cdk-preflight 0.0.120 → 0.0.122

package/.claude/skills/add-preflight-rule/SKILL.md

@@ -25,7 +25,7 @@ cdk-preflight のルール追加パイプライン。AGENTS.md の設計原則
    - `walk` ビルトインは無い。`to_number`/`object.get`/`flatten_list`/`resolve` で明示的に書く
    - fail テンプレートはこのルール**だけ**に違反、pass テンプレートは完全クリーン
    - **数値・長さ・個数の制約は境界ちょうどで書く**。fail は「違反する値のうち限界に最も近いもの」、pass は「限界そのもの」— 20 文字下限なら fail=19 文字 / pass=20 文字であって、fail=5 文字 / pass=26 文字ではない。緩いペアはルールの向きしか証明しない（`count(v) < 20` は fail が 5 文字なら定数が `< 10` でも鳴り、pass が 26 文字なら `< 25` でも黙る）ので、定数も比較演算子も固定できないし、実機ゲートの証拠も弱くなる（19 文字が CREATE に失敗して初めて下限 20 が実証される）。ルールが両端を見ているレンジは fail に両端を置く（fail の判定は「自分のルールの診断が 1 件以上」なので、違反リソースを 2 つ並べてよい）。エンジンのスキーマが既に持っている側の端は入れない — ルールもそこは見ていない（原則 1）し、重複ガードが赤くなる。順序の無い制約（プロパティ欠落、enum の値違い、リソース間の不整合）には境界が無いので対象外
-4. **ローカルゲート**: まず `npx ts-node --transpile-only --project test/tsconfig.json scripts/rule-check.ts check <service|rule-id>...` を回す。`rules/` を直接読んで 1 エンジンに全ルールを載せ、fail が自分のルールで鳴るか / pass が全ルール無音か / どちらも組み込みエンジンに止められないかを返す（`bundle-rules` も meta.yaml の evidence も要らないので、実機ゲート前の直しはここで回す。80 本で数秒）。全部 `ok` になってから `npx projen bundle-rules && npx jest test/rules.test.ts test/structure.test.ts`（`bundle-rules` は `src/rules.generated.ts` / `docs/rules.md` に加えて **README のルール数バッジと対応リソースタイプ一覧も書き換える**。手で直さない。古いままなら `structure.test.ts` が落ちる）。**`rules/<service>/` を新設したときは `npx projen` も回す** — `.github/workflows/monthly-verify.yml` のサービス行列はそこから生成されるので、`bundle-rules` だけでは更新されず PR の self-mutation チェックが赤くなる（2026-09-13、Athena 追加で踏んだ）。`structure.test.ts` は手順 3 の境界値を機械で見る（rego のしきい値ごとに fail へ「限界に最も近い違反値」、pass へ「限界そのもの」が現れるか）。しきい値の検出が意味を持たないルールだけ `rules/_boundary-exceptions.txt` に理由付きで逃がす。**jest は `-t` で対象を絞る**。フルスイートは PR 直前の 1 回だけでよく、実測では 401 回中 73 回がフル実行で合計 5.8 時間を溶かしている。
+4. **ローカルゲート**: まず `npx ts-node --transpile-only --project test/tsconfig.json scripts/rule-check.ts check <service|rule-id>...` を回す。`rules/` を直接読んで 1 エンジンに全ルールを載せ、fail が自分のルールで鳴るか / pass が全ルール無音か / どちらも組み込みエンジンに止められないかを返す（`bundle-rules` も meta.yaml の evidence も要らないので、実機ゲート前の直しはここで回す。80 本で数秒）。全部 `ok` になってから `npx projen bundle-rules && npx jest test/rules test/structure.test.ts`（`test/rules` は `rules.test.ts` と、ルール表を回す `rules.shard*.test.ts` の両方に当たる）（`bundle-rules` は `src/rules.generated.ts` / `docs/rules.md` に加えて **README のルール数バッジと対応リソースタイプ一覧も書き換える**。手で直さない。古いままなら `structure.test.ts` が落ちる）。**`rules/<service>/` を新設したときは `npx projen` も回す** — `.github/workflows/monthly-verify.yml` のサービス行列はそこから生成されるので、`bundle-rules` だけでは更新されず PR の self-mutation チェックが赤くなる（2026-09-13、Athena 追加で踏んだ）。`structure.test.ts` は手順 3 の境界値を機械で見る（rego のしきい値ごとに fail へ「限界に最も近い違反値」、pass へ「限界そのもの」が現れるか）。しきい値の検出が意味を持たないルールだけ `rules/_boundary-exceptions.txt` に理由付きで逃がす。**jest は `-t` で対象を絞る**。フルスイートは PR 直前の 1 回だけでよく、実測では 401 回中 73 回がフル実行で合計 5.8 時間を溶かしている。
 5. **実機再現ゲート**: `bash bench/verify-rule.sh <rule-id>`（要 AWS 認証）。観測したエラーメッセージと日付を `meta.yaml#repro.evidence` に記録。
    - **evidence には実際にデプロイした値を書く**（`bench 2026-09-13 us-east-1: 19-char Value -> "...at least 20 characters" (ROLLBACK_COMPLETE); pass 20-char -> CREATE_COMPLETE`）。境界ちょうどのフィクスチャと組で、限界の位置そのものが meta.yaml から読める
    - fail テンプレートがデプロイに**成功**したら、それはドキュメント側の誤り（BROKEN-EXPECTATION）。ルールを削除し、証拠を issue に残して終了する。CloudFront では明文化された制約 9 件中 3 件がこれだった（2026-09-02）

package/.claude/skills/run-preflight-issue/SKILL.md

@@ -112,7 +112,10 @@ B の後は課金物の実在確認も回す（例 `aws athena list-capacity-res
 ## 関門
 
 **自動でやってよい**: issue コメントの投稿（着手・調査結果・API 結果）、実機再現ゲート（無料〜数円のスタックを多数作る）、
-ブランチへのコミット。
+ブランチへのコミット。**PR がマージされた後の後片付けも全部**（2026-09-14 のユーザー指示「勝手にやっておk　今後も」）:
+結果コメントを残して issue を close / #91 のチェックを付けて 1 行サマリを書く / ルールにできなかった分を #91 の「積み残し」に移す。
+#91 の本文を書き換えるときは `gh issue view 91 --json body -q .body` で**その場で取り直して**から編集し、
+`[ -s <file> ]` で非空を確かめてから `gh issue edit`、最後に `grep` で反映を確認する（古い／空の `--body-file` は本文を丸ごと上書きする）。
 
 **止まって人間に聞く**:
 
@@ -120,8 +123,7 @@ B の後は課金物の実在確認も回す（例 `aws athena list-capacity-res
 - 課金リソースが必要だと判明したとき（作らずに報告して止まる）
 - `.claude/settings*.json` の permission を足したくなったとき（**自分で書き換えない**）
 
-**絶対にしない**: 課金リソースの作成、issue の close、#91 のチェックボックス操作（PR マージが人間の手なので、
-その先は全部人間の仕事）、既存の無料下敷き（`pfdb` / `pfwg` / `cdkpf-*-probe` ロールやバケット）の削除。
+**絶対にしない**: 課金リソースの作成、既存の無料下敷き（`pfdb` / `pfwg` / `cdkpf-*-probe` ロールやバケット）の削除。
 
