@aws/nx-plugin 1.0.0-rc.91 → 1.0.0-rc.93

package/src/utils/agent-core-constructs/files/terraform/core/agent-core-code/runtime.tf.template

@@ -0,0 +1,204 @@
+terraform {
+  required_version = ">= 1.0"
+
+  required_providers {
+    aws = {
+      source  = "hashicorp/aws"
+      version = "<%- awsProviderVersion %>"
+    }
+    archive = {
+      source  = "hashicorp/archive"
+      version = "<%- archiveProviderVersion %>"
+    }
+  }
+}
+
+# Code packaging for an AgentCore Runtime: archives the built package, stages it
+# in the shared asset bucket, and delegates the runtime itself to the generic
+# `agent-core` module. Swap this module for `agent-core-container` to deploy a
+# container image instead — the inputs below are the only difference.
+
+variable "agent_runtime_name" {
+  description = "Name of the agent runtime"
+  type        = string
+}
+
+variable "code_dir" {
+  description = "Directory holding the packaged agent code, archived and staged in the asset bucket"
+  type        = string
+}
+
+variable "code_runtime" {
+  description = "Managed language runtime executing the packaged code (e.g. NODE_22, PYTHON_3_14)"
+  type        = string
+}
+
+variable "code_entry_point" {
+  description = "Entry point file within the packaged code, run by the managed runtime"
+  type        = string
+}
+
+variable "asset_bucket_name" {
+  description = "Name of the shared asset S3 bucket used to stage the agent code zip. Instantiate the `core/asset-bucket` module once per deployment and pass its `bucket_name` output here."
+  type        = string
+}
+
+variable "asset_bucket_arn" {
+  description = "ARN of the shared asset S3 bucket, used to scope the runtime's read grant to the staged object."
+  type        = string
+}
+
+variable "server_protocol" {
+  description = "Server protocol for the agent runtime (HTTP, MCP, or A2A)"
+  type        = string
+  default     = "HTTP"
+}
+
+variable "authorizer_configuration" {
+  description = "Authorization configuration for authenticating incoming requests"
+  type = object({
+    custom_jwt_authorizer = optional(object({
+      discovery_url    = string
+      allowed_audience = optional(list(string))
+      allowed_clients  = optional(list(string))
+    }))
+  })
+  default = null
+}
+
+variable "env" {
+  description = "Environment variables to pass to the agent core runtime"
+  type        = map(string)
+  default     = {}
+}
+
+variable "additional_iam_policy_statements" {
+  description = "Additional IAM policy statements to attach to the agent core runtime role"
+  type = list(object({
+    Effect   = string
+    Action   = list(string)
+    Resource = list(string)
+  }))
+  default = []
+}
+
+variable "enable_vpc" {
+  description = "Run the agent core runtime inside a VPC. Set alongside vpc_id/subnet_ids."
+  type        = bool
+  default     = false
+}
+
+variable "vpc_id" {
+  description = "VPC ID to run the agent core runtime in. Required when enable_vpc is true."
+  type        = string
+  default     = null
+}
+
+variable "subnet_ids" {
+  description = "Subnet IDs to run the agent core runtime in. Required when enable_vpc is true."
+  type        = list(string)
+  default     = null
+}
+
+variable "tags" {
+  description = "Tags to apply to resources"
+  type        = map(string)
+  default     = {}
+}
+
+data "archive_file" "agent_core_code" {
+  type        = "zip"
+  source_dir  = var.code_dir
+  output_path = "${var.code_dir}.zip"
+}
+
+# Keyed on the hex digest rather than `output_base64sha256`, whose `/` and `=`
+# characters would read as a key prefix and leave the object unresolvable.
