cdk-preflight 1.3.0 → 1.3.1

package/.jsii

@@ -9803,6 +9803,6 @@
       "symbolId": "src/index:PreflightOptions"
     }
   },
-  "version": "1.3.0",
-  "fingerprint": "cI4UT20nV0aAocY2YIDeG8jEwE97HQ6XoczPvAHZ9fM="
+  "version": "1.3.1",
+  "fingerprint": "QJBjFDC0MKpWQUEQHfDlRFvxTrbKxiuALzMN3KcxWNo="
 }

package/AGENTS.md

@@ -176,7 +176,7 @@ If you are a subagent running one of these phases, do not spawn further agents.
 4. **Real-deploy gate**: `bash bench/verify-rule.sh <rule-id>` deploys the fail template (expects CREATE to fail; records the service error message) and, where cheap, the pass template (expects success, then deletes). Paste the observed error into `meta.yaml#repro.evidence` with the date, then copy the part of it that names the constraint into `meta.yaml#repro.expect` — one line, `expect: "<fragment>"`, no `"` or `\` inside (the monthly runner reads it with `sed`), verbatim from the evidence (`bundle-rules` checks). Every monthly run matches the fail stack's reason against it, so a stack that falls over for anything else is INCONCLUSIVE rather than verified. Required for `real-deploy` rules added on or after 2026-09-27; when the service only ever says something generic (`GeneralServiceException`), quote that. Only `doc-only` rules may skip this, with justification.
 
    **A rule about runs after the deploy needs a probe to fail the deploy.** Most resources give CloudFormation nothing to wait on, so the fail template adds a custom resource (logical id `Probe`, type `Custom::CdkpfProbe`) backed by an inline Python function (`ProbeFn`, with its own `ProbeRole`) that, on Create only, runs the resource once — invokes the function, publishes and reads back from the queue, sets the alarm state and reads its history — and answers `FAILED` with what it observed, or `SUCCESS`. The pass template carries the same probe, so the pair differs only in the property the rule judges. `pf-lambda-zipfile-handler-module` and `pf-sns-aws-managed-key-delivery` are the reference implementations. The contract:
-   - The probe writes the response itself with `urllib` (PUT to `ResponseURL`). Do not `import cfnresponse`: on `python3.13` it is not in the inline package and the probe dies with `Runtime.ImportModuleError` before it can answer (2026-10-16), which leaves the stack waiting for `ServiceTimeout`.
+   - The probe writes the response itself with `urllib` (PUT to `ResponseURL`). Do not depend on `cfnresponse`: CloudFormation adds it to the inline package only when the code has the exact line `import cfnresponse` ([doc](https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/cfn-lambda-function-code-cfnresponsemodule.html)). The first probe wrote `import json, time, boto3, cfnresponse`, died with `Runtime.ImportModuleError: No module named 'cfnresponse'` before it could answer (python3.13, 2026-10-16), and left the stack waiting for `ServiceTimeout` on both create and delete.
    - Update and Delete always answer `SUCCESS`, so rollback and `cleanup()` never wait on the probe.
    - `ServiceTimeout: "300"` on the custom resource and a function `Timeout` well under it; `DependsOn` every policy, subscription and target the probe exercises, so it never runs before its scaffolding exists.
    - The `Reason` starts with the observation that names the constraint (the service's own error when there is one — `Runtime.ImportModuleError`, an alarm's `Failed to execute action`), and `repro.expect` quotes it. `verify-rule.sh` treats a failed resource whose type is not in `resourceTypes` as scaffolding unless its reason contains `expect`, so without `expect` a probe's verdict is never accepted. A probe that crashes says `cdkpf probe could not run`, which matches no `expect` and comes out INCONCLUSIVE.

package/lib/index.js

@@ -17,7 +17,7 @@ const rules_generated_1 = require("./rules.generated");
  * Preflight.apply(app);
  */
 class Preflight {
-    static [JSII_RTTI_SYMBOL_1] = { fqn: "cdk-preflight.Preflight", version: "1.3.0" };
+    static [JSII_RTTI_SYMBOL_1] = { fqn: "cdk-preflight.Preflight", version: "1.3.1" };
     /**
      * Register the cdk-preflight rules on an App or Stage.
      */

package/package.json

@@ -89,7 +89,7 @@
   "publishConfig": {
     "access": "public"
   },
-  "version": "1.3.0",
+  "version": "1.3.1",
   "jest": {
     "coverageProvider": "v8",
     "collectCoverage": false,