@kensio/yulin 1.21.13 → 1.21.14

package/dist/service/dynamodb/command/query/sim-dynamodb-query.js

@@ -34,8 +34,11 @@ export class SimDynamoDbQuery {
         // The one partition key the query reads is what authorization needs, and
         // reading it needs the view rather than the table, so it is read again
         // here against whichever of the two the request names.
-        const table = this.access.required("dynamodb:Query", input.TableName, options?.caller, (reached) => simDynamoDbLeadingKeyOf(expressions.terms.forTable(reached.view(input.IndexName))
-            .partitionKeyValue));
+        const table = this.access.required("dynamodb:Query", input.TableName, options?.caller, {
+            leadingKeys: (reached) => simDynamoDbLeadingKeyOf(expressions.terms.forTable(reached.view(input.IndexName))
+                .partitionKeyValue),
+            attributes: expressions.attributes,
+        });
         // What is being read is settled here: the table, or one of its indexes. An
         // IndexName the table does not have is refused rather than read as the
         // table. Everything after this asks the view rather than the table, so a

package/dist/service/dynamodb/command/scan/sim-dynamodb-scan-expressions.d.ts

@@ -7,6 +7,8 @@ import type { SimScanCommandInput } from "./scan.command.js";
 export interface SimDynamoDbScanExpressions {
     readonly filter: SimDynamoDbFilter | undefined;
     readonly projection: SimDynamoDbProjection | undefined;
+    /** The top-level attributes the expressions named, for `dynamodb:Attributes`. */
+    readonly attributes: readonly string[];
 }
 /**
  * Read both expressions of a scan against one set of placeholders.

package/dist/service/dynamodb/command/scan/sim-dynamodb-scan-expressions.js

@@ -22,13 +22,13 @@ export function readSimDynamoDbScanExpressions(input) {
     if (input.FilterExpression === undefined &&
         input.ProjectionExpression === undefined) {
         SimDynamoDbExpressionParameters.assertNoneWithout(input);
-        return { filter: undefined, projection: undefined };
+        return { filter: undefined, projection: undefined, attributes: [] };
     }
     const parameters = new SimDynamoDbExpressionParameters(input);
     const filter = filterIn(input.FilterExpression, parameters);
     const projection = projectionIn(input.ProjectionExpression, parameters);
     parameters.assertAllUsed();
-    return { filter, projection };
+    return { filter, projection, attributes: parameters.attributes.topLevel };
 }
 /**
  * Read the filter a scan drops read items by, if it names one.

package/dist/service/dynamodb/command/scan/sim-dynamodb-scan.js

@@ -39,7 +39,7 @@ export class SimDynamoDbScan {
         // attribute, including a key attribute, and needs no key schema to check.
         const segment = readSimDynamoDbScanSegment(input);
         const expressions = readSimDynamoDbScanExpressions(input);
-        const table = this.access.required("dynamodb:Scan", input.TableName, options?.caller);
+        const table = this.access.required("dynamodb:Scan", input.TableName, options?.caller, { attributes: expressions.attributes });
         // What is being read is settled here: the table, or one of its indexes.
         const view = table.view(input.IndexName);
         const scan = view.scan();

package/dist/service/dynamodb/command/table/sim-dynamodb-table-access.d.ts

@@ -4,7 +4,7 @@ import type { SimDynamoDbTable } from "../../table/sim-dynamodb-table.js";
 import type { SimDynamoDbTableName } from "../../table/sim-dynamodb-table-name.js";
 import type { SimDynamoDbTableStore } from "../../table/sim-dynamodb-table-store.js";
 import type { SimDynamoDbAuthorizer } from "../authorize/sim-dynamodb-authorizer.js";
-import type { SimDynamoDbLeadingKeys } from "../authorize/sim-dynamodb-leading-keys.js";
+import type { SimDynamoDbTableReach } from "./sim-dynamodb-table-reach.js";
 interface SimDynamoDbTableAccessProperties {
     readonly tables: SimDynamoDbTableStore;
     readonly authorizer: SimDynamoDbAuthorizer;
@@ -36,7 +36,7 @@ export declare class SimDynamoDbTableAccess {
     /**
      * Find the table a request names, refusing the caller before answering.
      */
-    required(action: string, tableName: string | undefined, caller: SimAwsCaller | undefined, leadingKeys?: SimDynamoDbLeadingKeys): SimDynamoDbTable;
+    required(action: string, tableName: string | undefined, caller: SimAwsCaller | undefined, reach?: SimDynamoDbTableReach): SimDynamoDbTable;
     /**
      * Find a table by a name that has already been read.
      *
@@ -44,7 +44,7 @@ export declare class SimDynamoDbTableAccess {
      * there, which keeps an unauthorized caller from finding out which table
      * names are taken.
      */
-    requiredByName(action: string, name: SimDynamoDbTableName, caller: SimAwsCaller | undefined, leadingKeys?: SimDynamoDbLeadingKeys): SimDynamoDbTable;
+    requiredByName(action: string, name: SimDynamoDbTableName, caller: SimAwsCaller | undefined, reach?: SimDynamoDbTableReach): SimDynamoDbTable;
     /**
      * Ensure the caller may perform an action that names no particular table.
      */

package/dist/service/dynamodb/command/table/sim-dynamodb-table-access.js

@@ -1,22 +1,6 @@
 import { SimDynamoDbResourceNotFoundException } from "../../error/dynamodb.error.js";
 import { readSimDynamoDbTableReference } from "../../table/sim-dynamodb-table-reference.js";
-/**
- * Read the partition key values a request reaches, or none where they cannot
- * be read.
- *
- * Authorization runs ahead of the checks a command makes on what it was given,
- * as it does on AWS. A request whose key or key condition is malformed is
- * authorized carrying no values and refused by the check that follows, so
- * whatever reading them throws is dropped here.
- */
-function readLeadingKeys(leadingKeys, table) {
-    try {
-        return leadingKeys?.(table);
-    }
-    catch {
-        return undefined;
-    }
-}
+import { simDynamoDbReachedIn } from "./sim-dynamodb-table-reach.js";
 /**
  * How a command reaches the table a request names.
  *
@@ -49,8 +33,8 @@ export class SimDynamoDbTableAccess {
     /**
      * Find the table a request names, refusing the caller before answering.
      */
-    required(action, tableName, caller, leadingKeys) {
-        return this.requiredByName(action, this.reference(tableName), caller, leadingKeys);
+    required(action, tableName, caller, reach = {}) {
+        return this.requiredByName(action, this.reference(tableName), caller, reach);
     }
     /**
      * Find a table by a name that has already been read.
@@ -59,9 +43,9 @@ export class SimDynamoDbTableAccess {
      * there, which keeps an unauthorized caller from finding out which table
      * names are taken.
      */
-    requiredByName(action, name, caller, leadingKeys) {
+    requiredByName(action, name, caller, reach = {}) {
         const table = this.tables.find(name);
-        this.authorizer.authorizeTable(action, name.value, caller, table === undefined ? undefined : readLeadingKeys(leadingKeys, table));
+        this.authorizer.authorizeTable(action, name.value, caller, simDynamoDbReachedIn(reach, table));
         if (table === undefined) {
             throw new SimDynamoDbResourceNotFoundException(`No DynamoDB Table named ${name.value}`);
         }

package/dist/service/dynamodb/command/table/sim-dynamodb-table-reach.d.ts

@@ -0,0 +1,25 @@
+import type { SimDynamoDbReached } from "../authorize/sim-dynamodb-reached.js";
+import type { SimDynamoDbLeadingKeys } from "../authorize/sim-dynamodb-leading-keys.js";
+import type { SimDynamoDbTable } from "../../table/sim-dynamodb-table.js";
+/**
+ * What one command's request reaches, for the condition keys authorization
+ * supplies.
+ *
+ * The partition key values need the table to read them, so they arrive as a
+ * function of it. The attribute names are read from the request's own
+ * parameters before the table is reached, so they arrive as they are.
+ */
+export interface SimDynamoDbTableReach {
+    readonly leadingKeys?: SimDynamoDbLeadingKeys | undefined;
+    readonly attributes?: readonly string[] | undefined;
+}
+/**
+ * Resolve what a request reaches against the table it named.
+ *
+ * Authorization runs ahead of the checks a command makes on what it was given,
+ * as it does on AWS. A request whose key or key condition is malformed is
+ * authorized carrying no values and refused by the check that follows, so
+ * whatever reading them throws is dropped here. A table that is not there
+ * leaves the values unread, since the key schema is what reads them.
+ */
+export declare function simDynamoDbReachedIn(reach: SimDynamoDbTableReach, table: SimDynamoDbTable | undefined): SimDynamoDbReached;

