@aws-sdk/client-bedrock-agentcore-control 3.1104.0 → 3.1106.0

package/dist-types/models/models_2.d.ts

@@ -1,6 +1,1443 @@
-import type { DescriptorType, RegistryAuthorizerType, RegistryRecordStatus, RegistryStatus, SchemaType, SynchronizationType, TargetProtocolType, TargetStatus } from "./enums";
-import type { A2aDescriptor, ApiGatewayTargetConfiguration, ApiSchemaConfiguration, AuthorizationData, AuthorizerConfiguration, ConnectorTargetConfiguration, CredentialProviderConfiguration, HttpTargetConfiguration, InferenceTargetConfiguration, KmsConfiguration, ManagedResourceDetails, McpServerTargetConfiguration, MetadataConfiguration, PrivateEndpoint, S3Configuration, SkillDefinition, SkillMdDefinition } from "./models_0";
-import type { CustomDescriptor, Descriptors, RegistryRecordCredentialProviderConfiguration, ServerDefinition, ToolsDefinition, UpdatedAuthorizerConfiguration, UpdatedDescription } from "./models_1";
+import type { DescriptorType, EnforcementMode, FindingType, PolicyGenerationStatus, PolicyStatus, PolicyValidationMode, RegistryAuthorizerType, RegistryRecordCredentialProviderType, RegistryRecordOAuthGrantType, RegistryRecordStatus, RegistryStatus, SchemaType, SynchronizationType, TargetProtocolType, TargetStatus } from "./enums";
+import type { A2aDescriptor, AgentSkillsDescriptor, ApiSchemaConfiguration, AuthorizerConfiguration, CredentialProviderConfiguration, HttpTargetConfiguration, MetadataConfiguration, PrivateEndpoint, S3Configuration, SkillDefinition, SkillMdDefinition, UpdatedDescription } from "./models_0";
+import type { ApiGatewayTargetConfiguration, AuthorizationData, ConnectorTargetConfiguration, InferenceTargetConfiguration, KmsConfiguration, ManagedResourceDetails, McpServerTargetConfiguration, UpdatedAuthorizerConfiguration } from "./models_1";
+/**
+ * <p>Represents a resource within the AgentCore Policy system. Resources are the targets of policy evaluation. Currently, only AgentCore Gateways are supported as resources for policy enforcement.</p>
+ * @public
+ */
+export type Resource = Resource.ArnMember | Resource.$UnknownMember;
+/**
+ * @public
+ */
+export declare namespace Resource {
+    /**
+     * <p>The Amazon Resource Name (ARN) of the resource. This globally unique identifier specifies the exact resource that policies will be evaluated against for access control decisions. </p>
+     * @public
+     */
+    interface ArnMember {
+        arn: string;
+        $unknown?: never;
+    }
+    /**
+     * @public
+     */
+    interface $UnknownMember {
+        arn?: never;
+        $unknown: [string, any];
+    }
+    /**
+     * @deprecated unused in schema-serde mode.
+     *
+     */
+    interface Visitor<T> {
+        arn: (value: string) => T;
+        _: (name: string, value: any) => T;
+    }
+}
+/**
+ * @public
+ */
+export interface GetPolicyGenerationResponse {
+    /**
+     * <p>The identifier of the policy engine associated with this policy generation. This confirms the policy engine context for the generation operation.</p>
+     * @public
+     */
+    policyEngineId: string | undefined;
+    /**
+     * <p>The unique identifier of the policy generation request. This matches the generation ID provided in the request and serves as the tracking identifier.</p>
+     * @public
+     */
+    policyGenerationId: string | undefined;
+    /**
+     * <p>The customer-assigned name for the policy generation request. This helps identify and track generation operations across multiple requests.</p>
+     * @public
+     */
+    name: string | undefined;
+    /**
+     * <p>The Amazon Resource Name (ARN) of the policy generation. This globally unique identifier can be used for tracking, auditing, and cross-service references.</p>
+     * @public
+     */
+    policyGenerationArn: string | undefined;
+    /**
+     * <p>The resource information associated with the policy generation. This provides context about the target resources for which the policies are being generated.</p>
+     * @public
+     */
+    resource: Resource | undefined;
+    /**
+     * <p>The timestamp when the policy generation request was created. This is used for tracking and auditing generation operations and their lifecycle.</p>
+     * @public
+     */
+    createdAt: Date | undefined;
+    /**
+     * <p>The timestamp when the policy generation was last updated. This tracks the progress of the generation process and any status changes.</p>
+     * @public
+     */
+    updatedAt: Date | undefined;
+    /**
+     * <p>The current status of the policy generation. This indicates whether the generation is in progress, completed successfully, or failed during processing.</p>
+     * @public
+     */
+    status: PolicyGenerationStatus | undefined;
+    /**
+     * <p>The findings and results from the policy generation process. This includes any issues, recommendations, validation results, or insights from the generated policies.</p>
+     * @public
+     */
+    findings?: string | undefined;
+    /**
+     * <p>Additional information about the generation status. This provides details about any failures, warnings, or the current state of the generation process.</p>
+     * @public
+     */
+    statusReasons: string[] | undefined;
+}
+/**
+ * @public
+ */
+export interface GetPolicyGenerationSummaryRequest {
+    /**
+     * <p>The unique identifier of the policy generation request to retrieve the summary for.</p>
+     * @public
+     */
+    policyGenerationId: string | undefined;
+    /**
+     * <p>The identifier of the policy engine associated with the policy generation request.</p>
+     * @public
+     */
+    policyEngineId: string | undefined;
+}
+/**
+ * @public
+ */
+export interface GetPolicyGenerationSummaryResponse {
+    /**
+     * <p>The identifier of the policy engine associated with this policy generation.</p>
+     * @public
+     */
+    policyEngineId: string | undefined;
+    /**
+     * <p>The unique identifier of the policy generation request.</p>
+     * @public
+     */
+    policyGenerationId: string | undefined;
+    /**
+     * <p>The customer-assigned name for the policy generation request.</p>
+     * @public
+     */
+    name: string | undefined;
+    /**
+     * <p>The Amazon Resource Name (ARN) of the policy generation request.</p>
+     * @public
+     */
+    policyGenerationArn: string | undefined;
+    /**
+     * <p>The resource information associated with the policy generation.</p>
+     * @public
+     */
+    resource: Resource | undefined;
+    /**
