@composurecdk/wafv2 0.0.0-stage → 0.13.0

package/dist/commonjs/rule-builder.js

@@ -0,0 +1,163 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.createWebAclRuleBuilder = createWebAclRuleBuilder;
+const core_1 = require("@composurecdk/core");
+const defaults_js_1 = require("./defaults.js");
+const names_js_1 = require("./names.js");
+const RULE_GROUP_STATEMENTS = ["managedRuleGroupStatement", "ruleGroupReferenceStatement"];
+/** Whether `statement` evaluates a rule group, so its rule takes `overrideAction`. */
+function isRuleGroupStatement(statement) {
+    return RULE_GROUP_STATEMENTS.some((key) => statement[key] !== undefined);
+}
+class WebAclRuleBuilder {
+    props = {};
+    #statement;
+    #action;
+    #response;
+    #labels = [];
+    /**
+     * Sets the rule's statement as raw CloudFormation, for a statement this
+     * builder has no helper for. Fields CDK types as `any` — `singleHeader`,
+     * `queryString`, `uriPath`, `method` and the like — pass through verbatim,
+     * so they must use CloudFormation's PascalCase (`{ Name: "x-api-key" }`).
+     *
+     * A rule has exactly one statement; setting a second throws.
+     */
+    statement(statement) {
+        this.#setStatement("statement", statement);
+        return this;
+    }
+    /** Blocks matching requests. This is the default action. */
+    block() {
+        return this.#setAction("block");
+    }
+    /** Allows matching requests, ending evaluation of the web ACL. */
+    allow() {
+        return this.#setAction("allow");
+    }
+    /**
+     * Counts matching requests and carries on evaluating. On a rule-group rule
+     * this counts every rule in the group instead of applying its actions.
+     */
+    count() {
+        return this.#setAction("count");
+    }
+    /** Answers matching requests with a CAPTCHA puzzle. */
+    captcha() {
+        return this.#setAction("captcha");
+    }
+    /** Answers matching requests with a silent browser challenge. */
+    challenge() {
+        return this.#setAction("challenge");
+    }
+    /**
+     * Blocks matching requests with a custom response instead of WAF's `403`.
+     * The body is collected into the web ACL's `customResponseBodies`, so
+     * nothing has to be declared there by hand.
+     *
+     * @param status - One of the status codes WAF supports; `410` is not.
+     * @param body - `{ json }`, `{ text }` or `{ html }`; at most 4 KB.
+     * @param headers - At most 10, and not `content-type`.
+     */
+    respond(status, body, headers) {
+        if (this.#action !== undefined && this.#action !== "block") {
+            throw new Error(`respond() blocks the request, but the rule's action is already "${this.#action}". A custom response is only available on Block.`);
+        }
+        this.#action = "block";
+        this.#response = { status, body, headers };
+        return this;
+    }
+    /**
+     * Adds labels to matching requests, for later rules to match on with a
+     * label match statement. Give the namespaces and name only, such as
+     * `"auth:missing-token"`; WAF adds the web ACL prefix.
+     */
+    labels(...labels) {
+        for (const label of labels)
+            (0, names_js_1.validateRuleLabel)(label);
+        this.#labels.push(...labels);
+        return this;
+    }
+    /** @internal — see ADR-0005. */
+    [core_1.COPY_STATE](target) {
+        target.#statement = this.#statement;
+        target.#action = this.#action;
+        target.#response = this.#response;
+        target.#labels.push(...this.#labels);
+    }
+    #setStatement(method, statement) {
+        if (this.#statement !== undefined) {
+            throw new Error(`${method}(): the rule already has a statement. A rule has exactly one; combine conditions with an AndStatement or OrStatement.`);
+        }
+        this.#statement = statement;
+    }
+    #setAction(action) {
+        if (this.#response !== undefined && action !== "block") {
+            throw new Error(`${action}(): the rule already has a custom response from respond(), which only applies to Block.`);
+        }
+        this.#action = action;
+        return this;
+    }
+    /** @internal — the web ACL builder turns each rule into CloudFormation. */
+    toRule(ctx) {
+        const who = `rule "${ctx.name}"`;
+        const statement = this.#statement;
+        if (statement === undefined) {
+            throw new Error(`${ctx.owner} ${who} has no statement. Give it one, such as .statement({ ... }).`);
+        }
+        const metricName = this.props.metricName ?? ctx.name;
+        (0, names_js_1.validateMetricName)(metricName);
+        const sampled = this.props.sampledRequests ?? ctx.sampledRequests;
+        const rateBased = statement.rateBasedStatement !== undefined;
+        const ruleGroup = isRuleGroupStatement(statement);
+        const { blocks, ...action } = this.#actionProperty(ctx, who, ruleGroup, rateBased);
+        const property = {
+            name: ctx.name,
+            priority: this.props.priority ?? ctx.defaultPriority,
+            statement,
+            ...action,
+            visibilityConfig: {
+                ...defaults_js_1.WEB_ACL_VISIBILITY_DEFAULTS,
+                metricName,
+                sampledRequestsEnabled: sampled,
+            },
+            ...(this.#labels.length > 0 && { ruleLabels: this.#labels.map((name) => ({ name })) }),
+            ...(this.props.captchaConfig && { captchaConfig: this.props.captchaConfig }),
+            ...(this.props.challengeConfig && { challengeConfig: this.props.challengeConfig }),
+        };
+        return {
+            property,
+            metricName,
+            sampled,
+            rateBased,
+            ruleGroup,
+            blocks,
+            alarms: this.props.alarms,
+        };
+    }
+    #actionProperty(ctx, who, ruleGroup, rateBased) {
+        if (ruleGroup) {
+            if (this.#action !== undefined && this.#action !== "count") {
+                throw new Error(`${ctx.owner} ${who} evaluates a rule group, whose rules keep their own actions. ` +
+                    `Use .count() to count them all instead, or leave the action unset.`);
+            }
+            // The group's own rules block unless the whole group is counted.
+            return this.#action === "count"
+                ? { overrideAction: { count: {} }, blocks: false }
+                : { overrideAction: { none: {} }, blocks: true };
+        }
+        const action = this.#action ?? "block";
+        if (action === "allow" && rateBased) {
+            throw new Error(`${ctx.owner} ${who} is rate-based, and a rate-based rule cannot Allow. Use block, count, captcha or challenge.`);
+        }
+        if (action !== "block")
+            return { action: { [action]: {} }, blocks: false };
+        return { action: { block: ctx.bodies.block(who, ctx.name, this.#response) }, blocks: true };
+    }
+}
+/** @internal — the web ACL builder makes one of these per rule. */
+function createWebAclRuleBuilder() {
+    // eslint-disable-next-line composurecdk/builder-must-be-tagged -- a rule is a property of AWS::WAFv2::WebACL, not a taggable resource
+    return (0, core_1.Builder)(WebAclRuleBuilder);
+}
+//# sourceMappingURL=rule-builder.js.map

