@intentius/chant-lexicon-aws 0.18.23 → 0.18.25

package/dist/types/index.d.ts

@@ -8659,30 +8659,30 @@ export declare class DataSyncAgent {
 
 export declare class DataTable {
   constructor(props: {
+    /** The identifier of the Amazon Connect instance. */
+    InstanceArn: string;
+    /** The name of the Data Table */
+    Name: string;
+    /** The status of the Data Table */
+    Status: "PUBLISHED";
+    /** The time zone of the Data Table */
+    TimeZone: string;
+    /** The value lock level of the Data Table */
+    ValueLockLevel: "ATTRIBUTE" | "DATA_TABLE" | "NONE" | "PRIMARY_VALUE" | "VALUE";
     /** The arn of the Data Table */
     Arn?: string;
     /** The creation time of the Data Table */
     CreatedTime?: number;
     /** The description of the Data Table. */
     Description?: string;
-    /** The identifier of the Amazon Connect instance. */
-    InstanceArn?: string;
     /** Last modified region. */
     LastModifiedRegion?: string;
     /** Last modified time. */
     LastModifiedTime?: number;
     /** The lock version of the Data Table */
     LockVersion?: Record<string, unknown>;
-    /** The name of the Data Table */
-    Name?: string;
-    /** The status of the Data Table */
-    Status?: "PUBLISHED";
     /** One or more tags. */
     Tags?: DataTable_Tag[];
-    /** The time zone of the Data Table */
-    TimeZone?: string;
-    /** The value lock level of the Data Table */
-    ValueLockLevel?: "ATTRIBUTE" | "DATA_TABLE" | "NONE" | "PRIMARY_VALUE" | "VALUE";
   }, attributes?: CFResourceAttributes);
   readonly Arn: string;
   readonly CreatedTime: number;
@@ -8693,17 +8693,17 @@ export declare class DataTable {
 
 export declare class DataTableAttribute {
   constructor(props: {
+    DataTableArn: string;
+    InstanceArn: string;
+    Name: string;
+    ValueType: "BOOLEAN" | "NUMBER" | "NUMBER_LIST" | "TEXT" | "TEXT_LIST";
     AttributeId?: string;
-    DataTableArn?: string;
     Description?: string;
-    InstanceArn?: string;
     LastModifiedRegion?: string;
     LastModifiedTime?: number;
     LockVersion?: Record<string, unknown>;
-    Name?: string;
     Primary?: boolean;
     Validation?: Record<string, unknown>;
-    ValueType?: "BOOLEAN" | "NUMBER" | "NUMBER_LIST" | "TEXT" | "TEXT_LIST";
   }, attributes?: CFResourceAttributes);
   readonly AttributeId: string;
   readonly LastModifiedRegion: string;
@@ -8713,9 +8713,9 @@ export declare class DataTableAttribute {
 
 export declare class DataTableRecord {
   constructor(props: {
-    DataTableArn?: string;
-    DataTableRecord?: Record<string, unknown>;
-    InstanceArn?: string;
+    DataTableArn: string;
+    DataTableRecord: Record<string, unknown>;
+    InstanceArn: string;
     RecordId?: string;
   }, attributes?: CFResourceAttributes);
   readonly RecordId: string;
@@ -11190,12 +11190,16 @@ export declare class DLMLifecyclePolicy {
 
 export declare class DMSCertificate {
   constructor(props: {
+    /** The certificate Arn */
+    CertificateArn?: string;
+    /** The certificate Identifier */
     CertificateIdentifier?: string;
+    /** The certificate Pem */
     CertificatePem?: string;
+    /** The certificate Wallet */
     CertificateWallet?: string;
-    Id?: string;
   }, attributes?: CFResourceAttributes);
-  readonly Id: string;
+  readonly CertificateArn: string;
 }
 
 export declare class DMSEndpoint {
@@ -17690,14 +17694,14 @@ export declare class InstanceGroupConfig {
     JobFlowId: string;
     AutoScalingPolicy?: InstanceGroupConfig_AutoScalingPolicy;
     BidPrice?: string;
-    Configurations?: InstanceGroupConfig_AppConfiguration[];
+    Configurations?: InstanceGroupConfig_Configuration[];
     CustomAmiId?: string;
     EbsConfiguration?: InstanceGroupConfig_EbsConfiguration;
-    InstanceGroupId?: string;
+    Id?: string;
     Market?: string;
     Name?: string;
   }, attributes?: CFResourceAttributes);
-  readonly InstanceGroupId: string;
+  readonly Id: string;
 }
 
 export declare class InstanceProfile {
@@ -19306,6 +19310,18 @@ export declare class KmsKey {
   readonly KeyId: string;
 }
 
