cdk-preflight 1.11.1 → 1.12.1

package/.jsii

@@ -9601,7 +9601,7 @@
     "stability": "stable"
   },
   "homepage": "https://github.com/badmintoncryer/cdk-preflight.git",
-  "jsiiVersion": "6.0.17 (build e6a458c)",
+  "jsiiVersion": "6.0.20 (build 338bb97)",
   "keywords": [
     "aws",
     "aws-cdk",
@@ -9626,7 +9626,7 @@
   },
   "name": "cdk-preflight",
   "readme": {
-    "markdown": "<p align=\"center\">\n  <img src=\"https://raw.githubusercontent.com/badmintoncryer/cdk-preflight/main/assets/logo.png\" alt=\"cdk-preflight\" width=\"104\" height=\"104\">\n</p>\n\n<h1 align=\"center\">cdk-preflight</h1>\n\n<p align=\"center\">\n  <strong>Catch deploy-time CloudFormation failures at <code>cdk synth</code> time.</strong>\n</p>\n\n<p align=\"center\">\n  <a href=\"https://github.com/badmintoncryer/cdk-preflight/actions/workflows/monthly-verify.yml\"><img src=\"https://github.com/badmintoncryer/cdk-preflight/actions/workflows/monthly-verify.yml/badge.svg\" alt=\"monthly real-deploy verification\"></a>\n  <a href=\"https://www.npmjs.com/package/cdk-preflight\"><img src=\"https://img.shields.io/npm/v/cdk-preflight.svg\" alt=\"npm version\"></a>\n  <a href=\"https://www.npmjs.com/package/cdk-preflight\"><img src=\"https://img.shields.io/npm/dt/cdk-preflight.svg\" alt=\"npm total downloads\"></a>\n  <a href=\"docs/rules.md\"><img src=\"https://img.shields.io/badge/rules-3361-blue\" alt=\"3361 bundled rules\"></a>\n</p>\n\nSome CloudFormation constraints are not expressed in resource provider schemas — they live only in documentation, in service API validation, or across multiple properties. Templates that violate them pass `cdk synth`, pass CloudFormation pre-deployment validation, and then fail minutes into a deployment, burning a rollback cycle.\n\ncdk-preflight is a curated [Rego rule pack](docs/rules.md) for exactly those constraints, evaluated with the CloudFormation validation engine that ships inside `aws-cdk-lib` (>= 2.267.0). By default a violation **fails `cdk synth`** — a template that is known to fail at deploy time never leaves your machine.\n\nThe pack aims at **every deploy-time failure, and every post-deploy run that is certain to fail, that no existing CDK mechanism already catches** — nothing narrower. Every bundled rule is backed by a `fail`/`pass` template pair, and the failure has been reproduced against real AWS. The handful of rules that could not be reproduced are marked `doc-only` and report as **warnings**, as does a rule whose remaining false positives cannot be told from the template (a cross-account Lambda layer the owner may have shared): they show up in the validation report but never fail synth. Rules that the built-in validation engine already covers are deliberately **not** duplicated — a test suite enforces this, and a rule the engine catches up with later is skipped on engines that cover it (see [Scope and rule lifecycle](#scope-and-rule-lifecycle)).\n\n> **Requires `aws-cdk-lib` >= 2.267.0** (released 2026-08-27) — the first release that bundles\n> the CloudFormation validation engine. On older versions the rules cannot run at all.\n\n## Quick start\n\n```bash\nnpm i -D cdk-preflight\nnpx cdkpf init   # inserts Preflight.apply(app) into your CDK app\n                         # (`npx cdkpf init` is the same command, shorter)\n```\n\nor add one line yourself:\n\n```ts\nimport { Preflight } from 'cdk-preflight';\n\nconst app = new App();\nPreflight.apply(app);\n```\n\nOn violation, `cdk synth` fails with one error per finding, including the construct trace:\n\n```text\nERROR idle_timeout.timeout_seconds is 5000 but must be between 1 and 4000 seconds (cdk-preflight)\n   MyStack/Alb/Resource (Alb16C2F182) aws-cdk-lib.aws_elasticloadbalancingv2.CfnLoadBalancer\n\nSynthesis finished with errors\n```\n\n## What it catches\n\nFour ordinary-looking snippets. All of them pass `cdk synth` and CloudFormation\npre-deployment validation, and all of them fail minutes into a deployment:\n\n```ts\n// 1) pf-iam-inline-policy-size — enumerate buckets, grant each one, blow past 10,240 chars\n//    \"Maximum policy size of 10240 bytes exceeded for role IngestRole\"\n//    (via role.addToPolicy the CDK auto-splits into managed policies instead,\n//     and you hit the 6,144-char limit as pf-iam-managed-policy-size)\nnew iam.Policy(this, 'IngestPolicy', {\n  roles: [role],\n  statements: [new iam.PolicyStatement({\n    actions: ['s3:GetObject', 's3:ListBucket'],\n    resources: Array.from({ length: 200 },\n      (_, i) => `arn:aws:s3:::data-lake-landing-zone-${i}/year=*/month=*/*`),\n  })],\n});\n\n// 2) pf-lambda-env-size — a config blob in the environment, over the 4KB total\n//    \"Lambda was unable to configure your environment variables because the\n//     environment variables you have provided exceeded the 4KB limit\"\nnew lambda.Function(this, 'Fn', {\n  runtime: lambda.Runtime.NODEJS_22_X,\n  handler: 'index.handler',\n  code: lambda.Code.fromInline('exports.handler = async () => {};'),\n  environment: { FEATURE_FLAGS: JSON.stringify(bigFeatureFlagMap) },\n});\n\n// 3) pf-sfn-asl-missing-state (+ pf-sfn-asl-unreachable-state) — a typo in a state name\n//    \"Invalid State Machine Definition: 'MISSING_TRANSITION_TARGET: ...'\"\nnew sfn.StateMachine(this, 'Pipeline', {\n  definitionBody: sfn.DefinitionBody.fromString(JSON.stringify({\n    StartAt: 'Validate',\n    States: {\n      Validate: { Type: 'Pass', Next: 'Transform' },\n      Trasform: { Type: 'Pass', End: true },   // typo: Transform\n    },\n  })),\n});\n\n// 4) pf-logs-filter-pattern-bracket — a filter pattern opened with '[' and never closed\n//    \"If a filter pattern starts with '[' it must end with ']'\"\nnew logs.MetricFilter(this, 'ErrorFilter', {\n  logGroup,\n  metricNamespace: 'Pipeline',\n  metricName: 'Errors',\n  filterPattern: logs.FilterPattern.literal('[time, level=ERROR, msg'),\n});\n```\n\nNone of these are type errors, so the L2 constructs accept them; none of them are\nexpressible in a resource schema, so CloudFormation accepts the template. With\n`Preflight.apply(app)` in place they fail `cdk synth` instead.\n\n## Observe-only mode\n\nTo roll the rules out gradually, start with `enforce: false`: findings then surface as synth **warnings** through the CDK built-in validator, with construct traces and per-finding acknowledgement:\n\n```ts\nPreflight.apply(app, { enforce: false });\n```\n\n```text\nWARNING idle_timeout.timeout_seconds is 5000 but must be between 1 and 4000 seconds (CloudFormation Validate)\n   MyStack/Alb (Alb) aws-cdk-lib.aws_elasticloadbalancingv2.CfnLoadBalancer\n   Acknowledge with 'CloudFormation-Validate::pf-elbv2-lb-idle-timeout-range'\n```\n\n> **Known limitation with stages.** The AWS CDK CLI drops validation findings for stacks nested in a `Stage`\n> before printing them, so in observe-only mode those findings appear **only** in `cdk.out/validation-report.json`\n> and never on the console. Enforce mode is not affected: cdk-preflight reports such findings itself and fails\n> synthesis. This is a CLI-side bug (present since aws-cdk 2.1128.1), not a rule evaluation problem.\n\n> **If the rules cannot run, the build stops.** When the evaluation engine fails on a template (a rule pack that\n> does not compile, an engine bug), enforce mode reports it as a violation named `pf-engine-error` and fails\n> synthesis for that stack instead of passing green with no rule having run. The other stacks keep their rules.\n> `pf-engine-error` is not a bundled rule and cannot be `exclude`d; `enforce: false` unblocks the build if you\n> need one.\n\n| Option | Default | Effect |\n|---|---|---|\n| `enforce` | `true` | Violations of bundled rules fail synthesis; set to `false` to only warn |\n| `strict` | `false` | With `enforce`: also fail on error-class findings (`ERROR`/`FATAL`, e.g. `F3034`) of the built-in validation engine itself, which the CDK currently downgrades to warnings |\n| `exclude` | `[]` | Rule ids to disable |\n| `includeUpstreamPending` | `true` | Include rules already proposed to the upstream engine but not yet merged |\n| `checkQuotas` | `false` | Also check the target account's Service Quotas and current usage (calls AWS at synth time, see below) |\n| `quotaCacheTtl` | 5 minutes | How long `checkQuotas` reuses the usage and deployed-stack state it fetched |\n\nTo opt out of a single rule everywhere, pass its id in `exclude`. To suppress a\nsingle *finding* on one construct, acknowledge it — this works in both modes, the\nid prefix just differs (`cdk-preflight::` when enforcing, `CloudFormation-Validate::`\nin observe-only, as printed in the warning text):\n\n```ts\ncdk.Validations.of(errorFilter).acknowledge({\n  id: 'cdk-preflight::pf-logs-filter-pattern-bracket',\n  reason: 'log group is written by a legacy producer; pattern is fixed upstream',\n});\n```\n\n## Service quota check (opt-in)\n\nThe rules only read the template, so they never assert a limit an account can raise. `checkQuotas: true` covers that\ngap for the quotas a CDK app runs into most: it adds up what every stack in the app (nested stacks included) is about\nto create in each account and Region, and compares that against the account's applied quota and current usage.\n\n```ts\nPreflight.apply(app, { checkQuotas: true });\n```\n\n| Check | Counts | Against |\n|---|---|---|\n| `pf-quota-vpcs-per-region` | new `AWS::EC2::VPC` | VPCs per Region (`vpc/L-F678F1CE`) |\n| `pf-quota-internet-gateways-per-region` | new `AWS::EC2::InternetGateway` | Internet gateways per Region (`vpc/L-A4707A72`) |\n| `pf-quota-elastic-ips-per-region` | new `AWS::EC2::EIP` (one per NAT gateway in a default `ec2.Vpc`) | EC2-VPC Elastic IPs (`ec2/L-0263D0A3`) |\n| `pf-quota-lambda-unreserved-concurrency` | increase in `ReservedConcurrentExecutions` | Lambda keeps at least 100 concurrent executions unreserved |\n\n- **Only new resources count.** The deployed template of each stack is read with `GetTemplate`; a resource whose\n  logical id and type are already deployed is not counted again, so redeploying an unchanged app never trips the\n  check. Resources behind a `Condition` and the brief overlap during a replacement are not counted.\n- **A finding fails synth** in enforce mode and is a warning with `enforce: false`. Acknowledge one like any other\n  finding (`cdk-preflight::pf-quota-...`; `cdk-preflight-quotas::pf-quota-...` with `enforce: false`). The ids also work in `exclude`, including `pf-quota-check-skipped` to silence the skip warning.\n- **It needs credentials in the app process.** The CDK CLI does not pass `--profile` on to the app, so set\n  `AWS_PROFILE` (or `AWS_*` variables) instead. When the credentials are missing, lack permissions, or belong to a\n  different account than the stack's, the check is skipped with a `pf-quota-check-skipped` warning and synth goes on.\n- **Permissions:** `servicequotas:GetServiceQuota`, `servicequotas:GetAWSDefaultServiceQuota`, `ec2:DescribeVpcs`,\n  `ec2:DescribeInternetGateways`, `ec2:DescribeAddresses`, `lambda:GetAccountSettings`, `cloudformation:GetTemplate`,\n  `cloudformation:DescribeStackResource`. All read-only (`ReadOnlyAccess` covers them). The check also calls\n  `sts:GetCallerIdentity`, which IAM never denies.\n- **Results are cached** in `cdk.out/.cdk-preflight/quota-cache.json`: usage and deployed templates for\n  `quotaCacheTtl` (5 minutes), quota values for 24 hours. Delete the file to force a refetch.\n- Usage can change between synth and deploy (another team deploying to the same account), so a clean check is not a\n  guarantee. The reverse also happens: EC2 does not always enforce the Elastic IP quota when CloudFormation\n  creates several addresses in parallel (measured 2026-10-16: with 4 of 5 in use, two parallel `AWS::EC2::EIP` both\n  succeeded), so a template the check stops may occasionally deploy. The check follows the quota, not the race.\n- **CloudFormation's own quota warning is a different check.** Since June 2026, creating a change set (and\n  `cdk validate` with `--online`, below) warns when a stack would exceed a service quota. That warning runs per stack,\n  after the template is uploaded, and never stops the deploy. `checkQuotas` adds up every stack of the app that\n  targets the same account and Region, and fails `cdk synth` before anything is uploaded. Both can be on.\n\n## Across stacks\n\nTwo checks read every stack of the app at once, because a single template cannot show the problem. They report\n**warnings** (they have not been reproduced on the bench yet, see [Scope](#scope-and-rule-lifecycle)) and never fail\nsynth, in either mode:\n\n| Check | Finds | Deploy error it predicts |\n|---|---|---|\n| `pf-cfn-export-name-conflict` | two stacks that deploy to the same account and Region export the same name (Stages included) | `Export with name X is already exported by stack Y` |\n| `pf-cfn-import-value-missing-export` | `Fn::ImportValue` of a name that starts with the name of a stack of the app (`Producer:...`, CDK's naming) that this stack, in the same account and Region, does not export | `No export named X found` |\n\nImports of names that do not start with a stack name of the app are left alone, since another app may export them.\nAcknowledge a finding with `cdk-preflight-exports::<rule-id>`, or turn a check off with `exclude`.\n\n## With `cdk validate`\n\nThe CDK CLI's experimental `cdk validate` (`cdk --unstable=validate validate`) synthesizes the app and runs its\nvalidation plugins without deploying, so cdk-preflight runs there exactly as in `cdk synth`: in enforce mode a finding\nfails the command, with `enforce: false` it is a warning (checked with CLI 2.1147.0). `--watch` re-runs it on each\nchange. `--online` (the default) also submits the templates to CloudFormation's pre-deployment validation, which\nneeds credentials and adds the server-side checks (resource name conflicts, the quota warning above); `--no-online`\nkeeps it offline.\n\n```sh\nnpx cdk --unstable=validate validate --no-online --watch\n```\n\n## Bundled rules\n\nSee [docs/rules.md](docs/rules.md) for the generated rule table.\n\n<!-- supported-resources:start -->\n<details>\n<summary><b>431 resource types across 78 services</b> — click to expand</summary>\n\nResource names are relative to `AWS::<Service>::`; the number in parentheses is how many rules target that type.\n\n| Service | Resource types |\n|---|---|\n| **(any resource type)** | `*` (14) |\n| **ApiGateway** | `ApiKey` (1), `Authorizer` (5), `Deployment` (1), `DocumentationPart` (1), `DomainName` (4), `GatewayResponse` (1), `Method` (14), `Model` (3), `Resource` (1), `RestApi` (5), `Stage` (9), `UsagePlan` (5), `VpcLink` (1) |\n| **ApiGatewayV2** | `Api` (5), `Authorizer` (11), `DomainName` (3), `Integration` (15), `IntegrationResponse` (1), `Model` (2), `Route` (6), `RouteResponse` (2), `Stage` (4), `VpcLink` (1) |\n| **ApplicationAutoScaling** | `ScalableTarget` (19), `ScalingPolicy` (30) |\n| **AppSync** | `Api` (7), `ApiCache` (4), `ApiKey` (2), `ChannelNamespace` (5), `DataSource` (15), `DomainName` (1), `FunctionConfiguration` (24), `GraphQLApi` (16), `GraphQLSchema` (12), `Resolver` (32), `SourceApiAssociation` (3) |\n| **APS** | `AnomalyDetector` (9), `ResourcePolicy` (5), `RuleGroupsNamespace` (10), `Workspace` (12) |\n| **Athena** | `DataCatalog` (6), `WorkGroup` (8) |\n| **AutoScaling** | `AutoScalingGroup` (38), `LifecycleHook` (8), `ScalingPolicy` (41), `ScheduledAction` (13), `WarmPool` (4) |\n| **Backup** | `BackupPlan` (12), `BackupSelection` (5), `BackupVault` (3), `Framework` (3), `LogicallyAirGappedBackupVault` (2), `ReportPlan` (2), `RestoreTestingPlan` (5), `RestoreTestingSelection` (3) |\n| **Batch** | `ComputeEnvironment` (40), `ConsumableResource` (2), `JobDefinition` (109), `JobQueue` (18), `SchedulingPolicy` (8), `ServiceEnvironment` (6) |\n| **Bedrock** | `ApplicationInferenceProfile` (2), `AutomatedReasoningPolicy` (3), `Blueprint` (3), `DataAutomationProject` (8), `DataSource` (12), `Flow` (14), `Guardrail` (19), `IntelligentPromptRouter` (5), `KnowledgeBase` (18), `Prompt` (4) |\n| **BedrockAgentCore** | `ApiKeyCredentialProvider` (1), `BrowserCustom` (1), `BrowserProfile` (1), `CapacityProvider` (8), `CodeInterpreterCustom` (1), `ConfigurationBundle` (4), `Dataset` (3), `Evaluator` (4), `Gateway` (16), `GatewayRateLimit` (5), `GatewayRule` (5), `GatewayTarget` (11), `Harness` (2), `HarnessEndpoint` (2), `Memory` (14), `OAuth2CredentialProvider` (5), `OnlineEvaluationConfig` (3), `PaymentCredentialProvider` (1), `PaymentManager` (1), `Policy` (3), `ResourcePolicy` (1), `Runtime` (16), `RuntimeEndpoint` (1) |\n| **Cassandra** | `Keyspace` (2), `Table` (22), `Type` (13) |\n| **CertificateManager** | `Certificate` (4) |\n| **CloudFormation** | `GuardHook` (1), `Stack` (2), `StackSet` (6) |\n| **CloudFront** | `AnycastIpList` (1), `CachePolicy` (7), `ContinuousDeploymentPolicy` (5), `Distribution` (55), `Function` (4), `KeyGroup` (1), `KeyValueStore` (2), `OriginRequestPolicy` (5), `PublicKey` (1), `RealtimeLogConfig` (3), `ResponseHeadersPolicy` (8), `VpcOrigin` (3) |\n| **CloudTrail** | `EventDataStore` (1), `Trail` (19) |\n| **CloudWatch** | `Alarm` (22), `AnomalyDetector` (6), `CompositeAlarm` (7), `Dashboard` (14), `InsightRule` (7), `MetricStream` (6) |\n| **CodeBuild** | `Project` (37), `ReportGroup` (2), `SourceCredential` (4) |\n| **CodeCommit** | `Repository` (11) |\n| **CodeDeploy** | `Application` (7), `DeploymentConfig` (12), `DeploymentGroup` (23) |\n| **CodePipeline** | `CustomActionType` (3), `Pipeline` (25), `Webhook` (2) |\n| **Cognito** | `IdentityPool` (3), `IdentityPoolRoleAttachment` (7), `LogDeliveryConfiguration` (3), `ManagedLoginBranding` (2), `UserPool` (52), `UserPoolClient` (21), `UserPoolDomain` (7), `UserPoolGroup` (1), `UserPoolIdentityProvider` (11), `UserPoolResourceServer` (4), `UserPoolRiskConfigurationAttachment` (6), `UserPoolUICustomizationAttachment