@farukada/aws-langgraph-dynamodb-ts 0.1.1 → 0.2.0

package/dist/shared/utils/logger.js

@@ -25,6 +25,8 @@ Object.defineProperty(exports, "__esModule", { value: true });
 exports.setGlobalLogger = setGlobalLogger;
 exports.getLogger = getLogger;
 exports.resetLogger = resetLogger;
+exports.redactSecrets = redactSecrets;
+exports.redactLogger = redactLogger;
 /**
  * Default logger using console
  */
@@ -59,4 +61,88 @@ function getLogger() {
 function resetLogger() {
     globalLogger = defaultLogger;
 }
+/**
+ * Default field names treated as secrets. Case-insensitive substring match — so
+ * `AccessKeyId`, `aws_access_key_id`, `X-Amz-Security-Token`, `authorization`
+ * all get caught. Extend via {@link redactLogger}'s `extraKeys` option if your
+ * workload introduces more sensitive fields (e.g. `api_key`, `bearer`).
+ */
+const DEFAULT_SECRET_KEY_PATTERNS = [
+    'accesskey',
+    'secretkey',
+    'secret',
+    'sessiontoken',
+    'securitytoken',
+    'authorization',
+    'password',
+    'credential',
+    'apikey',
+    'bearer',
+    'token',
+    'privatekey',
+];
+const REDACTED_PLACEHOLDER = '[REDACTED]';
+function isSecretKey(key, patterns) {
+    const lc = key.toLowerCase();
+    return patterns.some((p) => lc.includes(p));
+}
+/**
+ * Recursively clone an object, replacing values at any secret-looking key with
+ * `[REDACTED]`. Cycles are broken with a WeakSet. Leaves primitives and non-
+ * enumerable values untouched. Does not mutate the input.
+ *
+ * @param value - Arbitrary value to redact
+ * @param patterns - Lower-cased substrings to match against each key
+ */
+function redactSecrets(value, patterns = DEFAULT_SECRET_KEY_PATTERNS) {
+    const seen = new WeakSet();
+    const walk = (v) => {
+        if (v === null || typeof v !== 'object')
+            return v;
+        if (seen.has(v))
+            return '[Circular]';
+        seen.add(v);
+        if (Array.isArray(v)) {
+            return v.map((el) => walk(el));
+        }
+        // Preserve Error shapes so stack traces survive redaction.
+        // eslint-disable-next-line no-instanceof/no-instanceof
+        if (v instanceof Error) {
+            return v;
+        }
+        const out = {};
+        for (const [k, val] of Object.entries(v)) {
+            out[k] = isSecretKey(k, patterns) ? REDACTED_PLACEHOLDER : walk(val);
+        }
+        return out;
+    };
+    return walk(value);
+}
+/**
+ * Wrap an existing logger with automatic secret redaction applied to the
+ * variadic args (the message string itself is passed through unchanged — don't
+ * interpolate secrets into messages). Strings in args are left as-is; only
+ * object properties whose keys match a secret pattern are replaced.
+ *
+ * @example
+ * ```ts
+ * import { setGlobalLogger, redactLogger, getLogger } from '@farukada/aws-langgraph-dynamodb-ts';
+ * setGlobalLogger(redactLogger(getLogger()));
+ * ```
+ *
+ * @param inner - Logger to wrap
+ * @param options.extraKeys - Additional lower-cased substrings to treat as secret keys
+ */
+function redactLogger(inner, options = {}) {
+    const patterns = options.extraKeys
+        ? [...DEFAULT_SECRET_KEY_PATTERNS, ...options.extraKeys.map((k) => k.toLowerCase())]
+        : DEFAULT_SECRET_KEY_PATTERNS;
+    const wrap = (args) => args.map((a) => redactSecrets(a, patterns));
+    return {
+        info: (msg, ...args) => inner.info(msg, ...wrap(args)),
+        warn: (msg, ...args) => inner.warn(msg, ...wrap(args)),
+        error: (msg, ...args) => inner.error(msg, ...wrap(args)),
+        debug: (msg, ...args) => inner.debug(msg, ...wrap(args)),
+    };
+}
 //# sourceMappingURL=logger.js.map

package/dist/shared/utils/logger.js.map

@@ -1 +1 @@
-{"version":3,"file":"logger.js","sourceRoot":"","sources":["../../../src/shared/utils/logger.ts"],"names":[],"mappings":";AAAA;;;;;;;;;;;;;;;;;;;;;GAqBG;;AAsCH,0CAEC;AAOD,8BAEC;AAKD,kCAEC;AA5CD;;GAEG;AACH,4GAA4G;AAC5G,MAAM,aAAa,GAAW;IAC5B,IAAI,EAAE,CAAC,OAAe,EAAE,GAAG,IAAe,EAAE,EAAE,CAC5C,OAAO,CAAC,IAAI,CAAC,wBAAwB,OAAO,EAAE,EAAE,GAAG,IAAI,CAAC;IAE1D,IAAI,EAAE,CAAC,OAAe,EAAE,GAAG,IAAe,EAAE,EAAE,CAC5C,OAAO,CAAC,IAAI,CAAC,wBAAwB,OAAO,EAAE,EAAE,GAAG,IAAI,CAAC;IAE1D,KAAK,EAAE,CAAC,OAAe,EAAE,GAAG,IAAe,EAAE,EAAE,CAC7C,OAAO,CAAC,KAAK,CAAC,wBAAwB,OAAO,EAAE,EAAE,GAAG,IAAI,CAAC;IAE3D,KAAK,EAAE,CAAC,OAAe,EAAE,GAAG,IAAe,EAAE,EAAE,CAC7C,OAAO,CAAC,KAAK,CAAC,wBAAwB,OAAO,EAAE,EAAE,GAAG,IAAI,CAAC;CAC5D,CAAC;AACF,8BAA8B;AAE9B,IAAI,YAAY,GAAW,aAAa,CAAC;AAEzC;;;;GAIG;AACH,SAAgB,eAAe,CAAC,MAAc;IAC5C,YAAY,GAAG,MAAM,CAAC;AACxB,CAAC;AAED;;;;GAIG;AACH,SAAgB,SAAS;IACvB,OAAO,YAAY,CAAC;AACtB,CAAC;AAED;;GAEG;AACH,SAAgB,WAAW;IACzB,YAAY,GAAG,aAAa,CAAC;AAC/B,CAAC"}
+{"version":3,"file":"logger.js","sourceRoot":"","sources":["../../../src/shared/utils/logger.ts"],"names":[],"mappings":";AAAA;;;;;;;;;;;;;;;;;;;;;GAqBG;;AAsCH,0CAEC;AAOD,8BAEC;AAKD,kCAEC;AAsCD,sCA6BC;AAiBD,oCAcC;AA9ID;;GAEG;AACH,4GAA4G;AAC5G,MAAM,aAAa,GAAW;IAC5B,IAAI,EAAE,CAAC,OAAe,EAAE,GAAG,IAAe,EAAE,EAAE,CAC5C,OAAO,CAAC,IAAI,CAAC,wBAAwB,OAAO,EAAE,EAAE,GAAG,IAAI,CAAC;IAE1D,IAAI,EAAE,CAAC,OAAe,EAAE,GAAG,IAAe,EAAE,EAAE,CAC5C,OAAO,CAAC,IAAI,CAAC,wBAAwB,OAAO,EAAE,EAAE,GAAG,IAAI,CAAC;IAE1D,KAAK,EAAE,CAAC,OAAe,EAAE,GAAG,IAAe,EAAE,EAAE,CAC7C,OAAO,CAAC,KAAK,CAAC,wBAAwB,OAAO,EAAE,EAAE,GAAG,IAAI,CAAC;IAE3D,KAAK,EAAE,CAAC,OAAe,EAAE,GAAG,IAAe,EAAE,EAAE,CAC7C,OAAO,CAAC,KAAK,CAAC,wBAAwB,OAAO,EAAE,EAAE,GAAG,IAAI,CAAC;CAC5D,CAAC;AACF,8BAA8B;AAE9B,IAAI,YAAY,GAAW,aAAa,CAAC;AAEzC;;;;GAIG;AACH,SAAgB,eAAe,CAAC,MAAc;IAC5C,YAAY,GAAG,MAAM,CAAC;AACxB,CAAC;AAED;;;;GAIG;AACH,SAAgB,SAAS;IACvB,OAAO,YAAY,CAAC;AACtB,CAAC;AAED;;GAEG;AACH,SAAgB,WAAW;IACzB,YAAY,GAAG,aAAa,CAAC;AAC/B,CAAC;AAED;;;;;GAKG;AACH,MAAM,2BAA2B,GAAsB;IACrD,WAAW;IACX,WAAW;IACX,QAAQ;IACR,cAAc;IACd,eAAe;IACf,eAAe;IACf,UAAU;IACV,YAAY;IACZ,QAAQ;IACR,QAAQ;IACR,OAAO;IACP,YAAY;CACb,CAAC;AAEF,MAAM,oBAAoB,GAAG,YAAY,CAAC;AAE1C,SAAS,WAAW,CAAC,GAAW,EAAE,QAA2B;IAC3D,MAAM,EAAE,GAAG,GAAG,CAAC,WAAW,EAAE,CAAC;IAC7B,OAAO,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,EAAE,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC;AAC9C,CAAC;AAED;;;;;;;GAOG;AACH,SAAgB,aAAa,CAC3B,KAAc,EACd,WAA8B,2BAA2B;IAEzD,MAAM,IAAI,GAAG,IAAI,OAAO,EAAU,CAAC;IAEnC,MAAM,IAAI,GAAG,CAAC,CAAU,EAAW,EAAE;QACnC,IAAI,CAAC,KAAK,IAAI,IAAI,OAAO,CAAC,KAAK,QAAQ;YAAE,OAAO,CAAC,CAAC;QAClD,IAAI,IAAI,CAAC,GAAG,CAAC,CAAW,CAAC;YAAE,OAAO,YAAY,CAAC;QAC/C,IAAI,CAAC,GAAG,CAAC,CAAW,CAAC,CAAC;QAEtB,IAAI,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,CAAC;YACrB,OAAO,CAAC,CAAC,GAAG,CAAC,CAAC,EAAE,EAAE,EAAE,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC,CAAC;QACjC,CAAC;QAED,2DAA2D;QAC3D,uDAAuD;QACvD,IAAI,CAAC,YAAY,KAAK,EAAE,CAAC;YACvB,OAAO,CAAC,CAAC;QACX,CAAC;QAED,MAAM,GAAG,GAA4B,EAAE,CAAC;QACxC,KAAK,MAAM,CAAC,CAAC,EAAE,GAAG,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,CAA4B,CAAC,EAAE,CAAC;YACpE,GAAG,CAAC,CAAC,CAAC,GAAG,WAAW,CAAC,CAAC,EAAE,QAAQ,CAAC,CAAC,CAAC,CAAC,oBAAoB,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;QACvE,CAAC;QACD,OAAO,GAAG,CAAC;IACb,CAAC,CAAC;IAEF,OAAO,IAAI,CAAC,KAAK,CAAC,CAAC;AACrB,CAAC;AAED;;;;;;;;;;;;;;GAcG;AACH,SAAgB,YAAY,CAC1B,KAAa,EACb,UAA6C,EAAE;IAE/C,MAAM,QAAQ,GAAG,OAAO,CAAC,SAAS;QAChC,CAAC,CAAC,CAAC,GAAG,2BAA2B,EAAE,GAAG,OAAO,CAAC,SAAS,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,WAAW,EAAE,CAAC,CAAC;QACpF,CAAC,CAAC,2BAA2B,CAAC;IAChC,MAAM,IAAI,GAAG,CAAC,IAAe,EAAa,EAAE,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,aAAa,CAAC,CAAC,EAAE,QAAQ,CAAC,CAAC,CAAC;IACzF,OAAO;QACL,IAAI,EAAE,CAAC,GAAG,EAAE,GAAG,IAAI,EAAE,EAAE,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,IAAI,CAAC,CAAC;QACtD,IAAI,EAAE,CAAC,GAAG,EAAE,GAAG,IAAI,EAAE,EAAE,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,IAAI,CAAC,CAAC;QACtD,KAAK,EAAE,CAAC,GAAG,EAAE,GAAG,IAAI,EAAE,EAAE,CAAC,KAAK,CAAC,KAAK,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,IAAI,CAAC,CAAC;QACxD,KAAK,EAAE,CAAC,GAAG,EAAE,GAAG,IAAI,EAAE,EAAE,CAAC,KAAK,CAAC,KAAK,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,IAAI,CAAC,CAAC;KACzD,CAAC;AACJ,CAAC"}

