agentcore-cli 0.31.1__py3-none-any.whl

agentcore/templates/llm_context/agentcore.ts

@@ -0,0 +1,685 @@
+/* eslint-disable @typescript-eslint/no-unused-vars */
+/**
+ * READ-ONLY LLM CONTEXT - Do not edit this file.
+ *
+ * JSON File: agentcore/agentcore.json
+ * Purpose: Current top-level AgentCore project configuration.
+ */
+
+interface AgentCoreProjectSpec {
+  $schema?: string;
+  name: string; // @regex ^[A-Za-z][A-Za-z0-9]{0,22}$ @min 1 @max 23
+  version: number; // integer @min 1
+  managedBy: 'CDK'; // default 'CDK'
+  tags?: Tags;
+  runtimes: AgentEnvSpec[]; // default [], unique by name
+  memories: Memory[]; // default [], unique by name
+  knowledgeBases: KnowledgeBase[]; // default [], unique by name
+  credentials: Credential[]; // default [], unique by name
+  evaluators: Evaluator[]; // default [], unique by name
+  onlineEvalConfigs: OnlineEvalConfig[]; // default [], unique by name
+  agentCoreGateways: AgentCoreGateway[]; // default [], unique by name
+  mcpRuntimeTools?: AgentCoreMcpRuntimeTool[]; // unique by name
+  unassignedTargets?: AgentCoreGatewayTarget[]; // unique by name
+  policyEngines: PolicyEngine[]; // default [], unique by name
+  configBundles: ConfigBundle[]; // default [], unique by name
+  abTests: ABTest[]; // default [], unique by name
+  harnesses: HarnessRegistryEntry[]; // default [], unique by name
+  datasets?: Dataset[]; // unique by name
+  capacityProviders?: CapacityProvider[]; // unique by name
+  payments?: PaymentManager[]; // unique by name
+}
+
+type Tags = Record<string, string>; // @max 50 entries; keys @min 1 @max 128; values @max 256
+type BuildType = 'CodeZip' | 'Container';
+type PythonRuntime = 'PYTHON_3_10' | 'PYTHON_3_11' | 'PYTHON_3_12' | 'PYTHON_3_13' | 'PYTHON_3_14';
+type NodeRuntime = 'NODE_18' | 'NODE_20' | 'NODE_22';
+type RuntimeVersion = PythonRuntime | NodeRuntime;
+type NetworkMode = 'PUBLIC' | 'VPC';
+type ProtocolMode = 'HTTP' | 'MCP' | 'A2A' | 'AGUI';
+
+// RUNTIME
+
+interface AgentEnvSpec {
+  name: string; // @regex ^[a-zA-Z][a-zA-Z0-9_]{0,47}$ @min 1 @max 48
+  description?: string; // @max 200
+  build: BuildType;
+  entrypoint: string; // @regex ^[a-zA-Z0-9_][a-zA-Z0-9_/.-]*\.(py|ts|js)(:[a-zA-Z_][a-zA-Z0-9_]*)?$
+  codeLocation: string; // @min 1 directory path
+  dockerfile?: string; // Container only, relative to build context, @min 1 @max 255
+  buildContextPath?: string; // Container only, @min 1 directory path
+  customDockerBuildArgs?: Record<string, string>; // Container only; keys @regex ^[A-Za-z_][A-Za-z0-9_]*$ @max 255; values @max 4096
+  runtimeVersion?: RuntimeVersion;
+  envVars?: EnvVar[];
+  networkMode?: NetworkMode; // default 'PUBLIC'; must be unset when capacityProviderConfiguration is set (a CP supplies its own networking)
+  networkConfig?: NetworkConfig; // required only when networkMode is 'VPC'; mutually exclusive with capacityProviderConfiguration
+  capacityProviderConfiguration?: CapacityProviderConfiguration; // attach runtime to a CP; mutually exclusive with networkMode/networkConfig
