@kensio/yulin 1.21.27 → 1.21.29

package/dist/service/lambda/function/outbound/sim-lambda-http2-module.js

@@ -0,0 +1,53 @@
+import { SimLambdaHttp2Session, } from "./sim-lambda-http2-session.js";
+/**
+ * The specifiers a bundler and a hand-written require may ask for the
+ * HTTP/2 module by.
+ */
+const http2ModuleSpecifiers = new Set([
+    "http2",
+    "node:http2",
+]);
+/**
+ * Whether a module specifier names the HTTP/2 module.
+ */
+export function isSimLambdaHttp2ModuleSpecifier(specifier) {
+    return http2ModuleSpecifiers.has(specifier);
+}
+/**
+ * Build the `node:http2` module sim Lambda function code connects through.
+ *
+ * Everything the real module exports is kept, and only `connect` is
+ * replaced. A session to a hostname the simulation serves is a real HTTP/2
+ * session, connected over an in-memory socket pair to a server in this
+ * process that hands each request to the simulation. Every other session is
+ * the host module's, connected exactly as it was asked for.
+ *
+ * Bedrock Runtime's SDK client sends over HTTP/2, so this is where its calls
+ * from function code reach simulated Bedrock.
+ */
+export function makeSimLambdaHttp2Module(properties) {
+    const { hostModule, outbound } = properties;
+    const hostConnect = hostModule["connect"];
+    return {
+        ...hostModule,
+        connect: (...callArguments) => {
+            const authority = authorityUrl(callArguments[0]);
+            if (authority === undefined || !outbound.serves(authority.hostname)) {
+                return hostConnect(...callArguments);
+            }
+            return new SimLambdaHttp2Session(authority, outbound).connect(hostConnect, callArguments);
+        },
+    };
+}
+/**
+ * The URL `connect` was asked for, as a string or a URL, or undefined for
+ * anything that is not one.
+ */
+function authorityUrl(authority) {
+    if (authority instanceof URL) {
+        return authority;
+    }
+    return typeof authority === "string" && URL.canParse(authority)
+        ? new URL(authority)
+        : undefined;
+}

package/dist/service/lambda/function/outbound/sim-lambda-http2-session.d.ts

@@ -0,0 +1,31 @@
+import http2 from "node:http2";
+import type { SimLambdaOutboundHttp } from "./sim-lambda-outbound-http.js";
+/**
+ * The host module's `connect`.
+ */
+export type SimLambdaHttp2Connect = (...callArguments: unknown[]) => http2.ClientHttp2Session;
+/**
+ * One HTTP/2 session the simulation answers.
+ */
+export declare class SimLambdaHttp2Session {
+    private readonly authority;
+    private readonly outbound;
+    private readonly exchanges;
+    constructor(authority: URL, outbound: SimLambdaOutboundHttp);
+    /**
+     * Connect the host module's client to an in-process server.
+     *
+     * The host client does all the HTTP/2 work, so streams, flow control,
+     * timeouts and resets behave as they do over a network socket. Only the
+     * socket it runs over is supplied.
+     */
+    connect(hostConnect: SimLambdaHttp2Connect, callArguments: readonly unknown[]): http2.ClientHttp2Session;
+    private answer;
+    /**
+     * Answer one request from the simulation.
+     *
+     * A request the simulation cannot answer fails the client's stream with the
+     * error that explains it, which is what the SDK rejects the call with.
+     */
+    private respond;
+}

