feat(deploy): auto-provision the default deployment target from STS

[AlexanderRichey]

Summary

A brand-new user can now run

agentcore project create --name MyProject
cd MyProject
agentcore project deploy

and get a deployed CloudFormation stack with no hand-editing of config files, no prompts, and no prior AWS setup beyond valid credentials — including into a region that has never been CDK-bootstrapped.

• When the requested target is default (defaulted or explicit) and agentcore/aws-targets.json is missing, empty, or lacks a default entry, FsProjectManager.deploy now synthesizes it: account from STS GetCallerIdentity, region from the CLI's already-resolved effective region (--region → env → ~/.aws/config → fallback), validated against AgentCoreRegionSchema before anything is written.
• The entry is merged into the raw file contents, so existing targets keep their order, key order, and any unknown fields; the CLI reports one stderr line (Created default deployment target: …) and proceeds with the deploy in the same invocation.
• Named targets are never invented — --target staging on an unconfigured project keeps the existing ProjectStateErrors, and the backend's account-match assertion is unchanged.
• Failure modes are clean: an unsupported region fails with the resolved region plus the supported list (file untouched); unresolvable/expired credentials fail with an actionable InvalidEnvironmentError instead of an SDK stack trace.
• The STS lookup is injectable via ProjectManagerConfig.resolveAccount (like json/runner/checkTool), so unit tests never call AWS.

Vended CDK template restore

This PR also reverts src/assets/cdk/{bin/cdk.ts,lib/cdk-stack.ts,test/cdk.test.ts,package.json} to their pre-#2120 state (byte-identical to adb02a1d^, pin @aws/agentcore-cdk@0.1.0-alpha.45). #2120 rewrote the template around an AgentCorePayments L3 that no published @aws/agentcore-cdk exports (alpha.49 and alpha.50 both ship only AgentCorePaymentManager/AgentCorePaymentConnector), so every fresh scaffold failed cdk synth at tsc before reaching AWS. The template shape from #2120 can be re-landed once a release ships that construct.

Testing

• bun test src: 2310 pass, 0 fail. New coverage: file absent / [] → default synthesized; non-default entries preserved byte-for-byte (including unknown keys and non-canonical key order); missing named target → existing error, no STS call; unsupported region → actionable error, file untouched; STS failure → actionable error; existing default entry → used as-is, file untouched.
• tsc --noEmit clean on the repo's code; oxlint clean at the committed toolchain version.

Live end-to-end (account 501930284170)

• Happy path (us-east-1): fresh project, project deploy with no flags or edits → exit 0, target synthesized and written, stack AgentCore-DeployE2e0830-default reached CREATE_COMPLETE (verified via aws cloudformation describe-stacks).
• Un-bootstrapped region (eu-west-1): verified no CDKToolkit existed, then a single project deploy --region eu-west-1 synthesized the target, bootstrapped unprompted (Bootstrapping aws://…/eu-west-1, new CDKToolkit at BootstrapVersion 32), and took AgentCore-DeployE2eBoot0830-default to CREATE_COMPLETE in one invocation.
• Idempotency: a second deploy succeeded with no re-synthesis and a byte-identical aws-targets.json.
• Both e2e stacks were destroyed afterwards; the eu-west-1 CDKToolkit was left standing.

🤖 Generated with Claude Code

https://claude.ai/code/session_01XfADH54TZn2SSGUUixft8P

[agentcore-devx-automation]

Claude Security Review: no high-confidence findings. (run)

[codecov-commenter]

Codecov Report

❌ Patch coverage is 94.93671% with 4 lines in your changes missing coverage. Please review.
✅ Project coverage is 97.29%. Comparing base (3d449c5) to head (5264d47).

Files with missing lines	Patch %	Lines
src/core/project/backends/cdk/environment.ts	0.00%	4 Missing ⚠️

Additional details and impacted files

@@ Coverage Diff @@## refactor #2145 +/- ##
============================================
- Coverage 97.29% 97.29% -0.01% 
============================================
Files 479 479 Lines 29673 29734 +61 ============================================
+ Hits 28871 28929 +58 - Misses 802 805 +3 

☔ View full report in Codecov by Harness.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.
• 📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.