package/dist/commonjs/rule-builder.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"rule-builder.js","sourceRoot":"","sources":["../../src/rule-builder.ts"],"names":[],"mappings":";;AAoRA,0DAGC;AAtRD,6CAAwE;AAOxE,+CAA4D;AAC5D,yCAAmE;AAwEnE,MAAM,qBAAqB,GAAG,CAAC,2BAA2B,EAAE,6BAA6B,CAAU,CAAC;AAEpG,sFAAsF;AACtF,SAAS,oBAAoB,CAAC,SAAsC;IAClE,OAAO,qBAAqB,CAAC,IAAI,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,SAAS,CAAC,GAAG,CAAC,KAAK,SAAS,CAAC,CAAC;AAC3E,CAAC;AAED,MAAM,iBAAiB;IACrB,KAAK,GAAoC,EAAE,CAAC;IAC5C,UAAU,CAA+B;IACzC,OAAO,CAAoB;IAC3B,SAAS,CAAkB;IAClB,OAAO,GAAa,EAAE,CAAC;IAEhC;;;;;;;OAOG;IACH,SAAS,CAAC,SAAsC;QAC9C,IAAI,CAAC,aAAa,CAAC,WAAW,EAAE,SAAS,CAAC,CAAC;QAC3C,OAAO,IAAI,CAAC;IACd,CAAC;IAED,4DAA4D;IAC5D,KAAK;QACH,OAAO,IAAI,CAAC,UAAU,CAAC,OAAO,CAAC,CAAC;IAClC,CAAC;IAED,kEAAkE;IAClE,KAAK;QACH,OAAO,IAAI,CAAC,UAAU,CAAC,OAAO,CAAC,CAAC;IAClC,CAAC;IAED;;;OAGG;IACH,KAAK;QACH,OAAO,IAAI,CAAC,UAAU,CAAC,OAAO,CAAC,CAAC;IAClC,CAAC;IAED,uDAAuD;IACvD,OAAO;QACL,OAAO,IAAI,CAAC,UAAU,CAAC,SAAS,CAAC,CAAC;IACpC,CAAC;IAED,iEAAiE;IACjE,SAAS;QACP,OAAO,IAAI,CAAC,UAAU,CAAC,WAAW,CAAC,CAAC;IACtC,CAAC;IAED;;;;;;;;OAQG;IACH,OAAO,CAAC,MAAc,EAAE,IAAyB,EAAE,OAAgC;QACjF,IAAI,IAAI,CAAC,OAAO,KAAK,SAAS,IAAI,IAAI,CAAC,OAAO,KAAK,OAAO,EAAE,CAAC;YAC3D,MAAM,IAAI,KAAK,CACb,mEAAmE,IAAI,CAAC,OAAO,kDAAkD,CAClI,CAAC;QACJ,CAAC;QACD,IAAI,CAAC,OAAO,GAAG,OAAO,CAAC;QACvB,IAAI,CAAC,SAAS,GAAG,EAAE,MAAM,EAAE,IAAI,EAAE,OAAO,EAAE,CAAC;QAC3C,OAAO,IAAI,CAAC;IACd,CAAC;IAED;;;;OAIG;IACH,MAAM,CAAC,GAAG,MAAgB;QACxB,KAAK,MAAM,KAAK,IAAI,MAAM;YAAE,IAAA,4BAAiB,EAAC,KAAK,CAAC,CAAC;QACrD,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,GAAG,MAAM,CAAC,CAAC;QAC7B,OAAO,IAAI,CAAC;IACd,CAAC;IAED,gCAAgC;IAChC,CAAC,iBAAU,CAAC,CAAC,MAAyB;QACpC,MAAM,CAAC,UAAU,GAAG,IAAI,CAAC,UAAU,CAAC;QACpC,MAAM,CAAC,OAAO,GAAG,IAAI,CAAC,OAAO,CAAC;QAC9B,MAAM,CAAC,SAAS,GAAG,IAAI,CAAC,SAAS,CAAC;QAClC,MAAM,CAAC,OAAO,CAAC,IAAI,CAAC,GAAG,IAAI,CAAC,OAAO,CAAC,CAAC;IACvC,CAAC;IAED,aAAa,CAAC,MAAc,EAAE,SAAsC;QAClE,IAAI,IAAI,CAAC,UAAU,KAAK,SAAS,EAAE,CAAC;YAClC,MAAM,IAAI,KAAK,CACb,GAAG,MAAM,uHAAuH,CACjI,CAAC;QACJ,CAAC;QACD,IAAI,CAAC,UAAU,GAAG,SAAS,CAAC;IAC9B,CAAC;IAED,UAAU,CAAC,MAAwB;QACjC,IAAI,IAAI,CAAC,SAAS,KAAK,SAAS,IAAI,MAAM,KAAK,OAAO,EAAE,CAAC;YACvD,MAAM,IAAI,KAAK,CACb,GAAG,MAAM,yFAAyF,CACnG,CAAC;QACJ,CAAC;QACD,IAAI,CAAC,OAAO,GAAG,MAAM,CAAC;QACtB,OAAO,IAAI,CAAC;IACd,CAAC;IAED,2EAA2E;IAC3E,MAAM,CAAC,GAAqB;QAC1B,MAAM,GAAG,GAAG,SAAS,GAAG,CAAC,IAAI,GAAG,CAAC;QACjC,MAAM,SAAS,GAAG,IAAI,CAAC,UAAU,CAAC;QAClC,IAAI,SAAS,KAAK,SAAS,EAAE,CAAC;YAC5B,MAAM,IAAI,KAAK,CACb,GAAG,GAAG,CAAC,KAAK,IAAI,GAAG,8DAA8D,CAClF,CAAC;QACJ,CAAC;QAED,MAAM,UAAU,GAAG,IAAI,CAAC,KAAK,CAAC,UAAU,IAAI,GAAG,CAAC,IAAI,CAAC;QACrD,IAAA,6BAAkB,EAAC,UAAU,CAAC,CAAC;QAC/B,MAAM,OAAO,GAAG,IAAI,CAAC,KAAK,CAAC,eAAe,IAAI,GAAG,CAAC,eAAe,CAAC;QAClE,MAAM,SAAS,GAAG,SAAS,CAAC,kBAAkB,KAAK,SAAS,CAAC;QAC7D,MAAM,SAAS,GAAG,oBAAoB,CAAC,SAAS,CAAC,CAAC;QAElD,MAAM,EAAE,MAAM,EAAE,GAAG,MAAM,EAAE,GAAG,IAAI,CAAC,eAAe,CAAC,GAAG,EAAE,GAAG,EAAE,SAAS,EAAE,SAAS,CAAC,CAAC;QACnF,MAAM,QAAQ,GAAG;YACf,IAAI,EAAE,GAAG,CAAC,IAAI;YACd,QAAQ,EAAE,IAAI,CAAC,KAAK,CAAC,QAAQ,IAAI,GAAG,CAAC,eAAe;YACpD,SAAS;YACT,GAAG,MAAM;YACT,gBAAgB,EAAE;gBAChB,GAAG,yCAA2B;gBAC9B,UAAU;gBACV,sBAAsB,EAAE,OAAO;aAChC;YACD,GAAG,CAAC,IAAI,CAAC,OAAO,CAAC,MAAM,GAAG,CAAC,IAAI,EAAE,UAAU,EAAE,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC,EAAE,CAAC;YACtF,GAAG,CAAC,IAAI,CAAC,KAAK,CAAC,aAAa,IAAI,EAAE,aAAa,EAAE,IAAI,CAAC,KAAK,CAAC,aAAa,EAAE,CAAC;YAC5E,GAAG,CAAC,IAAI,CAAC,KAAK,CAAC,eAAe,IAAI,EAAE,eAAe,EAAE,IAAI,CAAC,KAAK,CAAC,eAAe,EAAE,CAAC;SACnF,CAAC;QACF,OAAO;YACL,QAAQ;YACR,UAAU;YACV,OAAO;YACP,SAAS;YACT,SAAS;YACT,MAAM;YACN,MAAM,EAAE,IAAI,CAAC,KAAK,CAAC,MAAM;SAC1B,CAAC;IACJ,CAAC;IAED,eAAe,CACb,GAAqB,EACrB,GAAW,EACX,SAAkB,EAClB,SAAkB;QAElB,IAAI,SAAS,EAAE,CAAC;YACd,IAAI,IAAI,CAAC,OAAO,KAAK,SAAS,IAAI,IAAI,CAAC,OAAO,KAAK,OAAO,EAAE,CAAC;gBAC3D,MAAM,IAAI,KAAK,CACb,GAAG,GAAG,CAAC,KAAK,IAAI,GAAG,+DAA+D;oBAChF,oEAAoE,CACvE,CAAC;YACJ,CAAC;YACD,iEAAiE;YACjE,OAAO,IAAI,CAAC,OAAO,KAAK,OAAO;gBAC7B,CAAC,CAAC,EAAE,cAAc,EAAE,EAAE,KAAK,EAAE,EAAE,EAAE,EAAE,MAAM,EAAE,KAAK,EAAE;gBAClD,CAAC,CAAC,EAAE,cAAc,EAAE,EAAE,IAAI,EAAE,EAAE,EAAE,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC;QACrD,CAAC;QAED,MAAM,MAAM,GAAG,IAAI,CAAC,OAAO,IAAI,OAAO,CAAC;QACvC,IAAI,MAAM,KAAK,OAAO,IAAI,SAAS,EAAE,CAAC;YACpC,MAAM,IAAI,KAAK,CACb,GAAG,GAAG,CAAC,KAAK,IAAI,GAAG,6FAA6F,CACjH,CAAC;QACJ,CAAC;QACD,IAAI,MAAM,KAAK,OAAO;YAAE,OAAO,EAAE,MAAM,EAAE,EAAE,CAAC,MAAM,CAAC,EAAE,EAAE,EAAE,EAAE,MAAM,EAAE,KAAK,EAAE,CAAC;QAC3E,OAAO,EAAE,MAAM,EAAE,EAAE,KAAK,EAAE,GAAG,CAAC,MAAM,CAAC,KAAK,CAAC,GAAG,EAAE,GAAG,CAAC,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,EAAE,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC;IAC9F,CAAC;CACF;AAWD,mEAAmE;AACnE,SAAgB,uBAAuB;IACrC,sIAAsI;IACtI,OAAO,IAAA,cAAO,EAA4C,iBAAiB,CAAC,CAAC;AAC/E,CAAC"}

