cdk-preflight 0.0.87 → 0.0.89

package/.jsii

@@ -9391,7 +9391,7 @@
     "stability": "stable"
   },
   "homepage": "https://github.com/badmintoncryer/cdk-preflight.git",
-  "jsiiVersion": "5.8.27 (build aebddcd)",
+  "jsiiVersion": "6.0.13 (build 5c05d06)",
   "keywords": [
     "aws",
     "aws-cdk",
@@ -9411,11 +9411,12 @@
         "hasDefaultInterfaces": true
       }
     },
-    "tscRootDir": "/home/runner/work/cdk-preflight/cdk-preflight/src"
+    "tscOutDir": "lib",
+    "tscRootDir": "src"
   },
   "name": "cdk-preflight",
   "readme": {
-    "markdown": "<p align=\"center\">\n  <img src=\"https://raw.githubusercontent.com/badmintoncryer/cdk-preflight/main/assets/logo.png\" alt=\"cdk-preflight\" width=\"104\" height=\"104\">\n</p>\n\n<h1 align=\"center\">cdk-preflight</h1>\n\n<p align=\"center\">\n  <strong>Catch deploy-time CloudFormation failures at <code>cdk synth</code> time.</strong>\n</p>\n\n<p align=\"center\">\n  <a href=\"https://github.com/badmintoncryer/cdk-preflight/actions/workflows/monthly-verify.yml\"><img src=\"https://github.com/badmintoncryer/cdk-preflight/actions/workflows/monthly-verify.yml/badge.svg\" alt=\"monthly real-deploy verification\"></a>\n  <a href=\"https://www.npmjs.com/package/cdk-preflight\"><img src=\"https://img.shields.io/npm/v/cdk-preflight.svg\" alt=\"npm version\"></a>\n  <a href=\"https://www.npmjs.com/package/cdk-preflight\"><img src=\"https://img.shields.io/npm/dt/cdk-preflight.svg\" alt=\"npm total downloads\"></a>\n</p>\n\nSome CloudFormation constraints are not expressed in resource provider schemas — they live only in documentation, in service API validation, or across multiple properties. Templates that violate them pass `cdk synth`, pass CloudFormation pre-deployment validation, and then fail minutes into a deployment, burning a rollback cycle.\n\ncdk-preflight is a curated [Rego rule pack](docs/rules.md) for exactly those constraints, evaluated with the CloudFormation validation engine that ships inside `aws-cdk-lib` (>= 2.267.0). By default a violation **fails `cdk synth`** — a template that is known to fail at deploy time never leaves your machine.\n\nThe pack aims at **every deploy-time failure that no existing CDK mechanism already catches** — nothing narrower. Every bundled rule is backed by a `fail`/`pass` template pair, and the failure has been reproduced against real AWS. The handful of rules that could not be reproduced are marked `doc-only` and report as **warnings**: they show up in the validation report but never fail synth. Rules that the built-in validation engine already covers are deliberately **not** duplicated — a test suite enforces this.\n\n> **Requires `aws-cdk-lib` >= 2.267.0** (released 2026-08-27) — the first release that bundles\n> the CloudFormation validation engine. On older versions the rules cannot run at all.\n\n## Quick start\n\n```bash\nnpm i -D cdk-preflight\nnpx cdkpf init   # inserts Preflight.apply(app) into your CDK app\n                         # (`npx cdkpf init` is the same command, shorter)\n```\n\nor add one line yourself:\n\n```ts\nimport { Preflight } from 'cdk-preflight';\n\nconst app = new App();\nPreflight.apply(app);\n```\n\nOn violation, `cdk synth` fails with one error per finding, including the construct trace:\n\n```text\nERROR idle_timeout.timeout_seconds is 5000 but must be between 1 and 4000 seconds (cdk-preflight)\n   MyStack/Alb/Resource (Alb16C2F182) aws-cdk-lib.aws_elasticloadbalancingv2.CfnLoadBalancer\n\nSynthesis finished with errors\n```\n\n## What it catches\n\nFour ordinary-looking snippets. All of them pass `cdk synth` and CloudFormation\npre-deployment validation, and all of them fail minutes into a deployment:\n\n```ts\n// 1) pf-iam-inline-policy-size — enumerate buckets, grant each one, blow past 10,240 chars\n//    \"Maximum policy size of 10240 bytes exceeded for role IngestRole\"\n//    (via role.addToPolicy the CDK auto-splits into managed policies instead,\n//     and you hit the 6,144-char limit as pf-iam-managed-policy-size)\nnew iam.Policy(this, 'IngestPolicy', {\n  roles: [role],\n  statements: [new iam.PolicyStatement({\n    actions: ['s3:GetObject', 's3:ListBucket'],\n    resources: Array.from({ length: 200 },\n      (_, i) => `arn:aws:s3:::data-lake-landing-zone-${i}/year=*/month=*/*`),\n  })],\n});\n\n// 2) pf-lambda-env-size — a config blob in the environment, over the 4KB total\n//    \"Lambda was unable to configure your environment variables because the\n//     environment variables you have provided exceeded the 4KB limit\"\nnew lambda.Function(this, 'Fn', {\n  runtime: lambda.Runtime.NODEJS_22_X,\n  handler: 'index.handler',\n  code: lambda.Code.fromInline('exports.handler = async () => {};'),\n  environment: { FEATURE_FLAGS: JSON.stringify(bigFeatureFlagMap) },\n});\n\n// 3) pf-sfn-asl-missing-state (+ pf-sfn-asl-unreachable-state) — a typo in a state name\n//    \"Invalid State Machine Definition: 'MISSING_TRANSITION_TARGET: ...'\"\nnew sfn.StateMachine(this, 'Pipeline', {\n  definitionBody: sfn.DefinitionBody.fromString(JSON.stringify({\n    StartAt: 'Validate',\n    States: {\n      Validate: { Type: 'Pass', Next: 'Transform' },\n      Trasform: { Type: 'Pass', End: true },   // typo: Transform\n    },\n  })),\n});\n\n// 4) pf-logs-filter-pattern-bracket — a filter pattern opened with '[' and never closed\n//    \"If a filter pattern starts with '[' it must end with ']'\"\nnew logs.MetricFilter(this, 'ErrorFilter', {\n  logGroup,\n  metricNamespace: 'Pipeline',\n  metricName: 'Errors',\n  filterPattern: logs.FilterPattern.literal('[time, level=ERROR, msg'),\n});\n```\n\nNone of these are type errors, so the L2 constructs accept them; none of them are\nexpressible in a resource schema, so CloudFormation accepts the template. With\n`Preflight.apply(app)` in place they fail `cdk synth` instead.\n\n## Observe-only mode\n\nTo roll the rules out gradually, start with `enforce: false`: findings then surface as synth **warnings** through the CDK built-in validator, with construct traces and per-finding acknowledgement:\n\n```ts\nPreflight.apply(app, { enforce: false });\n```\n\n```text\nWARNING idle_timeout.timeout_seconds is 5000 but must be between 1 and 4000 seconds (CloudFormation Validate)\n   MyStack/Alb (Alb) aws-cdk-lib.aws_elasticloadbalancingv2.CfnLoadBalancer\n   Acknowledge with 'CloudFormation-Validate::pf-elbv2-lb-idle-timeout-range'\n```\n\n> **Known limitation with stages.** The AWS CDK CLI drops validation findings for stacks nested in a `Stage`\n> before printing them, so in observe-only mode those findings appear **only** in `cdk.out/validation-report.json`\n> and never on the console. Enforce mode is not affected: cdk-preflight reports such findings itself and fails\n> synthesis. This is a CLI-side bug (present since aws-cdk 2.1128.1), not a rule evaluation problem.\n\n> **If the rules cannot run, the build stops.** When the evaluation engine fails on a template (a rule pack that\n> does not compile, an engine bug), enforce mode reports it as a violation named `pf-engine-error` and fails\n> synthesis for that stack instead of passing green with no rule having run. The other stacks keep their rules.\n> `pf-engine-error` is not a bundled rule and cannot be `exclude`d; `enforce: false` unblocks the build if you\n> need one.