@composurecdk/wafv2 0.0.0-stage → 0.13.0

package/dist/commonjs/association.js

@@ -0,0 +1,61 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.associate = associate;
+const aws_cdk_lib_1 = require("aws-cdk-lib");
+const aws_wafv2_1 = require("aws-cdk-lib/aws-wafv2");
+const constructs_1 = require("constructs");
+function isStage(target) {
+    return typeof target === "object" && "stageArn" in target;
+}
+/** 32-bit FNV-1a, as 8 hex digits. */
+function fnv1a(value) {
+    let hash = 0x811c9dc5;
+    for (let i = 0; i < value.length; i++) {
+        hash = Math.imul(hash ^ value.charCodeAt(i), 0x01000193) >>> 0;
+    }
+    return hash.toString(16).padStart(8, "0");
+}
+/**
+ * A construct id suffix that follows the target, not its position: an id that
+ * moved when another target was removed would replace the association, and
+ * CloudFormation deletes the old one last, disassociating the resource.
+ */
+function targetKey(scope, target) {
+    const identity = constructs_1.Construct.isConstruct(target)
+        ? target.node.path
+        : JSON.stringify(aws_cdk_lib_1.Stack.of(scope).resolve(target));
+    return fnv1a(identity);
+}
+/**
+ * Creates one `AWS::WAFv2::WebACLAssociation` per target, each depending on
+ * the one before it: AWS allows one `AssociateWebACL` call every two seconds
+ * per account and Region, so parallel associations throttle themselves.
+ *
+ * @internal
+ */
+function associate(scope, id, webAclArn, targets) {
+    const associations = [];
+    const seen = new Set();
+    for (const target of targets) {
+        const resourceArn = isStage(target) ? target.stageArn : target;
+        const key = targetKey(scope, target);
+        if (seen.has(key)) {
+            throw new Error(`WebAclBuilder "${id}": associateWith() was given the same resource twice.`);
+        }
+        seen.add(key);
+        const association = new aws_wafv2_1.CfnWebACLAssociation(scope, `${id}Association${key}`, {
+            webAclArn,
+            resourceArn,
+        });
+        // The ARN references the resource, which already orders the association
+        // after it; a construct is depended on explicitly in case it does not.
+        if (constructs_1.Construct.isConstruct(target))
+            association.node.addDependency(target);
+        const previous = associations.at(-1);
+        if (previous)
+            association.node.addDependency(previous);
+        associations.push(association);
+    }
+    return associations;
+}
+//# sourceMappingURL=association.js.map

package/dist/commonjs/association.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"association.js","sourceRoot":"","sources":["../../src/association.ts"],"names":[],"mappings":";;AAgDA,8BA2BC;AA3ED,6CAAoC;AAEpC,qDAA6F;AAC7F,2CAAwD;AAaxD,SAAS,OAAO,CAAC,MAA+B;IAC9C,OAAO,OAAO,MAAM,KAAK,QAAQ,IAAI,UAAU,IAAI,MAAM,CAAC;AAC5D,CAAC;AAED,sCAAsC;AACtC,SAAS,KAAK,CAAC,KAAa;IAC1B,IAAI,IAAI,GAAG,UAAU,CAAC;IACtB,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,KAAK,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;QACtC,IAAI,GAAG,IAAI,CAAC,IAAI,CAAC,IAAI,GAAG,KAAK,CAAC,UAAU,CAAC,CAAC,CAAC,EAAE,UAAU,CAAC,KAAK,CAAC,CAAC;IACjE,CAAC;IACD,OAAO,IAAI,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC;AAC5C,CAAC;AAED;;;;GAIG;AACH,SAAS,SAAS,CAAC,KAAiB,EAAE,MAA+B;IACnE,MAAM,QAAQ,GAAG,sBAAS,CAAC,WAAW,CAAC,MAAM,CAAC;QAC5C,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,IAAI;QAClB,CAAC,CAAC,IAAI,CAAC,SAAS,CAAC,mBAAK,CAAC,EAAE,CAAC,KAAK,CAAC,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC;IACpD,OAAO,KAAK,CAAC,QAAQ,CAAC,CAAC;AACzB,CAAC;AAED;;;;;;GAMG;AACH,SAAgB,SAAS,CACvB,KAAiB,EACjB,EAAU,EACV,SAAiB,EACjB,OAAkC;IAElC,MAAM,YAAY,GAA2B,EAAE,CAAC;IAChD,MAAM,IAAI,GAAG,IAAI,GAAG,EAAU,CAAC;IAC/B,KAAK,MAAM,MAAM,IAAI,OAAO,EAAE,CAAC;QAC7B,MAAM,WAAW,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC,CAAC,MAAM,CAAC;QAC/D,MAAM,GAAG,GAAG,SAAS,CAAC,KAAK,EAAE,MAAM,CAAC,CAAC;QACrC,IAAI,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC,EAAE,CAAC;YAClB,MAAM,IAAI,KAAK,CAAC,kBAAkB,EAAE,uDAAuD,CAAC,CAAC;QAC/F,CAAC;QACD,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;QACd,MAAM,WAAW,GAAG,IAAI,gCAAoB,CAAC,KAAK,EAAE,GAAG,EAAE,cAAc,GAAG,EAAE,EAAE;YAC5E,SAAS;YACT,WAAW;SACZ,CAAC,CAAC;QACH,wEAAwE;QACxE,uEAAuE;QACvE,IAAI,sBAAS,CAAC,WAAW,CAAC,MAAM,CAAC;YAAE,WAAW,CAAC,IAAI,CAAC,aAAa,CAAC,MAAM,CAAC,CAAC;QAC1E,MAAM,QAAQ,GAAG,YAAY,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC;QACrC,IAAI,QAAQ;YAAE,WAAW,CAAC,IAAI,CAAC,aAAa,CAAC,QAAQ,CAAC,CAAC;QACvD,YAAY,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC;IACjC,CAAC;IACD,OAAO,YAAY,CAAC;AACtB,CAAC"}

