@exabugs/dynamodb-client 1.6.2 → 1.8.0

package/CHANGELOG.md

@@ -7,6 +7,31 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 
 ## [Unreleased]
 
+## [1.8.0] - 2026-10-12
+
+### Fixed
+
+- `sort: id` にフィルタを付けた一覧が、ページごとに全レコードを読み直していた(全ページで O(ページ数 × 件数)、更新中は取りこぼしの原因)。ID 順のカーソルで読み進める方式に変更し、全ページを通した読み取りは O(件数)、走査中の更新でも取りこぼし・重複が出ない (#50)
+- `bulkRecordRepair` が既定ソート(updatedAt)で列挙していたため、修復中の更新で取りこぼし・重複が出うる問題を、id 順の列挙に変更して解消 (#51)
+
+### Changed
+
+- `sort: id` + フィルタの `nextToken` は、オフセットではなく最後に読んだレコードのキーになった。デプロイをまたいで途中のページネーションを続けると、古いトークンは 400 になる
+- `sort: id` + フィルタは、ページが埋まる(perPage 件)か末尾に達するまで読んでから返す。一致が疎だと 1 リクエストで多くのレコードを読むので、頻繁に使う条件はシャドー(インデックス)の対象フィールドで絞ること。`perPage` 未満なら最終ページ、という前提は従来どおり保たれる
+
+## [1.7.0] - 2026-10-12
+
+### Fixed
+
+- 更新のドット記法パス(例: `sections.1.t`)が配列をオブジェクトに壊していた。配列は要素単位で更新し、範囲外・非数値の添字は 400 で拒否する。`__proto__` を含むパスも拒否する (#48)
+- 更新時に `updatedAt` が変わらなかった(既存の値が優先されていた)。パッチ側に付与して毎回更新する。クライアントが値を指定した場合はそれを尊重し、`null` / `undefined` は未指定として扱う (#48)
+- 解釈できないフィルタ指定が 500 (`CONFIG_ERROR`) になっていた。400 (`INVALID_FILTER`) を返す (#48)
+
+### Changed
+
+- **`updatedAt` を明示しない更新で、値が毎回変わる**ようになった。`updatedAt` 順の一覧は更新のたびに並びが変わり、`updatedAt` のシャドーの再作成により 1 レコードあたりの書き込み項目が増える
+- ドット記法で、存在しない(またはオブジェクト以外の)親に対する `null`(削除)は何もしなくなった(従来は `{a: null}` のような残骸が残っていた)
+
 ## [1.6.2] - 2026-10-11
 
 ### Security

package/dist/scripts/operations/bulkRecordRepair.js

@@ -32,7 +32,8 @@ export async function repairAllRecords(collection, dryRun) {
  * @returns 全レコードの配列
  */
 async function fetchAllRecords(collection) {
-    return await collection.find({}).toArrayAll();
+    // 修復中にレコードが更新されても取りこぼし・重複が出ないよう、不変の id 順で列挙する
+    return await collection.find({}).sort({ id: 'asc' }).toArrayAll();
 }
 /**
  * 単一レコードを処理

package/dist/scripts/operations/bulkRecordRepair.js.map

@@ -1 +1 @@
-{"version":3,"file":"bulkRecordRepair.js","sourceRoot":"","sources":["../../../src/scripts/operations/bulkRecordRepair.ts"],"names":[],"mappings":"AAMA,OAAO,EAEL,oBAAoB,EACpB,oBAAoB,EACpB,2BAA2B,EAC3B,gBAAgB,GACjB,MAAM,yBAAyB,CAAC;AAEjC;;;;;GAKG;AACH,MAAM,CAAC,KAAK,UAAU,gBAAgB,CACpC,UAA4E,EAC5E,MAAe;IAEf,MAAM,KAAK,GAAgB;QACzB,OAAO,EAAE,CAAC;QACV,WAAW,EAAE,CAAC;QACd,QAAQ,EAAE,CAAC;QACX,MAAM,EAAE,CAAC;QACT,MAAM,EAAE,EAAE;KACX,CAAC;IAEF,OAAO,CAAC,GAAG,CAAC,gCAAgC,CAAC,CAAC;IAC9C,OAAO,CAAC,GAAG,CAAC,SAAS,MAAM,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,QAAQ,EAAE,CAAC,CAAC;IAEtD,WAAW;IACX,MAAM,OAAO,GAAG,MAAM,eAAe,CAAC,UAAU,CAAC,CAAC;IAClD,OAAO,CAAC,GAAG,CAAC,SAAS,OAAO,CAAC,MAAM,UAAU,CAAC,CAAC;IAE/C,WAAW;IACX,KAAK,MAAM,UAAU,IAAI,OAAO,EAAE,CAAC;QACjC,MAAM,aAAa,CAAC,UAAU,EAAE,KAAK,EAAE,MAAM,EAAE,UAAU,CAAC,CAAC;IAC7D,CAAC;IAED,UAAU;IACV,oBAAoB,CAAC,KAAK,CAAC,CAAC;AAC9B,CAAC;AAED;;;;;GAKG;AACH,KAAK,UAAU,eAAe,CAC5B,UAA4E;IAE5E,OAAO,MAAM,UAAU,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC,UAAU,EAAE,CAAC;AAChD,CAAC;AAED;;;;;;;GAOG;AACH,KAAK,UAAU,aAAa,CAC1B,UAAkD,EAClD,KAAkB,EAClB,MAAe,EACf,UAA4E;IAE5E,KAAK,CAAC,OAAO,EAAE,CAAC;IAChB,MAAM,QAAQ,GAAG,UAAU,CAAC,EAAE,CAAC;IAE/B,IAAI,CAAC;QACH,MAAM,EAAE,WAAW,EAAE,cAAc,EAAE,YAAY,EAAE,GAAG,MAAM,oBAAoB,EAAE,CAAC;QAEnF,IAAI,WAAW,EAAE,CAAC;YAChB,KAAK,CAAC,WAAW,EAAE,CAAC;YACpB,OAAO,CAAC,GAAG,CACT,MAAM,KAAK,CAAC,OAAO,YAAY,QAAQ,aAAa,cAAc,WAAW,YAAY,EAAE,CAC5F,CAAC;YAEF,IAAI,CAAC,MAAM,EAAE,CAAC;gBACZ,MAAM,2BAA2B,CAAC,UAAU,EAAE,QAAQ,CAAC,CAAC;gBACxD,KAAK,CAAC,QAAQ,EAAE,CAAC;gBACjB,OAAO,CAAC,GAAG,CAAC,cAAc,CAAC,CAAC;gBAE5B,kBAAkB;gBAClB,MAAM,gBAAgB,EAAE,CAAC;YAC3B,CAAC;QACH,CAAC;IACH,CAAC;IAAC,OAAO,KAAc,EAAE,CAAC;QACxB;;;;;WAKG;QACH,KAAK,CAAC,MAAM,EAAE,CAAC;QACf,MAAM,YAAY,GAAG,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;QAC5E,KAAK,CAAC,MAAM,CAAC,IAAI,CAAC,EAAE,EAAE,EAAE,QAAQ,EAAE,KAAK,EAAE,YAAY,EAAE,CAAC,CAAC;QACzD,OAAO,CAAC,KAAK,CAAC,eAAe,YAAY,EAAE,CAAC,CAAC;IAC/C,CAAC;AACH,CAAC"}
+{"version":3,"file":"bulkRecordRepair.js","sourceRoot":"","sources":["../../../src/scripts/operations/bulkRecordRepair.ts"],"names":[],"mappings":"AAMA,OAAO,EAEL,oBAAoB,EACpB,oBAAoB,EACpB,2BAA2B,EAC3B,gBAAgB,GACjB,MAAM,yBAAyB,CAAC;AAEjC;;;;;GAKG;AACH,MAAM,CAAC,KAAK,UAAU,gBAAgB,CACpC,UAA4E,EAC5E,MAAe;IAEf,MAAM,KAAK,GAAgB;QACzB,OAAO,EAAE,CAAC;QACV,WAAW,EAAE,CAAC;QACd,QAAQ,EAAE,CAAC;QACX,MAAM,EAAE,CAAC;QACT,MAAM,EAAE,EAAE;KACX,CAAC;IAEF,OAAO,CAAC,GAAG,CAAC,gCAAgC,CAAC,CAAC;IAC9C,OAAO,CAAC,GAAG,CAAC,SAAS,MAAM,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,QAAQ,EAAE,CAAC,CAAC;IAEtD,WAAW;IACX,MAAM,OAAO,GAAG,MAAM,eAAe,CAAC,UAAU,CAAC,CAAC;IAClD,OAAO,CAAC,GAAG,CAAC,SAAS,OAAO,CAAC,MAAM,UAAU,CAAC,CAAC;IAE/C,WAAW;IACX,KAAK,MAAM,UAAU,IAAI,OAAO,EAAE,CAAC;QACjC,MAAM,aAAa,CAAC,UAAU,EAAE,KAAK,EAAE,MAAM,EAAE,UAAU,CAAC,CAAC;IAC7D,CAAC;IAED,UAAU;IACV,oBAAoB,CAAC,KAAK,CAAC,CAAC;AAC9B,CAAC;AAED;;;;;GAKG;AACH,KAAK,UAAU,eAAe,CAC5B,UAA4E;IAE5E,8CAA8C;IAC9C,OAAO,MAAM,UAAU,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC,IAAI,CAAC,EAAE,EAAE,EAAE,KAAK,EAAE,CAAC,CAAC,UAAU,EAAE,CAAC;AACpE,CAAC;AAED;;;;;;;GAOG;AACH,KAAK,UAAU,aAAa,CAC1B,UAAkD,EAClD,KAAkB,EAClB,MAAe,EACf,UAA4E;IAE5E,KAAK,CAAC,OAAO,EAAE,CAAC;IAChB,MAAM,QAAQ,GAAG,UAAU,CAAC,EAAE,CAAC;IAE/B,IAAI,CAAC;QACH,MAAM,EAAE,WAAW,EAAE,cAAc,EAAE,YAAY,EAAE,GAAG,MAAM,oBAAoB,EAAE,CAAC;QAEnF,IAAI,WAAW,EAAE,CAAC;YAChB,KAAK,CAAC,WAAW,EAAE,CAAC;YACpB,OAAO,CAAC,GAAG,CACT,MAAM,KAAK,CAAC,OAAO,YAAY,QAAQ,aAAa,cAAc,WAAW,YAAY,EAAE,CAC5F,CAAC;YAEF,IAAI,CAAC,MAAM,EAAE,CAAC;gBACZ,MAAM,2BAA2B,CAAC,UAAU,EAAE,QAAQ,CAAC,CAAC;gBACxD,KAAK,CAAC,QAAQ,EAAE,CAAC;gBACjB,OAAO,CAAC,GAAG,CAAC,cAAc,CAAC,CAAC;gBAE5B,kBAAkB;gBAClB,MAAM,gBAAgB,EAAE,CAAC;YAC3B,CAAC;QACH,CAAC;IACH,CAAC;IAAC,OAAO,KAAc,EAAE,CAAC;QACxB;;;;;WAKG;QACH,KAAK,CAAC,MAAM,EAAE,CAAC;QACf,MAAM,YAAY,GAAG,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;QAC5E,KAAK,CAAC,MAAM,CAAC,IAAI,CAAC,EAAE,EAAE,EAAE,QAAQ,EAAE,KAAK,EAAE,YAAY,EAAE,CAAC,CAAC;QACzD,OAAO,CAAC,KAAK,CAAC,eAAe,YAAY,EAAE,CAAC,CAAC;IAC/C,CAAC;AACH,CAAC"}

package/dist/server/handler.cjs

@@ -1,5 +1,5 @@
-// @exabugs/dynamodb-client v1.6.2
