@aws/nx-plugin 1.0.1 → 1.0.2

package/migrations.json

@@ -12,6 +12,11 @@
       "description": "Move the shared shadcn package's components onto the cn package the shadcn registry now depends on",
       "implementation": "./src/migrations/latest/shadcn-cn-package/migration"
     },
+    "latest-terraform-harness-environment-variables": {
+      "version": "1.0.2",
+      "description": "Send an empty map rather than null for a vended Terraform AgentCore Harness module's environment_variables, so the first apply does not fail after creating the Harness",
+      "implementation": "./src/migrations/latest/terraform-harness-environment-variables/migration"
+    },
     "v1.0.0-rc.50-0001-modernize-function-props-cast": {
       "version": "1.0.0-rc.50",
       "description": "Replace the legacy angle-bracket FunctionProps type assertion with the modern as syntax in generated API constructs",
@@ -368,7 +373,7 @@
       "implementation": "./src/migrations/v1.0.0-rc.97/0006-script-project-quality-gates/migration"
     },
     "sync-vended-versions": {
-      "version": "1.0.1",
+      "version": "1.0.2",
       "description": "Sync vended dependency versions and the tracked plugin version to those vended by this release",
       "implementation": "./src/utils/version-upgrade-migration/migration"
     }
@@ -474,7 +479,7 @@
       }
     },
     "nx-23.2.1-nx-packages": {
-      "version": "1.0.1",
+      "version": "1.0.2",
       "packages": {
         "nx": {
           "version": "23.2.1",

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@aws/nx-plugin",
-  "version": "1.0.1",
+  "version": "1.0.2",
   "repository": {
     "type": "git",
     "url": "https://github.com/awslabs/nx-plugin-for-aws.git",

package/src/agentcore-gateway/agent-connection/generator.js

@@ -63,6 +63,12 @@ export const AGENTCORE_GATEWAY_AGENT_CONNECTION_GENERATOR_INFO = getGeneratorInf
     if (agentAuth !== 'iam' && agentAuth !== 'cognito') {
         throw new Error(`Agent '${agentComponent.name}' uses auth='${agentAuth}', which a gateway cannot front. Supported: iam, cognito.`);
     }
+    // JWT passthrough forwards the token the gateway validated on the way in, so
+    // a Cognito agent needs a Cognito gateway in front of it. An IAM gateway
+    // authenticates its callers with SigV4 and has no bearer token to forward.
+    if (agentAuth === 'cognito' && gateway.auth !== 'cognito') {
+        throw new Error(`Agent '${agentComponent.name}' uses auth='cognito', but gateway '${gateway.name}' uses auth='${gateway.auth}'. A Cognito agent authorizes on the caller's forwarded JWT, which only a Cognito gateway receives — generate the gateway with --auth=cognito against the same user pool, or front an IAM agent instead.`);
+    }
     // The target name must match what the deployed Gateway uses (`agentName` on
     // the agent construct, derived from the project's class name) so the
     // `/<target>/invocations` path resolves identically locally and deployed.