[agentcore-devx-automation]

AgentCore Harness Review

Verdict: Changes requested

The STS auto-provisioning feature itself — the change described in the commit title — looks great. The default-target-only guard, the "leave existing entries byte-for-byte" behavior, the actionable errors for unsupported regions and unresolvable credentials, and the resolveAccount injection point for tests are all thoughtful, and the coverage in manager.test.ts and deploy/index.test.ts is genuinely thorough.

The problems are in the CDK asset rework that got bundled into the same commit.

1. Unnecessary downgrade of @aws/agentcore-cdk (src/assets/cdk/package.json)

The commit downgrades @aws/agentcore-cdk from 0.1.0-alpha.49 to 0.1.0-alpha.45 and justifies it as "restoring the vended CDK app to its last publishable state" because the old file referenced an AgentCorePayments L3 that no released version exports.

The premise (no released version exports AgentCorePayments) is correct — I verified against every published 0.1.0-alpha.* on the registry. But the conclusion doesn't follow: every symbol the new inline cdk-stack.ts imports (AgentCoreApplication, AgentCoreMcp, AgentCorePaymentManager, AgentCorePaymentConnector, CustomJWTAuthorizerConfig, HarnessDeploymentConfig) is exported by alpha.45, .46, .47, .48, .49, and .50 with the same shapes. Alpha.45 was never uniquely required to make this build.

Downgrading four minor releases silently drops several Gateway fixes shipped between .45 and .49, e.g.:

• Omitting ProtocolConfiguration when enableSemanticSearch === false (emitting 'NONE' produces a template CloudFormation rejects).
• cfnTarget.node.addDependency(this.role) for both gateway targets and Lambda-backed targets (without it, target creation can race the DefaultPolicy attach and surface as an opaque "NoStack" rollback in the toolkit).
• Retriever mapping changes in KB-backed targets.

Options:

• Pin to 0.1.0-alpha.49 (previous state) and keep the new inline payment construction — this fixes the broken scaffold without regressing Gateway.
• Bump to 0.1.0-alpha.50 (current latest).

Either preserves the intent (a scaffolded project's cdk synth passes tsc) without shedding fixes.

2. Payment coverage in the vended CDK dropped to zero (src/assets/cdk/test/cdk.test.ts)

The two existing tests — synthesizes manual and Quick Create payment connectors and preserves complete and type-distinct payment resource identities — were deleted, not adapted. The new inline payment wiring in cdk-stack.ts is substantial (~100 lines) and does non-obvious things: it filters agents through isPaymentEligibleAgent, injects AGENTCORE_PAYMENT_* env vars, adds an sts:AssumeRole grant on ProcessPaymentRole, and adds a broad set of bedrock-agentcore:* payment actions directly to the runtime role (a deliberate deviation from the beta guide, per the inline comment). None of that is covered by a synth-time template assertion any more, so a future edit that drops an env var, mis-scopes an IAM resource, or breaks the eligibility filter will ship without a red test.

At minimum, please restore synth-level assertions that:

• A paymentSpec with an eligible Python HTTP agent produces the expected env vars on the runtime and the two IAM statements on its role.
• Ineligible agents (non-HTTP protocol, or non-.py entrypoint) do not receive those env vars or grants.
• A connector referencing a credentialName with no deployed provider fails synth with the "no deployed credential provider was found" error from bin/cdk.ts.

3. Scope of the commit

The auto-provisioning change and the CDK-asset rework are independent and each substantial. Bundling them makes the title/description mismatch the diff (nothing in the title hints at the payment L3 replacement or the @aws/agentcore-cdk version change), and it makes bisect/revert coarser than it needs to be. Not a merge blocker on its own, but worth splitting if you end up rerolling for the items above.

The STS auto-provisioning path is otherwise good to go once these are addressed.