@kensio/yulin 1.17.2 → 1.18.1

package/dist/service/wafv2/managed/sim-waf-managed-rule.type.d.ts

@@ -0,0 +1,48 @@
+import type { SimWafManagedRequestParts } from "./sim-waf-managed-request.js";
+/**
+ * How closely one simulated managed rule follows the AWS rule it stands for.
+ *
+ * AWS publishes every rule name, every default action, every label and the
+ * size limits, and holds back the pattern set behind each rule. What can be
+ * simulated therefore varies by rule, and each one says which it is rather
+ * than leaving a reader to find out from a request that was not blocked.
+ *
+ * - `exact` matches where the AWS rule matches. The condition is documented
+ *   in full, so there is nothing left to approximate.
+ * - `documented` matches the patterns AWS published for the rule and nothing
+ *   beyond them, so it detects less than the AWS rule does.
+ * - `declared` detects nothing at all, and matches only a request a test
+ *   declared a match for. The detection AWS runs is undocumented, and a guess
+ *   at it would block requests AWS allows.
+ */
+export type SimWafManagedRuleTier = "exact" | "documented" | "declared";
+/**
+ * Whether one managed rule claims a request.
+ */
+export type SimWafManagedDetector = (parts: SimWafManagedRequestParts) => boolean;
+/**
+ * One rule of an AWS managed rule group.
+ *
+ * Every rule in the three simulated groups blocks by default, so the action is
+ * not carried here. A rule with no detector is a declared-only rule.
+ */
+export interface SimWafManagedRuleDefinition {
+    /** The rule name, as AWS names it and as an override names it. */
+    readonly name: string;
+    /** The label this rule adds, within its group's namespace. */
+    readonly label: string;
+    readonly tier: SimWafManagedRuleTier;
+    readonly detects?: SimWafManagedDetector | undefined;
+}
+/**
+ * One AWS managed rule group, in the order its rules are evaluated.
+ */
+export interface SimWafManagedRuleGroupDefinition {
+    readonly name: string;
+    /** The prefix every label this group adds is qualified by. */
+    readonly labelNamespace: string;
+    /** The WCUs the group costs, which `DescribeManagedRuleGroup` reports. */
+    readonly capacity: number;
+    readonly rules: readonly SimWafManagedRuleDefinition[];
+}
+//# sourceMappingURL=sim-waf-managed-rule.type.d.ts.map

package/dist/service/wafv2/managed/sim-waf-managed-rule.type.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"sim-waf-managed-rule.type.d.ts","sourceRoot":"","sources":["../../../../src/service/wafv2/managed/sim-waf-managed-rule.type.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,yBAAyB,EAAE,MAAM,8BAA8B,CAAC;AAE9E;;;;;;;;;;;;;;;GAeG;AACH,MAAM,MAAM,qBAAqB,GAAG,OAAO,GAAG,YAAY,GAAG,UAAU,CAAC;AAExE;;GAEG;AACH,MAAM,MAAM,qBAAqB,GAAG,CAClC,KAAK,EAAE,yBAAyB,KAC7B,OAAO,CAAC;AAEb;;;;;GAKG;AACH,MAAM,WAAW,2BAA2B;IAC1C,kEAAkE;IAClE,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IAEtB,8DAA8D;IAC9D,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IAEvB,QAAQ,CAAC,IAAI,EAAE,qBAAqB,CAAC;IAErC,QAAQ,CAAC,OAAO,CAAC,EAAE,qBAAqB,GAAG,SAAS,CAAC;CACtD;AAED;;GAEG;AACH,MAAM,WAAW,gCAAgC;IAC/C,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IAEtB,8DAA8D;IAC9D,QAAQ,CAAC,cAAc,EAAE,MAAM,CAAC;IAEhC,0EAA0E;IAC1E,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAE1B,QAAQ,CAAC,KAAK,EAAE,SAAS,2BAA2B,EAAE,CAAC;CACxD"}

package/dist/service/wafv2/managed/sim-waf-managed-rule.type.js

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=sim-waf-managed-rule.type.js.map

package/dist/service/wafv2/managed/sim-waf-managed-rule.type.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"sim-waf-managed-rule.type.js","sourceRoot":"","sources":["../../../../src/service/wafv2/managed/sim-waf-managed-rule.type.ts"],"names":[],"mappings":""}

package/dist/service/wafv2/managed/sim-waf-managed-rules.d.ts

@@ -0,0 +1,59 @@
+import type { SimWafInspectedRequest } from "../evaluate/sim-waf-inspected-request.js";
+import { type SimWafManagedRuleReport } from "./sim-waf-managed-rule-report.js";
+import type { SimWafManagedRuleTier } from "./sim-waf-managed-rule.type.js";
+/**
+ * The managed rules a test says claim a request.
+ */
+export interface SimWafManagedMatchDeclaration {
+    /** The rules that claim the request, by the name AWS gives them. */
+    readonly matches: readonly string[];
+}
+/**
+ * The managed rule matches this simulated WAFv2 answers with, and what it
+ * covers of each rule.
+ *
+ * Most of the managed rules detect for themselves, and this is for the ones
+ * that cannot. The four `CrossSiteScripting_*` rules run detection AWS
+ * documents none of, and the rules in the documented tier match the published
+ * patterns and nothing beyond them, so a test asserting that a payload is
+ * blocked says which rule claims it:
+ *
+ * ```typescript
+ * simAws.wafV2().managedRules().onRequest("/search", {
+ *   matches: ["CrossSiteScripting_QueryArguments"],
+ * });
+ * ```
+ *
+ * A declared match is a match, and everything after it is what the group would
+ * have done anyway: the rule adds its label, an action override applies to it,
+ * and the group blocks by that rule.
+ */
+export declare class SimWafManagedRules {
+    #private;
+    /**
+     * Declare which managed rules claim a request to one URI path.
+     *
+     * The path is matched exactly, as simulated Rekognition matches the name of
+     * an image a result was declared for. A rule name no simulated group carries
+     * is refused here rather than matching nothing later.
+     */
+    onRequest(uriPath: string, declaration: SimWafManagedMatchDeclaration): void;
+    /**
+     * The rules declared to claim one request.
+     */
+    declaredMatches(request: SimWafInspectedRequest): ReadonlySet<string>;
+    /**
+     * What this simulation covers of one managed rule.
+     */
+    tierOf(ruleName: string): SimWafManagedRuleTier;
+    /**
+     * What this simulation covers of every managed rule it carries.
+     *
+     * This is how a reader finds out what a group does here without reading the
+     * source of it, which matters most for the rules that detect less than the
+     * AWS rule they stand for.
+     */
+    rules(): readonly SimWafManagedRuleReport[];
+    private requiredRule;
+}
+//# sourceMappingURL=sim-waf-managed-rules.d.ts.map

