Skip to main content
← back to extensions

Aws/adopt

@webframp/aws/adoptv2026.10.21.1· Apache-2.0· 10d agoBEHAVIORSWORKFLOWSREPORTS
01README

Brownfield adoption of AWS resources into swamp models, whatever created them. plan_account_sweep enumerates about 40 resource types in a region through Cloud Control and writes adoption candidates with deterministic flags, live dependencies, swamp-managed matching, and coverage gaps. prepare_judgement and decide turn a plan into dispositions: flags settle what they can, jev (@swamp/typesafe-ai) advises on the rest, fixed rules have the last word, and the result is ordered into observe waves with high-risk findings. The adopt-find-unmanaged workflow runs the pipeline through an approval gate to read-only observation. plan_stack_adoption scopes the question to one CloudFormation stack.

Authentication

Uses the default AWS credential chain: sign in with an SSO named profile (aws sso login) and pass it as the optional profile global argument, or run with an attached IAM role. Required read permissions: Cloud Control (ListResources, GetResource) plus the service reads it makes on your behalf, which the AWS managed ReadOnlyAccess policy covers; STS GetCallerIdentity for the sweep; CloudFormation (ListStackResources) for stack adoption; and EC2, RDS, and Secrets Manager for the discover_* methods.

The observe step runs the official @swamp/aws/* types, which take no profile argument: they use the environment's credential chain, so set AWS_PROFILE for the workflow run. Judgement needs a @swamp/typesafe-ai model whose apiKey global argument reads the TypeSafe API key from a vault; triage_batch comes from @webframp/typesafe-batch. Store the key with swamp vault put typesafe API_KEY (it prompts), the same vault and key @webframp/typesafe-batch uses, and never pass the literal key:

swamp vault create local_encryption typesafe   # once, if you have no vault yet
swamp vault put typesafe API_KEY   # prompts for the key
swamp model create @swamp/typesafe-ai jev \
  --global-arg 'apiKey=${{ vault.get("typesafe", "API_KEY") }}'

Quick Start

swamp extension pull @webframp/aws/adopt
swamp model create @webframp/aws/adopt acct --global-arg region=us-east-1
swamp model method run acct plan_account_sweep
swamp data get acct sweep-us-east-1 --json

# Sweep, judge, decide, approve, observe:
swamp workflow run @webframp/adopt-find-unmanaged --input modelName=acct
02Release Notes

2026.10.21.1

Changed: The manifest now shows how to wire the @swamp/typesafe-ai model's apiKey from a vault (swamp vault put plus a vault.get expression) instead of only saying a TypeSafe API key is needed. The README and manifest store the key as swamp vault put typesafe API_KEY and wire ${{ vault.get("typesafe", "API_KEY") }}, the same vault and key @webframp/typesafe-batch documents for the same jev model, and both show swamp vault create for a repo with no vault yet. The manifest also recommends an SSO named profile or an attached IAM role for AWS credentials.

Upgrade note: Documentation only; no behavioral or schema changes.

03Behaviors1
@webframp/aws/adoptv2026.10.21.1aws/adopt.ts
fn discover_vpcs()
Discover existing VPCs
fn discover_subnets()
Discover existing subnets
fn discover_gateways()
Discover existing internet gateways
fn discover_route_tables()
Discover existing route tables
fn discover_security_groups()
Discover existing security groups
fn discover_rds_clusters()
Discover existing RDS clusters
fn discover_rds_instances()
Discover existing RDS instances
fn discover_db_subnet_groups()
Discover existing DB subnet groups
fn discover_secrets()
Discover existing Secrets Manager secrets
fn discover_all()
Run full discovery and generate setup commands for brownfield adoption
fn plan_account_sweep(prefix?: string, types?: array, tiers?: array, maxPagesPerType?: number, maxResourcesPerType?: number, readConcurrency?: number, managed?: array)
Sweep every registry type in the region through Cloud Control and
ArgumentTypeDescription
prefix?stringPrefix for generated swamp model names
types?arrayLimit the sweep to these CloudFormation types (default: all)
tiers?arrayLimit the sweep to these tiers (default: all)
maxPagesPerType?numberListResources page cap per type (and per parent for child types)
maxResourcesPerType?numberResource cap per type; the excess marks the type truncated
readConcurrency?numberConcurrent GetResource calls
managed?arrayStored swamp state to match against, as projected by
fn prepare_judgement(maxItems?: number)
Select the plan candidates the flags did not settle and write the
ArgumentTypeDescription
maxItems?numberMost candidates to send to jev; the rest go to a human, never dropped
fn decide(judge?: boolean)
Decide each candidate's disposition from flags, rules, and jev's
ArgumentTypeDescription
judge?booleanFalse when the workflow did not ask jev; unsettled candidates go to a
fn plan_stack_adoption(stackName: string, includeNested?: boolean, maxDepth?: number, prefix?: string)
Enumerate all resources in a CloudFormation stack, map to swamp types, and build an adoption plan
ArgumentTypeDescription
stackNamestringCloudFormation stack name (not ARN)
includeNested?booleanRecurse into AWS::CloudFormation::Stack resources
maxDepth?numberNested stack recursion limit
prefix?stringPrefix for generated swamp model names