package/dist/shared/utils/retry.d.ts

@@ -7,6 +7,13 @@ export interface RetryOptions {
     baseDelayMs?: number;
     maxDelayMs?: number;
     retryableErrors?: string[];
+    /**
+     * Optional abort signal. When aborted, any in-flight sleep between retries
+     * resolves immediately and `withRetry` rejects with the signal's abort reason.
+     * The signal is checked before every attempt, so an abort mid-backoff short-
+     * circuits the remaining retries rather than consuming the full schedule.
+     */
+    signal?: AbortSignal;
 }
 /**
  * Retry a function with exponential backoff

package/dist/shared/utils/retry.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"retry.d.ts","sourceRoot":"","sources":["../../../src/shared/utils/retry.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAEH,MAAM,WAAW,YAAY;IAC3B,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,eAAe,CAAC,EAAE,MAAM,EAAE,CAAC;CAC5B;AA2CD;;GAEG;AACH,wBAAsB,SAAS,CAAC,CAAC,EAAE,EAAE,EAAE,MAAM,OAAO,CAAC,CAAC,CAAC,EAAE,OAAO,GAAE,YAAiB,GAAG,OAAO,CAAC,CAAC,CAAC,CA0D/F;AAED;;GAEG;AACH,wBAAsB,iBAAiB,CAAC,CAAC,EACvC,EAAE,EAAE,MAAM,OAAO,CAAC,CAAC,CAAC,EACpB,SAAS,CAAC,EAAE,OAAO,CAAC,YAAY,CAAC,GAChC,OAAO,CAAC,CAAC,CAAC,CAOZ"}
+{"version":3,"file":"retry.d.ts","sourceRoot":"","sources":["../../../src/shared/utils/retry.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAIH,MAAM,WAAW,YAAY;IAC3B,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,eAAe,CAAC,EAAE,MAAM,EAAE,CAAC;IAC3B;;;;;OAKG;IACH,MAAM,CAAC,EAAE,WAAW,CAAC;CACtB;AA0FD;;GAEG;AACH,wBAAsB,SAAS,CAAC,CAAC,EAAE,EAAE,EAAE,MAAM,OAAO,CAAC,CAAC,CAAC,EAAE,OAAO,GAAE,YAAiB,GAAG,OAAO,CAAC,CAAC,CAAC,CAkE/F;AAED;;GAEG;AACH,wBAAsB,iBAAiB,CAAC,CAAC,EACvC,EAAE,EAAE,MAAM,OAAO,CAAC,CAAC,CAAC,EACpB,SAAS,CAAC,EAAE,OAAO,CAAC,YAAY,CAAC,GAChC,OAAO,CAAC,CAAC,CAAC,CAOZ"}

package/dist/shared/utils/retry.js

@@ -6,49 +6,105 @@
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.withRetry = withRetry;
 exports.withDynamoDBRetry = withDynamoDBRetry;
+const sleep_1 = require("./sleep");
+// TransactionCanceledException is NOT retried here: its CancellationReasons include
+// permanent failures (ConditionalCheckFailed, ValidationError, ItemCollectionSizeLimitExceeded)
+// that must not be retried blindly. Callers that need to retry on specific sub-reasons
+// (e.g. ThrottlingError) must inspect CancellationReasons themselves.
+//
+// TransactionConflictException (the *transient* sibling — one row racing with another
+// concurrent transaction) IS retried. It's the recommended retry path for writes under
+// contention and is distinct from TransactionCanceledException.
 const DEFAULT_OPTIONS = {
     maxAttempts: 5,
     baseDelayMs: 100,
     maxDelayMs: 5000,
     retryableErrors: [
+        // DynamoDB throttling / capacity
         'ProvisionedThroughputExceededException',
         'ThrottlingException',
         'RequestLimitExceeded',
+        // Service-side transient
         'InternalServerError',
         'ServiceUnavailable',
-        'TransactionCanceledException',
+        // Transaction contention (transient — distinct from TransactionCanceledException)
+        'TransactionConflictException',
+        // Node-level network transients. Matched against both the error `code` and
+        // `name` fields so we catch plain socket errors as well as SDK-wrapped ones.
+        'ECONNRESET',
+        'ECONNREFUSED',
+        'ETIMEDOUT',
+        'EPIPE',
+        'EAI_AGAIN',
+        'NetworkingError',
+        'TimeoutError',
     ],
 };
 /**
- * Sleep for a specified number of milliseconds
- */
-function sleep(ms) {
-    return new Promise((resolve) => setTimeout(resolve, ms));
-}
-/**
- * Calculate delay with exponential backoff and jitter
+ * Calculate delay with full jitter (AWS recommended) and a max-delay cap.
+ *
+ * `delay = random(0, min(cap, base * 2^(attempt-1)))` — spreads retries
+ * uniformly across the backoff window so concurrent clients don't synchronize
+ * into a thundering herd.
+ * See https://aws.amazon.com/blogs/architecture/exponential-backoff-and-jitter/
  */
 function calculateDelay(attempt, baseDelayMs, maxDelayMs) {
     const exponentialDelay = baseDelayMs * Math.pow(2, attempt - 1);
-    const jitter = Math.random() * 0.3 * exponentialDelay; // Add up to 30% jitter
-    return Math.min(exponentialDelay + jitter, maxDelayMs);
+    const cap = Math.min(exponentialDelay, maxDelayMs);
+    return Math.random() * cap;
 }
 /**
- * Check if an error is retryable
+ * Check if an error is retryable.
+ *
+ * Matches against the error's `name` and `code` fields (and, when available,
+ * a nested `$metadata`/`cause`) so we catch AWS SDK exceptions, Node socket
+ * errors (`ECONNRESET`, `ETIMEDOUT`, …), and wrapped `cause` chains.
  */
 function isRetryableError(error, retryableErrors) {
     if (!error)
         return false;
-    const errObj = error;
-    const errorName = String(errObj.name ?? errObj.code ?? '');
-    return retryableErrors.some((retryable) => errorName.includes(retryable));
+    const seen = new WeakSet();
+    const signals = [];
+    // Bound recursion depth — WeakSet breaks cycles but does not bound unique chain
+    // length. An attacker (or a buggy SDK middleware) could craft a 10k-deep
+    // `cause` chain and stack-overflow the process. 32 is generous: realistic AWS
+    // SDK wrapping nests 3-5 deep.
+    const MAX_CAUSE_DEPTH = 32;
+    const collect = (err, depth) => {
+        if (depth > MAX_CAUSE_DEPTH)
+            return;
+        if (!err || typeof err !== 'object')
+            return;
+        if (seen.has(err))
+            return;
+        seen.add(err);
+        const o = err;
+        if (typeof o.name === 'string')
+            signals.push(o.name);
+        if (typeof o.code === 'string')
+            signals.push(o.code);
+        if (typeof o.errno === 'string')
+            signals.push(o.errno);
+        if (typeof o.syscall === 'string')
+            signals.push(o.syscall);
+        collect(o.cause, depth + 1);
+    };
+    collect(error, 0);
+    if (signals.length === 0)
+        return false;
+    return retryableErrors.some((retryable) => signals.some((sig) => sig.includes(retryable)));
 }
 /**
  * Retry a function with exponential backoff
  */
 async function withRetry(fn, options = {}) {
-    const opts = { ...DEFAULT_OPTIONS, ...options };
+    const { signal, ...rest } = options;
+    const opts = { ...DEFAULT_OPTIONS, ...rest };
     let lastError;
+    // Surface pre-aborted signals before consuming an attempt.
+    if (signal?.aborted) {
+        throw signal.reason ?? new Error('Aborted');
+    }
     for (let attempt = 1; attempt <= opts.maxAttempts; attempt++) {
         try {
             return await fn();
@@ -75,9 +131,11 @@ async function withRetry(fn, options = {}) {
                 }
                 throw wrappedError;
             }
-            // Calculate delay and wait
+            // Abort mid-backoff short-circuits the remaining retries — sleep() rejects
+            // with the signal's reason, which we re-throw so the caller sees the abort
+            // rather than the last retry error.
             const delay = calculateDelay(attempt, opts.baseDelayMs, opts.maxDelayMs);
-            await sleep(delay);
+            await (0, sleep_1.sleep)(delay, signal);
         }
     }
     // Ensure we always throw an Error object

