@kensio/yulin 1.17.2 → 1.18.0

package/dist/service/wafv2/statement/sim-waf-field-content.js

@@ -0,0 +1,62 @@
+import { invalidSimWafRule } from "./sim-waf-rule-refusals.js";
+/**
+ * How much of a request body, header set or cookie set WAF reads.
+ *
+ * Real WAF stops at 8 KB for a web ACL as it is created here. A CloudFront
+ * association can raise the body limit, which is settled where associations
+ * are, so this is the one figure until then.
+ */
+export const simWafInspectionLimitBytes = 8192;
+const encoder = new TextEncoder();
+const decoder = new TextDecoder();
+/**
+ * Read the oversize handling a rule named, refusing anything else.
+ */
+export function requiredSimWafOversizeHandling(handling, ruleName) {
+    const wanted = handling ?? "CONTINUE";
+    if (wanted !== "CONTINUE" && wanted !== "MATCH" && wanted !== "NO_MATCH") {
+        invalidSimWafRule(ruleName, `The oversize handling ${String(handling)} is not valid`);
+    }
+    return wanted;
+}
+/**
+ * Decide what a rule inspects, given everything the field held.
+ *
+ * Content within the limit is inspected whole. Past it, `MATCH` and `NO_MATCH`
+ * settle the statement without looking, and `CONTINUE` inspects as much as WAF
+ * would have read: whole entries while they fit, and the first entry cut to
+ * the limit when even one does not.
+ */
+export function simWafFieldContent(candidates, oversizeHandling) {
+    const encoded = candidates.map((candidate) => encoder.encode(candidate));
+    const total = encoded.reduce((sum, bytes) => sum + bytes.length, 0);
+    if (total <= simWafInspectionLimitBytes) {
+        return { outcome: "inspect", candidates };
+    }
+    if (oversizeHandling !== "CONTINUE") {
+        return { outcome: oversizeHandling === "MATCH" ? "match" : "noMatch" };
+    }
+    return { outcome: "inspect", candidates: readWithinLimit(encoded) };
+}
+/**
+ * The content WAF would have read before it stopped.
+ */
+function readWithinLimit(encoded) {
+    const read = [];
+    let budget = simWafInspectionLimitBytes;
+    for (const bytes of encoded) {
+        if (budget === 0) {
+            break;
+        }
+        if (bytes.length > budget) {
+            // An entry over the remaining budget is cut where WAF stopped reading,
+            // which for a body is the only case that happens.
+            read.push(decoder.decode(bytes.subarray(0, budget)));
+            break;
+        }
+        read.push(decoder.decode(bytes));
+        budget -= bytes.length;
+    }
+    return read;
+}
+//# sourceMappingURL=sim-waf-field-content.js.map

package/dist/service/wafv2/statement/sim-waf-field-content.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"sim-waf-field-content.js","sourceRoot":"","sources":["../../../../src/service/wafv2/statement/sim-waf-field-content.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,iBAAiB,EAAE,MAAM,4BAA4B,CAAC;AAe/D;;;;;;GAMG;AACH,MAAM,CAAC,MAAM,0BAA0B,GAAG,IAAI,CAAC;AAO/C,MAAM,OAAO,GAAG,IAAI,WAAW,EAAE,CAAC;AAClC,MAAM,OAAO,GAAG,IAAI,WAAW,EAAE,CAAC;AAElC;;GAEG;AACH,MAAM,UAAU,8BAA8B,CAC5C,QAA4B,EAC5B,QAAgB;IAEhB,MAAM,MAAM,GAAG,QAAQ,IAAI,UAAU,CAAC;IAEtC,IAAI,MAAM,KAAK,UAAU,IAAI,MAAM,KAAK,OAAO,IAAI,MAAM,KAAK,UAAU,EAAE,CAAC;QACzE,iBAAiB,CACf,QAAQ,EACR,yBAAyB,MAAM,CAAC,QAAQ,CAAC,eAAe,CACzD,CAAC;IACJ,CAAC;IAED,OAAO,MAAM,CAAC;AAChB,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,UAAU,kBAAkB,CAChC,UAA6B,EAC7B,gBAAwC;IAExC,MAAM,OAAO,GAAG,UAAU,CAAC,GAAG,CAAC,CAAC,SAAS,EAAE,EAAE,CAAC,OAAO,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC,CAAC;IACzE,MAAM,KAAK,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC,GAAG,EAAE,KAAK,EAAE,EAAE,CAAC,GAAG,GAAG,KAAK,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC;IAEpE,IAAI,KAAK,IAAI,0BAA0B,EAAE,CAAC;QACxC,OAAO,EAAE,OAAO,EAAE,SAAS,EAAE,UAAU,EAAE,CAAC;IAC5C,CAAC;IAED,IAAI,gBAAgB,KAAK,UAAU,EAAE,CAAC;QACpC,OAAO,EAAE,OAAO,EAAE,gBAAgB,KAAK,OAAO,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,SAAS,EAAE,CAAC;IACzE,CAAC;IAED,OAAO,EAAE,OAAO,EAAE,SAAS,EAAE,UAAU,EAAE,eAAe,CAAC,OAAO,CAAC,EAAE,CAAC;AACtE,CAAC;AAED;;GAEG;AACH,SAAS,eAAe,CAAC,OAA8B;IACrD,MAAM,IAAI,GAAa,EAAE,CAAC;IAC1B,IAAI,MAAM,GAAG,0BAA0B,CAAC;IAExC,KAAK,MAAM,KAAK,IAAI,OAAO,EAAE,CAAC;QAC5B,IAAI,MAAM,KAAK,CAAC,EAAE,CAAC;YACjB,MAAM;QACR,CAAC;QAED,IAAI,KAAK,CAAC,MAAM,GAAG,MAAM,EAAE,CAAC;YAC1B,uEAAuE;YACvE,kDAAkD;YAClD,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC,EAAE,MAAM,CAAC,CAAC,CAAC,CAAC;YACrD,MAAM;QACR,CAAC;QAED,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC;QACjC,MAAM,IAAI,KAAK,CAAC,MAAM,CAAC;IACzB,CAAC;IAED,OAAO,IAAI,CAAC;AACd,CAAC"}

package/dist/service/wafv2/statement/sim-waf-field-match.d.ts

@@ -0,0 +1,29 @@
+import type { SimWafInspectedRequest } from "../evaluate/sim-waf-inspected-request.js";
+import type { SimWafFieldToMatchInput } from "./sim-waf-field-to-match.type.js";
+import { type SimWafTextTransformationInput } from "./sim-waf-text-transformation.js";
+/**
+ * Whether one statement claims a request.
+ */
+export type SimWafMatcher = (request: SimWafInspectedRequest) => boolean;
+/**
+ * Whether one string a field held is what a statement is looking for.
+ */
+export type SimWafValueTest = (value: string) => boolean;
+/**
+ * What the three statement kinds that read a request field have in common.
+ */
+export interface SimWafFieldMatcherProperties {
+    readonly field: SimWafFieldToMatchInput | undefined;
+    readonly transformations: readonly SimWafTextTransformationInput[] | undefined;
+    readonly ruleName: string;
+    readonly test: SimWafValueTest;
+}
+/**
+ * Build the matcher for a statement that reads one request field.
+ *
+ * A field can hold more than one string, and WAF matches a statement when any
+ * of them matches: one header out of the set a pattern selected is enough, and
+ * so is one query argument out of all of them.
+ */
+export declare function compileSimWafFieldMatcher(properties: SimWafFieldMatcherProperties): SimWafMatcher;
+//# sourceMappingURL=sim-waf-field-match.d.ts.map

