@aws-sdk/client-agent-registry-control 3.1121.0 → 3.1122.0

package/dist-types/models/models_0.d.ts

@@ -1,11 +1,11 @@
-import type { AutoApprovalRule, ClaimMatchOperatorType, EndpointIpAddressType, InboundTokenClaimValueType, RecordType, RegistryAuthorizerType, RegistryFilterName, RegistryRecordCredentialProviderType, RegistryRecordFilterName, RegistryRecordOAuthGrantType, RegistryRecordStatus, RegistryStatus } from "./enums";
+import type { AgentCoreGatewayProtocolType, AgentCoreRuntimeServerProtocol, AutoApprovalRule, AutoDetectionScope, AutoDetectionStatus, ClaimMatchOperatorType, EndpointIpAddressType, InboundTokenClaimValueType, ProvenanceRelation, RecordType, RegistryAuthorizerType, RegistryFilterName, RegistryRecordCredentialProviderType, RegistryRecordFilterName, RegistryRecordOAuthGrantType, RegistryRecordStatus, RegistryStatus, SourceType } from "./enums";
 /**
- * <p>The configuration for an IAM role credential provider that signs requests to a registry record's source with AWS Signature Version 4 (SigV4).</p>
+ * <p>The configuration for an IAM role credential provider that signs requests to a registry record's source with Amazon Web Services Signature Version 4 (SigV4).</p>
  * @public
  */
 export interface RegistryRecordIamCredentialProvider {
     /**
-     * <p>The &amp;ARN; of the IAM role to assume for request signing.</p>
+     * <p>The Amazon Resource Name (ARN) of the IAM role to assume for request signing.</p>
      * @public
      */
     roleArn?: string | undefined;
@@ -15,7 +15,7 @@ export interface RegistryRecordIamCredentialProvider {
      */
     service?: string | undefined;
     /**
-     * <p>The AWS Region to use for request signing. If not specified, the Region is derived from the source URL hostname, falling back to the Region of the registry.</p>
+     * <p>The Amazon Web Services Region to use for request signing. If not specified, the Region is derived from the source URL hostname, falling back to the Region of the registry.</p>
      * @public
      */
     region?: string | undefined;
@@ -26,7 +26,7 @@ export interface RegistryRecordIamCredentialProvider {
  */
 export interface RegistryRecordOAuthCredentialProvider {
     /**
-     * <p>The &amp;ARN; of the OAuth 2.0 credential provider resource in Amazon Bedrock AgentCore Identity.</p>
+     * <p>The Amazon Resource Name (ARN) of the OAuth 2.0 credential provider resource in Amazon Bedrock AgentCore Identity.</p>
      * @public
      */
     providerArn: string | undefined;
@@ -155,12 +155,367 @@ export interface A2aAgentCardDescriptor {
      */
     source?: DescriptorSource | undefined;
 }
+/**
+ * <p>The expected value used to match a claim. Exactly one member is set.</p>
+ * @public
+ */
+export type ClaimMatchValueType = ClaimMatchValueType.MatchValueStringMember | ClaimMatchValueType.MatchValueStringListMember | ClaimMatchValueType.$UnknownMember;
+/**
+ * @public
+ */
+export declare namespace ClaimMatchValueType {
+    /**
+     * <p>A single string value to match the claim against.</p>
+     * @public
+     */
+    interface MatchValueStringMember {
+        matchValueString: string;
+        matchValueStringList?: never;
+        $unknown?: never;
+    }
+    /**
+     * <p>A list of string values to match the claim against.</p>
+     * @public
+     */
+    interface MatchValueStringListMember {
+        matchValueString?: never;
+        matchValueStringList: string[];
+        $unknown?: never;
+    }
+    /**
+     * @public
+     */
+    interface $UnknownMember {
+        matchValueString?: never;
+        matchValueStringList?: never;
+        $unknown: [string, any];
+    }
+    /**
+     * @deprecated unused in schema-serde mode.
+     *
+     */
+    interface Visitor<T> {
+        matchValueString: (value: string) => T;
+        matchValueStringList: (value: string[]) => T;
+        _: (name: string, value: any) => T;
+    }
+}
+/**
+ * <p>The value and match operator used to authorize a claim during JWT validation.</p>
+ * @public
+ */
+export interface AuthorizingClaimMatchValueType {
+    /**
+     * <p>The expected value or values that the claim is compared against.</p>
+     * @public
+     */
+    claimMatchValue: ClaimMatchValueType | undefined;
+    /**
+     * <p>The operator used to compare the claim value against the expected value.</p>
+     * @public
+     */
+    claimMatchOperator: ClaimMatchOperatorType | undefined;
+}
+/**
+ * <p>A validation rule applied to a single claim of an inbound JWT.</p>
+ * @public
+ */
+export interface CustomClaimValidationType {
+    /**
+     * <p>The name of the claim in the inbound token to validate.</p>
+     * @public
+     */
+    inboundTokenClaimName: string | undefined;
+    /**
+     * <p>The value type of the claim in the inbound token, either a string or an array of strings.</p>
+     * @public
+     */
+    inboundTokenClaimValueType: InboundTokenClaimValueType | undefined;
+    /**
+     * <p>The value and match operator used to authorize the claim.</p>
+     * @public
+     */
+    authorizingClaimMatchValue: AuthorizingClaimMatchValueType | undefined;
+}
+/**
+ * <p>A service-managed private endpoint provisioned within a customer VPC.</p>
+ * @public
+ */
+export interface ManagedVpcResource {
+    /**
+     * <p>The identifier of the VPC in which the private endpoint is provisioned.</p>
+     * @public
+     */
+    vpcIdentifier: string | undefined;
+    /**
+     * <p>The identifiers of the subnets in which the private endpoint network interfaces are placed.</p>
+     * @public
+     */
+    subnetIds: string[] | undefined;
+    /**
+     * <p>The IP address type used by the private endpoint, either IPV4 or IPV6.</p>
+     * @public
+     */
+    endpointIpAddressType: EndpointIpAddressType | undefined;
+    /**
+     * <p>The identifiers of the security groups associated with the private endpoint network interfaces.</p>
+     * @public
+     */
+    securityGroupIds?: string[] | undefined;
+    /**
+     * <p>The tags applied to the service-managed VPC resource.</p>
+     * @public
+     */
+    tags?: Record<string, string> | undefined;
+    /**
+     * <p>The routing domain used to resolve traffic through the private endpoint.</p>
+     * @public
+     */
+    routingDomain?: string | undefined;
+}
+/**
+ * <p>A self-managed private endpoint backed by a VPC Lattice resource configuration. Exactly one member is set.</p>
+ * @public
+ */
+export type SelfManagedLatticeResource = SelfManagedLatticeResource.ResourceConfigurationIdentifierMember | SelfManagedLatticeResource.$UnknownMember;
+/**
+ * @public
+ */
+export declare namespace SelfManagedLatticeResource {
+    /**
+     * <p>The identifier of the VPC Lattice resource configuration, specified as a resource configuration ID or ARN.</p>
+     * @public
+     */
+    interface ResourceConfigurationIdentifierMember {
+        resourceConfigurationIdentifier: string;
+        $unknown?: never;
+    }
+    /**
+     * @public
+     */
+    interface $UnknownMember {
+        resourceConfigurationIdentifier?: never;
+        $unknown: [string, any];
+    }
+    /**
+     * @deprecated unused in schema-serde mode.
