@kensio/yulin 1.21.28 → 1.21.29

package/dist/sdk/wire/sim-sdk-wire-bedrock-action.d.ts

@@ -0,0 +1,18 @@
+import type { SimSdkWireRequest, SimSdkWireResponse } from "./sim-sdk-wire.types.js";
+/**
+ * The REST-JSON content type, for bodies and for errors.
+ */
+export declare const simSdkWireBedrockJsonContentType = "application/json";
+/**
+ * How one Bedrock Runtime operation reads its input off a request and writes
+ * its output back.
+ */
+export interface SimSdkWireBedrockAction {
+    readonly commandName: string;
+    input(modelId: string, request: SimSdkWireRequest): unknown;
+    outputResponse(output: unknown): Promise<SimSdkWireResponse>;
+}
+/**
+ * The invocation operations, keyed by the last segment of their path.
+ */
+export declare const simSdkWireBedrockActions: ReadonlyMap<string, SimSdkWireBedrockAction>;

package/dist/sdk/wire/sim-sdk-wire-bedrock-action.js

@@ -0,0 +1,71 @@
+import { simSdkWireConverseInput, simSdkWireInvokeInput, } from "./sim-sdk-wire-bedrock-input.js";
+import { simSdkWireEventStreamBody, simSdkWireEventStreamContentType, } from "./sim-sdk-wire-event-stream.js";
+import { simSdkWireOutputResponse } from "./sim-sdk-wire-response.js";
+/**
+ * The REST-JSON content type, for bodies and for errors.
+ */
+export const simSdkWireBedrockJsonContentType = "application/json";
+/**
+ * The invocation operations, keyed by the last segment of their path.
+ */
+export const simSdkWireBedrockActions = new Map([
+    [
+        "converse",
+        {
+            commandName: "ConverseCommand",
+            input: simSdkWireConverseInput,
+            outputResponse: (output) => Promise.resolve(simSdkWireOutputResponse(output, simSdkWireBedrockJsonContentType)),
+        },
+    ],
+    [
+        "converse-stream",
+        {
+            commandName: "ConverseStreamCommand",
+            input: simSdkWireConverseInput,
+            outputResponse: async (output) => await eventStreamResponse(output.stream, {}),
+        },
+    ],
+    [
+        "invoke",
+        {
+            commandName: "InvokeModelCommand",
+            input: (modelId, request) => simSdkWireInvokeInput(modelId, request, "accept"),
+            outputResponse: invokeModelResponse,
+        },
+    ],
+    [
+        "invoke-with-response-stream",
+        {
+            commandName: "InvokeModelWithResponseStreamCommand",
+            input: (modelId, request) => simSdkWireInvokeInput(modelId, request, "x-amzn-bedrock-accept"),
+            outputResponse: async (output) => {
+                const { body, contentType } = output;
+                return await eventStreamResponse(body, {
+                    "x-amzn-bedrock-content-type": contentType,
+                });
+            },
+        },
+    ],
+]);
+/**
+ * `InvokeModel` answers with the model's own body as it is, labelled with its
+ * content type.
+ */
+function invokeModelResponse(output) {
+    const { body, contentType } = output;
+    return Promise.resolve({
+        statusCode: 200,
+        headers: { "content-type": contentType },
+        body,
+    });
+}
+/**
+ * The streaming operations answer with an event stream body.
+ */
+async function eventStreamResponse(events, headers) {
+    return {
+        statusCode: 200,
+        headers: { "content-type": simSdkWireEventStreamContentType, ...headers },
+        body: await simSdkWireEventStreamBody(events),
+    };
+}

package/dist/sdk/wire/sim-sdk-wire-bedrock-input.d.ts

@@ -0,0 +1,11 @@
+import type { SimSdkWireRequest } from "./sim-sdk-wire.types.js";
+/**
+ * `Converse` and `ConverseStream` send their input as the JSON body, less the
+ * model id the path carries.
+ */
+export declare function simSdkWireConverseInput(modelId: string, request: SimSdkWireRequest): unknown;
+/**
+ * The model invocations send the request body as it is, with every other
+ * member in a header.
+ */
+export declare function simSdkWireInvokeInput(modelId: string, request: SimSdkWireRequest, acceptHeaderName: string): unknown;

package/dist/sdk/wire/sim-sdk-wire-bedrock-input.js

@@ -0,0 +1,45 @@
+import { readSimSdkWireInput } from "./sim-sdk-wire-json.js";
+/**
+ * The Command input members `InvokeModel` and
+ * `InvokeModelWithResponseStream` carry in headers, with the header each one
+ * travels in. The two differ only in where they carry `accept`.
+ *
+ * Every one is read, including the ones the simulation refuses, so that a
+ * request naming a guardrail is refused here as it is through an intercepted
+ * client.
+ */
+const invokeHeaderMembers = [
+    ["contentType", "content-type"],
+    ["trace", "x-amzn-bedrock-trace"],
+    ["guardrailIdentifier", "x-amzn-bedrock-guardrailidentifier"],
+    ["guardrailVersion", "x-amzn-bedrock-guardrailversion"],
+    ["performanceConfigLatency", "x-amzn-bedrock-performanceconfig-latency"],
+    ["serviceTier", "x-amzn-bedrock-service-tier"],
+    ["requestMetadata", "x-amzn-bedrock-request-metadata"],
+];
+/**
+ * `Converse` and `ConverseStream` send their input as the JSON body, less the
+ * model id the path carries.
+ */
+export function simSdkWireConverseInput(modelId, request) {
+    return { ...readSimSdkWireInput(request.body), modelId };
+}
+/**
+ * The model invocations send the request body as it is, with every other
+ * member in a header.
+ */
+export function simSdkWireInvokeInput(modelId, request, acceptHeaderName) {
+    const members = [
+        ...invokeHeaderMembers,
+        ["accept", acceptHeaderName],
+    ].flatMap(([member, headerName]) => {
+        // oxlint-disable-next-line security/detect-object-injection -- this module's own fixed header names.
+        const value = request.headers[headerName];
+        return value === undefined ? [] : [[member, value]];
+    });
+    return {
+        ...Object.fromEntries(members),
+        modelId,
+        ...(request.body.byteLength > 0 && { body: request.body }),
+    };
+}

package/dist/sdk/wire/sim-sdk-wire-bedrock.d.ts

@@ -0,0 +1,10 @@
+import type { SimSdkWireCall } from "./sim-sdk-wire-call.js";
+import type { SimSdkWireRequest } from "./sim-sdk-wire.types.js";
+/**
+ * Read a Bedrock Runtime model invocation, which names its operation and its
+ * model in the path rather than in a header.
+ *
+ * A request counts as one when it was signed for Bedrock, or, unsigned, sent
+ * to a Bedrock Runtime endpoint, and its path is a model invocation.
+ */
+export declare function readSimSdkWireBedrockCall(request: SimSdkWireRequest): SimSdkWireCall | undefined;

