lambder 6.0.1 → 7.0.1

package/dist/shared/{LambderCrashDetail.js → wire/LambderCrashDetail.js}

@@ -76,3 +76,33 @@ export const errorFromCrashDetail = (crash) => {
         cause = build(entry, cause);
     return build(crash, cause);
 };
+/**
+ * A thrown value as an Error, so a reporter or a `cause` chain always holds
+ * one. An Error passes through; anything else becomes an Error whose message
+ * describes the value the way describeCrash does, JSON where String() cannot
+ * (a null-prototype object or a throwing toString must not make the
+ * coercion itself throw). One implementation, rather than
+ * `err instanceof Error ? err : new Error(...)` spelled at every site with a
+ * fallback of its own.
+ */
+export const coerceToError = (value, fallbackMessage = "Unknown error") => {
+    if (value instanceof Error)
+        return value;
+    let message;
+    if (typeof value === "string")
+        message = value;
+    else {
+        try {
+            message = JSON.stringify(value);
+        }
+        catch {
+            try {
+                message = String(value);
+            }
+            catch {
+                message = undefined;
+            }
+        }
+    }
+    return new Error(message || fallbackMessage);
+};

package/dist/shared/wire/LambderHttpStatus.d.ts

@@ -0,0 +1,12 @@
+/**
+ * The HTTP status codes a Lambder response may carry.
+ *
+ * In `shared/` rather than beside LambderResponse because it is HTTP
+ * vocabulary with no relationship to the server's response class, and the
+ * places that need it include ones a browser bundle reaches
+ * (LambderApiRefusal, the mock's contract types). Importing it from `core/`
+ * pulled `core/LambderResponse.ts` into the type graph of `lambder/client`,
+ * and with it `aws-lambda`, so a browser-only consumer needed
+ * `@types/aws-lambda` resolvable to typecheck a status union.
+ */
+export type LambderHttpStatusCode = 100 | 101 | 200 | 201 | 202 | 203 | 204 | 206 | 300 | 301 | 302 | 303 | 304 | 307 | 308 | 400 | 401 | 402 | 403 | 404 | 405 | 406 | 408 | 409 | 410 | 412 | 413 | 415 | 416 | 418 | 422 | 428 | 429 | 431 | 451 | 500 | 501 | 502 | 503 | 504;

package/dist/shared/wire/LambderHttpStatus.js

@@ -0,0 +1 @@
+export {};

package/dist/shared/{LambderRequestPayload.d.ts → wire/LambderRequestPayload.d.ts}

