@kensio/yulin 1.21.12 → 1.21.14

package/dist/service/dynamodb/command/item/sim-dynamodb-update-plan.d.ts

@@ -1,4 +1,4 @@
-import { SimDynamoDbProjection } from "../../expression/projection/sim-dynamodb-projection.js";
+import type { SimDynamoDbProjection } from "../../expression/projection/sim-dynamodb-projection.js";
 import type { SimDynamoDbItem } from "../../item/sim-dynamodb-item.js";
 import { SimDynamoDbConditionCheck } from "./sim-dynamodb-condition-check.js";
 import { type SimDynamoDbUpdateExpressionInput } from "./sim-dynamodb-update-expressions.js";
@@ -10,6 +10,12 @@ interface SimDynamoDbUpdatePlanInput extends SimDynamoDbUpdateExpressionInput {
  */
 export declare class SimDynamoDbUpdatePlan {
     readonly check: SimDynamoDbConditionCheck;
+    /**
+     * The top-level attributes both expressions named, for
+     * `dynamodb:Attributes`. They share one set of placeholders, so the update
+     * and the condition guarding it are gathered together.
+     */
+    readonly attributeNames: readonly string[];
     private readonly update;
     private constructor();
     /**
@@ -24,11 +30,7 @@ export declare class SimDynamoDbUpdatePlan {
      */
     assertLeavesKeyAlone(keyAttributeNames: readonly string[]): void;
     /**
-     * The parts of an item this update touched, for the reporting modes that
-     * answer with those and nothing else.
-     *
-     * A request that says nothing to change touched nothing, so the projection it
-     * answers with finds nothing in either item.
+     * The parts of an item this update touched.
      */
     touched(): SimDynamoDbProjection;
     /**

package/dist/service/dynamodb/command/item/sim-dynamodb-update-plan.js

@@ -1,5 +1,4 @@
-import { SimDynamoDbProjection } from "../../expression/projection/sim-dynamodb-projection.js";
-import { updateExpressionName } from "../../expression/update/sim-dynamodb-update-refusal.js";
+import { simDynamoDbTouchedBy } from "./sim-dynamodb-update-touched.js";
 import { SimDynamoDbConditionCheck } from "./sim-dynamodb-condition-check.js";
 import { readSimDynamoDbUpdateExpressions, } from "./sim-dynamodb-update-expressions.js";
 /**
@@ -7,10 +6,17 @@ import { readSimDynamoDbUpdateExpressions, } from "./sim-dynamodb-update-express
  */
 export class SimDynamoDbUpdatePlan {
     check;
+    /**
+     * The top-level attributes both expressions named, for
+     * `dynamodb:Attributes`. They share one set of placeholders, so the update
+     * and the condition guarding it are gathered together.
+     */
+    attributeNames;
     update;
     constructor(properties) {
         this.update = properties.update;
         this.check = properties.check;
+        this.attributeNames = properties.attributeNames;
     }
     /**
      * Read the expressions a request carries, before anything is looked up.
@@ -21,15 +27,18 @@ export class SimDynamoDbUpdatePlan {
     static read(input, operation) {
         const expression = input.UpdateExpression;
         if (expression === undefined) {
+            const check = SimDynamoDbConditionCheck.read(input, operation);
             return new this({
                 update: undefined,
-                check: SimDynamoDbConditionCheck.read(input, operation),
+                check,
+                attributeNames: check.attributeNames,
             });
         }
         const read = readSimDynamoDbUpdateExpressions(input, expression);
         return new this({
             update: read.update,
             check: SimDynamoDbConditionCheck.of(read.condition, input, operation),
+            attributeNames: read.attributes,
         });
     }
     /**
@@ -39,18 +48,10 @@ export class SimDynamoDbUpdatePlan {
         this.update?.assertLeavesKeyAlone(keyAttributeNames);
     }
     /**
-     * The parts of an item this update touched, for the reporting modes that
-     * answer with those and nothing else.
-     *
-     * A request that says nothing to change touched nothing, so the projection it
-     * answers with finds nothing in either item.
+     * The parts of an item this update touched.
      */
     touched() {
-        return (this.update?.touched() ??
-            new SimDynamoDbProjection({
-                expressionName: updateExpressionName,
-                paths: [],
-            }));
+        return simDynamoDbTouchedBy(this.update);
     }
     /**
      * The item this update makes of the one that was there.

