agentcore-cli 0.31.1__py3-none-any.whl

agentcore/operations/feedback/submit_feedback.py

@@ -0,0 +1,150 @@
+"""Validate and submit feedback (port of submit-feedback.ts)."""
+
+from __future__ import annotations
+
+import base64
+import hashlib
+import os
+from dataclasses import dataclass
+from typing import Any
+from urllib.parse import unquote, urlsplit
+
+from agentcore.lib.errors.types import ValidationError
+from agentcore.operations.feedback import aperture_client
+from agentcore.operations.feedback.build_payload import (
+    CLI_VERSION,
+    FeedbackMode,
+    build_feedback_payload,
+    build_user_agent,
+)
+from agentcore.operations.feedback.constants import (
+    ALLOWED_SCREENSHOT_EXTENSIONS,
+    APERTURE_FORM_CATEGORY,
+    APERTURE_FORM_NAME,
+    APERTURE_FORM_VERSION,
+    MAX_SCREENSHOT_BYTES,
+)
+
+FEEDBACK_MESSAGE_MAX_LENGTH = 1000
+
+
+class FeedbackValidationError(ValidationError):
+    """User input the feedback command refuses to send."""
+
+
+def validate_feedback_message(message: str) -> str | None:
+    trimmed = message.strip()
+    if not trimmed:
+        return "Feedback message cannot be empty."
+    if len(trimmed) > FEEDBACK_MESSAGE_MAX_LENGTH:
+        return f"Feedback message must be {FEEDBACK_MESSAGE_MAX_LENGTH} characters or fewer."
+    return None
+
+
+@dataclass
+class LoadedScreenshot:
+    data: bytes
+    file_name: str
+    content_type: str
+    sha256_base64: str
+    size: int
+
+
+def _expand_tilde(path: str) -> str:
+    if path == "~":
+        return os.path.expanduser("~")
+    if path.startswith("~/"):
+        return os.path.join(os.path.expanduser("~"), path[2:])
+    return path
+
+
+def _os_error_reason(exc: OSError) -> str:
+    """Node-style fs error text (``ENOENT: no such file or directory, stat '<path>'``)."""
+    import errno
+
+    code = errno.errorcode.get(exc.errno or 0, "EIO")
+    return f"{code}: {(exc.strerror or str(exc)).lower()}, stat '{exc.filename}'"
+
+
+def load_and_validate_screenshot(raw_path: str) -> LoadedScreenshot:
+    path = _expand_tilde(raw_path)
+    try:
+        st = os.stat(path)
+    except OSError as exc:
+        raise FeedbackValidationError(f"Could not read screenshot at {path}: {_os_error_reason(exc)}") from None
+    import stat as stat_mod
+
+    if stat_mod.S_ISDIR(st.st_mode):
+        raise FeedbackValidationError(f"Screenshot path is a directory, not a file: {path}")
+    if not stat_mod.S_ISREG(st.st_mode):
+        raise FeedbackValidationError(f"Screenshot path is not a regular file: {path}")
+    ext = os.path.splitext(path)[1].lower()
+    if ext not in ALLOWED_SCREENSHOT_EXTENSIONS:
+        raise FeedbackValidationError(f"Screenshot must be one of: {', '.join(ALLOWED_SCREENSHOT_EXTENSIONS)}.")
+    try:
+        with open(path, "rb") as fh:
+            data = fh.read()
+    except OSError as exc:
+        raise FeedbackValidationError(f"Could not read screenshot at {path}: {_os_error_reason(exc)}") from None
+    if len(data) > MAX_SCREENSHOT_BYTES:
+        raise FeedbackValidationError(
+            f"Screenshot is {len(data) / (1024 * 1024):.1f} MB; maximum allowed size is 100 MB."
+        )
+    return LoadedScreenshot(
+        data=data,
+        file_name=os.path.basename(path),
+        content_type="image/png" if ext == ".png" else "image/jpeg",
+        sha256_base64=base64.b64encode(hashlib.sha256(data).digest()).decode(),
+        size=len(data),
+    )
+
+
+def validate_screenshot_path(path: str) -> str | None:
+    try:
+        load_and_validate_screenshot(path)
+        return None
+    except FeedbackValidationError as exc:
+        return str(exc)
+
+
+def _object_key_from_presigned_url(url: str) -> str:
+    return unquote(urlsplit(url).path.lstrip("/"))
+
+
+def submit_feedback(message: str, screenshot: str | None = None, mode: FeedbackMode = "cli") -> dict[str, Any]:
+    """Returns ``{"id", "timestamp", "reference"}``."""
+    error = validate_feedback_message(message)
+    if error:
+        raise FeedbackValidationError(error)
+
+    user_agent = build_user_agent(CLI_VERSION)
+    reference: str | None = None
+    if screenshot:
+        file = load_and_validate_screenshot(screenshot)
+        presigned = aperture_client.fetch_presigned_url(
+            {
+                "category": APERTURE_FORM_CATEGORY,
+                "name": APERTURE_FORM_NAME,
+                "version": APERTURE_FORM_VERSION,
+                "fileName": file.file_name,
+                "fileSize": file.size,
+                "uploadFileSHA256": file.sha256_base64,
+            },
+            user_agent,
+        )
+        aperture_client.upload_file_to_s3(presigned, file.data, file.content_type, file.sha256_base64, user_agent)
+        reference = _object_key_from_presigned_url(presigned)
+
+    payload = build_feedback_payload(message.strip(), screenshot_reference=reference, mode=mode)
+    response = aperture_client.submit_form(payload, user_agent)
+    return {"id": response.get("id"), "timestamp": response.get("timestamp"), "reference": response.get("reference")}
+
+
+__all__ = [
+    "FEEDBACK_MESSAGE_MAX_LENGTH",
+    "FeedbackValidationError",
+    "load_and_validate_screenshot",
+    "submit_feedback",
+    "validate_feedback_message",
+    "validate_screenshot_path",
+]

