cdk-preflight 0.0.161 → 0.0.162

package/.jsii

@@ -9600,6 +9600,6 @@
       "symbolId": "src/index:PreflightOptions"
     }
   },
-  "version": "0.0.161",
-  "fingerprint": "GPusYz6ZtAljYMDxthjYvzc7ijRZti6uRdndaygQ1Ac="
+  "version": "0.0.162",
+  "fingerprint": "Pfp2GqAs4BLa+XiX2a/e5b28jyuo8UfrMaGLok5/1QU="
 }

package/AGENTS.md

@@ -203,6 +203,7 @@ If you are a subagent running one of these phases, do not spawn further agents.
   - *Character classes are Unicode-aware.* `\w`, `\d` and `\s` match non-ASCII — `regex.match("[\\w]+", "テスト用")` is **true**. AWS API patterns like Cognito's `[\w\s+=,.@-]+` are ASCII-semantics, so copying one verbatim yields a rule that never fires. Write explicit ranges (`^[A-Za-z0-9_ \t+=,.@-]+$`).
   - *No lookahead/lookbehind.* ELBv2 publishes `(?!^-)(?!.*-$)^[A-Za-z0-9-]+$` for `targetGroupName`; that pattern does not compile here, and `regex.match` then returns false for **every** input — the rule fires on all values, which is worse than not firing. Rewrite without lookaround: `^[A-Za-z0-9]([A-Za-z0-9-]*[A-Za-z0-9])?$`.
 - **The absence sentinel must not be a string.** The `object.get(props, "<Key>", "__pf_absent")` idiom is only safe when the next step is `== "__pf_absent"`. If the next step is `is_string(v)` followed by a format check, an *absent* key yields the sentinel string and the rule fires on every resource that omits the property. Use `null` as the default in that case — `is_string(null)` is false, so the rule skips. (This produced three false-positive rules in the 2026-09-04 batch, visible only because other rules' pass fixtures went red.)
+- **`not <undefined>` is true, so a helper that declines makes the rule fire on everything.** Rego's negation succeeds when its operand is undefined, so `not a in _helper(x)` passes whenever `_helper(x)` is undefined — not just when `a` is missing from it. Helpers guard their input (`is_array`, `is_object`, an unresolved `Fn::If` marker) precisely so they decline on the values a rule should skip, and writing the negation inline turns that guard inside out into a false positive on every such resource. Bind first — `defined := _helper(x)` on its own line, then `not a in defined` — so the body goes undefined and the rule stays silent when the helper declines. **Neither fixture catches this**: both templates carry a value the helper accepts, so only a false-positive sweep over unrelated templates finds it. Measured twice on 2026-09-25: the OpenSearch Serverless policy rules fired on the `Fn::Join`+`Ref` policies CDK ordinarily emits (#268), and the Network Firewall custom-action rules fired on every stateless rule group (#280).
 - **Two bare `some x` declarations in one rule body take the whole pack down** (measured 2026-09-09, 1.7.0-beta): the engine defines the second one's local slot once per binding of the first, so as soon as the outer iteration yields two values the custom package dies with `duplicated definition of local variable <name>` — every rule stops firing, for every stack, and `exclude` cannot work around it because the package fails as a whole. One filter entry passed, two did not (issue #150). Write the second iteration as `some k, v in coll` (guarded by `is_array` / `is_object`, since `some .. in` on a scalar is itself a hard error); converting either of the two is enough. `test/structure.test.ts` fails the build on any body with two bare `some`s. Reference: `pf-wafv2-logging-filter-condition`.
 - **A fixture with a single-element array does not exercise the rule's iteration.** The bug above shipped because both templates of the rule carried one `Filters[]` entry. Give the pass template two entries whenever a rule walks a nested array.
 - **Iterating a scalar with `some .. in` is a hard evaluation error, not undefined** ("`some .. in collection` expects array/set/object. Got `true`", measured 2026-09-05) — and it takes the *whole* custom package down, every rule. Any `some k, v in x` over a value read out of user JSON needs an `is_object(x)` / `is_array(x)` guard first.

package/lib/index.js

@@ -17,7 +17,7 @@ const rules_generated_1 = require("./rules.generated");
  * Preflight.apply(app);
  */
 class Preflight {
-    static [JSII_RTTI_SYMBOL_1] = { fqn: "cdk-preflight.Preflight", version: "0.0.161" };
+    static [JSII_RTTI_SYMBOL_1] = { fqn: "cdk-preflight.Preflight", version: "0.0.162" };
     /**
      * Register the cdk-preflight rules on an App or Stage.
      */

package/package.json

@@ -89,7 +89,7 @@
   "publishConfig": {
     "access": "public"
   },
-  "version": "0.0.161",
+  "version": "0.0.162",
   "jest": {
     "coverageProvider": "v8",
     "coveragePathIgnorePatterns": [