@aws-cdk/aws-bedrock-agentcore-alpha 2.250.0-alpha.0 → 2.252.0-alpha.0

package/lib/gateway/outbound-auth/api-key.js

@@ -19,7 +19,7 @@ var ApiKeyCredentialLocationType;
  * API Key location within the request
  */
 class ApiKeyCredentialLocation {
-    static [JSII_RTTI_SYMBOL_1] = { fqn: "@aws-cdk/aws-bedrock-agentcore-alpha.ApiKeyCredentialLocation", version: "2.250.0-alpha.0" };
+    static [JSII_RTTI_SYMBOL_1] = { fqn: "@aws-cdk/aws-bedrock-agentcore-alpha.ApiKeyCredentialLocation", version: "2.252.0-alpha.0" };
     /**
      * Create a header-based API key credential location
      * @param config - Optional configuration for the credential location

package/lib/gateway/outbound-auth/credential-provider.js

@@ -31,7 +31,7 @@ var CredentialProviderType;
  * Factory class for creating different Gateway Credential Providers
  */
 class GatewayCredentialProvider {
-    static [JSII_RTTI_SYMBOL_1] = { fqn: "@aws-cdk/aws-bedrock-agentcore-alpha.GatewayCredentialProvider", version: "2.250.0-alpha.0" };
+    static [JSII_RTTI_SYMBOL_1] = { fqn: "@aws-cdk/aws-bedrock-agentcore-alpha.GatewayCredentialProvider", version: "2.252.0-alpha.0" };
     /**
      * Create an API key credential provider from Identity ARN
      * Use this method when you have the Identity ARN as a string

package/lib/gateway/protocol.js

@@ -21,7 +21,7 @@ var GatewayProtocolType;
  * Factory class for instantiating Gateway Protocols
  */
 class GatewayProtocol {
-    static [JSII_RTTI_SYMBOL_1] = { fqn: "@aws-cdk/aws-bedrock-agentcore-alpha.GatewayProtocol", version: "2.250.0-alpha.0" };
+    static [JSII_RTTI_SYMBOL_1] = { fqn: "@aws-cdk/aws-bedrock-agentcore-alpha.GatewayProtocol", version: "2.252.0-alpha.0" };
     /**
      * Create an MCP protocol configuration
      * @param props - Optional MCP configuration properties
@@ -75,7 +75,7 @@ var McpGatewaySearchType;
  * MCP (Model Context Protocol) configuration implementation
  */
 class McpProtocolConfiguration {
-    static [JSII_RTTI_SYMBOL_1] = { fqn: "@aws-cdk/aws-bedrock-agentcore-alpha.McpProtocolConfiguration", version: "2.250.0-alpha.0" };
+    static [JSII_RTTI_SYMBOL_1] = { fqn: "@aws-cdk/aws-bedrock-agentcore-alpha.McpProtocolConfiguration", version: "2.252.0-alpha.0" };
     protocolType;
     /**
      * The supported MCP protocol versions

package/lib/gateway/targets/schema/api-schema.js

@@ -15,7 +15,7 @@ const base_schema_1 = require("./base-schema");
  * Represents the concept of an API Schema for a Gateway Target.
  */
 class ApiSchema extends base_schema_1.TargetSchema {
-    static [JSII_RTTI_SYMBOL_1] = { fqn: "@aws-cdk/aws-bedrock-agentcore-alpha.ApiSchema", version: "2.250.0-alpha.0" };
+    static [JSII_RTTI_SYMBOL_1] = { fqn: "@aws-cdk/aws-bedrock-agentcore-alpha.ApiSchema", version: "2.252.0-alpha.0" };
     /**
      * Creates an API Schema from a local file.
      * @param path - the path to the local file containing the OpenAPI schema for the action group
@@ -73,7 +73,7 @@ exports.ApiSchema = ApiSchema;
 class AssetApiSchema extends ApiSchema {
     path;
     options;
-    static [JSII_RTTI_SYMBOL_1] = { fqn: "@aws-cdk/aws-bedrock-agentcore-alpha.AssetApiSchema", version: "2.250.0-alpha.0" };
+    static [JSII_RTTI_SYMBOL_1] = { fqn: "@aws-cdk/aws-bedrock-agentcore-alpha.AssetApiSchema", version: "2.252.0-alpha.0" };
     asset;
     constructor(path, options = {}) {
         super();
@@ -135,7 +135,7 @@ exports.AssetApiSchema = AssetApiSchema;
  */
 class InlineApiSchema extends ApiSchema {
     schema;
-    static [JSII_RTTI_SYMBOL_1] = { fqn: "@aws-cdk/aws-bedrock-agentcore-alpha.InlineApiSchema", version: "2.250.0-alpha.0" };
+    static [JSII_RTTI_SYMBOL_1] = { fqn: "@aws-cdk/aws-bedrock-agentcore-alpha.InlineApiSchema", version: "2.252.0-alpha.0" };
     constructor(schema) {
         super(undefined, undefined, schema);
         this.schema = schema;
@@ -165,7 +165,7 @@ exports.InlineApiSchema = InlineApiSchema;
 class S3ApiSchema extends ApiSchema {
     location;
     bucketOwnerAccountId;
-    static [JSII_RTTI_SYMBOL_1] = { fqn: "@aws-cdk/aws-bedrock-agentcore-alpha.S3ApiSchema", version: "2.250.0-alpha.0" };
+    static [JSII_RTTI_SYMBOL_1] = { fqn: "@aws-cdk/aws-bedrock-agentcore-alpha.S3ApiSchema", version: "2.252.0-alpha.0" };
     constructor(location, bucketOwnerAccountId) {
         super(location, bucketOwnerAccountId, undefined);
         this.location = location;

package/lib/gateway/targets/schema/tool-schema.js

@@ -30,7 +30,7 @@ var SchemaDefinitionType;
  *                       TOOL SCHEMA CLASS
  *****************************************************************************/
 class ToolSchema extends base_schema_1.TargetSchema {
-    static [JSII_RTTI_SYMBOL_1] = { fqn: "@aws-cdk/aws-bedrock-agentcore-alpha.ToolSchema", version: "2.250.0-alpha.0" };
+    static [JSII_RTTI_SYMBOL_1] = { fqn: "@aws-cdk/aws-bedrock-agentcore-alpha.ToolSchema", version: "2.252.0-alpha.0" };
     /**
      * Creates a tool Schema from a local file.
      * @param path - the path to the local file containing the function schema for the tool
@@ -88,7 +88,7 @@ exports.ToolSchema = ToolSchema;
 class AssetToolSchema extends ToolSchema {
     path;
     options;
-    static [JSII_RTTI_SYMBOL_1] = { fqn: "@aws-cdk/aws-bedrock-agentcore-alpha.AssetToolSchema", version: "2.250.0-alpha.0" };
+    static [JSII_RTTI_SYMBOL_1] = { fqn: "@aws-cdk/aws-bedrock-agentcore-alpha.AssetToolSchema", version: "2.252.0-alpha.0" };
     asset;
     constructor(path, options = {}) {
         super();
@@ -141,7 +141,7 @@ exports.AssetToolSchema = AssetToolSchema;
  */
 class InlineToolSchema extends ToolSchema {
     schema;
-    static [JSII_RTTI_SYMBOL_1] = { fqn: "@aws-cdk/aws-bedrock-agentcore-alpha.InlineToolSchema", version: "2.250.0-alpha.0" };
+    static [JSII_RTTI_SYMBOL_1] = { fqn: "@aws-cdk/aws-bedrock-agentcore-alpha.InlineToolSchema", version: "2.252.0-alpha.0" };
     constructor(schema) {
         super(undefined, undefined, schema);
         this.schema = schema;
@@ -171,7 +171,7 @@ exports.InlineToolSchema = InlineToolSchema;
 class S3ToolSchema extends ToolSchema {
     location;
     bucketOwnerAccountId;
-    static [JSII_RTTI_SYMBOL_1] = { fqn: "@aws-cdk/aws-bedrock-agentcore-alpha.S3ToolSchema", version: "2.250.0-alpha.0" };
+    static [JSII_RTTI_SYMBOL_1] = { fqn: "@aws-cdk/aws-bedrock-agentcore-alpha.S3ToolSchema", version: "2.252.0-alpha.0" };
     constructor(location, bucketOwnerAccountId) {
         super(location, bucketOwnerAccountId, undefined);
         this.location = location;