agentcore/operations/fetch_access/__init__.py

@@ -0,0 +1,36 @@
+"""Access info / OAuth tokens for deployed resources (port of src/cli/operations/fetch-access)."""
+
+from agentcore.operations.fetch_access.fetch_gateway_token import fetch_gateway_token
+from agentcore.operations.fetch_access.fetch_harness_token import can_fetch_harness_token, fetch_harness_token
+from agentcore.operations.fetch_access.fetch_runtime_token import can_fetch_runtime_token, fetch_runtime_token
+from agentcore.operations.fetch_access.list_agents import list_agents
+from agentcore.operations.fetch_access.list_gateways import list_gateways
+from agentcore.operations.fetch_access.list_harnesses import list_harnesses
+from agentcore.operations.fetch_access.oauth_token import OAuthTokenResult, fetch_oauth_token
+from agentcore.operations.fetch_access.types import (
+    AgentInfo,
+    FetchResourceType,
+    GatewayInfo,
+    HarnessInfo,
+    ResourceInfo,
+    TokenFetchResult,
+)
+
+__all__ = [
+    "AgentInfo",
+    "FetchResourceType",
+    "GatewayInfo",
+    "HarnessInfo",
+    "OAuthTokenResult",
+    "ResourceInfo",
+    "TokenFetchResult",
+    "can_fetch_harness_token",
+    "can_fetch_runtime_token",
+    "fetch_gateway_token",
+    "fetch_harness_token",
+    "fetch_oauth_token",
+    "fetch_runtime_token",
+    "list_agents",
+    "list_gateways",
+    "list_harnesses",
+]

agentcore/operations/fetch_access/_target.py

@@ -0,0 +1,17 @@
+"""Shared deployed-target lookup for list_agents/list_gateways/list_harnesses."""
+
+from typing import Any
+
+from agentcore.lib.schemas.io.config_io import ConfigIO
+
+
+def _target_resources(config_io: ConfigIO, deploy_target: str | None) -> tuple[Any, Any] | None:
+    deployed_state = config_io.read_deployed_state()
+    project_spec = config_io.read_project_spec()
+    targets = deployed_state.targets or {}
+    if not targets:
+        return None
+    target = targets.get(deploy_target or next(iter(targets)))
+    if target is None:
+        return None
+    return project_spec, target.resources

