@kensio/yulin 1.21.13 → 1.21.14

package/dist/service/dynamodb/command/authorize/sim-dynamodb-attributes.d.ts

@@ -0,0 +1,27 @@
+import type { SimDynamoDbItem } from "../../item/sim-dynamodb-item.js";
+/**
+ * The condition key DynamoDB names a request's attributes by.
+ */
+export declare const simDynamoDbAttributesConditionKey = "dynamodb:Attributes";
+/**
+ * The top-level attribute names a `Key` or an `Item` carries.
+ *
+ * Those parameters name their attributes outright, so there is no expression
+ * to read them out of. Every name is top-level, since an item's attributes are
+ * what nesting starts from.
+ *
+ * The items are read when authorization asks for them, and whatever reading
+ * them throws is dropped. Authorization runs ahead of the checks a command
+ * makes on what it was given, so a request too malformed to read is authorized
+ * naming no attributes and refused by the check that follows.
+ */
+export declare function simDynamoDbItemAttributeNames(items: () => readonly SimDynamoDbItem[]): readonly string[];
+/**
+ * Gather the attribute names a request reaches, keeping each one once.
+ *
+ * A request names the same attribute in more than one place often enough for
+ * this to matter. An UpdateItem names its key in `Key` and may name it again
+ * in a condition, and AWS supplies one list of attributes rather than one per
+ * parameter.
+ */
+export declare function simDynamoDbAttributesOf(...sources: readonly (readonly string[])[]): readonly string[];

package/dist/service/dynamodb/command/authorize/sim-dynamodb-attributes.js

@@ -0,0 +1,35 @@
+/**
+ * The condition key DynamoDB names a request's attributes by.
+ */
+export const simDynamoDbAttributesConditionKey = "dynamodb:Attributes";
+/**
+ * The top-level attribute names a `Key` or an `Item` carries.
+ *
+ * Those parameters name their attributes outright, so there is no expression
+ * to read them out of. Every name is top-level, since an item's attributes are
+ * what nesting starts from.
+ *
+ * The items are read when authorization asks for them, and whatever reading
+ * them throws is dropped. Authorization runs ahead of the checks a command
+ * makes on what it was given, so a request too malformed to read is authorized
+ * naming no attributes and refused by the check that follows.
+ */
+export function simDynamoDbItemAttributeNames(items) {
+    try {
+        return items().flatMap((item) => item.attributeNames());
+    }
+    catch {
+        return [];
+    }
+}
+/**
+ * Gather the attribute names a request reaches, keeping each one once.
+ *
+ * A request names the same attribute in more than one place often enough for
+ * this to matter. An UpdateItem names its key in `Key` and may name it again
+ * in a condition, and AWS supplies one list of attributes rather than one per
+ * parameter.
+ */
+export function simDynamoDbAttributesOf(...sources) {
+    return [...new Set(sources.flat())];
+}

package/dist/service/dynamodb/command/authorize/sim-dynamodb-authorizer.d.ts

@@ -2,6 +2,7 @@ import type { SimAwsCaller } from "../../../aws/caller/sim-aws-caller.js";
 import type { SimAwsResolvedCaller } from "../../../aws/caller/sim-aws-caller-resolver.js";
 import type { SimAwsAccountRegionScope } from "../../../aws/sim-aws-account-region-scope.js";
 import type { SimIamInterServiceAuthZ } from "../../../iam/authorize/sim-iam-inter-service-auth-z.js";
+import type { SimDynamoDbReached } from "./sim-dynamodb-reached.js";
 interface SimDynamoDbAuthorizerProperties {
     readonly iam: SimIamInterServiceAuthZ;
     readonly accountRegionScope: SimAwsAccountRegionScope;
@@ -29,7 +30,7 @@ export declare class SimDynamoDbAuthorizer {
      * omitted caller, which defaults to Account root, from an explicit anonymous
      * caller.
      */
-    authorizeTable(action: string, tableName: string, caller?: SimAwsCaller, leadingKeys?: readonly string[]): SimAwsResolvedCaller;
+    authorizeTable(action: string, tableName: string, caller?: SimAwsCaller, reached?: SimDynamoDbReached): SimAwsResolvedCaller;
     /**
      * Ensure the caller may perform an action on a table's stream.
      *

