@aws-cdk/aws-bedrock-agentcore-alpha 2.235.1-alpha.0 → 2.237.0-alpha.0

package/lib/gateway/inbound-auth/custom-claim.d.ts

@@ -0,0 +1,50 @@
+/**
+ *  Copyright Amazon.com, Inc. or its affiliates. All Rights Reserved.
+ *
+ *  Licensed under the Apache License, Version 2.0 (the "License"). You may not use this file except in compliance
+ *  with the License. A copy of the License is located at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ *  or in the 'license' file accompanying this file. This file is distributed on an 'AS IS' BASIS, WITHOUT WARRANTIES
+ *  OR CONDITIONS OF ANY KIND, express or implied. See the License for the specific language governing permissions
+ *  and limitations under the License.
+ */
+import { CfnGateway } from 'aws-cdk-lib/aws-bedrockagentcore';
+import { CustomClaimOperator } from '../../common/types';
+/**
+ * Represents a custom claim validation configuration for Gateway JWT authorizers.
+ * Custom claims allow you to validate additional fields in JWT tokens beyond
+ * the standard audience, client, and scope validations.
+ */
+export declare class GatewayCustomClaim {
+    private readonly name;
+    private readonly valueType;
+    private readonly operator;
+    private readonly value;
+    /**
+     * Create a custom claim with a string value.
+     * String claims must use the EQUALS operator.
+     *
+     * @param name The name of the claim in the JWT token
+     * @param value The string value to match (must exactly equal)
+     * @returns A GatewayCustomClaim configured for string validation
+     */
+    static withStringValue(name: string, value: string): GatewayCustomClaim;
+    /**
+     * Create a custom claim with a string array value.
+     * String array claims can use CONTAINS (default) or CONTAINS_ANY operator.
+     *
+     * @param name The name of the claim in the JWT token
+     * @param values The array of string values to match. For CONTAINS operator, must contain exactly one value.
+     * @param operator The match operator (defaults to CONTAINS)
+     * @returns A GatewayCustomClaim configured for string array validation
+     */
+    static withStringArrayValue(name: string, values: string[], operator?: CustomClaimOperator): GatewayCustomClaim;
+    private constructor();
+    /**
+     * Render the custom claim as a CloudFormation property
+     * @internal
+     */
+    _render(): CfnGateway.CustomClaimValidationTypeProperty;
+}

package/lib/gateway/inbound-auth/custom-claim.js

@@ -0,0 +1,127 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.GatewayCustomClaim = void 0;
+const jsiiDeprecationWarnings = require("../../../.warnings.jsii.js");
+const JSII_RTTI_SYMBOL_1 = Symbol.for("jsii.rtti");
+/**
+ *  Copyright Amazon.com, Inc. or its affiliates. All Rights Reserved.
+ *
+ *  Licensed under the Apache License, Version 2.0 (the "License"). You may not use this file except in compliance
+ *  with the License. A copy of the License is located at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ *  or in the 'license' file accompanying this file. This file is distributed on an 'AS IS' BASIS, WITHOUT WARRANTIES
+ *  OR CONDITIONS OF ANY KIND, express or implied. See the License for the specific language governing permissions
+ *  and limitations under the License.
+ */
+const aws_cdk_lib_1 = require("aws-cdk-lib");
+const types_1 = require("../../common/types");
+const validation_helpers_1 = require("../validation-helpers");
+/**
+ * Represents a custom claim validation configuration for Gateway JWT authorizers.
+ * Custom claims allow you to validate additional fields in JWT tokens beyond
+ * the standard audience, client, and scope validations.
+ */
+class GatewayCustomClaim {
+    name;
+    valueType;
+    operator;
+    value;
+    static [JSII_RTTI_SYMBOL_1] = { fqn: "@aws-cdk/aws-bedrock-agentcore-alpha.GatewayCustomClaim", version: "2.237.0-alpha.0" };
+    /**
+     * Create a custom claim with a string value.
+     * String claims must use the EQUALS operator.
+     *
+     * @param name The name of the claim in the JWT token
+     * @param value The string value to match (must exactly equal)
+     * @returns A GatewayCustomClaim configured for string validation
+     */
+    static withStringValue(name, value) {
+        return new GatewayCustomClaim(name, types_1.CustomClaimValueType.STRING, types_1.CustomClaimOperator.EQUALS, value);
+    }
+    /**
+     * Create a custom claim with a string array value.
+     * String array claims can use CONTAINS (default) or CONTAINS_ANY operator.
+     *
+     * @param name The name of the claim in the JWT token
+     * @param values The array of string values to match. For CONTAINS operator, must contain exactly one value.
+     * @param operator The match operator (defaults to CONTAINS)
+     * @returns A GatewayCustomClaim configured for string array validation
+     */
+    static withStringArrayValue(name, values, operator = types_1.CustomClaimOperator.CONTAINS) {
+        try {
+            jsiiDeprecationWarnings._aws_cdk_aws_bedrock_agentcore_alpha_CustomClaimOperator(operator);
+        }
+        catch (error) {
+            if (process.env.JSII_DEBUG !== "1" && error.name === "DeprecationError") {
+                Error.captureStackTrace(error, this.withStringArrayValue);
+            }
+            throw error;
+        }
+        // Validate operator is valid for STRING_ARRAY type
+        if (operator !== types_1.CustomClaimOperator.CONTAINS && operator !== types_1.CustomClaimOperator.CONTAINS_ANY) {
+            throw new validation_helpers_1.ValidationError(`Custom claim '${name}': STRING_ARRAY type only supports CONTAINS or CONTAINS_ANY operators, got ${operator}`);