package/lib/gateway/targets/target-base.js

@@ -41,7 +41,7 @@ var McpTargetType;
  * permission management and property definitions.
  */
 class GatewayTargetBase extends aws_cdk_lib_1.Resource {
-    static [JSII_RTTI_SYMBOL_1] = { fqn: "@aws-cdk/aws-bedrock-agentcore-alpha.GatewayTargetBase", version: "2.250.0-alpha.0" };
+    static [JSII_RTTI_SYMBOL_1] = { fqn: "@aws-cdk/aws-bedrock-agentcore-alpha.GatewayTargetBase", version: "2.252.0-alpha.0" };
     /**
      * A reference to a GatewayTarget resource.
      */

package/lib/gateway/targets/target-configuration.js

@@ -19,7 +19,7 @@ const target_base_1 = require("./target-base");
  * Provides common functionality for all MCP target types
  */
 class McpTargetConfiguration {
-    static [JSII_RTTI_SYMBOL_1] = { fqn: "@aws-cdk/aws-bedrock-agentcore-alpha.McpTargetConfiguration", version: "2.250.0-alpha.0" };
+    static [JSII_RTTI_SYMBOL_1] = { fqn: "@aws-cdk/aws-bedrock-agentcore-alpha.McpTargetConfiguration", version: "2.252.0-alpha.0" };
     /**
      * Renders the configuration as CloudFormation properties
      * @internal
@@ -41,7 +41,7 @@ exports.McpTargetConfiguration = McpTargetConfiguration;
  * allowing the gateway to invoke the function to provide tool capabilities.
  */
 class LambdaTargetConfiguration extends McpTargetConfiguration {
-    static [JSII_RTTI_SYMBOL_1] = { fqn: "@aws-cdk/aws-bedrock-agentcore-alpha.LambdaTargetConfiguration", version: "2.250.0-alpha.0" };
+    static [JSII_RTTI_SYMBOL_1] = { fqn: "@aws-cdk/aws-bedrock-agentcore-alpha.LambdaTargetConfiguration", version: "2.252.0-alpha.0" };
     /**
      * Create a Lambda target configuration
      *
@@ -131,7 +131,7 @@ exports.LambdaTargetConfiguration = LambdaTargetConfiguration;
  * allowing the gateway to transform API operations into tool calls.
  */
 class OpenApiTargetConfiguration extends McpTargetConfiguration {
-    static [JSII_RTTI_SYMBOL_1] = { fqn: "@aws-cdk/aws-bedrock-agentcore-alpha.OpenApiTargetConfiguration", version: "2.250.0-alpha.0" };
+    static [JSII_RTTI_SYMBOL_1] = { fqn: "@aws-cdk/aws-bedrock-agentcore-alpha.OpenApiTargetConfiguration", version: "2.252.0-alpha.0" };
     /**
      * Create an OpenAPI target configuration
      *
@@ -249,7 +249,7 @@ exports.OpenApiTargetConfiguration = OpenApiTargetConfiguration;
  * allowing the gateway to transform Smithy operations into tool calls.
  */
 class SmithyTargetConfiguration extends McpTargetConfiguration {
-    static [JSII_RTTI_SYMBOL_1] = { fqn: "@aws-cdk/aws-bedrock-agentcore-alpha.SmithyTargetConfiguration", version: "2.250.0-alpha.0" };
+    static [JSII_RTTI_SYMBOL_1] = { fqn: "@aws-cdk/aws-bedrock-agentcore-alpha.SmithyTargetConfiguration", version: "2.252.0-alpha.0" };
     /**
      * Create a Smithy target configuration
      *
@@ -331,7 +331,7 @@ exports.SmithyTargetConfiguration = SmithyTargetConfiguration;
  * synchronization.
  */
 class McpServerTargetConfiguration extends McpTargetConfiguration {
-    static [JSII_RTTI_SYMBOL_1] = { fqn: "@aws-cdk/aws-bedrock-agentcore-alpha.McpServerTargetConfiguration", version: "2.250.0-alpha.0" };
+    static [JSII_RTTI_SYMBOL_1] = { fqn: "@aws-cdk/aws-bedrock-agentcore-alpha.McpServerTargetConfiguration", version: "2.252.0-alpha.0" };
     /**
      * Create an MCP server target configuration
      *
@@ -445,7 +445,7 @@ var ApiGatewayHttpMethod;
  * - Proxy resources (e.g., `/pets/{proxy+}`) are not supported
  */
 class ApiGatewayTargetConfiguration extends McpTargetConfiguration {
-    static [JSII_RTTI_SYMBOL_1] = { fqn: "@aws-cdk/aws-bedrock-agentcore-alpha.ApiGatewayTargetConfiguration", version: "2.250.0-alpha.0" };
+    static [JSII_RTTI_SYMBOL_1] = { fqn: "@aws-cdk/aws-bedrock-agentcore-alpha.ApiGatewayTargetConfiguration", version: "2.252.0-alpha.0" };
     /**
      * Create an API Gateway target configuration
      *

package/lib/gateway/targets/target.js

@@ -80,7 +80,7 @@ let GatewayTarget = (() => {
             GatewayTarget = _classThis = _classDescriptor.value;
             if (_metadata) Object.defineProperty(_classThis, Symbol.metadata, { enumerable: true, configurable: true, writable: true, value: _metadata });
         }
-        static [JSII_RTTI_SYMBOL_1] = { fqn: "@aws-cdk/aws-bedrock-agentcore-alpha.GatewayTarget", version: "2.250.0-alpha.0" };
+        static [JSII_RTTI_SYMBOL_1] = { fqn: "@aws-cdk/aws-bedrock-agentcore-alpha.GatewayTarget", version: "2.252.0-alpha.0" };
         /** Uniquely identifies this class. */
         static PROPERTY_INJECTION_ID = '@aws-cdk.aws-bedrock-agentcore-alpha.GatewayTarget';
         /**

package/lib/index.d.ts

@@ -13,6 +13,7 @@ export * from './runtime/inbound-auth/runtime-authorizer-configuration';
 export * from './runtime/runtime-endpoint-base';
 export * from './runtime/runtime-endpoint';
 export * from './runtime/runtime';
+export * from './runtime/observability';
 export * from './tools/code-interpreter';
 export * from './tools/browser';
 export * from './gateway/gateway-base';
@@ -32,3 +33,10 @@ export * from './gateway/targets/target-configuration';
 export * from './gateway/targets/schema/base-schema';
 export * from './gateway/targets/schema/api-schema';
 export * from './gateway/targets/schema/tool-schema';
+export * from './policy/perms';
+export * from './policy/policy-types';
+export * from './policy/policy-engine-base';
+export * from './policy/policy-engine';
+export * from './policy/policy-base';
+export * from './policy/policy';
+export * from './policy/policy-statement';

