agentcore-cli 0.31.1__py3-none-any.whl

agentcore/primitives/credential.py

@@ -0,0 +1,387 @@
+"""Credential add/remove (port of src/cli/primitives/CredentialPrimitive.tsx)."""
+
+from dataclasses import dataclass
+from typing import Any
+
+import typer
+
+from agentcore.cli import interactive
+from agentcore.cli.commands.add._common import first_issue, js_url_ok
+from agentcore.cli.commands.add.validate import validate_add_credential_options
+from agentcore.cli.errors import get_error_message
+from agentcore.cli.naming import generate_unique_name
+from agentcore.cli.run_command import run_cli_command
+from agentcore.lib import (
+    ConflictError,
+    ResourceNotFoundError,
+    ValidationError,
+    find_config_root,
+    get_env_var,
+    serialize_result,
+    set_env_var,
+)
+from agentcore.lib.errors.types import to_error
+from agentcore.lib.result import Err, Ok
+from agentcore.lib.schemas.io.config_io import to_jsonable
+from agentcore.lib.secrets import validate_credential_name_encryptable
+from agentcore.primitives.base import BasePrimitive, RemovableResource, RemovalPreview, SchemaChange, emit_json
+from agentcore.primitives.credential_utils import compute_default_credential_env_var_name
+from agentcore.primitives.secret_flag_warning import warn_on_literal_secret_flag
+from agentcore.schema import CredentialName
+
+
+@dataclass
+class AddApiKeyCredentialOptions:
+    name: str
+    api_key: str
+    authorizer_type: str = "ApiKeyCredentialProvider"
+
+
+@dataclass
+class AddOAuthCredentialOptions:
+    name: str
+    discovery_url: str
+    client_id: str
+    client_secret: str
+    scopes: list[str] | None = None
+    authorizer_type: str = "OAuthCredentialProvider"
+
+
+AddCredentialOptions = AddApiKeyCredentialOptions | AddOAuthCredentialOptions
+
+
+@dataclass
+class CredentialStrategy:
+    """Whether an agent reuses an existing model-provider credential or creates a new one."""
+
+    reuse: bool
+    credential_name: str
+    env_var_name: str
+    is_agent_scoped: bool
+
+
+def _config_root(config_io: Any) -> str | None:
+    try:
+        return config_io.get_config_root()
+    except Exception:  # noqa: BLE001
+        return None
+
+
+class CredentialPrimitive(BasePrimitive):
+    kind = "credential"
+    label = "Credential"
+    article = "a"
+
+    compute_default_credential_env_var_name = staticmethod(compute_default_credential_env_var_name)
+
+    def _project(self) -> dict[str, Any]:
+        return to_jsonable(self.read_project_spec())
+
+    # --- add ----------------------------------------------------------------------------
+
+    def add(self, options: AddCredentialOptions) -> Ok[dict[str, Any]] | Err[Exception]:
+        try:
+            # An API-key secret lives in the bare AGENTCORE_CREDENTIAL_<NAME> var; refuse names that
+            # would normalize to a reserved suffix and leave it unencrypted.