+        }
+        return new GatewayCustomClaim(name, types_1.CustomClaimValueType.STRING_ARRAY, operator, values);
+    }
+    constructor(name, valueType, operator, value) {
+        this.name = name;
+        this.valueType = valueType;
+        this.operator = operator;
+        this.value = value;
+        if (aws_cdk_lib_1.Token.isUnresolved(value)) {
+            return;
+        }
+        // Validate that value matches the valueType
+        if (valueType === types_1.CustomClaimValueType.STRING && typeof value !== 'string') {
+            throw new validation_helpers_1.ValidationError(`Custom claim '${name}': STRING type requires a string value, got ${typeof value}`);
+        }
+        if (valueType === types_1.CustomClaimValueType.STRING_ARRAY && !Array.isArray(value)) {
+            throw new validation_helpers_1.ValidationError(`Custom claim '${name}': STRING_ARRAY type requires an array value, got ${typeof value}`);
+        }
+    }
+    /**
+     * Render the custom claim as a CloudFormation property
+     * @internal
+     */
+    _render() {
+        // Build the claim match value based on operator and value type
+        let claimMatchValue;
+        if (this.valueType === types_1.CustomClaimValueType.STRING) {
+            // STRING type always uses matchValueString with EQUALS operator
+            claimMatchValue = {
+                matchValueString: this.value,
+            };
+        }
+        else {
+            // STRING_ARRAY type: CONTAINS uses matchValueString, CONTAINS_ANY uses matchValueStringList
+            if (this.operator === types_1.CustomClaimOperator.CONTAINS) {
+                // CONTAINS requires a single string value (check if claim array contains this string)
+                const values = this.value;
+                if (!aws_cdk_lib_1.Token.isUnresolved(values[0]) && values.length !== 1) {
+                    throw new validation_helpers_1.ValidationError(`Custom claim '${this.name}': CONTAINS operator requires exactly one value, got ${values.length} values`);
+                }
+                claimMatchValue = {
+                    matchValueString: values[0],
+                };
+            }
+            else {
+                // CONTAINS_ANY uses matchValueStringList
+                claimMatchValue = {
+                    matchValueStringList: this.value,
+                };
+            }
+        }
+        return {
+            inboundTokenClaimName: this.name,
+            inboundTokenClaimValueType: this.valueType,
+            authorizingClaimMatchValue: {
+                claimMatchOperator: this.operator,
+                claimMatchValue: claimMatchValue,
+            },
+        };
+    }
+}
+exports.GatewayCustomClaim = GatewayCustomClaim;
+//# sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJmaWxlIjoiY3VzdG9tLWNsYWltLmpzIiwic291cmNlUm9vdCI6IiIsInNvdXJjZXMiOlsiY3VzdG9tLWNsYWltLnRzIl0sIm5hbWVzIjpbXSwibWFwcGluZ3MiOiI7Ozs7O0FBQUE7Ozs7Ozs7Ozs7O0dBV0c7QUFFSCw2Q0FBb0M7QUFFcEMsOENBQStFO0FBQy9FLDhEQUF3RDtBQUV4RDs7OztHQUlHO0FBQ0gsTUFBYSxrQkFBa0I7SUFxQ1Y7SUFDQTtJQUNBO0lBQ0E7O0lBdkNuQjs7Ozs7OztPQU9HO0lBQ0ksTUFBTSxDQUFDLGVBQWUsQ0FBQyxJQUFZLEVBQUUsS0FBYTtRQUN2RCxPQUFPLElBQUksa0JBQWtCLENBQUMsSUFBSSxFQUFFLDRCQUFvQixDQUFDLE1BQU0sRUFBRSwyQkFBbUIsQ0FBQyxNQUFNLEVBQUUsS0FBSyxDQUFDLENBQUM7S0FDckc7SUFFRDs7Ozs7Ozs7T0FRRztJQUNJLE1BQU0sQ0FBQyxvQkFBb0IsQ0FDaEMsSUFBWSxFQUNaLE1BQWdCLEVBQ2hCLFdBQWdDLDJCQUFtQixDQUFDLFFBQVE7Ozs7Ozs7Ozs7UUFFNUQsbURBQW1EO1FBQ25ELElBQUksUUFBUSxLQUFLLDJCQUFtQixDQUFDLFFBQVEsSUFBSSxRQUFRLEtBQUssMkJBQW1CLENBQUMsWUFBWSxFQUFFLENBQUM7WUFDL0YsTUFBTSxJQUFJLG9DQUFlLENBQ3ZCLGlCQUFpQixJQUFJLDhFQUE4RSxRQUFRLEVBQUUsQ0FDOUcsQ0FBQztRQUNKLENBQUM7UUFDRCxPQUFPLElBQUksa0JBQWtCLENBQUMsSUFBSSxFQUFFLDRCQUFvQixDQUFDLFlBQVksRUFBRSxRQUFRLEVBQUUsTUFBTSxDQUFDLENBQUM7S0FDMUY7SUFFRCxZQUNtQixJQUFZLEVBQ1osU0FBK0IsRUFDL0IsUUFBNkIsRUFDN0IsS0FBd0I7UUFIeEIsU0FBSSxHQUFKLElBQUksQ0FBUTtRQUNaLGNBQVMsR0FBVCxTQUFTLENBQXNCO1FBQy9CLGFBQVEsR0FBUixRQUFRLENBQXFCO1FBQzdCLFVBQUssR0FBTCxLQUFLLENBQW1CO1FBRXpDLElBQUksbUJBQUssQ0FBQyxZQUFZLENBQUMsS0FBSyxDQUFDLEVBQUUsQ0FBQztZQUM5QixPQUFPO1FBQ1QsQ0FBQztRQUNELDRDQUE0QztRQUM1QyxJQUFJLFNBQVMsS0FBSyw0QkFBb0IsQ0FBQyxNQUFNLElBQUksT0FBTyxLQUFLLEtBQUssUUFBUSxFQUFFLENBQUM7WUFDM0UsTUFBTSxJQUFJLG9DQUFlLENBQUMsaUJBQWlCLElBQUksK0NBQStDLE9BQU8sS0FBSyxFQUFFLENBQUMsQ0FBQztRQUNoSCxDQUFDO1FBQ0QsSUFBSSxTQUFTLEtBQUssNEJBQW9CLENBQUMsWUFBWSxJQUFJLENBQUMsS0FBSyxDQUFDLE9BQU8sQ0FBQyxLQUFLLENBQUMsRUFBRSxDQUFDO1lBQzdFLE1BQU0sSUFBSSxvQ0FBZSxDQUFDLGlCQUFpQixJQUFJLHFEQUFxRCxPQUFPLEtBQUssRUFBRSxDQUFDLENBQUM7UUFDdEgsQ0FBQztLQUNGO0lBRUQ7OztPQUdHO0lBQ0ksT0FBTztRQUNaLCtEQUErRDtRQUMvRCxJQUFJLGVBQXVELENBQUM7UUFDNUQsSUFBSSxJQUFJLENBQUMsU0FBUyxLQUFLLDRCQUFvQixDQUFDLE1BQU0sRUFBRSxDQUFDO1lBQ25ELGdFQUFnRTtZQUNoRSxlQUFlLEdBQUc7Z0JBQ2hCLGdCQUFnQixFQUFFLElBQUksQ0FBQyxLQUFlO2FBQ3ZDLENBQUM7UUFDSixDQUFDO2FBQU0sQ0FBQztZQUNOLDRGQUE0RjtZQUM1RixJQUFJLElBQUksQ0FBQyxRQUFRLEtBQUssMkJBQW1CLENBQUMsUUFBUSxFQUFFLENBQUM7Z0JBQ25ELHNGQUFzRjtnQkFDdEYsTUFBTSxNQUFNLEdBQUcsSUFBSSxDQUFDLEtBQWlCLENBQUM7Z0JBQ3RDLElBQUksQ0FBQyxtQkFBSyxDQUFDLFlBQVksQ0FBQyxNQUFNLENBQUMsQ0FBQyxDQUFDLENBQUMsSUFBSSxNQUFNLENBQUMsTUFBTSxLQUFLLENBQUMsRUFBRSxDQUFDO29CQUMxRCxNQUFNLElBQUksb0NBQWUsQ0FDdkIsaUJBQWlCLElBQUksQ0FBQyxJQUFJLHdEQUF3RCxNQUFNLENBQUMsTUFBTSxTQUFTLENBQ3pHLENBQUM7Z0JBQ0osQ0FBQztnQkFDRCxlQUFlLEdBQUc7b0JBQ2hCLGdCQUFnQixFQUFFLE1BQU0sQ0FBQyxDQUFDLENBQUM7aUJBQzVCLENBQUM7WUFDSixDQUFDO2lCQUFNLENBQUM7Z0JBQ04seUNBQXlDO2dCQUN6QyxlQUFlLEdBQUc7b0JBQ2hCLG9CQUFvQixFQUFFLElBQUksQ0FBQyxLQUFpQjtpQkFDN0MsQ0FBQztZQUNKLENBQUM7UUFDSCxDQUFDO1FBRUQsT0FBTztZQUNMLHFCQUFxQixFQUFFLElBQUksQ0FBQyxJQUFJO1lBQ2hDLDBCQUEwQixFQUFFLElBQUksQ0FBQyxTQUFTO1lBQzFDLDBCQUEwQixFQUFFO2dCQUMxQixrQkFBa0IsRUFBRSxJQUFJLENBQUMsUUFBUTtnQkFDakMsZUFBZSxFQUFFLGVBQWU7YUFDakM7U0FDRixDQUFDO0tBQ0g7O0FBL0ZILGdEQWdHQyIsInNvdXJjZXNDb250ZW50IjpbIi8qKlxuICogIENvcHlyaWdodCBBbWF6b24uY29tLCBJbmMuIG9yIGl0cyBhZmZpbGlhdGVzLiBBbGwgUmlnaHRzIFJlc2VydmVkLlxuICpcbiAqICBMaWNlbnNlZCB1bmRlciB0aGUgQXBhY2hlIExpY2Vuc2UsIFZlcnNpb24gMi4wICh0aGUgXCJMaWNlbnNlXCIpLiBZb3UgbWF5IG5vdCB1c2UgdGhpcyBmaWxlIGV4Y2VwdCBpbiBjb21wbGlhbmNlXG4gKiAgd2l0aCB0aGUgTGljZW5zZS4gQSBjb3B5IG9mIHRoZSBMaWNlbnNlIGlzIGxvY2F0ZWQgYXRcbiAqXG4gKiAgICAgIGh0dHA6Ly93d3cuYXBhY2hlLm9yZy9saWNlbnNlcy9MSUNFTlNFLTIuMFxuICpcbiAqICBvciBpbiB0aGUgJ2xpY2Vuc2UnIGZpbGUgYWNjb21wYW55aW5nIHRoaXMgZmlsZS4gVGhpcyBmaWxlIGlzIGRpc3RyaWJ1dGVkIG9uIGFuICdBUyBJUycgQkFTSVMsIFdJVEhPVVQgV0FSUkFOVElFU1xuICogIE9SIENPTkRJVElPTlMgT0YgQU5ZIEtJTkQsIGV4cHJlc3Mgb3IgaW1wbGllZC4gU2VlIHRoZSBMaWNlbnNlIGZvciB0aGUgc3BlY2lmaWMgbGFuZ3VhZ2UgZ292ZXJuaW5nIHBlcm1pc3Npb25zXG4gKiAgYW5kIGxpbWl0YXRpb25zIHVuZGVyIHRoZSBMaWNlbnNlLlxuICovXG5cbmltcG9ydCB7IFRva2VuIH0gZnJvbSAnYXdzLWNkay1saWInO1xuaW1wb3J0IHsgQ2ZuR2F0ZXdheSB9IGZyb20gJ2F3cy1jZGstbGliL2F3cy1iZWRyb2NrYWdlbnRjb3JlJztcbmltcG9ydCB7IEN1c3RvbUNsYWltT3BlcmF0b3IsIEN1c3RvbUNsYWltVmFsdWVUeXBlIH0gZnJvbSAnLi4vLi4vY29tbW9uL3R5cGVzJztcbmltcG9ydCB7IFZhbGlkYXRpb25FcnJvciB9IGZyb20gJy4uL3ZhbGlkYXRpb24taGVscGVycyc7XG5cbi8qKlxuICogUmVwcmVzZW50cyBhIGN1c3RvbSBjbGFpbSB2YWxpZGF0aW9uIGNvbmZpZ3VyYXRpb24gZm9yIEdhdGV3YXkgSldUIGF1dGhvcml6ZXJzLlxuICogQ3VzdG9tIGNsYWltcyBhbGxvdyB5b3UgdG8gdmFsaWRhdGUgYWRkaXRpb25hbCBmaWVsZHMgaW4gSldUIHRva2VucyBiZXlvbmRcbiAqIHRoZSBzdGFuZGFyZCBhdWRpZW5jZSwgY2xpZW50LCBhbmQgc2NvcGUgdmFsaWRhdGlvbnMuXG4gKi9cbmV4cG9ydCBjbGFzcyBHYXRld2F5Q3VzdG9tQ2xhaW0ge1xuICAvKipcbiAgICogQ3JlYXRlIGEgY3VzdG9tIGNsYWltIHdpdGggYSBzdHJpbmcgdmFsdWUuXG4gICAqIFN0cmluZyBjbGFpbXMgbXVzdCB1c2UgdGhlIEVRVUFMUyBvcGVyYXRvci5cbiAgICpcbiAgICogQHBhcmFtIG5hbWUgVGhlIG5hbWUgb2YgdGhlIGNsYWltIGluIHRoZSBKV1QgdG9rZW5cbiAgICogQHBhcmFtIHZhbHVlIFRoZSBzdHJpbmcgdmFsdWUgdG8gbWF0Y2ggKG11c3QgZXhhY3RseSBlcXVhbClcbiAgICogQHJldHVybnMgQSBHYXRld2F5Q3VzdG9tQ2xhaW0gY29uZmlndXJlZCBmb3Igc3RyaW5nIHZhbGlkYXRpb25cbiAgICovXG4gIHB1YmxpYyBzdGF0aWMgd2l0aFN0cmluZ1ZhbHVlKG5hbWU6IHN0cmluZywgdmFsdWU6IHN0cmluZyk6IEdhdGV3YXlDdXN0b21DbGFpbSB7XG4gICAgcmV0dXJuIG5ldyBHYXRld2F5Q3VzdG9tQ2xhaW0obmFtZSwgQ3VzdG9tQ2xhaW1WYWx1ZVR5cGUuU1RSSU5HLCBDdXN0b21DbGFpbU9wZXJhdG9yLkVRVUFMUywgdmFsdWUpO1xuICB9XG5cbiAgLyoqXG4gICAqIENyZWF0ZSBhIGN1c3RvbSBjbGFpbSB3aXRoIGEgc3RyaW5nIGFycmF5IHZhbHVlLlxuICAgKiBTdHJpbmcgYXJyYXkgY2xhaW1zIGNhbiB1c2UgQ09OVEFJTlMgKGRlZmF1bHQpIG9yIENPTlRBSU5TX0FOWSBvcGVyYXRvci5cbiAgICpcbiAgICogQHBhcmFtIG5hbWUgVGhlIG5hbWUgb2YgdGhlIGNsYWltIGluIHRoZSBKV1QgdG9rZW5cbiAgICogQHBhcmFtIHZhbHVlcyBUaGUgYXJyYXkgb2Ygc3RyaW5nIHZhbHVlcyB0byBtYXRjaC4gRm9yIENPTlRBSU5TIG9wZXJhdG9yLCBtdXN0IGNvbnRhaW4gZXhhY3RseSBvbmUgdmFsdWUuXG4gICAqIEBwYXJhbSBvcGVyYXRvciBUaGUgbWF0Y2ggb3BlcmF0b3IgKGRlZmF1bHRzIHRvIENPTlRBSU5TKVxuICAgKiBAcmV0dXJucyBBIEdhdGV3YXlDdXN0b21DbGFpbSBjb25maWd1cmVkIGZvciBzdHJpbmcgYXJyYXkgdmFsaWRhdGlvblxuICAgKi9cbiAgcHVibGljIHN0YXRpYyB3aXRoU3RyaW5nQXJyYXlWYWx1ZShcbiAgICBuYW1lOiBzdHJpbmcsXG4gICAgdmFsdWVzOiBzdHJpbmdbXSxcbiAgICBvcGVyYXRvcjogQ3VzdG9tQ2xhaW1PcGVyYXRvciA9IEN1c3RvbUNsYWltT3BlcmF0b3IuQ09OVEFJTlMsXG4gICk6IEdhdGV3YXlDdXN0b21DbGFpbSB7XG4gICAgLy8gVmFsaWRhdGUgb3BlcmF0b3IgaXMgdmFsaWQgZm9yIFNUUklOR19BUlJBWSB0eXBlXG4gICAgaWYgKG9wZXJhdG9yICE9PSBDdXN0b21DbGFpbU9wZXJhdG9yLkNPTlRBSU5TICYmIG9wZXJhdG9yICE9PSBDdXN0b21DbGFpbU9wZXJhdG9yLkNPTlRBSU5TX0FOWSkge1xuICAgICAgdGhyb3cgbmV3IFZhbGlkYXRpb25FcnJvcihcbiAgICAgICAgYEN1c3RvbSBjbGFpbSAnJHtuYW1lfSc6IFNUUklOR19BUlJBWSB0eXBlIG9ubHkgc3VwcG9ydHMgQ09OVEFJTlMgb3IgQ09OVEFJTlNfQU5ZIG9wZXJhdG9ycywgZ290ICR7b3BlcmF0b3J9YCxcbiAgICAgICk7XG4gICAgfVxuICAgIHJldHVybiBuZXcgR2F0ZXdheUN1c3RvbUNsYWltKG5hbWUsIEN1c3RvbUNsYWltVmFsdWVUeXBlLlNUUklOR19BUlJBWSwgb3BlcmF0b3IsIHZhbHVlcyk7XG4gIH1cblxuICBwcml2YXRlIGNvbnN0cnVjdG9yKFxuICAgIHByaXZhdGUgcmVhZG9ubHkgbmFtZTogc3RyaW5nLFxuICAgIHByaXZhdGUgcmVhZG9ubHkgdmFsdWVUeXBlOiBDdXN0b21DbGFpbVZhbHVlVHlwZSxcbiAgICBwcml2YXRlIHJlYWRvbmx5IG9wZXJhdG9yOiBDdXN0b21DbGFpbU9wZXJhdG9yLFxuICAgIHByaXZhdGUgcmVhZG9ubHkgdmFsdWU6IHN0cmluZyB8IHN0cmluZ1tdLFxuICApIHtcbiAgICBpZiAoVG9rZW4uaXNVbnJlc29sdmVkKHZhbHVlKSkge1xuICAgICAgcmV0dXJuO1xuICAgIH1cbiAgICAvLyBWYWxpZGF0ZSB0aGF0IHZhbHVlIG1hdGNoZXMgdGhlIHZhbHVlVHlwZVxuICAgIGlmICh2YWx1ZVR5cGUgPT09IEN1c3RvbUNsYWltVmFsdWVUeXBlLlNUUklORyAmJiB0eXBlb2YgdmFsdWUgIT09ICdzdHJpbmcnKSB7XG4gICAgICB0aHJvdyBuZXcgVmFsaWRhdGlvbkVycm9yKGBDdXN0b20gY2xhaW0gJyR7bmFtZX0nOiBTVFJJTkcgdHlwZSByZXF1aXJlcyBhIHN0cmluZyB2YWx1ZSwgZ290ICR7dHlwZW9mIHZhbHVlfWApO1xuICAgIH1cbiAgICBpZiAodmFsdWVUeXBlID09PSBDdXN0b21DbGFpbVZhbHVlVHlwZS5TVFJJTkdfQVJSQVkgJiYgIUFycmF5LmlzQXJyYXkodmFsdWUpKSB7XG4gICAgICB0aHJvdyBuZXcgVmFsaWRhdGlvbkVycm9yKGBDdXN0b20gY2xhaW0gJyR7bmFtZX0nOiBTVFJJTkdfQVJSQVkgdHlwZSByZXF1aXJlcyBhbiBhcnJheSB2YWx1ZSwgZ290ICR7dHlwZW9mIHZhbHVlfWApO1xuICAgIH1cbiAgfVxuXG4gIC8qKlxuICAgKiBSZW5kZXIgdGhlIGN1c3RvbSBjbGFpbSBhcyBhIENsb3VkRm9ybWF0aW9uIHByb3BlcnR5XG4gICAqIEBpbnRlcm5hbFxuICAgKi9cbiAgcHVibGljIF9yZW5kZXIoKTogQ2ZuR2F0ZXdheS5DdXN0b21DbGFpbVZhbGlkYXRpb25UeXBlUHJvcGVydHkge1xuICAgIC8vIEJ1aWxkIHRoZSBjbGFpbSBtYXRjaCB2YWx1ZSBiYXNlZCBvbiBvcGVyYXRvciBhbmQgdmFsdWUgdHlwZVxuICAgIGxldCBjbGFpbU1hdGNoVmFsdWU6IENmbkdhdGV3YXkuQ2xhaW1NYXRjaFZhbHVlVHlwZVByb3BlcnR5O1xuICAgIGlmICh0aGlzLnZhbHVlVHlwZSA9PT0gQ3VzdG9tQ2xhaW1WYWx1ZVR5cGUuU1RSSU5HKSB7XG4gICAgICAvLyBTVFJJTkcgdHlwZSBhbHdheXMgdXNlcyBtYXRjaFZhbHVlU3RyaW5nIHdpdGggRVFVQUxTIG9wZXJhdG9yXG4gICAgICBjbGFpbU1hdGNoVmFsdWUgPSB7XG4gICAgICAgIG1hdGNoVmFsdWVTdHJpbmc6IHRoaXMudmFsdWUgYXMgc3RyaW5nLFxuICAgICAgfTtcbiAgICB9IGVsc2Uge1xuICAgICAgLy8gU1RSSU5HX0FSUkFZIHR5cGU6IENPTlRBSU5TIHVzZXMgbWF0Y2hWYWx1ZVN0cmluZywgQ09OVEFJTlNfQU5ZIHVzZXMgbWF0Y2hWYWx1ZVN0cmluZ0xpc3RcbiAgICAgIGlmICh0aGlzLm9wZXJhdG9yID09PSBDdXN0b21DbGFpbU9wZXJhdG9yLkNPTlRBSU5TKSB7XG4gICAgICAgIC8vIENPTlRBSU5TIHJlcXVpcmVzIGEgc2luZ2xlIHN0cmluZyB2YWx1ZSAoY2