@kensio/yulin 1.21.23 → 1.21.24

package/dist/service/wafv2/command/association/sim-wafv2-association-commands.js

@@ -1,6 +1,6 @@
 import { requiredSimWafArn } from "../sim-wafv2-input.js";
 import { simWafWebAclOutput } from "../web-acl/sim-waf-web-acl-output.js";
-import { simWafListedResourceType } from "./sim-wafv2-association-input.js";
+import { refuseSimWafAccountTakeoverForUserPool, simWafListedResourceType, } from "./sim-wafv2-association-input.js";
 /**
  * The commands that put a web ACL in front of a resource and take it away
  * again.
@@ -27,6 +27,7 @@ export class SimWafAssociationCommands {
         this.#access.authorizeWebAcl("wafv2:AssociateWebACL", webAclArn, options?.caller);
         const webAcl = this.#access.webAcl(webAclArn);
         this.#access.requireResource(resource);
+        refuseSimWafAccountTakeoverForUserPool(resource, webAcl);
         this.#associations.associate(resource, webAcl);
         return { $metadata: {} };
     }

package/dist/service/wafv2/command/association/sim-wafv2-association-input.d.ts

@@ -1,5 +1,6 @@
 import type { SimAwsAccountRegionScope } from "../../../aws/sim-aws-account-region-scope.js";
 import { type SimWafProtectedResource, type SimWafProtectedResourceType } from "../../association/sim-waf-protected-resource.js";
+import type { SimWafWebAcl } from "../../web-acl/sim-waf-web-acl.js";
 /**
  * Read the resource an association named, and hold it to one Account and
  * Region.
@@ -11,7 +12,14 @@ import { type SimWafProtectedResource, type SimWafProtectedResourceType } from "
  */
 export declare function simWafAssociationResource(resourceArn: string | undefined, accountRegionScope: SimAwsAccountRegionScope): SimWafProtectedResource;
 /**
- * Read the resource type a listing named, refusing one this simulation does
- * not hold.
+ * Read the resource type a listing named, refusing one WAFv2 does not list.
  */
 export declare function simWafListedResourceType(resourceType: string | undefined): SimWafProtectedResourceType;
+/**
+ * Refuse a web ACL carrying the account takeover group in front of a user
+ * pool, as AWS does.
+ *
+ * AWS refuses the whole association over the one rule group. Yulin holds the
+ * group without evaluating it, and this is where the refusal lands.
+ */
+export declare function refuseSimWafAccountTakeoverForUserPool(resource: SimWafProtectedResource, webAcl: SimWafWebAcl): void;

