@kensio/yulin 1.20.17 → 1.21.1

package/dist/service/iam/authorize/allow/sim-iam-allow-requirement.d.ts

@@ -115,11 +115,12 @@ export declare class SimIamMandatoryResourcePolicyRequirement implements SimIamA
  *
  * A resource policy naming the caller still allows the request on its own, as
  * a KMS key policy naming a Role does. A policy admitting whoever the request
- * came from does not, because what it admits is the service. That is the
- * difference between a key policy naming a Role and the aws/ssm key policy,
- * which admits the Account's principals reaching KMS through Parameter Store
- * and still leaves a Role holding only ssm:GetParameter unable to decrypt a
- * SecureString.
+ * came from does not, because what it admits is the service, and an identity
+ * policy has to allow the action as well.
+ *
+ * Nothing in the simulation asks for this rule. Parameter Store is the case it
+ * was written for, and the aws/ssm key policy grants its cryptographic actions
+ * to a wildcard principal outright.
  */
 export declare class SimIamCallerPermissionRequirement implements SimIamAllowRequirement {
     /**

package/dist/service/iam/authorize/allow/sim-iam-allow-requirement.js

@@ -120,11 +120,12 @@ export class SimIamMandatoryResourcePolicyRequirement {
  *
  * A resource policy naming the caller still allows the request on its own, as
  * a KMS key policy naming a Role does. A policy admitting whoever the request
- * came from does not, because what it admits is the service. That is the
- * difference between a key policy naming a Role and the aws/ssm key policy,
- * which admits the Account's principals reaching KMS through Parameter Store
- * and still leaves a Role holding only ssm:GetParameter unable to decrypt a
- * SecureString.
+ * came from does not, because what it admits is the service, and an identity
+ * policy has to allow the action as well.
+ *
+ * Nothing in the simulation asks for this rule. Parameter Store is the case it
+ * was written for, and the aws/ssm key policy grants its cryptographic actions
+ * to a wildcard principal outright.
  */
 export class SimIamCallerPermissionRequirement {
     /**

package/dist/service/iam/authorize/context/sim-iam-auth-z-input.d.ts

@@ -78,10 +78,12 @@ export interface SimIamAuthorizationInput {
      * resource policy admitting the caller is enough on its own. A service sets
      * this where it reaches another service as the caller. A resource policy
      * that admits whoever the request came from then grants nothing by itself,
-     * because what it admits is the service. Reading a SecureString needs
-     * kms:Decrypt for that reason, even under the aws/ssm key, whose policy
-     * admits the Account's principals reaching KMS through Parameter Store. A
-     * resource policy naming the caller still allows the request on its own.
+     * because what it admits is the service. A resource policy naming the caller
+     * still allows the request on its own.
+     *
+     * No simulated service sets this. Parameter Store is the case it was written
+     * for, and the aws/ssm key policy grants its cryptographic actions to a
+     * wildcard principal outright.
      */
     readonly withCallerPermissions?: boolean | undefined;
 }

package/dist/service/kms/command/sim-kms-request-options.d.ts

@@ -24,11 +24,15 @@ export interface SimKmsRequestOptions {
      * Whether the service named by `viaService` is making the request with the
      * caller's own KMS permissions rather than with its own.
      *
-     * Parameter Store decrypts a SecureString this way. A caller holding
-     * ssm:GetParameter and no kms:Decrypt is refused even under the aws/ssm key,
-     * whose policy admits the Account's principals reaching KMS through Systems
-     * Manager. A key policy naming the caller still allows the request on its
-     * own, as it does for any other KMS request.
+     * A key policy admitting whoever the request came from then grants nothing
+     * by itself, because what it admits is the service, and the caller has to
+     * hold the KMS action in an identity policy as well. A key policy naming the
+     * caller still allows the request on its own, as it does for any other KMS
+     * request.
+     *
+     * No simulated service sets this. Parameter Store is the case it was written
+     * for, and the aws/ssm key policy grants its cryptographic actions to a
+     * wildcard principal outright.
      */
     readonly withCallerPermissions?: boolean | undefined;
 }

