agentcore-cli 0.31.1__py3-none-any.whl

agentcore/primitives/payment_connector.py

@@ -0,0 +1,427 @@
+"""Payment connector add/remove (port of src/cli/primitives/PaymentConnectorPrimitive.ts).
+
+Connectors are children of a payment manager; removal uses the composite key
+``managerName/connectorName`` (like policies). Manual connectors get a
+``PaymentCredentialProvider`` credential whose secrets go to ``.env.local``.
+"""
+
+from __future__ import annotations
+
+from dataclasses import dataclass
+from typing import Any
+
+import typer
+
+from agentcore.cli import interactive
+from agentcore.cli.errors import get_error_message
+from agentcore.lib import set_env_var
+from agentcore.lib.errors.types import to_error
+from agentcore.lib.result import Err, Ok
+from agentcore.lib.schemas.io.config_io import to_jsonable
+from agentcore.lib.schemas.io.path_resolver import find_config_root
+from agentcore.primitives.base import BasePrimitive, RemovableResource, RemovalPreview, SchemaChange, emit_json
+from agentcore.primitives.credential_utils import (
+    compute_payment_credential_env_var_names,
+    compute_stripe_privy_credential_env_var_names,
+)
+from agentcore.primitives.payment_manager import _cleanup_credential_env, _run_named_remove
+from agentcore.primitives.payment_validation import (
+    strip_wallet_auth_prefix,
+    validate_api_key_secret,
+    validate_authorization_private_key,
+    validate_wallet_secret,
+)
+from agentcore.primitives.secret_flag_warning import warn_on_literal_secret_flag
+
+PAYMENT_PROVIDERS = ("CoinbaseCDP", "StripePrivy")
+PAYMENT_PROVISION_MODES = ("MANUAL", "QUICK_CREATE")
+
+
+@dataclass
+class AddPaymentConnectorOptions:
+    """Union of the CoinbaseCDP / StripePrivy / QUICK_CREATE option shapes."""
+
+    manager: str
+    name: str
+    provider: str = "CoinbaseCDP"
+    provision_mode: str | None = None
+    api_key_id: str | None = None
+    api_key_secret: str | None = None
+    wallet_secret: str | None = None
+    app_id: str | None = None
+    app_secret: str | None = None
+    authorization_private_key: str | None = None
+    authorization_id: str | None = None
+
+
+def _split_key(key: str) -> tuple[str | None, str]:
+    if "/" in key:
+        i = key.index("/")
+        return key[:i], key[i + 1 :]
+    return None, key
+
+
+class PaymentConnectorPrimitive(BasePrimitive):
+    kind = "payment-connector"
+    label = "Payment Connector"
+
+    def _project(self) -> dict[str, Any]:
+        project = to_jsonable(self.read_project_spec())
+        if project.get("payments") is None:
+            project["payments"] = []
+        return project
+
+    def add(self, options: AddPaymentConnectorOptions) -> Ok[dict[str, Any]] | Err[Exception]:
+        try:
+            project = self._project()
+            manager = next((m for m in project["payments"] if m["name"] == options.manager), None)
+            if manager is None:
+                return Err(Exception(f'Payment manager "{options.manager}" not found.'))
+            connectors = manager.setdefault("connectors", [])
+            if any(c["name"] == options.name for c in connectors):
+                return Err(
+                    Exception(f'Payment connector "{options.name}" already exists in manager "{options.manager}".')
+                )
+
+            if options.provision_mode == "QUICK_CREATE":
+                connectors.append({"name": options.name, "provider": "CoinbaseCDP", "provisionMode": "QUICK_CREATE"})
+                self.write_project_spec(project)
+                return Ok({"connectorName": options.name, "managerName": options.manager})
+
+            suffix = "stripe-privy" if options.provider == "StripePrivy" else "cdp"
+            credential_name = f"{options.manager}-{options.name}-{suffix}"
+            credentials = project.setdefault("credentials", [])
+            if any(c["name"] == credential_name for c in credentials):
+                raise ValueError(f'Credential "{credential_name}" already exists.')