package/src/agentcore-gateway/agent-connection/generator.js.map

@@ -1 +1 @@
-{"version":3,"sources":["../../../../../../packages/nx-plugin/src/agentcore-gateway/agent-connection/generator.ts"],"sourcesContent":["/**\n * Copyright Amazon.com, Inc. or its affiliates. All Rights Reserved.\n * SPDX-License-Identifier: Apache-2.0\n */\nimport type { GeneratorCallback, Tree } from '@nx/devkit';\nimport { formatFilesInSubtree } from '../../utils/format.js';\nimport { installDependencies } from '../../utils/install.js';\nimport { addGeneratorMetricsIfApplicable } from '../../utils/metrics.js';\nimport { kebabCase, toClassName } from '../../utils/names.js';\nimport {\n  addComponentGeneratorMetadata,\n  getGeneratorInfo,\n  type NxGeneratorInfo,\n  readProjectConfigurationUnqualified,\n} from '../../utils/nx.js';\nimport { attachAgentToLocalGateway } from '../attach-upstream.js';\nimport { readAgentCoreGatewayMetadata } from '../generator.js';\nimport type { AgentcoreGatewayAgentConnectionGeneratorSchema } from './schema';\n\nexport const AGENTCORE_GATEWAY_AGENT_CONNECTION_GENERATOR_INFO: NxGeneratorInfo =\n  getGeneratorInfo(import.meta.filename);\n\n/**\n * The agent protocols an http gateway can front, by agent language. The\n * gateway proxies plain HTTP request/response and SSE streams:\n *\n * - `ag-ui` (ts + py) and `http` (py) serve POST /invocations with streamed\n *   responses, which proxy cleanly.\n * - `a2a` (ts + py) is JSON-RPC over POST, which AgentCore applies a default\n *   schema for.\n * - `http` (ts) is tRPC over WebSocket, and the gateway does not support\n *   WebSocket / bidirectional streaming, so it cannot sit behind one.\n */\nconst SUPPORTED_AGENT_PROTOCOLS: Record<string, string[]> = {\n  'ts#agent': ['ag-ui', 'a2a'],\n  'py#agent': ['ag-ui', 'http', 'a2a'],\n};\n\n/**\n * Connect an AgentCore Gateway to an agent, so the agent is added as a\n * gateway target and served under `<gatewayUrl>/<targetName>/invocations`.\n *\n * Chains the gateway's dev target to the agent's dev target, and registers\n * the agent in the gateway's local-dev.ts so the local gateway proxies to it.\n * Users must still call `gateway.addAgent(...)` in their application stack to\n * create the actual CDK/Terraform resource.\n */\nexport const agentcoreGatewayAgentConnectionGenerator = async (\n  tree: Tree,\n  options: AgentcoreGatewayAgentConnectionGeneratorSchema,\n): Promise<GeneratorCallback> => {\n  const sourceProject = readProjectConfigurationUnqualified(\n    tree,\n    options.sourceProject,\n  );\n  const targetProject = readProjectConfigurationUnqualified(\n    tree,\n    options.targetProject,\n  );\n\n  const gateway = readAgentCoreGatewayMetadata(sourceProject);\n  const agentComponent = options.targetComponent;\n\n  if (!agentComponent) {\n    throw new Error(\n      `Target project '${options.targetProject}' has no agent component metadata. Did you run the 'ts#agent' or 'py#agent' generator?`,\n    );\n  }\n\n  if (gateway.protocol !== 'http') {\n    throw new Error(\n      `Gateway '${gateway.name}' has protocol='${gateway.protocol}'. Agent targets can only be attached to http-protocol gateways — generate one with the 'agentcore-gateway' generator and --protocol=http.`,\n    );\n  }\n\n  const agentGenerator = agentComponent.generator ?? 'ts#agent';\n  const agentProtocol = (\n    (agentComponent.protocol as string | undefined) ?? 'http'\n  ).toLowerCase();\n  const supportedProtocols = SUPPORTED_AGENT_PROTOCOLS[agentGenerator] ?? [];\n  if (!supportedProtocols.includes(agentProtocol)) {\n    throw new Error(\n      `Agent '${agentComponent.name}' uses protocol='${agentProtocol}', which cannot be fronted by a gateway` +\n        (agentGenerator === 'ts#agent' && agentProtocol === 'http'\n          ? ` — a TypeScript HTTP agent serves tRPC over WebSocket, and AgentCore Gateway does not support WebSocket streaming. Consider the ag-ui protocol instead.`\n          : `. Supported protocols: ${supportedProtocols.join(', ')}.`),\n    );\n  }\n  // Both IAM and Cognito agents can be fronted. An IAM agent is invoked with\n  // the gateway's own role (GATEWAY_IAM_ROLE); a Cognito agent has the caller's\n  // JWT forwarded to it (JWT_PASSTHROUGH) so it authorizes on the token. The\n  // vended `addAgent` picks the credential from the agent's `auth`.\n  const agentAuth = (agentComponent.auth as string | undefined) ?? 'iam';\n  if (agentAuth !== 'iam' && agentAuth !== 'cognito') {\n    throw new Error(\n      `Agent '${agentComponent.name}' uses auth='${agentAuth}', which a gateway cannot front. Supported: iam, cognito.`,\n    );\n  }\n\n  // The target name must match what the deployed Gateway uses (`agentName` on\n  // the agent construct, derived from the project's class name) so the\n  // `/<target>/invocations` path resolves identically locally and deployed.\n  const agentComponentName = agentComponent.name ?? 'agent';\n  const agentTargetName = kebabCase(\n    (agentComponent.rc as string | undefined) ??\n      toClassName(agentComponentName),\n  );\n\n  await attachAgentToLocalGateway(tree, sourceProject, 'dev', {\n    targetName: agentTargetName,\n    port: (agentComponent.port as number | undefined) ?? 8081,\n    upstreamProjectName: targetProject.name,\n    upstreamDevTargetName: `${agentComponentName}-dev`,\n    // The deployed gateway maps an A2A target's `/invocations/...` paths onto\n    // the agent container's root; HTTP and AG-UI agents serve /invocations\n    // themselves.\n    stripInvocations: agentProtocol === 'a2a',\n  });\n\n  // Recorded so the version sync can identify this connection.\n  addComponentGeneratorMetadata(\n    tree,\n    sourceProject.name,\n    AGENTCORE_GATEWAY_AGENT_CONNECTION_GENERATOR_INFO,\n    targetProject.root,\n    agentTargetName,\n  );\n\n  await addGeneratorMetricsIfApplicable(tree, [\n    AGENTCORE_GATEWAY_AGENT_CONNECTION_GENERATOR_INFO,\n  ]);\n\n  await formatFilesInSubtree(tree);\n\n  return () =>\n    installDependencies(tree, options.preferInstallDependencies, {\n      languages: ['typescript'],\n    });\n};\n\nexport default agentcoreGatewayAgentConnectionGenerator;\n"],"names":["formatFilesInSubtree","installDependencies","addGeneratorMetricsIfApplicable","kebabCase","toClassName","addComponentGeneratorMetadata","getGeneratorInfo","readProjectConfigurationUnqualified","attachAgentToLocalGateway","readAgentCoreGatewayMetadata","AGENTCORE_GATEWAY_AGENT_CONNECTION_GENERATOR_INFO","filename","SUPPORTED_AGENT_PROTOCOLS","agentcoreGatewayAgentConnectionGenerator","tree","options","sourceProject","targetProject","gateway","agentComponent","targetComponent","Error","protocol","name","agentGenerator","generator","agentProtocol","toLowerCase","supportedProtocols","includes","join","agentAuth","auth","agentComponentName","agentTargetName","rc","targetName","port","upstreamProjectName","upstreamDevTargetName","stripInvocations","root","preferInstallDependencies","languages"],"mappings":"AAAA;;;CAGC,GAED,SAASA,oBAAoB,QAAQ,wBAAwB;AAC7D,SAASC,mBAAmB,QAAQ,yBAAyB;AAC7D,SAASC,+BAA+B,QAAQ,yBAAyB;AACzE,SAASC,SAAS,EAAEC,WAAW,QAAQ,uBAAuB;AAC9D,SACEC,6BAA6B,EAC7BC,gBAAgB,EAEhBC,mCAAmC,QAC9B,oBAAoB;AAC3B,SAASC,yBAAyB,QAAQ,wBAAwB;AAClE,SAASC,4BAA4B,QAAQ,kBAAkB;AAG/D,OAAO,MAAMC,oDACXJ,iBAAiB,YAAYK,QAAQ,EAAE;AAEzC;;;;;;;;;;CAUC,GACD,MAAMC,4BAAsD;IAC1D,YAAY;QAAC;QAAS;KAAM;IAC5B,YAAY;QAAC;QAAS;QAAQ;KAAM;AACtC;AAEA;;;;;;;;CAQC,GACD,OAAO,MAAMC,2CAA2C,OACtDC,MACAC;IAEA,MAAMC,gBAAgBT,oCACpBO,MACAC,QAAQC,aAAa;IAEvB,MAAMC,gBAAgBV,oCACpBO,MACAC,QAAQE,aAAa;IAGvB,MAAMC,UAAUT,6BAA6BO;IAC7C,MAAMG,iBAAiBJ,QAAQK,eAAe;IAE9C,IAAI,CAACD,gBAAgB;QACnB,MAAM,IAAIE,MACR,CAAC,gBAAgB,EAAEN,QAAQE,aAAa,CAAC,sFAAsF,CAAC;IAEpI;IAEA,IAAIC,QAAQI,QAAQ,KAAK,QAAQ;QAC/B,MAAM,IAAID,MACR,CAAC,SAAS,EAAEH,QAAQK,IAAI,CAAC,gBAAgB,EAAEL,QAAQI,QAAQ,CAAC,0IAA0I,CAAC;IAE3M;IAEA,MAAME,iBAAiBL,eAAeM,SAAS,IAAI;IACnD,MAAMC,gBAAgB,AACpB,CAAA,AAACP,eAAeG,QAAQ,IAA2B,MAAK,EACxDK,WAAW;IACb,MAAMC,qBAAqBhB,yBAAyB,CAACY,eAAe,IAAI,EAAE;IAC1E,IAAI,CAACI,mBAAmBC,QAAQ,CAACH,gBAAgB;QAC/C,MAAM,IAAIL,MACR,CAAC,OAAO,EAAEF,eAAeI,IAAI,CAAC,iBAAiB,EAAEG,cAAc,uCAAuC,CAAC,GACpGF,CAAAA,mBAAmB,cAAcE,kBAAkB,SAChD,CAAC,uJAAuJ,CAAC,GACzJ,CAAC,uBAAuB,EAAEE,mBAAmBE,IAAI,CAAC,MAAM,CAAC,CAAC,AAAD;IAEnE;IACA,2EAA2E;IAC3E,8EAA8E;IAC9E,2EAA2E;IAC3E,kEAAkE;IAClE,MAAMC,YAAY,AAACZ,eAAea,IAAI,IAA2B;IACjE,IAAID,cAAc,SAASA,cAAc,WAAW;QAClD,MAAM,IAAIV,MACR,CAAC,OAAO,EAAEF,eAAeI,IAAI,CAAC,aAAa,EAAEQ,UAAU,yDAAyD,CAAC;IAErH;IAEA,4EAA4E;IAC5E,qEAAqE;IACrE,0EAA0E;IAC1E,MAAME,qBAAqBd,eAAeI,IAAI,IAAI;IAClD,MAAMW,kBAAkB/B,UACtB,AAACgB,eAAegB,EAAE,IAChB/B,YAAY6B;IAGhB,MAAMzB,0BAA0BM,MAAME,eAAe,OAAO;QAC1DoB,YAAYF;QACZG,MAAM,AAAClB,eAAekB,IAAI,IAA2B;QACrDC,qBAAqBrB,cAAcM,IAAI;QACvCgB,uBAAuB,GAAGN,mBAAmB,IAAI,CAAC;QAClD,0EAA0E;QAC1E,uEAAuE;QACvE,cAAc;QACdO,kBAAkBd,kBAAkB;IACtC;IAEA,6DAA6D;IAC7DrB,8BACES,MACAE,cAAcO,IAAI,EAClBb,mDACAO,cAAcwB,IAAI,EAClBP;IAGF,MAAMhC,gCAAgCY,MAAM;QAC1CJ;KACD;IAED,MAAMV,qBAAqBc;IAE3B,OAAO,IACLb,oBAAoBa,MAAMC,QAAQ2B,yBAAyB,EAAE;YAC3DC,WAAW;gBAAC;aAAa;QAC3B;AACJ,EAAE;AAEF,eAAe9B,yCAAyC"}
+{"version":3,"sources":["../../../../../../packages/nx-plugin/src/agentcore-gateway/agent-connection/generator.ts"],"sourcesContent":["/**\n * Copyright Amazon.com, Inc. or its affiliates. All Rights Reserved.\n * SPDX-License-Identifier: Apache-2.0\n */\nimport type { GeneratorCallback, Tree } from '@nx/devkit';\nimport { formatFilesInSubtree } from '../../utils/format.js';\nimport { installDependencies } from '../../utils/install.js';\nimport { addGeneratorMetricsIfApplicable } from '../../utils/metrics.js';\nimport { kebabCase, toClassName } from '../../utils/names.js';\nimport {\n  addComponentGeneratorMetadata,\n  getGeneratorInfo,\n  type NxGeneratorInfo,\n  readProjectConfigurationUnqualified,\n} from '../../utils/nx.js';\nimport { attachAgentToLocalGateway } from '../attach-upstream.js';\nimport { readAgentCoreGatewayMetadata } from '../generator.js';\nimport type { AgentcoreGatewayAgentConnectionGeneratorSchema } from './schema';\n\nexport const AGENTCORE_GATEWAY_AGENT_CONNECTION_GENERATOR_INFO: NxGeneratorInfo =\n  getGeneratorInfo(import.meta.filename);\n\n/**\n * The agent protocols an http gateway can front, by agent language. The\n * gateway proxies plain HTTP request/response and SSE streams:\n *\n * - `ag-ui` (ts + py) and `http` (py) serve POST /invocations with streamed\n *   responses, which proxy cleanly.\n * - `a2a` (ts + py) is JSON-RPC over POST, which AgentCore applies a default\n *   schema for.\n * - `http` (ts) is tRPC over WebSocket, and the gateway does not support\n *   WebSocket / bidirectional streaming, so it cannot sit behind one.\n */\nconst SUPPORTED_AGENT_PROTOCOLS: Record<string, string[]> = {\n  'ts#agent': ['ag-ui', 'a2a'],\n  'py#agent': ['ag-ui', 'http', 'a2a'],\n};\n\n/**\n * Connect an AgentCore Gateway to an agent, so the agent is added as a\n * gateway target and served under `<gatewayUrl>/<targetName>/invocations`.\n *\n * Chains the gateway's dev target to the agent's dev target, and registers\n * the agent in the gateway's local-dev.ts so the local gateway proxies to it.\n * Users must still call `gateway.addAgent(...)` in their application stack to\n * create the actual CDK/Terraform resource.\n */\nexport const agentcoreGatewayAgentConnectionGenerator = async (\n  tree: Tree,\n  options: AgentcoreGatewayAgentConnectionGeneratorSchema,\n): Promise<GeneratorCallback> => {\n  const sourceProject = readProjectConfigurationUnqualified(\n    tree,\n    options.sourceProject,\n  );\n  const targetProject = readProjectConfigurationUnqualified(\n    tree,\n    options.targetProject,\n  );\n\n  const gateway = readAgentCoreGatewayMetadata(sourceProject);\n  const agentComponent = options.targetComponent;\n\n  if (!agentComponent) {\n    throw new Error(\n      `Target project '${options.targetProject}' has no agent component metadata. Did you run the 'ts#agent' or 'py#agent' generator?`,\n    );\n  }\n\n  if (gateway.protocol !== 'http') {\n    throw new Error(\n      `Gateway '${gateway.name}' has protocol='${gateway.protocol}'. Agent targets can only be attached to http-protocol gateways — generate one with the 'agentcore-gateway' generator and --protocol=http.`,\n    );\n  }\n\n  const agentGenerator = agentComponent.generator ?? 'ts#agent';\n  const agentProtocol = (\n    (agentComponent.protocol as string | undefined) ?? 'http'\n  ).toLowerCase();\n  const supportedProtocols = SUPPORTED_AGENT_PROTOCOLS[agentGenerator] ?? [];\n  if (!supportedProtocols.includes(agentProtocol)) {\n    throw new Error(\n      `Agent '${agentComponent.name}' uses protocol='${agentProtocol}', which cannot be fronted by a gateway` +\n        (agentGenerator === 'ts#agent' && agentProtocol === 'http'\n          ? ` — a TypeScript HTTP agent serves tRPC over WebSocket, and AgentCore Gateway does not support WebSocket streaming. Consider the ag-ui protocol instead.`\n          : `. Supported protocols: ${supportedProtocols.join(', ')}.`),\n    );\n  }\n  // Both IAM and Cognito agents can be fronted. An IAM agent is invoked with\n  // the gateway's own role (GATEWAY_IAM_ROLE); a Cognito agent has the caller's\n  // JWT forwarded to it (JWT_PASSTHROUGH) so it authorizes on the token. The\n  // vended `addAgent` picks the credential from the agent's `auth`.\n  const agentAuth = (agentComponent.auth as string | undefined) ?? 'iam';\n  if (agentAuth !== 'iam' && agentAuth !== 'cognito') {\n    throw new Error(\n      `Agent '${agentComponent.name}' uses auth='${agentAuth}', which a gateway cannot front. Supported: iam, cognito.`,\n    );\n  }\n  // JWT passthrough forwards the token the gateway validated on the way in, so\n  // a Cognito agent needs a Cognito gateway in front of it. An IAM gateway\n  // authenticates its callers with SigV4 and has no bearer token to forward.\n  if (agentAuth === 'cognito' && gateway.auth !== 'cognito') {\n    throw new Error(\n      `Agent '${agentComponent.name}' uses auth='cognito', but gateway '${gateway.name}' uses auth='${gateway.auth}'. A Cognito agent authorizes on the caller's forwarded JWT, which only a Cognito gateway receives — generate the gateway with --auth=cognito against the same user pool, or front an IAM agent instead.`,\n    );\n  }\n\n  // The target name must match what the deployed Gateway uses (`agentName` on\n  // the agent construct, derived from the project's class name) so the\n  // `/<target>/invocations` path resolves identically locally and deployed.\n  const agentComponentName = agentComponent.name ?? 'agent';\n  const agentTargetName = kebabCase(\n    (agentComponent.rc as string | undefined) ??\n      toClassName(agentComponentName),\n  );\n\n  await attachAgentToLocalGateway(tree, sourceProject, 'dev', {\n    targetName: agentTargetName,\n    port: (agentComponent.port as number | undefined) ?? 8081,\n    upstreamProjectName: targetProject.name,\n    upstreamDevTargetName: `${agentComponentName}-dev`,\n    // The deployed gateway maps an A2A target's `/invocations/...` paths onto\n    // the agent container's root; HTTP and AG-UI agents serve /invocations\n    // themselves.\n    stripInvocations: agentProtocol === 'a2a',\n  });\n\n  // Recorded so the version sync can identify this connection.\n  addComponentGeneratorMetadata(\n    tree,\n    sourceProject.name,\n    AGENTCORE_GATEWAY_AGENT_CONNECTION_GENERATOR_INFO,\n    targetProject.root,\n    agentTargetName,\n  );\n\n  await addGeneratorMetricsIfApplicable(tree, [\n    AGENTCORE_GATEWAY_AGENT_CONNECTION_GENERATOR_INFO,\n  ]);\n\n  await formatFilesInSubtree(tree);\n\n  return () =>\n    installDependencies(tree, options.preferInstallDependencies, {\n      languages: ['typescript'],\n    });\n};\n\nexport default agentcoreGatewayAgentConnectionGenerator;\n"],"names":["formatFilesInSubtree","installDependencies","addGeneratorMetricsIfApplicable","kebabCase","toClassName","addComponentGeneratorMetadata","getGeneratorInfo","readProjectConfigurationUnqualified","attachAgentToLocalGateway","readAgentCoreGatewayMetadata","AGENTCORE_GATEWAY_AGENT_CONNECTION_GENERATOR_INFO","filename","SUPPORTED_AGENT_PROTOCOLS","agentcoreGatewayAgentConnectionGenerator","tree","options","sourceProject","targetProject","gateway","agentComponent","targetComponent","Error","protocol","name","agentGenerator","generator","agentProtocol","toLowerCase","supportedProtocols","includes","join","agentAuth","auth","agentComponentName","agentTargetName","rc","targetName","port","upstreamProjectName","upstreamDevTargetName","stripInvocations","root","preferInstallDependencies","languages"],"mappings":"AAAA;;;CAGC,GAED,SAASA,oBAAoB,QAAQ,wBAAwB;AAC7D,SAASC,mBAAmB,QAAQ,yBAAyB;AAC7D,SAASC,+BAA+B,QAAQ,yBAAyB;AACzE,SAASC,SAAS,EAAEC,WAAW,QAAQ,uBAAuB;AAC9D,SACEC,6BAA6B,EAC7BC,gBAAgB,EAEhBC,mCAAmC,QAC9B,oBAAoB;AAC3B,SAASC,yBAAyB,QAAQ,wBAAwB;AAClE,SAASC,4BAA4B,QAAQ,kBAAkB;AAG/D,OAAO,MAAMC,oDACXJ,iBAAiB,YAAYK,QAAQ,EAAE;AAEzC;;;;;;;;;;CAUC,GACD,MAAMC,4BAAsD;IAC1D,YAAY;QAAC;QAAS;KAAM;IAC5B,YAAY;QAAC;QAAS;QAAQ;KAAM;AACtC;AAEA;;;;;;;;CAQC,GACD,OAAO,MAAMC,2CAA2C,OACtDC,MACAC;IAEA,MAAMC,gBAAgBT,oCACpBO,MACAC,QAAQC,aAAa;IAEvB,MAAMC,gBAAgBV,oCACpBO,MACAC,QAAQE,aAAa;IAGvB,MAAMC,UAAUT,6BAA6BO;IAC7C,MAAMG,iBAAiBJ,QAAQK,eAAe;IAE9C,IAAI,CAACD,gBAAgB;QACnB,MAAM,IAAIE,MACR,CAAC,gBAAgB,EAAEN,QAAQE,aAAa,CAAC,sFAAsF,CAAC;IAEpI;IAEA,IAAIC,QAAQI,QAAQ,KAAK,QAAQ;QAC/B,MAAM,IAAID,MACR,CAAC,SAAS,EAAEH,QAAQK,IAAI,CAAC,gBAAgB,EAAEL,QAAQI,QAAQ,CAAC,0IAA0I,CAAC;IAE3M;IAEA,MAAME,iBAAiBL,eAAeM,SAAS,IAAI;IACnD,MAAMC,gBAAgB,AACpB,CAAA,AAACP,eAAeG,QAAQ,IAA2B,MAAK,EACxDK,WAAW;IACb,MAAMC,qBAAqBhB,yBAAyB,CAACY,eAAe,IAAI,EAAE;IAC1E,IAAI,CAACI,mBAAmBC,QAAQ,CAACH,gBAAgB;QAC/C,MAAM,IAAIL,MACR,CAAC,OAAO,EAAEF,eAAeI,IAAI,CAAC,iBAAiB,EAAEG,cAAc,uCAAuC,CAAC,GACpGF,CAAAA,mBAAmB,cAAcE,kBAAkB,SAChD,CAAC,uJAAuJ,CAAC,GACzJ,CAAC,uBAAuB,EAAEE,mBAAmBE,IAAI,CAAC,MAAM,CAAC,CAAC,AAAD;IAEnE;IACA,2EAA2E;IAC3E,8EAA8E;IAC9E,2EAA2E;IAC3E,kEAAkE;IAClE,MAAMC,YAAY,AAACZ,eAAea,IAAI,IAA2B;IACjE,IAAID,cAAc,SAASA,cAAc,WAAW;QAClD,MAAM,IAAIV,MACR,CAAC,OAAO,EAAEF,eAAeI,IAAI,CAAC,aAAa,EAAEQ,UAAU,yDAAyD,CAAC;IAErH;IACA,6EAA6E;IAC7E,yEAAyE;IACzE,2EAA2E;IAC3E,IAAIA,cAAc,aAAab,QAAQc,IAAI,KAAK,WAAW;QACzD,MAAM,IAAIX,MACR,CAAC,OAAO,EAAEF,eAAeI,IAAI,CAAC,oCAAoC,EAAEL,QAAQK,IAAI,CAAC,aAAa,EAAEL,QAAQc,IAAI,CAAC,wMAAwM,CAAC;IAE1T;IAEA,4EAA4E;IAC5E,qEAAqE;IACrE,0EAA0E;IAC1E,MAAMC,qBAAqBd,eAAeI,IAAI,IAAI;IAClD,MAAMW,kBAAkB/B,UACtB,AAACgB,eAAegB,EAAE,IAChB/B,YAAY6B;IAGhB,MAAMzB,0BAA0BM,MAAME,eAAe,OAAO;QAC1DoB,YAAYF;QACZG,MAAM,AAAClB,eAAekB,IAAI,IAA2B;QACrDC,qBAAqBrB,cAAcM,IAAI;QACvCgB,uBAAuB,GAAGN,mBAAmB,IAAI,CAAC;QAClD,0EAA0E;QAC1E,uEAAuE;QACvE,cAAc;QACdO,kBAAkBd,kBAAkB;IACtC;IAEA,6DAA6D;IAC7DrB,8BACES,MACAE,cAAcO,IAAI,EAClBb,mDACAO,cAAcwB,IAAI,EAClBP;IAGF,MAAMhC,gCAAgCY,MAAM;QAC1CJ;KACD;IAED,MAAMV,qBAAqBc;IAE3B,OAAO,IACLb,oBAAoBa,MAAMC,QAAQ2B,yBAAyB,EAAE;YAC3DC,WAAW;gBAAC;aAAa;QAC3B;AACJ,EAAE;AAEF,eAAe9B,yCAAyC"}

