@hot-updater/aws 1.0.0-rc.1 → 1.0.0-rc.16

package/dist/iac/index.cjs

@@ -6,7 +6,7 @@ var __getOwnPropDesc = Object.getOwnPropertyDescriptor;
 var __getOwnPropNames = Object.getOwnPropertyNames;
 var __getProtoOf = Object.getPrototypeOf;
 var __hasOwnProp = Object.prototype.hasOwnProperty;
-var __commonJSMin = (cb, mod) => () => (mod || cb((mod = { exports: {} }).exports, mod), mod.exports);
+var __commonJSMin = (cb, mod) => () => (mod || (cb((mod = { exports: {} }).exports, mod), cb = null), mod.exports);
 var __copyProps = (to, from, except, desc) => {
 	if (from && typeof from === "object" || typeof from === "function") for (var keys = __getOwnPropNames(from), i = 0, n = keys.length, key; i < n; i++) {
 		key = keys[i];
@@ -17,25 +17,25 @@ var __copyProps = (to, from, except, desc) => {
 	}
 	return to;
 };
-var __toESM = (mod, isNodeMode, target) => (target = mod != null ? __create(__getProtoOf(mod)) : {}, __copyProps(isNodeMode || !mod || !mod.__esModule ? __defProp(target, "default", {
+var __toESM = (mod, isNodeMode, target) => (target = mod != null ? __create(__getProtoOf(mod)) : {}, __copyProps(isNodeMode || !mod || !mod.__esModule || !__hasOwnProp.call(mod, "default") ? __defProp(target, "default", {
 	value: mod,
 	enumerable: true
 }) : target, mod));
 //#endregion
 let _hot_updater_cli_tools = require("@hot-updater/cli-tools");
-let _hot_updater_server = require("@hot-updater/server");
+let _hot_updater_server_db = require("@hot-updater/server/db");
 let node_url = require("node:url");
 let node_child_process = require("node:child_process");
 let node_string_decoder = require("node:string_decoder");
 let node_util = require("node:util");
 let node_process = require("node:process");
-node_process = __toESM(node_process);
+node_process = __toESM(node_process, 1);
 let node_tty = require("node:tty");
-node_tty = __toESM(node_tty);
+node_tty = __toESM(node_tty, 1);
 let node_path = require("node:path");
-node_path = __toESM(node_path);
+node_path = __toESM(node_path, 1);
 let path = require("path");
-path = __toESM(path);
+path = __toESM(path, 1);
 let node_timers_promises = require("node:timers/promises");
 let node_os = require("node:os");
 let node_events = require("node:events");
@@ -44,20 +44,21 @@ let node_fs = require("node:fs");
 let node_stream_promises = require("node:stream/promises");
 let node_stream = require("node:stream");
 let node_buffer = require("node:buffer");
-let _aws_sdk_client_cloudfront = require("@aws-sdk/client-cloudfront");
 let _aws_sdk_client_dynamodb = require("@aws-sdk/client-dynamodb");
+let _hot_updater_server_database = require("@hot-updater/server/database");
+let _aws_sdk_client_cloudfront = require("@aws-sdk/client-cloudfront");
 let _aws_sdk_lib_dynamodb = require("@aws-sdk/lib-dynamodb");
-let _hot_updater_plugin_core = require("@hot-updater/plugin-core");
-let _hot_updater_plugin_core_internal = require("@hot-updater/plugin-core/internal");
+let _hot_updater_server_plugins_api_keys = require("@hot-updater/server/plugins/api-keys");
+let _hot_updater_server_plugins_insights = require("@hot-updater/server/plugins/insights");
 let _aws_sdk_credential_providers = require("@aws-sdk/credential-providers");
 let _aws_sdk_client_lambda = require("@aws-sdk/client-lambda");
-let crypto = require("crypto");
-crypto = __toESM(crypto);
+let crypto$1 = require("crypto");
+crypto$1 = __toESM(crypto$1, 1);
 let node_crypto = require("node:crypto");
 let _aws_sdk_client_iam = require("@aws-sdk/client-iam");
 let _aws_sdk_client_sts = require("@aws-sdk/client-sts");
 let fs_promises = require("fs/promises");
-fs_promises = __toESM(fs_promises);
+fs_promises = __toESM(fs_promises, 1);
 let _aws_sdk_client_s3 = require("@aws-sdk/client-s3");
 let _aws_sdk_client_ssm = require("@aws-sdk/client-ssm");
 //#region ../../node_modules/.pnpm/is-plain-obj@4.1.0/node_modules/is-plain-obj/index.js
@@ -158,7 +159,8 @@ const parseTemplate = ({ templates, expressions, tokens, index, template }) => {
 	const newTokens = concatTokens(tokens, nextTokens, leadingWhitespaces);
 	if (index === expressions.length) return newTokens;
 	const expression = expressions[index];
-	return concatTokens(newTokens, Array.isArray(expression) ? expression.map((expression) => parseExpression(expression)) : [parseExpression(expression)], trailingWhitespaces);
+	const expressionTokens = Array.isArray(expression) ? expression.map((expression) => parseExpression(expression)) : [parseExpression(expression)];
+	return concatTokens(newTokens, expressionTokens, trailingWhitespaces);
 };
 const splitByWhitespaces = (template, rawTemplate) => {
 	if (rawTemplate.length === 0) return {
@@ -191,7 +193,7 @@ const splitByWhitespaces = (template, rawTemplate) => {
 		trailingWhitespaces
 	};
 };
-const DELIMITERS = new Set([
+const DELIMITERS = /* @__PURE__ */ new Set([
 	" ",
 	"	",
 	"\r",
@@ -243,7 +245,8 @@ const normalizeFdSpecificOptions = (options) => {
 };
 const normalizeFdSpecificOption = (options, optionName) => {
 	const optionBaseArray = Array.from({ length: getStdioLength(options) + 1 });
-	return addDefaultValue$1(normalizeFdSpecificValue(options[optionName], optionBaseArray, optionName), optionName);
+	const optionArray = normalizeFdSpecificValue(options[optionName], optionBaseArray, optionName);
+	return addDefaultValue$1(optionArray, optionName);
 };
 const getStdioLength = ({ stdio }) => Array.isArray(stdio) ? Math.max(stdio.length, STANDARD_STREAMS_ALIASES.length) : STANDARD_STREAMS_ALIASES.length;
 const normalizeFdSpecificValue = (optionValue, optionArray, optionName) => isPlainObject(optionValue) ? normalizeOptionObject(optionValue, optionArray, optionName) : optionArray.fill(optionValue);
@@ -276,7 +279,7 @@ const addDefaultValue$1 = (optionArray, optionName) => optionArray.map((optionVa
 const DEFAULT_OPTIONS = {
 	lines: false,
 	buffer: true,
-	maxBuffer: 1e3 * 1e3 * 100,
+	maxBuffer: 1e8,
 	verbose: (0, node_util.debuglog)("execa").enabled ? "full" : "none",
 	stripFinalNewline: true
 };
@@ -324,7 +327,7 @@ const escapeControlCharacter = (character) => {
 };
 const getSpecialCharRegExp = () => {
 	try {
-		return /* @__PURE__ */ new RegExp("\\p{Separator}|\\p{Other}", "gu");
+		return new RegExp("\\p{Separator}|\\p{Other}", "gu");
 	} catch {
 		return /[\s\u0000-\u001F\u007F-\u009F\u00AD]/g;
 	}
@@ -744,11 +747,13 @@ const appendNewline = (printedLine) => printedLine.endsWith("\n") ? printedLine
 //#endregion
 //#region ../../node_modules/.pnpm/execa@9.5.2/node_modules/execa/lib/verbose/log.js
 const verboseLog = ({ type, verboseMessage, fdNumber, verboseInfo, result }) => {
-	const finalLines = applyVerboseOnLines(getPrintedLines(verboseMessage, getVerboseObject({
+	const verboseObject = getVerboseObject({
 		type,
 		result,
 		verboseInfo
-	})), verboseInfo, fdNumber);
+	});
+	const printedLines = getPrintedLines(verboseMessage, verboseObject);
+	const finalLines = applyVerboseOnLines(printedLines, verboseInfo, fdNumber);
 	if (finalLines !== "") console.warn(finalLines.slice(0, -1));
 };
 const getVerboseObject = ({ type, result, verboseInfo: { escapedCommand, commandId, rawOptions: { piped = false, ...options } } }) => ({
@@ -771,7 +776,8 @@ const getPrintedLine = (verboseObject) => {
 	};
 };
 const serializeVerboseMessage = (message) => {
-	return escapeLines(typeof message === "string" ? message : (0, node_util.inspect)(message)).replaceAll("	", " ".repeat(TAB_SIZE));
+	const messageString = typeof message === "string" ? message : (0, node_util.inspect)(message);
+	return escapeLines(messageString).replaceAll("	", " ".repeat(TAB_SIZE));
 };
 const TAB_SIZE = 2;
 //#endregion
@@ -816,7 +822,8 @@ const getDurationMs = (startTime) => Number(node_process.hrtime.bigint() - start
 const handleCommand = (filePath, rawArguments, rawOptions) => {
 	const startTime = getStartTime();
 	const { command, escapedCommand } = joinCommand(filePath, rawArguments);
-	const verboseInfo = getVerboseInfo(normalizeFdSpecificOption(rawOptions, "verbose"), escapedCommand, { ...rawOptions });
+	const verbose = normalizeFdSpecificOption(rawOptions, "verbose");
+	const verboseInfo = getVerboseInfo(verbose, escapedCommand, { ...rawOptions });
 	logCommand(escapedCommand, verboseInfo);
 	return {
 		command,
@@ -937,7 +944,8 @@ var require_which = /* @__PURE__ */ __commonJSMin(((exports, module) => {
 	const getNotFoundError = (cmd) => Object.assign(/* @__PURE__ */ new Error(`not found: ${cmd}`), { code: "ENOENT" });
 	const getPathInfo = (cmd, opt) => {
 		const colon = opt.colon || COLON;
-		const pathEnv = cmd.match(/\//) || isWindows && cmd.match(/\\/) ? [""] : [...isWindows ? [process.cwd()] : [], ...(opt.path || process.env.PATH || "").split(colon)];
+		const pathEnv = cmd.match(/\//) || isWindows && cmd.match(/\\/) ? [""] : [...isWindows ? [process.cwd()] : [], ...(opt.path || process.env.PATH || 
+		/* istanbul ignore next: very unusual */ "").split(colon)];
 		const pathExtExe = isWindows ? opt.pathExt || process.env.PATHEXT || ".EXE;.CMD;.BAT;.COM" : "";
 		const pathExt = isWindows ? pathExtExe.split(colon) : [""];
 		if (isWindows) {
@@ -962,14 +970,17 @@ var require_which = /* @__PURE__ */ __commonJSMin(((exports, module) => {
 			const ppRaw = pathEnv[i];
 			const pathPart = /^".*"$/.test(ppRaw) ? ppRaw.slice(1, -1) : ppRaw;
 			const pCmd = path$9.join(pathPart, cmd);
-			resolve(subStep(!pathPart && /^\.[\\\/]/.test(cmd) ? cmd.slice(0, 2) + pCmd : pCmd, i, 0));
+			const p = !pathPart && /^\.[\\\/]/.test(cmd) ? cmd.slice(0, 2) + pCmd : pCmd;
+			resolve(subStep(p, i, 0));
 		});
 		const subStep = (p, i, ii) => new Promise((resolve, reject) => {
 			if (ii === pathExt.length) return resolve(step(i + 1));
 			const ext = pathExt[ii];
 			isexe(p + ext, { pathExt: pathExtExe }, (er, is) => {
-				if (!er && is) if (opt.all) found.push(p + ext);
-				else return resolve(p + ext);
+				if (!er && is) {
+					if (opt.all) found.push(p + ext);
+					else return resolve(p + ext);
+				}
 				return resolve(subStep(p, i, ii + 1));
 			});
 		});
@@ -987,8 +998,10 @@ var require_which = /* @__PURE__ */ __commonJSMin(((exports, module) => {
 			for (let j = 0; j < pathExt.length; j++) {
 				const cur = p + pathExt[j];
 				try {
-					if (isexe.sync(cur, { pathExt: pathExtExe })) if (opt.all) found.push(cur);
-					else return cur;
+					if (isexe.sync(cur, { pathExt: pathExtExe })) {
+						if (opt.all) found.push(cur);
+						else return cur;
+					}
 				} catch (ex) {}
 			}
 		}
@@ -1679,7 +1692,7 @@ const normalizeForceKillAfterDelay = (forceKillAfterDelay) => {
 	if (!Number.isFinite(forceKillAfterDelay) || forceKillAfterDelay < 0) throw new TypeError(`Expected the \`forceKillAfterDelay\` option to be a non-negative integer, got \`${forceKillAfterDelay}\` (${typeof forceKillAfterDelay})`);
 	return forceKillAfterDelay;
 };
-const DEFAULT_FORCE_KILL_TIMEOUT = 1e3 * 5;
+const DEFAULT_FORCE_KILL_TIMEOUT = 5e3;
 const subprocessKill = ({ kill, options: { forceKillAfterDelay, killSignal }, onInternalError, context, controller }, signalOrError, errorArgument) => {
 	const { signal, error } = parseKillArguments(signalOrError, errorArgument, killSignal);
 	emitKillError(error, onInternalError);
@@ -1781,7 +1794,7 @@ const handleSerializationError = ({ error, methodName, isSubprocess, message })
 	if (isSerializationError(error)) throw new Error(`${getMethodName(methodName, isSubprocess)}'s argument type is invalid: the message cannot be serialized: ${String(message)}.`, { cause: error });
 };
 const isSerializationError = ({ code, message }) => SERIALIZATION_ERROR_CODES.has(code) || SERIALIZATION_ERROR_MESSAGES.some((serializationErrorMessage) => message.includes(serializationErrorMessage));
-const SERIALIZATION_ERROR_CODES = new Set(["ERR_MISSING_ARGS", "ERR_INVALID_ARG_TYPE"]);
+const SERIALIZATION_ERROR_CODES = /* @__PURE__ */ new Set(["ERR_MISSING_ARGS", "ERR_INVALID_ARG_TYPE"]);
 const SERIALIZATION_ERROR_MESSAGES = [
 	"could not be cloned",
 	"circular structure",
@@ -1991,7 +2004,8 @@ const isConnected = (anyProcess) => {
 //#region ../../node_modules/.pnpm/execa@9.5.2/node_modules/execa/lib/ipc/strict.js
 const handleSendStrict = ({ anyProcess, channel, isSubprocess, message, strict }) => {
 	if (!strict) return message;
-	const hasListeners = hasMessageListeners(anyProcess, getIpcEmitter(anyProcess, channel, isSubprocess));
+	const ipcEmitter = getIpcEmitter(anyProcess, channel, isSubprocess);
+	const hasListeners = hasMessageListeners(anyProcess, ipcEmitter);
 	return {
 		id: count++,
 		type: REQUEST_TYPE,
@@ -2223,7 +2237,8 @@ const throwOnGracefulCancel = ({ subprocess, cancelSignal, gracefulCancel, force
 })] : [];
 const sendOnAbort = async ({ subprocess, cancelSignal, forceKillAfterDelay, context, controller: { signal } }) => {
 	await onAbortedSignal(cancelSignal, signal);
-	await sendAbort(subprocess, getReason(cancelSignal));
+	const reason = getReason(cancelSignal);
+	await sendAbort(subprocess, reason);
 	killOnTimeout({
 		kill: subprocess.kill,
 		forceKillAfterDelay,
@@ -2335,8 +2350,8 @@ Please rename it to ${serializeEncoding(correctEncoding)}.`);
 	throw new TypeError(`Invalid option \`encoding: ${serializeEncoding(encoding)}\`.
 Please rename it to one of: ${correctEncodings}.`);
 };
-const TEXT_ENCODINGS = new Set(["utf8", "utf16le"]);
-const BINARY_ENCODINGS = new Set([
+const TEXT_ENCODINGS = /* @__PURE__ */ new Set(["utf8", "utf16le"]);
+const BINARY_ENCODINGS = /* @__PURE__ */ new Set([
 	"buffer",
 	"hex",
 	"base64",
@@ -2344,7 +2359,7 @@ const BINARY_ENCODINGS = new Set([
 	"latin1",
 	"ascii"
 ]);
-const ENCODINGS = new Set([...TEXT_ENCODINGS, ...BINARY_ENCODINGS]);
+const ENCODINGS = /* @__PURE__ */ new Set([...TEXT_ENCODINGS, ...BINARY_ENCODINGS]);
 const getCorrectEncoding = (encoding) => {
 	if (encoding === null) return "buffer";
 	if (typeof encoding !== "string") return;
@@ -2391,7 +2406,8 @@ const normalizeOptions = (filePath, rawArguments, rawOptions) => {
 	rawOptions.cwd = normalizeCwd(rawOptions.cwd);
 	const [processedFile, processedArguments, processedOptions] = handleNodeOption(filePath, rawArguments, rawOptions);
 	const { command: file, args: commandArguments, options: initialOptions } = import_cross_spawn.default._parse(processedFile, processedArguments, processedOptions);
-	const options = addDefaultOptions(normalizeFdSpecificOptions(initialOptions));
+	const fdOptions = normalizeFdSpecificOptions(initialOptions);
+	const options = addDefaultOptions(fdOptions);
 	validateTimeout(options);
 	validateEncoding(options);
 	validateIpcInputOption(options);
@@ -2592,14 +2608,17 @@ const getStreamContents$1 = async (stream, { init, convertChunk, getSize, trunca
 	const state = init();
 	state.length = 0;
 	try {
-		for await (const chunk of asyncIterable) appendChunk({
-			convertedChunk: convertChunk[getChunkType(chunk)](chunk, state),
-			state,
-			getSize,
-			truncateChunk,
-			addChunk,
-			maxBuffer
-		});
+		for await (const chunk of asyncIterable) {
+			const convertedChunk = convertChunk[getChunkType(chunk)](chunk, state);
+			appendChunk({
+				convertedChunk,
+				state,
+				getSize,
+				truncateChunk,
+				addChunk,
+				maxBuffer
+			});
+		}
 		appendFinalChunk({
 			state,
 			convertChunk,
@@ -2885,7 +2904,8 @@ const getErrorPrefix = ({ originalError, timedOut, timeout, isMaxBuffer, maxBuff
 const getForcefulSuffix = (isForcefullyTerminated, forceKillAfterDelay) => isForcefullyTerminated ? ` and was forcefully terminated after ${forceKillAfterDelay} milliseconds` : "";
 const getOriginalMessage = (originalError, cwd) => {
 	if (originalError instanceof DiscardedError) return;
-	const escapedOriginalMessage = escapeLines(fixCwdError(isExecaError(originalError) ? originalError.originalMessage : String(originalError?.message ?? originalError), cwd));
+	const originalMessage = isExecaError(originalError) ? originalError.originalMessage : String(originalError?.message ?? originalError);
+	const escapedOriginalMessage = escapeLines(fixCwdError(originalMessage, cwd));
 	return escapedOriginalMessage === "" ? void 0 : escapedOriginalMessage;
 };
 const serializeIpcMessage = (ipcMessage) => typeof ipcMessage === "string" ? ipcMessage : (0, node_util.inspect)(ipcMessage);
@@ -3096,26 +3116,28 @@ function prettyMilliseconds(milliseconds, options) {
 		add(Number(parsed.hours), "hour", "h");
 	}
 	add(Number(parsed.minutes), "minute", "m");
-	if (!options.hideSeconds) if (options.separateMilliseconds || options.formatSubMilliseconds || !options.colonNotation && milliseconds < 1e3 && !options.subSecondsAsDecimals) {
-		const seconds = Number(parsed.seconds);
-		const milliseconds = Number(parsed.milliseconds);
-		const microseconds = Number(parsed.microseconds);
-		const nanoseconds = Number(parsed.nanoseconds);
-		add(seconds, "second", "s");
-		if (options.formatSubMilliseconds) {
-			add(milliseconds, "millisecond", "ms");
-			add(microseconds, "microsecond", "µs");
-			add(nanoseconds, "nanosecond", "ns");
+	if (!options.hideSeconds) {
+		if (options.separateMilliseconds || options.formatSubMilliseconds || !options.colonNotation && milliseconds < 1e3 && !options.subSecondsAsDecimals) {
+			const seconds = Number(parsed.seconds);
+			const milliseconds = Number(parsed.milliseconds);
+			const microseconds = Number(parsed.microseconds);
+			const nanoseconds = Number(parsed.nanoseconds);
+			add(seconds, "second", "s");
+			if (options.formatSubMilliseconds) {
+				add(milliseconds, "millisecond", "ms");
+				add(microseconds, "microsecond", "µs");
+				add(nanoseconds, "nanosecond", "ns");
+			} else {
+				const millisecondsAndBelow = milliseconds + microseconds / 1e3 + nanoseconds / 1e6;
+				const millisecondsDecimalDigits = typeof options.millisecondsDecimalDigits === "number" ? options.millisecondsDecimalDigits : 0;
+				const millisecondsString = millisecondsDecimalDigits ? millisecondsAndBelow.toFixed(millisecondsDecimalDigits) : millisecondsAndBelow >= 1 ? Math.round(millisecondsAndBelow) : Math.ceil(millisecondsAndBelow);
+				add(Number.parseFloat(millisecondsString), "millisecond", "ms", millisecondsString);
+			}
 		} else {
-			const millisecondsAndBelow = milliseconds + microseconds / 1e3 + nanoseconds / 1e6;
-			const millisecondsDecimalDigits = typeof options.millisecondsDecimalDigits === "number" ? options.millisecondsDecimalDigits : 0;
-			const millisecondsString = millisecondsDecimalDigits ? millisecondsAndBelow.toFixed(millisecondsDecimalDigits) : millisecondsAndBelow >= 1 ? Math.round(millisecondsAndBelow) : Math.ceil(millisecondsAndBelow);
-			add(Number.parseFloat(millisecondsString), "millisecond", "ms", millisecondsString);
+			const secondsFixed = floorDecimals((isBigInt ? Number(milliseconds % ONE_DAY_IN_MILLISECONDS) : milliseconds) / 1e3 % 60, typeof options.secondsDecimalDigits === "number" ? options.secondsDecimalDigits : 1);
+			const secondsString = options.keepDecimalsOnWholeSeconds ? secondsFixed : secondsFixed.replace(/\.0+$/, "");
+			add(Number.parseFloat(secondsString), "second", "s", secondsString);
 		}
-	} else {
-		const secondsFixed = floorDecimals((isBigInt ? Number(milliseconds % ONE_DAY_IN_MILLISECONDS) : milliseconds) / 1e3 % 60, typeof options.secondsDecimalDigits === "number" ? options.secondsDecimalDigits : 1);
-		const secondsString = options.keepDecimalsOnWholeSeconds ? secondsFixed : secondsFixed.replace(/\.0+$/, "");
-		add(Number.parseFloat(secondsString), "second", "s", secondsString);
 	}
 	if (result.length === 0) return sign + "0" + (options.verbose ? " milliseconds" : "ms");
 	const separator = options.colonNotation ? ":" : " ";
@@ -3140,9 +3162,10 @@ const logResult = (result, verboseInfo) => {
 	logDuration(result, verboseInfo);
 };
 const logDuration = (result, verboseInfo) => {
+	const verboseMessage = `(done in ${prettyMilliseconds(result.durationMs)})`;
 	verboseLog({
 		type: "duration",
-		verboseMessage: `(done in ${prettyMilliseconds(result.durationMs)})`,
+		verboseMessage,
 		verboseInfo,
 		result
 	});
@@ -3210,10 +3233,10 @@ const isTransformOptions = (value) => isPlainObject(value) && (value.transform !
