@kensio/yulin 1.21.22 → 1.21.24

package/dist/service/athena/engine/sim-athena-ast-nodes.d.ts

@@ -18,6 +18,17 @@ export interface SimAthenaFromItem extends SimAthenaAstNode {
     table: string;
     as?: string | null;
 }
+/** One value as a node, or nothing where it is not an object. */
+export declare function asAstNode(value: unknown): SimAthenaAstNode | undefined;
+/**
+ * The name a call carries, where the statement wrote it as one part.
+ *
+ * The parser holds a name as a list, one entry per piece of a qualified name,
+ * and it holds an `UNNEST` alias as a call of its own. A name written in more
+ * than one part answers with nothing, since neither the engine's functions nor
+ * an alias is reached that way.
+ */
+export declare function simAthenaCalledName(node: SimAthenaAstNode | undefined): string | undefined;
 /** Every node in the tree, the outermost first. */
 export declare function simAthenaAstNodes(root: unknown): Generator<SimAthenaAstNode>;
 /** Whether this node references a column. */

package/dist/service/athena/engine/sim-athena-ast-nodes.js

@@ -1,3 +1,25 @@
+/** One value as a node, or nothing where it is not an object. */
+export function asAstNode(value) {
+    return typeof value === "object" && value !== null
+        ? value
+        : undefined;
+}
+/**
+ * The name a call carries, where the statement wrote it as one part.
+ *
+ * The parser holds a name as a list, one entry per piece of a qualified name,
+ * and it holds an `UNNEST` alias as a call of its own. A name written in more
+ * than one part answers with nothing, since neither the engine's functions nor
+ * an alias is reached that way.
+ */
+export function simAthenaCalledName(node) {
+    const parts = asAstNode(node?.["name"])?.["name"];
+    const first = Array.isArray(parts) && parts.length === 1
+        ? asAstNode(parts[0])
+        : undefined;
+    const name = first?.["value"];
+    return typeof name === "string" ? name : undefined;
+}
 /** Every node in the tree, the outermost first. */
 export function* simAthenaAstNodes(root) {
     if (Array.isArray(root)) {

package/dist/service/athena/engine/sim-athena-string-shims.js

@@ -1,4 +1,5 @@
-import { shimNumber, shimText, simAthenaScalarShim, } from "./sim-athena-shim-registry.js";
+import { SimAthenaSetUpError } from "../error/sim-athena.error.js";
+import { isExplicitNull, shimNumber, shimText, simAthenaScalarShim, } from "./sim-athena-shim-registry.js";
 /**
  * Trino's string functions.
  *
@@ -8,9 +9,36 @@ import { shimNumber, shimText, simAthenaScalarShim, } from "./sim-athena-shim-re
  * with something that works less well.
  */
 export function simAthenaInstallStringShims(database) {
+    simAthenaScalarShim(database, "split", (...values) => isExplicitNull(values, 2)
+        ? null
+        : split(shimText(values.at(0)), shimText(values.at(1)), shimNumber(values.at(2))));
     simAthenaScalarShim(database, "split_part", (value, delimiter, index) => splitPart(shimText(value), shimText(delimiter), shimNumber(index)));
     simAthenaScalarShim(database, "strpos", (value, search) => position(shimText(value), shimText(search)));
 }
+/**
+ * One value cut into an array, written as the JSON text an array is held as.
+ *
+ * Trino answers with one empty element over an empty value, and refuses an
+ * empty delimiter rather than answering a character at a time. A limit caps
+ * how many elements come back and leaves the rest of the value in the last of
+ * them.
+ */
+function split(value, delimiter, limit) {
+    if (value === undefined || delimiter === undefined) {
+        return null;
+    }
+    if (delimiter === "" || (limit !== undefined && limit < 1)) {
+        throw new SimAthenaSetUpError("split takes a delimiter of at least one character and a limit from one");
+    }
+    const parts = value.split(delimiter);
+    if (limit === undefined || parts.length <= limit) {
+        return JSON.stringify(parts);
+    }
+    return JSON.stringify([
+        ...parts.slice(0, limit - 1),
+        parts.slice(limit - 1).join(delimiter),
+    ]);
+}
 /** Trino counts the fields from one, and has no field below that. */
 function splitPart(value, delimiter, index) {
     if (value === undefined || delimiter === undefined || index === undefined) {

