@composurecdk/wafv2 0.0.0-stage → 0.13.0

package/dist/esm/alarm-config.d.ts

@@ -0,0 +1,60 @@
+import type { AlarmConfig } from "@composurecdk/cloudwatch";
+/**
+ * Controls the web ACL's recommended alarms. They are per rule — see
+ * {@link WebAclRuleAlarmConfig} — so this is the master switch.
+ */
+export interface WebAclAlarmConfig {
+    /**
+     * Set to `false` to create none of the recommended alarms. Alarms added
+     * with `addAlarm()` are unaffected.
+     * @default true
+     */
+    enabled?: boolean;
+}
+/**
+ * Controls one rule's recommended alarms, set with the rule builder's
+ * `.alarms()`. Set an alarm to `false` to disable it, or to an
+ * {@link AlarmConfig} to enable it (if off by default) or tune it. Defaults
+ * are in {@link WEB_ACL_RULE_ALARM_DEFAULTS}.
+ *
+ * Every alarm treats missing data as not breaching: WAF publishes a
+ * datapoint only when the count is non-zero.
+ *
+ * AWS publishes no recommended alarms for WAF, so the thresholds are this
+ * library's starting points.
+ */
+export interface WebAclRuleAlarmConfig {
+    /**
+     * Set to `false` to disable all of this rule's recommended alarms.
+     * @default true
+     */
+    enabled?: boolean;
+    /**
+     * Alarm when the rule blocks requests: `BlockedRequests` (Sum, 5 minutes)
+     * above the threshold.
+     *
+     * On by default for a rule you wrote whose action is Block, where a block
+     * is a signal — a throttled client, a request missing its credentials.
+     * Off by default for a rule-group rule, whose managed rules block internet
+     * background noise all day; pass an {@link AlarmConfig} to turn it on.
+     * Never created for a rule that does not block.
+     *
+     * Default threshold: > 0 blocked requests in one 5-minute period.
+     */
+    blockedRequests?: AlarmConfig | false;
+    /**
+     * Alarm when a pinned managed rule group version is about to expire:
+     * `DaysToExpiry` (Minimum, 1 hour) below the threshold. Once a version
+     * expires, WAF rejects every update to the web ACL that does not move
+     * the group to a current version.
+     *
+     * On by default for a managed rule group with a `version`; never created
+     * otherwise.
+     *
+     * Default threshold: < 30 days.
+     *
+     * @see https://docs.aws.amazon.com/waf/latest/developerguide/waf-managed-rule-groups-versioning-expiration.html
+     */
+    daysToExpiry?: AlarmConfig | false;
+}
+//# sourceMappingURL=alarm-config.d.ts.map

package/dist/esm/alarm-config.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"alarm-config.d.ts","sourceRoot":"","sources":["../../src/alarm-config.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,0BAA0B,CAAC;AAE5D;;;GAGG;AACH,MAAM,WAAW,iBAAiB;IAChC;;;;OAIG;IACH,OAAO,CAAC,EAAE,OAAO,CAAC;CACnB;AAED;;;;;;;;;;;GAWG;AACH,MAAM,WAAW,qBAAqB;IACpC;;;OAGG;IACH,OAAO,CAAC,EAAE,OAAO,CAAC;IAElB;;;;;;;;;;;OAWG;IACH,eAAe,CAAC,EAAE,WAAW,GAAG,KAAK,CAAC;IAEtC;;;;;;;;;;;;OAYG;IACH,YAAY,CAAC,EAAE,WAAW,GAAG,KAAK,CAAC;CACpC"}

package/dist/esm/alarm-config.js

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=alarm-config.js.map

package/dist/esm/alarm-config.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"alarm-config.js","sourceRoot":"","sources":["../../src/alarm-config.ts"],"names":[],"mappings":""}

package/dist/esm/alarm-defaults.d.ts

@@ -0,0 +1,34 @@
+import { TreatMissingData } from "aws-cdk-lib/aws-cloudwatch";
+/**
+ * Default configuration of each rule's recommended alarms. AWS publishes no
+ * recommended alarms for WAF, so these are this library's starting points.
+ * Both treat missing data as not breaching, because WAF publishes a
+ * datapoint only when its value is non-zero.
+ */
+export declare const WEB_ACL_RULE_ALARM_DEFAULTS: {
+    /**
+     * Any block in a 5-minute period. A rule you wrote encodes your own
+     * contract — a credential every caller should send, a rate no client
+     * should reach — so a single block is worth a look. Raise the threshold
+     * on a rule that blocks routinely.
+     */
+    blockedRequests: {
+        threshold: number;
+        evaluationPeriods: number;
+        datapointsToAlarm: number;
+        treatMissingData: TreatMissingData.NOT_BREACHING;
+    };
+    /**
+     * Fewer than 30 days before a pinned version expires, which leaves time to
+     * test and move to a newer one.
+     *
+     * @see https://docs.aws.amazon.com/waf/latest/developerguide/waf-managed-rule-groups-best-practice.html
+     */
+    daysToExpiry: {
+        threshold: number;
+        evaluationPeriods: number;
+        datapointsToAlarm: number;
+        treatMissingData: TreatMissingData.NOT_BREACHING;
+    };
+};
+//# sourceMappingURL=alarm-defaults.d.ts.map

package/dist/esm/alarm-defaults.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"alarm-defaults.d.ts","sourceRoot":"","sources":["../../src/alarm-defaults.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,gBAAgB,EAAE,MAAM,4BAA4B,CAAC;AAG9D;;;;;GAKG;AACH,eAAO,MAAM,2BAA2B;IACtC;;;;;OAKG;;;;;;;IAQH;;;;;OAKG;;;;;;;CAO0C,CAAC"}