+resource "aws_s3_object" "agent_core_code" {
+  bucket      = var.asset_bucket_name
+  key         = "agent-core/${var.agent_runtime_name}/${data.archive_file.agent_core_code.output_sha256}.zip"
+  source      = data.archive_file.agent_core_code.output_path
+  source_hash = data.archive_file.agent_core_code.output_base64sha256
+  etag        = data.archive_file.agent_core_code.output_md5
+
+  tags = var.tags
+}
+
+module "runtime" {
+  source = "../agent-core"
+
+  agent_runtime_name       = var.agent_runtime_name
+  server_protocol          = var.server_protocol
+  authorizer_configuration = var.authorizer_configuration
+  env                      = var.env
+  enable_vpc               = var.enable_vpc
+  vpc_id                   = var.vpc_id
+  subnet_ids               = var.subnet_ids
+  tags                     = var.tags
+
+  code_configuration = {
+    # The `opentelemetry-instrument` prefix auto-instruments with the AWS Distro
+    # for OpenTelemetry packaged alongside the code.
+    # https://docs.aws.amazon.com/bedrock-agentcore/latest/devguide/observability-configure.html
+    entry_point = ["opentelemetry-instrument", var.code_entry_point]
+    runtime     = var.code_runtime
+    s3_bucket   = aws_s3_object.agent_core_code.bucket
+    s3_key      = aws_s3_object.agent_core_code.key
+  }
+
+  # The runtime downloads the package, so grant it read access to the object.
+  additional_iam_policy_statements = concat([
+    {
+      Effect = "Allow"
+      Action = [
+        "s3:GetObject",
+        "s3:GetObjectVersion"
+      ]
+      Resource = [
+        "${var.asset_bucket_arn}/agent-core/${var.agent_runtime_name}/*"
+      ]
+    }
+  ], var.additional_iam_policy_statements)
+
+  artifact_dependencies = [aws_s3_object.agent_core_code]
+}
+
+output "agent_core_runtime_role_arn" {
+  description = "ARN of the Agent Core Runtime IAM role"
+  value       = module.runtime.agent_core_runtime_role_arn
+}
+
+output "agent_core_runtime_role_name" {
+  description = "Name of the Agent Core Runtime IAM role"
+  value       = module.runtime.agent_core_runtime_role_name
+}
+
+output "agent_runtime_name" {
+  description = "Name of the deployed agent runtime"
+  value       = module.runtime.agent_runtime_name
+}
+
+output "agent_core_runtime_arn" {
+  description = "ARN of the Bedrock Agent Core runtime. For MCP runtimes the value flows through the readiness probe, so consumers wait until the runtime serves MCP."
+  value       = module.runtime.agent_core_runtime_arn
+}
+
+output "invocation_url" {
+  description = "HTTPS invocation URL of the runtime. MCP runtimes get the MCP endpoint (e.g. for use as a Gateway target endpoint), A2A runtimes the A2A endpoint (trailing slash required). For MCP runtimes the value flows through the readiness probe, so consumers wait until the runtime serves MCP."
+  value       = module.runtime.invocation_url
+}
+
+output "agent_runtime_id" {
+  description = "ID of the Bedrock Agent Core runtime"
+  value       = module.runtime.agent_runtime_id
+}
+
+output "agent_runtime_version" {
+  description = "Version of the Bedrock Agent Core runtime"
+  value       = module.runtime.agent_runtime_version
+}
+
+output "security_group_id" {
+  description = "Security group ID of the agent core runtime, for use in ingress rules on resources it must reach (e.g. a database). Null unless enable_vpc is true."
+  value       = module.runtime.security_group_id
+}

package/src/utils/agent-core-constructs/files/terraform/core/agent-core-container/runtime.tf.template

@@ -0,0 +1,235 @@
+terraform {
+  required_version = ">= 1.0"
+
+  required_providers {
+    aws = {
+      source  = "hashicorp/aws"
+      version = "<%- awsProviderVersion %>"
+    }
+    external = {
+      source  = "hashicorp/external"
+      version = "<%- externalProviderVersion %>"
+    }
+    null = {
+      source  = "hashicorp/null"
+      version = "<%- nullProviderVersion %>"
+    }
+  }
+}
+
+# Container packaging for an AgentCore Runtime: publishes the built image to the
+# shared asset registry, and delegates the runtime itself to the generic
+# `agent-core` module. Swap this module for `agent-core-code` to deploy a code
+# package instead — the inputs below are the only difference.
