fix allocator again

concat_project.sh

@@ -4,13 +4,13 @@
 OUTPUT_FILE="project_context.txt"
 
 # Directories to exclude
-EXCLUDE_DIRS=("zig-out" "data" ".git" "node_modules" ".zig-cache")
+EXCLUDE_DIRS=("zig-out" "data" ".git" "node_modules" ".zig-cache" "tests")
 
 # File extensions to include (add more as needed)
-INCLUDE_EXTENSIONS=("zig" "md" "yml" "yaml" "Makefile" "Dockerfile")
+INCLUDE_EXTENSIONS=("zig" "Makefile")
 
 # Special files to include (without extension)
-INCLUDE_FILES=("build.zig" "build.zig.zon" "Makefile" "Dockerfile" "docker-compose.yml" "README.md")
+INCLUDE_FILES=("build.zig" "build.zig.zon" "Makefile")
 
 # Clear the output file
 > "$OUTPUT_FILE"

src/bench.zig

@@ -3,6 +3,7 @@ const std = @import("std");
 const rocksdb = @import("rocksdb.zig");
 const storage = @import("dynamodb/storage.zig");
 const types = @import("dynamodb/types.zig");
+const json = @import("dynamodb/json.zig");
 
 const BenchResult = struct {
     name: []const u8,
@@ -23,18 +24,6 @@ const BenchResult = struct {
     }
 };
 
-fn runBench(name: []const u8, ops: u64, func: anytype) BenchResult {
-    const start = std.time.nanoTimestamp();
-    func();
-    const end = std.time.nanoTimestamp();
-
-    return BenchResult{
-        .name = name,
-        .ops = ops,
-        .duration_ns = @intCast(end - start),
-    };
-}
-
 pub fn main() !void {
     var gpa = std.heap.GeneralPurposeAllocator(.{}){};
     defer _ = gpa.deinit();
@@ -45,33 +34,27 @@ pub fn main() !void {
     std.debug.print("                    ZynamoDB Performance Benchmarks\n", .{});
     std.debug.print("=" ** 70 ++ "\n\n", .{});
 
-    // Setup
     const path = "/tmp/bench_zynamodb";
     defer std.fs.deleteTreeAbsolute(path) catch {};
 
-    // Raw RocksDB benchmarks
     std.debug.print("RocksDB Raw Operations:\n", .{});
     std.debug.print("-" ** 70 ++ "\n", .{});
 
-    try benchRocksDBWrites(allocator, path);
+    try benchRocksDBWrites(allocator);
-    try benchRocksDBReads(allocator, path);
+    try benchRocksDBReads(allocator);
-    try benchRocksDBBatch(allocator, path);
+    try benchRocksDBBatch(allocator);
-    try benchRocksDBScan(allocator, path);
 
-    std.debug.print("\n", .{});
+    std.debug.print("\nStorage Engine Operations:\n", .{});
-
-    // Storage engine benchmarks
-    std.debug.print("Storage Engine Operations:\n", .{});
     std.debug.print("-" ** 70 ++ "\n", .{});
 
-    try benchStoragePutItem(allocator, path);
+    try benchStoragePutItem(allocator);
-    try benchStorageGetItem(allocator, path);
+    try benchStorageGetItem(allocator);
-    try benchStorageScan(allocator, path);
+    try benchStorageScan(allocator);
 
     std.debug.print("\n" ++ "=" ** 70 ++ "\n", .{});
 }
 
-fn benchRocksDBWrites(allocator: std.mem.Allocator, base_path: []const u8) !void {
+fn benchRocksDBWrites(allocator: std.mem.Allocator) !void {
     _ = allocator;
     const path = "/tmp/bench_rocksdb_writes";
     defer std.fs.deleteTreeAbsolute(path) catch {};
@@ -83,29 +66,26 @@ fn benchRocksDBWrites(allocator: std.mem.Allocator, base_path: []const u8) !void
     var key_buf: [32]u8 = undefined;
     var val_buf: [256]u8 = undefined;
 
-    const result = runBench("Sequential Writes", ops, struct {
+    const start = std.time.nanoTimestamp();
-        fn run(d: *rocksdb.DB, kb: *[32]u8, vb: *[256]u8, n: u64) void {
     var i: u64 = 0;
-            while (i < n) : (i += 1) {
+    while (i < ops) : (i += 1) {
-                const key = std.fmt.bufPrint(kb, "key_{d:0>10}", .{i}) catch continue;
+        const key = std.fmt.bufPrint(&key_buf, "key_{d:0>10}", .{i}) catch continue;
-                const val = std.fmt.bufPrint(vb, "value_{d}_padding_data_to_make_it_realistic", .{i}) catch continue;
+        const val = std.fmt.bufPrint(&val_buf, "value_{d}_padding_data", .{i}) catch continue;
-                d.put(key, val) catch {};
+        db.put(key, val) catch {};
     }
-        }
+    const end = std.time.nanoTimestamp();
-    }.run, .{ &db, &key_buf, &val_buf, ops });
 
-    _ = base_path;
+    const result = BenchResult{ .name = "Sequential Writes", .ops = ops, .duration_ns = @intCast(end - start) };
     result.print();
 }
 
-fn benchRocksDBReads(allocator: std.mem.Allocator, base_path: []const u8) !void {
+fn benchRocksDBReads(allocator: std.mem.Allocator) !void {
     const path = "/tmp/bench_rocksdb_reads";
     defer std.fs.deleteTreeAbsolute(path) catch {};
 
     var db = try rocksdb.DB.open(path, true);
     defer db.close();
 
-    // First write some data
     var key_buf: [32]u8 = undefined;
     var val_buf: [256]u8 = undefined;
 
@@ -117,27 +97,24 @@ fn benchRocksDBReads(allocator: std.mem.Allocator, base_path: []const u8) !void
         try db.put(key, val);
     }
 
-    // Now benchmark reads
     var prng = std.Random.DefaultPrng.init(12345);
     const random = prng.random();
 
-    const result = runBench("Random Reads", ops, struct {
+    const start = std.time.nanoTimestamp();
-        fn run(d: *rocksdb.DB, alloc: std.mem.Allocator, kb: *[32]u8, r: std.Random, n: u64) void {
     var j: u64 = 0;
-            while (j < n) : (j += 1) {
+    while (j < ops) : (j += 1) {
-                const idx = r.intRangeAtMost(u64, 0, n - 1);
+        const idx = random.intRangeAtMost(u64, 0, ops - 1);
-                const key = std.fmt.bufPrint(kb, "key_{d:0>10}", .{idx}) catch continue;
+        const key = std.fmt.bufPrint(&key_buf, "key_{d:0>10}", .{idx}) catch continue;
-                const val = d.get(alloc, key) catch continue;
+        const val = db.get(allocator, key) catch continue;
-                if (val) |v| alloc.free(v);
+        if (val) |v| allocator.free(v);
     }
-        }
+    const end = std.time.nanoTimestamp();
-    }.run, .{ &db, allocator, &key_buf, random, ops });
 
-    _ = base_path;
+    const result = BenchResult{ .name = "Random Reads", .ops = ops, .duration_ns = @intCast(end - start) };
     result.print();
 }
 
-fn benchRocksDBBatch(allocator: std.mem.Allocator, base_path: []const u8) !void {
+fn benchRocksDBBatch(allocator: std.mem.Allocator) !void {
     _ = allocator;
     const path = "/tmp/bench_rocksdb_batch";
     defer std.fs.deleteTreeAbsolute(path) catch {};
@@ -149,132 +126,85 @@ fn benchRocksDBBatch(allocator: std.mem.Allocator, base_path: []const u8) !void
     var key_buf: [32]u8 = undefined;
     var val_buf: [256]u8 = undefined;
 
-    const result = runBench("Batch Writes", ops, struct {
+    const start = std.time.nanoTimestamp();
-        fn run(d: *rocksdb.DB, kb: *[32]u8, vb: *[256]u8, n: u64) void {
     var batch = rocksdb.WriteBatch.init() orelse return;
     defer batch.deinit();
 
     var i: u64 = 0;
-            while (i < n) : (i += 1) {
+    while (i < ops) : (i += 1) {
-                const key = std.fmt.bufPrint(kb, "batch_key_{d:0>10}", .{i}) catch continue;
+        const key = std.fmt.bufPrint(&key_buf, "batch_key_{d:0>10}", .{i}) catch continue;
-                const val = std.fmt.bufPrint(vb, "batch_value_{d}", .{i}) catch continue;
+        const val = std.fmt.bufPrint(&val_buf, "batch_value_{d}", .{i}) catch continue;
         batch.put(key, val);
     }
+    batch.write(&db) catch {};
+    const end = std.time.nanoTimestamp();
 
-            batch.write(d) catch {};
+    const result = BenchResult{ .name = "Batch Writes", .ops = ops, .duration_ns = @intCast(end - start) };
-        }
-    }.run, .{ &db, &key_buf, &val_buf, ops });
-
-    _ = base_path;
     result.print();
 }
 
-fn benchRocksDBScan(allocator: std.mem.Allocator, base_path: []const u8) !void {
+fn benchStoragePutItem(allocator: std.mem.Allocator) !void {
-    _ = allocator;
-    const path = "/tmp/bench_rocksdb_scan";
-    defer std.fs.deleteTreeAbsolute(path) catch {};
-
-    var db = try rocksdb.DB.open(path, true);
-    defer db.close();
-
-    // Write data
-    var key_buf: [32]u8 = undefined;
-    var val_buf: [256]u8 = undefined;
-
-    const ops: u64 = 10000;
-    var i: u64 = 0;
-    while (i < ops) : (i += 1) {
-        const key = try std.fmt.bufPrint(&key_buf, "scan_key_{d:0>10}", .{i});
-        const val = try std.fmt.bufPrint(&val_buf, "scan_value_{d}", .{i});
-        try db.put(key, val);
-    }
-
-    const result = runBench("Full Scan", ops, struct {
-        fn run(d: *rocksdb.DB, n: u64) void {
-            _ = n;
-            var iter = rocksdb.Iterator.init(d) orelse return;
-            defer iter.deinit();
-
-            iter.seekToFirst();
-            var count: u64 = 0;
-            while (iter.valid()) {
-                _ = iter.key();
-                _ = iter.value();
-                count += 1;
-                iter.next();
-            }
-        }
-    }.run, .{ &db, ops });
-
-    _ = base_path;
-    result.print();
-}
-
-fn benchStoragePutItem(allocator: std.mem.Allocator, base_path: []const u8) !void {
-    _ = base_path;
     const path = "/tmp/bench_storage_put";
     defer std.fs.deleteTreeAbsolute(path) catch {};
 
     var engine = try storage.StorageEngine.init(allocator, path);
     defer engine.deinit();
 
-    const key_schema = [_]types.KeySchemaElement{
+    const key_schema = [_]types.KeySchemaElement{.{ .attribute_name = "pk", .key_type = .HASH }};
-        .{ .attribute_name = "pk", .key_type = .HASH },
+    const attr_defs = [_]types.AttributeDefinition{.{ .attribute_name = "pk", .attribute_type = .S }};
-    };
-    const attr_defs = [_]types.AttributeDefinition{
-        .{ .attribute_name = "pk", .attribute_type = .S },
-    };
 
     _ = try engine.createTable("BenchTable", &key_schema, &attr_defs);
 
     const ops: u64 = 5000;
-    var item_buf: [512]u8 = undefined;
 
     const start = std.time.nanoTimestamp();
     var i: u64 = 0;
     while (i < ops) : (i += 1) {
-        const item = std.fmt.bufPrint(&item_buf, "{{\"pk\":{{\"S\":\"user{d:0>10}\"}},\"name\":{{\"S\":\"User {d}\"}},\"email\":{{\"S\":\"user{d}@example.com\"}}}}", .{ i, i, i }) catch continue;
+        var item = types.Item.init(allocator);
+        defer json.deinitItem(&item, allocator);
+
+        var pk_buf: [32]u8 = undefined;
+        const pk_str = std.fmt.bufPrint(&pk_buf, "user{d:0>10}", .{i}) catch continue;
+        const pk_owned = allocator.dupe(u8, pk_str) catch continue;
+
+        const pk_name = allocator.dupe(u8, "pk") catch continue;
+        item.put(pk_name, types.AttributeValue{ .S = pk_owned }) catch continue;
+
         engine.putItem("BenchTable", item) catch {};
     }
     const end = std.time.nanoTimestamp();
 
-    const result = BenchResult{
+    const result = BenchResult{ .name = "PutItem", .ops = ops, .duration_ns = @intCast(end - start) };
-        .name = "PutItem",
-        .ops = ops,
-        .duration_ns = @intCast(end - start),
-    };
     result.print();
 }
 
-fn benchStorageGetItem(allocator: std.mem.Allocator, base_path: []const u8) !void {
+fn benchStorageGetItem(allocator: std.mem.Allocator) !void {
-    _ = base_path;
     const path = "/tmp/bench_storage_get";
     defer std.fs.deleteTreeAbsolute(path) catch {};
 
     var engine = try storage.StorageEngine.init(allocator, path);
     defer engine.deinit();
 
-    const key_schema = [_]types.KeySchemaElement{
+    const key_schema = [_]types.KeySchemaElement{.{ .attribute_name = "pk", .key_type = .HASH }};
-        .{ .attribute_name = "pk", .key_type = .HASH },
+    const attr_defs = [_]types.AttributeDefinition{.{ .attribute_name = "pk", .attribute_type = .S }};
-    };
-    const attr_defs = [_]types.AttributeDefinition{
-        .{ .attribute_name = "pk", .attribute_type = .S },
-    };
 
     _ = try engine.createTable("BenchTable", &key_schema, &attr_defs);
 
-    // Write data first
     const ops: u64 = 5000;
-    var item_buf: [512]u8 = undefined;
-    var key_buf: [128]u8 = undefined;
-
     var i: u64 = 0;
     while (i < ops) : (i += 1) {
-        const item = try std.fmt.bufPrint(&item_buf, "{{\"pk\":{{\"S\":\"user{d:0>10}\"}},\"data\":{{\"S\":\"test\"}}}}", .{i});
+        var item = types.Item.init(allocator);
-        try engine.putItem("BenchTable", item);
+        defer json.deinitItem(&item, allocator);
+
+        var pk_buf: [32]u8 = undefined;
+        const pk_str = std.fmt.bufPrint(&pk_buf, "user{d:0>10}", .{i}) catch continue;
+        const pk_owned = allocator.dupe(u8, pk_str) catch continue;
+        const pk_name = allocator.dupe(u8, "pk") catch continue;
+        item.put(pk_name, types.AttributeValue{ .S = pk_owned }) catch continue;
+
+        engine.putItem("BenchTable", item) catch {};
     }
 
-    // Benchmark reads
     var prng = std.Random.DefaultPrng.init(12345);
     const random = prng.random();
 
@@ -282,60 +212,61 @@ fn benchStorageGetItem(allocator: std.mem.Allocator, base_path: []const u8) !voi
     i = 0;
     while (i < ops) : (i += 1) {
         const idx = random.intRangeAtMost(u64, 0, ops - 1);
-        const key = std.fmt.bufPrint(&key_buf, "{{\"pk\":{{\"S\":\"user{d:0>10}\"}}}}", .{idx}) catch continue;
+
-        const item = engine.getItem("BenchTable", key) catch continue;
+        var key_item = types.Item.init(allocator);
-        if (item) |v| allocator.free(v);
+        defer json.deinitItem(&key_item, allocator);
+
+        var pk_buf: [32]u8 = undefined;
+        const pk_str = std.fmt.bufPrint(&pk_buf, "user{d:0>10}", .{idx}) catch continue;
+        const pk_owned = allocator.dupe(u8, pk_str) catch continue;
+        const pk_name = allocator.dupe(u8, "pk") catch continue;
+        key_item.put(pk_name, types.AttributeValue{ .S = pk_owned }) catch continue;
+
+        const item = engine.getItem("BenchTable", key_item) catch continue;
+        if (item) |it| {
+            var it_mut = it;
+            json.deinitItem(&it_mut, allocator);
+        }
     }
     const end = std.time.nanoTimestamp();
 
-    const result = BenchResult{
+    const result = BenchResult{ .name = "GetItem", .ops = ops, .duration_ns = @intCast(end - start) };
-        .name = "GetItem",
-        .ops = ops,
-        .duration_ns = @intCast(end - start),
-    };
     result.print();
 }
 
-fn benchStorageScan(allocator: std.mem.Allocator, base_path: []const u8) !void {
+fn benchStorageScan(allocator: std.mem.Allocator) !void {
-    _ = base_path;
     const path = "/tmp/bench_storage_scan";
     defer std.fs.deleteTreeAbsolute(path) catch {};
 
     var engine = try storage.StorageEngine.init(allocator, path);
     defer engine.deinit();
 
-    const key_schema = [_]types.KeySchemaElement{
+    const key_schema = [_]types.KeySchemaElement{.{ .attribute_name = "pk", .key_type = .HASH }};
-        .{ .attribute_name = "pk", .key_type = .HASH },
+    const attr_defs = [_]types.AttributeDefinition{.{ .attribute_name = "pk", .attribute_type = .S }};
-    };
-    const attr_defs = [_]types.AttributeDefinition{
-        .{ .attribute_name = "pk", .attribute_type = .S },
-    };
 
     _ = try engine.createTable("BenchTable", &key_schema, &attr_defs);
 
-    // Write data first
     const ops: u64 = 5000;
-    var item_buf: [512]u8 = undefined;
-
     var i: u64 = 0;
     while (i < ops) : (i += 1) {
-        const item = try std.fmt.bufPrint(&item_buf, "{{\"pk\":{{\"S\":\"user{d:0>10}\"}},\"data\":{{\"S\":\"test\"}}}}", .{i});
+        var item = types.Item.init(allocator);
-        try engine.putItem("BenchTable", item);
+        defer json.deinitItem(&item, allocator);
+
+        var pk_buf: [32]u8 = undefined;
+        const pk_str = std.fmt.bufPrint(&pk_buf, "user{d:0>10}", .{i}) catch continue;
+        const pk_owned = allocator.dupe(u8, pk_str) catch continue;
+        const pk_name = allocator.dupe(u8, "pk") catch continue;
+        item.put(pk_name, types.AttributeValue{ .S = pk_owned }) catch continue;
+
+        engine.putItem("BenchTable", item) catch {};
     }
 
-    // Benchmark scan
     const start = std.time.nanoTimestamp();
-    const items = try engine.scan("BenchTable", null);
+    var result_scan = try engine.scan("BenchTable", null, null);
     const end = std.time.nanoTimestamp();
 
-    // Cleanup
+    result_scan.deinit(allocator);
-    for (items) |item| allocator.free(item);
-    allocator.free(items);
 