package/dist/esm/alarm-defaults.js

@@ -0,0 +1,34 @@
+import { TreatMissingData } from "aws-cdk-lib/aws-cloudwatch";
+/**
+ * Default configuration of each rule's recommended alarms. AWS publishes no
+ * recommended alarms for WAF, so these are this library's starting points.
+ * Both treat missing data as not breaching, because WAF publishes a
+ * datapoint only when its value is non-zero.
+ */
+export const WEB_ACL_RULE_ALARM_DEFAULTS = {
+    /**
+     * Any block in a 5-minute period. A rule you wrote encodes your own
+     * contract — a credential every caller should send, a rate no client
+     * should reach — so a single block is worth a look. Raise the threshold
+     * on a rule that blocks routinely.
+     */
+    blockedRequests: {
+        threshold: 0,
+        evaluationPeriods: 1,
+        datapointsToAlarm: 1,
+        treatMissingData: TreatMissingData.NOT_BREACHING,
+    },
+    /**
+     * Fewer than 30 days before a pinned version expires, which leaves time to
+     * test and move to a newer one.
+     *
+     * @see https://docs.aws.amazon.com/waf/latest/developerguide/waf-managed-rule-groups-best-practice.html
+     */
+    daysToExpiry: {
+        threshold: 30,
+        evaluationPeriods: 1,
+        datapointsToAlarm: 1,
+        treatMissingData: TreatMissingData.NOT_BREACHING,
+    },
+};
+//# sourceMappingURL=alarm-defaults.js.map

package/dist/esm/alarm-defaults.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"alarm-defaults.js","sourceRoot":"","sources":["../../src/alarm-defaults.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,gBAAgB,EAAE,MAAM,4BAA4B,CAAC;AAG9D;;;;;GAKG;AACH,MAAM,CAAC,MAAM,2BAA2B,GAAG;IACzC;;;;;OAKG;IACH,eAAe,EAAE;QACf,SAAS,EAAE,CAAC;QACZ,iBAAiB,EAAE,CAAC;QACpB,iBAAiB,EAAE,CAAC;QACpB,gBAAgB,EAAE,gBAAgB,CAAC,aAAa;KACjD;IAED;;;;;OAKG;IACH,YAAY,EAAE;QACZ,SAAS,EAAE,EAAE;QACb,iBAAiB,EAAE,CAAC;QACpB,iBAAiB,EAAE,CAAC;QACpB,gBAAgB,EAAE,gBAAgB,CAAC,aAAa;KACjD;CAC4C,CAAC"}

package/dist/esm/alarms.d.ts

@@ -0,0 +1,18 @@
+import { type AlarmDefinition } from "@composurecdk/cloudwatch";
+import type { WebAclAlarmConfig } from "./alarm-config.js";
+import { type WebAclMetrics } from "./metrics.js";
+import type { BuiltRule } from "./rule-builder.js";
+/**
+ * The alarm-key prefix for a rule: its name in camelCase, so `PerIpRate` and
+ * `per-ip-rate` both become `perIpRate`.
+ *
+ * @internal
+ */
+export declare function ruleAlarmKey(name: string): string;
+/**
+ * Resolves each rule's recommended alarms into {@link AlarmDefinition}s.
+ *
+ * @internal
+ */
+export declare function resolveWebAclAlarmDefinitions(owner: string, metrics: WebAclMetrics, rules: readonly BuiltRule[], config: WebAclAlarmConfig | false | undefined): AlarmDefinition[];
+//# sourceMappingURL=alarms.d.ts.map

package/dist/esm/alarms.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"alarms.d.ts","sourceRoot":"","sources":["../../src/alarms.ts"],"names":[],"mappings":"AAGA,OAAO,EAGL,KAAK,eAAe,EAGrB,MAAM,0BAA0B,CAAC;AAClC,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,mBAAmB,CAAC;AAE3D,OAAO,EAGL,KAAK,aAAa,EACnB,MAAM,cAAc,CAAC;AACtB,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,mBAAmB,CAAC;AAInD;;;;;GAKG;AACH,wBAAgB,YAAY,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,CAIjD;AAiBD;;;;GAIG;AACH,wBAAgB,6BAA6B,CAC3C,KAAK,EAAE,MAAM,EACb,OAAO,EAAE,aAAa,EACtB,KAAK,EAAE,SAAS,SAAS,EAAE,EAC3B,MAAM,EAAE,iBAAiB,GAAG,KAAK,GAAG,SAAS,GAC5C,eAAe,EAAE,CAkBnB"}

package/dist/esm/alarms.js

@@ -0,0 +1,90 @@
+import { Token } from "aws-cdk-lib";
+import { ComparisonOperator } from "aws-cdk-lib/aws-cloudwatch";
+import { resolveAlarmConfig, } from "@composurecdk/cloudwatch";
+import { WEB_ACL_RULE_ALARM_DEFAULTS } from "./alarm-defaults.js";
+import { REQUEST_METRIC_PERIOD, } from "./metrics.js";
+const PERIOD_LABEL = `${String(REQUEST_METRIC_PERIOD.toMinutes())} minutes`;
+/**
+ * The alarm-key prefix for a rule: its name in camelCase, so `PerIpRate` and
+ * `per-ip-rate` both become `perIpRate`.
+ *
+ * @internal
+ */
+export function ruleAlarmKey(name) {
+    const parts = name.split(/[-_]+/).filter(Boolean);
+    const pascal = parts.map((p) => p.charAt(0).toUpperCase() + p.slice(1)).join("");
+    return pascal.charAt(0).toLowerCase() + pascal.slice(1);
+}
+function isOff(config) {
+    return config === false || config?.enabled === false;
+}
+/** The managed rule group a statement pins to a version, if any. */
+function pinnedGroup(statement) {
+    // The rule builder only takes a `StatementProperty`, never a token.
+    const group = statement.managedRuleGroupStatement;
+    if (group === undefined || Token.isUnresolved(group))
+        return undefined;
+    const { vendorName, name, version } = group;
+    return version === undefined ? undefined : { vendorName, name, version };
+}
+/**
+ * Resolves each rule's recommended alarms into {@link AlarmDefinition}s.
+ *
+ * @internal
+ */
+export function resolveWebAclAlarmDefinitions(owner, metrics, rules, config) {
+    if (isOff(config))
+        return [];
+    const keys = new Map();
+    return rules.flatMap((rule) => {
+        const definitions = resolveRuleAlarms(metrics, rule);
+        if (definitions.length === 0)
+            return [];
+        const { name } = rule.property;
+        const key = ruleAlarmKey(name);
+        const other = keys.get(key);
+        if (other !== undefined) {
+            throw new Error(`${owner}: rules "${other}" and "${name}" both have alarm key "${key}", because ` +
+                `alarm keys are rule names in camelCase. Rename one of them.`);
+        }
+        keys.set(key, name);
+        return definitions;
+    });
+}
+function definition(key, metric, comparisonOperator, userConfig, defaults, describe) {
+    const { alarmName, threshold, evaluationPeriods, datapointsToAlarm, treatMissingData } = resolveAlarmConfig(userConfig, defaults);
+    return {
+        key,
+        alarmName,
+        metric,
+        threshold,
+        comparisonOperator,
+        evaluationPeriods,
+        datapointsToAlarm,
+        treatMissingData,
+        description: describe(threshold),
+    };
+}
+function resolveRuleAlarms(metrics, rule) {
+    const config = rule.alarms;
+    if (isOff(config))
+        return [];
+    const { name } = rule.property;
+    const key = ruleAlarmKey(name);
+    const definitions = [];
+    const blocked = config ? config.blockedRequests : undefined;
+    // A rule group's managed rules block background noise, so its alarm is opt-in.
+    if (rule.blocks && blocked !== false && (!rule.ruleGroup || blocked !== undefined)) {
+        definitions.push(definition(`${key}BlockedRequests`, metrics.rule(name).blockedRequests(), ComparisonOperator.GREATER_THAN_THRESHOLD, blocked, WEB_ACL_RULE_ALARM_DEFAULTS.blockedRequests, (t) => `WAF rule "${name}" is blocking requests. Threshold: > ${String(t)} blocked requests in ${PERIOD_LABEL}.`));
+    }
+    const group = pinnedGroup(rule.property.statement);
+    const expiry = config ? config.daysToExpiry : undefined;
+    if (group && expiry !== false) {
+        const version = Token.isUnresolved(group.version)
+            ? "its pinned version"
+            : `version ${group.version}`;
+        definitions.push(definition(`${key}DaysToExpiry`, metrics.daysToExpiry(group), ComparisonOperator.LESS_THAN_THRESHOLD, expiry, WEB_ACL_RULE_ALARM_DEFAULTS.daysToExpiry, (t) => `WAF rule "${name}" pins ${group.name} at ${version}, which expires in under ${String(t)} days. Move it to a newer version; WAF rejects updates to the web ACL once it expires.`));
+    }
+    return definitions;
+}
+//# sourceMappingURL=alarms.js.map