+     * <p>The timestamp when the policy generation request was created.</p>
+     * @public
+     */
+    createdAt: Date | undefined;
+    /**
+     * <p>The timestamp when the policy generation was last updated.</p>
+     * @public
+     */
+    updatedAt: Date | undefined;
+    /**
+     * <p>The current status of the policy generation request.</p>
+     * @public
+     */
+    status: PolicyGenerationStatus | undefined;
+    /**
+     * <p>The findings from the policy generation process, if available.</p>
+     * @public
+     */
+    findings?: string | undefined;
+}
+/**
+ * @public
+ */
+export interface ListPolicyGenerationAssetsRequest {
+    /**
+     * <p>The unique identifier of the policy generation request whose assets are to be retrieved. This must be a valid generation ID from a previous <a href="https://docs.aws.amazon.com/bedrock-agentcore-control/latest/APIReference/API_StartPolicyGeneration.html">StartPolicyGeneration</a> call that has completed processing.</p>
+     * @public
+     */
+    policyGenerationId: string | undefined;
+    /**
+     * <p>The unique identifier of the policy engine associated with the policy generation request. This provides the context for the generation operation and ensures assets are retrieved from the correct policy engine.</p>
+     * @public
+     */
+    policyEngineId: string | undefined;
+    /**
+     * <p>A pagination token returned from a previous <a href="https://docs.aws.amazon.com/bedrock-agentcore-control/latest/APIReference/API_ListPolicyGenerationAssets.html">ListPolicyGenerationAssets</a> call. Use this token to retrieve the next page of assets when the response is paginated due to large numbers of generated policy options.</p>
+     * @public
+     */
+    nextToken?: string | undefined;
+    /**
+     * <p>The maximum number of policy generation assets to return in a single response. If not specified, the default is 10 assets per page, with a maximum of 100 per page. This helps control response size when dealing with policy generations that produce many alternative policy options.</p>
+     * @public
+     */
+    maxResults?: number | undefined;
+}
+/**
+ * <p>Represents a Cedar policy statement within the AgentCore Policy system. Cedar is a policy language designed for authorization that provides human-readable, analyzable, and high-performance policy evaluation for controlling agent behavior and access decisions. </p>
+ * @public
+ */
+export interface CedarPolicy {
+    /**
+     * <p>The Cedar policy statement that defines the authorization logic. This statement follows Cedar syntax and specifies principals, actions, resources, and conditions that determine when access should be allowed or denied.</p>
+     * @public
+     */
+    statement: string | undefined;
+}
+/**
+ * <p>An AgentCore policy statement, which supports plain Cedar policies as well as guardrails definitions.</p>
+ * @public
+ */
+export interface PolicyStatement {
+    /**
+     * <p>The body of the AgentCore policy statement. Contains the policy logic, which can be a Cedar policy or a guardrails definition.</p>
+     * @public
+     */
+    statement: string | undefined;
+}
+/**
+ * <p>Represents the information identifying a generated policy asset from the AI-powered policy generation process within the AgentCore Policy system. Each asset contains a Cedar policy statement generated from natural language input, along with associated metadata and analysis findings to help users evaluate and select the most appropriate policy option.</p>
+ * @public
+ */
+export interface PolicyGenerationDetails {
+    /**
+     * <p>The unique identifier for this policy generation request.</p>
+     * @public
+     */
+    policyGenerationId: string | undefined;
+    /**
+     * <p>The unique identifier for this generated policy asset within the policy generation request.</p>
+     * @public
+     */
+    policyGenerationAssetId: string | undefined;
+}
+/**
+ * <p>Represents the definition structure for policies within the AgentCore Policy system. This structure encapsulates different policy formats and languages that can be used to define access control rules.</p>
+ * @public
+ */
+export type PolicyDefinition = PolicyDefinition.CedarMember | PolicyDefinition.PolicyMember | PolicyDefinition.PolicyGenerationMember | PolicyDefinition.$UnknownMember;
+/**
+ * @public
+ */
+export declare namespace PolicyDefinition {
+    /**
+     * <p>The Cedar policy definition within the policy definition structure. This contains the Cedar policy statement that defines the authorization logic using Cedar's human-readable, analyzable policy language. Cedar policies specify principals (who can access), actions (what operations are allowed), resources (what can be accessed), and optional conditions for fine-grained control. Cedar provides a formal policy language designed for authorization with deterministic evaluation, making policies testable, reviewable, and auditable. All Cedar policies follow a default-deny model where actions are denied unless explicitly permitted, and forbid policies always override permit policies.</p>
+     * @public
+     */
+    interface CedarMember {
+        cedar: CedarPolicy;
+        policyGeneration?: never;
+        policy?: never;
+        $unknown?: never;
+    }
+    /**
+     * <p>The generated policy asset information within the policy definition structure. This contains information identifying a generated policy asset from the AI-powered policy generation process within the AgentCore Policy system. Each asset contains a Cedar policy statement generated from natural language input, along with associated metadata and analysis findings to help users evaluate and select the most appropriate policy option.</p>
+     * @public
+     */
+    interface PolicyGenerationMember {
+        cedar?: never;
+        policyGeneration: PolicyGenerationDetails;
+        policy?: never;
+        $unknown?: never;
+    }
+    /**
+     * <p>An AgentCore policy statement that defines the access control rules. The statement can be a Cedar policy or a guardrails definition.</p>
+     * @public
+     */
+    interface PolicyMember {
+        cedar?: never;
+        policyGeneration?: never;
+        policy: PolicyStatement;
+        $unknown?: never;
+    }
+    /**
+     * @public
+     */
+    interface $UnknownMember {
+        cedar?: never;
+        policyGeneration?: never;
+        policy?: never;
+        $unknown: [string, any];
+    }
+    /**
+     * @deprecated unused in schema-serde mode.
