@kensio/yulin 1.17.1 → 1.18.0

package/dist/service/sns/delivery/lambda/sim-sns-delivery-function.d.ts

@@ -20,10 +20,11 @@ export declare class SimSnsDeliveryFunction {
     /**
      * Invoke the function with the event, if it still admits SNS for this topic.
      *
-     * The resource policy is consulted on every delivery rather than remembered
-     * from the moment the subscription was made, so a permission taken away
-     * afterwards stops delivery. Real SNS does not check it at `Subscribe` time
-     * at all, which is why this is the only place it is asked.
+     * The function, and the version or alias a qualified endpoint named, are
+     * resolved on every delivery, along with the resource policy, so a
+     * permission taken away afterwards stops delivery and an alias moved to
+     * another version moves what runs. Real SNS checks none of it at
+     * `Subscribe` time, which is why this is the only place it is asked.
      */
     deliver(request: SimSnsDeliveryRequest): Promise<void>;
 }

package/dist/service/sns/delivery/lambda/sim-sns-delivery-function.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"sim-sns-delivery-function.d.ts","sourceRoot":"","sources":["../../../../../src/service/sns/delivery/lambda/sim-sns-delivery-function.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,4BAA4B,EAAE,MAAM,8CAA8C,CAAC;AAIjG,OAAO,KAAK,EAAE,yBAAyB,EAAE,MAAM,qDAAqD,CAAC;AACrG,OAAO,EACL,KAAK,qBAAqB,EAG3B,MAAM,wBAAwB,CAAC;AAGhC,UAAU,gCAAgC;IACxC,QAAQ,CAAC,GAAG,EAAE,yBAAyB,CAAC;IACxC,QAAQ,CAAC,KAAK,EAAE,4BAA4B,CAAC;CAC9C;AAED;;;;;;;GAOG;AACH,qBAAa,sBAAsB;IACjC,OAAO,CAAC,QAAQ,CAAC,GAAG,CAA4B;IAChD,OAAO,CAAC,QAAQ,CAAC,KAAK,CAA+B;IAErD,YAAY,UAAU,EAAE,gCAAgC,EAGvD;IAED;;;;;;;OAOG;IACG,OAAO,CAAC,OAAO,EAAE,qBAAqB,GAAG,OAAO,CAAC,IAAI,CAAC,CAuC3D;CACF"}
+{"version":3,"file":"sim-sns-delivery-function.d.ts","sourceRoot":"","sources":["../../../../../src/service/sns/delivery/lambda/sim-sns-delivery-function.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,4BAA4B,EAAE,MAAM,8CAA8C,CAAC;AAIjG,OAAO,KAAK,EAAE,yBAAyB,EAAE,MAAM,qDAAqD,CAAC;AACrG,OAAO,EACL,KAAK,qBAAqB,EAG3B,MAAM,wBAAwB,CAAC;AAGhC,UAAU,gCAAgC;IACxC,QAAQ,CAAC,GAAG,EAAE,yBAAyB,CAAC;IACxC,QAAQ,CAAC,KAAK,EAAE,4BAA4B,CAAC;CAC9C;AAED;;;;;;;GAOG;AACH,qBAAa,sBAAsB;IACjC,OAAO,CAAC,QAAQ,CAAC,GAAG,CAA4B;IAChD,OAAO,CAAC,QAAQ,CAAC,KAAK,CAA+B;IAErD,YAAY,UAAU,EAAE,gCAAgC,EAGvD;IAED;;;;;;;;OAQG;IACG,OAAO,CAAC,OAAO,EAAE,qBAAqB,GAAG,OAAO,CAAC,IAAI,CAAC,CA2C3D;CACF"}

package/dist/service/sns/delivery/lambda/sim-sns-delivery-function.js

@@ -21,28 +21,33 @@ export class SimSnsDeliveryFunction {
     /**
      * Invoke the function with the event, if it still admits SNS for this topic.
      *
-     * The resource policy is consulted on every delivery rather than remembered
-     * from the moment the subscription was made, so a permission taken away
-     * afterwards stops delivery. Real SNS does not check it at `Subscribe` time
-     * at all, which is why this is the only place it is asked.
+     * The function, and the version or alias a qualified endpoint named, are
+     * resolved on every delivery, along with the resource policy, so a
+     * permission taken away afterwards stops delivery and an alias moved to
+     * another version moves what runs. Real SNS checks none of it at
+     * `Subscribe` time, which is why this is the only place it is asked.
      */
     async deliver(request) {
         const source = simSnsDeliverySource(request);
         const endpointArn = request.subscription.endpoint.value;
-        const simFunction = this.scope
+        const target = this.scope
             .lambda()
-            .getSimFunctionByName(this.arn.functionName);
-        if (simFunction === undefined) {
+            .getSimFunctionTarget(this.arn.functionName, this.arn.qualifier);
+        if (target === undefined) {
             // Not a refusal: the resource policy said nothing, because there is no
             // function. A subscription pointing at nothing is a mistake worth
             // warning about, where a policy saying no is a modelled outcome a test
-            // may be asking for on purpose.
-            throw new SimSnsNotFoundException(`${endpointArn} is not a simulated Lambda function.`);
+            // may be asking for on purpose. A qualified endpoint reaches here for a
+            // version or alias that is not there as well.
+            throw new SimSnsNotFoundException(this.arn.qualifier === undefined
+                ? `${endpointArn} is not a simulated Lambda function.`
+                : `${endpointArn} names no simulated Lambda function version or ` +
+                    "alias.");
         }
         const decision = new SimLambdaServiceInvokeAuthorizer({
             iam: this.scope.iam(),
         }).authorize({
-            simFunction,
+            resource: target.resource,
             servicePrincipal: simSnsServicePrincipal,
             ...source,
         });
@@ -56,7 +61,7 @@ export class SimSnsDeliveryFunction {
         // asynchronous invocation real SNS makes, and because a handler failure
         // has to reach the delivery outcome rather than being swallowed as an
         // asynchronous invocation error.
-        await simFunction.invoke(simSnsLambdaEventDocument(request));
+        await target.simFunction.invoke(simSnsLambdaEventDocument(request));
     }
 }
 //# sourceMappingURL=sim-sns-delivery-function.js.map