+            if options.authorizer_type == "ApiKeyCredentialProvider":
+                check = validate_credential_name_encryptable(options.name)
+                if check is not True:
+                    return Err(ValidationError(check))
+            credential = self._create_credential(options)
+            return Ok({"credentialName": credential["name"]})
+        except Exception as exc:  # noqa: BLE001
+            return Err(to_error(exc))
+
+    def _create_credential(self, config: AddCredentialOptions) -> dict[str, Any]:
+        project = self._project()
+        existing = next((c for c in project["credentials"] if c["name"] == config.name), None)
+        if existing is not None:
+            credential = existing
+        elif isinstance(config, AddOAuthCredentialOptions):
+            credential = {
+                "authorizerType": "OAuthCredentialProvider",
+                "name": config.name,
+                "discoveryUrl": config.discovery_url,
+                "vendor": "CustomOauth2",
+            }
+            if config.scopes is not None:
+                credential["scopes"] = config.scopes
+            project["credentials"].append(credential)
+            self.write_project_spec(project)
+        else:
+            credential = {"authorizerType": "ApiKeyCredentialProvider", "name": config.name}
+            project["credentials"].append(credential)
+            self.write_project_spec(project)
+
+        root = _config_root(self.config_io)
+        prefix = compute_default_credential_env_var_name(config.name)
+        if isinstance(config, AddOAuthCredentialOptions):
+            set_env_var(f"{prefix}_CLIENT_ID", config.client_id, root)
+            set_env_var(f"{prefix}_CLIENT_SECRET", config.client_secret, root)
+        else:
+            set_env_var(prefix, config.api_key, root)
+        return credential
+
+    # --- remove -------------------------------------------------------------------------
+
+    def remove(self, name: str, force: bool = False) -> Ok[None] | Err[Exception]:
+        try:
+            project = self._project()
+            index = next((i for i, c in enumerate(project["credentials"]) if c["name"] == name), -1)
+            if index == -1:
+                return Err(ResourceNotFoundError(f'Credential "{name}" not found.'))
+            credential = project["credentials"][index]
+            if credential.get("managed") and not force:
+                return Err(
+                    ConflictError(
+                        f'Credential "{name}" is managed by the CLI and cannot be removed. Use force to override.'
+                    )
+                )
+            targets = self._find_referencing_gateway_targets(name, project)
+            if targets and not force:
+                target_list = ", ".join(t["name"] for t in targets)
+                return Err(
+                    ConflictError(
+                        f'Credential "{name}" is referenced by gateway target(s): {target_list}. Use force to override.'
+                    )
+                )
+            project["credentials"].pop(index)
+            self.write_project_spec(project)
+            return Ok(None)
+        except Exception as exc:  # noqa: BLE001
+            return Err(to_error(exc))
+
+    def preview_remove(self, name: str) -> RemovalPreview:
+        project = self._project()
+        credential = next((c for c in project["credentials"] if c["name"] == name), None)
+        if credential is None:
+            raise Exception(f'Credential "{name}" not found.')
+        summary = [
+            f"Removing credential: {name}",
+            f"Type: {credential['authorizerType']}",
+            "Note: .env file will not be modified",
+        ]
+        if credential.get("managed"):
+            summary.append(
+                "Warning: This credential is managed by the CLI. Removing it may break gateway authentication."
+            )
+        targets = self._find_referencing_gateway_targets(name, project)
+        if targets:
+            summary.append(f"Warning: Referenced by gateway target(s): {', '.join(t['name'] for t in targets)}")
+        after = {**project, "credentials": [c for c in project["credentials"] if c["name"] != name]}
+        return RemovalPreview(summary, [], [SchemaChange("agentcore/agentcore.json", project, after)])
+
+    def get_removable(self) -> list[RemovableResource]:
+        try:
+            return [
+                RemovableResource(c["name"], {"authorizerType": c["authorizerType"]})
+                for c in self._project()["credentials"]
+            ]
+        except Exception:  # noqa: BLE001
+            return []
+
+    def get_all_credentials(self) -> list[dict[str, Any]]:
+        try:
+            return self._project()["credentials"]
+        except Exception:  # noqa: BLE001
+            return []
+
+    def get_all_names(self) -> list[str]:
+        return [c["name"] for c in self.get_all_credentials()]
+
+    @staticmethod
+    def _find_referencing_gateway_targets(name: str, project: dict[str, Any]) -> list[dict[str, Any]]:
+        return [
+            {"name": target["name"]}
+            for gateway in project.get("agentCoreGateways", [])
+            for target in gateway.get("targets", [])
+            if (target.get("outboundAuth") or {}).get("credentialName") == name
+        ]
+
+    # --- credential strategy for agents ----------------------------------------------------
+
+    def resolve_credential_strategy(
+        self,
+        project_name: str,
+        agent_name: str,
+        model_provider: str,
+        new_api_key: str | None,
+        config_base_dir: str,
+        existing_credentials: list[Any],
+    ) -> CredentialStrategy:
+        """Reuse a credential holding the same key, else create project- or agent-scoped."""