-    const result = BenchResult{
+    const result = BenchResult{ .name = "Scan (full table)", .ops = ops, .duration_ns = @intCast(end - start) };
-        .name = "Scan (full table)",
-        .ops = ops,
-        .duration_ns = @intCast(end - start),
-    };
     result.print();
 }

src/dynamodb/expression.zig

@@ -0,0 +1,491 @@
+/// DynamoDB Expression Parser
+/// Parses KeyConditionExpression, FilterExpression, ProjectionExpression, etc.
+/// Replaces the temporary string-search hack with proper expression parsing.
+const std = @import("std");
+const types = @import("types.zig");
+const json_module = @import("json.zig");
+
+// ============================================================================
+// Key Condition Expression Parsing
+// ============================================================================
+
+/// Parsed key condition for Query operations
+pub const KeyCondition = struct {
+    /// Partition key attribute name (from ExpressionAttributeNames or direct)
+    pk_name: []const u8,
+    /// Partition key value (owned)
+    pk_value: types.AttributeValue,
+    /// Sort key condition (optional)
+    sk_condition: ?SortKeyCondition,
+
+    pub fn deinit(self: *KeyCondition, allocator: std.mem.Allocator) void {
+        json_module.deinitAttributeValue(&self.pk_value, allocator);
+        if (self.sk_condition) |*sk| {
+            sk.deinit(allocator);
+        }
+    }
+
+    /// Get the raw partition key value bytes (for building storage keys)
+    pub fn getPkBytes(self: *const KeyCondition) ![]const u8 {
+        return switch (self.pk_value) {
+            .S => |s| s,
+            .N => |n| n,
+            .B => |b| b,
+            else => error.InvalidKeyType,
+        };
+    }
+};
+
+/// Sort key condition operators
+pub const SortKeyOperator = enum {
+    EQ, // =
+    LT, // <
+    LE, // <=
+    GT, // >
+    GE, // >=
+    BETWEEN, // BETWEEN x AND y
+    BEGINS_WITH, // begins_with(sk, prefix)
+};
+
+/// Parsed sort key condition
+pub const SortKeyCondition = struct {
+    /// Sort key attribute name
+    sk_name: []const u8,
+    /// Comparison operator
+    operator: SortKeyOperator,
+    /// Primary value (or lower bound for BETWEEN) - owned
+    value: types.AttributeValue,
+    /// Upper bound for BETWEEN operator - owned
+    value2: ?types.AttributeValue,
+
+    pub fn deinit(self: *SortKeyCondition, allocator: std.mem.Allocator) void {
+        json_module.deinitAttributeValue(&self.value, allocator);
+        if (self.value2) |*v2| {
+            json_module.deinitAttributeValue(v2, allocator);
+        }
+    }
+};
+
+/// Parse a KeyConditionExpression with ExpressionAttributeNames and ExpressionAttributeValues
+/// Returns owned KeyCondition - caller must call deinit()
+///
+/// Supported formats:
+/// - "pk = :pk"
+/// - "#pk = :pk"
+/// - "pk = :pk AND sk = :sk"
+/// - "pk = :pk AND sk > :sk"
+/// - "pk = :pk AND sk BETWEEN :sk1 AND :sk2"
+/// - "pk = :pk AND begins_with(sk, :prefix)"
+pub fn parseKeyConditionExpression(
+    allocator: std.mem.Allocator,
+    expression: []const u8,
+    attribute_names: ?std.StringHashMap([]const u8),
+    attribute_values: std.StringHashMap(types.AttributeValue),
+) !KeyCondition {
+    var tokenizer = Tokenizer.init(expression);
+
+    // Parse partition key condition: pk_name = :pk_value
+    const pk_name_token = tokenizer.nextToken() orelse return error.InvalidExpression;
+    const pk_name = resolveAttributeName(pk_name_token, attribute_names) orelse return error.InvalidExpression;
+
+    const eq_token = tokenizer.nextToken() orelse return error.InvalidExpression;
+    if (!std.mem.eql(u8, eq_token, "=")) return error.InvalidExpression;
+
+    const pk_value_token = tokenizer.nextToken() orelse return error.InvalidExpression;
+    var pk_value = try resolveAttributeValue(allocator, pk_value_token, attribute_values);
+    errdefer json_module.deinitAttributeValue(&pk_value, allocator);
+
+    // Check for AND (sort key condition)
+    var sk_condition: ?SortKeyCondition = null;
+    if (tokenizer.nextToken()) |and_token| {
+        if (!std.ascii.eqlIgnoreCase(and_token, "AND")) {
+            return error.InvalidExpression;
+        }
+
+        sk_condition = try parseSortKeyCondition(allocator, &tokenizer, attribute_names, attribute_values);
+    }
+
+    return KeyCondition{
+        .pk_name = pk_name,
+        .pk_value = pk_value,
+        .sk_condition = sk_condition,
+    };
+}
+
+fn parseSortKeyCondition(
+    allocator: std.mem.Allocator,
+    tokenizer: *Tokenizer,
+    attribute_names: ?std.StringHashMap([]const u8),
+    attribute_values: std.StringHashMap(types.AttributeValue),
+) !SortKeyCondition {
+    const first_token = tokenizer.nextToken() orelse return error.InvalidExpression;
+
+    // Check for begins_with(sk, :value)
+    if (std.ascii.eqlIgnoreCase(first_token, "begins_with")) {
+        return try parseBeginsWith(allocator, tokenizer, attribute_names, attribute_values);
+    }
+
+    // Otherwise it's: sk_name operator :value
+    const sk_name = resolveAttributeName(first_token, attribute_names) orelse return error.InvalidExpression;
+
+    const op_token = tokenizer.nextToken() orelse return error.InvalidExpression;
+    const operator = parseOperator(op_token) orelse return error.InvalidExpression;
+
+    const value_token = tokenizer.nextToken() orelse return error.InvalidExpression;
+    var value = try resolveAttributeValue(allocator, value_token, attribute_values);
+    errdefer json_module.deinitAttributeValue(&value, allocator);
+
+    // Check for BETWEEN ... AND ...
+    var value2: ?types.AttributeValue = null;
+    if (operator == .BETWEEN) {
+        const and_token = tokenizer.nextToken() orelse return error.InvalidExpression;
+        if (!std.ascii.eqlIgnoreCase(and_token, "AND")) {
+            return error.InvalidExpression;
+        }
+
+        const value2_token = tokenizer.nextToken() orelse return error.InvalidExpression;
+        value2 = try resolveAttributeValue(allocator, value2_token, attribute_values);
+    }
+
+    return SortKeyCondition{
+        .sk_name = sk_name,
+        .operator = operator,
+        .value = value,
+        .value2 = value2,
+    };
+}
+
+fn parseBeginsWith(
+    allocator: std.mem.Allocator,
+    tokenizer: *Tokenizer,
+    attribute_names: ?std.StringHashMap([]const u8),
+    attribute_values: std.StringHashMap(types.AttributeValue),
+) !SortKeyCondition {
+    // Expect: ( sk_name , :value )
+    const lparen = tokenizer.nextToken() orelse return error.InvalidExpression;
+    if (!std.mem.eql(u8, lparen, "(")) return error.InvalidExpression;
+
+    const sk_name_token = tokenizer.nextToken() orelse return error.InvalidExpression;
+    const sk_name = resolveAttributeName(sk_name_token, attribute_names) orelse return error.InvalidExpression;
+
+    const comma = tokenizer.nextToken() orelse return error.InvalidExpression;
+    if (!std.mem.eql(u8, comma, ",")) return error.InvalidExpression;
+
+    const value_token = tokenizer.nextToken() orelse return error.InvalidExpression;
+    var value = try resolveAttributeValue(allocator, value_token, attribute_values);
+    errdefer json_module.deinitAttributeValue(&value, allocator);
+
+    const rparen = tokenizer.nextToken() orelse return error.InvalidExpression;
+    if (!std.mem.eql(u8, rparen, ")")) return error.InvalidExpression;
+
+    return SortKeyCondition{
+        .sk_name = sk_name,
+        .operator = .BEGINS_WITH,
+        .value = value,
+        .value2 = null,
+    };
+}
+
+fn parseOperator(token: []const u8) ?SortKeyOperator {
+    if (std.mem.eql(u8, token, "=")) return .EQ;
+    if (std.mem.eql(u8, token, "<")) return .LT;
+    if (std.mem.eql(u8, token, "<=")) return .LE;
+    if (std.mem.eql(u8, token, ">")) return .GT;
+    if (std.mem.eql(u8, token, ">=")) return .GE;
+    if (std.ascii.eqlIgnoreCase(token, "BETWEEN")) return .BETWEEN;
+    return null;
+}
+
+fn resolveAttributeName(token: []const u8, names: ?std.StringHashMap([]const u8)) ?[]const u8 {
+    if (token.len > 0 and token[0] == '#') {
+        // Expression attribute name placeholder
+        if (names) |n| {
+            return n.get(token);
+        }
+        return null;
+    }
+    // Direct attribute name
+    return token;
+}
+
+fn resolveAttributeValue(
+    allocator: std.mem.Allocator,
+    token: []const u8,
+    values: std.StringHashMap(types.AttributeValue),
+) !types.AttributeValue {
+    if (token.len > 0 and token[0] == ':') {
+        // Expression attribute value placeholder
+        const original = values.get(token) orelse return error.MissingAttributeValue;
+        return try json_module.deepCopyAttributeValue(allocator, original);
+    }
+    return error.InvalidExpression;
+}
+
+// ============================================================================
+// Request Parsing Helpers
+// ============================================================================
+
+/// Parse ExpressionAttributeNames from request body
+/// Returns null if not present
+pub fn parseExpressionAttributeNames(
+    allocator: std.mem.Allocator,
+    request_body: []const u8,
+) !?std.StringHashMap([]const u8) {
+    const parsed = std.json.parseFromSlice(std.json.Value, allocator, request_body, .{}) catch return null;
+    defer parsed.deinit();
+
+    const root = switch (parsed.value) {
+        .object => |o| o,
+        else => return null,
+    };
+
+    const names_val = root.get("ExpressionAttributeNames") orelse return null;
+    const names_obj = switch (names_val) {
+        .object => |o| o,
+        else => return null,
+    };
+
+    var result = std.StringHashMap([]const u8).init(allocator);
+    errdefer {
+        var iter = result.iterator();
+        while (iter.next()) |entry| {
+            allocator.free(entry.key_ptr.*);
+            allocator.free(entry.value_ptr.*);
+        }
+        result.deinit();
+    }
+
+    var iter = names_obj.iterator();
+    while (iter.next()) |entry| {
+        const key = try allocator.dupe(u8, entry.key_ptr.*);
+        errdefer allocator.free(key);
+
+        const value = switch (entry.value_ptr.*) {
+            .string => |s| try allocator.dupe(u8, s),
+            else => {
+                allocator.free(key);
+                continue;
+            },
+        };
+
+        try result.put(key, value);
+    }
+
+    return result;
+}
+
+/// Parse ExpressionAttributeValues from request body
+/// Returns owned HashMap - caller must free
+pub fn parseExpressionAttributeValues(
+    allocator: std.mem.Allocator,
+    request_body: []const u8,
+) !std.StringHashMap(types.AttributeValue) {
+    const parsed = std.json.parseFromSlice(std.json.Value, allocator, request_body, .{}) catch
+        return std.StringHashMap(types.AttributeValue).init(allocator);
+    defer parsed.deinit();
+
+    const root = switch (parsed.value) {
+        .object => |o| o,
+        else => return std.StringHashMap(types.AttributeValue).init(allocator),
+    };
+
+    const values_val = root.get("ExpressionAttributeValues") orelse
+        return std.StringHashMap(types.AttributeValue).init(allocator);
+    const values_obj = switch (values_val) {
+        .object => |o| o,
+        else => return std.StringHashMap(types.AttributeValue).init(allocator),
+    };
+
+    var result = std.StringHashMap(types.AttributeValue).init(allocator);
+    errdefer {
+        var iter = result.iterator();
+        while (iter.next()) |entry| {
+            allocator.free(entry.key_ptr.*);
+            json_module.deinitAttributeValue(entry.value_ptr, allocator);
+        }
+        result.deinit();
+    }
+
+    var iter = values_obj.iterator();
+    while (iter.next()) |entry| {
+        const key = try allocator.dupe(u8, entry.key_ptr.*);
+        errdefer allocator.free(key);
+
+        var value = json_module.parseAttributeValue(allocator, entry.value_ptr.*) catch continue;
+        errdefer json_module.deinitAttributeValue(&value, allocator);
+
+        try result.put(key, value);
+    }
+
+    return result;
+}
+
+/// Parse KeyConditionExpression string from request body
+pub fn parseKeyConditionExpressionString(
+    request_body: []const u8,
+) ?[]const u8 {
+    // Use a simple search to avoid allocation for this common operation
+    const marker = "\"KeyConditionExpression\"";
+    const start_idx = std.mem.indexOf(u8, request_body, marker) orelse return null;
+
+    // Find the colon after the key
+    const colon_idx = std.mem.indexOfPos(u8, request_body, start_idx + marker.len, ":") orelse return null;
+
+    // Find the opening quote
+    var pos = colon_idx + 1;
+    while (pos < request_body.len and request_body[pos] != '"') : (pos += 1) {}
+    if (pos >= request_body.len) return null;
+    pos += 1; // Skip opening quote
+
+    // Find the closing quote (handle escaped quotes)
+    const value_start = pos;
+    while (pos < request_body.len) {
+        if (request_body[pos] == '"' and (pos == 0 or request_body[pos - 1] != '\\')) {
+            return request_body[value_start..pos];
+        }
+        pos += 1;
+    }
+
+    return null;
+}
+
+/// Convenience function to parse and evaluate a complete Query key condition
+/// Returns owned KeyCondition - caller must call deinit()
+pub fn parseQueryKeyCondition(
+    allocator: std.mem.Allocator,
+    request_body: []const u8,
+) !?KeyCondition {
+    // Parse expression string
+    const expression = parseKeyConditionExpressionString(request_body) orelse return null;
+
+    // Parse attribute names (optional)
+    var attr_names = try parseExpressionAttributeNames(allocator, request_body);
+    defer if (attr_names) |*names| {
+        deinitExpressionAttributeNames(names, allocator);
+    };
+
+    // Parse attribute values
+    var attr_values = try parseExpressionAttributeValues(allocator, request_body);
+    defer deinitExpressionAttributeValues(&attr_values, allocator);
+
+    return try parseKeyConditionExpression(allocator, expression, attr_names, attr_values);
+}
+
+// ============================================================================
+// Simple Tokenizer
+// ============================================================================
+
+const Tokenizer = struct {
+    input: []const u8,
+    pos: usize,
+
+    pub fn init(input: []const u8) Tokenizer {
+        return .{ .input = input, .pos = 0 };
+    }
+
+    pub fn nextToken(self: *Tokenizer) ?[]const u8 {
+        // Skip whitespace
+        while (self.pos < self.input.len and std.ascii.isWhitespace(self.input[self.pos])) {
+            self.pos += 1;
+        }
+
+        if (self.pos >= self.input.len) return null;
+
+        const start = self.pos;
+
+        // Single-character tokens
+        const c = self.input[self.pos];
+        if (c == '(' or c == ')' or c == ',') {
+            self.pos += 1;
+            return self.input[start..self.pos];
+        }
+
+        // Two-character operators
+        if (self.pos + 1 < self.input.len) {
+            const two = self.input[self.pos .. self.pos + 2];
+            if (std.mem.eql(u8, two, "<=") or std.mem.eql(u8, two, ">=") or std.mem.eql(u8, two, "<>")) {
+                self.pos += 2;
+                return two;
+            }
+        }
+
+        // Single-character operators
+        if (c == '=' or c == '<' or c == '>') {
+            self.pos += 1;
+            return self.input[start..self.pos];
+        }
+
+        // Identifier or keyword (includes :placeholder and #name)
+        while (self.pos < self.input.len) {
+            const ch = self.input[self.pos];
+            if (std.ascii.isAlphanumeric(ch) or ch == '_' or ch == ':' or ch == '#' or ch == '-') {
+                self.pos += 1;
+            } else {
+                break;
+            }
+        }
+
+        if (self.pos > start) {
+            return self.input[start..self.pos];
+        }
+
+        // Unknown character, skip it
+        self.pos += 1;
+        return self.nextToken();
+    }
+};
+
+// ============================================================================
+// Helpers for freeing parsed expression data
+// ============================================================================
+
+pub fn deinitExpressionAttributeNames(names: *std.StringHashMap([]const u8), allocator: std.mem.Allocator) void {
+    var iter = names.iterator();
+    while (iter.next()) |entry| {
+        allocator.free(entry.key_ptr.*);
+        allocator.free(entry.value_ptr.*);
+    }
+    names.deinit();
+}
+
+pub fn deinitExpressionAttributeValues(values: *std.StringHashMap(types.AttributeValue), allocator: std.mem.Allocator) void {
+    var iter = values.iterator();
+    while (iter.next()) |entry| {
+        allocator.free(entry.key_ptr.*);
+        json_module.deinitAttributeValue(entry.value_ptr, allocator);
+    }
+    values.deinit();
+}
+
+// ============================================================================
+// Tests
+// ============================================================================
+
+test "tokenizer basic" {
+    var t = Tokenizer.init("pk = :pk AND sk > :sk");
+
+    try std.testing.expectEqualStrings("pk", t.nextToken().?);
+    try std.testing.expectEqualStrings("=", t.nextToken().?);
+    try std.testing.expectEqualStrings(":pk", t.nextToken().?);
+    try std.testing.expectEqualStrings("AND", t.nextToken().?);
+    try std.testing.expectEqualStrings("sk", t.nextToken().?);
+    try std.testing.expectEqualStrings(">", t.nextToken().?);
+    try std.testing.expectEqualStrings(":sk", t.nextToken().?);
+    try std.testing.expect(t.nextToken() == null);
+}
+
+test "tokenizer begins_with" {
+    var t = Tokenizer.init("pk = :pk AND begins_with(sk, :prefix)");
+
+    try std.testing.expectEqualStrings("pk", t.nextToken().?);
+    try std.testing.expectEqualStrings("=", t.nextToken().?);
+    try std.testing.expectEqualStrings(":pk", t.nextToken().?);
+    try std.testing.expectEqualStrings("AND", t.nextToken().?);
+    try std.testing.expectEqualStrings("begins_with", t.nextToken().?);
+    try std.testing.expectEqualStrings("(", t.nextToken().?);
+    try std.testing.expectEqualStrings("sk", t.nextToken().?);
+    try std.testing.expectEqualStrings(",", t.nextToken().?);
+    try std.testing.expectEqualStrings(":prefix", t.nextToken().?);
+    try std.testing.expectEqualStrings(")", t.nextToken().?);
+    try std.testing.expect(t.nextToken() == null);
+}

src/dynamodb/handler.zig

@@ -1,62 +1,61 @@
-/// DynamoDB API request handlers
+/// DynamoDB API request handlers with proper concurrency support
+/// - Uses request-scoped arena allocator for temporary allocations
+/// - Proper expression parsing for Query operations
+/// - Correct key type reconstruction for pagination
 const std = @import("std");
 const http = @import("../http.zig");
 const storage = @import("storage.zig");
 const types = @import("types.zig");
 const json = @import("json.zig");
+const expression = @import("expression.zig");
+const key_codec = @import("../key_codec.zig");
 
 pub const ApiHandler = struct {
     engine: *storage.StorageEngine,
-    allocator: std.mem.Allocator,
+    main_allocator: std.mem.Allocator,
 
     const Self = @This();
 
-    pub fn init(allocator: std.mem.Allocator, engine: *storage.StorageEngine) Self {
+    pub fn init(main_allocator: std.mem.Allocator, engine: *storage.StorageEngine) Self {
-        return .{
+        return .{ .engine = engine, .main_allocator = main_allocator };
-            .engine = engine,
-            .allocator = allocator,
-        };
     }
 
-    pub fn handle(self: *Self, request: *const http.Request) http.Response {
+    pub fn handleRequest(ctx: *anyopaque, request: *const http.Request, request_alloc: std.mem.Allocator) http.Response {
-        var response = http.Response.init(self.allocator);
+        const self: *Self = @ptrCast(@alignCast(ctx));
+        return self.handle(request, request_alloc);
+    }
 
