agentcore-cli 0.31.1__py3-none-any.whl

agentcore/assets/AGENTS.md

@@ -0,0 +1,60 @@
+## AgentCore Templates
+
+This directory stores:
+
+- Template assets for agents written in different languages, SDKs, and configurations
+- Container templates (`container/python/`) with `Dockerfile` and `.dockerignore` for Container build agents
+- Vended documentation (`README.md`, `agents/AGENTS.md`) copied into user projects at create time
+- CDK project template (`cdk/`) using `@aws/agentcore-cdk` L3 constructs
+- Evaluator templates (`evaluators/`) for code-based evaluators
+- MCP tool templates (`mcp/`) for Lambda and AgentCoreRuntime compute
+
+### Directory Layout
+
+```
+assets/
+├── README.md            # Vended to project root as project README
+├── AGENTS.md            # This file — internal dev context
+├── agents/
+│   └── AGENTS.md        # Vended to project root for AI coding assistants
+├── python/              # Framework templates (one per SDK per protocol)
+│   ├── http/            # HTTP protocol agents
+│   │   ├── strands/
+│   │   ├── langchain_langgraph/
+│   │   ├── googleadk/
+│   │   ├── openaiagents/
+│   │   └── autogen/
+│   ├── mcp/             # MCP protocol agents
+│   │   └── standalone/
+│   └── a2a/             # A2A protocol agents
+│       ├── strands/
+│       ├── langchain_langgraph/
+│       └── googleadk/
+├── typescript/          # TypeScript agent templates
+├── container/           # Container build templates
+│   └── python/
+│       ├── Dockerfile
+│       └── dockerignore.template
+├── cdk/                 # CDK project template (@aws/agentcore-cdk)
+├── evaluators/          # Code-based evaluator templates
+└── mcp/                 # MCP tool templates (Lambda + AgentCoreRuntime)
+    ├── python/
+    └── python-lambda/
+```
+
+The rendering logic is rooted in the `AgentEnvSpec` and must ALWAYS respect the configuration in the spec.
+
+For Container builds, `BaseRenderer.render()` automatically copies the `container/<language>/` templates (Dockerfile,
+.dockerignore) into the agent directory when `buildType === 'Container'`.
+
+## Guidance for template changes
+
+- Always make sure the templates are as close to working code as possible
+- AVOID as much as possible using any conditionals within the templates
+- Test template rendering with `agentcore add agent` for each framework/protocol combination
+
+## How to use the assets in this directory
+
+- These assets are rendered by the CLI's template renderer in `src/cli/templates/`
+- The `README.md` and `agents/AGENTS.md` are copied verbatim (no template rendering) during project creation
+- The `.llm-context/` files are sourced from `src/schema/llm-compacted/` and written during project creation

agentcore/assets/README.md

@@ -0,0 +1,108 @@
+# AgentCore Project
+
+This project was created with the [AgentCore CLI](https://github.com/aws/agentcore-cli).
+
+## Project Structure
+
+```
+my-project/
+├── AGENTS.md               # AI coding assistant context
+├── agentcore/
+│   ├── agentcore.json      # Project config (agents, memories, credentials, gateways, evaluators)
+│   ├── aws-targets.json    # Deployment targets (account + region)
+│   ├── .env.local          # Secrets — API keys (gitignored)
+│   ├── .llm-context/       # TypeScript type definitions for AI assistants
+│   │   ├── agentcore.ts    # AgentCoreProjectSpec types
+│   │   └── aws-targets.ts  # Deployment target types
+│   └── cdk/                # CDK infrastructure (@aws/agentcore-cdk)
+├── app/                    # Agent application code
+└── evaluators/             # Custom evaluator code (if any)
+```
+
+## Getting Started
+
+### Prerequisites
+
+- **Node.js** 20.x or later
+- **Python 3.10+** and **uv** for Python agents ([install uv](https://docs.astral.sh/uv/getting-started/installation/))
+- **AWS credentials** configured (`aws configure` or environment variables)
+- **Docker** (only for Container build agents)
+
+### Development
+
+Run your agent locally:
+
+```bash
+agentcore dev
+```
+
+### Validate Invocation Input
+
+Validate runtime invocation payloads before forwarding them to an agent framework. Keep user prompts typed as strings
+and pass only prompt text to the agent.
