@kensio/yulin 1.21.23 → 1.21.24

package/dist/service/wafv2/web-acl/sim-waf-web-acl-capacity.js

@@ -59,8 +59,8 @@ function nestedCapacity(statement) {
  *
  * A group is fixed at the capacity its owner gave it, and a scope-down
  * statement is charged on top. A group this simulation does not carry
- * contributes nothing, which cannot happen through a compiled web ACL: naming
- * one is refused where the rule is written.
+ * contributes nothing, so a web ACL holding one reports less than AWS would
+ * charge.
  */
 function managedGroupCapacity(statement) {
     const named = statement.ManagedRuleGroupStatement;

package/dist/service/wafv2/web-acl/sim-waf-web-acl-configuration.d.ts

@@ -13,6 +13,11 @@ export interface SimWafWebAclConfiguration {
     readonly visibilityConfig?: unknown;
     readonly description?: string | undefined;
     readonly associationConfig?: SimWafAssociationConfigInput | undefined;
+    /**
+     * The members held as written and not acted on, such as `CaptchaConfig`,
+     * keyed by the name the API gives them.
+     */
+    readonly heldMembers?: Readonly<Record<string, unknown>> | undefined;
 }
 /**
  * Read the action a request no rule claims is given.

package/dist/service/wafv2/web-acl/sim-waf-web-acl.d.ts

@@ -1,7 +1,7 @@
 import { type SimWafDecision } from "../evaluate/sim-waf-decision.js";
 import type { SimWafInspectedRequest } from "../evaluate/sim-waf-inspected-request.js";
 import { SimWafResource, type SimWafResourceProperties } from "../resource/sim-waf-resource.js";
-import { type SimWafBodyInspectionResourceType } from "./sim-waf-association-config.js";
+import type { SimWafUnsimulatedPart } from "../resource/sim-waf-unsimulated-part.js";
 import type { SimWafWebAclRuleScope } from "./sim-waf-rule.type.js";
 import { type SimWafWebAclConfiguration } from "./sim-waf-web-acl-configuration.js";
 interface SimWafWebAclProperties extends SimWafResourceProperties, SimWafWebAclRuleScope {
@@ -33,6 +33,14 @@ export declare class SimWafWebAcl extends SimWafResource {
      * What this web ACL's rules add up to in capacity units.
      */
     get capacity(): number;
+    /**
+     * What this web ACL was written with and the simulation does not act on.
+     *
+     * A rule listed here claims no request, a member is held and does nothing,
+     * and a body inspection limit applies to no request. `GetWebACL` returns
+     * every one of them as written.
+     */
+    get unsimulated(): readonly SimWafUnsimulatedPart[];
     /**
      * What this web ACL was last written with, as the API reports it.
      */
@@ -42,6 +50,7 @@ export declare class SimWafWebAcl extends SimWafResource {
      *
      * The rules are compiled before anything is replaced, so a web ACL that
      * refuses an update keeps the rules it had rather than being left with none.
+     * The tags stay as they were created, since UpdateWebACL takes none.
      */
     reconfigure(configuration: SimWafWebAclConfiguration, lockToken: string | undefined): void;
     /**
@@ -51,7 +60,7 @@ export declare class SimWafWebAcl extends SimWafResource {
      * `AssociationConfig` raises it per resource type, and a web ACL written
      * without one reads the 16 KB default everything it protects has.
      */
-    bodyInspectionLimitBytes(resourceType: SimWafBodyInspectionResourceType | undefined): number;
+    bodyInspectionLimitBytes(resourceType: string | undefined): number;
     /**
      * Decide what happens to one request.
      */

