@aws-cdk/aws-bedrock-agentcore-alpha 2.236.0-alpha.0 → 2.237.0-alpha.0

package/.warnings.jsii.js

@@ -92,6 +92,8 @@ function _aws_cdk_aws_bedrock_agentcore_alpha_CodeInterpreterNetworkConfiguratio
 }
 function _aws_cdk_aws_bedrock_agentcore_alpha_RuntimeNetworkConfiguration(p) {
 }
+function _aws_cdk_aws_bedrock_agentcore_alpha_CustomClaimOperator(p) {
+}
 function _aws_cdk_aws_bedrock_agentcore_alpha_ProtocolType(p) {
 }
 function _aws_cdk_aws_bedrock_agentcore_alpha_RequestHeaderConfiguration(p) {
@@ -120,6 +122,8 @@ function _aws_cdk_aws_bedrock_agentcore_alpha_AgentCoreRuntime(p) {
 }
 function _aws_cdk_aws_bedrock_agentcore_alpha_AgentRuntimeArtifact(p) {
 }
+function _aws_cdk_aws_bedrock_agentcore_alpha_RuntimeCustomClaim(p) {
+}
 function _aws_cdk_aws_bedrock_agentcore_alpha_RuntimeAuthorizerConfiguration(p) {
 }
 function _aws_cdk_aws_bedrock_agentcore_alpha_IRuntimeEndpoint(p) {
@@ -363,6 +367,18 @@ function _aws_cdk_aws_bedrock_agentcore_alpha_GatewayAuthorizerType(p) {
 function _aws_cdk_aws_bedrock_agentcore_alpha_IGatewayAuthorizerConfig(p) {
 }
 function _aws_cdk_aws_bedrock_agentcore_alpha_CustomJwtConfiguration(p) {
+    if (p == null)
+        return;
+    visitedObjects.add(p);
+    try {
+        if (p.customClaims != null)
+            for (const o of p.customClaims)
+                if (!visitedObjects.has(o))
+                    _aws_cdk_aws_bedrock_agentcore_alpha_GatewayCustomClaim(o);
+    }
+    finally {
+        visitedObjects.delete(p);
+    }
 }
 function _aws_cdk_aws_bedrock_agentcore_alpha_CustomJwtAuthorizer(p) {
 }
@@ -377,6 +393,10 @@ function _aws_cdk_aws_bedrock_agentcore_alpha_CognitoAuthorizerProps(p) {
             for (const o of p.allowedClients)
                 if (!visitedObjects.has(o))
                     require("aws-cdk-lib/.warnings.jsii.js").aws_cdk_lib_aws_cognito_IUserPoolClient(o);
+        if (p.customClaims != null)
+            for (const o of p.customClaims)
+                if (!visitedObjects.has(o))
+                    _aws_cdk_aws_bedrock_agentcore_alpha_GatewayCustomClaim(o);
     }
     finally {
         visitedObjects.delete(p);
@@ -384,6 +404,8 @@ function _aws_cdk_aws_bedrock_agentcore_alpha_CognitoAuthorizerProps(p) {
 }
 function _aws_cdk_aws_bedrock_agentcore_alpha_GatewayAuthorizer(p) {
 }
+function _aws_cdk_aws_bedrock_agentcore_alpha_GatewayCustomClaim(p) {
+}
 function _aws_cdk_aws_bedrock_agentcore_alpha_CredentialProviderType(p) {
 }
 function _aws_cdk_aws_bedrock_agentcore_alpha_ICredentialProviderConfig(p) {
@@ -622,4 +644,4 @@ class DeprecationError extends Error {
         });
     }
 }
-module.exports = { print, getPropertyDescriptor, DeprecationError, _aws_cdk_aws_bedrock_agentcore_alpha_IMemory, _aws_cdk_aws_bedrock_agentcore_alpha_MemoryBase, _aws_cdk_aws_bedrock_agentcore_alpha_MemoryProps, _aws_cdk_aws_bedrock_agentcore_alpha_MemoryAttributes, _aws_cdk_aws_bedrock_agentcore_alpha_Memory, _aws_cdk_aws_bedrock_agentcore_alpha_OverrideConfig, _aws_cdk_aws_bedrock_agentcore_alpha_EpisodicReflectionConfiguration, _aws_cdk_aws_bedrock_agentcore_alpha_ManagedStrategyProps, _aws_cdk_aws_bedrock_agentcore_alpha_ManagedMemoryStrategy, _aws_cdk_aws_bedrock_agentcore_alpha_TriggerConditions, _aws_cdk_aws_bedrock_agentcore_alpha_InvocationConfiguration, _aws_cdk_aws_bedrock_agentcore_alpha_SelfManagedStrategyProps, _aws_cdk_aws_bedrock_agentcore_alpha_SelfManagedMemoryStrategy, _aws_cdk_aws_bedrock_agentcore_alpha_MemoryStrategyType, _aws_cdk_aws_bedrock_agentcore_alpha_MemoryStrategyCommonProps, _aws_cdk_aws_bedrock_agentcore_alpha_IMemoryStrategy, _aws_cdk_aws_bedrock_agentcore_alpha_MemoryStrategy, _aws_cdk_aws_bedrock_agentcore_alpha_VpcConfigProps, _aws_cdk_aws_bedrock_agentcore_alpha_NetworkConfiguration, _aws_cdk_aws_bedrock_agentcore_alpha_BrowserNetworkConfiguration, _aws_cdk_aws_bedrock_agentcore_alpha_CodeInterpreterNetworkConfiguration, _aws_cdk_aws_bedrock_agentcore_alpha_RuntimeNetworkConfiguration, _aws_cdk_aws_bedrock_agentcore_alpha_ProtocolType, _aws_cdk_aws_bedrock_agentcore_alpha_RequestHeaderConfiguration, _aws_cdk_aws_bedrock_agentcore_alpha_LifecycleConfiguration, _aws_cdk_aws_bedrock_agentcore_alpha_IBedrockAgentRuntime, _aws_cdk_aws_bedrock_agentcore_alpha_RuntimeBase, _aws_cdk_aws_bedrock_agentcore_alpha_AgentRuntimeAttributes, _aws_cdk_aws_bedrock_agentcore_alpha_AgentCoreRuntime, _aws_cdk_aws_bedrock_agentcore_alpha_AgentRuntimeArtifact, _aws_cdk_aws_bedrock_agentcore_alpha_RuntimeAuthorizerConfiguration, _aws_cdk_aws_bedrock_agentcore_alpha_IRuntimeEndpoint, _aws_cdk_aws_bedrock_agentcore_alpha_RuntimeEndpointBase, _aws_cdk_aws_bedrock_agentcore_alpha_RuntimeEndpointAttributes, _aws_cdk_aws_bedrock_agentcore_alpha_RuntimeEndpointProps, _aws_cdk_aws_bedrock_agentcore_alpha_RuntimeEndpoint, _aws_cdk_aws_bedrock_agentcore_alpha_RuntimeProps, _aws_cdk_aws_bedrock_agentcore_alpha_AddEndpointOptions, _aws_cdk_aws_bedrock_agentcore_alpha_Runtime, _aws_cdk_aws_bedrock_agentcore_alpha_ICodeInterpreterCustom, _aws_cdk_aws_bedrock_agentcore_alpha_CodeInterpreterCustomBase, _aws_cdk_aws_bedrock_agentcore_alpha_CodeInterpreterCustomProps, _aws_cdk_aws_bedrock_agentcore_alpha_CodeInterpreterCustomAttributes, _aws_cdk_aws_bedrock_agentcore_alpha_CodeInterpreterCustom, _aws_cdk_aws_bedrock_agentcore_alpha_BrowserSigning, _aws_cdk_aws_bedrock_agentcore_alpha_IBrowserCustom, _aws_cdk_aws_bedrock_agentcore_alpha_BrowserCustomBase, _aws_cdk_aws_bedrock_agentcore_alpha_RecordingConfig, _aws_cdk_aws_bedrock_agentcore_alpha_BrowserCustomProps, _aws_cdk_aws_bedrock_agentcore_alpha_BrowserCustomAttributes, _aws_cdk_aws_bedrock_agentcore_alpha_BrowserCustom, _aws_cdk_aws_bedrock_agentcore_alpha_GatewayExceptionLevel, _aws_cdk_aws_bedrock_agentcore_alpha_IGateway, _aws_cdk_aws_bedrock_agentcore_alpha_GatewayBase, _aws_cdk_aws_bedrock_agentcore_alpha_AddLambdaTargetOptions, _aws_cdk_aws_bedrock_agentcore_alpha_AddOpenApiTargetOptions, _aws_cdk_aws_bedrock_agentcore_alpha_AddSmithyTargetOptions, _aws_cdk_aws_bedrock_agentcore_alpha_AddMcpServerTargetOptions, _aws_cdk_aws_bedrock_agentcore_alpha_GatewayProps, _aws_cdk_aws_bedrock_agentcore_alpha_GatewayAttributes, _aws_cdk_aws_bedrock_agentcore_alpha_Gateway, _aws_cdk_aws_bedrock_agentcore_alpha_InterceptionPoint, _aws_cdk_aws_bedrock_agentcore_alpha_InterceptorOptions, _aws_cdk_aws_bedrock_agentcore_alpha_IInterceptor, _aws_cdk_aws_bedrock_agentcore_alpha_InterceptorBindConfig, _aws_cdk_aws_bedrock_agentcore_alpha_LambdaInterceptor, _aws_cdk_aws_bedrock_agentcore_alpha_IGatewayProtocolConfig, _aws_cdk_aws_bedrock_agentcore_alpha_GatewayProtocol, _aws_cdk_aws_bedrock_agentcore_alpha_MCPProtocolVersion, _aws_cdk_aws_bedrock_agentcore_alpha_McpGatewaySearchType, _aws_cdk_aws_bedrock_agentcore_alpha_McpConfiguration, _aws_cdk_aws_bedrock_agentcore_alpha_McpProtocolConfiguration, _aws_cdk_aws_bedrock_agentcore_alpha_GatewayAuthorizerType, _aws_cdk_aws_bedrock_agentcore_alpha_IGatewayAuthorizerConfig, _aws_cdk_aws_bedrock_agentcore_alpha_CustomJwtConfiguration, _aws_cdk_aws_bedrock_agentcore_alpha_CustomJwtAuthorizer, _aws_cdk_aws_bedrock_agentcore_alpha_IamAuthorizer, _aws_cdk_aws_bedrock_agentcore_alpha_CognitoAuthorizerProps, _aws_cdk_aws_bedrock_agentcore_alpha_GatewayAuthorizer, _aws_cdk_aws_bedrock_agentcore_alpha_CredentialProviderType, _aws_cdk_aws_bedrock_agentcore_alpha_ICredentialProviderConfig, _aws_cdk_aws_bedrock_agentcore_alpha_GatewayCredentialProvider, _aws_cdk_aws_bedrock_agentcore_alpha_ApiKeyAdditionalConfiguration, _aws_cdk_aws_bedrock_agentcore_alpha_ApiKeyCredentialLocation, _aws_cdk_aws_bedrock_agentcore_alpha_ApiKeyCredentialProviderProps, _aws_cdk_aws_bedrock_agentcore_alpha_OAuthConfiguration, _aws_cdk_aws_bedrock_agentcore_alpha_GatewayTargetProtocolType, _aws_cdk_aws_bedrock_agentcore_alpha_McpTargetType, _aws_cdk_aws_bedrock_agentcore_alpha_IGatewayTarget, _aws_cdk_aws_bedrock_agentcore_alpha_IMcpGatewayTarget, _aws_cdk_aws_bedrock_agentcore_alpha_GatewayTargetBase, _aws_cdk_aws_bedrock_agentcore_alpha_GatewayTargetCommonProps, _aws_cdk_aws_bedrock_agentcore_alpha_GatewayTargetProps, _aws_cdk_aws_bedrock_agentcore_alpha_GatewayTargetLambdaProps, _aws_cdk_aws_bedrock_agentcore_alpha_GatewayTargetOpenApiProps, _aws_cdk_aws_bedrock_agentcore_alpha_GatewayTargetSmithyProps, _aws_cdk_aws_bedrock_agentcore_alpha_GatewayTargetMcpServerProps, _aws_cdk_aws_bedrock_agentcore_alpha_GatewayTargetAttributes, _aws_cdk_aws_bedrock_agentcore_alpha_GatewayTarget, _aws_cdk_aws_bedrock_agentcore_alpha_TargetConfigurationConfig, _aws_cdk_aws_bedrock_agentcore_alpha_ITargetConfiguration, _aws_cdk_aws_bedrock_agentcore_alpha_McpTargetConfiguration, _aws_cdk_aws_bedrock_agentcore_alpha_LambdaTargetConfiguration, _aws_cdk_aws_bedrock_agentcore_alpha_OpenApiTargetConfiguration, _aws_cdk_aws_bedrock_agentcore_alpha_SmithyTargetConfiguration, _aws_cdk_aws_bedrock_agentcore_alpha_McpServerTargetConfiguration, _aws_cdk_aws_bedrock_agentcore_alpha_ApiSchema, _aws_cdk_aws_bedrock_agentcore_alpha_AssetApiSchema, _aws_cdk_aws_bedrock_agentcore_alpha_InlineApiSchema, _aws_cdk_aws_bedrock_agentcore_alpha_S3ApiSchema, _aws_cdk_aws_bedrock_agentcore_alpha_SchemaDefinitionType, _aws_cdk_aws_bedrock_agentcore_alpha_SchemaDefinition, _aws_cdk_aws_bedrock_agentcore_alpha_ToolDefinition, _aws_cdk_aws_bedrock_agentcore_alpha_ToolSchema, _aws_cdk_aws_bedrock_agentcore_alpha_AssetToolSchema, _aws_cdk_aws_bedrock_agentcore_alpha_InlineToolSchema, _aws_cdk_aws_bedrock_agentcore_alpha_S3ToolSchema };
+module.exports = { print, getPropertyDescriptor, DeprecationError, _aws_cdk_aws_bedrock_agentcore_alpha_IMemory, _aws_cdk_aws_bedrock_agentcore_alpha_MemoryBase, _aws_cdk_aws_bedrock_agentcore_alpha_MemoryProps, _aws_cdk_aws_bedrock_agentcore_alpha_MemoryAttributes, _aws_cdk_aws_bedrock_agentcore_alpha_Memory, _aws_cdk_aws_bedrock_agentcore_alpha_OverrideConfig, _aws_cdk_aws_bedrock_agentcore_alpha_EpisodicReflectionConfiguration, _aws_cdk_aws_bedrock_agentcore_alpha_ManagedStrategyProps, _aws_cdk_aws_bedrock_agentcore_alpha_ManagedMemoryStrategy, _aws_cdk_aws_bedrock_agentcore_alpha_TriggerConditions, _aws_cdk_aws_bedrock_agentcore_alpha_InvocationConfiguration, _aws_cdk_aws_bedrock_agentcore_alpha_SelfManagedStrategyProps, _aws_cdk_aws_bedrock_agentcore_alpha_SelfManagedMemoryStrategy, _aws_cdk_aws_bedrock_agentcore_alpha_MemoryStrategyType, _aws_cdk_aws_bedrock_agentcore_alpha_MemoryStrategyCommonProps, _aws_cdk_aws_bedrock_agentcore_alpha_IMemoryStrategy, _aws_cdk_aws_bedrock_agentcore_alpha_MemoryStrategy, _aws_cdk_aws_bedrock_agentcore_alpha_VpcConfigProps, _aws_cdk_aws_bedrock_agentcore_alpha_NetworkConfiguration, _aws_cdk_aws_bedrock_agentcore_alpha_BrowserNetworkConfiguration, _aws_cdk_aws_bedrock_agentcore_alpha_CodeInterpreterNetworkConfiguration, _aws_cdk_aws_bedrock_agentcore_alpha_RuntimeNetworkConfiguration, _aws_cdk_aws_bedrock_agentcore_alpha_CustomClaimOperator, _aws_cdk_aws_bedrock_agentcore_alpha_ProtocolType, _aws_cdk_aws_bedrock_agentcore_alpha_RequestHeaderConfiguration, _aws_cdk_aws_bedrock_agentcore_alpha_LifecycleConfiguration, _aws_cdk_aws_bedrock_agentcore_alpha_IBedrockAgentRuntime, _aws_cdk_aws_bedrock_agentcore_alpha_RuntimeBase, _aws_cdk_aws_bedrock_agentcore_alpha_AgentRuntimeAttributes, _aws_cdk_aws_bedrock_agentcore_alpha_AgentCoreRuntime, _aws_cdk_aws_bedrock_agentcore_alpha_AgentRuntimeArtifact, _aws_cdk_aws_bedrock_agentcore_alpha_RuntimeCustomClaim, _aws_cdk_aws_bedrock_agentcore_alpha_RuntimeAuthorizerConfiguration, _aws_cdk_aws_bedrock_agentcore_alpha_IRuntimeEndpoint, _aws_cdk_aws_bedrock_agentcore_alpha_RuntimeEndpointBase, _aws_cdk_aws_bedrock_agentcore_alpha_RuntimeEndpointAttributes, _aws_cdk_aws_bedrock_agentcore_alpha_RuntimeEndpointProps, _aws_cdk_aws_bedrock_agentcore_alpha_RuntimeEndpoint, _aws_cdk_aws_bedrock_agentcore_alpha_RuntimeProps, _aws_cdk_aws_bedrock_agentcore_alpha_AddEndpointOptions, _aws_cdk_aws_bedrock_agentcore_alpha_Runtime, _aws_cdk_aws_bedrock_agentcore_alpha_ICodeInterpreterCustom, _aws_cdk_aws_bedrock_agentcore_alpha_CodeInterpreterCustomBase, _aws_cdk_aws_bedrock_agentcore_alpha_CodeInterpreterCustomProps, _aws_cdk_aws_bedrock_agentcore_alpha_CodeInterpreterCustomAttributes, _aws_cdk_aws_bedrock_agentcore_alpha_CodeInterpreterCustom, _aws_cdk_aws_bedrock_agentcore_alpha_BrowserSigning, _aws_cdk_aws_bedrock_agentcore_alpha_IBrowserCustom, _aws_cdk_aws_bedrock_agentcore_alpha_BrowserCustomBase, _aws_cdk_aws_bedrock_agentcore_alpha_RecordingConfig, _aws_cdk_aws_bedrock_agentcore_alpha_BrowserCustomProps, _aws_cdk_aws_bedrock_agentcore_alpha_BrowserCustomAttributes, _aws_cdk_aws_bedrock_agentcore_alpha_BrowserCustom, _aws_cdk_aws_bedrock_agentcore_alpha_GatewayExceptionLevel, _aws_cdk_aws_bedrock_agentcore_alpha_IGateway, _aws_cdk_aws_bedrock_agentcore_alpha_GatewayBase, _aws_cdk_aws_bedrock_agentcore_alpha_AddLambdaTargetOptions, _aws_cdk_aws_bedrock_agentcore_alpha_AddOpenApiTargetOptions, _aws_cdk_aws_bedrock_agentcore_alpha_AddSmithyTargetOptions, _aws_cdk_aws_bedrock_agentcore_alpha_AddMcpServerTargetOptions, _aws_cdk_aws_bedrock_agentcore_alpha_GatewayProps, _aws_cdk_aws_bedrock_agentcore_alpha_GatewayAttributes, _aws_cdk_aws_bedrock_agentcore_alpha_Gateway, _aws_cdk_aws_bedrock_agentcore_alpha_InterceptionPoint, _aws_cdk_aws_bedrock_agentcore_alpha_InterceptorOptions, _aws_cdk_aws_bedrock_agentcore_alpha_IInterceptor, _aws_cdk_aws_bedrock_agentcore_alpha_InterceptorBindConfig, _aws_cdk_aws_bedrock_agentcore_alpha_LambdaInterceptor, _aws_cdk_aws_bedrock_agentcore_alpha_IGatewayProtocolConfig, _aws_cdk_aws_bedrock_agentcore_alpha_GatewayProtocol, _aws_cdk_aws_bedrock_agentcore_alpha_MCPProtocolVersion, _aws_cdk_aws_bedrock_agentcore_alpha_McpGatewaySearchType, _aws_cdk_aws_bedrock_agentcore_alpha_McpConfiguration, _aws_cdk_aws_bedrock_agentcore_alpha_McpProtocolConfiguration, _aws_cdk_aws_bedrock_agentcore_alpha_GatewayAuthorizerType, _aws_cdk_aws_bedrock_agentcore_alpha_IGatewayAuthorizerConfig, _aws_cdk_aws_bedrock_agentcore_alpha_CustomJwtConfiguration, _aws_cdk_aws_bedrock_agentcore_alpha_CustomJwtAuthorizer, _aws_cdk_aws_bedrock_agentcore_alpha_IamAuthorizer, _aws_cdk_aws_bedrock_agentcore_alpha_CognitoAuthorizerProps, _aws_cdk_aws_bedrock_agentcore_alpha_GatewayAuthorizer, _aws_cdk_aws_bedrock_agentcore_alpha_GatewayCustomClaim, _aws_cdk_aws_bedrock_agentcore_alpha_CredentialProviderType, _aws_cdk_aws_bedrock_agentcore_alpha_ICredentialProviderConfig, _aws_cdk_aws_bedrock_agentcore_alpha_GatewayCredentialProvider, _aws_cdk_aws_bedrock_agentcore_alpha_ApiKeyAdditionalConfiguration, _aws_cdk_aws_bedrock_agentcore_alpha_ApiKeyCredentialLocation, _aws_cdk_aws_bedrock_agentcore_alpha_ApiKeyCredentialProviderProps, _aws_cdk_aws_bedrock_agentcore_alpha_OAuthConfiguration, _aws_cdk_aws_bedrock_agentcore_alpha_GatewayTargetProtocolType, _aws_cdk_aws_bedrock_agentcore_alpha_McpTargetType, _aws_cdk_aws_bedrock_agentcore_alpha_IGatewayTarget, _aws_cdk_aws_bedrock_agentcore_alpha_IMcpGatewayTarget, _aws_cdk_aws_bedrock_agentcore_alpha_GatewayTargetBase, _aws_cdk_aws_bedrock_agentcore_alpha_GatewayTargetCommonProps, _aws_cdk_aws_bedrock_agentcore_alpha_GatewayTargetProps, _aws_cdk_aws_bedrock_agentcore_alpha_GatewayTargetLambdaProps, _aws_cdk_aws_bedrock_agentcore_alpha_GatewayTargetOpenApiProps, _aws_cdk_aws_bedrock_agentcore_alpha_GatewayTargetSmithyProps, _aws_cdk_aws_bedrock_agentcore_alpha_GatewayTargetMcpServerProps, _aws_cdk_aws_bedrock_agentcore_alpha_GatewayTargetAttributes, _aws_cdk_aws_bedrock_agentcore_alpha_GatewayTarget, _aws_cdk_aws_bedrock_agentcore_alpha_TargetConfigurationConfig, _aws_cdk_aws_bedrock_agentcore_alpha_ITargetConfiguration, _aws_cdk_aws_bedrock_agentcore_alpha_McpTargetConfiguration, _aws_cdk_aws_bedrock_agentcore_alpha_LambdaTargetConfiguration, _aws_cdk_aws_bedrock_agentcore_alpha_OpenApiTargetConfiguration, _aws_cdk_aws_bedrock_agentcore_alpha_SmithyTargetConfiguration, _aws_cdk_aws_bedrock_agentcore_alpha_McpServerTargetConfiguration, _aws_cdk_aws_bedrock_agentcore_alpha_ApiSchema, _aws_cdk_aws_bedrock_agentcore_alpha_AssetApiSchema, _aws_cdk_aws_bedrock_agentcore_alpha_InlineApiSchema, _aws_cdk_aws_bedrock_agentcore_alpha_S3ApiSchema, _aws_cdk_aws_bedrock_agentcore_alpha_SchemaDefinitionType, _aws_cdk_aws_bedrock_agentcore_alpha_SchemaDefinition, _aws_cdk_aws_bedrock_agentcore_alpha_ToolDefinition, _aws_cdk_aws_bedrock_agentcore_alpha_ToolSchema, _aws_cdk_aws_bedrock_agentcore_alpha_AssetToolSchema, _aws_cdk_aws_bedrock_agentcore_alpha_InlineToolSchema, _aws_cdk_aws_bedrock_agentcore_alpha_S3ToolSchema };

