cdk-preflight 0.0.138 → 0.0.140

package/.jsii

@@ -9600,6 +9600,6 @@
       "symbolId": "src/index:PreflightOptions"
     }
   },
-  "version": "0.0.138",
-  "fingerprint": "Mz/rr8CQYRwM49aq7aPzHIXqNqwWuEV5Y8bjQlBLAHQ="
+  "version": "0.0.140",
+  "fingerprint": "iYBjh60OrHoT/P6ZKbuXQv2Bj7WH09/tF41wPLN2iak="
 }

package/AGENTS.md

@@ -230,7 +230,8 @@ If you are a subagent running one of these phases, do not spawn further agents.
 - **A malformed identifier in a probe fixture is reported as an engine detection** (measured 2026-09-06). `VpcId: "vpc-1"` yields `E1151 'vpc-1' does not match format 'AWS::EC2::VPC.Id'` (ids need 8 or 17 hex chars, e.g. `vpc-11112222`), which reads exactly like the candidate being covered — two EC2 hypotheses (`GroupName: default`, ICMP type/code) were nearly recorded as Rejected on that basis and are clean once the id is valid. **Pair every probe with a control template that differs only in the property under test**; if the control is also flagged, the finding is about the fixture.
 - **A probe that "should fail" can create an expensive resource**: `create-cache-cluster --num-cache-nodes 41` was accepted (the documented cap of 40 is not enforced) and ElastiCache/MemoryDB refuse `delete-*` until the cluster reaches `available`, so the 41 nodes ran for ~20 minutes. Quantity and limit probes belong in CloudFormation (a rollback deletes what it made); when probing the API directly, arm a wait-then-delete loop in the same breath (measured 2026-09-06).
 - **Fixture name tagging must skip reference properties.** The generator that suffixes fixture names with the rule id has to key off the resource type: `ACLName` is the name on `AWS::MemoryDB::ACL` but a *reference* on `AWS::MemoryDB::Cluster`, and tagging it made every MemoryDB pass template fail with "ACL open-access-port not found" (measured 2026-09-06). Same for `ParameterGroupName` / `CacheParameterGroupName`.
-- **`bench/verify-rule.sh` polls for 30 minutes** (raised from 15 on 2026-09-06): ElastiCache and MemoryDB clusters take 10-25 minutes to create and about as long to roll back, and the shorter poll reported TIMEOUT / INCONCLUSIVE on rules whose constraint had already fired.
+- **`bench/verify-rule.sh` polls for 60 minutes** (15 → 30 on 2026-09-06, → 60 on 2026-09-13): ElastiCache and MemoryDB clusters take 10-25 minutes to create and about as long to roll back, and an MSK Provisioned cluster took 31m34s to reach CREATE_COMPLETE at its minimum size; a shorter poll reported TIMEOUT / INCONCLUSIVE on rules whose constraint had already fired.
+- **A non-zero `aws` exit is not evidence of anything** (measured 2026-09-22, four parallel `verify-rule.sh` in us-east-1). `describe-stacks … 2>/dev/null || echo GONE` collapsed throttling, blips and expired credentials into `GONE`; `cleanup()` then deleted two `pf-servicediscovery-*` stacks mid-create, and in one of them `reason_of` captured the real failure a moment later — proof from the run's own log that the stack still existed. The same collapse on `describe-stack-events` is worse than losing a run: an unreadable reason leaves `FTYPE`/`REASON` empty, the scaffolding guard silently no-ops, and a VPC-quota rollback reports `OK: verified`. Only `ValidationError … does not exist` means gone. Everything else is retried inside the poll budget and then reported under its own reason (`could not read the … status` / `… events`), never as `GONE` and never as a dirty fixture; a `LEFTOVER` line likewise needs a confirmed-present stack, not just a `wait` that failed. `bench/verify-rule.test.sh` pins all of it with a stubbed `aws` on `PATH` — 13 of its assertions fail against the pre-fix script.
 - **Probing the raw engine with custom rules**: the rule set must be named `violation` (`data.<pkg>.violation` is looked up; a `diagnostics` set fails with "not a valid rule path"), and hand-built diagnostic objects need lowercase severities (`error`, not `ERROR`/`CUSTOM` — those are display labels added by the wrapper). Pack rules never see this because `make_diag_full` handles the shape.
 - **`as` is a reserved keyword in the engine's Rego build** (measured 2026-09-06): `acts := object.get(s, "Action", null)` is fine but `as := ...` fails to parse ("unexpected keyword `as`") and, like every parse error, takes the whole custom package down — every rule stops firing, and the jest failure names an unrelated rule.
 - **A Managed Flink application deploys with no `ApplicationConfiguration` at all** (measured 2026-09-06), which is what makes `AWS::KinesisAnalyticsV2::Application` fixtures cheap: no S3 bucket, no JAR, no Glue database, just an IAM role the service can assume. Adding a "minimal" code stanza is worse than none — CreateApplication really fetches the S3 object (`We are unable to get the specified fileKey`) and rejects `PLAINTEXT` for a Flink runtime.

package/lib/index.js

@@ -17,7 +17,7 @@ const rules_generated_1 = require("./rules.generated");
  * Preflight.apply(app);
  */
 class Preflight {
-    static [JSII_RTTI_SYMBOL_1] = { fqn: "cdk-preflight.Preflight", version: "0.0.138" };
+    static [JSII_RTTI_SYMBOL_1] = { fqn: "cdk-preflight.Preflight", version: "0.0.140" };
     /**
      * Register the cdk-preflight rules on an App or Stage.
      */

package/package.json

@@ -89,7 +89,7 @@
   "publishConfig": {
     "access": "public"
   },
-  "version": "0.0.138",
+  "version": "0.0.140",
   "jest": {
     "coverageProvider": "v8",
     "coveragePathIgnorePatterns": [