package/dist/service/dynamodb/command/item/sim-dynamodb-update-touched.d.ts

@@ -0,0 +1,10 @@
+import { SimDynamoDbProjection } from "../../expression/projection/sim-dynamodb-projection.js";
+import type { SimDynamoDbUpdate } from "../../expression/update/sim-dynamodb-update.js";
+/**
+ * The parts of an item an update touched, for the reporting modes that answer
+ * with those and nothing else.
+ *
+ * A request that says nothing to change touched nothing, so the projection it
+ * answers with finds nothing in either item.
+ */
+export declare function simDynamoDbTouchedBy(update: SimDynamoDbUpdate | undefined): SimDynamoDbProjection;

package/dist/service/dynamodb/command/item/sim-dynamodb-update-touched.js

@@ -0,0 +1,16 @@
+import { SimDynamoDbProjection } from "../../expression/projection/sim-dynamodb-projection.js";
+import { updateExpressionName } from "../../expression/update/sim-dynamodb-update-refusal.js";
+/**
+ * The parts of an item an update touched, for the reporting modes that answer
+ * with those and nothing else.
+ *
+ * A request that says nothing to change touched nothing, so the projection it
+ * answers with finds nothing in either item.
+ */
+export function simDynamoDbTouchedBy(update) {
+    return (update?.touched() ??
+        new SimDynamoDbProjection({
+            expressionName: updateExpressionName,
+            paths: [],
+        }));
+}

package/dist/service/dynamodb/command/query/sim-dynamodb-query-expressions.d.ts

@@ -9,6 +9,8 @@ export interface SimDynamoDbQueryExpressions {
     readonly terms: SimDynamoDbKeyConditionTerms;
     readonly filter: SimDynamoDbFilter | undefined;
     readonly projection: SimDynamoDbProjection | undefined;
+    /** The top-level attributes the expressions named, for `dynamodb:Attributes`. */
+    readonly attributes: readonly string[];
 }
 /**
  * Read every expression of a query against one set of placeholders.

package/dist/service/dynamodb/command/query/sim-dynamodb-query-expressions.js

@@ -21,7 +21,12 @@ export function readSimDynamoDbQueryExpressions(input) {
     const filter = filterIn(input.FilterExpression, parameters);
     const projection = projectionIn(input.ProjectionExpression, parameters);
     parameters.assertAllUsed();
-    return { terms, filter, projection };
+    return {
+        terms,
+        filter,
+        projection,
+        attributes: parameters.attributes.topLevel,
+    };
 }
 /**
  * Read the filter a query drops read items by, if it names one.

