@kensio/yulin 1.21.9 → 1.21.11

package/dist/service/apigatewayv2/serve/sim-http-api-may-invoke.d.ts

@@ -0,0 +1,19 @@
+import type { SimHttpApiMatch } from "../api/sim-http-api-match.js";
+import type { SimHttpApi } from "../api/sim-http-api.js";
+import type { SimHttpApiFunctionTarget } from "./sim-http-api-function-target.js";
+interface SimHttpApiMayInvokeInput {
+    readonly api: SimHttpApi;
+    readonly match: SimHttpApiMatch;
+    readonly request: Request;
+}
+/**
+ * Whether the API lacks permission to invoke a function behind one of its
+ * routes.
+ *
+ * The route the request matched is supplied as the source ARN, so a permission
+ * granted for one route does not open another. This is the API's own question
+ * rather than the client's, whose was already answered by the route's
+ * authorization.
+ */
+export declare function simHttpApiMayNotInvoke(input: SimHttpApiMayInvokeInput, target: SimHttpApiFunctionTarget): boolean;
+export {};

package/dist/service/apigatewayv2/serve/sim-http-api-may-invoke.js

@@ -0,0 +1,19 @@
+import { SimHttpApiExecuteApiArn } from "../api/sim-http-api-execute-api-arn.js";
+import { SimHttpApiInvokeAuthorizer } from "./auth/sim-http-api-invoke-authorizer.js";
+/**
+ * Whether the API lacks permission to invoke a function behind one of its
+ * routes.
+ *
+ * The route the request matched is supplied as the source ARN, so a permission
+ * granted for one route does not open another. This is the API's own question
+ * rather than the client's, whose was already answered by the route's
+ * authorization.
+ */
+export function simHttpApiMayNotInvoke(input, target) {
+    const { api, match, request } = input;
+    return new SimHttpApiInvokeAuthorizer({ iam: target.iam }).authorize({
+        api,
+        target,
+        sourceArn: SimHttpApiExecuteApiArn.forMatchedRoute(api, match, request.method),
+    }).isDenied;
+}

package/dist/service/apigatewayv2/serve/sim-http-api-serve-pipeline.d.ts

@@ -0,0 +1,27 @@
+import type { SimAwsServiceRequest } from "../../../serve/controller/sim-service-controller.js";
+import type { SimApiGatewayV2Router } from "./sim-api-gateway-v2-router.js";
+import type { SimHttpApiServed, SimHttpApiServedRequest } from "./sim-http-api-served.js";
+interface SimHttpApiServePipelineProperties {
+    readonly router: SimApiGatewayV2Router;
+}
+/**
+ * Takes one request the resolver matched to a stage through the three things
+ * that stand between it and a response.
+ *
+ * The stage's throttle is asked first. A flood of requests to a throttled
+ * route invokes neither the authorizer nor the integration, and AWS publishes
+ * no order between the two. The client's own authorization comes next, so a
+ * request with no credentials is refused whether or not the integration
+ * behind the route would work. What each step decided is carried out with the
+ * response, because the stage's access log describes the request afterwards
+ * and a refused request is the case that log exists for.
+ */
+export declare class SimHttpApiServePipeline {
+    #private;
+    constructor(properties: SimHttpApiServePipelineProperties);
+    /**
+     * Serve one request, and report what each step of serving it decided.
+     */
+    run(serving: SimHttpApiServedRequest, serviceRequest: SimAwsServiceRequest): Promise<SimHttpApiServed>;
+}
+export {};

