Aurora Datastore Bootstrap

2026.10.22.2

Fixed: The README and manifest Quick Start documented master_password as a literal --input master_password=... value. Workflow --input values are recorded in cleartext in the run history, so a password written that way leaks. The docs now store the password with swamp vault put aurora MASTER_PASSWORD (which prompts for the value) and pass it as a ${{ vault.get("aurora", "MASTER_PASSWORD") }} expression, which swamp redacts. This earns the registry secret-safe-docs quality factor.

Changed: Docs only. No model schema, method, or behavior change. The upgrades chain gains an identity entry terminating at this version so existing definitions migrate cleanly.

Upgrade note: No action required. On the next method run, each existing definition's typeVersion advances to 2026.10.22.2 with its global arguments preserved.

2026.10.22.1

Fixed: Existing definitions created against an earlier version were stranded on upgrade. The model shipped new versions without a corresponding upgrades chain, so swamp could not migrate a definition's typeVersion and logged a warning that global arguments would not be migrated. This release backfills the full upgrade chain through every shipped version and terminates it at the current version, so stale definitions migrate cleanly. The transform is identity — no stored global argument value changes.

Upgrade note: No action required. On the next method run, each existing definition's typeVersion advances to 2026.10.22.1 with its global arguments preserved.

2026.10.14.1

Added: The manifest now declares license: Apache-2.0 (SPDX). The registry quality rubric scores a declared license separately from the bundled LICENSE.md.

Upgrade note: Metadata only. No code, schema, or behavioral changes.

2026.09.18.1

Upgrade note: Normalized npm:zod dependency version to 4.6.5 across the repo. No behavioral changes in this extension.

2026.10.14.1

Added: The manifest now declares license: Apache-2.0 (SPDX). The registry quality rubric scores a declared license separately from the bundled LICENSE.md.

Upgrade note: Metadata only. No code, schema, or behavioral changes.

2026.09.18.1

Upgrade note: Normalized npm:zod dependency version to 4.6.5 across the repo. No behavioral changes in this extension.

2026.09.18.1

Upgrade note: Normalized npm:zod dependency version to 4.6.5 across the repo. No behavioral changes in this extension.

2026.09.15.1

Changed: Bump zod 4.4.3 → 4.6.5

2026.08.28.1

Changed: Normalized the extension license to Apache-2.0 and corrected the copyright holder to "Sean Escriva". Extensions that previously shipped an MIT LICENSE.md are now Apache-2.0, consistent with the repository root and every other extension. No code or behavioral changes.

Upgrade note: License text only. No API, schema, or runtime behavior changed.

2026.08.27.1

Changed: Test suite now builds its method context from the shared createModelTestContext factory in @systeminit/swamp-testing instead of a hand-rolled context, wrapping writeResource to preserve the existing assertion API. No behavioral, schema, or method changes — the published provisioner is unchanged. The deno.json gains a dev-only @systeminit/swamp-testing import-map entry and its check task now type-checks the test file.

2026.08.26.3

Fixed: Restored inline npm:zod@4.4.3 import specifiers so the registry quality scorer can resolve dependencies and score the extension. An earlier release used a bare "zod" import-map specifier, which published but scored as unscored.

Changed: Retained explicit compilerOptions.strict in deno.json. No behavioral or schema changes.

2026.08.28.1

Changed: Normalized the extension license to Apache-2.0 and corrected the copyright holder to "Sean Escriva". Extensions that previously shipped an MIT LICENSE.md are now Apache-2.0, consistent with the repository root and every other extension. No code or behavioral changes.

Upgrade note: License text only. No API, schema, or runtime behavior changed.

2026.08.27.1

Changed: Test suite now builds its method context from the shared createModelTestContext factory in @systeminit/swamp-testing instead of a hand-rolled context, wrapping writeResource to preserve the existing assertion API. No behavioral, schema, or method changes — the published provisioner is unchanged. The deno.json gains a dev-only @systeminit/swamp-testing import-map entry and its check task now type-checks the test file.

2026.08.26.3

Fixed: Restored inline npm:zod@4.4.3 import specifiers so the registry quality scorer can resolve dependencies and score the extension. An earlier release used a bare "zod" import-map specifier, which published but scored as unscored.

Changed: Retained explicit compilerOptions.strict in deno.json. No behavioral or schema changes.