+
+### Deployment
+
+Deploy to AWS:
+
+```bash
+agentcore deploy
+```
+
+## Commands
+
+| Command | Description |
+| --- | --- |
+| `agentcore create` | Create a new AgentCore project |
+| `agentcore add` | Add resources (agent, memory, credential, gateway, evaluator, policy) |
+| `agentcore remove` | Remove resources |
+| `agentcore dev` | Run agent locally with hot-reload |
+| `agentcore deploy` | Deploy to AWS via CDK |
+| `agentcore status` | Show deployment status |
+| `agentcore invoke` | Invoke agent (local or deployed) |
+| `agentcore logs` | View agent logs |
+| `agentcore traces` | View agent traces |
+| `agentcore eval` | Run evaluations |
+| `agentcore package` | Package agent artifacts |
+| `agentcore validate` | Validate configuration |
+| `agentcore pause` | Pause a deployed agent |
+| `agentcore resume` | Resume a paused agent |
+| `agentcore fetch` | Fetch remote resource definitions |
+| `agentcore import` | Import existing resources |
+| `agentcore update` | Check for CLI updates |
+
+## Configuration
+
+Edit the JSON files in `agentcore/` to configure your project. See `agentcore/.llm-context/` for type definitions and validation constraints.
+
+The project uses a **flat resource model** — agents, memories, credentials, gateways, evaluators, and policies are top-level arrays in `agentcore.json`. Resources are independent; agents discover memories and credentials at runtime via environment variables or SDK calls.
+
+## Resources
+
+| Resource | Purpose |
+| --- | --- |
+| Agent (runtime) | HTTP, MCP, or A2A agent deployed to AgentCore Runtime |
+| Memory | Persistent context storage with configurable strategies |
+| Credential | API key or OAuth credential providers |
+| Gateway | MCP gateway that routes tool calls to targets |
+| Gateway Target | Tool implementation (Lambda, MCP server, OpenAPI, Smithy, API Gateway) |
+| Evaluator | Custom LLM-as-a-Judge or code-based evaluation |
+| Online Eval Config | Continuous evaluation pipeline for deployed agents |
+| Policy | Cedar authorization policies for gateway tools |
+
+### Agent Types
+
+- **Template agents**: Created from framework templates (Strands, LangChain/LangGraph, GoogleADK, OpenAI Agents, Autogen)
+- **BYO agents**: Bring your own code with `agentcore add agent --type byo`
+- **Import agents**: Import existing Bedrock agents with `agentcore import`
+
+### Build Types
+
+- **CodeZip**: Python source packaged as a zip and deployed directly to AgentCore Runtime
+- **Container**: Docker image built via CodeBuild (ARM64), pushed to ECR, and deployed to AgentCore Runtime
+
+## Documentation
+
+- [AgentCore CLI](https://github.com/aws/agentcore-cli)
+- [AgentCore CDK Constructs](https://github.com/aws/agentcore-l3-cdk-constructs)
+- [Amazon Bedrock AgentCore](https://aws.amazon.com/bedrock/agentcore/)

agentcore/assets/agents/AGENTS.md

@@ -0,0 +1,218 @@
+# AgentCore Project
+
+This project contains configuration and infrastructure for an Amazon Bedrock AgentCore application.
+
+The `agentcore/` directory is a declarative model of the project. The `agentcore/cdk/` subdirectory uses the
+`@aws/agentcore-cdk` L3 constructs to deploy the configuration to AWS.
+
+## Mental Model
+
+The project uses a **flat resource model**. Agents, memories, credentials, gateways, evaluators, and policies are
+independent top-level arrays in `agentcore.json`. There is no binding between resources in the schema — each resource is
+provisioned independently. Agents discover memories and credentials at runtime via environment variables or SDK calls.
+Tags defined in `agentcore.json` flow through to deployed CloudFormation resources.
+
+## Critical Invariants
+
+1. **Schema-First Authority:** The `.json` files are the source of truth. Do not modify agent behavior by editing
+   generated CDK code in `cdk/`.
+2. **Resource Identity:** The `name` field determines the CloudFormation Logical ID.
+   - **Renaming** a resource will **destroy and recreate** it.
+   - **Modifying** other fields will update the resource **in-place**.
+3. **Schema Validation:** If your JSON conforms to the types in `.llm-context/`, it will deploy successfully. Run
+   `agentcore validate` to check.