+export declare class KnowledgeBasePolicy {
+  constructor(props: {
+    /** The unique identifier of the knowledge base */
+    KnowledgeBaseId: string;
+    /** The IAM policy document defining access permissions for the knowledge base */
+    PolicyDocument: PolicyDocument;
+    /** The revision identifier for the policy, used for optimistic concurrency control */
+    RevisionId?: string;
+  }, attributes?: CFResourceAttributes);
+  readonly RevisionId: string;
+}
+
 export declare class Label {
   constructor(props: {
     /** The name of the label. */
@@ -34835,6 +34851,23 @@ export declare class TLSInspectionConfiguration {
   readonly TLSInspectionConfigurationId: string;
 }
 
+export declare class TokenVault {
+  constructor(props: {
+    /** The ARN of the token vault. */
+    Arn?: string;
+    /** The KMS configuration for the token vault. */
+    KmsConfiguration?: TokenVault_KmsConfiguration;
+    /** The timestamp when the token vault was last modified. */
+    LastModifiedDate?: string;
+    /** The unique identifier of the token vault. */
+    TokenVaultId?: string;
+  }, attributes?: CFResourceAttributes);
+  readonly Arn: string;
+  readonly KmsConfiguration: TokenVault_KmsConfiguration;
+  readonly LastModifiedDate: string;
+  readonly TokenVaultId: string;
+}
+
 export declare class Topic {
   constructor(props: {
     /** The archive policy determines the number of days SNS retains messages. You can set a retention period from 1 to 365 days. */
@@ -35605,6 +35638,18 @@ export declare class TransitGatewayPolicyTable {
   readonly TransitGatewayPolicyTableId: string;
 }
 
+export declare class TransitGatewayPolicyTableAssociation {
+  constructor(props: {
+    /** The ID of transit gateway attachment. */
+    TransitGatewayAttachmentId: string;
+    /** The ID of transit gateway policy table. */
+    TransitGatewayPolicyTableId: string;
+    /** The state of the transit gateway policy table association. */
+    State?: string;
+  }, attributes?: CFResourceAttributes);
+  readonly State: string;
+}
+
 export declare class TransitGatewayRegistration {
   constructor(props: {
     /** The ID of the global network. */
@@ -36806,12 +36851,42 @@ export declare class Vpc {
     Ipv6CidrBlocks?: string[];
     /** The tags for the VPC. */
     Tags?: Vpc_Tag[];
+    VpcEncryptionControl?: Vpc_VpcEncryptionControl;
     VpcId?: string;
   }, attributes?: CFResourceAttributes);
   readonly CidrBlockAssociations: string[];
   readonly DefaultNetworkAcl: string;
   readonly DefaultSecurityGroup: string;
   readonly Ipv6CidrBlocks: string[];
+  readonly VpcEncryptionControl_ResourceExclusions: string;
+  readonly VpcEncryptionControl_ResourceExclusions_EgressOnlyInternetGateway: string;
+  readonly VpcEncryptionControl_ResourceExclusions_EgressOnlyInternetGateway_State: string;
+  readonly VpcEncryptionControl_ResourceExclusions_EgressOnlyInternetGateway_StateMessage: string;
+  readonly VpcEncryptionControl_ResourceExclusions_ElasticFileSystem: string;
+  readonly VpcEncryptionControl_ResourceExclusions_ElasticFileSystem_State: string;
+  readonly VpcEncryptionControl_ResourceExclusions_ElasticFileSystem_StateMessage: string;
+  readonly VpcEncryptionControl_ResourceExclusions_InternetGateway: string;
+  readonly VpcEncryptionControl_ResourceExclusions_InternetGateway_State: string;
+  readonly VpcEncryptionControl_ResourceExclusions_InternetGateway_StateMessage: string;
+  readonly VpcEncryptionControl_ResourceExclusions_Lambda: string;
+  readonly VpcEncryptionControl_ResourceExclusions_Lambda_State: string;
+  readonly VpcEncryptionControl_ResourceExclusions_Lambda_StateMessage: string;
+  readonly VpcEncryptionControl_ResourceExclusions_NatGateway: string;
+  readonly VpcEncryptionControl_ResourceExclusions_NatGateway_State: string;
+  readonly VpcEncryptionControl_ResourceExclusions_NatGateway_StateMessage: string;
+  readonly VpcEncryptionControl_ResourceExclusions_VirtualPrivateGateway: string;
+  readonly VpcEncryptionControl_ResourceExclusions_VirtualPrivateGateway_State: string;
+  readonly VpcEncryptionControl_ResourceExclusions_VirtualPrivateGateway_StateMessage: string;
+  readonly VpcEncryptionControl_ResourceExclusions_VpcLattice: string;
+  readonly VpcEncryptionControl_ResourceExclusions_VpcLattice_State: string;
+  readonly VpcEncryptionControl_ResourceExclusions_VpcLattice_StateMessage: string;
+  readonly VpcEncryptionControl_ResourceExclusions_VpcPeering: string;
+  readonly VpcEncryptionControl_ResourceExclusions_VpcPeering_State: string;
+  readonly VpcEncryptionControl_ResourceExclusions_VpcPeering_StateMessage: string;
+  readonly VpcEncryptionControl_State: string;
+  readonly VpcEncryptionControl_StateMessage: string;
+  readonly VpcEncryptionControl_VpcEncryptionControlId: string;
+  readonly VpcEncryptionControl_VpcId: string;
   readonly VpcId: string;
 }
 