+            credentials.append(
+                {"authorizerType": "PaymentCredentialProvider", "name": credential_name, "provider": options.provider}
+            )
+
+            # Secrets go to .env.local BEFORE the spec (a failure leaves the spec untouched).
+            config_root = self.config_io.get_config_root()
+            if options.provider == "StripePrivy":
+                v = compute_stripe_privy_credential_env_var_names(credential_name)
+                set_env_var(v.app_id, options.app_id or "", config_root)
+                set_env_var(v.app_secret, options.app_secret or "", config_root)
+                set_env_var(v.authorization_private_key, options.authorization_private_key or "", config_root)
+                set_env_var(v.authorization_id, options.authorization_id or "", config_root)
+            else:
+                p = compute_payment_credential_env_var_names(credential_name)
+                set_env_var(p.api_key_id, options.api_key_id or "", config_root)
+                set_env_var(p.api_key_secret, options.api_key_secret or "", config_root)
+                set_env_var(p.wallet_secret, options.wallet_secret or "", config_root)
+
+            connectors.append({"name": options.name, "provider": options.provider, "credentialName": credential_name})
+            self.write_project_spec(project)
+            return Ok(
+                {"connectorName": options.name, "managerName": options.manager, "credentialName": credential_name}
+            )
+        except Exception as exc:  # noqa: BLE001
+            return Err(to_error(exc))
+
+    def _resolve_manager(self, project: dict[str, Any], connector: str, manager: str | None) -> str | None:
+        if manager:
+            return manager
+        matching = [m for m in project["payments"] if any(c["name"] == connector for c in m.get("connectors") or [])]
+        if len(matching) > 1:
+            raise _MultipleManagers(
+                f'Connector "{connector}" exists in multiple managers: {", ".join(m["name"] for m in matching)}. '
+                "Use --manager to specify which one."
+            )
+        return matching[0]["name"] if matching else None
+
+    def remove(self, name: str, manager_name: str | None = None) -> Ok[None] | Err[Exception]:
+        try:
+            project = self._project()
+            manager_key, connector_name = (manager_name, name) if manager_name else _split_key(name)
+            try:
+                resolved = self._resolve_manager(project, connector_name, manager_key)
+            except _MultipleManagers as exc:
+                return Err(Exception(str(exc)))
+
+            for manager in project["payments"]:
+                if resolved and manager["name"] != resolved:
+                    continue
+                connectors = manager.get("connectors") or []
+                index = next((i for i, c in enumerate(connectors) if c["name"] == connector_name), -1)
+                if index == -1:
+                    continue
+                connector = connectors.pop(index)
+                if connector.get("provisionMode") != "QUICK_CREATE":
+                    credential = connector.get("credentialName")
+                    still = any(
+                        c.get("provisionMode") != "QUICK_CREATE" and c.get("credentialName") == credential
+                        for m in project["payments"]
+                        for c in m.get("connectors") or []
+                    )
+                    if not still:
+                        project["credentials"] = [
+                            c for c in project.get("credentials") or [] if c["name"] != credential
+                        ]
+                    self.write_project_spec(project)
+                    if not still:
+                        _cleanup_credential_env(credential, connector.get("provider"), self.config_io.get_config_root())
+                else:
+                    self.write_project_spec(project)
+                return Ok(None)
+
+            suffix = f' in manager "{resolved}"' if resolved else ""
+            return Err(Exception(f'Payment connector "{connector_name}" not found{suffix}.'))