+4. **Resource Removal:** Use `agentcore remove` to remove resources. Run `agentcore deploy` after removal to tear down
+   deployed infrastructure.
+5. **Invocation Input:** Validate runtime payloads and require text prompts to be strings. If a Strands app accepts a
+   caller-supplied message history, normalize the history tail with `strip_trailing_tool_use()` before invocation.
+
+## Directory Structure
+
+```
+myProject/
+├── AGENTS.md               # This file — AI coding assistant context
+├── agentcore/
+│   ├── agentcore.json      # Main project config (AgentCoreProjectSpec)
+│   ├── aws-targets.json    # Deployment targets (account + region)
+│   ├── .env.local          # Secrets — API keys (gitignored)
+│   ├── .llm-context/       # TypeScript type definitions for AI assistants
+│   │   ├── README.md       # Guide to using schema files
+│   │   ├── agentcore.ts    # AgentCoreProjectSpec types
+│   │   └── aws-targets.ts  # AWS deployment target types
+│   └── cdk/                # AWS CDK project (@aws/agentcore-cdk L3 constructs)
+├── app/                    # Agent application code
+└── evaluators/             # Custom evaluator code (if any)
+```
+
+## Schema Reference
+
+The `agentcore/.llm-context/` directory contains TypeScript type definitions optimized for AI coding assistants. Each
+file maps to a JSON config file and includes validation constraints as comments (`@regex`, `@min`, `@max`).
+
+| JSON Config | Schema File | Root Type |
+| --- | --- | --- |
+| `agentcore/agentcore.json` | `agentcore/.llm-context/agentcore.ts` | `AgentCoreProjectSpec` |
+| `agentcore/aws-targets.json` | `agentcore/.llm-context/aws-targets.ts` | `AwsDeploymentTarget[]` |
+
+### Key Types
+
+- **AgentCoreProjectSpec**: Root config with runtimes, memories, knowledge bases, credentials, evaluators, online evals and insights, gateways, policy engines, config bundles, A/B tests, harness registrations, datasets, payment managers, and capacity providers
+- **AgentEnvSpec**: Agent configuration (build type, entrypoint, code location, runtime version, network mode)
+- **Memory**: Memory resource with strategies (SEMANTIC, SUMMARIZATION, USER_PREFERENCE, EPISODIC) and expiry
+- **Credential**: API key or OAuth credential provider
+- **AgentCoreGateway**: MCP gateway with targets (Lambda, MCP server, OpenAPI, Smithy, API Gateway, web-search, knowledge-base)
+- **Evaluator**: LLM-as-a-Judge or code-based evaluator
+- **OnlineEvalConfig**: Continuous evaluation pipeline bound to an agent
+- **OnlineInsightsConfig** _[preview]_: Continuous failure-pattern analysis bound to an agent
+- **KnowledgeBase**: Managed Bedrock Knowledge Base auto-wired to a gateway
+- **Harness**: Declarative agent — runtime + tools + skills + memory + observability without writing agent code
+- **PolicyEngine** + **Policy**: Cedar policy engine with form-based guardrails (Bedrock content filters, prompt-attack, sensitive-info) or raw Cedar policies
+- **PaymentManager** + **PaymentConnector**: x402-protocol payment orchestration with provider credentials (CoinbaseCDP, StripePrivy)
+- **ConfigBundle**: Versioned runtime configuration as a separately-deployable resource
+- **Dataset**: Curated session dataset for batch evaluation and recommendation runs
+- **RuntimeEndpoint**: Named endpoint (e.g. `PROMPT_V1`) targeting a specific runtime version
+
+### Common Enum Values
+
+- **BuildType**: `'CodeZip'` | `'Container'`
+- **NetworkMode**: `'PUBLIC'` | `'VPC'`
+- **RuntimeVersion**: `'PYTHON_3_10'` | `'PYTHON_3_11'` | `'PYTHON_3_12'` | `'PYTHON_3_13'` | `'PYTHON_3_14'` | `'NODE_18'` | `'NODE_20'` | `'NODE_22'`
+- **MemoryStrategyType**: `'SEMANTIC'` | `'SUMMARIZATION'` | `'USER_PREFERENCE'` | `'EPISODIC'`
+- **GatewayTargetType**: `'lambda'` | `'mcpServer'` | `'openApiSchema'` | `'smithyModel'` | `'apiGateway'` | `'lambdaFunctionArn'` | `'connector'` (web-search, bedrock-knowledge-bases)
+- **ModelProvider**: `'Bedrock'` | `'Gemini'` | `'OpenAI'` | `'Anthropic'`
+- **PaymentProvider**: `'CoinbaseCDP'` | `'StripePrivy'`
+- **PolicyEnforcementMode**: `'ACTIVE'` | `'PASSIVE'`
+- **GuardrailContentFilter**: `'VIOLENCE'` | `'HATE'` | `'SEXUAL'` | `'MISCONDUCT'` | `'INSULTS'`
+
+### Build Types
+
+- **CodeZip**: Python source packaged as a zip and deployed directly to AgentCore Runtime.