-// Built: 2026-10-11T14:15:49.129Z
+// @exabugs/dynamodb-client v1.8.0
+// Built: 2026-10-11T23:03:45.636Z
 "use strict";
 var __create = Object.create;
 var __defProp = Object.defineProperty;
@@ -73,7 +73,7 @@ var init_types = __esm({
 function isAppError(error2) {
   return error2 instanceof AppError;
 }
-var AppError, AuthError, ConfigError, InvalidTokenError, ItemNotFoundError;
+var AppError, AuthError, ConfigError, InvalidFilterError, InvalidTokenError, ItemNotFoundError;
 var init_errors = __esm({
   "src/shared/errors/index.ts"() {
     "use strict";
@@ -117,6 +117,14 @@ var init_errors = __esm({
         super("CONFIG_ERROR" /* CONFIG_ERROR */, message, 500, details);
       }
     };
+    InvalidFilterError = class extends AppError {
+      static {
+        __name(this, "InvalidFilterError");
+      }
+      constructor(message, details) {
+        super("INVALID_FILTER" /* INVALID_FILTER */, message, 400, details);
+      }
+    };
     InvalidTokenError = class extends AppError {
       static {
         __name(this, "InvalidTokenError");
@@ -34459,7 +34467,7 @@ function parseFilters(filter) {
         fieldKey,
         error: error2 instanceof Error ? error2.message : String(error2)
       });
-      throw new ConfigError(`Invalid filter field syntax: ${fieldKey}`, {
+      throw new InvalidFilterError(`Invalid filter field syntax: ${fieldKey}`, {
         field: fieldKey,
         error: error2 instanceof Error ? error2.message : String(error2)
       });
@@ -34651,7 +34659,14 @@ async function executeInQuery(resource, targetIds, sort, requestId) {
 }
 async function executeAllRecordsQuery(resource, sort, perPage, nextToken, parsedFilters, requestId) {
   if (parsedFilters.length > 0) {
-    return executeAllRecordsQueryFullScan(resource, sort, perPage, nextToken, parsedFilters, requestId);
+    return executeAllRecordsQueryFullScan(
+      resource,
+      sort,
+      perPage,
+      nextToken,
+      parsedFilters,
+      requestId
+    );
   }
   const dbClient2 = getDBClient();
   const tableName = getTableName();
@@ -34723,19 +34738,20 @@ async function executeAllRecordsQueryFullScan(resource, sort, perPage, nextToken
   const dbClient2 = getDBClient();
   const tableName = getTableName();
   const costTracker = new CostTracker();
-  const offset = nextToken ? decodeOffsetToken(nextToken) ?? 0 : 0;
-  logger6.debug("Executing full scan query (ID sort)", {
-    requestId,
-    resource,
-    offset
-  });
-  const allRecords = [];
   let exclusiveStartKey;
-  let previousKeySignature;
-  const MAX_ITERATIONS = 1e4;
+  if (nextToken) {
+    const decoded = decodeNextToken(nextToken);
+    exclusiveStartKey = { PK: decoded.PK, SK: decoded.SK };
+  }
+  const page = [];
+  let lastReturned;
+  let hasNextPage = false;
+  let scanned = 0;
   let iterations = 0;
-  do {
-    if (++iterations > MAX_ITERATIONS) {
+  let previousKeySignature;
+  let chunkSize = SCAN_CHUNK_INITIAL;