+  instrumentation?: Instrumentation;
+  protocol?: ProtocolMode; // default 'HTTP'
+  requestHeaderAllowlist?: string[]; // @max 20
+  executionRoleArn?: string;
+  additionalPolicies?: string[]; // managed-policy ARNs or policy JSON paths relative to codeLocation
+  authorizerType?: RuntimeAuthorizerType; // default 'AWS_IAM'
+  authorizerConfiguration?: AuthorizerConfig; // required only for CUSTOM_JWT
+  tags?: Tags;
+  lifecycleConfiguration?: LifecycleConfiguration;
+  filesystemConfigurations?: FilesystemConfiguration[]; // @max 5; mount paths unique
+  endpoints?: Record<string, RuntimeEndpoint>; // keys @regex ^[a-zA-Z][a-zA-Z0-9_]{0,47}$ @max 48
+  connections?: Connection[];
+}
+
+interface EnvVar {
+  name: string; // @regex ^[A-Za-z_][A-Za-z0-9_]*$ @min 1 @max 255
+  value: string;
+}
+
+interface NetworkConfig {
+  subnets: string[]; // @min 1 @max 16; each @regex ^subnet-(?:[0-9a-f]{8}|[0-9a-f]{17})$
+  securityGroups: string[]; // @min 1 @max 16; each @regex ^sg-(?:[0-9a-f]{8}|[0-9a-f]{17})$
+  vpcId?: string; // @regex ^vpc-(?:[0-9a-f]{8}|[0-9a-f]{17})$
+}
+
+interface Instrumentation {
+  enableOtel: boolean; // default true
+}
+
+type FilesystemConfiguration =
+  | { sessionStorage: SessionStorage }
+  | { efsAccessPoint: EfsAccessPointConfig }
+  | { s3FilesAccessPoint: S3FilesAccessPointConfig }
+  | { capacityProviderVolume: CapacityProviderVolumeConfig }; // requires the runtime attached to a capacity provider
+
+interface SessionStorage {
+  mountPath: string; // @regex ^/mnt/[a-zA-Z0-9._-]+/?$ @min 6 @max 200
+}
+
+interface EfsAccessPointConfig {
+  accessPointArn: string; // EFS access point ARN
+  mountPath: string; // @regex ^/mnt/[a-zA-Z0-9._-]+/?$ @min 6 @max 200
+}
+
+interface S3FilesAccessPointConfig {
+  accessPointArn: string; // S3 Files access point ARN
+  mountPath: string; // @regex ^/mnt/[a-zA-Z0-9._-]+/?$ @min 6 @max 200
+}
+
+// Runtime -> capacity-provider reference. Exactly one of the two must be set.
+interface CapacityProviderConfiguration {
+  capacityProviderArn?: string; // external CP (not defined in this project)
+  capacityProviderName?: string; // in-project CP (a capacityProviders[] sibling)
+}
+
+interface CapacityProviderVolumeConfig {
+  volumeName: string; // @regex ^[a-zA-Z][a-zA-Z0-9_-]{0,47}$ @min 1 @max 48; a volume defined on the attached CP (its volumes[])
+  mountPath: string; // @regex ^/mnt/[a-zA-Z0-9._-]+/?$ @min 6 @max 200
+}
+
+interface LifecycleConfiguration {
+  idleRuntimeSessionTimeout?: number; // integer seconds @min 60 @max 28800; must be <= maxLifetime
+  maxLifetime?: number; // integer seconds @min 60 @max 28800
+}
+
+interface RuntimeEndpoint {
+  version: number; // integer @min 1
+  description?: string; // @max 200
+}
+
+type RuntimeAuthorizerType = 'AWS_IAM' | 'CUSTOM_JWT';
+type GatewayAuthorizerType = 'NONE' | 'AWS_IAM' | 'CUSTOM_JWT';
+
+interface AuthorizerConfig {
+  customJwtAuthorizer?: CustomJwtAuthorizerConfig;
