@composurecdk/wafv2 0.0.0-stage → 0.13.0

package/dist/esm/web-acl-builder.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"web-acl-builder.d.ts","sourceRoot":"","sources":["../../src/web-acl-builder.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,KAAK,EAAE,MAAM,4BAA4B,CAAC;AACxD,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,sBAAsB,CAAC;AACrD,OAAO,EACL,KAAK,uBAAuB,EAC5B,SAAS,EACT,KAAK,oBAAoB,EACzB,KAAK,cAAc,EACpB,MAAM,uBAAuB,CAAC;AAC/B,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,YAAY,CAAC;AAC7C,OAAO,EAAE,UAAU,EAAE,KAAK,SAAS,EAAW,KAAK,UAAU,EAAE,MAAM,oBAAoB,CAAC;AAC1F,OAAO,EAAE,KAAK,cAAc,EAAiB,MAAM,8BAA8B,CAAC;AAClF,OAAO,EACL,KAAK,eAAe,EAGrB,MAAM,0BAA0B,CAAC;AAClC,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,mBAAmB,CAAC;AAE3D,OAAO,EAAa,KAAK,uBAAuB,EAAE,MAAM,kBAAkB,CAAC;AAC3E,OAAO,EAAE,KAAK,cAAc,EAAwB,MAAM,sBAAsB,CAAC;AAajF,OAAO,EAGL,KAAK,kBAAkB,EACxB,MAAM,mBAAmB,CAAC;AAC3B,OAAO,EAAoB,KAAK,mBAAmB,EAAE,MAAM,cAAc,CAAC;AAC1E,OAAO,EAAE,KAAK,aAAa,EAAiB,MAAM,cAAc,CAAC;AACjE,OAAO,EAAyB,KAAK,WAAW,EAAE,MAAM,YAAY,CAAC;AAErE;;;;;GAKG;AACH,MAAM,WAAW,kBAAmB,SAAQ,IAAI,CAC9C,cAAc,EACd,OAAO,GAAG,eAAe,GAAG,OAAO,GAAG,sBAAsB,GAAG,kBAAkB,GAAG,MAAM,CAC3F;IACC;;;;OAIG;IACH,KAAK,CAAC,EAAE,WAAW,CAAC;IAEpB;;;;OAIG;IACH,UAAU,CAAC,EAAE,MAAM,CAAC;IAEpB;;;;;OAKG;IACH,eAAe,CAAC,EAAE,OAAO,CAAC;IAE1B;;;;;;OAMG;IACH,OAAO,CAAC,EAAE,mBAAmB,GAAG,KAAK,CAAC;IAEtC;;;;;;;OAOG;IACH,iBAAiB,CAAC,EAAE,iBAAiB,GAAG,KAAK,CAAC;CAC/C;AAED,qDAAqD;AACrD,MAAM,WAAW,mBAAmB;IAClC,mBAAmB;IACnB,MAAM,EAAE,SAAS,CAAC;IAClB;;;OAGG;IACH,YAAY,EAAE,oBAAoB,EAAE,CAAC;IACrC,+FAA+F;IAC/F,QAAQ,CAAC,EAAE,QAAQ,CAAC;IACpB,6DAA6D;IAC7D,OAAO,CAAC,EAAE,uBAAuB,CAAC;IAClC;;;OAGG;IACH,OAAO,EAAE,aAAa,CAAC;IACvB,iFAAiF;IACjF,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,KAAK,CAAC,CAAC;CAC/B;AAED;;;;GAIG;AACH,MAAM,MAAM,cAAc,GAAG,cAAc,CAAC,kBAAkB,EAAE,aAAa,CAAC,CAAC;AAe/E,cAAM,aAAc,YAAW,SAAS,CAAC,mBAAmB,CAAC;;IAC3D,KAAK,EAAE,OAAO,CAAC,kBAAkB,CAAC,CAAM;IAMxC;;;OAGG;IACH,aAAa,CAAC,MAAM,EAAE,OAAO,GAAG,OAAO,EAAE,QAAQ,CAAC,EAAE,cAAc,GAAG,IAAI;IAQzE;;;;;;OAMG;IACH,OAAO,CAAC,IAAI,EAAE,MAAM,EAAE,SAAS,EAAE,CAAC,IAAI,EAAE,kBAAkB,KAAK,kBAAkB,GAAG,IAAI;IAWxF;;;;;;;;OAQG;IACH,aAAa,CAAC,MAAM,EAAE,UAAU,CAAC,uBAAuB,CAAC,GAAG,IAAI;IAKhE;;;;OAIG;IACH,QAAQ,CAAC,GAAG,EAAE,MAAM,EAAE,SAAS,EAAE,eAAe,CAAC,aAAa,CAAC,GAAG,IAAI;IAKtE;;;OAGG;IACH,SAAS,CAAC,