` (2) |\n| **Config** | `ConfigRule` (6), `ConfigurationAggregator` (2), `ConfigurationRecorder` (7), `ConformancePack` (1), `RemediationConfiguration` (2) |\n| **DocDB** | `DBCluster` (14), `DBInstance` (1), `DBSubnetGroup` (2), `EventSubscription` (1) |\n| **DocDBElastic** | `Cluster` (7) |\n| **DynamoDB** | `GlobalTable` (25), `Table` (28) |\n| **EC2** | `ClientVpnAuthorizationRule` (1), `ClientVpnEndpoint` (6), `DHCPOptions` (2), `EIPAssociation` (1), `FlowLog` (4), `Instance` (10), `KeyPair` (1), `LaunchTemplate` (12), `NatGateway` (2), `NetworkAclEntry` (1), `NetworkInterface` (2), `PlacementGroup` (3), `PrefixList` (3), `Route` (1), `SecurityGroup` (7), `SecurityGroupEgress` (5), `SecurityGroupIngress` (5), `Subnet` (14), `TrafficMirrorTarget` (1), `TransitGateway` (2), `TransitGatewayRoute` (1), `Volume` (6), `VPC` (2), `VPCCidrBlock` (1), `VPCEndpoint` (4), `VPCGatewayAttachment` (1), `VPNConnection` (5) |\n| **ECR** | `PullThroughCacheRule` (3), `RegistryScanningConfiguration` (1), `ReplicationConfiguration` (1), `Repository` (7), `RepositoryCreationTemplate` (8), `SigningConfiguration` (1) |\n| **ECS** | `CapacityProvider` (3), `Cluster` (5), `Service` (37), `TaskDefinition` (66), `TaskSet` (2) |\n| **EFS** | `AccessPoint` (1), `FileSystem` (7), `MountTarget` (4) |\n| **EKS** | `AccessEntry` (14), `Addon` (5), `Cluster` (21), `FargateProfile` (5), `IdentityProviderConfig` (3), `Nodegroup` (21), `PodIdentityAssociation` (5) |\n| **ElastiCache** | `CacheCluster` (9), `ReplicationGroup` (14), `User` (2), `UserGroup` (1) |\n| **ElasticBeanstalk** | `Application` (2), `ConfigurationTemplate` (37), `Environment` (35) |\n| **ElasticLoadBalancingV2** | `Listener` (57), `ListenerCertificate` (2), `ListenerRule` (38), `LoadBalancer` (37), `TargetGroup` (58), `TrustStore` (1), `TrustStoreRevocation` (1) |\n| **Events** | `ApiDestination` (1), `Archive` (5), `Connection` (1), `Endpoint` (2), `EventBus` (2), `Rule` (27) |\n| **EventSchemas** | `Discoverer` (1), `Registry` (1), `RegistryPolicy` (1), `Schema` (1) |\n| **GlobalAccelerator** | `Accelerator` (1), `EndpointGroup` (5), `Listener` (2) |\n| **Glue** | `Classifier` (6), `Connection` (5), `Crawler` (11), `CustomEntityType` (1), `Database` (1), `DataQualityRuleset` (1), `Job` (15), `MLTransform` (4), `Partition` (1), `Schema` (3), `SecurityConfiguration` (1), `Table` (1), `Trigger` (10), `UserDefinedFunction` (2), `Workflow` (1) |\n| **Grafana** | `Workspace` (7) |\n| **IAM** | `Group` (23), `GroupPolicy` (19), `InstanceProfile` (2), `ManagedPolicy` (31), `OIDCProvider` (2), `Policy` (29), `Role` (44), `RolePolicy` (19), `ServiceLinkedRole` (1), `User` (24), `UserPolicy` (19) |\n| **IoT** | `Authorizer` (3), `Certificate` (1), `CertificateProvider` (1), `Command` (1), `DomainConfiguration` (3), `JobTemplate` (3), `MitigationAction` (1), `Policy` (4), `PolicyPrincipalAttachment` (1), `ProvisioningTemplate` (3), `RoleAlias` (1), `ScheduledAudit` (1), `Thing` (1), `ThingGroup` (2), `TopicRule` (5), `TopicRuleDestination` (2) |\n| **Kinesis** | `ResourcePolicy` (4), `Stream` (5), `StreamConsumer` (2) |\n| **KinesisAnalyticsV2** | `Application` (20), `ApplicationCloudWatchLoggingOption` (1), `ApplicationOutput` (1), `ApplicationReferenceDataSource` (1) |\n| **KinesisFirehose** | `DeliveryStream` (68) |\n| **KMS** | `Alias` (2), `Key` (12), `ReplicaKey` (4) |\n| **Lambda** | `Alias` (7), `CodeSigningConfig` (1), `EventInvokeConfig` (5), `EventSourceMapping` (54), `Function` (48), `LayerVersion` (8), `LayerVersionPermission` (3), `Permission` (8), `Url` (8), `Version` (1) |\n| **Logs** | `AccountPolicy` (6), `DeliveryDestination` (3), `Destination` (1), `LogAnomalyDetector` (2), `LogGroup` (10), `MetricFilter` (7), `QueryDefinition` (1), `ResourcePolicy` (1), `SubscriptionFilter` (6), `Transformer` (3) |\n| **MediaConvert** | `JobTemplate` (9), `Preset` (32), `Queue` (2) |\n| **MemoryDB** | `Cluster` (8), `User` (1) |\n| **MSK** | `BatchScramSecret` (2), `Cluster` (31), `ClusterPolicy` (1), `Configuration` (4), `Replicator` (10), `ServerlessCluster` (4) |\n| **Neptune** | `DBCluster` (11), `DBClusterParameterGroup` (1), `DBInstance` (3), `DBSubnetGroup` (1), `GlobalCluster` (1) |\n| **NeptuneGraph** | `Graph` (2), `PrivateGraphEndpoint` (1) |\n| **NetworkFirewall** | `FirewallPolicy` (18), `RuleGroup` (34), `TLSInspectionConfiguration` (7) |\n| **OpenSearchServerless** | `AccessPolicy` (7), `Collection` (2), `CollectionGroup` (3), `LifecyclePolicy` (4), `SecurityConfig` (5), `SecurityPolicy` (14) |\n| **OpenSearchService** | `Domain` (65) |\n| **Pipes** | `Pipe` (9) |\n| **RDS** | `DBCluster` (19), `DBInstance` (33), `DBParameterGroup` (2), `DBProxy` (4), `DBProxyTargetGroup` (2), `DBShardGroup` (1), `DBSubnetGroup` (3), `EventSubscription` (3), `OptionGroup` (1) |\n| **Redshift** | `Cluster` (20), `EventSubscription` (1), `ScheduledAction` (2) |\n| **RedshiftServerless** | `Namespace` (5), `Workgroup` (6) |\n| **Route53** | `CidrCollection` (11), `DNSSEC` (3), `HealthCheck` (30), `HostedZone` (14), `KeySigningKey` (9), `RecordSet` (74), `RecordSetGroup` (76) |\n| **Route53Profiles** | `ProfileAssociation` (1), `ProfileResourceAssociation` (6) |\n| **Route53Resolver** | `FirewallDomainList` (3), `FirewallRuleGroup` (18), `FirewallRuleGroupAssociation` (4), `ResolverDNSSECConfig` (1), `ResolverEndpoint` (18), `ResolverQueryLoggingConfig` (1), `ResolverQueryLoggingConfigAssociation` (1), `ResolverRule` (15), `ResolverRuleAssociation` (1) |\n| **S3** | `AccessPoint` (1), `Bucket` (54), `BucketPolicy` (4), `StorageLens` (5), `StorageLensGroup` (3) |\n| **S3Express** | `AccessPoint` (3), `DirectoryBucket` (11) |\n| **Scheduler** | `Schedule` (12), `ScheduleGroup` (1) |\n| **SecretsManager** | `RotationSchedule` (4), `Secret` (5), `SecretTargetAttachment` (1) |\n| **ServiceDiscovery** | `HttpNamespace` (3), `Instance` (19), `PrivateDnsNamespace` (4), `PublicDnsNamespace` (4), `Service` (13) |\n| **SES** | `ConfigurationSetEventDestination` (8), `ContactList` (1), `EmailIdentity` (6), `ReceiptRule` (6), `ReceiptRuleSet` (1), `Template` (1) |\n| **SNS** | `Subscription` (10), `Topic` (14), `TopicPolicy` (1) |\n| **SQS** | `Queue` (10), `QueuePolicy` (1) |\n| **SSM** | `Association` (4), `Document` (3), `MaintenanceWindow` (2), `MaintenanceWindowTarget` (1), `MaintenanceWindowTask` (1), `Parameter` (5) |\n| **StepFunctions** | `Activity` (3), `StateMachine` (26) |\n| **Synthetics** | `Canary` (16) |\n| **VerifiedPermissions** | `IdentitySource` (3), `Policy` (26), `PolicyStore` (23), `PolicyStoreAlias` (1), `PolicyTemplate` (29) |\n| **VpcLattice** | `AccessLogSubscription` (3), `AuthPolicy` (3), `DomainVerification` (1), `Listener` (12), `ResourceConfiguration` (30), `ResourceGateway` (6), `ResourcePolicy` (1), `Rule` (7), `Service` (2), `ServiceNetwork` (1), `ServiceNetworkResourceAssociation` (3), `ServiceNetworkServiceAssociation` (3), `ServiceNetworkVpcAssociation` (8), `TargetGroup` (14) |\n| **WAFv2** | `IPSet` (3), `LoggingConfiguration` (3), `RegexPatternSet` (3), `RuleGroup` (18), `WebACL` (23), `WebACLAssociation` (2) |\n| **XRay** | `Group` (1), `ResourcePolicy` (3), `SamplingRule` (6) |\n\n</details>\n<!-- supported-resources:end -->\n\nHighlights:\n\n- **ELBv2**: `idle_timeout` / `deregistration_delay` / `slow_start` attribute ranges (stringly-typed Key/Value attributes are invisible to schema validation)\n- **IAM**: managed (6,144 chars) and inline (role/group/user) policy document size limits\n- **CloudFront**: `MinTTL <= DefaultTTL <= MaxTTL` ordering, ACM certificates must live in `us-east-1`\n- **Step Functions**: `Next`/`Default`/`Choices` must reference defined states (a dangling `StartAt` is already caught by the engine's built-in `E3601`)\n- **EC2**: security group TCP/UDP port ranges and `FromPort <= ToPort`\n\n## Pull request report (GitHub Action)\n\nThe repository is also a GitHub Action that synthesizes the app on both sides of a pull request and posts **one comment** with:\n\n- the cdk-preflight findings of the pull request (from `cdk.out/validation-report.json`, or the synth log),\n- the idle cost change, from [cfn-idle-cost](https://github.com/badmintoncryer/cfn-idle-cost) (what the stacks cost a month with zero traffic),\n- the CloudFormation execution role permission change, from [cfn-exec-policy](https://github.com/badmintoncryer/cfn-exec-policy).\n\n```yaml\nname: cdk-report\non: pull_request\npermissions: { contents: read, pull-requests: write }\njobs:\n  report:\n    runs-on: ubuntu-latest\n    steps:\n      - uses: actions/checkout@v7\n      - uses: actions/setup-node@v7\n        with: { node-version: 22 }\n      - uses: badmintoncryer/cdk-preflight@main\n        with:\n          idle-cost-args: --region us-east-1 --max-increase 50\n          exec-policy-args: --fail-on wildcard,unknown\n```\n\nThe base branch is fetched and synthesized in a separate worktree, so neither side needs AWS credentials (unless the app's synth does lookups that are not in `cdk.context.json`). The comment is updated on each push and also written to the job summary. The job fails when the pull request has cdk-preflight errors, does not synthesize, or goes over a budget or `--fail-on` given to the other two tools; the `failed` output says which.\n\n| Input | What it does |\n|---|---|\n| `working-directory` | Directory of the CDK app (where `cdk.json` is). Default `.` |\n| `install` | Install command, run on both sides. Default `npm ci`; empty to skip |\n| `synth` | Synth command, run on both sides. It must write `cdk.out` in the app directory. Default `npx cdk synth -q` |\n| `base-ref` | Branch to compare against. Default: the pull request's base branch |\n| `idle-cost`, `idle-cost-args` | `false` to leave the idle cost out; more `cfn-idle-cost` flags (`--region` is needed for env-agnostic stacks) |\n| `exec-policy`, `exec-policy-args` | `false` to leave the permissions out; more `cfn-exec-policy diff` flags |\n| `comment` | `false` to only write the job summary. Default `true` |\n| `github-token` | Token used to comment. Default `github.token` |\n\nWhen the base branch does not synthesize, the idle cost is shown for the whole app instead of the change, and the permission change is left out.\n\n## For AI agents\n\nTo add cdk-preflight to a CDK app:\n\n1. `npm i -D cdk-preflight`\n2. `npx cdk-preflight init` — or the shorter alias `npx cdkpf init` (finds the entry point via `cdk.json` and inserts `Preflight.apply(app)`; use `--dry-run` to preview)\n3. Run `cdk synth`. Violations fail the synth with a validation report; each finding carries a rule id, the actual value, and a suggested fix\n4. To fix a finding, prefer correcting the resource. To opt out instead: `exclude: ['<rule-id>']` disables one rule, `enforce: false` switches to warn-only reporting\n\nThe machine-readable findings are written to `cdk.out/validation-report.json` when synthesizing with `-c @aws-cdk/core:validationReportJson=true`.\n\nThe two sibling tools also run as MCP servers, so an agent can check the same `cdk.out` for what it costs idle and\nwhat it asks of the CloudFormation execution role:\n\n```sh\nclaude mcp add idle-cost -- npx -y cfn-idle-cost mcp       # idle_cost\nclaude mcp add exec-policy -- npx -y cfn-exec-policy mcp   # exec_policy_explain / _generate / _diff / _doctor\n```\n\n### Report missed deploy errors\n\ncdk-preflight only knows the failure modes it has benched. When a deploy fails on a constraint the pack should have caught, that report is how new rules get added — but at that moment cdk-preflight is out of the loop (it passed the synth), so the instruction has to already sit in your agent's context. Paste this into your repository's `AGENTS.md` (or `CLAUDE.md`):\n\n```markdown\n## cdk-preflight: report missed deploy errors\n\nIf `cdk deploy` fails even though `cdk synth` (with cdk-preflight enabled) passed,\nand the failure is a service-side validation rejection — CREATE_FAILED/UPDATE_FAILED\nwith a 400-class message such as \"Invalid request provided: ...\" — cdk-preflight is\nmissing a rule. Report it:\n\n1. Qualify first. NOT reportable: AccessDenied / permissions, service quotas\n   (those belong to the opt-in `checkQuotas`; open a regular issue if it missed one),\n   throttling, name conflicts with existing resources, stabilization timeouts.\n2. Redact account-specific data (account IDs -> 123456789012, real ARNs/domains\n   -> placeholders).\n3. Search existing issues: https://github.com/badmintoncryer/cdk-preflight/issues\n4. With your user's approval, open a \"Missed deploy error\" issue with the verbatim\n   error message, the resource type, a minimal template snippet, and your\n   aws-cdk-lib / cdk-preflight versions.\n```\n\n## Scope and rule lifecycle\n\nA constraint belongs in the pack when violating it makes a real deployment fail, or lets the deployment succeed and then makes every run of the deployed resource fail (an SSM Automation association that targets several tags, for example), *and* no layer that sees the same synthesized template already blocks it. There is no further \"is this worth a rule\" question — if the gap is real, it gets a rule.\n\nCDK L2 construct validation is deliberately **not** one of those layers. `CfnXxx` usage, escape hatches, `addPropertyOverride`, `cloudformation-include` and migrated templates all bypass L2, so an L2 guard covering the same mistake neither disqualifies a rule nor retires one.\n\nThat makes growth the normal state, and it has a consequence worth knowing before you upgrade: **new rules land in minor releases, so a minor upgrade can newly fail a `cdk synth` that passed yesterday.** That is intended, not a regression. If you need a frozen rule set, pin the version; to drop a single rule, `exclude: ['<rule-id>']`; to see everything without failing the build, `enforce: false`.\n\nRules move the other way too. Once the validation engine bundled in `aws-cdk-lib` starts blocking a constraint, the rule records the engine version that covers it and stops being evaluated on that engine or later — but only where that changes nothing about whether synth fails: with `enforce: false`, with `strict: true`, or when your app sets the context `@aws-cdk/core:validateAgainstDefaultRules: true`. In the default enforce mode the CDK reports its own engine's errors as warnings, so the rule keeps running and you may see both. Users on an older `aws-cdk-lib` keep the rule either way; it is deleted only once the minimum supported `aws-cdk-lib` bundles an engine that covers it.\n\n## How it works\n\n`Preflight.apply()` evaluates the rules with the [cloudformation-validate](https://github.com/aws-cloudformation/cloudformation-validate) Rust/WASM engine that ships inside `aws-cdk-lib` — no extra binaries, and no network access at synth time unless you opt in to `checkQuotas`, which calls AWS from a child process. In the default enforce mode the engine is invoked through a dedicated CDK validation plugin so that violations fail synthesis; with `enforce: false` the rules are instead injected into the CDK built-in `CloudFormationValidatePlugin` and reported as warnings.\n\nConstraints that *can* be expressed in schemas or generic engine rules also make good upstream PRs to that engine, but nothing here waits on one — the upstream release cycle is deliberately slower than this pack's. Each rule's `meta.yaml` tracks its upstream status so that retirement stays bookkeeping.\n\n## Requirements\n\n- `aws-cdk-lib` >= 2.267.0, released 2026-08-27 (the first release that bundles the built-in CloudFormation validator). This is a recent release — an existing CDK app may need an upgrade before cdk-preflight can run.\n\n## Contributing\n\nRule authoring, the verification gates (including real-deploy reproduction), and the test layout are documented in [AGENTS.md](AGENTS.md) — written for AI coding agents and humans alike.\n\n## License\n\nApache-2.0\n"