+}
+
+interface CustomJwtAuthorizerConfig {
+  discoveryUrl: string; // HTTPS URL ending in /.well-known/openid-configuration
+  allowedAudience?: string[];
+  allowedClients?: string[];
+  allowedScopes?: string[]; // each @regex ^[\x21\x23-\x5B\x5D-\x7E]+$ @max 255
+  customClaims?: CustomClaimValidation[]; // @min 1
+  privateEndpoint?: PrivateEndpoint;
+  privateEndpointOverrides?: PrivateEndpointOverride[]; // @max 5; requires privateEndpoint
+}
+
+interface CustomClaimValidation {
+  inboundTokenClaimName: string; // @regex ^[A-Za-z0-9_.:-]+$ @min 1 @max 255
+  inboundTokenClaimValueType: 'STRING' | 'STRING_ARRAY';
+  authorizingClaimMatchValue: {
+    claimMatchOperator: 'EQUALS' | 'CONTAINS' | 'CONTAINS_ANY';
+    claimMatchValue:
+      | { matchValueString: string; matchValueStringList?: never }
+      | { matchValueString?: never; matchValueStringList: string[] };
+  };
+}
+
+type PrivateEndpoint =
+  | { selfManagedLatticeResource: SelfManagedLatticeResource; managedVpcResource?: never }
+  | { selfManagedLatticeResource?: never; managedVpcResource: ManagedVpcResource };
+
+interface SelfManagedLatticeResource {
+  resourceConfigurationIdentifier: string; // rcfg ID or VPC Lattice resource-configuration ARN
+}
+
+interface ManagedVpcResource {
+  vpcIdentifier: string; // VPC ID
+  subnetIds: string[]; // @min 1
+  endpointIpAddressType: 'IPV4' | 'IPV6';
+  securityGroupIds?: string[]; // @max 5
+  tags?: Tags;
+  routingDomain?: string; // @min 3 @max 255
+}
+
+interface PrivateEndpointOverride {
+  domain: string; // @min 1 @max 253
+  privateEndpoint: PrivateEndpoint;
+}
+
+// EXTERNAL RESOURCE CONNECTIONS
+
+interface Connection {
+  id?: string; // @regex ^[a-zA-Z][a-zA-Z0-9_-]{0,63}$
+  to: ConnectionTarget;
+  access?: 'read' | 'readwrite'; // only meaningful for memory; default 'read'
+  description?: string; // @max 200
+}
+
+type ConnectionTarget =
+  | { type: 'memory'; arn: string; namespaces?: string[] }
+  | { type: 'gateway'; arn: string; outboundAuth?: GatewayOutboundAuth }
+  | { type: 'runtime'; arn: string; exec?: boolean }
+  | { type: 'browser'; arn?: string }
+  | { type: 'codeInterpreter'; arn?: string };
+
+type GatewayOutboundAuth =
+  | { awsIam: Record<string, never> }
+  | { none: Record<string, never> }
+  | {
+      oauth: {
+        providerArn: string;
+        scopes: string[];
+        grantType?: 'CLIENT_CREDENTIALS' | 'AUTHORIZATION_CODE' | 'TOKEN_EXCHANGE';
+        customParameters?: Record<string, string>;
+      };
+    };
+
+// MEMORY
+
+interface Memory {
+  name: string; // @regex ^[a-zA-Z][a-zA-Z0-9_]{0,47}$ @min 1 @max 48
+  eventExpiryDuration: number; // integer days @min 3 @max 365
+  strategies: MemoryStrategy[]; // default [], unique by type
+  indexedKeys?: IndexedKey[]; // @max 10, unique by key; requires at least one strategy
+  tags?: Tags;
+  encryptionKeyArn?: string;
+  executionRoleArn?: string;
+  streamDeliveryResources?: StreamDeliveryResources;
+}