package/dist/service/wafv2/managed/sim-waf-managed-rules.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"sim-waf-managed-rules.d.ts","sourceRoot":"","sources":["../../../../src/service/wafv2/managed/sim-waf-managed-rules.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,sBAAsB,EAAE,MAAM,0CAA0C,CAAC;AAKvF,OAAO,EACL,KAAK,uBAAuB,EAE7B,MAAM,kCAAkC,CAAC;AAE1C,OAAO,KAAK,EAAE,qBAAqB,EAAE,MAAM,gCAAgC,CAAC;AAE5E;;GAEG;AACH,MAAM,WAAW,6BAA6B;IAC5C,oEAAoE;IACpE,QAAQ,CAAC,OAAO,EAAE,SAAS,MAAM,EAAE,CAAC;CACrC;AAID;;;;;;;;;;;;;;;;;;;GAmBG;AACH,qBAAa,kBAAkB;;IAG7B;;;;;;OAMG;IACH,SAAS,CAAC,OAAO,EAAE,MAAM,EAAE,WAAW,EAAE,6BAA6B,GAAG,IAAI,CAc3E;IAED;;OAEG;IACH,eAAe,CAAC,OAAO,EAAE,sBAAsB,GAAG,WAAW,CAAC,MAAM,CAAC,CAEpE;IAED;;OAEG;IACH,MAAM,CAAC,QAAQ,EAAE,MAAM,GAAG,qBAAqB,CAE9C;IAED;;;;;;OAMG;IACH,KAAK,IAAI,SAAS,uBAAuB,EAAE,CAE1C;IAED,OAAO,CAAC,YAAY;CAarB"}

package/dist/service/wafv2/managed/sim-waf-managed-rules.js

@@ -0,0 +1,73 @@
+import { SimWafDeclarationError } from "../error/sim-wafv2.error.js";
+import { findSimWafManagedRule, } from "./sim-waf-managed-rule-groups.js";
+import { simWafManagedRuleReports, } from "./sim-waf-managed-rule-report.js";
+const noMatches = new Set();
+/**
+ * The managed rule matches this simulated WAFv2 answers with, and what it
+ * covers of each rule.
+ *
+ * Most of the managed rules detect for themselves, and this is for the ones
+ * that cannot. The four `CrossSiteScripting_*` rules run detection AWS
+ * documents none of, and the rules in the documented tier match the published
+ * patterns and nothing beyond them, so a test asserting that a payload is
+ * blocked says which rule claims it:
+ *
+ * ```typescript
+ * simAws.wafV2().managedRules().onRequest("/search", {
+ *   matches: ["CrossSiteScripting_QueryArguments"],
+ * });
+ * ```
+ *
+ * A declared match is a match, and everything after it is what the group would
+ * have done anyway: the rule adds its label, an action override applies to it,
+ * and the group blocks by that rule.
+ */
+export class SimWafManagedRules {
+    #byUriPath = new Map();
+    /**
+     * Declare which managed rules claim a request to one URI path.
+     *
+     * The path is matched exactly, as simulated Rekognition matches the name of
+     * an image a result was declared for. A rule name no simulated group carries
+     * is refused here rather than matching nothing later.
+     */
+    onRequest(uriPath, declaration) {
+        if (uriPath === "") {
+            throw new SimWafDeclarationError("A declared managed rule match needs the URI path of the request it " +
+                "is declared for");
+        }
+        this.#byUriPath.set(uriPath, new Set(declaration.matches.map((name) => this.requiredRule(name).rule.name)));
+    }
+    /**
+     * The rules declared to claim one request.
+     */
+    declaredMatches(request) {
+        return this.#byUriPath.get(request.uriPath) ?? noMatches;
+    }
+    /**
+     * What this simulation covers of one managed rule.
+     */
+    tierOf(ruleName) {
+        return this.requiredRule(ruleName).rule.tier;
+    }
+    /**
+     * What this simulation covers of every managed rule it carries.
+     *
+     * This is how a reader finds out what a group does here without reading the
+     * source of it, which matters most for the rules that detect less than the
+     * AWS rule they stand for.
+     */
+    rules() {
+        return simWafManagedRuleReports();
+    }
+    requiredRule(ruleName) {
+        const entry = findSimWafManagedRule(ruleName);
+        if (entry === undefined) {
+            throw new SimWafDeclarationError(`No simulated AWS managed rule group holds a rule named ` +
+                `${ruleName}. The rules that are simulated are reported by ` +
+                `managedRules().rules().`);
+        }
+        return entry;
+    }
+}
+//# sourceMappingURL=sim-waf-managed-rules.js.map