package/dist/service/dynamodb/command/table/sim-dynamodb-table-reach.js

@@ -0,0 +1,27 @@
+/**
+ * Resolve what a request reaches against the table it named.
+ *
+ * Authorization runs ahead of the checks a command makes on what it was given,
+ * as it does on AWS. A request whose key or key condition is malformed is
+ * authorized carrying no values and refused by the check that follows, so
+ * whatever reading them throws is dropped here. A table that is not there
+ * leaves the values unread, since the key schema is what reads them.
+ */
+export function simDynamoDbReachedIn(reach, table) {
+    return {
+        leadingKeys: table === undefined ? undefined : leadingKeysIn(reach, table),
+        attributes: reach.attributes,
+    };
+}
+/**
+ * Read the partition key values a request reaches, or none where they cannot
+ * be read.
+ */
+function leadingKeysIn(reach, table) {
+    try {
+        return reach.leadingKeys?.(table);
+    }
+    catch {
+        return undefined;
+    }
+}

package/dist/service/dynamodb/command/transact/sim-dynamodb-transact-gets.js

@@ -23,7 +23,7 @@ export class SimDynamoDbTransactRead {
      * Read the Get one action of a transactional read carries.
      */
     static of(request) {
-        return new this(request.TableName, readSimDynamoDbKey(request.Key), readSimDynamoDbProjection(request));
+        return new this(request.TableName, readSimDynamoDbKey(request.Key), readSimDynamoDbProjection(request).projection);
     }
     /**
      * The primary key this Get reads, as the table marshals it.

package/dist/service/dynamodb/expression/condition/sim-dynamodb-condition-expression.d.ts

@@ -4,13 +4,21 @@ import type { SimDynamoDbCondition } from "./sim-dynamodb-condition.js";
 interface SimDynamoDbConditionRequest extends SimDynamoDbExpressionParameterInput {
     readonly ConditionExpression?: string | undefined;
 }
+/**
+ * What a request's ConditionExpression said, once it has been read.
+ */
+export interface SimDynamoDbConditionRead {
+    readonly condition: SimDynamoDbCondition | undefined;
+    /** The top-level attributes the expression named, for `dynamodb:Attributes`. */
+    readonly attributes: readonly string[];
+}
 /**
  * Read the condition a write is guarded by, if it names one.
  *
  * A request with no ConditionExpression is an unconditional write, so there is
  * nothing to check.
  */
-export declare function readSimDynamoDbCondition(request: SimDynamoDbConditionRequest): SimDynamoDbCondition | undefined;
+export declare function readSimDynamoDbCondition(request: SimDynamoDbConditionRequest): SimDynamoDbConditionRead;
 /**
  * Read one ConditionExpression against placeholders that have already been
  * gathered.

package/dist/service/dynamodb/expression/condition/sim-dynamodb-condition-expression.js

@@ -11,12 +11,12 @@ export function readSimDynamoDbCondition(request) {
     const expression = request.ConditionExpression;
     if (expression === undefined) {
         SimDynamoDbExpressionParameters.assertNoneWithout(request);
-        return undefined;
+        return { condition: undefined, attributes: [] };
     }
     const parameters = new SimDynamoDbExpressionParameters(request);
     const condition = parseSimDynamoDbCondition(expression, parameters);
     parameters.assertAllUsed();
-    return condition;
+    return { condition, attributes: parameters.attributes.topLevel };
 }
 /**
  * Read one ConditionExpression against placeholders that have already been

package/dist/service/dynamodb/expression/condition/sim-dynamodb-condition-grammar.js