package/dist/service/dynamodb/command/authorize/sim-dynamodb-authorizer.js

@@ -1,19 +1,6 @@
 import { SimIamAccessDenied } from "../../../iam/error/sim-iam.error.js";
 import { simDynamoDbTableArn } from "../../table/sim-dynamodb-table-arn.js";
-import { simDynamoDbLeadingKeysConditionKey } from "./sim-dynamodb-leading-keys.js";
-/**
- * The condition values a request carries for the table it names.
- *
- * A request reaching no partition key value supplies none rather than an empty
- * list, leaving the key absent from the context as it is on AWS for an
- * operation that names no item.
- */
-function conditionContextOf(leadingKeys) {
-    if (leadingKeys === undefined || leadingKeys.length === 0) {
-        return {};
-    }
-    return { [simDynamoDbLeadingKeysConditionKey]: leadingKeys };
-}
+import { simDynamoDbConditionContextOf } from "./sim-dynamodb-reached.js";
 /**
  * Applies simulated IAM authorization to DynamoDB requests.
  *
@@ -40,8 +27,8 @@ export class SimDynamoDbAuthorizer {
      * omitted caller, which defaults to Account root, from an explicit anonymous
      * caller.
      */
-    authorizeTable(action, tableName, caller, leadingKeys) {
-        return this.authorizeResource(action, simDynamoDbTableArn(this.accountRegionScope, tableName), caller, leadingKeys);
+    authorizeTable(action, tableName, caller, reached = {}) {
+        return this.authorizeResource(action, simDynamoDbTableArn(this.accountRegionScope, tableName), caller, reached);
     }
     /**
      * Ensure the caller may perform an action on a table's stream.
@@ -65,12 +52,12 @@ export class SimDynamoDbAuthorizer {
     authorizeAnyTable(action, caller) {
         return this.authorizeResource(action, "*", caller);
     }
-    authorizeResource(action, resource, caller, leadingKeys) {
+    authorizeResource(action, resource, caller, reached = {}) {
         const decision = this.iam.authorize({
             action,
             resource,
             caller,
-            conditionContext: conditionContextOf(leadingKeys),
+            conditionContext: simDynamoDbConditionContextOf(reached),
         });
         if (decision.isDenied) {
             throw new SimIamAccessDenied({

package/dist/service/dynamodb/command/authorize/sim-dynamodb-reached.d.ts

@@ -0,0 +1,17 @@
+/**
+ * What one request reaches in the table it names.
+ *
+ * Each entry becomes a DynamoDB condition key. A request reaching nothing
+ * under one of them leaves it out, as AWS leaves a key out for an operation
+ * that reaches nothing it names.
+ */
+export interface SimDynamoDbReached {
+    /** The partition key values the request reaches. */
+    readonly leadingKeys?: readonly string[] | undefined;
+    /** The top-level attribute names the request names. */
+    readonly attributes?: readonly string[] | undefined;
+}
+/**
+ * The condition values a request carries for the table it names.
+ */
+export declare function simDynamoDbConditionContextOf(reached: SimDynamoDbReached): Readonly<Record<string, readonly string[]>>;

package/dist/service/dynamodb/command/authorize/sim-dynamodb-reached.js

@@ -0,0 +1,11 @@
+import { simDynamoDbAttributesConditionKey } from "./sim-dynamodb-attributes.js";
+import { simDynamoDbLeadingKeysConditionKey } from "./sim-dynamodb-leading-keys.js";
+/**
+ * The condition values a request carries for the table it names.
+ */
+export function simDynamoDbConditionContextOf(reached) {
+    return Object.fromEntries([
+        [simDynamoDbLeadingKeysConditionKey, reached.leadingKeys],
+        [simDynamoDbAttributesConditionKey, reached.attributes],
+    ].filter(([, values]) => (values ?? []).length > 0));
+}

package/dist/service/dynamodb/command/batch/sim-dynamodb-batch-get-item.js

@@ -28,7 +28,10 @@ export class SimDynamoDbBatchGetItem {
             access: this.access,
             operation: "BatchGetItem",
             caller: options?.caller,
-            leadingKeys: (entry) => simDynamoDbLeadingKeysOf(() => entry.keys),
+            reached: (entry) => ({
+                leadingKeys: simDynamoDbLeadingKeysOf(() => entry.keys),
+                attributes: entry.attributes,
+            }),
         });
         const responses = Object.fromEntries(reached.map((entry) => [entry.requested.reference, readItems(entry)]));
         // Nothing here throttles or stops at a response size, so no key is ever

