feat(gateway): add custom claims validation and TUI wizard for JWT auth

[aidandaly24]

Description

Adds custom JWT claims validation and a full TUI wizard flow for configuring Custom JWT gateway authorization.

Stacked PR: This PR includes changes from #598 (inbound auth hardening). Merge #598 first, then rebase this onto main — the diff will shrink to only the custom claims feature.

TUI Wizard Screenshots

1. Authorizer Type Selection

2. JWT Constraint Picker

3. Constraints Selected (Allowed Clients + Custom Claims)

4. Custom Claims Form

Custom Claims Schema

• ClaimMatchOperatorSchema — operators: Equals, StartsWith, Contains, NotEquals
• ClaimMatchValueSchema — string value with 1-256 char limit
• InboundTokenClaimValueTypeSchema — String, Number, Boolean, Array
• CustomClaimValidationSchema — strict object with claimName, operator, matchValue, valueType
• Wired into CustomJwtAuthorizerConfigSchema as optional customClaims array
• Added to deployed-state.ts for deployment state tracking

CLI Support

• Added --custom-claims flag accepting JSON array (e.g., --custom-claims '[{"claimName":"dept","operator":"Equals","matchValue":"engineering","valueType":"String"}]')
• Validation: JSON parse, array check, per-claim field validation
• GatewayPrimitive passes custom claims through to authorizer configuration

TUI Wizard

• Expanded JWT config flow with custom claims manager:
  • Add claim sub-flow: claim name → operator → match value → value type
  • Edit/delete existing claims
  • Done to proceed
• Client credentials made optional (skip with empty Enter)
• Human-readable claim summary in confirm review screen
• Step counter updated dynamically

Testing (comprehensive)

• AddGatewayJwtConfig.test.tsx — TUI component tests covering the full JWT wizard flow
• finishJwtConfig.test.ts — unit tests for config assembly helper
• useAddGatewayWizard.test.tsx — extended with JWT + custom claims wizard flows
• GatewayPrimitive.test.ts — custom claims round-trip through primitive
• validate.test.ts — custom claims CLI validation cases
• mcp.test.ts — schema-level custom claims tests
• add-gateway-jwt.test.ts — TUI integration test via harness

Related Issue

Extracted from #596 (replaces it together with #597 and #598)

Documentation PR

N/A

Type of Change

• Bug fix
• New feature
• Breaking change
• Documentation update
• Other (please describe):

Testing

How have you tested the change?

• I ran npm run test:unit and npm run test:integ
• I ran npm run typecheck
• I ran npm run lint
• If I modified src/assets/, I ran npm run test:update-snapshots and committed the updated snapshots

Checklist

• I have read the CONTRIBUTING document
• I have added any necessary tests that prove my fix is effective or my feature works
• I have updated the documentation accordingly
• I have added an appropriate example to the documentation to outline the feature, or no new docs are needed
• My changes generate no new warnings
• Any dependent changes have been merged and published

---

By submitting this pull request, I confirm that you can use, modify, copy, and redistribute this contribution, under the
terms of your choice.

[tejaskash]

Code review

Found 2 issues:

1. createManagedOAuthCredential only writes CLIENT_SECRET to .env, but the current main branch (from PR feat: add policy engine and policy support #579) writes both CLIENT_ID and CLIENT_SECRET. When this PR lands, the CLIENT_ID env var will be lost, causing runtime failures for managed OAuth credentials.

agentcore-cli/src/cli/primitives/GatewayPrimitive.ts

Lines 427 to 431 in af1ddac

	// Write client secret to .env
	constenvVarName=computeDefaultCredentialEnvVarName(credentialName);
	awaitsetEnvVar(envVarName,jwtConfig.clientSecret!);
	}

2. Inline dynamic import in a React component violates AGENTS.md ("Never use inline imports. Imports must always go at the top of the file."). Should be a top-level static import.

agentcore-cli/src/cli/tui/screens/policy/AddPolicyScreen.tsx

Lines 189 to 191 in af1ddac

	// policyEngineId is needed; get it from deployed state
	const{ policyEnginePrimitive }=awaitimport('../../../primitives/registry');
	constpolicyEngineId=awaitpolicyEnginePrimitive.getDeployedEngineId(wizard.config.engine);

[tejaskash]

Review comments addressed: CLIENT_ID env var restored, inline import moved to top-level.