\n\n| Option | Default | Effect |\n|---|---|---|\n| `enforce` | `true` | Violations of bundled rules fail synthesis; set to `false` to only warn |\n| `strict` | `false` | With `enforce`: also fail on error-class findings (`ERROR`/`FATAL`, e.g. `F3034`) of the built-in validation engine itself, which the CDK currently downgrades to warnings |\n| `exclude` | `[]` | Rule ids to disable |\n| `includeUpstreamPending` | `true` | Include rules already proposed to the upstream engine but not yet merged |\n\nTo opt out of a single rule everywhere, pass its id in `exclude`. To suppress a\nsingle *finding* on one construct, acknowledge it — this works in both modes, the\nid prefix just differs (`cdk-preflight::` when enforcing, `CloudFormation-Validate::`\nin observe-only, as printed in the warning text):\n\n```ts\ncdk.Validations.of(errorFilter).acknowledge({\n  id: 'cdk-preflight::pf-logs-filter-pattern-bracket',\n  reason: 'log group is written by a legacy producer; pattern is fixed upstream',\n});\n```\n\n## Bundled rules\n\nSee [docs/rules.md](docs/rules.md) for the generated rule table. Highlights:\n\n- **ELBv2**: `idle_timeout` / `deregistration_delay` / `slow_start` attribute ranges (stringly-typed Key/Value attributes are invisible to schema validation)\n- **IAM**: managed (6,144 chars) and inline (role/group/user) policy document size limits\n- **CloudFront**: `MinTTL <= DefaultTTL <= MaxTTL` ordering, ACM certificates must live in `us-east-1`\n- **Step Functions**: `Next`/`Default`/`Choices` must reference defined states (a dangling `StartAt` is already caught by the engine's built-in `E3601`)\n- **EC2**: security group TCP/UDP port ranges and `FromPort <= ToPort`\n\n## For AI agents\n\nTo add cdk-preflight to a CDK app:\n\n1. `npm i -D cdk-preflight`\n2. `npx cdk-preflight init` — or the shorter alias `npx cdkpf init` (finds the entry point via `cdk.json` and inserts `Preflight.apply(app)`; use `--dry-run` to preview)\n3. Run `cdk synth`. Violations fail the synth with a validation report; each finding carries a rule id, the actual value, and a suggested fix\n4. To fix a finding, prefer correcting the resource. To opt out instead: `exclude: ['<rule-id>']` disables one rule, `enforce: false` switches to warn-only reporting\n\nThe machine-readable findings are written to `cdk.out/validation-report.json` when synthesizing with `-c @aws-cdk/core:validationReportJson=true`.\n\n### Report missed deploy errors\n\ncdk-preflight only knows the failure modes it has benched. When a deploy fails on a constraint the pack should have caught, that report is how new rules get added — but at that moment cdk-preflight is out of the loop (it passed the synth), so the instruction has to already sit in your agent's context. Paste this into your repository's `AGENTS.md` (or `CLAUDE.md`):\n\n```markdown\n## cdk-preflight: report missed deploy errors\n\nIf `cdk deploy` fails even though `cdk synth` (with cdk-preflight enabled) passed,\nand the failure is a service-side validation rejection — CREATE_FAILED/UPDATE_FAILED\nwith a 400-class message such as \"Invalid request provided: ...\" — cdk-preflight is\nmissing a rule. Report it:\n\n1. Qualify first. NOT reportable: AccessDenied / permissions, service quotas,\n   throttling, name conflicts with existing resources, stabilization timeouts.\n2. Redact account-specific data (account IDs -> 123456789012, real ARNs/domains\n   -> placeholders).\n3. Search existing issues: https://github.com/badmintoncryer/cdk-preflight/issues\n4. With your user's approval, open a \"Missed deploy error\" issue with the verbatim\n   error message, the resource type, a minimal template snippet, and your\n   aws-cdk-lib / cdk-preflight versions.\n```\n\n## Scope and rule lifecycle\n\nA constraint belongs in the pack when violating it makes a real deployment fail *and* no layer that sees the same synthesized template already blocks it. There is no further \"is this worth a rule\" question — if the gap is real, it gets a rule.\n\nCDK L2 construct validation is deliberately **not** one of those layers. `CfnXxx` usage, escape hatches, `addPropertyOverride`, `cloudformation-include` and migrated templates all bypass L2, so an L2 guard covering the same mistake neither disqualifies a rule nor retires one.\n\nThat makes growth the normal state, and it has a consequence worth knowing before you upgrade: **new rules land in minor releases, so a minor upgrade can newly fail a `cdk synth` that passed yesterday.** That is intended, not a regression. If you need a frozen rule set, pin the version; to drop a single rule, `exclude: ['<rule-id>']`; to see everything without failing the build, `enforce: false`.\n\nRules move the other way too. Once the validation engine bundled in `aws-cdk-lib` (or CloudFormation's own pre-deploy validation) starts blocking a constraint, the rule is deleted rather than kept as a duplicate — staying on an older `aws-cdk-lib` and an older cdk-preflight keeps the old behavior.\n\n## How it works\n\n`Preflight.apply()` evaluates the rules with the [cloudformation-validate](https://github.com/aws-cloudformation/cloudformation-validate) Rust/WASM engine that ships inside `aws-cdk-lib` — no extra binaries, no network access at synth time. In the default enforce mode the engine is invoked through a dedicated CDK validation plugin so that violations fail synthesis; with `enforce: false` the rules are instead injected into the CDK built-in `CloudFormationValidatePlugin` and reported as warnings.\n\nConstraints that *can* be expressed in schemas or generic engine rules also make good upstream PRs to that engine, but nothing here waits on one — the upstream release cycle is deliberately slower than this pack's. Each rule's `meta.yaml` tracks its upstream status so that retirement stays bookkeeping.\n\n## Requirements\n\n- `aws-cdk-lib` >= 2.267.0, released 2026-08-27 (the first release that bundles the built-in CloudFormation validator). This is a recent release — an existing CDK app may need an upgrade before cdk-preflight can run.\n\n## Contributing\n\nRule authoring, the verification gates (including real-deploy reproduction), and the test layout are documented in [AGENTS.md](AGENTS.md) — written for AI coding agents and humans alike.\n\n## License\n\nApache-2.0\n"
+    "markdown": "<p align=\"center\">\n  <img src=\"https://raw.githubusercontent.com/badmintoncryer/cdk-preflight/main/assets/logo.png\" alt=\"cdk-preflight\" width=\"104\" height=\"104\">\n</p>\n\n<h1 align=\"center\">cdk-preflight</h1>\n\n<p align=\"center\">\n  <strong>Catch deploy-time CloudFormation failures at <code>cdk synth</code> time.</strong>\n</p>\n\n<p align=\"center\">\n  <a href=\"https://github.com/badmintoncryer/cdk-preflight/actions/workflows/monthly-verify.yml\"><img src=\"https://github.com/badmintoncryer/cdk-preflight/actions/workflows/monthly-verify.yml/badge.svg\" alt=\"monthly real-deploy verification\"></a>\n  <a href=\"https://www.npmjs.com/package/cdk-preflight\"><img src=\"https://img.shields.io/npm/v/cdk-preflight.svg\" alt=\"npm version\"></a>\n  <a href=\"https://www.npmjs.com/package/cdk-preflight\"><img src=\"https://img.shields.io/npm/dt/cdk-preflight.svg\" alt=\"npm total downloads\"></a>\n  <a href=\"docs/rules.md\"><img src=\"https://img.shields.io/badge/rules-1844-blue\" alt=\"1844 bundled rules\"></a>\n</p>\n\nSome CloudFormation constraints are not expressed in resource provider schemas — they live only in documentation, in service API validation, or across multiple properties. Templates that violate them pass `cdk synth`, pass CloudFormation pre-deployment validation, and then fail minutes into a deployment, burning a rollback cycle.