npm - cdk-preflight - Versions diffs - 0.0.134 → 0.0.136 - Mend

cdk-preflight 0.0.134 → 0.0.136

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.

Files changed (8) hide show

package/.jsii CHANGED Viewed

@@ -9445,7 +9445,7 @@
       "kind": "class",
       "locationInModule": {
         "filename": "src/index.ts",
-        "line": 65
+        "line": 71
       },
       "methods": [
         {
@@ -9455,7 +9455,7 @@
           },
           "locationInModule": {
             "filename": "src/index.ts",
-            "line": 69
+            "line": 75
           },
           "name": "apply",
           "parameters": [
@@ -9482,7 +9482,7 @@
           },
           "locationInModule": {
             "filename": "src/index.ts",
-            "line": 93
+            "line": 99
           },
           "name": "ruleIds",
           "returns": {
@@ -9562,14 +9562,14 @@
           "abstract": true,
           "docs": {
             "default": "true",
-            "remarks": "Disable this if you run a newer engine that already covers them.",
+            "remarks": "Disable this if you run a newer engine that already covers them.\n\nRules marked `cfn-schema` are unaffected by this switch. CloudFormation's\nown registry schema does reject those templates, but only with a\nstack-level \"Validation failed with 1 error(s)\" that names no property, so\nthey keep earning their place at synth time and no engine release retires\nthem.",
             "stability": "stable",
             "summary": "Include rules that are marked `pending-engine` (candidates that have been proposed to the upstream cloudformation-validate engine but are not merged yet)."
           },
           "immutable": true,
           "locationInModule": {
             "filename": "src/index.ts",
-            "line": 51
+            "line": 57
           },
           "name": "includeUpstreamPending",
           "optional": true,
@@ -9600,6 +9600,6 @@
       "symbolId": "src/index:PreflightOptions"
     }
   },
-  "version": "0.0.134",
-  "fingerprint": "pAxrVkGHKZrj+c4vLAwzad5Dnt7MVMBAgHWM5gOkslw="
+  "version": "0.0.136",
+  "fingerprint": "BQeN5QxPNjYt656afljgU4sY1rd2tX/o+uSP/sIw5Eg="
 }

package/AGENTS.md CHANGED Viewed

@@ -34,10 +34,10 @@ Five other validation layers sit around a CDK app. Exactly one of them is a boun
 | CDK L1 generated validators (`CfnXxx`) | synth, every CDK app | type and required-property checks only — never value ranges, patterns, or cross-field rules | **No practical overlap**: pack rules are value / cross-field constraints by construction |
 | Bundled engine default rules (`@aws/cloudformation-validate`: SCHEMA / CFN_LINT / ENGINE) | synth, via this plugin | patched registry-schema ranges/patterns/enums + cfn-lint rules | **The hard boundary** (principle 1) **and the only retirement trigger**. If the bare engine reports ERROR/FATAL on the minimal violating template, the rule must not exist — enforced by the jest duplication guard, which turns red by itself when the engine catches up |
 | cfn-lint (external CLI) | outside the synth path (a separate CI step, if the user runs one) | near-parity with the bundled engine | **Not a boundary** — never disqualifies a rule. A check cfn-lint has but the engine lacks is an upstream-PR candidate *for the engine* (project policy: contribute to cloudformation-validate, not to cfn-lint) |
-| CloudFormation server-side pre-deploy validation | CreateStack / UpdateStack / CreateChangeSet, before resources are touched | property syntax against RAW registry schemas for non-excluded types; resource name conflicts | **Almost no overlap** with this pack's domain: ~420 resource types are excluded (IAM, EC2 SG, ECS, RDS, SFN, …) and raw schemas carry none of the doc-only limits — 0/16 real-world cases detected (measured 2026-09, cdk-validation-gap-research). Not something to *look* for, but when it does fire it is a **retirement trigger** like the engine: a single-property range that the bundled schema misses can still be enforced here (`AWS::Kinesis::Stream.RetentionPeriodHours` < 24 fails as a stack-level `Validation failed with 1 error(s)`, measured 2026-09-06 — that candidate was dropped) |
+| CloudFormation server-side pre-deploy validation | CreateStack / UpdateStack / CreateChangeSet, before resources are touched | property syntax against RAW registry schemas for non-excluded types; resource name conflicts | **Almost no overlap** with this pack's domain: ~420 resource types are excluded (IAM, EC2 SG, ECS, RDS, SFN, …) and raw schemas carry none of the doc-only limits — 0/16 real-world cases detected (measured 2026-09, cdk-validation-gap-research). **Not a retirement trigger** — this is the one place where a layer that *blocks the deploy* still does not make a rule redundant, because what it returns is not equivalent. A raw-schema violation comes back as a stack-level `Validation failed with 1 error(s). Call DescribeEvents to retrieve the full list of issues…`, which **names no property**: the developer has to make a second API call to find out what was wrong. A rule here fails `cdk synth` instead, before any AWS call, naming the property path. Audited 2026-09-17: 36 shipped rules sit in this band and 30+ of their `repro.evidence` lines record that sentence verbatim. They carry `upstream: cfn-schema` |
 | CloudFormation + service APIs | deploy (CREATE/UPDATE) | everything else: cross-field rules, service-side business rules, quotas | **The target, not a duplicate to avoid.** A rule exists *iff* it front-runs a real deploy-time failure here; `meta.yaml#repro` (real-deploy gate) proves that equivalence |
-Selection algorithm for a new rule, in order: (1) duplication guard — run the minimal violating template through the bare engine; any built-in ERROR/FATAL kills the candidate. A **WARN-class-only** engine finding (`W…`) does *not* kill it but marks a gray zone: the engine knows about the constraint and under-classifies it, so nothing blocks the deploy (`strict` promotes only ERROR/FATAL) — prefer filing an upstream severity issue, and if a stopgap rule ships anyway, mark it `upstream: pending-engine` so it retires with the upstream fix. (2) real-deploy gate — the fail template must actually fail CREATE with the predicted service error; a fail template that deploys kills the candidate (it happened: the "30-day minimum before STANDARD_IA" and the "4096-char ZipFile" constraints are documented but not enforced, so those rules were dropped). There is no third gate: L1/L2 coverage, marginal value, and how exotic the mistake looks never disqualify a candidate.
+Selection algorithm for a new rule, in order: (1) duplication guard — run the minimal violating template through the bare engine; any built-in ERROR/FATAL kills the candidate. A **WARN-class-only** engine finding (`W…`) does *not* kill it but marks a gray zone: the engine knows about the constraint and under-classifies it, so nothing blocks the deploy (`strict` promotes only ERROR/FATAL) — prefer filing an upstream severity issue, and if a stopgap rule ships anyway, mark it `upstream: pending-engine` so it retires with the upstream fix. **A second gray zone looks similar and is not the same one**: CloudFormation's raw registry schema carries the constraint, so the deploy stops at `CreateStack` with `Validation failed with 1 error(s)` and no property name, while the bundled engine is silent. Those rules are marked `upstream: cfn-schema` — they do not retire with an engine fix, because the engine never knew. The two were conflated under `pending-engine` until the 2026-09-17 audit split them (20 `W3030` / 16 `cfn-schema`); read the evidence, not the failure string, to tell them apart. `includeUpstreamPending: false` drops only the `pending-engine` half. (2) real-deploy gate — the fail template must actually fail CREATE with the predicted service error; a fail template that deploys kills the candidate (it happened: the "30-day minimum before STANDARD_IA" and the "4096-char ZipFile" constraints are documented but not enforced, so those rules were dropped). There is no third gate: L1/L2 coverage, marginal value, and how exotic the mistake looks never disqualify a candidate.
 **A doc sentence is a hypothesis, not evidence.** The CloudFront survey (2026-09-02) put nine documented constraints through the gate and three of them deployed clean: `DefaultRootObject` "can't begin with a forward slash", `GeoRestriction.Locations` marked "Required: Conditional", and "a `CacheBehavior` must include either a `CachePolicyId` or `ForwardedValues`". All three are unambiguous prose in the CloudFormation reference; the API accepts all three. Shipping on the strength of the docs alone would have produced a third of that batch as false positives — synth failures on templates that deploy. Treat `doc-only` as reserved for constraints whose repro needs resources we cannot cheaply create (a validated ACM certificate, an owned domain), never as a shortcut for a constraint that simply has not been tried. When a repro comes back failing for a *different* reason than predicted — a foreign-account ARN, a CNAME rejected for ownership — that is not evidence either; rebuild the template until the service error names the constraint, or record the confound in `evidence`.
@@ -70,7 +70,7 @@ The two failure modes are watched separately: **staleness** (the constraint disa
 **Adding.** Two gates, both mechanical, and nothing else can reject a candidate: the duplication guard (`test/rules.shard*.test.ts`) and the real-deploy gate (`bench/verify-rule.sh`). The real-deploy gate is the one thing that did *not* get looser with the widened scope, and deliberately so — `enforce` is the default mode, so a false positive is a hard synth failure in someone's CI. The CloudFront survey is the standing evidence: 3 of 9 documented constraints deployed clean (see "A doc sentence is a hypothesis" above). Volume comes from running the bench over more services, never from lowering that bar.
-**Retiring.** The trigger is the bundled engine (or CloudFormation's server-side validation) starting to block the constraint — never an L2 construct, never cfn-lint. You do not have to watch for it; two mechanisms report it:
+**Retiring.** The trigger is the bundled engine starting to block the constraint — never CloudFormation's server-side validation (see the layer table: it blocks the deploy but names no property), never an L2 construct, never cfn-lint. You do not have to watch for it; two mechanisms report it:
 - The jest duplication guard turns red on its own the first time an `aws-cdk-lib` bump brings an engine that reports ERROR/FATAL on a rule's fail template, and its failure message names the rule to delete.
 - `npx projen redundancy-scan` lists every such rule at once (no AWS account, no cost — it just re-runs each fail template through the bare engine). The monthly `monthly-verify` workflow runs it and files the results under a **REDUNDANT** heading in the same issue that reports drift, so obsolescence and staleness arrive on one page.