@@ -25,7 +25,7 @@
  * LambderCompressionCodec gives stored records, so a malicious or truncated
  * body fails instead of expanding without limit.
  */
-import type { LambderCompressionOption } from "./LambderCompressionOption.js";
+import type { LambderCompressionOption, LambderCompressionSettings } from "./LambderCompressionOption.js";
 /** Envelope field carrying the base64 gzip of the payload's JSON. */
 export declare const COMPRESSED_PAYLOAD_GZ_FIELD = "payloadGz";
 /**
@@ -71,18 +71,18 @@ export declare const DEFAULT_REQUEST_COMPRESSION_SETTINGS: LambderRequestCompres
  */
 export declare const DEFAULT_MAX_RESTORED_PAYLOAD_BYTES = 20000000;
 /**
- * The two rules every compressed payload follows, whichever algorithm made
- * the bytes: nothing below the threshold is compressed, and the compressed
- * form is only ever sent when its base64 is smaller than the JSON it
- * replaces. The threshold is measured on real UTF-8 bytes, not string
- * length, so a payload of multi-byte text is judged by what actually goes on
- * the wire. `compress` is the algorithm: the browser's CompressionStream for
- * gzip, zlib for Brotli (LambderInvokeCaller); both go through here so the
- * rules cannot drift between them.
+ * The threshold one call is judged against, or null when its payload goes
+ * plainly: the caller's configured setting unless the call overrode it, and
+ * `compressRequest: true` means "whatever the size", which is a threshold of
+ * zero rather than a separate path.
+ *
+ * Both callers decide this, and the three-line ternary they each wrote is the
+ * one place a caller can get the override backwards, so it is written once
+ * beside the compressors it feeds.
  */
-export declare const compressPayloadWith: <TField extends string>(json: string, minBytes: number, field: TField, compress: (bytes: Uint8Array<ArrayBuffer>) => Promise<Uint8Array>) => Promise<({ [K in TField]: string; } & {
-    [COMPRESSED_PAYLOAD_BYTES_FIELD]: number;
-}) | null>;
+export declare const resolveRequestCompressionMinBytes: (compressRequest: boolean | undefined, settings: {
+    minBytes: number;
+} | null | undefined) => number | null;
 /** True when this runtime can compress request payloads (browsers, and Node 18+). */
 export declare const isRequestCompressionAvailable: () => boolean;
 /**
@@ -94,10 +94,18 @@ export declare const isRequestCompressionAvailable: () => boolean;
  * bigger, so the compressed form is only ever sent when it is smaller.
  */
 export declare const compressPayloadGzip: (json: string, minBytes: number) => Promise<LambderCompressedGzipPayload | null>;
+/** Request Brotli when `requestCompression: true` on LambderInvokeCaller: the HTTP request threshold, at the quality every other Lambder site uses. */
+export declare const DEFAULT_INVOKE_REQUEST_COMPRESSION_SETTINGS: LambderCompressionSettings;
 /**
- * Restores a payload the caller compressed, for request mocking
- * (LambderMSW), so a mock handler receives the same payload the server
- * would. The server does NOT use this: it decompresses through zlib, whose
- * bounded output is what makes an untrusted body safe to expand.
+ * Brotli one payload's JSON for sending, or null when the plain JSON should
+ * go instead: compressPayloadGzip with Brotli, for a caller where both ends
+ * are Node (LambderInvokeCaller). The threshold and the only-when-smaller
+ * rule are compressPayloadWith's, shared with the gzip side.
+ *
+ * Beside its gzip twin rather than inside the invoke caller, because the two
+ * are one wire format with one set of rules and a reader comparing them
+ * should not have to open two files. It needs Buffer and zlib, which the
+ * codec loads lazily, so this module stays resolvable from the browser entry
+ * and a bundle that never calls this drops it with the codec behind it.
  */
-export declare const decompressPayloadGzip: (payloadGz: string) => Promise<unknown>;
+export declare const compressPayloadBrotli: (json: string, minBytes: number, quality: number) => Promise<LambderCompressedBrotliPayload | null>;

