s3db.js 18.0.11-next.1534f717 → 18.0.11-next.e8e71b5b

package/dist/s3db.cjs

@@ -9,15 +9,14 @@ var recker = require('recker');
 var node_stream = require('node:stream');
 var clientS3 = require('@aws-sdk/client-s3');
 var crypto$2 = require('crypto');
-var os$2 = require('os');
-var promises = require('timers/promises');
 var nanoid = require('nanoid');
 var fs$2 = require('fs/promises');
 var stream$2 = require('stream');
 var fs$3 = require('fs');
+var os$2 = require('os');
 var zlib$2 = require('zlib');
-var promisePool = require('@supercharge/promise-pool');
 var web = require('node:stream/web');
+var promises = require('timers/promises');
 var jsonStableStringify = require('json-stable-stringify');
 var FastestValidatorModule = require('fastest-validator');
 var v8$2 = require('v8');
@@ -260,6 +259,15 @@ function calculateRetryDelay(attempt, baseDelay, maxDelay, useJitter = true) {
 }
 function isRetryableError(error, statusCode) {
     if (error) {
+        // Check for HTTP/2 specific errors first
+        const h2Error = recker.parseHttp2Error(error);
+        if (h2Error) {
+            return h2Error.retriable;
+        }
+        // Check for native HTTP/2 errors
+        if (error instanceof recker.Http2Error) {
+            return error.retriable;
+        }
         const code = error.code;
         if (code === 'ECONNRESET' || code === 'ETIMEDOUT' || code === 'ENOTFOUND' ||
             code === 'ECONNREFUSED' || code === 'EPIPE' || code === 'UND_ERR_SOCKET' ||
@@ -276,6 +284,17 @@ function isRetryableError(error, statusCode) {
     }
     return false;
 }
+/**
+ * Get additional retry delay for HTTP/2 errors like ENHANCE_YOUR_CALM
+ */
+function getHttp2RetryDelay(error) {
+    const h2Error = recker.parseHttp2Error(error);
+    if (h2Error && h2Error.errorCode === 'ENHANCE_YOUR_CALM') {
+        // Server is rate limiting, wait longer (5-10 seconds)
+        return 5000 + Math.random() * 5000;
+    }
+    return undefined;
+}
 function parseRetryAfter$1(headerValue) {
     if (!headerValue)
         return undefined;
@@ -297,6 +316,7 @@ class ReckerHttpHandler {
     deduplicator;
     circuitBreaker;
     metrics;
+    http2MetricsEnabled;
     constructor(options = {}) {
         this.options = {
             connectTimeout: 10000,
@@ -308,6 +328,9 @@ class ReckerHttpHandler {
             pipelining: 10,
             http2: true,
             http2MaxConcurrentStreams: 100,
+            http2Preset: 'performance', // Default to performance preset for S3 workloads
+            expectContinue: 2 * 1024 * 1024, // 2MB threshold for Expect: 100-Continue
+            enableHttp2Metrics: false,
             enableDedup: true,
             enableCircuitBreaker: true,
             circuitBreakerThreshold: 5,
@@ -320,6 +343,15 @@ class ReckerHttpHandler {
             respectRetryAfter: true,
             ...options,
         };
+        this.http2MetricsEnabled = this.options.enableHttp2Metrics;
+        // Build HTTP/2 configuration using presets
+        const http2Config = this.options.http2
+            ? this.options.http2Preset
+                ? recker.expandHTTP2Options(this.options.http2Preset)
+                : { enabled: true, maxConcurrentStreams: this.options.http2MaxConcurrentStreams }
+            : false;
+        // Build hooks for HTTP/2 observability
+        const hooks = this.http2MetricsEnabled ? recker.createHttp2MetricsHooks() : undefined;
         this.client = recker.createClient({
             timeout: {
                 lookup: 5000,
@@ -328,10 +360,8 @@ class ReckerHttpHandler {
                 response: this.options.headersTimeout,
                 request: this.options.bodyTimeout,
             },
-            http2: this.options.http2 ? {
-                enabled: true,
-                maxConcurrentStreams: this.options.http2MaxConcurrentStreams,
-            } : false,
+            http2: http2Config,
+            expectContinue: this.options.expectContinue,
             concurrency: {
                 max: this.options.connections * 10,
                 agent: {
@@ -342,7 +372,8 @@ class ReckerHttpHandler {
                     keepAliveMaxTimeout: this.options.keepAliveMaxTimeout,
                 },
             },
-            observability: false,
+            hooks,
+            observability: this.http2MetricsEnabled,
         });
         this.deduplicator = this.options.enableDedup ? new RequestDeduplicator() : null;
         this.circuitBreaker = this.options.enableCircuitBreaker ? new CircuitBreaker({
@@ -432,7 +463,11 @@ class ReckerHttpHandler {
                     }
                     if (this.options.enableRetry && attempt < maxAttempts && isRetryableError(error)) {
                         this.metrics.retries++;
-                        const delay = calculateRetryDelay(attempt, this.options.retryDelay, this.options.maxRetryDelay, this.options.retryJitter);
+                        // Check for HTTP/2 specific retry delay (e.g., ENHANCE_YOUR_CALM)
+                        const h2Delay = getHttp2RetryDelay(error);
+                        const delay = h2Delay !== undefined
+                            ? Math.min(h2Delay, this.options.maxRetryDelay)
+                            : calculateRetryDelay(attempt, this.options.retryDelay, this.options.maxRetryDelay, this.options.retryJitter);
                         await new Promise(resolve => setTimeout(resolve, delay));
                         continue;
                     }
@@ -458,13 +493,25 @@ class ReckerHttpHandler {
         return { ...this.options };
     }
     getMetrics() {
-        return {
+        const metrics = {
             ...this.metrics,
             circuitStates: this.circuitBreaker
                 ? Object.fromEntries(this.circuitBreaker.circuits)
                 : {},
             pendingDeduped: this.deduplicator?.size || 0,
         };
+        // Include HTTP/2 metrics if enabled
+        if (this.http2MetricsEnabled) {
+            const h2Summary = recker.getGlobalHttp2Metrics().getSummary();
+            metrics.http2 = {
+                sessions: h2Summary.totals.sessions,
+                activeSessions: h2Summary.totals.activeSessions,
+                streams: h2Summary.totals.streams,
+                activeStreams: h2Summary.totals.activeStreams,
+                errors: h2Summary.totals.errors,
+            };
+        }
+        return metrics;
     }
     resetMetrics() {
         this.metrics = {
@@ -3559,6 +3606,37 @@ class TasksPool extends EventEmitter.EventEmitter {
         });
         return { results: orderedResults, errors, batchId };
     }
+    /**
+     * Process an array of items with controlled concurrency.