package/dist/service/apigatewayv2/serve/sim-http-api-serve-pipeline.js

@@ -0,0 +1,75 @@
+import { SimHttpApiRouteAuthorizer } from "./auth/sim-http-api-route-authorizer.js";
+import { SimApiGatewayV2ErrorResponse } from "./sim-api-gateway-v2-error-response.js";
+import { SimHttpApiIntegrationInvocation } from "./sim-http-api-integration-invocation.js";
+import { SimHttpApiRefusalResponse } from "./sim-http-api-refusal-response.js";
+/**
+ * Takes one request the resolver matched to a stage through the three things
+ * that stand between it and a response.
+ *
+ * The stage's throttle is asked first. A flood of requests to a throttled
+ * route invokes neither the authorizer nor the integration, and AWS publishes
+ * no order between the two. The client's own authorization comes next, so a
+ * request with no credentials is refused whether or not the integration
+ * behind the route would work. What each step decided is carried out with the
+ * response, because the stage's access log describes the request afterwards
+ * and a refused request is the case that log exists for.
+ */
+export class SimHttpApiServePipeline {
+    #router;
+    #routeAuthorizer;
+    #integration;
+    #errorResponse = new SimApiGatewayV2ErrorResponse();
+    #refusalResponse = new SimHttpApiRefusalResponse();
+    constructor(properties) {
+        this.#router = properties.router;
+        // The clock is the router's, so the event timestamps and the token expiry
+        // checks belong to the same simulation.
+        this.#routeAuthorizer = new SimHttpApiRouteAuthorizer({
+            clock: properties.router.simAws,
+            functions: properties.router,
+        });
+        this.#integration = new SimHttpApiIntegrationInvocation({
+            router: properties.router,
+            clock: properties.router.simAws,
+        });
+    }
+    /**
+     * Serve one request, and report what each step of serving it decided.
+     */
+    async run(serving, serviceRequest) {
+        const { request } = serviceRequest;
+        const { api, match, domainName, rawPath, requestId } = serving;
+        // What the authorizer's event and the integration's event both describe.
+        const asked = { api, match, request, domainName, rawPath, requestId };
+        // The throttle takes a token from the route's bucket, and a route whose
+        // bucket is empty is answered here. Neither the authorizer nor the
+        // integration runs for it, and the stage's access log is the only place
+        // the refusal is recorded.
+        if (!match.stage.admits(match.route.routeKey)) {
+            return { response: this.#errorResponse.tooManyRequests() };
+        }
+        const authorization = await this.#routeAuthorizer.authorize({
+            ...asked,
+            caller: serviceRequest.caller,
+            iam: this.#router.iamFor(api),
+        });
+        // A refusal is carried out alongside its response, because the access log
+        // line reports what the authorizer said. An unmet route scope, an
+        // `AWS_IAM` route IAM did not allow, and a Lambda authorizer that said no
+        // all arrive here.
+        if (!authorization.admitted) {
+            return {
+                response: this.#refusalResponse.build(authorization),
+                authorization,
+            };
+        }
+        const clock = this.#router.simAws;
+        const invokedAt = clock.now().getTime();
+        const outcome = await this.#integration.invoke({ ...asked, authorization });
+        const integration = {
+            ...outcome,
+            integrationLatency: clock.now().getTime() - invokedAt,
+        };
+        return { response: integration.response, authorization, integration };
+    }
+}

package/dist/service/apigatewayv2/serve/sim-http-api-served.d.ts

@@ -0,0 +1,22 @@
+import type { SimHttpApiAuthorization } from "../api/authorizer/sim-http-api-authorization.js";
+import type { SimHttpApiIntegrationOutcome } from "./sim-http-api-integration-outcome.js";
+import type { SimHttpApiServing } from "./sim-http-api-serving.js";
+/**
+ * What one request through the endpoint produced, gathered as it happened so
+ * that the stage's access log can describe it afterwards.
+ *
+ * A request the stage's throttle refused has neither an authorization nor an
+ * integration, and one an authorizer refused has an authorization alone.
+ */
+export interface SimHttpApiServed {
+    readonly response: Response;
+    readonly authorization?: SimHttpApiAuthorization | undefined;
+    readonly integration?: SimHttpApiIntegrationOutcome | undefined;
+}
+/**
+ * A serving the controller has stamped with the id this request is logged and
+ * reported under, which every path below it then names.
+ */
+export interface SimHttpApiServedRequest extends SimHttpApiServing {
+    readonly requestId: string;
+}

package/dist/service/apigatewayv2/serve/sim-http-api-served.js

@@ -0,0 +1 @@
+export {};

package/dist/service/apigatewayv2/serve/sim-http-api-serving.d.ts

@@ -21,6 +21,18 @@ export interface SimHttpApiServing {
      * carrying.
      */
     readonly rawPath: string;
+    /**
+     * The id this request is logged and reported under, settled by the
+     * controller before anything runs. The resolver leaves it out, and the
+     * controller adds it to the serving it passes on.
+     */
+    readonly requestId?: string | undefined;
+    /**
+     * The API mapping base path this request matched, for a request that
+     * reached a custom domain. It is the empty string for a mapping serving the
+     * root of its domain, and absent for the generated endpoint.
+     */
+    readonly basePathMatched?: string | undefined;
 }
 /**
  * What an HTTP API endpoint decided about one request before any of it ran.