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,eAAe,CAAC,aAAa,CAAC,CAAC,GAAG,IAAI;IAOvE,gCAAgC;IAChC,CAAC,UAAU,CAAC,CAAC,MAAM,EAAE,aAAa,GAAG,IAAI;IAOzC,KAAK,CAAC,KAAK,EAAE,UAAU,EAAE,EAAE,EAAE,MAAM,EAAE,OAAO,GAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAM,GAAG,mBAAmB;CA4HhG;AAED;;;;;;;;;;;;;;;;;;;;;;GAsBG;AACH,wBAAgB,mBAAmB,IAAI,cAAc,CAEpD"}

package/dist/esm/web-acl-builder.js

@@ -0,0 +1,202 @@
+import { Annotations, Lazy } from "aws-cdk-lib";
+import { CfnWebACL, } from "aws-cdk-lib/aws-wafv2";
+import { COPY_STATE, resolve } from "@composurecdk/core";
+import { taggedBuilder } from "@composurecdk/cloudformation";
+import { AlarmDefinitionBuilder, createAlarms, } from "@composurecdk/cloudwatch";
+import { resolveWebAclAlarmDefinitions } from "./alarms.js";
+import { associate } from "./association.js";
+import { CustomResponseBodies } from "./custom-response.js";
+import { DEFAULT_RULE_PRIORITY_STEP, WEB_ACL_DEFAULTS, WEB_ACL_VISIBILITY_DEFAULTS, } from "./defaults.js";
+import { sanitizeMetricName, webAclBaseName, validateMetricName, validateRuleName, validateWebAclName, } from "./names.js";
+import { createWebAclRuleBuilder, } from "./rule-builder.js";
+import { configureLogging } from "./logging.js";
+import { webAclMetrics } from "./metrics.js";
+import { checkCloudFrontRegion } from "./scope.js";
+const SAMPLING_ANNOTATION = "@composurecdk/wafv2:sampling-unredacted";
+const MAX_RATE_BASED_RULES = 10;
+class WebAclBuilder {
+    props = {};
+    #rules = [];
+    #associations = [];
+    #defaultAction = { action: "allow" };
+    #customAlarms = [];
+    /**
+     * What happens to a request no rule decides on. `allow` is the default;
+     * `block` can answer with a custom response.
+     */
+    defaultAction(action, response) {
+        if (action === "allow" && response !== undefined) {
+            throw new Error(`defaultAction("allow") cannot take a custom response; only Block can.`);
+        }
+        this.#defaultAction = { action, response };
+        return this;
+    }
+    /**
+     * Adds a rule. Rules are evaluated in the order they are added, unless a
+     * rule sets its own `.priority(n)`.
+     *
+     * @param name - Unique within the web ACL; also the rule's default metric name.
+     * @param configure - Sets the rule's statement, action and the rest.