+  scan: while (true) {
+    if (++iterations > SCAN_MAX_ITERATIONS) {
       logger6.error("executeAllRecordsQueryFullScan: \u6700\u5927\u53CD\u5FA9\u56DE\u6570\u3092\u8D85\u904E\u3057\u305F\u305F\u3081\u4E2D\u65AD", {
         requestId,
         resource,
@@ -34753,8 +34769,7 @@ async function executeAllRecordsQueryFullScan(resource, sort, perPage, nextToken
             ":skPrefix": "id#"
           },
           ScanIndexForward: sort.order === "ASC",
-          Limit: 1e3,
-          // 大きめの Limit でループ回数を最小化
+          Limit: chunkSize,
           ExclusiveStartKey: exclusiveStartKey,
           ConsistentRead: true,
           ReturnConsumedCapacity: "TOTAL"
@@ -34763,10 +34778,24 @@ async function executeAllRecordsQueryFullScan(resource, sort, perPage, nextToken
       "Query"
     );
     costTracker.add(queryResult.ConsumedCapacity);
-    allRecords.push(...queryResult.Items || []);
+    for (const row of queryResult.Items || []) {
+      scanned++;
+      if (!matchesAllFilters(extractCleanRecord(row), parsedFilters)) {
+        continue;
+      }
+      if (page.length >= perPage) {
+        hasNextPage = true;
+        break scan;
+      }
+      page.push(extractCleanRecord(row));
+      lastReturned = { PK: row.PK, SK: row.SK };
+    }
     const nextKey = queryResult.LastEvaluatedKey;
-    const nextKeySignature = nextKey ? `${nextKey.PK}#${nextKey.SK}` : void 0;
-    if (nextKeySignature && nextKeySignature === previousKeySignature) {
+    if (!nextKey) {
+      break;
+    }
+    const nextKeySignature = `${nextKey.PK}#${nextKey.SK}`;
+    if (nextKeySignature === previousKeySignature) {
       logger6.error("executeAllRecordsQueryFullScan: \u540C\u4E00\u306ELastEvaluatedKey\u304C\u8FD4\u5374\u3055\u308C\u305F\u305F\u3081\u4E2D\u65AD", {
         requestId,
         resource,
@@ -34776,28 +34805,24 @@ async function executeAllRecordsQueryFullScan(resource, sort, perPage, nextToken
     }
     previousKeySignature = nextKeySignature;
     exclusiveStartKey = nextKey;
-  } while (exclusiveStartKey);
-  let items = allRecords.map((item) => extractCleanRecord(item));
-  items = items.filter((record) => matchesAllFilters(record, parsedFilters));
-  const page = items.slice(offset, offset + perPage);
-  const hasNextPage = offset + perPage < items.length;
-  const nextTokenValue = hasNextPage ? encodeOffsetToken(offset + perPage) : void 0;
-  logger6.info("ID full scan query succeeded", {
+    chunkSize = Math.min(chunkSize * 2, SCAN_CHUNK_MAX);
+  }
+  const nextTokenValue = hasNextPage && lastReturned ? encodeNextToken(lastReturned.PK, lastReturned.SK) : void 0;
+  logger6.info("ID filtered scan query succeeded", {
     requestId,
     resource,
-    totalMatched: items.length,
-    offset,
+    scanned,
     returned: page.length,
     hasNextPage
   });
   return {
     items: page,
-    pageInfo: { hasNextPage, hasPreviousPage: offset > 0 },
