cdk-preflight 0.0.158 → 0.0.159

package/.jsii

@@ -9600,6 +9600,6 @@
       "symbolId": "src/index:PreflightOptions"
     }
   },
-  "version": "0.0.158",
-  "fingerprint": "m9vWzrW3d18LT2GCNqYQxBShwcyyzGvqC/yGwl6uWPw="
+  "version": "0.0.159",
+  "fingerprint": "boVz9qpwLW8cANQn58iaC89O3udlxOJbvYUo9DKHIpM="
 }

package/AGENTS.md

@@ -153,7 +153,7 @@ If you are a subagent running one of these phases, do not spawn further agents.
      | `flatten_list()` の `it.value` の入れ子 | **真の枝に潰れて消える** | `__dynamic` が残る |
      | `resolve()` | **真の枝に潰れて消える** | **undefined**（ルールごと降りる） |
 
-     So `_pf_countable_items()` earns its place on a **raw** read (it catches both) and on a `flatten_list` value (it catches the `Ref` half via `is_array`); after `resolve()` it can only repeat an `is_array()` you should already have. The `Fn::If` over-count on a `flatten_list` / `resolve` value is **not fixed and not detectable** from those paths — it needs a raw lookup by path, which is what `_pf_countable_list(name, path)` does. Two more measurements worth knowing: `Fn::Split` over a *literal* string is expanded into a real array in the raw document (only `Fn::Split` over a `Ref` stays a marker), and `resolve()` of an `Fn::GetAtt` returns a 2-key marker object, so `count()` on it silently yields 2.
+     So `_pf_countable_items()` earns its place on a **raw** read (it catches both) and on a `flatten_list` value (it catches the `Ref` half via `is_array`); after `resolve()` it can only repeat an `is_array()` you should already have. **`_pf_unconditional_items()` is only worth writing on a raw read** — on a `flatten_list` value it rejects nothing (the `Fn::If` is gone, and a `Ref` marker is exactly the "present" case the gate wants), so it reads as protection while passing every input (measured 2026-09-24; four CloudFront rules were written that way and the lines were removed again). The `Fn::If` over-count on a `flatten_list` / `resolve` value is **not fixed and not detectable** from those paths — it needs a raw lookup by path, which is what `_pf_countable_list(name, path)` does. Two more measurements worth knowing: `Fn::Split` over a *literal* string is expanded into a real array in the raw document (only `Fn::Split` over a `Ref` stays a marker), and `resolve()` of an `Fn::GetAtt` returns a 2-key marker object, so `count()` on it silently yields 2.
    - **`count(...) < N` minimum checks need no guard.** An over-count can only push the count up, and if the counted `k` is already below `N` then the deployed count (`<= k`) is below it too — the diagnosis holds. Guarding there only buys a false negative. `< 1` is the same thing as `== 0`.
    - **Intrinsics inside `input.resources` values are marker objects, never strings** (measured 2026-09-03, 1.7.0-beta): `Fn::GetAtt` appears as `{"__kind": "getatt:Arn", "__ref": "B"}` and `Fn::Sub` as `{"__dynamic": "Sub:..."}` at any nesting depth. A plain `is_string(v)` guard therefore safely mutes rules that judge string shapes (ARN format, prefixes) on values users wired via intrinsics — no logical-ID false positives. Reference implementations: `pf-iam-policy-resource-format`, `pf-iam-policy-action-format`.
    - **Dynamic reference strings are markerized too** (measured 2026-09-03): a literal `{{resolve:ssm:/path}}` property value surfaces as `{"__dynamic": "dynamic reference: {{resolve:ssm:/path}}", "__param_type": "String"}` and `resolve()` is undefined for it. A rule that judges the reference text itself (e.g. the SSM parameter path) must read the raw property with `object.get` and extract the `__dynamic` string. Reference implementation: `pf-ec2-instance-ami-arch`.

package/lib/index.js

@@ -17,7 +17,7 @@ const rules_generated_1 = require("./rules.generated");
  * Preflight.apply(app);
  */
 class Preflight {
-    static [JSII_RTTI_SYMBOL_1] = { fqn: "cdk-preflight.Preflight", version: "0.0.158" };
+    static [JSII_RTTI_SYMBOL_1] = { fqn: "cdk-preflight.Preflight", version: "0.0.159" };
     /**
      * Register the cdk-preflight rules on an App or Stage.
      */