@kensio/yulin 1.21.22 → 1.21.24

package/dist/service/wafv2/command/web-acl/sim-wafv2-unsimulated-web-acl-input.js

@@ -1,49 +1,48 @@
-import { SimWafUnsimulatedInputException } from "../../error/sim-wafv2.error.js";
-import { refuseSimWafTags } from "../sim-wafv2-input.js";
 const tokenActions = "the CAPTCHA and Challenge actions are answered by a browser, and nothing " +
     "in a test does that";
-const refusedMembers = [
-    [(input) => input.CaptchaConfig, "CaptchaConfig", tokenActions],
-    [(input) => input.ChallengeConfig, "ChallengeConfig", tokenActions],
-    [(input) => input.TokenDomains, "TokenDomains", tokenActions],
+/**
+ * Why each web ACL member this simulation does not model is held and not
+ * acted on, by the name a request and a template both write.
+ */
+const unsimulatedMembers = new Map([
+    ["CaptchaConfig", tokenActions],
+    ["ChallengeConfig", tokenActions],
+    ["TokenDomains", tokenActions],
     [
-        (input) => input.DataProtectionConfig,
         "DataProtectionConfig",
         "it decides what a request field looks like in logs, and web ACL logging " +
             "is not simulated",
     ],
     [
-        (input) => input.OnSourceDDoSProtectionConfig,
         "OnSourceDDoSProtectionConfig",
         "it responds to traffic volume, which a simulated request never has",
     ],
     [
-        (input) => input.ApplicationConfig,
         "ApplicationConfig",
         "it configures the WAF-hosted sign-in pages, which are not simulated",
     ],
-];
+]);
 /**
- * Why each web ACL member this simulation does not model is refused, by the
- * name a request and a template both write.
+ * The web ACL members a write carries that this simulation holds without
+ * acting on, keyed by member name.
  *
- * The refusal below and the CloudFormation layer read the same list. One
- * throws and the other records the member and deploys the web ACL without it,
- * and neither should be able to grow a reason the other has not got.
+ * Each of them changes what a web ACL does on real WAF. The web ACL keeps
+ * them, `GetWebACL` returns them as written, and `unsimulatedSimWafWebAclMembers`
+ * says which ones a request evaluated here goes without.
  */
-export const simWafUnsimulatedWebAclMembers = new Map(refusedMembers.map(([, member, reason]) => [member, reason]));
+export function heldSimWafWebAclMembers(input) {
+    return Object.fromEntries(Object.entries(input).filter(([member, value]) => unsimulatedMembers.has(member) && value !== undefined));
+}
 /**
- * Refuse the web ACL members this simulation does not model.
- *
- * Each of them changes what a web ACL does on real WAF, so accepting one and
- * dropping it would leave the web ACL looking configured to the request that
- * wrote it and unconfigured to every request it then evaluated.
+ * What a web ACL's held members leave out, one part per member.
  */
-export function refuseUnsimulatedSimWafWebAclInput(input, operation) {
-    refuseSimWafTags(input.Tags, operation);
-    for (const [read, member, reason] of refusedMembers) {
-        if (read(input) !== undefined) {
-            throw new SimWafUnsimulatedInputException(`${operation} refuses ${member}, which Yulin does not simulate: ${reason}`);
-        }
-    }
+export function unsimulatedSimWafWebAclMembers(members) {
+    return unsimulatedMembers
+        .entries()
+        .filter(([member]) => Object.hasOwn(members, member))
+        .map(([member, reason]) => ({
+        part: member,
+        reason: `${member} is not simulated: ${reason}`,
+    }))
+        .toArray();
 }

package/dist/service/wafv2/command/web-acl/sim-wafv2-web-acl-commands.d.ts

@@ -20,9 +20,9 @@ interface SimWafWebAclCommandsProperties {
 /**
  * The commands that make, read, list, change and remove web ACLs.
  *
- * Every rule is compiled where the web ACL is written, so a statement kind
- * this simulation cannot evaluate is refused by CreateWebACL and UpdateWebACL
- * rather than by the request that would have been let through.
+ * Every rule is compiled where the web ACL is written. A rule or member this
+ * simulation cannot act on is held as written, so `GetWebACL` returns it, and
+ * the web ACL reports it in `unsimulated`.
  */
 export declare class SimWafWebAclCommands {
     #private;