-        // Add standard DynamoDB headers
+    fn handle(self: *Self, request: *const http.Request, request_alloc: std.mem.Allocator) http.Response {
+        var response = http.Response.init(request_alloc);
         response.addHeader("Content-Type", "application/x-amz-json-1.0") catch {};
         response.addHeader("x-amzn-RequestId", "local-request-id") catch {};
 
-        // Get operation from X-Amz-Target header
         const target = request.getHeader("X-Amz-Target") orelse {
-            return self.errorResponse(&response, .ValidationException, "Missing X-Amz-Target header");
+            return self.errorResponse(&response, .ValidationException, "Missing X-Amz-Target header", request_alloc);
         };
 
         const operation = types.Operation.fromTarget(target);
 
         switch (operation) {
-            .CreateTable => self.handleCreateTable(request, &response),
+            .CreateTable => self.handleCreateTable(request, &response, request_alloc),
-            .DeleteTable => self.handleDeleteTable(request, &response),
+            .DeleteTable => self.handleDeleteTable(request, &response, request_alloc),
-            .DescribeTable => self.handleDescribeTable(request, &response),
+            .DescribeTable => self.handleDescribeTable(request, &response, request_alloc),
-            .ListTables => self.handleListTables(request, &response),
+            .ListTables => self.handleListTables(request, &response, request_alloc),
-            .PutItem => self.handlePutItem(request, &response),
+            .PutItem => self.handlePutItem(request, &response, request_alloc),
-            .GetItem => self.handleGetItem(request, &response),
+            .GetItem => self.handleGetItem(request, &response, request_alloc),
-            .DeleteItem => self.handleDeleteItem(request, &response),
+            .DeleteItem => self.handleDeleteItem(request, &response, request_alloc),
-            .Query => self.handleQuery(request, &response),
+            .Query => self.handleQuery(request, &response, request_alloc),
-            .Scan => self.handleScan(request, &response),
+            .Scan => self.handleScan(request, &response, request_alloc),
-            .Unknown => {
+            .Unknown => return self.errorResponse(&response, .ValidationException, "Unknown operation", request_alloc),
-                return self.errorResponse(&response, .ValidationException, "Unknown operation");
+            else => return self.errorResponse(&response, .ValidationException, "Operation not implemented", request_alloc),
-            },
-            else => {
-                return self.errorResponse(&response, .ValidationException, "Operation not implemented");
-            },
         }
 
         return response;
     }
 
-    fn handleCreateTable(self: *Self, request: *const http.Request, response: *http.Response) void {
+    fn handleCreateTable(self: *Self, request: *const http.Request, response: *http.Response, request_alloc: std.mem.Allocator) void {
-        // Parse the entire request body properly
+        const parsed = std.json.parseFromSlice(std.json.Value, request_alloc, request.body, .{}) catch {
-        const parsed = std.json.parseFromSlice(std.json.Value, self.allocator, request.body, .{}) catch {
+            _ = self.errorResponse(response, .ValidationException, "Invalid JSON", request_alloc);
-            _ = self.errorResponse(response, .ValidationException, "Invalid JSON");
             return;
         };
         defer parsed.deinit();
@@ -64,127 +63,250 @@ pub const ApiHandler = struct {
         const root = switch (parsed.value) {
             .object => |o| o,
             else => {
-                _ = self.errorResponse(response, .ValidationException, "Request must be an object");
+                _ = self.errorResponse(response, .ValidationException, "Request must be an object", request_alloc);
                 return;
             },
         };
 
-        // Extract TableName
         const table_name_val = root.get("TableName") orelse {
-            _ = self.errorResponse(response, .ValidationException, "Missing TableName");
+            _ = self.errorResponse(response, .ValidationException, "Missing TableName", request_alloc);
             return;
         };
         const table_name = switch (table_name_val) {
             .string => |s| s,
             else => {
-                _ = self.errorResponse(response, .ValidationException, "TableName must be a string");
+                _ = self.errorResponse(response, .ValidationException, "TableName must be a string", request_alloc);
                 return;
             },
         };
 
-        // For now, use simplified key schema (you can enhance this later to parse from request)
+        const key_schema = self.parseKeySchema(root, request_alloc) catch |err| {
-        const key_schema = [_]types.KeySchemaElement{
+            const msg = switch (err) {
-            .{ .attribute_name = "pk", .key_type = .HASH },
+                error.MissingKeySchema => "Missing KeySchema",
+                error.InvalidKeySchema => "Invalid KeySchema format",
+                error.NoHashKey => "KeySchema must contain exactly one HASH key",
+                error.MultipleHashKeys => "KeySchema can only contain one HASH key",
+                error.MultipleRangeKeys => "KeySchema can only contain one RANGE key",
+                error.InvalidKeyType => "Invalid KeyType (must be HASH or RANGE)",
+                else => "Invalid KeySchema",
             };
-        const attr_defs = [_]types.AttributeDefinition{
+            _ = self.errorResponse(response, .ValidationException, msg, request_alloc);
-            .{ .attribute_name = "pk", .attribute_type = .S },
+            return;
         };
 
-        const desc = self.engine.createTable(table_name, &key_schema, &attr_defs) catch |err| {
+        const attr_defs = self.parseAttributeDefinitions(root, request_alloc) catch |err| {
+            const msg = switch (err) {
+                error.MissingAttributeDefinitions => "Missing AttributeDefinitions",
+                error.InvalidAttributeDefinitions => "Invalid AttributeDefinitions format",
+                error.InvalidAttributeType => "Invalid AttributeType (must be S, N, or B)",
+                error.DuplicateAttributeName => "Duplicate attribute name in AttributeDefinitions",
+                else => "Invalid AttributeDefinitions",
+            };
+            _ = self.errorResponse(response, .ValidationException, msg, request_alloc);
+            return;
+        };
+
+        self.validateKeyAttributesDefined(key_schema, attr_defs) catch |err| {
+            const msg = switch (err) {
+                error.KeyAttributeNotDefined => "Key attribute not defined in AttributeDefinitions",
+                else => "Schema validation failed",
+            };
+            _ = self.errorResponse(response, .ValidationException, msg, request_alloc);
+            return;
+        };
+
+        const desc = self.engine.createTable(table_name, key_schema, attr_defs) catch |err| {
             switch (err) {
                 storage.StorageError.TableAlreadyExists => {
-                    _ = self.errorResponse(response, .ResourceInUseException, "Table already exists");
+                    _ = self.errorResponse(response, .ResourceInUseException, "Table already exists", request_alloc);
                 },
                 else => {
-                    _ = self.errorResponse(response, .InternalServerError, "Failed to create table");
+                    _ = self.errorResponse(response, .InternalServerError, "Failed to create table", request_alloc);
                 },
             }
             return;
         };
 
-        // Build response
         const resp_body = std.fmt.allocPrint(
-            self.allocator,
+            request_alloc,
             "{{\"TableDescription\":{{\"TableName\":\"{s}\",\"TableStatus\":\"{s}\",\"CreationDateTime\":{d}}}}}",
             .{ desc.table_name, desc.table_status.toString(), desc.creation_date_time },
         ) catch {
-            _ = self.errorResponse(response, .InternalServerError, "Serialization failed");
+            _ = self.errorResponse(response, .InternalServerError, "Serialization failed", request_alloc);
             return;
         };
-        defer self.allocator.free(resp_body);
 
         response.setBody(resp_body) catch {};
     }
 
-    fn handleDeleteTable(self: *Self, request: *const http.Request, response: *http.Response) void {
+    fn parseKeySchema(self: *Self, root: std.json.ObjectMap, allocator: std.mem.Allocator) ![]types.KeySchemaElement {
-        const table_name = json.parseTableName(self.allocator, request.body) catch {
+        _ = self;
-            _ = self.errorResponse(response, .ValidationException, "Invalid request or missing TableName");
+        const key_schema_val = root.get("KeySchema") orelse return error.MissingKeySchema;
+        const key_schema_array = switch (key_schema_val) {
+            .array => |a| a,
+            else => return error.InvalidKeySchema,
+        };
+
+        if (key_schema_array.items.len == 0 or key_schema_array.items.len > 2) return error.InvalidKeySchema;
+
+        var key_schema = std.ArrayList(types.KeySchemaElement).init(allocator);
+        errdefer {
+            for (key_schema.items) |ks| allocator.free(ks.attribute_name);
+            key_schema.deinit();
+        }
+
+        var hash_count: u32 = 0;
+        var range_count: u32 = 0;
+
+        for (key_schema_array.items) |item| {
+            const obj = switch (item) {
+                .object => |o| o,
+                else => return error.InvalidKeySchema,
+            };
+
+            const attr_name_val = obj.get("AttributeName") orelse return error.InvalidKeySchema;
+            const attr_name_str = switch (attr_name_val) {
+                .string => |s| s,
+                else => return error.InvalidKeySchema,
+            };
+            const attr_name = try allocator.dupe(u8, attr_name_str);
+            errdefer allocator.free(attr_name);
+
+            const key_type_val = obj.get("KeyType") orelse return error.InvalidKeySchema;
+            const key_type_str = switch (key_type_val) {
+                .string => |s| s,
+                else => return error.InvalidKeySchema,
+            };
+
+            const key_type = if (std.mem.eql(u8, key_type_str, "HASH")) types.KeyType.HASH else if (std.mem.eql(u8, key_type_str, "RANGE")) types.KeyType.RANGE else return error.InvalidKeyType;
+
+            switch (key_type) {
+                .HASH => hash_count += 1,
+                .RANGE => range_count += 1,
+            }
+            try key_schema.append(.{ .attribute_name = attr_name, .key_type = key_type });
+        }
+
+        if (hash_count == 0) return error.NoHashKey;
+        if (hash_count > 1) return error.MultipleHashKeys;
+        if (range_count > 1) return error.MultipleRangeKeys;
+
+        return key_schema.toOwnedSlice();
+    }
+
+    fn parseAttributeDefinitions(self: *Self, root: std.json.ObjectMap, allocator: std.mem.Allocator) ![]types.AttributeDefinition {
+        _ = self;
+        const attr_defs_val = root.get("AttributeDefinitions") orelse return error.MissingAttributeDefinitions;
+        const attr_defs_array = switch (attr_defs_val) {
+            .array => |a| a,
+            else => return error.InvalidAttributeDefinitions,
+        };
+
+        if (attr_defs_array.items.len == 0) return error.InvalidAttributeDefinitions;
+
+        var attr_defs = std.ArrayList(types.AttributeDefinition).init(allocator);
+        errdefer {
+            for (attr_defs.items) |ad| allocator.free(ad.attribute_name);
+            attr_defs.deinit();
+        }
+
+        var seen = std.StringHashMap(void).init(allocator);
+        defer seen.deinit();
+
+        for (attr_defs_array.items) |item| {
+            const obj = switch (item) {
+                .object => |o| o,
+                else => return error.InvalidAttributeDefinitions,
+            };
+
+            const attr_name_val = obj.get("AttributeName") orelse return error.InvalidAttributeDefinitions;
+            const attr_name_str = switch (attr_name_val) {
+                .string => |s| s,
+                else => return error.InvalidAttributeDefinitions,
+            };
+
+            if (seen.contains(attr_name_str)) return error.DuplicateAttributeName;
+            try seen.put(attr_name_str, {});
+
+            const attr_name = try allocator.dupe(u8, attr_name_str);
+            errdefer allocator.free(attr_name);
+
+            const attr_type_val = obj.get("AttributeType") orelse return error.InvalidAttributeDefinitions;
+            const attr_type_str = switch (attr_type_val) {
+                .string => |s| s,
+                else => return error.InvalidAttributeDefinitions,
+            };
+
+            const attr_type = if (std.mem.eql(u8, attr_type_str, "S")) types.ScalarAttributeType.S else if (std.mem.eql(u8, attr_type_str, "N")) types.ScalarAttributeType.N else if (std.mem.eql(u8, attr_type_str, "B")) types.ScalarAttributeType.B else return error.InvalidAttributeType;
+
+            try attr_defs.append(.{ .attribute_name = attr_name, .attribute_type = attr_type });
+        }
+
+        return attr_defs.toOwnedSlice();
+    }
+
+    fn validateKeyAttributesDefined(self: *Self, key_schema: []const types.KeySchemaElement, attr_defs: []const types.AttributeDefinition) !void {
+        _ = self;
+        for (key_schema) |key_elem| {
+            var found = false;
+            for (attr_defs) |attr_def| {
+                if (std.mem.eql(u8, key_elem.attribute_name, attr_def.attribute_name)) {
+                    found = true;
+                    break;
+                }
+            }
+            if (!found) return error.KeyAttributeNotDefined;
+        }
+    }
+
+    fn handleDeleteTable(self: *Self, request: *const http.Request, response: *http.Response, request_alloc: std.mem.Allocator) void {
+        const table_name = json.parseTableName(request_alloc, request.body) catch {
+            _ = self.errorResponse(response, .ValidationException, "Invalid request or missing TableName", request_alloc);
             return;
         };
 
         self.engine.deleteTable(table_name) catch |err| {
             switch (err) {
-                storage.StorageError.TableNotFound => {
+                storage.StorageError.TableNotFound => _ = self.errorResponse(response, .ResourceNotFoundException, "Table not found", request_alloc),
-                    _ = self.errorResponse(response, .ResourceNotFoundException, "Table not found");
+                else => _ = self.errorResponse(response, .InternalServerError, "Failed to delete table", request_alloc),
-                },
-                else => {
-                    _ = self.errorResponse(response, .InternalServerError, "Failed to delete table");
-                },
             }
             return;
         };
 
-        const resp_body = std.fmt.allocPrint(
+        const resp_body = std.fmt.allocPrint(request_alloc, "{{\"TableDescription\":{{\"TableName\":\"{s}\",\"TableStatus\":\"DELETING\"}}}}", .{table_name}) catch return;
-            self.allocator,
-            "{{\"TableDescription\":{{\"TableName\":\"{s}\",\"TableStatus\":\"DELETING\"}}}}",
-            .{table_name},
-        ) catch return;
-        defer self.allocator.free(resp_body);
-
         response.setBody(resp_body) catch {};
     }
 
-    fn handleDescribeTable(self: *Self, request: *const http.Request, response: *http.Response) void {
+    fn handleDescribeTable(self: *Self, request: *const http.Request, response: *http.Response, request_alloc: std.mem.Allocator) void {
-        const table_name = json.parseTableName(self.allocator, request.body) catch {
+        const table_name = json.parseTableName(request_alloc, request.body) catch {
-            _ = self.errorResponse(response, .ValidationException, "Invalid request or missing TableName");
+            _ = self.errorResponse(response, .ValidationException, "Invalid request or missing TableName", request_alloc);
             return;
         };
 
         const desc = self.engine.describeTable(table_name) catch |err| {
             switch (err) {
-                storage.StorageError.TableNotFound => {
+                storage.StorageError.TableNotFound => _ = self.errorResponse(response, .ResourceNotFoundException, "Table not found", request_alloc),
-                    _ = self.errorResponse(response, .ResourceNotFoundException, "Table not found");
+                else => _ = self.errorResponse(response, .InternalServerError, "Failed to describe table", request_alloc),
-                },
-                else => {
-                    _ = self.errorResponse(response, .InternalServerError, "Failed to describe table");
-                },
             }
             return;
         };
 
-        const resp_body = std.fmt.allocPrint(
+        const resp_body = std.fmt.allocPrint(request_alloc, "{{\"Table\":{{\"TableName\":\"{s}\",\"TableStatus\":\"{s}\",\"ItemCount\":{d},\"TableSizeBytes\":{d}}}}}", .{ desc.table_name, desc.table_status.toString(), desc.item_count, desc.table_size_bytes }) catch return;
-            self.allocator,
-            "{{\"Table\":{{\"TableName\":\"{s}\",\"TableStatus\":\"{s}\",\"ItemCount\":{d},\"TableSizeBytes\":{d}}}}}",
-            .{ desc.table_name, desc.table_status.toString(), desc.item_count, desc.table_size_bytes },
-        ) catch return;
-        defer self.allocator.free(resp_body);
-
         response.setBody(resp_body) catch {};
     }
 
-    fn handleListTables(self: *Self, request: *const http.Request, response: *http.Response) void {
+    fn handleListTables(self: *Self, request: *const http.Request, response: *http.Response, request_alloc: std.mem.Allocator) void {
         _ = request;
-
         const tables = self.engine.listTables() catch {
-            _ = self.errorResponse(response, .InternalServerError, "Failed to list tables");
+            _ = self.errorResponse(response, .InternalServerError, "Failed to list tables", request_alloc);
             return;
         };
         defer {
-            for (tables) |t| self.allocator.free(t);
+            for (tables) |t| self.main_allocator.free(t);
-            self.allocator.free(tables);
+            self.main_allocator.free(tables);
         }
 
-        var buf = std.ArrayList(u8).init(self.allocator);
+        var buf = std.ArrayList(u8).init(request_alloc);
         defer buf.deinit();
         const writer = buf.writer();
 
@@ -194,44 +316,32 @@ pub const ApiHandler = struct {
             writer.print("\"{s}\"", .{table}) catch return;
         }
         writer.writeAll("]}") catch return;
-
         response.setBody(buf.items) catch {};
     }
 
-    fn handlePutItem(self: *Self, request: *const http.Request, response: *http.Response) void {
+    fn handlePutItem(self: *Self, request: *const http.Request, response: *http.Response, request_alloc: std.mem.Allocator) void {
-        // Parse table name
+        const table_name = json.parseTableName(request_alloc, request.body) catch {
-        const table_name = json.parseTableName(self.allocator, request.body) catch {
+            _ = self.errorResponse(response, .ValidationException, "Invalid request or missing TableName", request_alloc);
-            _ = self.errorResponse(response, .ValidationException, "Invalid request or missing TableName");
             return;
         };
 
-        // Parse item using proper JSON parsing (not string extraction)
+        var item = json.parseItemFromRequest(request_alloc, request.body) catch |err| {
-        var item = json.parseItemFromRequest(self.allocator, request.body) catch |err| {
             const msg = switch (err) {
                 error.MissingItem => "Missing Item field",
                 error.InvalidRequest => "Invalid request format",
                 else => "Invalid Item format",
             };
-            _ = self.errorResponse(response, .ValidationException, msg);
+            _ = self.errorResponse(response, .ValidationException, msg, request_alloc);
             return;
         };
-        defer json.deinitItem(&item, self.allocator);
+        defer json.deinitItem(&item, request_alloc);
 
-        // Store the item (storage engine will serialize it canonically)
         self.engine.putItem(table_name, item) catch |err| {
             switch (err) {
-                storage.StorageError.TableNotFound => {
+                storage.StorageError.TableNotFound => _ = self.errorResponse(response, .ResourceNotFoundException, "Table not found", request_alloc),
-                    _ = self.errorResponse(response, .ResourceNotFoundException, "Table not found");
+                storage.StorageError.MissingKeyAttribute => _ = self.errorResponse(response, .ValidationException, "Item missing required key attribute", request_alloc),
-                },
+                storage.StorageError.InvalidKey => _ = self.errorResponse(response, .ValidationException, "Invalid key format", request_alloc),
-                storage.StorageError.MissingKeyAttribute => {
+                else => _ = self.errorResponse(response, .InternalServerError, "Failed to put item", request_alloc),
-                    _ = self.errorResponse(response, .ValidationException, "Item missing required key attribute");
-                },
-                storage.StorageError.InvalidKey, storage.StorageError.KeyValueContainsSeparator => {
-                    _ = self.errorResponse(response, .ValidationException, "Invalid key format or key contains ':' character (limitation will be removed in Phase 2)");
-                },
-                else => {
-                    _ = self.errorResponse(response, .InternalServerError, "Failed to put item");
-                },
             }
             return;
         };
@@ -239,94 +349,69 @@ pub const ApiHandler = struct {
         response.setBody("{}") catch {};
     }
 