package/src/connection/scaffold-catalog.d.ts

@@ -107,6 +107,18 @@ export declare const CONNECTION_ENDPOINT_TYPES: readonly string[];
  * edit to this file.
  */
 export declare const buildScaffoldRecipes: (schemaOf: SchemaResolver) => Readonly<Record<string, ScaffoldRecipe>>;
+/**
+ * An option value one end of a connection must hold for a constraint to apply,
+ * narrowing a rule that only binds some of a connection's configurations.
+ */
+export interface ConnectionConstraintCondition {
+    /** Which end of the connection the conditioning option belongs to. */
+    readonly side: 'source' | 'target';
+    /** The generator option whose value decides whether the constraint applies. */
+    readonly option: string;
+    /** The value that brings the constraint into effect. */
+    readonly equals: string;
+}
 /**
  * A requirement one end of a connection places on the other's options, mirroring
  * the guard the corresponding connection generator enforces.
@@ -125,6 +137,11 @@ export interface ConnectionConstraint {
     readonly equals?: string;
     /** A value rejected, for options accepting all but one. */
     readonly notEquals?: string;
+    /**
+     * Limits the rule to connections whose endpoints read this way. Absent for a
+     * rule binding every connection of its kind.
+     */
+    readonly when?: ConnectionConstraintCondition;
     /** Why the constraint exists, phrased for the user choosing the option. */
     readonly reason: string;
 }

package/src/connection/scaffold-catalog.js

@@ -183,6 +183,17 @@ const GATEWAY_TO_AGENT = [
         option: 'protocol',
         equals: 'http',
         reason: 'Agent runtime targets can only be attached to an http-protocol gateway.'
+    },
+    {
+        side: 'source',
+        option: 'auth',
+        equals: 'cognito',
+        when: {
+            side: 'target',
+            option: 'auth',
+            equals: 'cognito'
+        },
+        reason: "A Cognito agent authorizes on the caller's forwarded JWT, which only a Cognito gateway receives. An IAM gateway can front an IAM agent, which it invokes with its own role."
     }
 ];
 /**