package/dist/service/wafv2/web-acl/sim-waf-web-acl.js

@@ -1,7 +1,8 @@
 import { simWafDecision, } from "../evaluate/sim-waf-decision.js";
 import { simWafEvaluateRules } from "../evaluate/sim-waf-evaluate-rules.js";
+import { unsimulatedSimWafWebAclMembers } from "../command/web-acl/sim-wafv2-unsimulated-web-acl-input.js";
 import { SimWafResource, } from "../resource/sim-waf-resource.js";
-import { SimWafBodyInspectionLimits, } from "./sim-waf-association-config.js";
+import { SimWafBodyInspectionLimits } from "./sim-waf-association-config.js";
 import { compileSimWafWebAclRules } from "./sim-waf-rules.js";
 import { simWafWebAclCapacity } from "./sim-waf-web-acl-capacity.js";
 import { readSimWafDefaultAction, } from "./sim-waf-web-acl-configuration.js";
@@ -49,6 +50,23 @@ export class SimWafWebAcl extends SimWafResource {
     get capacity() {
         return this.#capacity;
     }
+    /**
+     * What this web ACL was written with and the simulation does not act on.
+     *
+     * A rule listed here claims no request, a member is held and does nothing,
+     * and a body inspection limit applies to no request. `GetWebACL` returns
+     * every one of them as written.
+     */
+    get unsimulated() {
+        return [
+            ...this.#rules.flatMap(({ name, unsimulatedReason }) => unsimulatedReason === undefined
+                ? []
+                : [{ part: `Rules.${name}`, reason: unsimulatedReason }]),
+            ...unsimulatedSimWafWebAclMembers(this.#configuration.heldMembers ?? {}),
+            ...this.#bodyInspectionLimits.unsimulated,
+            ...super.unsimulated,
+        ];
+    }
     /**
      * What this web ACL was last written with, as the API reports it.
      */
@@ -60,6 +78,7 @@ export class SimWafWebAcl extends SimWafResource {
      *
      * The rules are compiled before anything is replaced, so a web ACL that
      * refuses an update keeps the rules it had rather than being left with none.
+     * The tags stay as they were created, since UpdateWebACL takes none.
      */
     reconfigure(configuration, lockToken) {
         const defaultAction = readSimWafDefaultAction(configuration);

package/docs/services/wafv2/README.md

@@ -302,13 +302,20 @@ both refused where the rule is written.
 
 ## The AWS managed rule groups
 
-Three of the AWS managed rule groups are simulated, so a stack that turns them on deploys and its
-traffic can be tested against them.
+Six of the AWS managed rule groups are simulated, so a stack that turns them on deploys and its
+traffic can be tested against them. The first three read the request.
 
 - `AWSManagedRulesCommonRuleSet`, the core rule set, 22 rules.
 - `AWSManagedRulesKnownBadInputsRuleSet`, 11 rules.
 - `AWSManagedRulesAdminProtectionRuleSet`, one rule.
 
+The other three read the caller, and a test declares what they find (see
+[Groups that read the caller](#groups-that-read-the-caller)).
+
+- `AWSManagedRulesAmazonIpReputationList`, three rules.
+- `AWSManagedRulesAnonymousIpList`, two rules.
+- `AWSManagedRulesBotControlRuleSet` at the common inspection level, 19 rules.
+
 A group evaluates its rules in the order AWS documents them, adds the documented
 `awswaf:managed:aws:*` label to a request a rule claims, and blocks by that rule's action. The
 labels are on the decision, and they are what says which rule inside a group claimed the request.
@@ -405,7 +412,8 @@ AWS rule it stands for, and `managedRules().rules()` reports the tier of every o
   `ExploitablePaths_URIPATH`, `AdminProtection_URIPATH`, `JavaDeserializationRCE_*` and
   `UserAgent_BadBots_HEADER`.
 - **declared** detects nothing at all. The four `CrossSiteScripting_*` rules run AWS's own
-  detection, and AWS documents none of it.
+  detection, and AWS documents none of it. Every rule of the IP reputation, anonymous IP and Bot
+  Control groups is declared too.
 
 The tiers under-detect against AWS and never over-detect. The usual reason to put WAF in a test is
 to find out whether an application's own traffic still gets through with the core rule set on. A
@@ -447,10 +455,125 @@ A match names the rule, in the spelling `RuleActionOverrides` and `DescribeManag
 (`CrossSiteScripting_QueryArguments`). A name no simulated group holds is refused where it was
 written.
 