package/dist/shared/utils/retry.js.map

@@ -1 +1 @@
-{"version":3,"file":"retry.js","sourceRoot":"","sources":["../../../src/shared/utils/retry.ts"],"names":[],"mappings":";AAAA;;;GAGG;;AAqDH,8BA0DC;AAKD,8CAUC;AArHD,MAAM,eAAe,GAA2B;IAC9C,WAAW,EAAE,CAAC;IACd,WAAW,EAAE,GAAG;IAChB,UAAU,EAAE,IAAI;IAChB,eAAe,EAAE;QACf,wCAAwC;QACxC,qBAAqB;QACrB,sBAAsB;QACtB,qBAAqB;QACrB,oBAAoB;QACpB,8BAA8B;KAC/B;CACF,CAAC;AAEF;;GAEG;AACH,SAAS,KAAK,CAAC,EAAU;IACvB,OAAO,IAAI,OAAO,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,UAAU,CAAC,OAAO,EAAE,EAAE,CAAC,CAAC,CAAC;AAC3D,CAAC;AAED;;GAEG;AACH,SAAS,cAAc,CAAC,OAAe,EAAE,WAAmB,EAAE,UAAkB;IAC9E,MAAM,gBAAgB,GAAG,WAAW,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,OAAO,GAAG,CAAC,CAAC,CAAC;IAChE,MAAM,MAAM,GAAG,IAAI,CAAC,MAAM,EAAE,GAAG,GAAG,GAAG,gBAAgB,CAAC,CAAC,uBAAuB;IAC9E,OAAO,IAAI,CAAC,GAAG,CAAC,gBAAgB,GAAG,MAAM,EAAE,UAAU,CAAC,CAAC;AACzD,CAAC;AAED;;GAEG;AACH,SAAS,gBAAgB,CAAC,KAAc,EAAE,eAAyB;IACjE,IAAI,CAAC,KAAK;QAAE,OAAO,KAAK,CAAC;IAEzB,MAAM,MAAM,GAAG,KAAgC,CAAC;IAChD,MAAM,SAAS,GAAG,MAAM,CAAC,MAAM,CAAC,IAAI,IAAI,MAAM,CAAC,IAAI,IAAI,EAAE,CAAC,CAAC;IAC3D,OAAO,eAAe,CAAC,IAAI,CAAC,CAAC,SAAS,EAAE,EAAE,CAAC,SAAS,CAAC,QAAQ,CAAC,SAAS,CAAC,CAAC,CAAC;AAC5E,CAAC;AAED;;GAEG;AACI,KAAK,UAAU,SAAS,CAAI,EAAoB,EAAE,UAAwB,EAAE;IACjF,MAAM,IAAI,GAAG,EAAE,GAAG,eAAe,EAAE,GAAG,OAAO,EAAE,CAAC;IAChD,IAAI,SAAkB,CAAC;IAEvB,KAAK,IAAI,OAAO,GAAG,CAAC,EAAE,OAAO,IAAI,IAAI,CAAC,WAAW,EAAE,OAAO,EAAE,EAAE,CAAC;QAC7D,IAAI,CAAC;YACH,OAAO,MAAM,EAAE,EAAE,CAAC;QACpB,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,SAAS,GAAG,KAAK,CAAC;YAElB,0CAA0C;YAC1C,IAAI,OAAO,KAAK,IAAI,CAAC,WAAW,EAAE,CAAC;gBACjC,MAAM;YACR,CAAC;YAED,4CAA4C;YAC5C,IAAI,CAAC,gBAAgB,CAAC,KAAK,EAAE,IAAI,CAAC,eAAe,CAAC,EAAE,CAAC;gBACnD,oDAAoD;gBACpD,uDAAuD;gBACvD,IAAI,KAAK,YAAY,KAAK,EAAE,CAAC;oBAC3B,MAAM,KAAK,CAAC;gBACd,CAAC;gBACD,MAAM,YAAY,GAAG,IAAI,KAAK,CAC5B,KAAK,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,SAAS,IAAI,KAAK;oBACtD,CAAC,CAAC,MAAM,CAAE,KAA8B,CAAC,OAAO,CAAC;oBACjD,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAClB,CAAC;gBACF,6DAA6D;gBAC7D,IAAI,KAAK,IAAI,OAAO,KAAK,KAAK,QAAQ,EAAE,CAAC;oBACvC,MAAM,CAAC,MAAM,CAAC,YAAY,EAAE,KAAK,CAAC,CAAC;gBACrC,CAAC;gBACD,MAAM,YAAY,CAAC;YACrB,CAAC;YAED,2BAA2B;YAC3B,MAAM,KAAK,GAAG,cAAc,CAAC,OAAO,EAAE,IAAI,CAAC,WAAW,EAAE,IAAI,CAAC,UAAU,CAAC,CAAC;YACzE,MAAM,KAAK,CAAC,KAAK,CAAC,CAAC;QACrB,CAAC;IACH,CAAC;IAED,yCAAyC;IACzC,IAAI,CAAC,SAAS,EAAE,CAAC;QACf,MAAM,IAAI,KAAK,CAAC,4BAA4B,CAAC,CAAC;IAChD,CAAC;IACD,uDAAuD;IACvD,IAAI,SAAS,YAAY,KAAK,EAAE,CAAC;QAC/B,MAAM,SAAS,CAAC;IAClB,CAAC;IACD,+CAA+C;IAC/C,MAAM,YAAY,GAAG,IAAI,KAAK,CAC5B,SAAS,IAAI,OAAO,SAAS,KAAK,QAAQ,IAAI,SAAS,IAAI,SAAS;QAClE,CAAC,CAAC,MAAM,CAAE,SAAkC,CAAC,OAAO,CAAC;QACrD,CAAC,CAAC,MAAM,CAAC,SAAS,CAAC,CACtB,CAAC;IACF,IAAI,SAAS,IAAI,OAAO,SAAS,KAAK,QAAQ,EAAE,CAAC;QAC/C,MAAM,CAAC,MAAM,CAAC,YAAY,EAAE,SAAS,CAAC,CAAC;IACzC,CAAC;IACD,MAAM,YAAY,CAAC;AACrB,CAAC;AAED;;GAEG;AACI,KAAK,UAAU,iBAAiB,CACrC,EAAoB,EACpB,SAAiC;IAEjC,OAAO,SAAS,CAAC,EAAE,EAAE;QACnB,WAAW,EAAE,CAAC;QACd,WAAW,EAAE,GAAG;QAChB,UAAU,EAAE,IAAI;QAChB,GAAG,SAAS;KACb,CAAC,CAAC;AACL,CAAC"}
+{"version":3,"file":"retry.js","sourceRoot":"","sources":["../../../src/shared/utils/retry.ts"],"names":[],"mappings":";AAAA;;;GAGG;;AA6GH,8BAkEC;AAKD,8CAUC;AA5LD,mCAAgC;AAgBhC,oFAAoF;AACpF,gGAAgG;AAChG,uFAAuF;AACvF,sEAAsE;AACtE,EAAE;AACF,sFAAsF;AACtF,uFAAuF;AACvF,gEAAgE;AAChE,MAAM,eAAe,GAA2C;IAC9D,WAAW,EAAE,CAAC;IACd,WAAW,EAAE,GAAG;IAChB,UAAU,EAAE,IAAI;IAChB,eAAe,EAAE;QACf,iCAAiC;QACjC,wCAAwC;QACxC,qBAAqB;QACrB,sBAAsB;QACtB,yBAAyB;QACzB,qBAAqB;QACrB,oBAAoB;QACpB,kFAAkF;QAClF,8BAA8B;QAC9B,2EAA2E;QAC3E,6EAA6E;QAC7E,YAAY;QACZ,cAAc;QACd,WAAW;QACX,OAAO;QACP,WAAW;QACX,iBAAiB;QACjB,cAAc;KACf;CACF,CAAC;AAEF;;;;;;;GAOG;AACH,SAAS,cAAc,CAAC,OAAe,EAAE,WAAmB,EAAE,UAAkB;IAC9E,MAAM,gBAAgB,GAAG,WAAW,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,OAAO,GAAG,CAAC,CAAC,CAAC;IAChE,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,CAAC,gBAAgB,EAAE,UAAU,CAAC,CAAC;IACnD,OAAO,IAAI,CAAC,MAAM,EAAE,GAAG,GAAG,CAAC;AAC7B,CAAC;AAED;;;;;;GAMG;AACH,SAAS,gBAAgB,CAAC,KAAc,EAAE,eAAyB;IACjE,IAAI,CAAC,KAAK;QAAE,OAAO,KAAK,CAAC;IAEzB,MAAM,IAAI,GAAG,IAAI,OAAO,EAAU,CAAC;IACnC,MAAM,OAAO,GAAa,EAAE,CAAC;IAE7B,gFAAgF;IAChF,yEAAyE;IACzE,8EAA8E;IAC9E,+BAA+B;IAC/B,MAAM,eAAe,GAAG,EAAE,CAAC;IAE3B,MAAM,OAAO,GAAG,CAAC,GAAY,EAAE,KAAa,EAAQ,EAAE;QACpD,IAAI,KAAK,GAAG,eAAe;YAAE,OAAO;QACpC,IAAI,CAAC,GAAG,IAAI,OAAO,GAAG,KAAK,QAAQ;YAAE,OAAO;QAC5C,IAAI,IAAI,CAAC,GAAG,CAAC,GAAa,CAAC;YAAE,OAAO;QACpC,IAAI,CAAC,GAAG,CAAC,GAAa,CAAC,CAAC;QAExB,MAAM,CAAC,GAAG,GAA8B,CAAC;QACzC,IAAI,OAAO,CAAC,CAAC,IAAI,KAAK,QAAQ;YAAE,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC;QACrD,IAAI,OAAO,CAAC,CAAC,IAAI,KAAK,QAAQ;YAAE,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC;QACrD,IAAI,OAAO,CAAC,CAAC,KAAK,KAAK,QAAQ;YAAE,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC;QACvD,IAAI,OAAO,CAAC,CAAC,OAAO,KAAK,QAAQ;YAAE,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC;QAC3D,OAAO,CAAC,CAAC,CAAC,KAAK,EAAE,KAAK,GAAG,CAAC,CAAC,CAAC;IAC9B,CAAC,CAAC;IAEF,OAAO,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC;IAElB,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,KAAK,CAAC;IAEvC,OAAO,eAAe,CAAC,IAAI,CAAC,CAAC,SAAS,EAAE,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,GAAG,CAAC,QAAQ,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC;AAC7F,CAAC;AAED;;GAEG;AACI,KAAK,UAAU,SAAS,CAAI,EAAoB,EAAE,UAAwB,EAAE;IACjF,MAAM,EAAE,MAAM,EAAE,GAAG,IAAI,EAAE,GAAG,OAAO,CAAC;IACpC,MAAM,IAAI,GAAG,EAAE,GAAG,eAAe,EAAE,GAAG,IAAI,EAAE,CAAC;IAC7C,IAAI,SAAkB,CAAC;IAEvB,2DAA2D;IAC3D,IAAI,MAAM,EAAE,OAAO,EAAE,CAAC;QACpB,MAAM,MAAM,CAAC,MAAM,IAAI,IAAI,KAAK,CAAC,SAAS,CAAC,CAAC;IAC9C,CAAC;IAED,KAAK,IAAI,OAAO,GAAG,CAAC,EAAE,OAAO,IAAI,IAAI,CAAC,WAAW,EAAE,OAAO,EAAE,EAAE,CAAC;QAC7D,IAAI,CAAC;YACH,OAAO,MAAM,EAAE,EAAE,CAAC;QACpB,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,SAAS,GAAG,KAAK,CAAC;YAElB,0CAA0C;YAC1C,IAAI,OAAO,KAAK,IAAI,CAAC,WAAW,EAAE,CAAC;gBACjC,MAAM;YACR,CAAC;YAED,4CAA4C;YAC5C,IAAI,CAAC,gBAAgB,CAAC,KAAK,EAAE,IAAI,CAAC,eAAe,CAAC,EAAE,CAAC;gBACnD,oDAAoD;gBACpD,uDAAuD;gBACvD,IAAI,KAAK,YAAY,KAAK,EAAE,CAAC;oBAC3B,MAAM,KAAK,CAAC;gBACd,CAAC;gBACD,MAAM,YAAY,GAAG,IAAI,KAAK,CAC5B,KAAK,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,SAAS,IAAI,KAAK;oBACtD,CAAC,CAAC,MAAM,CAAE,KAA8B,CAAC,OAAO,CAAC;oBACjD,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAClB,CAAC;gBACF,6DAA6D;gBAC7D,IAAI,KAAK,IAAI,OAAO,KAAK,KAAK,QAAQ,EAAE,CAAC;oBACvC,MAAM,CAAC,MAAM,CAAC,YAAY,EAAE,KAAK,CAAC,CAAC;gBACrC,CAAC;gBACD,MAAM,YAAY,CAAC;YACrB,CAAC;YAED,2EAA2E;YAC3E,2EAA2E;YAC3E,oCAAoC;YACpC,MAAM,KAAK,GAAG,cAAc,CAAC,OAAO,EAAE,IAAI,CAAC,WAAW,EAAE,IAAI,CAAC,UAAU,CAAC,CAAC;YACzE,MAAM,IAAA,aAAK,EAAC,KAAK,EAAE,MAAM,CAAC,CAAC;QAC7B,CAAC;IACH,CAAC;IAED,yCAAyC;IACzC,IAAI,CAAC,SAAS,EAAE,CAAC;QACf,MAAM,IAAI,KAAK,CAAC,4BAA4B,CAAC,CAAC;IAChD,CAAC;IACD,uDAAuD;IACvD,IAAI,SAAS,YAAY,KAAK,EAAE,CAAC;QAC/B,MAAM,SAAS,CAAC;IAClB,CAAC;IACD,+CAA+C;IAC/C,MAAM,YAAY,GAAG,IAAI,KAAK,CAC5B,SAAS,IAAI,OAAO,SAAS,KAAK,QAAQ,IAAI,SAAS,IAAI,SAAS;QAClE,CAAC,CAAC,MAAM,CAAE,SAAkC,CAAC,OAAO,CAAC;QACrD,CAAC,CAAC,MAAM,CAAC,SAAS,CAAC,CACtB,CAAC;IACF,IAAI,SAAS,IAAI,OAAO,SAAS,KAAK,QAAQ,EAAE,CAAC;QAC/C,MAAM,CAAC,MAAM,CAAC,YAAY,EAAE,SAAS,CAAC,CAAC;IACzC,CAAC;IACD,MAAM,YAAY,CAAC;AACrB,CAAC;AAED;;GAEG;AACI,KAAK,UAAU,iBAAiB,CACrC,EAAoB,EACpB,SAAiC;IAEjC,OAAO,SAAS,CAAC,EAAE,EAAE;QACnB,WAAW,EAAE,CAAC;QACd,WAAW,EAAE,GAAG;QAChB,UAAU,EAAE,IAAI;QAChB,GAAG,SAAS;KACb,CAAC,CAAC;AACL,CAAC"}

