Extension Maintenance
Extension repository maintenance model. Observes a multi-extension repo, audits dependency freshness (npm, swamp-testing, manifest pins), computes quality scores, plans version bumps, and applies changes with human approval.
Designed for repos publishing many swamp extensions via CI. Replaces the manual audit → bump → test → PR loop with typed, observable methods.
Usage
swamp extension pull @webframp/extension-maintenance
swamp model create @webframp/extension-maintenance/maintainer ext-maint \
--global-arg repo_root=/path/to/extensions
# Observe
swamp model method run ext-maint audit
# Plan (human reviews output)
swamp model method run ext-maint plan-bump
# Apply (writes files)
swamp model method run ext-maint apply-bump
# Verify
swamp model method run ext-maint quality-gateOr run the whole sweep as one workflow, with the approval gate between plan and apply:
swamp workflow run @webframp/extension-maintenance-sweep2026.10.22.1
Fixed: Existing definitions created against an earlier version were stranded
on upgrade. The model shipped new versions without a corresponding upgrades
chain, so swamp could not migrate a definition's typeVersion and logged a
warning that global arguments would not be migrated. This release backfills the
full upgrade chain through every shipped version and terminates it at the
current version, so stale definitions migrate cleanly. The transform is identity
— no stored global argument value changes.
Changed: The chain records the addition of the min_dependency_age_hours
global argument (default 24) and additive optional report fields. Existing
ext-maint definitions keep their configured arguments; the new argument takes
its schema default.
Upgrade note: No action required. On the next method run, each existing
definition's typeVersion advances to 2026.10.22.1 with its global arguments
preserved.
2026.10.14.1
Added: The manifest now declares license: Apache-2.0 (SPDX). The registry
quality rubric scores a declared license separately from the bundled
LICENSE.md.
Upgrade note: Metadata only. No code, schema, or behavioral changes.
2026.09.24.1
Fixed: Audit no longer plans npm or JSR versions newer than Deno's minimum
dependency age. It reports the newest release published at least
min_dependency_age_hours ago (new global argument, default 24). Before, the
2026-09-24 sweep pinned @aws-sdk/* 3.1140.0 hours after release;
swamp extension quality rejected it in CI across 21 extensions. A pin newer
than that version is no longer reported as stale, and unpublished or deprecated
npm versions are never picked. Manifest pins compare numerically too, so audit
never plans a downgrade.
Fixed: apply-bump appends upgrade entries correctly to compact
upgrades: [{ ... }, { ... }] arrays. The old splice landed inside the last
element and produced a syntax error. Comments and strings no longer steer the
insert, and an insert that would not parse is reported and never written.
Changed: apply-bump fails after writing current-apply when any extension
recorded an error, including a failed deno.lock regeneration. It used to
succeed, so the sweep workflow reported success over half-written lockfiles. The
workflow's verify step still runs afterwards to snapshot the repo.
Changed: quality-gate fails an extension that misses CI's quality verdict
(status passed, 100%, allPassed not false). It used to record the score
only.
Changed: Local deno cache and deno task runs ignore the minimum
dependency age (--minimum-dependency-age=0, NPM_CONFIG_MIN_RELEASE_AGE=0).
The gate's swamp extension quality check still enforces it, matching CI.
Upgrade note: The only new global argument, min_dependency_age_hours, has
a default, so existing instances need no change. The model has no upgrades:
array, so no migration entry is required.
Resources
Routine dependency-maintenance sweep across every extension in the repo: observe staleness, plan CalVer bumps, gate on human approval, apply, then verify with the quality gate. Replaces the manual four-command loop: swamp model method run ext-maint audit swamp model method run ext-maint plan-bump swamp model method run ext-maint apply-bump swamp model method run ext-maint quality-gate Requires an @webframp/extension-maintenance/maintainer instance named `ext-maint`, with repo_root poin
2026.10.14.1
Added: The manifest now declares license: Apache-2.0 (SPDX). The registry
quality rubric scores a declared license separately from the bundled
LICENSE.md.
Upgrade note: Metadata only. No code, schema, or behavioral changes.
2026.09.24.1
Fixed: Audit no longer plans npm or JSR versions newer than Deno's minimum
dependency age. It reports the newest release published at least
min_dependency_age_hours ago (new global argument, default 24). Before, the
2026-09-24 sweep pinned @aws-sdk/* 3.1140.0 hours after release;
swamp extension quality rejected it in CI across 21 extensions. A pin newer
than that version is no longer reported as stale, and unpublished or deprecated
npm versions are never picked. Manifest pins compare numerically too, so audit
never plans a downgrade.