package/lib/index.js

@@ -38,6 +38,7 @@ __exportStar(require("./runtime/inbound-auth/runtime-authorizer-configuration"),
 __exportStar(require("./runtime/runtime-endpoint-base"), exports);
 __exportStar(require("./runtime/runtime-endpoint"), exports);
 __exportStar(require("./runtime/runtime"), exports);
+__exportStar(require("./runtime/observability"), exports);
 // Tools
 // ===================================
 __exportStar(require("./tools/code-interpreter"), exports);
@@ -75,4 +76,15 @@ __exportStar(require("./gateway/targets/target-configuration"), exports);
 __exportStar(require("./gateway/targets/schema/base-schema"), exports);
 __exportStar(require("./gateway/targets/schema/api-schema"), exports);
 __exportStar(require("./gateway/targets/schema/tool-schema"), exports);
-//# sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJmaWxlIjoiaW5kZXguanMiLCJzb3VyY2VSb290IjoiIiwic291cmNlcyI6WyJpbmRleC50cyJdLCJuYW1lcyI6W10sIm1hcHBpbmdzIjoiOzs7Ozs7Ozs7Ozs7Ozs7O0FBQUEsa0RBQWdDO0FBQ2hDLHVFQUFxRDtBQUNyRCw0RUFBMEQ7QUFDMUQsMkRBQXlDO0FBQ3pDLHNDQUFzQztBQUN0Qyx3QkFBd0I7QUFDeEIsc0NBQXNDO0FBQ3RDLGtFQUFnRDtBQUVoRCxzQ0FBc0M7QUFDdEMsd0JBQXdCO0FBQ3hCLHNDQUFzQztBQUN0QyxpREFBK0I7QUFFL0Isc0NBQXNDO0FBQ3RDLFVBQVU7QUFDVixzQ0FBc0M7QUFDdEMsa0RBQWdDO0FBQ2hDLGtEQUFnQztBQUNoQyx5REFBdUM7QUFDdkMsNkRBQTJDO0FBQzNDLHNFQUFvRDtBQUNwRCwwRkFBd0U7QUFDeEUsa0VBQWdEO0FBQ2hELDZEQUEyQztBQUMzQyxvREFBa0M7QUFDbEMsUUFBUTtBQUNSLHNDQUFzQztBQUN0QywyREFBeUM7QUFDekMsa0RBQWdDO0FBRWhDLHNDQUFzQztBQUN0QyxVQUFVO0FBQ1Ysc0NBQXNDO0FBQ3RDLHlEQUF1QztBQUN2QyxvREFBa0M7QUFDbEMsd0RBQXNDO0FBQ3RDLGtEQUFnQztBQUNoQyxxREFBbUM7QUFDbkMsNEVBQTRFO0FBRTVFLHNDQUFzQztBQUN0Qyx5QkFBeUI7QUFDekIsc0NBQXNDO0FBQ3RDLG9FQUFrRDtBQUNsRCxzRUFBb0Q7QUFFcEQsc0NBQXNDO0FBQ3RDLDBCQUEwQjtBQUMxQixzQ0FBc0M7QUFDdEMsOEVBQTREO0FBQzVELGtFQUFnRDtBQUNoRCxtRUFBaUQ7QUFDakQsZ0VBQThDO0FBRTlDLHNDQUFzQztBQUN0QyxvQkFBb0I7QUFDcEIsc0NBQXNDO0FBQ3RDLGdFQUE4QztBQUM5QywyREFBeUM7QUFDekMseUVBQXVEO0FBRXZELHNDQUFzQztBQUN0QyxvQkFBb0I7QUFDcEIsc0NBQXNDO0FBQ3RDLHVFQUFxRDtBQUNyRCxzRUFBb0Q7QUFDcEQsdUVBQXFEIiwic291cmNlc0NvbnRlbnQiOlsiZXhwb3J0ICogZnJvbSAnLi9tZW1vcnkvbWVtb3J5JztcbmV4cG9ydCAqIGZyb20gJy4vbWVtb3J5L3N0cmF0ZWdpZXMvbWFuYWdlZC1zdHJhdGVneSc7XG5leHBvcnQgKiBmcm9tICcuL21lbW9yeS9zdHJhdGVnaWVzL3NlbGYtbWFuYWdlZC1zdHJhdGVneSc7XG5leHBvcnQgKiBmcm9tICcuL21lbW9yeS9tZW1vcnktc3RyYXRlZ3knO1xuLy8gPT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT1cbi8vIE5ldHdvcmsgQ29uZmlndXJhdGlvblxuLy8gPT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT1cbmV4cG9ydCAqIGZyb20gJy4vbmV0d29yay9uZXR3b3JrLWNvbmZpZ3VyYXRpb24nO1xuXG4vLyA9PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PVxuLy8gQ29tbW9uIChzaGFyZWQgdHlwZXMpXG4vLyA9PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PVxuZXhwb3J0ICogZnJvbSAnLi9jb21tb24vdHlwZXMnO1xuXG4vLyA9PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PVxuLy8gUnVudGltZVxuLy8gPT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT1cbmV4cG9ydCAqIGZyb20gJy4vcnVudGltZS9wZXJtcyc7XG5leHBvcnQgKiBmcm9tICcuL3J1bnRpbWUvdHlwZXMnO1xuZXhwb3J0ICogZnJvbSAnLi9ydW50aW1lL3J1bnRpbWUtYmFzZSc7XG5leHBvcnQgKiBmcm9tICcuL3J1bnRpbWUvcnVudGltZS1hcnRpZmFjdCc7XG5leHBvcnQgKiBmcm9tICcuL3J1bnRpbWUvaW5ib3VuZC1hdXRoL2N1c3RvbS1jbGFpbSc7XG5leHBvcnQgKiBmcm9tICcuL3J1bnRpbWUvaW5ib3VuZC1hdXRoL3J1bnRpbWUtYXV0aG9yaXplci1jb25maWd1cmF0aW9uJztcbmV4cG9ydCAqIGZyb20gJy4vcnVudGltZS9ydW50aW1lLWVuZHBvaW50LWJhc2UnO1xuZXhwb3J0ICogZnJvbSAnLi9ydW50aW1lL3J1bnRpbWUtZW5kcG9pbnQnO1xuZXhwb3J0ICogZnJvbSAnLi9ydW50aW1lL3J1bnRpbWUnO1xuLy8gVG9vbHNcbi8vID09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09XG5leHBvcnQgKiBmcm9tICcuL3Rvb2xzL2NvZGUtaW50ZXJwcmV0ZXInO1xuZXhwb3J0ICogZnJvbSAnLi90b29scy9icm93c2VyJztcblxuLy8gPT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT1cbi8vIEdhdGV3YXlcbi8vID09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09XG5leHBvcnQgKiBmcm9tICcuL2dhdGV3YXkvZ2F0ZXdheS1iYXNlJztcbmV4cG9ydCAqIGZyb20gJy4vZ2F0ZXdheS9nYXRld2F5JztcbmV4cG9ydCAqIGZyb20gJy4vZ2F0ZXdheS9pbnRlcmNlcHRvcic7XG5leHBvcnQgKiBmcm9tICcuL2dhdGV3YXkvcGVybXMnO1xuZXhwb3J0ICogZnJvbSAnLi9nYXRld2F5L3Byb3RvY29sJztcbi8vIHZhbGlkYXRpb24taGVscGVycyBjb250YWlucyBpbnRlcm5hbCB1dGlsaXRpZXMgYW5kIHNob3VsZCBub3QgYmUgZXhwb3J0ZWRcblxuLy8gPT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT1cbi8vIEdhdGV3YXkgLSBJbmJvdW5kIEF1dGhcbi8vID09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09XG5leHBvcnQgKiBmcm9tICcuL2dhdGV3YXkvaW5ib3VuZC1hdXRoL2F1dGhvcml6ZXInO1xuZXhwb3J0ICogZnJvbSAnLi9nYXRld2F5L2luYm91bmQtYXV0aC9jdXN0b20tY2xhaW0nO1xuXG4vLyA9PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PVxuLy8gR2F0ZXdheSAtIE91dGJvdW5kIEF1dGhcbi8vID09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09XG5leHBvcnQgKiBmcm9tICcuL2dhdGV3YXkvb3V0Ym91bmQtYXV0aC9jcmVkZW50aWFsLXByb3ZpZGVyJztcbmV4cG9ydCAqIGZyb20gJy4vZ2F0ZXdheS9vdXRib3VuZC1hdXRoL2FwaS1rZXknO1xuZXhwb3J0ICogZnJvbSAnLi9nYXRld2F5L291dGJvdW5kLWF1dGgvaWFtLXJvbGUnO1xuZXhwb3J0ICogZnJvbSAnLi9nYXRld2F5L291dGJvdW5kLWF1dGgvb2F1dGgnO1xuXG4vLyA9PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PVxuLy8gR2F0ZXdheSAtIFRhcmdldHNcbi8vID09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09XG5leHBvcnQgKiBmcm9tICcuL2dhdGV3YXkvdGFyZ2V0cy90YXJnZXQtYmFzZSc7XG5leHBvcnQgKiBmcm9tICcuL2dhdGV3YXkvdGFyZ2V0cy90YXJnZXQnO1xuZXhwb3J0ICogZnJvbSAnLi9nYXRld2F5L3RhcmdldHMvdGFyZ2V0LWNvbmZpZ3VyYXRpb24nO1xuXG4vLyA9PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PVxuLy8gR2F0ZXdheSAtIFNjaGVtYXNcbi8vID09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09XG5leHBvcnQgKiBmcm9tICcuL2dhdGV3YXkvdGFyZ2V0cy9zY2hlbWEvYmFzZS1zY2hlbWEnO1xuZXhwb3J0ICogZnJvbSAnLi9nYXRld2F5L3RhcmdldHMvc2NoZW1hL2FwaS1zY2hlbWEnO1xuZXhwb3J0ICogZnJvbSAnLi9nYXRld2F5L3RhcmdldHMvc2NoZW1hL3Rvb2wtc2NoZW1hJztcbiJdfQ==
+// ===================================
+// Policy
+// ===================================
+__exportStar(require("./policy/perms"), exports);
+__exportStar(require("./policy/policy-types"), exports);
+__exportStar(require("./policy/policy-engine-base"), exports);
+__exportStar(require("./policy/policy-engine"), exports);
+__exportStar(require("./policy/policy-base"), exports);
+__exportStar(require("./policy/policy"), exports);
+__exportStar(require("./policy/policy-statement"), exports);
+// validation-helpers contains internal utilities and should not be exported
+//# sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJmaWxlIjoiaW5kZXguanMiLCJzb3VyY2VSb290IjoiIiwic291cmNlcyI6WyJpbmRleC50cyJdLCJuYW1lcyI6W10sIm1hcHBpbmdzIjoiOzs7Ozs7Ozs7Ozs7Ozs7O0FBQUEsa0RBQWdDO0FBQ2hDLHVFQUFxRDtBQUNyRCw0RUFBMEQ7QUFDMUQsMkRBQXlDO0FBQ3pDLHNDQUFzQztBQUN0Qyx3QkFBd0I7QUFDeEIsc0NBQXNDO0FBQ3RDLGtFQUFnRDtBQUVoRCxzQ0FBc0M7QUFDdEMsd0JBQXdCO0FBQ3hCLHNDQUFzQztBQUN0QyxpREFBK0I7QUFFL0Isc0NBQXNDO0FBQ3RDLFVBQVU7QUFDVixzQ0FBc0M7QUFDdEMsa0RBQWdDO0FBQ2hDLGtEQUFnQztBQUNoQyx5REFBdUM7QUFDdkMsNkRBQTJDO0FBQzNDLHNFQUFvRDtBQUNwRCwwRkFBd0U7QUFDeEUsa0VBQWdEO0FBQ2hELDZEQUEyQztBQUMzQyxvREFBa0M7QUFDbEMsMERBQXdDO0FBQ3hDLFFBQVE7QUFDUixzQ0FBc0M7QUFDdEMsMkRBQXlDO0FBQ3pDLGtEQUFnQztBQUVoQyxzQ0FBc0M7QUFDdEMsVUFBVTtBQUNWLHNDQUFzQztBQUN0Qyx5REFBdUM7QUFDdkMsb0RBQWtDO0FBQ2xDLHdEQUFzQztBQUN0QyxrREFBZ0M7QUFDaEMscURBQW1DO0FBQ25DLDRFQUE0RTtBQUU1RSxzQ0FBc0M7QUFDdEMseUJBQXlCO0FBQ3pCLHNDQUFzQztBQUN0QyxvRUFBa0Q7QUFDbEQsc0VBQW9EO0FBRXBELHNDQUFzQztBQUN0QywwQkFBMEI7QUFDMUIsc0NBQXNDO0FBQ3RDLDhFQUE0RDtBQUM1RCxrRUFBZ0Q7QUFDaEQsbUVBQWlEO0FBQ2pELGdFQUE4QztBQUU5QyxzQ0FBc0M7QUFDdEMsb0JBQW9CO0FBQ3BCLHNDQUFzQztBQUN0QyxnRUFBOEM7QUFDOUMsMkRBQXlDO0FBQ3pDLHlFQUF1RDtBQUV2RCxzQ0FBc0M7QUFDdEMsb0JBQW9CO0FBQ3BCLHNDQUFzQztBQUN0Qyx1RUFBcUQ7QUFDckQsc0VBQW9EO0FBQ3BELHVFQUFxRDtBQUVyRCxzQ0FBc0M7QUFDdEMsU0FBUztBQUNULHNDQUFzQztBQUN0QyxpREFBK0I7QUFDL0Isd0RBQXNDO0FBQ3RDLDhEQUE0QztBQUM1Qyx5REFBdUM7QUFDdkMsdURBQXFDO0FBQ3JDLGtEQUFnQztBQUNoQyw0REFBMEM7QUFDMUMsNEVBQTRFIiwic291cmNlc0NvbnRlbnQiOlsiZXhwb3J0ICogZnJvbSAnLi9tZW1vcnkvbWVtb3J5JztcbmV4cG9ydCAqIGZyb20gJy4vbWVtb3J5L3N0cmF0ZWdpZXMvbWFuYWdlZC1zdHJhdGVneSc7XG5leHBvcnQgKiBmcm9tICcuL21lbW9yeS9zdHJhdGVnaWVzL3NlbGYtbWFuYWdlZC1zdHJhdGVneSc7XG5leHBvcnQgKiBmcm9tICcuL21lbW9yeS9tZW1vcnktc3RyYXRlZ3knO1xuLy8gPT