package/dist/service/wafv2/managed/sim-waf-managed-rules.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"sim-waf-managed-rules.js","sourceRoot":"","sources":["../../../../src/service/wafv2/managed/sim-waf-managed-rules.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,sBAAsB,EAAE,MAAM,6BAA6B,CAAC;AAErE,OAAO,EACL,qBAAqB,GAEtB,MAAM,kCAAkC,CAAC;AAC1C,OAAO,EAEL,wBAAwB,GACzB,MAAM,kCAAkC,CAAC;AAY1C,MAAM,SAAS,GAAwB,IAAI,GAAG,EAAE,CAAC;AAEjD;;;;;;;;;;;;;;;;;;;GAmBG;AACH,MAAM,OAAO,kBAAkB;IACpB,UAAU,GAAG,IAAI,GAAG,EAA+B,CAAC;IAE7D;;;;;;OAMG;IACH,SAAS,CAAC,OAAe,EAAE,WAA0C;QACnE,IAAI,OAAO,KAAK,EAAE,EAAE,CAAC;YACnB,MAAM,IAAI,sBAAsB,CAC9B,qEAAqE;gBACnE,iBAAiB,CACpB,CAAC;QACJ,CAAC;QAED,IAAI,CAAC,UAAU,CAAC,GAAG,CACjB,OAAO,EACP,IAAI,GAAG,CACL,WAAW,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,YAAY,CAAC,IAAI,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CACrE,CACF,CAAC;IACJ,CAAC;IAED;;OAEG;IACH,eAAe,CAAC,OAA+B;QAC7C,OAAO,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,OAAO,CAAC,OAAO,CAAC,IAAI,SAAS,CAAC;IAC3D,CAAC;IAED;;OAEG;IACH,MAAM,CAAC,QAAgB;QACrB,OAAO,IAAI,CAAC,YAAY,CAAC,QAAQ,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC;IAC/C,CAAC;IAED;;;;;;OAMG;IACH,KAAK;QACH,OAAO,wBAAwB,EAAE,CAAC;IACpC,CAAC;IAEO,YAAY,CAAC,QAAgB;QACnC,MAAM,KAAK,GAAG,qBAAqB,CAAC,QAAQ,CAAC,CAAC;QAE9C,IAAI,KAAK,KAAK,SAAS,EAAE,CAAC;YACxB,MAAM,IAAI,sBAAsB,CAC9B,yDAAyD;gBACvD,GAAG,QAAQ,iDAAiD;gBAC5D,yBAAyB,CAC5B,CAAC;QACJ,CAAC;QAED,OAAO,KAAK,CAAC;IACf,CAAC;CACF"}

package/dist/service/wafv2/regex-pattern-set/sim-waf-regex-pattern-set.d.ts

@@ -0,0 +1,37 @@
+import { SimWafResource, type SimWafResourceProperties } from "../resource/sim-waf-resource.js";
+import { type SimWafRegularExpressionInput } from "./sim-waf-regular-expressions.js";
+interface SimWafRegexPatternSetProperties extends SimWafResourceProperties {
+    readonly regularExpressions: readonly SimWafRegularExpressionInput[];
+}
+/**
+ * One named list of regular expressions a rule can point at.
+ *
+ * The patterns are compiled when the set is created, so an expression that
+ * will not compile is refused where it was written rather than quietly
+ * matching nothing when a request arrives.
+ */
+export declare class SimWafRegexPatternSet extends SimWafResource {
+    #private;
+    constructor(properties: SimWafRegexPatternSetProperties);
+    /**
+     * The expressions this set holds, as they were written.
+     */
+    get regularExpressions(): readonly string[];
+    /**
+     * The expressions this set holds, compiled.
+     */
+    get expressions(): readonly RegExp[];
+    /**
+     * Write a new list of expressions over this one.
+     *
+     * Every expression is compiled before anything is replaced. A set that
+     * refuses an update keeps the expressions it had.
+     */
+    replaceExpressions(properties: {
+        readonly regularExpressions: readonly SimWafRegularExpressionInput[];
+        readonly description?: string | undefined;
+        readonly lockToken: string | undefined;
+    }): void;
+}
+export { type SimWafRegularExpressionInput } from "./sim-waf-regular-expressions.js";
+//# sourceMappingURL=sim-waf-regex-pattern-set.d.ts.map

package/dist/service/wafv2/regex-pattern-set/sim-waf-regex-pattern-set.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"sim-waf-regex-pattern-set.d.ts","sourceRoot":"","sources":["../../../../src/service/wafv2/regex-pattern-set/sim-waf-regex-pattern-set.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,cAAc,EACd,KAAK,wBAAwB,EAC9B,MAAM,iCAAiC,CAAC;AACzC,OAAO,EAEL,KAAK,4BAA4B,EAElC,MAAM,kCAAkC,CAAC;AAE1C,UAAU,+BAAgC,SAAQ,wBAAwB;IACxE,QAAQ,CAAC,kBAAkB,EAAE,SAAS,4BAA4B,EAAE,CAAC;CACtE;AAED;;;;;;GAMG;AACH,qBAAa,qBAAsB,SAAQ,cAAc;;IAIvD,YAAY,UAAU,EAAE,+BAA+B,EAStD;IAED;;OAEG;IACH,IAAI,kBAAkB,IAAI,SAAS,MAAM,EAAE,CAE1C;IAED;;OAEG;IACH,IAAI,WAAW,IAAI,SAAS,MAAM,EAAE,CAEnC;IAED;;;;;OAKG;IACH,kBAAkB,CAAC,UAAU,EAAE;QAC7B,QAAQ,CAAC,kBAAkB,EAAE,SAAS,4BAA4B,EAAE,CAAC;QACrE,QAAQ,CAAC,WAAW,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;QAC1C,QAAQ,CAAC,SAAS,EAAE,MAAM,GAAG,SAAS,CAAC;KACxC,GAAG,IAAI,CAUP;CACF;AAED,OAAO,EAAE,KAAK,4BAA4B,EAAE,MAAM,kCAAkC,CAAC"}

