@kensio/yulin 1.17.2 → 1.18.0

package/dist/service/wafv2/web-acl/sim-waf-rule-input.js

@@ -0,0 +1,44 @@
+import { SimWafInvalidParameterException } from "../error/sim-wafv2.error.js";
+import { invalidSimWafRule, refuseSimWafRuleInput, } from "../statement/sim-waf-rule-refusals.js";
+const browserAnswered = "the two actions they configure are answered by a browser, and nothing in " +
+    "a test does that";
+/**
+ * The rule members real WAFv2 takes and this simulation does not.
+ */
+const refusedMembers = new Map([
+    ["CaptchaConfig", browserAnswered],
+    ["ChallengeConfig", browserAnswered],
+]);
+/**
+ * Read the name a rule was written under, refusing one with none.
+ */
+export function requiredSimWafRuleName(name) {
+    if (name === undefined || name === "") {
+        throw new SimWafInvalidParameterException("Error reason: A rule needs a Name, field: RULE, parameter: Name");
+    }
+    return name;
+}
+/**
+ * Read the priority a rule runs at, refusing anything that is not a place in
+ * an order.
+ */
+export function requiredSimWafRulePriority(priority, name) {
+    if (priority === undefined ||
+        !Number.isSafeInteger(priority) ||
+        priority < 0) {
+        invalidSimWafRule(name, "A rule needs a Priority of zero or more");
+    }
+    return priority;
+}
+/**
+ * Refuse the parts of a rule real WAFv2 takes and this simulation does not.
+ */
+export function refuseUnsimulatedSimWafRuleInput(input, name) {
+    for (const [member, value] of Object.entries(input)) {
+        const reason = refusedMembers.get(member);
+        if (reason !== undefined && value !== undefined) {
+            refuseSimWafRuleInput(name, member, reason);
+        }
+    }
+}
+//# sourceMappingURL=sim-waf-rule-input.js.map

package/dist/service/wafv2/web-acl/sim-waf-rule-input.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"sim-waf-rule-input.js","sourceRoot":"","sources":["../../../../src/service/wafv2/web-acl/sim-waf-rule-input.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,+BAA+B,EAAE,MAAM,6BAA6B,CAAC;AAC9E,OAAO,EACL,iBAAiB,EACjB,qBAAqB,GACtB,MAAM,uCAAuC,CAAC;AAG/C,MAAM,eAAe,GACnB,2EAA2E;IAC3E,kBAAkB,CAAC;AAErB;;GAEG;AACH,MAAM,cAAc,GAAG,IAAI,GAAG,CAAiB;IAC7C,CAAC,eAAe,EAAE,eAAe,CAAC;IAClC,CAAC,iBAAiB,EAAE,eAAe,CAAC;CACrC,CAAC,CAAC;AAEH;;GAEG;AACH,MAAM,UAAU,sBAAsB,CAAC,IAAwB;IAC7D,IAAI,IAAI,KAAK,SAAS,IAAI,IAAI,KAAK,EAAE,EAAE,CAAC;QACtC,MAAM,IAAI,+BAA+B,CACvC,iEAAiE,CAClE,CAAC;IACJ,CAAC;IAED,OAAO,IAAI,CAAC;AACd,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,0BAA0B,CACxC,QAA4B,EAC5B,IAAY;IAEZ,IACE,QAAQ,KAAK,SAAS;QACtB,CAAC,MAAM,CAAC,aAAa,CAAC,QAAQ,CAAC;QAC/B,QAAQ,GAAG,CAAC,EACZ,CAAC;QACD,iBAAiB,CAAC,IAAI,EAAE,yCAAyC,CAAC,CAAC;IACrE,CAAC;IAED,OAAO,QAAQ,CAAC;AAClB,CAAC;AAED;;GAEG;AACH,MAAM,UAAU,gCAAgC,CAC9C,KAAsB,EACtB,IAAY;IAEZ,KAAK,MAAM,CAAC,MAAM,EAAE,KAAK,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC;QACpD,MAAM,MAAM,GAAG,cAAc,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;QAE1C,IAAI,MAAM,KAAK,SAAS,IAAI,KAAK,KAAK,SAAS,EAAE,CAAC;YAChD,qBAAqB,CAAC,IAAI,EAAE,MAAM,EAAE,MAAM,CAAC,CAAC;QAC9C,CAAC;IACH,CAAC;AACH,CAAC"}

package/dist/service/wafv2/web-acl/sim-waf-rule-labels.d.ts

@@ -0,0 +1,15 @@
+/**
+ * Minimal structural WAFv2 Label, which a rule adds to a request it matches.
+ */
+export interface SimWafLabelInput {
+    readonly Name?: string | undefined;
+}
+/**
+ * Read the labels a rule adds to the requests it claims.
+ *
+ * A label a rule of the web ACL's own adds carries no prefix, where a label
+ * from a rule group is qualified by the group it came from. That is AWS's own
+ * rule, and it is what a `LabelMatchStatement` key has to be written to match.
+ */
+export declare function simWafRuleLabels(labels: readonly SimWafLabelInput[] | undefined, ruleName: string): readonly string[];
+//# sourceMappingURL=sim-waf-rule-labels.d.ts.map

package/dist/service/wafv2/web-acl/sim-waf-rule-labels.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"sim-waf-rule-labels.d.ts","sourceRoot":"","sources":["../../../../src/service/wafv2/web-acl/sim-waf-rule-labels.ts"],"names":[],"mappings":"AAEA;;GAEG;AACH,MAAM,WAAW,gBAAgB;IAC/B,QAAQ,CAAC,IAAI,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;CACpC;AAED;;;;;;GAMG;AACH,wBAAgB,gBAAgB,CAC9B,MAAM,EAAE,SAAS,gBAAgB,EAAE,GAAG,SAAS,EAC/C,QAAQ,EAAE,MAAM,GACf,SAAS,MAAM,EAAE,CAQnB"}

package/dist/service/wafv2/web-acl/sim-waf-rule-labels.js

@@ -0,0 +1,17 @@
+import { invalidSimWafRule } from "../statement/sim-waf-rule-refusals.js";
+/**
+ * Read the labels a rule adds to the requests it claims.
+ *
+ * A label a rule of the web ACL's own adds carries no prefix, where a label
+ * from a rule group is qualified by the group it came from. That is AWS's own
+ * rule, and it is what a `LabelMatchStatement` key has to be written to match.
+ */
+export function simWafRuleLabels(labels, ruleName) {
+    return (labels ?? []).map((label) => {
+        if (label.Name === undefined || label.Name === "") {
+            invalidSimWafRule(ruleName, "A rule label needs a Name");
+        }
+        return label.Name;
+    });
+}
+//# sourceMappingURL=sim-waf-rule-labels.js.map

