@farukada/aws-langgraph-dynamodb-ts 0.8.0 → 0.9.0

package/dist/checkpointer/internal/special-write-verify.d.ts

@@ -0,0 +1,54 @@
+import type { PayloadDescriptor } from '../../shared/codec/codec';
+import type { CheckpointWriteItem } from '../types';
+import type { CheckpointerContext } from './setup';
+/**
+ * A special row already carries a per-call ULID in `writeGroup`, so it needs no
+ * extra revision attribute to compare and swap on.
+ */
+export declare const SPECIAL_REVISION_ATTRIBUTE = "writeGroup";
+/** What a special item's row held before this call tried to overwrite it. */
+export interface SpecialRowState {
+    exists: boolean;
+    value?: PayloadDescriptor;
+    revision?: string;
+}
+/** Outcome of one special item's conditional write. Never thrown, always returned. */
+export interface SpecialWriteOutcome {
+    committed: boolean;
+    superseded?: PayloadDescriptor;
+    error?: Error;
+}
+/** What a post-failure verification read established about the attempt. */
+export interface VerifiedFailure {
+    outcome: SpecialWriteOutcome;
+    /** Present only when the row was read and holds some other writer's group. */
+    observed?: SpecialRowState;
+}
+/** Read a special row's current descriptor and the writeGroup guarding it. */
+export declare function readSpecialRow(context: CheckpointerContext, item: CheckpointWriteItem): Promise<SpecialRowState>;
+/**
+ * Read the row back after a put failed, and report what that failure actually
+ * did — never assuming it did nothing.
+ *
+ * No rejection is proof of a non-commit. `withDynamoDBRetry` re-issues a put
+ * whose response was lost, and those re-issues can time out at the transport
+ * without ever reaching DynamoDB, so the budget is spent on a
+ * `RetryExhaustedError` and never on a `ConditionalCheckFailedException` — yet
+ * the row is committed. Reporting that as a confirmed non-commit let
+ * `writeSpecialItemsWithCleanup` delete the S3 object the live row points at,
+ * so every later `getTuple()` on that checkpoint failed with `NoSuchKey`,
+ * permanently.
+ *
+ * Three answers are possible:
+ * - the row holds this item's own `writeGroup`: the write landed, and the
+ *   descriptor this attempt pinned is the dead one.
+ * - the row holds some other group: the write is confirmed not to be what is
+ *   live, so this item's own upload is the dead one. `observed` is returned so
+ *   a rejected compare-and-swap can re-pin and try again.
+ * - the read itself fails: nothing is confirmed, so the outcome still reports a
+ *   commit and keeps the originating error. That leaks one S3 object at worst
+ *   (reclaimed by `ensureS3LifecycleRule`) where the alternative strands a live
+ *   row — the same trade `store/internal/persist.ts` makes.
+ */
+export declare function verifyAfterFailure(context: CheckpointerContext, item: CheckpointWriteItem, attempted: SpecialRowState, error: Error): Promise<VerifiedFailure>;
+//# sourceMappingURL=special-write-verify.d.ts.map

package/dist/checkpointer/internal/special-write-verify.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"special-write-verify.d.ts","sourceRoot":"","sources":["../../../src/checkpointer/internal/special-write-verify.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,0BAA0B,CAAC;AAElE,OAAO,KAAK,EAAE,mBAAmB,EAAE,MAAM,UAAU,CAAC;AACpD,OAAO,KAAK,EAAE,mBAAmB,EAAE,MAAM,SAAS,CAAC;AAEnD;;;GAGG;AACH,eAAO,MAAM,0BAA0B,eAAe,CAAC;AAEvD,6EAA6E;AAC7E,MAAM,WAAW,eAAe;IAC9B,MAAM,EAAE,OAAO,CAAC;IAChB,KAAK,CAAC,EAAE,iBAAiB,CAAC;IAC1B,QAAQ,CAAC,EAAE,MAAM,CAAC;CACnB;AAED,sFAAsF;AACtF,MAAM,WAAW,mBAAmB;IAClC,SAAS,EAAE,OAAO,CAAC;IACnB,UAAU,CAAC,EAAE,iBAAiB,CAAC;IAC/B,KAAK,CAAC,EAAE,KAAK,CAAC;CACf;AAED,2EAA2E;AAC3E,MAAM,WAAW,eAAe;IAC9B,OAAO,EAAE,mBAAmB,CAAC;IAC7B,8EAA8E;IAC9E,QAAQ,CAAC,EAAE,eAAe,CAAC;CAC5B;AAED,8EAA8E;AAC9E,wBAAsB,cAAc,CAClC,OAAO,EAAE,mBAAmB,EAC5B,IAAI,EAAE,mBAAmB,GACxB,OAAO,CAAC,eAAe,CAAC,CAgB1B;AAED;;;;;;;;;;;;;;;;;;;;;;;GAuBG;AACH,wBAAsB,kBAAkB,CACtC,OAAO,EAAE,mBAAmB,EAC5B,IAAI,EAAE,mBAAmB,EACzB,SAAS,EAAE,eAAe,EAC1B,KAAK,EAAE,KAAK,GACX,OAAO,CAAC,eAAe,CAAC,CAU1B"}

package/dist/checkpointer/internal/special-write-verify.js

@@ -0,0 +1,65 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.SPECIAL_REVISION_ATTRIBUTE = void 0;
+exports.readSpecialRow = readSpecialRow;
+exports.verifyAfterFailure = verifyAfterFailure;
+const retry_1 = require("../../shared/dynamodb/retry");
+/**
+ * A special row already carries a per-call ULID in `writeGroup`, so it needs no
+ * extra revision attribute to compare and swap on.
+ */
+exports.SPECIAL_REVISION_ATTRIBUTE = 'writeGroup';
+/** Read a special row's current descriptor and the writeGroup guarding it. */
+async function readSpecialRow(context, item) {
+    const result = await (0, retry_1.withDynamoDBRetry)(() => context.client.get({
+        TableName: context.tableName,
+        Key: { PK: item.PK, SK: item.SK },
+        ConsistentRead: true,
+        ProjectionExpression: '#v, #g',
+        ExpressionAttributeNames: { '#v': 'value', '#g': exports.SPECIAL_REVISION_ATTRIBUTE },
+    }));
+    if (!result.Item)
+        return { exists: false };
+    return {
+        exists: true,
+        value: result.Item.value,
+        revision: result.Item[exports.SPECIAL_REVISION_ATTRIBUTE],
+    };
+}
+/**
+ * Read the row back after a put failed, and report what that failure actually
+ * did — never assuming it did nothing.
+ *
+ * No rejection is proof of a non-commit. `withDynamoDBRetry` re-issues a put
+ * whose response was lost, and those re-issues can time out at the transport
+ * without ever reaching DynamoDB, so the budget is spent on a
+ * `RetryExhaustedError` and never on a `ConditionalCheckFailedException` — yet
+ * the row is committed. Reporting that as a confirmed non-commit let
+ * `writeSpecialItemsWithCleanup` delete the S3 object the live row points at,
+ * so every later `getTuple()` on that checkpoint failed with `NoSuchKey`,
+ * permanently.
+ *
+ * Three answers are possible:
+ * - the row holds this item's own `writeGroup`: the write landed, and the
+ *   descriptor this attempt pinned is the dead one.
+ * - the row holds some other group: the write is confirmed not to be what is
+ *   live, so this item's own upload is the dead one. `observed` is returned so
+ *   a rejected compare-and-swap can re-pin and try again.
+ * - the read itself fails: nothing is confirmed, so the outcome still reports a
+ *   commit and keeps the originating error. That leaks one S3 object at worst
+ *   (reclaimed by `ensureS3LifecycleRule`) where the alternative strands a live
+ *   row — the same trade `store/internal/persist.ts` makes.
+ */
+async function verifyAfterFailure(context, item, attempted, error) {
+    try {
+        const observed = await readSpecialRow(context, item);
+        if (observed.revision === item.writeGroup) {
+            return { outcome: { committed: true, superseded: attempted.value } };
+        }
+        return { outcome: { committed: false, error }, observed };
+    }
+    catch {
+        return { outcome: { committed: true, error } };
+    }
+}
+//# sourceMappingURL=special-write-verify.js.map

package/dist/checkpointer/internal/special-write-verify.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"special-write-verify.js","sourceRoot":"","sources":["../../../src/checkpointer/internal/special-write-verify.ts"],"names":[],"mappings":";;;;;AACA,uDAAgE;AAIhE;;;GAGG;AACU,QAAA,0BAA0B,GAAG,YAAY,CAAC;AAuBvD,8EAA8E;AACvE,KAAK,yBACV,OAA4B,EAC5B,IAAyB;IAEzB,MAAM,MAAM,GAAG,MAAM,IAAA,yBAAiB,EAAC,GAAG,EAAE,CAC1C,OAAO,CAAC,MAAM,CAAC,GAAG,CAAC;QACjB,SAAS,EAAE,OAAO,CAAC,SAAS;QAC5B,GAAG,EAAE,EAAE,EAAE,EAAE,IAAI,CAAC,EAAE,EAAE,EAAE,EAAE,IAAI,CAAC,EAAE,EAAE;QACjC,cAAc,EAAE,IAAI;QACpB,oBAAoB,EAAE,QAAQ;QAC9B,wBAAwB,EAAE,EAAE,IAAI,EAAE,OAAO,EAAE,IAAI,EAAE,QAAA,0BAA0B,EAAE;KAC9E,CAAC,CACH,CAAC;IACF,IAAI,CAAC,MAAM,CAAC,IAAI;QAAE,OAAO,EAAE,MAAM,EAAE,KAAK,EAAE,CAAC;IAC3C,OAAO;QACL,MAAM,EAAE,IAAI;QACZ,KAAK,EAAE,MAAM,CAAC,IAAI,CAAC,KAAsC;QACzD,QAAQ,EAAE,MAAM,CAAC,IAAI,CAAC,QAAA,0BAA0B,CAAuB;KACxE,CAAC;AACJ,CAAC;AAED;;;;;;;;;;;;;;;;;;;;;;;GAuBG;AACI,KAAK,6BACV,OAA4B,EAC5B,IAAyB,EACzB,SAA0B,EAC1B,KAAY;IAEZ,IAAI,CAAC;QACH,MAAM,QAAQ,GAAG,MAAM,cAAc,CAAC,OAAO,EAAE,IAAI,CAAC,CAAC;QACrD,IAAI,QAAQ,CAAC,QAAQ,KAAK,IAAI,CAAC,UAAU,EAAE,CAAC;YAC1C,OAAO,EAAE,OAAO,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,UAAU,EAAE,SAAS,CAAC,KAAK,EAAE,EAAE,CAAC;QACvE,CAAC;QACD,OAAO,EAAE,OAAO,EAAE,EAAE,SAAS,EAAE,KAAK,EAAE,KAAK,EAAE,EAAE,QAAQ,EAAE,CAAC;IAC5D,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,EAAE,OAAO,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,KAAK,EAAE,EAAE,CAAC;IACjD,CAAC;AACH,CAAC"}