@@ -41616,14 +41691,6 @@ export declare class AppConfigResourceObject {
   });
 }
 
-export declare class AppConfiguration {
-  constructor(props: {
-    Classification?: string;
-    ConfigurationProperties?: Record<string, unknown>;
-    Configurations?: InstanceGroupConfig_AppConfiguration[];
-  });
-}
-
 export declare class AppCookieStickinessPolicy {
   constructor(props: {
     /** The name of the application cookie used for stickiness. */
@@ -79199,26 +79266,24 @@ export declare class InstanceFleetConfig_SpotResizingSpecification {
   });
 }
 
-export declare class InstanceGroupConfig_AppConfiguration {
+export declare class InstanceGroupConfig_AutoScalingPolicy {
   constructor(props: {
-    Classification?: string;
-    ConfigurationProperties?: Record<string, unknown>;
-    Configurations?: InstanceGroupConfig_AppConfiguration[];
+    Constraints: InstanceGroupConfig_ScalingConstraints;
+    Rules: InstanceGroupConfig_ScalingRule[];
   });
 }
 
-export declare class InstanceGroupConfig_AutoScalingPolicy {
+export declare class InstanceGroupConfig_Configuration {
   constructor(props: {
-    Constraints: InstanceGroupConfig_ScalingConstraints;
-    Rules: InstanceGroupConfig_ScalingRule[];
+    Classification?: string;
+    ConfigurationProperties?: Record<string, unknown>;
+    Configurations?: InstanceGroupConfig_Configuration[];
   });
 }
 
 export declare class InstanceGroupConfig_EbsBlockDeviceConfig {
   constructor(props: {
     VolumeSpecification: InstanceGroupConfig_VolumeSpecification;
-    /** Use of this property can confuse CloudFormation drift detection. The EbsBlockDeviceConfigs read from the system may return a list with one entry per volume, replacing any entry specified in the template with a VolumesPerInstance greater than one by that many entries containing only the VolumeSpecification. Thus to avoid false drift detection, it is recommended to supply repeated entries in EbsBlockDeviceConfigs for any VolumeSpecification which is intended to be repeated and not to use this property.
- */
     VolumesPerInstance?: number;
   });
 }
@@ -83004,6 +83069,15 @@ export declare class KinesisVideoStreamConfig {
   });
 }
 