 const isUrl = (value) => Object.prototype.toString.call(value) === "[object URL]";
 const isRegularUrl = (value) => isUrl(value) && value.protocol !== "file:";
 const isFilePathObject = (value) => isPlainObject(value) && Object.keys(value).length > 0 && Object.keys(value).every((key) => FILE_PATH_KEYS.has(key)) && isFilePathString(value.file);
-const FILE_PATH_KEYS = new Set(["file", "append"]);
+const FILE_PATH_KEYS = /* @__PURE__ */ new Set(["file", "append"]);
 const isFilePathString = (file) => typeof file === "string";
 const isUnknownStdioString = (type, value) => type === "native" && typeof value === "string" && !KNOWN_STDIO_STRINGS.has(value);
-const KNOWN_STDIO_STRINGS = new Set([
+const KNOWN_STDIO_STRINGS = /* @__PURE__ */ new Set([
 	"ipc",
 	"ignore",
 	"inherit",
@@ -3227,24 +3250,24 @@ const isTransformStream = (value) => isReadableStream(value?.readable) && isWrit
 const isAsyncIterableObject = (value) => isObject(value) && typeof value[Symbol.asyncIterator] === "function";
 const isIterableObject = (value) => isObject(value) && typeof value[Symbol.iterator] === "function";
 const isObject = (value) => typeof value === "object" && value !== null;
-const TRANSFORM_TYPES = new Set([
+const TRANSFORM_TYPES = /* @__PURE__ */ new Set([
 	"generator",
 	"asyncGenerator",
 	"duplex",
 	"webTransform"
 ]);
-const FILE_TYPES = new Set([
+const FILE_TYPES = /* @__PURE__ */ new Set([
 	"fileUrl",
 	"filePath",
 	"fileNumber"
 ]);
-const SPECIAL_DUPLICATE_TYPES_SYNC = new Set(["fileUrl", "filePath"]);
-const SPECIAL_DUPLICATE_TYPES = new Set([
+const SPECIAL_DUPLICATE_TYPES_SYNC = /* @__PURE__ */ new Set(["fileUrl", "filePath"]);
+const SPECIAL_DUPLICATE_TYPES = /* @__PURE__ */ new Set([
 	...SPECIAL_DUPLICATE_TYPES_SYNC,
 	"webStream",
 	"nodeStream"
 ]);
-const FORBID_DUPLICATE_TYPES = new Set(["webTransform", "duplex"]);
+const FORBID_DUPLICATE_TYPES = /* @__PURE__ */ new Set(["webTransform", "duplex"]);
 const TYPE_TO_MESSAGE = {
 	generator: "a generator",
 	asyncGenerator: "an async generator",
@@ -3577,7 +3600,8 @@ const validateDuplicateStreamSync = ({ otherStdioItems, type, value, optionName,
 const getDuplicateStreamInstance = ({ otherStdioItems, type, value, optionName, direction }) => {
 	const duplicateStdioItems = otherStdioItems.filter((stdioItem) => hasSameValue(stdioItem, value));
 	if (duplicateStdioItems.length === 0) return;
-	throwOnDuplicateStream(duplicateStdioItems.find((stdioItem) => stdioItem.direction !== direction), optionName, type);
+	const differentStdioItem = duplicateStdioItems.find((stdioItem) => stdioItem.direction !== direction);
+	throwOnDuplicateStream(differentStdioItem, optionName, type);
 	return direction === "output" ? duplicateStdioItems[0].stream : void 0;
 };
 const hasSameValue = ({ type, value }, secondValue) => {
@@ -3586,7 +3610,8 @@ const hasSameValue = ({ type, value }, secondValue) => {
 	return value === secondValue;
 };
 const validateDuplicateTransform = ({ otherStdioItems, type, value, optionName }) => {
-	throwOnDuplicateStream(otherStdioItems.find(({ value: { transform } }) => transform === value.transform), optionName, type);
+	const duplicateStdioItem = otherStdioItems.find(({ value: { transform } }) => transform === value.transform);
+	throwOnDuplicateStream(duplicateStdioItem, optionName, type);
 };
 const throwOnDuplicateStream = (stdioItem, optionName, type) => {
 	if (stdioItem !== void 0) throw new TypeError(`The \`${stdioItem.optionName}\` and \`${optionName}\` options must not target ${TYPE_TO_MESSAGE[type]} that is the same.`);
@@ -3594,13 +3619,14 @@ const throwOnDuplicateStream = (stdioItem, optionName, type) => {
 //#endregion
 //#region ../../node_modules/.pnpm/execa@9.5.2/node_modules/execa/lib/stdio/handle.js
 const handleStdio = (addProperties, options, verboseInfo, isSync) => {
+	const initialFileDescriptors = normalizeStdioOption(options, verboseInfo, isSync).map((stdioOption, fdNumber) => getFileDescriptor({
+		stdioOption,
+		fdNumber,
+		options,
+		isSync
+	}));
 	const fileDescriptors = getFinalFileDescriptors({
-		initialFileDescriptors: normalizeStdioOption(options, verboseInfo, isSync).map((stdioOption, fdNumber) => getFileDescriptor({
-			stdioOption,
-			fdNumber,
-			options,
-			isSync
-		})),
+		initialFileDescriptors,
 		addProperties,
 		options,
 		isSync
@@ -3617,13 +3643,14 @@ const getFileDescriptor = ({ stdioOption, fdNumber, options, isSync }) => {
 		optionName
 	});
 	const direction = getStreamDirection(initialStdioItems, fdNumber, optionName);
-	const normalizedStdioItems = normalizeTransforms(initialStdioItems.map((stdioItem) => handleNativeStream({
+	const stdioItems = initialStdioItems.map((stdioItem) => handleNativeStream({
 		stdioItem,
 		isStdioArray,
 		fdNumber,
 		direction,
 		isSync
-	})), optionName, direction, options);
+	}));
+	const normalizedStdioItems = normalizeTransforms(stdioItems, optionName, direction, options);
 	const objectMode = getFdObjectMode(normalizedStdioItems, direction);
 	validateFileObjectMode(normalizedStdioItems, objectMode);
 	return {
@@ -3633,7 +3660,8 @@ const getFileDescriptor = ({ stdioOption, fdNumber, options, isSync }) => {
 	};
 };
 const initializeStdioItems = ({ stdioOption, fdNumber, options, optionName }) => {
-	const stdioItems = filterDuplicates([...(Array.isArray(stdioOption) ? stdioOption : [stdioOption]).map((value) => initializeStdioItem(value, optionName)), ...handleInputOptions(options, fdNumber)]);
+	const initialStdioItems = [...(Array.isArray(stdioOption) ? stdioOption : [stdioOption]).map((value) => initializeStdioItem(value, optionName)), ...handleInputOptions(options, fdNumber)];
+	const stdioItems = filterDuplicates(initialStdioItems);
 	const isStdioArray = stdioItems.length > 1;
 	validateStdioArray(stdioItems, isStdioArray, optionName);
 	validateStreams(stdioItems);
@@ -3652,7 +3680,7 @@ const validateStdioArray = (stdioItems, isStdioArray, optionName) => {
 	if (!isStdioArray) return;
 	for (const { value, optionName } of stdioItems) if (INVALID_STDIO_ARRAY_OPTIONS.has(value)) throw new Error(`The \`${optionName}\` option must not include \`${value}\`.`);
 };
-const INVALID_STDIO_ARRAY_OPTIONS = new Set(["ignore", "ipc"]);
+const INVALID_STDIO_ARRAY_OPTIONS = /* @__PURE__ */ new Set(["ignore", "ipc"]);
 const validateStreams = (stdioItems) => {
 	for (const stdioItem of stdioItems) validateFileStdio(stdioItem);
 };
@@ -3981,7 +4009,10 @@ const generatorToStream = ({ value, value: { transform, final, writableObjectMod
 const runGeneratorsSync = (chunks, stdioItems, encoding, isInput) => {
 	const generators = stdioItems.filter(({ type }) => type === "generator");
 	const reversedGenerators = isInput ? generators.reverse() : generators;
-	for (const { value, optionName } of reversedGenerators) chunks = runTransformSync(addInternalGenerators(value, encoding, optionName), chunks);
+	for (const { value, optionName } of reversedGenerators) {
+		const generators = addInternalGenerators(value, encoding, optionName);
+		chunks = runTransformSync(generators, chunks);
+	}
 	return chunks;
 };
 const addInternalGenerators = ({ transform, final, binary, writableObjectMode, readableObjectMode, preserveNewlines }, encoding, optionName) => {
@@ -4017,7 +4048,8 @@ const addInputOptionSync = (fileDescriptors, fdNumber, options) => {
 		const [{ type, optionName }] = allStdioItems;
 		throw new TypeError(`Only the \`stdin\` option, not \`${optionName}\`, can be ${TYPE_TO_MESSAGE[type]} with synchronous methods.`);
 	}
-	options.input = joinToUint8Array(allStdioItems.map(({ contents }) => contents).map((contents) => applySingleInputGeneratorsSync(contents, stdioItems)));
+	const transformedContents = allStdioItems.map(({ contents }) => contents).map((contents) => applySingleInputGeneratorsSync(contents, stdioItems));
+	options.input = joinToUint8Array(transformedContents);
 };
 const applySingleInputGeneratorsSync = (contents, stdioItems) => {
 	const newContents = runGeneratorsSync(contents, stdioItems, "utf8", true);
@@ -4032,7 +4064,7 @@ const validateSerializable = (newContents) => {
 //#region ../../node_modules/.pnpm/execa@9.5.2/node_modules/execa/lib/verbose/output.js
 const shouldLogOutput = ({ stdioItems, encoding, verboseInfo, fdNumber }) => fdNumber !== "all" && isFullVerbose(verboseInfo, fdNumber) && !BINARY_ENCODINGS.has(encoding) && fdUsesVerbose(fdNumber) && (stdioItems.some(({ type, value }) => type === "native" && PIPED_STDIO_VALUES.has(value)) || stdioItems.every(({ type }) => TRANSFORM_TYPES.has(type)));
 const fdUsesVerbose = (fdNumber) => fdNumber === 1 || fdNumber === 2;
-const PIPED_STDIO_VALUES = new Set(["pipe", "overlapped"]);
+const PIPED_STDIO_VALUES = /* @__PURE__ */ new Set(["pipe", "overlapped"]);
 const logLines = async (linesIterable, stream, fdNumber, verboseInfo) => {
 	for await (const line of linesIterable) if (!isPipingStream(stream)) logLine(line, fdNumber, verboseInfo);
 };
@@ -4041,9 +4073,10 @@ const logLinesSync = (linesArray, fdNumber, verboseInfo) => {
 };
 const isPipingStream = (stream) => stream._readableState.pipes.length > 0;
 const logLine = (line, fdNumber, verboseInfo) => {
+	const verboseMessage = serializeVerboseMessage(line);
 	verboseLog({
 		type: "output",
-		verboseMessage: serializeVerboseMessage(line),
+		verboseMessage,
 		fdNumber,
 		verboseInfo
 	});
@@ -4069,10 +4102,12 @@ const transformOutputSync = ({ fileDescriptors, syncResult: { output }, options,
 };
 const transformOutputResultSync = ({ result, fileDescriptors, fdNumber, state, outputFiles, isMaxBuffer, verboseInfo }, { buffer, encoding, lines, stripFinalNewline, maxBuffer }) => {
 	if (result === null) return;
-	const uint8ArrayResult = bufferToUint8Array(truncateMaxBufferSync(result, isMaxBuffer, maxBuffer));
+	const truncatedResult = truncateMaxBufferSync(result, isMaxBuffer, maxBuffer);
+	const uint8ArrayResult = bufferToUint8Array(truncatedResult);
 	const { stdioItems, objectMode } = fileDescriptors[fdNumber];
+	const chunks = runOutputGeneratorsSync([uint8ArrayResult], stdioItems, encoding, state);
 	const { serializedResult, finalResult = serializedResult } = serializeChunks({
-		chunks: runOutputGeneratorsSync([uint8ArrayResult], stdioItems, encoding, state),
+		chunks,
 		objectMode,
 		encoding,
 		lines,
@@ -4196,7 +4231,7 @@ const getResultError = (error, exitCode, signal) => {
 //#region ../../node_modules/.pnpm/execa@9.5.2/node_modules/execa/lib/methods/main-sync.js
 const execaCoreSync = (rawFile, rawArguments, rawOptions) => {
 	const { file, commandArguments, command, escapedCommand, startTime, verboseInfo, options, fileDescriptors } = handleSyncArguments(rawFile, rawArguments, rawOptions);
-	return handleResult(spawnSubprocessSync({
+	const result = spawnSubprocessSync({
 		file,
 		commandArguments,
 		options,
@@ -4205,11 +4240,13 @@ const execaCoreSync = (rawFile, rawArguments, rawOptions) => {
 		verboseInfo,
 		fileDescriptors,
 		startTime
-	}), verboseInfo, options);
+	});
+	return handleResult(result, verboseInfo, options);
 };
 const handleSyncArguments = (rawFile, rawArguments, rawOptions) => {
 	const { command, escapedCommand, startTime, verboseInfo } = handleCommand(rawFile, rawArguments, rawOptions);
-	const { file, commandArguments, options } = normalizeOptions(rawFile, rawArguments, normalizeSyncOptions(rawOptions));
+	const syncOptions = normalizeSyncOptions(rawOptions);
+	const { file, commandArguments, options } = normalizeOptions(rawFile, rawArguments, syncOptions);
 	validateSyncOptions(options);
 	return {
 		file,
@@ -4254,14 +4291,16 @@ const spawnSubprocessSync = ({ file, commandArguments, options, command, escaped
 		isMaxBuffer,
 		verboseInfo
 	});
+	const stdio = output.map((stdioOutput, fdNumber) => stripNewline(stdioOutput, options, fdNumber));
+	const all = stripNewline(getAllSync(output, options), options, "all");
 	return getSyncResult({
 		error,
 		exitCode,
 		signal,
 		timedOut,
 		isMaxBuffer,
-		stdio: output.map((stdioOutput, fdNumber) => stripNewline(stdioOutput, options, fdNumber)),
-		all: stripNewline(getAllSync(output, options), options, "all"),
+		stdio,
+		all,
 		options,
 		command,
 		escapedCommand,
@@ -4271,7 +4310,8 @@ const spawnSubprocessSync = ({ file, commandArguments, options, command, escaped
 const runSubprocessSync = ({ file, commandArguments, options, command, escapedCommand, fileDescriptors, startTime }) => {
 	try {
 		addInputOptionsSync(fileDescriptors, options);
-		return (0, node_child_process.spawnSync)(file, commandArguments, normalizeSpawnSyncOptions(options));
+		const normalizedOptions = normalizeSpawnSyncOptions(options);
+		return (0, node_child_process.spawnSync)(file, commandArguments, normalizedOptions);
 	} catch (error) {
 		return makeEarlyError({
 			error,
@@ -4485,17 +4525,18 @@ const handleEarlyError = ({ error, command, escapedCommand, fileDescriptors, opt
 		writable,
 		duplex
 	});
+	const earlyError = makeEarlyError({
+		error,
+		command,
+		escapedCommand,
+		fileDescriptors,
+		options,
+		startTime,
+		isSync: false
+	});
 	return {
 		subprocess,
-		promise: handleDummyPromise(makeEarlyError({
-			error,
-			command,
-			escapedCommand,
-			fileDescriptors,
-			options,
-			startTime,
-			isSync: false
-		}), verboseInfo, options)
+		promise: handleDummyPromise(earlyError, verboseInfo, options)
 	};
 };
 const createDummyStreams = (subprocess, fileDescriptors) => {
@@ -4679,8 +4720,10 @@ const endWhenStreamsDone = async ({ passThroughStream, stream, streams, ended, a
 		controller.abort();
 		updateMaxListeners(passThroughStream, -PASSTHROUGH_LISTENERS_PER_STREAM);
 	}
-	if (streams.size > 0 && streams.size === ended.size + aborted.size) if (ended.size === 0 && aborted.size > 0) abortStream(passThroughStream);
-	else endStream(passThroughStream);
+	if (streams.size > 0 && streams.size === ended.size + aborted.size) {
+		if (ended.size === 0 && aborted.size > 0) abortStream(passThroughStream);
+		else endStream(passThroughStream);
+	}
 };
 const afterMergedStreamFinished = async (onFinished, stream, { signal }) => {
 	try {
@@ -4786,7 +4829,10 @@ const pipeOutputAsync = (subprocess, fileDescriptors, controller) => {
 			controller
 		});
 	}
-	for (const [outputStream, inputStreams] of pipeGroups.entries()) pipeStreams(inputStreams.length === 1 ? inputStreams[0] : mergeStreams(inputStreams), outputStream);
+	for (const [outputStream, inputStreams] of pipeGroups.entries()) {
+		const inputStream = inputStreams.length === 1 ? inputStreams[0] : mergeStreams(inputStreams);
+		pipeStreams(inputStream, outputStream);
+	}
 };