package/dist/service/sns/delivery/lambda/sim-sns-delivery-function.js.map

@@ -1 +1 @@
-{"version":3,"file":"sim-sns-delivery-function.js","sourceRoot":"","sources":["../../../../../src/service/sns/delivery/lambda/sim-sns-delivery-function.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,gCAAgC,EAAE,MAAM,2EAA2E,CAAC;AAC7H,OAAO,EAAE,0BAA0B,EAAE,MAAM,uCAAuC,CAAC;AACnF,OAAO,EAAE,uBAAuB,EAAE,MAAM,8BAA8B,CAAC;AAEvE,OAAO,EAEL,oBAAoB,EACpB,sBAAsB,GACvB,MAAM,wBAAwB,CAAC;AAChC,OAAO,EAAE,yBAAyB,EAAE,MAAM,2BAA2B,CAAC;AAOtE;;;;;;;GAOG;AACH,MAAM,OAAO,sBAAsB;IAChB,GAAG,CAA4B;IAC/B,KAAK,CAA+B;IAErD,YAAY,UAA4C;QACtD,IAAI,CAAC,GAAG,GAAG,UAAU,CAAC,GAAG,CAAC;QAC1B,IAAI,CAAC,KAAK,GAAG,UAAU,CAAC,KAAK,CAAC;IAChC,CAAC;IAED;;;;;;;OAOG;IACH,KAAK,CAAC,OAAO,CAAC,OAA8B;QAC1C,MAAM,MAAM,GAAG,oBAAoB,CAAC,OAAO,CAAC,CAAC;QAC7C,MAAM,WAAW,GAAG,OAAO,CAAC,YAAY,CAAC,QAAQ,CAAC,KAAK,CAAC;QACxD,MAAM,WAAW,GAAG,IAAI,CAAC,KAAK;aAC3B,MAAM,EAAE;aACR,oBAAoB,CAAC,IAAI,CAAC,GAAG,CAAC,YAAY,CAAC,CAAC;QAE/C,IAAI,WAAW,KAAK,SAAS,EAAE,CAAC;YAC9B,uEAAuE;YACvE,kEAAkE;YAClE,uEAAuE;YACvE,gCAAgC;YAChC,MAAM,IAAI,uBAAuB,CAC/B,GAAG,WAAW,sCAAsC,CACrD,CAAC;QACJ,CAAC;QAED,MAAM,QAAQ,GAAG,IAAI,gCAAgC,CAAC;YACpD,GAAG,EAAE,IAAI,CAAC,KAAK,CAAC,GAAG,EAAE;SACtB,CAAC,CAAC,SAAS,CAAC;YACX,WAAW;YACX,gBAAgB,EAAE,sBAAsB;YACxC,GAAG,MAAM;SACV,CAAC,CAAC;QAEH,IAAI,QAAQ,CAAC,QAAQ,EAAE,CAAC;YACtB,MAAM,IAAI,0BAA0B,CAClC,0BAA0B,WAAW,kBAAkB;gBACrD,GAAG,sBAAsB,qBAAqB,MAAM,CAAC,SAAS,IAAI;gBAClE,8BAA8B,CACjC,CAAC;QACJ,CAAC;QAED,0EAA0E;QAC1E,wEAAwE;QACxE,wEAAwE;QACxE,sEAAsE;QACtE,iCAAiC;QACjC,MAAM,WAAW,CAAC,MAAM,CAAC,yBAAyB,CAAC,OAAO,CAAC,CAAC,CAAC;IAC/D,CAAC;CACF"}
+{"version":3,"file":"sim-sns-delivery-function.js","sourceRoot":"","sources":["../../../../../src/service/sns/delivery/lambda/sim-sns-delivery-function.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,gCAAgC,EAAE,MAAM,2EAA2E,CAAC;AAC7H,OAAO,EAAE,0BAA0B,EAAE,MAAM,uCAAuC,CAAC;AACnF,OAAO,EAAE,uBAAuB,EAAE,MAAM,8BAA8B,CAAC;AAEvE,OAAO,EAEL,oBAAoB,EACpB,sBAAsB,GACvB,MAAM,wBAAwB,CAAC;AAChC,OAAO,EAAE,yBAAyB,EAAE,MAAM,2BAA2B,CAAC;AAOtE;;;;;;;GAOG;AACH,MAAM,OAAO,sBAAsB;IAChB,GAAG,CAA4B;IAC/B,KAAK,CAA+B;IAErD,YAAY,UAA4C;QACtD,IAAI,CAAC,GAAG,GAAG,UAAU,CAAC,GAAG,CAAC;QAC1B,IAAI,CAAC,KAAK,GAAG,UAAU,CAAC,KAAK,CAAC;IAChC,CAAC;IAED;;;;;;;;OAQG;IACH,KAAK,CAAC,OAAO,CAAC,OAA8B;QAC1C,MAAM,MAAM,GAAG,oBAAoB,CAAC,OAAO,CAAC,CAAC;QAC7C,MAAM,WAAW,GAAG,OAAO,CAAC,YAAY,CAAC,QAAQ,CAAC,KAAK,CAAC;QACxD,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK;aACtB,MAAM,EAAE;aACR,oBAAoB,CAAC,IAAI,CAAC,GAAG,CAAC,YAAY,EAAE,IAAI,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC;QAEnE,IAAI,MAAM,KAAK,SAAS,EAAE,CAAC;YACzB,uEAAuE;YACvE,kEAAkE;YAClE,uEAAuE;YACvE,wEAAwE;YACxE,8CAA8C;YAC9C,MAAM,IAAI,uBAAuB,CAC/B,IAAI,CAAC,GAAG,CAAC,SAAS,KAAK,SAAS;gBAC9B,CAAC,CAAC,GAAG,WAAW,sCAAsC;gBACtD,CAAC,CAAC,GAAG,WAAW,iDAAiD;oBAC7D,QAAQ,CACf,CAAC;QACJ,CAAC;QAED,MAAM,QAAQ,GAAG,IAAI,gCAAgC,CAAC;YACpD,GAAG,EAAE,IAAI,CAAC,KAAK,CAAC,GAAG,EAAE;SACtB,CAAC,CAAC,SAAS,CAAC;YACX,QAAQ,EAAE,MAAM,CAAC,QAAQ;YACzB,gBAAgB,EAAE,sBAAsB;YACxC,GAAG,MAAM;SACV,CAAC,CAAC;QAEH,IAAI,QAAQ,CAAC,QAAQ,EAAE,CAAC;YACtB,MAAM,IAAI,0BAA0B,CAClC,0BAA0B,WAAW,kBAAkB;gBACrD,GAAG,sBAAsB,qBAAqB,MAAM,CAAC,SAAS,IAAI;gBAClE,8BAA8B,CACjC,CAAC;QACJ,CAAC;QAED,0EAA0E;QAC1E,wEAAwE;QACxE,wEAAwE;QACxE,sEAAsE;QACtE,iCAAiC;QACjC,MAAM,MAAM,CAAC,WAAW,CAAC,MAAM,CAAC,yBAAyB,CAAC,OAAO,CAAC,CAAC,CAAC;IACtE,CAAC;CACF"}

package/dist/service/sns/subscription/sim-sns-function-endpoint-arn.d.ts

@@ -13,6 +13,14 @@ export declare class SimSnsFunctionEndpointArn {
     readonly regionName: AwsRegionName;
     readonly accountId: SimAwsAccountId;
     readonly functionName: string;
+    /**
+     * The version or alias the endpoint qualified the function with, if it named
+     * one.
+     *
+     * A subscription to `orders:live` delivers to the version the alias points
+     * at, so the qualifier is held here and resolved on every delivery.
+     */
+    readonly qualifier: string | undefined;
     private constructor();
     /**
      * Read a function ARN, refusing anything a function could not be reached by.
@@ -21,10 +29,6 @@ export declare class SimSnsFunctionEndpointArn {
      * What SNS adds is what an unreadable one means to a `Subscribe` request,
      * which is the same `InvalidParameterException` a queue ARN that is not one
      * gets.
-     *
-     * A qualified ARN naming a version or an alias is refused rather than read as
-     * the unqualified function, because simulated Lambda has neither and
-     * delivering to `$LATEST` instead would be the wrong function.
      */
     static parse(endpoint: string): SimSnsFunctionEndpointArn;
 }