+export declare class KmsConfiguration {
+  constructor(props: {
+    /** The type of KMS key (CustomerManagedKey or ServiceManagedKey). */
+    KeyType: "CustomerManagedKey" | "ServiceManagedKey";
+    /** The Amazon Resource Name (ARN) of the KMS key. */
+    KmsKeyArn?: string;
+  });
+}
+
 export declare class KmsEncryptionConfig {
   constructor(props: {
     /** The type of customer-managed-key (CMK) used for encryption. The two types of supported CMKs are customer owned CMKs and AWS owned CMKs. */
@@ -85494,6 +85568,7 @@ export declare class ListenerRule_RuleCondition {
 
 export declare class ListenerRule_SourceIpConfig {
   constructor(props: {
+    IpAddressType?: string;
     /** The source IP addresses, in CIDR format. You can use both IPv4 and IPv6 addresses. Wildcards are not supported.
  If you specify multiple addresses, the condition is satisfied if the source IP address of the request matches one of the CIDR blocks. This condition is not satisfied by the addresses in the X-Forwarded-For header. */
     Values?: string[];
@@ -113484,6 +113559,7 @@ export declare class SourceDataSettings {
 
 export declare class SourceIpConfig {
   constructor(props: {
+    IpAddressType?: string;
     /** The source IP addresses, in CIDR format. You can use both IPv4 and IPv6 addresses. Wildcards are not supported.
  If you specify multiple addresses, the condition is satisfied if the source IP address of the request matches one of the CIDR blocks. This condition is not satisfied by the addresses in the X-Forwarded-For header. */
     Values?: string[];
@@ -118196,6 +118272,15 @@ export declare class TokenValidityUnits {
   });
 }
 
+export declare class TokenVault_KmsConfiguration {
+  constructor(props: {
+    /** The type of KMS key (CustomerManagedKey or ServiceManagedKey). */
+    KeyType: "CustomerManagedKey" | "ServiceManagedKey";
+    /** The Amazon Resource Name (ARN) of the KMS key. */
+    KmsKeyArn?: string;
+  });
+}
+
 export declare class ToolbarConfiguration {
   constructor(props: {
     HiddenToolbarItems?: UserSettings_ToolbarItem[];
@@ -121731,6 +121816,60 @@ export declare class Vpc_Tag {
   });
 }
 
+export declare class Vpc_VpcEncryptionControl {
+  constructor(props: {
+    /** The desired exclusion mode for Egress-Only Internet Gateways. */
+    EgressOnlyInternetGatewayExclusion?: "disable" | "enable";
+    /** The desired exclusion mode for Elastic File System. */
+    ElasticFileSystemExclusion?: "disable" | "enable";
+    /** The desired exclusion mode for Internet Gateways. */
+    InternetGatewayExclusion?: "disable" | "enable";
+    /** The desired exclusion mode for Lambda. */
+    LambdaExclusion?: "disable" | "enable";
+    /** The mode of the VPC encryption control. */
+    Mode?: "enforce" | "monitor";
+    /** The desired exclusion mode for NAT Gateways. */
+    NatGatewayExclusion?: "disable" | "enable";
+    ResourceExclusions?: Vpc_VpcEncryptionControlExclusions;
+    /** The state of the VPC encryption control. */
+    State?: string;
+    /** A message describing the state of the VPC encryption control. */
+    StateMessage?: string;
+    /** The desired exclusion mode for Virtual Private Gateways. */
+    VirtualPrivateGatewayExclusion?: "disable" | "enable";
+    /** The ID of the VPC encryption control. */
+    VpcEncryptionControlId?: string;
+    /** The ID of the VPC. */
+    VpcId?: string;
+    /** The desired exclusion mode for VPC Lattice. */
+    VpcLatticeExclusion?: "disable" | "enable";
+    /** The desired exclusion mode for VPC Peering. */
+    VpcPeeringExclusion?: "disable" | "enable";
+  });
+}
+
+export declare class Vpc_VpcEncryptionControlExclusion {
+  constructor(props: {
+    /** The exclusion state of the resource type. */
+    State?: string;
+    /** A message describing the exclusion state of the resource type. */
+    StateMessage?: string;
+  });
+}
+
+export declare class Vpc_VpcEncryptionControlExclusions {
+  constructor(props: {
+    EgressOnlyInternetGateway?: Vpc_VpcEncryptionControlExclusion;
+    ElasticFileSystem?: Vpc_VpcEncryptionControlExclusion;
+    InternetGateway?: Vpc_VpcEncryptionControlExclusion;
+    Lambda?: Vpc_VpcEncryptionControlExclusion;
+    NatGateway?: Vpc_VpcEncryptionControlExclusion;
+    VirtualPrivateGateway?: Vpc_VpcEncryptionControlExclusion;
+    VpcLattice?: Vpc_VpcEncryptionControlExclusion;
+    VpcPeering?: Vpc_VpcEncryptionControlExclusion;
+  });
+}
+
 export declare class VpcAttachment_ProposedNetworkFunctionGroupChange {
   constructor(props: {
     /** The rule number in the policy document that applies to this change. */
@@ -121859,6 +121998,38 @@ export declare class VpcEgressConfiguration {
   });
 }
 