 const pipeTransform = (subprocess, stream, direction, fdNumber) => {
 	if (direction === "output") pipeStreams(subprocess.stdio[fdNumber], stream);
@@ -5275,12 +5321,13 @@ const stopReadingOnStreamEnd = async (onStreamEnd, controller, stream) => {
 	}
 };
 const iterateOnStream = ({ stream, controller, binary, shouldEncode, encoding, shouldSplit, preserveNewlines }) => {
+	const onStdoutChunk = (0, node_events.on)(stream, "data", {
+		signal: controller.signal,
+		highWaterMark: HIGH_WATER_MARK,
+		highWatermark: HIGH_WATER_MARK
+	});
 	return iterateOnData({
-		onStdoutChunk: (0, node_events.on)(stream, "data", {
-			signal: controller.signal,
-			highWaterMark: HIGH_WATER_MARK,
-			highWatermark: HIGH_WATER_MARK
-		}),
+		onStdoutChunk,
 		controller,
 		binary,
 		shouldEncode,
@@ -5324,12 +5371,13 @@ const getStreamOutput = async ({ stream, onStreamEnd, fdNumber, encoding, buffer
 		await Promise.all([resumeStream(stream), logPromise]);
 		return;
 	}
+	const stripFinalNewlineValue = getStripFinalNewline(stripFinalNewline, fdNumber);
 	const iterable = iterateForResult({
 		stream,
 		onStreamEnd,
 		lines,
 		encoding,
-		stripFinalNewline: getStripFinalNewline(stripFinalNewline, fdNumber),
+		stripFinalNewline: stripFinalNewlineValue,
 		allMixed
 	});
 	const [output] = await Promise.all([getStreamContents({
@@ -5349,14 +5397,15 @@ const logOutputAsync = async ({ stream, onStreamEnd, fdNumber, encoding, allMixe
 		verboseInfo,
 		fdNumber
 	})) return;
-	await logLines(iterateForResult({
+	const linesIterable = iterateForResult({
 		stream,
 		onStreamEnd,
 		lines: true,
 		encoding,
 		stripFinalNewline: true,
 		allMixed
-	}), stream, fdNumber, verboseInfo);
+	});
+	await logLines(linesIterable, stream, fdNumber, verboseInfo);
 };
 const resumeStream = async (stream) => {
 	await (0, node_timers_promises.setImmediate)();
@@ -5502,9 +5551,10 @@ const getAllMixed = ({ all, stdout, stderr }) => all && stdout && stderr && stdo
 //#region ../../node_modules/.pnpm/execa@9.5.2/node_modules/execa/lib/verbose/ipc.js
 const shouldLogIpc = (verboseInfo) => isFullVerbose(verboseInfo, "ipc");
 const logIpcOutput = (message, verboseInfo) => {
+	const verboseMessage = serializeVerboseMessage(message);
 	verboseLog({
 		type: "ipc",
-		verboseMessage: serializeVerboseMessage(message),
+		verboseMessage,
 		fdNumber: "ipc",
 		verboseInfo
 	});
@@ -5900,14 +5950,15 @@ const onDuplexDestroy = async ({ subprocessStdout, subprocessStdin, subprocess,
 const createIterable = (subprocess, encoding, { from, binary: binaryOption = false, preserveNewlines = false } = {}) => {
 	const binary = binaryOption || BINARY_ENCODINGS.has(encoding);
 	const subprocessStdout = getFromStream(subprocess, from);
-	return iterateOnStdoutData(iterateOnSubprocessStream({
+	const onStdoutData = iterateOnSubprocessStream({
 		subprocessStdout,
 		subprocess,
 		binary,
 		shouldEncode: true,
 		encoding,
 		preserveNewlines
-	}), subprocessStdout, subprocess);
+	});
+	return iterateOnStdoutData(onStdoutData, subprocessStdout, subprocess);
 };
 const iterateOnStdoutData = async function* (onStdoutData, subprocessStdout, subprocess) {
 	try {
@@ -6067,19 +6118,22 @@ const handlePromise = async ({ subprocess, options, startTime, verboseInfo, file
 	});
 	controller.abort();
 	onInternalError.resolve();
-	return handleResult(getAsyncResult({
+	const stdio = stdioResults.map((stdioResult, fdNumber) => stripNewline(stdioResult, options, fdNumber));
+	const all = stripNewline(allResult, options, "all");
+	const result = getAsyncResult({
 		errorInfo,
 		exitCode,
 		signal,
-		stdio: stdioResults.map((stdioResult, fdNumber) => stripNewline(stdioResult, options, fdNumber)),
-		all: stripNewline(allResult, options, "all"),
+		stdio,
+		all,
 		ipcOutput,
 		context,
 		options,
 		command,
 		escapedCommand,
 		startTime
-	}), verboseInfo, options);
+	});
+	return handleResult(result, verboseInfo, options);
 };
 const getAsyncResult = ({ errorInfo, exitCode, signal, stdio, all, ipcOutput, context, options, command, escapedCommand, startTime }) => "error" in errorInfo ? makeError({
 	error: errorInfo.error,
@@ -6123,7 +6177,7 @@ const mergeOption = (optionName, boundOptionValue, optionValue) => {
 	};
 	return optionValue;
 };
-const DEEP_OPTIONS = new Set(["env", ...FD_SPECIFIC_OPTIONS]);
+const DEEP_OPTIONS = /* @__PURE__ */ new Set(["env", ...FD_SPECIFIC_OPTIONS]);
 //#endregion
 //#region ../../node_modules/.pnpm/execa@9.5.2/node_modules/execa/lib/methods/create.js
 const createExeca = (mapArguments, boundOptions, deepOptions, setBoundExeca) => {
@@ -6150,7 +6204,8 @@ const callBoundExeca = ({ mapArguments, deepOptions = {}, boundOptions = {}, set
 	return isSync ? execaCoreSync(file, commandArguments, options) : execaCoreAsync(file, commandArguments, options, createNested);
 };
 const parseArguments = ({ mapArguments, firstArgument, nextArguments, deepOptions, boundOptions }) => {
-	const [initialFile, initialArguments, initialOptions] = normalizeParameters(...isTemplateString(firstArgument) ? parseTemplates(firstArgument, nextArguments) : [firstArgument, ...nextArguments]);
+	const callArguments = isTemplateString(firstArgument) ? parseTemplates(firstArgument, nextArguments) : [firstArgument, ...nextArguments];
+	const [initialFile, initialArguments, initialOptions] = normalizeParameters(...callArguments);
 	const mergedOptions = mergeOptions(mergeOptions(deepOptions, boundOptions), initialOptions);
 	const { file = initialFile, commandArguments = initialArguments, options = mergedOptions, isSync = false } = mapArguments({
 		file: initialFile,
@@ -6221,8 +6276,8 @@ const { sendMessage, getOneMessage, getEachMessage, getCancelSignal } = getIpcEx
 //#endregion
 //#region src/cloudFrontInvalidation.ts
 const DEFAULT_POLL_INTERVAL_MS = 2e3;
-const DEFAULT_TIMEOUT_MS = 300 * 1e3;
-const sleep = (milliseconds) => new Promise((resolve) => setTimeout(resolve, milliseconds));
+const DEFAULT_TIMEOUT_MS = 3e5;
+const sleep$1 = (milliseconds) => new Promise((resolve) => setTimeout(resolve, milliseconds));
 const invalidateCloudFront = async (client, distributionId, paths, options) => {
 	if (paths.length === 0) return;
 	const response = await client.send(new _aws_sdk_client_cloudfront.CreateInvalidationCommand({
@@ -6240,7 +6295,7 @@ const invalidateCloudFront = async (client, distributionId, paths, options) => {
 	if (!invalidationId) throw new Error("CloudFront invalidation response is missing Invalidation.Id");
 	const deadline = Date.now() + DEFAULT_TIMEOUT_MS;
 	while (Date.now() < deadline) {
-		await sleep(DEFAULT_POLL_INTERVAL_MS);
+		await sleep$1(DEFAULT_POLL_INTERVAL_MS);
 		if ((await client.send(new _aws_sdk_client_cloudfront.GetInvalidationCommand({
 			DistributionId: distributionId,
 			Id: invalidationId
@@ -6248,1751 +6303,294 @@ const invalidateCloudFront = async (client, distributionId, paths, options) => {
 	}
 	throw new Error(`Timed out waiting for CloudFront invalidation ${invalidationId}.`);
 };
-//#endregion
-//#region src/dynamoDB.ts
-const DYNAMODB_MAX_METADATA_ITEM_BYTES = 8 * 1024;
-const DYNAMODB_MAX_CATALOG_ITEM_BYTES = 400 * 1024;
-var DynamoDBMetadataItemSizeError = class extends Error {
-	name = "DynamoDBMetadataItemSizeError";
-	constructor(byteLength) {
-		super(`DynamoDB metadata item is ${byteLength} bytes; maximum is ${DYNAMODB_MAX_METADATA_ITEM_BYTES}`);
-		this.byteLength = byteLength;
-	}
-};
-const boundedDynamoDBMetadataItem = (item) => {
-	const byteLength = new TextEncoder().encode(JSON.stringify(item)).byteLength;
-	if (byteLength > 8192) throw new DynamoDBMetadataItemSizeError(byteLength);
-	return item;
-};
-var DynamoDBCatalogItemSizeError = class extends Error {
-	name = "DynamoDBCatalogItemSizeError";
-	constructor(byteLength) {
-		super(`DynamoDB catalog item is ${byteLength} bytes; maximum is ${DYNAMODB_MAX_CATALOG_ITEM_BYTES}`);
-		this.byteLength = byteLength;
-	}
-};
-const boundedDynamoDBCatalogItem = (item) => {
-	const byteLength = new TextEncoder().encode(JSON.stringify(item)).byteLength;
-	if (byteLength > 409600) throw new DynamoDBCatalogItemSizeError(byteLength);
-	return item;
-};
-const DYNAMODB_CHANNEL_PARTITION = "channels";
-const DYNAMODB_CHANNEL_NAME_PARTITION = "_hot-updater#channel-names";
-var DynamoDBStoredItemError = class extends Error {
-	name = "DynamoDBStoredItemError";
-	constructor() {
-		super("DynamoDB contains an invalid Hot Updater row");
-	}
-};
-const field = (value, name) => Reflect.get(value, name);
-const isNullableString = (value) => value === null || typeof value === "string";
-const isByteSize = (value) => typeof value === "number" && Number.isSafeInteger(value) && value >= 0;
-const withLegacyArchiveByteSize = (value) => typeof value === "object" && value !== null && field(value, "archive_byte_size") === void 0 ? {
-	...value,
-	archive_byte_size: 0
-} : value;
-const isBundleRow = (value) => typeof value === "object" && value !== null && typeof field(value, "id") === "string" && (field(value, "platform") === "ios" || field(value, "platform") === "android") && typeof field(value, "file_hash") === "string" && isNullableString(field(value, "git_commit_hash")) && typeof field(value, "storage_uri") === "string" && isByteSize(field(value, "archive_byte_size")) && (0, _hot_updater_plugin_core.isDatabaseMetadataObject)(field(value, "metadata")) && isNullableString(field(value, "manifest_storage_uri")) && isNullableString(field(value, "manifest_file_hash")) && isNullableString(field(value, "asset_base_storage_uri"));
-const isPatchRow = (value) => typeof value === "object" && value !== null && typeof field(value, "id") === "string" && typeof field(value, "bundle_id") === "string" && typeof field(value, "base_bundle_id") === "string" && typeof field(value, "base_file_hash") === "string" && typeof field(value, "patch_file_hash") === "string" && typeof field(value, "patch_storage_uri") === "string" && isByteSize(field(value, "byte_size")) && typeof field(value, "order_index") === "number";
-const isChannelRow = (value) => typeof value === "object" && value !== null && typeof field(value, "id") === "string" && typeof field(value, "name") === "string";
-const isReleaseRow = (value) => typeof value === "object" && value !== null && typeof field(value, "id") === "string" && typeof field(value, "revision") === "number" && typeof field(value, "scope_key") === "string" && typeof field(value, "channel_id") === "string" && (field(value, "platform") === "ios" || field(value, "platform") === "android") && (field(value, "kind") === "BUNDLE" || field(value, "kind") === "EMBEDDED") && isNullableString(field(value, "bundle_id")) && (field(value, "strategy") === "APP_VERSION" || field(value, "strategy") === "FINGERPRINT") && isNullableString(field(value, "target_app_version")) && isNullableString(field(value, "fingerprint_hash")) && typeof field(value, "enabled") === "boolean" && typeof field(value, "should_force_update") === "boolean" && isNullableString(field(value, "message")) && typeof field(value, "rollout_cohort_count") === "number" && Array.isArray(field(value, "target_cohorts")) && field(value, "target_cohorts").every((cohort) => typeof cohort === "string") && (field(value, "operation") === "DEPLOY" || field(value, "operation") === "PROMOTE" || field(value, "operation") === "ROLLBACK") && isNullableString(field(value, "source_release_id")) && typeof field(value, "created_at_ms") === "number" && typeof field(value, "updated_at_ms") === "number";
-const isReleaseCatalogRow = (value) => typeof value === "object" && value !== null && typeof field(value, "scope_key") === "string" && typeof field(value, "catalog_id") === "string" && (field(value, "strategy") === "APP_VERSION" || field(value, "strategy") === "FINGERPRINT") && typeof field(value, "channel_id") === "string" && typeof field(value, "channel_key") === "string" && (field(value, "platform") === "ios" || field(value, "platform") === "android") && isNullableString(field(value, "fingerprint_hash")) && typeof field(value, "generation") === "number" && typeof field(value, "payload") === "string" && typeof field(value, "catalog_hash") === "string" && typeof field(value, "byte_size") === "number" && typeof field(value, "is_tombstone") === "boolean" && typeof field(value, "updated_at_ms") === "number";
-const parseDynamoDBItem = (value) => {
-	const pk = value.pk;
-	const sk = value.sk;
-	const version = value.version;
-	const relationCount = value.relation_count;
-	const ownedPatchCount = value.owned_patch_count;
-	const gsi1pk = value.gsi1pk;
-	const gsi1sk = value.gsi1sk;
-	const row = pk === "bundles" ? withLegacyArchiveByteSize(value.row) : value.row;
-	if (typeof sk !== "string" || typeof version !== "number") throw new DynamoDBStoredItemError();
-	if (pk === "channels" && typeof value.reference_count === "number" && isChannelRow(row)) return {
-		pk,
-		sk,
-		version,
-		reference_count: value.reference_count,
-		row
-	};
-	if (typeof pk === "string" && pk.startsWith("release-scope#") && isReleaseRow(row)) return {
-		pk,
-		sk,
-		version,
-		row
-	};
-	if (pk === "release_catalogs" && isReleaseCatalogRow(row)) return {
-		pk,
-		sk,
-		version,
-		row
-	};
-	if (typeof gsi1pk !== "string" || typeof gsi1sk !== "string") throw new DynamoDBStoredItemError();
-	if (pk === "bundles" && isBundleRow(row)) {
-		if (typeof relationCount !== "number" || typeof ownedPatchCount !== "number") throw new DynamoDBStoredItemError();
-		return {
-			pk,
-			sk,
-			version,
-			relation_count: relationCount,
-			owned_patch_count: ownedPatchCount,
-			gsi1pk,
-			gsi1sk,
-			row
-		};
-	}
-	if (pk === "bundle_patches" && isPatchRow(row)) return {
-		pk,
-		sk,
-		version,
-		gsi1pk,
-		gsi1sk,
-		row
-	};
-	throw new DynamoDBStoredItemError();
-};
-const bundlePlatformPartition = (row) => `bundle#${row.platform}`;
-const patchOwnerPartition = (bundleId) => `patch-owner#${bundleId}`;
-const patchOrderKey = (row) => `${row.order_index.toString().padStart(10, "0")}#${row.id}`;
-const toDynamoDBBundleItem = (row, version = 1, relationCount = 0, ownedPatchCount = 0) => ({
-	pk: "bundles",
-	sk: row.id,
-	version,
-	relation_count: relationCount,
-	owned_patch_count: ownedPatchCount,
-	gsi1pk: bundlePlatformPartition(row),
-	gsi1sk: row.id,
-	row
-});
-const toDynamoDBPatchItem = (row, version = 1) => {
-	const orderKey = patchOrderKey(row);
+/**
+* The update-check routes' CloudFront invalidation: `invalidate` purges their
+* cached copies and `destroy` releases the client; undefined without a
+* distribution. A failed invalidation only warns, so the write that changed
+* the routes still succeeds.