+    "markdown": "<p align=\"center\">\n  <img src=\"https://raw.githubusercontent.com/badmintoncryer/cdk-preflight/main/assets/logo.png\" alt=\"cdk-preflight\" width=\"104\" height=\"104\">\n</p>\n\n<h1 align=\"center\">cdk-preflight</h1>\n\n<p align=\"center\">\n  <strong>Catch deploy-time CloudFormation failures at <code>cdk synth</code> time.</strong>\n</p>\n\n<p align=\"center\">\n  <a href=\"https://github.com/badmintoncryer/cdk-preflight/actions/workflows/monthly-verify.yml\"><img src=\"https://github.com/badmintoncryer/cdk-preflight/actions/workflows/monthly-verify.yml/badge.svg\" alt=\"monthly real-deploy verification\"></a>\n  <a href=\"https://www.npmjs.com/package/cdk-preflight\"><img src=\"https://img.shields.io/npm/v/cdk-preflight.svg\" alt=\"npm version\"></a>\n  <a href=\"https://www.npmjs.com/package/cdk-preflight\"><img src=\"https://img.shields.io/npm/dt/cdk-preflight.svg\" alt=\"npm total downloads\"></a>\n  <a href=\"docs/rules.md\"><img src=\"https://img.shields.io/badge/rules-3361-blue\" alt=\"3361 bundled rules\"></a>\n</p>\n\nSome CloudFormation constraints are not expressed in resource provider schemas — they live only in documentation, in service API validation, or across multiple properties. Templates that violate them pass `cdk synth`, pass CloudFormation pre-deployment validation, and then fail minutes into a deployment, burning a rollback cycle.\n\ncdk-preflight is a curated [Rego rule pack](docs/rules.md) for exactly those constraints, evaluated with the CloudFormation validation engine that ships inside `aws-cdk-lib` (>= 2.267.0). By default a violation **fails `cdk synth`** — a template that is known to fail at deploy time never leaves your machine.\n\nThe pack aims at **every deploy-time failure, and every post-deploy run that is certain to fail, that no existing CDK mechanism already catches** — nothing narrower. Every bundled rule is backed by a `fail`/`pass` template pair, and the failure has been reproduced against real AWS. The handful of rules that could not be reproduced are marked `doc-only` and report as **warnings**, as does a rule whose remaining false positives cannot be told from the template (a cross-account Lambda layer the owner may have shared): they show up in the validation report but never fail synth. Rules that the built-in validation engine already covers are deliberately **not** duplicated — a test suite enforces this, and a rule the engine catches up with later is skipped on engines that cover it (see [Scope and rule lifecycle](#scope-and-rule-lifecycle)).\n\n> **Requires `aws-cdk-lib` >= 2.267.0** (released 2026-08-27) — the first release that bundles\n> the CloudFormation validation engine. On older versions the rules cannot run at all.\n\n## Quick start\n\n```bash\nnpm i -D cdk-preflight\nnpx cdkpf init   # inserts Preflight.apply(app) into your CDK app\n                         # (`npx cdkpf init` is the same command, shorter)\n```\n\nor add one line yourself:\n\n```ts\nimport { Preflight } from 'cdk-preflight';\n\nconst app = new App();\nPreflight.apply(app);\n```\n\nOn violation, `cdk synth` fails with one error per finding, including the construct trace:\n\n```text\nERROR idle_timeout.timeout_seconds is 5000 but must be between 1 and 4000 seconds (cdk-preflight)\n   MyStack/Alb/Resource (Alb16C2F182) aws-cdk-lib.aws_elasticloadbalancingv2.CfnLoadBalancer\n\nSynthesis finished with errors\n```\n\n## What it catches\n\nFour ordinary-looking snippets. All of them pass `cdk synth` and CloudFormation\npre-deployment validation, and all of them fail minutes into a deployment:\n\n```ts\n// 1) pf-iam-inline-policy-size — enumerate buckets, grant each one, blow past 10,240 chars\n//    \"Maximum policy size of 10240 bytes exceeded for role IngestRole\"\n//    (via role.addToPolicy the CDK auto-splits into managed policies instead,\n//     and you hit the 6,144-char limit as pf-iam-managed-policy-size)\nnew iam.Policy(this, 'IngestPolicy', {\n  roles: [role],\n  statements: [new iam.PolicyStatement({\n    actions: ['s3:GetObject', 's3:ListBucket'],\n    resources: Array.from({ length: 200 },\n      (_, i) => `arn:aws:s3:::data-lake-landing-zone-${i}/year=*/month=*/*`),\n  })],\n});\n\n// 2) pf-lambda-env-size — a config blob in the environment, over the 4KB total\n//    \"Lambda was unable to configure your environment variables because the\n//     environment variables you have provided exceeded the 4KB limit\"\nnew lambda.Function(this, 'Fn', {\n  runtime: lambda.Runtime.NODEJS_22_X,\n  handler: 'index.handler',\n  code: lambda.Code.fromInline('exports.handler = async () => {};'),\n  environment: { FEATURE_FLAGS: JSON.stringify(bigFeatureFlagMap) },\n});\n\n// 3) pf-sfn-asl-missing-state (+ pf-sfn-asl-unreachable-state) — a typo in a state name\n//    \"Invalid State Machine Definition: 'MISSING_TRANSITION_TARGET: ...'\"\nnew sfn.StateMachine(this, 'Pipeline', {\n  definitionBody: sfn.DefinitionBody.fromString(JSON.stringify({\n    StartAt: 'Validate',\n    States: {\n      Validate: { Type: 'Pass', Next: 'Transform' },\n      Trasform: { Type: 'Pass', End: true },   // typo: Transform\n    },\n  })),\n});\n\n// 4) pf-logs-filter-pattern-bracket — a filter pattern opened with '[' and never closed\n//    \"If a filter pattern starts with '[' it must end with ']'\"\nnew logs.MetricFilter(this, 'ErrorFilter', {\n  logGroup,\n  metricNamespace: 'Pipeline',\n  metricName: 'Errors',\n  filterPattern: logs.FilterPattern.literal('[time, level=ERROR, msg'),\n});\n```\n\nNone of these are type errors, so the L2 constructs accept them; none of them are\nexpressible in a resource schema, so CloudFormation accepts the template. With\n`Preflight.apply(app)` in place they fail `cdk synth` instead.\n\n## Observe-only mode\n\nTo roll the rules out gradually, start with `enforce: false`: findings then surface as synth **warnings** through the CDK built-in validator, with construct traces and per-finding acknowledgement:\n\n```ts\nPreflight.apply(app, { enforce: false });\n```\n\n```text\nWARNING idle_timeout.timeout_seconds is 5000 but must be between 1 and 4000 seconds (CloudFormation Validate)\n   MyStack/Alb (Alb) aws-cdk-lib.aws_elasticloadbalancingv2.CfnLoadBalancer\n   Acknowledge with 'CloudFormation-Validate::pf-elbv2-lb-idle-timeout-range'\n```\n\n> **Known limitation with stages.** The AWS CDK CLI drops validation findings for stacks nested in a `Stage`\n> before printing them, so in observe-only mode those findings appear **only** in `cdk.out/validation-report.json`\n> and never on the console. Enforce mode is not affected: cdk-preflight reports such findings itself and fails\n> synthesis. This is a CLI-side bug (present since aws-cdk 2.1128.1), not a rule evaluation problem.\n\n> **If the rules cannot run, the build stops.** When the evaluation engine fails on a template (a rule pack that\n> does not compile, an engine bug), enforce mode reports it as a violation named `pf-engine-error` and fails\n> synthesis for that stack instead of passing green with no rule having run. The other stacks keep their rules.\n> `pf-engine-error` is not a bundled rule and cannot be `exclude`d; `enforce: false` unblocks the build if you\n> need one.\n\n| Option | Default | Effect |\n|---|---|---|\n| `enforce` | `true` | Violations of bundled rules fail synthesis; set to `false` to only warn |\n| `strict` | `false` | With `enforce`: also fail on error-class findings (`ERROR`/`FATAL`, e.g. `F3034`) of the built-in validation engine itself, which the CDK currently downgrades to warnings |\n| `exclude` | `[]` | Rule ids to disable |\n| `includeUpstreamPending` | `true` | Include rules already proposed to the upstream engine but not yet merged |\n| `checkQuotas` | `false` | Also check the target account's Service Quotas and current usage (calls AWS at synth time, see below) |\n| `quotaCacheTtl` | 5 minutes | How long `checkQuotas` reuses the usage and deployed-stack state it fetched |\n\nTo opt out of a single rule everywhere, pass its id in `exclude`. To suppress a\nsingle *finding* on one construct, acknowledge it — this works in both modes, the\nid prefix just differs (`cdk-preflight::` when enforcing, `CloudFormation-Validate::`\nin observe-only, as printed in the warning text):\n\n```ts\ncdk.Validations.of(errorFilter).acknowledge({\n  id: 'cdk-preflight::pf-logs-filter-pattern-bracket',\n  reason: 'log group is written by a legacy producer; pattern is fixed upstream',\n});\n```\n\n## Service quota check (opt-in)\n\nThe rules only read the template, so they never assert a limit an account can raise. `checkQuotas: true` covers that\ngap for the quotas a CDK app runs into most: it adds up what every stack in the app (nested stacks included) is about\nto create in each account and Region, and compares that against the account's applied quota and current usage.\n\n```ts\nPreflight.apply(app, { checkQuotas: true });\n```\n\n| Check | Counts | Against |\n|---|---|---|\n| `pf-quota-vpcs-per-region` | new `AWS::EC2::VPC` | VPCs per Region (`vpc/L-F678F1CE`) |\n| `pf-quota-internet-gateways-per-region` | new `AWS::EC2::InternetGateway` | Internet gateways per Region (`vpc/L-A4707A72`) |\n| `pf-quota-elastic-ips-per-region` | new `AWS::EC2::EIP` (one per NAT gateway in a default `ec2.Vpc`) | EC2-VPC Elastic IPs (`ec2/L-0263D0A3`) |\n| `pf-quota-lambda-unreserved-concurrency` | increase in `ReservedConcurrentExecutions` | Lambda keeps at least 100 concurrent executions unreserved |\n\n- **Only new resources count.** The deployed template of each stack is read with `GetTemplate`; a resource whose\n  logical id and type are already deployed is not counted again, so redeploying an unchanged app never trips the\n  check. Resources behind a `Condition` and the brief overlap during a replacement are not counted.\n- **A finding fails synth** in enforce mode and is a warning with `enforce: false`. Acknowledge one like any other\n  finding (`cdk-preflight::pf-quota-...`; `cdk-preflight-quotas::pf-quota-...` with `enforce: false`). The ids also work in `exclude`, including `pf-quota-check-skipped` to silence the skip warning.\n- **It needs credentials in the app process.** The CDK CLI does not pass `--profile` on to the app, so set\n  `AWS_PROFILE` (or `AWS_*` variables) instead. When the credentials are missing, lack permissions, or belong to a\n  different account than the stack's, the check is skipped with a `pf-quota-check-skipped` warning and synth goes on.\n- **Permissions:** `servicequotas:GetServiceQuota`, `servicequotas:GetAWSDefaultServiceQuota`, `ec2:DescribeVpcs`,\n  `ec2:DescribeInternetGateways`, `ec2:DescribeAddresses`, `lambda:GetAccountSettings`, `cloudformation:GetTemplate`,\n  `cloudformation:DescribeStackResource`. All read-only (`ReadOnlyAccess` covers them). The check also calls\n  `sts:GetCallerIdentity`, which IAM never denies.\n- **Results are cached** in `cdk.out/.cdk-preflight/quota-cache.json`: usage and deployed templates for\n  `quotaCacheTtl` (5 minutes), quota values for 24 hours. Delete the file to force a refetch.\n- Usage can change between synth and deploy (another team deploying to the same account), so a clean check is not a\n  guarantee. The reverse also happens: EC2 does not always enforce the Elastic IP quota when CloudFormation\n  creates several addresses in parallel (measured 2026-10-16: with 4 of 5 in use, two parallel `AWS::EC2::EIP` both\n  succeeded), so a template the check stops may occasionally deploy. The check follows the quota, not the race.\n- **CloudFormation's own quota warning is a different check.** Since June 2026, creating a change set (and\n  `cdk validate` with `--online`, below) warns when a stack would exceed a service quota. That warning runs per stack,\n  after the template is uploaded, and never stops the deploy. `checkQuotas` adds up every stack of the app that\n  targets the same account and Region, and fails `cdk synth` before anything is uploaded. Both can be on.\n\n## Across stacks\n\nTwo checks read every stack of the app at once, because a single template cannot show the problem. They report\n**warnings** (they have not been reproduced on the bench yet, see [Scope](#scope-and-rule-lifecycle)) and never fail\nsynth, in either mode:\n\n| Check | Finds | Deploy error it predicts |\n|---|---|---|\n| `pf-cfn-export-name-conflict` | two stacks that deploy to the same account and Region export the same name (Stages included) | `Export with name X is already exported by stack Y` |\n| `pf-cfn-import-value-missing-export` | `Fn::ImportValue` of a name that starts with the name of a stack of the app (`Producer:...`, CDK's naming) that this stack, in the same account and Region, does not export | `No export named X found` |\n\nImports of names that do not start with a stack name of the app are left alone, since another app may export them.\nAcknowledge a finding with `cdk-preflight-exports::<rule-id>`, or turn a check off with `exclude`.\n\n## With `cdk validate`\n\nThe CDK CLI's experimental `cdk validate` (`cdk --unstable=validate validate`) synthesizes the app and runs its\nvalidation plugins without deploying, so cdk-preflight runs there exactly as in `cdk synth`: in enforce mode a finding\nfails the command, with `enforce: false` it is a warning (checked with CLI 2.1147.0). `--watch` re-runs it on each\nchange. `--online` (the default) also submits the templates to CloudFormation's pre-deployment validation, which\nneeds credentials and adds the server-side checks (resource name conflicts, the quota warning above); `--no-online`\nkeeps it offline.\n\n```sh\nnpx cdk --unstable=validate validate --no-online --watch\n```\n\n## With a CloudFormation template\n\nTemplates written without CDK (JSON or YAML) are checked with `check`. It needs no CDK app and no AWS credentials;\n`aws-cdk-lib` only has to be installed next to cdk-preflight:\n\n```sh\nnpm i -D cdk-preflight aws-cdk-lib constructs\nnpx cdkpf check template.yaml\n```\n\n```text\nERROR idle_timeout.timeout_seconds is 5000 but must be between 1 and 4000 seconds (cdk-preflight)\n   template/Template/Alb (Alb) aws-cdk-lib.aws_elasticloadbalancingv2.CfnLoadBalancer\n   Acknowledge with 'cdk-preflight::pf-elbv2-lb-idle-timeout-range'\n```\n\nEach template is loaded into its own stack with\n[`cloudformation-include`](https://docs.aws.amazon.com/cdk/api/v2/docs/aws-cdk-lib.cloudformation_include-readme.html)\nand synthesized with `Preflight.apply`, so the rules and the output are the same as in `cdk synth`. Findings name the\ntemplate's file (`template`) and logical ID (`Alb`). The exit code is `0` when nothing fails, `1` on findings, and `2`\nwhen a template cannot be read, so the command works as a CI step as it is.\n\n| Flag | What it does |\n|---|---|\n| `--exclude <id,...>` | Rule ids to skip, as `exclude` |\n| `--warn` | Report findings as warnings and exit `0`, as `enforce: false` |\n| `--region <r>`, `--account <id>` | The environment the template deploys to. Rules that depend on the Region or account only run when it is given |\n| `--output <dir>` | Where to write the synthesized assembly and `validation-report.json`. Default: a temporary directory |\n\nSeveral templates can be checked at once: `npx cdkpf check network.yaml app.yaml`.\n`cfn-idle-cost` and `cfn-exec-policy` read template files directly as well.\n\n## Bundled rules\n\nSee [docs/rules.md](docs/rules.md) for the generated rule table.\n\n<!-- supported-resources:start -->\n<details>\n<summary><b>431 resource types across 78 services</b> — click to expand</summary>\n\nResource names are relative to `AWS::<Service>::`; the number in parentheses is how many rules target that type.\n\n| Service | Resource types |\n|---|---|\n| **(any resource type)** | `*` (14) |\n| **ApiGateway** | `ApiKey` (1), `Authorizer` (5), `Deployment` (1), `DocumentationPart` (1), `DomainName` (4), `GatewayResponse` (1), `Method` (14), `Model` (3), `Resource` (1), `RestApi` (5), `Stage` (9), `UsagePlan` (5), `VpcLink` (1) |\n| **ApiGatewayV2** | `Api` (5), `Authorizer` (11), `DomainName` (3), `Integration` (15), `IntegrationResponse` (1), `Model` (2), `Route` (6), `RouteResponse` (2), `Stage` (4), `VpcLink` (1) |\n| **ApplicationAutoScaling** | `ScalableTarget` (19), `ScalingPolicy` (30) |\n| **AppSync** | `Api` (7), `ApiCache` (4), `ApiKey` (2), `ChannelNamespace` (5), `DataSource` (15), `DomainName` (1), `FunctionConfiguration` (24), `GraphQLApi` (16), `GraphQLSchema` (12), `Resolver` (32), `SourceApiAssociation` (3) |\n| **APS** | `AnomalyDetector` (9), `ResourcePolicy` (5), `RuleGroupsNamespace` (10), `Workspace` (12) |\n| **Athena** | `DataCatalog` (6), `WorkGroup` (8) |\n| **AutoScaling** | `AutoScalingGroup` (38), `LifecycleHook` (8), `ScalingPolicy` (41), `ScheduledAction` (13), `WarmPool` (4) |\n| **Backup** | `BackupPlan` (12), `BackupSelection` (5), `BackupVault` (3), `Framework` (3), `LogicallyAirGappedBackupVault` (2), `ReportPlan` (2), `RestoreTestingPlan` (5), `RestoreTestingSelection` (3) |\n| **Batch** | `ComputeEnvironment` (40), `ConsumableResource` (2), `JobDefinition` (109), `JobQueue` (18), `SchedulingPolicy` (8), `ServiceEnvironment` (6) |\n| **Bedrock** | `ApplicationInferenceProfile` (2), `AutomatedReasoningPolicy` (3), `Blueprint` (3), `DataAutomationProject` (8), `DataSource` (12), `Flow` (14), `Guardrail` (19), `IntelligentPromptRouter` (5), `KnowledgeBase` (18), `Prompt` (4) |\n| **BedrockAgentCore** | `ApiKeyCredentialProvider` (1), `BrowserCustom` (1), `BrowserProfile` (1), `CapacityProvider` (8), `CodeInterpreterCustom` (1), `ConfigurationBundle` (4), `Dataset` (3), `Evaluator` (4), `Gateway` (16), `GatewayRateLimit` (5), `GatewayRule` (5), `GatewayTarget` (11), `Harness` (2), `HarnessEndpoint` (2), `Memory` (14), `OAuth2CredentialProvider` (5), `OnlineEvaluationConfig` (3), `PaymentCredentialProvider` (1), `PaymentManager` (1), `Policy` (3), `ResourcePolicy` (1), `Runtime` (16), `RuntimeEndpoint` (1) |\n| **Cassandra** | `Keyspace` (2), `Table` (22), `Type` (13) |\n| **CertificateManager** | `Certificate` (4) |\n| **CloudFormation** | `GuardHook` (1), `Stack` (2), `StackSet` (6) |\n| **CloudFront** | `AnycastIpList` (1), `CachePolicy` (7), `ContinuousDeploymentPolicy` (5), `Distribution` (55), `Function` (4), `KeyGroup` (1), `KeyValueStore` (2), `OriginRequestPolicy` (5), `PublicKey` (1), `RealtimeLogConfig` (3), `ResponseHeadersPolicy` (8), `VpcOrigin` (3) |\n| **CloudTrail** | `EventDataStore` (1), `Trail` (19) |\n| **CloudWatch** | `Alarm` (22), `AnomalyDetector` (6), `CompositeAlarm` (7), `Dashboard` (14), `InsightRule` (7), `MetricStream` (6) |\n| **CodeBuild** | `Project` (37), `ReportGroup` (2), `SourceCredential` (4) |\n| **CodeCommit** | `Repository` (11) |\n| **CodeDeploy** | `Application` (7), `DeploymentConfig` (12), `DeploymentGroup` (23) |\n| **CodePipeline** | `CustomActionType` (3), `Pipeline` (25), `Webhook` (2) |\n| **Cognito** | `IdentityPool` (3), `IdentityPoolRoleAttachment` (7), `LogDeliveryConfiguration` (3), `ManagedLoginBranding` (2), `UserPool` (52), `UserPoolClient` (21), `UserPoolDomain` (7), `UserPoolGroup` (1), `UserPoolIdentityProvider` (11), `UserPoolResourceServer` (4), `UserPoolRiskConfigurationAttachment` (6), `UserPoolUICustomizationAttachment` (2) |\n| **Config** | `ConfigRule` (6), `ConfigurationAggregator` (2), `ConfigurationRecorder` (7), `ConformancePack` (1), `RemediationConfiguration` (2) |\n| **DocDB** | `DBCluster` (14), `DBInstance` (1), `DBSubnetGroup` (2), `EventSubscription` (1) |\n| **DocDBElastic** | `Cluster` (7) |\n| **DynamoDB** | `GlobalTable` (25), `Table` (28) |\n| **EC2** | `ClientVpnAuthorizationRule` (1), `ClientVpnEndpoint` (6), `DHCPOptions` (2), `EIPAssociation` (1), `FlowLog` (4), `Instance` (10), `KeyPair` (1), `LaunchTemplate` (12), `NatGateway` (2), `NetworkAclEntry` (1), `NetworkInterface` (2), `PlacementGroup` (3), `PrefixList` (3), `Route` (1), `SecurityGroup` (7), `SecurityGroupEgress` (5), `SecurityGroupIngress` (5