package/dist/service/sns/subscription/sim-sns-function-endpoint-arn.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"sim-sns-function-endpoint-arn.d.ts","sourceRoot":"","sources":["../../../../src/service/sns/subscription/sim-sns-function-endpoint-arn.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,iCAAiC,CAAC;AACvE,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,6BAA6B,CAAC;AAcjE;;;;;;;GAOG;AACH,qBAAa,yBAAyB;IACpC,SAAgB,KAAK,EAAE,MAAM,CAAC;IAC9B,SAAgB,UAAU,EAAE,aAAa,CAAC;IAC1C,SAAgB,SAAS,EAAE,eAAe,CAAC;IAC3C,SAAgB,YAAY,EAAE,MAAM,CAAC;IAErC,OAAO,eAKN;IAED;;;;;;;;;;;OAWG;IACH,MAAM,CAAC,KAAK,CAAC,QAAQ,EAAE,MAAM,GAAG,yBAAyB,CAyBxD;CACF"}
+{"version":3,"file":"sim-sns-function-endpoint-arn.d.ts","sourceRoot":"","sources":["../../../../src/service/sns/subscription/sim-sns-function-endpoint-arn.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,iCAAiC,CAAC;AACvE,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,6BAA6B,CAAC;AAYjE;;;;;;;GAOG;AACH,qBAAa,yBAAyB;IACpC,SAAgB,KAAK,EAAE,MAAM,CAAC;IAC9B,SAAgB,UAAU,EAAE,aAAa,CAAC;IAC1C,SAAgB,SAAS,EAAE,eAAe,CAAC;IAC3C,SAAgB,YAAY,EAAE,MAAM,CAAC;IAErC;;;;;;OAMG;IACH,SAAgB,SAAS,EAAE,MAAM,GAAG,SAAS,CAAC;IAE9C,OAAO,eAMN;IAED;;;;;;;OAOG;IACH,MAAM,CAAC,KAAK,CAAC,QAAQ,EAAE,MAAM,GAAG,yBAAyB,CAkBxD;CACF"}

package/dist/service/sns/subscription/sim-sns-function-endpoint-arn.js

@@ -1,5 +1,5 @@
 import { parseSimLambdaFunctionArn } from "../../lambda/function/sim-lambda-function-arn-parts.js";
-import { SimSnsInvalidParameterException, SimSnsUnsimulatedInputException, } from "../error/sim-sns.error.js";
+import { SimSnsInvalidParameterException } from "../error/sim-sns.error.js";
 /**
  * The Lambda function ARN a subscription's endpoint names.
  *
@@ -13,11 +13,20 @@ export class SimSnsFunctionEndpointArn {
     regionName;
     accountId;
     functionName;
+    /**
+     * The version or alias the endpoint qualified the function with, if it named
+     * one.
+     *
+     * A subscription to `orders:live` delivers to the version the alias points
+     * at, so the qualifier is held here and resolved on every delivery.
+     */
+    qualifier;
     constructor(properties) {
         this.value = properties.value;
         this.regionName = properties.regionName;
         this.accountId = properties.accountId;
         this.functionName = properties.functionName;
+        this.qualifier = properties.qualifier;
     }
     /**
      * Read a function ARN, refusing anything a function could not be reached by.
@@ -26,10 +35,6 @@ export class SimSnsFunctionEndpointArn {
      * What SNS adds is what an unreadable one means to a `Subscribe` request,
      * which is the same `InvalidParameterException` a queue ARN that is not one
      * gets.
-     *
-     * A qualified ARN naming a version or an alias is refused rather than read as
-     * the unqualified function, because simulated Lambda has neither and
-     * delivering to `$LATEST` instead would be the wrong function.
      */
     static parse(endpoint) {
         const parts = parseSimLambdaFunctionArn(endpoint);
@@ -38,16 +43,12 @@ export class SimSnsFunctionEndpointArn {
                 "function ARN, which is " +
                 "arn:aws:lambda:<region>:<account-id>:function:<function-name>");
         }
-        if (parts.qualifier !== undefined) {
-            throw new SimSnsUnsimulatedInputException(`Cannot subscribe ${endpoint}: simulated Lambda has no function ` +
-                "versions or aliases, so a qualified function ARN is refused rather " +
-                "than treated as the unqualified function.");
-        }
         return new this({
             value: endpoint,
             regionName: parts.regionName,
             accountId: parts.accountId,
             functionName: parts.functionName,
+            qualifier: parts.qualifier,
         });
     }
 }

package/dist/service/sns/subscription/sim-sns-function-endpoint-arn.js.map

@@ -1 +1 @@
-{"version":3,"file":"sim-sns-function-endpoint-arn.js","sourceRoot":"","sources":["../../../../src/service/sns/subscription/sim-sns-function-endpoint-arn.ts"],"names":[],"mappings":"AAEA,OAAO,EAAE,yBAAyB,EAAE,MAAM,wDAAwD,CAAC;AACnG,OAAO,EACL,+BAA+B,EAC/B,+BAA+B,GAChC,MAAM,2BAA2B,CAAC;AASnC;;;;;;;GAOG;AACH,MAAM,OAAO,yBAAyB;IACpB,KAAK,CAAS;IACd,UAAU,CAAgB;IAC1B,SAAS,CAAkB;IAC3B,YAAY,CAAS;IAErC,YAAoB,UAA+C;QACjE,IAAI,CAAC,KAAK,GAAG,UAAU,CAAC,KAAK,CAAC;QAC9B,IAAI,CAAC,UAAU,GAAG,UAAU,CAAC,UAAU,CAAC;QACxC,IAAI,CAAC,SAAS,GAAG,UAAU,CAAC,SAAS,CAAC;QACtC,IAAI,CAAC,YAAY,GAAG,UAAU,CAAC,YAAY,CAAC;IAC9C,CAAC;IAED;;;;;;;;;;;OAWG;IACH,MAAM,CAAC,KAAK,CAAC,QAAgB;QAC3B,MAAM,KAAK,GAAG,yBAAyB,CAAC,QAAQ,CAAC,CAAC;QAElD,IAAI,KAAK,KAAK,SAAS,EAAE,CAAC;YACxB,MAAM,IAAI,+BAA+B,CACvC,uCAAuC,QAAQ,mBAAmB;gBAChE,yBAAyB;gBACzB,+DAA+D,CAClE,CAAC;QACJ,CAAC;QAED,IAAI,KAAK,CAAC,SAAS,KAAK,SAAS,EAAE,CAAC;YAClC,MAAM,IAAI,+BAA+B,CACvC,oBAAoB,QAAQ,qCAAqC;gBAC/D,qEAAqE;gBACrE,2CAA2C,CAC9C,CAAC;QACJ,CAAC;QAED,OAAO,IAAI,IAAI,CAAC;YACd,KAAK,EAAE,QAAQ;YACf,UAAU,EAAE,KAAK,CAAC,UAAU;YAC5B,SAAS,EAAE,KAAK,CAAC,SAAS;YAC1B,YAAY,EAAE,KAAK,CAAC,YAAY;SACjC,CAAC,CAAC;IACL,CAAC;CACF"}
+{"version":3,"file":"sim-sns-function-endpoint-arn.js","sourceRoot":"","sources":["../../../../src/service/sns/subscription/sim-sns-function-endpoint-arn.ts"],"names":[],"mappings":"AAEA,OAAO,EAAE,yBAAyB,EAAE,MAAM,wDAAwD,CAAC;AACnG,OAAO,EAAE,+BAA+B,EAAE,MAAM,2BAA2B,CAAC;AAU5E;;;;;;;GAOG;AACH,MAAM,OAAO,yBAAyB;IACpB,KAAK,CAAS;IACd,UAAU,CAAgB;IAC1B,SAAS,CAAkB;IAC3B,YAAY,CAAS;IAErC;;;;;;OAMG;IACa,SAAS,CAAqB;IAE9C,YAAoB,UAA+C;QACjE,IAAI,CAAC,KAAK,GAAG,UAAU,CAAC,KAAK,CAAC;QAC9B,IAAI,CAAC,UAAU,GAAG,UAAU,CAAC,UAAU,CAAC;QACxC,IAAI,CAAC,SAAS,GAAG,UAAU,CAAC,SAAS,CAAC;QACtC,IAAI,CAAC,YAAY,GAAG,UAAU,CAAC,YAAY,CAAC;QAC5C,IAAI,CAAC,SAAS,GAAG,UAAU,CAAC,SAAS,CAAC;IACxC,CAAC;IAED;;;;;;;OAOG;IACH,MAAM,CAAC,KAAK,CAAC,QAAgB;QAC3B,MAAM,KAAK,GAAG,yBAAyB,CAAC,QAAQ,CAAC,CAAC;QAElD,IAAI,KAAK,KAAK,SAAS,EAAE,CAAC;YACxB,MAAM,IAAI,+BAA+B,CACvC,uCAAuC,QAAQ,mBAAmB;gBAChE,yBAAyB;gBACzB,+DAA+D,CAClE,CAAC;QACJ,CAAC;QAED,OAAO,IAAI,IAAI,CAAC;YACd,KAAK,EAAE,QAAQ;YACf,UAAU,EAAE,KAAK,CAAC,UAAU;YAC5B,SAAS,EAAE,KAAK,CAAC,SAAS;YAC1B,YAAY,EAAE,KAAK,CAAC,YAAY;YAChC,SAAS,EAAE,KAAK,CAAC,SAAS;SAC3B,CAAC,CAAC;IACL,CAAC;CACF"}

