feat(partiql): implement ExecuteStatement, BatchExecuteStatement, ExecuteTransaction

.github/workflows/integration-cassandra.yml

@@ -125,7 +125,11 @@ jobs:
 
   cassandra-pytest:
     runs-on: extenddb_ubuntu-2404_4-core
-    timeout-minutes: 45
+    # With the PartiQL wire tests the job took up to 42 min 10 s on #411's CI,
+    # near the old 45-minute bound; on main it took 30 to 40 min. A run with a
+    # cold build cache should take about 44 min; 60 leaves room for a slow
+    # runner.
+    timeout-minutes: 60
     services:
       cassandra:
         image: cassandra:4.1

.github/workflows/integration-mongodb.yml

@@ -116,7 +116,9 @@ jobs:
 
   mongodb-rust:
     runs-on: extenddb_ubuntu-2404_4-core
-    timeout-minutes: 40
+    # The job took up to 38 min 42 s on main's CI in November 2026, near the
+    # old 40-minute bound; 55 leaves room for a slow runner.
+    timeout-minutes: 55
     steps:
       - uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6.1.0
       - uses: dtolnay/rust-toolchain@683b588c487a69d01f6c6ddf40f036ff682cc2c8 # master

.github/workflows/integration.yml

@@ -29,9 +29,10 @@ jobs:
     # 2026 and this compiles Rust; move to 26 deliberately.
     runs-on: extenddb_ubuntu-2404_4-core
     # With the backup store and job suites it ends with (3 min 3 s of it), the
-    # job took 39 min 49 s on #740's CI, at the old 40-minute bound; 55 leaves
-    # room for a slow runner.
-    timeout-minutes: 55
+    # job took 39 min 49 s on #740's CI, at the old 40-minute bound. With the
+    # PartiQL wire tests it took 48 min 4 s on #411's CI, before #740. A run
+    # with both should take about 50 min; 70 leaves room for a slow runner.
+    timeout-minutes: 70
     services:
       postgres:
         # pgvector's own image, which is postgres:16 plus the extension. The
@@ -214,9 +215,10 @@ jobs:
   run-integration-sqlite:
     runs-on: extenddb_ubuntu-2404_4-core
     # With the backup store and job suites it ends with (4 min 16 s of it), the
-    # job took 40 min 31 s on #740's CI, past the old 40-minute bound; 55 leaves
-    # room for a slow runner.
-    timeout-minutes: 55
+    # job took 40 min 31 s on #740's CI, past the old 40-minute bound. With the
+    # PartiQL wire tests it took 43 min 27 s on #411's CI, before #740. 60
+    # leaves room for both and a slow runner.
+    timeout-minutes: 60
     steps:
       - uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6.1.0
 
@@ -526,7 +528,10 @@ jobs:
 
   run-rust-integration:
     runs-on: extenddb_ubuntu-2404_4-core
-    timeout-minutes: 40
+    # The job took 33 min 21 s on #740's merge queue run and 29 min 39 s on
+    # #411's CI, before #740. A run with both should take about 36 min; 50
+    # leaves room for a slow runner.
+    timeout-minutes: 50
     services:
       postgres:
         image: pgvector/pgvector:pg16

crates/auth/src/policy/context.rs

@@ -185,6 +185,10 @@ pub struct RequestParams {
     pub return_consumed_capacity: Option<String>,
     /// The enclosing operation for batch/transact sub-operations.
     pub enclosing_operation: Option<String>,
+    /// `dynamodb:FullTableScan` for a request that is not a scan
+    /// (`RequestContext::build` sets it to `true` for one). `None` leaves the
+    /// key absent; a PartiQL read by key sets `false`.
+    pub full_table_scan: Option<bool>,
     /// The caller ARN (`aws:PrincipalArn`), when known.
     pub principal_arn: Option<String>,
     /// The caller's account id (`aws:PrincipalAccount`), when known.
@@ -301,7 +305,8 @@ impl RequestContext {
     /// Build context for a `DynamoDB` operation.
     ///
     /// `principal_tags` and `resource_tags` come from the identity and target
-    /// table respectively. `is_scan` should be true for Scan operations.
+    /// table respectively. `is_scan` should be true for Scan operations; for
+    /// any other request `params.full_table_scan` gives the key.
     /// `params` carries operation-specific request parameters.
     #[must_use]
     pub fn build(
@@ -319,7 +324,11 @@ impl RequestContext {
             select: params.select,
             return_values: params.return_values,
             return_consumed_capacity: params.return_consumed_capacity,
-            full_table_scan: if is_scan { Some(true) } else { None },
+            full_table_scan: if is_scan {
+                Some(true)
+            } else {
+                params.full_table_scan
+            },
             enclosing_operation: params.enclosing_operation,
             principal_arn: params.principal_arn,
             principal_account: params.principal_account,
@@ -999,6 +1008,25 @@ mod tests {
         );
     }
 
