@aws-sdk/client-bedrock-agentcore-control 3.1096.0 → 3.1097.0

package/dist-cjs/index.js

@@ -69,7 +69,7 @@ const commonParams = {
     UseDualStack: { type: "builtInParams", name: "useDualstackEndpoint" },
 };
 
-var version = "3.1095.0";
+var version = "3.1096.0";
 var packageInfo = {
 	version: version};
 
@@ -317,6 +317,8 @@ const _A = "Actions";
 const _AC = "ApprovalConfiguration";
 const _ACD = "AgentCardDefinition";
 const _ACMVT = "AuthorizingClaimMatchValueType";
+const _ACV = "AdditionalClaimValue";
+const _ACd = "AdditionalClaims";
 const _ACu = "AuthorizerConfiguration";
 const _AD = "A2aDescriptor";
 const _ADE = "AccessDeniedException";
@@ -818,6 +820,7 @@ const _IPa = "IamPrincipal";
 const _ISE = "InternalServerException";
 const _ITC = "InferenceTargetConfiguration";
 const _KC = "KmsConfiguration";
+const _KKST = "KmsKeySourceType";
 const _KR = "KinesisResource";
 const _LAAJEC = "LlmAsAJudgeEvaluatorConfig";
 const _LAKCP = "ListApiKeyCredentialProviders";
@@ -1017,6 +1020,8 @@ const _PGD = "PolicyGenerationDetails";
 const _PGS = "PolicyGenerationSummary";
 const _PGSL = "PolicyGenerationSummaryList";
 const _PGo = "PolicyGenerations";
+const _PKJC = "PrivateKeyJwtConfig";
+const _PKS = "PrivateKeySource";
 const _PMS = "PaymentManagerSummary";
 const _PMSa = "PaymentManagerSummaries";
 const _PP = "ProviderPrefix";
@@ -1280,6 +1285,7 @@ const _aE = "authorizationEndpoint";
 const _aF = "apiFormat";
 const _aG = "apiGateway";
 const _aGTC = "apiGatewayToolConfiguration";
+const _aHC = "additionalHeaderClaims";
 const _aI = "actorId";
 const _aIK = "addIndexedKeys";
 const _aIp = "appId";
@@ -1300,6 +1306,7 @@ const _aO = "anyOf";
 const _aOPC = "atlassianOauth2ProviderConfig";
 const _aP = "additionalParams";
 const _aPA = "accessPointArn";
+const _aPC = "additionalPayloadClaims";
 const _aPK = "authorizationPrivateKey";
 const _aPKA = "authorizationPrivateKeyArn";
 const _aPKC = "authorizationPrivateKeyConfig";
@@ -1547,6 +1554,7 @@ const _jK = "jsonKey";
 const _k = "key";
 const _kC = "kmsConfiguration";
 const _kKA = "kmsKeyArn";
+const _kKS = "kmsKeySource";
 const _kT = "keyType";
 const _ki = "kinesis";
 const _l = "location";
@@ -1674,6 +1682,8 @@ const _pGI = "policyGenerationId";
 const _pGo = "policyGeneration";
 const _pI = "profileId";
 const _pIo = "policyId";
+const _pKJC = "privateKeyJwtConfig";
+const _pKS = "privateKeySource";
 const _pM = "paymentManagers";
 const _pMA = "paymentManagerArn";
 const _pMI = "paymentManagerId";
@@ -1736,7 +1746,8 @@ const _reso = "resources";
 const _ru = "runtime";
 const _rul = "rule";
 const _s = "smithy.ts.sdk.synthetic.com.amazonaws.bedrockagentcorecontrol";
-const _sA = "secretArn";
+const _sA = "signingAlgorithm";
+const _sAe = "secretArn";
 const _sC = "synchronizationConfiguration";
 const _sCO = "semanticConsolidationOverride";
 const _sCOu = "summaryConsolidationOverride";
@@ -1972,6 +1983,7 @@ const errorTypeRegistries = [
     _s_registry,
     n0_registry,
 ];
+var AdditionalClaimValue = [0, n0, _ACV, 8, 0];
 var ConfigurationBundleDescription = [0, n0, _CBD, 8, 0];
 var DefaultApiKeyType = [0, n0, _DAKT, 8, 0];
 var DefaultClientSecretType = [0, n0, _DCST, 8, 0];
@@ -2392,7 +2404,7 @@ var CreateOauth2CredentialProviderRequest$ = [3, n0, _COCPR,
 var CreateOauth2CredentialProviderResponse$ = [3, n0, _COCPRr,
     0,
     [_cSA, _n, _cPA, _cSJK, _cSS, _cUa, _oPCO, _st],
-    [() => Secret$, 0, 0, 0, 0, 0, () => Oauth2ProviderConfigOutput$, 0], 3
+    [() => Secret$, 0, 0, 0, 0, 0, [() => Oauth2ProviderConfigOutput$, 0], 0], 3
 ];
 var CreateOnlineEvaluationConfigRequest$ = [3, n0, _COECR,
     0,
@@ -2511,13 +2523,13 @@ var CustomMemoryStrategyInput$ = [3, n0, _CMSI,
 ];
 var CustomOauth2ProviderConfigInput$ = [3, n0, _COPCI,
     0,
-    [_oD, _cI, _cS, _cSC, _cSS, _oBOTEC, _cAM, _pE, _pEO],
-    [() => Oauth2Discovery$, 0, [() => DefaultClientSecretType, 0], () => SecretReference$, 0, () => OnBehalfOfTokenExchangeConfigType$, 0, () => PrivateEndpoint$, () => PrivateEndpointOverrides], 1
+    [_oD, _cI, _cS, _cSC, _cSS, _oBOTEC, _cAM, _pKJC, _pE, _pEO],
+    [() => Oauth2Discovery$, 0, [() => DefaultClientSecretType, 0], () => SecretReference$, 0, () => OnBehalfOfTokenExchangeConfigType$, 0, [() => PrivateKeyJwtConfig$, 0], () => PrivateEndpoint$, () => PrivateEndpointOverrides], 1
 ];
 var CustomOauth2ProviderConfigOutput$ = [3, n0, _COPCO,
     0,
-    [_oD, _cI, _pE, _pEO, _oBOTEC, _cAM],
-    [() => Oauth2Discovery$, 0, () => PrivateEndpoint$, () => PrivateEndpointOverrides, () => OnBehalfOfTokenExchangeConfigType$, 0], 1
+    [_oD, _cI, _oBOTEC, _cAM, _pE, _pEO, _pKJC],
+    [() => Oauth2Discovery$, 0, () => OnBehalfOfTokenExchangeConfigType$, 0, () => PrivateEndpoint$, () => PrivateEndpointOverrides, [() => PrivateKeyJwtConfig$, 0]], 1
 ];
 var CustomTransformConfiguration$ = [3, n0, _CTCu,
     0,
@@ -3092,7 +3104,7 @@ var GetOauth2CredentialProviderRequest$ = [3, n0, _GOCPR,
 var GetOauth2CredentialProviderResponse$ = [3, n0, _GOCPRe,
     0,
     [_cSA, _n, _cPA, _cPV, _oPCO, _cTr, _lUT, _cSJK, _cSS, _cUa, _st, _fR],
-    [() => Secret$, 0, 0, 0, () => Oauth2ProviderConfigOutput$, 4, 4, 0, 0, 0, 0, 0], 7
+    [() => Secret$, 0, 0, 0, [() => Oauth2ProviderConfigOutput$, 0], 4, 4, 0, 0, 0, 0, 0], 7