-Anything outside the three groups is refused by name, and the refusal says which are simulated. The
-IP reputation and anonymous IP groups decide by caller address, and every request in this simulation
-comes from one client. Bot Control and the account takeover groups decide by behaviour across
-requests. The SQL injection group is undocumented in the way the cross-site scripting rules are.
+A rule naming any other group is held and claims no request (see [Held input](#held-input)), and
+the reason it gives says which groups are simulated. The account takeover and account creation
+groups, and Bot Control's targeted level, decide by behaviour across requests and by tokens a
+browser carries. The SQL injection group is undocumented in the way the cross-site scripting rules
+are.
+
+### Groups that read the caller
+
+The IP reputation, anonymous IP and Bot Control groups decide by who sent a request, and every
+request in this simulation comes from `127.0.0.1`. Each of their rules is declared-only. The group
+labels the request, takes the rule's documented action and honours overrides, as the groups that
+read the request do.
+
+`AWSManagedRulesAmazonIpReputationList` holds `AWSManagedIPReputationList` and
+`AWSManagedReconnaissanceList`, which block, and `AWSManagedIPDDoSList`, which counts as AWS ships
+it. `AWSManagedRulesAnonymousIpList` holds `AnonymousIPList` (VPNs, proxies and Tor) and
+`HostingProviderIPList` (hosting and cloud providers other than AWS), which both block. A test
+declares a match by rule name, as above, and says which requests come from a flagged address that
+way.
+
+Bot Control labels a request by the bot that sent it, and a verified bot is labelled and matches no
+rule. A test declares the bot.
+
+```typescript sim-wafv2-bot-control
+/**
+ * Counting with Bot Control and blocking unverified bots by label.
+ */
+
+import { CreateWebACLCommand } from "@aws-sdk/client-wafv2";
+
+import { SimAws } from "@kensio/yulin";
+
+const waf = new SimAws().wafV2();
+
+const visibility = {
+  SampledRequestsEnabled: false,
+  CloudWatchMetricsEnabled: false,
+  MetricName: "site",
+};
+
+const created = await waf.createWebAcl(
+  new CreateWebACLCommand({
+    Name: "site-acl",
+    Scope: "REGIONAL",
+    DefaultAction: { Allow: {} },
+    VisibilityConfig: visibility,
+    Rules: [
+      {
+        Name: "bot-control",
+        Priority: 0,
+        OverrideAction: { Count: {} },
+        Statement: {
+          ManagedRuleGroupStatement: {
+            VendorName: "AWS",
+            Name: "AWSManagedRulesBotControlRuleSet",
+            ManagedRuleGroupConfigs: [
+              {
+                AWSManagedRulesBotControlRuleSet: { InspectionLevel: "COMMON" },
+              },
+            ],
+          },
+        },
+        VisibilityConfig: visibility,
+      },
+      {
+        Name: "block-scrapers",
+        Priority: 1,
+        Action: { Block: {} },
+        Statement: {
+          LabelMatchStatement: {
+            Scope: "LABEL",
+            Key: "awswaf:managed:aws:bot-control:bot:category:scraping_framework",
+          },
+        },
+        VisibilityConfig: visibility,
+      },
+    ],
+  }),
+);
+
+waf.managedRules().onRequest("/search", {
+  bot: { category: "scraping_framework", name: "scrapy" },
+});
+waf.managedRules().onRequest("/", {
+  bot: { category: "search_engine", name: "googlebot", verified: true },
+});
+
+const webAclArn = created.Summary!.ARN;
+
+const scraper = waf.evaluateRequest({
+  webAclArn,
+  request: new Request("https://example.test/search"),
+});
+const crawler = waf.evaluateRequest({
+  webAclArn,
+  request: new Request("https://example.test/"),
+});
+
+// "BLOCK" "block-scrapers"
+console.log(scraper.action, scraper.terminatingRuleName);
+
+// "ALLOW" true
+console.log(
+  crawler.action,
+  crawler.labels.includes("awswaf:managed:aws:bot-control:bot:verified"),
+);
+```
+
+A `bot` declaration names the category in the spelling the `bot:category:` label uses
+(`search_engine`, `http_library`, `scraping_framework` and the rest), and optionally the bot's
+`name`, its `organization` and whether it is `verified`. An unverified bot matches its category's
+rule (`CategorySearchEngine` and so on), which blocks by default. A verified bot matches no rule,
+except a verified AI bot, which `CategoryAI` blocks as it does on AWS. Either way the group adds
+`bot:category:`, `bot:name:` and `bot:organization:` labels where the declaration gives them, and
+`bot:verified` or `bot:unverified`. The three `Signal*` rules are declared by rule name in
+`matches`, and add their `signal:` label beside their own.
+
+Bot Control runs at `COMMON` when `ManagedRuleGroupConfigs` names that level or when it is left out.
+A rule naming the `TARGETED` level is held (see [Held input](#held-input)).
 
