+  allowed_tools      = var.allowed_tools
+
+  model {
+    bedrock_model_config {
+      model_id = var.model_id
+    }
+  }
+}
+"
+`;

package/src/migrations/latest/agentcore-harness-no-tools-by-default/metadata.json

@@ -0,0 +1,3 @@
+{
+  "description": "Pin the vended AgentCore Harness construct/module to no tools by default, since AgentCore treats an absent allowedTools as every tool"
+}

package/src/migrations/latest/agentcore-harness-no-tools-by-default/migration.d.ts

@@ -0,0 +1,6 @@
+/**
+ * Copyright Amazon.com, Inc. or its affiliates. All Rights Reserved.
+ * SPDX-License-Identifier: Apache-2.0
+ */
+import { type MigrationReturnObject, type Tree } from '@nx/devkit';
+export default function migration(tree: Tree): Promise<MigrationReturnObject>;

package/src/migrations/latest/agentcore-harness-no-tools-by-default/migration.js

@@ -0,0 +1,87 @@
+/**
+ * Copyright Amazon.com, Inc. or its affiliates. All Rights Reserved.
+ * SPDX-License-Identifier: Apache-2.0
+ */ import { joinPathFragments } from "@nx/devkit";
+import { applyGritQL, GRIT_INSERT_PLACEHOLDER, insertViaGritQL, matchGritQL } from "../../../utils/ast.js";
+import { formatFilesInSubtree } from "../../../utils/format.js";
+import { PACKAGES_DIR, SHARED_CONSTRUCTS_DIR, SHARED_TERRAFORM_DIR } from "../../../utils/shared-constructs-constants.js";
+/**
+ * Pin each vended Harness to no tools by default.
+ *
+ * AgentCore treats an absent `allowedTools` as every tool, so a Harness that
+ * never set it deployed with `allowedTools: ["*"]` — shell execution and file
+ * read/write included. Both providers now send the field explicitly, defaulting
+ * to none.
+ *
+ * These files are generated with `KeepExisting`, so an upgraded workspace keeps
+ * the implicit every-tool default until this runs. Diverged files are left
+ * untouched and reported via `nextSteps`.
+ */ const CDK_HARNESSES_DIR = `${PACKAGES_DIR}/${SHARED_CONSTRUCTS_DIR}/src/app/harnesses`;
+const TERRAFORM_HARNESSES_DIR = `${PACKAGES_DIR}/${SHARED_TERRAFORM_DIR}/src/app/harnesses`;
+const hcl = (pattern)=>`language hcl\n${pattern}`;
+const ALLOWED_TOOLS_VARIABLE = [
+    'variable "allowed_tools" {',
+    '  description = "Tools the Harness may use. Defaults to none; set [\\"@builtin\\"] for every built-in tool, or name individual tools. Always sent explicitly, since the service treats an absent value as every tool."',
+    '  type        = list(string)',
+    '  default     = []',
+    '}'
+].join('\n');
+const divergedMessage = (filePath, remedy)=>`${filePath}: has diverged from the generated shape - left untouched. AgentCore treats an absent allowedTools as every tool, so this Harness deploys with all built-in tools (including shell and file access). ${remedy}`;
+/**
+ * Default the construct's `allowedTools` to none and pass it to the resource
+ * after the props spread, so an undefined caller value cannot reinstate the
+ * service's every-tool default.
+ */ const migrateCdkConstruct = async (tree, filePath)=>{
+    const destructured = await insertViaGritQL(tree, filePath, `\`const { $fields } = props ?? {};\` => \`const {\n      ${GRIT_INSERT_PLACEHOLDER}\n      $fields\n    } = props ?? {};\``, [
+        '// The service treats an absent allowedTools as every tool, so this',
+        '// defaults to none and is always passed explicitly.',
+        'allowedTools = [],'
+    ].join('\n      '));
+    if (!destructured) return false;
+    return await applyGritQL(tree, filePath, '`new agentcore.CfnHarness($scope, $id, { $props })` where {' + ' $props <: contains spread_element() as $spread,' + ' $spread => `$spread,\n      allowedTools`' + ' }');
+};
+/**
+ * Declare `allowed_tools` and assign it to the Harness resource, so the module
+ * always sends the field.