+export declare class VpcEncryptionControl {
+  constructor(props: {
+    /** The desired exclusion mode for Egress-Only Internet Gateways. */
+    EgressOnlyInternetGatewayExclusion?: "disable" | "enable";
+    /** The desired exclusion mode for Elastic File System. */
+    ElasticFileSystemExclusion?: "disable" | "enable";
+    /** The desired exclusion mode for Internet Gateways. */
+    InternetGatewayExclusion?: "disable" | "enable";
+    /** The desired exclusion mode for Lambda. */
+    LambdaExclusion?: "disable" | "enable";
+    /** The mode of the VPC encryption control. */
+    Mode?: "enforce" | "monitor";
+    /** The desired exclusion mode for NAT Gateways. */
+    NatGatewayExclusion?: "disable" | "enable";
+    ResourceExclusions?: Vpc_VpcEncryptionControlExclusions;
+    /** The state of the VPC encryption control. */
+    State?: string;
+    /** A message describing the state of the VPC encryption control. */
+    StateMessage?: string;
+    /** The desired exclusion mode for Virtual Private Gateways. */
+    VirtualPrivateGatewayExclusion?: "disable" | "enable";
+    /** The ID of the VPC encryption control. */
+    VpcEncryptionControlId?: string;
+    /** The ID of the VPC. */
+    VpcId?: string;
+    /** The desired exclusion mode for VPC Lattice. */
+    VpcLatticeExclusion?: "disable" | "enable";
+    /** The desired exclusion mode for VPC Peering. */
+    VpcPeeringExclusion?: "disable" | "enable";
+  });
+}
+
 export declare class VPCEncryptionControl_ResourceExclusions {
   constructor(props: {
     EgressOnlyInternetGateway?: VPCEncryptionControl_VpcEncryptionControlExclusion;
@@ -121888,10 +122059,16 @@ export declare class VPCEncryptionControl_VpcEncryptionControlExclusion {
   });
 }
 
-export declare class VpcEncryptionControlExclusion {
+export declare class VpcEncryptionControlExclusions {
   constructor(props: {
-    State?: string;
-    StateMessage?: string;
+    EgressOnlyInternetGateway?: Vpc_VpcEncryptionControlExclusion;
+    ElasticFileSystem?: Vpc_VpcEncryptionControlExclusion;
+    InternetGateway?: Vpc_VpcEncryptionControlExclusion;
+    Lambda?: Vpc_VpcEncryptionControlExclusion;
+    NatGateway?: Vpc_VpcEncryptionControlExclusion;
+    VirtualPrivateGateway?: Vpc_VpcEncryptionControlExclusion;
+    VpcLattice?: Vpc_VpcEncryptionControlExclusion;
+    VpcPeering?: Vpc_VpcEncryptionControlExclusion;
   });
 }
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@intentius/chant-lexicon-aws",
-  "version": "0.18.23",
+  "version": "0.18.25",
   "description": "AWS CloudFormation lexicon for chant — declarative IaC in TypeScript",
   "license": "Apache-2.0",
   "homepage": "https://intentius.io/chant",
@@ -80,7 +80,7 @@
     "typescript": "^5.9.3"
   },
   "peerDependencies": {
-    "@intentius/chant": "^0.18.23",
+    "@intentius/chant": "^0.18.25",
     "typescript": "^5.9.3"
   }
 }

package/src/composites/agentcore-agent.test.ts

@@ -15,13 +15,24 @@ const baseProps = {
   containerUri: "123456789012.dkr.ecr.us-east-1.amazonaws.com/support-agent:latest",
 };
 