Fixed: apply-bump appends upgrade entries correctly to compact
upgrades: [{ ... }, { ... }] arrays. The old splice landed inside the last
element and produced a syntax error. Comments and strings no longer steer the
insert, and an insert that would not parse is reported and never written.
Changed: apply-bump fails after writing current-apply when any extension
recorded an error, including a failed deno.lock regeneration. It used to
succeed, so the sweep workflow reported success over half-written lockfiles. The
workflow's verify step still runs afterwards to snapshot the repo.
Changed: quality-gate fails an extension that misses CI's quality verdict
(status passed, 100%, allPassed not false). It used to record the score
only.
Changed: Local deno cache and deno task runs ignore the minimum
dependency age (--minimum-dependency-age=0, NPM_CONFIG_MIN_RELEASE_AGE=0).
The gate's swamp extension quality check still enforces it, matching CI.
Upgrade note: The only new global argument, min_dependency_age_hours, has
a default, so existing instances need no change. The model has no upgrades:
array, so no migration entry is required.
Modified 1 behaviors
2026.09.24.1
Fixed: Audit no longer plans npm or JSR versions newer than Deno's minimum
dependency age. It reports the newest release published at least
min_dependency_age_hours ago (new global argument, default 24). Before, the
2026-09-24 sweep pinned @aws-sdk/* 3.1140.0 hours after release;
swamp extension quality rejected it in CI across 21 extensions. A pin newer
than that version is no longer reported as stale, and unpublished or deprecated
npm versions are never picked. Manifest pins compare numerically too, so audit
never plans a downgrade.
Fixed: apply-bump appends upgrade entries correctly to compact
upgrades: [{ ... }, { ... }] arrays. The old splice landed inside the last
element and produced a syntax error. Comments and strings no longer steer the
insert, and an insert that would not parse is reported and never written.
Changed: apply-bump fails after writing current-apply when any extension
recorded an error, including a failed deno.lock regeneration. It used to
succeed, so the sweep workflow reported success over half-written lockfiles. The
workflow's verify step still runs afterwards to snapshot the repo.
Changed: quality-gate fails an extension that misses CI's quality verdict
(status passed, 100%, allPassed not false). It used to record the score
only.
Changed: Local deno cache and deno task runs ignore the minimum
dependency age (--minimum-dependency-age=0, NPM_CONFIG_MIN_RELEASE_AGE=0).
The gate's swamp extension quality check still enforces it, matching CI.
Upgrade note: The only new global argument, min_dependency_age_hours, has
a default, so existing instances need no change. The model has no upgrades:
array, so no migration entry is required.
2026.09.19.1
Changed: The dependency audit now recognizes the @swamp-club/swamp-testing
JSR package instead of the deprecated @systeminit/swamp-testing scope. Swamp
core renamed the testing SDK scope; the old alias is being retired upstream. The
readTestingVersion lookup, the JSR latest-version query, and the reported
dependency name all move to the new scope. Auditing a repo still pinned to the
old scope will now report the testing dependency as absent — repin to
@swamp-club/swamp-testing to restore the audit.
Upgrade note: No model schema, method, resource, or global-argument change.
The model has no upgrades: array, so no migration entry is required.
2026.09.18.1
Upgrade note: Normalized npm:zod dependency version to 4.6.5 across the
repo. No behavioral changes in this extension.
2026.09.15.1
Changed: Bump zod 4.4.3 → 4.6.5
2026.08.28.3
Added: The audit method now detects two more classes of repo-wide drift.
pinDrift flags any extension pinning an npm package to a version differing
from the repo-wide consensus (the modal version across all extensions) — this
catches inconsistency even when the pin is not stale. metadataCoverage flags
observation-model extensions missing any of the standard output-metadata fields
(durationMs, collectedBy, fetchedAt) introduced in #386.
Added: Two new categories counts in the audit summary — pinDrift and
metadataGaps — and two new per-extension fields, pinDrift and
metadataCoverage. Exported computeModalPins and checkMetadataCoverage for
unit testing.
Upgrade note: The audit resource schema gained required fields. A
current-audit resource stored by an older version will fail validation on
read; re-run audit to regenerate it. Audit snapshots are ephemeral
observations and are not migrated. No model-instance schema changed. Detection
is heuristic (string-based, consistent with the rest of the audit) and is a
signal for human review, not a hard gate — plan-bump/apply-bump behavior is
unchanged.
2026.08.28.2
Fixed: The sweep no longer corrupts model upgrade chains. Previously
plan-bump emitted a toVersion: "<old>" → "<new>" find/replace that
relabelled the last existing upgrade entry in place, destroying the prior
version's migration step and attaching its description to the wrong version. It
passed the shallow chain check only because the last toVersion still equalled
the model version. apply-bump now APPENDS a new no-op upgrade entry (identity
upgradeAttributes) to every model upgrades: array instead, leaving prior
entries intact.