package/dist/service/wafv2/association/sim-aws-waf-protected-resources.d.ts

@@ -0,0 +1,45 @@
+import type { SimAwsAccountRegionScope } from "../../aws/sim-aws-account-region-scope.js";
+import type { SimAws } from "../../aws/sim-aws.js";
+import type { SimWafProtectedResource } from "./sim-waf-protected-resource.js";
+import type { SimWafProtectedResources } from "./sim-waf-protected-resources.js";
+interface SimAwsWafProtectedResourcesProperties {
+    readonly simAws: SimAws;
+    readonly accountRegionScope: SimAwsAccountRegionScope;
+}
+/**
+ * The resources of one simulated AWS instance a web ACL can be put in front
+ * of.
+ *
+ * The lookup is made in the Account and Region the WAFv2 handling the request
+ * belongs to. A stage ARN names no Account, and AWS WAF associates within one
+ * Account, so a stage created elsewhere in the simulation is not there to be
+ * found. A user pool ARN does name an Account, and one naming another Account
+ * was already refused before the lookup.
+ */
+export declare class SimAwsWafProtectedResources implements SimWafProtectedResources {
+    #private;
+    constructor(properties: SimAwsWafProtectedResourcesProperties);
+    /**
+     * Whether the resource an ARN names is one this scope holds.
+     */
+    has(resource: SimWafProtectedResource): boolean;
+    /**
+     * Whether this scope holds the REST API stage an ARN names.
+     */
+    private hasRestApiStage;
+    /**
+     * Whether this scope holds the user pool an ARN names.
+     *
+     * The ARN is compared rather than the id alone. A pool id is unique across
+     * the whole simulation, so a pool this scope does not hold is simply not
+     * found, and comparing the ARN says the same thing about a pool id that is
+     * there under a different Account.
+     */
+    private hasUserPool;
+    /**
+     * The simulated services of the Account and Region this WAFv2 belongs to.
+     */
+    private scope;
+}
+export {};
+//# sourceMappingURL=sim-aws-waf-protected-resources.d.ts.map

package/dist/service/wafv2/association/sim-aws-waf-protected-resources.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"sim-aws-waf-protected-resources.d.ts","sourceRoot":"","sources":["../../../../src/service/wafv2/association/sim-aws-waf-protected-resources.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAEV,wBAAwB,EACzB,MAAM,2CAA2C,CAAC;AACnD,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,sBAAsB,CAAC;AACnD,OAAO,KAAK,EAAE,uBAAuB,EAAE,MAAM,iCAAiC,CAAC;AAC/E,OAAO,KAAK,EAAE,wBAAwB,EAAE,MAAM,kCAAkC,CAAC;AAIjF,UAAU,qCAAqC;IAC7C,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,QAAQ,CAAC,kBAAkB,EAAE,wBAAwB,CAAC;CACvD;AAED;;;;;;;;;GASG;AACH,qBAAa,2BAA4B,YAAW,wBAAwB;;IAI1E,YAAY,UAAU,EAAE,qCAAqC,EAG5D;IAED;;OAEG;IACH,GAAG,CAAC,QAAQ,EAAE,uBAAuB,GAAG,OAAO,CAM9C;IAED;;OAEG;IACH,OAAO,CAAC,eAAe;IAMvB;;;;;;;OAOG;IACH,OAAO,CAAC,WAAW;IAQnB;;OAEG;IACH,OAAO,CAAC,KAAK;CAKd"}

package/dist/service/wafv2/association/sim-aws-waf-protected-resources.js

@@ -0,0 +1,56 @@
+/**
+ * The resources of one simulated AWS instance a web ACL can be put in front
+ * of.
+ *
+ * The lookup is made in the Account and Region the WAFv2 handling the request
+ * belongs to. A stage ARN names no Account, and AWS WAF associates within one
+ * Account, so a stage created elsewhere in the simulation is not there to be
+ * found. A user pool ARN does name an Account, and one naming another Account
+ * was already refused before the lookup.
+ */
+export class SimAwsWafProtectedResources {
+    #simAws;
+    #accountRegionScope;
+    constructor(properties) {
+        this.#simAws = properties.simAws;
+        this.#accountRegionScope = properties.accountRegionScope;
+    }
+    /**
+     * Whether the resource an ARN names is one this scope holds.
+     */
+    has(resource) {
+        if (resource.resourceType === "COGNITO_USER_POOL") {
+            return this.hasUserPool(resource);
+        }
+        return this.hasRestApiStage(resource);
+    }
+    /**
+     * Whether this scope holds the REST API stage an ARN names.
+     */
+    hasRestApiStage(resource) {
+        const restApi = this.scope().apiGateway().findRestApi(resource.restApiId);
+        return restApi?.stages.find(resource.stageName) !== undefined;
+    }
+    /**
+     * Whether this scope holds the user pool an ARN names.
+     *
+     * The ARN is compared rather than the id alone. A pool id is unique across
+     * the whole simulation, so a pool this scope does not hold is simply not
+     * found, and comparing the ARN says the same thing about a pool id that is
+     * there under a different Account.
+     */
+    hasUserPool(resource) {
+        const pool = this.scope()
+            .cognitoIdentityProvider()
+            .findUserPool(resource.userPoolId);
+        return pool?.arn.value === resource.arn;
+    }
+    /**
+     * The simulated services of the Account and Region this WAFv2 belongs to.
+     */
+    scope() {
+        const { accountId, regionName } = this.#accountRegionScope;
+        return this.#simAws.accountRegionScope(accountId, regionName);
+    }
+}
+//# sourceMappingURL=sim-aws-waf-protected-resources.js.map

