Cloudflare WAF Expression Builder

Builds a Cloudflare Ruleset Engine filter expression from a bounded condition list. Field names come from an allowlist and each field carries a type, so only the operators that type supports are offered: string fields get eq, ne, contains, starts_with, ends_with, and in; ip.src gets eq, ne, and in; numeric fields get the comparisons; and ssl is a boolean that appears on its own or behind not. Three details the engine cares about are handled for you. starts_with and ends_with are functions, written starts_with(field, "value"), not infix operators. List membership is written with braces and space-separated values, and only string values are quoted, so ip.src in {203.0.113.0/24} has no quotes while http.request.method in {"GET" "POST"} does. A prefix is only meaningful as set membership, so eq and ne on ip.src take a single address and a CIDR is accepted by in alone. String literals are double quoted with backslash escapes, and control characters are rejected rather than escaped, since a control character in a match value is almost always a paste accident. IP values are validated but printed exactly as typed. The ip.src.country field was previously called ip.geoip.country; older rules and documentation still use that name. Deliberate limits: the regex operator matches is not offered, because a regex written blind is the easiest way to build a rule that does not do what it looks like; no action, rate limit, or ruleset placement is chosen here; and nothing is sent to Cloudflare — this produces text for you to review and paste. Expressions are capped at 4096 characters, and your plan may impose its own limit.