 ];
 var GetOnlineEvaluationConfigRequest$ = [3, n0, _GOECR,
     0,
@@ -3499,6 +3511,11 @@ var KmsConfiguration$ = [3, n0, _KC,
     [_kT, _kKA],
     [0, 0], 1
 ];
+var KmsKeySourceType$ = [3, n0, _KKST,
+    0,
+    [_kKA],
+    [0], 1
+];
 var LambdaEvaluatorConfig$ = [3, n0, _LEC,
     0,
     [_lA, _lTIS],
@@ -4149,6 +4166,11 @@ var PrivateEndpointOverride$ = [3, n0, _PEO,
     [_do, _pE],
     [0, () => PrivateEndpoint$], 2
 ];
+var PrivateKeyJwtConfig$ = [3, n0, _PKJC,
+    0,
+    [_pKS, _sA, _aHC, _aPC],
+    [() => PrivateKeySource$, 0, [() => AdditionalClaims, 0], [() => AdditionalClaims, 0]]
+];
 var ProtocolConfiguration$ = [3, n0, _PC,
     0,
     [_sPe],
@@ -4261,7 +4283,7 @@ var SchemaDefinition$ = [3, n0, _SD,
 ];
 var Secret$ = [3, n0, _S,
     0,
-    [_sA],
+    [_sAe],
     [0], 1
 ];
 var SecretReference$ = [3, n0, _SR,
@@ -4271,7 +4293,7 @@ var SecretReference$ = [3, n0, _SR,
 ];
 var SecretsManagerLocation$ = [3, n0, _SML,
     0,
-    [_sA],
+    [_sAe],
     [0], 1
 ];
 var SelfManagedConfiguration$ = [3, n0, _SMC,
@@ -4777,7 +4799,7 @@ var UpdateOauth2CredentialProviderRequest$ = [3, n0, _UOCPR,
 var UpdateOauth2CredentialProviderResponse$ = [3, n0, _UOCPRp,
     0,
     [_cSA, _n, _cPV, _cPA, _oPCO, _cTr, _lUT, _cSJK, _cSS, _cUa, _st],
-    [() => Secret$, 0, 0, 0, () => Oauth2ProviderConfigOutput$, 4, 4, 0, 0, 0, 0], 7
+    [() => Secret$, 0, 0, 0, [() => Oauth2ProviderConfigOutput$, 0], 4, 4, 0, 0, 0, 0], 7
 ];
 var UpdateOnlineEvaluationConfigRequest$ = [3, n0, _UOECR,
     0,
@@ -5227,6 +5249,12 @@ var ValidationExceptionFieldList = [1, n0, _VEFL,
 var WorkloadIdentityList = [1, n0, _WIL,
     0, () => WorkloadIdentityType$
 ];
+var AdditionalClaims = [2, n0, _ACd,
+    0, [0,
+        0],
+    [() => AdditionalClaimValue,
+        0]
+];
 var ComponentConfigurationMap = [2, n0, _CCM,
     0, [0,
         0],
@@ -5529,7 +5557,7 @@ var Oauth2ProviderConfigInput$ = [4, n0, _OPCI,
 var Oauth2ProviderConfigOutput$ = [4, n0, _OPCO,
     0,
     [_cOPC, _gOPC, _gOPCi, _sOPC, _sOPCa, _mOPC, _aOPC, _lOPC, _iOPC],
-    [() => CustomOauth2ProviderConfigOutput$, () => GoogleOauth2ProviderConfigOutput$, () => GithubOauth2ProviderConfigOutput$, () => SlackOauth2ProviderConfigOutput$, () => SalesforceOauth2ProviderConfigOutput$, () => MicrosoftOauth2ProviderConfigOutput$, () => AtlassianOauth2ProviderConfigOutput$, () => LinkedinOauth2ProviderConfigOutput$, () => IncludedOauth2ProviderConfigOutput$]
+    [[() => CustomOauth2ProviderConfigOutput$, 0], () => GoogleOauth2ProviderConfigOutput$, () => GithubOauth2ProviderConfigOutput$, () => SlackOauth2ProviderConfigOutput$, () => SalesforceOauth2ProviderConfigOutput$, () => MicrosoftOauth2ProviderConfigOutput$, () => AtlassianOauth2ProviderConfigOutput$, () => LinkedinOauth2ProviderConfigOutput$, () => IncludedOauth2ProviderConfigOutput$]
 ];
 var PaymentProviderConfigurationInput$ = [4, n0, _PPCI,
     0,
@@ -5551,6 +5579,11 @@ var PrivateEndpoint$ = [4, n0, _PEr,
     [_sMLR, _mVR],
     [() => SelfManagedLatticeResource$, () => ManagedVpcResource$]
 ];
+var PrivateKeySource$ = [4, n0, _PKS,
+    0,
+    [_kKS],
+    [() => KmsKeySourceType$]
+];
 var RatingScale$ = [4, n0, _RSa,
     8,
     [_nu, _ca],
@@ -7668,11 +7701,17 @@ const ClientAuthenticationMethodType = {
     AWS_IAM_ID_TOKEN_JWT: "AWS_IAM_ID_TOKEN_JWT",
     CLIENT_SECRET_BASIC: "CLIENT_SECRET_BASIC",
     CLIENT_SECRET_POST: "CLIENT_SECRET_POST",
+    PRIVATE_KEY_JWT: "PRIVATE_KEY_JWT",
 };
 const OnBehalfOfTokenExchangeGrantTypeType = {
     JWT_AUTHORIZATION_GRANT: "JWT_AUTHORIZATION_GRANT",
     TOKEN_EXCHANGE: "TOKEN_EXCHANGE",
 };
+const SigningAlgorithm = {
+    ES256: "ES256",
+    PS256: "PS256",
+    RS256: "RS256",
+};
 const Status = {
     CREATE_FAILED: "CREATE_FAILED",
     CREATING: "CREATING",
@@ -8405,6 +8444,7 @@ exports.InvocationConfigurationInput$ = InvocationConfigurationInput$;
 exports.KeyType = KeyType;
 exports.KinesisResource$ = KinesisResource$;
 exports.KmsConfiguration$ = KmsConfiguration$;
+exports.KmsKeySourceType$ = KmsKeySourceType$;
 exports.LambdaEvaluatorConfig$ = LambdaEvaluatorConfig$;
 exports.LambdaInterceptorConfiguration$ = LambdaInterceptorConfiguration$;
 exports.LambdaTransformConfiguration$ = LambdaTransformConfiguration$;
@@ -8644,6 +8684,8 @@ exports.PolicyValidationMode = PolicyValidationMode;
 exports.PrincipalMatchOperator = PrincipalMatchOperator;
 exports.PrivateEndpoint$ = PrivateEndpoint$;
 exports.PrivateEndpointOverride$ = PrivateEndpointOverride$;
+exports.PrivateKeyJwtConfig$ = PrivateKeyJwtConfig$;
+exports.PrivateKeySource$ = PrivateKeySource$;
 exports.ProtocolConfiguration$ = ProtocolConfiguration$;
 exports.ProviderPrefix$ = ProviderPrefix$;
 exports.PutResourcePolicy$ = PutResourcePolicy$;
@@ -8714,6 +8756,7 @@ exports.SetTokenVaultCMK$ = SetTokenVaultCMK$;
 exports.SetTokenVaultCMKCommand = SetTokenVaultCMKCommand;
 exports.SetTokenVaultCMKRequest$ = SetTokenVaultCMKRequest$;
 exports.SetTokenVaultCMKResponse$ = SetTokenVaultCMKResponse$;
+exports.SigningAlgorithm = SigningAlgorithm;
 exports.SkillDefinition$ = SkillDefinition$;
 exports.SkillMdDefinition$ = SkillMdDefinition$;
 exports.SlackOauth2ProviderConfigInput$ = SlackOauth2ProviderConfigInput$;

