@aws/agentcore 1.0.0-preview.2 → 1.0.0-preview.20

package/dist/schema/schemas/auth.d.ts

@@ -1,4 +1,6 @@
+import { SECURITY_GROUP_ID_PATTERN, SUBNET_ID_PATTERN, VPC_ID_PATTERN } from '../constants';
 import { z } from 'zod';
+export { SECURITY_GROUP_ID_PATTERN, SUBNET_ID_PATTERN, VPC_ID_PATTERN };
 export declare const GatewayAuthorizerTypeSchema: z.ZodEnum<{
     NONE: "NONE";
     AWS_IAM: "AWS_IAM";
@@ -45,6 +47,73 @@ export declare const CustomClaimValidationSchema: z.ZodObject<{
     }, z.core.$strip>;
 }, z.core.$strict>;
 export type CustomClaimValidation = z.infer<typeof CustomClaimValidationSchema>;
+export declare const LATTICE_RESOURCE_CONFIG_PATTERN: RegExp;
+export declare const EndpointIpAddressTypeSchema: z.ZodEnum<{
+    IPV4: "IPV4";
+    IPV6: "IPV6";
+}>;
+export type EndpointIpAddressType = z.infer<typeof EndpointIpAddressTypeSchema>;
+/** Reach the discovery endpoint via a self-managed VPC Lattice resource configuration. */
+export declare const SelfManagedLatticeResourceSchema: z.ZodObject<{
+    resourceConfigurationIdentifier: z.ZodString;
+}, z.core.$strict>;
+export type SelfManagedLatticeResource = z.infer<typeof SelfManagedLatticeResourceSchema>;
+/** Reach the discovery endpoint via a service-managed VPC interface endpoint. */
+export declare const ManagedVpcResourceSchema: z.ZodObject<{
+    vpcIdentifier: z.ZodString;
+    subnetIds: z.ZodArray<z.ZodString>;
+    endpointIpAddressType: z.ZodEnum<{
+        IPV4: "IPV4";
+        IPV6: "IPV6";
+    }>;
+    securityGroupIds: z.ZodOptional<z.ZodArray<z.ZodString>>;
+    tags: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodString>>;
+    routingDomain: z.ZodOptional<z.ZodString>;
+}, z.core.$strict>;
+export type ManagedVpcResource = z.infer<typeof ManagedVpcResourceSchema>;
+/**
+ * A private endpoint: exactly one of selfManagedLatticeResource or managedVpcResource.
+ * The CFN spec dropped `oneOf` (contract-test antipattern) and enforces exactly-one structurally;
+ * we mirror that with a superRefine rather than a discriminated union.
+ */
+export declare const PrivateEndpointSchema: z.ZodObject<{
+    selfManagedLatticeResource: z.ZodOptional<z.ZodObject<{
+        resourceConfigurationIdentifier: z.ZodString;
+    }, z.core.$strict>>;
+    managedVpcResource: z.ZodOptional<z.ZodObject<{
+        vpcIdentifier: z.ZodString;
+        subnetIds: z.ZodArray<z.ZodString>;
+        endpointIpAddressType: z.ZodEnum<{
+            IPV4: "IPV4";
+            IPV6: "IPV6";
+        }>;
+        securityGroupIds: z.ZodOptional<z.ZodArray<z.ZodString>>;
+        tags: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodString>>;
+        routingDomain: z.ZodOptional<z.ZodString>;
+    }, z.core.$strict>>;
+}, z.core.$strict>;
+export type PrivateEndpoint = z.infer<typeof PrivateEndpointSchema>;
+/** Maps a specific domain to its own private endpoint (overrides the discovery-URL endpoint for that domain). */
+export declare const PrivateEndpointOverrideSchema: z.ZodObject<{
+    domain: z.ZodString;
+    privateEndpoint: z.ZodObject<{
+        selfManagedLatticeResource: z.ZodOptional<z.ZodObject<{
+            resourceConfigurationIdentifier: z.ZodString;
+        }, z.core.$strict>>;
+        managedVpcResource: z.ZodOptional<z.ZodObject<{
+            vpcIdentifier: z.ZodString;
+            subnetIds: z.ZodArray<z.ZodString>;
+            endpointIpAddressType: z.ZodEnum<{
+                IPV4: "IPV4";
+                IPV6: "IPV6";
+            }>;
+            securityGroupIds: z.ZodOptional<z.ZodArray<z.ZodString>>;
+            tags: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodString>>;
+            routingDomain: z.ZodOptional<z.ZodString>;
+        }, z.core.$strict>>;
+    }, z.core.$strict>;
+}, z.core.$strict>;
+export type PrivateEndpointOverride = z.infer<typeof PrivateEndpointOverrideSchema>;
 /**
  * Custom JWT authorizer configuration.
  * Used when authorizerType is 'CUSTOM_JWT'.
@@ -75,6 +144,41 @@ export declare const CustomJwtAuthorizerConfigSchema: z.ZodObject<{
             }, z.core.$strip>;
         }, z.core.$strip>;
     }, z.core.$strict>>>;
+    privateEndpoint: z.ZodOptional<z.ZodObject<{
+        selfManagedLatticeResource: z.ZodOptional<z.ZodObject<{
+            resourceConfigurationIdentifier: z.ZodString;
+        }, z.core.$strict>>;
+        managedVpcResource: z.ZodOptional<z.ZodObject<{
+            vpcIdentifier: z.ZodString;
+            subnetIds: z.ZodArray<z.ZodString>;
+            endpointIpAddressType: z.ZodEnum<{
+                IPV4: "IPV4";
+                IPV6: "IPV6";
+            }>;
+            securityGroupIds: z.ZodOptional<z.ZodArray<z.ZodString>>;
+            tags: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodString>>;
+            routingDomain: z.ZodOptional<z.ZodString>;
+        }, z.core.$strict>>;
+    }, z.core.$strict>>;
+    privateEndpointOverrides: z.ZodOptional<z.ZodArray<z.ZodObject<{
+        domain: z.ZodString;
+        privateEndpoint: z.ZodObject<{
+            selfManagedLatticeResource: z.ZodOptional<z.ZodObject<{
+                resourceConfigurationIdentifier: z.ZodString;
+            }, z.core.$strict>>;
+            managedVpcResource: z.ZodOptional<z.ZodObject<{
+                vpcIdentifier: z.ZodString;
+                subnetIds: z.ZodArray<z.ZodString>;
+                endpointIpAddressType: z.ZodEnum<{
+                    IPV4: "IPV4";
+                    IPV6: "IPV6";
+                }>;
+                securityGroupIds: z.ZodOptional<z.ZodArray<z.ZodString>>;
+                tags: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodString>>;
+                routingDomain: z.ZodOptional<z.ZodString>;
+            }, z.core.$strict>>;
+        }, z.core.$strict>;
+    }, z.core.$strict>>>;
 }, z.core.$strict>;
 export type CustomJwtAuthorizerConfig = z.infer<typeof CustomJwtAuthorizerConfigSchema>;
 /**
@@ -105,6 +209,41 @@ export declare const AuthorizerConfigSchema: z.ZodObject<{
                 }, z.core.$strip>;
             }, z.core.$strip>;
         }, z.core.$strict>>>;
+        privateEndpoint: z.ZodOptional<z.ZodObject<{
+            selfManagedLatticeResource: z.ZodOptional<z.ZodObject<{
+                resourceConfigurationIdentifier: z.ZodString;