+    pageInfo: { hasNextPage, hasPreviousPage: !!nextToken },
     ...nextTokenValue && { nextToken: nextTokenValue },
     consumedCapacity: costTracker.getAggregated()
   };
 }
-var import_lib_dynamodb2, logger6;
+var import_lib_dynamodb2, logger6, SCAN_CHUNK_INITIAL, SCAN_CHUNK_MAX, SCAN_MAX_ITERATIONS;
 var init_idQuery = __esm({
   "src/server/operations/find/idQuery.ts"() {
     "use strict";
@@ -34815,6 +34840,9 @@ var init_idQuery = __esm({
     __name(executeSpecificIdQuery, "executeSpecificIdQuery");
     __name(executeInQuery, "executeInQuery");
     __name(executeAllRecordsQuery, "executeAllRecordsQuery");
+    SCAN_CHUNK_INITIAL = 100;
+    SCAN_CHUNK_MAX = 1e3;
+    SCAN_MAX_ITERATIONS = 1e4;
     __name(executeAllRecordsQueryFullScan, "executeAllRecordsQueryFullScan");
   }
 });
@@ -35918,8 +35946,8 @@ function addUpdateTimestamp(data) {
   }
   const now = (/* @__PURE__ */ new Date()).toISOString();
   return {
-    [timestampFields.updatedAt]: now,
-    ...data
+    ...data,
+    [timestampFields.updatedAt]: data[timestampFields.updatedAt] ?? now
   };
 }
 var init_timestamps = __esm({
@@ -36219,51 +36247,118 @@ var init_insertMany = __esm({
   }
 });
 
-// src/server/operations/updateMany.ts
-var updateMany_exports = {};
-__export(updateMany_exports, {
-  handleUpdateMany: () => handleUpdateMany
-});
-function expandDotNotation(patch) {
-  const result = {};
+// src/server/utils/mergePatch.ts
+function isPlainObject(value) {
+  return typeof value === "object" && value !== null && !Array.isArray(value);
+}
+function invalidPath(path, reason) {
+  return new AppError("VALIDATION_ERROR" /* VALIDATION_ERROR */, `Invalid patch path "${path}": ${reason}`, 400, {
+    path
+  });
+}
+function mergeInto(target, patch) {
   for (const [key, value] of Object.entries(patch)) {
     if (key.includes(".")) {
-      const keys = key.split(".");
-      let current = result;
-      for (let i4 = 0; i4 < keys.length - 1; i4++) {
-        const k4 = keys[i4];
-        if (!(k4 in current)) {
-          current[k4] = {};
-        } else if (typeof current[k4] !== "object" || Array.isArray(current[k4])) {
-          current[k4] = {};
-        }
-        current = current[k4];
-      }
-      const lastKey = keys[keys.length - 1];
-      current[lastKey] = value;
+      setByPath(target, key, value);
     } else {
-      result[key] = value;
+      setKey(target, key, value, key);
     }
   }
-  return result;
 }
-function applyJsonMergePatch(target, patch) {
-  const expandedPatch = expandDotNotation(patch);
-  const result = { ...target };
-  for (const [key, value] of Object.entries(expandedPatch)) {
-    if (value === null) {
-      delete result[key];
-    } else if (typeof value === "object" && !Array.isArray(value) && value !== null && typeof result[key] === "object" && !Array.isArray(result[key]) && result[key] !== null) {
-      result[key] = applyJsonMergePatch(
-        result[key],
-        value
-      );
