@aligent/aws-wrappers 0.1.0 → 0.1.2

package/esm/index.mjs

@@ -0,0 +1,1903 @@
+import { Logger } from '@aws-lambda-powertools/logger';
+import { DynamoDBClient } from '@aws-sdk/client-dynamodb';
+import { DynamoDBDocumentClient, paginateQuery, paginateScan, GetCommand, PutCommand, UpdateCommand, DeleteCommand, QueryCommand, ScanCommand, BatchGetCommand, BatchWriteCommand } from '@aws-sdk/lib-dynamodb';
+import xray from 'aws-xray-sdk-core';
+import { S3Client, PutObjectCommand, GetObjectCommand, HeadObjectCommand, CopyObjectCommand, paginateListObjectsV2, DeleteObjectCommand, DeleteObjectsCommand } from '@aws-sdk/client-s3';
+import { getSignedUrl } from '@aws-sdk/s3-request-presigner';
+import { SecretsManagerClient, CreateSecretCommand, UpdateSecretCommand, PutSecretValueCommand, DeleteSecretCommand, GetSecretValueCommand } from '@aws-sdk/client-secrets-manager';
+import { SFNClient, paginateListExecutions, StartExecutionCommand, DescribeExecutionCommand, StopExecutionCommand } from '@aws-sdk/client-sfn';
+import { SNSClient, PublishCommand, PublishBatchCommand } from '@aws-sdk/client-sns';
+import { SQSClient, SendMessageCommand, ReceiveMessageCommand, DeleteMessageCommand, SendMessageBatchCommand, DeleteMessageBatchCommand } from '@aws-sdk/client-sqs';
+import { SSMClient, GetParameterCommand, GetParametersCommand, PutParameterCommand, DeleteParameterCommand, paginateGetParametersByPath } from '@aws-sdk/client-ssm';
+
+/******************************************************************************
+Copyright (c) Microsoft Corporation.
+
+Permission to use, copy, modify, and/or distribute this software for any
+purpose with or without fee is hereby granted.
+
+THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES WITH
+REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF MERCHANTABILITY
+AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY SPECIAL, DIRECT,
+INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES WHATSOEVER RESULTING FROM
+LOSS OF USE, DATA OR PROFITS, WHETHER IN AN ACTION OF CONTRACT, NEGLIGENCE OR
+OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR
+PERFORMANCE OF THIS SOFTWARE.
+***************************************************************************** */
+/* global Reflect, Promise, SuppressedError, Symbol, Iterator */
+
+
+var __assign = function() {
+    __assign = Object.assign || function __assign(t) {
+        for (var s, i = 1, n = arguments.length; i < n; i++) {
+            s = arguments[i];
+            for (var p in s) if (Object.prototype.hasOwnProperty.call(s, p)) t[p] = s[p];
+        }
+        return t;
+    };
+    return __assign.apply(this, arguments);
+};
+
+function __awaiter(thisArg, _arguments, P, generator) {
+    function adopt(value) { return value instanceof P ? value : new P(function (resolve) { resolve(value); }); }
+    return new (P || (P = Promise))(function (resolve, reject) {
+        function fulfilled(value) { try { step(generator.next(value)); } catch (e) { reject(e); } }
+        function rejected(value) { try { step(generator["throw"](value)); } catch (e) { reject(e); } }
+        function step(result) { result.done ? resolve(result.value) : adopt(result.value).then(fulfilled, rejected); }
+        step((generator = generator.apply(thisArg, _arguments || [])).next());
+    });
+}
+
+function __generator(thisArg, body) {
+    var _ = { label: 0, sent: function() { if (t[0] & 1) throw t[1]; return t[1]; }, trys: [], ops: [] }, f, y, t, g = Object.create((typeof Iterator === "function" ? Iterator : Object).prototype);
+    return g.next = verb(0), g["throw"] = verb(1), g["return"] = verb(2), typeof Symbol === "function" && (g[Symbol.iterator] = function() { return this; }), g;
+    function verb(n) { return function (v) { return step([n, v]); }; }
+    function step(op) {
+        if (f) throw new TypeError("Generator is already executing.");
+        while (g && (g = 0, op[0] && (_ = 0)), _) try {
+            if (f = 1, y && (t = op[0] & 2 ? y["return"] : op[0] ? y["throw"] || ((t = y["return"]) && t.call(y), 0) : y.next) && !(t = t.call(y, op[1])).done) return t;
+            if (y = 0, t) op = [op[0] & 2, t.value];
+            switch (op[0]) {
+                case 0: case 1: t = op; break;
+                case 4: _.label++; return { value: op[1], done: false };
+                case 5: _.label++; y = op[1]; op = [0]; continue;
+                case 7: op = _.ops.pop(); _.trys.pop(); continue;
+                default:
+                    if (!(t = _.trys, t = t.length > 0 && t[t.length - 1]) && (op[0] === 6 || op[0] === 2)) { _ = 0; continue; }
+                    if (op[0] === 3 && (!t || (op[1] > t[0] && op[1] < t[3]))) { _.label = op[1]; break; }
+                    if (op[0] === 6 && _.label < t[1]) { _.label = t[1]; t = op; break; }
+                    if (t && _.label < t[2]) { _.label = t[2]; _.ops.push(op); break; }
+                    if (t[2]) _.ops.pop();
+                    _.trys.pop(); continue;
+            }
+            op = body.call(thisArg, _);
+        } catch (e) { op = [6, e]; y = 0; } finally { f = t = 0; }
+        if (op[0] & 5) throw op[1]; return { value: op[0] ? op[1] : void 0, done: true };
+    }
+}
+
+function __values(o) {
+    var s = typeof Symbol === "function" && Symbol.iterator, m = s && o[s], i = 0;
+    if (m) return m.call(o);
+    if (o && typeof o.length === "number") return {
+        next: function () {
+            if (o && i >= o.length) o = void 0;
+            return { value: o && o[i++], done: !o };
+        }
+    };
+    throw new TypeError(s ? "Object is not iterable." : "Symbol.iterator is not defined.");
+}
+
+function __await(v) {
+    return this instanceof __await ? (this.v = v, this) : new __await(v);
+}
+
+function __asyncGenerator(thisArg, _arguments, generator) {
+    if (!Symbol.asyncIterator) throw new TypeError("Symbol.asyncIterator is not defined.");
+    var g = generator.apply(thisArg, _arguments || []), i, q = [];
+    return i = Object.create((typeof AsyncIterator === "function" ? AsyncIterator : Object).prototype), verb("next"), verb("throw"), verb("return", awaitReturn), i[Symbol.asyncIterator] = function () { return this; }, i;
+    function awaitReturn(f) { return function (v) { return Promise.resolve(v).then(f, reject); }; }
+    function verb(n, f) { if (g[n]) { i[n] = function (v) { return new Promise(function (a, b) { q.push([n, v, a, b]) > 1 || resume(n, v); }); }; if (f) i[n] = f(i[n]); } }
+    function resume(n, v) { try { step(g[n](v)); } catch (e) { settle(q[0][3], e); } }
+    function step(r) { r.value instanceof __await ? Promise.resolve(r.value.v).then(fulfill, reject) : settle(q[0][2], r); }
+    function fulfill(value) { resume("next", value); }
+    function reject(value) { resume("throw", value); }
+    function settle(f, v) { if (f(v), q.shift(), q.length) resume(q[0][0], q[0][1]); }
+}
+
+function __asyncValues(o) {
+    if (!Symbol.asyncIterator) throw new TypeError("Symbol.asyncIterator is not defined.");
+    var m = o[Symbol.asyncIterator], i;
+    return m ? m.call(o) : (o = typeof __values === "function" ? __values(o) : o[Symbol.iterator](), i = {}, verb("next"), verb("throw"), verb("return"), i[Symbol.asyncIterator] = function () { return this; }, i);
+    function verb(n) { i[n] = o[n] && function (v) { return new Promise(function (resolve, reject) { v = o[n](v), settle(resolve, reject, v.done, v.value); }); }; }
+    function settle(resolve, reject, d, v) { Promise.resolve(v).then(function(v) { resolve({ value: v, done: d }); }, reject); }
+}
+
+typeof SuppressedError === "function" ? SuppressedError : function (error, suppressed, message) {
+    var e = new Error(message);
+    return e.name = "SuppressedError", e.error = error, e.suppressed = suppressed, e;
+};
+
+/**
+ * Return a log-safe projection of `input` based on the logger's configured level.
+ *
+ * At `DEBUG`, the full input is returned unchanged — operators who set
+ * `POWERTOOLS_LOG_LEVEL=DEBUG` (or call `logger.setLogLevel('DEBUG')`) have
+ * explicitly opted into seeing everything, including payloads, secret material
+ * and PII.
+ *
+ * At any other level, only the fields listed in `safeFields` are included.
+ * Missing fields are silently skipped — the result type narrows to
+ * `Pick<T, K>` accordingly.
+ *
+ * Used across the package so that the "what's safe to log at INFO" decision
+ * lives in one place. See `packages/aws-wrappers/CLAUDE.md` ("Logging") for
+ * the design rationale and conventions on building the safe-field lists.
+ */
+function filterFieldsForLogLevel(logger, input, safeFields) {
+    if (logger.getLevelName() === 'DEBUG')
+        return input;
+    var out = {};
+    for (var _i = 0, safeFields_1 = safeFields; _i < safeFields_1.length; _i++) {
+        var key = safeFields_1[_i];
+        if (key in input)
+            out[key] = input[key];
+    }
+    return out;
+}
+
+var BATCH_WRITE_MAX_ATTEMPTS = 5;
+var BATCH_WRITE_BASE_DELAY_MS = 200;
+/**
+ * Fields safe to log at INFO. Omits `Key` (may carry customer IDs / tenant IDs).
+ * `POWERTOOLS_LOG_LEVEL=DEBUG` unlocks the full input.
+ */
+var GET_ITEM_SAFE_FIELDS = [
+    'TableName',
+    'ConsistentRead',
+    'ProjectionExpression',
+    'ReturnConsumedCapacity',
+    'ExpressionAttributeNames',
+];
+/**
+ * Fields safe to log at INFO. Omits `Item` (the payload itself) and
+ * `ExpressionAttributeValues` (values bound to ConditionExpression, often PII).
+ * `POWERTOOLS_LOG_LEVEL=DEBUG` unlocks the full input.
+ */
+var PUT_ITEM_SAFE_FIELDS = [
+    'TableName',
+    'ConditionExpression',
+    'ExpressionAttributeNames',
+    'ReturnValues',
+    'ReturnConsumedCapacity',
+    'ReturnItemCollectionMetrics',
+    'ReturnValuesOnConditionCheckFailure',
+];
+/**
+ * Fields safe to log at INFO. Omits `Key` and `ExpressionAttributeValues`.