+            }, z.core.$strict>>;
+            managedVpcResource: z.ZodOptional<z.ZodObject<{
+                vpcIdentifier: z.ZodString;
+                subnetIds: z.ZodArray<z.ZodString>;
+                endpointIpAddressType: z.ZodEnum<{
+                    IPV4: "IPV4";
+                    IPV6: "IPV6";
+                }>;
+                securityGroupIds: z.ZodOptional<z.ZodArray<z.ZodString>>;
+                tags: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodString>>;
+                routingDomain: z.ZodOptional<z.ZodString>;
+            }, z.core.$strict>>;
+        }, z.core.$strict>>;
+        privateEndpointOverrides: z.ZodOptional<z.ZodArray<z.ZodObject<{
+            domain: z.ZodString;
+            privateEndpoint: z.ZodObject<{
+                selfManagedLatticeResource: z.ZodOptional<z.ZodObject<{
+                    resourceConfigurationIdentifier: z.ZodString;
+                }, z.core.$strict>>;
+                managedVpcResource: z.ZodOptional<z.ZodObject<{
+                    vpcIdentifier: z.ZodString;
+                    subnetIds: z.ZodArray<z.ZodString>;
+                    endpointIpAddressType: z.ZodEnum<{
+                        IPV4: "IPV4";
+                        IPV6: "IPV6";
+                    }>;
+                    securityGroupIds: z.ZodOptional<z.ZodArray<z.ZodString>>;
+                    tags: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodString>>;
+                    routingDomain: z.ZodOptional<z.ZodString>;
+                }, z.core.$strict>>;
+            }, z.core.$strict>;
+        }, z.core.$strict>>>;
     }, z.core.$strict>>;
 }, z.core.$strip>;
 export type AuthorizerConfig = z.infer<typeof AuthorizerConfigSchema>;
@@ -133,6 +272,41 @@ export declare const GatewayAuthorizerConfigSchema: z.ZodObject<{
                 }, z.core.$strip>;
             }, z.core.$strip>;
         }, z.core.$strict>>>;
+        privateEndpoint: z.ZodOptional<z.ZodObject<{
+            selfManagedLatticeResource: z.ZodOptional<z.ZodObject<{
+                resourceConfigurationIdentifier: z.ZodString;
+            }, z.core.$strict>>;
+            managedVpcResource: z.ZodOptional<z.ZodObject<{
+                vpcIdentifier: z.ZodString;
+                subnetIds: z.ZodArray<z.ZodString>;
+                endpointIpAddressType: z.ZodEnum<{
+                    IPV4: "IPV4";
+                    IPV6: "IPV6";
+                }>;
+                securityGroupIds: z.ZodOptional<z.ZodArray<z.ZodString>>;
+                tags: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodString>>;
+                routingDomain: z.ZodOptional<z.ZodString>;
+            }, z.core.$strict>>;
+        }, z.core.$strict>>;
+        privateEndpointOverrides: z.ZodOptional<z.ZodArray<z.ZodObject<{
+            domain: z.ZodString;
+            privateEndpoint: z.ZodObject<{
+                selfManagedLatticeResource: z.ZodOptional<z.ZodObject<{
+                    resourceConfigurationIdentifier: z.ZodString;
+                }, z.core.$strict>>;
+                managedVpcResource: z.ZodOptional<z.ZodObject<{
+                    vpcIdentifier: z.ZodString;
+                    subnetIds: z.ZodArray<z.ZodString>;
+                    endpointIpAddressType: z.ZodEnum<{
+                        IPV4: "IPV4";
+                        IPV6: "IPV6";
+                    }>;
+                    securityGroupIds: z.ZodOptional<z.ZodArray<z.ZodString>>;
+                    tags: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodString>>;
+                    routingDomain: z.ZodOptional<z.ZodString>;
+                }, z.core.$strict>>;
+            }, z.core.$strict>;
+        }, z.core.$strict>>>;
     }, z.core.$strict>>;
 }, z.core.$strip>;
 /** @deprecated Use AuthorizerConfig. Backwards-compatible alias for Gateway. */

package/dist/schema/schemas/auth.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"auth.d.ts","sourceRoot":"","sources":["../../../src/schema/schemas/auth.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAMxB,eAAO,MAAM,2BAA2B;;;;EAA4C,CAAC;AACrF,MAAM,MAAM,qBAAqB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,2BAA2B,CAAC,CAAC;AAEhF,eAAO,MAAM,2BAA2B;;;EAAoC,CAAC;AAC7E,MAAM,MAAM,qBAAqB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,2BAA2B,CAAC,CAAC;AA4BhF,eAAO,MAAM,wBAAwB;;;;EAAiD,CAAC;AACvF,MAAM,MAAM,kBAAkB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,wBAAwB,CAAC,CAAC;AAE1E,eAAO,MAAM,qBAAqB;;;iBAmB9B,CAAC;AACL,MAAM,MAAM,eAAe,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,qBAAqB,CAAC,CAAC;AAEpE,eAAO,MAAM,gCAAgC;;;EAAqC,CAAC;AACnF,MAAM,MAAM,0BAA0B,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,gCAAgC,CAAC,CAAC;AAE1F,eAAO,MAAM,2BAA2B;;;;;;;;;;;;;;;;;kBAgB7B,CAAC;AACZ,MAAM,MAAM,qBAAqB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,2BAA2B,CAAC,CAAC;AAIhF;;;;;;GAMG;AACH,eAAO,MAAM,+BAA+B;;;;;;;;;;;;;;;;;;;;;;;kBA0BxC,CAAC;AAEL,MAAM,MAAM,yBAAyB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,+BAA+B,CAAC,CAAC;AAExF;;;GAGG;AACH,eAAO,MAAM,sBAAsB;;;;;;;;;;;;;;;;;;;;;;;;;iBAEjC,CAAC;AAEH,MAAM,MAAM,gBAAgB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,sBAAsB,CAAC,CAAC;AAEtE,sFAAsF;AACtF,eAAO,MAAM,6BAA6B;;;;;;;;;;;;;;;;;;;;;;;;;iBAAyB,CAAC;AACpE,gFAAgF;AAChF,MAAM,MAAM,uBAAuB,GAAG,gBAAgB,CAAC"}
+{"version":3,"file":"auth.d.ts","sourceRoot":"","sources":["../../../src/schema/schemas/auth.