package/README.md

@@ -469,16 +469,34 @@ const repository = new ecr.Repository(this, "TestRepository", {
 });
 const agentRuntimeArtifact = agentcore.AgentRuntimeArtifact.fromEcrRepository(repository, "v1.0.0");
 
+// Optional: Create custom claims for additional validation
+const customClaims = [
+  agentcore.RuntimeCustomClaim.withStringValue('department', 'engineering'),
+  agentcore.RuntimeCustomClaim.withStringArrayValue('roles', ['admin'], agentcore.CustomClaimOperator.CONTAINS),
+  agentcore.RuntimeCustomClaim.withStringArrayValue('permissions', ['read', 'write'], agentcore.CustomClaimOperator.CONTAINS_ANY),
+];
+
 const runtime = new agentcore.Runtime(this, "MyAgentRuntime", {
   runtimeName: "myAgent",
   agentRuntimeArtifact: agentRuntimeArtifact,
   authorizerConfiguration: agentcore.RuntimeAuthorizerConfiguration.usingCognito(
     userPool, // User Pool (required)
     [userPoolClient, anotherUserPoolClient], // User Pool Clients
+    ["audience1"], // Allowed Audiences (optional)
+    ["read", "write"], // Allowed Scopes (optional)
+    customClaims, // Custom claims (optional) - see Custom Claims Validation section
   ),
 });
 ```
 
+You can configure:
+
+- User Pool: The Cognito User Pool that issues JWT tokens
+- User Pool Clients: One or more Cognito User Pool App Clients that are allowed to access the runtime
+- Allowed audiences: Used to validate that the audiences specified in the Cognito token match or are a subset of the audiences specified in the AgentCore Runtime
+- Allowed scopes: Allow access only if the token contains at least one of the required scopes configured here
+- Custom claims: A set of rules to match specific claims in the incoming token against predefined values for validating JWT tokens
+
 #### JWT Authentication
 
 To configure custom JWT authentication with your own OpenID Connect (OIDC) provider:
@@ -495,13 +513,77 @@ const runtime = new agentcore.Runtime(this, "MyAgentRuntime", {
   authorizerConfiguration: agentcore.RuntimeAuthorizerConfiguration.usingJWT(
     "https://example.com/.well-known/openid-configuration",  // Discovery URL (required)
     ["client1", "client2"],  // Allowed Client IDs (optional)
-    ["audience1"]           // Allowed Audiences (optional)
+    ["audience1"],           // Allowed Audiences (optional)
+    ["read", "write"],       // Allowed Scopes (optional)
+    // Custom claims (optional) - see Custom Claims Validation section below
   ),
 });
 ```
 
+You can configure:
+
+- Discovery URL: Enter the Discovery URL from your identity provider (e.g. Okta, Cognito, etc.), typically found in that provider's documentation. This allows your Agent or Tool to fetch login, downstream resource token, and verification settings.
+- Allowed audiences: This is used to validate that the audiences specified for the OAuth token matches or are a subset of the audiences specified in the AgentCore Runtime.
+- Allowed clients: This is used to validate that the public identifier of the client, as specified in the authorization token, is allowed to access the AgentCore Runtime.
+- Allowed scopes: Allow access only if the token contains at least one of the required scopes configured here.
+- Custom claims: A set of rules to match specific claims in the incoming token against predefined values for validating JWT tokens.
+
 **Note**: The discovery URL must end with `/.well-known/openid-configuration`.
 
