Since value is an open string(s), lets do an initial validation to check if it is a token

done in 003c6e3

To avoid this duplication of enums, I think is ok to have a single type called CustomClaimValueType and CustomClaimOperator and reuse both on the gatways and runtime. Just dont include that shared file in the index.ts so it wont be exposed as part of the public api

That is fine for ClaimValueType, but the operator needs to be exposed since users can provide it, for instance:

agentcore.GatewayCustomClaim.withStringArrayValue('roles', ['admin'], agentcore.GatewayCustomClaimOperator.CONTAINS)

Should I re-export it from runtime and gateway ? Something like:

export { CustomClaimOperator as RuntimeCustomClaimOperator } from '../../common/types';

and under common/types:

/**
 * Custom claim match operator.
 * Shared by Runtime and Gateway custom claim implementations.
 * @internal
 */
export enum CustomClaimOperator {
  /** Equals operator - used for STRING type claims */
  EQUALS = 'EQUALS',
  /** Contains operator - used for STRING_ARRAY type claims. Checks if the claim array contains a specific string value. */
  CONTAINS = 'CONTAINS',
  /** ContainsAny operator - used for STRING_ARRAY type claims. Checks if the claim array contains any of the provided string values. */
  CONTAINS_ANY = 'CONTAINS_ANY',
}

What I dont like is the duplication part, so would it be a problem if we just keep a generic one? are we expecting them to differ at some point or do we have some knowledge at this time of some condition that justifies having an exact copy just with diff enum names?

No, we can keep a generic one ! I will just need to export it publicly. So if I export the common/types file above, does that work ?

btw, I think tthe re-export part will also be ok and will work, I just want to avoid potential JSII problems by doing that, but it seems safe, based on the initial research I did

No, we can keep a generic one ! I will just need to export it publicly. So if I export the common/types file above, does that work ?

Yep, that works

ok thanks ! I'll do the changes, that will also remove the re-export

done in 003c6e3