 ## やらないこと
 

package/.jsii

@@ -9416,7 +9416,7 @@
   },
   "name": "cdk-preflight",
   "readme": {
-    "markdown": "<p align=\"center\">\n  <img src=\"https://raw.githubusercontent.com/badmintoncryer/cdk-preflight/main/assets/logo.png\" alt=\"cdk-preflight\" width=\"104\" height=\"104\">\n</p>\n\n<h1 align=\"center\">cdk-preflight</h1>\n\n<p align=\"center\">\n  <strong>Catch deploy-time CloudFormation failures at <code>cdk synth</code> time.</strong>\n</p>\n\n<p align=\"center\">\n  <a href=\"https://github.com/badmintoncryer/cdk-preflight/actions/workflows/monthly-verify.yml\"><img src=\"https://github.com/badmintoncryer/cdk-preflight/actions/workflows/monthly-verify.yml/badge.svg\" alt=\"monthly real-deploy verification\"></a>\n  <a href=\"https://www.npmjs.com/package/cdk-preflight\"><img src=\"https://img.shields.io/npm/v/cdk-preflight.svg\" alt=\"npm version\"></a>\n  <a href=\"https://www.npmjs.com/package/cdk-preflight\"><img src=\"https://img.shields.io/npm/dt/cdk-preflight.svg\" alt=\"npm total downloads\"></a>\n  <a href=\"docs/rules.md\"><img src=\"https://img.shields.io/badge/rules-2204-blue\" alt=\"2204 bundled rules\"></a>\n</p>\n\nSome CloudFormation constraints are not expressed in resource provider schemas — they live only in documentation, in service API validation, or across multiple properties. Templates that violate them pass `cdk synth`, pass CloudFormation pre-deployment validation, and then fail minutes into a deployment, burning a rollback cycle.\n\ncdk-preflight is a curated [Rego rule pack](docs/rules.md) for exactly those constraints, evaluated with the CloudFormation validation engine that ships inside `aws-cdk-lib` (>= 2.267.0). By default a violation **fails `cdk synth`** — a template that is known to fail at deploy time never leaves your machine.\n\nThe pack aims at **every deploy-time failure that no existing CDK mechanism already catches** — nothing narrower. Every bundled rule is backed by a `fail`/`pass` template pair, and the failure has been reproduced against real AWS. The handful of rules that could not be reproduced are marked `doc-only` and report as **warnings**: they show up in the validation report but never fail synth. Rules that the built-in validation engine already covers are deliberately **not** duplicated — a test suite enforces this.\n\n> **Requires `aws-cdk-lib` >= 2.267.0** (released 2026-08-27) — the first release that bundles\n> the CloudFormation validation engine. On older versions the rules cannot run at all.\n\n## Quick start\n\n```bash\nnpm i -D cdk-preflight\nnpx cdkpf init   # inserts Preflight.apply(app) into your CDK app\n                         # (`npx cdkpf init` is the same command, shorter)\n```\n\nor add one line yourself:\n\n```ts\nimport { Preflight } from 'cdk-preflight';\n\nconst app = new App();\nPreflight.apply(app);\n```\n\nOn violation, `cdk synth` fails with one error per finding, including the construct trace:\n\n```text\nERROR idle_timeout.timeout_seconds is 5000 but must be between 1 and 4000 seconds (cdk-preflight)\n   MyStack/Alb/Resource (Alb16C2F182) aws-cdk-lib.aws_elasticloadbalancingv2.CfnLoadBalancer\n\nSynthesis finished with errors\n```\n\n## What it catches\n\nFour ordinary-looking snippets. All of them pass `cdk synth` and CloudFormation\npre-deployment validation, and all of them fail minutes into a deployment:\n\n```ts\n// 1) pf-iam-inline-policy-size — enumerate buckets, grant each one, blow past 10,240 chars\n//    \"Maximum policy size of 10240 bytes exceeded for role IngestRole\"\n//    (via role.addToPolicy the CDK auto-splits into managed policies instead,\n//     and you hit the 6,144-char limit as pf-iam-managed-policy-size)\nnew iam.Policy(this, 'IngestPolicy', {\n  roles: [role],\n  statements: [new iam.PolicyStatement({\n    actions: ['s3:GetObject', 's3:ListBucket'],\n    resources: Array.from({ length: 200 },\n      (_, i) => `arn:aws:s3:::data-lake-landing-zone-${i}/year=*/month=*/*`),\n  })],\n});\n\n// 2) pf-lambda-env-size — a config blob in the environment, over the 4KB total\n//    \"Lambda was unable to configure your environment variables because the\n//     environment variables you have provided exceeded the 4KB limit\"\nnew lambda.Function(this, 'Fn', {\n  runtime: lambda.Runtime.NODEJS_22_X,\n  handler: 'index.handler',\n  code: lambda.Code.fromInline('exports.handler = async () => {};'),\n  environment: { FEATURE_FLAGS: JSON.stringify(bigFeatureFlagMap) },\n});\n\n// 3) pf-sfn-asl-missing-state (+ pf-sfn-asl-unreachable-state) — a typo in a state name\n//    \"Invalid State Machine Definition: 'MISSING_TRANSITION_TARGET: ...'\"\nnew sfn.StateMachine(this, 'Pipeline', {\n  definitionBody: sfn.DefinitionBody.fromString(JSON.stringify({\n    StartAt: 'Validate',\n    States: {\n      Validate: { Type: 'Pass', Next: 'Transform' },\n      Trasform: { Type: 'Pass', End: true },   // typo: Transform\n    },\n  })),\n});\n\n// 4) pf-logs-filter-pattern-bracket — a filter pattern opened with '[' and never closed\n//    \"If a filter pattern starts with '[' it must end with ']'\"\nnew logs.MetricFilter(this, 'ErrorFilter', {\n  logGroup,\n  metricNamespace: 'Pipeline',\n  metricName: 'Errors',\n  filterPattern: logs.FilterPattern.literal('[time, level=ERROR, msg'),\n});\n```\n\nNone of these are type errors, so the L2 constructs accept them; none of them are\nexpressible in a resource schema, so CloudFormation accepts the template. With\n`Preflight.apply(app)` in place they fail `cdk synth` instead.\n\n## Observe-only mode\n\nTo roll the rules out gradually, start with `enforce: false`: findings then surface as synth **warnings** through the CDK built-in validator, with construct traces and per-finding acknowledgement:\n\n```ts\nPreflight.apply(app, { enforce: false });\n```\n\n```text\nWARNING idle_timeout.timeout_seconds is 5000 but must be between 1 and 4000 seconds (CloudFormation Validate)\n   MyStack/Alb (Alb) aws-cdk-lib.aws_elasticloadbalancingv2.CfnLoadBalancer\n   Acknowledge with 'CloudFormation-Validate::pf-elbv2-lb-idle-timeout-range'\n```\n\n> **Known limitation with stages.** The AWS CDK CLI drops validation findings for stacks nested in a `Stage`\n> before printing them, so in observe-only mode those findings appear **only** in `cdk.out/validation-report.json`\n> and never on the console. Enforce mode is not affected: cdk-preflight reports such findings itself and fails\n> synthesis. This is a CLI-side bug (present since aws-cdk 2.1128.1), not a rule evaluation problem.\n\n> **If the rules cannot run, the build stops.** When the evaluation engine fails on a template (a rule pack that\n> does not compile, an engine bug), enforce mode reports it as a violation named `pf-engine-error` and fails\n> synthesis for that stack instead of passing green with no rule having run. The other stacks keep their rules.\n> `pf-engine-error` is not a bundled rule and cannot be `exclude`d; `enforce: false` unblocks the build if you\n> need one.\n\n| Option | Default | Effect |\n|---|---|---|\n| `enforce` | `true` | Violations of bundled rules fail synthesis; set to `false` to only warn |\n| `strict` | `false` | With `enforce`: also fail on error-class findings (`ERROR`/`FATAL`, e.g. `F3034`) of the built-in validation engine itself, which the CDK currently downgrades to warnings |\n| `exclude` | `[]` | Rule ids to disable |\n| `includeUpstreamPending` | `true` | Include rules already proposed to the upstream engine but not yet merged |\n\nTo opt out of a single rule everywhere, pass its id in `exclude`. To suppress a\nsingle *finding* on one construct, acknowledge it — this works in both modes, the\nid prefix just differs (`cdk-preflight::` when enforcing, `CloudFormation-Validate::`\nin observe-only, as printed in the warning text):\n\n```ts\ncdk.Validations.of(errorFilter).acknowledge({\n  id: 'cdk-preflight::pf-logs-filter-pattern-bracket',\n  reason: 'log group is written by a legacy producer; pattern is fixed upstream',\n});\n```\n\n## Bundled rules\n\nSee [docs/rules.md](docs/rules.md) for the generated rule table.\n\n<!-- supported-resources:start -->\n<details>\n<summary><b>275 resource types across 43 services</b> — click to expand</summary>\n\nResource names are relative to `AWS::<Service>::`; the number in parentheses is how many rules target that type.\n\n| Service | Resource types |\n|---|---|\n| **(any resource type)** | `*` (2) |\n| **ApiGateway** | `ApiKey` (1), `Authorizer` (5), `Deployment` (1), `DocumentationPart` (1), `DomainName` (4), `GatewayResponse` (1), `Method` (13), `Model` (3), `Resource` (1), `RestApi` (4), `Stage` (9), `UsagePlan` (5), `VpcLink` (1) |\n| **ApiGatewayV2** | `Api` (5), `Authorizer` (11), `DomainName` (3), `Integration` (15), `IntegrationResponse` (1), `Model` (2), `Route` (6), `RouteResponse` (2), `Stage` (4), `VpcLink` (1) |\n| **AppSync** | `Api` (7), `ApiCache` (4), `ApiKey` (2), `ChannelNamespace` (5), `DataSource` (15), `DomainName` (1), `FunctionConfiguration` (24), `GraphQLApi` (16), `GraphQLSchema` (12), `Resolver` (32), `SourceApiAssociation` (3) |\n| **Athena** | `DataCatalog` (6), `WorkGroup` (8) |\n| **AutoScaling** | `AutoScalingGroup` (38), `LifecycleHook` (8), `ScalingPolicy` (41), `ScheduledAction` (13), `WarmPool` (4) |\n| **Batch** | `ComputeEnvironment` (40), `ConsumableResource` (2), `JobDefinition` (109), `JobQueue` (18), `SchedulingPolicy` (8), `ServiceEnvironment` (6) |\n| **Bedrock** | `ApplicationInferenceProfile` (2), `AutomatedReasoningPolicy` (3), `Blueprint` (3), `DataAutomationProject` (8), `DataSource` (12), `Flow` (14), `Guardrail` (19), `IntelligentPromptRouter` (5), `KnowledgeBase` (18), `Prompt` (4) |\n| **BedrockAgentCore** | `ApiKeyCredentialProvider` (1), `BrowserCustom` (1), `CodeInterpreterCustom` (1), `ConfigurationBundle` (3), `Dataset` (3), `Evaluator` (4), `Gateway` (5), `GatewayRule` (3), `GatewayTarget` (9), `Harness` (2), `HarnessEndpoint` (2), `Memory` (6), `OAuth2CredentialProvider` (3), `OnlineEvaluationConfig` (3), `PaymentCredentialProvider` (1), `PaymentManager` (1), `Policy` (3), `ResourcePolicy` (1), `Runtime` (8), `RuntimeEndpoint` (1) |\n| **CloudFront** | `AnycastIpList` (1), `CachePolicy` (7), `ContinuousDeploymentPolicy` (5), `Distribution` (55), `Function` (4), `KeyGroup` (1), `KeyValueStore` (2), `OriginRequestPolicy` (5), `PublicKey` (1), `RealtimeLogConfig` (3), `ResponseHeadersPolicy` (8), `VpcOrigin` (3) |\n| **CloudWatch** | `Alarm` (21), `AnomalyDetector` (6), `CompositeAlarm` (6), `Dashboard` (14), `InsightRule` (7), `MetricStream` (6) |\n| **Cognito** | `IdentityPool` (3), `IdentityPoolRoleAttachment` (7), `LogDeliveryConfiguration` (3), `ManagedLoginBranding` (2), `UserPool` (52), `UserPoolClient` (21), `UserPoolDomain` (7), `UserPoolGroup` (1), `UserPoolIdentityProvider` (11), `UserPoolResourceServer` (4), `UserPoolRiskConfigurationAttachment` (6), `UserPoolUICustomizationAttachment` (2) |\n| **DynamoDB** | `GlobalTable` (26), `Table` (28) |\n| **EC2** | `ClientVpnAuthorizationRule` (1), `ClientVpnEndpoint` (6), `DHCPOptions` (2), `EIPAssociation` (1), `FlowLog` (4), `Instance` (10), `KeyPair` (1), `LaunchTemplate` (5), `NatGateway` (2), `NetworkAclEntry` (1), `NetworkInterface` (2), `PlacementGroup` (3), `PrefixList` (3), `Route` (1), `SecurityGroup` (6), `SecurityGroupEgress` (5), `SecurityGroupIngress` (5), `Subnet` (6), `TrafficMirrorTarget` (1), `TransitGateway` (2), `TransitGatewayRoute` (1), `Volume` (6), `VPC` (2), `VPCCidrBlock` (1), `VPCEndpoint` (4), `VPCGatewayAttachment` (1), `VPNConnection` (5) |\n| **ECR** | `PullThroughCacheRule` (3), `RegistryScanningConfiguration` (1), `ReplicationConfiguration` (1), `Repository` (7), `RepositoryCreationTemplate` (8), `SigningConfiguration` (1) |\n| **ECS** | `CapacityProvider` (3), `Cluster` (5), `Service` (37), `TaskDefinition` (64), `TaskSet` (2) |\n| **EFS** | `AccessPoint` (1), `FileSystem` (7), `MountTarget` (4) |\n| **ElastiCache** | `CacheCluster` (9), `ReplicationGroup` (14), `User` (2), `UserGroup` (1) |\n| **ElasticLoadBalancingV2** | `Listener` (57), `ListenerCertificate` (2), `ListenerRule` (37), `LoadBalancer` (37), `TargetGroup` (58), `TrustStore` (1), `TrustStoreRevocation` (1) |\n| **Events** | `ApiDestination` (1), `Archive` (5), `Connection` (1), `Endpoint` (2), `EventBus` (2), `Rule` (23) |\n| **EventSchemas** | `Discoverer` (1), `Registry` (1), `RegistryPolicy` (1), `Schema` (1) |\n| **IAM** | `Group` (23), `GroupPolicy` (1), `InstanceProfile` (2), `ManagedPolicy` (31), `OIDCProvider` (2), `Policy` (29), `Role` (40), `RolePolicy` (1), `ServiceLinkedRole` (1), `User` (24), `UserPolicy` (1) |\n| **Kinesis** | `ResourcePolicy` (4), `Stream` (5), `StreamConsumer` (2) |\n| **KinesisAnalyticsV2** | `Application` (20), `ApplicationCloudWatchLoggingOption` (1), `ApplicationOutput` (1), `ApplicationReferenceDataSource` (1) |\n| **KinesisFirehose** | `DeliveryStream` (68) |\n| **KMS** | `Alias` (2), `Key` (12), `ReplicaKey` (4) |\n| **Lambda** | `Alias` (7), `CodeSigningConfig` (1), `EventInvokeConfig` (5), `EventSourceMapping` (54), `Function` (46), `LayerVersion` (8), `LayerVersionPermission` (3), `Permission` (8), `Url` (8), `Version` (1) |\n| **Logs** | `AccountPolicy` (6), `DeliveryDestination` (3), `Destination` (1), `LogAnomalyDetector` (2), `LogGroup` (10), `MetricFilter` (7), `QueryDefinition` (1), `ResourcePolicy` (1), `SubscriptionFilter` (6), `Transformer` (3) |\n| **MemoryDB** | `Cluster` (8), `User` (1) |\n| **Pipes** | `Pipe` (9) |\n| **RDS** | `DBCluster` (19), `DBInstance` (33), `DBParameterGroup` (2), `DBProxy` (4), `DBProxyTargetGroup` (2), `DBShardGroup` (1), `DBSubnetGroup` (3), `EventSubscription` (3), `OptionGroup` (1) |\n| **Route53** | `CidrCollection` (11), `DNSSEC` (3), `HealthCheck` (30), `HostedZone` (14), `KeySigningKey` (9), `RecordSet` (75), `RecordSetGroup` (76) |\n| **Route53Profiles** | `ProfileAssociation` (1), `ProfileResourceAssociation` (6) |\n| **Route53Resolver** | `FirewallDomainList` (3), `FirewallRuleGroup` (18), `FirewallRuleGroupAssociation` (4), `ResolverDNSSECConfig` (1), `ResolverEndpoint` (18), `ResolverQueryLoggingConfig` (1), `ResolverQueryLoggingConfigAssociation` (1), `ResolverRule` (15), `ResolverRuleAssociation` (1) |\n| **S3** | `AccessPoint` (1), `Bucket` (54), `BucketPolicy` (4), `StorageLens` (5), `StorageLensGroup` (3) |\n| **S3Express** | `AccessPoint` (3), `DirectoryBucket` (11) |\n| **Scheduler** | `Schedule` (10), `ScheduleGroup` (1) |\n| **SecretsManager** | `RotationSchedule` (4), `Secret` (5), `SecretTargetAttachment` (1) |\n| **SNS** | `Subscription` (9), `Topic` (12), `TopicPolicy` (1) |\n| **SQS** | `Queue` (9), `QueuePolicy` (1) |\n| **SSM** | `Association` (3), `Document` (3), `MaintenanceWindow` (2), `MaintenanceWindowTarget` (1), `MaintenanceWindowTask` (1), `Parameter` (5) |\n| **StepFunctions** | `Activity` (3), `StateMachine` (26) |\n| **WAFv2** | `IPSet` (3), `LoggingConfiguration` (3), `RegexPatternSet` (3), `RuleGroup` (18), `WebACL` (23), `WebACLAssociation` (2) |\n\n</details>\n<!-- supported-resources:end -->\n\nHighlights:\n\n- **ELBv2**: `idle_timeout` / `deregistration_delay` / `slow_start` attribute ranges (stringly-typed Key/Value attributes are invisible to schema validation)\n- **IAM**: managed (6,144 chars) and inline (role/group/user) policy document size limits\n- **CloudFront**: `MinTTL <= DefaultTTL <= MaxTTL` ordering, ACM certificates must live in `us-east-1`\n- **Step Functions**: `Next`/`Default`/`Choices` must reference defined states (a dangling `StartAt` is already caught by the engine's built-in `E3601`)\n- **EC2**: security group TCP/UDP port ranges and `FromPort <= ToPort`\n\n## For AI agents\n\nTo add cdk-preflight to a CDK app:\n\n1. `npm i -D cdk-preflight`\n2. `npx cdk-preflight init` — or the shorter alias `npx cdkpf init` (finds the entry point via `cdk.json` and inserts `Preflight.apply(app)`; use `--dry-run` to preview)\n3. Run `cdk synth`. Violations fail the synth with a validation report; each finding carries a rule id, the actual value, and a suggested fix\n4. To fix a finding, prefer correcting the resource. To opt out instead: `exclude: ['<rule-id>']` disables one rule, `enforce: false` switches to warn-only reporting\n\nThe machine-readable findings are written to `cdk.out/validation-report.json` when synthesizing with `-c @aws-cdk/core:validationReportJson=true`.\n\n### Report missed deploy errors\n\ncdk-preflight only knows the failure modes it has benched. When a deploy fails on a constraint the pack should have caught, that report is how new rules get added — but at that moment cdk-preflight is out of the loop (it passed the synth), so the instruction has to already sit in your agent's context. Paste this into your repository's `AGENTS.md` (or `CLAUDE.md`):\n\n```markdown\n## cdk-preflight: report missed deploy errors\n\nIf `cdk deploy` fails even though `cdk synth` (with cdk-preflight enabled) passed,\nand the failure is a service-side validation rejection — CREATE_FAILED/UPDATE_FAILED\nwith a 400-class message such as \"Invalid request provided: ...\" — cdk-preflight is\nmissing a rule. Report it:\n\n1. Qualify first. NOT reportable: AccessDenied / permissions, service quotas,\n   throttling, name conflicts with existing resources, stabilization timeouts.\n2. Redact account-specific data (account IDs -> 123456789012, real ARNs/domains\n   -> placeholders).\n3. Search existing issues: https://github.com/badmintoncryer/cdk-preflight/issues\n4. With your user's approval, open a \"Missed deploy error\" issue with the verbatim\n   error message, the resource type, a minimal template snippet, and your\n   aws-cdk-lib / cdk-preflight versions.\n```\n\n## Scope and rule lifecycle\n\nA constraint belongs in the pack when violating it makes a real deployment fail *and* no layer that sees the same synthesized template already blocks it. There is no further \"is this worth a rule\" question — if the gap is real, it gets a rule.\n\nCDK L2 construct validation is deliberately **not** one of those layers. `CfnXxx` usage, escape hatches, `addPropertyOverride`, `cloudformation-include` and migrated templates all bypass L2, so an L2 guard covering the same mistake neither disqualifies a rule nor retires one.\n\nThat makes growth the normal state, and it has a consequence worth knowing before you upgrade: **new rules land in minor releases, so a minor upgrade can newly fail a `cdk synth` that passed yesterday.** That is intended, not a regression. If you need a frozen rule set, pin the version; to drop a single rule, `exclude: ['<rule-id>']`; to see everything without failing the build, `enforce: false`.\n\nRules move the other way too. Once the validation engine bundled in `aws-cdk-lib` (or CloudFormation's own pre-deploy validation) starts blocking a constraint, the rule is deleted rather than kept as a duplicate — staying on an older `aws-cdk-lib` and an older cdk-preflight keeps the old behavior.\n\n## How it works\n\n`Preflight.apply()` evaluates the rules with the [cloudformation-validate](https://github.com/aws-cloudformation/cloudformation-validate) Rust/WASM engine that ships inside `aws-cdk-lib` — no extra binaries, no network access at synth time. In the default enforce mode the engine is invoked through a dedicated CDK validation plugin so that violations fail synthesis; with `enforce: false` the rules are instead injected into the CDK built-in `CloudFormationValidatePlugin` and reported as warnings.\n\nConstraints that *can* be expressed in schemas or generic engine rules also make good upstream PRs to that engine, but nothing here waits on one — the upstream release cycle is deliberately slower than this pack's. Each rule's `meta.yaml` tracks its upstream status so that retirement stays bookkeeping.\n\n## Requirements\n\n- `aws-cdk-lib` >= 2.267.0, released 2026-08-27 (the first release that bundles the built-in CloudFormation validator). This is a recent release — an existing CDK app may need an upgrade before cdk-preflight can run.\n\n## Contributing\n\nRule authoring, the verification gates (including real-deploy reproduction), and the test layout are documented in [AGENTS.md](AGENTS.md) — written for AI coding agents and humans alike.\n\n## License\n\nApache-2.0\n"