Resources

discovery(24h)— Full discovery result with setup commands and workflow guidance
partial(24h)— Single resource-type discovery result
stackPlan(7d)— CloudFormation stack adoption plan with mapped/unmapped/skipped/orphan resources
adoptionPlan(7d)— Adoption candidates from a sweep or stack, with coverage and gaps
judgeRequest(7d)— The candidates and questions sent to jev for one plan, with the
adoptionDecision(7d)— Per-candidate dispositions with provenance, observe waves, and
04Workflows4
@webframp/adopt-find-unmanaged9201d472-e19a-4ab5-867b-4d3e8c081470

Sweep one region for resources swamp does not manage yet, judge them, decide what to do with each, and, after approval, observe the ones to manage or watch. Nothing in AWS is changed. How it works: - plan: plan_account_sweep lists every registry type through Cloud Control and matches the results against stored swamp state. prepare_judgement picks the unmanaged candidates the deterministic flags did not settle. jev's triage_batch answers four questions about each (disposition, blast radi

planSweep, judge, and decide
1.sweep${{ inputs.modelName }}.plan_account_sweep— List every registry type and match against stored swamp state
2.prepare${{ inputs.modelName }}.prepare_judgement— Pick the candidates for jev and write the questions
3.judge${{ inputs.judgeModel }}.triage_batch— Ask jev the four questions about each unsettled candidate
4.decide${{ inputs.modelName }}.decide— Apply the rules, order waves, and list high-risk findings
approveReview the decision before observing
1.approve-observe
observeRead each manage and observe-only candidate through its official type
1.get-${{ self.c.modelName }}— Observe ${{ self.c.id }}
@webframp/adopt-stackeb3aa3b7-04c5-4f62-81fb-f150fcf820dc

Orchestrate brownfield adoption of existing AWS infrastructure. Runs get and sync on pre-created swamp models in dependency order: networking first, then database, then secrets, then verification. Models must be pre-created from discover_all output before running this workflow. The workflow references models by deterministic names derived from the prefix and resource identifiers. Resources whose IDs cannot be derived from workflow inputs (subnets, route tables, security groups) should be impor

adopt-networkingImport networking resources starting with the VPC
1.get-vpc${{ inputs.prefix }}-vpc-${{ inputs.vpcSuffix }}.get— Adopt the target VPC by running get with its identifier
adopt-databaseImport RDS database resources that depend on networking
1.get-db-subnet-group${{ inputs.prefix }}-dbsubnet-${{ inputs.dbSubnetGroupName }}.get— Adopt the DB subnet group
2.get-rds-cluster${{ inputs.prefix }}-cluster-${{ inputs.clusterIdentifier }}.get— Adopt the RDS cluster by its identifier
adopt-secretsImport secrets associated with adopted resources
1.get-secret${{ inputs.prefix }}-secret-${{ inputs.secretName }}.get— Adopt the secret by its ARN
verify-adoptionVerify adopted resources by syncing live state
1.sync-vpc${{ inputs.prefix }}-vpc-${{ inputs.vpcSuffix }}.sync— Sync VPC model to confirm live state matches
2.sync-rds-cluster${{ inputs.prefix }}-cluster-${{ inputs.clusterIdentifier }}.sync— Sync RDS cluster model to confirm live state matches
@webframp/adopt-cfn-stackc0875484-1d77-4a65-8779-d5e5c4626b81

Adopt all resources defined in a CloudFormation stack into swamp typed data, comparing the stack's resource list against live AWS state. How it works: - Job 1 runs plan_stack_adoption to enumerate stack resources (recursively into nested stacks), map them to swamp types, and produce an adoption plan. - Job 2 iterates over the plan's mapped[] resources and runs `get` on each pre-existing swamp model to refresh its live state. Steps allow failure so missing models on the first run don't fai

planEnumerate stack resources and build adoption plan
1.plan-resources${{ inputs.modelName }}.plan_stack_adoption— Map CloudFormation resources to swamp types
executeRefresh live state on each mapped swamp model
1.get-${{ self.resource.logicalId }}${{ self.resource.modelName }}.get— Adopt ${{ self.resource.cfnType }} via its swamp model
@webframp/adopt-drift-check7b52035f-ceb3-40cb-aa52-d46b6cb76e20