+     *
+     */
+    interface Visitor<T> {
+        resourceConfigurationIdentifier: (value: string) => T;
+        _: (name: string, value: any) => T;
+    }
+}
+/**
+ * <p>A private network endpoint used to reach a resource over a private path. Exactly one member is set.</p>
+ * @public
+ */
+export type PrivateEndpoint = PrivateEndpoint.ManagedVpcResourceMember | PrivateEndpoint.SelfManagedLatticeResourceMember | PrivateEndpoint.$UnknownMember;
+/**
+ * @public
+ */
+export declare namespace PrivateEndpoint {
+    /**
+     * <p>A private endpoint backed by a self-managed VPC Lattice resource configuration.</p>
+     * @public
+     */
+    interface SelfManagedLatticeResourceMember {
+        selfManagedLatticeResource: SelfManagedLatticeResource;
+        managedVpcResource?: never;
+        $unknown?: never;
+    }
+    /**
+     * <p>A private endpoint backed by a service-managed VPC resource.</p>
+     * @public
+     */
+    interface ManagedVpcResourceMember {
+        selfManagedLatticeResource?: never;
+        managedVpcResource: ManagedVpcResource;
+        $unknown?: never;
+    }
+    /**
+     * @public
+     */
+    interface $UnknownMember {
+        selfManagedLatticeResource?: never;
+        managedVpcResource?: never;
+        $unknown: [string, any];
+    }
+    /**
+     * @deprecated unused in schema-serde mode.
+     *
+     */
+    interface Visitor<T> {
+        selfManagedLatticeResource: (value: SelfManagedLatticeResource) => T;
+        managedVpcResource: (value: ManagedVpcResource) => T;
+        _: (name: string, value: any) => T;
+    }
+}
+/**
+ * <p>A mapping of a domain to the private endpoint used to reach it.</p>
+ * @public
+ */
+export interface PrivateEndpointOverride {
+    /**
+     * <p>The domain name to which this private endpoint override applies.</p>
+     * @public
+     */
+    domain: string | undefined;
+    /**
+     * <p>The private endpoint used to reach the specified domain.</p>
+     * @public
+     */
+    privateEndpoint: PrivateEndpoint | undefined;
+}
+/**
+ * <p>Configuration for a custom JWT authorizer that validates inbound bearer tokens against an OpenID Connect identity provider.</p>
+ * @public
+ */
+export interface CustomJWTAuthorizerConfiguration {
+    /**
+     * <p>The OpenID Connect discovery URL used to retrieve the identity provider's metadata and signing keys.</p>
+     * @public
+     */
+    discoveryUrl: string | undefined;
+    /**
+     * <p>The audience values accepted during JWT validation. A token is rejected if none of its audience claims match.</p>
+     * @public
+     */
+    allowedAudience?: string[] | undefined;
+    /**
+     * <p>The client identifiers accepted during JWT validation. A token is rejected if it was not issued to one of these clients.</p>
+     * @public
+     */
+    allowedClients?: string[] | undefined;
+    /**
+     * <p>The scopes accepted during JWT validation. A token is rejected if it does not carry one of these scopes.</p>
+     * @public
+     */
+    allowedScopes?: string[] | undefined;
+    /**
+     * <p>Additional custom claim validations applied to the inbound JWT.</p>
+     * @public
+     */
+    customClaims?: CustomClaimValidationType[] | undefined;
+    /**
+     * <p>The private endpoint used to reach the identity provider's discovery URL over a private network path.</p>
+     * @public
+     */
+    privateEndpoint?: PrivateEndpoint | undefined;
+    /**
+     * <p>Per-domain private endpoint overrides that route specific identity provider domains through distinct private endpoints.</p>
+     * @public
+     */
+    privateEndpointOverrides?: PrivateEndpointOverride[] | undefined;
+}
+/**
+ * <p>The authorizer configuration for a registry. Exactly one member is set.</p>
+ * @public
+ */
+export type AuthorizerConfiguration = AuthorizerConfiguration.CustomJWTAuthorizerMember | AuthorizerConfiguration.$UnknownMember;
+/**
+ * @public
+ */
+export declare namespace AuthorizerConfiguration {
+    /**
+     * <p>Configuration for a custom JWT authorizer.</p>
+     * @public
+     */
+    interface CustomJWTAuthorizerMember {
+        customJWTAuthorizer: CustomJWTAuthorizerConfiguration;
+        $unknown?: never;
+    }
+    /**
+     * @public
+     */
+    interface $UnknownMember {
+        customJWTAuthorizer?: never;
+        $unknown: [string, any];
+    }
+    /**
+     * @deprecated unused in schema-serde mode.
+     *
+     */
+    interface Visitor<T> {
+        customJWTAuthorizer: (value: CustomJWTAuthorizerConfiguration) => T;
+        _: (name: string, value: any) => T;
+    }
+}
+/**
+ * Workload identity details associated with a source resource.
+ * @public
+ */
+export interface WorkloadIdentityDetails {
+    /**
+     * <p>The Amazon Resource Name (ARN) of the workload identity associated with the source resource.</p>
+     * @public
+     */
+    workloadIdentityArn: string | undefined;
+}
+/**
+ * Source details for a record auto-detected from an AgentCore Gateway resource.
+ * @public
+ */
+export interface AgentCoreGatewaySourceDetails {
+    /**
+     * The protocol type of an AgentCore Gateway.
+     * @public
+     */
+    protocolType?: AgentCoreGatewayProtocolType | undefined;
+    /**
+     * <p>The type of authorizer configured on the AgentCore Gateway resource that the registry record was detected from.</p>
+     * @public
+     */
+    authorizerType?: string | undefined;
+    /**
+     * <p>The authorizer configuration for a registry. Exactly one member is set.</p>
+     * @public
+     */
+    authorizerConfiguration?: AuthorizerConfiguration | undefined;
+    /**
+     * Workload identity details associated with a source resource.
+     * @public
+     */
+    workloadIdentityDetails?: WorkloadIdentityDetails | undefined;
+}
+/**
+ * Protocol configuration for an AgentCore Runtime.
+ * @public
+ */
+export interface AgentCoreRuntimeProtocolConfiguration {
+    /**
+     * The server protocol used by an AgentCore Runtime.
+     * @public
+     */
+    serverProtocol?: AgentCoreRuntimeServerProtocol | undefined;
+}
+/**
+ * Source details for a record auto-detected from an AgentCore Runtime resource.