package/dist/service/dynamodb/command/batch/sim-dynamodb-batch-read-limit.d.ts

@@ -0,0 +1,6 @@
+import type { SimDynamoDbKeysAndAttributes } from "./batch.command.js";
+import type { SimDynamoDbBatchTableRequest } from "./sim-dynamodb-batch-request-items.js";
+/**
+ * Refuse a batch asking for more items than DynamoDB reads at once.
+ */
+export declare function assertSimDynamoDbBatchReadLimit(tables: readonly SimDynamoDbBatchTableRequest<SimDynamoDbKeysAndAttributes>[], operation: string): void;

package/dist/service/dynamodb/command/batch/sim-dynamodb-batch-read-limit.js

@@ -0,0 +1,16 @@
+import { SimDynamoDbValidationException } from "../../error/dynamodb.error.js";
+/**
+ * Real DynamoDB reads 100 items in one batch, counted across every table the
+ * request names rather than per table.
+ */
+const greatestKeys = 100;
+/**
+ * Refuse a batch asking for more items than DynamoDB reads at once.
+ */
+export function assertSimDynamoDbBatchReadLimit(tables, operation) {
+    const total = tables.reduce((count, { requested }) => count + (requested.Keys ?? []).length, 0);
+    if (total > greatestKeys) {
+        throw new SimDynamoDbValidationException(`Too many items requested for the ${operation} call: ${total.toString()} ` +
+            `keys, where ${greatestKeys.toString()} is the most a batch reads`);
+    }
+}

package/dist/service/dynamodb/command/batch/sim-dynamodb-batch-reads.d.ts

@@ -11,6 +11,8 @@ export interface SimDynamoDbBatchTableReads {
     readonly reference: string;
     readonly keys: readonly SimDynamoDbItem[];
     readonly projection: SimDynamoDbProjection | undefined;
+    /** The top-level attributes this table is asked for, per table as above. */
+    readonly attributes: readonly string[];
 }
 /**
  * Read every key a batch asks for, before any table is reached.

package/dist/service/dynamodb/command/batch/sim-dynamodb-batch-reads.js

@@ -1,14 +1,11 @@
 import { SimDynamoDbValidationException } from "../../error/dynamodb.error.js";
 import { readSimDynamoDbProjection } from "../../expression/projection/sim-dynamodb-projection-expression.js";
 import { readSimDynamoDbKey } from "../item/sim-dynamodb-key-input.js";
-import { readSimDynamoDbBatchRequestItems, } from "./sim-dynamodb-batch-request-items.js";
+import { simDynamoDbAttributesOf, simDynamoDbItemAttributeNames, } from "../authorize/sim-dynamodb-attributes.js";
+import { readSimDynamoDbBatchRequestItems } from "./sim-dynamodb-batch-request-items.js";
+import { assertSimDynamoDbBatchReadLimit } from "./sim-dynamodb-batch-read-limit.js";
 import { refuseUnsimulatedBatchKeysAndAttributes } from "./sim-dynamodb-unsimulated-batch-input.js";
 const operation = "BatchGetItem";
-/**
- * Real DynamoDB reads 100 items in one batch, counted across every table the
- * request names rather than per table.
- */
-const greatestKeys = 100;
 /**
  * Read every key a batch asks for, before any table is reached.
  *
@@ -17,22 +14,17 @@ const greatestKeys = 100;
  */
 export function readSimDynamoDbBatchReads(requestItems) {
     const tables = readSimDynamoDbBatchRequestItems(requestItems, operation);
-    assertWithinKeyLimit(tables);
-    return tables.map(({ reference, requested }) => ({
-        reference,
-        keys: readTableKeys(reference, requested),
-        projection: readSimDynamoDbProjection(requested),
-    }));
-}
-/**
- * Refuse a batch asking for more items than DynamoDB reads at once.
- */
-function assertWithinKeyLimit(tables) {
-    const total = tables.reduce((count, { requested }) => count + (requested.Keys ?? []).length, 0);
-    if (total > greatestKeys) {
-        throw new SimDynamoDbValidationException(`Too many items requested for the ${operation} call: ${total.toString()} ` +
-            `keys, where ${greatestKeys.toString()} is the most a batch reads`);
-    }
+    assertSimDynamoDbBatchReadLimit(tables, operation);
+    return tables.map(({ reference, requested }) => {
+        const keys = readTableKeys(reference, requested);
+        const read = readSimDynamoDbProjection(requested);
+        return {
+            reference,
+            keys,
+            projection: read.projection,
+            attributes: simDynamoDbAttributesOf(read.attributes, simDynamoDbItemAttributeNames(() => keys)),
+        };
+    });
 }
 /**
  * Read the keys one table of the batch is asked for.

