@kensio/yulin 1.21.12 → 1.21.14

package/dist/service/dynamodb/command/authorize/sim-dynamodb-attributes.d.ts

@@ -0,0 +1,27 @@
+import type { SimDynamoDbItem } from "../../item/sim-dynamodb-item.js";
+/**
+ * The condition key DynamoDB names a request's attributes by.
+ */
+export declare const simDynamoDbAttributesConditionKey = "dynamodb:Attributes";
+/**
+ * The top-level attribute names a `Key` or an `Item` carries.
+ *
+ * Those parameters name their attributes outright, so there is no expression
+ * to read them out of. Every name is top-level, since an item's attributes are
+ * what nesting starts from.
+ *
+ * The items are read when authorization asks for them, and whatever reading
+ * them throws is dropped. Authorization runs ahead of the checks a command
+ * makes on what it was given, so a request too malformed to read is authorized
+ * naming no attributes and refused by the check that follows.
+ */
+export declare function simDynamoDbItemAttributeNames(items: () => readonly SimDynamoDbItem[]): readonly string[];
+/**
+ * Gather the attribute names a request reaches, keeping each one once.
+ *
+ * A request names the same attribute in more than one place often enough for
+ * this to matter. An UpdateItem names its key in `Key` and may name it again
+ * in a condition, and AWS supplies one list of attributes rather than one per
+ * parameter.
+ */
+export declare function simDynamoDbAttributesOf(...sources: readonly (readonly string[])[]): readonly string[];

package/dist/service/dynamodb/command/authorize/sim-dynamodb-attributes.js

@@ -0,0 +1,35 @@
+/**
+ * The condition key DynamoDB names a request's attributes by.
+ */
+export const simDynamoDbAttributesConditionKey = "dynamodb:Attributes";
+/**
+ * The top-level attribute names a `Key` or an `Item` carries.
+ *
+ * Those parameters name their attributes outright, so there is no expression
+ * to read them out of. Every name is top-level, since an item's attributes are
+ * what nesting starts from.
+ *
+ * The items are read when authorization asks for them, and whatever reading
+ * them throws is dropped. Authorization runs ahead of the checks a command
+ * makes on what it was given, so a request too malformed to read is authorized
+ * naming no attributes and refused by the check that follows.
+ */
+export function simDynamoDbItemAttributeNames(items) {
+    try {
+        return items().flatMap((item) => item.attributeNames());
+    }
+    catch {
+        return [];
+    }
+}
+/**
+ * Gather the attribute names a request reaches, keeping each one once.
+ *
+ * A request names the same attribute in more than one place often enough for
+ * this to matter. An UpdateItem names its key in `Key` and may name it again
+ * in a condition, and AWS supplies one list of attributes rather than one per
+ * parameter.
+ */
+export function simDynamoDbAttributesOf(...sources) {
+    return [...new Set(sources.flat())];
+}

package/dist/service/dynamodb/command/authorize/sim-dynamodb-authorizer.d.ts

@@ -2,6 +2,7 @@ import type { SimAwsCaller } from "../../../aws/caller/sim-aws-caller.js";
 import type { SimAwsResolvedCaller } from "../../../aws/caller/sim-aws-caller-resolver.js";
 import type { SimAwsAccountRegionScope } from "../../../aws/sim-aws-account-region-scope.js";
 import type { SimIamInterServiceAuthZ } from "../../../iam/authorize/sim-iam-inter-service-auth-z.js";
+import type { SimDynamoDbReached } from "./sim-dynamodb-reached.js";
 interface SimDynamoDbAuthorizerProperties {
     readonly iam: SimIamInterServiceAuthZ;
     readonly accountRegionScope: SimAwsAccountRegionScope;
@@ -29,7 +30,7 @@ export declare class SimDynamoDbAuthorizer {
      * omitted caller, which defaults to Account root, from an explicit anonymous
      * caller.
      */
-    authorizeTable(action: string, tableName: string, caller?: SimAwsCaller): SimAwsResolvedCaller;
+    authorizeTable(action: string, tableName: string, caller?: SimAwsCaller, reached?: SimDynamoDbReached): SimAwsResolvedCaller;
     /**
      * Ensure the caller may perform an action on a table's stream.
      *

