@intentius/chant-lexicon-aws 0.18.22 → 0.18.24

package/dist/types/index.d.ts

@@ -11190,12 +11190,16 @@ export declare class DLMLifecyclePolicy {
 
 export declare class DMSCertificate {
   constructor(props: {
+    /** The certificate Arn */
+    CertificateArn?: string;
+    /** The certificate Identifier */
     CertificateIdentifier?: string;
+    /** The certificate Pem */
     CertificatePem?: string;
+    /** The certificate Wallet */
     CertificateWallet?: string;
-    Id?: string;
   }, attributes?: CFResourceAttributes);
-  readonly Id: string;
+  readonly CertificateArn: string;
 }
 
 export declare class DMSEndpoint {
@@ -13923,6 +13927,37 @@ export declare class ExperimentTemplate {
   readonly Id: string;
 }
 
+export declare class ExperimentTrialComponent {
+  constructor(props: {
+    /** The name of the trial component. The name must be unique in your AWS account and is not case-sensitive. */
+    TrialComponentName: string;
+    /** The Amazon Resource Name (ARN) of the trial component. */
+    Arn?: string;
+    /** When the component was created. */
+    CreationTime?: string;
+    /** The name of the component as displayed. The name doesn't need to be unique. If DisplayName isn't specified, TrialComponentName is displayed. */
+    DisplayName?: string;
+    /** When the component ended. */
+    EndTime?: string;
+    /** When the component was last modified. */
+    LastModifiedTime?: string;
+    /** The Amazon Resource Name (ARN) of the lineage group. */
+    LineageGroupArn?: string;
+    /** Metadata properties of the tracking entity, trial, or trial component. */
+    MetadataProperties?: Record<string, unknown>;
+    /** When the component started. */
+    StartTime?: string;
+    /** The status of the trial component. */
+    Status?: Record<string, unknown>;
+    /** A list of tags to associate with the component. */
+    Tags?: Record<string, unknown>[];
+  }, attributes?: CFResourceAttributes);
+  readonly Arn: string;
+  readonly CreationTime: string;
+  readonly LastModifiedTime: string;
+  readonly LineageGroupArn: string;
+}
+
 export declare class Export {
   constructor(props: {
     Export: Export_Export;
@@ -17659,14 +17694,14 @@ export declare class InstanceGroupConfig {
     JobFlowId: string;
     AutoScalingPolicy?: InstanceGroupConfig_AutoScalingPolicy;
     BidPrice?: string;
-    Configurations?: InstanceGroupConfig_AppConfiguration[];
+    Configurations?: InstanceGroupConfig_Configuration[];
     CustomAmiId?: string;
     EbsConfiguration?: InstanceGroupConfig_EbsConfiguration;
-    InstanceGroupId?: string;
+    Id?: string;
     Market?: string;
     Name?: string;
   }, attributes?: CFResourceAttributes);
-  readonly InstanceGroupId: string;
+  readonly Id: string;
 }
 
 export declare class InstanceProfile {
@@ -19275,6 +19310,18 @@ export declare class KmsKey {
   readonly KeyId: string;
 }
 
+export declare class KnowledgeBasePolicy {
+  constructor(props: {
+    /** The unique identifier of the knowledge base */
+    KnowledgeBaseId: string;
+    /** The IAM policy document defining access permissions for the knowledge base */
+    PolicyDocument: PolicyDocument;
+    /** The revision identifier for the policy, used for optimistic concurrency control */
+    RevisionId?: string;
+  }, attributes?: CFResourceAttributes);
+  readonly RevisionId: string;
+}
+
 export declare class Label {
   constructor(props: {
     /** The name of the label. */
@@ -22905,6 +22952,34 @@ export declare class MonitoringSchedule {
   readonly MonitoringScheduleArn: string;
 }
 