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,yBAAyB,EAAE,iBAAiB,EAAE,cAAc,EAAE,MAAM,cAAc,CAAC;AAE5F,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAGxB,OAAO,EAAE,yBAAyB,EAAE,iBAAiB,EAAE,cAAc,EAAE,CAAC;AAMxE,eAAO,MAAM,2BAA2B;;;;EAA4C,CAAC;AACrF,MAAM,MAAM,qBAAqB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,2BAA2B,CAAC,CAAC;AAEhF,eAAO,MAAM,2BAA2B;;;EAAoC,CAAC;AAC7E,MAAM,MAAM,qBAAqB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,2BAA2B,CAAC,CAAC;AA+BhF,eAAO,MAAM,wBAAwB;;;;EAAiD,CAAC;AACvF,MAAM,MAAM,kBAAkB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,wBAAwB,CAAC,CAAC;AAE1E,eAAO,MAAM,qBAAqB;;;iBAmB9B,CAAC;AACL,MAAM,MAAM,eAAe,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,qBAAqB,CAAC,CAAC;AAEpE,eAAO,MAAM,gCAAgC;;;EAAqC,CAAC;AACnF,MAAM,MAAM,0BAA0B,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,gCAAgC,CAAC,CAAC;AAE1F,eAAO,MAAM,2BAA2B;;;;;;;;;;;;;;;;;kBAgB7B,CAAC;AACZ,MAAM,MAAM,qBAAqB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,2BAA2B,CAAC,CAAC;AAWhF,eAAO,MAAM,+BAA+B,QAC0E,CAAC;AAEvH,eAAO,MAAM,2BAA2B;;;EAA2B,CAAC;AACpE,MAAM,MAAM,qBAAqB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,2BAA2B,CAAC,CAAC;AAEhF,0FAA0F;AAC1F,eAAO,MAAM,gCAAgC;;kBAQlC,CAAC;AACZ,MAAM,MAAM,0BAA0B,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,gCAAgC,CAAC,CAAC;AAE1F,iFAAiF;AACjF,eAAO,MAAM,wBAAwB;;;;;;;;;;kBAY1B,CAAC;AACZ,MAAM,MAAM,kBAAkB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,wBAAwB,CAAC,CAAC;AAE1E;;;;GAIG;AACH,eAAO,MAAM,qBAAqB;;;;;;;;;;;;;;;kBAc9B,CAAC;AACL,MAAM,MAAM,eAAe,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,qBAAqB,CAAC,CAAC;AAEpE,iHAAiH;AACjH,eAAO,MAAM,6BAA6B;;;;;;;;;;;;;;;;;;kBAK/B,CAAC;AACZ,MAAM,MAAM,uBAAuB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,6BAA6B,CAAC,CAAC;AAepF;;;;;;GAMG;AACH,eAAO,MAAM,+BAA+B;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;kBA8ExC,CAAC;AAEL,MAAM,MAAM,yBAAyB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,+BAA+B,CAAC,CAAC;AAExF;;;GAGG;AACH,eAAO,MAAM,sBAAsB;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;iBAEjC,CAAC;AAEH,MAAM,MAAM,gBAAgB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,sBAAsB,CAAC,CAAC;AAEtE,sFAAsF;AACtF,eAAO,MAAM,6BAA6B;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;iBAAyB,CAAC;AACpE,gFAAgF;AAChF,MAAM,MAAM,uBAAuB,GAAG,gBAAgB,CAAC"}

package/dist/schema/schemas/auth.js

@@ -1,6 +1,11 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.GatewayAuthorizerConfigSchema = exports.AuthorizerConfigSchema = exports.CustomJwtAuthorizerConfigSchema = exports.CustomClaimValidationSchema = exports.InboundTokenClaimValueTypeSchema = exports.ClaimMatchValueSchema = exports.ClaimMatchOperatorSchema = exports.RuntimeAuthorizerTypeSchema = exports.GatewayAuthorizerTypeSchema = void 0;
+exports.GatewayAuthorizerConfigSchema = exports.AuthorizerConfigSchema = exports.CustomJwtAuthorizerConfigSchema = exports.PrivateEndpointOverrideSchema = exports.PrivateEndpointSchema = exports.ManagedVpcResourceSchema = exports.SelfManagedLatticeResourceSchema = exports.EndpointIpAddressTypeSchema = exports.LATTICE_RESOURCE_CONFIG_PATTERN = exports.CustomClaimValidationSchema = exports.InboundTokenClaimValueTypeSchema = exports.ClaimMatchValueSchema = exports.ClaimMatchOperatorSchema = exports.RuntimeAuthorizerTypeSchema = exports.GatewayAuthorizerTypeSchema = exports.VPC_ID_PATTERN = exports.SUBNET_ID_PATTERN = exports.SECURITY_GROUP_ID_PATTERN = void 0;
+const constants_1 = require("../constants");
+Object.defineProperty(exports, "SECURITY_GROUP_ID_PATTERN", { enumerable: true, get: function () { return constants_1.SECURITY_GROUP_ID_PATTERN; } });
+Object.defineProperty(exports, "SUBNET_ID_PATTERN", { enumerable: true, get: function () { return constants_1.SUBNET_ID_PATTERN; } });
+Object.defineProperty(exports, "VPC_ID_PATTERN", { enumerable: true, get: function () { return constants_1.VPC_ID_PATTERN; } });
+const tags_1 = require("./primitives/tags");
 const zod_1 = require("zod");
 // ============================================================================
 // Shared Authorization Schemas
@@ -26,6 +31,9 @@ const OidcDiscoveryUrlSchema = zod_1.z
 // ── Custom Claims Schemas (matches CFN CustomClaimValidationType) ──
 // API-documented patterns (from ClaimMatchValueType and CustomClaimValidationType)
 const MATCH_VALUE_PATTERN = /^[A-Za-z0-9_.-]+$/;
+// OAuth scope token: printable ASCII excluding space (0x20) and double-quote (0x22).
+// Mirrors CFN CustomJWTAuthorizerConfiguration.AllowedScopes.items pattern byte-for-byte.
+const ALLOWED_SCOPE_PATTERN = /^[\x21\x23-\x5B\x5D-\x7E]+$/;
 const CLAIM_NAME_PATTERN = /^[A-Za-z0-9_.:-]+$/;
 // Server-side reserved claim names (not regex-documented; API rejects these at deploy time)
 const RESERVED_CLAIM_NAMES = ['client_id'];
@@ -68,6 +76,74 @@ exports.CustomClaimValidationSchema = zod_1.z
     }),
 })
     .strict();
+// ── PrivateLink Inbound — private endpoint for reaching the OIDC discovery URL ──
+//
+// Nested inside CustomJWTAuthorizerConfiguration ("PrivateLink inbound" GA-parity feature):
+// when a JWT IdP's discovery/JWKS endpoint is privately hosted, this tells the harness how to
+// reach it over a private network. Two mutually-exclusive arms. Patterns match the
+// AWS::BedrockAgentCore::Harness CFN spec byte-for-byte.
+// VPC Lattice resource-config id, or its full ARN. Exported so the TUI validators reuse the
+// schema regex (single source of truth) instead of hand-rolled checks that drift from it.
+exports.LATTICE_RESOURCE_CONFIG_PATTERN = /^((rcfg-[0-9a-z]{17})|(arn:[a-z0-9-]+:vpc-lattice:[a-zA-Z0-9-]+:\d{12}:resourceconfiguration\/rcfg-[0-9a-z]{17}))$/;
+exports.EndpointIpAddressTypeSchema = zod_1.z.enum(['IPV4', 'IPV6']);
+/** Reach the discovery endpoint via a self-managed VPC Lattice resource configuration. */
+exports.SelfManagedLatticeResourceSchema = zod_1.z
+    .object({
+    resourceConfigurationIdentifier: zod_1.z
+        .string()
+        .min(20)
+        .max(2048)
+        .regex(exports.LATTICE_RESOURCE_CONFIG_PATTERN, 'Must be a VPC Lattice resource-config id (rcfg-...) or its ARN'),
+})
+    .strict();
+/** Reach the discovery endpoint via a service-managed VPC interface endpoint. */
+exports.ManagedVpcResourceSchema = zod_1.z
+    .object({
+    vpcIdentifier: zod_1.z.string().regex(constants_1.VPC_ID_PATTERN, 'Must be a VPC id (vpc-...)'),
+    subnetIds: zod_1.z.array(zod_1.z.string().regex(constants_1.SUBNET_ID_PATTERN, 'Must be a subnet id (subnet-...)')).min(1),
+    endpointIpAddressType: exports.EndpointIpAddressTypeSchema,
+    securityGroupIds: zod_1.z
+        .array(zod_1.z.string().regex(constants_1.SECURITY_GROUP_ID_PATTERN, 'Must be a security group id (sg-...)'))
+        .max(5)
+        .optional(),
+    tags: tags_1.TagsSchema.optional(),
+    routingDomain: zod_1.z.string().min(3).max(255).optional(),
+})
+    .strict();
+/**
+ * A private endpoint: exactly one of selfManagedLatticeResource or managedVpcResource.
+ * The CFN spec dropped `oneOf` (contract-test antipattern) and enforces exactly-one structurally;
+ * we mirror that with a superRefine rather than a discriminated union.