package/dist/shared/{LambderRequestPayload.js → wire/LambderRequestPayload.js}

@@ -1,30 +1,5 @@
-/**
- * Request payload compression: the wire format both sides speak.
- *
- * When a LambderCaller call's payload clears the configured size, the caller
- * sends the payload's JSON as `payloadGz` (gzip bytes, base64) beside
- * `payloadBytes` (its UTF-8 byte length) in place of `payload`, and the
- * server restores it before anything reads the payload. A Node caller
- * (LambderInvokeCaller) sends `payloadBr` instead, Brotli under the same
- * rules; the server accepts either. Everything else in the envelope
- * (apiName, version, token, siteHost, guardInputs, idempotencyKey) stays
- * plain text, so routing, logging and request mocking are unaffected.
- *
- * Base64 inside the JSON envelope, rather than a binary body with
- * Content-Encoding: API Gateway hands a binary request body to Lambda
- * base64-encoded anyway, so binary saves nothing against Lambda's ~6MB
- * invoke payload cap while adding a content-type negotiation that gateways,
- * CDNs and mock servers each treat differently. Base64's 4/3 overhead
- * applies to bytes that already shrank several times over.
- *
- * gzip rather than Brotli because the browser's CompressionStream offers
- * gzip and deflate only; responses, compressed by Node, do prefer Brotli.
- *
- * `payloadBytes` is not bookkeeping: it bounds the server's decompression
- * and the restored length must match it exactly, the same guarantee
- * LambderCompressionCodec gives stored records, so a malicious or truncated
- * body fails instead of expanding without limit.
- */
+import { bytesToBase64 } from "../util/LambderBase64.js";
+import { compressText } from "./LambderCompressionCodec.js";
 /** Envelope field carrying the base64 gzip of the payload's JSON. */
 export const COMPRESSED_PAYLOAD_GZ_FIELD = "payloadGz";
 /**
@@ -51,17 +26,6 @@ export const DEFAULT_REQUEST_COMPRESSION_SETTINGS = { minBytes: 4096 };
  * compressible body cannot exhaust the function's memory.
  */
 export const DEFAULT_MAX_RESTORED_PAYLOAD_BYTES = 20_000_000;
-/** Buffer where there is one (Node); otherwise chunked so a large payload cannot overflow the argument list of String.fromCharCode. */
-const bytesToBase64 = (bytes) => {
-    if (typeof Buffer !== "undefined")
-        return Buffer.from(bytes.buffer, bytes.byteOffset, bytes.byteLength).toString("base64");
-    const chunkSize = 0x8000;
-    let binary = "";
-    for (let i = 0; i < bytes.length; i += chunkSize) {
-        binary += String.fromCharCode(...bytes.subarray(i, i + chunkSize));
-    }
-    return btoa(binary);
-};
 /**
  * The two rules every compressed payload follows, whichever algorithm made
  * the bytes: nothing below the threshold is compressed, and the compressed
@@ -72,7 +36,7 @@ const bytesToBase64 = (bytes) => {
  * gzip, zlib for Brotli (LambderInvokeCaller); both go through here so the
  * rules cannot drift between them.
  */
-export const compressPayloadWith = async (json, minBytes, field, compress) => {
+const compressPayloadWith = async (json, minBytes, field, compress) => {
     const encoded = new TextEncoder().encode(json);
     if (encoded.length < minBytes)
         return null;