The base branch was changed.

[aidandaly24]

Description

Adds custom JWT claims validation and a full TUI wizard flow for configuring Custom JWT gateway authorization.

Stacked PR: This PR includes changes from #598 (inbound auth hardening). Merge #598 first, then rebase this onto main — the diff will shrink to only the custom claims feature.

TUI Wizard Screenshots

1. Authorizer Type Selection

2. JWT Constraint Picker

3. Constraints Selected (Allowed Clients + Custom Claims)

4. Custom Claims Form

Custom Claims Schema

• ClaimMatchOperatorSchema — operators: Equals, StartsWith, Contains, NotEquals
• ClaimMatchValueSchema — string value with 1-256 char limit
• InboundTokenClaimValueTypeSchema — String, Number, Boolean, Array
• CustomClaimValidationSchema — strict object with claimName, operator, matchValue, valueType
• Wired into CustomJwtAuthorizerConfigSchema as optional customClaims array
• Added to deployed-state.ts for deployment state tracking

CLI Support

• Added --custom-claims flag accepting JSON array (e.g., --custom-claims '[{"claimName":"dept","operator":"Equals","matchValue":"engineering","valueType":"String"}]')
• Validation: JSON parse, array check, per-claim field validation
• GatewayPrimitive passes custom claims through to authorizer configuration

TUI Wizard

• Expanded JWT config flow with custom claims manager:
  • Add claim sub-flow: claim name → operator → match value → value type
  • Edit/delete existing claims
  • Done to proceed
• Client credentials made optional (skip with empty Enter)
• Human-readable claim summary in confirm review screen
• Step counter updated dynamically

Testing (comprehensive)

• AddGatewayJwtConfig.test.tsx — TUI component tests covering the full JWT wizard flow
• finishJwtConfig.test.ts — unit tests for config assembly helper
• useAddGatewayWizard.test.tsx — extended with JWT + custom claims wizard flows
• GatewayPrimitive.test.ts — custom claims round-trip through primitive
• validate.test.ts — custom claims CLI validation cases
• mcp.test.ts — schema-level custom claims tests
• add-gateway-jwt.test.ts — TUI integration test via harness

Related Issue

Extracted from #596 (replaces it together with #597 and #598)

Documentation PR

N/A

Type of Change

• Bug fix
• New feature
• Breaking change
• Documentation update
• Other (please describe):

Testing

How have you tested the change?

• I ran npm run test:unit and npm run test:integ
• I ran npm run typecheck
• I ran npm run lint
• If I modified src/assets/, I ran npm run test:update-snapshots and committed the updated snapshots

Checklist

• I have read the CONTRIBUTING document
• I have added any necessary tests that prove my fix is effective or my feature works
• I have updated the documentation accordingly
• I have added an appropriate example to the documentation to outline the feature, or no new docs are needed
• My changes generate no new warnings
• Any dependent changes have been merged and published

---

By submitting this pull request, I confirm that you can use, modify, copy, and redistribute this contribution, under the
terms of your choice.

[tejaskash]

Code review

Found 2 issues:

1. createManagedOAuthCredential only writes CLIENT_SECRET to .env, but the current main branch (from PR feat: add policy engine and policy support #579) writes both CLIENT_ID and CLIENT_SECRET. When this PR lands, the CLIENT_ID env var will be lost, causing runtime failures for managed OAuth credentials.

agentcore-cli/src/cli/primitives/GatewayPrimitive.ts

Lines 427 to 431 in af1ddac

	// Write client secret to .env
	constenvVarName=computeDefaultCredentialEnvVarName(credentialName);
	awaitsetEnvVar(envVarName,jwtConfig.clientSecret!);
	}

2. Inline dynamic import in a React component violates AGENTS.md ("Never use inline imports. Imports must always go at the top of the file."). Should be a top-level static import.

agentcore-cli/src/cli/tui/screens/policy/AddPolicyScreen.tsx

Lines 189 to 191 in af1ddac

	// policyEngineId is needed; get it from deployed state
	const{ policyEnginePrimitive }=awaitimport('../../../primitives/registry');
	constpolicyEngineId=awaitpolicyEnginePrimitive.getDeployedEngineId(wizard.config.engine);

[tejaskash]

Review comments addressed: CLIENT_ID env var restored, inline import moved to top-level.

