chore(main): release 0.6.19

[jmevatt]

🤖 I have created a release beep boop

0.6.19 (2026-10-14)

Features

• aws: address a further call by a value the read captured (#373) (0a1a392)
• aws: create, update and delete DynamoDB tables directly, short of indexes and streaming (#440) (a63b25a)
• aws: create, update and delete ECS clusters directly (#406) (c84082d)
• aws: create, update and delete ELBv2 target groups directly (#424) (9bd7910)
• aws: create, update and delete IAM roles directly (#448) (5ef57f8)
• aws: create, update and delete Lambda functions directly (#461) (67353d9)
• aws: create, update and delete Lambda permissions and function URLs directly (#460) (89a7f32)
• aws: create, update and delete log groups directly (#404) (e470fc0)
• aws: create, update and delete S3 buckets directly (#474) (a648651)
• aws: create, update and delete Secrets Manager secrets directly (#450) (ebad660)
• aws: create, update and delete security groups directly (#426) (0272d63)
• aws: create, update and delete SQS queues directly on lifecycle evidence (#389) (c5b243d)
• aws: create, update and delete SSM parameters directly (#444) (23bc9a7)
• aws: create, update and delete subnets, routes and gateway attachments directly (#451) (7e983a1)
• aws: create, update and delete VPCs, route tables and subnet groups directly (#411) (049d7b5)
• aws: every type found by name carries and checks kraai's identity tag (#491) (0d895d0)
• aws: join CloudFormation schemas to Smithy models for 239 direct readers (#348) (c0f3ca3)
• aws: list ECS task definitions through ECS, proven at read parity (#347) (13344e5)
• aws: mutate DynamoDB tables directly, falling back to Cloud Control for what no call sets (#442) (bbde4fe)
• aws: mutate event buses and log resource policies directly, selecting a read's resource from a list (#446) (d7c1481)
• aws: mutate over the query protocols, starting with internet gateways (#408) (67a3be5)
• aws: mutate RDS cluster parameter groups directly, reading an omitted parameter as its default (#437) (4f02c75)
• aws: mutate under restJson1, and promote HTTP APIs to direct mutation (#459) (2b9051d)
• aws: per-type waits, settling between calls, and stepwise list routes (#439) (57f927a)
• aws: prove a direct read agrees with Cloud Control on absence, and read ECS tags (#351) (7eeeb78)
• aws: put and delete CloudWatch alarms directly (#407) (f5886be)
• aws: put and delete S3 analytics, intelligent-tiering, inventory and metrics configurations by id (#477) (e937b98)
• aws: put, update and delete EventBridge rules directly, diffing targets by key (#420) (a377d61)
• aws: read a type through several calls, and serve target groups directly (#357) (003cc40)
• aws: read API Gateway v2 APIs directly, at read and absence parity (#445) (83e7d77)
• aws: read CloudWatch alarms directly, reading Smithy unions as structures (#384) (214e1e0)
• aws: read DynamoDB tables directly, choosing each operation's endpoint (#383) (a0fd69d)
• aws: read Lambda functions directly (#449) (98afa86)
• aws: read Lambda permissions and function URLs directly (#447) (3ce86ce)
• aws: read map-shaped and string-encoded responses directly (#374) (b2e7acc)
• aws: read proven types through their own service instead of Cloud Control (#354) (3a0ceeb)
• aws: read resources over awsQuery and ec2Query (#349) (12a5ba5)
• aws: read resources over restXml, with endpoints taken from the rule set (#350) (863acc7)
• aws: read resources whose identifier is an ARN taken apart or a filter value (#381) (9867dae)
• aws: read route tables and ECS clusters directly in production (#365) (cdd9076)
• aws: read S3 buckets completely and directly in production (#470) (82c5b47)
• aws: read S3 buckets directly, binding the bucket as an endpoint parameter (#468) (89f37c0)
• aws: read security groups directly in production (#363) (406929f)
• aws: read security groups directly, filtering a list by its elements' members (#362) (4c7579f)
• aws: read VPCs and internet gateways directly in production (#364) (5f59e8a)
• aws: redeploy a function when a secret it reads has a new version (#339) (6238667)
• aws: register and deregister ECS task definitions directly (#400) (ff3e2a9)
• aws: resolve endpoints by evaluating each service's rule set (#464) (e686955)
• aws: send structured inputs and select a list element, and read a subnet's network ACL association (#359) (ac58761)
• aws: the network names a VPC Terraform owns (#505) (6faca42)
• aws: the queues capability is a native SQS queue, adopting untagged queues by generation (#498) (3aa786d)
• aws: wait out busy states over XML, retry creates that cannot duplicate, and route map properties (#435) (26c310a)
• aws: write S3 lifecycle, notification and replication configurations directly (#476) (3249e54)
• ci: apply the paid AWS stores live on demand (#522) (7bee861)
• dev: add declcheck and splitdecls for verifiable file splits (#399) (b8ad5e2)
• manifest: read Terraform and OpenTofu outputs as template values (#504) (cff1d14)
• show which properties a plan changes, made safe before printing (#514) (6eb14a7)