package/dist/service/wafv2/statement/sim-waf-field-match.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"sim-waf-field-match.d.ts","sourceRoot":"","sources":["../../../../src/service/wafv2/statement/sim-waf-field-match.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,sBAAsB,EAAE,MAAM,0CAA0C,CAAC;AAEvF,OAAO,KAAK,EAAE,uBAAuB,EAAE,MAAM,kCAAkC,CAAC;AAChF,OAAO,EAEL,KAAK,6BAA6B,EACnC,MAAM,kCAAkC,CAAC;AAE1C;;GAEG;AACH,MAAM,MAAM,aAAa,GAAG,CAAC,OAAO,EAAE,sBAAsB,KAAK,OAAO,CAAC;AAEzE;;GAEG;AACH,MAAM,MAAM,eAAe,GAAG,CAAC,KAAK,EAAE,MAAM,KAAK,OAAO,CAAC;AAEzD;;GAEG;AACH,MAAM,WAAW,4BAA4B;IAC3C,QAAQ,CAAC,KAAK,EAAE,uBAAuB,GAAG,SAAS,CAAC;IACpD,QAAQ,CAAC,eAAe,EACpB,SAAS,6BAA6B,EAAE,GACxC,SAAS,CAAC;IACd,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B,QAAQ,CAAC,IAAI,EAAE,eAAe,CAAC;CAChC;AAED;;;;;;GAMG;AACH,wBAAgB,yBAAyB,CACvC,UAAU,EAAE,4BAA4B,GACvC,aAAa,CAef"}

package/dist/service/wafv2/statement/sim-waf-field-match.js

@@ -0,0 +1,21 @@
+import { compileSimWafFieldToMatch } from "./sim-waf-field-to-match.js";
+import { compileSimWafTextTransformations, } from "./sim-waf-text-transformation.js";
+/**
+ * Build the matcher for a statement that reads one request field.
+ *
+ * A field can hold more than one string, and WAF matches a statement when any
+ * of them matches: one header out of the set a pattern selected is enough, and
+ * so is one query argument out of all of them.
+ */
+export function compileSimWafFieldMatcher(properties) {
+    const read = compileSimWafFieldToMatch(properties.field, properties.ruleName);
+    const transform = compileSimWafTextTransformations(properties.transformations, properties.ruleName);
+    const { test } = properties;
+    return (request) => {
+        const content = read(request);
+        return content.outcome === "inspect"
+            ? content.candidates.some((candidate) => test(transform(candidate)))
+            : content.outcome === "match";
+    };
+}
+//# sourceMappingURL=sim-waf-field-match.js.map

package/dist/service/wafv2/statement/sim-waf-field-match.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"sim-waf-field-match.js","sourceRoot":"","sources":["../../../../src/service/wafv2/statement/sim-waf-field-match.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,yBAAyB,EAAE,MAAM,6BAA6B,CAAC;AAExE,OAAO,EACL,gCAAgC,GAEjC,MAAM,kCAAkC,CAAC;AAwB1C;;;;;;GAMG;AACH,MAAM,UAAU,yBAAyB,CACvC,UAAwC;IAExC,MAAM,IAAI,GAAG,yBAAyB,CAAC,UAAU,CAAC,KAAK,EAAE,UAAU,CAAC,QAAQ,CAAC,CAAC;IAC9E,MAAM,SAAS,GAAG,gCAAgC,CAChD,UAAU,CAAC,eAAe,EAC1B,UAAU,CAAC,QAAQ,CACpB,CAAC;IACF,MAAM,EAAE,IAAI,EAAE,GAAG,UAAU,CAAC;IAE5B,OAAO,CAAC,OAAO,EAAW,EAAE;QAC1B,MAAM,OAAO,GAAG,IAAI,CAAC,OAAO,CAAC,CAAC;QAE9B,OAAO,OAAO,CAAC,OAAO,KAAK,SAAS;YAClC,CAAC,CAAC,OAAO,CAAC,UAAU,CAAC,IAAI,CAAC,CAAC,SAAS,EAAE,EAAE,CAAC,IAAI,CAAC,SAAS,CAAC,SAAS,CAAC,CAAC,CAAC;YACpE,CAAC,CAAC,OAAO,CAAC,OAAO,KAAK,OAAO,CAAC;IAClC,CAAC,CAAC;AACJ,CAAC"}

package/dist/service/wafv2/statement/sim-waf-field-to-match.d.ts

@@ -0,0 +1,17 @@
+import type { SimWafInspectedRequest } from "../evaluate/sim-waf-inspected-request.js";
+import type { SimWafFieldContent } from "./sim-waf-field-content.js";
+import type { SimWafFieldToMatchInput } from "./sim-waf-field-to-match.type.js";
+/**
+ * How a compiled rule reads the field it inspects.
+ */
+export type SimWafFieldReader = (request: SimWafInspectedRequest) => SimWafFieldContent;
+/**
+ * Build the reader a rule uses to get at the part of a request it inspects.
+ *
+ * A reader answers with every string the field held, because several of the
+ * field kinds hold more than one: all the query arguments, all the headers a
+ * pattern selected. A statement matches when any of them matches, which is
+ * what WAF does.
+ */
+export declare function compileSimWafFieldToMatch(field: SimWafFieldToMatchInput | undefined, ruleName: string): SimWafFieldReader;
+//# sourceMappingURL=sim-waf-field-to-match.d.ts.map

package/dist/service/wafv2/statement/sim-waf-field-to-match.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"sim-waf-field-to-match.d.ts","sourceRoot":"","sources":["../../../../src/service/wafv2/statement/sim-waf-field-to-match.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,sBAAsB,EAAE,MAAM,0CAA0C,CAAC;AACvF,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,4BAA4B,CAAC;AACrE,OAAO,KAAK,EACV,uBAAuB,EAExB,MAAM,kCAAkC,CAAC;AAS1C;;GAEG;AACH,MAAM,MAAM,iBAAiB,GAAG,CAC9B,OAAO,EAAE,sBAAsB,KAC5B,kBAAkB,CAAC;AAExB;;;;;;;GAOG;AACH,wBAAgB,yBAAyB,CACvC,KAAK,EAAE,uBAAuB,GAAG,SAAS,EAC1C,QAAQ,EAAE,MAAM,GACf,iBAAiB,CAQnB"}