+        if model_provider == "Bedrock" or not new_api_key:
+            return CredentialStrategy(True, "", "", False)
+
+        for cred in existing_credentials:
+            cred_name = cred["name"] if isinstance(cred, dict) else cred.name
+            env_var_name = compute_default_credential_env_var_name(cred_name)
+            if get_env_var(env_var_name, config_base_dir) == new_api_key:
+                return CredentialStrategy(True, cred_name, env_var_name, cred_name != f"{project_name}{model_provider}")
+
+        project_scoped = f"{project_name}{model_provider}"
+        names = [c["name"] if isinstance(c, dict) else c.name for c in existing_credentials]
+        if project_scoped not in names:
+            return CredentialStrategy(
+                False, project_scoped, compute_default_credential_env_var_name(project_scoped), False
+            )
+
+        agent_scoped = f"{project_name}{agent_name}{model_provider}"
+        return CredentialStrategy(False, agent_scoped, compute_default_credential_env_var_name(agent_scoped), True)
+
+    # --- CLI ----------------------------------------------------------------------------
+
+    def register_commands(self, add_app: typer.Typer, remove_app: typer.Typer) -> None:
+        @add_app.command("credential", help="Add a credential to the project")
+        def add_credential(
+            name: str | None = typer.Option(None, "--name", help="Credential name [non-interactive]"),
+            api_key: str | None = typer.Option(None, "--api-key", help="The API key value [non-interactive]"),
+            as_json: bool = typer.Option(False, "--json", help="Output as JSON [non-interactive]"),
+            cred_type: str | None = typer.Option(
+                None, "--type", help="Credential type: api-key (default) or oauth [non-interactive]"
+            ),
+            discovery_url: str | None = typer.Option(
+                None, "--discovery-url", help="OAuth discovery URL [non-interactive]"
+            ),
+            client_id: str | None = typer.Option(None, "--client-id", help="OAuth client ID [non-interactive]"),
+            client_secret: str | None = typer.Option(
+                None, "--client-secret", help="OAuth client secret [non-interactive]"
+            ),
+            scopes: str | None = typer.Option(None, "--scopes", help="OAuth scopes, comma-separated [non-interactive]"),
+        ) -> None:
+            if not find_config_root():
+                typer.echo("No agentcore project found. Run `agentcore create` first.", err=True)
+                raise typer.Exit(1)
+
+            if not (name or api_key or as_json or cred_type or discovery_url or client_id or client_secret or scopes):
+                try:
+                    interactive.require_tty()
+                    self.add_interactive()
+                except typer.Exit:
+                    raise
+                except Exception as exc:  # noqa: BLE001
+                    typer.echo(get_error_message(exc), err=True)
+                    raise typer.Exit(1) from None
+                raise typer.Exit(0)
+
+            def run() -> None:
+                warn_on_literal_secret_flag([api_key, client_secret], as_json, "add credential")
+                validation = validate_add_credential_options(
+                    {
+                        "name": name,
+                        "type": cred_type,
+                        "apiKey": api_key,
+                        "discoveryUrl": discovery_url,
+                        "clientId": client_id,
+                        "clientSecret": client_secret,
+                        "scopes": scopes,
+                    }
+                )
+                if not validation.valid:
+                    raise ValidationError(validation.error or "")
+                options: AddCredentialOptions
+                if cred_type == "oauth":
+                    options = AddOAuthCredentialOptions(
+                        name=name or "",
+                        discovery_url=discovery_url or "",
+                        client_id=client_id or "",
+                        client_secret=client_secret or "",
+                        scopes=[s.strip() for s in scopes.split(",") if s.strip()] if scopes is not None else None,
+                    )
+                else:
+                    options = AddApiKeyCredentialOptions(name=name or "", api_key=api_key or "")
+                result = self.add(options)
+                if not result.success:
+                    raise result.error
+                if as_json:
+                    emit_json(serialize_result(result))
+                else:
+                    typer.echo(f"Added credential '{result.value['credentialName']}'")
+
+            run_cli_command(as_json, run)
+
+        self.register_remove_subcommand(remove_app)
+
+    def add_interactive(self, identity_type: str | None = None) -> str | None:
+        """Prompt flow mirroring tui/screens/identity/AddIdentityScreen (type, name, secrets, confirm).