Check for drift on all resources adopted from a CloudFormation stack. Re-runs the adoption plan to detect stack changes, then syncs each adopted model to refresh live state. The drift report compares the previous stored state against the fresh sync to surface differences. Usage: AWS_PROFILE=my-account/ReadOnlyPlus \ swamp workflow run @webframp/adopt-drift-check \ --input modelName=my-adopt \ --input stackName=my-prod-stack

planRe-enumerate stack resources to detect additions/removals
1.plan-resources${{ inputs.modelName }}.plan_stack_adoption
sync-allSync each adopted model to refresh live state
1.sync-${{ self.resource.logicalId }}${{ self.resource.modelName }}.sync— Sync ${{ self.resource.modelName }}
05Reports3
@webframp/adopt-decision-reportmethod
adopt_decision_report.ts

Renders an adoption decision after `decide`: coverage and gaps, the

awsadoptionbrownfielddecision
@webframp/adopt-drift-reportworkflow
adopt_drift_report.ts

Compares stored state vs live state for adopted CloudFormation stack resources and surfaces drift

awsadoptiondriftcloudformation
@webframp/adopt-reportworkflow
adopt_report.ts

Summarizes adoption workflow results with success/failure counts, per-job breakdown, and remediation guidance

awsadoptionbrownfieldimport
06Previous Versions18
2026.10.14.1Apache-2.0(was none)

2026.10.14.1

Added: The manifest now declares license: Apache-2.0 (SPDX). The registry quality rubric scores a declared license separately from the bundled LICENSE.md.

Upgrade note: Metadata only. No code, schema, or behavioral changes.

2026.09.26.2

Added: prepare_judgement writes a judgeRequest (judge-<plan>): the unmanaged candidates the deterministic flags did not settle, in rank order and capped at maxItems (at most 100), with the four jev questions (disposition, blast_radius, controller_owned, risk) and a fingerprint of the items.

Added: decide writes an adoptionDecision (decision-<plan>). Flags settle controller-owned candidates (exclude), the default VPC (observe-only), and read failures (needs-human). jev's answers decide the rest only when the batch fingerprint matches the request and the rules allow it: an answer below minConfidence (default 0.7), a manage jev also rates controller-owned, and a stateful manage with high blast radius go to a human. A candidate with no usable answer goes to a human with the reason. High-risk candidates are listed in findings[] whatever their disposition. manage and observe-only candidates are ordered into dependency waves, and every decision records who made it and why.

Added: The @webframp/adopt-find-unmanaged workflow runs sweep, prepare, jev triage_batch, and decide, then a manual approval, then a get on each candidate to observe through its official @swamp/aws/* type, one model per candidate. judge=false skips jev and sends unsettled candidates to a human.

Added: @webframp/adopt-decision-report, a default report of the adopt model type. After decide it renders the decision for review before approval: coverage and gaps, the jev outcome, dispositions, waves, high-risk findings, and why candidates went to a human. After a sweep it renders the plan's coverage.

Changed: Manifest dependencies now pin every registry type's @swamp/aws/* package (23 packages), @swamp/typesafe-ai 2026.09.15.1, and @webframp/typesafe-batch 2026.09.26.1.

Changed: prefix is limited to 64 characters on plan_account_sweep, plan_stack_adoption, and discover_all. Sweep model names become jev item ids, which triage_batch caps at 200 characters; the other two methods take the same limit for consistency.

Fixed: @webframp/adopt-report counted a guard-skipped step as failed. It now reports skipped steps separately and leaves them out of the attempted count. It also showed no error for a failed step, because it read error where swamp supplies errorMessage.

2026.09.26.2

2026.09.26.2

Added: prepare_judgement writes a judgeRequest (judge-<plan>): the unmanaged candidates the deterministic flags did not settle, in rank order and capped at maxItems (at most 100), with the four jev questions (disposition, blast_radius, controller_owned, risk) and a fingerprint of the items.

Added: decide writes an adoptionDecision (decision-<plan>). Flags settle controller-owned candidates (exclude), the default VPC (observe-only), and read failures (needs-human). jev's answers decide the rest only when the batch fingerprint matches the request and the rules allow it: an answer below minConfidence (default 0.7), a manage jev also rates controller-owned, and a stateful manage with high blast radius go to a human. A candidate with no usable answer goes to a human with the reason. High-risk candidates are listed in findings[] whatever their disposition. manage and observe-only candidates are ordered into dependency waves, and every decision records who made it and why.

Added: The @webframp/adopt-find-unmanaged workflow runs sweep, prepare, jev triage_batch, and decide, then a manual approval, then a get on each candidate to observe through its official @swamp/aws/* type, one model per candidate. judge=false skips jev and sends unsettled candidates to a human.

