@kensio/yulin 1.17.1 → 1.18.0

package/dist/service/wafv2/managed/sim-waf-managed-group-input.js

@@ -0,0 +1,64 @@
+import { invalidSimWafRule, refuseSimWafRuleInput, } from "../statement/sim-waf-rule-refusals.js";
+import { findSimWafManagedRuleGroup, simWafManagedRuleGroupNames, } from "./sim-waf-managed-rule-groups.js";
+/**
+ * The rule group statement members real WAFv2 takes and this simulation does
+ * not.
+ */
+const refusedMembers = new Map([
+    [
+        "Version",
+        "a versioned rule group is a snapshot of rules that were published on a " +
+            "date, and only the current rules are carried here",
+    ],
+    [
+        "ExcludedRules",
+        "AWS replaced it with RuleActionOverrides, which says which action a " +
+            "named rule takes rather than only that it takes none",
+    ],
+    [
+        "ManagedRuleGroupConfigs",
+        "it configures the Bot Control, account takeover and account creation " +
+            "groups, and none of those is simulated",
+    ],
+]);
+/**
+ * Find the simulated group a statement names, refusing any other.
+ *
+ * The refusal names the groups that are simulated, because the ones that are
+ * not are left out for reasons a reader cannot guess from the name: a group
+ * that decides by caller address sees one client for the whole simulation, and
+ * a group whose detection AWS does not describe cannot be reproduced at all.
+ */
+export function requiredSimWafManagedRuleGroup(statement, ruleName) {
+    for (const [member, value] of Object.entries(statement)) {
+        const reason = refusedMembers.get(member);
+        if (reason !== undefined && value !== undefined) {
+            refuseSimWafRuleInput(ruleName, `the rule group member ${member}`, reason);
+        }
+    }
+    const group = findSimWafManagedRuleGroup(statement.VendorName, statement.Name);
+    if (group === undefined) {
+        const named = `${String(statement.VendorName)} ${String(statement.Name)}`;
+        const simulated = simWafManagedRuleGroupNames().join(", ");
+        refuseSimWafRuleInput(ruleName, `the managed rule group ${named}`, `the simulated groups are ${simulated}`);
+    }
+    return group;
+}
+/**
+ * Whether a rule group's own override action turns the whole group to counting.
+ *
+ * `None` and `Count` are the two real WAFv2 takes, and one of them is required
+ * on a rule that names a rule group. A rule with neither would be a rule with
+ * no action at all, since a rule group statement carries no `Action`.
+ */
+export function simWafGroupCountsEverything(overrideAction, ruleName) {
+    if (overrideAction?.Count !== undefined) {
+        return true;
+    }
+    if (overrideAction?.None === undefined) {
+        invalidSimWafRule(ruleName, "A rule naming a rule group takes an OverrideAction of None or Count " +
+            "in place of an Action");
+    }
+    return false;
+}
+//# sourceMappingURL=sim-waf-managed-group-input.js.map

package/dist/service/wafv2/managed/sim-waf-managed-group-input.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"sim-waf-managed-group-input.js","sourceRoot":"","sources":["../../../../src/service/wafv2/managed/sim-waf-managed-group-input.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,iBAAiB,EACjB,qBAAqB,GACtB,MAAM,uCAAuC,CAAC;AAK/C,OAAO,EACL,0BAA0B,EAC1B,2BAA2B,GAC5B,MAAM,kCAAkC,CAAC;AAG1C;;;GAGG;AACH,MAAM,cAAc,GAAG,IAAI,GAAG,CAAiB;IAC7C;QACE,SAAS;QACT,yEAAyE;YACvE,mDAAmD;KACtD;IACD;QACE,eAAe;QACf,sEAAsE;YACpE,sDAAsD;KACzD;IACD;QACE,yBAAyB;QACzB,uEAAuE;YACrE,wCAAwC;KAC3C;CACF,CAAC,CAAC;AAEH;;;;;;;GAOG;AACH,MAAM,UAAU,8BAA8B,CAC5C,SAA+C,EAC/C,QAAgB;IAEhB,KAAK,MAAM,CAAC,MAAM,EAAE,KAAK,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,SAAS,CAAC,EAAE,CAAC;QACxD,MAAM,MAAM,GAAG,cAAc,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;QAE1C,IAAI,MAAM,KAAK,SAAS,IAAI,KAAK,KAAK,SAAS,EAAE,CAAC;YAChD,qBAAqB,CACnB,QAAQ,EACR,yBAAyB,MAAM,EAAE,EACjC,MAAM,CACP,CAAC;QACJ,CAAC;IACH,CAAC;IAED,MAAM,KAAK,GAAG,0BAA0B,CACtC,SAAS,CAAC,UAAU,EACpB,SAAS,CAAC,IAAI,CACf,CAAC;IAEF,IAAI,KAAK,KAAK,SAAS,EAAE,CAAC;QACxB,MAAM,KAAK,GAAG,GAAG,MAAM,CAAC,SAAS,CAAC,UAAU,CAAC,IAAI,MAAM,CAAC,SAAS,CAAC,IAAI,CAAC,EAAE,CAAC;QAC1E,MAAM,SAAS,GAAG,2BAA2B,EAAE,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QAE3D,qBAAqB,CACnB,QAAQ,EACR,0BAA0B,KAAK,EAAE,EACjC,4BAA4B,SAAS,EAAE,CACxC,CAAC;IACJ,CAAC;IAED,OAAO,KAAK,CAAC;AACf,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,2BAA2B,CACzC,cAAqD,EACrD,QAAgB;IAEhB,IAAI,cAAc,EAAE,KAAK,KAAK,SAAS,EAAE,CAAC;QACxC,OAAO,IAAI,CAAC;IACd,CAAC;IAED,IAAI,cAAc,EAAE,IAAI,KAAK,SAAS,EAAE,CAAC;QACvC,iBAAiB,CACf,QAAQ,EACR,sEAAsE;YACpE,uBAAuB,CAC1B,CAAC;IACJ,CAAC;IAED,OAAO,KAAK,CAAC;AACf,CAAC"}