package/dist/service/dynamodb/command/batch/sim-dynamodb-batch-tables.d.ts

@@ -1,7 +1,7 @@
 import type { SimAwsCaller } from "../../../aws/caller/sim-aws-caller.js";
 import type { SimDynamoDbTable } from "../../table/sim-dynamodb-table.js";
 import type { SimDynamoDbTableAccess } from "../table/sim-dynamodb-table-access.js";
-import type { SimDynamoDbLeadingKeys } from "../authorize/sim-dynamodb-leading-keys.js";
+import type { SimDynamoDbTableReach } from "../table/sim-dynamodb-table-reach.js";
 /**
  * What one table of a batch asks for, against the table it names.
  */
@@ -14,12 +14,12 @@ interface SimDynamoDbBatchReach<Requested> {
     readonly operation: string;
     readonly caller: SimAwsCaller | undefined;
     /**
-     * How to read the partition key values one table of the batch is asked for.
+     * What one table of the batch is asked for.
      *
-     * Each table is authorized on its own, so each carries the keys the batch
-     * names in that table and no others.
+     * Each table is authorized on its own, so each carries the keys and the
+     * attributes the batch names in that table and no others.
      */
-    readonly leadingKeys: (requested: Requested) => SimDynamoDbLeadingKeys;
+    readonly reached: (requested: Requested) => SimDynamoDbTableReach;
 }
 /**
  * Reach every table a batch names, authorizing the caller against each.

package/dist/service/dynamodb/command/batch/sim-dynamodb-batch-tables.js

@@ -11,7 +11,7 @@ import { SimDynamoDbValidationException } from "../../error/dynamodb.error.js";
 export function reachSimDynamoDbBatchTables(requested, reach) {
     const action = `dynamodb:${reach.operation}`;
     const reached = requested.map((entry) => ({
-        table: reach.access.required(action, entry.reference, reach.caller, reach.leadingKeys(entry)),
+        table: reach.access.required(action, entry.reference, reach.caller, reach.reached(entry)),
         requested: entry,
     }));
     assertDistinctTables(reached, reach.operation);

package/dist/service/dynamodb/command/batch/sim-dynamodb-batch-write-item.js

@@ -3,6 +3,7 @@ import { reachSimDynamoDbBatchTables } from "./sim-dynamodb-batch-tables.js";
 import { readSimDynamoDbBatchWrites } from "./sim-dynamodb-batch-writes.js";
 import { refuseUnsimulatedBatchWriteInput } from "./sim-dynamodb-unsimulated-batch-input.js";
 import { simDynamoDbLeadingKeysOf } from "../authorize/sim-dynamodb-leading-keys.js";
+import { simDynamoDbItemAttributeNames } from "../authorize/sim-dynamodb-attributes.js";
 const operation = "BatchWriteItem";
 /**
  * The BatchWriteItem command.
@@ -30,7 +31,10 @@ export class SimDynamoDbBatchWriteItem {
             access: this.access,
             operation,
             caller: options?.caller,
-            leadingKeys: (entry) => simDynamoDbLeadingKeysOf(() => entry.writes.map((write) => write.names)),
+            reached: (entry) => ({
+                leadingKeys: simDynamoDbLeadingKeysOf(() => entry.writes.map((write) => write.names)),
+                attributes: simDynamoDbItemAttributeNames(() => entry.writes.map((write) => write.names)),
+            }),
         });
         // Marshalling every key checks it against the table's key schema, and is
         // what tells two operations on one item apart. Every table is checked