package/dist/service/apigatewayv2/serve/sim-http-api-serving.js

@@ -107,6 +107,7 @@ export class SimHttpApiServingResolver {
                 match,
                 domainName: domain.domainName,
                 rawPath: mapping.apiMappingKey.remainingPath(path),
+                basePathMatched: mapping.apiMappingKey.value,
             },
         };
     }

package/dist/service/lambda/cfn/event-source-mapping/sim-cfn-lambda-event-source-mapping-properties.d.ts

@@ -19,7 +19,7 @@ export declare class SimCfnLambdaEventSourceMappingProperties {
     private readonly parser;
     constructor(properties: SimCfnLambdaEventSourceMappingPropertiesProperties);
     /**
-     * The create input this Resource asks for, refusing what is not simulated.
+     * The create input this Resource asks for, recording what is left out of it.
      *
      * The event source ARN is read before anything else is judged, as the command
      * reads it first for the same reason: what a mapping may ask for depends on

package/dist/service/lambda/cfn/event-source-mapping/sim-cfn-lambda-event-source-mapping-properties.js

@@ -1,6 +1,6 @@
 import { simLambdaStreamDestinationConfig } from "../../event-source/sim-lambda-stream-destination-config.js";
 import { SimCfnLambdaPropertyParser } from "../function/sim-cfn-lambda-property-parser.js";
-import { assertSimulatedEventSourceMappingProperties } from "./sim-cfn-lambda-event-source-mapping-property-rules.js";
+import { recordUnsimulatedEventSourceMappingProperties } from "./sim-cfn-lambda-event-source-mapping-property-rules.js";
 import { simCfnLambdaTargetFunctionName } from "../function/sim-cfn-lambda-target-function.js";
 /**
  * What a CloudFormation Unix time seconds value is multiplied by to reach the
@@ -24,7 +24,7 @@ export class SimCfnLambdaEventSourceMappingProperties {
         this.properties = properties.properties;
     }
     /**
-     * The create input this Resource asks for, refusing what is not simulated.
+     * The create input this Resource asks for, recording what is left out of it.
      *
      * The event source ARN is read before anything else is judged, as the command
      * reads it first for the same reason: what a mapping may ask for depends on
@@ -32,7 +32,7 @@ export class SimCfnLambdaEventSourceMappingProperties {
      */
     createInput() {
         const eventSourceArn = this.parser.requiredString(this.resource, this.properties["EventSourceArn"], "EventSourceArn");
-        assertSimulatedEventSourceMappingProperties(this.resource, this.properties);
+        recordUnsimulatedEventSourceMappingProperties(this.resource, this.properties);
         return {
             EventSourceArn: eventSourceArn,
             DestinationConfig: simLambdaStreamDestinationConfig(this.properties["DestinationConfig"]),
@@ -42,6 +42,7 @@ export class SimCfnLambdaEventSourceMappingProperties {
             MaximumBatchingWindowInSeconds: this.parser.optionalNumber(this.resource, this.properties["MaximumBatchingWindowInSeconds"], "MaximumBatchingWindowInSeconds"),
             MaximumRetryAttempts: this.parser.optionalNumber(this.resource, this.properties["MaximumRetryAttempts"], "MaximumRetryAttempts"),
             MaximumRecordAgeInSeconds: this.parser.optionalNumber(this.resource, this.properties["MaximumRecordAgeInSeconds"], "MaximumRecordAgeInSeconds"),
+            BisectBatchOnFunctionError: this.parser.optionalBoolean(this.resource, this.properties["BisectBatchOnFunctionError"], "BisectBatchOnFunctionError"),
             StartingPosition: this.parser.optionalString(this.resource, this.properties["StartingPosition"], "StartingPosition"),
             StartingPositionTimestamp: this.startingPositionTimestamp(),
             FunctionResponseTypes: this.functionResponseTypes(),

package/dist/service/lambda/cfn/event-source-mapping/sim-cfn-lambda-event-source-mapping-property-names.d.ts