+function setKey(target, key, value, path) {
+  if (key === "__proto__") {
+    throw invalidPath(path, "forbidden segment");
+  }
+  if (value === null) {
+    delete target[key];
+  } else if (isPlainObject(value) && isPlainObject(target[key])) {
+    mergeInto(target[key], value);
+  } else {
+    target[key] = value;
+  }
+}
+function setByPath(target, path, value) {
+  const keys = path.split(".");
+  if (keys.some((k4) => k4 === "")) {
+    throw invalidPath(path, "empty segment");
+  }
+  let current = target;
+  for (let i4 = 0; i4 < keys.length; i4++) {
+    const key = keys[i4];
+    const isLast = i4 === keys.length - 1;
+    if (Array.isArray(current)) {
+      if (!/^(0|[1-9]\d*)$/.test(key) || Number(key) >= current.length) {
+        throw invalidPath(path, `"${key}" is not a valid index (length ${current.length})`);
+      }
+      const index = Number(key);
+      if (isLast) {
+        if (value === null) {
+          throw invalidPath(path, "array elements cannot be deleted by path");
+        }
+        const existing = current[index];
+        if (isPlainObject(value) && isPlainObject(existing)) {
+          mergeInto(existing, value);
+        } else {
+          current[index] = value;
+        }
+        return;
+      }
+      const next2 = current[index];
+      if (isPlainObject(next2) || Array.isArray(next2)) {
+        current = next2;
+      } else {
+        if (value === null) {
+          return;
+        }
+        const created = {};
+        current[index] = created;
+        current = created;
+      }
+      continue;
+    }
+    if (isLast) {
+      setKey(current, key, value, path);
+      return;
+    }
+    if (key === "__proto__") {
+      throw invalidPath(path, "forbidden segment");
+    }
+    const next = current[key];
+    if (isPlainObject(next) || Array.isArray(next)) {
+      current = next;
     } else {
-      result[key] = value;
+      if (value === null) {
+        return;
+      }
+      const created = {};
+      current[key] = created;
+      current = created;
     }
   }
+}
+function applyJsonMergePatch(target, patch) {
+  const result = structuredClone(target);
+  mergeInto(result, structuredClone(patch));
   return result;
 }
+var init_mergePatch = __esm({
+  "src/server/utils/mergePatch.ts"() {
+    "use strict";
+    init_shared();
+    __name(isPlainObject, "isPlainObject");
+    __name(invalidPath, "invalidPath");
+    __name(mergeInto, "mergeInto");
+    __name(setKey, "setKey");
+    __name(setByPath, "setByPath");
+    __name(applyJsonMergePatch, "applyJsonMergePatch");
+  }
+});
+
+// src/server/operations/updateMany.ts
+var updateMany_exports = {};
+__export(updateMany_exports, {
+  handleUpdateMany: () => handleUpdateMany
+});
 async function handleUpdateMany(resource, params, requestId) {
   const { data: patchData, options } = params;
   const upsert = options?.upsert ?? false;