\n\ncdk-preflight is a curated [Rego rule pack](docs/rules.md) for exactly those constraints, evaluated with the CloudFormation validation engine that ships inside `aws-cdk-lib` (>= 2.267.0). By default a violation **fails `cdk synth`** — a template that is known to fail at deploy time never leaves your machine.\n\nThe pack aims at **every deploy-time failure that no existing CDK mechanism already catches** — nothing narrower. Every bundled rule is backed by a `fail`/`pass` template pair, and the failure has been reproduced against real AWS. The handful of rules that could not be reproduced are marked `doc-only` and report as **warnings**: they show up in the validation report but never fail synth. Rules that the built-in validation engine already covers are deliberately **not** duplicated — a test suite enforces this.\n\n> **Requires `aws-cdk-lib` >= 2.267.0** (released 2026-08-27) — the first release that bundles\n> the CloudFormation validation engine. On older versions the rules cannot run at all.\n\n## Quick start\n\n```bash\nnpm i -D cdk-preflight\nnpx cdkpf init   # inserts Preflight.apply(app) into your CDK app\n                         # (`npx cdkpf init` is the same command, shorter)\n```\n\nor add one line yourself:\n\n```ts\nimport { Preflight } from 'cdk-preflight';\n\nconst app = new App();\nPreflight.apply(app);\n```\n\nOn violation, `cdk synth` fails with one error per finding, including the construct trace:\n\n```text\nERROR idle_timeout.timeout_seconds is 5000 but must be between 1 and 4000 seconds (cdk-preflight)\n   MyStack/Alb/Resource (Alb16C2F182) aws-cdk-lib.aws_elasticloadbalancingv2.CfnLoadBalancer\n\nSynthesis finished with errors\n```\n\n## What it catches\n\nFour ordinary-looking snippets. All of them pass `cdk synth` and CloudFormation\npre-deployment validation, and all of them fail minutes into a deployment:\n\n```ts\n// 1) pf-iam-inline-policy-size — enumerate buckets, grant each one, blow past 10,240 chars\n//    \"Maximum policy size of 10240 bytes exceeded for role IngestRole\"\n//    (via role.addToPolicy the CDK auto-splits into managed policies instead,\n//     and you hit the 6,144-char limit as pf-iam-managed-policy-size)\nnew iam.Policy(this, 'IngestPolicy', {\n  roles: [role],\n  statements: [new iam.PolicyStatement({\n    actions: ['s3:GetObject', 's3:ListBucket'],\n    resources: Array.from({ length: 200 },\n      (_, i) => `arn:aws:s3:::data-lake-landing-zone-${i}/year=*/month=*/*`),\n  })],\n});\n\n// 2) pf-lambda-env-size — a config blob in the environment, over the 4KB total\n//    \"Lambda was unable to configure your environment variables because the\n//     environment variables you have provided exceeded the 4KB limit\"\nnew lambda.Function(this, 'Fn', {\n  runtime: lambda.Runtime.NODEJS_22_X,\n  handler: 'index.handler',\n  code: lambda.Code.fromInline('exports.handler = async () => {};'),\n  environment: { FEATURE_FLAGS: JSON.stringify(bigFeatureFlagMap) },\n});\n\n// 3) pf-sfn-asl-missing-state (+ pf-sfn-asl-unreachable-state) — a typo in a state name\n//    \"Invalid State Machine Definition: 'MISSING_TRANSITION_TARGET: ...'\"\nnew sfn.StateMachine(this, 'Pipeline', {\n  definitionBody: sfn.DefinitionBody.fromString(JSON.stringify({\n    StartAt: 'Validate',\n    States: {\n      Validate: { Type: 'Pass', Next: 'Transform' },\n      Trasform: { Type: 'Pass', End: true },   // typo: Transform\n    },\n  })),\n});\n\n// 4) pf-logs-filter-pattern-bracket — a filter pattern opened with '[' and never closed\n//    \"If a filter pattern starts with '[' it must end with ']'\"\nnew logs.MetricFilter(this, 'ErrorFilter', {\n  logGroup,\n  metricNamespace: 'Pipeline',\n  metricName: 'Errors',\n  filterPattern: logs.FilterPattern.literal('[time, level=ERROR, msg'),\n});\n```\n\nNone of these are type errors, so the L2 constructs accept them; none of them are\nexpressible in a resource schema, so CloudFormation accepts the template. With\n`Preflight.apply(app)` in place they fail `cdk synth` instead.\n\n## Observe-only mode\n\nTo roll the rules out gradually, start with `enforce: false`: findings then surface as synth **warnings** through the CDK built-in validator, with construct traces and per-finding acknowledgement:\n\n```ts\nPreflight.apply(app, { enforce: false });\n```\n\n```text\nWARNING idle_timeout.timeout_seconds is 5000 but must be between 1 and 4000 seconds (CloudFormation Validate)\n   MyStack/Alb (Alb) aws-cdk-lib.aws_elasticloadbalancingv2.CfnLoadBalancer\n   Acknowledge with 'CloudFormation-Validate::pf-elbv2-lb-idle-timeout-range'\n```\n\n> **Known limitation with stages.** The AWS CDK CLI drops validation findings for stacks nested in a `Stage`\n> before printing them, so in observe-only mode those findings appear **only** in `cdk.out/validation-report.json`\n> and never on the console. Enforce mode is not affected: cdk-preflight reports such findings itself and fails\n> synthesis. This is a CLI-side bug (present since aws-cdk 2.1128.1), not a rule evaluation problem.\n\n> **If the rules cannot run, the build stops.** When the evaluation engine fails on a template (a rule pack that\n> does not compile, an engine bug), enforce mode reports it as a violation named `pf-engine-error` and fails\n> synthesis for that stack instead of passing green with no rule having run. The other stacks keep their rules.\n> `pf-engine-error` is not a bundled rule and cannot be `exclude`d; `enforce: false` unblocks the build if you\n> need one.\n\n| Option | Default | Effect |\n|---|---|---|\n| `enforce` | `true` | Violations of bundled rules fail synthesis; set to `false` to only warn |\n| `strict` | `false` | With `enforce`: also fail on error-class findings (`ERROR`/`FATAL`, e.g. `F3034`) of the built-in validation engine itself, which the CDK currently downgrades to warnings |\n| `exclude` | `[]` | Rule ids to disable |\n| `includeUpstreamPending` | `true` | Include rules already proposed to the upstream engine but not yet merged |\n\nTo opt out of a single rule everywhere, pass its id in `exclude`. To suppress a\nsingle *finding* on one construct, acknowledge it — this works in both modes, the\nid prefix just differs (`cdk-preflight::` when enforcing, `CloudFormation-Validate::`\nin observe-only, as printed in the warning text):\n\n```ts\ncdk.Validations.of(errorFilter).acknowledge({\n  id: 'cdk-preflight::pf-logs-filter-pattern-bracket',\n  reason: 'log group is written by a legacy producer; pattern is fixed upstream',\n});\n```\n\n## Bundled rules\n\nSee [docs/rules.md](docs/rules.md) for the generated rule table. Highlights:\n\n- **ELBv2**: `idle_timeout` / `deregistration_delay` / `slow_start` attribute ranges (stringly-typed Key/Value attributes are invisible to schema validation)\n- **IAM**: managed (6,144 chars) and inline (role/group/user) policy document size limits\n- **CloudFront**: `MinTTL <= DefaultTTL <= MaxTTL` ordering, ACM certificates must live in `us-east-1`\n- **Step Functions**: `Next`/`Default`/`Choices` must reference defined states (a dangling `StartAt` is already caught by the engine's built-in `E3601`)\n- **EC2**: security group TCP/UDP port ranges and `FromPort <= ToPort`\n\n## For AI agents\n\nTo add cdk-preflight to a CDK app:\n\n1. `npm i -D cdk-preflight`\n2. `npx cdk-preflight init` — or the shorter alias `npx cdkpf init` (finds the entry point via `cdk.json` and inserts `Preflight.apply(app)`; use `--dry-run` to preview)\n3. Run `cdk synth`. Violations fail the synth with a validation report; each finding carries a rule id, the actual value, and a suggested fix\n4. To fix a finding, prefer correcting the resource. To opt out instead: `exclude: ['<rule-id>']` disables one rule, `enforce: false` switches to warn-only reporting\n\nThe machine-readable findings are written to `cdk.out/validation-report.json` when synthesizing with `-c @aws-cdk/core:validationReportJson=true`.