package/dist/service/wafv2/association/sim-aws-waf-protected-resources.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"sim-aws-waf-protected-resources.js","sourceRoot":"","sources":["../../../../src/service/wafv2/association/sim-aws-waf-protected-resources.ts"],"names":[],"mappings":"AAeA;;;;;;;;;GASG;AACH,MAAM,OAAO,2BAA2B;IAC7B,OAAO,CAAS;IAChB,mBAAmB,CAA2B;IAEvD,YAAY,UAAiD;QAC3D,IAAI,CAAC,OAAO,GAAG,UAAU,CAAC,MAAM,CAAC;QACjC,IAAI,CAAC,mBAAmB,GAAG,UAAU,CAAC,kBAAkB,CAAC;IAC3D,CAAC;IAED;;OAEG;IACH,GAAG,CAAC,QAAiC;QACnC,IAAI,QAAQ,CAAC,YAAY,KAAK,mBAAmB,EAAE,CAAC;YAClD,OAAO,IAAI,CAAC,WAAW,CAAC,QAAQ,CAAC,CAAC;QACpC,CAAC;QAED,OAAO,IAAI,CAAC,eAAe,CAAC,QAAQ,CAAC,CAAC;IACxC,CAAC;IAED;;OAEG;IACK,eAAe,CAAC,QAA4B;QAClD,MAAM,OAAO,GAAG,IAAI,CAAC,KAAK,EAAE,CAAC,UAAU,EAAE,CAAC,WAAW,CAAC,QAAQ,CAAC,SAAS,CAAC,CAAC;QAE1E,OAAO,OAAO,EAAE,MAAM,CAAC,IAAI,CAAC,QAAQ,CAAC,SAAS,CAAC,KAAK,SAAS,CAAC;IAChE,CAAC;IAED;;;;;;;OAOG;IACK,WAAW,CAAC,QAAwB;QAC1C,MAAM,IAAI,GAAG,IAAI,CAAC,KAAK,EAAE;aACtB,uBAAuB,EAAE;aACzB,YAAY,CAAC,QAAQ,CAAC,UAAU,CAAC,CAAC;QAErC,OAAO,IAAI,EAAE,GAAG,CAAC,KAAK,KAAK,QAAQ,CAAC,GAAG,CAAC;IAC1C,CAAC;IAED;;OAEG;IACK,KAAK;QACX,MAAM,EAAE,SAAS,EAAE,UAAU,EAAE,GAAG,IAAI,CAAC,mBAAmB,CAAC;QAE3D,OAAO,IAAI,CAAC,OAAO,CAAC,kBAAkB,CAAC,SAAS,EAAE,UAAU,CAAC,CAAC;IAChE,CAAC;CACF"}

package/dist/service/wafv2/association/sim-waf-associations.d.ts

@@ -0,0 +1,52 @@
+import type { SimWafDecision } from "../evaluate/sim-waf-decision.js";
+import type { SimWafWebAcl } from "../web-acl/sim-waf-web-acl.js";
+import type { SimWafProtectedResource, SimWafProtectedResourceType } from "./sim-waf-protected-resource.js";
+import type { SimWafProtectedRequest, SimWafProtection } from "./sim-waf-protection.js";
+/**
+ * The web ACLs one Account and Region has in front of things.
+ *
+ * A resource carries at most one web ACL, which is why this is keyed by
+ * resource ARN. The web ACL itself is held rather than its ARN, so a request
+ * reaching a protected resource is evaluated without a second lookup, and so a
+ * web ACL cannot be deleted out from under a resource still pointing at it.
+ */
+export declare class SimWafAssociations implements SimWafProtection {
+    #private;
+    /**
+     * Put a web ACL in front of one resource, replacing whatever was there.
+     *
+     * AssociateWebACL overwrites rather than refusing, because a resource has
+     * one web ACL and pointing it at another is how it is changed.
+     */
+    associate(resource: SimWafProtectedResource, webAcl: SimWafWebAcl): void;
+    /**
+     * The web ACL in front of one resource, or nothing when it has none.
+     */
+    webAclFor(resourceArn: string): SimWafWebAcl | undefined;
+    /**
+     * The resources one web ACL is in front of, in the order they were
+     * associated.
+     *
+     * A resource type narrows the answer to the resources of that type, as
+     * `ListResourcesForWebACL` does. Naming none answers with all of them, which
+     * is what `DeleteWebACL` asks for when it refuses a web ACL still in use.
+     */
+    resourceArnsFor(webAcl: SimWafWebAcl, resourceType?: SimWafProtectedResourceType): readonly string[];
+    /**
+     * Whether a web ACL is in front of one resource.
+     */
+    protects(resourceArn: string): boolean;
+    /**
+     * What the web ACL in front of one resource decides about a request.
+     */
+    decide(request: SimWafProtectedRequest): SimWafDecision | undefined;
+    /**
+     * Forget whatever is in front of one resource.
+     *
+     * This is both what DisassociateWebACL does and what deleting the resource
+     * does. A stage that is deleted and created again under the same name is
+     * unprotected, as it is on AWS.
+     */
+    release(resourceArn: string): void;
+}
+//# sourceMappingURL=sim-waf-associations.d.ts.map

package/dist/service/wafv2/association/sim-waf-associations.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"sim-waf-associations.d.ts","sourceRoot":"","sources":["../../../../src/service/wafv2/association/sim-waf-associations.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,iCAAiC,CAAC;AAEtE,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,+BAA+B,CAAC;AAClE,OAAO,KAAK,EACV,uBAAuB,EACvB,2BAA2B,EAC5B,MAAM,iCAAiC,CAAC;AACzC,OAAO,KAAK,EACV,sBAAsB,EACtB,gBAAgB,EACjB,MAAM,yBAAyB,CAAC;AAcjC;;;;;;;GAOG;AACH,qBAAa,kBAAmB,YAAW,gBAAgB;;IAGzD;;;;;OAKG;IACH,SAAS,CAAC,QAAQ,EAAE,uBAAuB,EAAE,MAAM,EAAE,YAAY,GAAG,IAAI,CAKvE;IAED;;OAEG;IACH,SAAS,CAAC,WAAW,EAAE,MAAM,GAAG,YAAY,GAAG,SAAS,CAEvD;IAED;;;;;;;OAOG;IACH,eAAe,CACb,MAAM,EAAE,YAAY,EACpB,YAAY,CAAC,EAAE,2BAA2B,GACzC,SAAS,MAAM,EAAE,CAWnB;IAED;;OAEG;IACH,QAAQ,CAAC,WAAW,EAAE,MAAM,GAAG,OAAO,CAErC;IAED;;OAEG;IACH,MAAM,CAAC,OAAO,EAAE,sBAAsB,GAAG,cAAc,GAAG,SAAS,CAUlE;IAED;;;;;;OAMG;IACH,OAAO,CAAC,WAAW,EAAE,MAAM,GAAG,IAAI,CAEjC;CACF"}

