raindancers-cloudfront 0.0.0

package/lib/cloudfront/cloudfrontWebAcl.js

@@ -0,0 +1,249 @@
+"use strict";
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
+    Object.defineProperty(o, "default", { enumerable: true, value: v });
+}) : function(o, v) {
+    o["default"] = v;
+});
+var __importStar = (this && this.__importStar) || (function () {
+    var ownKeys = function(o) {
+        ownKeys = Object.getOwnPropertyNames || function (o) {
+            var ar = [];
+            for (var k in o) if (Object.prototype.hasOwnProperty.call(o, k)) ar[ar.length] = k;
+            return ar;
+        };
+        return ownKeys(o);
+    };
+    return function (mod) {
+        if (mod && mod.__esModule) return mod;
+        var result = {};
+        if (mod != null) for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);
+        __setModuleDefault(result, mod);
+        return result;
+    };
+})();
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.CloudFrontWebAcl = exports.Country = void 0;
+const core = __importStar(require("aws-cdk-lib"));
+const aws_cdk_lib_1 = require("aws-cdk-lib");
+const constructs = __importStar(require("constructs"));
+const countries_1 = require("./countries");
+var countries_2 = require("./countries");
+Object.defineProperty(exports, "Country", { enumerable: true, get: function () { return countries_2.Country; } });
+/**
+ * Creates a WAF WebACL in us-east-1 for use with CloudFront.
+ *
+ * CloudFront requires WAF WebACLs to be in us-east-1 with CLOUDFRONT scope.
+ * This construct uses a custom resource to create the WebACL in us-east-1
+ * regardless of the stack's region.
+ *
+ * Provides sensible defaults with AWS managed rules for common threats.
+ *
+ * @example
+ * ```typescript
+ * const webAcl = new CloudFrontWebAcl(this, 'WebAcl', {
+ *   name: 'MyCloudFrontWebAcl',
+ *   rateLimit: 10000, // Default for all paths
+ *   pathRateLimits: [
+ *     { path: '/oauth2/callback', rateLimit: 100 },
+ *     { path: '/oauth2/authorize', rateLimit: 100 },
+ *     { path: '/api/auth', rateLimit: 500 },
+ *   ],
+ *   allowedCountries: ['UnitedStates', 'Canada', 'UnitedKingdom'],
+ * });
+ *
+ * new cloudfront.Distribution(this, 'Distribution', {
+ *   webAclId: webAcl.webAclArn,
+ *   // ...
+ * });
+ * ```
+ */
+class CloudFrontWebAcl extends constructs.Construct {
+    constructor(scope, id, props = {}) {
+        super(scope, id);
+        if (props.allowedCountries && props.blockedCountries) {
+            throw new Error('Cannot specify both allowedCountries and blockedCountries');
+        }
+        const name = props.name || `${core.Stack.of(this).stackName}-cloudfront-waf`;
+        const enableManagedRules = props.enableManagedRules ?? true;
+        const rateLimit = props.rateLimit ?? 2000;
+        const pathRateLimits = props.pathRateLimits ?? [];
+        const allowedCountries = props.allowedCountries?.map(c => countries_1.Country[c]) ?? [];
+        const blockedCountries = props.blockedCountries?.map(c => countries_1.Country[c]) ?? [];
+        const rules = this.buildRules(enableManagedRules, rateLimit, pathRateLimits, allowedCountries, blockedCountries);
+        this.webAcl = new aws_cdk_lib_1.aws_wafv2.CfnWebACL(this, 'WebACL', {
+            scope: 'CLOUDFRONT',
+            defaultAction: { allow: {} },
+            rules: rules,
+            visibilityConfig: {
+                sampledRequestsEnabled: true,
+                cloudWatchMetricsEnabled: true,
+                metricName: name,
+            },
+            name: name,
+        });
+        this.webAclArn = this.webAcl.attrArn;
+        this.webAclId = this.webAcl.attrId;
+    }
+    buildRules(enableManagedRules, rateLimit, pathRateLimits, allowedCountries, blockedCountries) {
+        const rules = [];
+        let priority = 0;
+        if (allowedCountries.length > 0) {
+            rules.push({
+                name: 'GeoAllowRule',
+                priority: priority++,
+                statement: {
+                    notStatement: {
+                        statement: {
+                            geoMatchStatement: {
+                                countryCodes: allowedCountries,
+                            },
+                        },
+                    },
+                },
+                action: { block: {} },
+                visibilityConfig: {
+                    sampledRequestsEnabled: true,
+                    cloudWatchMetricsEnabled: true,
+                    metricName: 'GeoAllowRule',
