@kensio/yulin 1.21.4 → 1.21.6

package/dist/service/s3/sim-s3.d.ts

@@ -18,9 +18,25 @@ import type { SimS3MountFilesystemOptions } from "./mount/sim-s3-mount.type.js";
  */
 export declare class SimS3 extends SimS3Operations {
     private readonly bucketAccess;
+    private readonly bucketMaker;
     private readonly cfnFactory;
     private readonly sdkRouter;
     constructor(properties?: SimS3Properties);
+    /**
+     * Make a Bucket in this scope without a `CreateBucketCommand`, and so
+     * without a principal to authorize.
+     *
+     * This is for a Bucket real AWS has provisioned before the code under test
+     * runs, which nothing in the simulation is deploying. The CDK bootstrap
+     * staging Bucket is the one the simulator makes for itself: `cdk deploy`
+     * publishes assets into a Bucket the bootstrap stack created, and a
+     * deployment that had to create it would be charged permissions no real
+     * deployment needs.
+     *
+     * A name this scope cannot take is reported the way `CreateBucketCommand`
+     * reports it.
+     */
+    makeSimBucket(bucketName: SimS3BucketName | string): SimS3Bucket;
     /**
      * Change how many keys one page of an Object listing holds, which real S3
      * fixes at a thousand.

package/dist/service/s3/sim-s3.js

@@ -1,5 +1,6 @@
 import { SimS3GlobalRegistry } from "./sim-s3-global-registry.js";
 import { SimS3BucketAccess } from "./bucket/sim-s3-bucket-access.js";
+import { SimS3BucketMaker } from "./bucket/sim-s3-bucket-maker.js";
 import { SimS3CloudFormationResourceFactory } from "./cfn/sim-cfn-s3-resource-factory.js";
 import { simAwsAccountRegionScopeFactory } from "../aws/sim-aws-account-region-scope.factory.js";
 import { SimS3Commands } from "./sim-s3-commands.js";
@@ -16,6 +17,7 @@ import { SimS3SdkCommandRouter } from "./sdk/sim-s3-sdk-command-router.js";
  */
 export class SimS3 extends SimS3Operations {
     bucketAccess;
+    bucketMaker;
     cfnFactory = new SimS3CloudFormationResourceFactory(this);
     sdkRouter = new SimS3SdkCommandRouter(this);
     constructor(properties = {}) {
@@ -32,6 +34,29 @@ export class SimS3 extends SimS3Operations {
             accountRegionScope,
             s3GlobalRegistry,
         });
+        this.bucketMaker = new SimS3BucketMaker({
+            accountRegionScope,
+            buckets,
+            s3GlobalRegistry,
+            background: this.commands.background,
+        });
+    }
+    /**
+     * Make a Bucket in this scope without a `CreateBucketCommand`, and so
+     * without a principal to authorize.
+     *
+     * This is for a Bucket real AWS has provisioned before the code under test
+     * runs, which nothing in the simulation is deploying. The CDK bootstrap
+     * staging Bucket is the one the simulator makes for itself: `cdk deploy`
+     * publishes assets into a Bucket the bootstrap stack created, and a
+     * deployment that had to create it would be charged permissions no real
+     * deployment needs.
+     *
+     * A name this scope cannot take is reported the way `CreateBucketCommand`
+     * reports it.
+     */
+    makeSimBucket(bucketName) {
+        return this.bucketMaker.make(bucketName);
     }
     /**
      * Change how many keys one page of an Object listing holds, which real S3

package/docs/services/cloudformation/README.md

@@ -1055,8 +1055,15 @@ simulated CloudFront hostname, such as `e123example.cloudfront.net`.
 #### Values from a skipped Resource
 