Bug Fixes

• aws: carry a Body-defined API's tags in its document and re-import it (#525) (8eb7ec2)
• aws: check override error codes against the model, and require undeclared ones observed (#465) (5ec70f8)
• aws: compare a DynamoDB table's attribute definitions in any order (#385) (b5c686e)
• aws: compare a value in the form the service returns it (#510) (90d7edc)
• aws: compare arrays the schema declares unordered in any order (#353) (3e8d321)
• aws: compare target group attributes as a subset when planning (#430) (d114ca4)
• aws: delete an ephemeral environment's Aurora final snapshot (#524) (8b04086)
• aws: delete an S3 bucket's tagging when its tags are emptied (#479) (7174b26)
• aws: detect removals only where the whole config is compared (#515) (dc5e557)
• aws: do not replace a resource over a write-only create-only property (#441) (b828d50)
• aws: find a queue by its URL, which a lagging list cannot hide (#508) (9612b84)
• aws: follow DescribeParameters pages when reading or setting a secret parameter (#360) (f417e8c), closes #346
• aws: give a native FIFO queue's derived name the .fifo suffix (#379) (957598b)
• aws: grant Cloud Control's calls under the cloudformation prefix (#519) (4f605f6)
• aws: grant the calls kraai makes outside Cloud Control's handlers (#520) (44b98c1)
• aws: never delete an SSM parameter kraai did not make (#494) (429762e)
• aws: pass over listed entries Cloud Control refuses to read when matching (#378) (3968386)
• aws: plan a replacement for an override's create-only property (#432) (251c027)
• aws: prove absence only by a direct read that reports it (#376) (6b881c1)
• aws: read a DynamoDB table's default billing mode and encryption as Cloud Control does (#438) (a338c9f)
• aws: read a gone instance as absent through the not-found code its read operation declares (#472) (9b482bb)
• aws: read, update and delete an S3 bucket in another region there (#475) (f05c4cf)
• aws: refuse to plan against a SecureString SSM parameter (#509) (240b7d0)
• aws: retry transient failures of direct calls with the SDK's classifiers (#427) (7c1cf78)
• aws: schedule-triggered services apply, and Lambda permissions stop replacing every run (#492) (fbf7ed6)
• aws: send a secret's value at create only, never on update (#457) (45d6a41), closes #454
• aws: send an empty list as the query protocol does (#431) (8976861)
• aws: stop nested vendor defaults planning an unchanged resource as a replace (#344) (7a19aa5)
• aws: treat a direct read answered with a page token as incomplete (#361) (5f01bd7)
• ci: split the live role's actions across managed policies (#517) (8f73104)
• ci: trust the repository's immutable OIDC subject (#518) (2e8cf8c)
• cloudflare: read R2's real listing shapes and treat a missing bucket as deleted (#530) (eede5f8)
• dev: bypass governance retention only when emptying the object-lock fixture bucket (#478) (5f4029b)
• direct: draft an ARN identifier into a name input through its last segment (#387) (ee5183b)
• direct: extract writes all or nothing and keeps locked schemas (#377) (80e1365)
• direct: read ARN-identified drafts by the name or id their input takes (#388) (5e1d924)
• fit a derived name to its service's name limit (#507) (99588a3)
• plan a change to a vetted write-only property from its fingerprint (#512) (09d7fa2)
• plan: report a dependent of a failed resource as failed, not as an update (#429) (3db7c7c)
• plan: take a service's dir against the manifest directory, not the working directory (#493) (d406c02)
• reset a property kraai set and the manifest stopped declaring (#506) (6453f43)

Performance Improvements

• aws: decode each model and schema once per compilation (#462) (41ddfb9)
• aws: take a tagging-index hit on every command, walking only on a miss (#356) (1ca8dd8)
• aws: trust a settled tagging index's miss on every command (#358) (6965ad3)
• direct: parse each model's endpoint rule set once per compilation (#469) (76c952a)

---

This PR was generated with Release Please. See documentation.