The base branch was changed.

[aidandaly24]

Description

Adds custom JWT claims validation and a full TUI wizard flow for configuring Custom JWT gateway authorization.

Stacked PR: This PR includes changes from #598 (inbound auth hardening). Merge #598 first, then rebase this onto main — the diff will shrink to only the custom claims feature.

TUI Wizard Screenshots

1. Authorizer Type Selection

2. JWT Constraint Picker

3. Constraints Selected (Allowed Clients + Custom Claims)

4. Custom Claims Form

Custom Claims Schema

• ClaimMatchOperatorSchema — operators: Equals, StartsWith, Contains, NotEquals
• ClaimMatchValueSchema — string value with 1-256 char limit
• InboundTokenClaimValueTypeSchema — String, Number, Boolean, Array
• CustomClaimValidationSchema — strict object with claimName, operator, matchValue, valueType
• Wired into CustomJwtAuthorizerConfigSchema as optional customClaims array
• Added to deployed-state.ts for deployment state tracking

CLI Support

• Added --custom-claims flag accepting JSON array (e.g., --custom-claims '[{"claimName":"dept","operator":"Equals","matchValue":"engineering","valueType":"String"}]')
• Validation: JSON parse, array check, per-claim field validation
• GatewayPrimitive passes custom claims through to authorizer configuration

TUI Wizard

• Expanded JWT config flow with custom claims manager:
  • Add claim sub-flow: claim name → operator → match value → value type
  • Edit/delete existing claims
  • Done to proceed
• Client credentials made optional (skip with empty Enter)
• Human-readable claim summary in confirm review screen
• Step counter updated dynamically

Testing (comprehensive)

• AddGatewayJwtConfig.test.tsx — TUI component tests covering the full JWT wizard flow
• finishJwtConfig.test.ts — unit tests for config assembly helper
• useAddGatewayWizard.test.tsx — extended with JWT + custom claims wizard flows
• GatewayPrimitive.test.ts — custom claims round-trip through primitive
• validate.test.ts — custom claims CLI validation cases
• mcp.test.ts — schema-level custom claims tests
• add-gateway-jwt.test.ts — TUI integration test via harness

Related Issue

Extracted from #596 (replaces it together with #597 and #598)

Documentation PR

N/A

Type of Change

• Bug fix
• New feature
• Breaking change
• Documentation update
• Other (please describe):

Testing

How have you tested the change?

• I ran npm run test:unit and npm run test:integ
• I ran npm run typecheck
• I ran npm run lint
• If I modified src/assets/, I ran npm run test:update-snapshots and committed the updated snapshots

Checklist

• I have read the CONTRIBUTING document
• I have added any necessary tests that prove my fix is effective or my feature works
• I have updated the documentation accordingly
• I have added an appropriate example to the documentation to outline the feature, or no new docs are needed
• My changes generate no new warnings
• Any dependent changes have been merged and published

---

By submitting this pull request, I confirm that you can use, modify, copy, and redistribute this contribution, under the
terms of your choice.

[tejaskash]

Code review

Found 2 issues:

1. createManagedOAuthCredential only writes CLIENT_SECRET to .env, but the current main branch (from PR feat: add policy engine and policy support #579) writes both CLIENT_ID and CLIENT_SECRET. When this PR lands, the CLIENT_ID env var will be lost, causing runtime failures for managed OAuth credentials.

agentcore-cli/src/cli/primitives/GatewayPrimitive.ts

Lines 427 to 431 in af1ddac

	// Write client secret to .env
	constenvVarName=computeDefaultCredentialEnvVarName(credentialName);
	awaitsetEnvVar(envVarName,jwtConfig.clientSecret!);
	}

2. Inline dynamic import in a React component violates AGENTS.md ("Never use inline imports. Imports must always go at the top of the file."). Should be a top-level static import.

agentcore-cli/src/cli/tui/screens/policy/AddPolicyScreen.tsx

Lines 189 to 191 in af1ddac

	// policyEngineId is needed; get it from deployed state
	const{ policyEnginePrimitive }=awaitimport('../../../primitives/registry');
	constpolicyEngineId=awaitpolicyEnginePrimitive.getDeployedEngineId(wizard.config.engine);

[tejaskash]

Review comments addressed: CLIENT_ID env var restored, inline import moved to top-level.

