@kensio/yulin 1.21.23 → 1.21.24

package/dist/service/wafv2/resource/sim-waf-unsimulated-part.d.ts

@@ -0,0 +1,24 @@
+/**
+ * One part of a WAFv2 write this simulation holds and does not act on.
+ *
+ * A write carrying something Yulin does not simulate is accepted, and the read
+ * that follows returns it as written. What the simulation leaves out is
+ * reported here instead, so a test can find out how far the resource it wrote
+ * is from the one AWS would run.
+ */
+export interface SimWafUnsimulatedPart {
+    /**
+     * Where the part sits in what was written.
+     *
+     * A rule is `Rules.<rule name>`, a web ACL member is its own name, and a body
+     * inspection limit is `AssociationConfig.RequestBody.<resource type>`. These
+     * are the names a CloudFormation Resource records them under.
+     */
+    readonly part: string;
+    /** Why the simulation does not act on it. */
+    readonly reason: string;
+}
+/**
+ * What a resource's tags leave out, which is nothing when it has none.
+ */
+export declare function simWafTagsParts(tags: readonly unknown[]): readonly SimWafUnsimulatedPart[];

package/dist/service/wafv2/resource/sim-waf-unsimulated-part.js

@@ -0,0 +1,8 @@
+const tagsReason = "the tags are held and nothing reads them, since ListTagsForResource is " +
+    "not simulated";
+/**
+ * What a resource's tags leave out, which is nothing when it has none.
+ */
+export function simWafTagsParts(tags) {
+    return tags.length === 0 ? [] : [{ part: "Tags", reason: tagsReason }];
+}

package/dist/service/wafv2/sim-wafv2.d.ts

@@ -8,12 +8,11 @@ import type { SimWafIpSet } from "./ip-set/sim-waf-ip-set.js";
 import type { SimWafManagedRules } from "./managed/sim-waf-managed-rules.js";
 import type { SimWafRegexPatternSet } from "./regex-pattern-set/sim-waf-regex-pattern-set.js";
 import type { SimWafScope } from "./scope/sim-waf-scope.js";
+import type { SimWafUnsimulatedPart } from "./resource/sim-waf-unsimulated-part.js";
 import { type SimWafV2Properties } from "./sim-wafv2-commands.js";
 import { SimWafCfnResourceFactory } from "./cfn/sim-waf-cfn-resource-factory.js";
 import { SimWafSets } from "./sim-wafv2-sets.js";
 import type { SimWafWebAcl } from "./web-acl/sim-waf-web-acl.js";
-import { type SimWafUnevaluatableRule } from "./web-acl/sim-waf-unevaluatable-rules.js";
-import type { SimWafWebAclWriteInput } from "./command/web-acl/web-acl.command.js";
 export type { SimWafEvaluationRequest } from "./evaluate/sim-waf-evaluation-request.js";
 /**
  * Simulated AWS WAFv2. Handles SDK commands. Emulates AWS behaviour and state.
@@ -71,6 +70,13 @@ export declare class SimWafV2 extends SimWafSets {
      * compiled against, since a reference carries the ARN and nothing else.
      */
     findRegexPatternSetByArn(regexPatternSetArn: string): SimWafRegexPatternSet | undefined;
+    /**
+     * What a web ACL holds and this simulation does not act on, each part with
+     * its reason: a rule that claims no request (`Rules.<rule name>`), a member
+     * such as `CaptchaConfig`, a body inspection limit, the tags, and an
+     * association nothing is evaluated through (`Association.<resource ARN>`).
+     */
+    unsimulatedParts(webAclArn: string): readonly SimWafUnsimulatedPart[];
     /**
      * Evaluate one HTTP request against a web ACL's rules.
      *
@@ -89,16 +95,6 @@ export declare class SimWafV2 extends SimWafSets {
      * nothing here, and `rules()` reports what is covered of each.
      */
     managedRules(): SimWafManagedRules;
-    /**
-     * The rules of a web ACL input this simulation cannot evaluate.
-     *
-     * The simulator's own accessor rather than a WAFv2 operation. `CreateWebACL`
-     * refuses a web ACL carrying such a rule, because a web ACL that accepted
-     * one would allow a request AWS blocks. A template is deployed rule by rule
-     * instead, so the CloudFormation layer asks this first and leaves the rules
-     * it names out of the web ACL it writes.
-     */
-    unevaluatableWebAclRules(input: SimWafWebAclWriteInput): readonly SimWafUnevaluatableRule[];
     /**
      * Handle a CreateWebACL Command from the SDK.
      */
@@ -147,4 +143,8 @@ export declare class SimWafV2 extends SimWafSets {
      * Get this service's SDK Command router for SDK client interception.
      */
     sdkCommandRouter(): SimSdkCommandRouter;
+    /**
+     * Find a web ACL by its ARN, refusing one that is not here.
+     */
+    private requireWebAcl;
 }