+
+variable "agent_runtime_name" {
+  description = "Name of the agent runtime"
+  type        = string
+}
+
+variable "docker_image_tag" {
+  description = "Name of the docker image tag to use as the agent core runtime"
+  type        = string
+}
+
+variable "asset_ecr_repository_url" {
+  description = "URL of the shared asset ECR repository the runtime's image is published to. Instantiate the `core/asset-ecr` module once per deployment and pass its `repository_url` output here."
+  type        = string
+}
+
+variable "asset_ecr_repository_arn" {
+  description = "ARN of the shared asset ECR repository (from `core/asset-ecr.repository_arn`), used to scope the runtime's image pull grant to it."
+  type        = string
+}
+
+variable "server_protocol" {
+  description = "Server protocol for the agent runtime (HTTP, MCP, or A2A)"
+  type        = string
+  default     = "HTTP"
+}
+
+variable "authorizer_configuration" {
+  description = "Authorization configuration for authenticating incoming requests"
+  type = object({
+    custom_jwt_authorizer = optional(object({
+      discovery_url    = string
+      allowed_audience = optional(list(string))
+      allowed_clients  = optional(list(string))
+    }))
+  })
+  default = null
+}
+
+variable "env" {
+  description = "Environment variables to pass to the agent core runtime"
+  type        = map(string)
+  default     = {}
+}
+
+variable "additional_iam_policy_statements" {
+  description = "Additional IAM policy statements to attach to the agent core runtime role"
+  type = list(object({
+    Effect   = string
+    Action   = list(string)
+    Resource = list(string)
+  }))
+  default = []
+}
+
+variable "enable_vpc" {
+  description = "Run the agent core runtime inside a VPC. Set alongside vpc_id/subnet_ids."
+  type        = bool
+  default     = false
+}
+
+variable "vpc_id" {
+  description = "VPC ID to run the agent core runtime in. Required when enable_vpc is true."
+  type        = string
+  default     = null
+}
+
+variable "subnet_ids" {
+  description = "Subnet IDs to run the agent core runtime in. Required when enable_vpc is true."
+  type        = list(string)
+  default     = null
+}
+
+variable "tags" {
+  description = "Tags to apply to resources"
+  type        = map(string)
+  default     = {}
+}
+
+data "aws_region" "current" {}
+
+locals {
+  aws_region = data.aws_region.current.id
+}
+
+# Data source to get container image digest
+data "external" "docker_digest" {
+  program = ["sh", "-c", "echo '{\"digest\":\"'$(<%= containers %> inspect ${var.docker_image_tag} --format '{{.Id}}')'\"}' "]
+}
+
+locals {
+  # Content-based, immutable image tag derived from the local image digest
+  image_tag = "agent-core-${lower(var.agent_runtime_name)}-${replace(data.external.docker_digest.result.digest, "sha256:", "")}"
+}
+
+# Null resource for container image publish
+resource "null_resource" "docker_publish" {
+  triggers = {
+    docker_digest    = data.external.docker_digest.result.digest
+    repository_url   = var.asset_ecr_repository_url
+    docker_image_tag = var.docker_image_tag
+    image_tag        = local.image_tag
+  }
+
+  provisioner "local-exec" {
+    command = <<-EOT
+      # Get ECR login token
+      aws ecr get-login-password --region "$AWS_REGION" | <%= containers %> login --username AWS --password-stdin "$REPOSITORY_URL"
+
+      # Tag the image with the immutable content-based tag
+      <%= containers %> tag "$DOCKER_IMAGE_TAG" "$REPOSITORY_URL:$IMAGE_TAG"
+
+      # Push the image
+      <%= containers %> push "$REPOSITORY_URL:$IMAGE_TAG"
+    EOT
+    environment = {
+      AWS_REGION       = local.aws_region
+      REPOSITORY_URL   = self.triggers.repository_url
+      DOCKER_IMAGE_TAG = self.triggers.docker_image_tag
+      IMAGE_TAG        = self.triggers.image_tag
+    }
+  }
+}
+
+module "runtime" {
+  source = "../agent-core"
+
+  agent_runtime_name       = var.agent_runtime_name
+  server_protocol          = var.server_protocol
+  authorizer_configuration = var.authorizer_configuration
+  env                      = var.env
+  enable_vpc               = var.enable_vpc
+  vpc_id                   = var.vpc_id
+  subnet_ids               = var.subnet_ids
+  tags                     = var.tags
+
+  container_configuration = {
+    container_uri = "${var.asset_ecr_repository_url}:${local.image_tag}"
+  }
+
+  # The runtime pulls the image, so grant it read access to the repository.
