@ftschopp/dynatable-core 1.5.1 → 1.5.2

package/CHANGELOG.md

@@ -1,3 +1,10 @@
+## @ftschopp/dynatable-core [1.5.2](https://github.com/ftschopp/dynatable/compare/@ftschopp/dynatable-core@1.5.1...@ftschopp/dynatable-core@1.5.2) (2026-05-10)
+
+
+### Bug Fixes
+
+* **core:** guard primary-key template fields and non-set ops on GSI templates in update builder ([#42](https://github.com/ftschopp/dynatable/issues/42)) ([4487ff2](https://github.com/ftschopp/dynatable/commit/4487ff22ad507b37aa0e2e279a602a4813afddba))
+
 ## @ftschopp/dynatable-core [1.5.1](https://github.com/ftschopp/dynatable/compare/@ftschopp/dynatable-core@1.5.0...@ftschopp/dynatable-core@1.5.1) (2026-05-10)
 
 

package/dist/builders/update/create-update-builder.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"create-update-builder.d.ts","sourceRoot":"","sources":["../../../src/builders/update/create-update-builder.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,cAAc,EAAE,MAAM,0BAA0B,CAAC;AAE1D,OAAO,EAAgC,SAAS,EAA4B,MAAM,WAAW,CAAC;AAC9F,OAAO,EAAE,aAAa,EAAE,YAAY,EAAE,YAAY,EAAE,MAAM,SAAS,CAAC;AACpE,OAAO,EAAE,cAAc,EAAE,MAAM,6BAA6B,CAAC;AAa7D;;;;;;;;GAQG;AACH,wBAAgB,mBAAmB,CAAC,KAAK,EACvC,SAAS,EAAE,MAAM,EACjB,GAAG,EAAE,OAAO,CAAC,KAAK,CAAC,EACnB,MAAM,EAAE,cAAc,EACtB,cAAc,GAAE,SAAS,EAAO,EAChC,aAAa,GAAE;IACb,GAAG,EAAE,YAAY,EAAE,CAAC;IACpB,MAAM,EAAE,YAAY,EAAE,CAAC;IACvB,GAAG,EAAE,YAAY,EAAE,CAAC;IACpB,MAAM,EAAE,YAAY,EAAE,CAAC;CACuB,EAChD,UAAU,GAAE,MAAM,GAAG,SAAS,GAAG,SAAS,GAAG,aAAa,GAAG,aAAsB,EACnF,YAAY,SAAI,EAChB,gBAAgB,UAAQ,EACxB,MAAM,CAAC,EAAE,cAAc,EACvB,YAAY,CAAC,EAAE,YAAY,EAC3B,SAAS,GAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAM,GAClC,aAAa,CAAC,KAAK,CAAC,CAmXtB"}
+{"version":3,"file":"create-update-builder.d.ts","sourceRoot":"","sources":["../../../src/builders/update/create-update-builder.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,cAAc,EAAE,MAAM,0BAA0B,CAAC;AAE1D,OAAO,EAAgC,SAAS,EAA4B,MAAM,WAAW,CAAC;AAC9F,OAAO,EAAE,aAAa,EAAE,YAAY,EAAE,YAAY,EAAE,MAAM,SAAS,CAAC;AACpE,OAAO,EAAE,cAAc,EAAE,MAAM,6BAA6B,CAAC;AAyB7D;;;;;;;;GAQG;AACH,wBAAgB,mBAAmB,CAAC,KAAK,EACvC,SAAS,EAAE,MAAM,EACjB,GAAG,EAAE,OAAO,CAAC,KAAK,CAAC,EACnB,MAAM,EAAE,cAAc,EACtB,cAAc,GAAE,SAAS,EAAO,EAChC,aAAa,GAAE;IACb,GAAG,EAAE,YAAY,EAAE,CAAC;IACpB,MAAM,EAAE,YAAY,EAAE,CAAC;IACvB,GAAG,EAAE,YAAY,EAAE,CAAC;IACpB,MAAM,EAAE,YAAY,EAAE,CAAC;CACuB,EAChD,UAAU,GAAE,MAAM,GAAG,SAAS,GAAG,SAAS,GAAG,aAAa,GAAG,aAAsB,EACnF,YAAY,SAAI,EAChB,gBAAgB,UAAQ,EACxB,MAAM,CAAC,EAAE,cAAc,EACvB,YAAY,CAAC,EAAE,YAAY,EAC3B,SAAS,GAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAM,GAClC,aAAa,CAAC,KAAK,CAAC,CAwbtB"}

