/* eslint-disable @typescript-eslint/no-unused-vars */
/**
 * READ-ONLY LLM CONTEXT - Do not edit this file.
 *
 * JSON File: agentcore/agentcore.json
 * Purpose: Current top-level AgentCore project configuration.
 */

interface AgentCoreProjectSpec {
  $schema?: string;
  name: string; // @regex ^[A-Za-z][A-Za-z0-9]{0,22}$ @min 1 @max 23
  version: number; // integer @min 1
  managedBy: 'CDK'; // default 'CDK'
  tags?: Tags;
  runtimes: AgentEnvSpec[]; // default [], unique by name
  memories: Memory[]; // default [], unique by name
  knowledgeBases: KnowledgeBase[]; // default [], unique by name
  credentials: Credential[]; // default [], unique by name
  evaluators: Evaluator[]; // default [], unique by name
  onlineEvalConfigs: OnlineEvalConfig[]; // default [], unique by name
  agentCoreGateways: AgentCoreGateway[]; // default [], unique by name
  mcpRuntimeTools?: AgentCoreMcpRuntimeTool[]; // unique by name
  unassignedTargets?: AgentCoreGatewayTarget[]; // unique by name
  policyEngines: PolicyEngine[]; // default [], unique by name
  configBundles: ConfigBundle[]; // default [], unique by name
  abTests: ABTest[]; // default [], unique by name
  harnesses: HarnessRegistryEntry[]; // default [], unique by name
  datasets?: Dataset[]; // unique by name
  payments?: PaymentManager[]; // unique by name
}

type Tags = Record<string, string>; // @max 50 entries; keys @min 1 @max 128; values @max 256
type BuildType = 'CodeZip' | 'Container';
type PythonRuntime = 'PYTHON_3_10' | 'PYTHON_3_11' | 'PYTHON_3_12' | 'PYTHON_3_13' | 'PYTHON_3_14';
type NodeRuntime = 'NODE_18' | 'NODE_20' | 'NODE_22';
type RuntimeVersion = PythonRuntime | NodeRuntime;
type NetworkMode = 'PUBLIC' | 'VPC';
type ProtocolMode = 'HTTP' | 'MCP' | 'A2A' | 'AGUI';

// RUNTIME

interface AgentEnvSpec {
  name: string; // @regex ^[a-zA-Z][a-zA-Z0-9_]{0,47}$ @min 1 @max 48
  description?: string; // @max 200
  build: BuildType;
  entrypoint: string; // @regex ^[a-zA-Z0-9_][a-zA-Z0-9_/.-]*\.(py|ts|js)(:[a-zA-Z_][a-zA-Z0-9_]*)?$
  codeLocation: string; // @min 1 directory path
  dockerfile?: string; // Container only, relative to build context, @min 1 @max 255
  buildContextPath?: string; // Container only, @min 1 directory path
  customDockerBuildArgs?: Record<string, string>; // Container only; keys @regex ^[A-Za-z_][A-Za-z0-9_]*$ @max 255; values @max 4096
  runtimeVersion?: RuntimeVersion;
  envVars?: EnvVar[];
  networkMode?: NetworkMode; // default 'PUBLIC'
  networkConfig?: NetworkConfig; // required only when networkMode is 'VPC'
  instrumentation?: Instrumentation;
  protocol?: ProtocolMode; // default 'HTTP'
  requestHeaderAllowlist?: string[]; // @max 20
  executionRoleArn?: string;
  additionalPolicies?: string[]; // managed-policy ARNs or policy JSON paths relative to codeLocation
  authorizerType?: RuntimeAuthorizerType; // default 'AWS_IAM'
  authorizerConfiguration?: AuthorizerConfig; // required only for CUSTOM_JWT
  tags?: Tags;
  lifecycleConfiguration?: LifecycleConfiguration;
  filesystemConfigurations?: FilesystemConfiguration[]; // @max 5; mount paths unique
  endpoints?: Record<string, RuntimeEndpoint>; // keys @regex ^[a-zA-Z][a-zA-Z0-9_]{0,47}$ @max 48
  connections?: Connection[];
}

interface EnvVar {
  name: string; // @regex ^[A-Za-z_][A-Za-z0-9_]*$ @min 1 @max 255
  value: string;
}