@@ -10,7 +10,7 @@ import { SimDynamoDbConditionParser } from "./sim-dynamodb-condition-parser.js";
 export function simDynamoDbConditionParser(expressionName, expression, parameters) {
     return new SimDynamoDbConditionParser({
         tokens: SimDynamoDbExpressionTokens.of(expressionName, expression, "the expression says nothing, and an expression cannot be empty"),
-        names: parameters.names,
+        attributes: parameters.attributes,
         values: parameters.values,
     });
 }

package/dist/service/dynamodb/expression/condition/sim-dynamodb-condition-operand-parser.d.ts

@@ -1,11 +1,12 @@
 import type { SimDynamoDbValue } from "../../item/sim-dynamodb-value.js";
 import type { SimDynamoDbDocumentPath } from "../sim-dynamodb-document-path.js";
+import type { SimDynamoDbExpressionAttributes } from "../sim-dynamodb-expression-attributes.js";
 import type { SimDynamoDbExpressionPlaceholders } from "../sim-dynamodb-expression-placeholders.js";
 import type { SimDynamoDbExpressionTokens } from "../sim-dynamodb-expression-tokens.js";
 import { type SimDynamoDbConditionOperand, SimDynamoDbPathOperand } from "./sim-dynamodb-condition-operand.js";
 interface SimDynamoDbConditionOperandParserProperties {
     readonly tokens: SimDynamoDbExpressionTokens;
-    readonly names: SimDynamoDbExpressionPlaceholders<string>;
+    readonly attributes: SimDynamoDbExpressionAttributes;
     readonly values: SimDynamoDbExpressionPlaceholders<SimDynamoDbValue>;
 }
 /**
@@ -17,7 +18,7 @@ interface SimDynamoDbConditionOperandParserProperties {
  */
 export declare class SimDynamoDbConditionOperandParser {
     private readonly tokens;
-    private readonly names;
+    private readonly attributes;
     private readonly values;
     private readonly read;
     constructor(properties: SimDynamoDbConditionOperandParserProperties);

package/dist/service/dynamodb/expression/condition/sim-dynamodb-condition-operand-parser.js

@@ -15,12 +15,12 @@ const sizeFunctionName = "size";
  */
 export class SimDynamoDbConditionOperandParser {
     tokens;
-    names;
+    attributes;
     values;
     read = [];
     constructor(properties) {
         this.tokens = properties.tokens;
-        this.names = properties.names;
+        this.attributes = properties.attributes;
         this.values = properties.values;
     }
     /**
@@ -87,7 +87,7 @@ export class SimDynamoDbConditionOperandParser {
     path() {
         const path = new SimDynamoDbDocumentPathParser({
             tokens: this.tokens,
-            names: this.names,
+            attributes: this.attributes,
         }).parse();
         this.read.push(path);
         return new SimDynamoDbPathOperand(path);

package/dist/service/dynamodb/expression/condition/sim-dynamodb-condition-parser.d.ts

@@ -1,11 +1,12 @@
 import type { SimDynamoDbValue } from "../../item/sim-dynamodb-value.js";
 import type { SimDynamoDbDocumentPath } from "../sim-dynamodb-document-path.js";
+import type { SimDynamoDbExpressionAttributes } from "../sim-dynamodb-expression-attributes.js";
 import type { SimDynamoDbExpressionPlaceholders } from "../sim-dynamodb-expression-placeholders.js";
 import type { SimDynamoDbExpressionTokens } from "../sim-dynamodb-expression-tokens.js";
 import { type SimDynamoDbCondition } from "./sim-dynamodb-condition.js";
 interface SimDynamoDbConditionParserProperties {
     readonly tokens: SimDynamoDbExpressionTokens;
-    readonly names: SimDynamoDbExpressionPlaceholders<string>;
+    readonly attributes: SimDynamoDbExpressionAttributes;
     readonly values: SimDynamoDbExpressionPlaceholders<SimDynamoDbValue>;
 }
 /**

package/dist/service/dynamodb/expression/condition/sim-dynamodb-condition-parser.js