+export declare class MonitoringScheduleAlert {
+  constructor(props: {
+    /** Within EvaluationPeriod, how many execution failures will raise an alert. */
+    DatapointsToAlert: number;
+    /** The number of most recent monitoring executions to consider when evaluating alert status. */
+    EvaluationPeriod: number;
+    /** The name of the monitoring alert. */
+    MonitoringAlertName: string;
+    /** The name of the monitoring schedule. */
+    MonitoringScheduleName: string;
+    /** A list of alert actions taken in response to an alert going into InAlert status. */
+    Actions?: MonitoringScheduleAlert_MonitoringAlertActions;
+    /** The current status of the alert. */
+    AlertStatus?: "InAlert" | "OK";
+    /** The Amazon Resource Name (ARN) of the monitoring schedule alert. */
+    Arn?: string;
+    /** A timestamp that indicates when the alert was created. */
+    CreationTime?: string;
+    /** A timestamp that indicates when the alert was last updated. */
+    LastModifiedTime?: string;
+  }, attributes?: CFResourceAttributes);
+  readonly Actions: MonitoringScheduleAlert_MonitoringAlertActions;
+  readonly AlertStatus: "InAlert" | "OK";
+  readonly Arn: string;
+  readonly CreationTime: string;
+  readonly LastModifiedTime: string;
+}
+
 export declare class MonitoringSubscription {
   constructor(props: {
     /** The ID of the distribution that you are enabling metrics for. */
@@ -34776,6 +34851,23 @@ export declare class TLSInspectionConfiguration {
   readonly TLSInspectionConfigurationId: string;
 }
 
+export declare class TokenVault {
+  constructor(props: {
+    /** The ARN of the token vault. */
+    Arn?: string;
+    /** The KMS configuration for the token vault. */
+    KmsConfiguration?: TokenVault_KmsConfiguration;
+    /** The timestamp when the token vault was last modified. */
+    LastModifiedDate?: string;
+    /** The unique identifier of the token vault. */
+    TokenVaultId?: string;
+  }, attributes?: CFResourceAttributes);
+  readonly Arn: string;
+  readonly KmsConfiguration: TokenVault_KmsConfiguration;
+  readonly LastModifiedDate: string;
+  readonly TokenVaultId: string;
+}
+
 export declare class Topic {
   constructor(props: {
     /** The archive policy determines the number of days SNS retains messages. You can set a retention period from 1 to 365 days. */
@@ -35546,6 +35638,18 @@ export declare class TransitGatewayPolicyTable {
   readonly TransitGatewayPolicyTableId: string;
 }
 
