@kensio/yulin 1.18.0 → 1.18.2

package/dist/service/wafv2/sim-wafv2-commands.js

@@ -49,6 +49,9 @@ export class SimWafCommands {
             managedRules: this.managedRules,
             authorizer,
             accountRegionScope,
+            // The background scheduler is this simulation's source of time as well
+            // as its scheduler, and a rate-based rule counts against it.
+            clock: background,
         });
         this.managedRuleGroupCommands = new SimWafManagedRuleGroupCommands({
             authorizer,

package/dist/service/wafv2/sim-wafv2-commands.js.map

@@ -1 +1 @@
-{"version":3,"file":"sim-wafv2-commands.js","sourceRoot":"","sources":["../../../src/service/wafv2/sim-wafv2-commands.ts"],"names":[],"mappings":"AAAA,OAAO,EAEL,eAAe,GAChB,MAAM,qCAAqC,CAAC;AAE7C,OAAO,EAAE,+BAA+B,EAAE,MAAM,gDAAgD,CAAC;AACjG,OAAO,EACL,kBAAkB,GAEnB,MAAM,kDAAkD,CAAC;AAC1D,OAAO,EAAE,kBAAkB,EAAE,MAAM,uCAAuC,CAAC;AAC3E,OAAO,EACL,0BAA0B,GAE3B,MAAM,8CAA8C,CAAC;AACtD,OAAO,EAAE,uBAAuB,EAAE,MAAM,uDAAuD,CAAC;AAChG,OAAO,EAAE,yBAAyB,EAAE,MAAM,yDAAyD,CAAC;AACpG,OAAO,EAAE,gBAAgB,EAAE,MAAM,6CAA6C,CAAC;AAC/E,OAAO,EAAE,mBAAmB,EAAE,MAAM,+CAA+C,CAAC;AACpF,OAAO,EAAE,8BAA8B,EAAE,MAAM,uEAAuE,CAAC;AACvH,OAAO,EAAE,6BAA6B,EAAE,MAAM,qEAAqE,CAAC;AACpH,OAAO,EAAE,oBAAoB,EAAE,MAAM,iDAAiD,CAAC;AAEvF,OAAO,EAAE,kBAAkB,EAAE,MAAM,oCAAoC,CAAC;AAExE,OAAO,EAAE,mBAAmB,EAAE,MAAM,sCAAsC,CAAC;AAe3E;;;;;;;GAOG;AACH,MAAM,OAAO,cAAc;IAChB,OAAO,GAAG,IAAI,mBAAmB,CAAe,SAAS,CAAC,CAAC;IAC3D,MAAM,GAAG,IAAI,mBAAmB,CAAc,QAAQ,CAAC,CAAC;IACxD,gBAAgB,GAAG,IAAI,mBAAmB,CACjD,mBAAmB,CACpB,CAAC;IAEF;;;;;OAKG;IACM,YAAY,GAAG,IAAI,kBAAkB,EAAE,CAAC;IAExC,YAAY,GAAG,IAAI,kBAAkB,EAAE,CAAC;IAExC,cAAc,CAAuB;IACrC,mBAAmB,CAA4B;IAC/C,wBAAwB,CAAiC;IACzD,aAAa,CAAsB;IACnC,uBAAuB,CAAgC;IACvD,UAAU,CAAsB;IAEzC,YAAY,UAAU,GAAuB,EAAE;QAC7C,MAAM,EACJ,kBAAkB,GAAG,+BAA+B,CAAC,IAAI,EAAE,EAC3D,GAAG,GAAG,IAAI,kBAAkB,EAAE,EAC9B,UAAU,GAAG,IAAI,eAAe,EAAE,EAClC,kBAAkB,GAAG,IAAI,0BAA0B,EAAE,GACtD,GAAG,UAAU,CAAC;QAEf,MAAM,UAAU,GAAG,IAAI,gBAAgB,CAAC,EAAE,GAAG,EAAE,CAAC,CAAC;QAEjD,IAAI,CAAC,UAAU,GAAG,UAAU,CAAC;QAC7B,IAAI,CAAC,cAAc,GAAG,IAAI,oBAAoB,CAAC;YAC7C,OAAO,EAAE,IAAI,CAAC,OAAO;YACrB,gBAAgB,EAAE,IAAI,CAAC,gBAAgB;YACvC,YAAY,EAAE,IAAI,CAAC,YAAY;YAC/B,YAAY,EAAE,IAAI,CAAC,YAAY;YAC/B,UAAU;YACV,kBAAkB;SACnB,CAAC,CAAC;QACH,IAAI,CAAC,wBAAwB,GAAG,IAAI,8BAA8B,CAAC;YACjE,UAAU;YACV,kBAAkB;SACnB,CAAC,CAAC;QACH,IAAI,CAAC,mBAAmB,GAAG,IAAI,yBAAyB,CAAC;YACvD,YAAY,EAAE,IAAI,CAAC,YAAY;YAC/B,MAAM,EAAE,IAAI,uBAAuB,CAAC;gBAClC,OAAO,EAAE,IAAI,CAAC,OAAO;gBACrB,kBAAkB;gBAClB,UAAU;gBACV,kBAAkB;aACnB,CAAC;SACH,CAAC,CAAC;QACH,IAAI,CAAC,aAAa,GAAG,IAAI,mBAAmB,CAAC;YAC3C,MAAM,EAAE,IAAI,CAAC,MAAM;YACnB,UAAU;YACV,kBAAkB;SACnB,CAAC,CAAC;QACH,IAAI,CAAC,uBAAuB,GAAG,IAAI,6BAA6B,CAAC;YAC/D,gBAAgB,EAAE,IAAI,CAAC,gBAAgB;YACvC,UAAU;YACV,kBAAkB;SACnB,CAAC,CAAC;IACL,CAAC;CACF"}
+{"version":3,"file":"sim-wafv2-commands.js","sourceRoot":"","sources":["../../../src/service/wafv2/sim-wafv2-commands.ts"],"names":[],"mappings":"AAAA,OAAO,EAEL,eAAe,GAChB,MAAM,qCAAqC,CAAC;AAE7C,OAAO,EAAE,+BAA+B,EAAE,MAAM,gDAAgD,CAAC;AACjG,OAAO,EACL,kBAAkB,GAEnB,MAAM,kDAAkD,CAAC;AAC1D,OAAO,EAAE,kBAAkB,EAAE,MAAM,uCAAuC,CAAC;AAC3E,OAAO,EACL,0BAA0B,GAE3B,MAAM,8CAA8C,CAAC;AACtD,OAAO,EAAE,uBAAuB,EAAE,MAAM,uDAAuD,CAAC;AAChG,OAAO,EAAE,yBAAyB,EAAE,MAAM,yDAAyD,CAAC;AACpG,OAAO,EAAE,gBAAgB,EAAE,MAAM,6CAA6C,CAAC;AAC/E,OAAO,EAAE,mBAAmB,EAAE,MAAM,+CAA+C,CAAC;AACpF,OAAO,EAAE,8BAA8B,EAAE,MAAM,uEAAuE,CAAC;AACvH,OAAO,EAAE,6BAA6B,EAAE,MAAM,qEAAqE,CAAC;AACpH,OAAO,EAAE,oBAAoB,EAAE,MAAM,iDAAiD,CAAC;AAEvF,OAAO,EAAE,kBAAkB,EAAE,MAAM,oCAAoC,CAAC;AAExE,OAAO,EAAE,mBAAmB,EAAE,MAAM,sCAAsC,CAAC;AAe3E;;;;;;;GAOG;AACH,MAAM,OAAO,cAAc;IAChB,OAAO,GAAG,IAAI,mBAAmB,CAAe,SAAS,CAAC,CAAC;IAC3D,MAAM,GAAG,IAAI,mBAAmB,CAAc,QAAQ,CAAC,CAAC;IACxD,gBAAgB,GAAG,IAAI,mBAAmB,CACjD,mBAAmB,CACpB,CAAC;IAEF;;;;;OAKG;IACM,YAAY,GAAG,IAAI,kBAAkB,EAAE,CAAC;IAExC,YAAY,GAAG,IAAI,kBAAkB,EAAE,CAAC;IAExC,cAAc,CAAuB;IACrC,mBAAmB,CAA4B;IAC/C,wBAAwB,CAAiC;IACzD,aAAa,CAAsB;IACnC,uBAAuB,CAAgC;IACvD,UAAU,CAAsB;IAEzC,YAAY,UAAU,GAAuB,EAAE;QAC7C,MAAM,EACJ,kBAAkB,GAAG,+BAA+B,CAAC,IAAI,EAAE,EAC3D,GAAG,GAAG,IAAI,kBAAkB,EAAE,EAC9B,UAAU,GAAG,IAAI,eAAe,EAAE,EAClC,kBAAkB,GAAG,IAAI,0BAA0B,EAAE,GACtD,GAAG,UAAU,CAAC;QAEf,MAAM,UAAU,GAAG,IAAI,gBAAgB,CAAC,EAAE,GAAG,EAAE,CAAC,CAAC;QAEjD,IAAI,CAAC,UAAU,GAAG,UAAU,CAAC;QAC7B,IAAI,CAAC,cAAc,GAAG,IAAI,oBAAoB,CAAC;YAC7C,OAAO,EAAE,IAAI,CAAC,OAAO;YACrB,gBAAgB,EAAE,IAAI,CAAC,gBAAgB;YACvC,YAAY,EAAE,IAAI,CAAC,YAAY;YAC/B,YAAY,EAAE,IAAI,CAAC,YAAY;YAC/B,UAAU;YACV,kBAAkB;YAClB,uEAAuE;YACvE,6DAA6D;YAC7D,KAAK,EAAE,UAAU;SAClB,CAAC,CAAC;QACH,IAAI,CAAC,wBAAwB,GAAG,IAAI,8BAA8B,CAAC;YACjE,UAAU;YACV,kBAAkB;SACnB,CAAC,CAAC;QACH,IAAI,CAAC,mBAAmB,GAAG,IAAI,yBAAyB,CAAC;YACvD,YAAY,EAAE,IAAI,CAAC,YAAY;YAC/B,MAAM,EAAE,IAAI,uBAAuB,CAAC;gBAClC,OAAO,EAAE,IAAI,CAAC,OAAO;gBACrB,kBAAkB;gBAClB,UAAU;gBACV,kBAAkB;aACnB,CAAC;SACH,CAAC,CAAC;QACH,IAAI,CAAC,aAAa,GAAG,IAAI,mBAAmB,CAAC;YAC3C,MAAM,EAAE,IAAI,CAAC,MAAM;YACnB,UAAU;YACV,kBAAkB;SACnB,CAAC,CAAC;QACH,IAAI,CAAC,uBAAuB,GAAG,IAAI,6BAA6B,CAAC;YAC/D,gBAAgB,EAAE,IAAI,CAAC,gBAAgB;YACvC,UAAU;YACV,kBAAkB;SACnB,CAAC,CAAC;IACL,CAAC;CACF"}

package/dist/service/wafv2/sim-wafv2.d.ts

@@ -12,6 +12,8 @@ import { type SimWafV2Properties } from "./sim-wafv2-commands.js";
 import { SimWafCfnResourceFactory } from "./cfn/sim-waf-cfn-resource-factory.js";
 import { SimWafSets } from "./sim-wafv2-sets.js";
 import type { SimWafWebAcl } from "./web-acl/sim-waf-web-acl.js";
+import { type SimWafUnevaluatableRule } from "./web-acl/sim-waf-unevaluatable-rules.js";
+import type { SimWafWebAclWriteInput } from "./command/web-acl/web-acl.command.js";
 export type { SimWafEvaluationRequest } from "./evaluate/sim-waf-evaluation-request.js";
 /**
  * Simulated AWS WAFv2. Handles SDK commands. Emulates AWS behaviour and state.
@@ -87,6 +89,16 @@ export declare class SimWafV2 extends SimWafSets {
      * nothing here, and `rules()` reports what is covered of each.
      */
     managedRules(): SimWafManagedRules;
+    /**
+     * The rules of a web ACL input this simulation cannot evaluate.
+     *
+     * The simulator's own accessor rather than a WAFv2 operation. `CreateWebACL`
+     * refuses a web ACL carrying such a rule, because a web ACL that accepted
+     * one would allow a request AWS blocks. A template is deployed rule by rule
+     * instead, so the CloudFormation layer asks this first and leaves the rules
+     * it names out of the web ACL it writes.
+     */
+    unevaluatableWebAclRules(input: SimWafWebAclWriteInput): readonly SimWafUnevaluatableRule[];
     /**
      * Handle a CreateWebACL Command from the SDK.
      */