+     *
+     */
+    interface Visitor<T> {
+        cedar: (value: CedarPolicy) => T;
+        policyGeneration: (value: PolicyGenerationDetails) => T;
+        policy: (value: PolicyStatement) => T;
+        _: (name: string, value: any) => T;
+    }
+}
+/**
+ * <p>Represents a finding or issue discovered during policy generation or validation. Findings provide insights about potential problems, recommendations, or validation results from policy analysis operations. Finding types include: VALID (policy is ready to use), INVALID (policy has validation errors that must be fixed), NOT_TRANSLATABLE (input couldn't be converted to policy), ALLOW_ALL (policy would allow all actions, potential security risk), ALLOW_NONE (policy would allow no actions, unusable), DENY_ALL (policy would deny all actions, may be too restrictive), and DENY_NONE (policy would deny no actions, ineffective). Review all findings before creating policies from generated assets to ensure they match your security requirements.</p>
+ * @public
+ */
+export interface Finding {
+    /**
+     * <p>The type or category of the finding. This classifies the finding as an error, warning, recommendation, or informational message to help users understand the severity and nature of the issue.</p>
+     * @public
+     */
+    type?: FindingType | undefined;
+    /**
+     * <p>A human-readable description of the finding. This provides detailed information about the issue, recommendation, or validation result to help users understand and address the finding. </p>
+     * @public
+     */
+    description?: string | undefined;
+}
+/**
+ * <p>Represents a generated policy asset from the AI-powered policy generation process within the AgentCore Policy system. Each asset contains a Cedar policy statement generated from natural language input, along with associated metadata and analysis findings to help users evaluate and select the most appropriate policy option.</p>
+ * @public
+ */
+export interface PolicyGenerationAsset {
+    /**
+     * <p>The unique identifier for this generated policy asset within the policy generation request. This ID can be used to reference specific generated policy options when creating actual policies from the generation results.</p>
+     * @public
+     */
+    policyGenerationAssetId: string | undefined;
+    /**
+     * <p>Represents the definition structure for policies within the AgentCore Policy system. This structure encapsulates different policy formats and languages that can be used to define access control rules.</p>
+     * @public
+     */
+    definition?: PolicyDefinition | undefined;
+    /**
+     * <p>The portion of the original natural language input that this generated policy asset addresses. This helps users understand which part of their policy description was translated into this specific Cedar policy statement, enabling better policy selection and refinement. When a single natural language input describes multiple authorization requirements, the generation process creates separate policy assets for each requirement, with each asset's rawTextFragment showing which requirement it addresses. Use this mapping to verify that all parts of your natural language input were correctly translated into Cedar policies.</p>
+     * @public
+     */
+    rawTextFragment: string | undefined;
+    /**
+     * <p>Analysis findings and insights related to this specific generated policy asset. These findings may include validation results, potential issues, or recommendations for improvement to help users evaluate the quality and appropriateness of the generated policy.</p>
+     * @public
+     */
+    findings: Finding[] | undefined;
+}
+/**
+ * @public
+ */
+export interface ListPolicyGenerationAssetsResponse {
+    /**
+     * <p>An array of generated policy assets including Cedar policies and related artifacts from the AI-powered policy generation process. Each asset represents a different policy option or variation generated from the original natural language input.</p>
+     * @public
+     */
+    policyGenerationAssets?: PolicyGenerationAsset[] | undefined;
+    /**
+     * <p>A pagination token that can be used in subsequent <a href="https://docs.aws.amazon.com/bedrock-agentcore-control/latest/APIReference/API_ListPolicyGenerationAssets.html">ListPolicyGenerationAssets</a> calls to retrieve additional assets. This token is only present when there are more generated policy assets available beyond the current response.</p>
+     * @public
+     */
+    nextToken?: string | undefined;
+}
+/**
+ * @public
+ */
+export interface ListPolicyGenerationsRequest {
+    /**
+     * <p>A pagination token for retrieving additional policy generations when results are paginated.</p>
+     * @public
+     */
+    nextToken?: string | undefined;
+    /**
+     * <p>The maximum number of policy generations to return in a single response.</p>
+     * @public
+     */
+    maxResults?: number | undefined;
+    /**
+     * <p>The identifier of the policy engine whose policy generations to retrieve.</p>
+     * @public
+     */
+    policyEngineId: string | undefined;
+}
+/**
+ * <p>Represents a policy generation request within the AgentCore Policy system. Tracks the AI-powered conversion of natural language descriptions into Cedar policy statements, enabling users to author policies by describing authorization requirements in plain English. The generation process analyzes the natural language input along with the Gateway's tool context and Cedar schema to produce one or more validated policy options. Each generation request tracks the status of the conversion process and maintains findings about the generated policies, including validation results and potential issues. Generated policy assets remain available for one week after successful generation, allowing time to review and create policies from the generated options.</p>
+ * @public
+ */
+export interface PolicyGeneration {
+    /**
+     * <p>The identifier of the policy engine associated with this generation request.</p>
+     * @public
+     */
+    policyEngineId: string | undefined;
+    /**
+     * <p>The unique identifier for this policy generation request.</p>
+     * @public
+     */
+    policyGenerationId: string | undefined;
+    /**
+     * <p>The customer-assigned name for this policy generation request.</p>
+     * @public
+     */
+    name: string | undefined;
+    /**
+     * <p>The ARN of this policy generation request.</p>
+     * @public
+     */
+    policyGenerationArn: string | undefined;
+    /**
+     * <p>The resource information associated with this policy generation.</p>
+     * @public
+     */
+    resource: Resource | undefined;
+    /**
+     * <p>The timestamp when this policy generation request was created.</p>
+     * @public
+     */
+    createdAt: Date | undefined;
+    /**
+     * <p>The timestamp when this policy generation was last updated.</p>
+     * @public
+     */
+    updatedAt: Date | undefined;
+    /**
+     * <p>The current status of this policy generation request.</p>
+     * @public
+     */
+    status: PolicyGenerationStatus | undefined;
+    /**
+     * <p>Findings and insights from this policy generation process.</p>
+     * @public
+     */
+    findings?: string | undefined;
+    /**
+     * <p>Additional information about the generation status.</p>
+     * @public
+     */
+    statusReasons: string[] | undefined;
+}
+/**
+ * @public
+ */
+export interface ListPolicyGenerationsResponse {
+    /**
+     * <p>An array of policy generation objects that match the specified criteria.</p>
+     * @public
+     */
+    policyGenerations: PolicyGeneration[] | undefined;
+    /**
+     * <p>A pagination token for retrieving additional policy generations if more results are available.</p>
+     * @public
+     */
+    nextToken?: string | undefined;
+}
+/**
+ * @public
+ */
+export interface ListPolicyGenerationSummariesRequest {
+    /**
+     * <p>A pagination token returned from a previous <a href="https://docs.aws.amazon.com/bedrock-agentcore-control/latest/APIReference/API_ListPolicyGenerationSummaries.html">ListPolicyGenerationSummaries</a> call. Use this token to retrieve the next page of results when the response is paginated.</p>
+     * @public
+     */
+    nextToken?: string | undefined;
+    /**
+     * <p>The maximum number of policy generation summaries to return in a single response.</p>
+     * @public
+     */
+    maxResults?: number | undefined;
+    /**
+     * <p>The identifier of the policy engine whose policy generation summaries to retrieve.</p>
+     * @public
+     */
+    policyEngineId: string | undefined;
+}
+/**
+ * <p>Represents a metadata-only summary of a policy generation resource. This structure contains resource identifiers, status, timestamps, and findings without customer-encrypted fields such as status reasons. Policy generation summaries are returned by operations that do not require access to the customer's KMS key.</p>
+ * @public
+ */
+export interface PolicyGenerationSummary {
+    /**
+     * <p>The identifier of the policy engine associated with this generation request.</p>
+     * @public
+     */
+    policyEngineId: string | undefined;
+    /**
+     * <p>The unique identifier for this policy generation request.</p>
+     * @public
+     */
+    policyGenerationId: string | undefined;
+    /**
+     * <p>The customer-assigned name for this policy generation request.</p>
+     * @public
+     */
+    name: string | undefined;
+    /**
+     * <p>The ARN of this policy generation request.</p>
+     * @public
+     */
+    policyGenerationArn: string | undefined;
+    /**
+     * <p>The resource information associated with this policy generation.</p>
+     * @public
+     */
+    resource: Resource | undefined;
+    /**
+     * <p>The timestamp when this policy generation request was created.</p>
+     * @public
+     */
+    createdAt: Date | undefined;
+    /**
+     * <p>The timestamp when this policy generation was last updated.</p>
+     * @public
+     */
+    updatedAt: Date | undefined;
+    /**
+     * <p>The current status of this policy generation request.</p>
+     * @public
+     */
+    status: PolicyGenerationStatus | undefined;
+    /**
+     * <p>Findings and insights from this policy generation process.</p>
+     * @public
+     */
+    findings?: string | undefined;
+}
+/**
+ * @public
+ */
+export interface ListPolicyGenerationSummariesResponse {
+    /**
+     * <p>An array of policy generation summary objects that match the specified criteria. Each summary contains resource identifiers, status, timestamps, and findings without customer-encrypted content.</p>
+     * @public
+     */
+    policyGenerations: PolicyGenerationSummary[] | undefined;
+    /**
+     * <p>A pagination token that can be used in subsequent <a href="https://docs.aws.amazon.com/bedrock-agentcore-control/latest/APIReference/API_ListPolicyGenerationSummaries.html">ListPolicyGenerationSummaries</a> calls to retrieve additional results. This token is only present when there are more results available.</p>
+     * @public
+     */
+    nextToken?: string | undefined;
+}
+/**
+ * <p>Represents content input for policy generation operations. This structure encapsulates the natural language descriptions or other content formats that are used as input for AI-powered policy generation.</p>
+ * @public
+ */
+export type Content = Content.RawTextMember | Content.$UnknownMember;
+/**
+ * @public
+ */
+export declare namespace Content {
+    /**
+     * <p>The raw text content containing natural language descriptions of desired policy behavior. This text is processed by AI to generate corresponding Cedar policy statements that match the described intent.</p>
+     * @public
+     */
+    interface RawTextMember {
+        rawText: string;
+        $unknown?: never;
+    }
+    /**
+     * @public
+     */
+    interface $UnknownMember {
+        rawText?: never;
+        $unknown: [string, any];
+    }
+    /**
+     * @deprecated unused in schema-serde mode.