+##### Custom Claims Validation
+
+Custom claims allow you to validate additional fields in JWT tokens beyond the standard audience, client, and scope validations. You can create custom claims using the `RuntimeCustomClaim` class:
+
+```typescript fixture=default
+const repository = new ecr.Repository(this, "TestRepository", {
+  repositoryName: "test-agent-runtime",
+});
+const agentRuntimeArtifact = agentcore.AgentRuntimeArtifact.fromEcrRepository(repository, "v1.0.0");
+
+// String claim - validates that the claim exactly equals the specified value
+// Uses EQUALS operator automatically
+const departmentClaim = agentcore.RuntimeCustomClaim.withStringValue('department', 'engineering');
+
+// String array claim with CONTAINS operator (default)
+// Validates that the claim array contains a specific string value
+// IMPORTANT: CONTAINS requires exactly one value in the array parameter
+const rolesClaim = agentcore.RuntimeCustomClaim.withStringArrayValue('roles', ['admin']);
+
+// String array claim with CONTAINS_ANY operator
+// Validates that the claim array contains at least one of the specified values
+// Use this when you want to check for multiple possible values
+const permissionsClaim = agentcore.RuntimeCustomClaim.withStringArrayValue(
+  'permissions',
+  ['read', 'write'],
+  agentcore.CustomClaimOperator.CONTAINS_ANY
+);
+
+// Use custom claims in authorizer configuration
+const runtime = new agentcore.Runtime(this, "MyAgentRuntime", {
+  runtimeName: "myAgent",
+  agentRuntimeArtifact: agentRuntimeArtifact,
+  authorizerConfiguration: agentcore.RuntimeAuthorizerConfiguration.usingJWT(
+    "https://example.com/.well-known/openid-configuration",
+    ["client1", "client2"],
+    ["audience1"],
+    ["read", "write"],
+    [departmentClaim, rolesClaim, permissionsClaim] // Custom claims
+  ),
+});
+```
+
+**Custom Claim Rules**:
+
+- **String claims**: Must use the `EQUALS` operator (automatically set). The claim value must exactly match the specified string.
+- **String array claims**: Can use `CONTAINS` (default) or `CONTAINS_ANY` operators:
+  - **`CONTAINS`**: Checks if the claim array contains a specific string value. **Requires exactly one value** in the array parameter. For example, `['admin']` will check if the token's claim array contains the string `'admin'`.
+  - **`CONTAINS_ANY`**: Checks if the claim array contains at least one of the provided string values. Use this when you want to validate against multiple possible values. For example, `['read', 'write']` will check if the token's claim array contains either `'read'` or `'write'`.
+
+**Example Use Cases**:
+
+- Use `CONTAINS` when you need to verify a user has a specific role: `RuntimeCustomClaim.withStringArrayValue('roles', ['admin'])`
+- Use `CONTAINS_ANY` when you need to verify a user has any of several permissions: `RuntimeCustomClaim.withStringArrayValue('permissions', ['read', 'write'], CustomClaimOperator.CONTAINS_ANY)`
+
 #### OAuth Authentication
 
 To configure OAuth 2.0 authentication:
@@ -516,8 +598,11 @@ const runtime = new agentcore.Runtime(this, "MyAgentRuntime", {
   runtimeName: "myAgent",
   agentRuntimeArtifact: agentRuntimeArtifact,
   authorizerConfiguration: agentcore.RuntimeAuthorizerConfiguration.usingOAuth(
-    "https://github.com/.well-known/openid-configuration",  
-    "oauth_client_123",  
+    "https://github.com/.well-known/openid-configuration",  // Discovery URL (required)
+    "oauth_client_123",  // OAuth Client ID (required)
+    ["audience1"],       // Allowed Audiences (optional)
+    ["openid", "profile"], // Allowed Scopes (optional)
+    // Custom claims (optional) - see Custom Claims Validation section
   ),
 });
 ```
@@ -1132,21 +1217,33 @@ your AgentCore gateway. By default, if not provided, the construct will create a
 **JSON Web Token (JWT)** – A secure and compact token used for authorization. After creating the JWT, you specify it as the authorization
 configuration when you create the gateway. You can create a JWT with any of the identity providers at Provider setup and configuration.
 
-You can configure a custom authorization provider using the `inboundAuthorizer` property with `GatewayAuthorizer.usingCustomJwt()`.
+You can configure a custom authorization provider using the `authorizerConfiguration` property with `GatewayAuthorizer.usingCustomJwt()`.
 You need to specify an OAuth discovery server and client IDs/audiences when you create the gateway. You can specify the following:
 
 - Discovery Url — String that must match the pattern ^.+/\.well-known/openid-configuration$ for OpenID Connect discovery URLs
 - At least one of the below options depending on the chosen identity provider.
 - Allowed audiences — List of allowed audiences for JWT tokens
 - Allowed clients — List of allowed client identifiers
+- Allowed scopes — List of allowed scopes for JWT tokens
+- Custom claims — Optional custom claim validations (see Custom Claims Validation section below)
 
 ```typescript fixture=default
+
+// Optional: Create custom claims (CustomClaimOperator and GatewayCustomClaim from agentcore)
+const customClaims = [
+  agentcore.GatewayCustomClaim.withStringValue('department', 'engineering'),
+  agentcore.GatewayCustomClaim.withStringArrayValue('roles', ['admin'], agentcore.CustomClaimOperator.CONTAINS),
+  agentcore.GatewayCustomClaim.withStringArrayValue('permissions', ['read', 'write'], agentcore.CustomClaimOperator.CONTAINS_ANY),
+];
+
 const gateway = new agentcore.Gateway(this, "MyGateway", {
   gatewayName: "my-gateway",
   authorizerConfiguration: agentcore.GatewayAuthorizer.usingCustomJwt({
     discoveryUrl: "https://auth.example.com/.well-known/openid-configuration",
     allowedAudience: ["my-app"],
     allowedClients: ["my-client-id"],
+    allowedScopes: ["read", "write"],
+    customClaims: customClaims, // Optional custom claims
   }),
 });
 ```
@@ -1188,6 +1285,31 @@ const oauthScopes = gateway.oauthScopes;
 // oauthScopes are in the format: ['{resourceServerId}/read', '{resourceServerId}/write']
 ```
 
+**Using Cognito User Pool Explicitly with Custom Claims** – You can also use an existing Cognito User Pool with custom claims:
+
+```typescript fixture=default
+declare const userPool: cognito.UserPool;
+declare const userPoolClient: cognito.UserPoolClient;
+
+// Optional: Create custom claims (CustomClaimOperator and GatewayCustomClaim from agentcore)
+const customClaims = [
+  agentcore.GatewayCustomClaim.withStringValue('department', 'engineering'),
+  agentcore.GatewayCustomClaim.withStringArrayValue('roles', ['admin'], agentcore.CustomClaimOperator.CONTAINS),
+  agentcore.GatewayCustomClaim.withStringArrayValue('permissions', ['read', 'write'], agentcore.CustomClaimOperator.CONTAINS_ANY),
+];
+
+const gateway = new agentcore.Gateway(this, "MyGateway", {
+  gatewayName: "my-gateway",
+  authorizerConfiguration: agentcore.GatewayAuthorizer.usingCognito({
+    userPool: userPool,
+    allowedClients: [userPoolClient],
+    allowedAudiences: ["audience1"],
+    allowedScopes: ["read", "write"],
+    customClaims: customClaims, // Optional custom claims
+  }),
+});
+```
+
 To authenticate with the gateway, request an access token using the client credentials flow and use it to call Gateway endpoints. For more information about the token endpoint, see [The token issuer endpoint](https://docs.aws.amazon.com/cognito/latest/developerguide/token-endpoint.html).
 
 The following is an example of a token request using curl:
@@ -1225,6 +1347,7 @@ const gateway = new agentcore.Gateway(this, "MyGateway", {
     discoveryUrl: "https://auth.example.com/.well-known/openid-configuration",
     allowedAudience: ["my-app"],
     allowedClients: ["my-client-id"],
+    allowedScopes: ["read", "write"],
   }),
   kmsKey: encryptionKey,
   exceptionLevel: agentcore.GatewayExceptionLevel.DEBUG,
@@ -1255,6 +1378,7 @@ const gateway = new agentcore.Gateway(this, "MyGateway", {
     discoveryUrl: "https://auth.example.com/.well-known/openid-configuration",
     allowedAudience: ["my-app"],
     allowedClients: ["my-client-id"],
+    allowedScopes: ["read", "write"],
   }),
   role: executionRole,
 });
@@ -1278,6 +1402,7 @@ const gateway = new agentcore.Gateway(this, "MyGateway", {
     discoveryUrl: "https://auth.example.com/.well-known/openid-configuration",
     allowedAudience: ["my-app"],
     allowedClients: ["my-client-id"],
+    allowedScopes: ["read", "write"],
   }),
 });
 

package/lib/common/types.d.ts

@@ -0,0 +1,35 @@
+/**
+ *  Copyright Amazon.com, Inc. or its affiliates. All Rights Reserved.
+ *
+ *  Licensed under the Apache License, Version 2.0 (the "License"). You may not use this file except in compliance
+ *  with the License. A copy of the License is located at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ *  or in the 'license' file accompanying this file. This file is distributed on an 'AS IS' BASIS, WITHOUT WARRANTIES
+ *  OR CONDITIONS OF ANY KIND, express or implied. See the License for the specific language governing permissions
+ *  and limitations under the License.
+ */
+/**
+ * Custom claim value type.
+ * Shared by Runtime and Gateway custom claim implementations.
+ * @internal
+ */
+export declare enum CustomClaimValueType {
+    /** String value type */
+    STRING = "STRING",
+    /** String array value type */
+    STRING_ARRAY = "STRING_ARRAY"
+}
+/**
+ * Custom claim match operator.
+ * Shared by Runtime and Gateway custom claim implementations.
+ */
+export declare enum CustomClaimOperator {
+    /** Equals operator - used for STRING type claims */
+    EQUALS = "EQUALS",
+    /** Contains operator - used for STRING_ARRAY type claims. Checks if the claim array contains a specific string value. */
+    CONTAINS = "CONTAINS",
+    /** ContainsAny operator - used for STRING_ARRAY type claims. Checks if the claim array contains any of the provided string values. */
+    CONTAINS_ANY = "CONTAINS_ANY"
+}