Fixed: The sweep now updates exact-literal test version assertions. Tests of
the form assertEquals(model.version, "<old>") were left pointing at the old
version, breaking deno test after a bump (as happened to the 5
*-datastore-bootstrap extensions in the license sweep). plan-bump now emits
a test-assertion change for each distinct asserted literal. Pattern-based
assertions (assertMatch(model.version, /regex/)) carry no literal and are
untouched.
Added: checkUpgradeChain now detects the relabel anti-pattern. When given
the version a bump came from, it errors if that previous shipped version's chain
entry is missing — catching an in-place relabel even though the last toVersion
matches the model version.
Added: BumpPlanEntry.upgradeInserts (structured append instructions) and a
test-assertion change category.
Upgrade note: Behavior of the maintenance sweep only. This tool must never be used for a schema-changing bump — the appended migration is identity and would silently fail to migrate stored data. Dependency and license bumps (its only purpose) never change data shape.
2026.08.28.1
Changed: Normalized the extension license to Apache-2.0 and corrected the copyright holder to "Sean Escriva". Extensions that previously shipped an MIT LICENSE.md are now Apache-2.0, consistent with the repository root and every other extension. No code or behavioral changes.
Upgrade note: License text only. No API, schema, or runtime behavior changed.
2026.08.26.3
Fixed: Restored inline npm:zod@4.4.3 import specifiers so the registry
quality scorer can resolve dependencies and score the extension. An earlier
release used a bare "zod" import-map specifier, which published but scored as
unscored.
Changed: Retained explicit compilerOptions.strict in deno.json. No
behavioral or schema changes.
2026.08.28.3
Added: The audit method now detects two more classes of repo-wide drift.
pinDrift flags any extension pinning an npm package to a version differing
from the repo-wide consensus (the modal version across all extensions) — this
catches inconsistency even when the pin is not stale. metadataCoverage flags
observation-model extensions missing any of the standard output-metadata fields
(durationMs, collectedBy, fetchedAt) introduced in #386.
Added: Two new categories counts in the audit summary — pinDrift and
metadataGaps — and two new per-extension fields, pinDrift and
metadataCoverage. Exported computeModalPins and checkMetadataCoverage for
unit testing.
Upgrade note: The audit resource schema gained required fields. A
current-audit resource stored by an older version will fail validation on
read; re-run audit to regenerate it. Audit snapshots are ephemeral
observations and are not migrated. No model-instance schema changed. Detection
is heuristic (string-based, consistent with the rest of the audit) and is a
signal for human review, not a hard gate — plan-bump/apply-bump behavior is
unchanged.
2026.08.28.2
Fixed: The sweep no longer corrupts model upgrade chains. Previously
plan-bump emitted a toVersion: "<old>" → "<new>" find/replace that
relabelled the last existing upgrade entry in place, destroying the prior
version's migration step and attaching its description to the wrong version. It
passed the shallow chain check only because the last toVersion still equalled
the model version. apply-bump now APPENDS a new no-op upgrade entry (identity
upgradeAttributes) to every model upgrades: array instead, leaving prior
entries intact.
Fixed: The sweep now updates exact-literal test version assertions. Tests of
the form assertEquals(model.version, "<old>") were left pointing at the old
version, breaking deno test after a bump (as happened to the 5
*-datastore-bootstrap extensions in the license sweep). plan-bump now emits
a test-assertion change for each distinct asserted literal. Pattern-based
assertions (assertMatch(model.version, /regex/)) carry no literal and are
untouched.
Added: checkUpgradeChain now detects the relabel anti-pattern. When given
the version a bump came from, it errors if that previous shipped version's chain
entry is missing — catching an in-place relabel even though the last toVersion
matches the model version.
Added: BumpPlanEntry.upgradeInserts (structured append instructions) and a
test-assertion change category.
Upgrade note: Behavior of the maintenance sweep only. This tool must never be used for a schema-changing bump — the appended migration is identity and would silently fail to migrate stored data. Dependency and license bumps (its only purpose) never change data shape.
2026.08.28.1
Changed: Normalized the extension license to Apache-2.0 and corrected the copyright holder to "Sean Escriva". Extensions that previously shipped an MIT LICENSE.md are now Apache-2.0, consistent with the repository root and every other extension. No code or behavioral changes.
Upgrade note: License text only. No API, schema, or runtime behavior changed.
2026.08.26.3
Fixed: Restored inline npm:zod@4.4.3 import specifiers so the registry
quality scorer can resolve dependencies and score the extension. An earlier
release used a bare "zod" import-map specifier, which published but scored as
unscored.