package/dist/commonjs/custom-response.d.ts

@@ -0,0 +1,52 @@
+import type { CfnWebACL } from "aws-cdk-lib/aws-wafv2";
+/**
+ * The body of a custom response. `json` is serialised with `JSON.stringify`
+ * unless it is already a string.
+ */
+export type CustomResponseBody = {
+    json: unknown;
+} | {
+    text: string;
+} | {
+    html: string;
+};
+/** A custom response for a Block action: status, optional body and headers. */
+export interface CustomResponse {
+    readonly status: number;
+    readonly body?: CustomResponseBody;
+    readonly headers?: Record<string, string>;
+}
+/**
+ * The status codes WAF accepts in a custom response. `410` is not among them,
+ * and `402` is reserved for the Monetize action.
+ *
+ * @see https://docs.aws.amazon.com/waf/latest/developerguide/customizing-the-response-status-codes.html
+ */
+export declare const SUPPORTED_CUSTOM_RESPONSE_STATUS_CODES: readonly number[];
+/**
+ * Collects the custom response bodies of a web ACL's default action and rules
+ * into the ACL-level `CustomResponseBodies` map CloudFormation requires.
+ * Identical bodies share one key; a body's key is derived from the first rule
+ * that uses it.
+ *
+ * @internal
+ */
+export declare class CustomResponseBodies {
+    #private;
+    constructor(owner: string);
+    /**
+     * Validates `response` and turns it into the `CustomResponse` CloudFormation
+     * expects, registering its body under a key derived from `keyHint`.
+     *
+     * @param who - Names the rule or default action in error messages.
+     */
+    register(who: string, keyHint: string, response: CustomResponse): CfnWebACL.CustomResponseProperty;
+    /**
+     * The Block action for a rule or default action, with `response` as its
+     * custom response when there is one.
+     */
+    block(who: string, keyHint: string, response?: CustomResponse): CfnWebACL.BlockActionProperty;
+    /** The map for `CfnWebACLProps.customResponseBodies`, or `undefined` when empty. */
+    toProperty(): Record<string, CfnWebACL.CustomResponseBodyProperty> | undefined;
+}
+//# sourceMappingURL=custom-response.d.ts.map

package/dist/commonjs/custom-response.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"custom-response.d.ts","sourceRoot":"","sources":["../../src/custom-response.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,uBAAuB,CAAC;AAEvD;;;GAGG;AACH,MAAM,MAAM,kBAAkB,GAAG;IAAE,IAAI,EAAE,OAAO,CAAA;CAAE,GAAG;IAAE,IAAI,EAAE,MAAM,CAAA;CAAE,GAAG;IAAE,IAAI,EAAE,MAAM,CAAA;CAAE,CAAC;AAEzF,+EAA+E;AAC/E,MAAM,WAAW,cAAc;IAC7B,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,QAAQ,CAAC,IAAI,CAAC,EAAE,kBAAkB,CAAC;IACnC,QAAQ,CAAC,OAAO,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;CAC3C;AAMD;;;;;GAKG;AACH,eAAO,MAAM,sCAAsC,EAAE,SAAS,MAAM,EAGnE,CAAC;AA2DF;;;;;;;GAOG;AACH,qBAAa,oBAAoB;;gBAMnB,KAAK,EAAE,MAAM;IAIzB;;;;;OAKG;IACH,QAAQ,CACN,GAAG,EAAE,MAAM,EACX,OAAO,EAAE,MAAM,EACf,QAAQ,EAAE,cAAc,GACvB,SAAS,CAAC,sBAAsB;IAgDnC;;;OAGG;IACH,KAAK,CAAC,GAAG,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,EAAE,QAAQ,CAAC,EAAE,cAAc,GAAG,SAAS,CAAC,mBAAmB;IAI7F,oFAAoF;IACpF,UAAU,IAAI,MAAM,CAAC,MAAM,EAAE,SAAS,CAAC,0BAA0B,CAAC,GAAG,SAAS;CAG/E"}