\n\n### Report missed deploy errors\n\ncdk-preflight only knows the failure modes it has benched. When a deploy fails on a constraint the pack should have caught, that report is how new rules get added — but at that moment cdk-preflight is out of the loop (it passed the synth), so the instruction has to already sit in your agent's context. Paste this into your repository's `AGENTS.md` (or `CLAUDE.md`):\n\n```markdown\n## cdk-preflight: report missed deploy errors\n\nIf `cdk deploy` fails even though `cdk synth` (with cdk-preflight enabled) passed,\nand the failure is a service-side validation rejection — CREATE_FAILED/UPDATE_FAILED\nwith a 400-class message such as \"Invalid request provided: ...\" — cdk-preflight is\nmissing a rule. Report it:\n\n1. Qualify first. NOT reportable: AccessDenied / permissions, service quotas,\n   throttling, name conflicts with existing resources, stabilization timeouts.\n2. Redact account-specific data (account IDs -> 123456789012, real ARNs/domains\n   -> placeholders).\n3. Search existing issues: https://github.com/badmintoncryer/cdk-preflight/issues\n4. With your user's approval, open a \"Missed deploy error\" issue with the verbatim\n   error message, the resource type, a minimal template snippet, and your\n   aws-cdk-lib / cdk-preflight versions.\n```\n\n## Scope and rule lifecycle\n\nA constraint belongs in the pack when violating it makes a real deployment fail *and* no layer that sees the same synthesized template already blocks it. There is no further \"is this worth a rule\" question — if the gap is real, it gets a rule.\n\nCDK L2 construct validation is deliberately **not** one of those layers. `CfnXxx` usage, escape hatches, `addPropertyOverride`, `cloudformation-include` and migrated templates all bypass L2, so an L2 guard covering the same mistake neither disqualifies a rule nor retires one.\n\nThat makes growth the normal state, and it has a consequence worth knowing before you upgrade: **new rules land in minor releases, so a minor upgrade can newly fail a `cdk synth` that passed yesterday.** That is intended, not a regression. If you need a frozen rule set, pin the version; to drop a single rule, `exclude: ['<rule-id>']`; to see everything without failing the build, `enforce: false`.\n\nRules move the other way too. Once the validation engine bundled in `aws-cdk-lib` (or CloudFormation's own pre-deploy validation) starts blocking a constraint, the rule is deleted rather than kept as a duplicate — staying on an older `aws-cdk-lib` and an older cdk-preflight keeps the old behavior.\n\n## How it works\n\n`Preflight.apply()` evaluates the rules with the [cloudformation-validate](https://github.com/aws-cloudformation/cloudformation-validate) Rust/WASM engine that ships inside `aws-cdk-lib` — no extra binaries, no network access at synth time. In the default enforce mode the engine is invoked through a dedicated CDK validation plugin so that violations fail synthesis; with `enforce: false` the rules are instead injected into the CDK built-in `CloudFormationValidatePlugin` and reported as warnings.\n\nConstraints that *can* be expressed in schemas or generic engine rules also make good upstream PRs to that engine, but nothing here waits on one — the upstream release cycle is deliberately slower than this pack's. Each rule's `meta.yaml` tracks its upstream status so that retirement stays bookkeeping.\n\n## Requirements\n\n- `aws-cdk-lib` >= 2.267.0, released 2026-08-27 (the first release that bundles the built-in CloudFormation validator). This is a recent release — an existing CDK app may need an upgrade before cdk-preflight can run.\n\n## Contributing\n\nRule authoring, the verification gates (including real-deploy reproduction), and the test layout are documented in [AGENTS.md](AGENTS.md) — written for AI coding agents and humans alike.\n\n## License\n\nApache-2.0\n"
   },
   "repository": {
     "type": "git",
@@ -9599,6 +9600,6 @@
       "symbolId": "src/index:PreflightOptions"
     }
   },
-  "version": "0.0.87",
-  "fingerprint": "3x+PhQLflTDhj7eg/d5EXEn8uGBvVN+C/o4isis8J38="
+  "version": "0.0.89",
+  "fingerprint": "kBWEDpti+NeT8Q3uN6PPchYzMmv+6h7Hk1WV2ukFqcQ="
 }

package/AGENTS.md

@@ -115,6 +115,7 @@ bench/                      # real-deploy verification (needs an AWS account; no
    - **Dynamic reference strings are markerized too** (measured 2026-09-03): a literal `{{resolve:ssm:/path}}` property value surfaces as `{"__dynamic": "dynamic reference: {{resolve:ssm:/path}}", "__param_type": "String"}` and `resolve()` is undefined for it. A rule that judges the reference text itself (e.g. the SSM parameter path) must read the raw property with `object.get` and extract the `__dynamic` string. Reference implementation: `pf-ec2-instance-ami-arch`.
    - **Deploy-region rules**: the enforce plugin injects a generated module defining `deploy_region` (and `deploy_account` when the account id is concrete) whenever the app-level region is concrete (`deployEnvironmentModule` in `src/private/enforce.ts`; the test harness injects `us-east-1` for fixtures). Rules must read it as `data.cdk_preflight.deploy_region` — the data reference is undefined when not injected, so the rule skips; a bare `deploy_region` variable would be a compile error. `data.cdk_preflight.deploy_account` works the same way (`pf-kms-key-policy-lockout` treats any account as ours when it is absent, `pf-kms-alias-target` skips its account check). Consequences: region-dependent rules are silent in warn mode (`enforce: false` hands rules to the CDK built-in plugin, which we cannot inject into) and in region-agnostic apps; say so in `meta.yaml#repro.evidence`. Reference implementations: `pf-dynamodb-global-table-replica-region`, `pf-dynamodb-kinesis-stream-region`.
    - Helper rules must use a unique `_pf_<rule>_...` prefix (all rules share one package).
+   - **`meta.resourceTypes` is load-bearing, not documentation.** The enforce plugin compiles only the rules whose declared types appear in the synthesized templates — rule compilation is the dominant fixed cost (~4.6s for the whole pack, ~0.8s for the ~100 rules a typical app keeps), so this is what keeps `cdk synth` usable as the pack grows. A type a rule *reads* but does not *declare* makes the rule silently stop firing on real apps. Declare every type the rule touches, including the counterpart of a cross-resource rule; `test/rules.test.ts` checks every rule survives pruning against its own fail template.
    - A helper several rules of one service need (parsing an opaque DSL, enumerating nested scopes) goes in `rules/_lib/<service>.rego` with a `_pf_<service>lib_` prefix (`rules/_lib/sfn.rego` is the reference: ASL from `DefinitionString` *or* the L1 `Definition` object, nested Parallel/Map scopes to depth 3, effective QueryLanguage). Rules never reference another rule's helpers — `exclude` can unload any rule, a lib is always loaded.