+    "markdown": "<p align=\"center\">\n  <img src=\"https://raw.githubusercontent.com/badmintoncryer/cdk-preflight/main/assets/logo.png\" alt=\"cdk-preflight\" width=\"104\" height=\"104\">\n</p>\n\n<h1 align=\"center\">cdk-preflight</h1>\n\n<p align=\"center\">\n  <strong>Catch deploy-time CloudFormation failures at <code>cdk synth</code> time.</strong>\n</p>\n\n<p align=\"center\">\n  <a href=\"https://github.com/badmintoncryer/cdk-preflight/actions/workflows/monthly-verify.yml\"><img src=\"https://github.com/badmintoncryer/cdk-preflight/actions/workflows/monthly-verify.yml/badge.svg\" alt=\"monthly real-deploy verification\"></a>\n  <a href=\"https://www.npmjs.com/package/cdk-preflight\"><img src=\"https://img.shields.io/npm/v/cdk-preflight.svg\" alt=\"npm version\"></a>\n  <a href=\"https://www.npmjs.com/package/cdk-preflight\"><img src=\"https://img.shields.io/npm/dt/cdk-preflight.svg\" alt=\"npm total downloads\"></a>\n  <a href=\"docs/rules.md\"><img src=\"https://img.shields.io/badge/rules-2267-blue\" alt=\"2267 bundled rules\"></a>\n</p>\n\nSome CloudFormation constraints are not expressed in resource provider schemas — they live only in documentation, in service API validation, or across multiple properties. Templates that violate them pass `cdk synth`, pass CloudFormation pre-deployment validation, and then fail minutes into a deployment, burning a rollback cycle.\n\ncdk-preflight is a curated [Rego rule pack](docs/rules.md) for exactly those constraints, evaluated with the CloudFormation validation engine that ships inside `aws-cdk-lib` (>= 2.267.0). By default a violation **fails `cdk synth`** — a template that is known to fail at deploy time never leaves your machine.\n\nThe pack aims at **every deploy-time failure that no existing CDK mechanism already catches** — nothing narrower. Every bundled rule is backed by a `fail`/`pass` template pair, and the failure has been reproduced against real AWS. The handful of rules that could not be reproduced are marked `doc-only` and report as **warnings**: they show up in the validation report but never fail synth. Rules that the built-in validation engine already covers are deliberately **not** duplicated — a test suite enforces this.\n\n> **Requires `aws-cdk-lib` >= 2.267.0** (released 2026-08-27) — the first release that bundles\n> the CloudFormation validation engine. On older versions the rules cannot run at all.\n\n## Quick start\n\n```bash\nnpm i -D cdk-preflight\nnpx cdkpf init   # inserts Preflight.apply(app) into your CDK app\n                         # (`npx cdkpf init` is the same command, shorter)\n```\n\nor add one line yourself:\n\n```ts\nimport { Preflight } from 'cdk-preflight';\n\nconst app = new App();\nPreflight.apply(app);\n```\n\nOn violation, `cdk synth` fails with one error per finding, including the construct trace:\n\n```text\nERROR idle_timeout.timeout_seconds is 5000 but must be between 1 and 4000 seconds (cdk-preflight)\n   MyStack/Alb/Resource (Alb16C2F182) aws-cdk-lib.aws_elasticloadbalancingv2.CfnLoadBalancer\n\nSynthesis finished with errors\n```\n\n## What it catches\n\nFour ordinary-looking snippets. All of them pass `cdk synth` and CloudFormation\npre-deployment validation, and all of them fail minutes into a deployment:\n\n```ts\n// 1) pf-iam-inline-policy-size — enumerate buckets, grant each one, blow past 10,240 chars\n//    \"Maximum policy size of 10240 bytes exceeded for role IngestRole\"\n//    (via role.addToPolicy the CDK auto-splits into managed policies instead,\n//     and you hit the 6,144-char limit as pf-iam-managed-policy-size)\nnew iam.Policy(this, 'IngestPolicy', {\n  roles: [role],\n  statements: [new iam.PolicyStatement({\n    actions: ['s3:GetObject', 's3:ListBucket'],\n    resources: Array.from({ length: 200 },\n      (_, i) => `arn:aws:s3:::data-lake-landing-zone-${i}/year=*/month=*/*`),\n  })],\n});\n\n// 2) pf-lambda-env-size — a config blob in the environment, over the 4KB total\n//    \"Lambda was unable to configure your environment variables because the\n//     environment variables you have provided exceeded the 4KB limit\"\nnew lambda.Function(this, 'Fn', {\n  runtime: lambda.Runtime.NODEJS_22_X,\n  handler: 'index.handler',\n  code: lambda.Code.fromInline('exports.handler = async () => {};'),\n  environment: { FEATURE_FLAGS: JSON.stringify(bigFeatureFlagMap) },\n});\n\n// 3) pf-sfn-asl-missing-state (+ pf-sfn-asl-unreachable-state) — a typo in a state name\n//    \"Invalid State Machine Definition: 'MISSING_TRANSITION_TARGET: ...'\"\nnew sfn.StateMachine(this, 'Pipeline', {\n  definitionBody: sfn.DefinitionBody.fromString(JSON.stringify({\n    StartAt: 'Validate',\n    States: {\n      Validate: { Type: 'Pass', Next: 'Transform' },\n      Trasform: { Type: 'Pass', End: true },   // typo: Transform\n    },\n  })),\n});\n\n// 4) pf-logs-filter-pattern-bracket — a filter pattern opened with '[' and never closed\n//    \"If a filter pattern starts with '[' it must end with ']'\"\nnew logs.MetricFilter(this, 'ErrorFilter', {\n  logGroup,\n  metricNamespace: 'Pipeline',\n  metricName: 'Errors',\n  filterPattern: logs.FilterPattern.literal('[time, level=ERROR, msg'),\n});\n```\n\nNone of these are type errors, so the L2 constructs accept them; none of them are\nexpressible in a resource schema, so CloudFormation accepts the template. With\n`Preflight.apply(app)` in place they fail `cdk synth` instead.\n\n## Observe-only mode\n\nTo roll the rules out gradually, start with `enforce: false`: findings then surface as synth **warnings** through the CDK built-in validator, with construct traces and per-finding acknowledgement:\n\n```ts\nPreflight.apply(app, { enforce: false });\n```\n\n```text\nWARNING idle_timeout.timeout_seconds is 5000 but must be between 1 and 4000 seconds (CloudFormation Validate)\n   MyStack/Alb (Alb) aws-cdk-lib.aws_elasticloadbalancingv2.CfnLoadBalancer\n   Acknowledge with 'CloudFormation-Validate::pf-elbv2-lb-idle-timeout-range'\n```\n\n> **Known limitation with stages.** The AWS CDK CLI drops validation findings for stacks nested in a `Stage`\n> before printing them, so in observe-only mode those findings appear **only** in `cdk.out/validation-report.json`\n> and never on the console. Enforce mode is not affected: cdk-preflight reports such findings itself and fails\n> synthesis. This is a CLI-side bug (present since aws-cdk 2.1128.1), not a rule evaluation problem.\n\n> **If the rules cannot run, the build stops.** When the evaluation engine fails on a template (a rule pack that\n> does not compile, an engine bug), enforce mode reports it as a violation named `pf-engine-error` and fails\n> synthesis for that stack instead of passing green with no rule having run. The other stacks keep their rules.\n> `pf-engine-error` is not a bundled rule and cannot be `exclude`d; `enforce: false` unblocks the build if you\n> need one.\n\n| Option | Default | Effect |\n|---|---|---|\n| `enforce` | `true` | Violations of bundled rules fail synthesis; set to `false` to only warn |\n| `strict` | `false` | With `enforce`: also fail on error-class findings (`ERROR`/`FATAL`, e.g. `F3034`) of the built-in validation engine itself, which the CDK currently downgrades to warnings |\n| `exclude` | `[]` | Rule ids to disable |\n| `includeUpstreamPending` | `true` | Include rules already proposed to the upstream engine but not yet merged |\n\nTo opt out of a single rule everywhere, pass its id in `exclude`. To suppress a\nsingle *finding* on one construct, acknowledge it — this works in both modes, the\nid prefix just differs (`cdk-preflight::` when enforcing, `CloudFormation-Validate::`\nin observe-only, as printed in the warning text):\n\n```ts\ncdk.Validations.of(errorFilter).acknowledge({\n  id: 'cdk-preflight::pf-logs-filter-pattern-bracket',\n  reason: 'log group is written by a legacy producer; pattern is fixed upstream',\n});\n```\n\n## Bundled rules\n\nSee [docs/rules.md](docs/rules.md) for the generated rule table.\n\n<!-- supported-resources:start -->\n<details>\n<summary><b>290 resource types across 44 services</b> — click to expand</summary>\n\nResource names are relative to `AWS::<Service>::`; the number in parentheses is how many rules target that type.\n\n| Service | Resource types |\n|---|---|\n| **(any resource type)** | `*` (2) |\n| **ApiGateway** | `ApiKey` (1), `Authorizer` (5), `Deployment` (1), `DocumentationPart` (1), `DomainName` (4), `GatewayResponse` (1), `Method` (13), `Model` (3), `Resource` (1), `RestApi` (4), `Stage` (9), `UsagePlan` (5), `VpcLink` (1) |\n| **ApiGatewayV2** | `Api` (5), `Authorizer` (11), `DomainName` (3), `Integration` (15), `IntegrationResponse` (1), `Model` (2), `Route` (6), `RouteResponse` (2), `Stage` (4), `VpcLink` (1) |\n| **AppSync** | `Api` (7), `ApiCache` (4), `ApiKey` (2), `ChannelNamespace` (5), `DataSource` (15), `DomainName` (1), `FunctionConfiguration` (24), `GraphQLApi` (16), `GraphQLSchema` (12), `Resolver` (32), `SourceApiAssociation` (3) |\n| **Athena** | `DataCatalog` (6), `WorkGroup` (8) |\n| **AutoScaling** | `AutoScalingGroup` (38), `LifecycleHook` (8), `ScalingPolicy` (41), `ScheduledAction` (13), `WarmPool` (4) |\n| **Batch** | `ComputeEnvironment` (40), `ConsumableResource` (2), `JobDefinition` (109), `JobQueue` (18), `SchedulingPolicy` (8), `ServiceEnvironment` (6) |\n| **Bedrock** | `ApplicationInferenceProfile` (2), `AutomatedReasoningPolicy` (3), `Blueprint` (3), `DataAutomationProject` (8), `DataSource` (12), `Flow` (14), `Guardrail` (19), `IntelligentPromptRouter` (5), `KnowledgeBase` (18), `Prompt` (4) |\n| **BedrockAgentCore** | `ApiKeyCredentialProvider` (1), `BrowserCustom` (1), `CodeInterpreterCustom` (1), `ConfigurationBundle` (3), `Dataset` (3), `Evaluator` (4), `Gateway` (5), `GatewayRule` (3), `GatewayTarget` (9), `Harness` (2), `HarnessEndpoint` (2), `Memory` (6), `OAuth2CredentialProvider` (3), `OnlineEvaluationConfig` (3), `PaymentCredentialProvider` (1), `PaymentManager` (1), `Policy` (3), `ResourcePolicy` (1), `Runtime` (8), `RuntimeEndpoint` (1) |\n| **CloudFront** | `AnycastIpList` (1), `CachePolicy` (7), `ContinuousDeploymentPolicy` (5), `Distribution` (55), `Function` (4), `KeyGroup` (1), `KeyValueStore` (2), `OriginRequestPolicy` (5), `PublicKey` (1), `RealtimeLogConfig` (3), `ResponseHeadersPolicy` (8), `VpcOrigin` (3) |\n| **CloudWatch** | `Alarm` (21), `AnomalyDetector` (6), `CompositeAlarm` (6), `Dashboard` (14), `InsightRule` (7), `MetricStream` (6) |\n| **Cognito** | `IdentityPool` (3), `IdentityPoolRoleAttachment` (7), `LogDeliveryConfiguration` (3), `ManagedLoginBranding` (2), `UserPool` (52), `UserPoolClient` (21), `UserPoolDomain` (7), `UserPoolGroup` (1), `UserPoolIdentityProvider` (11), `UserPoolResourceServer` (4), `UserPoolRiskConfigurationAttachment` (6), `UserPoolUICustomizationAttachment` (2) |\n| **DynamoDB** | `GlobalTable` (26), `Table` (28) |\n| **EC2** | `ClientVpnAuthorizationRule` (1), `ClientVpnEndpoint` (6), `DHCPOptions` (2), `EIPAssociation` (1), `FlowLog` (4), `Instance` (10), `KeyPair` (1), `LaunchTemplate` (5), `NatGateway` (2), `NetworkAclEntry` (1), `NetworkInterface` (2), `PlacementGroup` (3), `PrefixList` (3), `Route` (1), `SecurityGroup` (6), `SecurityGroupEgress` (5), `SecurityGroupIngress` (5), `Subnet` (6), `TrafficMirrorTarget` (1), `TransitGateway` (2), `TransitGatewayRoute` (1), `Volume` (6), `VPC` (2), `VPCCidrBlock` (1), `VPCEndpoint` (4), `VPCGatewayAttachment` (1), `VPNConnection` (5) |\n| **ECR** | `PullThroughCacheRule` (3), `RegistryScanningConfiguration` (1), `ReplicationConfiguration` (1), `Repository` (7), `RepositoryCreationTemplate` (8), `SigningConfiguration` (1) |\n| **ECS** | `CapacityProvider` (3), `Cluster` (5), `Service` (37), `TaskDefinition` (64), `TaskSet` (2) |\n| **EFS** | `AccessPoint` (1), `FileSystem` (7), `MountTarget` (4) |\n| **ElastiCache** | `CacheCluster` (9), `ReplicationGroup` (14), `User` (2), `UserGroup` (1) |\n| **ElasticLoadBalancingV2** | `Listener` (57), `ListenerCertificate` (2), `ListenerRule` (37), `LoadBalancer` (37), `TargetGroup` (58), `TrustStore` (1), `TrustStoreRevocation` (1) |\n| **Events** | `ApiDestination` (1), `Archive` (5), `Connection` (1), `Endpoint` (2), `EventBus` (2), `Rule` (23) |\n| **EventSchemas** | `Discoverer` (1), `Registry` (1), `RegistryPolicy` (1), `Schema` (1) |\n| **Glue** | `Classifier` (6), `Connection` (5), `Crawler` (11), `CustomEntityType` (1), `Database` (1), `DataQualityRuleset` (1), `Job` (15), `MLTransform` (4), `Partition` (1), `Schema` (3), `SecurityConfiguration` (1), `Table` (1), `Trigger` (10), `UserDefinedFunction` (2), `Workflow` (1) |\n| **IAM** | `Group` (23), `GroupPolicy` (1), `InstanceProfile` (2), `ManagedPolicy` (31), `OIDCProvider` (2), `Policy` (29), `Role` (40), `RolePolicy` (1), `ServiceLinkedRole` (1), `User` (24), `UserPolicy` (1) |\n| **Kinesis** | `ResourcePolicy` (4), `Stream` (5), `StreamConsumer` (2) |\n| **KinesisAnalyticsV2** | `Application` (20), `ApplicationCloudWatchLoggingOption` (1), `ApplicationOutput` (1), `ApplicationReferenceDataSource` (1) |\n| **KinesisFirehose** | `DeliveryStream` (68) |\n| **KMS** | `Alias` (2), `Key` (12), `ReplicaKey` (4) |\n| **Lambda** | `Alias` (7), `CodeSigningConfig` (1), `EventInvokeConfig` (5), `EventSourceMapping` (54), `Function` (46), `LayerVersion` (8), `LayerVersionPermission` (3), `Permission` (8), `Url` (8), `Version` (1) |\n| **Logs** | `AccountPolicy` (6), `DeliveryDestination` (3), `Destination` (1), `LogAnomalyDetector` (2), `LogGroup` (10), `MetricFilter` (7), `QueryDefinition` (1), `ResourcePolicy` (1), `SubscriptionFilter` (6), `Transformer` (3) |\n| **MemoryDB** | `Cluster` (8), `User` (1) |\n| **Pipes** | `Pipe` (9) |\n| **RDS** | `DBCluster` (19), `DBInstance` (33), `DBParameterGroup` (2), `DBProxy` (4), `DBProxyTargetGroup` (2), `DBShardGroup` (1), `DBSubnetGroup` (3), `EventSubscription` (3), `OptionGroup` (1) |\n| **Route53** | `CidrCollection` (11), `DNSSEC` (3), `HealthCheck` (30), `HostedZone` (14), `KeySigningKey` (9), `RecordSet` (75), `RecordSetGroup` (76) |\n| **Route53Profiles** | `ProfileAssociation` (1), `ProfileResourceAssociation` (6) |\n| **Route53Resolver** | `FirewallDomainList` (3), `FirewallRuleGroup` (18), `FirewallRuleGroupAssociation` (4), `ResolverDNSSECConfig` (1), `ResolverEndpoint` (18), `ResolverQueryLoggingConfig` (1), `ResolverQueryLoggingConfigAssociation` (1), `ResolverRule` (15), `ResolverRuleAssociation` (1) |\n| **S3** | `AccessPoint` (1), `Bucket` (54), `BucketPolicy` (4), `StorageLens` (5), `StorageLensGroup` (3) |\n| **S3Express** | `AccessPoint` (3), `DirectoryBucket` (11) |\n| **Scheduler** | `Schedule` (10), `ScheduleGroup` (1) |\n| **SecretsManager** | `RotationSchedule` (4), `Secret` (5), `SecretTargetAttachment` (1) |\n| **SNS** | `Subscription` (9), `Topic` (12), `TopicPolicy` (1) |\n| **SQS** | `Queue` (9), `QueuePolicy` (1) |\n| **SSM** | `Association` (3), `Document` (3), `MaintenanceWindow` (2), `MaintenanceWindowTarget` (1), `MaintenanceWindowTask` (1), `Parameter` (5) |\n| **StepFunctions** | `Activity` (3), `StateMachine` (26) |\n| **WAFv2** | `IPSet` (3), `LoggingConfiguration` (3), `RegexPatternSet` (3), `RuleGroup` (18), `WebACL` (23), `WebACLAssociation` (2) |\n\n</details>\n<!-- supported-resources:end -->\n\nHighlights:\n\n- **ELBv2**: `idle_timeout` / `deregistration_delay` / `slow_start` attribute ranges (stringly-typed Key/Value attributes are invisible to schema validation)\n- **IAM**: managed (6,144 chars) and inline (role/group/user) policy document size limits\n- **CloudFront**: `MinTTL <= DefaultTTL <= MaxTTL` ordering, ACM certificates must live in `us-east-1`\n- **Step Functions**: `Next`/`Default`/`Choices` must reference defined states (a dangling `StartAt` is already caught by the engine's built-in `E3601`)\n- **EC2**: security group TCP/UDP port ranges and `FromPort <= ToPort`\n\n## For AI agents\n\nTo add cdk-preflight to a CDK app:\n\n1. `npm i -D cdk-preflight`\n2. `npx cdk-preflight init` — or the shorter alias `npx cdkpf init` (finds the entry point via `cdk.json` and inserts `Preflight.apply(app)`; use `--dry-run` to preview)\n3. Run `cdk synth`. Violations fail the synth with a validation report; each finding carries a rule id, the actual value, and a suggested fix\n4. To fix a finding, prefer correcting the resource. To opt out instead: `exclude: ['<rule-id>']` disables one rule, `enforce: false` switches to warn-only reporting\n\nThe machine-readable findings are written to `cdk.out/validation-report.json` when synthesizing with `-c @aws-cdk/core:validationReportJson=true`.\n\n### Report missed deploy errors\n\ncdk-preflight only knows the failure modes it has benched. When a deploy fails on a constraint the pack should have caught, that report is how new rules get added — but at that moment cdk-preflight is out of the loop (it passed the synth), so the instruction has to already sit in your agent's context. Paste this into your repository's `AGENTS.md` (or `CLAUDE.md`):\n\n```markdown\n## cdk-preflight: report missed deploy errors\n\nIf `cdk deploy` fails even though `cdk synth` (with cdk-preflight enabled) passed,\nand the failure is a service-side validation rejection — CREATE_FAILED/UPDATE_FAILED\nwith a 400-class message such as \"Invalid request provided: ...\" — cdk-preflight is\nmissing a rule. Report it:\n\n1. Qualify first. NOT reportable: AccessDenied / permissions, service quotas,\n   throttling, name conflicts with existing resources, stabilization timeouts.\n2. Redact account-specific data (account IDs -> 123456789012, real ARNs/domains\n   -> placeholders).\n3. Search existing issues: https://github.com/badmintoncryer/cdk-preflight/issues\n4. With your user's approval, open a \"Missed deploy error\" issue with the verbatim\n   error message, the resource type, a minimal template snippet, and your\n   aws-cdk-lib / cdk-preflight versions.\n```\n\n## Scope and rule lifecycle\n\nA constraint belongs in the pack when violating it makes a real deployment fail *and* no layer that sees the same synthesized template already blocks it. There is no further \"is this worth a rule\" question — if the gap is real, it gets a rule.\n\nCDK L2 construct validation is deliberately **not** one of those layers. `CfnXxx` usage, escape hatches, `addPropertyOverride`, `cloudformation-include` and migrated templates all bypass L2, so an L2 guard covering the same mistake neither disqualifies a rule nor retires one.\n\nThat makes growth the normal state, and it has a consequence worth knowing before you upgrade: **new rules land in minor releases, so a minor upgrade can newly fail a `cdk synth` that passed yesterday.** That is intended, not a regression. If you need a frozen rule set, pin the version; to drop a single rule, `exclude: ['<rule-id>']`; to see everything without failing the build, `enforce: false`.\n\nRules move the other way too. Once the validation engine bundled in `aws-cdk-lib` (or CloudFormation's own pre-deploy validation) starts blocking a constraint, the rule is deleted rather than kept as a duplicate — staying on an older `aws-cdk-lib` and an older cdk-preflight keeps the old behavior.\n\n## How it works\n\n`Preflight.apply()` evaluates the rules with the [cloudformation-validate](https://github.com/aws-cloudformation/cloudformation-validate) Rust/WASM engine that ships inside `aws-cdk-lib` — no extra binaries, no network access at synth time. In the default enforce mode the engine is invoked through a dedicated CDK validation plugin so that violations fail synthesis; with `enforce: false` the rules are instead injected into the CDK built-in `CloudFormationValidatePlugin` and reported as warnings.\n\nConstraints that *can* be expressed in schemas or generic engine rules also make good upstream PRs to that engine, but nothing here waits on one — the upstream release cycle is deliberately slower than this pack's. Each rule's `meta.yaml` tracks its upstream status so that retirement stays bookkeeping.\n\n## Requirements\n\n- `aws-cdk-lib` >= 2.267.0, released 2026-08-27 (the first release that bundles the built-in CloudFormation validator). This is a recent release — an existing CDK app may need an upgrade before cdk-preflight can run.\n\n## Contributing\n\nRule authoring, the verification gates (including real-deploy reproduction), and the test layout are documented in [AGENTS.md](AGENTS.md) — written for AI coding agents and humans alike.\n\n## License\n\nApache-2.0\n"
   },
   "repository": {
     "type": "git",
@@ -9482,7 +9482,7 @@
           },
           "locationInModule": {
             "filename": "src/index.ts",
-            "line": 98
+            "line": 93
           },
           "name": "ruleIds",
           "returns": {
@@ -9600,6 +9600,6 @@
       "symbolId": "src/index:PreflightOptions"
     }
   },
-  "version": "0.0.120",
-  "fingerprint": "Fr6VkZqFaGL2YypLv8o2JM0KLU2xcjOJvCXOucS2wuE="
+  "version": "0.0.122",
+  "fingerprint": "CXf4WHV95yWFjsMKp4xBg1usqS8JMPdQz72DaTgvZ2I="
 }

