agentcore-cli 0.31.1__py3-none-any.whl

agentcore/schema/schemas/primitives/harness.py

@@ -0,0 +1,710 @@
+"""Harness spec, i.e. per-harness harness.json (port of ``primitives/harness.ts``)."""
+
+from __future__ import annotations
+
+import re
+from typing import Annotated, Any, ClassVar, Final, Literal, get_args
+
+from pydantic import AfterValidator, BeforeValidator, Field, ValidationError, model_validator
+
+from ..._zod import (
+    JS_WHITESPACE,
+    Issue,
+    PassthroughModel,
+    StrictModel,
+    ZodModel,
+    array_checks,
+    js_len,
+    js_regex,
+    js_trim,
+    raise_issues,
+    unique_by,
+    zint,
+    znum,
+    zstr,
+)
+from ...constants import MAX_CONTAINER_BUILD_SECURITY_GROUPS, NetworkMode, is_container_build
+from ..agent_env import (
+    EfsAccessPointConfig,
+    LifecycleConfiguration,
+    NetworkConfig,
+    S3FilesAccessPointConfig,
+    SessionStorageMountPath,
+)
+from ..auth import AuthorizerConfig, RuntimeAuthorizerType
+from ..connections import Connection
+from .tags import Tags
+
+# ECR image URI, mirroring the CFN ContainerConfiguration.ContainerUri constraint.
+CONTAINER_URI_PATTERN: Final = js_regex(
+    r"^(([0-9]{12})\.dkr\.ecr\.([a-z0-9-]+)\.amazonaws\.com(\.cn)?|public\.ecr\.aws)\/"
+    r"((?:[a-z0-9]+(?:[._-][a-z0-9]+)*\/)*[a-z0-9]+(?:[._-][a-z0-9]+)*)(?::([^:@]{1,300}))?(?:@(.+))?$"
+)
+MAX_CONTAINER_URI_LENGTH: Final = 1024
+# CFN EnvironmentVariables value maxLength and map maxProperties.
+MAX_ENV_VAR_VALUE_LENGTH: Final = 5000
+MAX_ENV_VARS: Final = 50
+# Smithy EnvironmentVariableKey length bounds (1–100, no char pattern).
+MAX_ENV_VAR_KEY_LENGTH: Final = 100
+
+# ============================================================================
+# Harness Name
+# ============================================================================
+
+HarnessName = zstr(
+    min=1,
+    max=40,
+    min_msg="Harness name is required",
+    pattern=r"^[a-zA-Z][a-zA-Z0-9_]{0,39}$",
+    pattern_msg="Must begin with a letter and contain only alphanumeric characters and underscores (max 40 chars)",
+)
+
+# ============================================================================
+# Model Configuration
+# ============================================================================
+
+HarnessModelProvider = Literal["bedrock", "open_ai", "gemini", "lite_llm"]
+HARNESS_MODEL_PROVIDERS: Final[tuple[HarnessModelProvider, ...]] = get_args(HarnessModelProvider)
+
+# Max length of the LiteLLM apiBase URL (Smithy: HarnessLiteLlmApiBase, 1–16383).
+MAX_LITE_LLM_API_BASE_LENGTH: Final = 16383
+
+BedrockApiFormat = Literal["converse_stream", "responses", "chat_completions"]
+BEDROCK_API_FORMATS: Final[tuple[BedrockApiFormat, ...]] = get_args(BedrockApiFormat)
+
+OpenAiApiFormat = Literal["responses", "chat_completions"]
+OPEN_AI_API_FORMATS: Final[tuple[OpenAiApiFormat, ...]] = get_args(OpenAiApiFormat)
+
+HarnessApiFormat = Literal["converse_stream", "responses", "chat_completions"]
+HARNESS_API_FORMATS: Final[tuple[HarnessApiFormat, ...]] = get_args(HarnessApiFormat)
+
+
+class HarnessModel(ZodModel):
+    provider: HarnessModelProvider
+    model_id: zstr(min=1, min_msg="Model ID is required")
+    api_key_arn: str | None = None
+    api_format: HarnessApiFormat | None = None
+    temperature: znum(ge=0, le=2) | None = None
+    top_p: znum(ge=0, le=1) | None = None
+    top_k: zint(ge=0, le=500) | None = None
+    max_tokens: zint(ge=1) | None = None
+    # LiteLLM only: base URL for the third-party model provider's API endpoint.