package/dist/service/wafv2/statement/sim-waf-field-to-match.js

@@ -0,0 +1,74 @@
+import { compileSimWafSetField } from "./sim-waf-set-field.js";
+import { simWafQueryArguments, } from "./sim-waf-request-fields.js";
+import { invalidSimWafRule } from "./sim-waf-rule-refusals.js";
+import { refuseUnsimulatedSimWafField } from "./sim-waf-unsimulated-field.js";
+/**
+ * Build the reader a rule uses to get at the part of a request it inspects.
+ *
+ * A reader answers with every string the field held, because several of the
+ * field kinds hold more than one: all the query arguments, all the headers a
+ * pattern selected. A statement matches when any of them matches, which is
+ * what WAF does.
+ */
+export function compileSimWafFieldToMatch(field, ruleName) {
+    if (field === undefined) {
+        invalidSimWafRule(ruleName, "FieldToMatch is required");
+    }
+    refuseUnsimulatedSimWafField(field, ruleName);
+    return compileWholeField(field, ruleName);
+}
+/**
+ * The fields that are read whole, with nothing to select within them.
+ */
+function compileWholeField(field, ruleName) {
+    if (field.UriPath !== undefined) {
+        return (request) => inspect([request.uriPath]);
+    }
+    if (field.QueryString !== undefined) {
+        return (request) => inspect([request.queryString]);
+    }
+    if (field.Method !== undefined) {
+        return (request) => inspect([request.method]);
+    }
+    if (field.AllQueryArguments !== undefined) {
+        return (request) => inspect(values(simWafQueryArguments(request.queryString)));
+    }
+    return compileNamedField(field, ruleName);
+}
+/**
+ * The fields that name what they read within a set.
+ */
+function compileNamedField(field, ruleName) {
+    if (field.SingleQueryArgument !== undefined) {
+        const wanted = requiredName(field.SingleQueryArgument, ruleName);
+        return (request) => inspect(values(simWafQueryArguments(request.queryString).filter((argument) => argument.name === wanted)));
+    }
+    if (field.SingleHeader !== undefined) {
+        const wanted = requiredName(field.SingleHeader, ruleName);
+        return (request) => inspect(headerValues(request.headers, wanted));
+    }
+    return compileSimWafSetField(field, ruleName);
+}
+function inspect(candidates) {
+    return { outcome: "inspect", candidates };
+}
+function values(entries) {
+    return entries.map((entry) => entry.value);
+}
+/**
+ * Every value a header carries.
+ *
+ * The Headers class joins repeats with a comma, and WAF inspects the joined
+ * value the same way, so this is one candidate or none.
+ */
+function headerValues(headers, name) {
+    const value = headers.get(name);
+    return value === null ? [] : [value];
+}
+function requiredName(field, ruleName) {
+    if (field.Name === undefined || field.Name === "") {
+        invalidSimWafRule(ruleName, "The field to match needs a Name");
+    }
+    return field.Name.toLowerCase();
+}
+//# sourceMappingURL=sim-waf-field-to-match.js.map

package/dist/service/wafv2/statement/sim-waf-field-to-match.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"sim-waf-field-to-match.js","sourceRoot":"","sources":["../../../../src/service/wafv2/statement/sim-waf-field-to-match.ts"],"names":[],"mappings":"AAMA,OAAO,EAAE,qBAAqB,EAAE,MAAM,wBAAwB,CAAC;AAC/D,OAAO,EAEL,oBAAoB,GACrB,MAAM,6BAA6B,CAAC;AACrC,OAAO,EAAE,iBAAiB,EAAE,MAAM,4BAA4B,CAAC;AAC/D,OAAO,EAAE,4BAA4B,EAAE,MAAM,gCAAgC,CAAC;AAS9E;;;;;;;GAOG;AACH,MAAM,UAAU,yBAAyB,CACvC,KAA0C,EAC1C,QAAgB;IAEhB,IAAI,KAAK,KAAK,SAAS,EAAE,CAAC;QACxB,iBAAiB,CAAC,QAAQ,EAAE,0BAA0B,CAAC,CAAC;IAC1D,CAAC;IAED,4BAA4B,CAAC,KAAK,EAAE,QAAQ,CAAC,CAAC;IAE9C,OAAO,iBAAiB,CAAC,KAAK,EAAE,QAAQ,CAAC,CAAC;AAC5C,CAAC;AAED;;GAEG;AACH,SAAS,iBAAiB,CACxB,KAA8B,EAC9B,QAAgB;IAEhB,IAAI,KAAK,CAAC,OAAO,KAAK,SAAS,EAAE,CAAC;QAChC,OAAO,CAAC,OAAO,EAAsB,EAAE,CAAC,OAAO,CAAC,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC,CAAC;IACrE,CAAC;IAED,IAAI,KAAK,CAAC,WAAW,KAAK,SAAS,EAAE,CAAC;QACpC,OAAO,CAAC,OAAO,EAAsB,EAAE,CAAC,OAAO,CAAC,CAAC,OAAO,CAAC,WAAW,CAAC,CAAC,CAAC;IACzE,CAAC;IAED,IAAI,KAAK,CAAC,MAAM,KAAK,SAAS,EAAE,CAAC;QAC/B,OAAO,CAAC,OAAO,EAAsB,EAAE,CAAC,OAAO,CAAC,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC;IACpE,CAAC;IAED,IAAI,KAAK,CAAC,iBAAiB,KAAK,SAAS,EAAE,CAAC;QAC1C,OAAO,CAAC,OAAO,EAAsB,EAAE,CACrC,OAAO,CAAC,MAAM,CAAC,oBAAoB,CAAC,OAAO,CAAC,WAAW,CAAC,CAAC,CAAC,CAAC;IAC/D,CAAC;IAED,OAAO,iBAAiB,CAAC,KAAK,EAAE,QAAQ,CAAC,CAAC;AAC5C,CAAC;AAED;;GAEG;AACH,SAAS,iBAAiB,CACxB,KAA8B,EAC9B,QAAgB;IAEhB,IAAI,KAAK,CAAC,mBAAmB,KAAK,SAAS,EAAE,CAAC;QAC5C,MAAM,MAAM,GAAG,YAAY,CAAC,KAAK,CAAC,mBAAmB,EAAE,QAAQ,CAAC,CAAC;QAEjE,OAAO,CAAC,OAAO,EAAsB,EAAE,CACrC,OAAO,CACL,MAAM,CACJ,oBAAoB,CAAC,OAAO,CAAC,WAAW,CAAC,CAAC,MAAM,CAC9C,CAAC,QAAQ,EAAE,EAAE,CAAC,QAAQ,CAAC,IAAI,KAAK,MAAM,CACvC,CACF,CACF,CAAC;IACN,CAAC;IAED,IAAI,KAAK,CAAC,YAAY,KAAK,SAAS,EAAE,CAAC;QACrC,MAAM,MAAM,GAAG,YAAY,CAAC,KAAK,CAAC,YAAY,EAAE,QAAQ,CAAC,CAAC;QAE1D,OAAO,CAAC,OAAO,EAAsB,EAAE,CACrC,OAAO,CAAC,YAAY,CAAC,OAAO,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC,CAAC;IACnD,CAAC;IAED,OAAO,qBAAqB,CAAC,KAAK,EAAE,QAAQ,CAAC,CAAC;AAChD,CAAC;AAED,SAAS,OAAO,CAAC,UAA6B;IAC5C,OAAO,EAAE,OAAO,EAAE,SAAS,EAAE,UAAU,EAAE,CAAC;AAC5C,CAAC;AAED,SAAS,MAAM,CAAC,OAAmC;IACjD,OAAO,OAAO,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC;AAC7C,CAAC;AAED;;;;;GAKG;AACH,SAAS,YAAY,CAAC,OAAgB,EAAE,IAAY;IAClD,MAAM,KAAK,GAAG,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;IAEhC,OAAO,KAAK,KAAK,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC;AACvC,CAAC;AAED,SAAS,YAAY,CAAC,KAA4B,EAAE,QAAgB;IAClE,IAAI,KAAK,CAAC,IAAI,KAAK,SAAS,IAAI,KAAK,CAAC,IAAI,KAAK,EAAE,EAAE,CAAC;QAClD,iBAAiB,CAAC,QAAQ,EAAE,iCAAiC,CAAC,CAAC;IACjE,CAAC;IAED,OAAO,KAAK,CAAC,IAAI,CAAC,WAAW,EAAE,CAAC;AAClC,CAAC"}