 A Resource that was skipped, because its type is outside the simulation or because there is no
-simulated Resource to create at all, still answers both intrinsics. `Ref` returns the logical ID, and
-`Fn::GetAtt` returns the string `<logical ID>.<attribute name>`.
+simulated Resource to create at all, still answers both intrinsics.
+
+What `Ref` answers with follows how far the refusal got. A service that had already worked out the
+Resource's name answers with that name. That is the name real CloudFormation would have produced,
+and the simulation holds it whether or not the Resource behind it was created. Sim Lambda declining
+a function on its `Runtime` is the case to know about, and it covers CDK's own Python providers. A
+Resource refused before any name existed answers with the logical ID.
+
+`Fn::GetAtt` answers with the string `<logical ID>.<attribute name>` for either of them.
 
 ```typescript sim-cloudformation-skipped-resource-values
 /**
@@ -1071,28 +1078,31 @@ const stack = await simAws.cloudFormation().deployTemplate({
   stackName: "stand-in-stack",
   template: {
     Resources: {
-      AlarmRule: {
-        Type: "AWS::CloudWatch::Alarm",
+      SearchApi: {
+        Type: "AWS::AppSync::GraphQLApi",
+        Properties: {
+          Name: "search",
+        },
       },
     },
     Outputs: {
-      AlarmRef: { Value: { Ref: "AlarmRule" } },
-      AlarmArn: { Value: { "Fn::GetAtt": ["AlarmRule", "Arn"] } },
+      SearchApiRef: { Value: { Ref: "SearchApi" } },
+      SearchApiArn: { Value: { "Fn::GetAtt": ["SearchApi", "Arn"] } },
     },
   },
 });
 
 await stack.waitForDeployComplete();
 
-console.log(stack.output("AlarmRef"));
-// "AlarmRule"
+console.log(stack.output("SearchApiRef"));
+// "SearchApi"
 
-console.log(stack.output("AlarmArn"));
-// "AlarmRule.Arn"
+console.log(stack.output("SearchApiArn"));
+// "SearchApi.Arn"
 
 for (const skipped of stack.skippedResources) {
   console.log(skipped.logicalId, skipped.skippedReason);
-  // "AlarmRule Unsupported sim CloudFormation Resource service CloudWatch"
+  // "SearchApi Unsupported sim CloudFormation Resource service AppSync"
 }
 ```
 
@@ -1101,7 +1111,7 @@ every Resource holding a `Ref` or `Fn::GetAtt` to a skipped Resource would fail
 every Resource depending on those, until one EventBridge rule took the whole stack down with it. The skip
 stays where it happened.
 
-A stand-in is deliberately shaped unlike an ARN. It fails closed wherever the simulator reads it.
+A logical ID is deliberately shaped unlike an ARN. It fails closed wherever the simulator reads it.
 
 - In an IAM policy `Resource` it matches no ARN, so a caller relying on that statement is denied.
 - In a property that is parsed as an ARN it is refused as malformed, and that Resource fails.
@@ -1112,9 +1122,58 @@ A stand-in is deliberately shaped unlike an ARN. It fails closed wherever the si
   SDK call fails the way a call for a missing resource does. A `PutItem` naming the skipped table
   gets `ResourceNotFoundException: No DynamoDB Table named Orders`.
 
-A stand-in stands in for something absent, and is never a value to rely on. A test asserting against
-one is asserting on a Resource that was never created. `stack.skippedResources` is where to find out
-which Resources those are and why, under
+A generated name behaves differently, and is meant to. It is the name an account would have held, so
+anything reading it reads a well-formed name. CDK writes a function's log group name as
+`/aws/lambda/` joined to a `Ref` of the function, and the log group is created under
+`/aws/lambda/<stack>-<logical ID>-<suffix>` even where the function was declined. A deploy Role
+scoped to `<stack>-*` and `/aws/lambda/<stack>-*` covers the deployment, the way it does on AWS.
+
+```typescript sim-cloudformation-skipped-resource-generated-name
+/**
+ * A function skipped on its Runtime, and the Log Group named after it.
+ */
+
+import { SimAws } from "@kensio/yulin";
+
+const simAws = new SimAws();
+
+const stack = await simAws.cloudFormation().deployTemplate({
+  stackName: "ReportStack",
+  template: {
+    Resources: {
+      ReportFunction: {
+        Type: "AWS::Lambda::Function",
+        Properties: {
+          Role: "arn:aws:iam::111111111111:role/ReportRole",
+          Handler: "index.handler",
+          Runtime: "python3.13",
+          Code: { ZipFile: "def handler(event, context): return 'report'" },
+        },
+      },
+      ReportFunctionLogGroup: {
+        Type: "AWS::Logs::LogGroup",
+        Properties: {
+          LogGroupName: {
+            "Fn::Join": ["", ["/aws/lambda/", { Ref: "ReportFunction" }]],
+          },
+        },
+      },
+    },
+  },
+});
+
+await stack.waitForDeployComplete();
+
+console.log(stack.getResource("ReportFunction")?.refValue);
+// "ReportStack-ReportFunction-42d643ca8338"
+
+console.log(simAws.logs().allLogGroups()[0]?.logGroupName);
+// "/aws/lambda/ReportStack-ReportFunction-42d643ca8338"
+```
+
+The Resource is absent all the same, and the name is no evidence that it is there. Invoking the
+function above fails with `ResourceNotFoundException`. `stack.skippedResources` is where to find out
+which Resources were left out and why, under
 [Inspecting stacks and resources](#inspecting-stacks-and-resources).
 