+ * `POWERTOOLS_LOG_LEVEL=DEBUG` unlocks the full input.
+ */
+var UPDATE_ITEM_SAFE_FIELDS = [
+    'TableName',
+    'UpdateExpression',
+    'ConditionExpression',
+    'ExpressionAttributeNames',
+    'ReturnValues',
+    'ReturnConsumedCapacity',
+    'ReturnItemCollectionMetrics',
+    'ReturnValuesOnConditionCheckFailure',
+];
+/**
+ * Fields safe to log at INFO. Omits `Key` and `ExpressionAttributeValues`
+ * (the latter binds to ConditionExpression and may carry PII).
+ * `POWERTOOLS_LOG_LEVEL=DEBUG` unlocks the full input.
+ */
+var DELETE_ITEM_SAFE_FIELDS = [
+    'TableName',
+    'ConditionExpression',
+    'ExpressionAttributeNames',
+    'ReturnValues',
+    'ReturnConsumedCapacity',
+    'ReturnItemCollectionMetrics',
+    'ReturnValuesOnConditionCheckFailure',
+];
+/**
+ * Fields safe to log at INFO for `query` and `paginateItems`. Omits
+ * `ExpressionAttributeValues` (values often carry PII) and `ExclusiveStartKey`
+ * (pagination cursor includes Key shape). `POWERTOOLS_LOG_LEVEL=DEBUG` unlocks
+ * the full input.
+ */
+var QUERY_SAFE_FIELDS = [
+    'TableName',
+    'IndexName',
+    'KeyConditionExpression',
+    'FilterExpression',
+    'ProjectionExpression',
+    'ExpressionAttributeNames',
+    'ConsistentRead',
+    'ScanIndexForward',
+    'Select',
+    'Limit',
+    'ReturnConsumedCapacity',
+];
+/**
+ * Fields safe to log at INFO for `scan` and `paginateScan`. Omits
+ * `ExpressionAttributeValues` and `ExclusiveStartKey`.
+ * `POWERTOOLS_LOG_LEVEL=DEBUG` unlocks the full input.
+ */
+var SCAN_SAFE_FIELDS = [
+    'TableName',
+    'IndexName',
+    'FilterExpression',
+    'ProjectionExpression',
+    'ExpressionAttributeNames',
+    'ConsistentRead',
+    'Select',
+    'Limit',
+    'Segment',
+    'TotalSegments',
+    'ReturnConsumedCapacity',
+];
+var sleep = function (ms) { return new Promise(function (resolve) { return setTimeout(resolve, ms); }); };
+var backoffDelay = function (attempt) {
+    var exp = BATCH_WRITE_BASE_DELAY_MS * Math.pow(2, attempt);
+    return exp + Math.random() * exp;
+};
+/**
+ * Wrapper around the AWS DynamoDB Document client providing structured
+ * Powertools logging and X-Ray tracing by default.
+ *
+ * Items are automatically marshalled / unmarshalled via the document client —
+ * callers work with plain TypeScript objects in both directions.
+ */
+var DynamoDBService = /** @class */ (function () {
+    /**
+     * @param opts.logger - Optional Powertools logger. Defaults to `new Logger()`,
+     * which picks up `POWERTOOLS_SERVICE_NAME` from the environment.
+     * @param opts.client - Optional pre-configured `DynamoDBDocumentClient`.
+     * When supplied, the wrapper does not apply X-Ray instrumentation. When
+     * omitted, a default `DynamoDBClient` is wrapped with `captureAWSv3Client`
+     * *before* being passed to `DynamoDBDocumentClient.from`, so X-Ray
+     * tracing captures every DynamoDB call.
+     */
+    function DynamoDBService(opts) {
+        var _a, _b;
+        this.client =
+            (_a = opts === null || opts === void 0 ? void 0 : opts.client) !== null && _a !== void 0 ? _a : DynamoDBDocumentClient.from(xray.captureAWSv3Client(new DynamoDBClient({})), {
+                marshallOptions: { removeUndefinedValues: true },
+            });
+        this.logger = (_b = opts === null || opts === void 0 ? void 0 : opts.logger) !== null && _b !== void 0 ? _b : new Logger();
+    }
+    /**
+     * Get an item from DynamoDB.
+     * @template K - Shape of the partition / sort key.
+     * @template R - Expected unmarshalled item shape.
+     * @returns The item, or `undefined` if not found.
+     */
+    DynamoDBService.prototype.getItem = function (input) {
+        return __awaiter(this, void 0, void 0, function () {
+            var response;
+            return __generator(this, function (_a) {
+                switch (_a.label) {
+                    case 0:
+                        this.logger.info('Getting DynamoDB item', {
+                            input: filterFieldsForLogLevel(this.logger, input, GET_ITEM_SAFE_FIELDS),
+                        });
+                        return [4 /*yield*/, this.client.send(new GetCommand(input))];
+                    case 1:
+                        response = _a.sent();
+                        return [2 /*return*/, response.Item];
+                }
+            });
+        });
+    };
+    /**
+     * Put an item into DynamoDB. The caller's `Item` is typed as `T`, which
+     * the document client marshalls automatically.
+     * @template T - Type of the item being stored.
+     */
+    DynamoDBService.prototype.putItem = function (input) {
+        return __awaiter(this, void 0, void 0, function () {
+            return __generator(this, function (_a) {
+                this.logger.info('Putting DynamoDB item', {
+                    input: filterFieldsForLogLevel(this.logger, input, PUT_ITEM_SAFE_FIELDS),
+                });
+                return [2 /*return*/, this.client.send(new PutCommand(input))];
+            });
+        });
+    };
+    /**
+     * Update an item in DynamoDB. The `Attributes` field on the response is
+     * typed as `R` — the caller should choose `R` to match their
+     * `ReturnValues` setting:
+     * - `NONE` (default): no `Attributes` returned.
+     * - `ALL_OLD` / `ALL_NEW`: full item.
+     * - `UPDATED_OLD` / `UPDATED_NEW`: only updated attributes (partial).
+     * @template K - Shape of the partition / sort key.
+     * @template R - Expected shape of the returned `Attributes`.
+     */
+    DynamoDBService.prototype.updateItem = function (input) {
+        return __awaiter(this, void 0, void 0, function () {
+            var response;
+            return __generator(this, function (_a) {
+                switch (_a.label) {
+                    case 0:
+                        this.logger.info('Updating DynamoDB item', {
+                            input: filterFieldsForLogLevel(this.logger, input, UPDATE_ITEM_SAFE_FIELDS),
+                        });
+                        return [4 /*yield*/, this.client.send(new UpdateCommand(input))];
+                    case 1:
+                        response = _a.sent();
+                        return [2 /*return*/, response];
+                }
+            });
+        });
+    };
+    /**
+     * Delete an item from DynamoDB. The `Attributes` field on the response is
+     * typed as `R` — relevant when `ReturnValues: 'ALL_OLD'` is set.
+     * @template K - Shape of the partition / sort key.
+     * @template R - Expected shape of the returned `Attributes`.
+     */
+    DynamoDBService.prototype.deleteItem = function (input) {
+        return __awaiter(this, void 0, void 0, function () {
+            var response;
+            return __generator(this, function (_a) {
+                switch (_a.label) {
+                    case 0:
+                        this.logger.info('Deleting DynamoDB item', {
+                            input: filterFieldsForLogLevel(this.logger, input, DELETE_ITEM_SAFE_FIELDS),
+                        });
+                        return [4 /*yield*/, this.client.send(new DeleteCommand(input))];
+                    case 1:
+                        response = _a.sent();
+                        return [2 /*return*/, response];
+                }
+            });
+        });
+    };
+    /**
+     * Execute a DynamoDB Query. The full `QueryCommandOutput` is returned with
+     * `Items` typed as `T[]` so callers retain pagination metadata
+     * (`LastEvaluatedKey`, `Count`, etc.).
+     * @template T - Expected shape of each unmarshalled item.
+     */
+    DynamoDBService.prototype.query = function (input) {
+        return __awaiter(this, void 0, void 0, function () {
+            var response;
+            return __generator(this, function (_a) {
+                switch (_a.label) {
+                    case 0:
+                        this.logger.info('Querying DynamoDB', {
+                            input: filterFieldsForLogLevel(this.logger, input, QUERY_SAFE_FIELDS),
+                        });
+                        return [4 /*yield*/, this.client.send(new QueryCommand(input))];
+                    case 1:
+                        response = _a.sent();
+                        return [2 /*return*/, response];
+                }
+            });
+        });
+    };
+    /**
+     * Scan a DynamoDB table. The full `ScanCommandOutput` is returned with
+     * `Items` typed as `T[]` so callers retain pagination metadata.
+     *
+     * Scan reads every item in the table, so cost and latency grow linearly
+     * with table size; it is rarely the right tool in a runtime service.
+     * Prefer, in order:
+     *
+     *   1. `query` with the table's partition key.
+     *   2. `query` against a GSI or LSI whose key matches your access pattern.
+     *   3. A sparse GSI populated only for the items you need to enumerate.
+     *   4. A denormalised lookup item or table maintained on write.
+     *
+     * Legitimate scan use cases are mostly one-off admin work (export,
+     * migration, audit). For those, prefer the AWS CLI or Console rather than
+     * embedding a scan in a Lambda.
+     *
+     * @template T - Expected shape of each unmarshalled item.
+     */
+    DynamoDBService.prototype.scan = function (input) {
+        return __awaiter(this, void 0, void 0, function () {
+            var response;
+            return __generator(this, function (_a) {
+                switch (_a.label) {
+                    case 0:
+                        this.logger.info('Scanning DynamoDB', {
+                            input: filterFieldsForLogLevel(this.logger, input, SCAN_SAFE_FIELDS),
+                        });
+                        return [4 /*yield*/, this.client.send(new ScanCommand(input))];
+                    case 1:
+                        response = _a.sent();
+                        return [2 /*return*/, response];
+                }
+            });
+        });
+    };
+    /**
+     * Batch-get items from one or more DynamoDB tables.
+     *
+     * Note: this method is intentionally **not** generic. `BatchGet`'s
+     * `Responses` field is a multi-table `Record<string, item[]>` whose item
+     * shapes can differ per table — no single `T` can soundly describe it.
+     * Callers should narrow the result type at the call site.