@@ -81,6 +45,19 @@ export const compressPayloadWith = async (json, minBytes, field, compress) => {
         return null;
     return { [field]: base64, [COMPRESSED_PAYLOAD_BYTES_FIELD]: encoded.length };
 };
+/**
+ * The threshold one call is judged against, or null when its payload goes
+ * plainly: the caller's configured setting unless the call overrode it, and
+ * `compressRequest: true` means "whatever the size", which is a threshold of
+ * zero rather than a separate path.
+ *
+ * Both callers decide this, and the three-line ternary they each wrote is the
+ * one place a caller can get the override backwards, so it is written once
+ * beside the compressors it feeds.
+ */
+export const resolveRequestCompressionMinBytes = (compressRequest, settings) => compressRequest === true ? 0
+    : compressRequest === false ? null
+        : settings?.minBytes ?? null;
 /** True when this runtime can compress request payloads (browsers, and Node 18+). */
 export const isRequestCompressionAvailable = () => typeof CompressionStream !== "undefined" && typeof btoa !== "undefined";
 /**
@@ -95,18 +72,18 @@ export const compressPayloadGzip = (json, minBytes) => compressPayloadWith(json,
     const stream = new Blob([bytes]).stream().pipeThrough(new CompressionStream("gzip"));
     return new Uint8Array(await new Response(stream).arrayBuffer());
 });
+/** Request Brotli when `requestCompression: true` on LambderInvokeCaller: the HTTP request threshold, at the quality every other Lambder site uses. */
+export const DEFAULT_INVOKE_REQUEST_COMPRESSION_SETTINGS = { minBytes: 4096, quality: 5 };
 /**
- * Restores a payload the caller compressed, for request mocking
- * (LambderMSW), so a mock handler receives the same payload the server
- * would. The server does NOT use this: it decompresses through zlib, whose
- * bounded output is what makes an untrusted body safe to expand.
+ * Brotli one payload's JSON for sending, or null when the plain JSON should
+ * go instead: compressPayloadGzip with Brotli, for a caller where both ends
+ * are Node (LambderInvokeCaller). The threshold and the only-when-smaller
+ * rule are compressPayloadWith's, shared with the gzip side.
+ *
+ * Beside its gzip twin rather than inside the invoke caller, because the two
+ * are one wire format with one set of rules and a reader comparing them
+ * should not have to open two files. It needs Buffer and zlib, which the
+ * codec loads lazily, so this module stays resolvable from the browser entry
+ * and a bundle that never calls this drops it with the codec behind it.
  */
-export const decompressPayloadGzip = async (payloadGz) => {
-    const binary = atob(payloadGz);
-    const bytes = new Uint8Array(binary.length);
-    for (let i = 0; i < binary.length; i += 1) {
-        bytes[i] = binary.charCodeAt(i);
-    }
-    const stream = new Blob([bytes]).stream().pipeThrough(new DecompressionStream("gzip"));
-    return JSON.parse(await new Response(stream).text());
-};
+export const compressPayloadBrotli = (json, minBytes, quality) => compressPayloadWith(json, minBytes, COMPRESSED_PAYLOAD_BR_FIELD, (bytes) => compressText(Buffer.from(bytes.buffer, bytes.byteOffset, bytes.byteLength), "br", quality));