+ */ const migrateTerraformModule = async (tree, filePath)=>{
+    const declared = await insertViaGritQL(tree, filePath, hcl(`\`variable "model_resource_arns" { $props }\` => \`${GRIT_INSERT_PLACEHOLDER}\n\nvariable "model_resource_arns" {\n  $props\n}\``), ALLOWED_TOOLS_VARIABLE);
+    if (!declared) return false;
+    // Appended after the existing arguments so their alignment is preserved;
+    // `terraform fmt` re-aligns the block.
+    return await applyGritQL(tree, filePath, hcl('`execution_role_arn = aws_iam_role.execution_role.arn` => `execution_role_arn = aws_iam_role.execution_role.arn\n  allowed_tools      = var.allowed_tools`'));
+};
+export default async function migration(tree) {
+    const nextSteps = [];
+    for (const dirName of tree.exists(CDK_HARNESSES_DIR) ? tree.children(CDK_HARNESSES_DIR) : []){
+        const filePath = joinPathFragments(CDK_HARNESSES_DIR, dirName, `${dirName}.ts`);
+        if (!tree.exists(filePath)) {
+            continue; // Not a Harness construct directory.
+        }
+        // Already pinned, by this migration or by hand.
+        if (tree.read(filePath, 'utf-8')?.includes('allowedTools = [],')) {
+            continue;
+        }
+        if (!await migrateCdkConstruct(tree, filePath)) {
+            nextSteps.push(divergedMessage(filePath, 'Default `allowedTools` to `[]` when destructuring props, and pass `allowedTools` to the CfnHarness after the `...harnessProps` spread.'));
+        }
+    }
+    for (const dirName of tree.exists(TERRAFORM_HARNESSES_DIR) ? tree.children(TERRAFORM_HARNESSES_DIR) : []){
+        const filePath = joinPathFragments(TERRAFORM_HARNESSES_DIR, dirName, `${dirName}.tf`);
+        if (!tree.exists(filePath)) {
+            continue; // Not a Harness module directory.
+        }
+        // Already assigned, by this migration or by hand.
+        if (await matchGritQL(tree, filePath, hcl('`allowed_tools = $_`'))) {
+            continue;
+        }
+        if (!await migrateTerraformModule(tree, filePath)) {
+            nextSteps.push(divergedMessage(filePath, 'Declare an `allowed_tools` variable (list(string), default []) and assign `allowed_tools = var.allowed_tools` on the `aws_bedrockagentcore_harness` resource.'));
+        }
+    }
+    await formatFilesInSubtree(tree);
+    return {
+        nextSteps
+    };
+}
+
+//# sourceMappingURL=migration.js.map

package/src/migrations/latest/agentcore-harness-no-tools-by-default/migration.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../../../../../../../packages/nx-plugin/src/migrations/latest/agentcore-harness-no-tools-by-default/migration.ts"],"sourcesContent":["/**\n * Copyright Amazon.com, Inc. or its affiliates. All Rights Reserved.