@farukada/aws-langgraph-dynamodb-ts 1.0.0-rc.2 → 1.0.0

package/dist/shared/logging/redaction.js

@@ -1,316 +0,0 @@
-"use strict";
-/**
- * Hides how a logger and a value are redacted.
- *
- * A redacting logger walks every argument of every line, bounded in depth and
- * safe against cycles and hostile getters, and replaces the value of any key
- * that looks like a secret and any text that looks like one; the same walk
- * serves `redactSecrets` for a value a caller wants to log themselves.
- */
-Object.defineProperty(exports, "__esModule", { value: true });
-exports.redactSecrets = redactSecrets;
-exports.redactLogger = redactLogger;
-exports.walkObject = walkObject;
-const errors_1 = require("../errors/errors");
-const collaborators_1 = require("../validation/collaborators");
-const option_shape_1 = require("../validation/option-shape");
-const primitives_1 = require("../validation/primitives");
-const logger_1 = require("./logger");
-const secret_patterns_1 = require("./secret-patterns");
-/** Substituted for a log argument whose redaction itself failed (a throwing getter, say). */
-const UNREDACTABLE = '[UNREDACTABLE]';
-/**
- * Reject a list of value shapes this package could not apply.
- *
- * Accepts: `value` — the list as the caller gave it. `field` — what the error
- * names.
- *
- * Returns: nothing: the value is kept under its declared type, and this
- * checks it. An empty list is valid, and is how a caller turns value matching
- * off.
- *
- * Throws: `VALIDATION` naming `field` for a non-array or an entry that is
- * not a `RegExp`. {@link redactText} skips such an entry, which protects
- * nothing while the caller believes it does, so it is refused where it is
- * supplied instead.
- */
-function assertRegExpArray(value, field) {
-    if (!Array.isArray(value) || value.some((entry) => !(0, secret_patterns_1.isRegExp)(entry))) {
-        throw (0, errors_1.validationError)(`${field} must be an array of RegExp`, field);
-    }
-}
-/**
- * Recursively clone `value`, replacing any value at a secret-looking key with
- * `[REDACTED]` and any recognised secret *shape* inside a string — including an
- * error's `message`/`stack` text, which key-name matching cannot reach — with
- * the same marker. Cycles become `[Circular]`.
- *
- * An Error with no own enumerable properties whose text holds no secret is
- * passed through by reference, so its identity and stack trace survive; one
- * carrying own data (this library's error types all attach `code`/`context`
- * this way) or a secret in its text is rebuilt instead, with `name`/`message`/
- * `stack` redacted and every other own property recursed like a plain object.
- * `Date`/`RegExp` keep their identity rather than collapsing to `{}`,
- * `Set`/`Map` render as their contents, and binary views become a short label.
- *
- * Accepts: `value` — any log argument, including `undefined`, a primitive, a
- * typed `Error`, a class instance or a `Record`, so callers never cast. A
- * cyclic or shared graph is fine; each node is walked once. `patterns` and
- * `valuePatterns` — the key names and value shapes to redact, an array of
- * strings and an array of `RegExp` respectively; both default to this
- * package's own lists, and an empty one turns that rule off.
- *
- * Returns: a redacted clone. The input is never mutated — a logger that
- * scrubbed the caller's own object would corrupt the very data the application
- * is working with.
- *
- * Throws: `VALIDATION` naming `patterns` or `valuePatterns` for a list this
- * function could not apply, which is a mistake in the call itself and is
- * raised before anything is walked. Nothing after that: a value whose
- * redaction fails — a throwing getter, a structure deep enough to exhaust the
- * stack — is replaced whole by `[UNREDACTABLE]`, since a logger that throws
- * takes down the operation it was only observing. {@link redactLogger}
- * redacts one argument per call, so there a single hostile argument is what is
- * lost rather than the record around it.