package/dist/service/wafv2/command/association/sim-wafv2-association-input.js

@@ -1,12 +1,9 @@
 import { simWafProtectedResource, simWafProtectedResourceTypes, } from "../../association/sim-waf-protected-resource.js";
-import { SimWafInvalidParameterException, SimWafUnsimulatedInputException, } from "../../error/sim-wafv2.error.js";
+import { SimWafInvalidParameterException } from "../../error/sim-wafv2.error.js";
 import { requiredSimWafArn } from "../sim-wafv2-input.js";
 /**
- * What ListResourcesForWebACL lists when the request names no resource type.
- *
- * Real WAFv2 documents that default, and it is not one of the types simulated
- * here. A listing that names nothing is refused, because the empty list a load
- * balancer listing produces reads as a web ACL protecting nothing.
+ * What ListResourcesForWebACL lists when the request names no resource type,
+ * as real WAFv2 documents it.
  */
 const defaultResourceType = "APPLICATION_LOAD_BALANCER";
 /**
@@ -32,21 +29,36 @@ export function simWafAssociationResource(resourceArn, accountRegionScope) {
     return resource;
 }
 /**
- * Read the resource type a listing named, refusing one this simulation does
- * not hold.
+ * Read the resource type a listing named, refusing one WAFv2 does not list.
  */
 export function simWafListedResourceType(resourceType) {
     const listed = resourceType ?? defaultResourceType;
     const simulated = simWafProtectedResourceTypes.find((candidate) => candidate === listed);
     if (simulated === undefined) {
-        throw new SimWafUnsimulatedInputException(`AWS WAF lists ${listed} resources, and ` +
-            `${simWafProtectedResourceTypes.join(" and ")} are the types Yulin ` +
-            `simulates. ListResourcesForWebACL lists ${defaultResourceType} when ` +
-            `a request names no ResourceType, so name one of the simulated types ` +
-            `to list the resources a web ACL protects.`);
+        throw new SimWafInvalidParameterException(`Error reason: ListResourcesForWebACL lists one of ` +
+            `${simWafProtectedResourceTypes.join(", ")}, field: RESOURCE_TYPE, ` +
+            `parameter: ${listed}`);
     }
     return simulated;
 }
+const accountTakeoverGroup = "AWSManagedRulesATPRuleSet";
+/**
+ * Refuse a web ACL carrying the account takeover group in front of a user
+ * pool, as AWS does.
+ *
+ * AWS refuses the whole association over the one rule group. Yulin holds the
+ * group without evaluating it, and this is where the refusal lands.
+ */
+export function refuseSimWafAccountTakeoverForUserPool(resource, webAcl) {
+    if (resource.resourceType !== "COGNITO_USER_POOL") {
+        return;
+    }
+    const carriesGroup = (webAcl.configuration.rules ?? []).some((rule) => rule.Statement?.ManagedRuleGroupStatement?.Name === accountTakeoverGroup);
+    if (carriesGroup) {
+        throw refusedResourceArn(`A web ACL carrying ${accountTakeoverGroup} cannot protect a Cognito ` +
+            `user pool`, resource.arn);
+    }
+}
 /**
  * The refusal a bad resource ARN reports, in the form WAFv2 writes.
  */

package/dist/service/wafv2/command/ip-set/sim-wafv2-ip-set-commands.d.ts

@@ -12,9 +12,9 @@ interface SimWafIpSetCommandsProperties {
 /**
  * The commands that make, read, list and remove IP sets.
  *
- * The addresses are held and reported and nothing evaluates them, because
- * `IPSetReferenceStatement` is refused: every request in this simulation comes
- * from 127.0.0.1.
+ * The addresses are held and reported and nothing evaluates them. A rule
+ * naming one with `IPSetReferenceStatement` is held unevaluated, because every
+ * request in this simulation comes from 127.0.0.1.
  */
 export declare class SimWafIpSetCommands {
     #private;

package/dist/service/wafv2/command/ip-set/sim-wafv2-ip-set-commands.js

@@ -1,14 +1,14 @@
 import { SimWafIpSet, requiredSimWafIpAddressVersion, } from "../../ip-set/sim-waf-ip-set.js";
 import { requiredSimWafScope } from "../../scope/sim-waf-scope.js";
 import { SimWafPage } from "../sim-wafv2-page.js";
-import { checkedSimWafDescription, refuseSimWafTags, requiredSimWafName, } from "../sim-wafv2-input.js";
+import { checkedSimWafDescription, requiredSimWafName, } from "../sim-wafv2-input.js";
 import { requireSimWafResource } from "../sim-wafv2-resource-lookup.js";
 /**
  * The commands that make, read, list and remove IP sets.
  *
- * The addresses are held and reported and nothing evaluates them, because
- * `IPSetReferenceStatement` is refused: every request in this simulation comes
- * from 127.0.0.1.
+ * The addresses are held and reported and nothing evaluates them. A rule
+ * naming one with `IPSetReferenceStatement` is held unevaluated, because every
+ * request in this simulation comes from 127.0.0.1.
  */
 export class SimWafIpSetCommands {
     #ipSets;
@@ -24,12 +24,12 @@ export class SimWafIpSetCommands {
      */
     createIpSet(command, options) {
         const { input } = command;
-        refuseSimWafTags(input.Tags, "CreateIPSet");
         const ipSet = new SimWafIpSet({
             name: requiredSimWafName(input.Name),
             scope: requiredSimWafScope(input.Scope, this.#accountRegionScope.regionName),
             accountRegionScope: this.#accountRegionScope,
             description: checkedSimWafDescription(input.Description),
+            tags: input.Tags,
             ipAddressVersion: requiredSimWafIpAddressVersion(input.IPAddressVersion),
             addresses: input.Addresses ?? [],
         });

package/dist/service/wafv2/command/managed-rule-group/sim-wafv2-managed-rule-group-commands.js