package/dist/service/wafv2/managed/sim-waf-managed-group-statement.d.ts

@@ -0,0 +1,25 @@
+import type { SimWafRuleEvaluator, SimWafRuleScope } from "../web-acl/sim-waf-rule.type.js";
+import type { SimWafManagedRuleGroupStatementInput, SimWafOverrideActionInput } from "./sim-waf-managed-group.type.js";
+interface SimWafManagedRuleGroupProperties {
+    readonly statement: SimWafManagedRuleGroupStatementInput;
+    readonly overrideAction: SimWafOverrideActionInput | undefined;
+    readonly ruleName: string;
+    readonly scope: SimWafRuleScope;
+}
+/**
+ * Compile a rule that names an AWS managed rule group.
+ *
+ * The group's rules run in the order AWS evaluates them, and the first of them
+ * whose action terminates decides the request. A rule that matches adds its
+ * label whatever action it ends up taking, which is what lets the tuning
+ * pattern work: the group runs in count mode, labels what it would have
+ * blocked, and a rule of the reader's own blocks on the label.
+ *
+ * The two overrides stack in one direction. `RuleActionOverrides` sets what a
+ * named rule does, and a group override action of `Count` then holds the whole
+ * group to counting whatever its rules were set to, so an overridden group
+ * cannot decide a request.
+ */
+export declare function compileSimWafManagedRuleGroup(properties: SimWafManagedRuleGroupProperties): SimWafRuleEvaluator;
+export {};
+//# sourceMappingURL=sim-waf-managed-group-statement.d.ts.map

package/dist/service/wafv2/managed/sim-waf-managed-group-statement.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"sim-waf-managed-group-statement.d.ts","sourceRoot":"","sources":["../../../../src/service/wafv2/managed/sim-waf-managed-group-statement.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EACV,mBAAmB,EACnB,eAAe,EAChB,MAAM,iCAAiC,CAAC;AAMzC,OAAO,KAAK,EACV,oCAAoC,EACpC,yBAAyB,EAC1B,MAAM,iCAAiC,CAAC;AAGzC,UAAU,gCAAgC;IACxC,QAAQ,CAAC,SAAS,EAAE,oCAAoC,CAAC;IACzD,QAAQ,CAAC,cAAc,EAAE,yBAAyB,GAAG,SAAS,CAAC;IAC/D,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B,QAAQ,CAAC,KAAK,EAAE,eAAe,CAAC;CACjC;AAED;;;;;;;;;;;;;GAaG;AACH,wBAAgB,6BAA6B,CAC3C,UAAU,EAAE,gCAAgC,GAC3C,mBAAmB,CA0DrB"}

package/dist/service/wafv2/managed/sim-waf-managed-group-statement.js

@@ -0,0 +1,61 @@
+import { compileSimWafStatement } from "../statement/sim-waf-statement.js";
+import { SimWafAction } from "../web-acl/sim-waf-action.js";
+import { requiredSimWafManagedRuleGroup, simWafGroupCountsEverything, } from "./sim-waf-managed-group-input.js";
+import { simWafManagedRuleOverrides } from "./sim-waf-managed-rule-overrides.js";
+import { simWafManagedRequestParts } from "./sim-waf-managed-request.js";
+/**
+ * Compile a rule that names an AWS managed rule group.
+ *
+ * The group's rules run in the order AWS evaluates them, and the first of them
+ * whose action terminates decides the request. A rule that matches adds its
+ * label whatever action it ends up taking, which is what lets the tuning
+ * pattern work: the group runs in count mode, labels what it would have
+ * blocked, and a rule of the reader's own blocks on the label.
+ *
+ * The two overrides stack in one direction. `RuleActionOverrides` sets what a
+ * named rule does, and a group override action of `Count` then holds the whole
+ * group to counting whatever its rules were set to, so an overridden group
+ * cannot decide a request.
+ */
+export function compileSimWafManagedRuleGroup(properties) {
+    const { statement, ruleName, scope } = properties;
+    const group = requiredSimWafManagedRuleGroup(statement, ruleName);
+    const overrides = simWafManagedRuleOverrides(statement, group, ruleName, scope.customResponseBodies);
+    const counting = simWafGroupCountsEverything(properties.overrideAction, ruleName);
+    const scopeDown = statement.ScopeDownStatement === undefined
+        ? undefined
+        : compileSimWafStatement(statement.ScopeDownStatement, {
+            regexPatternSets: scope.regexPatternSets,
+            ruleName,
+        });
+    // Every rule in the three simulated groups blocks by default, and a group
+    // that is counting counts whatever the rule that matched was set to.
+    const blocking = SimWafAction.read({ Block: {} }, ruleName, {});
+    const counted = SimWafAction.read({ Count: {} }, ruleName, {});
+    const { managedRules } = scope;
+    return (request) => {
+        // A scope-down statement decides whether the group sees the request at
+        // all, so a request it does not claim picks up no label from the group.
+        if (scopeDown !== undefined && !scopeDown(request)) {
+            return undefined;
+        }
+        const parts = simWafManagedRequestParts(request);
+        const declared = managedRules.declaredMatches(request);
+        let matched = false;
+        for (const rule of group.rules) {
+            if (!declared.has(rule.name) && rule.detects?.(parts) !== true) {
+                continue;
+            }
+            request.labels.add(`${group.labelNamespace}:${rule.label}`);
+            const action = counting
+                ? counted
+                : (overrides.get(rule.name) ?? blocking);
+            if (action.isTerminating) {
+                return action;
+            }
+            matched = true;
+        }
+        return matched ? counted : undefined;
+    };
+}
+//# sourceMappingURL=sim-waf-managed-group-statement.js.map

