feat: create credential providers before synthesizing a deploy

[notgitika]

Creates a project's credential providers before synthesis, so the synthesized CDK app can read their ARNs out of deployed-state.json and wire them into the stack. Without this, deploying a project that declares any credential fails inside cdk synth.

What it does

• Between the account preflight and synth, CdkBackend.deploy provisions each declared credential provider: reuse-if-present, create-if-absent, never update (so a redeploy neither mints a new secret version nor overwrites one rotated outside the CLI), then records the ARNs via updateTargetState.
• Secrets come from the same place project add credentials writes them — .env.local (AGENTCORE_CREDENTIAL_<NAME>) or a Secrets Manager secretRef. The env-var name is now derived from one shared function in envLocal.ts so add and deploy agree.
• Payment credentials are rejected up front (agentcore.json can't express their vendor config).

Notes

• Pre-synth by necessity: the vended app reads the ARNs at synth time.
• Rebased onto refactor now that the deployed-state work (feat: persist minimal deploy state to deployed-state.json #2105) has merged.

Tested e2e

Ran the full flow against a real account (us-west-2): project add credentials api-key → project deploy. Confirmed deploy creates the API-key credential provider imperatively before synth, writes it to agentcore/.cli/deployed-state.json, then deploys the stack and merges the stackArn into the same target entry (no clobbering). Resulting file held both resources.credentials.e2ekey and stackArn.

[agentcore-devx-automation]

AgentCore Harness Review

Verdict: Looks good

Nice PR. The design of running credential provisioning before cdk synth and threading the ARNs through deployed-state.json is well-motivated and the comments do a great job of capturing why. The seam boundary (IdentityProviderClient) is drawn at the SDK client rather than at fs/process boundaries, so the tests avoid excessive mocking while still exercising the real spec + .env.local parsing paths. Sharing credentialEnvVarName/CLIENT_SECRET_SUFFIX between add and deploy via envLocal.ts (with a re-export from shared.ts) removes a latent format-drift bug.

A couple of small things that aren't blockers but worth confirming intentional:

• Stale credential entries when the spec goes to zero credentials. In src/core/project/backends/cdk.ts (~L115) updateTargetState is only called when Object.keys(provisioned).length > 0. If a user deletes their last credential from agentcore.json and re-deploys, provisioned is {}, the state write is skipped, and the previous resources.credentials map is left on disk. The doc-comment on updateTargetState promises "A resource map provided in the patch replaces the previous map for that kind wholesale, so a credential dropped from the spec stops being advertised" — that guarantee is only actually delivered when at least one credential remains. Since the synthesized CDK app looks up credentials by name, this is likely inert in practice, but if you want the drop-to-zero case to behave the same as drop-one-of-many, you'd either always call updateTargetState({ resources: { credentials: provisioned } }) or explicitly write {} when declared is non-empty on the spec side but you provisioned nothing.

• parseEnv cast in EnvLocalFile.read (src/core/project/envLocal.ts L90): parseEnv's declared return type is Record<string, string | undefined> (last-write-wins across duplicate keys), but you cast to Record<string, string>. All callers happen to use if (!value) so undefined is handled safely today; just be aware the type is a small lie and a future caller doing env[k].trim() would compile but crash.

Neither of these needs to block the merge.

[codecov-commenter]

Codecov Report

❌ Patch coverage is 97.71689% with 5 lines in your changes missing coverage. Please review.
✅ Project coverage is 97.38%. Comparing base (794ddbf) to head (2c47266).
⚠️ Report is 3 commits behind head on refactor.

Files with missing lines	Patch %	Lines
src/core/project/backends/cdk/credentials.ts	97.46%	5 Missing ⚠️

Additional details and impacted files

@@            Coverage Diff             @@
##           refactor    #2123    +/-   ##
==========================================
  Coverage     97.37%   97.38%            
==========================================
  Files           455      456     +1     
  Lines         27741    27955   +214     
==========================================
+ Hits          27014    27223   +209     
- Misses          727      732     +5     

☔ View full report in Codecov by Harness.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.
• 📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.

[agentcore-devx-automation]

Claude Security Review: no high-confidence findings. (run)

[agentcore-devx-automation]

Claude Security Review: no high-confidence findings. (run)

[agentcore-devx-automation]

Claude Security Review: no high-confidence findings. (run)