\n * SPDX-License-Identifier: Apache-2.0\n */\nimport {\n  joinPathFragments,\n  type MigrationReturnObject,\n  type Tree,\n} from '@nx/devkit';\nimport {\n  applyGritQL,\n  GRIT_INSERT_PLACEHOLDER,\n  insertViaGritQL,\n  matchGritQL,\n} from '../../../utils/ast.js';\nimport { formatFilesInSubtree } from '../../../utils/format.js';\nimport {\n  PACKAGES_DIR,\n  SHARED_CONSTRUCTS_DIR,\n  SHARED_TERRAFORM_DIR,\n} from '../../../utils/shared-constructs-constants.js';\n\n/**\n * Pin each vended Harness to no tools by default.\n *\n * AgentCore treats an absent `allowedTools` as every tool, so a Harness that\n * never set it deployed with `allowedTools: [\"*\"]` — shell execution and file\n * read/write included. Both providers now send the field explicitly, defaulting\n * to none.\n *\n * These files are generated with `KeepExisting`, so an upgraded workspace keeps\n * the implicit every-tool default until this runs. Diverged files are left\n * untouched and reported via `nextSteps`.\n */\n\nconst CDK_HARNESSES_DIR = `${PACKAGES_DIR}/${SHARED_CONSTRUCTS_DIR}/src/app/harnesses`;\nconst TERRAFORM_HARNESSES_DIR = `${PACKAGES_DIR}/${SHARED_TERRAFORM_DIR}/src/app/harnesses`;\n\nconst hcl = (pattern: string) => `language hcl\\n${pattern}`;\n\nconst ALLOWED_TOOLS_VARIABLE = [\n  'variable \"allowed_tools\" {',\n  '  description = \"Tools the Harness may use. Defaults to none; set [\\\\\"@builtin\\\\\"] for every built-in tool, or name individual tools. Always sent explicitly, since the service treats an absent value as every tool.\"',\n  '  type        = list(string)',\n  '  default     = []',\n  '}',\n].join('\\n');\n\nconst divergedMessage = (filePath: string, remedy: string) =>\n  `${filePath}: has diverged from the generated shape - left untouched. AgentCore treats an absent allowedTools as every tool, so this Harness deploys with all built-in tools (including shell and file access). ${remedy}`;\n\n/**\n * Default the construct's `allowedTools` to none and pass it to the resource\n * after the props spread, so an undefined caller value cannot reinstate the\n * service's every-tool default.\n */\nconst migrateCdkConstruct = async (\n  tree: Tree,\n  filePath: string,\n): Promise<boolean> => {\n  const destructured = await insertViaGritQL(\n    tree,\n    filePath,\n    `\\`const { $fields } = props ?? {};\\` => \\`const {\\n      ${GRIT_INSERT_PLACEHOLDER}\\n      $fields\\n    } = props ?? {};\\``,\n    [\n      '// The service treats an absent allowedTools as every tool, so this',\n      '// defaults to none and is always passed explicitly.',\n      'allowedTools = [],',\n    ].join('\\n      '),\n  );\n  if (!destructured) return false;\n\n  return await applyGritQL(\n    tree,\n    filePath,\n    '`new agentcore.CfnHarness($scope, $id, { $props })` where {' +\n      ' $props <: contains spread_element() as $spread,' +\n      ' $spread => `$spread,\\n      allowedTools`' +\n      ' }',\n  );\n};\n\n/**\n * Declare `allowed_tools` and assign it to the Harness resource, so the module\n * always sends the field.