package/dist/commonjs/custom-response.js

@@ -0,0 +1,137 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.CustomResponseBodies = exports.SUPPORTED_CUSTOM_RESPONSE_STATUS_CODES = void 0;
+const aws_cdk_lib_1 = require("aws-cdk-lib");
+const SOURCE = "https://docs.aws.amazon.com/waf/latest/developerguide/customizing-the-response-status-codes.html";
+const QUOTAS = "https://docs.aws.amazon.com/waf/latest/developerguide/limits.html";
+/**
+ * The status codes WAF accepts in a custom response. `410` is not among them,
+ * and `402` is reserved for the Monetize action.
+ *
+ * @see https://docs.aws.amazon.com/waf/latest/developerguide/customizing-the-response-status-codes.html
+ */
+exports.SUPPORTED_CUSTOM_RESPONSE_STATUS_CODES = [
+    200, 201, 202, 204, 206, 300, 301, 302, 303, 304, 307, 308, 400, 401, 403, 404, 405, 408, 409,
+    411, 412, 413, 414, 415, 416, 421, 429, 500, 501, 502, 503, 504, 505,
+];
+const MAX_BODY_BYTES = 4 * 1024;
+const MAX_BODIES = 50;
+const MAX_TOTAL_BODY_BYTES = 50 * 1024;
+const MAX_HEADERS = 10;
+const HEADER_NAME = /^[a-zA-Z0-9._$-]{1,64}$/;
+const encoder = new TextEncoder();
+const byteLength = (s) => encoder.encode(s).length;
+function toBodyProperty(body) {
+    if ("json" in body) {
+        return {
+            contentType: "APPLICATION_JSON",
+            content: typeof body.json === "string" ? body.json : JSON.stringify(body.json),
+        };
+    }
+    if ("text" in body)
+        return { contentType: "TEXT_PLAIN", content: body.text };
+    return { contentType: "TEXT_HTML", content: body.html };
+}
+function validateStatus(owner, status) {
+    if (aws_cdk_lib_1.Token.isUnresolved(status))
+        return;
+    if (!exports.SUPPORTED_CUSTOM_RESPONSE_STATUS_CODES.includes(status)) {
+        throw new Error(`${owner}: AWS WAF does not support the custom response status code ${String(status)}. ` +
+            `Supported: ${exports.SUPPORTED_CUSTOM_RESPONSE_STATUS_CODES.join(", ")}. See ${SOURCE}.`);
+    }
+}
+function validateHeaders(owner, headers) {
+    const names = Object.keys(headers);
+    if (names.length > MAX_HEADERS) {
+        throw new Error(`${owner}: a custom response can set at most ${String(MAX_HEADERS)} headers, but ${String(names.length)} were given. See ${QUOTAS}.`);
+    }
+    const seen = new Set();
+    for (const name of names) {
+        if (!HEADER_NAME.test(name)) {
+            throw new Error(`${owner}: custom response header "${name}" is invalid. Names are 1–64 characters of letters, digits and ._$-. See ${SOURCE}.`);
+        }
+        const lower = name.toLowerCase();
+        if (lower === "content-type") {
+            throw new Error(`${owner}: a custom response cannot set content-type; WAF sets it from the body's type. Use { json }, { text } or { html } instead.`);
+        }
+        if (seen.has(lower)) {
+            throw new Error(`${owner}: custom response header "${name}" is set twice.`);
+        }
+        seen.add(lower);
+    }
+}
+/**
+ * Collects the custom response bodies of a web ACL's default action and rules
+ * into the ACL-level `CustomResponseBodies` map CloudFormation requires.
+ * Identical bodies share one key; a body's key is derived from the first rule
+ * that uses it.
+ *
+ * @internal
+ */
+class CustomResponseBodies {
+    #owner;
+    #bodies = {};
+    #keysByContent = new Map();
+    #totalBytes = 0;
+    constructor(owner) {
+        this.#owner = owner;
+    }
+    /**
+     * Validates `response` and turns it into the `CustomResponse` CloudFormation
+     * expects, registering its body under a key derived from `keyHint`.
+     *
+     * @param who - Names the rule or default action in error messages.
+     */
+    register(who, keyHint, response) {
+        const owner = `${this.#owner} ${who}`;
+        validateStatus(owner, response.status);
+        if (response.headers)
+            validateHeaders(owner, response.headers);
+        const responseHeaders = response.headers
+            ? Object.entries(response.headers).map(([name, value]) => ({ name, value }))
+            : undefined;
+        return {
+            responseCode: response.status,
+            ...(response.body && { customResponseBodyKey: this.#keyFor(owner, keyHint, response.body) }),
+            ...(responseHeaders && { responseHeaders }),
+        };
+    }
+    #keyFor(owner, keyHint, body) {
+        const property = toBodyProperty(body);
+        const identity = `${property.contentType}\n${property.content}`;
+        const existing = this.#keysByContent.get(identity);
+        if (existing !== undefined)
+            return existing;
+        const bytes = byteLength(property.content);
+        if (bytes > MAX_BODY_BYTES) {
+            throw new Error(`${owner}: the custom response body is ${String(bytes)} bytes; AWS WAF allows at most ${String(MAX_BODY_BYTES)}. See ${QUOTAS}.`);
+        }
+        if (this.#keysByContent.size >= MAX_BODIES) {
+            throw new Error(`${this.#owner}: a web ACL can hold at most ${String(MAX_BODIES)} distinct custom response bodies. See ${QUOTAS}.`);
+        }
+        this.#totalBytes += bytes;
+        if (this.#totalBytes > MAX_TOTAL_BODY_BYTES) {
+            throw new Error(`${this.#owner}: the custom response bodies total ${String(this.#totalBytes)} bytes; AWS WAF allows at most ${String(MAX_TOTAL_BODY_BYTES)} per web ACL. See ${QUOTAS}.`);
+        }
+        let key = keyHint;
+        // Keys share the 128-character limit of rule names, so leave room for a suffix.
+        for (let n = 2; key in this.#bodies; n++)
+            key = `${keyHint.slice(0, 120)}-${String(n)}`;
+        this.#bodies[key] = property;
+        this.#keysByContent.set(identity, key);
+        return key;
+    }
+    /**
+     * The Block action for a rule or default action, with `response` as its
+     * custom response when there is one.
+     */
+    block(who, keyHint, response) {
+        return response ? { customResponse: this.register(who, keyHint, response) } : {};
+    }
+    /** The map for `CfnWebACLProps.customResponseBodies`, or `undefined` when empty. */
+    toProperty() {
+        return this.#keysByContent.size > 0 ? this.#bodies : undefined;
+    }
+}
+exports.CustomResponseBodies = CustomResponseBodies;
+//# sourceMappingURL=custom-response.js.map