+export declare class TransitGatewayPolicyTableAssociation {
+  constructor(props: {
+    /** The ID of transit gateway attachment. */
+    TransitGatewayAttachmentId: string;
+    /** The ID of transit gateway policy table. */
+    TransitGatewayPolicyTableId: string;
+    /** The state of the transit gateway policy table association. */
+    State?: string;
+  }, attributes?: CFResourceAttributes);
+  readonly State: string;
+}
+
 export declare class TransitGatewayRegistration {
   constructor(props: {
     /** The ID of the global network. */
@@ -36747,12 +36851,42 @@ export declare class Vpc {
     Ipv6CidrBlocks?: string[];
     /** The tags for the VPC. */
     Tags?: Vpc_Tag[];
+    VpcEncryptionControl?: Vpc_VpcEncryptionControl;
     VpcId?: string;
   }, attributes?: CFResourceAttributes);
   readonly CidrBlockAssociations: string[];
   readonly DefaultNetworkAcl: string;
   readonly DefaultSecurityGroup: string;
   readonly Ipv6CidrBlocks: string[];
+  readonly VpcEncryptionControl_ResourceExclusions: string;
+  readonly VpcEncryptionControl_ResourceExclusions_EgressOnlyInternetGateway: string;
+  readonly VpcEncryptionControl_ResourceExclusions_EgressOnlyInternetGateway_State: string;
+  readonly VpcEncryptionControl_ResourceExclusions_EgressOnlyInternetGateway_StateMessage: string;
+  readonly VpcEncryptionControl_ResourceExclusions_ElasticFileSystem: string;
+  readonly VpcEncryptionControl_ResourceExclusions_ElasticFileSystem_State: string;
+  readonly VpcEncryptionControl_ResourceExclusions_ElasticFileSystem_StateMessage: string;
+  readonly VpcEncryptionControl_ResourceExclusions_InternetGateway: string;
+  readonly VpcEncryptionControl_ResourceExclusions_InternetGateway_State: string;
+  readonly VpcEncryptionControl_ResourceExclusions_InternetGateway_StateMessage: string;
+  readonly VpcEncryptionControl_ResourceExclusions_Lambda: string;
+  readonly VpcEncryptionControl_ResourceExclusions_Lambda_State: string;
+  readonly VpcEncryptionControl_ResourceExclusions_Lambda_StateMessage: string;
+  readonly VpcEncryptionControl_ResourceExclusions_NatGateway: string;
+  readonly VpcEncryptionControl_ResourceExclusions_NatGateway_State: string;
+  readonly VpcEncryptionControl_ResourceExclusions_NatGateway_StateMessage: string;
+  readonly VpcEncryptionControl_ResourceExclusions_VirtualPrivateGateway: string;
+  readonly VpcEncryptionControl_ResourceExclusions_VirtualPrivateGateway_State: string;
+  readonly VpcEncryptionControl_ResourceExclusions_VirtualPrivateGateway_StateMessage: string;
+  readonly VpcEncryptionControl_ResourceExclusions_VpcLattice: string;
+  readonly VpcEncryptionControl_ResourceExclusions_VpcLattice_State: string;
+  readonly VpcEncryptionControl_ResourceExclusions_VpcLattice_StateMessage: string;
+  readonly VpcEncryptionControl_ResourceExclusions_VpcPeering: string;
+  readonly VpcEncryptionControl_ResourceExclusions_VpcPeering_State: string;
+  readonly VpcEncryptionControl_ResourceExclusions_VpcPeering_StateMessage: string;
+  readonly VpcEncryptionControl_State: string;
+  readonly VpcEncryptionControl_StateMessage: string;
+  readonly VpcEncryptionControl_VpcEncryptionControlId: string;
+  readonly VpcEncryptionControl_VpcId: string;
   readonly VpcId: string;
 }
 
@@ -41557,14 +41691,6 @@ export declare class AppConfigResourceObject {
   });
 }
 
-export declare class AppConfiguration {
-  constructor(props: {
-    Classification?: string;
-    ConfigurationProperties?: Record<string, unknown>;
-    Configurations?: InstanceGroupConfig_AppConfiguration[];
-  });
-}
-
 export declare class AppCookieStickinessPolicy {
   constructor(props: {
     /** The name of the application cookie used for stickiness. */
@@ -79140,26 +79266,24 @@ export declare class InstanceFleetConfig_SpotResizingSpecification {
   });
 }
 
-export declare class InstanceGroupConfig_AppConfiguration {
+export declare class InstanceGroupConfig_AutoScalingPolicy {
   constructor(props: {
-    Classification?: string;
-    ConfigurationProperties?: Record<string, unknown>;
-    Configurations?: InstanceGroupConfig_AppConfiguration[];
+    Constraints: InstanceGroupConfig_ScalingConstraints;
+    Rules: InstanceGroupConfig_ScalingRule[];
   });
 }
 
-export declare class InstanceGroupConfig_AutoScalingPolicy {
+export declare class InstanceGroupConfig_Configuration {
   constructor(props: {
-    Constraints: InstanceGroupConfig_ScalingConstraints;
-    Rules: InstanceGroupConfig_ScalingRule[];
+    Classification?: string;
+    ConfigurationProperties?: Record<string, unknown>;
+    Configurations?: InstanceGroupConfig_Configuration[];
   });
 }
 
 export declare class InstanceGroupConfig_EbsBlockDeviceConfig {
   constructor(props: {
     VolumeSpecification: InstanceGroupConfig_VolumeSpecification;
-    /** Use of this property can confuse CloudFormation drift detection. The EbsBlockDeviceConfigs read from the system may return a list with one entry per volume, replacing any entry specified in the template with a VolumesPerInstance greater than one by that many entries containing only the VolumeSpecification. Thus to avoid false drift detection, it is recommended to supply repeated entries in EbsBlockDeviceConfigs for any VolumeSpecification which is intended to be repeated and not to use this property.
- */
     VolumesPerInstance?: number;
   });
 }
@@ -82945,6 +83069,15 @@ export declare class KinesisVideoStreamConfig {
   });
 }
 