+     *
+     */
+    interface Visitor<T> {
+        rawText: (value: string) => T;
+        _: (name: string, value: any) => T;
+    }
+}
+/**
+ * @public
+ */
+export interface StartPolicyGenerationRequest {
+    /**
+     * <p>The identifier of the policy engine that provides the context for policy generation. This engine's schema and tool context are used to ensure generated policies are valid and applicable.</p>
+     * @public
+     */
+    policyEngineId: string | undefined;
+    /**
+     * <p>The resource information that provides context for policy generation. This helps the AI understand the target resources and generate appropriate access control rules.</p>
+     * @public
+     */
+    resource: Resource | undefined;
+    /**
+     * <p>The natural language description of the desired policy behavior. This content is processed by AI to generate corresponding Cedar policy statements that match the described intent.</p>
+     * @public
+     */
+    content: Content | undefined;
+    /**
+     * <p>A customer-assigned name for the policy generation request. This helps track and identify generation operations, especially when running multiple generations simultaneously.</p>
+     * @public
+     */
+    name: string | undefined;
+    /**
+     * <p>A unique, case-sensitive identifier to ensure the idempotency of the request. The AWS SDK automatically generates this token, so you don't need to provide it in most cases. If you retry a request with the same client token, the service returns the same response without starting a duplicate generation.</p>
+     * @public
+     */
+    clientToken?: string | undefined;
+}
+/**
+ * @public
+ */
+export interface StartPolicyGenerationResponse {
+    /**
+     * <p>The identifier of the policy engine associated with the started policy generation. </p>
+     * @public
+     */
+    policyEngineId: string | undefined;
+    /**
+     * <p>The unique identifier assigned to the policy generation request for tracking progress. </p>
+     * @public
+     */
+    policyGenerationId: string | undefined;
+    /**
+     * <p>The customer-assigned name for the policy generation request.</p>
+     * @public
+     */
+    name: string | undefined;
+    /**
+     * <p>The ARN of the created policy generation request.</p>
+     * @public
+     */
+    policyGenerationArn: string | undefined;
+    /**
+     * <p>The resource information associated with the policy generation request.</p>
+     * @public
+     */
+    resource: Resource | undefined;
+    /**
+     * <p>The timestamp when the policy generation request was created.</p>
+     * @public
+     */
+    createdAt: Date | undefined;
+    /**
+     * <p>The timestamp when the policy generation was last updated.</p>
+     * @public
+     */
+    updatedAt: Date | undefined;
+    /**
+     * <p>The initial status of the policy generation request.</p>
+     * @public
+     */
+    status: PolicyGenerationStatus | undefined;
+    /**
+     * <p>Initial findings from the policy generation process.</p>
+     * @public
+     */
+    findings?: string | undefined;
+    /**
+     * <p>Additional information about the generation status.</p>
+     * @public
+     */
+    statusReasons: string[] | undefined;
+}
+/**
+ * @public
+ */
+export interface CreatePolicyRequest {
+    /**
+     * <p>The customer-assigned immutable name for the policy. Must be unique within the account. This name is used for policy identification and cannot be changed after creation.</p>
+     * @public
+     */
+    name: string | undefined;
+    /**
+     * <p>The Cedar policy statement that defines the access control rules. This contains the actual policy logic written in Cedar policy language, specifying effect (permit or forbid), principals, actions, resources, and conditions for agent behavior control.</p>
+     * @public
+     */
+    definition: PolicyDefinition | undefined;
+    /**
+     * <p>A human-readable description of the policy's purpose and functionality (1-4,096 characters). This helps policy administrators understand the policy's intent, business rules, and operational scope. Use this field to document why the policy exists, what business requirement it addresses, and any special considerations for maintenance. Clear descriptions are essential for policy governance, auditing, and troubleshooting.</p>
+     * @public
+     */
+    description?: string | undefined;
+    /**
+     * <p>The validation mode for the policy creation. Determines how Cedar analyzer validation results are handled during policy creation. FAIL_ON_ANY_FINDINGS (default) runs the Cedar analyzer to validate the policy against the Cedar schema and tool context, failing creation if the analyzer detects any validation issues to ensure strict conformance. IGNORE_ALL_FINDINGS runs the Cedar analyzer but allows policy creation even if validation issues are detected, useful for testing or when the policy schema is evolving. Use FAIL_ON_ANY_FINDINGS for production policies to ensure correctness, and IGNORE_ALL_FINDINGS only when you understand and accept the analyzer findings.</p>
+     * @public
+     */
+    validationMode?: PolicyValidationMode | undefined;
+    /**
+     * <p>The enforcement mode for the policy. Run this policy in <code>LOG_ONLY</code> mode to collect data on how it affects your application. Once you are satisfied with the data gathered, switch the policy to <code>ACTIVE</code>. Defaults to <code>ACTIVE</code>.</p>
+     * @public
+     */
+    enforcementMode?: EnforcementMode | undefined;
+    /**
+     * <p>The identifier of the policy engine which contains this policy. Policy engines group related policies and provide the execution context for policy evaluation.</p>
+     * @public
+     */
+    policyEngineId: string | undefined;
+    /**
+     * <p>A unique, case-sensitive identifier to ensure the idempotency of the request. The AWS SDK automatically generates this token, so you don't need to provide it in most cases. If you retry a request with the same client token, the service returns the same response without creating a duplicate policy.</p>
+     * @public
+     */
+    clientToken?: string | undefined;
+}
+/**
+ * @public
+ */
+export interface CreatePolicyResponse {
+    /**
+     * <p>The unique identifier for the created policy. This is a system-generated identifier consisting of the user name plus a 10-character generated suffix, used for all subsequent policy operations.</p>
+     * @public
+     */
+    policyId: string | undefined;
+    /**
+     * <p>The customer-assigned name of the created policy. This matches the name provided in the request and serves as the human-readable identifier for the policy.</p>
+     * @public
+     */
+    name: string | undefined;
+    /**
+     * <p>The identifier of the policy engine that manages this policy. This confirms the policy engine assignment and is used for policy evaluation routing.</p>
+     * @public
+     */
+    policyEngineId: string | undefined;
+    /**
+     * <p>The timestamp when the policy was created. This is automatically set by the service and used for auditing and lifecycle management.</p>
+     * @public
+     */
+    createdAt: Date | undefined;