package/dist/commonjs/custom-response.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"custom-response.js","sourceRoot":"","sources":["../../src/custom-response.ts"],"names":[],"mappings":";;;AAAA,6CAAoC;AAgBpC,MAAM,MAAM,GACV,kGAAkG,CAAC;AACrG,MAAM,MAAM,GAAG,mEAAmE,CAAC;AAEnF;;;;;GAKG;AACU,QAAA,sCAAsC,GAAsB;IACvE,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG;IAC7F,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG;CACrE,CAAC;AAEF,MAAM,cAAc,GAAG,CAAC,GAAG,IAAI,CAAC;AAChC,MAAM,UAAU,GAAG,EAAE,CAAC;AACtB,MAAM,oBAAoB,GAAG,EAAE,GAAG,IAAI,CAAC;AACvC,MAAM,WAAW,GAAG,EAAE,CAAC;AACvB,MAAM,WAAW,GAAG,yBAAyB,CAAC;AAE9C,MAAM,OAAO,GAAG,IAAI,WAAW,EAAE,CAAC;AAClC,MAAM,UAAU,GAAG,CAAC,CAAS,EAAU,EAAE,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC;AAEnE,SAAS,cAAc,CAAC,IAAwB;IAC9C,IAAI,MAAM,IAAI,IAAI,EAAE,CAAC;QACnB,OAAO;YACL,WAAW,EAAE,kBAAkB;YAC/B,OAAO,EAAE,OAAO,IAAI,CAAC,IAAI,KAAK,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,IAAI,CAAC;SAC/E,CAAC;IACJ,CAAC;IACD,IAAI,MAAM,IAAI,IAAI;QAAE,OAAO,EAAE,WAAW,EAAE,YAAY,EAAE,OAAO,EAAE,IAAI,CAAC,IAAI,EAAE,CAAC;IAC7E,OAAO,EAAE,WAAW,EAAE,WAAW,EAAE,OAAO,EAAE,IAAI,CAAC,IAAI,EAAE,CAAC;AAC1D,CAAC;AAED,SAAS,cAAc,CAAC,KAAa,EAAE,MAAc;IACnD,IAAI,mBAAK,CAAC,YAAY,CAAC,MAAM,CAAC;QAAE,OAAO;IACvC,IAAI,CAAC,8CAAsC,CAAC,QAAQ,CAAC,MAAM,CAAC,EAAE,CAAC;QAC7D,MAAM,IAAI,KAAK,CACb,GAAG,KAAK,8DAA8D,MAAM,CAAC,MAAM,CAAC,IAAI;YACtF,cAAc,8CAAsC,CAAC,IAAI,CAAC,IAAI,CAAC,SAAS,MAAM,GAAG,CACpF,CAAC;IACJ,CAAC;AACH,CAAC;AAED,SAAS,eAAe,CAAC,KAAa,EAAE,OAA+B;IACrE,MAAM,KAAK,GAAG,MAAM,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;IACnC,IAAI,KAAK,CAAC,MAAM,GAAG,WAAW,EAAE,CAAC;QAC/B,MAAM,IAAI,KAAK,CACb,GAAG,KAAK,uCAAuC,MAAM,CAAC,WAAW,CAAC,iBAAiB,MAAM,CAAC,KAAK,CAAC,MAAM,CAAC,oBAAoB,MAAM,GAAG,CACrI,CAAC;IACJ,CAAC;IACD,MAAM,IAAI,GAAG,IAAI,GAAG,EAAU,CAAC;IAC/B,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;QACzB,IAAI,CAAC,WAAW,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC;YAC5B,MAAM,IAAI,KAAK,CACb,GAAG,KAAK,6BAA6B,IAAI,4EAA4E,MAAM,GAAG,CAC/H,CAAC;QACJ,CAAC;QACD,MAAM,KAAK,GAAG,IAAI,CAAC,WAAW,EAAE,CAAC;QACjC,IAAI,KAAK,KAAK,cAAc,EAAE,CAAC;YAC7B,MAAM,IAAI,KAAK,CACb,GAAG,KAAK,4HAA4H,CACrI,CAAC;QACJ,CAAC;QACD,IAAI,IAAI,CAAC,GAAG,CAAC,KAAK,CAAC,EAAE,CAAC;YACpB,MAAM,IAAI,KAAK,CAAC,GAAG,KAAK,6BAA6B,IAAI,iBAAiB,CAAC,CAAC;QAC9E,CAAC;QACD,IAAI,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC;IAClB,CAAC;AACH,CAAC;AAED;;;;;;;GAOG;AACH,MAAa,oBAAoB;IACtB,MAAM,CAAS;IACf,OAAO,GAAyD,EAAE,CAAC;IACnE,cAAc,GAAG,IAAI,GAAG,EAAkB,CAAC;IACpD,WAAW,GAAG,CAAC,CAAC;IAEhB,YAAY,KAAa;QACvB,IAAI,CAAC,MAAM,GAAG,KAAK,CAAC;IACtB,CAAC;IAED;;;;;OAKG;IACH,QAAQ,CACN,GAAW,EACX,OAAe,EACf,QAAwB;QAExB,MAAM,KAAK,GAAG,GAAG,IAAI,CAAC,MAAM,IAAI,GAAG,EAAE,CAAC;QACtC,cAAc,CAAC,KAAK,EAAE,QAAQ,CAAC,MAAM,CAAC,CAAC;QACvC,IAAI,QAAQ,CAAC,OAAO;YAAE,eAAe,CAAC,KAAK,EAAE,QAAQ,CAAC,OAAO,CAAC,CAAC;QAE/D,MAAM,eAAe,GAAG,QAAQ,CAAC,OAAO;YACtC,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,EAAE,KAAK,CAAC,EAAE,EAAE,CAAC,CAAC,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;YAC5E,CAAC,CAAC,SAAS,CAAC;QAEd,OAAO;YACL,YAAY,EAAE,QAAQ,CAAC,MAAM;YAC7B,GAAG,CAAC,QAAQ,CAAC,IAAI,IAAI,EAAE,qBAAqB,EAAE,IAAI,CAAC,OAAO,CAAC,KAAK,EAAE,OAAO,EAAE,QAAQ,CAAC,IAAI,CAAC,EAAE,CAAC;YAC5F,GAAG,CAAC,eAAe,IAAI,EAAE,eAAe,EAAE,CAAC;SAC5C,CAAC;IACJ,CAAC;IAED,OAAO,CAAC,KAAa,EAAE,OAAe,EAAE,IAAwB;QAC9D,MAAM,QAAQ,GAAG,cAAc,CAAC,IAAI,CAAC,CAAC;QACtC,MAAM,QAAQ,GAAG,GAAG,QAAQ,CAAC,WAAW,KAAK,QAAQ,CAAC,OAAO,EAAE,CAAC;QAChE,MAAM,QAAQ,GAAG,IAAI,CAAC,cAAc,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;QACnD,IAAI,QAAQ,KAAK,SAAS;YAAE,OAAO,QAAQ,CAAC;QAE5C,MAAM,KAAK,GAAG,UAAU,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC;QAC3C,IAAI,KAAK,GAAG,cAAc,EAAE,CAAC;YAC3B,MAAM,IAAI,KAAK,CACb,GAAG,KAAK,iCAAiC,MAAM,CAAC,KAAK,CAAC,kCAAkC,MAAM,CAAC,cAAc,CAAC,SAAS,MAAM,GAAG,CACjI,CAAC;QACJ,CAAC;QACD,IAAI,IAAI,CAAC,cAAc,CAAC,IAAI,IAAI,UAAU,EAAE,CAAC;YAC3C,MAAM,IAAI,KAAK,CACb,GAAG,IAAI,CAAC,MAAM,gCAAgC,MAAM,CAAC,UAAU,CAAC,yCAAyC,MAAM,GAAG,CACnH,CAAC;QACJ,CAAC;QACD,IAAI,CAAC,WAAW,IAAI,KAAK,CAAC;QAC1B,IAAI,IAAI,CAAC,WAAW,GAAG,oBAAoB,EAAE,CAAC;YAC5C,MAAM,IAAI,KAAK,CACb,GAAG,IAAI,CAAC,MAAM,sCAAsC,MAAM,CAAC,IAAI,CAAC,WAAW,CAAC,kCAAkC,MAAM,CAAC,oBAAoB,CAAC,qBAAqB,MAAM,GAAG,CACzK,CAAC;QACJ,CAAC;QAED,IAAI,GAAG,GAAG,OAAO,CAAC;QAClB,gFAAgF;QAChF,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,GAAG,IAAI,IAAI,CAAC,OAAO,EAAE,CAAC,EAAE;YAAE,GAAG,GAAG,GAAG,OAAO,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC,IAAI,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC;QACxF,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,GAAG,QAAQ,CAAC;QAC7B,IAAI,CAAC,cAAc,CAAC,GAAG,CAAC,QAAQ,EAAE,GAAG,CAAC,CAAC;QACvC,OAAO,GAAG,CAAC;IACb,CAAC;IAED;;;OAGG;IACH,KAAK,CAAC,GAAW,EAAE,OAAe,EAAE,QAAyB;QAC3D,OAAO,QAAQ,CAAC,CAAC,CAAC,EAAE,cAAc,EAAE,IAAI,CAAC,QAAQ,CAAC,GAAG,EAAE,OAAO,EAAE,QAAQ,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;IACnF,CAAC;IAED,oFAAoF;IACpF,UAAU;QACR,OAAO,IAAI,CAAC,cAAc,CAAC,IAAI,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,CAAC,SAAS,CAAC;IACjE,CAAC;CACF;AAhFD,oDAgFC"}