package/dist/shared/wire/LambderSessionCookieNames.d.ts

@@ -0,0 +1,9 @@
+/**
+ * The session cookie names an app uses unless it configures its own. One
+ * definition, in shared, because the server writes these names and the
+ * browser caller, the invoke caller and the mock runtime all read them: the
+ * two sides must agree byte for byte, and a second copy is a place for them
+ * to drift apart with every test still green.
+ */
+export declare const DEFAULT_SESSION_TOKEN_COOKIE_KEY = "LMDRSESSIONTKID";
+export declare const DEFAULT_SESSION_CSRF_COOKIE_KEY = "LMDRSESSIONCSTK";

package/dist/shared/wire/LambderSessionCookieNames.js

@@ -0,0 +1,9 @@
+/**
+ * The session cookie names an app uses unless it configures its own. One
+ * definition, in shared, because the server writes these names and the
+ * browser caller, the invoke caller and the mock runtime all read them: the
+ * two sides must agree byte for byte, and a second copy is a place for them
+ * to drift apart with every test still green.
+ */
+export const DEFAULT_SESSION_TOKEN_COOKIE_KEY = "LMDRSESSIONTKID";
+export const DEFAULT_SESSION_CSRF_COOKIE_KEY = "LMDRSESSIONCSTK";

package/dist/stores/LambderDdbCache.d.ts

@@ -1,7 +1,8 @@
 import type { DynamoDBClient } from "@aws-sdk/client-dynamodb";
-import { type LambderCompressionOption } from "../shared/LambderCompressionOption.js";
+import { type LambderCompressionOption } from "../shared/wire/LambderCompressionOption.js";
 export interface LambderDdbCacheOptions {
     tableName: string;
+    /** Region the client is created for on first use; the SDK's default chain otherwise. */
     region?: string;
     /** Partition key prefix, keeps cache items separated from other systems in a shared table. Default: "CACHE". */
     keyPrefix?: string;
@@ -18,6 +19,12 @@ export interface LambderDdbCacheOptions {
     maxValueBytes?: number;
     memoryMaxBytes?: number;
     client?: DynamoDBClient;
+    /**
+     * The clock entries are expired against, injectable the way the rate
+     * limiter's and the idempotency store's are, so a test can cross a TTL
+     * boundary without moving the world's clock.
+     */
+    now?: () => number;
 }
 /**
  * Where a value lives. A plain string addresses one entry, as it always has.
@@ -59,7 +66,7 @@ export interface LambderDdbCacheListOptions {
  * Table shape: string hash key `pk`, string range key `sk`, TTL on
  * `expiresAt`. Items are prefixed `CACHE#<namespace>#` by default, so the
  * table can be shared with LambderDdbRateLimiter (`RL#`) and
- * LambderDdbIdempotency (`IDEM#`) without key collisions.
+ * LambderDdbIdempotencyStore (`IDEM#`) without key collisions.
  *
  * A key may also be a `{ pk, sk }` pair, which groups entries under one
  * partition so `deletePartition` and `listSortKeys` can work on the group
@@ -72,19 +79,16 @@ export declare class LambderDdbCache {
     readonly tableName: string;
     readonly keyPrefix: string;
     readonly namespace: string;
-    /** The client given at creation, or one created from `region` on first use; the SDK arrives with it. */
-    private readonly providedClient;
-    private readonly region;
-    private readyPromise;
+    /** The SDK and the client, loaded and created the first time the table is touched (see LambderDdbSdk). */
+    private readonly ready;
     private readonly defaultTtlSeconds;
     private readonly chunkBytes;
     private readonly compression;
     private readonly maxValueBytes;
     private readonly memory;
     private readonly inFlight;
+    private readonly now;
     constructor(options: LambderDdbCacheOptions);
-    /** The SDK and the client, loaded and created the first time the table is touched (see LambderDdbSdk). */
-    private ready;
     get<T>(key: LambderCacheKey): Promise<T | undefined>;
     private getByAddress;
     has(key: LambderCacheKey): Promise<boolean>;
@@ -145,5 +149,4 @@ export declare class LambderDdbCache {
     /** Drop every in-memory copy belonging to one partition. */
     private forgetPartition;
     private nowSeconds;
-    private isConditionalFailure;
 }