+     */
+    DynamoDBService.prototype.batchGet = function (input) {
+        return __awaiter(this, void 0, void 0, function () {
+            var isDebug;
+            var _a;
+            return __generator(this, function (_b) {
+                isDebug = this.logger.getLevelName() === 'DEBUG';
+                this.logger.info('Batch getting DynamoDB items', {
+                    input: isDebug ? input : { tables: Object.keys((_a = input.RequestItems) !== null && _a !== void 0 ? _a : {}) },
+                });
+                return [2 /*return*/, this.client.send(new BatchGetCommand(input))];
+            });
+        });
+    };
+    /**
+     * Batch-write items to DynamoDB, retrying `UnprocessedItems` with jittered
+     * exponential backoff. Up to 5 attempts (200ms base delay). Throws when
+     * items remain unprocessed after the final attempt.
+     */
+    DynamoDBService.prototype.batchWrite = function (input) {
+        return __awaiter(this, void 0, void 0, function () {
+            var isDebug, current, attempt, response, unprocessed;
+            var _a;
+            return __generator(this, function (_b) {
+                switch (_b.label) {
+                    case 0:
+                        isDebug = this.logger.getLevelName() === 'DEBUG';
+                        this.logger.info('Batch writing DynamoDB items', {
+                            input: isDebug ? input : { tables: Object.keys((_a = input.RequestItems) !== null && _a !== void 0 ? _a : {}) },
+                        });
+                        current = input;
+                        attempt = 0;
+                        _b.label = 1;
+                    case 1:
+                        if (!(attempt < BATCH_WRITE_MAX_ATTEMPTS)) return [3 /*break*/, 6];
+                        return [4 /*yield*/, this.client.send(new BatchWriteCommand(current))];
+                    case 2:
+                        response = _b.sent();
+                        unprocessed = response.UnprocessedItems;
+                        if (!unprocessed || Object.keys(unprocessed).length === 0)
+                            return [2 /*return*/, response];
+                        this.logger.warn('Retrying unprocessed DynamoDB items', {
+                            attempt: attempt + 1,
+                            tables: Object.keys(unprocessed),
+                        });
+                        if (!(attempt < BATCH_WRITE_MAX_ATTEMPTS - 1)) return [3 /*break*/, 4];
+                        return [4 /*yield*/, sleep(backoffDelay(attempt))];
+                    case 3:
+                        _b.sent();
+                        _b.label = 4;
+                    case 4:
+                        current = __assign(__assign({}, input), { RequestItems: unprocessed });
+                        _b.label = 5;
+                    case 5:
+                        attempt++;
+                        return [3 /*break*/, 1];
+                    case 6: throw new Error("batchWrite failed after ".concat(BATCH_WRITE_MAX_ATTEMPTS, " attempts"));
+                }
+            });
+        });
+    };
+    /**
+     * Paginate over Query results, yielding one unmarshalled item at a time.
+     * @template T - Expected shape of each yielded item.
+     */
+    DynamoDBService.prototype.paginateItems = function (input) {
+        return __asyncGenerator(this, arguments, function paginateItems_1() {
+            var paginator, _a, paginator_1, paginator_1_1, page, _i, _b, item, e_1_1;
+            var _c, e_1, _d, _e;
+            return __generator(this, function (_f) {
+                switch (_f.label) {
+                    case 0:
+                        this.logger.info('Paginating DynamoDB query', {
+                            input: filterFieldsForLogLevel(this.logger, input, QUERY_SAFE_FIELDS),
+                        });
+                        paginator = paginateQuery({ client: this.client }, input);
+                        _f.label = 1;
+                    case 1:
+                        _f.trys.push([1, 10, 11, 16]);
+                        _a = true, paginator_1 = __asyncValues(paginator);
+                        _f.label = 2;
+                    case 2: return [4 /*yield*/, __await(paginator_1.next())];
+                    case 3:
+                        if (!(paginator_1_1 = _f.sent(), _c = paginator_1_1.done, !_c)) return [3 /*break*/, 9];
+                        _e = paginator_1_1.value;
+                        _a = false;
+                        page = _e;
+                        if (!page.Items)
+                            return [3 /*break*/, 8];
+                        _i = 0, _b = page.Items;
+                        _f.label = 4;
+                    case 4:
+                        if (!(_i < _b.length)) return [3 /*break*/, 8];
+                        item = _b[_i];
+                        return [4 /*yield*/, __await(item)];
+                    case 5: return [4 /*yield*/, _f.sent()];
+                    case 6:
+                        _f.sent();
+                        _f.label = 7;
+                    case 7:
+                        _i++;
+                        return [3 /*break*/, 4];
+                    case 8:
+                        _a = true;
+                        return [3 /*break*/, 2];
+                    case 9: return [3 /*break*/, 16];
+                    case 10:
+                        e_1_1 = _f.sent();
+                        e_1 = { error: e_1_1 };
+                        return [3 /*break*/, 16];
+                    case 11:
+                        _f.trys.push([11, , 14, 15]);
+                        if (!(!_a && !_c && (_d = paginator_1.return))) return [3 /*break*/, 13];
+                        return [4 /*yield*/, __await(_d.call(paginator_1))];
+                    case 12:
+                        _f.sent();
+                        _f.label = 13;
+                    case 13: return [3 /*break*/, 15];
+                    case 14:
+                        if (e_1) throw e_1.error;
+                        return [7 /*endfinally*/];
+                    case 15: return [7 /*endfinally*/];
+                    case 16: return [2 /*return*/];
+                }
+            });
+        });
+    };
+    /**
+     * Paginate over Scan results, yielding one unmarshalled item at a time.
+     * @template T - Expected shape of each yielded item.
+     */
+    DynamoDBService.prototype.paginateScan = function (input) {
+        return __asyncGenerator(this, arguments, function paginateScan_1() {
+            var paginator, _a, paginator_2, paginator_2_1, page, _i, _b, item, e_2_1;
+            var _c, e_2, _d, _e;
+            return __generator(this, function (_f) {
+                switch (_f.label) {
+                    case 0:
+                        this.logger.info('Paginating DynamoDB scan', {
+                            input: filterFieldsForLogLevel(this.logger, input, SCAN_SAFE_FIELDS),
+                        });
+                        paginator = paginateScan({ client: this.client }, input);
+                        _f.label = 1;
+                    case 1:
+                        _f.trys.push([1, 10, 11, 16]);
+                        _a = true, paginator_2 = __asyncValues(paginator);
+                        _f.label = 2;
+                    case 2: return [4 /*yield*/, __await(paginator_2.next())];
+                    case 3:
+                        if (!(paginator_2_1 = _f.sent(), _c = paginator_2_1.done, !_c)) return [3 /*break*/, 9];
+                        _e = paginator_2_1.value;
+                        _a = false;
+                        page = _e;
+                        if (!page.Items)
+                            return [3 /*break*/, 8];
+                        _i = 0, _b = page.Items;
+                        _f.label = 4;
+                    case 4:
+                        if (!(_i < _b.length)) return [3 /*break*/, 8];
+                        item = _b[_i];
+                        return [4 /*yield*/, __await(item)];
+                    case 5: return [4 /*yield*/, _f.sent()];
+                    case 6:
+                        _f.sent();
+                        _f.label = 7;
+                    case 7:
+                        _i++;
+                        return [3 /*break*/, 4];
+                    case 8:
+                        _a = true;
+                        return [3 /*break*/, 2];
+                    case 9: return [3 /*break*/, 16];
+                    case 10:
+                        e_2_1 = _f.sent();
+                        e_2 = { error: e_2_1 };
+                        return [3 /*break*/, 16];
+                    case 11:
+                        _f.trys.push([11, , 14, 15]);
+                        if (!(!_a && !_c && (_d = paginator_2.return))) return [3 /*break*/, 13];
+                        return [4 /*yield*/, __await(_d.call(paginator_2))];
+                    case 12:
+                        _f.sent();
+                        _f.label = 13;
+                    case 13: return [3 /*break*/, 15];
+                    case 14:
+                        if (e_2) throw e_2.error;
+                        return [7 /*endfinally*/];
+                    case 15: return [7 /*endfinally*/];
+                    case 16: return [2 /*return*/];
+                }
+            });
+        });
+    };
+    return DynamoDBService;
+}());
+
+var DEFAULT_PRESIGNED_URL_EXPIRES_IN_SECONDS = 3600;
+var DELETE_OBJECTS_BATCH_LIMIT = 1000;
+/**
+ * Fields safe to log at INFO for `putObject`. Omits `Body` (object payload).
+ * `POWERTOOLS_LOG_LEVEL=DEBUG` unlocks the full input.
+ */
+var PUT_OBJECT_SAFE_FIELDS = ['Bucket', 'Key'];
+/**
+ * Fields safe to log at INFO for `putJsonObject`. Omits `Body` (the
+ * unserialised JSON payload). `Metadata` is included (operational labels).
+ * `POWERTOOLS_LOG_LEVEL=DEBUG` unlocks the full input.
+ */
+var PUT_JSON_OBJECT_SAFE_FIELDS = [
+    'Bucket',
+    'Key',
+    'Metadata',
+];
+/**
+ * Wrapper around the AWS S3 client providing structured Powertools logging
+ * and X-Ray tracing by default.
+ *
+ * Input shapes are intentionally tight (Bucket/Key/Body only). Callers
+ * needing SDK-level options not exposed here (server-side encryption,
+ * tagging, version IDs) should use `S3Client` directly.
+ */
+var S3Service = /** @class */ (function () {
+    /**
+     * @param opts.logger - Optional Powertools logger. Defaults to `new Logger()`,
+     * which picks up `POWERTOOLS_SERVICE_NAME` from the environment.
+     * @param opts.client - Optional pre-configured `S3Client`. When supplied,
+     * the wrapper does not apply X-Ray instrumentation.
+     */
+    function S3Service(opts) {
+        var _a, _b;
+        this.client = (_a = opts === null || opts === void 0 ? void 0 : opts.client) !== null && _a !== void 0 ? _a : xray.captureAWSv3Client(new S3Client());
+        this.logger = (_b = opts === null || opts === void 0 ? void 0 : opts.logger) !== null && _b !== void 0 ? _b : new Logger();
+    }
+    /**
+     * Put an object into S3.
+     *
+     * Note: the structured log line only includes `Bucket` and `Key` —
+     * `Body` is omitted to avoid spilling large payloads or sensitive
+     * content into CloudWatch.
+     *
+     * @param input - Bucket, Key, and Body of the object to store.