package/dist/service/athena/engine/sim-athena-unnest-item.js

@@ -1,4 +1,4 @@
-import { simAthenaAstNodes, } from "./sim-athena-ast-nodes.js";
+import { asAstNode, simAthenaAstNodes, simAthenaCalledName, } from "./sim-athena-ast-nodes.js";
 /**
  * The `UNNEST` a statement flattens an array or a map with.
  *
@@ -19,8 +19,8 @@ export function simAthenaUnnestItem(ast) {
     }
     const alias = aliasOf(item);
     const columns = aliasColumns(item);
-    const source = item["expr"];
-    if (alias === undefined || columns === undefined || !isNode(source)) {
+    const source = asAstNode(item["expr"]);
+    if (alias === undefined || columns === undefined || source === undefined) {
         return { kind: "unreadable" };
     }
     return { kind: "found", item, alias, columns, source };
@@ -38,25 +38,16 @@ function isCrossJoined(item) {
 }
 /** The alias name, which the parser holds as a function's name. */
 function aliasOf(item) {
-    const parts = asNode(asNode(item["as"])?.["name"])?.["name"];
-    const first = Array.isArray(parts) ? asNode(parts[0]) : undefined;
-    const value = first?.["value"];
-    return typeof value === "string" ? value : undefined;
+    return simAthenaCalledName(asAstNode(item["as"]));
 }
 /** The names inside the alias, which the parser holds as a function's arguments. */
 function aliasColumns(item) {
-    const values = asNode(asNode(item["as"])?.["args"])?.["value"];
+    const values = asAstNode(asAstNode(item["as"])?.["args"])?.["value"];
     if (!Array.isArray(values) || values.length === 0) {
         return undefined;
     }
-    const columns = values.map((value) => asNode(value)?.["column"]);
+    const columns = values.map((value) => asAstNode(value)?.["column"]);
     return columns.every((column) => typeof column === "string")
         ? columns
         : undefined;
 }
-function isNode(value) {
-    return typeof value === "object" && value !== null;
-}
-function asNode(value) {
-    return isNode(value) ? value : undefined;
-}

package/dist/service/athena/engine/sim-athena-unnest-rewrite.d.ts

@@ -7,10 +7,10 @@ interface SimAthenaUnnestRewriteRequest {
 /**
  * Turn an `UNNEST` into the `json_each` SQLite flattens JSON with.
  *
- * An array or a map column is held as its JSON text, and `json_each` reads that
- * as one row per element with a `key` and a `value`. The `FROM` entry becomes a
- * call to it and every reference to the alias is pointed at the column it
- * answers with.
+ * An array or a map column is held as its JSON text, as is what a function like
+ * `split` answers, and `json_each` reads that as one row per element with a
+ * `key` and a `value`. The `FROM` entry becomes a call to it and every
+ * reference to the alias is pointed at the column it answers with.
  *
  * Answers with whether the statement can run. A statement carrying no `UNNEST`
  * runs untouched, and one carrying an `UNNEST` this cannot turn into

package/dist/service/athena/engine/sim-athena-unnest-rewrite.js

@@ -6,10 +6,10 @@ import { simAthenaUnnestTargets } from "./sim-athena-unnest-targets.js";
 /**
  * Turn an `UNNEST` into the `json_each` SQLite flattens JSON with.
  *
- * An array or a map column is held as its JSON text, and `json_each` reads that
- * as one row per element with a `key` and a `value`. The `FROM` entry becomes a
- * call to it and every reference to the alias is pointed at the column it
- * answers with.
+ * An array or a map column is held as its JSON text, as is what a function like
+ * `split` answers, and `json_each` reads that as one row per element with a
+ * `key` and a `value`. The `FROM` entry becomes a call to it and every
+ * reference to the alias is pointed at the column it answers with.
  *
  * Answers with whether the statement can run. A statement carrying no `UNNEST`
  * runs untouched, and one carrying an `UNNEST` this cannot turn into