+  additional_iam_policy_statements = concat([
+    {
+      Sid    = "ECRImageAccess"
+      Effect = "Allow"
+      Action = [
+        "ecr:BatchGetImage",
+        "ecr:GetDownloadUrlForLayer"
+      ]
+      Resource = [
+        var.asset_ecr_repository_arn
+      ]
+    },
+    {
+      Sid    = "ECRTokenAccess"
+      Effect = "Allow"
+      Action = [
+        "ecr:GetAuthorizationToken"
+      ]
+      Resource = [
+        "*"
+      ]
+    }
+  ], var.additional_iam_policy_statements)
+
+  artifact_dependencies = [null_resource.docker_publish]
+}
+
+output "agent_core_runtime_role_arn" {
+  description = "ARN of the Agent Core Runtime IAM role"
+  value       = module.runtime.agent_core_runtime_role_arn
+}
+
+output "agent_core_runtime_role_name" {
+  description = "Name of the Agent Core Runtime IAM role"
+  value       = module.runtime.agent_core_runtime_role_name
+}
+
+output "agent_runtime_name" {
+  description = "Name of the deployed agent runtime"
+  value       = module.runtime.agent_runtime_name
+}
+
+output "agent_core_runtime_arn" {
+  description = "ARN of the Bedrock Agent Core runtime. For MCP runtimes the value flows through the readiness probe, so consumers wait until the runtime serves MCP."
+  value       = module.runtime.agent_core_runtime_arn
+}
+
+output "invocation_url" {
+  description = "HTTPS invocation URL of the runtime. MCP runtimes get the MCP endpoint (e.g. for use as a Gateway target endpoint), A2A runtimes the A2A endpoint (trailing slash required). For MCP runtimes the value flows through the readiness probe, so consumers wait until the runtime serves MCP."
+  value       = module.runtime.invocation_url
+}
+
+output "agent_runtime_id" {
+  description = "ID of the Bedrock Agent Core runtime"
+  value       = module.runtime.agent_runtime_id
+}
+
+output "agent_runtime_version" {
+  description = "Version of the Bedrock Agent Core runtime"
+  value       = module.runtime.agent_runtime_version
+}
+
+output "security_group_id" {
+  description = "Security group ID of the agent core runtime, for use in ingress rules on resources it must reach (e.g. a database). Null unless enable_vpc is true."
+  value       = module.runtime.security_group_id
+}
+
+output "container_uri" {
+  description = "URI of the published image the runtime runs, within the shared asset registry"
+  value       = "${var.asset_ecr_repository_url}:${local.image_tag}"
+}

package/src/utils/agent-core-packaging.d.ts

@@ -0,0 +1,119 @@
+/**
+ * Copyright Amazon.com, Inc. or its affiliates. All Rights Reserved.
+ * SPDX-License-Identifier: Apache-2.0
+ */
+import { type ProjectConfiguration, type Tree } from '@nx/devkit';
+import { type DependencyDeclaration, type MustDeclare } from './declared-dependencies.js';
+import { FS_DEPENDENCIES } from './fs.js';
+/**
+ * How an AgentCore Runtime's artifact is packaged and hosted.
+ *
+ * `agentcore` uploads a `.zip` of the built code to S3 and runs it on an
+ * AgentCore managed language runtime, which skips the container build, ECR
+ * repository and image push entirely — the fastest build and deploy cycle.