package/dist/checkpointer/internal/write-guard.d.ts

@@ -1,13 +1,5 @@
 import type { CheckpointWriteItem } from '../types';
 import type { CheckpointerContext } from './setup';
-/**
- * True when the guard rejected a write — NOT evidence a competitor won: a
- * `PutCommand` retried after its response was lost can re-hit its own
- * committed row and fail identically; the two cases are indistinguishable.
- */
-export declare function isConditionalCheckFailed(error: {
-    name?: string;
-}): boolean;
 /**
  * Report a guard rejection. Sort keys carry their channel, so a rejection
  * normally means this exact (task, channel, occurrence) row is already

package/dist/checkpointer/internal/write-guard.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"write-guard.d.ts","sourceRoot":"","sources":["../../../src/checkpointer/internal/write-guard.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,mBAAmB,EAAE,MAAM,UAAU,CAAC;AACpD,OAAO,KAAK,EAAE,mBAAmB,EAAE,MAAM,SAAS,CAAC;AAEnD;;;;GAIG;AACH,wBAAgB,wBAAwB,CAAC,KAAK,EAAE;IAAE,IAAI,CAAC,EAAE,MAAM,CAAA;CAAE,GAAG,OAAO,CAE1E;AAcD;;;;;;;;GAQG;AACH,wBAAgB,oBAAoB,CAClC,OAAO,EAAE,mBAAmB,EAC5B,IAAI,EAAE,mBAAmB,EACzB,KAAK,EAAE,KAAK,GACX,IAAI,CAcN"}
+{"version":3,"file":"write-guard.d.ts","sourceRoot":"","sources":["../../../src/checkpointer/internal/write-guard.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,mBAAmB,EAAE,MAAM,UAAU,CAAC;AACpD,OAAO,KAAK,EAAE,mBAAmB,EAAE,MAAM,SAAS,CAAC;AAcnD;;;;;;;;GAQG;AACH,wBAAgB,oBAAoB,CAClC,OAAO,EAAE,mBAAmB,EAC5B,IAAI,EAAE,mBAAmB,EACzB,KAAK,EAAE,KAAK,GACX,IAAI,CAcN"}

package/dist/checkpointer/internal/write-guard.js

@@ -1,15 +1,6 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.isConditionalCheckFailed = isConditionalCheckFailed;
 exports.reportGuardRejection = reportGuardRejection;
-/**
- * True when the guard rejected a write — NOT evidence a competitor won: a
- * `PutCommand` retried after its response was lost can re-hit its own
- * committed row and fail identically; the two cases are indistinguishable.
- */
-function isConditionalCheckFailed(error) {
-    return error.name === 'ConditionalCheckFailedException';
-}
 /**
  * The channel recorded on the row that turned a write away, or undefined when
  * the service returned no attributes. `ReturnValuesOnConditionCheckFailure:

package/dist/checkpointer/internal/write-guard.js.map

@@ -1 +1 @@
-{"version":3,"file":"write-guard.js","sourceRoot":"","sources":["../../../src/checkpointer/internal/write-guard.ts"],"names":[],"mappings":";;;;AAGA;;;;GAIG;AACH,kCAAyC,KAAwB;IAC/D,OAAO,KAAK,CAAC,IAAI,KAAK,iCAAiC,CAAC;AAC1D,CAAC;AAED;;;;;;;GAOG;AACH,SAAS,eAAe,CAAC,KAAY;IACnC,OAAQ,KAAiD,CAAC,IAAI,EAAE,OAAO,EAAE,CAAC,CAAC;AAC7E,CAAC;AAED;;;;;;;;GAQG;AACH,8BACE,OAA4B,EAC5B,IAAyB,EACzB,KAAY;IAEZ,MAAM,KAAK,GAAG,eAAe,CAAC,KAAK,CAAC,CAAC;IACrC,IAAI,KAAK,KAAK,SAAS,IAAI,KAAK,KAAK,IAAI,CAAC,OAAO,EAAE,CAAC;QAClD,OAAO,CAAC,MAAM,CAAC,IAAI,CAAC,yEAAyE,EAAE;YAC7F,OAAO,EAAE,IAAI,CAAC,EAAE;YAChB,QAAQ,EAAE,IAAI,CAAC,OAAO;YACtB,KAAK;SACN,CAAC,CAAC;QACH,OAAO;IACT,CAAC;IACD,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,wEAAwE,EAAE;QAC7F,OAAO,EAAE,IAAI,CAAC,EAAE;QAChB,OAAO,EAAE,IAAI,CAAC,OAAO;KACtB,CAAC,CAAC;AACL,CAAC"}
+{"version":3,"file":"write-guard.js","sourceRoot":"","sources":["../../../src/checkpointer/internal/write-guard.ts"],"names":[],"mappings":";;;AAGA;;;;;;;GAOG;AACH,SAAS,eAAe,CAAC,KAAY;IACnC,OAAQ,KAAiD,CAAC,IAAI,EAAE,OAAO,EAAE,CAAC,CAAC;AAC7E,CAAC;AAED;;;;;;;;GAQG;AACH,8BACE,OAA4B,EAC5B,IAAyB,EACzB,KAAY;IAEZ,MAAM,KAAK,GAAG,eAAe,CAAC,KAAK,CAAC,CAAC;IACrC,IAAI,KAAK,KAAK,SAAS,IAAI,KAAK,KAAK,IAAI,CAAC,OAAO,EAAE,CAAC;QAClD,OAAO,CAAC,MAAM,CAAC,IAAI,CAAC,yEAAyE,EAAE;YAC7F,OAAO,EAAE,IAAI,CAAC,EAAE;YAChB,QAAQ,EAAE,IAAI,CAAC,OAAO;YACtB,KAAK;SACN,CAAC,CAAC;QACH,OAAO;IACT,CAAC;IACD,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,wEAAwE,EAAE;QAC7F,OAAO,EAAE,IAAI,CAAC,EAAE;QAChB,OAAO,EAAE,IAAI,CAAC,OAAO;KACtB,CAAC,CAAC;AACL,CAAC"}

package/dist/checkpointer/internal/write-index.d.ts

@@ -4,6 +4,14 @@ export interface ResolvedWrite {
     channel: string;
     value: PendingWriteValue;
     index: number;
+    /**
+     * How many earlier writes in this same call already used this channel. A
+     * retry that emits a channel *more* often than the original call produces a
+     * row at an occurrence no earlier call ever wrote — it collides with nothing
+     * and commits cleanly, so the read-side dedup must not mistake it for a
+     * superseding duplicate.
+     */
+    occurrence: number;
 }
 /**
  * Assign every write in one `putWrites` call its sort-key index, in a single

package/dist/checkpointer/internal/write-index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"write-index.d.ts","sourceRoot":"","sources":["../../../src/checkpointer/internal/write-index.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,YAAY,EAAE,iBAAiB,EAAE,MAAM,iCAAiC,CAAC;AAGvF,+DAA+D;AAC/D,MAAM,WAAW,aAAa;IAC5B,OAAO,EAAE,MAAM,CAAC;IAChB,KAAK,EAAE,iBAAiB,CAAC;IACzB,KAAK,EAAE,MAAM,CAAC;CACf;AAED;;;;;;;;;;;;;;;;;;;GAmBG;AACH,wBAAgB,mBAAmB,CAAC,MAAM,EAAE,YAAY,EAAE,GAAG,aAAa,EAAE,CAY3E"}
+{"version":3,"file":"write-index.d.ts","sourceRoot":"","sources":["../../../src/checkpointer/internal/write-index.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,YAAY,EAAE,iBAAiB,EAAE,MAAM,iCAAiC,CAAC;AAGvF,+DAA+D;AAC/D,MAAM,WAAW,aAAa;IAC5B,OAAO,EAAE,MAAM,CAAC;IAChB,KAAK,EAAE,iBAAiB,CAAC;IACzB,KAAK,EAAE,MAAM,CAAC;IACd;;;;;;OAMG;IACH,UAAU,EAAE,MAAM,CAAC;CACpB;AAED;;;;;;;;;;;;;;;;;;;GAmBG;AACH,wBAAgB,mBAAmB,CAAC,MAAM,EAAE,YAAY,EAAE,GAAG,aAAa,EAAE,CAgB3E"}

package/dist/checkpointer/internal/write-index.js

@@ -25,13 +25,17 @@ const langgraph_checkpoint_1 = require("@langchain/langgraph-checkpoint");
 function resolveWriteIndices(writes) {
     const bySpecialIndex = new Map();
     const regular = [];
+    const occurrences = new Map();
     writes.forEach(([channel, value], positional) => {
         if (Object.hasOwn(langgraph_checkpoint_1.WRITES_IDX_MAP, channel)) {
             const index = langgraph_checkpoint_1.WRITES_IDX_MAP[channel];
-            bySpecialIndex.set(index, { channel, value, index });
+            /** Last write wins per special channel, so a call holds exactly one. */
+            bySpecialIndex.set(index, { channel, value, index, occurrence: 0 });
             return;
         }
-        regular.push({ channel, value, index: positional });
+        const occurrence = occurrences.get(channel) ?? 0;
+        occurrences.set(channel, occurrence + 1);
+        regular.push({ channel, value, index: positional, occurrence });
     });
     return [...bySpecialIndex.values(), ...regular];
 }