package/dist/service/dynamodb/command/authorize/sim-dynamodb-authorizer.js

@@ -1,5 +1,6 @@
 import { SimIamAccessDenied } from "../../../iam/error/sim-iam.error.js";
 import { simDynamoDbTableArn } from "../../table/sim-dynamodb-table-arn.js";
+import { simDynamoDbConditionContextOf } from "./sim-dynamodb-reached.js";
 /**
  * Applies simulated IAM authorization to DynamoDB requests.
  *
@@ -26,8 +27,8 @@ export class SimDynamoDbAuthorizer {
      * omitted caller, which defaults to Account root, from an explicit anonymous
      * caller.
      */
-    authorizeTable(action, tableName, caller) {
-        return this.authorizeResource(action, simDynamoDbTableArn(this.accountRegionScope, tableName), caller);
+    authorizeTable(action, tableName, caller, reached = {}) {
+        return this.authorizeResource(action, simDynamoDbTableArn(this.accountRegionScope, tableName), caller, reached);
     }
     /**
      * Ensure the caller may perform an action on a table's stream.
@@ -51,8 +52,13 @@ export class SimDynamoDbAuthorizer {
     authorizeAnyTable(action, caller) {
         return this.authorizeResource(action, "*", caller);
     }
-    authorizeResource(action, resource, caller) {
-        const decision = this.iam.authorize({ action, resource, caller });
+    authorizeResource(action, resource, caller, reached = {}) {
+        const decision = this.iam.authorize({
+            action,
+            resource,
+            caller,
+            conditionContext: simDynamoDbConditionContextOf(reached),
+        });
         if (decision.isDenied) {
             throw new SimIamAccessDenied({
                 principal: decision.caller.principal,

package/dist/service/dynamodb/command/authorize/sim-dynamodb-leading-keys.d.ts

@@ -0,0 +1,33 @@
+import type { SimDynamoDbItem } from "../../item/sim-dynamodb-item.js";
+import type { SimDynamoDbValue } from "../../item/sim-dynamodb-value.js";
+import type { SimDynamoDbTable } from "../../table/sim-dynamodb-table.js";
+/**
+ * The condition key DynamoDB names a request's partition key values by.
+ */
+export declare const simDynamoDbLeadingKeysConditionKey = "dynamodb:LeadingKeys";
+/**
+ * The partition key values one request reaches in one table.
+ *
+ * Which attribute holds the partition key is the table's to say, so a command
+ * hands over how to read the values rather than the values themselves. The
+ * table is found before the caller is authorized against it, and the values
+ * are read from it in between.
+ */
+export type SimDynamoDbLeadingKeys = (table: SimDynamoDbTable) => readonly string[];
+/**
+ * Read the partition key values a run of items or keys carries.
+ *
+ * The items are read when authorization asks for them rather than at the call
+ * site, which is what keeps a request DynamoDB would refuse being refused
+ * after the caller has been authorized rather than before.
+ *
+ * An item with no readable partition key value is left out.
+ */
+export declare function simDynamoDbLeadingKeysOf(items: () => readonly SimDynamoDbItem[]): SimDynamoDbLeadingKeys;
+/**
+ * Read the one partition key value a key condition names.
+ *
+ * The value is already held against the key schema of what is being read, so
+ * the table says nothing more about it here.
+ */
+export declare function simDynamoDbLeadingKeyOf(value: SimDynamoDbValue): readonly string[];