package/lib/common/types.js

@@ -0,0 +1,41 @@
+"use strict";
+/**
+ *  Copyright Amazon.com, Inc. or its affiliates. All Rights Reserved.
+ *
+ *  Licensed under the Apache License, Version 2.0 (the "License"). You may not use this file except in compliance
+ *  with the License. A copy of the License is located at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ *  or in the 'license' file accompanying this file. This file is distributed on an 'AS IS' BASIS, WITHOUT WARRANTIES
+ *  OR CONDITIONS OF ANY KIND, express or implied. See the License for the specific language governing permissions
+ *  and limitations under the License.
+ */
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.CustomClaimOperator = exports.CustomClaimValueType = void 0;
+/**
+ * Custom claim value type.
+ * Shared by Runtime and Gateway custom claim implementations.
+ * @internal
+ */
+var CustomClaimValueType;
+(function (CustomClaimValueType) {
+    /** String value type */
+    CustomClaimValueType["STRING"] = "STRING";
+    /** String array value type */
+    CustomClaimValueType["STRING_ARRAY"] = "STRING_ARRAY";
+})(CustomClaimValueType || (exports.CustomClaimValueType = CustomClaimValueType = {}));
+/**
+ * Custom claim match operator.
+ * Shared by Runtime and Gateway custom claim implementations.
+ */
+var CustomClaimOperator;
+(function (CustomClaimOperator) {
+    /** Equals operator - used for STRING type claims */
+    CustomClaimOperator["EQUALS"] = "EQUALS";
+    /** Contains operator - used for STRING_ARRAY type claims. Checks if the claim array contains a specific string value. */
+    CustomClaimOperator["CONTAINS"] = "CONTAINS";
+    /** ContainsAny operator - used for STRING_ARRAY type claims. Checks if the claim array contains any of the provided string values. */
+    CustomClaimOperator["CONTAINS_ANY"] = "CONTAINS_ANY";
+})(CustomClaimOperator || (exports.CustomClaimOperator = CustomClaimOperator = {}));
+//# sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJmaWxlIjoidHlwZXMuanMiLCJzb3VyY2VSb290IjoiIiwic291cmNlcyI6WyJ0eXBlcy50cyJdLCJuYW1lcyI6W10sIm1hcHBpbmdzIjoiO0FBQUE7Ozs7Ozs7Ozs7O0dBV0c7OztBQUVIOzs7O0dBSUc7QUFDSCxJQUFZLG9CQUtYO0FBTEQsV0FBWSxvQkFBb0I7SUFDOUIsd0JBQXdCO0lBQ3hCLHlDQUFpQixDQUFBO0lBQ2pCLDhCQUE4QjtJQUM5QixxREFBNkIsQ0FBQTtBQUMvQixDQUFDLEVBTFcsb0JBQW9CLG9DQUFwQixvQkFBb0IsUUFLL0I7QUFFRDs7O0dBR0c7QUFDSCxJQUFZLG1CQU9YO0FBUEQsV0FBWSxtQkFBbUI7SUFDN0Isb0RBQW9EO0lBQ3BELHdDQUFpQixDQUFBO0lBQ2pCLHlIQUF5SDtJQUN6SCw0Q0FBcUIsQ0FBQTtJQUNyQixzSUFBc0k7SUFDdEksb0RBQTZCLENBQUE7QUFDL0IsQ0FBQyxFQVBXLG1CQUFtQixtQ0FBbkIsbUJBQW1CLFFBTzlCIiwic291cmNlc0NvbnRlbnQiOlsiLyoqXG4gKiAgQ29weXJpZ2h0IEFtYXpvbi5jb20sIEluYy4gb3IgaXRzIGFmZmlsaWF0ZXMuIEFsbCBSaWdodHMgUmVzZXJ2ZWQuXG4gKlxuICogIExpY2Vuc2VkIHVuZGVyIHRoZSBBcGFjaGUgTGljZW5zZSwgVmVyc2lvbiAyLjAgKHRoZSBcIkxpY2Vuc2VcIikuIFlvdSBtYXkgbm90IHVzZSB0aGlzIGZpbGUgZXhjZXB0IGluIGNvbXBsaWFuY2VcbiAqICB3aXRoIHRoZSBMaWNlbnNlLiBBIGNvcHkgb2YgdGhlIExpY2Vuc2UgaXMgbG9jYXRlZCBhdFxuICpcbiAqICAgICAgaHR0cDovL3d3dy5hcGFjaGUub3JnL2xpY2Vuc2VzL0xJQ0VOU0UtMi4wXG4gKlxuICogIG9yIGluIHRoZSAnbGljZW5zZScgZmlsZSBhY2NvbXBhbnlpbmcgdGhpcyBmaWxlLiBUaGlzIGZpbGUgaXMgZGlzdHJpYnV0ZWQgb24gYW4gJ0FTIElTJyBCQVNJUywgV0lUSE9VVCBXQVJSQU5USUVTXG4gKiAgT1IgQ09ORElUSU9OUyBPRiBBTlkgS0lORCwgZXhwcmVzcyBvciBpbXBsaWVkLiBTZWUgdGhlIExpY2Vuc2UgZm9yIHRoZSBzcGVjaWZpYyBsYW5ndWFnZSBnb3Zlcm5pbmcgcGVybWlzc2lvbnNcbiAqICBhbmQgbGltaXRhdGlvbnMgdW5kZXIgdGhlIExpY2Vuc2UuXG4gKi9cblxuLyoqXG4gKiBDdXN0b20gY2xhaW0gdmFsdWUgdHlwZS5cbiAqIFNoYXJlZCBieSBSdW50aW1lIGFuZCBHYXRld2F5IGN1c3RvbSBjbGFpbSBpbXBsZW1lbnRhdGlvbnMuXG4gKiBAaW50ZXJuYWxcbiAqL1xuZXhwb3J0IGVudW0gQ3VzdG9tQ2xhaW1WYWx1ZVR5cGUge1xuICAvKiogU3RyaW5nIHZhbHVlIHR5cGUgKi9cbiAgU1RSSU5HID0gJ1NUUklORycsXG4gIC8qKiBTdHJpbmcgYXJyYXkgdmFsdWUgdHlwZSAqL1xuICBTVFJJTkdfQVJSQVkgPSAnU1RSSU5HX0FSUkFZJyxcbn1cblxuLyoqXG4gKiBDdXN0b20gY2xhaW0gbWF0Y2ggb3BlcmF0b3IuXG4gKiBTaGFyZWQgYnkgUnVudGltZSBhbmQgR2F0ZXdheSBjdXN0b20gY2xhaW0gaW1wbGVtZW50YXRpb25zLlxuICovXG5leHBvcnQgZW51bSBDdXN0b21DbGFpbU9wZXJhdG9yIHtcbiAgLyoqIEVxdWFscyBvcGVyYXRvciAtIHVzZWQgZm9yIFNUUklORyB0eXBlIGNsYWltcyAqL1xuICBFUVVBTFMgPSAnRVFVQUxTJyxcbiAgLyoqIENvbnRhaW5zIG9wZXJhdG9yIC0gdXNlZCBmb3IgU1RSSU5HX0FSUkFZIHR5cGUgY2xhaW1zLiBDaGVja3MgaWYgdGhlIGNsYWltIGFycmF5IGNvbnRhaW5zIGEgc3BlY2lmaWMgc3RyaW5nIHZhbHVlLiAqL1xuICBDT05UQUlOUyA9ICdDT05UQUlOUycsXG4gIC8qKiBDb250YWluc0FueSBvcGVyYXRvciAtIHVzZWQgZm9yIFNUUklOR19BUlJBWSB0eXBlIGNsYWltcy4gQ2hlY2tzIGlmIHRoZSBjbGFpbSBhcnJheSBjb250YWlucyBhbnkgb2YgdGhlIHByb3ZpZGVkIHN0cmluZyB2YWx1ZXMuICovXG4gIENPTlRBSU5TX0FOWSA9ICdDT05UQUlOU19BTlknLFxufVxuIl19

package/lib/gateway/gateway-base.js

@@ -25,7 +25,7 @@ var GatewayExceptionLevel;
  *                                Base Class
  *****************************************************************************/
 class GatewayBase extends aws_cdk_lib_1.Resource {
-    static [JSII_RTTI_SYMBOL_1] = { fqn: "@aws-cdk/aws-bedrock-agentcore-alpha.GatewayBase", version: "2.236.0-alpha.0" };
+    static [JSII_RTTI_SYMBOL_1] = { fqn: "@aws-cdk/aws-bedrock-agentcore-alpha.GatewayBase", version: "2.237.0-alpha.0" };
     constructor(scope, id, props = {}) {
         super(scope, id, props);
     }

package/lib/gateway/gateway.js

@@ -91,7 +91,7 @@ let Gateway = (() => {
             Gateway = _classThis = _classDescriptor.value;
             if (_metadata) Object.defineProperty(_classThis, Symbol.metadata, { enumerable: true, configurable: true, writable: true, value: _metadata });
         }
-        static [JSII_RTTI_SYMBOL_1] = { fqn: "@aws-cdk/aws-bedrock-agentcore-alpha.Gateway", version: "2.236.0-alpha.0" };
+        static [JSII_RTTI_SYMBOL_1] = { fqn: "@aws-cdk/aws-bedrock-agentcore-alpha.Gateway", version: "2.237.0-alpha.0" };
         /** Uniquely identifies this class. */
         static PROPERTY_INJECTION_ID = '@aws-cdk.aws-bedrock-agentcore-alpha.Gateway';
         /**

package/lib/gateway/inbound-auth/authorizer.d.ts

@@ -1,4 +1,5 @@
 import { IUserPoolClient, IUserPool } from 'aws-cdk-lib/aws-cognito';
+import { GatewayCustomClaim } from './custom-claim';
 /******************************************************************************
  *                                Authorizer Configuration
  *****************************************************************************/
@@ -50,6 +51,17 @@ export interface CustomJwtConfiguration {
      * @default - No client ID validation
      */
     readonly allowedClients?: string[];
+    /**
+     * Represents individual scopes that are validated in the incoming JWT token validation process.
+     * @default - No scope validation
+     */
+    readonly allowedScopes?: string[];
+    /**
+     * Custom claims for additional JWT token validation.
+     * Allows you to validate additional fields in JWT tokens beyond the standard audience, client, and scope validations.
+     * @default - No custom claim validation
+     */
+    readonly customClaims?: GatewayCustomClaim[];
 }
 /**
  * Custom JWT authorizer configuration implementation
@@ -59,6 +71,8 @@ export declare class CustomJwtAuthorizer implements IGatewayAuthorizerConfig {
     private readonly discoveryUrl;
     private readonly allowedAudience?;
     private readonly allowedClients?;
+    private readonly allowedScopes?;
+    private readonly customClaims?;
     constructor(config: CustomJwtConfiguration);
     /**
      * @internal
@@ -97,6 +111,17 @@ export interface CognitoAuthorizerProps {
      * @default - No audience validation
      */
     readonly allowedAudiences?: string[];
+    /**
+     * The allowed scopes for JWT validation
+     * @default - No scope validation
+     */
+    readonly allowedScopes?: string[];
+    /**
+     * Custom claims for additional JWT token validation.
+     * Allows you to validate additional fields in JWT tokens beyond the standard audience, client, and scope validations.
+     * @default - No custom claim validation
+     */
+    readonly customClaims?: GatewayCustomClaim[];
 }
 /**
  * Factory class for creating Gateway Authorizers