- */
-function redactSecrets(value, patterns = secret_patterns_1.DEFAULT_SECRET_KEY_PATTERNS, valuePatterns = secret_patterns_1.DEFAULT_SECRET_VALUE_PATTERNS) {
-    (0, primitives_1.assertStringArray)(patterns, 'patterns');
-    assertRegExpArray(valuePatterns, 'valuePatterns');
-    // `walking` detects a cycle; `done` memoises a finished node. Both are
-    // needed and they answer different questions. A guard that only removed a
-    // node when its subtree finished is correct for cycles but re-walks every
-    // node reachable by more than one path, so a graph that merely *shares*
-    // structure — not even a cycle — costs exponential time: without `done`, a
-    // few dozen shared objects in a sub-kilobyte argument would block the event
-    // loop for minutes, and this is a public export reachable from caller code.
-    const walking = new WeakSet();
-    const done = new WeakMap();
-    const walk = (current) => {
-        if (typeof current === 'string')
-            return (0, secret_patterns_1.redactText)(current, valuePatterns);
-        if (current === null || typeof current !== 'object')
-            return current;
-        if (done.has(current))
-            return done.get(current);
-        if (walking.has(current))
-            return '[Circular]';
-        walking.add(current);
-        try {
-            const redacted = walkObject(current, { keyPatterns: patterns, valuePatterns, walk });
-            done.set(current, redacted);
-            return redacted;
-        }
-        finally {
-            walking.delete(current);
-        }
-    };
-    try {
-        return walk(value);
-    }
-    catch {
-        // Every failure of the walk yields the marker: a `RangeError` from nesting
-        // deeper than the stack holds, and equally a getter of the caller's own
-        // that throws. Telling the two apart served no caller. The value is being
-        // prepared for a log line, and the log line is typically written from a
-        // `catch`, so a throw here does not report the hostile value — it replaces
-        // the failure that was being reported with a `TypeError` about a getter.
-        return UNREDACTABLE;
-    }
-}
-/**
- * Reject redaction options that would silently fail to redact.
- *
- * A non-string in `extraKeys` reached `key.toLowerCase()` and raised a bare
- * `TypeError` at the first log call; a non-`RegExp` in `extraValuePatterns` is
- * skipped by {@link redactText} and would have protected nothing while the
- * caller believed it did. An `options` that is not an object at all carried no
- * rule to begin with, and was read as "none given", leaving the caller running
- * on a default it believed it had overridden. All three are refused here,
- * once, where they are configured.
- *
- * Accepts: `options` — as the caller gave it.
- *
- * Returns: nothing: the value is kept under its declared type, and this
- * checks it.
- *
- * Throws: `VALIDATION` naming `options`, `extraKeys` or `extraValuePatterns`.
- */
-function assertRedactionOptions(options) {
-    (0, option_shape_1.assertObjectShape)(options, 'options');
-    if (options.extraKeys !== undefined)
-        (0, primitives_1.assertStringArray)(options.extraKeys, 'extraKeys');
-    if (options.extraValuePatterns !== undefined) {
-        assertRegExpArray(options.extraValuePatterns, 'extraValuePatterns');
-    }
-}
-/**
- * Wrap a logger so object args are redacted before delegation.
- *
- * Accepts: `inner` — the logger to delegate to; it must carry all four
- * methods, because a missing one is a wiring mistake worth naming here rather
- * than at the first log line. `options.extraKeys` — further key names to
- * redact, matched like the defaults. `options.extraValuePatterns` — further
- * secret shapes; each must be a `RegExp`, and it is applied globally whether or
- * not it carries the `g` flag.
- *
- * Returns: a logger with the same four methods.
- *
- * Throws: `VALIDATION` naming `logger` or `logger.<method>` for a logger it
- * could not delegate to, and `options`, `extraKeys` or `extraValuePatterns`
- * for an option of the wrong type. Nothing at log time.
- *
- * Guarantees: the message string is passed through unchanged — never
- * interpolate a secret into it — and every other argument is redacted before
- * it reaches `inner`. Past the wrap call nothing escapes a log call: an
- * argument whose redaction fails is replaced by a fixed marker, and a failure
- * of `inner` itself is absorbed, because the
- * operation that wrote the line was only observing itself and is commonly
- * reporting some other failure already.