package/AGENTS.md

@@ -14,7 +14,7 @@ Growth is the normal state. The upstream engine ships slowly and carefully by de
 
 ## Design principles (do not violate)
 
-1. **No duplication of the engine.** If the bundled engine already reports a constraint as ERROR/FATAL (schema check or built-in rule), we must not re-implement it. `test/rules.test.ts` enforces this mechanically ("does not duplicate a built-in blocker"). If that test fails for a new rule, the rule is unnecessary — delete it and record why in the PR.
+1. **No duplication of the engine.** If the bundled engine already reports a constraint as ERROR/FATAL (schema check or built-in rule), we must not re-implement it. `test/rule-table.ts`, run through the `test/rules.shard*.test.ts` files, enforces this mechanically ("does not duplicate a built-in blocker"). If that test fails for a new rule, the rule is unnecessary — delete it and record why in the PR.
 2. **Every rule ships with proof.** `templates/fail.template.json` must violate exactly this rule; `templates/pass.template.json` must be clean. `meta.yaml#repro` records how the deploy-time failure was verified (`real-deploy` / `research-case` / `doc-only` — the last one requires an explanation in `evidence`).
 
    **Both fixtures sit on the boundary.** For an ordered constraint (a number, a length, a count) the fail template carries the *tightest violating* value and the pass template the *exact limit* — a 20-character minimum gets a 19-character fail and a 20-character pass, not 5 and 26. A slack pair proves only the direction of the rule: `count(v) < 20` still fires on a 5-character fail template when the constant is wrong (`< 10`), and a 26-character pass template stays silent even at `< 25`, so neither the constant nor the comparison operator is pinned by the fixtures. It also weakens the real-deploy gate, which is the only thing that establishes where AWS's limit actually is — a 19-character key that fails CREATE proves the documented 20, a 5-character one proves "somewhere above 5". A range the rule checks at both ends gets a resource at each end (the fixture assertion is "at least one diagnostic for this rule", so several violating resources in one fail template are fine, and a branch a single fixture cannot reach gets a targeted case in `test/rules.test.ts`). An end the engine's schema already enforces stays out of the fail template — the rule does not check it (principle 1) and the duplication guard would flag it. Constraints with no ordering — a missing property, a wrong enum member, a cross-resource mismatch — have no boundary to sit on. The evidence line records the values that were actually deployed, so it pins the boundary too: `bench 2026-09-13 us-east-1: 19-char Value -> "API Key value should be at least 20 characters" (ROLLBACK_COMPLETE); pass 20-char -> CREATE_COMPLETE`.
@@ -68,7 +68,7 @@ The ordering is by **how easily the L2 guard is bypassed in normal use**, not by
 
 The two failure modes are watched separately: **staleness** (the constraint disappeared at AWS — the fail template now deploys clean) is caught by the monthly real-deploy run and reported as BROKEN; **obsolescence** (the engine caught up — the rule is now a duplicate) is caught by the duplication guard and the redundancy scan and reported as REDUNDANT. Both land in the monthly issue.
 