@@ -30,11 +30,11 @@ export class SimWafManagedRuleGroupCommands {
             LabelNamespace: `${group.labelNamespace}:`,
             Rules: group.rules.map((rule) => ({
                 Name: rule.name,
-                Action: { Block: {} },
-            })),
-            AvailableLabels: group.rules.map((rule) => ({
-                Name: `${group.labelNamespace}:${rule.label}`,
+                Action: rule.counts === true ? { Count: {} } : { Block: {} },
             })),
+            AvailableLabels: group.rules
+                .flatMap((rule) => [rule.label, ...(rule.labels ?? [])])
+                .map((label) => ({ Name: `${group.labelNamespace}:${label}` })),
         };
     }
 }

package/dist/service/wafv2/command/regex-pattern-set/sim-wafv2-regex-pattern-set-commands.js

@@ -1,7 +1,7 @@
 import { SimWafRegexPatternSet } from "../../regex-pattern-set/sim-waf-regex-pattern-set.js";
 import { requiredSimWafScope } from "../../scope/sim-waf-scope.js";
 import { SimWafPage } from "../sim-wafv2-page.js";
-import { checkedSimWafDescription, refuseSimWafTags, requiredSimWafName, } from "../sim-wafv2-input.js";
+import { checkedSimWafDescription, requiredSimWafName, } from "../sim-wafv2-input.js";
 import { requireSimWafResource } from "../sim-wafv2-resource-lookup.js";
 /**
  * The commands that make, read, list and remove regex pattern sets.
@@ -24,12 +24,12 @@ export class SimWafRegexPatternSetCommands {
      */
     createRegexPatternSet(command, options) {
         const { input } = command;
-        refuseSimWafTags(input.Tags, "CreateRegexPatternSet");
         const patternSet = new SimWafRegexPatternSet({
             name: requiredSimWafName(input.Name),
             scope: requiredSimWafScope(input.Scope, this.#accountRegionScope.regionName),
             accountRegionScope: this.#accountRegionScope,
             description: checkedSimWafDescription(input.Description),
+            tags: input.Tags,
             regularExpressions: input.RegularExpressionList ?? [],
         });
         this.#authorizer.authorizeResource("wafv2:CreateRegexPatternSet", patternSet.arn, options?.caller);

package/dist/service/wafv2/command/sim-wafv2-input.d.ts

@@ -10,13 +10,6 @@ export declare function requiredSimWafName(name: string | undefined): string;
  * read, and so does this.
  */
 export declare function requiredSimWafId(id: string | undefined): string;
-/**
- * Refuse tags on a WAFv2 resource.
- *
- * Nothing here reads a tag, and a resource that reported tags it was never
- * asked about would be worse than one that says it does not carry them.
- */
-export declare function refuseSimWafTags(tags: readonly unknown[] | undefined, operation: string): void;
 /**
  * Read an ARN a request named, refusing a request with none.
  *

package/dist/service/wafv2/command/sim-wafv2-input.js

@@ -1,4 +1,4 @@
-import { SimWafInvalidParameterException, SimWafUnsimulatedInputException, SimWafValidationException, } from "../error/sim-wafv2.error.js";
+import { SimWafInvalidParameterException, SimWafValidationException, } from "../error/sim-wafv2.error.js";
 /**
  * Read the name a request named, refusing a request with none.
  */
@@ -22,18 +22,6 @@ export function requiredSimWafId(id) {
     }
     return id;
 }
-/**
- * Refuse tags on a WAFv2 resource.
- *
- * Nothing here reads a tag, and a resource that reported tags it was never
- * asked about would be worse than one that says it does not carry them.
- */
-export function refuseSimWafTags(tags, operation) {
-    if (tags !== undefined && tags.length > 0) {
-        throw new SimWafUnsimulatedInputException(`WAFv2 resource tags are not simulated, so ${operation} refuses them ` +
-            `rather than dropping them`);
-    }
-}
 /**
  * Read an ARN a request named, refusing a request with none.
  *