+
+type MemoryStrategyType = 'SEMANTIC' | 'SUMMARIZATION' | 'USER_PREFERENCE' | 'EPISODIC';
+
+interface MemoryStrategy {
+  type: MemoryStrategyType;
+  name?: string; // @regex ^[a-zA-Z][a-zA-Z0-9_]{0,47}$ @max 48
+  description?: string;
+  namespaceTemplates?: string[];
+  reflectionNamespaceTemplates?: string[]; // EPISODIC only and required for EPISODIC
+  /** @deprecated Use namespaceTemplates. */
+  namespaces?: string[];
+  /** @deprecated Use reflectionNamespaceTemplates. */
+  reflectionNamespaces?: string[];
+}
+
+interface IndexedKey {
+  key: string; // @regex ^[a-zA-Z0-9\s._:/=+@-]+$ @min 1 @max 128
+  type: 'STRING' | 'STRINGLIST' | 'NUMBER';
+}
+
+interface StreamDeliveryResources {
+  resources: {
+    kinesis: {
+      dataStreamArn: string;
+      contentConfigurations: {
+        type: 'MEMORY_RECORDS';
+        level: 'FULL_CONTENT' | 'METADATA_ONLY';
+      }[];
+    };
+  }[];
+}
+
+// KNOWLEDGE BASE
+
+interface KnowledgeBase {
+  type: 'AgentCoreKnowledgeBase'; // default 'AgentCoreKnowledgeBase'
+  name: string; // @regex ^[a-zA-Z][a-zA-Z0-9_-]{0,47}$ @min 1 @max 48
+  description?: string; // @max 2048
+  dataSources: DataSource[]; // @min 1, unique by URI/config file
+  gateway?: string;
+}
+
+type DataSource =
+  | { type: 'S3'; uri: string } // valid s3:// URI
+  | {
+      type: 'WEB' | 'CONFLUENCE' | 'SHAREPOINT' | 'ONEDRIVE' | 'GOOGLEDRIVE';
+      connectorConfigFile: string;
+    };
+
+// CREDENTIAL
+
+type Credential = ApiKeyCredential | OAuthCredential | PaymentCredential;
+
+interface ApiKeyCredential {
+  authorizerType: 'ApiKeyCredentialProvider';
+  name: string; // @regex ^[a-zA-Z0-9\-_]+$ @min 1 @max 128
+}
+
+interface OAuthCredential {
+  authorizerType: 'OAuthCredentialProvider';
+  name: string; // @regex ^[a-zA-Z0-9\-_]+$ @min 1 @max 128
+  discoveryUrl?: string;
+  scopes?: string[];
+  vendor: string; // default 'CustomOauth2'
+  managed?: boolean;
+  usage?: 'inbound' | 'outbound';
+}
+
+interface PaymentCredential {
+  authorizerType: 'PaymentCredentialProvider';
+  name: string; // @regex ^[a-zA-Z0-9\-_]+$ @min 1 @max 128
+  provider: PaymentProvider;
+}
+
+// EVALUATION
+
+interface Evaluator {
+  name: string; // @regex ^[a-zA-Z][a-zA-Z0-9_]{0,47}$ @min 1 @max 48
+  level: 'SESSION' | 'TRACE' | 'TOOL_CALL';
+  description?: string;
+  config: { llmAsAJudge: LlmAsAJudgeConfig; codeBased?: never } | { llmAsAJudge?: never; codeBased: CodeBasedConfig };
+  kmsKeyArn?: string;
+  tags?: Tags;
+}
+
+interface LlmAsAJudgeConfig {
+  modelProvider?: 'Bedrock' | 'OpenResponses'; // Defaults to Bedrock when omitted
+  model: string; // Bedrock model ID/ARN or OpenAI model ID
+  instructions: string;
+  ratingScale:
+    | { numerical: { value: number; label: string; definition: string }[]; categorical?: never }
+    | { numerical?: never; categorical: { label: string; definition: string }[] };
+}
+
+type CodeBasedConfig =
+  | { managed: ManagedCodeBasedConfig; external?: never }