+     */
+    addRule(name, configure) {
+        validateRuleName(name);
+        if (this.#rules.some((r) => r.name === name)) {
+            throw new Error(`WebAclBuilder.addRule: duplicate rule name "${name}". Each rule must have a unique name.`);
+        }
+        this.#rules.push({ name, configure });
+        return this;
+    }
+    /**
+     * Protects a regional resource with this web ACL. Call it once per
+     * resource. Accepts an ARN, a CDK reference CloudFormation's
+     * `AWS::WAFv2::WebACLAssociation` takes (an Application Load Balancer, an
+     * AppSync API), or an API Gateway stage, as a concrete value or a `ref`.
+     *
+     * A CLOUDFRONT web ACL cannot be associated: pass its ARN to the
+     * distribution's `webAclId` instead.
+     */
+    associateWith(target) {
+        this.#associations.push(target);
+        return this;
+    }
+    /**
+     * Adds a custom alarm. The metric factory receives the web ACL's
+     * {@link WebAclMetrics}, so a rule's metrics come by its name:
+     * `(m) => m.rule("PerIpRate").countedRequests()`.
+     */
+    addAlarm(key, configure) {
+        this.#customAlarms.push(configure(new AlarmDefinitionBuilder(key)));
+        return this;
+    }
+    /**
+     * Adds a set of custom alarms in one call: each entry exactly as if by
+     * `addAlarm(key, configure)`, in the record's iteration order.
+     */
+    addAlarms(alarms) {
+        for (const [key, configure] of Object.entries(alarms)) {
+            this.addAlarm(key, configure);
+        }
+        return this;
+    }
+    /** @internal — see ADR-0005. */
+    [COPY_STATE](target) {
+        target.#rules.push(...this.#rules);
+        target.#associations.push(...this.#associations);
+        target.#defaultAction = this.#defaultAction;
+        target.#customAlarms.push(...this.#customAlarms);
+    }
+    build(scope, id, context = {}) {
+        const owner = `WebAclBuilder "${id}"`;
+        const { scope: aclScope = WEB_ACL_DEFAULTS.scope, metricName: userMetricName, sampledRequests = WEB_ACL_DEFAULTS.sampledRequests, logging: loggingConfig = WEB_ACL_DEFAULTS.logging, recommendedAlarms, ...rest } = this.props;
+        if (rest.name !== undefined)
+            validateWebAclName(rest.name);
+        if (aclScope === "CLOUDFRONT") {
+            if (this.#associations.length > 0) {
+                throw new Error(`${owner} has scope CLOUDFRONT, so it cannot be associated with associateWith(). ` +
+                    `Pass its ARN (result.webAcl.attrArn) to the distribution's webAclId instead.`);
+            }
+            checkCloudFrontRegion(scope, id);
+        }
+        if (userMetricName !== undefined)
+            validateMetricName(userMetricName);
+        const bodies = new CustomResponseBodies(owner);
+        const { action, response } = this.#defaultAction;
+        const defaultAction = action === "allow"
+            ? { allow: {} }
+            : { block: bodies.block("default action", "DefaultAction", response) };
+        const rules = this.#buildRules(owner, bodies, sampledRequests);
+        const usesSampling = sampledRequests || rules.some((r) => r.sampled);
+        // Read through `in`, not as a typed property: `dataProtectionConfig` is not in
+        // CfnWebACLProps at this package's aws-cdk-lib floor (2.93.0), so it only
+        // reaches `rest` as a pass-through prop on a newer install.
+        const hasDataProtection = "dataProtectionConfig" in rest && rest.dataProtectionConfig !== undefined;
+        if (usesSampling && !hasDataProtection) {
+            Annotations.of(scope).addWarningV2(SAMPLING_ANNOTATION, `${owner} keeps sampled requests without a dataProtectionConfig. Samples keep every ` +
+                `header and are not redacted by logging, so credentials in them are visible in the ` +
+                `console. Set a dataProtectionConfig, or turn sampling off.`);
+        }
+        // The derived name comes from the construct's path, so it is read once the construct exists.
+        const metricName = userMetricName ??