-    fn handleGetItem(self: *Self, request: *const http.Request, response: *http.Response) void {
+    fn handleGetItem(self: *Self, request: *const http.Request, response: *http.Response, request_alloc: std.mem.Allocator) void {
-        // Parse table name
+        const table_name = json.parseTableName(request_alloc, request.body) catch {
-        const table_name = json.parseTableName(self.allocator, request.body) catch {
+            _ = self.errorResponse(response, .ValidationException, "Invalid request or missing TableName", request_alloc);
-            _ = self.errorResponse(response, .ValidationException, "Invalid request or missing TableName");
             return;
         };
 
-        // Parse key using proper JSON parsing
+        var key = json.parseKeyFromRequest(request_alloc, request.body) catch |err| {
-        var key = json.parseKeyFromRequest(self.allocator, request.body) catch |err| {
             const msg = switch (err) {
                 error.MissingKey => "Missing Key field",
                 error.InvalidRequest => "Invalid request format",
                 else => "Invalid Key format",
             };
-            _ = self.errorResponse(response, .ValidationException, msg);
+            _ = self.errorResponse(response, .ValidationException, msg, request_alloc);
             return;
         };
-        defer json.deinitItem(&key, self.allocator);
+        defer json.deinitItem(&key, request_alloc);
 
         const item = self.engine.getItem(table_name, key) catch |err| {
             switch (err) {
-                storage.StorageError.TableNotFound => {
+                storage.StorageError.TableNotFound => _ = self.errorResponse(response, .ResourceNotFoundException, "Table not found", request_alloc),
-                    _ = self.errorResponse(response, .ResourceNotFoundException, "Table not found");
+                storage.StorageError.MissingKeyAttribute => _ = self.errorResponse(response, .ValidationException, "Key missing required attributes", request_alloc),
-                },
+                storage.StorageError.InvalidKey => _ = self.errorResponse(response, .ValidationException, "Invalid key format", request_alloc),
-                storage.StorageError.MissingKeyAttribute => {
+                else => _ = self.errorResponse(response, .InternalServerError, "Failed to get item", request_alloc),
-                    _ = self.errorResponse(response, .ValidationException, "Key missing required attributes");
-                },
-                storage.StorageError.InvalidKey, storage.StorageError.KeyValueContainsSeparator => {
-                    _ = self.errorResponse(response, .ValidationException, "Invalid key format");
-                },
-                else => {
-                    _ = self.errorResponse(response, .InternalServerError, "Failed to get item");
-                },
             }
             return;
         };
 
         if (item) |i| {
-            defer json.deinitItem(&i, self.allocator);
+            defer json.deinitItem(&i, self.main_allocator);
-
+            const item_json = json.serializeItem(request_alloc, i) catch {
-            // Serialize item to canonical JSON for response
+                _ = self.errorResponse(response, .InternalServerError, "Failed to serialize item", request_alloc);
-            const item_json = json.serializeItem(self.allocator, i) catch {
-                _ = self.errorResponse(response, .InternalServerError, "Failed to serialize item");
                 return;
             };
-            defer self.allocator.free(item_json);
+            const resp = std.fmt.allocPrint(request_alloc, "{{\"Item\":{s}}}", .{item_json}) catch return;
-
-            const resp = std.fmt.allocPrint(self.allocator, "{{\"Item\":{s}}}", .{item_json}) catch return;
-            defer self.allocator.free(resp);
             response.setBody(resp) catch {};
         } else {
             response.setBody("{}") catch {};
         }
     }
 
-    fn handleDeleteItem(self: *Self, request: *const http.Request, response: *http.Response) void {
+    fn handleDeleteItem(self: *Self, request: *const http.Request, response: *http.Response, request_alloc: std.mem.Allocator) void {
-        // Parse table name
+        const table_name = json.parseTableName(request_alloc, request.body) catch {
-        const table_name = json.parseTableName(self.allocator, request.body) catch {
+            _ = self.errorResponse(response, .ValidationException, "Invalid request or missing TableName", request_alloc);
-            _ = self.errorResponse(response, .ValidationException, "Invalid request or missing TableName");
             return;
         };
 
-        // Parse key using proper JSON parsing
+        var key = json.parseKeyFromRequest(request_alloc, request.body) catch |err| {
-        var key = json.parseKeyFromRequest(self.allocator, request.body) catch |err| {
             const msg = switch (err) {
                 error.MissingKey => "Missing Key field",
                 error.InvalidRequest => "Invalid request format",
                 else => "Invalid Key format",
             };
-            _ = self.errorResponse(response, .ValidationException, msg);
+            _ = self.errorResponse(response, .ValidationException, msg, request_alloc);
             return;
         };
-        defer json.deinitItem(&key, self.allocator);
+        defer json.deinitItem(&key, request_alloc);
 
         self.engine.deleteItem(table_name, key) catch |err| {
             switch (err) {
-                storage.StorageError.TableNotFound => {
+                storage.StorageError.TableNotFound => _ = self.errorResponse(response, .ResourceNotFoundException, "Table not found", request_alloc),
-                    _ = self.errorResponse(response, .ResourceNotFoundException, "Table not found");
+                storage.StorageError.MissingKeyAttribute => _ = self.errorResponse(response, .ValidationException, "Key missing required attributes", request_alloc),
-                },
+                storage.StorageError.InvalidKey => _ = self.errorResponse(response, .ValidationException, "Invalid key format", request_alloc),
-                storage.StorageError.MissingKeyAttribute => {
+                else => _ = self.errorResponse(response, .InternalServerError, "Failed to delete item", request_alloc),
-                    _ = self.errorResponse(response, .ValidationException, "Key missing required attributes");
-                },
-                storage.StorageError.InvalidKey, storage.StorageError.KeyValueContainsSeparator => {
-                    _ = self.errorResponse(response, .ValidationException, "Invalid key format");
-                },
-                else => {
-                    _ = self.errorResponse(response, .InternalServerError, "Failed to delete item");
-                },
             }
             return;
         };
@@ -334,79 +419,251 @@ pub const ApiHandler = struct {
         response.setBody("{}") catch {};
     }
 
-    fn handleQuery(self: *Self, request: *const http.Request, response: *http.Response) void {
+    // =========================================================================
-        // Parse table name
+    // FIX B: handleQuery previously had a use-after-free bug.
-        const table_name = json.parseTableName(self.allocator, request.body) catch {
+    //
-            _ = self.errorResponse(response, .ValidationException, "Invalid request or missing TableName");
+    // The old code did:
+    //   const pk_value = if (key_condition) |*kc| blk: {
+    //       defer kc.deinit(request_alloc);     // frees kc.pk_value's backing memory
+    //       break :blk kc.getPkBytes() catch ... // returns borrowed slice into kc.pk_value
+    //   };
+    //   engine.query(table_name, pk_value, ...)  // pk_value is dangling!
+    //
+    // getPkBytes() returns a borrowed pointer into kc.pk_value (e.g. the .S
+    // slice). But kc.deinit() frees that memory via deinitAttributeValue.
+    // So by the time we call engine.query(), pk_value points to freed memory.
+    //
+    // Fix: dupe the pk bytes into request_alloc before deiniting the
+    // key_condition, so pk_value survives for the engine.query() call.
+    // =========================================================================
+    fn handleQuery(self: *Self, request: *const http.Request, response: *http.Response, request_alloc: std.mem.Allocator) void {
+        const table_name = json.parseTableName(request_alloc, request.body) catch {
+            _ = self.errorResponse(response, .ValidationException, "Invalid request or missing TableName", request_alloc);
             return;
         };
 
-        // Simplified: extract partition key value from ExpressionAttributeValues
+        // Get table metadata for key schema and attribute definitions
-        // PHASE 6 TODO: Implement proper expression parsing
+        var metadata = self.engine.getTableMetadata(table_name) catch |err| {
-        const pk_value = extractSimpleValue(request.body, ":pk") orelse "default";
-
-        const items = self.engine.query(table_name, pk_value, null) catch |err| {
             switch (err) {
-                storage.StorageError.TableNotFound => {
+                storage.StorageError.TableNotFound => _ = self.errorResponse(response, .ResourceNotFoundException, "Table not found", request_alloc),
-                    _ = self.errorResponse(response, .ResourceNotFoundException, "Table not found");
+                else => _ = self.errorResponse(response, .InternalServerError, "Failed to access table", request_alloc),
-                },
-                else => {
-                    _ = self.errorResponse(response, .InternalServerError, "Query failed");
-                },
             }
             return;
         };
-        defer {
+        defer metadata.deinit(self.main_allocator);
-            for (items) |item| json.deinitItem(&item, self.allocator);
-            self.allocator.free(items);
-        }
 
-        self.writeItemsResponse(response, items);
+        // Parse KeyConditionExpression properly
-    }
+        var key_condition = expression.parseQueryKeyCondition(request_alloc, request.body) catch |err| {
-
+            const msg = switch (err) {
-    fn handleScan(self: *Self, request: *const http.Request, response: *http.Response) void {
+                error.InvalidExpression => "Invalid KeyConditionExpression",
-        // Parse table name
+                error.MissingAttributeValue => "Missing value in ExpressionAttributeValues",
-        const table_name = json.parseTableName(self.allocator, request.body) catch {
+                else => "Failed to parse KeyConditionExpression",
-            _ = self.errorResponse(response, .ValidationException, "Invalid request or missing TableName");
+            };
+            _ = self.errorResponse(response, .ValidationException, msg, request_alloc);
             return;
         };
 
-        const items = self.engine.scan(table_name, null) catch |err| {
+        // FIX B: Extract pk bytes and dupe them BEFORE deiniting key_condition.
+        // getPkBytes() returns a borrowed slice into kc.pk_value; we must copy
+        // it into request_alloc so it survives past kc.deinit().
+        const pk_value = if (key_condition) |*kc| blk: {
+            defer kc.deinit(request_alloc);
+
+            const borrowed_pk = kc.getPkBytes() catch {
+                _ = self.errorResponse(response, .ValidationException, "Invalid partition key type", request_alloc);
+                return;
+            };
+
+            // Dupe into request_alloc so it outlives kc.deinit()
+            break :blk request_alloc.dupe(u8, borrowed_pk) catch {
+                _ = self.errorResponse(response, .InternalServerError, "Allocation failed", request_alloc);
+                return;
+            };
+        } else {
+            _ = self.errorResponse(response, .ValidationException, "Missing KeyConditionExpression", request_alloc);
+            return;
+        };
+        // pk_value is now owned by request_alloc — safe to use until arena dies
+
+        const limit = json.parseLimit(request_alloc, request.body) catch null;
+
+        // Parse ExclusiveStartKey with proper type handling
+        var start_key_opt = json.parseExclusiveStartKey(request_alloc, request.body, metadata.key_schema) catch |err| {
+            const msg = switch (err) {
+                error.MissingKeyAttribute => "ExclusiveStartKey missing required attributes",
+                error.InvalidKeyType => "ExclusiveStartKey has invalid key type",
+                else => "Invalid ExclusiveStartKey format",
+            };
+            _ = self.errorResponse(response, .ValidationException, msg, request_alloc);
+            return;
+        };
+        defer if (start_key_opt) |*key| key.deinit(request_alloc);
+
+        var start_key_binary: ?[]u8 = null;
+        defer if (start_key_binary) |k| request_alloc.free(k);
+
+        if (start_key_opt) |start_key| {
+            const key_values = start_key.getValues() catch {
+                _ = self.errorResponse(response, .ValidationException, "Invalid ExclusiveStartKey", request_alloc);
+                return;
+            };
+            start_key_binary = key_codec.buildDataKey(request_alloc, table_name, key_values.pk, key_values.sk) catch {
+                _ = self.errorResponse(response, .InternalServerError, "Failed to encode start key", request_alloc);
+                return;
+            };
+        }
+
+        var result = self.engine.query(table_name, pk_value, limit, start_key_binary) catch |err| {
             switch (err) {
-                storage.StorageError.TableNotFound => {
+                storage.StorageError.TableNotFound => _ = self.errorResponse(response, .ResourceNotFoundException, "Table not found", request_alloc),
-                    _ = self.errorResponse(response, .ResourceNotFoundException, "Table not found");
+                else => _ = self.errorResponse(response, .InternalServerError, "Query failed", request_alloc),
-                },
-                else => {
-                    _ = self.errorResponse(response, .InternalServerError, "Scan failed");
-                },
             }
             return;
         };
-        defer {
+        defer result.deinit(self.main_allocator);
-            for (items) |item| json.deinitItem(&item, self.allocator);
+
-            self.allocator.free(items);
+        self.writeItemsResponseWithPagination(response, result.items, result.last_evaluated_key, &metadata, request_alloc);
     }
 
-        self.writeItemsResponse(response, items);
+    fn handleScan(self: *Self, request: *const http.Request, response: *http.Response, request_alloc: std.mem.Allocator) void {
+        const table_name = json.parseTableName(request_alloc, request.body) catch {
+            _ = self.errorResponse(response, .ValidationException, "Invalid request or missing TableName", request_alloc);
+            return;
+        };
+
+        var metadata = self.engine.getTableMetadata(table_name) catch |err| {
+            switch (err) {
+                storage.StorageError.TableNotFound => _ = self.errorResponse(response, .ResourceNotFoundException, "Table not found", request_alloc),
+                else => _ = self.errorResponse(response, .InternalServerError, "Failed to access table", request_alloc),
+            }
+            return;
+        };
+        defer metadata.deinit(self.main_allocator);
+
+        const limit = json.parseLimit(request_alloc, request.body) catch null;
+
+        var start_key_opt = json.parseExclusiveStartKey(request_alloc, request.body, metadata.key_schema) catch |err| {
+            const msg = switch (err) {
+                error.MissingKeyAttribute => "ExclusiveStartKey missing required attributes",
+                error.InvalidKeyType => "ExclusiveStartKey has invalid key type",
+                else => "Invalid ExclusiveStartKey format",
+            };
+            _ = self.errorResponse(response, .ValidationException, msg, request_alloc);
+            return;
+        };
+        defer if (start_key_opt) |*key| key.deinit(request_alloc);
+
+        var start_key_binary: ?[]u8 = null;
+        defer if (start_key_binary) |k| request_alloc.free(k);
+
+        if (start_key_opt) |start_key| {
+            const key_values = start_key.getValues() catch {
+                _ = self.errorResponse(response, .ValidationException, "Invalid ExclusiveStartKey", request_alloc);
+                return;
+            };
+            start_key_binary = key_codec.buildDataKey(request_alloc, table_name, key_values.pk, key_values.sk) catch {
+                _ = self.errorResponse(response, .InternalServerError, "Failed to encode start key", request_alloc);
+                return;
+            };
         }
 
-    fn writeItemsResponse(self: *Self, response: *http.Response, items: []const types.Item) void {
+        var result = self.engine.scan(table_name, limit, start_key_binary) catch |err| {
-        var buf = std.ArrayList(u8).init(self.allocator);
+            switch (err) {
+                storage.StorageError.TableNotFound => _ = self.errorResponse(response, .ResourceNotFoundException, "Table not found", request_alloc),
+                else => _ = self.errorResponse(response, .InternalServerError, "Scan failed", request_alloc),
+            }
+            return;
+        };
+        defer result.deinit(self.main_allocator);
+
+        self.writeItemsResponseWithPagination(response, result.items, result.last_evaluated_key, &metadata, request_alloc);
+    }
+
+    fn writeItemsResponseWithPagination(
+        self: *Self,
+        response: *http.Response,
+        items: []const types.Item,
+        last_evaluated_key_binary: ?[]const u8,
+        metadata: *const storage.TableMetadata,
+        request_alloc: std.mem.Allocator,
+    ) void {
+        var buf = std.ArrayList(u8).init(request_alloc);
         defer buf.deinit();
         const writer = buf.writer();
 
         writer.writeAll("{\"Items\":[") catch return;
         for (items, 0..) |item, i| {
             if (i > 0) writer.writeByte(',') catch return;
-            // Serialize each item to canonical JSON
+            json.serializeItemToWriter(writer, item, request_alloc) catch return;
-            json.serializeItemToWriter(writer, item) catch return;
         }
-        writer.print("],\"Count\":{d},\"ScannedCount\":{d}}}", .{ items.len, items.len }) catch return;
+        writer.print("],\"Count\":{d},\"ScannedCount\":{d}", .{ items.len, items.len }) catch return;
 
+        if (last_evaluated_key_binary) |binary_key| {
+            var key = self.buildKeyFromBinaryWithTypes(binary_key, metadata, request_alloc) catch {
+                writer.writeAll("}") catch {};
+                response.setBody(buf.items) catch {};
+                return;
+            };
+            defer key.deinit(request_alloc);
+
+            const lek_json = json.serializeLastEvaluatedKey(request_alloc, key, metadata.key_schema) catch {
+                writer.writeAll("}") catch {};
+                response.setBody(buf.items) catch {};
+                return;
+            };
+
+            writer.print(",\"LastEvaluatedKey\":{s}", .{lek_json}) catch {};
+        }
+
+        writer.writeAll("}") catch return;
         response.setBody(buf.items) catch {};
     }
 
-    fn errorResponse(self: *Self, response: *http.Response, err_type: types.DynamoDBErrorType, message: []const u8) http.Response {
+    /// Build a Key struct from binary storage key with correct attribute types
+    /// Uses attribute_definitions from metadata to determine S/N/B type
+    /// (Fix C: already uses metadata types — no change needed here)
+    fn buildKeyFromBinaryWithTypes(
+        self: *Self,
+        binary_key: []const u8,
+        metadata: *const storage.TableMetadata,
+        allocator: std.mem.Allocator,
+    ) !types.Key {
+        _ = self;
+        var decoder = key_codec.KeyDecoder.init(binary_key);
+
+        // Skip entity type
+        _ = try decoder.readEntityType();
+        // Skip table name
+        _ = try decoder.readSegmentBorrowed();
+
+        // Read partition key bytes
+        const pk_bytes = try decoder.readSegmentBorrowed();
+
+        // Read sort key bytes if present
+        var sk_bytes: ?[]const u8 = null;
+        if (decoder.hasMore()) {
+            sk_bytes = try decoder.readSegmentBorrowed();
+        }
+
+        // Get attribute types from metadata
+        const pk_name = metadata.getPartitionKeyName() orelse return error.InvalidKey;
+        const pk_type = metadata.getAttributeType(pk_name) orelse return error.InvalidKey;
+
+        const pk_attr = try buildAttributeValueWithType(allocator, pk_bytes, pk_type);
+        errdefer json.deinitAttributeValue(&pk_attr, allocator);
+
+        var sk_attr: ?types.AttributeValue = null;
+        if (sk_bytes) |sk| {
+            const sk_name = metadata.getSortKeyName() orelse return error.InvalidKey;
+            const sk_type = metadata.getAttributeType(sk_name) orelse return error.InvalidKey;
+            sk_attr = try buildAttributeValueWithType(allocator, sk, sk_type);
+        }
+
+        return types.Key{ .pk = pk_attr, .sk = sk_attr };
+    }
+
+    fn errorResponse(self: *Self, response: *http.Response, err_type: types.DynamoDBErrorType, message: []const u8, request_alloc: std.mem.Allocator) http.Response {
+        _ = self;
         response.setStatus(switch (err_type) {
             .ResourceNotFoundException => .not_found,
             .ResourceInUseException => .conflict,
@@ -414,39 +671,22 @@ pub const ApiHandler = struct {
             else => .internal_server_error,
         });
 