+export declare class KmsConfiguration {
+  constructor(props: {
+    /** The type of KMS key (CustomerManagedKey or ServiceManagedKey). */
+    KeyType: "CustomerManagedKey" | "ServiceManagedKey";
+    /** The Amazon Resource Name (ARN) of the KMS key. */
+    KmsKeyArn?: string;
+  });
+}
+
 export declare class KmsEncryptionConfig {
   constructor(props: {
     /** The type of customer-managed-key (CMK) used for encryption. The two types of supported CMKs are customer owned CMKs and AWS owned CMKs. */
@@ -85435,6 +85568,7 @@ export declare class ListenerRule_RuleCondition {
 
 export declare class ListenerRule_SourceIpConfig {
   constructor(props: {
+    IpAddressType?: string;
     /** The source IP addresses, in CIDR format. You can use both IPv4 and IPv6 addresses. Wildcards are not supported.
  If you specify multiple addresses, the condition is satisfied if the source IP address of the request matches one of the CIDR blocks. This condition is not satisfied by the addresses in the X-Forwarded-For header. */
     Values?: string[];
@@ -91054,6 +91188,13 @@ export declare class ModelCardExportOutputConfig {
   });
 }
 
+export declare class ModelDashboardIndicatorAction {
+  constructor(props: {
+    /** Indicates whether the alert action is turned on. */
+    Enabled?: boolean;
+  });
+}
+
 export declare class ModelDataQuality {
   constructor(props: {
     Constraints?: ModelPackage_MetricsSource;
@@ -92044,6 +92185,12 @@ export declare class Monitoring {
   });
 }
 
+export declare class MonitoringAlertActions {
+  constructor(props: {
+    ModelDashboardIndicator?: MonitoringScheduleAlert_ModelDashboardIndicatorAction;
+  });
+}
+
 export declare class MonitoringAppSpecification {
   constructor(props: {
     /** The container image to be run by the monitoring job. */
@@ -92213,6 +92360,19 @@ export declare class MonitoringSchedule_Tag {
   });
 }
 
+export declare class MonitoringScheduleAlert_ModelDashboardIndicatorAction {
+  constructor(props: {
+    /** Indicates whether the alert action is turned on. */
+    Enabled?: boolean;
+  });
+}
+
+export declare class MonitoringScheduleAlert_MonitoringAlertActions {
+  constructor(props: {
+    ModelDashboardIndicator?: MonitoringScheduleAlert_ModelDashboardIndicatorAction;
+  });
+}
+
 export declare class MonitoringScheduleConfig {
   constructor(props: {
     MonitoringJobDefinition?: MonitoringSchedule_MonitoringJobDefinition;
@@ -113399,6 +113559,7 @@ export declare class SourceDataSettings {
 
 export declare class SourceIpConfig {
   constructor(props: {
+    IpAddressType?: string;
     /** The source IP addresses, in CIDR format. You can use both IPv4 and IPv6 addresses. Wildcards are not supported.
  If you specify multiple addresses, the condition is satisfied if the source IP address of the request matches one of the CIDR blocks. This condition is not satisfied by the addresses in the X-Forwarded-For header. */
     Values?: string[];
@@ -118111,6 +118272,15 @@ export declare class TokenValidityUnits {
   });
 }
 
+export declare class TokenVault_KmsConfiguration {
+  constructor(props: {
+    /** The type of KMS key (CustomerManagedKey or ServiceManagedKey). */
+    KeyType: "CustomerManagedKey" | "ServiceManagedKey";
+    /** The Amazon Resource Name (ARN) of the KMS key. */
+    KmsKeyArn?: string;
+  });
+}
+
 export declare class ToolbarConfiguration {
   constructor(props: {
     HiddenToolbarItems?: UserSettings_ToolbarItem[];
@@ -121646,6 +121816,60 @@ export declare class Vpc_Tag {
   });
 }
 