agentcore/operations/fetch_access/fetch_gateway_token.py

@@ -0,0 +1,75 @@
+"""Port of src/cli/operations/fetch-access/fetch-gateway-token.ts."""
+
+from agentcore.lib.schemas.io.config_io import ConfigIO
+from agentcore.operations.fetch_access import oauth_token
+from agentcore.operations.fetch_access.types import TokenFetchResult
+
+
+def fetch_gateway_token(
+    gateway_name: str,
+    *,
+    config_io: ConfigIO | None = None,
+    deploy_target: str | None = None,
+    identity_name: str | None = None,
+) -> TokenFetchResult:
+    config_io = config_io or ConfigIO()
+    deployed_state = config_io.read_deployed_state()
+    project_spec = config_io.read_project_spec()
+
+    target_names = list(deployed_state.targets or {})
+    if not target_names:
+        raise RuntimeError("No deployed targets found. Run `agentcore deploy` first.")
+    target_name = deploy_target or target_names[0]
+    target = deployed_state.targets.get(target_name)
+    if target is None:
+        raise RuntimeError(f"Deployment target '{target_name}' not found. Available targets: {', '.join(target_names)}")
+
+    gateways = project_spec.agent_core_gateways or []
+    gateway_spec = next((g for g in gateways if g.name == gateway_name), None)
+    if gateway_spec is None:
+        available = ", ".join(g.name for g in gateways) or "none"
+        raise RuntimeError(f"Gateway '{gateway_name}' not found in MCP configuration. Available gateways: {available}")
+
+    resources = target.resources
+    deployed_gateway = ((resources.gateways if resources else None) or {}).get(gateway_name)
+    if deployed_gateway is None and resources and resources.mcp:
+        deployed_gateway = (resources.mcp.gateways or {}).get(gateway_name)
+    if not (deployed_gateway and deployed_gateway.gateway_url):
+        raise RuntimeError(
+            f"Gateway '{gateway_name}' does not have a deployed URL. Run `agentcore deploy` to deploy the gateway."
+        )
+
+    gateway_url = deployed_gateway.gateway_url
+    auth_type = gateway_spec.authorizer_type
+    if auth_type == "NONE":
+        return {
+            "url": gateway_url,
+            "authType": "NONE",
+            "message": "No authentication required. Send requests directly to the URL.",
+        }
+    if auth_type == "AWS_IAM":
+        return {
+            "url": gateway_url,
+            "authType": "AWS_IAM",
+            "message": "This gateway uses AWS IAM auth. Sign requests with SigV4 using your IAM credentials.",
+        }
+
+    config = gateway_spec.authorizer_configuration
+    jwt_config = config.custom_jwt_authorizer if config else None
+    if jwt_config is None:
+        raise RuntimeError(
+            f"Gateway '{gateway_name}' is configured as CUSTOM_JWT but has no customJwtAuthorizer configuration."
+        )
+
+    result = oauth_token.fetch_oauth_token(
+        resource_name=gateway_name,
+        jwt_config=jwt_config,
+        deployed_state=deployed_state,
+        target_name=target_name,
+        credentials=project_spec.credentials or [],
+        credential_name=identity_name,
+    )
+    out: TokenFetchResult = {"url": gateway_url, "authType": "CUSTOM_JWT", "token": result.token}
+    if result.expires_in is not None:
+        out["expiresIn"] = result.expires_in
+    return out