package/dist/sdk/wire/sim-sdk-wire-bedrock.js

@@ -0,0 +1,47 @@
+import { simSdkWireBedrockActions, simSdkWireBedrockJsonContentType, } from "./sim-sdk-wire-bedrock-action.js";
+import { readSimSdkWireCredentialScope } from "./sim-sdk-wire-operation.js";
+import { simSdkWireErrorResponse } from "./sim-sdk-wire-response.js";
+/**
+ * The SDK `config.serviceId` of a `BedrockRuntimeClient`.
+ */
+const bedrockRuntimeServiceId = "Bedrock Runtime";
+/**
+ * The SigV4 signing name Bedrock Runtime requests are signed with.
+ */
+const bedrockSigningName = "bedrock";
+/**
+ * The path of a model invocation: `/model/{modelId}/{action}`, where the
+ * model id is URL-encoded and may be a whole ARN.
+ */
+const invocationPathPattern = /^\/model\/(?<modelId>[^/]+)\/(?<action>[a-z-]+)$/;
+/**
+ * Read a Bedrock Runtime model invocation, which names its operation and its
+ * model in the path rather than in a header.
+ *
+ * A request counts as one when it was signed for Bedrock, or, unsigned, sent
+ * to a Bedrock Runtime endpoint, and its path is a model invocation.
+ */
+export function readSimSdkWireBedrockCall(request) {
+    const signingName = readSimSdkWireCredentialScope(request)?.signingName;
+    const isBedrock = signingName === undefined
+        ? request.hostname.startsWith("bedrock-runtime.")
+        : signingName === bedrockSigningName;
+    if (!isBedrock || request.method.toUpperCase() !== "POST") {
+        return undefined;
+    }
+    const groups = invocationPathPattern.exec(request.path.split("?", 1)[0] ?? "")?.groups;
+    const action = simSdkWireBedrockActions.get(groups?.["action"] ?? "");
+    if (groups === undefined || action === undefined) {
+        return undefined;
+    }
+    // A malformed escape fails decoding, which is the service's answer to the
+    // request, so the model id is decoded when the input is read.
+    const encodedModelId = groups["modelId"] ?? "";
+    return {
+        serviceId: bedrockRuntimeServiceId,
+        commandName: action.commandName,
+        input: () => action.input(decodeURIComponent(encodedModelId), request),
+        outputResponse: async (output) => await action.outputResponse(output),
+        errorResponse: (error) => simSdkWireErrorResponse(error, simSdkWireBedrockJsonContentType),
+    };
+}

package/dist/sdk/wire/sim-sdk-wire-call.d.ts

@@ -0,0 +1,30 @@
+import type { SimSdkWireRequest, SimSdkWireResponse } from "./sim-sdk-wire.types.js";
+/**
+ * One wire request read back into the Command it was serialized from, with
+ * the protocol it came in to encode the answer in.
+ */
+export interface SimSdkWireCall {
+    /** The SDK `config.serviceId` of the service the request is addressed to. */
+    readonly serviceId: string;
+    /** The SDK Command class name the request would have been sent as. */
+    readonly commandName: string;
+    /**
+     * The Command input. Reading it can fail on a malformed body, and that
+     * failure is the service's answer to the request, so it is read when the
+     * operation runs.
+     */
+    input(): unknown;
+    /** The response for an output the simulated operation answered with. */
+    outputResponse(output: unknown): Promise<SimSdkWireResponse>;
+    /** The response for an error the simulated operation refused with. */
+    errorResponse(error: unknown): SimSdkWireResponse;
+}
+/**
+ * Read a wire request as the Command it was serialized from.
+ *
+ * Returns undefined for a request no reader here understands. The AWS JSON
+ * protocol services all name their operation in one header. Bedrock Runtime
+ * speaks REST-JSON, with the operation and model in the path, and has a
+ * reader of its own.
+ */
+export declare function readSimSdkWireCall(request: SimSdkWireRequest): SimSdkWireCall | undefined;

package/dist/sdk/wire/sim-sdk-wire-call.js

@@ -0,0 +1,32 @@
+import { readSimSdkWireBedrockCall } from "./sim-sdk-wire-bedrock.js";
+import { readSimSdkWireInput } from "./sim-sdk-wire-json.js";
+import { readSimSdkWireOperation } from "./sim-sdk-wire-operation.js";
+import { simSdkWireErrorResponse, simSdkWireOutputResponse, } from "./sim-sdk-wire-response.js";
+/**
+ * Read a wire request as the Command it was serialized from.
+ *
+ * Returns undefined for a request no reader here understands. The AWS JSON
+ * protocol services all name their operation in one header. Bedrock Runtime
+ * speaks REST-JSON, with the operation and model in the path, and has a
+ * reader of its own.
+ */
+export function readSimSdkWireCall(request) {
+    return readSimSdkWireJsonCall(request) ?? readSimSdkWireBedrockCall(request);
+}
+/**
+ * Read an AWS JSON protocol request, whose body is the Command input and
+ * whose response echoes the protocol version it was sent with.
+ */
+function readSimSdkWireJsonCall(request) {
+    const operation = readSimSdkWireOperation(request);
+    if (operation === undefined) {
+        return undefined;
+    }
+    const contentType = request.headers["content-type"];
+    return {
+        ...operation,
+        input: () => readSimSdkWireInput(request.body),
+        outputResponse: (output) => Promise.resolve(simSdkWireOutputResponse(output, contentType)),
+        errorResponse: (error) => simSdkWireErrorResponse(error, contentType),
+    };
+}

package/dist/sdk/wire/sim-sdk-wire-dispatcher.js

@@ -1,8 +1,7 @@
 import { SimSdkCommandDispatcher } from "../sim-sdk-command-dispatcher.js";
 import { makeSimSdkWireClient, makeSimSdkWireCommand, } from "./sim-sdk-wire-command.js";
-import { readSimSdkWireInput } from "./sim-sdk-wire-json.js";
-import { readSimSdkWireCredentialScope, readSimSdkWireOperation, } from "./sim-sdk-wire-operation.js";
-import { simSdkWireErrorResponse, simSdkWireOutputResponse, } from "./sim-sdk-wire-response.js";
+import { readSimSdkWireCall } from "./sim-sdk-wire-call.js";
+import { readSimSdkWireCredentialScope } from "./sim-sdk-wire-operation.js";
 import { simSdkUnbridgedWireRequest } from "./sim-sdk-wire-unbridged.js";
 /**
  * Dispatches AWS API requests to simulated AWS service operations.
@@ -44,20 +43,19 @@ export class SimSdkWireDispatcher {
      * relies on.
      */
     async dispatch(request, caller) {
-        const operation = readSimSdkWireOperation(request);
-        if (operation === undefined) {
+        const call = readSimSdkWireCall(request);
+        if (call === undefined) {
             throw simSdkUnbridgedWireRequest(request);
         }
         // The operation runs in the Region it was signed for or, unsigned, the
         // Region of the code that sent it.
         const scope = readSimSdkWireCredentialScope(request);
-        const contentType = request.headers["content-type"];
         try {
-            const output = await this.dispatcher.dispatch(makeSimSdkWireCommand(operation.commandName, readSimSdkWireInput(request.body)), makeSimSdkWireClient(operation.serviceId, scope?.regionName ?? this.regionName), undefined, caller);
-            return simSdkWireOutputResponse(output, contentType);
+            const output = await this.dispatcher.dispatch(makeSimSdkWireCommand(call.commandName, call.input()), makeSimSdkWireClient(call.serviceId, scope?.regionName ?? this.regionName), undefined, caller);
+            return await call.outputResponse(output);
         }
         catch (error) {
-            return simSdkWireErrorResponse(error, contentType);
+            return call.errorResponse(error);
         }
     }
 }