+// The endpoint is opt-in (#978) — it races the Runtime's async version-READY when
+// created in the same apply. Tests that exercise the endpoint pass this variant.
+const withEndpoint = { ...baseProps, provisionEndpoint: true };
+
 describe("AgentCoreAgent", () => {
-  test("returns all 8 members", () => {
+  test("returns 7 members by default; the endpoint is opt-in (#978)", () => {
     const instance = AgentCoreAgent(baseProps);
     expect(Object.keys(instance.members)).toEqual([
-      "role", "gatewayRole", "runtime", "endpoint", "memory",
+      "role", "gatewayRole", "runtime", "memory",
       "workloadIdentity", "gateway", "gatewayTarget",
     ]);
+    expect((instance as any).endpoint).toBeUndefined();
+  });
+
+  test("provisionEndpoint adds the endpoint as an 8th member", () => {
+    const instance = AgentCoreAgent(withEndpoint);
+    expect(Object.keys(instance.members)).toContain("endpoint");
+    expect(Object.keys(instance.members)).toHaveLength(8);
   });
 
   test("expandComposite produces correct logical names", () => {
@@ -29,12 +40,14 @@ describe("AgentCoreAgent", () => {
     expect(expanded.has("agentRole")).toBe(true);
     expect(expanded.has("agentGatewayRole")).toBe(true);
     expect(expanded.has("agentRuntime")).toBe(true);
-    expect(expanded.has("agentEndpoint")).toBe(true);
+    expect(expanded.has("agentEndpoint")).toBe(false); // opt-in (#978)
     expect(expanded.has("agentMemory")).toBe(true);
     expect(expanded.has("agentWorkloadIdentity")).toBe(true);
     expect(expanded.has("agentGateway")).toBe(true);
     expect(expanded.has("agentGatewayTarget")).toBe(true);
-    expect(expanded.size).toBe(8);
+    expect(expanded.size).toBe(7);
+    // With the endpoint opted in, it appears as agentEndpoint.
+    expect(expandComposite("agent", AgentCoreAgent(withEndpoint)).has("agentEndpoint")).toBe(true);
   });
 
   test("role and gatewayRole trust bedrock-agentcore.amazonaws.com", () => {
@@ -50,7 +63,7 @@ describe("AgentCoreAgent", () => {
   });
 
   test("kebab-case name is sanitized for Runtime/RuntimeEndpoint/Memory (no hyphens)", () => {
-    const instance = AgentCoreAgent(baseProps);
+    const instance = AgentCoreAgent(withEndpoint);
     const runtimeProps = (instance.runtime as any).props;
     const endpointProps = (instance.endpoint as any).props;
     const memoryProps = (instance.memory as any).props;
@@ -182,8 +195,8 @@ describe("AgentCoreAgent", () => {
     );
   });
 
-  test("RuntimeEndpoint references runtime.AgentRuntimeId", () => {
-    const instance = AgentCoreAgent(baseProps);
+  test("RuntimeEndpoint references runtime.AgentRuntimeId (when opted in)", () => {
+    const instance = AgentCoreAgent(withEndpoint);
     const endpointProps = (instance.endpoint as any).props;
     expect(endpointProps.AgentRuntimeId).toBeInstanceOf(AttrRef);
   });
@@ -222,7 +235,7 @@ describe("AgentCoreAgent", () => {
 
   test("per-member defaults are applied (e.g. custom endpoint description)", () => {
     const instance = AgentCoreAgent({
-      ...baseProps,
+      ...withEndpoint,
       defaults: { endpoint: { Description: "prod alias" } },
     });
     const endpointProps = (instance.endpoint as any).props;
@@ -230,7 +243,7 @@ describe("AgentCoreAgent", () => {
   });
 