+     * This is a convenience method that mimics PromisePool.for().process() API.
+     *
+     * @example
+     * const { results, errors } = await TasksPool.map(
+     *   users,
+     *   async (user) => fetchUserData(user.id),
+     *   { concurrency: 10 }
+     * );
+     */
+    static async map(items, processor, options = {}) {
+        const { concurrency = 10, onItemComplete, onItemError } = options;
+        const pool = new TasksPool({
+            concurrency,
+            features: { profile: 'bare', emitEvents: false }
+        });
+        const fns = items.map((item, index) => async () => processor(item, index));
+        const batchOptions = {
+            onItemComplete: onItemComplete,
+            onItemError: onItemError
+                ? (error, index) => onItemError(error, items[index], index)
+                : undefined
+        };
+        const { results, errors } = await pool.addBatch(fns, batchOptions);
+        await pool.destroy();
+        return {
+            results: results.filter((r) => r !== null),
+            errors: errors.map(e => ({ error: e.error, item: items[e.index], index: e.index }))
+        };
+    }
     processNext() {
         if (this.lightMode) {
             this._processLightQueue();
@@ -9437,15 +9515,13 @@ class ResourceReader extends EventEmitter {
     }
     async _transform(chunk, _encoding, callback) {
         const [, err] = await tryFn(async () => {
-            await promisePool.PromisePool.for(chunk)
-                .withConcurrency(this.concurrency)
-                .handleError(async (error, content) => {
-                this.emit("error", error, content);
-            })
-                .process(async (id) => {
+            await TasksPool.map(chunk, async (id) => {
                 const data = await this.resource.get(id);
                 this.transform.push(data);
                 return data;
+            }, {
+                concurrency: this.concurrency,
+                onItemError: (error, id) => this.emit("error", error, id)
             });
         });
         callback(err);
@@ -9509,12 +9585,7 @@ class ResourceWriter extends EventEmitter {
         while (this.buffer.length > 0) {
             const batch = this.buffer.splice(0, this.batchSize);
             const [ok, err] = await tryFn(async () => {
-                await promisePool.PromisePool.for(batch)
-                    .withConcurrency(this.concurrency)
-                    .handleError(async (error, content) => {
-                    this.emit("error", error, content);
-                })
-                    .process(async (item) => {
+                await TasksPool.map(batch, async (item) => {
                     const [insertOk, insertErr, result] = await tryFn(async () => {
                         const res = await this.resource.insert(item);
                         return res;
@@ -9524,6 +9595,9 @@ class ResourceWriter extends EventEmitter {
                         return null;
                     }
                     return result;
+                }, {
+                    concurrency: this.concurrency,
+                    onItemError: (error, item) => this.emit("error", error, item)
                 });
             });
             if (!ok) {
@@ -10055,10 +10129,7 @@ class DatabasePlugins {
                 }
             }
             const concurrency = Math.max(1, Number.isFinite(db.executorPool?.concurrency) ? db.executorPool.concurrency : 5);
-            const installResult = await promisePool.PromisePool
-                .withConcurrency(concurrency)
-                .for(plugins)
-                .process(async (plugin) => {
+            const installResult = await TasksPool.map(plugins, async (plugin) => {
                 const pluginName = this._getPluginName(plugin);
                 if (typeof plugin.setInstanceName === 'function') {
                     plugin.setInstanceName(pluginName);
@@ -10074,11 +10145,11 @@ class DatabasePlugins {
                 });
                 db.pluginRegistry[pluginName] = plugin;
                 return pluginName;
-            });
+            }, { concurrency });
             if (installResult.errors.length > 0) {
                 const errorInfo = installResult.errors[0];
                 const failedPlugin = errorInfo.item;
-                const error = errorInfo.raw || errorInfo.error || errorInfo;
+                const error = errorInfo.error;
                 const failedName = this._getPluginName(failedPlugin);
                 throw new DatabaseError(`Failed to install plugin '${failedName}': ${error?.message || error}`, {
                     operation: 'startPlugins.install',
@@ -10086,10 +10157,7 @@ class DatabasePlugins {
                     original: error
                 });
             }
-            const startResult = await promisePool.PromisePool
-                .withConcurrency(concurrency)
-                .for(plugins)
-                .process(async (plugin) => {
+            const startResult = await TasksPool.map(plugins, async (plugin) => {
                 const pluginName = this._getPluginName(plugin);
                 await plugin.start();
                 db.emit('db:plugin:metrics', {
@@ -10098,11 +10166,11 @@ class DatabasePlugins {
                     ...this.coordinators.collectMemorySnapshot()
                 });
                 return plugin;
-            });
+            }, { concurrency });
             if (startResult.errors.length > 0) {
                 const errorInfo = startResult.errors[0];
                 const failedPlugin = errorInfo.item;
-                const error = errorInfo.raw || errorInfo.error || errorInfo;
+                const error = errorInfo.error;
                 const failedName = this._getPluginName(failedPlugin);
                 throw new DatabaseError(`Failed to start plugin '${failedName}': ${error?.message || error}`, {
                     operation: 'startPlugins.start',
@@ -14185,6 +14253,40 @@ class ResourceMiddleware {
     }
 }
 
+/**
+ * S3 Key Utilities
+ *
+ * S3 keys always use POSIX-style forward slashes regardless of the operating system.
+ * These utilities ensure consistent key construction across all platforms.