package/dist/service/dynamodb/command/authorize/sim-dynamodb-leading-keys.js

@@ -0,0 +1,45 @@
+/**
+ * The condition key DynamoDB names a request's partition key values by.
+ */
+export const simDynamoDbLeadingKeysConditionKey = "dynamodb:LeadingKeys";
+/**
+ * Write one partition key value the way an IAM policy condition holds it.
+ *
+ * A policy condition value is a string. A string key is its text and a number
+ * key is its digits. Binary has no form documented for the condition key, and
+ * a request carrying a binary partition key leaves the value out rather than
+ * inventing an encoding for it.
+ */
+function leadingKeyText(value) {
+    if (value?.kind === "S") {
+        return value.text;
+    }
+    if (value?.kind === "N") {
+        return value.number.text;
+    }
+    return undefined;
+}
+/**
+ * Read the partition key values a run of items or keys carries.
+ *
+ * The items are read when authorization asks for them rather than at the call
+ * site, which is what keeps a request DynamoDB would refuse being refused
+ * after the caller has been authorized rather than before.
+ *
+ * An item with no readable partition key value is left out.
+ */
+export function simDynamoDbLeadingKeysOf(items) {
+    return (table) => items()
+        .map((item) => leadingKeyText(item.attribute(table.keySchema.hashKeyAttributeName)))
+        .filter((text) => text !== undefined);
+}
+/**
+ * Read the one partition key value a key condition names.
+ *
+ * The value is already held against the key schema of what is being read, so
+ * the table says nothing more about it here.
+ */
+export function simDynamoDbLeadingKeyOf(value) {
+    const text = leadingKeyText(value);
+    return text === undefined ? [] : [text];
+}

package/dist/service/dynamodb/command/authorize/sim-dynamodb-reached.d.ts

@@ -0,0 +1,17 @@
+/**
+ * What one request reaches in the table it names.
+ *
+ * Each entry becomes a DynamoDB condition key. A request reaching nothing
+ * under one of them leaves it out, as AWS leaves a key out for an operation
+ * that reaches nothing it names.
+ */
+export interface SimDynamoDbReached {
+    /** The partition key values the request reaches. */
+    readonly leadingKeys?: readonly string[] | undefined;
+    /** The top-level attribute names the request names. */
+    readonly attributes?: readonly string[] | undefined;
+}
+/**
+ * The condition values a request carries for the table it names.
+ */
+export declare function simDynamoDbConditionContextOf(reached: SimDynamoDbReached): Readonly<Record<string, readonly string[]>>;

package/dist/service/dynamodb/command/authorize/sim-dynamodb-reached.js

@@ -0,0 +1,11 @@
+import { simDynamoDbAttributesConditionKey } from "./sim-dynamodb-attributes.js";
+import { simDynamoDbLeadingKeysConditionKey } from "./sim-dynamodb-leading-keys.js";
+/**
+ * The condition values a request carries for the table it names.
+ */
+export function simDynamoDbConditionContextOf(reached) {
+    return Object.fromEntries([
+        [simDynamoDbLeadingKeysConditionKey, reached.leadingKeys],
+        [simDynamoDbAttributesConditionKey, reached.attributes],
+    ].filter(([, values]) => (values ?? []).length > 0));
+}

package/dist/service/dynamodb/command/batch/sim-dynamodb-batch-get-item.js

@@ -2,6 +2,7 @@ import { readSimDynamoDbBatchReads, } from "./sim-dynamodb-batch-reads.js";
 import { assertDistinctBatchItems } from "./sim-dynamodb-batch-request-items.js";
 import { reachSimDynamoDbBatchTables, } from "./sim-dynamodb-batch-tables.js";
 import { refuseUnsimulatedBatchReadInput } from "./sim-dynamodb-unsimulated-batch-input.js";
+import { simDynamoDbLeadingKeysOf } from "../authorize/sim-dynamodb-leading-keys.js";
 /**
  * The BatchGetItem command.
  *
@@ -27,6 +28,10 @@ export class SimDynamoDbBatchGetItem {
             access: this.access,
             operation: "BatchGetItem",
             caller: options?.caller,
+            reached: (entry) => ({
+                leadingKeys: simDynamoDbLeadingKeysOf(() => entry.keys),
+                attributes: entry.attributes,
+            }),
         });
         const responses = Object.fromEntries(reached.map((entry) => [entry.requested.reference, readItems(entry)]));
         // Nothing here throttles or stops at a response size, so no key is ever

package/dist/service/dynamodb/command/batch/sim-dynamodb-batch-read-limit.d.ts

@@ -0,0 +1,6 @@
+import type { SimDynamoDbKeysAndAttributes } from "./batch.command.js";
+import type { SimDynamoDbBatchTableRequest } from "./sim-dynamodb-batch-request-items.js";
+/**
+ * Refuse a batch asking for more items than DynamoDB reads at once.
+ */
+export declare function assertSimDynamoDbBatchReadLimit(tables: readonly SimDynamoDbBatchTableRequest<SimDynamoDbKeysAndAttributes>[], operation: string): void;