package/lib/gateway/inbound-auth/authorizer.js

@@ -21,11 +21,13 @@ var GatewayAuthorizerType;
  * Custom JWT authorizer configuration implementation
  */
 class CustomJwtAuthorizer {
-    static [JSII_RTTI_SYMBOL_1] = { fqn: "@aws-cdk/aws-bedrock-agentcore-alpha.CustomJwtAuthorizer", version: "2.236.0-alpha.0" };
+    static [JSII_RTTI_SYMBOL_1] = { fqn: "@aws-cdk/aws-bedrock-agentcore-alpha.CustomJwtAuthorizer", version: "2.237.0-alpha.0" };
     authorizerType = GatewayAuthorizerType.CUSTOM_JWT;
     discoveryUrl;
     allowedAudience;
     allowedClients;
+    allowedScopes;
+    customClaims;
     constructor(config) {
         try {
             jsiiDeprecationWarnings._aws_cdk_aws_bedrock_agentcore_alpha_CustomJwtConfiguration(config);
@@ -39,6 +41,8 @@ class CustomJwtAuthorizer {
         this.discoveryUrl = config.discoveryUrl;
         this.allowedAudience = config.allowedAudience;
         this.allowedClients = config.allowedClients;
+        this.allowedScopes = config.allowedScopes;
+        this.customClaims = config.customClaims;
     }
     /**
      * @internal
@@ -49,6 +53,10 @@ class CustomJwtAuthorizer {
                 discoveryUrl: this.discoveryUrl,
                 ...(this.allowedAudience && { allowedAudience: this.allowedAudience }),
                 ...(this.allowedClients && { allowedClients: this.allowedClients }),
+                ...(this.allowedScopes && { allowedScopes: this.allowedScopes }),
+                ...(this.customClaims && this.customClaims.length > 0 && {
+                    customClaims: this.customClaims.map(claim => claim._render()),
+                }),
             },
         };
     }
@@ -62,7 +70,7 @@ exports.CustomJwtAuthorizer = CustomJwtAuthorizer;
  *
  */
 class IamAuthorizer {
-    static [JSII_RTTI_SYMBOL_1] = { fqn: "@aws-cdk/aws-bedrock-agentcore-alpha.IamAuthorizer", version: "2.236.0-alpha.0" };
+    static [JSII_RTTI_SYMBOL_1] = { fqn: "@aws-cdk/aws-bedrock-agentcore-alpha.IamAuthorizer", version: "2.237.0-alpha.0" };
     authorizerType = GatewayAuthorizerType.AWS_IAM;
     /**
      * @internal
@@ -78,7 +86,7 @@ exports.IamAuthorizer = IamAuthorizer;
  * Factory class for creating Gateway Authorizers
  */
 class GatewayAuthorizer {
-    static [JSII_RTTI_SYMBOL_1] = { fqn: "@aws-cdk/aws-bedrock-agentcore-alpha.GatewayAuthorizer", version: "2.236.0-alpha.0" };
+    static [JSII_RTTI_SYMBOL_1] = { fqn: "@aws-cdk/aws-bedrock-agentcore-alpha.GatewayAuthorizer", version: "2.237.0-alpha.0" };
     /**
      * AWS IAM authorizer instance
      */
@@ -100,9 +108,9 @@ class GatewayAuthorizer {
             }
             throw error;
         }
-        // At least one of allowedAudience or allowedClients must be defined for CUSTOM_JWT authorizer
-        if (!configuration.allowedAudience && !configuration.allowedClients) {
-            throw new validation_helpers_1.ValidationError('At least one of allowedAudience or allowedClients must be defined for CUSTOM_JWT authorizer');
+        // At least one of allowedAudience, allowedClients, allowedScopes, or customClaims must be defined for CUSTOM_JWT authorizer
+        if (!configuration.allowedAudience && !configuration.allowedClients && !configuration.allowedScopes && !configuration.customClaims) {
+            throw new validation_helpers_1.ValidationError('At least one of allowedAudience, allowedClients, allowedScopes, or customClaims must be defined for CUSTOM_JWT authorizer');
         }
         return new CustomJwtAuthorizer(configuration);
     }
@@ -126,8 +134,10 @@ class GatewayAuthorizer {
             discoveryUrl: discoveryUrl,
             allowedClients: props.allowedClients?.flatMap((client) => client.userPoolClientId),
             allowedAudience: props.allowedAudiences,
+            allowedScopes: props.allowedScopes,
+            customClaims: props.customClaims,
         });
     }
 }
 exports.GatewayAuthorizer = GatewayAuthorizer;
-//# sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJmaWxlIjoiYXV0aG9yaXplci5qcyIsInNvdXJjZVJvb3QiOiIiLCJzb3VyY2VzIjpbImF1dGhvcml6ZXIudHMiXSwibmFtZXMiOltdLCJtYXBwaW5ncyI6Ijs7Ozs7QUFDQSw4REFBd0Q7QUFFeEQ7OytFQUUrRTtBQUUvRTs7R0FFRztBQUNILElBQVkscUJBS1g7QUFMRCxXQUFZLHFCQUFxQjtJQUMvQixpQ0FBaUM7SUFDakMsa0RBQXlCLENBQUE7SUFDekIsOEJBQThCO0lBQzlCLDRDQUFtQixDQUFBO0FBQ3JCLENBQUMsRUFMVyxxQkFBcUIscUNBQXJCLHFCQUFxQixRQUtoQztBQStDRDs7R0FFRztBQUNILE1BQWEsbUJBQW1COztJQUNkLGNBQWMsR0FBRyxxQkFBcUIsQ0FBQyxVQUFVLENBQUM7SUFDakQsWUFBWSxDQUFTO0lBQ3JCLGVBQWUsQ0FBWTtJQUMzQixjQUFjLENBQVk7SUFFM0MsWUFBWSxNQUE4Qjs7Ozs7OytDQU4vQixtQkFBbUI7Ozs7UUFPNUIsSUFBSSxDQUFDLFlBQVksR0FBRyxNQUFNLENBQUMsWUFBWSxDQUFDO1FBQ3hDLElBQUksQ0FBQyxlQUFlLEdBQUcsTUFBTSxDQUFDLGVBQWUsQ0FBQztRQUM5QyxJQUFJLENBQUMsY0FBYyxHQUFHLE1BQU0sQ0FBQyxjQUFjLENBQUM7S0FDN0M7SUFFRDs7T0FFRztJQUNJLE9BQU87UUFDWixPQUFPO1lBQ0wsbUJBQW1CLEVBQUU7Z0JBQ25CLFlBQVksRUFBRSxJQUFJLENBQUMsWUFBWTtnQkFDL0IsR0FBRyxDQUFDLElBQUksQ0FBQyxlQUFlLElBQUksRUFBRSxlQUFlLEVBQUUsSUFBSSxDQUFDLGVBQWUsRUFBRSxDQUFDO2dCQUN0RSxHQUFHLENBQUMsSUFBSSxDQUFDLGNBQWMsSUFBSSxFQUFFLGNBQWMsRUFBRSxJQUFJLENBQUMsY0FBYyxFQUFFLENBQUM7YUFDcEU7U0FDRixDQUFDO0tBQ0g7O0FBdkJILGtEQXdCQztBQUVEOzsrRUFFK0U7QUFFL0U7OztHQUdHO0FBQ0gsTUFBYSxhQUFhOztJQUNSLGNBQWMsR0FBRyxxQkFBcUIsQ0FBQyxPQUFPLENBQUM7SUFFL0Q7O09BRUc7SUFDSCxPQUFPO1FBQ0wsMkRBQTJEO1FBQzNELCtEQUErRDtRQUMvRCxPQUFPLFNBQVMsQ0FBQztLQUNsQjs7QUFWSCxzQ0FXQztBQXNCRDs7R0FFRztBQUNILE1BQXNCLGlCQUFpQjs7SUFDckM7O09BRUc7SUFDSSxNQUFNLENBQUMsV0FBVztRQUN2QixPQUFPLElBQUksYUFBYSxFQUFFLENBQUM7S0FDNUI7SUFFRDs7OztPQUlHO0lBQ0ksTUFBTSxDQUFDLGNBQWMsQ0FBQyxhQUFxQzs7Ozs7Ozs7OztRQUNoRSw4RkFBOEY7UUFDOUYsSUFBSSxDQUFDLGFBQWEsQ0FBQyxlQUFlLElBQUksQ0FBQyxhQUFhLENBQUMsY0FBYyxFQUFFLENBQUM7WUFDcEUsTUFBTSxJQUFJLG9DQUFlLENBQUMsNkZBQTZGLENBQUMsQ0FBQztRQUMzSCxDQUFDO1FBQ0QsT0FBTyxJQUFJLG1CQUFtQixDQUFDLGFBQWEsQ0FBQyxDQUFDO0tBQy9DO0lBRUQ7Ozs7T0FJRztJQUNJLE1BQU0sQ0FBQyxZQUFZLENBQUMsS0FBNkI7Ozs7Ozs7Ozs7UUFDdEQsTUFBTSxZQUFZLEdBQUcsdUJBQXVCLEtBQUssQ0FBQyxRQUFRLENBQUMsR0FBRyxDQUFDLE1BQU0sa0JBQWtCLEtBQUssQ0FBQyxRQUFRLENBQUMsVUFBVSxtQ0FBbUMsQ0FBQztRQUVwSixPQUFPLElBQUksbUJBQW1CLENBQUM7WUFDN0IsWUFBWSxFQUFFLFlBQVk7WUFDMUIsY0FBYyxFQUFFLEtBQUssQ0FBQyxjQUFjLEVBQUUsT0FBTyxDQUFDLENBQUMsTUFBTSxFQUFFLEVBQUUsQ0FBQyxNQUFNLENBQUMsZ0JBQWdCLENBQUM7WUFDbEYsZUFBZSxFQUFFLEtBQUssQ0FBQyxnQkFBZ0I7U0FDeEMsQ0FBQyxDQUFDO0tBQ0o7O0FBbENILDhDQW1DQyIsInNvdXJjZXNDb250ZW50IjpbImltcG9ydCB7IElVc2VyUG9vbENsaWVudCwgSVVzZXJQb29sIH0gZnJvbSAnYXdzLWNkay1saWIvYXdzLWNvZ25pdG8nO1xuaW1wb3J0IHsgVmFsaWRhdGlvbkVycm9yIH0gZnJvbSAnLi4vdmFsaWRhdGlvbi1oZWxwZXJzJztcblxuLyoqKioqKioqKioqKioqKioqKioqKioqKioqKioqKioqKioqKioqKioqKioqKioqKioqKioqKioqKioqKioqKioqKioqKioqKioqKioqKlxuICogICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIEF1dGhvcml6ZXIgQ29uZmlndXJhdGlvblxuICoqKioqKioqKioqKioqKioqKioqKioqKioqKioqKioqKioqKioqKioqKioqKioqKioqKioqKioqKioqKioqKioqKioqKioqKioqKioqL1xuXG4vKipcbiAqIEdhdGV3YXkgYXV0aG9yaXplciB0eXBlXG4gKi9cbmV4cG9ydCBlbnVtIEdhdGV3YXlBdXRob3JpemVyVHlwZSB7XG4gIC8qKiBDdXN0b20gSldUIGF1dGhvcml6ZXIgdHlwZSAqL1xuICBDVVNUT01fSldUID0gJ0NVU1RPTV9KV1QnLFxuICAvKiogQVdTIElBTSBhdXRob3JpemVyIHR5cGUgKi9cbiAgQVdTX0lBTSA9ICdBV1NfSUFNJyxcbn1cblxuLyoqXG4gKiBBYnN0cmFjdCBpbnRlcmZhY2UgZm9yIGdhdGV3YXkgYXV0aG9yaXplciBjb25maWd1cmF0aW9uXG4gKi9cbmV4cG9ydCBpbnRlcmZhY2UgSUdhdGV3YXlBdXRob3JpemVyQ29uZmlnIHtcbiAgLyoqXG4gICAqIFRoZSBhdXRob3JpemVyIHR5cGVcbiAgICovXG4gIHJlYWRvbmx5IGF1dGhvcml6ZXJUeXBlOiBHYXRld2F5QXV0aG9yaXplclR5cGU7XG5cbiAgLyoqXG4gICAqIFRoZSBhdXRob3JpemVyIGNvbmZpZ3VyYXRpb24gaW4gQ0ZOIGZvcm1hdFxuICAgKiBAaW50ZXJuYWxcbiAgICovXG4gIF9yZW5kZXIoKTogYW55O1xufVxuXG4vKioqKioqKioqKioqKioqKioqKioqKioqKioqKioqKioqKioqKioqKioqKioqKioqKioqKioqKioqKioqKioqKioqKioqKioqKioqKioqXG4gKiAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBDdXN0b20gSldUXG4gKioqKioqKioqKioqKioqKioqKioqKioqKioqKioqKioqKioqKioqKioqKioqKioqKioqKioqKioqKioqKioqKioqKioqKioqKioqKiovXG4vKipcbiAqIEN1c3RvbSBKV1QgYXV0aG9yaXplciBjb25maWd1cmF0aW9uXG4gKi9cbmV4cG9ydCBpbnRlcmZhY2UgQ3VzdG9tSnd0Q29uZmlndXJhdGlvbiB7XG4gIC8qKlxuICAgKiBUaGlzIFVSTCBpcyB1c2VkIHRvIGZldGNoIE9wZW5JRCBDb25uZWN0IGNvbmZpZ3VyYXRpb24gb3IgYXV0aG9yaXphdGlvbiBzZXJ2ZXIgbWV0YWRhdGFcbiAgICogZm9yIHZhbGlkYXRpbmcgaW5jb21pbmcgdG9rZW5zLlxuICAgKlxuICAgKiBQYXR0ZXJuOiAuKy9cXC53ZWxsLWtub3duL29wZW5pZC1jb25maWd1cmF0aW9uXG4gICAqIFJlcXVpcmVkOiBZZXNcbiAgICovXG4gIHJlYWRvbmx5IGRpc2NvdmVyeVVybDogc3RyaW5nO1xuXG4gIC8qKlxuICAgKiBSZXByZXNlbnRzIGluZGl2aWR1YWwgYXVkaWVuY2UgdmFsdWVzIHRoYXQgYXJlIHZhbGlkYXRlZCBpbiB0aGUgaW5jb21pbmcgSldUIHRva2VuIHZhbGlkYXRpb24gcHJvY2Vzcy5cbiAgICogQGRlZmF1bHQgLSBObyBhdWRpZW5jZSB2YWxpZGF0aW9uXG4gICAqL1xuICByZWFkb25seSBhbGxvd2VkQXVkaWVuY2U/OiBzdHJpbmdbXTtcblxuICAvKipcbiAgICogUmVwcmVzZW50cyBpbmRpdmlkdWFsIGNsaWVudCBJRHMgdGhhdCBhcmUgdmFsaWRhdGVkIGluIHRoZSBpbmNvbWluZyBKV1QgdG9rZW4gdmFsaWRhdGlvbiBwcm9jZXNzLlxuICAgKiBAZGVmYXVsdCAtIE5vIGNsaWVudCBJRCB2YWxpZGF0aW9uXG4gICAqL1xuICByZWFkb25seSBhbGxvd2VkQ2xpZW50cz86