 ### `Fn::Join`
@@ -2115,8 +2174,62 @@ const stacks = await simAws.cloudFormation().deployCdkOut({
 console.log(stacks.get("PipelineStack")?.stackName);
 ```
 
-A staged CDK asset is published under the same principal, before CloudFormation reads the template
-that points at it.
+### The principal a CDK asset is published as
+
+A real `cdk deploy` runs in two phases under two Roles. `cdk-assets` publishes every staged file
+asset to the bootstrap staging bucket as the file publishing Role, and CloudFormation then processes
+the template as the execution Role. `assetsCaller` names the first of those, beside the `caller`
+naming the second.
+
+```typescript sim-cloudformation-assets-caller
+/**
+ * Publishing a Stack's CDK file assets as the file publishing Role.
+ */
+
+import { SimAws } from "@kensio/yulin";
+
+const simAws = new SimAws({
+  defaultAccountId: "123456789012",
+  defaultRegionName: "eu-west-2",
+});
+
+const publisher = await simAws.iam().makeDeployRole({
+  roleName: "cdk-file-publishing",
+  policyDocument: {
+    Version: "2012-10-17",
+    Statement: {
+      Effect: "Allow",
+      Action: ["s3:GetObject*", "s3:GetBucket*", "s3:List*", "s3:PutObject"],
+      Resource: "arn:aws:s3:::cdk-hnb659fds-assets-*",
+    },
+  },
+});
+
+const executor = await simAws.iam().makeDeployRole({
+  roleName: "cdk-exec",
+  policyDocument: {
+    Version: "2012-10-17",
+    Statement: { Effect: "Allow", Action: "s3:*", Resource: "*" },
+  },
+});
+
+const stacks = await simAws.cloudFormation().deployCdkOut({
+  directoryPath: "cdk.out",
+  caller: executor,
+  assetsCaller: publisher,
+});
+
+console.log(stacks.size);
+```
+
+`deployTemplate(...)` and `deployTemplateFile(...)` take the same option, and a Stack in an assembly
+names its own in `stackOptions`. A deployment that names no `assetsCaller` publishes its assets as
+`caller`, the way every deployment did before the two could be told apart.
+
+The CDK bootstrap stack provisions the staging bucket, long before either Role runs. Yulin stands in
+for that and makes the bucket outside IAM when the first asset is published into it. So a Role
+holding only what a scoped execution policy grants on `cdk-hnb659fds-assets-*` deploys a cloud
+assembly with file assets, with no `s3:CreateBucket` or `s3:PutObject` added to it.
 
 ## Editing a synthesized template before deploying it
 
@@ -3922,8 +4035,11 @@ const stack = await simAws.cloudFormation().deployTemplate({
           BucketName: "skipped-site-bucket",
         },
       },
-      AlarmRule: {
-        Type: "AWS::CloudWatch::Alarm",
+      SearchApi: {
+        Type: "AWS::AppSync::GraphQLApi",
+        Properties: {
+          Name: "search",
+        },
       },
     },
   },
@@ -3932,10 +4048,10 @@ const stack = await simAws.cloudFormation().deployTemplate({
 await stack.waitForDeployComplete();
 
 console.log(stack.skippedResources.map((resource) => resource.logicalId));
-// ["AlarmRule"]
+// ["SearchApi"]
 
-console.log(stack.getResource("AlarmRule")?.skippedReason);
-// "Unsupported sim CloudFormation Resource service CloudWatch"
+console.log(stack.getResource("SearchApi")?.skippedReason);
+// "Unsupported sim CloudFormation Resource service AppSync"
 ```
 