package/dist/service/dynamodb/command/query/sim-dynamodb-query.js

@@ -2,6 +2,7 @@ import { SimDynamoDbItemPage } from "../item/sim-dynamodb-item-page.js";
 import { SimDynamoDbReadAnswer } from "../read/sim-dynamodb-read-answer.js";
 import { assertSimDynamoDbConsistentReadAnswerable } from "../read/sim-dynamodb-consistent-read.js";
 import { SimDynamoDbSelect } from "../read/sim-dynamodb-select.js";
+import { simDynamoDbLeadingKeyOf } from "../authorize/sim-dynamodb-leading-keys.js";
 import { readSimDynamoDbQueryExpressions } from "./sim-dynamodb-query-expressions.js";
 import { refuseSimDynamoDbQuerySegment } from "./sim-dynamodb-query-segment.js";
 import { readSimDynamoDbQueryStartKey } from "./sim-dynamodb-query-start-key.js";
@@ -30,7 +31,14 @@ export class SimDynamoDbQuery {
         refuseUnsimulatedQueryInput(input);
         refuseSimDynamoDbQuerySegment(input);
         const expressions = readSimDynamoDbQueryExpressions(input);
-        const table = this.access.required("dynamodb:Query", input.TableName, options?.caller);
+        // The one partition key the query reads is what authorization needs, and
+        // reading it needs the view rather than the table, so it is read again
+        // here against whichever of the two the request names.
+        const table = this.access.required("dynamodb:Query", input.TableName, options?.caller, {
+            leadingKeys: (reached) => simDynamoDbLeadingKeyOf(expressions.terms.forTable(reached.view(input.IndexName))
+                .partitionKeyValue),
+            attributes: expressions.attributes,
+        });
         // What is being read is settled here: the table, or one of its indexes. An
         // IndexName the table does not have is refused rather than read as the
         // table. Everything after this asks the view rather than the table, so a

package/dist/service/dynamodb/command/scan/sim-dynamodb-scan-expressions.d.ts

@@ -7,6 +7,8 @@ import type { SimScanCommandInput } from "./scan.command.js";
 export interface SimDynamoDbScanExpressions {
     readonly filter: SimDynamoDbFilter | undefined;
     readonly projection: SimDynamoDbProjection | undefined;
+    /** The top-level attributes the expressions named, for `dynamodb:Attributes`. */
+    readonly attributes: readonly string[];
 }
 /**
  * Read both expressions of a scan against one set of placeholders.

package/dist/service/dynamodb/command/scan/sim-dynamodb-scan-expressions.js

@@ -22,13 +22,13 @@ export function readSimDynamoDbScanExpressions(input) {
     if (input.FilterExpression === undefined &&
         input.ProjectionExpression === undefined) {
         SimDynamoDbExpressionParameters.assertNoneWithout(input);
-        return { filter: undefined, projection: undefined };
+        return { filter: undefined, projection: undefined, attributes: [] };
     }
     const parameters = new SimDynamoDbExpressionParameters(input);
     const filter = filterIn(input.FilterExpression, parameters);
     const projection = projectionIn(input.ProjectionExpression, parameters);
     parameters.assertAllUsed();
-    return { filter, projection };
+    return { filter, projection, attributes: parameters.attributes.topLevel };
 }
 /**
  * Read the filter a scan drops read items by, if it names one.

package/dist/service/dynamodb/command/scan/sim-dynamodb-scan.js

@@ -39,7 +39,7 @@ export class SimDynamoDbScan {
         // attribute, including a key attribute, and needs no key schema to check.
         const segment = readSimDynamoDbScanSegment(input);
         const expressions = readSimDynamoDbScanExpressions(input);
-        const table = this.access.required("dynamodb:Scan", input.TableName, options?.caller);
+        const table = this.access.required("dynamodb:Scan", input.TableName, options?.caller, { attributes: expressions.attributes });
         // What is being read is settled here: the table, or one of its indexes.
         const view = table.view(input.IndexName);
         const scan = view.scan();