+*/
+const createUpdateRouteInvalidation = ({ apiBasePath = "/release-catalogs", cloudfrontDistributionId, shouldWaitForInvalidation = false, credentials, region }) => {
+	if (!cloudfrontDistributionId) return void 0;
+	const client = new _aws_sdk_client_cloudfront.CloudFrontClient({
+		credentials,
+		region
+	});
 	return {
-		pk: "bundle_patches",
-		sk: row.id,
-		version,
-		gsi1pk: patchOwnerPartition(row.bundle_id),
-		gsi1sk: orderKey,
-		row
-	};
-};
-const toDynamoDBChannelItem = (row, version = 1, referenceCount = 0) => ({
-	pk: DYNAMODB_CHANNEL_PARTITION,
-	sk: row.id,
-	version,
-	reference_count: referenceCount,
-	row
-});
-const releaseScopePartition = (scopeKey) => `release-scope#${scopeKey}`;
-const toDynamoDBReleaseItem = (row, version = 1) => ({
-	pk: releaseScopePartition(row.scope_key),
-	sk: row.id,
-	version,
-	row
-});
-const toDynamoDBReleaseCatalogItem = (row, version = 1) => ({
-	pk: "release_catalogs",
-	sk: row.scope_key,
-	version,
-	row
-});
-const itemKey = (model, id) => ({
-	pk: model,
-	sk: id
-});
-const exactDynamoDBId = (where) => {
-	if (where?.length !== 1) return void 0;
-	const condition = where[0];
-	if (Reflect.get(condition, "field") !== "id" || (Reflect.get(condition, "operator") ?? "eq") !== "eq" || Reflect.get(condition, "mode") === "insensitive") return;
-	const value = Reflect.get(condition, "value");
-	return typeof value === "string" ? value : void 0;
-};
-const exactDynamoDBPatchOwner = (where) => {
-	const owners = exactDynamoDBPatchOwners(where);
-	return owners?.length === 1 ? owners[0] : void 0;
-};
-const exactDynamoDBPatchOwners = (where) => {
-	if (!where || where.some((condition) => Reflect.get(condition, "connector") === "OR")) return;
-	const ownerConditions = where.filter((condition) => Reflect.get(condition, "field") === "bundle_id");
-	if (ownerConditions.length !== 1) return void 0;
-	const condition = ownerConditions[0];
-	if (Reflect.get(condition, "mode") === "insensitive") return;
-	const operator = Reflect.get(condition, "operator") ?? "eq";
-	const value = Reflect.get(condition, "value");
-	if (operator === "eq") return typeof value === "string" ? [value] : void 0;
-	if (operator === "in" && Array.isArray(value) && value.every((id) => typeof id === "string")) return value;
-};
-const exactDynamoDBBundleIds = (where) => {
-	if (!where || where.some((condition) => Reflect.get(condition, "connector") === "OR")) return;
-	for (const condition of where) {
-		if (Reflect.get(condition, "field") !== "id" || Reflect.get(condition, "mode") === "insensitive") continue;
-		const operator = Reflect.get(condition, "operator") ?? "eq";
-		const value = Reflect.get(condition, "value");
-		if (operator === "eq" && typeof value === "string") return [value];
-		if (operator === "in" && Array.isArray(value) && value.every((id) => typeof id === "string")) return value;
-	}
-};
-const dynamoDBBundlePageStart = (where, direction) => {
-	if ((where ?? []).some((condition) => Reflect.get(condition, "connector") === "OR")) return;
-	let result;
-	for (const condition of where ?? []) {
-		if (Reflect.get(condition, "field") !== "id") continue;
-		const operator = Reflect.get(condition, "operator") ?? "eq";
-		const value = Reflect.get(condition, "value");
-		if (!(direction === "asc" ? operator === "gt" || operator === "gte" : operator === "lt" || operator === "lte") || typeof value !== "string") continue;
-		const inclusive = operator === "gte" || operator === "lte";
-		if (result === void 0 || (direction === "asc" ? value > result.id : value < result.id) || value === result.id && !inclusive) result = {
-			id: value,
-			inclusive
-		};
-	}
-	return result;
-};
-const parseStoredItem = (item) => parseDynamoDBItem(item.pk === "release_catalogs" ? boundedDynamoDBCatalogItem(item) : boundedDynamoDBMetadataItem(item));
-const queryItems = async (store, input) => {
-	let exclusiveStartKey;
-	const items = [];
-	do {
-		const sortCondition = input.minimumSortKey ? " AND #sortKey >= :minimumSortKey" : "";
-		const page = await store.client.send(new _aws_sdk_lib_dynamodb.QueryCommand({
-			TableName: store.tableName,
-			...input.indexName ? { IndexName: input.indexName } : {},
-			...input.consistentRead ? { ConsistentRead: true } : {},
-			ExclusiveStartKey: exclusiveStartKey,
-			KeyConditionExpression: `#partitionKey = :partition${sortCondition}`,
-			ExpressionAttributeNames: {
-				"#partitionKey": input.indexName ? "gsi1pk" : "pk",
-				...input.minimumSortKey ? { "#sortKey": input.indexName ? "gsi1sk" : "sk" } : {}
-			},
-			ExpressionAttributeValues: {
-				":partition": input.partition,
-				...input.minimumSortKey ? { ":minimumSortKey": input.minimumSortKey } : {}
+		invalidate: async () => {
+			try {
+				await invalidateCloudFront(client, cloudfrontDistributionId, [`${apiBasePath.replace(/\/+$/, "")}/*`], { shouldWait: shouldWaitForInvalidation });
+			} catch (error) {
+				console.warn("[hot-updater/aws] CloudFront invalidation failed; continuing without cache invalidation.", {
+					distributionId: cloudfrontDistributionId,
+					error: error instanceof Error ? error.message : "Unknown error"
+				});
 			}
-		}));
-		const pageItems = (page.Items ?? []).map(parseStoredItem);
-		items.push(...pageItems);
-		exclusiveStartKey = page.LastEvaluatedKey;
-	} while (exclusiveStartKey !== void 0);
-	return items;
-};
-const queryBundleItemsPage = async (store, input) => {
-	if (input.limit === 0) return [];
-	let exclusiveStartKey;
-	const items = [];
-	do {
-		const startOperator = input.start?.inclusive ? input.direction === "asc" ? ">=" : "<=" : input.direction === "asc" ? ">" : "<";
-		const page = await store.client.send(new _aws_sdk_lib_dynamodb.QueryCommand({
-			TableName: store.tableName,
-			ExclusiveStartKey: exclusiveStartKey,
-			KeyConditionExpression: input.start ? `#pk = :pk AND #sk ${startOperator} :start` : "#pk = :pk",
-			ExpressionAttributeNames: {
-				"#pk": "pk",
-				...input.start ? { "#sk": "sk" } : {}
-			},
-			ExpressionAttributeValues: {
-				":pk": "bundles",
-				...input.start ? { ":start": input.start.id } : {}
-			},
-			Limit: Math.max(input.limit - items.length, 100),
-			ScanIndexForward: input.direction === "asc"
-		}));
-		for (const item of (page.Items ?? []).map(parseStoredItem)) {
-			if (item.pk === "bundles" && input.matches(item.row)) items.push(item);
-			if (items.length === input.limit) return items;
-		}
-		exclusiveStartKey = page.LastEvaluatedKey;
-	} while (exclusiveStartKey !== void 0);
-	return items;
-};
-const loadModelItems = (store, model) => queryItems(store, {
-	partition: model,
-	consistentRead: true
-});
-const loadModelItem = async (store, model, id) => {
-	const { Item } = await store.client.send(new _aws_sdk_lib_dynamodb.GetCommand({
-		TableName: store.tableName,
-		Key: itemKey(model, id),
-		ConsistentRead: true
-	}));
-	return Item === void 0 ? void 0 : parseStoredItem(Item);
-};
-const loadBundleItem = async (store, id) => {
-	const item = await loadModelItem(store, "bundles", id);
-	return item?.pk === "bundles" ? item : void 0;
-};
-const loadPatchItem = async (store, id) => {
-	const item = await loadModelItem(store, "bundle_patches", id);
-	return item?.pk === "bundle_patches" ? item : void 0;
-};
-const loadChannelItem = async (store, id) => {
-	const item = await loadModelItem(store, DYNAMODB_CHANNEL_PARTITION, id);
-	return item?.pk === "channels" ? item : void 0;
-};
-const loadBundleItems = async (store) => {
-	return (await loadModelItems(store, "bundles")).filter((item) => item.pk === "bundles");
-};
-const loadPatchItems = async (store) => {
-	return (await loadModelItems(store, "bundle_patches")).filter((item) => item.pk === "bundle_patches");
-};
-const loadChannelItems = async (store) => {
-	return (await loadModelItems(store, DYNAMODB_CHANNEL_PARTITION)).filter((item) => item.pk === DYNAMODB_CHANNEL_PARTITION);
-};
-const DYNAMODB_RELEASE_ID_PARTITION = "_hot-updater#release-scope-by-id";
-const releaseLocatorItem = (row) => ({
-	pk: DYNAMODB_RELEASE_ID_PARTITION,
-	sk: row.id,
-	scope_key: row.scope_key
-});
-const loadReleaseItem = async (store, id) => {
-	const locator = await store.client.send(new _aws_sdk_lib_dynamodb.GetCommand({
-		TableName: store.tableName,
-		Key: {
-			pk: DYNAMODB_RELEASE_ID_PARTITION,
-			sk: id
 		},
-		ConsistentRead: true
-	}));
-	if (locator.Item === void 0) return void 0;
-	const scopeKey = locator.Item.scope_key;
-	if (typeof scopeKey !== "string") throw new DynamoDBStoredItemError();
-	const result = await store.client.send(new _aws_sdk_lib_dynamodb.GetCommand({
-		TableName: store.tableName,
-		Key: {
-			pk: releaseScopePartition(scopeKey),
-			sk: id
-		},
-		ConsistentRead: true
-	}));
-	if (result.Item === void 0) throw new DynamoDBStoredItemError();
-	const item = parseStoredItem(result.Item);
-	if (!isReleaseRow(item.row) || item.sk !== id) throw new DynamoDBStoredItemError();
-	return item;
-};
-const loadReleaseItemsByScope = async (store, scopeKey) => (await queryItems(store, {
-	partition: releaseScopePartition(scopeKey),
-	consistentRead: true
-})).filter((item) => item.pk === releaseScopePartition(scopeKey) && isReleaseRow(item.row));
-const loadReleaseItems = async (store) => {
-	let exclusiveStartKey;
-	const items = [];
-	do {
-		const page = await store.client.send(new _aws_sdk_lib_dynamodb.ScanCommand({
-			TableName: store.tableName,
-			ExclusiveStartKey: exclusiveStartKey,
-			ConsistentRead: true,
-			FilterExpression: "begins_with(#pk, :prefix)",
-			ExpressionAttributeNames: { "#pk": "pk" },
-			ExpressionAttributeValues: { ":prefix": "release-scope#" }
-		}));
-		for (const value of page.Items ?? []) {
-			const item = parseStoredItem(value);
-			if (isReleaseRow(item.row)) items.push(item);
-		}
-		exclusiveStartKey = page.LastEvaluatedKey;
-	} while (exclusiveStartKey !== void 0);
-	return items;
-};
-const loadReleaseCatalogItem = async (store, scopeKey) => {
-	const result = await store.client.send(new _aws_sdk_lib_dynamodb.GetCommand({
-		TableName: store.tableName,
-		Key: itemKey("release_catalogs", scopeKey),
-		ConsistentRead: true
-	}));
-	if (result.Item === void 0) return void 0;
-	const item = parseStoredItem(result.Item);
-	return item.pk === "release_catalogs" ? item : void 0;
-};
-const loadReleaseCatalogItems = async (store) => (await queryItems(store, {
-	partition: "release_catalogs",
-	consistentRead: true
-})).filter((item) => item.pk === "release_catalogs");
-const loadChannelByName = async (store, name) => {
-	const { Item } = await store.client.send(new _aws_sdk_lib_dynamodb.GetCommand({
-		TableName: store.tableName,
-		Key: {
-			pk: DYNAMODB_CHANNEL_NAME_PARTITION,
-			sk: name
-		},
-		ConsistentRead: true
-	}));
-	const id = Item?.channel_id;
-	if (Item === void 0) return void 0;
-	if (typeof id !== "string") throw new DynamoDBStoredItemError();
-	const channel = await loadChannelItem(store, id);
-	if (channel === void 0 || channel.row.name !== name) throw new DynamoDBStoredItemError();
-	return channel;
-};
-const insertDynamoDBChannel = async (store, input) => {
-	const existing = await loadChannelByName(store, input.row.name);
-	if (existing !== void 0) return {
-		row: existing.row,
-		inserted: false
-	};
-	const existingId = await loadChannelItem(store, input.row.id);
-	if (existingId !== void 0) {
-		if (existingId.row.name === input.row.name) return {
-			row: existingId.row,
-			inserted: false
-		};
-		throw new DynamoDBStoredItemError();
-	}
-	try {
-		await commitDynamoDBTransaction(store, [{ Put: {
-			TableName: store.tableName,
-			Item: boundedDynamoDBMetadataItem(toDynamoDBChannelItem(input.row)),
-			ConditionExpression: "attribute_not_exists(#pk)",
-			ExpressionAttributeNames: { "#pk": "pk" }
-		} }, { Put: {
-			TableName: store.tableName,
-			Item: {
-				pk: DYNAMODB_CHANNEL_NAME_PARTITION,
-				sk: input.row.name,
-				channel_id: input.row.id
-			},
-			ConditionExpression: "attribute_not_exists(#pk)",
-			ExpressionAttributeNames: { "#pk": "pk" }
-		} }]);
-		return {
-			row: input.row,
-			inserted: true
-		};
-	} catch (error) {
-		const canonical = await loadChannelByName(store, input.row.name);
-		if (canonical !== void 0) return {
-			row: canonical.row,
-			inserted: false
-		};
-		throw error;
-	}
-};
-const deleteDynamoDBChannel = async (store, input) => {
-	const current = await loadChannelItem(store, input.id);
-	if (current === void 0) return {
-		deleted: false,
-		reason: "not_found"
-	};
-	if (current.reference_count !== 0) return {
-		deleted: false,
-		reason: "not_empty"
+		destroy: () => client.destroy()
 	};
-	try {
-		await commitDynamoDBTransaction(store, [{ Delete: {
-			TableName: store.tableName,
-			Key: itemKey(DYNAMODB_CHANNEL_PARTITION, current.sk),
-			ConditionExpression: "#version = :version AND #referenceCount = :zero",
-			ExpressionAttributeNames: {
-				"#version": "version",
-				"#referenceCount": "reference_count"
-			},
-			ExpressionAttributeValues: {
-				":version": current.version,
-				":zero": 0
-			}
-		} }, { Delete: {
-			TableName: store.tableName,
-			Key: {
-				pk: DYNAMODB_CHANNEL_NAME_PARTITION,
-				sk: current.row.name
-			},
-			ConditionExpression: "#channelId = :channelId",
-			ExpressionAttributeNames: { "#channelId": "channel_id" },
-			ExpressionAttributeValues: { ":channelId": current.sk }
-		} }]);
-		return { deleted: true };
-	} catch (error) {
-		const latest = await loadChannelItem(store, input.id);
-		if (latest !== void 0 && latest.reference_count > 0) return {
-			deleted: false,
-			reason: "not_empty"
-		};
-		if (latest === void 0) return {
-			deleted: false,
-			reason: "not_found"
-		};
-		throw error;
-	}
 };
-const queryOwnerPatchIds = async (store, indexName, bundleId) => {
-	return (await queryItems(store, {
-		partition: patchOwnerPartition(bundleId),
-		indexName
-	})).filter((item) => item.pk === "bundle_patches").map(({ sk }) => sk);
-};
-var DynamoDBTransactionLimitError = class extends Error {
-	name = "DynamoDBTransactionLimitError";
-	constructor(actionCount) {
-		super(`DynamoDB transaction requires ${actionCount} actions; maximum is 100`);
-		this.actionCount = actionCount;
-	}
-};
-const metadataUpdate = (store, delta) => {
-	const entries = Object.entries(delta).filter(([, value]) => value !== 0);
-	if (entries.length === 0) return void 0;
+//#endregion
+//#region src/dynamoDBStore.ts
+/** DynamoDB's limits: 100 items and 4 MB a transaction, 400 KB an item, and 2,048- and 1,024-byte keys. */
+const DYNAMODB_LIMITS = {
+	items: 100,
+	bytes: 4e6,
+	itemBytes: 4e5,
+	keyBytes: {
+		pk: 2048,
+		sk: 1024
+	}
+};
+/** BatchGetItem takes 100 keys a call. */
+const GET_BATCH = 100;
+/** A column named like a key attribute is stored with a leading dot, which no column name has. */
+const attribute = (column) => column === "pk" || column === "sk" ? `.${column}` : column;
+const renamed = (record, rename) => Object.fromEntries(Object.entries(record).map(([name, value]) => [rename(name), value]));
+const toItem = (key, row) => ({
+	...renamed(row, attribute),
+	pk: key.pk,
+	sk: key.sk
+});
+const toRow = ({ pk: _pk, sk: _sk, ...item }) => renamed(item, (name) => name.replace(/^\./, ""));
+const idOf = ({ pk, sk }) => JSON.stringify([pk, sk]);
+const nameOf = (error) => error.name;
+const sleep = (milliseconds) => new Promise((resolve) => setTimeout(resolve, milliseconds));
+/**
+* One transaction item. Its expressions bind every column name and value, so
+* no column clashes with a reserved word; `pk` and `sk` are none.
+*/
+const toTransactItem = (tableName, op) => {
 	const names = {};
 	const values = {};
-	const updates = [];
-	const conditions = [];
-	for (const [model, change] of entries) {
-		const name = model === "bundles" ? "bundles" : "patches";
-		const valueName = model === "bundles" ? "bundle" : "patch";
-		names[`#${name}`] = name;
-		values[`:${valueName}Delta`] = change;
-		updates.push(`#${name} :${valueName}Delta`);
-		if (change < 0) {
-			values[`:${valueName}Removal`] = -change;
-			conditions.push(`#${name} >= :${valueName}Removal`);
-		}
-	}
-	return { Update: {
-		TableName: store.tableName,
-		Key: {
-			pk: "_hot-updater",
-			sk: "limits.metadata"
-		},
-		UpdateExpression: `ADD ${updates.join(", ")}`,
-		...conditions.length > 0 ? { ConditionExpression: conditions.join(" AND ") } : {},
-		ExpressionAttributeNames: names,
-		ExpressionAttributeValues: values
-	} };
-};
-const updateBundleRelation = (store, bundleId, delta, ownedPatchDelta = 0) => {
-	const names = {
-		"#pk": "pk",
-		"#version": "version"
+	const binder = (map, prefix) => (entry) => {
+		const token = `${prefix}${Object.keys(map).length}`;
+		map[token] = entry;
+		return token;
 	};
-	const values = { ":one": 1 };
-	const additions = [];
-	let condition = "attribute_exists(#pk)";
-	let update = "SET #version = #version + :one";
-	if (delta !== 0) {
-		names["#relationCount"] = "relation_count";
-		values[":relationDelta"] = delta;
-		additions.push("#relationCount :relationDelta");
-		if (delta < 0) {
-			values[":relationRemoval"] = -delta;
-			condition += " AND #relationCount >= :relationRemoval";
-		}
-	}
-	if (ownedPatchDelta !== 0) {
-		names["#ownedPatchCount"] = "owned_patch_count";
-		values[":ownedPatchDelta"] = ownedPatchDelta;
-		additions.push("#ownedPatchCount :ownedPatchDelta");
-		if (ownedPatchDelta < 0) {
-			values[":ownedPatchRemoval"] = -ownedPatchDelta;
-			condition += " AND #ownedPatchCount >= :ownedPatchRemoval";
+	const name = binder(names, "#n");
+	const value = binder(values, ":v");
+	const { condition } = op;
+	const guard = condition === void 0 ? void 0 : "v" in condition ? `${name("_v")} = ${value(condition.v)}` : `${condition.exists ? "attribute_exists" : "attribute_not_exists"}(pk)`;
+	const item = (fields) => ({
+		TableName: tableName,
+		ConditionExpression: guard,
+		...fields,
+		ExpressionAttributeNames: Object.keys(names).length ? names : void 0,
+		ExpressionAttributeValues: Object.keys(values).length ? values : void 0
+	});
+	const Key = {
+		pk: op.key.pk,
+		sk: op.key.sk
+	};
+	switch (op.type) {
+		case "put": return { Put: item({ Item: toItem(op.key, op.value) }) };
+		case "delete": return { Delete: item({ Key }) };
+		case "check": return { ConditionCheck: item({
+			Key,
+			ConditionExpression: guard
+		}) };
+		case "add": {
+			const init = op.init ?? {};
+			return { Update: item({
+				Key,
+				UpdateExpression: `SET ${Object.keys({
+					...init,
+					...op.by
+				}).map((column) => {
+					const path = name(attribute(column));
+					const by = op.by[column];
+					if (by === void 0) return `${path} = if_not_exists(${path}, ${value(init[column])})`;
+					return `${path} = if_not_exists(${path}, ${value(Number(init[column] ?? 0))}) + ${value(by)}`;
+				}).join(", ")}`
+			}) };
 		}
 	}
-	if (additions.length > 0) update += ` ADD ${additions.join(", ")}`;
-	return { Update: {
-		TableName: store.tableName,
-		Key: itemKey("bundles", bundleId),
-		ConditionExpression: condition,
-		ExpressionAttributeNames: names,
-		ExpressionAttributeValues: values,
-		UpdateExpression: update
-	} };
-};
-const commitDynamoDBTransaction = async (store, actions) => {
-	if (actions.length > 100) throw new DynamoDBTransactionLimitError(actions.length);
-	await store.client.send(new _aws_sdk_lib_dynamodb.TransactWriteCommand({ TransactItems: [...actions] }));
-};
-const DYNAMODB_BATCH_GET_ATTEMPTS = 5;
-const DYNAMODB_BATCH_GET_BASE_DELAY_MS = 25;
-var DynamoDBBatchGetExhaustedError = class extends Error {
-	name = "DynamoDBBatchGetExhaustedError";
-	constructor(unprocessedKeyCount) {
-		super(`DynamoDB did not process ${unprocessedKeyCount} batch-get keys after ${DYNAMODB_BATCH_GET_ATTEMPTS} attempts`);
-		this.unprocessedKeyCount = unprocessedKeyCount;
-	}
 };
-const waitBeforeRetry = (attempt) => new Promise((resolve) => setTimeout(resolve, DYNAMODB_BATCH_GET_BASE_DELAY_MS * 2 ** attempt));
-const batchGetDynamoDBItems = async (store, keys) => {
-	const items = [];
-	for (let offset = 0; offset < keys.length; offset += 100) {
-		let pending = keys.slice(offset, offset + 100);