package/API.md CHANGED Viewed

@@ -73,6 +73,12 @@ Include rules that are marked `pending-engine` (candidates that have been propos
 Disable this if you run a newer engine that already covers them.
+Rules marked `cfn-schema` are unaffected by this switch. CloudFormation's
+own registry schema does reject those templates, but only with a
+stack-level "Validation failed with 1 error(s)" that names no property, so
+they keep earning their place at synth time and no engine release retires
+them.
 ---
 ##### `strict`<sup>Optional</sup> <a name="strict" id="cdk-preflight.PreflightOptions.property.strict"></a>

package/docs/rules.md CHANGED Viewed

@@ -147,7 +147,7 @@
 | `pf-appsync-ds-http-requires-config` | AWS::AppSync::DataSource | A HTTP data source needs HttpConfig | ERROR | none |
 | `pf-appsync-ds-lambda-requires-config` | AWS::AppSync::DataSource | A AWS_LAMBDA data source needs LambdaConfig | ERROR | none |
 | `pf-appsync-ds-lambda-requires-service-role` | AWS::AppSync::DataSource | A data source that reaches another service needs ServiceRoleArn | ERROR | none |
-| `pf-appsync-ds-metrics-config-value` | AWS::AppSync::DataSource | MetricsConfig takes ENABLED / DISABLED | ERROR | pending-engine |
+| `pf-appsync-ds-metrics-config-value` | AWS::AppSync::DataSource | MetricsConfig takes ENABLED / DISABLED | ERROR | cfn-schema |
 | `pf-appsync-ds-none-forbids-config` | AWS::AppSync::DataSource | A NONE data source takes no configuration block | ERROR | none |
 | `pf-appsync-ds-opensearch-requires-config` | AWS::AppSync::DataSource | A AMAZON_OPENSEARCH_SERVICE data source needs OpenSearchServiceConfig | ERROR | none |
 | `pf-appsync-ds-rds-requires-config` | AWS::AppSync::DataSource | A RELATIONAL_DATABASE data source needs RelationalDatabaseConfig | ERROR | none |
@@ -184,7 +184,7 @@
 | `pf-appsync-res-field-in-schema` | AWS::AppSync::Resolver | FieldName must exist on the type | ERROR | none |
 | `pf-appsync-res-kind-value` | AWS::AppSync::Resolver | Kind takes UNIT / PIPELINE | ERROR | pending-engine |
 | `pf-appsync-res-max-batch-size-requires-lambda-ds` | AWS::AppSync::Resolver | MaxBatchSize only applies to a Lambda data source | ERROR | none |
-| `pf-appsync-res-metrics-config-value` | AWS::AppSync::Resolver | MetricsConfig takes ENABLED / DISABLED | ERROR | pending-engine |
+| `pf-appsync-res-metrics-config-value` | AWS::AppSync::Resolver | MetricsConfig takes ENABLED / DISABLED | ERROR | cfn-schema |
 | `pf-appsync-res-pipeline-forbids-data-source` | AWS::AppSync::Resolver | A PIPELINE resolver takes no DataSourceName | ERROR | none |
 | `pf-appsync-res-pipeline-functions-max` | AWS::AppSync::Resolver | A pipeline runs at most 10 functions | ERROR | none |
 | `pf-appsync-res-pipeline-requires-functions` | AWS::AppSync::Resolver | A PIPELINE resolver needs PipelineConfig.Functions | ERROR | none |
@@ -208,7 +208,7 @@
 | `pf-appsync-schema-root-type-missing` | AWS::AppSync::GraphQLSchema | The schema block may only name declared types | ERROR | none |
 | `pf-appsync-schema-undefined-type-reference` | AWS::AppSync::GraphQLSchema | Every field type must be declared in the schema | ERROR | none |
 | `pf-appsync-schema-unknown-scalar` | AWS::AppSync::GraphQLSchema | Only AppSync's own AWS scalars exist | ERROR | none |
-| `pf-appsync-source-api-merge-type-value` | AWS::AppSync::SourceApiAssociation | MergeType is AUTO_MERGE or MANUAL_MERGE | ERROR | pending-engine |
+| `pf-appsync-source-api-merge-type-value` | AWS::AppSync::SourceApiAssociation | MergeType is AUTO_MERGE or MANUAL_MERGE | ERROR | cfn-schema |
 | `pf-appsync-source-api-merged-not-source` | AWS::AppSync::SourceApiAssociation | A merged API cannot be a source API | ERROR | none |
 | `pf-appsync-source-api-not-merged-target` | AWS::AppSync::SourceApiAssociation | The association target must be a MERGED API | ERROR | none |
 | `pf-athena-dc-glue-requires-catalog-id` | AWS::Athena::DataCatalog | A GLUE data catalog requires the catalog-id parameter | ERROR | none |
@@ -503,7 +503,7 @@
 | `pf-batch-se-name` | AWS::Batch::ServiceEnvironment | Service environment names allow only letters, numbers, hyphen and underscore | ERROR | none |
 | `pf-batch-sp-fairshare-quotashare-exclusive` | AWS::Batch::SchedulingPolicy | FairsharePolicy and QuotaSharePolicy are mutually exclusive | ERROR | none |
 | `pf-batch-sp-name` | AWS::Batch::SchedulingPolicy | Scheduling policy names allow only letters, numbers, hyphen and underscore | ERROR | none |
-| `pf-batch-sp-quota-share-idle-strategy-value` | AWS::Batch::SchedulingPolicy | QuotaSharePolicy.IdleResourceAssignmentStrategy must be FIFO | ERROR | none |
+| `pf-batch-sp-quota-share-idle-strategy-value` | AWS::Batch::SchedulingPolicy | QuotaSharePolicy.IdleResourceAssignmentStrategy must be FIFO | ERROR | cfn-schema |
 | `pf-batch-sp-share-distribution-max` | AWS::Batch::SchedulingPolicy | A fair-share policy supports at most 500 share identifiers | ERROR | none |
 | `pf-batch-sp-share-identifier-duplicate` | AWS::Batch::SchedulingPolicy | ShareDistribution entries need unique share identifiers | ERROR | none |
 | `pf-batch-sp-share-identifier-overlap` | AWS::Batch::SchedulingPolicy | A share identifier prefix may not cover another share identifier | ERROR | none |
@@ -637,7 +637,7 @@
 | `pf-agentcore-runtime-artifact-exactly-one` | AWS::BedrockAgentCore::Runtime | AgentRuntimeArtifact must hold exactly one of ContainerConfiguration or CodeConfiguration | ERROR | none |
 | `pf-agentcore-runtime-code-entrypoint-extension` | AWS::BedrockAgentCore::Runtime | A CodeConfiguration EntryPoint file must match the selected Runtime (.py for PYTHON_*) | ERROR | none |
 | `pf-agentcore-runtime-endpoint-name-default` | AWS::BedrockAgentCore::RuntimeEndpoint | A RuntimeEndpoint cannot be named DEFAULT (the runtime already owns that endpoint) | ERROR | none |
-| `pf-agentcore-runtime-env-var-count` | AWS::BedrockAgentCore::Runtime | AgentCore Runtime EnvironmentVariables holds at most 50 entries | ERROR | pending-engine |
+| `pf-agentcore-runtime-env-var-count` | AWS::BedrockAgentCore::Runtime | AgentCore Runtime EnvironmentVariables holds at most 50 entries | ERROR | cfn-schema |
 | `pf-agentcore-runtime-lifecycle-timeout-order` | AWS::BedrockAgentCore::Runtime | AgentCore Runtime IdleRuntimeSessionTimeout must not exceed MaxLifetime | ERROR | none |
 | `pf-agentcore-runtime-name` | AWS::BedrockAgentCore::Runtime | AgentCore Runtime names must match [a-zA-Z][a-zA-Z0-9_]{0,47} (no hyphens) | ERROR | pending-engine |
 | `pf-agentcore-runtime-session-storage-single` | AWS::BedrockAgentCore::Runtime | An AgentCore Runtime allows at most one SessionStorage filesystem configuration | ERROR | none |
@@ -1034,7 +1034,7 @@
 | `pf-dynamodb-duplicate-index-name` | AWS::DynamoDB::Table | Secondary index names must be unique | ERROR | none |
 | `pf-dynamodb-global-table-attribute-definitions` | AWS::DynamoDB::GlobalTable | GlobalTable AttributeDefinitions must match the key schemas exactly | ERROR | none |