package/dist/service/wafv2/web-acl/sim-waf-rule-labels.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"sim-waf-rule-labels.js","sourceRoot":"","sources":["../../../../src/service/wafv2/web-acl/sim-waf-rule-labels.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,iBAAiB,EAAE,MAAM,uCAAuC,CAAC;AAS1E;;;;;;GAMG;AACH,MAAM,UAAU,gBAAgB,CAC9B,MAA+C,EAC/C,QAAgB;IAEhB,OAAO,CAAC,MAAM,IAAI,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE;QAClC,IAAI,KAAK,CAAC,IAAI,KAAK,SAAS,IAAI,KAAK,CAAC,IAAI,KAAK,EAAE,EAAE,CAAC;YAClD,iBAAiB,CAAC,QAAQ,EAAE,2BAA2B,CAAC,CAAC;QAC3D,CAAC;QAED,OAAO,KAAK,CAAC,IAAI,CAAC;IACpB,CAAC,CAAC,CAAC;AACL,CAAC"}

package/dist/service/wafv2/web-acl/sim-waf-rule.d.ts

@@ -0,0 +1,30 @@
+import type { SimWafInspectedRequest } from "../evaluate/sim-waf-inspected-request.js";
+import type { SimWafAction } from "./sim-waf-action.js";
+import type { SimWafRuleInput, SimWafRuleScope } from "./sim-waf-rule.type.js";
+/**
+ * One rule of a web ACL, compiled so a request can be evaluated against it.
+ *
+ * The statement is turned into an evaluator when the web ACL is written, which
+ * is what lets a rule Yulin cannot evaluate be refused at that point rather
+ * than silently letting requests past later on.
+ */
+export declare class SimWafRule {
+    #private;
+    readonly name: string;
+    readonly priority: number;
+    private constructor();
+    /**
+     * Compile one rule as it was written.
+     */
+    static compile(input: SimWafRuleInput, scope: SimWafRuleScope): SimWafRule;
+    /**
+     * What this rule does with a request, which is nothing when it does not
+     * claim it.
+     *
+     * A rule labels the requests it claims whatever action it goes on to take,
+     * counted ones included, because a label is how a rule that runs later finds
+     * out this one matched.
+     */
+    evaluate(request: SimWafInspectedRequest): SimWafAction | undefined;
+}
+//# sourceMappingURL=sim-waf-rule.d.ts.map

package/dist/service/wafv2/web-acl/sim-waf-rule.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"sim-waf-rule.d.ts","sourceRoot":"","sources":["../../../../src/service/wafv2/web-acl/sim-waf-rule.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,sBAAsB,EAAE,MAAM,0CAA0C,CAAC;AACvF,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,qBAAqB,CAAC;AAQxD,OAAO,KAAK,EAEV,eAAe,EACf,eAAe,EAChB,MAAM,wBAAwB,CAAC;AAShC;;;;;;GAMG;AACH,qBAAa,UAAU;;IACrB,SAAgB,IAAI,EAAE,MAAM,CAAC;IAC7B,SAAgB,QAAQ,EAAE,MAAM,CAAC;IAKjC,OAAO,eAKN;IAED;;OAEG;IACH,MAAM,CAAC,OAAO,CAAC,KAAK,EAAE,eAAe,EAAE,KAAK,EAAE,eAAe,GAAG,UAAU,CAWzE;IAED;;;;;;;OAOG;IACH,QAAQ,CAAC,OAAO,EAAE,sBAAsB,GAAG,YAAY,GAAG,SAAS,CAUlE;CACF"}

package/dist/service/wafv2/web-acl/sim-waf-rule.factory.d.ts

@@ -0,0 +1,39 @@
+import { DynamicFactory } from "@kensio/part-factory";
+import type { SimWafRuleInput } from "./sim-waf-rule.type.js";
+/**
+ * The visibility configuration every WAFv2 rule and web ACL carries.
+ *
+ * Nothing is emitted from it: web ACL metrics and sampled requests are not
+ * simulated. It is here because real WAFv2 asks for one on every rule, so a
+ * rule written without it is not a rule anyone would write.
+ */
+export declare const simWafVisibilityConfig: {
+    SampledRequestsEnabled: boolean;
+    CloudWatchMetricsEnabled: boolean;
+    MetricName: string;
+};
+/**
+ * Makes minimally valid WAFv2 rules that block every request.
+ *
+ * The statement claims any request, so a test about the order rules run in
+ * says nothing about matching.
+ *
+ * `Statement` and `Action` are replaced whole rather than overridden, because
+ * overrides are merged into the defaults and both of these are one-of: a
+ * statement naming two kinds, or an action naming both `Allow` and `Block`, is
+ * not something WAF would take, and is refused where the rule is written.
+ */
+export declare const simWafRuleFactory: DynamicFactory<SimWafRuleInput, undefined>;
+/**
+ * Makes rules that run the AWS core rule set as it comes.
+ *
+ * `Statement` and `OverrideAction` are replaced whole rather than overridden,
+ * for the reason the statement of any other rule is: each of them holds one
+ * thing at a time, and a merge would leave a rule naming two.
+ *
+ * A rule that names a rule group carries an `OverrideAction` where any other
+ * rule carries an `Action`, since what it does to a request comes from
+ * whichever rule inside the group claimed it.
+ */
+export declare const simWafManagedRuleFactory: DynamicFactory<SimWafRuleInput, undefined>;
+//# sourceMappingURL=sim-waf-rule.factory.d.ts.map

package/dist/service/wafv2/web-acl/sim-waf-rule.factory.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"sim-waf-rule.factory.d.ts","sourceRoot":"","sources":["../../../../src/service/wafv2/web-acl/sim-waf-rule.factory.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,cAAc,EAAE,MAAM,sBAAsB,CAAC;AAEtD,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,wBAAwB,CAAC;AAE9D;;;;;;GAMG;AACH,eAAO,MAAM,sBAAsB;IACjC,sBAAsB;IACtB,wBAAwB;IACxB,UAAU;CACX,CAAC;AAEF;;;;;;;;;;GAUG;AACH,eAAO,MAAM,iBAAiB,4CAa3B,CAAC;AAEJ;;;;;;;;;;GAUG;AACH,eAAO,MAAM,wBAAwB,4CAapC,CAAC"}