package/dist/shared/utils/s3-offloader.d.ts

@@ -23,7 +23,11 @@ export interface S3OffloadConfig {
     keyPrefix?: string;
     /** Payload size threshold in bytes that triggers offloading (default: 358400 = 350KB) */
     thresholdBytes?: number;
-    /** Server-side encryption algorithm (e.g., 'AES256' or 'aws:kms'). Not set by default. */
+    /**
+     * Server-side encryption algorithm (`'AES256'` or `'aws:kms'`).
+     * Defaults to `'AES256'` — pass an explicit value to override (e.g. `'aws:kms'`
+     * together with `sseKmsKeyId`).
+     */
     serverSideEncryption?: string;
     /** KMS key ID or ARN. Only used when serverSideEncryption is 'aws:kms'. */
     sseKmsKeyId?: string;
@@ -63,7 +67,7 @@ export declare class S3Offloader {
     private readonly bucketName;
     private readonly keyPrefix;
     private readonly thresholdBytes;
-    private readonly serverSideEncryption?;
+    private readonly serverSideEncryption;
     private readonly sseKmsKeyId?;
     private readonly clientConfig?;
     constructor(config: S3OffloadConfig);
@@ -134,7 +138,10 @@ export declare class S3Offloader {
     /**
      * Generate a deterministic lifecycle rule ID for idempotency.
      *
-     * @param ttlDays - Expiration in days
+     * The ID is scoped to the configured key prefix but intentionally TTL-independent:
+     * changing ttlDays updates the existing rule in place instead of leaving a stale
+     * rule behind that would still expire objects at the old cadence.
+     *
      * @returns Rule ID string
      */
     private buildLifecycleRuleId;

package/dist/shared/utils/s3-offloader.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"s3-offloader.d.ts","sourceRoot":"","sources":["../../../src/shared/utils/s3-offloader.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;GAcG;AAuBH;;GAEG;AACH,MAAM,WAAW,eAAe;IAC9B,+DAA+D;IAC/D,UAAU,EAAE,MAAM,CAAC;IACnB,oEAAoE;IACpE,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,yFAAyF;IACzF,cAAc,CAAC,EAAE,MAAM,CAAC;IACxB,0FAA0F;IAC1F,oBAAoB,CAAC,EAAE,MAAM,CAAC;IAC9B,2EAA2E;IAC3E,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB;;;OAGG;IACH,YAAY,CAAC,EAAE;QACb,MAAM,CAAC,EAAE,MAAM,CAAC;QAChB,QAAQ,CAAC,EAAE,MAAM,CAAC;QAClB,WAAW,CAAC,EAAE,OAAO,CAAC;QACtB,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC;KACxB,CAAC;CACH;AAED;;;;;;;;;;;;;;;;;;;GAmBG;AACH,qBAAa,WAAW;IACtB,OAAO,CAAC,QAAQ,CAAC,CAA6D;IAC9E,OAAO,CAAC,QAAQ,CAAC,UAAU,CAAS;IACpC,OAAO,CAAC,QAAQ,CAAC,SAAS,CAAS;IACnC,OAAO,CAAC,QAAQ,CAAC,cAAc,CAAS;IACxC,OAAO,CAAC,QAAQ,CAAC,oBAAoB,CAAC,CAAS;IAC/C,OAAO,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAS;IACtC,OAAO,CAAC,QAAQ,CAAC,YAAY,CAAC,CAAkC;gBAEpD,MAAM,EAAE,eAAe;IASnC;;;OAGG;IACH,OAAO,CAAC,SAAS;IAQjB;;;;;OAKG;IACH,aAAa,CAAC,IAAI,EAAE,UAAU,GAAG,OAAO;IAIxC;;;;;;;OAOG;IACH,QAAQ,CAAC,QAAQ,EAAE,MAAM,EAAE,YAAY,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,GAAG,MAAM;IAIvE;;;;;;OAMG;IACG,MAAM,CAAC,GAAG,EAAE,MAAM,EAAE,IAAI,EAAE,UAAU,GAAG,OAAO,CAAC,MAAM,CAAC;IAqB5D;;;;;;OAMG;IACG,QAAQ,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,UAAU,CAAC;IAoBhD;;;;OAIG;IACG,MAAM,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IAYxC;;;;OAIG;IACG,WAAW,CAAC,IAAI,EAAE,MAAM,EAAE,GAAG,OAAO,CAAC,IAAI,CAAC;IAgChD;;OAEG;IACH,YAAY,IAAI,MAAM;IAItB;;;;;;;;;OASG;IACG,mBAAmB,CAAC,OAAO,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IA8EzD;;;;;OAKG;IACH,OAAO,CAAC,oBAAoB;IAI5B;;OAEG;IACH,OAAO,IAAI,IAAI;CAGhB"}
+{"version":3,"file":"s3-offloader.d.ts","sourceRoot":"","sources":["../../../src/shared/utils/s3-offloader.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;GAcG;AA+BH;;GAEG;AACH,MAAM,WAAW,eAAe;IAC9B,+DAA+D;IAC/D,UAAU,EAAE,MAAM,CAAC;IACnB,oEAAoE;IACpE,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,yFAAyF;IACzF,cAAc,CAAC,EAAE,MAAM,CAAC;IACxB;;;;OAIG;IACH,oBAAoB,CAAC,EAAE,MAAM,CAAC;IAC9B,2EAA2E;IAC3E,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB;;;OAGG;IACH,YAAY,CAAC,EAAE;QACb,MAAM,CAAC,EAAE,MAAM,CAAC;QAChB,QAAQ,CAAC,EAAE,MAAM,CAAC;QAClB,WAAW,CAAC,EAAE,OAAO,CAAC;QACtB,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC;KACxB,CAAC;CACH;AAED;;;;;;;;;;;;;;;;;;;GAmBG;AACH,qBAAa,WAAW;IACtB,OAAO,CAAC,QAAQ,CAAC,CAA6D;IAC9E,OAAO,CAAC,QAAQ,CAAC,UAAU,CAAS;IACpC,OAAO,CAAC,QAAQ,CAAC,SAAS,CAAS;IACnC,OAAO,CAAC,QAAQ,CAAC,cAAc,CAAS;IACxC,OAAO,CAAC,QAAQ,CAAC,oBAAoB,CAAS;IAC9C,OAAO,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAS;IACtC,OAAO,CAAC,QAAQ,CAAC,YAAY,CAAC,CAAkC;gBAEpD,MAAM,EAAE,eAAe;IASnC;;;OAGG;IACH,OAAO,CAAC,SAAS;IAQjB;;;;;OAKG;IACH,aAAa,CAAC,IAAI,EAAE,UAAU,GAAG,OAAO;IAIxC;;;;;;;OAOG;IACH,QAAQ,CAAC,QAAQ,EAAE,MAAM,EAAE,YAAY,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,GAAG,MAAM;IAIvE;;;;;;OAMG;IACG,MAAM,CAAC,GAAG,EAAE,MAAM,EAAE,IAAI,EAAE,UAAU,GAAG,OAAO,CAAC,MAAM,CAAC;IAmB5D;;;;;;OAMG;IACG,QAAQ,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,UAAU,CAAC;IAoBhD;;;;OAIG;IACG,MAAM,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IAYxC;;;;OAIG;IACG,WAAW,CAAC,IAAI,EAAE,MAAM,EAAE,GAAG,OAAO,CAAC,IAAI,CAAC;IAgChD;;OAEG;IACH,YAAY,IAAI,MAAM;IAItB;;;;;;;;;OASG;IACG,mBAAmB,CAAC,OAAO,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IA8EzD;;;;;;;;OAQG;IACH,OAAO,CAAC,oBAAoB;IAM5B;;OAEG;IACH,OAAO,IAAI,IAAI;CAGhB"}