IHN0cmluZ1tdO1xufVxuXG4vKipcbiAqIEN1c3RvbSBKV1QgYXV0aG9yaXplciBjb25maWd1cmF0aW9uIGltcGxlbWVudGF0aW9uXG4gKi9cbmV4cG9ydCBjbGFzcyBDdXN0b21Kd3RBdXRob3JpemVyIGltcGxlbWVudHMgSUdhdGV3YXlBdXRob3JpemVyQ29uZmlnIHtcbiAgcHVibGljIHJlYWRvbmx5IGF1dGhvcml6ZXJUeXBlID0gR2F0ZXdheUF1dGhvcml6ZXJUeXBlLkNVU1RPTV9KV1Q7XG4gIHByaXZhdGUgcmVhZG9ubHkgZGlzY292ZXJ5VXJsOiBzdHJpbmc7XG4gIHByaXZhdGUgcmVhZG9ubHkgYWxsb3dlZEF1ZGllbmNlPzogc3RyaW5nW107XG4gIHByaXZhdGUgcmVhZG9ubHkgYWxsb3dlZENsaWVudHM/OiBzdHJpbmdbXTtcblxuICBjb25zdHJ1Y3Rvcihjb25maWc6IEN1c3RvbUp3dENvbmZpZ3VyYXRpb24pIHtcbiAgICB0aGlzLmRpc2NvdmVyeVVybCA9IGNvbmZpZy5kaXNjb3ZlcnlVcmw7XG4gICAgdGhpcy5hbGxvd2VkQXVkaWVuY2UgPSBjb25maWcuYWxsb3dlZEF1ZGllbmNlO1xuICAgIHRoaXMuYWxsb3dlZENsaWVudHMgPSBjb25maWcuYWxsb3dlZENsaWVudHM7XG4gIH1cblxuICAvKipcbiAgICogQGludGVybmFsXG4gICAqL1xuICBwdWJsaWMgX3JlbmRlcigpOiBhbnkge1xuICAgIHJldHVybiB7XG4gICAgICBjdXN0b21Kd3RBdXRob3JpemVyOiB7XG4gICAgICAgIGRpc2NvdmVyeVVybDogdGhpcy5kaXNjb3ZlcnlVcmwsXG4gICAgICAgIC4uLih0aGlzLmFsbG93ZWRBdWRpZW5jZSAmJiB7IGFsbG93ZWRBdWRpZW5jZTogdGhpcy5hbGxvd2VkQXVkaWVuY2UgfSksXG4gICAgICAgIC4uLih0aGlzLmFsbG93ZWRDbGllbnRzICYmIHsgYWxsb3dlZENsaWVudHM6IHRoaXMuYWxsb3dlZENsaWVudHMgfSksXG4gICAgICB9LFxuICAgIH07XG4gIH1cbn1cblxuLyoqKioqKioqKioqKioqKioqKioqKioqKioqKioqKioqKioqKioqKioqKioqKioqKioqKioqKioqKioqKioqKioqKioqKioqKioqKioqKlxuICogICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgQVdTIElBTVxuICoqKioqKioqKioqKioqKioqKioqKioqKioqKioqKioqKioqKioqKioqKioqKioqKioqKioqKioqKioqKioqKioqKioqKioqKioqKioqL1xuXG4vKipcbiAqIEFXUyBJQU0gYXV0aG9yaXplciBjb25maWd1cmF0aW9uIGltcGxlbWVudGF0aW9uXG4gKlxuICovXG5leHBvcnQgY2xhc3MgSWFtQXV0aG9yaXplciBpbXBsZW1lbnRzIElHYXRld2F5QXV0aG9yaXplckNvbmZpZyB7XG4gIHB1YmxpYyByZWFkb25seSBhdXRob3JpemVyVHlwZSA9IEdhdGV3YXlBdXRob3JpemVyVHlwZS5BV1NfSUFNO1xuXG4gIC8qKlxuICAgKiBAaW50ZXJuYWxcbiAgICovXG4gIF9yZW5kZXIoKTogYW55IHtcbiAgICAvLyBBV1MgSUFNIGF1dGhvcml6ZXIgZG9lc24ndCBuZWVkIGFkZGl0aW9uYWwgY29uZmlndXJhdGlvblxuICAgIC8vIFJldHVybiBudWxsIG9yIHVuZGVmaW5lZCB0byBpbmRpY2F0ZSBubyBjb25maWd1cmF0aW9uIG5lZWRlZFxuICAgIHJldHVybiB1bmRlZmluZWQ7XG4gIH1cbn1cblxuLyoqKioqKioqKioqKioqKioqKioqKioqKioqKioqKioqKioqKioqKioqKioqKioqKioqKioqKioqKioqKioqKioqKioqKioqKioqKioqKlxuICogICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgRmFjdG9yeVxuICoqKioqKioqKioqKioqKioqKioqKioqKioqKioqKioqKioqKioqKioqKioqKioqKioqKioqKioqKioqKioqKioqKioqKioqKioqKioqL1xuXG5leHBvcnQgaW50ZXJmYWNlIENvZ25pdG9BdXRob3JpemVyUHJvcHMge1xuICAvKipcbiAgICogVGhlIENvZ25pdG8gVXNlciBQb29sIHRvIHVzZSBmb3IgYXV0aGVudGljYXRpb25cbiAgICovXG4gIHJlYWRvbmx5IHVzZXJQb29sOiBJVXNlclBvb2w7XG4gIC8qKlxuICAgKiBUaGUgYWxsb3dlZCBVc2VyIFBvb2wgY2xpZW50c1xuICAgKiBAZGVmYXVsdCAtIEFsbCBjbGllbnRzIGFyZSBhbGxvd2VkXG4gICAqL1xuICByZWFkb25seSBhbGxvd2VkQ2xpZW50cz86IElVc2VyUG9vbENsaWVudFtdO1xuICAvKipcbiAgICogVGhlIGFsbG93ZWQgYXVkaWVuY2VzIGZvciBKV1QgdmFsaWRhdGlvblxuICAgKiBAZGVmYXVsdCAtIE5vIGF1ZGllbmNlIHZhbGlkYXRpb25cbiAgICovXG4gIHJlYWRvbmx5IGFsbG93ZWRBdWRpZW5jZXM/OiBzdHJpbmdbXTtcbn1cbi8qKlxuICogRmFjdG9yeSBjbGFzcyBmb3IgY3JlYXRpbmcgR2F0ZXdheSBBdXRob3JpemVyc1xuICovXG5leHBvcnQgYWJzdHJhY3QgY2xhc3MgR2F0ZXdheUF1dGhvcml6ZXIge1xuICAvKipcbiAgICogQVdTIElBTSBhdXRob3JpemVyIGluc3RhbmNlXG4gICAqL1xuICBwdWJsaWMgc3RhdGljIHVzaW5nQXdzSWFtKCk6IElHYXRld2F5QXV0aG9yaXplckNvbmZpZyB7XG4gICAgcmV0dXJuIG5ldyBJYW1BdXRob3JpemVyKCk7XG4gIH1cblxuICAvKipcbiAgICogQ3JlYXRlIGEgY3VzdG9tIEpXVCBhdXRob3JpemVyXG4gICAqIEBwYXJhbSBjb25maWd1cmF0aW9uIC0gVGhlIEpXVCBjb25maWd1cmF0aW9uXG4gICAqIEByZXR1cm5zIElHYXRld2F5QXV0aG9yaXplckNvbmZpZyBjb25maWd1cmVkIGZvciBjdXN0b20gSldUXG4gICAqL1xuICBwdWJsaWMgc3RhdGljIHVzaW5nQ3VzdG9tSnd0KGNvbmZpZ3VyYXRpb246IEN1c3RvbUp3dENvbmZpZ3VyYXRpb24pOiBJR2F0ZXdheUF1dGhvcml6ZXJDb25maWcge1xuICAgIC8vIEF0IGxlYXN0IG9uZSBvZiBhbGxvd2VkQXVkaWVuY2Ugb3IgYWxsb3dlZENsaWVudHMgbXVzdCBiZSBkZWZpbmVkIGZvciBDVVNUT01fSldUIGF1dGhvcml6ZXJcbiAgICBpZiAoIWNvbmZpZ3VyYXRpb24uYWxsb3dlZEF1ZGllbmNlICYmICFjb25maWd1cmF0aW9uLmFsbG93ZWRDbGllbnRzKSB7XG4gICAgICB0aHJvdyBuZXcgVmFsaWRhdGlvbkVycm9yKCdBdCBsZWFzdCBvbmUgb2YgYWxsb3dlZEF1ZGllbmNlIG9yIGFsbG93ZWRDbGllbnRzIG11c3QgYmUgZGVmaW5lZCBmb3IgQ1VTVE9NX0pXVCBhdXRob3JpemVyJyk7XG4gICAgfVxuICAgIHJldHVybiBuZXcgQ3VzdG9tSnd0QXV0aG9yaXplcihjb25maWd1cmF0aW9uKTtcbiAgfVxuXG4gIC8qKlxuICAgKiBDcmVhdGUgYSBKV1QgYXV0aG9yaXplciBmcm9tIENvZ25pdG8gVXNlciBQb29sXG4gICAqIEBwYXJhbSBwcm9wcyAtIFRoZSBDb2duaXRvIGNvbmZpZ3VyYXRpb25cbiAgICogQHJldHVybnMgQ3VzdG9tSnd0QXV0aG9yaXplciBjb25maWd1cmVkIGZvciBDb2duaXRvXG4gICAqL1xuICBwdWJsaWMgc3RhdGljIHVzaW5nQ29nbml0byhwcm9wczogQ29nbml0b0F1dGhvcml6ZXJQcm9wcyk6IElHYXRld2F5QXV0aG9yaXplckNvbmZpZyB7XG4gICAgY29uc3QgZGlzY292ZXJ5VXJsID0gYGh0dHBzOi8vY29nbml0by1pZHAuJHtwcm9wcy51c2VyUG9vbC5lbnYucmVnaW9ufS5hbWF6b25hd3MuY29tLyR7cHJvcHMudXNlclBvb2wudXNlclBvb2xJZH0vLndlbGwta25vd24vb3BlbmlkLWNvbmZpZ3VyYXRpb25gO1xuXG4gICAgcmV0dXJuIG5ldyBDdXN0b21Kd3RBdXRob3JpemVyKHtcbiAgICAgIGRpc2NvdmVyeVVybDogZGlzY292ZXJ5VXJsLFxuICAgICAgYWxsb3dlZENsaWVudHM6IHByb3BzLmFsbG93ZWRDbGllbnRzPy5mbGF0TWFwKChjbGllbnQpID0+IGNsaWVudC51c2VyUG9vbENsaWVudElkKSxcbiAgICAgIGFsbG93ZWRBdWRpZW5jZTogcHJvcHMuYWxsb3dlZEF1ZGllbmNlcyxcbiAgICB9KTtcbiAgfVxufVxuIl19
+//# sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJmaWxlIjoiYXV0aG9yaXplci5qcyIsInNvdXJjZVJvb3QiOiIiLCJzb3VyY2VzIjpbImF1dGhvcml6ZXIudHMiXSwibmFtZXMiOltdLCJtYXBwaW5ncyI6Ijs7Ozs7QUFDQSw4REFBd0Q7QUFHeEQ7OytFQUUrRTtBQUUvRTs7R0FFRztBQUNILElBQVkscUJBS1g7QUFMRCxXQUFZLHFCQUFxQjtJQUMvQixpQ0FBaUM7SUFDakMsa0RBQXlCLENBQUE7SUFDekIsOEJBQThCO0lBQzlCLDRDQUFtQixDQUFBO0FBQ3JCLENBQUMsRUFMVyxxQkFBcUIscUNBQXJCLHFCQUFxQixRQUtoQztBQTRERDs7R0FFRztBQUNILE1BQWEsbUJBQW1COztJQUNkLGNBQWMsR0FBRyxxQkFBcUIsQ0FBQyxVQUFVLENBQUM7SUFDakQsWUFBWSxDQUFTO0lBQ3JCLGVBQWUsQ0FBWTtJQUMzQixjQUFjLENBQVk7SUFDMUIsYUFBYSxDQUFZO0lBQ3pCLFlBQVksQ0FBd0I7SUFFckQsWUFBWSxNQUE4Qjs7Ozs7OytDQVIvQixtQkFBbUI7Ozs7UUFTNUIsSUFBSSxDQUFDLFlBQVksR0FBRyxNQUFNLENBQUMsWUFBWSxDQUFDO1FBQ3hDLElBQUksQ0FBQyxlQUFlLEdBQUcsTUFBTSxDQUFDLGVBQWUsQ0FBQztRQUM5QyxJQUFJLENBQUMsY0FBYyxHQUFHLE1BQU0sQ0FBQyxjQUFjLENBQUM7UUFDNUMsSUFBSSxDQUFDLGFBQWEsR0FBRyxNQUFNLENBQUMsYUFBYSxDQUFDO1FBQzFDLElBQUksQ0FBQyxZQUFZLEdBQUcsTUFBTSxDQUFDLFlBQVksQ0FBQztLQUN6QztJQUVEOztPQUVHO0lBQ0ksT0FBTztRQUNaLE9BQU87WUFDTCxtQkFBbUIsRUFBRTtnQkFDbkIsWUFBWSxFQUFFLElBQUksQ0FBQyxZQUFZO2dCQUMvQixHQUFHLENBQUMsSUFBSSxDQUFDLGVBQWUsSUFBSSxFQUFFLGVBQWUsRUFBRSxJQUFJLENBQUMsZUFBZSxFQUFFLENBQUM7Z0JBQ3RFLEdBQUcsQ0FBQyxJQUFJLENBQUMsY0FBYyxJQUFJLEVBQUUsY0FBYyxFQUFFLElBQUksQ0FBQyxjQUFjLEVBQUUsQ0FBQztnQkFDbkUsR0FBRyxDQUFDLElBQUksQ0FBQyxhQUFhLElBQUksRUFBRSxhQUFhLEVBQUUsSUFBSSxDQUFDLGFBQWEsRUFBRSxDQUFDO2dCQUNoRSxHQUFHLENBQUMsSUFBSSxDQUFDLFlBQVksSUFBSSxJQUFJLENBQUMsWUFBWSxDQUFDLE1BQU0sR0FBRyxDQUFDLElBQUk7b0JBQ3ZELFlBQVksRUFBRSxJQUFJLENBQUMsWUFBWSxDQUFDLEdBQUcsQ0FBQyxLQUFLLENBQUMsRUFBRSxDQUFDLEtBQUssQ0FBQyxPQUFPLEVBQUUsQ0FBQztpQkFDOUQsQ0FBQzthQUNIO1NBQ0YsQ0FBQztLQUNIOztBQS9CSCxrREFnQ0M7QUFFRDs7K0VBRStFO0FBRS9FOzs7R0FHRztBQUNILE1BQWEsYUFBYTs7SUFDUixjQUFjLEdBQUcscUJBQXFCLENBQUMsT0FBTyxDQUFDO0lBRS9EOztPQUVHO0lBQ0gsT0FBTztRQUNMLDJEQUEyRDtRQUMzRCwrREFBK0Q7UUFDL0QsT0FBTyxTQUFTLENBQUM7S0FDbEI7O0FBVkgsc0NBV0M7QUFpQ0Q7O0dBRUc7QUFDSCxNQUFzQixpQkFBaUI7O0lBQ3JDOztPQUVHO0lBQ0ksTUFBTSxDQUFDLFdBQVc7UUFDdkIsT0FBTyxJQUFJLGFBQWEsRUFBRSxDQUFDO0tBQzVCO0lBRUQ7Ozs7T0FJRztJQUNJLE1BQU0sQ0FBQyxjQUFjLENBQUMsYUFBcUM7Ozs7Ozs7Ozs7UUFDaEUsNEhBQTRIO1FBQzVILElBQUksQ0FBQyxhQUFhLENBQUMsZUFBZSxJQUFJLENBQUMsYUFBYSxDQUFDLGNBQWMsSUFBSSxDQUFDLGFBQWEsQ0FBQyxhQUFhLElBQUksQ0FBQyxhQUFhLENBQUMsWUFBWSxFQUFFLENBQUM7WUFDbkksTUFBTSxJQUFJLG9DQUFlLENBQUMsMkhBQTJILENBQUMsQ0FBQztRQUN6SixDQUFDO1FBQ0QsT0FBTyxJQUFJLG1CQUFtQixDQUFDLGFBQWEsQ0FBQyxDQUFDO0tBQy9DO0lBRUQ7Ozs7T0FJRztJQUNJLE1BQU0sQ0FBQyxZQUFZLENBQUMsS0FBNkI7Ozs7Ozs7Ozs7UUFDdEQsTUFBTSxZQUFZLEdBQUcsdUJBQXVCLEtBQUssQ0FBQyxRQUFRLENBQUMsR0FBRyxDQUFDLE1BQU0sa0JBQWtCLEtBQUssQ0FBQyxRQUFRLENBQUMsVUFBVSxtQ0FBbUMsQ0FBQztRQUVwSixPQUFPLElBQUksbUJBQW1CLENBQUM7WUFDN0IsWUFBWSxFQUFFLFlBQVk7WUFDMUIsY0FBYyxFQUFFLEtBQUssQ0FBQyxjQUFjLEVBQUUsT0FBTyxDQUFDLENBQUMsTUFBTSxFQUFFLEVBQUUsQ0FBQyxNQUFNLENBQUMsZ0JBQWdCLENBQUM7WUFDbEYsZUFBZSxFQUFFLEtBQUssQ0FBQyxnQkFBZ0I7WUFDdkMsYUFBYSxFQUFFLEtBQUssQ0FBQyxhQUFhO1lBQ2xDLFlBQVksRUFBRSxLQUFLLENBQUMsWUFBWTtTQUNqQyxDQUFDLENBQUM7S0FDSjs7QUFwQ0gsOENBcUNDIiwic291cmNlc0NvbnRlbnQiOlsiaW1wb3J0IHsgSVVzZXJQb29sQ2xpZW50LCBJVXNlclBvb2wgfSBmcm9tICdhd3MtY2RrLWxpYi9hd3MtY29nbml0byc7XG5pbXBvcnQgeyBWYWxpZGF0aW9uRXJyb3IgfSBmcm9tICcuLi92YWxpZGF0aW9uLWhlbHBlcnMnO1xuaW1wb3J0IHsgR2F0ZXdheUN1c3RvbUNsYWltIH0gZnJvbSAnLi9jdXN0b20tY2xhaW0nO1xuXG4vKioqKioqKioqKioqKioqKioqKioqKioqKioqKioqKioqKioqKioqKioqKioqKioqKioqKioqKioqKioqKioqKioqKioqKioqKioqKioqXG4gKiAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgQXV0aG9yaXplciBDb25maWd1cmF0aW9uXG4gKioqKioqKioqKioqKioqKioqKioqKioqKioqKioqKioqKioqKioqKioqKioqKioqKioqKioqKioqKioqKioqKioqKioqKioqKioqKiovXG5cbi8qKlxuICogR2F0ZXdheSBhdXRob3JpemVyIHR5cGVcbiAqL1xuZXhwb3J0IGVudW0gR2F0ZXdheUF1dGhvcml6ZXJUeXBlIHtcbiAgLyoqIEN1c3RvbSBKV1QgYXV0aG9yaXplciB0eXBlICovXG4gIENVU1RPTV9KV1QgPSAnQ1VTVE9NX0pXVCcsXG4gIC8qKiBBV1MgSUFNIGF1dGhvcml