+ */
+exports.PrivateEndpointSchema = zod_1.z
+    .object({
+    selfManagedLatticeResource: exports.SelfManagedLatticeResourceSchema.optional(),
+    managedVpcResource: exports.ManagedVpcResourceSchema.optional(),
+})
+    .strict()
+    .superRefine((data, ctx) => {
+    const count = [data.selfManagedLatticeResource, data.managedVpcResource].filter(v => v !== undefined).length;
+    if (count !== 1) {
+        ctx.addIssue({
+            code: zod_1.z.ZodIssueCode.custom,
+            message: 'A private endpoint must set exactly one of selfManagedLatticeResource or managedVpcResource',
+        });
+    }
+});
+/** Maps a specific domain to its own private endpoint (overrides the discovery-URL endpoint for that domain). */
+exports.PrivateEndpointOverrideSchema = zod_1.z
+    .object({
+    domain: zod_1.z.string().min(1).max(253),
+    privateEndpoint: exports.PrivateEndpointSchema,
+})
+    .strict();
+function privateEndpointArm(pe) {
+    if (pe.selfManagedLatticeResource)
+        return 'selfManagedLatticeResource';
+    if (pe.managedVpcResource)
+        return 'managedVpcResource';
+    return undefined;
+}
 // ── Custom JWT Authorizer Configuration ──
 /**
  * Custom JWT authorizer configuration.
@@ -84,10 +160,20 @@ exports.CustomJwtAuthorizerConfigSchema = zod_1.z
     allowedAudience: zod_1.z.array(zod_1.z.string().min(1)).optional(),
     /** List of allowed client IDs */
     allowedClients: zod_1.z.array(zod_1.z.string().min(1)).optional(),
-    /** List of allowed scopes */
-    allowedScopes: zod_1.z.array(zod_1.z.string().min(1)).optional(),
+    /** List of allowed scopes (printable ASCII, no space/quote; ≤255 chars each — CFN parity) */
+    allowedScopes: zod_1.z
+        .array(zod_1.z
+        .string()
+        .min(1)
+        .max(255)
+        .regex(ALLOWED_SCOPE_PATTERN, 'Scope must be printable ASCII with no spaces or quotes'))
+        .optional(),
     /** Custom claim validations */
     customClaims: zod_1.z.array(exports.CustomClaimValidationSchema).min(1).optional(),
+    /** PrivateLink inbound: how to reach the OIDC discovery endpoint over a private network. */
+    privateEndpoint: exports.PrivateEndpointSchema.optional(),
+    /** Per-domain private-endpoint overrides (≤5). */
+    privateEndpointOverrides: zod_1.z.array(exports.PrivateEndpointOverrideSchema).max(5).optional(),
 })
     .strict()
     .superRefine((data, ctx) => {
@@ -101,6 +187,44 @@ exports.CustomJwtAuthorizerConfigSchema = zod_1.z
             message: 'At least one of allowedAudience, allowedClients, allowedScopes, or customClaims must be provided',
         });
     }
+    // PrivateEndpointOverrides coupling rules — mirror the AgentCore Identity service's deploy-time
+    // validation so the user fails fast here instead of mid-deploy.
+    const overrides = data.privateEndpointOverrides ?? [];
+    if (overrides.length > 0) {
+        // 1. Overrides require a base privateEndpoint.
+        if (!data.privateEndpoint) {
+            ctx.addIssue({
+                code: zod_1.z.ZodIssueCode.custom,
+                message: 'privateEndpointOverrides can only be used when privateEndpoint is also set',
+                path: ['privateEndpointOverrides'],
+            });
+        }
+        else {
+            // 2. The base endpoint and every override must use the same arm (all self-managed or all service-managed).
+            const baseArm = privateEndpointArm(data.privateEndpoint);
+            overrides.forEach((o, i) => {
+                if (privateEndpointArm(o.privateEndpoint) !== baseArm) {
+                    ctx.addIssue({
+                        code: zod_1.z.ZodIssueCode.custom,
+                        message: 'privateEndpoint and privateEndpointOverrides must all be the same kind — either all selfManagedLatticeResource or all managedVpcResource',
+                        path: ['privateEndpointOverrides', i, 'privateEndpoint'],
+                    });
+                }
+            });
+        }
+        // 3. Override domains must be unique.
+        const seen = new Set();
+        overrides.forEach((o, i) => {
+            if (seen.has(o.domain)) {
+                ctx.addIssue({
+                    code: zod_1.z.ZodIssueCode.custom,
+                    message: `Duplicate privateEndpointOverride domain: ${o.domain}`,
+                    path: ['privateEndpointOverrides', i, 'domain'],
+                });
+            }
+            seen.add(o.domain);
+        });
+    }
 });
 /**
  * Resource-agnostic authorizer configuration container.

package/dist/schema/schemas/auth.js.map

@@ -1 +1 @@