+            Lazy.string({ produce: () => sanitizeMetricName(webAclBaseName(webAcl)) });
+        const webAcl = new CfnWebACL(scope, id, {
+            ...rest,
+            scope: aclScope,
+            defaultAction,
+            rules: rules.map((r) => r.property),
+            customResponseBodies: bodies.toProperty(),
+            visibilityConfig: {
+                ...WEB_ACL_VISIBILITY_DEFAULTS,
+                metricName,
+                sampledRequestsEnabled: sampledRequests,
+            },
+        });
+        const associations = associate(scope, id, webAcl.attrArn, this.#associations.map((target) => resolve(target, context)));
+        const metrics = webAclMetrics(webAcl, metricName, new Map(rules.map((r) => [r.property.name, r.metricName])));
+        const alarms = createAlarms(scope, id, [
+            ...resolveWebAclAlarmDefinitions(owner, metrics, rules, recommendedAlarms),
+            ...this.#customAlarms.map((b) => b.resolve(metrics)),
+        ]);
+        return {
+            webAcl,
+            associations,
+            ...configureLogging(scope, id, owner, webAcl, loggingConfig, context),
+            metrics,
+            alarms,
+        };
+    }
+    #buildRules(owner, bodies, sampledRequests) {
+        const rules = this.#rules.map((entry, index) => {
+            const builder = createWebAclRuleBuilder();
+            entry.configure(builder);
+            return builder.toRule({
+                name: entry.name,
+                owner,
+                defaultPriority: index * DEFAULT_RULE_PRIORITY_STEP,
+                sampledRequests,
+                bodies,
+            });
+        });
+        const byPriority = new Map();
+        for (const { property: rule } of rules) {
+            const other = byPriority.get(rule.priority);
+            if (other !== undefined) {
+                throw new Error(`${owner}: rules "${other}" and "${rule.name}" both have priority ${String(rule.priority)}. ` +
+                    `Priorities must be unique; change one rule's .priority(n).`);
+            }
+            byPriority.set(rule.priority, rule.name);
+        }
+        const rateBased = rules.filter((r) => r.rateBased);
+        if (rateBased.length > MAX_RATE_BASED_RULES) {
+            throw new Error(`${owner} has ${String(rateBased.length)} rate-based rules; AWS WAF allows at most ` +
+                `${String(MAX_RATE_BASED_RULES)} per web ACL. See https://docs.aws.amazon.com/waf/latest/developerguide/limits.html.`);
+        }
+        return rules;
+    }
+}
+/**
+ * Creates a builder for an AWS WAF web ACL, with its rules, its associations
+ * and the visibility settings the rest of the package relies on.
+ *
+ * By default the web ACL is regional, allows what no rule blocks, publishes
+ * CloudWatch metrics for itself and every rule ({@link WEB_ACL_VISIBILITY_DEFAULTS}),
+ * and keeps no sampled requests ({@link WEB_ACL_DEFAULTS}).