Added: @webframp/adopt-decision-report, a default report of the adopt model type. After decide it renders the decision for review before approval: coverage and gaps, the jev outcome, dispositions, waves, high-risk findings, and why candidates went to a human. After a sweep it renders the plan's coverage.

Changed: Manifest dependencies now pin every registry type's @swamp/aws/* package (23 packages), @swamp/typesafe-ai 2026.09.15.1, and @webframp/typesafe-batch 2026.09.26.1.

Changed: prefix is limited to 64 characters on plan_account_sweep, plan_stack_adoption, and discover_all. Sweep model names become jev item ids, which triage_batch caps at 200 characters; the other two methods take the same limit for consistency.

Fixed: @webframp/adopt-report counted a guard-skipped step as failed. It now reports skipped steps separately and leaves them out of the attempted count. It also showed no error for a failed step, because it read error where swamp supplies errorMessage.

2026.09.26.1

Added: plan_account_sweep enumerates every registry type in a region through Cloud Control and writes an adoptionPlan resource (sweep-<region>) that records the account and region. Each candidate carries its swamp type, primary identifier, live dependsOn, tags, a model name scoped to account and region, the aws:cloudformation:stack-name tag, swampManaged, deterministic flags, and a judgeState projection. Child types (ECS services, ELB listeners, Route 53 record sets, EKS nodegroups) are listed once per parent. Types that cannot be listed, fully or for some parents, are recorded in coverage.gaps[] with a reason, and the sweep continues. swampManaged matches stored swamp state on each type's own ARN (or an SQS queue URL), only within the sweep's account and region; a record with neither matches only when the type's identifier is globally unique, and coverage.warnings counts the records that could not be scoped.

Added: ADOPTION_TYPES, a registry of 41 adoptable types with tier, dependency rank, statefulness, identifier properties, parent, references, and judge attributes. deno task check:registry verifies every row against the published @swamp/aws/* packages.

Changed: CFN_TO_SWAMP_TYPE_MAP is now derived from ADOPTION_TYPES, so it has 41 entries instead of 14; the 14 existing mappings are unchanged. plan_stack_adoption maps 36 of them. The other five are listed in unmapped[] with the reason a stack's physical ID cannot address them: AWS::EC2::EIP, AWS::ECS::Service, and AWS::Route53::RecordSet have composite Cloud Control identifiers; AWS::Events::Rule is identified by ARN, not name; and the physical ID of AWS::EKS::Nodegroup is unconfirmed. EIPs were mapped before, but their get could not succeed; an EIP that a previous plan mapped is not reported as an orphan. Stack model names use ecs-cluster and eks-cluster so the two cluster types cannot collide; other stack model names are unchanged.

Changed: Bump @swamp/aws/rds and @swamp/aws/secretsmanager 2026.09.24.1 → 2026.09.25.1. Add @aws-sdk/client-cloudcontrol and @aws-sdk/client-sts 3.1139.0.

Fixed: README and manifest now list the CloudFormation and Cloud Control permissions, and the README's dependency versions match the manifest.

2026.09.24.1

Changed: Bump @aws-sdk/* 3.1133.0 → 3.1139.0 (5 packages)

Changed: Bump @swamp/aws/ec2 2026.09.17.1 → 2026.09.24.1

Changed: Bump @swamp/aws/rds 2026.09.17.1 → 2026.09.24.1

Changed: Bump @swamp/aws/secretsmanager 2026.09.17.1 → 2026.09.24.1

2026.09.18.1

**Upgrade n

Modified 1 behaviors. Added 1 workflows. Added 1 reports. updated dependencies

2026.09.26.1

2026.09.26.1

Added: plan_account_sweep enumerates every registry type in a region through Cloud Control and writes an adoptionPlan resource (sweep-<region>) that records the account and region. Each candidate carries its swamp type, primary identifier, live dependsOn, tags, a model name scoped to account and region, the aws:cloudformation:stack-name tag, swampManaged, deterministic flags, and a judgeState projection. Child types (ECS services, ELB listeners, Route 53 record sets, EKS nodegroups) are listed once per parent. Types that cannot be listed, fully or for some parents, are recorded in coverage.gaps[] with a reason, and the sweep continues. swampManaged matches stored swamp state on each type's own ARN (or an SQS queue URL), only within the sweep's account and region; a record with neither matches only when the type's identifier is globally unique, and coverage.warnings counts the records that could not be scoped.

Added: ADOPTION_TYPES, a registry of 41 adoptable types with tier, dependency rank, statefulness, identifier properties, parent, references, and judge attributes. deno task check:registry verifies every row against the published @swamp/aws/* packages.