@@ -36391,11 +36486,9 @@ async function handleUpdateMany(resource, params, requestId) {
       const id = existingData.id;
       const oldShadowKeys = item.__shadowKeys ?? existingData.__shadowKeys ?? [];
       const actualPatchData2 = patchData.$set ? patchData.$set : patchData;
-      const mergedData = applyJsonMergePatch(removeShadowKeys(existingData), actualPatchData2);
-      const updatedData = addUpdateTimestamp({
-        ...mergedData,
-        id
-      });
+      const timestampedPatch = addUpdateTimestamp(actualPatchData2);
+      const mergedData = applyJsonMergePatch(removeShadowKeys(existingData), timestampedPatch);
+      const updatedData = { ...mergedData, id };
       const newShadowRecords = generateShadowRecords(updatedData, resource, shadowConfig);
       const newShadowKeys = newShadowRecords.map((shadow) => shadow.SK);
       const mainSK = generateMainRecordSK2(id);
@@ -36676,10 +36769,9 @@ var init_updateMany = __esm({
     init_chunking();
     init_cost_tracker();
     init_dynamodb3();
+    init_mergePatch();
     init_timestamps();
     logger18 = createLogger({ service: "records-lambda" });
-    __name(expandDotNotation, "expandDotNotation");
-    __name(applyJsonMergePatch, "applyJsonMergePatch");
     __name(handleUpdateMany, "handleUpdateMany");
     __name(getPreparationErrorCode2, "getPreparationErrorCode");
   }
@@ -37115,6 +37207,9 @@ async function handleUpdateOne(resource, params, requestId) {
     if (updateManyResult.count === 0) {
       const error2 = Object.values(updateManyResult.errors || {})[0];
       if (error2) {
+        if (error2.code === "VALIDATION_ERROR" /* VALIDATION_ERROR */) {
+          throw new AppError("VALIDATION_ERROR" /* VALIDATION_ERROR */, error2.message ?? "Invalid patch", 400);
+        }
         throw new Error(`Failed to update record: ${error2.message}`);
       } else {
         throw new Error(`Failed to update record: ${targetId}`);
@@ -37154,6 +37249,9 @@ async function handleUpdateOne(resource, params, requestId) {
     if (updateManyResult.count === 0) {
       const error2 = Object.values(updateManyResult.errors || {})[0];
       if (error2) {
+        if (error2.code === "VALIDATION_ERROR" /* VALIDATION_ERROR */) {
+          throw new AppError("VALIDATION_ERROR" /* VALIDATION_ERROR */, error2.message ?? "Invalid patch", 400);
+        }
         throw new Error(`Failed to update record: ${error2.message}`);
       } else {
         throw new Error(`No records found matching filter`);
@@ -38706,7 +38804,7 @@ async function handler(event) {
       return createCorsResponse(HTTP_STATUS.OK);
     }
     if (event.requestContext.http.method === "GET" && event.requestContext.http.path === "/version") {
-      const version = "1.6.2";
+      const version = "1.8.0";
       return createSuccessResponse({ version, timestamp: (/* @__PURE__ */ new Date()).toISOString() }, requestId);
     }
     if (event.requestContext.http.method !== "POST") {