+ */
+const UNSAFE_KEY_CHARS = /[\\\/=%]/;
+/**
+ * Validates that a value is safe for use in S3 keys.
+ * IDs and partition values must be URL-friendly (no /, \, =, or %).
+ * Returns true if valid, false if contains unsafe characters.
+ */
+function isValidS3KeySegment(value) {
+    return !UNSAFE_KEY_CHARS.test(value);
+}
+/**
+ * Validates a value for S3 key usage, throwing ValidationError if invalid.
+ * Use this for IDs and partition values.
+ * Accepts any value type - coerces to string for validation.
+ */
+function validateS3KeySegment(value, context) {
+    const strValue = String(value);
+    if (UNSAFE_KEY_CHARS.test(strValue)) {
+        const invalidChars = strValue.match(UNSAFE_KEY_CHARS);
+        throw new ValidationError(`Invalid ${context}: contains unsafe character '${invalidChars?.[0]}'`, {
+            field: context,
+            value: strValue,
+            constraint: 'url-safe',
+            statusCode: 400,
+            suggestion: 'IDs and partition values must be URL-friendly (no /, \\, =, or %). Use alphanumeric characters, hyphens, or underscores.'
+        });
+    }
+}
+
 class ResourcePartitions {
     resource;
     _strictValidation;
@@ -14397,7 +14499,11 @@ class ResourcePartitions {
         return `resource=${this.resource.name}/partition=${partition}`;
     }
     extractValuesFromKey(id, keys, sortedFields) {
-        const keyForId = keys.find(key => key.includes(`id=${id}`));
+        const idSegment = `id=${id}`;
+        const keyForId = keys.find(key => {
+            const segments = key.split('/');
+            return segments.some(segment => segment === idSegment);
+        });
         if (!keyForId) {
             throw new PartitionError(`Partition key not found for ID ${id}`, {
                 resourceName: this.resource.name,
@@ -14554,6 +14660,12 @@ class ResourcePartitions {
         }
     }
     async getFromPartition({ id, partitionName, partitionValues = {} }) {
+        validateS3KeySegment(id, 'id');
+        for (const [fieldName, value] of Object.entries(partitionValues)) {
+            if (value !== undefined && value !== null) {
+                validateS3KeySegment(value, `partitionValues.${fieldName}`);
+            }
+        }
         const partitions = this.getPartitions();
         if (!partitions || !partitions[partitionName]) {
             throw new PartitionError(`Partition '${partitionName}' not found`, {
@@ -14841,58 +14953,32 @@ class ResourceQuery {
         return results;
     }
     async page({ offset = 0, size = 100, partition = null, partitionValues = {}, skipCount = false } = {}) {
-        const [ok, err, result] = await tryFn(async () => {
-            let totalItems = null;
-            let totalPages = null;
-            if (!skipCount) {
-                const [okCount, , count] = await tryFn(() => this.count({ partition, partitionValues }));
-                if (okCount && count !== undefined) {
-                    totalItems = count;
-                    totalPages = Math.ceil(totalItems / size);
-                }
-            }
-            const page = Math.floor(offset / size);
-            let items = [];
-            if (size > 0) {
-                const [okList, , listResult] = await tryFn(() => this.list({ partition, partitionValues, limit: size, offset }));
-                items = okList && listResult ? listResult : [];
-            }
-            const pageResult = {
-                items,
-                totalItems,
-                page,
-                pageSize: size,
-                totalPages,
-                hasMore: items.length === size && (offset + size) < (totalItems || Infinity),
-                _debug: {
-                    requestedSize: size,
-                    requestedOffset: offset,
-                    actualItemsReturned: items.length,
-                    skipCount,
-                    hasTotalItems: totalItems !== null
-                }
-            };
-            this.resource._emitStandardized('paginated', pageResult);
-            return pageResult;
-        });
-        if (ok && result)
-            return result;
-        return {
-            items: [],
-            totalItems: null,
-            page: Math.floor(offset / size),
-            pageSize: size,
-            totalPages: null,
-            hasMore: false,
+        const effectiveSize = size > 0 ? size : 100;
+        let totalItems = null;
+        let totalPages = null;
+        if (!skipCount) {
+            totalItems = await this.count({ partition, partitionValues });
+            totalPages = Math.ceil(totalItems / effectiveSize);
+        }
+        const page = Math.floor(offset / effectiveSize);
+        const items = await this.list({ partition, partitionValues, limit: effectiveSize, offset });
+        const pageResult = {
+            items,
+            totalItems,
+            page,
+            pageSize: effectiveSize,
+            totalPages,
+            hasMore: items.length === effectiveSize && (offset + effectiveSize) < (totalItems || Infinity),
             _debug: {
                 requestedSize: size,
                 requestedOffset: offset,
-                actualItemsReturned: 0,
-                skipCount: skipCount,
-                hasTotalItems: false,
-                error: err.message
+                actualItemsReturned: items.length,
+                skipCount,
+                hasTotalItems: totalItems !== null
             }
         };
+        this.resource._emitStandardized('paginated', pageResult);
+        return pageResult;
     }
     async query(filter = {}, { limit = 100, offset = 0, partition = null, partitionValues = {} } = {}) {
         await this.resource.executeHooks('beforeQuery', { filter, limit, offset, partition, partitionValues });
@@ -15613,6 +15699,71 @@ function getBehavior(behaviorName) {
 const AVAILABLE_BEHAVIORS = Object.keys(behaviors);
 const DEFAULT_BEHAVIOR = 'user-managed';
 
+/**
+ * S3 Error Classification Utilities
+ *
+ * Provides consistent error classification across all S3 operations.
+ * Handles differences between AWS SDK v3, MinIO, and other S3-compatible clients.
+ */
+/**
+ * Checks if an error indicates the object/resource was not found.
+ * Handles various S3 client error formats (AWS SDK v3, MinIO, etc.)