+        except Exception as exc:  # noqa: BLE001
+            return Err(to_error(exc))
+
+    def preview_remove(self, name: str) -> RemovalPreview:
+        project = self._project()
+        target_manager, target = _split_key(name)
+        target_manager = self._resolve_manager(project, target, target_manager)
+        for manager in project["payments"]:
+            if target_manager and manager["name"] != target_manager:
+                continue
+            connector = next((c for c in manager.get("connectors") or [] if c["name"] == target), None)
+            if connector is None:
+                continue
+            summary = [f"Removing payment connector: {target} (from manager {manager['name']})"]
+            if connector.get("provisionMode") != "QUICK_CREATE":
+                credential = connector.get("credentialName")
+                still = any(
+                    c.get("provisionMode") != "QUICK_CREATE" and c.get("credentialName") == credential
+                    for m in project["payments"]
+                    for c in m.get("connectors") or []
+                    if not (m["name"] == manager["name"] and c["name"] == target)
+                )
+                summary.append(
+                    f'Credential "{credential}" is shared and will be kept'
+                    if still
+                    else f'Associated credential "{credential}" will also be removed'
+                )
+            after = {
+                **project,
+                "payments": [
+                    m
+                    if m["name"] != manager["name"]
+                    else {**m, "connectors": [c for c in m.get("connectors") or [] if c["name"] != target]}
+                    for m in project["payments"]
+                ],
+            }
+            return RemovalPreview(summary, [], [SchemaChange("agentcore/agentcore.json", project, after)])
+        suffix = f' in manager "{target_manager}"' if target_manager else ""
+        raise Exception(f'Payment connector "{target}" not found{suffix}.')
+
+    def get_removable(self) -> list[RemovableResource]:
+        try:
+            return [
+                RemovableResource(f"{m['name']}/{c['name']}", {"managerName": m["name"]})
+                for m in self._project()["payments"]
+                for c in m.get("connectors") or []
+            ]
+        except Exception:  # noqa: BLE001
+            return []
+
+    # --- CLI ----------------------------------------------------------------------------
+
+    def register_commands(self, add_app: typer.Typer, remove_app: typer.Typer) -> None:
+        @add_app.command("payment-connector", help="Add a payment connector to a payment manager")
+        def add_command(
+            manager: str | None = typer.Option(None, "--manager", help="Payment manager name [non-interactive]"),
+            name: str | None = typer.Option(None, "--name", help="Payment connector name [non-interactive]"),
+            provider: str | None = typer.Option(
+                None, "--provider", help="Payment provider: CoinbaseCDP, StripePrivy [non-interactive]"
+            ),
+            provision_mode: str | None = typer.Option(
+                None, "--provision-mode", help="Provisioning mode: MANUAL, QUICK_CREATE [non-interactive]"
+            ),
+            api_key_id: str | None = typer.Option(
+                None, "--api-key-id", help="CDP API Key ID (CoinbaseCDP) [non-interactive]"
+            ),
+            api_key_secret: str | None = typer.Option(
+                None, "--api-key-secret", help="CDP API Key Secret (CoinbaseCDP) [non-interactive]"
+            ),
+            wallet_secret: str | None = typer.Option(
+                None, "--wallet-secret", help="CDP Wallet Secret (CoinbaseCDP) [non-interactive]"
+            ),
+            app_id: str | None = typer.Option(None, "--app-id", help="Privy App ID (StripePrivy) [non-interactive]"),
+            app_secret: str | None = typer.Option(
+                None, "--app-secret", help="Privy App Secret (StripePrivy) [non-interactive]"
+            ),
+            authorization_private_key: str | None = typer.Option(
+                None,
+                "--authorization-private-key",
+                help="ECDSA P-256 private key (StripePrivy) [non-interactive]",
+            ),
+            authorization_id: str | None = typer.Option(
+                None, "--authorization-id", help="Authorization key identifier (StripePrivy) [non-interactive]"
+            ),
+            as_json: bool = typer.Option(False, "--json", help="Output as JSON [non-interactive]"),
+        ) -> None:
+            cli = {
+                "manager": manager,
+                "name": name,
+                "provider": provider,
+                "provisionMode": provision_mode,
+                "apiKeyId": api_key_id,
+                "apiKeySecret": api_key_secret,
+                "walletSecret": wallet_secret,
+                "appId": app_id,
+                "appSecret": app_secret,
+                "authorizationPrivateKey": authorization_private_key,
+                "authorizationId": authorization_id,
+            }
+            try:
+                if not find_config_root():
+                    typer.echo("No agentcore project found. Run `agentcore create` first.", err=True)
+                    raise typer.Exit(1)
+                # Upstream: `a ?? b ?? ... ?? json` -> the first defined value decides (an empty string is falsy).