+     */
+    S3Service.prototype.putObject = function (input) {
+        return __awaiter(this, void 0, void 0, function () {
+            return __generator(this, function (_a) {
+                this.logger.info('Putting S3 object', {
+                    input: filterFieldsForLogLevel(this.logger, input, PUT_OBJECT_SAFE_FIELDS),
+                });
+                return [2 /*return*/, this.client.send(new PutObjectCommand(input))];
+            });
+        });
+    };
+    /**
+     * Serialise a value to JSON and store it as an S3 object.
+     *
+     * Note: the structured log line only includes `Bucket` and `Key` —
+     * the JSON-encoded body is omitted to avoid spilling potentially
+     * large or sensitive content into CloudWatch.
+     *
+     * @template T - Type of the value being stored.
+     */
+    S3Service.prototype.putJsonObject = function (input) {
+        return __awaiter(this, void 0, void 0, function () {
+            return __generator(this, function (_a) {
+                this.logger.info('Putting S3 JSON object', {
+                    input: filterFieldsForLogLevel(this.logger, input, PUT_JSON_OBJECT_SAFE_FIELDS),
+                });
+                return [2 /*return*/, this.client.send(new PutObjectCommand({
+                        Bucket: input.Bucket,
+                        Key: input.Key,
+                        Body: JSON.stringify(input.Body),
+                        Metadata: input.Metadata,
+                    }))];
+            });
+        });
+    };
+    /**
+     * Get an object from S3.
+     */
+    S3Service.prototype.getObject = function (input) {
+        return __awaiter(this, void 0, void 0, function () {
+            return __generator(this, function (_a) {
+                this.logger.info('Getting S3 object', { input: input });
+                return [2 /*return*/, this.client.send(new GetObjectCommand(input))];
+            });
+        });
+    };
+    /**
+     * Get an object from S3 and return its body as a string.
+     * @returns The object body as a string, or `undefined` if the response
+     * has no body.
+     */
+    S3Service.prototype.getObjectBody = function (input) {
+        return __awaiter(this, void 0, void 0, function () {
+            var response;
+            var _a;
+            return __generator(this, function (_b) {
+                switch (_b.label) {
+                    case 0:
+                        this.logger.info('Getting S3 object body', { input: input });
+                        return [4 /*yield*/, this.client.send(new GetObjectCommand(input))];
+                    case 1:
+                        response = _b.sent();
+                        return [2 /*return*/, (_a = response.Body) === null || _a === void 0 ? void 0 : _a.transformToString()];
+                }
+            });
+        });
+    };
+    /**
+     * Get an object from S3 and parse it as JSON.
+     * @template T - Expected type of the parsed value.
+     * @returns The parsed value, or `undefined` if the response has no body.
+     * @throws If the body is non-empty and not valid JSON.
+     */
+    S3Service.prototype.getJsonObject = function (input) {
+        return __awaiter(this, void 0, void 0, function () {
+            var response, body;
+            var _a;
+            return __generator(this, function (_b) {
+                switch (_b.label) {
+                    case 0:
+                        this.logger.info('Getting S3 JSON object', { input: input });
+                        return [4 /*yield*/, this.client.send(new GetObjectCommand(input))];
+                    case 1:
+                        response = _b.sent();
+                        return [4 /*yield*/, ((_a = response.Body) === null || _a === void 0 ? void 0 : _a.transformToString())];
+                    case 2:
+                        body = _b.sent();
+                        return [2 /*return*/, body ? JSON.parse(body) : undefined];
+                }
+            });
+        });
+    };
+    /**
+     * Fetch the metadata for an S3 object without downloading its body.
+     */
+    S3Service.prototype.headObject = function (input) {
+        return __awaiter(this, void 0, void 0, function () {
+            return __generator(this, function (_a) {
+                this.logger.info('Fetching S3 object metadata', { input: input });
+                return [2 /*return*/, this.client.send(new HeadObjectCommand(input))];
+            });
+        });
+    };
+    /**
+     * Copy an object within S3.
+     */
+    S3Service.prototype.copyObject = function (input) {
+        return __awaiter(this, void 0, void 0, function () {
+            return __generator(this, function (_a) {
+                this.logger.info('Copying S3 object', { input: input });
+                return [2 /*return*/, this.client.send(new CopyObjectCommand(input))];
+            });
+        });
+    };
+    /**
+     * List object keys under a bucket and optional prefix, auto-paginating
+     * across all pages.
+     */
+    S3Service.prototype.listObjects = function (bucket, prefix) {
+        return __awaiter(this, void 0, void 0, function () {
+            var paginator, keys, _a, paginator_1, paginator_1_1, page, _i, _b, object, e_1_1;
+            var _c, e_1, _d, _e;
+            var _f;
+            return __generator(this, function (_g) {
+                switch (_g.label) {
+                    case 0:
+                        this.logger.info('Listing S3 objects', { input: { bucket: bucket, prefix: prefix } });
+                        paginator = paginateListObjectsV2({ client: this.client }, { Bucket: bucket, Prefix: prefix });
+                        keys = [];
+                        _g.label = 1;
+                    case 1:
+                        _g.trys.push([1, 6, 7, 12]);
+                        _a = true, paginator_1 = __asyncValues(paginator);
+                        _g.label = 2;
+                    case 2: return [4 /*yield*/, paginator_1.next()];
+                    case 3:
+                        if (!(paginator_1_1 = _g.sent(), _c = paginator_1_1.done, !_c)) return [3 /*break*/, 5];
+                        _e = paginator_1_1.value;
+                        _a = false;
+                        page = _e;
+                        for (_i = 0, _b = (_f = page.Contents) !== null && _f !== void 0 ? _f : []; _i < _b.length; _i++) {
+                            object = _b[_i];
+                            if (object.Key)
+                                keys.push(object.Key);
+                        }
+                        _g.label = 4;
+                    case 4:
+                        _a = true;
+                        return [3 /*break*/, 2];
+                    case 5: return [3 /*break*/, 12];
+                    case 6:
+                        e_1_1 = _g.sent();
+                        e_1 = { error: e_1_1 };
+                        return [3 /*break*/, 12];
+                    case 7:
+                        _g.trys.push([7, , 10, 11]);
+                        if (!(!_a && !_c && (_d = paginator_1.return))) return [3 /*break*/, 9];
+                        return [4 /*yield*/, _d.call(paginator_1)];
+                    case 8:
+                        _g.sent();
+                        _g.label = 9;
+                    case 9: return [3 /*break*/, 11];
+                    case 10:
+                        if (e_1) throw e_1.error;
+                        return [7 /*endfinally*/];
+                    case 11: return [7 /*endfinally*/];
+                    case 12: return [2 /*return*/, keys];
+                }
+            });
+        });
+    };
+    /**
+     * List and JSON-parse every object under a bucket and optional prefix.
+     * Auto-paginated. Objects without a body are skipped.
+     * @template T - Expected type of each parsed object.
+     */
+    S3Service.prototype.getAllObjects = function (bucket, prefix) {
+        return __awaiter(this, void 0, void 0, function () {
+            var paginator, bodies, _a, paginator_2, paginator_2_1, page, _i, _b, object, response, body, e_2_1;
+            var _c, e_2, _d, _e;
+            var _f, _g;
+            return __generator(this, function (_h) {
+                switch (_h.label) {
+                    case 0:
+                        this.logger.info('Getting all S3 objects', { input: { bucket: bucket, prefix: prefix } });
+                        paginator = paginateListObjectsV2({ client: this.client }, { Bucket: bucket, Prefix: prefix });
+                        bodies = [];
+                        _h.label = 1;
+                    case 1:
+                        _h.trys.push([1, 10, 11, 16]);
+                        _a = true, paginator_2 = __asyncValues(paginator);
+                        _h.label = 2;
+                    case 2: return [4 /*yield*/, paginator_2.next()];
+                    case 3:
+                        if (!(paginator_2_1 = _h.sent(), _c = paginator_2_1.done, !_c)) return [3 /*break*/, 9];
+                        _e = paginator_2_1.value;
+                        _a = false;
+                        page = _e;
+                        _i = 0, _b = (_f = page.Contents) !== null && _f !== void 0 ? _f : [];
+                        _h.label = 4;
+                    case 4:
+                        if (!(_i < _b.length)) return [3 /*break*/, 8];
+                        object = _b[_i];
+                        if (!object.Key)
+                            return [3 /*break*/, 7];
+                        return [4 /*yield*/, this.client.send(new GetObjectCommand({ Bucket: bucket, Key: object.Key }))];
+                    case 5:
+                        response = _h.sent();
+                        return [4 /*yield*/, ((_g = response.Body) === null || _g === void 0 ? void 0 : _g.transformToString())];
+                    case 6:
+                        body = _h.sent();
+                        if (body)
+                            bodies.push(JSON.parse(body));
+                        _h.label = 7;
+                    case 7:
+                        _i++;
+                        return [3 /*break*/, 4];
+                    case 8:
+                        _a = true;
+                        return [3 /*break*/, 2];
+                    case 9: return [3 /*break*/, 16];
+                    case 10:
+                        e_2_1 = _h.sent();
+                        e_2 = { error: e_2_1 };
+                        return [3 /*break*/, 16];
+                    case 11:
+                        _h.trys.push([11, , 14, 15]);
+                        if (!(!_a && !_c && (_d = paginator_2.return))) return [3 /*break*/, 13];
+                        return [4 /*yield*/, _d.call(paginator_2)];
+                    case 12:
+                        _h.sent();
+                        _h.label = 13;
+                    case 13: return [3 /*break*/, 15];
+                    case 14:
+                        if (e_2) throw e_2.error;
+                        return [7 /*endfinally*/];
+                    case 15: return [7 /*endfinally*/];
+                    case 16: return [2 /*return*/, bodies];
+                }
+            });
+        });
+    };
+    /**
+     * Generate a presigned URL that callers can use to GET or PUT an S3 object
+     * directly, without going through the wrapper. The signing happens against
+     * the wrapper's `S3Client`, so callers do not need their own client.
+     *
+     * GET URLs are signed with `ResponseContentDisposition: 'attachment'` so
+     * browsers download the object rather than rendering it in-place.
+     *
+     * The input shape is an inline object (rather than the `Required<Pick<...>>`
+     * pattern used by other S3 methods) because this method wraps two SDK
+     * commands rather than one, and `action` / `expiresIn` are wrapper-level
+     * concerns with no SDK-input equivalent.
+     *
+     * @param input.Bucket - The S3 bucket name.
+     * @param input.Key - The S3 object key.
+     * @param input.action - `'get'` to download, `'put'` to upload.
+     * @param input.expiresIn - URL lifetime in seconds. Defaults to 3600 (1 hour).