+    /**
+     * <p>The timestamp when the policy was last updated. For newly created policies, this matches the createdAt timestamp.</p>
+     * @public
+     */
+    updatedAt: Date | undefined;
+    /**
+     * <p>The Amazon Resource Name (ARN) of the created policy. This globally unique identifier can be used for cross-service references and IAM policy statements.</p>
+     * @public
+     */
+    policyArn: string | undefined;
+    /**
+     * <p>The current status of the policy. A status of <code>ACTIVE</code> indicates the policy is ready for use.</p>
+     * @public
+     */
+    status: PolicyStatus | undefined;
+    /**
+     * <p>The enforcement mode of the created policy.</p>
+     * @public
+     */
+    enforcementMode?: EnforcementMode | undefined;
+    /**
+     * <p>The Cedar policy statement that was created. This is the validated policy definition that will be used for agent behavior control and access decisions.</p>
+     * @public
+     */
+    definition: PolicyDefinition | undefined;
+    /**
+     * <p>The human-readable description of the policy's purpose and functionality. This helps administrators understand and manage the policy.</p>
+     * @public
+     */
+    description?: string | undefined;
+    /**
+     * <p>Additional information about the policy status. This provides details about any failures or the current state of the policy creation process.</p>
+     * @public
+     */
+    statusReasons: string[] | undefined;
+}
+/**
+ * @public
+ */
+export interface DeletePolicyRequest {
+    /**
+     * <p>The identifier of the policy engine that manages the policy to be deleted. This ensures the policy is deleted from the correct policy engine context.</p>
+     * @public
+     */
+    policyEngineId: string | undefined;
+    /**
+     * <p>The unique identifier of the policy to be deleted. This must be a valid policy ID that exists within the specified policy engine.</p>
+     * @public
+     */
+    policyId: string | undefined;
+}
+/**
+ * @public
+ */
+export interface DeletePolicyResponse {
+    /**
+     * <p>The unique identifier of the policy being deleted. This confirms which policy the deletion operation targets.</p>
+     * @public
+     */
+    policyId: string | undefined;
+    /**
+     * <p>The customer-assigned name of the deleted policy. This confirms which policy was successfully removed from the system and matches the name that was originally assigned during policy creation.</p>
+     * @public
+     */
+    name: string | undefined;
+    /**
+     * <p>The identifier of the policy engine from which the policy was deleted. This confirms the policy engine context for the deletion operation.</p>
+     * @public
+     */
+    policyEngineId: string | undefined;
+    /**
+     * <p>The timestamp when the deleted policy was originally created.</p>
+     * @public
+     */
+    createdAt: Date | undefined;
+    /**
+     * <p>The timestamp when the deleted policy was last modified before deletion. This tracks the final state of the policy before it was removed from the system.</p>
+     * @public
+     */
+    updatedAt: Date | undefined;
+    /**
+     * <p>The Amazon Resource Name (ARN) of the deleted policy. This globally unique identifier confirms which policy resource was successfully removed.</p>
+     * @public
+     */
+    policyArn: string | undefined;
+    /**
+     * <p>The status of the policy deletion operation. This provides information about any issues that occurred during the deletion process.</p>
+     * @public
+     */
+    status: PolicyStatus | undefined;
+    /**
+     * <p>The enforcement mode of the deleted policy.</p>
+     * @public
+     */
+    enforcementMode?: EnforcementMode | undefined;
+    /**
+     * <p>Represents the definition structure for policies within the AgentCore Policy system. This structure encapsulates different policy formats and languages that can be used to define access control rules.</p>
+     * @public
+     */
+    definition: PolicyDefinition | undefined;
+    /**
+     * <p>The human-readable description of the deleted policy.</p>
+     * @public
+     */
+    description?: string | undefined;
+    /**
+     * <p>Additional information about the deletion status. This provides details about the deletion process or any issues that may have occurred.</p>
+     * @public
+     */
+    statusReasons: string[] | undefined;
+}
+/**
+ * @public
+ */
+export interface GetPolicyRequest {
+    /**
+     * <p>The identifier of the policy engine that manages the policy to be retrieved.</p>
+     * @public
+     */
+    policyEngineId: string | undefined;
+    /**
+     * <p>The unique identifier of the policy to be retrieved. This must be a valid policy ID that exists within the specified policy engine.</p>
+     * @public
+     */
+    policyId: string | undefined;
+}
+/**
+ * @public
+ */
+export interface GetPolicyResponse {
+    /**
+     * <p>The unique identifier of the retrieved policy. This matches the policy ID provided in the request and serves as the system identifier for the policy.</p>
+     * @public
+     */
+    policyId: string | undefined;
+    /**
+     * <p>The customer-assigned name of the policy. This is the human-readable identifier that was specified when the policy was created.</p>
+     * @public
+     */
+    name: string | undefined;
+    /**
+     * <p>The identifier of the policy engine that manages this policy. This confirms the policy engine context for the retrieved policy.</p>
+     * @public
+     */
+    policyEngineId: string | undefined;
+    /**
+     * <p>The timestamp when the policy was originally created.</p>
+     * @public
+     */
+    createdAt: Date | undefined;
+    /**
+     * <p>The timestamp when the policy was last modified. This tracks the most recent changes to the policy configuration.</p>
+     * @public
+     */
+    updatedAt: Date | undefined;
+    /**
+     * <p>The Amazon Resource Name (ARN) of the policy. This globally unique identifier can be used for cross-service references and IAM policy statements.</p>
+     * @public
+     */
+    policyArn: string | undefined;
+    /**
+     * <p>The current status of the policy.</p>
+     * @public
+     */
+    status: PolicyStatus | undefined;
+    /**
+     * <p>The current enforcement mode of the policy.</p>
+     * @public
+     */
+    enforcementMode?: EnforcementMode | undefined;
+    /**
+     * <p>The Cedar policy statement that defines the access control rules. This contains the actual policy logic used for agent behavior control and access decisions.</p>
+     * @public
+     */
+    definition: PolicyDefinition | undefined;
+    /**
+     * <p>The human-readable description of the policy's purpose and functionality. This helps administrators understand and manage the policy.</p>
+     * @public
+     */
+    description?: string | undefined;
+    /**
+     * <p>Additional information about the policy status. This provides details about any failures or the current state of the policy.</p>
+     * @public
+     */
+    statusReasons: string[] | undefined;
+}
+/**
+ * @public
+ */
+export interface GetPolicySummaryRequest {
+    /**