interface NetworkConfig {
  subnets: string[]; // @min 1 @max 16; each @regex ^subnet-(?:[0-9a-f]{8}|[0-9a-f]{17})$
  securityGroups: string[]; // @min 1 @max 16; each @regex ^sg-(?:[0-9a-f]{8}|[0-9a-f]{17})$
  vpcId?: string; // @regex ^vpc-(?:[0-9a-f]{8}|[0-9a-f]{17})$
}

interface Instrumentation {
  enableOtel: boolean; // default true
}

type FilesystemConfiguration =
  | { sessionStorage: SessionStorage }
  | { efsAccessPoint: EfsAccessPointConfig }
  | { s3FilesAccessPoint: S3FilesAccessPointConfig };

interface SessionStorage {
  mountPath: string; // @regex ^/mnt/[a-zA-Z0-9._-]+/?$ @min 6 @max 200
}

interface EfsAccessPointConfig {
  accessPointArn: string; // EFS access point ARN
  mountPath: string; // @regex ^/mnt/[a-zA-Z0-9._-]+/?$ @min 6 @max 200
}

interface S3FilesAccessPointConfig {
  accessPointArn: string; // S3 Files access point ARN
  mountPath: string; // @regex ^/mnt/[a-zA-Z0-9._-]+/?$ @min 6 @max 200
}

interface LifecycleConfiguration {
  idleRuntimeSessionTimeout?: number; // integer seconds @min 60 @max 28800; must be <= maxLifetime
  maxLifetime?: number; // integer seconds @min 60 @max 28800
}

interface RuntimeEndpoint {
  version: number; // integer @min 1
  description?: string; // @max 200
}

type RuntimeAuthorizerType = 'AWS_IAM' | 'CUSTOM_JWT';
type GatewayAuthorizerType = 'NONE' | 'AWS_IAM' | 'CUSTOM_JWT';

interface AuthorizerConfig {
  customJwtAuthorizer?: CustomJwtAuthorizerConfig;
}

interface CustomJwtAuthorizerConfig {
  discoveryUrl: string; // HTTPS URL ending in /.well-known/openid-configuration
  allowedAudience?: string[];
  allowedClients?: string[];
  allowedScopes?: string[]; // each @regex ^[\x21\x23-\x5B\x5D-\x7E]+$ @max 255
  customClaims?: CustomClaimValidation[]; // @min 1
  privateEndpoint?: PrivateEndpoint;
  privateEndpointOverrides?: PrivateEndpointOverride[]; // @max 5; requires privateEndpoint
}

interface CustomClaimValidation {
  inboundTokenClaimName: string; // @regex ^[A-Za-z0-9_.:-]+$ @min 1 @max 255
  inboundTokenClaimValueType: 'STRING' | 'STRING_ARRAY';
  authorizingClaimMatchValue: {
    claimMatchOperator: 'EQUALS' | 'CONTAINS' | 'CONTAINS_ANY';
    claimMatchValue:
      | { matchValueString: string; matchValueStringList?: never }
      | { matchValueString?: never; matchValueStringList: string[] };
  };
}

type PrivateEndpoint =
  | { selfManagedLatticeResource: SelfManagedLatticeResource; managedVpcResource?: never }
  | { selfManagedLatticeResource?: never; managedVpcResource: ManagedVpcResource };

interface SelfManagedLatticeResource {
  resourceConfigurationIdentifier: string; // rcfg ID or VPC Lattice resource-configuration ARN
}

interface ManagedVpcResource {
  vpcIdentifier: string; // VPC ID
  subnetIds: string[]; // @min 1
  endpointIpAddressType: 'IPV4' | 'IPV6';
  securityGroupIds?: string[]; // @max 5
  tags?: Tags;
  routingDomain?: string; // @min 3 @max 255
}

interface PrivateEndpointOverride {
  domain: string; // @min 1 @max 253
  privateEndpoint: PrivateEndpoint;
}