+     */
+    S3Service.prototype.getPresignedUrl = function (input) {
+        return __awaiter(this, void 0, void 0, function () {
+            var expiresIn, command;
+            var _a;
+            return __generator(this, function (_b) {
+                expiresIn = (_a = input.expiresIn) !== null && _a !== void 0 ? _a : DEFAULT_PRESIGNED_URL_EXPIRES_IN_SECONDS;
+                this.logger.info('Generating S3 presigned URL', {
+                    input: { Bucket: input.Bucket, Key: input.Key, action: input.action, expiresIn: expiresIn },
+                });
+                command = input.action === 'get'
+                    ? new GetObjectCommand({
+                        Bucket: input.Bucket,
+                        Key: input.Key,
+                        ResponseContentDisposition: 'attachment',
+                    })
+                    : new PutObjectCommand({ Bucket: input.Bucket, Key: input.Key });
+                return [2 /*return*/, getSignedUrl(this.client, command, { expiresIn: expiresIn })];
+            });
+        });
+    };
+    /**
+     * Delete a single object from S3.
+     */
+    S3Service.prototype.deleteObject = function (input) {
+        return __awaiter(this, void 0, void 0, function () {
+            return __generator(this, function (_a) {
+                this.logger.info('Deleting S3 object', { input: input });
+                return [2 /*return*/, this.client.send(new DeleteObjectCommand(input))];
+            });
+        });
+    };
+    /**
+     * Delete multiple objects from S3, auto-chunking the request into batches
+     * of 1000 keys (the S3-enforced DeleteObjects limit). Returns one output
+     * per chunk.
+     */
+    S3Service.prototype.deleteObjects = function (bucket, keys) {
+        return __awaiter(this, void 0, void 0, function () {
+            var isDebug, results, i, batch, _a, _b;
+            return __generator(this, function (_c) {
+                switch (_c.label) {
+                    case 0:
+                        isDebug = this.logger.getLevelName() === 'DEBUG';
+                        this.logger.info('Deleting S3 objects', {
+                            input: isDebug ? { bucket: bucket, keys: keys } : { bucket: bucket, keyCount: keys.length },
+                        });
+                        results = [];
+                        i = 0;
+                        _c.label = 1;
+                    case 1:
+                        if (!(i < keys.length)) return [3 /*break*/, 4];
+                        batch = keys.slice(i, i + DELETE_OBJECTS_BATCH_LIMIT);
+                        _b = (_a = results).push;
+                        return [4 /*yield*/, this.client.send(new DeleteObjectsCommand({
+                                Bucket: bucket,
+                                Delete: { Objects: batch.map(function (Key) { return ({ Key: Key }); }) },
+                            }))];
+                    case 2:
+                        _b.apply(_a, [_c.sent()]);
+                        _c.label = 3;
+                    case 3:
+                        i += DELETE_OBJECTS_BATCH_LIMIT;
+                        return [3 /*break*/, 1];
+                    case 4: return [2 /*return*/, results];
+                }
+            });
+        });
+    };
+    /**
+     * Delete every object in a bucket. Streams the listing page-by-page and
+     * delegates each page's deletion to `deleteObjects`, so peak memory stays
+     * bounded by one page (~1000 keys) regardless of bucket size.
+     * @returns The keys of every deleted object.
+     */
+    S3Service.prototype.emptyBucket = function (bucket) {
+        return __awaiter(this, void 0, void 0, function () {
+            var paginator, deletedKeys, _a, paginator_3, paginator_3_1, page, keys, e_3_1;
+            var _b, e_3, _c, _d;
+            var _e;
+            return __generator(this, function (_f) {
+                switch (_f.label) {
+                    case 0:
+                        this.logger.info('Emptying S3 bucket', { input: { bucket: bucket } });
+                        paginator = paginateListObjectsV2({ client: this.client }, { Bucket: bucket });
+                        deletedKeys = [];
+                        _f.label = 1;
+                    case 1:
+                        _f.trys.push([1, 7, 8, 13]);
+                        _a = true, paginator_3 = __asyncValues(paginator);
+                        _f.label = 2;
+                    case 2: return [4 /*yield*/, paginator_3.next()];
+                    case 3:
+                        if (!(paginator_3_1 = _f.sent(), _b = paginator_3_1.done, !_b)) return [3 /*break*/, 6];
+                        _d = paginator_3_1.value;
+                        _a = false;
+                        page = _d;
+                        keys = ((_e = page.Contents) !== null && _e !== void 0 ? _e : []).flatMap(function (o) { return (o.Key ? [o.Key] : []); });
+                        if (keys.length === 0)
+                            return [3 /*break*/, 5];
+                        return [4 /*yield*/, this.deleteObjects(bucket, keys)];
+                    case 4:
+                        _f.sent();
+                        deletedKeys.push.apply(deletedKeys, keys);
+                        _f.label = 5;
+                    case 5:
+                        _a = true;
+                        return [3 /*break*/, 2];
+                    case 6: return [3 /*break*/, 13];
+                    case 7:
+                        e_3_1 = _f.sent();
+                        e_3 = { error: e_3_1 };
+                        return [3 /*break*/, 13];
+                    case 8:
+                        _f.trys.push([8, , 11, 12]);
+                        if (!(!_a && !_b && (_c = paginator_3.return))) return [3 /*break*/, 10];
+                        return [4 /*yield*/, _c.call(paginator_3)];
+                    case 9:
+                        _f.sent();
+                        _f.label = 10;
+                    case 10: return [3 /*break*/, 12];
+                    case 11:
+                        if (e_3) throw e_3.error;
+                        return [7 /*endfinally*/];
+                    case 12: return [7 /*endfinally*/];
+                    case 13: return [2 /*return*/, deletedKeys];
+                }
+            });
+        });
+    };
+    return S3Service;
+}());
+
+/**
+ * Fields safe to log at INFO level. Omits `SecretString` and `SecretBinary` —
+ * the secret material itself. `POWERTOOLS_LOG_LEVEL=DEBUG` unlocks the full
+ * input.
+ */
+var CREATE_SECRET_SAFE_FIELDS = [
+    'Name',
+    'Description',
+    'KmsKeyId',
+    'Tags',
+    'ClientRequestToken',
+    'AddReplicaRegions',
+    'ForceOverwriteReplicaSecret',
+];
+var UPDATE_SECRET_SAFE_FIELDS = [
+    'SecretId',
+    'Description',
+    'KmsKeyId',
+    'ClientRequestToken',
+];
+var PUT_SECRET_VALUE_SAFE_FIELDS = [
+    'SecretId',
+    'VersionStages',
+    'ClientRequestToken',
+];
+/**
+ * `DeleteSecretCommandInput` carries no secret material today, but the
+ * explicit allowlist keeps the log shape consistent with the other write
+ * methods and protects against future field additions.
+ */
+var DELETE_SECRET_SAFE_FIELDS = [
+    'SecretId',
+    'RecoveryWindowInDays',
+    'ForceDeleteWithoutRecovery',
+];
+/**
+ * Wrapper around the AWS Secrets Manager client providing structured
+ * Powertools logging and X-Ray tracing by default.
+ *
+ * Write operations (`createSecret`, `updateSecret`, `putSecretValue`,
+ * `deleteSecret`) are exposed for convenience but should be used with care:
+ * secret lifecycle is usually managed by IaC (CDK / Terraform). Prefer IaC
+ * for anything that exists at deploy time; reserve runtime writes for
+ * dynamically-issued credentials, rotation flows, or other genuinely
+ * mutable values.
+ */
+var SecretsManagerService = /** @class */ (function () {
+    /**
+     * @param opts.logger - Optional Powertools logger. Defaults to `new Logger()`,
+     * which picks up `POWERTOOLS_SERVICE_NAME` from the environment.
+     * @param opts.client - Optional pre-configured `SecretsManagerClient`. When
+     * supplied, the wrapper does not apply X-Ray instrumentation — the caller
+     * owns that decision.
+     */
+    function SecretsManagerService(opts) {
+        var _a, _b;
+        this.client = (_a = opts === null || opts === void 0 ? void 0 : opts.client) !== null && _a !== void 0 ? _a : xray.captureAWSv3Client(new SecretsManagerClient());
+        this.logger = (_b = opts === null || opts === void 0 ? void 0 : opts.logger) !== null && _b !== void 0 ? _b : new Logger();
+    }
+    /**
+     * Fetch a secret's string value from Secrets Manager.
+     * @param secretId - The ARN or friendly name of the secret.
+     * @returns The secret's `SecretString` value.
+     * @throws If the response does not contain a `SecretString` (e.g. the secret
+     * stores binary data).
+     */
+    SecretsManagerService.prototype.getSecret = function (secretId) {
+        return __awaiter(this, void 0, void 0, function () {
+            return __generator(this, function (_a) {
+                this.logger.info('Fetching secret', { input: { secretId: secretId } });
+                return [2 /*return*/, this.fetchSecretString(secretId)];
+            });
+        });
+    };
+    /**
+     * Fetch a secret and parse it as JSON.
+     * @param secretId - The ARN or friendly name of the secret.
+     * @template T - Expected shape of the parsed secret.
+     * @returns The parsed secret value.
+     * @throws If the secret has no `SecretString` or the value is not valid JSON.
+     */
+    SecretsManagerService.prototype.getJsonSecret = function (secretId) {
+        return __awaiter(this, void 0, void 0, function () {
+            var secretString;
+            return __generator(this, function (_a) {
+                switch (_a.label) {
+                    case 0:
+                        this.logger.info('Fetching JSON secret', { input: { secretId: secretId } });
+                        return [4 /*yield*/, this.fetchSecretString(secretId)];
+                    case 1:
+                        secretString = _a.sent();
+                        return [2 /*return*/, JSON.parse(secretString)];
+                }
+            });
+        });
+    };
+    /**
+     * Create a new secret. At INFO level the log line includes only identity
+     * and non-secret metadata; `POWERTOOLS_LOG_LEVEL=DEBUG` unlocks the full
+     * input (including `SecretString` / `SecretBinary`).
+     *
+     * Prefer IaC (CDK / Terraform) for secret lifecycle — use this for
+     * dynamically-issued credentials only.
+     */
+    SecretsManagerService.prototype.createSecret = function (input) {
+        return __awaiter(this, void 0, void 0, function () {
+            return __generator(this, function (_a) {
+                this.logger.info('Creating secret', {
+                    input: filterFieldsForLogLevel(this.logger, input, CREATE_SECRET_SAFE_FIELDS),
+                });
+                return [2 /*return*/, this.client.send(new CreateSecretCommand(input))];
+            });
+        });
+    };
+    /**
+     * Update an existing secret's metadata or value. At INFO level the log
+     * line omits `SecretString` / `SecretBinary`; `POWERTOOLS_LOG_LEVEL=DEBUG`
+     * unlocks the full input.
