Elasticache Datastore Bootstrap

2026.08.27.1

Changed: Test suite now builds its method context from the shared createModelTestContext factory in @systeminit/swamp-testing instead of a hand-rolled context, wrapping writeResource to preserve the existing assertion API. No behavioral, schema, or method changes — the published provisioner is unchanged. The deno.json gains a dev-only @systeminit/swamp-testing import-map entry and its check task now type-checks the test file.

2026.08.26.3

Fixed: Restored inline npm:zod@4.4.3 import specifiers so the registry quality scorer can resolve dependencies and score the extension. An earlier release used a bare "zod" import-map specifier, which published but scored as unscored.

Changed: Retained explicit compilerOptions.strict in deno.json. No behavioral or schema changes.

2026.08.26.3

Fixed: Restored inline npm:zod@4.4.3 import specifiers so the registry quality scorer can resolve dependencies and score the extension. An earlier release used a bare "zod" import-map specifier, which published but scored as unscored.

Changed: Retained explicit compilerOptions.strict in deno.json. No behavioral or schema changes.

2026.08.26.1

Changed: Normalized deno.json configuration for repo-wide consistency: added explicit compilerOptions.strict and migrated zod dependency to the import map (bare "zod" specifier instead of inline npm:zod@4.4.3). No behavioral changes — runtime resolution is identical.

2026.08.24.1

Added: Output metadata attributes for observability.

• durationMs: Method execution duration in milliseconds.
• collectedBy: Extension name that produced the data.
• fetchedAt: ISO 8601 timestamp when data was fetched (added to resources that previously lacked it).

2026.08.23.1

Fixed: README's Development section referenced a nonexistent valkey-datastore-bootstrap directory; corrected to elasticache-datastore-bootstrap.

Changed: Documentation only — no code changes otherwise. Added a ## Troubleshooting section covering the multiple-default-VPC error, the create-failed/deleting/deleted terminal-state branches in waitForCacheAvailable, the self-healing ingress-rule check in ensureSecurityGroup that silently reopens port 6379 to the VPC CIDR on re-run, and divergent securityGroupId reporting when reusing a cache created with a different security group.

2026.08.02.1

Fixed: The configure job in @webframp/bootstrap-elasticache-datastore failed with Invalid expression: No such key: attributes. The workflow queried data.latest("swamp-valkey-provisioner", "state"), but the provisioner writes its resource under the instance name "main" (via writeResource("state", "main", ...)) — data.latest()'s second argument matches the resource's instance name, not its spec name. The configure job now queries data.latest("swamp-valkey-provisioner", "main"), which resolves correctly.

Changed: The run-setup step now passes the provisioner's datastoreConfig through a DATASTORE_CONFIG environment variable instead of interpolating it directly into a single-quoted shell string. The prior pattern could allow a config value containing a single quote to break out of shell quoting.

Upgrade note: No action needed beyond swamp extension pull — the workflow file is re-pulled with the extension.

2026.07.27.1

Fixed: The fmt task ran deno fmt --check, so deno task fmt verified formatting instead of applying it and there was no way to format the extension through its own task. fmt now formats and a new fmt:check verifies, matching every other extension in the repository.

Fixed: deno fmt no longer inspects CLAUDE.md / AGENTS.md. Those files are gitignored and never present in CI, but deno fmt does not read .gitignore, so deno task fmt:check could fail locally on a file CI does not have.

Upgrade note: Tooling and formatting only. No model, method, schema, or behavior change — nothing to do on upgrade.

2026.07.23.1

Added: Initial release of @webframp/elasticache-datastore-bootstrap — one-shot provisioner for AWS ElastiCache Serverless (Valkey engine) targeting @webframp/valkey-datastore.

Creates an ElastiCache Serverless cache with TLS, a VPC security group (TCP/6379 from VPC CIDR), and a least-privilege IAM managed policy, then configures the swamp repo datastore via a two-job workflow.

Fixed:

• Subnet IDs from user input are validated per-element against /^subnet-[a-f0-9]+$/ after split, preventing CLI argument injection
• key_prefix constrained to max 64 chars and safe characters only ([a-zA-Z0-9_\-:.]) — prevents shell injection via workflow template
• --policy-document values are redacted from AWS CLI error messages to avoid leaking ARNs and account IDs in logs
• waitForCacheAvailable throws immediately when cache returns null (deleted mid-wait) or enters deleting/deleted terminal state
• getDefaultVpcId throws if multiple default VPCs found, requiring explicit vpc_id
• Idempotency path waits for cache availability when re-running against a cache in creating state, preventing broken endpoint URLs
• describeServerlessCache only swallows ServerlessCacheNotFoundFault — other errors propagate correctly
• ensureSecurityGroup verifies port 6379/tcp ingress on reused security groups and adds it if missing
• getSubnetIds validates filtered subnet IDs are non-empty
• security_group_name schema rejects commas to prevent tag argument injection
• Empty cache ARN or endpoint address throws immediately instead of producing malformed output