+export declare class Vpc_VpcEncryptionControl {
+  constructor(props: {
+    /** The desired exclusion mode for Egress-Only Internet Gateways. */
+    EgressOnlyInternetGatewayExclusion?: "disable" | "enable";
+    /** The desired exclusion mode for Elastic File System. */
+    ElasticFileSystemExclusion?: "disable" | "enable";
+    /** The desired exclusion mode for Internet Gateways. */
+    InternetGatewayExclusion?: "disable" | "enable";
+    /** The desired exclusion mode for Lambda. */
+    LambdaExclusion?: "disable" | "enable";
+    /** The mode of the VPC encryption control. */
+    Mode?: "enforce" | "monitor";
+    /** The desired exclusion mode for NAT Gateways. */
+    NatGatewayExclusion?: "disable" | "enable";
+    ResourceExclusions?: Vpc_VpcEncryptionControlExclusions;
+    /** The state of the VPC encryption control. */
+    State?: string;
+    /** A message describing the state of the VPC encryption control. */
+    StateMessage?: string;
+    /** The desired exclusion mode for Virtual Private Gateways. */
+    VirtualPrivateGatewayExclusion?: "disable" | "enable";
+    /** The ID of the VPC encryption control. */
+    VpcEncryptionControlId?: string;
+    /** The ID of the VPC. */
+    VpcId?: string;
+    /** The desired exclusion mode for VPC Lattice. */
+    VpcLatticeExclusion?: "disable" | "enable";
+    /** The desired exclusion mode for VPC Peering. */
+    VpcPeeringExclusion?: "disable" | "enable";
+  });
+}
+
+export declare class Vpc_VpcEncryptionControlExclusion {
+  constructor(props: {
+    /** The exclusion state of the resource type. */
+    State?: string;
+    /** A message describing the exclusion state of the resource type. */
+    StateMessage?: string;
+  });
+}
+
+export declare class Vpc_VpcEncryptionControlExclusions {
+  constructor(props: {
+    EgressOnlyInternetGateway?: Vpc_VpcEncryptionControlExclusion;
+    ElasticFileSystem?: Vpc_VpcEncryptionControlExclusion;
+    InternetGateway?: Vpc_VpcEncryptionControlExclusion;
+    Lambda?: Vpc_VpcEncryptionControlExclusion;
+    NatGateway?: Vpc_VpcEncryptionControlExclusion;
+    VirtualPrivateGateway?: Vpc_VpcEncryptionControlExclusion;
+    VpcLattice?: Vpc_VpcEncryptionControlExclusion;
+    VpcPeering?: Vpc_VpcEncryptionControlExclusion;
+  });
+}
+
 export declare class VpcAttachment_ProposedNetworkFunctionGroupChange {
   constructor(props: {
     /** The rule number in the policy document that applies to this change. */
@@ -121774,6 +121998,38 @@ export declare class VpcEgressConfiguration {
   });
 }
 