+ * @public
+ */
+export interface AgentCoreRuntimeSourceDetails {
+    /**
+     * Protocol configuration for an AgentCore Runtime.
+     * @public
+     */
+    protocolConfiguration?: AgentCoreRuntimeProtocolConfiguration | undefined;
+    /**
+     * <p>The authorizer configuration for a registry. Exactly one member is set.</p>
+     * @public
+     */
+    authorizerConfiguration?: AuthorizerConfiguration | undefined;
+    /**
+     * Workload identity details associated with a source resource.
+     * @public
+     */
+    workloadIdentityDetails?: WorkloadIdentityDetails | undefined;
+}
 /**
  * @public
  */
 export interface ListTagsForResourceRequest {
     /**
-     * ARN of a taggable Agent Registry resource.
+     * <p>The Amazon Resource Name (ARN) of the resource to list tags for. Supported resources include registries and registry records.</p>
      * @public
      */
     resourceArn: string | undefined;
@@ -170,7 +525,7 @@ export interface ListTagsForResourceRequest {
  */
 export interface ListTagsForResourceResponse {
     /**
-     * A map of tag keys to tag values returned by read operations (may be empty).
+     * <p>The tags currently associated with the resource, as a map of tag keys to tag values.</p>
      * @public
      */
     tags?: Record<string, string> | undefined;
@@ -244,29 +599,51 @@ export interface AgentSkillsDefinitionDescriptor {
      */
     additionalData?: AgentSkillsAdditionalData | undefined;
 }
+/**
+ * <p>A registry record descriptor for the AG-UI (Agent-User Interaction) protocol.</p>
+ * @public
+ */
+export interface AgUiDescriptor {
+    /**
+     * <p>The source configuration that defines where descriptor content is retrieved from.</p>
+     * @public
+     */
+    source?: DescriptorSource | undefined;
+}
 /**
  * <p>Custom descriptor for user-defined content</p>
  * @public
  */
 export interface CustomDescriptor {
     /**
-     * <p>Descriptor payload data</p>
+     * <p>The custom descriptor content, serialized as descriptor payload data.</p>
      * @public
      */
     data?: string | undefined;
 }
+/**
+ * <p>A registry record descriptor for the HTTP protocol. This descriptor is source-only: its content is synchronized from the configured source URL rather than supplied inline.</p>
+ * @public
+ */
+export interface HttpDescriptor {
+    /**
+     * <p>The source configuration that defines where descriptor content is retrieved from.</p>
+     * @public
+     */
+    source?: DescriptorSource | undefined;
+}
 /**
  * <p>MCP tools descriptor containing tool definitions</p>
  * @public
  */
 export interface McpToolsDescriptor {
     /**
-     * <p>Descriptor payload data</p>
+     * <p>The MCP tools descriptor content, serialized as descriptor payload data.</p>
      * @public
      */
     data?: string | undefined;
     /**
-     * <p>Version of the descriptor type schema</p>
+     * <p>The schema version of the descriptor payload.</p>
      * @public
      */
     dataSchemaVersion?: string | undefined;
@@ -277,7 +654,7 @@ export interface McpToolsDescriptor {
  */
 export interface McpServerAdditionalData {
     /**
-     * <p>MCP tools descriptor containing tool definitions</p>
+     * <p>The MCP tools descriptor that defines the tools exposed by the MCP server.</p>
      * @public
      */
     tools?: McpToolsDescriptor | undefined;
@@ -333,6 +710,87 @@ export interface Descriptors {
      * @public
      */
     custom?: CustomDescriptor | undefined;
+    /**
+     * <p>The HTTP descriptor, populated for records detected from an HTTP protocol source.</p>
+     * @public
+     */
+    http?: HttpDescriptor | undefined;
+    /**
+     * <p>The AG-UI descriptor, populated for records detected from an AG-UI protocol source.</p>
+     * @public
+     */
+    agui?: AgUiDescriptor | undefined;
+}
+/**
+ * <p>The details about the upstream source from which a registry record was detected. Exactly one member is populated, corresponding to the source type.</p>
+ * @public
+ */
+export type SourceDetails = SourceDetails.AgentcoreGatewayMember | SourceDetails.AgentcoreRuntimeMember | SourceDetails.$UnknownMember;
+/**
+ * @public
+ */
+export declare namespace SourceDetails {
+    /**
+     * Source details for a record auto-detected from an AgentCore Runtime resource.
+     * @public
+     */
+    interface AgentcoreRuntimeMember {
+        agentcoreRuntime: AgentCoreRuntimeSourceDetails;
+        agentcoreGateway?: never;
+        $unknown?: never;
+    }
+    /**
+     * Source details for a record auto-detected from an AgentCore Gateway resource.
+     * @public
+     */
+    interface AgentcoreGatewayMember {
+        agentcoreRuntime?: never;
+        agentcoreGateway: AgentCoreGatewaySourceDetails;
+        $unknown?: never;
+    }
+    /**
+     * @public
+     */
+    interface $UnknownMember {
+        agentcoreRuntime?: never;
+        agentcoreGateway?: never;
+        $unknown: [string, any];
+    }
+    /**
+     * @deprecated unused in schema-serde mode.
+     *
+     */
+    interface Visitor<T> {
+        agentcoreRuntime: (value: AgentCoreRuntimeSourceDetails) => T;
+        agentcoreGateway: (value: AgentCoreGatewaySourceDetails) => T;
+        _: (name: string, value: any) => T;
+    }
+}
+/**
+ * One provenance entry describing the lineage of a registry record.
+ * @public
+ */
+export interface Provenance {
+    /**
+     * The relationship between the registry record and its provenance source.
+     * @public
+     */
+    relation: ProvenanceRelation | undefined;
+    /**
+     * <p>The identifier of the upstream source that the registry record was detected from.</p>
+     * @public
+     */
+    sourceId: string | undefined;
+    /**
+     * <p>The type of the upstream source that the registry record was detected from.</p>
+     * @public
+     */
+    sourceType?: SourceType | undefined;
+    /**
+     * <p>Additional details about the upstream source that the registry record was detected from, such as the AgentCore Gateway or Runtime configuration. The populated member corresponds to the source type.</p>
+     * @public
+     */
+    sourceDetails?: SourceDetails | undefined;
 }
 /**
  * @public
@@ -378,6 +836,13 @@ export interface CreateRegistryRecordRequest {
      * @public
      */
     clientToken?: string | undefined;
+    /**
+     * List of provenance entries on a registry record. Capped at one entry today: a record carries a
+     * single DETECTED_FROM lineage. Modeled as a list so additional relations can be unlocked post-GA
+     * by raising this bound without a breaking shape change.