package/dist/builders/update/create-update-builder.js

@@ -13,6 +13,18 @@ function extractAttrName(action) {
     const m = action.expression.match(/^\s*#([A-Za-z0-9_]+)\s*=/);
     return m?.[1];
 }
+/**
+ * Pull the attribute name from any update action (set / remove / add / delete).
+ * Each action emitted by this builder carries exactly one entry in `names`
+ * mapping `#<attr>` → `<attr>`, so the value side of that map is the source
+ * of truth regardless of the surrounding expression syntax.
+ */
+function actionAttrName(action) {
+    if (!action.names)
+        return undefined;
+    const values = Object.values(action.names);
+    return values[0];
+}
 /**
  * Creates an UpdateBuilder for an item key and table.
  *
@@ -120,6 +132,68 @@ function createUpdateBuilder(tableName, key, client, prevConditions = [], update
             // key vars + the .set() payload, we throw — recomputing from the
             // existing item would require an extra read the builder won't do.
             if (indexContext) {
+                // Collect the attribute name targeted by every update action,
+                // grouped by op. `setInputs` carries the .set() payload (already
+                // structured) — for remove/add/delete we read from the action's
+                // attribute-name map.
+                const setFields = Object.keys(setInputs);
+                const removeFields = updateActions.remove
+                    .map(actionAttrName)
+                    .filter((n) => !!n);
+                const addFields = updateActions.add
+                    .map(actionAttrName)
+                    .filter((n) => !!n);
+                const deleteFields = updateActions.delete
+                    .map(actionAttrName)
+                    .filter((n) => !!n);
+                // Guard 1: primary-key template fields are immutable in DynamoDB.
+                // The Key on the UpdateItem request fixes the row to operate on; if
+                // the user changes a field that participates in the PK/SK template,
+                // the row's PK doesn't move (DynamoDB doesn't allow that) but the
+                // attribute does — leaving an inconsistent row whose PK encodes the
+                // old value. Catch this on every op (.set / .remove / .add / .delete)
+                // before it leaves the process.
+                const primaryKeyTemplateVars = new Set();
+                for (const keyDef of Object.values(indexContext.model.key)) {
+                    for (const v of (0, model_utils_1.extractTemplateVars)(keyDef.value)) {
+                        primaryKeyTemplateVars.add(v);
+                    }
+                }
+                const allTouched = [...setFields, ...removeFields, ...addFields, ...deleteFields];
+                const pkConflicts = [
+                    ...new Set(allTouched.filter((f) => primaryKeyTemplateVars.has(f))),
+                ];
+                if (pkConflicts.length > 0) {
+                    throw new Error(`Cannot update field(s) [${pkConflicts.join(', ')}] — they participate ` +
+                        `in the primary key template, which is immutable in DynamoDB. To ` +
+                        `"rename" a primary-key value, delete the old item and put a new one ` +
+                        `(ideally inside a transactWrite for atomicity).`);
+                }
+                // Guard 2: .add() / .remove() / .delete() against a field used in a
+                // SECONDARY-index template. The recompute path needs an explicit new
+                // value to resolve the template — ADD increments without exposing
+                // the new value, REMOVE strips the field entirely, and DELETE
+                // mutates a Set without naming a scalar. Switching to .set(field,
+                // newValue) lets the recompute path handle it correctly.
+                if (indexContext.model.index) {
+                    const indexTemplateVars = new Set();
+                    for (const indexDef of Object.values(indexContext.model.index)) {
+                        for (const v of (0, model_utils_1.extractTemplateVars)(indexDef.value)) {
+                            indexTemplateVars.add(v);
+                        }
+                    }
+                    const nonSetTouches = [...removeFields, ...addFields, ...deleteFields];
+                    const gsiConflicts = [
+                        ...new Set(nonSetTouches.filter((f) => indexTemplateVars.has(f))),
+                    ];
+                    if (gsiConflicts.length > 0) {
+                        throw new Error(`Cannot use .add() / .remove() / .delete() on field(s) ` +
+                            `[${gsiConflicts.join(', ')}] — they participate in a ` +
+                            `secondary-index template, and the affected index key cannot be ` +
+                            `recomputed without an explicit new value. Use .set(field, ` +
+                            `newValue) instead so the index key is recomputed atomically.`);
+                    }
+                }
                 const { actions: idxActions, missing } = (0, model_utils_1.computeIndexUpdates)(indexContext.model, indexContext.keyVars, setInputs);
                 if (missing.length > 0) {
                     const details = missing

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@ftschopp/dynatable-core",
-  "version": "1.5.1",
+  "version": "1.5.2",
   "description": "Core library for DynamoDB single table design",
   "main": "dist/index.js",
   "types": "dist/index.d.ts",