+     *
+     * Prefer IaC (CDK / Terraform) for secret lifecycle — use this for
+     * runtime metadata updates only.
+     */
+    SecretsManagerService.prototype.updateSecret = function (input) {
+        return __awaiter(this, void 0, void 0, function () {
+            return __generator(this, function (_a) {
+                this.logger.info('Updating secret', {
+                    input: filterFieldsForLogLevel(this.logger, input, UPDATE_SECRET_SAFE_FIELDS),
+                });
+                return [2 /*return*/, this.client.send(new UpdateSecretCommand(input))];
+            });
+        });
+    };
+    /**
+     * Store a new version of a secret's value. At INFO level the log line
+     * omits `SecretString` / `SecretBinary`; `POWERTOOLS_LOG_LEVEL=DEBUG`
+     * unlocks the full input.
+     *
+     * Typically used by rotation flows.
+     */
+    SecretsManagerService.prototype.putSecretValue = function (input) {
+        return __awaiter(this, void 0, void 0, function () {
+            return __generator(this, function (_a) {
+                this.logger.info('Putting secret value', {
+                    input: filterFieldsForLogLevel(this.logger, input, PUT_SECRET_VALUE_SAFE_FIELDS),
+                });
+                return [2 /*return*/, this.client.send(new PutSecretValueCommand(input))];
+            });
+        });
+    };
+    /**
+     * Delete a secret. Pass `ForceDeleteWithoutRecovery: true` to bypass the
+     * default 7-30 day recovery window (irreversible).
+     *
+     * Prefer IaC (CDK / Terraform) for secret lifecycle.
+     */
+    SecretsManagerService.prototype.deleteSecret = function (input) {
+        return __awaiter(this, void 0, void 0, function () {
+            return __generator(this, function (_a) {
+                this.logger.info('Deleting secret', {
+                    input: filterFieldsForLogLevel(this.logger, input, DELETE_SECRET_SAFE_FIELDS),
+                });
+                return [2 /*return*/, this.client.send(new DeleteSecretCommand(input))];
+            });
+        });
+    };
+    SecretsManagerService.prototype.fetchSecretString = function (secretId) {
+        return __awaiter(this, void 0, void 0, function () {
+            var response;
+            return __generator(this, function (_a) {
+                switch (_a.label) {
+                    case 0: return [4 /*yield*/, this.client.send(new GetSecretValueCommand({ SecretId: secretId }))];
+                    case 1:
+                        response = _a.sent();
+                        if (response.SecretString === undefined) {
+                            throw new Error("Secret '".concat(secretId, "' does not contain a string value"));
+                        }
+                        return [2 /*return*/, response.SecretString];
+                }
+            });
+        });
+    };
+    return SecretsManagerService;
+}());
+
+/**
+ * Fields safe to log at INFO for `startExecution`. Omits `input` — the SFN
+ * execution payload, which routinely carries PII (customer IDs, addresses,
+ * order contents, etc.). `POWERTOOLS_LOG_LEVEL=DEBUG` unlocks the full input.
+ */
+var START_EXECUTION_SAFE_FIELDS = [
+    'stateMachineArn',
+    'name',
+    'traceHeader',
+];
+/**
+ * Wrapper around the AWS Step Functions client providing structured
+ * Powertools logging and X-Ray tracing by default.
+ */
+var StepFunctionsService = /** @class */ (function () {
+    /**
+     * @param opts.logger - Optional Powertools logger. Defaults to `new Logger()`,
+     * which picks up `POWERTOOLS_SERVICE_NAME` from the environment.
+     * @param opts.client - Optional pre-configured `SFNClient`. When supplied,
+     * the wrapper does not apply X-Ray instrumentation.
+     */
+    function StepFunctionsService(opts) {
+        var _a, _b;
+        this.client = (_a = opts === null || opts === void 0 ? void 0 : opts.client) !== null && _a !== void 0 ? _a : xray.captureAWSv3Client(new SFNClient());
+        this.logger = (_b = opts === null || opts === void 0 ? void 0 : opts.logger) !== null && _b !== void 0 ? _b : new Logger();
+    }
+    /**
+     * List all executions for a state machine, auto-paginating across all
+     * pages. Typically bounded by `statusFilter` and state-machine retention,
+     * so the flat-array shape is safe in practice.
+     */
+    StepFunctionsService.prototype.listExecutions = function (input) {
+        return __awaiter(this, void 0, void 0, function () {
+            var paginator, executions, _a, paginator_1, paginator_1_1, page, e_1_1;
+            var _b, e_1, _c, _d;
+            return __generator(this, function (_e) {
+                switch (_e.label) {
+                    case 0:
+                        this.logger.info('Listing Step Functions executions', { input: input });
+                        paginator = paginateListExecutions({ client: this.client }, input);
+                        executions = [];
+                        _e.label = 1;
+                    case 1:
+                        _e.trys.push([1, 6, 7, 12]);
+                        _a = true, paginator_1 = __asyncValues(paginator);
+                        _e.label = 2;
+                    case 2: return [4 /*yield*/, paginator_1.next()];
+                    case 3:
+                        if (!(paginator_1_1 = _e.sent(), _b = paginator_1_1.done, !_b)) return [3 /*break*/, 5];
+                        _d = paginator_1_1.value;
+                        _a = false;
+                        page = _d;
+                        if (page.executions)
+                            executions.push.apply(executions, page.executions);
+                        _e.label = 4;
+                    case 4:
+                        _a = true;
+                        return [3 /*break*/, 2];
+                    case 5: return [3 /*break*/, 12];
+                    case 6:
+                        e_1_1 = _e.sent();
+                        e_1 = { error: e_1_1 };
+                        return [3 /*break*/, 12];
+                    case 7:
+                        _e.trys.push([7, , 10, 11]);
+                        if (!(!_a && !_b && (_c = paginator_1.return))) return [3 /*break*/, 9];
+                        return [4 /*yield*/, _c.call(paginator_1)];
+                    case 8:
+                        _e.sent();
+                        _e.label = 9;
+                    case 9: return [3 /*break*/, 11];
+                    case 10:
+                        if (e_1) throw e_1.error;
+                        return [7 /*endfinally*/];
+                    case 11: return [7 /*endfinally*/];
+                    case 12: return [2 /*return*/, executions];
+                }
+            });
+        });
+    };
+    /**
+     * Start a new Step Functions execution.
+     */
+    StepFunctionsService.prototype.startExecution = function (input) {
+        return __awaiter(this, void 0, void 0, function () {
+            return __generator(this, function (_a) {
+                this.logger.info('Starting Step Functions execution', {
+                    input: filterFieldsForLogLevel(this.logger, input, START_EXECUTION_SAFE_FIELDS),
+                });
+                return [2 /*return*/, this.client.send(new StartExecutionCommand(input))];
+            });
+        });
+    };
+    /**
+     * Describe an existing Step Functions execution.
+     */
+    StepFunctionsService.prototype.describeExecution = function (input) {
+        return __awaiter(this, void 0, void 0, function () {
+            return __generator(this, function (_a) {
+                this.logger.info('Describing Step Functions execution', { input: input });
+                return [2 /*return*/, this.client.send(new DescribeExecutionCommand(input))];
+            });
+        });
+    };
+    /**
+     * Stop an in-progress Step Functions execution.
+     */
+    StepFunctionsService.prototype.stopExecution = function (input) {
+        return __awaiter(this, void 0, void 0, function () {
+            return __generator(this, function (_a) {
+                this.logger.info('Stopping Step Functions execution', { input: input });
+                return [2 /*return*/, this.client.send(new StopExecutionCommand(input))];
+            });
+        });
+    };
+    return StepFunctionsService;
+}());
+
+/**
+ * Truncate a UTF-8 string to fit within `maxBytes` when encoded as UTF-8.
+ *
+ * Walks back from the cut point to the start of the previous codepoint, so the
+ * result is never a malformed UTF-8 sequence. Returns the input unchanged when
+ * it already fits.
+ */
+function truncateUtf8(str, maxBytes) {
+    var buf = Buffer.from(str, 'utf8');
+    if (buf.length <= maxBytes)
+        return str;
+    var end = maxBytes;
+    while (end > 0) {
+        var byte = buf[end];
+        if (byte === undefined || (byte & 0xc0) !== 0x80)
+            break;
+        end--;
+    }
+    return buf.toString('utf8', 0, end);
+}
+/**
+ * Truncate a string to at most `maxChars` Unicode codepoints. Splits the
+ * string via `Array.from` so surrogate pairs (emoji, supplementary-plane
+ * characters) are not split in the middle. Returns the input unchanged when
+ * it already fits.
+ */
+function truncateCodepoints(str, maxChars) {
+    var codepoints = Array.from(str);
+    if (codepoints.length <= maxChars)
+        return str;
+    return codepoints.slice(0, maxChars).join('');
+}
+
+var PUBLISH_BATCH_LIMIT = 10;
+var SNS_MESSAGE_MAX_BYTES = 256 * 1024;
+var SNS_SUBJECT_MAX_CHARS = 100;
+/**
+ * Fields safe to log at INFO level for `publish`. Omits `Message`, `Subject`,
+ * `MessageAttributes`, and `PhoneNumber` — payloads, user-visible content
+ * (subjects often carry order numbers / customer names), and PII recipient
+ * identifiers. `POWERTOOLS_LOG_LEVEL=DEBUG` unlocks the full input.
+ */
+var PUBLISH_SAFE_FIELDS = [
+    'TopicArn',
+    'TargetArn',
+    'MessageStructure',
+    'MessageGroupId',
+    'MessageDeduplicationId',
+];
+/**
+ * Wrapper around the AWS SNS client providing structured Powertools logging
+ * and X-Ray tracing by default.
+ */
+var SNSService = /** @class */ (function () {
+    /**
+     * @param opts.logger - Optional Powertools logger. Defaults to `new Logger()`,
+     * which picks up `POWERTOOLS_SERVICE_NAME` from the environment.
+     * @param opts.client - Optional pre-configured `SNSClient`. When supplied,
+     * the wrapper does not apply X-Ray instrumentation.
+     * @param opts.truncate - When `true`, oversized `Message` / `Subject` are
+     * truncated (byte-safe / codepoint-safe) before sending instead of failing
+     * at the SDK. Defaults to `false` — the SDK throws on oversize, which is
+     * usually the right failure mode. Each `publish` call can override via
+     * its own `truncate` option.
