cdk-preflight 1.12.2 → 1.12.3

package/.jsii

@@ -9847,6 +9847,6 @@
       "symbolId": "src/index:PreflightOptions"
     }
   },
-  "version": "1.12.2",
-  "fingerprint": "/xzrS2QGuIe2v8xVGqr7Ol1qKFO/RCvCS3O6oHHg5yw="
+  "version": "1.12.3",
+  "fingerprint": "saYA0rmBG0kltHfHTXpn2uqWHdHtrgYFcV1SdS8DckM="
 }

package/AGENTS.md

@@ -207,6 +207,7 @@ If you are a subagent running one of these phases, do not spawn further agents.
 | Unit tests | `npx jest` |
 | Full build (jsii, lint, tests, package) | `npx projen build` |
 | Real-deploy verification for one rule | `bash bench/verify-rule.sh <rule-id>` |
+| Re-run the monthly check on chosen rules, in the monthly account | dispatch `monthly-verify` with `rules: <id> <id> ...` (the issue it files counts only those rules) |
 
 ## Known engine facts (verified 2026-09-01, engine 1.7.0-beta)
 
@@ -270,6 +271,7 @@ If you are a subagent running one of these phases, do not spawn further agents.
 - **`bench/verify-rule.sh` polls for 60 minutes** (15 → 30 on 2026-09-06, → 60 on 2026-09-13): ElastiCache and MemoryDB clusters take 10-25 minutes to create and about as long to roll back, and an MSK Provisioned cluster took 31m34s to reach CREATE_COMPLETE at its minimum size; a shorter poll reported TIMEOUT / INCONCLUSIVE on rules whose constraint had already fired.
 - **A non-zero `aws` exit is not evidence of anything** (measured 2026-09-22, four parallel `verify-rule.sh` in us-east-1). `describe-stacks … 2>/dev/null || echo GONE` collapsed throttling, blips and expired credentials into `GONE`; `cleanup()` then deleted two `pf-servicediscovery-*` stacks mid-create, and in one of them `reason_of` captured the real failure a moment later — proof from the run's own log that the stack still existed. The same collapse on `describe-stack-events` is worse than losing a run: an unreadable reason leaves `FTYPE`/`REASON` empty, the scaffolding guard silently no-ops, and a VPC-quota rollback reports `OK: verified`. Only `ValidationError … does not exist` means gone. Everything else is retried inside the poll budget and then reported under its own reason (`could not read the … status` / `… events`), never as `GONE` and never as a dirty fixture; a `LEFTOVER` line likewise needs a confirmed-present stack, not just a `wait` that failed. `bench/verify-rule.test.sh` pins all of it with a stubbed `aws` on `PATH` — 13 of its assertions fail against the pre-fix script.
 - **A fail stack falling over is not evidence that the constraint fired** (measured 2026-09-25, #264). `verify-rule.sh` verified any rollback that did not look like a quota, and in the cloudformation monthly run only 9 of the 21 OKs named their constraint. Three holes. `reason_of` dropped the stack's own rows with `ResourceType!='AWS::CloudFormation::Stack'`, which also dropped a *nested* stack's real failure and picked up a sibling's collateral `Resource creation cancelled` instead; the stack's own rows are the ones whose `LogicalResourceId` is the stack name. A failure that belongs to no resource (an Output's Export) puts its reason only on the stack's `ROLLBACK_IN_PROGRESS` row under the default rollback. And a synchronous `ValidationError` from `create-stack` — the strongest evidence there is, with no scaffolding to collapse — was always INCONCLUSIVE, which pinned the cloudformation monthly at `overall=4`. Now an unreadable reason, a collateral cancellation or the `The following resource(s) failed to create` summary is INCONCLUSIVE, and with `repro.expect` set the reason, or the synchronous rejection, has to contain it. Replayed over the dev account's 90-day event history (3,110 stacks, 2026-09-26), the new reader changes the reason of those 5 cloudformation rules and of no other rule. The event reads also moved to `--output json`: with `--output text` the CLI applies `--query` page by page (100 events a page), so on a stack of more than 100 events `[-1]` answered once per page, and "no reason on either page" came back as two `None` lines, which is not `None` (measured 2026-09-27: `length(StackEvents)` is `100` and `16` in text, `116` in json).
+- **Since 2026-10 the stack event of a property-validation failure no longer says what failed** (monthly 2026-11). It used to read `Properties validation failed for resource X with message: #/...`, and the `repro.expect` lines of the rules in that band quote that tail; now the same event reads only `Validation failed with N error(s). Call DescribeEvents to retrieve the full list of issues ...`. The detail lives only in `DescribeEvents` (`--filters FailedEvents=true`, `EventType: VALIDATION_ERROR`, fields `ValidationName`, `LogicalResourceId`, `ValidationPath`, `ValidationStatusReason`). `verify-rule.sh` fetches it whenever the reason is that summary and appends it as `[DescribeEvents: <name> <logical id> <path>: <reason>]`, so a rule in this band quotes the `ValidationStatusReason` in `expect`.
 - **Probing the raw engine with custom rules**: the rule set must be named `violation` (`data.<pkg>.violation` is looked up; a `diagnostics` set fails with "not a valid rule path"), and hand-built diagnostic objects need lowercase severities (`error`, not `ERROR`/`CUSTOM` — those are display labels added by the wrapper). Pack rules never see this because `make_diag_full` handles the shape.
 - **`as` is a reserved keyword in the engine's Rego build** (measured 2026-09-06): `acts := object.get(s, "Action", null)` is fine but `as := ...` fails to parse ("unexpected keyword `as`") and, like every parse error, takes the whole custom package down — every rule stops firing, and the jest failure names an unrelated rule.
 - **A Managed Flink application deploys with no `ApplicationConfiguration` at all** (measured 2026-09-06), which is what makes `AWS::KinesisAnalyticsV2::Application` fixtures cheap: no S3 bucket, no JAR, no Glue database, just an IAM role the service can assume. Adding a "minimal" code stanza is worse than none — CreateApplication really fetches the S3 object (`We are unable to get the specified fileKey`) and rejects `PLAINTEXT` for a Flink runtime.

package/lib/index.js

@@ -19,7 +19,7 @@ const rules_generated_1 = require("./rules.generated");
  * Preflight.apply(app);
  */
 class Preflight {
-    static [JSII_RTTI_SYMBOL_1] = { fqn: "cdk-preflight.Preflight", version: "1.12.2" };
+    static [JSII_RTTI_SYMBOL_1] = { fqn: "cdk-preflight.Preflight", version: "1.12.3" };
     /**
      * Register the cdk-preflight rules on an App or Stage.
      */