+                },
+            });
+        }
+        if (blockedCountries.length > 0) {
+            rules.push({
+                name: 'GeoBlockRule',
+                priority: priority++,
+                statement: {
+                    geoMatchStatement: {
+                        countryCodes: blockedCountries,
+                    },
+                },
+                action: { block: {} },
+                visibilityConfig: {
+                    sampledRequestsEnabled: true,
+                    cloudWatchMetricsEnabled: true,
+                    metricName: 'GeoBlockRule',
+                },
+            });
+        }
+        pathRateLimits.forEach((pathLimit, idx) => {
+            const ruleName = pathLimit.name || `PathRateLimit${idx}`;
+            rules.push({
+                name: ruleName,
+                priority: priority++,
+                statement: {
+                    rateBasedStatement: {
+                        limit: pathLimit.rateLimit,
+                        aggregateKeyType: 'IP',
+                        scopeDownStatement: {
+                            byteMatchStatement: {
+                                searchString: pathLimit.path,
+                                fieldToMatch: { uriPath: {} },
+                                textTransformations: [{ priority: 0, type: 'NONE' }],
+                                positionalConstraint: pathLimit.path.includes('*') ? 'CONTAINS' : 'STARTS_WITH',
+                            },
+                        },
+                    },
+                },
+                action: { block: {} },
+                visibilityConfig: {
+                    sampledRequestsEnabled: true,
+                    cloudWatchMetricsEnabled: true,
+                    metricName: ruleName,
+                },
+            });
+        });
+        rules.push({
+            name: 'RateLimitRule',
+            priority: priority++,
+            statement: {
+                rateBasedStatement: {
+                    limit: rateLimit,
+                    aggregateKeyType: 'IP',
+                },
+            },
+            action: { block: {} },
+            visibilityConfig: {
+                sampledRequestsEnabled: true,
+                cloudWatchMetricsEnabled: true,
+                metricName: 'RateLimitRule',
+            },
+        });
+        if (enableManagedRules) {
+            rules.push({
+                name: 'AWSManagedRulesCommonRuleSet',
+                priority: priority++,
+                statement: {
+                    managedRuleGroupStatement: {
+                        vendorName: 'AWS',
+                        name: 'AWSManagedRulesCommonRuleSet',
+                    },
+                },
+                overrideAction: { none: {} },
+                visibilityConfig: {
+                    sampledRequestsEnabled: true,
+                    cloudWatchMetricsEnabled: true,
+                    metricName: 'AWSManagedRulesCommonRuleSet',
+                },
+            }, {
+                name: 'AWSManagedRulesKnownBadInputsRuleSet',
+                priority: priority++,
+                statement: {
+                    managedRuleGroupStatement: {
+                        vendorName: 'AWS',
+                        name: 'AWSManagedRulesKnownBadInputsRuleSet',
+                    },
+                },
+                overrideAction: { none: {} },
+                visibilityConfig: {
+                    sampledRequestsEnabled: true,
+                    cloudWatchMetricsEnabled: true,
+                    metricName: 'AWSManagedRulesKnownBadInputsRuleSet',
+                },
+            }, {
+                name: 'AWSManagedRulesAmazonIpReputationList',
+                priority: priority++,
+                statement: {
+                    managedRuleGroupStatement: {
+                        vendorName: 'AWS',
+                        name: 'AWSManagedRulesAmazonIpReputationList',
+                    },
+                },
+                overrideAction: { none: {} },
+                visibilityConfig: {
+                    sampledRequestsEnabled: true,
+                    cloudWatchMetricsEnabled: true,
+                    metricName: 'AWSManagedRulesAmazonIpReputationList',
+                },
+            }, {
+                name: 'AWSManagedRulesAnonymousIpList',
+                priority: priority++,
+                statement: {