+ *
+ * @example
+ * ```ts
+ * createWebAclBuilder()
+ *   .associateWith(ref("api", (r: RestApiBuilderResult) => r.api.deploymentStage))
+ *   .addRule("BlockAdmin", (rule) =>
+ *     rule.statement({
+ *       byteMatchStatement: {
+ *         fieldToMatch: { uriPath: {} },
+ *         positionalConstraint: "STARTS_WITH",
+ *         searchString: "/admin",
+ *         textTransformations: [{ priority: 0, type: "NONE" }],
+ *       },
+ *     }).respond(404));
+ * ```
+ */
+export function createWebAclBuilder() {
+    return taggedBuilder(WebAclBuilder);
+}
+//# sourceMappingURL=web-acl-builder.js.map

package/dist/esm/web-acl-builder.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"web-acl-builder.js","sourceRoot":"","sources":["../../src/web-acl-builder.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,WAAW,EAAE,IAAI,EAAE,MAAM,aAAa,CAAC;AAGhD,OAAO,EAEL,SAAS,GAGV,MAAM,uBAAuB,CAAC;AAE/B,OAAO,EAAE,UAAU,EAAkB,OAAO,EAAmB,MAAM,oBAAoB,CAAC;AAC1F,OAAO,EAAuB,aAAa,EAAE,MAAM,8BAA8B,CAAC;AAClF,OAAO,EAEL,sBAAsB,EACtB,YAAY,GACb,MAAM,0BAA0B,CAAC;AAElC,OAAO,EAAE,6BAA6B,EAAE,MAAM,aAAa,CAAC;AAC5D,OAAO,EAAE,SAAS,EAAgC,MAAM,kBAAkB,CAAC;AAC3E,OAAO,EAAuB,oBAAoB,EAAE,MAAM,sBAAsB,CAAC;AACjF,OAAO,EACL,0BAA0B,EAC1B,gBAAgB,EAChB,2BAA2B,GAC5B,MAAM,eAAe,CAAC;AACvB,OAAO,EACL,kBAAkB,EAClB,cAAc,EACd,kBAAkB,EAClB,gBAAgB,EAChB,kBAAkB,GACnB,MAAM,YAAY,CAAC;AACpB,OAAO,EAEL,uBAAuB,GAExB,MAAM,mBAAmB,CAAC;AAC3B,OAAO,EAAE,gBAAgB,EAA4B,MAAM,cAAc,CAAC;AAC1E,OAAO,EAAsB,aAAa,EAAE,MAAM,cAAc,CAAC;AACjE,OAAO,EAAE,qBAAqB,EAAoB,MAAM,YAAY,CAAC;AA6FrE,MAAM,mBAAmB,GAAG,yCAAyC,CAAC;AACtE,MAAM,oBAAoB,GAAG,EAAE,CAAC;AAEhC,MAAM,aAAa;IACjB,KAAK,GAAgC,EAAE,CAAC;IAC/B,MAAM,GAAgB,EAAE,CAAC;IACzB,aAAa,GAA0C,EAAE,CAAC;IACnE,cAAc,GAAkB,EAAE,MAAM,EAAE,OAAO,EAAE,CAAC;IAC3C,aAAa,GAA4C,EAAE,CAAC;IAErE;;;OAGG;IACH,aAAa,CAAC,MAAyB,EAAE,QAAyB;QAChE,IAAI,MAAM,KAAK,OAAO,IAAI,QAAQ,KAAK,SAAS,EAAE,CAAC;YACjD,MAAM,IAAI,KAAK,CAAC,uEAAuE,CAAC,CAAC;QAC3F,CAAC;QACD,IAAI,CAAC,cAAc,GAAG,EAAE,MAAM,EAAE,QAAQ,EAAE,CAAC;QAC3C,OAAO,IAAI,CAAC;IACd,CAAC;IAED;;;;;;OAMG;IACH,OAAO,CAAC,IAAY,EAAE,SAA2D;QAC/E,gBAAgB,CAAC,IAAI,CAAC,CAAC;QACvB,IAAI,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,KAAK,IAAI,CAAC,EAAE,CAAC;YAC7C,MAAM,IAAI,KAAK,CACb,+CAA+C,IAAI,uCAAuC,CAC3F,CAAC;QACJ,CAAC;QACD,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