package/dist/service/wafv2/command/web-acl/sim-waf-web-acl-output.js

@@ -18,5 +18,6 @@ export function simWafWebAclOutput(webAcl) {
         VisibilityConfig: configuration.visibilityConfig,
         CustomResponseBodies: configuration.customResponseBodies,
         AssociationConfig: configuration.associationConfig,
+        ...configuration.heldMembers,
     };
 }

package/dist/service/wafv2/command/web-acl/sim-wafv2-unsimulated-web-acl-input.d.ts

@@ -1,18 +1,15 @@
+import type { SimWafUnsimulatedPart } from "../../resource/sim-waf-unsimulated-part.js";
 import type { SimWafWebAclWriteInput } from "./web-acl.command.js";
 /**
- * Why each web ACL member this simulation does not model is refused, by the
- * name a request and a template both write.
+ * The web ACL members a write carries that this simulation holds without
+ * acting on, keyed by member name.
  *
- * The refusal below and the CloudFormation layer read the same list. One
- * throws and the other records the member and deploys the web ACL without it,
- * and neither should be able to grow a reason the other has not got.
+ * Each of them changes what a web ACL does on real WAF. The web ACL keeps
+ * them, `GetWebACL` returns them as written, and `unsimulatedSimWafWebAclMembers`
+ * says which ones a request evaluated here goes without.
  */
-export declare const simWafUnsimulatedWebAclMembers: ReadonlyMap<string, string>;
+export declare function heldSimWafWebAclMembers(input: SimWafWebAclWriteInput): Readonly<Record<string, unknown>>;
 /**
- * Refuse the web ACL members this simulation does not model.
- *
- * Each of them changes what a web ACL does on real WAF, so accepting one and
- * dropping it would leave the web ACL looking configured to the request that
- * wrote it and unconfigured to every request it then evaluated.
+ * What a web ACL's held members leave out, one part per member.
  */
-export declare function refuseUnsimulatedSimWafWebAclInput(input: SimWafWebAclWriteInput, operation: string): void;
+export declare function unsimulatedSimWafWebAclMembers(members: Readonly<Record<string, unknown>>): readonly SimWafUnsimulatedPart[];

package/dist/service/wafv2/command/web-acl/sim-wafv2-unsimulated-web-acl-input.js