package/dist-es/models/enums.js

@@ -394,11 +394,17 @@ export const ClientAuthenticationMethodType = {
     AWS_IAM_ID_TOKEN_JWT: "AWS_IAM_ID_TOKEN_JWT",
     CLIENT_SECRET_BASIC: "CLIENT_SECRET_BASIC",
     CLIENT_SECRET_POST: "CLIENT_SECRET_POST",
+    PRIVATE_KEY_JWT: "PRIVATE_KEY_JWT",
 };
 export const OnBehalfOfTokenExchangeGrantTypeType = {
     JWT_AUTHORIZATION_GRANT: "JWT_AUTHORIZATION_GRANT",
     TOKEN_EXCHANGE: "TOKEN_EXCHANGE",
 };
+export const SigningAlgorithm = {
+    ES256: "ES256",
+    PS256: "PS256",
+    RS256: "RS256",
+};
 export const Status = {
     CREATE_FAILED: "CREATE_FAILED",
     CREATING: "CREATING",

package/dist-es/schemas/schemas_0.js

@@ -2,6 +2,8 @@ const _A = "Actions";
 const _AC = "ApprovalConfiguration";
 const _ACD = "AgentCardDefinition";
 const _ACMVT = "AuthorizingClaimMatchValueType";
+const _ACV = "AdditionalClaimValue";
+const _ACd = "AdditionalClaims";
 const _ACu = "AuthorizerConfiguration";
 const _AD = "A2aDescriptor";
 const _ADE = "AccessDeniedException";
@@ -503,6 +505,7 @@ const _IPa = "IamPrincipal";
 const _ISE = "InternalServerException";
 const _ITC = "InferenceTargetConfiguration";
 const _KC = "KmsConfiguration";
+const _KKST = "KmsKeySourceType";
 const _KR = "KinesisResource";
 const _LAAJEC = "LlmAsAJudgeEvaluatorConfig";
 const _LAKCP = "ListApiKeyCredentialProviders";
@@ -702,6 +705,8 @@ const _PGD = "PolicyGenerationDetails";
 const _PGS = "PolicyGenerationSummary";
 const _PGSL = "PolicyGenerationSummaryList";
 const _PGo = "PolicyGenerations";
+const _PKJC = "PrivateKeyJwtConfig";
+const _PKS = "PrivateKeySource";
 const _PMS = "PaymentManagerSummary";
 const _PMSa = "PaymentManagerSummaries";
 const _PP = "ProviderPrefix";
@@ -965,6 +970,7 @@ const _aE = "authorizationEndpoint";
 const _aF = "apiFormat";
 const _aG = "apiGateway";
 const _aGTC = "apiGatewayToolConfiguration";
+const _aHC = "additionalHeaderClaims";
 const _aI = "actorId";
 const _aIK = "addIndexedKeys";
 const _aIp = "appId";
@@ -985,6 +991,7 @@ const _aO = "anyOf";
 const _aOPC = "atlassianOauth2ProviderConfig";
 const _aP = "additionalParams";
 const _aPA = "accessPointArn";
+const _aPC = "additionalPayloadClaims";
 const _aPK = "authorizationPrivateKey";
 const _aPKA = "authorizationPrivateKeyArn";
 const _aPKC = "authorizationPrivateKeyConfig";
@@ -1232,6 +1239,7 @@ const _jK = "jsonKey";
 const _k = "key";
 const _kC = "kmsConfiguration";
 const _kKA = "kmsKeyArn";
+const _kKS = "kmsKeySource";
 const _kT = "keyType";
 const _ki = "kinesis";
 const _l = "location";
@@ -1359,6 +1367,8 @@ const _pGI = "policyGenerationId";
 const _pGo = "policyGeneration";
 const _pI = "profileId";
 const _pIo = "policyId";
+const _pKJC = "privateKeyJwtConfig";
+const _pKS = "privateKeySource";
 const _pM = "paymentManagers";
 const _pMA = "paymentManagerArn";
 const _pMI = "paymentManagerId";
@@ -1421,7 +1431,8 @@ const _reso = "resources";
 const _ru = "runtime";
 const _rul = "rule";
 const _s = "smithy.ts.sdk.synthetic.com.amazonaws.bedrockagentcorecontrol";
-const _sA = "secretArn";
+const _sA = "signingAlgorithm";
+const _sAe = "secretArn";
 const _sC = "synchronizationConfiguration";
 const _sCO = "semanticConsolidationOverride";
 const _sCOu = "summaryConsolidationOverride";
@@ -1660,6 +1671,7 @@ export const errorTypeRegistries = [
     _s_registry,
     n0_registry,
 ];
+var AdditionalClaimValue = [0, n0, _ACV, 8, 0];
 var ConfigurationBundleDescription = [0, n0, _CBD, 8, 0];
 var DefaultApiKeyType = [0, n0, _DAKT, 8, 0];
 var DefaultClientSecretType = [0, n0, _DCST, 8, 0];
@@ -2080,7 +2092,7 @@ export var CreateOauth2CredentialProviderRequest$ = [3, n0, _COCPR,
 export var CreateOauth2CredentialProviderResponse$ = [3, n0, _COCPRr,
     0,
     [_cSA, _n, _cPA, _cSJK, _cSS, _cUa, _oPCO, _st],
-    [() => Secret$, 0, 0, 0, 0, 0, () => Oauth2ProviderConfigOutput$, 0], 3
+    [() => Secret$, 0, 0, 0, 0, 0, [() => Oauth2ProviderConfigOutput$, 0], 0], 3
 ];
 export var CreateOnlineEvaluationConfigRequest$ = [3, n0, _COECR,
     0,
@@ -2199,13 +2211,13 @@ export var CustomMemoryStrategyInput$ = [3, n0, _CMSI,
 ];
 export var CustomOauth2ProviderConfigInput$ = [3, n0, _COPCI,
     0,
-    [_oD, _cI, _cS, _cSC, _cSS, _oBOTEC, _cAM, _pE, _pEO],
-    [() => Oauth2Discovery$, 0, [() => DefaultClientSecretType, 0], () => SecretReference$, 0, () => OnBehalfOfTokenExchangeConfigType$, 0, () => PrivateEndpoint$, () => PrivateEndpointOverrides], 1
+    [_oD, _cI, _cS, _cSC, _cSS, _oBOTEC, _cAM, _pKJC, _pE, _pEO],
+    [() => Oauth2Discovery$, 0, [() => DefaultClientSecretType, 0], () => SecretReference$, 0, () => OnBehalfOfTokenExchangeConfigType$, 0, [() => PrivateKeyJwtConfig$, 0], () => PrivateEndpoint$, () => PrivateEndpointOverrides], 1
 ];
 export var CustomOauth2ProviderConfigOutput$ = [3, n0, _COPCO,
     0,
-    [_oD, _cI, _pE, _pEO, _oBOTEC, _cAM],
-    [() => Oauth2Discovery$, 0, () => PrivateEndpoint$, () => PrivateEndpointOverrides, () => OnBehalfOfTokenExchangeConfigType$, 0], 1
+    [_oD, _cI, _oBOTEC, _cAM, _pE, _pEO, _pKJC],
+    [() => Oauth2Discovery$, 0, () => OnBehalfOfTokenExchangeConfigType$, 0, () => PrivateEndpoint$, () => PrivateEndpointOverrides, [() => PrivateKeyJwtConfig$, 0]], 1
 ];
 export var CustomTransformConfiguration$ = [3, n0, _CTCu,
     0,
@@ -2780,7 +2792,7 @@ export var GetOauth2CredentialProviderRequest$ = [3, n0, _GOCPR,
 export var GetOauth2CredentialProviderResponse$ = [3, n0, _GOCPRe,
     0,
     [_cSA, _n, _cPA, _cPV, _oPCO, _cTr, _lUT, _cSJK, _cSS, _cUa, _st, _fR],
-    [() => Secret$, 0, 0, 0, () => Oauth2ProviderConfigOutput$, 4, 4, 0, 0, 0, 0, 0], 7
+    [() => Secret$, 0, 0, 0, [() => Oauth2ProviderConfigOutput$, 0], 4, 4, 0, 0, 0, 0, 0], 7
 ];
 export var GetOnlineEvaluationConfigRequest$ = [3, n0, _GOECR,
     0,
@@ -3187,6 +3199,11 @@ export var KmsConfiguration$ = [3, n0, _KC,
     [_kT, _kKA],
     [0, 0], 1
 ];
+export var KmsKeySourceType$ = [3, n0, _KKST,
+    0,
+    [_kKA],
+    [0], 1
+];
 export var LambdaEvaluatorConfig$ = [3, n0, _LEC,
     0,
     [_lA, _lTIS],
@@ -3837,6 +3854,11 @@ export var PrivateEndpointOverride$ = [3, n0, _PEO,
     [_do, _pE],
     [0, () => PrivateEndpoint$], 2
 ];
+export var PrivateKeyJwtConfig$ = [3, n0, _PKJC,
+    0,
+    [_pKS, _sA, _aHC, _aPC],
+    [() => PrivateKeySource$, 0, [() => AdditionalClaims, 0], [() => AdditionalClaims, 0]]
+];
 export var ProtocolConfiguration$ = [3, n0, _PC,
     0,
     [_sPe],
@@ -3949,7 +3971,7 @@ export var SchemaDefinition$ = [3, n0, _SD,
 ];
 export var Secret$ = [3, n0, _S,
     0,
-    [_sA],
+    [_sAe],
     [0], 1
 ];
 export var SecretReference$ = [3, n0, _SR,
@@ -3959,7 +3981,7 @@ export var SecretReference$ = [3, n0, _SR,
 ];
 export var SecretsManagerLocation$ = [3, n0, _SML,
     0,
-    [_sA],
+    [_sAe],
     [0], 1
 ];
 export var SelfManagedConfiguration$ = [3, n0, _SMC,
@@ -4465,7 +4487,7 @@ export var UpdateOauth2CredentialProviderRequest$ = [3, n0, _UOCPR,
 export var UpdateOauth2CredentialProviderResponse$ = [3, n0, _UOCPRp,
     0,
     [_cSA, _n, _cPV, _cPA, _oPCO, _cTr, _lUT, _cSJK, _cSS, _cUa, _st],
-    [() => Secret$, 0, 0, 0, () => Oauth2ProviderConfigOutput$, 4, 4, 0, 0, 0, 0], 7
+    [() => Secret$, 0, 0, 0, [() => Oauth2ProviderConfigOutput$, 0], 4, 4, 0, 0, 0, 0], 7
 ];
 export var UpdateOnlineEvaluationConfigRequest$ = [3, n0, _UOECR,
     0,
@@ -4957,6 +4979,12 @@ var WorkloadIdentityList = [1, n0, _WIL,
     0, () => WorkloadIdentityType$
 ];
 var WorkloadIdentityNameListType = 64 | 0;
+var AdditionalClaims = [2, n0, _ACd,
+    0, [0,
+        0],
+    [() => AdditionalClaimValue,
+        0]
+];
 var AdvertisedScopeMappingType = 128 | 0;
 var ComponentConfigurationMap = [2, n0, _CCM,
     0, [0,
@@ -5263,7 +5291,7 @@ export var Oauth2ProviderConfigInput$ = [4, n0, _OPCI,
 export var Oauth2ProviderConfigOutput$ = [4, n0, _OPCO,
     0,
     [_cOPC, _gOPC, _gOPCi, _sOPC, _sOPCa, _mOPC, _aOPC, _lOPC, _iOPC],
-    [() => CustomOauth2ProviderConfigOutput$, () => GoogleOauth2ProviderConfigOutput$, () => GithubOauth2ProviderConfigOutput$, () => SlackOauth2ProviderConfigOutput$, () => SalesforceOauth2ProviderConfigOutput$, () => MicrosoftOauth2ProviderConfigOutput$, () => AtlassianOauth2ProviderConfigOutput$, () => LinkedinOauth2ProviderConfigOutput$, () => IncludedOauth2ProviderConfigOutput$]
+    [[() => CustomOauth2ProviderConfigOutput$, 0], () => GoogleOauth2ProviderConfigOutput$, () => GithubOauth2ProviderConfigOutput$, () => SlackOauth2ProviderConfigOutput$, () => SalesforceOauth2ProviderConfigOutput$, () => MicrosoftOauth2ProviderConfigOutput$, () => AtlassianOauth2ProviderConfigOutput$, () => LinkedinOauth2ProviderConfigOutput$, () => IncludedOauth2ProviderConfigOutput$]
 ];
 export var PaymentProviderConfigurationInput$ = [4, n0, _PPCI,
     0,
@@ -5285,6 +5313,11 @@ export var PrivateEndpoint$ = [4, n0, _PEr,
     [_sMLR, _mVR],
     [() => SelfManagedLatticeResource$, () => ManagedVpcResource$]
 ];
+export var PrivateKeySource$ = [4, n0, _PKS,
+    0,
+    [_kKS],
+    [() => KmsKeySourceType$]
+];
 export var RatingScale$ = [4, n0, _RSa,
     8,
     [_nu, _ca],