package/dist/service/wafv2/association/sim-waf-associations.js

@@ -0,0 +1,74 @@
+import { simWafInspectedRequest } from "../evaluate/sim-waf-inspected-request.js";
+/**
+ * The web ACLs one Account and Region has in front of things.
+ *
+ * A resource carries at most one web ACL, which is why this is keyed by
+ * resource ARN. The web ACL itself is held rather than its ARN, so a request
+ * reaching a protected resource is evaluated without a second lookup, and so a
+ * web ACL cannot be deleted out from under a resource still pointing at it.
+ */
+export class SimWafAssociations {
+    #associations = new Map();
+    /**
+     * Put a web ACL in front of one resource, replacing whatever was there.
+     *
+     * AssociateWebACL overwrites rather than refusing, because a resource has
+     * one web ACL and pointing it at another is how it is changed.
+     */
+    associate(resource, webAcl) {
+        this.#associations.set(resource.arn, {
+            webAcl,
+            resourceType: resource.resourceType,
+        });
+    }
+    /**
+     * The web ACL in front of one resource, or nothing when it has none.
+     */
+    webAclFor(resourceArn) {
+        return this.#associations.get(resourceArn)?.webAcl;
+    }
+    /**
+     * The resources one web ACL is in front of, in the order they were
+     * associated.
+     *
+     * A resource type narrows the answer to the resources of that type, as
+     * `ListResourcesForWebACL` does. Naming none answers with all of them, which
+     * is what `DeleteWebACL` asks for when it refuses a web ACL still in use.
+     */
+    resourceArnsFor(webAcl, resourceType) {
+        return this.#associations
+            .entries()
+            .filter(([, association]) => association.webAcl === webAcl)
+            .filter(([, association]) => resourceType === undefined ||
+            association.resourceType === resourceType)
+            .map(([resourceArn]) => resourceArn)
+            .toArray();
+    }
+    /**
+     * Whether a web ACL is in front of one resource.
+     */
+    protects(resourceArn) {
+        return this.#associations.has(resourceArn);
+    }
+    /**
+     * What the web ACL in front of one resource decides about a request.
+     */
+    decide(request) {
+        const association = this.#associations.get(request.resourceArn);
+        if (association === undefined) {
+            return undefined;
+        }
+        return association.webAcl.evaluate(simWafInspectedRequest(request.request, request.body));
+    }
+    /**
+     * Forget whatever is in front of one resource.
+     *
+     * This is both what DisassociateWebACL does and what deleting the resource
+     * does. A stage that is deleted and created again under the same name is
+     * unprotected, as it is on AWS.
+     */
+    release(resourceArn) {
+        this.#associations.delete(resourceArn);
+    }
+}
+//# sourceMappingURL=sim-waf-associations.js.map

package/dist/service/wafv2/association/sim-waf-associations.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"sim-waf-associations.js","sourceRoot":"","sources":["../../../../src/service/wafv2/association/sim-waf-associations.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,sBAAsB,EAAE,MAAM,0CAA0C,CAAC;AAuBlF;;;;;;;GAOG;AACH,MAAM,OAAO,kBAAkB;IACpB,aAAa,GAAG,IAAI,GAAG,EAA6B,CAAC;IAE9D;;;;;OAKG;IACH,SAAS,CAAC,QAAiC,EAAE,MAAoB;QAC/D,IAAI,CAAC,aAAa,CAAC,GAAG,CAAC,QAAQ,CAAC,GAAG,EAAE;YACnC,MAAM;YACN,YAAY,EAAE,QAAQ,CAAC,YAAY;SACpC,CAAC,CAAC;IACL,CAAC;IAED;;OAEG;IACH,SAAS,CAAC,WAAmB;QAC3B,OAAO,IAAI,CAAC,aAAa,CAAC,GAAG,CAAC,WAAW,CAAC,EAAE,MAAM,CAAC;IACrD,CAAC;IAED;;;;;;;OAOG;IACH,eAAe,CACb,MAAoB,EACpB,YAA0C;QAE1C,OAAO,IAAI,CAAC,aAAa;aACtB,OAAO,EAAE;aACT,MAAM,CAAC,CAAC,CAAC,EAAE,WAAW,CAAC,EAAE,EAAE,CAAC,WAAW,CAAC,MAAM,KAAK,MAAM,CAAC;aAC1D,MAAM,CACL,CAAC,CAAC,EAAE,WAAW,CAAC,EAAE,EAAE,CAClB,YAAY,KAAK,SAAS;YAC1B,WAAW,CAAC,YAAY,KAAK,YAAY,CAC5C;aACA,GAAG,CAAC,CAAC,CAAC,WAAW,CAAC,EAAE,EAAE,CAAC,WAAW,CAAC;aACnC,OAAO,EAAE,CAAC;IACf,CAAC;IAED;;OAEG;IACH,QAAQ,CAAC,WAAmB;QAC1B,OAAO,IAAI,CAAC,aAAa,CAAC,GAAG,CAAC,WAAW,CAAC,CAAC;IAC7C,CAAC;IAED;;OAEG;IACH,MAAM,CAAC,OAA+B;QACpC,MAAM,WAAW,GAAG,IAAI,CAAC,aAAa,CAAC,GAAG,CAAC,OAAO,CAAC,WAAW,CAAC,CAAC;QAEhE,IAAI,WAAW,KAAK,SAAS,EAAE,CAAC;YAC9B,OAAO,SAAS,CAAC;QACnB,CAAC;QAED,OAAO,WAAW,CAAC,MAAM,CAAC,QAAQ,CAChC,sBAAsB,CAAC,OAAO,CAAC,OAAO,EAAE,OAAO,CAAC,IAAI,CAAC,CACtD,CAAC;IACJ,CAAC;IAED;;;;;;OAMG;IACH,OAAO,CAAC,WAAmB;QACzB,IAAI,CAAC,aAAa,CAAC,MAAM,CAAC,WAAW,CAAC,CAAC;IACzC,CAAC;CACF"}

package/dist/service/wafv2/association/sim-waf-protected-resource.d.ts

@@ -0,0 +1,38 @@
+import { SimWafRestApiStage } from "./sim-waf-rest-api-stage.js";
+import { SimWafUserPool } from "./sim-waf-user-pool.js";
+/**
+ * A resource a `REGIONAL` web ACL can be put in front of.
+ *
+ * Two types are simulated. A third one joins this union and the reader below
+ * gains a branch for it, and everything that holds an association goes on
+ * addressing a resource by its ARN.
+ */
+export type SimWafProtectedResource = SimWafRestApiStage | SimWafUserPool;
+/**
+ * The type ListResourcesForWebACL lists one simulated resource under.
+ */
+export type SimWafProtectedResourceType = SimWafProtectedResource["resourceType"];
+/**
+ * The type ListResourcesForWebACL lists a simulated REST API stage under.
+ */
+export declare const simWafApiGatewayResourceType = "API_GATEWAY";
+/**
+ * The type ListResourcesForWebACL lists a simulated user pool under.
+ */
+export declare const simWafUserPoolResourceType = "COGNITO_USER_POOL";
+/**
+ * The resource types this simulation holds, as a refusal names them.
+ */
+export declare const simWafProtectedResourceTypes: readonly SimWafProtectedResourceType[];
+/**
+ * Read the resource an association names, refusing anything a web ACL cannot
+ * be put in front of here.
+ *
+ * The three refusals mean different things. An HTTP API stage is refused
+ * because AWS WAF protects no HTTP API, so an association accepted here would
+ * let a test cover protection AWS never applies. A load balancer and the rest
+ * are resource types AWS does protect and this simulation does not, which is
+ * the ordinary unsimulated refusal. Anything else is not a resource ARN.
+ */
+export declare function simWafProtectedResource(arn: string): SimWafProtectedResource;
+//# sourceMappingURL=sim-waf-protected-resource.d.ts.map