package/dist/commonjs/scope.d.ts

@@ -0,0 +1,15 @@
+import type { IConstruct } from "constructs";
+/** Where a web ACL can be used: CloudFront distributions, or regional resources. */
+export type WebAclScope = "REGIONAL" | "CLOUDFRONT";
+/**
+ * Throws when a CLOUDFRONT web ACL's stack is in a known region other than
+ * `us-east-1`, and warns when the region cannot be known at synth.
+ *
+ * Env-agnostic stacks fall back to `CDK_DEFAULT_REGION`, which the CDK toolkit
+ * uses to fill the deploy region, as `@composurecdk/route53`'s query logging
+ * does.
+ *
+ * @internal
+ */
+export declare function checkCloudFrontRegion(scope: IConstruct, id: string): void;
+//# sourceMappingURL=scope.d.ts.map

package/dist/commonjs/scope.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"scope.d.ts","sourceRoot":"","sources":["../../src/scope.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,YAAY,CAAC;AAE7C,oFAAoF;AACpF,MAAM,MAAM,WAAW,GAAG,UAAU,GAAG,YAAY,CAAC;AAOpD;;;;;;;;;GASG;AACH,wBAAgB,qBAAqB,CAAC,KAAK,EAAE,UAAU,EAAE,EAAE,EAAE,MAAM,GAAG,IAAI,CAqBzE"}

package/dist/commonjs/scope.js

@@ -0,0 +1,35 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.checkCloudFrontRegion = checkCloudFrontRegion;
+const aws_cdk_lib_1 = require("aws-cdk-lib");
+const CLOUDFRONT_REGION = "us-east-1";
+const REGION_ANNOTATION = "@composurecdk/wafv2:cloudfront-region";
+const SOURCE = "https://docs.aws.amazon.com/waf/latest/developerguide/how-aws-waf-works-resources.html";
+/**
+ * Throws when a CLOUDFRONT web ACL's stack is in a known region other than
+ * `us-east-1`, and warns when the region cannot be known at synth.
+ *
+ * Env-agnostic stacks fall back to `CDK_DEFAULT_REGION`, which the CDK toolkit
+ * uses to fill the deploy region, as `@composurecdk/route53`'s query logging
+ * does.
+ *
+ * @internal
+ */
+function checkCloudFrontRegion(scope, id) {
+    const stackRegion = aws_cdk_lib_1.Stack.of(scope).region;
+    const region = aws_cdk_lib_1.Token.isUnresolved(stackRegion) ? process.env.CDK_DEFAULT_REGION : stackRegion;
+    if (region === undefined || region === "") {
+        aws_cdk_lib_1.Annotations.of(scope).addWarningV2(REGION_ANNOTATION, `WebAclBuilder "${id}" has scope CLOUDFRONT, which AWS WAF only accepts in ` +
+            `${CLOUDFRONT_REGION}. This stack is env-agnostic and CDK_DEFAULT_REGION is not ` +
+            `set, so the region cannot be checked at synth. Pin env: { region: ` +
+            `"${CLOUDFRONT_REGION}" } on the stack to silence this warning.`);
+        return;
+    }
+    if (region !== CLOUDFRONT_REGION) {
+        throw new Error(`WebAclBuilder "${id}" has scope CLOUDFRONT, but its stack is in "${region}". ` +
+            `AWS WAF only creates CloudFront web ACLs in ${CLOUDFRONT_REGION}. Deploy this ` +
+            `web ACL from a ${CLOUDFRONT_REGION} stack and pass its ARN to the distribution's ` +
+            `webAclId. See ${SOURCE}.`);
+    }
+}
+//# sourceMappingURL=scope.js.map