package/dist/service/dynamodb/command/table/sim-dynamodb-table-access.d.ts

@@ -4,6 +4,7 @@ import type { SimDynamoDbTable } from "../../table/sim-dynamodb-table.js";
 import type { SimDynamoDbTableName } from "../../table/sim-dynamodb-table-name.js";
 import type { SimDynamoDbTableStore } from "../../table/sim-dynamodb-table-store.js";
 import type { SimDynamoDbAuthorizer } from "../authorize/sim-dynamodb-authorizer.js";
+import type { SimDynamoDbTableReach } from "./sim-dynamodb-table-reach.js";
 interface SimDynamoDbTableAccessProperties {
     readonly tables: SimDynamoDbTableStore;
     readonly authorizer: SimDynamoDbAuthorizer;
@@ -14,9 +15,14 @@ interface SimDynamoDbTableAccessProperties {
  *
  * Every table command goes through the same two steps in the same order: read
  * the name or ARN the request carries, then authorize the caller against it
- * before anything looks the table up. Keeping them here is what makes that
- * order the same for all of them, so no command can accidentally tell an
- * unauthorized caller which table names are taken.
+ * before the command is told whether the table is there. Keeping them here is
+ * what makes that order the same for all of them, so no command can
+ * accidentally tell an unauthorized caller which table names are taken.
+ *
+ * A command reaching particular items hands over how to read their partition
+ * key values, which authorization needs the table to read. The table is found
+ * first for that, and a caller refused against a table that is not there still
+ * hears AccessDenied rather than a missing table.
  */
 export declare class SimDynamoDbTableAccess {
     private readonly tables;
@@ -28,13 +34,17 @@ export declare class SimDynamoDbTableAccess {
      */
     reference(tableName: string | undefined): SimDynamoDbTableName;
     /**
-     * Find the table a request names, refusing the caller before looking it up.
+     * Find the table a request names, refusing the caller before answering.
      */
-    required(action: string, tableName: string | undefined, caller: SimAwsCaller | undefined): SimDynamoDbTable;
+    required(action: string, tableName: string | undefined, caller: SimAwsCaller | undefined, reach?: SimDynamoDbTableReach): SimDynamoDbTable;
     /**
      * Find a table by a name that has already been read.
+     *
+     * A caller with no permission hears AccessDenied whether or not the table is
+     * there, which keeps an unauthorized caller from finding out which table
+     * names are taken.
      */
-    requiredByName(action: string, name: SimDynamoDbTableName, caller: SimAwsCaller | undefined): SimDynamoDbTable;
+    requiredByName(action: string, name: SimDynamoDbTableName, caller: SimAwsCaller | undefined, reach?: SimDynamoDbTableReach): SimDynamoDbTable;
     /**
      * Ensure the caller may perform an action that names no particular table.
      */

package/dist/service/dynamodb/command/table/sim-dynamodb-table-access.js

@@ -1,13 +1,19 @@
 import { SimDynamoDbResourceNotFoundException } from "../../error/dynamodb.error.js";
 import { readSimDynamoDbTableReference } from "../../table/sim-dynamodb-table-reference.js";
+import { simDynamoDbReachedIn } from "./sim-dynamodb-table-reach.js";
 /**
  * How a command reaches the table a request names.
  *
  * Every table command goes through the same two steps in the same order: read
  * the name or ARN the request carries, then authorize the caller against it
- * before anything looks the table up. Keeping them here is what makes that
- * order the same for all of them, so no command can accidentally tell an
- * unauthorized caller which table names are taken.
+ * before the command is told whether the table is there. Keeping them here is
+ * what makes that order the same for all of them, so no command can
+ * accidentally tell an unauthorized caller which table names are taken.
+ *
+ * A command reaching particular items hands over how to read their partition
+ * key values, which authorization needs the table to read. The table is found
+ * first for that, and a caller refused against a table that is not there still
+ * hears AccessDenied rather than a missing table.
  */
 export class SimDynamoDbTableAccess {
     tables;
@@ -25,17 +31,21 @@ export class SimDynamoDbTableAccess {
         return readSimDynamoDbTableReference(tableName, this.accountRegionScope);
     }
     /**
-     * Find the table a request names, refusing the caller before looking it up.
+     * Find the table a request names, refusing the caller before answering.
      */
-    required(action, tableName, caller) {
-        return this.requiredByName(action, this.reference(tableName), caller);
+    required(action, tableName, caller, reach = {}) {
+        return this.requiredByName(action, this.reference(tableName), caller, reach);
     }
     /**
      * Find a table by a name that has already been read.
+     *
+     * A caller with no permission hears AccessDenied whether or not the table is
+     * there, which keeps an unauthorized caller from finding out which table
+     * names are taken.
      */
-    requiredByName(action, name, caller) {
-        this.authorizer.authorizeTable(action, name.value, caller);
+    requiredByName(action, name, caller, reach = {}) {
         const table = this.tables.find(name);
+        this.authorizer.authorizeTable(action, name.value, caller, simDynamoDbReachedIn(reach, table));
         if (table === undefined) {
             throw new SimDynamoDbResourceNotFoundException(`No DynamoDB Table named ${name.value}`);
         }