+    api_base: zstr(min=1, max=MAX_LITE_LLM_API_BASE_LENGTH) | None = None
+    # LiteLLM only: provider-specific parameters passed through unchanged.
+    additional_params: dict[str, Any] | None = None
+
+    @model_validator(mode="after")
+    def _refine(self) -> HarnessModel:
+        issues: list[Issue] = []
+        if self.top_k is not None and self.provider != "gemini":
+            issues.append((("topK",), 'topK is only supported for the "gemini" provider'))
+        if self.api_format is not None:
+            if self.provider not in ("bedrock", "open_ai"):
+                issues.append((("apiFormat",), "--api-format is only supported for bedrock and open_ai providers"))
+            elif self.provider == "open_ai" and self.api_format == "converse_stream":
+                issues.append(
+                    (
+                        ("apiFormat",),
+                        f"Invalid API format for open_ai: {self.api_format}. Use {', '.join(OPEN_AI_API_FORMATS)}",
+                    )
+                )
+        # CFN requires ApiKeyArn for the open_ai and gemini model configs.
+        if self.api_key_arn is None and self.provider in ("open_ai", "gemini"):
+            issues.append((("apiKeyArn",), f'apiKeyArn is required for the "{self.provider}" provider'))
+        if self.api_base is not None and self.provider != "lite_llm":
+            issues.append((("apiBase",), 'apiBase is only supported for the "lite_llm" provider'))
+        if self.additional_params is not None and self.provider != "lite_llm":
+            issues.append((("additionalParams",), 'additionalParams is only supported for the "lite_llm" provider'))
+        raise_issues(issues, self)
+        return self
+
+
+def validate_api_format(api_format: str, provider: str) -> dict[str, Any]:
+    """Returns ``{"valid": True}`` or ``{"valid": False, "error": str}`` (port of ``validateApiFormat``)."""
+    if api_format not in HARNESS_API_FORMATS:
+        return {"valid": False, "error": f"Invalid API format: {api_format}. Use {', '.join(HARNESS_API_FORMATS)}"}
+    if provider not in ("bedrock", "open_ai"):
+        return {"valid": False, "error": "--api-format is only supported for bedrock and open_ai providers"}
+    try:
+        HarnessModel.model_validate({"provider": provider, "modelId": "placeholder", "apiFormat": api_format})
+    except ValidationError as e:
+        if any("apiFormat" in err["loc"] for err in e.errors()):
+            formats = OPEN_AI_API_FORMATS if provider == "open_ai" else BEDROCK_API_FORMATS
+            return {
+                "valid": False,
+                "error": f"Invalid API format for {provider}: {api_format}. Use {', '.join(formats)}",
+            }
+    return {"valid": True}
+
+
+# ============================================================================
+# Tool Configuration
+# ============================================================================
+
+HarnessToolType = Literal[
+    "remote_mcp",
+    "agentcore_browser",
+    "agentcore_gateway",
+    "inline_function",
+    "agentcore_code_interpreter",
+]
+HARNESS_TOOL_TYPES: Final[tuple[HarnessToolType, ...]] = get_args(HarnessToolType)
+
+HarnessToolName = zstr(
+    min=1,
+    max=64,
+    pattern=r"^[a-zA-Z0-9_-]+$",
+    pattern_msg="Tool name must contain only alphanumeric characters, hyphens, and underscores (1-64 chars)",
+)
+
+
+class EmptyObject(ZodModel):
+    """``z.object({})`` (unknown keys stripped)."""