Changed: Retained explicit compilerOptions.strict in deno.json. No
behavioral or schema changes.
2026.08.28.2
Fixed: The sweep no longer corrupts model upgrade chains. Previously
plan-bump emitted a toVersion: "<old>" → "<new>" find/replace that
relabelled the last existing upgrade entry in place, destroying the prior
version's migration step and attaching its description to the wrong version. It
passed the shallow chain check only because the last toVersion still equalled
the model version. apply-bump now APPENDS a new no-op upgrade entry (identity
upgradeAttributes) to every model upgrades: array instead, leaving prior
entries intact.
Fixed: The sweep now updates exact-literal test version assertions. Tests of
the form assertEquals(model.version, "<old>") were left pointing at the old
version, breaking deno test after a bump (as happened to the 5
*-datastore-bootstrap extensions in the license sweep). plan-bump now emits
a test-assertion change for each distinct asserted literal. Pattern-based
assertions (assertMatch(model.version, /regex/)) carry no literal and are
untouched.
Added: checkUpgradeChain now detects the relabel anti-pattern. When given
the version a bump came from, it errors if that previous shipped version's chain
entry is missing — catching an in-place relabel even though the last toVersion
matches the model version.
Added: BumpPlanEntry.upgradeInserts (structured append instructions) and a
test-assertion change category.
Upgrade note: Behavior of the maintenance sweep only. This tool must never be used for a schema-changing bump — the appended migration is identity and would silently fail to migrate stored data. Dependency and license bumps (its only purpose) never change data shape.
2026.08.28.1
Changed: Normalized the extension license to Apache-2.0 and corrected the copyright holder to "Sean Escriva". Extensions that previously shipped an MIT LICENSE.md are now Apache-2.0, consistent with the repository root and every other extension. No code or behavioral changes.
Upgrade note: License text only. No API, schema, or runtime behavior changed.
2026.08.26.3
Fixed: Restored inline npm:zod@4.4.3 import specifiers so the registry
quality scorer can resolve dependencies and score the extension. An earlier
release used a bare "zod" import-map specifier, which published but scored as
unscored.
Changed: Retained explicit compilerOptions.strict in deno.json. No
behavioral or schema changes.
2026.08.28.1
Changed: Normalized the extension license to Apache-2.0 and corrected the copyright holder to "Sean Escriva". Extensions that previously shipped an MIT LICENSE.md are now Apache-2.0, consistent with the repository root and every other extension. No code or behavioral changes.
Upgrade note: License text only. No API, schema, or runtime behavior changed.
2026.08.26.3
Fixed: Restored inline npm:zod@4.4.3 import specifiers so the registry
quality scorer can resolve dependencies and score the extension. An earlier
release used a bare "zod" import-map specifier, which published but scored as
unscored.
Changed: Retained explicit compilerOptions.strict in deno.json. No
behavioral or schema changes.
2026.08.26.3
Fixed: Restored inline npm:zod@4.4.3 import specifiers so the registry
quality scorer can resolve dependencies and score the extension. An earlier
release used a bare "zod" import-map specifier, which published but scored as
unscored.
Changed: Retained explicit compilerOptions.strict in deno.json. No
behavioral or schema changes.
2026.08.26.1
Changed: Normalized deno.json configuration for repo-wide consistency:
added explicit compilerOptions.strict and migrated zod dependency to the
import map (bare "zod" specifier instead of inline npm:zod@4.4.3). No
behavioral changes — runtime resolution is identical.
2026.08.24.2
Added: Output metadata attributes for observability.
durationMs: Method execution duration in milliseconds.collectedBy: Extension name that produced the data.fetchedAt: ISO 8601 timestamp when data was fetched (added to resources that previously lacked it).
2026.08.24.1
Added Troubleshooting section documenting strict audit/plan/apply ordering, registry-unavailability false negatives, per-extension apply resilience, registry_timeout arg, and quality-gate fmt side effect.
2026.08.21.2
Changed: quality-gate failures now include the actual command output.
Previously a failing deno task check/lint/fmt/test or
swamp extension fmt --check only recorded a bare "check failed" / "lint
failed" style message with no indication of what broke; the errors array now
embeds a truncated snippet of the command's stderr (or stdout when stderr is
empty) so you can diagnose a failure from the quality report alone.
apply-bump's deno cache regeneration failure message now includes the
deno cache stderr output instead of a generic "may be out of sync" note.
2026.08.21.1
Changed: Added .describe() documentation to previously undocumented schema
fields: the extensions array in AuditSummarySchema, the changes[].category
enum and entries array in the bump-plan schemas, and the error/result fields
in ApplyResultSchema and QualityResultSchema. No behavioral change.