package/dist/service/dynamodb/command/batch/sim-dynamodb-batch-read-limit.js

@@ -0,0 +1,16 @@
+import { SimDynamoDbValidationException } from "../../error/dynamodb.error.js";
+/**
+ * Real DynamoDB reads 100 items in one batch, counted across every table the
+ * request names rather than per table.
+ */
+const greatestKeys = 100;
+/**
+ * Refuse a batch asking for more items than DynamoDB reads at once.
+ */
+export function assertSimDynamoDbBatchReadLimit(tables, operation) {
+    const total = tables.reduce((count, { requested }) => count + (requested.Keys ?? []).length, 0);
+    if (total > greatestKeys) {
+        throw new SimDynamoDbValidationException(`Too many items requested for the ${operation} call: ${total.toString()} ` +
+            `keys, where ${greatestKeys.toString()} is the most a batch reads`);
+    }
+}

package/dist/service/dynamodb/command/batch/sim-dynamodb-batch-reads.d.ts

@@ -11,6 +11,8 @@ export interface SimDynamoDbBatchTableReads {
     readonly reference: string;
     readonly keys: readonly SimDynamoDbItem[];
     readonly projection: SimDynamoDbProjection | undefined;
+    /** The top-level attributes this table is asked for, per table as above. */
+    readonly attributes: readonly string[];
 }
 /**
  * Read every key a batch asks for, before any table is reached.

package/dist/service/dynamodb/command/batch/sim-dynamodb-batch-reads.js

@@ -1,14 +1,11 @@
 import { SimDynamoDbValidationException } from "../../error/dynamodb.error.js";
 import { readSimDynamoDbProjection } from "../../expression/projection/sim-dynamodb-projection-expression.js";
 import { readSimDynamoDbKey } from "../item/sim-dynamodb-key-input.js";
-import { readSimDynamoDbBatchRequestItems, } from "./sim-dynamodb-batch-request-items.js";
+import { simDynamoDbAttributesOf, simDynamoDbItemAttributeNames, } from "../authorize/sim-dynamodb-attributes.js";
+import { readSimDynamoDbBatchRequestItems } from "./sim-dynamodb-batch-request-items.js";
+import { assertSimDynamoDbBatchReadLimit } from "./sim-dynamodb-batch-read-limit.js";
 import { refuseUnsimulatedBatchKeysAndAttributes } from "./sim-dynamodb-unsimulated-batch-input.js";
 const operation = "BatchGetItem";
-/**
- * Real DynamoDB reads 100 items in one batch, counted across every table the
- * request names rather than per table.
- */
-const greatestKeys = 100;
 /**
  * Read every key a batch asks for, before any table is reached.
  *
@@ -17,22 +14,17 @@ const greatestKeys = 100;
  */
 export function readSimDynamoDbBatchReads(requestItems) {
     const tables = readSimDynamoDbBatchRequestItems(requestItems, operation);
-    assertWithinKeyLimit(tables);
-    return tables.map(({ reference, requested }) => ({
-        reference,
-        keys: readTableKeys(reference, requested),
-        projection: readSimDynamoDbProjection(requested),
-    }));
-}
-/**
- * Refuse a batch asking for more items than DynamoDB reads at once.
- */
-function assertWithinKeyLimit(tables) {
-    const total = tables.reduce((count, { requested }) => count + (requested.Keys ?? []).length, 0);
-    if (total > greatestKeys) {
-        throw new SimDynamoDbValidationException(`Too many items requested for the ${operation} call: ${total.toString()} ` +
-            `keys, where ${greatestKeys.toString()} is the most a batch reads`);
-    }
+    assertSimDynamoDbBatchReadLimit(tables, operation);
+    return tables.map(({ reference, requested }) => {
+        const keys = readTableKeys(reference, requested);
+        const read = readSimDynamoDbProjection(requested);
+        return {
+            reference,
+            keys,
+            projection: read.projection,
+            attributes: simDynamoDbAttributesOf(read.attributes, simDynamoDbItemAttributeNames(() => keys)),
+        };
+    });
 }
 /**
  * Read the keys one table of the batch is asked for.