-		for (let attempt = 0; attempt < DYNAMODB_BATCH_GET_ATTEMPTS && pending.length > 0; attempt++) {
-			const { Responses, UnprocessedKeys } = await store.client.send(new _aws_sdk_lib_dynamodb.BatchGetCommand({ RequestItems: { [store.tableName]: {
-				ConsistentRead: true,
-				Keys: pending
-			} } }));
-			items.push(...Responses?.[store.tableName] ?? []);
-			pending = UnprocessedKeys?.[store.tableName]?.Keys ?? [];
-			if (pending.length > 0 && attempt + 1 < DYNAMODB_BATCH_GET_ATTEMPTS) await waitBeforeRetry(attempt);
-		}
-		if (pending.length > 0) throw new DynamoDBBatchGetExhaustedError(pending.length);
-	}
-	return items;
-};
-const parseKeyReadItem = (item) => parseDynamoDBItem(boundedDynamoDBMetadataItem(item));
-const loadBundleItemsById = async (store, ids) => {
-	const uniqueIds = [...new Set(ids)];
-	if (uniqueIds.length === 0) return [];
-	return (await batchGetDynamoDBItems(store, uniqueIds.map((id) => itemKey("bundles", id)))).map(parseKeyReadItem).filter((item) => item.pk === "bundles");
-};
-const loadPatchItemsById = async (store, ids) => {
-	const uniqueIds = [...new Set(ids)];
-	if (uniqueIds.length === 0) return [];
-	return (await batchGetDynamoDBItems(store, uniqueIds.map((id) => itemKey("bundle_patches", id)))).map(parseKeyReadItem).filter((item) => item.pk === "bundle_patches");
-};
-const loadMetadataCount = async (store, model) => {
-	if (model !== "bundles" && model !== "bundle_patches") return void 0;
-	const field = model === "bundles" ? "bundles" : "patches";
-	const { Item } = await store.client.send(new _aws_sdk_lib_dynamodb.GetCommand({
-		TableName: store.tableName,
-		Key: {
-			pk: "_hot-updater",
-			sk: "limits.metadata"
-		},
-		ConsistentRead: true,
-		ProjectionExpression: "#count",
-		ExpressionAttributeNames: { "#count": field }
-	}));
-	const count = Item?.[field];
-	return typeof count === "number" && Number.isSafeInteger(count) && count >= 0 ? count : void 0;
-};
-var DynamoDBPatchIndexConsistencyError = class extends Error {
-	name = "DynamoDBPatchIndexConsistencyError";
-	constructor(bundleId, expectedCount) {
-		super(`DynamoDB patch index did not converge to ${expectedCount} rows for bundle "${bundleId}"`);
-		this.bundleId = bundleId;
-		this.expectedCount = expectedCount;
-	}
-};
-const waitForIndex = (attempt) => new Promise((resolve) => setTimeout(resolve, 20 * (attempt + 1)));
-const queryCompleteOwnerPatches = async (store, indexName, bundleId) => {
-	const owner = await loadBundleItem(store, bundleId);
-	if (!owner || owner.owned_patch_count === 0) return [];
-	for (let attempt = 0; attempt < 3; attempt++) {
-		const patchIds = await queryOwnerPatchIds(store, indexName, bundleId);
-		const patchIdSet = new Set(patchIds);
-		const patches = (await loadPatchItemsById(store, patchIds)).filter(({ row }) => row.bundle_id === bundleId);
-		if (patchIds.length === owner.owned_patch_count && patchIdSet.size === owner.owned_patch_count && patches.length === owner.owned_patch_count && patches.every(({ sk }) => patchIdSet.has(sk))) return patches.map(({ row }) => row).sort((left, right) => left.order_index - right.order_index || left.id.localeCompare(right.id));
-		if (attempt < 2) await waitForIndex(attempt);
-	}
-	throw new DynamoDBPatchIndexConsistencyError(bundleId, owner.owned_patch_count);
-};
-const queryCompleteOwnersPatches = async (store, indexName, bundleIds) => {
-	const owners = (await loadBundleItemsById(store, bundleIds)).filter(({ owned_patch_count }) => owned_patch_count > 0);
-	const firstOwner = owners[0];
-	if (!firstOwner) return [];
-	let failedOwner = firstOwner;
-	for (let attempt = 0; attempt < 3; attempt++) {
-		const candidateIdsByOwner = await Promise.all(owners.map(({ sk }) => queryOwnerPatchIds(store, indexName, sk)));
-		const patches = await loadPatchItemsById(store, candidateIdsByOwner.flat());
-		const patchesById = new Map(patches.map((patch) => [patch.sk, patch]));
-		const mismatchedOwner = owners.find((owner, ownerIndex) => {
-			const ids = candidateIdsByOwner[ownerIndex] ?? [];
-			const uniqueIds = new Set(ids);
-			return ids.length !== owner.owned_patch_count || uniqueIds.size !== owner.owned_patch_count || ids.some((id) => patchesById.get(id)?.row.bundle_id !== owner.sk);
-		});
-		if (!mismatchedOwner) return patches.map(({ row }) => row);
-		failedOwner = mismatchedOwner;
-		if (attempt < 2) await waitForIndex(attempt);
-	}
-	throw new DynamoDBPatchIndexConsistencyError(failedOwner.sk, failedOwner.owned_patch_count);
-};
-const createDynamoDBBundlePatchTable = (store, indexName) => ({ findByBundleIds: (bundleIds) => bundleIds.length === 0 ? Promise.resolve([]) : queryCompleteOwnersPatches(store, indexName, bundleIds) });
-const compare = (left, right) => {
-	if (typeof left === "number" && typeof right === "number") return left - right;
-	if (left == null) return right == null ? 0 : -1;
-	if (right == null) return 1;
-	return JSON.stringify(left).localeCompare(JSON.stringify(right));
-};
-const compareString = (actual, expected, mode, predicate) => {
-	if (typeof actual !== "string") return false;
-	return mode === "insensitive" ? predicate(actual.toLocaleLowerCase(), expected.toLocaleLowerCase()) : predicate(actual, expected);
-};
-const matchesCondition = (row, condition) => {
-	const actual = Reflect.get(row, condition.field);
-	const expected = Reflect.get(condition, "value");
-	switch (Reflect.get(condition, "operator") ?? "eq") {
-		case "eq": return typeof expected === "string" ? compareString(actual, expected, Reflect.get(condition, "mode"), (value, query) => value === query) : actual === expected;
-		case "ne":
-			if (actual == null) return false;
-			return typeof expected === "string" ? !compareString(actual, expected, Reflect.get(condition, "mode"), (value, query) => value === query) : actual !== expected;
-		case "gt": return actual != null && compare(actual, expected) > 0;
-		case "gte": return actual != null && compare(actual, expected) >= 0;
-		case "lt": return actual != null && compare(actual, expected) < 0;
-		case "lte": return actual != null && compare(actual, expected) <= 0;
-		case "in": return Array.isArray(expected) && expected.some((candidate) => candidate === actual);
-		case "not_in": return Array.isArray(expected) && (expected.length === 0 || actual != null && expected.every((candidate) => candidate !== actual));
-		case "contains": return typeof expected === "string" ? compareString(actual, expected, Reflect.get(condition, "mode"), (value, query) => value.includes(query)) : false;
-		case "starts_with": return typeof expected === "string" ? compareString(actual, expected, Reflect.get(condition, "mode"), (value, query) => value.startsWith(query)) : false;
-		case "ends_with": return typeof expected === "string" ? compareString(actual, expected, Reflect.get(condition, "mode"), (value, query) => value.endsWith(query)) : false;
-		default: return false;
-	}
-};
-const matchesDynamoDBWhere = (row, where) => {
-	if (!where || where.length === 0) return true;
-	let result = matchesCondition(row, where[0]);
-	for (const condition of where.slice(1)) {
-		const current = matchesCondition(row, condition);
-		result = condition.connector === "OR" ? result || current : result && current;
-	}
-	return result;
-};
-const compareRows = (left, right, orderBy) => {
-	for (const clause of orderBy) {
-		const leftValue = Reflect.get(left, clause.field);
-		const rightValue = Reflect.get(right, clause.field);
-		if (leftValue == null || rightValue == null) {
-			if (leftValue == null && rightValue == null) continue;
-			const nulls = clause.nulls ?? (clause.direction === "asc" ? "last" : "first");
-			const order = leftValue == null ? -1 : 1;
-			return nulls === "first" ? order : -order;
-		}
-		const order = compare(leftValue, rightValue);
-		if (order !== 0) return clause.direction === "asc" ? order : -order;
-	}
-	return 0;
-};
-const distinctKey = (row, distinctOn) => JSON.stringify(distinctOn.fields.map((field) => Reflect.get(row, field)));
-const queryDynamoDBRows = (rows, input) => {
-	const filtered = rows.filter((row) => matchesDynamoDBWhere(row, input.where));
-	const orderBy = input.orderBy;
-	const ordered = orderBy ? filtered.toSorted((left, right) => compareRows(left, right, orderBy)) : filtered;
-	const distinctOn = input.distinctOn;
-	const distinct = distinctOn ? (() => {
-		const seen = /* @__PURE__ */ new Set();
-		return ordered.filter((row) => {
-			const key = distinctKey(row, distinctOn);
-			if (seen.has(key)) return false;
-			seen.add(key);
-			return true;
-		});
-	})() : ordered;
-	const offset = input.offset ?? 0;
-	return distinct.slice(offset, offset + (input.limit ?? 100));
-};
-const countDistinctDynamoDBRows = (rows, fields) => {
-	if (fields === void 0) return rows.length;
-	return new Set(rows.map((row) => JSON.stringify(fields.map((field) => Reflect.get(row, field))))).size;
-};
-const createDynamoDBBundle = async (store, row) => {
-	const counter = metadataUpdate(store, { bundles: 1 });
-	if (!counter) return;
-	await commitDynamoDBTransaction(store, [counter, { Put: {
-		TableName: store.tableName,
-		Item: boundedDynamoDBMetadataItem(toDynamoDBBundleItem(row)),
-		ConditionExpression: "attribute_not_exists(#pk)",
-		ExpressionAttributeNames: { "#pk": "pk" }
-	} }]);
-};
-const createDynamoDBPatch = async (store, row) => {
-	const bundleIds = [...new Set([row.bundle_id, row.base_bundle_id])];
-	const counter = metadataUpdate(store, { bundle_patches: 1 });
-	if (!counter) return;
-	await commitDynamoDBTransaction(store, [
-		counter,
-		...bundleIds.map((bundleId) => updateBundleRelation(store, bundleId, 1, bundleId === row.bundle_id ? 1 : 0)),
-		{ Put: {
-			TableName: store.tableName,
-			Item: boundedDynamoDBMetadataItem(toDynamoDBPatchItem(row)),
-			ConditionExpression: "attribute_not_exists(#pk)",
-			ExpressionAttributeNames: { "#pk": "pk" }
-		} }
-	]);
-};
-const replaceDynamoDBBundle = async (store, current, row) => {
-	await store.client.send(new _aws_sdk_lib_dynamodb.PutCommand({
-		TableName: store.tableName,
-		Item: boundedDynamoDBMetadataItem(toDynamoDBBundleItem(row, current.version + 1, current.relation_count, current.owned_patch_count)),
-		ConditionExpression: "#version = :currentVersion",
-		ExpressionAttributeNames: { "#version": "version" },
-		ExpressionAttributeValues: { ":currentVersion": current.version }
-	}));
-};
-const deleteAction = (store, item) => ({ Delete: {
-	TableName: store.tableName,
-	Key: {
-		pk: item.pk,
-		sk: item.sk
-	},
-	ConditionExpression: "#version = :currentVersion",
-	ExpressionAttributeNames: { "#version": "version" },
-	ExpressionAttributeValues: { ":currentVersion": item.version }
-} });
-const deleteDynamoDBPatch = async (store, item) => {
-	const counter = metadataUpdate(store, { bundle_patches: -1 });
-	if (!counter) return;
-	await commitDynamoDBTransaction(store, [
-		counter,
-		...[...new Set([item.row.bundle_id, item.row.base_bundle_id])].map((id) => updateBundleRelation(store, id, -1, id === item.row.bundle_id ? -1 : 0)),
-		deleteAction(store, item)
-	]);
-};
-const deleteBundle = async (store, bundle, patches) => {
-	const counter = metadataUpdate(store, {
-		bundles: -1,
-		bundle_patches: -patches.length
-	});
-	if (!counter) return;
-	const otherEndpointCounts = /* @__PURE__ */ new Map();
-	for (const { row } of patches) for (const id of new Set([row.bundle_id, row.base_bundle_id])) {
-		if (id === bundle.sk) continue;
-		const current = otherEndpointCounts.get(id) ?? {
-			owned: 0,
-			relations: 0
-		};
-		otherEndpointCounts.set(id, {
-			owned: current.owned + (id === row.bundle_id ? 1 : 0),
-			relations: current.relations + 1
-		});
-	}
-	await commitDynamoDBTransaction(store, [
-		counter,
-		...[...otherEndpointCounts].map(([id, count]) => updateBundleRelation(store, id, -count.relations, -count.owned)),
-		...patches.map((patch) => deleteAction(store, patch)),
-		deleteAction(store, bundle)
-	]);
-};
-const deleteDynamoDBBundles = async (store, bundles, allPatches) => {
-	let patches = [...allPatches];
-	const versionIncrements = /* @__PURE__ */ new Map();
-	for (const originalBundle of bundles) {
-		const bundle = {
-			...originalBundle,
-			version: originalBundle.version + (versionIncrements.get(originalBundle.sk) ?? 0)
-		};
-		const related = patches.filter(({ row }) => row.bundle_id === bundle.sk || row.base_bundle_id === bundle.sk);
-		await deleteBundle(store, bundle, related);
-		const updatedBundleIds = new Set(related.flatMap(({ row }) => [row.bundle_id, row.base_bundle_id]));
-		updatedBundleIds.delete(bundle.sk);
-		for (const id of updatedBundleIds) versionIncrements.set(id, (versionIncrements.get(id) ?? 0) + 1);
-		const removedPatchIds = new Set(related.map(({ sk }) => sk));
-		patches = patches.filter(({ sk }) => !removedPatchIds.has(sk));
-	}
+/** Errors, and cancellation reasons, that a retry of the whole write can clear. */
+const TRANSIENT = /* @__PURE__ */ new Set([
+	"TransactionConflict",
+	"ThrottlingError",
+	"ProvisionedThroughputExceeded",
+	"RequestLimitExceeded",
+	"TransactionInProgressException",
+	"ProvisionedThroughputExceededException",
+	"ThrottlingException",
+	"InternalServerError"
+]);
+/** A missing table reads as one to the schema fence, like SQL's 42P01. */
+const missingTable = (error) => {
+	throw nameOf(error) === "ResourceNotFoundException" ? Object.assign(new Error(error.message, { cause: error }), { code: "42P01" }) : error;
 };
-var DynamoDBUnsupportedModelError = class extends Error {
-	name = "DynamoDBUnsupportedModelError";
-	constructor() {
-		super("DynamoDB received an unsupported database model");
-	}
-};
-const distinctFields = (fields) => fields;
-const exactDynamoDBField = (where, fieldName) => {
-	const conditions = (where ?? []).filter((condition) => Reflect.get(condition, "field") === fieldName);
-	if (conditions.length !== 1) return void 0;
-	const condition = conditions[0];
-	if ((Reflect.get(condition, "operator") ?? "eq") !== "eq" || Reflect.get(condition, "mode") === "insensitive") return;
-	const value = Reflect.get(condition, "value");
-	return typeof value === "string" ? value : void 0;
-};
-const createDynamoDBCrud = (store, updateIndexName) => ({
-	async create(input) {
-		switch (input.model) {
-			case "bundles":
-				await createDynamoDBBundle(store, input.data);
-				return input.data;
-			case "bundle_patches":
-				await createDynamoDBPatch(store, input.data);
-				return input.data;
-			case "releases": {
-				const channel = await loadChannelItem(store, input.data.channel_id);
-				if (channel === void 0) throw new DynamoDBStoredItemError();
-				await commitDynamoDBTransaction(store, [
-					updateChannelReferenceCount(store, channel, 1),
-					{ Put: {
-						TableName: store.tableName,
-						Item: boundedDynamoDBMetadataItem(toDynamoDBReleaseItem(input.data)),
-						ConditionExpression: "attribute_not_exists(#pk)",
-						ExpressionAttributeNames: { "#pk": "pk" }
-					} },
-					{ Put: {
-						TableName: store.tableName,
-						Item: releaseLocatorItem(input.data),
-						ConditionExpression: "attribute_not_exists(#pk)",
-						ExpressionAttributeNames: { "#pk": "pk" }
-					} }
-				]);
-				return input.data;
-			}
-			case "release_catalogs":
-				await store.client.send(new _aws_sdk_lib_dynamodb.PutCommand({
-					TableName: store.tableName,
-					Item: boundedDynamoDBCatalogItem(toDynamoDBReleaseCatalogItem(input.data)),
-					ConditionExpression: "attribute_not_exists(#pk)",
-					ExpressionAttributeNames: { "#pk": "pk" }
+/**
+* The key-value store over one DynamoDB table keyed by `pk` and `sk`, with
+* no secondary index. Reads are strongly consistent; a write is one
+* `TransactWriteItems` with a client request token.
+*/
+const createDynamoDBStore = ({ client, tableName, nativePageSize }) => {
+	const documents = _aws_sdk_lib_dynamodb.DynamoDBDocumentClient.from(client, { marshallOptions: { removeUndefinedValues: true } });
+	return {
+		id: "dynamoDB",
+		limits: DYNAMODB_LIMITS,
+		async get(keys) {
+			const found = /* @__PURE__ */ new Map();
+			const unique = [...new Map(keys.map((key) => [idOf(key), key])).values()];
+			for (let at = 0; at < unique.length; at += GET_BATCH) {
+				let pending = unique.slice(at, at + GET_BATCH).map(({ pk, sk }) => ({
+					pk,
+					sk
 				}));
-				return input.data;
-			case "channels": return (await insertDynamoDBChannel(store, {
-				row: input.data,
-				onConflict: "returnExisting"
-			})).row;
-		}
-		throw new DynamoDBUnsupportedModelError();
-	},
-	async update(input) {
-		if (input.model === "releases") {
-			const id = exactDynamoDBId(input.where);
-			if (id === void 0) throw new DynamoDBUnsupportedModelError();
-			const current = await loadReleaseItem(store, id);
-			if (current === void 0) return null;
-			const updated = {
-				...current.row,
-				...input.update
-			};
-			const nextPartition = releaseScopePartition(updated.scope_key);
-			const moved = current.pk !== nextPartition;
-			await commitDynamoDBTransaction(store, [
-				...moved ? [{ Delete: {
-					TableName: store.tableName,
-					Key: {
-						pk: current.pk,
-						sk: current.sk
-					},
-					ConditionExpression: "#version = :version",
-					ExpressionAttributeNames: { "#version": "version" },
-					ExpressionAttributeValues: { ":version": current.version }
-				} }] : [],
-				{ Put: {
-					TableName: store.tableName,
-					Item: boundedDynamoDBMetadataItem(toDynamoDBReleaseItem(updated, current.version + 1)),
-					ConditionExpression: moved ? "attribute_not_exists(#pk)" : "#version = :version",
-					ExpressionAttributeNames: moved ? { "#pk": "pk" } : { "#version": "version" },
-					...moved ? {} : { ExpressionAttributeValues: { ":version": current.version } }
-				} },
-				{ Put: {
-					TableName: store.tableName,
-					Item: releaseLocatorItem(updated),
-					ConditionExpression: "#scopeKey = :scopeKey",
-					ExpressionAttributeNames: { "#scopeKey": "scope_key" },
-					ExpressionAttributeValues: { ":scopeKey": current.row.scope_key }
-				} }
-			]);
-			return updated;
-		}
-		if (input.model === "release_catalogs") {
-			const scopeKey = exactDynamoDBField(input.where, "scope_key");
-			if (scopeKey === void 0) throw new DynamoDBUnsupportedModelError();
-			const current = await loadReleaseCatalogItem(store, scopeKey);
-			if (current === void 0) return null;
-			const updated = {
-				...current.row,
-				...input.update
-			};
-			await store.client.send(new _aws_sdk_lib_dynamodb.PutCommand({
-				TableName: store.tableName,
-				Item: boundedDynamoDBCatalogItem(toDynamoDBReleaseCatalogItem(updated, current.version + 1)),
-				ConditionExpression: "#version = :version",
-				ExpressionAttributeNames: { "#version": "version" },
-				ExpressionAttributeValues: { ":version": current.version }
-			}));
-			return updated;
-		}
-		if (input.model !== "bundles") throw new DynamoDBUnsupportedModelError();
-		const id = exactDynamoDBId(input.where);
-		const current = id === void 0 ? (await loadBundleItems(store)).find(({ row }) => matchesDynamoDBWhere(row, input.where)) : await loadBundleItem(store, id);
-		if (!current) return null;
-		const updated = {
-			...current.row,
-			...input.update
-		};
-		await replaceDynamoDBBundle(store, current, updated);
-		return updated;
-	},
-	async delete(input) {
-		if (input.model === "channels") {
-			const id = exactDynamoDBId(input.where);
-			if (id !== void 0) await deleteDynamoDBChannel(store, { id });
-			return;
-		}
-		if (input.model === "bundle_patches") {
-			const items = (await loadPatchItems(store)).filter(({ row }) => matchesDynamoDBWhere(row, input.where));
-			for (const item of items) await deleteDynamoDBPatch(store, item);
-			return;
-		}
-		if (input.model === "releases") {
-			const items = (await loadReleaseItems(store)).filter(({ row }) => matchesDynamoDBWhere(row, input.where));
-			for (const item of items) {
-				const channel = await loadChannelItem(store, item.row.channel_id);
-				if (channel === void 0) throw new DynamoDBStoredItemError();
-				await commitDynamoDBTransaction(store, [
-					updateChannelReferenceCount(store, channel, -1),
-					deleteAction(store, item),