-{"version":3,"file":"auth.js","sourceRoot":"","sources":["../../../src/schema/schemas/auth.ts"],"names":[],"mappings":";;;AAAA,6BAAwB;AAExB,+EAA+E;AAC/E,+BAA+B;AAC/B,+EAA+E;AAElE,QAAA,2BAA2B,GAAG,OAAC,CAAC,IAAI,CAAC,CAAC,MAAM,EAAE,SAAS,EAAE,YAAY,CAAC,CAAC,CAAC;AAGxE,QAAA,2BAA2B,GAAG,OAAC,CAAC,IAAI,CAAC,CAAC,SAAS,EAAE,YAAY,CAAC,CAAC,CAAC;AAG7E,4FAA4F;AAC5F,MAAM,sBAAsB,GAAG,mCAAmC,CAAC;AAEnE;;;;GAIG;AACH,MAAM,sBAAsB,GAAG,OAAC;KAC7B,MAAM,EAAE;KACR,GAAG,CAAC,qBAAqB,CAAC;KAC1B,MAAM,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,CAAC,UAAU,CAAC,UAAU,CAAC,EAAE;IACzC,OAAO,EAAE,mCAAmC;CAC7C,CAAC;KACD,MAAM,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,CAAC,QAAQ,CAAC,sBAAsB,CAAC,EAAE;IACnD,OAAO,EAAE,qCAAqC,sBAAsB,GAAG;CACxE,CAAC,CAAC;AAEL,sEAAsE;AAEtE,mFAAmF;AACnF,MAAM,mBAAmB,GAAG,mBAAmB,CAAC;AAChD,MAAM,kBAAkB,GAAG,oBAAoB,CAAC;AAChD,4FAA4F;AAC5F,MAAM,oBAAoB,GAAG,CAAC,WAAW,CAAC,CAAC;AAE9B,QAAA,wBAAwB,GAAG,OAAC,CAAC,IAAI,CAAC,CAAC,QAAQ,EAAE,UAAU,EAAE,cAAc,CAAC,CAAC,CAAC;AAG1E,QAAA,qBAAqB,GAAG,OAAC;KACnC,MAAM,CAAC;IACN,gBAAgB,EAAE,OAAC;SAChB,MAAM,EAAE;SACR,GAAG,CAAC,CAAC,CAAC;SACN,GAAG,CAAC,GAAG,CAAC;SACR,KAAK,CAAC,mBAAmB,EAAE,wCAAwC,CAAC;SACpE,QAAQ,EAAE;IACb,oBAAoB,EAAE,OAAC;SACpB,KAAK,CAAC,OAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,KAAK,CAAC,mBAAmB,EAAE,6CAA6C,CAAC,CAAC;SAC3G,GAAG,CAAC,CAAC,CAAC;SACN,GAAG,CAAC,GAAG,CAAC;SACR,QAAQ,EAAE;CACd,CAAC;KACD,MAAM,CAAC,IAAI,CAAC,EAAE,CAAC,IAAI,CAAC,gBAAgB,KAAK,SAAS,IAAI,IAAI,CAAC,oBAAoB,KAAK,SAAS,EAAE;IAC9F,OAAO,EAAE,kEAAkE;CAC5E,CAAC;KACD,MAAM,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,gBAAgB,KAAK,SAAS,IAAI,IAAI,CAAC,oBAAoB,KAAK,SAAS,CAAC,EAAE;IACjG,OAAO,EAAE,sEAAsE;CAChF,CAAC,CAAC;AAGQ,QAAA,gCAAgC,GAAG,OAAC,CAAC,IAAI,CAAC,CAAC,QAAQ,EAAE,cAAc,CAAC,CAAC,CAAC;AAGtE,QAAA,2BAA2B,GAAG,OAAC;KACzC,MAAM,CAAC;IACN,qBAAqB,EAAE,OAAC;SACrB,MAAM,EAAE;SACR,GAAG,CAAC,CAAC,CAAC;SACN,GAAG,CAAC,GAAG,CAAC;SACR,KAAK,CAAC,kBAAkB,EAAE,wCAAwC,CAAC;SACnE,MAAM,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC,oBAAoB,CAAC,QAAQ,CAAC,IAAI,CAAC,EAAE;QACpD,OAAO,EAAE,yCAAyC,oBAAoB,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG;KACrF,CAAC;IACJ,0BAA0B,EAAE,wCAAgC;IAC5D,0BAA0B,EAAE,OAAC,CAAC,MAAM,CAAC;QACnC,kBAAkB,EAAE,gCAAwB;QAC5C,eAAe,EAAE,6BAAqB;KACvC,CAAC;CACH,CAAC;KACD,MAAM,EAAE,CAAC;AAGZ,4CAA4C;AAE5C;;;;;;GAMG;AACU,QAAA,+BAA+B,GAAG,OAAC;KAC7C,MAAM,CAAC;IACN,0HAA0H;IAC1H,YAAY,EAAE,sBAAsB;IACpC,uDAAuD;IACvD,eAAe,EAAE,OAAC,CAAC,KAAK,CAAC,OAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,QAAQ,EAAE;IACtD,iCAAiC;IACjC,cAAc,EAAE,OAAC,CAAC,KAAK,CAAC,OAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,QAAQ,EAAE;IACrD,6BAA6B;IAC7B,aAAa,EAAE,OAAC,CAAC,KAAK,CAAC,OAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,QAAQ,EAAE;IACpD,+BAA+B;IAC/B,YAAY,EAAE,OAAC,CAAC,KAAK,CAAC,mCAA2B,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,EAAE;CACrE,CAAC;KACD,MAAM,EAAE;KACR,WAAW,CAAC,CAAC,IAAI,EAAE,GAAG,EAAE,EAAE;IACzB,MAAM,WAAW,GAAG,IAAI,CAAC,eAAe,IAAI,IAAI,CAAC,eAAe,CAAC,MAAM,GAAG,CAAC,CAAC;IAC5E,MAAM,UAAU,GAAG,IAAI,CAAC,cAAc,IAAI,IAAI,CAAC,cAAc,CAAC,MAAM,GAAG,CAAC,CAAC;IACzE,MAAM,SAAS,GAAG,IAAI,CAAC,aAAa,IAAI,IAAI,CAAC,aAAa,CAAC,MAAM,GAAG,CAAC,CAAC;IACtE,MAAM,SAAS,GAAG,IAAI,CAAC,YAAY,IAAI,IAAI,CAAC,YAAY,CAAC,MAAM,GAAG,CAAC,CAAC;IAEpE,IAAI,CAAC,WAAW,IAAI,CAAC,UAAU,IAAI,CAAC,SAAS,IAAI,CAAC,SAAS,EAAE,CAAC;QAC5D,GAAG,CAAC,QAAQ,CAAC;YACX,IAAI,EAAE,OAAC,CAAC,YAAY,CAAC,MAAM;YAC3B,OAAO,EAAE,kGAAkG;SAC5G,CAAC,CAAC;IACL,CAAC;AACH,CAAC,CAAC,CAAC;AAIL;;;GAGG;AACU,QAAA,sBAAsB,GAAG,OAAC,CAAC,MAAM,CAAC;IAC7C,mBAAmB,EAAE,uCAA+B,CAAC,QAAQ,EAAE;CAChE,CAAC,CAAC;AAIH,sFAAsF;AACzE,QAAA,6BAA6B,GAAG,8BAAsB,CAAC"}
+{"version":3,"file":"auth.js","sourceRoot":"","sources":["../../../src/schema/schemas/auth.ts"],"names":[],"mappings":";;;AAAA,4CAA4F;AAKnF,0GALA,qCAAyB,OAKA;AAAE,kGALA,6BAAiB,OAKA;AAAE,+FALA,0BAAc,OAKA;AAJrE,4CAA+C;AAC/C,6BAAwB;AAKxB,+EAA+E;AAC/E,+BAA+B;AAC/B,+EAA+E;AAElE,QAAA,2BAA2B,GAAG,OAAC,CAAC,IAAI,CAAC,CAAC,MAAM,EAAE,SAAS,EAAE,YAAY,CAAC,CAAC,CAAC;AAGxE,QAAA,2BAA2B,GAAG,OAAC,CAAC,IAAI,CAAC,CAAC,SAAS,EAAE,YAAY,CAAC,CAAC,CAAC;AAG7E,4FAA4F;AAC5F,MAAM,sBAAsB,GAAG,mCAAmC,CAAC;AAEnE;;;;GAIG;AACH,MAAM,sBAAsB,GAAG,OAAC;KAC7B,MAAM,EAAE;KACR,GAAG,CAAC,qBAAqB,CAAC;KAC1B,MAAM,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,CAAC,UAAU,CAAC,UAAU,CAAC,EAAE;IACzC,OAAO,EAAE,mCAAmC;CAC7C,CAAC;KACD,MAAM,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,CAAC,QAAQ,CAAC,sBAAsB,CAAC,EAAE;IACnD,OAAO,EAAE,qCAAqC,sBAAsB,GAAG;CACxE,CAAC,CAAC;AAEL,sEAAsE;AAEtE,mFAAmF;AACnF,MAAM,mBAAmB,GAAG,mBAAmB,CAAC;AAChD,qFAAqF;AACrF,0FAA0F;AAC1F,MAAM,qBAAqB,GAAG,6BAA6B,CAAC;AAC5D,MAAM,kBAAkB,GAAG,oBAAoB,CAAC;AAChD,4FAA4F;AAC5F,MAAM,oBAAoB,GAAG,CAAC,WAAW,CAAC,CAAC;AAE9B,QAAA,wBAAwB,GAAG,OAAC,CAAC,IAAI,CAAC,CAAC,QAAQ,EAAE,UAAU,EAAE,cAAc,CAAC,CAAC,CAAC;AAG1E,QAAA,qBAAqB,GAAG,OAAC;KACnC,MAAM,CAAC;IACN,gBAAgB,EAAE,OAAC;SAChB,MAAM,EAAE;SACR,GAAG,CAAC,CAAC,CAAC;SACN,GAAG,CAAC,GAAG,CAAC;SACR,KAAK,CAAC,mBAAmB,EAAE,wCAAwC,CAAC;SACpE,QAAQ,EAAE;IACb,oBAAoB,EAAE,OAAC;