- */
-function redactLogger(inner, options = {}) {
-    (0, collaborators_1.assertMembers)(inner, collaborators_1.LOGGER_MEMBERS, 'logger');
-    assertRedactionOptions(options);
-    const patterns = options.extraKeys
-        ? [...secret_patterns_1.DEFAULT_SECRET_KEY_PATTERNS, ...options.extraKeys.map(secret_patterns_1.normaliseKey)]
-        : secret_patterns_1.DEFAULT_SECRET_KEY_PATTERNS;
-    const valuePatterns = options.extraValuePatterns
-        ? [...secret_patterns_1.DEFAULT_SECRET_VALUE_PATTERNS, ...options.extraValuePatterns]
-        : secret_patterns_1.DEFAULT_SECRET_VALUE_PATTERNS;
-    const deliver = (method) => (message, ...args) => (0, logger_1.absorbLoggerFailure)(() => inner[method](message, ...args.map((arg) => redactSecrets(arg, patterns, valuePatterns))));
-    return {
-        info: deliver('info'),
-        warn: deliver('warn'),
-        error: deliver('error'),
-        debug: deliver('debug'),
-    };
-}
-/** True when `value` is a Set, tested by tag so a cross-realm Set still matches. */
-function isSetValue(value) {
-    return Object.prototype.toString.call(value) === '[object Set]';
-}
-/** True when `value` is a Map, tested by tag so a cross-realm Map still matches. */
-function isMapValue(value) {
-    return Object.prototype.toString.call(value) === '[object Map]';
-}
-/**
- * True when `value` is an Error (or subclass) or a `DOMException` — which has
- * its own tag yet carries the same `name`/`message`/`stack` — tested by tag,
- * not `instanceof`, so a cross-realm error still matches.
- */
-function isErrorValue(value) {
-    const tag = Object.prototype.toString.call(value);
-    return tag === '[object Error]' || tag === '[object DOMException]';
-}
-/**
- * True for a value whose identity matters more than its own properties.
- * `Date` and `RegExp` have none, so recursing either would yield a bare `{}`.
- */
-function isOpaqueValue(value) {
-    const tag = Object.prototype.toString.call(value);
-    return tag === '[object Date]' || tag === '[object RegExp]';
-}
-/**
- * Rebuild entries into a plain object, redacting values at secret-looking
- * keys. Properties are defined, not assigned: `out['__proto__'] = …` would
- * replace the result's prototype (and drop the entry) instead of recording the
- * key as data.
- */
-function redactEntries(entries, keyPatterns, walk) {
-    const out = {};
-    for (const [key, value] of entries) {
-        Object.defineProperty(out, key, {
-            value: (0, secret_patterns_1.isSecretKey)(key, keyPatterns) ? secret_patterns_1.REDACTED : walk(value),
-            enumerable: true,
-            writable: true,
-            configurable: true,
-        });
-    }
-    return out;
-}
-/**
- * A Map's entries as an object. Keys are stringified so a non-string key is
- * still reported rather than dropped — including as `[object Object]` for a
- * plain-object key, which beats silently losing the entry — and each is
- * checked against the secret-key patterns exactly as a plain object's own
- * keys are.
- *
- * The annotation on `keyText` is `Redactable`'s own shape restated with an
- * explicit `toString`, which every one of its members already has; it changes
- * nothing about which key is what, only what `no-base-to-string` can see, so
- * it stops mistaking the deliberate `[object Object]` case above for a bug.
- */
-function redactMap(value, deps) {
-    const entries = [...value].map(([key, entry]) => {
-        const keyText = key;
-        return [String(keyText), entry];
-    });
-    return redactEntries(entries, deps.keyPatterns, deps.walk);
-}
-/**
- * Rebuild an Error as a plain object carrying its redacted text alongside its
- * redacted own properties. The one exception is an Error with no own
- * enumerable data, no `cause`, no aggregated `errors`, and no secret in its
- * text: it is returned by reference so its identity and stack trace survive,
- * which is what keeps a caught error useful in a log.