package/dist-types/commands/CreateOauth2CredentialProviderCommand.d.ts

@@ -68,7 +68,21 @@ declare const CreateOauth2CredentialProviderCommand_base: {
  *           ],
  *         },
  *       },
- *       clientAuthenticationMethod: "CLIENT_SECRET_BASIC" || "CLIENT_SECRET_POST" || "AWS_IAM_ID_TOKEN_JWT",
+ *       clientAuthenticationMethod: "CLIENT_SECRET_BASIC" || "CLIENT_SECRET_POST" || "AWS_IAM_ID_TOKEN_JWT" || "PRIVATE_KEY_JWT",
+ *       privateKeyJwtConfig: { // PrivateKeyJwtConfig
+ *         privateKeySource: { // PrivateKeySource Union: only one key present
+ *           kmsKeySource: { // KmsKeySourceType
+ *             kmsKeyArn: "STRING_VALUE", // required
+ *           },
+ *         },
+ *         signingAlgorithm: "RS256" || "PS256" || "ES256",
+ *         additionalHeaderClaims: { // AdditionalClaims
+ *           "<keys>": "STRING_VALUE",
+ *         },
+ *         additionalPayloadClaims: {
+ *           "<keys>": "STRING_VALUE",
+ *         },
+ *       },
  *       privateEndpoint: { // PrivateEndpoint Union: only one key present
  *         selfManagedLatticeResource: { // SelfManagedLatticeResource Union: only one key present
  *           resourceConfigurationIdentifier: "STRING_VALUE",
@@ -208,6 +222,16 @@ declare const CreateOauth2CredentialProviderCommand_base: {
  * //         },
  * //       },
  * //       clientId: "STRING_VALUE",
+ * //       onBehalfOfTokenExchangeConfig: { // OnBehalfOfTokenExchangeConfigType
+ * //         grantType: "TOKEN_EXCHANGE" || "JWT_AUTHORIZATION_GRANT", // required
+ * //         tokenExchangeGrantTypeConfig: { // TokenExchangeGrantTypeConfigType
+ * //           actorTokenContent: "NONE" || "M2M" || "AWS_IAM_ID_TOKEN_JWT", // required
+ * //           actorTokenScopes: [ // ScopesListType
+ * //             "STRING_VALUE",
+ * //           ],
+ * //         },
+ * //       },
+ * //       clientAuthenticationMethod: "CLIENT_SECRET_BASIC" || "CLIENT_SECRET_POST" || "AWS_IAM_ID_TOKEN_JWT" || "PRIVATE_KEY_JWT",
  * //       privateEndpoint: { // PrivateEndpoint Union: only one key present
  * //         selfManagedLatticeResource: { // SelfManagedLatticeResource Union: only one key present
  * //           resourceConfigurationIdentifier: "STRING_VALUE",
@@ -251,16 +275,20 @@ declare const CreateOauth2CredentialProviderCommand_base: {
  * //           },
  * //         },
  * //       ],
- * //       onBehalfOfTokenExchangeConfig: { // OnBehalfOfTokenExchangeConfigType
- * //         grantType: "TOKEN_EXCHANGE" || "JWT_AUTHORIZATION_GRANT", // required
- * //         tokenExchangeGrantTypeConfig: { // TokenExchangeGrantTypeConfigType
- * //           actorTokenContent: "NONE" || "M2M" || "AWS_IAM_ID_TOKEN_JWT", // required
- * //           actorTokenScopes: [ // ScopesListType
- * //             "STRING_VALUE",
- * //           ],
+ * //       privateKeyJwtConfig: { // PrivateKeyJwtConfig
+ * //         privateKeySource: { // PrivateKeySource Union: only one key present
+ * //           kmsKeySource: { // KmsKeySourceType
+ * //             kmsKeyArn: "STRING_VALUE", // required
+ * //           },
+ * //         },
+ * //         signingAlgorithm: "RS256" || "PS256" || "ES256",
+ * //         additionalHeaderClaims: { // AdditionalClaims
+ * //           "<keys>": "STRING_VALUE",
+ * //         },
+ * //         additionalPayloadClaims: {
+ * //           "<keys>": "STRING_VALUE",
  * //         },
  * //       },
- * //       clientAuthenticationMethod: "CLIENT_SECRET_BASIC" || "CLIENT_SECRET_POST" || "AWS_IAM_ID_TOKEN_JWT",
  * //     },
  * //     googleOauth2ProviderConfig: { // GoogleOauth2ProviderConfigOutput
  * //       oauthDiscovery: {//  Union: only one key present