package/dist/service/wafv2/association/sim-waf-protected-resource.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"sim-waf-protected-resource.d.ts","sourceRoot":"","sources":["../../../../src/service/wafv2/association/sim-waf-protected-resource.ts"],"names":[],"mappings":"AAIA,OAAO,EAAE,kBAAkB,EAAE,MAAM,6BAA6B,CAAC;AACjE,OAAO,EAAE,cAAc,EAAE,MAAM,wBAAwB,CAAC;AAExD;;;;;;GAMG;AACH,MAAM,MAAM,uBAAuB,GAAG,kBAAkB,GAAG,cAAc,CAAC;AAE1E;;GAEG;AACH,MAAM,MAAM,2BAA2B,GACrC,uBAAuB,CAAC,cAAc,CAAC,CAAC;AAE1C;;GAEG;AACH,eAAO,MAAM,4BAA4B,gBAAgB,CAAC;AAE1D;;GAEG;AACH,eAAO,MAAM,0BAA0B,sBAAsB,CAAC;AAE9D;;GAEG;AACH,eAAO,MAAM,4BAA4B,EAAE,SAAS,2BAA2B,EACnB,CAAC;AAuB7D;;;;;;;;;GASG;AACH,wBAAgB,uBAAuB,CAAC,GAAG,EAAE,MAAM,GAAG,uBAAuB,CA4B5E"}

package/dist/service/wafv2/association/sim-waf-protected-resource.js

@@ -0,0 +1,100 @@
+import { SimWafInvalidParameterException, SimWafUnsimulatedInputException, } from "../error/sim-wafv2.error.js";
+import { SimWafRestApiStage } from "./sim-waf-rest-api-stage.js";
+import { SimWafUserPool } from "./sim-waf-user-pool.js";
+/**
+ * The type ListResourcesForWebACL lists a simulated REST API stage under.
+ */
+export const simWafApiGatewayResourceType = "API_GATEWAY";
+/**
+ * The type ListResourcesForWebACL lists a simulated user pool under.
+ */
+export const simWafUserPoolResourceType = "COGNITO_USER_POOL";
+/**
+ * The resource types this simulation holds, as a refusal names them.
+ */
+export const simWafProtectedResourceTypes = [simWafApiGatewayResourceType, simWafUserPoolResourceType];
+const restApiStagePattern = /^arn:aws:apigateway:(?<regionName>[^:]+)::\/restapis\/(?<restApiId>[^/]+)\/stages\/(?<stageName>[^/]+)$/u;
+const httpApiStagePattern = /^arn:aws:apigateway:[^:]+::\/apis\/[^/]+\/stages\/[^/]+$/u;
+const userPoolPattern = /^arn:aws:cognito-idp:(?<regionName>[^:]+):(?<accountId>[^:]+):userpool\/(?<userPoolId>[^/]+)$/u;
+/**
+ * The resource types real WAF protects that this simulation does not, by the
+ * service in their ARN.
+ */
+const unsimulatedResources = new Map([
+    ["elasticloadbalancing", "an Application Load Balancer"],
+    ["appsync", "an AppSync GraphQL API"],
+    ["apprunner", "an App Runner service"],
+    ["amplify", "an Amplify app"],
+    ["ec2", "a Verified Access instance"],
+]);
+/**
+ * Read the resource an association names, refusing anything a web ACL cannot
+ * be put in front of here.
+ *
+ * The three refusals mean different things. An HTTP API stage is refused
+ * because AWS WAF protects no HTTP API, so an association accepted here would
+ * let a test cover protection AWS never applies. A load balancer and the rest
+ * are resource types AWS does protect and this simulation does not, which is
+ * the ordinary unsimulated refusal. Anything else is not a resource ARN.
+ */
+export function simWafProtectedResource(arn) {
+    const stage = restApiStage(arn);
+    if (stage !== undefined) {
+        return stage;
+    }
+    const userPool = simWafUserPool(arn);
+    if (userPool !== undefined) {
+        return userPool;
+    }
+    if (httpApiStagePattern.test(arn)) {
+        throw new SimWafInvalidParameterException(`AWS WAF does not protect an API Gateway HTTP API. The resource types ` +
+            `it protects cover a REST API stage and not an HTTP API stage, so ` +
+            `${arn} cannot be associated with a web ACL.`);
+    }
+    refuseUnsimulatedResource(arn);
+    throw new SimWafInvalidParameterException(`Error reason: The ARN isn't valid. A valid ARN begins with arn: and ` +
+        `includes other information separated by colons or slashes., ` +
+        `field: RESOURCE_ARN, parameter: ${arn}`);
+}
+/**
+ * The REST API stage an ARN names, or nothing when it names no stage.
+ */
+function restApiStage(arn) {
+    const { groups } = restApiStagePattern.exec(arn) ?? {};
+    if (groups === undefined) {
+        return undefined;
+    }
+    return new SimWafRestApiStage({
+        arn,
+        regionName: groups["regionName"] ?? "",
+        restApiId: groups["restApiId"] ?? "",
+        stageName: groups["stageName"] ?? "",
+    });
+}
+/**
+ * The user pool an ARN names, or nothing when it names no pool.
+ */
+function simWafUserPool(arn) {
+    const { groups } = userPoolPattern.exec(arn) ?? {};
+    if (groups === undefined) {
+        return undefined;
+    }
+    return new SimWafUserPool({
+        arn,
+        regionName: groups["regionName"] ?? "",
+        accountId: groups["accountId"] ?? "",
+        userPoolId: groups["userPoolId"] ?? "",
+    });
+}
+/**
+ * Refuse an ARN naming a resource type AWS WAF protects and Yulin does not.
+ */
+function refuseUnsimulatedResource(arn) {
+    const described = unsimulatedResources.get(arn.split(":", 3)[2] ?? "");
+    if (described !== undefined) {
+        throw new SimWafUnsimulatedInputException(`AWS WAF protects ${described}, and Yulin does not simulate a web ACL ` +
+            `in front of one, so ${arn} is refused rather than protected by ` +
+            `nothing.`);
+    }
+}
+//# sourceMappingURL=sim-waf-protected-resource.js.map