   test("serializes to a valid CloudFormation template with the expected resource types", () => {
-    const expanded = expandComposite("agent", AgentCoreAgent(baseProps));
+    const expanded = expandComposite("agent", AgentCoreAgent(withEndpoint));
     resolveAttrRefs(expanded);
     const output = awsSerializer.serialize(expanded);
     const template = JSON.parse(output);

package/src/composites/agentcore-agent.ts

@@ -96,6 +96,18 @@ export interface AgentCoreAgentProps {
   environmentVariables?: Record<string, string>;
   /** RuntimeEndpoint name — the alias a version-promotion capability would repoint (deferred, see #882). Default: "DEFAULT". */
   endpointName?: string;
+  /**
+   * Create the `RuntimeEndpoint` in this template. **Default: false.** A
+   * RuntimeEndpoint can only be created once the Runtime's agent *version* is
+   * READY, which is asynchronous and is NOT gated by the Runtime resource's own
+   * CloudFormation `CREATE_COMPLETE` — so creating the endpoint in the same apply
+   * as the Runtime races and fails on a real deploy ("Agent version 1 must be in
+   * READY status. Current status: CREATING", #978). Leave this off and create the
+   * endpoint out-of-band once the runtime is READY — which is what Bedrock
+   * AgentCore's own tooling (and Loom's app) does. Opt in only when you know the
+   * Runtime will already be READY (e.g. a version-promotion flow on an existing runtime).
+   */
+  provisionEndpoint?: boolean;
   /** Memory event retention, in days. CFN bounds: 3-365. Default: 30. */
   memoryEventExpiryDays?: number;
   /** Gateway authorizer. Mirrors the generated `BedrockAgentCoreGateway_AuthorizerType` CFN enum. Default: "AWS_IAM". */
@@ -122,7 +134,8 @@ export type AgentCoreAgentResult = {
   role: InstanceType<typeof Role>;
   gatewayRole: InstanceType<typeof Role>;
   runtime: InstanceType<typeof Runtime>;
-  endpoint: InstanceType<typeof RuntimeEndpoint>;
+  /** Present only when `provisionEndpoint` is set — see that prop (#978). */
+  endpoint?: InstanceType<typeof RuntimeEndpoint>;
   memory: InstanceType<typeof Memory>;
   workloadIdentity: InstanceType<typeof WorkloadIdentity>;
   gateway: InstanceType<typeof BedrockAgentCoreGateway>;
@@ -228,10 +241,14 @@ export const AgentCoreAgent = Composite<AgentCoreAgentProps, AgentCoreAgentResul
     EnvironmentVariables: props.environmentVariables,
   }, defaults?.runtime));
 
-  const endpoint = new RuntimeEndpoint(mergeDefaults({
-    AgentRuntimeId: runtime.AgentRuntimeId,
-    Name: toRuntimeIdentifier(props.endpointName ?? "DEFAULT"),
-  }, defaults?.endpoint));
+  // Opt-in only (#978): the endpoint races the Runtime's async version-READY when
+  // created in the same apply. Off by default; create it out-of-band post-READY.
+  const endpoint = props.provisionEndpoint
+    ? new RuntimeEndpoint(mergeDefaults({
+        AgentRuntimeId: runtime.AgentRuntimeId,
+        Name: toRuntimeIdentifier(props.endpointName ?? "DEFAULT"),
+      }, defaults?.endpoint))
+    : undefined;
 
   const memory = new Memory(mergeDefaults({
     Name: `${runtimeName}Memory`.slice(0, 48),
@@ -264,5 +281,5 @@ export const AgentCoreAgent = Composite<AgentCoreAgentProps, AgentCoreAgentResul
     },
   }, defaults?.gatewayTarget));
 
-  return { role, gatewayRole, runtime, endpoint, memory, workloadIdentity, gateway, gatewayTarget };
+  return { role, gatewayRole, runtime, ...(endpoint ? { endpoint } : {}), memory, workloadIdentity, gateway, gatewayTarget };
 }, "AgentCoreAgent");