package/dist/commonjs/scope.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"scope.js","sourceRoot":"","sources":["../../src/scope.ts"],"names":[],"mappings":";;AAqBA,sDAqBC;AA1CD,6CAAwD;AAMxD,MAAM,iBAAiB,GAAG,WAAW,CAAC;AACtC,MAAM,iBAAiB,GAAG,uCAAuC,CAAC;AAClE,MAAM,MAAM,GACV,wFAAwF,CAAC;AAE3F;;;;;;;;;GASG;AACH,SAAgB,qBAAqB,CAAC,KAAiB,EAAE,EAAU;IACjE,MAAM,WAAW,GAAG,mBAAK,CAAC,EAAE,CAAC,KAAK,CAAC,CAAC,MAAM,CAAC;IAC3C,MAAM,MAAM,GAAG,mBAAK,CAAC,YAAY,CAAC,WAAW,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,GAAG,CAAC,kBAAkB,CAAC,CAAC,CAAC,WAAW,CAAC;IAC9F,IAAI,MAAM,KAAK,SAAS,IAAI,MAAM,KAAK,EAAE,EAAE,CAAC;QAC1C,yBAAW,CAAC,EAAE,CAAC,KAAK,CAAC,CAAC,YAAY,CAChC,iBAAiB,EACjB,kBAAkB,EAAE,wDAAwD;YAC1E,GAAG,iBAAiB,6DAA6D;YACjF,oEAAoE;YACpE,IAAI,iBAAiB,2CAA2C,CACnE,CAAC;QACF,OAAO;IACT,CAAC;IACD,IAAI,MAAM,KAAK,iBAAiB,EAAE,CAAC;QACjC,MAAM,IAAI,KAAK,CACb,kBAAkB,EAAE,gDAAgD,MAAM,KAAK;YAC7E,+CAA+C,iBAAiB,gBAAgB;YAChF,kBAAkB,iBAAiB,gDAAgD;YACnF,iBAAiB,MAAM,GAAG,CAC7B,CAAC;IACJ,CAAC;AACH,CAAC"}

package/dist/commonjs/web-acl-builder.d.ts

@@ -0,0 +1,152 @@
+import type { Alarm } from "aws-cdk-lib/aws-cloudwatch";
+import type { LogGroup } from "aws-cdk-lib/aws-logs";
+import { type CfnLoggingConfiguration, CfnWebACL, type CfnWebACLAssociation, type CfnWebACLProps } from "aws-cdk-lib/aws-wafv2";
+import type { IConstruct } from "constructs";
+import { COPY_STATE, type Lifecycle, type Resolvable } from "@composurecdk/core";
+import { type ITaggedBuilder } from "@composurecdk/cloudformation";
+import { type AlarmConfigurer } from "@composurecdk/cloudwatch";
+import type { WebAclAlarmConfig } from "./alarm-config.js";
+import { type WebAclAssociationTarget } from "./association.js";
+import { type CustomResponse } from "./custom-response.js";
+import { type IWebAclRuleBuilder } from "./rule-builder.js";
+import { type WebAclLoggingConfig } from "./logging.js";
+import { type WebAclMetrics } from "./metrics.js";
+import { type WebAclScope } from "./scope.js";
+/**
+ * Configuration for {@link createWebAclBuilder}: CDK's `CfnWebACLProps`, less
+ * what the builder owns. Rules, the default action and associations have
+ * their own methods; custom response bodies and the visibility config are
+ * generated.
+ */
+export interface WebAclBuilderProps extends Omit<CfnWebACLProps, "scope" | "defaultAction" | "rules" | "customResponseBodies" | "visibilityConfig" | "tags"> {
+    /**
+     * `REGIONAL` (the default) for API Gateway, Application Load Balancers,
+     * AppSync, Cognito, App Runner and Verified Access; `CLOUDFRONT` for
+     * CloudFront distributions, which must be deployed in `us-east-1`.
+     */
+    scope?: WebAclScope;
+    /**
+     * The name of the web ACL's CloudWatch metrics. Defaults to its `name` when
+     * that is set, and otherwise to a name derived from its construct path, so
+     * two web ACLs never share metrics.
+     */
+    metricName?: string;
+    /**
+     * Whether WAF keeps samples of the requests the web ACL and its rules
+     * inspect. Off by default: samples keep every header, and logging's
+     * redaction does not apply to them. Turning it on without a
+     * `dataProtectionConfig` warns.
+     */
+    sampledRequests?: boolean;
+    /**
+     * The web ACL's logging. On by default, to a created `aws-waf-logs-`
+     * CloudWatch log group, keeping only the requests WAF does not allow and
+     * redacting the `authorization` and `cookie` headers. `false` turns it off.
+     *
+     * @see https://docs.aws.amazon.com/wellarchitected/latest/security-pillar/sec_detect_investigate_events_app_service_logging.html
+     */
+    logging?: WebAclLoggingConfig | false;
+    /**
+     * The master switch for the recommended alarms, which are configured per
+     * rule with the rule builder's `.alarms()`. `false` creates none; alarms
+     * added with `addAlarm()` are unaffected.
+     *
+     * No alarm actions are configured; apply them from the result or with
+     * `alarmActionsPolicy`.
+     */
+    recommendedAlarms?: WebAclAlarmConfig | false;
+}
+/** The build output of an {@link IWebAclBuilder}. */
+export interface WebAclBuilderResult {
+    /** The web ACL. */
+    webAcl: CfnWebACL;
+    /**
+     * One association per `associateWith` call, in that order. Empty for a
+     * CLOUDFRONT web ACL, which a distribution references by `webAclId`.
+     */
+    associations: CfnWebACLAssociation[];
+    /** The log group WAF writes to. Absent when logging is off or goes to your own destination. */
+    logGroup?: LogGroup;
+    /** The logging configuration. Absent when logging is off. */
+    logging?: CfnLoggingConfiguration;
+    /**
+     * The web ACL's metrics, for the ACL, the default action and each rule,
+     * with dimensions that match what WAF publishes.
+     */
+    metrics: WebAclMetrics;
+    /** The CloudWatch alarms created, recommended and custom, keyed by alarm key. */
+    alarms: Record<string, Alarm>;
+}
+/**
+ * A fluent builder for an AWS WAF web ACL.
+ *
+ * @see {@link createWebAclBuilder}
+ */
+export type IWebAclBuilder = ITaggedBuilder<WebAclBuilderProps, WebAclBuilder>;
+declare class WebAclBuilder implements Lifecycle<WebAclBuilderResult> {
+    #private;
+    props: Partial<WebAclBuilderProps>;
+    /**
+     * What happens to a request no rule decides on. `allow` is the default;
+     * `block` can answer with a custom response.
+     */
+    defaultAction(action: "allow" | "block", response?: CustomResponse): this;
+    /**
+     * Adds a rule. Rules are evaluated in the order they are added, unless a
+     * rule sets its own `.priority(n)`.
+     *
+     * @param name - Unique within the web ACL; also the rule's default metric name.
+     * @param configure - Sets the rule's statement, action and the rest.
+     */
+    addRule(name: string, configure: (rule: IWebAclRuleBuilder) => IWebAclRuleBuilder): this;
+    /**
+     * Protects a regional resource with this web ACL. Call it once per
+     * resource. Accepts an ARN, a CDK reference CloudFormation's
+     * `AWS::WAFv2::WebACLAssociation` takes (an Application Load Balancer, an
+     * AppSync API), or an API Gateway stage, as a concrete value or a `ref`.
+     *
+     * A CLOUDFRONT web ACL cannot be associated: pass its ARN to the
+     * distribution's `webAclId` instead.
+     */
+    associateWith(target: Resolvable<WebAclAssociationTarget>): this;
+    /**
+     * Adds a custom alarm. The metric factory receives the web ACL's
+     * {@link WebAclMetrics}, so a rule's metrics come by its name:
+     * `(m) => m.rule("PerIpRate").countedRequests()`.
+     */
+    addAlarm(key: string, configure: AlarmConfigurer<WebAclMetrics>): this;
+    /**
+     * Adds a set of custom alarms in one call: each entry exactly as if by
+     * `addAlarm(key, configure)`, in the record's iteration order.
+     */
+    addAlarms(alarms: Record<string, AlarmConfigurer<WebAclMetrics>>): this;
+    /** @internal — see ADR-0005. */
+    [COPY_STATE](target: WebAclBuilder): void;
+    build(scope: IConstruct, id: string, context?: Record<string, object>): WebAclBuilderResult;
+}
+/**
+ * Creates a builder for an AWS WAF web ACL, with its rules, its associations
+ * and the visibility settings the rest of the package relies on.
+ *
+ * By default the web ACL is regional, allows what no rule blocks, publishes
+ * CloudWatch metrics for itself and every rule ({@link WEB_ACL_VISIBILITY_DEFAULTS}),
+ * and keeps no sampled requests ({@link WEB_ACL_DEFAULTS}).
+ *
+ * @example
+ * ```ts
+ * createWebAclBuilder()
+ *   .associateWith(ref("api", (r: RestApiBuilderResult) => r.api.deploymentStage))
+ *   .addRule("BlockAdmin", (rule) =>
+ *     rule.statement({
+ *       byteMatchStatement: {
+ *         fieldToMatch: { uriPath: {} },
+ *         positionalConstraint: "STARTS_WITH",
+ *         searchString: "/admin",
+ *         textTransformations: [{ priority: 0, type: "NONE" }],
+ *       },
+ *     }).respond(404));
+ * ```
+ */
+export declare function createWebAclBuilder(): IWebAclBuilder;
+export {};
+//# sourceMappingURL=web-acl-builder.d.ts.map