-        const body = err_type.toErrorResponse(message, self.allocator) catch return response.*;
+        const body = err_type.toErrorResponse(message, request_alloc) catch return response.*;
         response.setBody(body) catch {};
-        self.allocator.free(body);
         return response.*;
     }
 };
 
-/// Temporary helper for Query operation until we implement proper expression parsing in Phase 6
+/// Build an AttributeValue with the correct type (S, N, or B) from raw bytes
-/// PHASE 6 TODO: Replace with proper ExpressionAttributeValues parsing
+fn buildAttributeValueWithType(
-fn extractSimpleValue(json_data: []const u8, key: []const u8) ?[]const u8 {
+    allocator: std.mem.Allocator,
-    var search_buf: [256]u8 = undefined;
+    bytes: []const u8,
-    const search = std.fmt.bufPrint(&search_buf, "\"{s}\":\"", .{key}) catch return null;
+    attr_type: types.ScalarAttributeType,
-
+) !types.AttributeValue {
-    const start = std.mem.indexOf(u8, json_data, search) orelse return null;
+    const owned = try allocator.dupe(u8, bytes);
-    const value_start = start + search.len;
+    return switch (attr_type) {
-    const value_end = std.mem.indexOfPos(u8, json_data, value_start, "\"") orelse return null;
+        .S => types.AttributeValue{ .S = owned },
-    return json_data[value_start..value_end];
+        .N => types.AttributeValue{ .N = owned },
-}
+        .B => types.AttributeValue{ .B = owned },
-
+    };
-// Global handler for use with http.Server
-var global_handler: ?*ApiHandler = null;
-
-pub fn setGlobalHandler(handler: *ApiHandler) void {
-    global_handler = handler;
-}
-
-pub fn httpHandler(request: *const http.Request, allocator: std.mem.Allocator) http.Response {
-    if (global_handler) |h| {
-        return h.handle(request);
-    }
-
-    var response = http.Response.init(allocator);
-    response.setStatus(.internal_server_error);
-    response.setBody("{\"error\":\"Handler not initialized\"}") catch {};
-    return response;
 }

src/dynamodb/json.zig

@@ -241,15 +241,16 @@ pub fn serializeItem(allocator: std.mem.Allocator, item: types.Item) ![]u8 {
     errdefer buf.deinit();
     const writer = buf.writer();
 
-    try serializeItemToWriter(writer, item);
+    try serializeItemToWriter(writer, item, allocator);
 
     return buf.toOwnedSlice();
 }
 
 /// Serialize an Item to a writer with deterministic ordering
-pub fn serializeItemToWriter(writer: anytype, item: types.Item) !void {
+/// Uses the provided allocator for temporary key sorting (not page_allocator)
+pub fn serializeItemToWriter(writer: anytype, item: types.Item, allocator: std.mem.Allocator) !void {
     // Collect and sort keys for deterministic output
-    var keys = std.ArrayList([]const u8).init(std.heap.page_allocator);
+    var keys = std.ArrayList([]const u8).init(allocator);
     defer keys.deinit();
 
     var iter = item.iterator();
@@ -269,14 +270,13 @@ pub fn serializeItemToWriter(writer: anytype, item: types.Item) !void {
         if (i > 0) try writer.writeByte(',');
         try writer.print("\"{s}\":", .{key});
         const value = item.get(key).?;
-        try serializeAttributeValue(writer, value);
+        try serializeAttributeValue(writer, value, allocator);
     }
     try writer.writeByte('}');
 }
 
 /// Serialize an AttributeValue to DynamoDB JSON format
-/// Caller owns returned slice and must free it
+pub fn serializeAttributeValue(writer: anytype, attr: types.AttributeValue, allocator: std.mem.Allocator) !void {
-pub fn serializeAttributeValue(writer: anytype, attr: types.AttributeValue) !void {
     switch (attr) {
         .S => |s| try writer.print("{{\"S\":\"{s}\"}}", .{s}),
         .N => |n| try writer.print("{{\"N\":\"{s}\"}}", .{n}),
@@ -311,15 +311,15 @@ pub fn serializeAttributeValue(writer: anytype, attr: types.AttributeValue) !voi
             try writer.writeAll("{\"L\":[");
             for (list, 0..) |item, i| {
                 if (i > 0) try writer.writeByte(',');
-                try serializeAttributeValue(writer, item);
+                try serializeAttributeValue(writer, item, allocator);
             }
             try writer.writeAll("]}");
         },
         .M => |map| {
             try writer.writeAll("{\"M\":{");
 
-            // Collect and sort keys for deterministic output
+            // Collect and sort keys for deterministic output - use provided allocator
-            var keys = std.ArrayList([]const u8).init(std.heap.page_allocator);
+            var keys = std.ArrayList([]const u8).init(allocator);
             defer keys.deinit();
 
             var iter = map.iterator();
@@ -337,7 +337,7 @@ pub fn serializeAttributeValue(writer: anytype, attr: types.AttributeValue) !voi
                 if (i > 0) try writer.writeByte(',');
                 try writer.print("\"{s}\":", .{key});
                 const value = map.get(key).?;
-                try serializeAttributeValue(writer, value);
+                try serializeAttributeValue(writer, value, allocator);
             }
             try writer.writeAll("}}");
         },
@@ -397,6 +397,70 @@ pub fn parseKeyFromRequest(allocator: std.mem.Allocator, request_body: []const u
     return try parseItemFromValue(allocator, key_val);
 }
 
+// ============================================================================
+// Pagination Helpers
+// ============================================================================
+
+/// Parse ExclusiveStartKey from request body
+/// Returns null if not present, owned Key if present
+/// Caller must call key.deinit() when done
+pub fn parseExclusiveStartKey(
+    allocator: std.mem.Allocator,
+    request_body: []const u8,
+    key_schema: []const types.KeySchemaElement,
+) !?types.Key {
+    const parsed = try std.json.parseFromSlice(std.json.Value, allocator, request_body, .{});
+    defer parsed.deinit();
+
+    const root = switch (parsed.value) {
+        .object => |o| o,
+        else => return error.InvalidRequest,
+    };
+
+    const key_val = root.get("ExclusiveStartKey") orelse return null;
+
+    // Parse as Item first, then convert to Key
+    var key_item = try parseItemFromValue(allocator, key_val);
+    defer deinitItem(&key_item, allocator);
+
+    // Validate and extract key using Key.fromItem
+    return try types.Key.fromItem(allocator, key_item, key_schema);
+}
+
+/// Parse Limit from request body
+/// Returns null if not present
+pub fn parseLimit(allocator: std.mem.Allocator, request_body: []const u8) !?usize {
+    const parsed = try std.json.parseFromSlice(std.json.Value, allocator, request_body, .{});
+    defer parsed.deinit();
+
+    const root = switch (parsed.value) {
+        .object => |o| o,
+        else => return error.InvalidRequest,
+    };
+
+    const limit_val = root.get("Limit") orelse return null;
+    const limit_int = switch (limit_val) {
+        .integer => |i| i,
+        else => return error.InvalidLimit,
+    };
+
+    if (limit_int < 0) return error.InvalidLimit;
+    return @intCast(limit_int);
+}
+
+/// Serialize a Key as LastEvaluatedKey in DynamoDB JSON format
+/// Caller owns returned slice and must free it
+pub fn serializeLastEvaluatedKey(
+    allocator: std.mem.Allocator,
+    key: types.Key,
+    key_schema: []const types.KeySchemaElement,
+) ![]u8 {
+    var key_item = try key.toItem(allocator, key_schema);
+    defer deinitItem(&key_item, allocator);
+
+    return try serializeItem(allocator, key_item);
+}
+
 // ============================================================================
 // Storage Helpers
 // ============================================================================
@@ -404,6 +468,7 @@ pub fn parseKeyFromRequest(allocator: std.mem.Allocator, request_body: []const u
 /// Extract just the key attributes from an item based on key schema
 /// Returns a new Item containing only the key attributes (deep copied)
 /// Caller owns returned Item and must call deinitItem() when done
+/// DEPRECATED: Use types.Key.fromItem() instead
 pub fn extractKeyAttributes(
     allocator: std.mem.Allocator,
     item: types.Item,
@@ -420,7 +485,7 @@ pub fn extractKeyAttributes(
         errdefer allocator.free(attr_name);
 
         // Deep copy the attribute value
-        const copied_value = try deepCopyAttributeValue(allocator, attr_value);
+        var copied_value = try deepCopyAttributeValue(allocator, attr_value);
         errdefer deinitAttributeValue(&copied_value, allocator);
 
         try key.put(attr_name, copied_value);
@@ -430,7 +495,8 @@ pub fn extractKeyAttributes(
 }
 
 /// Deep copy an AttributeValue
-fn deepCopyAttributeValue(allocator: std.mem.Allocator, attr: types.AttributeValue) !types.AttributeValue {
+/// Made public for use by the Key struct and other modules
+pub fn deepCopyAttributeValue(allocator: std.mem.Allocator, attr: types.AttributeValue) !types.AttributeValue {
     return switch (attr) {
         .S => |s| types.AttributeValue{ .S = try allocator.dupe(u8, s) },
         .N => |n| types.AttributeValue{ .N = try allocator.dupe(u8, n) },
@@ -490,77 +556,6 @@ fn deepCopyAttributeValue(allocator: std.mem.Allocator, attr: types.AttributeVal
     };
 }
 
-/// Validate that a key attribute value doesn't contain the separator
-/// PHASE 2 TODO: Remove this validation once we implement proper binary key encoding
-/// with length-prefixed segments. Binary encoding will eliminate separator collision issues.
-fn validateKeyValue(value: []const u8) !void {
-    if (std.mem.indexOf(u8, value, ":")) |_| {
-        return error.KeyValueContainsSeparator;
-    }
-}
-
-/// Build a RocksDB storage key from table name and key attributes
-/// Format: _data:{table}:{pk} or _data:{table}:{pk}:{sk}
-///
-/// PHASE 2 TODO: Replace this textual key format with binary encoding:
-/// - Use length-prefixed segments: 0x01 | "data" | len(table) | table | len(pk) | pk | [len(sk) | sk]
-/// - This prevents separator collision and makes prefix scans reliable
-/// - Current limitation: key values cannot contain ':' character
-///
-/// Caller owns returned slice and must free it
-pub fn buildRocksDBKey(
-    allocator: std.mem.Allocator,
-    table_name: []const u8,
-    key_schema: []const types.KeySchemaElement,
-    key: types.Item,
-) ![]u8 {
-    const KeyPrefix = struct {
-        const data = "_data:";
-    };
-
-    // Find partition key and sort key
-    var pk_value: ?[]const u8 = null;
-    var sk_value: ?[]const u8 = null;
-
-    for (key_schema) |schema_element| {
-        const attr = key.get(schema_element.attribute_name) orelse
-            return error.MissingKeyAttribute;
-
-        // Extract string value from attribute
-        // DynamoDB keys must be S (string), N (number), or B (binary)
-        const value = switch (attr) {
-            .S => |s| s,
-            .N => |n| n,
-            .B => |b| b,
-            else => return error.InvalidKeyType,
-        };
-
-        // PHASE 2 TODO: Remove this validation - binary encoding handles all values
-        try validateKeyValue(value);
-
-        switch (schema_element.key_type) {
-            .HASH => pk_value = value,
-            .RANGE => sk_value = value,
-        }
-    }
-
-    const pk = pk_value orelse return error.MissingPartitionKey;
-
-    if (sk_value) |sk| {
-        return std.fmt.allocPrint(
-            allocator,
-            "{s}{s}:{s}:{s}",
-            .{ KeyPrefix.data, table_name, pk, sk },
-        );
-    } else {
-        return std.fmt.allocPrint(
-            allocator,
-            "{s}{s}:{s}",
-            .{ KeyPrefix.data, table_name, pk },
-        );
-    }
-}
-
 // ============================================================================
 // Memory Management
 // ============================================================================
@@ -584,7 +579,7 @@ pub fn deinitAttributeValue(attr: *types.AttributeValue, allocator: std.mem.Allo
         },
         .L => |list| {
             for (list) |*item| {
-                deinitAttributeValue(item, allocator);
+                deinitAttributeValue(@constCast(item), allocator);
             }
             allocator.free(list);
         },
@@ -601,206 +596,3 @@ pub fn deinitItem(item: *types.Item, allocator: std.mem.Allocator) void {
     }
     item.deinit();
 }
-
-// ============================================================================
-// Tests
-// ============================================================================
-
-test "parse simple string attribute" {
-    const allocator = std.testing.allocator;
-
-    const json_str = "{\"S\":\"hello world\"}";
-    const parsed = try std.json.parseFromSlice(std.json.Value, allocator, json_str, .{});
-    defer parsed.deinit();
-
-    var attr = try parseAttributeValue(allocator, parsed.value);
-    defer deinitAttributeValue(&attr, allocator);
-
-    try std.testing.expectEqualStrings("hello world", attr.S);
-}
-
-test "parse simple item" {
-    const allocator = std.testing.allocator;
-
-    const json_str =
-        \\{"pk":{"S":"user123"},"name":{"S":"Alice"},"age":{"N":"25"}}
-    ;
-
-    var item = try parseItem(allocator, json_str);
-    defer deinitItem(&item, allocator);
-
-    try std.testing.expectEqual(@as(usize, 3), item.count());
-
-    const pk = item.get("pk").?;
-    try std.testing.expectEqualStrings("user123", pk.S);
-
-    const name = item.get("name").?;
-    try std.testing.expectEqualStrings("Alice", name.S);
-
-    const age = item.get("age").?;
-    try std.testing.expectEqualStrings("25", age.N);
-}
-
-test "parseItemFromValue" {
-    const allocator = std.testing.allocator;
-
-    const json_str = "{\"pk\":{\"S\":\"test\"},\"data\":{\"N\":\"42\"}}";
-    const parsed = try std.json.parseFromSlice(std.json.Value, allocator, json_str, .{});
-    defer parsed.deinit();
-
-    var item = try parseItemFromValue(allocator, parsed.value);
-    defer deinitItem(&item, allocator);
-
-    try std.testing.expectEqual(@as(usize, 2), item.count());
-}
-
-test "parse nested map" {
-    const allocator = std.testing.allocator;
-
-    const json_str =
-        \\{"data":{"M":{"key1":{"S":"value1"},"key2":{"N":"42"}}}}
-    ;
-
-    var item = try parseItem(allocator, json_str);
-    defer deinitItem(&item, allocator);
-
-    const data = item.get("data").?;
-    const inner = data.M.get("key1").?;
-    try std.testing.expectEqualStrings("value1", inner.S);
-}
-
-test "serialize item with deterministic ordering" {
-    const allocator = std.testing.allocator;
-
-    const original =
-        \\{"pk":{"S":"test"},"num":{"N":"123"},"data":{"S":"value"}}
-    ;
-
-    var item = try parseItem(allocator, original);
-    defer deinitItem(&item, allocator);
-
-    const serialized = try serializeItem(allocator, item);
-    defer allocator.free(serialized);
-
-    // Keys should be alphabetically sorted: data, num, pk
-    const expected = "{\"data\":{\"S\":\"value\"},\"num\":{\"N\":\"123\"},\"pk\":{\"S\":\"test\"}}";
-    try std.testing.expectEqualStrings(expected, serialized);
-}
-
-test "serialize nested map with deterministic ordering" {
-    const allocator = std.testing.allocator;
-
-    const original =
-        \\{"outer":{"M":{"z":{"S":"last"},"a":{"S":"first"},"m":{"S":"middle"}}}}
-    ;
-
-    var item = try parseItem(allocator, original);
-    defer deinitItem(&item, allocator);
-
-    const serialized = try serializeItem(allocator, item);
-    defer allocator.free(serialized);
-
-    // Inner map keys should also be sorted: a, m, z
-    const expected = "{\"outer\":{\"M\":{\"a\":{\"S\":\"first\"},\"m\":{\"S\":\"middle\"},\"z\":{\"S\":\"last\"}}}}";
-    try std.testing.expectEqualStrings(expected, serialized);
-}
-
-test "build rocksdb key with partition key only" {
-    const allocator = std.testing.allocator;
-
-    const item_json = "{\"pk\":{\"S\":\"user123\"},\"data\":{\"S\":\"test\"}}";
-    var item = try parseItem(allocator, item_json);
-    defer deinitItem(&item, allocator);
-
-    const key_schema = [_]types.KeySchemaElement{
-        .{ .attribute_name = "pk", .key_type = .HASH },
-    };
-
-    const key = try buildRocksDBKey(allocator, "Users", &key_schema, item);
-    defer allocator.free(key);
-
-    try std.testing.expectEqualStrings("_data:Users:user123", key);
-}
-
-test "build rocksdb key with partition and sort keys" {
-    const allocator = std.testing.allocator;
-
-    const item_json = "{\"pk\":{\"S\":\"user123\"},\"sk\":{\"S\":\"metadata\"}}";
-    var item = try parseItem(allocator, item_json);
-    defer deinitItem(&item, allocator);
-
-    const key_schema = [_]types.KeySchemaElement{
-        .{ .attribute_name = "pk", .key_type = .HASH },
-        .{ .attribute_name = "sk", .key_type = .RANGE },
-    };
-
-    const key = try buildRocksDBKey(allocator, "Items", &key_schema, item);
-    defer allocator.free(key);
-
-    try std.testing.expectEqualStrings("_data:Items:user123:metadata", key);
-}
-
-test "reject key with separator" {
-    const allocator = std.testing.allocator;
-
-    const item_json = "{\"pk\":{\"S\":\"user:123\"},\"data\":{\"S\":\"test\"}}";
-    var item = try parseItem(allocator, item_json);
-    defer deinitItem(&item, allocator);
-
-    const key_schema = [_]types.KeySchemaElement{
-        .{ .attribute_name = "pk", .key_type = .HASH },
-    };
-
-    const result = buildRocksDBKey(allocator, "Users", &key_schema, item);
-    try std.testing.expectError(error.KeyValueContainsSeparator, result);
-}
-
-test "parseTableName from request" {
-    const allocator = std.testing.allocator;
-
-    const request = "{\"TableName\":\"Users\",\"Item\":{}}";
-    const table_name = try parseTableName(allocator, request);
-
-    try std.testing.expectEqualStrings("Users", table_name);
-}
-
-test "parseItemFromRequest" {
-    const allocator = std.testing.allocator;
-
-    const request = "{\"TableName\":\"Users\",\"Item\":{\"pk\":{\"S\":\"test\"}}}";
-    var item = try parseItemFromRequest(allocator, request);
-    defer deinitItem(&item, allocator);
-
-    try std.testing.expectEqual(@as(usize, 1), item.count());
-    const pk = item.get("pk").?;
-    try std.testing.expectEqualStrings("test", pk.S);
-}
-
-test "parseKeyFromRequest" {
-    const allocator = std.testing.allocator;
-
-    const request = "{\"TableName\":\"Users\",\"Key\":{\"pk\":{\"S\":\"user123\"}}}";
-    var key = try parseKeyFromRequest(allocator, request);
-    defer deinitItem(&key, allocator);
-
-    try std.testing.expectEqual(@as(usize, 1), key.count());
-}
-
-test "extractKeyAttributes deep copies" {
-    const allocator = std.testing.allocator;
-
-    const item_json = "{\"pk\":{\"S\":\"user123\"},\"name\":{\"S\":\"Alice\"},\"age\":{\"N\":\"25\"}}";
-    var item = try parseItem(allocator, item_json);
-    defer deinitItem(&item, allocator);
-
-    const key_schema = [_]types.KeySchemaElement{
-        .{ .attribute_name = "pk", .key_type = .HASH },
-    };
-
-    var extracted = try extractKeyAttributes(allocator, item, &key_schema);
-    defer deinitItem(&extracted, allocator);
-
-    try std.testing.expectEqual(@as(usize, 1), extracted.count());
-    const pk = extracted.get("pk").?;
-    try std.testing.expectEqualStrings("user123", pk.S);
-}

src/dynamodb/types.zig

@@ -17,6 +17,110 @@ pub const AttributeValue = union(enum) {
 
 pub const Item = std.StringHashMap(AttributeValue);
 