package/dist/service/wafv2/sim-wafv2.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"sim-wafv2.d.ts","sourceRoot":"","sources":["../../../src/service/wafv2/sim-wafv2.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,mBAAmB,EAAE,MAAM,iDAAiD,CAAC;AAC3F,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,qCAAqC,CAAC;AAC5E,OAAO,KAAK,KAAK,cAAc,MAAM,sCAAsC,CAAC;AAC5E,OAAO,KAAK,EAAE,oBAAoB,EAAE,MAAM,wCAAwC,CAAC;AAEnF,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,gCAAgC,CAAC;AACrE,OAAO,KAAK,EAAE,uBAAuB,EAAE,MAAM,0CAA0C,CAAC;AAExF,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,4BAA4B,CAAC;AAC9D,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,oCAAoC,CAAC;AAC7E,OAAO,KAAK,EAAE,qBAAqB,EAAE,MAAM,kDAAkD,CAAC;AAC9F,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,0BAA0B,CAAC;AAE5D,OAAO,EAEL,KAAK,kBAAkB,EACxB,MAAM,yBAAyB,CAAC;AACjC,OAAO,EAAE,wBAAwB,EAAE,MAAM,uCAAuC,CAAC;AACjF,OAAO,EAAE,UAAU,EAAE,MAAM,qBAAqB,CAAC;AACjD,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,8BAA8B,CAAC;AAEjE,YAAY,EAAE,uBAAuB,EAAE,MAAM,0CAA0C,CAAC;AAExF;;;;;;;;;;;;;GAaG;AACH,qBAAa,QAAS,SAAQ,UAAU;;IAItC,YAAY,UAAU,GAAE,kBAAuB,EAE9C;IAED;;;;;;;;;OASG;IACH,UAAU,IAAI,gBAAgB,CAE7B;IAED;;;;;OAKG;IACH,UAAU,CAAC,KAAK,EAAE,WAAW,GAAG,SAAS,YAAY,EAAE,CAEtD;IAED;;;;;OAKG;IACH,eAAe,CAAC,SAAS,EAAE,MAAM,GAAG,YAAY,GAAG,SAAS,CAE3D;IAED;;;;;OAKG;IACH,cAAc,CAAC,QAAQ,EAAE,MAAM,GAAG,WAAW,GAAG,SAAS,CAExD;IAED;;;;;OAKG;IACH,wBAAwB,CACtB,kBAAkB,EAAE,MAAM,GACzB,qBAAqB,GAAG,SAAS,CAEnC;IAED;;;;;;;;OAQG;IACH,eAAe,CAAC,UAAU,EAAE,uBAAuB,GAAG,cAAc,CAanE;IAED;;;;;;OAMG;IACH,YAAY,IAAI,kBAAkB,CAEjC;IAED;;OAEG;IACG,YAAY,CAChB,OAAO,EAAE,cAAc,CAAC,sBAAsB,EAC9C,OAAO,CAAC,EAAE,oBAAoB,GAC7B,OAAO,CAAC,cAAc,CAAC,4BAA4B,CAAC,CAGtD;IAED;;OAEG;IACG,SAAS,CACb,OAAO,EAAE,cAAc,CAAC,mBAAmB,EAC3C,OAAO,CAAC,EAAE,oBAAoB,GAC7B,OAAO,CAAC,cAAc,CAAC,yBAAyB,CAAC,CAGnD;IAED;;OAEG;IACG,YAAY,CAChB,OAAO,EAAE,cAAc,CAAC,sBAAsB,EAC9C,OAAO,CAAC,EAAE,oBAAoB,GAC7B,OAAO,CAAC,cAAc,CAAC,4BAA4B,CAAC,CAGtD;IAED;;OAEG;IACG,WAAW,CACf,OAAO,EAAE,cAAc,CAAC,qBAAqB,EAC7C,OAAO,CAAC,EAAE,oBAAoB,GAC7B,OAAO,CAAC,cAAc,CAAC,2BAA2B,CAAC,CAGrD;IAED;;OAEG;IACG,YAAY,CAChB,OAAO,EAAE,cAAc,CAAC,sBAAsB,EAC9C,OAAO,CAAC,EAAE,oBAAoB,GAC7B,OAAO,CAAC,cAAc,CAAC,4BAA4B,CAAC,CAGtD;IAED;;OAEG;IACG,wBAAwB,CAC5B,OAAO,EAAE,cAAc,CAAC,kCAAkC,EAC1D,OAAO,CAAC,EAAE,oBAAoB,GAC7B,OAAO,CAAC,cAAc,CAAC,wCAAwC,CAAC,CAMlE;IAED;;OAEG;IACG,eAAe,CACnB,OAAO,EAAE,cAAc,CAAC,yBAAyB,EACjD,OAAO,CAAC,EAAE,oBAAoB,GAC7B,OAAO,CAAC,cAAc,CAAC,+BAA+B,CAAC,CAGzD;IAED;;OAEG;IACG,kBAAkB,CACtB,OAAO,EAAE,cAAc,CAAC,4BAA4B,EACpD,OAAO,CAAC,EAAE,oBAAoB,GAC7B,OAAO,CAAC,cAAc,CAAC,kCAAkC,CAAC,CAM5D;IAED;;OAEG;IACG,oBAAoB,CACxB,OAAO,EAAE,cAAc,CAAC,8BAA8B,EACtD,OAAO,CAAC,EAAE,oBAAoB,GAC7B,OAAO,CAAC,cAAc,CAAC,oCAAoC,CAAC,CAM9D;IAED;;OAEG;IACG,sBAAsB,CAC1B,OAAO,EAAE,cAAc,CAAC,gCAAgC,EACxD,OAAO,CAAC,EAAE,oBAAoB,GAC7B,OAAO,CAAC,cAAc,CAAC,sCAAsC,CAAC,CAMhE;IAED;;OAEG;IACH,kBAAkB,IAAI,wBAAwB,CAE7C;IAED;;OAEG;IACH,gBAAgB,IAAI,mBAAmB,CAEtC;CACF"}
+{"version":3,"file":"sim-wafv2.d.ts","sourceRoot":"","sources":["../../../src/service/wafv2/sim-wafv2.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,mBAAmB,EAAE,MAAM,iDAAiD,CAAC;AAC3F,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,qCAAqC,CAAC;AAC5E,OAAO,KAAK,KAAK,cAAc,MAAM,sCAAsC,CAAC;AAC5E,OAAO,KAAK,EAAE,oBAAoB,EAAE,MAAM,wCAAwC,CAAC;AAEnF,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,gCAAgC,CAAC;AACrE,OAAO,KAAK,EAAE,uBAAuB,EAAE,MAAM,0CAA0C,CAAC;AAExF,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,4BAA4B,CAAC;AAC9D,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,oCAAoC,CAAC;AAC7E,OAAO,KAAK,EAAE,qBAAqB,EAAE,MAAM,kDAAkD,CAAC;AAC9F,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,0BAA0B,CAAC;AAE5D,OAAO,EAEL,KAAK,kBAAkB,EACxB,MAAM,yBAAyB,CAAC;AACjC,OAAO,EAAE,wBAAwB,EAAE,MAAM,uCAAuC,CAAC;AACjF,OAAO,EAAE,UAAU,EAAE,MAAM,qBAAqB,CAAC;AACjD,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,8BAA8B,CAAC;AACjE,OAAO,EACL,KAAK,uBAAuB,EAE7B,MAAM,0CAA0C,CAAC;AAClD,OAAO,KAAK,EAAE,sBAAsB,EAAE,MAAM,sCAAsC,CAAC;AAEnF,YAAY,EAAE,uBAAuB,EAAE,MAAM,0CAA0C,CAAC;AAExF;;;;;;;;;;;;;GAaG;AACH,qBAAa,QAAS,SAAQ,UAAU;;IAItC,YAAY,UAAU,GAAE,kBAAuB,EAE9C;IAED;;;;;;;;;OASG;IACH,UAAU,IAAI,gBAAgB,CAE7B;IAED;;;;;OAKG;IACH,UAAU,CAAC,KAAK,EAAE,WAAW,GAAG,SAAS,YAAY,EAAE,CAEtD;IAED;;;;;OAKG;IACH,eAAe,CAAC,SAAS,EAAE,MAAM,GAAG,YAAY,GAAG,SAAS,CAE3D;IAED;;;;;OAKG;IACH,cAAc,CAAC,QAAQ,EAAE,MAAM,GAAG,WAAW,GAAG,SAAS,CAExD;IAED;;;;;OAKG;IACH,wBAAwB,CACtB,kBAAkB,EAAE,MAAM,GACzB,qBAAqB,GAAG,SAAS,CAEnC;IAED;;;;;;;;OAQG;IACH,eAAe,CAAC,UAAU,EAAE,uBAAuB,GAAG,cAAc,CAanE;IAED;;;;;;OAMG;IACH,YAAY,IAAI,kBAAkB,CAEjC;IAED;;;;;;;;OAQG;IACH,wBAAwB,CACtB,KAAK,EAAE,sBAAsB,GAC5B,SAAS,uBAAuB,EAAE,CAOpC;IAED;;OAEG;IACG,YAAY,CAChB,OAAO,EAAE,cAAc,CAAC,sBAAsB,EAC9C,OAAO,CAAC,EAAE,oBAAoB,GAC7B,OAAO,CAAC,cAAc,CAAC,4BAA4B,CAAC,CAGtD;IAED;;OAEG;IACG,SAAS,CACb,OAAO,EAAE,cAAc,CAAC,mBAAmB,EAC3C,OAAO,CAAC,EAAE,oBAAoB,GAC7B,OAAO,CAAC,cAAc,CAAC,yBAAyB,CAAC,CAGnD;IAED;;OAEG;IACG,YAAY,CAChB,OAAO,EAAE,cAAc,CAAC,sBAAsB,EAC9C,OAAO,CAAC,EAAE,oBAAoB,GAC7B,OAAO,CAAC,cAAc,CAAC,4BAA4B,CAAC,CAGtD;IAED;;OAEG;IACG,WAAW,CACf,OAAO,EAAE,cAAc,CAAC,qBAAqB,EAC7C,OAAO,CAAC,EAAE,oBAAoB,GAC7B,OAAO,CAAC,cAAc,CAAC,2BAA2B,CAAC,CAGrD;IAED;;OAEG;IACG,YAAY,CAChB,OAAO,EAAE,cAAc,CAAC,sBAAsB,EAC9C,OAAO,CAAC,EAAE,oBAAoB,GAC7B,OAAO,CAAC,cAAc,CAAC,4BAA4B,CAAC,CAGtD;IAED;;OAEG;IACG,wBAAwB,CAC5B,OAAO,EAAE,cAAc,CAAC,kCAAkC,EAC1D,OAAO,CAAC,EAAE,oBAAoB,GAC7B,OAAO,CAAC,cAAc,CAAC,wCAAwC,CAAC,CAMlE;IAED;;OAEG;IACG,eAAe,CACnB,OAAO,EAAE,cAAc,CAAC,yBAAyB,EACjD,OAAO,CAAC,EAAE,oBAAoB,GAC7B,OAAO,CAAC,cAAc,CAAC,+BAA+B,CAAC,CAGzD;IAED;;OAEG;IACG,kBAAkB,CACtB,OAAO,EAAE,cAAc,CAAC,4BAA4B,EACpD,OAAO,CAAC,EAAE,oBAAoB,GAC7B,OAAO,CAAC,cAAc,CAAC,kCAAkC,CAAC,CAM5D;IAED;;OAEG;IACG,oBAAoB,CACxB,OAAO,EAAE,cAAc,CAAC,8BAA8B,EACtD,OAAO,CAAC,EAAE,oBAAoB,GAC7B,OAAO,CAAC,cAAc,CAAC,oCAAoC,CAAC,CAM9D;IAED;;OAEG;IACG,sBAAsB,CAC1B,OAAO,EAAE,cAAc,CAAC,gCAAgC,EACxD,OAAO,CAAC,EAAE,oBAAoB,GAC7B,OAAO,CAAC,cAAc,CAAC,sCAAsC,CAAC,CAMhE;IAED;;OAEG;IACH,kBAAkB,IAAI,wBAAwB,CAE7C;IAED;;OAEG;IACH,gBAAgB,IAAI,mBAAmB,CAEtC;CACF"}

package/dist/service/wafv2/sim-wafv2.js

@@ -4,6 +4,7 @@ import { SimWafSdkCommandRouter } from "./sdk/sim-wafv2-sdk-command-router.js";
 import { SimWafCommands, } from "./sim-wafv2-commands.js";
 import { SimWafCfnResourceFactory } from "./cfn/sim-waf-cfn-resource-factory.js";
 import { SimWafSets } from "./sim-wafv2-sets.js";
+import { unevaluatableSimWafRules, } from "./web-acl/sim-waf-unevaluatable-rules.js";
 /**
  * Simulated AWS WAFv2. Handles SDK commands. Emulates AWS behaviour and state.
  *
@@ -100,6 +101,23 @@ export class SimWafV2 extends SimWafSets {
     managedRules() {
         return this.commands.managedRules;
     }
+    /**
+     * The rules of a web ACL input this simulation cannot evaluate.
+     *
+     * The simulator's own accessor rather than a WAFv2 operation. `CreateWebACL`
+     * refuses a web ACL carrying such a rule, because a web ACL that accepted
+     * one would allow a request AWS blocks. A template is deployed rule by rule
+     * instead, so the CloudFormation layer asks this first and leaves the rules
+     * it names out of the web ACL it writes.
+     */
+    unevaluatableWebAclRules(input) {
+        return unevaluatableSimWafRules(input.Rules, {
+            regexPatternSets: this.commands.regexPatternSets,
+            managedRules: this.commands.managedRules,
+            clock: this.commands.background,
+            customResponseBodies: input.CustomResponseBodies ?? {},
+        });
+    }
     /**
      * Handle a CreateWebACL Command from the SDK.
      */