package/dist/service/athena/engine/sim-athena-unnest-source.d.ts

@@ -3,17 +3,18 @@ import { type SimAthenaAstNode } from "./sim-athena-ast-nodes.js";
 /** The two things Athena flattens with `UNNEST`. */
 export type SimAthenaUnnestKind = "array" | "map";
 /**
- * What the statement is flattening, read off the Glue schema.
+ * What the statement is flattening.
  *
- * The catalog is the only thing that says whether a column holds an array, a
- * map or a scalar, and `json_each` answers with different columns for the first
- * two. A column the schema calls anything else answers with nothing here, and
- * the query falls back rather than reading a value as a collection it never
- * was.
+ * A column is read off the Glue schema. The catalog is the only thing that says
+ * whether a column holds an array, a map or a scalar, and `json_each` answers
+ * with different columns for the first two. A column the schema calls anything
+ * else answers with nothing here, and the query falls back rather than reading
+ * a value as a collection it never was.
  *
- * An expression that is not a plain column reference answers with nothing too.
- * `UNNEST(split(x, ','))` is a real Athena query and the schema says nothing
- * about what it comes to.
+ * An expression is read off the function it calls. `UNNEST(split(x, ','))` is
+ * how a statement flattens a delimited string, and nothing but the call says
+ * what it comes to. A call to anything else answers with nothing, since the
+ * flattening would otherwise run over whatever SQLite made of a scalar.
  */
 export declare function simAthenaUnnestKind(source: SimAthenaAstNode, ast: unknown, tables: readonly SimAthenaCatalogTable[]): SimAthenaUnnestKind | undefined;
 /** Every catalog table the statement reads, by the name it reaches each one by. */

package/dist/service/athena/engine/sim-athena-unnest-source.js

@@ -1,20 +1,29 @@
-import { isColumnRef, isFromItem, simAthenaAstNodes, } from "./sim-athena-ast-nodes.js";
+import { isColumnRef, isFromItem, simAthenaAstNodes, simAthenaCalledName, } from "./sim-athena-ast-nodes.js";
 /**
- * What the statement is flattening, read off the Glue schema.
+ * The engine's own functions that answer an array.
  *
- * The catalog is the only thing that says whether a column holds an array, a
- * map or a scalar, and `json_each` answers with different columns for the first
- * two. A column the schema calls anything else answers with nothing here, and
- * the query falls back rather than reading a value as a collection it never
- * was.
+ * An expression has no catalog entry to read, so the call itself is what says
+ * the value is a collection. Each of these answers with the JSON text an array
+ * column is held as, which is what `json_each` reads.
+ */
+const arrayFunctions = new Set(["split", "slice"]);
+/**
+ * What the statement is flattening.
+ *
+ * A column is read off the Glue schema. The catalog is the only thing that says
+ * whether a column holds an array, a map or a scalar, and `json_each` answers
+ * with different columns for the first two. A column the schema calls anything
+ * else answers with nothing here, and the query falls back rather than reading
+ * a value as a collection it never was.
  *
- * An expression that is not a plain column reference answers with nothing too.
- * `UNNEST(split(x, ','))` is a real Athena query and the schema says nothing
- * about what it comes to.
+ * An expression is read off the function it calls. `UNNEST(split(x, ','))` is
+ * how a statement flattens a delimited string, and nothing but the call says
+ * what it comes to. A call to anything else answers with nothing, since the
+ * flattening would otherwise run over whatever SQLite made of a scalar.
  */
 export function simAthenaUnnestKind(source, ast, tables) {
     if (!isColumnRef(source)) {
-        return undefined;
+        return answersArray(source) ? "array" : undefined;
     }
     const declared = declaredType(source, ast, tables);
     if (declared === undefined) {
@@ -26,6 +35,11 @@ export function simAthenaUnnestKind(source, ast, tables) {
     }
     return type.startsWith("map") ? "map" : undefined;
 }
+/** Whether this expression is a call to a function answering an array. */
+function answersArray(source) {
+    const name = source["type"] === "function" ? simAthenaCalledName(source) : undefined;
+    return name !== undefined && arrayFunctions.has(name.toLowerCase());
+}
 /** Every catalog table the statement reads, by the name it reaches each one by. */
 export function simAthenaQueryTables(ast, tables) {
     const byName = new Map();