+
+        ``identity_type`` skips the type question (inline creation from other wizards, upstream
+        useCreateIdentity). Returns the new credential's name, or None if cancelled.
+        """
+        existing = self.get_all_names()
+        identity_type = identity_type or interactive.select(
+            "Select credential type",
+            [
+                interactive.Choice("API Key", "ApiKeyCredentialProvider", "Store and manage API key credentials"),
+                interactive.Choice("OAuth", "OAuthCredentialProvider", "OAuth 2.0 client credentials"),
+            ],
+        )
+        is_oauth = identity_type == "OAuthCredentialProvider"
+
+        def validate_name(value: str) -> str | None:
+            issue = first_issue(CredentialName, value)
+            if issue:
+                return issue
+            if value in existing:
+                return "Credential name already exists"
+            if not is_oauth:
+                check = validate_credential_name_encryptable(value)
+                if check is not True:
+                    return check
+            return None
+
+        name = interactive.text(
+            "Credential name",
+            default=generate_unique_name("MyOAuth" if is_oauth else "MyApiKey", existing),
+            validate=validate_name,
+        )
+        options: AddCredentialOptions
+        if is_oauth:
+
+            def validate_url(value: str) -> str | None:
+                if not js_url_ok(value):
+                    return "Must be a valid URL"
+                if not value.endswith("/.well-known/openid-configuration"):
+                    return "URL must end with '/.well-known/openid-configuration'"
+                return None
+
+            discovery_url = interactive.text("Discovery URL (OIDC well-known endpoint)", validate=validate_url)
+            client_id = interactive.text(
+                "Client ID", secret=True, validate=lambda v: None if v.strip() else "Client ID is required"
+            )
+            client_secret = interactive.text(
+                "Client Secret", secret=True, validate=lambda v: None if v.strip() else "Client secret is required"
+            )
+            scopes = interactive.text("Scopes (comma-separated, optional)", default="")
+            summary = [("Type", "OAuth"), ("Name", name), ("Discovery URL", discovery_url)]
+            if scopes:
+                summary.append(("Scopes", scopes))
+            options = AddOAuthCredentialOptions(
+                name=name,
+                discovery_url=discovery_url,
+                client_id=client_id,
+                client_secret=client_secret,
+                scopes=[s.strip() for s in scopes.split(",") if s.strip()] if scopes else None,
+            )
+        else:
+            api_key = interactive.text(
+                "API Key", secret=True, validate=lambda v: None if v.strip() else "API key is required"
+            )
+            summary = [("Type", "API Key"), ("Name", name), ("API Key", "*" * min(len(api_key), 20))]
+            options = AddApiKeyCredentialOptions(name=name, api_key=api_key)
+
+        for label, value in summary:
+            typer.echo(f"  {label}: {value}")
+        if not interactive.confirm("Add this credential?", default=True):
+            typer.echo("Cancelled.")
+            return None
+        result = self.add(options)
+        if not result.success:
+            typer.echo("Failed to add credential", err=True)
+            typer.echo(get_error_message(result.error), err=True)
+            raise typer.Exit(1)
+        typer.echo(f"Added credential: {result.value['credentialName']}")
+        return result.value["credentialName"]
+
+
+PRIMITIVE = CredentialPrimitive()

agentcore/primitives/credential_utils.py

@@ -0,0 +1,45 @@
+"""Credential env-var naming (port of src/cli/primitives/credential-utils.ts)."""