+
+
+class RemoteMcp(ZodModel):
+    url: zstr(min=1)
+    headers: dict[str, str] | None = None
+
+
+class RemoteMcpConfig(ZodModel):
+    KEY: ClassVar[str] = "remoteMcp"
+    remote_mcp: RemoteMcp
+
+
+class AgentCoreBrowser(ZodModel):
+    browser_arn: str | None = None
+
+
+class AgentCoreBrowserConfig(ZodModel):
+    KEY: ClassVar[str] = "agentCoreBrowser"
+    agent_core_browser: AgentCoreBrowser
+
+
+class AgentCoreCodeInterpreter(ZodModel):
+    code_interpreter_arn: str | None = None
+
+
+class AgentCoreCodeInterpreterConfig(ZodModel):
+    KEY: ClassVar[str] = "agentCoreCodeInterpreter"
+    agent_core_code_interpreter: AgentCoreCodeInterpreter
+
+
+GatewayOAuthGrantType = Literal["CLIENT_CREDENTIALS", "USER_FEDERATION"]
+GATEWAY_OAUTH_GRANT_TYPES: Final[tuple[GatewayOAuthGrantType, ...]] = get_args(GatewayOAuthGrantType)
+
+
+class HarnessGatewayOAuth(ZodModel):
+    provider_arn: zstr(min=1)
+    scopes: list[zstr(min=1)]
+    grant_type: GatewayOAuthGrantType | None = None
+    custom_parameters: dict[str, str] | None = None
+
+
+class HarnessAwsIamOutboundAuth(ZodModel):
+    aws_iam: EmptyObject
+
+
+class HarnessNoneOutboundAuth(ZodModel):
+    none: EmptyObject
+
+
+class HarnessOAuthOutboundAuth(ZodModel):
+    oauth: HarnessGatewayOAuth
+
+
+HarnessGatewayOutboundAuth = Annotated[
+    HarnessAwsIamOutboundAuth | HarnessNoneOutboundAuth | HarnessOAuthOutboundAuth,
+    Field(union_mode="left_to_right"),
+]
+
+
+class HarnessAgentCoreGateway(PassthroughModel):
+    gateway_arn: zstr(min=1)
+    outbound_auth: HarnessGatewayOutboundAuth | None = None
+
+    @model_validator(mode="after")
+    def _refine(self) -> HarnessAgentCoreGateway:
+        if "credentialProviderName" in (self.model_extra or {}):
+            raise_issues(
+                [
+                    (
+                        ("credentialProviderName",),
+                        (
+                            "credentialProviderName is no longer supported. Use outboundAuth instead. Example: "
+                            'outboundAuth: { awsIam: {} } or outboundAuth: { oauth: { providerArn: "...", scopes: [...] } }'
+                        ),
+                    )
+                ],
+                self,
+            )
+        return self
+
+
+class AgentCoreGatewayConfig(ZodModel):
+    KEY: ClassVar[str] = "agentCoreGateway"
+    agent_core_gateway: HarnessAgentCoreGateway
+
+
+class InlineFunction(ZodModel):
+    description: zstr(min=1)
+    input_schema: dict[str, Any]
+
+
+class InlineFunctionConfig(ZodModel):
+    KEY: ClassVar[str] = "inlineFunction"
+    inline_function: InlineFunction
+
+
+HarnessToolConfig = Annotated[
+    RemoteMcpConfig
+    | AgentCoreBrowserConfig
+    | AgentCoreCodeInterpreterConfig
+    | AgentCoreGatewayConfig
+    | InlineFunctionConfig,
+    Field(union_mode="left_to_right"),
+]
+
+_TOOL_TYPE_TO_CONFIG_KEY: Final[dict[str, str]] = {
+    "remote_mcp": "remoteMcp",
+    "agentcore_browser": "agentCoreBrowser",
+    "agentcore_gateway": "agentCoreGateway",
+    "inline_function": "inlineFunction",
+    "agentcore_code_interpreter": "agentCoreCodeInterpreter",
+}
+
+_TOOL_TYPES_REQUIRING_CONFIG: Final = frozenset({"remote_mcp", "agentcore_gateway", "inline_function"})
+
+
+class HarnessTool(ZodModel):
+    type: HarnessToolType
+    name: HarnessToolName
+    config: HarnessToolConfig | None = None
+
+    @model_validator(mode="after")
+    def _refine(self) -> HarnessTool:
+        expected = _TOOL_TYPE_TO_CONFIG_KEY[self.type]
+        if self.config is None:
+            if self.type in _TOOL_TYPES_REQUIRING_CONFIG:
+                raise_issues([(("config",), f'Tool type "{self.type}" requires a "{expected}" config')], self)
+            return self
+        if self.config.KEY != expected:
+            raise_issues(
+                [
+                    (
+                        ("config",),
+                        f'Tool type "{self.type}" requires "{expected}" config, got "{self.config.KEY}"',
+                    )
+                ],
+                self,
+            )
+        return self
+
+
+# ============================================================================
+# Memory Reference
+# ============================================================================
+
+
+class HarnessMemoryRetrievalConfig(StrictModel):
+    """Per-namespace retrieval tuning, fanned out by the CDK to every namespace of the memory."""