+- **Container**: Docker image built in CodeBuild (ARM64), pushed to a per-agent ECR repository. Requires a `Dockerfile`
+  in the agent's `codeLocation` directory. For local development (`agentcore dev`), the container is built and run
+  locally with volume-mounted hot-reload.
+
+### Supported Frameworks (for template agents)
+
+- **Strands** — Bedrock, Anthropic, OpenAI, Gemini
+- **LangChain/LangGraph** — Bedrock, Anthropic, OpenAI, Gemini
+- **GoogleADK** — Gemini
+- **OpenAI Agents** — OpenAI
+- **Autogen** — Bedrock, Anthropic, OpenAI, Gemini
+
+### Protocols
+
+- **HTTP** — Standard HTTP agent endpoint
+- **MCP** — Model Context Protocol server
+- **A2A** — Agent-to-Agent protocol (Google A2A)
+
+## Deployment
+
+Deployments are orchestrated through the CLI:
+
+```bash
+agentcore deploy    # Synthesizes CDK and deploys to AWS
+agentcore status    # Shows deployment status
+```
+
+Alternatively, deploy directly via CDK:
+
+```bash
+cd agentcore/cdk
+npm install
+npx cdk synth
+npx cdk deploy
+```
+
+## Editing Schemas
+
+When modifying JSON config files:
+
+1. Read the corresponding `agentcore/.llm-context/*.ts` file for type definitions
+2. Check validation constraint comments (`@regex`, `@min`, `@max`)
+3. Use exact enum values as string literals
+4. Use CloudFormation-safe names (alphanumeric, start with letter)
+5. Run `agentcore validate` to verify changes
+
+## Harness Export
+
+`agentcore export harness` converts a harness configuration into a deployable Strands Python agent under `app/<agentName>/`.
+
+**After every export, you MUST read `app/<agentName>/EXPORT_NOTES.md` before proceeding.**
+
+This file lists any manual follow-up items required before the agent will deploy or run correctly — missing files to create, IAM policies to add, or configuration steps the exporter could not automate. A clean export produces "No manual steps required." Complete every item in the file before running `agentcore deploy`.
+
+```bash
+agentcore export harness --name <harnessName>   # generates app/<agentName>/EXPORT_NOTES.md
+cat app/<agentName>/EXPORT_NOTES.md             # read this before touching anything else
+```
+
+## CLI Commands
+
+Run `agentcore --help` or `agentcore <command> --help` for full flags. Commonly used:
+
+**Project lifecycle**
+
+| Command | Description |
+| --- | --- |
+| `agentcore create` | Create a new project |
+| `agentcore dev` | Run agent locally with hot-reload |
+| `agentcore deploy` | Deploy to AWS |
+| `agentcore invoke` | Invoke agent (local or deployed) |
+| `agentcore capacity-provider delete-session` | Delete (deprovision) a live capacity provider session |
+| `agentcore status` | Show deployment status |
+| `agentcore validate` | Validate configuration |
+| `agentcore package` | Package agent artifacts |
+| `agentcore import` | Import resources from a Bedrock AgentCore Starter Toolkit project |
+
+**Resources**
+
+| Command | Description |
+| --- | --- |
+| `agentcore add <resource>` | Add agent, memory, credential, gateway, gateway-target, evaluator, online-eval, online-insights, knowledge-base, harness, policy-engine, policy, payment-manager, payment-connector, capacity-provider, config-bundle, dataset, runtime-endpoint |
+| `agentcore remove <resource>` | Remove any resource |
+| `agentcore export harness` | Export a harness to a Strands runtime agent under `app/<agentName>/` |
+
+**Jobs (run, view, archive, lifecycle)**
+
+| Command | Description |
+| --- | --- |
+| `agentcore run eval` | Run on-demand evaluation against agent traces |
+| `agentcore run batch-evaluation` | Run evaluators across all sessions at scale |
+| `agentcore run recommendation` | Optimize prompts or tool descriptions from real traces |
+| `agentcore run insights` _[preview]_ | Run failure-pattern analysis across sessions |
+| `agentcore run ab-test` | Start an A/B test (config-bundle or target-based) |