), `Subnet` (14), `TrafficMirrorTarget` (1), `TransitGateway` (2), `TransitGatewayRoute` (1), `Volume` (6), `VPC` (2), `VPCCidrBlock` (1), `VPCEndpoint` (4), `VPCGatewayAttachment` (1), `VPNConnection` (5) |\n| **ECR** | `PullThroughCacheRule` (3), `RegistryScanningConfiguration` (1), `ReplicationConfiguration` (1), `Repository` (7), `RepositoryCreationTemplate` (8), `SigningConfiguration` (1) |\n| **ECS** | `CapacityProvider` (3), `Cluster` (5), `Service` (37), `TaskDefinition` (66), `TaskSet` (2) |\n| **EFS** | `AccessPoint` (1), `FileSystem` (7), `MountTarget` (4) |\n| **EKS** | `AccessEntry` (14), `Addon` (5), `Cluster` (21), `FargateProfile` (5), `IdentityProviderConfig` (3), `Nodegroup` (21), `PodIdentityAssociation` (5) |\n| **ElastiCache** | `CacheCluster` (9), `ReplicationGroup` (14), `User` (2), `UserGroup` (1) |\n| **ElasticBeanstalk** | `Application` (2), `ConfigurationTemplate` (37), `Environment` (35) |\n| **ElasticLoadBalancingV2** | `Listener` (57), `ListenerCertificate` (2), `ListenerRule` (38), `LoadBalancer` (37), `TargetGroup` (58), `TrustStore` (1), `TrustStoreRevocation` (1) |\n| **Events** | `ApiDestination` (1), `Archive` (5), `Connection` (1), `Endpoint` (2), `EventBus` (2), `Rule` (27) |\n| **EventSchemas** | `Discoverer` (1), `Registry` (1), `RegistryPolicy` (1), `Schema` (1) |\n| **GlobalAccelerator** | `Accelerator` (1), `EndpointGroup` (5), `Listener` (2) |\n| **Glue** | `Classifier` (6), `Connection` (5), `Crawler` (11), `CustomEntityType` (1), `Database` (1), `DataQualityRuleset` (1), `Job` (15), `MLTransform` (4), `Partition` (1), `Schema` (3), `SecurityConfiguration` (1), `Table` (1), `Trigger` (10), `UserDefinedFunction` (2), `Workflow` (1) |\n| **Grafana** | `Workspace` (7) |\n| **IAM** | `Group` (23), `GroupPolicy` (19), `InstanceProfile` (2), `ManagedPolicy` (31), `OIDCProvider` (2), `Policy` (29), `Role` (44), `RolePolicy` (19), `ServiceLinkedRole` (1), `User` (24), `UserPolicy` (19) |\n| **IoT** | `Authorizer` (3), `Certificate` (1), `CertificateProvider` (1), `Command` (1), `DomainConfiguration` (3), `JobTemplate` (3), `MitigationAction` (1), `Policy` (4), `PolicyPrincipalAttachment` (1), `ProvisioningTemplate` (3), `RoleAlias` (1), `ScheduledAudit` (1), `Thing` (1), `ThingGroup` (2), `TopicRule` (5), `TopicRuleDestination` (2) |\n| **Kinesis** | `ResourcePolicy` (4), `Stream` (5), `StreamConsumer` (2) |\n| **KinesisAnalyticsV2** | `Application` (20), `ApplicationCloudWatchLoggingOption` (1), `ApplicationOutput` (1), `ApplicationReferenceDataSource` (1) |\n| **KinesisFirehose** | `DeliveryStream` (68) |\n| **KMS** | `Alias` (2), `Key` (12), `ReplicaKey` (4) |\n| **Lambda** | `Alias` (7), `CodeSigningConfig` (1), `EventInvokeConfig` (5), `EventSourceMapping` (54), `Function` (48), `LayerVersion` (8), `LayerVersionPermission` (3), `Permission` (8), `Url` (8), `Version` (1) |\n| **Logs** | `AccountPolicy` (6), `DeliveryDestination` (3), `Destination` (1), `LogAnomalyDetector` (2), `LogGroup` (10), `MetricFilter` (7), `QueryDefinition` (1), `ResourcePolicy` (1), `SubscriptionFilter` (6), `Transformer` (3) |\n| **MediaConvert** | `JobTemplate` (9), `Preset` (32), `Queue` (2) |\n| **MemoryDB** | `Cluster` (8), `User` (1) |\n| **MSK** | `BatchScramSecret` (2), `Cluster` (31), `ClusterPolicy` (1), `Configuration` (4), `Replicator` (10), `ServerlessCluster` (4) |\n| **Neptune** | `DBCluster` (11), `DBClusterParameterGroup` (1), `DBInstance` (3), `DBSubnetGroup` (1), `GlobalCluster` (1) |\n| **NeptuneGraph** | `Graph` (2), `PrivateGraphEndpoint` (1) |\n| **NetworkFirewall** | `FirewallPolicy` (18), `RuleGroup` (34), `TLSInspectionConfiguration` (7) |\n| **OpenSearchServerless** | `AccessPolicy` (7), `Collection` (2), `CollectionGroup` (3), `LifecyclePolicy` (4), `SecurityConfig` (5), `SecurityPolicy` (14) |\n| **OpenSearchService** | `Domain` (65) |\n| **Pipes** | `Pipe` (9) |\n| **RDS** | `DBCluster` (19), `DBInstance` (33), `DBParameterGroup` (2), `DBProxy` (4), `DBProxyTargetGroup` (2), `DBShardGroup` (1), `DBSubnetGroup` (3), `EventSubscription` (3), `OptionGroup` (1) |\n| **Redshift** | `Cluster` (20), `EventSubscription` (1), `ScheduledAction` (2) |\n| **RedshiftServerless** | `Namespace` (5), `Workgroup` (6) |\n| **Route53** | `CidrCollection` (11), `DNSSEC` (3), `HealthCheck` (30), `HostedZone` (14), `KeySigningKey` (9), `RecordSet` (74), `RecordSetGroup` (76) |\n| **Route53Profiles** | `ProfileAssociation` (1), `ProfileResourceAssociation` (6) |\n| **Route53Resolver** | `FirewallDomainList` (3), `FirewallRuleGroup` (18), `FirewallRuleGroupAssociation` (4), `ResolverDNSSECConfig` (1), `ResolverEndpoint` (18), `ResolverQueryLoggingConfig` (1), `ResolverQueryLoggingConfigAssociation` (1), `ResolverRule` (15), `ResolverRuleAssociation` (1) |\n| **S3** | `AccessPoint` (1), `Bucket` (54), `BucketPolicy` (4), `StorageLens` (5), `StorageLensGroup` (3) |\n| **S3Express** | `AccessPoint` (3), `DirectoryBucket` (11) |\n| **Scheduler** | `Schedule` (12), `ScheduleGroup` (1) |\n| **SecretsManager** | `RotationSchedule` (4), `Secret` (5), `SecretTargetAttachment` (1) |\n| **ServiceDiscovery** | `HttpNamespace` (3), `Instance` (19), `PrivateDnsNamespace` (4), `PublicDnsNamespace` (4), `Service` (13) |\n| **SES** | `ConfigurationSetEventDestination` (8), `ContactList` (1), `EmailIdentity` (6), `ReceiptRule` (6), `ReceiptRuleSet` (1), `Template` (1) |\n| **SNS** | `Subscription` (10), `Topic` (14), `TopicPolicy` (1) |\n| **SQS** | `Queue` (10), `QueuePolicy` (1) |\n| **SSM** | `Association` (4), `Document` (3), `MaintenanceWindow` (2), `MaintenanceWindowTarget` (1), `MaintenanceWindowTask` (1), `Parameter` (5) |\n| **StepFunctions** | `Activity` (3), `StateMachine` (26) |\n| **Synthetics** | `Canary` (16) |\n| **VerifiedPermissions** | `IdentitySource` (3), `Policy` (26), `PolicyStore` (23), `PolicyStoreAlias` (1), `PolicyTemplate` (29) |\n| **VpcLattice** | `AccessLogSubscription` (3), `AuthPolicy` (3), `DomainVerification` (1), `Listener` (12), `ResourceConfiguration` (30), `ResourceGateway` (6), `ResourcePolicy` (1), `Rule` (7), `Service` (2), `ServiceNetwork` (1), `ServiceNetworkResourceAssociation` (3), `ServiceNetworkServiceAssociation` (3), `ServiceNetworkVpcAssociation` (8), `TargetGroup` (14) |\n| **WAFv2** | `IPSet` (3), `LoggingConfiguration` (3), `RegexPatternSet` (3), `RuleGroup` (18), `WebACL` (23), `WebACLAssociation` (2) |\n| **XRay** | `Group` (1), `ResourcePolicy` (3), `SamplingRule` (6) |\n\n</details>\n<!-- supported-resources:end -->\n\nHighlights:\n\n- **ELBv2**: `idle_timeout` / `deregistration_delay` / `slow_start` attribute ranges (stringly-typed Key/Value attributes are invisible to schema validation)\n- **IAM**: managed (6,144 chars) and inline (role/group/user) policy document size limits\n- **CloudFront**: `MinTTL <= DefaultTTL <= MaxTTL` ordering, ACM certificates must live in `us-east-1`\n- **Step Functions**: `Next`/`Default`/`Choices` must reference defined states (a dangling `StartAt` is already caught by the engine's built-in `E3601`)\n- **EC2**: security group TCP/UDP port ranges and `FromPort <= ToPort`\n\n## Pull request report (GitHub Action)\n\nThe repository is also a GitHub Action that synthesizes the app on both sides of a pull request and posts **one comment** with:\n\n- the cdk-preflight findings of the pull request (from `cdk.out/validation-report.json`, or the synth log),\n- the idle cost change, from [cfn-idle-cost](https://github.com/badmintoncryer/cfn-idle-cost) (what the stacks cost a month with zero traffic),\n- the CloudFormation execution role permission change, from [cfn-exec-policy](https://github.com/badmintoncryer/cfn-exec-policy).\n\n```yaml\nname: cdk-report\non: pull_request\npermissions: { contents: read, pull-requests: write }\njobs:\n  report:\n    runs-on: ubuntu-latest\n    steps:\n      - uses: actions/checkout@v7\n      - uses: actions/setup-node@v7\n        with: { node-version: 22 }\n      - uses: badmintoncryer/cdk-preflight@main\n        with:\n          idle-cost-args: --region us-east-1 --max-increase 50\n          exec-policy-args: --fail-on wildcard,unknown\n```\n\nThe base branch is fetched and synthesized in a separate worktree, so neither side needs AWS credentials (unless the app's synth does lookups that are not in `cdk.context.json`). The comment is updated on each push and also written to the job summary. The job fails when the pull request has cdk-preflight errors, does not synthesize, or goes over a budget or `--fail-on` given to the other two tools; the `failed` output says which.\n\n| Input | What it does |\n|---|---|\n| `working-directory` | Directory of the CDK app (where `cdk.json` is). Default `.` |\n| `install` | Install command, run on both sides. Default `npm ci`; empty to skip |\n| `synth` | Synth command, run on both sides. It must write `cdk.out` in the app directory. Default `npx cdk synth -q` |\n| `base-ref` | Branch to compare against. Default: the pull request's base branch |\n| `idle-cost`, `idle-cost-args` | `false` to leave the idle cost out; more `cfn-idle-cost` flags (`--region` is needed for env-agnostic stacks) |\n| `exec-policy`, `exec-policy-args` | `false` to leave the permissions out; more `cfn-exec-policy diff` flags |\n| `comment` | `false` to only write the job summary. Default `true` |\n| `github-token` | Token used to comment. Default `github.token` |\n\nWhen the base branch does not synthesize, the idle cost is shown for the whole app instead of the change, and the permission change is left out.\n\n## For AI agents\n\nTo add cdk-preflight to a CDK app:\n\n1. `npm i -D cdk-preflight`\n2. `npx cdk-preflight init` — or the shorter alias `npx cdkpf init` (finds the entry point via `cdk.json` and inserts `Preflight.apply(app)`; use `--dry-run` to preview)\n3. Run `cdk synth`. Violations fail the synth with a validation report; each finding carries a rule id, the actual value, and a suggested fix\n4. To fix a finding, prefer correcting the resource. To opt out instead: `exclude: ['<rule-id>']` disables one rule, `enforce: false` switches to warn-only reporting\n\nThe machine-readable findings are written to `cdk.out/validation-report.json` when synthesizing with `-c @aws-cdk/core:validationReportJson=true`.\n\nFor a CloudFormation template written without CDK, run `npx cdkpf check <template...>` instead (exit `1` on findings; `--output <dir>` keeps `validation-report.json`).\n\nThe two sibling tools also run as MCP servers, so an agent can check the same `cdk.out` for what it costs idle and\nwhat it asks of the CloudFormation execution role:\n\n```sh\nclaude mcp add idle-cost -- npx -y cfn-idle-cost mcp       # idle_cost\nclaude mcp add exec-policy -- npx -y cfn-exec-policy mcp   # exec_policy_explain / _generate / _diff / _doctor\n```\n\n### Report missed deploy errors\n\ncdk-preflight only knows the failure modes it has benched. When a deploy fails on a constraint the pack should have caught, that report is how new rules get added — but at that moment cdk-preflight is out of the loop (it passed the synth), so the instruction has to already sit in your agent's context. Paste this into your repository's `AGENTS.md` (or `CLAUDE.md`):\n\n```markdown\n## cdk-preflight: report missed deploy errors\n\nIf `cdk deploy` fails even though `cdk synth` (with cdk-preflight enabled) passed,\nand the failure is a service-side validation rejection — CREATE_FAILED/UPDATE_FAILED\nwith a 400-class message such as \"Invalid request provided: ...\" — cdk-preflight is\nmissing a rule. Report it:\n\n1. Qualify first. NOT reportable: AccessDenied / permissions, service quotas\n   (those belong to the opt-in `checkQuotas`; open a regular issue if it missed one),\n   throttling, name conflicts with existing resources, stabilization timeouts.\n2. Redact account-specific data (account IDs -> 123456789012, real ARNs/domains\n   -> placeholders).\n3. Search existing issues: https://github.com/badmintoncryer/cdk-preflight/issues\n4. With your user's approval, open a \"Missed deploy error\" issue with the verbatim\n   error message, the resource type, a minimal template snippet, and your\n   aws-cdk-lib / cdk-preflight versions.\n```\n\n## Scope and rule lifecycle\n\nA constraint belongs in the pack when violating it makes a real deployment fail, or lets the deployment succeed and then makes every run of the deployed resource fail (an SSM Automation association that targets several tags, for example), *and* no layer that sees the same synthesized template already blocks it. There is no further \"is this worth a rule\" question — if the gap is real, it gets a rule.\n\nCDK L2 construct validation is deliberately **not** one of those layers. `CfnXxx` usage, escape hatches, `addPropertyOverride`, `cloudformation-include` and migrated templates all bypass L2, so an L2 guard covering the same mistake neither disqualifies a rule nor retires one.\n\nThat makes growth the normal state, and it has a consequence worth knowing before you upgrade: **new rules land in minor releases, so a minor upgrade can newly fail a `cdk synth` that passed yesterday.** That is intended, not a regression. If you need a frozen rule set, pin the version; to drop a single rule, `exclude: ['<rule-id>']`; to see everything without failing the build, `enforce: false`.\n\nRules move the other way too. Once the validation engine bundled in `aws-cdk-lib` starts blocking a constraint, the rule records the engine version that covers it and stops being evaluated on that engine or later — but only where that changes nothing about whether synth fails: with `enforce: false`, with `strict: true`, or when your app sets the context `@aws-cdk/core:validateAgainstDefaultRules: true`. In the default enforce mode the CDK reports its own engine's errors as warnings, so the rule keeps running and you may see both. Users on an older `aws-cdk-lib` keep the rule either way; it is deleted only once the minimum supported `aws-cdk-lib` bundles an engine that covers it.\n\n## How it works\n\n`Preflight.apply()` evaluates the rules with the [cloudformation-validate](https://github.com/aws-cloudformation/cloudformation-validate) Rust/WASM engine that ships inside `aws-cdk-lib` — no extra binaries, and no network access at synth time unless you opt in to `checkQuotas`, which calls AWS from a child process. In the default enforce mode the engine is invoked through a dedicated CDK validation plugin so that violations fail synthesis; with `enforce: false` the rules are instead injected into the CDK built-in `CloudFormationValidatePlugin` and reported as warnings.\n\nConstraints that *can* be expressed in schemas or generic engine rules also make good upstream PRs to that engine, but nothing here waits on one — the upstream release cycle is deliberately slower than this pack's. Each rule's `meta.yaml` tracks its upstream status so that retirement stays bookkeeping.\n\n## Requirements\n\n- `aws-cdk-lib` >= 2.267.0, released 2026-08-27 (the first release that bundles the built-in CloudFormation validator). This is a recent release — an existing CDK app may need an upgrade before cdk-preflight can run.\n\n## Contributing\n\nRule authoring, the verification gates (including real-deploy reproduction), and the test layout are documented in [AGENTS.md](AGENTS.md) — written for AI coding agents and humans alike.\n\n## License\n\nApache-2.0\n"
   },
   "repository": {
     "type": "git",
@@ -9847,6 +9847,6 @@
       "symbolId": "src/index:PreflightOptions"
     }
   },
-  "version": "1.11.1",
-  "fingerprint": "FhDJGk/YFUf3rGxCvea+A/Jfx/70e+6aZ6U5Xg7ujTU="
+  "version": "1.12.1",
+  "fingerprint": "DnEaLfOgNY+4aoZZuiOyYMnfnusN6lnzm9So79Rakbg="
 }

package/README.md

@@ -218,6 +218,38 @@ keeps it offline.
 npx cdk --unstable=validate validate --no-online --watch
 ```
 
+## With a CloudFormation template
+
+Templates written without CDK (JSON or YAML) are checked with `check`. It needs no CDK app and no AWS credentials;
+`aws-cdk-lib` only has to be installed next to cdk-preflight:
+
+```sh
+npm i -D cdk-preflight aws-cdk-lib constructs
+npx cdkpf check template.yaml
+```
+
+```text
+ERROR idle_timeout.timeout_seconds is 5000 but must be between 1 and 4000 seconds (cdk-preflight)
+   template/Template/Alb (Alb) aws-cdk-lib.aws_elasticloadbalancingv2.CfnLoadBalancer
+   Acknowledge with 'cdk-preflight::pf-elbv2-lb-idle-timeout-range'
+```
+
+Each template is loaded into its own stack with
+[`cloudformation-include`](https://docs.aws.amazon.com/cdk/api/v2/docs/aws-cdk-lib.cloudformation_include-readme.html)
+and synthesized with `Preflight.apply`, so the rules and the output are the same as in `cdk synth`. Findings name the
+template's file (`template`) and logical ID (`Alb`). The exit code is `0` when nothing fails, `1` on findings, and `2`
+when a template cannot be read, so the command works as a CI step as it is.
+
+| Flag | What it does |
+|---|---|
+| `--exclude <id,...>` | Rule ids to skip, as `exclude` |
+| `--warn` | Report findings as warnings and exit `0`, as `enforce: false` |
+| `--region <r>`, `--account <id>` | The environment the template deploys to. Rules that depend on the Region or account only run when it is given |
+| `--output <dir>` | Where to write the synthesized assembly and `validation-report.json`. Default: a temporary directory |
+
+Several templates can be checked at once: `npx cdkpf check network.yaml app.yaml`.
+`cfn-idle-cost` and `cfn-exec-policy` read template files directly as well.
+
 ## Bundled rules
 
 See [docs/rules.md](docs/rules.md) for the generated rule table.
@@ -371,6 +403,8 @@ To add cdk-preflight to a CDK app:
 
 The machine-readable findings are written to `cdk.out/validation-report.json` when synthesizing with `-c @aws-cdk/core:validationReportJson=true`.
 
+For a CloudFormation template written without CDK, run `npx cdkpf check <template...>` instead (exit `1` on findings; `--output <dir>` keeps `validation-report.json`).