package/dist/sdk/wire/sim-sdk-wire-event-stream.d.ts

@@ -0,0 +1,16 @@
+/**
+ * The media type of an AWS event stream response body.
+ */
+export declare const simSdkWireEventStreamContentType = "application/vnd.amazon.eventstream";
+/**
+ * Encode an event stream as the `application/vnd.amazon.eventstream` body an
+ * SDK reads it from.
+ *
+ * Each event is a union with one member set, as an SDK hands it to calling
+ * code (`{ chunk: { bytes } }` or `{ contentBlockDelta: { ... } }`). The
+ * member name is the message's event type, and its value is the JSON payload.
+ *
+ * The whole stream is read before the body is built. A simulated stream has
+ * every event available at once, so sending them together loses nothing.
+ */
+export declare function simSdkWireEventStreamBody(events: AsyncIterable<object>): Promise<Uint8Array>;

package/dist/sdk/wire/sim-sdk-wire-event-stream.js

@@ -0,0 +1,79 @@
+import { crc32 } from "../../util/zip/crc32.js";
+import { simSdkWireJsonBody } from "./sim-sdk-wire-json.js";
+/**
+ * The media type of an AWS event stream response body.
+ */
+export const simSdkWireEventStreamContentType = "application/vnd.amazon.eventstream";
+/**
+ * The header value type code for a string, the only type written here.
+ */
+const stringHeaderType = 7;
+/**
+ * The bytes of the prelude: the total length, the headers length and the
+ * prelude checksum, each four bytes.
+ */
+const preludeLength = 12;
+/**
+ * The bytes of the checksum closing every message.
+ */
+const messageChecksumLength = 4;
+/**
+ * Encode an event stream as the `application/vnd.amazon.eventstream` body an
+ * SDK reads it from.
+ *
+ * Each event is a union with one member set, as an SDK hands it to calling
+ * code (`{ chunk: { bytes } }` or `{ contentBlockDelta: { ... } }`). The
+ * member name is the message's event type, and its value is the JSON payload.
+ *
+ * The whole stream is read before the body is built. A simulated stream has
+ * every event available at once, so sending them together loses nothing.
+ */
+export async function simSdkWireEventStreamBody(events) {
+    const messages = [];
+    for await (const event of events) {
+        const members = Object.entries(event).filter(([, value]) => value !== undefined);
+        for (const [eventType, value] of members) {
+            messages.push(eventMessage(eventType, simSdkWireJsonBody(value)));
+        }
+    }
+    return Buffer.concat(messages);
+}
+/**
+ * Encode one event message.
+ *
+ * The layout is the prelude, the headers, the payload and a CRC-32 of
+ * everything before it. The prelude ends with a CRC-32 of its first eight
+ * bytes.
+ */
+function eventMessage(eventType, payload) {
+    const headers = Buffer.concat([
+        stringHeader(":event-type", eventType),
+        stringHeader(":content-type", "application/json"),
+        stringHeader(":message-type", "event"),
+    ]);
+    const totalLength = preludeLength + headers.length + payload.length + messageChecksumLength;
+    const checksumOffset = totalLength - messageChecksumLength;
+    const message = Buffer.alloc(totalLength);
+    message.writeUInt32BE(totalLength, 0);
+    message.writeUInt32BE(headers.length, 4);
+    message.writeUInt32BE(crc32(message.subarray(0, 8)), 8);
+    headers.copy(message, preludeLength);
+    message.set(payload, preludeLength + headers.length);
+    message.writeUInt32BE(crc32(message.subarray(0, checksumOffset)), checksumOffset);
+    return message;
+}
+/**
+ * Encode one string-valued header: the name length and name, the type code,
+ * and the value length and value.
+ */
+function stringHeader(name, value) {
+    const nameBytes = Buffer.from(name);
+    const valueBytes = Buffer.from(value);
+    const header = Buffer.alloc(4 + nameBytes.length + valueBytes.length);
+    header.writeUInt8(nameBytes.length, 0);
+    nameBytes.copy(header, 1);
+    header.writeUInt8(stringHeaderType, 1 + nameBytes.length);
+    header.writeUInt16BE(valueBytes.length, 2 + nameBytes.length);
+    valueBytes.copy(header, 4 + nameBytes.length);
+    return header;
+}

package/dist/sdk/wire/sim-sdk-wire-unbridged.js

@@ -16,8 +16,8 @@ import { readSimSdkWireCredentialScope } from "./sim-sdk-wire-operation.js";
 export function simSdkUnbridgedWireRequest(request) {
     const service = readSimSdkWireCredentialScope(request)?.signingName ?? request.hostname;
     return new SimSdkUnbridgedWireRequestError(`Cannot answer a request to ${service} from the simulation: a ` +
-        "serialized AWS API request can only be routed for a service using " +
-        "the AWS JSON protocol. Where this is an AWS SDK bundled into " +
+        "serialized AWS API request can only be routed for S3, Bedrock " +
+        "Runtime and the services using the AWS JSON protocol. Where this is an AWS SDK bundled into " +
         "function code, leaving the SDK out of the deployment package puts it " +
         "back on the module interception path, which every simulated service " +
         "is reachable through.");

package/dist/service/bedrock/command/authorize/sim-bedrock-authorizer.js

@@ -24,9 +24,13 @@ export class SimBedrockAuthorizer {
             caller: options.caller,
         });
         if (decision.isDenied) {
-            throw new SimBedrockAccessDeniedException(`User: ${this.callerIdentifier.format(decision.caller.principal)} is ` +
-                `not authorized to perform: ${action} on resource: ${resource} ` +
-                `because no identity-based policy allows the ${action} action`);
+            // A service control policy denial names the policy, as other services'
+            // denials do.
+            const reason = decision.denialReason ??
+                `because no identity-based policy allows the ${action} action`;
+            const caller = this.callerIdentifier.format(decision.caller.principal);
+            throw new SimBedrockAccessDeniedException(`User: ${caller} is not authorized to perform: ${action} on ` +
+                `resource: ${resource} ${reason}`);
         }
         return decision.caller;
     }

package/dist/service/lambda/function/code/vm/sdk/sim-sdk-lambda-vm-module-provider.d.ts