package/dist/service/lambda/function/outbound/sim-lambda-http2-session.js

@@ -0,0 +1,57 @@
+import http2 from "node:http2";
+import { duplexPair } from "node:stream";
+import { simLambdaHttp2ConnectArguments, simLambdaHttp2Request, simLambdaHttp2ResponseHeaders, } from "./sim-lambda-http2-messages.js";
+import { SimLambdaHttp2Exchanges } from "./sim-lambda-http2-exchanges.js";
+/**
+ * One HTTP/2 session the simulation answers.
+ */
+export class SimLambdaHttp2Session {
+    authority;
+    outbound;
+    exchanges = new SimLambdaHttp2Exchanges();
+    constructor(authority, outbound) {
+        this.authority = authority;
+        this.outbound = outbound;
+    }
+    /**
+     * Connect the host module's client to an in-process server.
+     *
+     * The host client does all the HTTP/2 work, so streams, flow control,
+     * timeouts and resets behave as they do over a network socket. Only the
+     * socket it runs over is supplied.
+     */
+    connect(hostConnect, callArguments) {
+        const { options, listener } = simLambdaHttp2ConnectArguments(callArguments);
+        const server = http2.createServer((request, response) => {
+            this.answer(request, response);
+        });
+        const [clientSocket, serverSocket] = duplexPair();
+        server.emit("connection", serverSocket);
+        const session = hostConnect(this.authority, { ...options, createConnection: () => clientSocket }, ...listener);
+        this.exchanges.track(session);
+        return session;
+    }
+    answer(request, response) {
+        const exchange = this.exchanges.exchangeFor(request);
+        exchange.scope.runInAsyncScope(() => {
+            void this.respond(request, response, exchange.stream);
+        });
+    }
+    /**
+     * Answer one request from the simulation.
+     *
+     * A request the simulation cannot answer fails the client's stream with the
+     * error that explains it, which is what the SDK rejects the call with.
+     */
+    async respond(request, response, clientStream) {
+        try {
+            const answered = await this.outbound.fetch(await simLambdaHttp2Request(this.authority, this.outbound, request));
+            const body = Buffer.from(await answered.arrayBuffer());
+            response.writeHead(answered.status, simLambdaHttp2ResponseHeaders(answered.headers));
+            response.end(body);
+        }
+        catch (error) {
+            clientStream.destroy(error);
+        }
+    }
+}

package/dist/service/lambda/function/outbound/sim-lambda-transport-module.d.ts

@@ -0,0 +1,11 @@
+import type { SimLambdaOutboundHttp } from "./sim-lambda-outbound-http.js";
+/**
+ * Whether a module specifier names one of the transport modules function code
+ * makes requests through: `node:http`, `node:https` or `node:http2`.
+ */
+export declare function isSimLambdaTransportModuleSpecifier(specifier: string): boolean;
+/**
+ * The transport module a specifier names, with its requests to the hostnames
+ * the simulation serves answered by the simulation.
+ */
+export declare function makeSimLambdaTransportModule(specifier: string, hostModule: Record<string, unknown>, outbound: SimLambdaOutboundHttp): Record<string, unknown>;

package/dist/service/lambda/function/outbound/sim-lambda-transport-module.js

@@ -0,0 +1,24 @@
+import { isSimLambdaHttpModuleSpecifier, makeSimLambdaHttpModule, simLambdaHttpModuleScheme, } from "./sim-lambda-http-module.js";
+import { isSimLambdaHttp2ModuleSpecifier, makeSimLambdaHttp2Module, } from "./sim-lambda-http2-module.js";
+/**
+ * Whether a module specifier names one of the transport modules function code
+ * makes requests through: `node:http`, `node:https` or `node:http2`.
+ */
+export function isSimLambdaTransportModuleSpecifier(specifier) {
+    return (isSimLambdaHttpModuleSpecifier(specifier) ||
+        isSimLambdaHttp2ModuleSpecifier(specifier));
+}
+/**
+ * The transport module a specifier names, with its requests to the hostnames
+ * the simulation serves answered by the simulation.
+ */
+export function makeSimLambdaTransportModule(specifier, hostModule, outbound) {
+    if (isSimLambdaHttp2ModuleSpecifier(specifier)) {
+        return makeSimLambdaHttp2Module({ hostModule, outbound });
+    }
+    return makeSimLambdaHttpModule({
+        hostModule,
+        outbound,
+        scheme: simLambdaHttpModuleScheme(specifier),
+    });
+}

package/docs/serve/README.md

@@ -415,6 +415,6 @@ service guide lists its supported commands.
 - `yulin watch` does not preserve simulated state across a restart or reload changed Lambda and
   CloudFront Function code inside the current process.
 - The shared AWS API endpoint refuses unsupported protocols and operations with `501 Not
-Implemented`.
+  Implemented`.
 - Some service functionality is available only through `SimAws` or SDK interception. Check the
   relevant service guide before depending on access through the local endpoint.

package/docs/services/cloudformation/README.md

@@ -948,8 +948,20 @@ console.log(
 
 A parameter with no supplied value takes the template default, when the template has one.
 