package/dist/service/wafv2/regex-pattern-set/sim-waf-regex-pattern-set.js

@@ -0,0 +1,46 @@
+import { SimWafResource, } from "../resource/sim-waf-resource.js";
+import { compiledSimWafExpression, simWafPatternStrings, } from "./sim-waf-regular-expressions.js";
+/**
+ * One named list of regular expressions a rule can point at.
+ *
+ * The patterns are compiled when the set is created, so an expression that
+ * will not compile is refused where it was written rather than quietly
+ * matching nothing when a request arrives.
+ */
+export class SimWafRegexPatternSet extends SimWafResource {
+    #regularExpressions;
+    #expressions;
+    constructor(properties) {
+        super("regexpatternset", properties);
+        this.#regularExpressions = simWafPatternStrings(properties.regularExpressions);
+        this.#expressions = this.#regularExpressions.map((pattern) => compiledSimWafExpression(pattern));
+    }
+    /**
+     * The expressions this set holds, as they were written.
+     */
+    get regularExpressions() {
+        return this.#regularExpressions;
+    }
+    /**
+     * The expressions this set holds, compiled.
+     */
+    get expressions() {
+        return this.#expressions;
+    }
+    /**
+     * Write a new list of expressions over this one.
+     *
+     * Every expression is compiled before anything is replaced. A set that
+     * refuses an update keeps the expressions it had.
+     */
+    replaceExpressions(properties) {
+        const patterns = simWafPatternStrings(properties.regularExpressions);
+        const expressions = patterns.map((pattern) => compiledSimWafExpression(pattern));
+        this.takeLock(properties.lockToken);
+        this.replaceDescription(properties.description);
+        this.#regularExpressions = patterns;
+        this.#expressions = expressions;
+    }
+}
+export {} from "./sim-waf-regular-expressions.js";
+//# sourceMappingURL=sim-waf-regex-pattern-set.js.map

package/dist/service/wafv2/regex-pattern-set/sim-waf-regex-pattern-set.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"sim-waf-regex-pattern-set.js","sourceRoot":"","sources":["../../../../src/service/wafv2/regex-pattern-set/sim-waf-regex-pattern-set.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,cAAc,GAEf,MAAM,iCAAiC,CAAC;AACzC,OAAO,EACL,wBAAwB,EAExB,oBAAoB,GACrB,MAAM,kCAAkC,CAAC;AAM1C;;;;;;GAMG;AACH,MAAM,OAAO,qBAAsB,SAAQ,cAAc;IACvD,mBAAmB,CAAoB;IACvC,YAAY,CAAoB;IAEhC,YAAY,UAA2C;QACrD,KAAK,CAAC,iBAAiB,EAAE,UAAU,CAAC,CAAC;QAErC,IAAI,CAAC,mBAAmB,GAAG,oBAAoB,CAC7C,UAAU,CAAC,kBAAkB,CAC9B,CAAC;QACF,IAAI,CAAC,YAAY,GAAG,IAAI,CAAC,mBAAmB,CAAC,GAAG,CAAC,CAAC,OAAO,EAAE,EAAE,CAC3D,wBAAwB,CAAC,OAAO,CAAC,CAClC,CAAC;IACJ,CAAC;IAED;;OAEG;IACH,IAAI,kBAAkB;QACpB,OAAO,IAAI,CAAC,mBAAmB,CAAC;IAClC,CAAC;IAED;;OAEG;IACH,IAAI,WAAW;QACb,OAAO,IAAI,CAAC,YAAY,CAAC;IAC3B,CAAC;IAED;;;;;OAKG;IACH,kBAAkB,CAAC,UAIlB;QACC,MAAM,QAAQ,GAAG,oBAAoB,CAAC,UAAU,CAAC,kBAAkB,CAAC,CAAC;QACrE,MAAM,WAAW,GAAG,QAAQ,CAAC,GAAG,CAAC,CAAC,OAAO,EAAE,EAAE,CAC3C,wBAAwB,CAAC,OAAO,CAAC,CAClC,CAAC;QAEF,IAAI,CAAC,QAAQ,CAAC,UAAU,CAAC,SAAS,CAAC,CAAC;QACpC,IAAI,CAAC,kBAAkB,CAAC,UAAU,CAAC,WAAW,CAAC,CAAC;QAChD,IAAI,CAAC,mBAAmB,GAAG,QAAQ,CAAC;QACpC,IAAI,CAAC,YAAY,GAAG,WAAW,CAAC;IAClC,CAAC;CACF;AAED,OAAO,EAAqC,MAAM,kCAAkC,CAAC"}

package/dist/service/wafv2/regex-pattern-set/sim-waf-regular-expressions.d.ts

@@ -0,0 +1,15 @@
+/**
+ * Minimal structural WAFv2 Regex.
+ */
+export interface SimWafRegularExpressionInput {
+    readonly RegexString?: string | undefined;
+}
+/**
+ * Read the expressions a pattern set was written with.
+ */
+export declare function simWafPatternStrings(regularExpressions: readonly SimWafRegularExpressionInput[]): readonly string[];
+/**
+ * Compile one expression, refusing one that will not compile.
+ */
+export declare function compiledSimWafExpression(pattern: string): RegExp;
+//# sourceMappingURL=sim-waf-regular-expressions.d.ts.map

package/dist/service/wafv2/regex-pattern-set/sim-waf-regular-expressions.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"sim-waf-regular-expressions.d.ts","sourceRoot":"","sources":["../../../../src/service/wafv2/regex-pattern-set/sim-waf-regular-expressions.ts"],"names":[],"mappings":"AAGA;;GAEG;AACH,MAAM,WAAW,4BAA4B;IAC3C,QAAQ,CAAC,WAAW,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;CAC3C;AAED;;GAEG;AACH,wBAAgB,oBAAoB,CAClC,kBAAkB,EAAE,SAAS,4BAA4B,EAAE,GAC1D,SAAS,MAAM,EAAE,CAInB;AAeD;;GAEG;AACH,wBAAgB,wBAAwB,CAAC,OAAO,EAAE,MAAM,GAAG,MAAM,CAWhE"}

