@go-to-k/cdkd 0.290.0 → 0.290.2

package/dist/{program-DUmAMwgQ.js → program-z-ESK5sd.js}

@@ -1,8 +1,8 @@
-import { $ as getCurrentResourceSecrets, $n as validateAssetBucketName, $t as findActionableSilentDrops, A as planOrphanAdoption, An as CUSTOM_RESOURCE_RESPONSE_PREFIX, Ar as warnDeprecatedNoPrefixCliFlag, At as resolveExplicitPhysicalId, B as bold, Bn as WorkGraph, Br as derivePartitionAndUrlSuffix, Bt as requireConfigObject, C as createPreDeleteFinalSnapshot, Ci as markNonRetryable, Cn as S3StateBackend, Cr as resolveAutoAssetStorage, Ct as coerceParameterTypedValue, D as makeCanonicalizePropertiesFn, Dn as forceQuitRecoveryClause, Dr as resolveStateBucketWithDefaultAndSource, Dt as refStateLookupFromResource, E as unsupportedFinalSnapshotError, En as buildLockContentionMessage, Er as resolveStateBucketWithDefault, Et as parameterTypeMayLoseSecretIdentity, F as WARM_THROUGHPUT_MEMBERS, Fn as orphansAfterRollback, Fr as uploadCfnTemplate, Ft as configIntegerRefusal, G as yellow, Gn as AssetModeResolver, Gr as AwsClients, Gt as s3BucketArn, H as gray, Hn as createAssetRedirectResolver, Hr as processStackMessages, Ht as classifyReplaySecretRegion, I as coerceWarmThroughput$1, In as orphansCarriedFrom, Ir as CUSTOM_RESOURCE_RESPONSE_OBJECT_DESCRIPTION, It as configStringRefusal, J as exportAliasCollisionScrubWarning, Jn as ensureAssetStorage, Jr as setAwsClients, Jt as s3BucketRegionalDomainName, K as collectDeclaredOutputNames, Kn as BOOTSTRAP_MARKER_PREFIX, Kr as getAwsClients, Kt as s3BucketDomainName, L as isWarmThroughputDecrease, Ln as shouldRetainResource, Lr as expectedOwnerParam, Lt as readConfigString, M as isStatefulRecreateTargetForReplace, Mn as exportNamesCarriedFrom, Mr as CFN_TEMPLATE_URL_LIMIT, Mt as coerceCfnBoolean, N as isStatefulRecreateTargetSync, Nn as importableOutputKeys, Nr as MIGRATE_TMP_PREFIX, Nt as coerceCfnInteger, O as extractDeploymentEventError, On as formatLockExpiry, Or as resolveUseCdkBootstrapAssets, Ot as WAFv2WebACLProvider, P as renderStatefulReason, Pn as importableOutputs, Pr as findLargeInlineResources, Pt as configBooleanRefusal, Q as secretSafeKeyDisplay, Qn as readBootstrapMarkerBody, Qr as CrossAccountSecretRefusalError, Qt as INTRINSIC_KEYS, R as toFiniteNumber, Rn as AssetPublisher, Rr as PARTITION_TABLE, Rt as replayWarn, S as ccRoutedFinalSnapshotError, Si as isTransientServerError, Sn as LockManager, Sr as resolveApp, St as cfnRefValueFromPhysicalId, T as refusesFinalSnapshot, Ti as retryClassificationText, Tn as buildForceUnlockCommand, Tr as resolveSkipPrefix, Tt as isUnboundTemplateParameter, U as green, Un as loadPublishableAssetManifest, Ut as producerRegionsFromState, V as cyan, Vn as buildAssetRedirectMap, Vr as AssemblyReader, Vt as requireConfigString, W as red, Wn as rewriteTemplateAssetReferences, Wr as resolveBucketRegion, Wt as withSharedDrainBudget, X as secretBearing, Xn as isCrossRegionRedirect, Xr as CdkdError, Xt as applyRoleArnIfSet, Y as isExportAliasCollision, Yn as getBootstrapMarkerKey, Yt as s3BucketWebsiteUrl, Z as secretBearingStateKeyWarning, Zn as parseBootstrapMarker, Zt as DiffCalculator, _ as isSecretBearingReferenceString, _i as normalizeAwsError, _n as maskSecretsInText, _r as getDockerImageBySourceHash, _t as deleteSkipReason, a