package/dist/service/dynamodb/command/item/sim-dynamodb-condition-check.d.ts

@@ -15,6 +15,10 @@ interface SimDynamoDbConditionCheckInput {
  * be nothing: that is what makes `attribute_not_exists` an insert if absent.
  */
 export declare class SimDynamoDbConditionCheck {
+    /**
+     * The top-level attributes the condition named, for `dynamodb:Attributes`.
+     */
+    readonly attributeNames: readonly string[];
     private readonly condition;
     private readonly reportsItem;
     private constructor();
@@ -31,7 +35,7 @@ export declare class SimDynamoDbConditionCheck {
      * UpdateItem reads its condition alongside its update expression, since the
      * two share the request's placeholders, and then hands the condition here.
      */
-    static of(condition: SimDynamoDbCondition | undefined, input: SimDynamoDbConditionCheckInput, operation: string): SimDynamoDbConditionCheck;
+    static of(condition: SimDynamoDbCondition | undefined, input: SimDynamoDbConditionCheckInput, operation: string, attributeNames?: readonly string[]): SimDynamoDbConditionCheck;
     /**
      * Whether the request asked for the item that turned it away.
      */

package/dist/service/dynamodb/command/item/sim-dynamodb-condition-check.js

@@ -13,11 +13,16 @@ const failureModes = new Set(["NONE", "ALL_OLD"]);
  * be nothing: that is what makes `attribute_not_exists` an insert if absent.
  */
 export class SimDynamoDbConditionCheck {
+    /**
+     * The top-level attributes the condition named, for `dynamodb:Attributes`.
+     */
+    attributeNames;
     condition;
     reportsItem;
     constructor(properties) {
         this.condition = properties.condition;
         this.reportsItem = properties.reportsItem;
+        this.attributeNames = properties.attributeNames;
     }
     /**
      * Read the condition a request carries, before anything is looked up.
@@ -26,7 +31,8 @@ export class SimDynamoDbConditionCheck {
      * anything, so a bad expression fails the same way every time.
      */
     static read(input, operation) {
-        return this.of(readSimDynamoDbCondition(input), input, operation);
+        const read = readSimDynamoDbCondition(input);
+        return this.of(read.condition, input, operation, read.attributes);
     }
     /**
      * Guard a write with a condition that has already been read.
@@ -34,10 +40,11 @@ export class SimDynamoDbConditionCheck {
      * UpdateItem reads its condition alongside its update expression, since the
      * two share the request's placeholders, and then hands the condition here.
      */
-    static of(condition, input, operation) {
+    static of(condition, input, operation, attributeNames = []) {
         return new this({
             condition,
             reportsItem: this.reportsItemFor(input, operation),
+            attributeNames,
         });
     }
     /**

package/dist/service/dynamodb/command/item/sim-dynamodb-delete-item.js

@@ -1,4 +1,5 @@
 import { simDynamoDbLeadingKeysOf } from "../authorize/sim-dynamodb-leading-keys.js";
+import { simDynamoDbAttributesOf, simDynamoDbItemAttributeNames, } from "../authorize/sim-dynamodb-attributes.js";
 import { readSimDynamoDbKey } from "./sim-dynamodb-key-input.js";
 import { SimDynamoDbConditionCheck } from "./sim-dynamodb-condition-check.js";
 import { SimDynamoDbReturnValues } from "./sim-dynamodb-return-values.js";
@@ -27,7 +28,12 @@ export class SimDynamoDbDeleteItem {
         // The condition is read before the table is reached, so an expression
         // DynamoDB would refuse is refused whether or not the key holds anything.
         const check = SimDynamoDbConditionCheck.read(input, "DeleteItem");
-        const table = this.access.required("dynamodb:DeleteItem", input.TableName, options?.caller, simDynamoDbLeadingKeysOf(() => [readSimDynamoDbKey(input.Key)]));
+        const table = this.access.required("dynamodb:DeleteItem", input.TableName, options?.caller, {
+            leadingKeys: simDynamoDbLeadingKeysOf(() => [
+                readSimDynamoDbKey(input.Key),
+            ]),
+            attributes: simDynamoDbAttributesOf(check.attributeNames, simDynamoDbItemAttributeNames(() => [readSimDynamoDbKey(input.Key)])),
+        });
         const asked = SimDynamoDbReturnValues.read(input.ReturnValues, "DeleteItem");
         const key = readSimDynamoDbKey(input.Key);
         check.assertHoldsFor(table.getItem(key));

