@farukada/aws-langgraph-dynamodb-ts 1.0.0-rc.1 → 1.0.0

package/dist/esm/store/internal/batch-plan.js

@@ -0,0 +1,28 @@
+import { DEFAULT_READ_CONCURRENCY, mapWithConcurrency } from '../../shared/concurrency.js';
+function itemOf(address) {
+    return JSON.stringify([address.namespace, address.key]);
+}
+export function planBatch(operations) {
+    const reads = [];
+    const lastWrite = new Map();
+    operations.forEach((op, index) => {
+        if (op.kind === 'put' || op.kind === 'delete')
+            lastWrite.set(itemOf(op.address), index);
+        else
+            reads.push(index);
+    });
+    return { reads, writes: [...lastWrite.values()].sort((a, b) => a - b) };
+}
+export async function runBatch(operations, dispatch, limit = DEFAULT_READ_CONCURRENCY) {
+    const results = operations.map(() => null);
+    const { reads, writes } = planBatch(operations);
+    for (const phase of [reads, writes]) {
+        if (phase.length === 0)
+            continue;
+        const share = Math.max(1, Math.floor(limit / Math.min(limit, phase.length)));
+        await mapWithConcurrency(phase, limit, async (index) => {
+            results[index] = await dispatch(operations[index], share);
+        });
+    }
+    return results;
+}

package/dist/esm/store/internal/filter.d.ts

@@ -0,0 +1,43 @@
+/**
+ * Hides the store's filter grammar.
+ *
+ * Which operators a search filter accepts, how each compares a stored field —
+ * ordered comparisons only between like-typed values, an absent field
+ * satisfying only `$ne` and `$nin` — and whether an item passes a search's
+ * optional filter are decided here, the same way whichever search path runs.
+ */
+import type { Item } from '@langchain/langgraph-checkpoint';
+/** A JSON value stored in an item or supplied in a filter. */
+export type JsonValue = string | number | boolean | null | JsonValue[] | {
+    [key: string]: JsonValue;
+};
+/**
+ * Whether `value` satisfies every field condition in `filter`.
+ *
+ * Accepts: `value` — a stored item's decoded value. Declared as a record, but a
+ * row holds whatever its writer stored, including `null` and a scalar; such a
+ * value has no own properties and so satisfies no condition. `filter` — a plain
+ * value per field is exact match, an operator object (`{ $gt: 4 }`) applies
+ * comparisons, and `{}` constrains nothing.
+ *
+ * Returns: whether every condition holds.
+ *
+ * Throws: nothing. `search` walks every candidate row, so one row whose value
+ * is not an object must not fail the search.
+ *
+ * Guarantees: own properties only — `value['toString']` would otherwise resolve
+ * up the prototype chain and be compared as if it were stored data.
+ */
+export declare function matchesStoreFilter(value: Record<string, JsonValue>, filter: Record<string, JsonValue>): boolean;
+/**
+ * Whether `item` satisfies a search's optional metadata filter.
+ *
+ * Accepts: `filter` — a parsed search's filter; absent passes every item.
+ * `item.value` — whatever the item's writer stored; a value that is not
+ * an object satisfies no condition (see `matchesStoreFilter`).
+ *
+ * Returns: whether the item belongs in the result.
+ *
+ * Throws: nothing, so one unusual row cannot fail a search over many.