-**Adding.** Two gates, both mechanical, and nothing else can reject a candidate: the duplication guard (`test/rules.test.ts`) and the real-deploy gate (`bench/verify-rule.sh`). The real-deploy gate is the one thing that did *not* get looser with the widened scope, and deliberately so — `enforce` is the default mode, so a false positive is a hard synth failure in someone's CI. The CloudFront survey is the standing evidence: 3 of 9 documented constraints deployed clean (see "A doc sentence is a hypothesis" above). Volume comes from running the bench over more services, never from lowering that bar.
+**Adding.** Two gates, both mechanical, and nothing else can reject a candidate: the duplication guard (`test/rules.shard*.test.ts`) and the real-deploy gate (`bench/verify-rule.sh`). The real-deploy gate is the one thing that did *not* get looser with the widened scope, and deliberately so — `enforce` is the default mode, so a false positive is a hard synth failure in someone's CI. The CloudFront survey is the standing evidence: 3 of 9 documented constraints deployed clean (see "A doc sentence is a hypothesis" above). Volume comes from running the bench over more services, never from lowering that bar.
 
 **Retiring.** The trigger is the bundled engine (or CloudFormation's server-side validation) starting to block the constraint — never an L2 construct, never cfn-lint. You do not have to watch for it; two mechanisms report it:
 
@@ -146,10 +146,10 @@ If you are a subagent running one of these phases, do not spawn further agents.
    - **Dynamic reference strings are markerized too** (measured 2026-09-03): a literal `{{resolve:ssm:/path}}` property value surfaces as `{"__dynamic": "dynamic reference: {{resolve:ssm:/path}}", "__param_type": "String"}` and `resolve()` is undefined for it. A rule that judges the reference text itself (e.g. the SSM parameter path) must read the raw property with `object.get` and extract the `__dynamic` string. Reference implementation: `pf-ec2-instance-ami-arch`.
    - **Deploy-region rules**: the enforce plugin injects a generated module defining `deploy_region` (and `deploy_account` when the account id is concrete) whenever the app-level region is concrete (`deployEnvironmentModule` in `src/private/enforce.ts`; the test harness injects `us-east-1` for fixtures). Rules must read it as `data.cdk_preflight.deploy_region` — the data reference is undefined when not injected, so the rule skips; a bare `deploy_region` variable would be a compile error. `data.cdk_preflight.deploy_account` works the same way (`pf-kms-key-policy-lockout` treats any account as ours when it is absent, `pf-kms-alias-target` skips its account check). Consequences: region-dependent rules are silent in warn mode (`enforce: false` hands rules to the CDK built-in plugin, which we cannot inject into) and in region-agnostic apps; say so in `meta.yaml#repro.evidence`. Reference implementations: `pf-dynamodb-global-table-replica-region`, `pf-dynamodb-kinesis-stream-region`.
    - Helper rules must use a unique `_pf_<rule>_...` prefix (all rules share one package, and the enforce plugin loads a service's rules as a single module). `bundle-rules` fails the build when two modules define the same top-level name — without the check, the second definition merges into the first as an incremental rule and both rules quietly change meaning. A name two rules genuinely need belongs in `rules/_lib/`.
-   - **`meta.resourceTypes` is load-bearing, not documentation.** The enforce plugin compiles only the rules whose declared types appear in the synthesized templates — rule compilation is the dominant fixed cost (~4.6s for the whole pack, ~0.8s for the ~100 rules a typical app keeps), so this is what keeps `cdk synth` usable as the pack grows. A type a rule *reads* but does not *declare* makes the rule silently stop firing on real apps. Declare every type the rule touches, including the counterpart of a cross-resource rule; `test/rules.test.ts` checks every rule survives pruning against its own fail template.
+   - **`meta.resourceTypes` is load-bearing, not documentation.** The enforce plugin compiles only the rules whose declared types appear in the synthesized templates — rule compilation is the dominant fixed cost (~4.6s for the whole pack, ~0.8s for the ~100 rules a typical app keeps), so this is what keeps `cdk synth` usable as the pack grows. A type a rule *reads* but does not *declare* makes the rule silently stop firing on real apps. Declare every type the rule touches, including the counterpart of a cross-resource rule; `test/rules.shard*.test.ts` checks every rule survives pruning against its own fail template.
    - A helper several rules of one service need (parsing an opaque DSL, enumerating nested scopes) goes in `rules/_lib/<service>.rego` with a `_pf_<service>lib_` prefix (`rules/_lib/sfn.rego` is the reference: ASL from `DefinitionString` *or* the L1 `Definition` object, nested Parallel/Map scopes to depth 3, effective QueryLanguage). Rules never reference another rule's helpers — `exclude` can unload any rule, a lib is always loaded.
    - **Cheap screen for definition-level constraints**: some services expose their create-time validator as a free API (`aws stepfunctions validate-state-machine-definition --type STANDARD|EXPRESS` is the same validator CreateStateMachine runs). Use it to triage doc hypotheses before spending a CloudFormation deploy on each — 100 Step Functions hypotheses took minutes (2026-09-05). The real-deploy gate stays.
-3. `npx ts-node --transpile-only --project test/tsconfig.json scripts/rule-check.ts check <service|rule-id>` while iterating: it reads `rules/` straight from disk into a single engine (no bundle, no meta validation, no jest) and reports, per rule, whether the fail template fires its own rule, the pass template is silent for every rule, and neither trips a built-in ERROR/FATAL. Then `npx projen bundle-rules` and `npx jest test/rules.test.ts test/structure.test.ts` — the duplication guard and fixture checks run there for real. Prefer `jest -t` while iterating; the full suite is 3,228 tests / ~2 min (measured 2026-09-08), so keep it for the pre-PR run.
+3. `npx ts-node --transpile-only --project test/tsconfig.json scripts/rule-check.ts check <service|rule-id>` while iterating: it reads `rules/` straight from disk into a single engine (no bundle, no meta validation, no jest) and reports, per rule, whether the fail template fires its own rule, the pass template is silent for every rule, and neither trips a built-in ERROR/FATAL. Then `npx projen bundle-rules` and `npx jest test/rules test/structure.test.ts` (the `test/rules` pattern picks up both `rules.test.ts` and the `rules.shard*.test.ts` files that carry the per-rule table) — the duplication guard and fixture checks run there for real. Prefer `jest -t` while iterating; the full suite is ~11,400 tests / ~2.5 min on 8 cores (measured 2026-09-14), so keep it for the pre-PR run.
 4. **Real-deploy gate**: `bash bench/verify-rule.sh <rule-id>` deploys the fail template (expects CREATE to fail; records the service error message) and, where cheap, the pass template (expects success, then deletes). Paste the observed error into `meta.yaml#repro.evidence` with the date. Only `doc-only` rules may skip this, with justification.
 5. Update nothing else by hand — `docs/rules.md`, `src/rules.generated.ts`, and the parts of `README.md` between the
    `<!-- supported-resources:start -->` markers (plus the rule-count badge) are all written by `npx projen bundle-rules`.

package/README.md

@@ -12,7 +12,7 @@
   <a href="https://github.com/badmintoncryer/cdk-preflight/actions/workflows/monthly-verify.yml"><img src="https://github.com/badmintoncryer/cdk-preflight/actions/workflows/monthly-verify.yml/badge.svg" alt="monthly real-deploy verification"></a>
   <a href="https://www.npmjs.com/package/cdk-preflight"><img src="https://img.shields.io/npm/v/cdk-preflight.svg" alt="npm version"></a>
   <a href="https://www.npmjs.com/package/cdk-preflight"><img src="https://img.shields.io/npm/dt/cdk-preflight.svg" alt="npm total downloads"></a>
-  <a href="docs/rules.md"><img src="https://img.shields.io/badge/rules-2204-blue" alt="2204 bundled rules"></a>
+  <a href="docs/rules.md"><img src="https://img.shields.io/badge/rules-2267-blue" alt="2267 bundled rules"></a>
 </p>
 
 Some CloudFormation constraints are not expressed in resource provider schemas — they live only in documentation, in service API validation, or across multiple properties. Templates that violate them pass `cdk synth`, pass CloudFormation pre-deployment validation, and then fail minutes into a deployment, burning a rollback cycle.
@@ -155,7 +155,7 @@ See [docs/rules.md](docs/rules.md) for the generated rule table.
 
 <!-- supported-resources:start -->
 <details>
-<summary><b>275 resource types across 43 services</b> — click to expand</summary>
+<summary><b>290 resource types across 44 services</b> — click to expand</summary>
 
 Resource names are relative to `AWS::<Service>::`; the number in parentheses is how many rules target that type.
 
@@ -182,6 +182,7 @@ Resource names are relative to `AWS::<Service>::`; the number in parentheses is
 | **ElasticLoadBalancingV2** | `Listener` (57), `ListenerCertificate` (2), `ListenerRule` (37), `LoadBalancer` (37), `TargetGroup` (58), `TrustStore` (1), `TrustStoreRevocation` (1) |
 | **Events** | `ApiDestination` (1), `Archive` (5), `Connection` (1), `Endpoint` (2), `EventBus` (2), `Rule` (23) |
 | **EventSchemas** | `Discoverer` (1), `Registry` (1), `RegistryPolicy` (1), `Schema` (1) |
+| **Glue** | `Classifier` (6), `Connection` (5), `Crawler` (11), `CustomEntityType` (1), `Database` (1), `DataQualityRuleset` (1), `Job` (15), `MLTransform` (4), `Partition` (1), `Schema` (3), `SecurityConfiguration` (1), `Table` (1), `Trigger` (10), `UserDefinedFunction` (2), `Workflow` (1) |
 | **IAM** | `Group` (23), `GroupPolicy` (1), `InstanceProfile` (2), `ManagedPolicy` (31), `OIDCProvider` (2), `Policy` (29), `Role` (40), `RolePolicy` (1), `ServiceLinkedRole` (1), `User` (24), `UserPolicy` (1) |
 | **Kinesis** | `ResourcePolicy` (4), `Stream` (5), `StreamConsumer` (2) |
 | **KinesisAnalyticsV2** | `Application` (20), `ApplicationCloudWatchLoggingOption` (1), `ApplicationOutput` (1), `ApplicationReferenceDataSource` (1) |