\n */\nconst migrateTerraformModule = async (\n  tree: Tree,\n  filePath: string,\n): Promise<boolean> => {\n  const declared = await insertViaGritQL(\n    tree,\n    filePath,\n    hcl(\n      `\\`variable \"model_resource_arns\" { $props }\\` => \\`${GRIT_INSERT_PLACEHOLDER}\\n\\nvariable \"model_resource_arns\" {\\n  $props\\n}\\``,\n    ),\n    ALLOWED_TOOLS_VARIABLE,\n  );\n  if (!declared) return false;\n\n  // Appended after the existing arguments so their alignment is preserved;\n  // `terraform fmt` re-aligns the block.\n  return await applyGritQL(\n    tree,\n    filePath,\n    hcl(\n      '`execution_role_arn = aws_iam_role.execution_role.arn` => `execution_role_arn = aws_iam_role.execution_role.arn\\n  allowed_tools      = var.allowed_tools`',\n    ),\n  );\n};\n\nexport default async function migration(\n  tree: Tree,\n): Promise<MigrationReturnObject> {\n  const nextSteps: string[] = [];\n\n  for (const dirName of tree.exists(CDK_HARNESSES_DIR)\n    ? tree.children(CDK_HARNESSES_DIR)\n    : []) {\n    const filePath = joinPathFragments(\n      CDK_HARNESSES_DIR,\n      dirName,\n      `${dirName}.ts`,\n    );\n    if (!tree.exists(filePath)) {\n      continue; // Not a Harness construct directory.\n    }\n\n    // Already pinned, by this migration or by hand.\n    if (tree.read(filePath, 'utf-8')?.includes('allowedTools = [],')) {\n      continue;\n    }\n\n    if (!(await migrateCdkConstruct(tree, filePath))) {\n      nextSteps.push(\n        divergedMessage(\n          filePath,\n          'Default `allowedTools` to `[]` when destructuring props, and pass `allowedTools` to the CfnHarness after the `...harnessProps` spread.',\n        ),\n      );\n    }\n  }\n\n  for (const dirName of tree.exists(TERRAFORM_HARNESSES_DIR)\n    ? tree.children(TERRAFORM_HARNESSES_DIR)\n    : []) {\n    const filePath = joinPathFragments(\n      TERRAFORM_HARNESSES_DIR,\n      dirName,\n      `${dirName}.tf`,\n    );\n    if (!tree.exists(filePath)) {\n      continue; // Not a Harness module directory.\n    }\n\n    // Already assigned, by this migration or by hand.\n    if (await matchGritQL(tree, filePath, hcl('`allowed_tools = $_`'))) {\n      continue;\n    }\n\n    if (!(await migrateTerraformModule(tree, filePath))) {\n      nextSteps.push(\n        divergedMessage(\n          filePath,\n          'Declare an `allowed_tools` variable (list(string), default []) and assign `allowed_tools = var.allowed_tools` on the `aws_bedrockagentcore_harness` resource.',\n        ),\n      );\n    }\n  }\n\n  await formatFilesInSubtree(tree);\n\n  return { nextSteps };\n}\n"],"names":["joinPathFragments","applyGritQL","GRIT_INSERT_PLACEHOLDER","insertViaGritQL","matchGritQL","formatFilesInSubtree","PACKAGES_DIR","SHARED_CONSTRUCTS_DIR","SHARED_TERRAFORM_DIR","CDK_HARNESSES_DIR","TERRAFORM_HARNESSES_DIR","hcl","pattern","ALLOWED_TOOLS_VARIABLE","join","divergedMessage","filePath","remedy","migrateCdkConstruct","tree","destructured","migrateTerraformModule","declared","migration","nextSteps","dirName","exists","children","read","includes","push"],"mappings":"AAAA;;;CAGC,GACD,SACEA,iBAAiB,QAGZ,aAAa;AACpB,SACEC,WAAW,EACXC,uBAAuB,EACvBC,eAAe,EACfC,WAAW,QACN,wBAAwB;AAC/B,SAASC,oBAAoB,QAAQ,2BAA2B;AAChE,SACEC,YAAY,EACZC,qBAAqB,EACrBC,oBAAoB,QACf,gDAAgD;AAEvD;;;;;;;;;;;CAWC,GAED,MAAMC,oBAAoB,GAAGH,aAAa,CAAC,EAAEC,sBAAsB,kBAAkB,CAAC;AACtF,MAAMG,0BAA0B,GAAGJ,aAAa,CAAC,EAAEE,qBAAqB,kBAAkB,CAAC;AAE3F,MAAMG,MAAM,CAACC,UAAoB,CAAC,cAAc,EAAEA,SAAS;AAE3D,MAAMC,yBAAyB;IAC7B;IACA;IACA;IACA;IACA;CACD,CAACC,IAAI,CAAC;AAEP,MAAMC,kBAAkB,CAACC,UAAkBC,SACzC,GAAGD,SAAS,oMAAoM,EAAEC,QAAQ;AAE5N;;;;CAIC,GACD,MAAMC,sBAAsB,OAC1BC,MACAH;IAEA,MAAMI,eAAe,MAAMjB,gBACzBgB,MACAH,UACA,CAAC,yDAAyD,EAAEd,wBAAwB,uCAAuC,CAAC,EAC5H;QACE;QACA;QACA;KACD,CAACY,IAAI,CAAC;IAET,IAAI,CAACM,cAAc,OAAO;IAE1B,OAAO,MAAMnB,YACXkB,MACAH,UACA,gEACE,qDACA,+CACA;AAEN;AAEA;;;CAGC,GACD,MAAMK,yBAAyB,OAC7BF,MACAH;IAEA,MAAMM,WAAW,MAAMnB,gBACrBgB,MACAH,UACAL,IACE,CAAC,mDAAmD,EAAET,wBAAwB,mDAAmD,CAAC,GAEpIW;IAEF,IAAI,CAACS,UAAU,OAAO;IAEtB,yEAAyE;IACzE,uCAAuC;IACvC,OAAO,MAAMrB,YACXkB,MACAH,UACAL,IACE;AAGN;AAEA,eAAe,eAAeY,UAC5BJ,IAAU;IAEV,MAAMK,YAAsB,EAAE;IAE9B,KAAK,MAAMC,WAAWN,KAAKO,MAAM,CAACjB,qBAC9BU,KAAKQ,QAAQ,CAAClB,qBACd,EAAE,CAAE;QACN,MAAMO,WAAWhB,kBACfS,mBACAgB,SACA,GAAGA,QAAQ,GAAG,CAAC;QAEjB,IAAI,CAACN,KAAKO,MAAM,CAACV,WAAW;YAC1B,UAAU,qCAAqC;QACjD;QAEA,gDAAgD;QAChD,IAAIG,KAAKS,IAAI,CAACZ,UAAU,UAAUa,SAAS,uBAAuB;YAChE;QACF;QAEA,IAAI,CAAE,MAAMX,oBAAoBC,MAAMH,WAAY;YAChDQ,UAAUM,IAAI,CACZf,gBACEC,UACA;QAGN;IACF;IAEA,KAAK,MAAMS,WAAWN,KAAKO,MAAM,CAAChB,2BAC9BS,KAAKQ,QAAQ,CAACjB,2BACd,EAAE,CAAE;QACN,MAAMM,WAAWhB,kBACfU,yBACAe,SACA,GAAGA,QAAQ,GAAG,CAAC;QAEjB,IAAI,CAACN,KAAKO,MAAM,CAACV,WAAW;YAC1B,UAAU,kCAAkC;QAC9C;QAEA,kDAAkD;QAClD,IAAI,MAAMZ,YAAYe,MAAMH,UAAUL,IAAI,0BAA0B;YAClE;QACF;QAEA,IAAI,CAAE,MAAMU,uBAAuBF,MAAMH,WAAY;YACnDQ,UAAUM,IAAI,CACZf,gBACEC,UACA;QAGN;IACF;IAEA,MAAMX,qBAAqBc;IAE3B,OAAO;QAAEK;IAAU;AACrB"}

package/src/migrations/latest/dynamodb-terraform-app-module-outputs/metadata.json

@@ -0,0 +1,3 @@
+{
+  "description": "Re-export the DynamoDB table and KMS key attributes from the vended Terraform per-table app module"
+}

package/src/migrations/latest/dynamodb-terraform-app-module-outputs/migration.d.ts

@@ -0,0 +1,6 @@
+/**
+ * Copyright Amazon.com, Inc. or its affiliates. All Rights Reserved.
+ * SPDX-License-Identifier: Apache-2.0
+ */
+import { type MigrationReturnObject, type Tree } from '@nx/devkit';
+export default function migration(tree: Tree): Promise<MigrationReturnObject>;

package/src/migrations/latest/dynamodb-terraform-app-module-outputs/migration.js

@@ -0,0 +1,69 @@
+/**
+ * Copyright Amazon.com, Inc. or its affiliates. All Rights Reserved.