+| `agentcore run ingest` | Start a fresh ingestion job for every data source on a deployed knowledge base |
+| `agentcore view <type>` | List or view jobs (recommendation, batch-evaluation, ab-test, insights) |
+| `agentcore archive <type>` | Delete a job on the service + clear local history |
+| `agentcore stop <type>` | Stop a running batch-evaluation or ab-test |
+| `agentcore promote ab-test` | Apply the winning variant to `agentcore.json` |
+| `agentcore pause <type>` / `agentcore resume <type>` | Pause/resume a deployed online-eval, online-insights, or ab-test |
+
+**Config bundles & datasets**
+
+| Command | Description |
+| --- | --- |
+| `agentcore config-bundle versions` (alias `cb versions`) | List version history for a bundle |
+| `agentcore config-bundle diff` | Diff two versions of a bundle |
+| `agentcore config-bundle create-branch` | Create a new branch on an existing bundle |
+| `agentcore dataset download` | Download a dataset version locally |
+| `agentcore dataset publish-version` | Publish a new dataset version |
+| `agentcore dataset remove-version` | Remove a dataset version |
+
+**Observability & history**
+
+| Command | Description |
+| --- | --- |
+| `agentcore logs` | Stream/search agent runtime logs |
+| `agentcore logs evals` | Stream/search online-eval logs |
+| `agentcore traces list` / `agentcore traces get` | List recent traces or download one to JSON |
+| `agentcore evals history` | View past on-demand eval results |
+
+**Utilities**
+
+| Command | Description |
+| --- | --- |
+| `agentcore fetch access` | Fetch access info for deployed gateway or agent |
+| `agentcore feedback` | Send feedback (with optional screenshot) to the AgentCore team |
+| `agentcore update` | Check for and install CLI updates |
+| `agentcore telemetry` | View or change telemetry preferences |

agentcore/assets/cdk/.prettierrc

@@ -0,0 +1,8 @@
+{
+  "trailingComma": "es5",
+  "printWidth": 120,
+  "tabWidth": 2,
+  "semi": true,
+  "singleQuote": true,
+  "arrowParens": "avoid"
+}

agentcore/assets/cdk/README.md

@@ -0,0 +1,26 @@
+# AgentCore CDK Project
+
+This CDK project is managed by the AgentCore CLI. It deploys your agent infrastructure into AWS using the `@aws/agentcore-cdk` L3 constructs.
+
+## Structure
+
+- `bin/cdk.ts` — Entry point. Reads project configuration from `agentcore/` and creates a stack per deployment target.
+- `lib/cdk-stack.ts` — Defines `AgentCoreStack`, which wraps the `AgentCoreApplication` L3 construct.
+- `test/cdk.test.ts` — Unit tests for stack synthesis.
+
+## Useful commands
+
+- `npm run build` compile TypeScript to JavaScript
+- `npm run test` run unit tests
+- `npx cdk synth` emit the synthesized CloudFormation template
+- `npx cdk deploy` deploy this stack to your default AWS account/region
+- `npx cdk diff` compare deployed stack with current state
+
+## Usage
+
+You typically don't need to interact with this directory directly. The AgentCore CLI handles synthesis and deployment:
+
+```bash
+agentcore deploy    # synthesizes and deploys via CDK
+agentcore status    # checks deployment status
+```

agentcore/assets/cdk/bin/cdk.ts

@@ -0,0 +1,216 @@
+#!/usr/bin/env node
+import { AgentCoreStack, type HarnessConfig } from '../lib/cdk-stack';
+import { ConfigIO, HarnessSpecSchema, type AwsDeploymentTarget } from '@aws/agentcore-cdk';
+import { App, type Environment } from 'aws-cdk-lib';
+import * as path from 'path';
+import * as fs from 'fs';
+
+function toEnvironment(target: AwsDeploymentTarget): Environment {
+  return {
+    account: target.account,
+    region: target.region,
+  };
+}
+
+function sanitize(name: string): string {
+  return name.replace(/_/g, '-');
+}
+
+function toStackName(projectName: string, targetName: string): string {
+  return `AgentCore-${sanitize(projectName)}-${sanitize(targetName)}`;
+}
+
+async function main() {
+  // Config root is parent of cdk/ directory. The CLI sets process.cwd() to agentcore/cdk/.