,SAAS,EAAE,CAAC,CAAC;QACtC,OAAO,IAAI,CAAC;IACd,CAAC;IAED;;;;;;;;OAQG;IACH,aAAa,CAAC,MAA2C;QACvD,IAAI,CAAC,aAAa,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;QAChC,OAAO,IAAI,CAAC;IACd,CAAC;IAED;;;;OAIG;IACH,QAAQ,CAAC,GAAW,EAAE,SAAyC;QAC7D,IAAI,CAAC,aAAa,CAAC,IAAI,CAAC,SAAS,CAAC,IAAI,sBAAsB,CAAgB,GAAG,CAAC,CAAC,CAAC,CAAC;QACnF,OAAO,IAAI,CAAC;IACd,CAAC;IAED;;;OAGG;IACH,SAAS,CAAC,MAAsD;QAC9D,KAAK,MAAM,CAAC,GAAG,EAAE,SAAS,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC,EAAE,CAAC;YACtD,IAAI,CAAC,QAAQ,CAAC,GAAG,EAAE,SAAS,CAAC,CAAC;QAChC,CAAC;QACD,OAAO,IAAI,CAAC;IACd,CAAC;IAED,gCAAgC;IAChC,CAAC,UAAU,CAAC,CAAC,MAAqB;QAChC,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,GAAG,IAAI,CAAC,MAAM,CAAC,CAAC;QACnC,MAAM,CAAC,aAAa,CAAC,IAAI,CAAC,GAAG,IAAI,CAAC,aAAa,CAAC,CAAC;QACjD,MAAM,CAAC,cAAc,GAAG,IAAI,CAAC,cAAc,CAAC;QAC5C,MAAM,CAAC,aAAa,CAAC,IAAI,CAAC,GAAG,IAAI,CAAC,aAAa,CAAC,CAAC;IACnD,CAAC;IAED,KAAK,CAAC,KAAiB,EAAE,EAAU,EAAE,UAAkC,EAAE;QACvE,MAAM,KAAK,GAAG,kBAAkB,EAAE,GAAG,CAAC;QACtC,MAAM,EACJ,KAAK,EAAE,QAAQ,GAAG,gBAAgB,CAAC,KAAK,EACxC,UAAU,EAAE,cAAc,EAC1B,eAAe,GAAG,gBAAgB,CAAC,eAAe,EAClD,OAAO,EAAE,aAAa,GAAG,gBAAgB,CAAC,OAAO,EACjD,iBAAiB,EACjB,GAAG,IAAI,EACR,GAAG,IAAI,CAAC,KAAK,CAAC;QAEf,IAAI,IAAI,CAAC,IAAI,KAAK,SAAS;YAAE,kBAAkB,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QAC3D,IAAI,QAAQ,KAAK,YAAY,EAAE,CAAC;YAC9B,IAAI,IAAI,CAAC,aAAa,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;gBAClC,MAAM,IAAI,KAAK,CACb,GAAG,KAAK,0EAA0E;oBAChF,8EAA8E,CACjF,CAAC;YACJ,CAAC;YACD,qBAAqB,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC;QACnC,CAAC;QAED,IAAI,cAAc,KAAK,SAAS;YAAE,kBAAkB,CAAC,cAAc,CAAC,CAAC;QAErE,MAAM,MAAM,GAAG,IAAI,oBAAoB,CAAC,KAAK,CAAC,CAAC;QAC/C,MAAM,EAAE,MAAM,EAAE,QAAQ,EAAE,GAAG,IAAI,CAAC,cAAc,CAAC;QACjD,MAAM,aAAa,GACjB,MAAM,KAAK,OAAO;YAChB,CAAC,CAAC,EAAE,KAAK,EAAE,EAAE,EAAE;YACf,CAAC,CAAC,EAAE,KAAK,EAAE,MAAM,CAAC,KAAK,CAAC,gBAAgB,EAAE,eAAe,EAAE,QAAQ,CAAC,EAAE,CAAC;QAC3E,MAAM,KAAK,GAAG,IAAI,CAAC,WAAW,CAAC,KAAK,EAAE,MAAM,EAAE,eAAe,CAAC,CAAC;QAC/D,MAAM,YAAY,GAAG,eAAe,IAAI,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC;QACrE,+EAA+E;QAC/E,0EAA0E;QAC1E,4DAA4D;QAC5D,MAAM,iBAAiB,GACrB,sBAAsB,IAAI,IAAI,IAAI,IAAI,CAAC,oBAAoB,KAAK,SAAS,CAAC;QAC5E,IAAI,YAAY,IAAI,CAAC,iBAAiB,EAAE,CAAC;YACvC,WAAW,CAAC,EAAE,CAAC,KAAK,CAAC,CAAC,YAAY,CAChC,mBAAmB,EACnB,GAAG,KAAK,6EAA6E;gBACnF,oFAAoF;gBACpF,4DAA4D,CAC/D,CAAC;QACJ,CAAC;QAED,6FAA6F;QAC7F,MAAM,UAAU,GACd,cAAc;YACd,IAAI,CAAC,MAAM,CAAC,EAAE,OAAO,EAAE,GAAW,EAAE,CAAC,kBAAkB,CAAC,cAAc,CAAC,MAAM,CAAC,CAAC,EAAE,CAAC,CAAC;QACrF,MAAM,MAAM,GAAc,IAAI,SAAS,CAAC,KAAK,EAAE,EAAE,EAAE;YACjD,GAAG,IAAI;YACP,KAAK,EAAE,QAAQ;YACf,aAAa;YACb,KAAK,EAAE,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,QAAQ,CAAC;YACnC,oBAAoB,EAAE,MAAM,CAAC,UAAU,EAAE;YACzC,gBAAgB,EAAE;gBAChB,GAAG,2BAA2B;gBAC9B,UAAU;gBACV,sBAAsB,EAAE,eAAe;aACxC;SACF,CAAC,CAAC;QAEH,MAAM,YAAY,GAAG,SAAS,CAC5B,KAAK,EACL,EAAE,EACF,MAAM,CAAC,OAAO,EACd,IAAI,CAAC,aAAa,CAAC,GAAG,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,OAAO,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,CAC7D,CAAC;QAEF,MAAM,OAAO,GAAG,aAAa,CAC3B,MAAM,EACN,UAAU,EACV,IAAI,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,IAAI,EAAE,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,CAC3D,CAAC;QACF,MAAM,MAAM,GAAG,YAAY,CAAC,KAAK,EAAE,EAAE,EAAE;YACrC,GAAG,6BAA6B,CAAC,KAAK,EAAE,OAAO,EAAE,KAAK,EAAE,iBAAiB,CAAC;YAC1E,GAAG,IAAI,CAAC,aAAa,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC;SACrD,CAAC,CAAC;QAEH,OAAO;YACL,MAAM;YACN,YAAY;YACZ,GAAG,gBAAgB,CAAC,KAAK,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,aAAa,EAAE,OAAO,CAAC;YACrE,OAAO;YACP,MAAM;SACP,CAAC;IACJ,CAAC;IAED,WAAW,CAAC,KAAa,EAAE,MAA4B,EAAE,eAAwB;QAC/E,MAAM,KAAK,GAAG,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,KAAK,EAAE,EAAE;YAC7C,MAAM,OAAO,GAAG,uBAAuB,EAAE,CAAC;YAC1C,KAAK,CAAC,SAAS,CAAC,OAAO,CAAC,CAAC;YACzB,OAAO,OAAO,CAAC,MAAM,CAAC;gBACpB,IAAI,EAAE,KAAK,CAAC,IAAI;gBAChB,KAAK;gBACL,eAAe,EAAE,KAAK,GAAG,0BAA0B;gBACnD,eAAe;gBACf,MAAM;aACP,CAAC,CAAC;QACL,CAAC,CAAC,CAAC;QAEH,MAAM,UAAU,GAAG,IAAI,GAAG,EAAkB,CAAC;QAC7C,KAAK,MAAM,EAAE,QAAQ,EAAE,IAAI,EAAE,IAAI,KAAK,EAAE,CAAC;YACvC,MAAM,KAAK,GAAG,UAAU,CAAC,GAAG,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;YAC5C,IAAI,KAAK,KAAK,SAAS,EAAE,CAAC;gBACxB,MAAM,IAAI,KAAK,CACb,GAAG,KAAK,YAAY,KAAK,UAAU,IAAI,CAAC,IAAI,wBAAwB,MAAM,CAAC,IAAI,CAAC,QAAQ,CAAC,IAAI;oBAC3F,4DAA4D,CAC/D,CAAC;YACJ,CAAC;YACD,UAAU,CAAC,GAAG,CAAC,IAAI,CAAC,QAAQ,EAAE,IAAI,CAAC,IAAI,CAAC,CAAC;QAC3C,CAAC;QAED,MAAM,SAAS,GAAG,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC;QACnD,IAAI,SAAS,CAAC,MAAM,GAAG,oBAAoB,EAAE,CAAC;YAC5C,MAAM,IAAI,KAAK,CACb,GAAG,KAAK,QAAQ,MAAM,CAAC,SAAS,CAAC,MAAM,CAAC,4CAA4C;gBAClF,GAAG,MAAM,CAAC,oBAAoB,CAAC,sFAAsF,CACxH,CAAC;QACJ,CAAC;QAED,OAAO,KAAK,CAAC;IACf,CAAC;CACF;AAED;;;;;;;;;;;;;;;;;;;;;;GAsBG;AACH,MAAM,UAAU,mBAAmB;IACjC,OAAO,aAAa,CAAoC,aAAa,CAAC,CAAC;AACzE,CAAC"}