package/dist/service/wafv2/sim-wafv2.js.map

@@ -1 +1 @@
-{"version":3,"file":"sim-wafv2.js","sourceRoot":"","sources":["../../../src/service/wafv2/sim-wafv2.ts"],"names":[],"mappings":"AAIA,OAAO,EAAE,8BAA8B,EAAE,MAAM,4BAA4B,CAAC;AAG5E,OAAO,EAAE,sBAAsB,EAAE,MAAM,yCAAyC,CAAC;AAKjF,OAAO,EAAE,sBAAsB,EAAE,MAAM,uCAAuC,CAAC;AAC/E,OAAO,EACL,cAAc,GAEf,MAAM,yBAAyB,CAAC;AACjC,OAAO,EAAE,wBAAwB,EAAE,MAAM,uCAAuC,CAAC;AACjF,OAAO,EAAE,UAAU,EAAE,MAAM,qBAAqB,CAAC;AAKjD;;;;;;;;;;;;;GAaG;AACH,MAAM,OAAO,QAAS,SAAQ,UAAU;IAC7B,UAAU,GAAG,IAAI,sBAAsB,CAAC,IAAI,CAAC,CAAC;IAC9C,WAAW,GAAG,IAAI,wBAAwB,CAAC,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC;IAErE,YAAY,UAAU,GAAuB,EAAE;QAC7C,KAAK,CAAC,IAAI,cAAc,CAAC,UAAU,CAAC,CAAC,CAAC;IACxC,CAAC;IAED;;;;;;;;;OASG;IACH,UAAU;QACR,OAAO,IAAI,CAAC,QAAQ,CAAC,YAAY,CAAC;IACpC,CAAC;IAED;;;;;OAKG;IACH,UAAU,CAAC,KAAkB;QAC3B,OAAO,IAAI,CAAC,QAAQ,CAAC,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC;IAC1C,CAAC;IAED;;;;;OAKG;IACH,eAAe,CAAC,SAAiB;QAC/B,OAAO,IAAI,CAAC,QAAQ,CAAC,OAAO,CAAC,SAAS,CAAC,SAAS,CAAC,CAAC;IACpD,CAAC;IAED;;;;;OAKG;IACH,cAAc,CAAC,QAAgB;QAC7B,OAAO,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC,SAAS,CAAC,QAAQ,CAAC,CAAC;IAClD,CAAC;IAED;;;;;OAKG;IACH,wBAAwB,CACtB,kBAA0B;QAE1B,OAAO,IAAI,CAAC,QAAQ,CAAC,gBAAgB,CAAC,SAAS,CAAC,kBAAkB,CAAC,CAAC;IACtE,CAAC;IAED;;;;;;;;OAQG;IACH,eAAe,CAAC,UAAmC;QACjD,MAAM,MAAM,GAAG,IAAI,CAAC,eAAe,CAAC,UAAU,CAAC,SAAS,CAAC,CAAC;QAE1D,IAAI,MAAM,KAAK,SAAS,EAAE,CAAC;YACzB,MAAM,IAAI,8BAA8B,CACtC,+DAA+D;gBAC7D,0BAA0B,UAAU,CAAC,SAAS,GAAG,CACpD,CAAC;QACJ,CAAC;QAED,OAAO,MAAM,CAAC,QAAQ,CACpB,sBAAsB,CAAC,UAAU,CAAC,OAAO,EAAE,UAAU,CAAC,IAAI,CAAC,CAC5D,CAAC;IACJ,CAAC;IAED;;;;;;OAMG;IACH,YAAY;QACV,OAAO,IAAI,CAAC,QAAQ,CAAC,YAAY,CAAC;IACpC,CAAC;IAED;;OAEG;IACH,KAAK,CAAC,YAAY,CAChB,OAA8C,EAC9C,OAA8B;QAE9B,MAAM,IAAI,CAAC,QAAQ,CAAC,UAAU,CAAC,QAAQ,EAAE,CAAC;QAC1C,OAAO,IAAI,CAAC,QAAQ,CAAC,cAAc,CAAC,YAAY,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC;IACrE,CAAC;IAED;;OAEG;IACH,KAAK,CAAC,SAAS,CACb,OAA2C,EAC3C,OAA8B;QAE9B,MAAM,IAAI,CAAC,QAAQ,CAAC,UAAU,CAAC,QAAQ,EAAE,CAAC;QAC1C,OAAO,IAAI,CAAC,QAAQ,CAAC,cAAc,CAAC,SAAS,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC;IAClE,CAAC;IAED;;OAEG;IACH,KAAK,CAAC,YAAY,CAChB,OAA8C,EAC9C,OAA8B;QAE9B,MAAM,IAAI,CAAC,QAAQ,CAAC,UAAU,CAAC,QAAQ,EAAE,CAAC;QAC1C,OAAO,IAAI,CAAC,QAAQ,CAAC,cAAc,CAAC,YAAY,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC;IACrE,CAAC;IAED;;OAEG;IACH,KAAK,CAAC,WAAW,CACf,OAA6C,EAC7C,OAA8B;QAE9B,MAAM,IAAI,CAAC,QAAQ,CAAC,UAAU,CAAC,QAAQ,EAAE,CAAC;QAC1C,OAAO,IAAI,CAAC,QAAQ,CAAC,cAAc,CAAC,WAAW,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC;IACpE,CAAC;IAED;;OAEG;IACH,KAAK,CAAC,YAAY,CAChB,OAA8C,EAC9C,OAA8B;QAE9B,MAAM,IAAI,CAAC,QAAQ,CAAC,UAAU,CAAC,QAAQ,EAAE,CAAC;QAC1C,OAAO,IAAI,CAAC,QAAQ,CAAC,cAAc,CAAC,YAAY,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC;IACrE,CAAC;IAED;;OAEG;IACH,KAAK,CAAC,wBAAwB,CAC5B,OAA0D,EAC1D,OAA8B;QAE9B,MAAM,IAAI,CAAC,QAAQ,CAAC,UAAU,CAAC,QAAQ,EAAE,CAAC;QAC1C,OAAO,IAAI,CAAC,QAAQ,CAAC,wBAAwB,CAAC,wBAAwB,CACpE,OAAO,EACP,OAAO,CACR,CAAC;IACJ,CAAC;IAED;;OAEG;IACH,KAAK,CAAC,eAAe,CACnB,OAAiD,EACjD,OAA8B;QAE9B,MAAM,IAAI,CAAC,QAAQ,CAAC,UAAU,CAAC,QAAQ,EAAE,CAAC;QAC1C,OAAO,IAAI,CAAC,QAAQ,CAAC,mBAAmB,CAAC,eAAe,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC;IAC7E,CAAC;IAED;;OAEG;IACH,KAAK,CAAC,kBAAkB,CACtB,OAAoD,EACpD,OAA8B;QAE9B,MAAM,IAAI,CAAC,QAAQ,CAAC,UAAU,CAAC,QAAQ,EAAE,CAAC;QAC1C,OAAO,IAAI,CAAC,QAAQ,CAAC,mBAAmB,CAAC,kBAAkB,CACzD,OAAO,EACP,OAAO,CACR,CAAC;IACJ,CAAC;IAED;;OAEG;IACH,KAAK,CAAC,oBAAoB,CACxB,OAAsD,EACtD,OAA8B;QAE9B,MAAM,IAAI,CAAC,QAAQ,CAAC,UAAU,CAAC,QAAQ,EAAE,CAAC;QAC1C,OAAO,IAAI,CAAC,QAAQ,CAAC,mBAAmB,CAAC,oBAAoB,CAC3D,OAAO,EACP,OAAO,CACR,CAAC;IACJ,CAAC;IAED;;OAEG;IACH,KAAK,CAAC,sBAAsB,CAC1B,OAAwD,EACxD,OAA8B;QAE9B,MAAM,IAAI,CAAC,QAAQ,CAAC,UAAU,CAAC,QAAQ,EAAE,CAAC;QAC1C,OAAO,IAAI,CAAC,QAAQ,CAAC,mBAAmB,CAAC,sBAAsB,CAC7D,OAAO,EACP,OAAO,CACR,CAAC;IACJ,CAAC;IAED;;OAEG;IACH,kBAAkB;QAChB,OAAO,IAAI,CAAC,WAAW,CAAC;IAC1B,CAAC;IAED;;OAEG;IACH,gBAAgB;QACd,OAAO,IAAI,CAAC,UAAU,CAAC;IACzB,CAAC;CACF"}
+{"version":3,"file":"sim-wafv2.js","sourceRoot":"","sources":["../../../src/service/wafv2/sim-wafv2.ts"],"names":[],"mappings":"AAIA,OAAO,EAAE,8BAA8B,EAAE,MAAM,4BAA4B,CAAC;AAG5E,OAAO,EAAE,sBAAsB,EAAE,MAAM,yCAAyC,CAAC;AAKjF,OAAO,EAAE,sBAAsB,EAAE,MAAM,uCAAuC,CAAC;AAC/E,OAAO,EACL,cAAc,GAEf,MAAM,yBAAyB,CAAC;AACjC,OAAO,EAAE,wBAAwB,EAAE,MAAM,uCAAuC,CAAC;AACjF,OAAO,EAAE,UAAU,EAAE,MAAM,qBAAqB,CAAC;AAEjD,OAAO,EAEL,wBAAwB,GACzB,MAAM,0CAA0C,CAAC;AAKlD;;;;;;;;;;;;;GAaG;AACH,MAAM,OAAO,QAAS,SAAQ,UAAU;IAC7B,UAAU,GAAG,IAAI,sBAAsB,CAAC,IAAI,CAAC,CAAC;IAC9C,WAAW,GAAG,IAAI,wBAAwB,CAAC,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC;IAErE,YAAY,UAAU,GAAuB,EAAE;QAC7C,KAAK,CAAC,IAAI,cAAc,CAAC,UAAU,CAAC,CAAC,CAAC;IACxC,CAAC;IAED;;;;;;;;;OASG;IACH,UAAU;QACR,OAAO,IAAI,CAAC,QAAQ,CAAC,YAAY,CAAC;IACpC,CAAC;IAED;;;;;OAKG;IACH,UAAU,CAAC,KAAkB;QAC3B,OAAO,IAAI,CAAC,QAAQ,CAAC,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC;IAC1C,CAAC;IAED;;;;;OAKG;IACH,eAAe,CAAC,SAAiB;QAC/B,OAAO,IAAI,CAAC,QAAQ,CAAC,OAAO,CAAC,SAAS,CAAC,SAAS,CAAC,CAAC;IACpD,CAAC;IAED;;;;;OAKG;IACH,cAAc,CAAC,QAAgB;QAC7B,OAAO,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC,SAAS,CAAC,QAAQ,CAAC,CAAC;IAClD,CAAC;IAED;;;;;OAKG;IACH,wBAAwB,CACtB,kBAA0B;QAE1B,OAAO,IAAI,CAAC,QAAQ,CAAC,gBAAgB,CAAC,SAAS,CAAC,kBAAkB,CAAC,CAAC;IACtE,CAAC;IAED;;;;;;;;OAQG;IACH,eAAe,CAAC,UAAmC;QACjD,MAAM,MAAM,GAAG,IAAI,CAAC,eAAe,CAAC,UAAU,CAAC,SAAS,CAAC,CAAC;QAE1D,IAAI,MAAM,KAAK,SAAS,EAAE,CAAC;YACzB,MAAM,IAAI,8BAA8B,CACtC,+DAA+D;gBAC7D,0BAA0B,UAAU,CAAC,SAAS,GAAG,CACpD,CAAC;QACJ,CAAC;QAED,OAAO,MAAM,CAAC,QAAQ,CACpB,sBAAsB,CAAC,UAAU,CAAC,OAAO,EAAE,UAAU,CAAC,IAAI,CAAC,CAC5D,CAAC;IACJ,CAAC;IAED;;;;;;OAMG;IACH,YAAY;QACV,OAAO,IAAI,CAAC,QAAQ,CAAC,YAAY,CAAC;IACpC,CAAC;IAED;;;;;;;;OAQG;IACH,wBAAwB,CACtB,KAA6B;QAE7B,OAAO,wBAAwB,CAAC,KAAK,CAAC,KAAK,EAAE;YAC3C,gBAAgB,EAAE,IAAI,CAAC,QAAQ,CAAC,gBAAgB;YAChD,YAAY,EAAE,IAAI,CAAC,QAAQ,CAAC,YAAY;YACxC,KAAK,EAAE,IAAI,CAAC,QAAQ,CAAC,UAAU;YAC/B,oBAAoB,EAAE,KAAK,CAAC,oBAAoB,IAAI,EAAE;SACvD,CAAC,CAAC;IACL,CAAC;IAED;;OAEG;IACH,KAAK,CAAC,YAAY,CAChB,OAA8C,EAC9C,OAA8B;QAE9B,MAAM,IAAI,CAAC,QAAQ,CAAC,UAAU,CAAC,QAAQ,EAAE,CAAC;QAC1C,OAAO,IAAI,CAAC,QAAQ,CAAC,cAAc,CAAC,YAAY,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC;IACrE,CAAC;IAED;;OAEG;IACH,KAAK,CAAC,SAAS,CACb,OAA2C,EAC3C,OAA8B;QAE9B,MAAM,IAAI,CAAC,QAAQ,CAAC,UAAU,CAAC,QAAQ,EAAE,CAAC;QAC1C,OAAO,IAAI,CAAC,QAAQ,CAAC,cAAc,CAAC,SAAS,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC;IAClE,CAAC;IAED;;OAEG;IACH,KAAK,CAAC,YAAY,CAChB,OAA8C,EAC9C,OAA8B;QAE9B,MAAM,IAAI,CAAC,QAAQ,CAAC,UAAU,CAAC,QAAQ,EAAE,CAAC;QAC1C,OAAO,IAAI,CAAC,QAAQ,CAAC,cAAc,CAAC,YAAY,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC;IACrE,CAAC;IAED;;OAEG;IACH,KAAK,CAAC,WAAW,CACf,OAA6C,EAC7C,OAA8B;QAE9B,MAAM,IAAI,CAAC,QAAQ,CAAC,UAAU,CAAC,QAAQ,EAAE,CAAC;QAC1C,OAAO,IAAI,CAAC,QAAQ,CAAC,cAAc,CAAC,WAAW,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC;IACpE,CAAC;IAED;;OAEG;IACH,KAAK,CAAC,YAAY,CAChB,OAA8C,EAC9C,OAA8B;QAE9B,MAAM,IAAI,CAAC,QAAQ,CAAC,UAAU,CAAC,QAAQ,EAAE,CAAC;QAC1C,OAAO,IAAI,CAAC,QAAQ,CAAC,cAAc,CAAC,YAAY,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC;IACrE,CAAC;IAED;;OAEG;IACH,KAAK,CAAC,wBAAwB,CAC5B,OAA0D,EAC1D,OAA8B;QAE9B,MAAM,IAAI,CAAC,QAAQ,CAAC,UAAU,CAAC,QAAQ,EAAE,CAAC;QAC1C,OAAO,IAAI,CAAC,QAAQ,CAAC,wBAAwB,CAAC,wBAAwB,CACpE,OAAO,EACP,OAAO,CACR,CAAC;IACJ,CAAC;IAED;;OAEG;IACH,KAAK,CAAC,eAAe,CACnB,OAAiD,EACjD,OAA8B;QAE9B,MAAM,IAAI,CAAC,QAAQ,CAAC,UAAU,CAAC,QAAQ,EAAE,CAAC;QAC1C,OAAO,IAAI,CAAC,QAAQ,CAAC,mBAAmB,CAAC,eAAe,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC;IAC7E,CAAC;IAED;;OAEG;IACH,KAAK,CAAC,kBAAkB,CACtB,OAAoD,EACpD,OAA8B;QAE9B,MAAM,IAAI,CAAC,QAAQ,CAAC,UAAU,CAAC,QAAQ,EAAE,CAAC;QAC1C,OAAO,IAAI,CAAC,QAAQ,CAAC,mBAAmB,CAAC,kBAAkB,CACzD,OAAO,EACP,OAAO,CACR,CAAC;IACJ,CAAC;IAED;;OAEG;IACH,KAAK,CAAC,oBAAoB,CACxB,OAAsD,EACtD,OAA8B;QAE9B,MAAM,IAAI,CAAC,QAAQ,CAAC,UAAU,CAAC,QAAQ,EAAE,CAAC;QAC1C,OAAO,IAAI,CAAC,QAAQ,CAAC,mBAAmB,CAAC,oBAAoB,CAC3D,OAAO,EACP,OAAO,CACR,CAAC;IACJ,CAAC;IAED;;OAEG;IACH,KAAK,CAAC,sBAAsB,CAC1B,OAAwD,EACxD,OAA8B;QAE9B,MAAM,IAAI,CAAC,QAAQ,CAAC,UAAU,CAAC,QAAQ,EAAE,CAAC;QAC1C,OAAO,IAAI,CAAC,QAAQ,CAAC,mBAAmB,CAAC,sBAAsB,CAC7D,OAAO,EACP,OAAO,CACR,CAAC;IACJ,CAAC;IAED;;OAEG;IACH,kBAAkB;QAChB,OAAO,IAAI,CAAC,WAAW,CAAC;IAC1B,CAAC;IAED;;OAEG;IACH,gBAAgB;QACd,OAAO,IAAI,CAAC,UAAU,CAAC;IACzB,CAAC;CACF"}