package/dist/service/wafv2/web-acl/sim-waf-rule.factory.js

@@ -0,0 +1,63 @@
+import { faker } from "@faker-js/faker";
+import { DynamicFactory } from "@kensio/part-factory";
+/**
+ * The visibility configuration every WAFv2 rule and web ACL carries.
+ *
+ * Nothing is emitted from it: web ACL metrics and sampled requests are not
+ * simulated. It is here because real WAFv2 asks for one on every rule, so a
+ * rule written without it is not a rule anyone would write.
+ */
+export const simWafVisibilityConfig = {
+    SampledRequestsEnabled: false,
+    CloudWatchMetricsEnabled: false,
+    MetricName: "sim",
+};
+/**
+ * Makes minimally valid WAFv2 rules that block every request.
+ *
+ * The statement claims any request, so a test about the order rules run in
+ * says nothing about matching.
+ *
+ * `Statement` and `Action` are replaced whole rather than overridden, because
+ * overrides are merged into the defaults and both of these are one-of: a
+ * statement naming two kinds, or an action naming both `Allow` and `Block`, is
+ * not something WAF would take, and is refused where the rule is written.
+ */
+export const simWafRuleFactory = new DynamicFactory(() => ({
+    Name: `rule-${faker.string.alphanumeric(8)}`,
+    Priority: 0,
+    Action: { Block: {} },
+    Statement: {
+        ByteMatchStatement: {
+            SearchString: "/",
+            PositionalConstraint: "CONTAINS",
+            FieldToMatch: { UriPath: {} },
+            TextTransformations: [{ Priority: 0, Type: "NONE" }],
+        },
+    },
+    VisibilityConfig: simWafVisibilityConfig,
+}));
+/**
+ * Makes rules that run the AWS core rule set as it comes.
+ *
+ * `Statement` and `OverrideAction` are replaced whole rather than overridden,
+ * for the reason the statement of any other rule is: each of them holds one
+ * thing at a time, and a merge would leave a rule naming two.
+ *
+ * A rule that names a rule group carries an `OverrideAction` where any other
+ * rule carries an `Action`, since what it does to a request comes from
+ * whichever rule inside the group claimed it.
+ */
+export const simWafManagedRuleFactory = new DynamicFactory(() => ({
+    Name: `managed-${faker.string.alphanumeric(8)}`,
+    Priority: 0,
+    OverrideAction: { None: {} },
+    Statement: {
+        ManagedRuleGroupStatement: {
+            VendorName: "AWS",
+            Name: "AWSManagedRulesCommonRuleSet",
+        },
+    },
+    VisibilityConfig: simWafVisibilityConfig,
+}));
+//# sourceMappingURL=sim-waf-rule.factory.js.map

package/dist/service/wafv2/web-acl/sim-waf-rule.factory.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"sim-waf-rule.factory.js","sourceRoot":"","sources":["../../../../src/service/wafv2/web-acl/sim-waf-rule.factory.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,KAAK,EAAE,MAAM,iBAAiB,CAAC;AACxC,OAAO,EAAE,cAAc,EAAE,MAAM,sBAAsB,CAAC;AAItD;;;;;;GAMG;AACH,MAAM,CAAC,MAAM,sBAAsB,GAAG;IACpC,sBAAsB,EAAE,KAAK;IAC7B,wBAAwB,EAAE,KAAK;IAC/B,UAAU,EAAE,KAAK;CAClB,CAAC;AAEF;;;;;;;;;;GAUG;AACH,MAAM,CAAC,MAAM,iBAAiB,GAAG,IAAI,cAAc,CAAkB,GAAG,EAAE,CAAC,CAAC;IAC1E,IAAI,EAAE,QAAQ,KAAK,CAAC,MAAM,CAAC,YAAY,CAAC,CAAC,CAAC,EAAE;IAC5C,QAAQ,EAAE,CAAC;IACX,MAAM,EAAE,EAAE,KAAK,EAAE,EAAE,EAAE;IACrB,SAAS,EAAE;QACT,kBAAkB,EAAE;YAClB,YAAY,EAAE,GAAG;YACjB,oBAAoB,EAAE,UAAU;YAChC,YAAY,EAAE,EAAE,OAAO,EAAE,EAAE,EAAE;YAC7B,mBAAmB,EAAE,CAAC,EAAE,QAAQ,EAAE,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,CAAC;SACrD;KACF;IACD,gBAAgB,EAAE,sBAAsB;CACzC,CAAC,CAAC,CAAC;AAEJ;;;;;;;;;;GAUG;AACH,MAAM,CAAC,MAAM,wBAAwB,GAAG,IAAI,cAAc,CACxD,GAAG,EAAE,CAAC,CAAC;IACL,IAAI,EAAE,WAAW,KAAK,CAAC,MAAM,CAAC,YAAY,CAAC,CAAC,CAAC,EAAE;IAC/C,QAAQ,EAAE,CAAC;IACX,cAAc,EAAE,EAAE,IAAI,EAAE,EAAE,EAAE;IAC5B,SAAS,EAAE;QACT,yBAAyB,EAAE;YACzB,UAAU,EAAE,KAAK;YACjB,IAAI,EAAE,8BAA8B;SACrC;KACF;IACD,gBAAgB,EAAE,sBAAsB;CACzC,CAAC,CACH,CAAC"}

package/dist/service/wafv2/web-acl/sim-waf-rule.js

@@ -0,0 +1,53 @@
+import { refuseUnsimulatedSimWafRuleInput, requiredSimWafRuleName, requiredSimWafRulePriority, } from "./sim-waf-rule-input.js";
+import { simWafRuleLabels } from "./sim-waf-rule-labels.js";
+import { compileSimWafRuleEvaluator } from "./sim-waf-rule-evaluator.js";
+/**
+ * One rule of a web ACL, compiled so a request can be evaluated against it.
+ *
+ * The statement is turned into an evaluator when the web ACL is written, which
+ * is what lets a rule Yulin cannot evaluate be refused at that point rather
+ * than silently letting requests past later on.
+ */
+export class SimWafRule {
+    name;
+    priority;
+    #labels;
+    #evaluate;
+    constructor(properties) {
+        this.name = properties.name;
+        this.priority = properties.priority;
+        this.#labels = properties.labels;
+        this.#evaluate = properties.evaluate;
+    }
+    /**
+     * Compile one rule as it was written.
+     */
+    static compile(input, scope) {
+        const name = requiredSimWafRuleName(input.Name);
+        refuseUnsimulatedSimWafRuleInput(input, name);
+        return new SimWafRule({
+            name,
+            priority: requiredSimWafRulePriority(input.Priority, name),
+            labels: simWafRuleLabels(input.RuleLabels, name),
+            evaluate: compileSimWafRuleEvaluator(input, name, scope),
+        });
+    }
+    /**
+     * What this rule does with a request, which is nothing when it does not
+     * claim it.
+     *
+     * A rule labels the requests it claims whatever action it goes on to take,
+     * counted ones included, because a label is how a rule that runs later finds
+     * out this one matched.
+     */
+    evaluate(request) {
+        const action = this.#evaluate(request);
+        if (action !== undefined) {
+            for (const label of this.#labels) {
+                request.labels.add(label);
+            }
+        }
+        return action;
+    }
+}
+//# sourceMappingURL=sim-waf-rule.js.map