package/dist/service/wafv2/regex-pattern-set/sim-waf-regular-expressions.js

@@ -0,0 +1,27 @@
+import { SimWafInvalidParameterException } from "../error/sim-wafv2.error.js";
+import { simWafRegExp } from "../statement/sim-waf-regex.js";
+/**
+ * Read the expressions a pattern set was written with.
+ */
+export function simWafPatternStrings(regularExpressions) {
+    return regularExpressions.map((regularExpression) => requiredRegexString(regularExpression));
+}
+function requiredRegexString(regularExpression) {
+    if (regularExpression.RegexString === undefined) {
+        throw new SimWafInvalidParameterException("Error reason: A regular expression needs a RegexString, field: " +
+            "REGULAR_EXPRESSION, parameter: RegexString");
+    }
+    return regularExpression.RegexString;
+}
+/**
+ * Compile one expression, refusing one that will not compile.
+ */
+export function compiledSimWafExpression(pattern) {
+    const expression = simWafRegExp(pattern);
+    if (expression === undefined) {
+        throw new SimWafInvalidParameterException(`Error reason: The regular expression is not valid, field: ` +
+            `REGULAR_EXPRESSION, parameter: ${pattern}`);
+    }
+    return expression;
+}
+//# sourceMappingURL=sim-waf-regular-expressions.js.map

package/dist/service/wafv2/regex-pattern-set/sim-waf-regular-expressions.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"sim-waf-regular-expressions.js","sourceRoot":"","sources":["../../../../src/service/wafv2/regex-pattern-set/sim-waf-regular-expressions.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,+BAA+B,EAAE,MAAM,6BAA6B,CAAC;AAC9E,OAAO,EAAE,YAAY,EAAE,MAAM,+BAA+B,CAAC;AAS7D;;GAEG;AACH,MAAM,UAAU,oBAAoB,CAClC,kBAA2D;IAE3D,OAAO,kBAAkB,CAAC,GAAG,CAAC,CAAC,iBAAiB,EAAE,EAAE,CAClD,mBAAmB,CAAC,iBAAiB,CAAC,CACvC,CAAC;AACJ,CAAC;AAED,SAAS,mBAAmB,CAC1B,iBAA+C;IAE/C,IAAI,iBAAiB,CAAC,WAAW,KAAK,SAAS,EAAE,CAAC;QAChD,MAAM,IAAI,+BAA+B,CACvC,iEAAiE;YAC/D,4CAA4C,CAC/C,CAAC;IACJ,CAAC;IAED,OAAO,iBAAiB,CAAC,WAAW,CAAC;AACvC,CAAC;AAED;;GAEG;AACH,MAAM,UAAU,wBAAwB,CAAC,OAAe;IACtD,MAAM,UAAU,GAAG,YAAY,CAAC,OAAO,CAAC,CAAC;IAEzC,IAAI,UAAU,KAAK,SAAS,EAAE,CAAC;QAC7B,MAAM,IAAI,+BAA+B,CACvC,4DAA4D;YAC1D,kCAAkC,OAAO,EAAE,CAC9C,CAAC;IACJ,CAAC;IAED,OAAO,UAAU,CAAC;AACpB,CAAC"}

package/dist/service/wafv2/resource/sim-waf-resource-store.d.ts

@@ -0,0 +1,52 @@
+import type { SimWafScope } from "../scope/sim-waf-scope.js";
+import type { SimWafResource } from "./sim-waf-resource.js";
+/**
+ * How one WAFv2 resource is asked for.
+ *
+ * All three reads take the same three parts, because a name is unique within a
+ * scope but is not on its own what a resource is: the id says which of two
+ * resources created under that name over time this one is.
+ */
+export interface SimWafResourceKey {
+    readonly scope: SimWafScope;
+    readonly name: string;
+    readonly id?: string | undefined;
+}
+/**
+ * The WAFv2 resources of one kind in one account and region.
+ *
+ * `CLOUDFRONT` and `REGIONAL` are separate namespaces here as on AWS, which is
+ * why the scope is part of every lookup rather than a property to filter on.
+ */
+export declare class SimWafResourceStore<T extends SimWafResource> {
+    #private;
+    constructor(kindLabel: string);
+    /**
+     * Every resource in one scope, in the order they were created.
+     */
+    all(scope: SimWafScope): readonly T[];
+    /**
+     * Hold a new resource, refusing a name that is taken.
+     */
+    add(resource: T): T;
+    /**
+     * Find a resource, or nothing when the scope, name and id name none.
+     */
+    find(key: SimWafResourceKey): T | undefined;
+    /**
+     * Find a resource by its ARN, or nothing when this store holds none.
+     *
+     * A rule referring to another WAFv2 resource carries its ARN and nothing
+     * else, which is what this is for.
+     */
+    findByArn(arn: string): T | undefined;
+    /**
+     * Get a resource, refusing one that is not there.
+     */
+    require(key: SimWafResourceKey): T;
+    /**
+     * Remove a resource.
+     */
+    remove(resource: T): void;
+}
+//# sourceMappingURL=sim-waf-resource-store.d.ts.map