package/dist/esm/alarms.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"alarms.js","sourceRoot":"","sources":["../../src/alarms.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,KAAK,EAAE,MAAM,aAAa,CAAC;AACpC,OAAO,EAAE,kBAAkB,EAAE,MAAM,4BAA4B,CAAC;AAEhE,OAAO,EAKL,kBAAkB,GACnB,MAAM,0BAA0B,CAAC;AAElC,OAAO,EAAE,2BAA2B,EAAE,MAAM,qBAAqB,CAAC;AAClE,OAAO,EAEL,qBAAqB,GAEtB,MAAM,cAAc,CAAC;AAGtB,MAAM,YAAY,GAAG,GAAG,MAAM,CAAC,qBAAqB,CAAC,SAAS,EAAE,CAAC,UAAU,CAAC;AAE5E;;;;;GAKG;AACH,MAAM,UAAU,YAAY,CAAC,IAAY;IACvC,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC;IAClD,MAAM,MAAM,GAAG,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,WAAW,EAAE,GAAG,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;IACjF,OAAO,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,WAAW,EAAE,GAAG,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;AAC1D,CAAC;AAED,SAAS,KAAK,CAAC,MAAiD;IAC9D,OAAO,MAAM,KAAK,KAAK,IAAI,MAAM,EAAE,OAAO,KAAK,KAAK,CAAC;AACvD,CAAC;AAED,oEAAoE;AACpE,SAAS,WAAW,CAClB,SAA8C;IAE9C,oEAAoE;IACpE,MAAM,KAAK,GAAI,SAAyC,CAAC,yBAAyB,CAAC;IACnF,IAAI,KAAK,KAAK,SAAS,IAAI,KAAK,CAAC,YAAY,CAAC,KAAK,CAAC;QAAE,OAAO,SAAS,CAAC;IACvE,MAAM,EAAE,UAAU,EAAE,IAAI,EAAE,OAAO,EAAE,GAAG,KAAoD,CAAC;IAC3F,OAAO,OAAO,KAAK,SAAS,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,EAAE,UAAU,EAAE,IAAI,EAAE,OAAO,EAAE,CAAC;AAC3E,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,6BAA6B,CAC3C,KAAa,EACb,OAAsB,EACtB,KAA2B,EAC3B,MAA6C;IAE7C,IAAI,KAAK,CAAC,MAAM,CAAC;QAAE,OAAO,EAAE,CAAC;IAC7B,MAAM,IAAI,GAAG,IAAI,GAAG,EAAkB,CAAC;IACvC,OAAO,KAAK,CAAC,OAAO,CAAC,CAAC,IAAI,EAAE,EAAE;QAC5B,MAAM,WAAW,GAAG,iBAAiB,CAAC,OAAO,EAAE,IAAI,CAAC,CAAC;QACrD,IAAI,WAAW,CAAC,MAAM,KAAK,CAAC;YAAE,OAAO,EAAE,CAAC;QACxC,MAAM,EAAE,IAAI,EAAE,GAAG,IAAI,CAAC,QAAQ,CAAC;QAC/B,MAAM,GAAG,GAAG,YAAY,CAAC,IAAI,CAAC,CAAC;QAC/B,MAAM,KAAK,GAAG,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;QAC5B,IAAI,KAAK,KAAK,SAAS,EAAE,CAAC;YACxB,MAAM,IAAI,KAAK,CACb,GAAG,KAAK,YAAY,KAAK,UAAU,IAAI,0BAA0B,GAAG,aAAa;gBAC/E,6DAA6D,CAChE,CAAC;QACJ,CAAC;QACD,IAAI,CAAC,GAAG,CAAC,GAAG,EAAE,IAAI,CAAC,CAAC;QACpB,OAAO,WAAW,CAAC;IACrB,CAAC,CAAC,CAAC;AACL,CAAC;AAED,SAAS,UAAU,CACjB,GAAW,EACX,MAAmB,EACnB,kBAAsC,EACtC,UAAmC,EACnC,QAA6B,EAC7B,QAAuC;IAEvC,MAAM,EAAE,SAAS,EAAE,SAAS,EAAE,iBAAiB,EAAE,iBAAiB,EAAE,gBAAgB,EAAE,GACpF,kBAAkB,CAAC,UAAU,EAAE,QAAQ,CAAC,CAAC;IAC3C,OAAO;QACL,GAAG;QACH,SAAS;QACT,MAAM;QACN,SAAS;QACT,kBAAkB;QAClB,iBAAiB;QACjB,iBAAiB;QACjB,gBAAgB;QAChB,WAAW,EAAE,QAAQ,CAAC,SAAS,CAAC;KACjC,CAAC;AACJ,CAAC;AAED,SAAS,iBAAiB,CAAC,OAAsB,EAAE,IAAe;IAChE,MAAM,MAAM,GAAG,IAAI,CAAC,MAAM,CAAC;IAC3B,IAAI,KAAK,CAAC,MAAM,CAAC;QAAE,OAAO,EAAE,CAAC;IAC7B,MAAM,EAAE,IAAI,EAAE,GAAG,IAAI,CAAC,QAAQ,CAAC;IAC/B,MAAM,GAAG,GAAG,YAAY,CAAC,IAAI,CAAC,CAAC;IAC/B,MAAM,WAAW,GAAsB,EAAE,CAAC;IAE1C,MAAM,OAAO,GAAG,MAAM,CAAC,CAAC,CAAC,MAAM,CAAC,eAAe,CAAC,CAAC,CAAC,SAAS,CAAC;IAC5D,+EAA+E;IAC/E,IAAI,IAAI,CAAC,MAAM,IAAI,OAAO,KAAK,KAAK,IAAI,CAAC,CAAC,IAAI,CAAC,SAAS,IAAI,OAAO,KAAK,SAAS,CAAC,EAAE,CAAC;QACnF,WAAW,CAAC,IAAI,CACd,UAAU,CACR,GAAG,GAAG,iBAAiB,EACvB,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,eAAe,EAAE,EACpC,kBAAkB,CAAC,sBAAsB,EACzC,OAAO,EACP,2BAA2B,CAAC,eAAe,EAC3C,CAAC,CAAC,EAAE,EAAE,CACJ,aAAa,IAAI,wCAAwC,MAAM,CAAC,CAAC,CAAC,wBAAwB,YAAY,GAAG,CAC5G,CACF,CAAC;IACJ,CAAC;IAED,MAAM,KAAK,GAAG,WAAW,CAAC,IAAI,CAAC,QAAQ,CAAC,SAAS,CAAC,CAAC;IACnD,MAAM,MAAM,GAAG,MAAM,CAAC,CAAC,CAAC,MAAM,CAAC,YAAY,CAAC,CAAC,CAAC,SAAS,CAAC;IACxD,IAAI,KAAK,IAAI,MAAM,KAAK,KAAK,EAAE,CAAC;QAC9B,MAAM,OAAO,GAAG,KAAK,CAAC,YAAY,CAAC,KAAK,CAAC,OAAO,CAAC;YAC/C,CAAC,CAAC,oBAAoB;YACtB,CAAC,CAAC,WAAW,KAAK,CAAC,OAAO,EAAE,CAAC;QAC/B,WAAW,CAAC,IAAI,CACd,UAAU,CACR,GAAG,GAAG,cAAc,EACpB,OAAO,CAAC,YAAY,CAAC,KAAK,CAAC,EAC3B,kBAAkB,CAAC,mBAAmB,EACtC,MAAM,EACN,2BAA2B,CAAC,YAAY,EACxC,CAAC,CAAC,EAAE,EAAE,CACJ,aAAa,IAAI,UAAU,KAAK,CAAC,IAAI,OAAO,OAAO,4BAA4B,MAAM,CAAC,CAAC,CAAC,wFAAwF,CACnL,CACF,CAAC;IACJ,CAAC;IAED,OAAO,WAAW,CAAC;AACrB,CAAC"}