+ */
+export declare function passesFilter(item: Item, filter: Record<string, JsonValue> | undefined): boolean;

package/dist/esm/store/internal/filter.js

@@ -0,0 +1,60 @@
+import { isDeepStrictEqual } from 'node:util';
+function orderOf(actual, expected) {
+    if (actual < expected)
+        return -1;
+    if (actual > expected)
+        return 1;
+    return actual === expected ? 0 : undefined;
+}
+function testOrder(order, test) {
+    return order !== undefined && test(order);
+}
+function compareOrdered(actual, expected, test) {
+    if (typeof actual === 'number' && typeof expected === 'number') {
+        return testOrder(orderOf(actual, expected), test);
+    }
+    if (typeof actual === 'string' && typeof expected === 'string') {
+        return testOrder(orderOf(actual, expected), test);
+    }
+    return false;
+}
+function equalValues(actual, expected) {
+    if (typeof actual === 'number' && typeof expected === 'number') {
+        return actual === expected || (Number.isNaN(actual) && Number.isNaN(expected));
+    }
+    return isDeepStrictEqual(actual, expected);
+}
+const COMPARATORS = {
+    $eq: (actual, expected) => equalValues(actual, expected),
+    $ne: (actual, expected) => !equalValues(actual, expected),
+    $gt: (actual, expected) => compareOrdered(actual, expected, (order) => order > 0),
+    $gte: (actual, expected) => compareOrdered(actual, expected, (order) => order >= 0),
+    $lt: (actual, expected) => compareOrdered(actual, expected, (order) => order < 0),
+    $lte: (actual, expected) => compareOrdered(actual, expected, (order) => order <= 0),
+    $in: (actual, expected) => Array.isArray(expected) ? expected.some((candidate) => equalValues(actual, candidate)) : false,
+    $nin: (actual, expected) => Array.isArray(expected) ? !expected.some((candidate) => equalValues(actual, candidate)) : true,
+};
+function isOperatorObject(condition) {
+    return (typeof condition === 'object' &&
+        condition !== null &&
+        !Array.isArray(condition) &&
+        Object.keys(condition).every((key) => Object.prototype.hasOwnProperty.call(COMPARATORS, key)));
+}
+function matchesCondition(actual, condition) {
+    if (!isOperatorObject(condition))
+        return equalValues(actual, condition);
+    return Object.entries(condition).every(([operator, expected]) => COMPARATORS[operator](actual, expected));
+}
+function ownField(item, field) {
+    if (item === null || typeof item !== 'object')
+        return undefined;
+    return Object.hasOwn(item, field) ? item[field] : undefined;
+}
+export function matchesStoreFilter(value, filter) {
+    return Object.entries(filter).every(([field, condition]) => matchesCondition(ownField(value, field), condition));
+}
+export function passesFilter(item, filter) {
+    if (!filter)
+        return true;
+    return matchesStoreFilter(item.value, filter);
+}

package/dist/esm/store/internal/get-item.d.ts

@@ -0,0 +1,77 @@
+/**
+ * Hides what a single read counts as absent, and how it outlives an overwrite.
+ *
+ * A get reads its row strongly consistently and answers `null` alike for a
+ * missing row, an expired one and a row this adapter does not own. When the
+ * object an offloaded row names is deleted between the row read and the
+ * download, one re-read settles whether the item was replaced, removed or
+ * truly lost. A caller gets an item or `null` and never sees the race.
+ */
+import type { Item } from '@langchain/langgraph-checkpoint';
+import type { StoreAddress } from './parse.js';
+import { type StoreItemRow } from './rows.js';
+import type { StoreContext } from './setup.js';
+/** A row and the item it decodes to, read together so a caller can use the row's own fields. */
+export interface ReadCandidate {
+    readonly row: StoreItemRow;
+    readonly item: Item;
+}
+/**
+ * The item a row denotes, recovering from a concurrent overwrite of that row.
+ *
+ * An offloaded item can lose a race with a concurrent overwrite: between the
+ * row read and the S3 download the writer commits a new descriptor and deletes
+ * the object this read was about to fetch. That surfaces as `NoSuchKey` — or
+ * as a 403 `AccessDenied` for a role without `s3:ListBucket`, which S3 answers
+ * for a missing key instead — and one strongly-consistent re-read settles it —
+ * the row now points at the new object (that is the answer), is gone, or
+ * still points at the same missing object (a genuine loss, rethrown) — and a
+ * refused download on an unchanged row is rethrown the same way, since it is
+ * then a real permission failure. A row the overwrite left with no descriptor
+ * at all is a replacement like any other: it is decoded, and refused by its
+ * own coded error. Any other download failure propagates.