2026.08.15.1
Fixed: Restore comment line in maintainer.ts truncated by apply-bump's
over-broad version regex (matched @opentelemetry/api@1.9.1 inside a code
comment and stripped trailing text).
2026.08.06.1
Fixed: plan-bump no longer assumes that source file version strings match
manifest.yaml. It now reads the actual version: fields from .ts source
files via a new readSourceVersions helper and emits find/replace patterns for
each distinct version found. This fixes silent no-ops during apply-bump when a
prior partial bump left source and manifest versions out of sync (as happened
with agentcore-bootstrap/provisioner.ts in the 2026.08.05 sweep).
Fixed: checkUpgradeChain now cross-validates that each source file's model
version matches the manifest version. Previously it only checked internal
consistency (last toVersion == version: within the same file), so a file
whose version drifted from the manifest passed silently. Both apply-bump and
quality-gate now pass the expected manifest version to catch this class of
mismatch.
2026.08.01.1
Fixed: apply-bump now self-verifies the upgrade chain it just wrote before
counting an extension as bumped. The plan-bump fix from 2026.07.29 (it adds
the matching toVersion alongside a version bump) only helps when
apply-bump runs through the full extension-maintenance-sweep workflow, whose
verify step calls quality-gate. Two sweeps since then were run as ad-hoc
audit → plan-bump → apply-bump invocations that skipped verify entirely,
so a broken chain shipped undetected both times — 19 extensions after the
2026.07.27.1 sweep, then 21 more after the AWS SDK bump on 2026.07.31.
apply-bump now runs the same checkUpgradeChain check quality-gate uses
immediately after writing each extension's files, so a broken chain is caught
and reported in current-apply even when verify never runs.
2026.07.31.1
Changed: Bump @aws-sdk/credential-providers 3.1096.0 → 3.1100.0
2026.07.27.4
Fixed: apply-bump lockfile regeneration now uses deno cache on all
source files instead of deno install. The previous approach only resolved
specifiers declared in the deno.json import map, leaving direct specifiers
(like npm:@opentelemetry/api@1.9.1) unresolved in the lockfile. CI would then
fail on lock-check because the lockfile still referenced the old version.
2026.07.27.3
Fixed: apply-bump now prepends the new release notes entry to
RELEASE_NOTES.md instead of overwriting it. Previous versions discarded the
entire changelog history, replacing it with only the current bump's entry.
2026.07.27.2
Fixed: apply-bump now includes *_test.ts files when expanding glob
patterns for find-and-replace. Previously the glob expansion excluded test
files, so a dependency bump in production source would leave the same import at
the old version in tests — causing duplicate-singleton bugs (e.g.
OpenTelemetry's global registry keyed per module instance).
The audit method's extractNpmImports still excludes test files when
determining which deps are stale (test-only deps don't drive bumps), but once
a bump plan exists, apply-bump replaces all occurrences of the stale version
string regardless of whether the file is a test.
2026.07.27.1
Fixed: The fmt task ran deno fmt --check, so deno task fmt verified
formatting instead of applying it and there was no way to format the extension
through its own task. fmt now formats and a new fmt:check verifies, matching
every other extension in the repository.
Fixed: deno fmt no longer inspects CLAUDE.md / AGENTS.md. Those files
are gitignored and never present in CI, but deno fmt does not read .gitignore,
so deno task fmt:check could fail locally on a file CI does not have.
Upgrade note: Tooling and formatting only. No model, method, schema, or behavior change — nothing to do on upgrade.
2026.08.21.1
Changed: Added .describe() documentation to previously undocumented schema
fields: the extensions array in AuditSummarySchema, the changes[].category
enum and entries array in the bump-plan schemas, and the error/result fields
in ApplyResultSchema and QualityResultSchema. No behavioral change.
2026.08.15.1
Fixed: Restore comment line in maintainer.ts truncated by apply-bump's
over-broad version regex (matched @opentelemetry/api@1.9.1 inside a code
comment and stripped trailing text).
2026.08.06.1
Fixed: plan-bump no longer assumes that source file version strings match
manifest.yaml. It now reads the actual version: fields from .ts source
files via a new readSourceVersions helper and emits find/replace patterns for
each distinct version found. This fixes silent no-ops during apply-bump when a
prior partial bump left source and manifest versions out of sync (as happened
with agentcore-bootstrap/provisioner.ts in the 2026.08.05 sweep).
Fixed: checkUpgradeChain now cross-validates that each source file's model
version matches the manifest version. Previously it only checked internal
consistency (last toVersion == version: within the same file), so a file
whose version drifted from the manifest passed silently. Both apply-bump and
quality-gate now pass the expected manifest version to catch this class of
mismatch.