+
 The two sibling tools also run as MCP servers, so an agent can check the same `cdk.out` for what it costs idle and
 what it asks of the CloudFormation execution role:
 

package/lib/cli.js

@@ -37,15 +37,20 @@ Object.defineProperty(exports, "__esModule", { value: true });
 exports.runCli = runCli;
 /**
  * `npx cdk-preflight init` — 既存 CDK アプリに Preflight.apply(app) を挿入する codemod。
+ * `npx cdk-preflight check <template...>` — CDK を使わずに書いた CloudFormation テンプレートを検査する。
  * 人間にも AI エージェントにも同じ入口を提供する。
  */
 const fs = __importStar(require("fs"));
+const os = __importStar(require("os"));
 const path = __importStar(require("path"));
 /* eslint-disable no-console */
 const USAGE = [
-    'Usage: cdk-preflight init [--dry-run] [--dir <path>]',
-    '',
-    'Inserts `Preflight.apply(app)` into the CDK app entry point found via cdk.json.',
+    'Usage:',
+    '  cdk-preflight init [--dry-run] [--dir <path>]',
+    '      Insert `Preflight.apply(app)` into the CDK app entry point found via cdk.json.',
+    '  cdk-preflight check [--warn] [--exclude <id,...>] [--region <r>] [--account <id>] [--output <dir>] <template...>',
+    '      Check CloudFormation templates (JSON or YAML) written without CDK.',
+    '      Exit 0 when nothing fails, 1 on findings, 2 when a template cannot be read.',
 ].join('\n');
 /**
  * CLI 本体。テストから直接呼べるよう exit せず終了コードを返す。
@@ -56,6 +61,9 @@ function runCli(args) {
         console.log(USAGE);
         return 0;
     }
+    if (cmd === 'check') {
+        return runCheck(args.slice(1));
+    }
     if (cmd !== 'init') {
         console.error(`cdk-preflight: unknown command "${cmd}"\n\n${USAGE}`);
         return 1;
@@ -123,8 +131,114 @@ function runCli(args) {
     ].join('\n'));
     return 0;
 }
+/**
+ * `check`: 各テンプレートを cloudformation-include で 1 スタックずつ読み込んだ App を組み、
+ * Preflight.apply してから synth する。ルールの評価は `cdk synth` と同じ経路を通るので、
+ * 結果も出力も CDK アプリのときと変わらない。
+ */
+function runCheck(args) {
+    const files = [];
+    const exclude = [];
+    let warn = false;
+    let region;
+    let account;
+    let output;
+    for (let i = 0; i < args.length; i++) {
+        const a = args[i];
+        const value = () => {
+            const v = args[++i];
+            if (v === undefined || v.startsWith('--')) {
+                console.error(`cdk-preflight: ${a} needs a value\n\n${USAGE}`);
+                return undefined;
+            }
+            return v;
+        };
+        if (a === '--warn') {
+            warn = true;
+        }
+        else if (a === '--exclude' || a === '--region' || a === '--account' || a === '--output') {
+            const v = value();
+            if (v === undefined)
+                return 2;
+            if (a === '--exclude')
+                exclude.push(...v.split(',').map((x) => x.trim()).filter(Boolean));
+            else if (a === '--region')
+                region = v;
+            else if (a === '--account')
+                account = v;
+            else
+                output = v;
+        }
+        else if (a.startsWith('--')) {
+            console.error(`cdk-preflight: unknown flag "${a}"\n\n${USAGE}`);
+            return 2;
+        }
+        else {
+            files.push(a);
+        }
+    }
+    if (files.length === 0) {
+        console.error(`cdk-preflight: no template given\n\n${USAGE}`);
+        return 2;
+    }
+    for (const f of files) {
+        if (!fs.existsSync(f) || !fs.statSync(f).isFile()) {
+            console.error(`cdk-preflight: template not found: ${f}`);
+            return 2;
+        }
+    }
+    // aws-cdk-lib は peerDependency。`init` だけ使う場合に読み込まずに済むよう、ここで初めて require する。
+    /* eslint-disable @typescript-eslint/no-require-imports */
+    const cdk = require('aws-cdk-lib');
+    const { CfnInclude } = require('aws-cdk-lib/cloudformation-include');
+    const { Preflight } = require('./index');
+    /* eslint-enable @typescript-eslint/no-require-imports */
+    const outdir = output ? path.resolve(output) : fs.mkdtempSync(path.join(os.tmpdir(), 'cdk-preflight-check-'));
+    const app = new cdk.App({ outdir });
+    const env = region || account ? { region, account } : undefined;
+    const used = new Set();
+    try {
+        for (const f of files) {
+            const id = stackId(f, used);
+            const stack = new cdk.Stack(app, id, {
+                env,
+                // テンプレートに無い Rule や Parameter を足さない
+                synthesizer: new cdk.DefaultStackSynthesizer({ generateBootstrapVersionRule: false }),
+            });
+            new CfnInclude(stack, 'Template', { templateFile: f });
+        }
+    }
+    catch (e) {
+        console.error(`cdk-preflight: cannot read template: ${e.message}`);
+        return 2;
+    }
+    Preflight.apply(app, { enforce: !warn, exclude });
+    try {
+        app.synth();
+    }
+    catch (e) {
+        // findings はライブラリ（CDK のフォーマッタ）が出力済み。レポートがあれば検査は走っている。
+        if (fs.existsSync(path.join(outdir, 'validation-report.json')))
+            return 1;
+        console.error(`cdk-preflight: ${e.message}`);
+        return 2;
+    }
+    console.error(`cdk-preflight: checked ${files.length} template(s)${warn ? '' : ', no errors'}`);
+    return 0;
+}
+/** テンプレートのファイル名からスタック名に使える一意な id を作る（`app.yaml` → `app`）。 */
+function stackId(file, used) {
+    let base = path.basename(file, path.extname(file)).replace(/[^A-Za-z0-9-]/g, '-');
+    if (!/^[A-Za-z]/.test(base))
+        base = `T${base}`;
+    let id = base;
+    for (let n = 2; used.has(id); n++)
+        id = `${base}-${n}`;
+    used.add(id);
+    return id;
+}
 /* istanbul ignore next */
 if (require.main === module) {
     process.exit(runCli(process.argv.slice(2)));
 }
-//# sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJmaWxlIjoiY2xpLmpzIiwic291cmNlUm9vdCI6IiIsInNvdXJjZXMiOlsiLi4vc3JjL2NsaS50cyJdLCJuYW1lcyI6W10sIm1hcHBpbmdzIjoiOzs7Ozs7Ozs7Ozs7Ozs7Ozs7Ozs7Ozs7Ozs7Ozs7Ozs7Ozs7QUFtQkEsd0JBMkVDO0FBN0ZEOzs7R0FHRztBQUNILHVDQUF5QjtBQUN6QiwyQ0FBNkI7QUFFN0IsK0JBQStCO0FBRS9CLE1BQU0sS0FBSyxHQUFHO0lBQ1osc0RBQXNEO0lBQ3RELEVBQUU7SUFDRixpRkFBaUY7Q0FDbEYsQ0FBQyxJQUFJLENBQUMsSUFBSSxDQUFDLENBQUM7QUFFYjs7R0FFRztBQUNILFNBQWdCLE1BQU0sQ0FBQyxJQUFjO0lBQ25DLE1BQU0sR0FBRyxHQUFHLElBQUksQ0FBQyxDQUFDLENBQUMsQ0FBQztJQUNwQixJQUFJLEdBQUcsS0FBSyxTQUFTLElBQUksR0FBRyxLQUFLLFFBQVEsSUFBSSxHQUFHLEtBQUssSUFBSSxFQUFFLENBQUM7UUFDMUQsT0FBTyxDQUFDLEdBQUcsQ0FBQyxLQUFLLENBQUMsQ0FBQztRQUNuQixPQUFPLENBQUMsQ0FBQztJQUNYLENBQUM7SUFDRCxJQUFJLEdBQUcsS0FBSyxNQUFNLEVBQUUsQ0FBQztRQUNuQixPQUFPLENBQUMsS0FBSyxDQUFDLG1DQUFtQyxHQUFHLFFBQVEsS0FBSyxFQUFFLENBQUMsQ0FBQztRQUNyRSxPQUFPLENBQUMsQ0FBQztJQUNYLENBQUM7SUFDRCxNQUFNLEdBQUcsR0FBRyxJQUFJLENBQUMsUUFBUSxDQUFDLFdBQVcsQ0FBQyxDQUFDO0lBQ3ZDLE1BQU0sTUFBTSxHQUFHLElBQUksQ0FBQyxPQUFPLENBQUMsT0FBTyxDQUFDLENBQUM7SUFDckMsTUFBTSxHQUFHLEdBQUcsTUFBTSxJQUFJLENBQUMsSUFBSSxJQUFJLENBQUMsTUFBTSxHQUFHLENBQUMsQ0FBQyxDQUFDLENBQUMsQ0FBQyxJQUFJLENBQUMsT0FBTyxDQUFDLElBQUksQ0FBQyxNQUFNLEdBQUcsQ0FBQyxDQUFDLENBQUMsQ0FBQyxDQUFDLENBQUMsT0FBTyxDQUFDLEdBQUcsRUFBRSxDQUFDO0lBRTdGLE1BQU0sV0FBVyxHQUFHLElBQUksQ0FBQyxJQUFJLENBQUMsR0FBRyxFQUFFLFVBQVUsQ0FBQyxDQUFDO0lBQy9DLElBQUksQ0FBQyxFQUFFLENBQUMsVUFBVSxDQUFDLFdBQVcsQ0FBQyxFQUFFLENBQUM7UUFDaEMsT0FBTyxDQUFDLEtBQUssQ0FBQyx1Q0FBdUMsR0FBRyx3Q0FBd0MsQ0FBQyxDQUFDO1FBQ2xHLE9BQU8sQ0FBQyxDQUFDO0lBQ1gsQ0FBQztJQUNELE1BQU0sTUFBTSxHQUFXLElBQUksQ0FBQyxLQUFLLENBQUMsRUFBRSxDQUFDLFlBQVksQ0FBQyxXQUFXLEVBQUUsTUFBTSxDQUFDLENBQUMsQ0FBQyxHQUFHLElBQUksRUFBRSxDQUFDO0lBQ2xGLE1BQU0sVUFBVSxHQUFHLE1BQU0sQ0FBQyxLQUFLLENBQUMsb0NBQW9DLENBQUMsQ0FBQztJQUN0RSxJQUFJLENBQUMsVUFBVSxFQUFFLENBQUM7UUFDaEIsT0FBTyxDQUFDLEtBQUssQ0FBQyxvRUFBb0UsTUFBTSxFQUFFLENBQUMsQ0FBQztRQUM1RixPQUFPLENBQUMsQ0FBQztJQUNYLENBQUM7SUFDRCxNQUFNLEtBQUssR0FBRyxJQUFJLENBQUMsSUFBSSxDQUFDLEdBQUcsRUFBRSxVQUFVLENBQUMsQ0FBQyxDQUFDLENBQUMsQ0FBQztJQUM1QyxJQUFJLENBQUMsRUFBRSxDQUFDLFVBQVUsQ0FBQyxLQUFLLENBQUMsRUFBRSxDQUFDO1FBQzFCLE9BQU8sQ0FBQyxLQUFLLENBQUMsd0NBQXdDLEtBQUssRUFBRSxDQUFDLENBQUM7UUFDL0QsT0FBTyxDQUFDLENBQUM7SUFDWCxDQUFDO0lBRUQsTUFBTSxHQUFHLEdBQUcsRUFBRSxDQUFDLFlBQVksQ0FBQyxLQUFLLEVBQUUsTUFBTSxDQUFDLENBQUM7SUFDM0MsSUFBSSxHQUFHLENBQUMsUUFBUSxDQUFDLGVBQWUsQ0FBQyxFQUFFLENBQUM7UUFDbEMsT0FBTyxDQUFDLEdBQUcsQ0FBQyxrQkFBa0IsS0FBSyxtREFBbUQsQ0FBQyxDQUFDO1FBQ3hGLE9BQU8sQ0FBQyxDQUFDO0lBQ1gsQ0FBQztJQUNELE1BQU0sWUFBWSxHQUFHLEdBQUcsQ0FBQyxLQUFLLENBQUMsdURBQXVELENBQUMsQ0FBQztJQUN4RixJQUFJLENBQUMsWUFBWSxFQUFFLENBQUM7UUFDbEIsT0FBTyxDQUFDLEtBQUssQ0FBQztZQUNaLHFEQUFxRCxLQUFLLGlCQUFpQjtZQUMzRSw4Q0FBOEM7WUFDOUMseUJBQXlCO1NBQzFCLENBQUMsSUFBSSxDQUFDLElBQUksQ0FBQyxDQUFDLENBQUM7UUFDZCxPQUFPLENBQUMsQ0FBQztJQUNYLENBQUM7SUFDRCxNQUFNLE9BQU8sR0FBRyxZQUFZLENBQUMsQ0FBQyxDQUFDLENBQUM7SUFDaEMsTUFBTSxRQUFRLEdBQUcsT0FBTyxDQUFDLEtBQUssQ0FBQywrQkFBK0IsQ0FBQyxDQUFDO0lBQ2hFLE1BQU0sTUFBTSxHQUFHLFFBQVEsQ0FBQyxDQUFDLENBQUMsUUFBUSxDQUFDLENBQUMsQ0FBQyxDQUFDLENBQUMsQ0FBQyxLQUFLLENBQUM7SUFFOUMsbURBQW1EO0lBQ25ELElBQUksT0FBTyxHQUFHLEdBQUcsQ0FBQyxPQUFPLENBQUMsT0FBTyxFQUFFLEdBQUcsRUFBRSxDQUFDLEdBQUcsT0FBTyxxQkFBcUIsTUFBTSxJQUFJLENBQUMsQ0FBQztJQUNwRix5RUFBeUU7SUFDekUsNkJBQTZCO0lBQzdCLE1BQU0sUUFBUSxHQUFHLFFBQVEsQ0FBQyxJQUFJLENBQUMsS0FBSyxDQUFDLElBQUksQ0FBQyxPQUFPLENBQUMsSUFBSSxDQUFDLEtBQUssQ0FBQyxJQUFJLGdCQUFnQixDQUFDLElBQUksQ0FBQyxHQUFHLENBQUMsSUFBSSxDQUFDLGVBQWUsQ0FBQyxJQUFJLENBQUMsR0FBRyxDQUFDLENBQUMsQ0FBQztJQUMzSCxNQUFNLFVBQVUsR0FBRyxRQUFRO1FBQ3pCLENBQUMsQ0FBQyxpREFBaUQ7UUFDbkQsQ0FBQyxDQUFDLDRDQUE0QyxDQUFDO0lBQ2pELHlEQUF5RDtJQUN6RCxNQUFNLElBQUksR0FBRyxPQUFPLENBQUMsS0FBSyxDQUFDLHdEQUF3RCxDQUFDLEVBQUUsQ0FBQyxDQUFDLENBQUMsSUFBSSxFQUFFLENBQUM7SUFDaEcsT0FBTyxHQUFHLEdBQUcsSUFBSSxHQUFHLFVBQVUsS0FBSyxPQUFPLENBQUMsS0FBSyxDQUFDLElBQUksQ0FBQyxNQUFNLENBQUMsRUFBRSxDQUFDO0lBRWhFLElBQUksR0FBRyxFQUFFLENBQUM7UUFDUixPQUFPLENBQUMsR0FBRyxDQUFDLE9BQU8sS0FBSyxtQkFBbUIsT0FBTyxFQUFFLENBQUMsQ0FBQztJQUN4RCxDQUFDO1NBQU0sQ0FBQztRQUNOLEVBQUUsQ0FBQyxhQUFhLENBQUMsS0FBSyxFQUFFLE9BQU8sQ0FBQyxDQUFDO1FBQ2pDLE9BQU8sQ0FBQyxHQUFHLENBQUMsMEJBQTBCLEtBQUssRUFBRSxDQUFDLENBQUM7SUFDakQsQ0FBQztJQUNELE9BQU8sQ0FBQyxHQUFHLENBQUM7UUFDVixFQUFFO1FBQ0YsYUFBYTtRQUNiLHNEQUFzRDtRQUN0RCxvRkFBb0Y7UUFDcEYseUZBQXlGO0tBQzFGLENBQUMsSUFBSSxDQUFDLElBQUksQ0FBQyxDQUFDLENBQUM7SUFDZCxPQUFPLENBQUMsQ0FBQztBQUNYLENBQUM7QUFFRCwwQkFBMEI7QUFDMUIsSUFBSSxPQUFPLENBQUMsSUFBSSxLQUFLLE1BQU0sRUFBRSxDQUFDO0lBQzVCLE9BQU8sQ0FBQyxJQUFJLENBQUMsTUFBTSxDQUFDLE9BQU8sQ0FBQyxJQUFJLENBQUMsS0FBSyxDQUFDLENBQUMsQ0FBQyxDQUFDLENBQUMsQ0FBQztBQUM5QyxDQUFDIiwic291cmNlc0NvbnRlbnQiOlsiIyEvdXNyL2Jpbi9lbnYgbm9kZVxuLyoqXG4gKiBgbnB4IGNkay1wcmVmbGlnaHQgaW5pdGAg4oCUIOaXouWtmCBDREsg44Ki44OX44Oq44GrIFByZWZsaWdodC5hcHBseShhcHApIOOCkuaMv+WFpeOBmeOCiyBjb2RlbW9k44CCXG4gKiDkurrplpPjgavjgoIgQUkg44Ko44O844K444Kn44Oz44OI44Gr44KC5ZCM44GY5YWl5Y+j44KS5o+Q5L6b44GZ44KL44CCXG4gKi9cbmltcG9ydCAqIGFzIGZzIGZyb20gJ2ZzJztcbmltcG9ydCAqIGFzIHBhdGggZnJvbSAncGF0aCc7XG5cbi8qIGVzbGludC1kaXNhYmxlIG5vLWNvbnNvbGUgKi9cblxuY29uc3QgVVNBR0UgPSBbXG4gICdVc2FnZTogY2RrLXByZWZsaWdodCBpbml0IFstLWRyeS1ydW5dIFstLWRpciA8cGF0aD5dJyxcbiAgJycsXG4gICdJbnNlcnRzIGBQcmVmbGlnaHQuYXBwbHkoYXBwKWAgaW50byB0aGUgQ0RLIGFwcCBlbnRyeSBwb2ludCBmb3VuZCB2aWEgY2RrLmpzb24uJyxcbl0uam9pbignXFxuJyk7XG5cbi8qKlxuICogQ0xJIOacrOS9k+OAguODhuOCueODiOOBi+OCieebtOaOpeWRvOOBueOCi+OCiOOBhiBleGl0IOOBm+OBmue1guS6huOCs+ODvOODieOCkui/lOOBmeOAglxuICovXG5leHBvcnQgZnVuY3Rpb24gcnVuQ2xpKGFyZ3M6IHN0cmluZ1tdKTogbnVtYmVyIHtcbiAgY29uc3QgY21kID0gYXJnc1swXTtcbiAgaWYgKGNtZCA9PT0gdW5kZWZpbmVkIHx8IGNtZCA9PT0gJy0taGVscCcgfHwgY21kID09PSAnLWgnKSB7XG4gICAgY29uc29sZS5sb2coVVNBR0UpO1xuICAgIHJldHVybiAwO1xuICB9XG4gIGlmIChjbWQgIT09ICdpbml0Jykge1xuICAgIGNvbnNvbGUuZXJyb3IoYGNkay1wcmVmbGlnaHQ6IHVua25vd24gY29tbWFuZCBcIiR7Y21kfVwiXFxuXFxuJHtVU0FHRX1gKTtcbiAgICByZXR1cm4gMTtcbiAgfVxuICBjb25zdCBkcnkgPSBhcmdzLmluY2x1ZGVzKCctLWRyeS1ydW4nKTtcbiAgY29uc3QgZGlySWR4ID0gYXJncy5pbmRleE9mKCctLWRpcicpO1xuICBjb25zdCBjd2QgPSBkaXJJZHggPj0gMCAmJiBhcmdzW2RpcklkeCArIDFdID8gcGF0aC5yZXNvbHZlKGFyZ3NbZGlySWR4ICsgMV0pIDogcHJvY2Vzcy5jd2QoKTtcblxuICBjb25zdCBjZGtKc29uUGF0aCA9IHBhdGguam9pbihjd2QsICdjZGsuanNvbicpO1xuICBpZiAoIWZzLmV4aXN0c1N5bmMoY2RrSnNvblBhdGgpKSB7XG4gICAgY29uc29sZS5lcnJvcihgY2RrLXByZWZsaWdodDogbm8gY2RrLmpzb24gZm91bmQgaW4gJHtjd2R9IChydW4gaW5zaWRlIGEgQ0RLIGFwcCwgb3IgcGFzcyAtLWRpcilgKTtcbiAgICByZXR1cm4gMTtcbiAgfVxuICBjb25zdCBhcHBDbWQ6IHN0cmluZyA9IEpTT04ucGFyc2UoZnMucmVhZEZpbGVTeW5jKGNka0pzb25QYXRoLCAndXRmOCcpKS5hcHAgPz8gJyc7XG4gIGNvbnN0IGVudHJ5TWF0Y2ggPSBhcHBDbWQubWF0Y2goLyhcXFMrXFwuKD86dHN8bXRzfGN0c3xqc3xtanN8Y2pzKSlcXGIvKTtcbiAgaWYgKCFlbnRyeU1hdGNoKSB7XG4gICAgY29uc29sZS5lcnJvcihgY2RrLXByZWZsaWdodDogY291bGQgbm90IGxvY2F0ZSBhbiBlbnRyeSBmaWxlIGluIGNkay5qc29uIFwiYXBwXCI6ICR7YXBwQ21kfWApO1xuICAgIHJldHVybiAxO1xuICB9XG4gIGNvbnN0IGVudHJ5ID0gcGF0aC5qb2luKGN3ZCwgZW50cnlNYXRjaFsxXSk7XG4gIGlmICghZnMuZXhpc3RzU3luYyhlbnRyeSkpIHtcbiAgICBjb25zb2xlLmVycm9yKGBjZGstcHJlZmxpZ2h0OiBlbnRyeSBmaWxlIG5vdCBmb3VuZDogJHtlbnRyeX1gKTtcbiAgICByZXR1cm4gMTtcbiAgfVxuXG4gIGNvbnN0IHNyYyA9IGZzLnJlYWRGaWxlU3luYyhlbnRyeSwgJ3V0ZjgnKTtcbiAgaWYgKHNyYy5pbmNsdWRlcygnY2RrLXByZWZsaWdodCcpKSB7XG4gICAgY29uc29sZS5sb2coYGNkay1wcmVmbGlnaHQ6ICR7ZW50cnl9IGFscmVhZHkgcmVmZXJlbmNlcyBjZGstcHJlZmxpZ2h0IOKAlCBub3RoaW5nIHRvIGRvYCk7XG4gICAgcmV0dXJuIDA7XG4gIH1cbiAgY29uc3QgYXBwTGluZU1hdGNoID0gc3JjLm1hdGNoKC9eLipcXGJuZXdcXHMrKD86Y2RrXFwuKT9BcHBcXHMqXFwoW147XFxuXSpcXClcXHMqOz9bXlxcU1xcbl0qJC9tKTtcbiAgaWYgKCFhcHBMaW5lTWF0Y2gpIHtcbiAgICBjb25zb2xlLmVycm9yKFtcbiAgICAgIGBjZGstcHJlZmxpZ2h0OiBjb3VsZCBub3QgZmluZCBcXGBuZXcgQXBwKC4uLilcXGAgaW4gJHtlbnRyeX0uIEFkZCBtYW51YWxseTpgLFxuICAgICAgXCIgIGltcG9ydCB7IFByZWZsaWdodCB9IGZyb20gJ2Nkay1wcmVmbGlnaHQnO1wiLFxuICAgICAgJyAgUHJlZmxpZ2h0LmFwcGx5KGFwcCk7JyxcbiAgICBdLmpvaW4oJ1xcbicpKTtcbiAgICByZXR1cm4gMTtcbiAgfVxuICBjb25zdCBhcHBMaW5lID0gYXBwTGluZU1hdGNoWzBdO1xuICBjb25zdCB2YXJNYXRjaCA9IGFwcExpbmUubWF0Y2goLyg/OmNvbnN0fGxldHx2YXIpXFxzKyhcXHcrKVxccyo9Lyk7XG4gIGNvbnN0IGFwcFZhciA9IHZhck1hdGNoID8gdmFyTWF0Y2hbMV0gOiAnYXBwJztcblxuICAvLyDnva7mj5vjgpLplqLmlbDjgafmuKHjgZnjga7jga/jgIHmloflrZfliJfjgaDjgaggQXBwIOOBruihjOOBq+WQq+OBvuOCjOOCiyBgJCZgIOOBquOBqeOBjOWxlemWi+OBleOCjOOBpuOBl+OBvuOBhuOBi+OCieOAglxuICBsZXQgdXBkYXRlZCA9IHNyYy5yZXBsYWNlKGFwcExpbmUsICgpID0+IGAke2FwcExpbmV9XFxuUHJlZmxpZ2h0LmFwcGx5KCR7YXBwVmFyfSk7YCk7XG4gIC8vIENvbW1vbkpT77yIYGNkayBpbml0IC0tbGFuZ3VhZ2UgamF2YXNjcmlwdGAg44Gu5b2i77yJ44GrIGltcG9ydCDjgpLlhaXjgozjgovjgaggRVNNIOOBqOWIpOWumuOBleOCjOOAgVxuICAvLyByZXF1aXJlIOOBjOS9v+OBiOOBquOBj+OBquOBo+OBpuOCouODl+ODquOBjOi1t+WLleOBl+OBquOBhOOAglxuICBjb25zdCBjb21tb25KcyA9IC9cXC5janMkLy50ZXN0KGVudHJ5KSB8fCAoL1xcLmpzJC8udGVzdChlbnRyeSkgJiYgL1xcYnJlcXVpcmVcXHMqXFwoLy50ZXN0KHNyYykgJiYgIS9eXFxzKmltcG9ydFxccy9tLnRlc3Qoc3JjKSk7XG4gIGNvbnN0IGltcG9ydExpbmUgPSBjb21tb25Kc1xuICAgID8gXCJjb25zdCB7IFByZWZsaWdodCB9ID0gcmVxdWlyZSgnY2RrLXByZWZsaWdodCcpO1wiXG4gICAgOiBcImltcG9ydCB7IFByZWZsaWdodCB9IGZyb20gJ2Nkay1wcmVmbGlnaHQnO1wiO1xuICAvLyBzaGViYW5nIOOBryAxIOihjOebruOAgSd1c2Ugc3RyaWN0JyDjga/mnIDliJ3jga7mlofjgafjgarjgZHjgozjgbDlirnjgYvjgarjgYTjga7jgafjgIHjgZ3jga7kuIvjgavlt67jgZfovrzjgoDjgIJcbiAgY29uc3QgaGVhZCA9IHVwZGF0ZWQubWF0Y2goL14oPzojIVteXFxuXSpcXG4pPyg/OlxccyooWydcIl0pdXNlIHN0cmljdFxcMTs/W15cXFNcXG5dKlxcbik/Lyk/LlswXSA/PyAnJztcbiAgdXBkYXRlZCA9IGAke2hlYWR9JHtpbXBvcnRMaW5lfVxcbiR7dXBkYXRlZC5zbGljZShoZWFkLmxlbmd0aCl9YDtcblxuICBpZiAoZHJ5KSB7XG4gICAgY29uc29sZS5sb2coYC0tLSAke2VudHJ5fSAoZHJ5IHJ1bikgLS0tXFxuJHt1cGRhdGVkfWApO1xuICB9IGVsc2Uge1xuICAgIGZzLndyaXRlRmlsZVN5bmMoZW50cnksIHVwZGF0ZWQpO1xuICAgIGNvbnNvbGUubG9nKGBjZGstcHJlZmxpZ2h0OiB1cGRhdGVkICR7ZW50cnl9YCk7XG4gIH1cbiAgY29uc29sZS5sb2coW1xuICAgICcnLFxuICAgICdOZXh0IHN0ZXBzOicsXG4gICAgJyAgMS4gbnBtIGkgLUQgY2RrLXByZWZsaWdodCAgIChpZiBub3QgaW5zdGFsbGVkIHlldCknLFxuICAgICcgIDIuIGNkayBzeW50aCAgICAgICAgICAgICAgICAodmlvbGF0aW9ucyBmYWlsIHRoZSBzeW50aCB3aXRoIGEgdmFsaWRhdGlvbiByZXBvcnQpJyxcbiAgICAnICAzLiBPcHRpb25hbDogUHJlZmxpZ2h0LmFwcGx5KGFwcCwgeyBlbmZvcmNlOiBmYWxzZSB9KSB0byBvbmx5IHdhcm4gaW5zdGVhZCBvZiBmYWlsaW5nJyxcbiAgXS5qb2luKCdcXG4nKSk7XG4gIHJldHVybiAwO1xufVxuXG4vKiBpc3RhbmJ1bCBpZ25vcmUgbmV4dCAqL1xuaWYgKHJlcXVpcmUubWFpbiA9PT0gbW9kdWxlKSB7XG4gIHByb2Nlc3MuZXhpdChydW5DbGkocHJvY2Vzcy5hcmd2LnNsaWNlKDIpKSk7XG59XG4iXX0=
+//# sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJmaWxlIjoiY2xpLmpzIiwic291cmNlUm9vdCI6IiIsInNvdXJjZXMiOlsiLi4vc3JjL2NsaS50cyJdLCJuYW1lcyI6W10sIm1hcHBpbmdzIjoiOzs7Ozs7Ozs7Ozs7Ozs7Ozs7Ozs7Ozs7Ozs7Ozs7Ozs7Ozs7QUF3QkEsd0JBOEVDO0FBckdEOzs7O0dBSUc7QUFDSCx1Q0FBeUI7QUFDekIsdUNBQXlCO0FBQ3pCLDJDQUE2QjtBQUU3QiwrQkFBK0I7QUFFL0IsTUFBTSxLQUFLLEdBQUc7SUFDWixRQUFRO0lBQ1IsaURBQWlEO0lBQ2pELHNGQUFzRjtJQUN0RixvSEFBb0g7SUFDcEgsMEVBQTBFO0lBQzFFLG1GQUFtRjtDQUNwRixDQUFDLElBQUksQ0FBQyxJQUFJLENBQUMsQ0FBQztBQUViOztHQUVHO0FBQ0gsU0FBZ0IsTUFBTSxDQUFDLElBQWM7SUFDbkMsTUFBTSxHQUFHLEdBQUcsSUFBSSxDQUFDLENBQUMsQ0FBQyxDQUFDO0lBQ3BCLElBQUksR0FBRyxLQUFLLFNBQVMsSUFBSSxHQUFHLEtBQUssUUFBUSxJQUFJLEdBQUcsS0FBSyxJQUFJLEVBQUUsQ0FBQztRQUMxRCxPQUFPLENBQUMsR0FBRyxDQUFDLEtBQUssQ0FBQyxDQUFDO1FBQ25CLE9BQU8sQ0FBQyxDQUFDO0lBQ1gsQ0FBQztJQUNELElBQUksR0FBRyxLQUFLLE9BQU8sRUFBRSxDQUFDO1FBQ3BCLE9BQU8sUUFBUSxDQUFDLElBQUksQ0FBQyxLQUFLLENBQUMsQ0FBQyxDQUFDLENBQUMsQ0FBQztJQUNqQyxDQUFDO0lBQ0QsSUFBSSxHQUFHLEtBQUssTUFBTSxFQUFFLENBQUM7UUFDbkIsT0FBTyxDQUFDLEtBQUssQ0FBQyxtQ0FBbUMsR0FBRyxRQUFRLEtBQUssRUFBRSxDQUFDLENBQUM7UUFDckUsT0FBTyxDQUFDLENBQUM7SUFDWCxDQUFDO0lBQ0QsTUFBTSxHQUFHLEdBQUcsSUFBSSxDQUFDLFFBQVEsQ0FBQyxXQUFXLENBQUMsQ0FBQztJQUN2QyxNQUFNLE1BQU0sR0FBRyxJQUFJLENBQUMsT0FBTyxDQUFDLE9BQU8sQ0FBQyxDQUFDO0lBQ3JDLE1BQU0sR0FBRyxHQUFHLE1BQU0sSUFBSSxDQUFDLElBQUksSUFBSSxDQUFDLE1BQU0sR0FBRyxDQUFDLENBQUMsQ0FBQyxDQUFDLENBQUMsSUFBSSxDQUFDLE9BQU8sQ0FBQyxJQUFJLENBQUMsTUFBTSxHQUFHLENBQUMsQ0FBQyxDQUFDLENBQUMsQ0FBQyxDQUFDLE9BQU8sQ0FBQyxHQUFHLEVBQUUsQ0FBQztJQUU3RixNQUFNLFdBQVcsR0FBRyxJQUFJLENBQUMsSUFBSSxDQUFDLEdBQUcsRUFBRSxVQUFVLENBQUMsQ0FBQztJQUMvQyxJQUFJLENBQUMsRUFBRSxDQUFDLFVBQVUsQ0FBQyxXQUFXLENBQUMsRUFBRSxDQUFDO1FBQ2hDLE9BQU8sQ0FBQyxLQUFLLENBQUMsdUNBQXVDLEdBQUcsd0NBQXdDLENBQUMsQ0FBQztRQUNsRyxPQUFPLENBQUMsQ0FBQztJQUNYLENBQUM7SUFDRCxNQUFNLE1BQU0sR0FBVyxJQUFJLENBQUMsS0FBSyxDQUFDLEVBQUUsQ0FBQyxZQUFZLENBQUMsV0FBVyxFQUFFLE1BQU0sQ0FBQyxDQUFDLENBQUMsR0FBRyxJQUFJLEVBQUUsQ0FBQztJQUNsRixNQUFNLFVBQVUsR0FBRyxNQUFNLENBQUMsS0FBSyxDQUFDLG9DQUFvQyxDQUFDLENBQUM7SUFDdEUsSUFBSSxDQUFDLFVBQVUsRUFBRSxDQUFDO1FBQ2hCLE9BQU8sQ0FBQyxLQUFLLENBQUMsb0VBQW9FLE1BQU0sRUFBRSxDQUFDLENBQUM7UUFDNUYsT0FBTyxDQUFDLENBQUM7SUFDWCxDQUFDO0lBQ0QsTUFBTSxLQUFLLEdBQUcsSUFBSSxDQUFDLElBQUksQ0FBQyxHQUFHLEVBQUUsVUFBVSxDQUFDLENBQUMsQ0FBQyxDQUFDLENBQUM7SUFDNUMsSUFBSSxDQUFDLEVBQUUsQ0FBQyxVQUFVLENBQUMsS0FBSyxDQUFDLEVBQUUsQ0FBQztRQUMxQixPQUFPLENBQUMsS0FBSyxDQUFDLHdDQUF3QyxLQUFLLEVBQUUsQ0FBQyxDQUFDO1FBQy9ELE9BQU8sQ0FBQyxDQUFDO0lBQ1gsQ0FBQztJQUVELE1BQU0sR0FBRyxHQUFHLEVBQUUsQ0FBQyxZQUFZLENBQUMsS0FBSyxFQUFFLE1BQU0sQ0FBQyxDQUFDO0lBQzNDLElBQUksR0FBRyxDQUFDLFFBQVEsQ0FBQyxlQUFlLENBQUMsRUFBRSxDQUFDO1FBQ2xDLE9BQU8sQ0FBQyxHQUFHLENBQUMsa0JBQWtCLEtBQUssbURBQW1ELENBQUMsQ0FBQztRQUN4RixPQUFPLENBQUMsQ0FBQztJQUNYLENBQUM7SUFDRCxNQUFNLFlBQVksR0FBRyxHQUFHLENBQUMsS0FBSyxDQUFDLHVEQUF1RCxDQUFDLENBQUM7SUFDeEYsSUFBSSxDQUFDLFlBQVksRUFBRSxDQUFDO1FBQ2xCLE9BQU8sQ0FBQyxLQUFLLENBQUM7WUFDWixxREFBcUQsS0FBSyxpQkFBaUI7WUFDM0UsOENBQThDO1lBQzlDLHlCQUF5QjtTQUMxQixDQUFDLElBQUksQ0FBQyxJQUFJLENBQUMsQ0FBQyxDQUFDO1FBQ2QsT0FBTyxDQUFDLENBQUM7SUFDWCxDQUFDO0lBQ0QsTUFBTSxPQUFPLEdBQUcsWUFBWSxDQUFDLENBQUMsQ0FBQyxDQUFDO0lBQ2hDLE1BQU0sUUFBUSxHQUFHLE9BQU8sQ0FBQyxLQUFLLENBQUMsK0JBQStCLENBQUMsQ0FBQztJQUNoRSxNQUFNLE1BQU0sR0FBRyxRQUFRLENBQUMsQ0FBQyxDQUFDLFFBQVEsQ0FBQyxDQUFDLENBQUMsQ0FBQyxDQUFDLENBQUMsS0FBSyxDQUFDO0lBRTlDLG1EQUFtRDtJQUNuRCxJQUFJLE9BQU8sR0FBRyxHQUFHLENBQUMsT0FBTyxDQUFDLE9BQU8sRUFBRSxHQUFHLEVBQUUsQ0FBQyxHQUFHLE9BQU8scUJBQXFCLE1BQU0sSUFBSSxDQUFDLENBQUM7SUFDcEYseUVBQXlFO0lBQ3pFLDZCQUE2QjtJQUM3QixNQUFNLFFBQVEsR0FBRyxRQUFRLENBQUMsSUFBSSxDQUFDLEtBQUssQ0FBQyxJQUFJLENBQUMsT0FBTyxDQUFDLElBQUksQ0FBQyxLQUFLLENBQUMsSUFBSSxnQkFBZ0IsQ0FBQyxJQUFJLENBQUMsR0FBRyxDQUFDLElBQUksQ0FBQyxlQUFlLENBQUMsSUFBSSxDQUFDLEdBQUcsQ0FBQyxDQUFDLENBQUM7SUFDM0gsTUFBTSxVQUFVLEdBQUcsUUFBUTtRQUN6QixDQUFDLENBQUMsaURBQWlEO1FBQ25ELENBQUMsQ0FBQyw0Q0FBNEMsQ0FBQztJQUNqRCx5REFBeUQ7SUFDekQsTUFBTSxJQUFJLEdBQUcsT0FBTyxDQUFDLEtBQUssQ0FBQyx3REFBd0QsQ0FBQyxFQUFFLENBQUMsQ0FBQyxDQUFDLElBQUksRUFBRSxDQUFDO0lBQ2hHLE9BQU8sR0FBRyxHQUFHLElBQUksR0FBRyxVQUFVLEtBQUssT0FBTyxDQUFDLEtBQUssQ0FBQyxJQUFJLENBQUMsTUFBTSxDQUFDLEVBQUUsQ0FBQztJQUVoRSxJQUFJLEdBQUcsRUFBRSxDQUFDO1FBQ1IsT0FBTyxDQUFDLEdBQUcsQ0FBQyxPQUFPLEtBQUssbUJBQW1CLE9BQU8sRUFBRSxDQUFDLENBQUM7SUFDeEQsQ0FBQztTQUFNLENBQUM7UUFDTixFQUFFLENBQUMsYUFBYSxDQUFDLEtBQUssRUFBRSxPQUFPLENBQUMsQ0FBQztRQUNqQyxPQUFPLENBQUMsR0FBRyxDQUFDLDBCQUEwQixLQUFLLEVBQUUsQ0FBQyxDQUFDO0lBQ2pELENBQUM7SUFDRCxPQUFPLENBQUMsR0FBRyxDQUFDO1FBQ1YsRUFBRTtRQUNGLGFBQWE7UUFDYixzREFBc0Q7UUFDdEQsb0ZBQW9GO1FBQ3BGLHlGQUF5RjtLQUMxRixDQUFDLElBQUksQ0FBQyxJQUFJLENBQUMsQ0FBQyxDQUFDO0lBQ2QsT0FBTyxDQUFDLENBQUM7QUFDWCxDQUFDO0FBRUQ7Ozs7R0FJRztBQUNILFNBQVMsUUFBUSxDQUFDLElBQWM7SUFDOUIsTUFBTSxLQUFLLEdBQWEsRUFBRSxDQUFDO0lBQzNCLE1BQU0sT0FBTyxHQUFhLEVBQUUsQ0FBQztJQUM3QixJQUFJLElBQUksR0FBRyxLQUFLLENBQUM7SUFDakIsSUFBSSxNQUEwQixDQUFDO0lBQy9CLElBQUksT0FBMkIsQ0FBQztJQUNoQyxJQUFJLE1BQTBCLENBQUM7SUFDL0IsS0FBSyxJQUFJLENBQUMsR0FBRyxDQUFDLEVBQUUsQ0FBQyxHQUFHLElBQUksQ0FBQyxNQUFNLEVBQUUsQ0FBQyxFQUFFLEVBQUUsQ0FBQztRQUNyQyxNQUFNLENBQUMsR0FBRyxJQUFJLENBQUMsQ0FBQyxDQUFDLENBQUM7UUFDbEIsTUFBTSxLQUFLLEdBQUcsR0FBdUIsRUFBRTtZQUNyQyxNQUFNLENBQUMsR0FBRyxJQUFJLENBQUMsRUFBRSxDQUFDLENBQUMsQ0FBQztZQUNwQixJQUFJLENBQUMsS0FBSyxTQUFTLElBQUksQ0FBQyxDQUFDLFVBQVUsQ0FBQyxJQUFJLENBQUMsRUFBRSxDQUFDO2dCQUMxQyxPQUFPLENBQUMsS0FBSyxDQUFDLGtCQUFrQixDQUFDLHFCQUFxQixLQUFLLEVBQUUsQ0FBQyxDQUFDO2dCQUMvRCxPQUFPLFNBQVMsQ0FBQztZQUNuQixDQUFDO1lBQ0QsT0FBTyxDQUFDLENBQUM7UUFDWCxDQUFDLENBQUM7UUFDRixJQUFJLENBQUMsS0FBSyxRQUFRLEVBQUUsQ0FBQztZQUNuQixJQUFJLEdBQUcsSUFBSSxDQUFDO1FBQ2QsQ0FBQzthQUFNLElBQUksQ0FBQyxLQUFLLFdBQVcsSUFBSSxDQUFDLEtBQUssVUFBVSxJQUFJLENBQUMsS0FBSyxXQUFXLElBQUksQ0FBQyxLQUFLLFVBQVUsRUFBRSxDQUFDO1lBQzFGLE1BQU0sQ0FBQyxHQUFHLEtBQUssRUFBRSxDQUFDO1lBQ2xCLElBQUksQ0FBQyxLQUFLLFNBQVM7Z0JBQUUsT0FBTyxDQUFDLENBQUM7WUFDOUIsSUFBSSxDQUFDLEtBQUssV0FBVztnQkFBRSxPQUFPLENBQUMsSUFBSSxDQUFDLEdBQUcsQ0FBQyxDQUFDLEtBQUssQ0FBQyxHQUFHLENBQUMsQ0FBQyxHQUFHLENBQUMsQ0FBQyxDQUFDLEVBQUUsRUFBRSxDQUFDLENBQUMsQ0FBQyxJQUFJLEVBQUUsQ0FBQyxDQUFDLE1BQU0sQ0FBQyxPQUFPLENBQUMsQ0FBQyxDQUFDO2lCQUNyRixJQUFJLENBQUMsS0FBSyxVQUFVO2dCQUFFLE1BQU0sR0FBRyxDQUFDLENBQUM7aUJBQ2pDLElBQUksQ0FBQyxLQUFLLFdBQVc7Z