package/dist-types/commands/DeleteRegistryRecordCommand.d.ts

@@ -1,5 +1,5 @@
 import type { MetadataBearer as __MetadataBearer } from "@smithy/types";
-import type { DeleteRegistryRecordRequest, DeleteRegistryRecordResponse } from "../models/models_1";
+import type { DeleteRegistryRecordRequest, DeleteRegistryRecordResponse } from "../models/models_2";
 /**
  * @public
  */

package/dist-types/commands/GetOauth2CredentialProviderCommand.d.ts

@@ -65,6 +65,16 @@ declare const GetOauth2CredentialProviderCommand_base: {
  * //         },
  * //       },
  * //       clientId: "STRING_VALUE",
+ * //       onBehalfOfTokenExchangeConfig: { // OnBehalfOfTokenExchangeConfigType
+ * //         grantType: "TOKEN_EXCHANGE" || "JWT_AUTHORIZATION_GRANT", // required
+ * //         tokenExchangeGrantTypeConfig: { // TokenExchangeGrantTypeConfigType
+ * //           actorTokenContent: "NONE" || "M2M" || "AWS_IAM_ID_TOKEN_JWT", // required
+ * //           actorTokenScopes: [ // ScopesListType
+ * //             "STRING_VALUE",
+ * //           ],
+ * //         },
+ * //       },
+ * //       clientAuthenticationMethod: "CLIENT_SECRET_BASIC" || "CLIENT_SECRET_POST" || "AWS_IAM_ID_TOKEN_JWT" || "PRIVATE_KEY_JWT",
  * //       privateEndpoint: { // PrivateEndpoint Union: only one key present
  * //         selfManagedLatticeResource: { // SelfManagedLatticeResource Union: only one key present
  * //           resourceConfigurationIdentifier: "STRING_VALUE",
@@ -108,16 +118,20 @@ declare const GetOauth2CredentialProviderCommand_base: {
  * //           },
  * //         },
  * //       ],
- * //       onBehalfOfTokenExchangeConfig: { // OnBehalfOfTokenExchangeConfigType
- * //         grantType: "TOKEN_EXCHANGE" || "JWT_AUTHORIZATION_GRANT", // required
- * //         tokenExchangeGrantTypeConfig: { // TokenExchangeGrantTypeConfigType
- * //           actorTokenContent: "NONE" || "M2M" || "AWS_IAM_ID_TOKEN_JWT", // required
- * //           actorTokenScopes: [ // ScopesListType
- * //             "STRING_VALUE",
- * //           ],
+ * //       privateKeyJwtConfig: { // PrivateKeyJwtConfig
+ * //         privateKeySource: { // PrivateKeySource Union: only one key present
+ * //           kmsKeySource: { // KmsKeySourceType
+ * //             kmsKeyArn: "STRING_VALUE", // required
+ * //           },
+ * //         },
+ * //         signingAlgorithm: "RS256" || "PS256" || "ES256",
+ * //         additionalHeaderClaims: { // AdditionalClaims
+ * //           "<keys>": "STRING_VALUE",
+ * //         },
+ * //         additionalPayloadClaims: {
+ * //           "<keys>": "STRING_VALUE",
  * //         },
  * //       },
- * //       clientAuthenticationMethod: "CLIENT_SECRET_BASIC" || "CLIENT_SECRET_POST" || "AWS_IAM_ID_TOKEN_JWT",
  * //     },
  * //     googleOauth2ProviderConfig: { // GoogleOauth2ProviderConfigOutput
  * //       oauthDiscovery: {//  Union: only one key present

package/dist-types/commands/GetRegistryRecordCommand.d.ts

@@ -1,6 +1,5 @@
 import type { MetadataBearer as __MetadataBearer } from "@smithy/types";
-import type { GetRegistryRecordRequest } from "../models/models_1";
-import type { GetRegistryRecordResponse } from "../models/models_2";
+import type { GetRegistryRecordRequest, GetRegistryRecordResponse } from "../models/models_2";
 /**
  * @public
  */

package/dist-types/commands/UpdateOauth2CredentialProviderCommand.d.ts

@@ -68,7 +68,21 @@ declare const UpdateOauth2CredentialProviderCommand_base: {
  *           ],
  *         },
  *       },
- *       clientAuthenticationMethod: "CLIENT_SECRET_BASIC" || "CLIENT_SECRET_POST" || "AWS_IAM_ID_TOKEN_JWT",
+ *       clientAuthenticationMethod: "CLIENT_SECRET_BASIC" || "CLIENT_SECRET_POST" || "AWS_IAM_ID_TOKEN_JWT" || "PRIVATE_KEY_JWT",
+ *       privateKeyJwtConfig: { // PrivateKeyJwtConfig
+ *         privateKeySource: { // PrivateKeySource Union: only one key present
+ *           kmsKeySource: { // KmsKeySourceType
+ *             kmsKeyArn: "STRING_VALUE", // required
+ *           },
+ *         },
+ *         signingAlgorithm: "RS256" || "PS256" || "ES256",
+ *         additionalHeaderClaims: { // AdditionalClaims
+ *           "<keys>": "STRING_VALUE",
+ *         },
+ *         additionalPayloadClaims: {
+ *           "<keys>": "STRING_VALUE",
+ *         },
+ *       },
  *       privateEndpoint: { // PrivateEndpoint Union: only one key present
  *         selfManagedLatticeResource: { // SelfManagedLatticeResource Union: only one key present
  *           resourceConfigurationIdentifier: "STRING_VALUE",
@@ -208,6 +222,16 @@ declare const UpdateOauth2CredentialProviderCommand_base: {
  * //         },
  * //       },
  * //       clientId: "STRING_VALUE",
+ * //       onBehalfOfTokenExchangeConfig: { // OnBehalfOfTokenExchangeConfigType
+ * //         grantType: "TOKEN_EXCHANGE" || "JWT_AUTHORIZATION_GRANT", // required
+ * //         tokenExchangeGrantTypeConfig: { // TokenExchangeGrantTypeConfigType
+ * //           actorTokenContent: "NONE" || "M2M" || "AWS_IAM_ID_TOKEN_JWT", // required
+ * //           actorTokenScopes: [ // ScopesListType
+ * //             "STRING_VALUE",
+ * //           ],
+ * //         },
+ * //       },
+ * //       clientAuthenticationMethod: "CLIENT_SECRET_BASIC" || "CLIENT_SECRET_POST" || "AWS_IAM_ID_TOKEN_JWT" || "PRIVATE_KEY_JWT",
  * //       privateEndpoint: { // PrivateEndpoint Union: only one key present
  * //         selfManagedLatticeResource: { // SelfManagedLatticeResource Union: only one key present
  * //           resourceConfigurationIdentifier: "STRING_VALUE",
@@ -251,16 +275,20 @@ declare const UpdateOauth2CredentialProviderCommand_base: {
  * //           },
  * //         },
  * //       ],
- * //       onBehalfOfTokenExchangeConfig: { // OnBehalfOfTokenExchangeConfigType
- * //         grantType: "TOKEN_EXCHANGE" || "JWT_AUTHORIZATION_GRANT", // required
- * //         tokenExchangeGrantTypeConfig: { // TokenExchangeGrantTypeConfigType
- * //           actorTokenContent: "NONE" || "M2M" || "AWS_IAM_ID_TOKEN_JWT", // required
- * //           actorTokenScopes: [ // ScopesListType
- * //             "STRING_VALUE",
- * //           ],
+ * //       privateKeyJwtConfig: { // PrivateKeyJwtConfig
+ * //         privateKeySource: { // PrivateKeySource Union: only one key present
+ * //           kmsKeySource: { // KmsKeySourceType
+ * //             kmsKeyArn: "STRING_VALUE", // required
+ * //           },
+ * //         },
+ * //         signingAlgorithm: "RS256" || "PS256" || "ES256",
+ * //         additionalHeaderClaims: { // AdditionalClaims
+ * //           "<keys>": "STRING_VALUE",
+ * //         },
+ * //         additionalPayloadClaims: {
+ * //           "<keys>": "STRING_VALUE",
  * //         },
  * //       },
- * //       clientAuthenticationMethod: "CLIENT_SECRET_BASIC" || "CLIENT_SECRET_POST" || "AWS_IAM_ID_TOKEN_JWT",
  * //     },
  * //     googleOauth2ProviderConfig: { // GoogleOauth2ProviderConfigOutput
  * //       oauthDiscovery: {//  Union: only one key present