package/dist/service/dynamodb/command/item/sim-dynamodb-get-item.js

@@ -2,6 +2,7 @@ import { simDynamoDbLeadingKeysOf } from "../authorize/sim-dynamodb-leading-keys
 import { readSimDynamoDbKey } from "./sim-dynamodb-key-input.js";
 import { refuseUnsimulatedItemReadInput } from "./sim-dynamodb-unsimulated-item-read-input.js";
 import { readSimDynamoDbProjection } from "../../expression/projection/sim-dynamodb-projection-expression.js";
+import { simDynamoDbAttributesOf, simDynamoDbItemAttributeNames, } from "../authorize/sim-dynamodb-attributes.js";
 /**
  * The GetItem command.
  *
@@ -26,8 +27,14 @@ export class SimDynamoDbGetItem {
         refuseUnsimulatedItemReadInput(input);
         // The projection is read before the table is reached, so an expression
         // DynamoDB would refuse is refused whether or not the key holds anything.
-        const projection = readSimDynamoDbProjection(input);
-        const table = this.access.required("dynamodb:GetItem", input.TableName, options?.caller, simDynamoDbLeadingKeysOf(() => [readSimDynamoDbKey(input.Key)]));
+        const read = readSimDynamoDbProjection(input);
+        const projection = read.projection;
+        const table = this.access.required("dynamodb:GetItem", input.TableName, options?.caller, {
+            leadingKeys: simDynamoDbLeadingKeysOf(() => [
+                readSimDynamoDbKey(input.Key),
+            ]),
+            attributes: simDynamoDbAttributesOf(read.attributes, simDynamoDbItemAttributeNames(() => [readSimDynamoDbKey(input.Key)])),
+        });
         const found = table.getItem(readSimDynamoDbKey(input.Key));
         if (found === undefined) {
             return { $metadata: {} };

package/dist/service/dynamodb/command/item/sim-dynamodb-put-item.js

@@ -1,6 +1,7 @@
 import { SimDynamoDbValidationException } from "../../error/dynamodb.error.js";
 import { SimDynamoDbItem } from "../../item/sim-dynamodb-item.js";
 import { simDynamoDbLeadingKeysOf } from "../authorize/sim-dynamodb-leading-keys.js";
+import { simDynamoDbAttributesOf, simDynamoDbItemAttributeNames, } from "../authorize/sim-dynamodb-attributes.js";
 import { SimDynamoDbConditionCheck } from "./sim-dynamodb-condition-check.js";
 import { SimDynamoDbReturnValues } from "./sim-dynamodb-return-values.js";
 import { refuseUnsimulatedItemWriteInput } from "./sim-dynamodb-unsimulated-item-write-input.js";
@@ -37,7 +38,10 @@ export class SimDynamoDbPutItem {
         // The condition is read before the table is reached, so an expression
         // DynamoDB would refuse is refused whether or not the key holds anything.
         const check = SimDynamoDbConditionCheck.read(input, "PutItem");
-        const table = this.access.required("dynamodb:PutItem", input.TableName, options?.caller, simDynamoDbLeadingKeysOf(() => [readItem(input)]));
+        const table = this.access.required("dynamodb:PutItem", input.TableName, options?.caller, {
+            leadingKeys: simDynamoDbLeadingKeysOf(() => [readItem(input)]),
+            attributes: simDynamoDbAttributesOf(check.attributeNames, simDynamoDbItemAttributeNames(() => [readItem(input)])),
+        });
         const asked = SimDynamoDbReturnValues.read(input.ReturnValues, "PutItem");
         const item = readItem(input);
         check.assertHoldsFor(table.itemUnder(item));

package/dist/service/dynamodb/command/item/sim-dynamodb-update-expressions.d.ts

@@ -14,6 +14,8 @@ export interface SimDynamoDbUpdateExpressionInput extends SimDynamoDbExpressionP
 export interface SimDynamoDbUpdateExpressions {
     readonly update: SimDynamoDbUpdate;
     readonly condition: SimDynamoDbCondition | undefined;
+    /** The top-level attributes the expressions named, for `dynamodb:Attributes`. */
+    readonly attributes: readonly string[];
 }
 /**
  * Read both expressions of an update against one set of placeholders.

package/dist/service/dynamodb/command/item/sim-dynamodb-update-expressions.js

@@ -13,7 +13,7 @@ export function readSimDynamoDbUpdateExpressions(input, expression) {
     const update = parseSimDynamoDbUpdate(expression, parameters);
     const condition = conditionIn(input.ConditionExpression, parameters);
     parameters.assertAllUsed();
-    return { update, condition };
+    return { update, condition, attributes: parameters.attributes.topLevel };
 }
 /**
  * Read the condition guarding an update, if it names one.