package/dist/service/wafv2/command/web-acl/sim-wafv2-web-acl-commands.js

@@ -4,14 +4,14 @@ import { SimWafWebAcl } from "../../web-acl/sim-waf-web-acl.js";
 import { SimWafPage } from "../sim-wafv2-page.js";
 import { checkedSimWafDescription, requiredSimWafName, } from "../sim-wafv2-input.js";
 import { requireSimWafResource, } from "../sim-wafv2-resource-lookup.js";
-import { refuseUnsimulatedSimWafWebAclInput } from "./sim-wafv2-unsimulated-web-acl-input.js";
+import { heldSimWafWebAclMembers } from "./sim-wafv2-unsimulated-web-acl-input.js";
 import { simWafWebAclOutput } from "./sim-waf-web-acl-output.js";
 /**
  * The commands that make, read, list, change and remove web ACLs.
  *
- * Every rule is compiled where the web ACL is written, so a statement kind
- * this simulation cannot evaluate is refused by CreateWebACL and UpdateWebACL
- * rather than by the request that would have been let through.
+ * Every rule is compiled where the web ACL is written. A rule or member this
+ * simulation cannot act on is held as written, so `GetWebACL` returns it, and
+ * the web ACL reports it in `unsimulated`.
  */
 export class SimWafWebAclCommands {
     #webAcls;
@@ -37,7 +37,6 @@ export class SimWafWebAclCommands {
         const { input } = command;
         const name = requiredSimWafName(input.Name);
         const scope = requiredSimWafScope(input.Scope, this.#accountRegionScope.regionName);
-        refuseUnsimulatedSimWafWebAclInput(input, "CreateWebACL");
         const configuration = configurationOf(input);
         const webAcl = new SimWafWebAcl({
             name,
@@ -45,6 +44,7 @@ export class SimWafWebAclCommands {
             accountRegionScope: this.#accountRegionScope,
             description: configuration.description,
             configuration,
+            tags: input.Tags,
             regexPatternSets: this.#regexPatternSets,
             managedRules: this.#managedRules,
             clock: this.#clock,
@@ -68,7 +68,6 @@ export class SimWafWebAclCommands {
      */
     updateWebAcl(command, options) {
         const { input } = command;
-        refuseUnsimulatedSimWafWebAclInput(input, "UpdateWebACL");
         const configuration = configurationOf(input);
         const webAcl = this.require(input, "wafv2:UpdateWebACL", options);
         webAcl.reconfigure(configuration, input.LockToken);
@@ -138,5 +137,6 @@ function configurationOf(input) {
         visibilityConfig: input.VisibilityConfig,
         description: checkedSimWafDescription(input.Description),
         associationConfig: input.AssociationConfig,
+        heldMembers: heldSimWafWebAclMembers(input),
     };
 }

package/dist/service/wafv2/command/web-acl/web-acl.command.d.ts

@@ -74,6 +74,12 @@ export interface SimWafWebAclOutput {
     readonly VisibilityConfig: unknown;
     readonly CustomResponseBodies: SimWafCustomResponseBodies | undefined;
     readonly AssociationConfig: SimWafAssociationConfigInput | undefined;
+    readonly CaptchaConfig?: unknown;
+    readonly ChallengeConfig?: unknown;
+    readonly TokenDomains?: readonly string[] | undefined;
+    readonly DataProtectionConfig?: unknown;
+    readonly OnSourceDDoSProtectionConfig?: unknown;
+    readonly ApplicationConfig?: unknown;
 }
 export interface SimGetWebAclCommandOutput {
     readonly WebACL?: SimWafWebAclOutput | undefined;