+
+    top_k: zint(ge=1) | None = None
+    relevance_score: znum(ge=0, le=1) | None = None
+
+    @model_validator(mode="after")
+    def _refine(self) -> HarnessMemoryRetrievalConfig:
+        # An empty {} fans out to per-namespace {} objects, which crashed the pre-v6 service handler.
+        if self.top_k is None and self.relevance_score is None:
+            raise_issues([((), "retrievalConfig must specify at least one of topK or relevanceScore")], self)
+        return self
+
+
+# Managed harness memory excludes CUSTOM (CFN ManagedMemoryConfiguration.Strategies enum).
+ManagedMemoryStrategy = Literal["SEMANTIC", "SUMMARIZATION", "USER_PREFERENCE", "EPISODIC"]
+MANAGED_MEMORY_STRATEGIES: Final[tuple[ManagedMemoryStrategy, ...]] = get_args(ManagedMemoryStrategy)
+
+
+class ManagedMemoryRef(StrictModel):
+    """The harness creates and owns its memory. ``strategies`` is only written when explicitly tuned."""
+
+    mode: Literal["managed"]
+    strategies: Annotated[list[ManagedMemoryStrategy], array_checks(min=1, max=4)] | None = None
+    event_expiry_duration: zint(ge=3, le=365) | None = None
+    encryption_key_arn: zstr(min=1) | None = None
+
+
+class ExistingMemoryRef(StrictModel):
+    """Bring-your-own memory referenced by sibling ``name`` or ``arn``."""
+
+    mode: Literal["existing"]
+    name: zstr(min=1) | None = None
+    arn: zstr(min=1) | None = None
+    actor_id: str | None = None
+    # Limits how many recent memory messages are loaded into context (CFN MessagesCount).
+    messages_count: zint(ge=1) | None = None
+    retrieval_config: HarnessMemoryRetrievalConfig | None = None
+
+    @model_validator(mode="after")
+    def _refine(self) -> ExistingMemoryRef:
+        issues: list[Issue] = []
+        if self.arn is None and self.name is None:
+            issues.append((("name",), "existing memory requires `arn` or `name`"))
+        # At synth `arn` wins over `name`, so any by-arn ref resolves no strategies and the tuning
+        # would be silently dropped; gate on `arn` alone.
+        if self.arn and self.retrieval_config is not None:
+            issues.append(
+                (
+                    ("retrievalConfig",),
+                    (
+                        "retrievalConfig is not supported when memory is referenced by `arn` (per-namespace tuning is "
+                        "only resolvable for a by-name reference). Reference the memory by `name` only, or drop "
+                        "retrievalConfig."
+                    ),
+                )
+            )
+        raise_issues(issues, self)
+        return self
+
+
+class DisabledMemoryRef(StrictModel):
+    """Explicit opt-out of memory."""
+
+    mode: Literal["disabled"]
+
+
+def _legacy_memory_ref(value: Any) -> Any:
+    # Legacy flat shape ({ name | arn | ... }) -> the `existing` arm. Absent memory stays absent.
+    if isinstance(value, dict) and "mode" not in value:
+        return {"mode": "existing", **value}
+    return value
+
+
+HarnessMemoryRef = Annotated[
+    ManagedMemoryRef | ExistingMemoryRef | DisabledMemoryRef,
+    Field(discriminator="mode"),
+    BeforeValidator(_legacy_memory_ref),
+]
+
+# ============================================================================
+# Truncation Configuration
+# ============================================================================
+
+HarnessTruncationStrategy = Literal["sliding_window", "summarization", "none"]
+HARNESS_TRUNCATION_STRATEGIES: Final[tuple[HarnessTruncationStrategy, ...]] = get_args(HarnessTruncationStrategy)
+
+
+class SlidingWindow(ZodModel):
+    messages_count: zint(ge=1) | None = None
+
+
+class SlidingWindowConfig(StrictModel):
+    # Strict outer object so a payload carrying both arms fails the union instead of dropping one.