package/dist/service/lambda/command/create-function/create-function.handler.d.ts

@@ -7,6 +7,7 @@ import { type SimIamInterServiceAuthZ } from "../../../iam/authorize/sim-iam-int
 import type { SimLambdaContainerImages } from "../../function/code/image/sim-lambda-container-images.js";
 import type { SimLambdaCodeStore } from "../../function/code/store/sim-lambda-code-store.js";
 import type { SimLambdaVmSdkModuleProvider } from "../../function/code/vm/sdk/sim-lambda-vm-sdk-module-provider.js";
+import type { SimCloudWatchServiceWriter } from "../../../cloudwatch/write/sim-cloudwatch-service-writer.js";
 import type { SimLogsServiceWriter } from "../../../logs/write/sim-logs-service-writer.js";
 import type { SimLambdaOutboundHttp } from "../../function/outbound/sim-lambda-outbound-http.js";
 import { SimLambdaEnvironmentConflicts } from "../../function/environment/sim-lambda-environment-conflicts.js";
@@ -23,6 +24,7 @@ interface CreateFunctionCommandHandlerProperties {
     vmSdkModuleProvider?: SimLambdaVmSdkModuleProvider | undefined;
     environmentConflicts?: SimLambdaEnvironmentConflicts;
     logs?: SimLogsServiceWriter | undefined;
+    metrics?: SimCloudWatchServiceWriter | undefined;
     outboundHttp?: SimLambdaOutboundHttp | undefined;
 }
 interface CreateFunctionCommandHandlerOptions {
@@ -42,6 +44,7 @@ export declare class CreateFunctionCommandHandler implements CommandHandler<SimC
     private readonly codeResolver;
     private readonly environmentConflicts;
     private readonly logs;
+    private readonly metrics;
     private readonly outboundHttp;
     constructor(properties: CreateFunctionCommandHandlerProperties);
     /**

package/dist/service/lambda/command/create-function/create-function.handler.js

@@ -22,9 +22,10 @@ export class CreateFunctionCommandHandler {
     codeResolver;
     environmentConflicts;
     logs;
+    metrics;
     outboundHttp;
     constructor(properties) {
-        const { accountRegionScope, functions, runAsOwner, iam = new SimIamAllowAllAuth(), background = new BackgroundTasks(), codeStore, containerImages, vmSdkModuleProvider, environmentConflicts = new SimLambdaEnvironmentConflicts(), logs, outboundHttp, } = properties;
+        const { accountRegionScope, functions, runAsOwner, iam = new SimIamAllowAllAuth(), background = new BackgroundTasks(), codeStore, containerImages, vmSdkModuleProvider, environmentConflicts = new SimLambdaEnvironmentConflicts(), logs, metrics, outboundHttp, } = properties;
         this.accountRegionScope = accountRegionScope;
         this.functions = functions;
         this.runAsOwner = runAsOwner;
@@ -41,6 +42,7 @@ export class CreateFunctionCommandHandler {
         });
         this.environmentConflicts = environmentConflicts;
         this.logs = logs;
+        this.metrics = metrics;
         this.outboundHttp = outboundHttp;
     }
     /**
@@ -70,6 +72,7 @@ export class CreateFunctionCommandHandler {
             runAsOwner: this.runAsOwner,
             clock: this.background,
             logs: this.logs,
+            metrics: this.metrics,
             outboundHttp: this.outboundHttp,
         });
         this.functions.set(simFunction.name, simFunction);

package/dist/service/lambda/command/function/sim-lambda-function-commands.d.ts

@@ -6,6 +6,7 @@ import type { SimIamInterServiceAuthZ } from "../../../iam/authorize/sim-iam-int
 import type { SimLambdaContainerImages } from "../../function/code/image/sim-lambda-container-images.js";
 import type { SimLambdaCodeStore } from "../../function/code/store/sim-lambda-code-store.js";
 import type { SimLambdaVmSdkModuleProvider } from "../../function/code/vm/sdk/sim-lambda-vm-sdk-module-provider.js";
+import type { SimCloudWatchServiceWriter } from "../../../cloudwatch/write/sim-cloudwatch-service-writer.js";
 import type { SimLogsServiceWriter } from "../../../logs/write/sim-logs-service-writer.js";
 import type { SimLambdaOutboundHttp } from "../../function/outbound/sim-lambda-outbound-http.js";
 import type { SimLambdaDestinationTargets } from "../../destination/sim-lambda-destination-targets.js";
@@ -38,6 +39,7 @@ interface SimLambdaFunctionCommandsProperties {
     readonly containerImages?: SimLambdaContainerImages | undefined;
     readonly vmSdkModuleProvider?: SimLambdaVmSdkModuleProvider | undefined;
     readonly logs?: SimLogsServiceWriter | undefined;
+    readonly metrics?: SimCloudWatchServiceWriter | undefined;
     readonly outboundHttp?: SimLambdaOutboundHttp | undefined;
 }
 interface SimLambdaFunctionCommandOptions {

package/dist/service/lambda/event-source/poll/kinesis/sim-lambda-kinesis-stream-delivery.js