@@ -21,7 +21,7 @@ export class SimDynamoDbConditionParser {
     constructor(properties) {
         const operands = new SimDynamoDbConditionOperandParser({
             tokens: properties.tokens,
-            names: properties.names,
+            attributes: properties.attributes,
             values: properties.values,
         });
         this.tokens = properties.tokens;

package/dist/service/dynamodb/expression/key-condition/sim-dynamodb-key-condition-expression.js

@@ -22,7 +22,7 @@ export function readSimDynamoDbKeyCondition(request, parameters) {
     }
     const terms = new SimDynamoDbKeyConditionParser({
         tokens: SimDynamoDbExpressionTokens.of(keyConditionExpressionName, expression, "the expression says nothing, and an expression cannot be empty"),
-        names: parameters.names,
+        attributes: parameters.attributes,
         values: parameters.values,
     }).parse();
     return new SimDynamoDbKeyConditionTerms(terms);

package/dist/service/dynamodb/expression/key-condition/sim-dynamodb-key-condition-operands.d.ts

@@ -1,10 +1,11 @@
 import type { SimDynamoDbValue } from "../../item/sim-dynamodb-value.js";
+import type { SimDynamoDbExpressionAttributes } from "../sim-dynamodb-expression-attributes.js";
 import type { SimDynamoDbExpressionPlaceholders } from "../sim-dynamodb-expression-placeholders.js";
 import type { SimDynamoDbExpressionTokens } from "../sim-dynamodb-expression-tokens.js";
 import { type SimDynamoDbKeyConditionRefusals } from "./sim-dynamodb-key-condition-refusals.js";
 interface SimDynamoDbKeyConditionOperandsProperties {
     readonly tokens: SimDynamoDbExpressionTokens;
-    readonly names: SimDynamoDbExpressionPlaceholders<string>;
+    readonly attributes: SimDynamoDbExpressionAttributes;
     readonly values: SimDynamoDbExpressionPlaceholders<SimDynamoDbValue>;
     readonly refusals: SimDynamoDbKeyConditionRefusals;
 }
@@ -17,7 +18,7 @@ interface SimDynamoDbKeyConditionOperandsProperties {
  */
 export declare class SimDynamoDbKeyConditionOperands {
     private readonly tokens;
-    private readonly names;
+    private readonly attributes;
     private readonly values;
     private readonly refusals;
     constructor(properties: SimDynamoDbKeyConditionOperandsProperties);

package/dist/service/dynamodb/expression/key-condition/sim-dynamodb-key-condition-operands.js

@@ -22,12 +22,12 @@ const keyComparators = new Set([
  */
 export class SimDynamoDbKeyConditionOperands {
     tokens;
-    names;
+    attributes;
     values;
     refusals;
     constructor(properties) {
         this.tokens = properties.tokens;
-        this.names = properties.names;
+        this.attributes = properties.attributes;
         this.values = properties.values;
         this.refusals = properties.refusals;
     }
@@ -77,9 +77,11 @@ export class SimDynamoDbKeyConditionOperands {
      * The attribute a name token stands for, which may be a placeholder.
      */
     nameOf(kind, text) {
-        if (kind === "name") {
-            return text;
-        }
-        return this.names.required(text);
+        const name = kind === "name" ? text : this.attributes.required(text);
+        // A key condition reads no document paths, so the attributes it reaches
+        // are noted here rather than by the path parser. A key is scalar, and the
+        // attribute a term names is always a top-level one.
+        this.attributes.reach(name);
+        return name;
     }
 }

package/dist/service/dynamodb/expression/key-condition/sim-dynamodb-key-condition-parser.d.ts