package/dist/commonjs/defaults.d.ts

@@ -0,0 +1,89 @@
+/**
+ * Defaults for {@link createWebAclBuilder}. Each can be overridden through the
+ * builder's fluent API.
+ */
+export declare const WEB_ACL_DEFAULTS: {
+    /**
+     * Regional, for API Gateway, Application Load Balancers, AppSync, Cognito,
+     * App Runner and Verified Access. A web ACL for CloudFront must say
+     * `.scope("CLOUDFRONT")` and be deployed in `us-east-1`.
+     *
+     * @see https://docs.aws.amazon.com/waf/latest/developerguide/how-aws-waf-works-resources.html
+     */
+    readonly scope: "REGIONAL";
+    /**
+     * Off, because a sampled request keeps every header, including the
+     * credentials that logging redacts. Turn it on only with a
+     * `dataProtectionConfig`, which does apply to samples.
+     *
+     * @see https://docs.aws.amazon.com/waf/latest/developerguide/waf-data-protection-and-logging.html
+     * @see https://docs.aws.amazon.com/wellarchitected/latest/security-pillar/sec_data_classification_define_protection.html
+     */
+    readonly sampledRequests: false;
+    /**
+     * On, to a created `aws-waf-logs-` log group, keeping the requests WAF does
+     * not allow ({@link DEFAULT_LOGGING_FILTER}) and redacting
+     * {@link DEFAULT_LOGGING_REDACTED_HEADERS}.
+     *
+     * @see https://docs.aws.amazon.com/wellarchitected/latest/security-pillar/sec_detect_investigate_events_app_service_logging.html
+     */
+    readonly logging: {};
+};
+/**
+ * Visibility settings that are not configurable. CloudWatch metrics are always
+ * on for the web ACL and every rule: they are free, and the recommended alarms
+ * and `metrics` helper read them.
+ *
+ * @see https://docs.aws.amazon.com/wellarchitected/latest/security-pillar/sec_detect_investigate_events_app_service_logging.html
+ * @see https://docs.aws.amazon.com/waf/latest/developerguide/waf-metrics.html
+ */
+export declare const WEB_ACL_VISIBILITY_DEFAULTS: {
+    readonly cloudWatchMetricsEnabled: true;
+};
+/**
+ * Gap between the priorities of consecutive rules, so a rule can be inserted
+ * with an explicit `.priority(n)` without renumbering the others.
+ */
+export declare const DEFAULT_RULE_PRIORITY_STEP = 10;
+/**
+ * The prefix AWS WAF requires of a CloudWatch log group, S3 bucket or Firehose
+ * stream it logs to.
+ *
+ * @see https://docs.aws.amazon.com/waf/latest/developerguide/logging-cw-logs.html
+ */
+export declare const WAF_LOG_GROUP_NAME_PREFIX = "aws-waf-logs-";
+/**
+ * Headers always redacted from WAF logs. Both carry credentials a log reader
+ * could replay, and neither helps tune a rule.
+ *
+ * @see https://docs.aws.amazon.com/wellarchitected/latest/security-pillar/sec_data_classification_define_protection.html
+ * @see https://docs.aws.amazon.com/waf/latest/developerguide/logging-management.html
+ */
+export declare const DEFAULT_LOGGING_REDACTED_HEADERS: readonly string[];
+/**
+ * Logs every request WAF does not simply allow, and drops the rest. Filtering
+ * is AWS's main lever on log volume and cost, and the allowed requests are
+ * rarely what a rule is tuned against.
+ *
+ * @see https://docs.aws.amazon.com/waf/latest/developerguide/logging-management.html
+ * @see https://docs.aws.amazon.com/wellarchitected/latest/security-pillar/sec_detect_investigate_events_app_service_logging.html
+ */
+export declare const DEFAULT_LOGGING_FILTER: {
+    readonly defaultBehavior: "DROP";
+    readonly filters: readonly [{
+        readonly behavior: "KEEP";
+        readonly requirement: "MEETS_ANY";
+        readonly conditions: readonly [{
+            readonly action: "BLOCK";
+        }, {
+            readonly action: "COUNT";
+        }, {
+            readonly action: "CAPTCHA";
+        }, {
+            readonly action: "CHALLENGE";
+        }, {
+            readonly action: "EXCLUDED_AS_COUNT";
+        }];
+    }];
+};
+//# sourceMappingURL=defaults.d.ts.map

package/dist/commonjs/defaults.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"defaults.d.ts","sourceRoot":"","sources":["../../src/defaults.ts"],"names":[],"mappings":"AAEA;;;GAGG;AACH,eAAO,MAAM,gBAAgB;IAC3B;;;;;;OAMG;;IAGH;;;;;;;OAOG;;IAGH;;;;;;OAMG;;CAEK,CAAC;AAEX;;;;;;;GAOG;AACH,eAAO,MAAM,2BAA2B;;CAE9B,CAAC;AAEX;;;GAGG;AACH,eAAO,MAAM,0BAA0B,KAAK,CAAC;AAE7C;;;;;GAKG;AACH,eAAO,MAAM,yBAAyB,kBAAkB,CAAC;AAEzD;;;;;;GAMG;AACH,eAAO,MAAM,gCAAgC,EAAE,SAAS,MAAM,EAAgC,CAAC;AAE/F;;;;;;;GAOG;AACH,eAAO,MAAM,sBAAsB;;;;;;;;;;;;;;;;;CAeK,CAAC"}