+     * <p>The identifier of the policy engine that manages the policy to retrieve the summary for.</p>
+     * @public
+     */
+    policyEngineId: string | undefined;
+    /**
+     * <p>The unique identifier of the policy to retrieve the summary for. This must be a valid policy ID that exists within the specified policy engine.</p>
+     * @public
+     */
+    policyId: string | undefined;
+}
+/**
+ * @public
+ */
+export interface GetPolicySummaryResponse {
+    /**
+     * <p>The unique identifier of the policy.</p>
+     * @public
+     */
+    policyId: string | undefined;
+    /**
+     * <p>The customer-assigned name of the policy.</p>
+     * @public
+     */
+    name: string | undefined;
+    /**
+     * <p>The identifier of the policy engine that manages this policy.</p>
+     * @public
+     */
+    policyEngineId: string | undefined;
+    /**
+     * <p>The timestamp when the policy was originally created.</p>
+     * @public
+     */
+    createdAt: Date | undefined;
+    /**
+     * <p>The timestamp when the policy was last modified.</p>
+     * @public
+     */
+    updatedAt: Date | undefined;
+    /**
+     * <p>The Amazon Resource Name (ARN) of the policy.</p>
+     * @public
+     */
+    policyArn: string | undefined;
+    /**
+     * <p>The current status of the policy.</p>
+     * @public
+     */
+    status: PolicyStatus | undefined;
+    /**
+     * <p>The current enforcement mode of the policy.</p>
+     * @public
+     */
+    enforcementMode?: EnforcementMode | undefined;
+}
+/**
+ * @public
+ */
+export interface ListPoliciesRequest {
+    /**
+     * <p>A pagination token returned from a previous <a href="https://docs.aws.amazon.com/bedrock-agentcore-control/latest/APIReference/API_ListPolicies.html">ListPolicies</a> call. Use this token to retrieve the next page of results when the response is paginated.</p>
+     * @public
+     */
+    nextToken?: string | undefined;
+    /**
+     * <p>The maximum number of policies to return in a single response. If not specified, the default is 10 policies per page, with a maximum of 100 per page.</p>
+     * @public
+     */
+    maxResults?: number | undefined;
+    /**
+     * <p>The identifier of the policy engine whose policies to retrieve.</p>
+     * @public
+     */
+    policyEngineId: string | undefined;
+    /**
+     * <p>Optional filter to list policies that apply to a specific resource scope or resource type. This helps narrow down policy results to those relevant for particular Amazon Web Services resources, agent tools, or operational contexts within the policy engine ecosystem.</p>
+     * @public
+     */
+    targetResourceScope?: string | undefined;
+}
+/**
+ * <p>Represents a complete policy resource within the AgentCore Policy system. Policies are ARN-able resources that contain Cedar policy statements and associated metadata for controlling agent behavior and access decisions. Each policy belongs to a policy engine and defines fine-grained authorization rules that are evaluated in real-time as agents interact with tools through Gateway. Policies use the Cedar policy language to specify who (principals based on OAuth claims like username, role, or scope) can perform what actions (tool calls) on which resources (Gateways), with optional conditions for attribute-based access control. Multiple policies can apply to a single request, with Cedar's forbid-wins semantics ensuring that security restrictions are never accidentally overridden.</p>
+ * @public
+ */
+export interface Policy {
+    /**
+     * <p>The unique identifier for the policy. This system-generated identifier consists of the user name plus a 10-character generated suffix and serves as the primary key for policy operations.</p>
+     * @public
+     */
+    policyId: string | undefined;
+    /**
+     * <p>The customer-assigned immutable name for the policy. This human-readable identifier must be unique within the account and cannot exceed 48 characters.</p>
+     * @public
+     */
+    name: string | undefined;
+    /**
+     * <p>The identifier of the policy engine that manages this policy. This establishes the policy engine context for policy evaluation and management.</p>
+     * @public
+     */
+    policyEngineId: string | undefined;
+    /**
+     * <p>The timestamp when the policy was originally created. This is automatically set by the service and used for auditing and lifecycle management.</p>
+     * @public
+     */
+    createdAt: Date | undefined;
+    /**
+     * <p>The timestamp when the policy was last modified. This tracks the most recent changes to the policy configuration or metadata.</p>
+     * @public
+     */
+    updatedAt: Date | undefined;
+    /**
+     * <p>The Amazon Resource Name (ARN) of the policy. This globally unique identifier can be used for cross-service references and IAM policy statements.</p>
+     * @public
+     */
+    policyArn: string | undefined;
+    /**
+     * <p>The current status of the policy.</p>
+     * @public
+     */
+    status: PolicyStatus | undefined;
+    /**
+     * <p>The current enforcement mode of the policy.</p>
+     * @public
+     */
+    enforcementMode?: EnforcementMode | undefined;
+    /**
+     * <p>The Cedar policy statement that defines the access control rules. This contains the actual policy logic used for agent behavior control and access decisions.</p>
+     * @public
+     */
+    definition: PolicyDefinition | undefined;
+    /**
+     * <p>A human-readable description of the policy's purpose and functionality. Limited to 4,096 characters, this helps administrators understand and manage the policy.</p>
+     * @public
+     */
+    description?: string | undefined;
+    /**
+     * <p>Additional information about the policy status. This provides details about any failures or the current state of the policy lifecycle.</p>
+     * @public
+     */
+    statusReasons: string[] | undefined;
+}
+/**
+ * @public
+ */
+export interface ListPoliciesResponse {
+    /**
+     * <p>An array of policy objects that match the specified criteria. Each policy object contains the policy metadata, status, and key identifiers for further operations.</p>
+     * @public
+     */
+    policies: Policy[] | undefined;
+    /**
+     * <p>A pagination token that can be used in subsequent ListPolicies calls to retrieve additional results. This token is only present when there are more results available.</p>
+     * @public
+     */
+    nextToken?: string | undefined;
+}
+/**
+ * @public
+ */
+export interface ListPolicySummariesRequest {
+    /**
+     * <p>A pagination token returned from a previous <a href="https://docs.aws.amazon.com/bedrock-agentcore-control/latest/APIReference/API_ListPolicySummaries.html">ListPolicySummaries</a> call. Use this token to retrieve the next page of results when the response is paginated.</p>
+     * @public
+     */
+    nextToken?: string | undefined;
+    /**
+     * <p>The maximum number of policy summaries to return in a single response.</p>
+     * @public
+     */
+    maxResults?: number | undefined;
+    /**
+     * <p>The identifier of the policy engine whose policy summaries to retrieve.</p>
+     * @public
+     */
+    policyEngineId: string | undefined;
