Parity grade: A · SDK aws-sdk-go-v2/service/codeartifact@v1.38.19 · last audited 2026-07-23 (TBD-fill-in-after-commit)
| Metric | Value |
|---|---|
| Operations audited | 48 (41 ok, 7 partial) |
| Feature families | 3 (3 ok) |
| Known gaps | 6 |
| Deferred items | 3 |
| Resource leaks | clean |
- Package-group 'weak match' (case-folding, dash/dot/underscore-equivalence, confusable-character normalization used for dependency-confusion protection) is not implemented — only the 'strong' (exact) half of AWS's matching algorithm is (see package_group_pattern_matching family note). Every match this backend reports is therefore always associationType STRONG; real AWS's WEAK association type (and its 'block the package even though a broader group would allow it' side effect) never occurs here.
- This backend does not auto-create the implicit root package group ('/*') that real AWS attaches to every domain and forbids deleting. Adding it would change GetAssociatedPackageGroup/ListPackageGroups behavior on a domain with zero explicitly-created groups (several existing tests assert 'no groups yet' -> empty list / no match), so it was deliberately left out this pass rather than rewriting that test surface; flagged for a future pass.
- DescribePackage / DescribePackageVersion auto-create a stub record when the resource doesn't exist, instead of returning ResourceNotFoundException like real AWS. This is pre-existing, intentionally-documented behavior, reconfirmed this pass to be extremely load-bearing test-seeding infrastructure (60+ call sites across handler_package_versions_test.go, handler_package_versions_assets_test.go, persistence_test.go, handler_packages_test.go use GET as a seed operation), so ripping it out remains a large, independently-scoped migration — not touched this pass either. Real behavioral divergence from AWS.
- GetPackageVersionReadme / ListPackageVersionDependencies now parse real content from a published package.json asset (npm convention — see the ops table), but still return empty for any format/publish that doesn't include a standalone package.json asset (e.g. a real npm tarball, a Maven POM, or any non-npm format) — this backend's single-asset-per-call publish model doesn't unpack archives.
- GetAuthorizationToken returns a fabricated token string rather than any real credential material; acceptable since nothing validates it downstream, but flagged in case a future op starts checking it.
- domain-owner / cross-account query param is accepted by real AWS on nearly every op (for cross-account domain access) but is not read anywhere in this backend; single-account-only is assumed throughout.
- Package-group 'weak match' dependency-confusion-protection semantics (see gaps above)
- Root package-group auto-creation (see gaps above)
- store_setup.go was read but not modified — no bugs found, not exhaustively re-audited