The base branch was changed.

[aidandaly24]

Description

Adds custom JWT claims validation and a full TUI wizard flow for configuring Custom JWT gateway authorization.

Stacked PR: This PR includes changes from #598 (inbound auth hardening). Merge #598 first, then rebase this onto main — the diff will shrink to only the custom claims feature.

TUI Wizard Screenshots

1. Authorizer Type Selection

2. JWT Constraint Picker

3. Constraints Selected (Allowed Clients + Custom Claims)

4. Custom Claims Form

Custom Claims Schema

• ClaimMatchOperatorSchema — operators: Equals, StartsWith, Contains, NotEquals
• ClaimMatchValueSchema — string value with 1-256 char limit
• InboundTokenClaimValueTypeSchema — String, Number, Boolean, Array
• CustomClaimValidationSchema — strict object with claimName, operator, matchValue, valueType
• Wired into CustomJwtAuthorizerConfigSchema as optional customClaims array
• Added to deployed-state.ts for deployment state tracking

CLI Support

• Added --custom-claims flag accepting JSON array (e.g., --custom-claims '[{"claimName":"dept","operator":"Equals","matchValue":"engineering","valueType":"String"}]')
• Validation: JSON parse, array check, per-claim field validation
• GatewayPrimitive passes custom claims through to authorizer configuration

TUI Wizard

• Expanded JWT config flow with custom claims manager:
  • Add claim sub-flow: claim name → operator → match value → value type
  • Edit/delete existing claims
  • Done to proceed
• Client credentials made optional (skip with empty Enter)
• Human-readable claim summary in confirm review screen
• Step counter updated dynamically

Testing (comprehensive)

• AddGatewayJwtConfig.test.tsx — TUI component tests covering the full JWT wizard flow
• finishJwtConfig.test.ts — unit tests for config assembly helper
• useAddGatewayWizard.test.tsx — extended with JWT + custom claims wizard flows
• GatewayPrimitive.test.ts — custom claims round-trip through primitive
• validate.test.ts — custom claims CLI validation cases
• mcp.test.ts — schema-level custom claims tests
• add-gateway-jwt.test.ts — TUI integration test via harness

Related Issue

Extracted from #596 (replaces it together with #597 and #598)

Documentation PR

N/A

Type of Change

• Bug fix
• New feature
• Breaking change
• Documentation update
• Other (please describe):

Testing

How have you tested the change?

• I ran npm run test:unit and npm run test:integ
• I ran npm run typecheck
• I ran npm run lint
• If I modified src/assets/, I ran npm run test:update-snapshots and committed the updated snapshots

Checklist

• I have read the CONTRIBUTING document
• I have added any necessary tests that prove my fix is effective or my feature works
• I have updated the documentation accordingly
• I have added an appropriate example to the documentation to outline the feature, or no new docs are needed
• My changes generate no new warnings
• Any dependent changes have been merged and published

---

By submitting this pull request, I confirm that you can use, modify, copy, and redistribute this contribution, under the
terms of your choice.

[tejaskash]

Code review

Found 2 issues:

1. createManagedOAuthCredential only writes CLIENT_SECRET to .env, but the current main branch (from PR feat: add policy engine and policy support #579) writes both CLIENT_ID and CLIENT_SECRET. When this PR lands, the CLIENT_ID env var will be lost, causing runtime failures for managed OAuth credentials.

agentcore-cli/src/cli/primitives/GatewayPrimitive.ts

Lines 427 to 431 in af1ddac

	// Write client secret to .env
	constenvVarName=computeDefaultCredentialEnvVarName(credentialName);
	awaitsetEnvVar(envVarName,jwtConfig.clientSecret!);
	}

2. Inline dynamic import in a React component violates AGENTS.md ("Never use inline imports. Imports must always go at the top of the file."). Should be a top-level static import.

agentcore-cli/src/cli/tui/screens/policy/AddPolicyScreen.tsx

Lines 189 to 191 in af1ddac

	// policyEngineId is needed; get it from deployed state
	const{ policyEnginePrimitive }=awaitimport('../../../primitives/registry');
	constpolicyEngineId=awaitpolicyEnginePrimitive.getDeployedEngineId(wizard.config.engine);

[tejaskash]

Review comments addressed: CLIENT_ID env var restored, inline import moved to top-level.