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT1cbi8vIE5ldHdvcmsgQ29uZmlndXJhdGlvblxuLy8gPT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT1cbmV4cG9ydCAqIGZyb20gJy4vbmV0d29yay9uZXR3b3JrLWNvbmZpZ3VyYXRpb24nO1xuXG4vLyA9PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PVxuLy8gQ29tbW9uIChzaGFyZWQgdHlwZXMpXG4vLyA9PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PVxuZXhwb3J0ICogZnJvbSAnLi9jb21tb24vdHlwZXMnO1xuXG4vLyA9PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PVxuLy8gUnVudGltZVxuLy8gPT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT1cbmV4cG9ydCAqIGZyb20gJy4vcnVudGltZS9wZXJtcyc7XG5leHBvcnQgKiBmcm9tICcuL3J1bnRpbWUvdHlwZXMnO1xuZXhwb3J0ICogZnJvbSAnLi9ydW50aW1lL3J1bnRpbWUtYmFzZSc7XG5leHBvcnQgKiBmcm9tICcuL3J1bnRpbWUvcnVudGltZS1hcnRpZmFjdCc7XG5leHBvcnQgKiBmcm9tICcuL3J1bnRpbWUvaW5ib3VuZC1hdXRoL2N1c3RvbS1jbGFpbSc7XG5leHBvcnQgKiBmcm9tICcuL3J1bnRpbWUvaW5ib3VuZC1hdXRoL3J1bnRpbWUtYXV0aG9yaXplci1jb25maWd1cmF0aW9uJztcbmV4cG9ydCAqIGZyb20gJy4vcnVudGltZS9ydW50aW1lLWVuZHBvaW50LWJhc2UnO1xuZXhwb3J0ICogZnJvbSAnLi9ydW50aW1lL3J1bnRpbWUtZW5kcG9pbnQnO1xuZXhwb3J0ICogZnJvbSAnLi9ydW50aW1lL3J1bnRpbWUnO1xuZXhwb3J0ICogZnJvbSAnLi9ydW50aW1lL29ic2VydmFiaWxpdHknO1xuLy8gVG9vbHNcbi8vID09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09XG5leHBvcnQgKiBmcm9tICcuL3Rvb2xzL2NvZGUtaW50ZXJwcmV0ZXInO1xuZXhwb3J0ICogZnJvbSAnLi90b29scy9icm93c2VyJztcblxuLy8gPT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT1cbi8vIEdhdGV3YXlcbi8vID09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09XG5leHBvcnQgKiBmcm9tICcuL2dhdGV3YXkvZ2F0ZXdheS1iYXNlJztcbmV4cG9ydCAqIGZyb20gJy4vZ2F0ZXdheS9nYXRld2F5JztcbmV4cG9ydCAqIGZyb20gJy4vZ2F0ZXdheS9pbnRlcmNlcHRvcic7XG5leHBvcnQgKiBmcm9tICcuL2dhdGV3YXkvcGVybXMnO1xuZXhwb3J0ICogZnJvbSAnLi9nYXRld2F5L3Byb3RvY29sJztcbi8vIHZhbGlkYXRpb24taGVscGVycyBjb250YWlucyBpbnRlcm5hbCB1dGlsaXRpZXMgYW5kIHNob3VsZCBub3QgYmUgZXhwb3J0ZWRcblxuLy8gPT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT1cbi8vIEdhdGV3YXkgLSBJbmJvdW5kIEF1dGhcbi8vID09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09XG5leHBvcnQgKiBmcm9tICcuL2dhdGV3YXkvaW5ib3VuZC1hdXRoL2F1dGhvcml6ZXInO1xuZXhwb3J0ICogZnJvbSAnLi9nYXRld2F5L2luYm91bmQtYXV0aC9jdXN0b20tY2xhaW0nO1xuXG4vLyA9PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PVxuLy8gR2F0ZXdheSAtIE91dGJvdW5kIEF1dGhcbi8vID09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09XG5leHBvcnQgKiBmcm9tICcuL2dhdGV3YXkvb3V0Ym91bmQtYXV0aC9jcmVkZW50aWFsLXByb3ZpZGVyJztcbmV4cG9ydCAqIGZyb20gJy4vZ2F0ZXdheS9vdXRib3VuZC1hdXRoL2FwaS1rZXknO1xuZXhwb3J0ICogZnJvbSAnLi9nYXRld2F5L291dGJvdW5kLWF1dGgvaWFtLXJvbGUnO1xuZXhwb3J0ICogZnJvbSAnLi9nYXRld2F5L291dGJvdW5kLWF1dGgvb2F1dGgnO1xuXG4vLyA9PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PVxuLy8gR2F0ZXdheSAtIFRhcmdldHNcbi8vID09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09XG5leHBvcnQgKiBmcm9tICcuL2dhdGV3YXkvdGFyZ2V0cy90YXJnZXQtYmFzZSc7XG5leHBvcnQgKiBmcm9tICcuL2dhdGV3YXkvdGFyZ2V0cy90YXJnZXQnO1xuZXhwb3J0ICogZnJvbSAnLi9nYXRld2F5L3RhcmdldHMvdGFyZ2V0LWNvbmZpZ3VyYXRpb24nO1xuXG4vLyA9PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PVxuLy8gR2F0ZXdheSAtIFNjaGVtYXNcbi8vID09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09XG5leHBvcnQgKiBmcm9tICcuL2dhdGV3YXkvdGFyZ2V0cy9zY2hlbWEvYmFzZS1zY2hlbWEnO1xuZXhwb3J0ICogZnJvbSAnLi9nYXRld2F5L3RhcmdldHMvc2NoZW1hL2FwaS1zY2hlbWEnO1xuZXhwb3J0ICogZnJvbSAnLi9nYXRld2F5L3RhcmdldHMvc2NoZW1hL3Rvb2wtc2NoZW1hJztcblxuLy8gPT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT1cbi8vIFBvbGljeVxuLy8gPT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT1cbmV4cG9ydCAqIGZyb20gJy4vcG9saWN5L3Blcm1zJztcbmV4cG9ydCAqIGZyb20gJy4vcG9saWN5L3BvbGljeS10eXBlcyc7XG5leHBvcnQgKiBmcm9tICcuL3BvbGljeS9wb2xpY3ktZW5naW5lLWJhc2UnO1xuZXhwb3J0ICogZnJvbSAnLi9wb2xpY3kvcG9saWN5LWVuZ2luZSc7XG5leHBvcnQgKiBmcm9tICcuL3BvbGljeS9wb2xpY3ktYmFzZSc7XG5leHBvcnQgKiBmcm9tICcuL3BvbGljeS9wb2xpY3knO1xuZXhwb3J0ICogZnJvbSAnLi9wb2xpY3kvcG9saWN5LXN0YXRlbWVudCc7XG4vLyB2YWxpZGF0aW9uLWhlbHBlcnMgY29udGFpbnMgaW50ZXJuYWwgdXRpbGl0aWVzIGFuZCBzaG91bGQgbm90IGJlIGV4cG9ydGVkXG4iXX0=