package/dist/esm/association.d.ts

@@ -0,0 +1,21 @@
+import type { Stage } from "aws-cdk-lib/aws-apigateway";
+import { CfnWebACLAssociation, type CfnWebACLAssociationProps } from "aws-cdk-lib/aws-wafv2";
+import { type IConstruct } from "constructs";
+/**
+ * A resource a regional web ACL can protect: an ARN, a CDK reference CDK
+ * itself accepts (an Application Load Balancer, an AppSync API, …), or an API
+ * Gateway REST API stage.
+ *
+ * The ARN and reference types are read from CDK's own `resourceArn` prop, so
+ * they track the installed `aws-cdk-lib` (ADR-0018).
+ */
+export type WebAclAssociationTarget = NonNullable<CfnWebACLAssociationProps["resourceArn"]> | Pick<Stage, "stageArn" | "node">;
+/**
+ * Creates one `AWS::WAFv2::WebACLAssociation` per target, each depending on
+ * the one before it: AWS allows one `AssociateWebACL` call every two seconds
+ * per account and Region, so parallel associations throttle themselves.
+ *
+ * @internal
+ */
+export declare function associate(scope: IConstruct, id: string, webAclArn: string, targets: WebAclAssociationTarget[]): CfnWebACLAssociation[];
+//# sourceMappingURL=association.d.ts.map

package/dist/esm/association.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"association.d.ts","sourceRoot":"","sources":["../../src/association.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,KAAK,EAAE,MAAM,4BAA4B,CAAC;AACxD,OAAO,EAAE,oBAAoB,EAAE,KAAK,yBAAyB,EAAE,MAAM,uBAAuB,CAAC;AAC7F,OAAO,EAAa,KAAK,UAAU,EAAE,MAAM,YAAY,CAAC;AAExD;;;;;;;GAOG;AACH,MAAM,MAAM,uBAAuB,GACjC,WAAW,CAAC,yBAAyB,CAAC,aAAa,CAAC,CAAC,GAAG,IAAI,CAAC,KAAK,EAAE,UAAU,GAAG,MAAM,CAAC,CAAC;AA2B3F;;;;;;GAMG;AACH,wBAAgB,SAAS,CACvB,KAAK,EAAE,UAAU,EACjB,EAAE,EAAE,MAAM,EACV,SAAS,EAAE,MAAM,EACjB,OAAO,EAAE,uBAAuB,EAAE,GACjC,oBAAoB,EAAE,CAsBxB"}