+     * @public
+     */
+    provenance?: Provenance[] | undefined;
     /**
      * <p>Tags to associate with the registry record</p>
      * @public
@@ -442,12 +907,12 @@ export interface GetRegistryRecordRequest {
  */
 export interface GetRegistryRecordResponse {
     /**
-     * <p>The &amp;ARN; of the parent registry that owns the record.</p>
+     * <p>The Amazon Resource Name (ARN) of the parent registry that owns the record.</p>
      * @public
      */
     registryArn: string | undefined;
     /**
-     * <p>The &amp;ARN; of the registry record.</p>
+     * <p>The Amazon Resource Name (ARN) of the registry record.</p>
      * @public
      */
     recordArn: string | undefined;
@@ -506,6 +971,23 @@ export interface GetRegistryRecordResponse {
      * @public
      */
     statusReason?: string | undefined;
+    /**
+     * List of provenance entries on a registry record. Capped at one entry today: a record carries a
+     * single DETECTED_FROM lineage. Modeled as a list so additional relations can be unlocked post-GA
+     * by raising this bound without a breaking shape change.
+     * @public
+     */
+    provenance?: Provenance[] | undefined;
+    /**
+     * <p>Specifies whether the registry record was created by auto-detection. <code>true</code> indicates the record was automatically created by the service based on the registry's auto-detection configuration; <code>false</code> indicates the record was created through a control-plane API call.</p>
+     * @public
+     */
+    createdByAutoDetection?: boolean | undefined;
+    /**
+     * <p>The ID of the Amazon Web Services account that created the registry record.</p>
+     * @public
+     */
+    createdBy?: string | undefined;
 }
 /**
  * <p>A single filter applied to a ListRegistryRecords request.</p>
@@ -533,20 +1015,42 @@ export interface ListRegistryRecordsRequest {
      */
     registryId: string | undefined;
     /**
-     * <p>Maximum number of records to return</p>
+     * <p>Maximum number of records to return</p>
+     * @public
+     */
+    maxResults?: number | undefined;
+    /**
+     * <p>Token for pagination</p>
+     * @public
+     */
+    nextToken?: string | undefined;
+    /**
+     * <p>Filters to apply to the registry record list</p>
+     * @public
+     */
+    filters?: RegistryRecordFilter[] | undefined;
+}
+/**
+ * Condensed provenance entry for list results — the key triple only (no sourceDetails union).
+ * Enough to display and client-side-filter lineage without the full-read config payload.
+ * @public
+ */
+export interface ProvenanceSummary {
+    /**
+     * The relationship between the registry record and its provenance source.
      * @public
      */
-    maxResults?: number | undefined;
+    relation: ProvenanceRelation | undefined;
     /**
-     * <p>Token for pagination</p>
+     * <p>The identifier of the upstream source that the registry record was detected from.</p>
      * @public
      */
-    nextToken?: string | undefined;
+    sourceId: string | undefined;
     /**
-     * <p>Filters to apply to the registry record list</p>
+     * <p>The type of the upstream source that the registry record was detected from.</p>
      * @public
      */
-    filters?: RegistryRecordFilter[] | undefined;
+    sourceType?: SourceType | undefined;
 }
 /**
  * <p>A summary of a registry record returned by list operations. Contains identifying and lifecycle fields but omits descriptor content.</p>
@@ -554,12 +1058,12 @@ export interface ListRegistryRecordsRequest {
  */
 export interface RegistryRecordSummary {
     /**
-     * <p>The &amp;ARN; of the parent registry that owns the record.</p>
+     * <p>The Amazon Resource Name (ARN) of the parent registry that owns the record.</p>
      * @public
      */
     registryArn: string | undefined;
     /**
-     * <p>The &amp;ARN; of the registry record.</p>
+     * <p>The Amazon Resource Name (ARN) of the registry record.</p>
      * @public
      */
     recordArn: string | undefined;
@@ -608,6 +1112,22 @@ export interface RegistryRecordSummary {
      * @public
      */
     updatedAt: Date | undefined;
+    /**
+     * <p>Specifies whether the registry record was created by auto-detection. <code>true</code> indicates the record was automatically created by the service based on the registry's auto-detection configuration; <code>false</code> indicates the record was created through a control-plane API call.</p>
+     * @public
+     */
+    createdByAutoDetection?: boolean | undefined;
+    /**
+     * <p>The ID of the Amazon Web Services account that created the registry record.</p>
+     * @public
+     */
+    createdBy?: string | undefined;
+    /**
+     * List of condensed provenance entries surfaced on RegistryRecordSummary. Mirrors ProvenanceList's
+     * cardinality (one entry today); modeled as a list for forward-compatibility.
+     * @public
+     */
+    provenanceSummaryList?: ProvenanceSummary[] | undefined;
 }
 /**
  * <p>Response structure for listing registry records</p>
@@ -677,7 +1197,7 @@ export interface SubmitRegistryRecordForApprovalResponse {
  */
 export interface UpdatedDescription {
     /**
-     * <p>Description of the Resource</p>
+     * <p>The value to set for this field. Omit the wrapper to leave the field unchanged.</p>
      * @public
      */
     optionalValue?: string | undefined;
@@ -833,6 +1353,28 @@ export interface UpdatedAgentSkillsDefinitionDescriptor {
      */
     optionalValue?: UpdatedAgentSkillsDefinitionDescriptorFields | undefined;
 }
+/**
+ * <p>The set of AG-UI descriptor fields that can be individually updated.</p>
+ * @public
+ */
+export interface UpdatedAgUiDescriptorFields {
+    /**
+     * <p>The patch for the descriptor's source field.</p>
+     * @public
+     */
+    source?: UpdatedDescriptorSource | undefined;
+}
+/**
+ * <p>The AG-UI descriptor patch wrapper. Omit to leave the descriptor unchanged; supply an empty object to remove it; supply optionalValue to patch its fields.</p>
+ * @public
+ */
+export interface UpdatedAgUiDescriptor {
+    /**
+     * <p>The value to set for this field. Omit the wrapper to leave the field unchanged.</p>
+     * @public
+     */
+    optionalValue?: UpdatedAgUiDescriptorFields | undefined;
+}
 /**
  * <p>The set of custom descriptor fields that can be individually updated.</p>
  * @public
@@ -855,6 +1397,28 @@ export interface UpdatedCustomDescriptor {
      */
     optionalValue?: UpdatedCustomDescriptorFields | undefined;
 }
+/**
+ * <p>The set of HTTP descriptor fields that can be individually updated.</p>
+ * @public
+ */
+export interface UpdatedHttpDescriptorFields {
+    /**
+     * <p>The patch for the descriptor's source field.</p>
+     * @public
+     */
+    source?: UpdatedDescriptorSource | undefined;
+}
+/**
+ * <p>The HTTP descriptor patch wrapper. Omit to leave the descriptor unchanged; supply an empty object to remove it; supply optionalValue to patch its fields.</p>
+ * @public
+ */
+export interface UpdatedHttpDescriptor {
+    /**
+     * <p>The value to set for this field. Omit the wrapper to leave the field unchanged.</p>
+     * @public
+     */
+    optionalValue?: UpdatedHttpDescriptorFields | undefined;
+}
 /**
  * <p>The set of MCP tools descriptor fields that can be individually updated.</p>
  * @public
@@ -966,6 +1530,16 @@ export interface UpdatedDescriptorsFields {
      * @public