+    sliding_window: SlidingWindow
+
+
+class Summarization(ZodModel):
+    summary_ratio: znum(ge=0, le=1) | None = None
+    preserve_recent_messages: zint(ge=0) | None = None
+    summarization_system_prompt: str | None = None
+
+
+class SummarizationConfig(StrictModel):
+    summarization: Summarization
+
+
+_TRUNCATION_CONFIG_KEY: Final[dict[str, str | None]] = {
+    "sliding_window": "slidingWindow",
+    "summarization": "summarization",
+    "none": None,
+}
+
+
+class HarnessTruncationConfig(ZodModel):
+    strategy: HarnessTruncationStrategy
+    config: Annotated[SlidingWindowConfig | SummarizationConfig, Field(union_mode="left_to_right")] | None = None
+
+    @model_validator(mode="after")
+    def _refine(self) -> HarnessTruncationConfig:
+        if self.config is None:
+            return self
+        config_key = "slidingWindow" if isinstance(self.config, SlidingWindowConfig) else "summarization"
+        expected = _TRUNCATION_CONFIG_KEY[self.strategy]
+        if expected is None:
+            raise_issues([(("config",), f'Truncation strategy "{self.strategy}" does not take a config')], self)
+        elif expected != config_key:
+            raise_issues(
+                [
+                    (
+                        ("config",),
+                        f'Truncation strategy "{self.strategy}" requires a "{expected}" config, got "{config_key}"',
+                    )
+                ],
+                self,
+            )
+        return self
+
+
+# ============================================================================
+# Skill Configuration
+# ============================================================================
+
+
+class HarnessSkillGitAuth(ZodModel):
+    credential_name: zstr(min=1)
+    username: str | None = None
+
+
+class HarnessSkillS3Source(StrictModel):
+    s3_uri: zstr(min=5, pattern=r"^s3:\/\/", pattern_msg="Must be an S3 URI starting with s3://")
+
+
+class HarnessSkillGitSource(StrictModel):
+    git_url: zstr(min=8, pattern=r"^https:\/\/", pattern_msg="Must be an HTTPS git URL")
+    path: zstr(min=1) | None = None
+    auth: HarnessSkillGitAuth | None = None
+
+
+class HarnessSkillPathSource(StrictModel):
+    path: zstr(min=1)
+
+
+class HarnessSkillAwsSkills(StrictModel):
+    paths: list[zstr(min=1, max=4096)] | None = None
+
+
+class HarnessSkillAwsSkillsSource(StrictModel):
+    aws_skills: HarnessSkillAwsSkills
+
+
+def _skill_shorthand(value: Any) -> Any:
+    # A bare non-empty string is shorthand for { path } (upstream: z.string().min(1).transform).
+    if isinstance(value, str) and js_len(value) >= 1:
+        return {"path": value}
+    return value
+
+
+HarnessSkill = Annotated[
+    HarnessSkillS3Source | HarnessSkillGitSource | HarnessSkillPathSource | HarnessSkillAwsSkillsSource,
+    Field(union_mode="left_to_right"),
+    BeforeValidator(_skill_shorthand),
+]
+
+# ============================================================================
+# Allowed Tools
+# ============================================================================
+
+AllowedTool = zstr(
+    min=1,
+    max=64,
+    pattern=r"^(\*|@?[^/]+(\/[^/]+)?)$",
+    pattern_msg='Must be "*" or a tool name pattern (max 64 chars)',
+)
+
+
+def looks_like_legacy_prompt_path(value: str) -> bool:
+    """Detect the legacy file-path-shaped ``systemPrompt`` (``./prompt.md`` style).
+
+    Real prompts are prose containing whitespace; the legacy shape was a single bare token that is a
+    relative path or ends in .md/.txt.
+    """
+    v = js_trim(value)
+    if not v or any(ch in JS_WHITESPACE for ch in v):
+        return False
+    return re.match(r"\.\.?/", v) is not None or re.search(r"\.(md|txt)\Z", v, re.IGNORECASE) is not None
+
+
+SystemPrompt = zstr(
+    refines=(
+        (lambda v: len(js_trim(v)) > 0, "systemPrompt must not be empty or whitespace-only"),
+        (
+            lambda v: not looks_like_legacy_prompt_path(v),
+            (
+                "systemPrompt looks like a file path. It is now always literal text — put file-backed prompts in a "
+                "`system-prompt.md` in the harness directory (auto-discovered), or inline the prompt text here."