package/src/connection/scaffold-catalog.js.map

@@ -1 +1 @@
-{"version":3,"sources":["../../../../../packages/nx-plugin/src/connection/scaffold-catalog.ts"],"sourcesContent":["/**\n * Copyright Amazon.com, Inc. or its affiliates. All Rights Reserved.\n * SPDX-License-Identifier: Apache-2.0\n */\nimport GeneratorsJson from '../../generators.json' with { type: 'json' };\nimport {\n  type ConnectionKey,\n  SUPPORTED_CONNECTIONS,\n  type SUPPORTED_PROJECT_TYPES,\n} from './supported-connections.js';\n\n/**\n * How to scaffold each end of a connection, derived from the plugin's own\n * metadata rather than hand-listed.\n *\n * Every connection endpoint type is also a generator id, which is what makes the\n * derivation possible:\n *\n * - **kind** — a generator whose schema `required`s a `project` adds a component\n *   to an existing project; anything else creates a project of its own.\n * - **host** — a component lands in a project made by its language's base\n *   generator (`ts#project` / `py#project`).\n * - **generator + options** — a type whose own generator is `hidden` is reached\n *   through the public wrapper that selects it, found by matching the wrapper's\n *   enum values against the type's name (`ts#trpc-api` ← `ts#api\n *   --framework=trpc`). A visible generator is run directly.\n *\n * - **label** — the generator schema's own `x-label`.\n *\n * The result is that adding a generator and a connection for it needs no edit\n * here at all. The one thing still declared below is the option constraints,\n * which live as imperative guards inside each connection generator and so cannot\n * be read from metadata.\n */\n\n/**\n * Every type that can sit at either end of a connection: the project-level\n * types resolved by introspection, plus the component generator ids recorded in\n * component metadata.\n */\nexport type ConnectionEndpointType =\n  | (typeof SUPPORTED_PROJECT_TYPES)[number]\n  | (typeof SUPPORTED_CONNECTIONS)[number]['source']\n  | (typeof SUPPORTED_CONNECTIONS)[number]['target'];\n\n/**\n * Whether scaffolding an endpoint creates a project of its own, or adds a\n * component to a project that must already exist.\n */\nexport type ScaffoldKind = 'project' | 'component';\n\n/** How to scaffold one end of a connection from the CLI. */\nexport interface ScaffoldRecipe {\n  /** Human-readable name for this endpoint type. */\n  readonly label: string;\n  /** The generator id in `generators.json` that produces this endpoint. */\n  readonly generator: string;\n  /**\n   * Options that select this endpoint type from its generator, for generators\n   * producing more than one type (e.g. `framework`).\n   */\n  readonly options?: Readonly<Record<string, string>>;\n  /** Whether the generator creates a project or adds a component to one. */\n  readonly kind: ScaffoldKind;\n  /**\n   * The generator producing a project able to host this component, for\n   * `component` recipes. Components are added to an existing project, so one\n   * must be scaffolded first.\n   */\n  readonly host?: {\n    readonly generator: string;\n    readonly options?: Readonly<Record<string, string>>;\n    /**\n     * Whether the host project's name is referenced in snake_case. Python\n     * project names are snake_cased when qualified, TypeScript ones are not.\n     */\n    readonly snakeCaseName?: boolean;\n  };\n}\n\ntype GeneratorEntry = { schema: string; hidden?: boolean };\n/** The subset of JSON Schema the catalogue and the docs builder read. */\nexport type GeneratorSchema = {\n  /**\n   * Short display name for the thing this generator produces, used by the docs\n   * graph builder's palette. Set it on any generator that can take part in a\n   * connection.\n   */\n  'x-label'?: string;\n  properties?: Record<\n    string,\n    {\n      type?: string;\n      description?: string;\n      enum?: string[];\n      default?: unknown;\n      'x-priority'?: string;\n      /** The option values this option applies under. */\n      'x-when'?: Record<string, string | string[]>;\n      /** The same, per value, where one of an option's values applies sometimes. */\n      'x-value-when'?: Record<string, Record<string, string | string[]>>;\n    }\n  >;\n  required?: string[];\n};\n\ntype Schema = GeneratorSchema;\n\nconst GENERATORS = GeneratorsJson.generators as Record<string, GeneratorEntry>;\n\n/**\n * Resolves a generator's JSON schema by generator id.\n *\n * Injected rather than fixed because the two callers load files differently: the\n * plugin reads from disk (see `./schema-resolver`), while the docs site bundles\n * the schemas for the browser, where `node:fs` does not exist. Keeping this\n * module free of `node:fs` is what lets the browser import it at all.\n */\nexport type SchemaResolver = (generatorId: string) => Schema;\n\n/** The path `generators.json` records for a generator, relative to the plugin root. */\nexport const schemaPathOf = (generatorId: string): string => {\n  const entry = GENERATORS[generatorId];\n  if (!entry) {\n    throw new Error(\n      `Scaffold catalog: '${generatorId}' is not in generators.json`,\n    );\n  }\n  return entry.schema;\n};\n\n/** The language prefix of a generator id: `ts` for `ts#agent`, `` for `license`. */\nconst languageOf = (id: string): string =>\n  id.includes('#') ? id.slice(0, id.indexOf('#')) : '';\n\n/** Compare ids ignoring the separators that differ between wrapper and variant. */\nconst alike = (a: string, b: string): boolean =>\n  a.replace(/[^a-z0-9]/gi, '').toLowerCase() ===\n  b.replace(/[^a-z0-9]/gi, '').toLowerCase();\n\n/**\n * The public generator and option value that select a hidden endpoint type.\n *\n * A wrapper like `ts#api` produces several endpoint types, choosing between them\n * with an enum option: `--framework=trpc` yields `ts#trpc-api`. The pairing is\n * found by looking for a same-language public generator with an enum value that\n * reconstructs the endpoint's own name.\n */\nconst findWrapper = (\n  endpointType: string,\n  schemaOf: SchemaResolver,\n): { generator: string; options: Record<string, string> } | undefined => {\n  const language = languageOf(endpointType);\n  const name = endpointType.slice(endpointType.indexOf('#') + 1);\n\n  for (const [generatorId, entry] of Object.entries(GENERATORS)) {\n    if (entry.hidden) continue;\n    if (languageOf(generatorId) !== language) continue;\n    const wrapperName = generatorId.slice(generatorId.indexOf('#') + 1);\n\n    for (const [option, property] of Object.entries(\n      schemaOf(generatorId).properties ?? {},\n    )) {\n      for (const value of property.enum ?? []) {\n        // Either the value names the variant outright (`react` for\n        // `react-website`), or it qualifies the wrapper's own name\n        // (`trpc` + `api` for `trpc-api`).\n        if (alike(value, name) || alike(`${value}${wrapperName}`, name)) {\n          return { generator: generatorId, options: { [option]: value } };\n        }\n      }\n    }\n  }\n  return undefined;\n};\n\n/**\n * Derive the recipe for one endpoint type. Exported so a test can assert the\n * derivation against every type the plugin supports.\n */\nexport const deriveScaffoldRecipe = (\n  endpointType: string,\n  schemaOf: SchemaResolver,\n): ScaffoldRecipe => {\n  const own = GENERATORS[endpointType];\n  if (!own) {\n    throw new Error(\n      `Scaffold catalog: connection endpoint '${endpointType}' is not a generator id`,\n    );\n  }\n\n  // A hidden generator is an implementation detail reached through its public\n  // wrapper, which is what a user would actually run.\n  const wrapper = own.hidden ? findWrapper(endpointType, schemaOf) : undefined;\n  if (own.hidden && !wrapper) {\n    throw new Error(\n      `Scaffold catalog: '${endpointType}' is hidden and no public generator selects it`,\n    );\n  }\n\n  // A generator requiring a `project` adds a component to one; anything else\n  // creates its own project.\n  const kind: ScaffoldKind = (schemaOf(endpointType).required ?? []).includes(\n    'project',\n  )\n    ? 'component'\n    : 'project';\n\n  const language = languageOf(endpointType);\n  const hostGenerator = `${language}#project`;\n  if (kind === 'component' && !GENERATORS[hostGenerator]) {\n    throw new Error(\n      `Scaffold catalog: '${endpointType}' is a component but '${hostGenerator}' does not exist to host it`,\n    );\n  }\n\n  return {\n    // `x-label` is the short noun a palette entry needs; `title` and\n    // `description` are prose aimed at CLI prompts (\"Create a relational database\n    // project\"). A generator without one falls back to its id, so a new endpoint\n    // type still appears rather than being dropped.\n    label: schemaOf(endpointType)['x-label'] ?? endpointType,\n    generator: wrapper?.generator ?? endpointType,\n    ...(wrapper ? { options: wrapper.options } : {}),\n    kind,\n    ...(kind === 'component'\n      ? {\n          host: {\n            generator: hostGenerator,\n            // Only options the host's schema actually requires, so a base\n            // project generator gaining a required option is handled here.\n            options: Object.fromEntries(\n              (schemaOf(hostGenerator).required ?? [])\n                .filter((option) => option !== 'name')\n                .map((option) => {\n                  const property = schemaOf(hostGenerator).properties?.[option];\n                  const value = property?.default ?? property?.enum?.[0];\n                  if (value === undefined) {\n                    throw new Error(\n                      `Scaffold catalog: '${hostGenerator}' requires '${option}' but its schema offers no value to use`,\n                    );\n                  }\n                  return [option, String(value)];\n                }),\n            ),\n            // Python project names are snake_cased when Nx qualifies them.\n            snakeCaseName: language === 'py',\n          },\n        }\n      : {}),\n  };\n};\n\n/** Every endpoint type appearing at either end of a supported connection. */\nexport const CONNECTION_ENDPOINT_TYPES: readonly string[] = [\n  ...new Set(\n    SUPPORTED_CONNECTIONS.flatMap(({ source, target }) => [source, target]),\n  ),\n].sort();\n\n/**\n * How to scaffold each connection endpoint type, derived from the generator\n * metadata. A connection added to `SUPPORTED_CONNECTIONS` appears here with no\n * edit to this file.\n */\nexport const buildScaffoldRecipes = (\n  schemaOf: SchemaResolver,\n): Readonly<Record<string, ScaffoldRecipe>> =>\n  Object.fromEntries(\n    CONNECTION_ENDPOINT_TYPES.map((type) => [\n      type,\n      deriveScaffoldRecipe(type, schemaOf),\n    ]),\n  );\n\n/**\n * A requirement one end of a connection places on the other's options, mirroring\n * the guard the corresponding connection generator enforces.\n *\n * Declared rather than derived: each guard is an imperative `throw` inside its\n * connection generator, reachable only by running it. Recording them here lets a\n * caller choosing options up front check them first, and the paired test asserts\n * every entry names a real option with a value its enum allows.\n */\nexport interface ConnectionConstraint {\n  /** Which end of the connection the constrained option belongs to. */\n  readonly side: 'source' | 'target';\n  /** The generator option carrying the constrained value. */\n  readonly option: string;\n  /** The only value accepted, if the option is pinned to one. */\n  readonly equals?: string;\n  /** A value rejected, for options accepting all but one. */\n  readonly notEquals?: string;\n  /** Why the constraint exists, phrased for the user choosing the option. */\n  readonly reason: string;\n}\n\n/** Reusable constraint shapes, so the map below states each rule once. */\nconst AGENT_TO_AGENT: readonly ConnectionConstraint[] = [\n  {\n    side: 'target',\n    option: 'protocol',\n    equals: 'a2a',\n    reason: 'Only an A2A agent can be connected to another agent as a tool.',\n  },\n  {\n    side: 'target',\n    option: 'auth',\n    equals: 'iam',\n    reason: 'A2A agent connections authenticate with IAM.',\n  },\n];\n\nconst WEBSITE_TO_AGENT: readonly ConnectionConstraint[] = [\n  {\n    side: 'target',\n    option: 'protocol',\n    notEquals: 'a2a',\n    reason:\n      'A2A agents are reached by other agents, not by a website. Use the http or ag-ui protocol.',\n  },\n];\n\nconst AGENT_TO_MCP: readonly ConnectionConstraint[] = [\n  {\n    side: 'target',\n    option: 'auth',\n    equals: 'iam',\n    reason: 'An agent reaches an MCP server with IAM authentication.',\n  },\n];\n\n// The agent's own `auth` governs inbound requests to it, so it places no\n// requirement here — the agent signs its outbound call to the gateway with\n// SigV4 from its execution role either way.\nconst AGENT_TO_GATEWAY: readonly ConnectionConstraint[] = [\n  {\n    side: 'target',\n    option: 'auth',\n    equals: 'iam',\n    reason: 'Agent connections require the gateway to authenticate with IAM.',\n  },\n  {\n    side: 'target',\n    option: 'protocol',\n    equals: 'mcp',\n    reason:\n      'An agent reaches a gateway as an MCP client, so the gateway must serve the mcp protocol. Note a single gateway cannot both front an agent and be called by one, since fronting requires the http protocol.',\n  },\n];\n\nconst GATEWAY_TO_MCP: readonly ConnectionConstraint[] = [\n  {\n    side: 'source',\n    option: 'protocol',\n    equals: 'mcp',\n    reason:\n      'MCP server targets can only be attached to an mcp-protocol gateway.',\n  },\n  {\n    side: 'target',\n    option: 'auth',\n    equals: 'iam',\n    reason: 'A gateway reaches an MCP server target with IAM authentication.',\n  },\n];\n\nconst GATEWAY_TO_AGENT: readonly ConnectionConstraint[] = [\n  {\n    side: 'source',\n    option: 'protocol',\n    equals: 'http',\n    reason:\n      'Agent runtime targets can only be attached to an http-protocol gateway.',\n  },\n];\n\n/**\n * The option-level requirements each connection places on its endpoints.\n *\n * Only connections carrying a requirement appear. Keyed by `ConnectionKey`, so a\n * key that no longer names a supported connection is a compile error.