agentcore/operations/fetch_access/fetch_harness_token.py

@@ -0,0 +1,72 @@
+"""Port of src/cli/operations/fetch-access/fetch-harness-token.ts."""
+
+import os
+import sys
+
+from agentcore.lib.schemas.io.config_io import ConfigIO
+from agentcore.lib.utils.env import read_env_file
+from agentcore.operations.fetch_access import oauth_token
+from agentcore.operations.fetch_access.oauth_token import OAuthTokenResult
+from agentcore.primitives.credential_utils import (
+    compute_default_credential_env_var_name,
+    compute_managed_oauth_credential_name,
+)
+
+
+def can_fetch_harness_token(harness_name: str, *, config_io: ConfigIO | None = None) -> bool:
+    """True when a CUSTOM_JWT harness has its managed OAuth credential and client secret available."""
+    try:
+        config_io = config_io or ConfigIO()
+        spec = config_io.read_harness_spec(harness_name)
+        if spec.authorizer_type != "CUSTOM_JWT":
+            return False
+        if not (spec.authorizer_configuration and spec.authorizer_configuration.custom_jwt_authorizer):
+            return False
+        project_spec = config_io.read_project_spec()
+        cred_name = compute_managed_oauth_credential_name(harness_name)
+        if not any(
+            c.authorizer_type == "OAuthCredentialProvider" and c.name == cred_name
+            for c in project_spec.credentials or []
+        ):
+            return False
+        prefix = compute_default_credential_env_var_name(cred_name)
+        return bool(read_env_file().get(f"{prefix}_CLIENT_SECRET"))
+    except Exception as exc:  # noqa: BLE001 - "cannot fetch", as upstream
+        if os.environ.get("DEBUG"):
+            print("[canFetchHarnessToken]", exc, file=sys.stderr)
+        return False
+
+
+def fetch_harness_token(
+    harness_name: str,
+    *,
+    config_io: ConfigIO | None = None,
+    deploy_target: str | None = None,
+    identity_name: str | None = None,
+) -> OAuthTokenResult:
+    config_io = config_io or ConfigIO()
+    deployed_state = config_io.read_deployed_state()
+    project_spec = config_io.read_project_spec()
+    spec = config_io.read_harness_spec(harness_name)
+
+    target_names = list(deployed_state.targets or {})
+    if not target_names:
+        raise RuntimeError("No deployed targets found. Run `agentcore deploy` first.")
+    target_name = deploy_target or target_names[0]
+
+    if spec.authorizer_type != "CUSTOM_JWT":
+        raise RuntimeError(f"Harness '{harness_name}' uses {spec.authorizer_type or 'AWS_IAM'} auth, not CUSTOM_JWT.")
+    config = spec.authorizer_configuration
+    jwt_config = config.custom_jwt_authorizer if config else None
+    if jwt_config is None:
+        raise RuntimeError(
+            f"Harness '{harness_name}' is configured as CUSTOM_JWT but has no customJwtAuthorizer configuration."
+        )
+    return oauth_token.fetch_oauth_token(
+        resource_name=harness_name,
+        jwt_config=jwt_config,
+        deployed_state=deployed_state,
+        target_name=target_name,
+        credentials=project_spec.credentials or [],
+        credential_name=identity_name,
+    )