+            ),
+        ),
+    )
+)
+
+
+def _max_env_vars(rec: dict[str, str]) -> dict[str, str]:
+    if len(rec) > MAX_ENV_VARS:
+        raise_issues([((), f"A maximum of {MAX_ENV_VARS} environment variables is allowed")], rec)
+    return rec
+
+
+def _strip_trailing_slash(p: str) -> str:
+    return p.removesuffix("/")
+
+
+# ============================================================================
+# HarnessSpec — per-harness config file schema (harness.json)
+# ============================================================================
+
+
+class HarnessSpec(ZodModel):
+    name: HarnessName
+    model: HarnessModel
+    # Always literal text (file-backed prompts come from system-prompt.md auto-discovery).
+    system_prompt: SystemPrompt | None = None
+    tools: Annotated[
+        list[HarnessTool],
+        array_checks(extra=[unique_by(lambda t: t.name, lambda n: f"Duplicate tool name: {n}")]),
+        Field(default_factory=list),
+    ]
+    skills: list[HarnessSkill] = Field(default_factory=list)
+    allowed_tools: list[AllowedTool] | None = None
+    memory: HarnessMemoryRef | None = None
+    max_iterations: zint(ge=1) | None = None
+    max_tokens: zint(ge=1) | None = None
+    timeout_seconds: zint(ge=1) | None = None
+    truncation: HarnessTruncationConfig | None = None
+    container_uri: (
+        zstr(
+            min=1,
+            max=MAX_CONTAINER_URI_LENGTH,
+            pattern=CONTAINER_URI_PATTERN,
+            pattern_msg="containerUri must be an ECR image URI (12-digit private ECR or public.ecr.aws)",
+        )
+        | None
+    ) = None
+    dockerfile: zstr(min=1) | None = None
+    execution_role_arn: str | None = None
+    network_mode: NetworkMode | None = None
+    network_config: NetworkConfig | None = None
+    lifecycle_config: LifecycleConfiguration | None = None
+    session_storage_path: SessionStorageMountPath | None = None
+    efs_access_points: Annotated[list[EfsAccessPointConfig], array_checks(max=2)] | None = None
+    s3_access_points: Annotated[list[S3FilesAccessPointConfig], array_checks(max=2)] | None = None
+    environment_variables: (
+        Annotated[
+            dict[zstr(min=1, max=MAX_ENV_VAR_KEY_LENGTH), zstr(max=MAX_ENV_VAR_VALUE_LENGTH)],
+            AfterValidator(_max_env_vars),
+        ]
+        | None
+    ) = None
+    authorizer_type: RuntimeAuthorizerType | None = None
+    authorizer_configuration: AuthorizerConfig | None = None
+    connections: list[Connection] | None = None
+    tags: Tags | None = None
+
+    @model_validator(mode="after")
+    def _refine(self) -> HarnessSpec:
+        issues: list[Issue] = []
+        if self.container_uri is not None and self.dockerfile is not None:
+            issues.append((("containerUri",), "containerUri and dockerfile are mutually exclusive"))
+        if self.network_mode == "VPC" and self.network_config is None:
+            issues.append((("networkConfig",), "networkConfig is required when networkMode is VPC"))
+        if self.network_mode != "VPC" and self.network_config is not None:
+            issues.append((("networkConfig",), "networkConfig is only allowed when networkMode is VPC"))
+        if (
+            self.network_mode == "VPC"
+            and is_container_build(self)
+            and self.network_config is not None
+            and len(self.network_config.security_groups) > MAX_CONTAINER_BUILD_SECURITY_GROUPS
+        ):
+            issues.append(
+                (
+                    ("networkConfig", "securityGroups"),
+                    (