2026.08.01.1
Fixed: apply-bump now self-verifies the upgrade chain it just wrote before
counting an extension as bumped. The plan-bump fix from 2026.07.29 (it adds
the matching toVersion alongside a version bump) only helps when
apply-bump runs through the full extension-maintenance-sweep workflow, whose
verify step calls quality-gate. Two sweeps since then were run as ad-hoc
audit → plan-bump → apply-bump invocations that skipped verify entirely,
so a broken chain shipped undetected both times — 19 extensions after the
2026.07.27.1 sweep, then 21 more after the AWS SDK bump on 2026.07.31.
apply-bump now runs the same checkUpgradeChain check quality-gate uses
immediately after writing each extension's files, so a broken chain is caught
and reported in current-apply even when verify never runs.
2026.07.31.1
Changed: Bump @aws-sdk/credential-providers 3.1096.0 → 3.1100.0
2026.07.27.4
Fixed: apply-bump lockfile regeneration now uses deno cache on all
source files instead of deno install. The previous approach only resolved
specifiers declared in the deno.json import map, leaving direct specifiers
(like npm:@opentelemetry/api@1.9.1) unresolved in the lockfile. CI would then
fail on lock-check because the lockfile still referenced the old version.
2026.07.27.3
Fixed: apply-bump now prepends the new release notes entry to
RELEASE_NOTES.md instead of overwriting it. Previous versions discarded the
entire changelog history, replacing it with only the current bump's entry.
2026.07.27.2
Fixed: apply-bump now includes *_test.ts files when expanding glob
patterns for find-and-replace. Previously the glob expansion excluded test
files, so a dependency bump in production source would leave the same import at
the old version in tests — causing duplicate-singleton bugs (e.g.
OpenTelemetry's global registry keyed per module instance).
The audit method's extractNpmImports still excludes test files when
determining which deps are stale (test-only deps don't drive bumps), but once
a bump plan exists, apply-bump replaces all occurrences of the stale version
string regardless of whether the file is a test.
2026.07.27.1
Fixed: The fmt task ran deno fmt --check, so deno task fmt verified
formatting instead of applying it and there was no way to format the extension
through its own task. fmt now formats and a new fmt:check verifies, matching
every other extension in the repository.
Fixed: deno fmt no longer inspects CLAUDE.md / AGENTS.md. Those files
are gitignored and never present in CI, but deno fmt does not read .gitignore,
so deno task fmt:check could fail locally on a file CI does not have.
Upgrade note: Tooling and formatting only. No model, method, schema, or behavior change — nothing to do on upgrade.
2026.08.15.1
Changed: Bump @opentelemetry/api 1.9.1`) that bypass → 1.9.1
2026.08.06.1
Fixed: plan-bump no longer assumes that source file version strings match
manifest.yaml. It now reads the actual version: fields from .ts source
files via a new readSourceVersions helper and emits find/replace patterns for
each distinct version found. This fixes silent no-ops during apply-bump when a
prior partial bump left source and manifest versions out of sync (as happened
with agentcore-bootstrap/provisioner.ts in the 2026.08.05 sweep).
Fixed: checkUpgradeChain now cross-validates that each source file's model
version matches the manifest version. Previously it only checked internal
consistency (last toVersion == version: within the same file), so a file
whose version drifted from the manifest passed silently. Both apply-bump and
quality-gate now pass the expected manifest version to catch this class of
mismatch.
2026.08.01.1
Fixed: apply-bump now self-verifies the upgrade chain it just wrote before
counting an extension as bumped. The plan-bump fix from 2026.07.29 (it adds
the matching toVersion alongside a version bump) only helps when
apply-bump runs through the full extension-maintenance-sweep workflow, whose
verify step calls quality-gate. Two sweeps since then were run as ad-hoc
audit → plan-bump → apply-bump invocations that skipped verify entirely,
so a broken chain shipped undetected both times — 19 extensions after the
2026.07.27.1 sweep, then 21 more after the AWS SDK bump on 2026.07.31.
apply-bump now runs the same checkUpgradeChain check quality-gate uses
immediately after writing each extension's files, so a broken chain is caught
and reported in current-apply even when verify never runs.
2026.07.31.1
Changed: Bump @aws-sdk/credential-providers 3.1096.0 → 3.1100.0
2026.07.27.4
Fixed: apply-bump lockfile regeneration now uses deno cache on all
source files instead of deno install. The previous approach only resolved
specifiers declared in the deno.json import map, leaving direct specifiers
(like npm:@opentelemetry/api@1.9.1) unresolved in the lockfile. CI would then
fail on lock-check because the lockfile still referenced the old version.
