feat(partiql): implement ExecuteStatement, BatchExecuteStatement, ExecuteTransaction

crates/auth/src/policy/context.rs

@@ -183,6 +183,10 @@ pub struct RequestParams {
     pub return_consumed_capacity: Option<String>,
     /// The enclosing operation for batch/transact sub-operations.
     pub enclosing_operation: Option<String>,
+    /// `dynamodb:FullTableScan` for a request that is not a scan
+    /// (`RequestContext::build` sets it to `true` for one). `None` leaves the
+    /// key absent; a PartiQL read by key sets `false`.
+    pub full_table_scan: Option<bool>,
     /// The caller ARN (`aws:PrincipalArn`), when known.
     pub principal_arn: Option<String>,
     /// The caller's account id (`aws:PrincipalAccount`), when known.
@@ -299,7 +303,8 @@ impl RequestContext {
     /// Build context for a `DynamoDB` operation.
     ///
     /// `principal_tags` and `resource_tags` come from the identity and target
-    /// table respectively. `is_scan` should be true for Scan operations.
+    /// table respectively. `is_scan` should be true for Scan operations; for
+    /// any other request `params.full_table_scan` gives the key.
     /// `params` carries operation-specific request parameters.
     #[must_use]
     pub fn build(
@@ -317,7 +322,11 @@ impl RequestContext {
             select: params.select,
             return_values: params.return_values,
             return_consumed_capacity: params.return_consumed_capacity,
-            full_table_scan: if is_scan { Some(true) } else { None },
+            full_table_scan: if is_scan {
+                Some(true)
+            } else {
+                params.full_table_scan
+            },
             enclosing_operation: params.enclosing_operation,
             principal_arn: params.principal_arn,
             principal_account: params.principal_account,
@@ -997,6 +1006,25 @@ mod tests {
         );
     }
 
+    #[test]
+    fn request_context_full_table_scan_set_by_the_request() {
+        // A PartiQL read by key carries "false" (measured 2026-11-03); a
+        // request that sets nothing leaves the key absent unless it is a scan.
+        let ctx = RequestContext::build(
+            HashMap::new(),
+            HashMap::new(),
+            false,
+            RequestParams {
+                full_table_scan: Some(false),
+                ..Default::default()
+            },
+        );
+        assert_eq!(
+            ctx.resolve_key("dynamodb:FullTableScan"),
+            Some(vec!["false"])
+        );
+    }
+
     #[test]
     fn assume_role_context_external_id() {
         let ctx = ar_ctx(HashMap::new(), Some("ext-123".to_owned()), HashMap::new());

crates/core/Cargo.toml

@@ -18,3 +18,9 @@ md-5 = { workspace = true }
 sha2 = { workspace = true }
 time = { workspace = true }
 uuid = { workspace = true }
+
+[features]
+default = ["partiql"]
+# PartiQL grammar, AST and query planning. Removable: with this off, the
+# `partiql` module is not compiled and nothing else in core references it.
+partiql = []

crates/core/src/error/mod.rs

@@ -57,6 +57,13 @@ pub enum DynamoDbError {
     LimitExceededException(String),
     #[error("{0}")]
     ConditionalCheckFailedException(String, Option<Item>),
+    /// A PartiQL `INSERT` targeted a primary key that already exists.
+    ///
+    /// `INSERT` is create-only, so a duplicate full key fails with this error
+    /// rather than `ConditionalCheckFailedException`. HTTP 400. The message is
+    /// always `Duplicate primary key exists in table`, measured on the service.
+    #[error("{0}")]
+    DuplicateItemException(String),
     #[error("{message}")]
     TransactionCanceledException {
         /// Human-readable message.
@@ -157,6 +164,7 @@ impl DynamoDbError {
             | Self::TableNotFoundException(_)
             | Self::LimitExceededException(_)
             | Self::ConditionalCheckFailedException(..)
+            | Self::DuplicateItemException(_)
             | Self::TransactionCanceledException { .. }
             | Self::IdempotentParameterMismatchException(_)
             | Self::SerializationException(_)
@@ -204,6 +212,7 @@ impl DynamoDbError {
             Self::TableNotFoundException(_) => "TableNotFoundException",
             Self::LimitExceededException(_) => "LimitExceededException",
             Self::ConditionalCheckFailedException(..) => "ConditionalCheckFailedException",
+            Self::DuplicateItemException(_) => "DuplicateItemException",
             Self::TransactionCanceledException { .. } => "TransactionCanceledException",
             Self::IdempotentParameterMismatchException(_) => "IdempotentParameterMismatchException",
             Self::SerializationException(_) => "SerializationException",
@@ -280,6 +289,7 @@ impl DynamoDbError {
             | Self::TableNotFoundException(m)
             | Self::LimitExceededException(m)
             | Self::ConditionalCheckFailedException(m, _)
+            | Self::DuplicateItemException(m)
             | Self::IdempotentParameterMismatchException(m)
             | Self::SerializationException(m)
             | Self::UnknownOperationException(m)

crates/core/src/expression/resolver.rs

@@ -30,6 +30,11 @@ pub struct ExpressionMaps {
     /// and was desugared into an update expression. The service sizes that
     /// form against the item limit differently from an expression.
     pub legacy_attribute_updates: bool,
+    /// Set by the engine for an update translated from a PartiQL `UPDATE`.
+    /// The service sizes that statement by its finished item alone, as it
+    /// sizes a transacted Update, and not by the statement as it sizes
+    /// `UpdateItem`.
+    pub finished_item_sizing: bool,
     /// Pre-parsed `BigDecimal` values for numeric placeholders.
     /// Populated eagerly by `new()` and refreshed by `pre_parse_numerics()`.
     parsed_numerics: HashMap<String, bigdecimal::BigDecimal>,
@@ -45,6 +50,7 @@ impl ExpressionMaps {
             names,
             values,
             legacy_attribute_updates: false,
+            finished_item_sizing: false,
             parsed_numerics: HashMap::new(),
         };
         maps.pre_parse_numerics();

crates/core/src/lib.rs

@@ -13,6 +13,8 @@ pub mod error;
 pub mod expression;
 pub mod limits;
 pub mod metrics;
+#[cfg(feature = "partiql")]
+pub mod partiql;
 pub mod serde_helpers;
 pub mod settings_keys;
 pub mod throttle;