{
  "name": "waf",
  "version": "1.0.0",
  "kind": "l1",
  "type": "aws:wafv2:webacl",
  "description": "WAFv2 Web ACL primitive for CloudFront (substrate-agnostic stack type aws:wafv2:webacl; the Terraform adapter translates to aws_wafv2_web_acl). CloudFront-scoped WAF is always in us-east-1.",
  "inputs": {
    "name": {
      "type": "string",
      "description": "Name of the Web ACL.",
      "required": true
    },
    "scope": {
      "type": "string",
      "description": "Scope of the Web ACL (default cloudfront for CloudFront associations).",
      "required": false,
      "default": "cloudfront"
    },
    "default_action": {
      "type": "string",
      "description": "Default action (default allow).",
      "required": false,
      "default": "allow"
    },
    "rules": {
      "type": "string",
      "description": "Optional custom rules as JSON (default: managed rules only).",
      "required": false
    },
    "region": {
      "type": "string",
      "description": "AWS region (CloudFront-scoped WAF is always us-east-1; the adapter ignores this for cloudfront scope).",
      "required": true
    }
  },
  "outputs": {
    "web_acl_arn": {
      "type": "arn",
      "description": "The WAF Web ACL ARN."
    }
  },
  "nfrs": {},
  "resources": [
    {
      "type": "aws:wafv2:webacl",
      "description": "WAFv2 Web ACL with managed rules.",
      "inputs": ["name", "scope", "default_action", "rules"],
      "outputs": ["web_acl_arn"]
    }
  ]
}