      */
     custom?: UpdatedCustomDescriptor | undefined;
+    /**
+     * <p>The patch for the HTTP descriptor.</p>
+     * @public
+     */
+    http?: UpdatedHttpDescriptor | undefined;
+    /**
+     * <p>The patch for the AG-UI descriptor.</p>
+     * @public
+     */
+    agui?: UpdatedAgUiDescriptor | undefined;
 }
 /**
  * <p>The top-level descriptors patch wrapper used in UpdateRegistryRecord. Omit to leave the current descriptors unchanged; supply an empty object to clear them; supply optionalValue to apply a per-field patch.</p>
@@ -1031,442 +1605,196 @@ export interface UpdateRegistryRecordRequest {
     /**
      * <p>The updated version of the registry record. Omit to leave the version unchanged.</p>
      * @public
-     */
-    recordVersion?: string | undefined;
-    /**
-     * <p>Whether to trigger synchronization of the record's descriptor content from its source</p>
-     * @public
-     */
-    triggerSynchronization?: boolean | undefined;
-}
-/**
- * <p>Response structure for updating a registry record</p>
- * @public
- */
-export interface UpdateRegistryRecordResponse {
-    /**
-     * <p>The &amp;ARN; of the parent registry that owns the record.</p>
-     * @public
-     */
-    registryArn: string | undefined;
-    /**
-     * <p>The &amp;ARN; of the registry record.</p>
-     * @public
-     */
-    recordArn: string | undefined;
-    /**
-     * <p>The unique identifier of the registry record.</p>
-     * @public
-     */
-    recordId: string | undefined;
-    /**
-     * <p>The name of the registry record. Names are unique within a registry.</p>
-     * @public
-     */
-    name: string | undefined;
-    /**
-     * <p>The human-readable display name of the registry record.</p>
-     * @public
-     */
-    displayName?: string | undefined;
-    /**
-     * <p>A description of the registry record.</p>
-     * @public
-     */
-    description?: string | undefined;
-    /**
-     * <p>The type of the registry record, such as MCP, AGENT, SKILL, or CUSTOM.</p>
-     * @public
-     */
-    recordType: RecordType | undefined;
-    /**
-     * <p>The typed descriptors that define the content of the registry record.</p>
-     * @public
-     */
-    descriptors?: Descriptors | undefined;
-    /**
-     * <p>The version identifier of the registry record.</p>
-     * @public
-     */
-    recordVersion?: string | undefined;
-    /**
-     * <p>The lifecycle status of the registry record.</p>
-     * @public
-     */
-    status: RegistryRecordStatus | undefined;
-    /**
-     * <p>The timestamp when the registry record was created.</p>
-     * @public
-     */
-    createdAt: Date | undefined;
-    /**
-     * <p>The timestamp when the registry record was last updated.</p>
-     * @public
-     */
-    updatedAt: Date | undefined;
-    /**
-     * <p>The reason for the current status. Typically populated when the status indicates a failure state.</p>
-     * @public
-     */
-    statusReason?: string | undefined;
-}
-/**
- * @public
- */
-export interface UpdateRegistryRecordStatusRequest {
-    /**
-     * <p>The identifier of the registry containing the record (ARN or ID)</p>
-     * @public
-     */
-    registryId: string | undefined;
-    /**
-     * <p>The identifier of the registry record to update the status of (ARN or ID)</p>
-     * @public
-     */
-    recordId: string | undefined;
-    /**
-     * <p>The target status for the registry record</p>
-     * @public
-     */
-    status: RegistryRecordStatus | undefined;
-    /**
-     * <p>The reason for the status change, for example why the record was approved, rejected, or deprecated</p>
-     * @public
-     */
-    statusReason: string | undefined;
-}
-/**
- * <p>Response structure for updating a registry record status</p>
- * @public
- */
-export interface UpdateRegistryRecordStatusResponse {
-    /**
-     * <p>The ARN of the registry</p>
-     * @public
-     */
-    registryArn: string | undefined;
-    /**
-     * <p>The ARN of the registry record</p>
-     * @public
-     */
-    recordArn: string | undefined;
-    /**
-     * <p>The ID of the registry record</p>
-     * @public
-     */
-    recordId: string | undefined;
-    /**
-     * <p>The resulting status of the registry record</p>
-     * @public
-     */
-    status: RegistryRecordStatus | undefined;
-    /**
-     * <p>The reason for the status change</p>
-     * @public
-     */
-    statusReason: string | undefined;
-    /**
-     * <p>The timestamp when the record was last updated</p>
-     * @public
-     */
-    updatedAt: Date | undefined;
-}
-/**
- * <p>Configuration for the registry's record approval workflow. Controls whether records submitted for approval require manual review before they become approved and discoverable, or are auto-approved. When no auto-approval rules are configured, submitted records require manual review.</p>
- * @public
- */
-export interface ApprovalConfiguration {
-    /**
-     * <p>The rules that determine which registry records are automatically approved on submission. When omitted or empty, submitted records require manual review.</p>
-     * @public
-     */
-    autoApprovalRules?: AutoApprovalRule[] | undefined;
-}
-/**
- * <p>The expected value used to match a claim. Exactly one member is set.</p>
- * @public
- */
-export type ClaimMatchValueType = ClaimMatchValueType.MatchValueStringMember | ClaimMatchValueType.MatchValueStringListMember | ClaimMatchValueType.$UnknownMember;
-/**
- * @public
- */
-export declare namespace ClaimMatchValueType {
-    /**
-     * <p>A single string value to match the claim against.</p>
-     * @public
-     */
-    interface MatchValueStringMember {
-        matchValueString: string;
-        matchValueStringList?: never;
-        $unknown?: never;
-    }
-    /**
-     * <p>A list of string values to match the claim against.</p>
-     * @public
-     */
-    interface MatchValueStringListMember {
-        matchValueString?: never;
-        matchValueStringList: string[];
-        $unknown?: never;
-    }
-    /**
-     * @public
-     */
-    interface $UnknownMember {
-        matchValueString?: never;
-        matchValueStringList?: never;
-        $unknown: [string, any];
-    }
-    /**
-     * @deprecated unused in schema-serde mode.
-     *
-     */
-    interface Visitor<T> {
-        matchValueString: (value: string) => T;
-        matchValueStringList: (value: string[]) => T;
-        _: (name: string, value: any) => T;
-    }
-}
-/**
- * <p>The value and match operator used to authorize a claim during JWT validation.</p>
- * @public
- */
-export interface AuthorizingClaimMatchValueType {
+     */
+    recordVersion?: string | undefined;
     /**
-     * <p>The expected value or values that the claim is compared against.</p>
+     * <p>Whether to trigger synchronization of the record's descriptor content from its source</p>
      * @public
      */
-    claimMatchValue: ClaimMatchValueType | undefined;
+    triggerSynchronization?: boolean | undefined;
     /**
-     * <p>The operator used to compare the claim value against the expected value.</p>
+     * List of provenance entries on a registry record. Capped at one entry today: a record carries a
+     * single DETECTED_FROM lineage. Modeled as a list so additional relations can be unlocked post-GA
+     * by raising this bound without a breaking shape change.