+ */
+function isNotFoundError$1(error) {
+    if (!error)
+        return false;
+    const err = error;
+    return (err.name === 'NoSuchKey' ||
+        err.name === 'NotFound' ||
+        err.code === 'NoSuchKey' ||
+        err.code === 'NotFound' ||
+        err.Code === 'NoSuchKey' ||
+        err.Code === 'NotFound' ||
+        err.statusCode === 404 ||
+        err.$metadata?.httpStatusCode === 404 ||
+        (typeof err.message === 'string' && err.message.includes('NoSuchKey')));
+}
+
+/**
+ * Safe Merge Utilities
+ *
+ * Provides functions to sanitize object keys before merging,
+ * preventing prototype pollution attacks via __proto__, constructor, or prototype keys.
+ */
+const DANGEROUS_KEYS = ['__proto__', 'constructor', 'prototype'];
+/**
+ * Check if a key is dangerous for object property assignment.
+ * Handles both simple keys and dot-notation paths.
+ */
+function isDangerousKey(key) {
+    if (DANGEROUS_KEYS.includes(key)) {
+        return true;
+    }
+    if (key.includes('.')) {
+        return key.split('.').some(part => DANGEROUS_KEYS.includes(part));
+    }
+    return false;
+}
+/**
+ * Recursively sanitize an object, removing dangerous keys at all levels.
+ * Use this for deep merge operations.
+ */
+function sanitizeDeep(obj) {
+    if (obj === null || typeof obj !== 'object') {
+        return obj;
+    }
+    if (Array.isArray(obj)) {
+        return obj.map(item => sanitizeDeep(item));
+    }
+    const result = {};
+    for (const [key, value] of Object.entries(obj)) {
+        if (!isDangerousKey(key)) {
+            result[key] = sanitizeDeep(value);
+        }
+    }
+    return result;
+}
+
 class ResourcePersistence {
     resource;
     constructor(resource) {
@@ -15638,10 +15789,10 @@ class ResourcePersistence {
             attributes.updatedAt = new Date().toISOString();
         }
         const attributesWithDefaults = this.validator.applyDefaults(attributes);
-        const completeData = id$1 !== undefined
+        const completeData = sanitizeDeep(id$1 !== undefined
             ? { id: id$1, ...attributesWithDefaults }
-            : { ...attributesWithDefaults };
-        const preProcessedData = await this.resource.executeHooks('beforeInsert', completeData);
+            : { ...attributesWithDefaults });
+        const preProcessedData = sanitizeDeep(await this.resource.executeHooks('beforeInsert', completeData));
         const extraProps = Object.keys(preProcessedData).filter(k => !(k in completeData) || preProcessedData[k] !== completeData[k]);
         const extraData = {};
         for (const k of extraProps)
@@ -15865,7 +16016,7 @@ class ResourcePersistence {
     }
     async getOrNull(id) {
         const [ok, err, data] = await tryFn(() => this.get(id));
-        if (!ok && err && (err.name === 'NoSuchKey' || err.message?.includes('NoSuchKey'))) {
+        if (!ok && err && isNotFoundError$1(err)) {
             return null;
         }
         if (!ok || !data)
@@ -15874,7 +16025,7 @@ class ResourcePersistence {
     }
     async getOrThrow(id) {
         const [ok, err, data] = await tryFn(() => this.get(id));
-        if (!ok && err && (err.name === 'NoSuchKey' || err.message?.includes('NoSuchKey'))) {
+        if (!ok && err && isNotFoundError$1(err)) {
             throw new ResourceError(`Resource '${this.name}' with id '${id}' not found`, {
                 resourceName: this.name,
                 operation: 'getOrThrow',
@@ -15889,7 +16040,12 @@ class ResourcePersistence {
     async exists(id) {
         await this.resource.executeHooks('beforeExists', { id });
         const key = this.resource.getResourceKey(id);
-        const [ok] = await tryFn(() => this.client.headObject(key));
+        const [ok, err] = await tryFn(() => this.client.headObject(key));
+        if (!ok && err) {
+            if (!isNotFoundError$1(err)) {
+                throw err;
+            }
+        }
         await this.resource.executeHooks('afterExists', { id, exists: ok });
         return ok;
     }
@@ -16070,7 +16226,8 @@ class ResourcePersistence {
                 mergedData.metadata = { ...mergedData.metadata };
             mergedData.metadata.updatedAt = now;
         }
-        const preProcessedData = await this.resource.executeHooks('beforeUpdate', mergedData);
+        mergedData = sanitizeDeep(mergedData);
+        const preProcessedData = sanitizeDeep(await this.resource.executeHooks('beforeUpdate', mergedData));
         const completeData = { ...originalData, ...preProcessedData, id };
         const { isValid, errors, data } = await this.resource.validate(completeData, { includeId: true });
         if (!isValid) {
@@ -16128,9 +16285,6 @@ class ResourcePersistence {
             if (okParse)
                 finalContentType = 'application/json';
         }
-        if (this.versioningEnabled && originalData._v !== this.version) {
-            await this.resource.createHistoricalVersion(id, originalData);
-        }
         const [ok, err] = await tryFn(() => this.client.putObject({
             key,
             body: finalBody,
@@ -16175,6 +16329,17 @@ class ResourcePersistence {
                 id
             });
         }
+        if (this.versioningEnabled && originalData._v !== this.version) {
+            const [okHistory, errHistory] = await tryFn(() => this.resource.createHistoricalVersion(id, originalData));
+            if (!okHistory) {
+                this.resource.emit('historyError', {
+                    operation: 'update',
+                    id,
+                    error: errHistory,
+                    message: errHistory.message
+                });
+            }
+        }
         const updatedData = await this.resource.composeFullObjectFromWrite({
             id,
             metadata: finalMetadata,
@@ -16297,6 +16462,7 @@ class ResourcePersistence {
         if (this.config.timestamps) {
             mergedData.updatedAt = new Date().toISOString();
         }
+        mergedData = sanitizeDeep(mergedData);
         const { isValid, errors } = await this.validator.validate(mergedData);
         if (!isValid) {
             throw new ValidationError('Validation failed during patch', {
@@ -16360,7 +16526,7 @@ class ResourcePersistence {
             }
             attributesWithDefaults.updatedAt = new Date().toISOString();
         }
-        const completeData = { id, ...attributesWithDefaults };
+        const completeData = sanitizeDeep({ id, ...attributesWithDefaults });