+
+from dataclasses import dataclass
+
+
+def _prefix(credential_name: str) -> str:
+    return f"AGENTCORE_CREDENTIAL_{credential_name.replace('-', '_').upper()}"
+
+
+def compute_default_credential_env_var_name(credential_name: str) -> str:
+    return _prefix(credential_name)
+
+
+def compute_managed_oauth_credential_name(gateway_name: str) -> str:
+    return f"{gateway_name}-oauth"
+
+
+@dataclass(frozen=True)
+class PaymentCredentialEnvVarNames:
+    api_key_id: str
+    api_key_secret: str
+    wallet_secret: str
+
+
+@dataclass(frozen=True)
+class StripePrivyCredentialEnvVarNames:
+    app_id: str
+    app_secret: str
+    authorization_private_key: str
+    authorization_id: str
+
+
+def compute_payment_credential_env_var_names(credential_name: str) -> PaymentCredentialEnvVarNames:
+    prefix = _prefix(credential_name)
+    return PaymentCredentialEnvVarNames(f"{prefix}_API_KEY_ID", f"{prefix}_API_KEY_SECRET", f"{prefix}_WALLET_SECRET")
+
+
+def compute_stripe_privy_credential_env_var_names(credential_name: str) -> StripePrivyCredentialEnvVarNames:
+    prefix = _prefix(credential_name)
+    return StripePrivyCredentialEnvVarNames(
+        f"{prefix}_APP_ID",
+        f"{prefix}_APP_SECRET",
+        f"{prefix}_AUTHORIZATION_PRIVATE_KEY",
+        f"{prefix}_AUTHORIZATION_ID",
+    )

agentcore/primitives/dataset.py

@@ -0,0 +1,211 @@
+"""Dataset add/remove (port of src/cli/primitives/DatasetPrimitive.ts)."""
+
+import json
+import os
+from dataclasses import dataclass
+from importlib import resources
+from typing import Any
+
+import typer
+
+from agentcore.cli import interactive
+from agentcore.cli.commands.add._common import first_issue
+from agentcore.cli.commands.add.validate import validate_add_dataset_options
+from agentcore.cli.errors import get_error_message
+from agentcore.cli.naming import generate_unique_name
+from agentcore.cli.run_command import run_cli_command
+from agentcore.lib import find_config_root
+from agentcore.lib.result import Err, Ok
+from agentcore.lib.schemas.io.config_io import to_jsonable
+from agentcore.primitives.base import BasePrimitive, RemovableResource, RemovalPreview, SchemaChange
+from agentcore.schema import DatasetName, is_valid_kms_key_arn
+
+SCHEMA_TYPE_TO_ASSET = {
+    "AGENTCORE_EVALUATION_PREDEFINED_V1": "predefined-v1.jsonl",
+    "AGENTCORE_EVALUATION_SIMULATED_V1": "simulated-v1.jsonl",
+}
+SCHEMA_TYPE_OPTIONS = (
+    ("AGENTCORE_EVALUATION_PREDEFINED_V1", "Predefined Turns", "Explicit inputs with expected responses"),
+    ("AGENTCORE_EVALUATION_SIMULATED_V1", "Actor Simulator", "Actor profiles for synthetic conversations"),
+)
+
+
+@dataclass
+class AddDatasetOptions:
+    name: str
+    schema_type: str
+    description: str | None = None
+    kms_key_arn: str | None = None
+
+
+def read_dataset_asset(asset_file: str) -> bytes:
+    """Bundled starter dataset (``agentcore/assets/datasets/*.jsonl``)."""