package/lib/memory/memory-strategy.js

@@ -56,7 +56,7 @@ var MemoryStrategyType;
  * @see https://docs.aws.amazon.com/bedrock-agentcore/latest/devguide/memory-strategies.html
  */
 class MemoryStrategy {
-    static [JSII_RTTI_SYMBOL_1] = { fqn: "@aws-cdk/aws-bedrock-agentcore-alpha.MemoryStrategy", version: "2.250.0-alpha.0" };
+    static [JSII_RTTI_SYMBOL_1] = { fqn: "@aws-cdk/aws-bedrock-agentcore-alpha.MemoryStrategy", version: "2.252.0-alpha.0" };
     /**
      * Default strategies for organizing and extracting memory data, each optimized for specific use cases.
      * This strategy compresses conversations into concise overviews, preserving essential context and key insights for quick recall.

package/lib/memory/memory.js

@@ -87,7 +87,7 @@ const MEMORY_EXPIRATION_DAYS_MAX = 365;
  * Contains methods and attributes valid for Memories either created with CDK or imported.
  */
 class MemoryBase extends aws_cdk_lib_1.Resource {
-    static [JSII_RTTI_SYMBOL_1] = { fqn: "@aws-cdk/aws-bedrock-agentcore-alpha.MemoryBase", version: "2.250.0-alpha.0" };
+    static [JSII_RTTI_SYMBOL_1] = { fqn: "@aws-cdk/aws-bedrock-agentcore-alpha.MemoryBase", version: "2.252.0-alpha.0" };
     /**
      * A reference to a Memory resource.
      */
@@ -369,7 +369,7 @@ let Memory = (() => {
             Memory = _classThis = _classDescriptor.value;
             if (_metadata) Object.defineProperty(_classThis, Symbol.metadata, { enumerable: true, configurable: true, writable: true, value: _metadata });
         }
-        static [JSII_RTTI_SYMBOL_1] = { fqn: "@aws-cdk/aws-bedrock-agentcore-alpha.Memory", version: "2.250.0-alpha.0" };
+        static [JSII_RTTI_SYMBOL_1] = { fqn: "@aws-cdk/aws-bedrock-agentcore-alpha.Memory", version: "2.252.0-alpha.0" };
         /** Uniquely identifies this class. */
         static PROPERTY_INJECTION_ID = '@aws-cdk.aws-bedrock-agentcore-alpha.Memory';
         /**

package/lib/memory/strategies/managed-strategy.js

@@ -25,7 +25,7 @@ const PROMPT_MAX_LENGTH = 30000;
  * with specific models and prompt templates.
  */
 class ManagedMemoryStrategy {
-    static [JSII_RTTI_SYMBOL_1] = { fqn: "@aws-cdk/aws-bedrock-agentcore-alpha.ManagedMemoryStrategy", version: "2.250.0-alpha.0" };
+    static [JSII_RTTI_SYMBOL_1] = { fqn: "@aws-cdk/aws-bedrock-agentcore-alpha.ManagedMemoryStrategy", version: "2.252.0-alpha.0" };
     name;
     description;
     /**

package/lib/memory/strategies/self-managed-strategy.js

@@ -86,7 +86,7 @@ const DEFAULT_TOKEN_BASED_TRIGGER = 100;
  * Use AgentCore memory for event storage with custom triggers. Define memory processing logic in your own environment.
  */
 class SelfManagedMemoryStrategy {
-    static [JSII_RTTI_SYMBOL_1] = { fqn: "@aws-cdk/aws-bedrock-agentcore-alpha.SelfManagedMemoryStrategy", version: "2.250.0-alpha.0" };
+    static [JSII_RTTI_SYMBOL_1] = { fqn: "@aws-cdk/aws-bedrock-agentcore-alpha.SelfManagedMemoryStrategy", version: "2.252.0-alpha.0" };
     name;
     description;
     strategyType;

package/lib/network/network-configuration.js

@@ -8,7 +8,7 @@ const ec2 = require("aws-cdk-lib/aws-ec2");
  * Abstract base class for network configuration.
  */
 class NetworkConfiguration {
-    static [JSII_RTTI_SYMBOL_1] = { fqn: "@aws-cdk/aws-bedrock-agentcore-alpha.NetworkConfiguration", version: "2.250.0-alpha.0" };
+    static [JSII_RTTI_SYMBOL_1] = { fqn: "@aws-cdk/aws-bedrock-agentcore-alpha.NetworkConfiguration", version: "2.252.0-alpha.0" };
     /**
      * The network mode to use.
      * Configure the security level for agent
@@ -87,7 +87,7 @@ exports.NetworkConfiguration = NetworkConfiguration;
  * Network configuration for the Browser tool.
  */
 class BrowserNetworkConfiguration extends NetworkConfiguration {
-    static [JSII_RTTI_SYMBOL_1] = { fqn: "@aws-cdk/aws-bedrock-agentcore-alpha.BrowserNetworkConfiguration", version: "2.250.0-alpha.0" };
+    static [JSII_RTTI_SYMBOL_1] = { fqn: "@aws-cdk/aws-bedrock-agentcore-alpha.BrowserNetworkConfiguration", version: "2.252.0-alpha.0" };
     /**
      * Creates a public network configuration. PUBLIC is the default network mode.
      * @returns A BrowserNetworkConfiguration.
@@ -133,7 +133,7 @@ exports.BrowserNetworkConfiguration = BrowserNetworkConfiguration;
  * Network configuration for the Code Interpreter tool.
  */
 class CodeInterpreterNetworkConfiguration extends NetworkConfiguration {
-    static [JSII_RTTI_SYMBOL_1] = { fqn: "@aws-cdk/aws-bedrock-agentcore-alpha.CodeInterpreterNetworkConfiguration", version: "2.250.0-alpha.0" };
+    static [JSII_RTTI_SYMBOL_1] = { fqn: "@aws-cdk/aws-bedrock-agentcore-alpha.CodeInterpreterNetworkConfiguration", version: "2.252.0-alpha.0" };
     /**
      * Creates a public network configuration.
      * @returns A CodeInterpreterNetworkConfiguration.
@@ -187,7 +187,7 @@ exports.CodeInterpreterNetworkConfiguration = CodeInterpreterNetworkConfiguratio
  * Network configuration for the Runtime.
  */
 class RuntimeNetworkConfiguration extends NetworkConfiguration {
-    static [JSII_RTTI_SYMBOL_1] = { fqn: "@aws-cdk/aws-bedrock-agentcore-alpha.RuntimeNetworkConfiguration", version: "2.250.0-alpha.0" };
+    static [JSII_RTTI_SYMBOL_1] = { fqn: "@aws-cdk/aws-bedrock-agentcore-alpha.RuntimeNetworkConfiguration", version: "2.252.0-alpha.0" };
     /**
      * Creates a public network configuration. PUBLIC is the default network mode.
      * @returns A RuntimeNetworkConfiguration.