package/dist/service/wafv2/web-acl/sim-waf-rule.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"sim-waf-rule.js","sourceRoot":"","sources":["../../../../src/service/wafv2/web-acl/sim-waf-rule.ts"],"names":[],"mappings":"AAEA,OAAO,EACL,gCAAgC,EAChC,sBAAsB,EACtB,0BAA0B,GAC3B,MAAM,yBAAyB,CAAC;AACjC,OAAO,EAAE,gBAAgB,EAAE,MAAM,0BAA0B,CAAC;AAC5D,OAAO,EAAE,0BAA0B,EAAE,MAAM,6BAA6B,CAAC;AAczE;;;;;;GAMG;AACH,MAAM,OAAO,UAAU;IACL,IAAI,CAAS;IACb,QAAQ,CAAS;IAExB,OAAO,CAAoB;IAC3B,SAAS,CAAsB;IAExC,YAAoB,UAAgC;QAClD,IAAI,CAAC,IAAI,GAAG,UAAU,CAAC,IAAI,CAAC;QAC5B,IAAI,CAAC,QAAQ,GAAG,UAAU,CAAC,QAAQ,CAAC;QACpC,IAAI,CAAC,OAAO,GAAG,UAAU,CAAC,MAAM,CAAC;QACjC,IAAI,CAAC,SAAS,GAAG,UAAU,CAAC,QAAQ,CAAC;IACvC,CAAC;IAED;;OAEG;IACH,MAAM,CAAC,OAAO,CAAC,KAAsB,EAAE,KAAsB;QAC3D,MAAM,IAAI,GAAG,sBAAsB,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;QAEhD,gCAAgC,CAAC,KAAK,EAAE,IAAI,CAAC,CAAC;QAE9C,OAAO,IAAI,UAAU,CAAC;YACpB,IAAI;YACJ,QAAQ,EAAE,0BAA0B,CAAC,KAAK,CAAC,QAAQ,EAAE,IAAI,CAAC;YAC1D,MAAM,EAAE,gBAAgB,CAAC,KAAK,CAAC,UAAU,EAAE,IAAI,CAAC;YAChD,QAAQ,EAAE,0BAA0B,CAAC,KAAK,EAAE,IAAI,EAAE,KAAK,CAAC;SACzD,CAAC,CAAC;IACL,CAAC;IAED;;;;;;;OAOG;IACH,QAAQ,CAAC,OAA+B;QACtC,MAAM,MAAM,GAAG,IAAI,CAAC,SAAS,CAAC,OAAO,CAAC,CAAC;QAEvC,IAAI,MAAM,KAAK,SAAS,EAAE,CAAC;YACzB,KAAK,MAAM,KAAK,IAAI,IAAI,CAAC,OAAO,EAAE,CAAC;gBACjC,OAAO,CAAC,MAAM,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC;YAC5B,CAAC;QACH,CAAC;QAED,OAAO,MAAM,CAAC;IAChB,CAAC;CACF"}

package/dist/service/wafv2/web-acl/sim-waf-rule.type.d.ts

@@ -0,0 +1,50 @@
+import type { SimWafOverrideActionInput } from "../managed/sim-waf-managed-group.type.js";
+import type { SimWafManagedRules } from "../managed/sim-waf-managed-rules.js";
+import type { SimWafRegexPatternSet } from "../regex-pattern-set/sim-waf-regex-pattern-set.js";
+import type { SimWafResourceStore } from "../resource/sim-waf-resource-store.js";
+import type { SimWafInspectedRequest } from "../evaluate/sim-waf-inspected-request.js";
+import type { SimWafStatementInput } from "../statement/sim-waf-statement.type.js";
+import type { SimWafAction } from "./sim-waf-action.js";
+import type { SimWafActionInput } from "./sim-waf-action.type.js";
+import type { SimWafCustomResponseBodies } from "./sim-waf-custom-response.type.js";
+import type { SimWafLabelInput } from "./sim-waf-rule-labels.js";
+/**
+ * Minimal structural WAFv2 Rule.
+ *
+ * https://docs.aws.amazon.com/AWSJavaScriptSDK/v3/latest/client/wafv2/Interface/Rule/
+ */
+export interface SimWafRuleInput {
+    readonly Name?: string | undefined;
+    readonly Priority?: number | undefined;
+    readonly Statement?: SimWafStatementInput | undefined;
+    readonly Action?: SimWafActionInput | undefined;
+    readonly OverrideAction?: SimWafOverrideActionInput | undefined;
+    readonly RuleLabels?: readonly SimWafLabelInput[] | undefined;
+    readonly CaptchaConfig?: unknown;
+    readonly ChallengeConfig?: unknown;
+    readonly VisibilityConfig?: unknown;
+}
+/**
+ * What a web ACL brings to compiling its rules, which is everything a rule is
+ * compiled against bar the custom responses it was written with.
+ */
+export interface SimWafWebAclRuleScope {
+    readonly regexPatternSets: SimWafResourceStore<SimWafRegexPatternSet>;
+    readonly managedRules: SimWafManagedRules;
+}
+/**
+ * What a rule is compiled against.
+ */
+export interface SimWafRuleScope extends SimWafWebAclRuleScope {
+    readonly customResponseBodies: SimWafCustomResponseBodies;
+}
+/**
+ * What one compiled rule does with a request.
+ *
+ * A rule that claims the request answers with the action to apply, and one
+ * that does not answers with nothing. The action is not the rule's own for
+ * every rule: a rule naming a managed rule group answers with the action of
+ * whichever rule inside the group claimed the request.
+ */
+export type SimWafRuleEvaluator = (request: SimWafInspectedRequest) => SimWafAction | undefined;
+//# sourceMappingURL=sim-waf-rule.type.d.ts.map