package/dist/shared/utils/s3-offloader.js

@@ -21,6 +21,13 @@ const logger_1 = require("./logger");
 const DEFAULT_THRESHOLD_BYTES = 350 * 1024;
 /** Default S3 key prefix for offloaded payloads */
 const DEFAULT_KEY_PREFIX = 'langgraph-checkpoints/';
+/**
+ * Default server-side encryption. Matches S3's own default (SSE-S3, AES256) since
+ * January 2023, but asserting it on the PutObject makes the intent explicit for
+ * compliance reviews and protects users running against older buckets or custom
+ * endpoints that don't inherit the modern default.
+ */
+const DEFAULT_SERVER_SIDE_ENCRYPTION = 'AES256';
 /* eslint-disable @typescript-eslint/no-require-imports -- TODO: migrate to dynamic import() when Jest ESM support is stable */
 // Lazy-loaded S3 SDK — uses require() for Jest CJS compatibility.
 // Replace with import() when the test runner supports --experimental-vm-modules.
@@ -63,7 +70,7 @@ class S3Offloader {
         this.bucketName = config.bucketName;
         this.keyPrefix = config.keyPrefix ?? DEFAULT_KEY_PREFIX;
         this.thresholdBytes = config.thresholdBytes ?? DEFAULT_THRESHOLD_BYTES;
-        this.serverSideEncryption = config.serverSideEncryption;
+        this.serverSideEncryption = config.serverSideEncryption ?? DEFAULT_SERVER_SIDE_ENCRYPTION;
         this.sseKmsKeyId = config.sseKmsKeyId;
         this.clientConfig = config.clientConfig;
     }
@@ -113,10 +120,8 @@ class S3Offloader {
             Key: key,
             Body: data,
             ContentType: 'application/octet-stream',
-            ...(this.serverSideEncryption && {
-                ServerSideEncryption: this
-                    .serverSideEncryption,
-            }),
+            ServerSideEncryption: this
+                .serverSideEncryption,
             ...(this.sseKmsKeyId && { SSEKMSKeyId: this.sseKmsKeyId }),
         }));
         return key;
@@ -202,7 +207,7 @@ class S3Offloader {
     async ensureLifecycleRule(ttlDays) {
         const { GetBucketLifecycleConfigurationCommand, PutBucketLifecycleConfigurationCommand } = getS3Sdk();
         const client = this.getClient();
-        const ruleId = this.buildLifecycleRuleId(ttlDays);
+        const ruleId = this.buildLifecycleRuleId();
         // 1. Read existing lifecycle configuration
         let existingRules = [];
         try {
@@ -254,11 +259,16 @@ class S3Offloader {
     /**
      * Generate a deterministic lifecycle rule ID for idempotency.
      *
-     * @param ttlDays - Expiration in days
+     * The ID is scoped to the configured key prefix but intentionally TTL-independent:
+     * changing ttlDays updates the existing rule in place instead of leaving a stale
+     * rule behind that would still expire objects at the old cadence.
+     *
      * @returns Rule ID string
      */
-    buildLifecycleRuleId(ttlDays) {
-        return `langgraph-ttl-${ttlDays}d`;
+    buildLifecycleRuleId() {
+        // Normalize the prefix into a lifecycle-rule-safe slug, trimming the trailing slash.
+        const slug = this.keyPrefix.replace(/\/+$/, '').replace(/[^a-zA-Z0-9-]/g, '-') || 'default';
+        return `langgraph-ttl-${slug}`;
     }
     /**
      * Release underlying S3 client resources