package/dist/commonjs/defaults.js

@@ -0,0 +1,90 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.DEFAULT_LOGGING_FILTER = exports.DEFAULT_LOGGING_REDACTED_HEADERS = exports.WAF_LOG_GROUP_NAME_PREFIX = exports.DEFAULT_RULE_PRIORITY_STEP = exports.WEB_ACL_VISIBILITY_DEFAULTS = exports.WEB_ACL_DEFAULTS = void 0;
+/**
+ * Defaults for {@link createWebAclBuilder}. Each can be overridden through the
+ * builder's fluent API.
+ */
+exports.WEB_ACL_DEFAULTS = {
+    /**
+     * Regional, for API Gateway, Application Load Balancers, AppSync, Cognito,
+     * App Runner and Verified Access. A web ACL for CloudFront must say
+     * `.scope("CLOUDFRONT")` and be deployed in `us-east-1`.
+     *
+     * @see https://docs.aws.amazon.com/waf/latest/developerguide/how-aws-waf-works-resources.html
+     */
+    scope: "REGIONAL",
+    /**
+     * Off, because a sampled request keeps every header, including the
+     * credentials that logging redacts. Turn it on only with a
+     * `dataProtectionConfig`, which does apply to samples.
+     *
+     * @see https://docs.aws.amazon.com/waf/latest/developerguide/waf-data-protection-and-logging.html
+     * @see https://docs.aws.amazon.com/wellarchitected/latest/security-pillar/sec_data_classification_define_protection.html
+     */
+    sampledRequests: false,
+    /**
+     * On, to a created `aws-waf-logs-` log group, keeping the requests WAF does
+     * not allow ({@link DEFAULT_LOGGING_FILTER}) and redacting
+     * {@link DEFAULT_LOGGING_REDACTED_HEADERS}.
+     *
+     * @see https://docs.aws.amazon.com/wellarchitected/latest/security-pillar/sec_detect_investigate_events_app_service_logging.html
+     */
+    logging: {},
+};
+/**
+ * Visibility settings that are not configurable. CloudWatch metrics are always
+ * on for the web ACL and every rule: they are free, and the recommended alarms
+ * and `metrics` helper read them.
+ *
+ * @see https://docs.aws.amazon.com/wellarchitected/latest/security-pillar/sec_detect_investigate_events_app_service_logging.html
+ * @see https://docs.aws.amazon.com/waf/latest/developerguide/waf-metrics.html
+ */
+exports.WEB_ACL_VISIBILITY_DEFAULTS = {
+    cloudWatchMetricsEnabled: true,
+};
+/**
+ * Gap between the priorities of consecutive rules, so a rule can be inserted
+ * with an explicit `.priority(n)` without renumbering the others.
+ */
+exports.DEFAULT_RULE_PRIORITY_STEP = 10;
+/**
+ * The prefix AWS WAF requires of a CloudWatch log group, S3 bucket or Firehose
+ * stream it logs to.
+ *
+ * @see https://docs.aws.amazon.com/waf/latest/developerguide/logging-cw-logs.html
+ */
+exports.WAF_LOG_GROUP_NAME_PREFIX = "aws-waf-logs-";
+/**
+ * Headers always redacted from WAF logs. Both carry credentials a log reader
+ * could replay, and neither helps tune a rule.
+ *
+ * @see https://docs.aws.amazon.com/wellarchitected/latest/security-pillar/sec_data_classification_define_protection.html
+ * @see https://docs.aws.amazon.com/waf/latest/developerguide/logging-management.html
+ */
+exports.DEFAULT_LOGGING_REDACTED_HEADERS = ["authorization", "cookie"];
+/**
+ * Logs every request WAF does not simply allow, and drops the rest. Filtering
+ * is AWS's main lever on log volume and cost, and the allowed requests are
+ * rarely what a rule is tuned against.
+ *
+ * @see https://docs.aws.amazon.com/waf/latest/developerguide/logging-management.html
+ * @see https://docs.aws.amazon.com/wellarchitected/latest/security-pillar/sec_detect_investigate_events_app_service_logging.html
+ */
+exports.DEFAULT_LOGGING_FILTER = {
+    defaultBehavior: "DROP",
+    filters: [
+        {
+            behavior: "KEEP",
+            requirement: "MEETS_ANY",
+            conditions: [
+                { action: "BLOCK" },
+                { action: "COUNT" },
+                { action: "CAPTCHA" },
+                { action: "CHALLENGE" },
+                { action: "EXCLUDED_AS_COUNT" },
+            ],
+        },
+    ],
+};
+//# sourceMappingURL=defaults.js.map

package/dist/commonjs/defaults.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"defaults.js","sourceRoot":"","sources":["../../src/defaults.ts"],"names":[],"mappings":";;;AAEA;;;GAGG;AACU,QAAA,gBAAgB,GAAG;IAC9B;;;;;;OAMG;IACH,KAAK,EAAE,UAAU;IAEjB;;;;;;;OAOG;IACH,eAAe,EAAE,KAAK;IAEtB;;;;;;OAMG;IACH,OAAO,EAAE,EAAE;CACH,CAAC;AAEX;;;;;;;GAOG;AACU,QAAA,2BAA2B,GAAG;IACzC,wBAAwB,EAAE,IAAI;CACtB,CAAC;AAEX;;;GAGG;AACU,QAAA,0BAA0B,GAAG,EAAE,CAAC;AAE7C;;;;;GAKG;AACU,QAAA,yBAAyB,GAAG,eAAe,CAAC;AAEzD;;;;;;GAMG;AACU,QAAA,gCAAgC,GAAsB,CAAC,eAAe,EAAE,QAAQ,CAAC,CAAC;AAE/F;;;;;;;GAOG;AACU,QAAA,sBAAsB,GAAG;IACpC,eAAe,EAAE,MAAM;IACvB,OAAO,EAAE;QACP;YACE,QAAQ,EAAE,MAAM;YAChB,WAAW,EAAE,WAAW;YACxB,UAAU,EAAE;gBACV,EAAE,MAAM,EAAE,OAAO,EAAE;gBACnB,EAAE,MAAM,EAAE,OAAO,EAAE;gBACnB,EAAE,MAAM,EAAE,SAAS,EAAE;gBACrB,EAAE,MAAM,EAAE,WAAW,EAAE;gBACvB,EAAE,MAAM,EAAE,mBAAmB,EAAE;aAChC;SACF;KACF;CACqC,CAAC"}

package/dist/commonjs/index.d.ts

@@ -0,0 +1,30 @@
+import { validateMetricName, validateRuleLabel, validateRuleName, validateWebAclName } from "./names.js";
+export { createWebAclBuilder, type IWebAclBuilder, type WebAclBuilderProps, type WebAclBuilderResult, } from "./web-acl-builder.js";
+export { type IWebAclRuleBuilder, type WebAclRuleAction, type WebAclRuleBuilderProps, } from "./rule-builder.js";
+export { type WebAclAssociationTarget } from "./association.js";
+export { type CustomResponse, type CustomResponseBody, SUPPORTED_CUSTOM_RESPONSE_STATUS_CODES, } from "./custom-response.js";
+export { type WebAclScope } from "./scope.js";
+export { type ManagedRuleGroupVersion, type WebAclMetrics, type WebAclRequestMetrics, } from "./metrics.js";
+export { type WebAclAlarmConfig, type WebAclRuleAlarmConfig } from "./alarm-config.js";
+export { WEB_ACL_RULE_ALARM_DEFAULTS } from "./alarm-defaults.js";
+export { type WebAclLoggingConfig, type WebAclLogRedaction } from "./logging.js";
+export { type WebAclLogAction, type WebAclLogCondition, type WebAclLoggingFilter, } from "./logging-filter.js";
+export { DEFAULT_LOGGING_FILTER, DEFAULT_LOGGING_REDACTED_HEADERS, DEFAULT_RULE_PRIORITY_STEP, WEB_ACL_DEFAULTS, WEB_ACL_VISIBILITY_DEFAULTS, WAF_LOG_GROUP_NAME_PREFIX, } from "./defaults.js";
+/**
+ * This package's AWS-property constraints, grouped by application strategy.
+ * The `constraints.validate.*` / `constraints.sanitize.*` shape is identical
+ * in every builder package, so it is discoverable without importing anything
+ * beyond the package you already use. The underlying constraint definitions
+ * stay module-private — this namespace is the only public surface for them.
+ * See ADR-0010.
+ */
+export declare const constraints: {
+    validate: {
+        webAclName: typeof validateWebAclName;
+        ruleName: typeof validateRuleName;
+        metricName: typeof validateMetricName;
+        ruleLabel: typeof validateRuleLabel;
+    };
+    sanitize: {};
+};
+//# sourceMappingURL=index.d.ts.map