 | `pf-dynamodb-global-table-gsi-provisioned-write-settings` | AWS::DynamoDB::GlobalTable | Each GSI of a PROVISIONED GlobalTable needs WriteProvisionedThroughputSettings | ERROR | none |
-| `pf-dynamodb-global-table-key-schema-shape` | AWS::DynamoDB::GlobalTable | GlobalTable KeySchema must be [HASH] or [HASH, RANGE] | ERROR | none |
+| `pf-dynamodb-global-table-key-schema-shape` | AWS::DynamoDB::GlobalTable | GlobalTable KeySchema must be [HASH] or [HASH, RANGE] | ERROR | cfn-schema |
 | `pf-dynamodb-global-table-lsi-attribute-definitions` | AWS::DynamoDB::GlobalTable | GlobalTable LSI key attributes must be defined in AttributeDefinitions | ERROR | none |
 | `pf-dynamodb-global-table-lsi-count` | AWS::DynamoDB::GlobalTable | A global table can carry at most 5 local secondary indexes | ERROR | none |
 | `pf-dynamodb-global-table-lsi-shape` | AWS::DynamoDB::GlobalTable | A GlobalTable LSI needs a RANGE key and the table's leading hash key | ERROR | none |
@@ -1162,7 +1162,7 @@
 | `pf-ecr-pull-through-cache-url` | AWS::ECR::PullThroughCacheRule | UpstreamRegistryUrl must be one of the supported upstream endpoints and cannot be this registry itself | ERROR | none |
 | `pf-ecr-registry-scanning-configuration` | AWS::ECR::RegistryScanningConfiguration | BASIC scanning supports SCAN_ON_PUSH only, and two rules cannot share a scan frequency | ERROR | none |
 | `pf-ecr-replication-destination` | AWS::ECR::ReplicationConfiguration | A replication destination must be another registry: not the deploy account in the deploy region, and not another partition | ERROR | none |
-| `pf-ecr-repository-creation-template-applied-for` | AWS::ECR::RepositoryCreationTemplate | AppliedFor accepts REPLICATION, PULL_THROUGH_CACHE and CREATE_ON_PUSH only | ERROR | none |
+| `pf-ecr-repository-creation-template-applied-for` | AWS::ECR::RepositoryCreationTemplate | AppliedFor accepts REPLICATION, PULL_THROUGH_CACHE and CREATE_ON_PUSH only | ERROR | cfn-schema |
 | `pf-ecr-signing-profile-region` | AWS::ECR::SigningConfiguration | A signing profile ARN must be in the same region as the registry | ERROR | none |
 | `pf-ecs-awsfirelens-without-router` | AWS::ECS::TaskDefinition | The awsfirelens log driver requires a FireLens router container | ERROR | none |
 | `pf-ecs-awslogs-fargate-missing-stream-prefix` | AWS::ECS::TaskDefinition | awslogs on Fargate requires the awslogs-stream-prefix option | ERROR | none |
@@ -1612,7 +1612,7 @@
 | `pf-glue-ml-transform-max-capacity-with-worker-type` | AWS::Glue::MLTransform | MLTransform MaxCapacity cannot be combined with WorkerType | ERROR | none |
 | `pf-glue-ml-transform-worker-type-and-number-of-workers` | AWS::Glue::MLTransform | MLTransform WorkerType and NumberOfWorkers have to be set together | ERROR | none |
 | `pf-glue-partition-values-match-partition-keys` | AWS::Glue::Partition | Partition Values must be as many as the table's PartitionKeys | ERROR | none |
-| `pf-glue-schema-compatibility` | AWS::Glue::Schema | Schema Compatibility must be one of the seven documented modes | ERROR | pending-engine |
+| `pf-glue-schema-compatibility` | AWS::Glue::Schema | Schema Compatibility must be one of the seven documented modes | ERROR | cfn-schema |
 | `pf-glue-schema-definition-format` | AWS::Glue::Schema | SchemaDefinition must parse as the declared DataFormat | ERROR | none |
 | `pf-glue-schema-name-charset` | AWS::Glue::Schema | A schema name is limited to letters, digits and - _ $ | ERROR | pending-engine |
 | `pf-glue-security-configuration-kms-key` | AWS::Glue::SecurityConfiguration | KMS encryption modes need a KmsKeyArn | ERROR | none |
@@ -1628,7 +1628,7 @@
 | `pf-glue-trigger-schedule-day-of-month-or-week` | AWS::Glue::Trigger | A Glue cron expression must put ? in exactly one of day-of-month and day-of-week | ERROR | none |
 | `pf-glue-trigger-scheduled-requires-schedule` | AWS::Glue::Trigger | A SCHEDULED trigger must carry a Schedule | ERROR | none |
 | `pf-glue-user-defined-function-owner-type` | AWS::Glue::UserDefinedFunction | A user-defined function needs an OwnerType of USER, ROLE or GROUP | ERROR | pending-engine |
-| `pf-glue-user-defined-function-resource-uri-type` | AWS::Glue::UserDefinedFunction | A function ResourceUri needs a ResourceType of JAR, FILE or ARCHIVE | ERROR | pending-engine |
+| `pf-glue-user-defined-function-resource-uri-type` | AWS::Glue::UserDefinedFunction | A function ResourceUri needs a ResourceType of JAR, FILE or ARCHIVE | ERROR | cfn-schema |
 | `pf-glue-workflow-max-concurrent-runs-min` | AWS::Glue::Workflow | A workflow needs at least one concurrent run | ERROR | pending-engine |
 | `pf-iam-identity-policy-no-principal` | AWS::IAM::Role<br>AWS::IAM::Policy<br>AWS::IAM::ManagedPolicy | Identity policies cannot carry a Principal field | ERROR | none |
 | `pf-iam-inline-policy-size` | AWS::IAM::Policy<br>AWS::IAM::RolePolicy<br>AWS::IAM::UserPolicy<br>AWS::IAM::GroupPolicy | Inline policy documents are limited per identity (role 10240 / group 5120 / user 2048 characters) | ERROR | none |
@@ -2036,7 +2036,7 @@
 | `pf-route53-alias-target-outside-zone` | AWS::Route53::RecordSet<br>AWS::Route53::RecordSetGroup | An alias into a hosted zone of this template must target a name inside that zone | ERROR | none |
 | `pf-route53-apex-cname` | AWS::Route53::RecordSet<br>AWS::Route53::HostedZone | A CNAME record is not permitted at the zone apex | ERROR | none |
 | `pf-route53-caa-tag-enum` | AWS::Route53::RecordSet<br>AWS::Route53::RecordSetGroup | A CAA tag must be issue, issuewild or iodef | ERROR | none |
-| `pf-route53-cidr-collection-id-format` | AWS::Route53::RecordSet<br>AWS::Route53::RecordSetGroup | CidrRoutingConfig.CollectionId must be a UUID | ERROR | pending-engine |
+| `pf-route53-cidr-collection-id-format` | AWS::Route53::RecordSet<br>AWS::Route53::RecordSetGroup | CidrRoutingConfig.CollectionId must be a UUID | ERROR | cfn-schema |
 | `pf-route53-cidr-location-name-format` | AWS::Route53::RecordSet<br>AWS::Route53::RecordSetGroup<br>AWS::Route53::CidrCollection | CidrRoutingConfig.LocationName is limited to 16 characters of [0-9A-Za-z_-*] | ERROR | none |
 | `pf-route53-cidr-private-zone` | AWS::Route53::RecordSet<br>AWS::Route53::RecordSetGroup | IP-based routing is not available in a private hosted zone | ERROR | none |
 | `pf-route53-cidr-same-collection-in-group` | AWS::Route53::RecordSetGroup | IP-based record sets sharing a name and type must use one CIDR collection | ERROR | none |
@@ -2058,7 +2058,7 @@
 | `pf-route53-dnssec-requires-ksk` | AWS::Route53::DNSSEC | DNSSEC cannot be enabled on a hosted zone without a key signing key | ERROR | none |
 | `pf-route53-ds-field-count` | AWS::Route53::RecordSet<br>AWS::Route53::RecordSetGroup | A DS record value needs exactly 4 space-separated fields | ERROR | none |
 | `pf-route53-failover-alias-evaluate-target-health` | AWS::Route53::RecordSet<br>AWS::Route53::RecordSetGroup | A PRIMARY failover alias must set EvaluateTargetHealth to true | ERROR | none |