package/dist/service/dynamodb/command/batch/sim-dynamodb-batch-tables.d.ts

@@ -1,6 +1,7 @@
 import type { SimAwsCaller } from "../../../aws/caller/sim-aws-caller.js";
 import type { SimDynamoDbTable } from "../../table/sim-dynamodb-table.js";
 import type { SimDynamoDbTableAccess } from "../table/sim-dynamodb-table-access.js";
+import type { SimDynamoDbTableReach } from "../table/sim-dynamodb-table-reach.js";
 /**
  * What one table of a batch asks for, against the table it names.
  */
@@ -8,10 +9,17 @@ export interface SimDynamoDbBatchTable<Requested> {
     readonly table: SimDynamoDbTable;
     readonly requested: Requested;
 }
-interface SimDynamoDbBatchReach {
+interface SimDynamoDbBatchReach<Requested> {
     readonly access: SimDynamoDbTableAccess;
     readonly operation: string;
     readonly caller: SimAwsCaller | undefined;
+    /**
+     * What one table of the batch is asked for.
+     *
+     * Each table is authorized on its own, so each carries the keys and the
+     * attributes the batch names in that table and no others.
+     */
+    readonly reached: (requested: Requested) => SimDynamoDbTableReach;
 }
 /**
  * Reach every table a batch names, authorizing the caller against each.
@@ -24,5 +32,5 @@ interface SimDynamoDbBatchReach {
  */
 export declare function reachSimDynamoDbBatchTables<Requested extends {
     readonly reference: string;
-}>(requested: readonly Requested[], reach: SimDynamoDbBatchReach): readonly SimDynamoDbBatchTable<Requested>[];
+}>(requested: readonly Requested[], reach: SimDynamoDbBatchReach<Requested>): readonly SimDynamoDbBatchTable<Requested>[];
 export {};

package/dist/service/dynamodb/command/batch/sim-dynamodb-batch-tables.js

@@ -11,7 +11,7 @@ import { SimDynamoDbValidationException } from "../../error/dynamodb.error.js";
 export function reachSimDynamoDbBatchTables(requested, reach) {
     const action = `dynamodb:${reach.operation}`;
     const reached = requested.map((entry) => ({
-        table: reach.access.required(action, entry.reference, reach.caller),
+        table: reach.access.required(action, entry.reference, reach.caller, reach.reached(entry)),
         requested: entry,
     }));
     assertDistinctTables(reached, reach.operation);

package/dist/service/dynamodb/command/batch/sim-dynamodb-batch-write-item.js

@@ -2,6 +2,8 @@ import { assertDistinctBatchItems } from "./sim-dynamodb-batch-request-items.js"
 import { reachSimDynamoDbBatchTables } from "./sim-dynamodb-batch-tables.js";
 import { readSimDynamoDbBatchWrites } from "./sim-dynamodb-batch-writes.js";
 import { refuseUnsimulatedBatchWriteInput } from "./sim-dynamodb-unsimulated-batch-input.js";
+import { simDynamoDbLeadingKeysOf } from "../authorize/sim-dynamodb-leading-keys.js";
+import { simDynamoDbItemAttributeNames } from "../authorize/sim-dynamodb-attributes.js";
 const operation = "BatchWriteItem";
 /**
  * The BatchWriteItem command.
@@ -25,7 +27,15 @@ export class SimDynamoDbBatchWriteItem {
     handle(command, options) {
         const input = command.input;
         refuseUnsimulatedBatchWriteInput(input);
-        const reached = reachSimDynamoDbBatchTables(readSimDynamoDbBatchWrites(input.RequestItems), { access: this.access, operation, caller: options?.caller });
+        const reached = reachSimDynamoDbBatchTables(readSimDynamoDbBatchWrites(input.RequestItems), {
+            access: this.access,
+            operation,
+            caller: options?.caller,
+            reached: (entry) => ({
+                leadingKeys: simDynamoDbLeadingKeysOf(() => entry.writes.map((write) => write.names)),
+                attributes: simDynamoDbItemAttributeNames(() => entry.writes.map((write) => write.names)),
+            }),
+        });
         // Marshalling every key checks it against the table's key schema, and is
         // what tells two operations on one item apart. Every table is checked
         // before any of them is written to.