The base branch was changed.

[aidandaly24]

Description

Adds custom JWT claims validation and a full TUI wizard flow for configuring Custom JWT gateway authorization.

Stacked PR: This PR includes changes from #598 (inbound auth hardening). Merge #598 first, then rebase this onto main — the diff will shrink to only the custom claims feature.

TUI Wizard Screenshots

1. Authorizer Type Selection

2. JWT Constraint Picker

3. Constraints Selected (Allowed Clients + Custom Claims)

4. Custom Claims Form

Custom Claims Schema

• ClaimMatchOperatorSchema — operators: Equals, StartsWith, Contains, NotEquals
• ClaimMatchValueSchema — string value with 1-256 char limit
• InboundTokenClaimValueTypeSchema — String, Number, Boolean, Array
• CustomClaimValidationSchema — strict object with claimName, operator, matchValue, valueType
• Wired into CustomJwtAuthorizerConfigSchema as optional customClaims array
• Added to deployed-state.ts for deployment state tracking

CLI Support

• Added --custom-claims flag accepting JSON array (e.g., --custom-claims '[{"claimName":"dept","operator":"Equals","matchValue":"engineering","valueType":"String"}]')
• Validation: JSON parse, array check, per-claim field validation
• GatewayPrimitive passes custom claims through to authorizer configuration

TUI Wizard

• Expanded JWT config flow with custom claims manager:
  • Add claim sub-flow: claim name → operator → match value → value type
  • Edit/delete existing claims
  • Done to proceed
• Client credentials made optional (skip with empty Enter)
• Human-readable claim summary in confirm review screen
• Step counter updated dynamically

Testing (comprehensive)

• AddGatewayJwtConfig.test.tsx — TUI component tests covering the full JWT wizard flow
• finishJwtConfig.test.ts — unit tests for config assembly helper
• useAddGatewayWizard.test.tsx — extended with JWT + custom claims wizard flows
• GatewayPrimitive.test.ts — custom claims round-trip through primitive
• validate.test.ts — custom claims CLI validation cases
• mcp.test.ts — schema-level custom claims tests
• add-gateway-jwt.test.ts — TUI integration test via harness

Related Issue

Extracted from #596 (replaces it together with #597 and #598)

Documentation PR

N/A

Type of Change

• Bug fix
• New feature
• Breaking change
• Documentation update
• Other (please describe):

Testing

How have you tested the change?

• I ran npm run test:unit and npm run test:integ
• I ran npm run typecheck
• I ran npm run lint
• If I modified src/assets/, I ran npm run test:update-snapshots and committed the updated snapshots

Checklist

• I have read the CONTRIBUTING document
• I have added any necessary tests that prove my fix is effective or my feature works
• I have updated the documentation accordingly
• I have added an appropriate example to the documentation to outline the feature, or no new docs are needed
• My changes generate no new warnings
• Any dependent changes have been merged and published

---

By submitting this pull request, I confirm that you can use, modify, copy, and redistribute this contribution, under the
terms of your choice.

[tejaskash]

Code review

Found 2 issues:

1. createManagedOAuthCredential only writes CLIENT_SECRET to .env, but the current main branch (from PR feat: add policy engine and policy support #579) writes both CLIENT_ID and CLIENT_SECRET. When this PR lands, the CLIENT_ID env var will be lost, causing runtime failures for managed OAuth credentials.

agentcore-cli/src/cli/primitives/GatewayPrimitive.ts

Lines 427 to 431 in af1ddac

	// Write client secret to .env
	constenvVarName=computeDefaultCredentialEnvVarName(credentialName);
	awaitsetEnvVar(envVarName,jwtConfig.clientSecret!);
	}

2. Inline dynamic import in a React component violates AGENTS.md ("Never use inline imports. Imports must always go at the top of the file."). Should be a top-level static import.

agentcore-cli/src/cli/tui/screens/policy/AddPolicyScreen.tsx

Lines 189 to 191 in af1ddac

	// policyEngineId is needed; get it from deployed state
	const{ policyEnginePrimitive }=awaitimport('../../../primitives/registry');
	constpolicyEngineId=awaitpolicyEnginePrimitive.getDeployedEngineId(wizard.config.engine);

[tejaskash]

Review comments addressed: CLIENT_ID env var restored, inline import moved to top-level.