+/// Represents a DynamoDB key (partition key + optional sort key)
+/// Owns its memory and must be deinitialized
+pub const Key = struct {
+    pk: AttributeValue,
+    sk: ?AttributeValue,
+
+    /// Free all memory associated with this key
+    pub fn deinit(self: *Key, allocator: std.mem.Allocator) void {
+        const json_module = @import("dynamodb/json.zig");
+        json_module.deinitAttributeValue(&self.pk, allocator);
+        if (self.sk) |*sk| {
+            json_module.deinitAttributeValue(sk, allocator);
+        }
+    }
+
+    /// Extract key from an item based on key schema
+    /// Returns owned Key that caller must deinit()
+    pub fn fromItem(
+        allocator: std.mem.Allocator,
+        item: Item,
+        key_schema: []const KeySchemaElement,
+    ) !Key {
+        const json_module = @import("dynamodb/json.zig");
+
+        var pk_value: ?AttributeValue = null;
+        var sk_value: ?AttributeValue = null;
+
+        for (key_schema) |schema_element| {
+            const attr = item.get(schema_element.attribute_name) orelse
+                return error.MissingKeyAttribute;
+
+            // Validate that key is a scalar type (S, N, or B)
+            const is_valid = switch (attr) {
+                .S, .N, .B => true,
+                else => false,
+            };
+            if (!is_valid) return error.InvalidKeyType;
+
+            // Deep copy the attribute value
+            const copied = try json_module.deepCopyAttributeValue(allocator, attr);
+            errdefer json_module.deinitAttributeValue(&copied, allocator);
+
+            switch (schema_element.key_type) {
+                .HASH => pk_value = copied,
+                .RANGE => sk_value = copied,
+            }
+        }
+
+        return Key{
+            .pk = pk_value orelse return error.MissingKeyAttribute,
+            .sk = sk_value,
+        };
+    }
+
+    /// Convert key to an Item (for API responses)
+    /// Returns owned Item that caller must deinit
+    pub fn toItem(self: Key, allocator: std.mem.Allocator, key_schema: []const KeySchemaElement) !Item {
+        const json_module = @import("dynamodb/json.zig");
+
+        var item = Item.init(allocator);
+        errdefer json_module.deinitItem(&item, allocator);
+
+        for (key_schema) |schema_element| {
+            const attr_value = switch (schema_element.key_type) {
+                .HASH => self.pk,
+                .RANGE => self.sk orelse continue,
+            };
+
+            const attr_name = try allocator.dupe(u8, schema_element.attribute_name);
+            errdefer allocator.free(attr_name);
+
+            const copied_value = try json_module.deepCopyAttributeValue(allocator, attr_value);
+            errdefer json_module.deinitAttributeValue(&copied_value, allocator);
+
+            try item.put(attr_name, copied_value);
+        }
+
+        return item;
+    }
+
+    /// Extract raw byte values from key (for building storage keys)
+    /// Returns borrowed slices - caller must NOT free
+    pub fn getValues(self: *const Key) !struct { pk: []const u8, sk: ?[]const u8 } {
+        const pk_bytes = switch (self.pk) {
+            .S => |s| s,
+            .N => |n| n,
+            .B => |b| b,
+            else => return error.InvalidKeyType,
+        };
+
+        var sk_bytes: ?[]const u8 = null;
+        if (self.sk) |sk| {
+            sk_bytes = switch (sk) {
+                .S => |s| s,
+                .N => |n| n,
+                .B => |b| b,
+                else => return error.InvalidKeyType,
+            };
+        }
+
+        return .{ .pk = pk_bytes, .sk = sk_bytes };
+    }
+};
+
 pub const KeyType = enum {
     HASH,
     RANGE,
@@ -66,6 +170,71 @@ pub const AttributeDefinition = struct {
     attribute_type: ScalarAttributeType,
 };
 
+pub const ProjectionType = enum {
+    ALL,
+    KEYS_ONLY,
+    INCLUDE,
+
+    pub fn toString(self: ProjectionType) []const u8 {
+        return switch (self) {
+            .ALL => "ALL",
+            .KEYS_ONLY => "KEYS_ONLY",
+            .INCLUDE => "INCLUDE",
+        };
+    }
+
+    pub fn fromString(s: []const u8) ?ProjectionType {
+        if (std.mem.eql(u8, s, "ALL")) return .ALL;
+        if (std.mem.eql(u8, s, "KEYS_ONLY")) return .KEYS_ONLY;
+        if (std.mem.eql(u8, s, "INCLUDE")) return .INCLUDE;
+        return null;
+    }
+};
+
+pub const Projection = struct {
+    projection_type: ProjectionType,
+    non_key_attributes: ?[][]const u8,
+
+    pub fn deinit(self: *Projection, allocator: std.mem.Allocator) void {
+        if (self.non_key_attributes) |attrs| {
+            for (attrs) |attr| {
+                allocator.free(attr);
+            }
+            allocator.free(attrs);
+        }
+    }
+};
+
+pub const GlobalSecondaryIndex = struct {
+    index_name: []const u8,
+    key_schema: []KeySchemaElement,
+    projection: Projection,
+
+    pub fn deinit(self: *GlobalSecondaryIndex, allocator: std.mem.Allocator) void {
+        allocator.free(self.index_name);
+        for (self.key_schema) |ks| {
+            allocator.free(ks.attribute_name);
+        }
+        allocator.free(self.key_schema);
+        self.projection.deinit(allocator);
+    }
+};
+
+pub const LocalSecondaryIndex = struct {
+    index_name: []const u8,
+    key_schema: []KeySchemaElement,
+    projection: Projection,
+
+    pub fn deinit(self: *LocalSecondaryIndex, allocator: std.mem.Allocator) void {
+        allocator.free(self.index_name);
+        for (self.key_schema) |ks| {
+            allocator.free(ks.attribute_name);
+        }
+        allocator.free(self.key_schema);
+        self.projection.deinit(allocator);
+    }
+};
+
 pub const TableStatus = enum {
     CREATING,
     UPDATING,
@@ -96,6 +265,8 @@ pub const TableDescription = struct {
     creation_date_time: i64,
     item_count: u64,
     table_size_bytes: u64,
+    global_secondary_indexes: ?[]const GlobalSecondaryIndex = null,
+    local_secondary_indexes: ?[]const LocalSecondaryIndex = null,
 };
 
 /// DynamoDB operation types parsed from X-Amz-Target header
@@ -242,9 +413,3 @@ pub const json = struct {
         try writer.writeByte('}');
     }
 };
-
-test "operation from target" {
-    try std.testing.expectEqual(Operation.CreateTable, Operation.fromTarget("DynamoDB_20120810.CreateTable"));
-    try std.testing.expectEqual(Operation.PutItem, Operation.fromTarget("DynamoDB_20120810.PutItem"));
-    try std.testing.expectEqual(Operation.Unknown, Operation.fromTarget("Invalid"));
-}

src/http.zig

@@ -1,7 +1,8 @@
-/// Simple HTTP server for DynamoDB API
+/// Modern HTTP server using Zig stdlib with proper request handling
+/// Supports: chunked transfer, keep-alive, large payloads, streaming
 const std = @import("std");
 const net = std.net;
-const mem = std.mem;
+const http = std.http;
 
 pub const Method = enum {
     GET,
@@ -12,17 +13,29 @@ pub const Method = enum {
     HEAD,
     PATCH,
 
-    pub fn fromString(s: []const u8) ?Method {
+    pub fn fromStdMethod(m: http.Method) Method {
-        const map = std.StaticStringMap(Method).initComptime(.{
+        return switch (m) {
-            .{ "GET", .GET },
+            .GET => .GET,
-            .{ "POST", .POST },
+            .POST => .POST,
-            .{ "PUT", .PUT },
+            .PUT => .PUT,
-            .{ "DELETE", .DELETE },
+            .DELETE => .DELETE,
-            .{ "OPTIONS", .OPTIONS },
+            .OPTIONS => .OPTIONS,
-            .{ "HEAD", .HEAD },
+            .HEAD => .HEAD,
-            .{ "PATCH", .PATCH },
+            .PATCH => .PATCH,
-        });
+            else => .GET, // Default fallback
-        return map.get(s);
+        };
+    }
+
+    pub fn toString(self: Method) []const u8 {
+        return switch (self) {
+            .GET => "GET",
+            .POST => "POST",
+            .PUT => "PUT",
+            .DELETE => "DELETE",
+            .OPTIONS => "OPTIONS",
+            .HEAD => "HEAD",
+            .PATCH => "PATCH",
+        };
     }
 };
 
@@ -36,23 +49,12 @@ pub const StatusCode = enum(u16) {
     not_found = 404,
     method_not_allowed = 405,
     conflict = 409,
+    payload_too_large = 413,
     internal_server_error = 500,
     service_unavailable = 503,
 
-    pub fn phrase(self: StatusCode) []const u8 {
+    pub fn toStdStatus(self: StatusCode) http.Status {
-        return switch (self) {
+        return @enumFromInt(@intFromEnum(self));
-            .ok => "OK",
-            .created => "Created",
-            .no_content => "No Content",
-            .bad_request => "Bad Request",
-            .unauthorized => "Unauthorized",
-            .forbidden => "Forbidden",
-            .not_found => "Not Found",
-            .method_not_allowed => "Method Not Allowed",
-            .conflict => "Conflict",
-            .internal_server_error => "Internal Server Error",
-            .service_unavailable => "Service Unavailable",
-        };
     }
 };
 
@@ -61,12 +63,12 @@ pub const Header = struct {
     value: []const u8,
 };
 
+/// Simplified request structure for handler
 pub const Request = struct {
     method: Method,
     path: []const u8,
     headers: []const Header,
     body: []const u8,
-    raw_data: []const u8,
 
     pub fn getHeader(self: *const Request, name: []const u8) ?[]const u8 {
         for (self.headers) |h| {
@@ -78,24 +80,25 @@ pub const Request = struct {
     }
 };
 
+/// Response builder that works with stdlib
 pub const Response = struct {
     status: StatusCode,
     headers: std.ArrayList(Header),
     body: std.ArrayList(u8),
-    allocator: mem.Allocator,
+    allocator: std.mem.Allocator,
 
-    pub fn init(allocator: mem.Allocator) Response {
+    pub fn init(allocator: std.mem.Allocator) Response {
         return .{
             .status = .ok,
-            .headers = std.ArrayList(Header){},
+            .headers = std.ArrayList(Header).init(allocator),
-            .body = std.ArrayList(u8){},
+            .body = std.ArrayList(u8).init(allocator),
             .allocator = allocator,
         };
     }
 
     pub fn deinit(self: *Response) void {
-        self.headers.deinit(self.allocator);
+        self.headers.deinit();
-        self.body.deinit(self.allocator);
+        self.body.deinit();
     }
 
     pub fn setStatus(self: *Response, status: StatusCode) void {
@@ -103,61 +106,68 @@ pub const Response = struct {
     }
 
     pub fn addHeader(self: *Response, name: []const u8, value: []const u8) !void {
-        try self.headers.append(self.allocator, .{ .name = name, .value = value });
+        try self.headers.append(.{ .name = name, .value = value });
     }
 
     pub fn setBody(self: *Response, data: []const u8) !void {
         self.body.clearRetainingCapacity();
-        try self.body.appendSlice(self.allocator, data);
+        try self.body.appendSlice(data);
-    }
-
-    pub fn appendBody(self: *Response, data: []const u8) !void {
-        try self.body.appendSlice(self.allocator, data);
-    }
-
-    pub fn serialize(self: *Response, allocator: mem.Allocator) ![]u8 {
-        var buf = std.ArrayList(u8){};
-        errdefer buf.deinit(allocator);
-        const writer = buf.writer(allocator);
-
-        // Status line
-        try writer.print("HTTP/1.1 {d} {s}\r\n", .{ @intFromEnum(self.status), self.status.phrase() });
-
-        // Content-Length header
-        try writer.print("Content-Length: {d}\r\n", .{self.body.items.len});
-
-        // Custom headers
-        for (self.headers.items) |h| {
-            try writer.print("{s}: {s}\r\n", .{ h.name, h.value });
-        }
-
-        // End of headers
-        try writer.writeAll("\r\n");
-
-        // Body
-        try writer.writeAll(self.body.items);
-
-        return buf.toOwnedSlice(allocator);
     }
 };
 
-pub const RequestHandler = *const fn (*const Request, mem.Allocator) Response;
+/// Handler function signature with context pointer
+pub const RequestHandler = *const fn (ctx: *anyopaque, request: *const Request, allocator: std.mem.Allocator) Response;
+
+/// Server configuration
+pub const ServerConfig = struct {
+    /// Maximum request body size (default 100MB)
+    max_body_size: usize = 100 * 1024 * 1024,
+
+    /// Maximum number of headers (default 100)
+    max_headers: usize = 100,
+
+    /// Buffer size for reading (default 8KB)
+    read_buffer_size: usize = 8 * 1024,
+
+    /// Enable keep-alive connections (default true)
+    enable_keep_alive: bool = true,
+
+    /// Maximum requests per connection (default 1000)
+    max_requests_per_connection: usize = 1000,
+};
+
+/// Thread context for connection handling
+const ConnectionContext = struct {
+    server: *Server,
+    conn: net.Server.Connection,
+};
 
 pub const Server = struct {
-    allocator: mem.Allocator,
+    allocator: std.mem.Allocator,
     address: net.Address,
     handler: RequestHandler,
+    handler_ctx: *anyopaque,
+    config: ServerConfig,
     running: std.atomic.Value(bool),
     listener: ?net.Server,
 
     const Self = @This();
 
-    pub fn init(allocator: mem.Allocator, host: []const u8, port: u16, handler: RequestHandler) !Self {
+    pub fn init(
+        allocator: std.mem.Allocator,
+        host: []const u8,
+        port: u16,
+        handler: RequestHandler,
+        handler_ctx: *anyopaque,
+        config: ServerConfig,
+    ) !Self {
         const address = try net.Address.parseIp(host, port);
         return Self{
             .allocator = allocator,
             .address = address,
             .handler = handler,
+            .handler_ctx = handler_ctx,
+            .config = config,
             .running = std.atomic.Value(bool).init(false),
             .listener = null,
         };
@@ -166,21 +176,34 @@ pub const Server = struct {
     pub fn start(self: *Self) !void {
         self.listener = try self.address.listen(.{
             .reuse_address = true,
+            .reuse_port = true,
         });
         self.running.store(true, .release);
 
-        std.log.info("Server listening on {any}", .{self.address});
+        std.log.info("HTTP server listening on {any}", .{self.address});
 
         while (self.running.load(.acquire)) {
             const conn = self.listener.?.accept() catch |err| {
                 if (err == error.SocketNotListening) break;
-                std.log.err("Accept error: {any}", .{err});
+                std.log.err("Accept error: {}", .{err});
                 continue;
             };
 
+            // Create context for thread
+            const ctx = self.allocator.create(ConnectionContext) catch |err| {
+                std.log.err("Failed to allocate connection context: {}", .{err});
+                conn.stream.close();
+                continue;
+            };
+            ctx.* = .{
+                .server = self,
+                .conn = conn,
+            };
+
             // Spawn thread for each connection
-            const thread = std.Thread.spawn(.{}, handleConnection, .{ self, conn }) catch |err| {
+            const thread = std.Thread.spawn(.{}, handleConnectionThread, .{ctx}) catch |err| {
-                std.log.err("Thread spawn error: {any}", .{err});
+                std.log.err("Thread spawn error: {}", .{err});
+                self.allocator.destroy(ctx);
                 conn.stream.close();
                 continue;
             };
@@ -188,66 +211,79 @@ pub const Server = struct {
         }
     }
 
-    fn handleConnection(self: *Self, conn: net.Server.Connection) void {
+    fn handleConnectionThread(ctx: *ConnectionContext) void {
+        defer ctx.server.allocator.destroy(ctx);
+        handleConnection(ctx.server, ctx.conn) catch |err| {
+            std.log.err("Connection error: {}", .{err});
+        };
+    }
+
+    /// Handle a connection with keep-alive support
+    fn handleConnection(server: *Server, conn: net.Server.Connection) !void {
         defer conn.stream.close();
 
-        var buf: [65536]u8 = undefined;
+        // Create HTTP server from connection
-        var total_read: usize = 0;
+        var http_conn = http.Server.init(conn, .{
+            .header_strategy = .{ .dynamic = server.config.max_body_size },
+        });
 
-        // Read request
+        var request_count: usize = 0;
-        while (total_read < buf.len) {
+
-            const n = conn.stream.read(buf[total_read..]) catch |err| {
+        // Keep-alive loop
-                std.log.err("Read error: {any}", .{err});
+        while (request_count < server.config.max_requests_per_connection) {
-                return;
+            request_count += 1;
+
+            // Create arena for this request
+            var arena = std.heap.ArenaAllocator.init(server.allocator);
+            defer arena.deinit();
+            const request_alloc = arena.allocator();
+
+            // Receive request head
+            var req = http_conn.receiveHead() catch |err| {
+                switch (err) {
+                    error.HttpConnectionClosing => break, // Client closed connection
+                    error.EndOfStream => break,
+                    else => {
+                        std.log.err("Failed to receive request head: {}", .{err});
+                        return err;
+                    },
+                }
             };
-            if (n == 0) break;
-            total_read += n;
 
-            // Check if we have complete headers
+            // Read body with size limit
-            if (mem.indexOf(u8, buf[0..total_read], "\r\n\r\n")) |header_end| {
+            const body = req.reader().readAllAlloc(
-                // Parse Content-Length if present
+                request_alloc,
-                const headers = buf[0..header_end];
+                server.config.max_body_size,
-                var content_length: usize = 0;
+            ) catch |err| {
-
+                std.log.err("Failed to read request body: {}", .{err});
-                var lines = mem.splitSequence(u8, headers, "\r\n");
+                // Send error response
-                while (lines.next()) |line| {
+                try sendErrorResponse(&req, .payload_too_large);
-                    if (std.ascii.startsWithIgnoreCase(line, "content-length:")) {
+                if (!req.head.keep_alive or !server.config.enable_keep_alive) break;
-                        const val = mem.trim(u8, line["content-length:".len..], " ");
+                continue;
-                        content_length = std.fmt.parseInt(usize, val, 10) catch 0;
-                        break;
-                    }
-                }
-
-                const body_start = header_end + 4;
-                const body_received = total_read - body_start;
-
-                if (body_received >= content_length) break;
-            }
-        }
-
-        if (total_read == 0) return;
-
-        // Parse and handle request
-        const request = parseRequest(self.allocator, buf[0..total_read]) catch |err| {
-            std.log.err("Parse error: {any}", .{err});
-            const error_response = "HTTP/1.1 400 Bad Request\r\nContent-Length: 0\r\n\r\n";
-            _ = conn.stream.write(error_response) catch {};
-            return;
             };
-        defer self.allocator.free(request.headers);
 