SACpB,KAAK,CAAC,OAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,KAAK,CAAC,mBAAmB,EAAE,6CAA6C,CAAC,CAAC;SAC3G,GAAG,CAAC,CAAC,CAAC;SACN,GAAG,CAAC,GAAG,CAAC;SACR,QAAQ,EAAE;CACd,CAAC;KACD,MAAM,CAAC,IAAI,CAAC,EAAE,CAAC,IAAI,CAAC,gBAAgB,KAAK,SAAS,IAAI,IAAI,CAAC,oBAAoB,KAAK,SAAS,EAAE;IAC9F,OAAO,EAAE,kEAAkE;CAC5E,CAAC;KACD,MAAM,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,gBAAgB,KAAK,SAAS,IAAI,IAAI,CAAC,oBAAoB,KAAK,SAAS,CAAC,EAAE;IACjG,OAAO,EAAE,sEAAsE;CAChF,CAAC,CAAC;AAGQ,QAAA,gCAAgC,GAAG,OAAC,CAAC,IAAI,CAAC,CAAC,QAAQ,EAAE,cAAc,CAAC,CAAC,CAAC;AAGtE,QAAA,2BAA2B,GAAG,OAAC;KACzC,MAAM,CAAC;IACN,qBAAqB,EAAE,OAAC;SACrB,MAAM,EAAE;SACR,GAAG,CAAC,CAAC,CAAC;SACN,GAAG,CAAC,GAAG,CAAC;SACR,KAAK,CAAC,kBAAkB,EAAE,wCAAwC,CAAC;SACnE,MAAM,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC,oBAAoB,CAAC,QAAQ,CAAC,IAAI,CAAC,EAAE;QACpD,OAAO,EAAE,yCAAyC,oBAAoB,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG;KACrF,CAAC;IACJ,0BAA0B,EAAE,wCAAgC;IAC5D,0BAA0B,EAAE,OAAC,CAAC,MAAM,CAAC;QACnC,kBAAkB,EAAE,gCAAwB;QAC5C,eAAe,EAAE,6BAAqB;KACvC,CAAC;CACH,CAAC;KACD,MAAM,EAAE,CAAC;AAGZ,mFAAmF;AACnF,EAAE;AACF,4FAA4F;AAC5F,8FAA8F;AAC9F,mFAAmF;AACnF,yDAAyD;AAEzD,4FAA4F;AAC5F,0FAA0F;AAC7E,QAAA,+BAA+B,GAC1C,oHAAoH,CAAC;AAE1G,QAAA,2BAA2B,GAAG,OAAC,CAAC,IAAI,CAAC,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,CAAC;AAGpE,0FAA0F;AAC7E,QAAA,gCAAgC,GAAG,OAAC;KAC9C,MAAM,CAAC;IACN,+BAA+B,EAAE,OAAC;SAC/B,MAAM,EAAE;SACR,GAAG,CAAC,EAAE,CAAC;SACP,GAAG,CAAC,IAAI,CAAC;SACT,KAAK,CAAC,uCAA+B,EAAE,gEAAgE,CAAC;CAC5G,CAAC;KACD,MAAM,EAAE,CAAC;AAGZ,iFAAiF;AACpE,QAAA,wBAAwB,GAAG,OAAC;KACtC,MAAM,CAAC;IACN,aAAa,EAAE,OAAC,CAAC,MAAM,EAAE,CAAC,KAAK,CAAC,0BAAc,EAAE,4BAA4B,CAAC;IAC7E,SAAS,EAAE,OAAC,CAAC,KAAK,CAAC,OAAC,CAAC,MAAM,EAAE,CAAC,KAAK,CAAC,6BAAiB,EAAE,kCAAkC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC;IAClG,qBAAqB,EAAE,mCAA2B;IAClD,gBAAgB,EAAE,OAAC;SAChB,KAAK,CAAC,OAAC,CAAC,MAAM,EAAE,CAAC,KAAK,CAAC,qCAAyB,EAAE,sCAAsC,CAAC,CAAC;SAC1F,GAAG,CAAC,CAAC,CAAC;SACN,QAAQ,EAAE;IACb,IAAI,EAAE,iBAAU,CAAC,QAAQ,EAAE;IAC3B,aAAa,EAAE,OAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,QAAQ,EAAE;CACrD,CAAC;KACD,MAAM,EAAE,CAAC;AAGZ;;;;GAIG;AACU,QAAA,qBAAqB,GAAG,OAAC;KACnC,MAAM,CAAC;IACN,0BAA0B,EAAE,wCAAgC,CAAC,QAAQ,EAAE;IACvE,kBAAkB,EAAE,gCAAwB,CAAC,QAAQ,EAAE;CACxD,CAAC;KACD,MAAM,EAAE;KACR,WAAW,CAAC,CAAC,IAAI,EAAE,GAAG,EAAE,EAAE;IACzB,MAAM,KAAK,GAAG,CAAC,IAAI,CAAC,0BAA0B,EAAE,IAAI,CAAC,kBAAkB,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,KAAK,SAAS,CAAC,CAAC,MAAM,CAAC;IAC7G,IAAI,KAAK,KAAK,CAAC,EAAE,CAAC;QAChB,GAAG,CAAC,QAAQ,CAAC;YACX,IAAI,EAAE,OAAC,CAAC,YAAY,CAAC,MAAM;YAC3B,OAAO,EAAE,6FAA6F;SACvG,CAAC,CAAC;IACL,CAAC;AACH,CAAC,CAAC,CAAC;AAGL,iHAAiH;AACpG,QAAA,6BAA6B,GAAG,OAAC;KAC3C,MAAM,CAAC;IACN,MAAM,EAAE,OAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC;IAClC,eAAe,EAAE,6BAAqB;CACvC,CAAC;KACD,MAAM,EAAE,CAAC;AAQZ,SAAS,kBAAkB,CAAC,EAAmB;IAC7C,IAAI,EAAE,CAAC,0BAA0B;QAAE,OAAO,4BAA4B,CAAC;IACvE,IAAI,EAAE,CAAC,kBAAkB;QAAE,OAAO,oBAAoB,CAAC;IACvD,OAAO,SAAS,CAAC;AACnB,CAAC;AAED,4CAA4C;AAE5C;;;;;;GAMG;AACU,QAAA,+BAA+B,GAAG,OAAC;KAC7C,MAAM,CAAC;IACN,0HAA0H;IAC1H,YAAY,EAAE,sBAAsB;IACpC,uDAAuD;IACvD,eAAe,EAAE,OAAC,CAAC,KAAK,CAAC,OAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,QAAQ,EAAE;IACtD,iCAAiC;IACjC,cAAc,EAAE,OAAC,CAAC,KAAK,CAAC,OAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,QAAQ,EAAE;IACrD,6FAA6F;IAC7F,aAAa,EAAE,OAAC;SACb,KAAK,CACJ,OAAC;SACE,MAAM,EAAE;SACR,GAAG,CAAC,CAAC,CAAC;SACN,GAAG,CAAC,GAAG,CAAC;SACR,KAAK,CAAC,qBAAqB,EAAE,wDAAwD,CAAC,CAC1F;SACA,QAAQ,EAAE;IACb,+BAA+B;IAC/B,YAAY,EAAE,OAAC,CAAC,KAAK,CAAC,mCAA2B,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,EAAE;IACpE,4FAA4F;IAC5F,eAAe,EAAE,6BAAqB,CAAC,QAAQ,EAAE;IACjD,kDAAkD;IAClD,wBAAwB,EAAE,OAAC,CAAC,KAAK,CAAC,qCAA6B,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,EAAE;CACnF,CAAC;KACD,MAAM,EAAE;KACR,WAAW,CAAC,CAAC,IAAI,EAAE,GAAG,EAAE,EAAE;IACzB,MAAM,WAAW,GAAG,IAAI,CAAC,eAAe,IAAI,IAAI,CAAC,eAAe,CAAC,MAAM,GAAG,CAAC,CAAC;IAC5E,MAAM,UAAU,GAAG,IAAI,CAAC,cAAc,IAAI,IAAI,CAAC,cAAc,CAAC,MAAM,GAAG,CAAC,CAAC;IACzE,MAAM,SAAS,GAAG,IAAI,CAAC,aAAa,IAAI,IAAI,CAAC,aAAa,CAAC,MAAM,GAAG,CAAC,CAAC;IACtE,MAAM,SAAS,GAAG,IAAI,CAAC,YAAY,IAAI,IAAI,CAAC,YAAY,CAAC,MAAM,GAAG,CAAC,CAAC;IAEpE,IAAI,CAAC,WAAW,IAAI,CAAC,UAAU,IAAI,CAAC,SAAS,IAAI,CAAC,SAAS,EAAE,CAAC;QAC5D,GAAG,CAAC,QAAQ,CAAC;YACX,IAAI,EAAE,OAAC,CAAC,YAAY,CAAC,MAAM;YAC3B,OAAO,EAAE,kGAAkG;SAC5G,CAAC,CAAC;IACL,CAAC;IAED,gGAAgG;IAChG,gEAAgE;IAChE,MAAM,SAAS,GAAG,IAAI,CAAC,wBAAwB,IAAI,EAAE,CAAC;IACtD,IAAI,SAAS,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACzB,+CAA+C;QAC/C,IAAI,CAAC,IAAI,CAAC,eAAe,EAAE,CAAC;YAC1B,GAAG,CAAC,QAAQ,CAAC;gBACX,IAAI,EAAE,OAAC,CAAC,YAAY,CAAC,MAAM;gBAC3B,OAAO,EAAE,4EAA4E;gBACrF,IAAI,EAAE,CAAC,0BAA0B,CAAC;aACnC,CAAC,CAAC;QACL,CAAC;aAAM,CAAC;YACN,2GAA2G;YAC3G,MAAM,OAAO,GAAG,kBAAkB,CAAC,IAAI,CAAC,