package/dist/checkpointer/internal/write-index.js.map

@@ -1 +1 @@
-{"version":3,"file":"write-index.js","sourceRoot":"","sources":["../../../src/checkpointer/internal/write-index.ts"],"names":[],"mappings":";;;AACA,0EAAiE;AASjE;;;;;;;;;;;;;;;;;;;GAmBG;AACH,6BAAoC,MAAsB;IACxD,MAAM,cAAc,GAAG,IAAI,GAAG,EAAyB,CAAC;IACxD,MAAM,OAAO,GAAoB,EAAE,CAAC;IACpC,MAAM,CAAC,OAAO,CAAC,CAAC,CAAC,OAAO,EAAE,KAAK,CAAC,EAAE,UAAU,EAAE,EAAE;QAC9C,IAAI,MAAM,CAAC,MAAM,CAAC,qCAAc,EAAE,OAAO,CAAC,EAAE,CAAC;YAC3C,MAAM,KAAK,GAAG,qCAAc,CAAC,OAAO,CAAC,CAAC;YACtC,cAAc,CAAC,GAAG,CAAC,KAAK,EAAE,EAAE,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,CAAC,CAAC;YACrD,OAAO;QACT,CAAC;QACD,OAAO,CAAC,IAAI,CAAC,EAAE,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,UAAU,EAAE,CAAC,CAAC;IACtD,CAAC,CAAC,CAAC;IACH,OAAO,CAAC,GAAG,cAAc,CAAC,MAAM,EAAE,EAAE,GAAG,OAAO,CAAC,CAAC;AAClD,CAAC"}
+{"version":3,"file":"write-index.js","sourceRoot":"","sources":["../../../src/checkpointer/internal/write-index.ts"],"names":[],"mappings":";;;AACA,0EAAiE;AAiBjE;;;;;;;;;;;;;;;;;;;GAmBG;AACH,6BAAoC,MAAsB;IACxD,MAAM,cAAc,GAAG,IAAI,GAAG,EAAyB,CAAC;IACxD,MAAM,OAAO,GAAoB,EAAE,CAAC;IACpC,MAAM,WAAW,GAAG,IAAI,GAAG,EAAkB,CAAC;IAC9C,MAAM,CAAC,OAAO,CAAC,CAAC,CAAC,OAAO,EAAE,KAAK,CAAC,EAAE,UAAU,EAAE,EAAE;QAC9C,IAAI,MAAM,CAAC,MAAM,CAAC,qCAAc,EAAE,OAAO,CAAC,EAAE,CAAC;YAC3C,MAAM,KAAK,GAAG,qCAAc,CAAC,OAAO,CAAC,CAAC;YACtC,wEAAwE;YACxE,cAAc,CAAC,GAAG,CAAC,KAAK,EAAE,EAAE,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,UAAU,EAAE,CAAC,EAAE,CAAC,CAAC;YACpE,OAAO;QACT,CAAC;QACD,MAAM,UAAU,GAAG,WAAW,CAAC,GAAG,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC;QACjD,WAAW,CAAC,GAAG,CAAC,OAAO,EAAE,UAAU,GAAG,CAAC,CAAC,CAAC;QACzC,OAAO,CAAC,IAAI,CAAC,EAAE,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,UAAU,EAAE,UAAU,EAAE,CAAC,CAAC;IAClE,CAAC,CAAC,CAAC;IACH,OAAO,CAAC,GAAG,cAAc,CAAC,MAAM,EAAE,EAAE,GAAG,OAAO,CAAC,CAAC;AAClD,CAAC"}

package/dist/checkpointer/types.d.ts

@@ -39,6 +39,12 @@ export interface CheckpointWriteItem {
     channel: string;
     /** Identifies the `putWrites` call that produced this row (see item-writer). */
     writeGroup: string;
+    /**
+     * How many earlier writes in the same call already used this channel.
+     * Optional: rows written before 0.9.0 carry none and read back as 0, which
+     * is exactly the identity they were stored under.
+     */
+    occurrence?: number;
     value: PayloadDescriptor;
     ttl?: number;
 }

package/dist/checkpointer/types.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../../src/checkpointer/types.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,iCAAiC,CAAC;AAE1E,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,uBAAuB,CAAC;AAC/D,OAAO,KAAK,EAAE,kBAAkB,EAAE,YAAY,EAAE,MAAM,mBAAmB,CAAC;AAE1E,yCAAyC;AACzC,MAAM,MAAM,oBAAoB,GAAG,kBAAkB,GACnD,YAAY,GAAG;IACb,8EAA8E;IAC9E,KAAK,CAAC,EAAE,kBAAkB,CAAC;CAC5B,CAAC;AAEJ,2EAA2E;AAC3E,MAAM,WAAW,sBAAsB;IACrC,SAAS,EAAE,MAAM,CAAC;IAClB,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB,aAAa,CAAC,EAAE,MAAM,CAAC;CACxB;AAED,6EAA6E;AAC7E,MAAM,WAAW,kBAAkB;IACjC,EAAE,EAAE,MAAM,CAAC;IACX,EAAE,EAAE,MAAM,CAAC;IACX,QAAQ,EAAE,MAAM,CAAC;IACjB,YAAY,EAAE,MAAM,CAAC;IACrB,YAAY,EAAE,MAAM,CAAC;IACrB,kBAAkB,CAAC,EAAE,MAAM,CAAC;IAC5B,QAAQ,EAAE,iBAAiB,CAAC;IAC5B,GAAG,CAAC,EAAE,MAAM,CAAC;CACd;AAED,4DAA4D;AAC5D,MAAM,WAAW,qBAAqB;IACpC,EAAE,EAAE,MAAM,CAAC;IACX,EAAE,EAAE,MAAM,CAAC;IACX,UAAU,EAAE,iBAAiB,CAAC;IAC9B,GAAG,CAAC,EAAE,MAAM,CAAC;CACd;AAED,gEAAgE;AAChE,MAAM,WAAW,mBAAmB;IAClC,EAAE,EAAE,MAAM,CAAC;IACX,EAAE,EAAE,MAAM,CAAC;IACX,MAAM,EAAE,MAAM,CAAC;IACf,KAAK,EAAE,MAAM,CAAC;IACd,OAAO,EAAE,MAAM,CAAC;IAChB,gFAAgF;IAChF,UAAU,EAAE,MAAM,CAAC;IACnB,KAAK,EAAE,iBAAiB,CAAC;IACzB,GAAG,CAAC,EAAE,MAAM,CAAC;CACd"}
+{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../../src/checkpointer/types.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,iCAAiC,CAAC;AAE1E,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,uBAAuB,CAAC;AAC/D,OAAO,KAAK,EAAE,kBAAkB,EAAE,YAAY,EAAE,MAAM,mBAAmB,CAAC;AAE1E,yCAAyC;AACzC,MAAM,MAAM,oBAAoB,GAAG,kBAAkB,GACnD,YAAY,GAAG;IACb,8EAA8E;IAC9E,KAAK,CAAC,EAAE,kBAAkB,CAAC;CAC5B,CAAC;AAEJ,2EAA2E;AAC3E,MAAM,WAAW,sBAAsB;IACrC,SAAS,EAAE,MAAM,CAAC;IAClB,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB,aAAa,CAAC,EAAE,MAAM,CAAC;CACxB;AAED,6EAA6E;AAC7E,MAAM,WAAW,kBAAkB;IACjC,EAAE,EAAE,MAAM,CAAC;IACX,EAAE,EAAE,MAAM,CAAC;IACX,QAAQ,EAAE,MAAM,CAAC;IACjB,YAAY,EAAE,MAAM,CAAC;IACrB,YAAY,EAAE,MAAM,CAAC;IACrB,kBAAkB,CAAC,EAAE,MAAM,CAAC;IAC5B,QAAQ,EAAE,iBAAiB,CAAC;IAC5B,GAAG,CAAC,EAAE,MAAM,CAAC;CACd;AAED,4DAA4D;AAC5D,MAAM,WAAW,qBAAqB;IACpC,EAAE,EAAE,MAAM,CAAC;IACX,EAAE,EAAE,MAAM,CAAC;IACX,UAAU,EAAE,iBAAiB,CAAC;IAC9B,GAAG,CAAC,EAAE,MAAM,CAAC;CACd;AAED,gEAAgE;AAChE,MAAM,WAAW,mBAAmB;IAClC,EAAE,EAAE,MAAM,CAAC;IACX,EAAE,EAAE,MAAM,CAAC;IACX,MAAM,EAAE,MAAM,CAAC;IACf,KAAK,EAAE,MAAM,CAAC;IACd,OAAO,EAAE,MAAM,CAAC;IAChB,gFAAgF;IAChF,UAAU,EAAE,MAAM,CAAC;IACnB;;;;OAIG;IACH,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,KAAK,EAAE,iBAAiB,CAAC;IACzB,GAAG,CAAC,EAAE,MAAM,CAAC;CACd"}

package/dist/shared/constants.d.ts

@@ -46,4 +46,19 @@ export declare const DEFAULT_RETRY_MAX_ATTEMPTS = 5;
 export declare const MESSAGE_APPEND_RETRY_MAX_ATTEMPTS = 18;
 /** Default cap on candidates the in-DB semantic ranker will score. */
 export declare const DEFAULT_MAX_SEARCH_CANDIDATES = 1000;
+/**
+ * Raw rows a single `listCheckpoints` call may pull before it warns. The read
+ * itself is deliberately unbounded — capping it counted raw rows rather than
+ * filter-matched ones, which turned a caller asking for a handful of rare
+ * matches over a large thread into a hard error instead of the true answer.
+ * The warning restores the operational signal without restoring the wrong
+ * error.
+ *
+ * Its own literal, deliberately: this is the point at which a scan is worth
+ * telling an operator about, which is independent of
+ * {@link MAX_TOTAL_ITEMS_IN_MEMORY}'s hard collection cap. Aliasing the two
+ * meant retuning the memory cap silently moved the warning as well, and it
+ * left the pair reported as a duplicate export.
+ */
+export declare const LIST_SCAN_WARN_THRESHOLD = 10000;
 //# sourceMappingURL=constants.d.ts.map