+                    managedRuleGroupStatement: {
+                        vendorName: 'AWS',
+                        name: 'AWSManagedRulesAnonymousIpList',
+                    },
+                },
+                overrideAction: { none: {} },
+                visibilityConfig: {
+                    sampledRequestsEnabled: true,
+                    cloudWatchMetricsEnabled: true,
+                    metricName: 'AWSManagedRulesAnonymousIpList',
+                },
+            });
+        }
+        return rules;
+    }
+}
+exports.CloudFrontWebAcl = CloudFrontWebAcl;
+//# sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJmaWxlIjoiY2xvdWRmcm9udFdlYkFjbC5qcyIsInNvdXJjZVJvb3QiOiIiLCJzb3VyY2VzIjpbIi4uLy4uL3NyYy9jbG91ZGZyb250L2Nsb3VkZnJvbnRXZWJBY2wudHMiXSwibmFtZXMiOltdLCJtYXBwaW5ncyI6Ijs7Ozs7Ozs7Ozs7Ozs7Ozs7Ozs7Ozs7Ozs7Ozs7Ozs7Ozs7O0FBQUEsa0RBQW9DO0FBQ3BDLDZDQUVxQjtBQUNyQix1REFBeUM7QUFDekMsMkNBQXNDO0FBRXRDLHlDQUFtRDtBQUExQyxvR0FBQSxPQUFPLE9BQUE7QUFvQ2hCOzs7Ozs7Ozs7Ozs7Ozs7Ozs7Ozs7Ozs7Ozs7R0EyQkc7QUFDSCxNQUFhLGdCQUFpQixTQUFRLFVBQVUsQ0FBQyxTQUFTO0lBUXhELFlBQVksS0FBMkIsRUFBRSxFQUFVLEVBQUUsUUFBK0IsRUFBRTtRQUNwRixLQUFLLENBQUMsS0FBSyxFQUFFLEVBQUUsQ0FBQyxDQUFDO1FBRWpCLElBQUksS0FBSyxDQUFDLGdCQUFnQixJQUFJLEtBQUssQ0FBQyxnQkFBZ0IsRUFBRSxDQUFDO1lBQ3JELE1BQU0sSUFBSSxLQUFLLENBQUMsMkRBQTJELENBQUMsQ0FBQztRQUMvRSxDQUFDO1FBRUQsTUFBTSxJQUFJLEdBQUcsS0FBSyxDQUFDLElBQUksSUFBSSxHQUFHLElBQUksQ0FBQyxLQUFLLENBQUMsRUFBRSxDQUFDLElBQUksQ0FBQyxDQUFDLFNBQVMsaUJBQWlCLENBQUM7UUFDN0UsTUFBTSxrQkFBa0IsR0FBRyxLQUFLLENBQUMsa0JBQWtCLElBQUksSUFBSSxDQUFDO1FBQzVELE1BQU0sU0FBUyxHQUFHLEtBQUssQ0FBQyxTQUFTLElBQUksSUFBSSxDQUFDO1FBQzFDLE1BQU0sY0FBYyxHQUFHLEtBQUssQ0FBQyxjQUFjLElBQUksRUFBRSxDQUFDO1FBQ2xELE1BQU0sZ0JBQWdCLEdBQUcsS0FBSyxDQUFDLGdCQUFnQixFQUFFLEdBQUcsQ0FBQyxDQUFDLENBQUMsRUFBRSxDQUFDLG1CQUFPLENBQUMsQ0FBQyxDQUFDLENBQUMsSUFBSSxFQUFFLENBQUM7UUFDNUUsTUFBTSxnQkFBZ0IsR0FBRyxLQUFLLENBQUMsZ0JBQWdCLEVBQUUsR0FBRyxDQUFDLENBQUMsQ0FBQyxFQUFFLENBQUMsbUJBQU8sQ0FBQyxDQUFDLENBQUMsQ0FBQyxJQUFJLEVBQUUsQ0FBQztRQUU1RSxNQUFNLEtBQUssR0FBRyxJQUFJLENBQUMsVUFBVSxDQUFDLGtCQUFrQixFQUFFLFNBQVMsRUFBRSxjQUFjLEVBQUUsZ0JBQWdCLEVBQUUsZ0JBQWdCLENBQUMsQ0FBQztRQUVqSCxJQUFJLENBQUMsTUFBTSxHQUFHLElBQUksdUJBQUssQ0FBQyxTQUFTLENBQUMsSUFBSSxFQUFFLFFBQVEsRUFBRTtZQUNoRCxLQUFLLEVBQUUsWUFBWTtZQUNuQixhQUFhLEVBQUUsRUFBRSxLQUFLLEVBQUUsRUFBRSxFQUFFO1lBQzVCLEtBQUssRUFBRSxLQUFLO1lBQ1osZ0JBQWdCLEVBQUU7Z0JBQ2hCLHNCQUFzQixFQUFFLElBQUk7Z0JBQzVCLHdCQUF3QixFQUFFLElBQUk7Z0JBQzlCLFVBQVUsRUFBRSxJQUFJO2FBQ2pCO1lBQ0QsSUFBSSxFQUFFLElBQUk7U0FDWCxDQUFDLENBQUM7UUFFSCxJQUFJLENBQUMsU0FBUyxHQUFHLElBQUksQ0FBQyxNQUFNLENBQUMsT0FBTyxDQUFDO1FBQ3JDLElBQUksQ0FBQyxRQUFRLEdBQUcsSUFBSSxDQUFDLE1BQU0sQ0FBQyxNQUFNLENBQUM7SUFDckMsQ0FBQztJQUVPLFVBQVUsQ0FDaEIsa0JBQTJCLEVBQzNCLFNBQWlCLEVBQ2pCLGNBQStCLEVBQy9CLGdCQUEwQixFQUMxQixnQkFBMEI7UUFFMUIsTUFBTSxLQUFLLEdBQW1DLEVBQUUsQ0FBQztRQUNqRCxJQUFJLFFBQVEsR0FBRyxDQUFDLENBQUM7UUFFakIsSUFBSSxnQkFBZ0IsQ0FBQyxNQUFNLEdBQUcsQ0FBQyxFQUFFLENBQUM7WUFDaEMsS0FBSyxDQUFDLElBQUksQ0FBQztnQkFDVCxJQUFJLEVBQUUsY0FBYztnQkFDcEIsUUFBUSxFQUFFLFFBQVEsRUFBRTtnQkFDcEIsU0FBUyxFQUFFO29CQUNULFlBQVksRUFBRTt3QkFDWixTQUFTLEVBQUU7NEJBQ1QsaUJBQWlCLEVBQUU7Z0NBQ2pCLFlBQVksRUFBRSxnQkFBZ0I7NkJBQy9CO3lCQUNGO3FCQUNGO2lCQUNGO2dCQUNELE1BQU0sRUFBRSxFQUFFLEtBQUssRUFBRSxFQUFFLEVBQUU7Z0JBQ3JCLGdCQUFnQixFQUFFO29CQUNoQixzQkFBc0IsRUFBRSxJQUFJO29CQUM1Qix3QkFBd0IsRUFBRSxJQUFJO29CQUM5QixVQUFVLEVBQUUsY0FBYztpQkFDM0I7YUFDRixDQUFDLENBQUM7UUFDTCxDQUFDO1FBRUQsSUFBSSxnQkFBZ0IsQ0FBQyxNQUFNLEdBQUcsQ0FBQyxFQUFFLENBQUM7WUFDaEMsS0FBSyxDQUFDLElBQUksQ0FBQztnQkFDVCxJQUFJLEVBQUUsY0FBYztnQkFDcEIsUUFBUSxFQUFFLFFBQVEsRUFBRTtnQkFDcEIsU0FBUyxFQUFFO29CQUNULGlCQUFpQixFQUFFO3dCQUNqQixZQUFZLEVBQUUsZ0JBQWdCO3FCQUMvQjtpQkFDRjtnQkFDRCxNQUFNLEVBQUUsRUFBRSxLQUFLLEVBQUUsRUFBRSxFQUFFO2dCQUNyQixnQkFBZ0IsRUFBRTtvQkFDaEIsc0JBQXNCLEVBQUUsSUFBSTtvQkFDNUIsd0JBQXdCLEVBQUUsSUFBSTtvQkFDOUIsVUFBVSxFQUFFLGNBQWM7aUJBQzNCO2FBQ0YsQ0FBQyxDQUFDO1FBQ0wsQ0FBQztRQUVELGNBQWMsQ0FBQyxPQUFPLENBQUMsQ0FBQyxTQUFTLEVBQUUsR0FBRyxFQUFFLEVBQUU7WUFDeEMsTUFBTSxRQUFRLEdBQUcsU0FBUyxDQUFDLElBQUksSUFBSSxnQkFBZ0IsR0FBRyxFQUFFLENBQUM7WUFDekQsS0FBSyxDQUFDLElBQUksQ0FBQztnQkFDVCxJQUFJLEVBQUUsUUFBUTtnQkFDZCxRQUFRLEVBQUUsUUFBUSxFQUFFO2dCQUNwQixTQUFTLEVBQUU7b0JBQ1Qsa0JBQWtCLEVBQUU7d0JBQ2xCLEtBQUssRUFBRSxTQUFTLENBQUMsU0FBUzt3QkFDMUIsZ0JBQWdCLEVBQUUsSUFBSTt3QkFDdEIsa0JBQWtCLEVBQUU7NEJBQ2xCLGtCQUFrQixFQUFFO2dDQUNsQixZQUFZLEVBQUUsU0FBUyxDQUFDLElBQUk7Z0NBQzVCLFlBQVksRUFBRSxFQUFFLE9BQU8sRUFBRSxFQUFFLEVBQUU7Z0NBQzdCLG1CQUFtQixFQUFFLENBQUMsRUFBRSxRQUFRLEVBQUUsQ0FBQyxFQUFFLElBQUksRUFBRSxNQUFNLEVBQUUsQ0FBQztnQ0FDcEQsb0JBQW9CLEVBQUUsU0FBUyxDQUFDLElBQUksQ0FBQyxRQUFRLENBQUMsR0FBRyxDQUFDLENBQUMsQ0FBQyxDQUFDLFVBQVUsQ0FBQyxDQUFDLENBQUMsYUFBYTs2QkFDaEY7eUJBQ0Y7cUJBQ0Y7aUJBQ0Y7Z0JBQ0QsTUFBTSxFQUFFLEVBQUUsS0FBSyxFQUFFLEVBQUUsRUFBRTtnQkFDckIsZ0JBQWdCLEVBQUU7b0JBQ2hCLHNCQUFzQixFQUFFLElBQUk7b0JBQzVCLHdCQUF3QixFQUFFLElBQUk7b0JBQzlCLFVBQVUsRUFBRSxRQUFRO2lCQUNyQjthQUNGLENBQUMsQ0FBQztRQUNMLENBQUMsQ0FBQyxDQUFDO1FBRUgsS0FBSyxDQUFDLElBQUksQ0FBQztZQUNULElBQUksRUFBRSxlQUFlO1lBQ3JCLFFBQVEsRUFBRSxRQUFRLEVBQUU7WUFDcEIsU0FBUyxFQUFFO2dCQUNULGtCQUFrQixFQUFFO29CQUNsQixLQUFLLEVBQUUsU0FBUztvQkFDaEIsZ0JBQWdCLEVBQUUsSUFBSTtpQkFDdkI7YUFDRjtZQUNELE1BQU0sRUFBRSxFQUFFLEtBQUssRUFBRSxFQUFFLEVBQUU7WUFDckIsZ0JBQWdCLEVBQUU7Z0JBQ2hCLHNCQUFzQixFQUFFLElBQUk7Z0JBQzVCLHdCQUF3QixFQUFFLElBQUk7Z0JBQzlCLFVBQVUsRUFBRSxlQUFlO2FBQzVCO1NBQ0YsQ0FBQyxDQUFDO1FBRUgsSUFBSSxrQkFBa0IsRUFBRSxDQUFDO1lBQ3ZCLEtBQUssQ0FBQyxJQUFJLENBQ1I7Z0JBQ0UsSUFBSSxFQUFFLDhCQUE4QjtnQkFDcEMsUUFBUSxFQUFFLFFBQVEsRUFBRTtnQkFDcEIsU0FBUyxFQUFFO29CQUNULHlCQUF5QixFQUFFO3dCQUN6QixVQUFVLEVBQUUsS0FBSzt3QkFDakIsSUFBSSxFQUFFLDhCQUE4QjtxQkFDckM7aUJBQ0Y7Z0JBQ0QsY0FBYyxFQUFFLEVBQUUsSUFBSSxFQUFFLEVBQUUsRUFBRTtnQkFDNUIsZ0JBQWdCLEVBQUU7b0JBQ2hCLHNCQUFzQixFQUFFLElBQUk7b0JBQzVCLHdCQUF3QixFQUFFLElBQUk7b0JBQzlCLFVBQVUsRUFBRSw4QkFBOEI7aUJBQzNDO2FBQ0YsRUFDRDtnQkFDRSxJQUFJLEVBQUUsc0NBQXNDO2dCQUM1QyxRQUFRLEVBQUUsUUFBUSxFQUFFO2dCQUNwQixTQUFTLEVBQUU7b0JBQ1QseUJBQXlCLEVBQUU7d0JBQ3pCLFVBQVUsRUFBRSxLQUFLO3dCQUNqQixJQUFJLEVBQUUsc0NBQXNDO3FCQUM3QztpQkFDRjtnQkFDRCxjQUFjLEVBQUUsRUFBRSxJQUFJLEVBQUUsRUFBRSxFQUFFO2dCQUM1QixnQkFBZ0IsRUFBRTtvQkFDaEIsc0JBQXNCLEVBQUUsSUFBSTtvQkFDNUIsd0JBQXdCLEVBQUUsSUFBSTtvQkFDOUIsVUFBVSxFQUFFLHNDQUFzQztpQkFDbkQ7YUFDRixFQUNEO2dCQUNFLElBQUksRUFBRSx1Q0FBdUM7Z0JBQzdDLFFBQVEsRUFBRSxRQUFRLEVBQUU7Z0JBQ3BCLFNBQVMsRUFBRTtvQkFDVCx5QkFBeUIsRUFBRTt3QkFDekIsVUFBVSxFQUFFLEtBQUs7d0JBQ2pCLElBQUksRUFBRSx1Q0FBdUM7cUJBQzlDO2lCQUNGO2dCQUNELGNBQWMsRUFBRSxFQUFFLElBQUksRUFBRSxFQUFFLEVBQUU7Z0JBQzVCLGdCQUFnQixFQUFFO29CQUNoQixzQkFBc0IsRUFBRSxJQUFJO29CQUM1Qix3QkFBd0IsRUFBRSxJQUFJO29CQUM5QixVQUFVLEVBQUUsdUNBQXVDO2lCQUNwRDthQUNGLEVBQ0Q7Z0JBQ0UsSUFBSSxFQUFFLGdDQUFnQztnQkFDdEMsUUFBUSxFQUFFLFFBQVEsRUFBRTtnQkFDcEIsU0FBUyxFQUFFO29CQUNULHlCQUF5QixFQUFFO3dCQUN6QixVQUFVLEVBQUUsS0FBSzt3QkFDakIsSUFBSSxFQUFFLGdDQUFnQztxQkFDdkM7aUJBQ0Y7Z0JBQ0QsY0FBYyxFQUFFLEVBQUUsSUFBSSxFQUFFLEVBQUUsRUFBRTtnQkFDNUIsZ0JBQWdCLEVBQUU7b0JBQ2hCLHNCQUFzQixFQUFFLElBQUk7b0JBQzVCLHdCQUF3QixFQUFFLElBQUk7b0JBQzlCLFVBQVUsRUFBRSxnQ0FBZ0M7aUJBQzdDO2FBQ0YsQ0FDRixDQUFDO1FBQ0osQ0FBQztRQUVELE9BQU8sS0FBSyxDQUFDO0lBQ2YsQ0FBQztDQUNGO0FBOU1ELDRDQThNQyIsInNvdXJjZXNDb250ZW50IjpbImltcG9ydCAqIGFzIGNvcmUgZnJvbSAnYXdzLWNkay1saWInO1xuaW1wb3J0IHtcbiAgYXdzX3dhZnYyIGFzIHdhZnYyLFxufSBmcm9tICdhd3MtY2RrLWxpYic7XG5pbXBvcnQgKiBhcyBjb25zdHJ1Y3RzIGZyb20gJ2NvbnN0cnVjdHMnO1xuaW1wb3J0IHsgQ291bnRyeSB9IGZyb20gJy4vY291bnRyaWVzJztcblxuZXhwb3J0IHsgQ291bnRyeSwgQ291bnRyeUNvZGUgfSBmcm9tICcuL2NvdW50cmllcyc7XG5cbmV4cG9ydCB0eXBlIENvdW50cnlOYW1lID0ga2V5b2YgdHlwZW9mIENvdW50cnk7XG5cbi8qKlxuICogUGF0aC1zcGVjaWZpYyByYXRlIGxpbWl0IGNvbmZpZ3VyYXRpb24uXG4gKi9cbmV4cG9ydCBpbnRlcmZhY2UgUGF0aFJhdGVMaW1pdCB7XG4gIC8qKiBVUkkgcGF0aCBwYXR0ZXJuIChlLmcuLCAnL29hdXRoMi9jYWxsYmFjaycsICcvYXBpL2F1dGgvKicpICovXG4gIHJlYWRvbmx5IHBhdGg6IHN0cmluZztcbiAgLyoqIFJhdGUgbGltaXQgZm9yIHRoaXMgcGF0aCAocmVxdWVzdHMgcGVyIDUgbWludXRlcykgKi9cbiAgcmVhZG9ubHkgcmF0ZUxpbWl0OiBudW1iZXI7XG4gIC8qKiBPcHRpb25hbCBuYW1lIGZvciB0aGUgcnVsZSAoYXV0by1nZW5lcmF0ZWQgaWYgbm90IHByb3ZpZGVkKSAqL1xuICByZWFkb25seSBuYW1lPzogc3RyaW5nO1xufVxuXG4vKipcbiAqIFByb3BlcnRpZXMgZm9yIENsb3VkRnJvbnRXZWJBY2wgY29uc3RydWN0LlxuICovXG5leHBvcnQgaW50ZXJmYWNlIENsb3VkRnJvbnRXZWJBY2xQcm9wcyB7XG4gIC8qKiBOYW1lIGZvciB0aGUgV2ViIEFDTCAqL1xuICByZWFkb25seSBuYW1lPzogc3RyaW5nO1xuICAvKiogV2hldGhlciB0byBlbmFibGUgQVdTIG1hbmFnZWQgcnVsZXMgKGRlZmF1bHQ6IHRydWUpICovXG4gIHJlYWRvbmx5IGVuYWJsZU1hbmFnZWRSdWxlcz86IGJvb2xlYW47XG4gIC8qKiBDdXN0b20gcnVsZXMgdG8gYWRkIHRvIHRoZSBXZWIgQUNMICovXG4gIHJlYWRvbmx5IHJ1bGVzPzogd2FmdjIuQ2ZuV2ViQUNMLlJ1bGVQcm9wZXJ0eVtdO1xuICAvKiogUmF0ZSBsaW1pdCBmb3IgcmVxdWVzdHMgcGVyIDUgbWludXRlcyAoZGVmYXVsdDogMjAwMCkgKi9cbiAgcmVhZG9ubHkgcmF0ZUxpbWl0PzogbnVtYmVyO1xuICAvKiogUGF0aC1zcGVjaWZpYyByYXRlIGxpbWl0cyAob3ZlcnJpZGVzIGRlZmF1bHQgcmF0ZUxpbWl0IGZvciBtYXRjaGluZyBwYXRocykgKi9cbiAgcmVhZG9ubHkgcGF0aFJhdGVMaW1pdHM/OiBQYXRoUmF0ZUxpbWl0W107XG4gIC8qKiBBbGxvdyByZXF1ZXN0cyBvbmx5IGZyb20gdGhlc2UgY291bnRyaWVzIChhbGwgb3RoZXJzIGJsb2NrZWQpICovXG4gIHJlYWRvbmx5IGFsbG93ZWRDb3VudHJpZXM/OiBDb3VudHJ5TmFtZVtdO1xuICAvKiogQmxvY2sgcmVxdWVzdHMgZnJvbSB0aGVzZSBjb3VudHJpZXMgKGFsbCBvdGhlcnMgYWxsb3dlZCkgKi9cbiAgcmVhZG9ubHkgYmxvY2tlZENvdW50cmllcz86IENvdW50cnlOYW1lW107XG59XG