用 Amazon Bedrock AgentCore Payment 构建自主支付 AI Agent: x402 协议实战

@tool
def request_content(url: str) -> dict:
    """请求内容。如果返回 402，提取 x402_payload 供 process_payment 使用。"""
    full_url = f"{config.seller_api_url}{url}"

    with httpx.Client(timeout=30.0) as client:
        response = client.get(full_url, headers={"Accept": "application/json"})

        if response.status_code == 402:
            # x402 v2: 从 X-PAYMENT-REQUIRED header 解码
            header_value = response.headers.get("x-payment-required")
            x402_data = json.loads(base64.b64decode(header_value))
            return {
                "http_status": 402,
                "x402_payload": x402_data["accepts"][0],  # 传给 process_payment
                "x402_version": x402_data.get("x402Version", 2),
            }

        if response.status_code == 200:
            return {"http_status": 200, "data": response.json()}

@tool
def process_payment(x402_payload: dict, x402_version: int = 1) -> dict:
    """执行 x402 支付。把 Seller 返回的 x402_payload 原样传给 AgentCore Payments。"""
    dp_client = _get_dp_client()  # 通过 STS AssumeRole 获取临时凭证

    response = dp_client.process_payment(
        userId=config.user_id,
        paymentManagerArn=config.payment_manager_arn,
        paymentSessionId=config.payment_session_id,
        paymentInstrumentId=config.payment_instrument_id,
        paymentType="CRYPTO_X402",
        paymentInput={
            "cryptoX402": {
                "version": str(x402_version),
                "payload": x402_payload,  # 原样传递，不做任何解析
            }
        },
        clientToken=str(uuid.uuid4()),  # 幂等 token
    )

    # 缓存 proof 供下一步使用（不进入 LLM 上下文）
    if response.get("status") == "PROOF_GENERATED":
        _last_payment_context["proof"] = response["paymentOutput"]["cryptoX402"]
        _last_payment_context["x402_payload"] = x402_payload

    return response

@tool
def request_content_with_payment(url: str) -> dict:
    """带 payment proof 重试请求。自动构造 x402 header 并指数退避重试。"""
    ctx = get_last_payment_context()
    proof = ctx["proof"]

    # 构造 x402 v2 payment header
    header_obj = {
        "x402Version": 2,
        "resource": ctx["x402_payload"].get("resource", ""),
        "accepted": ctx["x402_payload"],
        "payload": proof.get("payload", proof),
    }
    encoded_header = base64.b64encode(json.dumps(header_obj).encode()).decode()

    # 指数退避重试（等待链上结算）
    max_attempts = 6
    with httpx.Client(timeout=30.0) as client:
        for attempt in range(1, max_attempts + 1):
            response = client.get(
                f"{config.seller_api_url}{url}",
                headers={"PAYMENT-SIGNATURE": encoded_header},
            )
            if response.status_code != 402:
                break
            time.sleep(2 * attempt)  # 2s, 4s, 6s...

    if response.status_code == 200:
        settlement = parse_settlement_header(response)
        return {"http_status": 200, "data": response.json(), "settlement": settlement}

if method == "POST" and x402_payload:
    # 用 GET 重新获取规范化的 payment requirement
    get_resp = client.get(full_url, ...)

npm install -g @coinbase/cdp-cli
cdp env live --key-file ~/Downloads/cdp_api_key.json
cdp env live --wallet-secret-file ~/cdp-wallet-secret.txt

# 创建收款钱包（参数格式是 name=xxx，不是 --name xxx）
cdp evm accounts create name=x402-demo-seller
# 输出中的 address 字段就是收款钱包地址

# 上传内容（key 不带 .json 后缀，Lambda@Edge 按路径匹配）
aws s3 cp content/research-report.json s3://x402-content-seller/research-report

# 打包 Lambda@Edge（不要打包 node_modules，运行时自带 SDK v3）
zip -r payment-verifier.zip payment-verifier.js content-config.js types.js deploy-config.json

# deploy-config.json 中注入收款钱包地址
echo '{ "payTo": "0x你的收款钱包地址" }' > deploy-config.json

import boto3
ctrl = boto3.client("bedrock-agentcore-control", region_name="us-west-2")
dp = boto3.client("bedrock-agentcore", region_name="us-west-2")

