feat(project): add payment resources

[aidandaly24]

Summary

Adds project-based Payments resource authoring:

agentcore project add credentials payment
agentcore project add payment-manager
agentcore project add payment-connector
agentcore project remove payment-manager
agentcore project remove payment-connector --manager <manager>

Payment credentials are reusable project resources under credentials[]. Create
the credential first, then reference it from a manual connector:

agentcore project add credentials payment \
--name coinbase-prod \
--provider CoinbaseCDP \
--api-key-id <id> \
--api-key-secret file://<path> \
--wallet-secret file://<path>
agentcore project add payment-connector \
--manager Payments \
--name Coinbase \
--credential coinbase-prod
agentcore project add credentials payment \
--name stripe-prod \
--provider StripePrivy \
--app-id <id> \
--app-secret file://<path> \
--authorization-private-key file://<path> \
--authorization-id <id>
agentcore project add payment-connector \
--manager Payments \
--name Stripe \
--credential stripe-prod

Quick Create is a connector-only mode and creates no credentials[] entry:

agentcore project add payment-connector \
--manager Payments \
--name CoinbaseQuick \
--quick-create

The change:

• models manual and Quick Create connectors using the same schema variants as main;
• validates connector-name uniqueness within each manager;
• validates manual credential references, credential type, and provider compatibility;
• collects CoinbaseCDP and StripePrivy credential values through source-aware flags;
• validates Coinbase Ed25519/P-256 and Stripe P-256 private-key formats and normalizes wallet-auth: prefixes;
• stores managed payment credential values or fill-before-deploy placeholders in a POSIX owner-only .env.local;
• rejects inline secret values and provider-incompatible credential options;
• rejects credential names that collide after environment-variable normalization;
• rejects payment manager names that collide after runtime environment-variable normalization;
• validates Payment manager OIDC, scope, description, and non-negative spend-limit constraints against CloudFormation;
• warns that auto-payment defaults on and that project commands do not mutate runtime source code;
• requires manual connectors to reference an explicitly created payment credential;
• removes payment managers with all nested connectors while preserving reusable credentials;
• removes nested payment connectors with explicit manager context while preserving siblings and reusable credentials;
• bumps generated projects from @aws/agentcore-cdk@0.1.0-alpha.45 to published alpha.49;
• maps Quick Create through generated CDK without resolving a credential ARN;
• preserves complete manager and connector identities in CDK construct and output IDs;
• synthesizes Quick Create status and authorization URL outputs.

Payment credential service-side provisioning remains outside these project
authoring commands. Manual connector deployment continues to consume credential
provider ARNs from target deployed state.

L3 Compatibility

Published L3 0.1.0-alpha.49 contains Quick Create support from
aws/agentcore-l3-cdk-constructs#324, and alpha.50 preserves legacy generated
connector props through aws/agentcore-l3-cdk-constructs#341.

aws/agentcore-l3-cdk-constructs#345 adds the AgentCorePayments L3 sibling that
now owns manager/connector construction, credential resolution, runtime wiring,
and outputs for newly generated projects. This PR includes the corresponding
generated-CDK cleanup, but its package manifest temporarily remains pinned to
alpha.49; generated-CDK build and deploy require the exact #345 tarball until
that PR is merged, published, and pinned here.

Testing

Latest source verification on PR head 7adecd9c:

• bun test src: 2,227 passed;
• 118 focused Payments and credential tests passed;
• bun run typecheck, bun run format:check, and bun run lint:check.

The included generated-CDK cleanup was tested independently with the exact
aws/agentcore-l3-cdk-constructs#345 tarball:

• npm run build;
• npm test -- --runInBand: 3 passed;
• npm run format:check;
• template assertions cover manual and Quick Create connector properties, outputs,
  and collision-safe construct identities.

Fresh refactor project

A project created by this branch's built CLI with the exact
aws/agentcore-l3-cdk-constructs#345 tarball:

• stored validated Coinbase/Stripe values in a 0600.env.local and stripped
  the documented wallet-auth: prefix;
• synthesized and deployed one manager, Coinbase/Stripe manual connectors, and
  a Coinbase Quick Create connector;
• reached CloudFormation CREATE_COMPLETE; manual connectors reached READY,
  while Quick Create returned PENDING_AUTHENTICATION and an authorization URL;
• redeployed unchanged with identical manager, connector, role, runtime, and
  output identities;
• deleted the stack and temporary credential providers and verified they were
  absent.