package/dist/service/dynamodb/command/table/sim-dynamodb-table-reach.d.ts

@@ -0,0 +1,25 @@
+import type { SimDynamoDbReached } from "../authorize/sim-dynamodb-reached.js";
+import type { SimDynamoDbLeadingKeys } from "../authorize/sim-dynamodb-leading-keys.js";
+import type { SimDynamoDbTable } from "../../table/sim-dynamodb-table.js";
+/**
+ * What one command's request reaches, for the condition keys authorization
+ * supplies.
+ *
+ * The partition key values need the table to read them, so they arrive as a
+ * function of it. The attribute names are read from the request's own
+ * parameters before the table is reached, so they arrive as they are.
+ */
+export interface SimDynamoDbTableReach {
+    readonly leadingKeys?: SimDynamoDbLeadingKeys | undefined;
+    readonly attributes?: readonly string[] | undefined;
+}
+/**
+ * Resolve what a request reaches against the table it named.
+ *
+ * Authorization runs ahead of the checks a command makes on what it was given,
+ * as it does on AWS. A request whose key or key condition is malformed is
+ * authorized carrying no values and refused by the check that follows, so
+ * whatever reading them throws is dropped here. A table that is not there
+ * leaves the values unread, since the key schema is what reads them.
+ */
+export declare function simDynamoDbReachedIn(reach: SimDynamoDbTableReach, table: SimDynamoDbTable | undefined): SimDynamoDbReached;

package/dist/service/dynamodb/command/table/sim-dynamodb-table-reach.js

@@ -0,0 +1,27 @@
+/**
+ * Resolve what a request reaches against the table it named.
+ *
+ * Authorization runs ahead of the checks a command makes on what it was given,
+ * as it does on AWS. A request whose key or key condition is malformed is
+ * authorized carrying no values and refused by the check that follows, so
+ * whatever reading them throws is dropped here. A table that is not there
+ * leaves the values unread, since the key schema is what reads them.
+ */
+export function simDynamoDbReachedIn(reach, table) {
+    return {
+        leadingKeys: table === undefined ? undefined : leadingKeysIn(reach, table),
+        attributes: reach.attributes,
+    };
+}
+/**
+ * Read the partition key values a request reaches, or none where they cannot
+ * be read.
+ */
+function leadingKeysIn(reach, table) {
+    try {
+        return reach.leadingKeys?.(table);
+    }
+    catch {
+        return undefined;
+    }
+}

package/dist/service/dynamodb/command/transact/sim-dynamodb-transact-gets.js

@@ -23,7 +23,7 @@ export class SimDynamoDbTransactRead {
      * Read the Get one action of a transactional read carries.
      */
     static of(request) {
-        return new this(request.TableName, readSimDynamoDbKey(request.Key), readSimDynamoDbProjection(request));
+        return new this(request.TableName, readSimDynamoDbKey(request.Key), readSimDynamoDbProjection(request).projection);
     }
     /**
      * The primary key this Get reads, as the table marshals it.

package/dist/service/dynamodb/expression/condition/sim-dynamodb-condition-expression.d.ts