@@ -1,10 +1,11 @@
 import type { SimDynamoDbValue } from "../../item/sim-dynamodb-value.js";
+import type { SimDynamoDbExpressionAttributes } from "../sim-dynamodb-expression-attributes.js";
 import type { SimDynamoDbExpressionPlaceholders } from "../sim-dynamodb-expression-placeholders.js";
 import type { SimDynamoDbExpressionTokens } from "../sim-dynamodb-expression-tokens.js";
 import type { SimDynamoDbKeyConditionTerm } from "./sim-dynamodb-key-condition-term.js";
 interface SimDynamoDbKeyConditionParserProperties {
     readonly tokens: SimDynamoDbExpressionTokens;
-    readonly names: SimDynamoDbExpressionPlaceholders<string>;
+    readonly attributes: SimDynamoDbExpressionAttributes;
     readonly values: SimDynamoDbExpressionPlaceholders<SimDynamoDbValue>;
 }
 /**

package/dist/service/dynamodb/expression/key-condition/sim-dynamodb-key-condition-parser.js

@@ -27,7 +27,7 @@ export class SimDynamoDbKeyConditionParser {
         this.refusals = refusals;
         this.operands = new SimDynamoDbKeyConditionOperands({
             tokens: properties.tokens,
-            names: properties.names,
+            attributes: properties.attributes,
             values: properties.values,
             refusals,
         });

package/dist/service/dynamodb/expression/projection/sim-dynamodb-projection-expression.d.ts

@@ -4,6 +4,14 @@ import { SimDynamoDbProjection } from "./sim-dynamodb-projection.js";
 interface SimDynamoDbProjectionRequest extends SimDynamoDbExpressionParameterInput {
     readonly ProjectionExpression?: string | undefined;
 }
+/**
+ * What a request's ProjectionExpression said, once it has been read.
+ */
+export interface SimDynamoDbProjectionRead {
+    readonly projection: SimDynamoDbProjection | undefined;
+    /** The top-level attributes the expression named, for `dynamodb:Attributes`. */
+    readonly attributes: readonly string[];
+}
 /**
  * Read the projection a request asks for, if it asks for one.
  *
@@ -15,7 +23,7 @@ interface SimDynamoDbProjectionRequest extends SimDynamoDbExpressionParameterInp
  * carry a filter alongside its projection, and reads both against one set of
  * placeholders through `parseSimDynamoDbProjection`.
  */
-export declare function readSimDynamoDbProjection(request: SimDynamoDbProjectionRequest): SimDynamoDbProjection | undefined;
+export declare function readSimDynamoDbProjection(request: SimDynamoDbProjectionRequest): SimDynamoDbProjectionRead;
 /**
  * Read one ProjectionExpression against placeholders that have already been
  * gathered.

package/dist/service/dynamodb/expression/projection/sim-dynamodb-projection-expression.js

@@ -19,12 +19,12 @@ export function readSimDynamoDbProjection(request) {
     const expression = request.ProjectionExpression;
     if (expression === undefined) {
         SimDynamoDbExpressionParameters.assertNoneWithout(request);
-        return undefined;
+        return { projection: undefined, attributes: [] };
     }
     const parameters = new SimDynamoDbExpressionParameters(request);
     const projection = parseSimDynamoDbProjection(expression, parameters);
     parameters.assertAllUsed();
-    return projection;
+    return { projection, attributes: parameters.attributes.topLevel };
 }
 /**
  * Read one ProjectionExpression against placeholders that have already been
@@ -35,16 +35,16 @@ export function readSimDynamoDbProjection(request) {
  * placeholders are checked once every expression has been read.
  */
 export function parseSimDynamoDbProjection(expression, parameters) {
-    const paths = projectedPaths(SimDynamoDbExpressionTokens.of(expressionName, expression, "the expression names no attributes, and an expression cannot be empty"), parameters.names);
+    const paths = projectedPaths(SimDynamoDbExpressionTokens.of(expressionName, expression, "the expression names no attributes, and an expression cannot be empty"), parameters.attributes);
     return new SimDynamoDbProjection({ expressionName, paths });
 }
 /**
  * Read the comma-separated document paths a ProjectionExpression names.
  */
-function projectedPaths(tokens, names) {
+function projectedPaths(tokens, attributes) {
     const paths = [];
     do {
-        paths.push(new SimDynamoDbDocumentPathParser({ tokens, names }).parse());
+        paths.push(new SimDynamoDbDocumentPathParser({ tokens, attributes }).parse());
     } while (tokens.takeSymbol(","));
     assertReadToEnd(tokens);
     return paths;