-A parameter's `Type` is read for the `AWS::SSM::Parameter::Value<...>` types, which hold a Parameter
-Store name and resolve to the value stored under it. See
+A `CommaDelimitedList` or `List<...>` parameter (`List<String>`, `List<Number>`,
+`List<AWS::EC2::Subnet::Id>` and the rest) is given one comma-separated string. A `Ref` to it
+resolves to the list of members, each trimmed of the spaces around it. `Fn::Join` and `Fn::Select`
+read that list as they read any other:
+
+```json
+{ "Fn::Join": ["-", { "Ref": "Names" }] }
+```
+
+With `Names` declared as a `CommaDelimitedList` and given `a, b, c`, this resolves to `a-b-c`. The
+members of a `List<Number>` are strings, as CloudFormation gives them.
+
+The `AWS::SSM::Parameter::Value<...>` types hold a Parameter Store name and resolve to the value
+stored under it. See
 [reading a parameter through a template Parameter](https://yulinsim.dev/services/ssm/#reading-a-parameter-through-a-template-parameter).
 Every other type is accepted and its value used as written, with no validation of the value against
 the type.
@@ -1217,6 +1229,17 @@ await simAws.cloudFormation().deployTemplate({
 });
 ```
 
+The second argument may also be a function that returns the whole list. CDK writes this for
+`Fn.join(",", zone.hostedZoneNameServers)`:
+
+```json
+{ "Fn::Join": [",", { "Fn::GetAtt": ["Zone", "NameServers"] }] }
+```
+
+`Fn::Split`, an `Fn::FindInMap` of a list value, `Fn::If` and a `Ref` to a list parameter can supply
+the list the same way. A list that resolves to anything but strings fails the deployment. That
+includes a number, and a list nested inside the list (CloudFormation joins one level only).
+
 ### `Fn::Sub`
 
 ```typescript sim-cloudformation-fn-sub
@@ -4545,9 +4568,9 @@ Each service's own docs describe what its resource types support.
   would reject as well. The simulator just rejects them later rather than up front.
 - `Fn::If` is a condition function inside the `Conditions` section, and is not a value an
   `Fn::Equals` can compare. Real CloudFormation allows only `Ref` and `Fn::FindInMap` there.
-- `Fn::Split` and `Fn::Select` accept any argument that resolves to the type they need. Real
-  CloudFormation allows only a named set of functions inside each of them. A template the simulator
-  resolves may still be one CloudFormation rejects.
+- `Fn::Join`, `Fn::Split` and `Fn::Select` accept any argument that resolves to the type they
+  need. Real CloudFormation allows only a named set of functions inside each of them. A template the
+  simulator resolves may still be one CloudFormation rejects.
 - The SAM transform is expanded for `AWS::Serverless::Function`, `AWS::Serverless::SimpleTable`,
   `AWS::Serverless::HttpApi` and `AWS::Serverless::Api`. Every other `AWS::Serverless::*` resource
   type is recorded as unsupported. `Api`, `HttpApi`, `SQS`, `DynamoDB`, `SNS`, `S3`, `Cognito`,