6ZXIgdHlwZSAqL1xuICBBV1NfSUFNID0gJ0FXU19JQU0nLFxufVxuXG4vKipcbiAqIEFic3RyYWN0IGludGVyZmFjZSBmb3IgZ2F0ZXdheSBhdXRob3JpemVyIGNvbmZpZ3VyYXRpb25cbiAqL1xuZXhwb3J0IGludGVyZmFjZSBJR2F0ZXdheUF1dGhvcml6ZXJDb25maWcge1xuICAvKipcbiAgICogVGhlIGF1dGhvcml6ZXIgdHlwZVxuICAgKi9cbiAgcmVhZG9ubHkgYXV0aG9yaXplclR5cGU6IEdhdGV3YXlBdXRob3JpemVyVHlwZTtcblxuICAvKipcbiAgICogVGhlIGF1dGhvcml6ZXIgY29uZmlndXJhdGlvbiBpbiBDRk4gZm9ybWF0XG4gICAqIEBpbnRlcm5hbFxuICAgKi9cbiAgX3JlbmRlcigpOiBhbnk7XG59XG5cbi8qKioqKioqKioqKioqKioqKioqKioqKioqKioqKioqKioqKioqKioqKioqKioqKioqKioqKioqKioqKioqKioqKioqKioqKioqKioqKipcbiAqICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIEN1c3RvbSBKV1RcbiAqKioqKioqKioqKioqKioqKioqKioqKioqKioqKioqKioqKioqKioqKioqKioqKioqKioqKioqKioqKioqKioqKioqKioqKioqKioqKi9cbi8qKlxuICogQ3VzdG9tIEpXVCBhdXRob3JpemVyIGNvbmZpZ3VyYXRpb25cbiAqL1xuZXhwb3J0IGludGVyZmFjZSBDdXN0b21Kd3RDb25maWd1cmF0aW9uIHtcbiAgLyoqXG4gICAqIFRoaXMgVVJMIGlzIHVzZWQgdG8gZmV0Y2ggT3BlbklEIENvbm5lY3QgY29uZmlndXJhdGlvbiBvciBhdXRob3JpemF0aW9uIHNlcnZlciBtZXRhZGF0YVxuICAgKiBmb3IgdmFsaWRhdGluZyBpbmNvbWluZyB0b2tlbnMuXG4gICAqXG4gICAqIFBhdHRlcm46IC4rL1xcLndlbGwta25vd24vb3BlbmlkLWNvbmZpZ3VyYXRpb25cbiAgICogUmVxdWlyZWQ6IFllc1xuICAgKi9cbiAgcmVhZG9ubHkgZGlzY292ZXJ5VXJsOiBzdHJpbmc7XG5cbiAgLyoqXG4gICAqIFJlcHJlc2VudHMgaW5kaXZpZHVhbCBhdWRpZW5jZSB2YWx1ZXMgdGhhdCBhcmUgdmFsaWRhdGVkIGluIHRoZSBpbmNvbWluZyBKV1QgdG9rZW4gdmFsaWRhdGlvbiBwcm9jZXNzLlxuICAgKiBAZGVmYXVsdCAtIE5vIGF1ZGllbmNlIHZhbGlkYXRpb25cbiAgICovXG4gIHJlYWRvbmx5IGFsbG93ZWRBdWRpZW5jZT86IHN0cmluZ1tdO1xuXG4gIC8qKlxuICAgKiBSZXByZXNlbnRzIGluZGl2aWR1YWwgY2xpZW50IElEcyB0aGF0IGFyZSB2YWxpZGF0ZWQgaW4gdGhlIGluY29taW5nIEpXVCB0b2tlbiB2YWxpZGF0aW9uIHByb2Nlc3MuXG4gICAqIEBkZWZhdWx0IC0gTm8gY2xpZW50IElEIHZhbGlkYXRpb25cbiAgICovXG4gIHJlYWRvbmx5IGFsbG93ZWRDbGllbnRzPzogc3RyaW5nW107XG5cbiAgLyoqXG4gICAqIFJlcHJlc2VudHMgaW5kaXZpZHVhbCBzY29wZXMgdGhhdCBhcmUgdmFsaWRhdGVkIGluIHRoZSBpbmNvbWluZyBKV1QgdG9rZW4gdmFsaWRhdGlvbiBwcm9jZXNzLlxuICAgKiBAZGVmYXVsdCAtIE5vIHNjb3BlIHZhbGlkYXRpb25cbiAgICovXG4gIHJlYWRvbmx5IGFsbG93ZWRTY29wZXM/OiBzdHJpbmdbXTtcblxuICAvKipcbiAgICogQ3VzdG9tIGNsYWltcyBmb3IgYWRkaXRpb25hbCBKV1QgdG9rZW4gdmFsaWRhdGlvbi5cbiAgICogQWxsb3dzIHlvdSB0byB2YWxpZGF0ZSBhZGRpdGlvbmFsIGZpZWxkcyBpbiBKV1QgdG9rZW5zIGJleW9uZCB0aGUgc3RhbmRhcmQgYXVkaWVuY2UsIGNsaWVudCwgYW5kIHNjb3BlIHZhbGlkYXRpb25zLlxuICAgKiBAZGVmYXVsdCAtIE5vIGN1c3RvbSBjbGFpbSB2YWxpZGF0aW9uXG4gICAqL1xuICByZWFkb25seSBjdXN0b21DbGFpbXM/OiBHYXRld2F5Q3VzdG9tQ2xhaW1bXTtcbn1cblxuLyoqXG4gKiBDdXN0b20gSldUIGF1dGhvcml6ZXIgY29uZmlndXJhdGlvbiBpbXBsZW1lbnRhdGlvblxuICovXG5leHBvcnQgY2xhc3MgQ3VzdG9tSnd0QXV0aG9yaXplciBpbXBsZW1lbnRzIElHYXRld2F5QXV0aG9yaXplckNvbmZpZyB7XG4gIHB1YmxpYyByZWFkb25seSBhdXRob3JpemVyVHlwZSA9IEdhdGV3YXlBdXRob3JpemVyVHlwZS5DVVNUT01fSldUO1xuICBwcml2YXRlIHJlYWRvbmx5IGRpc2NvdmVyeVVybDogc3RyaW5nO1xuICBwcml2YXRlIHJlYWRvbmx5IGFsbG93ZWRBdWRpZW5jZT86IHN0cmluZ1tdO1xuICBwcml2YXRlIHJlYWRvbmx5IGFsbG93ZWRDbGllbnRzPzogc3RyaW5nW107XG4gIHByaXZhdGUgcmVhZG9ubHkgYWxsb3dlZFNjb3Blcz86IHN0cmluZ1tdO1xuICBwcml2YXRlIHJlYWRvbmx5IGN1c3RvbUNsYWltcz86IEdhdGV3YXlDdXN0b21DbGFpbVtdO1xuXG4gIGNvbnN0cnVjdG9yKGNvbmZpZzogQ3VzdG9tSnd0Q29uZmlndXJhdGlvbikge1xuICAgIHRoaXMuZGlzY292ZXJ5VXJsID0gY29uZmlnLmRpc2NvdmVyeVVybDtcbiAgICB0aGlzLmFsbG93ZWRBdWRpZW5jZSA9IGNvbmZpZy5hbGxvd2VkQXVkaWVuY2U7XG4gICAgdGhpcy5hbGxvd2VkQ2xpZW50cyA9IGNvbmZpZy5hbGxvd2VkQ2xpZW50cztcbiAgICB0aGlzLmFsbG93ZWRTY29wZXMgPSBjb25maWcuYWxsb3dlZFNjb3BlcztcbiAgICB0aGlzLmN1c3RvbUNsYWltcyA9IGNvbmZpZy5jdXN0b21DbGFpbXM7XG4gIH1cblxuICAvKipcbiAgICogQGludGVybmFsXG4gICAqL1xuICBwdWJsaWMgX3JlbmRlcigpOiBhbnkge1xuICAgIHJldHVybiB7XG4gICAgICBjdXN0b21Kd3RBdXRob3JpemVyOiB7XG4gICAgICAgIGRpc2NvdmVyeVVybDogdGhpcy5kaXNjb3ZlcnlVcmwsXG4gICAgICAgIC4uLih0aGlzLmFsbG93ZWRBdWRpZW5jZSAmJiB7IGFsbG93ZWRBdWRpZW5jZTogdGhpcy5hbGxvd2VkQXVkaWVuY2UgfSksXG4gICAgICAgIC4uLih0aGlzLmFsbG93ZWRDbGllbnRzICYmIHsgYWxsb3dlZENsaWVudHM6IHRoaXMuYWxsb3dlZENsaWVudHMgfSksXG4gICAgICAgIC4uLih0aGlzLmFsbG93ZWRTY29wZXMgJiYgeyBhbGxvd2VkU2NvcGVzOiB0aGlzLmFsbG93ZWRTY29wZXMgfSksXG4gICAgICAgIC4uLih0aGlzLmN1c3RvbUNsYWltcyAmJiB0aGlzLmN1c3RvbUNsYWltcy5sZW5ndGggPiAwICYmIHtcbiAgICAgICAgICBjdXN0b21DbGFpbXM6IHRoaXMuY3VzdG9tQ2xhaW1zLm1hcChjbGFpbSA9PiBjbGFpbS5fcmVuZGVyKCkpLFxuICAgICAgICB9KSxcbiAgICAgIH0sXG4gICAgfTtcbiAgfVxufVxuXG4vKioqKioqKioqKioqKioqKioqKioqKioqKioqKioqKioqKioqKioqKioqKioqKioqKioqKioqKioqKioqKioqKioqKioqKioqKioqKioqXG4gKiAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBBV1MgSUFNXG4gKioqKioqKioqKioqKioqKioqKioqKioqKioqKioqKioqKioqKioqKioqKioqKioqKioqKioqKioqKioqKioqKioqKioqKioqKioqKiovXG5cbi8qKlxuICogQVdTIElBTSBhdXRob3JpemVyIGNvbmZpZ3VyYXRpb24gaW1wbGVtZW50YXRpb25cbiAqXG4gKi9cbmV4cG9ydCBjbGFzcyBJYW1BdXRob3JpemVyIGltcGxlbWVudHMgSUdhdGV3YXlBdXRob3JpemVyQ29uZmlnIHtcbiAgcHVibGljIHJlYWRvbmx5IGF1dGhvcml6ZXJUeXBlID0gR2F0ZXdheUF1dGhvcml6ZXJUeXBlLkFXU19JQU07XG5cbiAgLyoqXG4gICAqIEBpbnRlcm5hbFxuICAgKi9cbiAgX3JlbmRlcigpOiBhbnkge1xuICAgIC8vIEFXUyBJQU0gYXV0aG9yaXplciBkb2Vzbid0IG5lZWQgYWRkaXRpb25hbCBjb25maWd1cmF0aW9uXG4gICAgLy8gUmV0dXJuIG51bGwgb3IgdW5kZWZpbmVkIHRvIGluZGljYXRlIG5vIGNvbmZpZ3VyYXRpb24gbmVlZGVkXG4gICAgcmV0dXJuIHVuZGVmaW5lZDtcbiAgfVxufVxuXG4vKioqKioqKioqKioqKioqKioqKioqKioqKioqKioqKioqKioqKioqKioqKioqKioqKioqKioqKioqKioqKioqKioqKioqKioqKioqKioqXG4gKiAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBGYWN0b3J5XG4gKioqKioqKioqKioqKioqKioqKioqKioqKioqKioqKioqKioqKioqKioqKioqKioqKioqKioqKioqKioqKioqKioqKioqKioqKioqKiovXG5cbmV4cG9ydCBpbnRlcmZhY2UgQ29nbml0b0F1dGhvcml6ZXJQcm9wcyB7XG4gIC8qKlxuICAgKiBUaGUgQ29nbml0byBVc2VyIFBvb2wgdG8gdXNlIGZvciBhdXRoZW50aWNhdGlvblxuICAgKi9cbiAgcmVhZG9ubHkgdXNlclBvb2w6IElVc2VyUG9vbDtcbiAgLyoqXG4gICAqIFRoZSBhbGxvd2VkIFVzZXIgUG9vbCBjbGllbnRzXG4gICAqIEBkZWZhdWx0IC0gQWxsIGNsaWVudHMgYXJlIGFsbG93ZWRcbiAgICovXG4gIHJlYWRvbmx5IGFsbG93ZWRDbGllbnRzPzogSVVzZXJQb29sQ2xpZW50W107XG4gIC8qKlxuICAgKiBUaGUgYWxsb3dlZCBhdWRpZW5jZXMgZm9yIEpXVCB2YWxpZGF0aW9uXG4gICAqIEBkZWZhdWx0IC0gTm8gYXVkaWVuY2UgdmFsaWRhdGlvblxuICAgKi9cbiAgcmVhZG9ubHkgYWxsb3dlZEF1ZGllbmNlcz86IHN0cmluZ1tdO1xuICAvKipcbiAgICogVGhlIGFsbG93ZWQgc2NvcGVzIGZvciBKV1QgdmFsaWRhdGlvblxuICAgKiBAZGVmYXVsdCAtIE5vIHNjb3BlIHZhbGlkYXRpb25cbiAgICovXG4gIHJlYWRvbmx5IGFsbG93ZWRTY29wZXM/OiBzdHJpbmdbXTtcbiAgLyoqXG4gICAqIEN1c3RvbSBjbGFpbXMgZm9yIGFkZGl0aW9uYWwgSldUIHRva2VuIHZhbGlkYXRpb24uXG4gICAqIEFsbG93cyB5b3UgdG8gdmFsaWRhdGUgYWRkaXRpb25hbCBmaWVsZHMgaW4gSldUIHRva2VucyBiZXlvbmQgdGhlIHN0YW5kYXJkIGF1ZGllbmNlLCBjbGllbnQsIGFuZCBzY29wZSB2YWxpZGF0aW9ucy5cbiAgICogQGRlZmF1bHQgLSBObyBjdXN0b20gY2xhaW0gdmFsaWRhdGlvblxuICAgKi9cbiAgcmVhZG9ubHkgY3VzdG9tQ2xhaW1zPzogR2F0ZXdheUN1c3RvbUNsYWltW107XG59XG4vKipcbiAqIEZhY3RvcnkgY2xhc3MgZm9yIGNyZWF0aW5nIEdhdGV3YXkgQXV0aG9yaXplcnNcbiAqL1xuZXhwb3J0IGFic3RyYWN0IGNsYXNzIEdhdGV3YXlBdXRob3JpemVyIHtcbiAgLyoqXG4gICAqIEFXUyBJQU0gYXV0aG9yaXplciBpbnN0YW5jZVxuICAgKi9cbiAgcHVibGljIHN0YXRpYyB1c2luZ0F3c0lhbSgpOiBJR2F0ZXdheUF1dGhvcml6ZXJDb25maWcge1xuICAgIHJldHVybiBuZXcgSWFtQXV0aG9yaXplcigpO1xuICB9XG5cbiAgLyoqXG4gICAqIENyZWF0ZSBhIGN1c3RvbSBKV1QgYXV0aG9yaXplclxuICAgKiBAcGFyYW0gY29uZmlndXJhdGlvbiAtIFRoZSBKV1QgY29uZmlndXJhdGlvblxuICAgKiBAcmV0dXJucyBJR2F0ZXdheUF1dGhvcml6ZXJDb25maWcgY29uZmlndXJlZCBmb3IgY3VzdG9tIEpXVFxuICAgKi9cbiAgcHVibGljIHN0YXRpYyB1c2luZ0N1c3RvbUp3dChjb25maWd1cmF0aW9uOiBDdXN0b21Kd3RDb25maWd1cmF0aW9uKTogSUdhdGV3YXlBdXRob3JpemVyQ29uZmlnIHtcbiAgICAvLyBBdCBsZWFzdCBvbmUgb2YgYWxsb3dlZEF1ZGllbmNlLCBhbGxvd2VkQ2xpZW50cywgYWxsb3dlZFNjb3Blcywgb3IgY3VzdG9tQ2xhaW1zIG11c3QgYmUgZGVmaW5lZCBmb3IgQ1VTVE9NX0pXVCBhdXRob3JpemVyXG4gICAgaWYgKCFjb25maWd1cmF0aW9uLmFsbG93ZWRBdWRpZW5jZSAmJiAhY29uZmlndXJhdGlvbi5hbGxvd2VkQ2xpZW50cyAmJiAhY29uZmlndXJhdGlvbi5hbGxvd2VkU2NvcGVzICYmICFjb25maWd1cmF0aW9uLmN1c3RvbUNsYWltcykge1xuICAgICAgdGhyb3cgbmV3IFZhbGlkYXRpb25FcnJvcignQXQgbGVhc3Qgb25lIG9mIGFsbG93ZWRBdWRpZW5jZSwgYWxsb3dlZENsaWVudHMsIGFsbG93ZWRTY29wZXMsIG9yIGN1c3RvbUNsYWltcyBtdXN0IGJlIGRlZmluZWQgZm9yIENVU1RPTV9KV1QgYXV0aG9yaXplcicpO1xuICAgIH1cbiAgICByZXR1cm4gbmV3IEN1c3RvbUp3dEF1dGhvcml6ZXIoY29uZmlndXJhdGlvbik7XG4gIH1cblxuICAvKipcbiAgICogQ3JlYXRlIGEgSldUIGF1dGhvcml6ZXIgZnJvbSBDb2duaXRvIFVzZXIgUG9vbFxuICAgKiBAcGFyYW0gcHJvcHMgLSBUaGUgQ29nbml0byBjb25maWd1cmF0aW9uXG4gICAqIEByZXR1cm5zIEN1c3RvbUp3dEF1dGhvcml6ZXIgY29uZmlndXJlZCBmb3IgQ29nbml0b1xuICAgKi9cbiAgcHVibGljIHN0YXRpYyB1c2luZ0NvZ25pdG8ocHJvcHM6IENvZ25pdG9BdXRob3JpemVyUHJvcHMpOiBJR2F0ZXdheUF1dGhvcml6ZXJDb25maWcge1xuICAgIGNvbnN0IGRpc2NvdmVyeVVybCA9IGBodHRwczovL2NvZ25pdG8taWRwLiR7cHJvcHMudXNlclBvb2wuZW52LnJlZ2lvbn0uYW1hem9uYXdzLmNvbS8ke3Byb3BzLnVzZXJQb29sLnVzZXJQb29sSWR9Ly53ZWxsLWtub3duL29wZW5pZC1jb25maWd1cmF0aW9uYDtcblxuICAgIHJldHVybiBuZXcgQ3VzdG9tSnd0QXV0aG9yaXplcih7XG4gICAgICBkaXNjb3ZlcnlVcmw6IGRpc2NvdmVyeVVybCxcbiAgICAgIGFsbG93ZWRDbGllbnRzOiBwcm9wcy5hbGxvd2VkQ2xpZW50cz8uZmxhdE1hcCgoY2xpZW50KSA9PiBjbGllbnQudXNlclBvb2xDbGllbnRJZCksXG4gICAgICBhbGxvd2VkQXVkaWVuY2U6IHByb3BzLmFsbG93ZWRBdWRpZW5jZXMsXG4gICAgICBhbGxvd2VkU2NvcGVzOiBwcm9wcy5hbGxvd2VkU2NvcGVzLFxuICAgICAgY3VzdG9tQ2xhaW1zOiBwcm9wcy5jdXN0b21DbGFpbXMsXG4gICAgfSk7XG4gIH1cbn1cbiJdfQ==