// EXTERNAL RESOURCE CONNECTIONS

interface Connection {
  id?: string; // @regex ^[a-zA-Z][a-zA-Z0-9_-]{0,63}$
  to: ConnectionTarget;
  access?: 'read' | 'readwrite'; // only meaningful for memory; default 'read'
  description?: string; // @max 200
}

type ConnectionTarget =
  | { type: 'memory'; arn: string; namespaces?: string[] }
  | { type: 'gateway'; arn: string; outboundAuth?: GatewayOutboundAuth }
  | { type: 'runtime'; arn: string; exec?: boolean }
  | { type: 'browser'; arn?: string }
  | { type: 'codeInterpreter'; arn?: string };

type GatewayOutboundAuth =
  | { awsIam: Record<string, never> }
  | { none: Record<string, never> }
  | {
      oauth: {
        providerArn: string;
        scopes: string[];
        grantType?: 'CLIENT_CREDENTIALS' | 'AUTHORIZATION_CODE' | 'TOKEN_EXCHANGE';
        customParameters?: Record<string, string>;
      };
    };

// MEMORY

interface Memory {
  name: string; // @regex ^[a-zA-Z][a-zA-Z0-9_]{0,47}$ @min 1 @max 48
  eventExpiryDuration: number; // integer days @min 3 @max 365
  strategies: MemoryStrategy[]; // default [], unique by type
  indexedKeys?: IndexedKey[]; // @max 10, unique by key; requires at least one strategy
  tags?: Tags;
  encryptionKeyArn?: string;
  executionRoleArn?: string;
  streamDeliveryResources?: StreamDeliveryResources;
}

type MemoryStrategyType = 'SEMANTIC' | 'SUMMARIZATION' | 'USER_PREFERENCE' | 'EPISODIC';

interface MemoryStrategy {
  type: MemoryStrategyType;
  name?: string; // @regex ^[a-zA-Z][a-zA-Z0-9_]{0,47}$ @max 48
  description?: string;
  namespaceTemplates?: string[];
  reflectionNamespaceTemplates?: string[]; // EPISODIC only and required for EPISODIC
  /** @deprecated Use namespaceTemplates. */
  namespaces?: string[];
  /** @deprecated Use reflectionNamespaceTemplates. */
  reflectionNamespaces?: string[];
}

interface IndexedKey {
  key: string; // @regex ^[a-zA-Z0-9\s._:/=+@-]+$ @min 1 @max 128
  type: 'STRING' | 'STRINGLIST' | 'NUMBER';
}

interface StreamDeliveryResources {
  resources: {
    kinesis: {
      dataStreamArn: string;
      contentConfigurations: {
        type: 'MEMORY_RECORDS';
        level: 'FULL_CONTENT' | 'METADATA_ONLY';
      }[];
    };
  }[];
}

// KNOWLEDGE BASE

interface KnowledgeBase {
  type: 'AgentCoreKnowledgeBase'; // default 'AgentCoreKnowledgeBase'
  name: string; // @regex ^[a-zA-Z][a-zA-Z0-9_-]{0,47}$ @min 1 @max 48
  description?: string; // @max 2048
  dataSources: DataSource[]; // @min 1, unique by URI/config file
  gateway?: string;
}

type DataSource =
  | { type: 'S3'; uri: string } // valid s3:// URI
  | {
      type: 'WEB' | 'CONFLUENCE' | 'SHAREPOINT' | 'ONEDRIVE' | 'GOOGLEDRIVE';
      connectorConfigFile: string;
    };

// CREDENTIAL

type Credential = ApiKeyCredential | OAuthCredential | PaymentCredential;

interface ApiKeyCredential {
  authorizerType: 'ApiKeyCredentialProvider';
  name: string; // @regex ^[a-zA-Z0-9\-_]+$ @min 1 @max 128
}

interface OAuthCredential {
  authorizerType: 'OAuthCredentialProvider';
  name: string; // @regex ^[a-zA-Z0-9\-_]+$ @min 1 @max 128
  discoveryUrl?: string;
  scopes?: string[];
  vendor: string; // default 'CustomOauth2'
  managed?: boolean;
  usage?: 'inbound' | 'outbound';
}

interface PaymentCredential {
  authorizerType: 'PaymentCredentialProvider';
  name: string; // @regex ^[a-zA-Z0-9\-_]+$ @min 1 @max 128
  provider: PaymentProvider;
}

