cdk-preflight 0.0.82 → 0.0.83

package/.jsii

@@ -9599,6 +9599,6 @@
       "symbolId": "src/index:PreflightOptions"
     }
   },
-  "version": "0.0.82",
-  "fingerprint": "0BDPdPdA6URoRAPMl509DD3MyD7SF71W8GWzyBN+YiI="
+  "version": "0.0.83",
+  "fingerprint": "oCC3Y5cEPVzouPh3RrtI/8WLvhkhHzMNqHNb7viJs+g="
 }

package/AGENTS.md

@@ -146,6 +146,8 @@ bench/                      # real-deploy verification (needs an AWS account; no
   - *Character classes are Unicode-aware.* `\w`, `\d` and `\s` match non-ASCII — `regex.match("[\\w]+", "テスト用")` is **true**. AWS API patterns like Cognito's `[\w\s+=,.@-]+` are ASCII-semantics, so copying one verbatim yields a rule that never fires. Write explicit ranges (`^[A-Za-z0-9_ \t+=,.@-]+$`).
   - *No lookahead/lookbehind.* ELBv2 publishes `(?!^-)(?!.*-$)^[A-Za-z0-9-]+$` for `targetGroupName`; that pattern does not compile here, and `regex.match` then returns false for **every** input — the rule fires on all values, which is worse than not firing. Rewrite without lookaround: `^[A-Za-z0-9]([A-Za-z0-9-]*[A-Za-z0-9])?$`.
 - **The absence sentinel must not be a string.** The `object.get(props, "<Key>", "__pf_absent")` idiom is only safe when the next step is `== "__pf_absent"`. If the next step is `is_string(v)` followed by a format check, an *absent* key yields the sentinel string and the rule fires on every resource that omits the property. Use `null` as the default in that case — `is_string(null)` is false, so the rule skips. (This produced three false-positive rules in the 2026-09-04 batch, visible only because other rules' pass fixtures went red.)
+- **Two bare `some x` declarations in one rule body take the whole pack down** (measured 2026-09-09, 1.7.0-beta): the engine defines the second one's local slot once per binding of the first, so as soon as the outer iteration yields two values the custom package dies with `duplicated definition of local variable <name>` — every rule stops firing, for every stack, and `exclude` cannot work around it because the package fails as a whole. One filter entry passed, two did not (issue #150). Write the second iteration as `some k, v in coll` (guarded by `is_array` / `is_object`, since `some .. in` on a scalar is itself a hard error); converting either of the two is enough. `test/structure.test.ts` fails the build on any body with two bare `some`s. Reference: `pf-wafv2-logging-filter-condition`.
+- **A fixture with a single-element array does not exercise the rule's iteration.** The bug above shipped because both templates of the rule carried one `Filters[]` entry. Give the pass template two entries whenever a rule walks a nested array.
 - **Iterating a scalar with `some .. in` is a hard evaluation error, not undefined** ("`some .. in collection` expects array/set/object. Got `true`", measured 2026-09-05) — and it takes the *whole* custom package down, every rule. Any `some k, v in x` over a value read out of user JSON needs an `is_object(x)` / `is_array(x)` guard first.
 - **A bare `%` in a `sprintf` format string silently kills the rule** (measured 2026-09-05): `% ` is an invalid verb, `sprintf` is undefined, the body fails, nothing fires and nothing errors. Write `%%` in messages that mention percent signs.
 - **Missing builtins (measured 2026-09-05)**: `walk`, `graph.reachable`, `time.parse_rfc3339_ns`, `glob.match`, and `every` inside a comprehension all fail to evaluate. Reachability has to be approximated (no-incoming-edge, `pf-sfn-asl-unreachable-state`), nesting expanded to a fixed depth (`rules/_lib/sfn.rego`), timestamps matched with a regex. Present and working: `object.keys`, `object.get` with a path array, `regex.find_n`, `numbers.range`, `array.slice`, `json.marshal`, `object.union`, `strings.count`, `indexof`, `substring`.

package/lib/index.js

@@ -17,7 +17,7 @@ const rules_generated_1 = require("./rules.generated");
  * Preflight.apply(app);
  */
 class Preflight {
-    static [JSII_RTTI_SYMBOL_1] = { fqn: "cdk-preflight.Preflight", version: "0.0.82" };
+    static [JSII_RTTI_SYMBOL_1] = { fqn: "cdk-preflight.Preflight", version: "0.0.83" };
     /**
      * Register the cdk-preflight rules on an App or Stage.
      */