package/dist/service/wafv2/index.d.ts

@@ -11,6 +11,8 @@ export { SimWafNoProtection, type SimWafProtectedRequest, type SimWafProtection,
 export { SimWafInspected, SimWafRequestInspection, } from "./association/sim-waf-request-inspection.js";
 export { SimWafRestApiStage } from "./association/sim-waf-rest-api-stage.js";
 export { SimWafUserPool } from "./association/sim-waf-user-pool.js";
+export { SimWafUnsimulatedResource, type SimWafUnsimulatedResourceType, simWafUnsimulatedResourceTypes, } from "./association/sim-waf-unsimulated-resource.js";
+export type { SimWafUnsimulatedPart } from "./resource/sim-waf-unsimulated-part.js";
 export { SimWafResource, type SimWafResourceSummary, } from "./resource/sim-waf-resource.js";
 export { SimWafWebAcl } from "./web-acl/sim-waf-web-acl.js";
 export type { SimWafWebAclConfiguration } from "./web-acl/sim-waf-web-acl-configuration.js";
@@ -24,6 +26,7 @@ export { SimWafRegexPatternSet } from "./regex-pattern-set/sim-waf-regex-pattern
 export type { SimWafDecision } from "./evaluate/sim-waf-decision.js";
 export { SimWafRequestLabels } from "./evaluate/sim-waf-request-labels.js";
 export { SimWafManagedRules, type SimWafManagedMatchDeclaration, } from "./managed/sim-waf-managed-rules.js";
+export type { SimWafBotDeclaration } from "./managed/sim-waf-bot-declaration.js";
 export type { SimWafManagedRuleReport } from "./managed/sim-waf-managed-rule-report.js";
 export type { SimWafManagedRuleTier } from "./managed/sim-waf-managed-rule.type.js";
 export type { SimWafManagedRuleGroupStatementInput, SimWafOverrideActionInput, SimWafRuleActionOverrideInput, } from "./managed/sim-waf-managed-group.type.js";

package/dist/service/wafv2/index.js

@@ -9,6 +9,7 @@ export { SimWafNoProtection, } from "./association/sim-waf-protection.js";
 export { SimWafInspected, SimWafRequestInspection, } from "./association/sim-waf-request-inspection.js";
 export { SimWafRestApiStage } from "./association/sim-waf-rest-api-stage.js";
 export { SimWafUserPool } from "./association/sim-waf-user-pool.js";
+export { SimWafUnsimulatedResource, simWafUnsimulatedResourceTypes, } from "./association/sim-waf-unsimulated-resource.js";
 export { SimWafResource, } from "./resource/sim-waf-resource.js";
 export { SimWafWebAcl } from "./web-acl/sim-waf-web-acl.js";
 export { SimWafRule } from "./web-acl/sim-waf-rule.js";

package/dist/service/wafv2/managed/group/sim-waf-bot-control.d.ts

@@ -0,0 +1,27 @@
+import type { SimWafManagedRuleGroupDefinition } from "../sim-waf-managed-rule.type.js";
+/**
+ * The bot categories Bot Control's common level names, each with the rule
+ * that matches an unverified bot of that category.
+ *
+ * The category is spelled the way the `bot:category:` label spells it, and
+ * the rule name is `Category` and the category in Pascal case.
+ */
+export declare const simWafBotCategories: ReadonlyMap<string, string>;
+/**
+ * The one category whose rule matches a verified bot as well.
+ */
+export declare const simWafBotCategoryMatchingVerified = "ai";
+/**
+ * AWS WAF Bot Control at its common inspection level.
+ *
+ * The common level identifies a bot by what the request says about itself,
+ * and AWS publishes the rule names, the categories and the labels and none of
+ * the signatures. Verifying a bot reads the source address, which is
+ * `127.0.0.1` for every request here. So every rule is declared-only, and a
+ * test says which bot sent a request with `managedRules().onRequest` and a
+ * `bot` declaration.
+ *
+ * The targeted level is held without being evaluated. Its rules read tokens,
+ * browser signals and traffic across requests.
+ */
+export declare const simWafBotControlRuleSet: SimWafManagedRuleGroupDefinition;