agentcore/operations/fetch_access/fetch_runtime_token.py

@@ -0,0 +1,76 @@
+"""Port of src/cli/operations/fetch-access/fetch-runtime-token.ts."""
+
+from agentcore.lib.schemas.io.config_io import ConfigIO
+from agentcore.lib.utils.env import read_env_file
+from agentcore.operations.fetch_access import oauth_token
+from agentcore.operations.fetch_access.oauth_token import OAuthTokenResult
+from agentcore.primitives.credential_utils import (
+    compute_default_credential_env_var_name,
+    compute_managed_oauth_credential_name,
+)
+
+
+def can_fetch_runtime_token(
+    agent_name: str, *, config_io: ConfigIO | None = None, identity_name: str | None = None
+) -> bool:
+    """True when a CUSTOM_JWT agent has its managed OAuth credential and client secret available."""
+    try:
+        config_io = config_io or ConfigIO()
+        project_spec = config_io.read_project_spec()
+        agent = next((a for a in project_spec.runtimes or [] if a.name == agent_name), None)
+        if agent is None or agent.authorizer_type != "CUSTOM_JWT":
+            return False
+        if not (agent.authorizer_configuration and agent.authorizer_configuration.custom_jwt_authorizer):
+            return False
+        cred_name = identity_name or compute_managed_oauth_credential_name(agent_name)
+        if not any(
+            c.authorizer_type == "OAuthCredentialProvider" and c.name == cred_name
+            for c in project_spec.credentials or []
+        ):
+            return False
+        prefix = compute_default_credential_env_var_name(cred_name)
+        return bool(read_env_file().get(f"{prefix}_CLIENT_SECRET"))
+    except Exception:  # noqa: BLE001 - "cannot fetch", as upstream
+        return False
+
+
+def fetch_runtime_token(
+    agent_name: str,
+    *,
+    config_io: ConfigIO | None = None,
+    deploy_target: str | None = None,
+    identity_name: str | None = None,
+) -> OAuthTokenResult:
+    config_io = config_io or ConfigIO()
+    deployed_state = config_io.read_deployed_state()
+    project_spec = config_io.read_project_spec()
+
+    target_names = list(deployed_state.targets or {})
+    if not target_names:
+        raise RuntimeError("No deployed targets found. Run `agentcore deploy` first.")
+    target_name = deploy_target or target_names[0]
+
+    runtimes = project_spec.runtimes or []
+    agent = next((a for a in runtimes if a.name == agent_name), None)
+    if agent is None:
+        available = ", ".join(a.name for a in runtimes) or "none"
+        raise RuntimeError(f"Agent '{agent_name}' not found in project. Available agents: {available}")
+    if agent.authorizer_type != "CUSTOM_JWT":
+        raise RuntimeError(
+            f"Agent '{agent_name}' uses {agent.authorizer_type or 'AWS_IAM'} auth, not CUSTOM_JWT. "
+            "Token fetch is only needed for CUSTOM_JWT agents."
+        )
+    config = agent.authorizer_configuration
+    jwt_config = config.custom_jwt_authorizer if config else None
+    if jwt_config is None:
+        raise RuntimeError(
+            f"Agent '{agent_name}' is configured as CUSTOM_JWT but has no customJwtAuthorizer configuration."
+        )
+    return oauth_token.fetch_oauth_token(
+        resource_name=agent_name,
+        jwt_config=jwt_config,
+        deployed_state=deployed_state,
+        target_name=target_name,
+        credentials=project_spec.credentials or [],
+        credential_name=identity_name,
+    )

agentcore/operations/fetch_access/list_agents.py

@@ -0,0 +1,18 @@
+"""Port of src/cli/operations/fetch-access/list-agents.ts."""
+
+from agentcore.lib.schemas.io.config_io import ConfigIO
+from agentcore.operations.fetch_access._target import _target_resources
+from agentcore.operations.fetch_access.types import AgentInfo
+
+
+def list_agents(*, config_io: ConfigIO | None = None, deploy_target: str | None = None) -> list[AgentInfo]:
+    found = _target_resources(config_io or ConfigIO(), deploy_target)
+    if found is None:
+        return []
+    project_spec, resources = found
+    deployed = (resources.runtimes if resources else None) or {}
+    return [
+        {"name": a.name, "authType": a.authorizer_type or "AWS_IAM"}
+        for a in project_spec.runtimes or []
+        if deployed.get(a.name) and deployed[a.name].runtime_arn
+    ]

agentcore/operations/fetch_access/list_gateways.py

@@ -0,0 +1,26 @@
+"""Port of src/cli/operations/fetch-access/list-gateways.ts."""
+
+from agentcore.lib.schemas.io.config_io import ConfigIO
+from agentcore.operations.fetch_access._target import _target_resources
+from agentcore.operations.fetch_access.types import GatewayInfo
+
+
+def list_gateways(*, config_io: ConfigIO | None = None, deploy_target: str | None = None) -> list[GatewayInfo]:
+    found = _target_resources(config_io or ConfigIO(), deploy_target)
+    if found is None:
+        return []
+    project_spec, resources = found
+    gateways = project_spec.agent_core_gateways or []
+    mcp_deployed = (resources.mcp.gateways if resources and resources.mcp else None) or {}
+    result: list[GatewayInfo] = []
+    for gateway in gateways:
+        deployed = mcp_deployed.get(gateway.name)
+        if deployed and deployed.gateway_url:
+            result.append({"name": gateway.name, "authType": gateway.authorizer_type})
+    # HTTP gateways (deployed via CFN under resources.gateways)
+    http_deployed = (resources.gateways if resources else None) or {}
+    for gateway in (g for g in gateways if g.protocol_type == "None"):
+        deployed = http_deployed.get(gateway.name)
+        if deployed and deployed.gateway_arn:
+            result.append({"name": gateway.name, "authType": gateway.authorizer_type or "NONE"})
+    return result