package/dist/service/wafv2/resource/sim-waf-resource-store.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"sim-waf-resource-store.d.ts","sourceRoot":"","sources":["../../../../src/service/wafv2/resource/sim-waf-resource-store.ts"],"names":[],"mappings":"AAIA,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,2BAA2B,CAAC;AAC7D,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,uBAAuB,CAAC;AAE5D;;;;;;GAMG;AACH,MAAM,WAAW,iBAAiB;IAChC,QAAQ,CAAC,KAAK,EAAE,WAAW,CAAC;IAC5B,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,EAAE,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;CAClC;AAED;;;;;GAKG;AACH,qBAAa,mBAAmB,CAAC,CAAC,SAAS,cAAc;;IAIvD,YAAY,SAAS,EAAE,MAAM,EAE5B;IAED;;OAEG;IACH,GAAG,CAAC,KAAK,EAAE,WAAW,GAAG,SAAS,CAAC,EAAE,CAKpC;IAED;;OAEG;IACH,GAAG,CAAC,QAAQ,EAAE,CAAC,GAAG,CAAC,CAalB;IAED;;OAEG;IACH,IAAI,CAAC,GAAG,EAAE,iBAAiB,GAAG,CAAC,GAAG,SAAS,CAQ1C;IAED;;;;;OAKG;IACH,SAAS,CAAC,GAAG,EAAE,MAAM,GAAG,CAAC,GAAG,SAAS,CAEpC;IAED;;OAEG;IACH,OAAO,CAAC,GAAG,EAAE,iBAAiB,GAAG,CAAC,CAWjC;IAED;;OAEG;IACH,MAAM,CAAC,QAAQ,EAAE,CAAC,GAAG,IAAI,CAExB;CACF"}

package/dist/service/wafv2/resource/sim-waf-resource-store.js

@@ -0,0 +1,75 @@
+import { SimWafDuplicateItemException, SimWafNonexistentItemException, } from "../error/sim-wafv2.error.js";
+/**
+ * The WAFv2 resources of one kind in one account and region.
+ *
+ * `CLOUDFRONT` and `REGIONAL` are separate namespaces here as on AWS, which is
+ * why the scope is part of every lookup rather than a property to filter on.
+ */
+export class SimWafResourceStore {
+    #kindLabel;
+    #resources = new Map();
+    constructor(kindLabel) {
+        this.#kindLabel = kindLabel;
+    }
+    /**
+     * Every resource in one scope, in the order they were created.
+     */
+    all(scope) {
+        return this.#resources
+            .values()
+            .filter((resource) => resource.scope === scope)
+            .toArray();
+    }
+    /**
+     * Hold a new resource, refusing a name that is taken.
+     */
+    add(resource) {
+        const key = storeKey(resource.scope, resource.name);
+        if (this.#resources.has(key)) {
+            throw new SimWafDuplicateItemException(`AWS WAF couldn't perform the operation because some resource in ` +
+                `your account already has the name ${resource.name}.`);
+        }
+        this.#resources.set(key, resource);
+        return resource;
+    }
+    /**
+     * Find a resource, or nothing when the scope, name and id name none.
+     */
+    find(key) {
+        const found = this.#resources.get(storeKey(key.scope, key.name));
+        if (found === undefined || (key.id !== undefined && found.id !== key.id)) {
+            return undefined;
+        }
+        return found;
+    }
+    /**
+     * Find a resource by its ARN, or nothing when this store holds none.
+     *
+     * A rule referring to another WAFv2 resource carries its ARN and nothing
+     * else, which is what this is for.
+     */
+    findByArn(arn) {
+        return this.#resources.values().find((resource) => resource.arn === arn);
+    }
+    /**
+     * Get a resource, refusing one that is not there.
+     */
+    require(key) {
+        const found = this.find(key);
+        if (found === undefined) {
+            throw new SimWafNonexistentItemException(`AWS WAF couldn't perform the operation because your resource ` +
+                `doesn't exist: ${this.#kindLabel} ${key.name}.`);
+        }
+        return found;
+    }
+    /**
+     * Remove a resource.
+     */
+    remove(resource) {
+        this.#resources.delete(storeKey(resource.scope, resource.name));
+    }
+}
+function storeKey(scope, name) {
+    return `${scope}:${name}`;
+}
+//# sourceMappingURL=sim-waf-resource-store.js.map

package/dist/service/wafv2/resource/sim-waf-resource-store.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"sim-waf-resource-store.js","sourceRoot":"","sources":["../../../../src/service/wafv2/resource/sim-waf-resource-store.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,4BAA4B,EAC5B,8BAA8B,GAC/B,MAAM,6BAA6B,CAAC;AAiBrC;;;;;GAKG;AACH,MAAM,OAAO,mBAAmB;IACrB,UAAU,CAAS;IACnB,UAAU,GAAG,IAAI,GAAG,EAAa,CAAC;IAE3C,YAAY,SAAiB;QAC3B,IAAI,CAAC,UAAU,GAAG,SAAS,CAAC;IAC9B,CAAC;IAED;;OAEG;IACH,GAAG,CAAC,KAAkB;QACpB,OAAO,IAAI,CAAC,UAAU;aACnB,MAAM,EAAE;aACR,MAAM,CAAC,CAAC,QAAQ,EAAE,EAAE,CAAC,QAAQ,CAAC,KAAK,KAAK,KAAK,CAAC;aAC9C,OAAO,EAAE,CAAC;IACf,CAAC;IAED;;OAEG;IACH,GAAG,CAAC,QAAW;QACb,MAAM,GAAG,GAAG,QAAQ,CAAC,QAAQ,CAAC,KAAK,EAAE,QAAQ,CAAC,IAAI,CAAC,CAAC;QAEpD,IAAI,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,GAAG,CAAC,EAAE,CAAC;YAC7B,MAAM,IAAI,4BAA4B,CACpC,kEAAkE;gBAChE,qCAAqC,QAAQ,CAAC,IAAI,GAAG,CACxD,CAAC;QACJ,CAAC;QAED,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,GAAG,EAAE,QAAQ,CAAC,CAAC;QAEnC,OAAO,QAAQ,CAAC;IAClB,CAAC;IAED;;OAEG;IACH,IAAI,CAAC,GAAsB;QACzB,MAAM,KAAK,GAAG,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,QAAQ,CAAC,GAAG,CAAC,KAAK,EAAE,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC;QAEjE,IAAI,KAAK,KAAK,SAAS,IAAI,CAAC,GAAG,CAAC,EAAE,KAAK,SAAS,IAAI,KAAK,CAAC,EAAE,KAAK,GAAG,CAAC,EAAE,CAAC,EAAE,CAAC;YACzE,OAAO,SAAS,CAAC;QACnB,CAAC;QAED,OAAO,KAAK,CAAC;IACf,CAAC;IAED;;;;;OAKG;IACH,SAAS,CAAC,GAAW;QACnB,OAAO,IAAI,CAAC,UAAU,CAAC,MAAM,EAAE,CAAC,IAAI,CAAC,CAAC,QAAQ,EAAE,EAAE,CAAC,QAAQ,CAAC,GAAG,KAAK,GAAG,CAAC,CAAC;IAC3E,CAAC;IAED;;OAEG;IACH,OAAO,CAAC,GAAsB;QAC5B,MAAM,KAAK,GAAG,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;QAE7B,IAAI,KAAK,KAAK,SAAS,EAAE,CAAC;YACxB,MAAM,IAAI,8BAA8B,CACtC,+DAA+D;gBAC7D,kBAAkB,IAAI,CAAC,UAAU,IAAI,GAAG,CAAC,IAAI,GAAG,CACnD,CAAC;QACJ,CAAC;QAED,OAAO,KAAK,CAAC;IACf,CAAC;IAED;;OAEG;IACH,MAAM,CAAC,QAAW;QAChB,IAAI,CAAC,UAAU,CAAC,MAAM,CAAC,QAAQ,CAAC,QAAQ,CAAC,KAAK,EAAE,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC;IAClE,CAAC;CACF;AAED,SAAS,QAAQ,CAAC,KAAkB,EAAE,IAAY;IAChD,OAAO,GAAG,KAAK,IAAI,IAAI,EAAE,CAAC;AAC5B,CAAC"}