@@ -42,8 +42,8 @@ export declare class SimSdkLambdaVmModuleProvider implements SimLambdaVmSdkModul
     private readonly providedModules;
     constructor(properties: SimSdkLambdaVmModuleProviderProperties);
     /**
-     * Provide an intercepted AWS SDK package or HTTP transport module, or
-     * undefined for other specifiers.
+     * Provide an intercepted AWS SDK package or HTTP or HTTP/2 transport
+     * module, or undefined for other specifiers.
      */
     provideModule(specifier: string): unknown;
     /**

package/dist/service/lambda/function/code/vm/sdk/sim-sdk-lambda-vm-module-provider.js

@@ -1,7 +1,7 @@
 import { SimSdkModuleClientInterceptor } from "../../../../../../sdk/module/sim-sdk-module-client-interceptor.js";
 import { SimSdkCommandDispatcher } from "../../../../../../sdk/sim-sdk-command-dispatcher.js";
 import { SimLambdaAwsApiOutbound } from "../../../outbound/sim-lambda-aws-api-outbound.js";
-import { isSimLambdaHttpModuleSpecifier, makeSimLambdaHttpModule, simLambdaHttpModuleScheme, } from "../../../outbound/sim-lambda-http-module.js";
+import { isSimLambdaTransportModuleSpecifier, makeSimLambdaTransportModule, } from "../../../outbound/sim-lambda-transport-module.js";
 import { isModuleNotFoundError, requireHostModule, } from "../sim-lambda-host-modules.js";
 import { SimLambdaSdkPackagesNotInstalledError } from "./sim-lambda-sdk-packages-not-installed.error.js";
 import { awsSdkPackagePrefix, } from "./sim-lambda-vm-sdk-module-provider.js";
@@ -37,11 +37,11 @@ export class SimSdkLambdaVmModuleProvider {
         this.requireModule = properties.requireModule ?? requireHostModule;
     }
     /**
-     * Provide an intercepted AWS SDK package or HTTP transport module, or
-     * undefined for other specifiers.
+     * Provide an intercepted AWS SDK package or HTTP or HTTP/2 transport
+     * module, or undefined for other specifiers.
      */
     provideModule(specifier) {
-        const isTransport = isSimLambdaHttpModuleSpecifier(specifier);
+        const isTransport = isSimLambdaTransportModuleSpecifier(specifier);
         if (!isTransport && !specifier.startsWith(awsSdkPackagePrefix)) {
             return undefined;
         }
@@ -51,11 +51,7 @@ export class SimSdkLambdaVmModuleProvider {
         }
         const hostExports = this.hostModuleExports(specifier);
         const module = isTransport
-            ? makeSimLambdaHttpModule({
-                hostModule: hostExports,
-                outbound: this.outboundHttp,
-                scheme: simLambdaHttpModuleScheme(specifier),
-            })
+            ? makeSimLambdaTransportModule(specifier, hostExports, this.outboundHttp)
             : this.interceptor.interceptModule(hostExports);
         this.providedModules.set(specifier, module);
         return module;

package/dist/service/lambda/function/code/vm/sim-lambda-vm-context.d.ts

@@ -29,7 +29,7 @@ export interface SimLambdaVmContextProperties {
 /**
  * Create the sandbox vm context that sim Lambda function code runs in.
  *
- * The context provides the common globals a Node.js Lambda runtime offers,
+ * The context provides the globals a Node.js Lambda runtime offers,
  * including an AWS-like process.env holding the standard runtime variables
  * and any variables declared for the function, and the writable standard
  * streams function code writes its output to. Everything else must be part

package/dist/service/lambda/function/code/vm/sim-lambda-vm-context.js

@@ -6,11 +6,12 @@ import { simLambdaNoOutputSink, } from "../../logging/sim-lambda-output-sink.js"
 import { makeSimLambdaOutboundFetch } from "../../outbound/sim-lambda-outbound-fetch.js";
 import { simLambdaClearInterval, simLambdaClearTimeout, } from "../../invoke/timer/sim-lambda-clear-timer.js";
 import { simLambdaSetInterval, simLambdaSetTimeout, } from "../../invoke/timer/sim-lambda-process-timers.js";
+import { simLambdaVmHostGlobals } from "./sim-lambda-vm-host-globals.js";
 import { SimLambdaVmOutputStream } from "./sim-lambda-vm-output-stream.js";
 /**
  * Create the sandbox vm context that sim Lambda function code runs in.
  *
- * The context provides the common globals a Node.js Lambda runtime offers,
+ * The context provides the globals a Node.js Lambda runtime offers,
  * including an AWS-like process.env holding the standard runtime variables
  * and any variables declared for the function, and the writable standard
  * streams function code writes its output to. Everything else must be part
@@ -33,12 +34,12 @@ export function makeSimLambdaVmContext(properties) {
     // What function code writes reaches the function's log group through here.
     stdout.recordTo(sink);
     stderr.recordTo(sink);
-    return vm.createContext({
+    const context = vm.createContext({
+        ...simLambdaVmHostGlobals(),
         // The sandbox's console is built over those streams, as the real
         // runtime's is, so everything function code prints goes to one place
         // whether it printed through the console or wrote to the stream itself.
         console: new Console({ stdout, stderr }),
-        Buffer,
         process: {
             env: environment.variables(),
             stdout,
@@ -55,25 +56,13 @@ export function makeSimLambdaVmContext(properties) {
         clearTimeout: simLambdaClearTimeout,
         setInterval: simLambdaSetInterval,
         clearInterval: simLambdaClearInterval,
-        setImmediate,
-        queueMicrotask,
-        TextEncoder,
-        TextDecoder,
-        URL,
-        URLSearchParams,
-        structuredClone,
-        crypto,
-        // The Fetch API the Node.js runtime provides, with the client itself
-        // routed into the simulation. The rest are the host's own, so the objects
-        // a handler builds and the ones the simulation answers with are the same
-        // kind of thing.
+        // The Fetch API client, routed into the simulation. The types it works
+        // with are the host's own.
         fetch: makeSimLambdaOutboundFetch(outboundHttp),
-        Headers,
-        Request,
-        Response,
-        FormData,
-        Blob,
-        AbortController,
-        AbortSignal,
     });
+    // Node.js names its global object `global` as well as `globalThis`, and
+    // bundlers emit references to it for older packages. It has to be the
+    // sandbox's own global, which only exists once the context does.
+    vm.runInContext("globalThis.global = globalThis;", context);
+    return context;
 }

package/dist/service/lambda/function/code/vm/sim-lambda-vm-host-globals.d.ts

@@ -0,0 +1,4 @@
+/**
+ * The host's own value for each global the sandbox passes through.
+ */
+export declare function simLambdaVmHostGlobals(): Record<string, unknown>;