package/docs/rules.md

@@ -1449,6 +1449,69 @@
 | `pf-firehose-snowflake-user` | AWS::KinesisFirehose::DeliveryStream | A Snowflake destination needs a user or a secret | ERROR | none |
 | `pf-firehose-snowflake-variant-columns` | AWS::KinesisFirehose::DeliveryStream | Variant content and metadata mapping needs both column names | ERROR | none |
 | `pf-firehose-splunk-hec-endpoint-https` | AWS::KinesisFirehose::DeliveryStream | A Splunk HEC endpoint must be an HTTPS URL | ERROR | none |
+| `pf-glue-classifier-csv-custom-datatype` | AWS::Glue::Classifier | Custom CSV datatypes come from the supported set | ERROR | pending-engine |
+| `pf-glue-classifier-csv-custom-datatype-flag` | AWS::Glue::Classifier | ContainsCustomDatatype and CustomDatatypeConfigured travel together | ERROR | none |
+| `pf-glue-classifier-csv-quote-symbol` | AWS::Glue::Classifier | The CSV quote symbol differs from the delimiter | ERROR | none |
+| `pf-glue-classifier-csv-single-char` | AWS::Glue::Classifier | The CSV delimiter and quote symbol are one character each | ERROR | pending-engine |
+| `pf-glue-classifier-grok-pattern-names` | AWS::Glue::Classifier | A grok pattern only names built-in or custom patterns | ERROR | none |
+| `pf-glue-classifier-grok-pattern-single-line` | AWS::Glue::Classifier | A grok pattern holds no line break | ERROR | pending-engine |
+| `pf-glue-connection-jdbc-credentials` | AWS::Glue::Connection | A JDBC connection needs USERNAME and PASSWORD, or SECRET_ID | ERROR | none |
+| `pf-glue-connection-network-physical-requirements` | AWS::Glue::Connection | A NETWORK connection needs PhysicalConnectionRequirements | ERROR | none |
+| `pf-glue-connection-required-properties` | AWS::Glue::Connection | Each connection type needs its own ConnectionProperties entries | ERROR | none |
+| `pf-glue-connection-snowflake-compute-properties` | AWS::Glue::Connection | A SNOWFLAKE connection needs SparkProperties or PythonProperties | ERROR | none |
+| `pf-glue-connection-snowflake-spark-url` | AWS::Glue::Connection | A SNOWFLAKE connection's sfUrl must be a Snowflake account URL | ERROR | none |
+| `pf-glue-crawler-configuration-json` | AWS::Glue::Crawler | The crawler Configuration must be well-formed JSON | ERROR | none |
+| `pf-glue-crawler-configuration-version` | AWS::Glue::Crawler | The crawler Configuration JSON must carry Version | ERROR | none |
+| `pf-glue-crawler-configuration-version-type` | AWS::Glue::Crawler | The crawler Configuration Version has to be a JSON number | ERROR | none |
+| `pf-glue-crawler-dynamodb-scan-rate` | AWS::Glue::Crawler | A DynamoDB target scan rate must be between 0.1 and 1.5 | ERROR | pending-engine |
+| `pf-glue-crawler-event-mode-requires-event-queue` | AWS::Glue::Crawler | CRAWL_EVENT_MODE needs an S3 target with EventQueueArn | ERROR | none |
+| `pf-glue-crawler-non-catalog-target-database-name` | AWS::Glue::Crawler | A crawler with non-catalog targets needs a DatabaseName | ERROR | none |
+| `pf-glue-crawler-recrawl-behavior-s3-only` | AWS::Glue::Crawler | CRAWL_EVENT_MODE and CRAWL_NEW_FOLDERS_ONLY apply to S3 targets only | ERROR | none |
+| `pf-glue-crawler-s3-target-path` | AWS::Glue::Crawler | An S3 crawl target path cannot start with a slash | ERROR | none |
+| `pf-glue-crawler-schedule-cron-only` | AWS::Glue::Crawler | A crawler schedule is a cron() expression | ERROR | pending-engine |
+| `pf-glue-crawler-schedule-day-of-month-or-week` | AWS::Glue::Crawler | A crawler cron needs ? in exactly one of day-of-month and day-of-week | ERROR | none |
+| `pf-glue-crawler-target-connection-name` | AWS::Glue::Crawler | JDBC and MongoDB crawl targets need a connection name | ERROR | none |
+| `pf-glue-custom-entity-type-regex-string-required` | AWS::Glue::CustomEntityType | A custom entity type needs a RegexString | ERROR | pending-engine |
+| `pf-glue-data-quality-ruleset-rules` | AWS::Glue::DataQualityRuleset | A DQDL ruleset needs a non-empty Rules list | ERROR | none |
+| `pf-glue-database-resource-link-exclusive` | AWS::Glue::Database | A database resource link cannot also carry a LocationUri | ERROR | none |
+| `pf-glue-job-flex-command-name` | AWS::Glue::Job | ExecutionClass FLEX is only available for Spark ETL jobs | ERROR | none |
+| `pf-glue-job-flex-worker-type` | AWS::Glue::Job | A FLEX job runs only on G.1X or G.2X workers | ERROR | none |
+| `pf-glue-job-g025x-streaming-only` | AWS::Glue::Job | The G.025X worker type is only available for streaming jobs | ERROR | none |
+| `pf-glue-job-glue-version-eol` | AWS::Glue::Job | Glue versions 0.9, 1.0 and 2.0 are end of life and cannot be used for new jobs | ERROR | none |
+| `pf-glue-job-maintenance-window-streaming-only` | AWS::Glue::Job | MaintenanceWindow is only accepted on streaming jobs | ERROR | none |
+| `pf-glue-job-max-capacity-fractional` | AWS::Glue::Job | A Spark job cannot take a fractional DPU allocation | ERROR | none |
+| `pf-glue-job-max-capacity-with-worker-type` | AWS::Glue::Job | A job sizes with MaxCapacity or with WorkerType + NumberOfWorkers, never both | ERROR | none |
+| `pf-glue-job-number-of-workers-min` | AWS::Glue::Job | A job needs at least 2 workers | ERROR | none |
+| `pf-glue-job-pythonshell-max-capacity-values` | AWS::Glue::Job | A Python shell job can only allocate 0.0625 or 1 DPU | ERROR | none |
+| `pf-glue-job-pythonshell-worker-type` | AWS::Glue::Job | A Python shell job cannot be sized with WorkerType | ERROR | none |
+| `pf-glue-job-runtime-ray-only` | AWS::Glue::Job | Command.Runtime is only accepted on Ray jobs | ERROR | none |
+| `pf-glue-job-timeout-max` | AWS::Glue::Job | A job timeout cannot exceed 10080 minutes (7 days) | ERROR | pending-engine |
+| `pf-glue-job-worker-type-and-number-of-workers` | AWS::Glue::Job | WorkerType and NumberOfWorkers must be set together | ERROR | none |
+| `pf-glue-job-worker-type-requires-glue-4` | AWS::Glue::Job | The large and memory-optimised worker types require Glue 4.0 or later | ERROR | none |
+| `pf-glue-job-z2x-ray-only` | AWS::Glue::Job | The Z.2X worker type is only available for Ray jobs | ERROR | none |
+| `pf-glue-ml-transform-find-matches-parameters` | AWS::Glue::MLTransform | A FIND_MATCHES transform needs FindMatchesParameters | ERROR | none |
+| `pf-glue-ml-transform-glue-version-eol` | AWS::Glue::MLTransform | MLTransform Glue versions below 2.0 are past end of life | ERROR | none |
+| `pf-glue-ml-transform-max-capacity-with-worker-type` | AWS::Glue::MLTransform | MLTransform MaxCapacity cannot be combined with WorkerType | ERROR | none |
+| `pf-glue-ml-transform-worker-type-and-number-of-workers` | AWS::Glue::MLTransform | MLTransform WorkerType and NumberOfWorkers have to be set together | ERROR | none |
+| `pf-glue-partition-values-match-partition-keys` | AWS::Glue::Partition | Partition Values must be as many as the table's PartitionKeys | ERROR | none |
+| `pf-glue-schema-compatibility` | AWS::Glue::Schema | Schema Compatibility must be one of the seven documented modes | ERROR | pending-engine |
+| `pf-glue-schema-definition-format` | AWS::Glue::Schema | SchemaDefinition must parse as the declared DataFormat | ERROR | none |
+| `pf-glue-schema-name-charset` | AWS::Glue::Schema | A schema name is limited to letters, digits and - _ $ | ERROR | pending-engine |
+| `pf-glue-security-configuration-kms-key` | AWS::Glue::SecurityConfiguration | KMS encryption modes need a KmsKeyArn | ERROR | none |
+| `pf-glue-table-iceberg-metadata-operation` | AWS::Glue::Table | An Iceberg table needs MetadataOperation in IcebergInput | ERROR | pending-engine |
+| `pf-glue-trigger-action-job-or-crawler` | AWS::Glue::Trigger | A trigger action names either a job or a crawler, not both | ERROR | none |
+| `pf-glue-trigger-condition-crawl-state` | AWS::Glue::Trigger | A crawler condition can only watch SUCCEEDED, FAILED or CANCELLED | ERROR | pending-engine |
+| `pf-glue-trigger-condition-job-state` | AWS::Glue::Trigger | A job condition can only watch SUCCEEDED, STOPPED, FAILED or TIMEOUT | ERROR | pending-engine |
+| `pf-glue-trigger-conditional-requires-predicate` | AWS::Glue::Trigger | A CONDITIONAL trigger must carry a Predicate | ERROR | none |
+| `pf-glue-trigger-event-requires-workflow` | AWS::Glue::Trigger | An EVENT trigger must belong to a workflow | ERROR | none |
+| `pf-glue-trigger-ondemand-start-on-creation` | AWS::Glue::Trigger | An ON_DEMAND trigger cannot be started on creation | ERROR | none |
+| `pf-glue-trigger-predicate-job-not-action-job` | AWS::Glue::Trigger | A conditional trigger cannot watch and start the same job | ERROR | none |
+| `pf-glue-trigger-predicate-logical-required` | AWS::Glue::Trigger | A predicate with more than one condition needs Logical | ERROR | none |
+| `pf-glue-trigger-schedule-day-of-month-or-week` | AWS::Glue::Trigger | A Glue cron expression must put ? in exactly one of day-of-month and day-of-week | ERROR | none |
+| `pf-glue-trigger-scheduled-requires-schedule` | AWS::Glue::Trigger | A SCHEDULED trigger must carry a Schedule | ERROR | none |
+| `pf-glue-user-defined-function-owner-type` | AWS::Glue::UserDefinedFunction | A user-defined function needs an OwnerType of USER, ROLE or GROUP | ERROR | pending-engine |
+| `pf-glue-user-defined-function-resource-uri-type` | AWS::Glue::UserDefinedFunction | A function ResourceUri needs a ResourceType of JAR, FILE or ARCHIVE | ERROR | pending-engine |
+| `pf-glue-workflow-max-concurrent-runs-min` | AWS::Glue::Workflow | A workflow needs at least one concurrent run | ERROR | pending-engine |
 | `pf-iam-identity-policy-no-principal` | AWS::IAM::Role<br>AWS::IAM::Policy<br>AWS::IAM::ManagedPolicy | Identity policies cannot carry a Principal field | ERROR | none |
 | `pf-iam-inline-policy-size` | AWS::IAM::Policy<br>AWS::IAM::RolePolicy<br>AWS::IAM::UserPolicy<br>AWS::IAM::GroupPolicy | Inline policy documents are limited per identity (role 10240 / group 5120 / user 2048 characters) | ERROR | none |
 | `pf-iam-instance-profile-single-role` | AWS::IAM::InstanceProfile | An instance profile holds exactly one role | ERROR | none |

