feat(transfer): AWS Transfer Family service (71 ops, awsJson1.1, 100% conformance)

New fakecloud-transfer crate implementing the full 71-operation AWS Transfer
Family control plane (awsJson1.1, target prefix TransferService): SFTP/FTPS/FTP/
AS2 servers with synchronous ONLINE/OFFLINE state transitions, users + SSH
public keys, host keys, service-managed accesses, workflows + executions, AS2
agreements, connectors (SFTP + AS2, with TestConnection, StartFileTransfer,
StartDirectoryListing, StartRemoteDelete/Move, ListFileTransferResults),
profiles, certificates, the managed security-policy catalogue, web apps (+
customization), TestIdentityProvider, and tagging.

- Real CRUD: create/import is reflected by describe/list, update mutates,
  delete removes; nested config round-trips verbatim. AWS-shaped IDs and ARNs.
- Model-derived input validation (string @Length, integer @range, enum sets)
  returning InvalidRequestException; ResourceNotFoundException for missing
  parents/resources; ResourceExistsException on duplicates.
- Account-partitioned state with snapshot persistence + restore.
- Protocol routing wired in core::protocol and conformance service_detection.
- Registered in the server, workspace members + version-pinned workspace dep,
  release.yml publish list, conformance audit map, and tfacc allowlist/shard/
  endpoint env (TestAccTransfer(Server|User|SSHKey|Access)_basic).
- Conformance: 71/71 ops, 2756/2756 Smithy probe variants pass; baseline +
  doc-counts (parity, operations index, service lists) updated.
- Tests: 11 e2e CRUD/lifecycle/error tests + persistence round-trip.

Author: vieiralucas

.github/workflows/release.yml

@@ -211,6 +211,7 @@ jobs:
           publish fakecloud-opensearch       # only core/persistence/aws deps (ES + OpenSearch)
           publish fakecloud-backup           # only core/persistence/aws deps
           publish fakecloud-glacier          # only core/persistence/aws deps
+          publish fakecloud-transfer         # only core/persistence/aws deps
           publish fakecloud-kinesis
           publish fakecloud-scheduler
           publish fakecloud-bedrock

AGENTS.md

@@ -5,7 +5,7 @@ Local AWS cloud emulator. Part of the faisca project family.
 ## Product Context
 
 - FakeCloud is a local AWS emulator focused on high-fidelity behavior and AWS-compatible responses.
-- Current project state: 60 AWS services, 4,625 operations, 152,159/152,159 Smithy conformance variants pass — true 100% across every implemented service, no flake margin. See [the parity matrix](website/content/docs/parity.md) for the full service-by-service breakdown of control-plane vs data-plane coverage and known limitations.
+- Current project state: 61 AWS services, 4,696 operations, 154,915/154,915 Smithy conformance variants pass — true 100% across every implemented service, no flake margin. See [the parity matrix](website/content/docs/parity.md) for the full service-by-service breakdown of control-plane vs data-plane coverage and known limitations.
 - The broader roadmap prioritizes services that LocalStack keeps behind paid tiers, especially ECS, ELB/ALB, CloudFront, CloudWatch Metrics, and EC2.
 - Introspection SDKs (Rust, Python, TypeScript, Go, PHP, Java) are already built and maintained for the `/_fakecloud/*` endpoints.
 