@@ -4,13 +4,21 @@ import type { SimDynamoDbCondition } from "./sim-dynamodb-condition.js";
 interface SimDynamoDbConditionRequest extends SimDynamoDbExpressionParameterInput {
     readonly ConditionExpression?: string | undefined;
 }
+/**
+ * What a request's ConditionExpression said, once it has been read.
+ */
+export interface SimDynamoDbConditionRead {
+    readonly condition: SimDynamoDbCondition | undefined;
+    /** The top-level attributes the expression named, for `dynamodb:Attributes`. */
+    readonly attributes: readonly string[];
+}
 /**
  * Read the condition a write is guarded by, if it names one.
  *
  * A request with no ConditionExpression is an unconditional write, so there is
  * nothing to check.
  */
-export declare function readSimDynamoDbCondition(request: SimDynamoDbConditionRequest): SimDynamoDbCondition | undefined;
+export declare function readSimDynamoDbCondition(request: SimDynamoDbConditionRequest): SimDynamoDbConditionRead;
 /**
  * Read one ConditionExpression against placeholders that have already been
  * gathered.

package/dist/service/dynamodb/expression/condition/sim-dynamodb-condition-expression.js

@@ -11,12 +11,12 @@ export function readSimDynamoDbCondition(request) {
     const expression = request.ConditionExpression;
     if (expression === undefined) {
         SimDynamoDbExpressionParameters.assertNoneWithout(request);
-        return undefined;
+        return { condition: undefined, attributes: [] };
     }
     const parameters = new SimDynamoDbExpressionParameters(request);
     const condition = parseSimDynamoDbCondition(expression, parameters);
     parameters.assertAllUsed();
-    return condition;
+    return { condition, attributes: parameters.attributes.topLevel };
 }
 /**
  * Read one ConditionExpression against placeholders that have already been

package/dist/service/dynamodb/expression/condition/sim-dynamodb-condition-grammar.js

@@ -10,7 +10,7 @@ import { SimDynamoDbConditionParser } from "./sim-dynamodb-condition-parser.js";
 export function simDynamoDbConditionParser(expressionName, expression, parameters) {
     return new SimDynamoDbConditionParser({
         tokens: SimDynamoDbExpressionTokens.of(expressionName, expression, "the expression says nothing, and an expression cannot be empty"),
-        names: parameters.names,
+        attributes: parameters.attributes,
         values: parameters.values,
     });
 }

package/dist/service/dynamodb/expression/condition/sim-dynamodb-condition-operand-parser.d.ts

@@ -1,11 +1,12 @@
 import type { SimDynamoDbValue } from "../../item/sim-dynamodb-value.js";
 import type { SimDynamoDbDocumentPath } from "../sim-dynamodb-document-path.js";
+import type { SimDynamoDbExpressionAttributes } from "../sim-dynamodb-expression-attributes.js";
 import type { SimDynamoDbExpressionPlaceholders } from "../sim-dynamodb-expression-placeholders.js";
 import type { SimDynamoDbExpressionTokens } from "../sim-dynamodb-expression-tokens.js";
 import { type SimDynamoDbConditionOperand, SimDynamoDbPathOperand } from "./sim-dynamodb-condition-operand.js";
 interface SimDynamoDbConditionOperandParserProperties {
     readonly tokens: SimDynamoDbExpressionTokens;
-    readonly names: SimDynamoDbExpressionPlaceholders<string>;
+    readonly attributes: SimDynamoDbExpressionAttributes;
     readonly values: SimDynamoDbExpressionPlaceholders<SimDynamoDbValue>;
 }
 /**
@@ -17,7 +18,7 @@ interface SimDynamoDbConditionOperandParserProperties {
  */
 export declare class SimDynamoDbConditionOperandParser {
     private readonly tokens;
-    private readonly names;
+    private readonly attributes;
     private readonly values;
     private readonly read;
     constructor(properties: SimDynamoDbConditionOperandParserProperties);

package/dist/service/dynamodb/expression/condition/sim-dynamodb-condition-operand-parser.js

@@ -15,12 +15,12 @@ const sizeFunctionName = "size";
  */
 export class SimDynamoDbConditionOperandParser {
     tokens;
-    names;
+    attributes;
     values;
     read = [];
     constructor(properties) {
         this.tokens = properties.tokens;
-        this.names = properties.names;
+        this.attributes = properties.attributes;
         this.values = properties.values;
     }
     /**
@@ -87,7 +87,7 @@ export class SimDynamoDbConditionOperandParser {
     path() {
         const path = new SimDynamoDbDocumentPathParser({
             tokens: this.tokens,
-            names: this.names,
+            attributes: this.attributes,
         }).parse();
         this.read.push(path);
         return new SimDynamoDbPathOperand(path);

package/dist/service/dynamodb/expression/condition/sim-dynamodb-condition-parser.d.ts