@@ -1,49 +1,48 @@
-import { SimWafUnsimulatedInputException } from "../../error/sim-wafv2.error.js";
-import { refuseSimWafTags } from "../sim-wafv2-input.js";
 const tokenActions = "the CAPTCHA and Challenge actions are answered by a browser, and nothing " +
     "in a test does that";
-const refusedMembers = [
-    [(input) => input.CaptchaConfig, "CaptchaConfig", tokenActions],
-    [(input) => input.ChallengeConfig, "ChallengeConfig", tokenActions],
-    [(input) => input.TokenDomains, "TokenDomains", tokenActions],
+/**
+ * Why each web ACL member this simulation does not model is held and not
+ * acted on, by the name a request and a template both write.
+ */
+const unsimulatedMembers = new Map([
+    ["CaptchaConfig", tokenActions],
+    ["ChallengeConfig", tokenActions],
+    ["TokenDomains", tokenActions],
     [
-        (input) => input.DataProtectionConfig,
         "DataProtectionConfig",
         "it decides what a request field looks like in logs, and web ACL logging " +
             "is not simulated",
     ],
     [
-        (input) => input.OnSourceDDoSProtectionConfig,
         "OnSourceDDoSProtectionConfig",
         "it responds to traffic volume, which a simulated request never has",
     ],
     [
-        (input) => input.ApplicationConfig,
         "ApplicationConfig",
         "it configures the WAF-hosted sign-in pages, which are not simulated",
     ],
-];
+]);
 /**
- * Why each web ACL member this simulation does not model is refused, by the
- * name a request and a template both write.
+ * The web ACL members a write carries that this simulation holds without
+ * acting on, keyed by member name.
  *
- * The refusal below and the CloudFormation layer read the same list. One
- * throws and the other records the member and deploys the web ACL without it,
- * and neither should be able to grow a reason the other has not got.
+ * Each of them changes what a web ACL does on real WAF. The web ACL keeps
+ * them, `GetWebACL` returns them as written, and `unsimulatedSimWafWebAclMembers`
+ * says which ones a request evaluated here goes without.
  */
-export const simWafUnsimulatedWebAclMembers = new Map(refusedMembers.map(([, member, reason]) => [member, reason]));
+export function heldSimWafWebAclMembers(input) {
+    return Object.fromEntries(Object.entries(input).filter(([member, value]) => unsimulatedMembers.has(member) && value !== undefined));
+}
 /**
- * Refuse the web ACL members this simulation does not model.
- *
- * Each of them changes what a web ACL does on real WAF, so accepting one and
- * dropping it would leave the web ACL looking configured to the request that
- * wrote it and unconfigured to every request it then evaluated.
+ * What a web ACL's held members leave out, one part per member.
  */
-export function refuseUnsimulatedSimWafWebAclInput(input, operation) {
-    refuseSimWafTags(input.Tags, operation);
-    for (const [read, member, reason] of refusedMembers) {
-        if (read(input) !== undefined) {
-            throw new SimWafUnsimulatedInputException(`${operation} refuses ${member}, which Yulin does not simulate: ${reason}`);
-        }
-    }
+export function unsimulatedSimWafWebAclMembers(members) {
+    return unsimulatedMembers
+        .entries()
+        .filter(([member]) => Object.hasOwn(members, member))
+        .map(([member, reason]) => ({
+        part: member,
+        reason: `${member} is not simulated: ${reason}`,
+    }))
+        .toArray();
 }

package/dist/service/wafv2/command/web-acl/sim-wafv2-web-acl-commands.d.ts

@@ -20,9 +20,9 @@ interface SimWafWebAclCommandsProperties {
 /**
  * The commands that make, read, list, change and remove web ACLs.
  *
- * Every rule is compiled where the web ACL is written, so a statement kind
- * this simulation cannot evaluate is refused by CreateWebACL and UpdateWebACL
- * rather than by the request that would have been let through.
+ * Every rule is compiled where the web ACL is written. A rule or member this
+ * simulation cannot act on is held as written, so `GetWebACL` returns it, and
+ * the web ACL reports it in `unsimulated`.
  */
 export declare class SimWafWebAclCommands {
     #private;