package/dist-types/models/enums.d.ts

@@ -966,6 +966,7 @@ export declare const ClientAuthenticationMethodType: {
     readonly AWS_IAM_ID_TOKEN_JWT: "AWS_IAM_ID_TOKEN_JWT";
     readonly CLIENT_SECRET_BASIC: "CLIENT_SECRET_BASIC";
     readonly CLIENT_SECRET_POST: "CLIENT_SECRET_POST";
+    readonly PRIVATE_KEY_JWT: "PRIVATE_KEY_JWT";
 };
 /**
  * @public
@@ -989,6 +990,19 @@ export declare const OnBehalfOfTokenExchangeGrantTypeType: {
  * @public
  */
 export type OnBehalfOfTokenExchangeGrantTypeType = (typeof OnBehalfOfTokenExchangeGrantTypeType)[keyof typeof OnBehalfOfTokenExchangeGrantTypeType];
+/**
+ * @public
+ * @enum
+ */
+export declare const SigningAlgorithm: {
+    readonly ES256: "ES256";
+    readonly PS256: "PS256";
+    readonly RS256: "RS256";
+};
+/**
+ * @public
+ */
+export type SigningAlgorithm = (typeof SigningAlgorithm)[keyof typeof SigningAlgorithm];
 /**
  * @public
  * @enum

package/dist-types/models/models_1.d.ts

@@ -1,5 +1,5 @@
 import type { DocumentType as __DocumentType } from "@smithy/types";
-import type { ActorTokenContentType, ClientAuthenticationMethodType, ClusteringFrequency, ContentLevel, ContentType, CredentialProviderVendorType, DescriptorType, EnforcementMode, ExtractionType, FilterOperator, FindingType, HarnessOpenAiApiFormat, HarnessStatus, HarnessToolType, HarnessTruncationStrategy, MemoryStatus, MemoryStrategyStatus, MemoryStrategyType, MemoryView, MetadataValueType, OnBehalfOfTokenExchangeGrantTypeType, OnlineEvaluationConfigStatus, OnlineEvaluationExecutionStatus, OverrideType, PaymentConnectorStatus, PaymentConnectorType, PaymentCredentialProviderVendorType, PaymentManagerStatus, PaymentsAuthorizerType, PolicyEngineStatus, PolicyGenerationStatus, PolicyStatus, PolicyValidationMode, RegistryRecordCredentialProviderType, RegistryRecordOAuthGrantType, RegistryRecordStatus, SecretSourceType, Status, SynchronizationType } from "./enums";
+import type { ActorTokenContentType, ClientAuthenticationMethodType, ClusteringFrequency, ContentLevel, ContentType, CredentialProviderVendorType, DescriptorType, EnforcementMode, ExtractionType, FilterOperator, FindingType, HarnessOpenAiApiFormat, HarnessStatus, HarnessToolType, HarnessTruncationStrategy, MemoryStatus, MemoryStrategyStatus, MemoryStrategyType, MemoryView, MetadataValueType, OnBehalfOfTokenExchangeGrantTypeType, OnlineEvaluationConfigStatus, OnlineEvaluationExecutionStatus, OverrideType, PaymentConnectorStatus, PaymentConnectorType, PaymentCredentialProviderVendorType, PaymentManagerStatus, PaymentsAuthorizerType, PolicyEngineStatus, PolicyGenerationStatus, PolicyStatus, PolicyValidationMode, RegistryRecordCredentialProviderType, RegistryRecordOAuthGrantType, RegistryRecordStatus, SecretSourceType, SigningAlgorithm, Status, SynchronizationType } from "./enums";
 import type { A2aDescriptor, AgentSkillsDescriptor, AuthorizerConfiguration, FilesystemConfiguration, HarnessBedrockModelConfig, HarnessEnvironmentArtifact, HarnessEnvironmentProviderRequest, HarnessGeminiModelConfig, HarnessLiteLlmModelConfig, HarnessMemoryConfiguration, LifecycleConfiguration, NetworkConfiguration, OAuthCredentialProvider, PrivateEndpoint, PrivateEndpointOverride, Secret, SecretReference, Unit, WorkloadIdentityDetails } from "./models_0";
 /**
  * <p>Configuration for an OpenAI model provider. Requires an API key stored in AgentCore Identity.</p>
@@ -3818,6 +3818,78 @@ export interface OnBehalfOfTokenExchangeConfigType {
      */
     tokenExchangeGrantTypeConfig?: TokenExchangeGrantTypeConfigType | undefined;
 }
+/**
+ * <p>Contains the KMS key configuration for a JWT client assertion.</p>
+ * @public
+ */
+export interface KmsKeySourceType {
+    /**
+     * <p>The Amazon Resource Name (ARN) of the KMS key used to sign the JWT client assertion. The key must be an asymmetric key with key usage SIGN_VERIFY and a key spec compatible with the configured signing algorithm.</p>
+     * @public
+     */
+    kmsKeyArn: string | undefined;
+}
+/**
+ * <p>Contains the private key source configuration for a JWT client assertion.</p>
+ * @public
+ */
+export type PrivateKeySource = PrivateKeySource.KmsKeySourceMember | PrivateKeySource.$UnknownMember;
+/**
+ * @public
+ */
+export declare namespace PrivateKeySource {
+    /**
+     * <p>The KMS key source for the JWT client assertion.</p>
+     * @public
+     */
+    interface KmsKeySourceMember {
+        kmsKeySource: KmsKeySourceType;
+        $unknown?: never;
+    }
+    /**
+     * @public
+     */
+    interface $UnknownMember {
+        kmsKeySource?: never;
+        $unknown: [string, any];
+    }
+    /**
+     * @deprecated unused in schema-serde mode.
+     *
+     */
+    interface Visitor<T> {
+        kmsKeySource: (value: KmsKeySourceType) => T;
+        _: (name: string, value: any) => T;
+    }
+}
+/**
+ * Configuration for private_key_jwt client authentication (RFC 7523).
+ * On Create: privateKeySource and signingAlgorithm are required (enforced server-side).
+ * On Update: all fields are optional — only provided fields are updated.
+ * @public
+ */
+export interface PrivateKeyJwtConfig {
+    /**
+     * <p>The private key source for the JWT client assertion.</p>
+     * @public
+     */
+    privateKeySource?: PrivateKeySource | undefined;
+    /**
+     * <p>The algorithm used to sign the JWT client assertion. Valid values are <code>RS256</code>, <code>PS256</code>, and <code>ES256</code>.</p>
+     * @public
+     */
+    signingAlgorithm?: SigningAlgorithm | undefined;
+    /**
+     * <p>A map of additional claims to include in the JWT client assertion header. Standard header claims such as <code>alg</code> and <code>typ</code> cannot be added.</p>
+     * @public
+     */
+    additionalHeaderClaims?: Record<string, string> | undefined;
+    /**
+     * <p>A map of additional claims to include in the JWT client assertion payload. Payload claims generated by the service, such as <code>iss</code>, <code>sub</code>, <code>jti</code>, and <code>exp</code>, cannot be added.</p>
+     * @public
+     */
+    additionalPayloadClaims?: Record<string, string> | undefined;
+}
 /**
  * <p>Input configuration for a custom OAuth2 provider.</p>
  * @public
@@ -3858,6 +3930,13 @@ export interface CustomOauth2ProviderConfigInput {
      * @public
      */
     clientAuthenticationMethod?: ClientAuthenticationMethodType | undefined;
+    /**
+     * Configuration for private_key_jwt client authentication (RFC 7523).
+     * On Create: privateKeySource and signingAlgorithm are required (enforced server-side).
+     * On Update: all fields are optional — only provided fields are updated.
+     * @public
+     */
+    privateKeyJwtConfig?: PrivateKeyJwtConfig | undefined;
     /**
      * <p>The default private endpoint for the custom OAuth2 provider, enabling secure connectivity through a VPC Lattice resource configuration.</p>
      * @public
@@ -4312,6 +4391,16 @@ export interface CustomOauth2ProviderConfigOutput {
      * @public
      */
     clientId?: string | undefined;
+    /**
+     * <p>The configuration for on-behalf-of token exchange.</p>
+     * @public
+     */
+    onBehalfOfTokenExchangeConfig?: OnBehalfOfTokenExchangeConfigType | undefined;
+    /**
+     * <p>The client authentication method used when authenticating with the token endpoint.</p>
+     * @public
+     */
+    clientAuthenticationMethod?: ClientAuthenticationMethodType | undefined;
     /**
      * <p>The default private endpoint for the custom OAuth2 provider, enabling secure connectivity through a VPC Lattice resource configuration.</p>
      * @public
@@ -4323,15 +4412,12 @@ export interface CustomOauth2ProviderConfigOutput {
      */
     privateEndpointOverrides?: PrivateEndpointOverride[] | undefined;
     /**
-     * <p>The configuration for on-behalf-of token exchange.</p>
-     * @public
-     */
-    onBehalfOfTokenExchangeConfig?: OnBehalfOfTokenExchangeConfigType | undefined;
-    /**
-     * <p>The client authentication method used when authenticating with the token endpoint.</p>
+     * Configuration for private_key_jwt client authentication (RFC 7523).
+     * On Create: privateKeySource and signingAlgorithm are required (enforced server-side).
+     * On Update: all fields are optional — only provided fields are updated.
      * @public
      */
-    clientAuthenticationMethod?: ClientAuthenticationMethodType | undefined;
+    privateKeyJwtConfig?: PrivateKeyJwtConfig | undefined;
 }
 /**
  * <p>Output configuration for a GitHub OAuth2 provider.</p>
@@ -8806,38 +8892,3 @@ export interface CreateRegistryRecordResponse {
      */
     status: RegistryRecordStatus | undefined;
 }
-/**
- * @public
- */
-export interface DeleteRegistryRecordRequest {
-    /**
-     * <p>The identifier of the registry containing the record. You can specify either the Amazon Resource Name (ARN) or the ID of the registry.</p>
-     * @public
-     */
-    registryId: string | undefined;
-    /**
-     * <p>The identifier of the registry record to delete. You can specify either the Amazon Resource Name (ARN) or the ID of the record.</p>
-     * @public
-     */
-    recordId: string | undefined;
-}
-/**
- * @public
- */
-export interface DeleteRegistryRecordResponse {
-}
-/**
- * @public
- */
-export interface GetRegistryRecordRequest {
-    /**
-     * <p>The identifier of the registry containing the record. You can specify either the Amazon Resource Name (ARN) or the ID of the registry.</p>
-     * @public
-     */
-    registryId: string | undefined;
-    /**
-     * <p>The identifier of the registry record to retrieve. You can specify either the Amazon Resource Name (ARN) or the ID of the record.</p>
-     * @public
-     */
-    recordId: string | undefined;
-}