package/dist/service/wafv2/sim-wafv2.fixture.d.ts

@@ -1,5 +1,6 @@
-import type { SimCreateWebAclCommandInput, SimWafSummaryOutput } from "./command/web-acl/web-acl.command.js";
+import type { SimCreateWebAclCommandInput, SimWafSummaryOutput, SimWafWebAclOutput } from "./command/web-acl/web-acl.command.js";
 import type { SimWafDecision } from "./evaluate/sim-waf-decision.js";
+import type { SimWafUnsimulatedPart } from "./resource/sim-waf-unsimulated-part.js";
 import type { SimWafStatementInput } from "./statement/sim-waf-statement.type.js";
 import type { SimWafRuleInput } from "./web-acl/sim-waf-rule.type.js";
 import type { SimWafV2 } from "./sim-wafv2.js";
@@ -47,3 +48,20 @@ export declare function simWafWebAclDecisions(simWaf: SimWafV2, rules: readonly
  * makes its requests with this.
  */
 export declare function simWafBrowserRequest(url: string, init?: RequestInit): Request;
+/**
+ * A web ACL as GetWebACL reads it back, what the simulation says it left out
+ * of it, and what it decided about an ordinary request.
+ */
+export interface SimWafHeld {
+    readonly webAcl: SimWafWebAclOutput;
+    readonly parts: readonly SimWafUnsimulatedPart[];
+    readonly blocked: boolean;
+}
+/**
+ * Create a web ACL, read it back, and put one request through it.
+ */
+export declare function simWafHeldWebAcl(simWaf: SimWafV2, webAcl: Partial<SimCreateWebAclCommandInput>): Promise<SimWafHeld>;
+/**
+ * The reason the simulation gives for leaving out one part.
+ */
+export declare function simWafUnsimulatedReason(parts: readonly SimWafUnsimulatedPart[], part: string): string;

package/dist/service/wafv2/sim-wafv2.fixture.js

@@ -60,3 +60,32 @@ export function simWafBrowserRequest(url, init = {}) {
     return new Request(url, { ...init, headers });
 }
 const browserUserAgent = "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36";
+/**
+ * Create a web ACL, read it back, and put one request through it.
+ */
+export async function simWafHeldWebAcl(simWaf, webAcl) {
+    const created = await createSimWafWebAcl(simWaf, {
+        ...simWafCreateWebAclFactory.make(),
+        ...webAcl,
+    });
+    const read = await simWaf.getWebAcl({
+        input: { Name: created.Name, Scope: "REGIONAL", Id: created.Id },
+    });
+    assertDefined(read.WebACL, "Simulated WAFv2 read back no web ACL");
+    return {
+        webAcl: read.WebACL,
+        parts: simWaf.unsimulatedParts(created.ARN),
+        blocked: simWaf.evaluateRequest({
+            webAclArn: created.ARN,
+            request: new Request("https://example.com/search"),
+        }).action === "BLOCK",
+    };
+}
+/**
+ * The reason the simulation gives for leaving out one part.
+ */
+export function simWafUnsimulatedReason(parts, part) {
+    const found = parts.find((candidate) => candidate.part === part);
+    assertDefined(found, `Simulated WAFv2 reported no unsimulated part ${part}`);
+    return found.reason;
+}