package/dist/commonjs/web-acl-builder.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"web-acl-builder.d.ts","sourceRoot":"","sources":["../../src/web-acl-builder.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,KAAK,EAAE,MAAM,4BAA4B,CAAC;AACxD,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,sBAAsB,CAAC;AACrD,OAAO,EACL,KAAK,uBAAuB,EAC5B,SAAS,EACT,KAAK,oBAAoB,EACzB,KAAK,cAAc,EACpB,MAAM,uBAAuB,CAAC;AAC/B,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,YAAY,CAAC;AAC7C,OAAO,EAAE,UAAU,EAAE,KAAK,SAAS,EAAW,KAAK,UAAU,EAAE,MAAM,oBAAoB,CAAC;AAC1F,OAAO,EAAE,KAAK,cAAc,EAAiB,MAAM,8BAA8B,CAAC;AAClF,OAAO,EACL,KAAK,eAAe,EAGrB,MAAM,0BAA0B,CAAC;AAClC,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,mBAAmB,CAAC;AAE3D,OAAO,EAAa,KAAK,uBAAuB,EAAE,MAAM,kBAAkB,CAAC;AAC3E,OAAO,EAAE,KAAK,cAAc,EAAwB,MAAM,sBAAsB,CAAC;AAajF,OAAO,EAGL,KAAK,kBAAkB,EACxB,MAAM,mBAAmB,CAAC;AAC3B,OAAO,EAAoB,KAAK,mBAAmB,EAAE,MAAM,cAAc,CAAC;AAC1E,OAAO,EAAE,KAAK,aAAa,EAAiB,MAAM,cAAc,CAAC;AACjE,OAAO,EAAyB,KAAK,WAAW,EAAE,MAAM,YAAY,CAAC;AAErE;;;;;GAKG;AACH,MAAM,WAAW,kBAAmB,SAAQ,IAAI,CAC9C,cAAc,EACd,OAAO,GAAG,eAAe,GAAG,OAAO,GAAG,sBAAsB,GAAG,kBAAkB,GAAG,MAAM,CAC3F;IACC;;;;OAIG;IACH,KAAK,CAAC,EAAE,WAAW,CAAC;IAEpB;;;;OAIG;IACH,UAAU,CAAC,EAAE,MAAM,CAAC;IAEpB;;;;;OAKG;IACH,eAAe,CAAC,EAAE,OAAO,CAAC;IAE1B;;;;;;OAMG;IACH,OAAO,CAAC,EAAE,mBAAmB,GAAG,KAAK,CAAC;IAEtC;;;;;;;OAOG;IACH,iBAAiB,CAAC,EAAE,iBAAiB,GAAG,KAAK,CAAC;CAC/C;AAED,qDAAqD;AACrD,MAAM,WAAW,mBAAmB;IAClC,mBAAmB;IACnB,MAAM,EAAE,SAAS,CAAC;IAClB;;;OAGG;IACH,YAAY,EAAE,oBAAoB,EAAE,CAAC;IACrC,+FAA+F;IAC/F,QAAQ,CAAC,EAAE,QAAQ,CAAC;IACpB,6DAA6D;IAC7D,OAAO,CAAC,EAAE,uBAAuB,CAAC;IAClC;;;OAGG;IACH,OAAO,EAAE,aAAa,CAAC;IACvB,iFAAiF;IACjF,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,KAAK,CAAC,CAAC;CAC/B;AAED;;;;GAIG;AACH,MAAM,MAAM,cAAc,GAAG,cAAc,CAAC,kBAAkB,EAAE,aAAa,CAAC,CAAC;AAe/E,cAAM,aAAc,YAAW,SAAS,CAAC,mBAAmB,CAAC;;IAC3D,KAAK,EAAE,OAAO,CAAC,kBAAkB,CAAC,CAAM;IAMxC;;;OAGG;IACH,aAAa,CAAC,MAAM,EAAE,OAAO,GAAG,OAAO,EAAE,QAAQ,CAAC,EAAE,cAAc,GAAG,IAAI;IAQzE;;;;;;OAMG;IACH,OAAO,CAAC,IAAI,EAAE,MAAM,EAAE,SAAS,EAAE,CAAC,IAAI,EAAE,kBAAkB,KAAK,kBAAkB,GAAG,IAAI;IAWxF;;;;;;;;OAQG;IACH,aAAa,CAAC,MAAM,EAAE,UAAU,CAAC,uBAAuB,CAAC,GAAG,IAAI;IAKhE;;;;OAIG;IACH,QAAQ,CAAC,GAAG,EAAE,MAAM,EAAE,SAAS,EAAE,eAAe,CAAC,aAAa,CAAC,GAAG,IAAI;IAKtE;;;OAGG;IACH,SAAS,CAAC,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,eAAe,CAAC,aAAa,CAAC,CAAC,GAAG,IAAI;IAOvE,gCAAgC;IAChC,CAAC,UAAU,CAAC,CAAC,MAAM,EAAE,aAAa,GAAG,IAAI;IAOzC,KAAK,CAAC,KAAK,EAAE,UAAU,EAAE,EAAE,EAAE,MAAM,EAAE,OAAO,GAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAM,GAAG,mBAAmB;CA4HhG;AAED;;;;;;;;;;;;;;;;;;;;;;GAsBG;AACH,wBAAgB,mBAAmB,IAAI,cAAc,CAEpD"}