    - **Cheap screen for definition-level constraints**: some services expose their create-time validator as a free API (`aws stepfunctions validate-state-machine-definition --type STANDARD|EXPRESS` is the same validator CreateStateMachine runs). Use it to triage doc hypotheses before spending a CloudFormation deploy on each — 100 Step Functions hypotheses took minutes (2026-09-05). The real-deploy gate stays.
 3. `npx ts-node --transpile-only --project test/tsconfig.json scripts/rule-check.ts check <service|rule-id>` while iterating: it reads `rules/` straight from disk into a single engine (no bundle, no meta validation, no jest) and reports, per rule, whether the fail template fires its own rule, the pass template is silent for every rule, and neither trips a built-in ERROR/FATAL. Then `npx projen bundle-rules` and `npx jest test/rules.test.ts test/structure.test.ts` — the duplication guard and fixture checks run there for real. Prefer `jest -t` while iterating; the full suite is 3,228 tests / ~2 min (measured 2026-09-08), so keep it for the pre-PR run.
@@ -157,6 +158,9 @@ bench/                      # real-deploy verification (needs an AWS account; no
 - **Tuple destructuring in `some [a, b] in <array literal>` does not schedule** ("statements not scheduled in query", measured 2026-09-04). Iterating a table of pairs inline is not available — a **set literal** of tuples fails the same way (measured 2026-09-05); build a set with one helper rule per case and destructure that set (`some [name, path, v] in _pf_x_bad`), which does work.
 - **Rego source lines are capped at 1024 columns** ("line exceeds maximum column width of 1024", measured 2026-09-05) — the failure surfaces as a parse error that takes the whole custom package down. Wrap long literal tables (the IANA zone list in `pf-ssm-maintenance-window-schedule` is one entry per line).
 - **Template-level `Transform` is exposed as `input.template.transforms`** (always an array of strings, measured 2026-09-05; `input.template` also carries `description`, `formatVersion`, `rawTopLevelKeys`). Reference: `pf-secretsmanager-hosted-rotation`, which requires an `AWS::SecretsManager-*` transform.
+- **Rule compilation cost scales with the number of custom modules, not their total size** (measured 2026-09-11): 1,775 modules / 2.0MB of Rego compile in 6.2s; the same rules concatenated into 38 service-level modules compile in 1.0s and produce identical diagnostics.
+- **Constructing a second `RegoEngine` in one process degrades super-linearly unless the previous one is freed first** (measured 2026-09-11): 3.8s -> 11.2s -> 22.1s for three identical engines; calling `engine.free()` *before* building the next one gives 3.5s -> 0.4s -> 0.5s (the WASM module stays warm). `src/private/enforce.ts` therefore keeps a single-slot engine cache and frees the old engine before compiling a new rule set.
+- **`validateDetailed(tpl, { disableBuiltinRules: true })` skips the engine's own rules**: first validate of a 70-resource template drops from 3.27s to 0.22s (measured 2026-09-11). The enforce plugin passes it whenever `strict` is off, because the CDK built-in plugin already evaluates those rules on the same template and we discard their diagnostics anyway.
 - **Probe scripts that load the engine outside jest never exit on their own** and were found spinning at 100% CPU an hour later (measured 2026-09-05). End ad-hoc `ts-node` probes with `process.exit(0)` and wrap them in `perl -e 'alarm 300; exec @ARGV'`.
 - **Service APIs that the CloudFormation handler calls verbatim are a cheap triage** (KMS CreateKey/CreateAlias/ReplicateKey, Secrets Manager GetRandomPassword/RotateSecret, SSM PutParameter/CreateDocument/CreateMaintenanceWindow/CreateAssociation, measured 2026-09-05): a rejected call is free and its message is what the stack event will show. Handler-only checks (SecretString vs GenerateSecretString, HostedRotationLambda's transform, Automation associations needing AutomationTargetParameterName) still need a stack.
 - **`resolve()` of `Fn::GetAtt <Resource>.<Attr>` also returns the target's logical ID** (measured 2026-09-05), exactly like a `Ref`. So `resolve(sub, "Properties.Endpoint")` on `Fn::GetAtt Queue.Arn` yields `"Queue"`, which can be fed to `resources_of_type(...)` membership and a second `resolve` on the target. When the *kind* of reference matters (a URL-taking property handed an ARN), read the raw document: `Ref` is `{"__kind": "resource", "__ref": "Q"}`, `Fn::GetAtt` is `{"__kind": "getatt:<Attr>", "__ref": "Q"}`; `flatten_list` drops `__kind`. Reference implementations: `pf-sqs-queue-policy-queues`, `pf-sns-topic-policy-topics`.
@@ -190,4 +194,6 @@ bench/                      # real-deploy verification (needs an AWS account; no
 - **A Studio (ZEPPELIN-FLINK) application cannot be created without `glue:GetDatabase` on its service role**, so a Studio *pass* fixture is expensive. Every Studio-specific check (application mode, snapshots, system rollback, custom artifacts, catalog region, note JSON) fires before the Glue call, so the fail fixture can be a Studio app while the clean fixture stays a plain Flink app (measured 2026-09-06).
 - **The CloudFormation handler can word the same rejection differently from the API** (measured 2026-09-06): CreateStream says `ShardCount cannot be set while creating stream in On-Demand StreamMode`, the stack event says `ShardCount is not expected when StreamMode=ON_DEMAND`. Quote the handler's wording in the rule message — that is the string the user will search for.
 - **Kinesis rejects a cross-region ARN before it looks the resource up** ("The region specified in the ARN ... does not match the endpoint region", measured 2026-09-06 for `RegisterStreamConsumer` and `PutResourcePolicy`; `StartStreamEncryption` answers `KMSNotFoundException: Invalid arn us-west-2`). A region-binding repro therefore needs no real resource in the other region.
+- **`E3019` (duplicate resources) only reads `primaryIdentifier`** (measured 2026-09-10). It fires when the identifier is a property the user writes — `AWS::BedrockAgentCore::WorkloadIdentity` has `primaryIdentifier: /properties/Name`, so two same-named ones in a template are caught and the candidate is a duplicate. It is blind whenever the identifier is a read-only ARN, which is the usual shape: Dataset, Evaluator, ConfigurationBundle, Policy, Memory, OnlineEvaluationConfig and HarnessEndpoint all key on `…Arn`, so a name collision that the service rejects with a 409 is invisible to the engine. Check `primaryIdentifier` before deciding a uniqueness candidate is covered.
+- **A resource type the engine's bundled schema does not know fails the whole template with `F3006 Unknown resource type`**, so no rule can be written for it (measured 2026-09-10 on `AWS::BedrockAgentCore::GatewayRateLimit`; `AWS::BedrockAgentCore::PaymentConnector.ProvisionMode` fails the same way with `F3002`). Both are also absent from `aws-cdk-lib` 2.267.0's L1, so this is version lag rather than an engine bug — re-run the duplication guard for those candidates after an `aws-cdk-lib` bump.
 - **CloudFormation's server-side validation does enforce some raw-schema ranges the bundled engine misses** (measured 2026-09-06): `RetentionPeriodHours: 12` on `AWS::Kinesis::Stream` fails before any resource is touched, as a stack-level `Validation failed with 1 error(s). Call DescribeEvents ...` with the stack itself as the LogicalResourceId — while the engine's patched schema carries only the 8760 maximum. A fail template that dies at the *stack* level rather than in a resource handler is the tell; the candidate is a duplicate and does not ship.