package/dist/service/dynamodb/command/item/sim-dynamodb-update-item.js

@@ -1,4 +1,5 @@
 import { simDynamoDbLeadingKeysOf } from "../authorize/sim-dynamodb-leading-keys.js";
+import { simDynamoDbAttributesOf, simDynamoDbItemAttributeNames, } from "../authorize/sim-dynamodb-attributes.js";
 import { readSimDynamoDbKey } from "./sim-dynamodb-key-input.js";
 import { SimDynamoDbReturnValues } from "./sim-dynamodb-return-values.js";
 import { refuseUnsimulatedItemUpdateInput } from "./sim-dynamodb-unsimulated-item-update-input.js";
@@ -29,7 +30,12 @@ export class SimDynamoDbUpdateItem {
         // The expressions are read before the table is reached, so one DynamoDB
         // would refuse is refused whether or not the key holds anything.
         const plan = SimDynamoDbUpdatePlan.read(input, "UpdateItem");
-        const table = this.access.required("dynamodb:UpdateItem", input.TableName, options?.caller, simDynamoDbLeadingKeysOf(() => [readSimDynamoDbKey(input.Key)]));
+        const table = this.access.required("dynamodb:UpdateItem", input.TableName, options?.caller, {
+            leadingKeys: simDynamoDbLeadingKeysOf(() => [
+                readSimDynamoDbKey(input.Key),
+            ]),
+            attributes: simDynamoDbAttributesOf(plan.attributeNames, simDynamoDbItemAttributeNames(() => [readSimDynamoDbKey(input.Key)])),
+        });
         const asked = SimDynamoDbReturnValues.readForUpdate(input.ReturnValues, "UpdateItem");
         const key = readSimDynamoDbKey(input.Key);
         const existing = table.getItem(key);

package/dist/service/dynamodb/command/item/sim-dynamodb-update-plan.d.ts

@@ -1,4 +1,4 @@
-import { SimDynamoDbProjection } from "../../expression/projection/sim-dynamodb-projection.js";
+import type { SimDynamoDbProjection } from "../../expression/projection/sim-dynamodb-projection.js";
 import type { SimDynamoDbItem } from "../../item/sim-dynamodb-item.js";
 import { SimDynamoDbConditionCheck } from "./sim-dynamodb-condition-check.js";
 import { type SimDynamoDbUpdateExpressionInput } from "./sim-dynamodb-update-expressions.js";
@@ -10,6 +10,12 @@ interface SimDynamoDbUpdatePlanInput extends SimDynamoDbUpdateExpressionInput {
  */
 export declare class SimDynamoDbUpdatePlan {
     readonly check: SimDynamoDbConditionCheck;
+    /**
+     * The top-level attributes both expressions named, for
+     * `dynamodb:Attributes`. They share one set of placeholders, so the update
+     * and the condition guarding it are gathered together.
+     */
+    readonly attributeNames: readonly string[];
     private readonly update;
     private constructor();
     /**
@@ -24,11 +30,7 @@ export declare class SimDynamoDbUpdatePlan {
      */
     assertLeavesKeyAlone(keyAttributeNames: readonly string[]): void;
     /**
-     * The parts of an item this update touched, for the reporting modes that
-     * answer with those and nothing else.
-     *
-     * A request that says nothing to change touched nothing, so the projection it
-     * answers with finds nothing in either item.
+     * The parts of an item this update touched.
      */
     touched(): SimDynamoDbProjection;
     /**