package/dist/esm/association.js

@@ -0,0 +1,58 @@
+import { Stack } from "aws-cdk-lib";
+import { CfnWebACLAssociation } from "aws-cdk-lib/aws-wafv2";
+import { Construct } from "constructs";
+function isStage(target) {
+    return typeof target === "object" && "stageArn" in target;
+}
+/** 32-bit FNV-1a, as 8 hex digits. */
+function fnv1a(value) {
+    let hash = 0x811c9dc5;
+    for (let i = 0; i < value.length; i++) {
+        hash = Math.imul(hash ^ value.charCodeAt(i), 0x01000193) >>> 0;
+    }
+    return hash.toString(16).padStart(8, "0");
+}
+/**
+ * A construct id suffix that follows the target, not its position: an id that
+ * moved when another target was removed would replace the association, and
+ * CloudFormation deletes the old one last, disassociating the resource.
+ */
+function targetKey(scope, target) {
+    const identity = Construct.isConstruct(target)
+        ? target.node.path
+        : JSON.stringify(Stack.of(scope).resolve(target));
+    return fnv1a(identity);
+}
+/**
+ * Creates one `AWS::WAFv2::WebACLAssociation` per target, each depending on
+ * the one before it: AWS allows one `AssociateWebACL` call every two seconds
+ * per account and Region, so parallel associations throttle themselves.
+ *
+ * @internal
+ */
+export function associate(scope, id, webAclArn, targets) {
+    const associations = [];
+    const seen = new Set();
+    for (const target of targets) {
+        const resourceArn = isStage(target) ? target.stageArn : target;
+        const key = targetKey(scope, target);
+        if (seen.has(key)) {
+            throw new Error(`WebAclBuilder "${id}": associateWith() was given the same resource twice.`);
+        }
+        seen.add(key);
+        const association = new CfnWebACLAssociation(scope, `${id}Association${key}`, {
+            webAclArn,
+            resourceArn,
+        });
+        // The ARN references the resource, which already orders the association
+        // after it; a construct is depended on explicitly in case it does not.
+        if (Construct.isConstruct(target))
+            association.node.addDependency(target);
+        const previous = associations.at(-1);
+        if (previous)
+            association.node.addDependency(previous);
+        associations.push(association);
+    }
+    return associations;
+}
+//# sourceMappingURL=association.js.map

package/dist/esm/association.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"association.js","sourceRoot":"","sources":["../../src/association.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,KAAK,EAAE,MAAM,aAAa,CAAC;AAEpC,OAAO,EAAE,oBAAoB,EAAkC,MAAM,uBAAuB,CAAC;AAC7F,OAAO,EAAE,SAAS,EAAmB,MAAM,YAAY,CAAC;AAaxD,SAAS,OAAO,CAAC,MAA+B;IAC9C,OAAO,OAAO,MAAM,KAAK,QAAQ,IAAI,UAAU,IAAI,MAAM,CAAC;AAC5D,CAAC;AAED,sCAAsC;AACtC,SAAS,KAAK,CAAC,KAAa;IAC1B,IAAI,IAAI,GAAG,UAAU,CAAC;IACtB,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,KAAK,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;QACtC,IAAI,GAAG,IAAI,CAAC,IAAI,CAAC,IAAI,GAAG,KAAK,CAAC,UAAU,CAAC,CAAC,CAAC,EAAE,UAAU,CAAC,KAAK,CAAC,CAAC;IACjE,CAAC;IACD,OAAO,IAAI,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC;AAC5C,CAAC;AAED;;;;GAIG;AACH,SAAS,SAAS,CAAC,KAAiB,EAAE,MAA+B;IACnE,MAAM,QAAQ,GAAG,SAAS,CAAC,WAAW,CAAC,MAAM,CAAC;QAC5C,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,IAAI;QAClB,CAAC,CAAC,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,EAAE,CAAC,KAAK,CAAC,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC;IACpD,OAAO,KAAK,CAAC,QAAQ,CAAC,CAAC;AACzB,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,SAAS,CACvB,KAAiB,EACjB,EAAU,EACV,SAAiB,EACjB,OAAkC;IAElC,MAAM,YAAY,GAA2B,EAAE,CAAC;IAChD,MAAM,IAAI,GAAG,IAAI,GAAG,EAAU,CAAC;IAC/B,KAAK,MAAM,MAAM,IAAI,OAAO,EAAE,CAAC;QAC7B,MAAM,WAAW,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC,CAAC,MAAM,CAAC;QAC/D,MAAM,GAAG,GAAG,SAAS,CAAC,KAAK,EAAE,MAAM,CAAC,CAAC;QACrC,IAAI,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC,EAAE,CAAC;YAClB,MAAM,IAAI,KAAK,CAAC,kBAAkB,EAAE,uDAAuD,CAAC,CAAC;QAC/F,CAAC;QACD,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;QACd,MAAM,WAAW,GAAG,IAAI,oBAAoB,CAAC,KAAK,EAAE,GAAG,EAAE,cAAc,GAAG,EAAE,EAAE;YAC5E,SAAS;YACT,WAAW;SACZ,CAAC,CAAC;QACH,wEAAwE;QACxE,uEAAuE;QACvE,IAAI,SAAS,CAAC,WAAW,CAAC,MAAM,CAAC;YAAE,WAAW,CAAC,IAAI,CAAC,aAAa,CAAC,MAAM,CAAC,CAAC;QAC1E,MAAM,QAAQ,GAAG,YAAY,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC;QACrC,IAAI,QAAQ;YAAE,WAAW,CAAC,IAAI,CAAC,aAAa,CAAC,QAAQ,CAAC,CAAC;QACvD,YAAY,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC;IACjC,CAAC;IACD,OAAO,YAAY,CAAC;AACtB,CAAC"}