package/dist/commonjs/web-acl-builder.js

@@ -0,0 +1,205 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.createWebAclBuilder = createWebAclBuilder;
+const aws_cdk_lib_1 = require("aws-cdk-lib");
+const aws_wafv2_1 = require("aws-cdk-lib/aws-wafv2");
+const core_1 = require("@composurecdk/core");
+const cloudformation_1 = require("@composurecdk/cloudformation");
+const cloudwatch_1 = require("@composurecdk/cloudwatch");
+const alarms_js_1 = require("./alarms.js");
+const association_js_1 = require("./association.js");
+const custom_response_js_1 = require("./custom-response.js");
+const defaults_js_1 = require("./defaults.js");
+const names_js_1 = require("./names.js");
+const rule_builder_js_1 = require("./rule-builder.js");
+const logging_js_1 = require("./logging.js");
+const metrics_js_1 = require("./metrics.js");
+const scope_js_1 = require("./scope.js");
+const SAMPLING_ANNOTATION = "@composurecdk/wafv2:sampling-unredacted";
+const MAX_RATE_BASED_RULES = 10;
+class WebAclBuilder {
+    props = {};
+    #rules = [];
+    #associations = [];
+    #defaultAction = { action: "allow" };
+    #customAlarms = [];
+    /**
+     * What happens to a request no rule decides on. `allow` is the default;
+     * `block` can answer with a custom response.
+     */
+    defaultAction(action, response) {
+        if (action === "allow" && response !== undefined) {
+            throw new Error(`defaultAction("allow") cannot take a custom response; only Block can.`);
+        }
+        this.#defaultAction = { action, response };
+        return this;
+    }
+    /**
+     * Adds a rule. Rules are evaluated in the order they are added, unless a
+     * rule sets its own `.priority(n)`.
+     *
+     * @param name - Unique within the web ACL; also the rule's default metric name.
+     * @param configure - Sets the rule's statement, action and the rest.
+     */
+    addRule(name, configure) {
+        (0, names_js_1.validateRuleName)(name);
+        if (this.#rules.some((r) => r.name === name)) {
+            throw new Error(`WebAclBuilder.addRule: duplicate rule name "${name}". Each rule must have a unique name.`);
+        }
+        this.#rules.push({ name, configure });
+        return this;
+    }
+    /**
+     * Protects a regional resource with this web ACL. Call it once per
+     * resource. Accepts an ARN, a CDK reference CloudFormation's
+     * `AWS::WAFv2::WebACLAssociation` takes (an Application Load Balancer, an
+     * AppSync API), or an API Gateway stage, as a concrete value or a `ref`.
+     *
+     * A CLOUDFRONT web ACL cannot be associated: pass its ARN to the
+     * distribution's `webAclId` instead.
+     */
+    associateWith(target) {
+        this.#associations.push(target);
+        return this;
+    }
+    /**
+     * Adds a custom alarm. The metric factory receives the web ACL's
+     * {@link WebAclMetrics}, so a rule's metrics come by its name:
+     * `(m) => m.rule("PerIpRate").countedRequests()`.
+     */
+    addAlarm(key, configure) {
+        this.#customAlarms.push(configure(new cloudwatch_1.AlarmDefinitionBuilder(key)));
+        return this;
+    }
+    /**
+     * Adds a set of custom alarms in one call: each entry exactly as if by
+     * `addAlarm(key, configure)`, in the record's iteration order.
+     */
+    addAlarms(alarms) {
+        for (const [key, configure] of Object.entries(alarms)) {
+            this.addAlarm(key, configure);
+        }
+        return this;
+    }
+    /** @internal — see ADR-0005. */
+    [core_1.COPY_STATE](target) {
+        target.#rules.push(...this.#rules);
+        target.#associations.push(...this.#associations);
+        target.#defaultAction = this.#defaultAction;
+        target.#customAlarms.push(...this.#customAlarms);
+    }
+    build(scope, id, context = {}) {
+        const owner = `WebAclBuilder "${id}"`;
+        const { scope: aclScope = defaults_js_1.WEB_ACL_DEFAULTS.scope, metricName: userMetricName, sampledRequests = defaults_js_1.WEB_ACL_DEFAULTS.sampledRequests, logging: loggingConfig = defaults_js_1.WEB_ACL_DEFAULTS.logging, recommendedAlarms, ...rest } = this.props;
+        if (rest.name !== undefined)
+            (0, names_js_1.validateWebAclName)(rest.name);
+        if (aclScope === "CLOUDFRONT") {
+            if (this.#associations.length > 0) {
+                throw new Error(`${owner} has scope CLOUDFRONT, so it cannot be associated with associateWith(). ` +
+                    `Pass its ARN (result.webAcl.attrArn) to the distribution's webAclId instead.`);
+            }
+            (0, scope_js_1.checkCloudFrontRegion)(scope, id);
+        }
+        if (userMetricName !== undefined)
+            (0, names_js_1.validateMetricName)(userMetricName);
+        const bodies = new custom_response_js_1.CustomResponseBodies(owner);
+        const { action, response } = this.#defaultAction;
+        const defaultAction = action === "allow"
+            ? { allow: {} }
+            : { block: bodies.block("default action", "DefaultAction", response) };
+        const rules = this.#buildRules(owner, bodies, sampledRequests);
+        const usesSampling = sampledRequests || rules.some((r) => r.sampled);
+        // Read through `in`, not as a typed property: `dataProtectionConfig` is not in
+        // CfnWebACLProps at this package's aws-cdk-lib floor (2.93.0), so it only
+        // reaches `rest` as a pass-through prop on a newer install.
+        const hasDataProtection = "dataProtectionConfig" in rest && rest.dataProtectionConfig !== undefined;
+        if (usesSampling && !hasDataProtection) {
+            aws_cdk_lib_1.Annotations.of(scope).addWarningV2(SAMPLING_ANNOTATION, `${owner} keeps sampled requests without a dataProtectionConfig. Samples keep every ` +
+                `header and are not redacted by logging, so credentials in them are visible in the ` +
+                `console. Set a dataProtectionConfig, or turn sampling off.`);
+        }
+        // The derived name comes from the construct's path, so it is read once the construct exists.
+        const metricName = userMetricName ??
+            aws_cdk_lib_1.Lazy.string({ produce: () => (0, names_js_1.sanitizeMetricName)((0, names_js_1.webAclBaseName)(webAcl)) });
+        const webAcl = new aws_wafv2_1.CfnWebACL(scope, id, {
+            ...rest,
+            scope: aclScope,
+            defaultAction,
+            rules: rules.map((r) => r.property),
+            customResponseBodies: bodies.toProperty(),
+            visibilityConfig: {
+                ...defaults_js_1.WEB_ACL_VISIBILITY_DEFAULTS,
+                metricName,
+                sampledRequestsEnabled: sampledRequests,
+            },
+        });
+        const associations = (0, association_js_1.associate)(scope, id, webAcl.attrArn, this.#associations.map((target) => (0, core_1.resolve)(target, context)));
+        const metrics = (0, metrics_js_1.webAclMetrics)(webAcl, metricName, new Map(rules.map((r) => [r.property.name, r.metricName])));
+        const alarms = (0, cloudwatch_1.createAlarms)(scope, id, [
+            ...(0, alarms_js_1.resolveWebAclAlarmDefinitions)(owner, metrics, rules, recommendedAlarms),
+            ...this.#customAlarms.map((b) => b.resolve(metrics)),
+        ]);
+        return {
+            webAcl,
+            associations,
+            ...(0, logging_js_1.configureLogging)(scope, id, owner, webAcl, loggingConfig, context),
+            metrics,
+            alarms,
+        };
+    }
+    #buildRules(owner, bodies, sampledRequests) {
+        const rules = this.#rules.map((entry, index) => {
+            const builder = (0, rule_builder_js_1.createWebAclRuleBuilder)();
+            entry.configure(builder);
+            return builder.toRule({
+                name: entry.name,
+                owner,
+                defaultPriority: index * defaults_js_1.DEFAULT_RULE_PRIORITY_STEP,
+                sampledRequests,
+                bodies,
+            });
+        });
+        const byPriority = new Map();
+        for (const { property: rule } of rules) {
+            const other = byPriority.get(rule.priority);
+            if (other !== undefined) {
+                throw new Error(`${owner}: rules "${other}" and "${rule.name}" both have priority ${String(rule.priority)}. ` +
+                    `Priorities must be unique; change one rule's .priority(n).`);
+            }
+            byPriority.set(rule.priority, rule.name);
+        }
+        const rateBased = rules.filter((r) => r.rateBased);
+        if (rateBased.length > MAX_RATE_BASED_RULES) {
+            throw new Error(`${owner} has ${String(rateBased.length)} rate-based rules; AWS WAF allows at most ` +
+                `${String(MAX_RATE_BASED_RULES)} per web ACL. See https://docs.aws.amazon.com/waf/latest/developerguide/limits.html.`);
+        }
+        return rules;
+    }
+}
+/**
+ * Creates a builder for an AWS WAF web ACL, with its rules, its associations
+ * and the visibility settings the rest of the package relies on.
+ *
+ * By default the web ACL is regional, allows what no rule blocks, publishes
+ * CloudWatch metrics for itself and every rule ({@link WEB_ACL_VISIBILITY_DEFAULTS}),
+ * and keeps no sampled requests ({@link WEB_ACL_DEFAULTS}).
+ *
+ * @example
+ * ```ts
+ * createWebAclBuilder()
+ *   .associateWith(ref("api", (r: RestApiBuilderResult) => r.api.deploymentStage))
+ *   .addRule("BlockAdmin", (rule) =>
+ *     rule.statement({
+ *       byteMatchStatement: {
+ *         fieldToMatch: { uriPath: {} },
+ *         positionalConstraint: "STARTS_WITH",
+ *         searchString: "/admin",
+ *         textTransformations: [{ priority: 0, type: "NONE" }],
+ *       },
+ *     }).respond(404));
+ * ```
+ */
+function createWebAclBuilder() {
+    return (0, cloudformation_1.taggedBuilder)(WebAclBuilder);
+}
+//# sourceMappingURL=web-acl-builder.js.map