package/dist/service/wafv2/statement/sim-waf-rate-based-input.d.ts

@@ -0,0 +1,49 @@
+import type { SimWafInspectedRequest } from "../evaluate/sim-waf-inspected-request.js";
+import type { SimWafRateBasedStatementInput } from "./sim-waf-rate-based.type.js";
+import type { SimWafStatementInput } from "./sim-waf-statement.type.js";
+/**
+ * What a rule joining a rate limit to anything else is refused with.
+ *
+ * Real WAFv2 draws the line in both directions, and so does this. A
+ * `RateBasedStatement` beside another kind would leave that kind unread and
+ * the rate limit counting requests the rule meant to leave alone. Nesting one
+ * inside a logical statement would count only the requests that reached it. A
+ * rate limit narrows what it counts with its own `ScopeDownStatement`.
+ */
+export declare const simWafRateBasedIsWholeStatement: string;
+/**
+ * Refuse a rule that names a rate limit and another statement kind together.
+ */
+export declare function refuseJoinedSimWafRateBased(statement: SimWafStatementInput, ruleName: string): void;
+/**
+ * Which aggregation instance one request is counted under.
+ */
+export type SimWafRateAggregation = (request: SimWafInspectedRequest) => string;
+/**
+ * Read how many requests a rate-based statement counts up to.
+ *
+ * AWS holds the limit to at least ten. A rule below that would limit a client
+ * that had barely arrived.
+ */
+export declare function simWafRateLimit(statement: SimWafRateBasedStatementInput, ruleName: string): number;
+/**
+ * Read how long a rate-based statement counts over, in milliseconds.
+ *
+ * AWS takes four windows and no others, and a statement naming none counts
+ * over five minutes.
+ */
+export declare function simWafRateWindowMilliseconds(statement: SimWafRateBasedStatementInput, ruleName: string): number;
+/**
+ * Read how a rate-based statement groups the requests it counts.
+ *
+ * `IP` counts each client address on its own. Every request in this simulation
+ * reports `simAwsProxiedSourceIp`, leaving one client for the whole
+ * simulation. A rate limiting test sends its requests from one client and
+ * expects the rule to trip, so that is the case anybody would write.
+ *
+ * `CONSTANT` counts every request the statement sees together, and AWS asks
+ * for a scope-down statement alongside it to say which requests those are. A
+ * rule without one would limit everything the web ACL serves.
+ */
+export declare function simWafRateAggregation(statement: SimWafRateBasedStatementInput, ruleName: string): SimWafRateAggregation;
+//# sourceMappingURL=sim-waf-rate-based-input.d.ts.map

package/dist/service/wafv2/statement/sim-waf-rate-based-input.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"sim-waf-rate-based-input.d.ts","sourceRoot":"","sources":["../../../../src/service/wafv2/statement/sim-waf-rate-based-input.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,sBAAsB,EAAE,MAAM,0CAA0C,CAAC;AACvF,OAAO,KAAK,EAAE,6BAA6B,EAAE,MAAM,8BAA8B,CAAC;AAClF,OAAO,KAAK,EAAE,oBAAoB,EAAE,MAAM,6BAA6B,CAAC;AAIxE;;;;;;;;GAQG;AACH,eAAO,MAAM,+BAA+B,QAEF,CAAC;AAE3C;;GAEG;AACH,wBAAgB,2BAA2B,CACzC,SAAS,EAAE,oBAAoB,EAC/B,QAAQ,EAAE,MAAM,GACf,IAAI,CAYN;AAED;;GAEG;AACH,MAAM,MAAM,qBAAqB,GAAG,CAAC,OAAO,EAAE,sBAAsB,KAAK,MAAM,CAAC;AAchF;;;;;GAKG;AACH,wBAAgB,eAAe,CAC7B,SAAS,EAAE,6BAA6B,EACxC,QAAQ,EAAE,MAAM,GACf,MAAM,CAgBR;AAED;;;;;GAKG;AACH,wBAAgB,4BAA4B,CAC1C,SAAS,EAAE,6BAA6B,EACxC,QAAQ,EAAE,MAAM,GACf,MAAM,CAYR;AAED;;;;;;;;;;;GAWG;AACH,wBAAgB,qBAAqB,CACnC,SAAS,EAAE,6BAA6B,EACxC,QAAQ,EAAE,MAAM,GACf,qBAAqB,CA0BvB"}

package/dist/service/wafv2/statement/sim-waf-rate-based-input.js

@@ -0,0 +1,94 @@
+import { simAwsProxiedSourceIp } from "../../../serve/http/sim-aws-proxied-connection.js";
+import { invalidSimWafRule } from "./sim-waf-rule-refusals.js";
+import { refuseUnsimulatedSimWafRateKeyType } from "./sim-waf-unsimulated-rate-based.js";
+/**
+ * What a rule joining a rate limit to anything else is refused with.
+ *
+ * Real WAFv2 draws the line in both directions, and so does this. A
+ * `RateBasedStatement` beside another kind would leave that kind unread and
+ * the rate limit counting requests the rule meant to leave alone. Nesting one
+ * inside a logical statement would count only the requests that reached it. A
+ * rate limit narrows what it counts with its own `ScopeDownStatement`.
+ */
+export const simWafRateBasedIsWholeStatement = "A RateBasedStatement is the whole of a rule's statement, and cannot be " +
+    "joined to or nested inside another one";
+/**
+ * Refuse a rule that names a rate limit and another statement kind together.
+ */
+export function refuseJoinedSimWafRateBased(statement, ruleName) {
+    if (statement.RateBasedStatement === undefined) {
+        return;
+    }
+    const joined = Object.entries(statement).some(([kind, value]) => kind !== "RateBasedStatement" && value !== undefined);
+    if (joined) {
+        invalidSimWafRule(ruleName, simWafRateBasedIsWholeStatement);
+    }
+}
+/** The windows AWS counts over, in seconds. */
+const evaluationWindows = new Set([60, 120, 300, 600]);
+/** What AWS counts over when a statement names no window. */
+const defaultEvaluationWindowSec = 300;
+const millisecondsPerSecond = 1000;
+/** The smallest and largest limits AWS takes. */
+const smallestLimit = 10;
+const largestLimit = 2_000_000_000;
+/**
+ * Read how many requests a rate-based statement counts up to.
+ *
+ * AWS holds the limit to at least ten. A rule below that would limit a client
+ * that had barely arrived.
+ */
+export function simWafRateLimit(statement, ruleName) {
+    const limit = statement.Limit;
+    if (limit === undefined || !Number.isSafeInteger(limit)) {
+        invalidSimWafRule(ruleName, "A RateBasedStatement needs a whole Limit");
+    }
+    if (limit < smallestLimit || limit > largestLimit) {
+        invalidSimWafRule(ruleName, `A RateBasedStatement Limit is between ${smallestLimit} and ` +
+            `${largestLimit}, and this one is ${limit}`);
+    }
+    return limit;
+}
+/**
+ * Read how long a rate-based statement counts over, in milliseconds.
+ *
+ * AWS takes four windows and no others, and a statement naming none counts
+ * over five minutes.
+ */
+export function simWafRateWindowMilliseconds(statement, ruleName) {
+    const seconds = statement.EvaluationWindowSec ?? defaultEvaluationWindowSec;
+    if (!evaluationWindows.has(seconds)) {
+        invalidSimWafRule(ruleName, `A RateBasedStatement EvaluationWindowSec is one of ` +
+            `${[...evaluationWindows].join(", ")}, and this one is ${seconds}`);
+    }
+    return seconds * millisecondsPerSecond;
+}
+/**
+ * Read how a rate-based statement groups the requests it counts.
+ *
+ * `IP` counts each client address on its own. Every request in this simulation
+ * reports `simAwsProxiedSourceIp`, leaving one client for the whole
+ * simulation. A rate limiting test sends its requests from one client and
+ * expects the rule to trip, so that is the case anybody would write.
+ *
+ * `CONSTANT` counts every request the statement sees together, and AWS asks
+ * for a scope-down statement alongside it to say which requests those are. A
+ * rule without one would limit everything the web ACL serves.
+ */
+export function simWafRateAggregation(statement, ruleName) {
+    const keyType = statement.AggregateKeyType;
+    refuseUnsimulatedSimWafRateKeyType(keyType, ruleName);
+    if (keyType === "IP") {
+        return () => simAwsProxiedSourceIp;
+    }
+    if (keyType === "CONSTANT") {
+        if (statement.ScopeDownStatement === undefined) {
+            invalidSimWafRule(ruleName, "A RateBasedStatement aggregating on CONSTANT needs a " +
+                "ScopeDownStatement to say which requests it counts");
+        }
+        return () => "CONSTANT";
+    }
+    invalidSimWafRule(ruleName, `A RateBasedStatement AggregateKeyType is IP or CONSTANT, and this one ` +
+        `is ${String(keyType)}`);
+}
+//# sourceMappingURL=sim-waf-rate-based-input.js.map