- *
- * `cause` and `AggregateError.errors` are copied explicitly because both are
- * defined *non-enumerable* per spec, so `Object.entries` never sees them.
- * Without this the whole chain vanished on every rebuild — and the rebuild
- * always fires for this library's own error types, since each attaches an
- * enumerable `code`/`context`. A redacted `RETRY_EXHAUSTED` would then no
- * longer say whether the underlying failure was a throttle, a validation error
- * or a network fault, which is the entire reason it carries a cause. A bare
- * Error *with* a cause is rebuilt for the same reason: passing it by reference
- * would hand the caller whatever secret the cause carries. Recursing through
- * `walk` redacts the chain too, and the cycle guard handles a cause that
- * points back at its own wrapper.
- */
-function redactError(current, entries, deps) {
-    const text = (0, secret_patterns_1.redactErrorText)(current, deps.valuePatterns);
-    const aggregated = current.errors;
-    const bare = entries.length === 0 && current.cause === undefined && aggregated === undefined;
-    if (bare && !text.changed)
-        return current;
-    const out = redactEntries(entries, deps.keyPatterns, deps.walk);
-    out.name = text.name;
-    out.message = text.message;
-    out.stack = text.stack;
-    if (current.cause !== undefined)
-        out.cause = deps.walk(current.cause);
-    if (Array.isArray(aggregated))
-        out.errors = deps.walk(aggregated);
-    return out;
-}
-/**
- * Dispatch one non-null object by its shape.
- *
- * Accepts: `current` — any object. `deps.walk` — how to recurse, which carries
- * the cycle and memo state this module deliberately does not own.
- *
- * Returns: the redacted form — arrays and plain objects recursed, binary views
- * collapsed to a label, `Date`/`RegExp` passed through by reference so they do
- * not become `{}`, `Set`/`Map` rendered as their contents, and an Error through
- * the error path, which preserves the non-enumerable text a plain walk cannot
- * see.
- *
- * Throws: whatever a property getter on the value throws. `redactSecrets`, the
- * only caller, catches it and returns `[UNREDACTABLE]` in place of the whole
- * value it was given, rather than raising a getter's error at a caller who
- * asked only for a copy it could log.
- */
-function walkObject(current, deps) {
-    if (Array.isArray(current))
-        return current.map(deps.walk);
-    if (ArrayBuffer.isView(current))
-        return (0, secret_patterns_1.binaryLabel)(current);
-    if (isOpaqueValue(current))
-        return current;
-    if (isSetValue(current))
-        return [...current].map(deps.walk);
-    if (isMapValue(current))
-        return redactMap(current, deps);
-    const entries = Object.entries(current);
-    if (isErrorValue(current))
-        return redactError(current, entries, deps);
-    return redactEntries(entries, deps.keyPatterns, deps.walk);
-}

package/dist/shared/options.js

@@ -1,11 +0,0 @@
-"use strict";
-/**
- * Hides which options every adapter shares.
- *
- * The table, the client, the ttl, the logger, the retry policy, the recency
- * index, the read concurrency, the codec options and per-call cancellation are
- * declared once here, so the checkpointer, the store and the history accept
- * the same keys with the same meaning, and an adapter-wide option is added in
- * one place. This module holds their types only; checking them is elsewhere.
- */
-Object.defineProperty(exports, "__esModule", { value: true });

package/dist/shared/validation/options.js

@@ -1,328 +0,0 @@
-"use strict";
-/**
- * Hides which adapter-wide construction options are accepted.
- *
- * The table name, the client choice, the ttl, the retry policy, the recency
- * index, the read concurrency, compression and S3 offload are checked here with
- * their bounds, before an adapter builds anything, so a misconfiguration
- * surfaces at construction rather than on the first call.