0JBQUUsT0FBTyxHQUFHLENBQUMsQ0FBQzs7Z0JBQ25DLE1BQU0sR0FBRyxDQUFDLENBQUM7UUFDbEIsQ0FBQzthQUFNLElBQUksQ0FBQyxDQUFDLFVBQVUsQ0FBQyxJQUFJLENBQUMsRUFBRSxDQUFDO1lBQzlCLE9BQU8sQ0FBQyxLQUFLLENBQUMsZ0NBQWdDLENBQUMsUUFBUSxLQUFLLEVBQUUsQ0FBQyxDQUFDO1lBQ2hFLE9BQU8sQ0FBQyxDQUFDO1FBQ1gsQ0FBQzthQUFNLENBQUM7WUFDTixLQUFLLENBQUMsSUFBSSxDQUFDLENBQUMsQ0FBQyxDQUFDO1FBQ2hCLENBQUM7SUFDSCxDQUFDO0lBQ0QsSUFBSSxLQUFLLENBQUMsTUFBTSxLQUFLLENBQUMsRUFBRSxDQUFDO1FBQ3ZCLE9BQU8sQ0FBQyxLQUFLLENBQUMsdUNBQXVDLEtBQUssRUFBRSxDQUFDLENBQUM7UUFDOUQsT0FBTyxDQUFDLENBQUM7SUFDWCxDQUFDO0lBQ0QsS0FBSyxNQUFNLENBQUMsSUFBSSxLQUFLLEVBQUUsQ0FBQztRQUN0QixJQUFJLENBQUMsRUFBRSxDQUFDLFVBQVUsQ0FBQyxDQUFDLENBQUMsSUFBSSxDQUFDLEVBQUUsQ0FBQyxRQUFRLENBQUMsQ0FBQyxDQUFDLENBQUMsTUFBTSxFQUFFLEVBQUUsQ0FBQztZQUNsRCxPQUFPLENBQUMsS0FBSyxDQUFDLHNDQUFzQyxDQUFDLEVBQUUsQ0FBQyxDQUFDO1lBQ3pELE9BQU8sQ0FBQyxDQUFDO1FBQ1gsQ0FBQztJQUNILENBQUM7SUFFRCwyRUFBMkU7SUFDM0UsMERBQTBEO0lBQzFELE1BQU0sR0FBRyxHQUFpQyxPQUFPLENBQUMsYUFBYSxDQUFDLENBQUM7SUFDakUsTUFBTSxFQUFFLFVBQVUsRUFBRSxHQUF3RCxPQUFPLENBQUMsb0NBQW9DLENBQUMsQ0FBQztJQUMxSCxNQUFNLEVBQUUsU0FBUyxFQUFFLEdBQTZCLE9BQU8sQ0FBQyxTQUFTLENBQUMsQ0FBQztJQUNuRSx5REFBeUQ7SUFFekQsTUFBTSxNQUFNLEdBQUcsTUFBTSxDQUFDLENBQUMsQ0FBQyxJQUFJLENBQUMsT0FBTyxDQUFDLE1BQU0sQ0FBQyxDQUFDLENBQUMsQ0FBQyxFQUFFLENBQUMsV0FBVyxDQUFDLElBQUksQ0FBQyxJQUFJLENBQUMsRUFBRSxDQUFDLE1BQU0sRUFBRSxFQUFFLHNCQUFzQixDQUFDLENBQUMsQ0FBQztJQUM5RyxNQUFNLEdBQUcsR0FBRyxJQUFJLEdBQUcsQ0FBQyxHQUFHLENBQUMsRUFBRSxNQUFNLEVBQUUsQ0FBQyxDQUFDO0lBQ3BDLE1BQU0sR0FBRyxHQUFHLE1BQU0sSUFBSSxPQUFPLENBQUMsQ0FBQyxDQUFDLEVBQUUsTUFBTSxFQUFFLE9BQU8sRUFBRSxDQUFDLENBQUMsQ0FBQyxTQUFTLENBQUM7SUFDaEUsTUFBTSxJQUFJLEdBQUcsSUFBSSxHQUFHLEVBQVUsQ0FBQztJQUMvQixJQUFJLENBQUM7UUFDSCxLQUFLLE1BQU0sQ0FBQyxJQUFJLEtBQUssRUFBRSxDQUFDO1lBQ3RCLE1BQU0sRUFBRSxHQUFHLE9BQU8sQ0FBQyxDQUFDLEVBQUUsSUFBSSxDQUFDLENBQUM7WUFDNUIsTUFBTSxLQUFLLEdBQUcsSUFBSSxHQUFHLENBQUMsS0FBSyxDQUFDLEdBQUcsRUFBRSxFQUFFLEVBQUU7Z0JBQ25DLEdBQUc7Z0JBQ0gsbUNBQW1DO2dCQUNuQyxXQUFXLEVBQUUsSUFBSSxHQUFHLENBQUMsdUJBQXVCLENBQUMsRUFBRSw0QkFBNEIsRUFBRSxLQUFLLEVBQUUsQ0FBQzthQUN0RixDQUFDLENBQUM7WUFDSCxJQUFJLFVBQVUsQ0FBQyxLQUFLLEVBQUUsVUFBVSxFQUFFLEVBQUUsWUFBWSxFQUFFLENBQUMsRUFBRSxDQUFDLENBQUM7UUFDekQsQ0FBQztJQUNILENBQUM7SUFBQyxPQUFPLENBQUMsRUFBRSxDQUFDO1FBQ1gsT0FBTyxDQUFDLEtBQUssQ0FBQyx3Q0FBeUMsQ0FBVyxDQUFDLE9BQU8sRUFBRSxDQUFDLENBQUM7UUFDOUUsT0FBTyxDQUFDLENBQUM7SUFDWCxDQUFDO0lBQ0QsU0FBUyxDQUFDLEtBQUssQ0FBQyxHQUFHLEVBQUUsRUFBRSxPQUFPLEVBQUUsQ0FBQyxJQUFJLEVBQUUsT0FBTyxFQUFFLENBQUMsQ0FBQztJQUVsRCxJQUFJLENBQUM7UUFDSCxHQUFHLENBQUMsS0FBSyxFQUFFLENBQUM7SUFDZCxDQUFDO0lBQUMsT0FBTyxDQUFDLEVBQUUsQ0FBQztRQUNYLHNEQUFzRDtRQUN0RCxJQUFJLEVBQUUsQ0FBQyxVQUFVLENBQUMsSUFBSSxDQUFDLElBQUksQ0FBQyxNQUFNLEVBQUUsd0JBQXdCLENBQUMsQ0FBQztZQUFFLE9BQU8sQ0FBQyxDQUFDO1FBQ3pFLE9BQU8sQ0FBQyxLQUFLLENBQUMsa0JBQW1CLENBQVcsQ0FBQyxPQUFPLEVBQUUsQ0FBQyxDQUFDO1FBQ3hELE9BQU8sQ0FBQyxDQUFDO0lBQ1gsQ0FBQztJQUNELE9BQU8sQ0FBQyxLQUFLLENBQUMsMEJBQTBCLEtBQUssQ0FBQyxNQUFNLGVBQWUsSUFBSSxDQUFDLENBQUMsQ0FBQyxFQUFFLENBQUMsQ0FBQyxDQUFDLGFBQWEsRUFBRSxDQUFDLENBQUM7SUFDaEcsT0FBTyxDQUFDLENBQUM7QUFDWCxDQUFDO0FBRUQsNkRBQTZEO0FBQzdELFNBQVMsT0FBTyxDQUFDLElBQVksRUFBRSxJQUFpQjtJQUM5QyxJQUFJLElBQUksR0FBRyxJQUFJLENBQUMsUUFBUSxDQUFDLElBQUksRUFBRSxJQUFJLENBQUMsT0FBTyxDQUFDLElBQUksQ0FBQyxDQUFDLENBQUMsT0FBTyxDQUFDLGdCQUFnQixFQUFFLEdBQUcsQ0FBQyxDQUFDO0lBQ2xGLElBQUksQ0FBQyxXQUFXLENBQUMsSUFBSSxDQUFDLElBQUksQ0FBQztRQUFFLElBQUksR0FBRyxJQUFJLElBQUksRUFBRSxDQUFDO0lBQy9DLElBQUksRUFBRSxHQUFHLElBQUksQ0FBQztJQUNkLEtBQUssSUFBSSxDQUFDLEdBQUcsQ0FBQyxFQUFFLElBQUksQ0FBQyxHQUFHLENBQUMsRUFBRSxDQUFDLEVBQUUsQ0FBQyxFQUFFO1FBQUUsRUFBRSxHQUFHLEdBQUcsSUFBSSxJQUFJLENBQUMsRUFBRSxDQUFDO0lBQ3ZELElBQUksQ0FBQyxHQUFHLENBQUMsRUFBRSxDQUFDLENBQUM7SUFDYixPQUFPLEVBQUUsQ0FBQztBQUNaLENBQUM7QUFFRCwwQkFBMEI7QUFDMUIsSUFBSSxPQUFPLENBQUMsSUFBSSxLQUFLLE1BQU0sRUFBRSxDQUFDO0lBQzVCLE9BQU8sQ0FBQyxJQUFJLENBQUMsTUFBTSxDQUFDLE9BQU8sQ0FBQyxJQUFJLENBQUMsS0FBSyxDQUFDLENBQUMsQ0FBQyxDQUFDLENBQUMsQ0FBQztBQUM5QyxDQUFDIiwic291cmNlc0NvbnRlbnQiOlsiIyEvdXNyL2Jpbi9lbnYgbm9kZVxuLyoqXG4gKiBgbnB4IGNkay1wcmVmbGlnaHQgaW5pdGAg4oCUIOaXouWtmCBDREsg44Ki44OX44Oq44GrIFByZWZsaWdodC5hcHBseShhcHApIOOCkuaMv+WFpeOBmeOCiyBjb2RlbW9k44CCXG4gKiBgbnB4IGNkay1wcmVmbGlnaHQgY2hlY2sgPHRlbXBsYXRlLi4uPmAg4oCUIENESyDjgpLkvb/jgo/jgZrjgavmm7jjgYTjgZ8gQ2xvdWRGb3JtYXRpb24g44OG44Oz44OX44Os44O844OI44KS5qSc5p+744GZ44KL44CCXG4gKiDkurrplpPjgavjgoIgQUkg44Ko44O844K444Kn44Oz44OI44Gr44KC5ZCM44GY5YWl5Y+j44KS5o+Q5L6b44GZ44KL44CCXG4gKi9cbmltcG9ydCAqIGFzIGZzIGZyb20gJ2ZzJztcbmltcG9ydCAqIGFzIG9zIGZyb20gJ29zJztcbmltcG9ydCAqIGFzIHBhdGggZnJvbSAncGF0aCc7XG5cbi8qIGVzbGludC1kaXNhYmxlIG5vLWNvbnNvbGUgKi9cblxuY29uc3QgVVNBR0UgPSBbXG4gICdVc2FnZTonLFxuICAnICBjZGstcHJlZmxpZ2h0IGluaXQgWy0tZHJ5LXJ1bl0gWy0tZGlyIDxwYXRoPl0nLFxuICAnICAgICAgSW5zZXJ0IGBQcmVmbGlnaHQuYXBwbHkoYXBwKWAgaW50byB0aGUgQ0RLIGFwcCBlbnRyeSBwb2ludCBmb3VuZCB2aWEgY2RrLmpzb24uJyxcbiAgJyAgY2RrLXByZWZsaWdodCBjaGVjayBbLS13YXJuXSBbLS1leGNsdWRlIDxpZCwuLi4+XSBbLS1yZWdpb24gPHI+XSBbLS1hY2NvdW50IDxpZD5dIFstLW91dHB1dCA8ZGlyPl0gPHRlbXBsYXRlLi4uPicsXG4gICcgICAgICBDaGVjayBDbG91ZEZvcm1hdGlvbiB0ZW1wbGF0ZXMgKEpTT04gb3IgWUFNTCkgd3JpdHRlbiB3aXRob3V0IENESy4nLFxuICAnICAgICAgRXhpdCAwIHdoZW4gbm90aGluZyBmYWlscywgMSBvbiBmaW5kaW5ncywgMiB3aGVuIGEgdGVtcGxhdGUgY2Fubm90IGJlIHJlYWQuJyxcbl0uam9pbignXFxuJyk7XG5cbi8qKlxuICogQ0xJIOacrOS9k+OAguODhuOCueODiOOBi+OCieebtOaOpeWRvOOBueOCi+OCiOOBhiBleGl0IOOBm+OBmue1guS6huOCs+ODvOODieOCkui/lOOBmeOAglxuICovXG5leHBvcnQgZnVuY3Rpb24gcnVuQ2xpKGFyZ3M6IHN0cmluZ1tdKTogbnVtYmVyIHtcbiAgY29uc3QgY21kID0gYXJnc1swXTtcbiAgaWYgKGNtZCA9PT0gdW5kZWZpbmVkIHx8IGNtZCA9PT0gJy0taGVscCcgfHwgY21kID09PSAnLWgnKSB7XG4gICAgY29uc29sZS5sb2coVVNBR0UpO1xuICAgIHJldHVybiAwO1xuICB9XG4gIGlmIChjbWQgPT09ICdjaGVjaycpIHtcbiAgICByZXR1cm4gcnVuQ2hlY2soYXJncy5zbGljZSgxKSk7XG4gIH1cbiAgaWYgKGNtZCAhPT0gJ2luaXQnKSB7XG4gICAgY29uc29sZS5lcnJvcihgY2RrLXByZWZsaWdodDogdW5rbm93biBjb21tYW5kIFwiJHtjbWR9XCJcXG5cXG4ke1VTQUdFfWApO1xuICAgIHJldHVybiAxO1xuICB9XG4gIGNvbnN0IGRyeSA9IGFyZ3MuaW5jbHVkZXMoJy0tZHJ5LXJ1bicpO1xuICBjb25zdCBkaXJJZHggPSBhcmdzLmluZGV4T2YoJy0tZGlyJyk7XG4gIGNvbnN0IGN3ZCA9IGRpcklkeCA+PSAwICYmIGFyZ3NbZGlySWR4ICsgMV0gPyBwYXRoLnJlc29sdmUoYXJnc1tkaXJJZHggKyAxXSkgOiBwcm9jZXNzLmN3ZCgpO1xuXG4gIGNvbnN0IGNka0pzb25QYXRoID0gcGF0aC5qb2luKGN3ZCwgJ2Nkay5qc29uJyk7XG4gIGlmICghZnMuZXhpc3RzU3luYyhjZGtKc29uUGF0aCkpIHtcbiAgICBjb25zb2xlLmVycm9yKGBjZGstcHJlZmxpZ2h0OiBubyBjZGsuanNvbiBmb3VuZCBpbiAke2N3ZH0gKHJ1biBpbnNpZGUgYSBDREsgYXBwLCBvciBwYXNzIC0tZGlyKWApO1xuICAgIHJldHVybiAxO1xuICB9XG4gIGNvbnN0IGFwcENtZDogc3RyaW5nID0gSlNPTi5wYXJzZShmcy5yZWFkRmlsZVN5bmMoY2RrSnNvblBhdGgsICd1dGY4JykpLmFwcCA/PyAnJztcbiAgY29uc3QgZW50cnlNYXRjaCA9IGFwcENtZC5tYXRjaCgvKFxcUytcXC4oPzp0c3xtdHN8Y3RzfGpzfG1qc3xjanMpKVxcYi8pO1xuICBpZiAoIWVudHJ5TWF0Y2gpIHtcbiAgICBjb25zb2xlLmVycm9yKGBjZGstcHJlZmxpZ2h0OiBjb3VsZCBub3QgbG9jYXRlIGFuIGVudHJ5IGZpbGUgaW4gY2RrLmpzb24gXCJhcHBcIjogJHthcHBDbWR9YCk7XG4gICAgcmV0dXJuIDE7XG4gIH1cbiAgY29uc3QgZW50cnkgPSBwYXRoLmpvaW4oY3dkLCBlbnRyeU1hdGNoWzFdKTtcbiAgaWYgKCFmcy5leGlzdHNTeW5jKGVudHJ5KSkge1xuICAgIGNvbnNvbGUuZXJyb3IoYGNkay1wcmVmbGlnaHQ6IGVudHJ5IGZpbGUgbm90IGZvdW5kOiAke2VudHJ5fWApO1xuICAgIHJldHVybiAxO1xuICB9XG5cbiAgY29uc3Qgc3JjID0gZnMucmVhZEZpbGVTeW5jKGVudHJ5LCAndXRmOCcpO1xuICBpZiAoc3JjLmluY2x1ZGVzKCdjZGstcHJlZmxpZ2h0JykpIHtcbiAgICBjb25zb2xlLmxvZyhgY2RrLXByZWZsaWdodDogJHtlbnRyeX0gYWxyZWFkeSByZWZlcmVuY2VzIGNkay1wcmVmbGlnaHQg4oCUIG5vdGhpbmcgdG8gZG9gKTtcbiAgICByZXR1cm4gMDtcbiAgfVxuICBjb25zdCBhcHBMaW5lTWF0Y2ggPSBzcmMubWF0Y2goL14uKlxcYm5ld1xccysoPzpjZGtcXC4pP0FwcFxccypcXChbXjtcXG5dKlxcKVxccyo7P1teXFxTXFxuXSokL20pO1xuICBpZiAoIWFwcExpbmVNYXRjaCkge1xuICAgIGNvbnNvbGUuZXJyb3IoW1xuICAgICAgYGNkay1wcmVmbGlnaHQ6IGNvdWxkIG5vdCBmaW5kIFxcYG5ldyBBcHAoLi4uKVxcYCBpbiAke2VudHJ5fS4gQWRkIG1hbnVhbGx5OmAsXG4gICAgICBcIiAgaW1wb3J0IHsgUHJlZmxpZ2h0IH0gZnJvbSAnY2RrLXByZWZsaWdodCc7XCIsXG4gICAgICAnICBQcmVmbGlnaHQuYXBwbHkoYXBwKTsnLFxuICAgIF0uam9pbignXFxuJykpO1xuICAgIHJldHVybiAxO1xuICB9XG4gIGNvbnN0IGFwcExpbmUgPSBhcHBMaW5lTWF0Y2hbMF07XG4gIGNvbnN0IHZhck1hdGNoID0gYXBwTGluZS5tYXRjaCgvKD86Y29uc3R8bGV0fHZhcilcXHMrKFxcdyspXFxzKj0vKTtcbiAgY29uc3QgYXBwVmFyID0gdmFyTWF0Y2ggPyB2YXJNYXRjaFsxXSA6ICdhcHAnO1xuXG4gIC8vIOe9ruaPm+OCkumWouaVsOOBp+a4oeOBmeOBruOBr+OAgeaWh+Wtl+WIl+OBoOOBqCBBcHAg44Gu6KGM44Gr5ZCr44G+44KM44KLIGAkJmAg44Gq44Gp44GM5bGV6ZaL44GV44KM44Gm44GX44G+44GG44GL44KJ44CCXG4gIGxldCB1cGRhdGVkID0gc3JjLnJlcGxhY2UoYXBwTGluZSwgKCkgPT4gYCR7YXBwTGluZX1cXG5QcmVmbGlnaHQuYXBwbHkoJHthcHBWYXJ9KTtgKTtcbiAgLy8gQ29tbW9uSlPvvIhgY2RrIGluaXQgLS1sYW5ndWFnZSBqYXZhc2NyaXB0YCDjga7lvaLvvInjgasgaW1wb3J0IOOCkuWFpeOCjOOCi+OBqCBFU00g44Go5Yik5a6a44GV44KM44CBXG4gIC8vIHJlcXVpcmUg44GM5L2/44GI44Gq44GP44Gq44Gj44Gm44Ki44OX44Oq44GM6LW35YuV44GX44Gq44GE44CCXG4gIGNvbnN0IGNvbW1vbkpzID0gL1xcLmNqcyQvLnRlc3QoZW50cnkpIHx8ICgvXFwuanMkLy50ZXN0KGVudHJ5KSAmJiAvXFxicmVxdWlyZVxccypcXCgvLnRlc3Qoc3JjKSAmJiAhL15cXHMqaW1wb3J0XFxzL20udGVzdChzcmMpKTtcbiAgY29uc3QgaW1wb3J0TGluZSA9IGNvbW1vbkpzXG4gICAgPyBcImNvbnN0IHsgUHJlZmxpZ2h0IH0gPSByZXF1aXJlKCdjZGstcHJlZmxpZ2h0Jyk7XCJcbiAgICA6IFwiaW1wb3J0IHsgUHJlZmxpZ2h0IH0gZnJvbSAnY2RrLXByZWZsaWdodCc7XCI7XG4gIC8vIHNoZWJhbmcg44GvIDEg6KGM55uu44CBJ3VzZSBzdHJpY3QnIOOBr+acgOWIneOBruaWh+OBp+OBquOBkeOCjOOBsOWKueOBi+OBquOBhOOBruOBp+OAgeOBneOBruS4i+OBq+W3ruOBl+i+vOOCgOOAglxuICBjb25zdCBoZWFkID0gdXBkYXRlZC5tYXRjaCgvXig/OiMhW15cXG5dKlxcbik/KD86XFxzKihbJ1wiXSl1c2Ugc3RyaWN0XFwxOz9bXlxcU1xcbl0qXFxuKT8vKT8uWzBdID8/ICcnO1xuICB1cGRhdGVkID0gYCR7aGVhZH0ke2ltcG9ydExpbmV9XFxuJHt1cGRhdGVkLnNsaWNlKGhlYWQubGVuZ3RoKX1gO1xuXG4gIGlmIChkcnkpIHtcbiAgICBjb25zb2xlLmxvZyhgLS0tICR7ZW50cnl9IChkcnkgcnVuKSAtLS1cXG4ke3VwZGF0ZWR9YCk7XG4gIH0gZWxzZSB7XG4gICAgZnMud3JpdGVGaWxlU3luYyhlbnRyeSwgdXBkYXRlZCk7XG4gICAgY29uc29sZS5sb2coYGNkay1wcmVmbGlnaHQ6IHVwZGF0ZWQgJHtlbnRyeX1gKTtcbiAgfVxuICBjb25zb2xlLmxvZyhbXG4gICAgJycsXG4gICAgJ05leHQgc3RlcHM6JyxcbiAgICAnICAxLiBucG0gaSAtRCBjZGstcHJlZmxpZ2h0ICAgKGlmIG5vdCBpbnN0YWxsZWQgeWV0KScsXG4gICAgJyAgMi4gY2RrIHN5bnRoICAgICAgICAgICAgICAgICh2aW9sYXRpb25zIGZhaWwgdGhlIHN5bnRoIHdpdGggYSB2YWxpZGF0aW9uIHJlcG9ydCknLFxuICAgICcgIDMuIE9wdGlvbmFsOiBQcmVmbGlnaHQuYXBwbHkoYXBwLCB7IGVuZm9yY2U6IGZhbHNlIH0pIHRvIG9ubHkgd2FybiBpbnN0ZWFkIG9mIGZhaWxpbmcnLFxuICBdLmpvaW4oJ1xcbicpKTtcbiAgcmV0dXJuIDA7XG59XG5cbi8qKlxuICogYGNoZWNrYDog5ZCE44OG44Oz44OX44Os44O844OI44KSIGNsb3VkZm9ybWF0aW9uLWluY2x1ZGUg44GnIDEg44K544K/44OD44Kv44Ga44Gk6Kqt44G/6L6844KT44GgIEFwcCDjgpLntYTjgb/jgIFcbiAqIFByZWZsaWdodC5hcHBseSDjgZfjgabjgYvjgokgc3ludGgg44GZ44KL44CC44Or44O844Or44Gu6KmV5L6h44GvIGBjZGsgc3ludGhgIOOBqOWQjOOBmOe1jOi3r+OCkumAmuOCi+OBruOBp+OAgVxuICog57WQ5p6c44KC5Ye65Yqb44KCIENESyDjgqLjg5fjg6rjga7jgajjgY3jgajlpInjgo/jgonjgarjgYTjgIJcbiAqL1xuZnVuY3Rpb24gcnVuQ2hlY2soYXJnczogc3RyaW5nW10pOiBudW1iZXIge1xuICBjb25zdCBmaWxlczogc3RyaW5nW10gPSBbXTtcbiAgY29uc3QgZXhjbHVkZTogc3RyaW5nW10gPSBbXTtcbiAgbGV0IHdhcm4gPSBmYWxzZTtcbiAgbGV0IHJlZ2lvbjogc3RyaW5nIHwgdW5kZWZpbmVkO1xuICBsZXQgYWNjb3VudDogc3RyaW5nIHwgdW5kZWZpbmVkO1xuICBsZXQgb3V0cHV0OiBzdHJpbmcgfCB1bmRlZmluZWQ7XG4gIGZvciAobGV0IGkgPSAwOyBpIDwgYXJncy5sZW5ndGg7IGkrKykge1xuICAgIGNvbnN0IGEgPSBhcmdzW2ldO1xuICAgIGNvbnN0IHZhbHVlID0gKCk6IHN0cmluZyB8IHVuZGVmaW5lZCA9PiB7XG4gICAgICBjb25zdCB2ID0gYXJnc1srK2ldO1xuICAgICAgaWYgKHYgPT09IHVuZGVmaW5lZCB8fCB2LnN0YXJ0c1dpdGgoJy0tJykpIHtcbiAgICAgICAgY29uc29sZS5lcnJvcihgY2RrLXByZWZsaWdodDogJHthfSBuZWVkcyBhIHZhbHVlXFxuXFxuJHtVU0FHRX1gKTtcbiAgICAgICAgcmV0dXJuIHVuZGVmaW5lZDtcbiAgICAgIH1cbiAgICAgIHJldHVybiB2O1xuICAgIH07XG4gICAgaWYgKGEgPT09ICctLXdhcm4nKSB7XG4gICAgICB3YXJuID0gdHJ1ZTtcbiAgICB9IGVsc2UgaWYgKGEgPT09ICctLWV4Y2x1ZGUnIHx8IGEgPT09ICctLXJlZ2lvbicgfHwgYSA9PT0gJy0tYWNjb3VudCcgfHwgYSA9PT0gJy0tb3V0cHV0Jykge1xuICAgICAgY29uc3QgdiA9IHZhbHVlKCk7XG4gICAgICBpZiAodiA9PT0gdW5kZWZpbmVkKSByZXR1cm4gMjtcbiAgICAgIGlmIChhID09PSAnLS1leGNsdWRlJykgZXhjbHVkZS5wdXNoKC4uLnYuc3BsaXQoJywnKS5tYXAoKHgpID0+IHgudHJpbSgpKS5maWx0ZXIoQm9vbGVhbikpO1xuICAgICAgZWxzZSBpZiAoYSA9PT0gJy0tcmVnaW9uJykgcmVnaW9uID0gdjtcbiAgICAgIGVsc2UgaWYgKGEgPT09ICctLWFjY291bnQnKSBhY2NvdW50ID0gdjtcbiAgICAgIGVsc2Ugb3V0cHV0ID0gdjtcbiAgICB9IGVsc2UgaWYgKGEuc3RhcnRzV2l0aCgnLS0nKSkge1xuICAgICAgY29uc29sZS5lcnJvcihgY2RrLXByZWZsaWdodDogdW5rbm93biBmbGFnIFwiJHthfVwiXFxuXFxuJHtVU0FHRX1gKTtcbiAgICAgIHJldHVybiAyO1xuICAgIH0gZWxzZSB7XG4gICAgICBmaWxlcy5wdXNoKGEpO1xuICAgIH1cbiAgfVxuICBpZiAoZmlsZXMubGVuZ3RoID09PSAwKSB7XG4gICAgY29uc29sZS5lcnJvcihgY2RrLXByZWZsaWdodDogbm8gdGVtcGxhdGUgZ2l2ZW5cXG5cXG4ke1VTQUdFfWApO1xuICAgIHJldHVybiAyO1xuICB9XG4gIGZvciAoY29uc3QgZiBvZiBmaWxlcykge1xuICAgIGlmICghZnMuZXhpc3RzU3luYyhmKSB8fCAhZnMuc3RhdFN5bmMoZikuaXNGaWxlKCkpIHtcbiAgICAgIGNvbnNvbGUuZXJyb3IoYGNkay1wcmVmbGlnaHQ6IHRlbXBsYXRlIG5vdCBmb3VuZDogJHtmfWApO1xuICAgICAgcmV0dXJuIDI7XG4gICAgfVxuICB9XG5cbiAgLy8gYXdzLWNkay1saWIg44GvIHBlZXJEZXBlbmRlbmN544CCYGluaXRgIOOBoOOBkeS9v+OBhuWgtOWQiOOBq+iqreOBv+i+vOOBvuOBmuOBq+a4iOOCgOOCiOOBhuOAgeOBk+OBk+OBp+WIneOCgeOBpiByZXF1aXJlIOOBmeOCi+OAglxuICAvKiBlc2xpbnQtZGlzYWJsZSBAdHlwZXNjcmlwdC1lc2xpbnQvbm8tcmVxdWlyZS1pbXBvcnRzICovXG4gIGNvbnN0IGNkazogdHlwZW9mIGltcG9ydCgnYXdzLWNkay1saWInKSA9IHJlcXVpcmUoJ2F3cy1jZGstbGliJyk7XG4gIGNvbnN0IHsgQ2ZuSW5jbHVkZSB9OiB0eXBlb2YgaW1wb3J0KCdhd3MtY2RrLWxpYi9jbG91ZGZvcm1hdGlvbi1pbmNsdWRlJykgPSByZXF1aXJlKCdhd3MtY2RrLWxpYi9jbG91ZGZvcm1hdGlvbi1pbmNsdWRlJyk7XG4gIGNvbnN0IHsgUHJlZmxpZ2h0IH06IHR5cGVvZiBpbXBvcnQoJy4vaW5kZXgnKSA9IHJlcXVpcmUoJy4vaW5kZXgnKTtcbiAgLyogZXNsaW50LWVuYWJsZSBAdHlwZXNjcmlwdC1lc2xpbnQvbm8tcmVxdWlyZS1pbXBvcnRzICovXG5cbiAgY29uc3Qgb3V0ZGlyID0gb3V0cHV0ID8gcGF0aC5yZXNvbHZlKG91dHB1dCkgOiBmcy5ta2R0ZW1wU3luYyhwYXRoLmpvaW4ob3MudG1wZGlyKCksICdjZGstcHJlZmxpZ2h0LWNoZWNrLScpKTtcbiAgY29uc3QgYXBwID0gbmV3IGNkay5BcHAoeyBvdXRkaXIgfSk7XG4gIGNvbnN0IGVudiA9IHJlZ2lvbiB8fCBhY2NvdW50ID8geyByZWdpb24sIGFjY291bnQgfSA6IHVuZGVmaW5lZDtcbiAgY29uc3QgdXNlZCA9IG5ldyBTZXQ8c3RyaW5nPigpO1xuICB0cnkge1xuICAgIGZvciAoY29uc3QgZiBvZiBmaWxlcykge1xuICAgICAgY29uc3QgaWQgPSBzdGFja0lkKGYsIHVzZWQpO1xuICAgICAgY29uc3Qgc3RhY2sgPSBuZXcgY2RrLlN0YWNrKGFwcCwgaWQsIHtcbiAgICAgICAgZW52LFxuICAgICAgICAvLyDjg4bjg7Pjg5fjg6zjg7zjg4jjgavnhKHjgYQgUnVsZSDjgoQgUGFyYW1ldGVyIOOCkui2s+OBleOBquOBhFxuICAgICAgICBzeW50aGVzaXplcjogbmV3IGNkay5EZWZhdWx0U3RhY2tTeW50aGVzaXplcih7IGdlbmVyYXRlQm9vdHN0cmFwVmVyc2lvblJ1bGU6IGZhbHNlIH0pLFxuICAgICAgfSk7XG4gICAgICBuZXcgQ2ZuSW5jbHVkZShzdGFjaywgJ1RlbXBsYXRlJywgeyB0ZW1wbGF0ZUZpbGU6IGYgfSk7XG4gICAgfVxuICB9IGNhdGNoIChlKSB7XG4gICAgY29uc29sZS5lcnJvcihgY2RrLXByZWZsaWdodDogY2Fubm90IHJlYWQgdGVtcGxhdGU6ICR7KGUgYXMgRXJyb3IpLm1lc3NhZ2V9YCk7XG4gICAgcmV0dXJuIDI7XG4gIH1cbiAgUHJlZmxpZ2h0LmFwcGx5KGFwcCwgeyBlbmZvcmNlOiAhd2FybiwgZXhjbHVkZSB9KTtcblxuICB0cnkge1xuICAgIGFwcC5zeW50aCgpO1xuICB9IGNhdGNoIChlKSB7XG4gICAgLy8gZmluZGluZ3Mg44Gv44Op44Kk44OW44Op44Oq77yIQ0RLIOOBruODleOCqeODvOODnuODg+OCv++8ieOBjOWHuuWKm+a4iOOBv+OAguODrOODneODvOODiOOBjOOBguOCjOOBsOaknOafu+OBr+i1sOOBo+OBpuOBhOOCi+OAglxuICAgIGlmIChmcy5leGlzdHNTeW5jKHBhdGguam9pbihvdXRkaXIsICd2YWxpZGF0aW9uLXJlcG9ydC5qc29uJykpKSByZXR1cm4gMTtcbiAgICBjb25zb2xlLmVycm9yKGBjZGstcHJlZmxpZ2h0OiAkeyhlIGFzIEVycm9yKS5tZXNzYWdlfWApO1xuICAgIHJldHVybiAyO1xuICB9XG4gIGNvbnNvbGUuZXJyb3IoYGNkay1wcmVmbGlnaHQ6IGNoZWNrZWQgJHtmaWxlcy5sZW5ndGh9IHRlbXBsYXRlKHMpJHt3YXJuID8gJycgOiAnLCBubyBlcnJvcnMnfWApO1xuICByZXR1cm4gMDtcbn1cblxuLyoqIOODhuODs+ODl+ODrOODvOODiOOBruODleOCoeOCpOODq+WQjeOBi+OCieOCueOCv+ODg+OCr+WQjeOBq+S9v+OBiOOCi+S4gOaEj+OBqiBpZCDjgpLkvZzjgovvvIhgYXBwLnlhbWxgIOKGkiBgYXBwYO+8ieOAgiAqL1xuZnVuY3Rpb24gc3RhY2tJZChmaWxlOiBzdHJpbmcsIHVzZWQ6IFNldDxzdHJpbmc+KTogc3RyaW5nIHtcbiAgbGV0IGJhc2UgPSBwYXRoLmJhc2VuYW1lKGZpbGUsIHBhdGguZXh0bmFtZShmaWxlKSkucmVwbGFjZSgvW15BLVphLXowLTktXS9nLCAnLScpO1xuICBpZiAoIS9eW0EtWmEtel0vLnRlc3QoYmFzZSkpIGJhc2UgPSBgVCR7YmFzZX1gO1xuICBsZXQgaWQgPSBiYXNlO1xuICBmb3IgKGxldCBuID0gMjsgdXNlZC5oYXMoaWQpOyBuKyspIGlkID0gYCR7YmFzZX0tJHtufWA7XG4gIHVzZWQuYWRkKGlkKTtcbiAgcmV0dXJuIGlkO1xufVxuXG4vKiBpc3RhbmJ1bCBpZ25vcmUgbmV4dCAqL1xuaWYgKHJlcXVpcmUubWFpbiA9PT0gbW9kdWxlKSB7XG4gIHByb2Nlc3MuZXhpdChydW5DbGkocHJvY2Vzcy5hcmd2LnNsaWNlKDIpKSk7XG59XG4iXX0=

package/lib/index.js

@@ -19,7 +19,7 @@ const rules_generated_1 = require("./rules.generated");
  * Preflight.apply(app);
  */
 class Preflight {
-    static [JSII_RTTI_SYMBOL_1] = { fqn: "cdk-preflight.Preflight", version: "1.11.1" };
+    static [JSII_RTTI_SYMBOL_1] = { fqn: "cdk-preflight.Preflight", version: "1.12.1" };
     /**
      * Register the cdk-preflight rules on an App or Stage.
      */

package/llms.txt

@@ -14,7 +14,8 @@ Scope: every deploy-time failure, and every post-deploy run that is certain to f
 6. Machine-readable findings: synth with `-c @aws-cdk/core:validationReportJson=true`, then read `cdk.out/validation-report.json`.
 7. Without deploying or a full synth step: `cdk --unstable=validate validate --no-online` runs the same rules (add `--watch` to re-run on change).
 8. Across stacks (warnings, never fail synth): `pf-cfn-export-name-conflict` (two stacks in one account and Region export the same name) and `pf-cfn-import-value-missing-export` (an import named `<app stack>:...` that stack does not export). Acknowledge with `cdk-preflight-exports::<rule-id>`.
-9. Sibling MCP servers for the same cdk.out: `npx -y cfn-idle-cost mcp` (idle cost) and `npx -y cfn-exec-policy mcp` (execution role permissions).
+9. Plain CloudFormation templates (no CDK app): `npx cdkpf check [--exclude <id,...>] [--warn] [--region r] [--account id] [--output dir] <template...>` loads each template with cloudformation-include and runs the same rules. Exit 0 clean, 1 findings, 2 unreadable template or usage error.
+10. Sibling MCP servers for the same cdk.out: `npx -y cfn-idle-cost mcp` (idle cost) and `npx -y cfn-exec-policy mcp` (execution role permissions).
 
 ## Key files
 

package/node_modules/@aws-sdk/client-cloudformation/dist-cjs/index.js

@@ -69,7 +69,7 @@ const commonParams = {
     UseDualStack: { type: "builtInParams", name: "useDualstackEndpoint" },
 };
 
-var version = "3.1151.0";
+var version = "3.1160.0";
 var packageInfo = {
 	version: version};
 

package/node_modules/@aws-sdk/client-cloudformation/dist-types/CloudFormationClient.d.ts

@@ -218,7 +218,8 @@ export interface ClientDefaults extends Partial<__SmithyConfiguration<__HttpHand
     maxAttempts?: number | __Provider<number>;
     /**
      * Specifies which retry algorithm to use.
-     * @see https://docs.aws.amazon.com/AWSJavaScriptSDK/v3/latest/Package/-smithy-util-retry/Enum/RETRY_MODES/
+     * Accepted values are "standard" and "adaptive".
+     * @see https://docs.aws.amazon.com/sdkref/latest/guide/feature-retry-behavior.html
      *
      */
     retryMode?: string | __Provider<string>;

package/node_modules/@aws-sdk/client-cloudformation/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@aws-sdk/client-cloudformation",
-  "version": "3.1152.0",
+  "version": "3.1161.0",
   "description": "AWS SDK for JavaScript Cloudformation Client for Node.js, Browser and React Native",
   "homepage": "https://github.com/aws/aws-sdk-js-v3/tree/main/clients/client-cloudformation",
   "license": "Apache-2.0",
@@ -48,12 +48,12 @@
     "test:index": "tsc -p tsconfig.test.json && node ./test/index-objects.spec.mjs"
   },
   "dependencies": {
-    "@aws-sdk/core": "^3.978.3",
-    "@aws-sdk/credential-provider-node": "^3.972.86",
-    "@aws-sdk/types": "^3.974.6",
-    "@smithy/core": "^3.35.2",
+    "@aws-sdk/core": "^3.979.1",
+    "@aws-sdk/credential-provider-node": "^3.972.92",
+    "@aws-sdk/types": "^3.975.0",
+    "@smithy/core": "^3.38.0",
     "@smithy/fetch-http-handler": "^5.8.0",
-    "@smithy/node-http-handler": "^4.12.1",
+    "@smithy/node-http-handler": "^4.14.0",
     "@smithy/types": "^4.19.0",
     "tslib": "^2.6.2"
   },

package/node_modules/@aws-sdk/client-ec2/README.md

@@ -4160,6 +4160,13 @@ GetCapacityManagerMonitoredTagKeys
 </details>
 <details>
 <summary>
+GetCapacityManagerSupportabilityScores
+</summary>
+
+[Command API Reference](https://docs.aws.amazon.com/AWSJavaScriptSDK/v3/latest/client/ec2/command/GetCapacityManagerSupportabilityScoresCommand/) / [Input](https://docs.aws.amazon.com/AWSJavaScriptSDK/v3/latest/Package/-aws-sdk-client-ec2/Interface/GetCapacityManagerSupportabilityScoresCommandInput/) / [Output](https://docs.aws.amazon.com/AWSJavaScriptSDK/v3/latest/Package/-aws-sdk-client-ec2/Interface/GetCapacityManagerSupportabilityScoresCommandOutput/)
+</details>
+<details>
+<summary>
 GetCapacityReservationUsage
 </summary>
 
@@ -4265,6 +4272,13 @@ GetImageBlockPublicAccessState
 </details>
 <details>
 <summary>
+GetImageFindings
+</summary>
+
+[Command API Reference](https://docs.aws.amazon.com/AWSJavaScriptSDK/v3/latest/client/ec2/command/GetImageFindingsCommand/) / [Input](https://docs.aws.amazon.com/AWSJavaScriptSDK/v3/latest/Package/-aws-sdk-client-ec2/Interface/GetImageFindingsCommandInput/) / [Output](https://docs.aws.amazon.com/AWSJavaScriptSDK/v3/latest/Package/-aws-sdk-client-ec2/Interface/GetImageFindingsCommandOutput/)
+</details>
+<details>
+<summary>
 GetInstanceMetadataDefaults
 </summary>
 
@@ -4538,6 +4552,13 @@ GetSubnetCidrReservations
 </details>
 <details>
 <summary>
+GetTransitGatewayAttachmentNatConfiguration
+</summary>
+
+[Command API Reference](https://docs.aws.amazon.com/AWSJavaScriptSDK/v3/latest/client/ec2/command/GetTransitGatewayAttachmentNatConfigurationCommand/) / [Input](https://docs.aws.amazon.com/AWSJavaScriptSDK/v3/latest/Package/-aws-sdk-client-ec2/Interface/GetTransitGatewayAttachmentNatConfigurationCommandInput/) / [Output](https://docs.aws.amazon.com/AWSJavaScriptSDK/v3/latest/Package/-aws-sdk-client-ec2/Interface/GetTransitGatewayAttachmentNatConfigurationCommandOutput/)
+</details>
+<details>
+<summary>
 GetTransitGatewayAttachmentPropagations
 </summary>
 
@@ -5105,6 +5126,13 @@ ModifyTransitGateway
 </details>
 <details>
 <summary>
+ModifyTransitGatewayAttachmentNatConfiguration
+</summary>
+
+[Command API Reference](https://docs.aws.amazon.com/AWSJavaScriptSDK/v3/latest/client/ec2/command/ModifyTransitGatewayAttachmentNatConfigurationCommand/) / [Input](https://docs.aws.amazon.com/AWSJavaScriptSDK/v3/latest/Package/-aws-sdk-client-ec2/Interface/ModifyTransitGatewayAttachmentNatConfigurationCommandInput/) / [Output](https://docs.aws.amazon.com/AWSJavaScriptSDK/v3/latest/Package/-aws-sdk-client-ec2/Interface/ModifyTransitGatewayAttachmentNatConfigurationCommandOutput/)
+</details>
+<details>
+<summary>
 ModifyTransitGatewayMeteringPolicy
 </summary>