package/dist/service/dynamodb/expression/sim-dynamodb-document-path-parser.d.ts

@@ -1,9 +1,9 @@
 import { SimDynamoDbDocumentPath } from "./sim-dynamodb-document-path.js";
-import type { SimDynamoDbExpressionPlaceholders } from "./sim-dynamodb-expression-placeholders.js";
+import type { SimDynamoDbExpressionAttributes } from "./sim-dynamodb-expression-attributes.js";
 import type { SimDynamoDbExpressionTokens } from "./sim-dynamodb-expression-tokens.js";
 interface SimDynamoDbDocumentPathParserProperties {
     readonly tokens: SimDynamoDbExpressionTokens;
-    readonly names: SimDynamoDbExpressionPlaceholders<string>;
+    readonly attributes: SimDynamoDbExpressionAttributes;
 }
 /**
  * Reads one document path out of an expression.
@@ -15,7 +15,7 @@ interface SimDynamoDbDocumentPathParserProperties {
  */
 export declare class SimDynamoDbDocumentPathParser {
     private readonly tokens;
-    private readonly names;
+    private readonly attributes;
     private readonly segments;
     constructor(properties: SimDynamoDbDocumentPathParserProperties);
     /**

package/dist/service/dynamodb/expression/sim-dynamodb-document-path-parser.js

@@ -14,17 +14,21 @@ const greatestDepth = 32;
  */
 export class SimDynamoDbDocumentPathParser {
     tokens;
-    names;
+    attributes;
     segments = [];
     constructor(properties) {
         this.tokens = properties.tokens;
-        this.names = properties.names;
+        this.attributes = properties.attributes;
     }
     /**
      * Read a path, from its first attribute to the last thing it dereferences.
      */
     parse() {
-        this.segments.push(this.attribute());
+        const first = this.attribute();
+        // The path starts here, so this is the top-level attribute it reaches.
+        // Whatever it dereferences afterwards is inside this one.
+        this.attributes.reach(first.name);
+        this.segments.push(first);
         while (this.continues()) {
             this.assertWithinDepth();
         }
@@ -54,7 +58,7 @@ export class SimDynamoDbDocumentPathParser {
             return { kind: "attribute", name: token.text };
         }
         if (token.kind === "namePlaceholder") {
-            return { kind: "attribute", name: this.names.required(token.text) };
+            return { kind: "attribute", name: this.attributes.required(token.text) };
         }
         throw this.tokens.error(`syntax error; an attribute name was expected${this.after()}, but ` +
             `'${token.text}' was given`);

package/dist/service/dynamodb/expression/sim-dynamodb-expression-attributes.d.ts

@@ -0,0 +1,33 @@
+import type { SimDynamoDbExpressionPlaceholders } from "./sim-dynamodb-expression-placeholders.js";
+/**
+ * The attribute names one request's expressions reach.
+ *
+ * Every expression kind names attributes the same way, either outright or
+ * behind a `#` placeholder, and every one of them reads those names through
+ * here. Noting the names as they are read is what lets a request say which
+ * attributes it names, which is what `dynamodb:Attributes` asks about.
+ *
+ * Only the attribute a document path starts at is noted. AWS counts a
+ * top-level attribute as reached where the request names it or anything nested
+ * inside it, so `Address.City` reaches `Address`.
+ */
+export declare class SimDynamoDbExpressionAttributes {
+    private readonly placeholders;
+    private readonly reached;
+    constructor(placeholders: SimDynamoDbExpressionPlaceholders<string>);
+    /**
+     * What a placeholder stands for, refusing one the request never defined.
+     *
+     * Resolving a placeholder says nothing about where in a path it sits, so
+     * nothing is noted here.
+     */
+    required(placeholder: string): string;
+    /**
+     * Note a top-level attribute an expression named.
+     */
+    reach(name: string): void;
+    /**
+     * The top-level attributes every expression of the request named.
+     */
+    get topLevel(): readonly string[];
+}