package/dist/service/lambda/function/code/vm/sim-lambda-vm-host-globals.js

@@ -0,0 +1,87 @@
+/**
+ * The globals the Node.js runtime provides that the sandbox passes through
+ * from the host as they are.
+ *
+ * Anything here is the host's own object, so what function code builds with
+ * one and what the simulation answers with are the same kind of thing. The
+ * globals the sandbox replaces (the console, `process`, `Date`, the timers
+ * and `fetch`) are built in `makeSimLambdaVmContext` instead.
+ */
+const simLambdaVmHostGlobalNames = [
+    "Buffer",
+    "setImmediate",
+    // The host's, since the sandbox's `setImmediate` is the host's too.
+    "clearImmediate",
+    "queueMicrotask",
+    "structuredClone",
+    "atob",
+    "btoa",
+    "TextEncoder",
+    "TextDecoder",
+    "URL",
+    "URLSearchParams",
+    "URLPattern",
+    "DOMException",
+    // The Fetch API types. The client itself is the sandbox's own.
+    "Headers",
+    "Request",
+    "Response",
+    "FormData",
+    "Blob",
+    "File",
+    "AbortController",
+    "AbortSignal",
+    // WHATWG streams, which bundled SDK clients build their event streams on.
+    "ReadableStream",
+    "ReadableStreamDefaultReader",
+    "ReadableStreamBYOBReader",
+    "ReadableStreamBYOBRequest",
+    "ReadableByteStreamController",
+    "ReadableStreamDefaultController",
+    "WritableStream",
+    "WritableStreamDefaultController",
+    "WritableStreamDefaultWriter",
+    "TransformStream",
+    "TransformStreamDefaultController",
+    "ByteLengthQueuingStrategy",
+    "CountQueuingStrategy",
+    "TextEncoderStream",
+    "TextDecoderStream",
+    "CompressionStream",
+    "DecompressionStream",
+    // Events and messaging.
+    "Event",
+    "EventTarget",
+    "CustomEvent",
+    "MessageEvent",
+    "CloseEvent",
+    "MessageChannel",
+    "MessagePort",
+    "BroadcastChannel",
+    "WebSocket",
+    // Web Crypto.
+    "crypto",
+    "Crypto",
+    "CryptoKey",
+    "SubtleCrypto",
+    // Performance reads host time, while `Date` reads the simulated clock.
+    "performance",
+    "Performance",
+    "PerformanceEntry",
+    "PerformanceMark",
+    "PerformanceMeasure",
+    "PerformanceObserver",
+    "PerformanceObserverEntryList",
+    "PerformanceResourceTiming",
+    "navigator",
+    "Navigator",
+];
+/**
+ * The host's own value for each global the sandbox passes through.
+ */
+export function simLambdaVmHostGlobals() {
+    return Object.fromEntries(simLambdaVmHostGlobalNames.map((name) => [
+        name,
+        Reflect.get(globalThis, name),
+    ]));
+}

package/dist/service/lambda/function/invoke/sim-lambda-outbound-clients.d.ts

@@ -12,5 +12,8 @@ import type { SimLambdaOutboundHttp } from "../outbound/sim-lambda-outbound-http
  * modules export as it was. The built-in modules' named ES module exports are
  * a snapshot of those properties, so they are re-synchronised afterwards for
  * the handler that imported `request` by name rather than the module.
+ *
+ * `node:http2` has `connect` replaced the same way. Bedrock Runtime's SDK
+ * client sends over HTTP/2.
  */
 export declare function installSimLambdaOutboundClients(outbound: SimLambdaOutboundHttp): void;

package/dist/service/lambda/function/invoke/sim-lambda-outbound-clients.js

@@ -1,7 +1,9 @@
 import http from "node:http";
+import http2 from "node:http2";
 import https from "node:https";
 import { syncBuiltinESMExports } from "node:module";
 import { makeSimLambdaHttpModule } from "../outbound/sim-lambda-http-module.js";
+import { makeSimLambdaHttp2Module } from "../outbound/sim-lambda-http2-module.js";
 import { makeSimLambdaOutboundFetch } from "../outbound/sim-lambda-outbound-fetch.js";
 /**
  * The transport modules an in-process handler makes requests through, with the
@@ -24,6 +26,9 @@ const transportModules = [
  * modules export as it was. The built-in modules' named ES module exports are
  * a snapshot of those properties, so they are re-synchronised afterwards for
  * the handler that imported `request` by name rather than the module.
+ *
+ * `node:http2` has `connect` replaced the same way. Bedrock Runtime's SDK
+ * client sends over HTTP/2.
  */
 export function installSimLambdaOutboundClients(outbound) {
     const hostFetch = globalThis.fetch;
@@ -38,5 +43,10 @@ export function installSimLambdaOutboundClients(outbound) {
         patched["request"] = routed["request"];
         patched["get"] = routed["get"];
     }
+    const http2Module = http2;
+    http2Module["connect"] = makeSimLambdaHttp2Module({
+        hostModule: http2Module,
+        outbound,
+    })["connect"];
     syncBuiltinESMExports();
 }

package/dist/service/lambda/function/outbound/sim-lambda-http2-exchanges.d.ts

@@ -0,0 +1,32 @@
+import { AsyncResource } from "node:async_hooks";
+import type http2 from "node:http2";
+/**
+ * A request sent on a simulated session, waiting for its answer.
+ */
+export interface SimLambdaHttp2Exchange {
+    readonly stream: http2.ClientHttp2Stream;
+    /**
+     * The asynchronous context the request was sent from. A pooled session
+     * outlives the invocation that opened it, and each request on it belongs to
+     * whichever invocation sent it.
+     */
+    readonly scope: AsyncResource;
+}
+/**
+ * The requests in flight on one simulated session, each joined to the
+ * asynchronous context it was sent from.
+ */
+export declare class SimLambdaHttp2Exchanges {
+    private readonly exchanges;
+    /**
+     * Tag each request the session sends with the context it was sent from.
+     */
+    track(session: http2.ClientHttp2Session): void;
+    /**
+     * The exchange a request arriving at the session's server belongs to.
+     *
+     * Every request on the session's client is tagged by `track`, and nothing
+     * else can reach its server.
+     */
+    exchangeFor(request: http2.Http2ServerRequest): SimLambdaHttp2Exchange;
+}