package/dist/service/wafv2/statement/sim-waf-field-to-match.type.d.ts

@@ -0,0 +1,42 @@
+import type { SimWafMatchPatternInput } from "./sim-waf-match-pattern.js";
+/**
+ * The parts of a request a WAFv2 rule can be pointed at, in the API's own
+ * shape.
+ *
+ * The members Yulin does not simulate are declared here rather than left out,
+ * so a rule that names one is refused by name instead of being read as a rule
+ * with no field at all.
+ */
+export interface SimWafFieldToMatchInput {
+    readonly UriPath?: unknown;
+    readonly QueryString?: unknown;
+    readonly Method?: unknown;
+    readonly AllQueryArguments?: unknown;
+    readonly SingleQueryArgument?: SimWafNamedFieldInput | undefined;
+    readonly SingleHeader?: SimWafNamedFieldInput | undefined;
+    readonly Headers?: SimWafHeadersFieldInput | undefined;
+    readonly Cookies?: SimWafHeadersFieldInput | undefined;
+    readonly Body?: {
+        readonly OversizeHandling?: string | undefined;
+    } | undefined;
+    readonly JsonBody?: unknown;
+    readonly HeaderOrder?: unknown;
+    readonly JA3Fingerprint?: unknown;
+    readonly JA4Fingerprint?: unknown;
+    readonly UriFragment?: unknown;
+}
+/**
+ * A field that names the one header or query argument it reads.
+ */
+export interface SimWafNamedFieldInput {
+    readonly Name?: string | undefined;
+}
+/**
+ * A field that reads a set of headers or cookies.
+ */
+export interface SimWafHeadersFieldInput {
+    readonly MatchPattern?: SimWafMatchPatternInput | undefined;
+    readonly MatchScope?: string | undefined;
+    readonly OversizeHandling?: string | undefined;
+}
+//# sourceMappingURL=sim-waf-field-to-match.type.d.ts.map

package/dist/service/wafv2/statement/sim-waf-field-to-match.type.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"sim-waf-field-to-match.type.d.ts","sourceRoot":"","sources":["../../../../src/service/wafv2/statement/sim-waf-field-to-match.type.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,uBAAuB,EAAE,MAAM,4BAA4B,CAAC;AAE1E;;;;;;;GAOG;AACH,MAAM,WAAW,uBAAuB;IACtC,QAAQ,CAAC,OAAO,CAAC,EAAE,OAAO,CAAC;IAC3B,QAAQ,CAAC,WAAW,CAAC,EAAE,OAAO,CAAC;IAC/B,QAAQ,CAAC,MAAM,CAAC,EAAE,OAAO,CAAC;IAC1B,QAAQ,CAAC,iBAAiB,CAAC,EAAE,OAAO,CAAC;IACrC,QAAQ,CAAC,mBAAmB,CAAC,EAAE,qBAAqB,GAAG,SAAS,CAAC;IACjE,QAAQ,CAAC,YAAY,CAAC,EAAE,qBAAqB,GAAG,SAAS,CAAC;IAC1D,QAAQ,CAAC,OAAO,CAAC,EAAE,uBAAuB,GAAG,SAAS,CAAC;IACvD,QAAQ,CAAC,OAAO,CAAC,EAAE,uBAAuB,GAAG,SAAS,CAAC;IACvD,QAAQ,CAAC,IAAI,CAAC,EACV;QAAE,QAAQ,CAAC,gBAAgB,CAAC,EAAE,MAAM,GAAG,SAAS,CAAA;KAAE,GAClD,SAAS,CAAC;IACd,QAAQ,CAAC,QAAQ,CAAC,EAAE,OAAO,CAAC;IAC5B,QAAQ,CAAC,WAAW,CAAC,EAAE,OAAO,CAAC;IAC/B,QAAQ,CAAC,cAAc,CAAC,EAAE,OAAO,CAAC;IAClC,QAAQ,CAAC,cAAc,CAAC,EAAE,OAAO,CAAC;IAClC,QAAQ,CAAC,WAAW,CAAC,EAAE,OAAO,CAAC;CAChC;AAED;;GAEG;AACH,MAAM,WAAW,qBAAqB;IACpC,QAAQ,CAAC,IAAI,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;CACpC;AAED;;GAEG;AACH,MAAM,WAAW,uBAAuB;IACtC,QAAQ,CAAC,YAAY,CAAC,EAAE,uBAAuB,GAAG,SAAS,CAAC;IAC5D,QAAQ,CAAC,UAAU,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IACzC,QAAQ,CAAC,gBAAgB,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;CAChD"}

package/dist/service/wafv2/statement/sim-waf-field-to-match.type.js

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=sim-waf-field-to-match.type.js.map

package/dist/service/wafv2/statement/sim-waf-field-to-match.type.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"sim-waf-field-to-match.type.js","sourceRoot":"","sources":["../../../../src/service/wafv2/statement/sim-waf-field-to-match.type.ts"],"names":[],"mappings":""}