The base branch was changed.

[aidandaly24]

Description

Adds custom JWT claims validation and a full TUI wizard flow for configuring Custom JWT gateway authorization.

Stacked PR: This PR includes changes from #598 (inbound auth hardening). Merge #598 first, then rebase this onto main — the diff will shrink to only the custom claims feature.

TUI Wizard Screenshots

1. Authorizer Type Selection

2. JWT Constraint Picker

3. Constraints Selected (Allowed Clients + Custom Claims)

4. Custom Claims Form

Custom Claims Schema

• ClaimMatchOperatorSchema — operators: Equals, StartsWith, Contains, NotEquals
• ClaimMatchValueSchema — string value with 1-256 char limit
• InboundTokenClaimValueTypeSchema — String, Number, Boolean, Array
• CustomClaimValidationSchema — strict object with claimName, operator, matchValue, valueType
• Wired into CustomJwtAuthorizerConfigSchema as optional customClaims array
• Added to deployed-state.ts for deployment state tracking

CLI Support

• Added --custom-claims flag accepting JSON array (e.g., --custom-claims '[{"claimName":"dept","operator":"Equals","matchValue":"engineering","valueType":"String"}]')
• Validation: JSON parse, array check, per-claim field validation
• GatewayPrimitive passes custom claims through to authorizer configuration

TUI Wizard

• Expanded JWT config flow with custom claims manager:
  • Add claim sub-flow: claim name → operator → match value → value type
  • Edit/delete existing claims
  • Done to proceed
• Client credentials made optional (skip with empty Enter)
• Human-readable claim summary in confirm review screen
• Step counter updated dynamically

Testing (comprehensive)

• AddGatewayJwtConfig.test.tsx — TUI component tests covering the full JWT wizard flow
• finishJwtConfig.test.ts — unit tests for config assembly helper
• useAddGatewayWizard.test.tsx — extended with JWT + custom claims wizard flows
• GatewayPrimitive.test.ts — custom claims round-trip through primitive
• validate.test.ts — custom claims CLI validation cases
• mcp.test.ts — schema-level custom claims tests
• add-gateway-jwt.test.ts — TUI integration test via harness

Related Issue

Extracted from #596 (replaces it together with #597 and #598)

Documentation PR

N/A

Type of Change

• Bug fix
• New feature
• Breaking change
• Documentation update
• Other (please describe):

Testing

How have you tested the change?

• I ran npm run test:unit and npm run test:integ
• I ran npm run typecheck
• I ran npm run lint
• If I modified src/assets/, I ran npm run test:update-snapshots and committed the updated snapshots

Checklist

• I have read the CONTRIBUTING document
• I have added any necessary tests that prove my fix is effective or my feature works
• I have updated the documentation accordingly
• I have added an appropriate example to the documentation to outline the feature, or no new docs are needed
• My changes generate no new warnings
• Any dependent changes have been merged and published

---

By submitting this pull request, I confirm that you can use, modify, copy, and redistribute this contribution, under the
terms of your choice.

[tejaskash]

Code review

Found 2 issues:

1. createManagedOAuthCredential only writes CLIENT_SECRET to .env, but the current main branch (from PR feat: add policy engine and policy support #579) writes both CLIENT_ID and CLIENT_SECRET. When this PR lands, the CLIENT_ID env var will be lost, causing runtime failures for managed OAuth credentials.

agentcore-cli/src/cli/primitives/GatewayPrimitive.ts

Lines 427 to 431 in af1ddac

	// Write client secret to .env
	constenvVarName=computeDefaultCredentialEnvVarName(credentialName);
	awaitsetEnvVar(envVarName,jwtConfig.clientSecret!);
	}

2. Inline dynamic import in a React component violates AGENTS.md ("Never use inline imports. Imports must always go at the top of the file."). Should be a top-level static import.

agentcore-cli/src/cli/tui/screens/policy/AddPolicyScreen.tsx

Lines 189 to 191 in af1ddac

	// policyEngineId is needed; get it from deployed state
	const{ policyEnginePrimitive }=awaitimport('../../../primitives/registry');
	constpolicyEngineId=awaitpolicyEnginePrimitive.getDeployedEngineId(wizard.config.engine);

[tejaskash]

Review comments addressed: CLIENT_ID env var restored, inline import moved to top-level.