+     */
+    function SNSService(opts) {
+        var _a, _b, _c;
+        this.client = (_a = opts === null || opts === void 0 ? void 0 : opts.client) !== null && _a !== void 0 ? _a : xray.captureAWSv3Client(new SNSClient());
+        this.logger = (_b = opts === null || opts === void 0 ? void 0 : opts.logger) !== null && _b !== void 0 ? _b : new Logger();
+        this.truncate = (_c = opts === null || opts === void 0 ? void 0 : opts.truncate) !== null && _c !== void 0 ? _c : false;
+    }
+    /**
+     * Publish a single message to an SNS topic.
+     *
+     * At INFO level the log line includes only routing / dedup metadata; see
+     * `PUBLISH_SAFE_FIELDS` for the list. Setting `POWERTOOLS_LOG_LEVEL=DEBUG`
+     * unlocks the full input.
+     *
+     * @param input - PublishCommandInput including TopicArn and Message.
+     */
+    SNSService.prototype.publish = function (input, opts) {
+        return __awaiter(this, void 0, void 0, function () {
+            var shouldTruncate, effective;
+            var _a;
+            return __generator(this, function (_b) {
+                shouldTruncate = (_a = opts === null || opts === void 0 ? void 0 : opts.truncate) !== null && _a !== void 0 ? _a : this.truncate;
+                effective = shouldTruncate ? this.applyTruncation(input) : input;
+                this.logger.info('Publishing SNS message', {
+                    input: filterFieldsForLogLevel(this.logger, effective, PUBLISH_SAFE_FIELDS),
+                });
+                return [2 /*return*/, this.client.send(new PublishCommand(effective))];
+            });
+        });
+    };
+    SNSService.prototype.applyTruncation = function (input) {
+        var truncated = [];
+        var Message = input.Message;
+        if (Message !== undefined && Buffer.byteLength(Message, 'utf8') > SNS_MESSAGE_MAX_BYTES) {
+            Message = truncateUtf8(Message, SNS_MESSAGE_MAX_BYTES);
+            truncated.push('Message');
+        }
+        var Subject = input.Subject;
+        if (Subject !== undefined && Array.from(Subject).length > SNS_SUBJECT_MAX_CHARS) {
+            Subject = truncateCodepoints(Subject, SNS_SUBJECT_MAX_CHARS);
+            truncated.push('Subject');
+        }
+        if (truncated.length > 0) {
+            this.logger.warn('Truncated SNS publish input', { fields: truncated });
+        }
+        return __assign(__assign({}, input), { Message: Message, Subject: Subject });
+    };
+    /**
+     * Publish a batch of messages to an SNS topic. The SNS API caps
+     * PublishBatch at 10 entries per request, so this method auto-chunks
+     * the caller's `PublishBatchRequestEntries` and sends one request per
+     * chunk, returning the array of outputs.
+     * @param input - PublishBatchCommandInput including TopicArn and entries.
+     */
+    SNSService.prototype.publishBatch = function (input) {
+        return __awaiter(this, void 0, void 0, function () {
+            var entries, isDebug, results, i, chunk, _a, _b;
+            var _c;
+            return __generator(this, function (_d) {
+                switch (_d.label) {
+                    case 0:
+                        entries = (_c = input.PublishBatchRequestEntries) !== null && _c !== void 0 ? _c : [];
+                        isDebug = this.logger.getLevelName() === 'DEBUG';
+                        this.logger.info('Publishing SNS message batch', {
+                            input: isDebug ? input : { TopicArn: input.TopicArn, entryCount: entries.length },
+                        });
+                        results = [];
+                        i = 0;
+                        _d.label = 1;
+                    case 1:
+                        if (!(i < entries.length)) return [3 /*break*/, 4];
+                        chunk = entries.slice(i, i + PUBLISH_BATCH_LIMIT);
+                        _b = (_a = results).push;
+                        return [4 /*yield*/, this.client.send(new PublishBatchCommand(__assign(__assign({}, input), { PublishBatchRequestEntries: chunk })))];
+                    case 2:
+                        _b.apply(_a, [_d.sent()]);
+                        _d.label = 3;
+                    case 3:
+                        i += PUBLISH_BATCH_LIMIT;
+                        return [3 /*break*/, 1];
+                    case 4: return [2 /*return*/, results];
+                }
+            });
+        });
+    };
+    return SNSService;
+}());
+
+var SQS_BATCH_LIMIT = 10;
+var SQS_MESSAGE_BODY_MAX_BYTES = 256 * 1024;
+/**
+ * Fields safe to log at INFO level for `sendMessage`. Omits `MessageBody` and
+ * `MessageAttributes` — both carry payload content.
+ * `POWERTOOLS_LOG_LEVEL=DEBUG` unlocks the full input.
+ */
+var SEND_MESSAGE_SAFE_FIELDS = [
+    'QueueUrl',
+    'DelaySeconds',
+    'MessageGroupId',
+    'MessageDeduplicationId',
+];
+/**
+ * Wrapper around the AWS SQS client providing structured Powertools logging
+ * and X-Ray tracing by default.
+ */
+var SQSService = /** @class */ (function () {
+    /**
+     * @param opts.logger - Optional Powertools logger. Defaults to `new Logger()`,
+     * which picks up `POWERTOOLS_SERVICE_NAME` from the environment.
+     * @param opts.client - Optional pre-configured `SQSClient`. When supplied,
+     * the wrapper does not apply X-Ray instrumentation.
+     * @param opts.truncate - When `true`, oversized `MessageBody` is truncated
+     * (byte-safe) before sending instead of failing at the SDK. Defaults to
+     * `false`. Each `sendMessage` call can override via its own `truncate`
+     * option.
+     */
+    function SQSService(opts) {
+        var _a, _b, _c;
+        this.client = (_a = opts === null || opts === void 0 ? void 0 : opts.client) !== null && _a !== void 0 ? _a : xray.captureAWSv3Client(new SQSClient());
+        this.logger = (_b = opts === null || opts === void 0 ? void 0 : opts.logger) !== null && _b !== void 0 ? _b : new Logger();
+        this.truncate = (_c = opts === null || opts === void 0 ? void 0 : opts.truncate) !== null && _c !== void 0 ? _c : false;
+    }
+    /**
+     * Send a single message to an SQS queue.
+     *
+     * At INFO level the log line includes only queue routing / FIFO metadata;
+     * see `SEND_MESSAGE_SAFE_FIELDS`. `POWERTOOLS_LOG_LEVEL=DEBUG` unlocks the
+     * full input.
+     */
+    SQSService.prototype.sendMessage = function (input, opts) {
+        return __awaiter(this, void 0, void 0, function () {
+            var shouldTruncate, effective;
+            var _a;
+            return __generator(this, function (_b) {
+                shouldTruncate = (_a = opts === null || opts === void 0 ? void 0 : opts.truncate) !== null && _a !== void 0 ? _a : this.truncate;
+                effective = shouldTruncate ? this.applyTruncation(input) : input;
+                this.logger.info('Sending SQS message', {
+                    input: filterFieldsForLogLevel(this.logger, effective, SEND_MESSAGE_SAFE_FIELDS),
+                });
+                return [2 /*return*/, this.client.send(new SendMessageCommand(effective))];
+            });
+        });
+    };
+    SQSService.prototype.applyTruncation = function (input) {
+        var truncated = [];
+        var MessageBody = input.MessageBody;
+        if (MessageBody !== undefined &&
+            Buffer.byteLength(MessageBody, 'utf8') > SQS_MESSAGE_BODY_MAX_BYTES) {
+            MessageBody = truncateUtf8(MessageBody, SQS_MESSAGE_BODY_MAX_BYTES);
+            truncated.push('MessageBody');
+        }
+        if (truncated.length > 0) {
+            this.logger.warn('Truncated SQS sendMessage input', { fields: truncated });
+        }
+        return __assign(__assign({}, input), { MessageBody: MessageBody });
+    };
+    /**
+     * Receive messages from an SQS queue. Returns an empty array when no
+     * messages are available. No automatic deletion is performed — visibility
+     * timeout semantics are the caller's responsibility.
+     * @returns The `Messages` array from the response, or `[]` if absent.
+     */
+    SQSService.prototype.receiveMessages = function (input) {
+        return __awaiter(this, void 0, void 0, function () {
+            var response;
+            var _a;
+            return __generator(this, function (_b) {
+                switch (_b.label) {
+                    case 0:
+                        this.logger.info('Receiving SQS messages', { input: input });
+                        return [4 /*yield*/, this.client.send(new ReceiveMessageCommand(input))];
+                    case 1:
+                        response = _b.sent();
+                        return [2 /*return*/, (_a = response.Messages) !== null && _a !== void 0 ? _a : []];
+                }
+            });
+        });
+    };
+    /**
+     * Delete a single message from an SQS queue.
+     */
+    SQSService.prototype.deleteMessage = function (input) {
+        return __awaiter(this, void 0, void 0, function () {
+            return __generator(this, function (_a) {
+                this.logger.info('Deleting SQS message', { input: input });
+                return [2 /*return*/, this.client.send(new DeleteMessageCommand(input))];
+            });
+        });
+    };
+    /**
+     * Send a batch of messages to an SQS queue. The SQS API caps
+     * SendMessageBatch at 10 entries per request, so this method auto-chunks
+     * the caller's entries and sends one request per chunk.
+     */
+    SQSService.prototype.sendMessageBatch = function (input) {
+        return __awaiter(this, void 0, void 0, function () {
+            var entries, isDebug, results, i, chunk, _a, _b;
+            var _c;
+            return __generator(this, function (_d) {
+                switch (_d.label) {
+                    case 0:
+                        entries = (_c = input.Entries) !== null && _c !== void 0 ? _c : [];
+                        isDebug = this.logger.getLevelName() === 'DEBUG';
+                        this.logger.info('Sending SQS message batch', {
+                            input: isDebug ? input : { QueueUrl: input.QueueUrl, entryCount: entries.length },
+                        });
+                        results = [];
+                        i = 0;
+                        _d.label = 1;
+                    case 1:
+                        if (!(i < entries.length)) return [3 /*break*/, 4];
+                        chunk = entries.slice(i, i + SQS_BATCH_LIMIT);
+                        _b = (_a = results).push;
+                        return [4 /*yield*/, this.client.send(new SendMessageBatchCommand(__assign(__assign({}, input), { Entries: chunk })))];
+                    case 2:
+                        _b.apply(_a, [_d.sent()]);
+                        _d.label = 3;
+                    case 3:
+                        i += SQS_BATCH_LIMIT;
+                        return [3 /*break*/, 1];
+                    case 4: return [2 /*return*/, results];
+                }
+            });
+        });
+    };
+    /**
+     * Delete a batch of messages from an SQS queue. The SQS API caps
+     * DeleteMessageBatch at 10 entries per request, so this method auto-chunks
+     * the caller's entries and sends one request per chunk.