package/package.json

@@ -1,6 +1,80 @@
 {
   "name": "@composurecdk/wafv2",
-  "version": "0.0.0-stage",
-  "stub": true,
-  "description": "Temporary package placeholder for staged publishing"
-}
+  "version": "0.13.0",
+  "description": "Composable AWS WAF web ACL builder with rate limits, alarms and redacted logging",
+  "repository": {
+    "type": "git",
+    "url": "git+https://github.com/laazyj/composureCDK.git",
+    "directory": "packages/wafv2"
+  },
+  "files": [
+    "dist",
+    "README.md",
+    "LICENSE"
+  ],
+  "keywords": [
+    "aws",
+    "cdk",
+    "aws-cdk",
+    "infrastructure-as-code",
+    "iac",
+    "composurecdk",
+    "waf",
+    "wafv2",
+    "web-acl",
+    "firewall",
+    "rate-limiting"
+  ],
+  "author": "Jason Duffett (https://github.com/laazyj)",
+  "license": "MIT",
+  "publishConfig": {
+    "access": "public"
+  },
+  "type": "module",
+  "engines": {
+    "node": ">=20"
+  },
+  "tshy": {
+    "exports": {
+      "./package.json": "./package.json",
+      ".": "./src/index.ts"
+    }
+  },
+  "peerDependencies": {
+    "@composurecdk/cloudformation": "^0.13.0",
+    "@composurecdk/cloudwatch": "^0.13.0",
+    "@composurecdk/core": "^0.13.0",
+    "@composurecdk/logs": "^0.13.0",
+    "aws-cdk-lib": "^2.93.0",
+    "constructs": "^10.0.0"
+  },
+  "devDependencies": {
+    "@composurecdk/cdk-testing": "*",
+    "@types/node": "^26.6.6",
+    "aws-cdk-lib": "^2.275.0",
+    "constructs": "^10.8.1",
+    "typescript": "^6.0.3",
+    "vitest": "^5.0.0"
+  },
+  "exports": {
+    "./package.json": "./package.json",
+    ".": {
+      "import": {
+        "types": "./dist/esm/index.d.ts",
+        "default": "./dist/esm/index.js"
+      },
+      "require": {
+        "types": "./dist/commonjs/index.d.ts",
+        "default": "./dist/commonjs/index.js"
+      }
+    }
+  },
+  "main": "./dist/commonjs/index.js",
+  "types": "./dist/commonjs/index.d.ts",
+  "module": "./dist/esm/index.js",
+  "nx": {
+    "tags": [
+      "scope:lib"
+    ]
+  }
+}