5cbi8qKlxuICogQ3JlYXRlcyBhIFdBRiBXZWJBQ0wgaW4gdXMtZWFzdC0xIGZvciB1c2Ugd2l0aCBDbG91ZEZyb250LlxuICpcbiAqIENsb3VkRnJvbnQgcmVxdWlyZXMgV0FGIFdlYkFDTHMgdG8gYmUgaW4gdXMtZWFzdC0xIHdpdGggQ0xPVURGUk9OVCBzY29wZS5cbiAqIFRoaXMgY29uc3RydWN0IHVzZXMgYSBjdXN0b20gcmVzb3VyY2UgdG8gY3JlYXRlIHRoZSBXZWJBQ0wgaW4gdXMtZWFzdC0xXG4gKiByZWdhcmRsZXNzIG9mIHRoZSBzdGFjaydzIHJlZ2lvbi5cbiAqXG4gKiBQcm92aWRlcyBzZW5zaWJsZSBkZWZhdWx0cyB3aXRoIEFXUyBtYW5hZ2VkIHJ1bGVzIGZvciBjb21tb24gdGhyZWF0cy5cbiAqXG4gKiBAZXhhbXBsZVxuICogYGBgdHlwZXNjcmlwdFxuICogY29uc3Qgd2ViQWNsID0gbmV3IENsb3VkRnJvbnRXZWJBY2wodGhpcywgJ1dlYkFjbCcsIHtcbiAqICAgbmFtZTogJ015Q2xvdWRGcm9udFdlYkFjbCcsXG4gKiAgIHJhdGVMaW1pdDogMTAwMDAsIC8vIERlZmF1bHQgZm9yIGFsbCBwYXRoc1xuICogICBwYXRoUmF0ZUxpbWl0czogW1xuICogICAgIHsgcGF0aDogJy9vYXV0aDIvY2FsbGJhY2snLCByYXRlTGltaXQ6IDEwMCB9LFxuICogICAgIHsgcGF0aDogJy9vYXV0aDIvYXV0aG9yaXplJywgcmF0ZUxpbWl0OiAxMDAgfSxcbiAqICAgICB7IHBhdGg6ICcvYXBpL2F1dGgnLCByYXRlTGltaXQ6IDUwMCB9LFxuICogICBdLFxuICogICBhbGxvd2VkQ291bnRyaWVzOiBbJ1VuaXRlZFN0YXRlcycsICdDYW5hZGEnLCAnVW5pdGVkS2luZ2RvbSddLFxuICogfSk7XG4gKlxuICogbmV3IGNsb3VkZnJvbnQuRGlzdHJpYnV0aW9uKHRoaXMsICdEaXN0cmlidXRpb24nLCB7XG4gKiAgIHdlYkFjbElkOiB3ZWJBY2wud2ViQWNsQXJuLFxuICogICAvLyAuLi5cbiAqIH0pO1xuICogYGBgXG4gKi9cbmV4cG9ydCBjbGFzcyBDbG91ZEZyb250V2ViQWNsIGV4dGVuZHMgY29uc3RydWN0cy5Db25zdHJ1Y3Qge1xuICAvKiogVGhlIFdlYkFDTCBBUk4gKi9cbiAgcHVibGljIHJlYWRvbmx5IHdlYkFjbEFybjogc3RyaW5nO1xuICAvKiogVGhlIFdlYkFDTCBJRCAqL1xuICBwdWJsaWMgcmVhZG9ubHkgd2ViQWNsSWQ6IHN0cmluZztcblxuICBwcml2YXRlIHJlYWRvbmx5IHdlYkFjbDogd2FmdjIuQ2ZuV2ViQUNMO1xuXG4gIGNvbnN0cnVjdG9yKHNjb3BlOiBjb25zdHJ1Y3RzLkNvbnN0cnVjdCwgaWQ6IHN0cmluZywgcHJvcHM6IENsb3VkRnJvbnRXZWJBY2xQcm9wcyA9IHt9KSB7XG4gICAgc3VwZXIoc2NvcGUsIGlkKTtcblxuICAgIGlmIChwcm9wcy5hbGxvd2VkQ291bnRyaWVzICYmIHByb3BzLmJsb2NrZWRDb3VudHJpZXMpIHtcbiAgICAgIHRocm93IG5ldyBFcnJvcignQ2Fubm90IHNwZWNpZnkgYm90aCBhbGxvd2VkQ291bnRyaWVzIGFuZCBibG9ja2VkQ291bnRyaWVzJyk7XG4gICAgfVxuXG4gICAgY29uc3QgbmFtZSA9IHByb3BzLm5hbWUgfHwgYCR7Y29yZS5TdGFjay5vZih0aGlzKS5zdGFja05hbWV9LWNsb3VkZnJvbnQtd2FmYDtcbiAgICBjb25zdCBlbmFibGVNYW5hZ2VkUnVsZXMgPSBwcm9wcy5lbmFibGVNYW5hZ2VkUnVsZXMgPz8gdHJ1ZTtcbiAgICBjb25zdCByYXRlTGltaXQgPSBwcm9wcy5yYXRlTGltaXQgPz8gMjAwMDtcbiAgICBjb25zdCBwYXRoUmF0ZUxpbWl0cyA9IHByb3BzLnBhdGhSYXRlTGltaXRzID8/IFtdO1xuICAgIGNvbnN0IGFsbG93ZWRDb3VudHJpZXMgPSBwcm9wcy5hbGxvd2VkQ291bnRyaWVzPy5tYXAoYyA9PiBDb3VudHJ5W2NdKSA/PyBbXTtcbiAgICBjb25zdCBibG9ja2VkQ291bnRyaWVzID0gcHJvcHMuYmxvY2tlZENvdW50cmllcz8ubWFwKGMgPT4gQ291bnRyeVtjXSkgPz8gW107XG5cbiAgICBjb25zdCBydWxlcyA9IHRoaXMuYnVpbGRSdWxlcyhlbmFibGVNYW5hZ2VkUnVsZXMsIHJhdGVMaW1pdCwgcGF0aFJhdGVMaW1pdHMsIGFsbG93ZWRDb3VudHJpZXMsIGJsb2NrZWRDb3VudHJpZXMpO1xuXG4gICAgdGhpcy53ZWJBY2wgPSBuZXcgd2FmdjIuQ2ZuV2ViQUNMKHRoaXMsICdXZWJBQ0wnLCB7XG4gICAgICBzY29wZTogJ0NMT1VERlJPTlQnLFxuICAgICAgZGVmYXVsdEFjdGlvbjogeyBhbGxvdzoge30gfSxcbiAgICAgIHJ1bGVzOiBydWxlcyxcbiAgICAgIHZpc2liaWxpdHlDb25maWc6IHtcbiAgICAgICAgc2FtcGxlZFJlcXVlc3RzRW5hYmxlZDogdHJ1ZSxcbiAgICAgICAgY2xvdWRXYXRjaE1ldHJpY3NFbmFibGVkOiB0cnVlLFxuICAgICAgICBtZXRyaWNOYW1lOiBuYW1lLFxuICAgICAgfSxcbiAgICAgIG5hbWU6IG5hbWUsXG4gICAgfSk7XG5cbiAgICB0aGlzLndlYkFjbEFybiA9IHRoaXMud2ViQWNsLmF0dHJBcm47XG4gICAgdGhpcy53ZWJBY2xJZCA9IHRoaXMud2ViQWNsLmF0dHJJZDtcbiAgfVxuXG4gIHByaXZhdGUgYnVpbGRSdWxlcyhcbiAgICBlbmFibGVNYW5hZ2VkUnVsZXM6IGJvb2xlYW4sXG4gICAgcmF0ZUxpbWl0OiBudW1iZXIsXG4gICAgcGF0aFJhdGVMaW1pdHM6IFBhdGhSYXRlTGltaXRbXSxcbiAgICBhbGxvd2VkQ291bnRyaWVzOiBzdHJpbmdbXSxcbiAgICBibG9ja2VkQ291bnRyaWVzOiBzdHJpbmdbXSxcbiAgKTogd2FmdjIuQ2ZuV2ViQUNMLlJ1bGVQcm9wZXJ0eVtdIHtcbiAgICBjb25zdCBydWxlczogd2FmdjIuQ2ZuV2ViQUNMLlJ1bGVQcm9wZXJ0eVtdID0gW107XG4gICAgbGV0IHByaW9yaXR5ID0gMDtcblxuICAgIGlmIChhbGxvd2VkQ291bnRyaWVzLmxlbmd0aCA+IDApIHtcbiAgICAgIHJ1bGVzLnB1c2goe1xuICAgICAgICBuYW1lOiAnR2VvQWxsb3dSdWxlJyxcbiAgICAgICAgcHJpb3JpdHk6IHByaW9yaXR5KyssXG4gICAgICAgIHN0YXRlbWVudDoge1xuICAgICAgICAgIG5vdFN0YXRlbWVudDoge1xuICAgICAgICAgICAgc3RhdGVtZW50OiB7XG4gICAgICAgICAgICAgIGdlb01hdGNoU3RhdGVtZW50OiB7XG4gICAgICAgICAgICAgICAgY291bnRyeUNvZGVzOiBhbGxvd2VkQ291bnRyaWVzLFxuICAgICAgICAgICAgICB9LFxuICAgICAgICAgICAgfSxcbiAgICAgICAgICB9LFxuICAgICAgICB9LFxuICAgICAgICBhY3Rpb246IHsgYmxvY2s6IHt9IH0sXG4gICAgICAgIHZpc2liaWxpdHlDb25maWc6IHtcbiAgICAgICAgICBzYW1wbGVkUmVxdWVzdHNFbmFibGVkOiB0cnVlLFxuICAgICAgICAgIGNsb3VkV2F0Y2hNZXRyaWNzRW5hYmxlZDogdHJ1ZSxcbiAgICAgICAgICBtZXRyaWNOYW1lOiAnR2VvQWxsb3dSdWxlJyxcbiAgICAgICAgfSxcbiAgICAgIH0pO1xuICAgIH1cblxuICAgIGlmIChibG9ja2VkQ291bnRyaWVzLmxlbmd0aCA+IDApIHtcbiAgICAgIHJ1bGVzLnB1c2goe1xuICAgICAgICBuYW1lOiAnR2VvQmxvY2tSdWxlJyxcbiAgICAgICAgcHJpb3JpdHk6IHByaW9yaXR5KyssXG4gICAgICAgIHN0YXRlbWVudDoge1xuICAgICAgICAgIGdlb01hdGNoU3RhdGVtZW50OiB7XG4gICAgICAgICAgICBjb3VudHJ5Q29kZXM6IGJsb2NrZWRDb3VudHJpZXMsXG4gICAgICAgICAgfSxcbiAgICAgICAgfSxcbiAgICAgICAgYWN0aW9uOiB7IGJsb2NrOiB7fSB9LFxuICAgICAgICB2aXNpYmlsaXR5Q29uZmlnOiB7XG4gICAgICAgICAgc2FtcGxlZFJlcXVlc3RzRW5hYmxlZDogdHJ1ZSxcbiAgICAgICAgICBjbG91ZFdhdGNoTWV0cmljc0VuYWJsZWQ6IHRydWUsXG4gICAgICAgICAgbWV0cmljTmFtZTogJ0dlb0Jsb2NrUnVsZScsXG4gICAgICAgIH0sXG4gICAgICB9KTtcbiAgICB9XG5cbiAgICBwYXRoUmF0ZUxpbWl0cy5mb3JFYWNoKChwYXRoTGltaXQsIGlkeCkgPT4ge1xuICAgICAgY29uc3QgcnVsZU5hbWUgPSBwYXRoTGltaXQubmFtZSB8fCBgUGF0aFJhdGVMaW1pdCR7aWR4fWA7XG4gICAgICBydWxlcy5wdXNoKHtcbiAgICAgICAgbmFtZTogcnVsZU5hbWUsXG4gICAgICAgIHByaW9yaXR5OiBwcmlvcml0eSsrLFxuICAgICAgICBzdGF0ZW1lbnQ6IHtcbiAgICAgICAgICByYXRlQmFzZWRTdGF0ZW1lbnQ6IHtcbiAgICAgICAgICAgIGxpbWl0OiBwYXRoTGltaXQucmF0ZUxpbWl0LFxuICAgICAgICAgICAgYWdncmVnYXRlS2V5VHlwZTogJ0lQJyxcbiAgICAgICAgICAgIHNjb3BlRG93blN0YXRlbWVudDoge1xuICAgICAgICAgICAgICBieXRlTWF0Y2hTdGF0ZW1lbnQ6IHtcbiAgICAgICAgICAgICAgICBzZWFyY2hTdHJpbmc6IHBhdGhMaW1pdC5wYXRoLFxuICAgICAgICAgICAgICAgIGZpZWxkVG9NYXRjaDogeyB1cmlQYXRoOiB7fSB9LFxuICAgICAgICAgICAgICAgIHRleHRUcmFuc2Zvcm1hdGlvbnM6IFt7IHByaW9yaXR5OiAwLCB0eXBlOiAnTk9ORScgfV0sXG4gICAgICAgICAgICAgICAgcG9zaXRpb25hbENvbnN0cmFpbnQ6IHBhdGhMaW1pdC5wYXRoLmluY2x1ZGVzKCcqJykgPyAnQ09OVEFJTlMnIDogJ1NUQVJUU19XSVRIJyxcbiAgICAgICAgICAgICAgfSxcbiAgICAgICAgICAgIH0sXG4gICAgICAgICAgfSxcbiAgICAgICAgfSxcbiAgICAgICAgYWN0aW9uOiB7IGJsb2NrOiB7fSB9LFxuICAgICAgICB2aXNpYmlsaXR5Q29uZmlnOiB7XG4gICAgICAgICAgc2FtcGxlZFJlcXVlc3RzRW5hYmxlZDogdHJ1ZSxcbiAgICAgICAgICBjbG91ZFdhdGNoTWV0cmljc0VuYWJsZWQ6IHRydWUsXG4gICAgICAgICAgbWV0cmljTmFtZTogcnVsZU5hbWUsXG4gICAgICAgIH0sXG4gICAgICB9KTtcbiAgICB9KTtcblxuICAgIHJ1bGVzLnB1c2goe1xuICAgICAgbmFtZTogJ1JhdGVMaW1pdFJ1bGUnLFxuICAgICAgcHJpb3JpdHk6IHByaW9yaXR5KyssXG4gICAgICBzdGF0ZW1lbnQ6IHtcbiAgICAgICAgcmF0ZUJhc2VkU3RhdGVtZW50OiB7XG4gICAgICAgICAgbGltaXQ6IHJhdGVMaW1pdCxcbiAgICAgICAgICBhZ2dyZWdhdGVLZXlUeXBlOiAnSVAnLFxuICAgICAgICB9LFxuICAgICAgfSxcbiAgICAgIGFjdGlvbjogeyBibG9jazoge30gfSxcbiAgICAgIHZpc2liaWxpdHlDb25maWc6IHtcbiAgICAgICAgc2FtcGxlZFJlcXVlc3RzRW5hYmxlZDogdHJ1ZSxcbiAgICAgICAgY2xvdWRXYXRjaE1ldHJpY3NFbmFibGVkOiB0cnVlLFxuICAgICAgICBtZXRyaWNOYW1lOiAnUmF0ZUxpbWl0UnVsZScsXG4gICAgICB9LFxuICAgIH0pO1xuXG4gICAgaWYgKGVuYWJsZU1hbmFnZWRSdWxlcykge1xuICAgICAgcnVsZXMucHVzaChcbiAgICAgICAge1xuICAgICAgICAgIG5hbWU6ICdBV1NNYW5hZ2VkUnVsZXNDb21tb25SdWxlU2V0JyxcbiAgICAgICAgICBwcmlvcml0eTogcHJpb3JpdHkrKyxcbiAgICAgICAgICBzdGF0ZW1lbnQ6IHtcbiAgICAgICAgICAgIG1hbmFnZWRSdWxlR3JvdXBTdGF0ZW1lbnQ6IHtcbiAgICAgICAgICAgICAgdmVuZG9yTmFtZTogJ0FXUycsXG4gICAgICAgICAgICAgIG5hbWU6ICdBV1NNYW5hZ2VkUnVsZXNDb21tb25SdWxlU2V0JyxcbiAgICAgICAgICAgIH0sXG4gICAgICAgICAgfSxcbiAgICAgICAgICBvdmVycmlkZUFjdGlvbjogeyBub25lOiB7fSB9LFxuICAgICAgICAgIHZpc2liaWxpdHlDb25maWc6IHtcbiAgICAgICAgICAgIHNhbXBsZWRSZXF1ZXN0c0VuYWJsZWQ6IHRydWUsXG4gICAgICAgICAgICBjbG91ZFdhdGNoTWV0cmljc0VuYWJsZWQ6IHRydWUsXG4gICAgICAgICAgICBtZXRyaWNOYW1lOiAnQVdTTWFuYWdlZFJ1bGVzQ29tbW9uUnVsZVNldCcsXG4gICAgICAgICAgfSxcbiAgICAgICAgfSxcbiAgICAgICAge1xuICAgICAgICAgIG5hbWU6ICdBV1NNYW5hZ2VkUnVsZXNLbm93bkJhZElucHV0c1J1bGVTZXQnLFxuICAgICAgICAgIHByaW9yaXR5OiBwcmlvcml0eSsrLFxuICAgICAgICAgIHN0YXRlbWVudDoge1xuICAgICAgICAgICAgbWFuYWdlZFJ1bGVHcm91cFN0YXRlbWVudDoge1xuICAgICAgICAgICAgICB2ZW5kb3JOYW1lOiAnQVdTJyxcbiAgICAgICAgICAgICAgbmFtZTogJ0FXU01hbmFnZWRSdWxlc0tub3duQmFkSW5wdXRzUnVsZVNldCcsXG4gICAgICAgICAgICB9LFxuICAgICAgICAgIH0sXG4gICAgICAgICAgb3ZlcnJpZGVBY3Rpb246IHsgbm9uZToge30gfSxcbiAgICAgICAgICB2aXNpYmlsaXR5Q29uZmlnOiB7XG4gICAgICAgICAgICBzYW1wbGVkUmVxdWVzdHNFbmFibGVkOiB0cnVlLFxuICAgICAgICAgICAgY2xvdWRXYXRjaE1ldHJpY3NFbmFibGVkOiB0cnVlLFxuICAgICAgICAgICAgbWV0cmljTmFtZTogJ0FXU01hbmFnZWRSdWxlc0tub3duQmFkSW5wdXRzUnVsZVNldCcsXG4gICAgICAgICAgfSxcbiAgICAgICAgfSxcbiAgICAgICAge1xuICAgICAgICAgIG5hbWU6ICdBV1NNYW5hZ2VkUnVsZXNBbWF6b25JcFJlcHV0YXRpb25MaXN0JyxcbiAgICAgICAgICBwcmlvcml0eTogcHJpb3JpdHkrKyxcbiAgICAgICAgICBzdGF0ZW1lbnQ6IHtcbiAgICAgICAgICAgIG1hbmFnZWRSdWxlR3JvdXBTdGF0ZW1lbnQ6IHtcbiAgICAgICAgICAgICAgdmVuZG9yTmFtZTogJ0FXUycsXG4gICAgICAgICAgICAgIG5hbWU6ICdBV1NNYW5hZ2VkUnVsZXNBbWF6b25JcFJlcHV0YXRpb25MaXN0JyxcbiAgICAgICAgICAgIH0sXG4gICAgICAgICAgfSxcbiAgICAgICAgICBvdmVycmlkZUFjdGlvbjogeyBub25lOiB7fSB9LFxuICAgICAgICAgIHZpc2liaWxpdHlDb25maWc6IHtcbiAgICAgICAgICAgIHNhbXBsZWRSZXF1ZXN0c0VuYWJsZWQ6IHRydWUsXG4gICAgICAgICAgICBjbG91ZFdhdGNoTWV0cmljc0VuYWJsZWQ6IHRydWUsXG4gICAgICAgICAgICBtZXRyaWNOYW1lOiAnQVdTTWFuYWdlZFJ1bGVzQW1hem9uSXBSZXB1dGF0aW9uTGlzdCcsXG4gICAgICAgICAgfSxcbiAgICAgICAgfSxcbiAgICAgICAge1xuICAgICAgICAgIG5hbWU6ICdBV1NNYW5hZ2VkUnVsZXNBbm9ueW1