package/dist/service/wafv2/managed/group/sim-waf-bot-control.js

@@ -0,0 +1,68 @@
+/**
+ * The bot categories Bot Control's common level names, each with the rule
+ * that matches an unverified bot of that category.
+ *
+ * The category is spelled the way the `bot:category:` label spells it, and
+ * the rule name is `Category` and the category in Pascal case.
+ */
+export const simWafBotCategories = new Map([
+    ["advertising", "CategoryAdvertising"],
+    ["archiver", "CategoryArchiver"],
+    ["content_fetcher", "CategoryContentFetcher"],
+    ["email_client", "CategoryEmailClient"],
+    ["http_library", "CategoryHttpLibrary"],
+    ["link_checker", "CategoryLinkChecker"],
+    ["miscellaneous", "CategoryMiscellaneous"],
+    ["monitoring", "CategoryMonitoring"],
+    ["page_preview", "CategoryPagePreview"],
+    ["scraping_framework", "CategoryScrapingFramework"],
+    ["search_engine", "CategorySearchEngine"],
+    ["security", "CategorySecurity"],
+    ["seo", "CategorySeo"],
+    ["social_media", "CategorySocialMedia"],
+    ["webhooks", "CategoryWebhooks"],
+    ["ai", "CategoryAI"],
+]);
+/**
+ * The one category whose rule matches a verified bot as well.
+ */
+export const simWafBotCategoryMatchingVerified = "ai";
+const signals = [
+    ["SignalAutomatedBrowser", "automated_browser"],
+    ["SignalKnownBotDataCenter", "known_bot_data_center"],
+    ["SignalNonBrowserUserAgent", "non_browser_user_agent"],
+];
+const categoryRules = simWafBotCategories
+    .entries()
+    .map(([category, name]) => ({
+    name,
+    label: name,
+    labels: [`bot:category:${category}`],
+    tier: "declared",
+}))
+    .toArray();
+const signalRules = signals.map(([name, signal]) => ({
+    name,
+    label: name,
+    labels: [`signal:${signal}`],
+    tier: "declared",
+}));
+/**
+ * AWS WAF Bot Control at its common inspection level.
+ *
+ * The common level identifies a bot by what the request says about itself,
+ * and AWS publishes the rule names, the categories and the labels and none of
+ * the signatures. Verifying a bot reads the source address, which is
+ * `127.0.0.1` for every request here. So every rule is declared-only, and a
+ * test says which bot sent a request with `managedRules().onRequest` and a
+ * `bot` declaration.
+ *
+ * The targeted level is held without being evaluated. Its rules read tokens,
+ * browser signals and traffic across requests.
+ */
+export const simWafBotControlRuleSet = {
+    name: "AWSManagedRulesBotControlRuleSet",
+    labelNamespace: "awswaf:managed:aws:bot-control",
+    capacity: 50,
+    rules: [...categoryRules, ...signalRules],
+};

package/dist/service/wafv2/managed/group/sim-waf-ip-reputation.d.ts

@@ -0,0 +1,18 @@
+import type { SimWafManagedRuleGroupDefinition } from "../sim-waf-managed-rule.type.js";
+/**
+ * The Amazon IP reputation list, which decides by the address a request came
+ * from.
+ *
+ * Every request in this simulation reports a source address of `127.0.0.1`,
+ * so every rule here is declared-only. A test says which requests come from a
+ * flagged address with `managedRules().onRequest`, and the group labels and
+ * acts on them as AWS documents.
+ */
+export declare const simWafIpReputationList: SimWafManagedRuleGroupDefinition;
+/**
+ * The anonymous IP list, for VPNs, proxies, Tor nodes and hosting providers.
+ *
+ * It decides by source address as the reputation list does, and every rule is
+ * declared-only for the same reason.
+ */
+export declare const simWafAnonymousIpList: SimWafManagedRuleGroupDefinition;

package/dist/service/wafv2/managed/group/sim-waf-ip-reputation.js

@@ -0,0 +1,51 @@
+/**
+ * The Amazon IP reputation list, which decides by the address a request came
+ * from.
+ *
+ * Every request in this simulation reports a source address of `127.0.0.1`,
+ * so every rule here is declared-only. A test says which requests come from a
+ * flagged address with `managedRules().onRequest`, and the group labels and
+ * acts on them as AWS documents.
+ */
+export const simWafIpReputationList = {
+    name: "AWSManagedRulesAmazonIpReputationList",
+    labelNamespace: "awswaf:managed:aws:amazon-ip-list",
+    capacity: 25,
+    rules: [
+        {
+            name: "AWSManagedIPReputationList",
+            label: "AWSManagedIPReputationList",
+            tier: "declared",
+        },
+        {
+            name: "AWSManagedReconnaissanceList",
+            label: "AWSManagedReconnaissanceList",
+            tier: "declared",
+        },
+        {
+            name: "AWSManagedIPDDoSList",
+            label: "AWSManagedIPDDoSList",
+            counts: true,
+            tier: "declared",
+        },
+    ],
+};
+/**
+ * The anonymous IP list, for VPNs, proxies, Tor nodes and hosting providers.
+ *
+ * It decides by source address as the reputation list does, and every rule is
+ * declared-only for the same reason.
+ */
+export const simWafAnonymousIpList = {
+    name: "AWSManagedRulesAnonymousIpList",
+    labelNamespace: "awswaf:managed:aws:anonymous-ip-list",
+    capacity: 50,
+    rules: [
+        { name: "AnonymousIPList", label: "AnonymousIPList", tier: "declared" },
+        {
+            name: "HostingProviderIPList",
+            label: "HostingProviderIPList",
+            tier: "declared",
+        },
+    ],
+};