package/dist/shared/constants.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"constants.d.ts","sourceRoot":"","sources":["../../src/shared/constants.ts"],"names":[],"mappings":"AAAA,+CAA+C;AAC/C,eAAO,MAAM,YAAY,QAAU,CAAC;AAEpC,oDAAoD;AACpD,eAAO,MAAM,eAAe,QAA2B,CAAC;AAExD,yEAAyE;AACzE,eAAO,MAAM,mBAAmB,OAAO,CAAC;AAExC,wEAAwE;AACxE,eAAO,MAAM,yBAAyB,QAAQ,CAAC;AAE/C,yDAAyD;AACzD,eAAO,MAAM,eAAe,KAAK,CAAC;AAElC,mDAAmD;AACnD,eAAO,MAAM,aAAa,MAAM,CAAC;AAEjC,mEAAmE;AACnE,eAAO,MAAM,uBAAuB,KAAK,CAAC;AAE1C,2EAA2E;AAC3E,eAAO,MAAM,wBAAwB,MAAM,CAAC;AAE5C,6CAA6C;AAC7C,eAAO,MAAM,oBAAoB,OAAO,CAAC;AAEzC,iDAAiD;AACjD,eAAO,MAAM,mBAAmB,OAAO,CAAC;AAExC,8FAA8F;AAC9F,eAAO,MAAM,0BAA0B,QAAa,CAAC;AAErD,oDAAoD;AACpD,eAAO,MAAM,qBAAqB,2BAA2B,CAAC;AAE9D,mDAAmD;AACnD,eAAO,MAAM,cAAc,WAAW,CAAC;AAEvC,yEAAyE;AACzE,eAAO,MAAM,6BAA6B,OAAO,CAAC;AAElD,6DAA6D;AAC7D,eAAO,MAAM,yBAAyB,IAAI,CAAC;AAE3C,qEAAqE;AACrE,eAAO,MAAM,8BAA8B,QAAmB,CAAC;AAE/D,4DAA4D;AAC5D,eAAO,MAAM,0BAA0B,IAAI,CAAC;AAE5C;;;;;;;;;;GAUG;AACH,eAAO,MAAM,iCAAiC,KAAK,CAAC;AAEpD,sEAAsE;AACtE,eAAO,MAAM,6BAA6B,OAAO,CAAC"}
+{"version":3,"file":"constants.d.ts","sourceRoot":"","sources":["../../src/shared/constants.ts"],"names":[],"mappings":"AAAA,+CAA+C;AAC/C,eAAO,MAAM,YAAY,QAAU,CAAC;AAEpC,oDAAoD;AACpD,eAAO,MAAM,eAAe,QAA2B,CAAC;AAExD,yEAAyE;AACzE,eAAO,MAAM,mBAAmB,OAAO,CAAC;AAExC,wEAAwE;AACxE,eAAO,MAAM,yBAAyB,QAAQ,CAAC;AAE/C,yDAAyD;AACzD,eAAO,MAAM,eAAe,KAAK,CAAC;AAElC,mDAAmD;AACnD,eAAO,MAAM,aAAa,MAAM,CAAC;AAEjC,mEAAmE;AACnE,eAAO,MAAM,uBAAuB,KAAK,CAAC;AAE1C,2EAA2E;AAC3E,eAAO,MAAM,wBAAwB,MAAM,CAAC;AAE5C,6CAA6C;AAC7C,eAAO,MAAM,oBAAoB,OAAO,CAAC;AAEzC,iDAAiD;AACjD,eAAO,MAAM,mBAAmB,OAAO,CAAC;AAExC,8FAA8F;AAC9F,eAAO,MAAM,0BAA0B,QAAa,CAAC;AAErD,oDAAoD;AACpD,eAAO,MAAM,qBAAqB,2BAA2B,CAAC;AAE9D,mDAAmD;AACnD,eAAO,MAAM,cAAc,WAAW,CAAC;AAEvC,yEAAyE;AACzE,eAAO,MAAM,6BAA6B,OAAO,CAAC;AAElD,6DAA6D;AAC7D,eAAO,MAAM,yBAAyB,IAAI,CAAC;AAE3C,qEAAqE;AACrE,eAAO,MAAM,8BAA8B,QAAmB,CAAC;AAE/D,4DAA4D;AAC5D,eAAO,MAAM,0BAA0B,IAAI,CAAC;AAE5C;;;;;;;;;;GAUG;AACH,eAAO,MAAM,iCAAiC,KAAK,CAAC;AAEpD,sEAAsE;AACtE,eAAO,MAAM,6BAA6B,OAAO,CAAC;AAElD;;;;;;;;;;;;;GAaG;AACH,eAAO,MAAM,wBAAwB,QAAQ,CAAC"}

package/dist/shared/constants.js

@@ -1,6 +1,6 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.DEFAULT_MAX_SEARCH_CANDIDATES = exports.MESSAGE_APPEND_RETRY_MAX_ATTEMPTS = exports.DEFAULT_RETRY_MAX_ATTEMPTS = exports.DEFAULT_MAX_DECOMPRESSED_BYTES = exports.DEFAULT_COMPRESSION_LEVEL = exports.DEFAULT_COMPRESSION_MIN_BYTES = exports.DEFAULT_S3_SSE = exports.DEFAULT_S3_KEY_PREFIX = exports.DEFAULT_S3_THRESHOLD_BYTES = exports.S3_DELETE_BATCH_MAX = exports.MAX_BACKOFF_DELAY_MS = exports.INITIAL_BACKOFF_DELAY_MS = exports.MAX_UNPROCESSED_RETRIES = exports.BATCH_GET_MAX = exports.BATCH_WRITE_MAX = exports.MAX_TOTAL_ITEMS_IN_MEMORY = exports.MAX_LOOP_ITERATIONS = exports.MAX_TTL_SECONDS = exports.MAX_TTL_DAYS = void 0;
+exports.LIST_SCAN_WARN_THRESHOLD = exports.DEFAULT_MAX_SEARCH_CANDIDATES = exports.MESSAGE_APPEND_RETRY_MAX_ATTEMPTS = exports.DEFAULT_RETRY_MAX_ATTEMPTS = exports.DEFAULT_MAX_DECOMPRESSED_BYTES = exports.DEFAULT_COMPRESSION_LEVEL = exports.DEFAULT_COMPRESSION_MIN_BYTES = exports.DEFAULT_S3_SSE = exports.DEFAULT_S3_KEY_PREFIX = exports.DEFAULT_S3_THRESHOLD_BYTES = exports.S3_DELETE_BATCH_MAX = exports.MAX_BACKOFF_DELAY_MS = exports.INITIAL_BACKOFF_DELAY_MS = exports.MAX_UNPROCESSED_RETRIES = exports.BATCH_GET_MAX = exports.BATCH_WRITE_MAX = exports.MAX_TOTAL_ITEMS_IN_MEMORY = exports.MAX_LOOP_ITERATIONS = exports.MAX_TTL_SECONDS = exports.MAX_TTL_DAYS = void 0;
 /** Maximum TTL expressed in days (5 years). */
 exports.MAX_TTL_DAYS = 365 * 5;
 /** Maximum TTL expressed in seconds (100 years). */
@@ -49,4 +49,19 @@ exports.DEFAULT_RETRY_MAX_ATTEMPTS = 5;
 exports.MESSAGE_APPEND_RETRY_MAX_ATTEMPTS = 18;
 /** Default cap on candidates the in-DB semantic ranker will score. */
 exports.DEFAULT_MAX_SEARCH_CANDIDATES = 1000;
+/**
+ * Raw rows a single `listCheckpoints` call may pull before it warns. The read
+ * itself is deliberately unbounded — capping it counted raw rows rather than
+ * filter-matched ones, which turned a caller asking for a handful of rare
+ * matches over a large thread into a hard error instead of the true answer.
+ * The warning restores the operational signal without restoring the wrong
+ * error.
+ *
+ * Its own literal, deliberately: this is the point at which a scan is worth
+ * telling an operator about, which is independent of
+ * {@link MAX_TOTAL_ITEMS_IN_MEMORY}'s hard collection cap. Aliasing the two
+ * meant retuning the memory cap silently moved the warning as well, and it
+ * left the pair reported as a duplicate export.
+ */
+exports.LIST_SCAN_WARN_THRESHOLD = 10000;
 //# sourceMappingURL=constants.js.map