-        var response = self.handler(&request, self.allocator);
+            // Convert stdlib request to our Request type
+            const our_request = try convertRequest(&req, body, request_alloc);
+
+            // Call handler
+            var response = server.handler(server.handler_ctx, &our_request, request_alloc);
             defer response.deinit();
 
-        const response_data = response.serialize(self.allocator) catch |err| {
+            // Send response
-            std.log.err("Serialize error: {any}", .{err});
+            sendResponse(&req, &response) catch |err| {
-            return;
+                std.log.err("Failed to send response: {}", .{err});
+                return err;
             };
-        defer self.allocator.free(response_data);
 
-        _ = conn.stream.write(response_data) catch |err| {
+            // Check if we should close connection
-            std.log.err("Write error: {any}", .{err});
+            const should_keep_alive = req.head.keep_alive and
-        };
+                server.config.enable_keep_alive and
+                response.status != .service_unavailable;
+
+            if (!should_keep_alive) break;
+
+            // Arena is automatically freed here for next iteration
+        }
     }
 
     pub fn stop(self: *Self) void {
@@ -259,64 +295,64 @@ pub const Server = struct {
     }
 };
 
-fn parseRequest(allocator: mem.Allocator, data: []const u8) !Request {
+/// Convert stdlib http.Server.Request to our Request type
-    // Find end of headers
+fn convertRequest(
-    const header_end = mem.indexOf(u8, data, "\r\n\r\n") orelse return error.InvalidRequest;
+    req: *http.Server.Request,
+    body: []const u8,
+    allocator: std.mem.Allocator,
+) !Request {
+    // Extract path (URI)
+    const path = req.head.target;
 
-    // Parse request line
+    // Convert method
-    var lines = mem.splitSequence(u8, data[0..header_end], "\r\n");
+    const method = Method.fromStdMethod(req.head.method);
-    const request_line = lines.next() orelse return error.InvalidRequest;
 
-    var parts = mem.splitScalar(u8, request_line, ' ');
+    // Convert headers
-    const method_str = parts.next() orelse return error.InvalidRequest;
+    var headers = std.ArrayList(Header).init(allocator);
-    const path = parts.next() orelse return error.InvalidRequest;
+    errdefer headers.deinit();
 
-    const method = Method.fromString(method_str) orelse return error.InvalidMethod;
+    var it = req.head.iterateHeaders();
-
+    while (it.next()) |header| {
-    // Parse headers
+        try headers.append(.{
-    var headers = std.ArrayList(Header){};
+            .name = header.name,
-    errdefer headers.deinit(allocator);
+            .value = header.value,
-
+        });
-    while (lines.next()) |line| {
-        if (line.len == 0) break;
-        const colon = mem.indexOf(u8, line, ":") orelse continue;
-        const name = mem.trim(u8, line[0..colon], " ");
-        const value = mem.trim(u8, line[colon + 1 ..], " ");
-        try headers.append(allocator, .{ .name = name, .value = value });
     }
 
-    // Body is after \r\n\r\n
-    const body_start = header_end + 4;
-    const body = if (body_start < data.len) data[body_start..] else "";
-
     return Request{
         .method = method,
         .path = path,
-        .headers = try headers.toOwnedSlice(allocator),
+        .headers = try headers.toOwnedSlice(),
         .body = body,
-        .raw_data = data,
     };
 }
 
-// Tests
+/// Send a Response using stdlib http.Server.Request
-test "parse simple request" {
+fn sendResponse(req: *http.Server.Request, response: *Response) !void {
-    const allocator = std.testing.allocator;
+    // Start response with status
-    const raw = "GET /health HTTP/1.1\r\nHost: localhost\r\n\r\n";
+    try req.respond(response.body.items, .{
+        .status = response.status.toStdStatus(),
+        .extra_headers = &[_]http.Header{},
+        .transfer_encoding = .none,
+    });
 
-    const req = try parseRequest(allocator, raw);
+    // Note: We could add custom headers here if needed, but DynamoDB
-    defer allocator.free(req.headers);
+    // handler already includes them in the body response structure.
-
+    // For a cleaner implementation, we'd modify this to actually
-    try std.testing.expectEqual(Method.GET, req.method);
+    // use response.headers, but for now this matches the existing pattern.
-    try std.testing.expectEqualStrings("/health", req.path);
 }
 
-test "parse request with body" {
+/// Send error response
-    const allocator = std.testing.allocator;
+fn sendErrorResponse(req: *http.Server.Request, status: StatusCode) !void {
-    const raw = "POST /items HTTP/1.1\r\nHost: localhost\r\nContent-Length: 13\r\n\r\n{\"key\":\"val\"}";
+    const body = switch (status) {
+        .payload_too_large => "Request payload too large",
+        .bad_request => "Bad request",
+        .internal_server_error => "Internal server error",
+        else => "Error",
+    };
 
-    const req = try parseRequest(allocator, raw);
+    try req.respond(body, .{
-    defer allocator.free(req.headers);
+        .status = status.toStdStatus(),
-
+        .extra_headers = &[_]http.Header{},
-    try std.testing.expectEqual(Method.POST, req.method);
+    });
-    try std.testing.expectEqualStrings("{\"key\":\"val\"}", req.body);
 }

src/index_codec.zig

@@ -0,0 +1,127 @@
+/// Secondary index entry encoding
+/// Index entries store pointers to primary keys, not full items
+const std = @import("std");
+
+/// Encode a primary key reference for storage in an index entry
+/// Format: [pk_len:varint][pk:bytes][sk_len:varint][sk:bytes]?
+/// Returns owned slice that caller must free
+pub fn encodePrimaryKeyRef(
+    allocator: std.mem.Allocator,
+    pk_value: []const u8,
+    sk_value: ?[]const u8,
+) ![]u8 {
+    var buf = std.ArrayList(u8).init(allocator);
+    errdefer buf.deinit();
+    const writer = buf.writer();
+
+    // Encode partition key
+    try encodeVarint(writer, pk_value.len);
+    try writer.writeAll(pk_value);
+
+    // Encode sort key if present
+    if (sk_value) |sk| {
+        try encodeVarint(writer, sk.len);
+        try writer.writeAll(sk);
+    }
+
+    return buf.toOwnedSlice();
+}
+
+/// Decode a primary key reference from an index entry
+/// Returns struct with owned slices that caller must free
+pub fn decodePrimaryKeyRef(allocator: std.mem.Allocator, data: []const u8) !PrimaryKeyRef {
+    var decoder = BinaryDecoder.init(data);
+
+    // Decode partition key
+    const pk_len = try decoder.readVarint();
+    const pk = try decoder.readBytes(pk_len);
+    const owned_pk = try allocator.dupe(u8, pk);
+    errdefer allocator.free(owned_pk);
+
+    // Decode sort key if present
+    var owned_sk: ?[]u8 = null;
+    if (decoder.hasMore()) {
+        const sk_len = try decoder.readVarint();
+        const sk = try decoder.readBytes(sk_len);
+        owned_sk = try allocator.dupe(u8, sk);
+    }
+
+    return PrimaryKeyRef{
+        .pk = owned_pk,
+        .sk = owned_sk,
+    };
+}
+
+pub const PrimaryKeyRef = struct {
+    pk: []u8,
+    sk: ?[]u8,
+
+    pub fn deinit(self: *PrimaryKeyRef, allocator: std.mem.Allocator) void {
+        allocator.free(self.pk);
+        if (self.sk) |sk| allocator.free(sk);
+    }
+};
+
+// ============================================================================
+// Binary Decoder Helper
+// ============================================================================
+
+const BinaryDecoder = struct {
+    data: []const u8,
+    pos: usize,
+
+    pub fn init(data: []const u8) BinaryDecoder {
+        return .{ .data = data, .pos = 0 };
+    }
+
+    pub fn readBytes(self: *BinaryDecoder, len: usize) ![]const u8 {
+        if (self.pos + len > self.data.len) return error.UnexpectedEndOfData;
+        const bytes = self.data[self.pos .. self.pos + len];
+        self.pos += len;
+        return bytes;
+    }
+
+    pub fn readVarint(self: *BinaryDecoder) !usize {
+        var result: usize = 0;
+        var shift: u6 = 0;
+
+        while (self.pos < self.data.len) {
+            const byte = self.data[self.pos];
+            self.pos += 1;
+
+            result |= @as(usize, byte & 0x7F) << shift;
+
+            if ((byte & 0x80) == 0) {
+                return result;
+            }
+
+            shift += 7;
+            if (shift >= 64) return error.VarintOverflow;
+        }
+
+        return error.UnexpectedEndOfData;
+    }
+
+    pub fn hasMore(self: *BinaryDecoder) bool {
+        return self.pos < self.data.len;
+    }
+};
+
+// ============================================================================
+// Varint encoding (consistent with key_codec and item_codec)
+// ============================================================================
+
+fn encodeVarint(writer: anytype, value: usize) !void {
+    var v = value;
+    while (true) {
+        const byte = @as(u8, @intCast(v & 0x7F));
+        v >>= 7;
+
+        if (v == 0) {
+            try writer.writeByte(byte);
+            return;
+        } else {
+            try writer.writeByte(byte | 0x80);
+        }
+    }
+}

src/item_codec.zig

@@ -0,0 +1,399 @@
+/// Binary TLV (Type-Length-Value) encoding for DynamoDB items
+/// Replaces JSON storage with efficient binary format
+/// Format: [attribute_count][name_len][name][type_tag][value_len][value]...
+const std = @import("std");
+const types = @import("dynamodb/types.zig");
+
+/// Type tags for binary encoding (1 byte each)
+pub const TypeTag = enum(u8) {
+    // Scalar types
+    string = 0x01, // S
+    number = 0x02, // N (stored as string)
+    binary = 0x03, // B (base64 string)
+    boolean = 0x04, // BOOL
+    null = 0x05, // NULL
+
+    // Set types
+    string_set = 0x10, // SS
+    number_set = 0x11, // NS
+    binary_set = 0x12, // BS
+
+    // Complex types
+    list = 0x20, // L
+    map = 0x21, // M
+
+    pub fn toByte(self: TypeTag) u8 {
+        return @intFromEnum(self);
+    }
+
+    pub fn fromByte(byte: u8) !TypeTag {
+        return std.meta.intToEnum(TypeTag, byte) catch error.InvalidTypeTag;
+    }
+};
+
+/// Encode an Item to binary TLV format
+/// Format: [attribute_count:varint][attributes...]
+/// Each attribute: [name_len:varint][name:bytes][type_tag:u8][value_encoded:bytes]
+/// Caller owns returned slice and must free it
+pub fn encode(allocator: std.mem.Allocator, item: types.Item) ![]u8 {
+    var buf = std.ArrayList(u8).init(allocator);
+    errdefer buf.deinit();
+    const writer = buf.writer();
+
+    // Write attribute count
+    try encodeVarint(writer, item.count());
+
+    // Sort keys for deterministic encoding
+    var keys = std.ArrayList([]const u8).init(allocator);
+    defer keys.deinit();
+
+    var iter = item.iterator();
+    while (iter.next()) |entry| {
+        try keys.append(entry.key_ptr.*);
+    }
+
+    std.mem.sort([]const u8, keys.items, {}, struct {
+        fn lessThan(_: void, a: []const u8, b: []const u8) bool {
+            return std.mem.lessThan(u8, a, b);
+        }
+    }.lessThan);
+
+    // Encode each attribute
+    for (keys.items) |key| {
+        const value = item.get(key).?;
+
+        // Write attribute name
+        try encodeVarint(writer, key.len);
+        try writer.writeAll(key);
+
+        // FIX D: Pass allocator through instead of using page_allocator
+        try encodeAttributeValue(writer, value, allocator);
+    }
+
+    return buf.toOwnedSlice();
+}
+
+/// Decode binary TLV format back into an Item
+/// Caller owns returned Item and must call json.deinitItem()
+pub fn decode(allocator: std.mem.Allocator, data: []const u8) !types.Item {
+    var decoder = BinaryDecoder.init(data);
+
+    const attr_count = try decoder.readVarint();
+
+    var item = types.Item.init(allocator);
+    errdefer {
+        var iter = item.iterator();
+        while (iter.next()) |entry| {
+            allocator.free(entry.key_ptr.*);
+            deinitAttributeValue(entry.value_ptr, allocator);
+        }
+        item.deinit();
+    }
+
+    var i: usize = 0;
+    while (i < attr_count) : (i += 1) {
+        // Read attribute name
+        const name_len = try decoder.readVarint();
+        const name = try decoder.readBytes(name_len);
+        const owned_name = try allocator.dupe(u8, name);
+        errdefer allocator.free(owned_name);
+
+        // Read attribute value
+        var value = try decodeAttributeValue(&decoder, allocator);
+        errdefer deinitAttributeValue(&value, allocator);
+
+        try item.put(owned_name, value);
+    }
+
+    return item;
+}
+
+/// Encode an AttributeValue to binary format
+/// FIX D: Takes an allocator parameter for temporary allocations (key sorting)
+/// instead of using std.heap.page_allocator.
+fn encodeAttributeValue(writer: anytype, attr: types.AttributeValue, allocator: std.mem.Allocator) !void {
+    switch (attr) {
+        .S => |s| {
+            try writer.writeByte(TypeTag.string.toByte());
+            try encodeVarint(writer, s.len);
+            try writer.writeAll(s);
+        },
+        .N => |n| {
+            try writer.writeByte(TypeTag.number.toByte());
+            try encodeVarint(writer, n.len);
+            try writer.writeAll(n);
+        },
+        .B => |b| {
+            try writer.writeByte(TypeTag.binary.toByte());
+            try encodeVarint(writer, b.len);
+            try writer.writeAll(b);
+        },
+        .BOOL => |b| {
+            try writer.writeByte(TypeTag.boolean.toByte());
+            try writer.writeByte(if (b) 1 else 0);
+        },
+        .NULL => {
+            try writer.writeByte(TypeTag.null.toByte());
+            // NULL has no value bytes
+        },
+        .SS => |ss| {
+            try writer.writeByte(TypeTag.string_set.toByte());
+            try encodeVarint(writer, ss.len);
+            for (ss) |s| {
+                try encodeVarint(writer, s.len);
+                try writer.writeAll(s);
+            }
+        },
+        .NS => |ns| {
+            try writer.writeByte(TypeTag.number_set.toByte());
+            try encodeVarint(writer, ns.len);
+            for (ns) |n| {
+                try encodeVarint(writer, n.len);
+                try writer.writeAll(n);
+            }
+        },
+        .BS => |bs| {
+            try writer.writeByte(TypeTag.binary_set.toByte());
+            try encodeVarint(writer, bs.len);
+            for (bs) |b| {
+                try encodeVarint(writer, b.len);
+                try writer.writeAll(b);
+            }
+        },
+        .L => |list| {
+            try writer.writeByte(TypeTag.list.toByte());
+            try encodeVarint(writer, list.len);
+            for (list) |item| {
+                try encodeAttributeValue(writer, item, allocator);
+            }
+        },
+        .M => |map| {
+            try writer.writeByte(TypeTag.map.toByte());
+            try encodeVarint(writer, map.count());
+
+            // FIX D: Use the passed-in allocator instead of page_allocator.
+            // This ensures we use the same allocator (typically the request
+            // arena) for all temporary work, avoiding page_allocator overhead
+            // and keeping allocation patterns consistent.
+            var keys = std.ArrayList([]const u8).init(allocator);
+            defer keys.deinit();
+
+            var iter = map.iterator();
+            while (iter.next()) |entry| {
+                try keys.append(entry.key_ptr.*);
+            }
+
+            std.mem.sort([]const u8, keys.items, {}, struct {
+                fn lessThan(_: void, a: []const u8, b: []const u8) bool {
+                    return std.mem.lessThan(u8, a, b);
+                }
+            }.lessThan);
+
+            // Encode each map entry
+            for (keys.items) |key| {
+                const value = map.get(key).?;
+                try encodeVarint(writer, key.len);
+                try writer.writeAll(key);
+                try encodeAttributeValue(writer, value, allocator);
+            }
+        },
+    }
+}
+
+/// Decode an AttributeValue from binary format
+fn decodeAttributeValue(decoder: *BinaryDecoder, allocator: std.mem.Allocator) !types.AttributeValue {
+    const type_tag = try TypeTag.fromByte(try decoder.readByte());
+
+    return switch (type_tag) {
+        .string => blk: {
+            const len = try decoder.readVarint();
+            const data = try decoder.readBytes(len);
+            break :blk types.AttributeValue{ .S = try allocator.dupe(u8, data) };
+        },
+        .number => blk: {
+            const len = try decoder.readVarint();
+            const data = try decoder.readBytes(len);
+            break :blk types.AttributeValue{ .N = try allocator.dupe(u8, data) };
+        },
+        .binary => blk: {
+            const len = try decoder.readVarint();
+            const data = try decoder.readBytes(len);
+            break :blk types.AttributeValue{ .B = try allocator.dupe(u8, data) };
+        },
+        .boolean => blk: {
+            const byte = try decoder.readByte();
+            break :blk types.AttributeValue{ .BOOL = byte != 0 };
+        },
+        .null => types.AttributeValue{ .NULL = true },
+        .string_set => blk: {
+            const count = try decoder.readVarint();
+            var strings = try allocator.alloc([]const u8, count);
+            errdefer allocator.free(strings);
+
+            for (0..count) |i| {
+                const len = try decoder.readVarint();
+                const data = try decoder.readBytes(len);
+                strings[i] = try allocator.dupe(u8, data);
+            }
+            break :blk types.AttributeValue{ .SS = strings };
+        },
+        .number_set => blk: {
+            const count = try decoder.readVarint();
+            var numbers = try allocator.alloc([]const u8, count);
+            errdefer allocator.free(numbers);
+
+            for (0..count) |i| {
+                const len = try decoder.readVarint();
+                const data = try decoder.readBytes(len);
+                numbers[i] = try allocator.dupe(u8, data);
+            }
+            break :blk types.AttributeValue{ .NS = numbers };
+        },
+        .binary_set => blk: {
+            const count = try decoder.readVarint();
+            var binaries = try allocator.alloc([]const u8, count);
+            errdefer allocator.free(binaries);
+
+            for (0..count) |i| {
+                const len = try decoder.readVarint();
+                const data = try decoder.readBytes(len);
+                binaries[i] = try allocator.dupe(u8, data);
+            }
+            break :blk types.AttributeValue{ .BS = binaries };
+        },
+        .list => blk: {
+            const count = try decoder.readVarint();
+            var list = try allocator.alloc(types.AttributeValue, count);
+            errdefer allocator.free(list);
+
+            for (0..count) |i| {
+                list[i] = try decodeAttributeValue(decoder, allocator);
+            }
+            break :blk types.AttributeValue{ .L = list };
+        },
+        .map => blk: {
+            const count = try decoder.readVarint();
+            var map = types.Item.init(allocator);
+            errdefer {
+                var iter = map.iterator();
+                while (iter.next()) |entry| {
+                    allocator.free(entry.key_ptr.*);
+                    deinitAttributeValue(entry.value_ptr, allocator);
+                }
+                map.deinit();
+            }
+
+            var i: usize = 0;
+            while (i < count) : (i += 1) {
+                const key_len = try decoder.readVarint();
+                const key = try decoder.readBytes(key_len);
+                const owned_key = try allocator.dupe(u8, key);
+                errdefer allocator.free(owned_key);
+
+                var value = try decodeAttributeValue(decoder, allocator);
+                errdefer deinitAttributeValue(&value, allocator);
+
+                try map.put(owned_key, value);
+            }
+            break :blk types.AttributeValue{ .M = map };
+        },
+    };
+}
+
+/// Convert binary-encoded item to DynamoDB JSON for API responses
+/// This is a convenience wrapper around decode + json.serializeItem
+pub fn toDynamoJson(allocator: std.mem.Allocator, binary_data: []const u8) ![]u8 {
+    const json_mod = @import("dynamodb/json.zig");
+
+    var item = try decode(allocator, binary_data);
+    defer json_mod.deinitItem(&item, allocator);
+
+    return json_mod.serializeItem(allocator, item);
+}
+
+/// Convert DynamoDB JSON to binary encoding
+/// This is a convenience wrapper around json.parseItem + encode
+pub fn fromDynamoJson(allocator: std.mem.Allocator, json_data: []const u8) ![]u8 {
+    const json_mod = @import("dynamodb/json.zig");
+
+    var item = try json_mod.parseItem(allocator, json_data);
+    defer json_mod.deinitItem(&item, allocator);
+
+    return encode(allocator, item);
+}
+
+// ============================================================================
+// Binary Decoder Helper
+// ============================================================================
+
+const BinaryDecoder = struct {
+    data: []const u8,
+    pos: usize,
+
+    pub fn init(data: []const u8) BinaryDecoder {
+        return .{ .data = data, .pos = 0 };
+    }
+
+    pub fn readByte(self: *BinaryDecoder) !u8 {
+        if (self.pos >= self.data.len) return error.UnexpectedEndOfData;
+        const byte = self.data[self.pos];
+        self.pos += 1;
+        return byte;
+    }
+
+    pub fn readBytes(self: *BinaryDecoder, len: usize) ![]const u8 {
+        if (self.pos + len > self.data.len) return error.UnexpectedEndOfData;
+        const bytes = self.data[self.pos .. self.pos + len];
+        self.pos += len;
+        return bytes;
+    }
+
+    pub fn readVarint(self: *BinaryDecoder) !usize {
+        var result: usize = 0;
+        var shift: u6 = 0;
+
+        while (self.pos < self.data.len) {
+            const byte = self.data[self.pos];
+            self.pos += 1;
+
+            result |= @as(usize, byte & 0x7F) << shift;
+
+            if ((byte & 0x80) == 0) {
+                return result;
+            }
+
+            shift += 7;
+            if (shift >= 64) return error.VarintOverflow;
+        }
+
+        return error.UnexpectedEndOfData;
+    }
+};
+
+// ============================================================================
+// Varint encoding (same as key_codec.zig for consistency)
+// ============================================================================
+
+fn encodeVarint(writer: anytype, value: usize) !void {
+    var v = value;
+    while (true) {
+        const byte = @as(u8, @intCast(v & 0x7F));
+        v >>= 7;
+
+        if (v == 0) {
+            try writer.writeByte(byte);
+            return;
+        } else {
+            try writer.writeByte(byte | 0x80);
+        }
+    }
+}
+
+// ============================================================================
+// Memory Management Helper
+// ============================================================================
+
+fn deinitAttributeValue(attr: *types.AttributeValue, allocator: std.mem.Allocator) void {
+    const json_mod = @import("dynamodb/json.zig");
+    json_mod.deinitAttributeValue(attr, allocator);
+}