+export declare class VpcEncryptionControl {
+  constructor(props: {
+    /** The desired exclusion mode for Egress-Only Internet Gateways. */
+    EgressOnlyInternetGatewayExclusion?: "disable" | "enable";
+    /** The desired exclusion mode for Elastic File System. */
+    ElasticFileSystemExclusion?: "disable" | "enable";
+    /** The desired exclusion mode for Internet Gateways. */
+    InternetGatewayExclusion?: "disable" | "enable";
+    /** The desired exclusion mode for Lambda. */
+    LambdaExclusion?: "disable" | "enable";
+    /** The mode of the VPC encryption control. */
+    Mode?: "enforce" | "monitor";
+    /** The desired exclusion mode for NAT Gateways. */
+    NatGatewayExclusion?: "disable" | "enable";
+    ResourceExclusions?: Vpc_VpcEncryptionControlExclusions;
+    /** The state of the VPC encryption control. */
+    State?: string;
+    /** A message describing the state of the VPC encryption control. */
+    StateMessage?: string;
+    /** The desired exclusion mode for Virtual Private Gateways. */
+    VirtualPrivateGatewayExclusion?: "disable" | "enable";
+    /** The ID of the VPC encryption control. */
+    VpcEncryptionControlId?: string;
+    /** The ID of the VPC. */
+    VpcId?: string;
+    /** The desired exclusion mode for VPC Lattice. */
+    VpcLatticeExclusion?: "disable" | "enable";
+    /** The desired exclusion mode for VPC Peering. */
+    VpcPeeringExclusion?: "disable" | "enable";
+  });
+}
+
 export declare class VPCEncryptionControl_ResourceExclusions {
   constructor(props: {
     EgressOnlyInternetGateway?: VPCEncryptionControl_VpcEncryptionControlExclusion;
@@ -121803,10 +122059,16 @@ export declare class VPCEncryptionControl_VpcEncryptionControlExclusion {
   });
 }
 
-export declare class VpcEncryptionControlExclusion {
+export declare class VpcEncryptionControlExclusions {
   constructor(props: {
-    State?: string;
-    StateMessage?: string;
+    EgressOnlyInternetGateway?: Vpc_VpcEncryptionControlExclusion;
+    ElasticFileSystem?: Vpc_VpcEncryptionControlExclusion;
+    InternetGateway?: Vpc_VpcEncryptionControlExclusion;
+    Lambda?: Vpc_VpcEncryptionControlExclusion;
+    NatGateway?: Vpc_VpcEncryptionControlExclusion;
+    VirtualPrivateGateway?: Vpc_VpcEncryptionControlExclusion;
+    VpcLattice?: Vpc_VpcEncryptionControlExclusion;
+    VpcPeering?: Vpc_VpcEncryptionControlExclusion;
   });
 }
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@intentius/chant-lexicon-aws",
-  "version": "0.18.22",
+  "version": "0.18.24",
   "description": "AWS CloudFormation lexicon for chant — declarative IaC in TypeScript",
   "license": "Apache-2.0",
   "homepage": "https://intentius.io/chant",
@@ -80,7 +80,7 @@
     "typescript": "^5.9.3"
   },
   "peerDependencies": {
-    "@intentius/chant": "^0.18.22",
+    "@intentius/chant": "^0.18.24",
     "typescript": "^5.9.3"
   }
 }

package/src/composites/agentcore-agent.test.ts

@@ -84,6 +84,63 @@ describe("AgentCoreAgent", () => {
     expect(networkProps.NetworkModeConfig).toBeUndefined();
   });
 