Cargo.lock

@@ -1,5 +1,5 @@
 [workspace]
-members = [ "crates/fakecloud-account", "crates/fakecloud-acm", "crates/fakecloud-apigateway", "crates/fakecloud-apigatewayv2", "crates/fakecloud-application-autoscaling", "crates/fakecloud-autoscaling", "crates/fakecloud-athena", "crates/fakecloud-aws", "crates/fakecloud-batch", "crates/fakecloud-bedrock", "crates/fakecloud-bedrock-agent", "crates/fakecloud-bedrock-agent-runtime", "crates/fakecloud-cloudcontrol", "crates/fakecloud-cloudformation", "crates/fakecloud-cloudfront", "crates/fakecloud-backup", "crates/fakecloud-cloudwatch", "crates/fakecloud-cognito", "crates/fakecloud-conformance", "crates/fakecloud-conformance-macros", "crates/fakecloud-core", "crates/fakecloud-dms", "crates/fakecloud-dsql", "crates/fakecloud-dynamodb", "crates/fakecloud-e2e", "crates/fakecloud-ec2", "crates/fakecloud-ecr", "crates/fakecloud-ecs", "crates/fakecloud-eks", "crates/fakecloud-glacier", "crates/fakecloud-elasticache", "crates/fakecloud-memorydb", "crates/fakecloud-elbv2", "crates/fakecloud-eventbridge", "crates/fakecloud-firehose", "crates/fakecloud-glue", "crates/fakecloud-iam", "crates/fakecloud-identitystore", "crates/fakecloud-ssoadmin", "crates/fakecloud-verifiedpermissions", "crates/fakecloud-kinesis", "crates/fakecloud-kms", "crates/fakecloud-k8s", "crates/fakecloud-lambda", "crates/fakecloud-logs", "crates/fakecloud-opensearch", "crates/fakecloud-organizations", "crates/fakecloud-parity", "crates/fakecloud-persistence", "crates/fakecloud-pipes", "crates/fakecloud-rds", "crates/fakecloud-rds-data", "crates/fakecloud-redshift", "crates/fakecloud-resource-groups", "crates/fakecloud-resource-groups-tagging", "crates/fakecloud-route53", "crates/fakecloud-s3", "crates/fakecloud-scheduler", "crates/fakecloud-sdk", "crates/fakecloud-secretsmanager", "crates/fakecloud-server", "crates/fakecloud-servicediscovery", "crates/fakecloud-ses", "crates/fakecloud-sns", "crates/fakecloud-sqs", "crates/fakecloud-ssm", "crates/fakecloud-stepfunctions", "crates/fakecloud-testkit", "crates/fakecloud-tfacc", "crates/fakecloud-wafv2",]
+members = [ "crates/fakecloud-account", "crates/fakecloud-acm", "crates/fakecloud-apigateway", "crates/fakecloud-apigatewayv2", "crates/fakecloud-application-autoscaling", "crates/fakecloud-autoscaling", "crates/fakecloud-athena", "crates/fakecloud-aws", "crates/fakecloud-batch", "crates/fakecloud-bedrock", "crates/fakecloud-bedrock-agent", "crates/fakecloud-bedrock-agent-runtime", "crates/fakecloud-cloudcontrol", "crates/fakecloud-cloudformation", "crates/fakecloud-cloudfront", "crates/fakecloud-backup", "crates/fakecloud-cloudwatch", "crates/fakecloud-cognito", "crates/fakecloud-conformance", "crates/fakecloud-conformance-macros", "crates/fakecloud-core", "crates/fakecloud-dms", "crates/fakecloud-dsql", "crates/fakecloud-dynamodb", "crates/fakecloud-e2e", "crates/fakecloud-ec2", "crates/fakecloud-ecr", "crates/fakecloud-ecs", "crates/fakecloud-eks", "crates/fakecloud-glacier", "crates/fakecloud-elasticache", "crates/fakecloud-memorydb", "crates/fakecloud-elbv2", "crates/fakecloud-eventbridge", "crates/fakecloud-firehose", "crates/fakecloud-glue", "crates/fakecloud-iam", "crates/fakecloud-identitystore", "crates/fakecloud-ssoadmin", "crates/fakecloud-verifiedpermissions", "crates/fakecloud-kinesis", "crates/fakecloud-kms", "crates/fakecloud-k8s", "crates/fakecloud-lambda", "crates/fakecloud-logs", "crates/fakecloud-opensearch", "crates/fakecloud-organizations", "crates/fakecloud-parity", "crates/fakecloud-persistence", "crates/fakecloud-pipes", "crates/fakecloud-rds", "crates/fakecloud-rds-data", "crates/fakecloud-redshift", "crates/fakecloud-resource-groups", "crates/fakecloud-resource-groups-tagging", "crates/fakecloud-route53", "crates/fakecloud-s3", "crates/fakecloud-scheduler", "crates/fakecloud-sdk", "crates/fakecloud-secretsmanager", "crates/fakecloud-server", "crates/fakecloud-servicediscovery", "crates/fakecloud-ses", "crates/fakecloud-sns", "crates/fakecloud-sqs", "crates/fakecloud-ssm", "crates/fakecloud-stepfunctions", "crates/fakecloud-testkit", "crates/fakecloud-tfacc", "crates/fakecloud-transfer", "crates/fakecloud-wafv2",]
 resolver = "2"
 
 [workspace.package]
@@ -209,6 +209,10 @@ version = "0.34.1"
 path = "crates/fakecloud-dms"
 version = "0.34.1"
 
+[workspace.dependencies.fakecloud-transfer]
+path = "crates/fakecloud-transfer"
+version = "0.34.1"
+
 [workspace.dependencies.fakecloud-dsql]
 path = "crates/fakecloud-dsql"
 version = "0.34.1"

Cargo.toml

@@ -36,7 +36,7 @@ Works as a drop-in for LocalStack in CI, with Terraform (`endpoints` block), CDK
 ## Why fakecloud
 