package/dist/shared/utils/s3-offloader.js.map

@@ -1 +1 @@
-{"version":3,"file":"s3-offloader.js","sourceRoot":"","sources":["../../../src/shared/utils/s3-offloader.ts"],"names":[],"mappings":";AAAA;;;;;;;;;;;;;;GAcG;;;AAEH,qCAAqC;AAErC,mFAAmF;AACnF,MAAM,uBAAuB,GAAG,GAAG,GAAG,IAAI,CAAC;AAE3C,mDAAmD;AACnD,MAAM,kBAAkB,GAAG,wBAAwB,CAAC;AAEpD,+HAA+H;AAE/H,kEAAkE;AAClE,iFAAiF;AACjF,IAAI,KAAsD,CAAC;AAE3D,SAAS,QAAQ;IACf,IAAI,CAAC,KAAK,EAAE,CAAC;QACX,KAAK,GAAG,OAAO,CAAC,oBAAoB,CAAC,CAAC;IACxC,CAAC;IACD,OAAO,KAAM,CAAC;AAChB,CAAC;AA4BD;;;;;;;;;;;;;;;;;;;GAmBG;AACH,MAAa,WAAW;IACd,QAAQ,CAA8D;IAC7D,UAAU,CAAS;IACnB,SAAS,CAAS;IAClB,cAAc,CAAS;IACvB,oBAAoB,CAAU;IAC9B,WAAW,CAAU;IACrB,YAAY,CAAmC;IAEhE,YAAY,MAAuB;QACjC,IAAI,CAAC,UAAU,GAAG,MAAM,CAAC,UAAU,CAAC;QACpC,IAAI,CAAC,SAAS,GAAG,MAAM,CAAC,SAAS,IAAI,kBAAkB,CAAC;QACxD,IAAI,CAAC,cAAc,GAAG,MAAM,CAAC,cAAc,IAAI,uBAAuB,CAAC;QACvE,IAAI,CAAC,oBAAoB,GAAG,MAAM,CAAC,oBAAoB,CAAC;QACxD,IAAI,CAAC,WAAW,GAAG,MAAM,CAAC,WAAW,CAAC;QACtC,IAAI,CAAC,YAAY,GAAG,MAAM,CAAC,YAAY,CAAC;IAC1C,CAAC;IAED;;;OAGG;IACK,SAAS;QACf,IAAI,CAAC,IAAI,CAAC,QAAQ,EAAE,CAAC;YACnB,MAAM,EAAE,QAAQ,EAAE,GAAG,QAAQ,EAAE,CAAC;YAChC,IAAI,CAAC,QAAQ,GAAG,IAAI,QAAQ,CAAC,CAAC,IAAI,CAAC,YAAY,IAAI,EAAE,CAA4B,CAAC,CAAC;QACrF,CAAC;QACD,OAAO,IAAI,CAAC,QAAQ,CAAC;IACvB,CAAC;IAED;;;;;OAKG;IACH,aAAa,CAAC,IAAgB;QAC5B,OAAO,IAAI,CAAC,MAAM,IAAI,IAAI,CAAC,cAAc,CAAC;IAC5C,CAAC;IAED;;;;;;;OAOG;IACH,QAAQ,CAAC,QAAgB,EAAE,YAAoB,EAAE,KAAa;QAC5D,OAAO,GAAG,IAAI,CAAC,SAAS,GAAG,QAAQ,IAAI,YAAY,IAAI,KAAK,MAAM,CAAC;IACrE,CAAC;IAED;;;;;;OAMG;IACH,KAAK,CAAC,MAAM,CAAC,GAAW,EAAE,IAAgB;QACxC,MAAM,EAAE,gBAAgB,EAAE,GAAG,QAAQ,EAAE,CAAC;QACxC,MAAM,MAAM,GAAG,IAAI,CAAC,SAAS,EAAE,CAAC;QAEhC,MAAM,MAAM,CAAC,IAAI,CACf,IAAI,gBAAgB,CAAC;YACnB,MAAM,EAAE,IAAI,CAAC,UAAU;YACvB,GAAG,EAAE,GAAG;YACR,IAAI,EAAE,IAAI;YACV,WAAW,EAAE,0BAA0B;YACvC,GAAG,CAAC,IAAI,CAAC,oBAAoB,IAAI;gBAC/B,oBAAoB,EAAE,IAAI;qBACvB,oBAAyE;aAC7E,CAAC;YACF,GAAG,CAAC,IAAI,CAAC,WAAW,IAAI,EAAE,WAAW,EAAE,IAAI,CAAC,WAAW,EAAE,CAAC;SAC3D,CAAC,CACH,CAAC;QAEF,OAAO,GAAG,CAAC;IACb,CAAC;IAED;;;;;;OAMG;IACH,KAAK,CAAC,QAAQ,CAAC,GAAW;QACxB,MAAM,EAAE,gBAAgB,EAAE,GAAG,QAAQ,EAAE,CAAC;QACxC,MAAM,MAAM,GAAG,IAAI,CAAC,SAAS,EAAE,CAAC;QAEhC,MAAM,QAAQ,GAAG,MAAM,MAAM,CAAC,IAAI,CAChC,IAAI,gBAAgB,CAAC;YACnB,MAAM,EAAE,IAAI,CAAC,UAAU;YACvB,GAAG,EAAE,GAAG;SACT,CAAC,CACH,CAAC;QAEF,IAAI,CAAC,QAAQ,CAAC,IAAI,EAAE,CAAC;YACnB,MAAM,IAAI,KAAK,CAAC,oCAAoC,GAAG,EAAE,CAAC,CAAC;QAC7D,CAAC;QAED,4CAA4C;QAC5C,MAAM,SAAS,GAAG,MAAM,QAAQ,CAAC,IAAI,CAAC,oBAAoB,EAAE,CAAC;QAC7D,OAAO,IAAI,UAAU,CAAC,SAAS,CAAC,CAAC;IACnC,CAAC;IAED;;;;OAIG;IACH,KAAK,CAAC,MAAM,CAAC,GAAW;QACtB,MAAM,EAAE,mBAAmB,EAAE,GAAG,QAAQ,EAAE,CAAC;QAC3C,MAAM,MAAM,GAAG,IAAI,CAAC,SAAS,EAAE,CAAC;QAEhC,MAAM,MAAM,CAAC,IAAI,CACf,IAAI,mBAAmB,CAAC;YACtB,MAAM,EAAE,IAAI,CAAC,UAAU;YACvB,GAAG,EAAE,GAAG;SACT,CAAC,CACH,CAAC;IACJ,CAAC;IAED;;;;OAIG;IACH,KAAK,CAAC,WAAW,CAAC,IAAc;QAC9B,IAAI,IAAI,CAAC,MAAM,KAAK,CAAC;YAAE,OAAO;QAE9B,MAAM,EAAE,oBAAoB,EAAE,GAAG,QAAQ,EAAE,CAAC;QAC5C,MAAM,MAAM,GAAG,IAAI,CAAC,SAAS,EAAE,CAAC;QAEhC,wDAAwD;QACxD,MAAM,SAAS,GAAG,IAAI,CAAC;QACvB,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,IAAI,CAAC,MAAM,EAAE,CAAC,IAAI,SAAS,EAAE,CAAC;YAChD,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,GAAG,SAAS,CAAC,CAAC;YAC3C,MAAM,QAAQ,GAAG,MAAM,MAAM,CAAC,IAAI,CAChC,IAAI,oBAAoB,CAAC;gBACvB,MAAM,EAAE,IAAI,CAAC,UAAU;gBACvB,MAAM,EAAE;oBACN,OAAO,EAAE,KAAK,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC,EAAE,GAAG,EAAE,GAAG,EAAE,CAAC,CAAC;oBAC3C,KAAK,EAAE,IAAI;iBACZ;aACF,CAAC,CACH,CAAC;YAEF,6DAA6D;YAC7D,IAAI,QAAQ,CAAC,MAAM,IAAI,QAAQ,CAAC,MAAM,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;gBAClD,MAAM,UAAU,GAAG,QAAQ,CAAC,MAAM,CAAC,GAAG,CACpC,CAAC,GAAG,EAAE,EAAE,CAAC,GAAG,GAAG,CAAC,GAAG,KAAK,GAAG,CAAC,IAAI,KAAK,GAAG,CAAC,OAAO,GAAG,CACpD,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;gBACb,IAAA,kBAAS,GAAE,CAAC,IAAI,CACd,mBAAmB,QAAQ,CAAC,MAAM,CAAC,MAAM,8BAA8B,UAAU,EAAE,CACpF,CAAC;YACJ,CAAC;QACH,CAAC;IACH,CAAC;IAED;;OAEG;IACH,YAAY;QACV,OAAO,IAAI,CAAC,SAAS,CAAC;IACxB,CAAC;IAED;;;;;;;;;OASG;IACH,KAAK,CAAC,mBAAmB,CAAC,OAAe;QACvC,MAAM,EAAE,sCAAsC,EAAE,sCAAsC,EAAE,GACtF,QAAQ,EAAE,CAAC;QACb,MAAM,MAAM,GAAG,IAAI,CAAC,SAAS,EAAE,CAAC;QAEhC,MAAM,MAAM,GAAG,IAAI,CAAC,oBAAoB,CAAC,OAAO,CAAC,CAAC;QAElD,2CAA2C;QAC3C,IAAI,aAAa,GAMZ,EAAE,CAAC;QAER,IAAI,CAAC;YACH,MAAM,QAAQ,GAAG,MAAM,MAAM,CAAC,IAAI,CAChC,IAAI,sCAAsC,CAAC,EAAE,MAAM,EAAE,IAAI,CAAC,UAAU,EAAE,CAAC,CACxE,CAAC;YACF,aAAa,GAAI,QAAQ,CAAC,KAA8B,IAAI,EAAE,CAAC;QACjE,CAAC;QAAC,OAAO,KAAc,EAAE,CAAC;YACxB,qFAAqF;YACrF,IACE,KAAK;gBACL,OAAO,KAAK,KAAK,QAAQ;gBACzB,MAAM,IAAI,KAAK;gBACd,KAA0B,CAAC,IAAI,KAAK,8BAA8B,EACnE,CAAC;gBACD,aAAa,GAAG,EAAE,CAAC;YACrB,CAAC;iBAAM,CAAC;gBACN,MAAM,KAAK,CAAC;YACd,CAAC;QACH,CAAC;QAED,qDAAqD;QACrD,MAAM,YAAY,GAAG,aAAa,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,KAAK,MAAM,CAAC,CAAC;QAChE,IACE,YAAY;YACZ,YAAY,CAAC,MAAM,KAAK,SAAS;YACjC,YAAY,CAAC,UAAU;YACtB,YAAY,CAAC,UAAgC,CAAC,IAAI,KAAK,OAAO,EAC/D,CAAC;YACD,4DAA4D;YAC5D,IAAA,kBAAS,GAAE,CAAC,IAAI,CACd,sBAAsB,MAAM,yBAAyB,OAAO,4BAA4B,CACzF,CAAC;YACF,OAAO;QACT,CAAC;QAED,wBAAwB;QACxB,MAAM,OAAO,GAAG;YACd,EAAE,EAAE,MAAM;YACV,MAAM,EAAE,EAAE,MAAM,EAAE,IAAI,CAAC,SAAS,EAAE;YAClC,MAAM,EAAE,SAAkB;YAC1B,UAAU,EAAE,EAAE,IAAI,EAAE,OAAO,EAAE;SAC9B,CAAC;QAEF,yDAAyD;QACzD,MAAM,WAAW,GAAG,YAAY;YAC9B,CAAC,CAAC,aAAa,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,EAAE,KAAK,MAAM,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;YAC3D,CAAC,CAAC,CAAC,GAAG,aAAa,EAAE,OAAO,CAAC,CAAC;QAEhC,gBAAgB;QAChB,MAAM,MAAM,CAAC,IAAI,CACf,IAAI,sCAAsC,CAAC;YACzC,MAAM,EAAE,IAAI,CAAC,UAAU;YACvB,sBAAsB,EAAE;gBACtB,KAAK,EAAE,WAAsE;aAC9E;SACF,CAAC,CACH,CAAC;QAEF,IAAA,kBAAS,GAAE,CAAC,IAAI,CACd,sBAAsB,MAAM,iBAAiB,OAAO,8BAA8B,IAAI,CAAC,SAAS,GAAG,CACpG,CAAC;IACJ,CAAC;IAED;;;;;OAKG;IACK,oBAAoB,CAAC,OAAe;QAC1C,OAAO,iBAAiB,OAAO,GAAG,CAAC;IACrC,CAAC;IAED;;OAEG;IACH,OAAO;QACL,IAAI,CAAC,QAAQ,EAAE,OAAO,EAAE,CAAC;IAC3B,CAAC;CACF;AAhRD,kCAgRC"}
+{"version":3,"file":"s3-offloader.js","sourceRoot":"","sources":["../../../src/shared/utils/s3-offloader.ts"],"names":[],"mappings":";AAAA;;;;;;;;;;;;;;GAcG;;;AAEH,qCAAqC;AAErC,mFAAmF;AACnF,MAAM,uBAAuB,GAAG,GAAG,GAAG,IAAI,CAAC;AAE3C,mDAAmD;AACnD,MAAM,kBAAkB,GAAG,wBAAwB,CAAC;AAEpD;;;;;GAKG;AACH,MAAM,8BAA8B,GAAG,QAAQ,CAAC;AAEhD,+HAA+H;AAE/H,kEAAkE;AAClE,iFAAiF;AACjF,IAAI,KAAsD,CAAC;AAE3D,SAAS,QAAQ;IACf,IAAI,CAAC,KAAK,EAAE,CAAC;QACX,KAAK,GAAG,OAAO,CAAC,oBAAoB,CAAC,CAAC;IACxC,CAAC;IACD,OAAO,KAAM,CAAC;AAChB,CAAC;AAgCD;;;;;;;;;;;;;;;;;;;GAmBG;AACH,MAAa,WAAW;IACd,QAAQ,CAA8D;IAC7D,UAAU,CAAS;IACnB,SAAS,CAAS;IAClB,cAAc,CAAS;IACvB,oBAAoB,CAAS;IAC7B,WAAW,CAAU;IACrB,YAAY,CAAmC;IAEhE,YAAY,MAAuB;QACjC,IAAI,CAAC,UAAU,GAAG,MAAM,CAAC,UAAU,CAAC;QACpC,IAAI,CAAC,SAAS,GAAG,MAAM,CAAC,SAAS,IAAI,kBAAkB,CAAC;QACxD,IAAI,CAAC,cAAc,GAAG,MAAM,CAAC,cAAc,IAAI,uBAAuB,CAAC;QACvE,IAAI,CAAC,oBAAoB,GAAG,MAAM,CAAC,oBAAoB,IAAI,8BAA8B,CAAC;QAC1F,IAAI,CAAC,WAAW,GAAG,MAAM,CAAC,WAAW,CAAC;QACtC,IAAI,CAAC,YAAY,GAAG,MAAM,CAAC,YAAY,CAAC;IAC1C,CAAC;IAED;;;OAGG;IACK,SAAS;QACf,IAAI,CAAC,IAAI,CAAC,QAAQ,EAAE,CAAC;YACnB,MAAM,EAAE,QAAQ,EAAE,GAAG,QAAQ,EAAE,CAAC;YAChC,IAAI,CAAC,QAAQ,GAAG,IAAI,QAAQ,CAAC,CAAC,IAAI,CAAC,YAAY,IAAI,EAAE,CAA4B,CAAC,CAAC;QACrF,CAAC;QACD,OAAO,IAAI,CAAC,QAAQ,CAAC;IACvB,CAAC;IAED;;;;;OAKG;IACH,aAAa,CAAC,IAAgB;QAC5B,OAAO,IAAI,CAAC,MAAM,IAAI,IAAI,CAAC,cAAc,CAAC;IAC5C,CAAC;IAED;;;;;;;OAOG;IACH,QAAQ,CAAC,QAAgB,EAAE,YAAoB,EAAE,KAAa;QAC5D,OAAO,GAAG,IAAI,CAAC,SAAS,GAAG,QAAQ,IAAI,YAAY,IAAI,KAAK,MAAM,CAAC;IACrE,CAAC;IAED;;;;;;OAMG;IACH,KAAK,CAAC,MAAM,CAAC,GAAW,EAAE,IAAgB;QACxC,MAAM,EAAE,gBAAgB,EAAE,GAAG,QAAQ,EAAE,CAAC;QACxC,MAAM,MAAM,GAAG,IAAI,CAAC,SAAS,EAAE,CAAC;QAEhC,MAAM,MAAM,CAAC,IAAI,CACf,IAAI,gBAAgB,CAAC;YACnB,MAAM,EAAE,IAAI,CAAC,UAAU;YACvB,GAAG,EAAE,GAAG;YACR,IAAI,EAAE,IAAI;YACV,WAAW,EAAE,0BAA0B;YACvC,oBAAoB,EAAE,IAAI;iBACvB,oBAAyE;YAC5E,GAAG,CAAC,IAAI,CAAC,WAAW,IAAI,EAAE,WAAW,EAAE,IAAI,CAAC,WAAW,EAAE,CAAC;SAC3D,CAAC,CACH,CAAC;QAEF,OAAO,GAAG,CAAC;IACb,CAAC;IAED;;;;;;OAMG;IACH,KAAK,CAAC,QAAQ,CAAC,GAAW;QACxB,MAAM,EAAE,gBAAgB,EAAE,GAAG,QAAQ,EAAE,CAAC;QACxC,MAAM,MAAM,GAAG,IAAI,CAAC,SAAS,EAAE,CAAC;QAEhC,MAAM,QAAQ,GAAG,MAAM,MAAM,CAAC,IAAI,CAChC,IAAI,gBAAgB,CAAC;YACnB,MAAM,EAAE,IAAI,CAAC,UAAU;YACvB,GAAG,EAAE,GAAG;SACT,CAAC,CACH,CAAC;QAEF,IAAI,CAAC,QAAQ,CAAC,IAAI,EAAE,CAAC;YACnB,MAAM,IAAI,KAAK,CAAC,oCAAoC,GAAG,EAAE,CAAC,CAAC;QAC7D,CAAC;QAED,4CAA4C;QAC5C,MAAM,SAAS,GAAG,MAAM,QAAQ,CAAC,IAAI,CAAC,oBAAoB,EAAE,CAAC;QAC7D,OAAO,IAAI,UAAU,CAAC,SAAS,CAAC,CAAC;IACnC,CAAC;IAED;;;;OAIG;IACH,KAAK,CAAC,MAAM,CAAC,GAAW;QACtB,MAAM,EAAE,mBAAmB,EAAE,GAAG,QAAQ,EAAE,CAAC;QAC3C,MAAM,MAAM,GAAG,IAAI,CAAC,SAAS,EAAE,CAAC;QAEhC,MAAM,MAAM,CAAC,IAAI,CACf,IAAI,mBAAmB,CAAC;YACtB,MAAM,EAAE,IAAI,CAAC,UAAU;YACvB,GAAG,EAAE,GAAG;SACT,CAAC,CACH,CAAC;IACJ,CAAC;IAED;;;;OAIG;IACH,KAAK,CAAC,WAAW,CAAC,IAAc;QAC9B,IAAI,IAAI,CAAC,MAAM,KAAK,CAAC;YAAE,OAAO;QAE9B,MAAM,EAAE,oBAAoB,EAAE,GAAG,QAAQ,EAAE,CAAC;QAC5C,MAAM,MAAM,GAAG,IAAI,CAAC,SAAS,EAAE,CAAC;QAEhC,wDAAwD;QACxD,MAAM,SAAS,GAAG,IAAI,CAAC;QACvB,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,IAAI,CAAC,MAAM,EAAE,CAAC,IAAI,SAAS,EAAE,CAAC;YAChD,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,GAAG,SAAS,CAAC,CAAC;YAC3C,MAAM,QAAQ,GAAG,MAAM,MAAM,CAAC,IAAI,CAChC,IAAI,oBAAoB,CAAC;gBACvB,MAAM,EAAE,IAAI,CAAC,UAAU;gBACvB,MAAM,EAAE;oBACN,OAAO,EAAE,KAAK,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC,EAAE,GAAG,EAAE,GAAG,EAAE,CAAC,CAAC;oBAC3C,KAAK,EAAE,IAAI;iBACZ;aACF,CAAC,CACH,CAAC;YAEF,6DAA6D;YAC7D,IAAI,QAAQ,CAAC,MAAM,IAAI,QAAQ,CAAC,MAAM,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;gBAClD,MAAM,UAAU,GAAG,QAAQ,CAAC,MAAM,CAAC,GAAG,CACpC,CAAC,GAAG,EAAE,EAAE,CAAC,GAAG,GAAG,CAAC,GAAG,KAAK,GAAG,CAAC,IAAI,KAAK,GAAG,CAAC,OAAO,GAAG,CACpD,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;gBACb,IAAA,kBAAS,GAAE,CAAC,IAAI,CACd,mBAAmB,QAAQ,CAAC,MAAM,CAAC,MAAM,8BAA8B,UAAU,EAAE,CACpF,CAAC;YACJ,CAAC;QACH,CAAC;IACH,CAAC;IAED;;OAEG;IACH,YAAY;QACV,OAAO,IAAI,CAAC,SAAS,CAAC;IACxB,CAAC;IAED;;;;;;;;;OASG;IACH,KAAK,CAAC,mBAAmB,CAAC,OAAe;QACvC,MAAM,EAAE,sCAAsC,EAAE,sCAAsC,EAAE,GACtF,QAAQ,EAAE,CAAC;QACb,MAAM,MAAM,GAAG,IAAI,CAAC,SAAS,EAAE,CAAC;QAEhC,MAAM,MAAM,GAAG,IAAI,CAAC,oBAAoB,EAAE,CAAC;QAE3C,2CAA2C;QAC3C,IAAI,aAAa,GAMZ,EAAE,CAAC;QAER,IAAI,CAAC;YACH,MAAM,QAAQ,GAAG,MAAM,MAAM,CAAC,IAAI,CAChC,IAAI,sCAAsC,CAAC,EAAE,MAAM,EAAE,IAAI,CAAC,UAAU,EAAE,CAAC,CACxE,CAAC;YACF,aAAa,GAAI,QAAQ,CAAC,KAA8B,IAAI,EAAE,CAAC;QACjE,CAAC;QAAC,OAAO,KAAc,EAAE,CAAC;YACxB,qFAAqF;YACrF,IACE,KAAK;gBACL,OAAO,KAAK,KAAK,QAAQ;gBACzB,MAAM,IAAI,KAAK;gBACd,KAA0B,CAAC,IAAI,KAAK,8BAA8B,EACnE,CAAC;gBACD,aAAa,GAAG,EAAE,CAAC;YACrB,CAAC;iBAAM,CAAC;gBACN,MAAM,KAAK,CAAC;YACd,CAAC;QACH,CAAC;QAED,qDAAqD;QACrD,MAAM,YAAY,GAAG,aAAa,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,KAAK,MAAM,CAAC,CAAC;QAChE,IACE,YAAY;YACZ,YAAY,CAAC,MAAM,KAAK,SAAS;YACjC,YAAY,CAAC,UAAU;YACtB,YAAY,CAAC,UAAgC,CAAC,IAAI,KAAK,OAAO,EAC/D,CAAC;YACD,4DAA4D;YAC5D,IAAA,kBAAS,GAAE,CAAC,IAAI,CACd,sBAAsB,MAAM,yBAAyB,OAAO,4BAA4B,CACzF,CAAC;YACF,OAAO;QACT,CAAC;QAED,wBAAwB;QACxB,MAAM,OAAO,GAAG;YACd,EAAE,EAAE,MAAM;YACV,MAAM,EAAE,EAAE,MAAM,EAAE,IAAI,CAAC,SAAS,EAAE;YAClC,MAAM,EAAE,SAAkB;YAC1B,UAAU,EAAE,EAAE,IAAI,EAAE,OAAO,EAAE;SAC9B,CAAC;QAEF,yDAAyD;QACzD,MAAM,WAAW,GAAG,YAAY;YAC9B,CAAC,CAAC,aAAa,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,EAAE,KAAK,MAAM,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;YAC3D,CAAC,CAAC,CAAC,GAAG,aAAa,EAAE,OAAO,CAAC,CAAC;QAEhC,gBAAgB;QAChB,MAAM,MAAM,CAAC,IAAI,CACf,IAAI,sCAAsC,CAAC;YACzC,MAAM,EAAE,IAAI,CAAC,UAAU;YACvB,sBAAsB,EAAE;gBACtB,KAAK,EAAE,WAAsE;aAC9E;SACF,CAAC,CACH,CAAC;QAEF,IAAA,kBAAS,GAAE,CAAC,IAAI,CACd,sBAAsB,MAAM,iBAAiB,OAAO,8BAA8B,IAAI,CAAC,SAAS,GAAG,CACpG,CAAC;IACJ,CAAC;IAED;;;;;;;;OAQG;IACK,oBAAoB;QAC1B,qFAAqF;QACrF,MAAM,IAAI,GAAG,IAAI,CAAC,SAAS,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,OAAO,CAAC,gBAAgB,EAAE,GAAG,CAAC,IAAI,SAAS,CAAC;QAC5F,OAAO,iBAAiB,IAAI,EAAE,CAAC;IACjC,CAAC;IAED;;OAEG;IACH,OAAO;QACL,IAAI,CAAC,QAAQ,EAAE,OAAO,EAAE,CAAC;IAC3B,CAAC;CACF;AAnRD,kCAmRC"}