package/dist/service/wafv2/managed/sim-waf-managed-group-statement.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"sim-waf-managed-group-statement.js","sourceRoot":"","sources":["../../../../src/service/wafv2/managed/sim-waf-managed-group-statement.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,sBAAsB,EAAE,MAAM,mCAAmC,CAAC;AAC3E,OAAO,EAAE,YAAY,EAAE,MAAM,8BAA8B,CAAC;AAK5D,OAAO,EACL,8BAA8B,EAC9B,2BAA2B,GAC5B,MAAM,kCAAkC,CAAC;AAC1C,OAAO,EAAE,0BAA0B,EAAE,MAAM,qCAAqC,CAAC;AAKjF,OAAO,EAAE,yBAAyB,EAAE,MAAM,8BAA8B,CAAC;AASzE;;;;;;;;;;;;;GAaG;AACH,MAAM,UAAU,6BAA6B,CAC3C,UAA4C;IAE5C,MAAM,EAAE,SAAS,EAAE,QAAQ,EAAE,KAAK,EAAE,GAAG,UAAU,CAAC;IAClD,MAAM,KAAK,GAAG,8BAA8B,CAAC,SAAS,EAAE,QAAQ,CAAC,CAAC;IAClE,MAAM,SAAS,GAAG,0BAA0B,CAC1C,SAAS,EACT,KAAK,EACL,QAAQ,EACR,KAAK,CAAC,oBAAoB,CAC3B,CAAC;IACF,MAAM,QAAQ,GAAG,2BAA2B,CAC1C,UAAU,CAAC,cAAc,EACzB,QAAQ,CACT,CAAC;IACF,MAAM,SAAS,GACb,SAAS,CAAC,kBAAkB,KAAK,SAAS;QACxC,CAAC,CAAC,SAAS;QACX,CAAC,CAAC,sBAAsB,CAAC,SAAS,CAAC,kBAAkB,EAAE;YACnD,gBAAgB,EAAE,KAAK,CAAC,gBAAgB;YACxC,QAAQ;SACT,CAAC,CAAC;IAET,0EAA0E;IAC1E,qEAAqE;IACrE,MAAM,QAAQ,GAAG,YAAY,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,EAAE,EAAE,EAAE,QAAQ,EAAE,EAAE,CAAC,CAAC;IAChE,MAAM,OAAO,GAAG,YAAY,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,EAAE,EAAE,EAAE,QAAQ,EAAE,EAAE,CAAC,CAAC;IAC/D,MAAM,EAAE,YAAY,EAAE,GAAG,KAAK,CAAC;IAE/B,OAAO,CAAC,OAAO,EAA4B,EAAE;QAC3C,uEAAuE;QACvE,wEAAwE;QACxE,IAAI,SAAS,KAAK,SAAS,IAAI,CAAC,SAAS,CAAC,OAAO,CAAC,EAAE,CAAC;YACnD,OAAO,SAAS,CAAC;QACnB,CAAC;QAED,MAAM,KAAK,GAAG,yBAAyB,CAAC,OAAO,CAAC,CAAC;QACjD,MAAM,QAAQ,GAAG,YAAY,CAAC,eAAe,CAAC,OAAO,CAAC,CAAC;QACvD,IAAI,OAAO,GAAG,KAAK,CAAC;QAEpB,KAAK,MAAM,IAAI,IAAI,KAAK,CAAC,KAAK,EAAE,CAAC;YAC/B,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,IAAI,CAAC,OAAO,EAAE,CAAC,KAAK,CAAC,KAAK,IAAI,EAAE,CAAC;gBAC/D,SAAS;YACX,CAAC;YAED,OAAO,CAAC,MAAM,CAAC,GAAG,CAAC,GAAG,KAAK,CAAC,cAAc,IAAI,IAAI,CAAC,KAAK,EAAE,CAAC,CAAC;YAE5D,MAAM,MAAM,GAAG,QAAQ;gBACrB,CAAC,CAAC,OAAO;gBACT,CAAC,CAAC,CAAC,SAAS,CAAC,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,QAAQ,CAAC,CAAC;YAE3C,IAAI,MAAM,CAAC,aAAa,EAAE,CAAC;gBACzB,OAAO,MAAM,CAAC;YAChB,CAAC;YAED,OAAO,GAAG,IAAI,CAAC;QACjB,CAAC;QAED,OAAO,OAAO,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,SAAS,CAAC;IACvC,CAAC,CAAC;AACJ,CAAC"}

package/dist/service/wafv2/managed/sim-waf-managed-group.type.d.ts

@@ -0,0 +1,35 @@
+import type { SimWafStatementInput } from "../statement/sim-waf-statement.type.js";
+import type { SimWafActionInput } from "../web-acl/sim-waf-action.type.js";
+/**
+ * Minimal structural WAFv2 ManagedRuleGroupStatement.
+ *
+ * The members Yulin refuses are declared here rather than left out, so a
+ * statement that names one is refused by name.
+ *
+ * https://docs.aws.amazon.com/AWSJavaScriptSDK/v3/latest/client/wafv2/Interface/ManagedRuleGroupStatement/
+ */
+export interface SimWafManagedRuleGroupStatementInput {
+    readonly VendorName?: string | undefined;
+    readonly Name?: string | undefined;
+    readonly Version?: string | undefined;
+    readonly ScopeDownStatement?: SimWafStatementInput | undefined;
+    readonly RuleActionOverrides?: readonly SimWafRuleActionOverrideInput[] | undefined;
+    readonly ExcludedRules?: readonly unknown[] | undefined;
+    readonly ManagedRuleGroupConfigs?: readonly unknown[] | undefined;
+}
+/**
+ * One rule of a managed group set to an action of the reader's choosing.
+ */
+export interface SimWafRuleActionOverrideInput {
+    readonly Name?: string | undefined;
+    readonly ActionToUse?: SimWafActionInput | undefined;
+}
+/**
+ * Minimal structural WAFv2 OverrideAction, which a rule group statement
+ * carries in place of an action.
+ */
+export interface SimWafOverrideActionInput {
+    readonly None?: unknown;
+    readonly Count?: unknown;
+}
+//# sourceMappingURL=sim-waf-managed-group.type.d.ts.map

package/dist/service/wafv2/managed/sim-waf-managed-group.type.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"sim-waf-managed-group.type.d.ts","sourceRoot":"","sources":["../../../../src/service/wafv2/managed/sim-waf-managed-group.type.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,oBAAoB,EAAE,MAAM,wCAAwC,CAAC;AACnF,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,mCAAmC,CAAC;AAE3E;;;;;;;GAOG;AACH,MAAM,WAAW,oCAAoC;IACnD,QAAQ,CAAC,UAAU,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IACzC,QAAQ,CAAC,IAAI,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IACnC,QAAQ,CAAC,OAAO,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IACtC,QAAQ,CAAC,kBAAkB,CAAC,EAAE,oBAAoB,GAAG,SAAS,CAAC;IAC/D,QAAQ,CAAC,mBAAmB,CAAC,EACzB,SAAS,6BAA6B,EAAE,GACxC,SAAS,CAAC;IACd,QAAQ,CAAC,aAAa,CAAC,EAAE,SAAS,OAAO,EAAE,GAAG,SAAS,CAAC;IACxD,QAAQ,CAAC,uBAAuB,CAAC,EAAE,SAAS,OAAO,EAAE,GAAG,SAAS,CAAC;CACnE;AAED;;GAEG;AACH,MAAM,WAAW,6BAA6B;IAC5C,QAAQ,CAAC,IAAI,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IACnC,QAAQ,CAAC,WAAW,CAAC,EAAE,iBAAiB,GAAG,SAAS,CAAC;CACtD;AAED;;;GAGG;AACH,MAAM,WAAW,yBAAyB;IACxC,QAAQ,CAAC,IAAI,CAAC,EAAE,OAAO,CAAC;IACxB,QAAQ,CAAC,KAAK,CAAC,EAAE,OAAO,CAAC;CAC1B"}