@@ -1,11 +1,12 @@
 import type { SimDynamoDbValue } from "../../item/sim-dynamodb-value.js";
 import type { SimDynamoDbDocumentPath } from "../sim-dynamodb-document-path.js";
+import type { SimDynamoDbExpressionAttributes } from "../sim-dynamodb-expression-attributes.js";
 import type { SimDynamoDbExpressionPlaceholders } from "../sim-dynamodb-expression-placeholders.js";
 import type { SimDynamoDbExpressionTokens } from "../sim-dynamodb-expression-tokens.js";
 import { type SimDynamoDbCondition } from "./sim-dynamodb-condition.js";
 interface SimDynamoDbConditionParserProperties {
     readonly tokens: SimDynamoDbExpressionTokens;
-    readonly names: SimDynamoDbExpressionPlaceholders<string>;
+    readonly attributes: SimDynamoDbExpressionAttributes;
     readonly values: SimDynamoDbExpressionPlaceholders<SimDynamoDbValue>;
 }
 /**

package/dist/service/dynamodb/expression/condition/sim-dynamodb-condition-parser.js

@@ -21,7 +21,7 @@ export class SimDynamoDbConditionParser {
     constructor(properties) {
         const operands = new SimDynamoDbConditionOperandParser({
             tokens: properties.tokens,
-            names: properties.names,
+            attributes: properties.attributes,
             values: properties.values,
         });
         this.tokens = properties.tokens;

package/dist/service/dynamodb/expression/key-condition/sim-dynamodb-key-condition-expression.js

@@ -22,7 +22,7 @@ export function readSimDynamoDbKeyCondition(request, parameters) {
     }
     const terms = new SimDynamoDbKeyConditionParser({
         tokens: SimDynamoDbExpressionTokens.of(keyConditionExpressionName, expression, "the expression says nothing, and an expression cannot be empty"),
-        names: parameters.names,
+        attributes: parameters.attributes,
         values: parameters.values,
     }).parse();
     return new SimDynamoDbKeyConditionTerms(terms);

package/dist/service/dynamodb/expression/key-condition/sim-dynamodb-key-condition-operands.d.ts

@@ -1,10 +1,11 @@
 import type { SimDynamoDbValue } from "../../item/sim-dynamodb-value.js";
+import type { SimDynamoDbExpressionAttributes } from "../sim-dynamodb-expression-attributes.js";
 import type { SimDynamoDbExpressionPlaceholders } from "../sim-dynamodb-expression-placeholders.js";
 import type { SimDynamoDbExpressionTokens } from "../sim-dynamodb-expression-tokens.js";
 import { type SimDynamoDbKeyConditionRefusals } from "./sim-dynamodb-key-condition-refusals.js";
 interface SimDynamoDbKeyConditionOperandsProperties {
     readonly tokens: SimDynamoDbExpressionTokens;
-    readonly names: SimDynamoDbExpressionPlaceholders<string>;
+    readonly attributes: SimDynamoDbExpressionAttributes;
     readonly values: SimDynamoDbExpressionPlaceholders<SimDynamoDbValue>;
     readonly refusals: SimDynamoDbKeyConditionRefusals;
 }
@@ -17,7 +18,7 @@ interface SimDynamoDbKeyConditionOperandsProperties {
  */
 export declare class SimDynamoDbKeyConditionOperands {
     private readonly tokens;
-    private readonly names;
+    private readonly attributes;
     private readonly values;
     private readonly refusals;
     constructor(properties: SimDynamoDbKeyConditionOperandsProperties);

package/dist/service/dynamodb/expression/key-condition/sim-dynamodb-key-condition-operands.js