+    /**
+     * <p>Optional filter to list policy summaries that apply to a specific resource scope or resource type. This helps narrow down results to those relevant for particular Amazon Web Services resources, agent tools, or operational contexts within the policy engine ecosystem.</p>
+     * @public
+     */
+    targetResourceScope?: string | undefined;
+}
+/**
+ * <p>Represents a metadata-only summary of a policy resource. This structure contains resource identifiers, status, and timestamps without customer-encrypted fields such as definition, description, or status reasons. Policy summaries are returned by operations that do not require access to the customer's KMS key.</p>
+ * @public
+ */
+export interface PolicySummary {
+    /**
+     * <p>The unique identifier for the policy.</p>
+     * @public
+     */
+    policyId: string | undefined;
+    /**
+     * <p>The customer-assigned name of the policy.</p>
+     * @public
+     */
+    name: string | undefined;
+    /**
+     * <p>The identifier of the policy engine that manages this policy.</p>
+     * @public
+     */
+    policyEngineId: string | undefined;
+    /**
+     * <p>The timestamp when the policy was originally created.</p>
+     * @public
+     */
+    createdAt: Date | undefined;
+    /**
+     * <p>The timestamp when the policy was last modified.</p>
+     * @public
+     */
+    updatedAt: Date | undefined;
+    /**
+     * <p>The Amazon Resource Name (ARN) of the policy.</p>
+     * @public
+     */
+    policyArn: string | undefined;
+    /**
+     * <p>The current status of the policy.</p>
+     * @public
+     */
+    status: PolicyStatus | undefined;
+    /**
+     * <p>The current enforcement mode of the policy.</p>
+     * @public
+     */
+    enforcementMode?: EnforcementMode | undefined;
+}
+/**
+ * @public
+ */
+export interface ListPolicySummariesResponse {
+    /**
+     * <p>An array of policy summary objects that match the specified criteria. Each summary contains resource identifiers, status, and timestamps without customer-encrypted content.</p>
+     * @public
+     */
+    policies: PolicySummary[] | undefined;
+    /**
+     * <p>A pagination token that can be used in subsequent <a href="https://docs.aws.amazon.com/bedrock-agentcore-control/latest/APIReference/API_ListPolicySummaries.html">ListPolicySummaries</a> calls to retrieve additional results. This token is only present when there are more results available.</p>
+     * @public
+     */
+    nextToken?: string | undefined;
+}
+/**
+ * @public
+ */
+export interface UpdatePolicyRequest {
+    /**
+     * <p>The identifier of the policy engine that manages the policy to be updated. This ensures the policy is updated within the correct policy engine context.</p>
+     * @public
+     */
+    policyEngineId: string | undefined;
+    /**
+     * <p>The unique identifier of the policy to be updated. This must be a valid policy ID that exists within the specified policy engine.</p>
+     * @public
+     */
+    policyId: string | undefined;
+    /**
+     * <p>The new human-readable description for the policy. This optional field allows updating the policy's documentation while keeping the same policy logic.</p>
+     * @public
+     */
+    description?: UpdatedDescription | undefined;
+    /**
+     * <p>The new Cedar policy statement that defines the access control rules. This replaces the existing policy definition with new logic while maintaining the policy's identity.</p>
+     * @public
+     */
+    definition?: PolicyDefinition | undefined;
+    /**
+     * <p>The validation mode for the policy update. Determines how Cedar analyzer validation results are handled during policy updates. FAIL_ON_ANY_FINDINGS runs the Cedar analyzer and fails the update if validation issues are detected, ensuring the policy conforms to the Cedar schema and tool context. IGNORE_ALL_FINDINGS runs the Cedar analyzer but allows updates despite validation warnings. Use FAIL_ON_ANY_FINDINGS to ensure policy correctness during updates, especially when modifying policy logic or conditions.</p>
+     * @public
+     */
+    validationMode?: PolicyValidationMode | undefined;
+    /**
+     * <p>The enforcement mode for the policy. Run this policy in <code>LOG_ONLY</code> mode to collect data on how it affects your application. Once you are satisfied with the data gathered, switch the policy to <code>ACTIVE</code>. If you omit this field, the policy's existing enforcement mode is unchanged.</p>
+     * @public
+     */
+    enforcementMode?: EnforcementMode | undefined;
+}
+/**
+ * @public
+ */
+export interface UpdatePolicyResponse {
+    /**
+     * <p>The unique identifier of the updated policy.</p>
+     * @public
+     */
+    policyId: string | undefined;
+    /**
+     * <p>The name of the updated policy.</p>
+     * @public
+     */
+    name: string | undefined;
+    /**
+     * <p>The identifier of the policy engine managing the updated policy.</p>
+     * @public
+     */
+    policyEngineId: string | undefined;
+    /**
+     * <p>The original creation timestamp of the policy.</p>
+     * @public
+     */
+    createdAt: Date | undefined;
+    /**
+     * <p>The timestamp when the policy was last updated.</p>
+     * @public
+     */
+    updatedAt: Date | undefined;
+    /**
+     * <p>The ARN of the updated policy.</p>
+     * @public
+     */
+    policyArn: string | undefined;
+    /**
+     * <p>The current status of the updated policy.</p>
+     * @public
+     */
+    status: PolicyStatus | undefined;
+    /**
+     * <p>The current enforcement mode of the updated policy.</p>
+     * @public
+     */
+    enforcementMode?: EnforcementMode | undefined;
+    /**
+     * <p>The updated Cedar policy statement.</p>
+     * @public
+     */
+    definition: PolicyDefinition | undefined;
+    /**
+     * <p>The updated description of the policy.</p>
+     * @public
+     */
+    description?: string | undefined;
+    /**
+     * <p>Additional information about the update status.</p>
+     * @public
+     */
+    statusReasons: string[] | undefined;
+}
+/**
+ * @public
+ */
+export interface PutResourcePolicyRequest {
+    /**
+     * <p>The Amazon Resource Name (ARN) of the resource for which to create or update the resource policy.</p>
+     * @public
+     */
+    resourceArn: string | undefined;
+    /**
+     * <p>The resource policy to create or update.</p>
+     * @public
+     */
+    policy: string | undefined;
+}
+/**
+ * @public
+ */
+export interface PutResourcePolicyResponse {
+    /**
+     * <p>The resource policy that was created or updated.</p>
+     * @public
+     */
+    policy: string | undefined;
+}
+/**
+ * <p>A custom descriptor for a registry record. Use this for resources such as APIs, Lambda functions, or servers that do not conform to a standard protocol like MCP or A2A.</p>
+ * @public
+ */
+export interface CustomDescriptor {
+    /**
+     * <p>The custom descriptor content as a valid JSON document. You can define any custom schema that describes your resource.</p>
+     * @public
+     */
+    inlineContent?: string | undefined;
+}
+/**
+ * <p>The server definition for an MCP descriptor. Contains the schema version and inline content for the MCP server configuration.</p>