+                first = next((v for v in [*cli.values(), True if as_json else None] if v is not None), None)
+                if not first:
+                    interactive.require_tty()
+                    self.add_interactive()
+                    raise typer.Exit(0)
+                self._run_add_cli(cli, as_json)
+            except typer.Exit:
+                raise
+            except Exception as exc:  # noqa: BLE001
+                if as_json:
+                    emit_json({"success": False, "error": get_error_message(exc)})
+                else:
+                    typer.echo(f"Error: {get_error_message(exc)}", err=True)
+                raise typer.Exit(1) from None
+
+        @remove_app.command("payment-connector", help="Remove a payment connector from a payment manager")
+        def remove_command(
+            name: str | None = typer.Option(None, "--name", help="Name of connector to remove [non-interactive]"),
+            manager: str | None = typer.Option(None, "--manager", help="Payment manager name [non-interactive]"),
+            yes: bool = typer.Option(False, "-y", "--yes", help="Skip confirmation prompt [non-interactive]"),
+            as_json: bool = typer.Option(False, "--json", help="Output as JSON [non-interactive]"),
+        ) -> None:
+            key = f"{manager}/{name}" if manager and name else name
+            _run_named_remove(self, name, yes, as_json, key)
+
+    def _run_add_cli(self, cli: dict[str, Any], as_json: bool) -> None:
+        from agentcore.cli.commands.add._common import first_issue
+        from agentcore.schema import PaymentConnectorName
+
+        def fail(error: str) -> None:
+            if as_json:
+                emit_json({"success": False, "error": error})
+            else:
+                typer.echo(error, err=True)
+            raise typer.Exit(1)
+
+        provision_mode = cli["provisionMode"] if cli["provisionMode"] is not None else "MANUAL"
+        if provision_mode not in PAYMENT_PROVISION_MODES:
+            fail(f'Invalid provision mode "{cli["provisionMode"]}". Valid: MANUAL, QUICK_CREATE')
+
+        provider = "CoinbaseCDP"
+        if provision_mode == "QUICK_CREATE":
+            if cli["provider"] and cli["provider"] != "CoinbaseCDP":
+                fail("QUICK_CREATE only supports the CoinbaseCDP provider")
+        else:
+            if not cli["provider"]:
+                fail("--provider is required. Valid: CoinbaseCDP, StripePrivy")
+            if cli["provider"] not in PAYMENT_PROVIDERS:
+                fail(f'Invalid provider "{cli["provider"]}". Valid: CoinbaseCDP, StripePrivy')
+            provider = cli["provider"]
+
+        def blank(key: str) -> bool:
+            return not (cli[key] or "").strip()
+
+        missing = [flag for flag, key in (("--manager", "manager"), ("--name", "name")) if not cli[key]]
+        credential_flags = (
+            ("--api-key-id", "apiKeyId"),
+            ("--api-key-secret", "apiKeySecret"),
+            ("--wallet-secret", "walletSecret"),
+            ("--app-id", "appId"),
+            ("--app-secret", "appSecret"),
+            ("--authorization-private-key", "authorizationPrivateKey"),
+            ("--authorization-id", "authorizationId"),
+        )
+        if provision_mode == "QUICK_CREATE":
+            supplied = [flag for flag, key in credential_flags if cli[key] is not None]
+            if supplied:
+                fail(f"Credential options cannot be used with QUICK_CREATE: {', '.join(supplied)}")
+        elif provider == "StripePrivy":
+            missing += [flag for flag, key in credential_flags[3:] if blank(key)]
+        else:
+            missing += [flag for flag, key in credential_flags[:3] if blank(key)]
+        if missing:
+            fail(f"Missing required options for {provider}: {', '.join(missing)}")
+
+        issue = first_issue(PaymentConnectorName, cli["name"])
+        if issue:
+            fail(f"Invalid connector name: {issue}")
+
+        if provision_mode == "MANUAL":