@@ -1,4 +1,6 @@
 import { SimLambdaStreamCascadeGuard } from "../../stream/sim-lambda-stream-cascade-guard.js";
+import { countSimLambdaKinesisIteratorAge } from "../sim-lambda-stream-iterator-age.js";
+import { simLambdaStreamSequenceNumbers } from "../sim-lambda-stream-sequence-numbers.js";
 import { SimLambdaStreamBatchResponse } from "../sim-lambda-stream-batch-response.js";
 import { SimLambdaKinesisStreamEventBuilder } from "./sim-lambda-kinesis-stream-event.js";
 /**
@@ -56,20 +58,14 @@ export class SimLambdaKinesisStreamDelivery {
             // the stream sees is the batch being tried again.
             return this.batchResponse.failed();
         }
+        finally {
+            countSimLambdaKinesisIteratorAge(simFunction, records);
+        }
     }
 }
 /**
- * The sequence numbers a batch's records can be named by, in stream order.
- *
- * A Kinesis batch item failure names a record by its sequence number, the way a
- * DynamoDB one does, rather than by the `eventID` the event carried.
+ * The sequence numbers this batch's records can be named by.
  */
 function sequenceNumbersOf(records) {
-    return records.flatMap((record) => {
-        const sequenceNumber = record.SequenceNumber;
-        if (sequenceNumber === undefined || sequenceNumber === "") {
-            return [];
-        }
-        return [sequenceNumber];
-    });
+    return simLambdaStreamSequenceNumbers(records.map((one) => one.SequenceNumber));
 }

package/dist/service/lambda/event-source/poll/sim-lambda-dynamodb-stream-delivery.js

@@ -1,5 +1,7 @@
 import { SimLambdaStreamCascadeGuard } from "../stream/sim-lambda-stream-cascade-guard.js";
 import { SimLambdaDynamoDbStreamEventBuilder } from "./sim-lambda-dynamodb-stream-event.js";
+import { countSimLambdaDynamoDbIteratorAge } from "./sim-lambda-stream-iterator-age.js";
+import { simLambdaStreamSequenceNumbers } from "./sim-lambda-stream-sequence-numbers.js";
 import { SimLambdaStreamBatchResponse } from "./sim-lambda-stream-batch-response.js";
 /**
  * Hands one batch of stream records to a function and says what became of it.
@@ -55,17 +57,14 @@ export class SimLambdaDynamoDbStreamDelivery {
             // the table sees is the batch being tried again.
             return this.batchResponse.failed();
         }
+        finally {
+            countSimLambdaDynamoDbIteratorAge(simFunction, records);
+        }
     }
 }
 /**
- * The sequence numbers a batch's records can be named by, in stream order.
+ * The sequence numbers this batch's records can be named by.
  */
 function sequenceNumbersOf(records) {
-    return records.flatMap((record) => {
-        const sequenceNumber = record.dynamodb?.SequenceNumber;
-        if (sequenceNumber === undefined || sequenceNumber === "") {
-            return [];
-        }
-        return [sequenceNumber];
-    });
+    return simLambdaStreamSequenceNumbers(records.map((one) => one.dynamodb?.SequenceNumber));
 }

package/dist/service/lambda/event-source/poll/sim-lambda-stream-iterator-age.d.ts