package/dist/service/athena/sim-athena-flattened-events.fixture.d.ts

@@ -0,0 +1,3 @@
+import { type SimAthenaEngineSimulation } from "./sim-athena-engine.fixture.js";
+/** A simulation holding the events, with the engine on. */
+export declare function anEventSimulation(): Promise<SimAthenaEngineSimulation>;

package/dist/service/athena/sim-athena-flattened-events.fixture.js

@@ -0,0 +1,46 @@
+import { aCatalogTable, anEngineSimulation, aSeededJson, } from "./sim-athena-engine.fixture.js";
+/**
+ * The events a flattening query reads.
+ *
+ * Each holds a collection of every shape an `UNNEST` reaches. An array and a
+ * map that are empty, a delimited string that is empty, and a row carrying no
+ * delimited string at all, which is what a flattening answering no rows runs
+ * over.
+ */
+const events = [
+    {
+        id: 1,
+        tags: ["red", "blue"],
+        attrs: { size: "large" },
+        name: "one",
+        packed: "red;blue",
+    },
+    { id: 2, tags: [], attrs: {}, name: "two", packed: "" },
+    {
+        id: 3,
+        tags: ["green"],
+        attrs: { size: "small", colour: "green" },
+        name: "three",
+    },
+];
+/** A simulation holding the events, with the engine on. */
+export async function anEventSimulation() {
+    const simulation = await anEngineSimulation();
+    aCatalogTable(simulation.simAws, {
+        name: "events",
+        columns: [
+            { Name: "id", Type: "int" },
+            { Name: "tags", Type: "array<string>" },
+            { Name: "attrs", Type: "map<string,string>" },
+            { Name: "name", Type: "string" },
+            { Name: "packed", Type: "string" },
+        ],
+    });
+    await aSeededJson(simulation.simAws, "events/part-0.json", events);
+    await simulation.simAws.athena().engine().enable();
+    simulation.simAws
+        .athena()
+        .results()
+        .byDefault({ columns: ["fallback"], rows: [["declared"]] });
+    return simulation;
+}

package/dist/service/wafv2/association/sim-aws-waf-protected-resources.js

@@ -1,3 +1,4 @@
+import { SimWafUnsimulatedResource } from "./sim-waf-unsimulated-resource.js";
 /**
  * The resources of one simulated AWS instance a web ACL can be put in front
  * of.
@@ -19,6 +20,9 @@ export class SimAwsWafProtectedResources {
      * Whether the resource an ARN names is one this scope holds.
      */
     has(resource) {
+        if (resource instanceof SimWafUnsimulatedResource) {
+            return true;
+        }
         if (resource.resourceType === "COGNITO_USER_POOL") {
             return this.hasUserPool(resource);
         }

package/dist/service/wafv2/association/sim-waf-associations.d.ts

@@ -1,4 +1,5 @@
 import type { SimWafDecision } from "../evaluate/sim-waf-decision.js";
+import type { SimWafUnsimulatedPart } from "../resource/sim-waf-unsimulated-part.js";
 import type { SimWafWebAcl } from "../web-acl/sim-waf-web-acl.js";
 import type { SimWafProtectedResource, SimWafProtectedResourceType } from "./sim-waf-protected-resource.js";
 import type { SimWafProtectedRequest, SimWafProtection } from "./sim-waf-protection.js";
@@ -32,6 +33,11 @@ export declare class SimWafAssociations implements SimWafProtection {
      * is what `DeleteWebACL` asks for when it refuses a web ACL still in use.
      */
     resourceArnsFor(webAcl: SimWafWebAcl, resourceType?: SimWafProtectedResourceType): readonly string[];
+    /**
+     * The associations of one web ACL that nothing is evaluated through, one
+     * part per resource ARN.
+     */
+    unsimulatedFor(webAcl: SimWafWebAcl): readonly SimWafUnsimulatedPart[];
     /**
      * Whether a web ACL is in front of one resource.
      */

