test(deps): derive vended agentcore-cdk pin from the template

[jariy17]

TL;DR

The @aws/agentcore-cdk pin was hand-typed in 3 places. This makes the tests read it from the one file that ships it, so a version bump stops being a find-and-replace chore.

Review time: ~5 min. Risk: low — tests only, no runtime src/ change. Motivating commit: ddb32a2 (#2087).

The problem

0.1.0-alpha.49 was duplicated in:

• src/assets/cdk/package.json — the real pin (sync.ts treats it as source of truth)
• plan.test.ts + sync.test.ts — hand-typed copies

Every prerelease bump had to edit all of them in lockstep. Miss one → red build, or a stale assertion that passes when it shouldn't.

What changed (3 files)

1. New __tests__/fixtures.ts — exposes CDK_PIN read from the vended template, plus newerPrerelease() for skew tests. Reads via fs (not import) because src/assets is excluded from the TS program — same pattern the snapshot test and sync.ts already use.
2. plan.test.ts — uses CDK_PIN / derived CDK_PIN_NEWER instead of the literals.
3. sync.test.ts — uses CDK_PIN for its 5 pin literals.

Older-version fixtures (alpha.19) stay literal on purpose — they mean "much older", never bumped.

Why no new guardrail literal

The asset snapshot already stores the pin as a literal, so any unintended template change still trips a red snapshot test until someone regenerates it. No point duplicating that.

Verified

• vitest run --project unit src/lib/dependency-management → 40 passed
• npm run typecheck · eslint · prettier --check → clean

Next

Unblocks #2118 (auto-bump in the release flow). The pair was dry-run tested end-to-end in a private mirror: a release run auto-produced a PR bumping the pin alpha.48 → 49 with the snapshot refreshed and zero test edits.

[agentcore-devx-automation]

Claude Security Review: no high-confidence findings. (run)

[github-actions]

Package Tarball

aws-agentcore-0.28.0.tgz

How to install

gh release download pr-2117-tarball --repo aws/agentcore-cli --pattern "*.tgz" --dir /tmp/pr-tarball
npm install -g /tmp/pr-tarball/aws-agentcore-0.28.0.tgz

[agentcore-devx-automation]

AgentCore Harness Review

Verdict: Looks good

This is a focused test refactor that removes duplicated hardcoded @aws/agentcore-cdk version strings by sourcing CDK_PIN from the vended src/assets/cdk/package.json (the actual source of truth) and deriving a strictly-newer prerelease for skew tests via newerPrerelease. The substitutions in plan.test.ts and sync.test.ts are 1:1 replacements of the previous literals (0.1.0-alpha.49 and 0.1.0-alpha.51), so behavior is preserved while future template bumps no longer require editing multiple test files.

A few observations, none blocking:

• readFileSync in fixtures.ts runs at module load. Since vitest discovers only *.test.ts, fixtures.ts won't be picked up as a suite, and path.resolve(__dirname, '../../../assets/cdk/package.json') correctly points at src/assets/cdk/package.json from src/lib/dependency-management/__tests__/. The comment about src/assets being excluded from the TS program matches tsconfig.json.
• newerPrerelease will throw if the CDK pin ever moves off a -alpha.N prerelease. That's an intentional fail-fast, but worth remembering as the vended package approaches a stable release — the fixture will need updating at that point.
• The "upgrades an older exact-pinned prerelease" test still hardcodes 0.1.0-alpha.19 as the "older" version. That's fine as long as the pin never drops below alpha.20, which is a safe assumption.

No changes required. LGTM.

[agentcore-devx-automation]

Claude Security Review: no high-confidence findings. (run)

[github-actions]

Coverage Report

Status	Category	Percentage	Covered / Total
🔵	Lines	40.99%	15453 / 37694
🔵	Statements	40.24%	16473 / 40935
🔵	Functions	35.15%	2644 / 7522
🔵	Branches	34.18%	10311 / 30161

Generated in workflow #4421 for commit 85a851e by the Vitest Coverage Report Action