      * @public
      */
-    claimMatchOperator: ClaimMatchOperatorType | undefined;
+    provenance?: Provenance[] | undefined;
 }
 /**
- * <p>A validation rule applied to a single claim of an inbound JWT.</p>
+ * <p>Response structure for updating a registry record</p>
  * @public
  */
-export interface CustomClaimValidationType {
+export interface UpdateRegistryRecordResponse {
     /**
-     * <p>The name of the claim in the inbound token to validate.</p>
+     * <p>The Amazon Resource Name (ARN) of the parent registry that owns the record.</p>
      * @public
      */
-    inboundTokenClaimName: string | undefined;
+    registryArn: string | undefined;
     /**
-     * <p>The value type of the claim in the inbound token, either a string or an array of strings.</p>
+     * <p>The Amazon Resource Name (ARN) of the registry record.</p>
      * @public
      */
-    inboundTokenClaimValueType: InboundTokenClaimValueType | undefined;
+    recordArn: string | undefined;
     /**
-     * <p>The value and match operator used to authorize the claim.</p>
+     * <p>The unique identifier of the registry record.</p>
      * @public
      */
-    authorizingClaimMatchValue: AuthorizingClaimMatchValueType | undefined;
-}
-/**
- * <p>A service-managed private endpoint provisioned within a customer VPC.</p>
- * @public
- */
-export interface ManagedVpcResource {
+    recordId: string | undefined;
     /**
-     * <p>The identifier of the VPC in which the private endpoint is provisioned.</p>
+     * <p>The name of the registry record. Names are unique within a registry.</p>
      * @public
      */
-    vpcIdentifier: string | undefined;
+    name: string | undefined;
     /**
-     * <p>The identifiers of the subnets in which the private endpoint network interfaces are placed.</p>
+     * <p>The human-readable display name of the registry record.</p>
      * @public
      */
-    subnetIds: string[] | undefined;
+    displayName?: string | undefined;
     /**
-     * <p>The IP address type used by the private endpoint, either IPV4 or IPV6.</p>
+     * <p>A description of the registry record.</p>
      * @public
      */
-    endpointIpAddressType: EndpointIpAddressType | undefined;
+    description?: string | undefined;
     /**
-     * <p>The identifiers of the security groups associated with the private endpoint network interfaces.</p>
+     * <p>The type of the registry record, such as MCP, AGENT, SKILL, or CUSTOM.</p>
      * @public
      */
-    securityGroupIds?: string[] | undefined;
+    recordType: RecordType | undefined;
     /**
-     * A map of tag keys to tag values.
+     * <p>The typed descriptors that define the content of the registry record.</p>
      * @public
      */
-    tags?: Record<string, string> | undefined;
+    descriptors?: Descriptors | undefined;
     /**
-     * <p>The routing domain used to resolve traffic through the private endpoint.</p>
+     * <p>The version identifier of the registry record.</p>
      * @public
      */
-    routingDomain?: string | undefined;
-}
-/**
- * <p>A self-managed private endpoint backed by a VPC Lattice resource configuration. Exactly one member is set.</p>
- * @public
- */
-export type SelfManagedLatticeResource = SelfManagedLatticeResource.ResourceConfigurationIdentifierMember | SelfManagedLatticeResource.$UnknownMember;
-/**
- * @public
- */
-export declare namespace SelfManagedLatticeResource {
+    recordVersion?: string | undefined;
     /**
-     * <p>The identifier of the VPC Lattice resource configuration, specified as a resource configuration ID or ARN.</p>
+     * <p>The lifecycle status of the registry record.</p>
      * @public
      */
-    interface ResourceConfigurationIdentifierMember {
-        resourceConfigurationIdentifier: string;
-        $unknown?: never;
-    }
+    status: RegistryRecordStatus | undefined;
     /**
+     * <p>The timestamp when the registry record was created.</p>
      * @public
      */
-    interface $UnknownMember {
-        resourceConfigurationIdentifier?: never;
-        $unknown: [string, any];
-    }
+    createdAt: Date | undefined;
     /**
-     * @deprecated unused in schema-serde mode.
-     *
+     * <p>The timestamp when the registry record was last updated.</p>
+     * @public
      */
-    interface Visitor<T> {
-        resourceConfigurationIdentifier: (value: string) => T;
-        _: (name: string, value: any) => T;
-    }
-}
-/**
- * <p>A private network endpoint used to reach a resource over a private path. Exactly one member is set.</p>
- * @public
- */
-export type PrivateEndpoint = PrivateEndpoint.ManagedVpcResourceMember | PrivateEndpoint.SelfManagedLatticeResourceMember | PrivateEndpoint.$UnknownMember;
-/**
- * @public
- */
-export declare namespace PrivateEndpoint {
+    updatedAt: Date | undefined;
     /**
-     * <p>A private endpoint backed by a self-managed VPC Lattice resource configuration.</p>
+     * <p>The reason for the current status. Typically populated when the status indicates a failure state.</p>
      * @public
      */
-    interface SelfManagedLatticeResourceMember {
-        selfManagedLatticeResource: SelfManagedLatticeResource;
-        managedVpcResource?: never;
-        $unknown?: never;
-    }
+    statusReason?: string | undefined;
     /**
-     * <p>A private endpoint backed by a service-managed VPC resource.</p>
+     * List of provenance entries on a registry record. Capped at one entry today: a record carries a
+     * single DETECTED_FROM lineage. Modeled as a list so additional relations can be unlocked post-GA
+     * by raising this bound without a breaking shape change.
      * @public
      */
-    interface ManagedVpcResourceMember {
-        selfManagedLatticeResource?: never;
-        managedVpcResource: ManagedVpcResource;
-        $unknown?: never;
-    }
+    provenance?: Provenance[] | undefined;
     /**
+     * <p>Specifies whether the registry record was created by auto-detection. <code>true</code> indicates the record was automatically created by the service based on the registry's auto-detection configuration; <code>false</code> indicates the record was created through a control-plane API call.</p>
      * @public
      */
-    interface $UnknownMember {
-        selfManagedLatticeResource?: never;
-        managedVpcResource?: never;
-        $unknown: [string, any];
-    }
+    createdByAutoDetection?: boolean | undefined;
     /**
-     * @deprecated unused in schema-serde mode.