package/dist/service/wafv2/association/sim-waf-associations.js

@@ -1,4 +1,5 @@
 import { simWafInspectedRequest } from "../evaluate/sim-waf-inspected-request.js";
+import { SimWafUnsimulatedResource } from "./sim-waf-unsimulated-resource.js";
 /**
  * The web ACLs one Account and Region has in front of things.
  *
@@ -19,6 +20,9 @@ export class SimWafAssociations {
         this.#associations.set(resource.arn, {
             webAcl,
             resourceType: resource.resourceType,
+            unsimulatedReason: resource instanceof SimWafUnsimulatedResource
+                ? resource.reason
+                : undefined,
         });
     }
     /**
@@ -44,6 +48,19 @@ export class SimWafAssociations {
             .map(([resourceArn]) => resourceArn)
             .toArray();
     }
+    /**
+     * The associations of one web ACL that nothing is evaluated through, one
+     * part per resource ARN.
+     */
+    unsimulatedFor(webAcl) {
+        return this.#associations
+            .entries()
+            .filter(([, association]) => association.webAcl === webAcl)
+            .flatMap(([resourceArn, { unsimulatedReason }]) => unsimulatedReason === undefined
+            ? []
+            : [{ part: `Association.${resourceArn}`, reason: unsimulatedReason }])
+            .toArray();
+    }
     /**
      * Whether a web ACL is in front of one resource.
      */

package/dist/service/wafv2/association/sim-waf-protected-resource.d.ts

@@ -1,13 +1,16 @@
 import { SimWafRestApiStage } from "./sim-waf-rest-api-stage.js";
+import { SimWafUnsimulatedResource } from "./sim-waf-unsimulated-resource.js";
 import { SimWafUserPool } from "./sim-waf-user-pool.js";
 /**
  * A resource a `REGIONAL` web ACL can be put in front of.
  *
- * Two types are simulated. A third one joins this union and the reader below
- * gains a branch for it, and everything that holds an association goes on
+ * Requests reach a web ACL through two types here. The rest are held as
+ * `SimWafUnsimulatedResource`, associated and listed, with nothing evaluated
+ * in front of them. A type that starts serving requests gets a class of its
+ * own in this union, and everything that holds an association goes on
  * addressing a resource by its ARN.
  */
-export type SimWafProtectedResource = SimWafRestApiStage | SimWafUserPool;
+export type SimWafProtectedResource = SimWafRestApiStage | SimWafUserPool | SimWafUnsimulatedResource;
 /**
  * The type ListResourcesForWebACL lists one simulated resource under.
  */
@@ -21,17 +24,19 @@ export declare const simWafApiGatewayResourceType = "API_GATEWAY";
  */
 export declare const simWafUserPoolResourceType = "COGNITO_USER_POOL";
 /**
- * The resource types this simulation holds, as a refusal names them.
+ * The resource types ListResourcesForWebACL lists, which are all the types
+ * an association can hold.
  */
 export declare const simWafProtectedResourceTypes: readonly SimWafProtectedResourceType[];
 /**
  * Read the resource an association names, refusing anything a web ACL cannot
- * be put in front of here.
+ * be put in front of.
  *
  * The three refusals mean different things. An HTTP API stage is refused
  * because AWS WAF protects no HTTP API, so an association accepted here would
- * let a test cover protection AWS never applies. A load balancer and the rest
- * are resource types AWS does protect and this simulation does not, which is
- * the ordinary unsimulated refusal. Anything else is not a resource ARN.
+ * let a test cover protection AWS never applies. An Amplify app takes a
+ * `CLOUDFRONT` web ACL from `us-east-1` for an app in any Region, and a WAFv2
+ * here reaches web ACLs in its own Region only. Anything else is not a
+ * resource ARN.
  */
 export declare function simWafProtectedResource(arn: string): SimWafProtectedResource;