+  | { managed?: never; external: ExternalCodeBasedConfig };
+
+interface ManagedCodeBasedConfig {
+  codeLocation: string;
+  entrypoint: string; // default 'lambda_function.handler'
+  timeoutSeconds: number; // integer @min 1 @max 300, default 60
+  additionalPolicies?: string[];
+}
+
+interface ExternalCodeBasedConfig {
+  lambdaArn: string; // Lambda function ARN
+}
+
+interface OnlineEvalConfig {
+  name: string; // @regex ^[a-zA-Z][a-zA-Z0-9_]{0,47}$ @min 1 @max 48
+  agent?: string; // mutually exclusive with logGroupNames
+  endpoint?: string; // requires agent
+  logGroupNames?: string[]; // @min 1 @max 5, mutually exclusive with agent
+  serviceNames?: string[]; // @min 1, requires logGroupNames
+  evaluators?: string[];
+  insights?: string[];
+  clusteringConfig?: { frequencies: ('DAILY' | 'WEEKLY' | 'MONTHLY')[] }; // @min 1 @max 3; requires insights
+  samplingRate: number; // @min 0.01 @max 100
+  description?: string; // @max 200
+  enableOnCreate?: boolean;
+  tags?: Tags;
+}
+
+// GATEWAY
+
+type GatewayTargetType =
+  | 'lambda'
+  | 'mcpServer'
+  | 'openApiSchema'
+  | 'smithyModel'
+  | 'apiGateway'
+  | 'lambdaFunctionArn'
+  | 'httpRuntime'
+  | 'connector'
+  | 'passthrough';
+
+interface AgentCoreGateway {
+  name: string; // @regex ^[0-9a-zA-Z](?:[0-9a-zA-Z-]*[0-9a-zA-Z])?$ @min 1 @max 100
+  resourceName?: string; // imported AWS resource name, same constraints as name
+  protocolType?: 'MCP' | 'None';
+  description?: string;
+  targets: AgentCoreGatewayTarget[];
+  authorizerType: GatewayAuthorizerType; // default 'NONE'
+  authorizerConfiguration?: AuthorizerConfig; // required only for CUSTOM_JWT
+  enableSemanticSearch: boolean; // default true
+  exceptionLevel: 'NONE' | 'DEBUG'; // default 'NONE'
+  policyEngineConfiguration?: {
+    policyEngineName: string;
+    mode: 'LOG_ONLY' | 'ENFORCE';
+  };
+  executionRoleArn?: string; // IAM role ARN @max 2048
+  tags?: Tags;
+}
+
+interface AgentCoreGatewayTarget {
+  name: string;
+  targetType: GatewayTargetType;
+  toolDefinitions?: ToolDefinition[];
+  compute?: ToolComputeConfig;
+  endpoint?: string; // mcpServer URL
+  outboundAuth?: OutboundAuth;
+  apiGateway?: ApiGatewayConfig;
+  schemaSource?: SchemaSource;
+  lambdaFunctionArn?: LambdaFunctionArnConfig;
+  httpRuntime?: HttpRuntimeConfig;
+  connectorId?: 'bedrock-knowledge-bases' | 'web-search';
+  configurations?: ConnectorConfiguration[];
+  passthrough?: PassthroughConfig;
+}
+
+interface ToolDefinition {
+  name: string; // @min 1 @max 128
+  description: string;
+  inputSchema: SchemaDefinition;
+  outputSchema?: SchemaDefinition;
+}
+
+interface SchemaDefinition {
+  type: 'string' | 'number' | 'object' | 'array' | 'boolean' | 'integer';
+  description?: string;
+  items?: SchemaDefinition;
+  properties?: Record<string, SchemaDefinition>;
+  required?: string[];
+}
+
+type ToolComputeConfig = LambdaComputeConfig | AgentCoreRuntimeComputeConfig;
+
+interface LambdaComputeConfig {
+  host: 'Lambda';