@@ -0,0 +1,11 @@
+import type { SimLambdaFunction } from "../../function/sim-lambda-function.js";
+import type { SimLambdaKinesisStreamRecord } from "../stream/kinesis/sim-lambda-kinesis-streams.js";
+import type { SimLambdaEventSourceStreamRecord } from "../stream/sim-lambda-event-source-streams.js";
+/**
+ * Count what a finished DynamoDB Streams batch left on the clock.
+ */
+export declare function countSimLambdaDynamoDbIteratorAge(simFunction: SimLambdaFunction, records: readonly SimLambdaEventSourceStreamRecord[]): void;
+/**
+ * Count what a finished Kinesis batch left on the clock.
+ */
+export declare function countSimLambdaKinesisIteratorAge(simFunction: SimLambdaFunction, records: readonly SimLambdaKinesisStreamRecord[]): void;

package/dist/service/lambda/event-source/poll/sim-lambda-stream-iterator-age.js

@@ -0,0 +1,31 @@
+/**
+ * Count what a finished DynamoDB Streams batch left on the clock.
+ */
+export function countSimLambdaDynamoDbIteratorAge(simFunction, records) {
+    simFunction.metrics.iteratorAge.count(simFunction.name, newestOf(records.map((one) => one.dynamodb?.ApproximateCreationDateTime)));
+}
+/**
+ * Count what a finished Kinesis batch left on the clock.
+ */
+export function countSimLambdaKinesisIteratorAge(simFunction, records) {
+    simFunction.metrics.iteratorAge.count(simFunction.name, newestOf(records.map((one) => one.ApproximateArrivalTimestamp)));
+}
+/**
+ * The latest of the times given, if any of them is a time.
+ *
+ * This is what `IteratorAge` is measured back from. Records reach a poller in
+ * stream order, and the whole batch is read anyway because a record carrying
+ * no time would otherwise decide the answer by where it sits.
+ *
+ * A batch whose records all arrive without a time has no answer, and the
+ * metric is left uncounted rather than measured from nothing.
+ */
+function newestOf(times) {
+    let newest;
+    for (const time of times) {
+        if (time !== undefined && (newest === undefined || time > newest)) {
+            newest = time;
+        }
+    }
+    return newest;
+}

package/dist/service/lambda/event-source/poll/sim-lambda-stream-sequence-numbers.d.ts

@@ -0,0 +1,10 @@
+/**
+ * The sequence numbers a batch's records can be named by, in stream order.
+ *
+ * A batch item failure names a record by its sequence number, on Kinesis the
+ * same way as on DynamoDB Streams, rather than by the `eventID` a DynamoDB
+ * event carries. Both pollers read the same list out of whatever their own
+ * records call the field. A record without a sequence number cannot be named,
+ * and it is left out rather than reported as an empty name.
+ */
+export declare function simLambdaStreamSequenceNumbers(values: readonly (string | undefined)[]): readonly string[];

package/dist/service/lambda/event-source/poll/sim-lambda-stream-sequence-numbers.js

@@ -0,0 +1,12 @@
+/**
+ * The sequence numbers a batch's records can be named by, in stream order.
+ *
+ * A batch item failure names a record by its sequence number, on Kinesis the
+ * same way as on DynamoDB Streams, rather than by the `eventID` a DynamoDB
+ * event carries. Both pollers read the same list out of whatever their own
+ * records call the field. A record without a sequence number cannot be named,
+ * and it is left out rather than reported as an empty name.
+ */
+export function simLambdaStreamSequenceNumbers(values) {
+    return values.flatMap((value) => value === undefined || value === "" ? [] : [value]);
+}

package/dist/service/lambda/function/sim-lambda-function.d.ts

@@ -3,6 +3,7 @@ import { type SimLambdaFunctionArn, type SimLambdaFunctionConfiguration, type Si
 import { type SimLambdaExecutableCode } from "./code/sim-lambda-executable-code.js";
 import { SimLambdaEnvironment } from "./environment/sim-lambda-environment.js";
 import { SimLambdaFunctionPolicy } from "./policy/sim-lambda-function-policy.js";
+import { SimLambdaFunctionMetrics } from "../metric/sim-lambda-function-metrics.js";
 import { type SimLambdaFunctionConfigurationUpdate } from "./sim-lambda-function-reconfiguration.js";
 import type { SimLambdaFunctionName, SimLambdaFunctionProperties } from "./sim-lambda-function.type.js";
 export type { SimLambdaFunctionName, SimLambdaFunctionMap, } from "./sim-lambda-function.type.js";
@@ -44,6 +45,8 @@ export declare class SimLambdaFunction {
      * sees.
      */
     readonly resourcePolicy: SimLambdaFunctionPolicy;
+    /** What this function publishes about its own work into `AWS/Lambda`. */
+    readonly metrics: SimLambdaFunctionMetrics;
     private readonly properties;
     private readonly runAsOwner;
     private readonly runner;