hlY2sgaWYgY2xhaW0gYXJyYXkgY29udGFpbnMgdGhpcyBzdHJpbmcpXG4gICAgICAgIGNvbnN0IHZhbHVlcyA9IHRoaXMudmFsdWUgYXMgc3RyaW5nW107XG4gICAgICAgIGlmICghVG9rZW4uaXNVbnJlc29sdmVkKHZhbHVlc1swXSkgJiYgdmFsdWVzLmxlbmd0aCAhPT0gMSkge1xuICAgICAgICAgIHRocm93IG5ldyBWYWxpZGF0aW9uRXJyb3IoXG4gICAgICAgICAgICBgQ3VzdG9tIGNsYWltICcke3RoaXMubmFtZX0nOiBDT05UQUlOUyBvcGVyYXRvciByZXF1aXJlcyBleGFjdGx5IG9uZSB2YWx1ZSwgZ290ICR7dmFsdWVzLmxlbmd0aH0gdmFsdWVzYCxcbiAgICAgICAgICApO1xuICAgICAgICB9XG4gICAgICAgIGNsYWltTWF0Y2hWYWx1ZSA9IHtcbiAgICAgICAgICBtYXRjaFZhbHVlU3RyaW5nOiB2YWx1ZXNbMF0sXG4gICAgICAgIH07XG4gICAgICB9IGVsc2Uge1xuICAgICAgICAvLyBDT05UQUlOU19BTlkgdXNlcyBtYXRjaFZhbHVlU3RyaW5nTGlzdFxuICAgICAgICBjbGFpbU1hdGNoVmFsdWUgPSB7XG4gICAgICAgICAgbWF0Y2hWYWx1ZVN0cmluZ0xpc3Q6IHRoaXMudmFsdWUgYXMgc3RyaW5nW10sXG4gICAgICAgIH07XG4gICAgICB9XG4gICAgfVxuXG4gICAgcmV0dXJuIHtcbiAgICAgIGluYm91bmRUb2tlbkNsYWltTmFtZTogdGhpcy5uYW1lLFxuICAgICAgaW5ib3VuZFRva2VuQ2xhaW1WYWx1ZVR5cGU6IHRoaXMudmFsdWVUeXBlLFxuICAgICAgYXV0aG9yaXppbmdDbGFpbU1hdGNoVmFsdWU6IHtcbiAgICAgICAgY2xhaW1NYXRjaE9wZXJhdG9yOiB0aGlzLm9wZXJhdG9yLFxuICAgICAgICBjbGFpbU1hdGNoVmFsdWU6IGNsYWltTWF0Y2hWYWx1ZSxcbiAgICAgIH0sXG4gICAgfTtcbiAgfVxufVxuIl19

package/lib/gateway/interceptor.d.ts

@@ -0,0 +1,137 @@
+import { IFunction } from 'aws-cdk-lib/aws-lambda';
+import { Construct } from 'constructs';
+import { IGateway } from './gateway-base';
+/******************************************************************************
+ *                                Enums
+ *****************************************************************************/
+/**
+ * The interception point where the interceptor will be invoked
+ */
+export declare enum InterceptionPoint {
+    /**
+     * Execute before the gateway makes a call to the target
+     * Useful for request validation, transformation, or custom authorization
+     */
+    REQUEST = "REQUEST",
+    /**
+     * Execute after the target responds but before the gateway sends the response back
+     * Useful for response transformation, filtering, or adding custom headers
+     */
+    RESPONSE = "RESPONSE"
+}
+/******************************************************************************
+ *                                Interfaces
+ *****************************************************************************/
+/**
+ * Options for configuring an interceptor
+ */
+export interface InterceptorOptions {
+    /**
+     * Whether to pass request headers to the interceptor Lambda function
+     *
+     * **Security Warning**: Request headers can contain sensitive information such as
+     * authentication tokens and credentials. Only enable this if your interceptor needs
+     * access to headers and you have verified that sensitive information is not logged
+     * or exposed.
+     *
+     * @default false - Headers are not passed to interceptor for security
+     */
+    readonly passRequestHeaders?: boolean;
+}
+/**
+ * Represents an interceptor that can be bound to a Gateway
+ *
+ * Interceptors allow custom code execution at specific points in the gateway request/response flow.
+ */
+export interface IInterceptor {
+    /**
+     * The interception point where this interceptor will be invoked
+     */
+    readonly interceptionPoint: InterceptionPoint;
+    /**
+     * Binds this interceptor to a Gateway
+     *
+     * This method is called when the interceptor is added to a gateway. It should:
+     * 1. Grant any necessary permissions (e.g., Lambda invoke permissions)
+     * 2. Perform any required setup
+     * 3. Return the CloudFormation configuration
+     *
+     * @param scope The construct scope for creating any required resources
+     * @param gateway The gateway this interceptor is being bound to [disable-awslint:prefer-ref-interface]
+     * @returns Configuration that will be rendered to CloudFormation
+     */
+    bind(scope: Construct, gateway: IGateway): InterceptorBindConfig;
+}
+/**
+ * Configuration returned from binding an interceptor to a Gateway
+ */
+export interface InterceptorBindConfig {
+    /**
+     * The CloudFormation configuration for this interceptor
+     */
+    readonly configuration: any;
+}
+/******************************************************************************
+ *                                Classes
+ *****************************************************************************/
+/**
+ * A Lambda-based interceptor for Gateway
+ *
+ * Interceptors allow you to run custom code during each invocation of your gateway:
+ * - REQUEST interceptors execute before calling the target
+ * - RESPONSE interceptors execute after the target responds
+ * @see https://docs.aws.amazon.com/bedrock-agentcore/latest/devguide/gateway-interceptors.html
+ */
+export declare class LambdaInterceptor implements IInterceptor {
+    /**
+     * Create a REQUEST interceptor that executes before the gateway calls the target
+     *
+     * **Important:** When this interceptor is added to a gateway, the gateway's IAM role
+     * will automatically be granted `lambda:InvokeFunction` permission on the specified
+     * Lambda function.
+     *
+     * @param lambdaFunction The Lambda function to invoke
+     * @param options Optional configuration for the interceptor
+     * @returns A configured LambdaInterceptor for request interception
+     */
+    static forRequest(lambdaFunction: IFunction, options?: InterceptorOptions): LambdaInterceptor;
+    /**
+     * Create a RESPONSE interceptor that executes after the target responds
+     *
+     * **Important:** When this interceptor is added to a gateway, the gateway's IAM role
+     * will automatically be granted `lambda:InvokeFunction` permission on the specified
+     * Lambda function.