\n */\nexport const CONNECTION_CONSTRAINTS = {\n  'ts#react-website -> ts#agent': WEBSITE_TO_AGENT,\n  'ts#react-website -> py#agent': WEBSITE_TO_AGENT,\n  'ts#agent -> ts#agent': AGENT_TO_AGENT,\n  'ts#agent -> py#agent': AGENT_TO_AGENT,\n  'py#agent -> ts#agent': AGENT_TO_AGENT,\n  'py#agent -> py#agent': AGENT_TO_AGENT,\n  'ts#agent -> ts#mcp-server': AGENT_TO_MCP,\n  'ts#agent -> py#mcp-server': AGENT_TO_MCP,\n  'py#agent -> ts#mcp-server': AGENT_TO_MCP,\n  'py#agent -> py#mcp-server': AGENT_TO_MCP,\n  'ts#agent -> agentcore-gateway': AGENT_TO_GATEWAY,\n  'py#agent -> agentcore-gateway': AGENT_TO_GATEWAY,\n  'ts#react-website -> agentcore-gateway': [\n    {\n      side: 'target',\n      option: 'protocol',\n      equals: 'http',\n      reason:\n        'A website connects to an http-protocol gateway, which proxies requests to its agent targets.',\n    },\n  ],\n  'agentcore-gateway -> ts#agent': [\n    ...GATEWAY_TO_AGENT,\n    {\n      side: 'target',\n      option: 'protocol',\n      notEquals: 'http',\n      reason:\n        'A TypeScript http agent serves tRPC over WebSocket, which AgentCore Gateway does not support. Use the ag-ui or a2a protocol.',\n    },\n  ],\n  'agentcore-gateway -> py#agent': GATEWAY_TO_AGENT,\n  'agentcore-gateway -> ts#mcp-server': GATEWAY_TO_MCP,\n  'agentcore-gateway -> py#mcp-server': GATEWAY_TO_MCP,\n  'agentcore-gateway -> agentcore-gateway': [\n    {\n      side: 'source',\n      option: 'protocol',\n      equals: 'mcp',\n      reason:\n        'A gateway is aggregated into another as an MCP target, so both must be mcp-protocol gateways.',\n    },\n    {\n      side: 'target',\n      option: 'protocol',\n      equals: 'mcp',\n      reason:\n        'A gateway is aggregated into another as an MCP target, so both must be mcp-protocol gateways.',\n    },\n    {\n      side: 'target',\n      option: 'auth',\n      equals: 'iam',\n      reason:\n        'The source gateway signs its request with IAM, so the target gateway must accept IAM.',\n    },\n  ],\n} as const satisfies Partial<\n  Record<ConnectionKey, readonly ConnectionConstraint[]>\n>;\n\n/**\n * A generator run automatically after an endpoint is scaffolded, adding something\n * that endpoint should always have.\n *\n * A website is only useful with authentication in front of it, and `ts#website`\n * does not add it — `ts#website#auth` is a separate follow-up generator. Declared\n * here so the docs graph builder emits it without hardcoding the pairing.\n */\nexport interface FollowUpGenerator {\n  /** The generator id to run after the endpoint's own. */\n  readonly generator: string;\n  /** Options to pass, beyond the `--project` naming the endpoint. */\n  readonly options?: Readonly<Record<string, string>>;\n  /** What it adds, for the emitted command's comment. */\n  readonly adds: string;\n}\n\n/**\n * Generators run automatically after an endpoint type is scaffolded, keyed by\n * endpoint type.\n */\nexport const ENDPOINT_FOLLOW_UPS: Readonly<\n  Record<string, readonly FollowUpGenerator[]>\n> = {\n  'ts#react-website': [\n    {\n      generator: 'ts#website#auth',\n      // `cognitoDomain` is derived from the npm scope and project name when\n      // omitted, so the command stays short.\n      adds: 'Cognito authentication',\n    },\n  ],\n};\n\n/**\n * An option value a connection works best against, without requiring it.\n *\n * Distinct from `CONNECTION_CONSTRAINTS`: a constraint is a rule the connection\n * generator enforces, whereas a preference is the setting most users want. A\n * React website can call an `http` agent perfectly well, but AG-UI is the\n * protocol built for driving a frontend, so that is what a new connection picks.\n *\n * A caller applies these only where the user has not chosen the option, so a\n * preference never overrides a deliberate decision.\n */\nexport interface ConnectionPreference {\n  readonly side: 'source' | 'target';\n  readonly option: string;\n  readonly value: string;\n  /** Why this is the better default, phrased for the user. */\n  readonly reason: string;\n}\n\n/** An agent target only attaches to an http gateway, an MCP server only to an mcp one. */\nconst GATEWAY_PREFERS_HTTP: ConnectionPreference = {\n  side: 'source',\n  option: 'protocol',\n  value: 'http',\n  reason:\n    'Agent runtime targets are proxied by an http gateway, so attaching an agent selects that protocol.',\n};\n\nconst GATEWAY_PREFERS_MCP: ConnectionPreference = {\n  side: 'source',\n  option: 'protocol',\n  value: 'mcp',\n  reason:\n    'MCP server targets are aggregated by an mcp gateway, so attaching an MCP server selects that protocol.',\n};\n\n/**\n * Preferred option values per connection. Keyed by `ConnectionKey`, so a key that\n * no longer names a supported connection is a compile error.\n */\nexport const CONNECTION_PREFERENCES = {\n  'ts#react-website -> ts#agent': [\n    {\n      side: 'target',\n      option: 'protocol',\n      value: 'ag-ui',\n      reason:\n        'AG-UI is the protocol built for driving a frontend, so a website connection selects it.',\n    },\n  ],\n  'ts#react-website -> py#agent': [\n    {\n      side: 'target',\n      option: 'protocol',\n      value: 'ag-ui',\n      reason:\n        'AG-UI is the protocol built for driving a frontend, so a website connection selects it.',\n    },\n  ],\n  // A gateway's protocol is decided by what it fronts, and the two are mutually\n  // exclusive: agent runtime targets need an http gateway, MCP server targets an\n  // mcp one. The gateway schema defaults to mcp, so only the agent side needs a\n  // preference — but both are stated, so whichever target the user attaches\n  // first settles the protocol.\n  'agentcore-gateway -> ts#agent': [GATEWAY_PREFERS_HTTP],\n  'agentcore-gateway -> py#agent': [GATEWAY_PREFERS_HTTP],\n  'agentcore-gateway -> ts#mcp-server': [GATEWAY_PREFERS_MCP],\n  'agentcore-gateway -> py#mcp-server': [GATEWAY_PREFERS_MCP],\n  'ts#react-website -> agentcore-gateway': [\n    {\n      side: 'target',\n      option: 'protocol',\n      value: 'http',\n      reason:\n        'A website reaches a gateway’s agent targets over path-based http routing, so the gateway serves the http protocol.',\n    },\n  ],\n} as const satisfies Partial<\n  Record<ConnectionKey, readonly ConnectionPreference[]>\n>;\n\n/**\n * Connections that must be generated after another, because the generator reads\n * state the earlier one records.\n *\n * The website→gateway generator publishes a route per agent already attached to\n * the gateway, reading them from the gateway project's connection metadata. Run\n * before the gateway→agent connections, it finds none and wires up nothing.\n *\n * Keyed by `ConnectionKey`, so a key that no longer names a supported connection\n * is a compile error.\n */\nexport const CONNECTION_ORDERING = {\n  'ts#react-website -> agentcore-gateway': {\n    after: ['agentcore-gateway -> ts#agent', 'agentcore-gateway -> py#agent'],\n    reason:\n      'The website connection publishes a route per agent attached to the gateway, so the gateway’s agents must be attached first.',\n  },\n} as const satisfies Partial<\n  Record<\n    ConnectionKey,\n    { readonly after: readonly ConnectionKey[]; readonly reason: string }\n  >\n>;\n\n/**\n * Connections whose source and target must be distinct projects, because the\n * connection generator refuses to wire a project to itself.\n */\nexport const SELF_CONNECTION_DISALLOWED = [\n  'agentcore-gateway -> agentcore-gateway',\n] as const satisfies readonly ConnectionKey[];\n"],"names":["GeneratorsJson","type","SUPPORTED_CONNECTIONS","GENERATORS","generators","schemaPathOf","generatorId","entry","Error","schema","languageOf","id","includes","slice","indexOf","alike","a","b","replace","toLowerCase","findWrapper","endpointType","schemaOf","language","name","Object","entries","hidden","wrapperName","option","property","properties","value","enum","generator","options","undefined","deriveScaffoldRecipe","own","wrapper","kind","required","hostGenerator","label","host","fromEntries","filter","map","default","String","snakeCaseName","CONNECTION_ENDPOINT_TYPES","Set","flatMap","source","target","sort","buildScaffoldRecipes","AGENT_TO_AGENT","side","equals","reason","WEBSITE_TO_AGENT","notEquals","AGENT_TO_MCP","AGENT_TO_GATEWAY","GATEWAY_TO_MCP","GATEWAY_TO_AGENT","CONNECTION_CONSTRAINTS","ENDPOINT_FOLLOW_UPS","adds","GATEWAY_PREFERS_HTTP","GATEWAY_PREFERS_MCP","CONNECTION_PREFERENCES","CONNECTION_ORDERING","after","SELF_CONNECTION_DISALLOWED"],"mappings":"AAAA;;;CAGC,GACD,OAAOA,oBAAoB,6BAA6B;IAAEC,MAAM;AAAO,EAAE;AACzE,SAEEC,qBAAqB,QAEhB,6BAA6B;AAmGpC,MAAMC,aAAaH,eAAeI,UAAU;AAY5C,qFAAqF,GACrF,OAAO,MAAMC,eAAe,CAACC;IAC3B,MAAMC,QAAQJ,UAAU,CAACG,YAAY;IACrC,IAAI,CAACC,OAAO;QACV,MAAM,IAAIC,MACR,CAAC,mBAAmB,EAAEF,YAAY,2BAA2B,CAAC;IAElE;IACA,OAAOC,MAAME,MAAM;AACrB,EAAE;AAEF,kFAAkF,GAClF,MAAMC,aAAa,CAACC,KAClBA,GAAGC,QAAQ,CAAC,OAAOD,GAAGE,KAAK,CAAC,GAAGF,GAAGG,OAAO,CAAC,QAAQ;AAEpD,iFAAiF,GACjF,MAAMC,QAAQ,CAACC,GAAWC,IACxBD,EAAEE,OAAO,CAAC,eAAe,IAAIC,WAAW,OACxCF,EAAEC,OAAO,CAAC,eAAe,IAAIC,WAAW;AAE1C;;;;;;;CAOC,GACD,MAAMC,cAAc,CAClBC,cACAC;IAEA,MAAMC,WAAWb,WAAWW;IAC5B,MAAMG,OAAOH,aAAaR,KAAK,CAACQ,aAAaP,OAAO,CAAC,OAAO;IAE5D,KAAK,MAAM,CAACR,aAAaC,MAAM,IAAIkB,OAAOC,OAAO,CAACvB,YAAa;QAC7D,IAAII,MAAMoB,MAAM,EAAE;QAClB,IAAIjB,WAAWJ,iBAAiBiB,UAAU;QAC1C,MAAMK,cAActB,YAAYO,KAAK,CAACP,YAAYQ,OAAO,CAAC,OAAO;QAEjE,KAAK,MAAM,CAACe,QAAQC,SAAS,IAAIL,OAAOC,OAAO,CAC7CJ,SAAShB,aAAayB,UAAU,IAAI,CAAC,GACpC;YACD,KAAK,MAAMC,SAASF,SAASG,IAAI,IAAI,EAAE,CAAE;gBACvC,2DAA2D;gBAC3D,2DAA2D;gBAC3D,mCAAmC;gBACnC,IAAIlB,MAAMiB,OAAOR,SAAST,MAAM,GAAGiB,QAAQJ,aAAa,EAAEJ,OAAO;oBAC/D,OAAO;wBAAEU,WAAW5B;wBAAa6B,SAAS;4BAAE,CAACN,OAAO,EAAEG;wBAAM;oBAAE;gBAChE;YACF;QACF;IACF;IACA,OAAOI;AACT;AAEA;;;CAGC,GACD,OAAO,MAAMC,uBAAuB,CAClChB,cACAC;IAEA,MAAMgB,MAAMnC,UAAU,CAACkB,aAAa;IACpC,IAAI,CAACiB,KAAK;QACR,MAAM,IAAI9B,MACR,CAAC,uCAAuC,EAAEa,aAAa,uBAAuB,CAAC;IAEnF;IAEA,4EAA4E;IAC5E,oDAAoD;IACpD,MAAMkB,UAAUD,IAAIX,MAAM,GAAGP,YAAYC,cAAcC,YAAYc;IACnE,IAAIE,IAAIX,MAAM,IAAI,CAACY,SAAS;QAC1B,MAAM,IAAI/B,MACR,CAAC,mBAAmB,EAAEa,aAAa,8CAA8C,CAAC;IAEtF;IAEA,2EAA2E;IAC3E,2BAA2B;IAC3B,MAAMmB,OAAqB,AAAClB,CAAAA,SAASD,cAAcoB,QAAQ,IAAI,EAAE,AAAD,EAAG7B,QAAQ,CACzE,aAEE,cACA;IAEJ,MAAMW,WAAWb,WAAWW;IAC5B,MAAMqB,gBAAgB,GAAGnB,SAAS,QAAQ,CAAC;IAC3C,IAAIiB,SAAS,eAAe,CAACrC,UAAU,CAACuC,cAAc,EAAE;QACtD,MAAM,IAAIlC,MACR,CAAC,mBAAmB,EAAEa,aAAa,sBAAsB,EAAEqB,cAAc,2BAA2B,CAAC;IAEzG;IAEA,OAAO;QACL,iEAAiE;QACjE,8EAA8E;QAC9E,6EAA6E;QAC7E,gDAAgD;QAChDC,OAAOrB,SAASD,aAAa,CAAC,UAAU,IAAIA;QAC5Ca,WAAWK,SAASL,aAAab;QACjC,GAAIkB,UAAU;YAAEJ,SAASI,QAAQJ,OAAO;QAAC,IAAI,CAAC,CAAC;QAC/CK;QACA,GAAIA,SAAS,cACT;YACEI,MAAM;gBACJV,WAAWQ;gBACX,8DAA8D;gBAC9D,+DAA+D;gBAC/DP,SAASV,OAAOoB,WAAW,CACzB,AAACvB,CAAAA,SAASoB,eAAeD,QAAQ,IAAI,EAAE,AAAD,EACnCK,MAAM,CAAC,CAACjB,SAAWA,WAAW,QAC9BkB,GAAG,CAAC,CAAClB;oBACJ,MAAMC,WAAWR,SAASoB,eAAeX,UAAU,EAAE,CAACF,OAAO;oBAC7D,MAAMG,QAAQF,UAAUkB,WAAWlB,UAAUG,MAAM,CAAC,EAAE;oBACtD,IAAID,UAAUI,WAAW;wBACvB,MAAM,IAAI5B,MACR,CAAC,mBAAmB,EAAEkC,cAAc,YAAY,EAAEb,OAAO,uCAAuC,CAAC;oBAErG;oBACA,OAAO;wBAACA;wBAAQoB,OAAOjB;qBAAO;gBAChC;gBAEJ,+DAA+D;gBAC/DkB,eAAe3B,aAAa;YAC9B;QACF,IACA,CAAC,CAAC;IACR;AACF,EAAE;AAEF,2EAA2E,GAC3E,OAAO,MAAM4B,4BAA+C;OACvD,IAAIC,IACLlD,sBAAsBmD,OAAO,CAAC,CAAC,EAAEC,MAAM,EAAEC,MAAM,EAAE,GAAK;YAACD;YAAQC;SAAO;CAEzE,CAACC,IAAI,GAAG;AAET;;;;CAIC,GACD,OAAO,MAAMC,uBAAuB,CAClCnC,WAEAG,OAAOoB,WAAW,CAChBM,0BAA0BJ,GAAG,CAAC,CAAC9C,OAAS;YACtCA;YACAoC,qBAAqBpC,MAAMqB;SAC5B,GACD;AAwBJ,wEAAwE,GACxE,MAAMoC,iBAAkD;IACtD;QACEC,MAAM;QACN9B,QAAQ;QACR+B,QAAQ;QACRC,QAAQ;IACV;IACA;QACEF,MAAM;QACN9B,QAAQ;QACR+B,QAAQ;QACRC,QAAQ;IACV;CACD;AAED,MAAMC,mBAAoD;IACxD;QACEH,MAAM;QACN9B,QAAQ;QACRkC,WAAW;QACXF,QACE;IACJ;CACD;AAED,MAAMG,eAAgD;IACpD;QACEL,MAAM;QACN9B,QAAQ;QACR+B,QAAQ;QACRC,QAAQ;IACV;CACD;AAED,yEAAyE;AACzE,2EAA2E;AAC3E,4CAA4C;AAC5C,MAAMI,mBAAoD;IACxD;QACEN,MAAM;QACN9B,QAAQ;QACR+B,QAAQ;QACRC,QAAQ;IACV;IACA;QACEF,MAAM;QACN9B,QAAQ;QACR+B,QAAQ;QACRC,QACE;IACJ;CACD;AAED,MAAMK,iBAAkD;IACtD;QACEP,MAAM;QACN9B,QAAQ;QACR+B,QAAQ;QACRC,QACE;IACJ;IACA;QACEF,MAAM;QACN9B,QAAQ;QACR+B,QAAQ;QACRC,QAAQ;IACV;CACD;AAED,MAAMM,mBAAoD;IACxD;QACER,MAAM;QACN9B,QAAQ;QACR+B,QAAQ;QACRC,QACE;IACJ;CACD;AAED;;;;;CAKC,GACD,OAAO,MAAMO,yBAAyB;IACpC,gCAAgCN;IAChC,gCAAgCA;IAChC,wBAAwBJ;IACxB,wBAAwBA;IACxB,wBAAwBA;IACxB,wBAAwBA;IACxB,6BAA6BM;IAC7B,6BAA6BA;IAC7B,6BAA6BA;IAC7B,6BAA6BA;IAC7B,iCAAiCC;IACjC,iCAAiCA;IACjC,yCAAyC;QACvC;YACEN,MAAM;YACN9B,QAAQ;YACR+B,QAAQ;YACRC,QACE;QACJ;KACD;IACD,iCAAiC;WAC5BM;QACH;YACER,MAAM;YACN9B,QAAQ;YACRkC,WAAW;YACXF,QACE;QACJ;KACD;IACD,iCAAiCM;IACjC,sCAAsCD;IACtC,sCAAsCA;IACtC,0CAA0C;QACxC;YACEP,MAAM;YACN9B,QAAQ;YACR+B,QAAQ;YACRC,QACE;QACJ;QACA;YACEF,MAAM;YACN9B,QAAQ;YACR+B,QAAQ;YACRC,QACE;QACJ;QACA;YACEF,MAAM;YACN9B,QAAQ;YACR+B,QAAQ;YACRC,QACE;QACJ;KACD;AACH,EAEE;AAmBF;;;CAGC,GACD,OAAO,MAAMQ,sBAET;IACF,oBAAoB;QAClB;YACEnC,WAAW;YACX,sEAAsE;YACtE,uCAAuC;YACvCoC,MAAM;QACR;KACD;AACH,EAAE;AAqBF,wFAAwF,GACxF,MAAMC,uBAA6C;IACjDZ,MAAM;IACN9B,QAAQ;IACRG,OAAO;IACP6B,QACE;AACJ;AAEA,MAAMW,sBAA4C;IAChDb,MAAM;IACN9B,QAAQ;IACRG,OAAO;IACP6B,QACE;AACJ;AAEA;;;CAGC,GACD,OAAO,MAAMY,yBAAyB;IACpC,gCAAgC;QAC9B;YACEd,MAAM;YACN9B,QAAQ;YACRG,OAAO;YACP6B,QACE;QACJ;KACD;IACD,gCAAgC;QAC9B;YACEF,MAAM;YACN9B,QAAQ;YACRG,OAAO;YACP6B,QACE;QACJ;KACD;IACD,8EAA8E;IAC9E,+EAA+E;IAC/E,8EAA8E;IAC9E,0EAA0E;IAC1E,8BAA8B;IAC9B,iCAAiC;QAACU;KAAqB;IACvD,iCAAiC;QAACA;KAAqB;IACvD,sCAAsC;QAACC;KAAoB;IAC3D,sCAAsC;QAACA;KAAoB;IAC3D,yCAAyC;QACvC;YACEb,MAAM;YACN9B,QAAQ;YACRG,OAAO;YACP6B,QACE;QACJ;KACD;AACH,EAEE;AAEF;;;;;;;;;;CAUC,GACD,OAAO,MAAMa,sBAAsB;IACjC,yCAAyC;QACvCC,OAAO;YAAC;YAAiC;SAAgC;QACzEd,QACE;IACJ;AACF,EAKE;AAEF;;;CAGC,GACD,OAAO,MAAMe,6BAA6B;IACxC;CACD,CAA6C"}