         const { errors, isValid, data: validated, } = await this.resource.validate(completeData, { includeId: true });
         if (!isValid) {
             const errorMsg = (errors && errors.length && errors[0]?.message) ? errors[0].message : 'Replace failed';
@@ -16510,7 +16676,8 @@ class ResourcePersistence {
                 mergedData.metadata = { ...mergedData.metadata };
             mergedData.metadata.updatedAt = now;
         }
-        const preProcessedData = await this.resource.executeHooks('beforeUpdate', mergedData);
+        mergedData = sanitizeDeep(mergedData);
+        const preProcessedData = sanitizeDeep(await this.resource.executeHooks('beforeUpdate', mergedData));
         const completeData = { ...originalData, ...preProcessedData, id };
         const { isValid, errors, data } = await this.resource.validate(completeData, { includeId: true });
         if (!isValid) {
@@ -16572,6 +16739,17 @@ class ResourcePersistence {
                 error: err.message || 'Update failed'
             };
         }
+        if (this.versioningEnabled && originalData._v !== this.version) {
+            const [okHistory, errHistory] = await tryFn(() => this.resource.createHistoricalVersion(id, originalData));
+            if (!okHistory) {
+                this.resource.emit('historyError', {
+                    operation: 'updateConditional',
+                    id,
+                    error: errHistory,
+                    message: errHistory.message
+                });
+            }
+        }
         const updatedData = await this.resource.composeFullObjectFromWrite({
             id,
             metadata: processedMetadata,
@@ -16687,6 +16865,9 @@ function validateResourceConfig(config) {
     else if (config.name.trim() === '') {
         errors.push("Resource 'name' cannot be empty");
     }
+    else if (!isValidS3KeySegment(config.name)) {
+        errors.push(`Resource 'name' must be URL-friendly (no /, \\, =, or %). Got: '${config.name}'`);
+    }
     if (!config.client) {
         errors.push("S3 'client' is required");
     }
@@ -16746,7 +16927,10 @@ function validateResourceConfig(config) {
         }
         else {
             for (const [partitionName, partitionDef] of Object.entries(config.partitions)) {
-                if (typeof partitionDef !== 'object' || Array.isArray(partitionDef)) {
+                if (!isValidS3KeySegment(partitionName)) {
+                    errors.push(`Partition name '${partitionName}' must be URL-friendly (no /, \\, =, or %)`);
+                }
+                else if (typeof partitionDef !== 'object' || Array.isArray(partitionDef)) {
                     errors.push(`Partition '${partitionName}' must be an object`);
                 }
                 else if (!partitionDef.fields) {
@@ -16757,7 +16941,10 @@ function validateResourceConfig(config) {
                 }
                 else {
                     for (const [fieldName, fieldType] of Object.entries(partitionDef.fields)) {
-                        if (typeof fieldType !== 'string') {
+                        if (!isValidS3KeySegment(fieldName)) {
+                            errors.push(`Partition field '${fieldName}' must be URL-friendly (no /, \\, =, or %)`);
+                        }
+                        else if (typeof fieldType !== 'string') {
                             errors.push(`Partition '${partitionName}.fields.${fieldName}' must be a string`);
                         }
                     }
@@ -17205,6 +17392,7 @@ class Resource extends AsyncEventEmitter {
         return this._partitions.applyRule(value, rule);
     }
     getResourceKey(id) {
+        validateS3KeySegment(id, 'id');
         const key = path$2.join('resource=' + this.name, 'data', `id=${id}`);
         return key;
     }
@@ -17974,16 +18162,13 @@ class DatabaseConnection {
                     }
                 }
                 const stopConcurrency = Math.max(1, Number.isFinite(db.executorPool?.concurrency) ? db.executorPool.concurrency : 5);
-                await promisePool.PromisePool
-                    .withConcurrency(stopConcurrency)
-                    .for(db.pluginList)
-                    .process(async (plugin) => {
+                await TasksPool.map(db.pluginList, async (plugin) => {
                     await tryFn(async () => {
                         if (plugin && typeof plugin.stop === 'function') {
                             await plugin.stop();
                         }
                     });
-                });
+                }, { concurrency: stopConcurrency });
             }
             if (db.resources && Object.keys(db.resources).length > 0) {
                 for (const [, resource] of Object.entries(db.resources)) {
@@ -18087,8 +18272,8 @@ class Database extends SafeEventEmitter {
         })();
         this.version = '1';
         this.s3dbVersion = (() => {
-            const [ok, , version] = tryFnSync(() => (typeof globalThis['18.0.11-next.1534f717'] !== 'undefined' && globalThis['18.0.11-next.1534f717'] !== '18.0.11-next.1534f717'
-                ? globalThis['18.0.11-next.1534f717']
+            const [ok, , version] = tryFnSync(() => (typeof globalThis['18.0.11-next.e8e71b5b'] !== 'undefined' && globalThis['18.0.11-next.e8e71b5b'] !== '18.0.11-next.e8e71b5b'
+                ? globalThis['18.0.11-next.e8e71b5b']
                 : 'latest'));
             return ok ? version : 'latest';
         })();
@@ -19718,6 +19903,120 @@ class PluginStorage {
         });
         return Promise.all(promises);
     }
+    /**
+     * Set data only if the key does not exist (conditional PUT).
+     * Uses ifNoneMatch: '*' to ensure atomicity.
+     * @returns The ETag (version) if set succeeded, null if key already exists.
+     */
+    async setIfNotExists(key, data, options = {}) {
+        const [ok, err, response] = await tryFn(() => this.set(key, data, { ...options, ifNoneMatch: '*' }));
+        if (!ok) {
+            const error = err;
+            // PreconditionFailed (412) or similar means key already exists
+            if (error?.name === 'PreconditionFailed' ||
+                error?.code === 'PreconditionFailed' ||
+                error?.statusCode === 412) {
+                return null;
+            }
+            throw err;
+        }
+        return response?.ETag ?? null;
+    }
+    /**
+     * Get data along with its version (ETag) for conditional updates.
