@empire-builder-kit/nx 1.0.0-rc.30 → 1.0.0-rc.31

package/src/foundation/router-waf.d.ts

@@ -1,7 +1,12 @@
 import { type FoundationStage } from './stages.js';
+import { type DeploymentProfile } from '../repository-policy/policy.js';
+import { type RouterWafRateRehearsalEvidence } from './router-waf-rate-rehearsal.js';
 export declare const ROUTER_WAF_POLICY_KIND: "ebk-router-waf-policy";
 export declare const ROUTER_WAF_REHEARSAL_KIND: "ebk-router-waf-blocking-rehearsal";
 export declare const ROUTER_WAF_SCHEMA_VERSION: 1;
+export declare const ROUTER_WAF_CONTRACT_SCHEMA_VERSION: 1;
+export declare const ROUTER_WAF_REHEARSAL_SCHEMA_VERSION: 4;
+export declare const ROUTER_WAF_LIVE_EVIDENCE_SCHEMA_VERSION: 4;
 export declare const ROUTER_WAF_REQUIRED_MANAGED_RULES: readonly ["AWSManagedRulesCommonRuleSet", "AWSManagedRulesKnownBadInputsRuleSet", "AWSManagedRulesAmazonIpReputationList"];
 export type RouterWafAccess = 'allowlist' | 'public';
 export type RouterWafMode = 'block' | 'count';
@@ -11,6 +16,7 @@ export interface RouterWafStagePolicy {
     mode: RouterWafMode;
 }
 export interface RouterWafPolicy {
+    deploymentProfile: DeploymentProfile;
     kind: typeof ROUTER_WAF_POLICY_KIND;
     logging: {
         enabled: boolean;
@@ -18,43 +24,67 @@ export interface RouterWafPolicy {
     };
     rateLimitPerIp: number;
     schemaVersion: typeof ROUTER_WAF_SCHEMA_VERSION;
-    stages: Record<FoundationStage, RouterWafStagePolicy>;
+    stages: Record<'development' | 'production', RouterWafStagePolicy> & Partial<Record<'staging', RouterWafStagePolicy>>;
 }
 export interface RouterWafBlockingRehearsal {
+    accountId: string;
     completedAt: string;
+    deploymentRoleArn: string;
     evidenceDigest: `sha256:${string}`;
     kind: typeof ROUTER_WAF_REHEARSAL_KIND;
     mode: 'block';
     policyDigest: `sha256:${string}`;
-    schemaVersion: typeof ROUTER_WAF_SCHEMA_VERSION;
-    stage: 'staging';
+    region: string;
+    schemaVersion: typeof ROUTER_WAF_REHEARSAL_SCHEMA_VERSION;
+    stage: 'development' | 'staging';
     status: 'passed';
+    wafContractDigest: `sha256:${string}`;
+    workspace: string;
 }
 export interface RouterWafLiveEvidence {
     accountId: string;
     completedAt: string;
+    deploymentRoleArn: string;
     distributionId: string;
     kind: 'ebk-router-waf-live-evidence';
     mode: 'block';
     policyDigest: `sha256:${string}`;
     probes: {
         allowedRequestStatus: number;
-        blockedManagedRuleStatus: 403;
-        blockedNonAllowlistedStatus: 403;
-        blockedRateLimitStatus: 403;
         cloudWatchMetricsObserved: true;
-        countModeTuningObserved: true;
+        countModeTuningObserved: boolean;
+        managedRule: RouterWafOperatorBlockEvidence;
+        nonAllowlisted: RouterWafOperatorBlockEvidence;
+        rateLimit: RouterWafRateRehearsalEvidence;
         sampledRequestsObserved: true;
     };
     region: string;
     requiredRules: string[];
     result: 'passed';
-    schemaVersion: typeof ROUTER_WAF_SCHEMA_VERSION;
+    schemaVersion: typeof ROUTER_WAF_LIVE_EVIDENCE_SCHEMA_VERSION;
     sourceCommit: string;
-    stage: 'staging';
+    stage: 'development' | 'staging';
     startedAt: string;
     webAclArn: string;
     webAclScope: 'CLOUDFRONT';
+    wafContractDigest: `sha256:${string}`;
+    workspace: string;
+}
+export interface RouterWafOperatorBlockEvidence {
+    blockedAt: string;
+    marker: string;
+    method: 'GET';
+    path: string;
+    ruleName: string;
+    status: 403;
+}
+export interface RouterWafRehearsalBinding {
+    accountId: string;
+    deploymentRoleArn: string;
+    region: string;
+    stage: 'development' | 'staging';
+    wafContractDigest: `sha256:${string}`;
+    workspace: string;
 }
 export interface RouterWafStagePlan {
     access: RouterWafAccess;
@@ -77,12 +107,31 @@ type WafRule = Readonly<Record<string, unknown>>;
 export declare function normalizeRouterWafPolicy(value: unknown): RouterWafPolicy;
 export declare function routerWafPolicyDigest(policy: RouterWafPolicy): `sha256:${string}`;
 export declare function normalizeRouterWafBlockingRehearsal(value: unknown): RouterWafBlockingRehearsal | null;
+export interface ValidatedRouterWafLiveEvidenceSeed {
+    accountId: string;
+    completedAt: number;
+    deploymentRoleArn: string;
+    distributionId: string;
+    probes: Record<string, unknown>;
+    region: string;
+    stage: 'development' | 'staging';
+    startedAt: number;
+    wafContractDigest: `sha256:${string}`;
+    webAclArn: string;
+    webAclName: string;
+    workspace: string;
+}
+export declare function validateRouterWafLiveEvidenceSeed(input: {
+    evidence: unknown;
+    policy: RouterWafPolicy;
+}): ValidatedRouterWafLiveEvidenceSeed;
 export declare function createRouterWafBlockingRehearsal(input: {
     evidence: unknown;
     policy: RouterWafPolicy;
 }): RouterWafBlockingRehearsal;
 export declare function reconcileRouterWafBlockingRehearsal(input: {
     evidence: unknown;
+    expected: RouterWafRehearsalBinding;
     policy: RouterWafPolicy;
     receipt: unknown;
 }): RouterWafBlockingRehearsal | null;
@@ -95,4 +144,5 @@ export declare function createRouterWafRules(plan: RouterWafStagePlan, ipSets: {
     ipv4Arn?: unknown;
     ipv6Arn?: unknown;
 }): WafRule[];
+export declare function routerWafContractDigest(policy: RouterWafPolicy): `sha256:${string}`;
 export {};