+ *
+ * Every reader that downloads a row it read earlier takes this route: `get`,
+ * whose window is one read; a search, which reads a whole page before it
+ * downloads anything; and a reconcile, which reads a whole namespace. A
+ * search that failed on it failed for an item that is live and readable a
+ * moment later.
+ *
+ * Accepts: `record` — a row read moments ago, whose object may since have been
+ * released. `signal` — aborts the download and the re-read.
+ *
+ * Returns: the row that was finally decoded and its item — the one given, or
+ * the one the overwrite left — or `undefined` when the re-read finds the row
+ * gone or expired.
+ *
+ * Throws: as {@link readStoreItem}, for the row finally decoded; the
+ * download's own failure when the re-read finds the same row.
+ */
+export declare function readCandidate(context: StoreContext, record: StoreItemRow, signal?: AbortSignal): Promise<ReadCandidate | undefined>;
+/**
+ * Retrieve a single item by namespace and key (strongly consistent), or null.
+ *
+ * A download that finds its object released by a concurrent overwrite is
+ * settled by {@link readCandidate}.
+ *
+ * Accepts: `address` — parsed; no check is repeated here. `signal` — aborts
+ * the reads.
+ *
+ * Returns: the item, or `null` for one that does not exist, has expired, or
+ * whose key holds a row this adapter does not own — which includes a row whose
+ * `createdAt` or `updatedAt` is not the string this package writes there, since
+ * an item is reported with both. The answers are one on purpose: a caller
+ * cannot act on the difference, and reporting a foreign row would leak that a
+ * shared table holds one.
+ *
+ * Throws: `VALIDATION` naming — for a row whose descriptor is not one —
+ * `descriptor`; `FORMAT_UNSUPPORTED` for
+ * a row, or a payload, written by a newer version, which is *not* reported as
+ * absent — hiding an item that exists is worse than failing; `PAYLOAD_CORRUPT`
+ * or the download's own error for a payload that cannot be read; `ABORTED`
+ * when the signal fires.
+ *
+ * Guarantees: strongly consistent — an item just written is always seen, and
+ * the ttl is honoured here rather than waited for.
+ */
+export declare function getItem(context: StoreContext, address: StoreAddress, signal?: AbortSignal): Promise<Item | null>;

package/dist/esm/store/internal/get-item.js

@@ -0,0 +1,54 @@
+import { nowSeconds } from '../../shared/clock.js';
+import { PayloadLocation, isMissingObjectError, isRefusedObjectError, } from '../../shared/codec/codec.js';
+import { withDynamoDBRetry, retryFor } from '../../shared/dynamodb/retry.js';
+import { isExpiredRow } from '../../shared/dynamodb/table-schema.js';
+import { itemRowKey, parseWholeStoreRow, partitionKey, readStoreItem, sortKey, } from './rows.js';
+async function readRow(context, namespace, key, signal) {
+    const result = await withDynamoDBRetry((request) => context.client.get({
+        TableName: context.tableName,
+        Key: itemRowKey({ namespace, key }),
+        ConsistentRead: true,
+    }, request), retryFor(context, signal));
+    if (!result.Item)
+        return undefined;
+    const record = parseWholeStoreRow(result.Item);
+    if (!record) {
+        context.logger.warn('store.get: ignored a row that is not a store item', {
+            partitionKey: partitionKey(namespace),
+            sortKey: sortKey(namespace, key),
+        });
+        return undefined;
+    }
+    return isExpiredRow(record, nowSeconds()) ? undefined : record;
+}
+function sameObject(read, reread) {
+    const fresh = reread.value;
+    if (!fresh)
+        return false;
+    return (read.value.location === PayloadLocation.S3 &&
+        fresh.location === PayloadLocation.S3 &&
+        read.value.s3Key === fresh.s3Key);
+}
+export async function readCandidate(context, record, signal) {
+    try {