package/dist/shared/utils/s3-orphans.d.ts

@@ -0,0 +1,16 @@
+/**
+ * Best-effort S3 orphan cleanup shared by checkpointer writers.
+ *
+ * When a DynamoDB write fails *after* payloads have already been uploaded to S3,
+ * this helper deletes the uploaded objects so they don't linger until the
+ * lifecycle rule sweeps them.
+ *
+ * Transient S3 errors (503 SlowDown, 500 InternalError, throttling, socket
+ * blips) get bounded retries with full-jitter backoff so a single bad minute
+ * doesn't leak objects. Persistent failures are only logged — the lifecycle
+ * rule is the ultimate backstop and failing the caller's write *after* DDB has
+ * already rolled back would add confusion, not safety.
+ */
+import type { S3Offloader } from './s3-offloader';
+export declare function cleanUpS3Orphans(offloader: S3Offloader, keys: ReadonlyArray<string | undefined>, context: string): Promise<void>;
+//# sourceMappingURL=s3-orphans.d.ts.map

package/dist/shared/utils/s3-orphans.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"s3-orphans.d.ts","sourceRoot":"","sources":["../../../src/shared/utils/s3-orphans.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;GAYG;AAGH,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,gBAAgB,CAAC;AAqClD,wBAAsB,gBAAgB,CACpC,SAAS,EAAE,WAAW,EACtB,IAAI,EAAE,aAAa,CAAC,MAAM,GAAG,SAAS,CAAC,EACvC,OAAO,EAAE,MAAM,GACd,OAAO,CAAC,IAAI,CAAC,CA4Bf"}