package/README.md

@@ -12,6 +12,7 @@
   <a href="https://github.com/badmintoncryer/cdk-preflight/actions/workflows/monthly-verify.yml"><img src="https://github.com/badmintoncryer/cdk-preflight/actions/workflows/monthly-verify.yml/badge.svg" alt="monthly real-deploy verification"></a>
   <a href="https://www.npmjs.com/package/cdk-preflight"><img src="https://img.shields.io/npm/v/cdk-preflight.svg" alt="npm version"></a>
   <a href="https://www.npmjs.com/package/cdk-preflight"><img src="https://img.shields.io/npm/dt/cdk-preflight.svg" alt="npm total downloads"></a>
+  <a href="docs/rules.md"><img src="https://img.shields.io/badge/rules-1844-blue" alt="1844 bundled rules"></a>
 </p>
 
 Some CloudFormation constraints are not expressed in resource provider schemas — they live only in documentation, in service API validation, or across multiple properties. Templates that violate them pass `cdk synth`, pass CloudFormation pre-deployment validation, and then fail minutes into a deployment, burning a rollback cycle.

package/docs/rules.md

@@ -301,13 +301,18 @@
 | `pf-bedrock-prompt-variant-template-type` | AWS::Bedrock::Prompt | A prompt variant's TemplateConfiguration must match its TemplateType | ERROR | none |
 | `pf-agentcore-apikey-provider-secret-source` | AWS::BedrockAgentCore::ApiKeyCredentialProvider | An API key credential provider takes ApiKey when the secret is MANAGED and ApiKeySecretConfig when it is EXTERNAL, never both | ERROR | none |
 | `pf-agentcore-config-bundle-components-empty` | AWS::BedrockAgentCore::ConfigurationBundle | A configuration bundle needs at least one component | ERROR | none |
+| `pf-agentcore-config-bundle-name-unique` | AWS::BedrockAgentCore::ConfigurationBundle | BundleName must be unique within the account | ERROR | none |
+| `pf-agentcore-dataset-name-unique` | AWS::BedrockAgentCore::Dataset | DatasetName must be unique within the account, compared case-insensitively | ERROR | none |
 | `pf-agentcore-dataset-source-exactly-one` | AWS::BedrockAgentCore::Dataset | Dataset Source must hold exactly one of InlineExamples or S3Source | ERROR | none |
+| `pf-agentcore-evaluator-name-unique` | AWS::BedrockAgentCore::Evaluator | EvaluatorName must be unique within the account | ERROR | none |
 | `pf-agentcore-evaluator-rating-scale-empty` | AWS::BedrockAgentCore::Evaluator | An LLM-as-a-judge evaluator RatingScale must list at least one scale entry | ERROR | none |
+| `pf-agentcore-execution-role-account` | AWS::BedrockAgentCore::OnlineEvaluationConfig<br>AWS::BedrockAgentCore::Memory | An AgentCore execution role must live in the deploy account | ERROR | none |
 | `pf-agentcore-gateway-authorizer-config-unexpected` | AWS::BedrockAgentCore::Gateway | Gateways with AuthorizerType AWS_IAM or NONE must not set AuthorizerConfiguration | ERROR | none |
 | `pf-agentcore-gateway-interceptor-point-unique` | AWS::BedrockAgentCore::Gateway | Gateway interceptors may bind each interception point (REQUEST / RESPONSE) only once | ERROR | none |
 | `pf-agentcore-gateway-jwt-authorizer` | AWS::BedrockAgentCore::Gateway<br>AWS::BedrockAgentCore::PaymentManager | Gateways and payment managers with AuthorizerType CUSTOM_JWT require AuthorizerConfiguration | ERROR | none |
 | `pf-agentcore-gateway-mcp-supported-versions` | AWS::BedrockAgentCore::Gateway | Gateway MCP SupportedVersions must be MCP protocol versions the service supports | ERROR | none |
 | `pf-agentcore-gateway-target-credential-provider-required` | AWS::BedrockAgentCore::GatewayTarget | Gateway target credential types OAUTH and API_KEY require the matching CredentialProvider block | ERROR | none |
+| `pf-agentcore-gateway-target-http-unsupported` | AWS::BedrockAgentCore::GatewayTarget | TargetConfiguration.Http cannot be used: CloudFormation gateways are always MCP | ERROR | none |
 | `pf-agentcore-gateway-target-iam-credential-provider` | AWS::BedrockAgentCore::GatewayTarget | OpenAPI and MCP server gateway targets using GATEWAY_IAM_ROLE must set IamCredentialProvider (the SigV4 service) | ERROR | none |
 | `pf-agentcore-gateway-target-lambda-credential-type` | AWS::BedrockAgentCore::GatewayTarget | Lambda gateway targets accept only the GATEWAY_IAM_ROLE credential provider | ERROR | none |
 | `pf-agentcore-gateway-target-lambda-region` | AWS::BedrockAgentCore::GatewayTarget | Lambda gateway targets must be in the gateway's own region | ERROR | none |
@@ -315,6 +320,7 @@
 | `pf-agentcore-gateway-target-lambda-tool-schema-empty` | AWS::BedrockAgentCore::GatewayTarget | Lambda gateway targets need at least one tool in ToolSchema.InlinePayload | ERROR | none |
 | `pf-agentcore-gateway-target-openapi-schema` | AWS::BedrockAgentCore::GatewayTarget | Inline OpenAPI schemas for gateway targets must be OpenAPI 3 with a servers list and an operationId on every operation | ERROR | none |
 | `pf-agentcore-jwt-authorizer-claims` | AWS::BedrockAgentCore::Gateway<br>AWS::BedrockAgentCore::Runtime<br>AWS::BedrockAgentCore::Harness | A CustomJWTAuthorizer needs at least one of AllowedAudience, AllowedClients, AllowedScopes, or CustomClaims | ERROR | none |
+| `pf-agentcore-kms-key-region` | AWS::BedrockAgentCore::Dataset<br>AWS::BedrockAgentCore::Evaluator<br>AWS::BedrockAgentCore::ConfigurationBundle | A KmsKeyArn must name a key in the deploy region | ERROR | none |
 | `pf-agentcore-memory-custom-strategy-execution-role` | AWS::BedrockAgentCore::Memory | Memories with a custom strategy require MemoryExecutionRoleArn | ERROR | none |
 | `pf-agentcore-memory-strategy-exactly-one` | AWS::BedrockAgentCore::Memory | Each MemoryStrategies entry must hold exactly one strategy type, and a CustomMemoryStrategy exactly one Configuration override | ERROR | pending-engine |
 | `pf-agentcore-memory-strategy-name-unique` | AWS::BedrockAgentCore::Memory | Memory strategy names must be unique within a memory | ERROR | none |
@@ -327,6 +333,7 @@
 | `pf-agentcore-online-eval-evaluators-or-insights` | AWS::BedrockAgentCore::OnlineEvaluationConfig | An online evaluation config needs a non-empty Evaluators list (or Insights) | ERROR | none |
 | `pf-agentcore-payment-credential-provider-vendor-config` | AWS::BedrockAgentCore::PaymentCredentialProvider | ProviderConfigurationInput must contain the block matching CredentialProviderVendor (CoinbaseCDP / StripePrivy) | ERROR | none |
 | `pf-agentcore-policy-cedar-statement` | AWS::BedrockAgentCore::Policy | A Cedar policy statement must be a permit/forbid clause that constrains the resource and, for permit, carries a condition | ERROR | none |
+| `pf-agentcore-policy-name-unique` | AWS::BedrockAgentCore::Policy | Policy names must be unique within one policy engine | ERROR | none |