@@ -0,0 +1,30 @@
+/**
+ * The AWS::Lambda::EventSourceMapping properties this simulation acts on.
+ *
+ * The two starting position properties are here rather than among the
+ * unsimulated ones because whether a mapping may carry one is the event
+ * source's own rule: a stream has to be given a position and a queue is refused
+ * for naming one. That is decided by CreateEventSourceMapping, which knows
+ * which source the ARN names, so both are read and passed on. The two
+ * failed-batch limits are read for the same reason: a stream mapping keeps them
+ * and a queue mapping is refused for naming one.
+ */
+export declare const simulatedPropertyNames: ReadonlySet<string>;
+/**
+ * Real AWS::Lambda::EventSourceMapping properties this simulation does not act
+ * on, and what the mapping does in place of each.
+ *
+ * Every one of them changes what the function sees or when it sees it. That is
+ * what the record against the Resource is for. A mapping created without one
+ * still carries the records the template asked for to the function the
+ * template named, and the difference is there to be read.
+ */
+export declare const unsimulatedPropertyReasons: ReadonlyMap<string, string>;
+/**
+ * Why a property name this simulation has never heard of is recorded.
+ *
+ * A typo and a property AWS added after this simulation read the docs look
+ * identical from here. A mapping that deploys with the unread name reported is
+ * more use than a stack that fails over either.
+ */
+export declare const unknownPropertyReason: string;

package/dist/service/lambda/cfn/event-source-mapping/sim-cfn-lambda-event-source-mapping-property-names.js

@@ -0,0 +1,91 @@
+/**
+ * The AWS::Lambda::EventSourceMapping properties this simulation acts on.
+ *
+ * The two starting position properties are here rather than among the
+ * unsimulated ones because whether a mapping may carry one is the event
+ * source's own rule: a stream has to be given a position and a queue is refused
+ * for naming one. That is decided by CreateEventSourceMapping, which knows
+ * which source the ARN names, so both are read and passed on. The two
+ * failed-batch limits are read for the same reason: a stream mapping keeps them
+ * and a queue mapping is refused for naming one.
+ */
+export const simulatedPropertyNames = new Set([
+    "BatchSize",
+    "Enabled",
+    "EventSourceArn",
+    "FunctionName",
+    "FunctionResponseTypes",
+    "MaximumBatchingWindowInSeconds",
+    "MaximumRecordAgeInSeconds",
+    "MaximumRetryAttempts",
+    "BisectBatchOnFunctionError",
+    "DestinationConfig",
+    "StartingPosition",
+    "StartingPositionTimestamp",
+]);
+/**
+ * The event sources a mapping property can only be configuring, none of which
+ * this simulation has.
+ *
+ * A mapping naming one of these has an event source ARN to match, and that ARN
+ * is what the mapping is refused on. The property beside it is recorded.
+ */
+const absentEventSource = "the mapping polls the source its EventSourceArn names, and this " +
+    "simulation has SQS queues, DynamoDB streams and Kinesis streams";
+/**
+ * Real AWS::Lambda::EventSourceMapping properties this simulation does not act
+ * on, and what the mapping does in place of each.
+ *
+ * Every one of them changes what the function sees or when it sees it. That is
+ * what the record against the Resource is for. A mapping created without one
+ * still carries the records the template asked for to the function the
+ * template named, and the difference is there to be read.
+ */
+export const unsimulatedPropertyReasons = new Map([
+    ["AmazonManagedKafkaEventSourceConfig", absentEventSource],
+    ["DocumentDBEventSourceConfig", absentEventSource],
+    [
+        "FilterCriteria",
+        "every record on the event source is delivered to the function, unfiltered",
+    ],
+    [
+        "KmsKeyArn",
+        "the key encrypts filter criteria, and filter criteria are not simulated",
+    ],
+    ["MetricsConfig", "the mapping publishes no CloudWatch metrics"],
+    [
+        "ParallelizationFactor",
+        "polling concurrency is not simulated, and each shard of a stream is read " +
+            "by one reader",
+    ],
+    ["ProvisionedPollerConfig", "polling concurrency is not simulated"],
+    ["Queues", absentEventSource],
+    ["ScalingConfig", "polling concurrency is not simulated"],
+    ["SelfManagedEventSource", absentEventSource],
+    ["SelfManagedKafkaEventSourceConfig", absentEventSource],
+    [
+        "SourceAccessConfigurations",
+        "event source authentication is not simulated",
+    ],
+    [
+        "Tags",
+        "the mapping is created without them, and nothing reads them back or " +
+            "groups or bills by them",
+    ],
+    ["Topics", absentEventSource],
+    [
+        "TumblingWindowInSeconds",
+        "a batch carries no window state from the batch before it, and the " +
+            "function is handed no state to return",
+    ],
+]);
+/**
+ * Why a property name this simulation has never heard of is recorded.
+ *
+ * A typo and a property AWS added after this simulation read the docs look
+ * identical from here. A mapping that deploys with the unread name reported is
+ * more use than a stack that fails over either.
+ */
+export const unknownPropertyReason = "it is not an AWS::Lambda::EventSourceMapping property this simulation " +
+    "knows, whether because AWS added it or because the template misspelled " +
+    "something";