package/dist/service/wafv2/managed/sim-waf-managed-group.type.js

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=sim-waf-managed-group.type.js.map

package/dist/service/wafv2/managed/sim-waf-managed-group.type.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"sim-waf-managed-group.type.js","sourceRoot":"","sources":["../../../../src/service/wafv2/managed/sim-waf-managed-group.type.ts"],"names":[],"mappings":""}

package/dist/service/wafv2/managed/sim-waf-managed-request.d.ts

@@ -0,0 +1,45 @@
+import type { SimWafInspectedRequest } from "../evaluate/sim-waf-inspected-request.js";
+/**
+ * The request components an AWS managed rule inspects.
+ *
+ * A managed rule names the component it reads rather than carrying a field to
+ * match, so these are read once per request and handed to every rule in the
+ * group. The sizes are here because the four `SizeRestrictions_*` rules
+ * measure a component rather than looking inside it, and they measure bytes
+ * rather than characters.
+ */
+export interface SimWafManagedRequestParts {
+    readonly method: string;
+    /** The AWS-facing hostname, which `Host_localhost_HEADER` reads. */
+    readonly host: string;
+    readonly uriPath: string;
+    readonly queryString: string;
+    /** The value of each query argument, undecoded. */
+    readonly queryArguments: readonly string[];
+    /** The value of each header the request sent. */
+    readonly headerValues: readonly string[];
+    /** The User-Agent header, or nothing when the request sent none. */
+    readonly userAgent: string | undefined;
+    /** The whole Cookie header, as it arrived. */
+    readonly cookieHeader: string;
+    /** As much of the body as WAF reads, decoded as text. */
+    readonly body: string;
+    readonly uriPathBytes: number;
+    readonly queryStringBytes: number;
+    readonly cookieHeaderBytes: number;
+    readonly bodyBytes: number;
+}
+/**
+ * Read the components the managed rules inspect out of one request.
+ *
+ * The body is cut at WAF's inspection limit for the rules that look inside it,
+ * and its full size is kept beside it for `SizeRestrictions_BODY`. WAF knows
+ * how large a body is from the request whether or not it reads that far, so a
+ * body over the limit is measured rather than being reported as the limit.
+ */
+export declare function simWafManagedRequestParts(request: SimWafInspectedRequest): SimWafManagedRequestParts;
+/**
+ * How many bytes a string takes up, which is what WAF measures a component in.
+ */
+export declare function simWafByteLength(value: string): number;
+//# sourceMappingURL=sim-waf-managed-request.d.ts.map

package/dist/service/wafv2/managed/sim-waf-managed-request.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"sim-waf-managed-request.d.ts","sourceRoot":"","sources":["../../../../src/service/wafv2/managed/sim-waf-managed-request.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,sBAAsB,EAAE,MAAM,0CAA0C,CAAC;AAOvF;;;;;;;;GAQG;AACH,MAAM,WAAW,yBAAyB;IACxC,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IAExB,oEAAoE;IACpE,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IAEtB,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IACzB,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;IAE7B,mDAAmD;IACnD,QAAQ,CAAC,cAAc,EAAE,SAAS,MAAM,EAAE,CAAC;IAE3C,iDAAiD;IACjD,QAAQ,CAAC,YAAY,EAAE,SAAS,MAAM,EAAE,CAAC;IAEzC,oEAAoE;IACpE,QAAQ,CAAC,SAAS,EAAE,MAAM,GAAG,SAAS,CAAC;IAEvC,8CAA8C;IAC9C,QAAQ,CAAC,YAAY,EAAE,MAAM,CAAC;IAE9B,yDAAyD;IACzD,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IAEtB,QAAQ,CAAC,YAAY,EAAE,MAAM,CAAC;IAC9B,QAAQ,CAAC,gBAAgB,EAAE,MAAM,CAAC;IAClC,QAAQ,CAAC,iBAAiB,EAAE,MAAM,CAAC;IACnC,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;CAC5B;AAED;;;;;;;GAOG;AACH,wBAAgB,yBAAyB,CACvC,OAAO,EAAE,sBAAsB,GAC9B,yBAAyB,CAqB3B;AAED;;GAEG;AACH,wBAAgB,gBAAgB,CAAC,KAAK,EAAE,MAAM,GAAG,MAAM,CAEtD"}

package/dist/service/wafv2/managed/sim-waf-managed-request.js

@@ -0,0 +1,38 @@
+import { simWafInspectionLimitBytes } from "../statement/sim-waf-field-content.js";
+import { simWafQueryArguments } from "../statement/sim-waf-request-fields.js";
+const encoder = new TextEncoder();
+const decoder = new TextDecoder();
+/**
+ * Read the components the managed rules inspect out of one request.
+ *
+ * The body is cut at WAF's inspection limit for the rules that look inside it,
+ * and its full size is kept beside it for `SizeRestrictions_BODY`. WAF knows
+ * how large a body is from the request whether or not it reads that far, so a
+ * body over the limit is measured rather than being reported as the limit.
+ */
+export function simWafManagedRequestParts(request) {
+    const cookieHeader = request.headers.get("cookie") ?? "";
+    const body = request.body ?? new Uint8Array();
+    return {
+        method: request.method,
+        host: request.host,
+        uriPath: request.uriPath,
+        queryString: request.queryString,
+        queryArguments: simWafQueryArguments(request.queryString).map((argument) => argument.value),
+        headerValues: [...request.headers].map(([, value]) => value),
+        userAgent: request.headers.get("user-agent") ?? undefined,
+        cookieHeader,
+        body: decoder.decode(body.subarray(0, simWafInspectionLimitBytes)),
+        uriPathBytes: simWafByteLength(request.uriPath),
+        queryStringBytes: simWafByteLength(request.queryString),
+        cookieHeaderBytes: simWafByteLength(cookieHeader),
+        bodyBytes: body.length,
+    };
+}
+/**
+ * How many bytes a string takes up, which is what WAF measures a component in.
+ */
+export function simWafByteLength(value) {
+    return encoder.encode(value).length;
+}
+//# sourceMappingURL=sim-waf-managed-request.js.map