package/dist/shared/constants.js.map

@@ -1 +1 @@
-{"version":3,"file":"constants.js","sourceRoot":"","sources":["../../src/shared/constants.ts"],"names":[],"mappings":";;;AAAA,+CAA+C;AAClC,QAAA,YAAY,GAAG,GAAG,GAAG,CAAC,CAAC;AAEpC,oDAAoD;AACvC,QAAA,eAAe,GAAG,GAAG,GAAG,GAAG,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,CAAC;AAExD,yEAAyE;AAC5D,QAAA,mBAAmB,GAAG,IAAI,CAAC;AAExC,wEAAwE;AAC3D,QAAA,yBAAyB,GAAG,KAAK,CAAC;AAE/C,yDAAyD;AAC5C,QAAA,eAAe,GAAG,EAAE,CAAC;AAElC,mDAAmD;AACtC,QAAA,aAAa,GAAG,GAAG,CAAC;AAEjC,mEAAmE;AACtD,QAAA,uBAAuB,GAAG,EAAE,CAAC;AAE1C,2EAA2E;AAC9D,QAAA,wBAAwB,GAAG,GAAG,CAAC;AAE5C,6CAA6C;AAChC,QAAA,oBAAoB,GAAG,IAAI,CAAC;AAEzC,iDAAiD;AACpC,QAAA,mBAAmB,GAAG,IAAI,CAAC;AAExC,8FAA8F;AACjF,QAAA,0BAA0B,GAAG,GAAG,GAAG,IAAI,CAAC;AAErD,oDAAoD;AACvC,QAAA,qBAAqB,GAAG,wBAAwB,CAAC;AAE9D,mDAAmD;AACtC,QAAA,cAAc,GAAG,QAAQ,CAAC;AAEvC,yEAAyE;AAC5D,QAAA,6BAA6B,GAAG,IAAI,CAAC;AAElD,6DAA6D;AAChD,QAAA,yBAAyB,GAAG,CAAC,CAAC;AAE3C,qEAAqE;AACxD,QAAA,8BAA8B,GAAG,EAAE,GAAG,IAAI,GAAG,IAAI,CAAC;AAE/D,4DAA4D;AAC/C,QAAA,0BAA0B,GAAG,CAAC,CAAC;AAE5C;;;;;;;;;;GAUG;AACU,QAAA,iCAAiC,GAAG,EAAE,CAAC;AAEpD,sEAAsE;AACzD,QAAA,6BAA6B,GAAG,IAAI,CAAC"}
+{"version":3,"file":"constants.js","sourceRoot":"","sources":["../../src/shared/constants.ts"],"names":[],"mappings":";;;AAAA,+CAA+C;AAClC,QAAA,YAAY,GAAG,GAAG,GAAG,CAAC,CAAC;AAEpC,oDAAoD;AACvC,QAAA,eAAe,GAAG,GAAG,GAAG,GAAG,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,CAAC;AAExD,yEAAyE;AAC5D,QAAA,mBAAmB,GAAG,IAAI,CAAC;AAExC,wEAAwE;AAC3D,QAAA,yBAAyB,GAAG,KAAK,CAAC;AAE/C,yDAAyD;AAC5C,QAAA,eAAe,GAAG,EAAE,CAAC;AAElC,mDAAmD;AACtC,QAAA,aAAa,GAAG,GAAG,CAAC;AAEjC,mEAAmE;AACtD,QAAA,uBAAuB,GAAG,EAAE,CAAC;AAE1C,2EAA2E;AAC9D,QAAA,wBAAwB,GAAG,GAAG,CAAC;AAE5C,6CAA6C;AAChC,QAAA,oBAAoB,GAAG,IAAI,CAAC;AAEzC,iDAAiD;AACpC,QAAA,mBAAmB,GAAG,IAAI,CAAC;AAExC,8FAA8F;AACjF,QAAA,0BAA0B,GAAG,GAAG,GAAG,IAAI,CAAC;AAErD,oDAAoD;AACvC,QAAA,qBAAqB,GAAG,wBAAwB,CAAC;AAE9D,mDAAmD;AACtC,QAAA,cAAc,GAAG,QAAQ,CAAC;AAEvC,yEAAyE;AAC5D,QAAA,6BAA6B,GAAG,IAAI,CAAC;AAElD,6DAA6D;AAChD,QAAA,yBAAyB,GAAG,CAAC,CAAC;AAE3C,qEAAqE;AACxD,QAAA,8BAA8B,GAAG,EAAE,GAAG,IAAI,GAAG,IAAI,CAAC;AAE/D,4DAA4D;AAC/C,QAAA,0BAA0B,GAAG,CAAC,CAAC;AAE5C;;;;;;;;;;GAUG;AACU,QAAA,iCAAiC,GAAG,EAAE,CAAC;AAEpD,sEAAsE;AACzD,QAAA,6BAA6B,GAAG,IAAI,CAAC;AAElD;;;;;;;;;;;;;GAaG;AACU,QAAA,wBAAwB,GAAG,KAAK,CAAC"}

package/dist/shared/dynamodb/conditional-put.d.ts

@@ -0,0 +1,51 @@
+/**
+ * Attribute holding a row's revision token on adapters that need one. The
+ * checkpointer's special writes reuse their existing per-call `writeGroup`
+ * instead, so `revisionGuard` takes the attribute name rather than assuming it.
+ */
+export declare const REVISION_ATTRIBUTE = "rev";
+/**
+ * Compare-and-swap attempts before a caller gives up and overwrites
+ * unconditionally. Kept small on purpose: DynamoDB charges write capacity for a
+ * *failed* conditional write too, sized on the existing item, so an aggressive
+ * loop turns contention into cost. Three attempts settle every realistic race,
+ * and the fallback is exactly the pre-0.9.0 behaviour rather than an error.
+ */
+export declare const OVERWRITE_CAS_MAX_ATTEMPTS = 3;
+/** What a caller saw at the row before it tried to overwrite it. */
+export interface ObservedRow {
+    exists: boolean;
+    revision?: string;
+}
+/** Condition fragments to spread into a `PutCommand` input. */
+export interface RevisionGuard {
+    ConditionExpression: string;
+    ExpressionAttributeNames?: Record<string, string>;
+    ExpressionAttributeValues?: Record<string, string>;
+}
+/**
+ * Build the condition admitting a write only while the row still holds the
+ * revision this caller observed.
+ *
+ * Without it, two concurrent overwrites both read the same previous payload
+ * descriptor, both commit their own nonced upload, and both delete that same
+ * previous object — leaving the loser's upload orphaned with nothing left
+ * recording that it ever existed. A post-commit read-back cannot repair that,
+ * because neither writer can learn of an object it never saw; only refusing the
+ * second write until it re-reads can.
+ *
+ * A row with no revision attribute was written before 0.9.0. Pinning its
+ * *absence* is what makes the swap correct across an upgrade: the first writer
+ * to touch such a row stamps one, and any racer still holding the pre-upgrade
+ * observation is turned away.
+ */
+export declare function revisionGuard(attribute: string, observed: ObservedRow): RevisionGuard;
+/**
+ * True when the guard rejected a write — NOT evidence a competitor won: a
+ * `PutCommand` retried after its response was lost can re-hit its own
+ * committed row and fail identically; the two cases are indistinguishable.
+ */
+export declare function isConditionalCheckFailed(error: {
+    name?: string;
+}): boolean;
+//# sourceMappingURL=conditional-put.d.ts.map

package/dist/shared/dynamodb/conditional-put.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"conditional-put.d.ts","sourceRoot":"","sources":["../../../src/shared/dynamodb/conditional-put.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AACH,eAAO,MAAM,kBAAkB,QAAQ,CAAC;AAExC;;;;;;GAMG;AACH,eAAO,MAAM,0BAA0B,IAAI,CAAC;AAE5C,oEAAoE;AACpE,MAAM,WAAW,WAAW;IAC1B,MAAM,EAAE,OAAO,CAAC;IAChB,QAAQ,CAAC,EAAE,MAAM,CAAC;CACnB;AAED,+DAA+D;AAC/D,MAAM,WAAW,aAAa;IAC5B,mBAAmB,EAAE,MAAM,CAAC;IAC5B,wBAAwB,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAClD,yBAAyB,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;CACpD;AAED;;;;;;;;;;;;;;;GAeG;AACH,wBAAgB,aAAa,CAAC,SAAS,EAAE,MAAM,EAAE,QAAQ,EAAE,WAAW,GAAG,aAAa,CAarF;AAED;;;;GAIG;AACH,wBAAgB,wBAAwB,CAAC,KAAK,EAAE;IAAE,IAAI,CAAC,EAAE,MAAM,CAAA;CAAE,GAAG,OAAO,CAE1E"}

package/dist/shared/dynamodb/conditional-put.js

@@ -0,0 +1,59 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.OVERWRITE_CAS_MAX_ATTEMPTS = exports.REVISION_ATTRIBUTE = void 0;
+exports.revisionGuard = revisionGuard;
+exports.isConditionalCheckFailed = isConditionalCheckFailed;
+/**
+ * Attribute holding a row's revision token on adapters that need one. The
+ * checkpointer's special writes reuse their existing per-call `writeGroup`
+ * instead, so `revisionGuard` takes the attribute name rather than assuming it.
+ */
+exports.REVISION_ATTRIBUTE = 'rev';
+/**
+ * Compare-and-swap attempts before a caller gives up and overwrites
+ * unconditionally. Kept small on purpose: DynamoDB charges write capacity for a
+ * *failed* conditional write too, sized on the existing item, so an aggressive
+ * loop turns contention into cost. Three attempts settle every realistic race,
+ * and the fallback is exactly the pre-0.9.0 behaviour rather than an error.
+ */
+exports.OVERWRITE_CAS_MAX_ATTEMPTS = 3;
+/**
+ * Build the condition admitting a write only while the row still holds the
+ * revision this caller observed.
+ *
+ * Without it, two concurrent overwrites both read the same previous payload
+ * descriptor, both commit their own nonced upload, and both delete that same
+ * previous object — leaving the loser's upload orphaned with nothing left
+ * recording that it ever existed. A post-commit read-back cannot repair that,
+ * because neither writer can learn of an object it never saw; only refusing the
+ * second write until it re-reads can.
+ *
+ * A row with no revision attribute was written before 0.9.0. Pinning its
+ * *absence* is what makes the swap correct across an upgrade: the first writer
+ * to touch such a row stamps one, and any racer still holding the pre-upgrade
+ * observation is turned away.
+ */
+function revisionGuard(attribute, observed) {
+    if (!observed.exists)
+        return { ConditionExpression: 'attribute_not_exists(PK)' };
+    if (observed.revision === undefined) {
+        return {
+            ConditionExpression: 'attribute_not_exists(#rev)',
+            ExpressionAttributeNames: { '#rev': attribute },
+        };
+    }
+    return {
+        ConditionExpression: '#rev = :rev',
+        ExpressionAttributeNames: { '#rev': attribute },
+        ExpressionAttributeValues: { ':rev': observed.revision },
+    };
+}
+/**
+ * True when the guard rejected a write — NOT evidence a competitor won: a
+ * `PutCommand` retried after its response was lost can re-hit its own
+ * committed row and fail identically; the two cases are indistinguishable.
+ */
+function isConditionalCheckFailed(error) {
+    return error.name === 'ConditionalCheckFailedException';
+}
+//# sourceMappingURL=conditional-put.js.map