package/dist/service/wafv2/resource/sim-waf-resource.d.ts

@@ -0,0 +1,60 @@
+import type { SimAwsAccountRegionScope } from "../../aws/sim-aws-account-region-scope.js";
+import { type SimWafResourceKind } from "../sim-wafv2-arn.js";
+import type { SimWafScope } from "../scope/sim-waf-scope.js";
+/**
+ * What every WAFv2 resource reports about itself in a listing.
+ */
+export interface SimWafResourceSummary {
+    readonly Name: string;
+    readonly Id: string;
+    readonly Description: string | undefined;
+    readonly LockToken: string;
+    readonly ARN: string;
+}
+export interface SimWafResourceProperties {
+    readonly name: string;
+    readonly scope: SimWafScope;
+    readonly accountRegionScope: SimAwsAccountRegionScope;
+    readonly description?: string | undefined;
+}
+/**
+ * What a web ACL, an IP set and a regex pattern set have in common.
+ *
+ * All three are named within a scope, carry a generated id that is part of
+ * their ARN, and are written through a lock token. The token is the part worth
+ * sharing rather than repeating: WAFv2 changes it on every write and refuses a
+ * write made against a stale one, which is how two callers editing the same
+ * rules find out about each other.
+ */
+export declare abstract class SimWafResource {
+    #private;
+    readonly name: string;
+    readonly scope: SimWafScope;
+    readonly id: string;
+    readonly arn: string;
+    protected constructor(kind: SimWafResourceKind, properties: SimWafResourceProperties);
+    /**
+     * What the resource was created or last updated with as its description.
+     */
+    get description(): string | undefined;
+    /**
+     * The token the next write to this resource has to present.
+     */
+    get lockToken(): string;
+    /**
+     * What a listing reports about this resource.
+     */
+    summary(): SimWafResourceSummary;
+    /**
+     * Check the token a write presented and move it on.
+     *
+     * A caller holding a token from before somebody else's write is refused, so
+     * two changes made from the same read cannot both land.
+     */
+    takeLock(lockToken: string | undefined): void;
+    /**
+     * Take on the description a write gave.
+     */
+    protected replaceDescription(description: string | undefined): void;
+}
+//# sourceMappingURL=sim-waf-resource.d.ts.map

package/dist/service/wafv2/resource/sim-waf-resource.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"sim-waf-resource.d.ts","sourceRoot":"","sources":["../../../../src/service/wafv2/resource/sim-waf-resource.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EAAE,wBAAwB,EAAE,MAAM,2CAA2C,CAAC;AAE1F,OAAO,EAAE,KAAK,kBAAkB,EAAa,MAAM,qBAAqB,CAAC;AACzE,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,2BAA2B,CAAC;AAE7D;;GAEG;AACH,MAAM,WAAW,qBAAqB;IACpC,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,EAAE,EAAE,MAAM,CAAC;IACpB,QAAQ,CAAC,WAAW,EAAE,MAAM,GAAG,SAAS,CAAC;IACzC,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAC3B,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAC;CACtB;AAED,MAAM,WAAW,wBAAwB;IACvC,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,KAAK,EAAE,WAAW,CAAC;IAC5B,QAAQ,CAAC,kBAAkB,EAAE,wBAAwB,CAAC;IACtD,QAAQ,CAAC,WAAW,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;CAC3C;AAED;;;;;;;;GAQG;AACH,8BAAsB,cAAc;;IAClC,SAAgB,IAAI,EAAE,MAAM,CAAC;IAC7B,SAAgB,KAAK,EAAE,WAAW,CAAC;IACnC,SAAgB,EAAE,EAAE,MAAM,CAAgB;IAC1C,SAAgB,GAAG,EAAE,MAAM,CAAC;IAI5B,SAAS,aACP,IAAI,EAAE,kBAAkB,EACxB,UAAU,EAAE,wBAAwB,EAYrC;IAED;;OAEG;IACH,IAAI,WAAW,IAAI,MAAM,GAAG,SAAS,CAEpC;IAED;;OAEG;IACH,IAAI,SAAS,IAAI,MAAM,CAEtB;IAED;;OAEG;IACH,OAAO,IAAI,qBAAqB,CAQ/B;IAED;;;;;OAKG;IACH,QAAQ,CAAC,SAAS,EAAE,MAAM,GAAG,SAAS,GAAG,IAAI,CAU5C;IAED;;OAEG;IACH,SAAS,CAAC,kBAAkB,CAAC,WAAW,EAAE,MAAM,GAAG,SAAS,GAAG,IAAI,CAElE;CACF"}