package/dist/service/wafv2/web-acl/sim-waf-rule.type.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"sim-waf-rule.type.d.ts","sourceRoot":"","sources":["../../../../src/service/wafv2/web-acl/sim-waf-rule.type.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,yBAAyB,EAAE,MAAM,0CAA0C,CAAC;AAC1F,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,qCAAqC,CAAC;AAC9E,OAAO,KAAK,EAAE,qBAAqB,EAAE,MAAM,mDAAmD,CAAC;AAC/F,OAAO,KAAK,EAAE,mBAAmB,EAAE,MAAM,uCAAuC,CAAC;AACjF,OAAO,KAAK,EAAE,sBAAsB,EAAE,MAAM,0CAA0C,CAAC;AACvF,OAAO,KAAK,EAAE,oBAAoB,EAAE,MAAM,wCAAwC,CAAC;AACnF,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,qBAAqB,CAAC;AACxD,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,0BAA0B,CAAC;AAClE,OAAO,KAAK,EAAE,0BAA0B,EAAE,MAAM,mCAAmC,CAAC;AACpF,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,0BAA0B,CAAC;AAEjE;;;;GAIG;AACH,MAAM,WAAW,eAAe;IAC9B,QAAQ,CAAC,IAAI,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IACnC,QAAQ,CAAC,QAAQ,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IACvC,QAAQ,CAAC,SAAS,CAAC,EAAE,oBAAoB,GAAG,SAAS,CAAC;IACtD,QAAQ,CAAC,MAAM,CAAC,EAAE,iBAAiB,GAAG,SAAS,CAAC;IAChD,QAAQ,CAAC,cAAc,CAAC,EAAE,yBAAyB,GAAG,SAAS,CAAC;IAChE,QAAQ,CAAC,UAAU,CAAC,EAAE,SAAS,gBAAgB,EAAE,GAAG,SAAS,CAAC;IAC9D,QAAQ,CAAC,aAAa,CAAC,EAAE,OAAO,CAAC;IACjC,QAAQ,CAAC,eAAe,CAAC,EAAE,OAAO,CAAC;IACnC,QAAQ,CAAC,gBAAgB,CAAC,EAAE,OAAO,CAAC;CACrC;AAED;;;GAGG;AACH,MAAM,WAAW,qBAAqB;IACpC,QAAQ,CAAC,gBAAgB,EAAE,mBAAmB,CAAC,qBAAqB,CAAC,CAAC;IACtE,QAAQ,CAAC,YAAY,EAAE,kBAAkB,CAAC;CAC3C;AAED;;GAEG;AACH,MAAM,WAAW,eAAgB,SAAQ,qBAAqB;IAC5D,QAAQ,CAAC,oBAAoB,EAAE,0BAA0B,CAAC;CAC3D;AAED;;;;;;;GAOG;AACH,MAAM,MAAM,mBAAmB,GAAG,CAChC,OAAO,EAAE,sBAAsB,KAC5B,YAAY,GAAG,SAAS,CAAC"}

package/dist/service/wafv2/web-acl/sim-waf-rule.type.js

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=sim-waf-rule.type.js.map

package/dist/service/wafv2/web-acl/sim-waf-rule.type.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"sim-waf-rule.type.js","sourceRoot":"","sources":["../../../../src/service/wafv2/web-acl/sim-waf-rule.type.ts"],"names":[],"mappings":""}

package/dist/service/wafv2/web-acl/sim-waf-rules.d.ts

@@ -0,0 +1,23 @@
+import { SimWafRule } from "./sim-waf-rule.js";
+import type { SimWafRuleInput, SimWafRuleScope, SimWafWebAclRuleScope } from "./sim-waf-rule.type.js";
+import type { SimWafWebAclConfiguration } from "./sim-waf-web-acl-configuration.js";
+/**
+ * Compile the rules a web ACL was written with.
+ *
+ * The custom response bodies are part of the configuration and the rest of the
+ * scope belongs to the web ACL, which is what this puts together.
+ */
+export declare function compileSimWafWebAclRules(configuration: SimWafWebAclConfiguration, scope: SimWafWebAclRuleScope): readonly SimWafRule[];
+/**
+ * Compile a web ACL's rules into the order they are evaluated in.
+ *
+ * Rules run in ascending `Priority` rather than in the order they were
+ * written, which is the part that surprises people: moving a rule up the list
+ * changes nothing, and changing its priority changes everything.
+ *
+ * Two rules cannot claim one priority, as real WAF requires. Without that,
+ * which of them decided a request would come down to how the list happened to
+ * be sorted.
+ */
+export declare function compileSimWafRules(rules: readonly SimWafRuleInput[] | undefined, scope: SimWafRuleScope): readonly SimWafRule[];
+//# sourceMappingURL=sim-waf-rules.d.ts.map

package/dist/service/wafv2/web-acl/sim-waf-rules.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"sim-waf-rules.d.ts","sourceRoot":"","sources":["../../../../src/service/wafv2/web-acl/sim-waf-rules.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,UAAU,EAAE,MAAM,mBAAmB,CAAC;AAC/C,OAAO,KAAK,EACV,eAAe,EACf,eAAe,EACf,qBAAqB,EACtB,MAAM,wBAAwB,CAAC;AAChC,OAAO,KAAK,EAAE,yBAAyB,EAAE,MAAM,oCAAoC,CAAC;AAEpF;;;;;GAKG;AACH,wBAAgB,wBAAwB,CACtC,aAAa,EAAE,yBAAyB,EACxC,KAAK,EAAE,qBAAqB,GAC3B,SAAS,UAAU,EAAE,CAKvB;AAED;;;;;;;;;;GAUG;AACH,wBAAgB,kBAAkB,CAChC,KAAK,EAAE,SAAS,eAAe,EAAE,GAAG,SAAS,EAC7C,KAAK,EAAE,eAAe,GACrB,SAAS,UAAU,EAAE,CAMvB"}

package/dist/service/wafv2/web-acl/sim-waf-rules.js

@@ -0,0 +1,43 @@
+import { SimWafInvalidParameterException } from "../error/sim-wafv2.error.js";
+import { SimWafRule } from "./sim-waf-rule.js";
+/**
+ * Compile the rules a web ACL was written with.
+ *
+ * The custom response bodies are part of the configuration and the rest of the
+ * scope belongs to the web ACL, which is what this puts together.
+ */
+export function compileSimWafWebAclRules(configuration, scope) {
+    return compileSimWafRules(configuration.rules, {
+        ...scope,
+        customResponseBodies: configuration.customResponseBodies ?? {},
+    });
+}
+/**
+ * Compile a web ACL's rules into the order they are evaluated in.
+ *
+ * Rules run in ascending `Priority` rather than in the order they were
+ * written, which is the part that surprises people: moving a rule up the list
+ * changes nothing, and changing its priority changes everything.
+ *
+ * Two rules cannot claim one priority, as real WAF requires. Without that,
+ * which of them decided a request would come down to how the list happened to
+ * be sorted.
+ */
+export function compileSimWafRules(rules, scope) {
+    const compiled = (rules ?? []).map((rule) => SimWafRule.compile(rule, scope));
+    refuseRepeatedPriority(compiled);
+    return compiled.toSorted((left, right) => left.priority - right.priority);
+}
+function refuseRepeatedPriority(rules) {
+    const claimed = new Map();
+    for (const rule of rules) {
+        const already = claimed.get(rule.priority);
+        if (already !== undefined) {
+            throw new SimWafInvalidParameterException(`Error reason: The rules ${already} and ${rule.name} both have ` +
+                `priority ${rule.priority}, and a web ACL evaluates its rules in ` +
+                `priority order, field: RULE, parameter: ${rule.name}`);
+        }
+        claimed.set(rule.priority, rule.name);
+    }
+}
+//# sourceMappingURL=sim-waf-rules.js.map