package/dist/service/wafv2/association/sim-waf-protected-resource.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"sim-waf-protected-resource.js","sourceRoot":"","sources":["../../../../src/service/wafv2/association/sim-waf-protected-resource.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,+BAA+B,EAC/B,+BAA+B,GAChC,MAAM,6BAA6B,CAAC;AACrC,OAAO,EAAE,kBAAkB,EAAE,MAAM,6BAA6B,CAAC;AACjE,OAAO,EAAE,cAAc,EAAE,MAAM,wBAAwB,CAAC;AAiBxD;;GAEG;AACH,MAAM,CAAC,MAAM,4BAA4B,GAAG,aAAa,CAAC;AAE1D;;GAEG;AACH,MAAM,CAAC,MAAM,0BAA0B,GAAG,mBAAmB,CAAC;AAE9D;;GAEG;AACH,MAAM,CAAC,MAAM,4BAA4B,GACvC,CAAC,4BAA4B,EAAE,0BAA0B,CAAC,CAAC;AAE7D,MAAM,mBAAmB,GACvB,0GAA0G,CAAC;AAE7G,MAAM,mBAAmB,GACvB,2DAA2D,CAAC;AAE9D,MAAM,eAAe,GACnB,gGAAgG,CAAC;AAEnG;;;GAGG;AACH,MAAM,oBAAoB,GAAG,IAAI,GAAG,CAAiB;IACnD,CAAC,sBAAsB,EAAE,8BAA8B,CAAC;IACxD,CAAC,SAAS,EAAE,wBAAwB,CAAC;IACrC,CAAC,WAAW,EAAE,uBAAuB,CAAC;IACtC,CAAC,SAAS,EAAE,gBAAgB,CAAC;IAC7B,CAAC,KAAK,EAAE,4BAA4B,CAAC;CACtC,CAAC,CAAC;AAEH;;;;;;;;;GASG;AACH,MAAM,UAAU,uBAAuB,CAAC,GAAW;IACjD,MAAM,KAAK,GAAG,YAAY,CAAC,GAAG,CAAC,CAAC;IAEhC,IAAI,KAAK,KAAK,SAAS,EAAE,CAAC;QACxB,OAAO,KAAK,CAAC;IACf,CAAC;IAED,MAAM,QAAQ,GAAG,cAAc,CAAC,GAAG,CAAC,CAAC;IAErC,IAAI,QAAQ,KAAK,SAAS,EAAE,CAAC;QAC3B,OAAO,QAAQ,CAAC;IAClB,CAAC;IAED,IAAI,mBAAmB,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC;QAClC,MAAM,IAAI,+BAA+B,CACvC,uEAAuE;YACrE,mEAAmE;YACnE,GAAG,GAAG,uCAAuC,CAChD,CAAC;IACJ,CAAC;IAED,yBAAyB,CAAC,GAAG,CAAC,CAAC;IAE/B,MAAM,IAAI,+BAA+B,CACvC,sEAAsE;QACpE,8DAA8D;QAC9D,mCAAmC,GAAG,EAAE,CAC3C,CAAC;AACJ,CAAC;AAED;;GAEG;AACH,SAAS,YAAY,CAAC,GAAW;IAC/B,MAAM,EAAE,MAAM,EAAE,GAAG,mBAAmB,CAAC,IAAI,CAAC,GAAG,CAAC,IAAI,EAAE,CAAC;IAEvD,IAAI,MAAM,KAAK,SAAS,EAAE,CAAC;QACzB,OAAO,SAAS,CAAC;IACnB,CAAC;IAED,OAAO,IAAI,kBAAkB,CAAC;QAC5B,GAAG;QACH,UAAU,EAAE,MAAM,CAAC,YAAY,CAAC,IAAI,EAAE;QACtC,SAAS,EAAE,MAAM,CAAC,WAAW,CAAC,IAAI,EAAE;QACpC,SAAS,EAAE,MAAM,CAAC,WAAW,CAAC,IAAI,EAAE;KACrC,CAAC,CAAC;AACL,CAAC;AAED;;GAEG;AACH,SAAS,cAAc,CAAC,GAAW;IACjC,MAAM,EAAE,MAAM,EAAE,GAAG,eAAe,CAAC,IAAI,CAAC,GAAG,CAAC,IAAI,EAAE,CAAC;IAEnD,IAAI,MAAM,KAAK,SAAS,EAAE,CAAC;QACzB,OAAO,SAAS,CAAC;IACnB,CAAC;IAED,OAAO,IAAI,cAAc,CAAC;QACxB,GAAG;QACH,UAAU,EAAE,MAAM,CAAC,YAAY,CAAC,IAAI,EAAE;QACtC,SAAS,EAAE,MAAM,CAAC,WAAW,CAAC,IAAI,EAAE;QACpC,UAAU,EAAE,MAAM,CAAC,YAAY,CAAC,IAAI,EAAE;KACvC,CAAC,CAAC;AACL,CAAC;AAED;;GAEG;AACH,SAAS,yBAAyB,CAAC,GAAW;IAC5C,MAAM,SAAS,GAAG,oBAAoB,CAAC,GAAG,CAAC,GAAG,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC;IAEvE,IAAI,SAAS,KAAK,SAAS,EAAE,CAAC;QAC5B,MAAM,IAAI,+BAA+B,CACvC,oBAAoB,SAAS,0CAA0C;YACrE,uBAAuB,GAAG,uCAAuC;YACjE,UAAU,CACb,CAAC;IACJ,CAAC;AACH,CAAC"}

package/dist/service/wafv2/association/sim-waf-protected-resources.d.ts

@@ -0,0 +1,29 @@
+import type { SimWafProtectedResource } from "./sim-waf-protected-resource.js";
+/**
+ * The resources of one Account and Region a web ACL can be put in front of.
+ *
+ * An association names a resource that has to be there. WAFv2 holds no API
+ * Gateway state of its own, so this is how it asks whichever service owns the
+ * resource whether the ARN names anything.
+ */
+export interface SimWafProtectedResources {
+    /**
+     * Whether this simulation holds the resource an ARN names.
+     */
+    has(resource: SimWafProtectedResource): boolean;
+}
+/**
+ * The resources available to a WAFv2 with nothing around it to ask.
+ *
+ * Every ARN resolves to nothing, so a standalone simulated WAFv2 associates a
+ * web ACL with nothing at all. That is the safe answer: an association held
+ * against a resource no request will ever reach protects nothing, and saying
+ * so is better than reporting a web ACL in front of something imaginary.
+ */
+export declare class SimWafNoProtectedResources implements SimWafProtectedResources {
+    /**
+     * No resource is reachable here.
+     */
+    has(): boolean;
+}
+//# sourceMappingURL=sim-waf-protected-resources.d.ts.map

package/dist/service/wafv2/association/sim-waf-protected-resources.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"sim-waf-protected-resources.d.ts","sourceRoot":"","sources":["../../../../src/service/wafv2/association/sim-waf-protected-resources.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,uBAAuB,EAAE,MAAM,iCAAiC,CAAC;AAE/E;;;;;;GAMG;AACH,MAAM,WAAW,wBAAwB;IACvC;;OAEG;IACH,GAAG,CAAC,QAAQ,EAAE,uBAAuB,GAAG,OAAO,CAAC;CACjD;AAED;;;;;;;GAOG;AACH,qBAAa,0BAA2B,YAAW,wBAAwB;IACzE;;OAEG;IACH,GAAG,IAAI,OAAO,CAEb;CACF"}

package/dist/service/wafv2/association/sim-waf-protected-resources.js

@@ -0,0 +1,17 @@
+/**
+ * The resources available to a WAFv2 with nothing around it to ask.
+ *
+ * Every ARN resolves to nothing, so a standalone simulated WAFv2 associates a
+ * web ACL with nothing at all. That is the safe answer: an association held
+ * against a resource no request will ever reach protects nothing, and saying
+ * so is better than reporting a web ACL in front of something imaginary.
+ */
+export class SimWafNoProtectedResources {
+    /**
+     * No resource is reachable here.
+     */
+    has() {
+        return false;
+    }
+}
+//# sourceMappingURL=sim-waf-protected-resources.js.map