package/dist/shared/dynamodb/conditional-put.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"conditional-put.js","sourceRoot":"","sources":["../../../src/shared/dynamodb/conditional-put.ts"],"names":[],"mappings":";;;;;AAAA;;;;GAIG;AACU,QAAA,kBAAkB,GAAG,KAAK,CAAC;AAExC;;;;;;GAMG;AACU,QAAA,0BAA0B,GAAG,CAAC,CAAC;AAe5C;;;;;;;;;;;;;;;GAeG;AACH,uBAA8B,SAAiB,EAAE,QAAqB;IACpE,IAAI,CAAC,QAAQ,CAAC,MAAM;QAAE,OAAO,EAAE,mBAAmB,EAAE,0BAA0B,EAAE,CAAC;IACjF,IAAI,QAAQ,CAAC,QAAQ,KAAK,SAAS,EAAE,CAAC;QACpC,OAAO;YACL,mBAAmB,EAAE,4BAA4B;YACjD,wBAAwB,EAAE,EAAE,MAAM,EAAE,SAAS,EAAE;SAChD,CAAC;IACJ,CAAC;IACD,OAAO;QACL,mBAAmB,EAAE,aAAa;QAClC,wBAAwB,EAAE,EAAE,MAAM,EAAE,SAAS,EAAE;QAC/C,yBAAyB,EAAE,EAAE,MAAM,EAAE,QAAQ,CAAC,QAAQ,EAAE;KACzD,CAAC;AACJ,CAAC;AAED;;;;GAIG;AACH,kCAAyC,KAAwB;IAC/D,OAAO,KAAK,CAAC,IAAI,KAAK,iCAAiC,CAAC;AAC1D,CAAC"}

package/dist/shared/logging/redaction.d.ts

@@ -20,7 +20,11 @@ export declare function redactSecrets(value: Redactable, patterns?: readonly str
 export interface RedactLoggerOptions {
     /** Additional key names (matched case-insensitively as substrings) to redact. */
     extraKeys?: readonly string[];
-    /** Additional secret shapes to redact wherever they appear inside a string. */
+    /**
+     * Additional secret shapes to redact wherever they appear inside a string.
+     * A pattern's first capture group, if it has one, is preserved verbatim and
+     * only the remainder of the match is replaced.
+     */
     extraValuePatterns?: readonly RegExp[];
 }
 /**

package/dist/shared/logging/redaction.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"redaction.d.ts","sourceRoot":"","sources":["../../../src/shared/logging/redaction.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAe,MAAM,EAAE,MAAM,UAAU,CAAC;AACpD,OAAO,EAAE,KAAK,UAAU,EAAc,MAAM,kBAAkB,CAAC;AAO/D;;;;;;;;;;;;;;GAcG;AACH,wBAAgB,aAAa,CAC3B,KAAK,EAAE,UAAU,EACjB,QAAQ,GAAE,SAAS,MAAM,EAAgC,EACzD,aAAa,GAAE,SAAS,MAAM,EAAkC,GAC/D,UAAU,CAcZ;AAED,gDAAgD;AAChD,MAAM,WAAW,mBAAmB;IAClC,iFAAiF;IACjF,SAAS,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;IAC9B,+EAA+E;IAC/E,kBAAkB,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;CACxC;AAED;;;GAGG;AACH,wBAAgB,YAAY,CAAC,KAAK,EAAE,MAAM,EAAE,OAAO,GAAE,mBAAwB,GAAG,MAAM,CAerF"}
+{"version":3,"file":"redaction.d.ts","sourceRoot":"","sources":["../../../src/shared/logging/redaction.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAe,MAAM,EAAE,MAAM,UAAU,CAAC;AACpD,OAAO,EAAE,KAAK,UAAU,EAAc,MAAM,kBAAkB,CAAC;AAO/D;;;;;;;;;;;;;;GAcG;AACH,wBAAgB,aAAa,CAC3B,KAAK,EAAE,UAAU,EACjB,QAAQ,GAAE,SAAS,MAAM,EAAgC,EACzD,aAAa,GAAE,SAAS,MAAM,EAAkC,GAC/D,UAAU,CAcZ;AAED,gDAAgD;AAChD,MAAM,WAAW,mBAAmB;IAClC,iFAAiF;IACjF,SAAS,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;IAC9B;;;;OAIG;IACH,kBAAkB,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;CACxC;AAED;;;GAGG;AACH,wBAAgB,YAAY,CAAC,KAAK,EAAE,MAAM,EAAE,OAAO,GAAE,mBAAwB,GAAG,MAAM,CAerF"}

package/dist/shared/logging/redaction.js.map

@@ -1 +1 @@
-{"version":3,"file":"redaction.js","sourceRoot":"","sources":["../../../src/shared/logging/redaction.ts"],"names":[],"mappings":";;;;AACA,qDAA+D;AAC/D,uDAI2B;AAE3B;;;;;;;;;;;;;;GAcG;AACH,uBACE,KAAiB,EACjB,QAAQ,GAAsB,6CAA2B,EACzD,aAAa,GAAsB,+CAA6B;IAEhE,MAAM,IAAI,GAAG,IAAI,OAAO,EAAU,CAAC;IACnC,MAAM,IAAI,GAAG,CAAC,OAAmB,EAAc,EAAE;QAC/C,IAAI,OAAO,OAAO,KAAK,QAAQ;YAAE,OAAO,IAAA,4BAAU,EAAC,OAAO,EAAE,aAAa,CAAC,CAAC;QAC3E,IAAI,OAAO,KAAK,IAAI,IAAI,OAAO,OAAO,KAAK,QAAQ;YAAE,OAAO,OAAO,CAAC;QACpE,IAAI,IAAI,CAAC,GAAG,CAAC,OAAO,CAAC;YAAE,OAAO,YAAY,CAAC;QAC3C,IAAI,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC;QAClB,IAAI,CAAC;YACH,OAAO,IAAA,2BAAU,EAAC,OAAO,EAAE,EAAE,WAAW,EAAE,QAAQ,EAAE,aAAa,EAAE,IAAI,EAAE,CAAC,CAAC;QAC7E,CAAC;gBAAS,CAAC;YACT,IAAI,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC;QACvB,CAAC;IACH,CAAC,CAAC;IACF,OAAO,IAAI,CAAC,KAAK,CAAC,CAAC;AACrB,CAAC;AAUD;;;GAGG;AACH,sBAA6B,KAAa,EAAE,OAAO,GAAwB,EAAE;IAC3E,MAAM,QAAQ,GAAG,OAAO,CAAC,SAAS;QAChC,CAAC,CAAC,CAAC,GAAG,6CAA2B,EAAE,GAAG,OAAO,CAAC,SAAS,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,GAAG,CAAC,WAAW,EAAE,CAAC,CAAC;QACxF,CAAC,CAAC,6CAA2B,CAAC;IAChC,MAAM,aAAa,GAAG,OAAO,CAAC,kBAAkB;QAC9C,CAAC,CAAC,CAAC,GAAG,+CAA6B,EAAE,GAAG,OAAO,CAAC,kBAAkB,CAAC;QACnE,CAAC,CAAC,+CAA6B,CAAC;IAClC,MAAM,IAAI,GAAG,CAAC,IAAmB,EAAiB,EAAE,CAClD,IAAI,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,aAAa,CAAC,GAAiB,EAAE,QAAQ,EAAE,aAAa,CAAgB,CAAC,CAAC;IAC9F,OAAO;QACL,IAAI,EAAE,CAAC,OAAO,EAAE,GAAG,IAAI,EAAE,EAAE,CAAC,KAAK,CAAC,IAAI,CAAC,OAAO,EAAE,GAAG,IAAI,CAAC,IAAI,CAAC,CAAC;QAC9D,IAAI,EAAE,CAAC,OAAO,EAAE,GAAG,IAAI,EAAE,EAAE,CAAC,KAAK,CAAC,IAAI,CAAC,OAAO,EAAE,GAAG,IAAI,CAAC,IAAI,CAAC,CAAC;QAC9D,KAAK,EAAE,CAAC,OAAO,EAAE,GAAG,IAAI,EAAE,EAAE,CAAC,KAAK,CAAC,KAAK,CAAC,OAAO,EAAE,GAAG,IAAI,CAAC,IAAI,CAAC,CAAC;QAChE,KAAK,EAAE,CAAC,OAAO,EAAE,GAAG,IAAI,EAAE,EAAE,CAAC,KAAK,CAAC,KAAK,CAAC,OAAO,EAAE,GAAG,IAAI,CAAC,IAAI,CAAC,CAAC;KACjE,CAAC;AACJ,CAAC"}
+{"version":3,"file":"redaction.js","sourceRoot":"","sources":["../../../src/shared/logging/redaction.ts"],"names":[],"mappings":";;;;AACA,qDAA+D;AAC/D,uDAI2B;AAE3B;;;;;;;;;;;;;;GAcG;AACH,uBACE,KAAiB,EACjB,QAAQ,GAAsB,6CAA2B,EACzD,aAAa,GAAsB,+CAA6B;IAEhE,MAAM,IAAI,GAAG,IAAI,OAAO,EAAU,CAAC;IACnC,MAAM,IAAI,GAAG,CAAC,OAAmB,EAAc,EAAE;QAC/C,IAAI,OAAO,OAAO,KAAK,QAAQ;YAAE,OAAO,IAAA,4BAAU,EAAC,OAAO,EAAE,aAAa,CAAC,CAAC;QAC3E,IAAI,OAAO,KAAK,IAAI,IAAI,OAAO,OAAO,KAAK,QAAQ;YAAE,OAAO,OAAO,CAAC;QACpE,IAAI,IAAI,CAAC,GAAG,CAAC,OAAO,CAAC;YAAE,OAAO,YAAY,CAAC;QAC3C,IAAI,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC;QAClB,IAAI,CAAC;YACH,OAAO,IAAA,2BAAU,EAAC,OAAO,EAAE,EAAE,WAAW,EAAE,QAAQ,EAAE,aAAa,EAAE,IAAI,EAAE,CAAC,CAAC;QAC7E,CAAC;gBAAS,CAAC;YACT,IAAI,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC;QACvB,CAAC;IACH,CAAC,CAAC;IACF,OAAO,IAAI,CAAC,KAAK,CAAC,CAAC;AACrB,CAAC;AAcD;;;GAGG;AACH,sBAA6B,KAAa,EAAE,OAAO,GAAwB,EAAE;IAC3E,MAAM,QAAQ,GAAG,OAAO,CAAC,SAAS;QAChC,CAAC,CAAC,CAAC,GAAG,6CAA2B,EAAE,GAAG,OAAO,CAAC,SAAS,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,GAAG,CAAC,WAAW,EAAE,CAAC,CAAC;QACxF,CAAC,CAAC,6CAA2B,CAAC;IAChC,MAAM,aAAa,GAAG,OAAO,CAAC,kBAAkB;QAC9C,CAAC,CAAC,CAAC,GAAG,+CAA6B,EAAE,GAAG,OAAO,CAAC,kBAAkB,CAAC;QACnE,CAAC,CAAC,+CAA6B,CAAC;IAClC,MAAM,IAAI,GAAG,CAAC,IAAmB,EAAiB,EAAE,CAClD,IAAI,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,aAAa,CAAC,GAAiB,EAAE,QAAQ,EAAE,aAAa,CAAgB,CAAC,CAAC;IAC9F,OAAO;QACL,IAAI,EAAE,CAAC,OAAO,EAAE,GAAG,IAAI,EAAE,EAAE,CAAC,KAAK,CAAC,IAAI,CAAC,OAAO,EAAE,GAAG,IAAI,CAAC,IAAI,CAAC,CAAC;QAC9D,IAAI,EAAE,CAAC,OAAO,EAAE,GAAG,IAAI,EAAE,EAAE,CAAC,KAAK,CAAC,IAAI,CAAC,OAAO,EAAE,GAAG,IAAI,CAAC,IAAI,CAAC,CAAC;QAC9D,KAAK,EAAE,CAAC,OAAO,EAAE,GAAG,IAAI,EAAE,EAAE,CAAC,KAAK,CAAC,KAAK,CAAC,OAAO,EAAE,GAAG,IAAI,CAAC,IAAI,CAAC,CAAC;QAChE,KAAK,EAAE,CAAC,OAAO,EAAE,GAAG,IAAI,EAAE,EAAE,CAAC,KAAK,CAAC,KAAK,CAAC,OAAO,EAAE,GAAG,IAAI,CAAC,IAAI,CAAC,CAAC;KACjE,CAAC;AACJ,CAAC"}