package/dist/esm/custom-response.d.ts

@@ -0,0 +1,52 @@
+import type { CfnWebACL } from "aws-cdk-lib/aws-wafv2";
+/**
+ * The body of a custom response. `json` is serialised with `JSON.stringify`
+ * unless it is already a string.
+ */
+export type CustomResponseBody = {
+    json: unknown;
+} | {
+    text: string;
+} | {
+    html: string;
+};
+/** A custom response for a Block action: status, optional body and headers. */
+export interface CustomResponse {
+    readonly status: number;
+    readonly body?: CustomResponseBody;
+    readonly headers?: Record<string, string>;
+}
+/**
+ * The status codes WAF accepts in a custom response. `410` is not among them,
+ * and `402` is reserved for the Monetize action.
+ *
+ * @see https://docs.aws.amazon.com/waf/latest/developerguide/customizing-the-response-status-codes.html
+ */
+export declare const SUPPORTED_CUSTOM_RESPONSE_STATUS_CODES: readonly number[];
+/**
+ * Collects the custom response bodies of a web ACL's default action and rules
+ * into the ACL-level `CustomResponseBodies` map CloudFormation requires.
+ * Identical bodies share one key; a body's key is derived from the first rule
+ * that uses it.
+ *
+ * @internal
+ */
+export declare class CustomResponseBodies {
+    #private;
+    constructor(owner: string);
+    /**
+     * Validates `response` and turns it into the `CustomResponse` CloudFormation
+     * expects, registering its body under a key derived from `keyHint`.
+     *
+     * @param who - Names the rule or default action in error messages.
+     */
+    register(who: string, keyHint: string, response: CustomResponse): CfnWebACL.CustomResponseProperty;
+    /**
+     * The Block action for a rule or default action, with `response` as its
+     * custom response when there is one.
+     */
+    block(who: string, keyHint: string, response?: CustomResponse): CfnWebACL.BlockActionProperty;
+    /** The map for `CfnWebACLProps.customResponseBodies`, or `undefined` when empty. */
+    toProperty(): Record<string, CfnWebACL.CustomResponseBodyProperty> | undefined;
+}
+//# sourceMappingURL=custom-response.d.ts.map

package/dist/esm/custom-response.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"custom-response.d.ts","sourceRoot":"","sources":["../../src/custom-response.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,uBAAuB,CAAC;AAEvD;;;GAGG;AACH,MAAM,MAAM,kBAAkB,GAAG;IAAE,IAAI,EAAE,OAAO,CAAA;CAAE,GAAG;IAAE,IAAI,EAAE,MAAM,CAAA;CAAE,GAAG;IAAE,IAAI,EAAE,MAAM,CAAA;CAAE,CAAC;AAEzF,+EAA+E;AAC/E,MAAM,WAAW,cAAc;IAC7B,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,QAAQ,CAAC,IAAI,CAAC,EAAE,kBAAkB,CAAC;IACnC,QAAQ,CAAC,OAAO,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;CAC3C;AAMD;;;;;GAKG;AACH,eAAO,MAAM,sCAAsC,EAAE,SAAS,MAAM,EAGnE,CAAC;AA2DF;;;;;;;GAOG;AACH,qBAAa,oBAAoB;;gBAMnB,KAAK,EAAE,MAAM;IAIzB;;;;;OAKG;IACH,QAAQ,CACN,GAAG,EAAE,MAAM,EACX,OAAO,EAAE,MAAM,EACf,QAAQ,EAAE,cAAc,GACvB,SAAS,CAAC,sBAAsB;IAgDnC;;;OAGG;IACH,KAAK,CAAC,GAAG,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,EAAE,QAAQ,CAAC,EAAE,cAAc,GAAG,SAAS,CAAC,mBAAmB;IAI7F,oFAAoF;IACpF,UAAU,IAAI,MAAM,CAAC,MAAM,EAAE,SAAS,CAAC,0BAA0B,CAAC,GAAG,SAAS;CAG/E"}

package/dist/esm/custom-response.js

@@ -0,0 +1,133 @@
+import { Token } from "aws-cdk-lib";
+const SOURCE = "https://docs.aws.amazon.com/waf/latest/developerguide/customizing-the-response-status-codes.html";
+const QUOTAS = "https://docs.aws.amazon.com/waf/latest/developerguide/limits.html";
+/**
+ * The status codes WAF accepts in a custom response. `410` is not among them,
+ * and `402` is reserved for the Monetize action.
+ *
+ * @see https://docs.aws.amazon.com/waf/latest/developerguide/customizing-the-response-status-codes.html
+ */
+export const SUPPORTED_CUSTOM_RESPONSE_STATUS_CODES = [
+    200, 201, 202, 204, 206, 300, 301, 302, 303, 304, 307, 308, 400, 401, 403, 404, 405, 408, 409,
+    411, 412, 413, 414, 415, 416, 421, 429, 500, 501, 502, 503, 504, 505,
+];
+const MAX_BODY_BYTES = 4 * 1024;
+const MAX_BODIES = 50;
+const MAX_TOTAL_BODY_BYTES = 50 * 1024;
+const MAX_HEADERS = 10;
+const HEADER_NAME = /^[a-zA-Z0-9._$-]{1,64}$/;
+const encoder = new TextEncoder();
+const byteLength = (s) => encoder.encode(s).length;
+function toBodyProperty(body) {
+    if ("json" in body) {
+        return {
+            contentType: "APPLICATION_JSON",
+            content: typeof body.json === "string" ? body.json : JSON.stringify(body.json),
+        };
+    }
+    if ("text" in body)
+        return { contentType: "TEXT_PLAIN", content: body.text };
+    return { contentType: "TEXT_HTML", content: body.html };
+}
+function validateStatus(owner, status) {