-     *
+     * <p>The ID of the Amazon Web Services account that created the registry record.</p>
+     * @public
      */
-    interface Visitor<T> {
-        selfManagedLatticeResource: (value: SelfManagedLatticeResource) => T;
-        managedVpcResource: (value: ManagedVpcResource) => T;
-        _: (name: string, value: any) => T;
-    }
+    createdBy?: string | undefined;
 }
 /**
- * <p>A mapping of a domain to the private endpoint used to reach it.</p>
  * @public
  */
-export interface PrivateEndpointOverride {
+export interface UpdateRegistryRecordStatusRequest {
     /**
-     * <p>The domain name to which this private endpoint override applies.</p>
+     * <p>The identifier of the registry containing the record (ARN or ID)</p>
      * @public
      */
-    domain: string | undefined;
+    registryId: string | undefined;
     /**
-     * <p>The private endpoint used to reach the specified domain.</p>
+     * <p>The identifier of the registry record to update the status of (ARN or ID)</p>
      * @public
      */
-    privateEndpoint: PrivateEndpoint | undefined;
+    recordId: string | undefined;
+    /**
+     * <p>The target status for the registry record</p>
+     * @public
+     */
+    status: RegistryRecordStatus | undefined;
+    /**
+     * <p>The reason for the status change, for example why the record was approved, rejected, or deprecated</p>
+     * @public
+     */
+    statusReason: string | undefined;
 }
 /**
- * <p>Configuration for a custom JWT authorizer that validates inbound bearer tokens against an OpenID Connect identity provider.</p>
+ * <p>Response structure for updating a registry record status</p>
  * @public
  */
-export interface CustomJWTAuthorizerConfiguration {
-    /**
-     * <p>The OpenID Connect discovery URL used to retrieve the identity provider's metadata and signing keys.</p>
-     * @public
-     */
-    discoveryUrl: string | undefined;
+export interface UpdateRegistryRecordStatusResponse {
     /**
-     * <p>The audience values accepted during JWT validation. A token is rejected if none of its audience claims match.</p>
+     * <p>The ARN of the registry</p>
      * @public
      */
-    allowedAudience?: string[] | undefined;
+    registryArn: string | undefined;
     /**
-     * <p>The client identifiers accepted during JWT validation. A token is rejected if it was not issued to one of these clients.</p>
+     * <p>The ARN of the registry record</p>
      * @public
      */
-    allowedClients?: string[] | undefined;
+    recordArn: string | undefined;
     /**
-     * <p>The scopes accepted during JWT validation. A token is rejected if it does not carry one of these scopes.</p>
+     * <p>The ID of the registry record</p>
      * @public
      */
-    allowedScopes?: string[] | undefined;
+    recordId: string | undefined;
     /**
-     * <p>Additional custom claim validations applied to the inbound JWT.</p>
+     * <p>The resulting status of the registry record</p>
      * @public
      */
-    customClaims?: CustomClaimValidationType[] | undefined;
+    status: RegistryRecordStatus | undefined;
     /**
-     * <p>The private endpoint used to reach the identity provider's discovery URL over a private network path.</p>
+     * <p>The reason for the status change</p>
      * @public
      */
-    privateEndpoint?: PrivateEndpoint | undefined;
+    statusReason: string | undefined;
     /**
-     * <p>Per-domain private endpoint overrides that route specific identity provider domains through distinct private endpoints.</p>
+     * <p>The timestamp when the record was last updated</p>
      * @public
      */
-    privateEndpointOverrides?: PrivateEndpointOverride[] | undefined;
+    updatedAt: Date | undefined;
 }
 /**
- * <p>The authorizer configuration for a registry. Exactly one member is set.</p>
+ * <p>Configuration for the registry's record approval workflow. Controls whether records submitted for approval require manual review before they become approved and discoverable, or are auto-approved. When no auto-approval rules are configured, submitted records require manual review.</p>
  * @public
  */
-export type AuthorizerConfiguration = AuthorizerConfiguration.CustomJWTAuthorizerMember | AuthorizerConfiguration.$UnknownMember;
+export interface ApprovalConfiguration {
+    /**
+     * <p>The rules that determine which registry records are automatically approved on submission. When omitted or empty, submitted records require manual review.</p>
+     * @public
+     */
+    autoApprovalRules?: AutoApprovalRule[] | undefined;
+}
 /**
+ * <p>The customer-defined auto-detection settings for a registry.</p>
  * @public
  */
-export declare namespace AuthorizerConfiguration {
+export interface AutoDetectionConfiguration {
     /**
-     * <p>Configuration for a custom JWT authorizer.</p>
+     * <p>The source from which resources are detected. For example, <code>ORGANIZATION</code> sources resources from all member accounts of an Amazon Web Services organization.</p>
      * @public
      */
-    interface CustomJWTAuthorizerMember {
-        customJWTAuthorizer: CustomJWTAuthorizerConfiguration;
-        $unknown?: never;
-    }
+    scope: AutoDetectionScope | undefined;
     /**
+     * <p>Specifies whether auto-detection is requested for the registry. Setting this to <code>true</code> is necessary but not sufficient for auto-detection to become active; the preconditions of the configured scope must also be met.</p>
      * @public
      */
-    interface $UnknownMember {
-        customJWTAuthorizer?: never;
-        $unknown: [string, any];
-    }
-    /**
-     * @deprecated unused in schema-serde mode.