package/dist/service/dynamodb/command/batch/sim-dynamodb-batch-write.d.ts

@@ -1,3 +1,4 @@
+import { SimDynamoDbItem } from "../../item/sim-dynamodb-item.js";
 import type { SimDynamoDbTable } from "../../table/sim-dynamodb-table.js";
 import type { SimDynamoDbWriteRequest } from "./batch.command.js";
 /**
@@ -8,6 +9,11 @@ import type { SimDynamoDbWriteRequest } from "./batch.command.js";
  * before it applies anything, since the check and the write read the same item.
  */
 export interface SimDynamoDbBatchWrite {
+    /**
+     * The item or key this write names, which is where a policy condition reads
+     * its partition key value from.
+     */
+    readonly names: SimDynamoDbItem;
     /**
      * The primary key this write works on, as the table marshals it.
      */

package/dist/service/dynamodb/command/batch/sim-dynamodb-batch-write.js

@@ -5,15 +5,15 @@ import { readSimDynamoDbKey } from "../item/sim-dynamodb-key-input.js";
  * A put in a batch write, which replaces the whole item as PutItem does.
  */
 class SimDynamoDbBatchPut {
-    item;
+    names;
     constructor(item) {
-        this.item = item;
+        this.names = item;
     }
     keyIn(table) {
-        return table.keyOfItem(this.item);
+        return table.keyOfItem(this.names);
     }
     applyTo(table) {
-        table.putItem(this.item);
+        table.putItem(this.names);
     }
 }
 /**
@@ -21,15 +21,15 @@ class SimDynamoDbBatchPut {
  * that is already free is deleted successfully.
  */
 class SimDynamoDbBatchDelete {
-    key;
+    names;
     constructor(key) {
-        this.key = key;
+        this.names = key;
     }
     keyIn(table) {
-        return table.keyOfKey(this.key);
+        return table.keyOfKey(this.names);
     }
     applyTo(table) {
-        table.deleteItem(this.key);
+        table.deleteItem(this.names);
     }
 }
 /**

package/dist/service/dynamodb/command/item/sim-dynamodb-condition-check.d.ts

@@ -15,6 +15,10 @@ interface SimDynamoDbConditionCheckInput {
  * be nothing: that is what makes `attribute_not_exists` an insert if absent.
  */
 export declare class SimDynamoDbConditionCheck {
+    /**
+     * The top-level attributes the condition named, for `dynamodb:Attributes`.
+     */
+    readonly attributeNames: readonly string[];
     private readonly condition;
     private readonly reportsItem;
     private constructor();
@@ -31,7 +35,7 @@ export declare class SimDynamoDbConditionCheck {
      * UpdateItem reads its condition alongside its update expression, since the
      * two share the request's placeholders, and then hands the condition here.
      */
-    static of(condition: SimDynamoDbCondition | undefined, input: SimDynamoDbConditionCheckInput, operation: string): SimDynamoDbConditionCheck;
+    static of(condition: SimDynamoDbCondition | undefined, input: SimDynamoDbConditionCheckInput, operation: string, attributeNames?: readonly string[]): SimDynamoDbConditionCheck;
     /**
      * Whether the request asked for the item that turned it away.
      */

package/dist/service/dynamodb/command/item/sim-dynamodb-condition-check.js

@@ -13,11 +13,16 @@ const failureModes = new Set(["NONE", "ALL_OLD"]);
  * be nothing: that is what makes `attribute_not_exists` an insert if absent.
  */
 export class SimDynamoDbConditionCheck {
+    /**
+     * The top-level attributes the condition named, for `dynamodb:Attributes`.
+     */
+    attributeNames;
     condition;
     reportsItem;
     constructor(properties) {
         this.condition = properties.condition;
         this.reportsItem = properties.reportsItem;
+        this.attributeNames = properties.attributeNames;
     }
     /**
      * Read the condition a request carries, before anything is looked up.
@@ -26,7 +31,8 @@ export class SimDynamoDbConditionCheck {
      * anything, so a bad expression fails the same way every time.
      */
     static read(input, operation) {
-        return this.of(readSimDynamoDbCondition(input), input, operation);
+        const read = readSimDynamoDbCondition(input);
+        return this.of(read.condition, input, operation, read.attributes);
     }
     /**
      * Guard a write with a condition that has already been read.
@@ -34,10 +40,11 @@ export class SimDynamoDbConditionCheck {
      * UpdateItem reads its condition alongside its update expression, since the
      * two share the request's placeholders, and then hands the condition here.
      */
-    static of(condition, input, operation) {
+    static of(condition, input, operation, attributeNames = []) {
         return new this({
             condition,
             reportsItem: this.reportsItemFor(input, operation),
+            attributeNames,
         });
     }
     /**