 A skipped Resource is still there for `stack.getResource(...)`, and still answers `Ref` and `Fn::GetAtt` with
@@ -3979,8 +4095,11 @@ const stack = await simAws.cloudFormation().deployTemplate({
           Description: "/opt/awscli/aws",
         },
       },
-      AlarmRule: {
-        Type: "AWS::CloudWatch::Alarm",
+      SearchApi: {
+        Type: "AWS::AppSync::GraphQLApi",
+        Properties: {
+          Name: "search",
+        },
       },
     },
   },
@@ -3989,7 +4108,7 @@ const stack = await simAws.cloudFormation().deployTemplate({
 await stack.waitForDeployComplete();
 
 console.log(stack.skippedResources.map((resource) => resource.logicalId));
-// ["AlarmRule"]
+// ["SearchApi"]
 
 console.log(stack.inertResources.map((resource) => resource.logicalId));
 // ["AwsCliLayer"]

package/docs/services/cloudfront/README.md

@@ -259,6 +259,11 @@ with a 200 for a URL the Bucket has no object for. It is one of the same error c
 CloudFront allows. Where the response page is itself missing, the viewer gets the status from
 fetching it, as in CloudFront.
 
+Behind an origin access control, a response page the Bucket does not hold answers 403 where a public
+Bucket answers 404. The Bucket policy an origin access control is written with grants `s3:GetObject`
+and no `s3:ListBucket`, and S3 refuses a key whose absence it may not report. A test whose Bucket
+was never loaded with the site's error page sees that refusal in place of the page.
+
 A viewer-response function never sees a custom error page. CloudFront runs no viewer-response
 function once the Origin has answered 400 or higher, and simulated CloudFront does the same, for a
 CloudFront Function and a Lambda@Edge function alike. The status the Origin returned is what decides
@@ -3781,6 +3786,110 @@ A CDK stack needs no hand-editing.
 other store. Handing back an empty store would let a Function that lost its association run to
 completion and quietly take every default.
 
+## Permissions
+
+Every CloudFront command goes through simulated IAM. So does every CloudFront Resource a
+CloudFormation Stack creates, decided as the principal the deployment runs as. Stand a project's own
+execution policy up as a deploy Role and the Stack finds out what the policy leaves out. A
+deployment naming no principal is decided as the Account root.
+
+The action is the `cloudfront:` name of the operation. A Distribution action is decided against
+`arn:aws:cloudfront::<account>:distribution/<id>`, a Function action against `function/<name>` and a
+key value store action against `key-value-store/<id>`. A create action has nothing to name until it
+succeeds and is decided against `*`. A policy granting one has to write the wildcard.
+
+These are the actions the simulation asks about:
+
+- `CreateDistribution`, `GetDistribution`, `UpdateDistribution` and `DeleteDistribution`
+- `CreateFunction`, `ListFunctions`, `DescribeFunction`, `GetFunction` and `DeleteFunction`
+- `CreateInvalidation`, `GetInvalidation` and `ListInvalidations`
+- `CreateKeyValueStore`, `ListKeyValueStores`, `DescribeKeyValueStore`, `UpdateKeyValueStore` and
+  `DeleteKeyValueStore`, alongside the data API's own `cloudfront-keyvaluestore:` actions on the
+  keys inside a store
+- `CreateCachePolicy` and `DeleteCachePolicy`
+- `CreateOriginRequestPolicy` and `DeleteOriginRequestPolicy`
+- `CreateResponseHeadersPolicy` and `DeleteResponseHeadersPolicy`
+- `CreateOriginAccessControl` and `DeleteOriginAccessControl`
+
+The last four pairs reach IAM through CloudFormation alone, since a template is the only way to make
+one of those four here. Each delete is decided against the ARN of the thing it names, such as
+`arn:aws:cloudfront::<account>:cache-policy/<id>`.
+
+```typescript sim-cloudfront-deploy-permissions
+/**
+ * A deploy Role refused the cache policy its Stack declares.
+ */
+
+import { SimAws } from "@kensio/yulin";
+
+const simAws = new SimAws();
+
+// A deploy Role allowed CloudFormation and S3, and no CloudFront action.
+const { Role } = await simAws.iam().createRole({
+  input: {
+    RoleName: "DeployRole",
+    AssumeRolePolicyDocument: JSON.stringify({
+      Version: "2012-10-17",
+      Statement: [
+        {
+          Effect: "Allow",
+          Principal: { Service: "cloudformation.amazonaws.com" },
+          Action: "sts:AssumeRole",
+        },
+      ],
+    }),
+  },
+});
+
+await simAws.iam().putRolePolicy({
+  input: {
+    RoleName: "DeployRole",
+    PolicyName: "DeployPolicy",
+    PolicyDocument: JSON.stringify({
+      Version: "2012-10-17",
+      Statement: [
+        {
+          Effect: "Allow",
+          Action: ["cloudformation:*", "s3:*"],
+          Resource: "*",
+        },
+      ],
+    }),
+  },
+});
+
+try {
+  await simAws.cloudFormation().deployTemplate({
+    stackName: "site-stack",
+    caller: { kind: "arn", arn: Role.Arn },
+    template: {
+      Resources: {
+        SiteCachePolicy: {
+          Type: "AWS::CloudFront::CachePolicy",
+          Properties: {
+            CachePolicyConfig: {
+              Name: "site-caching",
+              MinTTL: 0,
+              ParametersInCacheKeyAndForwardedToOrigin: {
+                EnableAcceptEncodingGzip: false,
+                CookiesConfig: { CookieBehavior: "none" },
+                HeadersConfig: { HeaderBehavior: "none" },
+                QueryStringsConfig: { QueryStringBehavior: "none" },
+              },
+            },
+          },
+        },
+      },
+    },
+  });
+} catch (error) {
+  // Sim CloudFormation Resource SiteCachePolicy creation failed: User:
+  // arn:aws:iam::...:role/DeployRole is not authorized to perform:
+  // cloudfront:CreateCachePolicy on resource: *
+  console.log((error as Error).message);
+}
+```
+
 ## Available functionality
 