vdXNJcExpc3QnLFxuICAgICAgICAgIHByaW9yaXR5OiBwcmlvcml0eSsrLFxuICAgICAgICAgIHN0YXRlbWVudDoge1xuICAgICAgICAgICAgbWFuYWdlZFJ1bGVHcm91cFN0YXRlbWVudDoge1xuICAgICAgICAgICAgICB2ZW5kb3JOYW1lOiAnQVdTJyxcbiAgICAgICAgICAgICAgbmFtZTogJ0FXU01hbmFnZWRSdWxlc0Fub255bW91c0lwTGlzdCcsXG4gICAgICAgICAgICB9LFxuICAgICAgICAgIH0sXG4gICAgICAgICAgb3ZlcnJpZGVBY3Rpb246IHsgbm9uZToge30gfSxcbiAgICAgICAgICB2aXNpYmlsaXR5Q29uZmlnOiB7XG4gICAgICAgICAgICBzYW1wbGVkUmVxdWVzdHNFbmFibGVkOiB0cnVlLFxuICAgICAgICAgICAgY2xvdWRXYXRjaE1ldHJpY3NFbmFibGVkOiB0cnVlLFxuICAgICAgICAgICAgbWV0cmljTmFtZTogJ0FXU01hbmFnZWRSdWxlc0Fub255bW91c0lwTGlzdCcsXG4gICAgICAgICAgfSxcbiAgICAgICAgfSxcbiAgICAgICk7XG4gICAgfVxuXG4gICAgcmV0dXJuIHJ1bGVzO1xuICB9XG59XG4iXX0=

package/lib/cloudfront/countries.d.ts

@@ -0,0 +1,260 @@
+/**
+ * ISO 3166-1 alpha-2 country codes for use with CloudFront WAF geographic restrictions.
+ *
+ * @example
+ * ```typescript
+ * webAcl.allowGeographies([Country.NewZealand, Country.Australia, Country.UnitedKingdom]);
+ * ```
+ */
+export declare const Country: {
+    readonly Afghanistan: "AF";
+    readonly AlandIslands: "AX";
+    readonly Albania: "AL";
+    readonly Algeria: "DZ";
+    readonly AmericanSamoa: "AS";
+    readonly Andorra: "AD";
+    readonly Angola: "AO";
+    readonly Anguilla: "AI";
+    readonly Antarctica: "AQ";
+    readonly AntiguaAndBarbuda: "AG";
+    readonly Argentina: "AR";
+    readonly Armenia: "AM";
+    readonly Aruba: "AW";
+    readonly Australia: "AU";
+    readonly Austria: "AT";
+    readonly Azerbaijan: "AZ";
+    readonly Bahamas: "BS";
+    readonly Bahrain: "BH";
+    readonly Bangladesh: "BD";
+    readonly Barbados: "BB";
+    readonly Belarus: "BY";
+    readonly Belgium: "BE";
+    readonly Belize: "BZ";
+    readonly Benin: "BJ";
+    readonly Bermuda: "BM";
+    readonly Bhutan: "BT";
+    readonly Bolivia: "BO";
+    readonly BonaireSintEustatiusAndSaba: "BQ";
+    readonly BosniaAndHerzegovina: "BA";
+    readonly Botswana: "BW";
+    readonly BouvetIsland: "BV";
+    readonly Brazil: "BR";
+    readonly BritishIndianOceanTerritory: "IO";
+    readonly BruneiDarussalam: "BN";
+    readonly Bulgaria: "BG";
+    readonly BurkinaFaso: "BF";
+    readonly Burundi: "BI";
+    readonly CaboVerde: "CV";
+    readonly Cambodia: "KH";
+    readonly Cameroon: "CM";
+    readonly Canada: "CA";
+    readonly CaymanIslands: "KY";
+    readonly CentralAfricanRepublic: "CF";
+    readonly Chad: "TD";
+    readonly Chile: "CL";
+    readonly China: "CN";
+    readonly ChristmasIsland: "CX";
+    readonly CocosKeelingIslands: "CC";
+    readonly Colombia: "CO";
+    readonly Comoros: "KM";
+    readonly Congo: "CG";
+    readonly CongoDemocraticRepublic: "CD";
+    readonly CookIslands: "CK";
+    readonly CostaRica: "CR";
+    readonly CoteDIvoire: "CI";
+    readonly Croatia: "HR";
+    readonly Cuba: "CU";
+    readonly Curacao: "CW";
+    readonly Cyprus: "CY";
+    readonly Czechia: "CZ";
+    readonly Denmark: "DK";
+    readonly Djibouti: "DJ";
+    readonly Dominica: "DM";
+    readonly DominicanRepublic: "DO";
+    readonly Ecuador: "EC";
+    readonly Egypt: "EG";
+    readonly ElSalvador: "SV";
+    readonly EquatorialGuinea: "GQ";
+    readonly Eritrea: "ER";
+    readonly Estonia: "EE";
+    readonly Eswatini: "SZ";
+    readonly Ethiopia: "ET";
+    readonly FalklandIslands: "FK";
+    readonly FaroeIslands: "FO";
+    readonly Fiji: "FJ";
+    readonly Finland: "FI";
+    readonly France: "FR";
+    readonly FrenchGuiana: "GF";
+    readonly FrenchPolynesia: "PF";
+    readonly FrenchSouthernTerritories: "TF";
+    readonly Gabon: "GA";
+    readonly Gambia: "GM";
+    readonly Georgia: "GE";
+    readonly Germany: "DE";
+    readonly Ghana: "GH";
+    readonly Gibraltar: "GI";
+    readonly Greece: "GR";
+    readonly Greenland: "GL";
+    readonly Grenada: "GD";
+    readonly Guadeloupe: "GP";
+    readonly Guam: "GU";
+    readonly Guatemala: "GT";
+    readonly Guernsey: "GG";
+    readonly Guinea: "GN";
+    readonly GuineaBissau: "GW";
+    readonly Guyana: "GY";
+    readonly Haiti: "HT";
+    readonly HeardIslandAndMcDonaldIslands: "HM";
+    readonly HolySee: "VA";
+    readonly Honduras: "HN";
+    readonly HongKong: "HK";
+    readonly Hungary: "HU";
+    readonly Iceland: "IS";
+    readonly India: "IN";
+    readonly Indonesia: "ID";
+    readonly Iran: "IR";
+    readonly Iraq: "IQ";
+    readonly Ireland: "IE";
+    readonly IsleOfMan: "IM";
+    readonly Israel: "IL";
+    readonly Italy: "IT";