package/dist/service/wafv2/managed/sim-waf-bot-declaration.d.ts

@@ -0,0 +1,35 @@
+/**
+ * The bot a test says sent a request, as Bot Control would identify it.
+ */
+export interface SimWafBotDeclaration {
+    /**
+     * The category, spelled as the `bot:category:` label spells it, such as
+     * `search_engine` or `http_library`.
+     */
+    readonly category: string;
+    /** The bot's name, as the `bot:name:` label spells it, such as `googlebot`. */
+    readonly name?: string | undefined;
+    /** The bot's publisher, as the `bot:organization:` label spells it. */
+    readonly organization?: string | undefined;
+    /**
+     * Whether Bot Control could verify the bot. A verified bot is labelled and
+     * left alone, and an unverified one matches its category's rule.
+     */
+    readonly verified?: boolean | undefined;
+}
+/**
+ * What one declared bot adds to a request: the rules that match it, and the
+ * labels the group adds whether or not a rule matches.
+ */
+export interface SimWafBotDeclared {
+    readonly matches: readonly string[];
+    readonly groupLabels: ReadonlyMap<string, readonly string[]>;
+}
+/**
+ * Read a declared bot into the rule it matches and the labels it carries.
+ *
+ * A verified bot matches no rule, `CategoryAI` aside, which AWS applies to
+ * verified bots too. Either way the group labels the bot's category, its name
+ * and publisher where the declaration gives them, and whether it was verified.
+ */
+export declare function simWafBotDeclared(bot: SimWafBotDeclaration): SimWafBotDeclared;

package/dist/service/wafv2/managed/sim-waf-bot-declaration.js

@@ -0,0 +1,42 @@
+import { SimWafDeclarationError } from "../error/sim-wafv2.error.js";
+import { simWafBotCategories, simWafBotCategoryMatchingVerified, simWafBotControlRuleSet, } from "./group/sim-waf-bot-control.js";
+/**
+ * Read a declared bot into the rule it matches and the labels it carries.
+ *
+ * A verified bot matches no rule, `CategoryAI` aside, which AWS applies to
+ * verified bots too. Either way the group labels the bot's category, its name
+ * and publisher where the declaration gives them, and whether it was verified.
+ */
+export function simWafBotDeclared(bot) {
+    const rule = requiredCategoryRule(bot.category);
+    const verified = bot.verified === true;
+    const matches = !verified || bot.category === simWafBotCategoryMatchingVerified;
+    return {
+        matches: matches ? [rule] : [],
+        groupLabels: new Map([
+            [
+                simWafBotControlRuleSet.name,
+                [
+                    `bot:category:${bot.category}`,
+                    ...optionalLabel("bot:name", bot.name),
+                    ...optionalLabel("bot:organization", bot.organization),
+                    verified ? "bot:verified" : "bot:unverified",
+                ],
+            ],
+        ]),
+    };
+}
+/**
+ * The rule for one category, refusing a category Bot Control does not name.
+ */
+function requiredCategoryRule(category) {
+    const rule = simWafBotCategories.get(category);
+    if (rule === undefined) {
+        throw new SimWafDeclarationError(`Bot Control names no bot category ${category}. The categories are ` +
+            `${simWafBotCategories.keys().toArray().join(", ")}.`);
+    }
+    return rule;
+}
+function optionalLabel(prefix, value) {
+    return value === undefined ? [] : [`${prefix}:${value}`];
+}