package/dist/stores/LambderDdbCache.js

@@ -1,7 +1,8 @@
-import { loadDynamoClientSdk } from "./LambderDdbSdk.js";
-import { getCrypto } from "../shared/node-polyfills.js";
-import { compressText, restoreText } from "../shared/LambderCompressionCodec.js";
-import { resolveCompressionOption, } from "../shared/LambderCompressionOption.js";
+import { createDynamoClientLoader, isConditionalCheckFailure } from "./LambderDdbSdk.js";
+import { getCrypto } from "../shared/util/LambderNodeModules.js";
+import { assertPositiveInteger } from "../shared/util/LambderOptionChecks.js";
+import { compressText, restoreText, LambderCompressionError } from "../shared/wire/LambderCompressionCodec.js";
+import { resolveCompressionOption, } from "../shared/wire/LambderCompressionOption.js";
 import { LRUCache } from "lru-cache";
 const DEFAULT_TTL_SECONDS = 365 * 24 * 60 * 60;
 const DEFAULT_CHUNK_BYTES = 350 * 1024;
@@ -19,6 +20,25 @@ const BATCH_WRITE_LIMIT = 25;
 const MAX_BATCH_RETRIES = 8;
 /** Every value compressed by default; see the `compression` option. */
 const COMPRESSION_DEFAULTS = { minBytes: 0, quality: 5 };
+/**
+ * A stored entry that cannot be trusted: chunks that do not add up to what
+ * the manifest describes, bytes that fail its checksum, or a restore the
+ * codec would not vouch for (a LambderCompressionError, which is the same
+ * answer in the compression layer's own words).
+ *
+ * A type rather than "anything thrown while reading the entry", because the
+ * two are treated in opposite ways: a corrupt entry is dropped so the next
+ * reader refills it, while a throttled or failed Query is the table being
+ * busy. Deleting a healthy 2MB entry over one throttle orphans its chunks
+ * until their TTL and sends every later reader to the origin, which is the
+ * load the cache exists to absorb.
+ */
+class LambderCacheIntegrityError extends Error {
+    constructor(message) {
+        super(message);
+        this.name = "LambderCacheIntegrityError";
+    }
+}
 /**
  * `#` separates the store's own item-key segments, so a caller's `#` is
  * escaped rather than refused: `~` becomes `~0` and `#` becomes `~1`. An
@@ -30,11 +50,11 @@ const COMPRESSION_DEFAULTS = { minBytes: 0, quality: 5 };
  */
 const encodeSortKey = (value) => value.replace(/~/g, "~0").replace(/#/g, "~1");
 const decodeSortKey = (value) => value.replace(/~([01])/g, (_match, code) => code === "0" ? "~" : "#");
-// Node builtins are loaded lazily through node-polyfills so this module can
+// Node builtins are loaded lazily through LambderNodeModules so this module can
 // sit in a frontend bundle's import graph (via the package root) without
 // breaking; using the cache at runtime still requires Node. Brotli helpers
-// are shared with LambderDdbIdempotency and LambderSessionManager via
-// ../shared/LambderCompressionCodec.js.
+// are shared with LambderDdbIdempotencyStore and LambderDdbSessionStore via
+// ../shared/wire/LambderCompressionCodec.js.
 const requireCrypto = async () => {
     const crypto = await getCrypto();
     if (!crypto)
@@ -49,12 +69,6 @@ const randomUUID = async () => {
     const crypto = await requireCrypto();
     return crypto.randomUUID();
 };
-const positiveInteger = (value, name) => {
-    if (!Number.isSafeInteger(value) || value <= 0) {
-        throw new Error(`${name} must be a positive safe integer`);
-    }
-    return value;
-};
 const sleep = (milliseconds) => new Promise((resolve) => setTimeout(resolve, milliseconds));
 /**
  * Persistent JSON cache backed by DynamoDB.
@@ -71,7 +85,7 @@ const sleep = (milliseconds) => new Promise((resolve) => setTimeout(resolve, mil
  * Table shape: string hash key `pk`, string range key `sk`, TTL on
  * `expiresAt`. Items are prefixed `CACHE#<namespace>#` by default, so the
  * table can be shared with LambderDdbRateLimiter (`RL#`) and
- * LambderDdbIdempotency (`IDEM#`) without key collisions.
+ * LambderDdbIdempotencyStore (`IDEM#`) without key collisions.
  *
  * A key may also be a `{ pk, sk }` pair, which groups entries under one
  * partition so `deletePartition` and `listSortKeys` can work on the group
@@ -84,16 +98,15 @@ export class LambderDdbCache {
     tableName;
     keyPrefix;
     namespace;
-    /** The client given at creation, or one created from `region` on first use; the SDK arrives with it. */
-    providedClient;
-    region;
-    readyPromise;
+    /** The SDK and the client, loaded and created the first time the table is touched (see LambderDdbSdk). */