 ## Labels
 
@@ -704,9 +827,8 @@ await srv.close();
 
 `DisassociateWebACL` takes the web ACL back off. `GetWebACLForResource` reports the web ACL one
 stage carries, and `ListResourcesForWebACL` reports the stages one web ACL protects. That listing
-takes a `ResourceType` of `API_GATEWAY`. Real WAFv2 lists `APPLICATION_LOAD_BALANCER` for a request
-that names no type. Load balancers are outside this simulation, and a listing that names no type is
-refused.
+takes a `ResourceType` of `API_GATEWAY`. A listing that names no type lists
+`APPLICATION_LOAD_BALANCER`, as real WAFv2 does.
 
 Deleting the stage or the whole API takes the association with it. A stage deployed again under the
 same name carries no web ACL. A web ACL that is still in front of a stage cannot be deleted, and
@@ -717,9 +839,14 @@ because a distribution takes its web ACL from the distribution and not from `Ass
 ACL from another Region or another Account is refused, as it is on AWS.
 
 An API Gateway HTTP API stage is refused. AWS WAF has no resource type for one, and an association
-accepted here would let a test cover protection AWS never applies. Application Load Balancer,
-AppSync, App Runner, Amplify and Verified Access resources are refused as unsimulated, each naming
-what it would have protected.
+accepted here would let a test cover protection AWS never applies.
+
+An Application Load Balancer, an AppSync API, an App Runner service and a Verified Access instance
+are associated, and `GetWebACLForResource` and `ListResourcesForWebACL` report them. Simulated
+requests reach a web ACL through a REST API stage or a user pool alone, so the association is held
+for reading back and listed by `unsimulatedParts` (see [Held input](#held-input)). Yulin takes the
+resource as named, without looking for it. An Amplify app is refused. AWS takes a `CLOUDFRONT` web ACL from `us-east-1`
+for one, and a simulated WAFv2 associates the web ACLs of its own Region only.
 
 ## Protecting a Cognito user pool
 
@@ -854,9 +981,10 @@ The web ACL and the pool belong to one Account and Region. A `CLOUDFRONT` scope
 because a distribution takes its web ACL from the distribution. A pool in another Account or another
 Region is refused as well.
 
-AWS also refuses a web ACL carrying `AWSManagedRulesATPRuleSet`, and it refuses the whole web ACL
-over the one rule group. Yulin turns that group away earlier, at `CreateWebACL`, along with every
-managed rule group outside the [three that are simulated](#the-aws-managed-rule-groups).
+AWS also refuses a web ACL carrying `AWSManagedRulesATPRuleSet`, and it refuses the whole
+association over the one rule group. `AssociateWebACL` refuses it here too. The web ACL itself is
+created, holding the group without evaluating it, like every managed rule group outside the
+[six that are simulated](#the-aws-managed-rule-groups).
 