2026.08.27.1

Changed: Test suite now builds its method context from the shared createModelTestContext factory in @systeminit/swamp-testing instead of a hand-rolled context, wrapping writeResource to preserve the existing assertion API. No behavioral, schema, or method changes — the published provisioner is unchanged. The deno.json gains a dev-only @systeminit/swamp-testing import-map entry and its check task now type-checks the test file.

2026.08.26.3

Fixed: Restored inline npm:zod@4.4.3 import specifiers so the registry quality scorer can resolve dependencies and score the extension. An earlier release used a bare "zod" import-map specifier, which published but scored as unscored.

Changed: Retained explicit compilerOptions.strict in deno.json. No behavioral or schema changes.

2026.08.26.3

Fixed: Restored inline npm:zod@4.4.3 import specifiers so the registry quality scorer can resolve dependencies and score the extension. An earlier release used a bare "zod" import-map specifier, which published but scored as unscored.

Changed: Retained explicit compilerOptions.strict in deno.json. No behavioral or schema changes.

2026.08.26.1

Changed: Normalized deno.json configuration for repo-wide consistency: added explicit compilerOptions.strict and migrated zod dependency to the import map (bare "zod" specifier instead of inline npm:zod@4.4.3). No behavioral changes — runtime resolution is identical.

2026.08.24.1

Added: Output metadata attributes for observability.

• durationMs: Method execution duration in milliseconds.
• collectedBy: Extension name that produced the data.
• fetchedAt: ISO 8601 timestamp when data was fetched (added to resources that previously lacked it).

2026.08.23.1

Changed: Documentation only — no code changes. Added a ## Troubleshooting section covering the missing-default-VPC error, the "need 2+ subnets" check in getSubnetIds, the 600s/15s cluster-available timeout, and a real gotcha found while reading the code: the provisioner only waits for the cluster to reach available, never the writer instance, so connections can fail immediately post-bootstrap. Also documents the rds-db:connect policy being scoped only to master_username.

2026.08.21.1

Changed: subnet_ids is now validated as a comma-separated list of subnet-[a-f0-9]+ IDs at model-creation time, instead of accepting any string and letting a malformed value fail deep inside the AWS CLI call with an opaque error.

max_acu must now be greater than or equal to min_acu. Previously an inverted range (e.g. max_acu=2 with min_acu=4) was accepted and passed straight through to create-db-cluster, which rejects it with a generic RDS validation error that doesn't identify which argument was wrong.

2026.08.02.1

Fixed: The configure job in @webframp/bootstrap-aurora-datastore failed with Invalid expression: No such key: attributes. The workflow queried data.latest("swamp-aurora-provisioner", "state"), but the provisioner writes its resource under the instance name "main" (via writeResource("state", "main", ...)) — data.latest()'s second argument matches the resource's instance name, not its spec name. The configure job now queries data.latest("swamp-aurora-provisioner", "main"), which resolves correctly.

Added: The provisioner now writes an optional datastoreConfig field (JSON string of {connectionString, ssl}), matching the pattern used by the other datastore bootstrap extensions. The existing connectionString field is unchanged. The field is optional so resources written by prior versions remain readable.

Changed: The run-setup step now passes the provisioner's datastoreConfig through a DATASTORE_CONFIG environment variable instead of building the config JSON inline inside a single-quoted shell string. The prior pattern embedded the connection string (which includes the URL-encoded master password) directly into both a JSON literal and a shell single-quoted argument, so a password containing a single quote or double quote could corrupt the command or the JSON payload.

Upgrade note: If you provisioned with a prior version, your stored resource predates the datastoreConfig field. Re-run the infra job (or the whole workflow) once after upgrading so provision rewrites the resource with datastoreConfig populated — otherwise the configure job's run-setup step will receive an empty DATASTORE_CONFIG.

2026.07.27.1

Fixed: The fmt task ran deno fmt --check, so deno task fmt verified formatting instead of applying it and there was no way to format the extension through its own task. fmt now formats and a new fmt:check verifies, matching every other extension in the repository.

Changed: Reformatted files that had drifted from deno fmt. No code behavior changes.

Fixed: deno fmt no longer inspects CLAUDE.md / AGENTS.md. Those files are gitignored and never present in CI, but deno fmt does not read .gitignore, so deno task fmt:check could fail locally on a file CI does not have.

Upgrade note: Tooling and formatting only. No model, method, schema, or behavior change — nothing to do on upgrade.