- */
-Object.defineProperty(exports, "__esModule", { value: true });
-exports.MAX_READ_CONCURRENCY = exports.MAX_RETRY_DELAY_MS = exports.MAX_RETRY_ATTEMPTS = exports.MAX_PAYLOAD_BUFFER_BYTES = void 0;
-exports.assertTableName = assertTableName;
-exports.assertClientChoice = assertClientChoice;
-exports.assertRetryBounds = assertRetryBounds;
-exports.assertRetryPolicy = assertRetryPolicy;
-exports.assertBaseAdapterOptions = assertBaseAdapterOptions;
-exports.assertCompression = assertCompression;
-exports.assertS3 = assertS3;
-const codec_1 = require("../codec/codec");
-const config_1 = require("../codec/s3/config");
-const recency_index_1 = require("../dynamodb/recency-index");
-const errors_1 = require("../errors/errors");
-const option_shape_1 = require("./option-shape");
-const primitives_1 = require("./primitives");
-const ttl_1 = require("./ttl");
-/** DynamoDB's table-name rule: 3–255 characters from `[A-Za-z0-9_.-]`. */
-const TABLE_NAME_PATTERN = /^[A-Za-z0-9_.-]{3,255}$/;
-/**
- * Largest `s3.maxDownloadBytes`/`compression.maxDecompressedBytes` an adapter
- * accepts (512 MiB): both hold one buffer fully resident while it is read or
- * inflated, and `BaseAdapterOptions.readConcurrency`'s doc multiplies the two
- * together into the package's memory ceiling, so an unbounded value here is an
- * unbounded process, not just an unbounded object.
- */
-exports.MAX_PAYLOAD_BUFFER_BYTES = 512 * 1024 * 1024;
-/** Largest `retry.maxAttempts` an adapter accepts; beyond it a retry loop is a hang, not a policy. */
-exports.MAX_RETRY_ATTEMPTS = 100;
-/**
- * Largest `retry.baseDelayMs`/`retry.maxDelayMs` an adapter accepts (one
- * minute): combined with {@link MAX_RETRY_ATTEMPTS}, an unbounded per-attempt
- * delay turns a bounded attempt count back into an effectively unbounded wait.
- */
-exports.MAX_RETRY_DELAY_MS = 60_000;
-/**
- * Largest `readConcurrency` an adapter accepts: it is a multiplier on the
- * memory-ceiling formula (see the option's own doc) and on requests fired at
- * once, so an unbounded value turns a typo into an out-of-memory crash or a
- * request storm against the table/bucket.
- */
-exports.MAX_READ_CONCURRENCY = 128;
-const RETRY_KEYS = (0, option_shape_1.allKeysOf)({
-    maxAttempts: 'maxAttempts',
-    baseDelayMs: 'baseDelayMs',
-    maxDelayMs: 'maxDelayMs',
-});
-/**
- * Validate a table name against DynamoDB's own naming rule.
- *
- * Accepts: `tableName` — as the caller gave it.
- *
- * Returns: nothing: the value is kept under its declared type, and this
- * checks it.
- *
- * Throws: `VALIDATION` naming `tableName`.
- */
-function assertTableName(tableName) {
-    if (typeof tableName !== 'string' || !TABLE_NAME_PATTERN.test(tableName)) {
-        throw (0, errors_1.validationError)('tableName must be 3-255 characters from [A-Za-z0-9_.-], as DynamoDB requires', 'tableName');
-    }
-}
-/**
- * Reject a client choice that names two ways of getting one, or a
- * `clientConfig` that is not an object.
- *
- * Accepts: the three client options, from an adapter or from the factory that
- * defaults them. An injected `client` is used as-is, so a `clientConfig` or
- * `createClient` given alongside it would be silently ignored — including a
- * `region` the caller believes is in effect. `clientConfig`, when given, must
- * be an object that is neither `null` nor an array; what it holds is the AWS
- * SDK's to judge.
- *
- * Returns: nothing: the value is kept under its declared type, and this
- * checks it.
- *
- * Throws: `VALIDATION` naming `client` for both ways at once, then
- * `clientConfig` for one that is not an object.