+ * `agentcore-ecr` builds an arm64 container image and hosts it from ECR, for
+ * workloads needing OS-level control (e.g. native system libraries) or an
+ * established container pipeline.
+ */
+export declare const AGENT_CORE_INFRA: readonly ["agentcore", "agentcore-ecr", "none"];
+export type AgentCoreInfra = (typeof AGENT_CORE_INFRA)[number];
+/** Whether the given infra option hosts on AgentCore Runtime at all. */
+export declare const isAgentCoreHosted: (infra: AgentCoreInfra) => boolean;
+/** Whether the given infra option builds and hosts a container image. */
+export declare const isContainerHosted: (infra: AgentCoreInfra) => boolean;
+/** The AgentCore managed runtime a TypeScript component targets. */
+export declare const agentCoreNodeRuntime: () => string;
+/** The AgentCore managed runtime a Python component targets. */
+export declare const agentCorePythonRuntime: () => string;
+/**
+ * Dependencies a caller must declare to add a code (`.zip`) packaging target.
+ *
+ * The TypeScript package target vendors the AWS Distro for OpenTelemetry into
+ * the package directory, so its version is declared here (spread through
+ * `ownedElsewhere` by callers, since the install targets the built package
+ * rather than any workspace manifest).
+ */
+export declare const CODE_PACKAGE_DEPENDENCIES: readonly [{
+    readonly name: "ncp";
+}, {
+    readonly name: "rimraf";
+}, {
+    readonly name: "make-dir-cli";
+}, {
+    readonly name: "cpy-cli";
+}, {
+    readonly name: "@aws/aws-distro-opentelemetry-node-autoinstrumentation";
+}];
+export interface AddTypeScriptCodePackageTargetOptions {
+    /** Project configuration to add the target to (mutated in place). */
+    readonly project: ProjectConfiguration;
+    /** Name of the packaging target to add, e.g. `agent-package`. */
+    readonly targetName: string;
+    /** Name of the target producing the bundled `index.js`, depended on here. */
+    readonly bundleTargetName: string;
+    /** Directory holding the bundled `index.js`, relative to the workspace root. */
+    readonly bundleOutputDir: string;
+    /** Directory to assemble the deployable package in, relative to the workspace root. */
+    readonly packageOutputDir: string;
+}
+/**
+ * Add a target assembling the deployable code package for a TypeScript
+ * AgentCore Runtime.
+ *
+ * The package is the rolldown bundle plus a vendored AWS Distro for
+ * OpenTelemetry install. AgentCore rejects a code package with no OpenTelemetry
+ * dependencies present (`CREATE_FAILED`: "OpenTelemetry instrumentation
+ * executable not found"), so ADOT must ship inside the package rather than
+ * being installed at runtime — the `opentelemetry-instrument` entry point
+ * prefix resolves it from there.
+ *
+ * The install is scoped to the package directory with `--prefix` and
+ * `--no-save`, so it never touches the project's own manifest. `--omit=dev`
+ * keeps the package to what the runtime loads. ADOT is pure JavaScript with no
+ * native binaries, so the package is architecture independent even though
+ * AgentCore only runs arm64.
+ */
+export declare const addTypeScriptCodePackageTarget: <const D extends DependencyDeclaration>(tree: Tree, options: AddTypeScriptCodePackageTargetOptions, declaration: D & MustDeclare<typeof CODE_PACKAGE_DEPENDENCIES, D>) => void;
+export interface AddPythonCodePackageTargetOptions {
+    /** Project configuration to add the target to (mutated in place). */
+    readonly project: ProjectConfiguration;
+    /** Name of the packaging target to add, e.g. `agent-package`. */
+    readonly targetName: string;
+    /** Name of the arm64 bundle target, depended on here. */
+    readonly bundleTargetName: string;
+    /** Directory holding the arm64 bundle, relative to the workspace root. */
+    readonly bundleOutputDir: string;
+    /** Directory to assemble the deployable package in, relative to the workspace root. */
+    readonly packageOutputDir: string;
+    /**
+     * The project's source root, which is itself the module directory — copied
+     * into the package under {@link moduleName} so the agent's imports resolve.