+  const configRoot = path.resolve(process.cwd(), '..');
+  const configIO = new ConfigIO({ baseDir: configRoot });
+
+  const spec = await configIO.readProjectSpec();
+  const targets = await configIO.readAWSDeploymentTargets();
+
+  // The vended CDK project compiles against the published @aws/agentcore-cdk
+  // schema type, which may lag the CLI's own AgentCoreProjectSpec (e.g. payments,
+  // harnesses, gateway fields). Cast once so those fields are reachable.
+  // eslint-disable-next-line @typescript-eslint/no-explicit-any
+  const specAny = spec as any;
+
+  // Extract MCP configuration from project spec.
+  // Gateway fields are stored in agentcore.json but may not yet be on the
+  const mcpSpec = specAny.agentCoreGateways?.length
+    ? {
+        agentCoreGateways: specAny.agentCoreGateways,
+        mcpRuntimeTools: specAny.mcpRuntimeTools,
+        unassignedTargets: specAny.unassignedTargets,
+      }
+    : undefined;
+
+  // Read deployed state for credential ARNs (populated by pre-deploy identity setup)
+  let deployedState: Record<string, unknown> | undefined;
+  try {
+    deployedState = JSON.parse(fs.readFileSync(path.join(configRoot, '.cli', 'deployed-state.json'), 'utf8'));
+  } catch {
+    // Deployed state may not exist on first deploy
+  }
+
+  if (targets.length === 0) {
+    throw new Error('No deployment targets configured. Please define targets in agentcore/aws-targets.json');
+  }
+
+  // Read harness configs: the full validated spec drives the CFN resource; the
+  // role-scoped fields drive the IAM role + container build.
+  const projectRoot = path.resolve(configRoot, '..');
+
+  // Read non-S3 KB connector-config files and pass their parsed contents to the
+  // L3 verbatim. The L3 does not read files; it expects the parsed
+  // connectorParameters keyed by the data source's connectorConfigFile path.
+  const connectorParametersByFile: Record<string, Record<string, unknown>> = {};
+  for (const kb of specAny.knowledgeBases ?? []) {
+    for (const ds of kb.dataSources ?? []) {
+      if (ds.type !== 'S3' && ds.connectorConfigFile) {
+        const abs = path.resolve(projectRoot, ds.connectorConfigFile);
+        try {
+          connectorParametersByFile[ds.connectorConfigFile] = JSON.parse(fs.readFileSync(abs, 'utf-8'));
+        } catch (err) {
+          throw new Error(
+            `Could not read connector config '${ds.connectorConfigFile}' for knowledge base '${kb.name}' at ${abs}: ${err instanceof Error ? err.message : err}`
+          );
+        }
+      }
+    }
+  }
+
+  // Synthesize an AWS::BedrockAgentCore::Harness resource for each harness entry in the spec.
+  const harnessConfigs: HarnessConfig[] = [];
+  for (const entry of specAny.harnesses ?? []) {
+    const harnessDir = path.resolve(projectRoot, entry.path);
+    const harnessPath = path.resolve(harnessDir, 'harness.json');
+    try {
+      const harnessSpec = HarnessSpecSchema.parse(JSON.parse(fs.readFileSync(harnessPath, 'utf-8')));
+      harnessConfigs.push({
+        name: entry.name,
+        executionRoleArn: harnessSpec.executionRoleArn,
+        // Only an `existing` memory ref carries a name to wire IAM against; managed memory is
+        // owned by the harness (no sibling) and disabled has none — both resolve to undefined.