2026.07.27.3
Fixed: apply-bump now prepends the new release notes entry to
RELEASE_NOTES.md instead of overwriting it. Previous versions discarded the
entire changelog history, replacing it with only the current bump's entry.
2026.07.27.2
Fixed: apply-bump now includes *_test.ts files when expanding glob
patterns for find-and-replace. Previously the glob expansion excluded test
files, so a dependency bump in production source would leave the same import at
the old version in tests — causing duplicate-singleton bugs (e.g.
OpenTelemetry's global registry keyed per module instance).
The audit method's extractNpmImports still excludes test files when
determining which deps are stale (test-only deps don't drive bumps), but once
a bump plan exists, apply-bump replaces all occurrences of the stale version
string regardless of whether the file is a test.
2026.07.27.1
Fixed: The fmt task ran deno fmt --check, so deno task fmt verified
formatting instead of applying it and there was no way to format the extension
through its own task. fmt now formats and a new fmt:check verifies, matching
every other extension in the repository.
Fixed: deno fmt no longer inspects CLAUDE.md / AGENTS.md. Those files
are gitignored and never present in CI, but deno fmt does not read .gitignore,
so deno task fmt:check could fail locally on a file CI does not have.
Upgrade note: Tooling and formatting only. No model, method, schema, or behavior change — nothing to do on upgrade.
2026.08.06.1
Fixed: plan-bump no longer assumes that source file version strings match
manifest.yaml. It now reads the actual version: fields from .ts source
files via a new readSourceVersions helper and emits find/replace patterns for
each distinct version found. This fixes silent no-ops during apply-bump when a
prior partial bump left source and manifest versions out of sync (as happened
with agentcore-bootstrap/provisioner.ts in the 2026.08.05 sweep).
Fixed: checkUpgradeChain now cross-validates that each source file's model
version matches the manifest version. Previously it only checked internal
consistency (last toVersion == version: within the same file), so a file
whose version drifted from the manifest passed silently. Both apply-bump and
quality-gate now pass the expected manifest version to catch this class of
mismatch.
2026.08.01.1
Fixed: apply-bump now self-verifies the upgrade chain it just wrote before
counting an extension as bumped. The plan-bump fix from 2026.07.29 (it adds
the matching toVersion alongside a version bump) only helps when
apply-bump runs through the full extension-maintenance-sweep workflow, whose
verify step calls quality-gate. Two sweeps since then were run as ad-hoc
audit → plan-bump → apply-bump invocations that skipped verify entirely,
so a broken chain shipped undetected both times — 19 extensions after the
2026.07.27.1 sweep, then 21 more after the AWS SDK bump on 2026.07.31.
apply-bump now runs the same checkUpgradeChain check quality-gate uses
immediately after writing each extension's files, so a broken chain is caught
and reported in current-apply even when verify never runs.
2026.07.31.1
Changed: Bump @aws-sdk/credential-providers 3.1096.0 → 3.1100.0
2026.07.27.4
Fixed: apply-bump lockfile regeneration now uses deno cache on all
source files instead of deno install. The previous approach only resolved
specifiers declared in the deno.json import map, leaving direct specifiers
(like npm:@opentelemetry/api@1.9.1) unresolved in the lockfile. CI would then
fail on lock-check because the lockfile still referenced the old version.
2026.07.27.3
Fixed: apply-bump now prepends the new release notes entry to
RELEASE_NOTES.md instead of overwriting it. Previous versions discarded the
entire changelog history, replacing it with only the current bump's entry.
2026.07.27.2
Fixed: apply-bump now includes *_test.ts files when expanding glob
patterns for find-and-replace. Previously the glob expansion excluded test
files, so a dependency bump in production source would leave the same import at
the old version in tests — causing duplicate-singleton bugs (e.g.
OpenTelemetry's global registry keyed per module instance).
The audit method's extractNpmImports still excludes test files when
determining which deps are stale (test-only deps don't drive bumps), but once
a bump plan exists, apply-bump replaces all occurrences of the stale version
string regardless of whether the file is a test.
2026.07.27.1
Fixed: The fmt task ran deno fmt --check, so deno task fmt verified
formatting instead of applying it and there was no way to format the extension
through its own task. fmt now formats and a new fmt:check verifies, matching
every other extension in the repository.
Fixed: deno fmt no longer inspects CLAUDE.md / AGENTS.md. Those files
are gitignored and never present in CI, but deno fmt does not read .gitignore,
so deno task fmt:check could fail locally on a file CI does not have.
Upgrade note: Tooling and formatting only. No model, method, schema, or behavior change — nothing to do on upgrade.