package/dist/service/wafv2/managed/sim-waf-managed-request.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"sim-waf-managed-request.js","sourceRoot":"","sources":["../../../../src/service/wafv2/managed/sim-waf-managed-request.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,0BAA0B,EAAE,MAAM,uCAAuC,CAAC;AACnF,OAAO,EAAE,oBAAoB,EAAE,MAAM,wCAAwC,CAAC;AAE9E,MAAM,OAAO,GAAG,IAAI,WAAW,EAAE,CAAC;AAClC,MAAM,OAAO,GAAG,IAAI,WAAW,EAAE,CAAC;AAyClC;;;;;;;GAOG;AACH,MAAM,UAAU,yBAAyB,CACvC,OAA+B;IAE/B,MAAM,YAAY,GAAG,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC,QAAQ,CAAC,IAAI,EAAE,CAAC;IACzD,MAAM,IAAI,GAAG,OAAO,CAAC,IAAI,IAAI,IAAI,UAAU,EAAE,CAAC;IAE9C,OAAO;QACL,MAAM,EAAE,OAAO,CAAC,MAAM;QACtB,IAAI,EAAE,OAAO,CAAC,IAAI;QAClB,OAAO,EAAE,OAAO,CAAC,OAAO;QACxB,WAAW,EAAE,OAAO,CAAC,WAAW;QAChC,cAAc,EAAE,oBAAoB,CAAC,OAAO,CAAC,WAAW,CAAC,CAAC,GAAG,CAC3D,CAAC,QAAQ,EAAE,EAAE,CAAC,QAAQ,CAAC,KAAK,CAC7B;QACD,YAAY,EAAE,CAAC,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,KAAK,CAAC,EAAE,EAAE,CAAC,KAAK,CAAC;QAC5D,SAAS,EAAE,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC,YAAY,CAAC,IAAI,SAAS;QACzD,YAAY;QACZ,IAAI,EAAE,OAAO,CAAC,MAAM,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC,EAAE,0BAA0B,CAAC,CAAC;QAClE,YAAY,EAAE,gBAAgB,CAAC,OAAO,CAAC,OAAO,CAAC;QAC/C,gBAAgB,EAAE,gBAAgB,CAAC,OAAO,CAAC,WAAW,CAAC;QACvD,iBAAiB,EAAE,gBAAgB,CAAC,YAAY,CAAC;QACjD,SAAS,EAAE,IAAI,CAAC,MAAM;KACvB,CAAC;AACJ,CAAC;AAED;;GAEG;AACH,MAAM,UAAU,gBAAgB,CAAC,KAAa;IAC5C,OAAO,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,MAAM,CAAC;AACtC,CAAC"}

package/dist/service/wafv2/managed/sim-waf-managed-rule-groups.d.ts

@@ -0,0 +1,39 @@
+import type { SimWafManagedRuleDefinition, SimWafManagedRuleGroupDefinition } from "./sim-waf-managed-rule.type.js";
+/**
+ * The vendor the simulated managed rule groups belong to.
+ *
+ * A group from any other vendor is refused, marketplace groups included: a
+ * subscription buys rules nobody outside the vendor has ever seen.
+ */
+export declare const simWafManagedVendorName = "AWS";
+/**
+ * One rule and the group it belongs to.
+ */
+export interface SimWafManagedRuleEntry {
+    readonly group: SimWafManagedRuleGroupDefinition;
+    readonly rule: SimWafManagedRuleDefinition;
+}
+/**
+ * Find a simulated managed rule group by vendor and name.
+ */
+export declare function findSimWafManagedRuleGroup(vendorName: string | undefined, name: string | undefined): SimWafManagedRuleGroupDefinition | undefined;
+/**
+ * The groups that are simulated, named as a refusal names them.
+ */
+export declare function simWafManagedRuleGroupNames(): readonly string[];
+/**
+ * Find one managed rule by name, wherever it lives.
+ *
+ * Rule names are unique across the simulated groups, which is what lets a
+ * declared match and an action override name a rule and nothing else.
+ */
+export declare function findSimWafManagedRule(name: string): SimWafManagedRuleEntry | undefined;
+/**
+ * Every rule of every simulated group, in the order the groups evaluate them.
+ */
+export declare function allSimWafManagedRules(): readonly SimWafManagedRuleEntry[];
+/**
+ * The fully qualified name of the label one rule adds.
+ */
+export declare function simWafManagedRuleLabel(entry: SimWafManagedRuleEntry): string;
+//# sourceMappingURL=sim-waf-managed-rule-groups.d.ts.map

package/dist/service/wafv2/managed/sim-waf-managed-rule-groups.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"sim-waf-managed-rule-groups.d.ts","sourceRoot":"","sources":["../../../../src/service/wafv2/managed/sim-waf-managed-rule-groups.ts"],"names":[],"mappings":"AAGA,OAAO,KAAK,EACV,2BAA2B,EAC3B,gCAAgC,EACjC,MAAM,gCAAgC,CAAC;AAExC;;;;;GAKG;AACH,eAAO,MAAM,uBAAuB,QAAQ,CAAC;AAU7C;;GAEG;AACH,MAAM,WAAW,sBAAsB;IACrC,QAAQ,CAAC,KAAK,EAAE,gCAAgC,CAAC;IACjD,QAAQ,CAAC,IAAI,EAAE,2BAA2B,CAAC;CAC5C;AAQD;;GAEG;AACH,wBAAgB,0BAA0B,CACxC,UAAU,EAAE,MAAM,GAAG,SAAS,EAC9B,IAAI,EAAE,MAAM,GAAG,SAAS,GACvB,gCAAgC,GAAG,SAAS,CAI9C;AAED;;GAEG;AACH,wBAAgB,2BAA2B,IAAI,SAAS,MAAM,EAAE,CAE/D;AAED;;;;;GAKG;AACH,wBAAgB,qBAAqB,CACnC,IAAI,EAAE,MAAM,GACX,sBAAsB,GAAG,SAAS,CAEpC;AAED;;GAEG;AACH,wBAAgB,qBAAqB,IAAI,SAAS,sBAAsB,EAAE,CAEzE;AAED;;GAEG;AACH,wBAAgB,sBAAsB,CAAC,KAAK,EAAE,sBAAsB,GAAG,MAAM,CAE5E"}