Changed: CFN_TO_SWAMP_TYPE_MAP is now derived from ADOPTION_TYPES, so it has 41 entries instead of 14; the 14 existing mappings are unchanged. plan_stack_adoption maps 36 of them. The other five are listed in unmapped[] with the reason a stack's physical ID cannot address them: AWS::EC2::EIP, AWS::ECS::Service, and AWS::Route53::RecordSet have composite Cloud Control identifiers; AWS::Events::Rule is identified by ARN, not name; and the physical ID of AWS::EKS::Nodegroup is unconfirmed. EIPs were mapped before, but their get could not succeed; an EIP that a previous plan mapped is not reported as an orphan. Stack model names use ecs-cluster and eks-cluster so the two cluster types cannot collide; other stack model names are unchanged.

Changed: Bump @swamp/aws/rds and @swamp/aws/secretsmanager 2026.09.24.1 → 2026.09.25.1. Add @aws-sdk/client-cloudcontrol and @aws-sdk/client-sts 3.1139.0.

Fixed: README and manifest now list the CloudFormation and Cloud Control permissions, and the README's dependency versions match the manifest.

2026.09.24.1

Changed: Bump @aws-sdk/* 3.1133.0 → 3.1139.0 (5 packages)

Changed: Bump @swamp/aws/ec2 2026.09.17.1 → 2026.09.24.1

Changed: Bump @swamp/aws/rds 2026.09.17.1 → 2026.09.24.1

Changed: Bump @swamp/aws/secretsmanager 2026.09.17.1 → 2026.09.24.1

2026.09.18.1

Upgrade note: Normalized npm:zod dependency version to 4.6.5 across the repo. No behavioral changes in this extension.

Modified 1 behaviors. updated dependencies

2026.09.24.1

2026.09.24.1

Changed: Bump @aws-sdk/* 3.1133.0 → 3.1139.0 (5 packages)

Changed: Bump @swamp/aws/ec2 2026.09.17.1 → 2026.09.24.1

Changed: Bump @swamp/aws/rds 2026.09.17.1 → 2026.09.24.1

Changed: Bump @swamp/aws/secretsmanager 2026.09.17.1 → 2026.09.24.1

2026.09.18.1

Upgrade note: Normalized npm:zod dependency version to 4.6.5 across the repo. No behavioral changes in this extension.

updated dependencies

2026.09.18.1

2026.09.18.1

Upgrade note: Normalized npm:zod dependency version to 4.6.5 across the repo. No behavioral changes in this extension.

2026.09.17.1

2026.09.17.1

Changed: Bump @aws-sdk/* 3.1131.0 → 3.1133.0 (5 packages)

Changed: Bump @swamp/aws/ec2 2026.09.03.1 → 2026.09.17.1

Changed: Bump @swamp/aws/rds 2026.09.02.1 → 2026.09.17.1

Changed: Bump @swamp/aws/secretsmanager 2026.09.03.1 → 2026.09.17.1

2026.09.15.1

Changed: Bump zod 4.4.3 → 4.6.5

2026.09.14.1

Changed: Bump @aws-sdk/* 3.1126.0 → 3.1131.0 (5 packages)

2026.09.04.1

Changed: Bump @aws-sdk/* 3.1121.0 → 3.1126.0 (5 packages)

Changed: Bump @swamp/aws/ec2 2026.08.28.1 → 2026.09.03.1

Changed: Bump @swamp/aws/rds 2026.08.28.1 → 2026.09.02.1

Changed: Bump @swamp/aws/secretsmanager 2026.08.28.1 → 2026.09.03.1

2026.08.29.1

Changed: Bump @aws-sdk/* 3.1120.0 → 3.1121.0. Dependency-only update; no schema, API, or behavioral changes.

2026.08.28.2

Changed: Normalized the extension license to Apache-2.0 and corrected the copyright holder to "Sean Escriva". Extensions that previously shipped an MIT LICENSE.md are now Apache-2.0, consistent with the repository root and every other extension. No code or behavioral changes.

Upgrade note: License text only. No API, schema, or runtime behavior changed.

2026.08.28.1

Changed: Bump @aws-sdk/* 3.1114.0 → 3.1120.0 (5 packages)

Changed: Bump @swamp/aws/ec2 2026.08.20.1 → 2026.08.28.1

Changed: Bump @swamp/aws/rds 2026.08.19.1 → 2026.08.28.1

Changed: Bump @swamp/aws/secretsmanager 2026.08.20.1 → 2026.08.28.1

2026.08.26.3

Fixed: Restored inline npm:zod@4.4.3 import specifiers so the registry quality scorer can resolve dependencies and score the extension. An earlier release used a bare "zod" import-map specifier, which published but scored as unscored.