+     */
+    readonly sourceRoot: string;
+    /** Python module name (the source root's last segment). */
+    readonly moduleName: string;
+    /**
+     * Path to the entry point script, relative to the workspace root. Copied to
+     * the package root, where AgentCore's `entryPoint` runs it.
+     */
+    readonly entryPointPath: string;
+    /** File name the entry point takes at the package root. */
+    readonly entryPointFileName: string;
+}
+/**
+ * Add a target assembling the deployable code package for a Python AgentCore
+ * Runtime.
+ *
+ * The package is the arm64 dependency bundle (which already carries
+ * `bin/opentelemetry-instrument` from `aws-opentelemetry-distro`, satisfying
+ * AgentCore's requirement that OpenTelemetry be present), the project's own
+ * module tree, and a root entry point script.
+ *
+ * The entry point sits at the package root rather than inside the module:
+ * AgentCore runs it as a file path, and Python gives a script run that way no
+ * parent package, so the agent's own `from .init import app` would raise
+ * `ImportError: attempted relative import with no known parent package`. The
+ * root script imports the module absolutely instead, which resolves those
+ * relative imports normally.
+ */
+export declare const addPythonCodePackageTarget: <const D extends DependencyDeclaration>(tree: Tree, options: AddPythonCodePackageTargetOptions, declaration: D & MustDeclare<typeof FS_DEPENDENCIES, D>) => void;

package/src/utils/agent-core-packaging.js

@@ -0,0 +1,131 @@
+/**
+ * Copyright Amazon.com, Inc. or its affiliates. All Rights Reserved.
+ * SPDX-License-Identifier: Apache-2.0
+ */ import { joinPathFragments } from "@nx/devkit";
+import { forDependencies } from "./declared-dependencies.js";
+import { FS_DEPENDENCIES, FsCommands } from "./fs.js";
+import { addArtifactDependencyToTargets } from "./nx.js";
+import { agentCoreRuntime, TS_VERSIONS } from "./versions.js";
+/**
+ * How an AgentCore Runtime's artifact is packaged and hosted.
+ *
+ * `agentcore` uploads a `.zip` of the built code to S3 and runs it on an
+ * AgentCore managed language runtime, which skips the container build, ECR
+ * repository and image push entirely — the fastest build and deploy cycle.
+ * `agentcore-ecr` builds an arm64 container image and hosts it from ECR, for
+ * workloads needing OS-level control (e.g. native system libraries) or an
+ * established container pipeline.
+ */ export const AGENT_CORE_INFRA = [
+    'agentcore',
+    'agentcore-ecr',
+    'none'
+];
+/** Whether the given infra option hosts on AgentCore Runtime at all. */ export const isAgentCoreHosted = (infra)=>infra === 'agentcore' || infra === 'agentcore-ecr';
+/** Whether the given infra option builds and hosts a container image. */ export const isContainerHosted = (infra)=>infra === 'agentcore-ecr';
+/** The AgentCore managed runtime a TypeScript component targets. */ export const agentCoreNodeRuntime = ()=>agentCoreRuntime('node');
+/** The AgentCore managed runtime a Python component targets. */ export const agentCorePythonRuntime = ()=>agentCoreRuntime('python');
+/**
+ * Dependencies a caller must declare to add a code (`.zip`) packaging target.
+ *
+ * The TypeScript package target vendors the AWS Distro for OpenTelemetry into
+ * the package directory, so its version is declared here (spread through
+ * `ownedElsewhere` by callers, since the install targets the built package
+ * rather than any workspace manifest).
+ */ export const CODE_PACKAGE_DEPENDENCIES = [
+    ...FS_DEPENDENCIES,
+    {
+        name: '@aws/aws-distro-opentelemetry-node-autoinstrumentation'
+    }
+];
+/**
+ * Add a target assembling the deployable code package for a TypeScript
+ * AgentCore Runtime.