# 1. Credential Provider
provider = ctrl.create_payment_credential_provider(
    name="MyProvider", credentialProviderVendor="CoinbaseCDP",
    providerConfigurationInput={"coinbaseCdpConfiguration": {
        "apiKeyId": "...", "apiKeySecret": "...", "walletSecret": "..."
    }})

# 2. Payment Manager（名称只能用字母数字，不能有连字符）
manager = ctrl.create_payment_manager(
    name="MyManager", authorizerType="AWS_IAM", roleArn="<RetrievalRoleArn>")

# 3. Payment Connector
connector = ctrl.create_payment_connector(
    paymentManagerId=manager["paymentManagerId"], name="CdpConnector",
    type="CoinbaseCDP",
    credentialProviderConfigurations=[{"coinbaseCDP": {"credentialProviderArn": "..."}}])

# 4. Payment Instrument → 用户需访问 redirectUrl 完成授权 + 充值
instrument = dp.create_payment_instrument(
    paymentManagerArn=..., paymentConnectorId=..., userId="test-user",
    paymentInstrumentType="EMBEDDED_CRYPTO_WALLET",
    paymentInstrumentDetails={"embeddedCryptoWallet": {
        "network": "ETHEREUM",
        "linkedAccounts": [{"email": {"emailAddress": "user@example.com"}}]
    }})
# 返回: walletAddress, redirectUrl

# 5. Payment Session（expiryTimeInMinutes 最大 480，currency 只支持 USD）
session = dp.create_payment_session(
    userId="test-user", paymentManagerArn=...,
    limits={"maxSpendAmount": {"value": "100", "currency": "USD"}},
    expiryTimeInMinutes=480)

aws ecr create-repository --repository-name x402-agent --region us-west-2
aws ecr get-login-password --region us-west-2 | docker login --username AWS --password-stdin <account>.dkr.ecr.us-west-2.amazonaws.com
docker build -t <account>.dkr.ecr.us-west-2.amazonaws.com/x402-agent:latest .
docker push <account>.dkr.ecr.us-west-2.amazonaws.com/x402-agent:latest
ctrl.create_agent_runtime(
    agentRuntimeName="x402PayerAgent",
    roleArn="<AgentRuntimeRoleArn>",
    agentRuntimeArtifact={"containerConfiguration": {"containerUri": "<ECR_URI>"}},
    networkConfiguration={"networkMode": "PUBLIC"},
    environmentVariables={
        "BEDROCK_MODEL_ID": "us.anthropic.claude-sonnet-4-6",
        "MANAGER_ARN": "...", "PAYMENT_SESSION_ID": "...",
        "PAYMENT_INSTRUMENT_ID": "...", "PROCESS_PAYMENT_ROLE_ARN": "...",
        "SELLER_API_URL": "https://dXXX.cloudfront.net",
    },
)
ctrl.create_agent_runtime_endpoint(agentRuntimeId="...", name="default")

# 1. 创建 Gateway
gw = ctrl.create_gateway(
    name="x402PayerGateway", roleArn="<AgentRuntimeRoleArn>",
    protocolType="MCP",
    protocolConfiguration={"mcp": {"supportedVersions": ["2025-03-26"]}},
    authorizerType="NONE")

# 2. 创建 dummy API Key Provider
cp = ctrl.create_api_key_credential_provider(name="SellerNoAuth", apiKey="dummy")

# 3. 创建 Target（将 OpenAPI spec 中的 server URL 替换为实际 CloudFront URL）
ctrl.create_gateway_target(
    gatewayIdentifier=gw["gatewayId"], name="x402ContentAPI",
    targetConfiguration={"mcp": {"openApiSchema": {"inlinePayload": openapi_spec}}},
    credentialProviderConfigurations=[{
        "credentialProviderType": "API_KEY",
        "credentialProvider": {"apiKeyCredentialProvider": {
            "providerArn": cp["credentialProviderArn"],
            "credentialParameterName": "x-api-key",
            "credentialPrefix": "Bearer", "credentialLocation": "HEADER",
        }}
    }])

curl -s -X POST "${GATEWAY_URL}" -H "Content-Type: application/json" \
  -d '{"jsonrpc":"2.0","method":"tools/list","id":1}'
# 预期返回 4 个工具

# 构建前端（.env 中配置 API 端点和 Seller URL）
cd web-ui && npm install && npm run build
aws s3 sync dist/ s3://x402-web-ui-bucket/ --delete