+  implementation: ToolImplementationBinding;
+  nodeVersion?: NodeRuntime; // required for TypeScript
+  pythonVersion?: PythonRuntime; // required for Python
+  timeout?: number; // integer @min 1 @max 900
+  memorySize?: number; // integer @min 128 @max 10240
+  iamPolicy?: IamPolicyDocument;
+}
+
+interface AgentCoreRuntimeComputeConfig {
+  host: 'AgentCoreRuntime';
+  implementation: ToolImplementationBinding; // Python only
+  runtime?: RuntimeConfig;
+  iamPolicy?: IamPolicyDocument;
+}
+
+interface ToolImplementationBinding {
+  language: 'TypeScript' | 'Python';
+  path: string;
+  handler: string;
+}
+
+interface RuntimeConfig {
+  artifact: 'CodeZip';
+  pythonVersion: PythonRuntime;
+  name: string; // @regex ^[a-zA-Z][a-zA-Z0-9_]{0,47}$ @max 48
+  entrypoint: string; // Python file path with optional handler
+  codeLocation: string;
+  instrumentation?: Instrumentation;
+  networkMode: NetworkMode; // default 'PUBLIC'
+  description?: string;
+}
+
+interface IamPolicyDocument {
+  Version: string;
+  Statement: unknown[];
+  [key: string]: unknown;
+}
+
+interface OutboundAuth {
+  type: 'OAUTH' | 'API_KEY' | 'NONE' | 'GATEWAY_IAM_ROLE' | 'JWT_PASSTHROUGH'; // default 'NONE'
+  credentialName?: string;
+  scopes?: string[];
+  service?: string; // @min 1 @max 64; required for passthrough GATEWAY_IAM_ROLE
+  region?: string; // @min 1 @max 32
+}
+
+interface ApiGatewayConfig {
+  restApiId: string;
+  stage: string;
+  apiGatewayToolConfiguration: {
+    toolFilters: {
+      filterPath: string;
+      methods: ApiGatewayHttpMethod[];
+    }[];
+    toolOverrides?: {
+      name: string;
+      path: string;
+      method: ApiGatewayHttpMethod;
+      description?: string;
+    }[];
+  };
+}
+
+type ApiGatewayHttpMethod = 'GET' | 'POST' | 'PUT' | 'DELETE' | 'PATCH' | 'HEAD' | 'OPTIONS';
+type SchemaSource = { inline: { path: string } } | { s3: { uri: string; bucketOwnerAccountId?: string } };
+
+interface LambdaFunctionArnConfig {
+  lambdaArn: string; // @min 1 @max 170
+  toolSchemaFile: string;
+}
+
+interface HttpRuntimeConfig {
+  runtime: string; // project runtime name
+  runtimeEndpoint?: string; // endpoint alias
+}
+
+interface ConnectorConfiguration {
+  name: string;
+  description?: string;
+  parameterValues?: Record<string, unknown>;
+  parameterOverrides?: {
+    path: string;
+    description?: string;
+    visible?: boolean;
+  }[];
+}
+
+interface PassthroughConfig {
+  endpoint: string; // HTTPS URL
+  protocolType: 'MCP' | 'A2A' | 'INFERENCE' | 'CUSTOM'; // default 'CUSTOM'
+  stickinessConfiguration?: {
+    identifier: string; // @min 1 @max 256
+    timeout?: number; // integer @min 1 @max 86400
+  };
+}
+
+interface AgentCoreMcpRuntimeTool {
+  name: string;
+  toolDefinition: ToolDefinition;
+  compute: AgentCoreRuntimeComputeConfig;
+  bindings?: {
+    runtimeName: string;
+    envVarName: string; // @regex ^[A-Za-z_][A-Za-z0-9_]*$ @max 255
+  }[];
+}
+
+// POLICY
+
+interface PolicyEngine {