package/dist/service/wafv2/sim-wafv2.js

@@ -4,7 +4,6 @@ import { SimWafSdkCommandRouter } from "./sdk/sim-wafv2-sdk-command-router.js";
 import { SimWafCommands, } from "./sim-wafv2-commands.js";
 import { SimWafCfnResourceFactory } from "./cfn/sim-waf-cfn-resource-factory.js";
 import { SimWafSets } from "./sim-wafv2-sets.js";
-import { unevaluatableSimWafRules, } from "./web-acl/sim-waf-unevaluatable-rules.js";
 /**
  * Simulated AWS WAFv2. Handles SDK commands. Emulates AWS behaviour and state.
  *
@@ -74,6 +73,19 @@ export class SimWafV2 extends SimWafSets {
     findRegexPatternSetByArn(regexPatternSetArn) {
         return this.commands.regexPatternSets.findByArn(regexPatternSetArn);
     }
+    /**
+     * What a web ACL holds and this simulation does not act on, each part with
+     * its reason: a rule that claims no request (`Rules.<rule name>`), a member
+     * such as `CaptchaConfig`, a body inspection limit, the tags, and an
+     * association nothing is evaluated through (`Association.<resource ARN>`).
+     */
+    unsimulatedParts(webAclArn) {
+        const webAcl = this.requireWebAcl(webAclArn);
+        return [
+            ...webAcl.unsimulated,
+            ...this.commands.associations.unsimulatedFor(webAcl),
+        ];
+    }
     /**
      * Evaluate one HTTP request against a web ACL's rules.
      *
@@ -84,11 +96,7 @@ export class SimWafV2 extends SimWafSets {
      * front of.
      */
     evaluateRequest(evaluation) {
-        const webAcl = this.findWebAclByArn(evaluation.webAclArn);
-        if (webAcl === undefined) {
-            throw new SimWafNonexistentItemException(`AWS WAF couldn't perform the operation because your resource ` +
-                `doesn't exist: web ACL ${evaluation.webAclArn}.`);
-        }
+        const webAcl = this.requireWebAcl(evaluation.webAclArn);
         const limitBytes = webAcl.bodyInspectionLimitBytes(evaluation.resourceType);
         return webAcl.evaluate(simWafInspectedRequest(evaluation.request, evaluation.body, limitBytes));
     }
@@ -102,23 +110,6 @@ export class SimWafV2 extends SimWafSets {
     managedRules() {
         return this.commands.managedRules;
     }
-    /**
-     * The rules of a web ACL input this simulation cannot evaluate.
-     *
-     * The simulator's own accessor rather than a WAFv2 operation. `CreateWebACL`
-     * refuses a web ACL carrying such a rule, because a web ACL that accepted
-     * one would allow a request AWS blocks. A template is deployed rule by rule
-     * instead, so the CloudFormation layer asks this first and leaves the rules
-     * it names out of the web ACL it writes.
-     */
-    unevaluatableWebAclRules(input) {
-        return unevaluatableSimWafRules(input.Rules, {
-            regexPatternSets: this.commands.regexPatternSets,
-            managedRules: this.commands.managedRules,
-            clock: this.commands.background,
-            customResponseBodies: input.CustomResponseBodies ?? {},
-        });
-    }
     /**
      * Handle a CreateWebACL Command from the SDK.
      */
@@ -201,4 +192,15 @@ export class SimWafV2 extends SimWafSets {
     sdkCommandRouter() {
         return this.#sdkRouter;
     }
+    /**
+     * Find a web ACL by its ARN, refusing one that is not here.
+     */
+    requireWebAcl(webAclArn) {
+        const webAcl = this.findWebAclByArn(webAclArn);
+        if (webAcl === undefined) {
+            throw new SimWafNonexistentItemException(`AWS WAF couldn't perform the operation because your resource ` +
+                `doesn't exist: web ACL ${webAclArn}.`);
+        }
+        return webAcl;
+    }
 }