package/dist/service/wafv2/statement/sim-waf-label-match.d.ts

@@ -0,0 +1,22 @@
+import type { SimWafMatcher } from "./sim-waf-field-match.js";
+/**
+ * Minimal structural WAFv2 LabelMatchStatement.
+ */
+export interface SimWafLabelMatchStatementInput {
+    readonly Scope?: string | undefined;
+    readonly Key?: string | undefined;
+}
+/**
+ * Build the matcher for a statement that reads the labels a request picked up.
+ *
+ * The labels come from the rules that already ran, so a label match reads what
+ * the rules at lower priorities left behind. That is the whole of the pattern
+ * teams tune a managed rule group with: run the group in count mode, and block
+ * on the label of the one rule in it that matters.
+ *
+ * A `LABEL` scope matches the fully qualified name of one label, and a
+ * `NAMESPACE` scope matches every label under a prefix, so one rule can block
+ * on anything the core rule set claimed.
+ */
+export declare function compileSimWafLabelMatch(statement: SimWafLabelMatchStatementInput, ruleName: string): SimWafMatcher;
+//# sourceMappingURL=sim-waf-label-match.d.ts.map

package/dist/service/wafv2/statement/sim-waf-label-match.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"sim-waf-label-match.d.ts","sourceRoot":"","sources":["../../../../src/service/wafv2/statement/sim-waf-label-match.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,0BAA0B,CAAC;AAG9D;;GAEG;AACH,MAAM,WAAW,8BAA8B;IAC7C,QAAQ,CAAC,KAAK,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IACpC,QAAQ,CAAC,GAAG,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;CACnC;AAED;;;;;;;;;;;GAWG;AACH,wBAAgB,uBAAuB,CACrC,SAAS,EAAE,8BAA8B,EACzC,QAAQ,EAAE,MAAM,GACf,aAAa,CAmBf"}

package/dist/service/wafv2/statement/sim-waf-label-match.js

@@ -0,0 +1,27 @@
+import { invalidSimWafRule } from "./sim-waf-rule-refusals.js";
+/**
+ * Build the matcher for a statement that reads the labels a request picked up.
+ *
+ * The labels come from the rules that already ran, so a label match reads what
+ * the rules at lower priorities left behind. That is the whole of the pattern
+ * teams tune a managed rule group with: run the group in count mode, and block
+ * on the label of the one rule in it that matters.
+ *
+ * A `LABEL` scope matches the fully qualified name of one label, and a
+ * `NAMESPACE` scope matches every label under a prefix, so one rule can block
+ * on anything the core rule set claimed.
+ */
+export function compileSimWafLabelMatch(statement, ruleName) {
+    const { Key: key, Scope: scope } = statement;
+    if (key === undefined || key === "") {
+        invalidSimWafRule(ruleName, "A LabelMatchStatement needs a Key to match");
+    }
+    if (scope === "LABEL") {
+        return (request) => request.labels.has(key);
+    }
+    if (scope === "NAMESPACE") {
+        return (request) => request.labels.hasNamespace(key);
+    }
+    invalidSimWafRule(ruleName, `The label match scope ${String(scope)} is LABEL or NAMESPACE`);
+}
+//# sourceMappingURL=sim-waf-label-match.js.map

package/dist/service/wafv2/statement/sim-waf-label-match.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"sim-waf-label-match.js","sourceRoot":"","sources":["../../../../src/service/wafv2/statement/sim-waf-label-match.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,iBAAiB,EAAE,MAAM,4BAA4B,CAAC;AAU/D;;;;;;;;;;;GAWG;AACH,MAAM,UAAU,uBAAuB,CACrC,SAAyC,EACzC,QAAgB;IAEhB,MAAM,EAAE,GAAG,EAAE,GAAG,EAAE,KAAK,EAAE,KAAK,EAAE,GAAG,SAAS,CAAC;IAE7C,IAAI,GAAG,KAAK,SAAS,IAAI,GAAG,KAAK,EAAE,EAAE,CAAC;QACpC,iBAAiB,CAAC,QAAQ,EAAE,4CAA4C,CAAC,CAAC;IAC5E,CAAC;IAED,IAAI,KAAK,KAAK,OAAO,EAAE,CAAC;QACtB,OAAO,CAAC,OAAO,EAAW,EAAE,CAAC,OAAO,CAAC,MAAM,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;IACvD,CAAC;IAED,IAAI,KAAK,KAAK,WAAW,EAAE,CAAC;QAC1B,OAAO,CAAC,OAAO,EAAW,EAAE,CAAC,OAAO,CAAC,MAAM,CAAC,YAAY,CAAC,GAAG,CAAC,CAAC;IAChE,CAAC;IAED,iBAAiB,CACf,QAAQ,EACR,yBAAyB,MAAM,CAAC,KAAK,CAAC,wBAAwB,CAC/D,CAAC;AACJ,CAAC"}

package/dist/service/wafv2/statement/sim-waf-logical-statement.d.ts

@@ -0,0 +1,11 @@
+import { type SimWafStatementScope } from "./sim-waf-statement.js";
+import type { SimWafMatcher } from "./sim-waf-field-match.js";
+import type { SimWafStatementInput } from "./sim-waf-statement.type.js";
+/**
+ * Build the matcher for a statement that joins or negates other statements.
+ *
+ * These are the last kinds tried, because a statement that is none of them and
+ * none of the field statements either names no kind at all.
+ */
+export declare function compileSimWafLogicalStatement(statement: SimWafStatementInput, scope: SimWafStatementScope): SimWafMatcher;
+//# sourceMappingURL=sim-waf-logical-statement.d.ts.map

package/dist/service/wafv2/statement/sim-waf-logical-statement.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"sim-waf-logical-statement.d.ts","sourceRoot":"","sources":["../../../../src/service/wafv2/statement/sim-waf-logical-statement.ts"],"names":[],"mappings":"AAAA,OAAO,EAEL,KAAK,oBAAoB,EAC1B,MAAM,wBAAwB,CAAC;AAChC,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,0BAA0B,CAAC;AAE9D,OAAO,KAAK,EAAE,oBAAoB,EAAE,MAAM,6BAA6B,CAAC;AAExE;;;;;GAKG;AACH,wBAAgB,6BAA6B,CAC3C,SAAS,EAAE,oBAAoB,EAC/B,KAAK,EAAE,oBAAoB,GAC1B,aAAa,CAuBf"}