package/dist/service/wafv2/web-acl/sim-waf-rules.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"sim-waf-rules.js","sourceRoot":"","sources":["../../../../src/service/wafv2/web-acl/sim-waf-rules.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,+BAA+B,EAAE,MAAM,6BAA6B,CAAC;AAC9E,OAAO,EAAE,UAAU,EAAE,MAAM,mBAAmB,CAAC;AAQ/C;;;;;GAKG;AACH,MAAM,UAAU,wBAAwB,CACtC,aAAwC,EACxC,KAA4B;IAE5B,OAAO,kBAAkB,CAAC,aAAa,CAAC,KAAK,EAAE;QAC7C,GAAG,KAAK;QACR,oBAAoB,EAAE,aAAa,CAAC,oBAAoB,IAAI,EAAE;KAC/D,CAAC,CAAC;AACL,CAAC;AAED;;;;;;;;;;GAUG;AACH,MAAM,UAAU,kBAAkB,CAChC,KAA6C,EAC7C,KAAsB;IAEtB,MAAM,QAAQ,GAAG,CAAC,KAAK,IAAI,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,UAAU,CAAC,OAAO,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC,CAAC;IAE9E,sBAAsB,CAAC,QAAQ,CAAC,CAAC;IAEjC,OAAO,QAAQ,CAAC,QAAQ,CAAC,CAAC,IAAI,EAAE,KAAK,EAAE,EAAE,CAAC,IAAI,CAAC,QAAQ,GAAG,KAAK,CAAC,QAAQ,CAAC,CAAC;AAC5E,CAAC;AAED,SAAS,sBAAsB,CAAC,KAA4B;IAC1D,MAAM,OAAO,GAAG,IAAI,GAAG,EAAkB,CAAC;IAE1C,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;QACzB,MAAM,OAAO,GAAG,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;QAE3C,IAAI,OAAO,KAAK,SAAS,EAAE,CAAC;YAC1B,MAAM,IAAI,+BAA+B,CACvC,2BAA2B,OAAO,QAAQ,IAAI,CAAC,IAAI,aAAa;gBAC9D,YAAY,IAAI,CAAC,QAAQ,yCAAyC;gBAClE,2CAA2C,IAAI,CAAC,IAAI,EAAE,CACzD,CAAC;QACJ,CAAC;QAED,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,QAAQ,EAAE,IAAI,CAAC,IAAI,CAAC,CAAC;IACxC,CAAC;AACH,CAAC"}

package/dist/service/wafv2/web-acl/sim-waf-statement-capacity.d.ts

@@ -0,0 +1,11 @@
+import type { SimWafStatementInput } from "../statement/sim-waf-statement.type.js";
+/**
+ * What the statements that inspect a request cost.
+ *
+ * Only the kinds this simulation evaluates are counted. Every other kind is
+ * refused where the rule is written, so a web ACL that has rules to add up
+ * cannot hold one. Doubling the base cost for a JSON body never applies here
+ * for the same reason.
+ */
+export declare function simWafMatchCapacity(statement: SimWafStatementInput): number;
+//# sourceMappingURL=sim-waf-statement-capacity.d.ts.map

package/dist/service/wafv2/web-acl/sim-waf-statement-capacity.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"sim-waf-statement-capacity.d.ts","sourceRoot":"","sources":["../../../../src/service/wafv2/web-acl/sim-waf-statement-capacity.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAEV,oBAAoB,EACrB,MAAM,wCAAwC,CAAC;AAwBhD;;;;;;;GAOG;AACH,wBAAgB,mBAAmB,CAAC,SAAS,EAAE,oBAAoB,GAAG,MAAM,CAW3E"}

package/dist/service/wafv2/web-acl/sim-waf-statement-capacity.js

@@ -0,0 +1,57 @@
+/**
+ * What AWS charges for a byte match, by the kind of match it makes.
+ */
+const byteMatchBaseCosts = new Map([
+    ["EXACTLY", 2],
+    ["STARTS_WITH", 2],
+    ["ENDS_WITH", 2],
+    ["CONTAINS", 10],
+    ["CONTAINS_WORD", 10],
+]);
+const regexMatchBaseCost = 3;
+const regexPatternSetBaseCost = 25;
+const sizeConstraintBaseCost = 1;
+const labelMatchCost = 1;
+/** What inspecting every query argument adds to a statement's base cost. */
+const allQueryArgumentsCost = 10;
+/** What each text transformation adds. */
+const textTransformationCost = 10;
+/**
+ * What the statements that inspect a request cost.
+ *
+ * Only the kinds this simulation evaluates are counted. Every other kind is
+ * refused where the rule is written, so a web ACL that has rules to add up
+ * cannot hold one. Doubling the base cost for a JSON body never applies here
+ * for the same reason.
+ */
+export function simWafMatchCapacity(statement) {
+    return (byteMatchCapacity(statement.ByteMatchStatement) +
+        fieldCapacity(statement.RegexMatchStatement, regexMatchBaseCost) +
+        fieldCapacity(statement.RegexPatternSetReferenceStatement, regexPatternSetBaseCost) +
+        fieldCapacity(statement.SizeConstraintStatement, sizeConstraintBaseCost) +
+        (statement.LabelMatchStatement === undefined ? 0 : labelMatchCost));
+}
+/**
+ * What a byte match costs, which depends on the match it makes.
+ *
+ * A constraint outside the five is refused where the rule is compiled, and
+ * compiling happens before any of this.
+ */
+function byteMatchCapacity(statement) {
+    const constraint = statement?.PositionalConstraint ?? "";
+    return fieldCapacity(statement, byteMatchBaseCosts.get(constraint) ?? 0);
+}
+/**
+ * A base cost plus what the field and the transformations add to it.
+ */
+function fieldCapacity(statement, baseCost) {
+    if (statement === undefined) {
+        return 0;
+    }
+    const transformed = (statement.TextTransformations ?? []).filter((transformation) => transformation.Type !== "NONE");
+    const queryArguments = statement.FieldToMatch?.AllQueryArguments === undefined
+        ? 0
+        : allQueryArgumentsCost;
+    return (baseCost + queryArguments + transformed.length * textTransformationCost);
+}
+//# sourceMappingURL=sim-waf-statement-capacity.js.map