package/lib/index.js

@@ -17,7 +17,7 @@ const rules_generated_1 = require("./rules.generated");
  * Preflight.apply(app);
  */
 class Preflight {
-    static [JSII_RTTI_SYMBOL_1] = { fqn: "cdk-preflight.Preflight", version: "0.0.120" };
+    static [JSII_RTTI_SYMBOL_1] = { fqn: "cdk-preflight.Preflight", version: "0.0.122" };
     /**
      * Register the cdk-preflight rules on an App or Stage.
      */
@@ -38,12 +38,7 @@ class Preflight {
             (0, enforce_1.installEnforceGate)(scope);
         }
         else {
-            aws_cdk_lib_1.Validations.of(scope).addPlugins(new aws_cdk_lib_1.CloudFormationValidatePlugin({
-                regoRules: [
-                    ...rules_generated_1.BUNDLED_LIBS.map((l) => ({ name: l.name, content: l.rego })),
-                    ...selected.map((r) => ({ name: r.id, content: r.rego })),
-                ],
-            }));
+            aws_cdk_lib_1.Validations.of(scope).addPlugins((0, enforce_1.observePluginCached)(selected));
         }
     }
     /**
@@ -55,4 +50,4 @@ class Preflight {
     constructor() { }
 }
 exports.Preflight = Preflight;
-//# sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJmaWxlIjoiaW5kZXguanMiLCJzb3VyY2VSb290IjoiIiwic291cmNlcyI6WyIuLi9zcmMvaW5kZXgudHMiXSwibmFtZXMiOltdLCJtYXBwaW5ncyI6Ijs7OztBQUFBLDZDQUErRTtBQUUvRSwrQ0FBK0U7QUFDL0UsdURBQWdFO0FBa0RoRTs7Ozs7Ozs7OztHQVVHO0FBQ0gsTUFBYSxTQUFTOztJQUNwQjs7T0FFRztJQUNJLE1BQU0sQ0FBQyxLQUFLLENBQUMsS0FBaUIsRUFBRSxVQUE0QixFQUFFO1FBQ25FLElBQUksQ0FBQyxtQkFBSyxDQUFDLE9BQU8sQ0FBQyxLQUFLLENBQUMsRUFBRSxDQUFDO1lBQzFCLE1BQU0sSUFBSSxLQUFLLENBQUMsc0VBQXNFLENBQUMsQ0FBQztRQUMxRixDQUFDO1FBQ0QsTUFBTSxPQUFPLEdBQUcsT0FBTyxDQUFDLE9BQU8sSUFBSSxFQUFFLENBQUM7UUFDdEMsTUFBTSxPQUFPLEdBQUcsT0FBTyxDQUFDLE1BQU0sQ0FBQyxDQUFDLEVBQUUsRUFBRSxFQUFFLENBQUMsQ0FBQywrQkFBYSxDQUFDLElBQUksQ0FBQyxDQUFDLENBQUMsRUFBRSxFQUFFLENBQUMsQ0FBQyxDQUFDLEVBQUUsS0FBSyxFQUFFLENBQUMsQ0FBQyxDQUFDO1FBQ2hGLElBQUksT0FBTyxDQUFDLE1BQU0sR0FBRyxDQUFDLEVBQUUsQ0FBQztZQUN2QixNQUFNLElBQUksS0FBSyxDQUFDLGlEQUFpRCxPQUFPLENBQUMsSUFBSSxDQUFDLElBQUksQ0FBQyxFQUFFLENBQUMsQ0FBQztRQUN6RixDQUFDO1FBQ0QsTUFBTSxRQUFRLEdBQUcsK0JBQWE7YUFDM0IsTUFBTSxDQUFDLENBQUMsQ0FBQyxFQUFFLEVBQUUsQ0FBQyxDQUFDLE9BQU8sQ0FBQyxzQkFBc0IsSUFBSSxJQUFJLENBQUMsSUFBSSxDQUFDLENBQUMsUUFBUSxLQUFLLGdCQUFnQixDQUFDO2FBQzFGLE1BQU0sQ0FBQyxDQUFDLENBQUMsRUFBRSxFQUFFLENBQUMsQ0FBQyxPQUFPLENBQUMsUUFBUSxDQUFDLENBQUMsQ0FBQyxFQUFFLENBQUMsQ0FBQyxDQUFDO1FBRTFDLElBQUksT0FBTyxDQUFDLE9BQU8sSUFBSSxJQUFJLEVBQUUsQ0FBQztZQUM1Qix5QkFBVyxDQUFDLEVBQUUsQ0FBQyxLQUFLLENBQUMsQ0FBQyxVQUFVLENBQUMsSUFBSSxnQ0FBc0IsQ0FBQyxRQUFRLEVBQUUsT0FBTyxDQUFDLE1BQU0sSUFBSSxLQUFLLENBQUMsQ0FBQyxDQUFDO1lBQ2hHLElBQUEsNEJBQWtCLEVBQUMsS0FBSyxDQUFDLENBQUM7UUFDNUIsQ0FBQzthQUFNLENBQUM7WUFDTix5QkFBVyxDQUFDLEVBQUUsQ0FBQyxLQUFLLENBQUMsQ0FBQyxVQUFVLENBQUMsSUFBSSwwQ0FBNEIsQ0FBQztnQkFDaEUsU0FBUyxFQUFFO29CQUNULEdBQUcsOEJBQVksQ0FBQyxHQUFHLENBQUMsQ0FBQyxDQUFDLEVBQUUsRUFBRSxDQUFDLENBQUMsRUFBRSxJQUFJLEVBQUUsQ0FBQyxDQUFDLElBQUksRUFBRSxPQUFPLEVBQUUsQ0FBQyxDQUFDLElBQUksRUFBRSxDQUFDLENBQUM7b0JBQy9ELEdBQUcsUUFBUSxDQUFDLEdBQUcsQ0FBQyxDQUFDLENBQUMsRUFBRSxFQUFFLENBQUMsQ0FBQyxFQUFFLElBQUksRUFBRSxDQUFDLENBQUMsRUFBRSxFQUFFLE9BQU8sRUFBRSxDQUFDLENBQUMsSUFBSSxFQUFFLENBQUMsQ0FBQztpQkFDMUQ7YUFDRixDQUFDLENBQUMsQ0FBQztRQUNOLENBQUM7SUFDSCxDQUFDO0lBRUQ7O09BRUc7SUFDSSxNQUFNLENBQUMsT0FBTztRQUNuQixPQUFPLCtCQUFhLENBQUMsR0FBRyxDQUFDLENBQUMsQ0FBQyxFQUFFLEVBQUUsQ0FBQyxDQUFDLENBQUMsRUFBRSxDQUFDLENBQUM7SUFDeEMsQ0FBQztJQUVELGdCQUF1QixDQUFDOztBQXJDMUIsOEJBc0NDIiwic291cmNlc0NvbnRlbnQiOlsiaW1wb3J0IHsgQ2xvdWRGb3JtYXRpb25WYWxpZGF0ZVBsdWdpbiwgU3RhZ2UsIFZhbGlkYXRpb25zIH0gZnJvbSAnYXdzLWNkay1saWInO1xuaW1wb3J0IHsgSUNvbnN0cnVjdCB9IGZyb20gJ2NvbnN0cnVjdHMnO1xuaW1wb3J0IHsgaW5zdGFsbEVuZm9yY2VHYXRlLCBQcmVmbGlnaHRFbmZvcmNlUGx1Z2luIH0gZnJvbSAnLi9wcml2YXRlL2VuZm9yY2UnO1xuaW1wb3J0IHsgQlVORExFRF9MSUJTLCBCVU5ETEVEX1JVTEVTIH0gZnJvbSAnLi9ydWxlcy5nZW5lcmF0ZWQnO1xuXG4vKipcbiAqIE9wdGlvbnMgZm9yIHtAbGluayBQcmVmbGlnaHQuYXBwbHl9LlxuICovXG5leHBvcnQgaW50ZXJmYWNlIFByZWZsaWdodE9wdGlvbnMge1xuICAvKipcbiAgICogUnVsZSBpZHMgdG8gZGlzYWJsZSAoc2VlIGBQcmVmbGlnaHQucnVsZUlkcygpYCBvciBkb2NzL3J1bGVzLm1kKS5cbiAgICpcbiAgICogQGRlZmF1bHQgLSBhbGwgYnVuZGxlZCBydWxlcyBhcmUgZW5hYmxlZFxuICAgKi9cbiAgcmVhZG9ubHkgZXhjbHVkZT86IHN0cmluZ1tdO1xuXG4gIC8qKlxuICAgKiBGYWlsIHN5bnRoZXNpcyB3aGVuIGEgYnVuZGxlZCBydWxlIGlzIHZpb2xhdGVkLlxuICAgKlxuICAgKiBJbiB0aGUgZGVmYXVsdCAoZW5mb3JjZSkgbW9kZSwgY2RrLXByZWZsaWdodCBldmFsdWF0ZXMgaXRzIHJ1bGVzIHdpdGggaXRzXG4gICAqIG93biB2YWxpZGF0aW9uIHBsdWdpbiBhbmQgYSB2aW9sYXRpb24gbWFrZXMgYGNkayBzeW50aGAgZmFpbCDigJQgdGhlIHdob2xlXG4gICAqIHBvaW50IG9mIHByZWZsaWdodCBjaGVja3MgaXMgdGhhdCBhIHRlbXBsYXRlIGtub3duIHRvIGZhaWwgYXQgZGVwbG95IHRpbWVcbiAgICogbmV2ZXIgbGVhdmVzIHlvdXIgbWFjaGluZS4gU2V0IGBlbmZvcmNlOiBmYWxzZWAgdG8gb2JzZXJ2ZSBmaXJzdDogZmluZGluZ3NcbiAgICogYXJlIHRoZW4gcmVwb3J0ZWQgdGhyb3VnaCB0aGUgQ0RLIGJ1aWx0LWluIENsb3VkRm9ybWF0aW9uIHZhbGlkYXRvciBhbmRcbiAgICogc3VyZmFjZSBhcyBzeW50aCB3YXJuaW5ncyB3aXRoIGNvbnN0cnVjdCB0cmFjZXMsIHdoaWNoIGNhbiBiZSBtdXRlZCBwZXJcbiAgICogZmluZGluZyB2aWEgYEFja25vd2xlZGdlIHdpdGggJ0Nsb3VkRm9ybWF0aW9uLVZhbGlkYXRlOjo8cnVsZS1pZD4nYC5cbiAgICpcbiAgICogQGRlZmF1bHQgdHJ1ZVxuICAgKi9cbiAgcmVhZG9ubHkgZW5mb3JjZT86IGJvb2xlYW47XG5cbiAgLyoqXG4gICAqIEluIGVuZm9yY2UgbW9kZSwgYWRkaXRpb25hbGx5IGZhaWwgc3ludGhlc2lzIG9uIGVycm9yLWNsYXNzIGZpbmRpbmdzXG4gICAqIChzZXZlcml0eSBFUlJPUi9GQVRBTCkgb2YgdGhlIGJ1aWx0LWluIHZhbGlkYXRpb24gZW5naW5lIGl0c2VsZiwgZS5nLlxuICAgKiBzY2hlbWEgdmlvbGF0aW9ucyBsaWtlIGBGMzAzNGAuIFRoaXMgaXMgdGhlIHdvcmthcm91bmQgZm9yIHRoZSBDREtcbiAgICogYmVoYXZpb3Igd2hlcmUgYWxsIGJ1aWx0LWluIGZpbmRpbmdzIGFyZSBkb3duZ3JhZGVkIHRvIHdhcm5pbmdzLlxuICAgKlxuICAgKiBPbmx5IGVmZmVjdGl2ZSBpbiBlbmZvcmNlIG1vZGUgKHRoZSBkZWZhdWx0KS5cbiAgICpcbiAgICogQGRlZmF1bHQgZmFsc2VcbiAgICovXG4gIHJlYWRvbmx5IHN0cmljdD86IGJvb2xlYW47XG5cbiAgLyoqXG4gICAqIEluY2x1ZGUgcnVsZXMgdGhhdCBhcmUgbWFya2VkIGBwZW5kaW5nLWVuZ2luZWAgKGNhbmRpZGF0ZXMgdGhhdCBoYXZlIGJlZW5cbiAgICogcHJvcG9zZWQgdG8gdGhlIHVwc3RyZWFtIGNsb3VkZm9ybWF0aW9uLXZhbGlkYXRlIGVuZ2luZSBidXQgYXJlIG5vdCBtZXJnZWRcbiAgICogeWV0KS4gRGlzYWJsZSB0aGlzIGlmIHlvdSBydW4gYSBuZXdlciBlbmdpbmUgdGhhdCBhbHJlYWR5IGNvdmVycyB0aGVtLlxuICAgKlxuICAgKiBAZGVmYXVsdCB0cnVlXG4gICAqL1xuICByZWFkb25seSBpbmNsdWRlVXBzdHJlYW1QZW5kaW5nPzogYm9vbGVhbjtcbn1cblxuLyoqXG4gKiBjZGstcHJlZmxpZ2h0OiBjYXRjaCBkZXBsb3ktdGltZSBDbG91ZEZvcm1hdGlvbiBmYWlsdXJlcyBhdCBzeW50aCB0aW1lLlxuICpcbiAqIEluamVjdHMgYSBjdXJhdGVkIFJlZ28gcnVsZSBwYWNrIChjb25zdHJhaW50cyB0aGF0IHJlc291cmNlIHByb3ZpZGVyIHNjaGVtYXNcbiAqIGRvIG5vdCBleHByZXNzOiBkb2Mtb25seSB2YWx1ZSBsaW1pdHMsIGNyb3NzLXByb3BlcnR5IGFuZCBjcm9zcy1yZXNvdXJjZVxuICogcnVsZXMpIGludG8gdGhlIEFXUyBDREsgYnVpbHQtaW4gQ2xvdWRGb3JtYXRpb24gdmFsaWRhdG9yLlxuICpcbiAqIEBleGFtcGxlXG4gKiBkZWNsYXJlIGNvbnN0IGFwcDogQXBwO1xuICogUHJlZmxpZ2h0LmFwcGx5KGFwcCk7XG4gKi9cbmV4cG9ydCBjbGFzcyBQcmVmbGlnaHQge1xuICAvKipcbiAgICogUmVnaXN0ZXIgdGhlIGNkay1wcmVmbGlnaHQgcnVsZXMgb24gYW4gQXBwIG9yIFN0YWdlLlxuICAgKi9cbiAgcHVibGljIHN0YXRpYyBhcHBseShzY29wZTogSUNvbnN0cnVjdCwgb3B0aW9uczogUHJlZmxpZ2h0T3B0aW9ucyA9IHt9KTogdm9pZCB7XG4gICAgaWYgKCFTdGFnZS5pc1N0YWdlKHNjb3BlKSkge1xuICAgICAgdGhyb3cgbmV3IEVycm9yKCdjZGstcHJlZmxpZ2h0OiBQcmVmbGlnaHQuYXBwbHkoKSBtdXN0IGJlIGNhbGxlZCBvbiBhbiBBcHAgb3IgYSBTdGFnZScpO1xuICAgIH1cbiAgICBjb25zdCBleGNsdWRlID0gb3B0aW9ucy5leGNsdWRlID8/IFtdO1xuICAgIGNvbnN0IHVua25vd24gPSBleGNsdWRlLmZpbHRlcigoaWQpID0+ICFCVU5ETEVEX1JVTEVTLnNvbWUoKHIpID0+IHIuaWQgPT09IGlkKSk7XG4gICAgaWYgKHVua25vd24ubGVuZ3RoID4gMCkge1xuICAgICAgdGhyb3cgbmV3IEVycm9yKGBjZGstcHJlZmxpZ2h0OiB1bmtub3duIHJ1bGUgaWQocykgaW4gZXhjbHVkZTogJHt1bmtub3duLmpvaW4oJywgJyl9YCk7XG4gICAgfVxuICAgIGNvbnN0IHNlbGVjdGVkID0gQlVORExFRF9SVUxFU1xuICAgICAgLmZpbHRlcigocikgPT4gKG9wdGlvbnMuaW5jbHVkZVVwc3RyZWFtUGVuZGluZyA/PyB0cnVlKSB8fCByLnVwc3RyZWFtICE9PSAncGVuZGluZy1lbmdpbmUnKVxuICAgICAgLmZpbHRlcigocikgPT4gIWV4Y2x1ZGUuaW5jbHVkZXMoci5pZCkpO1xuXG4gICAgaWYgKG9wdGlvbnMuZW5mb3JjZSA/PyB0cnVlKSB7XG4gICAgICBWYWxpZGF0aW9ucy5vZihzY29wZSkuYWRkUGx1Z2lucyhuZXcgUHJlZmxpZ2h0RW5mb3JjZVBsdWdpbihzZWxlY3RlZCwgb3B0aW9ucy5zdHJpY3QgPz8gZmFsc2UpKTtcbiAgICAgIGluc3RhbGxFbmZvcmNlR2F0ZShzY29wZSk7XG4gICAgfSBlbHNlIHtcbiAgICAgIFZhbGlkYXRpb25zLm9mKHNjb3BlKS5hZGRQbHVnaW5zKG5ldyBDbG91ZEZvcm1hdGlvblZhbGlkYXRlUGx1Z2luKHtcbiAgICAgICAgcmVnb1J1bGVzOiBbXG4gICAgICAgICAgLi4uQlVORExFRF9MSUJTLm1hcCgobCkgPT4gKHsgbmFtZTogbC5uYW1lLCBjb250ZW50OiBsLnJlZ28gfSkpLFxuICAgICAgICAgIC4uLnNlbGVjdGVkLm1hcCgocikgPT4gKHsgbmFtZTogci5pZCwgY29udGVudDogci5yZWdvIH0pKSxcbiAgICAgICAgXSxcbiAgICAgIH0pKTtcbiAgICB9XG4gIH1cblxuICAvKipcbiAgICogVGhlIGlkcyBvZiBhbGwgYnVuZGxlZCBydWxlcy5cbiAgICovXG4gIHB1YmxpYyBzdGF0aWMgcnVsZUlkcygpOiBzdHJpbmdbXSB7XG4gICAgcmV0dXJuIEJVTkRMRURfUlVMRVMubWFwKChyKSA9PiByLmlkKTtcbiAgfVxuXG4gIHByaXZhdGUgY29uc3RydWN0b3IoKSB7fVxufVxuIl19