package/dist/service/lambda/function/sim-lambda-function.js

@@ -7,6 +7,7 @@ import { SimLambdaEnvironment } from "./environment/sim-lambda-environment.js";
 import { SimLambdaFunctionLogging } from "./logging/sim-lambda-function-logging.js";
 import { SimLambdaFunctionPolicy } from "./policy/sim-lambda-function-policy.js";
 import { SimLambdaHandlerRunner } from "./invoke/sim-lambda-handler-runner.js";
+import { SimLambdaFunctionMetrics } from "../metric/sim-lambda-function-metrics.js";
 import { SimLambdaInvokeContextBuilder } from "./invoke/sim-lambda-invoke-context-builder.js";
 import { runSimLambdaInHostScope } from "./invoke/sim-lambda-host-scope.js";
 import { SimRealClock } from "../../../util/clock/sim-clock.js";
@@ -49,6 +50,8 @@ export class SimLambdaFunction {
      * sees.
      */
     resourcePolicy = new SimLambdaFunctionPolicy();
+    /** What this function publishes about its own work into `AWS/Lambda`. */
+    metrics;
     #state;
     #code;
     properties;
@@ -58,7 +61,7 @@ export class SimLambdaFunction {
     logging;
     outboundHttp;
     constructor(properties) {
-        const { name, roleArn, accountRegionScope = simAwsAccountRegionScopeFactory.make(), handlerFunction = defaultLambdaHandler, code, state = "Pending", handlerName, runtimeName, description, timeoutSeconds = DEFAULT_SIM_LAMBDA_TIMEOUT_SECONDS, memorySizeMb = DEFAULT_SIM_LAMBDA_MEMORY_SIZE_MB, environment, deadLetterTargetArn, runAsOwner = this, version = SIM_LAMBDA_LATEST_VERSION, clock = new SimRealClock(), logs, outboundHttp, } = properties;
+        const { name, roleArn, accountRegionScope = simAwsAccountRegionScopeFactory.make(), handlerFunction = defaultLambdaHandler, code, state = "Pending", handlerName, runtimeName, description, timeoutSeconds = DEFAULT_SIM_LAMBDA_TIMEOUT_SECONDS, memorySizeMb = DEFAULT_SIM_LAMBDA_MEMORY_SIZE_MB, environment, deadLetterTargetArn, runAsOwner = this, version = SIM_LAMBDA_LATEST_VERSION, clock = new SimRealClock(), logs, metrics, outboundHttp, } = properties;
         this.properties = properties;
         this.clock = clock;
         this.version = version;
@@ -82,6 +85,7 @@ export class SimLambdaFunction {
         this.deadLetterTargetArn = deadLetterTargetArn;
         this.runAsOwner = runAsOwner;
         this.outboundHttp = outboundHttp;
+        this.metrics = new SimLambdaFunctionMetrics({ metrics, clock });
         this.logging = new SimLambdaFunctionLogging({
             functionName: name,
             logs,
@@ -188,7 +192,7 @@ export class SimLambdaFunction {
             logStreamName: this.logging.logStreamName(),
         });
         this.logging.recordFrom(this.#code);
-        return await simAwsRunAsContext.run(this.runAsOwner, { kind: "arn", arn: this.roleArn }, async () => await this.environment.runWith(async () => await this.runInHostScope(async () => await this.logging.around(async () => await this.runner.run(this.#code.handlerFunction(), event, contextBuilder)))));
+        return await this.metrics.around(String(this.name), async () => simAwsRunAsContext.run(this.runAsOwner, { kind: "arn", arn: this.roleArn }, async () => await this.environment.runWith(async () => await this.runInHostScope(async () => await this.logging.around(async () => await this.runner.run(this.#code.handlerFunction(), event, contextBuilder))))));
     }
     /**
      * Run an invocation with the process globals host-scope code reads bridged