Changed: Retained explicit compilerOptions.strict in deno.json. No behavioral or schema changes.

updated dependencies

2026.09.15.1

2026.09.15.1

Changed: Bump zod 4.4.3 → 4.6.5

2026.09.14.1

Changed: Bump @aws-sdk/* 3.1126.0 → 3.1131.0 (5 packages)

2026.09.04.1

Changed: Bump @aws-sdk/* 3.1121.0 → 3.1126.0 (5 packages)

Changed: Bump @swamp/aws/ec2 2026.08.28.1 → 2026.09.03.1

Changed: Bump @swamp/aws/rds 2026.08.28.1 → 2026.09.02.1

Changed: Bump @swamp/aws/secretsmanager 2026.08.28.1 → 2026.09.03.1

2026.08.29.1

Changed: Bump @aws-sdk/* 3.1120.0 → 3.1121.0. Dependency-only update; no schema, API, or behavioral changes.

2026.08.28.2

Changed: Normalized the extension license to Apache-2.0 and corrected the copyright holder to "Sean Escriva". Extensions that previously shipped an MIT LICENSE.md are now Apache-2.0, consistent with the repository root and every other extension. No code or behavioral changes.

Upgrade note: License text only. No API, schema, or runtime behavior changed.

2026.08.28.1

Changed: Bump @aws-sdk/* 3.1114.0 → 3.1120.0 (5 packages)

Changed: Bump @swamp/aws/ec2 2026.08.20.1 → 2026.08.28.1

Changed: Bump @swamp/aws/rds 2026.08.19.1 → 2026.08.28.1

Changed: Bump @swamp/aws/secretsmanager 2026.08.20.1 → 2026.08.28.1

2026.08.26.3

Fixed: Restored inline npm:zod@4.4.3 import specifiers so the registry quality scorer can resolve dependencies and score the extension. An earlier release used a bare "zod" import-map specifier, which published but scored as unscored.

Changed: Retained explicit compilerOptions.strict in deno.json. No behavioral or schema changes.

2026.09.04.1

2026.09.04.1

Changed: Bump @aws-sdk/* 3.1121.0 → 3.1126.0 (5 packages)

Changed: Bump @swamp/aws/ec2 2026.08.28.1 → 2026.09.03.1

Changed: Bump @swamp/aws/rds 2026.08.28.1 → 2026.09.02.1

Changed: Bump @swamp/aws/secretsmanager 2026.08.28.1 → 2026.09.03.1

2026.08.29.1

Changed: Bump @aws-sdk/* 3.1120.0 → 3.1121.0. Dependency-only update; no schema, API, or behavioral changes.

2026.08.28.2

Changed: Normalized the extension license to Apache-2.0 and corrected the copyright holder to "Sean Escriva". Extensions that previously shipped an MIT LICENSE.md are now Apache-2.0, consistent with the repository root and every other extension. No code or behavioral changes.

Upgrade note: License text only. No API, schema, or runtime behavior changed.

2026.08.28.1

Changed: Bump @aws-sdk/* 3.1114.0 → 3.1120.0 (5 packages)

Changed: Bump @swamp/aws/ec2 2026.08.20.1 → 2026.08.28.1

Changed: Bump @swamp/aws/rds 2026.08.19.1 → 2026.08.28.1

Changed: Bump @swamp/aws/secretsmanager 2026.08.20.1 → 2026.08.28.1

2026.08.26.3

Fixed: Restored inline npm:zod@4.4.3 import specifiers so the registry quality scorer can resolve dependencies and score the extension. An earlier release used a bare "zod" import-map specifier, which published but scored as unscored.

Changed: Retained explicit compilerOptions.strict in deno.json. No behavioral or schema changes.

updated dependencies

2026.08.29.1

2026.08.29.1

Changed: Bump @aws-sdk/* 3.1120.0 → 3.1121.0. Dependency-only update; no schema, API, or behavioral changes.

2026.08.28.2

Changed: Normalized the extension license to Apache-2.0 and corrected the copyright holder to "Sean Escriva". Extensions that previously shipped an MIT LICENSE.md are now Apache-2.0, consistent with the repository root and every other extension. No code or behavioral changes.

Upgrade note: License text only. No API, schema, or runtime behavior changed.

2026.08.28.1

Changed: Bump @aws-sdk/* 3.1114.0 → 3.1120.0 (5 packages)

Changed: Bump @swamp/aws/ec2 2026.08.20.1 → 2026.08.28.1

Changed: Bump @swamp/aws/rds 2026.08.19.1 → 2026.08.28.1

Changed: Bump @swamp/aws/secretsmanager 2026.08.20.1 → 2026.08.28.1

2026.08.26.3

Fixed: Restored inline npm:zod@4.4.3 import specifiers so the registry quality scorer can resolve dependencies and score the extension. An earlier release used a bare "zod" import-map specifier, which published but scored as unscored.

Changed: Retained explicit compilerOptions.strict in deno.json. No behavioral or schema changes.