+//# sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJmaWxlIjoiaW5kZXguanMiLCJzb3VyY2VSb290IjoiIiwic291cmNlcyI6WyIuLi9zcmMvaW5kZXgudHMiXSwibmFtZXMiOltdLCJtYXBwaW5ncyI6Ijs7OztBQUFBLDZDQUFpRDtBQUVqRCwrQ0FBb0c7QUFDcEcsdURBQWtEO0FBa0RsRDs7Ozs7Ozs7OztHQVVHO0FBQ0gsTUFBYSxTQUFTOztJQUNwQjs7T0FFRztJQUNJLE1BQU0sQ0FBQyxLQUFLLENBQUMsS0FBaUIsRUFBRSxVQUE0QixFQUFFO1FBQ25FLElBQUksQ0FBQyxtQkFBSyxDQUFDLE9BQU8sQ0FBQyxLQUFLLENBQUMsRUFBRSxDQUFDO1lBQzFCLE1BQU0sSUFBSSxLQUFLLENBQUMsc0VBQXNFLENBQUMsQ0FBQztRQUMxRixDQUFDO1FBQ0QsTUFBTSxPQUFPLEdBQUcsT0FBTyxDQUFDLE9BQU8sSUFBSSxFQUFFLENBQUM7UUFDdEMsTUFBTSxPQUFPLEdBQUcsT0FBTyxDQUFDLE1BQU0sQ0FBQyxDQUFDLEVBQUUsRUFBRSxFQUFFLENBQUMsQ0FBQywrQkFBYSxDQUFDLElBQUksQ0FBQyxDQUFDLENBQUMsRUFBRSxFQUFFLENBQUMsQ0FBQyxDQUFDLEVBQUUsS0FBSyxFQUFFLENBQUMsQ0FBQyxDQUFDO1FBQ2hGLElBQUksT0FBTyxDQUFDLE1BQU0sR0FBRyxDQUFDLEVBQUUsQ0FBQztZQUN2QixNQUFNLElBQUksS0FBSyxDQUFDLGlEQUFpRCxPQUFPLENBQUMsSUFBSSxDQUFDLElBQUksQ0FBQyxFQUFFLENBQUMsQ0FBQztRQUN6RixDQUFDO1FBQ0QsTUFBTSxRQUFRLEdBQUcsK0JBQWE7YUFDM0IsTUFBTSxDQUFDLENBQUMsQ0FBQyxFQUFFLEVBQUUsQ0FBQyxDQUFDLE9BQU8sQ0FBQyxzQkFBc0IsSUFBSSxJQUFJLENBQUMsSUFBSSxDQUFDLENBQUMsUUFBUSxLQUFLLGdCQUFnQixDQUFDO2FBQzFGLE1BQU0sQ0FBQyxDQUFDLENBQUMsRUFBRSxFQUFFLENBQUMsQ0FBQyxPQUFPLENBQUMsUUFBUSxDQUFDLENBQUMsQ0FBQyxFQUFFLENBQUMsQ0FBQyxDQUFDO1FBRTFDLElBQUksT0FBTyxDQUFDLE9BQU8sSUFBSSxJQUFJLEVBQUUsQ0FBQztZQUM1Qix5QkFBVyxDQUFDLEVBQUUsQ0FBQyxLQUFLLENBQUMsQ0FBQyxVQUFVLENBQUMsSUFBSSxnQ0FBc0IsQ0FBQyxRQUFRLEVBQUUsT0FBTyxDQUFDLE1BQU0sSUFBSSxLQUFLLENBQUMsQ0FBQyxDQUFDO1lBQ2hHLElBQUEsNEJBQWtCLEVBQUMsS0FBSyxDQUFDLENBQUM7UUFDNUIsQ0FBQzthQUFNLENBQUM7WUFDTix5QkFBVyxDQUFDLEVBQUUsQ0FBQyxLQUFLLENBQUMsQ0FBQyxVQUFVLENBQUMsSUFBQSw2QkFBbUIsRUFBQyxRQUFRLENBQUMsQ0FBQyxDQUFDO1FBQ2xFLENBQUM7SUFDSCxDQUFDO0lBRUQ7O09BRUc7SUFDSSxNQUFNLENBQUMsT0FBTztRQUNuQixPQUFPLCtCQUFhLENBQUMsR0FBRyxDQUFDLENBQUMsQ0FBQyxFQUFFLEVBQUUsQ0FBQyxDQUFDLENBQUMsRUFBRSxDQUFDLENBQUM7SUFDeEMsQ0FBQztJQUVELGdCQUF1QixDQUFDOztBQWhDMUIsOEJBaUNDIiwic291cmNlc0NvbnRlbnQiOlsiaW1wb3J0IHsgU3RhZ2UsIFZhbGlkYXRpb25zIH0gZnJvbSAnYXdzLWNkay1saWInO1xuaW1wb3J0IHsgSUNvbnN0cnVjdCB9IGZyb20gJ2NvbnN0cnVjdHMnO1xuaW1wb3J0IHsgaW5zdGFsbEVuZm9yY2VHYXRlLCBvYnNlcnZlUGx1Z2luQ2FjaGVkLCBQcmVmbGlnaHRFbmZvcmNlUGx1Z2luIH0gZnJvbSAnLi9wcml2YXRlL2VuZm9yY2UnO1xuaW1wb3J0IHsgQlVORExFRF9SVUxFUyB9IGZyb20gJy4vcnVsZXMuZ2VuZXJhdGVkJztcblxuLyoqXG4gKiBPcHRpb25zIGZvciB7QGxpbmsgUHJlZmxpZ2h0LmFwcGx5fS5cbiAqL1xuZXhwb3J0IGludGVyZmFjZSBQcmVmbGlnaHRPcHRpb25zIHtcbiAgLyoqXG4gICAqIFJ1bGUgaWRzIHRvIGRpc2FibGUgKHNlZSBgUHJlZmxpZ2h0LnJ1bGVJZHMoKWAgb3IgZG9jcy9ydWxlcy5tZCkuXG4gICAqXG4gICAqIEBkZWZhdWx0IC0gYWxsIGJ1bmRsZWQgcnVsZXMgYXJlIGVuYWJsZWRcbiAgICovXG4gIHJlYWRvbmx5IGV4Y2x1ZGU/OiBzdHJpbmdbXTtcblxuICAvKipcbiAgICogRmFpbCBzeW50aGVzaXMgd2hlbiBhIGJ1bmRsZWQgcnVsZSBpcyB2aW9sYXRlZC5cbiAgICpcbiAgICogSW4gdGhlIGRlZmF1bHQgKGVuZm9yY2UpIG1vZGUsIGNkay1wcmVmbGlnaHQgZXZhbHVhdGVzIGl0cyBydWxlcyB3aXRoIGl0c1xuICAgKiBvd24gdmFsaWRhdGlvbiBwbHVnaW4gYW5kIGEgdmlvbGF0aW9uIG1ha2VzIGBjZGsgc3ludGhgIGZhaWwg4oCUIHRoZSB3aG9sZVxuICAgKiBwb2ludCBvZiBwcmVmbGlnaHQgY2hlY2tzIGlzIHRoYXQgYSB0ZW1wbGF0ZSBrbm93biB0byBmYWlsIGF0IGRlcGxveSB0aW1lXG4gICAqIG5ldmVyIGxlYXZlcyB5b3VyIG1hY2hpbmUuIFNldCBgZW5mb3JjZTogZmFsc2VgIHRvIG9ic2VydmUgZmlyc3Q6IGZpbmRpbmdzXG4gICAqIGFyZSB0aGVuIHJlcG9ydGVkIHRocm91Z2ggdGhlIENESyBidWlsdC1pbiBDbG91ZEZvcm1hdGlvbiB2YWxpZGF0b3IgYW5kXG4gICAqIHN1cmZhY2UgYXMgc3ludGggd2FybmluZ3Mgd2l0aCBjb25zdHJ1Y3QgdHJhY2VzLCB3aGljaCBjYW4gYmUgbXV0ZWQgcGVyXG4gICAqIGZpbmRpbmcgdmlhIGBBY2tub3dsZWRnZSB3aXRoICdDbG91ZEZvcm1hdGlvbi1WYWxpZGF0ZTo6PHJ1bGUtaWQ+J2AuXG4gICAqXG4gICAqIEBkZWZhdWx0IHRydWVcbiAgICovXG4gIHJlYWRvbmx5IGVuZm9yY2U/OiBib29sZWFuO1xuXG4gIC8qKlxuICAgKiBJbiBlbmZvcmNlIG1vZGUsIGFkZGl0aW9uYWxseSBmYWlsIHN5bnRoZXNpcyBvbiBlcnJvci1jbGFzcyBmaW5kaW5nc1xuICAgKiAoc2V2ZXJpdHkgRVJST1IvRkFUQUwpIG9mIHRoZSBidWlsdC1pbiB2YWxpZGF0aW9uIGVuZ2luZSBpdHNlbGYsIGUuZy5cbiAgICogc2NoZW1hIHZpb2xhdGlvbnMgbGlrZSBgRjMwMzRgLiBUaGlzIGlzIHRoZSB3b3JrYXJvdW5kIGZvciB0aGUgQ0RLXG4gICAqIGJlaGF2aW9yIHdoZXJlIGFsbCBidWlsdC1pbiBmaW5kaW5ncyBhcmUgZG93bmdyYWRlZCB0byB3YXJuaW5ncy5cbiAgICpcbiAgICogT25seSBlZmZlY3RpdmUgaW4gZW5mb3JjZSBtb2RlICh0aGUgZGVmYXVsdCkuXG4gICAqXG4gICAqIEBkZWZhdWx0IGZhbHNlXG4gICAqL1xuICByZWFkb25seSBzdHJpY3Q/OiBib29sZWFuO1xuXG4gIC8qKlxuICAgKiBJbmNsdWRlIHJ1bGVzIHRoYXQgYXJlIG1hcmtlZCBgcGVuZGluZy1lbmdpbmVgIChjYW5kaWRhdGVzIHRoYXQgaGF2ZSBiZWVuXG4gICAqIHByb3Bvc2VkIHRvIHRoZSB1cHN0cmVhbSBjbG91ZGZvcm1hdGlvbi12YWxpZGF0ZSBlbmdpbmUgYnV0IGFyZSBub3QgbWVyZ2VkXG4gICAqIHlldCkuIERpc2FibGUgdGhpcyBpZiB5b3UgcnVuIGEgbmV3ZXIgZW5naW5lIHRoYXQgYWxyZWFkeSBjb3ZlcnMgdGhlbS5cbiAgICpcbiAgICogQGRlZmF1bHQgdHJ1ZVxuICAgKi9cbiAgcmVhZG9ubHkgaW5jbHVkZVVwc3RyZWFtUGVuZGluZz86IGJvb2xlYW47XG59XG5cbi8qKlxuICogY2RrLXByZWZsaWdodDogY2F0Y2ggZGVwbG95LXRpbWUgQ2xvdWRGb3JtYXRpb24gZmFpbHVyZXMgYXQgc3ludGggdGltZS5cbiAqXG4gKiBJbmplY3RzIGEgY3VyYXRlZCBSZWdvIHJ1bGUgcGFjayAoY29uc3RyYWludHMgdGhhdCByZXNvdXJjZSBwcm92aWRlciBzY2hlbWFzXG4gKiBkbyBub3QgZXhwcmVzczogZG9jLW9ubHkgdmFsdWUgbGltaXRzLCBjcm9zcy1wcm9wZXJ0eSBhbmQgY3Jvc3MtcmVzb3VyY2VcbiAqIHJ1bGVzKSBpbnRvIHRoZSBBV1MgQ0RLIGJ1aWx0LWluIENsb3VkRm9ybWF0aW9uIHZhbGlkYXRvci5cbiAqXG4gKiBAZXhhbXBsZVxuICogZGVjbGFyZSBjb25zdCBhcHA6IEFwcDtcbiAqIFByZWZsaWdodC5hcHBseShhcHApO1xuICovXG5leHBvcnQgY2xhc3MgUHJlZmxpZ2h0IHtcbiAgLyoqXG4gICAqIFJlZ2lzdGVyIHRoZSBjZGstcHJlZmxpZ2h0IHJ1bGVzIG9uIGFuIEFwcCBvciBTdGFnZS5cbiAgICovXG4gIHB1YmxpYyBzdGF0aWMgYXBwbHkoc2NvcGU6IElDb25zdHJ1Y3QsIG9wdGlvbnM6IFByZWZsaWdodE9wdGlvbnMgPSB7fSk6IHZvaWQge1xuICAgIGlmICghU3RhZ2UuaXNTdGFnZShzY29wZSkpIHtcbiAgICAgIHRocm93IG5ldyBFcnJvcignY2RrLXByZWZsaWdodDogUHJlZmxpZ2h0LmFwcGx5KCkgbXVzdCBiZSBjYWxsZWQgb24gYW4gQXBwIG9yIGEgU3RhZ2UnKTtcbiAgICB9XG4gICAgY29uc3QgZXhjbHVkZSA9IG9wdGlvbnMuZXhjbHVkZSA/PyBbXTtcbiAgICBjb25zdCB1bmtub3duID0gZXhjbHVkZS5maWx0ZXIoKGlkKSA9PiAhQlVORExFRF9SVUxFUy5zb21lKChyKSA9PiByLmlkID09PSBpZCkpO1xuICAgIGlmICh1bmtub3duLmxlbmd0aCA+IDApIHtcbiAgICAgIHRocm93IG5ldyBFcnJvcihgY2RrLXByZWZsaWdodDogdW5rbm93biBydWxlIGlkKHMpIGluIGV4Y2x1ZGU6ICR7dW5rbm93bi5qb2luKCcsICcpfWApO1xuICAgIH1cbiAgICBjb25zdCBzZWxlY3RlZCA9IEJVTkRMRURfUlVMRVNcbiAgICAgIC5maWx0ZXIoKHIpID0+IChvcHRpb25zLmluY2x1ZGVVcHN0cmVhbVBlbmRpbmcgPz8gdHJ1ZSkgfHwgci51cHN0cmVhbSAhPT0gJ3BlbmRpbmctZW5naW5lJylcbiAgICAgIC5maWx0ZXIoKHIpID0+ICFleGNsdWRlLmluY2x1ZGVzKHIuaWQpKTtcblxuICAgIGlmIChvcHRpb25zLmVuZm9yY2UgPz8gdHJ1ZSkge1xuICAgICAgVmFsaWRhdGlvbnMub2Yoc2NvcGUpLmFkZFBsdWdpbnMobmV3IFByZWZsaWdodEVuZm9yY2VQbHVnaW4oc2VsZWN0ZWQsIG9wdGlvbnMuc3RyaWN0ID8/IGZhbHNlKSk7XG4gICAgICBpbnN0YWxsRW5mb3JjZUdhdGUoc2NvcGUpO1xuICAgIH0gZWxzZSB7XG4gICAgICBWYWxpZGF0aW9ucy5vZihzY29wZSkuYWRkUGx1Z2lucyhvYnNlcnZlUGx1Z2luQ2FjaGVkKHNlbGVjdGVkKSk7XG4gICAgfVxuICB9XG5cbiAgLyoqXG4gICAqIFRoZSBpZHMgb2YgYWxsIGJ1bmRsZWQgcnVsZXMuXG4gICAqL1xuICBwdWJsaWMgc3RhdGljIHJ1bGVJZHMoKTogc3RyaW5nW10ge1xuICAgIHJldHVybiBCVU5ETEVEX1JVTEVTLm1hcCgocikgPT4gci5pZCk7XG4gIH1cblxuICBwcml2YXRlIGNvbnN0cnVjdG9yKCkge31cbn1cbiJdfQ==

package/lib/private/enforce.d.ts

@@ -1,4 +1,4 @@
-import { type IPolicyValidationContext, type IPolicyValidationPlugin, type PolicyValidationPluginReport } from 'aws-cdk-lib';
+import { CloudFormationValidatePlugin, type IPolicyValidationContext, type IPolicyValidationPlugin, type PolicyValidationPluginReport } from 'aws-cdk-lib';
 import type { IConstruct } from 'constructs';
 import { type BundledRuleData } from '../rules.generated';
 /**
@@ -72,6 +72,7 @@ export declare function installEnforceGate(scope: IConstruct): void;
 export declare function fallbackFormat(pluginReports: any[]): string;
 /** （テストからも利用するため export している） */
 export declare function loadFormatter(): any | undefined;
+export declare function observePluginCached(rules: BundledRuleData[]): CloudFormationValidatePlugin;
 /**
  * ルールを service ごとに 1 モジュールへまとめる。
  *