+  name: string; // @regex ^[A-Za-z][A-Za-z0-9_]{0,47}$ @min 1 @max 48
+  description?: string; // @min 1 @max 4096
+  encryptionKeyArn?: string;
+  tags?: Tags;
+  policies: Policy[]; // default [], unique by name
+}
+
+interface Policy {
+  name: string; // @regex ^[A-Za-z][A-Za-z0-9_]{0,47}$ @min 1 @max 48
+  description?: string; // @min 1 @max 4096
+  statement: string;
+  sourceFile?: string;
+  validationMode: 'FAIL_ON_ANY_FINDINGS' | 'IGNORE_ALL_FINDINGS'; // default 'FAIL_ON_ANY_FINDINGS'
+  enforcementMode: 'ACTIVE' | 'LOG_ONLY'; // default 'ACTIVE'
+  authorizationPhase?: 'INITIATE' | 'RETURN_OUTPUT'; // default 'INITIATE'
+}
+
+// CONFIG BUNDLE
+
+interface ConfigBundle {
+  name: string; // @regex ^[a-zA-Z][a-zA-Z0-9_]{0,99}$ @min 1 @max 100
+  type: 'ConfigurationBundle'; // default 'ConfigurationBundle'
+  description?: string; // @min 1 @max 500
+  components: Record<string, ComponentConfiguration>;
+  branchName?: string; // @max 128
+  commitMessage?: string; // @max 500
+  kmsKeyArn?: string;
+}
+
+interface ComponentConfiguration {
+  configuration: Record<string, unknown>;
+}
+
+// A/B TEST
+
+interface ABTest {
+  name: string; // @regex ^[a-zA-Z][a-zA-Z0-9_]{0,47}$ @min 1 @max 48
+  description?: string; // @min 1 @max 200
+  mode: 'config-bundle' | 'target-based'; // default 'config-bundle'
+  gatewayRef: string;
+  roleArn?: string;
+  variants: [ABTestVariant, ABTestVariant]; // one C and one T1; weights sum to 100
+  evaluationConfig:
+    | { onlineEvaluationConfigArn: string }
+    | {
+        perVariantOnlineEvaluationConfig: [PerVariantOnlineEvaluationConfig, PerVariantOnlineEvaluationConfig];
+      };
+  gatewayFilter?: { targetPaths: string[] }; // @max 1; each @max 500
+  enableOnCreate?: boolean;
+  promoted?: boolean;
+}
+
+interface ABTestVariant {
+  name: 'C' | 'T1';
+  weight: number; // integer @min 1 @max 100
+  variantConfiguration:
+    | { configurationBundle: { bundleArn: string; bundleVersion: string }; target?: never }
+    | { configurationBundle?: never; target: { targetName: string } };
+}
+
+interface PerVariantOnlineEvaluationConfig {
+  treatmentName: 'C' | 'T1';
+  onlineEvaluationConfigArn: string;
+}
+
+// HARNESS REGISTRY
+
+interface HarnessRegistryEntry {
+  name: string; // @regex ^[a-zA-Z][a-zA-Z0-9_]{0,39}$ @min 1 @max 40
+  path: string; // project-relative harness config directory
+}
+
+// DATASET
+
+interface Dataset {
+  name: string; // @regex ^[a-zA-Z][a-zA-Z0-9_]{0,47}$ @min 1 @max 48
+  schemaType: 'AGENTCORE_EVALUATION_PREDEFINED_V1' | 'AGENTCORE_EVALUATION_SIMULATED_V1';
+  description?: string; // @max 200
+  config: { managed: { location: string } };
+  kmsKeyArn?: string;
+}
+
+// CAPACITY PROVIDER
+
+interface CapacityProvider {
+  name: string; // @regex ^[a-zA-Z][a-zA-Z0-9_]{0,47}$ @min 1 @max 48; immutable after creation
+  description?: string; // @min 1 @max 4096; mutable (the only mutable field besides tags)
+  operatorRoleArn: string; // IAM role ARN @regex ^arn:aws(-[^:]+)?:iam::([0-9]{12})?:role/.+$ @max 2048; immutable