package/dist/service/wafv2/statement/sim-waf-rate-based-input.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"sim-waf-rate-based-input.js","sourceRoot":"","sources":["../../../../src/service/wafv2/statement/sim-waf-rate-based-input.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,qBAAqB,EAAE,MAAM,mDAAmD,CAAC;AAI1F,OAAO,EAAE,iBAAiB,EAAE,MAAM,4BAA4B,CAAC;AAC/D,OAAO,EAAE,kCAAkC,EAAE,MAAM,qCAAqC,CAAC;AAEzF;;;;;;;;GAQG;AACH,MAAM,CAAC,MAAM,+BAA+B,GAC1C,yEAAyE;IACzE,wCAAwC,CAAC;AAE3C;;GAEG;AACH,MAAM,UAAU,2BAA2B,CACzC,SAA+B,EAC/B,QAAgB;IAEhB,IAAI,SAAS,CAAC,kBAAkB,KAAK,SAAS,EAAE,CAAC;QAC/C,OAAO;IACT,CAAC;IAED,MAAM,MAAM,GAAG,MAAM,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC,IAAI,CAC3C,CAAC,CAAC,IAAI,EAAE,KAAK,CAAC,EAAE,EAAE,CAAC,IAAI,KAAK,oBAAoB,IAAI,KAAK,KAAK,SAAS,CACxE,CAAC;IAEF,IAAI,MAAM,EAAE,CAAC;QACX,iBAAiB,CAAC,QAAQ,EAAE,+BAA+B,CAAC,CAAC;IAC/D,CAAC;AACH,CAAC;AAOD,+CAA+C;AAC/C,MAAM,iBAAiB,GAAG,IAAI,GAAG,CAAC,CAAC,EAAE,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,CAAC,CAAC,CAAC;AAEvD,6DAA6D;AAC7D,MAAM,0BAA0B,GAAG,GAAG,CAAC;AAEvC,MAAM,qBAAqB,GAAG,IAAI,CAAC;AAEnC,iDAAiD;AACjD,MAAM,aAAa,GAAG,EAAE,CAAC;AACzB,MAAM,YAAY,GAAG,aAAa,CAAC;AAEnC;;;;;GAKG;AACH,MAAM,UAAU,eAAe,CAC7B,SAAwC,EACxC,QAAgB;IAEhB,MAAM,KAAK,GAAG,SAAS,CAAC,KAAK,CAAC;IAE9B,IAAI,KAAK,KAAK,SAAS,IAAI,CAAC,MAAM,CAAC,aAAa,CAAC,KAAK,CAAC,EAAE,CAAC;QACxD,iBAAiB,CAAC,QAAQ,EAAE,0CAA0C,CAAC,CAAC;IAC1E,CAAC;IAED,IAAI,KAAK,GAAG,aAAa,IAAI,KAAK,GAAG,YAAY,EAAE,CAAC;QAClD,iBAAiB,CACf,QAAQ,EACR,yCAAyC,aAAa,OAAO;YAC3D,GAAG,YAAY,qBAAqB,KAAK,EAAE,CAC9C,CAAC;IACJ,CAAC;IAED,OAAO,KAAK,CAAC;AACf,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,4BAA4B,CAC1C,SAAwC,EACxC,QAAgB;IAEhB,MAAM,OAAO,GAAG,SAAS,CAAC,mBAAmB,IAAI,0BAA0B,CAAC;IAE5E,IAAI,CAAC,iBAAiB,CAAC,GAAG,CAAC,OAAO,CAAC,EAAE,CAAC;QACpC,iBAAiB,CACf,QAAQ,EACR,qDAAqD;YACnD,GAAG,CAAC,GAAG,iBAAiB,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,qBAAqB,OAAO,EAAE,CACrE,CAAC;IACJ,CAAC;IAED,OAAO,OAAO,GAAG,qBAAqB,CAAC;AACzC,CAAC;AAED;;;;;;;;;;;GAWG;AACH,MAAM,UAAU,qBAAqB,CACnC,SAAwC,EACxC,QAAgB;IAEhB,MAAM,OAAO,GAAG,SAAS,CAAC,gBAAgB,CAAC;IAE3C,kCAAkC,CAAC,OAAO,EAAE,QAAQ,CAAC,CAAC;IAEtD,IAAI,OAAO,KAAK,IAAI,EAAE,CAAC;QACrB,OAAO,GAAW,EAAE,CAAC,qBAAqB,CAAC;IAC7C,CAAC;IAED,IAAI,OAAO,KAAK,UAAU,EAAE,CAAC;QAC3B,IAAI,SAAS,CAAC,kBAAkB,KAAK,SAAS,EAAE,CAAC;YAC/C,iBAAiB,CACf,QAAQ,EACR,uDAAuD;gBACrD,oDAAoD,CACvD,CAAC;QACJ,CAAC;QAED,OAAO,GAAW,EAAE,CAAC,UAAU,CAAC;IAClC,CAAC;IAED,iBAAiB,CACf,QAAQ,EACR,wEAAwE;QACtE,MAAM,MAAM,CAAC,OAAO,CAAC,EAAE,CAC1B,CAAC;AACJ,CAAC"}

package/dist/service/wafv2/statement/sim-waf-rate-based.d.ts

@@ -0,0 +1,22 @@
+import type { SimWafMatcher } from "./sim-waf-field-match.js";
+import type { SimWafRateBasedStatementInput } from "./sim-waf-rate-based.type.js";
+import { type SimWafStatementScope } from "./sim-waf-statement.js";
+/**
+ * Compile a rule that limits how many requests one client may make.
+ *
+ * The statement counts the requests it sees against the aggregation instance
+ * their key selects, and claims a request once the count over the evaluation
+ * window has gone past `Limit`. The rule's own action then applies. A blocking
+ * rule blocks, and a counting rule records the match and lets the next rule
+ * have a look.
+ *
+ * A scope-down statement decides which requests the rule sees at all. One it
+ * leaves alone is neither counted nor limited. That is what keeps a rate limit
+ * on `/signup` off the rest of a site.
+ *
+ * Counting is against the simulated clock. A test that has sent enough
+ * requests to trip the rule is served again once time has moved past the
+ * window.
+ */
+export declare function compileSimWafRateBasedStatement(statement: SimWafRateBasedStatementInput, scope: SimWafStatementScope): SimWafMatcher;
+//# sourceMappingURL=sim-waf-rate-based.d.ts.map

package/dist/service/wafv2/statement/sim-waf-rate-based.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"sim-waf-rate-based.d.ts","sourceRoot":"","sources":["../../../../src/service/wafv2/statement/sim-waf-rate-based.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,0BAA0B,CAAC;AAM9D,OAAO,KAAK,EAAE,6BAA6B,EAAE,MAAM,8BAA8B,CAAC;AAElF,OAAO,EAEL,KAAK,oBAAoB,EAC1B,MAAM,wBAAwB,CAAC;AAGhC;;;;;;;;;;;;;;;;GAgBG;AACH,wBAAgB,+BAA+B,CAC7C,SAAS,EAAE,6BAA6B,EACxC,KAAK,EAAE,oBAAoB,GAC1B,aAAa,CAuBf"}

package/dist/service/wafv2/statement/sim-waf-rate-based.js

@@ -0,0 +1,41 @@
+import { simWafRateAggregation, simWafRateLimit, simWafRateWindowMilliseconds, } from "./sim-waf-rate-based-input.js";
+import { SimWafRateCounter } from "./sim-waf-rate-counter.js";
+import { compileSimWafStatement, } from "./sim-waf-statement.js";
+import { refuseUnsimulatedSimWafRateMembers } from "./sim-waf-unsimulated-rate-based.js";
+/**
+ * Compile a rule that limits how many requests one client may make.
+ *
+ * The statement counts the requests it sees against the aggregation instance
+ * their key selects, and claims a request once the count over the evaluation
+ * window has gone past `Limit`. The rule's own action then applies. A blocking
+ * rule blocks, and a counting rule records the match and lets the next rule
+ * have a look.
+ *
+ * A scope-down statement decides which requests the rule sees at all. One it
+ * leaves alone is neither counted nor limited. That is what keeps a rate limit
+ * on `/signup` off the rest of a site.
+ *
+ * Counting is against the simulated clock. A test that has sent enough
+ * requests to trip the rule is served again once time has moved past the
+ * window.
+ */
+export function compileSimWafRateBasedStatement(statement, scope) {
+    const { ruleName } = scope;
+    refuseUnsimulatedSimWafRateMembers(statement, ruleName);
+    const limit = simWafRateLimit(statement, ruleName);
+    const keyOf = simWafRateAggregation(statement, ruleName);
+    const counter = new SimWafRateCounter({
+        clock: scope.clock,
+        windowMilliseconds: simWafRateWindowMilliseconds(statement, ruleName),
+    });
+    const scopeDown = statement.ScopeDownStatement === undefined
+        ? undefined
+        : compileSimWafStatement(statement.ScopeDownStatement, scope);
+    return (request) => {
+        if (scopeDown !== undefined && !scopeDown(request)) {
+            return false;
+        }
+        return counter.count(keyOf(request)) > limit;
+    };
+}
+//# sourceMappingURL=sim-waf-rate-based.js.map

package/dist/service/wafv2/statement/sim-waf-rate-based.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"sim-waf-rate-based.js","sourceRoot":"","sources":["../../../../src/service/wafv2/statement/sim-waf-rate-based.ts"],"names":[],"mappings":"AACA,OAAO,EACL,qBAAqB,EACrB,eAAe,EACf,4BAA4B,GAC7B,MAAM,+BAA+B,CAAC;AAEvC,OAAO,EAAE,iBAAiB,EAAE,MAAM,2BAA2B,CAAC;AAC9D,OAAO,EACL,sBAAsB,GAEvB,MAAM,wBAAwB,CAAC;AAChC,OAAO,EAAE,kCAAkC,EAAE,MAAM,qCAAqC,CAAC;AAEzF;;;;;;;;;;;;;;;;GAgBG;AACH,MAAM,UAAU,+BAA+B,CAC7C,SAAwC,EACxC,KAA2B;IAE3B,MAAM,EAAE,QAAQ,EAAE,GAAG,KAAK,CAAC;IAE3B,kCAAkC,CAAC,SAAS,EAAE,QAAQ,CAAC,CAAC;IAExD,MAAM,KAAK,GAAG,eAAe,CAAC,SAAS,EAAE,QAAQ,CAAC,CAAC;IACnD,MAAM,KAAK,GAAG,qBAAqB,CAAC,SAAS,EAAE,QAAQ,CAAC,CAAC;IACzD,MAAM,OAAO,GAAG,IAAI,iBAAiB,CAAC;QACpC,KAAK,EAAE,KAAK,CAAC,KAAK;QAClB,kBAAkB,EAAE,4BAA4B,CAAC,SAAS,EAAE,QAAQ,CAAC;KACtE,CAAC,CAAC;IACH,MAAM,SAAS,GACb,SAAS,CAAC,kBAAkB,KAAK,SAAS;QACxC,CAAC,CAAC,SAAS;QACX,CAAC,CAAC,sBAAsB,CAAC,SAAS,CAAC,kBAAkB,EAAE,KAAK,CAAC,CAAC;IAElE,OAAO,CAAC,OAAO,EAAW,EAAE;QAC1B,IAAI,SAAS,KAAK,SAAS,IAAI,CAAC,SAAS,CAAC,OAAO,CAAC,EAAE,CAAC;YACnD,OAAO,KAAK,CAAC;QACf,CAAC;QAED,OAAO,OAAO,CAAC,KAAK,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,GAAG,KAAK,CAAC;IAC/C,CAAC,CAAC;AACJ,CAAC"}