package/dist/service/lambda/function/outbound/sim-lambda-http2-exchanges.js

@@ -0,0 +1,39 @@
+import { AsyncResource } from "node:async_hooks";
+import { randomUUID } from "node:crypto";
+import { assertDefined } from "../../../../util/type-guard/defined.js";
+import { simLambdaHttp2ExchangeHeaderName, simLambdaHttp2ExchangeId, } from "./sim-lambda-http2-messages.js";
+/**
+ * The requests in flight on one simulated session, each joined to the
+ * asynchronous context it was sent from.
+ */
+export class SimLambdaHttp2Exchanges {
+    exchanges = new Map();
+    /**
+     * Tag each request the session sends with the context it was sent from.
+     */
+    track(session) {
+        const hostRequest = session.request.bind(session);
+        const request = (headers, options) => {
+            const exchangeId = randomUUID();
+            const stream = hostRequest({ ...headers, [simLambdaHttp2ExchangeHeaderName]: exchangeId }, options);
+            this.exchanges.set(exchangeId, {
+                stream,
+                scope: new AsyncResource("SimLambdaHttp2Request"),
+            });
+            stream.once("close", () => this.exchanges.delete(exchangeId));
+            return stream;
+        };
+        Object.assign(session, { request });
+    }
+    /**
+     * The exchange a request arriving at the session's server belongs to.
+     *
+     * Every request on the session's client is tagged by `track`, and nothing
+     * else can reach its server.
+     */
+    exchangeFor(request) {
+        const exchange = this.exchanges.get(simLambdaHttp2ExchangeId(request));
+        assertDefined(exchange, "sim Lambda HTTP/2 exchange for a request");
+        return exchange;
+    }
+}

package/dist/service/lambda/function/outbound/sim-lambda-http2-messages.d.ts

@@ -0,0 +1,33 @@
+import type http2 from "node:http2";
+import type { SimLambdaOutboundHttp } from "./sim-lambda-outbound-http.js";
+/**
+ * The header a request sent on a simulated session carries to say which
+ * request it is, so the answer runs in the asynchronous context the request
+ * was sent from. The simulation never sees it.
+ */
+export declare const simLambdaHttp2ExchangeHeaderName = "x-yulin-sim-lambda-exchange";
+/**
+ * The headers of a simulated answer that HTTP/2 can carry.
+ */
+export declare function simLambdaHttp2ResponseHeaders(headers: Headers): Record<string, string>;
+/**
+ * The request a stream carried, as the request the simulation is asked to
+ * answer, at the authority the session was connected to.
+ *
+ * A pooled session outlives the invocation that opened it. A request sent on
+ * it once no invocation is running has nothing to answer it, and is refused
+ * saying so.
+ */
+export declare function simLambdaHttp2Request(authority: URL, outbound: SimLambdaOutboundHttp, request: http2.Http2ServerRequest): Promise<Request>;
+/**
+ * The exchange tag a request on a simulated session carries.
+ */
+export declare function simLambdaHttp2ExchangeId(request: http2.Http2ServerRequest): string;
+/**
+ * The options and listener a `connect` call passed after the authority. The
+ * listener comes back as a list of none or one, to pass on as it came.
+ */
+export declare function simLambdaHttp2ConnectArguments(callArguments: readonly unknown[]): {
+    readonly options: object | undefined;
+    readonly listener: unknown[];
+};

package/dist/service/lambda/function/outbound/sim-lambda-http2-messages.js

@@ -0,0 +1,87 @@
+/**
+ * The header a request sent on a simulated session carries to say which
+ * request it is, so the answer runs in the asynchronous context the request
+ * was sent from. The simulation never sees it.
+ */
+export const simLambdaHttp2ExchangeHeaderName = "x-yulin-sim-lambda-exchange";
+/**
+ * The response headers HTTP/2 forbids, which a simulated answer may still
+ * carry from an HTTP/1.1 shape.
+ */
+const connectionHeaderNames = new Set([
+    "connection",
+    "keep-alive",
+    "proxy-connection",
+    "transfer-encoding",
+    "upgrade",
+]);
+/**
+ * The headers of a request, less the HTTP/2 pseudo-headers and the exchange
+ * tag.
+ */
+function requestHeaders(headers) {
+    return Object.fromEntries(Object.entries(headers).flatMap(([name, value]) => value === undefined ||
+        name === simLambdaHttp2ExchangeHeaderName ||
+        name.startsWith(":")
+        ? []
+        : [[name, Array.isArray(value) ? value.join(", ") : value]]));
+}
+/**
+ * The headers of a simulated answer that HTTP/2 can carry.
+ */
+export function simLambdaHttp2ResponseHeaders(headers) {
+    return Object.fromEntries([...headers].filter(([name]) => !connectionHeaderNames.has(name)));
+}
+/**
+ * The request a stream carried, as the request the simulation is asked to
+ * answer, at the authority the session was connected to.
+ *
+ * A pooled session outlives the invocation that opened it. A request sent on
+ * it once no invocation is running has nothing to answer it, and is refused
+ * saying so.
+ */
+export async function simLambdaHttp2Request(authority, outbound, request) {
+    const { hostname, host, protocol } = authority;
+    if (!outbound.serves(hostname)) {
+        throw sessionEndedError(hostname);
+    }
+    const chunks = [];
+    for await (const chunk of request) {
+        chunks.push(chunk);
+    }
+    const body = Buffer.concat(chunks);
+    return new Request(`${protocol}//${host}${request.url}`, {
+        method: request.method,
+        headers: requestHeaders(request.headers),
+        ...(body.length > 0 && { body }),
+    });
+}
+/**
+ * The exchange tag a request on a simulated session carries.
+ */
+export function simLambdaHttp2ExchangeId(request) {
+    // oxlint-disable-next-line security/detect-object-injection -- this module's own fixed header name.
+    return String(request.headers[simLambdaHttp2ExchangeHeaderName]);
+}
+/**
+ * The options and listener a `connect` call passed after the authority. The
+ * listener comes back as a list of none or one, to pass on as it came.
+ */
+export function simLambdaHttp2ConnectArguments(callArguments) {
+    const [, second, third] = callArguments;
+    const listener = typeof second === "function" ? second : third;
+    return {
+        options: typeof second === "object" ? (second ?? undefined) : undefined,
+        listener: listener === undefined ? [] : [listener],
+    };
+}
+/**
+ * Refuse a request on a session a sim Lambda invocation opened, sent once no
+ * invocation is running to answer it.
+ */
+function sessionEndedError(hostname) {
+    return new Error(`Cannot send a request to ${hostname} on an HTTP/2 session a sim ` +
+        "Lambda invocation opened, once no invocation is running. Create " +
+        "the SDK client inside the handler, or send this call from a " +
+        "handler invocation.");
+}

package/dist/service/lambda/function/outbound/sim-lambda-http2-module.d.ts

@@ -0,0 +1,27 @@
+import type { SimLambdaOutboundHttp } from "./sim-lambda-outbound-http.js";
+/**
+ * A `node:http2` module, as far as this needs to know.
+ */
+type NodeHttp2Module = Record<string, unknown>;
+/**
+ * Whether a module specifier names the HTTP/2 module.
+ */
+export declare function isSimLambdaHttp2ModuleSpecifier(specifier: string): boolean;
+interface SimLambdaHttp2ModuleProperties {
+    readonly hostModule: NodeHttp2Module;
+    readonly outbound: SimLambdaOutboundHttp;
+}
+/**
+ * Build the `node:http2` module sim Lambda function code connects through.
+ *
+ * Everything the real module exports is kept, and only `connect` is
+ * replaced. A session to a hostname the simulation serves is a real HTTP/2
+ * session, connected over an in-memory socket pair to a server in this
+ * process that hands each request to the simulation. Every other session is
+ * the host module's, connected exactly as it was asked for.
+ *
+ * Bedrock Runtime's SDK client sends over HTTP/2, so this is where its calls
+ * from function code reach simulated Bedrock.
+ */
+export declare function makeSimLambdaHttp2Module(properties: SimLambdaHttp2ModuleProperties): NodeHttp2Module;
+export {};