package/dist/commonjs/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/index.ts"],"names":[],"mappings":"AACA,OAAO,EACL,kBAAkB,EAClB,iBAAiB,EACjB,gBAAgB,EAChB,kBAAkB,EACnB,MAAM,YAAY,CAAC;AAEpB,OAAO,EACL,mBAAmB,EACnB,KAAK,cAAc,EACnB,KAAK,kBAAkB,EACvB,KAAK,mBAAmB,GACzB,MAAM,sBAAsB,CAAC;AAC9B,OAAO,EACL,KAAK,kBAAkB,EACvB,KAAK,gBAAgB,EACrB,KAAK,sBAAsB,GAC5B,MAAM,mBAAmB,CAAC;AAC3B,OAAO,EAAE,KAAK,uBAAuB,EAAE,MAAM,kBAAkB,CAAC;AAChE,OAAO,EACL,KAAK,cAAc,EACnB,KAAK,kBAAkB,EACvB,sCAAsC,GACvC,MAAM,sBAAsB,CAAC;AAC9B,OAAO,EAAE,KAAK,WAAW,EAAE,MAAM,YAAY,CAAC;AAC9C,OAAO,EACL,KAAK,uBAAuB,EAC5B,KAAK,aAAa,EAClB,KAAK,oBAAoB,GAC1B,MAAM,cAAc,CAAC;AACtB,OAAO,EAAE,KAAK,iBAAiB,EAAE,KAAK,qBAAqB,EAAE,MAAM,mBAAmB,CAAC;AACvF,OAAO,EAAE,2BAA2B,EAAE,MAAM,qBAAqB,CAAC;AAClE,OAAO,EAAE,KAAK,mBAAmB,EAAE,KAAK,kBAAkB,EAAE,MAAM,cAAc,CAAC;AACjF,OAAO,EACL,KAAK,eAAe,EACpB,KAAK,kBAAkB,EACvB,KAAK,mBAAmB,GACzB,MAAM,qBAAqB,CAAC;AAC7B,OAAO,EACL,sBAAsB,EACtB,gCAAgC,EAChC,0BAA0B,EAC1B,gBAAgB,EAChB,2BAA2B,EAC3B,yBAAyB,GAC1B,MAAM,eAAe,CAAC;AAEvB;;;;;;;GAOG;AACH,eAAO,MAAM,WAAW;;;;;;;;CAQO,CAAC"}

package/dist/commonjs/index.js

@@ -0,0 +1,35 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.constraints = exports.WAF_LOG_GROUP_NAME_PREFIX = exports.WEB_ACL_VISIBILITY_DEFAULTS = exports.WEB_ACL_DEFAULTS = exports.DEFAULT_RULE_PRIORITY_STEP = exports.DEFAULT_LOGGING_REDACTED_HEADERS = exports.DEFAULT_LOGGING_FILTER = exports.WEB_ACL_RULE_ALARM_DEFAULTS = exports.SUPPORTED_CUSTOM_RESPONSE_STATUS_CODES = exports.createWebAclBuilder = void 0;
+const names_js_1 = require("./names.js");
+var web_acl_builder_js_1 = require("./web-acl-builder.js");
+Object.defineProperty(exports, "createWebAclBuilder", { enumerable: true, get: function () { return web_acl_builder_js_1.createWebAclBuilder; } });
+var custom_response_js_1 = require("./custom-response.js");
+Object.defineProperty(exports, "SUPPORTED_CUSTOM_RESPONSE_STATUS_CODES", { enumerable: true, get: function () { return custom_response_js_1.SUPPORTED_CUSTOM_RESPONSE_STATUS_CODES; } });
+var alarm_defaults_js_1 = require("./alarm-defaults.js");
+Object.defineProperty(exports, "WEB_ACL_RULE_ALARM_DEFAULTS", { enumerable: true, get: function () { return alarm_defaults_js_1.WEB_ACL_RULE_ALARM_DEFAULTS; } });
+var defaults_js_1 = require("./defaults.js");
+Object.defineProperty(exports, "DEFAULT_LOGGING_FILTER", { enumerable: true, get: function () { return defaults_js_1.DEFAULT_LOGGING_FILTER; } });
+Object.defineProperty(exports, "DEFAULT_LOGGING_REDACTED_HEADERS", { enumerable: true, get: function () { return defaults_js_1.DEFAULT_LOGGING_REDACTED_HEADERS; } });
+Object.defineProperty(exports, "DEFAULT_RULE_PRIORITY_STEP", { enumerable: true, get: function () { return defaults_js_1.DEFAULT_RULE_PRIORITY_STEP; } });
+Object.defineProperty(exports, "WEB_ACL_DEFAULTS", { enumerable: true, get: function () { return defaults_js_1.WEB_ACL_DEFAULTS; } });
+Object.defineProperty(exports, "WEB_ACL_VISIBILITY_DEFAULTS", { enumerable: true, get: function () { return defaults_js_1.WEB_ACL_VISIBILITY_DEFAULTS; } });
+Object.defineProperty(exports, "WAF_LOG_GROUP_NAME_PREFIX", { enumerable: true, get: function () { return defaults_js_1.WAF_LOG_GROUP_NAME_PREFIX; } });
+/**
+ * This package's AWS-property constraints, grouped by application strategy.
+ * The `constraints.validate.*` / `constraints.sanitize.*` shape is identical
+ * in every builder package, so it is discoverable without importing anything
+ * beyond the package you already use. The underlying constraint definitions
+ * stay module-private — this namespace is the only public surface for them.
+ * See ADR-0010.
+ */
+exports.constraints = {
+    validate: {
+        webAclName: names_js_1.validateWebAclName,
+        ruleName: names_js_1.validateRuleName,
+        metricName: names_js_1.validateMetricName,
+        ruleLabel: names_js_1.validateRuleLabel,
+    },
+    sanitize: {},
+};
+//# sourceMappingURL=index.js.map