package/dist/service/wafv2/statement/sim-waf-field-to-match.type.d.ts

@@ -4,8 +4,8 @@ import type { SimWafMatchPatternInput } from "./sim-waf-match-pattern.js";
  * shape.
  *
  * The members Yulin does not simulate are declared here rather than left out,
- * so a rule that names one is refused by name instead of being read as a rule
- * with no field at all.
+ * so a rule that names one is held and reported by name instead of being read
+ * as a rule with no field at all.
  */
 export interface SimWafFieldToMatchInput {
     readonly UriPath?: unknown;

package/dist/service/wafv2/statement/sim-waf-rule-refusals.d.ts

@@ -1,10 +1,12 @@
 /**
- * Refuse something in a rule that real WAFv2 takes and this simulation does
+ * Stop compiling a rule at something real WAFv2 takes and this simulation does
  * not.
  *
- * Every refusal names the rule and what in it was refused, because a web ACL
- * is a list of rules that all look alike from the outside and the name is the
- * only thing that says which one to go and look at.
+ * `SimWafRule.compile` catches it and holds the rule unevaluated, with this
+ * message as the reason the web ACL reports. The message names the rule and
+ * what in it was left out, because a web ACL is a list of rules that all look
+ * alike from the outside and the name is the only thing that says which one to
+ * go and look at.
  */
 export declare function refuseSimWafRuleInput(ruleName: string, refused: string, reason: string): never;
 /**

package/dist/service/wafv2/statement/sim-waf-rule-refusals.js

@@ -1,16 +1,17 @@
 import { SimWafInvalidParameterException, SimWafUnsimulatedInputException, } from "../error/sim-wafv2.error.js";
 /**
- * Refuse something in a rule that real WAFv2 takes and this simulation does
+ * Stop compiling a rule at something real WAFv2 takes and this simulation does
  * not.
  *
- * Every refusal names the rule and what in it was refused, because a web ACL
- * is a list of rules that all look alike from the outside and the name is the
- * only thing that says which one to go and look at.
+ * `SimWafRule.compile` catches it and holds the rule unevaluated, with this
+ * message as the reason the web ACL reports. The message names the rule and
+ * what in it was left out, because a web ACL is a list of rules that all look
+ * alike from the outside and the name is the only thing that says which one to
+ * go and look at.
  */
 export function refuseSimWafRuleInput(ruleName, refused, reason) {
     throw new SimWafUnsimulatedInputException(`Rule ${ruleName} uses ${refused}, which Yulin does not simulate: ` +
-        `${reason}. A web ACL that accepted a rule it cannot evaluate would ` +
-        `allow a request AWS blocks.`);
+        `${reason}. The rule is held and claims no request.`);
 }
 /**
  * Refuse a rule real WAFv2 would refuse too.

package/dist/service/wafv2/statement/sim-waf-statement.d.ts

@@ -19,8 +19,8 @@ export interface SimWafStatementScope {
  * Turn one statement into the matcher a rule evaluates a request with.
  *
  * Compiling happens when the web ACL is written rather than when a request
- * arrives, which is what lets `CreateWebACL` refuse a statement kind it cannot
- * evaluate. It also means a rule does no parsing per request: what a request
- * meets is a closure over what the rule already worked out.
+ * arrives, which is where a statement kind Yulin cannot evaluate is found and
+ * its rule held unevaluated. It also means a rule does no parsing per request:
+ * what a request meets is a closure over what the rule already worked out.
  */
 export declare function compileSimWafStatement(statement: SimWafStatementInput | undefined, scope: SimWafStatementScope): SimWafMatcher;