eAAe,CAAC,CAAC;YACzD,SAAS,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE;gBACzB,IAAI,kBAAkB,CAAC,CAAC,CAAC,eAAe,CAAC,KAAK,OAAO,EAAE,CAAC;oBACtD,GAAG,CAAC,QAAQ,CAAC;wBACX,IAAI,EAAE,OAAC,CAAC,YAAY,CAAC,MAAM;wBAC3B,OAAO,EACL,0IAA0I;wBAC5I,IAAI,EAAE,CAAC,0BAA0B,EAAE,CAAC,EAAE,iBAAiB,CAAC;qBACzD,CAAC,CAAC;gBACL,CAAC;YACH,CAAC,CAAC,CAAC;QACL,CAAC;QAED,sCAAsC;QACtC,MAAM,IAAI,GAAG,IAAI,GAAG,EAAU,CAAC;QAC/B,SAAS,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE;YACzB,IAAI,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,MAAM,CAAC,EAAE,CAAC;gBACvB,GAAG,CAAC,QAAQ,CAAC;oBACX,IAAI,EAAE,OAAC,CAAC,YAAY,CAAC,MAAM;oBAC3B,OAAO,EAAE,6CAA6C,CAAC,CAAC,MAAM,EAAE;oBAChE,IAAI,EAAE,CAAC,0BAA0B,EAAE,CAAC,EAAE,QAAQ,CAAC;iBAChD,CAAC,CAAC;YACL,CAAC;YACD,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC;QACrB,CAAC,CAAC,CAAC;IACL,CAAC;AACH,CAAC,CAAC,CAAC;AAIL;;;GAGG;AACU,QAAA,sBAAsB,GAAG,OAAC,CAAC,MAAM,CAAC;IAC7C,mBAAmB,EAAE,uCAA+B,CAAC,QAAQ,EAAE;CAChE,CAAC,CAAC;AAIH,sFAAsF;AACzE,QAAA,6BAA6B,GAAG,8BAAsB,CAAC"}

package/dist/schema/schemas/connections.d.ts

@@ -0,0 +1,185 @@
+import { z } from 'zod';
+/**
+ * OAuth grant type for an external gateway, matching the runtime/Smithy model.
+ * The harness runtime maps these to AgentCore Identity auth flows:
+ *   CLIENT_CREDENTIALS -> M2M, AUTHORIZATION_CODE -> USER_FEDERATION, TOKEN_EXCHANGE -> TOKEN_EXCHANGE.
+ */
+export declare const GatewayGrantTypeSchema: z.ZodEnum<{
+    CLIENT_CREDENTIALS: "CLIENT_CREDENTIALS";
+    AUTHORIZATION_CODE: "AUTHORIZATION_CODE";
+    TOKEN_EXCHANGE: "TOKEN_EXCHANGE";
+}>;
+export type GatewayGrantType = z.infer<typeof GatewayGrantTypeSchema>;
+/**
+ * Outbound auth a caller uses to reach an external gateway. This is the union the
+ * gateway/harness runtime actually consumes — NOT the gateway's inbound authorizerType
+ * (which lives on the gateway resource and is invisible to an external caller).
+ *   - awsIam: SigV4-sign with the execution role (grants InvokeGateway)
+ *   - none:   no auth
+ *   - oauth:  fetch an OAuth token via AgentCore Identity (grants token-fetch perms on
+ *             the provider). All four oauth fields are consumed at runtime.
+ */
+export declare const GatewayOutboundAuthSchema: z.ZodUnion<readonly [z.ZodObject<{
+    awsIam: z.ZodObject<{}, z.core.$strict>;
+}, z.core.$strict>, z.ZodObject<{
+    none: z.ZodObject<{}, z.core.$strict>;
+}, z.core.$strict>, z.ZodObject<{
+    oauth: z.ZodObject<{
+        providerArn: z.ZodString;
+        scopes: z.ZodArray<z.ZodString>;
+        grantType: z.ZodOptional<z.ZodEnum<{
+            CLIENT_CREDENTIALS: "CLIENT_CREDENTIALS";
+            AUTHORIZATION_CODE: "AUTHORIZATION_CODE";
+            TOKEN_EXCHANGE: "TOKEN_EXCHANGE";
+        }>>;
+        customParameters: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodString>>;
+    }, z.core.$strict>;
+}, z.core.$strict>]>;
+export type GatewayOutboundAuth = z.infer<typeof GatewayOutboundAuthSchema>;
+export declare const BROWSER_ARN_PATTERN: RegExp;
+export declare const CODE_INTERPRETER_ARN_PATTERN: RegExp;
+export declare const ConnectionTargetSchema: z.ZodDiscriminatedUnion<[z.ZodObject<{
+    type: z.ZodLiteral<"memory">;
+    arn: z.ZodString;
+    namespaces: z.ZodOptional<z.ZodArray<z.ZodString>>;
+}, z.core.$strict>, z.ZodObject<{
+    type: z.ZodLiteral<"gateway">;
+    arn: z.ZodString;
+    outboundAuth: z.ZodOptional<z.ZodUnion<readonly [z.ZodObject<{
+        awsIam: z.ZodObject<{}, z.core.$strict>;
+    }, z.core.$strict>, z.ZodObject<{
+        none: z.ZodObject<{}, z.core.$strict>;
+    }, z.core.$strict>, z.ZodObject<{
+        oauth: z.ZodObject<{
+            providerArn: z.ZodString;
+            scopes: z.ZodArray<z.ZodString>;
+            grantType: z.ZodOptional<z.ZodEnum<{
+                CLIENT_CREDENTIALS: "CLIENT_CREDENTIALS";
+                AUTHORIZATION_CODE: "AUTHORIZATION_CODE";
+                TOKEN_EXCHANGE: "TOKEN_EXCHANGE";
+            }>>;
+            customParameters: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodString>>;
+        }, z.core.$strict>;
+    }, z.core.$strict>]>>;
+}, z.core.$strict>, z.ZodObject<{
+    type: z.ZodLiteral<"runtime">;
+    arn: z.ZodString;
+    exec: z.ZodOptional<z.ZodBoolean>;
+}, z.core.$strict>, z.ZodObject<{
+    type: z.ZodLiteral<"browser">;
+    arn: z.ZodOptional<z.ZodString>;
+}, z.core.$strict>, z.ZodObject<{
+    type: z.ZodLiteral<"codeInterpreter">;
+    arn: z.ZodOptional<z.ZodString>;
+}, z.core.$strict>], "type">;
+export type ConnectionTarget = z.infer<typeof ConnectionTargetSchema>;
+/**
+ * A single connection from the enclosing principal to an external resource.
+ * `access` is meaningful only for memory (read | readwrite); ignored for invoke-only
+ * targets. Defaults to `read` (least-privilege).