 | `pf-agentcore-required-union-empty` | AWS::BedrockAgentCore::Evaluator<br>AWS::BedrockAgentCore::GatewayTarget<br>AWS::BedrockAgentCore::Policy | Required union blocks (EvaluatorConfig, TargetConfiguration, Definition) must not be empty objects | ERROR | pending-engine |
 | `pf-agentcore-resource-policy-document` | AWS::BedrockAgentCore::ResourcePolicy | A resource policy must be a JSON policy whose statements carry Principal, bedrock-agentcore actions, and exactly one Resource ARN | ERROR | none |
 | `pf-agentcore-runtime-artifact-exactly-one` | AWS::BedrockAgentCore::Runtime | AgentRuntimeArtifact must hold exactly one of ContainerConfiguration or CodeConfiguration | ERROR | none |
@@ -1080,12 +1087,74 @@
 | `pf-eventschemas-registry-name-reserved` | AWS::EventSchemas::Registry | A registry name may not use the reserved aws. prefix | ERROR | none |
 | `pf-eventschemas-registry-policy` | AWS::EventSchemas::RegistryPolicy | A registry policy must declare a Version | ERROR | none |
 | `pf-eventschemas-schema-content` | AWS::EventSchemas::Schema | Schema Content must be valid JSON, and valid OpenAPI 3.0 when Type is OpenApi3 | ERROR | none |
+| `pf-firehose-aoss-collection-endpoint` | AWS::KinesisFirehose::DeliveryStream | An OpenSearch Serverless destination needs a collection endpoint | ERROR | none |
+| `pf-firehose-bucket-arn-format` | AWS::KinesisFirehose::DeliveryStream | A destination BucketARN must be an S3 bucket ARN | ERROR | none |
+| `pf-firehose-cloudwatch-log-processing-decompression` | AWS::KinesisFirehose::DeliveryStream | CloudWatch log processing needs a Decompression processor | ERROR | none |
+| `pf-firehose-cloudwatch-log-processing-value` | AWS::KinesisFirehose::DeliveryStream | DataMessageExtraction takes True or False | ERROR | none |
+| `pf-firehose-cloudwatch-logging-names` | AWS::KinesisFirehose::DeliveryStream | Enabled CloudWatch logging needs a log group name | ERROR | none |
+| `pf-firehose-custom-time-zone` | AWS::KinesisFirehose::DeliveryStream | CustomTimeZone must be a time zone Firehose supports | ERROR | none |
+| `pf-firehose-database-source-config` | AWS::KinesisFirehose::DeliveryStream | A database-sourced stream must deliver to Iceberg | ERROR | none |
+| `pf-firehose-deserializer-one` | AWS::KinesisFirehose::DeliveryStream | The deserializer must be exactly one SerDe | ERROR | none |
+| `pf-firehose-deserializer-required` | AWS::KinesisFirehose::DeliveryStream | InputFormatConfiguration must carry a deserializer | ERROR | none |
+| `pf-firehose-dfcc-compression` | AWS::KinesisFirehose::DeliveryStream | Format conversion needs an uncompressed S3 destination | ERROR | none |
 | `pf-firehose-dfcc-required-configs` | AWS::KinesisFirehose::DeliveryStream | Enabled format conversion needs input, output, and schema configs | ERROR | none |
 | `pf-firehose-dynamic-partitioning-buffer` | AWS::KinesisFirehose::DeliveryStream | Dynamic partitioning needs a 64 MB buffer floor | ERROR | none |
 | `pf-firehose-dynamic-partitioning-prefix` | AWS::KinesisFirehose::DeliveryStream | Dynamic partitioning needs partition namespaces in the prefix | ERROR | none |
+| `pf-firehose-dynamic-partitioning-query-key` | AWS::KinesisFirehose::DeliveryStream | Every MetadataExtraction key must appear in the S3 prefix | ERROR | none |
+| `pf-firehose-encryption-key-arn` | AWS::KinesisFirehose::DeliveryStream | A customer managed CMK needs a KeyARN | ERROR | none |
+| `pf-firehose-encryption-key-region` | AWS::KinesisFirehose::DeliveryStream | The stream CMK must be in the deploy region | ERROR | none |
+| `pf-firehose-encryption-kinesis-source` | AWS::KinesisFirehose::DeliveryStream | Server-side encryption is not available with a Kinesis source | ERROR | none |
+| `pf-firehose-encryption-owned-key-arn` | AWS::KinesisFirehose::DeliveryStream | An AWS owned CMK takes no KeyARN | ERROR | none |
+| `pf-firehose-error-output-prefix-error-type` | AWS::KinesisFirehose::DeliveryStream | An ErrorOutputPrefix with expressions needs !{firehose:error-output-type} | ERROR | none |
+| `pf-firehose-error-output-prefix-partition-namespace` | AWS::KinesisFirehose::DeliveryStream | Partition namespaces cannot appear in an ErrorOutputPrefix | ERROR | none |
+| `pf-firehose-error-output-prefix-required` | AWS::KinesisFirehose::DeliveryStream | A prefix with expressions needs an ErrorOutputPrefix | ERROR | none |
+| `pf-firehose-hive-timestamp-formats` | AWS::KinesisFirehose::DeliveryStream | HiveJsonSerDe timestamp formats must be Joda patterns | ERROR | none |
+| `pf-firehose-http-attribute-name-unique` | AWS::KinesisFirehose::DeliveryStream | HTTP common attribute names must be unique | ERROR | none |
+| `pf-firehose-http-buffer-size` | AWS::KinesisFirehose::DeliveryStream | HTTP endpoint buffering is capped at 64 MB | ERROR | none |
+| `pf-firehose-iceberg-backup-mode` | AWS::KinesisFirehose::DeliveryStream | Iceberg S3 backup only supports FailedDataOnly | ERROR | none |
+| `pf-firehose-iceberg-catalog-arn-format` | AWS::KinesisFirehose::DeliveryStream | An Iceberg catalog ARN must be a Glue catalog ARN | ERROR | none |
+| `pf-firehose-iceberg-default-table-config` | AWS::KinesisFirehose::DeliveryStream | An Iceberg destination without routing needs a default table | ERROR | none |
 | `pf-firehose-kinesis-source-config` | AWS::KinesisFirehose::DeliveryStream | KinesisStreamAsSource streams need KinesisStreamSourceConfiguration | ERROR | none |
+| `pf-firehose-metadata-extraction-dp-only` | AWS::KinesisFirehose::DeliveryStream | A MetadataExtraction processor needs dynamic partitioning | ERROR | none |
+| `pf-firehose-msk-source-config` | AWS::KinesisFirehose::DeliveryStream | An MSK-sourced stream needs MSKSourceConfiguration | ERROR | none |
 | `pf-firehose-one-destination` | AWS::KinesisFirehose::DeliveryStream | A delivery stream takes exactly one destination configuration | ERROR | none |
+| `pf-firehose-opensearch-endpoint-exclusive` | AWS::KinesisFirehose::DeliveryStream | An OpenSearch destination takes a domain ARN or an endpoint, not both | ERROR | none |
+| `pf-firehose-opensearch-endpoint-required` | AWS::KinesisFirehose::DeliveryStream | An OpenSearch destination needs a domain ARN or an endpoint | ERROR | none |
+| `pf-firehose-opensearch-type-name` | AWS::KinesisFirehose::DeliveryStream | An OpenSearch 7+ destination takes no type name | ERROR | none |
+| `pf-firehose-prefix-expression-syntax` | AWS::KinesisFirehose::DeliveryStream | A "!{" in an S3 prefix must open a complete expression | ERROR | none |
+| `pf-firehose-prefix-expression-value` | AWS::KinesisFirehose::DeliveryStream | An S3 prefix expression value must be one the namespace accepts | ERROR | none |
+| `pf-firehose-prefix-length` | AWS::KinesisFirehose::DeliveryStream | An evaluated S3 prefix cannot exceed 512 characters | ERROR | none |