package/dist/commonjs/web-acl-builder.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"web-acl-builder.js","sourceRoot":"","sources":["../../src/web-acl-builder.ts"],"names":[],"mappings":";;AA6WA,kDAEC;AA/WD,6CAAgD;AAGhD,qDAK+B;AAE/B,6CAA0F;AAC1F,iEAAkF;AAClF,yDAIkC;AAElC,2CAA4D;AAC5D,qDAA2E;AAC3E,6DAAiF;AACjF,+CAIuB;AACvB,yCAMoB;AACpB,uDAI2B;AAC3B,6CAA0E;AAC1E,6CAAiE;AACjE,yCAAqE;AA6FrE,MAAM,mBAAmB,GAAG,yCAAyC,CAAC;AACtE,MAAM,oBAAoB,GAAG,EAAE,CAAC;AAEhC,MAAM,aAAa;IACjB,KAAK,GAAgC,EAAE,CAAC;IAC/B,MAAM,GAAgB,EAAE,CAAC;IACzB,aAAa,GAA0C,EAAE,CAAC;IACnE,cAAc,GAAkB,EAAE,MAAM,EAAE,OAAO,EAAE,CAAC;IAC3C,aAAa,GAA4C,EAAE,CAAC;IAErE;;;OAGG;IACH,aAAa,CAAC,MAAyB,EAAE,QAAyB;QAChE,IAAI,MAAM,KAAK,OAAO,IAAI,QAAQ,KAAK,SAAS,EAAE,CAAC;YACjD,MAAM,IAAI,KAAK,CAAC,uEAAuE,CAAC,CAAC;QAC3F,CAAC;QACD,IAAI,CAAC,cAAc,GAAG,EAAE,MAAM,EAAE,QAAQ,EAAE,CAAC;QAC3C,OAAO,IAAI,CAAC;IACd,CAAC;IAED;;;;;;OAMG;IACH,OAAO,CAAC,IAAY,EAAE,SAA2D;QAC/E,IAAA,2BAAgB,EAAC,IAAI,CAAC,CAAC;QACvB,IAAI,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,KAAK,IAAI,CAAC,EAAE,CAAC;YAC7C,MAAM,IAAI,KAAK,CACb,+CAA+C,IAAI,uCAAuC,CAC3F,CAAC;QACJ,CAAC;QACD,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,SAAS,EAAE,CAAC,CAAC;QACtC,OAAO,IAAI,CAAC;IACd,CAAC;IAED;;;;;;;;OAQG;IACH,aAAa,CAAC,MAA2C;QACvD,IAAI,CAAC,aAAa,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;QAChC,OAAO,IAAI,CAAC;IACd,CAAC;IAED;;;;OAIG;IACH,QAAQ,CAAC,GAAW,EAAE,SAAyC;QAC7D,IAAI,CAAC,aAAa,CAAC,IAAI,CAAC,SAAS,CAAC,IAAI,mCAAsB,CAAgB,GAAG,CAAC,CAAC,CAAC,CAAC;QACnF,OAAO,IAAI,CAAC;IACd,CAAC;IAED;;;OAGG;IACH,SAAS,CAAC,MAAsD;QAC9D,KAAK,MAAM,CAAC,GAAG,EAAE,SAAS,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC,EAAE,CAAC;YACtD,IAAI,CAAC,QAAQ,CAAC,GAAG,EAAE,SAAS,CAAC,CAAC;QAChC,CAAC;QACD,OAAO,IAAI,CAAC;IACd,CAAC;IAED,gCAAgC;IAChC,CAAC,iBAAU,CAAC,CAAC,MAAqB;QAChC,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,GAAG,IAAI,CAAC,MAAM,CAAC,CAAC;QACnC,MAAM,CAAC,aAAa,CAAC,IAAI,CAAC,GAAG,IAAI,CAAC,aAAa,CAAC,CAAC;QACjD,MAAM,CAAC,cAAc,GAAG,IAAI,CAAC,cAAc,CAAC;QAC5C,MAAM,CAAC,aAAa,CAAC,IAAI,CAAC,GAAG,IAAI,CAAC,aAAa,CAAC,CAAC;IACnD,CAAC;IAED,KAAK,CAAC,KAAiB,EAAE,EAAU,EAAE,UAAkC,EAAE;QACvE,MAAM,KAAK,GAAG,kBAAkB,EAAE,GAAG,CAAC;QACtC,MAAM,EACJ,KAAK,EAAE,QAAQ,GAAG,8BAAgB,CAAC,KAAK,EACxC,UAAU,EAAE,cAAc,EAC1B,eAAe,GAAG,8BAAgB,CAAC,eAAe,EAClD,OAAO,EAAE,aAAa,GAAG,8BAAgB,CAAC,OAAO,EACjD,iBAAiB,EACjB,GAAG,IAAI,EACR,GAAG,IAAI,CAAC,KAAK,CAAC;QAEf,IAAI,IAAI,CAAC,IAAI,KAAK,SAAS;YAAE,IAAA,6BAAkB,EAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QAC3D,IAAI,QAAQ,KAAK,YAAY,EAAE,CAAC;YAC9B,IAAI,IAAI,CAAC,aAAa,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;gBAClC,MAAM,IAAI,KAAK,CACb,GAAG,KAAK,0EAA0E;oBAChF,8EAA8E,CACjF,CAAC;YACJ,CAAC;YACD,IAAA,gCAAqB,EAAC,KAAK,EAAE,EAAE,CAAC,CAAC;QACnC,CAAC;QAED,IAAI,cAAc,KAAK,SAAS;YAAE,IAAA,6BAAkB,EAAC,cAAc,CAAC,CAAC;QAErE,MAAM,MAAM,GAAG,IAAI,yCAAoB,CAAC,KAAK,CAAC,CAAC;QAC/C,MAAM,EAAE,MAAM,EAAE,QAAQ,EAAE,GAAG,IAAI,CAAC,cAAc,CAAC;QACjD,MAAM,aAAa,GACjB,MAAM,KAAK,OAAO;YAChB,CAAC,CAAC,EAAE,KAAK,EAAE,EAAE,EAAE;YACf,CAAC,CAAC,EAAE,KAAK,EAAE,