package/dist/service/wafv2/managed/sim-waf-managed-rule-groups.js

@@ -0,0 +1,53 @@
+import { simWafAdminProtectionRuleSet } from "./group/sim-waf-admin-protection.js";
+import { simWafCommonRuleSet } from "./group/sim-waf-common-rule-set.js";
+import { simWafKnownBadInputsRuleSet } from "./group/sim-waf-known-bad-inputs.js";
+/**
+ * The vendor the simulated managed rule groups belong to.
+ *
+ * A group from any other vendor is refused, marketplace groups included: a
+ * subscription buys rules nobody outside the vendor has ever seen.
+ */
+export const simWafManagedVendorName = "AWS";
+const groups = [
+    simWafCommonRuleSet,
+    simWafKnownBadInputsRuleSet,
+    simWafAdminProtectionRuleSet,
+];
+const byName = new Map(groups.map((group) => [group.name, group]));
+const rulesByName = new Map(groups.flatMap((group) => group.rules.map((rule) => [rule.name, { group, rule }])));
+/**
+ * Find a simulated managed rule group by vendor and name.
+ */
+export function findSimWafManagedRuleGroup(vendorName, name) {
+    return vendorName === simWafManagedVendorName && name !== undefined
+        ? byName.get(name)
+        : undefined;
+}
+/**
+ * The groups that are simulated, named as a refusal names them.
+ */
+export function simWafManagedRuleGroupNames() {
+    return groups.map((group) => group.name);
+}
+/**
+ * Find one managed rule by name, wherever it lives.
+ *
+ * Rule names are unique across the simulated groups, which is what lets a
+ * declared match and an action override name a rule and nothing else.
+ */
+export function findSimWafManagedRule(name) {
+    return rulesByName.get(name);
+}
+/**
+ * Every rule of every simulated group, in the order the groups evaluate them.
+ */
+export function allSimWafManagedRules() {
+    return rulesByName.values().toArray();
+}
+/**
+ * The fully qualified name of the label one rule adds.
+ */
+export function simWafManagedRuleLabel(entry) {
+    return `${entry.group.labelNamespace}:${entry.rule.label}`;
+}
+//# sourceMappingURL=sim-waf-managed-rule-groups.js.map

package/dist/service/wafv2/managed/sim-waf-managed-rule-groups.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"sim-waf-managed-rule-groups.js","sourceRoot":"","sources":["../../../../src/service/wafv2/managed/sim-waf-managed-rule-groups.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,4BAA4B,EAAE,MAAM,qCAAqC,CAAC;AACnF,OAAO,EAAE,mBAAmB,EAAE,MAAM,oCAAoC,CAAC;AACzE,OAAO,EAAE,2BAA2B,EAAE,MAAM,qCAAqC,CAAC;AAMlF;;;;;GAKG;AACH,MAAM,CAAC,MAAM,uBAAuB,GAAG,KAAK,CAAC;AAE7C,MAAM,MAAM,GAAgD;IAC1D,mBAAmB;IACnB,2BAA2B;IAC3B,4BAA4B;CAC7B,CAAC;AAEF,MAAM,MAAM,GAAG,IAAI,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC,KAAK,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC,CAAC,CAAC;AAUnE,MAAM,WAAW,GAAG,IAAI,GAAG,CACzB,MAAM,CAAC,OAAO,CAAC,CAAC,KAAK,EAAE,EAAE,CACvB,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC,IAAI,CAAC,IAAI,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,CAAU,CAAC,CACjE,CACF,CAAC;AAEF;;GAEG;AACH,MAAM,UAAU,0BAA0B,CACxC,UAA8B,EAC9B,IAAwB;IAExB,OAAO,UAAU,KAAK,uBAAuB,IAAI,IAAI,KAAK,SAAS;QACjE,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,IAAI,CAAC;QAClB,CAAC,CAAC,SAAS,CAAC;AAChB,CAAC;AAED;;GAEG;AACH,MAAM,UAAU,2BAA2B;IACzC,OAAO,MAAM,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;AAC3C,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,qBAAqB,CACnC,IAAY;IAEZ,OAAO,WAAW,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;AAC/B,CAAC;AAED;;GAEG;AACH,MAAM,UAAU,qBAAqB;IACnC,OAAO,WAAW,CAAC,MAAM,EAAE,CAAC,OAAO,EAAE,CAAC;AACxC,CAAC;AAED;;GAEG;AACH,MAAM,UAAU,sBAAsB,CAAC,KAA6B;IAClE,OAAO,GAAG,KAAK,CAAC,KAAK,CAAC,cAAc,IAAI,KAAK,CAAC,IAAI,CAAC,KAAK,EAAE,CAAC;AAC7D,CAAC"}

package/dist/service/wafv2/managed/sim-waf-managed-rule-overrides.d.ts

@@ -0,0 +1,13 @@
+import { SimWafAction } from "../web-acl/sim-waf-action.js";
+import type { SimWafCustomResponseBodies } from "../web-acl/sim-waf-custom-response.type.js";
+import type { SimWafManagedRuleGroupStatementInput } from "./sim-waf-managed-group.type.js";
+import type { SimWafManagedRuleGroupDefinition } from "./sim-waf-managed-rule.type.js";
+/**
+ * Read the actions a rule group statement sets its named rules to.
+ *
+ * An override naming a rule the group does not hold is refused. A typo there
+ * would otherwise leave the rule it meant to set to `Count` still blocking,
+ * which is the failure this whole mechanism exists to avoid.
+ */
+export declare function simWafManagedRuleOverrides(statement: SimWafManagedRuleGroupStatementInput, group: SimWafManagedRuleGroupDefinition, ruleName: string, bodies: SimWafCustomResponseBodies): ReadonlyMap<string, SimWafAction>;
+//# sourceMappingURL=sim-waf-managed-rule-overrides.d.ts.map

package/dist/service/wafv2/managed/sim-waf-managed-rule-overrides.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"sim-waf-managed-rule-overrides.d.ts","sourceRoot":"","sources":["../../../../src/service/wafv2/managed/sim-waf-managed-rule-overrides.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,YAAY,EAAE,MAAM,8BAA8B,CAAC;AAC5D,OAAO,KAAK,EAAE,0BAA0B,EAAE,MAAM,4CAA4C,CAAC;AAC7F,OAAO,KAAK,EAAE,oCAAoC,EAAE,MAAM,iCAAiC,CAAC;AAE5F,OAAO,KAAK,EAAE,gCAAgC,EAAE,MAAM,gCAAgC,CAAC;AAEvF;;;;;;GAMG;AACH,wBAAgB,0BAA0B,CACxC,SAAS,EAAE,oCAAoC,EAC/C,KAAK,EAAE,gCAAgC,EACvC,QAAQ,EAAE,MAAM,EAChB,MAAM,EAAE,0BAA0B,GACjC,WAAW,CAAC,MAAM,EAAE,YAAY,CAAC,CAoBnC"}