// EVALUATION

interface Evaluator {
  name: string; // @regex ^[a-zA-Z][a-zA-Z0-9_]{0,47}$ @min 1 @max 48
  level: 'SESSION' | 'TRACE' | 'TOOL_CALL';
  description?: string;
  config: { llmAsAJudge: LlmAsAJudgeConfig; codeBased?: never } | { llmAsAJudge?: never; codeBased: CodeBasedConfig };
  kmsKeyArn?: string;
  tags?: Tags;
}

interface LlmAsAJudgeConfig {
  modelProvider?: 'Bedrock' | 'OpenResponses'; // Defaults to Bedrock when omitted
  model: string; // Bedrock model ID/ARN or OpenAI model ID
  instructions: string;
  ratingScale:
    | { numerical: { value: number; label: string; definition: string }[]; categorical?: never }
    | { numerical?: never; categorical: { label: string; definition: string }[] };
}

type CodeBasedConfig =
  | { managed: ManagedCodeBasedConfig; external?: never }
  | { managed?: never; external: ExternalCodeBasedConfig };

interface ManagedCodeBasedConfig {
  codeLocation: string;
  entrypoint: string; // default 'lambda_function.handler'
  timeoutSeconds: number; // integer @min 1 @max 300, default 60
  additionalPolicies?: string[];
}

interface ExternalCodeBasedConfig {
  lambdaArn: string; // Lambda function ARN
}

interface OnlineEvalConfig {
  name: string; // @regex ^[a-zA-Z][a-zA-Z0-9_]{0,47}$ @min 1 @max 48
  agent?: string; // mutually exclusive with logGroupNames
  endpoint?: string; // requires agent
  logGroupNames?: string[]; // @min 1 @max 5, mutually exclusive with agent
  serviceNames?: string[]; // @min 1, requires logGroupNames
  evaluators?: string[];
  insights?: string[];
  clusteringConfig?: { frequencies: ('DAILY' | 'WEEKLY' | 'MONTHLY')[] }; // @min 1 @max 3; requires insights
  samplingRate: number; // @min 0.01 @max 100
  description?: string; // @max 200
  enableOnCreate?: boolean;
  tags?: Tags;
}

// GATEWAY

type GatewayTargetType =
  | 'lambda'
  | 'mcpServer'
  | 'openApiSchema'
  | 'smithyModel'
  | 'apiGateway'
  | 'lambdaFunctionArn'
  | 'httpRuntime'
  | 'connector'
  | 'passthrough';

interface AgentCoreGateway {
  name: string; // @regex ^[0-9a-zA-Z](?:[0-9a-zA-Z-]*[0-9a-zA-Z])?$ @min 1 @max 100
  resourceName?: string; // imported AWS resource name, same constraints as name
  protocolType?: 'MCP' | 'None';
  description?: string;
  targets: AgentCoreGatewayTarget[];
  authorizerType: GatewayAuthorizerType; // default 'NONE'
  authorizerConfiguration?: AuthorizerConfig; // required only for CUSTOM_JWT
  enableSemanticSearch: boolean; // default true
  exceptionLevel: 'NONE' | 'DEBUG'; // default 'NONE'
  policyEngineConfiguration?: {
    policyEngineName: string;
    mode: 'LOG_ONLY' | 'ENFORCE';
  };
  executionRoleArn?: string; // IAM role ARN @max 2048
  tags?: Tags;
}

interface AgentCoreGatewayTarget {
  name: string;
  targetType: GatewayTargetType;
  toolDefinitions?: ToolDefinition[];
  compute?: ToolComputeConfig;
  endpoint?: string; // mcpServer URL
  outboundAuth?: OutboundAuth;
  apiGateway?: ApiGatewayConfig;
  schemaSource?: SchemaSource;
  lambdaFunctionArn?: LambdaFunctionArnConfig;
  httpRuntime?: HttpRuntimeConfig;
  connectorId?: 'bedrock-knowledge-bases' | 'web-search';
  configurations?: ConnectorConfiguration[];
  passthrough?: PassthroughConfig;
}

interface ToolDefinition {
  name: string; // @min 1 @max 128
  description: string;
  inputSchema: SchemaDefinition;
  outputSchema?: SchemaDefinition;
}

interface SchemaDefinition {
  type: 'string' | 'number' | 'object' | 'array' | 'boolean' | 'integer';
  description?: string;
  items?: SchemaDefinition;
  properties?: Record<string, SchemaDefinition>;
  required?: string[];
}