package/dist/service/dynamodb/command/item/sim-dynamodb-update-plan.js

@@ -1,5 +1,4 @@
-import { SimDynamoDbProjection } from "../../expression/projection/sim-dynamodb-projection.js";
-import { updateExpressionName } from "../../expression/update/sim-dynamodb-update-refusal.js";
+import { simDynamoDbTouchedBy } from "./sim-dynamodb-update-touched.js";
 import { SimDynamoDbConditionCheck } from "./sim-dynamodb-condition-check.js";
 import { readSimDynamoDbUpdateExpressions, } from "./sim-dynamodb-update-expressions.js";
 /**
@@ -7,10 +6,17 @@ import { readSimDynamoDbUpdateExpressions, } from "./sim-dynamodb-update-express
  */
 export class SimDynamoDbUpdatePlan {
     check;
+    /**
+     * The top-level attributes both expressions named, for
+     * `dynamodb:Attributes`. They share one set of placeholders, so the update
+     * and the condition guarding it are gathered together.
+     */
+    attributeNames;
     update;
     constructor(properties) {
         this.update = properties.update;
         this.check = properties.check;
+        this.attributeNames = properties.attributeNames;
     }
     /**
      * Read the expressions a request carries, before anything is looked up.
@@ -21,15 +27,18 @@ export class SimDynamoDbUpdatePlan {
     static read(input, operation) {
         const expression = input.UpdateExpression;
         if (expression === undefined) {
+            const check = SimDynamoDbConditionCheck.read(input, operation);
             return new this({
                 update: undefined,
-                check: SimDynamoDbConditionCheck.read(input, operation),
+                check,
+                attributeNames: check.attributeNames,
             });
         }
         const read = readSimDynamoDbUpdateExpressions(input, expression);
         return new this({
             update: read.update,
             check: SimDynamoDbConditionCheck.of(read.condition, input, operation),
+            attributeNames: read.attributes,
         });
     }
     /**
@@ -39,18 +48,10 @@ export class SimDynamoDbUpdatePlan {
         this.update?.assertLeavesKeyAlone(keyAttributeNames);
     }
     /**
-     * The parts of an item this update touched, for the reporting modes that
-     * answer with those and nothing else.
-     *
-     * A request that says nothing to change touched nothing, so the projection it
-     * answers with finds nothing in either item.
+     * The parts of an item this update touched.
      */
     touched() {
-        return (this.update?.touched() ??
-            new SimDynamoDbProjection({
-                expressionName: updateExpressionName,
-                paths: [],
-            }));
+        return simDynamoDbTouchedBy(this.update);
     }
     /**
      * The item this update makes of the one that was there.

package/dist/service/dynamodb/command/item/sim-dynamodb-update-touched.d.ts

@@ -0,0 +1,10 @@
+import { SimDynamoDbProjection } from "../../expression/projection/sim-dynamodb-projection.js";
+import type { SimDynamoDbUpdate } from "../../expression/update/sim-dynamodb-update.js";
+/**
+ * The parts of an item an update touched, for the reporting modes that answer
+ * with those and nothing else.
+ *
+ * A request that says nothing to change touched nothing, so the projection it
+ * answers with finds nothing in either item.
+ */
+export declare function simDynamoDbTouchedBy(update: SimDynamoDbUpdate | undefined): SimDynamoDbProjection;

package/dist/service/dynamodb/command/item/sim-dynamodb-update-touched.js

@@ -0,0 +1,16 @@
+import { SimDynamoDbProjection } from "../../expression/projection/sim-dynamodb-projection.js";
+import { updateExpressionName } from "../../expression/update/sim-dynamodb-update-refusal.js";
+/**
+ * The parts of an item an update touched, for the reporting modes that answer
+ * with those and nothing else.
+ *
+ * A request that says nothing to change touched nothing, so the projection it
+ * answers with finds nothing in either item.
+ */
+export function simDynamoDbTouchedBy(update) {
+    return (update?.touched() ??
+        new SimDynamoDbProjection({
+            expressionName: updateExpressionName,
+            paths: [],
+        }));
+}

package/dist/service/dynamodb/command/query/sim-dynamodb-query-expressions.d.ts

@@ -9,6 +9,8 @@ export interface SimDynamoDbQueryExpressions {
     readonly terms: SimDynamoDbKeyConditionTerms;
     readonly filter: SimDynamoDbFilter | undefined;
     readonly projection: SimDynamoDbProjection | undefined;
+    /** The top-level attributes the expressions named, for `dynamodb:Attributes`. */
+    readonly attributes: readonly string[];
 }
 /**
  * Read every expression of a query against one set of placeholders.

package/dist/service/dynamodb/command/query/sim-dynamodb-query-expressions.js

@@ -21,7 +21,12 @@ export function readSimDynamoDbQueryExpressions(input) {
     const filter = filterIn(input.FilterExpression, parameters);
     const projection = projectionIn(input.ProjectionExpression, parameters);
     parameters.assertAllUsed();
-    return { terms, filter, projection };
+    return {
+        terms,
+        filter,
+        projection,
+        attributes: parameters.attributes.topLevel,
+    };
 }
 /**
  * Read the filter a query drops read items by, if it names one.