+        memoryName: harnessSpec.memory?.mode === 'existing' ? harnessSpec.memory.name : undefined,
+        containerUri: harnessSpec.containerUri,
+        hasDockerfile: !!harnessSpec.dockerfile,
+        dockerfile: harnessSpec.dockerfile,
+        codeLocation: harnessSpec.dockerfile ? harnessDir : undefined,
+        tools: harnessSpec.tools,
+        skills: harnessSpec.skills,
+        apiKeyArn: harnessSpec.model?.apiKeyArn,
+        efsAccessPoints: harnessSpec.efsAccessPoints,
+        s3AccessPoints: harnessSpec.s3AccessPoints,
+        apiFormat: harnessSpec.model?.apiFormat,
+        // Full spec + dir drive the AWS::BedrockAgentCore::Harness CFN resource.
+        spec: harnessSpec,
+        harnessDir,
+      });
+    } catch (err) {
+      throw new Error(
+        `Could not read harness.json for "${entry.name}" at ${harnessPath}: ${err instanceof Error ? err.message : err}`
+      );
+    }
+  }
+
+  const app = new App();
+
+  for (const target of targets) {
+    const env = toEnvironment(target);
+    const stackName = toStackName(spec.name, target.name);
+
+    // Extract credentials from deployed state for this target
+    const targetState = (deployedState as Record<string, unknown>)?.targets as
+      | Record<string, Record<string, unknown>>
+      | undefined;
+    const targetResources = targetState?.[target.name]?.resources as Record<string, unknown> | undefined;
+    const credentials = targetResources?.credentials as
+      | Record<string, { credentialProviderArn: string; clientSecretArn?: string }>
+      | undefined;
+
+    // Payment credential provider ARNs live in the same credentials map as identity credentials
+    const paymentCredentials = credentials;
+
+    const paymentSpec = specAny.payments?.length
+      ? specAny.payments.map(
+          (p: {
+            name: string;
+            description?: string;
+            authorizerType: 'AWS_IAM' | 'CUSTOM_JWT';
+            authorizerConfiguration?: unknown;
+            autoPayment?: boolean;
+            paymentToolAllowlist?: string[];
+            networkPreferences?: string[];
+            connectors: {
+              name: string;
+              provider?: string;
+              provisionMode?: 'MANUAL' | 'QUICK_CREATE';
+              credentialName?: string;
+            }[];
+          }) => ({
+            name: p.name,
+            description: p.description,
+            authorizerType: p.authorizerType,
+            authorizerConfiguration: p.authorizerConfiguration,
+            autoPayment: p.autoPayment,
+            paymentToolAllowlist: p.paymentToolAllowlist,
+            networkPreferences: p.networkPreferences,
+            connectors: p.connectors.map(c => {
+              if (c.provisionMode === 'QUICK_CREATE') {
+                return {
+                  name: c.name,
+                  provider: 'CoinbaseCDP' as const,
+                  provisionMode: 'QUICK_CREATE' as const,
+                };
+              }
+
+              if (!c.credentialName) {
+                throw new Error(
+                  `Manual payment connector "${c.name}" on manager "${p.name}" is missing its credential name.`
+                );
+              }
+              const credentialProviderArn = paymentCredentials?.[c.credentialName]?.credentialProviderArn;
+              if (!credentialProviderArn) {
+                // Fail fast with an actionable message rather than passing an empty
+                // ARN that fails opaquely server-side at CreatePaymentConnector.
+                throw new Error(
+                  `Payment connector "${c.name}" on manager "${p.name}" references credential ` +
+                    `"${c.credentialName}", but no deployed credential provider was found for it. ` +
+                    `Run \`agentcore deploy\` so the credential provider is created first.`
+                );
+              }
+              return {
+                name: c.name,
+                provider: c.provider,
+                ...(c.provisionMode && { provisionMode: c.provisionMode }),
+                credentialName: c.credentialName,
+                credentialProviderArn,
+              };
+            }),
+          })
+        )
+      : undefined;
+
+    new AgentCoreStack(app, stackName, {
+      spec,
+      mcpSpec,
+      credentials,
+      connectorParametersByFile,
+      harnesses: harnessConfigs.length > 0 ? harnessConfigs : undefined,
+      paymentSpec,
+      env,
+      description: `AgentCore stack for ${spec.name} deployed to ${target.name} (${target.region})`,
+      tags: {
+        'agentcore:project-name': spec.name,
+        'agentcore:target-name': target.name,
+      },
+    });
+  }
+
+  app.synth();
+}
+
+main().catch((error: unknown) => {
+  console.error('AgentCore CDK synthesis failed:', error instanceof Error ? error.message : error);
+  process.exit(1);
+});