+                        f"Container builds in VPC mode allow at most {MAX_CONTAINER_BUILD_SECURITY_GROUPS} security "
+                        "groups (CodeBuild limit)"
+                    ),
+                )
+            )
+        if (self.efs_access_points or self.s3_access_points) and self.network_mode != "VPC":
+            issues.append((("efsAccessPoints",), "efsAccessPoints and s3AccessPoints require networkMode: VPC"))
+        mount_paths: list[str] = []
+        if self.session_storage_path:
+            mount_paths.append(_strip_trailing_slash(self.session_storage_path))
+        mount_paths += [_strip_trailing_slash(ap.mount_path) for ap in self.efs_access_points or []]
+        mount_paths += [_strip_trailing_slash(ap.mount_path) for ap in self.s3_access_points or []]
+        if len(set(mount_paths)) != len(mount_paths):
+            issues.append((("efsAccessPoints",), "Filesystem mount paths must be unique"))
+        jwt = self.authorizer_configuration.custom_jwt_authorizer if self.authorizer_configuration else None
+        if self.authorizer_type == "CUSTOM_JWT" and jwt is None:
+            issues.append(
+                (
+                    ("authorizerConfiguration",),
+                    "authorizerConfiguration with customJwtAuthorizer is required when authorizerType is CUSTOM_JWT",
+                )
+            )
+        if self.authorizer_type != "CUSTOM_JWT" and self.authorizer_configuration is not None:
+            issues.append(
+                (
+                    ("authorizerConfiguration",),
+                    "authorizerConfiguration is only allowed when authorizerType is CUSTOM_JWT",
+                )
+            )
+        raise_issues(issues, self)
+        return self
+
+
+__all__ = [
+    "BEDROCK_API_FORMATS",
+    "CONTAINER_URI_PATTERN",
+    "GATEWAY_OAUTH_GRANT_TYPES",
+    "HARNESS_API_FORMATS",
+    "HARNESS_MODEL_PROVIDERS",
+    "HARNESS_TOOL_TYPES",
+    "HARNESS_TRUNCATION_STRATEGIES",
+    "MANAGED_MEMORY_STRATEGIES",
+    "MAX_CONTAINER_URI_LENGTH",
+    "MAX_ENV_VARS",
+    "MAX_ENV_VAR_KEY_LENGTH",
+    "MAX_ENV_VAR_VALUE_LENGTH",
+    "MAX_LITE_LLM_API_BASE_LENGTH",
+    "OPEN_AI_API_FORMATS",
+    "AgentCoreBrowser",
+    "AgentCoreBrowserConfig",
+    "AgentCoreCodeInterpreter",
+    "AgentCoreCodeInterpreterConfig",
+    "AgentCoreGatewayConfig",
+    "AllowedTool",
+    "BedrockApiFormat",
+    "DisabledMemoryRef",
+    "EmptyObject",
+    "ExistingMemoryRef",
+    "GatewayOAuthGrantType",
+    "HarnessAgentCoreGateway",
+    "HarnessApiFormat",
+    "HarnessAwsIamOutboundAuth",
+    "HarnessGatewayOAuth",
+    "HarnessGatewayOutboundAuth",
+    "HarnessMemoryRef",
+    "HarnessMemoryRetrievalConfig",
+    "HarnessModel",
+    "HarnessModelProvider",
+    "HarnessName",
+    "HarnessNoneOutboundAuth",
+    "HarnessOAuthOutboundAuth",
+    "HarnessSkill",
+    "HarnessSkillAwsSkills",
+    "HarnessSkillAwsSkillsSource",
+    "HarnessSkillGitAuth",
+    "HarnessSkillGitSource",
+    "HarnessSkillPathSource",
+    "HarnessSkillS3Source",
+    "HarnessSpec",
+    "HarnessTool",
+    "HarnessToolConfig",
+    "HarnessToolName",
+    "HarnessToolType",
+    "HarnessTruncationConfig",
+    "HarnessTruncationStrategy",
+    "InlineFunction",
+    "InlineFunctionConfig",
+    "ManagedMemoryRef",
+    "ManagedMemoryStrategy",
+    "OpenAiApiFormat",
+    "RemoteMcp",
+    "RemoteMcpConfig",
+    "SlidingWindow",
+    "SlidingWindowConfig",
+    "Summarization",
+    "SummarizationConfig",
+    "SystemPrompt",
+    "looks_like_legacy_prompt_path",
+    "validate_api_format",
+]