+        return { row: record, item: await readStoreItem(context, record, signal) };
+    }
+    catch (error) {
+        if (!isMissingObjectError(error) && !isRefusedObjectError(error))
+            throw error;
+        const fresh = await readRow(context, record.namespace, record.key, signal);
+        if (!fresh)
+            return undefined;
+        if (sameObject(record, fresh))
+            throw error;
+        return { row: fresh, item: await readStoreItem(context, fresh, signal) };
+    }
+}
+export async function getItem(context, address, signal) {
+    const { namespace, key } = address;
+    const record = await readRow(context, namespace, key, signal);
+    if (!record)
+        return null;
+    const read = await readCandidate(context, record, signal);
+    return read === undefined ? null : read.item;
+}

package/dist/esm/store/internal/item-write.d.ts

@@ -0,0 +1,270 @@
+/**
+ * Hides how an item's row is replaced or removed without stranding its S3
+ * object or deleting one a live row still names.
+ *
+ * A put with an offloader pins its write to the revision it observed and
+ * re-reads when a concurrent writer wins; once the budget is spent it
+ * overwrites and may leak one object to the lifecycle rule. A delete pins
+ * itself the same way. Either releases the payload it superseded only once its
+ * own write committed, and a write whose outcome was lost is read back before
+ * anything is released. Without an offloader there is no object to protect,
+ * and a put is a plain write.
+ */
+import { type WriteVerdict } from '../../shared/dynamodb/idempotent-write.js';
+import { type RowKey } from '../../shared/dynamodb/table-schema.js';
+import type { StoreAddress } from './parse.js';
+import { type ExistingRowMeta, type StoreItemRow } from './rows.js';
+import type { StoreContext } from './setup.js';
+/**
+ * Delete the item and, when a vector backend is configured, drop its vector.
+ *
+ * The row is read first, then removed inside a one-item `TransactWriteItems`
+ * conditioned on the revision that read observed. An unconditional delete
+ * erases a put that commits between the caller's call and the write — no lost
+ * acknowledgement needed, no S3 involved — and releases the object that put
+ * uploaded. The condition refuses that, and the request token makes a lost
+ * acknowledgement harmless: the replay is answered from DynamoDB's idempotency
+ * cache instead of removing whatever has arrived since.
+ *
+ * **A key with no row costs one read and sends no write at all**, which is the
+ * same race closed from the other side: there is nothing to pin, so a put that
+ * lands mid-call survives. The S3 release and the vector sync still run, since
+ * a key with no row can still have a stranded vector and clearing it is a
+ * repair path callers have today — and the vector sync goes through the same
+ * confirmation as every other path rather than letting the pre-read stand in
+ * for it, so the put that lands mid-call keeps its vector too.
+ *
+ * What a caller can and cannot tell apart:
+ *
+ * - **Compare-and-swap exhaustion resolves rather than throwing.** Three
+ *   consecutive writers between a re-pin and its attempt leave the item in
+ *   place, release nothing — correctly, a live row names the object — and emit
+ *   one `warn`. Throwing instead would add a failure mode to an interleaving
+ *   that succeeds today, which every caller deleting in a `finally` would have
+ *   to handle.
+ * - **The vector is dropped only on a confirmation, and that window is
+ *   narrowed rather than closed.** Immediately before the backend call — and
+ *   above the S3 cleanup, so no round trip with its own retries sits inside the
+ *   window — one strongly-consistent projected read asks whether the key holds
+ *   a row now, and a row that is there keeps its vector and logs one `info`.