+{"version":3,"sources":["../../../../../packages/nx-plugin/src/connection/scaffold-catalog.ts"],"sourcesContent":["/**\n * Copyright Amazon.com, Inc. or its affiliates. All Rights Reserved.\n * SPDX-License-Identifier: Apache-2.0\n */\nimport GeneratorsJson from '../../generators.json' with { type: 'json' };\nimport {\n  type ConnectionKey,\n  SUPPORTED_CONNECTIONS,\n  type SUPPORTED_PROJECT_TYPES,\n} from './supported-connections.js';\n\n/**\n * How to scaffold each end of a connection, derived from the plugin's own\n * metadata rather than hand-listed.\n *\n * Every connection endpoint type is also a generator id, which is what makes the\n * derivation possible:\n *\n * - **kind** — a generator whose schema `required`s a `project` adds a component\n *   to an existing project; anything else creates a project of its own.\n * - **host** — a component lands in a project made by its language's base\n *   generator (`ts#project` / `py#project`).\n * - **generator + options** — a type whose own generator is `hidden` is reached\n *   through the public wrapper that selects it, found by matching the wrapper's\n *   enum values against the type's name (`ts#trpc-api` ← `ts#api\n *   --framework=trpc`). A visible generator is run directly.\n *\n * - **label** — the generator schema's own `x-label`.\n *\n * The result is that adding a generator and a connection for it needs no edit\n * here at all. The one thing still declared below is the option constraints,\n * which live as imperative guards inside each connection generator and so cannot\n * be read from metadata.\n */\n\n/**\n * Every type that can sit at either end of a connection: the project-level\n * types resolved by introspection, plus the component generator ids recorded in\n * component metadata.\n */\nexport type ConnectionEndpointType =\n  | (typeof SUPPORTED_PROJECT_TYPES)[number]\n  | (typeof SUPPORTED_CONNECTIONS)[number]['source']\n  | (typeof SUPPORTED_CONNECTIONS)[number]['target'];\n\n/**\n * Whether scaffolding an endpoint creates a project of its own, or adds a\n * component to a project that must already exist.\n */\nexport type ScaffoldKind = 'project' | 'component';\n\n/** How to scaffold one end of a connection from the CLI. */\nexport interface ScaffoldRecipe {\n  /** Human-readable name for this endpoint type. */\n  readonly label: string;\n  /** The generator id in `generators.json` that produces this endpoint. */\n  readonly generator: string;\n  /**\n   * Options that select this endpoint type from its generator, for generators\n   * producing more than one type (e.g. `framework`).\n   */\n  readonly options?: Readonly<Record<string, string>>;\n  /** Whether the generator creates a project or adds a component to one. */\n  readonly kind: ScaffoldKind;\n  /**\n   * The generator producing a project able to host this component, for\n   * `component` recipes. Components are added to an existing project, so one\n   * must be scaffolded first.\n   */\n  readonly host?: {\n    readonly generator: string;\n    readonly options?: Readonly<Record<string, string>>;\n    /**\n     * Whether the host project's name is referenced in snake_case. Python\n     * project names are snake_cased when qualified, TypeScript ones are not.\n     */\n    readonly snakeCaseName?: boolean;\n  };\n}\n\ntype GeneratorEntry = { schema: string; hidden?: boolean };\n/** The subset of JSON Schema the catalogue and the docs builder read. */\nexport type GeneratorSchema = {\n  /**\n   * Short display name for the thing this generator produces, used by the docs\n   * graph builder's palette. Set it on any generator that can take part in a\n   * connection.\n   */\n  'x-label'?: string;\n  properties?: Record<\n    string,\n    {\n      type?: string;\n      description?: string;\n      enum?: string[];\n      default?: unknown;\n      'x-priority'?: string;\n      /** The option values this option applies under. */\n      'x-when'?: Record<string, string | string[]>;\n      /** The same, per value, where one of an option's values applies sometimes. */\n      'x-value-when'?: Record<string, Record<string, string | string[]>>;\n    }\n  >;\n  required?: string[];\n};\n\ntype Schema = GeneratorSchema;\n\nconst GENERATORS = GeneratorsJson.generators as Record<string, GeneratorEntry>;\n\n/**\n * Resolves a generator's JSON schema by generator id.\n *\n * Injected rather than fixed because the two callers load files differently: the\n * plugin reads from disk (see `./schema-resolver`), while the docs site bundles\n * the schemas for the browser, where `node:fs` does not exist. Keeping this\n * module free of `node:fs` is what lets the browser import it at all.\n */\nexport type SchemaResolver = (generatorId: string) => Schema;\n\n/** The path `generators.json` records for a generator, relative to the plugin root. */\nexport const schemaPathOf = (generatorId: string): string => {\n  const entry = GENERATORS[generatorId];\n  if (!entry) {\n    throw new Error(\n      `Scaffold catalog: '${generatorId}' is not in generators.json`,\n    );\n  }\n  return entry.schema;\n};\n\n/** The language prefix of a generator id: `ts` for `ts#agent`, `` for `license`. */\nconst languageOf = (id: string): string =>\n  id.includes('#') ? id.slice(0, id.indexOf('#')) : '';\n\n/** Compare ids ignoring the separators that differ between wrapper and variant. */\nconst alike = (a: string, b: string): boolean =>\n  a.replace(/[^a-z0-9]/gi, '').toLowerCase() ===\n  b.replace(/[^a-z0-9]/gi, '').toLowerCase();\n\n/**\n * The public generator and option value that select a hidden endpoint type.\n *\n * A wrapper like `ts#api` produces several endpoint types, choosing between them\n * with an enum option: `--framework=trpc` yields `ts#trpc-api`. The pairing is\n * found by looking for a same-language public generator with an enum value that\n * reconstructs the endpoint's own name.\n */\nconst findWrapper = (\n  endpointType: string,\n  schemaOf: SchemaResolver,\n): { generator: string; options: Record<string, string> } | undefined => {\n  const language = languageOf(endpointType);\n  const name = endpointType.slice(endpointType.indexOf('#') + 1);\n\n  for (const [generatorId, entry] of Object.entries(GENERATORS)) {\n    if (entry.hidden) continue;\n    if (languageOf(generatorId) !== language) continue;\n    const wrapperName = generatorId.slice(generatorId.indexOf('#') + 1);\n\n    for (const [option, property] of Object.entries(\n      schemaOf(generatorId).properties ?? {},\n    )) {\n      for (const value of property.enum ?? []) {\n        // Either the value names the variant outright (`react` for\n        // `react-website`), or it qualifies the wrapper's own name\n        // (`trpc` + `api` for `trpc-api`).\n        if (alike(value, name) || alike(`${value}${wrapperName}`, name)) {\n          return { generator: generatorId, options: { [option]: value } };\n        }\n      }\n    }\n  }\n  return undefined;\n};\n\n/**\n * Derive the recipe for one endpoint type. Exported so a test can assert the\n * derivation against every type the plugin supports.\n */\nexport const deriveScaffoldRecipe = (\n  endpointType: string,\n  schemaOf: SchemaResolver,\n): ScaffoldRecipe => {\n  const own = GENERATORS[endpointType];\n  if (!own) {\n    throw new Error(\n      `Scaffold catalog: connection endpoint '${endpointType}' is not a generator id`,\n    );\n  }\n\n  // A hidden generator is an implementation detail reached through its public\n  // wrapper, which is what a user would actually run.\n  const wrapper = own.hidden ? findWrapper(endpointType, schemaOf) : undefined;\n  if (own.hidden && !wrapper) {\n    throw new Error(\n      `Scaffold catalog: '${endpointType}' is hidden and no public generator selects it`,\n    );\n  }\n\n  // A generator requiring a `project` adds a component to one; anything else\n  // creates its own project.\n  const kind: ScaffoldKind = (schemaOf(endpointType).required ?? []).includes(\n    'project',\n  )\n    ? 'component'\n    : 'project';\n\n  const language = languageOf(endpointType);\n  const hostGenerator = `${language}#project`;\n  if (kind === 'component' && !GENERATORS[hostGenerator]) {\n    throw new Error(\n      `Scaffold catalog: '${endpointType}' is a component but '${hostGenerator}' does not exist to host it`,\n    );\n  }\n\n  return {\n    // `x-label` is the short noun a palette entry needs; `title` and\n    // `description` are prose aimed at CLI prompts (\"Create a relational database\n    // project\"). A generator without one falls back to its id, so a new endpoint\n    // type still appears rather than being dropped.\n    label: schemaOf(endpointType)['x-label'] ?? endpointType,\n    generator: wrapper?.generator ?? endpointType,\n    ...(wrapper ? { options: wrapper.options } : {}),\n    kind,\n    ...(kind === 'component'\n      ? {\n          host: {\n            generator: hostGenerator,\n            // Only options the host's schema actually requires, so a base\n            // project generator gaining a required option is handled here.\n            options: Object.fromEntries(\n              (schemaOf(hostGenerator).required ?? [])\n                .filter((option) => option !== 'name')\n                .map((option) => {\n                  const property = schemaOf(hostGenerator).properties?.[option];\n                  const value = property?.default ?? property?.enum?.[0];\n                  if (value === undefined) {\n                    throw new Error(\n                      `Scaffold catalog: '${hostGenerator}' requires '${option}' but its schema offers no value to use`,\n                    );\n                  }\n                  return [option, String(value)];\n                }),\n            ),\n            // Python project names are snake_cased when Nx qualifies them.\n            snakeCaseName: language === 'py',\n          },\n        }\n      : {}),\n  };\n};\n\n/** Every endpoint type appearing at either end of a supported connection. */\nexport const CONNECTION_ENDPOINT_TYPES: readonly string[] = [\n  ...new Set(\n    SUPPORTED_CONNECTIONS.flatMap(({ source, target }) => [source, target]),\n  ),\n].sort();\n\n/**\n * How to scaffold each connection endpoint type, derived from the generator\n * metadata. A connection added to `SUPPORTED_CONNECTIONS` appears here with no\n * edit to this file.\n */\nexport const buildScaffoldRecipes = (\n  schemaOf: SchemaResolver,\n): Readonly<Record<string, ScaffoldRecipe>> =>\n  Object.fromEntries(\n    CONNECTION_ENDPOINT_TYPES.map((type) => [\n      type,\n      deriveScaffoldRecipe(type, schemaOf),\n    ]),\n  );\n\n/**\n * An option value one end of a connection must hold for a constraint to apply,\n * narrowing a rule that only binds some of a connection's configurations.\n */\nexport interface ConnectionConstraintCondition {\n  /** Which end of the connection the conditioning option belongs to. */\n  readonly side: 'source' | 'target';\n  /** The generator option whose value decides whether the constraint applies. */\n  readonly option: string;\n  /** The value that brings the constraint into effect. */\n  readonly equals: string;\n}\n\n/**\n * A requirement one end of a connection places on the other's options, mirroring\n * the guard the corresponding connection generator enforces.\n *\n * Declared rather than derived: each guard is an imperative `throw` inside its\n * connection generator, reachable only by running it. Recording them here lets a\n * caller choosing options up front check them first, and the paired test asserts\n * every entry names a real option with a value its enum allows.\n */\nexport interface ConnectionConstraint {\n  /** Which end of the connection the constrained option belongs to. */\n  readonly side: 'source' | 'target';\n  /** The generator option carrying the constrained value. */\n  readonly option: string;\n  /** The only value accepted, if the option is pinned to one. */\n  readonly equals?: string;\n  /** A value rejected, for options accepting all but one. */\n  readonly notEquals?: string;\n  /**\n   * Limits the rule to connections whose endpoints read this way. Absent for a\n   * rule binding every connection of its kind.\n   */\n  readonly when?: ConnectionConstraintCondition;\n  /** Why the constraint exists, phrased for the user choosing the option. */\n  readonly reason: string;\n}\n\n/** Reusable constraint shapes, so the map below states each rule once. */\nconst AGENT_TO_AGENT: readonly ConnectionConstraint[] = [\n  {\n    side: 'target',\n    option: 'protocol',\n    equals: 'a2a',\n    reason: 'Only an A2A agent can be connected to another agent as a tool.',\n  },\n  {\n    side: 'target',\n    option: 'auth',\n    equals: 'iam',\n    reason: 'A2A agent connections authenticate with IAM.',\n  },\n];\n\nconst WEBSITE_TO_AGENT: readonly ConnectionConstraint[] = [\n  {\n    side: 'target',\n    option: 'protocol',\n    notEquals: 'a2a',\n    reason:\n      'A2A agents are reached by other agents, not by a website. Use the http or ag-ui protocol.',\n  },\n];\n\nconst AGENT_TO_MCP: readonly ConnectionConstraint[] = [\n  {\n    side: 'target',\n    option: 'auth',\n    equals: 'iam',\n    reason: 'An agent reaches an MCP server with IAM authentication.',\n  },\n];\n\n// The agent's own `auth` governs inbound requests to it, so it places no\n// requirement here — the agent signs its outbound call to the gateway with\n// SigV4 from its execution role either way.\nconst AGENT_TO_GATEWAY: readonly ConnectionConstraint[] = [\n  {\n    side: 'target',\n    option: 'auth',\n    equals: 'iam',\n    reason: 'Agent connections require the gateway to authenticate with IAM.',\n  },\n  {\n    side: 'target',\n    option: 'protocol',\n    equals: 'mcp',\n    reason:\n      'An agent reaches a gateway as an MCP client, so the gateway must serve the mcp protocol. Note a single gateway cannot both front an agent and be called by one, since fronting requires the http protocol.',\n  },\n];\n\nconst GATEWAY_TO_MCP: readonly ConnectionConstraint[] = [\n  {\n    side: 'source',\n    option: 'protocol',\n    equals: 'mcp',\n    reason:\n      'MCP server targets can only be attached to an mcp-protocol gateway.',\n  },\n  {\n    side: 'target',\n    option: 'auth',\n    equals: 'iam',\n    reason: 'A gateway reaches an MCP server target with IAM authentication.',\n  },\n];\n\nconst GATEWAY_TO_AGENT: readonly ConnectionConstraint[] = [\n  {\n    side: 'source',\n    option: 'protocol',\n    equals: 'http',\n    reason:\n      'Agent runtime targets can only be attached to an http-protocol gateway.',\n  },\n  {\n    side: 'source',\n    option: 'auth',\n    equals: 'cognito',\n    when: { side: 'target', option: 'auth', equals: 'cognito' },\n    reason:\n      \"A Cognito agent authorizes on the caller's forwarded JWT, which only a Cognito gateway receives. An IAM gateway can front an IAM agent, which it invokes with its own role.