+    ready;
     defaultTtlSeconds;
     chunkBytes;
     compression;
     maxValueBytes;
     memory;
     inFlight = new Map();
+    now;
     constructor(options) {
         if (!options.tableName.trim())
             throw new Error("tableName is required");
@@ -103,29 +116,22 @@ export class LambderDdbCache {
         if (Buffer.byteLength(this.namespace, "utf8") > 128) {
             throw new Error("namespace must be at most 128 UTF-8 bytes");
         }
-        this.defaultTtlSeconds = positiveInteger(options.defaultTtlSeconds ?? DEFAULT_TTL_SECONDS, "defaultTtlSeconds");
-        this.chunkBytes = positiveInteger(options.chunkBytes ?? DEFAULT_CHUNK_BYTES, "chunkBytes");
+        this.defaultTtlSeconds = assertPositiveInteger(options.defaultTtlSeconds ?? DEFAULT_TTL_SECONDS, "defaultTtlSeconds");
+        this.chunkBytes = assertPositiveInteger(options.chunkBytes ?? DEFAULT_CHUNK_BYTES, "chunkBytes");
         if (this.chunkBytes > MAX_SAFE_CHUNK_BYTES) {
             throw new Error(`chunkBytes must not exceed ${MAX_SAFE_CHUNK_BYTES}`);
         }
         this.compression = resolveCompressionOption(options.compression, COMPRESSION_DEFAULTS);
-        this.maxValueBytes = positiveInteger(options.maxValueBytes ?? DEFAULT_MAX_VALUE_BYTES, "maxValueBytes");
+        this.maxValueBytes = assertPositiveInteger(options.maxValueBytes ?? DEFAULT_MAX_VALUE_BYTES, "maxValueBytes");
         const memoryMaxBytes = options.memoryMaxBytes ?? DEFAULT_MEMORY_BYTES;
         this.memory = memoryMaxBytes === 0
             ? null
             : new LRUCache({
-                maxSize: positiveInteger(memoryMaxBytes, "memoryMaxBytes"),
+                maxSize: assertPositiveInteger(memoryMaxBytes, "memoryMaxBytes"),
                 sizeCalculation: (entry) => entry.stored.length,
             });
-        this.providedClient = options.client;
-        this.region = options.region ?? "us-east-1";
-    }
-    /** The SDK and the client, loaded and created the first time the table is touched (see LambderDdbSdk). */
-    ready() {
-        this.readyPromise ??= loadDynamoClientSdk("LambderDdbCache")
-            .then((sdk) => ({ sdk, client: this.providedClient ?? new sdk.DynamoDBClient({ region: this.region }) }))
-            .catch((error) => { this.readyPromise = undefined; throw error; });
-        return this.readyPromise;
+        this.now = options.now ?? (() => Date.now());
+        this.ready = createDynamoClientLoader({ user: "LambderDdbCache", region: options.region, client: options.client });
     }
     async get(key) {
         return await this.getByAddress(this.normalizeKey(key));
@@ -150,10 +156,10 @@ export class LambderDdbCache {
         try {
             const stored = manifest.inlineData ?? await this.readChunks(pk, address, manifest);
             if (stored.length !== manifest.storedBytes) {
-                throw new Error("stored byte length does not match manifest");
+                throw new LambderCacheIntegrityError("stored byte length does not match manifest");
             }
             if (await sha256(stored) !== manifest.checksum) {
-                throw new Error("stored checksum does not match manifest");
+                throw new LambderCacheIntegrityError("stored checksum does not match manifest");
             }
             const json = await this.decode(stored, manifest.encoding, manifest.uncompressedBytes);
             const parsed = JSON.parse(json);
@@ -161,6 +167,12 @@ export class LambderDdbCache {
             return parsed;
         }
         catch (error) {
+            // Only an entry this read can prove wrong is dropped. Everything
+            // else is the table answering badly, which is the manifest read's
+            // own behaviour one line up: it propagates, and getOrSet's
+            // fail-open handles it as the infrastructure failure it is.
+            if (!(error instanceof LambderCacheIntegrityError || error instanceof LambderCompressionError))
+                throw error;
             await this.invalidateManifest(pk, address, manifest.version);
             console.warn(`Ignoring corrupt DynamoDB cache entry in ${this.namespace}`, error);
             return undefined;
@@ -181,7 +193,7 @@ export class LambderDdbCache {
         return await this.setByAddress(this.normalizeKey(key), value, options);
     }
     async setByAddress(address, value, options) {