The base branch was changed.

[aidandaly24]

Description

Adds custom JWT claims validation and a full TUI wizard flow for configuring Custom JWT gateway authorization.

Stacked PR: This PR includes changes from #598 (inbound auth hardening). Merge #598 first, then rebase this onto main — the diff will shrink to only the custom claims feature.

TUI Wizard Screenshots

1. Authorizer Type Selection

2. JWT Constraint Picker

3. Constraints Selected (Allowed Clients + Custom Claims)

4. Custom Claims Form

Custom Claims Schema

• ClaimMatchOperatorSchema — operators: Equals, StartsWith, Contains, NotEquals
• ClaimMatchValueSchema — string value with 1-256 char limit
• InboundTokenClaimValueTypeSchema — String, Number, Boolean, Array
• CustomClaimValidationSchema — strict object with claimName, operator, matchValue, valueType
• Wired into CustomJwtAuthorizerConfigSchema as optional customClaims array
• Added to deployed-state.ts for deployment state tracking

CLI Support

• Added --custom-claims flag accepting JSON array (e.g., --custom-claims '[{"claimName":"dept","operator":"Equals","matchValue":"engineering","valueType":"String"}]')
• Validation: JSON parse, array check, per-claim field validation
• GatewayPrimitive passes custom claims through to authorizer configuration

TUI Wizard

• Expanded JWT config flow with custom claims manager:
  • Add claim sub-flow: claim name → operator → match value → value type
  • Edit/delete existing claims
  • Done to proceed
• Client credentials made optional (skip with empty Enter)
• Human-readable claim summary in confirm review screen
• Step counter updated dynamically

Testing (comprehensive)

• AddGatewayJwtConfig.test.tsx — TUI component tests covering the full JWT wizard flow
• finishJwtConfig.test.ts — unit tests for config assembly helper
• useAddGatewayWizard.test.tsx — extended with JWT + custom claims wizard flows
• GatewayPrimitive.test.ts — custom claims round-trip through primitive
• validate.test.ts — custom claims CLI validation cases
• mcp.test.ts — schema-level custom claims tests
• add-gateway-jwt.test.ts — TUI integration test via harness

Related Issue

Extracted from #596 (replaces it together with #597 and #598)

Documentation PR

N/A

Type of Change

• Bug fix
• New feature
• Breaking change
• Documentation update
• Other (please describe):

Testing

How have you tested the change?

• I ran npm run test:unit and npm run test:integ
• I ran npm run typecheck
• I ran npm run lint
• If I modified src/assets/, I ran npm run test:update-snapshots and committed the updated snapshots

Checklist

• I have read the CONTRIBUTING document
• I have added any necessary tests that prove my fix is effective or my feature works
• I have updated the documentation accordingly
• I have added an appropriate example to the documentation to outline the feature, or no new docs are needed
• My changes generate no new warnings
• Any dependent changes have been merged and published

---

By submitting this pull request, I confirm that you can use, modify, copy, and redistribute this contribution, under the
terms of your choice.

[tejaskash]

Code review

Found 2 issues:

1. createManagedOAuthCredential only writes CLIENT_SECRET to .env, but the current main branch (from PR feat: add policy engine and policy support #579) writes both CLIENT_ID and CLIENT_SECRET. When this PR lands, the CLIENT_ID env var will be lost, causing runtime failures for managed OAuth credentials.

agentcore-cli/src/cli/primitives/GatewayPrimitive.ts

Lines 427 to 431 in af1ddac

	// Write client secret to .env
	constenvVarName=computeDefaultCredentialEnvVarName(credentialName);
	awaitsetEnvVar(envVarName,jwtConfig.clientSecret!);
	}

2. Inline dynamic import in a React component violates AGENTS.md ("Never use inline imports. Imports must always go at the top of the file."). Should be a top-level static import.

agentcore-cli/src/cli/tui/screens/policy/AddPolicyScreen.tsx

Lines 189 to 191 in af1ddac

	// policyEngineId is needed; get it from deployed state
	const{ policyEnginePrimitive }=awaitimport('../../../primitives/registry');
	constpolicyEngineId=awaitpolicyEnginePrimitive.getDeployedEngineId(wizard.config.engine);

[tejaskash]

Review comments addressed: CLIENT_ID env var restored, inline import moved to top-level.

The base branch was changed.