+ */
+export declare const ConnectionSchema: z.ZodObject<{
+    id: z.ZodOptional<z.ZodString>;
+    to: z.ZodDiscriminatedUnion<[z.ZodObject<{
+        type: z.ZodLiteral<"memory">;
+        arn: z.ZodString;
+        namespaces: z.ZodOptional<z.ZodArray<z.ZodString>>;
+    }, z.core.$strict>, z.ZodObject<{
+        type: z.ZodLiteral<"gateway">;
+        arn: z.ZodString;
+        outboundAuth: z.ZodOptional<z.ZodUnion<readonly [z.ZodObject<{
+            awsIam: z.ZodObject<{}, z.core.$strict>;
+        }, z.core.$strict>, z.ZodObject<{
+            none: z.ZodObject<{}, z.core.$strict>;
+        }, z.core.$strict>, z.ZodObject<{
+            oauth: z.ZodObject<{
+                providerArn: z.ZodString;
+                scopes: z.ZodArray<z.ZodString>;
+                grantType: z.ZodOptional<z.ZodEnum<{
+                    CLIENT_CREDENTIALS: "CLIENT_CREDENTIALS";
+                    AUTHORIZATION_CODE: "AUTHORIZATION_CODE";
+                    TOKEN_EXCHANGE: "TOKEN_EXCHANGE";
+                }>>;
+                customParameters: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodString>>;
+            }, z.core.$strict>;
+        }, z.core.$strict>]>>;
+    }, z.core.$strict>, z.ZodObject<{
+        type: z.ZodLiteral<"runtime">;
+        arn: z.ZodString;
+        exec: z.ZodOptional<z.ZodBoolean>;
+    }, z.core.$strict>, z.ZodObject<{
+        type: z.ZodLiteral<"browser">;
+        arn: z.ZodOptional<z.ZodString>;
+    }, z.core.$strict>, z.ZodObject<{
+        type: z.ZodLiteral<"codeInterpreter">;
+        arn: z.ZodOptional<z.ZodString>;
+    }, z.core.$strict>], "type">;
+    access: z.ZodOptional<z.ZodEnum<{
+        read: "read";
+        readwrite: "readwrite";
+    }>>;
+    description: z.ZodOptional<z.ZodString>;
+}, z.core.$strict>;
+export type Connection = z.infer<typeof ConnectionSchema>;
+export declare const ConnectionsSchema: z.ZodArray<z.ZodObject<{
+    id: z.ZodOptional<z.ZodString>;
+    to: z.ZodDiscriminatedUnion<[z.ZodObject<{
+        type: z.ZodLiteral<"memory">;
+        arn: z.ZodString;
+        namespaces: z.ZodOptional<z.ZodArray<z.ZodString>>;
+    }, z.core.$strict>, z.ZodObject<{
+        type: z.ZodLiteral<"gateway">;
+        arn: z.ZodString;
+        outboundAuth: z.ZodOptional<z.ZodUnion<readonly [z.ZodObject<{
+            awsIam: z.ZodObject<{}, z.core.$strict>;
+        }, z.core.$strict>, z.ZodObject<{
+            none: z.ZodObject<{}, z.core.$strict>;
+        }, z.core.$strict>, z.ZodObject<{
+            oauth: z.ZodObject<{
+                providerArn: z.ZodString;
+                scopes: z.ZodArray<z.ZodString>;
+                grantType: z.ZodOptional<z.ZodEnum<{
+                    CLIENT_CREDENTIALS: "CLIENT_CREDENTIALS";
+                    AUTHORIZATION_CODE: "AUTHORIZATION_CODE";
+                    TOKEN_EXCHANGE: "TOKEN_EXCHANGE";
+                }>>;
+                customParameters: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodString>>;
+            }, z.core.$strict>;
+        }, z.core.$strict>]>>;
+    }, z.core.$strict>, z.ZodObject<{
+        type: z.ZodLiteral<"runtime">;
+        arn: z.ZodString;
+        exec: z.ZodOptional<z.ZodBoolean>;
+    }, z.core.$strict>, z.ZodObject<{
+        type: z.ZodLiteral<"browser">;
+        arn: z.ZodOptional<z.ZodString>;
+    }, z.core.$strict>, z.ZodObject<{
+        type: z.ZodLiteral<"codeInterpreter">;
+        arn: z.ZodOptional<z.ZodString>;
+    }, z.core.$strict>], "type">;
+    access: z.ZodOptional<z.ZodEnum<{
+        read: "read";
+        readwrite: "readwrite";
+    }>>;
+    description: z.ZodOptional<z.ZodString>;
+}, z.core.$strict>>;
+/** Maximum length of a connection id (matches the ConnectionSchema id regex bound). */
+export declare const CONNECTION_ID_MAX_LENGTH = 64;
+/** Last segment of an ARN (the resource id): `memory/mem-123` -> `mem-123`. */
+export declare function resourceIdFromArn(arn: string): string;
+/**
+ * Stable connection id for an external target: `<kind>-<resourceId>`, sanitized to the schema id
+ * charset and length. Used as the connection's `id` AND as the basis for its discovery env-var
+ * token, so the name baked into generated code matches what deploy injects.
+ */
+export declare function connectionIdForTarget(target: ConnectionTarget): string;
+/** Uppercase, underscore-safe token for env-var naming, derived from a connection id. */
+export declare function connectionEnvToken(id: string): string;
+/**
+ * Resolve the env-var token for a connection. Prefers the explicit `id`; otherwise derives the same
+ * `<kind>-<resourceId>` id the CLI would have assigned — so an id-less connection (schema permits it,
+ * e.g. a hand-authored config or a direct @aws/agentcore-cdk consumer) yields the SAME token on both
+ * sides instead of diverging.
+ */
+export declare function connectionTokenFor(connection: Connection): string;
+//# sourceMappingURL=connections.d.ts.map

package/dist/schema/schemas/connections.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"connections.d.ts","sourceRoot":"","sources":["../../../src/schema/schemas/connections.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAoBxB;;;;GAIG;AACH,eAAO,MAAM,sBAAsB;;;;EAAyE,CAAC;AAC7G,MAAM,MAAM,gBAAgB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,sBAAsB,CAAC,CAAC;AAEtE;;;;;;;;GAQG;AACH,eAAO,MAAM,yBAAyB;;;;;;;;;;;;;;;oBAepC,CAAC;AACH,MAAM,MAAM,mBAAmB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,yBAAyB,CAAC,CAAC;AAW5E,eAAO,MAAM,mBAAmB,QAAgF,CAAC;AACjH,eAAO,MAAM,4BAA4B,QAC+C,CAAC;AAiDzF,eAAO,MAAM,sBAAsB;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;4BAMjC,CAAC;AACH,MAAM,MAAM,gBAAgB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,sBAAsB,CAAC,CAAC;AAEtE;;;;GAIG;AACH,eAAO,MAAM,gBAAgB;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;kBAUlB,CAAC;AACZ,MAAM,MAAM,UAAU,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,gBAAgB,CAAC,CAAC;AAE1D,eAAO,MAAM,iBAAiB;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;mBAA4B,CAAC;AAc3D,uFAAuF;AACvF,eAAO,MAAM,wBAAwB,KAAK,CAAC;AAE3C,+EAA+E;AAC/E,wBAAgB,iBAAiB,CAAC,GAAG,EAAE,MAAM,GAAG,MAAM,CAIrD;AAED;;;;GAIG;AACH,wBAAgB,qBAAqB,CAAC,MAAM,EAAE,gBAAgB,GAAG,MAAM,CAKtE;AAED,yFAAyF;AACzF,wBAAgB,kBAAkB,CAAC,EAAE,EAAE,MAAM,GAAG,MAAM,CAErD;AAED;;;;;GAKG;AACH,wBAAgB,kBAAkB,CAAC,UAAU,EAAE,UAAU,GAAG,MAAM,CAEjE"}