+ * @public
+ */
+export interface ServerDefinition {
+    /**
+     * <p>The schema version of the server definition based on the MCP protocol specification. If not specified, the version is auto-detected from the content.</p>
+     * @public
+     */
+    schemaVersion?: string | undefined;
+    /**
+     * <p>The JSON content containing the MCP server definition, conforming to the MCP protocol specification.</p>
+     * @public
+     */
+    inlineContent?: string | undefined;
+}
+/**
+ * <p>The tools definition for an MCP descriptor. Contains the protocol version and inline content describing the available tools.</p>
+ * @public
+ */
+export interface ToolsDefinition {
+    /**
+     * <p>The protocol version of the tools definition based on the MCP protocol specification. If not specified, the version is auto-detected from the content.</p>
+     * @public
+     */
+    protocolVersion?: string | undefined;
+    /**
+     * <p>The JSON content containing the MCP tools definition, conforming to the MCP protocol specification.</p>
+     * @public
+     */
+    inlineContent?: string | undefined;
+}
+/**
+ * <p>The Model Context Protocol (MCP) descriptor for a registry record. Contains the server definition and tools definition for an MCP-compatible server. The schema is validated against the MCP protocol specification.</p>
+ * @public
+ */
+export interface McpDescriptor {
+    /**
+     * <p>The MCP server definition, containing the server configuration and schema as defined by the MCP protocol specification.</p>
+     * @public
+     */
+    server?: ServerDefinition | undefined;
+    /**
+     * <p>The MCP tools definition, containing the tools available on the MCP server as defined by the MCP protocol specification.</p>
+     * @public
+     */
+    tools?: ToolsDefinition | undefined;
+}
+/**
+ * <p>Contains descriptor-type-specific configurations for a registry record. Only the descriptor matching the record's <code>descriptorType</code> should be populated.</p>
+ * @public
+ */
+export interface Descriptors {
+    /**
+     * <p>The Model Context Protocol (MCP) descriptor configuration. Use this when the <code>descriptorType</code> is <code>MCP</code>.</p>
+     * @public
+     */
+    mcp?: McpDescriptor | undefined;
+    /**
+     * <p>The Agent-to-Agent (A2A) protocol descriptor configuration. Use this when the <code>descriptorType</code> is <code>A2A</code>.</p>
+     * @public
+     */
+    a2a?: A2aDescriptor | undefined;
+    /**
+     * <p>The custom descriptor configuration. Use this when the <code>descriptorType</code> is <code>CUSTOM</code>.</p>
+     * @public
+     */
+    custom?: CustomDescriptor | undefined;
+    /**
+     * <p>The agent skills descriptor configuration. Use this when the <code>descriptorType</code> is <code>AGENT_SKILLS</code>.</p>
+     * @public
+     */
+    agentSkills?: AgentSkillsDescriptor | undefined;
+}
+/**
+ * <p>IAM credential provider configuration for authenticating with an external source using SigV4 signing during synchronization.</p>
+ * @public
+ */
+export interface RegistryRecordIamCredentialProvider {
+    /**
+     * <p>The Amazon Resource Name (ARN) of the IAM role to assume for SigV4 signing.</p>
+     * @public
+     */
+    roleArn?: string | undefined;
+    /**
+     * <p>The SigV4 signing service name (for example, <code>execute-api</code> or <code>bedrock-agentcore</code>).</p>
+     * @public
+     */
+    service?: string | undefined;
+    /**
+     * <p>The Amazon Web Services region for SigV4 signing (for example, <code>us-west-2</code>). If not specified, the region is extracted from the MCP server URL hostname, with fallback to the service's own region.</p>
+     * @public
+     */
+    region?: string | undefined;
+}
+/**
+ * <p>OAuth credential provider configuration for authenticating with an external source during synchronization.</p>
+ * @public
+ */
+export interface RegistryRecordOAuthCredentialProvider {
+    /**
+     * <p>The Amazon Resource Name (ARN) of the OAuth credential provider resource.</p>
+     * @public
+     */
+    providerArn: string | undefined;
+    /**
+     * <p>The OAuth grant type. Currently only <code>CLIENT_CREDENTIALS</code> is supported.</p>
+     * @public
+     */
+    grantType?: RegistryRecordOAuthGrantType | undefined;
+    /**
+     * <p>The OAuth scopes to request during authentication.</p>
+     * @public
+     */
+    scopes?: string[] | undefined;
+    /**
+     * <p>Additional custom parameters for the OAuth flow.</p>
+     * @public
+     */
+    customParameters?: Record<string, string> | undefined;
+}
+/**
+ * <p>Union of supported credential provider types for registry record synchronization.</p>
+ * @public
+ */
+export type RegistryRecordCredentialProviderUnion = RegistryRecordCredentialProviderUnion.IamCredentialProviderMember | RegistryRecordCredentialProviderUnion.OauthCredentialProviderMember | RegistryRecordCredentialProviderUnion.$UnknownMember;
+/**
+ * @public
+ */
+export declare namespace RegistryRecordCredentialProviderUnion {
+    /**
+     * <p>The OAuth credential provider configuration for authenticating with the external source.</p>
+     * @public
+     */
+    interface OauthCredentialProviderMember {
+        oauthCredentialProvider: RegistryRecordOAuthCredentialProvider;
+        iamCredentialProvider?: never;
+        $unknown?: never;
+    }
+    /**
+     * <p>The IAM credential provider configuration for authenticating with the external source using SigV4 signing.</p>
+     * @public
+     */
+    interface IamCredentialProviderMember {
+        oauthCredentialProvider?: never;
+        iamCredentialProvider: RegistryRecordIamCredentialProvider;
+        $unknown?: never;
+    }
+    /**
+     * @public
+     */
+    interface $UnknownMember {
+        oauthCredentialProvider?: never;
+        iamCredentialProvider?: never;
+        $unknown: [string, any];
+    }
+    /**
+     * @deprecated unused in schema-serde mode.
+     *
+     */
+    interface Visitor<T> {
+        oauthCredentialProvider: (value: RegistryRecordOAuthCredentialProvider) => T;
+        iamCredentialProvider: (value: RegistryRecordIamCredentialProvider) => T;
+        _: (name: string, value: any) => T;
+    }
+}
+/**
+ * <p>A pairing of a credential provider type with its corresponding provider details for authenticating with external sources.</p>
+ * @public
+ */
+export interface RegistryRecordCredentialProviderConfiguration {
+    /**
+     * <p>The type of credential provider.</p> <ul> <li> <p> <code>OAUTH</code> - OAuth-based authentication.</p> </li> <li> <p> <code>IAM</code> - Amazon Web Services IAM-based authentication using SigV4 signing.</p> </li> </ul>
+     * @public
+     */
+    credentialProviderType: RegistryRecordCredentialProviderType | undefined;
+    /**
+     * <p>The credential provider configuration details. The structure depends on the <code>credentialProviderType</code>.</p>
+     * @public
+     */
+    credentialProvider: RegistryRecordCredentialProviderUnion | undefined;
+}
 /**
  * <p>Configuration for synchronizing from a URL-based MCP server.</p>
  * @public