+ *   That covers both interleavings that would otherwise erase a live item's vector: a
+ *   put recreating the row this call removed, and the compare-and-swap above
+ *   resolving with the row untouched. What is left is a put committing between
+ *   that read and the backend call, two adjacent statements apart. Closing it
+ *   needs a compare-and-swap **on the vector backend** — delete this vector
+ *   only if it is still the one written at time T — which the `VectorBackend`
+ *   contract cannot express and no implementation would be obliged to honour,
+ *   so `reconcileVectorIndex` stays the named repair for it.
+ * - **A deadline cut and a spent budget are one error.** The transaction's
+ *   budget is additionally bounded by `MAX_WRITE_LIFETIME_MS`, so a caller who
+ *   configures a long retry policy can see the budget end there rather than at
+ *   its own last attempt; both arrive as `RETRY_EXHAUSTED` and neither says
+ *   which bound stopped it.
+ * - **The pre-read is a new way for this call to fail.** It issues no read
+ *   today, so a delete of a key with *no row* can now fail where it always
+ *   succeeded. Nothing has been written when it does: no row removed, no object
+ *   released, no vector touched. The error types a caller sees are unchanged —
+ *   `store.delete` already documents `RETRY_EXHAUSTED` — but "deleting an
+ *   item that is not there is not an error" now describes the outcome rather
+ *   than the round trip.
+ *
+ * Accepts: `address` — parsed; the namespace and key the cleanup is scoped and
+ * logged by, and the row's key is derived from it.
+ *
+ * Returns: nothing. The item is gone, was already gone, or — on
+ * compare-and-swap exhaustion — is still there and was left alone.
+ *
+ * Throws: whatever the pre-read throws; whatever the transaction throws other
+ * than a guard rejection, which is this call's own business; and
+ * `RETRY_EXHAUSTED` when the budget is spent and a read cannot confirm the
+ * row is gone. Three things about that list are worth saying rather than
+ * leaving to be inferred. The **pre-read** is why a delete of a key with no row
+ * can now fail at all, and nothing has been written when it does. A **guard
+ * rejection** is refused rather than raised: the row it names was replaced
+ * after this call observed it, so removing it would erase that put and release
+ * the object the put uploaded, and re-pinning on the row the rejection carried
+ * is strictly safer than either raising or proceeding. And **exhausting** those
+ * re-pins throws nothing either — it resolves with the item still there and one
+ * `warn`, so a caller that needs the item gone re-runs once the key is
+ * quiescent rather than catching anything.
+ *
+ * Guarantees: the object released is the **last observation's**, on every path
+ * that releases at all — the pre-read's when nothing re-pinned, the rejected
+ * row's when something did. It is never read back from the response, so by
+ * construction the object of a delete whose acknowledgement was lost is not
+ * leaked. Nothing is released while the outcome is unknown: only a
+ * confirmed absence or a confirmed delete licenses it. And the backend's
+ * `delete` is never reached without a confirmation immediately before it, on
+ * every path including the one whose key never had a row: one rule with no
+ * exception, because an exception on a repair-shaped path is where the erasure
+ * comes back unnoticed.
+ */
+export declare function deleteStoreItem(context: StoreContext, address: StoreAddress): Promise<void>;
+/**
+ * Refuse a row DynamoDB would refuse for its size.
+ *
+ * Accepts: `record` — the fully built row, its payload encoded and its inline
+ * vectors attached.
+ *
+ * Returns: nothing: the row is kept under its declared type, and this checks it.
+ *
+ * Throws: `VALIDATION` when the row would pass DynamoDB's 400 KB item limit —
+ * naming `index` when the row fits without its vectors, since the vectors are
+ * what pushed it over (index fewer fields, embed with fewer dimensions, or
+ * configure a `vectorBackend`), and `value` otherwise.
+ */
+export declare function assertRowFits(record: StoreItemRow): void;
+/**
+ * Put the record and clean up whichever side is now dead.