-     *
-     */
-    interface Visitor<T> {
-        customJWTAuthorizer: (value: CustomJWTAuthorizerConfiguration) => T;
-        _: (name: string, value: any) => T;
-    }
+    enabled: boolean | undefined;
 }
 /**
  * <p>Discovery configuration for the registry. Controls how consumers are authorized to search the registry and invoke its MCP endpoint.</p>
@@ -1484,6 +1812,17 @@ export interface DiscoveryConfiguration {
      */
     authorizerType?: RegistryAuthorizerType | undefined;
 }
+/**
+ * <p>The server-side encryption configuration for a registry. Specifies a customer-managed Amazon Web Services KMS key used to encrypt the registry's content.</p>
+ * @public
+ */
+export interface EncryptionConfiguration {
+    /**
+     * <p>The Amazon Resource Name (ARN) of the customer-managed Amazon Web Services KMS key used to encrypt the registry's content. The key must be a symmetric encryption key in the same Amazon Web Services account and Region as the registry.</p>
+     * @public
+     */
+    kmsKeyArn: string | undefined;
+}
 /**
  * <p>Request structure for creating a registry</p>
  * @public
@@ -1499,13 +1838,18 @@ export interface CreateRegistryRequest {
      * @public
      */
     description?: string | undefined;
+    /**
+     * <p>The optional server-side encryption configuration for the registry. When you provide this field, the specified customer-managed Amazon Web Services KMS key encrypts the registry's content. Omit this field to use an Amazon Web Services-owned encryption key. You cannot change the encryption configuration after registry creation.</p>
+     * @public
+     */
+    encryptionConfiguration?: EncryptionConfiguration | undefined;
     /**
      * <p>Discovery configuration for the registry</p>
      * @public
      */
     discoveryConfiguration?: DiscoveryConfiguration | undefined;
     /**
-     * <p>Client token for idempotency</p>
+     * <p>A unique, case-sensitive identifier to ensure that the operation completes no more than one time. If this token matches a previous request, the service ignores the request, but does not return an error.</p>
      * @public
      */
     clientToken?: string | undefined;
@@ -1519,6 +1863,11 @@ export interface CreateRegistryRequest {
      * @public
      */
     approvalConfiguration?: ApprovalConfiguration | undefined;
+    /**
+     * <p>The optional auto-detection configuration for the registry. When provided, the registry is automatically populated with resources discovered according to the configuration. Omit this field for registries whose records are managed exclusively through the Agent Registry Control API.</p>
+     * @public
+     */
+    autoDetectionConfiguration?: AutoDetectionConfiguration | undefined;
 }
 /**
  * <p>Response structure for creating a registry</p>
@@ -1564,6 +1913,27 @@ export interface GetRegistryRequest {
      */
     registryId: string | undefined;
 }
+/**
+ * <p>The auto-detection properties for a registry, including the requested configuration and the current detection status. When auto-detection is enabled and the scope preconditions are met, the registry is automatically populated with discovered resources.</p>
+ * @public
+ */
+export interface AutoDetection {
+    /**
+     * <p>The auto-detection settings that control how resources are discovered for the registry.</p>
+     * @public
+     */
+    configuration: AutoDetectionConfiguration | undefined;
+    /**
+     * <p>The current auto-detection status. <code>ACTIVE</code> indicates that the registry is actively being populated with detected resources. <code>INACTIVE</code> indicates that the preconditions required at the configured scope are not currently met.</p>
+     * @public
+     */
+    status: AutoDetectionStatus | undefined;
+    /**
+     * <p>A human-readable explanation of the current auto-detection status. Typically populated when the status requires additional context.</p>
+     * @public
+     */
+    statusReason?: string | undefined;
+}
 /**
  * <p>Response structure for getting a registry</p>
  * @public
@@ -1594,6 +1964,11 @@ export interface GetRegistryResponse {
      * @public
      */
     discoveryConfiguration?: DiscoveryConfiguration | undefined;
+    /**
+     * <p>The server-side encryption configuration for the registry. Appears only when a customer-managed Amazon Web Services KMS key encrypts the registry.</p>
+     * @public
+     */
+    encryptionConfiguration?: EncryptionConfiguration | undefined;
     /**
      * <p>Approval configuration for registry records</p>
      * @public
@@ -1609,6 +1984,11 @@ export interface GetRegistryResponse {
      * @public
      */
     statusReason?: string | undefined;
+    /**
+     * <p>The registry's auto-detection properties, including the requested configuration and the current detection status. Present only when auto-detection was configured for the registry.</p>
+     * @public
+     */
+    autoDetection?: AutoDetection | undefined;
     /**
      * <p>The timestamp when the registry was created</p>
      * @public
@@ -1697,6 +2077,11 @@ export interface RegistrySummary {
      * @public
      */
     statusReason?: string | undefined;
+    /**
+     * <p>The registry's auto-detection properties, including the requested configuration and the current detection status. Present only when auto-detection was configured for the registry.</p>
+     * @public
+     */
+    autoDetection?: AutoDetection | undefined;
     /**
      * <p>The timestamp when the registry was created</p>
      * @public
@@ -1735,6 +2120,17 @@ export interface UpdatedApprovalConfiguration {
      */
     optionalValue?: ApprovalConfiguration | undefined;
 }
+/**
+ * <p>A wrapper for updating the auto-detection configuration of a registry with PATCH semantics. Include this wrapper to replace the auto-detection configuration with the specified value. Omit it to leave the auto-detection configuration unchanged. To clear the configuration, include the wrapper with a null <code>optionalValue</code>.</p>
+ * @public
+ */
+export interface UpdatedAutoDetectionConfiguration {
+    /**
+     * <p>The value to set for this field. Omit the wrapper to leave the field unchanged.</p>
+     * @public
+     */
+    optionalValue?: AutoDetectionConfiguration | undefined;
+}
 /**
  * <p>Wrapper for updating an optional authorizer configuration with PATCH semantics.</p>
  * @public
@@ -1787,6 +2183,11 @@ export interface UpdateRegistryRequest {
      * @public
      */
     approvalConfiguration?: UpdatedApprovalConfiguration | undefined;
+    /**
+     * <p>The updated auto-detection configuration for the registry, with PATCH semantics. Omit this field to leave the current configuration unchanged. Supply an empty wrapper to unset it. Supply <code>optionalValue</code> to replace it.</p>
+     * @public
+     */
+    autoDetectionConfiguration?: UpdatedAutoDetectionConfiguration | undefined;
 }
 /**
  * <p>Response structure for updating a registry</p>
@@ -1818,6 +2219,11 @@ export interface UpdateRegistryResponse {
      * @public
      */
     discoveryConfiguration?: DiscoveryConfiguration | undefined;
+    /**
+     * <p>The server-side encryption configuration for the registry. Appears only when a customer-managed Amazon Web Services KMS key encrypts the registry.</p>
+     * @public
+     */
+    encryptionConfiguration?: EncryptionConfiguration | undefined;
     /**
      * <p>Approval configuration for registry records</p>
      * @public
@@ -1833,6 +2239,11 @@ export interface UpdateRegistryResponse {
      * @public
      */
     statusReason?: string | undefined;
+    /**
+     * <p>The registry's auto-detection properties, including the requested configuration and the current detection status. Present only when auto-detection was configured for the registry.</p>
+     * @public
+     */
+    autoDetection?: AutoDetection | undefined;
     /**
      * <p>The timestamp when the registry was created</p>
      * @public
@@ -1849,12 +2260,12 @@ export interface UpdateRegistryResponse {
  */
 export interface TagResourceRequest {
     /**
-     * ARN of a taggable Agent Registry resource.
+     * <p>The Amazon Resource Name (ARN) of the resource to tag. Supported resources include registries and registry records.</p>
      * @public
      */
     resourceArn: string | undefined;
     /**
-     * A map of tag keys to tag values.
+     * <p>The tags to apply to the resource, as a map of tag keys to tag values. Tag keys must be unique within the request.</p>
      * @public
      */
     tags: Record<string, string> | undefined;
@@ -1869,12 +2280,12 @@ export interface TagResourceResponse {
  */
 export interface UntagResourceRequest {
     /**
-     * ARN of a taggable Agent Registry resource.
+     * <p>The Amazon Resource Name (ARN) of the resource to remove tags from. Supported resources include registries and registry records.</p>
      * @public
      */
     resourceArn: string | undefined;
     /**
-     * A list of tag keys.
+     * <p>The keys of the tags to remove from the resource. Tags with keys not included in this list remain on the resource.</p>
      * @public
      */
     tagKeys: string[] | undefined;