package/dist/service/dynamodb/command/item/sim-dynamodb-delete-item.js

@@ -1,3 +1,5 @@
+import { simDynamoDbLeadingKeysOf } from "../authorize/sim-dynamodb-leading-keys.js";
+import { simDynamoDbAttributesOf, simDynamoDbItemAttributeNames, } from "../authorize/sim-dynamodb-attributes.js";
 import { readSimDynamoDbKey } from "./sim-dynamodb-key-input.js";
 import { SimDynamoDbConditionCheck } from "./sim-dynamodb-condition-check.js";
 import { SimDynamoDbReturnValues } from "./sim-dynamodb-return-values.js";
@@ -26,7 +28,12 @@ export class SimDynamoDbDeleteItem {
         // The condition is read before the table is reached, so an expression
         // DynamoDB would refuse is refused whether or not the key holds anything.
         const check = SimDynamoDbConditionCheck.read(input, "DeleteItem");
-        const table = this.access.required("dynamodb:DeleteItem", input.TableName, options?.caller);
+        const table = this.access.required("dynamodb:DeleteItem", input.TableName, options?.caller, {
+            leadingKeys: simDynamoDbLeadingKeysOf(() => [
+                readSimDynamoDbKey(input.Key),
+            ]),
+            attributes: simDynamoDbAttributesOf(check.attributeNames, simDynamoDbItemAttributeNames(() => [readSimDynamoDbKey(input.Key)])),
+        });
         const asked = SimDynamoDbReturnValues.read(input.ReturnValues, "DeleteItem");
         const key = readSimDynamoDbKey(input.Key);
         check.assertHoldsFor(table.getItem(key));

package/dist/service/dynamodb/command/item/sim-dynamodb-get-item.js

@@ -1,6 +1,8 @@
+import { simDynamoDbLeadingKeysOf } from "../authorize/sim-dynamodb-leading-keys.js";
 import { readSimDynamoDbKey } from "./sim-dynamodb-key-input.js";
 import { refuseUnsimulatedItemReadInput } from "./sim-dynamodb-unsimulated-item-read-input.js";
 import { readSimDynamoDbProjection } from "../../expression/projection/sim-dynamodb-projection-expression.js";
+import { simDynamoDbAttributesOf, simDynamoDbItemAttributeNames, } from "../authorize/sim-dynamodb-attributes.js";
 /**
  * The GetItem command.
  *
@@ -25,8 +27,14 @@ export class SimDynamoDbGetItem {
         refuseUnsimulatedItemReadInput(input);
         // The projection is read before the table is reached, so an expression
         // DynamoDB would refuse is refused whether or not the key holds anything.
-        const projection = readSimDynamoDbProjection(input);
-        const table = this.access.required("dynamodb:GetItem", input.TableName, options?.caller);
+        const read = readSimDynamoDbProjection(input);
+        const projection = read.projection;
+        const table = this.access.required("dynamodb:GetItem", input.TableName, options?.caller, {
+            leadingKeys: simDynamoDbLeadingKeysOf(() => [
+                readSimDynamoDbKey(input.Key),
+            ]),
+            attributes: simDynamoDbAttributesOf(read.attributes, simDynamoDbItemAttributeNames(() => [readSimDynamoDbKey(input.Key)])),
+        });
         const found = table.getItem(readSimDynamoDbKey(input.Key));
         if (found === undefined) {
             return { $metadata: {} };