 - **Free, forever.** AGPL-3.0, no paid tier, no account, no token.
-- **True 100% conformance.** 152,159 Smithy-model-generated test variants pass on every commit, validated against AWS's own Smithy models. CI also runs upstream `terraform-provider-aws` `TestAcc*` suites to catch waiter/field/drift bugs that SDK tests miss.
+- **True 100% conformance.** 154,915 Smithy-model-generated test variants pass on every commit, validated against AWS's own Smithy models. CI also runs upstream `terraform-provider-aws` `TestAcc*` suites to catch waiter/field/drift bugs that SDK tests miss.
 - **Real cross-service wiring.** EventBridge -> Step Functions, S3 -> Lambda, SES inbound -> S3/SNS/Lambda, and 15+ more integrations execute end-to-end.
 - **Real infrastructure for stateful services.** Lambda (23 runtimes), RDS (Postgres/MySQL/MariaDB/Oracle/SQL Server/Db2), ElastiCache (Redis/Valkey/Memcached), ECS, and EC2 run as real containers. Use Docker (default) or native Kubernetes Pods via `FAKECLOUD_CONTAINER_BACKEND=k8s`. See the [Kubernetes backend guide](https://fakecloud.dev/docs/guides/kubernetes-backend/).
 - **Single binary.** ~19 MB, ~10 MiB idle, ~300ms startup. No Docker needed to run fakecloud itself.
@@ -47,7 +47,7 @@ Works as a drop-in for LocalStack in CI, with Terraform (`endpoints` block), CDK
 
 ## Supported services
 
-60 services, 4,625 operations, true 100% conformance across every implemented service. Notes below are one-liners; the [parity matrix](https://fakecloud.dev/docs/parity/) has full control-plane vs data-plane coverage and known limitations per service.
+61 services, 4,696 operations, true 100% conformance across every implemented service. Notes below are one-liners; the [parity matrix](https://fakecloud.dev/docs/parity/) has full control-plane vs data-plane coverage and known limitations per service.
 
 | Service                   | Ops | Notes |
 | ------------------------- | --- | ----- |
@@ -74,6 +74,7 @@ Works as a drop-in for LocalStack in CI, with Terraform (`endpoints` block), CDK
 | RDS Data API              | 6   | Real SQL on the backing Postgres/MySQL container, typed params/results incl. `bytea`/`BLOB`, transactions, batch |
 | Redshift                  | 141 | Full control plane: clusters, snapshots, parameter/subnet groups, snapshot schedules, endpoint access, logging, cross-region snapshot-copy config, tagging |
 | Database Migration Service | 119 | Full control plane: replication instances/tasks/endpoints, subnet groups, event subscriptions, certificates, serverless replication configs, data providers, instance profiles, migration projects, schema conversion, Fleet Advisor, tagging; persisted. No data-migration engine |
+| Transfer Family           | 71  | Full control plane: SFTP/FTPS/FTP/AS2 servers (start/stop settle state), users + SSH keys, host keys, accesses, workflows + executions, agreements, connectors (`TestConnection`, file transfer, directory listing, remote delete/move), profiles, certificates, security policies, web apps, `TestIdentityProvider`, tagging; persisted. No SFTP/AS2 transport engine |
 | Aurora DSQL               | 16  | Serverless distributed Postgres control plane: clusters, resource policies, change streams to Kinesis, multi-region, tagging |
 | Resource Groups           | 23  | Groups by tag/CloudFormation-stack query, explicit membership, group configuration, tagging, account settings, tag-sync tasks |
 | Resource Groups Tagging API | 9 | Cross-service tag reads/writes, compliance summary, tag reports, backed by a real cross-service tag index |
@@ -126,6 +127,7 @@ Per-service docs and feature matrices: [fakecloud.dev/docs/services](https://fak
 | RDS Data API              | 6 ops, real SQL + typed results + transactions on the RDS container  | [Paid only](https://docs.localstack.cloud/references/licensing/) |
 | Redshift                  | 141 ops, full control plane free (clusters, snapshots, endpoint access, logging) | [Paid only](https://docs.localstack.cloud/references/licensing/) |
 | Database Migration Service | 119 ops, full control plane free (replication instances/tasks/endpoints, subnet groups, serverless configs, schema conversion) | [Paid only](https://docs.localstack.cloud/references/licensing/) |
+| Transfer Family           | 71 ops, full control plane free (servers, users, SSH/host keys, accesses, workflows, agreements, connectors, profiles, certificates, web apps) | [Paid only](https://docs.localstack.cloud/references/licensing/) |
 | Aurora DSQL               | 16 ops, full control plane free (clusters, policies, streams, tagging) | [Paid only](https://docs.localstack.cloud/references/licensing/) |
 | Resource Groups           | 23 ops, groups + queries + membership + tag-sync, free | [Paid only](https://docs.localstack.cloud/references/licensing/) |
 | Resource Groups Tagging API | 9 ops, cross-service tag reads/writes + reports, free | [Paid only](https://docs.localstack.cloud/references/licensing/) |

README.md

@@ -238,5 +238,9 @@
   "dms": {
     "repo_dir": "database-migration-service",
     "service_name": "dms"
+  },
+  "transfer": {
+    "repo_dir": "transfer",
+    "service_name": "transfer"
   }
 }