+    if (Token.isUnresolved(status))
+        return;
+    if (!SUPPORTED_CUSTOM_RESPONSE_STATUS_CODES.includes(status)) {
+        throw new Error(`${owner}: AWS WAF does not support the custom response status code ${String(status)}. ` +
+            `Supported: ${SUPPORTED_CUSTOM_RESPONSE_STATUS_CODES.join(", ")}. See ${SOURCE}.`);
+    }
+}
+function validateHeaders(owner, headers) {
+    const names = Object.keys(headers);
+    if (names.length > MAX_HEADERS) {
+        throw new Error(`${owner}: a custom response can set at most ${String(MAX_HEADERS)} headers, but ${String(names.length)} were given. See ${QUOTAS}.`);
+    }
+    const seen = new Set();
+    for (const name of names) {
+        if (!HEADER_NAME.test(name)) {
+            throw new Error(`${owner}: custom response header "${name}" is invalid. Names are 1–64 characters of letters, digits and ._$-. See ${SOURCE}.`);
+        }
+        const lower = name.toLowerCase();
+        if (lower === "content-type") {
+            throw new Error(`${owner}: a custom response cannot set content-type; WAF sets it from the body's type. Use { json }, { text } or { html } instead.`);
+        }
+        if (seen.has(lower)) {
+            throw new Error(`${owner}: custom response header "${name}" is set twice.`);
+        }
+        seen.add(lower);
+    }
+}
+/**
+ * Collects the custom response bodies of a web ACL's default action and rules
+ * into the ACL-level `CustomResponseBodies` map CloudFormation requires.
+ * Identical bodies share one key; a body's key is derived from the first rule
+ * that uses it.
+ *
+ * @internal
+ */
+export class CustomResponseBodies {
+    #owner;
+    #bodies = {};
+    #keysByContent = new Map();
+    #totalBytes = 0;
+    constructor(owner) {
+        this.#owner = owner;
+    }
+    /**
+     * Validates `response` and turns it into the `CustomResponse` CloudFormation
+     * expects, registering its body under a key derived from `keyHint`.
+     *
+     * @param who - Names the rule or default action in error messages.
+     */
+    register(who, keyHint, response) {
+        const owner = `${this.#owner} ${who}`;
+        validateStatus(owner, response.status);
+        if (response.headers)
+            validateHeaders(owner, response.headers);
+        const responseHeaders = response.headers
+            ? Object.entries(response.headers).map(([name, value]) => ({ name, value }))
+            : undefined;
+        return {
+            responseCode: response.status,
+            ...(response.body && { customResponseBodyKey: this.#keyFor(owner, keyHint, response.body) }),
+            ...(responseHeaders && { responseHeaders }),
+        };
+    }
+    #keyFor(owner, keyHint, body) {
+        const property = toBodyProperty(body);
+        const identity = `${property.contentType}\n${property.content}`;
+        const existing = this.#keysByContent.get(identity);
+        if (existing !== undefined)
+            return existing;
+        const bytes = byteLength(property.content);
+        if (bytes > MAX_BODY_BYTES) {
+            throw new Error(`${owner}: the custom response body is ${String(bytes)} bytes; AWS WAF allows at most ${String(MAX_BODY_BYTES)}. See ${QUOTAS}.`);
+        }
+        if (this.#keysByContent.size >= MAX_BODIES) {
+            throw new Error(`${this.#owner}: a web ACL can hold at most ${String(MAX_BODIES)} distinct custom response bodies. See ${QUOTAS}.`);
+        }
+        this.#totalBytes += bytes;
+        if (this.#totalBytes > MAX_TOTAL_BODY_BYTES) {
+            throw new Error(`${this.#owner}: the custom response bodies total ${String(this.#totalBytes)} bytes; AWS WAF allows at most ${String(MAX_TOTAL_BODY_BYTES)} per web ACL. See ${QUOTAS}.`);
+        }
+        let key = keyHint;
+        // Keys share the 128-character limit of rule names, so leave room for a suffix.
+        for (let n = 2; key in this.#bodies; n++)
+            key = `${keyHint.slice(0, 120)}-${String(n)}`;
+        this.#bodies[key] = property;
+        this.#keysByContent.set(identity, key);
+        return key;
+    }
+    /**
+     * The Block action for a rule or default action, with `response` as its
+     * custom response when there is one.
+     */
+    block(who, keyHint, response) {
+        return response ? { customResponse: this.register(who, keyHint, response) } : {};
+    }
+    /** The map for `CfnWebACLProps.customResponseBodies`, or `undefined` when empty. */
+    toProperty() {
+        return this.#keysByContent.size > 0 ? this.#bodies : undefined;
+    }
+}
+//# sourceMappingURL=custom-response.js.map