- */
-function assertClientChoice(options) {
-    if (options.client &&
-        (options.clientConfig !== undefined || options.createClient !== undefined)) {
-        throw (0, errors_1.validationError)('provide either `client` or `clientConfig`/`createClient`, not both: an injected client ' +
-            'is used as-is and the configuration would be silently ignored', 'client');
-    }
-    // The shape only, never the keys, and on purpose: they are the AWS SDK's
-    // `DynamoDBClientConfig`, which gains keys between SDK releases, and an
-    // application may install a newer SDK than the one this package was
-    // compiled against, so a key list compiled in here would refuse valid
-    // configuration. The SDK reads each key itself.
-    if (options.clientConfig !== undefined)
-        (0, option_shape_1.assertObjectShape)(options.clientConfig, 'clientConfig');
-}
-/**
- * The three numeric bounds every retry policy shares, regardless of which
- * other keys the caller's own type allows beyond them. Split out so a caller
- * with a wider surface than {@link RetryPolicy} (`backfillRecencyIndex`'s
- * `RetryOptions`, which also exposes `onRetry`, `isRetryable` and friends)
- * can reuse the identical bounds without going through {@link
- * assertRetryPolicy}'s narrower `assertShape`, which would refuse those
- * extra keys outright.
- *
- * Accepts: `policy` — its `maxAttempts`, `baseDelayMs` and `maxDelayMs`, each
- * optional.
- *
- * Returns: nothing: the value is kept under its declared type, and this
- * checks it.
- *
- * Throws: `VALIDATION` naming `retry.maxAttempts`, `retry.baseDelayMs` or
- * `retry.maxDelayMs`.
- */
-function assertRetryBounds(policy) {
-    if (policy.maxAttempts !== undefined) {
-        (0, primitives_1.assertInteger)(policy.maxAttempts, 'retry.maxAttempts', { min: 1, max: exports.MAX_RETRY_ATTEMPTS });
-    }
-    if (policy.baseDelayMs !== undefined) {
-        (0, primitives_1.assertInteger)(policy.baseDelayMs, 'retry.baseDelayMs', { min: 1, max: exports.MAX_RETRY_DELAY_MS });
-    }
-    if (policy.maxDelayMs !== undefined) {
-        (0, primitives_1.assertInteger)(policy.maxDelayMs, 'retry.maxDelayMs', {
-            min: policy.baseDelayMs ?? 1,
-            max: exports.MAX_RETRY_DELAY_MS,
-        });
-    }
-}
-/**
- * Validate a retry policy: shape, then each bound.
- *
- * Accepts: `policy` — must be an object naming only `maxAttempts`,
- * `baseDelayMs` and `maxDelayMs`; each, if given, is a bounded integer.
- *
- * Returns: nothing: the value is kept under its declared type, and this
- * checks it.
- *
- * Throws: `VALIDATION` naming `retry` or `retry.<key>`.
- */
-function assertRetryPolicy(policy) {
-    (0, option_shape_1.assertShape)(policy, RETRY_KEYS, 'retry');
-    assertRetryBounds(policy);
-}
-/** The recency index: a named GSI, and the partition count rows are sharded across. */
-function assertRecencyIndex(options) {
-    if (options.indexShards !== undefined) {
-        (0, primitives_1.assertInteger)(options.indexShards, 'indexShards', { min: 1, max: recency_index_1.MAX_INDEX_SHARDS });
-    }
-    if (options.indexName !== undefined)
-        (0, primitives_1.assertNonEmptyString)(options.indexName, 'indexName');
-}
-/**
- * Validate the options every adapter shares, at construction.
- *
- * Accepts: `options` — must be an object. `tableName` is required; every other
- * option is optional, and `undefined` means "not configured" for each. A
- * nested `ttl`, `retry`, `compression` or `s3` must be an object whose keys
- * this package reads: a misspelt key is rejected rather than ignored, because
- * the caller would otherwise run on a default they believe they overrode.
- * `clientConfig` and `s3.clientConfig` must be objects, but their keys belong
- * to the AWS SDK and are not checked. Keys of `options` itself are not checked
- * here — the adapter types differ and this validator sees only the shared ones.