package/dist/service/wafv2/statement/sim-waf-statement.js

@@ -11,9 +11,9 @@ import { refuseUnsimulatedSimWafStatement } from "./sim-waf-unsimulated-statemen
  * Turn one statement into the matcher a rule evaluates a request with.
  *
  * Compiling happens when the web ACL is written rather than when a request
- * arrives, which is what lets `CreateWebACL` refuse a statement kind it cannot
- * evaluate. It also means a rule does no parsing per request: what a request
- * meets is a closure over what the rule already worked out.
+ * arrives, which is where a statement kind Yulin cannot evaluate is found and
+ * its rule held unevaluated. It also means a rule does no parsing per request:
+ * what a request meets is a closure over what the rule already worked out.
  */
 export function compileSimWafStatement(statement, scope) {
     const { ruleName } = scope;

package/dist/service/wafv2/statement/sim-waf-statement.type.d.ts

@@ -16,9 +16,9 @@ export interface SimWafFieldStatementInput {
 /**
  * Minimal structural WAFv2 Statement.
  *
- * The kinds Yulin refuses are declared alongside the ones it evaluates, so a
- * rule that uses one is refused by name rather than read as a rule with no
- * statement in it.
+ * The kinds Yulin does not evaluate are declared alongside the ones it does,
+ * so a rule that uses one is held and reported by name rather than read as a
+ * rule with no statement in it.
  *
  * https://docs.aws.amazon.com/AWSJavaScriptSDK/v3/latest/client/wafv2/Interface/Statement/
  */

package/dist/service/wafv2/statement/sim-waf-unsimulated-statement.js

@@ -6,7 +6,7 @@ const undocumentedDetection = "AWS does not document the detection it runs, so a
     "agree with real WAF by coincidence or not at all";
 /**
  * The statement kinds real WAFv2 evaluates and this simulation does not, and
- * why each of them is refused rather than deferred.
+ * why a rule using one is held unevaluated.
  */
 const refusedStatements = new Map([
     ["IPSetReferenceStatement", oneClientAddress],

package/dist/service/wafv2/web-acl/sim-waf-association-config.d.ts

@@ -1,10 +1,11 @@
+import type { SimWafUnsimulatedPart } from "../resource/sim-waf-unsimulated-part.js";
 /**
  * A resource type whose body inspection limit a web ACL can set.
  *
  * Real WAF keys `AssociationConfig.RequestBody` by resource type, and these
- * three are the ones a web ACL goes in front of here. `APP_RUNNER_SERVICE` and
- * `VERIFIED_ACCESS_INSTANCE` are keys AWS takes for resources this simulation
- * has no association for.
+ * three are the ones a request reaches a web ACL through here. `APP_RUNNER_SERVICE`
+ * and `VERIFIED_ACCESS_INSTANCE` are keys AWS takes for resources a web ACL
+ * can be associated with and no simulated request passes through.
  */
 export type SimWafBodyInspectionResourceType = "CLOUDFRONT" | "API_GATEWAY" | "COGNITO_USER_POOL";
 /**
@@ -12,8 +13,8 @@ export type SimWafBodyInspectionResourceType = "CLOUDFRONT" | "API_GATEWAY" | "C
  * `AssociationConfig`.
  *
  * CloudFront, API Gateway and Cognito all default to 16 KB. A load balancer
- * and an AppSync API are fixed at 8 KB, and a web ACL cannot be put in front
- * of either one here.
+ * and an AppSync API are fixed at 8 KB, and no simulated request reaches a web
+ * ACL through either one.
  */
 export declare const simWafBodyInspectionLimitBytes = 16384;
 /**
@@ -40,9 +41,15 @@ export declare class SimWafBodyInspectionLimits {
     private constructor();
     /**
      * Read the limits an `AssociationConfig` sets, refusing anything WAF would
-     * refuse and anything this simulation cannot apply.
+     * refuse.
      */
     static read(input: SimWafAssociationConfigInput | undefined): SimWafBodyInspectionLimits;
+    /**
+     * The limits set for resource types no simulated request passes through.
+     *
+     * Each is checked as WAF checks it and held, and applies to nothing.
+     */
+    get unsimulated(): readonly SimWafUnsimulatedPart[];
     /**
      * How many bytes of a body a request reaching one resource type is inspected
      * for.
@@ -50,5 +57,5 @@ export declare class SimWafBodyInspectionLimits {
      * A request evaluated against a web ACL that no resource holds names no
      * resource type, and reads the default.
      */
-    bytesFor(resourceType: SimWafBodyInspectionResourceType | undefined): number;
+    bytesFor(resourceType: string | undefined): number;
 }