+ *
+ * The compare-and-swap path runs **only when an offloader is configured**:
+ * without one there is no S3 object to orphan, so a plain last-write-wins put
+ * stays correct and costs no extra write capacity (DynamoDB charges for a
+ * failed conditional write too). With one, the swap is what lets this call
+ * delete exactly the payload it superseded rather than a descriptor a racer may
+ * already have replaced.
+ *
+ * Every failed put arrives after at least one write was issued —
+ * `putWithRevisionSwap` only re-reads after a rejection — so none of them
+ * proves a non-commit on its own: a put can commit server-side and lose its
+ * response, and a `ConditionalCheckFailedException` is as consistent with
+ * hitting the row this call just wrote as with a competitor's win. The row is
+ * therefore read back ({@link settleFailedPut}) before anything is deleted.
+ * Only a confirmed `'not-landed'` deletes this record's own object; a confirmed
+ * `'landed'` cleans up what the landed write replaced — the observation the
+ * attempt in flight was pinned to, which after a re-pin is a competitor's, not
+ * what this call first read — and swallows the error; an `'unverified'` read
+ * deletes nothing and rethrows, leaking one object at worst rather than
+ * stranding a live row pointing at a deleted one. So does a read that finds
+ * nothing, or finds another revision, after a write that DynamoDB may still
+ * apply: any attempt of the budget that got no answer, that DynamoDB answered
+ * as still in progress (`TransactionInProgressException`) or that failed with a
+ * server error (5xx). The verification compares the per-call `rev`, so an
+ * inline record is verified too: otherwise a lost acknowledgement of an inline
+ * overwrite would be reported as a failure while the previous offloaded object
+ * was never cleaned.
+ *
+ * Neither release reads the row again first. The record's object is uploaded
+ * under the record's own `rev`, which no other put uses, so no row another put
+ * commits names it; and the record names only that object, never the one it
+ * superseded.
+ *
+ * Accepts: `record` — the fully encoded row, its payload already uploaded if it
+ * was offloaded. `existing` — what the caller read before encoding.
+ *
+ * Returns: nothing. The row is committed and exactly one side's object, at
+ * most, has been released.
+ *
+ * Throws: `VALIDATION` naming `index` or `value` for a row over DynamoDB's
+ * item limit, before any write and after releasing this put's own upload;
+ * whatever the write, or the swap's re-read after a rejection, throws, unless
+ * the verification proves the write landed after all — in which case the error
+ * is swallowed and the cleanup runs as on the success path.
+ *
+ * Guarantees: this record's own object is released only after a read proves
+ * the write did not land, and a superseded object only after this record is
+ * committed. The failure modes are ordered by which is worse: a leaked object
+ * costs storage until the lifecycle rule reclaims it, while a row pointing at a
+ * deleted object is unreadable data, so every ambiguous case leaks instead of
+ * deletes.
+ */
+export declare function persistRow(context: StoreContext, record: StoreItemRow, existing: ExistingRowMeta): Promise<void>;
+/**
+ * How a revision swap ended, settled rather than thrown: what its committed
+ * write superseded, or the failure together with the observation the attempt in
+ * flight was pinned to — what that write replaced, if it landed after all.
+ */
+type SwapOutcome = {
+    ok: true;
+    superseded: ExistingRowMeta;
+} | {
+    ok: false;
+    reason: Error;
+    pinned: ExistingRowMeta;
+};
+/**
+ * Commit `record`, re-reading and retrying while another writer holds the row,
+ * and report the state this write actually superseded — the only descriptor
+ * safe to delete afterwards.
+ *
+ * Without the swap both racers read the same previous descriptor, both commit,
+ * and both delete it, orphaning the loser's own upload. Retrying against the
+ * *re-read* state is what makes each writer supersede exactly one payload.
+ *
+ * A rejection is not proof a competitor won: `withDynamoDBRetry` retries
+ * transient errors, so an attempt can commit server-side, its response can be
+ * lost, and the retried put can hit the row it just wrote and fail the same
+ * guard — indistinguishable from a competitor's win by the rejection alone.