+  test("code-config path wires CodeConfiguration (S3 zip on a managed runtime) instead of a container", () => {
+    const instance = AgentCoreAgent({
+      name: "support-agent",
+      code: {
+        s3Bucket: "loom-artifacts",
+        s3Prefix: "agents/assistant.zip",
+        runtime: "PYTHON_3_12",
+        entryPoint: ["app.py"],
+      },
+    });
+    const artifactProps = ((instance.runtime as any).props.AgentRuntimeArtifact as any).props;
+    expect(artifactProps.ContainerConfiguration).toBeUndefined();
+    const codeProps = (artifactProps.CodeConfiguration as any).props;
+    expect(codeProps.Runtime).toBe("PYTHON_3_12");
+    expect(codeProps.EntryPoint).toEqual(["app.py"]);
+    const s3 = (codeProps.Code as any).props.S3;
+    expect(s3).toEqual({ Bucket: "loom-artifacts", Prefix: "agents/assistant.zip" });
+  });
+
+  test("code-config VersionId is threaded through only when supplied", () => {
+    const withVersion = AgentCoreAgent({
+      name: "support-agent",
+      code: { s3Bucket: "b", s3Prefix: "k.zip", runtime: "PYTHON_3_12", entryPoint: ["app.py"], s3VersionId: "v1" },
+    });
+    const s3 = (((withVersion.runtime as any).props.AgentRuntimeArtifact as any).props.CodeConfiguration as any).props.Code.props.S3;
+    expect(s3.VersionId).toBe("v1");
+  });
+
+  test("throws when neither containerUri nor code is supplied", () => {
+    expect(() => AgentCoreAgent({ name: "support-agent" } as any)).toThrow(
+      "AgentCoreAgent requires exactly one of containerUri or code",
+    );
+  });
+
+  test("throws when both containerUri and code are supplied", () => {
+    expect(() => AgentCoreAgent({
+      ...baseProps,
+      code: { s3Bucket: "b", s3Prefix: "k.zip", runtime: "PYTHON_3_12", entryPoint: ["app.py"] },
+    })).toThrow("AgentCoreAgent requires exactly one of containerUri or code");
+  });
+
+  test("code-config serializes to a valid CloudFormation Runtime resource", () => {
+    const expanded = expandComposite("agent", AgentCoreAgent({
+      name: "support-agent",
+      code: { s3Bucket: "loom-artifacts", s3Prefix: "agents/assistant.zip", runtime: "PYTHON_3_12", entryPoint: ["app.py"] },
+    }));
+    resolveAttrRefs(expanded);
+    const template = JSON.parse(awsSerializer.serialize(expanded));
+    const artifact = template.Resources.agentRuntime.Properties.AgentRuntimeArtifact;
+    expect(artifact.ContainerConfiguration).toBeUndefined();
+    expect(artifact.CodeConfiguration).toEqual({
+      Code: { S3: { Bucket: "loom-artifacts", Prefix: "agents/assistant.zip" } },
+      EntryPoint: ["app.py"],
+      Runtime: "PYTHON_3_12",
+    });
+  });
+
   test("VPC network mode wires NetworkModeConfig from vpcSubnetIds/vpcSecurityGroupIds", () => {
     const instance = AgentCoreAgent({
       ...baseProps,

package/src/composites/agentcore-agent.ts

@@ -4,6 +4,8 @@ import {
   Role_Policy,
   Runtime,
   Runtime_AgentRuntimeArtifact,
+  Runtime_Code,
+  Runtime_CodeConfiguration,
   Runtime_ContainerConfiguration,
   Runtime_NetworkConfiguration,
   Runtime_VpcConfig,
@@ -13,6 +15,20 @@ import {
   GatewayTarget,
   WorkloadIdentity,
 } from "../generated";
+
+/**
+ * Managed language runtimes AgentCore can run a code-config zip on. Inlined
+ * from the generated `Runtime_AgentManagedRuntimeType` CFN enum (which the
+ * generated barrel exports as a type declaration only), matching how
+ * `protocolConfiguration`/`gatewayAuthorizerType` inline their enums below.
+ */
+export type AgentManagedRuntime =
+  | "NODE_22"
+  | "PYTHON_3_10"
+  | "PYTHON_3_11"
+  | "PYTHON_3_12"
+  | "PYTHON_3_13"
+  | "PYTHON_3_14";
 import { agentCoreTrustPolicy } from "./agentcore-trust-policy";
 
 /**
@@ -31,6 +47,26 @@ function toRuntimeIdentifier(name: string): string {
   return identifier.slice(0, 48);
 }
 