-| `pf-route53-failover-enum` | AWS::Route53::RecordSet<br>AWS::Route53::RecordSetGroup | Failover must be PRIMARY or SECONDARY | ERROR | pending-engine |
+| `pf-route53-failover-enum` | AWS::Route53::RecordSet<br>AWS::Route53::RecordSetGroup | Failover must be PRIMARY or SECONDARY | ERROR | cfn-schema |
 | `pf-route53-failover-requires-health-check` | AWS::Route53::RecordSet<br>AWS::Route53::RecordSetGroup | A non-alias PRIMARY failover record needs a health check | ERROR | none |
 | `pf-route53-geolocation-continent-code-enum` | AWS::Route53::RecordSet<br>AWS::Route53::RecordSetGroup | GeoLocation.ContinentCode must be one of the seven two-letter continent codes | ERROR | none |
 | `pf-route53-geolocation-country-code-iso` | AWS::Route53::RecordSet<br>AWS::Route53::RecordSetGroup | GeoLocation.CountryCode must be an ISO 3166-1 alpha-2 country code | ERROR | none |
@@ -2068,7 +2068,7 @@
 | `pf-route53-geolocation-subdivision-requires-us` | AWS::Route53::RecordSet<br>AWS::Route53::RecordSetGroup | GeoLocation.SubdivisionCode is only valid with CountryCode US | ERROR | none |
 | `pf-route53-geolocation-unsupported-country` | AWS::Route53::RecordSet<br>AWS::Route53::RecordSetGroup | Four ISO country codes have no Route 53 geolocation coverage | ERROR | none |
 | `pf-route53-geoproximity-awsregion-value` | AWS::Route53::RecordSet<br>AWS::Route53::RecordSetGroup | GeoProximityLocation.AWSRegion must be an existing AWS Region | ERROR | none |
-| `pf-route53-geoproximity-bias-range` | AWS::Route53::RecordSet<br>AWS::Route53::RecordSetGroup | GeoProximityLocation.Bias must be -99 to 99 | ERROR | pending-engine |
+| `pf-route53-geoproximity-bias-range` | AWS::Route53::RecordSet<br>AWS::Route53::RecordSetGroup | GeoProximityLocation.Bias must be -99 to 99 | ERROR | cfn-schema |
 | `pf-route53-geoproximity-exclusive` | AWS::Route53::RecordSet<br>AWS::Route53::RecordSetGroup | GeoProximityLocation takes exactly one of AWSRegion, LocalZoneGroup or Coordinates | ERROR | pending-engine |
 | `pf-route53-geoproximity-localzonegroup-format` | AWS::Route53::RecordSet<br>AWS::Route53::RecordSetGroup | GeoProximityLocation.LocalZoneGroup must be a Local Zone group name | ERROR | none |
 | `pf-route53-geoproximity-max-30-same-name-type` | AWS::Route53::RecordSetGroup | A geoproximity group may hold at most 30 record sets per name and type | ERROR | none |
@@ -2139,7 +2139,7 @@
 | `pf-route53-naptr-regexp-replacement-exclusive` | AWS::Route53::RecordSet<br>AWS::Route53::RecordSetGroup | A NAPTR value carries either a regexp or a replacement, never both | ERROR | none |
 | `pf-route53-naptr-service-quotes` | AWS::Route53::RecordSet<br>AWS::Route53::RecordSetGroup | The NAPTR service field must be quoted | ERROR | none |
 | `pf-route53-private-zone-health-check-policy` | AWS::Route53::RecordSet<br>AWS::Route53::RecordSetGroup | A record with no routing policy cannot reference a health check | ERROR | none |
-| `pf-route53-record-comment-length` | AWS::Route53::RecordSet<br>AWS::Route53::RecordSetGroup | Comment is limited to 256 characters | ERROR | pending-engine |
+| `pf-route53-record-comment-length` | AWS::Route53::RecordSet<br>AWS::Route53::RecordSetGroup | Comment is limited to 256 characters | ERROR | cfn-schema |
 | `pf-route53-record-name-charset` | AWS::Route53::RecordSet<br>AWS::Route53::RecordSetGroup | A record name cannot contain a space | ERROR | none |
 | `pf-route53-record-name-label-length` | AWS::Route53::RecordSet<br>AWS::Route53::RecordSetGroup | Each label of a record name is limited to 63 bytes | ERROR | none |
 | `pf-route53-record-name-punycode` | AWS::Route53::RecordSet<br>AWS::Route53::RecordSetGroup | A record name must be ASCII (IDNs go in as Punycode) | ERROR | none |
@@ -2150,10 +2150,10 @@
 | `pf-route53-record-value-source` | AWS::Route53::RecordSet | A record set needs AliasTarget or the full TTL+ResourceRecords pair | ERROR | none |
 | `pf-route53-recordsetgroup-max-1000-elements` | AWS::Route53::RecordSetGroup | One RecordSetGroup may carry at most 1000 ResourceRecords values in total | ERROR | none |
 | `pf-route53-recordsetgroup-max-32000-chars` | AWS::Route53::RecordSetGroup | One RecordSetGroup may carry at most 32000 characters of record data | ERROR | none |
-| `pf-route53-resourcerecord-value-length` | AWS::Route53::RecordSet<br>AWS::Route53::RecordSetGroup | A single ResourceRecords value is limited to 4000 characters | ERROR | pending-engine |
+| `pf-route53-resourcerecord-value-length` | AWS::Route53::RecordSet<br>AWS::Route53::RecordSetGroup | A single ResourceRecords value is limited to 4000 characters | ERROR | cfn-schema |
 | `pf-route53-resourcerecords-max-400` | AWS::Route53::RecordSet<br>AWS::Route53::RecordSetGroup | A record set may hold at most 400 ResourceRecords values | ERROR | none |
 | `pf-route53-routing-policy-exclusive` | AWS::Route53::RecordSet | A record set can use only one routing policy | ERROR | none |
-| `pf-route53-set-identifier-length` | AWS::Route53::RecordSet<br>AWS::Route53::RecordSetGroup | SetIdentifier must be 1-128 characters | ERROR | pending-engine |
+| `pf-route53-set-identifier-length` | AWS::Route53::RecordSet<br>AWS::Route53::RecordSetGroup | SetIdentifier must be 1-128 characters | ERROR | cfn-schema |
 | `pf-route53-set-identifier-pairing` | AWS::Route53::RecordSet | SetIdentifier and a routing policy must appear together | ERROR | none |
 | `pf-route53-set-identifier-unique-in-group` | AWS::Route53::RecordSetGroup | SetIdentifier must be unique among record sets sharing a name and type | ERROR | none |
 | `pf-route53-simple-and-policy-same-name-type` | AWS::Route53::RecordSetGroup | A simple record set cannot coexist with a routing-policy record set of the same name and type | ERROR | none |
@@ -2311,7 +2311,7 @@
 | `pf-s3-website-replace-key-exclusive` | AWS::S3::Bucket | ReplaceKeyWith and ReplaceKeyPrefixWith are mutually exclusive | ERROR | none |
 | `pf-s3-website-routing-rules-need-index` | AWS::S3::Bucket | RoutingRules require an IndexDocument | ERROR | none |
 | `pf-s3express-ap-name-suffix` | AWS::S3Express::AccessPoint | An S3 Express access point name must end with --<availability-zone-id>--xa-s3 | ERROR | none |
-| `pf-s3express-ap-scope-permissions` | AWS::S3Express::AccessPoint | Access point scope permissions are bare API names, not s3: actions | ERROR | none |
+| `pf-s3express-ap-scope-permissions` | AWS::S3Express::AccessPoint | Access point scope permissions are bare API names, not s3: actions | ERROR | cfn-schema |
 | `pf-s3express-ap-zone-mismatch` | AWS::S3Express::AccessPoint | An S3 Express access point must carry the same zone id as its bucket | ERROR | none |
 | `pf-s3express-bucket-key-enabled-false` | AWS::S3Express::DirectoryBucket | A directory bucket must keep BucketKeyEnabled true | ERROR | none |
 | `pf-s3express-bucket-location-region` | AWS::S3Express::DirectoryBucket | LocationName must name a zone in the region the stack deploys to | ERROR | none |