package/dist/service/wafv2/command/web-acl/sim-wafv2-web-acl-commands.js

@@ -4,14 +4,14 @@ import { SimWafWebAcl } from "../../web-acl/sim-waf-web-acl.js";
 import { SimWafPage } from "../sim-wafv2-page.js";
 import { checkedSimWafDescription, requiredSimWafName, } from "../sim-wafv2-input.js";
 import { requireSimWafResource, } from "../sim-wafv2-resource-lookup.js";
-import { refuseUnsimulatedSimWafWebAclInput } from "./sim-wafv2-unsimulated-web-acl-input.js";
+import { heldSimWafWebAclMembers } from "./sim-wafv2-unsimulated-web-acl-input.js";
 import { simWafWebAclOutput } from "./sim-waf-web-acl-output.js";
 /**
  * The commands that make, read, list, change and remove web ACLs.
  *
- * Every rule is compiled where the web ACL is written, so a statement kind
- * this simulation cannot evaluate is refused by CreateWebACL and UpdateWebACL
- * rather than by the request that would have been let through.
+ * Every rule is compiled where the web ACL is written. A rule or member this
+ * simulation cannot act on is held as written, so `GetWebACL` returns it, and
+ * the web ACL reports it in `unsimulated`.
  */
 export class SimWafWebAclCommands {
     #webAcls;
@@ -37,7 +37,6 @@ export class SimWafWebAclCommands {
         const { input } = command;
         const name = requiredSimWafName(input.Name);
         const scope = requiredSimWafScope(input.Scope, this.#accountRegionScope.regionName);
-        refuseUnsimulatedSimWafWebAclInput(input, "CreateWebACL");
         const configuration = configurationOf(input);
         const webAcl = new SimWafWebAcl({
             name,
@@ -45,6 +44,7 @@ export class SimWafWebAclCommands {
             accountRegionScope: this.#accountRegionScope,
             description: configuration.description,
             configuration,
+            tags: input.Tags,
             regexPatternSets: this.#regexPatternSets,
             managedRules: this.#managedRules,
             clock: this.#clock,
@@ -68,7 +68,6 @@ export class SimWafWebAclCommands {
      */
     updateWebAcl(command, options) {
         const { input } = command;
-        refuseUnsimulatedSimWafWebAclInput(input, "UpdateWebACL");
         const configuration = configurationOf(input);
         const webAcl = this.require(input, "wafv2:UpdateWebACL", options);
         webAcl.reconfigure(configuration, input.LockToken);
@@ -138,5 +137,6 @@ function configurationOf(input) {
         visibilityConfig: input.VisibilityConfig,
         description: checkedSimWafDescription(input.Description),
         associationConfig: input.AssociationConfig,
+        heldMembers: heldSimWafWebAclMembers(input),
     };
 }

package/dist/service/wafv2/command/web-acl/web-acl.command.d.ts

@@ -74,6 +74,12 @@ export interface SimWafWebAclOutput {
     readonly VisibilityConfig: unknown;
     readonly CustomResponseBodies: SimWafCustomResponseBodies | undefined;
     readonly AssociationConfig: SimWafAssociationConfigInput | undefined;
+    readonly CaptchaConfig?: unknown;
+    readonly ChallengeConfig?: unknown;
+    readonly TokenDomains?: readonly string[] | undefined;
+    readonly DataProtectionConfig?: unknown;
+    readonly OnSourceDDoSProtectionConfig?: unknown;
+    readonly ApplicationConfig?: unknown;
 }
 export interface SimGetWebAclCommandOutput {
     readonly WebACL?: SimWafWebAclOutput | undefined;

package/dist/service/wafv2/index.d.ts

@@ -11,6 +11,8 @@ export { SimWafNoProtection, type SimWafProtectedRequest, type SimWafProtection,
 export { SimWafInspected, SimWafRequestInspection, } from "./association/sim-waf-request-inspection.js";
 export { SimWafRestApiStage } from "./association/sim-waf-rest-api-stage.js";
 export { SimWafUserPool } from "./association/sim-waf-user-pool.js";
+export { SimWafUnsimulatedResource, type SimWafUnsimulatedResourceType, simWafUnsimulatedResourceTypes, } from "./association/sim-waf-unsimulated-resource.js";
+export type { SimWafUnsimulatedPart } from "./resource/sim-waf-unsimulated-part.js";
 export { SimWafResource, type SimWafResourceSummary, } from "./resource/sim-waf-resource.js";
 export { SimWafWebAcl } from "./web-acl/sim-waf-web-acl.js";
 export type { SimWafWebAclConfiguration } from "./web-acl/sim-waf-web-acl-configuration.js";
@@ -24,6 +26,7 @@ export { SimWafRegexPatternSet } from "./regex-pattern-set/sim-waf-regex-pattern
 export type { SimWafDecision } from "./evaluate/sim-waf-decision.js";
 export { SimWafRequestLabels } from "./evaluate/sim-waf-request-labels.js";
 export { SimWafManagedRules, type SimWafManagedMatchDeclaration, } from "./managed/sim-waf-managed-rules.js";
+export type { SimWafBotDeclaration } from "./managed/sim-waf-bot-declaration.js";
 export type { SimWafManagedRuleReport } from "./managed/sim-waf-managed-rule-report.js";
 export type { SimWafManagedRuleTier } from "./managed/sim-waf-managed-rule.type.js";
 export type { SimWafManagedRuleGroupStatementInput, SimWafOverrideActionInput, SimWafRuleActionOverrideInput, } from "./managed/sim-waf-managed-group.type.js";