+     * @returns Object with data and version, or { data: null, version: null } if not found.
+     */
+    async getWithVersion(key) {
+        const [ok, err, response] = await tryFn(() => this.client.getObject(key));
+        if (!ok || !response) {
+            const error = err;
+            if (error?.name === 'NoSuchKey' ||
+                error?.code === 'NoSuchKey' ||
+                error?.Code === 'NoSuchKey' ||
+                error?.statusCode === 404) {
+                return { data: null, version: null };
+            }
+            throw new PluginStorageError(`Failed to retrieve plugin data with version`, {
+                pluginSlug: this.pluginSlug,
+                key,
+                operation: 'getWithVersion',
+                original: err,
+                suggestion: 'Check if the key exists and S3 permissions are correct'
+            });
+        }
+        const metadata = response.Metadata || {};
+        const parsedMetadata = this._parseMetadataValues(metadata);
+        let data = parsedMetadata;
+        if (response.Body) {
+            const [parseOk, parseErr, result] = await tryFn(async () => {
+                const bodyContent = await response.Body.transformToString();
+                if (bodyContent && bodyContent.trim()) {
+                    const body = JSON.parse(bodyContent);
+                    return { ...parsedMetadata, ...body };
+                }
+                return parsedMetadata;
+            });
+            if (!parseOk || !result) {
+                throw new PluginStorageError(`Failed to parse JSON body`, {
+                    pluginSlug: this.pluginSlug,
+                    key,
+                    operation: 'getWithVersion',
+                    original: parseErr,
+                    suggestion: 'Body content may be corrupted'
+                });
+            }
+            data = result;
+        }
+        // Check expiration
+        const expiresAt = (data._expiresat || data._expiresAt);
+        if (expiresAt && Date.now() > expiresAt) {
+            await this.delete(key);
+            return { data: null, version: null };
+        }
+        // Clean up internal fields
+        delete data._expiresat;
+        delete data._expiresAt;
+        // Extract ETag from response - need to get it from headObject since getObject may not return it
+        const [headOk, , headResponse] = await tryFn(() => this.client.headObject(key));
+        const version = headOk && headResponse ? headResponse.ETag ?? null : null;
+        return { data, version };
+    }
+    /**
+     * Set data only if the current version matches (conditional PUT).
+     * Uses ifMatch to ensure no concurrent modifications.
+     * @returns The new ETag (version) if set succeeded, null if version mismatch.
+     */
+    async setIfVersion(key, data, version, options = {}) {
+        const [ok, err, response] = await tryFn(() => this.set(key, data, { ...options, ifMatch: version }));
+        if (!ok) {
+            const error = err;
+            // PreconditionFailed (412) means version mismatch
+            if (error?.name === 'PreconditionFailed' ||
+                error?.code === 'PreconditionFailed' ||
+                error?.statusCode === 412) {
+                return null;
+            }
+            throw err;
+        }
+        return response?.ETag ?? null;
+    }
+    /**
+     * Delete data only if the current version matches (conditional DELETE).
+     * @returns true if deleted, false if version mismatch or key not found.
+     */
+    async deleteIfVersion(key, version) {
+        // First verify the version matches
+        const [headOk, , headResponse] = await tryFn(() => this.client.headObject(key));
+        if (!headOk || !headResponse) {
+            return false;
+        }
+        const currentVersion = headResponse.ETag;
+        if (currentVersion !== version) {
+            return false;
+        }
+        const [deleteOk] = await tryFn(() => this.client.deleteObject(key));
+        return deleteOk;
+    }
     async acquireLock(lockName, options = {}) {
         return this._lock.acquire(lockName, options);
     }
@@ -20110,19 +20409,6 @@ class InMemoryPersistence {
     }
 }
 
-let PromisePoolCache = null;
-async function loadPromisePool() {
-    if (PromisePoolCache)
-        return PromisePoolCache;
-    try {
-        const module = await import('@supercharge/promise-pool');
-        PromisePoolCache = module;
-        return PromisePoolCache;
-    }
-    catch {
-        throw new Error('Failed to load @supercharge/promise-pool. Please install it: pnpm add @supercharge/promise-pool');
-    }
-}
 class HighPerformanceInserter {
     resource;
     batchSize;
@@ -20188,13 +20474,7 @@ class HighPerformanceInserter {
         const batch = this.insertBuffer.splice(0, this.batchSize);
         const startTime = Date.now();
         const [ok] = await tryFn(async () => {
-            const { PromisePool } = await loadPromisePool();
-            const { results, errors } = await PromisePool
-                .for(batch)
-                .withConcurrency(this.concurrency)
-                .process(async (item) => {
-                return await this.performInsert(item);
-            });
+            const { results, errors } = await TasksPool.map(batch, async (item) => this.performInsert(item), { concurrency: this.concurrency });
             const duration = Date.now() - startTime;
             this.stats.inserted += results.filter(r => r.success).length;
             this.stats.failed += errors.length;
@@ -20246,11 +20526,7 @@ class HighPerformanceInserter {
                 this.partitionProcessor = null;
                 return;
             }
-            const { PromisePool } = await loadPromisePool();
-            await PromisePool
-                .for(batch)
-                .withConcurrency(10)
-                .process(async (item) => {
+            await TasksPool.map(batch, async (item) => {
                 const [ok, err] = await tryFn(() => this.resource.createPartitionReferences(item.data));
                 if (ok) {
                     this.stats.partitionsPending--;
@@ -20261,7 +20537,7 @@ class HighPerformanceInserter {
                         error: err
                     });
                 }
-            });
+            }, { concurrency: 10 });
             if (this.partitionQueue.length > 0) {
                 this.processPartitionsAsync();
             }
@@ -20324,17 +20600,11 @@ class StreamInserter {
         return { id, inserted: true };
     }
     async bulkInsert(items) {
-        const { PromisePool } = await loadPromisePool();
-        const { results, errors } = await PromisePool
-            .for(items)
-            .withConcurrency(this.concurrency)
-            .process(async (item) => {