package/dist/esm/custom-response.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"custom-response.js","sourceRoot":"","sources":["../../src/custom-response.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,KAAK,EAAE,MAAM,aAAa,CAAC;AAgBpC,MAAM,MAAM,GACV,kGAAkG,CAAC;AACrG,MAAM,MAAM,GAAG,mEAAmE,CAAC;AAEnF;;;;;GAKG;AACH,MAAM,CAAC,MAAM,sCAAsC,GAAsB;IACvE,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG;IAC7F,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG;CACrE,CAAC;AAEF,MAAM,cAAc,GAAG,CAAC,GAAG,IAAI,CAAC;AAChC,MAAM,UAAU,GAAG,EAAE,CAAC;AACtB,MAAM,oBAAoB,GAAG,EAAE,GAAG,IAAI,CAAC;AACvC,MAAM,WAAW,GAAG,EAAE,CAAC;AACvB,MAAM,WAAW,GAAG,yBAAyB,CAAC;AAE9C,MAAM,OAAO,GAAG,IAAI,WAAW,EAAE,CAAC;AAClC,MAAM,UAAU,GAAG,CAAC,CAAS,EAAU,EAAE,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC;AAEnE,SAAS,cAAc,CAAC,IAAwB;IAC9C,IAAI,MAAM,IAAI,IAAI,EAAE,CAAC;QACnB,OAAO;YACL,WAAW,EAAE,kBAAkB;YAC/B,OAAO,EAAE,OAAO,IAAI,CAAC,IAAI,KAAK,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,IAAI,CAAC;SAC/E,CAAC;IACJ,CAAC;IACD,IAAI,MAAM,IAAI,IAAI;QAAE,OAAO,EAAE,WAAW,EAAE,YAAY,EAAE,OAAO,EAAE,IAAI,CAAC,IAAI,EAAE,CAAC;IAC7E,OAAO,EAAE,WAAW,EAAE,WAAW,EAAE,OAAO,EAAE,IAAI,CAAC,IAAI,EAAE,CAAC;AAC1D,CAAC;AAED,SAAS,cAAc,CAAC,KAAa,EAAE,MAAc;IACnD,IAAI,KAAK,CAAC,YAAY,CAAC,MAAM,CAAC;QAAE,OAAO;IACvC,IAAI,CAAC,sCAAsC,CAAC,QAAQ,CAAC,MAAM,CAAC,EAAE,CAAC;QAC7D,MAAM,IAAI,KAAK,CACb,GAAG,KAAK,8DAA8D,MAAM,CAAC,MAAM,CAAC,IAAI;YACtF,cAAc,sCAAsC,CAAC,IAAI,CAAC,IAAI,CAAC,SAAS,MAAM,GAAG,CACpF,CAAC;IACJ,CAAC;AACH,CAAC;AAED,SAAS,eAAe,CAAC,KAAa,EAAE,OAA+B;IACrE,MAAM,KAAK,GAAG,MAAM,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;IACnC,IAAI,KAAK,CAAC,MAAM,GAAG,WAAW,EAAE,CAAC;QAC/B,MAAM,IAAI,KAAK,CACb,GAAG,KAAK,uCAAuC,MAAM,CAAC,WAAW,CAAC,iBAAiB,MAAM,CAAC,KAAK,CAAC,MAAM,CAAC,oBAAoB,MAAM,GAAG,CACrI,CAAC;IACJ,CAAC;IACD,MAAM,IAAI,GAAG,IAAI,GAAG,EAAU,CAAC;IAC/B,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;QACzB,IAAI,CAAC,WAAW,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC;YAC5B,MAAM,IAAI,KAAK,CACb,GAAG,KAAK,6BAA6B,IAAI,4EAA4E,MAAM,GAAG,CAC/H,CAAC;QACJ,CAAC;QACD,MAAM,KAAK,GAAG,IAAI,CAAC,WAAW,EAAE,CAAC;QACjC,IAAI,KAAK,KAAK,cAAc,EAAE,CAAC;YAC7B,MAAM,IAAI,KAAK,CACb,GAAG,KAAK,4HAA4H,CACrI,CAAC;QACJ,CAAC;QACD,IAAI,IAAI,CAAC,GAAG,CAAC,KAAK,CAAC,EAAE,CAAC;YACpB,MAAM,IAAI,KAAK,CAAC,GAAG,KAAK,6BAA6B,IAAI,iBAAiB,CAAC,CAAC;QAC9E,CAAC;QACD,IAAI,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC;IAClB,CAAC;AACH,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,OAAO,oBAAoB;IACtB,MAAM,CAAS;IACf,OAAO,GAAyD,EAAE,CAAC;IACnE,cAAc,GAAG,IAAI,GAAG,EAAkB,CAAC;IACpD,WAAW,GAAG,CAAC,CAAC;IAEhB,YAAY,KAAa;QACvB,IAAI,CAAC,MAAM,GAAG,KAAK,CAAC;IACtB,CAAC;IAED;;;;;OAKG;IACH,QAAQ,CACN,GAAW,EACX,OAAe,EACf,QAAwB;QAExB,MAAM,KAAK,GAAG,GAAG,IAAI,CAAC,MAAM,IAAI,GAAG,EAAE,CAAC;QACtC,cAAc,CAAC,KAAK,EAAE,QAAQ,CAAC,MAAM,CAAC,CAAC;QACvC,IAAI,QAAQ,CAAC,OAAO;YAAE,eAAe,CAAC,KAAK,EAAE,QAAQ,CAAC,OAAO,CAAC,CAAC;QAE/D,MAAM,eAAe,GAAG,QAAQ,CAAC,OAAO;YACtC,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,EAAE,KAAK,CAAC,EAAE,EAAE,CAAC,CAAC,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;YAC5E,CAAC,CAAC,SAAS,CAAC;QAEd,OAAO;YACL,YAAY,EAAE,QAAQ,CAAC,MAAM;YAC7B,GAAG,CAAC,QAAQ,CAAC,IAAI,IAAI,EAAE,qBAAqB,EAAE,IAAI,CAAC,OAAO,CAAC,KAAK,EAAE,OAAO,EAAE,QAAQ,CAAC,IAAI,CAAC,EAAE,CAAC;YAC5F,GAAG,CAAC,eAAe,IAAI,EAAE,eAAe,EAAE,CAAC;SAC5C,CAAC;IACJ,CAAC;IAED,OAAO,CAAC,KAAa,EAAE,OAAe,EAAE,IAAwB;QAC9D,MAAM,QAAQ,GAAG,cAAc,CAAC,IAAI,CAAC,CAAC;QACtC,MAAM,QAAQ,GAAG,GAAG,QAAQ,CAAC,WAAW,KAAK,QAAQ,CAAC,OAAO,EAAE,CAAC;QAChE,MAAM,QAAQ,GAAG,IAAI,CAAC,cAAc,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;QACnD,IAAI,QAAQ,KAAK,SAAS;YAAE,OAAO,QAAQ,CAAC;QAE5C,MAAM,KAAK,GAAG,UAAU,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC;QAC3C,IAAI,KAAK,GAAG,cAAc,EAAE,CAAC;YAC3B,MAAM,IAAI,KAAK,CACb,GAAG,KAAK,iCAAiC,MAAM,CAAC,KAAK,CAAC,kCAAkC,MAAM,CAAC,cAAc,CAAC,SAAS,MAAM,GAAG,CACjI,CAAC;QACJ,CAAC;QACD,IAAI,IAAI,CAAC,cAAc,CAAC,IAAI,IAAI,UAAU,EAAE,CAAC;YAC3C,MAAM,IAAI,KAAK,CACb,GAAG,IAAI,CAAC,MAAM,gCAAgC,MAAM,CAAC,UAAU,CAAC,yCAAyC,MAAM,GAAG,CACnH,CAAC;QACJ,CAAC;QACD,IAAI,CAAC,WAAW,IAAI,KAAK,CAAC;QAC1B,IAAI,IAAI,CAAC,WAAW,GAAG,oBAAoB,EAAE,CAAC;YAC5C,MAAM,IAAI,KAAK,CACb,GAAG,IAAI,CAAC,MAAM,sCAAsC,MAAM,CAAC,IAAI,CAAC,WAAW,CAAC,kCAAkC,MAAM,CAAC,oBAAoB,CAAC,qBAAqB,MAAM,GAAG,CACzK,CAAC;QACJ,CAAC;QAED,IAAI,GAAG,GAAG,OAAO,CAAC;QAClB,gFAAgF;QAChF,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,GAAG,IAAI,IAAI,CAAC,OAAO,EAAE,CAAC,EAAE;YAAE,GAAG,GAAG,GAAG,OAAO,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC,IAAI,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC;QACxF,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,GAAG,QAAQ,CAAC;QAC7B,IAAI,CAAC,cAAc,CAAC,GAAG,CAAC,QAAQ,EAAE,GAAG,CAAC,CAAC;QACvC,OAAO,GAAG,CAAC;IACb,CAAC;IAED;;;OAGG;IACH,KAAK,CAAC,GAAW,EAAE,OAAe,EAAE,QAAyB;QAC3D,OAAO,QAAQ,CAAC,CAAC,CAAC,EAAE,cAAc,EAAE,IAAI,CAAC,QAAQ,CAAC,GAAG,EAAE,OAAO,EAAE,QAAQ,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;IACnF,CAAC;IAED,oFAAoF;IACpF,UAAU;QACR,OAAO,IAAI,CAAC,cAAc,CAAC,IAAI,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,CAAC,SAAS,CAAC;IACjE,CAAC;CACF"}