package/dist/service/wafv2/statement/sim-waf-rate-based.type.d.ts

@@ -0,0 +1,18 @@
+import type { SimWafStatementInput } from "./sim-waf-statement.type.js";
+/**
+ * Minimal structural WAFv2 RateBasedStatement.
+ *
+ * The members Yulin refuses are declared here rather than left out, so a
+ * statement that names one is refused by name.
+ *
+ * https://docs.aws.amazon.com/AWSJavaScriptSDK/v3/latest/client/wafv2/Interface/RateBasedStatement/
+ */
+export interface SimWafRateBasedStatementInput {
+    readonly Limit?: number | undefined;
+    readonly EvaluationWindowSec?: number | undefined;
+    readonly AggregateKeyType?: string | undefined;
+    readonly ScopeDownStatement?: SimWafStatementInput | undefined;
+    readonly CustomKeys?: readonly unknown[] | undefined;
+    readonly ForwardedIPConfig?: unknown;
+}
+//# sourceMappingURL=sim-waf-rate-based.type.d.ts.map

package/dist/service/wafv2/statement/sim-waf-rate-based.type.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"sim-waf-rate-based.type.d.ts","sourceRoot":"","sources":["../../../../src/service/wafv2/statement/sim-waf-rate-based.type.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,oBAAoB,EAAE,MAAM,6BAA6B,CAAC;AAExE;;;;;;;GAOG;AACH,MAAM,WAAW,6BAA6B;IAC5C,QAAQ,CAAC,KAAK,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IACpC,QAAQ,CAAC,mBAAmB,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IAClD,QAAQ,CAAC,gBAAgB,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IAC/C,QAAQ,CAAC,kBAAkB,CAAC,EAAE,oBAAoB,GAAG,SAAS,CAAC;IAC/D,QAAQ,CAAC,UAAU,CAAC,EAAE,SAAS,OAAO,EAAE,GAAG,SAAS,CAAC;IACrD,QAAQ,CAAC,iBAAiB,CAAC,EAAE,OAAO,CAAC;CACtC"}

package/dist/service/wafv2/statement/sim-waf-rate-based.type.js

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=sim-waf-rate-based.type.js.map

package/dist/service/wafv2/statement/sim-waf-rate-based.type.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"sim-waf-rate-based.type.js","sourceRoot":"","sources":["../../../../src/service/wafv2/statement/sim-waf-rate-based.type.ts"],"names":[],"mappings":""}

package/dist/service/wafv2/statement/sim-waf-rate-counter.d.ts

@@ -0,0 +1,29 @@
+import type { SimClock } from "../../../util/clock/sim-clock.js";
+interface SimWafRateCounterProperties {
+    readonly clock: SimClock;
+    readonly windowMilliseconds: number;
+}
+/**
+ * What one rate-based rule has counted, by aggregation instance.
+ *
+ * A count is a window over the simulated clock rather than a running total.
+ * The instant of each request is kept, and the instants that have fallen out
+ * of the window are dropped as the key is read, so a simulation whose clock
+ * has been advanced past the window finds the rule counting from nothing
+ * again.
+ *
+ * The counts belong to the compiled rule, so writing a new set of rules over a
+ * web ACL starts them again. Real WAF does the same with a rule it has just
+ * been given.
+ */
+export declare class SimWafRateCounter {
+    #private;
+    constructor(properties: SimWafRateCounterProperties);
+    /**
+     * Count one request against an aggregation key, and answer with what the
+     * window holds for that key once it has been counted.
+     */
+    count(key: string): number;
+}
+export {};
+//# sourceMappingURL=sim-waf-rate-counter.d.ts.map

package/dist/service/wafv2/statement/sim-waf-rate-counter.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"sim-waf-rate-counter.d.ts","sourceRoot":"","sources":["../../../../src/service/wafv2/statement/sim-waf-rate-counter.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,kCAAkC,CAAC;AAEjE,UAAU,2BAA2B;IACnC,QAAQ,CAAC,KAAK,EAAE,QAAQ,CAAC;IACzB,QAAQ,CAAC,kBAAkB,EAAE,MAAM,CAAC;CACrC;AAED;;;;;;;;;;;;GAYG;AACH,qBAAa,iBAAiB;;IAK5B,YAAY,UAAU,EAAE,2BAA2B,EAGlD;IAED;;;OAGG;IACH,KAAK,CAAC,GAAG,EAAE,MAAM,GAAG,MAAM,CASzB;CACF"}

package/dist/service/wafv2/statement/sim-waf-rate-counter.js

@@ -0,0 +1,35 @@
+/**
+ * What one rate-based rule has counted, by aggregation instance.
+ *
+ * A count is a window over the simulated clock rather than a running total.
+ * The instant of each request is kept, and the instants that have fallen out
+ * of the window are dropped as the key is read, so a simulation whose clock
+ * has been advanced past the window finds the rule counting from nothing
+ * again.
+ *
+ * The counts belong to the compiled rule, so writing a new set of rules over a
+ * web ACL starts them again. Real WAF does the same with a rule it has just
+ * been given.
+ */
+export class SimWafRateCounter {
+    #clock;
+    #windowMilliseconds;
+    #counted = new Map();
+    constructor(properties) {
+        this.#clock = properties.clock;
+        this.#windowMilliseconds = properties.windowMilliseconds;
+    }
+    /**
+     * Count one request against an aggregation key, and answer with what the
+     * window holds for that key once it has been counted.
+     */
+    count(key) {
+        const now = this.#clock.now().getTime();
+        const since = now - this.#windowMilliseconds;
+        const within = (this.#counted.get(key) ?? []).filter((at) => at > since);
+        within.push(now);
+        this.#counted.set(key, within);
+        return within.length;
+    }
+}
+//# sourceMappingURL=sim-waf-rate-counter.js.map

package/dist/service/wafv2/statement/sim-waf-rate-counter.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"sim-waf-rate-counter.js","sourceRoot":"","sources":["../../../../src/service/wafv2/statement/sim-waf-rate-counter.ts"],"names":[],"mappings":"AAOA;;;;;;;;;;;;GAYG;AACH,MAAM,OAAO,iBAAiB;IACnB,MAAM,CAAW;IACjB,mBAAmB,CAAS;IAC5B,QAAQ,GAAG,IAAI,GAAG,EAAoB,CAAC;IAEhD,YAAY,UAAuC;QACjD,IAAI,CAAC,MAAM,GAAG,UAAU,CAAC,KAAK,CAAC;QAC/B,IAAI,CAAC,mBAAmB,GAAG,UAAU,CAAC,kBAAkB,CAAC;IAC3D,CAAC;IAED;;;OAGG;IACH,KAAK,CAAC,GAAW;QACf,MAAM,GAAG,GAAG,IAAI,CAAC,MAAM,CAAC,GAAG,EAAE,CAAC,OAAO,EAAE,CAAC;QACxC,MAAM,KAAK,GAAG,GAAG,GAAG,IAAI,CAAC,mBAAmB,CAAC;QAC7C,MAAM,MAAM,GAAG,CAAC,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,GAAG,CAAC,IAAI,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC,EAAE,EAAE,EAAE,CAAC,EAAE,GAAG,KAAK,CAAC,CAAC;QAEzE,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;QACjB,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,GAAG,EAAE,MAAM,CAAC,CAAC;QAE/B,OAAO,MAAM,CAAC,MAAM,CAAC;IACvB,CAAC;CACF"}

package/dist/service/wafv2/statement/sim-waf-statement.d.ts

@@ -1,3 +1,4 @@
+import type { SimClock } from "../../../util/clock/sim-clock.js";
 import type { SimWafRegexPatternSet } from "../regex-pattern-set/sim-waf-regex-pattern-set.js";
 import type { SimWafResourceStore } from "../resource/sim-waf-resource-store.js";
 import { type SimWafMatcher } from "./sim-waf-field-match.js";
@@ -8,6 +9,11 @@ import type { SimWafStatementInput } from "./sim-waf-statement.type.js";
 export interface SimWafStatementScope {
     readonly regexPatternSets: SimWafResourceStore<SimWafRegexPatternSet>;
     readonly ruleName: string;
+    /**
+     * The simulation's sense of time, which a rate-based statement counts
+     * against.
+     */
+    readonly clock: SimClock;
 }
 /**
  * Turn one statement into the matcher a rule evaluates a request with.

package/dist/service/wafv2/statement/sim-waf-statement.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"sim-waf-statement.d.ts","sourceRoot":"","sources":["../../../../src/service/wafv2/statement/sim-waf-statement.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,qBAAqB,EAAE,MAAM,mDAAmD,CAAC;AAC/F,OAAO,KAAK,EAAE,mBAAmB,EAAE,MAAM,uCAAuC,CAAC;AAEjF,OAAO,EAEL,KAAK,aAAa,EACnB,MAAM,0BAA0B,CAAC;AASlC,OAAO,KAAK,EAEV,oBAAoB,EACrB,MAAM,6BAA6B,CAAC;AAGrC;;GAEG;AACH,MAAM,WAAW,oBAAoB;IACnC,QAAQ,CAAC,gBAAgB,EAAE,mBAAmB,CAAC,qBAAqB,CAAC,CAAC;IACtE,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;CAC3B;AAED;;;;;;;GAOG;AACH,wBAAgB,sBAAsB,CACpC,SAAS,EAAE,oBAAoB,GAAG,SAAS,EAC3C,KAAK,EAAE,oBAAoB,GAC1B,aAAa,CA4Bf"}
+{"version":3,"file":"sim-waf-statement.d.ts","sourceRoot":"","sources":["../../../../src/service/wafv2/statement/sim-waf-statement.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,kCAAkC,CAAC;AACjE,OAAO,KAAK,EAAE,qBAAqB,EAAE,MAAM,mDAAmD,CAAC;AAC/F,OAAO,KAAK,EAAE,mBAAmB,EAAE,MAAM,uCAAuC,CAAC;AAEjF,OAAO,EAEL,KAAK,aAAa,EACnB,MAAM,0BAA0B,CAAC;AAUlC,OAAO,KAAK,EAEV,oBAAoB,EACrB,MAAM,6BAA6B,CAAC;AAGrC;;GAEG;AACH,MAAM,WAAW,oBAAoB;IACnC,QAAQ,CAAC,gBAAgB,EAAE,mBAAmB,CAAC,qBAAqB,CAAC,CAAC;IACtE,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAE1B;;;OAGG;IACH,QAAQ,CAAC,KAAK,EAAE,QAAQ,CAAC;CAC1B;AAED;;;;;;;GAOG;AACH,wBAAgB,sBAAsB,CACpC,SAAS,EAAE,oBAAoB,GAAG,SAAS,EAC3C,KAAK,EAAE,oBAAoB,GAC1B,aAAa,CAgCf"}

package/dist/service/wafv2/statement/sim-waf-statement.js

@@ -3,6 +3,7 @@ import { compileSimWafFieldMatcher, } from "./sim-waf-field-match.js";
 import { simWafRegexPatternSetTest, simWafRegexTest, } from "./sim-waf-regex-match.js";
 import { compileSimWafLabelMatch } from "./sim-waf-label-match.js";
 import { compileSimWafLogicalStatement } from "./sim-waf-logical-statement.js";
+import { simWafRateBasedIsWholeStatement } from "./sim-waf-rate-based-input.js";
 import { invalidSimWafRule } from "./sim-waf-rule-refusals.js";
 import { simWafSizeTest } from "./sim-waf-size-constraint.js";
 import { refuseUnsimulatedSimWafStatement } from "./sim-waf-unsimulated-statement.js";
@@ -27,6 +28,9 @@ export function compileSimWafStatement(statement, scope) {
         invalidSimWafRule(ruleName, "A ManagedRuleGroupStatement is the whole of a rule's statement, and " +
             "cannot be joined to or nested inside another one");
     }
+    if (statement.RateBasedStatement !== undefined) {
+        invalidSimWafRule(ruleName, simWafRateBasedIsWholeStatement);
+    }
     if (statement.LabelMatchStatement !== undefined) {
         return compileSimWafLabelMatch(statement.LabelMatchStatement, ruleName);
     }