package/dist/service/wafv2/statement/sim-waf-logical-statement.js

@@ -0,0 +1,36 @@
+import { compileSimWafStatement, } from "./sim-waf-statement.js";
+import { invalidSimWafRule } from "./sim-waf-rule-refusals.js";
+/**
+ * Build the matcher for a statement that joins or negates other statements.
+ *
+ * These are the last kinds tried, because a statement that is none of them and
+ * none of the field statements either names no kind at all.
+ */
+export function compileSimWafLogicalStatement(statement, scope) {
+    if (statement.AndStatement !== undefined) {
+        const matchers = compileAll(statement.AndStatement.Statements, scope);
+        return (request) => matchers.every((matches) => matches(request));
+    }
+    if (statement.OrStatement !== undefined) {
+        const matchers = compileAll(statement.OrStatement.Statements, scope);
+        return (request) => matchers.some((matches) => matches(request));
+    }
+    if (statement.NotStatement !== undefined) {
+        const matches = compileSimWafStatement(statement.NotStatement.Statement, scope);
+        return (request) => !matches(request);
+    }
+    invalidSimWafRule(scope.ruleName, "The statement names no statement kind");
+}
+/**
+ * Compile the statements a logical statement joins, refusing an empty list.
+ *
+ * Real WAF requires at least two, and an `AndStatement` with none would
+ * otherwise match every request while looking like it narrowed one.
+ */
+function compileAll(statements, scope) {
+    if (statements === undefined || statements.length === 0) {
+        invalidSimWafRule(scope.ruleName, "An AndStatement or OrStatement needs statements to join");
+    }
+    return statements.map((statement) => compileSimWafStatement(statement, scope));
+}
+//# sourceMappingURL=sim-waf-logical-statement.js.map

package/dist/service/wafv2/statement/sim-waf-logical-statement.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"sim-waf-logical-statement.js","sourceRoot":"","sources":["../../../../src/service/wafv2/statement/sim-waf-logical-statement.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,sBAAsB,GAEvB,MAAM,wBAAwB,CAAC;AAEhC,OAAO,EAAE,iBAAiB,EAAE,MAAM,4BAA4B,CAAC;AAG/D;;;;;GAKG;AACH,MAAM,UAAU,6BAA6B,CAC3C,SAA+B,EAC/B,KAA2B;IAE3B,IAAI,SAAS,CAAC,YAAY,KAAK,SAAS,EAAE,CAAC;QACzC,MAAM,QAAQ,GAAG,UAAU,CAAC,SAAS,CAAC,YAAY,CAAC,UAAU,EAAE,KAAK,CAAC,CAAC;QAEtE,OAAO,CAAC,OAAO,EAAW,EAAE,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC,CAAC;IAC7E,CAAC;IAED,IAAI,SAAS,CAAC,WAAW,KAAK,SAAS,EAAE,CAAC;QACxC,MAAM,QAAQ,GAAG,UAAU,CAAC,SAAS,CAAC,WAAW,CAAC,UAAU,EAAE,KAAK,CAAC,CAAC;QAErE,OAAO,CAAC,OAAO,EAAW,EAAE,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC,CAAC;IAC5E,CAAC;IAED,IAAI,SAAS,CAAC,YAAY,KAAK,SAAS,EAAE,CAAC;QACzC,MAAM,OAAO,GAAG,sBAAsB,CACpC,SAAS,CAAC,YAAY,CAAC,SAAS,EAChC,KAAK,CACN,CAAC;QAEF,OAAO,CAAC,OAAO,EAAW,EAAE,CAAC,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC;IACjD,CAAC;IAED,iBAAiB,CAAC,KAAK,CAAC,QAAQ,EAAE,uCAAuC,CAAC,CAAC;AAC7E,CAAC;AAED;;;;;GAKG;AACH,SAAS,UAAU,CACjB,UAAuD,EACvD,KAA2B;IAE3B,IAAI,UAAU,KAAK,SAAS,IAAI,UAAU,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACxD,iBAAiB,CACf,KAAK,CAAC,QAAQ,EACd,yDAAyD,CAC1D,CAAC;IACJ,CAAC;IAED,OAAO,UAAU,CAAC,GAAG,CAAC,CAAC,SAAS,EAAE,EAAE,CAClC,sBAAsB,CAAC,SAAS,EAAE,KAAK,CAAC,CACzC,CAAC;AACJ,CAAC"}

package/dist/service/wafv2/statement/sim-waf-match-pattern.d.ts

@@ -0,0 +1,28 @@
+/**
+ * Which headers or cookies a rule reads.
+ */
+export interface SimWafMatchPatternInput {
+    readonly All?: unknown;
+    readonly IncludedHeaders?: readonly string[] | undefined;
+    readonly ExcludedHeaders?: readonly string[] | undefined;
+    readonly IncludedCookies?: readonly string[] | undefined;
+    readonly ExcludedCookies?: readonly string[] | undefined;
+}
+/**
+ * Which of a request's headers or cookies a rule reads.
+ */
+export interface SimWafPatternSelection {
+    readonly included: ReadonlySet<string> | undefined;
+    readonly excluded: ReadonlySet<string> | undefined;
+}
+/**
+ * Read the pattern a rule selects headers or cookies with, refusing anything
+ * else.
+ *
+ * Real WAFv2 takes one of `All`, an included list or an excluded list, and a
+ * list has to name something. A pattern naming two of them, or none, or an
+ * empty list, would leave which headers the rule read up to the order they
+ * happen to be checked in.
+ */
+export declare function requiredSimWafPatternSelection(pattern: SimWafMatchPatternInput | undefined, ruleName: string): SimWafPatternSelection;
+//# sourceMappingURL=sim-waf-match-pattern.d.ts.map

package/dist/service/wafv2/statement/sim-waf-match-pattern.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"sim-waf-match-pattern.d.ts","sourceRoot":"","sources":["../../../../src/service/wafv2/statement/sim-waf-match-pattern.ts"],"names":[],"mappings":"AAEA;;GAEG;AACH,MAAM,WAAW,uBAAuB;IACtC,QAAQ,CAAC,GAAG,CAAC,EAAE,OAAO,CAAC;IACvB,QAAQ,CAAC,eAAe,CAAC,EAAE,SAAS,MAAM,EAAE,GAAG,SAAS,CAAC;IACzD,QAAQ,CAAC,eAAe,CAAC,EAAE,SAAS,MAAM,EAAE,GAAG,SAAS,CAAC;IACzD,QAAQ,CAAC,eAAe,CAAC,EAAE,SAAS,MAAM,EAAE,GAAG,SAAS,CAAC;IACzD,QAAQ,CAAC,eAAe,CAAC,EAAE,SAAS,MAAM,EAAE,GAAG,SAAS,CAAC;CAC1D;AAED;;GAEG;AACH,MAAM,WAAW,sBAAsB;IACrC,QAAQ,CAAC,QAAQ,EAAE,WAAW,CAAC,MAAM,CAAC,GAAG,SAAS,CAAC;IACnD,QAAQ,CAAC,QAAQ,EAAE,WAAW,CAAC,MAAM,CAAC,GAAG,SAAS,CAAC;CACpD;AAED;;;;;;;;GAQG;AACH,wBAAgB,8BAA8B,CAC5C,OAAO,EAAE,uBAAuB,GAAG,SAAS,EAC5C,QAAQ,EAAE,MAAM,GACf,sBAAsB,CAkBxB"}