package/dist/shared/utils/s3-orphans.js

@@ -0,0 +1,79 @@
+"use strict";
+/**
+ * Best-effort S3 orphan cleanup shared by checkpointer writers.
+ *
+ * When a DynamoDB write fails *after* payloads have already been uploaded to S3,
+ * this helper deletes the uploaded objects so they don't linger until the
+ * lifecycle rule sweeps them.
+ *
+ * Transient S3 errors (503 SlowDown, 500 InternalError, throttling, socket
+ * blips) get bounded retries with full-jitter backoff so a single bad minute
+ * doesn't leak objects. Persistent failures are only logged — the lifecycle
+ * rule is the ultimate backstop and failing the caller's write *after* DDB has
+ * already rolled back would add confusion, not safety.
+ */
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.cleanUpS3Orphans = cleanUpS3Orphans;
+const logger_1 = require("./logger");
+const sleep_1 = require("./sleep");
+const ORPHAN_CLEANUP_MAX_ATTEMPTS = 3;
+const ORPHAN_CLEANUP_BASE_DELAY_MS = 100;
+const ORPHAN_CLEANUP_MAX_DELAY_MS = 2_000;
+/** Error codes/names that indicate an S3 request is worth re-issuing. */
+const RETRYABLE_S3_SIGNALS = [
+    'SlowDown',
+    'InternalError',
+    'ServiceUnavailable',
+    'RequestTimeout',
+    'ThrottlingException',
+    'ProvisionedThroughputExceededException',
+    // Node-level network transients (also caught by @aws-sdk/client-s3 wrappers).
+    'ECONNRESET',
+    'ECONNREFUSED',
+    'ETIMEDOUT',
+    'EPIPE',
+    'NetworkingError',
+    'TimeoutError',
+];
+function isTransientS3Error(err) {
+    if (!err || typeof err !== 'object')
+        return false;
+    const signals = [];
+    const e = err;
+    if (typeof e.name === 'string')
+        signals.push(e.name);
+    if (typeof e.code === 'string')
+        signals.push(e.code);
+    const status = e.$metadata?.httpStatusCode;
+    if (typeof status === 'number' && (status === 429 || (status >= 500 && status < 600))) {
+        return true;
+    }
+    return RETRYABLE_S3_SIGNALS.some((s) => signals.some((sig) => sig.includes(s)));
+}
+async function cleanUpS3Orphans(offloader, keys, context) {
+    const orphans = keys.filter((k) => typeof k === 'string' && k.length > 0);
+    if (orphans.length === 0)
+        return;
+    let delay = ORPHAN_CLEANUP_BASE_DELAY_MS;
+    let lastErr;
+    for (let attempt = 1; attempt <= ORPHAN_CLEANUP_MAX_ATTEMPTS; attempt++) {
+        try {
+            await offloader.deleteBatch(orphans);
+            return;
+        }
+        catch (err) {
+            lastErr = err;
+            if (attempt >= ORPHAN_CLEANUP_MAX_ATTEMPTS || !isTransientS3Error(err)) {
+                break;
+            }
+            await (0, sleep_1.sleep)((0, sleep_1.fullJitter)(delay));
+            delay = Math.min(delay * 2, ORPHAN_CLEANUP_MAX_DELAY_MS);
+        }
+    }
+    const msg = lastErr && typeof lastErr === 'object' && 'message' in lastErr
+        ? String(lastErr.message)
+        : String(lastErr);
+    (0, logger_1.getLogger)().warn(`Failed to clean up orphaned S3 objects after ${context} ` +
+        `(${ORPHAN_CLEANUP_MAX_ATTEMPTS} attempts, lifecycle rule will sweep): ${msg}`);
+}
+//# sourceMappingURL=s3-orphans.js.map

package/dist/shared/utils/s3-orphans.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"s3-orphans.js","sourceRoot":"","sources":["../../../src/shared/utils/s3-orphans.ts"],"names":[],"mappings":";AAAA;;;;;;;;;;;;GAYG;;AAwCH,4CAgCC;AAtED,qCAAqC;AAErC,mCAA4C;AAE5C,MAAM,2BAA2B,GAAG,CAAC,CAAC;AACtC,MAAM,4BAA4B,GAAG,GAAG,CAAC;AACzC,MAAM,2BAA2B,GAAG,KAAK,CAAC;AAE1C,yEAAyE;AACzE,MAAM,oBAAoB,GAAsB;IAC9C,UAAU;IACV,eAAe;IACf,oBAAoB;IACpB,gBAAgB;IAChB,qBAAqB;IACrB,wCAAwC;IACxC,8EAA8E;IAC9E,YAAY;IACZ,cAAc;IACd,WAAW;IACX,OAAO;IACP,iBAAiB;IACjB,cAAc;CACf,CAAC;AAEF,SAAS,kBAAkB,CAAC,GAAY;IACtC,IAAI,CAAC,GAAG,IAAI,OAAO,GAAG,KAAK,QAAQ;QAAE,OAAO,KAAK,CAAC;IAClD,MAAM,OAAO,GAAa,EAAE,CAAC;IAC7B,MAAM,CAAC,GAAG,GAAkF,CAAC;IAC7F,IAAI,OAAO,CAAC,CAAC,IAAI,KAAK,QAAQ;QAAE,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC;IACrD,IAAI,OAAO,CAAC,CAAC,IAAI,KAAK,QAAQ;QAAE,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC;IACrD,MAAM,MAAM,GAAG,CAAC,CAAC,SAAS,EAAE,cAAc,CAAC;IAC3C,IAAI,OAAO,MAAM,KAAK,QAAQ,IAAI,CAAC,MAAM,KAAK,GAAG,IAAI,CAAC,MAAM,IAAI,GAAG,IAAI,MAAM,GAAG,GAAG,CAAC,CAAC,EAAE,CAAC;QACtF,OAAO,IAAI,CAAC;IACd,CAAC;IACD,OAAO,oBAAoB,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;AAClF,CAAC;AAEM,KAAK,UAAU,gBAAgB,CACpC,SAAsB,EACtB,IAAuC,EACvC,OAAe;IAEf,MAAM,OAAO,GAAG,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,EAAe,EAAE,CAAC,OAAO,CAAC,KAAK,QAAQ,IAAI,CAAC,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC;IACvF,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO;IAEjC,IAAI,KAAK,GAAG,4BAA4B,CAAC;IACzC,IAAI,OAAgB,CAAC;IACrB,KAAK,IAAI,OAAO,GAAG,CAAC,EAAE,OAAO,IAAI,2BAA2B,EAAE,OAAO,EAAE,EAAE,CAAC;QACxE,IAAI,CAAC;YACH,MAAM,SAAS,CAAC,WAAW,CAAC,OAAO,CAAC,CAAC;YACrC,OAAO;QACT,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,OAAO,GAAG,GAAG,CAAC;YACd,IAAI,OAAO,IAAI,2BAA2B,IAAI,CAAC,kBAAkB,CAAC,GAAG,CAAC,EAAE,CAAC;gBACvE,MAAM;YACR,CAAC;YACD,MAAM,IAAA,aAAK,EAAC,IAAA,kBAAU,EAAC,KAAK,CAAC,CAAC,CAAC;YAC/B,KAAK,GAAG,IAAI,CAAC,GAAG,CAAC,KAAK,GAAG,CAAC,EAAE,2BAA2B,CAAC,CAAC;QAC3D,CAAC;IACH,CAAC;IAED,MAAM,GAAG,GACP,OAAO,IAAI,OAAO,OAAO,KAAK,QAAQ,IAAI,SAAS,IAAI,OAAO;QAC5D,CAAC,CAAC,MAAM,CAAE,OAAgC,CAAC,OAAO,CAAC;QACnD,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC;IACtB,IAAA,kBAAS,GAAE,CAAC,IAAI,CACd,gDAAgD,OAAO,GAAG;QACxD,IAAI,2BAA2B,0CAA0C,GAAG,EAAE,CACjF,CAAC;AACJ,CAAC"}

package/dist/shared/utils/sleep.d.ts

@@ -0,0 +1,48 @@
+/**
+ * Backoff helper shared by the UnprocessedItems / UnprocessedKeys retry loops
+ * in batch-write and BatchGetItem paths. Centralized so both call sites use
+ * the same cap, growth, and sleep semantics.
+ */
+/**
+ * Sleep for `ms` milliseconds, optionally cancellable via an `AbortSignal`.
+ *
+ * If `signal` is already aborted the returned promise rejects synchronously with
+ * the signal's abort reason. Otherwise the timer resolves on the normal path and
+ * the abort listener is removed to avoid leaking handlers.
+ *
+ * The `settled` flag is a belt-and-braces guard: `{ once: true }` already
+ * prevents the listener from firing twice, but the guard also ensures we never
+ * resolve *and* reject (which would produce an unhandled rejection if the timer
+ * and abort event fire in the same microtask turn).
+ */
+export declare function sleep(ms: number, signal?: AbortSignal): Promise<void>;
+/**
+ * Exponential-backoff delay calculator. Given the *previous* delay, returns the
+ * next delay — double it, capped at `max`. Use with {@link sleep} and
+ * {@link fullJitter} so concurrent retriers don't synchronize.
+ *
+ *   let delay = INITIAL_DELAY_MS;
+ *   while (keep_going) {
+ *     await sleep(fullJitter(delay));
+ *     delay = nextBackoffDelay(delay);
+ *   }
+ */
+export declare function nextBackoffDelay(currentMs: number, maxMs?: number): number;
+/**
+ * Apply full jitter (AWS recommended) to a backoff delay.
+ *
+ * Returns a uniform random value in `[0, delayMs)`. Spreading retries across the
+ * backoff window prevents the thundering-herd pattern where every throttled
+ * client wakes up at the same instant and re-throttles the service.
+ * See https://aws.amazon.com/blogs/architecture/exponential-backoff-and-jitter/
+ */
+export declare function fullJitter(delayMs: number): number;
+/**
+ * Starting delay for UnprocessedItems / UnprocessedKeys retry loops.
+ */
+export declare const INITIAL_BACKOFF_DELAY_MS = 100;
+/**
+ * Maximum delay for UnprocessedItems / UnprocessedKeys retry loops.
+ */
+export declare const MAX_BACKOFF_DELAY_MS = 5000;
+//# sourceMappingURL=sleep.d.ts.map

package/dist/shared/utils/sleep.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"sleep.d.ts","sourceRoot":"","sources":["../../../src/shared/utils/sleep.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAKH;;;;;;;;;;;GAWG;AACH,wBAAgB,KAAK,CAAC,EAAE,EAAE,MAAM,EAAE,MAAM,CAAC,EAAE,WAAW,GAAG,OAAO,CAAC,IAAI,CAAC,CAoBrE;AAED;;;;;;;;;;GAUG;AACH,wBAAgB,gBAAgB,CAAC,SAAS,EAAE,MAAM,EAAE,KAAK,GAAE,MAA6B,GAAG,MAAM,CAEhG;AAED;;;;;;;GAOG;AACH,wBAAgB,UAAU,CAAC,OAAO,EAAE,MAAM,GAAG,MAAM,CAElD;AAED;;GAEG;AACH,eAAO,MAAM,wBAAwB,MAA2B,CAAC;AAEjE;;GAEG;AACH,eAAO,MAAM,oBAAoB,OAAuB,CAAC"}