2026.08.28.2

2026.08.28.2

Changed: Normalized the extension license to Apache-2.0 and corrected the copyright holder to "Sean Escriva". Extensions that previously shipped an MIT LICENSE.md are now Apache-2.0, consistent with the repository root and every other extension. No code or behavioral changes.

Upgrade note: License text only. No API, schema, or runtime behavior changed.

2026.08.28.1

Changed: Bump @aws-sdk/* 3.1114.0 → 3.1120.0 (5 packages)

Changed: Bump @swamp/aws/ec2 2026.08.20.1 → 2026.08.28.1

Changed: Bump @swamp/aws/rds 2026.08.19.1 → 2026.08.28.1

Changed: Bump @swamp/aws/secretsmanager 2026.08.20.1 → 2026.08.28.1

2026.08.26.3

Fixed: Restored inline npm:zod@4.4.3 import specifiers so the registry quality scorer can resolve dependencies and score the extension. An earlier release used a bare "zod" import-map specifier, which published but scored as unscored.

Changed: Retained explicit compilerOptions.strict in deno.json. No behavioral or schema changes.

2026.08.28.1

2026.08.28.1

Changed: Bump @aws-sdk/* 3.1114.0 → 3.1120.0 (5 packages)

Changed: Bump @swamp/aws/ec2 2026.08.20.1 → 2026.08.28.1

Changed: Bump @swamp/aws/rds 2026.08.19.1 → 2026.08.28.1

Changed: Bump @swamp/aws/secretsmanager 2026.08.20.1 → 2026.08.28.1

2026.08.26.3

Fixed: Restored inline npm:zod@4.4.3 import specifiers so the registry quality scorer can resolve dependencies and score the extension. An earlier release used a bare "zod" import-map specifier, which published but scored as unscored.

Changed: Retained explicit compilerOptions.strict in deno.json. No behavioral or schema changes.

updated dependencies

2026.08.26.3

2026.08.26.3

Fixed: Restored inline npm:zod@4.4.3 import specifiers so the registry quality scorer can resolve dependencies and score the extension. An earlier release used a bare "zod" import-map specifier, which published but scored as unscored.

Changed: Retained explicit compilerOptions.strict in deno.json. No behavioral or schema changes.

2026.08.26.1

2026.08.26.1

Fixed: Added missing description field to upgrade entry for version 2026.08.24.2. The omission caused swamp extension pull to fail with a catalog validation error ("upgrades.N.description: Invalid input: expected string, received undefined").

2026.08.24.3

2026.08.24.3

Added: Output metadata attributes for observability.

  • durationMs: Method execution duration in milliseconds.
  • collectedBy: Extension name that produced the data.
  • fetchedAt: ISO 8601 timestamp when data was fetched (added to resources that previously lacked it).
2026.08.24.2

2026.08.24.2

Fixed: Updated stale dependency versions in README (ec2, rds, secretsmanager now reference current manifest versions).

Added: Troubleshooting section documenting the irrelevant AWS_REGION env var, MAX_PAGES = 5 truncation behavior, first-run orphan detection limits, silent resource omission for missing identifiers, and CloudFormation nested stack pagination.

2026.08.21.1

2026.08.21.1

Changed: Every AWS SDK call (EC2, RDS, Secrets Manager, CloudFormation) used to propagate its raw SDK exception with no indication of which operation was running or what it was scoped to. Failures now name the operation (e.g. DescribeVpcs, ListStackResources) and, where relevant, the region, VPC ID, or stack name, while preserving the original error message — a discovery failure now says what was being attempted instead of surfacing a bare SDK error.

region and vpcId global arguments are now validated at model-creation time (region must match AWS region shape, vpcId must match vpc-[a-f0-9]+) instead of accepting any string and failing deep inside the first API call.

2026.08.20.1

2026.08.20.1

Changed: Bump @aws-sdk/* 3.1111.0 → 3.1114.0 (5 packages)

Changed: Bump @swamp/aws/ec2 2026.08.14.1 → 2026.08.20.1

Changed: Bump @swamp/aws/rds 2026.08.15.1 → 2026.08.19.1

Changed: Bump @swamp/aws/secretsmanager 2026.08.14.1 → 2026.08.20.1

2026.08.15.1

Changed: Bump @aws-sdk/* 3.1104.0 → 3.1111.0 (5 packages)

Changed: Bump @swamp/aws/ec2 2026.08.05.1 → 2026.08.14.1

Changed: Bump @swamp/aws/rds 2026.08.05.1 → 2026.08.15.1

Changed: Bump @swamp/aws/secretsmanager 2026.08.05.1 → 2026.08.14.1

2026.08.05.1

Changed: Bump @aws-sdk/* 3.1101.0 → 3.1104.0 (5 packages)