package/dist/service/wafv2/statement/sim-waf-match-pattern.js

@@ -0,0 +1,26 @@
+import { invalidSimWafRule } from "./sim-waf-rule-refusals.js";
+/**
+ * Read the pattern a rule selects headers or cookies with, refusing anything
+ * else.
+ *
+ * Real WAFv2 takes one of `All`, an included list or an excluded list, and a
+ * list has to name something. A pattern naming two of them, or none, or an
+ * empty list, would leave which headers the rule read up to the order they
+ * happen to be checked in.
+ */
+export function requiredSimWafPatternSelection(pattern, ruleName) {
+    const included = pattern?.IncludedHeaders ?? pattern?.IncludedCookies ?? undefined;
+    const excluded = pattern?.ExcludedHeaders ?? pattern?.ExcludedCookies ?? undefined;
+    const named = [pattern?.All, included, excluded].filter((selector) => selector !== undefined);
+    if (named.length !== 1 || included?.length === 0 || excluded?.length === 0) {
+        invalidSimWafRule(ruleName, "A match pattern names All, one list of headers or cookies to include, " +
+            "or one list to exclude");
+    }
+    return { included: names(included), excluded: names(excluded) };
+}
+function names(listed) {
+    return listed === undefined
+        ? undefined
+        : new Set(listed.map((name) => name.toLowerCase()));
+}
+//# sourceMappingURL=sim-waf-match-pattern.js.map

package/dist/service/wafv2/statement/sim-waf-match-pattern.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"sim-waf-match-pattern.js","sourceRoot":"","sources":["../../../../src/service/wafv2/statement/sim-waf-match-pattern.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,iBAAiB,EAAE,MAAM,4BAA4B,CAAC;AAqB/D;;;;;;;;GAQG;AACH,MAAM,UAAU,8BAA8B,CAC5C,OAA4C,EAC5C,QAAgB;IAEhB,MAAM,QAAQ,GACZ,OAAO,EAAE,eAAe,IAAI,OAAO,EAAE,eAAe,IAAI,SAAS,CAAC;IACpE,MAAM,QAAQ,GACZ,OAAO,EAAE,eAAe,IAAI,OAAO,EAAE,eAAe,IAAI,SAAS,CAAC;IACpE,MAAM,KAAK,GAAG,CAAC,OAAO,EAAE,GAAG,EAAE,QAAQ,EAAE,QAAQ,CAAC,CAAC,MAAM,CACrD,CAAC,QAAQ,EAAE,EAAE,CAAC,QAAQ,KAAK,SAAS,CACrC,CAAC;IAEF,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC,IAAI,QAAQ,EAAE,MAAM,KAAK,CAAC,IAAI,QAAQ,EAAE,MAAM,KAAK,CAAC,EAAE,CAAC;QAC3E,iBAAiB,CACf,QAAQ,EACR,wEAAwE;YACtE,wBAAwB,CAC3B,CAAC;IACJ,CAAC;IAED,OAAO,EAAE,QAAQ,EAAE,KAAK,CAAC,QAAQ,CAAC,EAAE,QAAQ,EAAE,KAAK,CAAC,QAAQ,CAAC,EAAE,CAAC;AAClE,CAAC;AAED,SAAS,KAAK,CAAC,MAAqC;IAClD,OAAO,MAAM,KAAK,SAAS;QACzB,CAAC,CAAC,SAAS;QACX,CAAC,CAAC,IAAI,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,WAAW,EAAE,CAAC,CAAC,CAAC;AACxD,CAAC"}

package/dist/service/wafv2/statement/sim-waf-regex-match.d.ts

@@ -0,0 +1,29 @@
+import type { SimWafRegexPatternSet } from "../regex-pattern-set/sim-waf-regex-pattern-set.js";
+import type { SimWafResourceStore } from "../resource/sim-waf-resource-store.js";
+import type { SimWafValueTest } from "./sim-waf-field-match.js";
+/**
+ * Minimal structural WAFv2 RegexMatchStatement.
+ */
+export interface SimWafRegexMatchStatementInput {
+    readonly RegexString?: string | undefined;
+}
+/**
+ * Minimal structural WAFv2 RegexPatternSetReferenceStatement.
+ */
+export interface SimWafRegexPatternSetReferenceInput {
+    readonly ARN?: string | undefined;
+}
+/**
+ * Build the test a RegexMatchStatement puts each string through.
+ */
+export declare function simWafRegexTest(statement: SimWafRegexMatchStatementInput, ruleName: string): SimWafValueTest;
+/**
+ * Build the test a RegexPatternSetReferenceStatement puts each string through.
+ *
+ * The set is resolved when the rule is written rather than when a request
+ * arrives, so an ARN naming nothing is refused by CreateWebACL the way real
+ * WAF refuses it. The patterns themselves are read at match time, from the set
+ * the reference resolved to, so a rule follows the set it names.
+ */
+export declare function simWafRegexPatternSetTest(statement: SimWafRegexPatternSetReferenceInput, ruleName: string, regexPatternSets: SimWafResourceStore<SimWafRegexPatternSet>): SimWafValueTest;
+//# sourceMappingURL=sim-waf-regex-match.d.ts.map

package/dist/service/wafv2/statement/sim-waf-regex-match.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"sim-waf-regex-match.d.ts","sourceRoot":"","sources":["../../../../src/service/wafv2/statement/sim-waf-regex-match.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,qBAAqB,EAAE,MAAM,mDAAmD,CAAC;AAC/F,OAAO,KAAK,EAAE,mBAAmB,EAAE,MAAM,uCAAuC,CAAC;AACjF,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,0BAA0B,CAAC;AAKhE;;GAEG;AACH,MAAM,WAAW,8BAA8B;IAC7C,QAAQ,CAAC,WAAW,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;CAC3C;AAED;;GAEG;AACH,MAAM,WAAW,mCAAmC;IAClD,QAAQ,CAAC,GAAG,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;CACnC;AAED;;GAEG;AACH,wBAAgB,eAAe,CAC7B,SAAS,EAAE,8BAA8B,EACzC,QAAQ,EAAE,MAAM,GACf,eAAe,CAiBjB;AAED;;;;;;;GAOG;AACH,wBAAgB,yBAAyB,CACvC,SAAS,EAAE,mCAAmC,EAC9C,QAAQ,EAAE,MAAM,EAChB,gBAAgB,EAAE,mBAAmB,CAAC,qBAAqB,CAAC,GAC3D,eAAe,CAqBjB"}