+    return resources.files("agentcore.assets").joinpath("datasets", asset_file).read_bytes()
+
+
+class DatasetPrimitive(BasePrimitive):
+    kind = "dataset"
+    label = "Dataset"
+    article = "a"
+
+    def _project(self) -> dict[str, Any]:
+        return to_jsonable(self.read_project_spec())
+
+    def add(self, options: AddDatasetOptions) -> Ok | Err:
+        try:
+            project = self._project()
+            datasets = project.get("datasets") or []
+            self.check_duplicate([RemovableResource(d["name"]) for d in datasets], options.name)
+            location = f"datasets/{options.name}.jsonl"
+            dataset: dict[str, Any] = {"name": options.name, "schemaType": options.schema_type}
+            if options.description:
+                dataset["description"] = options.description
+            if options.kms_key_arn:
+                dataset["kmsKeyArn"] = options.kms_key_arn
+            dataset["config"] = {"managed": {"location": location}}
+            datasets.append(dataset)
+            project["datasets"] = datasets
+            self.write_project_spec(project)
+            self._scaffold_dataset_file(options.schema_type, location)
+            return Ok({"datasetName": options.name, "location": f"agentcore/{location}"})
+        except Exception as exc:  # noqa: BLE001
+            return Err(exc if isinstance(exc, Exception) else Exception(get_error_message(exc)))
+
+    def _scaffold_dataset_file(self, schema_type: str, location: str) -> None:
+        config_root = find_config_root()
+        if not config_root:
+            return
+        os.makedirs(os.path.join(config_root, "datasets"), exist_ok=True)
+        asset = SCHEMA_TYPE_TO_ASSET.get(schema_type)
+        if not asset:
+            return
+        with open(os.path.join(config_root, location), "wb") as fh:
+            fh.write(read_dataset_asset(asset))
+
+    def remove(self, name: str) -> Ok | Err:
+        try:
+            project = self._project()
+            datasets = project.get("datasets") or []
+            index = next((i for i, d in enumerate(datasets) if d["name"] == name), -1)
+            if index == -1:
+                return Err(Exception(f'Dataset "{name}" not found.'))
+            datasets.pop(index)
+            project["datasets"] = datasets
+            self.write_project_spec(project)
+            return Ok(None)
+        except Exception as exc:  # noqa: BLE001
+            return Err(exc)
+
+    def preview_remove(self, name: str) -> RemovalPreview:
+        project = self._project()
+        datasets = project.get("datasets") or []
+        if not any(d["name"] == name for d in datasets):
+            raise Exception(f'Dataset "{name}" not found.')
+        after = {**project, "datasets": [d for d in datasets if d["name"] != name]}
+        return RemovalPreview(
+            [f"Removing dataset: {name}"], [], [SchemaChange("agentcore/agentcore.json", project, after)]
+        )
+
+    def get_removable(self) -> list[RemovableResource]:
+        try:
+            return [RemovableResource(d["name"]) for d in self._project().get("datasets") or []]
+        except Exception:  # noqa: BLE001
+            return []
+
+    def get_all_names(self) -> list[str]:
+        return [r.name for r in self.get_removable()]
+
+    def register_commands(self, add_app: typer.Typer, remove_app: typer.Typer) -> None:
+        @add_app.command("dataset", help="Add a dataset to the project")
+        def add_dataset(
+            name: str | None = typer.Option(None, "--name", help="Dataset name [non-interactive]"),
+            schema_type: str | None = typer.Option(
+                None,
+                "--schema-type",
+                help="Dataset schema type: AGENTCORE_EVALUATION_PREDEFINED_V1 | AGENTCORE_EVALUATION_SIMULATED_V1 "
+                "[non-interactive]",
+            ),
+            description: str | None = typer.Option(None, "--description", help="Dataset description [non-interactive]"),
+            kms_key_arn: str | None = typer.Option(
+                None, "--kms-key-arn", help="KMS key ARN for dataset encryption (optional) [non-interactive]"
+            ),
+            as_json: bool = typer.Option(False, "--json", help="Output as JSON [non-interactive]"),
+        ) -> None:
+            if not find_config_root():
+                typer.echo("No agentcore project found. Run `agentcore create` first.", err=True)
+                raise typer.Exit(1)
+            if not (name or as_json):
+                try:
+                    interactive.require_tty()
+                    self.add_interactive()
+                except typer.Exit:
+                    raise
+                except Exception as exc:  # noqa: BLE001
+                    typer.echo(get_error_message(exc), err=True)
+                    raise typer.Exit(1) from None
+                raise typer.Exit(0)
+
+            def run() -> None:
+                validation = validate_add_dataset_options(
+                    {
+                        "name": name or "",
+                        "schemaType": schema_type or "",
+                        "description": description,
+                        "kmsKeyArn": kms_key_arn,
+                    }
+                )
+                if not validation.valid:
+                    raise Exception(validation.error)
+                result = self.add(AddDatasetOptions(name or "", schema_type or "", description, kms_key_arn))
+                if not result.success:
+                    raise result.error
+                if as_json:
+                    # Upstream prints the raw AddResult (`JSON.stringify(result)`).