-            return await this.fastInsert(item);
-        });
+        const { results, errors } = await TasksPool.map(items, async (item) => this.fastInsert(item), { concurrency: this.concurrency });
         return {
             success: results.length,
             failed: errors.length,
-            errors: errors.slice(0, 10)
+            errors: errors.map(e => e.error).slice(0, 10)
         };
     }
 }
@@ -46079,19 +46349,16 @@ async function runConsolidation(handler, storage, config, emitFn) {
             return result;
         }
         const byOriginalId = groupByOriginalId(allTransactions);
-        const { results, errors } = await promisePool.PromisePool
-            .for(Object.entries(byOriginalId))
-            .withConcurrency(10)
-            .process(async ([originalId, transactions]) => {
+        const { results, errors } = await TasksPool.map(Object.entries(byOriginalId), async ([originalId, transactions]) => {
             return consolidateRecord(handler, originalId, transactions, config);
-        });
+        }, { concurrency: 10 });
         for (const recordResult of results) {
             if (recordResult) {
                 result.recordsProcessed++;
                 result.transactionsApplied += recordResult.transactionsApplied;
             }
         }
-        result.errors = errors;
+        result.errors = errors.map(e => e.error);
         result.success = errors.length === 0;
         if (config.enableAnalytics && handler.analyticsResource) {
             const analyticsConfig = {
@@ -46444,13 +46711,10 @@ async function runGarbageCollection(transactionResource, storage, config, emitFn
         if (!oldTransactions || oldTransactions.length === 0) {
             return;
         }
-        const { results, errors } = await promisePool.PromisePool
-            .for(oldTransactions)
-            .withConcurrency(10)
-            .process(async (txn) => {
+        const { results, errors } = await TasksPool.map(oldTransactions, async (txn) => {
             const [deleted] = await tryFn(() => transactionResource.delete(txn.id));
             return deleted;
-        });
+        }, { concurrency: 10 });
         if (emitFn) {
             emitFn('plg:eventual-consistency:gc-completed', {
                 resource: config.resource,
@@ -80655,9 +80919,7 @@ class SchedulerManager {
             targetCount: activeTargets.length,
             targets: activeTargets.map(t => t.id)
         });
-        await promisePool.PromisePool.withConcurrency(this.plugin.config.concurrency || 1)
-            .for(activeTargets)
-            .process(async (targetEntry) => {
+        await TasksPool.map(activeTargets, async (targetEntry) => {
             try {
                 const report = await this.plugin.runDiagnostics(targetEntry.target, {
                     behavior: targetEntry.behavior,
@@ -80682,7 +80944,7 @@ class SchedulerManager {
                     error
                 });
             }
-        });
+        }, { concurrency: this.plugin.config.concurrency || 1 });
         this.plugin.emit('recon:sweep-completed', {
             reason,
             targetCount: activeTargets.length
@@ -87464,29 +87726,16 @@ class BaseReplicator extends EventEmitter {
             });
         }
         const limit = Math.max(1, concurrency ?? this.batchConcurrency ?? 5);
-        const results = [];
-        const errors = [];
-        await promisePool.PromisePool
-            .withConcurrency(limit)
-            .for(records)
-            .process(async (record) => {
-            try {
-                const result = await handler(record);
-                results.push(result);
-            }
-            catch (error) {
-                if (typeof mapError === 'function') {
-                    const mapped = mapError(error, record);
-                    if (mapped !== undefined) {
-                        errors.push(mapped);
-                    }
-                }
-                else {
-                    errors.push({ record, error: error });
-                }
-            }
+        const poolResult = await TasksPool.map(records, async (record) => handler(record), {
+            concurrency: limit,
+            onItemError: mapError
+                ? (error, record) => mapError(error, record)
+                : undefined
         });
-        return { results, errors };
+        const errors = mapError
+            ? poolResult.errors.map(e => mapError(e.error, e.item)).filter(m => m !== undefined)
+            : poolResult.errors.map(e => ({ record: e.item, error: e.error }));
+        return { results: poolResult.results, errors };
     }
     createError(message, details = {}) {
         return new ReplicationError(message, {
@@ -89190,10 +89439,7 @@ class ReplicatorPlugin extends Plugin {
         }
         const entries = applicableReplicators.map((replicator, index) => ({ replicator, index }));
         const outcomes = new Array(entries.length);
-        const poolResult = await promisePool.PromisePool
-            .withConcurrency(this.config.replicatorConcurrency)
-            .for(entries)
-            .process(async ({ replicator, index }) => {
+        const poolResult = await TasksPool.map(entries, async ({ replicator, index }) => {
             const [ok, error, replicationResult] = await tryFn(async () => {
                 const result = await this.retryWithBackoff(() => replicator.replicate(resourceName, operation, sanitizedData, recordId, sanitizedBefore), this.config.maxRetries);
                 this.emit('plg:replicator:replicated', {
@@ -89225,7 +89471,7 @@ class ReplicatorPlugin extends Plugin {
             }
             outcomes[index] = { status: 'rejected', reason: error };
             throw error;
-        });
+        }, { concurrency: this.config.replicatorConcurrency });
         if (poolResult.errors.length > 0) {
             for (const poolError of poolResult.errors) {
                 const { item, error } = poolError;
@@ -89246,10 +89492,7 @@ class ReplicatorPlugin extends Plugin {
         }
         const entries = applicableReplicators.map((replicator, index) => ({ replicator, index }));
         const outcomes = new Array(entries.length);
-        await promisePool.PromisePool
-            .withConcurrency(this.config.replicatorConcurrency)
-            .for(entries)
-            .process(async ({ replicator, index }) => {
+        await TasksPool.map(entries, async ({ replicator, index }) => {
             const [wrapperOk, wrapperError] = await tryFn(async () => {
                 const preparedData = item.data ? this.filterInternalFields(item.data) : null;
                 const preparedBefore = item.beforeData ? this.filterInternalFields(item.beforeData) : null;
@@ -89299,7 +89542,7 @@ class ReplicatorPlugin extends Plugin {