package/dist/service/wafv2/index.js

@@ -9,6 +9,7 @@ export { SimWafNoProtection, } from "./association/sim-waf-protection.js";
 export { SimWafInspected, SimWafRequestInspection, } from "./association/sim-waf-request-inspection.js";
 export { SimWafRestApiStage } from "./association/sim-waf-rest-api-stage.js";
 export { SimWafUserPool } from "./association/sim-waf-user-pool.js";
+export { SimWafUnsimulatedResource, simWafUnsimulatedResourceTypes, } from "./association/sim-waf-unsimulated-resource.js";
 export { SimWafResource, } from "./resource/sim-waf-resource.js";
 export { SimWafWebAcl } from "./web-acl/sim-waf-web-acl.js";
 export { SimWafRule } from "./web-acl/sim-waf-rule.js";

package/dist/service/wafv2/managed/group/sim-waf-bot-control.d.ts

@@ -0,0 +1,27 @@
+import type { SimWafManagedRuleGroupDefinition } from "../sim-waf-managed-rule.type.js";
+/**
+ * The bot categories Bot Control's common level names, each with the rule
+ * that matches an unverified bot of that category.
+ *
+ * The category is spelled the way the `bot:category:` label spells it, and
+ * the rule name is `Category` and the category in Pascal case.
+ */
+export declare const simWafBotCategories: ReadonlyMap<string, string>;
+/**
+ * The one category whose rule matches a verified bot as well.
+ */
+export declare const simWafBotCategoryMatchingVerified = "ai";
+/**
+ * AWS WAF Bot Control at its common inspection level.
+ *
+ * The common level identifies a bot by what the request says about itself,
+ * and AWS publishes the rule names, the categories and the labels and none of
+ * the signatures. Verifying a bot reads the source address, which is
+ * `127.0.0.1` for every request here. So every rule is declared-only, and a
+ * test says which bot sent a request with `managedRules().onRequest` and a
+ * `bot` declaration.
+ *
+ * The targeted level is held without being evaluated. Its rules read tokens,
+ * browser signals and traffic across requests.
+ */
+export declare const simWafBotControlRuleSet: SimWafManagedRuleGroupDefinition;

package/dist/service/wafv2/managed/group/sim-waf-bot-control.js

@@ -0,0 +1,68 @@
+/**
+ * The bot categories Bot Control's common level names, each with the rule
+ * that matches an unverified bot of that category.
+ *
+ * The category is spelled the way the `bot:category:` label spells it, and
+ * the rule name is `Category` and the category in Pascal case.
+ */
+export const simWafBotCategories = new Map([
+    ["advertising", "CategoryAdvertising"],
+    ["archiver", "CategoryArchiver"],
+    ["content_fetcher", "CategoryContentFetcher"],
+    ["email_client", "CategoryEmailClient"],
+    ["http_library", "CategoryHttpLibrary"],
+    ["link_checker", "CategoryLinkChecker"],
+    ["miscellaneous", "CategoryMiscellaneous"],
+    ["monitoring", "CategoryMonitoring"],
+    ["page_preview", "CategoryPagePreview"],
+    ["scraping_framework", "CategoryScrapingFramework"],
+    ["search_engine", "CategorySearchEngine"],
+    ["security", "CategorySecurity"],
+    ["seo", "CategorySeo"],
+    ["social_media", "CategorySocialMedia"],
+    ["webhooks", "CategoryWebhooks"],
+    ["ai", "CategoryAI"],
+]);
+/**
+ * The one category whose rule matches a verified bot as well.
+ */
+export const simWafBotCategoryMatchingVerified = "ai";
+const signals = [
+    ["SignalAutomatedBrowser", "automated_browser"],
+    ["SignalKnownBotDataCenter", "known_bot_data_center"],
+    ["SignalNonBrowserUserAgent", "non_browser_user_agent"],
+];
+const categoryRules = simWafBotCategories
+    .entries()
+    .map(([category, name]) => ({
+    name,
+    label: name,
+    labels: [`bot:category:${category}`],
+    tier: "declared",
+}))
+    .toArray();
+const signalRules = signals.map(([name, signal]) => ({
+    name,
+    label: name,
+    labels: [`signal:${signal}`],
+    tier: "declared",
+}));
+/**
+ * AWS WAF Bot Control at its common inspection level.
+ *
+ * The common level identifies a bot by what the request says about itself,
+ * and AWS publishes the rule names, the categories and the labels and none of
+ * the signatures. Verifying a bot reads the source address, which is
+ * `127.0.0.1` for every request here. So every rule is declared-only, and a
+ * test says which bot sent a request with `managedRules().onRequest` and a
+ * `bot` declaration.
+ *
+ * The targeted level is held without being evaluated. Its rules read tokens,
+ * browser signals and traffic across requests.
+ */
+export const simWafBotControlRuleSet = {
+    name: "AWSManagedRulesBotControlRuleSet",
+    labelNamespace: "awswaf:managed:aws:bot-control",
+    capacity: 50,
+    rules: [...categoryRules, ...signalRules],
+};