package/dist/service/wafv2/managed/sim-waf-managed-rule-overrides.js

@@ -0,0 +1,25 @@
+import { invalidSimWafRule } from "../statement/sim-waf-rule-refusals.js";
+import { SimWafAction } from "../web-acl/sim-waf-action.js";
+import { findSimWafManagedRule } from "./sim-waf-managed-rule-groups.js";
+/**
+ * Read the actions a rule group statement sets its named rules to.
+ *
+ * An override naming a rule the group does not hold is refused. A typo there
+ * would otherwise leave the rule it meant to set to `Count` still blocking,
+ * which is the failure this whole mechanism exists to avoid.
+ */
+export function simWafManagedRuleOverrides(statement, group, ruleName, bodies) {
+    return new Map((statement.RuleActionOverrides ?? []).map((override) => {
+        const overridden = String(override.Name);
+        const entry = findSimWafManagedRule(overridden);
+        if (entry === undefined || entry.group.name !== group.name) {
+            invalidSimWafRule(ruleName, `The rule group ${group.name} holds no rule named ${overridden} ` +
+                `to override`);
+        }
+        return [
+            overridden,
+            SimWafAction.read(override.ActionToUse, ruleName, bodies),
+        ];
+    }));
+}
+//# sourceMappingURL=sim-waf-managed-rule-overrides.js.map

package/dist/service/wafv2/managed/sim-waf-managed-rule-overrides.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"sim-waf-managed-rule-overrides.js","sourceRoot":"","sources":["../../../../src/service/wafv2/managed/sim-waf-managed-rule-overrides.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,iBAAiB,EAAE,MAAM,uCAAuC,CAAC;AAC1E,OAAO,EAAE,YAAY,EAAE,MAAM,8BAA8B,CAAC;AAG5D,OAAO,EAAE,qBAAqB,EAAE,MAAM,kCAAkC,CAAC;AAGzE;;;;;;GAMG;AACH,MAAM,UAAU,0BAA0B,CACxC,SAA+C,EAC/C,KAAuC,EACvC,QAAgB,EAChB,MAAkC;IAElC,OAAO,IAAI,GAAG,CACZ,CAAC,SAAS,CAAC,mBAAmB,IAAI,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC,QAAQ,EAAE,EAAE;QACrD,MAAM,UAAU,GAAG,MAAM,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC;QACzC,MAAM,KAAK,GAAG,qBAAqB,CAAC,UAAU,CAAC,CAAC;QAEhD,IAAI,KAAK,KAAK,SAAS,IAAI,KAAK,CAAC,KAAK,CAAC,IAAI,KAAK,KAAK,CAAC,IAAI,EAAE,CAAC;YAC3D,iBAAiB,CACf,QAAQ,EACR,kBAAkB,KAAK,CAAC,IAAI,wBAAwB,UAAU,GAAG;gBAC/D,aAAa,CAChB,CAAC;QACJ,CAAC;QAED,OAAO;YACL,UAAU;YACV,YAAY,CAAC,IAAI,CAAC,QAAQ,CAAC,WAAW,EAAE,QAAQ,EAAE,MAAM,CAAC;SAC1D,CAAC;IACJ,CAAC,CAAC,CACH,CAAC;AACJ,CAAC"}

package/dist/service/wafv2/managed/sim-waf-managed-rule-report.d.ts

@@ -0,0 +1,20 @@
+import type { SimWafManagedRuleTier } from "./sim-waf-managed-rule.type.js";
+/**
+ * What the simulation covers of one managed rule.
+ */
+export interface SimWafManagedRuleReport {
+    readonly group: string;
+    readonly name: string;
+    /** The fully qualified label the rule adds to a request it claims. */
+    readonly label: string;
+    readonly tier: SimWafManagedRuleTier;
+}
+/**
+ * What the simulation covers of every managed rule it carries.
+ *
+ * This is how a reader finds out what a group does here without reading the
+ * source of it, which matters most for the rules that detect less than the AWS
+ * rule they stand for.
+ */
+export declare function simWafManagedRuleReports(): readonly SimWafManagedRuleReport[];
+//# sourceMappingURL=sim-waf-managed-rule-report.d.ts.map

package/dist/service/wafv2/managed/sim-waf-managed-rule-report.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"sim-waf-managed-rule-report.d.ts","sourceRoot":"","sources":["../../../../src/service/wafv2/managed/sim-waf-managed-rule-report.ts"],"names":[],"mappings":"AAIA,OAAO,KAAK,EAAE,qBAAqB,EAAE,MAAM,gCAAgC,CAAC;AAE5E;;GAEG;AACH,MAAM,WAAW,uBAAuB;IACtC,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IACvB,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IAEtB,sEAAsE;IACtE,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IAEvB,QAAQ,CAAC,IAAI,EAAE,qBAAqB,CAAC;CACtC;AAED;;;;;;GAMG;AACH,wBAAgB,wBAAwB,IAAI,SAAS,uBAAuB,EAAE,CAO7E"}

package/dist/service/wafv2/managed/sim-waf-managed-rule-report.js

@@ -0,0 +1,17 @@
+import { allSimWafManagedRules, simWafManagedRuleLabel, } from "./sim-waf-managed-rule-groups.js";
+/**
+ * What the simulation covers of every managed rule it carries.
+ *
+ * This is how a reader finds out what a group does here without reading the
+ * source of it, which matters most for the rules that detect less than the AWS
+ * rule they stand for.
+ */
+export function simWafManagedRuleReports() {
+    return allSimWafManagedRules().map((entry) => ({
+        group: entry.group.name,
+        name: entry.rule.name,
+        label: simWafManagedRuleLabel(entry),
+        tier: entry.rule.tier,
+    }));
+}
+//# sourceMappingURL=sim-waf-managed-rule-report.js.map

package/dist/service/wafv2/managed/sim-waf-managed-rule-report.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"sim-waf-managed-rule-report.js","sourceRoot":"","sources":["../../../../src/service/wafv2/managed/sim-waf-managed-rule-report.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,qBAAqB,EACrB,sBAAsB,GACvB,MAAM,kCAAkC,CAAC;AAgB1C;;;;;;GAMG;AACH,MAAM,UAAU,wBAAwB;IACtC,OAAO,qBAAqB,EAAE,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC;QAC7C,KAAK,EAAE,KAAK,CAAC,KAAK,CAAC,IAAI;QACvB,IAAI,EAAE,KAAK,CAAC,IAAI,CAAC,IAAI;QACrB,KAAK,EAAE,sBAAsB,CAAC,KAAK,CAAC;QACpC,IAAI,EAAE,KAAK,CAAC,IAAI,CAAC,IAAI;KACtB,CAAC,CAAC,CAAC;AACN,CAAC"}