package/dist/service/lambda/function/outbound/sim-lambda-http2-module.js

@@ -0,0 +1,53 @@
+import { SimLambdaHttp2Session, } from "./sim-lambda-http2-session.js";
+/**
+ * The specifiers a bundler and a hand-written require may ask for the
+ * HTTP/2 module by.
+ */
+const http2ModuleSpecifiers = new Set([
+    "http2",
+    "node:http2",
+]);
+/**
+ * Whether a module specifier names the HTTP/2 module.
+ */
+export function isSimLambdaHttp2ModuleSpecifier(specifier) {
+    return http2ModuleSpecifiers.has(specifier);
+}
+/**
+ * Build the `node:http2` module sim Lambda function code connects through.
+ *
+ * Everything the real module exports is kept, and only `connect` is
+ * replaced. A session to a hostname the simulation serves is a real HTTP/2
+ * session, connected over an in-memory socket pair to a server in this
+ * process that hands each request to the simulation. Every other session is
+ * the host module's, connected exactly as it was asked for.
+ *
+ * Bedrock Runtime's SDK client sends over HTTP/2, so this is where its calls
+ * from function code reach simulated Bedrock.
+ */
+export function makeSimLambdaHttp2Module(properties) {
+    const { hostModule, outbound } = properties;
+    const hostConnect = hostModule["connect"];
+    return {
+        ...hostModule,
+        connect: (...callArguments) => {
+            const authority = authorityUrl(callArguments[0]);
+            if (authority === undefined || !outbound.serves(authority.hostname)) {
+                return hostConnect(...callArguments);
+            }
+            return new SimLambdaHttp2Session(authority, outbound).connect(hostConnect, callArguments);
+        },
+    };
+}
+/**
+ * The URL `connect` was asked for, as a string or a URL, or undefined for
+ * anything that is not one.
+ */
+function authorityUrl(authority) {
+    if (authority instanceof URL) {
+        return authority;
+    }
+    return typeof authority === "string" && URL.canParse(authority)
+        ? new URL(authority)
+        : undefined;
+}

package/dist/service/lambda/function/outbound/sim-lambda-http2-session.d.ts

@@ -0,0 +1,31 @@
+import http2 from "node:http2";
+import type { SimLambdaOutboundHttp } from "./sim-lambda-outbound-http.js";
+/**
+ * The host module's `connect`.
+ */
+export type SimLambdaHttp2Connect = (...callArguments: unknown[]) => http2.ClientHttp2Session;
+/**
+ * One HTTP/2 session the simulation answers.
+ */
+export declare class SimLambdaHttp2Session {
+    private readonly authority;
+    private readonly outbound;
+    private readonly exchanges;
+    constructor(authority: URL, outbound: SimLambdaOutboundHttp);
+    /**
+     * Connect the host module's client to an in-process server.
+     *
+     * The host client does all the HTTP/2 work, so streams, flow control,
+     * timeouts and resets behave as they do over a network socket. Only the
+     * socket it runs over is supplied.
+     */
+    connect(hostConnect: SimLambdaHttp2Connect, callArguments: readonly unknown[]): http2.ClientHttp2Session;
+    private answer;
+    /**
+     * Answer one request from the simulation.
+     *
+     * A request the simulation cannot answer fails the client's stream with the
+     * error that explains it, which is what the SDK rejects the call with.
+     */
+    private respond;
+}

package/dist/service/lambda/function/outbound/sim-lambda-http2-session.js

@@ -0,0 +1,57 @@
+import http2 from "node:http2";
+import { duplexPair } from "node:stream";
+import { simLambdaHttp2ConnectArguments, simLambdaHttp2Request, simLambdaHttp2ResponseHeaders, } from "./sim-lambda-http2-messages.js";
+import { SimLambdaHttp2Exchanges } from "./sim-lambda-http2-exchanges.js";
+/**
+ * One HTTP/2 session the simulation answers.
+ */
+export class SimLambdaHttp2Session {
+    authority;
+    outbound;
+    exchanges = new SimLambdaHttp2Exchanges();
+    constructor(authority, outbound) {
+        this.authority = authority;
+        this.outbound = outbound;
+    }
+    /**
+     * Connect the host module's client to an in-process server.
+     *
+     * The host client does all the HTTP/2 work, so streams, flow control,
+     * timeouts and resets behave as they do over a network socket. Only the
+     * socket it runs over is supplied.
+     */
+    connect(hostConnect, callArguments) {
+        const { options, listener } = simLambdaHttp2ConnectArguments(callArguments);
+        const server = http2.createServer((request, response) => {
+            this.answer(request, response);
+        });
+        const [clientSocket, serverSocket] = duplexPair();
+        server.emit("connection", serverSocket);
+        const session = hostConnect(this.authority, { ...options, createConnection: () => clientSocket }, ...listener);
+        this.exchanges.track(session);
+        return session;
+    }
+    answer(request, response) {
+        const exchange = this.exchanges.exchangeFor(request);
+        exchange.scope.runInAsyncScope(() => {
+            void this.respond(request, response, exchange.stream);
+        });
+    }
+    /**
+     * Answer one request from the simulation.
+     *
+     * A request the simulation cannot answer fails the client's stream with the
+     * error that explains it, which is what the SDK rejects the call with.
+     */
+    async respond(request, response, clientStream) {
+        try {
+            const answered = await this.outbound.fetch(await simLambdaHttp2Request(this.authority, this.outbound, request));
+            const body = Buffer.from(await answered.arrayBuffer());
+            response.writeHead(answered.status, simLambdaHttp2ResponseHeaders(answered.headers));
+            response.end(body);
+        }
+        catch (error) {
+            clientStream.destroy(error);
+        }
+    }
+}

package/dist/service/lambda/function/outbound/sim-lambda-transport-module.d.ts

@@ -0,0 +1,11 @@
+import type { SimLambdaOutboundHttp } from "./sim-lambda-outbound-http.js";
+/**
+ * Whether a module specifier names one of the transport modules function code
+ * makes requests through: `node:http`, `node:https` or `node:http2`.
+ */
+export declare function isSimLambdaTransportModuleSpecifier(specifier: string): boolean;
+/**
+ * The transport module a specifier names, with its requests to the hostnames
+ * the simulation serves answered by the simulation.
+ */
+export declare function makeSimLambdaTransportModule(specifier: string, hostModule: Record<string, unknown>, outbound: SimLambdaOutboundHttp): Record<string, unknown>;