package/lib/index.d.ts CHANGED Viewed

@@ -39,6 +39,12 @@ export interface PreflightOptions {
      * proposed to the upstream cloudformation-validate engine but are not merged
      * yet). Disable this if you run a newer engine that already covers them.
      *
+     * Rules marked `cfn-schema` are unaffected by this switch. CloudFormation's
+     * own registry schema does reject those templates, but only with a
+     * stack-level "Validation failed with 1 error(s)" that names no property, so
+     * they keep earning their place at synth time and no engine release retires
+     * them.
+     *
      * @default true
      */
     readonly includeUpstreamPending?: boolean;

package/lib/index.js CHANGED Viewed

@@ -17,7 +17,7 @@ const rules_generated_1 = require("./rules.generated");
  * Preflight.apply(app);
  */
 class Preflight {
-    static [JSII_RTTI_SYMBOL_1] = { fqn: "cdk-preflight.Preflight", version: "0.0.134" };
+    static [JSII_RTTI_SYMBOL_1] = { fqn: "cdk-preflight.Preflight", version: "0.0.136" };
     /**
      * Register the cdk-preflight rules on an App or Stage.
      */
@@ -50,4 +50,4 @@ class Preflight {
     constructor() { }
 }
 exports.Preflight = Preflight;
-//# sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJmaWxlIjoiaW5kZXguanMiLCJzb3VyY2VSb290IjoiIiwic291cmNlcyI6WyIuLi9zcmMvaW5kZXgudHMiXSwibmFtZXMiOltdLCJtYXBwaW5ncyI6Ijs7OztBQUFBLDZDQUFpRDtBQUVqRCwrQ0FBb0c7QUFDcEcsdURBQWtEO0FBa0RsRDs7Ozs7Ozs7OztHQVVHO0FBQ0gsTUFBYSxTQUFTOztJQUNwQjs7T0FFRztJQUNJLE1BQU0sQ0FBQyxLQUFLLENBQUMsS0FBaUIsRUFBRSxVQUE0QixFQUFFO1FBQ25FLElBQUksQ0FBQyxtQkFBSyxDQUFDLE9BQU8sQ0FBQyxLQUFLLENBQUMsRUFBRSxDQUFDO1lBQzFCLE1BQU0sSUFBSSxLQUFLLENBQUMsc0VBQXNFLENBQUMsQ0FBQztRQUMxRixDQUFDO1FBQ0QsTUFBTSxPQUFPLEdBQUcsT0FBTyxDQUFDLE9BQU8sSUFBSSxFQUFFLENBQUM7UUFDdEMsTUFBTSxPQUFPLEdBQUcsT0FBTyxDQUFDLE1BQU0sQ0FBQyxDQUFDLEVBQUUsRUFBRSxFQUFFLENBQUMsQ0FBQywrQkFBYSxDQUFDLElBQUksQ0FBQyxDQUFDLENBQUMsRUFBRSxFQUFFLENBQUMsQ0FBQyxDQUFDLEVBQUUsS0FBSyxFQUFFLENBQUMsQ0FBQyxDQUFDO1FBQ2hGLElBQUksT0FBTyxDQUFDLE1BQU0sR0FBRyxDQUFDLEVBQUUsQ0FBQztZQUN2QixNQUFNLElBQUksS0FBSyxDQUFDLGlEQUFpRCxPQUFPLENBQUMsSUFBSSxDQUFDLElBQUksQ0FBQyxFQUFFLENBQUMsQ0FBQztRQUN6RixDQUFDO1FBQ0QsTUFBTSxRQUFRLEdBQUcsK0JBQWE7YUFDM0IsTUFBTSxDQUFDLENBQUMsQ0FBQyxFQUFFLEVBQUUsQ0FBQyxDQUFDLE9BQU8sQ0FBQyxzQkFBc0IsSUFBSSxJQUFJLENBQUMsSUFBSSxDQUFDLENBQUMsUUFBUSxLQUFLLGdCQUFnQixDQUFDO2FBQzFGLE1BQU0sQ0FBQyxDQUFDLENBQUMsRUFBRSxFQUFFLENBQUMsQ0FBQyxPQUFPLENBQUMsUUFBUSxDQUFDLENBQUMsQ0FBQyxFQUFFLENBQUMsQ0FBQyxDQUFDO1FBRTFDLElBQUksT0FBTyxDQUFDLE9BQU8sSUFBSSxJQUFJLEVBQUUsQ0FBQztZQUM1Qix5QkFBVyxDQUFDLEVBQUUsQ0FBQyxLQUFLLENBQUMsQ0FBQyxVQUFVLENBQUMsSUFBSSxnQ0FBc0IsQ0FBQyxRQUFRLEVBQUUsT0FBTyxDQUFDLE1BQU0sSUFBSSxLQUFLLENBQUMsQ0FBQyxDQUFDO1lBQ2hHLElBQUEsNEJBQWtCLEVBQUMsS0FBSyxDQUFDLENBQUM7UUFDNUIsQ0FBQzthQUFNLENBQUM7WUFDTix5QkFBVyxDQUFDLEVBQUUsQ0FBQyxLQUFLLENBQUMsQ0FBQyxVQUFVLENBQUMsSUFBQSw2QkFBbUIsRUFBQyxRQUFRLENBQUMsQ0FBQyxDQUFDO1FBQ2xFLENBQUM7SUFDSCxDQUFDO0lBRUQ7O09BRUc7SUFDSSxNQUFNLENBQUMsT0FBTztRQUNuQixPQUFPLCtCQUFhLENBQUMsR0FBRyxDQUFDLENBQUMsQ0FBQyxFQUFFLEVBQUUsQ0FBQyxDQUFDLENBQUMsRUFBRSxDQUFDLENBQUM7SUFDeEMsQ0FBQztJQUVELGdCQUF1QixDQUFDOztBQWhDMUIsOEJBaUNDIiwic291cmNlc0NvbnRlbnQiOlsiaW1wb3J0IHsgU3RhZ2UsIFZhbGlkYXRpb25zIH0gZnJvbSAnYXdzLWNkay1saWInO1xuaW1wb3J0IHsgSUNvbnN0cnVjdCB9IGZyb20gJ2NvbnN0cnVjdHMnO1xuaW1wb3J0IHsgaW5zdGFsbEVuZm9yY2VHYXRlLCBvYnNlcnZlUGx1Z2luQ2FjaGVkLCBQcmVmbGlnaHRFbmZvcmNlUGx1Z2luIH0gZnJvbSAnLi9wcml2YXRlL2VuZm9yY2UnO1xuaW1wb3J0IHsgQlVORExFRF9SVUxFUyB9IGZyb20gJy4vcnVsZXMuZ2VuZXJhdGVkJztcblxuLyoqXG4gKiBPcHRpb25zIGZvciB7QGxpbmsgUHJlZmxpZ2h0LmFwcGx5fS5cbiAqL1xuZXhwb3J0IGludGVyZmFjZSBQcmVmbGlnaHRPcHRpb25zIHtcbiAgLyoqXG4gICAqIFJ1bGUgaWRzIHRvIGRpc2FibGUgKHNlZSBgUHJlZmxpZ2h0LnJ1bGVJZHMoKWAgb3IgZG9jcy9ydWxlcy5tZCkuXG4gICAqXG4gICAqIEBkZWZhdWx0IC0gYWxsIGJ1bmRsZWQgcnVsZXMgYXJlIGVuYWJsZWRcbiAgICovXG4gIHJlYWRvbmx5IGV4Y2x1ZGU/OiBzdHJpbmdbXTtcblxuICAvKipcbiAgICogRmFpbCBzeW50aGVzaXMgd2hlbiBhIGJ1bmRsZWQgcnVsZSBpcyB2aW9sYXRlZC5cbiAgICpcbiAgICogSW4gdGhlIGRlZmF1bHQgKGVuZm9yY2UpIG1vZGUsIGNkay1wcmVmbGlnaHQgZXZhbHVhdGVzIGl0cyBydWxlcyB3aXRoIGl0c1xuICAgKiBvd24gdmFsaWRhdGlvbiBwbHVnaW4gYW5kIGEgdmlvbGF0aW9uIG1ha2VzIGBjZGsgc3ludGhgIGZhaWwg4oCUIHRoZSB3aG9sZVxuICAgKiBwb2ludCBvZiBwcmVmbGlnaHQgY2hlY2tzIGlzIHRoYXQgYSB0ZW1wbGF0ZSBrbm93biB0byBmYWlsIGF0IGRlcGxveSB0aW1lXG4gICAqIG5ldmVyIGxlYXZlcyB5b3VyIG1hY2hpbmUuIFNldCBgZW5mb3JjZTogZmFsc2VgIHRvIG9ic2VydmUgZmlyc3Q6IGZpbmRpbmdzXG4gICAqIGFyZSB0aGVuIHJlcG9ydGVkIHRocm91Z2ggdGhlIENESyBidWlsdC1pbiBDbG91ZEZvcm1hdGlvbiB2YWxpZGF0b3IgYW5kXG4gICAqIHN1cmZhY2UgYXMgc3ludGggd2FybmluZ3Mgd2l0aCBjb25zdHJ1Y3QgdHJhY2VzLCB3aGljaCBjYW4gYmUgbXV0ZWQgcGVyXG4gICAqIGZpbmRpbmcgdmlhIGBBY2tub3dsZWRnZSB3aXRoICdDbG91ZEZvcm1hdGlvbi1WYWxpZGF0ZTo6PHJ1bGUtaWQ+J2AuXG4gICAqXG4gICAqIEBkZWZhdWx0IHRydWVcbiAgICovXG4gIHJlYWRvbmx5IGVuZm9yY2U/OiBib29sZWFuO1xuXG4gIC8qKlxuICAgKiBJbiBlbmZvcmNlIG1vZGUsIGFkZGl0aW9uYWxseSBmYWlsIHN5bnRoZXNpcyBvbiBlcnJvci1jbGFzcyBmaW5kaW5nc1xuICAgKiAoc2V2ZXJpdHkgRVJST1IvRkFUQUwpIG9mIHRoZSBidWlsdC1pbiB2YWxpZGF0aW9uIGVuZ2luZSBpdHNlbGYsIGUuZy5cbiAgICogc2NoZW1hIHZpb2xhdGlvbnMgbGlrZSBgRjMwMzRgLiBUaGlzIGlzIHRoZSB3b3JrYXJvdW5kIGZvciB0aGUgQ0RLXG4gICAqIGJlaGF2aW9yIHdoZXJlIGFsbCBidWlsdC1pbiBmaW5kaW5ncyBhcmUgZG93bmdyYWRlZCB0byB3YXJuaW5ncy5cbiAgICpcbiAgICogT25seSBlZmZlY3RpdmUgaW4gZW5mb3JjZSBtb2RlICh0aGUgZGVmYXVsdCkuXG4gICAqXG4gICAqIEBkZWZhdWx0IGZhbHNlXG4gICAqL1xuICByZWFkb25seSBzdHJpY3Q/OiBib29sZWFuO1xuXG4gIC8qKlxuICAgKiBJbmNsdWRlIHJ1bGVzIHRoYXQgYXJlIG1hcmtlZCBgcGVuZGluZy1lbmdpbmVgIChjYW5kaWRhdGVzIHRoYXQgaGF2ZSBiZWVuXG4gICAqIHByb3Bvc2VkIHRvIHRoZSB1cHN0cmVhbSBjbG91ZGZvcm1hdGlvbi12YWxpZGF0ZSBlbmdpbmUgYnV0IGFyZSBub3QgbWVyZ2VkXG4gICAqIHlldCkuIERpc2FibGUgdGhpcyBpZiB5b3UgcnVuIGEgbmV3ZXIgZW5naW5lIHRoYXQgYWxyZWFkeSBjb3ZlcnMgdGhlbS5cbiAgICpcbiAgICogQGRlZmF1bHQgdHJ1ZVxuICAgKi9cbiAgcmVhZG9ubHkgaW5jbHVkZVVwc3RyZWFtUGVuZGluZz86IGJvb2xlYW47XG59XG5cbi8qKlxuICogY2RrLXByZWZsaWdodDogY2F0Y2ggZGVwbG95LXRpbWUgQ2xvdWRGb3JtYXRpb24gZmFpbHVyZXMgYXQgc3ludGggdGltZS5cbiAqXG4gKiBJbmplY3RzIGEgY3VyYXRlZCBSZWdvIHJ1bGUgcGFjayAoY29uc3RyYWludHMgdGhhdCByZXNvdXJjZSBwcm92aWRlciBzY2hlbWFzXG4gKiBkbyBub3QgZXhwcmVzczogZG9jLW9ubHkgdmFsdWUgbGltaXRzLCBjcm9zcy1wcm9wZXJ0eSBhbmQgY3Jvc3MtcmVzb3VyY2VcbiAqIHJ1bGVzKSBpbnRvIHRoZSBBV1MgQ0RLIGJ1aWx0LWluIENsb3VkRm9ybWF0aW9uIHZhbGlkYXRvci5cbiAqXG4gKiBAZXhhbXBsZVxuICogZGVjbGFyZSBjb25zdCBhcHA6IEFwcDtcbiAqIFByZWZsaWdodC5hcHBseShhcHApO1xuICovXG5leHBvcnQgY2xhc3MgUHJlZmxpZ2h0IHtcbiAgLyoqXG4gICAqIFJlZ2lzdGVyIHRoZSBjZGstcHJlZmxpZ2h0IHJ1bGVzIG9uIGFuIEFwcCBvciBTdGFnZS5cbiAgICovXG4gIHB1YmxpYyBzdGF0aWMgYXBwbHkoc2NvcGU6IElDb25zdHJ1Y3QsIG9wdGlvbnM6IFByZWZsaWdodE9wdGlvbnMgPSB7fSk6IHZvaWQge1xuICAgIGlmICghU3RhZ2UuaXNTdGFnZShzY29wZSkpIHtcbiAgICAgIHRocm93IG5ldyBFcnJvcignY2RrLXByZWZsaWdodDogUHJlZmxpZ2h0LmFwcGx5KCkgbXVzdCBiZSBjYWxsZWQgb24gYW4gQXBwIG9yIGEgU3RhZ2UnKTtcbiAgICB9XG4gICAgY29uc3QgZXhjbHVkZSA9IG9wdGlvbnMuZXhjbHVkZSA/PyBbXTtcbiAgICBjb25zdCB1bmtub3duID0gZXhjbHVkZS5maWx0ZXIoKGlkKSA9PiAhQlVORExFRF9SVUxFUy5zb21lKChyKSA9PiByLmlkID09PSBpZCkpO1xuICAgIGlmICh1bmtub3duLmxlbmd0aCA+IDApIHtcbiAgICAgIHRocm93IG5ldyBFcnJvcihgY2RrLXByZWZsaWdodDogdW5rbm93biBydWxlIGlkKHMpIGluIGV4Y2x1ZGU6ICR7dW5rbm93bi5qb2luKCcsICcpfWApO1xuICAgIH1cbiAgICBjb25zdCBzZWxlY3RlZCA9IEJVTkRMRURfUlVMRVNcbiAgICAgIC5maWx0ZXIoKHIpID0+IChvcHRpb25zLmluY2x1ZGVVcHN0cmVhbVBlbmRpbmcgPz8gdHJ1ZSkgfHwgci51cHN0cmVhbSAhPT0gJ3BlbmRpbmctZW5naW5lJylcbiAgICAgIC5maWx0ZXIoKHIpID0+ICFleGNsdWRlLmluY2x1ZGVzKHIuaWQpKTtcblxuICAgIGlmIChvcHRpb25zLmVuZm9yY2UgPz8gdHJ1ZSkge1xuICAgICAgVmFsaWRhdGlvbnMub2Yoc2NvcGUpLmFkZFBsdWdpbnMobmV3IFByZWZsaWdodEVuZm9yY2VQbHVnaW4oc2VsZWN0ZWQsIG9wdGlvbnMuc3RyaWN0ID8/IGZhbHNlKSk7XG4gICAgICBpbnN0YWxsRW5mb3JjZUdhdGUoc2NvcGUpO1xuICAgIH0gZWxzZSB7XG4gICAgICBWYWxpZGF0aW9ucy5vZihzY29wZSkuYWRkUGx1Z2lucyhvYnNlcnZlUGx1Z2luQ2FjaGVkKHNlbGVjdGVkKSk7XG4gICAgfVxuICB9XG5cbiAgLyoqXG4gICAqIFRoZSBpZHMgb2YgYWxsIGJ1bmRsZWQgcnVsZXMuXG4gICAqL1xuICBwdWJsaWMgc3RhdGljIHJ1bGVJZHMoKTogc3RyaW5nW10ge1xuICAgIHJldHVybiBCVU5ETEVEX1JVTEVTLm1hcCgocikgPT4gci5pZCk7XG4gIH1cblxuICBwcml2YXRlIGNvbnN0cnVjdG9yKCkge31cbn1cbiJdfQ==