package/dist/service/wafv2/managed/sim-waf-managed-rule.type.d.ts

@@ -0,0 +1,48 @@
+import type { SimWafManagedRequestParts } from "./sim-waf-managed-request.js";
+/**
+ * How closely one simulated managed rule follows the AWS rule it stands for.
+ *
+ * AWS publishes every rule name, every default action, every label and the
+ * size limits, and holds back the pattern set behind each rule. What can be
+ * simulated therefore varies by rule, and each one says which it is rather
+ * than leaving a reader to find out from a request that was not blocked.
+ *
+ * - `exact` matches where the AWS rule matches. The condition is documented
+ *   in full, so there is nothing left to approximate.
+ * - `documented` matches the patterns AWS published for the rule and nothing
+ *   beyond them, so it detects less than the AWS rule does.
+ * - `declared` detects nothing at all, and matches only a request a test
+ *   declared a match for. The detection AWS runs is undocumented, and a guess
+ *   at it would block requests AWS allows.
+ */
+export type SimWafManagedRuleTier = "exact" | "documented" | "declared";
+/**
+ * Whether one managed rule claims a request.
+ */
+export type SimWafManagedDetector = (parts: SimWafManagedRequestParts) => boolean;
+/**
+ * One rule of an AWS managed rule group.
+ *
+ * Every rule in the three simulated groups blocks by default, so the action is
+ * not carried here. A rule with no detector is a declared-only rule.
+ */
+export interface SimWafManagedRuleDefinition {
+    /** The rule name, as AWS names it and as an override names it. */
+    readonly name: string;
+    /** The label this rule adds, within its group's namespace. */
+    readonly label: string;
+    readonly tier: SimWafManagedRuleTier;
+    readonly detects?: SimWafManagedDetector | undefined;
+}
+/**
+ * One AWS managed rule group, in the order its rules are evaluated.
+ */
+export interface SimWafManagedRuleGroupDefinition {
+    readonly name: string;
+    /** The prefix every label this group adds is qualified by. */
+    readonly labelNamespace: string;
+    /** The WCUs the group costs, which `DescribeManagedRuleGroup` reports. */
+    readonly capacity: number;
+    readonly rules: readonly SimWafManagedRuleDefinition[];
+}
+//# sourceMappingURL=sim-waf-managed-rule.type.d.ts.map

package/dist/service/wafv2/managed/sim-waf-managed-rule.type.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"sim-waf-managed-rule.type.d.ts","sourceRoot":"","sources":["../../../../src/service/wafv2/managed/sim-waf-managed-rule.type.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,yBAAyB,EAAE,MAAM,8BAA8B,CAAC;AAE9E;;;;;;;;;;;;;;;GAeG;AACH,MAAM,MAAM,qBAAqB,GAAG,OAAO,GAAG,YAAY,GAAG,UAAU,CAAC;AAExE;;GAEG;AACH,MAAM,MAAM,qBAAqB,GAAG,CAClC,KAAK,EAAE,yBAAyB,KAC7B,OAAO,CAAC;AAEb;;;;;GAKG;AACH,MAAM,WAAW,2BAA2B;IAC1C,kEAAkE;IAClE,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IAEtB,8DAA8D;IAC9D,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IAEvB,QAAQ,CAAC,IAAI,EAAE,qBAAqB,CAAC;IAErC,QAAQ,CAAC,OAAO,CAAC,EAAE,qBAAqB,GAAG,SAAS,CAAC;CACtD;AAED;;GAEG;AACH,MAAM,WAAW,gCAAgC;IAC/C,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IAEtB,8DAA8D;IAC9D,QAAQ,CAAC,cAAc,EAAE,MAAM,CAAC;IAEhC,0EAA0E;IAC1E,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAE1B,QAAQ,CAAC,KAAK,EAAE,SAAS,2BAA2B,EAAE,CAAC;CACxD"}

package/dist/service/wafv2/managed/sim-waf-managed-rule.type.js

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=sim-waf-managed-rule.type.js.map

package/dist/service/wafv2/managed/sim-waf-managed-rule.type.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"sim-waf-managed-rule.type.js","sourceRoot":"","sources":["../../../../src/service/wafv2/managed/sim-waf-managed-rule.type.ts"],"names":[],"mappings":""}

package/dist/service/wafv2/managed/sim-waf-managed-rules.d.ts

@@ -0,0 +1,59 @@
+import type { SimWafInspectedRequest } from "../evaluate/sim-waf-inspected-request.js";
+import { type SimWafManagedRuleReport } from "./sim-waf-managed-rule-report.js";
+import type { SimWafManagedRuleTier } from "./sim-waf-managed-rule.type.js";
+/**
+ * The managed rules a test says claim a request.
+ */
+export interface SimWafManagedMatchDeclaration {
+    /** The rules that claim the request, by the name AWS gives them. */
+    readonly matches: readonly string[];
+}
+/**
+ * The managed rule matches this simulated WAFv2 answers with, and what it
+ * covers of each rule.
+ *
+ * Most of the managed rules detect for themselves, and this is for the ones
+ * that cannot. The four `CrossSiteScripting_*` rules run detection AWS
+ * documents none of, and the rules in the documented tier match the published
+ * patterns and nothing beyond them, so a test asserting that a payload is
+ * blocked says which rule claims it:
+ *
+ * ```typescript
+ * simAws.wafV2().managedRules().onRequest("/search", {
+ *   matches: ["CrossSiteScripting_QueryArguments"],
+ * });
+ * ```
+ *
+ * A declared match is a match, and everything after it is what the group would
+ * have done anyway: the rule adds its label, an action override applies to it,
+ * and the group blocks by that rule.
+ */
+export declare class SimWafManagedRules {
+    #private;
+    /**
+     * Declare which managed rules claim a request to one URI path.
+     *
+     * The path is matched exactly, as simulated Rekognition matches the name of
+     * an image a result was declared for. A rule name no simulated group carries
+     * is refused here rather than matching nothing later.
+     */
+    onRequest(uriPath: string, declaration: SimWafManagedMatchDeclaration): void;
+    /**
+     * The rules declared to claim one request.
+     */
+    declaredMatches(request: SimWafInspectedRequest): ReadonlySet<string>;
+    /**
+     * What this simulation covers of one managed rule.
+     */
+    tierOf(ruleName: string): SimWafManagedRuleTier;
+    /**
+     * What this simulation covers of every managed rule it carries.
+     *
+     * This is how a reader finds out what a group does here without reading the
+     * source of it, which matters most for the rules that detect less than the
+     * AWS rule they stand for.
+     */
+    rules(): readonly SimWafManagedRuleReport[];
+    private requiredRule;
+}
+//# sourceMappingURL=sim-waf-managed-rules.d.ts.map