package/dist/service/lambda/function/sim-lambda-function.type.d.ts

@@ -2,6 +2,7 @@ import type { Brand } from "../../../util/brand.type.js";
 import type { SimClock } from "../../../util/clock/sim-clock.js";
 import type { SimAwsRunAsOwner } from "../../aws/caller/sim-aws-run-as-context.js";
 import type { SimAwsAccountRegionScope } from "../../aws/sim-aws-account-region-scope.js";
+import type { SimCloudWatchServiceWriter } from "../../cloudwatch/write/sim-cloudwatch-service-writer.js";
 import type { SimLogsServiceWriter } from "../../logs/write/sim-logs-service-writer.js";
 import type { SimLambdaExecutableCode } from "./code/sim-lambda-executable-code.js";
 import type { SimLambdaEnvironment } from "./environment/sim-lambda-environment.js";
@@ -47,6 +48,12 @@ export interface SimLambdaFunctionProperties {
      * only to the host streams.
      */
     logs?: SimLogsServiceWriter | undefined;
+    /**
+     * Where this function's invocations are counted. A function built
+     * standalone, outside a SimAws instance, has no simulated CloudWatch to
+     * publish `AWS/Lambda` metrics into and counts nothing.
+     */
+    metrics?: SimCloudWatchServiceWriter | undefined;
     /**
      * Where the HTTP requests this function's code makes to hostnames the
      * simulation serves are answered. A function built standalone, outside a

package/dist/service/lambda/metric/sim-lambda-function-metrics.d.ts

@@ -0,0 +1,47 @@
+import type { SimClock } from "../../../util/clock/sim-clock.js";
+import type { SimCloudWatchServiceWriter } from "../../cloudwatch/write/sim-cloudwatch-service-writer.js";
+import { SimLambdaIteratorAge } from "./sim-lambda-iterator-age.js";
+/**
+ * How one invocation went, as the metrics read it.
+ */
+export interface SimLambdaInvocationOutcome {
+    readonly functionName: string;
+    /** How far the simulation's clock moved while the handler ran. */
+    readonly durationMilliseconds: number;
+    /** Whether the handler threw, which is what real Lambda counts an error. */
+    readonly failed: boolean;
+}
+interface SimLambdaFunctionMetricsProperties {
+    readonly metrics: SimCloudWatchServiceWriter | undefined;
+    readonly clock: SimClock;
+}
+/**
+ * What a simulated Lambda function publishes about its own work.
+ *
+ * Real Lambda publishes these without being asked and without a caller needing
+ * any permission, so they go in through simulated CloudWatch's service writer
+ * rather than through `PutMetricData`, which refuses the `AWS/Lambda`
+ * namespace exactly as an account does.
+ *
+ * A function built on its own, outside a `SimAws` instance, has no CloudWatch
+ * to publish into and counts nothing.
+ */
+export declare class SimLambdaFunctionMetrics {
+    #private;
+    /** How far behind its stream a finished batch left this function. */
+    readonly iteratorAge: SimLambdaIteratorAge;
+    constructor(properties: SimLambdaFunctionMetricsProperties);
+    /**
+     * Run one invocation and count how it went.
+     *
+     * `Invocations` counts every invocation, including one that failed, which is
+     * how real Lambda counts them. `Errors` counts the ones that threw, so an
+     * alarm reading one against the other gets a failure rate.
+     *
+     * The duration is measured on the simulation's clock rather than the host's,
+     * so it is a number a test can assert on. A handler that moves the clock
+     * reports the time it moved, and one that does not reports nothing spent.
+     */
+    around<T>(functionName: string, run: () => Promise<T>): Promise<T>;
+}
+export {};

package/dist/service/lambda/metric/sim-lambda-function-metrics.js

@@ -0,0 +1,83 @@
+import { SimLambdaIteratorAge } from "./sim-lambda-iterator-age.js";
+import { simLambdaFunctionDimensions, simLambdaMetricNamespace, } from "./sim-lambda-metrics.js";
+/**
+ * What a simulated Lambda function publishes about its own work.
+ *
+ * Real Lambda publishes these without being asked and without a caller needing
+ * any permission, so they go in through simulated CloudWatch's service writer
+ * rather than through `PutMetricData`, which refuses the `AWS/Lambda`
+ * namespace exactly as an account does.
+ *
+ * A function built on its own, outside a `SimAws` instance, has no CloudWatch
+ * to publish into and counts nothing.
+ */
+export class SimLambdaFunctionMetrics {
+    /** How far behind its stream a finished batch left this function. */
+    iteratorAge;
+    #metrics;
+    #clock;
+    constructor(properties) {
+        this.#metrics = properties.metrics;
+        this.#clock = properties.clock;
+        this.iteratorAge = new SimLambdaIteratorAge(properties);
+    }
+    /**
+     * Run one invocation and count how it went.
+     *
+     * `Invocations` counts every invocation, including one that failed, which is
+     * how real Lambda counts them. `Errors` counts the ones that threw, so an
+     * alarm reading one against the other gets a failure rate.
+     *
+     * The duration is measured on the simulation's clock rather than the host's,
+     * so it is a number a test can assert on. A handler that moves the clock
+     * reports the time it moved, and one that does not reports nothing spent.
+     */
+    async around(functionName, run) {
+        const startedAt = this.#clock.now().getTime();
+        let failed = true;
+        try {
+            const result = await run();
+            failed = false;
+            return result;
+        }
+        finally {
+            this.#metrics?.publish(invocationData({
+                functionName,
+                durationMilliseconds: this.#clock.now().getTime() - startedAt,
+                failed,
+            }));
+        }
+    }
+}
+/**
+ * The datapoints one finished invocation produced.
+ */
+function invocationData(outcome) {
+    const dimensions = simLambdaFunctionDimensions(outcome.functionName);
+    const data = [
+        {
+            namespace: simLambdaMetricNamespace,
+            metricName: "Invocations",
+            dimensions,
+            value: 1,
+            unit: "Count",
+        },
+        {
+            namespace: simLambdaMetricNamespace,
+            metricName: "Duration",
+            dimensions,
+            value: outcome.durationMilliseconds,
+            unit: "Milliseconds",
+        },
+    ];
+    if (outcome.failed) {
+        data.push({
+            namespace: simLambdaMetricNamespace,
+            metricName: "Errors",
+            dimensions,
+            value: 1,
+            unit: "Count",
+        });
+    }
+    return data;
+}

package/dist/service/lambda/metric/sim-lambda-iterator-age.d.ts

@@ -0,0 +1,29 @@
+import type { SimClock } from "../../../util/clock/sim-clock.js";
+import type { SimCloudWatchServiceWriter } from "../../cloudwatch/write/sim-cloudwatch-service-writer.js";
+interface SimLambdaIteratorAgeProperties {
+    readonly metrics: SimCloudWatchServiceWriter | undefined;
+    readonly clock: SimClock;
+}
+/**
+ * How far behind its stream a finished batch left a function.
+ *
+ * Real Lambda publishes `IteratorAge` when a function finishes processing a
+ * batch of stream records, as the distance between the newest record in the
+ * batch and the moment the batch finished. A batch that failed is counted too,
+ * because the retry leaves the function further behind rather than caught up.
+ *
+ * The age is measured on the simulation's clock, so a test that lets records
+ * age before anything reads them gets back the interval it let pass.
+ */
+export declare class SimLambdaIteratorAge {
+    #private;
+    constructor(properties: SimLambdaIteratorAgeProperties);
+    /**
+     * Count one finished batch.
+     *
+     * A batch whose records carry no creation time is left uncounted, because
+     * there is nothing to measure the age from.
+     */
+    count(functionName: string, newestRecordAt: Date | undefined): void;
+}
+export {};

package/dist/service/lambda/metric/sim-lambda-iterator-age.js

@@ -0,0 +1,41 @@
+import { simLambdaFunctionDimensions, simLambdaMetricNamespace, } from "./sim-lambda-metrics.js";
+/**
+ * How far behind its stream a finished batch left a function.
+ *
+ * Real Lambda publishes `IteratorAge` when a function finishes processing a
+ * batch of stream records, as the distance between the newest record in the
+ * batch and the moment the batch finished. A batch that failed is counted too,
+ * because the retry leaves the function further behind rather than caught up.
+ *
+ * The age is measured on the simulation's clock, so a test that lets records
+ * age before anything reads them gets back the interval it let pass.
+ */
+export class SimLambdaIteratorAge {
+    #metrics;
+    #clock;
+    constructor(properties) {
+        this.#metrics = properties.metrics;
+        this.#clock = properties.clock;
+    }
+    /**
+     * Count one finished batch.
+     *
+     * A batch whose records carry no creation time is left uncounted, because
+     * there is nothing to measure the age from.
+     */
+    count(functionName, newestRecordAt) {
+        if (newestRecordAt === undefined) {
+            return;
+        }
+        const age = this.#clock.now().getTime() - newestRecordAt.getTime();
+        this.#metrics?.publish([
+            {
+                namespace: simLambdaMetricNamespace,
+                metricName: "IteratorAge",
+                dimensions: simLambdaFunctionDimensions(functionName),
+                value: Math.max(0, age),
+                unit: "Milliseconds",
+            },
+        ]);
+    }
+}