-					{ Delete: {
-						TableName: store.tableName,
-						Key: {
-							pk: DYNAMODB_RELEASE_ID_PARTITION,
-							sk: item.sk
-						},
-						ConditionExpression: "#scopeKey = :scopeKey",
-						ExpressionAttributeNames: { "#scopeKey": "scope_key" },
-						ExpressionAttributeValues: { ":scopeKey": item.row.scope_key }
-					} }
-				]);
-			}
-			return;
-		}
-		if (input.model !== "bundles") throw new DynamoDBUnsupportedModelError();
-		const bundleItems = (await loadBundleItems(store)).filter(({ row }) => matchesDynamoDBWhere(row, input.where));
-		if (bundleItems.length === 0) return;
-		await deleteDynamoDBBundles(store, bundleItems, await loadPatchItems(store));
-	},
-	async count(input) {
-		if ((input.where === void 0 || input.where.length === 0) && input.distinct === void 0) {
-			const count = await loadMetadataCount(store, input.model);
-			if (count !== void 0) return count;
-		}
-		switch (input.model) {
-			case "bundles": return countDistinctDynamoDBRows((await loadBundleItems(store)).map(({ row }) => row).filter((row) => matchesDynamoDBWhere(row, input.where)), distinctFields(input.distinct));
-			case "bundle_patches": {
-				const ownerId = exactDynamoDBPatchOwner(input.where);
-				return countDistinctDynamoDBRows((ownerId ? await queryCompleteOwnerPatches(store, updateIndexName, ownerId) : (await loadPatchItems(store)).map(({ row }) => row)).filter((row) => matchesDynamoDBWhere(row, input.where)), distinctFields(input.distinct));
-			}
-			case "releases": {
-				const scopeKey = exactDynamoDBField(input.where, "scope_key");
-				return countDistinctDynamoDBRows((scopeKey === void 0 ? await loadReleaseItems(store) : await loadReleaseItemsByScope(store, scopeKey)).map(({ row }) => row).filter((row) => matchesDynamoDBWhere(row, input.where)), distinctFields(input.distinct));
-			}
-		}
-		throw new DynamoDBUnsupportedModelError();
-	},
-	async findOne(input) {
-		const id = exactDynamoDBId(input.where);
-		switch (input.model) {
-			case "bundles":
-				if (id !== void 0) return (await loadBundleItem(store, id))?.row ?? null;
-				return (await loadBundleItems(store)).map(({ row }) => row).find((row) => matchesDynamoDBWhere(row, input.where)) ?? null;
-			case "bundle_patches":
-				if (id !== void 0) return (await loadPatchItem(store, id))?.row ?? null;
-				{
-					const ownerId = exactDynamoDBPatchOwner(input.where);
-					if (ownerId === void 0) break;
-					return (await queryCompleteOwnerPatches(store, updateIndexName, ownerId)).find((row) => matchesDynamoDBWhere(row, input.where)) ?? null;
-				}
-				break;
-			case "channels":
-				if (id !== void 0) return (await loadChannelItem(store, id))?.row ?? null;
-				return (await loadChannelItems(store)).map(({ row }) => row).find((row) => matchesDynamoDBWhere(row, input.where)) ?? null;
-			case "releases":
-				if (id !== void 0) return (await loadReleaseItem(store, id))?.row ?? null;
-				{
-					const scopeKey = exactDynamoDBField(input.where, "scope_key");
-					return (scopeKey === void 0 ? await loadReleaseItems(store) : await loadReleaseItemsByScope(store, scopeKey)).map(({ row }) => row).find((row) => matchesDynamoDBWhere(row, input.where)) ?? null;
-				}
-			case "release_catalogs": {
-				const scopeKey = exactDynamoDBField(input.where, "scope_key");
-				if (scopeKey !== void 0) return (await loadReleaseCatalogItem(store, scopeKey))?.row ?? null;
-				return (await loadReleaseCatalogItems(store)).map(({ row }) => row).find((row) => matchesDynamoDBWhere(row, input.where)) ?? null;
-			}
-		}
-		if (input.model === "bundle_patches") return (await loadPatchItems(store)).map(({ row }) => row).find((row) => matchesDynamoDBWhere(row, input.where)) ?? null;
-		throw new DynamoDBUnsupportedModelError();
-	},
-	async findMany(input) {
-		if (input.limit === 0) return [];
-		switch (input.model) {
-			case "bundles": {
-				const ids = exactDynamoDBBundleIds(input.where);
-				if (ids !== void 0) return queryDynamoDBRows((await loadBundleItemsById(store, ids)).map(({ row }) => row), input);
-				const orderBy = input.orderBy;
-				const direction = orderBy?.[0]?.direction;
-				if ((input.offset ?? 0) === 0 && input.distinctOn === void 0 && orderBy?.length === 1 && orderBy[0]?.field === "id" && (direction === "asc" || direction === "desc")) return (await queryBundleItemsPage(store, {
-					direction,
-					limit: input.limit ?? 100,
-					matches: (row) => matchesDynamoDBWhere(row, input.where),
-					start: dynamoDBBundlePageStart(input.where, direction)
-				})).map(({ row }) => row);
-				return queryDynamoDBRows((await loadBundleItems(store)).map(({ row }) => row), input);
-			}
-			case "bundle_patches": {
-				const ownerIds = exactDynamoDBPatchOwners(input.where);
-				if (ownerIds !== void 0) {
-					const ownerId = ownerIds.length === 1 ? ownerIds[0] : void 0;
-					return queryDynamoDBRows(ownerId !== void 0 ? await queryCompleteOwnerPatches(store, updateIndexName, ownerId) : await queryCompleteOwnersPatches(store, updateIndexName, ownerIds), input);
+				for (let round = 0; pending.length > 0; round += 1) {
+					if (round > 0) await sleep(2 ** round * 10);
+					const result = await documents.send(new _aws_sdk_lib_dynamodb.BatchGetCommand({ RequestItems: { [tableName]: {
+						Keys: pending,
+						ConsistentRead: true
+					} } })).catch(missingTable);
+					for (const item of result.Responses?.[tableName] ?? []) found.set(idOf(item), toRow(item));
+					pending = result.UnprocessedKeys?.[tableName]?.Keys ?? [];
 				}
-				return queryDynamoDBRows((await loadPatchItems(store)).map(({ row }) => row), input);
-			}
-			case "channels": return queryDynamoDBRows((await loadChannelItems(store)).map(({ row }) => row), input);
-			case "releases": {
-				const scopeKey = exactDynamoDBField(input.where, "scope_key");
-				return queryDynamoDBRows((scopeKey === void 0 ? await loadReleaseItems(store) : await loadReleaseItemsByScope(store, scopeKey)).map(({ row }) => row), input);
 			}
-			case "release_catalogs": return queryDynamoDBRows((await loadReleaseCatalogItems(store)).map(({ row }) => row), input);
-		}
-		throw new DynamoDBUnsupportedModelError();
-	},
-	insertChannel: (input) => insertDynamoDBChannel(store, input),
-	deleteChannel: (input) => deleteDynamoDBChannel(store, input)
-});
-var DynamoDBDuplicatePatchError = class extends Error {
-	name = "DynamoDBDuplicatePatchError";
-	constructor(patchId) {
-		super(`DynamoDB bundle mutation contains duplicate patch "${patchId}"`);
-		this.patchId = patchId;
-	}
-};
-const putNewBundle = (store, row, relationCount, ownedPatchCount = relationCount) => ({ Put: {
-	TableName: store.tableName,
-	Item: boundedDynamoDBMetadataItem(toDynamoDBBundleItem(row, 1, relationCount, ownedPatchCount)),
-	ConditionExpression: "attribute_not_exists(#pk)",
-	ExpressionAttributeNames: { "#pk": "pk" }
-} });
-const putUpdatedBundle = (store, current, row, relationCount, ownedPatchCount) => ({ Put: {
-	TableName: store.tableName,
-	Item: boundedDynamoDBMetadataItem(toDynamoDBBundleItem(row, current.version + 1, relationCount, ownedPatchCount)),
-	ConditionExpression: "#version = :currentVersion",
-	ExpressionAttributeNames: { "#version": "version" },
-	ExpressionAttributeValues: { ":currentVersion": current.version }
-} });
-const putPatch = (store, row, current) => ({ Put: {
-	TableName: store.tableName,
-	Item: boundedDynamoDBMetadataItem(toDynamoDBPatchItem(row, (current?.version ?? 0) + 1)),
-	ConditionExpression: current ? "#version = :currentVersion" : "attribute_not_exists(#pk)",
-	ExpressionAttributeNames: current ? { "#version": "version" } : { "#pk": "pk" },
-	...current ? { ExpressionAttributeValues: { ":currentVersion": current.version } } : {}
-} });
-const deletePatch = (store, item) => ({ Delete: {
-	TableName: store.tableName,
-	Key: itemKey(item.pk, item.sk),
-	ConditionExpression: "#version = :currentVersion",
-	ExpressionAttributeNames: { "#version": "version" },
-	ExpressionAttributeValues: { ":currentVersion": item.version }
-} });
-var DynamoDBCommitStateError = class extends Error {
-	name = "DynamoDBCommitStateError";
-	constructor(message) {
-		super(message);
-	}
-};
-const rowsEqual = (left, right) => JSON.stringify(left) === JSON.stringify(right);
-const putChannel = (store, row, current, referenceCount) => ({ Put: {
-	TableName: store.tableName,
-	Item: boundedDynamoDBMetadataItem(toDynamoDBChannelItem(row, (current?.version ?? 0) + 1, referenceCount)),
-	ConditionExpression: current ? "#version = :version" : "attribute_not_exists(#pk)",
-	ExpressionAttributeNames: current ? { "#version": "version" } : { "#pk": "pk" },
-	...current ? { ExpressionAttributeValues: { ":version": current.version } } : {}
-} });
-const deleteChannelActions = (store, current) => [{ Delete: {
-	TableName: store.tableName,
-	Key: itemKey(DYNAMODB_CHANNEL_PARTITION, current.sk),
-	ConditionExpression: "#version = :version",
-	ExpressionAttributeNames: { "#version": "version" },
-	ExpressionAttributeValues: { ":version": current.version }
-} }, { Delete: {
-	TableName: store.tableName,
-	Key: {
-		pk: DYNAMODB_CHANNEL_NAME_PARTITION,
-		sk: current.row.name
-	},
-	ConditionExpression: "#channelId = :channelId",
-	ExpressionAttributeNames: { "#channelId": "channel_id" },
-	ExpressionAttributeValues: { ":channelId": current.sk }
-} }];
-const updateChannelReferenceCount = (store, current, delta) => ({ Update: {
-	TableName: store.tableName,
-	Key: itemKey(DYNAMODB_CHANNEL_PARTITION, current.sk),
-	ConditionExpression: "#row.#name = :name" + (delta < 0 ? " AND #referenceCount >= :removal" : ""),
-	UpdateExpression: "SET #version = #version + :one ADD #referenceCount :delta",
-	ExpressionAttributeNames: {
-		"#row": "row",
-		"#name": "name",
-		"#version": "version",
-		"#referenceCount": "reference_count"
-	},
-	ExpressionAttributeValues: {
-		":name": current.row.name,
-		":one": 1,
-		":delta": delta,
-		...delta < 0 ? { ":removal": -delta } : {}
-	}
-} });
-const loadApiKeyByHash = async (store, hash) => {
-	const { Item } = await store.client.send(new _aws_sdk_lib_dynamodb.GetCommand({
-		TableName: store.tableName,
-		Key: {
-			pk: DYNAMODB_API_KEY_HASH_PARTITION,
-			sk: hash
+			return keys.map((key) => found.get(idOf(key)) ?? null);
 		},
-		ConsistentRead: true
-	}));
-	if (Item === void 0) return null;
-	const id = Item.api_key_id;
-	if (typeof id !== "string") throw new DynamoDBStoredItemError();
-	return loadApiKey(store, id);
-};
-const compileAndCommitDynamoDBChanges = async (store, input) => {
-	const [originalBundleItems, originalPatchItems, originalChannelItems, originalReleaseItems, originalReleaseCatalogItems] = await Promise.all([
-		loadBundleItems(store),
-		loadPatchItems(store),
-		loadChannelItems(store),
-		loadReleaseItems(store),
-		loadReleaseCatalogItems(store)
-	]);
-	const bundles = new Map(originalBundleItems.map(({ sk, row }) => [sk, row]));
-	const patches = new Map(originalPatchItems.map(({ sk, row }) => [sk, row]));
-	const channels = new Map(originalChannelItems.map(({ sk, row }) => [sk, row]));
-	const channelNames = new Map(originalChannelItems.map(({ sk, row }) => [row.name, sk]));
-	const releases = new Map(originalReleaseItems.map(({ sk, row }) => [sk, row]));
-	const releaseCatalogs = new Map(originalReleaseCatalogItems.map(({ sk, row }) => [sk, row]));
-	const originalApiKeys = /* @__PURE__ */ new Map();
-	const apiKeys = /* @__PURE__ */ new Map();
-	const apiKeyHashes = /* @__PURE__ */ new Map();
-	const insights = /* @__PURE__ */ new Map();
-	const rememberApiKey = (value) => {
-		if (value === null || apiKeys.has(value.row.id)) return;
-		originalApiKeys.set(value.row.id, value);
-		apiKeys.set(value.row.id, value);
-		apiKeyHashes.set(value.row.hash, value.row.id);
-	};
-	const requireReleaseReferences = (row) => {
-		if (!channels.has(row.channel_id)) throw new DynamoDBCommitStateError(`Release "${row.id}" references an invalid channel`);
-		if (row.bundle_id !== null) {
-			const bundle = bundles.get(row.bundle_id);
-			if (bundle === void 0 || bundle.platform !== row.platform) throw new DynamoDBCommitStateError(`Release "${row.id}" references an invalid bundle`);
-		}
-	};
-	for (const expectation of input.expectations ?? []) {
-		const actualVersion = expectation.model === "releases" ? releases.get(expectation.id)?.revision ?? null : releaseCatalogs.get(expectation.scopeKey)?.generation ?? null;
-		const expectedVersion = expectation.model === "releases" ? expectation.revision : expectation.generation;
-		if (actualVersion !== expectedVersion) return {
-			committed: false,
-			conflict: {
-				actualVersion,
-				changeIndex: -1,
-				expectedVersion,
-				key: expectation.model === "releases" ? expectation.id : expectation.scopeKey,
-				model: expectation.model,
-				reason: "version_conflict"
-			}
-		};
-	}
-	for (const [changeIndex, change] of input.changes.entries()) switch (change.model) {
-		case "channels":
-			if (change.operation === "insert") {
-				if (channelNames.get(change.row.name) !== void 0) break;
-				if (channels.get(change.row.id) !== void 0) throw new DynamoDBCommitStateError(`Channel id "${change.row.id}" already exists`);
-				channels.set(change.row.id, change.row);
-				channelNames.set(change.row.name, change.row.id);
-			} else {
-				const current = channels.get(change.where.id);
-				if (current === void 0) break;
-				if ([...releases.values()].some(({ channel_id }) => channel_id === change.where.id)) return {
-					committed: false,
-					conflict: {
-						changeIndex,
-						reason: "referenced"
-					}
-				};
-				channels.delete(change.where.id);
-				channelNames.delete(current.name);
-			}
-			break;
-		case "bundles":
-			if (change.operation === "insert") {
-				if (bundles.has(change.row.id)) throw new DynamoDBCommitStateError(`Bundle "${change.row.id}" already exists`);
-				bundles.set(change.row.id, change.row);
-			} else {
-				const current = bundles.get(change.where.id);
-				if (current === void 0) {
-					if (change.operation === "update") return {
-						committed: false,
-						conflict: {
-							changeIndex,
-							reason: "not_found"
-						}
-					};
-					break;
-				}
-				if (change.operation === "update") {
-					const row = {
-						...current,
-						...change.update
-					};
-					bundles.set(row.id, row);
-				} else {
-					if ([...releases.values()].some(({ bundle_id }) => bundle_id === change.where.id)) return {
-						committed: false,
-						conflict: {
-							changeIndex,
-							reason: "referenced"
-						}
-					};
-					bundles.delete(change.where.id);
-					for (const [id, patch] of patches) if (patch.bundle_id === change.where.id || patch.base_bundle_id === change.where.id) patches.delete(id);
-				}
-			}
-			break;
-		case "releases":
-			if (change.operation === "insert") {
-				requireReleaseReferences(change.row);
-				if (releases.has(change.row.id)) throw new DynamoDBCommitStateError(`Release "${change.row.id}" already exists`);
-				releases.set(change.row.id, change.row);
-			} else {
-				const current = releases.get(change.where.id);
-				if (current === void 0) {
-					if (change.operation === "update") return {
-						committed: false,
-						conflict: {
-							changeIndex,
-							reason: "not_found"
-						}
-					};
-					break;
-				}
-				if (change.operation === "update") {
-					const row = {
-						...current,
-						...change.update
-					};
-					requireReleaseReferences(row);
-					releases.set(row.id, row);
-				} else releases.delete(change.where.id);
-			}
-			break;
-		case "releaseCatalogs":
-			if (!channels.has(change.row.channel_id)) throw new DynamoDBCommitStateError(`Release catalog "${change.row.scope_key}" references an invalid channel`);
-			releaseCatalogs.set(change.row.scope_key, change.row);
-			break;
-		case "bundlePatches":
-			if (change.operation === "insert") {
-				if (!bundles.has(change.row.bundle_id) || !bundles.has(change.row.base_bundle_id)) throw new DynamoDBCommitStateError(`Patch "${change.row.id}" references a missing bundle`);
-				if (patches.has(change.row.id)) throw new DynamoDBDuplicatePatchError(change.row.id);
-				patches.set(change.row.id, change.row);
-			} else for (const [id, patch] of patches) if (patch.bundle_id === change.where.bundleId) patches.delete(id);
-			break;
-		case "insights": {
-			const key = insightsSortKey(change.row);
-			if (insights.has(key)) throw new DynamoDBCommitStateError(`Insights event "${change.row.id}" is duplicated`);
-			insights.set(key, change.row);
-			break;
-		}
-		case "apiKeys":
-			if (change.operation === "insert") {
-				rememberApiKey(await loadApiKeyByHash(store, change.row.hash));
-				if (apiKeyHashes.has(change.row.hash)) break;
-				rememberApiKey(await loadApiKey(store, change.row.id));
-				if (apiKeys.has(change.row.id)) throw new DynamoDBCommitStateError(`API key id "${change.row.id}" already exists`);
-				const inserted = {
-					row: change.row,
-					version: 1
-				};
-				apiKeys.set(change.row.id, inserted);
-				apiKeyHashes.set(change.row.hash, change.row.id);
-			} else {
-				rememberApiKey(await loadApiKey(store, change.where.id));
-				const current = apiKeys.get(change.where.id);
-				if (current === void 0) return {
-					committed: false,
-					conflict: {
-						changeIndex,
-						reason: "not_found"
-					}
-				};
-				apiKeys.set(change.where.id, {
-					row: {
-						...current.row,
-						revoked_at_ms: change.update.revokedAtMs
-					},
-					version: current.version
-				});
-			}
-			break;
-	}
-	const relationCounts = /* @__PURE__ */ new Map();
-	const ownedPatchCounts = /* @__PURE__ */ new Map();
-	for (const patch of patches.values()) {
-		for (const id of new Set([patch.bundle_id, patch.base_bundle_id])) relationCounts.set(id, (relationCounts.get(id) ?? 0) + 1);
-		ownedPatchCounts.set(patch.bundle_id, (ownedPatchCounts.get(patch.bundle_id) ?? 0) + 1);
-	}
-	const channelReferenceCounts = /* @__PURE__ */ new Map();
-	for (const release of releases.values()) channelReferenceCounts.set(release.channel_id, (channelReferenceCounts.get(release.channel_id) ?? 0) + 1);
-	const actions = [];
-	const originalChannels = new Map(originalChannelItems.map((item) => [item.sk, item]));
-	for (const original of originalChannelItems) if (!channels.has(original.sk)) actions.push(...deleteChannelActions(store, original));
-	for (const [id, row] of channels) {
-		const original = originalChannels.get(id);
-		const referenceCount = channelReferenceCounts.get(id) ?? 0;
-		if (original === void 0) {
-			actions.push(putChannel(store, row, original, referenceCount));
-			actions.push({ Put: {
-				TableName: store.tableName,
-				Item: {
-					pk: DYNAMODB_CHANNEL_NAME_PARTITION,
-					sk: row.name,
-					channel_id: id
-				},
-				ConditionExpression: "attribute_not_exists(#pk)",
-				ExpressionAttributeNames: { "#pk": "pk" }
-			} });
-		} else {
-			if (!rowsEqual(original.row, row)) throw new DynamoDBCommitStateError(`Channel "${id}" cannot be updated`);
-			const delta = referenceCount - original.reference_count;
-			if (delta !== 0) actions.push(updateChannelReferenceCount(store, original, delta));
-		}
-	}
-	const originalBundles = new Map(originalBundleItems.map((item) => [item.sk, item]));
-	for (const original of originalBundleItems) if (!bundles.has(original.sk)) actions.push(deleteAction(store, original));
-	for (const [id, row] of bundles) {
-		const original = originalBundles.get(id);
-		const relationCount = relationCounts.get(id) ?? 0;
-		const ownedPatchCount = ownedPatchCounts.get(id) ?? 0;
-		if (original === void 0) actions.push(putNewBundle(store, row, relationCount, ownedPatchCount));
-		else if (!rowsEqual(original.row, row)) actions.push(putUpdatedBundle(store, original, row, relationCount, ownedPatchCount));
-		else {
-			const relationDelta = relationCount - original.relation_count;
-			const ownedPatchDelta = ownedPatchCount - original.owned_patch_count;
-			if (relationDelta !== 0 || ownedPatchDelta !== 0) actions.push(updateBundleRelation(store, id, relationDelta, ownedPatchDelta));
-		}
-	}
-	const originalPatches = new Map(originalPatchItems.map((item) => [item.sk, item]));