package/dist/shared/logging/secret-patterns.d.ts

@@ -8,6 +8,31 @@ export declare const DEFAULT_SECRET_KEY_PATTERNS: readonly string[];
  * high-confidence — each pattern describes a credential *format* rather than a
  * word that merely sounds sensitive — so ordinary operational text survives
  * redaction unchanged.
+ *
+ * The credential-pair pattern (last) tolerates a **closing quote after the
+ * keyword**, because that is what `JSON.stringify` produces
+ * (`{"password":"…"}`) and requiring the separator to follow the bare keyword
+ * matched nothing at all there — a silent, complete bypass on the single most
+ * common shape a downstream HTTP error arrives in. Its group 1 is the keyword
+ * and separator, preserved by {@link redactText}.
+ *
+ * Its value side tries three shapes, and their order is load-bearing:
+ * 1. a fully-quoted span that consumes escapes, so `{"password":"a\"b"}` is
+ *    redacted whole. Ending the span at the escaped quote stopped the
+ *    redaction short and printed the rest of the secret verbatim.
+ * 2. an unquoted JSON scalar — number, `true`, `false`, `null` — required to
+ *    end at a real delimiter — `,`, `}`, `]` or end of input, optionally
+ *    preceded by whitespace. Without this alternative,
+ *    `{"apiKey":123,"region":"us-east-1"}` fell through to the fallback below,
+ *    which then destroyed every sibling field after the secret. The lookahead
+ *    is what stops the alternative truncating a value it does not fully
+ *    describe, such as `token=123abc`, and leaking the tail it left behind.
+ *    Whitespace alone does not end a scalar: treating a space as a delimiter
+ *    made `api_key: 5 items` redact to `api_key: [REDACTED] items`, which
+ *    reads as a partial redaction of a value the pattern never described.
+ * 3. the rest of the line, so a multi-word secret is redacted whole instead of
+ *    up to its first space. Trying the two precise shapes first is what keeps
+ *    this fallback from over-redacting sibling JSON fields.
  */
 export declare const DEFAULT_SECRET_VALUE_PATTERNS: readonly RegExp[];
 /** True when `key` matches any secret-key pattern. */
@@ -17,6 +42,14 @@ export declare function isSecretKey(key: string, patterns: readonly string[]): b
  * leaving the surrounding text intact so a redacted message stays readable.
  * Each pattern is rebuilt per call so a `g` flag's `lastIndex` never leaks
  * between invocations.
+ *
+ * A pattern may capture a leading group it wants **preserved**: only the rest
+ * of the match is replaced, which is what keeps `apiKey=[REDACTED]` saying
+ * which field was redacted instead of collapsing to a bare marker. A pattern
+ * with no group is replaced whole, as before. `String.prototype.replace`
+ * passes the match *offset* — a number — as the second callback argument when
+ * the pattern has no group, hence the `typeof` test rather than an
+ * `undefined` check.
  */
 export declare function redactText(value: string, patterns: readonly RegExp[]): string;
 /**

package/dist/shared/logging/secret-patterns.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"secret-patterns.d.ts","sourceRoot":"","sources":["../../../src/shared/logging/secret-patterns.ts"],"names":[],"mappings":"AAAA,4DAA4D;AAC5D,eAAO,MAAM,QAAQ,eAAe,CAAC;AAErC,oFAAoF;AACpF,eAAO,MAAM,2BAA2B,EAAE,SAAS,MAAM,EAYxD,CAAC;AAEF;;;;;;GAMG;AACH,eAAO,MAAM,6BAA6B,EAAE,SAAS,MAAM,EAK1D,CAAC;AAEF,sDAAsD;AACtD,wBAAgB,WAAW,CAAC,GAAG,EAAE,MAAM,EAAE,QAAQ,EAAE,SAAS,MAAM,EAAE,GAAG,OAAO,CAG7E;AAED;;;;;GAKG;AACH,wBAAgB,UAAU,CAAC,KAAK,EAAE,MAAM,EAAE,QAAQ,EAAE,SAAS,MAAM,EAAE,GAAG,MAAM,CAK7E;AAED;;;GAGG;AACH,wBAAgB,WAAW,CAAC,KAAK,EAAE,eAAe,GAAG,MAAM,CAE1D;AAED,kFAAkF;AAClF,MAAM,WAAW,iBAAiB;IAChC,IAAI,EAAE,MAAM,CAAC;IACb,OAAO,EAAE,MAAM,CAAC;IAChB,KAAK,EAAE,MAAM,GAAG,SAAS,CAAC;IAC1B,OAAO,EAAE,OAAO,CAAC;CAClB;AAED;;;;;GAKG;AACH,wBAAgB,eAAe,CAAC,KAAK,EAAE,KAAK,EAAE,QAAQ,EAAE,SAAS,MAAM,EAAE,GAAG,iBAAiB,CAS5F"}
+{"version":3,"file":"secret-patterns.d.ts","sourceRoot":"","sources":["../../../src/shared/logging/secret-patterns.ts"],"names":[],"mappings":"AAAA,4DAA4D;AAC5D,eAAO,MAAM,QAAQ,eAAe,CAAC;AAErC,oFAAoF;AACpF,eAAO,MAAM,2BAA2B,EAAE,SAAS,MAAM,EAYxD,CAAC;AAEF;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA+BG;AACH,eAAO,MAAM,6BAA6B,EAAE,SAAS,MAAM,EAK1D,CAAC;AAEF,sDAAsD;AACtD,wBAAgB,WAAW,CAAC,GAAG,EAAE,MAAM,EAAE,QAAQ,EAAE,SAAS,MAAM,EAAE,GAAG,OAAO,CAG7E;AAED;;;;;;;;;;;;;GAaG;AACH,wBAAgB,UAAU,CAAC,KAAK,EAAE,MAAM,EAAE,QAAQ,EAAE,SAAS,MAAM,EAAE,GAAG,MAAM,CAQ7E;AAED;;;GAGG;AACH,wBAAgB,WAAW,CAAC,KAAK,EAAE,eAAe,GAAG,MAAM,CAE1D;AAED,kFAAkF;AAClF,MAAM,WAAW,iBAAiB;IAChC,IAAI,EAAE,MAAM,CAAC;IACb,OAAO,EAAE,MAAM,CAAC;IAChB,KAAK,EAAE,MAAM,GAAG,SAAS,CAAC;IAC1B,OAAO,EAAE,OAAO,CAAC;CAClB;AAED;;;;;GAKG;AACH,wBAAgB,eAAe,CAAC,KAAK,EAAE,KAAK,EAAE,QAAQ,EAAE,SAAS,MAAM,EAAE,GAAG,iBAAiB,CAS5F"}