package/dist/service/wafv2/web-acl/sim-waf-statement-capacity.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"sim-waf-statement-capacity.js","sourceRoot":"","sources":["../../../../src/service/wafv2/web-acl/sim-waf-statement-capacity.ts"],"names":[],"mappings":"AAMA;;GAEG;AACH,MAAM,kBAAkB,GAAgC,IAAI,GAAG,CAAC;IAC9D,CAAC,SAAS,EAAE,CAAC,CAAC;IACd,CAAC,aAAa,EAAE,CAAC,CAAC;IAClB,CAAC,WAAW,EAAE,CAAC,CAAC;IAChB,CAAC,UAAU,EAAE,EAAE,CAAC;IAChB,CAAC,eAAe,EAAE,EAAE,CAAC;CACtB,CAAC,CAAC;AAEH,MAAM,kBAAkB,GAAG,CAAC,CAAC;AAC7B,MAAM,uBAAuB,GAAG,EAAE,CAAC;AACnC,MAAM,sBAAsB,GAAG,CAAC,CAAC;AACjC,MAAM,cAAc,GAAG,CAAC,CAAC;AAEzB,4EAA4E;AAC5E,MAAM,qBAAqB,GAAG,EAAE,CAAC;AAEjC,0CAA0C;AAC1C,MAAM,sBAAsB,GAAG,EAAE,CAAC;AAElC;;;;;;;GAOG;AACH,MAAM,UAAU,mBAAmB,CAAC,SAA+B;IACjE,OAAO,CACL,iBAAiB,CAAC,SAAS,CAAC,kBAAkB,CAAC;QAC/C,aAAa,CAAC,SAAS,CAAC,mBAAmB,EAAE,kBAAkB,CAAC;QAChE,aAAa,CACX,SAAS,CAAC,iCAAiC,EAC3C,uBAAuB,CACxB;QACD,aAAa,CAAC,SAAS,CAAC,uBAAuB,EAAE,sBAAsB,CAAC;QACxE,CAAC,SAAS,CAAC,mBAAmB,KAAK,SAAS,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,cAAc,CAAC,CACnE,CAAC;AACJ,CAAC;AAED;;;;;GAKG;AACH,SAAS,iBAAiB,CACxB,SAEa;IAEb,MAAM,UAAU,GAAG,SAAS,EAAE,oBAAoB,IAAI,EAAE,CAAC;IAEzD,OAAO,aAAa,CAAC,SAAS,EAAE,kBAAkB,CAAC,GAAG,CAAC,UAAU,CAAC,IAAI,CAAC,CAAC,CAAC;AAC3E,CAAC;AAED;;GAEG;AACH,SAAS,aAAa,CACpB,SAAgD,EAChD,QAAgB;IAEhB,IAAI,SAAS,KAAK,SAAS,EAAE,CAAC;QAC5B,OAAO,CAAC,CAAC;IACX,CAAC;IAED,MAAM,WAAW,GAAG,CAAC,SAAS,CAAC,mBAAmB,IAAI,EAAE,CAAC,CAAC,MAAM,CAC9D,CAAC,cAAc,EAAE,EAAE,CAAC,cAAc,CAAC,IAAI,KAAK,MAAM,CACnD,CAAC;IACF,MAAM,cAAc,GAClB,SAAS,CAAC,YAAY,EAAE,iBAAiB,KAAK,SAAS;QACrD,CAAC,CAAC,CAAC;QACH,CAAC,CAAC,qBAAqB,CAAC;IAE5B,OAAO,CACL,QAAQ,GAAG,cAAc,GAAG,WAAW,CAAC,MAAM,GAAG,sBAAsB,CACxE,CAAC;AACJ,CAAC"}

package/dist/service/wafv2/web-acl/sim-waf-web-acl-capacity.d.ts

@@ -0,0 +1,15 @@
+import type { SimWafRuleInput } from "./sim-waf-rule.type.js";
+/**
+ * What a web ACL's rules add up to in capacity units.
+ *
+ * The costs are the ones AWS publishes for each statement kind, along with the
+ * surcharges for inspecting every query argument and for each text
+ * transformation. `sim-waf-statement-capacity.ts` holds them.
+ *
+ * The sum is an upper bound on what AWS would charge. Real WAF charges a web
+ * ACL the sum of its rules minus whatever work it can share between them, and
+ * publishes no description of when it shares any. Nothing here enforces the
+ * 5,000 unit maximum on a web ACL or the 1,500 units the base price covers.
+ */
+export declare function simWafWebAclCapacity(rules: readonly SimWafRuleInput[] | undefined): number;
+//# sourceMappingURL=sim-waf-web-acl-capacity.d.ts.map

package/dist/service/wafv2/web-acl/sim-waf-web-acl-capacity.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"sim-waf-web-acl-capacity.d.ts","sourceRoot":"","sources":["../../../../src/service/wafv2/web-acl/sim-waf-web-acl-capacity.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,wBAAwB,CAAC;AAG9D;;;;;;;;;;;GAWG;AACH,wBAAgB,oBAAoB,CAClC,KAAK,EAAE,SAAS,eAAe,EAAE,GAAG,SAAS,GAC5C,MAAM,CAKR"}

package/dist/service/wafv2/web-acl/sim-waf-web-acl-capacity.js

@@ -0,0 +1,58 @@
+import { findSimWafManagedRuleGroup } from "../managed/sim-waf-managed-rule-groups.js";
+import { simWafMatchCapacity } from "./sim-waf-statement-capacity.js";
+/**
+ * What a web ACL's rules add up to in capacity units.
+ *
+ * The costs are the ones AWS publishes for each statement kind, along with the
+ * surcharges for inspecting every query argument and for each text
+ * transformation. `sim-waf-statement-capacity.ts` holds them.
+ *
+ * The sum is an upper bound on what AWS would charge. Real WAF charges a web
+ * ACL the sum of its rules minus whatever work it can share between them, and
+ * publishes no description of when it shares any. Nothing here enforces the
+ * 5,000 unit maximum on a web ACL or the 1,500 units the base price covers.
+ */
+export function simWafWebAclCapacity(rules) {
+    return (rules ?? []).reduce((total, rule) => total + statementCapacity(rule.Statement), 0);
+}
+/**
+ * What one statement costs, with whatever is nested inside it.
+ */
+function statementCapacity(statement) {
+    if (statement === undefined) {
+        return 0;
+    }
+    return (simWafMatchCapacity(statement) +
+        nestedCapacity(statement) +
+        managedGroupCapacity(statement));
+}
+/**
+ * What the statements inside a logical statement cost.
+ *
+ * A logical statement costs what its parts cost and nothing of its own.
+ */
+function nestedCapacity(statement) {
+    const joined = [
+        ...(statement.AndStatement?.Statements ?? []),
+        ...(statement.OrStatement?.Statements ?? []),
+    ];
+    return (joined.reduce((total, nested) => total + statementCapacity(nested), 0) +
+        statementCapacity(statement.NotStatement?.Statement));
+}
+/**
+ * What a rule naming a managed rule group costs.
+ *
+ * A group is fixed at the capacity its owner gave it, and a scope-down
+ * statement is charged on top. A group this simulation does not carry
+ * contributes nothing, which cannot happen through a compiled web ACL: naming
+ * one is refused where the rule is written.
+ */
+function managedGroupCapacity(statement) {
+    const named = statement.ManagedRuleGroupStatement;
+    if (named === undefined) {
+        return 0;
+    }
+    const group = findSimWafManagedRuleGroup(named.VendorName, named.Name);
+    return (group?.capacity ?? 0) + statementCapacity(named.ScopeDownStatement);
+}
+//# sourceMappingURL=sim-waf-web-acl-capacity.js.map