- *
- * Returns: nothing: the value is kept under its declared type, and this
- * checks it.
- *
- * Throws: `VALIDATION` whose `context.field` names the offending option,
- * dotted for a nested one (`s3.bucketName`). The order is `tableName`, client
- * choice, `ttl`, `retry`, `compression`, `s3`, `readConcurrency`, then the
- * index options.
- *
- * Guarantees: a misconfiguration surfaces at construction, naming the option,
- * rather than as a raw AWS error on the first request.
- */
-function assertBaseAdapterOptions(options) {
-    if (typeof options !== 'object' || options === null) {
-        throw (0, errors_1.validationError)('options must be an object naming at least a tableName', 'options');
-    }
-    assertTableName(options.tableName);
-    assertClientChoice(options);
-    if (options.ttl !== undefined)
-        (0, ttl_1.resolveTtlSeconds)(options.ttl);
-    if (options.retry !== undefined)
-        assertRetryPolicy(options.retry);
-    if (options.compression !== undefined)
-        assertCompression(options.compression);
-    if (options.s3 !== undefined)
-        assertS3(options.s3);
-    if (options.readConcurrency !== undefined) {
-        (0, primitives_1.assertInteger)(options.readConcurrency, 'readConcurrency', {
-            min: 1,
-            max: exports.MAX_READ_CONCURRENCY,
-        });
-    }
-    assertRecencyIndex(options);
-}
-/** Server-side encryption algorithms S3 accepts for `PutObject`. */
-const SSE_ALGORITHMS = ['AES256', 'aws:kms', 'aws:kms:dsse'];
-const COMPRESSION_KEYS = (0, option_shape_1.allKeysOf)({
-    enabled: 'enabled',
-    level: 'level',
-    minSizeBytes: 'minSizeBytes',
-    maxDecompressedBytes: 'maxDecompressedBytes',
-});
-const S3_KEYS = (0, option_shape_1.allKeysOf)({
-    bucketName: 'bucketName',
-    keyPrefix: 'keyPrefix',
-    thresholdBytes: 'thresholdBytes',
-    serverSideEncryption: 'serverSideEncryption',
-    sseKmsKeyId: 'sseKmsKeyId',
-    maxDownloadBytes: 'maxDownloadBytes',
-    clientConfig: 'clientConfig',
-    createS3Client: 'createS3Client',
-});
-/**
- * Validate a `compression` config, honoring its allowed key set.
- *
- * Accepts: `config` — an object naming only {@link CompressionConfig}'s keys.
- *
- * Returns: nothing: the value is kept under its declared type, and this
- * checks it.
- *
- * Throws: `VALIDATION` naming the offending field, dotted under
- * `compression`.
- */
-function assertCompression(config) {
-    (0, option_shape_1.assertShape)(config, COMPRESSION_KEYS, 'compression');
-    if (typeof config.enabled !== 'boolean') {
-        throw (0, errors_1.validationError)('compression.enabled must be a boolean', 'compression.enabled');
-    }
-    if (config.level !== undefined) {
-        (0, primitives_1.assertInteger)(config.level, 'compression.level', { min: 0, max: 9 });
-    }
-    if (config.minSizeBytes !== undefined) {
-        // Bounded by MAX_PAYLOAD_BUFFER_BYTES, not by MAX_INLINE_PAYLOAD_BYTES as
-        // `s3.thresholdBytes` is, because the two differ in kind. `encodePayload`
-        // compresses first and only then decides inline versus offload, on the
-        // compressed size — so `minSizeBytes` above the inline limit, paired with
-        // `s3`, is a meaningful configuration: compress only what will be offloaded
-        // anyway. A `thresholdBytes` above the inline limit is not: a payload
-        // between the two is too large to store inline and too small to offload,
-        // so its write fails. `minSizeBytes` only decides whether gzip runs; the
-        // only value it can never act on is one larger than any payload this
-        // package can read back.