package/dist/service/wafv2/statement/sim-waf-statement.js.map

@@ -1 +1 @@
-{"version":3,"file":"sim-waf-statement.js","sourceRoot":"","sources":["../../../../src/service/wafv2/statement/sim-waf-statement.ts"],"names":[],"mappings":"AAEA,OAAO,EAAE,mBAAmB,EAAE,MAAM,yBAAyB,CAAC;AAC9D,OAAO,EACL,yBAAyB,GAE1B,MAAM,0BAA0B,CAAC;AAClC,OAAO,EACL,yBAAyB,EACzB,eAAe,GAChB,MAAM,0BAA0B,CAAC;AAClC,OAAO,EAAE,uBAAuB,EAAE,MAAM,0BAA0B,CAAC;AACnE,OAAO,EAAE,6BAA6B,EAAE,MAAM,gCAAgC,CAAC;AAC/E,OAAO,EAAE,iBAAiB,EAAE,MAAM,4BAA4B,CAAC;AAC/D,OAAO,EAAE,cAAc,EAAE,MAAM,8BAA8B,CAAC;AAK9D,OAAO,EAAE,gCAAgC,EAAE,MAAM,oCAAoC,CAAC;AAUtF;;;;;;;GAOG;AACH,MAAM,UAAU,sBAAsB,CACpC,SAA2C,EAC3C,KAA2B;IAE3B,MAAM,EAAE,QAAQ,EAAE,GAAG,KAAK,CAAC;IAE3B,IAAI,SAAS,KAAK,SAAS,EAAE,CAAC;QAC5B,iBAAiB,CAAC,QAAQ,EAAE,0BAA0B,CAAC,CAAC;IAC1D,CAAC;IAED,gCAAgC,CAAC,SAAS,EAAE,QAAQ,CAAC,CAAC;IAEtD,IAAI,SAAS,CAAC,yBAAyB,KAAK,SAAS,EAAE,CAAC;QACtD,0EAA0E;QAC1E,yEAAyE;QACzE,0DAA0D;QAC1D,iBAAiB,CACf,QAAQ,EACR,sEAAsE;YACpE,kDAAkD,CACrD,CAAC;IACJ,CAAC;IAED,IAAI,SAAS,CAAC,mBAAmB,KAAK,SAAS,EAAE,CAAC;QAChD,OAAO,uBAAuB,CAAC,SAAS,CAAC,mBAAmB,EAAE,QAAQ,CAAC,CAAC;IAC1E,CAAC;IAED,OAAO,CACL,qBAAqB,CAAC,SAAS,EAAE,KAAK,CAAC;QACvC,6BAA6B,CAAC,SAAS,EAAE,KAAK,CAAC,CAChD,CAAC;AACJ,CAAC;AAED,SAAS,qBAAqB,CAC5B,SAA+B,EAC/B,KAA2B;IAE3B,MAAM,EAAE,QAAQ,EAAE,GAAG,KAAK,CAAC;IAE3B,IAAI,SAAS,CAAC,kBAAkB,KAAK,SAAS,EAAE,CAAC;QAC/C,MAAM,SAAS,GAAG,SAAS,CAAC,kBAAkB,CAAC;QAE/C,OAAO,YAAY,CACjB,SAAS,EACT,QAAQ,EACR,mBAAmB,CAAC,SAAS,EAAE,QAAQ,CAAC,CACzC,CAAC;IACJ,CAAC;IAED,IAAI,SAAS,CAAC,mBAAmB,KAAK,SAAS,EAAE,CAAC;QAChD,MAAM,UAAU,GAAG,SAAS,CAAC,mBAAmB,CAAC;QAEjD,OAAO,YAAY,CACjB,UAAU,EACV,QAAQ,EACR,eAAe,CAAC,UAAU,EAAE,QAAQ,CAAC,CACtC,CAAC;IACJ,CAAC;IAED,IAAI,SAAS,CAAC,iCAAiC,KAAK,SAAS,EAAE,CAAC;QAC9D,MAAM,SAAS,GAAG,SAAS,CAAC,iCAAiC,CAAC;QAE9D,OAAO,YAAY,CACjB,SAAS,EACT,QAAQ,EACR,yBAAyB,CAAC,SAAS,EAAE,QAAQ,EAAE,KAAK,CAAC,gBAAgB,CAAC,CACvE,CAAC;IACJ,CAAC;IAED,IAAI,SAAS,CAAC,uBAAuB,KAAK,SAAS,EAAE,CAAC;QACpD,MAAM,IAAI,GAAG,SAAS,CAAC,uBAAuB,CAAC;QAE/C,OAAO,YAAY,CAAC,IAAI,EAAE,QAAQ,EAAE,cAAc,CAAC,IAAI,EAAE,QAAQ,CAAC,CAAC,CAAC;IACtE,CAAC;IAED,OAAO,SAAS,CAAC;AACnB,CAAC;AAED,SAAS,YAAY,CACnB,SAAoC,EACpC,QAAgB,EAChB,IAAgC;IAEhC,OAAO,yBAAyB,CAAC;QAC/B,KAAK,EAAE,SAAS,CAAC,YAAY;QAC7B,eAAe,EAAE,SAAS,CAAC,mBAAmB;QAC9C,QAAQ;QACR,IAAI;KACL,CAAC,CAAC;AACL,CAAC"}
+{"version":3,"file":"sim-waf-statement.js","sourceRoot":"","sources":["../../../../src/service/wafv2/statement/sim-waf-statement.ts"],"names":[],"mappings":"AAGA,OAAO,EAAE,mBAAmB,EAAE,MAAM,yBAAyB,CAAC;AAC9D,OAAO,EACL,yBAAyB,GAE1B,MAAM,0BAA0B,CAAC;AAClC,OAAO,EACL,yBAAyB,EACzB,eAAe,GAChB,MAAM,0BAA0B,CAAC;AAClC,OAAO,EAAE,uBAAuB,EAAE,MAAM,0BAA0B,CAAC;AACnE,OAAO,EAAE,6BAA6B,EAAE,MAAM,gCAAgC,CAAC;AAC/E,OAAO,EAAE,+BAA+B,EAAE,MAAM,+BAA+B,CAAC;AAChF,OAAO,EAAE,iBAAiB,EAAE,MAAM,4BAA4B,CAAC;AAC/D,OAAO,EAAE,cAAc,EAAE,MAAM,8BAA8B,CAAC;AAK9D,OAAO,EAAE,gCAAgC,EAAE,MAAM,oCAAoC,CAAC;AAgBtF;;;;;;;GAOG;AACH,MAAM,UAAU,sBAAsB,CACpC,SAA2C,EAC3C,KAA2B;IAE3B,MAAM,EAAE,QAAQ,EAAE,GAAG,KAAK,CAAC;IAE3B,IAAI,SAAS,KAAK,SAAS,EAAE,CAAC;QAC5B,iBAAiB,CAAC,QAAQ,EAAE,0BAA0B,CAAC,CAAC;IAC1D,CAAC;IAED,gCAAgC,CAAC,SAAS,EAAE,QAAQ,CAAC,CAAC;IAEtD,IAAI,SAAS,CAAC,yBAAyB,KAAK,SAAS,EAAE,CAAC;QACtD,0EAA0E;QAC1E,yEAAyE;QACzE,0DAA0D;QAC1D,iBAAiB,CACf,QAAQ,EACR,sEAAsE;YACpE,kDAAkD,CACrD,CAAC;IACJ,CAAC;IAED,IAAI,SAAS,CAAC,kBAAkB,KAAK,SAAS,EAAE,CAAC;QAC/C,iBAAiB,CAAC,QAAQ,EAAE,+BAA+B,CAAC,CAAC;IAC/D,CAAC;IAED,IAAI,SAAS,CAAC,mBAAmB,KAAK,SAAS,EAAE,CAAC;QAChD,OAAO,uBAAuB,CAAC,SAAS,CAAC,mBAAmB,EAAE,QAAQ,CAAC,CAAC;IAC1E,CAAC;IAED,OAAO,CACL,qBAAqB,CAAC,SAAS,EAAE,KAAK,CAAC;QACvC,6BAA6B,CAAC,SAAS,EAAE,KAAK,CAAC,CAChD,CAAC;AACJ,CAAC;AAED,SAAS,qBAAqB,CAC5B,SAA+B,EAC/B,KAA2B;IAE3B,MAAM,EAAE,QAAQ,EAAE,GAAG,KAAK,CAAC;IAE3B,IAAI,SAAS,CAAC,kBAAkB,KAAK,SAAS,EAAE,CAAC;QAC/C,MAAM,SAAS,GAAG,SAAS,CAAC,kBAAkB,CAAC;QAE/C,OAAO,YAAY,CACjB,SAAS,EACT,QAAQ,EACR,mBAAmB,CAAC,SAAS,EAAE,QAAQ,CAAC,CACzC,CAAC;IACJ,CAAC;IAED,IAAI,SAAS,CAAC,mBAAmB,KAAK,SAAS,EAAE,CAAC;QAChD,MAAM,UAAU,GAAG,SAAS,CAAC,mBAAmB,CAAC;QAEjD,OAAO,YAAY,CACjB,UAAU,EACV,QAAQ,EACR,eAAe,CAAC,UAAU,EAAE,QAAQ,CAAC,CACtC,CAAC;IACJ,CAAC;IAED,IAAI,SAAS,CAAC,iCAAiC,KAAK,SAAS,EAAE,CAAC;QAC9D,MAAM,SAAS,GAAG,SAAS,CAAC,iCAAiC,CAAC;QAE9D,OAAO,YAAY,CACjB,SAAS,EACT,QAAQ,EACR,yBAAyB,CAAC,SAAS,EAAE,QAAQ,EAAE,KAAK,CAAC,gBAAgB,CAAC,CACvE,CAAC;IACJ,CAAC;IAED,IAAI,SAAS,CAAC,uBAAuB,KAAK,SAAS,EAAE,CAAC;QACpD,MAAM,IAAI,GAAG,SAAS,CAAC,uBAAuB,CAAC;QAE/C,OAAO,YAAY,CAAC,IAAI,EAAE,QAAQ,EAAE,cAAc,CAAC,IAAI,EAAE,QAAQ,CAAC,CAAC,CAAC;IACtE,CAAC;IAED,OAAO,SAAS,CAAC;AACnB,CAAC;AAED,SAAS,YAAY,CACnB,SAAoC,EACpC,QAAgB,EAChB,IAAgC;IAEhC,OAAO,yBAAyB,CAAC;QAC/B,KAAK,EAAE,SAAS,CAAC,YAAY;QAC7B,eAAe,EAAE,SAAS,CAAC,mBAAmB;QAC9C,QAAQ;QACR,IAAI;KACL,CAAC,CAAC;AACL,CAAC"}

package/dist/service/wafv2/statement/sim-waf-statement.type.d.ts

@@ -1,5 +1,6 @@
 import type { SimWafManagedRuleGroupStatementInput } from "../managed/sim-waf-managed-group.type.js";
 import type { SimWafByteMatchStatementInput } from "./sim-waf-byte-match.js";
+import type { SimWafRateBasedStatementInput } from "./sim-waf-rate-based.type.js";
 import type { SimWafLabelMatchStatementInput } from "./sim-waf-label-match.js";
 import type { SimWafFieldToMatchInput } from "./sim-waf-field-to-match.type.js";
 import type { SimWafRegexMatchStatementInput, SimWafRegexPatternSetReferenceInput } from "./sim-waf-regex-match.js";
@@ -38,7 +39,7 @@ export interface SimWafStatementInput {
     readonly IPSetReferenceStatement?: unknown;
     readonly GeoMatchStatement?: unknown;
     readonly AsnMatchStatement?: unknown;
-    readonly RateBasedStatement?: unknown;
+    readonly RateBasedStatement?: SimWafRateBasedStatementInput | undefined;
     readonly SqliMatchStatement?: unknown;
     readonly XssMatchStatement?: unknown;
     readonly LabelMatchStatement?: SimWafLabelMatchStatementInput | undefined;