package/dist/commonjs/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/index.ts"],"names":[],"mappings":";;;AACA,yCAKoB;AAEpB,2DAK8B;AAJ5B,yHAAA,mBAAmB,OAAA;AAWrB,2DAI8B;AAD5B,4IAAA,sCAAsC,OAAA;AASxC,yDAAkE;AAAzD,gIAAA,2BAA2B,OAAA;AAOpC,6CAOuB;AANrB,qHAAA,sBAAsB,OAAA;AACtB,+HAAA,gCAAgC,OAAA;AAChC,yHAAA,0BAA0B,OAAA;AAC1B,+GAAA,gBAAgB,OAAA;AAChB,0HAAA,2BAA2B,OAAA;AAC3B,wHAAA,yBAAyB,OAAA;AAG3B;;;;;;;GAOG;AACU,QAAA,WAAW,GAAG;IACzB,QAAQ,EAAE;QACR,UAAU,EAAE,6BAAkB;QAC9B,QAAQ,EAAE,2BAAgB;QAC1B,UAAU,EAAE,6BAAkB;QAC9B,SAAS,EAAE,4BAAiB;KAC7B;IACD,QAAQ,EAAE,EAAE;CACiB,CAAC"}

package/dist/commonjs/logging-filter.d.ts

@@ -0,0 +1,27 @@
+/** An action a logging filter condition can match on. */
+export type WebAclLogAction = "ALLOW" | "BLOCK" | "COUNT" | "CAPTCHA" | "CHALLENGE" | "EXCLUDED_AS_COUNT";
+/** One condition of a {@link WebAclLoggingFilter} filter: an action or a label. */
+export type WebAclLogCondition = {
+    action: WebAclLogAction;
+} | {
+    label: string;
+};
+/**
+ * Which requests WAF writes to the log, typed. The builder turns it into the
+ * PascalCase JSON CloudFormation's `LoggingFilter` expects, which CDK types
+ * as `any`.
+ *
+ * @see https://docs.aws.amazon.com/waf/latest/APIReference/API_LoggingFilter.html
+ */
+export interface WebAclLoggingFilter {
+    /** What to do with a request no filter matches. */
+    readonly defaultBehavior: "KEEP" | "DROP";
+    readonly filters: readonly {
+        readonly behavior: "KEEP" | "DROP";
+        readonly requirement: "MEETS_ALL" | "MEETS_ANY";
+        readonly conditions: readonly WebAclLogCondition[];
+    }[];
+}
+/** @internal — `LoggingFilter` is `any` in CDK, so this emits CloudFormation's PascalCase. */
+export declare function toFilterProperty(filter: WebAclLoggingFilter): unknown;
+//# sourceMappingURL=logging-filter.d.ts.map

package/dist/commonjs/logging-filter.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"logging-filter.d.ts","sourceRoot":"","sources":["../../src/logging-filter.ts"],"names":[],"mappings":"AAAA,yDAAyD;AACzD,MAAM,MAAM,eAAe,GACzB,OAAO,GAAG,OAAO,GAAG,OAAO,GAAG,SAAS,GAAG,WAAW,GAAG,mBAAmB,CAAC;AAE9E,mFAAmF;AACnF,MAAM,MAAM,kBAAkB,GAAG;IAAE,MAAM,EAAE,eAAe,CAAA;CAAE,GAAG;IAAE,KAAK,EAAE,MAAM,CAAA;CAAE,CAAC;AAEjF;;;;;;GAMG;AACH,MAAM,WAAW,mBAAmB;IAClC,mDAAmD;IACnD,QAAQ,CAAC,eAAe,EAAE,MAAM,GAAG,MAAM,CAAC;IAC1C,QAAQ,CAAC,OAAO,EAAE,SAAS;QACzB,QAAQ,CAAC,QAAQ,EAAE,MAAM,GAAG,MAAM,CAAC;QACnC,QAAQ,CAAC,WAAW,EAAE,WAAW,GAAG,WAAW,CAAC;QAChD,QAAQ,CAAC,UAAU,EAAE,SAAS,kBAAkB,EAAE,CAAC;KACpD,EAAE,CAAC;CACL;AAED,8FAA8F;AAC9F,wBAAgB,gBAAgB,CAAC,MAAM,EAAE,mBAAmB,GAAG,OAAO,CAarE"}

package/dist/commonjs/logging-filter.js

@@ -0,0 +1,17 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.toFilterProperty = toFilterProperty;
+/** @internal — `LoggingFilter` is `any` in CDK, so this emits CloudFormation's PascalCase. */
+function toFilterProperty(filter) {
+    return {
+        DefaultBehavior: filter.defaultBehavior,
+        Filters: filter.filters.map((f) => ({
+            Behavior: f.behavior,
+            Requirement: f.requirement,
+            Conditions: f.conditions.map((c) => "action" in c
+                ? { ActionCondition: { Action: c.action } }
+                : { LabelNameCondition: { LabelName: c.label } }),
+        })),
+    };
+}
+//# sourceMappingURL=logging-filter.js.map

package/dist/commonjs/logging-filter.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"logging-filter.js","sourceRoot":"","sources":["../../src/logging-filter.ts"],"names":[],"mappings":";;AAyBA,4CAaC;AAdD,8FAA8F;AAC9F,SAAgB,gBAAgB,CAAC,MAA2B;IAC1D,OAAO;QACL,eAAe,EAAE,MAAM,CAAC,eAAe;QACvC,OAAO,EAAE,MAAM,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;YAClC,QAAQ,EAAE,CAAC,CAAC,QAAQ;YACpB,WAAW,EAAE,CAAC,CAAC,WAAW;YAC1B,UAAU,EAAE,CAAC,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CACjC,QAAQ,IAAI,CAAC;gBACX,CAAC,CAAC,EAAE,eAAe,EAAE,EAAE,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,EAAE;gBAC3C,CAAC,CAAC,EAAE,kBAAkB,EAAE,EAAE,SAAS,EAAE,CAAC,CAAC,KAAK,EAAE,EAAE,CACnD;SACF,CAAC,CAAC;KACJ,CAAC;AACJ,CAAC"}