 Sim CloudFront currently supports:

package/docs/services/dynamodb/README.md

@@ -2443,6 +2443,123 @@ console.log(output.Responses[1]); // {}
 That is the difference from `BatchGetItem`, which leaves a missing item out of its answer
 altogether. Here the answers stay lined up with the Gets that asked for them.
 
+### Transactions through the document client
+
+`TransactWriteCommand` and `TransactGetCommand` from `@aws-sdk/lib-dynamodb` reach the same two
+operations. Every action's `Item`, `Key` and `ExpressionAttributeValues` are converted on the way in,
+and the `Item` of each `Responses` entry on the way out.
+
+```typescript sim-dynamodb-document-transactions
+/**
+ * Writing an order and the claim on its code together, in plain JavaScript.
+ */
+
+import { CreateTableCommand, DynamoDBClient } from "@aws-sdk/client-dynamodb";
+import {
+  DynamoDBDocumentClient,
+  TransactGetCommand,
+  TransactWriteCommand,
+} from "@aws-sdk/lib-dynamodb";
+
+import { SimSdk } from "@kensio/yulin/sdk";
+
+using simSdk = new SimSdk();
+
+const documents = DynamoDBDocumentClient.from(
+  new DynamoDBClient({ region: "eu-west-2" }),
+);
+simSdk.intercept(documents);
+
+for (const [tableName, keyName] of [
+  ["OrdersTable", "orderId"],
+  ["ClaimsTable", "code"],
+] as const) {
+  await documents.send(
+    new CreateTableCommand({
+      TableName: tableName,
+      KeySchema: [{ AttributeName: keyName, KeyType: "HASH" }],
+      AttributeDefinitions: [{ AttributeName: keyName, AttributeType: "S" }],
+      BillingMode: "PAY_PER_REQUEST",
+    }),
+  );
+}
+await simSdk.simAws.backgroundTasksComplete();
+
+const claim = {
+  TableName: "ClaimsTable",
+  ConditionExpression: "attribute_not_exists(code)",
+};
+
+// The order and the claim on its code go in together.
+await documents.send(
+  new TransactWriteCommand({
+    TransactItems: [
+      {
+        Put: {
+          TableName: "OrdersTable",
+          Item: { orderId: "order-1", total: 42, lines: [{ sku: "widget" }] },
+        },
+      },
+      { Put: { ...claim, Item: { code: "ABC123", orderId: "order-1" } } },
+    ],
+  }),
+);
+
+const read = await documents.send(
+  new TransactGetCommand({
+    TransactItems: [
+      { Get: { TableName: "OrdersTable", Key: { orderId: "order-1" } } },
+      { Get: { TableName: "ClaimsTable", Key: { code: "ABC123" } } },
+    ],
+  }),
+);
+
+const lines = read.Responses?.[0]?.Item?.["lines"] as { sku: string }[];
+console.log(lines[0]?.sku); // widget
+console.log(read.Responses?.[1]?.Item?.["orderId"]); // order-1
+
+// A second order wanting the same code loses the claim, and loses the order
+// with it.
+try {
+  await documents.send(
+    new TransactWriteCommand({
+      TransactItems: [
+        {
+          Put: {
+            TableName: "OrdersTable",
+            Item: { orderId: "order-2", total: 7 },
+          },
+        },
+        { Put: { ...claim, Item: { code: "ABC123", orderId: "order-2" } } },
+      ],
+    }),
+  );
+} catch (error) {
+  const cancelled = error as {
+    name: string;
+    CancellationReasons?: { Code: string }[];
+  };
+
+  console.log(cancelled.name); // "TransactionCanceledException"
+  console.log(cancelled.CancellationReasons?.map((reason) => reason.Code));
+  // ["None", "ConditionalCheckFailed"]
+}
+
+const second = await documents.send(
+  new TransactGetCommand({
+    TransactItems: [
+      { Get: { TableName: "OrdersTable", Key: { orderId: "order-2" } } },
+    ],
+  }),
+);
+
+console.log(second.Responses?.[0]); // {}
+```
+
+`CancellationReasons` arrive as the low-level Command reports them. There is one per action, in
+`TransactItems` order. A reason's `Item` holds AttributeValues, because a cancelled transaction is
+thrown, and the real document client converts nothing on the way out of a transactional write.
+
 ## Expiring items with time to live
 