package/dist/service/lambda/cfn/event-source-mapping/sim-cfn-lambda-event-source-mapping-property-rules.d.ts

@@ -1,17 +1,12 @@
 import type { SimCfnResource } from "../../../cloudformation/resource/sim-cfn-resource.js";
 import type { SimCfnTemplateValueRecord } from "../../../cloudformation/template/value/sim-cfn-template-value.js";
 /**
- * Build the error a property of an AWS::Lambda::EventSourceMapping Resource is
- * refused with.
+ * Record everything about an AWS::Lambda::EventSourceMapping Resource that the
+ * mapping is created without.
  *
- * The wording matters: sim CloudFormation skips a Resource whose error reads as
- * an unsupported Resource type, and skipping is the wrong answer for a mapping
- * that cannot be created as the template asks. The stack would deploy with the
- * queue and the function and nothing between them.
+ * Nothing here fails the Resource. A mapping missing one of these settings
+ * still carries records from the source to the function, and a stack that
+ * refused it would take every other Resource down over one line of a template.
+ * What the mapping does instead is in `stack.ignoredProperties`.
  */
-export declare function eventSourceMappingPropertyError(logicalId: string, reason: string): Error;
-/**
- * Refuse everything about an AWS::Lambda::EventSourceMapping Resource that is
- * not simulated, and record what the mapping is created without.
- */
-export declare function assertSimulatedEventSourceMappingProperties(resource: SimCfnResource, properties: SimCfnTemplateValueRecord): void;
+export declare function recordUnsimulatedEventSourceMappingProperties(resource: SimCfnResource, properties: SimCfnTemplateValueRecord): void;

package/dist/service/lambda/cfn/event-source-mapping/sim-cfn-lambda-event-source-mapping-property-rules.js