 ### The request body is withheld at a hosted domain
 
@@ -967,7 +1095,7 @@ An update to a pattern set reaches the rules pointing at it. A reference resolve
 the rule is written and reads its expressions when a request arrives, as it does on AWS.
 
 IP sets are created, read, updated, listed and deleted the same way. No rule reads one, for the
-reason in [Refusals](#refusals) below.
+reason in [Held input](#held-input) below.
 
 ## Deploying web ACLs with CloudFormation
 
@@ -1040,29 +1168,26 @@ strings where the SDK takes a list of `RegexString` objects. Both are read here
 CloudFormation writes them.
 
 Every rule is compiled while the stack deploys. A rule this simulator will not evaluate (see
-[Refusals](#refusals)) is left out of the web ACL, and the web ACL deploys with the rules that are
-left. The rule that went missing is recorded on `stack.ignoredProperties`, under the logical ID that
-declared it, and the reason is the one `CreateWebACL` gives an SDK caller.
+[Held input](#held-input)) is held by the web ACL and claims no request. It
+is recorded on `stack.ignoredProperties`, under the logical ID that declared it, with the reason
+`unsimulatedParts` gives.
 
 ```typescript
-const [dropped] = stack.ignoredProperties;
+const [held] = stack.ignoredProperties;
 
 // "OrdersAcl Rules.block-countries"
-console.log(`${dropped.logicalId} ${dropped.path}`);
+console.log(`${held.logicalId} ${held.path}`);
 
 // "Rule block-countries uses the statement kind GeoMatchStatement, which
 //  Yulin does not simulate: ..."
-console.log(dropped.reason);
+console.log(held.reason);
 ```
 
-The web ACL is then real, and thinner than the one the template describes. Requests the dropped rule
-would have blocked are served by whatever the web ACL is in front of. That is the size of what a
-test loses, and `stack.ignoredProperties` is where to read it. An SDK caller writing the same rule
-is refused outright, because a request that was answered and then quietly emptied is a worse answer
-than a refusal.
+Requests the held rule would have blocked are served by whatever the web ACL is in front of. That
+is the size of what a test loses, and `stack.ignoredProperties` is where to read it.
 
 The same goes for a web ACL member with no behaviour behind it, such as `CaptchaConfig`. The web ACL
-deploys without it and the member is recorded.
+holds it and the member is recorded.
 
 A web ACL nothing coherent could be deployed from still fails the stack. A `Scope` outside
 `REGIONAL` and `CLOUDFRONT`, a `Rules` written as an object, a `Name` written as a number. The
@@ -1080,8 +1205,8 @@ cover where the tail comes from.
 covers an API Gateway REST API stage and a Cognito user pool. It goes through `AssociateWebACL` and
 inherits that command's answers. An ARN naming an HTTP API stage fails the deployment, because AWS
 WAF protects no HTTP API and neither does real CloudFormation. An ARN naming a load balancer or an
-AppSync API skips the association. AWS WAF protects both, and Yulin simulates a web ACL in front of
-neither.
+AppSync API is associated, and `ResourceArn` is recorded on `stack.ignoredProperties` as an
+association held for reading back. An ARN naming an Amplify app skips the association.
 
 An association naming a web ACL from outside this simulation is skipped too, which covers a template
 naming one from a real account and one whose web ACL is in another Region. The stage or the pool
@@ -1143,7 +1268,8 @@ composite primary identifier of name, ID and scope. An association's physical ID
 and the web ACL ARN joined by a pipe, and it publishes no attributes.
 
 `AWS::WAFv2::RuleGroup` and `AWS::WAFv2::LoggingConfiguration` are recorded as unsupported and
-stepped over. A rule naming a rule group is refused anyway, and there is no log here to write to.
+stepped over. A rule naming a rule group is held and not evaluated anyway, and there is no log here
+to write to.
 