package/dist-types/models/models_2.d.ts

@@ -1,6 +1,41 @@
 import type { DescriptorType, RegistryAuthorizerType, RegistryRecordStatus, RegistryStatus, SchemaType, SynchronizationType, TargetProtocolType, TargetStatus } from "./enums";
 import type { A2aDescriptor, ApiGatewayTargetConfiguration, ApiSchemaConfiguration, AuthorizationData, AuthorizerConfiguration, ConnectorTargetConfiguration, CredentialProviderConfiguration, HttpTargetConfiguration, InferenceTargetConfiguration, KmsConfiguration, ManagedResourceDetails, McpServerTargetConfiguration, MetadataConfiguration, PrivateEndpoint, S3Configuration, SkillDefinition, SkillMdDefinition } from "./models_0";
 import type { CustomDescriptor, Descriptors, ServerDefinition, SynchronizationConfiguration, ToolsDefinition, UpdatedAuthorizerConfiguration, UpdatedDescription } from "./models_1";
+/**
+ * @public
+ */
+export interface DeleteRegistryRecordRequest {
+    /**
+     * <p>The identifier of the registry containing the record. You can specify either the Amazon Resource Name (ARN) or the ID of the registry.</p>
+     * @public
+     */
+    registryId: string | undefined;
+    /**
+     * <p>The identifier of the registry record to delete. You can specify either the Amazon Resource Name (ARN) or the ID of the record.</p>
+     * @public
+     */
+    recordId: string | undefined;
+}
+/**
+ * @public
+ */
+export interface DeleteRegistryRecordResponse {
+}
+/**
+ * @public
+ */
+export interface GetRegistryRecordRequest {
+    /**
+     * <p>The identifier of the registry containing the record. You can specify either the Amazon Resource Name (ARN) or the ID of the registry.</p>
+     * @public
+     */
+    registryId: string | undefined;
+    /**
+     * <p>The identifier of the registry record to retrieve. You can specify either the Amazon Resource Name (ARN) or the ID of the record.</p>
+     * @public
+     */
+    recordId: string | undefined;
+}
 /**
  * @public
  */

package/dist-types/schemas/schemas_0.d.ts

@@ -321,6 +321,7 @@ export declare var InvocationConfiguration$: StaticStructureSchema;
 export declare var InvocationConfigurationInput$: StaticStructureSchema;
 export declare var KinesisResource$: StaticStructureSchema;
 export declare var KmsConfiguration$: StaticStructureSchema;
+export declare var KmsKeySourceType$: StaticStructureSchema;
 export declare var LambdaEvaluatorConfig$: StaticStructureSchema;
 export declare var LambdaInterceptorConfiguration$: StaticStructureSchema;
 export declare var LambdaTransformConfiguration$: StaticStructureSchema;
@@ -451,6 +452,7 @@ export declare var PolicyGenerationSummary$: StaticStructureSchema;
 export declare var PolicyStatement$: StaticStructureSchema;
 export declare var PolicySummary$: StaticStructureSchema;
 export declare var PrivateEndpointOverride$: StaticStructureSchema;
+export declare var PrivateKeyJwtConfig$: StaticStructureSchema;
 export declare var ProtocolConfiguration$: StaticStructureSchema;
 export declare var ProviderPrefix$: StaticStructureSchema;
 export declare var PutResourcePolicyRequest$: StaticStructureSchema;
@@ -673,6 +675,7 @@ export declare var PaymentProviderConfigurationInput$: StaticUnionSchema;
 export declare var PaymentProviderConfigurationOutput$: StaticUnionSchema;
 export declare var PolicyDefinition$: StaticUnionSchema;
 export declare var PrivateEndpoint$: StaticUnionSchema;
+export declare var PrivateKeySource$: StaticUnionSchema;
 export declare var RatingScale$: StaticUnionSchema;
 export declare var ReflectionConfiguration$: StaticUnionSchema;
 export declare var RegistryRecordCredentialProviderUnion$: StaticUnionSchema;

package/dist-types/ts3.4/commands/DeleteRegistryRecordCommand.d.ts

@@ -1,5 +1,5 @@
 import { MetadataBearer as __MetadataBearer } from "@smithy/types";
-import { DeleteRegistryRecordRequest, DeleteRegistryRecordResponse } from "../models/models_1";
+import { DeleteRegistryRecordRequest, DeleteRegistryRecordResponse } from "../models/models_2";
 export { __MetadataBearer };
 export interface DeleteRegistryRecordCommandInput extends DeleteRegistryRecordRequest {}
 export interface DeleteRegistryRecordCommandOutput

package/dist-types/ts3.4/commands/GetRegistryRecordCommand.d.ts

@@ -1,6 +1,5 @@
 import { MetadataBearer as __MetadataBearer } from "@smithy/types";
-import { GetRegistryRecordRequest } from "../models/models_1";
-import { GetRegistryRecordResponse } from "../models/models_2";
+import { GetRegistryRecordRequest, GetRegistryRecordResponse } from "../models/models_2";
 export { __MetadataBearer };
 export interface GetRegistryRecordCommandInput extends GetRegistryRecordRequest {}
 export interface GetRegistryRecordCommandOutput