+    #[test]
+    fn request_context_full_table_scan_set_by_the_request() {
+        // A PartiQL read by key carries "false" (measured 2026-11-03); a
+        // request that sets nothing leaves the key absent unless it is a scan.
+        let ctx = RequestContext::build(
+            HashMap::new(),
+            HashMap::new(),
+            false,
+            RequestParams {
+                full_table_scan: Some(false),
+                ..Default::default()
+            },
+        );
+        assert_eq!(
+            ctx.resolve_key("dynamodb:FullTableScan"),
+            Some(vec!["false"])
+        );
+    }
+
     #[test]
     fn assume_role_context_external_id() {
         let ctx = ar_ctx(HashMap::new(), Some("ext-123".to_owned()), HashMap::new());

crates/core/Cargo.toml

@@ -18,3 +18,9 @@ md-5 = { workspace = true }
 sha2 = { workspace = true }
 time = { workspace = true }
 uuid = { workspace = true }
+
+[features]
+default = ["partiql"]
+# PartiQL grammar, AST and query planning. Removable: with this off, the
+# `partiql` module is not compiled and nothing else in core references it.
+partiql = []

crates/core/src/error/mod.rs

@@ -57,6 +57,13 @@ pub enum DynamoDbError {
     LimitExceededException(String),
     #[error("{0}")]
     ConditionalCheckFailedException(String, Option<Item>),
+    /// A PartiQL `INSERT` targeted a primary key that already exists.
+    ///
+    /// `INSERT` is create-only, so a duplicate full key fails with this error
+    /// rather than `ConditionalCheckFailedException`. HTTP 400. The message is
+    /// always `Duplicate primary key exists in table`, measured on the service.
+    #[error("{0}")]
+    DuplicateItemException(String),
     #[error("{message}")]
     TransactionCanceledException {
         /// Human-readable message.
@@ -157,6 +164,7 @@ impl DynamoDbError {
             | Self::TableNotFoundException(_)
             | Self::LimitExceededException(_)
             | Self::ConditionalCheckFailedException(..)
+            | Self::DuplicateItemException(_)
             | Self::TransactionCanceledException { .. }
             | Self::IdempotentParameterMismatchException(_)
             | Self::SerializationException(_)
@@ -204,6 +212,7 @@ impl DynamoDbError {
             Self::TableNotFoundException(_) => "TableNotFoundException",
             Self::LimitExceededException(_) => "LimitExceededException",
             Self::ConditionalCheckFailedException(..) => "ConditionalCheckFailedException",
+            Self::DuplicateItemException(_) => "DuplicateItemException",
             Self::TransactionCanceledException { .. } => "TransactionCanceledException",
             Self::IdempotentParameterMismatchException(_) => "IdempotentParameterMismatchException",
             Self::SerializationException(_) => "SerializationException",
@@ -280,6 +289,7 @@ impl DynamoDbError {
             | Self::TableNotFoundException(m)
             | Self::LimitExceededException(m)
             | Self::ConditionalCheckFailedException(m, _)
+            | Self::DuplicateItemException(m)
             | Self::IdempotentParameterMismatchException(m)
             | Self::SerializationException(m)
             | Self::UnknownOperationException(m)

crates/core/src/expression/resolver.rs

@@ -30,6 +30,11 @@ pub struct ExpressionMaps {
     /// and was desugared into an update expression. The service sizes that
     /// form against the item limit differently from an expression.
     pub legacy_attribute_updates: bool,
+    /// Set by the engine for an update translated from a PartiQL `UPDATE`.
+    /// The service sizes that statement by its finished item alone, as it
+    /// sizes a transacted Update, and not by the statement as it sizes
+    /// `UpdateItem`.
+    pub finished_item_sizing: bool,
     /// Pre-parsed `BigDecimal` values for numeric placeholders.
     /// Populated eagerly by `new()` and refreshed by `pre_parse_numerics()`.
     parsed_numerics: HashMap<String, bigdecimal::BigDecimal>,
@@ -45,6 +50,7 @@ impl ExpressionMaps {
             names,
             values,
             legacy_attribute_updates: false,
+            finished_item_sizing: false,
             parsed_numerics: HashMap::new(),
         };
         maps.pre_parse_numerics();

crates/core/src/lib.rs

@@ -13,6 +13,8 @@ pub mod error;
 pub mod expression;
 pub mod limits;
 pub mod metrics;
+#[cfg(feature = "partiql")]
+pub mod partiql;
 pub mod serde_helpers;
 pub mod settings_keys;
 pub mod throttle;