type ToolComputeConfig = LambdaComputeConfig | AgentCoreRuntimeComputeConfig;

interface LambdaComputeConfig {
  host: 'Lambda';
  implementation: ToolImplementationBinding;
  nodeVersion?: NodeRuntime; // required for TypeScript
  pythonVersion?: PythonRuntime; // required for Python
  timeout?: number; // integer @min 1 @max 900
  memorySize?: number; // integer @min 128 @max 10240
  iamPolicy?: IamPolicyDocument;
}

interface AgentCoreRuntimeComputeConfig {
  host: 'AgentCoreRuntime';
  implementation: ToolImplementationBinding; // Python only
  runtime?: RuntimeConfig;
  iamPolicy?: IamPolicyDocument;
}

interface ToolImplementationBinding {
  language: 'TypeScript' | 'Python';
  path: string;
  handler: string;
}

interface RuntimeConfig {
  artifact: 'CodeZip';
  pythonVersion: PythonRuntime;
  name: string; // @regex ^[a-zA-Z][a-zA-Z0-9_]{0,47}$ @max 48
  entrypoint: string; // Python file path with optional handler
  codeLocation: string;
  instrumentation?: Instrumentation;
  networkMode: NetworkMode; // default 'PUBLIC'
  description?: string;
}

interface IamPolicyDocument {
  Version: string;
  Statement: unknown[];
  [key: string]: unknown;
}

interface OutboundAuth {
  type: 'OAUTH' | 'API_KEY' | 'NONE' | 'GATEWAY_IAM_ROLE' | 'JWT_PASSTHROUGH'; // default 'NONE'
  credentialName?: string;
  scopes?: string[];
  service?: string; // @min 1 @max 64; required for passthrough GATEWAY_IAM_ROLE
  region?: string; // @min 1 @max 32
}

interface ApiGatewayConfig {
  restApiId: string;
  stage: string;
  apiGatewayToolConfiguration: {
    toolFilters: {
      filterPath: string;
      methods: ApiGatewayHttpMethod[];
    }[];
    toolOverrides?: {
      name: string;
      path: string;
      method: ApiGatewayHttpMethod;
      description?: string;
    }[];
  };
}

type ApiGatewayHttpMethod = 'GET' | 'POST' | 'PUT' | 'DELETE' | 'PATCH' | 'HEAD' | 'OPTIONS';
type SchemaSource = { inline: { path: string } } | { s3: { uri: string; bucketOwnerAccountId?: string } };

interface LambdaFunctionArnConfig {
  lambdaArn: string; // @min 1 @max 170
  toolSchemaFile: string;
}

interface HttpRuntimeConfig {
  runtime: string; // project runtime name
  runtimeEndpoint?: string; // endpoint alias
}

interface ConnectorConfiguration {
  name: string;
  description?: string;
  parameterValues?: Record<string, unknown>;
  parameterOverrides?: {
    path: string;
    description?: string;
    visible?: boolean;
  }[];
}

interface PassthroughConfig {
  endpoint: string; // HTTPS URL
  protocolType: 'MCP' | 'A2A' | 'INFERENCE' | 'CUSTOM'; // default 'CUSTOM'
  stickinessConfiguration?: {
    identifier: string; // @min 1 @max 256
    timeout?: number; // integer @min 1 @max 86400
  };
}

interface AgentCoreMcpRuntimeTool {
  name: string;
  toolDefinition: ToolDefinition;
  compute: AgentCoreRuntimeComputeConfig;
  bindings?: {
    runtimeName: string;
    envVarName: string; // @regex ^[A-Za-z_][A-Za-z0-9_]*$ @max 255
  }[];
}

// POLICY

interface PolicyEngine {
  name: string; // @regex ^[A-Za-z][A-Za-z0-9_]{0,47}$ @min 1 @max 48
  description?: string; // @min 1 @max 4096
  encryptionKeyArn?: string;
  tags?: Tags;
  policies: Policy[]; // default [], unique by name
}

interface Policy {
  name: string; // @regex ^[A-Za-z][A-Za-z0-9_]{0,47}$ @min 1 @max 48
  description?: string; // @min 1 @max 4096
  statement: string;
  sourceFile?: string;
  validationMode: 'FAIL_ON_ANY_FINDINGS' | 'IGNORE_ALL_FINDINGS'; // default 'FAIL_ON_ANY_FINDINGS'
  enforcementMode: 'ACTIVE' | 'LOG_ONLY'; // default 'ACTIVE'
  authorizationPhase?: 'INITIATE' | 'RETURN_OUTPUT'; // default 'INITIATE'
}