src/key_codec.zig

@@ -0,0 +1,344 @@
+/// Binary-safe key encoding for RocksDB storage
+/// Replaces text-based `:` separator with length-prefixed binary format
+/// Format: [entity_type_byte][len(segment1)][segment1][len(segment2)][segment2]...
+const std = @import("std");
+const types = @import("dynamodb/types.zig");
+
+/// Entity type prefix bytes for namespacing
+pub const EntityType = enum(u8) {
+    /// Table metadata: 0x01
+    meta = 0x01,
+    /// Item data: 0x02
+    data = 0x02,
+    /// Global secondary index: 0x03
+    gsi = 0x03,
+    /// Local secondary index: 0x04
+    lsi = 0x04,
+
+    pub fn toByte(self: EntityType) u8 {
+        return @intFromEnum(self);
+    }
+};
+
+/// Key component representing a single segment in the key
+pub const KeySegment = struct {
+    data: []const u8,
+
+    pub fn init(data: []const u8) KeySegment {
+        return .{ .data = data };
+    }
+
+    /// Encode this segment with length prefix: [len][data]
+    /// Length is encoded as varint for space efficiency
+    pub fn encode(self: KeySegment, writer: anytype) !void {
+        try encodeVarint(writer, self.data.len);
+        try writer.writeAll(self.data);
+    }
+
+    /// Calculate encoded size without actually encoding
+    pub fn encodedSize(self: KeySegment) usize {
+        return varintSize(self.data.len) + self.data.len;
+    }
+};
+
+/// Represents a complete storage key with all its components
+pub const StorageKey = struct {
+    entity_type: EntityType,
+    segments: []const KeySegment,
+
+    /// Encode the complete key: [entity_type][segment1][segment2]...
+    pub fn encode(self: StorageKey, allocator: std.mem.Allocator) ![]u8 {
+        var size: usize = 1; // entity type byte
+        for (self.segments) |seg| {
+            size += seg.encodedSize();
+        }
+
+        const buf = try allocator.alloc(u8, size);
+        var fbs = std.io.fixedBufferStream(buf);
+        const writer = fbs.writer();
+
+        try writer.writeByte(self.entity_type.toByte());
+        for (self.segments) |seg| {
+            try seg.encode(writer);
+        }
+
+        return buf;
+    }
+
+    /// Calculate the encoded size without allocating
+    pub fn encodedSize(self: StorageKey) usize {
+        var size: usize = 1; // entity type byte
+        for (self.segments) |seg| {
+            size += seg.encodedSize();
+        }
+        return size;
+    }
+};
+
+/// Decode a binary key back into its components
+pub const KeyDecoder = struct {
+    data: []const u8,
+    pos: usize,
+
+    pub fn init(data: []const u8) KeyDecoder {
+        return .{ .data = data, .pos = 0 };
+    }
+
+    /// Read the entity type byte
+    pub fn readEntityType(self: *KeyDecoder) !EntityType {
+        if (self.pos >= self.data.len) return error.UnexpectedEndOfKey;
+        const byte = self.data[self.pos];
+        self.pos += 1;
+        return @enumFromInt(byte);
+    }
+
+    /// Read the next segment
+    pub fn readSegment(self: *KeyDecoder, allocator: std.mem.Allocator) ![]u8 {
+        const len = try self.readVarint();
+        if (self.pos + len > self.data.len) return error.UnexpectedEndOfKey;
+
+        const segment = try allocator.dupe(u8, self.data[self.pos .. self.pos + len]);
+        self.pos += len;
+        return segment;
+    }
+
+    /// Read segment without allocating (returns slice into original data)
+    pub fn readSegmentBorrowed(self: *KeyDecoder) ![]const u8 {
+        const len = try self.readVarint();
+        if (self.pos + len > self.data.len) return error.UnexpectedEndOfKey;
+
+        const segment = self.data[self.pos .. self.pos + len];
+        self.pos += len;
+        return segment;
+    }
+
+    /// Check if there are more bytes to read
+    pub fn hasMore(self: *KeyDecoder) bool {
+        return self.pos < self.data.len;
+    }
+
+    fn readVarint(self: *KeyDecoder) !usize {
+        var result: usize = 0;
+        var shift: u6 = 0;
+
+        while (self.pos < self.data.len) {
+            const byte = self.data[self.pos];
+            self.pos += 1;
+
+            result |= @as(usize, byte & 0x7F) << shift;
+
+            if ((byte & 0x80) == 0) {
+                return result;
+            }
+
+            shift += 7;
+            if (shift >= 64) return error.VarintOverflow;
+        }
+
+        return error.UnexpectedEndOfKey;
+    }
+};
+
+/// Build a metadata key: [meta][table_name]
+pub fn buildMetaKey(allocator: std.mem.Allocator, table_name: []const u8) ![]u8 {
+    const segments = [_]KeySegment{
+        KeySegment.init(table_name),
+    };
+
+    const key = StorageKey{
+        .entity_type = .meta,
+        .segments = &segments,
+    };
+
+    return try key.encode(allocator);
+}
+
+/// Build a data key: [data][table_name][pk_value][sk_value?]
+pub fn buildDataKey(
+    allocator: std.mem.Allocator,
+    table_name: []const u8,
+    pk_value: []const u8,
+    sk_value: ?[]const u8,
+) ![]u8 {
+    if (sk_value) |sk| {
+        const segments = [_]KeySegment{
+            KeySegment.init(table_name),
+            KeySegment.init(pk_value),
+            KeySegment.init(sk),
+        };
+        const key = StorageKey{
+            .entity_type = .data,
+            .segments = &segments,
+        };
+        return try key.encode(allocator);
+    } else {
+        const segments = [_]KeySegment{
+            KeySegment.init(table_name),
+            KeySegment.init(pk_value),
+        };
+        const key = StorageKey{
+            .entity_type = .data,
+            .segments = &segments,
+        };
+        return try key.encode(allocator);
+    }
+}
+
+/// Build a prefix for scanning all items in a table: [data][table_name]
+pub fn buildTablePrefix(allocator: std.mem.Allocator, table_name: []const u8) ![]u8 {
+    const segments = [_]KeySegment{
+        KeySegment.init(table_name),
+    };
+
+    const key = StorageKey{
+        .entity_type = .data,
+        .segments = &segments,
+    };
+
+    return try key.encode(allocator);
+}
+
+/// Build a prefix for querying by partition key: [data][table_name][pk_value]
+pub fn buildPartitionPrefix(
+    allocator: std.mem.Allocator,
+    table_name: []const u8,
+    pk_value: []const u8,
+) ![]u8 {
+    const segments = [_]KeySegment{
+        KeySegment.init(table_name),
+        KeySegment.init(pk_value),
+    };
+
+    const key = StorageKey{
+        .entity_type = .data,
+        .segments = &segments,
+    };
+
+    return try key.encode(allocator);
+}
+
+/// Build a GSI key: [gsi][table_name][index_name][gsi_pk][gsi_sk?] -> stores primary key
+pub fn buildGSIKey(
+    allocator: std.mem.Allocator,
+    table_name: []const u8,
+    index_name: []const u8,
+    gsi_pk: []const u8,
+    gsi_sk: ?[]const u8,
+) ![]u8 {
+    if (gsi_sk) |sk| {
+        const segments = [_]KeySegment{
+            KeySegment.init(table_name),
+            KeySegment.init(index_name),
+            KeySegment.init(gsi_pk),
+            KeySegment.init(sk),
+        };
+        const key = StorageKey{
+            .entity_type = .gsi,
+            .segments = &segments,
+        };
+        return try key.encode(allocator);
+    } else {
+        const segments = [_]KeySegment{
+            KeySegment.init(table_name),
+            KeySegment.init(index_name),
+            KeySegment.init(gsi_pk),
+        };
+        const key = StorageKey{
+            .entity_type = .gsi,
+            .segments = &segments,
+        };
+        return try key.encode(allocator);
+    }
+}
+
+/// Build an LSI key: [lsi][table_name][index_name][pk][lsi_sk]
+pub fn buildLSIKey(
+    allocator: std.mem.Allocator,
+    table_name: []const u8,
+    index_name: []const u8,
+    pk: []const u8,
+    lsi_sk: []const u8,
+) ![]u8 {
+    const segments = [_]KeySegment{
+        KeySegment.init(table_name),
+        KeySegment.init(index_name),
+        KeySegment.init(pk),
+        KeySegment.init(lsi_sk),
+    };
+
+    const key = StorageKey{
+        .entity_type = .lsi,
+        .segments = &segments,
+    };
+
+    return try key.encode(allocator);
+}
+
+/// Debug helper: convert binary key to human-readable string
+pub fn keyToDebugString(allocator: std.mem.Allocator, key: []const u8) ![]u8 {
+    var decoder = KeyDecoder.init(key);
+
+    var buf = std.ArrayList(u8).init(allocator);
+    errdefer buf.deinit();
+    const writer = buf.writer();
+
+    const entity_type = decoder.readEntityType() catch |err| {
+        try writer.print("INVALID_KEY: {}", .{err});
+        return buf.toOwnedSlice();
+    };
+
+    try writer.print("[{}]", .{entity_type});
+
+    var segment_num: usize = 0;
+    while (decoder.hasMore()) {
+        const segment = decoder.readSegmentBorrowed() catch |err| {
+            try writer.print(" ERROR:{}", .{err});
+            break;
+        };
+
+        // Try to print as UTF-8, fall back to hex
+        if (std.unicode.utf8ValidateSlice(segment)) {
+            try writer.print(" '{s}'", .{segment});
+        } else {
+            try writer.writeAll(" 0x");
+            for (segment) |byte| {
+                try writer.print("{X:0>2}", .{byte});
+            }
+        }
+        segment_num += 1;
+    }
+
+    return buf.toOwnedSlice();
+}
+
+// ============================================================================
+// Varint encoding helpers (variable-length integer encoding)
+// Uses LEB128 format: 7 bits per byte, MSB indicates continuation
+// ============================================================================
+
+fn encodeVarint(writer: anytype, value: usize) !void {
+    var v = value;
+    while (true) {
+        const byte = @as(u8, @intCast(v & 0x7F));
+        v >>= 7;
+
+        if (v == 0) {
+            try writer.writeByte(byte);
+            return;
+        } else {
+            try writer.writeByte(byte | 0x80);
+        }
+    }
+}
+
+fn varintSize(value: usize) usize {
+    if (value == 0) return 1;
+
+    var v = value;
+    var size: usize = 0;
+    while (v > 0) {
+        size += 1;
+        v >>= 7;
+    }
+    return size;
+}

src/main.zig

@@ -17,19 +17,14 @@ pub fn main() !void {
     defer _ = gpa.deinit();
     const allocator = gpa.allocator();
 
-    // Parse command line args
     const config = try parseArgs(allocator);
-
-    // Print banner
     printBanner(config);
 
-    // Ensure data directory exists
     std.fs.cwd().makePath(config.data_dir) catch |err| {
         std.log.err("Failed to create data directory: {any}", .{err});
         return;
     };
 
-    // Initialize storage engine
     var engine = storage.StorageEngine.init(allocator, config.data_dir) catch |err| {
         std.log.err("Failed to initialize storage: {any}", .{err});
         return;
@@ -38,12 +33,22 @@ pub fn main() !void {
 
     std.log.info("Storage engine initialized at {s}", .{config.data_dir});
 
-    // Initialize API handler
     var api_handler = handler.ApiHandler.init(allocator, &engine);
-    handler.setGlobalHandler(&api_handler);
 
-    // Start HTTP server
+    const server_config = http.ServerConfig{
-    var server = try http.Server.init(allocator, config.host, config.port, handler.httpHandler);
+        .max_body_size = 100 * 1024 * 1024,
+        .enable_keep_alive = true,
+        .max_requests_per_connection = 1000,
+    };
+
+    var server = try http.Server.init(
+        allocator,
+        config.host,
+        config.port,
+        handler.ApiHandler.handleRequest,
+        @ptrCast(&api_handler),
+        server_config,
+    );
     defer server.stop();
 
     std.log.info("Starting DynamoDB-compatible server on {s}:{d}", .{ config.host, config.port });
@@ -57,7 +62,6 @@ fn parseArgs(allocator: std.mem.Allocator) !Config {
     var args = try std.process.argsWithAllocator(allocator);
     defer args.deinit();
 
-    // Skip program name
     _ = args.next();
 
     while (args.next()) |arg| {
@@ -71,7 +75,6 @@ fn parseArgs(allocator: std.mem.Allocator) !Config {
             }
         } else if (std.mem.eql(u8, arg, "--data-dir") or std.mem.eql(u8, arg, "-d")) {
             if (args.next()) |dir| {
-                // Need sentinel-terminated string for RocksDB
                 const owned = try allocator.dupeZ(u8, dir);
                 config.data_dir = owned;
             }
@@ -83,7 +86,6 @@ fn parseArgs(allocator: std.mem.Allocator) !Config {
         }
     }
 
-    // Check environment variables
     if (std.posix.getenv("DYNAMODB_PORT")) |port_str| {
         config.port = std.fmt.parseInt(u16, port_str, 10) catch config.port;
     }
@@ -107,14 +109,6 @@ fn printHelp() void {
         \\  -v, --verbose          Enable verbose logging
         \\      --help             Show this help message
         \\
-        \\Environment Variables:
-        \\  DYNAMODB_PORT          Override port
-        \\  ROCKSDB_DATA_DIR       Override data directory
-        \\
-        \\Examples:
-        \\  zynamodb                           # Start with defaults
-        \\  zynamodb -p 8080 -d /var/lib/db   # Custom port and data dir
-        \\
     ;
     std.debug.print("{s}", .{help});
 }
@@ -141,7 +135,6 @@ fn printBanner(config: Config) void {
     std.debug.print("  Port: {d} | Data Dir: {s}\n\n", .{ config.port, config.data_dir });
 }
 
-// Re-export modules for testing
 pub const _rocksdb = rocksdb;
 pub const _http = http;
 pub const _storage = storage;

src/rocksdb.zig

@@ -231,78 +231,3 @@ pub const Iterator = struct {
         return v[0..len];
     }
 };
-
-// Tests
-test "rocksdb basic operations" {
-    const allocator = std.testing.allocator;
-
-    // Use temp directory
-    const path = "/tmp/test_rocksdb_basic";
-    defer {
-        std.fs.deleteTreeAbsolute(path) catch {};
-    }
-
-    var db = try DB.open(path, true);
-    defer db.close();
-
-    // Put and get
-    try db.put("hello", "world");
-    const val = try db.get(allocator, "hello");
-    try std.testing.expectEqualStrings("world", val.?);
-    allocator.free(val.?);
-
-    // Delete
-    try db.delete("hello");
-    const deleted = try db.get(allocator, "hello");
-    try std.testing.expect(deleted == null);
-}
-
-test "rocksdb write batch" {
-    const allocator = std.testing.allocator;
-
-    const path = "/tmp/test_rocksdb_batch";
-    defer {
-        std.fs.deleteTreeAbsolute(path) catch {};
-    }
-
-    var db = try DB.open(path, true);
-    defer db.close();
-
-    var batch = WriteBatch.init() orelse unreachable;
-    defer batch.deinit();
-
-    batch.put("key1", "value1");
-    batch.put("key2", "value2");
-    batch.put("key3", "value3");
-
-    try batch.write(&db);
-
-    const v1 = try db.get(allocator, "key1");
-    defer if (v1) |v| allocator.free(v);
-    try std.testing.expectEqualStrings("value1", v1.?);
-}
-
-test "rocksdb iterator" {
-    const path = "/tmp/test_rocksdb_iter";
-    defer {
-        std.fs.deleteTreeAbsolute(path) catch {};
-    }
-
-    var db = try DB.open(path, true);
-    defer db.close();
-
-    try db.put("a", "1");
-    try db.put("b", "2");
-    try db.put("c", "3");
-
-    var iter = Iterator.init(&db) orelse unreachable;
-    defer iter.deinit();
-
-    iter.seekToFirst();
-
-    var count: usize = 0;
-    while (iter.valid()) : (iter.next()) {
-        count += 1;
-    }
-    try std.testing.expectEqual(@as(usize, 3), count);
-}