+ * SPDX-License-Identifier: Apache-2.0
+ */ import { joinPathFragments } from "@nx/devkit";
+import { GRIT_INSERT_PLACEHOLDER, insertViaGritQL, matchGritQL } from "../../../utils/ast.js";
+import { formatFilesInSubtree } from "../../../utils/format.js";
+import { PACKAGES_DIR, SHARED_TERRAFORM_DIR } from "../../../utils/shared-constructs-constants.js";
+/**
+ * Re-export the core dynamodb module's `table_name`, `table_arn` and
+ * `kms_key_arn` from each vended per-table Terraform app module
+ * (`app/dynamodb/<name>/<name>.tf`).
+ *
+ * The app module is what a root configuration instantiates, so without these
+ * outputs a root module cannot reference the table or its encryption key at
+ * all — for example to grant a consumer access to it.
+ *
+ * These files are generated with `KeepExisting`, so an upgraded workspace keeps
+ * a module with no outputs until this runs. Diverged files are left untouched
+ * and reported via `nextSteps`.
+ */ const TERRAFORM_DYNAMODB_APP_DIR = `${PACKAGES_DIR}/${SHARED_TERRAFORM_DIR}/src/app/dynamodb`;
+const divergedMessage = (filePath)=>`${filePath}: has diverged from the generated shape - left untouched. To reference the table from your root Terraform configuration, add table_name, table_arn and kms_key_arn outputs here forwarding the equivalent module.dynamodb_table attributes (see the ts#dynamodb generator's dynamodb app template).`;
+const hcl = (pattern)=>`language hcl\n${pattern}`;
+const OUTPUTS_TEXT = [
+    'output "table_name" {',
+    '  description = "Name of the DynamoDB table"',
+    '  value       = module.dynamodb_table.table_name',
+    '}',
+    '',
+    'output "table_arn" {',
+    '  description = "ARN of the DynamoDB table, for use in IAM policies granting access to the table. Suffix with /index/* to cover its global secondary indexes."',
+    '  value       = module.dynamodb_table.table_arn',
+    '}',
+    '',
+    'output "kms_key_arn" {',
+    '  description = "ARN of the KMS key used to encrypt the DynamoDB table, for use in IAM policies granting access to the table. Null when using the AWS owned key (encryption = DEFAULT)."',
+    '  value       = module.dynamodb_table.kms_key_arn',
+    '}'
+].join('\n');
+export default async function migration(tree) {
+    const nextSteps = [];
+    if (!tree.exists(TERRAFORM_DYNAMODB_APP_DIR)) {
+        return {
+            nextSteps
+        }; // This workspace has no Terraform dynamodb modules.
+    }
+    for (const dirName of tree.children(TERRAFORM_DYNAMODB_APP_DIR)){
+        const filePath = joinPathFragments(TERRAFORM_DYNAMODB_APP_DIR, dirName, `${dirName}.tf`);
+        if (!tree.exists(filePath)) {
+            continue; // Not a dynamodb app module directory.
+        }
+        if (await matchGritQL(tree, filePath, hcl('`output "table_arn" { $_ }`'))) {
+            continue; // Already migrated.
+        }
+        const RUNTIME_CONFIG_MODULE_BLOCK = hcl('`module "add_to_runtime_config" { $_ }`');
+        if (!await matchGritQL(tree, filePath, RUNTIME_CONFIG_MODULE_BLOCK)) {
+            nextSteps.push(divergedMessage(filePath));
+            continue;
+        }
+        // Appended after the runtime config module call, which the template ends
+        // with, matching where the generator now writes the outputs.