Cross-version payment matrix

An old-CLI scaffold was populated exclusively through the new project commands,
then validated and deployed by released CLI 0.28.0.

Verified:

• standalone CoinbaseCDP and StripePrivy payment credentials;
• existing credential reuse;
• one credential reused across payment managers;
• AWS_IAM and CUSTOM_JWT payment managers;
• Quick Create authorization through READY;
• unchanged redeploy reused resource identities;
• CloudFormation resources and all test credential providers were deleted and
  verified absent.

Scope

This PR does not add imperative Payments commands, TUI screens, or payment
credential deployment orchestration.

[agentcore-devx-automation]

Claude Security Review: no high-confidence findings. (run)

[agentcore-devx-automation]

AgentCore Harness Review

Verdict: Looks good

Nice work — the schema variants for manual vs. Quick Create are cleanly modeled, the L3 wiring in cdk-stack.ts narrows the union correctly, and the tests exercise the real filesystem instead of mocking fs (👍 per the harness guidance). A couple of small things to consider but nothing blocking:

• src/assets/cdk/test/cdk.test.ts L7–L16: beforeAll/afterAll operate on join(process.cwd(), 'agentcore'). The mkdirSync(..., { recursive: true }) won't fail if the directory already exists, and writeFileSync(..., '{}') will overwrite any existing agentcore.json; afterAll then rmSyncs the whole directory. If a developer ever runs this test from a real project root (or the vended CDK asset lands somewhere that already has an agentcore/), it would silently clobber real data. Consider using mkdtempSync (or fs.mkdtemp in os.tmpdir()) and pointing the L3 at it, similar to what payment-test-support.ts does. Non-blocking, but easy hardening.

• src/projectSchemas/project.ts L243–L258: the new credential env-var normalization check applies to all credential types, not just payment credentials. It's the right rule, but it's a project-wide validation change that could reject previously-accepted specs (e.g. service-key + service_key). Worth calling out in the PR description / release notes so it isn't a surprise on upgrade.

• src/projectSchemas/payment.ts L64–L69: defaultSpendLimit's refinement is Number.isFinite(Number(value)) && Number(value) >= 0. Number("") and Number(" ") both coerce to 0, so empty/whitespace strings slip through. A quick value.trim().length > 0 && ... would tighten it.

Telemetry: the sibling add handlers (gateway, api-key, oauth) don't instrument either, so the new payment handlers are consistent with existing patterns — no action needed here.

[codecov-commenter]

Codecov Report

❌ Patch coverage is 99.21507% with 5 lines in your changes missing coverage. Please review.
✅ Project coverage is 97.23%. Comparing base (fadad5a) to head (7adecd9).

Files with missing lines	Patch %	Lines
.../handlers/project/add/credentials/payment/input.ts	97.88%	3 Missing ⚠️
...lers/project/add/credentials/payment/validation.ts	97.82%	1 Missing ⚠️
src/projectSchemas/credential.ts	94.11%	1 Missing ⚠️

Additional details and impacted files

@@ Coverage Diff @@## refactor #2120 +/- ##
============================================
+ Coverage 97.19% 97.23% +0.04% 
============================================
Files 471 477 +6 Lines 28731 29334 +603 ============================================
+ Hits 27925 28523 +598 - Misses 806 811 +5 

☔ View full report in Codecov by Harness.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.
• 📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.

[aidandaly24]

This Schema change is already on main, but wasn't done in the fork.

[agentcore-devx-automation]

Claude Security Review: no high-confidence findings. (run)

[agentcore-devx-automation]

Claude Security Review: no high-confidence findings. (run)

[agentcore-devx-automation]

Claude Security Review: no high-confidence findings. (run)

[agentcore-devx-automation]

Claude Security Review: no high-confidence findings. (run)

[agentcore-devx-automation]

Claude Security Review: no high-confidence findings. (run)

[agentcore-devx-automation]

Claude Security Review: no high-confidence findings. (run)

[agentcore-devx-automation]

Claude Security Review: no high-confidence findings. (run)

[agentcore-devx-automation]

Claude Security Review: no high-confidence findings. (run)

[jariy17]

If we didn't remove anything, we should either throw an error and print it out in the console. This is OOS but wanted to bring this up.

[jariy17]

It's good and it follows this repo's patterns.

[notgitika]

Good work! This PR itself LGTM but just wanted to call out 2 things it depends on:
1/ credentials being able to deploy and written to deployed-state.json
2/ the CDK PR needs to be released