2026.08.01.1
Fixed: apply-bump now self-verifies the upgrade chain it just wrote before
counting an extension as bumped. The plan-bump fix from 2026.07.29 (it adds
the matching toVersion alongside a version bump) only helps when
apply-bump runs through the full extension-maintenance-sweep workflow, whose
verify step calls quality-gate. Two sweeps since then were run as ad-hoc
audit → plan-bump → apply-bump invocations that skipped verify entirely,
so a broken chain shipped undetected both times — 19 extensions after the
2026.07.27.1 sweep, then 21 more after the AWS SDK bump on 2026.07.31.
apply-bump now runs the same checkUpgradeChain check quality-gate uses
immediately after writing each extension's files, so a broken chain is caught
and reported in current-apply even when verify never runs.
2026.07.31.1
Changed: Bump @aws-sdk/credential-providers 3.1096.0 → 3.1100.0
2026.07.27.4
Fixed: apply-bump lockfile regeneration now uses deno cache on all
source files instead of deno install. The previous approach only resolved
specifiers declared in the deno.json import map, leaving direct specifiers
(like npm:@opentelemetry/api@1.9.1) unresolved in the lockfile. CI would then
fail on lock-check because the lockfile still referenced the old version.
2026.07.27.3
Fixed: apply-bump now prepends the new release notes entry to
RELEASE_NOTES.md instead of overwriting it. Previous versions discarded the
entire changelog history, replacing it with only the current bump's entry.
2026.07.27.2
Fixed: apply-bump now includes *_test.ts files when expanding glob
patterns for find-and-replace. Previously the glob expansion excluded test
files, so a dependency bump in production source would leave the same import at
the old version in tests — causing duplicate-singleton bugs (e.g.
OpenTelemetry's global registry keyed per module instance).
The audit method's extractNpmImports still excludes test files when
determining which deps are stale (test-only deps don't drive bumps), but once
a bump plan exists, apply-bump replaces all occurrences of the stale version
string regardless of whether the file is a test.
2026.07.27.1
Fixed: The fmt task ran deno fmt --check, so deno task fmt verified
formatting instead of applying it and there was no way to format the extension
through its own task. fmt now formats and a new fmt:check verifies, matching
every other extension in the repository.
Fixed: deno fmt no longer inspects CLAUDE.md / AGENTS.md. Those files
are gitignored and never present in CI, but deno fmt does not read .gitignore,
so deno task fmt:check could fail locally on a file CI does not have.
Upgrade note: Tooling and formatting only. No model, method, schema, or behavior change — nothing to do on upgrade.
2026.07.31.1
Changed: Bump @aws-sdk/credential-providers 3.1096.0 → 3.1100.0
2026.07.27.4
Fixed: apply-bump lockfile regeneration now uses deno cache on all
source files instead of deno install. The previous approach only resolved
specifiers declared in the deno.json import map, leaving direct specifiers
(like npm:@opentelemetry/api@1.9.1) unresolved in the lockfile. CI would then
fail on lock-check because the lockfile still referenced the old version.
2026.07.27.3
Fixed: apply-bump now prepends the new release notes entry to
RELEASE_NOTES.md instead of overwriting it. Previous versions discarded the
entire changelog history, replacing it with only the current bump's entry.
2026.07.27.2
Fixed: apply-bump now includes *_test.ts files when expanding glob
patterns for find-and-replace. Previously the glob expansion excluded test
files, so a dependency bump in production source would leave the same import at
the old version in tests — causing duplicate-singleton bugs (e.g.
OpenTelemetry's global registry keyed per module instance).
The audit method's extractNpmImports still excludes test files when
determining which deps are stale (test-only deps don't drive bumps), but once
a bump plan exists, apply-bump replaces all occurrences of the stale version
string regardless of whether the file is a test.
2026.07.27.1
Fixed: The fmt task ran deno fmt --check, so deno task fmt verified
formatting instead of applying it and there was no way to format the extension
through its own task. fmt now formats and a new fmt:check verifies, matching
every other extension in the repository.
Fixed: deno fmt no longer inspects CLAUDE.md / AGENTS.md. Those files
are gitignored and never present in CI, but deno fmt does not read .gitignore,
so deno task fmt:check could fail locally on a file CI does not have.
Upgrade note: Tooling and formatting only. No model, method, schema, or behavior change — nothing to do on upgrade.
- Has README or module doc2/2earned
- README has a code example1/1earned
- README is substantive1/1earned
- Most symbols documented1/1earned
- No slow types (deprecated)1/1earned
- Dependencies pass trust audit2/2earned
- Has description1/1earned
- Platform support declared (or universal)2/2earned
- License2/2earned
- Verified public repository2/2earned