\",\n  },\n];\n\n/**\n * The option-level requirements each connection places on its endpoints.\n *\n * Only connections carrying a requirement appear. Keyed by `ConnectionKey`, so a\n * key that no longer names a supported connection is a compile error.\n */\nexport const CONNECTION_CONSTRAINTS = {\n  'ts#react-website -> ts#agent': WEBSITE_TO_AGENT,\n  'ts#react-website -> py#agent': WEBSITE_TO_AGENT,\n  'ts#agent -> ts#agent': AGENT_TO_AGENT,\n  'ts#agent -> py#agent': AGENT_TO_AGENT,\n  'py#agent -> ts#agent': AGENT_TO_AGENT,\n  'py#agent -> py#agent': AGENT_TO_AGENT,\n  'ts#agent -> ts#mcp-server': AGENT_TO_MCP,\n  'ts#agent -> py#mcp-server': AGENT_TO_MCP,\n  'py#agent -> ts#mcp-server': AGENT_TO_MCP,\n  'py#agent -> py#mcp-server': AGENT_TO_MCP,\n  'ts#agent -> agentcore-gateway': AGENT_TO_GATEWAY,\n  'py#agent -> agentcore-gateway': AGENT_TO_GATEWAY,\n  'ts#react-website -> agentcore-gateway': [\n    {\n      side: 'target',\n      option: 'protocol',\n      equals: 'http',\n      reason:\n        'A website connects to an http-protocol gateway, which proxies requests to its agent targets.',\n    },\n  ],\n  'agentcore-gateway -> ts#agent': [\n    ...GATEWAY_TO_AGENT,\n    {\n      side: 'target',\n      option: 'protocol',\n      notEquals: 'http',\n      reason:\n        'A TypeScript http agent serves tRPC over WebSocket, which AgentCore Gateway does not support. Use the ag-ui or a2a protocol.',\n    },\n  ],\n  'agentcore-gateway -> py#agent': GATEWAY_TO_AGENT,\n  'agentcore-gateway -> ts#mcp-server': GATEWAY_TO_MCP,\n  'agentcore-gateway -> py#mcp-server': GATEWAY_TO_MCP,\n  'agentcore-gateway -> agentcore-gateway': [\n    {\n      side: 'source',\n      option: 'protocol',\n      equals: 'mcp',\n      reason:\n        'A gateway is aggregated into another as an MCP target, so both must be mcp-protocol gateways.',\n    },\n    {\n      side: 'target',\n      option: 'protocol',\n      equals: 'mcp',\n      reason:\n        'A gateway is aggregated into another as an MCP target, so both must be mcp-protocol gateways.',\n    },\n    {\n      side: 'target',\n      option: 'auth',\n      equals: 'iam',\n      reason:\n        'The source gateway signs its request with IAM, so the target gateway must accept IAM.',\n    },\n  ],\n} as const satisfies Partial<\n  Record<ConnectionKey, readonly ConnectionConstraint[]>\n>;\n\n/**\n * A generator run automatically after an endpoint is scaffolded, adding something\n * that endpoint should always have.\n *\n * A website is only useful with authentication in front of it, and `ts#website`\n * does not add it — `ts#website#auth` is a separate follow-up generator. Declared\n * here so the docs graph builder emits it without hardcoding the pairing.\n */\nexport interface FollowUpGenerator {\n  /** The generator id to run after the endpoint's own. */\n  readonly generator: string;\n  /** Options to pass, beyond the `--project` naming the endpoint. */\n  readonly options?: Readonly<Record<string, string>>;\n  /** What it adds, for the emitted command's comment. */\n  readonly adds: string;\n}\n\n/**\n * Generators run automatically after an endpoint type is scaffolded, keyed by\n * endpoint type.\n */\nexport const ENDPOINT_FOLLOW_UPS: Readonly<\n  Record<string, readonly FollowUpGenerator[]>\n> = {\n  'ts#react-website': [\n    {\n      generator: 'ts#website#auth',\n      // `cognitoDomain` is derived from the npm scope and project name when\n      // omitted, so the command stays short.\n      adds: 'Cognito authentication',\n    },\n  ],\n};\n\n/**\n * An option value a connection works best against, without requiring it.\n *\n * Distinct from `CONNECTION_CONSTRAINTS`: a constraint is a rule the connection\n * generator enforces, whereas a preference is the setting most users want. A\n * React website can call an `http` agent perfectly well, but AG-UI is the\n * protocol built for driving a frontend, so that is what a new connection picks.\n *\n * A caller applies these only where the user has not chosen the option, so a\n * preference never overrides a deliberate decision.\n */\nexport interface ConnectionPreference {\n  readonly side: 'source' | 'target';\n  readonly option: string;\n  readonly value: string;\n  /** Why this is the better default, phrased for the user. */\n  readonly reason: string;\n}\n\n/** An agent target only attaches to an http gateway, an MCP server only to an mcp one. */\nconst GATEWAY_PREFERS_HTTP: ConnectionPreference = {\n  side: 'source',\n  option: 'protocol',\n  value: 'http',\n  reason:\n    'Agent runtime targets are proxied by an http gateway, so attaching an agent selects that protocol.',\n};\n\nconst GATEWAY_PREFERS_MCP: ConnectionPreference = {\n  side: 'source',\n  option: 'protocol',\n  value: 'mcp',\n  reason:\n    'MCP server targets are aggregated by an mcp gateway, so attaching an MCP server selects that protocol.',\n};\n\n/**\n * Preferred option values per connection. Keyed by `ConnectionKey`, so a key that\n * no longer names a supported connection is a compile error.\n */\nexport const CONNECTION_PREFERENCES = {\n  'ts#react-website -> ts#agent': [\n    {\n      side: 'target',\n      option: 'protocol',\n      value: 'ag-ui',\n      reason:\n        'AG-UI is the protocol built for driving a frontend, so a website connection selects it.',\n    },\n  ],\n  'ts#react-website -> py#agent': [\n    {\n      side: 'target',\n      option: 'protocol',\n      value: 'ag-ui',\n      reason:\n        'AG-UI is the protocol built for driving a frontend, so a website connection selects it.',\n    },\n  ],\n  // A gateway's protocol is decided by what it fronts, and the two are mutually\n  // exclusive: agent runtime targets need an http gateway, MCP server targets an\n  // mcp one. The gateway schema defaults to mcp, so only the agent side needs a\n  // preference — but both are stated, so whichever target the user attaches\n  // first settles the protocol.\n  'agentcore-gateway -> ts#agent': [GATEWAY_PREFERS_HTTP],\n  'agentcore-gateway -> py#agent': [GATEWAY_PREFERS_HTTP],\n  'agentcore-gateway -> ts#mcp-server': [GATEWAY_PREFERS_MCP],\n  'agentcore-gateway -> py#mcp-server': [GATEWAY_PREFERS_MCP],\n  'ts#react-website -> agentcore-gateway': [\n    {\n      side: 'target',\n      option: 'protocol',\n      value: 'http',\n      reason:\n        'A website reaches a gateway’s agent targets over path-based http routing, so the gateway serves the http protocol.',\n    },\n  ],\n} as const satisfies Partial<\n  Record<ConnectionKey, readonly ConnectionPreference[]>\n>;\n\n/**\n * Connections that must be generated after another, because the generator reads\n * state the earlier one records.\n *\n * The website→gateway generator publishes a route per agent already attached to\n * the gateway, reading them from the gateway project's connection metadata. Run\n * before the gateway→agent connections, it finds none and wires up nothing.\n *\n * Keyed by `ConnectionKey`, so a key that no longer names a supported connection\n * is a compile error.\n */\nexport const CONNECTION_ORDERING = {\n  'ts#react-website -> agentcore-gateway': {\n    after: ['agentcore-gateway -> ts#agent', 'agentcore-gateway -> py#agent'],\n    reason:\n      'The website connection publishes a route per agent attached to the gateway, so the gateway’s agents must be attached first.',\n  },\n} as const satisfies Partial<\n  Record<\n    ConnectionKey,\n    { readonly after: readonly ConnectionKey[]; readonly reason: string }\n  >\n>;\n\n/**\n * Connections whose source and target must be distinct projects, because the\n * connection generator refuses to wire a project to itself.\n */\nexport const SELF_CONNECTION_DISALLOWED = [\n  'agentcore-gateway -> agentcore-gateway',\n] as const satisfies readonly ConnectionKey[];\n"],"names":["GeneratorsJson","type","SUPPORTED_CONNECTIONS","GENERATORS","generators","schemaPathOf","generatorId","entry","Error","schema","languageOf","id","includes","slice","indexOf","alike","a","b","replace","toLowerCase","findWrapper","endpointType","schemaOf","language","name","Object","entries","hidden","wrapperName","option","property","properties","value","enum","generator","options","undefined","deriveScaffoldRecipe","own","wrapper","kind","required","hostGenerator","label","host","fromEntries","filter","map","default","String","snakeCaseName","CONNECTION_ENDPOINT_TYPES","Set","flatMap","source","target","sort","buildScaffoldRecipes","AGENT_TO_AGENT","side","equals","reason","WEBSITE_TO_AGENT","notEquals","AGENT_TO_MCP","AGENT_TO_GATEWAY","GATEWAY_TO_MCP","GATEWAY_TO_AGENT","when","CONNECTION_CONSTRAINTS","ENDPOINT_FOLLOW_UPS","adds","GATEWAY_PREFERS_HTTP","GATEWAY_PREFERS_MCP","CONNECTION_PREFERENCES","CONNECTION_ORDERING","after","SELF_CONNECTION_DISALLOWED"],"mappings":"AAAA;;;CAGC,GACD,OAAOA,oBAAoB,6BAA6B;IAAEC,MAAM;AAAO,EAAE;AACzE,SAEEC,qBAAqB,QAEhB,6BAA6B;AAmGpC,MAAMC,aAAaH,eAAeI,UAAU;AAY5C,qFAAqF,GACrF,OAAO,MAAMC,eAAe,CAACC;IAC3B,MAAMC,QAAQJ,UAAU,CAACG,YAAY;IACrC,IAAI,CAACC,OAAO;QACV,MAAM,IAAIC,MACR,CAAC,mBAAmB,EAAEF,YAAY,2BAA2B,CAAC;IAElE;IACA,OAAOC,MAAME,MAAM;AACrB,EAAE;AAEF,kFAAkF,GAClF,MAAMC,aAAa,CAACC,KAClBA,GAAGC,QAAQ,CAAC,OAAOD,GAAGE,KAAK,CAAC,GAAGF,GAAGG,OAAO,CAAC,QAAQ;AAEpD,iFAAiF,GACjF,MAAMC,QAAQ,CAACC,GAAWC,IACxBD,EAAEE,OAAO,CAAC,eAAe,IAAIC,WAAW,OACxCF,EAAEC,OAAO,CAAC,eAAe,IAAIC,WAAW;AAE1C;;;;;;;CAOC,GACD,MAAMC,cAAc,CAClBC,cACAC;IAEA,MAAMC,WAAWb,WAAWW;IAC5B,MAAMG,OAAOH,aAAaR,KAAK,CAACQ,aAAaP,OAAO,CAAC,OAAO;IAE5D,KAAK,MAAM,CAACR,aAAaC,MAAM,IAAIkB,OAAOC,OAAO,CAACvB,YAAa;QAC7D,IAAII,MAAMoB,MAAM,EAAE;QAClB,IAAIjB,WAAWJ,iBAAiBiB,UAAU;QAC1C,MAAMK,cAActB,YAAYO,KAAK,CAACP,YAAYQ,OAAO,CAAC,OAAO;QAEjE,KAAK,MAAM,CAACe,QAAQC,SAAS,IAAIL,OAAOC,OAAO,CAC7CJ,SAAShB,aAAayB,UAAU,IAAI,CAAC,GACpC;YACD,KAAK,MAAMC,SAASF,SAASG,IAAI,IAAI,EAAE,CAAE;gBACvC,2DAA2D;gBAC3D,2DAA2D;gBAC3D,mCAAmC;gBACnC,IAAIlB,MAAMiB,OAAOR,SAAST,MAAM,GAAGiB,QAAQJ,aAAa,EAAEJ,OAAO;oBAC/D,OAAO;wBAAEU,WAAW5B;wBAAa6B,SAAS;4BAAE,CAACN,OAAO,EAAEG;wBAAM;oBAAE;gBAChE;YACF;QACF;IACF;IACA,OAAOI;AACT;AAEA;;;CAGC,GACD,OAAO,MAAMC,uBAAuB,CAClChB,cACAC;IAEA,MAAMgB,MAAMnC,UAAU,CAACkB,aAAa;IACpC,IAAI,CAACiB,KAAK;QACR,MAAM,IAAI9B,MACR,CAAC,uCAAuC,EAAEa,aAAa,uBAAuB,CAAC;IAEnF;IAEA,4EAA4E;IAC5E,oDAAoD;IACpD,MAAMkB,UAAUD,IAAIX,MAAM,GAAGP,YAAYC,cAAcC,YAAYc;IACnE,IAAIE,IAAIX,MAAM,IAAI,CAACY,SAAS;QAC1B,MAAM,IAAI/B,MACR,CAAC,mBAAmB,EAAEa,aAAa,8CAA8C,CAAC;IAEtF;IAEA,2EAA2E;IAC3E,2BAA2B;IAC3B,MAAMmB,OAAqB,AAAClB,CAAAA,SAASD,cAAcoB,QAAQ,IAAI,EAAE,AAAD,EAAG7B,QAAQ,CACzE,aAEE,cACA;IAEJ,MAAMW,WAAWb,WAAWW;IAC5B,MAAMqB,gBAAgB,GAAGnB,SAAS,QAAQ,CAAC;IAC3C,IAAIiB,SAAS,eAAe,CAACrC,UAAU,CAACuC,cAAc,EAAE;QACtD,MAAM,IAAIlC,MACR,CAAC,mBAAmB,EAAEa,aAAa,sBAAsB,EAAEqB,cAAc,2BAA2B,CAAC;IAEzG;IAEA,OAAO;QACL,iEAAiE;QACjE,8EAA8E;QAC9E,6EAA6E;QAC7E,gDAAgD;QAChDC,OAAOrB,SAASD,aAAa,CAAC,UAAU,IAAIA;QAC5Ca,WAAWK,SAASL,aAAab;QACjC,GAAIkB,UAAU;YAAEJ,SAASI,QAAQJ,OAAO;QAAC,IAAI,CAAC,CAAC;QAC/CK;QACA,GAAIA,SAAS,cACT;YACEI,MAAM;gBACJV,WAAWQ;gBACX,8DAA8D;gBAC9D,+DAA+D;gBAC/DP,SAASV,OAAOoB,WAAW,CACzB,AAACvB,CAAAA,SAASoB,eAAeD,QAAQ,IAAI,EAAE,AAAD,EACnCK,MAAM,CAAC,CAACjB,SAAWA,WAAW,QAC9BkB,GAAG,CAAC,CAAClB;oBACJ,MAAMC,WAAWR,SAASoB,eAAeX,UAAU,EAAE,CAACF,OAAO;oBAC7D,MAAMG,QAAQF,UAAUkB,WAAWlB,UAAUG,MAAM,CAAC,EAAE;oBACtD,IAAID,UAAUI,WAAW;wBACvB,MAAM,IAAI5B,MACR,CAAC,mBAAmB,EAAEkC,cAAc,YAAY,EAAEb,OAAO,uCAAuC,CAAC;oBAErG;oBACA,OAAO;wBAACA;wBAAQoB,OAAOjB;qBAAO;gBAChC;gBAEJ,+DAA+D;gBAC/DkB,eAAe3B,aAAa;YAC9B;QACF,IACA,CAAC,CAAC;IACR;AACF,EAAE;AAEF,2EAA2E,GAC3E,OAAO,MAAM4B,4BAA+C;OACvD,IAAIC,IACLlD,sBAAsBmD,OAAO,CAAC,CAAC,EAAEC,MAAM,EAAEC,MAAM,EAAE,GAAK;YAACD;YAAQC;SAAO;CAEzE,CAACC,IAAI,GAAG;AAET;;;;CAIC,GACD,OAAO,MAAMC,uBAAuB,CAClCnC,WAEAG,OAAOoB,WAAW,CAChBM,0BAA0BJ,GAAG,CAAC,CAAC9C,OAAS;YACtCA;YACAoC,qBAAqBpC,MAAMqB;SAC5B,GACD;AA0CJ,wEAAwE,GACxE,MAAMoC,iBAAkD;IACtD;QACEC,MAAM;QACN9B,QAAQ;QACR+B,QAAQ;QACRC,QAAQ;IACV;IACA;QACEF,MAAM;QACN9B,QAAQ;QACR+B,QAAQ;QACRC,QAAQ;IACV;CACD;AAED,MAAMC,mBAAoD;IACxD;QACEH,MAAM;QACN9B,QAAQ;QACRkC,WAAW;QACXF,QACE;IACJ;CACD;AAED,MAAMG,eAAgD;IACpD;QACEL,MAAM;QACN9B,QAAQ;QACR+B,QAAQ;QACRC,QAAQ;IACV;CACD;AAED,yEAAyE;AACzE,2EAA2E;AAC3E,4CAA4C;AAC5C,MAAMI,mBAAoD;IACxD;QACEN,MAAM;QACN9B,QAAQ;QACR+B,QAAQ;QACRC,QAAQ;IACV;IACA;QACEF,MAAM;QACN9B,QAAQ;QACR+B,QAAQ;QACRC,QACE;IACJ;CACD;AAED,MAAMK,iBAAkD;IACtD;QACEP,MAAM;QACN9B,QAAQ;QACR+B,QAAQ;QACRC,QACE;IACJ;IACA;QACEF,MAAM;QACN9B,QAAQ;QACR+B,QAAQ;QACRC,QAAQ;IACV;CACD;AAED,MAAMM,mBAAoD;IACxD;QACER,MAAM;QACN9B,QAAQ;QACR+B,QAAQ;QACRC,QACE;IACJ;IACA;QACEF,MAAM;QACN9B,QAAQ;QACR+B,QAAQ;QACRQ,MAAM;YAAET,MAAM;YAAU9B,QAAQ;YAAQ+B,QAAQ;QAAU;QAC1DC,QACE;IACJ;CACD;AAED;;;;;CAKC,GACD,OAAO,MAAMQ,yBAAyB;IACpC,gCAAgCP;IAChC,gCAAgCA;IAChC,wBAAwBJ;IACxB,wBAAwBA;IACxB,wBAAwBA;IACxB,wBAAwBA;IACxB,6BAA6BM;IAC7B,6BAA6BA;IAC7B,6BAA6BA;IAC7B,6BAA6BA;IAC7B,iCAAiCC;IACjC,iCAAiCA;IACjC,yCAAyC;QACvC;YACEN,MAAM;YACN9B,QAAQ;YACR+B,QAAQ;YACRC,QACE;QACJ;KACD;IACD,iCAAiC;WAC5BM;QACH;YACER,MAAM;YACN9B,QAAQ;YACRkC,WAAW;YACXF,QACE;QACJ;KACD;IACD,iCAAiCM;IACjC,sCAAsCD;IACtC,sCAAsCA;IACtC,0CAA0C;QACxC;YACEP,MAAM;YACN9B,QAAQ;YACR+B,QAAQ;YACRC,QACE;QACJ;QACA;YACEF,MAAM;YACN9B,QAAQ;YACR+B,QAAQ;YACRC,QACE;QACJ;QACA;YACEF,MAAM;YACN9B,QAAQ;YACR+B,QAAQ;YACRC,QACE;QACJ;KACD;AACH,EAEE;AAmBF;;;CAGC,GACD,OAAO,MAAMS,sBAET;IACF,oBAAoB;QAClB;YACEpC,WAAW;YACX,sEAAsE;YACtE,uCAAuC;YACvCqC,MAAM;QACR;KACD;AACH,EAAE;AAqBF,wFAAwF,GACxF,MAAMC,uBAA6C;IACjDb,MAAM;IACN9B,QAAQ;IACRG,OAAO;IACP6B,QACE;AACJ;AAEA,MAAMY,sBAA4C;IAChDd,MAAM;IACN9B,QAAQ;IACRG,OAAO;IACP6B,QACE;AACJ;AAEA;;;CAGC,GACD,OAAO,MAAMa,yBAAyB;IACpC,gCAAgC;QAC9B;YACEf,MAAM;YACN9B,QAAQ;YACRG,OAAO;YACP6B,QACE;QACJ;KACD;IACD,gCAAgC;QAC9B;YACEF,MAAM;YACN9B,QAAQ;YACRG,OAAO;YACP6B,QACE;QACJ;KACD;IACD,8EAA8E;IAC9E,+EAA+E;IAC/E,8EAA8E;IAC9E,0EAA0E;IAC1E,8BAA8B;IAC9B,iCAAiC;QAACW;KAAqB;IACvD,iCAAiC;QAACA;KAAqB;IACvD,sCAAsC;QAACC;KAAoB;IAC3D,sCAAsC;QAACA;KAAoB;IAC3D,yCAAyC;QACvC;YACEd,MAAM;YACN9B,QAAQ;YACRG,OAAO;YACP6B,QACE;QACJ;KACD;AACH,EAEE;AAEF;;;;;;;;;;CAUC,GACD,OAAO,MAAMc,sBAAsB;IACjC,yCAAyC;QACvCC,OAAO;YAAC;YAAiC;SAAgC;QACzEf,QACE;IACJ;AACF,EAKE;AAEF;;;CAGC,GACD,OAAO,MAAMgB,6BAA6B;IACxC;CACD,CAA6C"}