-	for (const original of originalPatchItems) if (!patches.has(original.sk)) actions.push(deletePatch(store, original));
-	for (const [id, row] of patches) {
-		const original = originalPatches.get(id);
-		if (original === void 0 || !rowsEqual(original.row, row)) actions.push(putPatch(store, row, original));
-	}
-	const originalReleases = new Map(originalReleaseItems.map((item) => [item.sk, item]));
-	for (const original of originalReleaseItems) {
-		if (releases.get(original.sk) !== void 0) continue;
-		actions.push(deleteAction(store, original));
-		actions.push({ Delete: {
-			TableName: store.tableName,
-			Key: {
-				pk: DYNAMODB_RELEASE_ID_PARTITION,
-				sk: original.sk
-			},
-			ConditionExpression: "#scopeKey = :scopeKey",
-			ExpressionAttributeNames: { "#scopeKey": "scope_key" },
-			ExpressionAttributeValues: { ":scopeKey": original.row.scope_key }
-		} });
-	}
-	for (const [id, row] of releases) {
-		const original = originalReleases.get(id);
-		if (original === void 0) {
-			actions.push({ Put: {
-				TableName: store.tableName,
-				Item: boundedDynamoDBMetadataItem(toDynamoDBReleaseItem(row)),
-				ConditionExpression: "attribute_not_exists(#pk)",
-				ExpressionAttributeNames: { "#pk": "pk" }
-			} });
-			actions.push({ Put: {
-				TableName: store.tableName,
-				Item: releaseLocatorItem(row),
-				ConditionExpression: "attribute_not_exists(#pk)",
-				ExpressionAttributeNames: { "#pk": "pk" }
-			} });
-		} else if (!rowsEqual(original.row, row)) {
-			const moved = original.row.scope_key !== row.scope_key;
-			if (moved) actions.push(deleteAction(store, original));
-			actions.push({ Put: {
-				TableName: store.tableName,
-				Item: boundedDynamoDBMetadataItem(toDynamoDBReleaseItem(row, original.version + 1)),
-				ConditionExpression: moved ? "attribute_not_exists(#pk)" : "#version = :version",
-				ExpressionAttributeNames: moved ? { "#pk": "pk" } : { "#version": "version" },
-				...moved ? {} : { ExpressionAttributeValues: { ":version": original.version } }
-			} });
-			if (moved) actions.push({ Put: {
-				TableName: store.tableName,
-				Item: releaseLocatorItem(row),
-				ConditionExpression: "#scopeKey = :scopeKey",
-				ExpressionAttributeNames: { "#scopeKey": "scope_key" },
-				ExpressionAttributeValues: { ":scopeKey": original.row.scope_key }
-			} });
-		}
-	}
-	const originalReleaseCatalogs = new Map(originalReleaseCatalogItems.map((item) => [item.sk, item]));
-	for (const [scopeKey, row] of releaseCatalogs) {
-		const original = originalReleaseCatalogs.get(scopeKey);
-		if (original === void 0 || !rowsEqual(original.row, row)) actions.push({ Put: {
-			TableName: store.tableName,
-			Item: boundedDynamoDBCatalogItem(toDynamoDBReleaseCatalogItem(row, (original?.version ?? 0) + 1)),
-			ConditionExpression: original ? "#version = :version" : "attribute_not_exists(#pk)",
-			ExpressionAttributeNames: original ? { "#version": "version" } : { "#pk": "pk" },
-			...original ? { ExpressionAttributeValues: { ":version": original.version } } : {}
-		} });
-	}
-	const changedReleaseIds = new Set([...new Set([...originalReleases.keys(), ...releases.keys()])].filter((id) => {
-		const original = originalReleases.get(id)?.row;
-		const next = releases.get(id);
-		return original === void 0 || next === void 0 || !rowsEqual(original, next);
-	}));
-	const changedCatalogScopes = new Set([...releaseCatalogs].flatMap(([scopeKey, row]) => {
-		const original = originalReleaseCatalogs.get(scopeKey)?.row;
-		return original === void 0 || !rowsEqual(original, row) ? [scopeKey] : [];
-	}));
-	for (const expectation of input.expectations ?? []) {
-		if (expectation.model === "releases" && !changedReleaseIds.has(expectation.id)) {
-			const original = originalReleases.get(expectation.id);
-			actions.push({ ConditionCheck: {
-				TableName: store.tableName,
-				Key: original === void 0 ? {
-					pk: DYNAMODB_RELEASE_ID_PARTITION,
-					sk: expectation.id
-				} : {
-					pk: original.pk,
-					sk: original.sk
-				},
-				ConditionExpression: original === void 0 ? "attribute_not_exists(#pk)" : "#version = :version",
-				ExpressionAttributeNames: original === void 0 ? { "#pk": "pk" } : { "#version": "version" },
-				...original === void 0 ? {} : { ExpressionAttributeValues: { ":version": original.version } }
-			} });
-		}
-		if (expectation.model === "releaseCatalogs" && !changedCatalogScopes.has(expectation.scopeKey)) {
-			const original = originalReleaseCatalogs.get(expectation.scopeKey);
-			actions.push({ ConditionCheck: {
-				TableName: store.tableName,
-				Key: itemKey("release_catalogs", expectation.scopeKey),
-				ConditionExpression: original === void 0 ? "attribute_not_exists(#pk)" : "#version = :version",
-				ExpressionAttributeNames: original === void 0 ? { "#pk": "pk" } : { "#version": "version" },
-				...original === void 0 ? {} : { ExpressionAttributeValues: { ":version": original.version } }
-			} });
-		}
-	}
-	const counter = metadataUpdate(store, {
-		bundles: bundles.size - originalBundles.size,
-		bundle_patches: patches.size - originalPatches.size
-	});
-	if (counter !== void 0) actions.push(counter);
-	for (const [key, row] of insights) actions.push({ Put: {
-		TableName: store.tableName,
-		Item: boundedDynamoDBMetadataItem({
-			pk: DYNAMODB_INSIGHTS_PARTITION,
-			sk: key,
-			version: 1,
-			row
-		}),
-		ConditionExpression: "attribute_not_exists(#pk)",
-		ExpressionAttributeNames: { "#pk": "pk" }
-	} });
-	for (const [id, current] of apiKeys) {
-		const original = originalApiKeys.get(id);
-		if (original !== void 0 && rowsEqual(original.row, current.row)) continue;
-		actions.push({ Put: {
-			TableName: store.tableName,
-			Item: boundedDynamoDBMetadataItem(apiKeyItem(current.row, original === void 0 ? 1 : original.version + 1)),
-			ConditionExpression: original ? "#version = :version" : "attribute_not_exists(#pk)",
-			ExpressionAttributeNames: original ? { "#version": "version" } : { "#pk": "pk" },
-			...original ? { ExpressionAttributeValues: { ":version": original.version } } : {}
-		} });
-		if (original === void 0) actions.push({ Put: {
-			TableName: store.tableName,
-			Item: {
-				pk: DYNAMODB_API_KEY_HASH_PARTITION,
-				sk: current.row.hash,
-				api_key_id: current.row.id
-			},
-			ConditionExpression: "attribute_not_exists(#pk)",
-			ExpressionAttributeNames: { "#pk": "pk" }
-		} });
-	}
-	if (actions.length > 0) await commitDynamoDBTransaction(store, actions);
-	return { committed: true };
-};
-const isDynamoDBTransactionConflict = (error) => typeof error === "object" && error !== null && Reflect.get(error, "name") === "TransactionCanceledException";
-const createDynamoDBCommit = (store) => async (input) => {
-	try {
-		return await compileAndCommitDynamoDBChanges(store, input);
-	} catch (error) {
-		if (!isDynamoDBTransactionConflict(error)) throw error;
-		return compileAndCommitDynamoDBChanges(store, input);
-	}
-};
-const DYNAMODB_INSIGHTS_PARTITION = "bundle_events";
-const DYNAMODB_API_KEY_PARTITION = "api_keys";
-const DYNAMODB_API_KEY_HASH_PARTITION = "_hot-updater#api-key-hashes";
-const hasValidBundleEventShape = (value) => {
-	const type = field(value, "type");
-	const fromBundleId = field(value, "from_bundle_id");
-	const updateStrategy = field(value, "update_strategy");
-	return (type === "UPDATE_APPLIED" || type === "RECOVERED" || type === "RELEASE_ADOPTED") && typeof fromBundleId === "string" && (updateStrategy === "fingerprint" || updateStrategy === "appVersion") || type === "UNCHANGED" && fromBundleId === null && updateStrategy === null;
-};
-const isBundleEventRow = (value) => typeof value === "object" && value !== null && typeof field(value, "id") === "string" && typeof field(value, "install_id") === "string" && isNullableString(field(value, "from_release_id")) && isNullableString(field(value, "to_release_id")) && typeof field(value, "to_bundle_id") === "string" && (field(value, "platform") === "ios" || field(value, "platform") === "android") && typeof field(value, "received_at_ms") === "number" && hasValidBundleEventShape(value);
-const isApiKeyRow = (value) => typeof value === "object" && value !== null && typeof field(value, "id") === "string" && typeof field(value, "hash") === "string" && typeof field(value, "name") === "string" && typeof field(value, "prefix") === "string" && field(value, "role") === "client" && typeof field(value, "created_at_ms") === "number" && (field(value, "revoked_at_ms") === null || typeof field(value, "revoked_at_ms") === "number");
-const parseOfficialRowItem = (value, partition, isRow) => {
-	if (value.pk !== partition || typeof value.sk !== "string" || typeof value.version !== "number" || !isRow(value.row)) throw new DynamoDBStoredItemError();
-	return {
-		row: value.row,
-		version: value.version
-	};
-};
-const timestampSortKey = (timestampMs) => Math.trunc(timestampMs).toString().padStart(16, "0");
-const insightsSortKey = (row) => `${timestampSortKey(row.received_at_ms)}#${row.id}`;
-const createDynamoDBInsightsTable = (store) => ({
-	async append(row) {
-		await store.client.send(new _aws_sdk_lib_dynamodb.PutCommand({
-			TableName: store.tableName,
-			Item: boundedDynamoDBMetadataItem({
-				pk: DYNAMODB_INSIGHTS_PARTITION,
-				sk: insightsSortKey(row),
-				version: 1,
-				row
-			}),
-			ConditionExpression: "attribute_not_exists(#pk)",
-			ExpressionAttributeNames: { "#pk": "pk" }
-		}));
-	},
-	async scan(input) {
-		if (input.limit <= 0) return [];
-		if (input.after !== void 0 && input.after.receivedAtMs >= input.beforeReceivedAtMs) return [];
-		const rows = [];
-		const afterKey = input.after === void 0 ? void 0 : `${timestampSortKey(input.after.receivedAtMs)}#${input.after.id}`;
-		let exclusiveStartKey;
-		do {
-			const page = await store.client.send(new _aws_sdk_lib_dynamodb.QueryCommand({
-				TableName: store.tableName,
-				ExclusiveStartKey: exclusiveStartKey,
-				KeyConditionExpression: afterKey === void 0 ? "#pk = :pk AND #sk < :before" : "#pk = :pk AND #sk BETWEEN :after AND :before",
-				ExpressionAttributeNames: {
-					"#pk": "pk",
-					"#sk": "sk"
-				},
+		async query({ pk, gte, lt, lte, order, limit, after }) {
+			let condition = "pk = :pk";
+			if (gte !== void 0 && lt !== void 0) condition += " AND sk BETWEEN :gte AND :lte";
+			else if (gte !== void 0) condition += " AND sk >= :gte";
+			else if (lt !== void 0) condition += " AND sk < :lt";
+			const result = await documents.send(new _aws_sdk_lib_dynamodb.QueryCommand({
+				TableName: tableName,
+				KeyConditionExpression: condition,
 				ExpressionAttributeValues: {
-					":before": `${timestampSortKey(input.beforeReceivedAtMs)}#`,
-					":pk": DYNAMODB_INSIGHTS_PARTITION,
-					...afterKey === void 0 ? {} : { ":after": afterKey }
+					":pk": pk,
+					":gte": gte,
+					...gte !== void 0 && lt !== void 0 ? { ":lte": lte ?? lt } : { ":lt": lt }
 				},
-				Limit: input.limit - rows.length + (afterKey === void 0 ? 0 : 1),
-				ScanIndexForward: true
-			}));
-			for (const item of page.Items ?? []) {
-				if (item.sk === afterKey) continue;
-				rows.push(parseOfficialRowItem(item, DYNAMODB_INSIGHTS_PARTITION, isBundleEventRow).row);
-				if (rows.length === input.limit) return rows;
-			}
-			exclusiveStartKey = page.LastEvaluatedKey;
-		} while (exclusiveStartKey !== void 0);
-		return rows;
-	}
-});
-const apiKeyItem = (row, version) => ({
-	pk: DYNAMODB_API_KEY_PARTITION,
-	sk: row.id,
-	version,
-	row
-});
-const loadApiKey = async (store, id) => {
-	const result = await store.client.send(new _aws_sdk_lib_dynamodb.GetCommand({
-		TableName: store.tableName,
-		Key: {
-			pk: DYNAMODB_API_KEY_PARTITION,
-			sk: id
+				ScanIndexForward: order === "asc",
+				ConsistentRead: true,
+				Limit: Math.min(limit, nativePageSize ?? limit),
+				ExclusiveStartKey: after === void 0 ? void 0 : {
+					pk,
+					sk: after
+				}
+			})).catch(missingTable);
+			return {
+				items: (result.Items ?? []).map((item) => ({
+					sk: item.sk,
+					value: toRow(item)
+				})),
+				more: result.LastEvaluatedKey !== void 0
+			};
 		},
-		ConsistentRead: true
-	}));
-	return result.Item === void 0 ? null : parseOfficialRowItem(result.Item, DYNAMODB_API_KEY_PARTITION, isApiKeyRow);
-};
-const createDynamoDBApiKeyTable = (store) => {
-	const findByHash = async (hash) => {
-		const lookup = await store.client.send(new _aws_sdk_lib_dynamodb.GetCommand({
-			TableName: store.tableName,
-			Key: {
-				pk: DYNAMODB_API_KEY_HASH_PARTITION,
-				sk: hash
-			},
-			ConsistentRead: true
-		}));
-		const id = lookup.Item?.api_key_id;
-		if (lookup.Item === void 0) return null;
-		if (typeof id !== "string") throw new DynamoDBStoredItemError();
-		return (await loadApiKey(store, id))?.row ?? null;
-	};
-	return {
-		async create(row) {
-			if (await findByHash(row.hash) !== null) return "existing";
+		async write(ops) {
 			try {
-				await commitDynamoDBTransaction(store, [{ Put: {
-					TableName: store.tableName,
-					Item: boundedDynamoDBMetadataItem(apiKeyItem(row, 1)),
-					ConditionExpression: "attribute_not_exists(#pk)",
-					ExpressionAttributeNames: { "#pk": "pk" }
-				} }, { Put: {
-					TableName: store.tableName,
-					Item: {
-						pk: DYNAMODB_API_KEY_HASH_PARTITION,
-						sk: row.hash,
-						api_key_id: row.id
-					},
-					ConditionExpression: "attribute_not_exists(#pk)",
-					ExpressionAttributeNames: { "#pk": "pk" }
-				} }]);
-				return "created";
+				await documents.send(new _aws_sdk_lib_dynamodb.TransactWriteCommand({
+					TransactItems: ops.map((op) => toTransactItem(tableName, op)),
+					ClientRequestToken: crypto.randomUUID()
+				}));
+				return { ok: true };
 			} catch (error) {
-				if (await findByHash(row.hash) !== null) return "existing";
-				throw error;
+				const { CancellationReasons = [] } = error;
+				const codes = CancellationReasons.map(({ Code }) => Code);
+				const failed = codes.indexOf("ConditionalCheckFailed");
+				if (failed !== -1) return {
+					ok: false,
+					failedOp: failed
+				};
+				return [nameOf(error), ...codes].some((code) => TRANSIENT.has(code)) ? {
+					ok: false,
+					retry: true
+				} : missingTable(error);
 			}
 		},
-		findByHash,
-		async list() {
-			const rows = [];
-			let exclusiveStartKey;
-			do {
-				const page = await store.client.send(new _aws_sdk_lib_dynamodb.QueryCommand({
-					TableName: store.tableName,
-					ExclusiveStartKey: exclusiveStartKey,
-					KeyConditionExpression: "#pk = :pk",
-					ExpressionAttributeNames: { "#pk": "pk" },
-					ExpressionAttributeValues: { ":pk": DYNAMODB_API_KEY_PARTITION },
-					ConsistentRead: true
-				}));
-				rows.push(...(page.Items ?? []).map((item) => parseOfficialRowItem(item, DYNAMODB_API_KEY_PARTITION, isApiKeyRow).row));
-				exclusiveStartKey = page.LastEvaluatedKey;
-			} while (exclusiveStartKey !== void 0);
-			return rows.sort((left, right) => right.created_at_ms - left.created_at_ms || left.id.localeCompare(right.id));
-		},
-		async revoke({ id, revokedAtMs }) {
-			const current = await loadApiKey(store, id);
-			if (current === null) return null;
-			const row = {
-				...current.row,
-				revoked_at_ms: revokedAtMs
-			};
-			await store.client.send(new _aws_sdk_lib_dynamodb.PutCommand({
-				TableName: store.tableName,
-				Item: boundedDynamoDBMetadataItem(apiKeyItem(row, current.version + 1)),
-				ConditionExpression: "#version = :currentVersion",
-				ExpressionAttributeNames: { "#version": "version" },
-				ExpressionAttributeValues: { ":currentVersion": current.version }
+		migrations: { 
+		/** Creates the table for local and test runs; `hot-updater init` creates it in AWS. */
+async apply() {
+			try {
+				await client.send(new _aws_sdk_client_dynamodb.DescribeTableCommand({ TableName: tableName }));
+				return;
+			} catch (error) {
+				if (nameOf(error) !== "ResourceNotFoundException") throw error;
+			}
+			await client.send(new _aws_sdk_client_dynamodb.CreateTableCommand({
+				TableName: tableName,
+				AttributeDefinitions: [{
+					AttributeName: "pk",
+					AttributeType: "S"
+				}, {
+					AttributeName: "sk",
+					AttributeType: "S"
+				}],
+				KeySchema: [{
+					AttributeName: "pk",
+					KeyType: "HASH"
+				}, {
+					AttributeName: "sk",
+					KeyType: "RANGE"
+				}],
+				BillingMode: "PAY_PER_REQUEST"
 			}));
-			return row;
-		}
+			await (0, _aws_sdk_client_dynamodb.waitUntilTableExists)({
+				client,
+				maxWaitTime: 120,
+				minDelay: 1,
+				maxDelay: 1
+			}, { TableName: tableName });
+		} }
 	};
 };
-const DYNAMODB_UPDATE_INDEX_NAME = "hot-updater-update-index";
-const dynamoDB = (config) => {
-	const { apiBasePath = "/release-catalogs", cloudfrontDistributionId, shouldWaitForInvalidation = false, tableName, ...clientConfig } = config;
-	const client = _aws_sdk_lib_dynamodb.DynamoDBDocumentClient.from(new _aws_sdk_client_dynamodb.DynamoDBClient(clientConfig), { marshallOptions: { removeUndefinedValues: true } });
-	const cloudFront = cloudfrontDistributionId ? new _aws_sdk_client_cloudfront.CloudFrontClient({
-		credentials: clientConfig.credentials,
-		region: clientConfig.region
-	}) : null;
-	const store = {
+//#endregion
+//#region src/dynamoDB.ts
+/** The DynamoDB client ignores the CloudFront settings in its config. */
+const adapterOf = ({ tableName, ...clientConfig }) => {
+	const client = new _aws_sdk_client_dynamodb.DynamoDBClient(clientConfig);
+	return {
 		client,
-		tableName
-	};
-	const crud = createDynamoDBCrud(store, DYNAMODB_UPDATE_INDEX_NAME);
-	const invalidateUpdateRoutes = async () => {
-		if (!cloudFront || !cloudfrontDistributionId) return;
-		try {
-			await invalidateCloudFront(cloudFront, cloudfrontDistributionId, [`${apiBasePath.replace(/\/+$/, "")}/*`], { shouldWait: shouldWaitForInvalidation });
-		} catch (error) {
-			console.warn("[hot-updater/aws] CloudFront invalidation failed; continuing without cache invalidation.", {
-				distributionId: cloudfrontDistributionId,
-				error: error instanceof Error ? error.message : "Unknown error"
-			});
-		}
+		adapter: (0, _hot_updater_server_database.createKvAdapter)({ store: createDynamoDBStore({
+			client,
+			tableName
+		}) })
 	};
-	const adapter = (0, _hot_updater_plugin_core_internal.createDatabasePluginAdapter)("dynamoDB", {
-		...crud,
-		commit: createDynamoDBCommit(store),
-		dispose: async () => {
+};
+/**
+* Creates the table when it is missing and writes the schema settings the
+* database checks before its first read. `hot-updater init` runs it in AWS.
+*/
+const migrateDynamoDB = async (config) => {
+	const { client, adapter } = adapterOf(config);
+	try {
+		await (0, _hot_updater_server_database.migrateBuiltInSchema)(adapter, "dynamoDB");
+	} finally {
+		client.destroy();
+	}
+};
+/**
+* Hot Updater's database on one DynamoDB table, through the storage engine.
+* With a distribution, it gives core the CloudFront invalidation core runs
+* after a write that changes what the update-check routes answer.
+*/
+const dynamoDB = (config) => {
+	const { client, adapter } = adapterOf(config);
+	const cloudFront = createUpdateRouteInvalidation(config);
+	return {
+		...(0, _hot_updater_server_database.createEngineDatabase)({
+			name: "dynamoDB",
+			adapter,
+			onCachedRoutesChange: cloudFront?.invalidate
+		}),
+		async dispose() {
+			await adapter.dispose?.();
 			client.destroy();
 			cloudFront?.destroy();
 		}
-	});
-	return (0, _hot_updater_plugin_core.createDatabasePlugin)({
-		name: "dynamoDB",
-		models: {
-			...adapter.models,
-			bundlePatches: createDynamoDBBundlePatchTable(store, DYNAMODB_UPDATE_INDEX_NAME),
-			insights: createDynamoDBInsightsTable(store),
-			apiKeys: createDynamoDBApiKeyTable(store)
-		},
-		async commit(input) {
-			const result = await adapter.commit(input);
-			if (result.committed && input.changes.some(({ model }) => model === "bundles" || model === "bundlePatches")) await invalidateUpdateRoutes();
-			return result;
-		},
-		dispose: adapter.dispose
-	});
+	};
 };
 //#endregion
+//#region src/plugins.ts
+/**
+* The plugins the managed AWS server runs: Insights, and API keys on every
+* client route. Its Lambda@Edge function imports this list.