[aidandaly24]

Description

Adds custom JWT claims validation and a full TUI wizard flow for configuring Custom JWT gateway authorization.

Stacked PR: This PR includes changes from #598 (inbound auth hardening). Merge #598 first, then rebase this onto main — the diff will shrink to only the custom claims feature.

TUI Wizard Screenshots

1. Authorizer Type Selection

2. JWT Constraint Picker

3. Constraints Selected (Allowed Clients + Custom Claims)

4. Custom Claims Form

Custom Claims Schema

• ClaimMatchOperatorSchema — operators: Equals, StartsWith, Contains, NotEquals
• ClaimMatchValueSchema — string value with 1-256 char limit
• InboundTokenClaimValueTypeSchema — String, Number, Boolean, Array
• CustomClaimValidationSchema — strict object with claimName, operator, matchValue, valueType
• Wired into CustomJwtAuthorizerConfigSchema as optional customClaims array
• Added to deployed-state.ts for deployment state tracking

CLI Support

• Added --custom-claims flag accepting JSON array (e.g., --custom-claims '[{"claimName":"dept","operator":"Equals","matchValue":"engineering","valueType":"String"}]')
• Validation: JSON parse, array check, per-claim field validation
• GatewayPrimitive passes custom claims through to authorizer configuration

TUI Wizard

• Expanded JWT config flow with custom claims manager:
  • Add claim sub-flow: claim name → operator → match value → value type
  • Edit/delete existing claims
  • Done to proceed
• Client credentials made optional (skip with empty Enter)
• Human-readable claim summary in confirm review screen
• Step counter updated dynamically

Testing (comprehensive)

• AddGatewayJwtConfig.test.tsx — TUI component tests covering the full JWT wizard flow
• finishJwtConfig.test.ts — unit tests for config assembly helper
• useAddGatewayWizard.test.tsx — extended with JWT + custom claims wizard flows
• GatewayPrimitive.test.ts — custom claims round-trip through primitive
• validate.test.ts — custom claims CLI validation cases
• mcp.test.ts — schema-level custom claims tests
• add-gateway-jwt.test.ts — TUI integration test via harness

Related Issue

Extracted from #596 (replaces it together with #597 and #598)

Documentation PR

N/A

Type of Change

• Bug fix
• New feature
• Breaking change
• Documentation update
• Other (please describe):

Testing

How have you tested the change?

• I ran npm run test:unit and npm run test:integ
• I ran npm run typecheck
• I ran npm run lint
• If I modified src/assets/, I ran npm run test:update-snapshots and committed the updated snapshots

Checklist

• I have read the CONTRIBUTING document
• I have added any necessary tests that prove my fix is effective or my feature works
• I have updated the documentation accordingly
• I have added an appropriate example to the documentation to outline the feature, or no new docs are needed
• My changes generate no new warnings
• Any dependent changes have been merged and published

---

By submitting this pull request, I confirm that you can use, modify, copy, and redistribute this contribution, under the
terms of your choice.

[tejaskash]

Code review

Found 2 issues:

1. createManagedOAuthCredential only writes CLIENT_SECRET to .env, but the current main branch (from PR feat: add policy engine and policy support #579) writes both CLIENT_ID and CLIENT_SECRET. When this PR lands, the CLIENT_ID env var will be lost, causing runtime failures for managed OAuth credentials.

agentcore-cli/src/cli/primitives/GatewayPrimitive.ts

Lines 427 to 431 in af1ddac

	// Write client secret to .env
	constenvVarName=computeDefaultCredentialEnvVarName(credentialName);
	awaitsetEnvVar(envVarName,jwtConfig.clientSecret!);
	}

2. Inline dynamic import in a React component violates AGENTS.md ("Never use inline imports. Imports must always go at the top of the file."). Should be a top-level static import.

agentcore-cli/src/cli/tui/screens/policy/AddPolicyScreen.tsx

Lines 189 to 191 in af1ddac

	// policyEngineId is needed; get it from deployed state
	const{ policyEnginePrimitive }=awaitimport('../../../primitives/registry');
	constpolicyEngineId=awaitpolicyEnginePrimitive.getDeployedEngineId(wizard.config.engine);

[tejaskash]

Review comments addressed: CLIENT_ID env var restored, inline import moved to top-level.

The base branch was changed.