package/src/migrations/latest/terraform-harness-environment-variables/metadata.json

@@ -0,0 +1,3 @@
+{
+  "description": "Send an empty map rather than null for a vended Terraform AgentCore Harness module's environment_variables, so the first apply does not fail after creating the Harness"
+}

package/src/migrations/latest/terraform-harness-environment-variables/migration.d.ts

@@ -0,0 +1,6 @@
+/**
+ * Copyright Amazon.com, Inc. or its affiliates. All Rights Reserved.
+ * SPDX-License-Identifier: Apache-2.0
+ */
+import { type MigrationReturnObject, type Tree } from '@nx/devkit';
+export default function migration(tree: Tree): Promise<MigrationReturnObject>;

package/src/migrations/latest/terraform-harness-environment-variables/migration.js

@@ -0,0 +1,54 @@
+/**
+ * Copyright Amazon.com, Inc. or its affiliates. All Rights Reserved.
+ * SPDX-License-Identifier: Apache-2.0
+ */ import { joinPathFragments } from "@nx/devkit";
+import { formatFilesInSubtree } from "../../../utils/format.js";
+import { PACKAGES_DIR, SHARED_TERRAFORM_DIR } from "../../../utils/shared-constructs-constants.js";
+/**
+ * Stop each vended Terraform AgentCore Harness app module
+ * (`app/harnesses/<name>/<name>.tf`) sending a null `environment_variables`.
+ *
+ * The service stores no environment variables as an empty map and returns one,
+ * so a null fails the apply with "inconsistent values for sensitive attribute"
+ * once the Harness has already been created, leaving it tainted. Every
+ * subsequent apply fails the same way.
+ *
+ * Modules whose assignment has been edited are left untouched and reported via
+ * `nextSteps`.
+ */ const TERRAFORM_HARNESS_APP_DIR = `${PACKAGES_DIR}/${SHARED_TERRAFORM_DIR}/src/app/harnesses`;
+/** The assignment the generator used to write. */ const NULLABLE_ASSIGNMENT = 'environment_variables = var.environment_variables';
+/** What it becomes, so the value sent matches what the service returns. */ const COALESCED_ASSIGNMENT = 'environment_variables = coalesce(var.environment_variables, {})';
+const divergedMessage = (filePath)=>`${filePath}: its environment_variables assignment has been edited, so it was left as it is. Change it to \`${COALESCED_ASSIGNMENT}\` — the AgentCore service returns an empty map when a Harness has no environment variables, and sending null fails the apply after the Harness has been created.`;
+export default async function migration(tree) {
+    const nextSteps = [];
+    let migrated = false;
+    if (!tree.exists(TERRAFORM_HARNESS_APP_DIR)) {
+        return {
+            nextSteps
+        }; // This workspace has no Terraform harness modules.
+    }
+    for (const dirName of tree.children(TERRAFORM_HARNESS_APP_DIR)){
+        const filePath = joinPathFragments(TERRAFORM_HARNESS_APP_DIR, dirName, `${dirName}.tf`);
+        if (!tree.exists(filePath)) {
+            continue; // Not a harness app module directory.
+        }
+        const contents = tree.read(filePath, 'utf-8') ?? '';
+        if (contents.includes(COALESCED_ASSIGNMENT)) {
+            continue; // Already migrated, so a re-run is a no-op.
+        }
+        if (!contents.includes(NULLABLE_ASSIGNMENT)) {
+            nextSteps.push(divergedMessage(filePath));
+            continue;
+        }
+        tree.write(filePath, contents.replace(NULLABLE_ASSIGNMENT, COALESCED_ASSIGNMENT));
+        migrated = true;
+    }
+    if (migrated) {
+        await formatFilesInSubtree(tree, TERRAFORM_HARNESS_APP_DIR);
+    }
+    return {
+        nextSteps
+    };
+}
+
+//# sourceMappingURL=migration.js.map

package/src/migrations/latest/terraform-harness-environment-variables/migration.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../../../../../../../packages/nx-plugin/src/migrations/latest/terraform-harness-environment-variables/migration.ts"],"sourcesContent":["/**\n * Copyright Amazon.com, Inc. or its affiliates. All Rights Reserved.\n * SPDX-License-Identifier: Apache-2.0\n */\nimport {\n  joinPathFragments,\n  type MigrationReturnObject,\n  type Tree,\n} from '@nx/devkit';\nimport { formatFilesInSubtree } from '../../../utils/format.js';\nimport {\n  PACKAGES_DIR,\n  SHARED_TERRAFORM_DIR,\n} from '../../../utils/shared-constructs-constants.js';\n\n/**\n * Stop each vended Terraform AgentCore Harness app module\n * (`app/harnesses/<name>/<name>.tf`) sending a null `environment_variables`.\n *\n * The service stores no environment variables as an empty map and returns one,\n * so a null fails the apply with \"inconsistent values for sensitive attribute\"\n * once the Harness has already been created, leaving it tainted. Every\n * subsequent apply fails the same way.\n *\n * Modules whose assignment has been edited are left untouched and reported via\n * `nextSteps`.\n */\n\nconst TERRAFORM_HARNESS_APP_DIR = `${PACKAGES_DIR}/${SHARED_TERRAFORM_DIR}/src/app/harnesses`;\n\n/** The assignment the generator used to write. */\nconst NULLABLE_ASSIGNMENT = 'environment_variables = var.environment_variables';\n\n/** What it becomes, so the value sent matches what the service returns. */\nconst COALESCED_ASSIGNMENT =\n  'environment_variables = coalesce(var.environment_variables, {})';\n\nconst divergedMessage = (filePath: string) =>\n  `${filePath}: its environment_variables assignment has been edited, so it was left as it is. Change it to \\`${COALESCED_ASSIGNMENT}\\` — the AgentCore service returns an empty map when a Harness has no environment variables, and sending null fails the apply after the Harness has been created.`;\n\nexport default async function migration(\n  tree: Tree,\n): Promise<MigrationReturnObject> {\n  const nextSteps: string[] = [];\n  let migrated = false;\n\n  if (!tree.exists(TERRAFORM_HARNESS_APP_DIR)) {\n    return { nextSteps }; // This workspace has no Terraform harness modules.\n  }\n\n  for (const dirName of tree.children(TERRAFORM_HARNESS_APP_DIR)) {\n    const filePath = joinPathFragments(\n      TERRAFORM_HARNESS_APP_DIR,\n      dirName,\n      `${dirName}.tf`,\n    );\n    if (!tree.exists(filePath)) {\n      continue; // Not a harness app module directory.\n    }\n\n    const contents = tree.read(filePath, 'utf-8') ?? '';\n\n    if (contents.includes(COALESCED_ASSIGNMENT)) {\n      continue; // Already migrated, so a re-run is a no-op.\n    }\n\n    if (!contents.includes(NULLABLE_ASSIGNMENT)) {\n      nextSteps.push(divergedMessage(filePath));\n      continue;\n    }\n\n    tree.write(\n      filePath,\n      contents.replace(NULLABLE_ASSIGNMENT, COALESCED_ASSIGNMENT),\n    );\n    migrated = true;\n  }\n\n  if (migrated) {\n    await formatFilesInSubtree(tree, TERRAFORM_HARNESS_APP_DIR);\n  }\n\n  return { nextSteps };\n}\n"],"names":["joinPathFragments","formatFilesInSubtree","PACKAGES_DIR","SHARED_TERRAFORM_DIR","TERRAFORM_HARNESS_APP_DIR","NULLABLE_ASSIGNMENT","COALESCED_ASSIGNMENT","divergedMessage","filePath","migration","tree","nextSteps","migrated","exists","dirName","children","contents","read","includes","push","write","replace"],"mappings":"AAAA;;;CAGC,GACD,SACEA,iBAAiB,QAGZ,aAAa;AACpB,SAASC,oBAAoB,QAAQ,2BAA2B;AAChE,SACEC,YAAY,EACZC,oBAAoB,QACf,gDAAgD;AAEvD;;;;;;;;;;;CAWC,GAED,MAAMC,4BAA4B,GAAGF,aAAa,CAAC,EAAEC,qBAAqB,kBAAkB,CAAC;AAE7F,gDAAgD,GAChD,MAAME,sBAAsB;AAE5B,yEAAyE,GACzE,MAAMC,uBACJ;AAEF,MAAMC,kBAAkB,CAACC,WACvB,GAAGA,SAAS,gGAAgG,EAAEF,qBAAqB,iKAAiK,CAAC;AAEvS,eAAe,eAAeG,UAC5BC,IAAU;IAEV,MAAMC,YAAsB,EAAE;IAC9B,IAAIC,WAAW;IAEf,IAAI,CAACF,KAAKG,MAAM,CAACT,4BAA4B;QAC3C,OAAO;YAAEO;QAAU,GAAG,mDAAmD;IAC3E;IAEA,KAAK,MAAMG,WAAWJ,KAAKK,QAAQ,CAACX,2BAA4B;QAC9D,MAAMI,WAAWR,kBACfI,2BACAU,SACA,GAAGA,QAAQ,GAAG,CAAC;QAEjB,IAAI,CAACJ,KAAKG,MAAM,CAACL,WAAW;YAC1B,UAAU,sCAAsC;QAClD;QAEA,MAAMQ,WAAWN,KAAKO,IAAI,CAACT,UAAU,YAAY;QAEjD,IAAIQ,SAASE,QAAQ,CAACZ,uBAAuB;YAC3C,UAAU,4CAA4C;QACxD;QAEA,IAAI,CAACU,SAASE,QAAQ,CAACb,sBAAsB;YAC3CM,UAAUQ,IAAI,CAACZ,gBAAgBC;YAC/B;QACF;QAEAE,KAAKU,KAAK,CACRZ,UACAQ,SAASK,OAAO,CAAChB,qBAAqBC;QAExCM,WAAW;IACb;IAEA,IAAIA,UAAU;QACZ,MAAMX,qBAAqBS,MAAMN;IACnC;IAEA,OAAO;QAAEO;IAAU;AACrB"}

package/src/utils/agent-core-constructs/files/terraform/app/agentcore-harness/__nameKebabCase__/__nameKebabCase__.tf.template

@@ -395,7 +395,7 @@ resource "aws_bedrockagentcore_harness" "this" {
   execution_role_arn = local.execution_role_arn
 
   allowed_tools         = var.allowed_tools
-  environment_variables = var.environment_variables
+  environment_variables = coalesce(var.environment_variables, {})
   max_iterations        = var.max_iterations
   timeout_seconds       = var.timeout_seconds