package/dist/service/wafv2/web-acl/sim-waf-association-config.js

@@ -1,11 +1,12 @@
-import { SimWafInvalidParameterException, SimWafUnsimulatedInputException, } from "../error/sim-wafv2.error.js";
+import { SimWafInvalidParameterException } from "../error/sim-wafv2.error.js";
+import { unsimulatedSimWafBodyLimits } from "./sim-waf-unsimulated-body-limit.js";
 /**
  * How much of a request body WAF reads for a resource type given no
  * `AssociationConfig`.
  *
  * CloudFront, API Gateway and Cognito all default to 16 KB. A load balancer
- * and an AppSync API are fixed at 8 KB, and a web ACL cannot be put in front
- * of either one here.
+ * and an AppSync API are fixed at 8 KB, and no simulated request reaches a web
+ * ACL through either one.
  */
 export const simWafBodyInspectionLimitBytes = 16_384;
 /**
@@ -17,11 +18,6 @@ const inspectionLimits = new Map([
     ["KB_48", 49_152],
     ["KB_64", 65_536],
 ]);
-const simulatedResourceTypes = [
-    "CLOUDFRONT",
-    "API_GATEWAY",
-    "COGNITO_USER_POOL",
-];
 /**
  * How much of a request body a web ACL's rules read, by resource type.
  *
@@ -36,15 +32,21 @@ export class SimWafBodyInspectionLimits {
     }
     /**
      * Read the limits an `AssociationConfig` sets, refusing anything WAF would
-     * refuse and anything this simulation cannot apply.
+     * refuse.
      */
     static read(input) {
-        const configured = Object.entries(input?.RequestBody ?? {});
-        const limits = new Map();
-        for (const [resourceType, config] of configured) {
-            limits.set(simulatedResourceType(resourceType), inspectionLimit(resourceType, config));
-        }
-        return new SimWafBodyInspectionLimits(limits);
+        return new SimWafBodyInspectionLimits(new Map(Object.entries(input?.RequestBody ?? {}).map(([resourceType, config]) => [
+            resourceType,
+            inspectionLimit(resourceType, config),
+        ])));
+    }
+    /**
+     * The limits set for resource types no simulated request passes through.
+     *
+     * Each is checked as WAF checks it and held, and applies to nothing.
+     */
+    get unsimulated() {
+        return unsimulatedSimWafBodyLimits(this.limits.keys());
     }
     /**
      * How many bytes of a body a request reaching one resource type is inspected
@@ -60,18 +62,6 @@ export class SimWafBodyInspectionLimits {
         return this.limits.get(resourceType) ?? simWafBodyInspectionLimitBytes;
     }
 }
-/**
- * Hold a `RequestBody` key to the resource types this simulation associates.
- */
-function simulatedResourceType(resourceType) {
-    const simulated = simulatedResourceTypes.find((candidate) => candidate === resourceType);
-    if (simulated === undefined) {
-        throw new SimWafUnsimulatedInputException(`AssociationConfig sets the body inspection limit for ${resourceType} ` +
-            `resources, and ${simulatedResourceTypes.join(" and ")} are the ` +
-            `types a web ACL goes in front of in Yulin`);
-    }
-    return simulated;
-}
 /**
  * Read one resource type's `DefaultSizeInspectionLimit`.
  *