 `UpdateTimeToLive` names the attribute a table expires items by, and `DescribeTimeToLive` reports
@@ -2930,8 +3047,11 @@ console.log(tags.has("priority")); // true
 ```
 
 `PutCommand`, `GetCommand`, `DeleteCommand`, `UpdateCommand`, `QueryCommand`, `ScanCommand`,
-`BatchWriteCommand` and `BatchGetCommand` are converted. A document Command with no route here, such
-as `TransactWriteCommand`, is refused by name before anything tries to convert its values.
+`BatchWriteCommand`, `BatchGetCommand`, `TransactWriteCommand` and `TransactGetCommand` are
+converted. The two transactional ones have
+[a section of their own](#transactions-through-the-document-client). A document Command with no route
+here, such as the PartiQL `ExecuteStatementCommand`, is refused by name before anything tries to
+convert its values.
 
 Intercept the document client itself. `DynamoDBDocumentClient.from(client)` builds a separate object
 outside the `DynamoDBClient` class, so intercepting the base client leaves Commands sent through the
@@ -3621,15 +3741,15 @@ Arn`, `Fn::GetAtt … StreamArn` and `Fn::GetAtt … TableId` answering. A CDK `
 - SDK interception, and an intercepted `DynamoDBClient` or `DynamoDBStreamsClient` reaches the
   simulation.
 - The `@aws-sdk/lib-dynamodb` document client, with `PutCommand`, `GetCommand`, `DeleteCommand`,
-  `UpdateCommand`, `QueryCommand`, `ScanCommand`, `BatchWriteCommand` and `BatchGetCommand`
-  converting native JavaScript values on the way in and out, and `paginateQuery` and `paginateScan`
-  paging through a simulated table.
+  `UpdateCommand`, `QueryCommand`, `ScanCommand`, `BatchWriteCommand`, `BatchGetCommand`,
+  `TransactWriteCommand` and `TransactGetCommand` converting native JavaScript values on the way in
+  and out, and `paginateQuery` and `paginateScan` paging through a simulated table.
 
 ## Limitations
 
-- The document client's transaction and PartiQL Commands go unconverted. PartiQL is an operation
-  this simulation lacks yet. The transactions are simulated as operations, so only the document form
-  of them is missing. Both are refused by name, never half converted.
+- The document client's PartiQL Commands go unconverted, because PartiQL is an operation this
+  simulation lacks yet. `ExecuteStatementCommand`, `BatchExecuteStatementCommand` and
+  `ExecuteTransactionCommand` are refused by name, never half converted.
 - A document client's translate config goes unread. The marshalling options it was built with do not
   apply. See [the SDK docs](https://yulinsim.dev/sdk/#limitations).
 - `Expected`, `ConditionalOperator`, `AttributeUpdates`, `KeyConditions`, `QueryFilter` and