+ *
+ * The package is the rolldown bundle plus a vendored AWS Distro for
+ * OpenTelemetry install. AgentCore rejects a code package with no OpenTelemetry
+ * dependencies present (`CREATE_FAILED`: "OpenTelemetry instrumentation
+ * executable not found"), so ADOT must ship inside the package rather than
+ * being installed at runtime — the `opentelemetry-instrument` entry point
+ * prefix resolves it from there.
+ *
+ * The install is scoped to the package directory with `--prefix` and
+ * `--no-save`, so it never touches the project's own manifest. `--omit=dev`
+ * keeps the package to what the runtime loads. ADOT is pure JavaScript with no
+ * native binaries, so the package is architecture independent even though
+ * AgentCore only runs arm64.
+ */ export const addTypeScriptCodePackageTarget = (tree, options, declaration)=>{
+    const { project, targetName, bundleTargetName, bundleOutputDir, packageOutputDir } = options;
+    const fs = new FsCommands(tree, forDependencies(declaration));
+    const adotVersion = TS_VERSIONS['@aws/aws-distro-opentelemetry-node-autoinstrumentation'];
+    project.targets ??= {};
+    project.targets[targetName] = {
+        cache: true,
+        inputs: [
+            'default'
+        ],
+        outputs: [
+            `{workspaceRoot}/${packageOutputDir}`
+        ],
+        executor: 'nx:run-commands',
+        options: {
+            commands: [
+                fs.rm(packageOutputDir),
+                fs.mkdir(packageOutputDir),
+                fs.cp(joinPathFragments(bundleOutputDir, 'index.js'), joinPathFragments(packageOutputDir, 'index.js')),
+                `npm install --prefix ${packageOutputDir} --no-save --no-audit --no-fund --omit=dev @aws/aws-distro-opentelemetry-node-autoinstrumentation@${adotVersion}`
+            ],
+            parallel: false
+        },
+        dependsOn: [
+            bundleTargetName
+        ]
+    };
+    addArtifactDependencyToTargets(project, targetName);
+};
+/**
+ * Add a target assembling the deployable code package for a Python AgentCore
+ * Runtime.
+ *
+ * The package is the arm64 dependency bundle (which already carries
+ * `bin/opentelemetry-instrument` from `aws-opentelemetry-distro`, satisfying
+ * AgentCore's requirement that OpenTelemetry be present), the project's own
+ * module tree, and a root entry point script.
+ *
+ * The entry point sits at the package root rather than inside the module:
+ * AgentCore runs it as a file path, and Python gives a script run that way no
+ * parent package, so the agent's own `from .init import app` would raise
+ * `ImportError: attempted relative import with no known parent package`. The
+ * root script imports the module absolutely instead, which resolves those
+ * relative imports normally.
+ */ export const addPythonCodePackageTarget = (tree, options, declaration)=>{
+    const { project, targetName, bundleTargetName, bundleOutputDir, packageOutputDir, sourceRoot, moduleName, entryPointPath, entryPointFileName } = options;
+    const fs = new FsCommands(tree, forDependencies(declaration));
+    project.targets ??= {};
+    project.targets[targetName] = {
+        cache: true,
+        inputs: [
+            'production',
+            '^production'
+        ],
+        outputs: [
+            `{workspaceRoot}/${packageOutputDir}`
+        ],
+        executor: 'nx:run-commands',
+        options: {
+            commands: [
+                fs.rm(packageOutputDir),
+                fs.mkdir(packageOutputDir),
+                fs.cp(bundleOutputDir, packageOutputDir),
+                fs.cp(sourceRoot, joinPathFragments(packageOutputDir, moduleName)),
+                fs.cp(entryPointPath, joinPathFragments(packageOutputDir, entryPointFileName))
+            ],
+            parallel: false
+        },
+        dependsOn: [
+            bundleTargetName
+        ]
+    };
+    addArtifactDependencyToTargets(project, targetName);
+};
+
+//# sourceMappingURL=agent-core-packaging.js.map