package/dist/service/lambda/metric/sim-lambda-metrics.d.ts

@@ -0,0 +1,12 @@
+import type { SimCloudWatchDimensionInput } from "../../cloudwatch/metric/sim-cloudwatch-dimension.js";
+/**
+ * The namespace real Lambda publishes what it counts about a function under.
+ */
+export declare const simLambdaMetricNamespace = "AWS/Lambda";
+/**
+ * The dimensions every metric here carries.
+ *
+ * Real Lambda dimensions a function's own metrics by `FunctionName`, and an
+ * alarm a stack declares on one names the function the same way.
+ */
+export declare function simLambdaFunctionDimensions(functionName: string): readonly SimCloudWatchDimensionInput[];

package/dist/service/lambda/metric/sim-lambda-metrics.js

@@ -0,0 +1,13 @@
+/**
+ * The namespace real Lambda publishes what it counts about a function under.
+ */
+export const simLambdaMetricNamespace = "AWS/Lambda";
+/**
+ * The dimensions every metric here carries.
+ *
+ * Real Lambda dimensions a function's own metrics by `FunctionName`, and an
+ * alarm a stack declares on one names the function the same way.
+ */
+export function simLambdaFunctionDimensions(functionName) {
+    return [{ Name: "FunctionName", Value: functionName }];
+}

package/dist/service/lambda/sim-lambda-commands.d.ts

@@ -15,6 +15,7 @@ import type { SimLambdaKinesisStreams } from "./event-source/stream/kinesis/sim-
 import { type SimLambdaContainerImages } from "./function/code/image/sim-lambda-container-images.js";
 import type { SimLambdaCodeStore } from "./function/code/store/sim-lambda-code-store.js";
 import type { SimLambdaVmSdkModuleProvider } from "./function/code/vm/sdk/sim-lambda-vm-sdk-module-provider.js";
+import type { SimCloudWatchServiceWriter } from "../cloudwatch/write/sim-cloudwatch-service-writer.js";
 import type { SimLogsServiceWriter } from "../logs/write/sim-logs-service-writer.js";
 import type { SimLambdaOutboundHttp } from "./function/outbound/sim-lambda-outbound-http.js";
 import { SimLambdaEventInvokeConfigStore } from "./function/event-invoke/sim-lambda-event-invoke-config-store.js";
@@ -37,6 +38,7 @@ export interface SimLambdaProperties {
     readonly containerImages?: SimLambdaContainerImages;
     readonly vmSdkModuleProvider?: SimLambdaVmSdkModuleProvider;
     readonly logs?: SimLogsServiceWriter | undefined;
+    readonly metrics?: SimCloudWatchServiceWriter | undefined;
     /**
      * Where the HTTP requests this simulated Lambda's function code makes to
      * hostnames the simulation serves are answered. A standalone SimLambda has

package/dist/service/lambda/sim-lambda-commands.js

@@ -51,7 +51,7 @@ export class SimLambdaCommands {
     eventSourceMappings;
     eventInvokeConfigs;
     constructor(properties) {
-        const { accountRegionScope = simAwsAccountRegionScopeFactory.make(), background = new BackgroundTasks(), codeStore, vmSdkModuleProvider, logs, outboundHttp, 
+        const { accountRegionScope = simAwsAccountRegionScopeFactory.make(), background = new BackgroundTasks(), codeStore, vmSdkModuleProvider, logs, metrics, outboundHttp, 
         // A standalone SimLambda is not reachable over HTTP, so its own registry
         // is enough; a SimAws-created one shares the environment-wide registry
         // the serving layer routes with.
@@ -142,6 +142,7 @@ export class SimLambdaCommands {
             containerImages,
             vmSdkModuleProvider,
             logs,
+            metrics,
             outboundHttp,
         });
     }