package/dist/service/wafv2/statement/sim-waf-statement.type.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"sim-waf-statement.type.d.ts","sourceRoot":"","sources":["../../../../src/service/wafv2/statement/sim-waf-statement.type.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,oCAAoC,EAAE,MAAM,0CAA0C,CAAC;AACrG,OAAO,KAAK,EAAE,6BAA6B,EAAE,MAAM,yBAAyB,CAAC;AAC7E,OAAO,KAAK,EAAE,8BAA8B,EAAE,MAAM,0BAA0B,CAAC;AAC/E,OAAO,KAAK,EAAE,uBAAuB,EAAE,MAAM,kCAAkC,CAAC;AAChF,OAAO,KAAK,EACV,8BAA8B,EAC9B,mCAAmC,EACpC,MAAM,0BAA0B,CAAC;AAClC,OAAO,KAAK,EAAE,kCAAkC,EAAE,MAAM,8BAA8B,CAAC;AACvF,OAAO,KAAK,EAAE,6BAA6B,EAAE,MAAM,kCAAkC,CAAC;AAEtF;;GAEG;AACH,MAAM,WAAW,yBAAyB;IACxC,QAAQ,CAAC,YAAY,CAAC,EAAE,uBAAuB,GAAG,SAAS,CAAC;IAC5D,QAAQ,CAAC,mBAAmB,CAAC,EACzB,SAAS,6BAA6B,EAAE,GACxC,SAAS,CAAC;CACf;AAED;;;;;;;;GAQG;AACH,MAAM,WAAW,oBAAoB;IACnC,QAAQ,CAAC,kBAAkB,CAAC,EACxB,CAAC,6BAA6B,GAAG,yBAAyB,CAAC,GAC3D,SAAS,CAAC;IACd,QAAQ,CAAC,mBAAmB,CAAC,EACzB,CAAC,8BAA8B,GAAG,yBAAyB,CAAC,GAC5D,SAAS,CAAC;IACd,QAAQ,CAAC,iCAAiC,CAAC,EACvC,CAAC,mCAAmC,GAAG,yBAAyB,CAAC,GACjE,SAAS,CAAC;IACd,QAAQ,CAAC,uBAAuB,CAAC,EAC7B,CAAC,kCAAkC,GAAG,yBAAyB,CAAC,GAChE,SAAS,CAAC;IACd,QAAQ,CAAC,YAAY,CAAC,EAClB;QAAE,QAAQ,CAAC,UAAU,CAAC,EAAE,SAAS,oBAAoB,EAAE,GAAG,SAAS,CAAA;KAAE,GACrE,SAAS,CAAC;IACd,QAAQ,CAAC,WAAW,CAAC,EACjB;QAAE,QAAQ,CAAC,UAAU,CAAC,EAAE,SAAS,oBAAoB,EAAE,GAAG,SAAS,CAAA;KAAE,GACrE,SAAS,CAAC;IACd,QAAQ,CAAC,YAAY,CAAC,EAClB;QAAE,QAAQ,CAAC,SAAS,CAAC,EAAE,oBAAoB,GAAG,SAAS,CAAA;KAAE,GACzD,SAAS,CAAC;IACd,QAAQ,CAAC,uBAAuB,CAAC,EAAE,OAAO,CAAC;IAC3C,QAAQ,CAAC,iBAAiB,CAAC,EAAE,OAAO,CAAC;IACrC,QAAQ,CAAC,iBAAiB,CAAC,EAAE,OAAO,CAAC;IACrC,QAAQ,CAAC,kBAAkB,CAAC,EAAE,OAAO,CAAC;IACtC,QAAQ,CAAC,kBAAkB,CAAC,EAAE,OAAO,CAAC;IACtC,QAAQ,CAAC,iBAAiB,CAAC,EAAE,OAAO,CAAC;IACrC,QAAQ,CAAC,mBAAmB,CAAC,EAAE,8BAA8B,GAAG,SAAS,CAAC;IAC1E,QAAQ,CAAC,yBAAyB,CAAC,EAC/B,oCAAoC,GACpC,SAAS,CAAC;IACd,QAAQ,CAAC,2BAA2B,CAAC,EAAE,OAAO,CAAC;CAChD"}
+{"version":3,"file":"sim-waf-statement.type.d.ts","sourceRoot":"","sources":["../../../../src/service/wafv2/statement/sim-waf-statement.type.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,oCAAoC,EAAE,MAAM,0CAA0C,CAAC;AACrG,OAAO,KAAK,EAAE,6BAA6B,EAAE,MAAM,yBAAyB,CAAC;AAC7E,OAAO,KAAK,EAAE,6BAA6B,EAAE,MAAM,8BAA8B,CAAC;AAClF,OAAO,KAAK,EAAE,8BAA8B,EAAE,MAAM,0BAA0B,CAAC;AAC/E,OAAO,KAAK,EAAE,uBAAuB,EAAE,MAAM,kCAAkC,CAAC;AAChF,OAAO,KAAK,EACV,8BAA8B,EAC9B,mCAAmC,EACpC,MAAM,0BAA0B,CAAC;AAClC,OAAO,KAAK,EAAE,kCAAkC,EAAE,MAAM,8BAA8B,CAAC;AACvF,OAAO,KAAK,EAAE,6BAA6B,EAAE,MAAM,kCAAkC,CAAC;AAEtF;;GAEG;AACH,MAAM,WAAW,yBAAyB;IACxC,QAAQ,CAAC,YAAY,CAAC,EAAE,uBAAuB,GAAG,SAAS,CAAC;IAC5D,QAAQ,CAAC,mBAAmB,CAAC,EACzB,SAAS,6BAA6B,EAAE,GACxC,SAAS,CAAC;CACf;AAED;;;;;;;;GAQG;AACH,MAAM,WAAW,oBAAoB;IACnC,QAAQ,CAAC,kBAAkB,CAAC,EACxB,CAAC,6BAA6B,GAAG,yBAAyB,CAAC,GAC3D,SAAS,CAAC;IACd,QAAQ,CAAC,mBAAmB,CAAC,EACzB,CAAC,8BAA8B,GAAG,yBAAyB,CAAC,GAC5D,SAAS,CAAC;IACd,QAAQ,CAAC,iCAAiC,CAAC,EACvC,CAAC,mCAAmC,GAAG,yBAAyB,CAAC,GACjE,SAAS,CAAC;IACd,QAAQ,CAAC,uBAAuB,CAAC,EAC7B,CAAC,kCAAkC,GAAG,yBAAyB,CAAC,GAChE,SAAS,CAAC;IACd,QAAQ,CAAC,YAAY,CAAC,EAClB;QAAE,QAAQ,CAAC,UAAU,CAAC,EAAE,SAAS,oBAAoB,EAAE,GAAG,SAAS,CAAA;KAAE,GACrE,SAAS,CAAC;IACd,QAAQ,CAAC,WAAW,CAAC,EACjB;QAAE,QAAQ,CAAC,UAAU,CAAC,EAAE,SAAS,oBAAoB,EAAE,GAAG,SAAS,CAAA;KAAE,GACrE,SAAS,CAAC;IACd,QAAQ,CAAC,YAAY,CAAC,EAClB;QAAE,QAAQ,CAAC,SAAS,CAAC,EAAE,oBAAoB,GAAG,SAAS,CAAA;KAAE,GACzD,SAAS,CAAC;IACd,QAAQ,CAAC,uBAAuB,CAAC,EAAE,OAAO,CAAC;IAC3C,QAAQ,CAAC,iBAAiB,CAAC,EAAE,OAAO,CAAC;IACrC,QAAQ,CAAC,iBAAiB,CAAC,EAAE,OAAO,CAAC;IACrC,QAAQ,CAAC,kBAAkB,CAAC,EAAE,6BAA6B,GAAG,SAAS,CAAC;IACxE,QAAQ,CAAC,kBAAkB,CAAC,EAAE,OAAO,CAAC;IACtC,QAAQ,CAAC,iBAAiB,CAAC,EAAE,OAAO,CAAC;IACrC,QAAQ,CAAC,mBAAmB,CAAC,EAAE,8BAA8B,GAAG,SAAS,CAAC;IAC1E,QAAQ,CAAC,yBAAyB,CAAC,EAC/B,oCAAoC,GACpC,SAAS,CAAC;IACd,QAAQ,CAAC,2BAA2B,CAAC,EAAE,OAAO,CAAC;CAChD"}

package/dist/service/wafv2/statement/sim-waf-unsimulated-rate-based.d.ts

@@ -0,0 +1,10 @@
+import type { SimWafRateBasedStatementInput } from "./sim-waf-rate-based.type.js";
+/**
+ * Refuse the parts of a rate-based statement this simulation cannot evaluate.
+ */
+export declare function refuseUnsimulatedSimWafRateMembers(statement: SimWafRateBasedStatementInput, ruleName: string): void;
+/**
+ * Refuse an aggregation key type this simulation cannot count by.
+ */
+export declare function refuseUnsimulatedSimWafRateKeyType(keyType: string | undefined, ruleName: string): void;
+//# sourceMappingURL=sim-waf-unsimulated-rate-based.d.ts.map

package/dist/service/wafv2/statement/sim-waf-unsimulated-rate-based.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"sim-waf-unsimulated-rate-based.d.ts","sourceRoot":"","sources":["../../../../src/service/wafv2/statement/sim-waf-unsimulated-rate-based.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,6BAA6B,EAAE,MAAM,8BAA8B,CAAC;AA2BlF;;GAEG;AACH,wBAAgB,kCAAkC,CAChD,SAAS,EAAE,6BAA6B,EACxC,QAAQ,EAAE,MAAM,GACf,IAAI,CAQN;AAED;;GAEG;AACH,wBAAgB,kCAAkC,CAChD,OAAO,EAAE,MAAM,GAAG,SAAS,EAC3B,QAAQ,EAAE,MAAM,GACf,IAAI,CAUN"}

package/dist/service/wafv2/statement/sim-waf-unsimulated-rate-based.js

@@ -0,0 +1,40 @@
+import { refuseSimWafRuleInput } from "./sim-waf-rule-refusals.js";
+const forwardedAddress = "it reads the address from a forwarding header, and needs the source " +
+    "address variety IPSetReferenceStatement is waiting on";
+const customAggregation = "aggregating on headers, cookies and query arguments is feasible and is " +
+    "not part of this";
+/**
+ * The aggregation key types real WAFv2 has and this simulation does not.
+ */
+const refusedKeyTypes = new Map([
+    ["FORWARDED_IP", forwardedAddress],
+    ["CUSTOM_KEYS", customAggregation],
+]);
+/**
+ * The rate-based members real WAFv2 takes and this simulation does not.
+ */
+const refusedMembers = new Map([
+    ["CustomKeys", customAggregation],
+    ["ForwardedIPConfig", forwardedAddress],
+]);
+/**
+ * Refuse the parts of a rate-based statement this simulation cannot evaluate.
+ */
+export function refuseUnsimulatedSimWafRateMembers(statement, ruleName) {
+    for (const [member, value] of Object.entries(statement)) {
+        const reason = refusedMembers.get(member);
+        if (reason !== undefined && value !== undefined) {
+            refuseSimWafRuleInput(ruleName, `RateBasedStatement ${member}`, reason);
+        }
+    }
+}
+/**
+ * Refuse an aggregation key type this simulation cannot count by.
+ */
+export function refuseUnsimulatedSimWafRateKeyType(keyType, ruleName) {
+    const reason = refusedKeyTypes.get(keyType ?? "");
+    if (reason !== undefined) {
+        refuseSimWafRuleInput(ruleName, `the aggregation key type ${keyType}`, reason);
+    }
+}
+//# sourceMappingURL=sim-waf-unsimulated-rate-based.js.map

package/dist/service/wafv2/statement/sim-waf-unsimulated-rate-based.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"sim-waf-unsimulated-rate-based.js","sourceRoot":"","sources":["../../../../src/service/wafv2/statement/sim-waf-unsimulated-rate-based.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,qBAAqB,EAAE,MAAM,4BAA4B,CAAC;AAEnE,MAAM,gBAAgB,GACpB,sEAAsE;IACtE,uDAAuD,CAAC;AAE1D,MAAM,iBAAiB,GACrB,yEAAyE;IACzE,kBAAkB,CAAC;AAErB;;GAEG;AACH,MAAM,eAAe,GAAG,IAAI,GAAG,CAAiB;IAC9C,CAAC,cAAc,EAAE,gBAAgB,CAAC;IAClC,CAAC,aAAa,EAAE,iBAAiB,CAAC;CACnC,CAAC,CAAC;AAEH;;GAEG;AACH,MAAM,cAAc,GAAG,IAAI,GAAG,CAAiB;IAC7C,CAAC,YAAY,EAAE,iBAAiB,CAAC;IACjC,CAAC,mBAAmB,EAAE,gBAAgB,CAAC;CACxC,CAAC,CAAC;AAEH;;GAEG;AACH,MAAM,UAAU,kCAAkC,CAChD,SAAwC,EACxC,QAAgB;IAEhB,KAAK,MAAM,CAAC,MAAM,EAAE,KAAK,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,SAAS,CAAC,EAAE,CAAC;QACxD,MAAM,MAAM,GAAG,cAAc,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;QAE1C,IAAI,MAAM,KAAK,SAAS,IAAI,KAAK,KAAK,SAAS,EAAE,CAAC;YAChD,qBAAqB,CAAC,QAAQ,EAAE,sBAAsB,MAAM,EAAE,EAAE,MAAM,CAAC,CAAC;QAC1E,CAAC;IACH,CAAC;AACH,CAAC;AAED;;GAEG;AACH,MAAM,UAAU,kCAAkC,CAChD,OAA2B,EAC3B,QAAgB;IAEhB,MAAM,MAAM,GAAG,eAAe,CAAC,GAAG,CAAC,OAAO,IAAI,EAAE,CAAC,CAAC;IAElD,IAAI,MAAM,KAAK,SAAS,EAAE,CAAC;QACzB,qBAAqB,CACnB,QAAQ,EACR,4BAA4B,OAAO,EAAE,EACrC,MAAM,CACP,CAAC;IACJ,CAAC;AACH,CAAC"}

package/dist/service/wafv2/statement/sim-waf-unsimulated-statement.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"sim-waf-unsimulated-statement.d.ts","sourceRoot":"","sources":["../../../../src/service/wafv2/statement/sim-waf-unsimulated-statement.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,oBAAoB,EAAE,MAAM,6BAA6B,CAAC;AAgCxE;;GAEG;AACH,wBAAgB,gCAAgC,CAC9C,SAAS,EAAE,oBAAoB,EAC/B,QAAQ,EAAE,MAAM,GACf,IAAI,CAQN"}
+{"version":3,"file":"sim-waf-unsimulated-statement.d.ts","sourceRoot":"","sources":["../../../../src/service/wafv2/statement/sim-waf-unsimulated-statement.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,oBAAoB,EAAE,MAAM,6BAA6B,CAAC;AA2BxE;;GAEG;AACH,wBAAgB,gCAAgC,CAC9C,SAAS,EAAE,oBAAoB,EAC/B,QAAQ,EAAE,MAAM,GACf,IAAI,CAQN"}