 ## Scopes
 
@@ -1344,17 +1470,72 @@ const scoped = simSdk.simAws.accountRegionScope(
 console.log(scoped.wafV2().allWebAcls("REGIONAL")[0]?.name);
 ```
 
-## Refusals
+## Held input
+
+A write WAFv2 itself would accept succeeds, whatever it carries, and `GetWebACL` returns it as
+written. A rule using something outside the simulation is held, and it claims no request. `unsimulatedParts` lists each part the simulation leaves out, with the reason.
+
+```typescript sim-wafv2-unsimulated
+/**
+ * Writing a web ACL with a rule Yulin does not evaluate.
+ */
+
+import { CreateWebACLCommand } from "@aws-sdk/client-wafv2";
+
+import { SimAws } from "@kensio/yulin";
+
+const waf = new SimAws().wafV2();
+
+const visibility = {
+  SampledRequestsEnabled: false,
+  CloudWatchMetricsEnabled: false,
+  MetricName: "site",
+};
+
+const created = await waf.createWebAcl(
+  new CreateWebACLCommand({
+    Name: "site-acl",
+    Scope: "REGIONAL",
+    DefaultAction: { Allow: {} },
+    VisibilityConfig: visibility,
+    Rules: [
+      {
+        Name: "bot-control",
+        Priority: 0,
+        OverrideAction: { Count: {} },
+        Statement: {
+          ManagedRuleGroupStatement: {
+            VendorName: "AWS",
+            Name: "AWSManagedRulesBotControlRuleSet",
+            ManagedRuleGroupConfigs: [
+              {
+                AWSManagedRulesBotControlRuleSet: { InspectionLevel: "COMMON" },
+              },
+            ],
+          },
+        },
+        VisibilityConfig: visibility,
+      },
+    ],
+  }),
+);
 
-A rule Yulin cannot evaluate is refused by `CreateWebACL` and `UpdateWebACL`, naming the rule and
-what in it was refused. A web ACL that accepted such a rule would allow a request AWS blocks, and a
-silent hole in a security layer is worse than a missing one.
+const [part] = waf.unsimulatedParts(created.Summary!.ARN);
 
-A template carrying one of these keeps the caution and drops the blast radius. The rule is left out,
-the web ACL deploys with the rest of them, and the omission is recorded. See
-[Deploying web ACLs with CloudFormation](#deploying-web-acls-with-cloudformation).
+// "Rules.bot-control"
+console.log(part?.part);
+
+// "Rule bot-control uses the rule group member ManagedRuleGroupConfigs,
+//  which Yulin does not simulate: ..."
+console.log(part?.reason);
+```
 
-These statement kinds are refused:
+The rule keeps its `Action` or `OverrideAction` as written and never matches. That is what AWS does
+with a request the rule would not have claimed. A request it would have claimed goes on to the next
+rule. An allow list (a `NotStatement` around an `IPSetReferenceStatement`) is the sharpest case,
+where AWS blocks every address outside the list and the simulation blocks none.
+
+A rule is held for any of these statement kinds:
 
 - `IPSetReferenceStatement`, `GeoMatchStatement` and `AsnMatchStatement`. Every request in this
   simulation reports a source address of `127.0.0.1`, and a rule on where a request came from would
@@ -1362,23 +1543,34 @@ These statement kinds are refused:
 - `SqliMatchStatement` and `XssMatchStatement`. AWS publishes no description of the detection they
   run.
 - `RuleGroupReferenceStatement`. A rule group of your own is a resource in its own right, and none
-  is simulated. The three simulated AWS managed rule groups are named in a statement rather than
+  is simulated. The six simulated AWS managed rule groups are named in a statement rather than
   created.
+- `ManagedRuleGroupStatement` naming a group outside the six, or carrying `Version` or
+  `ExcludedRules`. `ManagedRuleGroupConfigs` holds the rule too, unless it runs Bot Control at
+  `COMMON`.
 
-A `RateBasedStatement` is evaluated (see [Rate limiting](#rate-limiting)). Two of its aggregation
-key types are refused. `FORWARDED_IP` and `ForwardedIPConfig` read the address from a forwarding