+*/
+const plugins = [(0, _hot_updater_server_plugins_insights.insights)(), (0, _hot_updater_server_plugins_api_keys.apiKeys)()];
+//#endregion
 //#region iac/init/index.ts
 const AWS_AUTH_MODES = [
 	"local-session",
@@ -8881,7 +7479,7 @@ var CloudFrontManager = class {
 		return policyId;
 	}
 	async getOrCreateKeyGroup(publicKey) {
-		const publicKeyHash = crypto.default.createHash("sha256").update(publicKey).digest("hex").slice(0, 16);
+		const publicKeyHash = crypto$1.default.createHash("sha256").update(publicKey).digest("hex").slice(0, 16);
 		const cloudfrontClient = new _aws_sdk_client_cloudfront.CloudFront({
 			region: this.region,
 			credentials: this.credentials
@@ -9106,13 +7704,16 @@ var CloudFrontManager = class {
 //#region iac/dynamodb.ts
 const DYNAMODB_DESCRIBE_TABLE_ACTION = "dynamodb:DescribeTable";
 var DynamoDBTableSchemaError = class extends Error {
+	tableName;
 	name = "DynamoDBTableSchemaError";
 	constructor(tableName) {
-		super(`DynamoDB table "${tableName}" does not match the Hot Updater key and index schema`);
+		super(`DynamoDB table "${tableName}" does not match the Hot Updater schema: a pk and sk key and no secondary index. A table from before 1.0 keeps its update index; delete it and rerun init to create it again.`);
 		this.tableName = tableName;
 	}
 };
 var DynamoDBPermissionError = class extends _hot_updater_cli_tools.InitError {
+	tableName;
+	region;
 	name = "DynamoDBPermissionError";
 	requiredAction = DYNAMODB_DESCRIBE_TABLE_ACTION;
 	constructor(tableName, region, cause) {
@@ -9135,30 +7736,47 @@ const primaryKeySchema = [{
 	AttributeName: "sk",
 	KeyType: "RANGE"
 }];
-const updateIndexKeySchema = [{
-	AttributeName: "gsi1pk",
-	KeyType: "HASH"
-}, {
-	AttributeName: "gsi1sk",
-	KeyType: "RANGE"
-}];
-const keyAttributes = [
-	"pk",
-	"sk",
-	"gsi1pk",
-	"gsi1sk"
-];
+const keyAttributes = ["pk", "sk"];
 const onDemandThroughput = {
 	MaxReadRequestUnits: 4e3,
 	MaxWriteRequestUnits: 100
 };
 const hasKeySchema = (actual, expected) => actual?.length === expected.length && expected.every(({ AttributeName, KeyType }) => actual.some((key) => key.AttributeName === AttributeName && key.KeyType === KeyType));
 const hasExpectedSchema = (table) => {
-	const updateIndex = table?.GlobalSecondaryIndexes?.find(({ IndexName }) => IndexName === DYNAMODB_UPDATE_INDEX_NAME);
-	return keyAttributes.every((attributeName) => table?.AttributeDefinitions?.some(({ AttributeName, AttributeType }) => AttributeName === attributeName && AttributeType === "S")) && table?.BillingModeSummary?.BillingMode === "PAY_PER_REQUEST" && table.OnDemandThroughput?.MaxReadRequestUnits === onDemandThroughput.MaxReadRequestUnits && table.OnDemandThroughput?.MaxWriteRequestUnits === onDemandThroughput.MaxWriteRequestUnits && hasKeySchema(table?.KeySchema, primaryKeySchema) && hasKeySchema(updateIndex?.KeySchema, updateIndexKeySchema) && updateIndex?.OnDemandThroughput?.MaxReadRequestUnits === onDemandThroughput.MaxReadRequestUnits && updateIndex?.OnDemandThroughput?.MaxWriteRequestUnits === onDemandThroughput.MaxWriteRequestUnits && updateIndex?.Projection?.ProjectionType === "ALL";
+	return keyAttributes.every((attributeName) => table?.AttributeDefinitions?.some(({ AttributeName, AttributeType }) => AttributeName === attributeName && AttributeType === "S")) && table?.BillingModeSummary?.BillingMode === "PAY_PER_REQUEST" && table.OnDemandThroughput?.MaxReadRequestUnits === onDemandThroughput.MaxReadRequestUnits && table.OnDemandThroughput?.MaxWriteRequestUnits === onDemandThroughput.MaxWriteRequestUnits && hasKeySchema(table?.KeySchema, primaryKeySchema) && (table?.GlobalSecondaryIndexes ?? []).length === 0;
 };
 const isResourceNotFound = (error) => typeof error === "object" && error !== null && Reflect.get(error, "name") === "ResourceNotFoundException";
+const buildDynamoDBCreateTableInput = (tableName) => ({
+	AttributeDefinitions: [{
+		AttributeName: "pk",
+		AttributeType: "S"
+	}, {
+		AttributeName: "sk",
+		AttributeType: "S"
+	}],
+	BillingMode: "PAY_PER_REQUEST",
+	DeletionProtectionEnabled: true,
+	KeySchema: [...primaryKeySchema],
+	OnDemandThroughput: onDemandThroughput,
+	TableName: tableName
+});
+/**
+* The schema settings items the plugin checks before its first read, as one
+* BatchWriteItem request: what `migrateDynamoDB` writes to a new table.
+*/
+const buildDynamoDBSchemaSettingsInput = (tableName) => ({ RequestItems: { [tableName]: Object.entries(_hot_updater_server_database.builtInSettings).map(([key, value]) => ({ PutRequest: { Item: {
+	pk: { S: _hot_updater_server_database.SETTINGS_TABLE.name },
+	sk: { S: (0, _hot_updater_server_database.encodeKvKey)([key]) },
+	key: { S: key },
+	value: { S: value },
+	_v: { N: "0" }
+} } })) } });
+const buildDynamoDBBackupInput = (tableName) => ({
+	PointInTimeRecoverySpecification: { PointInTimeRecoveryEnabled: true },
+	TableName: tableName
+});
 var DynamoDBManager = class {
+	region;
 	client;
 	constructor(region, credentials) {
 		this.region = region;
@@ -9177,37 +7795,7 @@ var DynamoDBManager = class {
 			if (error instanceof Error && error.name === "AccessDeniedException" && error.message.includes(DYNAMODB_DESCRIBE_TABLE_ACTION)) throw new DynamoDBPermissionError(tableName, this.region, error);
 			if (!isResourceNotFound(error)) throw error;
 		}
-		await this.client.createTable({
-			AttributeDefinitions: [
-				{
-					AttributeName: "pk",
-					AttributeType: "S"
-				},
-				{
-					AttributeName: "sk",
-					AttributeType: "S"
-				},
-				{
-					AttributeName: "gsi1pk",
-					AttributeType: "S"
-				},
-				{
-					AttributeName: "gsi1sk",
-					AttributeType: "S"
-				}
-			],
-			BillingMode: "PAY_PER_REQUEST",
-			DeletionProtectionEnabled: true,
-			GlobalSecondaryIndexes: [{
-				IndexName: DYNAMODB_UPDATE_INDEX_NAME,
-				KeySchema: [...updateIndexKeySchema],
-				Projection: { ProjectionType: "ALL" },
-				OnDemandThroughput: onDemandThroughput
-			}],
-			KeySchema: [...primaryKeySchema],
-			OnDemandThroughput: onDemandThroughput,
-			TableName: tableName
-		});
+		await this.client.createTable(buildDynamoDBCreateTableInput(tableName));
 		await (0, _aws_sdk_client_dynamodb.waitUntilTableExists)({
 			client: this.client,
 			maxWaitTime: 120
@@ -9217,14 +7805,66 @@ var DynamoDBManager = class {
 	async ensureLifecycle(tableName) {
 		const { ContinuousBackupsDescription } = await this.client.describeContinuousBackups({ TableName: tableName });
 		if (ContinuousBackupsDescription?.PointInTimeRecoveryDescription?.PointInTimeRecoveryStatus === "ENABLED") return;
-		await this.client.updateContinuousBackups({
-			PointInTimeRecoverySpecification: { PointInTimeRecoveryEnabled: true },
-			TableName: tableName
-		});
+		await this.client.updateContinuousBackups(buildDynamoDBBackupInput(tableName));
 	}
 };
 //#endregion
 //#region iac/iam.ts
+/** The partitions the plugin's items use: each table's rows, and its index items after `#`. */
+const dynamoDBLeadingKeys = () => [..._hot_updater_server_database.builtInSchema.tables, _hot_updater_server_database.SETTINGS_TABLE].flatMap(({ name }) => [name, `${name}#*`]);
+const buildDynamoDBPolicy = (region, accountId, tableName) => {
+	const tableArn = `arn:aws:dynamodb:${region}:${accountId}:table/${tableName}`;
+	return {
+		Version: "2012-10-17",
+		Statement: [{
+			Action: [
+				"dynamodb:BatchGetItem",
+				"dynamodb:ConditionCheckItem",
+				"dynamodb:DeleteItem",
+				"dynamodb:GetItem",
+				"dynamodb:PutItem",
+				"dynamodb:Query",
+				"dynamodb:TransactWriteItems",
+				"dynamodb:UpdateItem"
+			],
+			Condition: { "ForAllValues:StringLike": { "dynamodb:LeadingKeys": dynamoDBLeadingKeys() } },
+			Effect: "Allow",
+			Resource: [tableArn]
+		}]
+	};
+};
+const buildS3Policy = (bucketName) => {
+	return {
+		Version: "2012-10-17",
+		Statement: [{
+			Action: ["s3:ListBucket"],
+			Effect: "Allow",
+			Resource: [`arn:aws:s3:::${bucketName}`]
+		}, {
+			Action: ["s3:GetObject"],
+			Effect: "Allow",
+			Resource: [`arn:aws:s3:::${bucketName}/*`]
+		}]
+	};
+};
+const buildSsmPolicy = (region, accountId, parameterName) => {
+	return {
+		Version: "2012-10-17",
+		Statement: [{
+			Effect: "Allow",
+			Action: ["ssm:GetParameter"],
+			Resource: `arn:aws:ssm:${region}:${accountId}:parameter/${parameterName.replace(/^\/+/, "")}`
+		}]
+	};
+};
+const LAMBDA_EDGE_TRUST_POLICY = {
+	Version: "2012-10-17",
+	Statement: [{
+		Effect: "Allow",
+		Principal: { Service: ["lambda.amazonaws.com", "edgelambda.amazonaws.com"] },
+		Action: "sts:AssumeRole"
+	}]
+};
 var IAMManager = class {
 	region;
 	credentials;
@@ -9241,71 +7881,22 @@ var IAMManager = class {
 		});
 	}
 	async ensureDynamoDBPolicy(iamClient, roleName, accountId, tableName) {
-		const tableArn = `arn:aws:dynamodb:${this.region}:${accountId}:table/${tableName}`;
 		await iamClient.putRolePolicy({
-			PolicyDocument: JSON.stringify({
-				Version: "2012-10-17",
-				Statement: [{
-					Action: ["dynamodb:Query"],
-					Effect: "Allow",
-					Resource: [`${tableArn}/index/${DYNAMODB_UPDATE_INDEX_NAME}`]
-				}, {
-					Action: [
-						"dynamodb:BatchGetItem",
-						"dynamodb:DeleteItem",
-						"dynamodb:GetItem",
-						"dynamodb:PutItem",
-						"dynamodb:Query",
-						"dynamodb:TransactWriteItems",
-						"dynamodb:UpdateItem"
-					],
-					Condition: { "ForAllValues:StringEquals": { "dynamodb:LeadingKeys": [
-						"_hot-updater",
-						"bundles",
-						"bundle_patches",
-						DYNAMODB_CHANNEL_PARTITION,
-						DYNAMODB_CHANNEL_NAME_PARTITION,
-						DYNAMODB_INSIGHTS_PARTITION,
-						DYNAMODB_API_KEY_PARTITION,
-						DYNAMODB_API_KEY_HASH_PARTITION
-					] } },
-					Effect: "Allow",
-					Resource: [tableArn]
-				}]
-			}),
+			PolicyDocument: JSON.stringify(buildDynamoDBPolicy(this.region, accountId, tableName)),
 			PolicyName: "HotUpdaterDynamoDBReadAccess",
 			RoleName: roleName
 		});
 	}
 	async ensureS3Policy(iamClient, roleName, bucketName) {
 		await iamClient.putRolePolicy({
-			PolicyDocument: JSON.stringify({
-				Version: "2012-10-17",
-				Statement: [{
-					Action: ["s3:ListBucket"],
-					Effect: "Allow",
-					Resource: [`arn:aws:s3:::${bucketName}`]
-				}, {
-					Action: ["s3:GetObject"],
-					Effect: "Allow",
-					Resource: [`arn:aws:s3:::${bucketName}/*`]
-				}]
-			}),
+			PolicyDocument: JSON.stringify(buildS3Policy(bucketName)),
 			PolicyName: "HotUpdaterS3ReadAccess",
 			RoleName: roleName
 		});
 	}
 	async ensureSsmPolicy(iamClient, roleName, accountId, parameterName) {
-		const parameterPath = parameterName.replace(/^\/+/, "");
 		await iamClient.putRolePolicy({
-			PolicyDocument: JSON.stringify({
-				Version: "2012-10-17",
-				Statement: [{
-					Effect: "Allow",
-					Action: ["ssm:GetParameter"],
-					Resource: `arn:aws:ssm:${this.region}:${accountId}:parameter/${parameterPath}`
-				}]
-			}),
+			PolicyDocument: JSON.stringify(buildSsmPolicy(this.region, accountId, parameterName)),
 			PolicyName: "HotUpdaterSSMAccess",
 			RoleName: roleName
 		});
@@ -9320,14 +7911,7 @@ var IAMManager = class {
 			credentials: this.credentials
 		}).getCallerIdentity({})).Account;
 		if (!accountId) throw new Error("Failed to get AWS account ID");
-		const assumeRolePolicyDocument = JSON.stringify({
-			Version: "2012-10-17",
-			Statement: [{
-				Effect: "Allow",
-				Principal: { Service: ["lambda.amazonaws.com", "edgelambda.amazonaws.com"] },
-				Action: "sts:AssumeRole"
-			}]
-		});
+		const assumeRolePolicyDocument = JSON.stringify(LAMBDA_EDGE_TRUST_POLICY);
 		const roleName = `hot-updater-edge-${(0, node_crypto.createHash)("sha256").update(options.lambdaName).digest("hex").slice(0, 16)}`;
 		try {
 			const { Role: existingRole } = await iamClient.getRole({ RoleName: roleName });
@@ -9403,7 +7987,8 @@ var LambdaEdgeDeployer = class {
 	async deploy(lambdaRoleArn, lambdaName, config) {
 		const cwd = (0, _hot_updater_cli_tools.getCwd)();
 		const lambdaPath = require.resolve("@hot-updater/aws/lambda");
-		const { tmpDir, removeTmpDir } = await (0, _hot_updater_cli_tools.copyDirToTmp)(path.default.dirname(lambdaPath));
+		const lambdaDir = path.default.dirname(lambdaPath);
+		const { tmpDir, removeTmpDir } = await (0, _hot_updater_cli_tools.copyDirToTmp)(lambdaDir);
 		const indexPath = path.default.join(tmpDir, "index.cjs");
 		const code = (0, _hot_updater_cli_tools.transformEnv)(indexPath, {
 			CLOUDFRONT_KEY_PAIR_ID: config.publicKeyId,
@@ -9636,7 +8221,7 @@ var SSMKeyPairManager = class {
 			_hot_updater_cli_tools.p.log.info("Using existing CloudFront key pair from SSM Parameter Store");
 			return keyPair;
 		}
-		const { publicKey, privateKey } = crypto.default.generateKeyPairSync("rsa", {
+		const { publicKey, privateKey } = crypto$1.default.generateKeyPairSync("rsa", {
 			modulusLength: 2048,
 			publicKeyEncoding: {
 				type: "spki",
@@ -9648,7 +8233,7 @@ var SSMKeyPairManager = class {
 			}
 		});
 		const keyPair = {
-			keyPairId: `HOTUPDATER-${crypto.default.randomBytes(4).toString("hex").toUpperCase()}`,
+			keyPairId: `HOTUPDATER-${crypto$1.default.randomBytes(4).toString("hex").toUpperCase()}`,
 			publicKey,
 			privateKey
 		};
@@ -9711,12 +8296,11 @@ const awsOptions = {
 };`.trim()
 			}];
 			break;
-		case "account":
-			helperStatements = [{
-				name: "awsOptions",
-				strategy: "merge-object",
-				replaceIncompatibleProperties: ["credentials"],
-				code: `
+		case "account": helperStatements = [{
+			name: "awsOptions",
+			strategy: "merge-object",
+			replaceIncompatibleProperties: ["credentials"],
+			code: `
 const awsOptions = {
   region: process.env.HOT_UPDATER_S3_REGION!,
   credentials: {
@@ -9724,8 +8308,7 @@ const awsOptions = {
     secretAccessKey: process.env.HOT_UPDATER_S3_SECRET_ACCESS_KEY!,
   },
 };`.trim()
-			}];
-			break;
+		}];
 	}
 	const builder = new _hot_updater_cli_tools.ConfigBuilder().setBuildType(build).setStorage(storageConfig).setDatabase(databaseConfig).setIntermediateCode(helperStatements.map((statement) => statement.code.trim()).join("\n\n"));
 	switch (authMode.mode) {
@@ -9735,13 +8318,10 @@ const awsOptions = {
 				named: ["fromSSO"]
 			});
 			break;
-		case "local":
-			builder.addImport({
-				pkg: "@aws-sdk/credential-providers",
-				named: [authMode.profile ? "fromIni" : "fromNodeProviderChain"]
-			});
-			break;
-		case "account": break;
+		case "local": builder.addImport({
+			pkg: "@aws-sdk/credential-providers",
+			named: [authMode.profile ? "fromIni" : "fromNodeProviderChain"]
+		});
 	}
 	return (0, _hot_updater_cli_tools.createHotUpdaterConfigScaffoldFromBuilder)(builder, { helperStatements });
 };
@@ -9776,11 +8356,12 @@ const isAwsRegion = (value) => {
 	return value !== void 0 && Object.hasOwn(regionLocationMap, value);
 };
 const prepareDynamoDBDeployment = async (input) => {
-	return new DynamoDBManager(input.region, input.credentials).ensureTable(input.tableName);
+	await new DynamoDBManager(input.region, input.credentials).ensureTable(input.tableName);
+	await migrateDynamoDB(input);
 };
+/** The app's client key, through the managed server's apiKeys() plugin, on the table it reads. */
 const prepareDynamoDBApiKey = async (input) => {
-	return (await (0, _hot_updater_server.provisionApiKey)({
-		apiKeys: input.apiKeys,
+	return (await (0, _hot_updater_server_db.createDatabasePluginApis)(input.database, plugins).apiKeys.provision({
 		existingApiKey: input.existingApiKey,
 		name: "AWS init"
 	})).apiKey;
@@ -9905,13 +8486,14 @@ const runInit = async ({ build, envFile }) => {
 		dynamodbTableName: resolvedDynamoDBTableName,
 		lambdaName
 	};
+	const persistCredentialInputs = await (0, _hot_updater_cli_tools.confirmInitInputPersistence)({
+		existingEnv: managedEnv,
+		inputs: resolvedInputs,
+		nonInteractive,
+		provider: initProvider
+	});
 	const initEnv = (0, _hot_updater_cli_tools.getInitProviderEnvVars)({
-		includeConsentInputs: await (0, _hot_updater_cli_tools.confirmInitInputPersistence)({
-			existingEnv: managedEnv,
-			inputs: resolvedInputs,
-			nonInteractive,
-			provider: initProvider
-		}),
+		includeConsentInputs: persistCredentialInputs,
 		inputs: resolvedInputs,
 		provider: initProvider
 	});
@@ -9943,7 +8525,7 @@ const runInit = async ({ build, envFile }) => {
 	let apiKey;
 	try {
 		apiKey = await prepareDynamoDBApiKey({
-			apiKeys: databasePlugin.models.apiKeys,
+			database: databasePlugin,
 			existingApiKey: providerEnv.HOT_UPDATER_API_KEY
 		});
 		await (0, _hot_updater_cli_tools.makeEnv)({ HOT_UPDATER_API_KEY: apiKey });
@@ -9990,6 +8572,7 @@ const runInit = async ({ build, envFile }) => {
 	if (configWriteResult.status === "created") _hot_updater_cli_tools.p.log.success("Generated 'hot-updater.config.ts' file with AWS settings.");
 	else if (configWriteResult.status === "merged") _hot_updater_cli_tools.p.log.success("Updated 'hot-updater.config.ts' file with AWS settings.");
 	else _hot_updater_cli_tools.p.log.warn(`Kept existing 'hot-updater.config.ts' unchanged: ${configWriteResult.reason}`);
+	await (0, _hot_updater_cli_tools.generateHotUpdaterPlugins)("@hot-updater/aws");
 	const sourceUrl = `https://${distributionDomain}`;
 	_hot_updater_cli_tools.p.note((0, _hot_updater_cli_tools.transformTemplate)(SOURCE_TEMPLATE, {
 		apiKey: JSON.stringify(apiKey),
@@ -10001,6 +8584,13 @@ const runInit = async ({ build, envFile }) => {
 	_hot_updater_cli_tools.p.log.success("Done! 🎉");
 };
 //#endregion
+exports.LAMBDA_EDGE_TRUST_POLICY = LAMBDA_EDGE_TRUST_POLICY;
+exports.buildDynamoDBBackupInput = buildDynamoDBBackupInput;
+exports.buildDynamoDBCreateTableInput = buildDynamoDBCreateTableInput;
+exports.buildDynamoDBPolicy = buildDynamoDBPolicy;
+exports.buildDynamoDBSchemaSettingsInput = buildDynamoDBSchemaSettingsInput;
+exports.buildS3Policy = buildS3Policy;
+exports.buildSsmPolicy = buildSsmPolicy;
 exports.prepareDynamoDBApiKey = prepareDynamoDBApiKey;
 exports.prepareDynamoDBDeployment = prepareDynamoDBDeployment;
 exports.runInit = runInit;