@@ -1,100 +1,20 @@
+import { simulatedPropertyNames, unknownPropertyReason, unsimulatedPropertyReasons, } from "./sim-cfn-lambda-event-source-mapping-property-names.js";
 /**
- * The AWS::Lambda::EventSourceMapping properties this simulation acts on.
+ * Record everything about an AWS::Lambda::EventSourceMapping Resource that the
+ * mapping is created without.
  *
- * The two starting position properties are here rather than among the
- * unsimulated ones because whether a mapping may carry one is the event
- * source's own rule: a stream has to be given a position and a queue is refused
- * for naming one. That is decided by CreateEventSourceMapping, which knows
- * which source the ARN names, so both are read and passed on. The two
- * failed-batch limits are read for the same reason: a stream mapping keeps them
- * and a queue mapping is refused for naming one.
+ * Nothing here fails the Resource. A mapping missing one of these settings
+ * still carries records from the source to the function, and a stack that
+ * refused it would take every other Resource down over one line of a template.
+ * What the mapping does instead is in `stack.ignoredProperties`.
  */
-const simulatedPropertyNames = new Set([
-    "BatchSize",
-    "Enabled",
-    "EventSourceArn",
-    "FunctionName",
-    "FunctionResponseTypes",
-    "MaximumBatchingWindowInSeconds",
-    "MaximumRecordAgeInSeconds",
-    "MaximumRetryAttempts",
-    "DestinationConfig",
-    "StartingPosition",
-    "StartingPositionTimestamp",
-]);
-/**
- * Real AWS::Lambda::EventSourceMapping properties this simulation does not
- * model.
- *
- * Every one of them changes what the function sees or when it sees it, so a
- * template asking for one fails the Resource rather than deploying a mapping
- * that quietly ignores it.
- */
-const unsimulatedPropertyNames = new Set([
-    "AmazonManagedKafkaEventSourceConfig",
-    "BisectBatchOnFunctionError",
-    "DocumentDBEventSourceConfig",
-    "FilterCriteria",
-    "KmsKeyArn",
-    "MetricsConfig",
-    "ParallelizationFactor",
-    "ProvisionedPollerConfig",
-    "Queues",
-    "ScalingConfig",
-    "SelfManagedEventSource",
-    "SelfManagedKafkaEventSourceConfig",
-    "SourceAccessConfigurations",
-    "Topics",
-    "TumblingWindowInSeconds",
-]);
-/**
- * Real AWS::Lambda::EventSourceMapping properties this simulation has nothing
- * to act on and no reason to fail a stack over.
- *
- * `Tags` is the whole list. The mapping is created without them and the
- * omission is recorded against the Resource. A mapping delivers the same
- * records with a tag and without one, and a CDK app calling
- * `Tags.of(app).add(...)` tags every mapping in it.
- */
-const ignoredPropertyReasons = new Map([
-    [
-        "Tags",
-        "AWS::Lambda::EventSourceMapping property Tags is not simulated, so the " +
-            "mapping is created without them. Nothing reads them back and nothing " +
-            "is grouped or billed by them.",
-    ],
-]);
-/**
- * Build the error a property of an AWS::Lambda::EventSourceMapping Resource is
- * refused with.
- *
- * The wording matters: sim CloudFormation skips a Resource whose error reads as
- * an unsupported Resource type, and skipping is the wrong answer for a mapping
- * that cannot be created as the template asks. The stack would deploy with the
- * queue and the function and nothing between them.
- */
-export function eventSourceMappingPropertyError(logicalId, reason) {
-    return new Error(`Invalid AWS::Lambda::EventSourceMapping Resource ${logicalId}: ${reason}`);
-}
-/**
- * Refuse everything about an AWS::Lambda::EventSourceMapping Resource that is
- * not simulated, and record what the mapping is created without.
- */
-export function assertSimulatedEventSourceMappingProperties(resource, properties) {
-    const logicalId = resource.logicalId;
+export function recordUnsimulatedEventSourceMappingProperties(resource, properties) {
     for (const name of Object.keys(properties)) {
-        const ignoredReason = ignoredPropertyReasons.get(name);
-        if (ignoredReason !== undefined) {
-            resource.ignoreProperty(name, ignoredReason);
+        if (simulatedPropertyNames.has(name)) {
             continue;
         }
-        if (unsimulatedPropertyNames.has(name)) {
-            throw eventSourceMappingPropertyError(logicalId, `${name} is a real AWS::Lambda::EventSourceMapping property that ` +
-                "this simulation does not simulate, so it is refused rather than " +
-                "ignored");
-        }
-        if (!simulatedPropertyNames.has(name)) {
-            throw eventSourceMappingPropertyError(logicalId, `${name} is not an AWS::Lambda::EventSourceMapping property`);
-        }
+        const reason = unsimulatedPropertyReasons.get(name) ?? unknownPropertyReason;
+        resource.ignoreProperty(name, `AWS::Lambda::EventSourceMapping property ${name} is not simulated: ` +
+            `${reason}.`);
     }
 }

package/dist/service/lambda/command/event-source-mapping/create-event-source-mapping-input.js

@@ -68,6 +68,7 @@ export class SimLambdaEventSourceMappingInput {
             streamRetryLimits: eventSourceArn.retryLimitRules.limitsIn({
                 maximumRetryAttempts: input.MaximumRetryAttempts,
                 maximumRecordAgeInSeconds: input.MaximumRecordAgeInSeconds,
+                bisectBatchOnFunctionError: input.BisectBatchOnFunctionError,
             }),
         });
     }

package/dist/service/lambda/command/event-source-mapping/create-event-source-mapping-refusals.js