agentcore/operations/fetch_access/list_harnesses.py

@@ -0,0 +1,23 @@
+"""Port of src/cli/operations/fetch-access/list-harnesses.ts."""
+
+from agentcore.lib.schemas.io.config_io import ConfigIO
+from agentcore.operations.fetch_access._target import _target_resources
+from agentcore.operations.fetch_access.types import HarnessInfo
+
+
+def list_harnesses(*, config_io: ConfigIO | None = None, deploy_target: str | None = None) -> list[HarnessInfo]:
+    config_io = config_io or ConfigIO()
+    found = _target_resources(config_io, deploy_target)
+    if found is None:
+        return []
+    project_spec, resources = found
+    deployed = (resources.harnesses if resources else None) or {}
+    result: list[HarnessInfo] = []
+    for harness in project_spec.harnesses or []:
+        state = deployed.get(harness.name)
+        if not (state and state.harness_arn):
+            continue
+        # A read failure for a deployed harness is a real config problem: let it propagate.
+        spec = config_io.read_harness_spec(harness.name)
+        result.append({"name": harness.name, "authType": spec.authorizer_type or "AWS_IAM"})
+    return result

agentcore/operations/fetch_access/oauth_token.py

@@ -0,0 +1,162 @@
+"""Port of src/cli/operations/fetch-access/oauth-token.ts (OIDC discovery + client_credentials)."""
+
+import json
+import urllib.error
+import urllib.request
+from dataclasses import dataclass
+from typing import Any
+from urllib.parse import urlencode
+
+from agentcore.lib.utils.env import read_env_file
+from agentcore.primitives.credential_utils import (
+    compute_default_credential_env_var_name,
+    compute_managed_oauth_credential_name,
+)
+
+
+@dataclass
+class OAuthTokenResult:
+    token: str
+    expires_in: int | None = None
+
+
+@dataclass
+class HttpResponse:
+    status: int
+    status_text: str
+    body: str
+
+    @property
+    def ok(self) -> bool:
+        return 200 <= self.status < 300
+
+    def json(self) -> Any:
+        return json.loads(self.body)
+
+
+def http_fetch(url: str, *, method: str = "GET", headers: dict[str, str] | None = None, body: str | None = None):
+    """Minimal ``fetch()``: returns status/statusText/body without raising on HTTP errors."""
+    request = urllib.request.Request(
+        url, method=method, headers=headers or {}, data=body.encode() if body is not None else None
+    )
+    try:
+        with urllib.request.urlopen(request, timeout=30) as response:
+            return HttpResponse(response.status, response.reason or "", response.read().decode("utf-8", "replace"))
+    except urllib.error.HTTPError as exc:
+        return HttpResponse(exc.code, exc.reason or "", exc.read().decode("utf-8", "replace"))
+
+
+def _field(obj: Any, name: str) -> Any:
+    return obj.get(name) if isinstance(obj, dict) else getattr(obj, name, None)
+
+
+def _resolve_client_id(
+    deployed_state: Any,
+    target_name: str,
+    cred_name: str,
+    env_var_prefix: str,
+    env_vars: dict[str, str],
+    allowed_clients: list[str] | None,
+) -> str | None:
+    # Tier 1: deployed-state credentials
+    target = (deployed_state.targets or {}).get(target_name)
+    resources = target.resources if target else None
+    deployed_cred = ((resources.credentials if resources else None) or {}).get(cred_name)
+    if deployed_cred is not None:
+        client_id = getattr(deployed_cred, "client_id", None) or (deployed_cred.model_extra or {}).get("clientId")
+        if client_id:
+            return client_id
+    # Tier 2: env var <prefix>_CLIENT_ID
+    env_client_id = env_vars.get(f"{env_var_prefix}_CLIENT_ID")
+    if env_client_id:
+        return env_client_id
+    # Tier 3: allowedClients[0]
+    if allowed_clients:
+        return allowed_clients[0]
+    return None
+
+
+def fetch_oauth_token(
+    *,
+    resource_name: str,
+    jwt_config: Any,