package/lib/gateway/inbound-auth/custom-claim.d.ts

@@ -0,0 +1,50 @@
+/**
+ *  Copyright Amazon.com, Inc. or its affiliates. All Rights Reserved.
+ *
+ *  Licensed under the Apache License, Version 2.0 (the "License"). You may not use this file except in compliance
+ *  with the License. A copy of the License is located at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ *  or in the 'license' file accompanying this file. This file is distributed on an 'AS IS' BASIS, WITHOUT WARRANTIES
+ *  OR CONDITIONS OF ANY KIND, express or implied. See the License for the specific language governing permissions
+ *  and limitations under the License.
+ */
+import { CfnGateway } from 'aws-cdk-lib/aws-bedrockagentcore';
+import { CustomClaimOperator } from '../../common/types';
+/**
+ * Represents a custom claim validation configuration for Gateway JWT authorizers.
+ * Custom claims allow you to validate additional fields in JWT tokens beyond
+ * the standard audience, client, and scope validations.
+ */
+export declare class GatewayCustomClaim {
+    private readonly name;
+    private readonly valueType;
+    private readonly operator;
+    private readonly value;
+    /**
+     * Create a custom claim with a string value.
+     * String claims must use the EQUALS operator.
+     *
+     * @param name The name of the claim in the JWT token
+     * @param value The string value to match (must exactly equal)
+     * @returns A GatewayCustomClaim configured for string validation
+     */
+    static withStringValue(name: string, value: string): GatewayCustomClaim;
+    /**
+     * Create a custom claim with a string array value.
+     * String array claims can use CONTAINS (default) or CONTAINS_ANY operator.
+     *
+     * @param name The name of the claim in the JWT token
+     * @param values The array of string values to match. For CONTAINS operator, must contain exactly one value.
+     * @param operator The match operator (defaults to CONTAINS)
+     * @returns A GatewayCustomClaim configured for string array validation
+     */
+    static withStringArrayValue(name: string, values: string[], operator?: CustomClaimOperator): GatewayCustomClaim;
+    private constructor();
+    /**
+     * Render the custom claim as a CloudFormation property
+     * @internal
+     */
+    _render(): CfnGateway.CustomClaimValidationTypeProperty;
+}