Changed: Bump @swamp/aws/ec2 2026.08.02.1 → 2026.08.05.1

Changed: Bump @swamp/aws/rds 2026.08.02.1 → 2026.08.05.1

Changed: Bump @swamp/aws/secretsmanager 2026.08.02.1 → 2026.08.05.1

2026.08.02.1

Changed: Bump @aws-sdk/* 3.1100.0 → 3.1101.0 (5 packages)

Changed: Bump @swamp/aws/ec2 2026.07.30.1 → 2026.08.02.1

Changed: Bump @swamp/aws/rds 2026.07.30.1 → 2026.08.02.1

Changed: Bump @swamp/aws/secretsmanager 2026.07.30.1 → 2026.08.02.1

2026.08.01.1

Fixed: Broken model-upgrade chain. The prior version bump (to 2026.07.31.1) updated version but left the upgrades array terminating one step short, which blocks swamp extension push ("model upgrade chain errors"). That version never actually published — the registry was still serving 2026.07.30.1. This release closes the chain with a no-op upgrade entry and republishes everything that had accumulated since 2026.07.30.1.

2026.07.31.1

Changed: Bump @aws-sdk/* 3.1096.0 → 3.1100.0 (5 packages)

Changed: Bump @swamp/aws/ec2 2026.07.27.1 → 2026.07.30.1

Changed: Bump @swamp/aws/rds 2026.07.27.1 → 2026.07.30.1

Changed: Bump @swamp/aws/secretsmanager 2026.07.27.1 → 2026.07.30.1

2026.07.30.1

Added: Optional profile global argument for multi-account credential resolution. When set, credentials resolve via fromIni (supports SSO token cache and shared-config profiles). When omitted, the default credential chain applies as before. Fully backward compatible — no changes required for existing instances.

updated dependencies

2026.08.15.1

2026.08.15.1

Changed: Bump @aws-sdk/* 3.1104.0 → 3.1111.0 (5 packages)

Changed: Bump @swamp/aws/ec2 2026.08.05.1 → 2026.08.14.1

Changed: Bump @swamp/aws/rds 2026.08.05.1 → 2026.08.15.1

Changed: Bump @swamp/aws/secretsmanager 2026.08.05.1 → 2026.08.14.1

2026.08.05.1

Changed: Bump @aws-sdk/* 3.1101.0 → 3.1104.0 (5 packages)

Changed: Bump @swamp/aws/ec2 2026.08.02.1 → 2026.08.05.1

Changed: Bump @swamp/aws/rds 2026.08.02.1 → 2026.08.05.1

Changed: Bump @swamp/aws/secretsmanager 2026.08.02.1 → 2026.08.05.1

2026.08.02.1

Changed: Bump @aws-sdk/* 3.1100.0 → 3.1101.0 (5 packages)

Changed: Bump @swamp/aws/ec2 2026.07.30.1 → 2026.08.02.1

Changed: Bump @swamp/aws/rds 2026.07.30.1 → 2026.08.02.1

Changed: Bump @swamp/aws/secretsmanager 2026.07.30.1 → 2026.08.02.1

2026.08.01.1

Fixed: Broken model-upgrade chain. The prior version bump (to 2026.07.31.1) updated version but left the upgrades array terminating one step short, which blocks swamp extension push ("model upgrade chain errors"). That version never actually published — the registry was still serving 2026.07.30.1. This release closes the chain with a no-op upgrade entry and republishes everything that had accumulated since 2026.07.30.1.

2026.07.31.1

Changed: Bump @aws-sdk/* 3.1096.0 → 3.1100.0 (5 packages)

Changed: Bump @swamp/aws/ec2 2026.07.27.1 → 2026.07.30.1

Changed: Bump @swamp/aws/rds 2026.07.27.1 → 2026.07.30.1

Changed: Bump @swamp/aws/secretsmanager 2026.07.27.1 → 2026.07.30.1

2026.07.30.1

Added: Optional profile global argument for multi-account credential resolution. When set, credentials resolve via fromIni (supports SSO token cache and shared-config profiles). When omitted, the default credential chain applies as before. Fully backward compatible — no changes required for existing instances.

updated dependencies

07Stats
A
100 / 100
Downloads
92
Archive size
518.6 KB
  • Has README or module doc2/2earned
  • README has a code example1/1earned
  • README is substantive1/1earned
  • Most symbols documented1/1earned
  • No slow types (deprecated)1/1earned
  • Dependencies pass trust audit2/2earned
  • Has description1/1earned
  • Platform support declared (or universal)2/2earned
  • License2/2earned
  • Verified public repository2/2earned
Repository
https://github.com/webframp/swamp-extensions
08Platforms
09Labels
#aws#adoption#brownfield#import#infrastructure#iac