             const failure = { success: false, error: wrapperError.message };
             outcomes[index] = { status: 'fulfilled', value: failure };
             return failure;
-        });
+        }, { concurrency: this.config.replicatorConcurrency });
         return outcomes;
     }
     async logReplicator(item) {
@@ -89352,10 +89595,7 @@ class ReplicatorPlugin extends Plugin {
     async getReplicatorStats() {
         const entries = this.replicators.map((replicator, index) => ({ replicator, index }));
         const replicatorStats = new Array(entries.length);
-        const poolResult = await promisePool.PromisePool
-            .withConcurrency(this.config.replicatorConcurrency)
-            .for(entries)
-            .process(async ({ replicator, index }) => {
+        const poolResult = await TasksPool.map(entries, async ({ replicator, index }) => {
             const status = await replicator.getStatus();
             const info = {
                 id: replicator.id,
@@ -89365,7 +89605,7 @@ class ReplicatorPlugin extends Plugin {
             };
             replicatorStats[index] = info;
             return info;
-        });
+        }, { concurrency: this.config.replicatorConcurrency });
         if (poolResult.errors.length > 0) {
             const poolError = poolResult.errors[0];
             const { item, error } = poolError;
@@ -89410,10 +89650,7 @@ class ReplicatorPlugin extends Plugin {
             status: 'failed'
         });
         let retried = 0;
-        const processResult = await promisePool.PromisePool
-            .withConcurrency(this.config.replicatorConcurrency)
-            .for(failedLogs || [])
-            .process(async (log) => {
+        const processResult = await TasksPool.map(failedLogs || [], async (log) => {
             const sanitizedData = log.data ? this.filterInternalFields(log.data) : null;
             const sanitizedBefore = log.beforeData ? this.filterInternalFields(log.beforeData) : null;
             const [ok, err, results] = await tryFn(async () => {
@@ -89464,7 +89701,7 @@ class ReplicatorPlugin extends Plugin {
                 error: failureMessage,
                 retryCount: (Number(log.retryCount) || 0) + 1
             });
-        });
+        }, { concurrency: this.config.replicatorConcurrency });
         if (processResult.errors.length) {
             for (const poolError of processResult.errors) {
                 const { item, error } = poolError;
@@ -89502,10 +89739,7 @@ class ReplicatorPlugin extends Plugin {
                     const records = Array.isArray(page) ? page : (page.items || []);
                     if (records.length === 0)
                         break;
-                    const poolResult = await promisePool.PromisePool
-                        .withConcurrency(this.config.replicatorConcurrency)
-                        .for(records)
-                        .process(async (record) => {
+                    const poolResult = await TasksPool.map(records, async (record) => {
                         const sanitizedRecord = this.filterInternalFields(record);
                         const [replicateOk, replicateError, result] = await tryFn(() => replicator.replicate(resourceName, 'insert', sanitizedRecord, sanitizedRecord.id));
                         if (!replicateOk) {
@@ -89533,7 +89767,7 @@ class ReplicatorPlugin extends Plugin {
                             success: true
                         });
                         return result;
-                    });
+                    }, { concurrency: this.config.replicatorConcurrency });
                     if (poolResult.errors.length > 0) {
                         const poolError = poolResult.errors[0];
                         throw poolError.error;
@@ -89547,10 +89781,7 @@ class ReplicatorPlugin extends Plugin {
     async stop() {
         const [ok, error] = await tryFn(async () => {
             if (this.replicators && this.replicators.length > 0) {
-                await promisePool.PromisePool
-                    .withConcurrency(this.config.stopConcurrency)
-                    .for(this.replicators)
-                    .process(async (replicator) => {
+                await TasksPool.map(this.replicators, async (replicator) => {
                     const [replicatorOk, replicatorError] = await tryFn(async () => {
                         if (replicator && typeof replicator.stop === 'function') {
                             await replicator.stop();
@@ -89564,7 +89795,7 @@ class ReplicatorPlugin extends Plugin {
                             error: replicatorError.message
                         });
                     }
-                });
+                }, { concurrency: this.config.stopConcurrency });
             }
             this.removeDatabaseHooks();
             if (this.database && this.database.resources) {
@@ -89914,17 +90145,14 @@ class QueueConsumerPlugin extends Plugin {
         if (startTasks.length === 0) {
             return;
         }
-        const { errors } = await promisePool.PromisePool
-            .withConcurrency(this.startConcurrency)
-            .for(startTasks)
-            .process(async (task) => {
+        const { errors } = await TasksPool.map(startTasks, async (task) => {
             await task.start();
             return `${task.driver}:${task.resource}`;
-        });
+        }, { concurrency: this.startConcurrency });
         if (errors.length > 0) {
-            const messages = errors.map((error) => {
-                const task = error.item;
-                const reason = error.reason ?? error;
+            const messages = errors.map((errorInfo) => {
+                const task = errorInfo.item;
+                const reason = errorInfo.error;
                 const identifier = task ? `${task.driver || 'unknown'}:${task.resource || 'unknown'}` : 'unknown';
                 return `[${identifier}] ${reason?.message || reason}`;
             });
@@ -89947,16 +90175,13 @@ class QueueConsumerPlugin extends Plugin {
             consumer,
             stop: () => consumer.stop()
         }));
-        const { errors } = await promisePool.PromisePool
-            .withConcurrency(this.stopConcurrency)
-            .for(stopTasks)
-            .process(async (task) => {
+        const { errors } = await TasksPool.map(stopTasks, async (task) => {
             await task.stop();
             return task.consumer;
-        });
+        }, { concurrency: this.stopConcurrency });
         if (errors.length > 0) {
-            errors.forEach((error) => {
-                const reason = error.reason ?? error;
+            errors.forEach((errorInfo) => {
+                const reason = errorInfo.error;
                 this.logger.warn({ error: reason?.message || reason }, `Failed to stop consumer: ${reason?.message || reason}`);
             });
         }