package/lib/policy/perms.d.ts

@@ -0,0 +1,50 @@
+/**
+ * IAM permissions for PolicyEngine and Policy operations.
+ *
+ * IMPORTANT: This module contains DATA PLANE (runtime) permissions only.
+ *
+ * Control plane operations (Create/Update/Delete) are performed by AWS CloudFormation
+ * during `cdk deploy` and do not need to be granted to application runtime roles.
+ *
+ * When you run `cdk deploy`, CloudFormation uses its own service principal to create/update/delete
+ * PolicyEngine and Policy resources. Your IAM user/role running `cdk deploy` needs control plane
+ * permissions in their IAM policies, but these should NOT be granted through CDK construct grant methods.
+ *
+ * @see https://docs.aws.amazon.com/bedrock-agentcore/latest/devguide/policy-permissions.html
+ *
+ * TODO: When this package graduates from alpha and is moved into aws-cdk-lib (and renamed from
+ * `aws-bedrock-agentcore-alpha` to `aws-bedrockagentcore` to align with the L1 module name),
+ * replace this file with an auto-generated grants class following the CDK Design Guidelines:
+ * @see https://github.com/aws/aws-cdk/blob/main/docs/DESIGN_GUIDELINES.md#grants
+ * This requires creating a `grants.json` file at the package root, after which the tooling
+ * will auto-generate the `*Grants` class on every `yarn build`.
+ */
+/**
+ * Runtime evaluation permissions for PolicyEngine (data plane).
+ *
+ * These permissions are required for evaluating authorization policies at runtime.
+ * Grant these to Gateway execution roles that evaluate policies during agent requests.
+ *
+ * Usage: policyEngine.grantEvaluate(gatewayRole)
+ */
+export declare const POLICY_ENGINE_EVALUATE_PERMS: string[];
+/**
+ * Read permissions for PolicyEngine (data plane).
+ *
+ * These permissions allow reading policy engine configuration at runtime.
+ * Typically used for monitoring, observability, or read-only administrative tools.
+ */
+export declare const POLICY_ENGINE_READ_PERMS: string[];
+/**
+ * Read permissions for Policy (data plane).
+ *
+ * These permissions allow reading policy configuration at runtime.
+ * Grant these to monitoring or audit roles that need to inspect policy definitions.
+ *
+ * Actions:
+ * - `bedrock-agentcore:GetPolicy` - Retrieve specific policy configuration and Cedar statement
+ *
+ * Note: `ListPolicies` is intentionally excluded as it's an administrative operation.
+ * Applications should reference specific policies by ID/ARN, not list all policies.
+ */
+export declare const POLICY_READ_PERMS: string[];