+        await insertViaGritQL(tree, filePath, hcl(`\`module "add_to_runtime_config" { $body }\` => \`module "add_to_runtime_config" {\n  $body\n}\n\n${GRIT_INSERT_PLACEHOLDER}\``), OUTPUTS_TEXT);
+    }
+    await formatFilesInSubtree(tree);
+    return {
+        nextSteps
+    };
+}
+
+//# sourceMappingURL=migration.js.map

package/src/migrations/latest/dynamodb-terraform-app-module-outputs/migration.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../../../../../../../packages/nx-plugin/src/migrations/latest/dynamodb-terraform-app-module-outputs/migration.ts"],"sourcesContent":["/**\n * Copyright Amazon.com, Inc. or its affiliates. All Rights Reserved.\n * SPDX-License-Identifier: Apache-2.0\n */\nimport {\n  joinPathFragments,\n  type MigrationReturnObject,\n  type Tree,\n} from '@nx/devkit';\nimport {\n  GRIT_INSERT_PLACEHOLDER,\n  insertViaGritQL,\n  matchGritQL,\n} from '../../../utils/ast.js';\nimport { formatFilesInSubtree } from '../../../utils/format.js';\nimport {\n  PACKAGES_DIR,\n  SHARED_TERRAFORM_DIR,\n} from '../../../utils/shared-constructs-constants.js';\n\n/**\n * Re-export the core dynamodb module's `table_name`, `table_arn` and\n * `kms_key_arn` from each vended per-table Terraform app module\n * (`app/dynamodb/<name>/<name>.tf`).\n *\n * The app module is what a root configuration instantiates, so without these\n * outputs a root module cannot reference the table or its encryption key at\n * all — for example to grant a consumer access to it.\n *\n * These files are generated with `KeepExisting`, so an upgraded workspace keeps\n * a module with no outputs until this runs. Diverged files are left untouched\n * and reported via `nextSteps`.\n */\n\nconst TERRAFORM_DYNAMODB_APP_DIR = `${PACKAGES_DIR}/${SHARED_TERRAFORM_DIR}/src/app/dynamodb`;\n\nconst divergedMessage = (filePath: string) =>\n  `${filePath}: has diverged from the generated shape - left untouched. To reference the table from your root Terraform configuration, add table_name, table_arn and kms_key_arn outputs here forwarding the equivalent module.dynamodb_table attributes (see the ts#dynamodb generator's dynamodb app template).`;\n\nconst hcl = (pattern: string) => `language hcl\\n${pattern}`;\n\nconst OUTPUTS_TEXT = [\n  'output \"table_name\" {',\n  '  description = \"Name of the DynamoDB table\"',\n  '  value       = module.dynamodb_table.table_name',\n  '}',\n  '',\n  'output \"table_arn\" {',\n  '  description = \"ARN of the DynamoDB table, for use in IAM policies granting access to the table. Suffix with /index/* to cover its global secondary indexes.\"',\n  '  value       = module.dynamodb_table.table_arn',\n  '}',\n  '',\n  'output \"kms_key_arn\" {',\n  '  description = \"ARN of the KMS key used to encrypt the DynamoDB table, for use in IAM policies granting access to the table. Null when using the AWS owned key (encryption = DEFAULT).