+//# sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJmaWxlIjoiaW5kZXguanMiLCJzb3VyY2VSb290IjoiIiwic291cmNlcyI6WyIuLi9zcmMvaW5kZXgudHMiXSwibmFtZXMiOltdLCJtYXBwaW5ncyI6Ijs7OztBQUFBLDZDQUFpRDtBQUVqRCwrQ0FBb0c7QUFDcEcsdURBQWtEO0FBd0RsRDs7Ozs7Ozs7OztHQVVHO0FBQ0gsTUFBYSxTQUFTOztJQUNwQjs7T0FFRztJQUNJLE1BQU0sQ0FBQyxLQUFLLENBQUMsS0FBaUIsRUFBRSxVQUE0QixFQUFFO1FBQ25FLElBQUksQ0FBQyxtQkFBSyxDQUFDLE9BQU8sQ0FBQyxLQUFLLENBQUMsRUFBRSxDQUFDO1lBQzFCLE1BQU0sSUFBSSxLQUFLLENBQUMsc0VBQXNFLENBQUMsQ0FBQztRQUMxRixDQUFDO1FBQ0QsTUFBTSxPQUFPLEdBQUcsT0FBTyxDQUFDLE9BQU8sSUFBSSxFQUFFLENBQUM7UUFDdEMsTUFBTSxPQUFPLEdBQUcsT0FBTyxDQUFDLE1BQU0sQ0FBQyxDQUFDLEVBQUUsRUFBRSxFQUFFLENBQUMsQ0FBQywrQkFBYSxDQUFDLElBQUksQ0FBQyxDQUFDLENBQUMsRUFBRSxFQUFFLENBQUMsQ0FBQyxDQUFDLEVBQUUsS0FBSyxFQUFFLENBQUMsQ0FBQyxDQUFDO1FBQ2hGLElBQUksT0FBTyxDQUFDLE1BQU0sR0FBRyxDQUFDLEVBQUUsQ0FBQztZQUN2QixNQUFNLElBQUksS0FBSyxDQUFDLGlEQUFpRCxPQUFPLENBQUMsSUFBSSxDQUFDLElBQUksQ0FBQyxFQUFFLENBQUMsQ0FBQztRQUN6RixDQUFDO1FBQ0QsTUFBTSxRQUFRLEdBQUcsK0JBQWE7YUFDM0IsTUFBTSxDQUFDLENBQUMsQ0FBQyxFQUFFLEVBQUUsQ0FBQyxDQUFDLE9BQU8sQ0FBQyxzQkFBc0IsSUFBSSxJQUFJLENBQUMsSUFBSSxDQUFDLENBQUMsUUFBUSxLQUFLLGdCQUFnQixDQUFDO2FBQzFGLE1BQU0sQ0FBQyxDQUFDLENBQUMsRUFBRSxFQUFFLENBQUMsQ0FBQyxPQUFPLENBQUMsUUFBUSxDQUFDLENBQUMsQ0FBQyxFQUFFLENBQUMsQ0FBQyxDQUFDO1FBRTFDLElBQUksT0FBTyxDQUFDLE9BQU8sSUFBSSxJQUFJLEVBQUUsQ0FBQztZQUM1Qix5QkFBVyxDQUFDLEVBQUUsQ0FBQyxLQUFLLENBQUMsQ0FBQyxVQUFVLENBQUMsSUFBSSxnQ0FBc0IsQ0FBQyxRQUFRLEVBQUUsT0FBTyxDQUFDLE1BQU0sSUFBSSxLQUFLLENBQUMsQ0FBQyxDQUFDO1lBQ2hHLElBQUEsNEJBQWtCLEVBQUMsS0FBSyxDQUFDLENBQUM7UUFDNUIsQ0FBQzthQUFNLENBQUM7WUFDTix5QkFBVyxDQUFDLEVBQUUsQ0FBQyxLQUFLLENBQUMsQ0FBQyxVQUFVLENBQUMsSUFBQSw2QkFBbUIsRUFBQyxRQUFRLENBQUMsQ0FBQyxDQUFDO1FBQ2xFLENBQUM7SUFDSCxDQUFDO0lBRUQ7O09BRUc7SUFDSSxNQUFNLENBQUMsT0FBTztRQUNuQixPQUFPLCtCQUFhLENBQUMsR0FBRyxDQUFDLENBQUMsQ0FBQyxFQUFFLEVBQUUsQ0FBQyxDQUFDLENBQUMsRUFBRSxDQUFDLENBQUM7SUFDeEMsQ0FBQztJQUVELGdCQUF1QixDQUFDOztBQWhDMUIsOEJBaUNDIiwic291cmNlc0NvbnRlbnQiOlsiaW1wb3J0IHsgU3RhZ2UsIFZhbGlkYXRpb25zIH0gZnJvbSAnYXdzLWNkay1saWInO1xuaW1wb3J0IHsgSUNvbnN0cnVjdCB9IGZyb20gJ2NvbnN0cnVjdHMnO1xuaW1wb3J0IHsgaW5zdGFsbEVuZm9yY2VHYXRlLCBvYnNlcnZlUGx1Z2luQ2FjaGVkLCBQcmVmbGlnaHRFbmZvcmNlUGx1Z2luIH0gZnJvbSAnLi9wcml2YXRlL2VuZm9yY2UnO1xuaW1wb3J0IHsgQlVORExFRF9SVUxFUyB9IGZyb20gJy4vcnVsZXMuZ2VuZXJhdGVkJztcblxuLyoqXG4gKiBPcHRpb25zIGZvciB7QGxpbmsgUHJlZmxpZ2h0LmFwcGx5fS5cbiAqL1xuZXhwb3J0IGludGVyZmFjZSBQcmVmbGlnaHRPcHRpb25zIHtcbiAgLyoqXG4gICAqIFJ1bGUgaWRzIHRvIGRpc2FibGUgKHNlZSBgUHJlZmxpZ2h0LnJ1bGVJZHMoKWAgb3IgZG9jcy9ydWxlcy5tZCkuXG4gICAqXG4gICAqIEBkZWZhdWx0IC0gYWxsIGJ1bmRsZWQgcnVsZXMgYXJlIGVuYWJsZWRcbiAgICovXG4gIHJlYWRvbmx5IGV4Y2x1ZGU/OiBzdHJpbmdbXTtcblxuICAvKipcbiAgICogRmFpbCBzeW50aGVzaXMgd2hlbiBhIGJ1bmRsZWQgcnVsZSBpcyB2aW9sYXRlZC5cbiAgICpcbiAgICogSW4gdGhlIGRlZmF1bHQgKGVuZm9yY2UpIG1vZGUsIGNkay1wcmVmbGlnaHQgZXZhbHVhdGVzIGl0cyBydWxlcyB3aXRoIGl0c1xuICAgKiBvd24gdmFsaWRhdGlvbiBwbHVnaW4gYW5kIGEgdmlvbGF0aW9uIG1ha2VzIGBjZGsgc3ludGhgIGZhaWwg4oCUIHRoZSB3aG9sZVxuICAgKiBwb2ludCBvZiBwcmVmbGlnaHQgY2hlY2tzIGlzIHRoYXQgYSB0ZW1wbGF0ZSBrbm93biB0byBmYWlsIGF0IGRlcGxveSB0aW1lXG4gICAqIG5ldmVyIGxlYXZlcyB5b3VyIG1hY2hpbmUuIFNldCBgZW5mb3JjZTogZmFsc2VgIHRvIG9ic2VydmUgZmlyc3Q6IGZpbmRpbmdzXG4gICAqIGFyZSB0aGVuIHJlcG9ydGVkIHRocm91Z2ggdGhlIENESyBidWlsdC1pbiBDbG91ZEZvcm1hdGlvbiB2YWxpZGF0b3IgYW5kXG4gICAqIHN1cmZhY2UgYXMgc3ludGggd2FybmluZ3Mgd2l0aCBjb25zdHJ1Y3QgdHJhY2VzLCB3aGljaCBjYW4gYmUgbXV0ZWQgcGVyXG4gICAqIGZpbmRpbmcgdmlhIGBBY2tub3dsZWRnZSB3aXRoICdDbG91ZEZvcm1hdGlvbi1WYWxpZGF0ZTo6PHJ1bGUtaWQ+J2AuXG4gICAqXG4gICAqIEBkZWZhdWx0IHRydWVcbiAgICovXG4gIHJlYWRvbmx5IGVuZm9yY2U/OiBib29sZWFuO1xuXG4gIC8qKlxuICAgKiBJbiBlbmZvcmNlIG1vZGUsIGFkZGl0aW9uYWxseSBmYWlsIHN5bnRoZXNpcyBvbiBlcnJvci1jbGFzcyBmaW5kaW5nc1xuICAgKiAoc2V2ZXJpdHkgRVJST1IvRkFUQUwpIG9mIHRoZSBidWlsdC1pbiB2YWxpZGF0aW9uIGVuZ2luZSBpdHNlbGYsIGUuZy5cbiAgICogc2NoZW1hIHZpb2xhdGlvbnMgbGlrZSBgRjMwMzRgLiBUaGlzIGlzIHRoZSB3b3JrYXJvdW5kIGZvciB0aGUgQ0RLXG4gICAqIGJlaGF2aW9yIHdoZXJlIGFsbCBidWlsdC1pbiBmaW5kaW5ncyBhcmUgZG93bmdyYWRlZCB0byB3YXJuaW5ncy5cbiAgICpcbiAgICogT25seSBlZmZlY3RpdmUgaW4gZW5mb3JjZSBtb2RlICh0aGUgZGVmYXVsdCkuXG4gICAqXG4gICAqIEBkZWZhdWx0IGZhbHNlXG4gICAqL1xuICByZWFkb25seSBzdHJpY3Q/OiBib29sZWFuO1xuXG4gIC8qKlxuICAgKiBJbmNsdWRlIHJ1bGVzIHRoYXQgYXJlIG1hcmtlZCBgcGVuZGluZy1lbmdpbmVgIChjYW5kaWRhdGVzIHRoYXQgaGF2ZSBiZWVuXG4gICAqIHByb3Bvc2VkIHRvIHRoZSB1cHN0cmVhbSBjbG91ZGZvcm1hdGlvbi12YWxpZGF0ZSBlbmdpbmUgYnV0IGFyZSBub3QgbWVyZ2VkXG4gICAqIHlldCkuIERpc2FibGUgdGhpcyBpZiB5b3UgcnVuIGEgbmV3ZXIgZW5naW5lIHRoYXQgYWxyZWFkeSBjb3ZlcnMgdGhlbS5cbiAgICpcbiAgICogUnVsZXMgbWFya2VkIGBjZm4tc2NoZW1hYCBhcmUgdW5hZmZlY3RlZCBieSB0aGlzIHN3aXRjaC4gQ2xvdWRGb3JtYXRpb24nc1xuICAgKiBvd24gcmVnaXN0cnkgc2NoZW1hIGRvZXMgcmVqZWN0IHRob3NlIHRlbXBsYXRlcywgYnV0IG9ubHkgd2l0aCBhXG4gICAqIHN0YWNrLWxldmVsIFwiVmFsaWRhdGlvbiBmYWlsZWQgd2l0aCAxIGVycm9yKHMpXCIgdGhhdCBuYW1lcyBubyBwcm9wZXJ0eSwgc29cbiAgICogdGhleSBrZWVwIGVhcm5pbmcgdGhlaXIgcGxhY2UgYXQgc3ludGggdGltZSBhbmQgbm8gZW5naW5lIHJlbGVhc2UgcmV0aXJlc1xuICAgKiB0aGVtLlxuICAgKlxuICAgKiBAZGVmYXVsdCB0cnVlXG4gICAqL1xuICByZWFkb25seSBpbmNsdWRlVXBzdHJlYW1QZW5kaW5nPzogYm9vbGVhbjtcbn1cblxuLyoqXG4gKiBjZGstcHJlZmxpZ2h0OiBjYXRjaCBkZXBsb3ktdGltZSBDbG91ZEZvcm1hdGlvbiBmYWlsdXJlcyBhdCBzeW50aCB0aW1lLlxuICpcbiAqIEluamVjdHMgYSBjdXJhdGVkIFJlZ28gcnVsZSBwYWNrIChjb25zdHJhaW50cyB0aGF0IHJlc291cmNlIHByb3ZpZGVyIHNjaGVtYXNcbiAqIGRvIG5vdCBleHByZXNzOiBkb2Mtb25seSB2YWx1ZSBsaW1pdHMsIGNyb3NzLXByb3BlcnR5IGFuZCBjcm9zcy1yZXNvdXJjZVxuICogcnVsZXMpIGludG8gdGhlIEFXUyBDREsgYnVpbHQtaW4gQ2xvdWRGb3JtYXRpb24gdmFsaWRhdG9yLlxuICpcbiAqIEBleGFtcGxlXG4gKiBkZWNsYXJlIGNvbnN0IGFwcDogQXBwO1xuICogUHJlZmxpZ2h0LmFwcGx5KGFwcCk7XG4gKi9cbmV4cG9ydCBjbGFzcyBQcmVmbGlnaHQge1xuICAvKipcbiAgICogUmVnaXN0ZXIgdGhlIGNkay1wcmVmbGlnaHQgcnVsZXMgb24gYW4gQXBwIG9yIFN0YWdlLlxuICAgKi9cbiAgcHVibGljIHN0YXRpYyBhcHBseShzY29wZTogSUNvbnN0cnVjdCwgb3B0aW9uczogUHJlZmxpZ2h0T3B0aW9ucyA9IHt9KTogdm9pZCB7XG4gICAgaWYgKCFTdGFnZS5pc1N0YWdlKHNjb3BlKSkge1xuICAgICAgdGhyb3cgbmV3IEVycm9yKCdjZGstcHJlZmxpZ2h0OiBQcmVmbGlnaHQuYXBwbHkoKSBtdXN0IGJlIGNhbGxlZCBvbiBhbiBBcHAgb3IgYSBTdGFnZScpO1xuICAgIH1cbiAgICBjb25zdCBleGNsdWRlID0gb3B0aW9ucy5leGNsdWRlID8/IFtdO1xuICAgIGNvbnN0IHVua25vd24gPSBleGNsdWRlLmZpbHRlcigoaWQpID0+ICFCVU5ETEVEX1JVTEVTLnNvbWUoKHIpID0+IHIuaWQgPT09IGlkKSk7XG4gICAgaWYgKHVua25vd24ubGVuZ3RoID4gMCkge1xuICAgICAgdGhyb3cgbmV3IEVycm9yKGBjZGstcHJlZmxpZ2h0OiB1bmtub3duIHJ1bGUgaWQocykgaW4gZXhjbHVkZTogJHt1bmtub3duLmpvaW4oJywgJyl9YCk7XG4gICAgfVxuICAgIGNvbnN0IHNlbGVjdGVkID0gQlVORExFRF9SVUxFU1xuICAgICAgLmZpbHRlcigocikgPT4gKG9wdGlvbnMuaW5jbHVkZVVwc3RyZWFtUGVuZGluZyA/PyB0cnVlKSB8fCByLnVwc3RyZWFtICE9PSAncGVuZGluZy1lbmdpbmUnKVxuICAgICAgLmZpbHRlcigocikgPT4gIWV4Y2x1ZGUuaW5jbHVkZXMoci5pZCkpO1xuXG4gICAgaWYgKG9wdGlvbnMuZW5mb3JjZSA/PyB0cnVlKSB7XG4gICAgICBWYWxpZGF0aW9ucy5vZihzY29wZSkuYWRkUGx1Z2lucyhuZXcgUHJlZmxpZ2h0RW5mb3JjZVBsdWdpbihzZWxlY3RlZCwgb3B0aW9ucy5zdHJpY3QgPz8gZmFsc2UpKTtcbiAgICAgIGluc3RhbGxFbmZvcmNlR2F0ZShzY29wZSk7XG4gICAgfSBlbHNlIHtcbiAgICAgIFZhbGlkYXRpb25zLm9mKHNjb3BlKS5hZGRQbHVnaW5zKG9ic2VydmVQbHVnaW5DYWNoZWQoc2VsZWN0ZWQpKTtcbiAgICB9XG4gIH1cblxuICAvKipcbiAgICogVGhlIGlkcyBvZiBhbGwgYnVuZGxlZCBydWxlcy5cbiAgICovXG4gIHB1YmxpYyBzdGF0aWMgcnVsZUlkcygpOiBzdHJpbmdbXSB7XG4gICAgcmV0dXJuIEJVTkRMRURfUlVMRVMubWFwKChyKSA9PiByLmlkKTtcbiAgfVxuXG4gIHByaXZhdGUgY29uc3RydWN0b3IoKSB7fVxufVxuIl19