+  computeConfiguration: ComputeConfiguration; // immutable after creation
+  tags?: Tags;
+}
+
+interface ComputeConfiguration {
+  ec2Configuration: Ec2Configuration;
+}
+
+interface Ec2Configuration {
+  launchTemplateSource: { launchParameters: LaunchParameters };
+  vpcConfiguration: CapacityProviderVpcConfiguration;
+  volumes?: VolumeConfiguration[]; // @max 5
+  lifecycleConfiguration?: InstanceLifecycleConfiguration;
+  // long tail (rootVolume, etc.) accepted via passthrough and validated by CFN
+}
+
+interface LaunchParameters {
+  operatingSystem: 'LINUX_X86_64' | 'LINUX_ARM64';
+  instanceRequirements: { allowedInstanceTypes: string[] }; // @min 1 @max 30; each @min 1 @max 255
+  instanceProfileArn?: string; // @regex ^arn:aws(-[^:]+)?:iam::[0-9]{12}:instance-profile/.+$
+  // long tail (sshKeyName, monitoring, licenseSpecifications, capacityReservationSpecification,
+  // ephemeralVolumes, propagatedTags) accepted via passthrough and validated by CFN
+}
+
+interface CapacityProviderVpcConfiguration {
+  subnets: string[]; // @min 1 @max 16; each @regex ^subnet-[0-9a-zA-Z]{8,17}$
+  securityGroups: string[]; // @min 1 @max 16; each @regex ^sg-[0-9a-zA-Z]{8,17}$
+}
+
+interface VolumeConfiguration {
+  ebsConfiguration: {
+    name: string; // @regex ^[a-zA-Z][a-zA-Z0-9_-]{0,47}$ @min 1 @max 48
+    sizeGiB: number; // integer @min 1 @max 65536
+    volumeType?: 'standard' | 'io1' | 'io2' | 'gp2' | 'sc1' | 'st1' | 'gp3';
+    encrypted?: boolean;
+    kmsKeyId?: string; // KMS key ARN
+    // long tail (iops, throughput, snapshotId) accepted via passthrough
+  };
+}
+
+interface InstanceLifecycleConfiguration {
+  idleInstanceTimeout?: number; // integer seconds @min 60 @max 1209600
+  maxLifetime?: number; // integer seconds @min 60 @max 1209600
+}
+
+// PAYMENTS
+
+type PaymentProvider = 'CoinbaseCDP' | 'StripePrivy';
+
+interface PaymentManager {
+  name: string; // @regex ^[a-zA-Z][a-zA-Z0-9]{0,47}$ @min 1 @max 48
+  authorizerType: 'AWS_IAM' | 'CUSTOM_JWT'; // default 'AWS_IAM'
+  authorizerConfiguration?: {
+    customJWTAuthorizer: {
+      discoveryUrl: string;
+      allowedClients?: string[];
+      allowedAudience?: string[];
+      allowedScopes?: string[];
+    };
+  };
+  connectors: PaymentConnector[]; // default []
+  description?: string;
+  autoPayment: boolean; // default true
+  defaultSpendLimit: string; // default '10.00'
+  paymentToolAllowlist?: string[];
+  networkPreferences?: string[];
+}
+
+type PaymentConnector = ManualPaymentConnector | QuickCreatePaymentConnector;
+
+interface ManualPaymentConnector {
+  name: string; // @regex ^[a-zA-Z][a-zA-Z0-9_]{0,47}$ @min 1 @max 48
+  provider: PaymentProvider; // default 'CoinbaseCDP'
+  provisionMode?: 'MANUAL';
+  credentialName: string;
+}
+
+interface QuickCreatePaymentConnector {
+  name: string; // @regex ^[a-zA-Z][a-zA-Z0-9_]{0,47}$ @min 1 @max 48
+  provider: 'CoinbaseCDP';
+  provisionMode: 'QUICK_CREATE';
+}