+| `pf-firehose-prefix-namespace` | AWS::KinesisFirehose::DeliveryStream | An S3 prefix expression takes one of four namespaces | ERROR | none |
+| `pf-firehose-prefix-no-error-output-type` | AWS::KinesisFirehose::DeliveryStream | Prefix cannot interpolate the error output type | ERROR | none |
+| `pf-firehose-processor-buffer-both` | AWS::KinesisFirehose::DeliveryStream | Lambda buffering takes both hints or neither | ERROR | none |
+| `pf-firehose-processor-buffer-interval-range` | AWS::KinesisFirehose::DeliveryStream | A Lambda processor buffers for 0 to 900 seconds | ERROR | none |
+| `pf-firehose-processor-buffer-size-range` | AWS::KinesisFirehose::DeliveryStream | A Lambda processor buffers between 0.2 and 3 MB | ERROR | none |
+| `pf-firehose-processor-count` | AWS::KinesisFirehose::DeliveryStream | A processing configuration takes one to five processors | ERROR | none |
+| `pf-firehose-processor-deaggregation-delimiter` | AWS::KinesisFirehose::DeliveryStream | Delimited de-aggregation needs a Delimiter | ERROR | none |
+| `pf-firehose-processor-duplicate-type` | AWS::KinesisFirehose::DeliveryStream | A destination takes at most one Lambda processor | ERROR | none |
+| `pf-firehose-processor-lambda-arn` | AWS::KinesisFirehose::DeliveryStream | A Lambda processor needs a LambdaArn parameter | ERROR | none |
+| `pf-firehose-processor-metadata-params` | AWS::KinesisFirehose::DeliveryStream | A MetadataExtraction processor needs a query and JQ-1.6 | ERROR | none |
+| `pf-firehose-processor-retries-range` | AWS::KinesisFirehose::DeliveryStream | A Lambda processor retries at most 300 times | ERROR | none |
+| `pf-firehose-processor-subrecord-type` | AWS::KinesisFirehose::DeliveryStream | SubRecordType is JSON or DELIMITED | ERROR | none |
+| `pf-firehose-record-deaggregation-dp-only` | AWS::KinesisFirehose::DeliveryStream | A RecordDeAggregation processor needs dynamic partitioning | ERROR | none |
+| `pf-firehose-redshift-credentials` | AWS::KinesisFirehose::DeliveryStream | A Redshift destination needs a password or a secret | ERROR | none |
+| `pf-firehose-redshift-prefix-no-expression` | AWS::KinesisFirehose::DeliveryStream | A Redshift destination takes no prefix expressions | ERROR | none |
+| `pf-firehose-redshift-s3-compression` | AWS::KinesisFirehose::DeliveryStream | A Redshift intermediate bucket takes UNCOMPRESSED or GZIP | ERROR | none |
+| `pf-firehose-role-arn-account` | AWS::KinesisFirehose::DeliveryStream | A delivery role must live in the deploy account | ERROR | none |
 | `pf-firehose-s3-backup-config` | AWS::KinesisFirehose::DeliveryStream | Enabling S3 backup needs S3BackupConfiguration | ERROR | none |
+| `pf-firehose-s3-encryption-exclusive` | AWS::KinesisFirehose::DeliveryStream | S3 encryption takes exactly one configuration | ERROR | none |
+| `pf-firehose-s3-kms-key-region` | AWS::KinesisFirehose::DeliveryStream | The S3 encryption key must be in the deploy region | ERROR | none |
+| `pf-firehose-schema-config-role-account` | AWS::KinesisFirehose::DeliveryStream | The schema configuration role must be in the deploy account | ERROR | none |
+| `pf-firehose-secrets-manager-region` | AWS::KinesisFirehose::DeliveryStream | The destination secret must be in the deploy region | ERROR | none |
+| `pf-firehose-secrets-manager-secret-arn` | AWS::KinesisFirehose::DeliveryStream | An enabled Secrets Manager configuration needs a SecretARN | ERROR | none |
+| `pf-firehose-serializer-one` | AWS::KinesisFirehose::DeliveryStream | The serializer must be exactly one SerDe | ERROR | none |
+| `pf-firehose-serializer-required` | AWS::KinesisFirehose::DeliveryStream | OutputFormatConfiguration must carry a serializer | ERROR | none |
+| `pf-firehose-snowflake-credentials` | AWS::KinesisFirehose::DeliveryStream | A Snowflake destination needs a private key or a secret | ERROR | none |
+| `pf-firehose-snowflake-json-mapping-columns` | AWS::KinesisFirehose::DeliveryStream | JSON mapping takes no Snowflake column names | ERROR | none |
+| `pf-firehose-snowflake-role-config` | AWS::KinesisFirehose::DeliveryStream | An enabled Snowflake role configuration needs a role | ERROR | none |
+| `pf-firehose-snowflake-user` | AWS::KinesisFirehose::DeliveryStream | A Snowflake destination needs a user or a secret | ERROR | none |
+| `pf-firehose-snowflake-variant-columns` | AWS::KinesisFirehose::DeliveryStream | Variant content and metadata mapping needs both column names | ERROR | none |
+| `pf-firehose-splunk-hec-endpoint-https` | AWS::KinesisFirehose::DeliveryStream | A Splunk HEC endpoint must be an HTTPS URL | ERROR | none |
 | `pf-iam-identity-policy-no-principal` | AWS::IAM::Role<br>AWS::IAM::Policy<br>AWS::IAM::ManagedPolicy | Identity policies cannot carry a Principal field | ERROR | none |
 | `pf-iam-inline-policy-size` | AWS::IAM::Policy<br>AWS::IAM::RolePolicy<br>AWS::IAM::UserPolicy<br>AWS::IAM::GroupPolicy | Inline policy documents are limited per identity (role 10240 / group 5120 / user 2048 characters) | ERROR | none |
 | `pf-iam-instance-profile-single-role` | AWS::IAM::InstanceProfile | An instance profile holds exactly one role | ERROR | none |

package/lib/index.js

@@ -17,7 +17,7 @@ const rules_generated_1 = require("./rules.generated");
  * Preflight.apply(app);
  */
 class Preflight {
-    static [JSII_RTTI_SYMBOL_1] = { fqn: "cdk-preflight.Preflight", version: "0.0.87" };
+    static [JSII_RTTI_SYMBOL_1] = { fqn: "cdk-preflight.Preflight", version: "0.0.89" };
     /**
      * Register the cdk-preflight rules on an App or Stage.
      */

package/lib/private/enforce.d.ts

@@ -72,6 +72,24 @@ export declare function installEnforceGate(scope: IConstruct): void;
 export declare function fallbackFormat(pluginReports: any[]): string;
 /** （テストからも利用するため export している） */
 export declare function loadFormatter(): any | undefined;
+/**
+ * テンプレート群に出てくるリソースタイプ。刈り込みに使えないテンプレートが 1 枚でもあれば
+ * undefined を返し、刈り込みそのものを諦める（何が載っているか分からないまま落とすと、
+ * ルールが黙って発火しなくなる = enforce にとって最悪の壊れ方になるため）。
+ * （テストからも利用するため export している）
+ */
+export declare function templateResourceTypes(templatePaths: string[]): Set<string> | undefined;
+/**
+ * テンプレートに出てくるリソースタイプに関係するルールだけを選ぶ。
+ *
+ * エンジンのコンパイル時間はルール数でほぼ決まるので（実測 1844 ルールで約 4.6s、
+ * 典型的なアプリに残る 100 ルール前後なら 0.8s 前後）、これが固定費の主な削りどころ。
+ * 安全性は meta.resourceTypes の宣言に乗っている: ルールが見るリソースタイプが
+ * 宣言から漏れていると刈られて発火しなくなるため、test/rules.test.ts が全ルールについて
+ * 「自分の fail テンプレートで刈り残ること」を検査している。
+ * （テストからも利用するため export している）
+ */
+export declare function prune(rules: BundledRuleData[], types: Set<string> | undefined): BundledRuleData[];
 /**
  * @aws/cloudformation-validate を解決する。
  * 通常は aws-cdk-lib が bundledDependencies として同梱しているコピーに乗る。