+     *
+     * @param lambdaFunction The Lambda function to invoke
+     * @param options Optional configuration for the interceptor
+     * @returns A configured LambdaInterceptor for response interception
+     */
+    static forResponse(lambdaFunction: IFunction, options?: InterceptorOptions): LambdaInterceptor;
+    /**
+     * The interception point (REQUEST or RESPONSE)
+     */
+    readonly interceptionPoint: InterceptionPoint;
+    /**
+     * The Lambda function to invoke for this interceptor
+     */
+    private readonly lambdaFunction;
+    /**
+     * Whether to pass request headers to the interceptor
+     *
+     * @default false - Headers are not passed for security
+     */
+    private readonly passRequestHeaders;
+    private constructor();
+    /**
+     * Binds this Lambda interceptor to a Gateway
+     *
+     * This method:
+     * 1. Grants the Gateway's IAM role permission to invoke the Lambda function
+     * 2. Returns the CloudFormation configuration for this interceptor
+     *
+     * @param _scope The construct scope (currently unused, reserved for future extensions)
+     * @param gateway The gateway this interceptor is being bound to
+     * @returns Configuration for CloudFormation rendering
+     */
+    bind(_scope: Construct, gateway: IGateway): InterceptorBindConfig;
+}

package/lib/gateway/interceptor.js

@@ -0,0 +1,143 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.LambdaInterceptor = exports.InterceptionPoint = void 0;
+const jsiiDeprecationWarnings = require("../../.warnings.jsii.js");
+const JSII_RTTI_SYMBOL_1 = Symbol.for("jsii.rtti");
+/******************************************************************************
+ *                                Enums
+ *****************************************************************************/
+/**
+ * The interception point where the interceptor will be invoked
+ */
+var InterceptionPoint;
+(function (InterceptionPoint) {
+    /**
+     * Execute before the gateway makes a call to the target
+     * Useful for request validation, transformation, or custom authorization
+     */
+    InterceptionPoint["REQUEST"] = "REQUEST";
+    /**
+     * Execute after the target responds but before the gateway sends the response back
+     * Useful for response transformation, filtering, or adding custom headers
+     */
+    InterceptionPoint["RESPONSE"] = "RESPONSE";
+})(InterceptionPoint || (exports.InterceptionPoint = InterceptionPoint = {}));
+/******************************************************************************
+ *                                Classes
+ *****************************************************************************/
+/**
+ * A Lambda-based interceptor for Gateway
+ *
+ * Interceptors allow you to run custom code during each invocation of your gateway:
+ * - REQUEST interceptors execute before calling the target
+ * - RESPONSE interceptors execute after the target responds
+ * @see https://docs.aws.amazon.com/bedrock-agentcore/latest/devguide/gateway-interceptors.html
+ */
+class LambdaInterceptor {
+    static [JSII_RTTI_SYMBOL_1] = { fqn: "@aws-cdk/aws-bedrock-agentcore-alpha.LambdaInterceptor", version: "2.237.0-alpha.0" };
+    /**
+     * Create a REQUEST interceptor that executes before the gateway calls the target
+     *
+     * **Important:** When this interceptor is added to a gateway, the gateway's IAM role
+     * will automatically be granted `lambda:InvokeFunction` permission on the specified
+     * Lambda function.
+     *
+     * @param lambdaFunction The Lambda function to invoke
+     * @param options Optional configuration for the interceptor
+     * @returns A configured LambdaInterceptor for request interception
+     */
+    static forRequest(lambdaFunction, options) {
+        try {
+            jsiiDeprecationWarnings._aws_cdk_aws_bedrock_agentcore_alpha_InterceptorOptions(options);
+        }
+        catch (error) {
+            if (process.env.JSII_DEBUG !== "1" && error.name === "DeprecationError") {
+                Error.captureStackTrace(error, this.forRequest);
+            }
+            throw error;
+        }
+        return new LambdaInterceptor(InterceptionPoint.REQUEST, lambdaFunction, options);
+    }
+    /**
+     * Create a RESPONSE interceptor that executes after the target responds
+     *
+     * **Important:** When this interceptor is added to a gateway, the gateway's IAM role
+     * will automatically be granted `lambda:InvokeFunction` permission on the specified
+     * Lambda function.
+     *
+     * @param lambdaFunction The Lambda function to invoke
+     * @param options Optional configuration for the interceptor
+     * @returns A configured LambdaInterceptor for response interception
+     */
+    static forResponse(lambdaFunction, options) {
+        try {
+            jsiiDeprecationWarnings._aws_cdk_aws_bedrock_agentcore_alpha_InterceptorOptions(options);
+        }
+        catch (error) {
+            if (process.env.JSII_DEBUG !== "1" && error.name === "DeprecationError") {
+                Error.captureStackTrace(error, this.forResponse);
+            }