\"',\n  '  value       = module.dynamodb_table.kms_key_arn',\n  '}',\n].join('\\n');\n\nexport default async function migration(\n  tree: Tree,\n): Promise<MigrationReturnObject> {\n  const nextSteps: string[] = [];\n\n  if (!tree.exists(TERRAFORM_DYNAMODB_APP_DIR)) {\n    return { nextSteps }; // This workspace has no Terraform dynamodb modules.\n  }\n\n  for (const dirName of tree.children(TERRAFORM_DYNAMODB_APP_DIR)) {\n    const filePath = joinPathFragments(\n      TERRAFORM_DYNAMODB_APP_DIR,\n      dirName,\n      `${dirName}.tf`,\n    );\n    if (!tree.exists(filePath)) {\n      continue; // Not a dynamodb app module directory.\n    }\n\n    if (await matchGritQL(tree, filePath, hcl('`output \"table_arn\" { $_ }`'))) {\n      continue; // Already migrated.\n    }\n\n    const RUNTIME_CONFIG_MODULE_BLOCK = hcl(\n      '`module \"add_to_runtime_config\" { $_ }`',\n    );\n    if (!(await matchGritQL(tree, filePath, RUNTIME_CONFIG_MODULE_BLOCK))) {\n      nextSteps.push(divergedMessage(filePath));\n      continue;\n    }\n\n    // Appended after the runtime config module call, which the template ends\n    // with, matching where the generator now writes the outputs.\n    await insertViaGritQL(\n      tree,\n      filePath,\n      hcl(\n        `\\`module \"add_to_runtime_config\" { $body }\\` => \\`module \"add_to_runtime_config\" {\\n  $body\\n}\\n\\n${GRIT_INSERT_PLACEHOLDER}\\``,\n      ),\n      OUTPUTS_TEXT,\n    );\n  }\n\n  await formatFilesInSubtree(tree);\n\n  return { nextSteps };\n}\n"],"names":["joinPathFragments","GRIT_INSERT_PLACEHOLDER","insertViaGritQL","matchGritQL","formatFilesInSubtree","PACKAGES_DIR","SHARED_TERRAFORM_DIR","TERRAFORM_DYNAMODB_APP_DIR","divergedMessage","filePath","hcl","pattern","OUTPUTS_TEXT","join","migration","tree","nextSteps","exists","dirName","children","RUNTIME_CONFIG_MODULE_BLOCK","push"],"mappings":"AAAA;;;CAGC,GACD,SACEA,iBAAiB,QAGZ,aAAa;AACpB,SACEC,uBAAuB,EACvBC,eAAe,EACfC,WAAW,QACN,wBAAwB;AAC/B,SAASC,oBAAoB,QAAQ,2BAA2B;AAChE,SACEC,YAAY,EACZC,oBAAoB,QACf,gDAAgD;AAEvD;;;;;;;;;;;;CAYC,GAED,MAAMC,6BAA6B,GAAGF,aAAa,CAAC,EAAEC,qBAAqB,iBAAiB,CAAC;AAE7F,MAAME,kBAAkB,CAACC,WACvB,GAAGA,SAAS,mSAAmS,CAAC;AAElT,MAAMC,MAAM,CAACC,UAAoB,CAAC,cAAc,EAAEA,SAAS;AAE3D,MAAMC,eAAe;IACnB;IACA;IACA;IACA;IACA;IACA;IACA;IACA;IACA;IACA;IACA;IACA;IACA;IACA;CACD,CAACC,IAAI,CAAC;AAEP,eAAe,eAAeC,UAC5BC,IAAU;IAEV,MAAMC,YAAsB,EAAE;IAE9B,IAAI,CAACD,KAAKE,MAAM,CAACV,6BAA6B;QAC5C,OAAO;YAAES;QAAU,GAAG,oDAAoD;IAC5E;IAEA,KAAK,MAAME,WAAWH,KAAKI,QAAQ,CAACZ,4BAA6B;QAC/D,MAAME,WAAWT,kBACfO,4BACAW,SACA,GAAGA,QAAQ,GAAG,CAAC;QAEjB,IAAI,CAACH,KAAKE,MAAM,CAACR,WAAW;YAC1B,UAAU,uCAAuC;QACnD;QAEA,IAAI,MAAMN,YAAYY,MAAMN,UAAUC,IAAI,iCAAiC;YACzE,UAAU,oBAAoB;QAChC;QAEA,MAAMU,8BAA8BV,IAClC;QAEF,IAAI,CAAE,MAAMP,YAAYY,MAAMN,UAAUW,8BAA+B;YACrEJ,UAAUK,IAAI,CAACb,gBAAgBC;YAC/B;QACF;QAEA,yEAAyE;QACzE,6DAA6D;QAC7D,MAAMP,gBACJa,MACAN,UACAC,IACE,CAAC,kGAAkG,EAAET,wBAAwB,EAAE,CAAC,GAElIW;IAEJ;IAEA,MAAMR,qBAAqBW;IAE3B,OAAO;QAAEC;IAAU;AACrB"}