package/dist/service/wafv2/managed/group/sim-waf-ip-reputation.d.ts

@@ -0,0 +1,18 @@
+import type { SimWafManagedRuleGroupDefinition } from "../sim-waf-managed-rule.type.js";
+/**
+ * The Amazon IP reputation list, which decides by the address a request came
+ * from.
+ *
+ * Every request in this simulation reports a source address of `127.0.0.1`,
+ * so every rule here is declared-only. A test says which requests come from a
+ * flagged address with `managedRules().onRequest`, and the group labels and
+ * acts on them as AWS documents.
+ */
+export declare const simWafIpReputationList: SimWafManagedRuleGroupDefinition;
+/**
+ * The anonymous IP list, for VPNs, proxies, Tor nodes and hosting providers.
+ *
+ * It decides by source address as the reputation list does, and every rule is
+ * declared-only for the same reason.
+ */
+export declare const simWafAnonymousIpList: SimWafManagedRuleGroupDefinition;

package/dist/service/wafv2/managed/group/sim-waf-ip-reputation.js

@@ -0,0 +1,51 @@
+/**
+ * The Amazon IP reputation list, which decides by the address a request came
+ * from.
+ *
+ * Every request in this simulation reports a source address of `127.0.0.1`,
+ * so every rule here is declared-only. A test says which requests come from a
+ * flagged address with `managedRules().onRequest`, and the group labels and
+ * acts on them as AWS documents.
+ */
+export const simWafIpReputationList = {
+    name: "AWSManagedRulesAmazonIpReputationList",
+    labelNamespace: "awswaf:managed:aws:amazon-ip-list",
+    capacity: 25,
+    rules: [
+        {
+            name: "AWSManagedIPReputationList",
+            label: "AWSManagedIPReputationList",
+            tier: "declared",
+        },
+        {
+            name: "AWSManagedReconnaissanceList",
+            label: "AWSManagedReconnaissanceList",
+            tier: "declared",
+        },
+        {
+            name: "AWSManagedIPDDoSList",
+            label: "AWSManagedIPDDoSList",
+            counts: true,
+            tier: "declared",
+        },
+    ],
+};
+/**
+ * The anonymous IP list, for VPNs, proxies, Tor nodes and hosting providers.
+ *
+ * It decides by source address as the reputation list does, and every rule is
+ * declared-only for the same reason.
+ */
+export const simWafAnonymousIpList = {
+    name: "AWSManagedRulesAnonymousIpList",
+    labelNamespace: "awswaf:managed:aws:anonymous-ip-list",
+    capacity: 50,
+    rules: [
+        { name: "AnonymousIPList", label: "AnonymousIPList", tier: "declared" },
+        {
+            name: "HostingProviderIPList",
+            label: "HostingProviderIPList",
+            tier: "declared",
+        },
+    ],
+};