-        const ttlSeconds = positiveInteger(options.ttlSeconds ?? this.defaultTtlSeconds, "ttlSeconds");
+        const ttlSeconds = assertPositiveInteger(options.ttlSeconds ?? this.defaultTtlSeconds, "ttlSeconds");
         const json = JSON.stringify(value);
         if (json === undefined)
             throw new Error("Cache value must be JSON-serializable");
@@ -272,7 +284,7 @@ export class LambderDdbCache {
     async listSortKeys(partition, options = {}) {
         const pk = await this.partitionKey(this.normalizePartition(partition));
         const prefix = `${SORT_KEY_MARKER}${encodeSortKey(options.prefix ?? "")}`;
-        const limit = options.limit === undefined ? undefined : positiveInteger(options.limit, "limit");
+        const limit = options.limit === undefined ? undefined : assertPositiveInteger(options.limit, "limit");
         const nowSeconds = this.nowSeconds();
         const items = await this.queryItems(pk, { prefix, projection: "#sk, #expiresAt", extraNames: { "#expiresAt": "expiresAt" } });
         const sortKeys = [];
@@ -330,8 +342,8 @@ export class LambderDdbCache {
         }
     }
     async fill(address, factory, options) {
-        const leaseSeconds = positiveInteger(options.leaseSeconds ?? 15, "leaseSeconds");
-        const waitForFillMs = positiveInteger(options.waitForFillMs ?? 5_000, "waitForFillMs");
+        const leaseSeconds = assertPositiveInteger(options.leaseSeconds ?? 15, "leaseSeconds");
+        const waitForFillMs = assertPositiveInteger(options.waitForFillMs ?? 5_000, "waitForFillMs");
         const pk = await this.partitionKey(address.partition);
         const owner = await randomUUID();
         if (await this.acquireLease(pk, address, owner, leaseSeconds)) {
@@ -384,7 +396,7 @@ export class LambderDdbCache {
             return true;
         }
         catch (error) {
-            if (this.isConditionalFailure(error))
+            if (isConditionalCheckFailure(error))
                 return false;
             throw error;
         }
@@ -401,7 +413,7 @@ export class LambderDdbCache {
             }));
         }
         catch (error) {
-            if (!this.isConditionalFailure(error)) {
+            if (!isConditionalCheckFailure(error)) {
                 console.warn(`Failed to release DynamoDB cache lease in ${this.namespace}`, error);
             }
         }
@@ -470,11 +482,11 @@ export class LambderDdbCache {
             .map((item) => ({ sk: item.sk.S, data: Buffer.from(item.data.B) }));
         chunks.sort((left, right) => left.sk.localeCompare(right.sk));
         if (chunks.length !== manifest.chunkCount) {
-            throw new Error(`DynamoDB cache entry is missing chunks (${chunks.length}/${manifest.chunkCount})`);
+            throw new LambderCacheIntegrityError(`DynamoDB cache entry is missing chunks (${chunks.length}/${manifest.chunkCount})`);
         }
         for (let index = 0; index < chunks.length; index += 1) {
             if (chunks[index]?.sk !== this.chunkSortKey(address, manifest.version, index)) {
-                throw new Error(`DynamoDB cache entry has an invalid chunk index at ${index}`);
+                throw new LambderCacheIntegrityError(`DynamoDB cache entry has an invalid chunk index at ${index}`);
             }
         }
         return Buffer.concat(chunks.map((chunk) => chunk.data), manifest.storedBytes);
@@ -520,7 +532,7 @@ export class LambderDdbCache {
             }));
         }
         catch (error) {
-            if (!this.isConditionalFailure(error)) {
+            if (!isConditionalCheckFailure(error)) {
                 console.warn(`Failed to invalidate corrupt DynamoDB cache manifest in ${this.namespace}`, error);
             }
         }
@@ -549,7 +561,7 @@ export class LambderDdbCache {
     remember(key, stored, encoding, uncompressedBytes, expiresAt) {
         if (!this.memory)
             return;
-        const ttl = expiresAt * 1000 - Date.now();
+        const ttl = expiresAt * 1000 - this.now();
         if (ttl <= 0)
             return;
         this.memory.set(key, { stored, encoding, uncompressedBytes, expiresAt }, { ttl });
@@ -616,9 +628,6 @@ export class LambderDdbCache {
         }
     }
     nowSeconds() {
-        return Math.floor(Date.now() / 1000);
-    }
-    isConditionalFailure(error) {
-        return !!error && typeof error === "object" && "name" in error && error.name === "ConditionalCheckFailedException";
+        return Math.floor(this.now() / 1000);
     }
 }