package/docs/services/dynamodb/README.md

@@ -3940,7 +3940,7 @@ is written.
   `AWS::DynamoDB::Table` path does, with the replica's `TableClass`, `DeletionProtectionEnabled` and
   `Tags` read off it, the table's writes and the replica's reads put back together into one
   provisioned capacity for the table and for each global secondary index, and `Ref`, `Fn::GetAtt …
-Arn`, `Fn::GetAtt … StreamArn` and `Fn::GetAtt … TableId` answering. A CDK `TableV2` stack deploys
+  Arn`, `Fn::GetAtt … StreamArn` and `Fn::GetAtt … TableId` answering. A CDK `TableV2` stack deploys
   through it without hand-editing.
 - SDK interception, and an intercepted `DynamoDBClient` or `DynamoDBStreamsClient` reaches the
   simulation.
@@ -4035,7 +4035,7 @@ Arn`, `Fn::GetAtt … StreamArn` and `Fn::GetAtt … TableId` answering. A CDK `
 - Time to live expiry is dispatched by moving the clock through `simAws.clock()`, not by real time
   elapsing. An item whose window goes by while a running-mode clock tracks the host stays where it
   is until something moves the clock. A simulated DynamoDB constructed standalone as `new
-SimDynamoDb()` has no clock control at all. No item there ever expires.
+  SimDynamoDb()` has no clock control at all. No item there ever expires.
 - A Lambda event source mapping is the only simulated service integration that consumes a stream.
   Anything else reads one through the Streams API itself. A Kinesis Data Streams destination is
   absent.

package/docs/services/lambda/README.md

@@ -152,6 +152,9 @@ The vm runtime models the real Node.js runtime closely:
   (`AWS_REGION`, `AWS_LAMBDA_FUNCTION_NAME`, `AWS_LAMBDA_FUNCTION_MEMORY_SIZE`, ...).
 - The sandbox provides writable `process.stdout` and `process.stderr`, with its `console` built
   over them, as the real runtime does. See [What a handler prints](#what-a-handler-prints).
+- The sandbox provides the other globals of the Node.js runtime, including `global`, the WHATWG
+  streams, `EventTarget`, `atob`, `performance` and `navigator`. `Date` and the timers follow the
+  simulated clock. `performance.now()` reads host time.
 - Import and handler problems surface as invocation errors, with the real runtime error types
   (`Runtime.ImportModuleError`, `Runtime.HandlerNotFound`, `Runtime.UserCodeSyntaxError`,
   `Runtime.MalformedHandlerName`). Creation succeeds either way.
@@ -728,8 +731,8 @@ Some deployment packages inline the SDK rather than relying on the runtime to pr
 `NodejsFunction` does that when given `bundling: { externalModules: [] }`. There is then no
 `@aws-sdk/*` module left for the runtime to provide, and nothing to intercept.
 
-Those functions reach the simulation anyway. The runtime provides their HTTP transport, `node:http`
-and `node:https`, and a request addressed to an AWS API endpoint is answered from the same
+Those functions reach the simulation anyway. The runtime provides their HTTP transport, `node:http`,
+`node:https` and `node:http2`, and a request addressed to an AWS API endpoint is answered from the same
 simulated services, as the same execution role, instead of going to the network. The execution
 role credentials are in the function's environment, as real Lambda puts them there. The SDK resolves
 credentials inside the sandbox, where it would otherwise fail with `CredentialsProviderError`.
@@ -746,6 +749,13 @@ sends. A function can read and write Objects with an `S3Client` its archive inli
 Role authorizes each request, and a read it holds no `s3:GetObject` for comes back to the SDK as
 `AccessDenied`.
 
+Bedrock Runtime states its operation and its model in the path, and its client sends over HTTP/2.
+`Converse`, `ConverseStream`, `InvokeModel` and `InvokeModelWithResponseStream` from a bundled
+`BedrockRuntimeClient` return what `simAws.bedrock().responses()` declares, and the SDK reads the
+two streaming operations as it reads a real event stream. A model id given as an inference profile
+ARN works too. The execution Role authorizes each call, and a denial reaches the handler as
+`AccessDeniedException`.
+
 A bundled call to any other simulated service, such as SNS, SES or Lambda itself, fails with an
 error naming the service. Leaving the SDK out of that archive puts it back
 on the module interception path above, which every simulated service is reachable through.
@@ -761,8 +771,8 @@ hostname, along with everything else a handler asks for over HTTP.
 ## The HTTP requests function code makes
 
 A request from a handler to a hostname the simulation serves is answered by the simulation. It
-never leaves the process. `fetch`, `node:http` and `node:https` all reach it, so it makes no
-difference which client the handler was written with.
+never leaves the process. `fetch`, `node:http`, `node:https` and `node:http2` all reach it, so it
+makes no difference which client the handler was written with.
 