package/dist/service/wafv2/association/sim-waf-protected-resource.js

@@ -1,5 +1,6 @@
 import { SimWafInvalidParameterException, SimWafUnsimulatedInputException, } from "../error/sim-wafv2.error.js";
 import { SimWafRestApiStage } from "./sim-waf-rest-api-stage.js";
+import { SimWafUnsimulatedResource, simWafUnsimulatedResourceTypes, } from "./sim-waf-unsimulated-resource.js";
 import { SimWafUserPool } from "./sim-waf-user-pool.js";
 /**
  * The type ListResourcesForWebACL lists a simulated REST API stage under.
@@ -10,32 +11,28 @@ export const simWafApiGatewayResourceType = "API_GATEWAY";
  */
 export const simWafUserPoolResourceType = "COGNITO_USER_POOL";
 /**
- * The resource types this simulation holds, as a refusal names them.
+ * The resource types ListResourcesForWebACL lists, which are all the types
+ * an association can hold.
  */
-export const simWafProtectedResourceTypes = [simWafApiGatewayResourceType, simWafUserPoolResourceType];
+export const simWafProtectedResourceTypes = [
+    simWafApiGatewayResourceType,
+    simWafUserPoolResourceType,
+    ...simWafUnsimulatedResourceTypes,
+];
 const restApiStagePattern = /^arn:aws:apigateway:(?<regionName>[^:]+)::\/restapis\/(?<restApiId>[^/]+)\/stages\/(?<stageName>[^/]+)$/u;
 const httpApiStagePattern = /^arn:aws:apigateway:[^:]+::\/apis\/[^/]+\/stages\/[^/]+$/u;
 const userPoolPattern = /^arn:aws:cognito-idp:(?<regionName>[^:]+):(?<accountId>[^:]+):userpool\/(?<userPoolId>[^/]+)$/u;
-/**
- * The resource types real WAF protects that this simulation does not, by the
- * service in their ARN.
- */
-const unsimulatedResources = new Map([
-    ["elasticloadbalancing", "an Application Load Balancer"],
-    ["appsync", "an AppSync GraphQL API"],
-    ["apprunner", "an App Runner service"],
-    ["amplify", "an Amplify app"],
-    ["ec2", "a Verified Access instance"],
-]);
+const amplifyAppPattern = /^arn:aws:amplify:[^:]+:[^:]+:apps\/[^/]+$/u;
 /**
  * Read the resource an association names, refusing anything a web ACL cannot
- * be put in front of here.
+ * be put in front of.
  *
  * The three refusals mean different things. An HTTP API stage is refused
  * because AWS WAF protects no HTTP API, so an association accepted here would
- * let a test cover protection AWS never applies. A load balancer and the rest
- * are resource types AWS does protect and this simulation does not, which is
- * the ordinary unsimulated refusal. Anything else is not a resource ARN.
+ * let a test cover protection AWS never applies. An Amplify app takes a
+ * `CLOUDFRONT` web ACL from `us-east-1` for an app in any Region, and a WAFv2
+ * here reaches web ACLs in its own Region only. Anything else is not a
+ * resource ARN.
  */
 export function simWafProtectedResource(arn) {
     const stage = restApiStage(arn);
@@ -46,6 +43,10 @@ export function simWafProtectedResource(arn) {
     if (userPool !== undefined) {
         return userPool;
     }
+    const unsimulated = SimWafUnsimulatedResource.read(arn);
+    if (unsimulated !== undefined) {
+        return unsimulated;
+    }
     if (httpApiStagePattern.test(arn)) {
         throw new SimWafInvalidParameterException(`AWS WAF does not protect an API Gateway HTTP API. The resource types ` +
             `it protects cover a REST API stage and not an HTTP API stage, so ` +
@@ -87,13 +88,12 @@ function simWafUserPool(arn) {
     });
 }
 /**
- * Refuse an ARN naming a resource type AWS WAF protects and Yulin does not.
+ * Refuse an Amplify app, whose web ACL is out of this WAFv2's reach.
  */
 function refuseUnsimulatedResource(arn) {
-    const described = unsimulatedResources.get(arn.split(":", 3)[2] ?? "");
-    if (described !== undefined) {
-        throw new SimWafUnsimulatedInputException(`AWS WAF protects ${described}, and Yulin does not simulate a web ACL ` +
-            `in front of one, so ${arn} is refused rather than protected by ` +
-            `nothing.`);
+    if (amplifyAppPattern.test(arn)) {
+        throw new SimWafUnsimulatedInputException(`AWS WAF protects an Amplify app with a CLOUDFRONT web ACL held in ` +
+            `us-east-1, and a simulated WAFv2 associates web ACLs of its own ` +
+            `Region only, so ${arn} is refused.`);
     }
 }