+ * Each attempt's pinned observation is captured in `attempted` before the
+ * put, so that when a re-read finds the row already holding *this call's
+ * own* `rev`, the swap returns whatever `attempted` held — never this
+ * record's own just-committed value, which would strand the live row
+ * pointing at a deleted object. That comparison is guarded on `rev` being
+ * set: `rev` is optional on the record type, and an unnonced record against a
+ * pre-0.9.0 revision-less row would otherwise match `undefined === undefined`
+ * and claim a race it never entered.
+ *
+ * On exhaustion the write proceeds unconditionally and warns. That is
+ * deliberate: the fallback costs at most one orphaned object, reclaimed by a
+ * lifecycle rule, so pathological contention degrades instead of turning a
+ * working put into an error. `createdAt` is refreshed from
+ * each re-read so a row created by whoever won keeps its true creation time.
+ *
+ * Accepts: `record` — the row to commit, carrying this call's own `rev`.
+ * `existing` — what the caller read before encoding, used as the first pin; an
+ * `exists: false` observation pins "no row", so a creation races correctly too.
+ *
+ * Returns: on success, the state this write actually superseded — the
+ * descriptor safe to delete — which is the last observation the winning put
+ * was pinned to, never this record's own value. On failure — a put failing
+ * other than on its guard, or a re-read failing after a rejection — the error,
+ * with the observation the failed attempt was pinned to. After a re-pin that is
+ * a competitor's row, not `existing`: the competitor already replaced and
+ * released `existing`, so a write that landed without an answer superseded the
+ * competitor's object, and only this observation names it.
+ *
+ * Throws: nothing; a failure is reported in the outcome, because only the
+ * swap knows which observation the failed attempt was pinned to.
+ *
+ * Guarantees: at most {@link OVERWRITE_CAS_MAX_ATTEMPTS} conditional puts, and
+ * a re-read only when the rejection did not already carry the row that caused
+ * it.
+ */
+export declare function putWithRevisionSwap(context: StoreContext, record: StoreItemRow, existing: ExistingRowMeta): Promise<SwapOutcome>;
+/**
+ * Whether `error` is a spent retry budget.
+ *
+ * Accepts: any error, and equally anything else a `throw` can produce.
+ * Recognised by brand and code: the code is the one thing an error crossing a
+ * module or realm boundary can be relied on to keep.
+ *
+ * Returns: whether the write is ambiguous for the reason retries were spent,
+ * which is the only failure a verification read is allowed to resolve.
+ *
+ * Throws: **nothing**, for any value. A value carrying no such code is not a
+ * spent budget, so the caller rethrows it rather than spending a read on it.
+ */
+export declare function isRetryExhausted(error: Error): boolean;
+/**
+ * Read `record`'s row back to establish what an ambiguous write actually did,
+ * comparing the row's revision with the one this write carried. Every put
+ * stamps a fresh per-call `rev`, so the comparison works for inline and
+ * offloaded records alike.
+ *
+ * Accepts: `record` — the row this call wrote, carrying the `rev` it stamped.
+ * A record with no `rev` has nothing to compare and is reported `'not-landed'`
+ * without spending a read.
+ *
+ * Returns: `'landed'`, `'not-landed'` or `'unverified'`; see
+ * {@link WriteVerdict} for what each answer licenses the caller to do. Only the
+ * `rev` is read: an offloaded record's key ends in that same `rev`, so the row
+ * holding a different one never names this write's object, and a cleanup
+ * needs nothing more from it.
+ *
+ * Throws: nothing — a failed verification is `'unverified'`, which is an
+ * answer, not an error.
+ */
+export declare function verifyWriteLanded(context: StoreContext, record: RowKey & {
+    rev?: string;
+}): Promise<WriteVerdict>;
+export {};