+/**
+ * Managed-runtime code artifact — the S3-zip alternative to `containerUri`.
+ * Mirrors CFN `Runtime.CodeConfiguration`: AgentCore runs a zipped agent on
+ * a managed language runtime, no container image to build or host. This is
+ * how a Strands agent actually ships (a Python zip in S3), which is why the
+ * composite offers it alongside the container path.
+ */
+export interface AgentCoreCodeArtifact {
+  /** S3 bucket holding the agent's zipped code. */
+  s3Bucket: string;
+  /** S3 key (or prefix) of the zip within `s3Bucket`. */
+  s3Prefix: string;
+  /** Optional S3 object version id, pinning a specific upload. */
+  s3VersionId?: string;
+  /** Managed runtime the zip runs on, e.g. `"PYTHON_3_12"`. Mirrors the generated CFN enum. */
+  runtime: AgentManagedRuntime;
+  /** Entry point, 1-2 items — e.g. `["app.py"]` or `["python", "app.py"]` (CFN bounds the list to 2). */
+  entryPoint: string[];
+}
+
 export interface AgentCoreAgentProps {
   /**
    * Base name for the agent's resources. `toRuntimeIdentifier(name)` derives
@@ -38,8 +74,16 @@ export interface AgentCoreAgentProps {
    * WorkloadIdentity use `name` as-is (hyphens are valid there).
    */
   name: string;
-  /** ECR image URI the Runtime runs, e.g. `"123456789012.dkr.ecr.us-east-1.amazonaws.com/agent:latest"`. */
-  containerUri: string;
+  /**
+   * ECR image URI the Runtime runs, e.g. `"123456789012.dkr.ecr.us-east-1.amazonaws.com/agent:latest"`.
+   * Supply exactly one of `containerUri` or `code`.
+   */
+  containerUri?: string;
+  /**
+   * S3-zip code artifact run on a managed runtime — the alternative to
+   * `containerUri`. Supply exactly one of the two.
+   */
+  code?: AgentCoreCodeArtifact;
   /** Runtime network mode. Default: "PUBLIC". */
   networkMode?: "PUBLIC" | "VPC";
   /** Subnets for the Runtime's ENIs. Required when `networkMode` is "VPC". */
@@ -106,6 +150,12 @@ export type AgentCoreAgentResult = {
  */
 export const AgentCoreAgent = Composite<AgentCoreAgentProps, AgentCoreAgentResult>((props) => {
   const { defaults } = props;
+  // Exactly one artifact source. Both-or-neither is a modeling mistake CFN
+  // would also reject (AgentRuntimeArtifact is a one-of), caught here so the
+  // error names the composite prop rather than a raw CFN validation string.
+  if ((props.containerUri === undefined) === (props.code === undefined)) {
+    throw new Error("AgentCoreAgent requires exactly one of containerUri or code");
+  }
   const networkMode = props.networkMode ?? "PUBLIC";
   // Check presence, not `.length`: a cross-stack value (Fn::Split of a Parameter,
   // the shape stackOutput/Ref/Split produce) is a truthy intrinsic object with no
@@ -146,13 +196,32 @@ export const AgentCoreAgent = Composite<AgentCoreAgentProps, AgentCoreAgentResul
       : undefined,
   });
 
-  const runtime = new Runtime(mergeDefaults({
-    AgentRuntimeName: runtimeName,
-    AgentRuntimeArtifact: new Runtime_AgentRuntimeArtifact({
+  // CFN `Code.S3` is a free-form location object in the generated type; its
+  // keys (Bucket/Prefix/VersionId) come straight from the CloudFormation
+  // schema for AWS::BedrockAgentCore::Runtime.
+  const artifact = props.code
+    ? new Runtime_AgentRuntimeArtifact({
+      CodeConfiguration: new Runtime_CodeConfiguration({
+        Code: new Runtime_Code({
+          S3: {
+            Bucket: props.code.s3Bucket,
+            Prefix: props.code.s3Prefix,
+            ...(props.code.s3VersionId !== undefined ? { VersionId: props.code.s3VersionId } : {}),
+          },
+        }),
+        EntryPoint: props.code.entryPoint,
+        Runtime: props.code.runtime,
+      }),
+    })
+    : new Runtime_AgentRuntimeArtifact({
       ContainerConfiguration: new Runtime_ContainerConfiguration({
-        ContainerUri: props.containerUri,
+        ContainerUri: props.containerUri as string,
       }),
-    }),
+    });
+
+  const runtime = new Runtime(mergeDefaults({
+    AgentRuntimeName: runtimeName,
+    AgentRuntimeArtifact: artifact,
     RoleArn: role.Arn,
     NetworkConfiguration: networkConfiguration,
     ProtocolConfiguration: props.protocolConfiguration ?? "MCP",