+    deployed_state: Any,
+    target_name: str,
+    credentials: list[Any],
+    credential_name: str | None = None,
+) -> OAuthTokenResult:
+    """``jwt_config`` is a CustomJwtAuthorizer model (discovery_url, allowed_clients, allowed_scopes)."""
+    cred_name = credential_name or compute_managed_oauth_credential_name(resource_name)
+    oauth_creds = [c for c in credentials if c.authorizer_type == "OAuthCredentialProvider"]
+    credential = next((c for c in oauth_creds if c.name == cred_name), None)
+    if credential is None:
+        available = [c.name for c in oauth_creds]
+        hint = (
+            f" Available OAuth credentials: {', '.join(available)}. Use --identity-name to specify one."
+            if available
+            else ""
+        )
+        raise RuntimeError(
+            f"No managed OAuth credential found for '{resource_name}'. Expected credential '{cred_name}'.{hint}"
+            + (" Re-create the resource with --client-id and --client-secret." if not available else "")
+        )
+
+    env_var_prefix = compute_default_credential_env_var_name(cred_name)
+    secret_env_var = f"{env_var_prefix}_CLIENT_SECRET"
+    env_vars = read_env_file()
+    client_secret = env_vars.get(secret_env_var)
+    if not client_secret:
+        raise RuntimeError(
+            f"Client secret not found in environment variable {secret_env_var}. "
+            "Ensure .env.local file contains this value."
+        )
+
+    client_id = _resolve_client_id(
+        deployed_state, target_name, cred_name, env_var_prefix, env_vars, _field(jwt_config, "allowed_clients")
+    )
+    if not client_id:
+        raise RuntimeError(
+            f"Could not determine OAuth client ID for '{resource_name}'. Ensure the resource was created with --client-id."
+        )
+
+    discovery_url = _field(jwt_config, "discovery_url")
+    discovery = http_fetch(discovery_url)
+    if not discovery.ok:
+        raise RuntimeError(f"OIDC discovery failed: {discovery.status} {discovery.status_text} ({discovery_url})")
+    discovery_doc = discovery.json()
+    token_endpoint = discovery_doc.get("token_endpoint")
+    if not token_endpoint:
+        raise RuntimeError(f"OIDC discovery response missing 'token_endpoint' field ({discovery_url})")
+
+    supported = discovery_doc.get("grant_types_supported")
+    if supported and "client_credentials" not in supported:
+        raise RuntimeError(
+            "This OAuth provider does not support the client_credentials grant type. "
+            f"Supported grants: {', '.join(supported)}. "
+            "Authorization code flows (3-legged OAuth) requiring browser login are not yet supported."
+        )
+
+    params = {"grant_type": "client_credentials", "client_id": client_id, "client_secret": client_secret}
+    scopes = _field(jwt_config, "allowed_scopes")
+    if scopes:
+        params["scope"] = " ".join(scopes)
+
+    token_response = http_fetch(
+        token_endpoint,
+        method="POST",
+        headers={"Content-Type": "application/x-www-form-urlencoded"},
+        body=urlencode(params),
+    )
+    if not token_response.ok:
+        error_body = token_response.body
+        if "unsupported_grant_type" in error_body:
+            raise RuntimeError(
+                "Token request failed: the OAuth provider rejected the client_credentials grant type. "
+                "This resource may require an authorization code flow (3-legged OAuth) which is not yet supported."
+            )
+        raise RuntimeError(f"Token request failed: {token_response.status} {token_response.status_text}. {error_body}")
+
+    token_data = token_response.json()
+    if not token_data.get("access_token"):
+        raise RuntimeError("Token response missing access_token field.")
+    return OAuthTokenResult(token=token_data["access_token"], expires_in=token_data.get("expires_in"))