+            warn_on_literal_secret_flag(
+                [cli["apiKeySecret"], cli["walletSecret"], cli["appSecret"], cli["authorizationPrivateKey"]],
+                as_json,
+                "add payment-connector",
+            )
+            if provider == "StripePrivy":
+                cli["authorizationPrivateKey"] = strip_wallet_auth_prefix(cli["authorizationPrivateKey"])
+                check = validate_authorization_private_key(cli["authorizationPrivateKey"])
+                if check is not True:
+                    fail(check)
+            else:
+                for validator, key in (
+                    (validate_api_key_secret, "apiKeySecret"),
+                    (validate_wallet_secret, "walletSecret"),
+                ):
+                    check = validator(cli[key])
+                    if check is not True:
+                        fail(check)
+
+        if provision_mode == "QUICK_CREATE":
+            options = AddPaymentConnectorOptions(
+                manager=cli["manager"], name=cli["name"], provider="CoinbaseCDP", provision_mode="QUICK_CREATE"
+            )
+        elif provider == "StripePrivy":
+            options = AddPaymentConnectorOptions(
+                manager=cli["manager"],
+                name=cli["name"],
+                provider=provider,
+                app_id=cli["appId"].strip(),
+                app_secret=cli["appSecret"].strip(),
+                authorization_private_key=cli["authorizationPrivateKey"].strip(),
+                authorization_id=cli["authorizationId"].strip(),
+            )
+        else:
+            options = AddPaymentConnectorOptions(
+                manager=cli["manager"],
+                name=cli["name"],
+                provider=provider,
+                api_key_id=cli["apiKeyId"].strip(),
+                api_key_secret=cli["apiKeySecret"].strip(),
+                wallet_secret=cli["walletSecret"].strip(),
+            )
+        result = self.add(options)
+        if as_json:
+            emit_json(
+                {"success": True, **result.value}
+                if result.success
+                else {"success": False, "error": get_error_message(result.error)}
+            )
+        elif result.success:
+            value = result.value
+            typer.echo(f"Added payment connector '{value['connectorName']}' to manager '{value['managerName']}'")
+            if provision_mode == "QUICK_CREATE":
+                typer.echo("Run `agentcore deploy` to create the connector and receive its authorization URL.")
+            else:
+                typer.echo(f"Credential '{value['credentialName']}' created and secrets stored in .env.local")
+                typer.echo("Run `agentcore deploy` to create payment infrastructure on AWS.")
+        else:
+            typer.echo(get_error_message(result.error), err=True)
+        raise typer.Exit(0 if result.success else 1)
+
+    def add_interactive(self) -> None:
+        from agentcore.primitives._payment_wizard import run_add_payment_connector_wizard
+
+        run_add_payment_connector_wizard(self)
+
+
+class _MultipleManagers(Exception):
+    pass
+
+
+__all__ = ["AddPaymentConnectorOptions", "PaymentConnectorPrimitive"]
+
+PRIMITIVE = PaymentConnectorPrimitive()

agentcore/primitives/payment_eligible.py

@@ -0,0 +1,20 @@
+"""Port of src/cli/primitives/payment-eligible.ts."""
+
+from __future__ import annotations
+
+from typing import Any
+
+from agentcore.lib.schemas.io.config_io import to_jsonable
+
+
+def is_payment_eligible_runtime(runtime: Any) -> bool:
+    """Payments only ship a runtime shim for Python (Strands) HTTP agents; anything else is ineligible."""
+    r = to_jsonable(runtime)
+    protocol = r.get("protocol")
+    if protocol and protocol != "HTTP":
+        return False
+    entrypoint = r.get("entrypoint") if isinstance(r.get("entrypoint"), str) else ""
+    return entrypoint.split(":")[0].endswith(".py")
+
+
+__all__ = ["is_payment_eligible_runtime"]