+     */
+    SQSService.prototype.deleteMessageBatch = function (input) {
+        return __awaiter(this, void 0, void 0, function () {
+            var entries, isDebug, results, i, chunk, _a, _b;
+            var _c;
+            return __generator(this, function (_d) {
+                switch (_d.label) {
+                    case 0:
+                        entries = (_c = input.Entries) !== null && _c !== void 0 ? _c : [];
+                        isDebug = this.logger.getLevelName() === 'DEBUG';
+                        this.logger.info('Deleting SQS message batch', {
+                            input: isDebug ? input : { QueueUrl: input.QueueUrl, entryCount: entries.length },
+                        });
+                        results = [];
+                        i = 0;
+                        _d.label = 1;
+                    case 1:
+                        if (!(i < entries.length)) return [3 /*break*/, 4];
+                        chunk = entries.slice(i, i + SQS_BATCH_LIMIT);
+                        _b = (_a = results).push;
+                        return [4 /*yield*/, this.client.send(new DeleteMessageBatchCommand(__assign(__assign({}, input), { Entries: chunk })))];
+                    case 2:
+                        _b.apply(_a, [_d.sent()]);
+                        _d.label = 3;
+                    case 3:
+                        i += SQS_BATCH_LIMIT;
+                        return [3 /*break*/, 1];
+                    case 4: return [2 /*return*/, results];
+                }
+            });
+        });
+    };
+    return SQSService;
+}());
+
+/**
+ * Fields safe to log at INFO level for `putParameter`. Omits `Value` (the
+ * parameter content itself). `POWERTOOLS_LOG_LEVEL=DEBUG` unlocks the full
+ * input.
+ */
+var PUT_PARAMETER_SAFE_FIELDS = [
+    'Name',
+    'Type',
+    'Description',
+    'KeyId',
+    'Overwrite',
+    'AllowedPattern',
+    'Tags',
+    'Tier',
+    'Policies',
+    'DataType',
+];
+/**
+ * Wrapper around the AWS SSM Parameter Store client providing structured
+ * Powertools logging and X-Ray tracing by default. All read operations enable
+ * `WithDecryption` — callers needing plaintext should use `SSMClient`
+ * directly.
+ *
+ * Write operations (`putParameter`, `deleteParameter`) are exposed for
+ * convenience but should be used with care: parameter lifecycle is usually
+ * managed by IaC (CDK / Terraform). Prefer IaC for anything that exists at
+ * deploy time; reserve runtime writes for values that genuinely need to
+ * mutate within the application.
+ */
+var SSMService = /** @class */ (function () {
+    /**
+     * @param opts.logger - Optional Powertools logger. Defaults to `new Logger()`,
+     * which picks up `POWERTOOLS_SERVICE_NAME` from the environment.
+     * @param opts.client - Optional pre-configured `SSMClient`. When supplied,
+     * the wrapper does not apply X-Ray instrumentation.
+     */
+    function SSMService(opts) {
+        var _a, _b;
+        this.client = (_a = opts === null || opts === void 0 ? void 0 : opts.client) !== null && _a !== void 0 ? _a : xray.captureAWSv3Client(new SSMClient());
+        this.logger = (_b = opts === null || opts === void 0 ? void 0 : opts.logger) !== null && _b !== void 0 ? _b : new Logger();
+    }
+    /**
+     * Fetch a single SSM parameter's value.
+     * @param name - The parameter name (or ARN).
+     * @returns The parameter value, or `undefined` if the parameter has no
+     * value set.
+     */
+    SSMService.prototype.getParameter = function (name) {
+        return __awaiter(this, void 0, void 0, function () {
+            var response;
+            var _a;
+            return __generator(this, function (_b) {
+                switch (_b.label) {
+                    case 0:
+                        this.logger.info('Fetching SSM parameter', { input: { name: name } });
+                        return [4 /*yield*/, this.client.send(new GetParameterCommand({ Name: name, WithDecryption: true }))];
+                    case 1:
+                        response = _b.sent();
+                        return [2 /*return*/, (_a = response.Parameter) === null || _a === void 0 ? void 0 : _a.Value];
+                }
+            });
+        });
+    };
+    /**
+     * Fetch multiple SSM parameters in a single request. Callers supply an
+     * alias-to-path record, and the returned record is keyed by the same
+     * aliases — so the SSM path is only mentioned at the call site and the
+     * destructured names are whatever the caller wants to use locally:
+     *
+     * ```ts
+     * const { username, password } = await ssm.getParameters({
+     *     username: '/myapp/db/username',
+     *     password: '/myapp/db/password',
+     * });
+     * ```
+     *
+     * @param aliases - Record mapping each desired local alias to its SSM
+     * parameter name (or ARN).
+     * @returns A record keyed by the same aliases, mapping each to the
+     * parameter's value, or `undefined` when the parameter is missing or has
+     * no value.
+     */
+    SSMService.prototype.getParameters = function (aliases) {
+        return __awaiter(this, void 0, void 0, function () {
+            var response, byPath, _i, _a, parameter, result, _b, _c, alias;
+            var _d;
+            return __generator(this, function (_e) {
+                switch (_e.label) {
+                    case 0:
+                        this.logger.info('Fetching SSM parameters', { input: { aliases: aliases } });
+                        return [4 /*yield*/, this.client.send(new GetParametersCommand({
+                                Names: Object.values(aliases),
+                                WithDecryption: true,
+                            }))];
+                    case 1:
+                        response = _e.sent();
+                        byPath = new Map();
+                        for (_i = 0, _a = (_d = response.Parameters) !== null && _d !== void 0 ? _d : []; _i < _a.length; _i++) {
+                            parameter = _a[_i];
+                            if (parameter.Name !== undefined)
+                                byPath.set(parameter.Name, parameter.Value);
+                        }
+                        result = {};
+                        for (_b = 0, _c = Object.keys(aliases); _b < _c.length; _b++) {
+                            alias = _c[_b];
+                            result[alias] = byPath.get(aliases[alias]);
+                        }
+                        return [2 /*return*/, result];
+                }
+            });
+        });
+    };
+    /**
+     * Create or update an SSM parameter. The log line omits `Value` to avoid
+     * leaking secret material.
+     *
+     * Prefer IaC (CDK / Terraform) for parameter lifecycle — use this for
+     * runtime values only.
+     */
+    SSMService.prototype.putParameter = function (input) {
+        return __awaiter(this, void 0, void 0, function () {
+            return __generator(this, function (_a) {
+                this.logger.info('Putting SSM parameter', {
+                    input: filterFieldsForLogLevel(this.logger, input, PUT_PARAMETER_SAFE_FIELDS),
+                });
+                return [2 /*return*/, this.client.send(new PutParameterCommand(input))];
+            });
+        });
+    };
+    /**
+     * Delete an SSM parameter by name.
+     *
+     * Prefer IaC (CDK / Terraform) for parameter lifecycle — use this for
+     * runtime cleanup only.
+     */
+    SSMService.prototype.deleteParameter = function (name) {
+        return __awaiter(this, void 0, void 0, function () {
+            return __generator(this, function (_a) {
+                switch (_a.label) {
+                    case 0:
+                        this.logger.info('Deleting SSM parameter', { input: { name: name } });
+                        return [4 /*yield*/, this.client.send(new DeleteParameterCommand({ Name: name }))];
+                    case 1:
+                        _a.sent();
+                        return [2 /*return*/];
+                }
+            });
+        });
+    };
+    /**
+     * Fetch all parameters under an SSM hierarchy path, auto-paginating across
+     * all pages. `Recursive` defaults to `true` (overriding the AWS SDK
+     * default of `false`) to match the typical "load all config under
+     * `/myapp/`" use case.
+     * @param path - The parameter path prefix (e.g. `/myapp/`).
+     * @param opts.recursive - Whether to recurse into nested paths. Defaults
+     * to `true`.
+     * @returns The full `Parameter` objects (including `Version`,
+     * `LastModifiedDate`, etc.).
+     */
+    SSMService.prototype.getParametersByPath = function (path, opts) {
+        return __awaiter(this, void 0, void 0, function () {
+            var recursive, paginator, parameters, _a, paginator_1, paginator_1_1, page, e_1_1;
+            var _b, e_1, _c, _d;
+            var _e, _f;
+            return __generator(this, function (_g) {
+                switch (_g.label) {
+                    case 0:
+                        recursive = (_e = opts === null || opts === void 0 ? void 0 : opts.recursive) !== null && _e !== void 0 ? _e : true;
+                        this.logger.info('Fetching SSM parameters by path', {
+                            input: { path: path, recursive: recursive },
+                        });
+                        paginator = paginateGetParametersByPath({ client: this.client }, { Path: path, Recursive: recursive, WithDecryption: true });
+                        parameters = [];
+                        _g.label = 1;
+                    case 1:
+                        _g.trys.push([1, 6, 7, 12]);
+                        _a = true, paginator_1 = __asyncValues(paginator);
+                        _g.label = 2;
+                    case 2: return [4 /*yield*/, paginator_1.next()];
+                    case 3:
+                        if (!(paginator_1_1 = _g.sent(), _b = paginator_1_1.done, !_b)) return [3 /*break*/, 5];
+                        _d = paginator_1_1.value;
+                        _a = false;
+                        page = _d;
+                        parameters.push.apply(parameters, ((_f = page.Parameters) !== null && _f !== void 0 ? _f : []));
+                        _g.label = 4;
+                    case 4:
+                        _a = true;
+                        return [3 /*break*/, 2];
+                    case 5: return [3 /*break*/, 12];
+                    case 6:
+                        e_1_1 = _g.sent();
+                        e_1 = { error: e_1_1 };
+                        return [3 /*break*/, 12];
+                    case 7:
+                        _g.trys.push([7, , 10, 11]);
+                        if (!(!_a && !_b && (_c = paginator_1.return))) return [3 /*break*/, 9];
+                        return [4 /*yield*/, _c.call(paginator_1)];
+                    case 8:
+                        _g.sent();
+                        _g.label = 9;
+                    case 9: return [3 /*break*/, 11];
+                    case 10:
+                        if (e_1) throw e_1.error;
+                        return [7 /*endfinally*/];
+                    case 11: return [7 /*endfinally*/];
+                    case 12: return [2 /*return*/, parameters];
+                }
+            });
+        });
+    };
+    return SSMService;
+}());
+
+export { DynamoDBService, S3Service, SNSService, SQSService, SSMService, SecretsManagerService, StepFunctionsService };