package/lib/policy/perms.js

@@ -0,0 +1,62 @@
+"use strict";
+/**
+ * IAM permissions for PolicyEngine and Policy operations.
+ *
+ * IMPORTANT: This module contains DATA PLANE (runtime) permissions only.
+ *
+ * Control plane operations (Create/Update/Delete) are performed by AWS CloudFormation
+ * during `cdk deploy` and do not need to be granted to application runtime roles.
+ *
+ * When you run `cdk deploy`, CloudFormation uses its own service principal to create/update/delete
+ * PolicyEngine and Policy resources. Your IAM user/role running `cdk deploy` needs control plane
+ * permissions in their IAM policies, but these should NOT be granted through CDK construct grant methods.
+ *
+ * @see https://docs.aws.amazon.com/bedrock-agentcore/latest/devguide/policy-permissions.html
+ *
+ * TODO: When this package graduates from alpha and is moved into aws-cdk-lib (and renamed from
+ * `aws-bedrock-agentcore-alpha` to `aws-bedrockagentcore` to align with the L1 module name),
+ * replace this file with an auto-generated grants class following the CDK Design Guidelines:
+ * @see https://github.com/aws/aws-cdk/blob/main/docs/DESIGN_GUIDELINES.md#grants
+ * This requires creating a `grants.json` file at the package root, after which the tooling
+ * will auto-generate the `*Grants` class on every `yarn build`.
+ */
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.POLICY_READ_PERMS = exports.POLICY_ENGINE_READ_PERMS = exports.POLICY_ENGINE_EVALUATE_PERMS = void 0;
+/**
+ * Runtime evaluation permissions for PolicyEngine (data plane).
+ *
+ * These permissions are required for evaluating authorization policies at runtime.
+ * Grant these to Gateway execution roles that evaluate policies during agent requests.
+ *
+ * Usage: policyEngine.grantEvaluate(gatewayRole)
+ */
+exports.POLICY_ENGINE_EVALUATE_PERMS = [
+    'bedrock-agentcore:GetPolicyEngine',
+    'bedrock-agentcore:AuthorizeAction',
+    'bedrock-agentcore:PartiallyAuthorizeActions',
+];
+/**
+ * Read permissions for PolicyEngine (data plane).
+ *
+ * These permissions allow reading policy engine configuration at runtime.
+ * Typically used for monitoring, observability, or read-only administrative tools.
+ */
+exports.POLICY_ENGINE_READ_PERMS = [
+    'bedrock-agentcore:GetPolicyEngine',
+];
+/**
+ * Read permissions for Policy (data plane).
+ *
+ * These permissions allow reading policy configuration at runtime.
+ * Grant these to monitoring or audit roles that need to inspect policy definitions.
+ *
+ * Actions:
+ * - `bedrock-agentcore:GetPolicy` - Retrieve specific policy configuration and Cedar statement
+ *
+ * Note: `ListPolicies` is intentionally excluded as it's an administrative operation.
+ * Applications should reference specific policies by ID/ARN, not list all policies.
+ */
+exports.POLICY_READ_PERMS = [
+    'bedrock-agentcore:GetPolicy',
+];
+//# sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJmaWxlIjoicGVybXMuanMiLCJzb3VyY2VSb290IjoiIiwic291cmNlcyI6WyJwZXJtcy50cyJdLCJuYW1lcyI6W10sIm1hcHBpbmdzIjoiO0FBQUE7Ozs7Ozs7Ozs7Ozs7Ozs7Ozs7O0dBb0JHOzs7QUFFSDs7Ozs7OztHQU9HO0FBQ1UsUUFBQSw0QkFBNEIsR0FBRztJQUMxQyxtQ0FBbUM7SUFDbkMsbUNBQW1DO0lBQ25DLDZDQUE2QztDQUM5QyxDQUFDO0FBRUY7Ozs7O0dBS0c7QUFDVSxRQUFBLHdCQUF3QixHQUFHO0lBQ3RDLG1DQUFtQztDQUNwQyxDQUFDO0FBRUY7Ozs7Ozs7Ozs7O0dBV0c7QUFDVSxRQUFBLGlCQUFpQixHQUFHO0lBQy9CLDZCQUE2QjtDQUM5QixDQUFDIiwic291cmNlc0NvbnRlbnQiOlsiLyoqXG4gKiBJQU0gcGVybWlzc2lvbnMgZm9yIFBvbGljeUVuZ2luZSBhbmQgUG9saWN5IG9wZXJhdGlvbnMuXG4gKlxuICogSU1QT1JUQU5UOiBUaGlzIG1vZHVsZSBjb250YWlucyBEQVRBIFBMQU5FIChydW50aW1lKSBwZXJtaXNzaW9ucyBvbmx5LlxuICpcbiAqIENvbnRyb2wgcGxhbmUgb3BlcmF0aW9ucyAoQ3JlYXRlL1VwZGF0ZS9EZWxldGUpIGFyZSBwZXJmb3JtZWQgYnkgQVdTIENsb3VkRm9ybWF0aW9uXG4gKiBkdXJpbmcgYGNkayBkZXBsb3lgIGFuZCBkbyBub3QgbmVlZCB0byBiZSBncmFudGVkIHRvIGFwcGxpY2F0aW9uIHJ1bnRpbWUgcm9sZXMuXG4gKlxuICogV2hlbiB5b3UgcnVuIGBjZGsgZGVwbG95YCwgQ2xvdWRGb3JtYXRpb24gdXNlcyBpdHMgb3duIHNlcnZpY2UgcHJpbmNpcGFsIHRvIGNyZWF0ZS91cGRhdGUvZGVsZXRlXG4gKiBQb2xpY3lFbmdpbmUgYW5kIFBvbGljeSByZXNvdXJjZXMuIFlvdXIgSUFNIHVzZXIvcm9sZSBydW5uaW5nIGBjZGsgZGVwbG95YCBuZWVkcyBjb250cm9sIHBsYW5lXG4gKiBwZXJtaXNzaW9ucyBpbiB0aGVpciBJQU0gcG9saWNpZXMsIGJ1dCB0aGVzZSBzaG91bGQgTk9UIGJlIGdyYW50ZWQgdGhyb3VnaCBDREsgY29uc3RydWN0IGdyYW50IG1ldGhvZHMuXG4gKlxuICogQHNlZSBodHRwczovL2RvY3MuYXdzLmFtYXpvbi5jb20vYmVkcm9jay1hZ2VudGNvcmUvbGF0ZXN0L2Rldmd1aWRlL3BvbGljeS1wZXJtaXNzaW9ucy5odG1sXG4gKlxuICogVE9ETzogV2hlbiB0aGlzIHBhY2thZ2UgZ3JhZHVhdGVzIGZyb20gYWxwaGEgYW5kIGlzIG1vdmVkIGludG8gYXdzLWNkay1saWIgKGFuZCByZW5hbWVkIGZyb21cbiAqIGBhd3MtYmVkcm9jay1hZ2VudGNvcmUtYWxwaGFgIHRvIGBhd3MtYmVkcm9ja2FnZW50Y29yZWAgdG8gYWxpZ24gd2l0aCB0aGUgTDEgbW9kdWxlIG5hbWUpLFxuICogcmVwbGFjZSB0aGlzIGZpbGUgd2l0aCBhbiBhdXRvLWdlbmVyYXRlZCBncmFudHMgY2xhc3MgZm9sbG93aW5nIHRoZSBDREsgRGVzaWduIEd1aWRlbGluZXM6XG4gKiBAc2VlIGh0dHBzOi8vZ2l0aHViLmNvbS9hd3MvYXdzLWNkay9ibG9iL21haW4vZG9jcy9ERVNJR05fR1VJREVMSU5FUy5tZCNncmFudHNcbiAqIFRoaXMgcmVxdWlyZXMgY3JlYXRpbmcgYSBgZ3JhbnRzLmpzb25gIGZpbGUgYXQgdGhlIHBhY2thZ2Ugcm9vdCwgYWZ0ZXIgd2hpY2ggdGhlIHRvb2xpbmdcbiAqIHdpbGwgYXV0by1nZW5lcmF0ZSB0aGUgYCpHcmFudHNgIGNsYXNzIG9uIGV2ZXJ5IGB5YXJuIGJ1aWxkYC5cbiAqL1xuXG4vKipcbiAqIFJ1bnRpbWUgZXZhbHVhdGlvbiBwZXJtaXNzaW9ucyBmb3IgUG9saWN5RW5naW5lIChkYXRhIHBsYW5lKS5cbiAqXG4gKiBUaGVzZSBwZXJtaXNzaW9ucyBhcmUgcmVxdWlyZWQgZm9yIGV2YWx1YXRpbmcgYXV0aG9yaXphdGlvbiBwb2xpY2llcyBhdCBydW50aW1lLlxuICogR3JhbnQgdGhlc2UgdG8gR2F0ZXdheSBleGVjdXRpb24gcm9sZXMgdGhhdCBldmFsdWF0ZSBwb2xpY2llcyBkdXJpbmcgYWdlbnQgcmVxdWVzdHMuXG4gKlxuICogVXNhZ2U6IHBvbGljeUVuZ2luZS5ncmFudEV2YWx1YXRlKGdhdGV3YXlSb2xlKVxuICovXG5leHBvcnQgY29uc3QgUE9MSUNZX0VOR0lORV9FVkFMVUFURV9QRVJNUyA9IFtcbiAgJ2JlZHJvY2stYWdlbnRjb3JlOkdldFBvbGljeUVuZ2luZScsXG4gICdiZWRyb2NrLWFnZW50Y29yZTpBdXRob3JpemVBY3Rpb24nLFxuICAnYmVkcm9jay1hZ2VudGNvcmU6UGFydGlhbGx5QXV0aG9yaXplQWN0aW9ucycsXG5dO1xuXG4vKipcbiAqIFJlYWQgcGVybWlzc2lvbnMgZm9yIFBvbGljeUVuZ2luZSAoZGF0YSBwbGFuZSkuXG4gKlxuICogVGhlc2UgcGVybWlzc2lvbnMgYWxsb3cgcmVhZGluZyBwb2xpY3kgZW5naW5lIGNvbmZpZ3VyYXRpb24gYXQgcnVudGltZS5cbiAqIFR5cGljYWxseSB1c2VkIGZvciBtb25pdG9yaW5nLCBvYnNlcnZhYmlsaXR5LCBvciByZWFkLW9ubHkgYWRtaW5pc3RyYXRpdmUgdG9vbHMuXG4gKi9cbmV4cG9ydCBjb25zdCBQT0xJQ1lfRU5HSU5FX1JFQURfUEVSTVMgPSBbXG4gICdiZWRyb2NrLWFnZW50Y29yZTpHZXRQb2xpY3lFbmdpbmUnLFxuXTtcblxuLyoqXG4gKiBSZWFkIHBlcm1pc3Npb25zIGZvciBQb2xpY3kgKGRhdGEgcGxhbmUpLlxuICpcbiAqIFRoZXNlIHBlcm1pc3Npb25zIGFsbG93IHJlYWRpbmcgcG9saWN5IGNvbmZpZ3VyYXRpb24gYXQgcnVudGltZS5cbiAqIEdyYW50IHRoZXNlIHRvIG1vbml0b3Jpbmcgb3IgYXVkaXQgcm9sZXMgdGhhdCBuZWVkIHRvIGluc3BlY3QgcG9saWN5IGRlZmluaXRpb25zLlxuICpcbiAqIEFjdGlvbnM6XG4gKiAtIGBiZWRyb2NrLWFnZW50Y29yZTpHZXRQb2xpY3lgIC0gUmV0cmlldmUgc3BlY2lmaWMgcG9saWN5IGNvbmZpZ3VyYXRpb24gYW5kIENlZGFyIHN0YXRlbWVudFxuICpcbiAqIE5vdGU6IGBMaXN0UG9saWNpZXNgIGlzIGludGVudGlvbmFsbHkgZXhjbHVkZWQgYXMgaXQncyBhbiBhZG1pbmlzdHJhdGl2ZSBvcGVyYXRpb24uXG4gKiBBcHBsaWNhdGlvbnMgc2hvdWxkIHJlZmVyZW5jZSBzcGVjaWZpYyBwb2xpY2llcyBieSBJRC9BUk4sIG5vdCBsaXN0IGFsbCBwb2xpY2llcy5cbiAqL1xuZXhwb3J0IGNvbnN0IFBPTElDWV9SRUFEX1BFUk1TID0gW1xuICAnYmVkcm9jay1hZ2VudGNvcmU6R2V0UG9saWN5Jyxcbl07XG4iXX0=