// CONFIG BUNDLE

interface ConfigBundle {
  name: string; // @regex ^[a-zA-Z][a-zA-Z0-9_]{0,99}$ @min 1 @max 100
  type: 'ConfigurationBundle'; // default 'ConfigurationBundle'
  description?: string; // @min 1 @max 500
  components: Record<string, ComponentConfiguration>;
  branchName?: string; // @max 128
  commitMessage?: string; // @max 500
  kmsKeyArn?: string;
}

interface ComponentConfiguration {
  configuration: Record<string, unknown>;
}

// A/B TEST

interface ABTest {
  name: string; // @regex ^[a-zA-Z][a-zA-Z0-9_]{0,47}$ @min 1 @max 48
  description?: string; // @min 1 @max 200
  mode: 'config-bundle' | 'target-based'; // default 'config-bundle'
  gatewayRef: string;
  roleArn?: string;
  variants: [ABTestVariant, ABTestVariant]; // one C and one T1; weights sum to 100
  evaluationConfig:
    | { onlineEvaluationConfigArn: string }
    | {
        perVariantOnlineEvaluationConfig: [PerVariantOnlineEvaluationConfig, PerVariantOnlineEvaluationConfig];
      };
  gatewayFilter?: { targetPaths: string[] }; // @max 1; each @max 500
  enableOnCreate?: boolean;
  promoted?: boolean;
}

interface ABTestVariant {
  name: 'C' | 'T1';
  weight: number; // integer @min 1 @max 100
  variantConfiguration:
    | { configurationBundle: { bundleArn: string; bundleVersion: string }; target?: never }
    | { configurationBundle?: never; target: { targetName: string } };
}

interface PerVariantOnlineEvaluationConfig {
  treatmentName: 'C' | 'T1';
  onlineEvaluationConfigArn: string;
}

// HARNESS REGISTRY

interface HarnessRegistryEntry {
  name: string; // @regex ^[a-zA-Z][a-zA-Z0-9_]{0,39}$ @min 1 @max 40
  path: string; // project-relative harness config directory
}

// DATASET

interface Dataset {
  name: string; // @regex ^[a-zA-Z][a-zA-Z0-9_]{0,47}$ @min 1 @max 48
  schemaType: 'AGENTCORE_EVALUATION_PREDEFINED_V1' | 'AGENTCORE_EVALUATION_SIMULATED_V1';
  description?: string; // @max 200
  config: { managed: { location: string } };
  kmsKeyArn?: string;
}

// PAYMENTS

type PaymentProvider = 'CoinbaseCDP' | 'StripePrivy';

interface PaymentManager {
  name: string; // @regex ^[a-zA-Z][a-zA-Z0-9]{0,47}$ @min 1 @max 48
  authorizerType: 'AWS_IAM' | 'CUSTOM_JWT'; // default 'AWS_IAM'
  authorizerConfiguration?: {
    customJWTAuthorizer: {
      discoveryUrl: string;
      allowedClients?: string[];
      allowedAudience?: string[];
      allowedScopes?: string[];
    };
  };
  connectors: PaymentConnector[]; // default []
  description?: string;
  autoPayment: boolean; // default true
  defaultSpendLimit: string; // default '10.00'
  paymentToolAllowlist?: string[];
  networkPreferences?: string[];
}

type PaymentConnector = ManualPaymentConnector | QuickCreatePaymentConnector;

interface ManualPaymentConnector {
  name: string; // @regex ^[a-zA-Z][a-zA-Z0-9_]{0,47}$ @min 1 @max 48
  provider: PaymentProvider; // default 'CoinbaseCDP'
  provisionMode?: 'MANUAL';
  credentialName: string;
}

interface QuickCreatePaymentConnector {
  name: string; // @regex ^[a-zA-Z][a-zA-Z0-9_]{0,47}$ @min 1 @max 48
  provider: 'CoinbaseCDP';
  provisionMode: 'QUICK_CREATE';
}