-        (0, primitives_1.assertInteger)(config.minSizeBytes, 'compression.minSizeBytes', {
-            min: 0,
-            max: exports.MAX_PAYLOAD_BUFFER_BYTES,
-        });
-    }
-    if (config.maxDecompressedBytes !== undefined) {
-        (0, primitives_1.assertInteger)(config.maxDecompressedBytes, 'compression.maxDecompressedBytes', {
-            min: 1,
-            max: exports.MAX_PAYLOAD_BUFFER_BYTES,
-        });
-    }
-}
-/**
- * Validate the two `s3` options `PutObject` receives as they were given.
- *
- * Accepts: `config.serverSideEncryption` — absent, or an algorithm S3 accepts.
- * `config.sseKmsKeyId` — absent, or a non-empty string. Only its type is
- * checked; whether it names a real key, by id or by ARN, is for S3 to answer.
- *
- * Returns: nothing: the value is kept under its declared type, and this
- * checks it.
- *
- * Throws: `VALIDATION` naming `s3.serverSideEncryption` or
- * `s3.sseKmsKeyId`. Unchecked, a truthy key id that is not a string was
- * handed to `PutObject` at the first offload, and a falsy one (`''`, `null`,
- * `0`) was dropped, uploading without the key the caller named.
- */
-function assertS3Encryption(config) {
-    if (config.serverSideEncryption !== undefined &&
-        !SSE_ALGORITHMS.includes(config.serverSideEncryption)) {
-        throw (0, errors_1.validationError)(`s3.serverSideEncryption must be one of ${SSE_ALGORITHMS.join(', ')}`, 's3.serverSideEncryption');
-    }
-    if (config.sseKmsKeyId !== undefined) {
-        (0, primitives_1.assertNonEmptyString)(config.sseKmsKeyId, 's3.sseKmsKeyId');
-    }
-}
-/**
- * Validate an `s3` offload config, honoring its allowed key set.
- *
- * Accepts: `config` — an object naming only {@link S3OffloadConfig}'s keys.
- * `config.clientConfig`, when given, must be an object that is neither `null`
- * nor an array; its own keys are not checked. `config.createS3Client`, when
- * given, must be a function.
- *
- * Returns: nothing: the value is kept under its declared type, and this
- * checks it.
- *
- * Throws: `VALIDATION` naming the offending field, dotted under `s3`.
- */
-function assertS3(config) {
-    (0, option_shape_1.assertShape)(config, S3_KEYS, 's3');
-    (0, primitives_1.assertNonEmptyString)(config.bucketName, 's3.bucketName');
-    // The shape only, never the keys: they are the AWS SDK's `S3ClientConfig`,
-    // which gains keys between SDK releases, and an application may install a
-    // newer SDK than the one this package was compiled against, so a key list
-    // compiled in here would refuse valid configuration.
-    if (config.clientConfig !== undefined)
-        (0, option_shape_1.assertObjectShape)(config.clientConfig, 's3.clientConfig');
-    if (config.thresholdBytes !== undefined) {
-        (0, primitives_1.assertInteger)(config.thresholdBytes, 's3.thresholdBytes', {
-            min: 1,
-            max: codec_1.MAX_INLINE_PAYLOAD_BYTES,
-        });
-    }
-    if (config.keyPrefix !== undefined)
-        (0, config_1.assertScopedKeyPrefix)(config.keyPrefix);
-    if (config.maxDownloadBytes !== undefined) {
-        (0, primitives_1.assertInteger)(config.maxDownloadBytes, 's3.maxDownloadBytes', {
-            min: 1,
-            max: exports.MAX_PAYLOAD_BUFFER_BYTES,
-        });
-    }
-    assertS3Encryption(config);
-    // Called to build the S3 client at the first offload, where a value that is
-    // not a function threw a bare `TypeError`.
-    if (config.createS3Client !== undefined && typeof config.createS3Client !== 'function') {
-        throw (0, errors_1.validationError)('s3.createS3Client must be a function', 's3.createS3Client');
-    }
-}