package/dist/service/dynamodb/command/item/sim-dynamodb-put-item.js

@@ -1,5 +1,7 @@
 import { SimDynamoDbValidationException } from "../../error/dynamodb.error.js";
 import { SimDynamoDbItem } from "../../item/sim-dynamodb-item.js";
+import { simDynamoDbLeadingKeysOf } from "../authorize/sim-dynamodb-leading-keys.js";
+import { simDynamoDbAttributesOf, simDynamoDbItemAttributeNames, } from "../authorize/sim-dynamodb-attributes.js";
 import { SimDynamoDbConditionCheck } from "./sim-dynamodb-condition-check.js";
 import { SimDynamoDbReturnValues } from "./sim-dynamodb-return-values.js";
 import { refuseUnsimulatedItemWriteInput } from "./sim-dynamodb-unsimulated-item-write-input.js";
@@ -36,7 +38,10 @@ export class SimDynamoDbPutItem {
         // The condition is read before the table is reached, so an expression
         // DynamoDB would refuse is refused whether or not the key holds anything.
         const check = SimDynamoDbConditionCheck.read(input, "PutItem");
-        const table = this.access.required("dynamodb:PutItem", input.TableName, options?.caller);
+        const table = this.access.required("dynamodb:PutItem", input.TableName, options?.caller, {
+            leadingKeys: simDynamoDbLeadingKeysOf(() => [readItem(input)]),
+            attributes: simDynamoDbAttributesOf(check.attributeNames, simDynamoDbItemAttributeNames(() => [readItem(input)])),
+        });
         const asked = SimDynamoDbReturnValues.read(input.ReturnValues, "PutItem");
         const item = readItem(input);
         check.assertHoldsFor(table.itemUnder(item));

package/dist/service/dynamodb/command/item/sim-dynamodb-update-expressions.d.ts

@@ -14,6 +14,8 @@ export interface SimDynamoDbUpdateExpressionInput extends SimDynamoDbExpressionP
 export interface SimDynamoDbUpdateExpressions {
     readonly update: SimDynamoDbUpdate;
     readonly condition: SimDynamoDbCondition | undefined;
+    /** The top-level attributes the expressions named, for `dynamodb:Attributes`. */
+    readonly attributes: readonly string[];
 }
 /**
  * Read both expressions of an update against one set of placeholders.

package/dist/service/dynamodb/command/item/sim-dynamodb-update-expressions.js

@@ -13,7 +13,7 @@ export function readSimDynamoDbUpdateExpressions(input, expression) {
     const update = parseSimDynamoDbUpdate(expression, parameters);
     const condition = conditionIn(input.ConditionExpression, parameters);
     parameters.assertAllUsed();
-    return { update, condition };
+    return { update, condition, attributes: parameters.attributes.topLevel };
 }
 /**
  * Read the condition guarding an update, if it names one.

package/dist/service/dynamodb/command/item/sim-dynamodb-update-item.js

@@ -1,3 +1,5 @@
+import { simDynamoDbLeadingKeysOf } from "../authorize/sim-dynamodb-leading-keys.js";
+import { simDynamoDbAttributesOf, simDynamoDbItemAttributeNames, } from "../authorize/sim-dynamodb-attributes.js";
 import { readSimDynamoDbKey } from "./sim-dynamodb-key-input.js";
 import { SimDynamoDbReturnValues } from "./sim-dynamodb-return-values.js";
 import { refuseUnsimulatedItemUpdateInput } from "./sim-dynamodb-unsimulated-item-update-input.js";
@@ -28,7 +30,12 @@ export class SimDynamoDbUpdateItem {
         // The expressions are read before the table is reached, so one DynamoDB
         // would refuse is refused whether or not the key holds anything.
         const plan = SimDynamoDbUpdatePlan.read(input, "UpdateItem");
-        const table = this.access.required("dynamodb:UpdateItem", input.TableName, options?.caller);
+        const table = this.access.required("dynamodb:UpdateItem", input.TableName, options?.caller, {
+            leadingKeys: simDynamoDbLeadingKeysOf(() => [
+                readSimDynamoDbKey(input.Key),
+            ]),
+            attributes: simDynamoDbAttributesOf(plan.attributeNames, simDynamoDbItemAttributeNames(() => [readSimDynamoDbKey(input.Key)])),
+        });
         const asked = SimDynamoDbReturnValues.readForUpdate(input.ReturnValues, "UpdateItem");
         const key = readSimDynamoDbKey(input.Key);
         const existing = table.getItem(key);