package/dist/service/wafv2/web-acl/sim-waf-web-acl-capacity.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"sim-waf-web-acl-capacity.js","sourceRoot":"","sources":["../../../../src/service/wafv2/web-acl/sim-waf-web-acl-capacity.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,0BAA0B,EAAE,MAAM,2CAA2C,CAAC;AAGvF,OAAO,EAAE,mBAAmB,EAAE,MAAM,iCAAiC,CAAC;AAEtE;;;;;;;;;;;GAWG;AACH,MAAM,UAAU,oBAAoB,CAClC,KAA6C;IAE7C,OAAO,CAAC,KAAK,IAAI,EAAE,CAAC,CAAC,MAAM,CACzB,CAAC,KAAK,EAAE,IAAI,EAAE,EAAE,CAAC,KAAK,GAAG,iBAAiB,CAAC,IAAI,CAAC,SAAS,CAAC,EAC1D,CAAC,CACF,CAAC;AACJ,CAAC;AAED;;GAEG;AACH,SAAS,iBAAiB,CACxB,SAA2C;IAE3C,IAAI,SAAS,KAAK,SAAS,EAAE,CAAC;QAC5B,OAAO,CAAC,CAAC;IACX,CAAC;IAED,OAAO,CACL,mBAAmB,CAAC,SAAS,CAAC;QAC9B,cAAc,CAAC,SAAS,CAAC;QACzB,oBAAoB,CAAC,SAAS,CAAC,CAChC,CAAC;AACJ,CAAC;AAED;;;;GAIG;AACH,SAAS,cAAc,CAAC,SAA+B;IACrD,MAAM,MAAM,GAAG;QACb,GAAG,CAAC,SAAS,CAAC,YAAY,EAAE,UAAU,IAAI,EAAE,CAAC;QAC7C,GAAG,CAAC,SAAS,CAAC,WAAW,EAAE,UAAU,IAAI,EAAE,CAAC;KAC7C,CAAC;IAEF,OAAO,CACL,MAAM,CAAC,MAAM,CAAC,CAAC,KAAK,EAAE,MAAM,EAAE,EAAE,CAAC,KAAK,GAAG,iBAAiB,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC;QACtE,iBAAiB,CAAC,SAAS,CAAC,YAAY,EAAE,SAAS,CAAC,CACrD,CAAC;AACJ,CAAC;AAED;;;;;;;GAOG;AACH,SAAS,oBAAoB,CAAC,SAA+B;IAC3D,MAAM,KAAK,GAAG,SAAS,CAAC,yBAAyB,CAAC;IAElD,IAAI,KAAK,KAAK,SAAS,EAAE,CAAC;QACxB,OAAO,CAAC,CAAC;IACX,CAAC;IAED,MAAM,KAAK,GAAG,0BAA0B,CAAC,KAAK,CAAC,UAAU,EAAE,KAAK,CAAC,IAAI,CAAC,CAAC;IAEvE,OAAO,CAAC,KAAK,EAAE,QAAQ,IAAI,CAAC,CAAC,GAAG,iBAAiB,CAAC,KAAK,CAAC,kBAAkB,CAAC,CAAC;AAC9E,CAAC"}

package/dist/service/wafv2/web-acl/sim-waf-web-acl-configuration.d.ts

@@ -0,0 +1,23 @@
+import { SimWafAction } from "./sim-waf-action.js";
+import type { SimWafActionInput } from "./sim-waf-action.type.js";
+import type { SimWafCustomResponseBodies } from "./sim-waf-custom-response.type.js";
+import type { SimWafRuleInput } from "./sim-waf-rule.type.js";
+/**
+ * Everything a web ACL is written with, on creation and on every update.
+ */
+export interface SimWafWebAclConfiguration {
+    readonly defaultAction?: SimWafActionInput | undefined;
+    readonly rules?: readonly SimWafRuleInput[] | undefined;
+    readonly customResponseBodies?: SimWafCustomResponseBodies | undefined;
+    readonly visibilityConfig?: unknown;
+    readonly description?: string | undefined;
+}
+/**
+ * Read the action a request no rule claims is given.
+ *
+ * Only `Allow` and `Block` are valid here on real WAF, and `Count` is the one
+ * worth refusing by name: a default action that counted would leave every
+ * unmatched request unanswered.
+ */
+export declare function readSimWafDefaultAction(configuration: SimWafWebAclConfiguration): SimWafAction;
+//# sourceMappingURL=sim-waf-web-acl-configuration.d.ts.map

package/dist/service/wafv2/web-acl/sim-waf-web-acl-configuration.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"sim-waf-web-acl-configuration.d.ts","sourceRoot":"","sources":["../../../../src/service/wafv2/web-acl/sim-waf-web-acl-configuration.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,YAAY,EAAE,MAAM,qBAAqB,CAAC;AACnD,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,0BAA0B,CAAC;AAClE,OAAO,KAAK,EAAE,0BAA0B,EAAE,MAAM,mCAAmC,CAAC;AACpF,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,wBAAwB,CAAC;AAE9D;;GAEG;AACH,MAAM,WAAW,yBAAyB;IACxC,QAAQ,CAAC,aAAa,CAAC,EAAE,iBAAiB,GAAG,SAAS,CAAC;IACvD,QAAQ,CAAC,KAAK,CAAC,EAAE,SAAS,eAAe,EAAE,GAAG,SAAS,CAAC;IACxD,QAAQ,CAAC,oBAAoB,CAAC,EAAE,0BAA0B,GAAG,SAAS,CAAC;IACvE,QAAQ,CAAC,gBAAgB,CAAC,EAAE,OAAO,CAAC;IACpC,QAAQ,CAAC,WAAW,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;CAC3C;AAED;;;;;;GAMG;AACH,wBAAgB,uBAAuB,CACrC,aAAa,EAAE,yBAAyB,GACvC,YAAY,CAed"}