package/dist/service/wafv2/resource/sim-waf-resource.js

@@ -0,0 +1,77 @@
+import { randomUUID } from "node:crypto";
+import { SimWafOptimisticLockException } from "../error/sim-wafv2.error.js";
+import { simWafArn } from "../sim-wafv2-arn.js";
+/**
+ * What a web ACL, an IP set and a regex pattern set have in common.
+ *
+ * All three are named within a scope, carry a generated id that is part of
+ * their ARN, and are written through a lock token. The token is the part worth
+ * sharing rather than repeating: WAFv2 changes it on every write and refuses a
+ * write made against a stale one, which is how two callers editing the same
+ * rules find out about each other.
+ */
+export class SimWafResource {
+    name;
+    scope;
+    id = randomUUID();
+    arn;
+    #description;
+    #lockToken = randomUUID();
+    constructor(kind, properties) {
+        this.name = properties.name;
+        this.scope = properties.scope;
+        this.#description = properties.description;
+        this.arn = simWafArn({
+            accountRegionScope: properties.accountRegionScope,
+            scope: properties.scope,
+            kind,
+            name: this.name,
+            id: this.id,
+        });
+    }
+    /**
+     * What the resource was created or last updated with as its description.
+     */
+    get description() {
+        return this.#description;
+    }
+    /**
+     * The token the next write to this resource has to present.
+     */
+    get lockToken() {
+        return this.#lockToken;
+    }
+    /**
+     * What a listing reports about this resource.
+     */
+    summary() {
+        return {
+            Name: this.name,
+            Id: this.id,
+            Description: this.#description,
+            LockToken: this.#lockToken,
+            ARN: this.arn,
+        };
+    }
+    /**
+     * Check the token a write presented and move it on.
+     *
+     * A caller holding a token from before somebody else's write is refused, so
+     * two changes made from the same read cannot both land.
+     */
+    takeLock(lockToken) {
+        if (lockToken !== this.#lockToken) {
+            throw new SimWafOptimisticLockException(`AWS WAF couldn't save your changes because someone changed the ` +
+                `resource after you started editing it. Retrieve the resource and ` +
+                `try again.`);
+        }
+        this.#lockToken = randomUUID();
+    }
+    /**
+     * Take on the description a write gave.
+     */
+    replaceDescription(description) {
+        this.#description = description;
+    }
+}
+//# sourceMappingURL=sim-waf-resource.js.map

package/dist/service/wafv2/resource/sim-waf-resource.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"sim-waf-resource.js","sourceRoot":"","sources":["../../../../src/service/wafv2/resource/sim-waf-resource.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AAGzC,OAAO,EAAE,6BAA6B,EAAE,MAAM,6BAA6B,CAAC;AAC5E,OAAO,EAA2B,SAAS,EAAE,MAAM,qBAAqB,CAAC;AAqBzE;;;;;;;;GAQG;AACH,MAAM,OAAgB,cAAc;IAClB,IAAI,CAAS;IACb,KAAK,CAAc;IACnB,EAAE,GAAW,UAAU,EAAE,CAAC;IAC1B,GAAG,CAAS;IAC5B,YAAY,CAAqB;IACjC,UAAU,GAAW,UAAU,EAAE,CAAC;IAElC,YACE,IAAwB,EACxB,UAAoC;QAEpC,IAAI,CAAC,IAAI,GAAG,UAAU,CAAC,IAAI,CAAC;QAC5B,IAAI,CAAC,KAAK,GAAG,UAAU,CAAC,KAAK,CAAC;QAC9B,IAAI,CAAC,YAAY,GAAG,UAAU,CAAC,WAAW,CAAC;QAC3C,IAAI,CAAC,GAAG,GAAG,SAAS,CAAC;YACnB,kBAAkB,EAAE,UAAU,CAAC,kBAAkB;YACjD,KAAK,EAAE,UAAU,CAAC,KAAK;YACvB,IAAI;YACJ,IAAI,EAAE,IAAI,CAAC,IAAI;YACf,EAAE,EAAE,IAAI,CAAC,EAAE;SACZ,CAAC,CAAC;IACL,CAAC;IAED;;OAEG;IACH,IAAI,WAAW;QACb,OAAO,IAAI,CAAC,YAAY,CAAC;IAC3B,CAAC;IAED;;OAEG;IACH,IAAI,SAAS;QACX,OAAO,IAAI,CAAC,UAAU,CAAC;IACzB,CAAC;IAED;;OAEG;IACH,OAAO;QACL,OAAO;YACL,IAAI,EAAE,IAAI,CAAC,IAAI;YACf,EAAE,EAAE,IAAI,CAAC,EAAE;YACX,WAAW,EAAE,IAAI,CAAC,YAAY;YAC9B,SAAS,EAAE,IAAI,CAAC,UAAU;YAC1B,GAAG,EAAE,IAAI,CAAC,GAAG;SACd,CAAC;IACJ,CAAC;IAED;;;;;OAKG;IACH,QAAQ,CAAC,SAA6B;QACpC,IAAI,SAAS,KAAK,IAAI,CAAC,UAAU,EAAE,CAAC;YAClC,MAAM,IAAI,6BAA6B,CACrC,iEAAiE;gBAC/D,mEAAmE;gBACnE,YAAY,CACf,CAAC;QACJ,CAAC;QAED,IAAI,CAAC,UAAU,GAAG,UAAU,EAAE,CAAC;IACjC,CAAC;IAED;;OAEG;IACO,kBAAkB,CAAC,WAA+B;QAC1D,IAAI,CAAC,YAAY,GAAG,WAAW,CAAC;IAClC,CAAC;CACF"}