package/dist/service/wafv2/association/sim-waf-protected-resources.d.ts

@@ -9,20 +9,25 @@ import type { SimWafProtectedResource } from "./sim-waf-protected-resource.js";
 export interface SimWafProtectedResources {
     /**
      * Whether this simulation holds the resource an ARN names.
+     *
+     * A `SimWafUnsimulatedResource` is held by no simulated service, so there is
+     * nothing to look for, and it is taken as named.
      */
     has(resource: SimWafProtectedResource): boolean;
 }
 /**
  * The resources available to a WAFv2 with nothing around it to ask.
  *
- * Every ARN resolves to nothing, so a standalone simulated WAFv2 associates a
- * web ACL with nothing at all. That is the safe answer: an association held
- * against a resource no request will ever reach protects nothing, and saying
- * so is better than reporting a web ACL in front of something imaginary.
+ * Every simulated resource ARN resolves to nothing, so a standalone simulated
+ * WAFv2 associates a web ACL with no stage or pool. That is the safe answer:
+ * an association held against a resource no request will ever reach protects
+ * nothing, and saying so is better than reporting a web ACL in front of
+ * something imaginary. A `SimWafUnsimulatedResource` is taken as named here
+ * as everywhere else.
  */
 export declare class SimWafNoProtectedResources implements SimWafProtectedResources {
     /**
-     * No resource is reachable here.
+     * Whether the resource is one no simulated service holds.
      */
-    has(): boolean;
+    has(resource: SimWafProtectedResource): boolean;
 }

package/dist/service/wafv2/association/sim-waf-protected-resources.js

@@ -1,16 +1,19 @@
+import { SimWafUnsimulatedResource } from "./sim-waf-unsimulated-resource.js";
 /**
  * The resources available to a WAFv2 with nothing around it to ask.
  *
- * Every ARN resolves to nothing, so a standalone simulated WAFv2 associates a
- * web ACL with nothing at all. That is the safe answer: an association held
- * against a resource no request will ever reach protects nothing, and saying
- * so is better than reporting a web ACL in front of something imaginary.
+ * Every simulated resource ARN resolves to nothing, so a standalone simulated
+ * WAFv2 associates a web ACL with no stage or pool. That is the safe answer:
+ * an association held against a resource no request will ever reach protects
+ * nothing, and saying so is better than reporting a web ACL in front of
+ * something imaginary. A `SimWafUnsimulatedResource` is taken as named here
+ * as everywhere else.
  */
 export class SimWafNoProtectedResources {
     /**
-     * No resource is reachable here.
+     * Whether the resource is one no simulated service holds.
      */
-    has() {
-        return false;
+    has(resource) {
+        return resource instanceof SimWafUnsimulatedResource;
     }
 }

package/dist/service/wafv2/association/sim-waf-unsimulated-resource.d.ts

@@ -0,0 +1,33 @@
+/**
+ * The resource types AWS WAF protects that no simulated request passes
+ * through, as ListResourcesForWebACL lists them.
+ */
+export type SimWafUnsimulatedResourceType = "APPLICATION_LOAD_BALANCER" | "APPSYNC" | "APP_RUNNER_SERVICE" | "VERIFIED_ACCESS_INSTANCE";
+/**
+ * The types listed for a resource AWS WAF protects and Yulin does not.
+ */
+export declare const simWafUnsimulatedResourceTypes: readonly SimWafUnsimulatedResourceType[];
+/**
+ * A resource AWS WAF protects and no simulated request passes through.
+ *
+ * An association with one is held, and GetWebACLForResource and
+ * ListResourcesForWebACL report it. Nothing is evaluated in front of it,
+ * because nothing here serves a request through it. Whether the resource
+ * exists is not checked, since no simulated service holds it to ask.
+ */
+export declare class SimWafUnsimulatedResource {
+    readonly resourceType: SimWafUnsimulatedResourceType;
+    readonly arn: string;
+    readonly regionName: string;
+    readonly accountId: string;
+    /** Why the web ACL in front of this resource evaluates nothing. */
+    readonly reason: string;
+    private constructor();
+    /**
+     * The unsimulated resource an ARN names, or nothing when it names none.
+     *
+     * Every pattern places the Region and the Account where any ARN does, so a
+     * match is read for them by position.
+     */
+    static read(arn: string): SimWafUnsimulatedResource | undefined;
+}