-header, which needs the source address variety an IP set is waiting on. `CUSTOM_KEYS` and
+A `RateBasedStatement` is evaluated (see [Rate limiting](#rate-limiting)). A rule using two of its
+aggregation key types is held. `FORWARDED_IP` and `ForwardedIPConfig` read the address from a
+forwarding header, which needs the source address variety an IP set is waiting on. `CUSTOM_KEYS` and
 `CustomKeys` aggregate on headers, cookies and query arguments, and are feasible and not part of
 this yet. `GetRateBasedStatementManagedKeys` is not simulated.
 
-`JsonBody`, `HeaderOrder`, `UriFragment`, `JA3Fingerprint` and `JA4Fingerprint` are refused as
-fields to match. The `Captcha` and `Challenge` actions are refused, along with the `CaptchaConfig`,
-`ChallengeConfig` and `TokenDomains` that configure them, because a browser has to answer them.
+A rule is held for the `JsonBody`, `HeaderOrder`, `UriFragment`, `JA3Fingerprint` and
+`JA4Fingerprint` fields to match, and for the `Captcha` and `Challenge` actions and the rule-level
+`CaptchaConfig` and `ChallengeConfig`, because a browser has to answer them.
+
+The web ACL holds these members as written, and they have no effect on a request. `CaptchaConfig`,
+`ChallengeConfig` and `TokenDomains` configure the browser-answered actions. `DataProtectionConfig` shapes web ACL
+logs, which Yulin leaves out. `OnSourceDDoSProtectionConfig` responds to
+traffic volume, and `ApplicationConfig` configures the WAF-hosted sign-in pages. An
+`AssociationConfig` limit for a resource type no simulated request passes through is held too.
+
+Tags on a web ACL, an IP set or a regex pattern set are held, and `unsimulatedParts` lists them.
+`ListTagsForResource` is the operation that would read them back, and Yulin leaves it out. Logging, sampled requests and CloudWatch metrics for a
+web ACL are not simulated.
 
-Tags, logging, sampled requests and CloudWatch metrics for a web ACL are not simulated.
-`DataProtectionConfig`, `OnSourceDDoSProtectionConfig` and `ApplicationConfig` are refused for the
-same reason, each naming what it would have configured. An `AssociationConfig` naming a resource
-type this simulation has no association for is refused too.
+`DescribeManagedRuleGroup` refuses a group outside the six, and a `VersionName`. Its only possible
+answer would be invented rules.
 
 ## Supported operations
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@kensio/yulin",
-  "version": "1.21.23",
+  "version": "1.21.24",
   "description": "AWS system behaviour simulation for isolated unit testing",
   "repository": "https://github.com/KensioSoftware/yulin",
   "homepage": "https://yulinsim.dev/",
@@ -299,7 +299,7 @@
     "hyparquet": "^1.29.2",
     "hyparquet-writer": "^0.16.9",
     "node-sql-parser": "^5.4.0",
-    "oxfmt": "^0.66.0",
+    "oxfmt": "^0.70.0",
     "oxlint": "^1.77.0",
     "oxlint-tsgolint": "^7.0.2001",
     "semantic-release": "25.0.9",

package/dist/service/wafv2/cfn/web-acl/sim-cfn-waf-evaluatable-rules.d.ts

@@ -1,15 +0,0 @@
-import type { SimCfnResource } from "../../../cloudformation/resource/sim-cfn-resource.js";
-import type { SimCreateWebAclCommandInput } from "../../command/web-acl/web-acl.command.js";
-import type { SimWafV2 } from "../../sim-wafv2.js";
-import type { SimWafRuleInput } from "../../web-acl/sim-waf-rule.type.js";
-/**
- * The rules of a template web ACL to deploy, which are the ones this
- * simulation can evaluate.
- *
- * Each rule left out is recorded on the Resource under its own name, because a
- * web ACL is a list of rules that all look alike from the outside and the name
- * is the only thing that says which one went missing. The reason is the one
- * `CreateWebACL` refuses the rule with, so a reader gets the same sentence
- * wherever they meet it.
- */