package/dist/service/wafv2/web-acl/sim-waf-rule.d.ts

@@ -4,17 +4,29 @@ import type { SimWafRuleInput, SimWafRuleScope } from "./sim-waf-rule.type.js";
 /**
  * One rule of a web ACL, compiled so a request can be evaluated against it.
  *
- * The statement is turned into an evaluator when the web ACL is written, which
- * is what lets a rule Yulin cannot evaluate be refused at that point rather
- * than silently letting requests past later on.
+ * The statement is turned into an evaluator when the web ACL is written. A
+ * rule using something Yulin does not simulate is held all the same, as a
+ * rule that claims no request, and says why in `unsimulatedReason`. The web
+ * ACL reports it from there.
  */
 export declare class SimWafRule {
     #private;
     readonly name: string;
     readonly priority: number;
+    /**
+     * Why this rule claims no request, when it uses something Yulin does not
+     * simulate.
+     *
+     * AWS would evaluate it. A request it would have claimed goes on to the
+     * next rule here.
+     */
+    readonly unsimulatedReason: string | undefined;
     private constructor();
     /**
      * Compile one rule as it was written.
+     *
+     * Input WAFv2 itself would refuse is refused here too. A rule using
+     * something only Yulin leaves out compiles to one that claims nothing.
      */
     static compile(input: SimWafRuleInput, scope: SimWafRuleScope): SimWafRule;
     /**

package/dist/service/wafv2/web-acl/sim-waf-rule.js

@@ -1,16 +1,32 @@
+import { SimWafUnsimulatedInputException } from "../error/sim-wafv2.error.js";
 import { refuseUnsimulatedSimWafRuleInput, requiredSimWafRuleName, requiredSimWafRulePriority, } from "./sim-waf-rule-input.js";
 import { simWafRuleLabels } from "./sim-waf-rule-labels.js";
 import { compileSimWafRuleEvaluator } from "./sim-waf-rule-evaluator.js";
+/**
+ * What a rule held without being evaluated does with every request.
+ */
+function claimsNothing() {
+    // A held rule claims no request, so every request goes on to the next rule.
+}
 /**
  * One rule of a web ACL, compiled so a request can be evaluated against it.
  *
- * The statement is turned into an evaluator when the web ACL is written, which
- * is what lets a rule Yulin cannot evaluate be refused at that point rather
- * than silently letting requests past later on.
+ * The statement is turned into an evaluator when the web ACL is written. A
+ * rule using something Yulin does not simulate is held all the same, as a
+ * rule that claims no request, and says why in `unsimulatedReason`. The web
+ * ACL reports it from there.
  */
 export class SimWafRule {
     name;
     priority;
+    /**
+     * Why this rule claims no request, when it uses something Yulin does not
+     * simulate.
+     *
+     * AWS would evaluate it. A request it would have claimed goes on to the
+     * next rule here.
+     */
+    unsimulatedReason;
     #labels;
     #evaluate;
     constructor(properties) {
@@ -18,19 +34,39 @@ export class SimWafRule {
         this.priority = properties.priority;
         this.#labels = properties.labels;
         this.#evaluate = properties.evaluate;
+        this.unsimulatedReason = properties.unsimulatedReason;
     }
     /**
      * Compile one rule as it was written.
+     *
+     * Input WAFv2 itself would refuse is refused here too. A rule using
+     * something only Yulin leaves out compiles to one that claims nothing.
      */
     static compile(input, scope) {
         const name = requiredSimWafRuleName(input.Name);
-        refuseUnsimulatedSimWafRuleInput(input, name);
-        return new SimWafRule({
-            name,
-            priority: requiredSimWafRulePriority(input.Priority, name),
-            labels: simWafRuleLabels(input.RuleLabels, name),
-            evaluate: compileSimWafRuleEvaluator(input, name, scope),
-        });
+        const priority = requiredSimWafRulePriority(input.Priority, name);
+        const labels = simWafRuleLabels(input.RuleLabels, name);
+        try {
+            refuseUnsimulatedSimWafRuleInput(input, name);
+            return new SimWafRule({
+                name,
+                priority,
+                labels,
+                evaluate: compileSimWafRuleEvaluator(input, name, scope),
+            });
+        }
+        catch (error) {
+            if (!(error instanceof SimWafUnsimulatedInputException)) {
+                throw error;
+            }
+            return new SimWafRule({
+                name,
+                priority,
+                labels,
+                evaluate: claimsNothing,
+                unsimulatedReason: error.message,
+            });
+        }
     }
     /**
      * What this rule does with a request, which is nothing when it does not