 Two kinds of hostname are served. Everything simulated Route53 resolves is answered over the same
 in-process HTTP entry point a browser on localhost reaches. That covers a
@@ -4358,9 +4368,9 @@ Sim Lambda currently supports:
 - Per-function environment variables with `Environment.Variables`
 - Runtime-provided `@aws-sdk/*` packages inside function code, routed into the owning simulated AWS
   environment
-- `fetch`, `node:http` and `node:https` requests from function code, answered by the simulation for
-  every hostname it serves, including a Cognito user pool domain's OAuth endpoints and the JWKS a
-  token verifier fetches from the regional Cognito endpoint
+- `fetch`, `node:http`, `node:https` and `node:http2` requests from function code, answered by the
+  simulation for every hostname it serves, including a Cognito user pool domain's OAuth endpoints
+  and the JWKS a token verifier fetches from the regional Cognito endpoint
 - Execution roles, evaluated against simulated IAM
 - Published versions and aliases, with `PublishVersion`, `ListVersionsByFunction`, `CreateAlias`,
   `UpdateAlias`, `GetAlias`, `ListAliases` and `DeleteAlias`, and a `Qualifier` on `Invoke`,
@@ -4470,7 +4480,7 @@ Current documented limitations:
 - Environment variables declared with `Environment.Variables` reach a real in-process handler
   function only while it runs, so a variable read at module scope sees the host process value
   instead. See [Environment variables](#environment-variables).
-- Outbound HTTP is routed for `fetch`, `node:http` and `node:https` alone. A handler using another
+- Outbound HTTP is routed for `fetch`, `node:http`, `node:https` and `node:http2` alone. A handler using another
   client, or a request made from a handler module while it is being imported, reaches the network.
   A routed response comes back as the simulation answered it, with redirects left for the caller to
   follow. See [The HTTP requests function code makes](#the-http-requests-function-code-makes).

package/docs/services/s3/README.md

@@ -1079,7 +1079,7 @@ A delete on a versioned Bucket raises `s3:ObjectRemoved:DeleteMarkerCreated` rat
 
 - MFA delete is refused with `NotImplemented` rather than stored. Nothing here could enforce it, and
   a Bucket reporting a protection it does not apply is worse than one that says so. `MFADelete:
-"Disabled"` is taken, and any other value is refused with `InvalidArgument`.
+  "Disabled"` is taken, and any other value is refused with `InvalidArgument`.
 - A `versionId` in a `CopySource` is still refused with `NotImplemented`. A copy reads the current
   version.
 - `NoncurrentVersionTransitions` is stored and unread, because storage classes are left out. An

package/docs/services/sqs/README.md

@@ -1214,7 +1214,7 @@ Current documented limitations:
 - A Lambda event source mapping polls one batch at a time. Real Lambda runs several pollers at once
   and scales them with the queue, and what that concurrency does to ordering is invisible here. See
   [simulated Lambda](https://yulinsim.dev/services/lambda/#triggering-a-function-from-an-sqs-queue "Simulated Lambda event
-source mapping docs") for the rest of the mapping limitations.
+  source mapping docs") for the rest of the mapping limitations.
 - `AWS::SQS::Queue` and `AWS::SQS::QueuePolicy` are the SQS resource types CloudFormation creates.
   Any other is reported as unsupported and skipped. A queue attribute outside the range real SQS
   accepts fails the resource, and a property it has no behaviour for is recorded and the queue

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@kensio/yulin",
-  "version": "1.21.27",
+  "version": "1.21.29",
   "description": "AWS system behaviour simulation for isolated unit testing",
   "repository": "https://github.com/KensioSoftware/yulin",
   "homepage": "https://yulinsim.dev/",
@@ -299,7 +299,7 @@
     "hyparquet": "^1.29.2",
     "hyparquet-writer": "^0.16.9",
     "node-sql-parser": "^5.4.0",
-    "oxfmt": "^0.71.0",
+    "oxfmt": "^0.72.0",
     "oxlint": "^1.77.0",
     "oxlint-tsgolint": "^7.0.2001",
     "semantic-release": "25.0.9",