package/dist/service/wafv2/statement/sim-waf-regex-match.js

@@ -0,0 +1,38 @@
+import { simWafRegExp } from "./sim-waf-regex.js";
+import { invalidSimWafRule } from "./sim-waf-rule-refusals.js";
+import { SimWafNonexistentItemException } from "../error/sim-wafv2.error.js";
+/**
+ * Build the test a RegexMatchStatement puts each string through.
+ */
+export function simWafRegexTest(statement, ruleName) {
+    const pattern = statement.RegexString;
+    if (pattern === undefined) {
+        invalidSimWafRule(ruleName, "RegexMatchStatement needs a RegexString");
+    }
+    const expression = simWafRegExp(pattern);
+    if (expression === undefined) {
+        invalidSimWafRule(ruleName, `The regular expression ${pattern} is not valid`);
+    }
+    return (value) => expression.test(value);
+}
+/**
+ * Build the test a RegexPatternSetReferenceStatement puts each string through.
+ *
+ * The set is resolved when the rule is written rather than when a request
+ * arrives, so an ARN naming nothing is refused by CreateWebACL the way real
+ * WAF refuses it. The patterns themselves are read at match time, from the set
+ * the reference resolved to, so a rule follows the set it names.
+ */
+export function simWafRegexPatternSetTest(statement, ruleName, regexPatternSets) {
+    const arn = statement.ARN;
+    if (arn === undefined) {
+        invalidSimWafRule(ruleName, "RegexPatternSetReferenceStatement needs an ARN");
+    }
+    const patternSet = regexPatternSets.findByArn(arn);
+    if (patternSet === undefined) {
+        throw new SimWafNonexistentItemException(`AWS WAF couldn't perform the operation because your resource doesn't ` +
+            `exist: the rule ${ruleName} refers to the regex pattern set ${arn}.`);
+    }
+    return (value) => patternSet.expressions.some((expression) => expression.test(value));
+}
+//# sourceMappingURL=sim-waf-regex-match.js.map

package/dist/service/wafv2/statement/sim-waf-regex-match.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"sim-waf-regex-match.js","sourceRoot":"","sources":["../../../../src/service/wafv2/statement/sim-waf-regex-match.ts"],"names":[],"mappings":"AAGA,OAAO,EAAE,YAAY,EAAE,MAAM,oBAAoB,CAAC;AAClD,OAAO,EAAE,iBAAiB,EAAE,MAAM,4BAA4B,CAAC;AAC/D,OAAO,EAAE,8BAA8B,EAAE,MAAM,6BAA6B,CAAC;AAgB7E;;GAEG;AACH,MAAM,UAAU,eAAe,CAC7B,SAAyC,EACzC,QAAgB;IAEhB,MAAM,OAAO,GAAG,SAAS,CAAC,WAAW,CAAC;IAEtC,IAAI,OAAO,KAAK,SAAS,EAAE,CAAC;QAC1B,iBAAiB,CAAC,QAAQ,EAAE,yCAAyC,CAAC,CAAC;IACzE,CAAC;IAED,MAAM,UAAU,GAAG,YAAY,CAAC,OAAO,CAAC,CAAC;IAEzC,IAAI,UAAU,KAAK,SAAS,EAAE,CAAC;QAC7B,iBAAiB,CACf,QAAQ,EACR,0BAA0B,OAAO,eAAe,CACjD,CAAC;IACJ,CAAC;IAED,OAAO,CAAC,KAAK,EAAW,EAAE,CAAC,UAAU,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;AACpD,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,UAAU,yBAAyB,CACvC,SAA8C,EAC9C,QAAgB,EAChB,gBAA4D;IAE5D,MAAM,GAAG,GAAG,SAAS,CAAC,GAAG,CAAC;IAE1B,IAAI,GAAG,KAAK,SAAS,EAAE,CAAC;QACtB,iBAAiB,CACf,QAAQ,EACR,gDAAgD,CACjD,CAAC;IACJ,CAAC;IAED,MAAM,UAAU,GAAG,gBAAgB,CAAC,SAAS,CAAC,GAAG,CAAC,CAAC;IAEnD,IAAI,UAAU,KAAK,SAAS,EAAE,CAAC;QAC7B,MAAM,IAAI,8BAA8B,CACtC,uEAAuE;YACrE,mBAAmB,QAAQ,oCAAoC,GAAG,GAAG,CACxE,CAAC;IACJ,CAAC;IAED,OAAO,CAAC,KAAK,EAAW,EAAE,CACxB,UAAU,CAAC,WAAW,CAAC,IAAI,CAAC,CAAC,UAAU,EAAE,EAAE,CAAC,UAAU,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC;AACxE,CAAC"}

package/dist/service/wafv2/statement/sim-waf-regex.d.ts

@@ -0,0 +1,15 @@
+/**
+ * Compile one WAFv2 regular expression, or answer with nothing when it will
+ * not compile.
+ *
+ * WAF matches without anchoring, so a pattern claims a value when it is found
+ * anywhere in it, and matching is case sensitive unless the rule asked for a
+ * LOWERCASE transformation.
+ *
+ * The pattern is compiled without the unicode flag. WAF's own dialect is a
+ * subset of PCRE, and a pattern written for it can hold escapes that a unicode
+ * mode expression rejects outright, so the looser mode is the one that accepts
+ * what AWS accepts.
+ */
+export declare function simWafRegExp(pattern: string): RegExp | undefined;
+//# sourceMappingURL=sim-waf-regex.d.ts.map

package/dist/service/wafv2/statement/sim-waf-regex.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"sim-waf-regex.d.ts","sourceRoot":"","sources":["../../../../src/service/wafv2/statement/sim-waf-regex.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;GAYG;AACH,wBAAgB,YAAY,CAAC,OAAO,EAAE,MAAM,GAAG,MAAM,GAAG,SAAS,CAahE"}

package/dist/service/wafv2/statement/sim-waf-regex.js

@@ -0,0 +1,29 @@
+/**
+ * Compile one WAFv2 regular expression, or answer with nothing when it will
+ * not compile.
+ *
+ * WAF matches without anchoring, so a pattern claims a value when it is found
+ * anywhere in it, and matching is case sensitive unless the rule asked for a
+ * LOWERCASE transformation.
+ *
+ * The pattern is compiled without the unicode flag. WAF's own dialect is a
+ * subset of PCRE, and a pattern written for it can hold escapes that a unicode
+ * mode expression rejects outright, so the looser mode is the one that accepts
+ * what AWS accepts.
+ */
+export function simWafRegExp(pattern) {
+    try {
+        /*
+         * The pattern comes from whoever wrote the web ACL, never from a request,
+         * so a pattern that backtracks badly holds up that author's own test run
+         * and nothing else. Real WAF bounds the expression instead, at 200
+         * characters and its own capacity units.
+         */
+        // oxlint-disable-next-line security/detect-non-literal-regexp
+        return new RegExp(pattern);
+    }
+    catch {
+        return undefined;
+    }
+}
+//# sourceMappingURL=sim-waf-regex.js.map

package/dist/service/wafv2/statement/sim-waf-regex.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"sim-waf-regex.js","sourceRoot":"","sources":["../../../../src/service/wafv2/statement/sim-waf-regex.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;GAYG;AACH,MAAM,UAAU,YAAY,CAAC,OAAe;IAC1C,IAAI,CAAC;QACH;;;;;WAKG;QACH,8DAA8D;QAC9D,OAAO,IAAI,MAAM,CAAC,OAAO,CAAC,CAAC;IAC7B,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,SAAS,CAAC;IACnB,CAAC;AACH,CAAC"}