package/dist/service/wafv2/managed/sim-waf-managed-declaration.d.ts

@@ -0,0 +1,35 @@
+import { type SimWafBotDeclaration } from "./sim-waf-bot-declaration.js";
+/**
+ * The managed rules a test says claim a request.
+ */
+export interface SimWafManagedMatchDeclaration {
+    /** The rules that claim the request, by the name AWS gives them. */
+    readonly matches?: readonly string[] | undefined;
+    /**
+     * The bot that sent the request, for Bot Control to match and label as it
+     * would have identified it.
+     */
+    readonly bot?: SimWafBotDeclaration | undefined;
+}
+/**
+ * What a test declared about the requests to one URI path.
+ */
+export interface SimWafDeclared {
+    readonly matches: ReadonlySet<string>;
+    readonly groupLabels: ReadonlyMap<string, readonly string[]>;
+}
+/**
+ * What a request nothing was declared for carries.
+ */
+export declare const simWafNothingDeclared: SimWafDeclared;
+/**
+ * Read a declaration into the rules that match and the labels groups add.
+ *
+ * `ruleNamed` checks a rule name the declaration gives, and answers with the
+ * name the rule goes by.
+ */
+export declare function simWafReadDeclaration(declaration: SimWafManagedMatchDeclaration, ruleNamed: (name: string) => string): SimWafDeclared;
+/**
+ * The labels one group adds to a request whatever its rules decide.
+ */
+export declare function simWafDeclaredGroupLabels(declared: SimWafDeclared, groupName: string): readonly string[];

package/dist/service/wafv2/managed/sim-waf-managed-declaration.js

@@ -0,0 +1,30 @@
+import { simWafBotDeclared, } from "./sim-waf-bot-declaration.js";
+/**
+ * What a request nothing was declared for carries.
+ */
+export const simWafNothingDeclared = {
+    matches: new Set(),
+    groupLabels: new Map(),
+};
+/**
+ * Read a declaration into the rules that match and the labels groups add.
+ *
+ * `ruleNamed` checks a rule name the declaration gives, and answers with the
+ * name the rule goes by.
+ */
+export function simWafReadDeclaration(declaration, ruleNamed) {
+    const bot = declaration.bot === undefined
+        ? simWafNothingDeclared
+        : simWafBotDeclared(declaration.bot);
+    const named = (declaration.matches ?? []).map((name) => ruleNamed(name));
+    return {
+        matches: new Set([...named, ...bot.matches]),
+        groupLabels: bot.groupLabels,
+    };
+}
+/**
+ * The labels one group adds to a request whatever its rules decide.
+ */
+export function simWafDeclaredGroupLabels(declared, groupName) {
+    return declared.groupLabels.get(groupName) ?? [];
+}

package/dist/service/wafv2/managed/sim-waf-managed-group-configs.d.ts

@@ -0,0 +1,11 @@
+import type { SimWafManagedRuleGroupDefinition } from "./sim-waf-managed-rule.type.js";
+/**
+ * Stop compiling a rule whose group configuration this simulation does not
+ * evaluate, so the web ACL holds it unevaluated.
+ *
+ * Bot Control at `COMMON` is evaluated, with or without the configuration
+ * that names the level. `TARGETED` is held, since its rules read tokens,
+ * browser signals and traffic across requests. Every other configuration sets
+ * up the account takeover and account creation groups, which are held too.
+ */
+export declare function refuseUnsimulatedSimWafGroupConfigs(configs: readonly unknown[] | undefined, group: SimWafManagedRuleGroupDefinition, ruleName: string): void;

package/dist/service/wafv2/managed/sim-waf-managed-group-configs.js

@@ -0,0 +1,42 @@
+import { refuseSimWafRuleInput } from "../statement/sim-waf-rule-refusals.js";
+import { simWafBotControlRuleSet } from "./group/sim-waf-bot-control.js";
+/**
+ * Stop compiling a rule whose group configuration this simulation does not
+ * evaluate, so the web ACL holds it unevaluated.
+ *
+ * Bot Control at `COMMON` is evaluated, with or without the configuration
+ * that names the level. `TARGETED` is held, since its rules read tokens,
+ * browser signals and traffic across requests. Every other configuration sets
+ * up the account takeover and account creation groups, which are held too.
+ */
+export function refuseUnsimulatedSimWafGroupConfigs(configs, group, ruleName) {
+    const written = configs ?? [];
+    for (const config of written) {
+        const level = botControlLevel(config);
+        if (group !== simWafBotControlRuleSet || level === undefined) {
+            refuseSimWafRuleInput(ruleName, "the rule group member ManagedRuleGroupConfigs", "it configures the account takeover and account creation groups, " +
+                "and Bot Control's level, and an entry holding nothing but Bot " +
+                "Control at COMMON is the one configuration simulated");
+        }
+        if (level !== "COMMON") {
+            refuseSimWafRuleInput(ruleName, `Bot Control at the ${level} inspection level`, "the targeted rules read tokens, browser signals and traffic across " +
+                "requests, and COMMON is the level simulated");
+        }
+    }
+}
+/**
+ * The level one entry runs Bot Control at, when the entry is Bot Control's
+ * configuration and nothing else.
+ *
+ * Anything else answers with no level, so a malformed entry or one carrying
+ * another member beside Bot Control's is held rather than read as `COMMON`.
+ */
+function botControlLevel(config) {
+    const isBotControlAlone = typeof config === "object" &&
+        config !== null &&
+        Object.keys(config).join(",") === "AWSManagedRulesBotControlRuleSet";
+    return isBotControlAlone
+        ? config.AWSManagedRulesBotControlRuleSet
+            ?.InspectionLevel
+        : undefined;
+}