+    readonly Jamaica: "JM";
+    readonly Japan: "JP";
+    readonly Jersey: "JE";
+    readonly Jordan: "JO";
+    readonly Kazakhstan: "KZ";
+    readonly Kenya: "KE";
+    readonly Kiribati: "KI";
+    readonly KoreaDemocraticPeoplesRepublic: "KP";
+    readonly KoreaRepublic: "KR";
+    readonly Kuwait: "KW";
+    readonly Kyrgyzstan: "KG";
+    readonly Lao: "LA";
+    readonly Latvia: "LV";
+    readonly Lebanon: "LB";
+    readonly Lesotho: "LS";
+    readonly Liberia: "LR";
+    readonly Libya: "LY";
+    readonly Liechtenstein: "LI";
+    readonly Lithuania: "LT";
+    readonly Luxembourg: "LU";
+    readonly Macao: "MO";
+    readonly Madagascar: "MG";
+    readonly Malawi: "MW";
+    readonly Malaysia: "MY";
+    readonly Maldives: "MV";
+    readonly Mali: "ML";
+    readonly Malta: "MT";
+    readonly MarshallIslands: "MH";
+    readonly Martinique: "MQ";
+    readonly Mauritania: "MR";
+    readonly Mauritius: "MU";
+    readonly Mayotte: "YT";
+    readonly Mexico: "MX";
+    readonly Micronesia: "FM";
+    readonly Moldova: "MD";
+    readonly Monaco: "MC";
+    readonly Mongolia: "MN";
+    readonly Montenegro: "ME";
+    readonly Montserrat: "MS";
+    readonly Morocco: "MA";
+    readonly Mozambique: "MZ";
+    readonly Myanmar: "MM";
+    readonly Namibia: "NA";
+    readonly Nauru: "NR";
+    readonly Nepal: "NP";
+    readonly Netherlands: "NL";
+    readonly NewCaledonia: "NC";
+    readonly NewZealand: "NZ";
+    readonly Nicaragua: "NI";
+    readonly Niger: "NE";
+    readonly Nigeria: "NG";
+    readonly Niue: "NU";
+    readonly NorfolkIsland: "NF";
+    readonly NorthMacedonia: "MK";
+    readonly NorthernMarianaIslands: "MP";
+    readonly Norway: "NO";
+    readonly Oman: "OM";
+    readonly Pakistan: "PK";
+    readonly Palau: "PW";
+    readonly Palestine: "PS";
+    readonly Panama: "PA";
+    readonly PapuaNewGuinea: "PG";
+    readonly Paraguay: "PY";
+    readonly Peru: "PE";
+    readonly Philippines: "PH";
+    readonly Pitcairn: "PN";
+    readonly Poland: "PL";
+    readonly Portugal: "PT";
+    readonly PuertoRico: "PR";
+    readonly Qatar: "QA";
+    readonly Reunion: "RE";
+    readonly Romania: "RO";
+    readonly RussianFederation: "RU";
+    readonly Rwanda: "RW";
+    readonly SaintBarthelemy: "BL";
+    readonly SaintHelenaAscensionAndTristanDaCunha: "SH";
+    readonly SaintKittsAndNevis: "KN";
+    readonly SaintLucia: "LC";
+    readonly SaintMartinFrenchPart: "MF";
+    readonly SaintPierreAndMiquelon: "PM";
+    readonly SaintVincentAndTheGrenadines: "VC";
+    readonly Samoa: "WS";
+    readonly SanMarino: "SM";
+    readonly SaoTomeAndPrincipe: "ST";
+    readonly SaudiArabia: "SA";
+    readonly Senegal: "SN";
+    readonly Serbia: "RS";
+    readonly Seychelles: "SC";
+    readonly SierraLeone: "SL";
+    readonly Singapore: "SG";
+    readonly SintMaartenDutchPart: "SX";
+    readonly Slovakia: "SK";
+    readonly Slovenia: "SI";
+    readonly SolomonIslands: "SB";
+    readonly Somalia: "SO";
+    readonly SouthAfrica: "ZA";
+    readonly SouthGeorgiaAndTheSouthSandwichIslands: "GS";
+    readonly SouthSudan: "SS";
+    readonly Spain: "ES";
+    readonly SriLanka: "LK";
+    readonly Sudan: "SD";
+    readonly Suriname: "SR";
+    readonly SvalbardAndJanMayen: "SJ";
+    readonly Sweden: "SE";
+    readonly Switzerland: "CH";
+    readonly SyrianArabRepublic: "SY";
+    readonly Taiwan: "TW";
+    readonly Tajikistan: "TJ";
+    readonly Tanzania: "TZ";
+    readonly Thailand: "TH";
+    readonly TimorLeste: "TL";
+    readonly Togo: "TG";
+    readonly Tokelau: "TK";
+    readonly Tonga: "TO";
+    readonly TrinidadAndTobago: "TT";
+    readonly Tunisia: "TN";
+    readonly Turkey: "TR";
+    readonly Turkmenistan: "TM";
+    readonly TurksAndCaicosIslands: "TC";
+    readonly Tuvalu: "TV";
+    readonly Uganda: "UG";
+    readonly Ukraine: "UA";
+    readonly UnitedArabEmirates: "AE";
+    readonly UnitedKingdom: "GB";
+    readonly UnitedStates: "US";
+    readonly UnitedStatesMinorOutlyingIslands: "UM";
+    readonly Uruguay: "UY";
+    readonly Uzbekistan: "UZ";
+    readonly Vanuatu: "VU";
+    readonly Venezuela: "VE";
+    readonly VietNam: "VN";
+    readonly VirginIslandsBritish: "VG";
+    readonly VirginIslandsUS: "VI";
+    readonly WallisAndFutuna: "WF";
+    readonly WesternSahara: "EH";
+    readonly Yemen: "YE";
+    readonly Zambia: "ZM";
+    readonly Zimbabwe: "ZW";
+};
+export type CountryCode = typeof Country[keyof typeof Country];