MAAM,CAAC,KAAK,CAAC,gBAAgB,EAAE,eAAe,EAAE,QAAQ,CAAC,EAAE,CAAC;QAC3E,MAAM,KAAK,GAAG,IAAI,CAAC,WAAW,CAAC,KAAK,EAAE,MAAM,EAAE,eAAe,CAAC,CAAC;QAC/D,MAAM,YAAY,GAAG,eAAe,IAAI,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC;QACrE,+EAA+E;QAC/E,0EAA0E;QAC1E,4DAA4D;QAC5D,MAAM,iBAAiB,GACrB,sBAAsB,IAAI,IAAI,IAAI,IAAI,CAAC,oBAAoB,KAAK,SAAS,CAAC;QAC5E,IAAI,YAAY,IAAI,CAAC,iBAAiB,EAAE,CAAC;YACvC,yBAAW,CAAC,EAAE,CAAC,KAAK,CAAC,CAAC,YAAY,CAChC,mBAAmB,EACnB,GAAG,KAAK,6EAA6E;gBACnF,oFAAoF;gBACpF,4DAA4D,CAC/D,CAAC;QACJ,CAAC;QAED,6FAA6F;QAC7F,MAAM,UAAU,GACd,cAAc;YACd,kBAAI,CAAC,MAAM,CAAC,EAAE,OAAO,EAAE,GAAW,EAAE,CAAC,IAAA,6BAAkB,EAAC,IAAA,yBAAc,EAAC,MAAM,CAAC,CAAC,EAAE,CAAC,CAAC;QACrF,MAAM,MAAM,GAAc,IAAI,qBAAS,CAAC,KAAK,EAAE,EAAE,EAAE;YACjD,GAAG,IAAI;YACP,KAAK,EAAE,QAAQ;YACf,aAAa;YACb,KAAK,EAAE,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,QAAQ,CAAC;YACnC,oBAAoB,EAAE,MAAM,CAAC,UAAU,EAAE;YACzC,gBAAgB,EAAE;gBAChB,GAAG,yCAA2B;gBAC9B,UAAU;gBACV,sBAAsB,EAAE,eAAe;aACxC;SACF,CAAC,CAAC;QAEH,MAAM,YAAY,GAAG,IAAA,0BAAS,EAC5B,KAAK,EACL,EAAE,EACF,MAAM,CAAC,OAAO,EACd,IAAI,CAAC,aAAa,CAAC,GAAG,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,IAAA,cAAO,EAAC,MAAM,EAAE,OAAO,CAAC,CAAC,CAC7D,CAAC;QAEF,MAAM,OAAO,GAAG,IAAA,0BAAa,EAC3B,MAAM,EACN,UAAU,EACV,IAAI,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,IAAI,EAAE,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,CAC3D,CAAC;QACF,MAAM,MAAM,GAAG,IAAA,yBAAY,EAAC,KAAK,EAAE,EAAE,EAAE;YACrC,GAAG,IAAA,yCAA6B,EAAC,KAAK,EAAE,OAAO,EAAE,KAAK,EAAE,iBAAiB,CAAC;YAC1E,GAAG,IAAI,CAAC,aAAa,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC;SACrD,CAAC,CAAC;QAEH,OAAO;YACL,MAAM;YACN,YAAY;YACZ,GAAG,IAAA,6BAAgB,EAAC,KAAK,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,aAAa,EAAE,OAAO,CAAC;YACrE,OAAO;YACP,MAAM;SACP,CAAC;IACJ,CAAC;IAED,WAAW,CAAC,KAAa,EAAE,MAA4B,EAAE,eAAwB;QAC/E,MAAM,KAAK,GAAG,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,KAAK,EAAE,EAAE;YAC7C,MAAM,OAAO,GAAG,IAAA,yCAAuB,GAAE,CAAC;YAC1C,KAAK,CAAC,SAAS,CAAC,OAAO,CAAC,CAAC;YACzB,OAAO,OAAO,CAAC,MAAM,CAAC;gBACpB,IAAI,EAAE,KAAK,CAAC,IAAI;gBAChB,KAAK;gBACL,eAAe,EAAE,KAAK,GAAG,wCAA0B;gBACnD,eAAe;gBACf,MAAM;aACP,CAAC,CAAC;QACL,CAAC,CAAC,CAAC;QAEH,MAAM,UAAU,GAAG,IAAI,GAAG,EAAkB,CAAC;QAC7C,KAAK,MAAM,EAAE,QAAQ,EAAE,IAAI,EAAE,IAAI,KAAK,EAAE,CAAC;YACvC,MAAM,KAAK,GAAG,UAAU,CAAC,GAAG,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;YAC5C,IAAI,KAAK,KAAK,SAAS,EAAE,CAAC;gBACxB,MAAM,IAAI,KAAK,CACb,GAAG,KAAK,YAAY,KAAK,UAAU,IAAI,CAAC,IAAI,wBAAwB,MAAM,CAAC,IAAI,CAAC,QAAQ,CAAC,IAAI;oBAC3F,4DAA4D,CAC/D,CAAC;YACJ,CAAC;YACD,UAAU,CAAC,GAAG,CAAC,IAAI,CAAC,QAAQ,EAAE,IAAI,CAAC,IAAI,CAAC,CAAC;QAC3C,CAAC;QAED,MAAM,SAAS,GAAG,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC;QACnD,IAAI,SAAS,CAAC,MAAM,GAAG,oBAAoB,EAAE,CAAC;YAC5C,MAAM,IAAI,KAAK,CACb,GAAG,KAAK,QAAQ,MAAM,CAAC,SAAS,CAAC,MAAM,CAAC,4CAA4C;gBAClF,GAAG,MAAM,CAAC,oBAAoB,CAAC,sFAAsF,CACxH,CAAC;QACJ,CAAC;QAED,OAAO,KAAK,CAAC;IACf,CAAC;CACF;AAED;;;;;;;;;;;;;;;;;;;;;;GAsBG;AACH,SAAgB,mBAAmB;IACjC,OAAO,IAAA,8BAAa,EAAoC,aAAa,CAAC,CAAC;AACzE,CAAC"}