package/dist/service/lambda/function/outbound/sim-lambda-transport-module.js

@@ -0,0 +1,24 @@
+import { isSimLambdaHttpModuleSpecifier, makeSimLambdaHttpModule, simLambdaHttpModuleScheme, } from "./sim-lambda-http-module.js";
+import { isSimLambdaHttp2ModuleSpecifier, makeSimLambdaHttp2Module, } from "./sim-lambda-http2-module.js";
+/**
+ * Whether a module specifier names one of the transport modules function code
+ * makes requests through: `node:http`, `node:https` or `node:http2`.
+ */
+export function isSimLambdaTransportModuleSpecifier(specifier) {
+    return (isSimLambdaHttpModuleSpecifier(specifier) ||
+        isSimLambdaHttp2ModuleSpecifier(specifier));
+}
+/**
+ * The transport module a specifier names, with its requests to the hostnames
+ * the simulation serves answered by the simulation.
+ */
+export function makeSimLambdaTransportModule(specifier, hostModule, outbound) {
+    if (isSimLambdaHttp2ModuleSpecifier(specifier)) {
+        return makeSimLambdaHttp2Module({ hostModule, outbound });
+    }
+    return makeSimLambdaHttpModule({
+        hostModule,
+        outbound,
+        scheme: simLambdaHttpModuleScheme(specifier),
+    });
+}

package/docs/services/lambda/README.md

@@ -152,6 +152,9 @@ The vm runtime models the real Node.js runtime closely:
   (`AWS_REGION`, `AWS_LAMBDA_FUNCTION_NAME`, `AWS_LAMBDA_FUNCTION_MEMORY_SIZE`, ...).
 - The sandbox provides writable `process.stdout` and `process.stderr`, with its `console` built
   over them, as the real runtime does. See [What a handler prints](#what-a-handler-prints).
+- The sandbox provides the other globals of the Node.js runtime, including `global`, the WHATWG
+  streams, `EventTarget`, `atob`, `performance` and `navigator`. `Date` and the timers follow the
+  simulated clock. `performance.now()` reads host time.
 - Import and handler problems surface as invocation errors, with the real runtime error types
   (`Runtime.ImportModuleError`, `Runtime.HandlerNotFound`, `Runtime.UserCodeSyntaxError`,
   `Runtime.MalformedHandlerName`). Creation succeeds either way.
@@ -728,8 +731,8 @@ Some deployment packages inline the SDK rather than relying on the runtime to pr
 `NodejsFunction` does that when given `bundling: { externalModules: [] }`. There is then no
 `@aws-sdk/*` module left for the runtime to provide, and nothing to intercept.
 
-Those functions reach the simulation anyway. The runtime provides their HTTP transport, `node:http`
-and `node:https`, and a request addressed to an AWS API endpoint is answered from the same
+Those functions reach the simulation anyway. The runtime provides their HTTP transport, `node:http`,
+`node:https` and `node:http2`, and a request addressed to an AWS API endpoint is answered from the same
 simulated services, as the same execution role, instead of going to the network. The execution
 role credentials are in the function's environment, as real Lambda puts them there. The SDK resolves
 credentials inside the sandbox, where it would otherwise fail with `CredentialsProviderError`.
@@ -746,6 +749,13 @@ sends. A function can read and write Objects with an `S3Client` its archive inli
 Role authorizes each request, and a read it holds no `s3:GetObject` for comes back to the SDK as
 `AccessDenied`.
 
+Bedrock Runtime states its operation and its model in the path, and its client sends over HTTP/2.
+`Converse`, `ConverseStream`, `InvokeModel` and `InvokeModelWithResponseStream` from a bundled
+`BedrockRuntimeClient` return what `simAws.bedrock().responses()` declares, and the SDK reads the
+two streaming operations as it reads a real event stream. A model id given as an inference profile
+ARN works too. The execution Role authorizes each call, and a denial reaches the handler as
+`AccessDeniedException`.
+
 A bundled call to any other simulated service, such as SNS, SES or Lambda itself, fails with an
 error naming the service. Leaving the SDK out of that archive puts it back
 on the module interception path above, which every simulated service is reachable through.
@@ -761,8 +771,8 @@ hostname, along with everything else a handler asks for over HTTP.
 ## The HTTP requests function code makes
 
 A request from a handler to a hostname the simulation serves is answered by the simulation. It
-never leaves the process. `fetch`, `node:http` and `node:https` all reach it, so it makes no
-difference which client the handler was written with.
+never leaves the process. `fetch`, `node:http`, `node:https` and `node:http2` all reach it, so it
+makes no difference which client the handler was written with.
 
 Two kinds of hostname are served. Everything simulated Route53 resolves is answered over the same
 in-process HTTP entry point a browser on localhost reaches. That covers a
@@ -4358,9 +4368,9 @@ Sim Lambda currently supports:
 - Per-function environment variables with `Environment.Variables`
 - Runtime-provided `@aws-sdk/*` packages inside function code, routed into the owning simulated AWS
   environment
-- `fetch`, `node:http` and `node:https` requests from function code, answered by the simulation for
-  every hostname it serves, including a Cognito user pool domain's OAuth endpoints and the JWKS a
-  token verifier fetches from the regional Cognito endpoint
+- `fetch`, `node:http`, `node:https` and `node:http2` requests from function code, answered by the
+  simulation for every hostname it serves, including a Cognito user pool domain's OAuth endpoints
+  and the JWKS a token verifier fetches from the regional Cognito endpoint
 - Execution roles, evaluated against simulated IAM
 - Published versions and aliases, with `PublishVersion`, `ListVersionsByFunction`, `CreateAlias`,
   `UpdateAlias`, `GetAlias`, `ListAliases` and `DeleteAlias`, and a `Qualifier` on `Invoke`,
@@ -4470,7 +4480,7 @@ Current documented limitations:
 - Environment variables declared with `Environment.Variables` reach a real in-process handler
   function only while it runs, so a variable read at module scope sees the host process value
   instead. See [Environment variables](#environment-variables).
-- Outbound HTTP is routed for `fetch`, `node:http` and `node:https` alone. A handler using another
+- Outbound HTTP is routed for `fetch`, `node:http`, `node:https` and `node:http2` alone. A handler using another
   client, or a request made from a handler module while it is being imported, reaches the network.
   A routed response comes back as the simulation answered it, with redirects left for the caller to
   follow. See [The HTTP requests function code makes](#the-http-requests-function-code-makes).

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@kensio/yulin",
-  "version": "1.21.28",
+  "version": "1.21.29",
   "description": "AWS system behaviour simulation for isolated unit testing",
   "repository": "https://github.com/KensioSoftware/yulin",
   "homepage": "https://yulinsim.dev/",