package/dist/shared/logging/secret-patterns.js

@@ -27,12 +27,37 @@ exports.DEFAULT_SECRET_KEY_PATTERNS = [
  * high-confidence — each pattern describes a credential *format* rather than a
  * word that merely sounds sensitive — so ordinary operational text survives
  * redaction unchanged.
+ *
+ * The credential-pair pattern (last) tolerates a **closing quote after the
+ * keyword**, because that is what `JSON.stringify` produces
+ * (`{"password":"…"}`) and requiring the separator to follow the bare keyword
+ * matched nothing at all there — a silent, complete bypass on the single most
+ * common shape a downstream HTTP error arrives in. Its group 1 is the keyword
+ * and separator, preserved by {@link redactText}.
+ *
+ * Its value side tries three shapes, and their order is load-bearing:
+ * 1. a fully-quoted span that consumes escapes, so `{"password":"a\"b"}` is
+ *    redacted whole. Ending the span at the escaped quote stopped the
+ *    redaction short and printed the rest of the secret verbatim.
+ * 2. an unquoted JSON scalar — number, `true`, `false`, `null` — required to
+ *    end at a real delimiter — `,`, `}`, `]` or end of input, optionally
+ *    preceded by whitespace. Without this alternative,
+ *    `{"apiKey":123,"region":"us-east-1"}` fell through to the fallback below,
+ *    which then destroyed every sibling field after the secret. The lookahead
+ *    is what stops the alternative truncating a value it does not fully
+ *    describe, such as `token=123abc`, and leaking the tail it left behind.
+ *    Whitespace alone does not end a scalar: treating a space as a delimiter
+ *    made `api_key: 5 items` redact to `api_key: [REDACTED] items`, which
+ *    reads as a partial redaction of a value the pattern never described.
+ * 3. the rest of the line, so a multi-word secret is redacted whole instead of
+ *    up to its first space. Trying the two precise shapes first is what keeps
+ *    this fallback from over-redacting sibling JSON fields.
  */
 exports.DEFAULT_SECRET_VALUE_PATTERNS = [
     /\b(?:AKIA|ASIA)[0-9A-Z]{16}\b/g,
     /\bBearer\s+[A-Za-z0-9._~+/-]+=*/gi,
     /\beyJ[A-Za-z0-9_-]+\.[A-Za-z0-9_-]+\.[A-Za-z0-9_-]+\b/g,
-    /(?:aws_)?(?:secret_access_key|secretaccesskey|password|passwd|api_?key|token)\s*[=:]\s*\S+/gi,
+    /((?:aws_)?(?:secret_access_key|secretaccesskey|password|passwd|api_?key|token)["']?\s*[=:]\s*)(?:"(?:\\.|[^"\\])*"|'(?:\\.|[^'\\])*'|(?:-?\d+(?:\.\d+)?(?:[eE][+-]?\d+)?|true|false|null)(?=\s*[,}\]]|\s*$)|[^\r\n]+)/gi,
 ];
 /** True when `key` matches any secret-key pattern. */
 function isSecretKey(key, patterns) {
@@ -44,9 +69,17 @@ function isSecretKey(key, patterns) {
  * leaving the surrounding text intact so a redacted message stays readable.
  * Each pattern is rebuilt per call so a `g` flag's `lastIndex` never leaks
  * between invocations.
+ *
+ * A pattern may capture a leading group it wants **preserved**: only the rest
+ * of the match is replaced, which is what keeps `apiKey=[REDACTED]` saying
+ * which field was redacted instead of collapsing to a bare marker. A pattern
+ * with no group is replaced whole, as before. `String.prototype.replace`
+ * passes the match *offset* — a number — as the second callback argument when
+ * the pattern has no group, hence the `typeof` test rather than an
+ * `undefined` check.
  */
 function redactText(value, patterns) {
-    return patterns.reduce((text, pattern) => text.replace(new RegExp(pattern.source, pattern.flags), exports.REDACTED), value);
+    return patterns.reduce((text, pattern) => text.replace(new RegExp(pattern.source, pattern.flags), (_match, prefix) => typeof prefix === 'string' ? `${prefix}${exports.REDACTED}` : exports.REDACTED), value);
 }
 /**
  * A short label for a binary view. Recursing one would explode it into a

package/dist/shared/logging/secret-patterns.js.map

@@ -1 +1 @@
-{"version":3,"file":"secret-patterns.js","sourceRoot":"","sources":["../../../src/shared/logging/secret-patterns.ts"],"names":[],"mappings":";;;;;;;AAAA,4DAA4D;AAC/C,QAAA,QAAQ,GAAG,YAAY,CAAC;AAErC,oFAAoF;AACvE,QAAA,2BAA2B,GAAsB;IAC5D,WAAW;IACX,WAAW;IACX,QAAQ;IACR,cAAc;IACd,eAAe;IACf,eAAe;IACf,UAAU;IACV,QAAQ;IACR,QAAQ;IACR,OAAO;IACP,YAAY;CACb,CAAC;AAEF;;;;;;GAMG;AACU,QAAA,6BAA6B,GAAsB;IAC9D,gCAAgC;IAChC,mCAAmC;IACnC,wDAAwD;IACxD,8FAA8F;CAC/F,CAAC;AAEF,sDAAsD;AACtD,qBAA4B,GAAW,EAAE,QAA2B;IAClE,MAAM,KAAK,GAAG,GAAG,CAAC,WAAW,EAAE,CAAC;IAChC,OAAO,QAAQ,CAAC,IAAI,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,KAAK,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC,CAAC;AAC7D,CAAC;AAED;;;;;GAKG;AACH,oBAA2B,KAAa,EAAE,QAA2B;IACnE,OAAO,QAAQ,CAAC,MAAM,CACpB,CAAC,IAAI,EAAE,OAAO,EAAE,EAAE,CAAC,IAAI,CAAC,OAAO,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,MAAM,EAAE,OAAO,CAAC,KAAK,CAAC,EAAE,QAAA,QAAQ,CAAC,EACpF,KAAK,CACN,CAAC;AACJ,CAAC;AAED;;;GAGG;AACH,qBAA4B,KAAsB;IAChD,OAAO,IAAI,KAAK,CAAC,WAAW,CAAC,IAAI,IAAI,KAAK,CAAC,UAAU,IAAI,CAAC;AAC5D,CAAC;AAUD;;;;;GAKG;AACH,yBAAgC,KAAY,EAAE,QAA2B;IACvE,MAAM,OAAO,GAAG,UAAU,CAAC,KAAK,CAAC,OAAO,EAAE,QAAQ,CAAC,CAAC;IACpD,MAAM,KAAK,GAAG,KAAK,CAAC,KAAK,KAAK,SAAS,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,UAAU,CAAC,KAAK,CAAC,KAAK,EAAE,QAAQ,CAAC,CAAC;IACxF,OAAO;QACL,IAAI,EAAE,KAAK,CAAC,IAAI;QAChB,OAAO;QACP,KAAK;QACL,OAAO,EAAE,OAAO,KAAK,KAAK,CAAC,OAAO,IAAI,KAAK,KAAK,KAAK,CAAC,KAAK;KAC5D,CAAC;AACJ,CAAC"}
+{"version":3,"file":"secret-patterns.js","sourceRoot":"","sources":["../../../src/shared/logging/secret-patterns.ts"],"names":[],"mappings":";;;;;;;AAAA,4DAA4D;AAC/C,QAAA,QAAQ,GAAG,YAAY,CAAC;AAErC,oFAAoF;AACvE,QAAA,2BAA2B,GAAsB;IAC5D,WAAW;IACX,WAAW;IACX,QAAQ;IACR,cAAc;IACd,eAAe;IACf,eAAe;IACf,UAAU;IACV,QAAQ;IACR,QAAQ;IACR,OAAO;IACP,YAAY;CACb,CAAC;AAEF;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA+BG;AACU,QAAA,6BAA6B,GAAsB;IAC9D,gCAAgC;IAChC,mCAAmC;IACnC,wDAAwD;IACxD,yNAAyN;CAC1N,CAAC;AAEF,sDAAsD;AACtD,qBAA4B,GAAW,EAAE,QAA2B;IAClE,MAAM,KAAK,GAAG,GAAG,CAAC,WAAW,EAAE,CAAC;IAChC,OAAO,QAAQ,CAAC,IAAI,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,KAAK,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC,CAAC;AAC7D,CAAC;AAED;;;;;;;;;;;;;GAaG;AACH,oBAA2B,KAAa,EAAE,QAA2B;IACnE,OAAO,QAAQ,CAAC,MAAM,CACpB,CAAC,IAAI,EAAE,OAAO,EAAE,EAAE,CAChB,IAAI,CAAC,OAAO,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,MAAM,EAAE,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC,MAAM,EAAE,MAAuB,EAAE,EAAE,CAC1F,OAAO,MAAM,KAAK,QAAQ,CAAC,CAAC,CAAC,GAAG,MAAM,GAAG,QAAA,QAAQ,EAAE,CAAC,CAAC,CAAC,QAAA,QAAQ,CAC/D,EACH,KAAK,CACN,CAAC;AACJ,CAAC;AAED;;;GAGG;AACH,qBAA4B,KAAsB;IAChD,OAAO,IAAI,KAAK,CAAC,WAAW,CAAC,IAAI,IAAI,KAAK,CAAC,UAAU,IAAI,CAAC;AAC5D,CAAC;AAUD;;;;;GAKG;AACH,yBAAgC,KAAY,EAAE,QAA2B;IACvE,MAAM,OAAO,GAAG,UAAU,CAAC,KAAK,CAAC,OAAO,EAAE,QAAQ,CAAC,CAAC;IACpD,MAAM,KAAK,GAAG,KAAK,CAAC,KAAK,KAAK,SAAS,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,UAAU,CAAC,KAAK,CAAC,KAAK,EAAE,QAAQ,CAAC,CAAC;IACxF,OAAO;QACL,IAAI,EAAE,KAAK,CAAC,IAAI;QAChB,OAAO;QACP,KAAK;QACL,OAAO,EAAE,OAAO,KAAK,KAAK,CAAC,OAAO,IAAI,KAAK,KAAK,KAAK,CAAC,KAAK;KAC5D,CAAC;AACJ,CAAC"}

package/dist/store/actions/put.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"put.d.ts","sourceRoot":"","sources":["../../../src/store/actions/put.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,iCAAiC,CAAC;AAcpE,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,mBAAmB,CAAC;AAgFtD;;;;;;GAMG;AACH,wBAAsB,OAAO,CAAC,OAAO,EAAE,YAAY,EAAE,EAAE,EAAE,YAAY,GAAG,OAAO,CAAC,IAAI,CAAC,CAyBpF"}
+{"version":3,"file":"put.d.ts","sourceRoot":"","sources":["../../../src/store/actions/put.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,iCAAiC,CAAC;AAcpE,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,mBAAmB,CAAC;AAsDtD;;;;;;GAMG;AACH,wBAAsB,OAAO,CAAC,OAAO,EAAE,YAAY,EAAE,EAAE,EAAE,YAAY,GAAG,OAAO,CAAC,IAAI,CAAC,CAyBpF"}