+                    typer.echo(json.dumps({"success": True, **result.value}, separators=(",", ":")))
+                else:
+                    typer.echo(f"Added dataset '{result.value['datasetName']}'")
+                    typer.echo(f"  File: {result.value['location']}")
+
+            run_cli_command(as_json, run)
+
+        self.register_remove_subcommand(remove_app)
+
+    def add_interactive(self) -> None:
+        """Prompt flow mirroring tui/screens/dataset/AddDatasetScreen."""
+        existing = self.get_all_names()
+
+        def validate_name(value: str) -> str | None:
+            issue = first_issue(DatasetName, value)
+            if issue:
+                return issue
+            return "Dataset name already exists" if value in existing else None
+
+        name = interactive.text(
+            "Dataset name", default=generate_unique_name("MyDataset", existing), validate=validate_name
+        )
+        schema_type = interactive.select(
+            "Schema type", [interactive.Choice(t, i, d) for i, t, d in SCHEMA_TYPE_OPTIONS]
+        )
+        description = interactive.text("Description (optional, press Enter to skip)")
+        kms = interactive.text(
+            "KMS Key ARN (optional, press Enter to skip)",
+            validate=lambda v: None if v == "" or is_valid_kms_key_arn(v) else "Must be a valid KMS key ARN",
+        )
+        typer.echo(f"  Name: {name}")
+        typer.echo(f"  Schema Type: {schema_type}")
+        if description:
+            typer.echo(f"  Description: {description}")
+        if kms:
+            typer.echo(f"  KMS Key: {kms}")
+        if not interactive.confirm("Add this dataset?", default=True):
+            typer.echo("Cancelled.")
+            return
+        result = self.add(AddDatasetOptions(name, schema_type, description or None, kms or None))
+        if not result.success:
+            typer.echo("Failed to add dataset", err=True)
+            typer.echo(get_error_message(result.error), err=True)
+            raise typer.Exit(1)
+        typer.echo(f"Added dataset: {name}")
+
+
+PRIMITIVE = DatasetPrimitive()

agentcore/primitives/deployed_gateways.py

@@ -0,0 +1,34 @@
+"""Resolve deployed gateways across both storage locations (port of primitives/deployed-gateways.ts).
+
+Deployed state keeps MCP gateways under ``resources.mcp.gateways`` and HTTP gateways
+(``protocolType: "None"``) under ``resources.gateways``. A project can populate both maps, so they
+are merged rather than falling back from one to the other.
+"""
+
+from typing import Any
+
+
+def merge_deployed_gateways(target: Any) -> dict[str, Any]:
+    resources = getattr(target, "resources", None)
+    mcp = getattr(resources, "mcp", None) if resources is not None else None
+    merged: dict[str, Any] = dict((getattr(mcp, "gateways", None) or {}) if mcp is not None else {})
+    merged.update((getattr(resources, "gateways", None) or {}) if resources is not None else {})
+    return merged
+
+
+def find_deployed_gateway(state: Any, name: str) -> Any | None:
+    """Find a deployed gateway by name across all targets."""
+    for target in (state.targets or {}).values():
+        gateway = merge_deployed_gateways(target).get(name)
+        if gateway:
+            return gateway
+    return None
+
+
+def first_deployed_gateway(state: Any) -> Any | None:
+    """The first deployed gateway across all targets."""
+    for target in (state.targets or {}).values():
+        gateways = list(merge_deployed_gateways(target).values())
+        if gateways:
+            return gateways[0]
+    return None