package/dist/service/dynamodb/expression/sim-dynamodb-expression-attributes.js

@@ -0,0 +1,40 @@
+/**
+ * The attribute names one request's expressions reach.
+ *
+ * Every expression kind names attributes the same way, either outright or
+ * behind a `#` placeholder, and every one of them reads those names through
+ * here. Noting the names as they are read is what lets a request say which
+ * attributes it names, which is what `dynamodb:Attributes` asks about.
+ *
+ * Only the attribute a document path starts at is noted. AWS counts a
+ * top-level attribute as reached where the request names it or anything nested
+ * inside it, so `Address.City` reaches `Address`.
+ */
+export class SimDynamoDbExpressionAttributes {
+    placeholders;
+    reached = new Set();
+    constructor(placeholders) {
+        this.placeholders = placeholders;
+    }
+    /**
+     * What a placeholder stands for, refusing one the request never defined.
+     *
+     * Resolving a placeholder says nothing about where in a path it sits, so
+     * nothing is noted here.
+     */
+    required(placeholder) {
+        return this.placeholders.required(placeholder);
+    }
+    /**
+     * Note a top-level attribute an expression named.
+     */
+    reach(name) {
+        this.reached.add(name);
+    }
+    /**
+     * The top-level attributes every expression of the request named.
+     */
+    get topLevel() {
+        return [...this.reached];
+    }
+}

package/dist/service/dynamodb/expression/sim-dynamodb-expression-parameters.d.ts

@@ -1,5 +1,6 @@
 import type { SimDynamoDbAttributeValue } from "../command/item/item.types.js";
 import type { SimDynamoDbValue } from "../item/sim-dynamodb-value.js";
+import { SimDynamoDbExpressionAttributes } from "./sim-dynamodb-expression-attributes.js";
 import { SimDynamoDbExpressionPlaceholders } from "./sim-dynamodb-expression-placeholders.js";
 /**
  * The two placeholder parameters a request can carry for its expressions.
@@ -19,6 +20,11 @@ export interface SimDynamoDbExpressionParameterInput {
 export declare class SimDynamoDbExpressionParameters {
     readonly names: SimDynamoDbExpressionPlaceholders<string>;
     readonly values: SimDynamoDbExpressionPlaceholders<SimDynamoDbValue>;
+    /**
+     * The attribute names the request's expressions reach, gathered as they are
+     * read. Authorization asks for these as `dynamodb:Attributes`.
+     */
+    readonly attributes: SimDynamoDbExpressionAttributes;
     constructor(input: SimDynamoDbExpressionParameterInput);
     /**
      * Refuse placeholders defined for an expression the request does not carry.

package/dist/service/dynamodb/expression/sim-dynamodb-expression-parameters.js

@@ -1,5 +1,6 @@
 import { SimDynamoDbValidationException } from "../error/dynamodb.error.js";
 import { readSimDynamoDbValue } from "../item/sim-dynamodb-value-reader.js";
+import { SimDynamoDbExpressionAttributes } from "./sim-dynamodb-expression-attributes.js";
 import { SimDynamoDbExpressionPlaceholders } from "./sim-dynamodb-expression-placeholders.js";
 /**
  * The placeholders one request defines for its expressions.
@@ -12,12 +13,18 @@ import { SimDynamoDbExpressionPlaceholders } from "./sim-dynamodb-expression-pla
 export class SimDynamoDbExpressionParameters {
     names;
     values;
+    /**
+     * The attribute names the request's expressions reach, gathered as they are
+     * read. Authorization asks for these as `dynamodb:Attributes`.
+     */
+    attributes;
     constructor(input) {
         this.names = new SimDynamoDbExpressionPlaceholders({
             parameterName: "ExpressionAttributeNames",
             marker: "#",
             entries: input.ExpressionAttributeNames,
         });
+        this.attributes = new SimDynamoDbExpressionAttributes(this.names);
         this.values = new SimDynamoDbExpressionPlaceholders({
             parameterName: "ExpressionAttributeValues",
             marker: ":",