feat(project): add payment resources

[aidandaly24]

Summary

Adds project-based Payments resource authoring:

agentcore project add credentials payment
agentcore project add payment-manager
agentcore project add payment-connector
agentcore project remove payment-manager
agentcore project remove payment-connector --manager <manager>

Payment credentials are reusable project resources under credentials[]. Manual
connectors can reference an existing payment credential or atomically create one:

agentcore project add payment-connector \
  --manager Payments \
  --name Coinbase \
  --credential coinbase-prod

agentcore project add payment-connector \
  --manager Payments \
  --name Stripe \
  --create-credential stripe-prod \
  --provider StripePrivy

Quick Create is a connector-only mode and creates no credentials[] entry:

agentcore project add payment-connector \
  --manager Payments \
  --name CoinbaseQuick \
  --quick-create

The change:

• models manual and Quick Create connectors using the same schema variants as main;
• validates connector-name uniqueness within each manager;
• validates manual credential references, credential type, and provider compatibility;
• rejects credential names that collide after environment-variable normalization;
• rejects payment manager names that collide after runtime environment-variable normalization;
• validates non-negative payment-session spend limits;
• commits compound credential-plus-connector additions in one validated project-spec write;
• removes payment managers with all nested connectors while preserving reusable credentials;
• removes nested payment connectors with explicit manager context while preserving siblings and reusable credentials;
• bumps generated projects from @aws/agentcore-cdk@0.1.0-alpha.45 to published alpha.49;
• maps Quick Create through generated CDK without resolving a credential ARN;
• rejects Quick Create in existing projects whose generated CDK assets do not declare support;
• preserves complete manager and connector identities in CDK construct and output IDs;
• synthesizes Quick Create status and authorization URL outputs.

Payment credential secret collection and service-side provisioning remain outside
these project authoring commands. Manual connector deployment continues to consume
credential provider ARNs from target deployed state.

L3 Compatibility

Published L3 0.1.0-alpha.49 contains Quick Create support from
aws/agentcore-l3-cdk-constructs#324. New generated projects pass the current
connector schema into AgentCorePaymentConnector.

aws/agentcore-l3-cdk-constructs#341 has also merged to preserve legacy generated
connector props once a newer L3 version is published.

Testing

Latest review-fix verification on PR head 5a166827:

• bun test src: 2,155 passed;
• bun run typecheck;
• bun run format:check;
• bun run lint:check;
• bun run secrets:check;
• bun run build.

Generated CDK package, tested independently with published alpha.49:

• npm run build;
• npm test -- --runInBand: 3 passed;
• npm run format:check;
• template assertions cover manual and Quick Create connector properties, outputs,
  and collision-safe construct identities.

Fresh refactor project

A project created by this branch's built CLI:

• contained the alpha.49 dependency and Quick Create adapter;
• passed agentcore project build;
• synthesized ProvisionMode: QUICK_CREATE with
  CredentialProviderConfigurations: [];
• deployed through this branch's agentcore project deploy;
• reached CloudFormation CREATE_COMPLETE;
• returned the connector ID, PENDING_AUTHENTICATION status, and authorization URL;
• was deleted and verified absent.

Cross-version payment matrix

An old-CLI scaffold was populated exclusively through the new project commands,
then validated and deployed by released CLI 0.28.0.

Verified:

• standalone CoinbaseCDP and StripePrivy payment credentials;
• existing credential reuse;
• atomic credential-plus-connector creation for both providers;
• one credential reused across payment managers;
• AWS_IAM and CUSTOM_JWT payment managers;
• Quick Create authorization through READY;
• unchanged redeploy reused resource identities;
• CloudFormation resources and all test credential providers were deleted and
  verified absent.

Scope

This PR does not add imperative Payments commands, TUI screens, or payment
credential deployment orchestration.

[agentcore-devx-automation]

Claude Security Review: no high-confidence findings. (run)

[agentcore-devx-automation]

AgentCore Harness Review

Verdict: Looks good

Nice work — the schema variants for manual vs. Quick Create are cleanly modeled, the L3 wiring in cdk-stack.ts narrows the union correctly, and the tests exercise the real filesystem instead of mocking fs (👍 per the harness guidance). A couple of small things to consider but nothing blocking:

• src/assets/cdk/test/cdk.test.ts L7–L16: beforeAll/afterAll operate on join(process.cwd(), 'agentcore'). The mkdirSync(..., { recursive: true }) won't fail if the directory already exists, and writeFileSync(..., '{}') will overwrite any existing agentcore.json; afterAll then rmSyncs the whole directory. If a developer ever runs this test from a real project root (or the vended CDK asset lands somewhere that already has an agentcore/), it would silently clobber real data. Consider using mkdtempSync (or fs.mkdtemp in os.tmpdir()) and pointing the L3 at it, similar to what payment-test-support.ts does. Non-blocking, but easy hardening.

• src/projectSchemas/project.ts L243–L258: the new credential env-var normalization check applies to all credential types, not just payment credentials. It's the right rule, but it's a project-wide validation change that could reject previously-accepted specs (e.g. service-key + service_key). Worth calling out in the PR description / release notes so it isn't a surprise on upgrade.

• src/projectSchemas/payment.ts L64–L69: defaultSpendLimit's refinement is Number.isFinite(Number(value)) && Number(value) >= 0. Number("") and Number(" ") both coerce to 0, so empty/whitespace strings slip through. A quick value.trim().length > 0 && ... would tighten it.

Telemetry: the sibling add handlers (gateway, api-key, oauth) don't instrument either, so the new payment handlers are consistent with existing patterns — no action needed here.

[codecov-commenter]

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 97.45%. Comparing base (9ab30d3) to head (5a16682).

Additional details and impacted files

@@             Coverage Diff              @@
##           refactor    #2120      +/-   ##
============================================
+ Coverage     97.41%   97.45%   +0.04%     
============================================
  Files           453      457       +4     
  Lines         27637    28085     +448     
============================================
+ Hits          26922    27370     +448     
  Misses          715      715              

☔ View full report in Codecov by Harness.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.
• 📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.

[aidandaly24]

This Schema change is already on main, but wasn't done in the fork.

[agentcore-devx-automation]

Claude Security Review: no high-confidence findings. (run)

[agentcore-devx-automation]

Claude Security Review: no high-confidence findings. (run)

[agentcore-devx-automation]

Claude Security Review: no high-confidence findings. (run)

[agentcore-devx-automation]

Claude Security Review: no high-confidence findings. (run)

[agentcore-devx-automation]

Claude Security Review: no high-confidence findings. (run)