+            throw error;
+        }
+        return new LambdaInterceptor(InterceptionPoint.RESPONSE, lambdaFunction, options);
+    }
+    /**
+     * The interception point (REQUEST or RESPONSE)
+     */
+    interceptionPoint;
+    /**
+     * The Lambda function to invoke for this interceptor
+     */
+    lambdaFunction;
+    /**
+     * Whether to pass request headers to the interceptor
+     *
+     * @default false - Headers are not passed for security
+     */
+    passRequestHeaders;
+    constructor(interceptionPoint, lambdaFunction, options) {
+        this.interceptionPoint = interceptionPoint;
+        this.lambdaFunction = lambdaFunction;
+        this.passRequestHeaders = options?.passRequestHeaders ?? false;
+    }
+    /**
+     * Binds this Lambda interceptor to a Gateway
+     *
+     * This method:
+     * 1. Grants the Gateway's IAM role permission to invoke the Lambda function
+     * 2. Returns the CloudFormation configuration for this interceptor
+     *
+     * @param _scope The construct scope (currently unused, reserved for future extensions)
+     * @param gateway The gateway this interceptor is being bound to
+     * @returns Configuration for CloudFormation rendering
+     */
+    bind(_scope, gateway) {
+        try {
+            jsiiDeprecationWarnings._aws_cdk_aws_bedrock_agentcore_alpha_IGateway(gateway);
+        }
+        catch (error) {
+            if (process.env.JSII_DEBUG !== "1" && error.name === "DeprecationError") {
+                Error.captureStackTrace(error, this.bind);
+            }
+            throw error;
+        }
+        // Grant Lambda invoke permission to the Gateway's role
+        this.lambdaFunction.grantInvoke(gateway.role);
+        // Return CloudFormation configuration
+        return {
+            configuration: {
+                interceptionPoints: [this.interceptionPoint],
+                interceptor: {
+                    lambda: {
+                        arn: this.lambdaFunction.functionArn,
+                    },
+                },
+                inputConfiguration: {
+                    passRequestHeaders: this.passRequestHeaders,
+                },
+            },
+        };
+    }
+}
+exports.LambdaInterceptor = LambdaInterceptor;
+//# sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJmaWxlIjoiaW50ZXJjZXB0b3IuanMiLCJzb3VyY2VSb290IjoiIiwic291cmNlcyI6WyJpbnRlcmNlcHRvci50cyJdLCJuYW1lcyI6W10sIm1hcHBpbmdzIjoiOzs7OztBQUlBOzsrRUFFK0U7QUFFL0U7O0dBRUc7QUFDSCxJQUFZLGlCQVlYO0FBWkQsV0FBWSxpQkFBaUI7SUFDM0I7OztPQUdHO0lBQ0gsd0NBQW1CLENBQUE7SUFFbkI7OztPQUdHO0lBQ0gsMENBQXFCLENBQUE7QUFDdkIsQ0FBQyxFQVpXLGlCQUFpQixpQ0FBakIsaUJBQWlCLFFBWTVCO0FBMkREOzsrRUFFK0U7QUFFL0U7Ozs7Ozs7R0FPRztBQUNILE1BQWEsaUJBQWlCOztJQUM1Qjs7Ozs7Ozs7OztPQVVHO0lBQ0ksTUFBTSxDQUFDLFVBQVUsQ0FDdEIsY0FBeUIsRUFDekIsT0FBNEI7Ozs7Ozs7Ozs7UUFFNUIsT0FBTyxJQUFJLGlCQUFpQixDQUMxQixpQkFBaUIsQ0FBQyxPQUFPLEVBQ3pCLGNBQWMsRUFDZCxPQUFPLENBQ1IsQ0FBQztLQUNIO0lBRUQ7Ozs7Ozs7Ozs7T0FVRztJQUNJLE1BQU0sQ0FBQyxXQUFXLENBQ3ZCLGNBQXlCLEVBQ3pCLE9BQTRCOzs7Ozs7Ozs7O1FBRTVCLE9BQU8sSUFBSSxpQkFBaUIsQ0FDMUIsaUJBQWlCLENBQUMsUUFBUSxFQUMxQixjQUFjLEVBQ2QsT0FBTyxDQUNSLENBQUM7S0FDSDtJQUVEOztPQUVHO0lBQ2EsaUJBQWlCLENBQW9CO0lBRXJEOztPQUVHO0lBQ2MsY0FBYyxDQUFZO0lBRTNDOzs7O09BSUc7SUFDYyxrQkFBa0IsQ0FBVTtJQUU3QyxZQUNFLGlCQUFvQyxFQUNwQyxjQUF5QixFQUN6QixPQUE0QjtRQUU1QixJQUFJLENBQUMsaUJBQWlCLEdBQUcsaUJBQWlCLENBQUM7UUFDM0MsSUFBSSxDQUFDLGNBQWMsR0FBRyxjQUFjLENBQUM7UUFDckMsSUFBSSxDQUFDLGtCQUFrQixHQUFHLE9BQU8sRUFBRSxrQkFBa0IsSUFBSSxLQUFLLENBQUM7S0FDaEU7SUFFRDs7Ozs7Ozs7OztPQVVHO0lBQ0ksSUFBSSxDQUFDLE1BQWlCLEVBQUUsT0FBaUI7Ozs7Ozs7Ozs7UUFDOUMsdURBQXVEO1FBQ3ZELElBQUksQ0FBQyxjQUFjLENBQUMsV0FBVyxDQUFDLE9BQU8sQ0FBQyxJQUFJLENBQUMsQ0FBQztRQUU5QyxzQ0FBc0M7UUFDdEMsT0FBTztZQUNMLGFBQWEsRUFBRTtnQkFDYixrQkFBa0IsRUFBRSxDQUFDLElBQUksQ0FBQyxpQkFBaUIsQ0FBQztnQkFDNUMsV0FBVyxFQUFFO29CQUNYLE1BQU0sRUFBRTt3QkFDTixHQUFHLEVBQUUsSUFBSSxDQUFDLGNBQWMsQ0FBQyxXQUFXO3FCQUNyQztpQkFDRjtnQkFDRCxrQkFBa0IsRUFBRTtvQkFDbEIsa0JBQWtCLEVBQUUsSUFBSSxDQUFDLGtCQUFrQjtpQkFDNUM7YUFDRjtTQUNGLENBQUM7S0FDSDs7QUFyR0gsOENBc0dDIiwic291cmNlc0NvbnRlbnQiOlsiaW1wb3J0IHsgSUZ1bmN0aW9uIH0gZnJvbSAnYXdzLWNkay1saWIvYXdzLWxhbWJkYSc7XG5pbXBvcnQgeyBDb25zdHJ1Y3QgfSBmcm9tICdjb25zdHJ1Y3RzJztcbmltcG9ydCB7IElHYXRld2F5IH0gZnJvbSAnLi9nYXRld2F5LWJhc2UnO1xuXG4vKioqKioqKioqKioqKioqKioqKioqKioqKioqKioqKioqKioqKioqKioqKioqKioqKioqKioqKioqKioqKioqKioqKioqKioqKioqKioqXG4gKiAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgRW51bXNcbiAqKioqKioqKioqKioqKioqKioqKioqKioqKioqKioqKioqKioqKioqKioqKioqKioqKioqKioqKioqKioqKioqKioqKioqKioqKioqKi9cblxuLyoqXG4gKiBUaGUgaW50ZXJjZXB0aW9uIHBvaW50IHdoZXJlIHRoZSBpbnRlcmNlcHRvciB3aWxsIGJlIGludm9rZWRcbiAqL1xuZXhwb3J0IGVudW0gSW50ZXJjZXB0aW9uUG9pbnQge1xuICAvKipcbiAgICogRXhlY3V0ZSBiZWZvcmUgdGhlIGdhdGV3YXkgbWFrZXMgYSBjYWxsIHRvIHRoZSB0YXJnZXRcbiAgICogVXNlZnVsIGZvciByZXF1ZXN0IHZhbGlkYXRpb24sIHRyYW5zZm9ybWF0aW9uLCBvciBjdXN0b20gYXV0aG9yaXphdGlvblxuICAgKi9cbiAgUkVRVUVTVCA9ICdSRVFVRVNUJyxcblxuICAvKipcbiAgICogRXhlY3V0ZSBhZnRlciB0aGUgdGFyZ2V0IHJlc3BvbmRzIGJ1dCBiZWZvcmUgdGhlIGdhdGV3YXkgc2VuZHMgdGhlIHJlc3BvbnNlIGJhY2tcbiAgICogVXNlZnVsIGZvciByZXNwb25zZSB0cmFuc2Zvcm1hdGlvbiwgZmlsdGVyaW5nLCBvciBhZGRpbmcgY3VzdG9tIGhlYWRlcnNcbiAgICovXG4gIFJFU1BPTlNFID0gJ1JFU1BPTlNFJyxcbn1cblxuLyoqKioqKioqKioqKioqKioqKioqKioqKioqKioqKioqKioqKioqKioqKioqKioqKioqKioqKioqKioqKioqKioqKioqKioqKioqKioqKlxuICogICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIEludGVyZmFjZXNcbiAqKioqKioqKioqKioqKioqKioqKioqKioqKioqKioqKioqKioqKioqKioqKioqKioqKioqKioqKioqKioqKioqKioqKioqKioqKioqKi9cblxuLyoqXG4gKiBPcHRpb25zIGZvciBjb25maWd1cmluZyBhbiBpbnRlcmNlcHRvclxuICovXG5leHBvcnQgaW50ZXJmYWNlIEludGVyY2VwdG9yT3B0aW9ucyB7XG4gIC8qKlxuICAgKiBXaGV0aGVyIHRvIHBhc3MgcmVxdWVzdCBoZWFkZXJzIHRvIHRoZSBpbnRlcmNlcHRvciBMYW1iZGEgZnVuY3Rpb25cbiAgICpcbiAgICogKipTZWN1cml0eSBXYXJuaW5nKio6IFJlcXVlc3QgaGVhZGVycyBjYW4gY29udGFpbiBzZW5zaXRpdmUgaW5mb3JtYXRpb24gc3VjaCBhc1xuICAgKiBhdXRoZW50aWNhdGlvbiB0b2tlbnMgYW5kIGNyZWRlbnRpYWxzLiBPbmx5IGVuYWJsZSB0aGlzIGlmIHlvdXIgaW50ZXJjZXB0b3IgbmVlZHNcbiAgICogYWNjZXNzIHRvIGhlYWRlcnMgYW5kIHlvdSBoYXZlIHZlcmlmaWVkIHRoYXQgc2Vuc2l0aXZlIGluZm9ybWF0aW9uIGlzIG5vdCBsb2dnZWRcbiAgICogb3IgZXhwb3NlZC5cbiAgICpcbiAgICogQGRlZmF1bHQgZmFsc2UgLSBIZWFkZXJzIGFyZSBub3QgcGFzc2VkIHRvIGludGVyY2VwdG9yIGZvciBzZWN1cml0eVxuICAgKi9cbiAgcmVhZG9ubHkgcGFzc1JlcXVlc3RIZWFkZXJzPzogYm9vbGVhbjtcbn1cblxuLyoqXG4gKiBSZXByZXNlbnRzIGFuIGludGVyY2VwdG9yIHRoYXQgY2FuIGJlIGJvdW5kIHRvIGEgR2F0ZXdheVxuICpcbiAqIEludGVyY2VwdG9ycyBhbGxvdyBjdXN0b20gY29kZSBleGVjdXRpb24gYXQgc3BlY2lmaWMgcG9pbnRzIGluIHRoZSBnYXRld2F5IHJlcXVlc3QvcmVzcG9uc2UgZmxvdy5cbiAqL1xuZXhwb3J0IGludGVyZmFjZSBJSW50ZXJjZXB0b3Ige1xuICAvKipcbiAgICogVGhlIGludGVyY2VwdGlvbiBwb2ludCB3aGVyZSB0aGlzIGludGVyY2VwdG9yIHdpbGwgYmUgaW52b2tlZFxuICAgKi9cbiAgcmVhZG9ubHkgaW50ZXJjZXB0aW9uUG9pbnQ6IEludGVyY2VwdGlvblBvaW50O1xuXG4gIC8qKlxuICAgKiBCaW5kcyB0aGlzIGludGVyY2VwdG9yIHRvIGEgR2F0ZXdheVxuICAgKlxuICAgKiBUaGlzIG1ldGhvZCBpcyBjYWxsZWQgd2hlbiB0aGUgaW50ZXJjZXB0b3IgaXMgYWRkZWQgdG8gYSBnYXRld2F5LiBJdCBzaG91bGQ6XG4gICAqIDEuIEdyYW50IGFueSBuZWNlc3NhcnkgcGVybWlzc2lvbnMgKGUuZy4sIExhbWJkYSBpbnZva2UgcGVybWlzc2lvbnMpXG4gICAqIDIuIFBlcmZvcm0gYW55IHJlcXVpcmVkIHNldHVwXG4gICAqIDMuIFJldHVybiB0aGUgQ2xvdWRGb3JtYXRpb24gY29uZmlndXJhdGlvblxuICAgKlxuICAgKiBAcGFyYW0gc2NvcGUgVGhlIGNvbnN0cnVjdCBzY29wZSBmb3IgY3JlYXRpbmcgYW55IHJlcXVpcmVkIHJlc291cmNlc1xuICAgKiBAcGFyYW0gZ2F0ZXdheSBUaGUgZ2F0ZXdheSB0aGlzIGludGVyY2VwdG9yIGlzIGJlaW5nIGJvdW5kIHRvIFtkaXNhYmxlLWF3c2xpbnQ6cHJlZmVyLXJlZi1pbnRlcmZhY2VdXG4gICAqIEByZXR1cm5zIENvbmZpZ3VyYXRpb24gdGhhdCB3aWxsIGJlIHJlbmRlcmVkIHRvIENsb3VkRm9ybWF0aW9uXG4gICAqL1xuICBiaW5kKHNjb3BlOiBDb25zdHJ1Y3QsIGdhdGV3YXk6IElHYXRld2F5KTogSW50ZXJjZXB0b3JCaW5kQ29uZmlnO1xufVxuXG4vKipcbiAqIENvbmZpZ3VyYXRpb24gcmV0dXJuZWQgZnJvbSBiaW5kaW5nIGFuIGludGVyY2VwdG9yIHRvIGEgR2F0ZXdheVxuICovXG5leHBvcnQgaW50ZXJmYWNlIEludGVyY2VwdG9yQmluZENvbmZpZyB7XG4gIC8qKlxuICAgKiBUaGUgQ2xvdWRGb3JtYXRpb24gY29uZmlndXJhdGlvbiBmb3IgdGhpcyBpbnRlcmNlcHRvclxuICAgKi9cbiAgcmVhZG9ubHkgY29uZmlndXJhdGlvbjogYW55O1xufVxuXG4vKioqKioqKioqKioqKioqKioqKioqKioqKioqKioqKioqKioqKioqKioqKioqKioqKioqKioqKioqKioqKioqKioqKioqKioqKioqKioqXG4gKiAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgQ2xhc3Nlc1xuICoqKioqKioqKioqKioqKioqKioqKioqKioqKioqKioqKioqKioqKioqKioqKioqKioqKioqKioqKioqKioqKioqKioqKioqKioqKioqL1xuXG4vKipcbiAqIEEgTGFtYmRhLWJhc2VkIGludGVyY2VwdG9yIGZvciBHYXRld2F5XG4gKlxuICogSW50ZXJjZXB0b3JzIGFsbG93IHlvdSB0byBydW4gY3VzdG9tIGNvZGUgZHVyaW5nIGVhY2ggaW52b2NhdGlvbiBvZiB5b3VyIGdhdGV3YXk6XG4gKiAtIFJFUVVFU1QgaW50ZXJjZXB0b3JzIGV4ZWN1dGUgYmVmb3JlIGNhbGxpbmcgdGhlIHRhcmdldFxuICogLSBSRVNQT05TRSBpbnRlcmNlcHRvcnMgZXhlY3V0ZSBhZnRlciB0aGUgdGFyZ2V0IHJlc3BvbmRzXG4gKiBAc2VlIGh0dHBzOi8vZG9jcy5hd3MuYW1hem9uLmNvbS9iZWRyb2NrLWFnZW50Y29yZS9sYXRlc3QvZGV2Z3VpZGUvZ2F0ZXdheS1pbnRlcmNlcHRvcnMuaHRtbFxuICovXG5leHBvcnQgY2xhc3MgTGFtYmRhSW50ZXJjZXB0b3IgaW1wbGVtZW50cyBJSW50ZXJjZXB0b3Ige1xuICAvKipcbiAgICogQ3JlYXRlIGEgUkVRVUVTVCBpbnRlcmNlcHRvciB0aGF0IGV4ZWN1dGVzIGJlZm9yZSB0aGUgZ2F0ZXdheSBjYWxscyB0aGUgdGFyZ2V0XG4gICAqXG4gICAqICoqSW1wb3J0YW50OioqIFdoZW4gdGhpcyBpbnRlcmNlcHRvciBpcyBhZGRlZCB0byBhIGdhdGV3YXksIHRoZSBnYXRld2F5J3MgSUFNIHJvbGVcbiAgICogd2lsbCBhdXRvbWF0aWNhbGx5IGJlIGdyYW50ZWQgYGxhbWJkYTpJbnZva2VGdW5jdGlvbmAgcGVybWlzc2lvbiBvbiB0aGUgc3BlY2lmaWVkXG4gICAqIExhbWJkYSBmdW5jdGlvbi5cbiAgICpcbiAgICogQHBhcmFtIGxhbWJkYUZ1bmN0aW9uIFRoZSBMYW1iZGEgZnVuY3Rpb24gdG8gaW52b2tlXG4gICAqIEBwYXJhbSBvcHRpb25zIE9wdGlvbmFsIGNvbmZpZ3VyYXRpb24gZm9yIHRoZSBpbnRlcmNlcHRvclxuICAgKiBAcmV0dXJucyBBIGNvbmZpZ3VyZWQgTGFtYmRhSW50ZXJjZXB0b3IgZm9yIHJlcXVlc3QgaW50ZXJjZXB0aW9uXG4gICAqL1xuICBwdWJsaWMgc3RhdGljIGZvclJlcXVlc3QoXG4gICAgbGFtYmRhRnVuY3Rpb246IElGdW5jdGlvbixcbiAgICBvcHRpb25zPzogSW50ZXJjZXB0b3JPcHRpb25zLFxuICApOiBMYW1iZGFJbnRlcmNlcHRvciB7XG4gICAgcmV0dXJuIG5ldyBMYW1iZGFJbnRlcmNlcHRvcihcbiAgICAgIEludGVyY2VwdGlvblBvaW50LlJFUVVFU1QsXG4gICAgICBsYW1iZGFGdW5jdGlvbixcbiAgICAgIG9wdGlvbnMsXG4gICAgKTtcbiAgfVxuXG4gIC8qKlxuICAgKiBDcmVhdGUgYSBSRVNQT05TRSBpbnRlcmNlcHRvciB0aGF0IGV4ZWN1dGVzIGFmdGVyIHRoZSB0YXJnZXQgcmVzcG9uZHNcbiAgICpcbiAgICogKipJbXBvcnRhbnQ6KiogV2hlbiB0aGlzIGludGVyY2VwdG9yIGlzIGFkZGVkIHRvIGEgZ2F0ZXdheSwgdGhlIGdhdGV3YXkncyBJQU0gcm9sZVxuICAgKiB3aWxsIGF1dG9tYXRpY2FsbHkgYmUgZ3JhbnRlZCBgbGFtYmRhOkludm9rZUZ1bmN0aW9uYCBwZXJtaXNzaW9uIG9uIHRoZSBzcGVjaWZpZWRcbiAgICogTGFtYmRhIGZ1bmN0aW9uLlxuICAgKlxuICAgKiBAcGFyYW0gbGFtYmRhRnVuY3Rpb24gVGhlIExhbWJkYSBmdW5jdGlvbiB0byBpbnZva2VcbiAgICogQHBhcmFtIG9wdGlvbnMgT3B0aW9uYWwgY29uZmlndXJhdGlvbiBmb3IgdGhlIGludGVyY2VwdG9yXG4gICAqIEByZXR1cm5zIEEgY29uZmlndXJlZCBMYW1iZGFJbnRlcmNlcHRvciBmb3IgcmVzcG9uc2UgaW50ZXJjZXB0aW9uXG4gICAqL1xuICBwdWJsaWMgc3RhdGljIGZvclJlc3BvbnNlKFxuICAgIGxhbWJkYUZ1bmN0aW9uOiBJRnVuY3Rpb24sXG4gICAgb3B0aW9ucz86IEludGVyY2VwdG9yT3B0aW9ucyxcbiAgKTogTGFtYmRhSW50ZXJjZXB0b3Ige1xuICAgIHJldHVybiBuZXcgTGFtYmRhSW50ZXJjZXB0b3IoXG4gICAgICBJbnRlcmNlcHRpb25Qb2ludC5SRVNQT05TRSxcbiAgICAgIGxhbWJkYUZ1bmN0aW9uLFxuICAgICAgb3B0aW9ucyxcbiAgICApO1xuICB9XG5cbiAgLyoqXG4gICAqIFRoZSBpbnRlcmNlcHRpb24gcG9pbnQgKFJFUVVFU1Qgb3IgUkVTUE9OU0UpXG4gICAqL1xuICBwdWJsaWMgcmVhZG9ubHkgaW50ZXJjZXB0aW9uUG9pbnQ6IEludGVyY2VwdGlvblBvaW50O1xuXG4gIC8qKlxuICAgKiBUaGUgTGFtYmRhIGZ1bmN0aW9uIHRvIGludm9rZSBmb3IgdGhpcyBpbnRlcmNlcHRvclxuICAgKi9cbiAgcHJpdmF0ZSByZWFkb25seSBsYW1iZGFGdW5jdGlvbjogSUZ1bmN0aW9uO1xuXG4gIC8qKlxuICAgKiBXaGV0aGVyIHRvIHBhc3MgcmVxdWVzdCBoZWFkZXJzIHRvIHRoZSBpbnRlcmNlcHRvclxuICAgKlxuICAgKiBAZGVmYXVsdCBmYWxzZSAtIEhlYWRlcnMgYXJlIG5vdCBwYXNzZWQgZm9yIHNlY3VyaXR5XG4gICAqL1xuICBwcml2YXRlIHJlYWRvbmx5IHBhc3NSZXF1ZXN0SGVhZGVyczogYm9vbGVhbjtcblxuICBwcml2YXRlIGNvbnN0cnVjdG9yKFxuICAgIGludGVyY2VwdGlvblBvaW50OiBJbnRlcmNlcHRpb25Qb2ludCxcbiAgICBsYW1iZGFGdW5jdGlvbjogSUZ1bmN0aW9uLFxuICAgIG9wdGlvbnM/OiBJbnRlcmNlcHRvck9wdGlvbnMsXG4gICkge1xuICAgIHRoaXMuaW50ZXJjZXB0aW9uUG9pbnQgPSBpbnRlcmNlcHRpb25Qb2ludDtcbiAgICB0aGlzLmxhbWJkYUZ1bmN0aW9uID0gbGFtYmRhRnVuY3Rpb247XG4gICAgdGhpcy5wYXNzUmVxdWVzdEhlYWRlcnMgPSBvcHRpb25zPy5wYXNzUmVxdWVzdEhlYWRlcnMgPz8gZmFsc2U7XG4gIH1cblxuICAvKipcbiAgICogQmluZHMgdGhpcyBMYW1iZGEgaW50ZXJjZXB0b3IgdG8gYSBHYXRld2F5XG4gICAqXG4gICAqIFRoaXMgbWV0aG9kOlxuICAgKiAxLiBHcmFudHMgdGhlIEdhdGV3YXkncyBJQU0gcm9sZSBwZXJtaXNzaW9uIHRvIGludm9rZSB0aGUgTGFtYmRhIGZ1bmN0aW9uXG4gICAqIDIuIFJldHVybnMgdGhlIENsb3VkRm9ybWF0aW9uIGNvbmZpZ3VyYXRpb24gZm9yIHRoaXMgaW50ZXJjZXB0b3JcbiAgICpcbiAgICogQHBhcmFtIF9zY29wZSBUaGUgY29uc3RydWN0IHNjb3BlIChjdXJyZW50bHkgdW51c2VkLCByZXNlcnZlZCBmb3IgZnV0dXJlIGV4dGVuc2lvbnMpXG4gICAqIEBwYXJhbSBnYXRld2F5IFRoZSBnYXRld2F5IHRoaXMgaW50ZXJjZXB0b3IgaXMgYmVpbmcgYm91bmQgdG9cbiAgICogQHJldHVybnMgQ29uZmlndXJhdGlvbiBmb3IgQ2xvdWRGb3JtYXRpb24gcmVuZGVyaW5nXG4gICAqL1xuICBwdWJsaWMgYmluZChfc2NvcGU6IENvbnN0cnVjdCwgZ2F0ZXdheTogSUdhdGV3YXkpOiBJbnRlcmNlcHRvckJpbmRDb25maWcge1xuICAgIC8vIEdyYW50IExhbWJkYSBpbnZva2UgcGVybWlzc2lvbiB0byB0aGUgR2F0ZXdheSdzIHJvbGVcbiAgICB0aGlzLmxhbWJkYUZ1bmN0aW9uLmdyYW50SW52b2tlKGdhdGV3YXkucm9sZSk7XG5cbiAgICAvLyBSZXR1cm4gQ2xvdWRGb3JtYXRpb24gY29uZmlndXJhdGlvblxuICAgIHJldHVybiB7XG4gICAgICBjb25maWd1cmF0aW9uOiB7XG4gICAgICAgIGludGVyY2VwdGlvblBvaW50czogW3RoaXMuaW50ZXJjZXB0aW9uUG9pbnRdLFxuICAgICAgICBpbnRlcmNlcHRvcjoge1xuICAgICAgICAgIGxhbWJkYToge1xuICAgICAgICAgICAgYXJuOiB0aGlzLmxhbWJkYUZ1bmN0aW9uLmZ1bmN0aW9uQXJuLFxuICAgICAgICAgIH0sXG4gICAgICAgIH0sXG4gICAgICAgIGlucHV0Q29uZmlndXJhdGlvbjoge1xuICAgICAgICAgIHBhc3NSZXF1ZXN0SGVhZGVyczogdGhpcy5wYXNzUmVxdWVzdEhlYWRlcnMsXG4gICAgICAgIH0sXG4gICAgICB9LFxuICAgIH07XG4gIH1cbn1cbiJdfQ==

package/lib/gateway/outbound-auth/api-key.js

@@ -19,7 +19,7 @@ var ApiKeyCredentialLocationType;
  * API Key location within the request
  */
 class ApiKeyCredentialLocation {
-    static [JSII_RTTI_SYMBOL_1] = { fqn: "@aws-cdk/aws-bedrock-agentcore-alpha.ApiKeyCredentialLocation", version: "2.235.1-alpha.0" };
+    static [JSII_RTTI_SYMBOL_1] = { fqn: "@aws-cdk/aws-bedrock-agentcore-alpha.ApiKeyCredentialLocation", version: "2.237.0-alpha.0" };
     /**
      * Create a header-based API key credential location
      * @param config - Optional configuration for the credential location

package/lib/gateway/outbound-auth/credential-provider.js

@@ -31,7 +31,7 @@ var CredentialProviderType;
  * Factory class for creating different Gateway Credential Providers
  */
 class GatewayCredentialProvider {
-    static [JSII_RTTI_SYMBOL_1] = { fqn: "@aws-cdk/aws-bedrock-agentcore-alpha.GatewayCredentialProvider", version: "2.235.1-alpha.0" };
+    static [JSII_RTTI_SYMBOL_1] = { fqn: "@aws-cdk/aws-bedrock-agentcore-alpha.GatewayCredentialProvider", version: "2.237.0-alpha.0" };
     /**
      * Create an API key credential provider from Identity ARN
      * Use this method when you have the Identity ARN as a string

package/lib/gateway/protocol.js

@@ -21,7 +21,7 @@ var GatewayProtocolType;
  * Factory class for instantiating Gateway Protocols
  */
 class GatewayProtocol {
-    static [JSII_RTTI_SYMBOL_1] = { fqn: "@aws-cdk/aws-bedrock-agentcore-alpha.GatewayProtocol", version: "2.235.1-alpha.0" };
+    static [JSII_RTTI_SYMBOL_1] = { fqn: "@aws-cdk/aws-bedrock-agentcore-alpha.GatewayProtocol", version: "2.237.0-alpha.0" };
     /**
      * Create an MCP protocol configuration
      * @param props - Optional MCP configuration properties
@@ -75,7 +75,7 @@ var McpGatewaySearchType;
  * MCP (Model Context Protocol) configuration implementation
  */
 class McpProtocolConfiguration {
-    static [JSII_RTTI_SYMBOL_1] = { fqn: "@aws-cdk/aws-bedrock-agentcore-alpha.McpProtocolConfiguration", version: "2.235.1-alpha.0" };
+    static [JSII_RTTI_SYMBOL_1] = { fqn: "@aws-cdk/aws-bedrock-agentcore-alpha.McpProtocolConfiguration", version: "2.237.0-alpha.0" };
     protocolType;
     /**
      * The supported MCP protocol versions