package/dist-types/ts3.4/models/enums.d.ts

@@ -483,6 +483,7 @@ export declare const ClientAuthenticationMethodType: {
   readonly AWS_IAM_ID_TOKEN_JWT: "AWS_IAM_ID_TOKEN_JWT";
   readonly CLIENT_SECRET_BASIC: "CLIENT_SECRET_BASIC";
   readonly CLIENT_SECRET_POST: "CLIENT_SECRET_POST";
+  readonly PRIVATE_KEY_JWT: "PRIVATE_KEY_JWT";
 };
 export type ClientAuthenticationMethodType =
   (typeof ClientAuthenticationMethodType)[keyof typeof ClientAuthenticationMethodType];
@@ -492,6 +493,12 @@ export declare const OnBehalfOfTokenExchangeGrantTypeType: {
 };
 export type OnBehalfOfTokenExchangeGrantTypeType =
   (typeof OnBehalfOfTokenExchangeGrantTypeType)[keyof typeof OnBehalfOfTokenExchangeGrantTypeType];
+export declare const SigningAlgorithm: {
+  readonly ES256: "ES256";
+  readonly PS256: "PS256";
+  readonly RS256: "RS256";
+};
+export type SigningAlgorithm = (typeof SigningAlgorithm)[keyof typeof SigningAlgorithm];
 export declare const Status: {
   readonly CREATE_FAILED: "CREATE_FAILED";
   readonly CREATING: "CREATING";

package/dist-types/ts3.4/models/models_1.d.ts

@@ -37,6 +37,7 @@ import {
   RegistryRecordOAuthGrantType,
   RegistryRecordStatus,
   SecretSourceType,
+  SigningAlgorithm,
   Status,
   SynchronizationType,
 } from "./enums";
@@ -1516,6 +1517,32 @@ export interface OnBehalfOfTokenExchangeConfigType {
   grantType: OnBehalfOfTokenExchangeGrantTypeType | undefined;
   tokenExchangeGrantTypeConfig?: TokenExchangeGrantTypeConfigType | undefined;
 }
+export interface KmsKeySourceType {
+  kmsKeyArn: string | undefined;
+}
+export type PrivateKeySource =
+  | PrivateKeySource.KmsKeySourceMember
+  | PrivateKeySource.$UnknownMember;
+export declare namespace PrivateKeySource {
+  interface KmsKeySourceMember {
+    kmsKeySource: KmsKeySourceType;
+    $unknown?: never;
+  }
+  interface $UnknownMember {
+    kmsKeySource?: never;
+    $unknown: [string, any];
+  }
+  interface Visitor<T> {
+    kmsKeySource: (value: KmsKeySourceType) => T;
+    _: (name: string, value: any) => T;
+  }
+}
+export interface PrivateKeyJwtConfig {
+  privateKeySource?: PrivateKeySource | undefined;
+  signingAlgorithm?: SigningAlgorithm | undefined;
+  additionalHeaderClaims?: Record<string, string> | undefined;
+  additionalPayloadClaims?: Record<string, string> | undefined;
+}
 export interface CustomOauth2ProviderConfigInput {
   oauthDiscovery: Oauth2Discovery | undefined;
   clientId?: string | undefined;
@@ -1524,6 +1551,7 @@ export interface CustomOauth2ProviderConfigInput {
   clientSecretSource?: SecretSourceType | undefined;
   onBehalfOfTokenExchangeConfig?: OnBehalfOfTokenExchangeConfigType | undefined;
   clientAuthenticationMethod?: ClientAuthenticationMethodType | undefined;
+  privateKeyJwtConfig?: PrivateKeyJwtConfig | undefined;
   privateEndpoint?: PrivateEndpoint | undefined;
   privateEndpointOverrides?: PrivateEndpointOverride[] | undefined;
 }
@@ -1731,10 +1759,11 @@ export interface AtlassianOauth2ProviderConfigOutput {
 export interface CustomOauth2ProviderConfigOutput {
   oauthDiscovery: Oauth2Discovery | undefined;
   clientId?: string | undefined;
-  privateEndpoint?: PrivateEndpoint | undefined;
-  privateEndpointOverrides?: PrivateEndpointOverride[] | undefined;
   onBehalfOfTokenExchangeConfig?: OnBehalfOfTokenExchangeConfigType | undefined;
   clientAuthenticationMethod?: ClientAuthenticationMethodType | undefined;
+  privateEndpoint?: PrivateEndpoint | undefined;
+  privateEndpointOverrides?: PrivateEndpointOverride[] | undefined;
+  privateKeyJwtConfig?: PrivateKeyJwtConfig | undefined;
 }
 export interface GithubOauth2ProviderConfigOutput {
   oauthDiscovery: Oauth2Discovery | undefined;
@@ -3024,12 +3053,3 @@ export interface CreateRegistryRecordResponse {
   recordArn: string | undefined;
   status: RegistryRecordStatus | undefined;
 }
-export interface DeleteRegistryRecordRequest {
-  registryId: string | undefined;
-  recordId: string | undefined;
-}
-export interface DeleteRegistryRecordResponse {}
-export interface GetRegistryRecordRequest {
-  registryId: string | undefined;
-  recordId: string | undefined;
-}

package/dist-types/ts3.4/models/models_2.d.ts

@@ -36,6 +36,15 @@ import {
   UpdatedAuthorizerConfiguration,
   UpdatedDescription,
 } from "./models_1";
+export interface DeleteRegistryRecordRequest {
+  registryId: string | undefined;
+  recordId: string | undefined;
+}
+export interface DeleteRegistryRecordResponse {}
+export interface GetRegistryRecordRequest {
+  registryId: string | undefined;
+  recordId: string | undefined;
+}
 export interface GetRegistryRecordResponse {
   registryArn: string | undefined;
   recordArn: string | undefined;

package/dist-types/ts3.4/schemas/schemas_0.d.ts

@@ -321,6 +321,7 @@ export declare var InvocationConfiguration$: StaticStructureSchema;
 export declare var InvocationConfigurationInput$: StaticStructureSchema;
 export declare var KinesisResource$: StaticStructureSchema;
 export declare var KmsConfiguration$: StaticStructureSchema;
+export declare var KmsKeySourceType$: StaticStructureSchema;
 export declare var LambdaEvaluatorConfig$: StaticStructureSchema;
 export declare var LambdaInterceptorConfiguration$: StaticStructureSchema;
 export declare var LambdaTransformConfiguration$: StaticStructureSchema;
@@ -451,6 +452,7 @@ export declare var PolicyGenerationSummary$: StaticStructureSchema;
 export declare var PolicyStatement$: StaticStructureSchema;
 export declare var PolicySummary$: StaticStructureSchema;
 export declare var PrivateEndpointOverride$: StaticStructureSchema;
+export declare var PrivateKeyJwtConfig$: StaticStructureSchema;
 export declare var ProtocolConfiguration$: StaticStructureSchema;
 export declare var ProviderPrefix$: StaticStructureSchema;
 export declare var PutResourcePolicyRequest$: StaticStructureSchema;
@@ -673,6 +675,7 @@ export declare var PaymentProviderConfigurationInput$: StaticUnionSchema;
 export declare var PaymentProviderConfigurationOutput$: StaticUnionSchema;
 export declare var PolicyDefinition$: StaticUnionSchema;
 export declare var PrivateEndpoint$: StaticUnionSchema;
+export declare var PrivateKeySource$: StaticUnionSchema;
 export declare var RatingScale$: StaticUnionSchema;
 export declare var ReflectionConfiguration$: StaticUnionSchema;
 export declare var RegistryRecordCredentialProviderUnion$: StaticUnionSchema;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@aws-sdk/client-bedrock-agentcore-control",
-  "version": "3.1096.0",
+  "version": "3.1097.0",
   "description": "AWS SDK for JavaScript Bedrock Agentcore Control Client for Node.js, Browser and React Native",
   "homepage": "https://github.com/aws/aws-sdk-js-v3/tree/main/clients/client-bedrock-agentcore-control",
   "license": "Apache-2.0",
@@ -46,8 +46,8 @@
     "test:index": "tsc --noEmit ./test/index-types.ts && node ./test/index-objects.spec.mjs"
   },
   "dependencies": {
-    "@aws-sdk/core": "^3.977.1",
-    "@aws-sdk/credential-provider-node": "^3.972.73",
+    "@aws-sdk/core": "^3.977.2",
+    "@aws-sdk/credential-provider-node": "^3.972.74",
     "@aws-sdk/types": "^3.974.2",
     "@smithy/core": "^3.29.8",
     "@smithy/fetch-http-handler": "^5.6.10",