-export declare function simCfnWafEvaluatableRules(wafV2: SimWafV2, resource: SimCfnResource, input: SimCreateWebAclCommandInput): readonly SimWafRuleInput[] | undefined;

package/dist/service/wafv2/cfn/web-acl/sim-cfn-waf-evaluatable-rules.js

@@ -1,21 +0,0 @@
-/**
- * The rules of a template web ACL to deploy, which are the ones this
- * simulation can evaluate.
- *
- * Each rule left out is recorded on the Resource under its own name, because a
- * web ACL is a list of rules that all look alike from the outside and the name
- * is the only thing that says which one went missing. The reason is the one
- * `CreateWebACL` refuses the rule with, so a reader gets the same sentence
- * wherever they meet it.
- */
-export function simCfnWafEvaluatableRules(wafV2, resource, input) {
-    const unevaluatable = wafV2.unevaluatableWebAclRules(input);
-    if (unevaluatable.length === 0) {
-        return input.Rules;
-    }
-    const dropped = new Set(unevaluatable.map(({ index }) => index));
-    for (const rule of unevaluatable) {
-        resource.ignoreProperty(`Rules.${rule.name}`, rule.reason);
-    }
-    return input.Rules?.filter((_, index) => !dropped.has(index));
-}

package/dist/service/wafv2/web-acl/sim-waf-unevaluatable-rules.d.ts

@@ -1,25 +0,0 @@
-import type { SimWafRuleInput, SimWafRuleScope } from "./sim-waf-rule.type.js";
-/**
- * One rule of a web ACL this simulation cannot evaluate, and why.
- */
-export interface SimWafUnevaluatableRule {
-    /** Where the rule sits in the list the web ACL was written with. */
-    readonly index: number;
-    /** The rule's name, as the reason and a record of it name it. */
-    readonly name: string;
-    /** What `CreateWebACL` refuses the rule with. */
-    readonly reason: string;
-}
-/**
- * The rules of a web ACL this simulation cannot evaluate.
- *
- * Each rule is compiled on its own and the refusal is caught, so this answers
- * with exactly what `CreateWebACL` would refuse and nothing else. A rule the
- * simulation can evaluate is compiled twice, once here and once by the write
- * that follows, and compiling is a pure reading of the rule.
- *
- * Only a refusal saying the simulation does not go that far is collected. Rule
- * input WAFv2 itself will not take is left where it is, for the write to raise
- * as it always has.
- */
-export declare function unevaluatableSimWafRules(rules: readonly SimWafRuleInput[] | undefined, scope: SimWafRuleScope): readonly SimWafUnevaluatableRule[];

package/dist/service/wafv2/web-acl/sim-waf-unevaluatable-rules.js

@@ -1,33 +0,0 @@
-import { SimWafUnsimulatedInputException } from "../error/sim-wafv2.error.js";
-import { SimWafRule } from "./sim-waf-rule.js";
-/**
- * The rules of a web ACL this simulation cannot evaluate.
- *
- * Each rule is compiled on its own and the refusal is caught, so this answers
- * with exactly what `CreateWebACL` would refuse and nothing else. A rule the
- * simulation can evaluate is compiled twice, once here and once by the write
- * that follows, and compiling is a pure reading of the rule.
- *
- * Only a refusal saying the simulation does not go that far is collected. Rule
- * input WAFv2 itself will not take is left where it is, for the write to raise
- * as it always has.
- */
-export function unevaluatableSimWafRules(rules, scope) {
-    return (rules ?? []).flatMap((rule, index) => {
-        const reason = unevaluatableReason(rule, scope);
-        return reason === undefined
-            ? []
-            : [{ index, name: rule.Name ?? `at ${index}`, reason }];
-    });
-}
-function unevaluatableReason(rule, scope) {
-    try {
-        SimWafRule.compile(rule, scope);
-    }
-    catch (error) {
-        if (error instanceof SimWafUnsimulatedInputException) {
-            return error.message;
-        }
-    }
-    return undefined;
-}