package/dist/service/wafv2/web-acl/sim-waf-statement-capacity.d.ts

@@ -2,9 +2,9 @@ import type { SimWafStatementInput } from "../statement/sim-waf-statement.type.j
 /**
  * What the statements that inspect a request cost.
  *
- * Only the kinds this simulation evaluates are counted. Every other kind is
- * refused where the rule is written, so a web ACL that has rules to add up
- * cannot hold one. Doubling the base cost for a JSON body never applies here
- * for the same reason.
+ * Only the kinds this simulation evaluates are counted. A rule using any
+ * other kind is held unevaluated and contributes nothing, so a web ACL holding
+ * one reports less than AWS would charge. Doubling the base cost for a JSON
+ * body never applies here for the same reason.
  */
 export declare function simWafMatchCapacity(statement: SimWafStatementInput): number;

package/dist/service/wafv2/web-acl/sim-waf-statement-capacity.js

@@ -19,10 +19,10 @@ const textTransformationCost = 10;
 /**
  * What the statements that inspect a request cost.
  *
- * Only the kinds this simulation evaluates are counted. Every other kind is
- * refused where the rule is written, so a web ACL that has rules to add up
- * cannot hold one. Doubling the base cost for a JSON body never applies here
- * for the same reason.
+ * Only the kinds this simulation evaluates are counted. A rule using any
+ * other kind is held unevaluated and contributes nothing, so a web ACL holding
+ * one reports less than AWS would charge. Doubling the base cost for a JSON
+ * body never applies here for the same reason.
  */
 export function simWafMatchCapacity(statement) {
     return (byteMatchCapacity(statement.ByteMatchStatement) +

package/dist/service/wafv2/web-acl/sim-waf-unsimulated-body-limit.d.ts

@@ -0,0 +1,6 @@
+import type { SimWafUnsimulatedPart } from "../resource/sim-waf-unsimulated-part.js";
+/**
+ * What the body inspection limits a web ACL sets leave out, one part per
+ * resource type no simulated request passes through.
+ */
+export declare function unsimulatedSimWafBodyLimits(resourceTypes: Iterable<string>): readonly SimWafUnsimulatedPart[];

package/dist/service/wafv2/web-acl/sim-waf-unsimulated-body-limit.js

@@ -0,0 +1,23 @@
+/**
+ * The resource types a simulated request reaches a web ACL through.
+ */
+const simulatedResourceTypes = new Set([
+    "CLOUDFRONT",
+    "API_GATEWAY",
+    "COGNITO_USER_POOL",
+]);
+/**
+ * What the body inspection limits a web ACL sets leave out, one part per
+ * resource type no simulated request passes through.
+ */
+export function unsimulatedSimWafBodyLimits(resourceTypes) {
+    return [...resourceTypes]
+        .filter((resourceType) => !simulatedResourceTypes.has(resourceType))
+        .map((resourceType) => ({
+        part: `AssociationConfig.RequestBody.${resourceType}`,
+        reason: `AssociationConfig sets the body inspection limit for ` +
+            `${resourceType} resources, and ` +
+            `${[...simulatedResourceTypes].join(" and ")} are the types a ` +
+            `simulated request reaches a web ACL through`,
+    }));
+}