@@ -12,11 +12,6 @@ const unsimulatedInputs = new Map([
     ["FilterCriteria", "event filtering is not simulated"],
     ["ScalingConfig", "polling concurrency is not simulated"],
     ["ProvisionedPollerConfig", "polling concurrency is not simulated"],
-    [
-        "BisectBatchOnFunctionError",
-        "batch bisection is not simulated, so a failing stream batch is retried " +
-            "whole",
-    ],
     [
         "ParallelizationFactor",
         "polling concurrency is not simulated, so each shard of a stream is read " +

package/dist/service/lambda/event-source/poll/kinesis/sim-lambda-kinesis-shard-poller.js

@@ -66,7 +66,7 @@ export class SimLambdaKinesisShardPoller {
         const { progress } = this;
         // Reading is done as the function's execution role, as on real Lambda, so
         // simulated IAM decides whether this mapping may read its stream.
-        const batch = await this.shard.read(progress.position, this.mapping.batchSize);
+        const batch = await this.shard.read(progress.position, progress.batchSizeWithin(this.mapping.batchSize));
         await processSimLambdaStreamBatch({
             batch,
             progress,

package/dist/service/lambda/event-source/poll/sim-lambda-dynamodb-stream-polling.js

@@ -15,7 +15,7 @@ export class SimLambdaDynamoDbStreamPolling {
         const { progress, stream, mapping, delivery } = this.properties;
         // Reading is done as the function's execution role, as on real Lambda, so
         // simulated IAM decides whether this mapping may read its stream.
-        const batch = await stream.read(simFunction.roleArn, progress.position, mapping.batchSize);
+        const batch = await stream.read(simFunction.roleArn, progress.position, progress.batchSizeWithin(mapping.batchSize));
         await processSimLambdaStreamBatch({
             batch,
             progress,

package/dist/service/lambda/event-source/poll/sim-lambda-stream-bisect.d.ts

@@ -0,0 +1,53 @@
+import type { SimLambdaStreamBatchOutcome } from "./sim-lambda-stream-batch-outcome.js";
+/**
+ * How much of a failing batch the next delivery may carry.
+ *
+ * A mapping asked to bisect halves a batch its function threw on, and halves
+ * again on each further error, until a failing batch holds one record. That is
+ * how the record that broke the batch ends up delivered on its own, and how the
+ * records beside it get through.
+ *
+ * A split is progress rather than another attempt at the same work, so it puts
+ * the retry count back to the start. Without that the simulator's own cap of
+ * five attempts would discard a batch of a hundred long before it was down to
+ * one record. A batch halves at every step, so the splitting ends on its own,
+ * and the single record it ends on is then counted and discarded as any failing
+ * batch is.
+ *
+ * Two numbers say what the next read may take. The half is how many records a
+ * delivery may carry, and the remainder is how many records of the batch being
+ * split are still to get through. Reading the lower of the two is what keeps a
+ * record written while the splitting is going on out of it: the halves are the
+ * batch that failed, and a record that arrived afterwards belongs to the batch
+ * after it. The mapping's own batch size comes back once the whole of the split
+ * batch is through.
+ */
+export declare class SimLambdaStreamBisect {
+    #private;
+    private readonly enabled;
+    constructor(enabled: boolean);
+    /**
+     * How many records the next read may take, within the mapping's batch size.
+     */
+    sizeWithin(batchSize: number): number;
+    /**
+     * Split a batch the function threw on, answering with whether it split.
+     *
+     * A batch the function reported partial failures on is left alone. Lambda
+     * bisects around an error the handler raised, and a report already says which
+     * record to go back to.
+     */
+    split(outcome: SimLambdaStreamBatchOutcome): boolean;
+    /**
+     * Take records of the batch being split that the mapping is finished with,
+     * whether the function handled them, they were discarded, or they aged out.
+     *
+     * The whole of the split batch being through is what puts the mapping back on
+     * full batches.
+     */
+    finished(count: number): void;
+    /**
+     * Read whole batches again.
+     */
+    reset(): void;
+}