@@ -22,12 +22,12 @@ const keyComparators = new Set([
  */
 export class SimDynamoDbKeyConditionOperands {
     tokens;
-    names;
+    attributes;
     values;
     refusals;
     constructor(properties) {
         this.tokens = properties.tokens;
-        this.names = properties.names;
+        this.attributes = properties.attributes;
         this.values = properties.values;
         this.refusals = properties.refusals;
     }
@@ -77,9 +77,11 @@ export class SimDynamoDbKeyConditionOperands {
      * The attribute a name token stands for, which may be a placeholder.
      */
     nameOf(kind, text) {
-        if (kind === "name") {
-            return text;
-        }
-        return this.names.required(text);
+        const name = kind === "name" ? text : this.attributes.required(text);
+        // A key condition reads no document paths, so the attributes it reaches
+        // are noted here rather than by the path parser. A key is scalar, and the
+        // attribute a term names is always a top-level one.
+        this.attributes.reach(name);
+        return name;
     }
 }

package/dist/service/dynamodb/expression/key-condition/sim-dynamodb-key-condition-parser.d.ts

@@ -1,10 +1,11 @@
 import type { SimDynamoDbValue } from "../../item/sim-dynamodb-value.js";
+import type { SimDynamoDbExpressionAttributes } from "../sim-dynamodb-expression-attributes.js";
 import type { SimDynamoDbExpressionPlaceholders } from "../sim-dynamodb-expression-placeholders.js";
 import type { SimDynamoDbExpressionTokens } from "../sim-dynamodb-expression-tokens.js";
 import type { SimDynamoDbKeyConditionTerm } from "./sim-dynamodb-key-condition-term.js";
 interface SimDynamoDbKeyConditionParserProperties {
     readonly tokens: SimDynamoDbExpressionTokens;
-    readonly names: SimDynamoDbExpressionPlaceholders<string>;
+    readonly attributes: SimDynamoDbExpressionAttributes;
     readonly values: SimDynamoDbExpressionPlaceholders<SimDynamoDbValue>;
 }
 /**

package/dist/service/dynamodb/expression/key-condition/sim-dynamodb-key-condition-parser.js

@@ -27,7 +27,7 @@ export class SimDynamoDbKeyConditionParser {
         this.refusals = refusals;
         this.operands = new SimDynamoDbKeyConditionOperands({
             tokens: properties.tokens,
-            names: properties.names,
+            attributes: properties.attributes,
             values: properties.values,
             refusals,
         });

package/dist/service/dynamodb/expression/projection/sim-dynamodb-projection-expression.d.ts

@@ -4,6 +4,14 @@ import { SimDynamoDbProjection } from "./sim-dynamodb-projection.js";
 interface SimDynamoDbProjectionRequest extends SimDynamoDbExpressionParameterInput {
     readonly ProjectionExpression?: string | undefined;
 }
+/**
+ * What a request's ProjectionExpression said, once it has been read.
+ */
+export interface SimDynamoDbProjectionRead {
+    readonly projection: SimDynamoDbProjection | undefined;
+    /** The top-level attributes the expression named, for `dynamodb:Attributes`. */
+    readonly attributes: readonly string[];
+}
 /**
  * Read the projection a request asks for, if it asks for one.
  *
@@ -15,7 +23,7 @@ interface SimDynamoDbProjectionRequest extends SimDynamoDbExpressionParameterInp
  * carry a filter alongside its projection, and reads both against one set of
  * placeholders through `parseSimDynamoDbProjection`.
  */
-export declare function readSimDynamoDbProjection(request: SimDynamoDbProjectionRequest): SimDynamoDbProjection | undefined;
+export declare function readSimDynamoDbProjection(request: SimDynamoDbProjectionRequest): SimDynamoDbProjectionRead;
 /**
  * Read one ProjectionExpression against placeholders that have already been
  * gathered.