package/dist/service/wafv2/managed/sim-waf-managed-group-input.d.ts

@@ -1,12 +1,13 @@
 import type { SimWafManagedRuleGroupStatementInput, SimWafOverrideActionInput } from "./sim-waf-managed-group.type.js";
 import type { SimWafManagedRuleGroupDefinition } from "./sim-waf-managed-rule.type.js";
 /**
- * Find the simulated group a statement names, refusing any other.
+ * Find the simulated group a statement names, stopping the rule's compilation
+ * at any other so the web ACL holds it unevaluated.
  *
- * The refusal names the groups that are simulated, because the ones that are
+ * The reason names the groups that are simulated, because the ones that are
  * not are left out for reasons a reader cannot guess from the name: a group
- * that decides by caller address sees one client for the whole simulation, and
- * a group whose detection AWS does not describe cannot be reproduced at all.
+ * that decides by behaviour across requests has one request to look at, and a
+ * group whose detection AWS does not describe cannot be reproduced at all.
  */
 export declare function requiredSimWafManagedRuleGroup(statement: SimWafManagedRuleGroupStatementInput, ruleName: string): SimWafManagedRuleGroupDefinition;
 /**

package/dist/service/wafv2/managed/sim-waf-managed-group-input.js

@@ -1,5 +1,6 @@
 import { invalidSimWafRule, refuseSimWafRuleInput, } from "../statement/sim-waf-rule-refusals.js";
 import { findSimWafManagedRuleGroup, simWafManagedRuleGroupNames, } from "./sim-waf-managed-rule-groups.js";
+import { refuseUnsimulatedSimWafGroupConfigs } from "./sim-waf-managed-group-configs.js";
 /**
  * The rule group statement members real WAFv2 takes and this simulation does
  * not.
@@ -15,19 +16,15 @@ const refusedMembers = new Map([
         "AWS replaced it with RuleActionOverrides, which says which action a " +
             "named rule takes rather than only that it takes none",
     ],
-    [
-        "ManagedRuleGroupConfigs",
-        "it configures the Bot Control, account takeover and account creation " +
-            "groups, and none of those is simulated",
-    ],
 ]);
 /**
- * Find the simulated group a statement names, refusing any other.
+ * Find the simulated group a statement names, stopping the rule's compilation
+ * at any other so the web ACL holds it unevaluated.
  *
- * The refusal names the groups that are simulated, because the ones that are
+ * The reason names the groups that are simulated, because the ones that are
  * not are left out for reasons a reader cannot guess from the name: a group
- * that decides by caller address sees one client for the whole simulation, and
- * a group whose detection AWS does not describe cannot be reproduced at all.
+ * that decides by behaviour across requests has one request to look at, and a
+ * group whose detection AWS does not describe cannot be reproduced at all.
  */
 export function requiredSimWafManagedRuleGroup(statement, ruleName) {
     for (const [member, value] of Object.entries(statement)) {
@@ -42,6 +39,7 @@ export function requiredSimWafManagedRuleGroup(statement, ruleName) {
         const simulated = simWafManagedRuleGroupNames().join(", ");
         refuseSimWafRuleInput(ruleName, `the managed rule group ${named}`, `the simulated groups are ${simulated}`);
     }
+    refuseUnsimulatedSimWafGroupConfigs(statement.ManagedRuleGroupConfigs, group, ruleName);
     return group;
 }
 /**