as DeploymentEventsStore, an as STATE_SOURCED_BASELINE_RULES, ar as describeDockerExecFailure, at as createMaskedRetryLogger, b as PRE_DELETE_SNAPSHOT_TYPES, bi as isRetryableTransientError, bn as redactSecretsForState, br as getDefaultStateBucketName, bt as IntrinsicFunctionResolver, c as replayFailedOperations, ci as ProvisioningError, cn as TEMPLATE_SOURCED_RULES, cr as formatDockerLoginError, ct as beginCommandInterruptScope, d as updatePartialReason, di as StackHasActiveImportsError, dn as dynamicReferenceTokens, dr as redactDockerArgvValues, dt as isInterruptedWaitError, ei as DeployCancelledError, en as findSilentDropProperties, er as validateContainerRepoName, et as IAMRoleProvider, f as withResourceDeadline, fi as StackTerminationProtectionError, fn as errorCauseChain, fr as runDockerForeground, ft as startInterruptWatch, g as bagHoldsSecretExpression, gn as maskSecretsInError, gr as AssetManifestLoader, gt as deleteIndeterminateGuards, h as computeImplicitDeleteEdges, hn as markSameGenerationBag, hr as stripControlChars, ht as UNSPECIFIED_SKIP_REASON, i as DeploymentEventsReader, ii as LocalStartServiceError, in as TemplateParser, ir as describeDockerCapturedOutput, it as wouldReturnToSdkProvider, j as MULTI_REGION_RECREATE_BLOCKED_TYPES, jn as DEFAULT_STATE_PREFIX, jr as CFN_TEMPLATE_BODY_LIMIT, jt as assertRegionMatch, k as makeSiblingClaimReader, kn as shellQuote, kr as stateBucketExistenceConfirmed, kt as normalizeAwsTagsToCfn, l as replayRollback, li as ResourceTimeoutError, ln as carriesSecretMask, lr as getDockerCmd, lt as endCommandInterruptScope, m as IMPLICIT_DELETE_DEPENDENCIES, mn as isSingleDynamicReferenceToken, mr as escapeRegExp, mt as slowCcOperationTimeoutMs, n as DEFAULT_RESOURCE_WARN_AFTER_MS, ni as IntrinsicResolutionRefusalError, nn as withRetry, nr as describeAwsFailure, nt as clearOnUpdateRemoval, o as planFailedOps, oi as NestedStackChildDirectDestroyError, on as STATE_SOURCED_CROSS_GENERATION_RULES, or as describeDockerFailure, ot as maskDeep, p as maskingRetryLogger, pn as identityKeyFor, pr as runDockerStreaming, pt as CloudControlProvider, q as collectPublishedOutputNames, qn as assertAssetBucketRegion, qr as resetAwsClients, qt as s3BucketDualStackDomainName, r as DeployEngine, ri as LocalInvokeBuildError$1, rn as DagBuilder, rr as buildDockerImage, rt as ProviderRegistry, s as planRollback, si as PartialFailureError, sn as STATE_SOURCED_READBACK_RULES, sr as dockerSpawnEnvWithSensitive, st as maskerOrIdentity, t as DEFAULT_RESOURCE_TIMEOUT_MS, ti as DynamicReferenceRegionAmbiguousError, tn as describeTypeWithThrottleRetry, tr as buildDenyExternalAccessPolicy, tt as collectInlinePolicyNamesManagedBySiblings, u as updatePartialMessage, ui as ResourceUpdateNotSupportedError, un as createSecretMasker, ur as partitionSensitiveEnv, ut as interruptWatchListenerCount, v as bindingSkippedOutputs, vi as withErrorHandling, vn as recordMaskOnlyValue, vr as Synthesizer, vt as disableInstanceApiTermination, w as isFinalSnapshotError, wi as markRedactedCause, wn as rebuildClientForBucketRegion, wr as resolveCaptureObservedState, wt as getAccountInfo, x as buildFinalSnapshotIdentifier, xi as isThrottlingError, xn as scrubResourceRecord, xr as getLegacyStateBucketName, xt as carriesDynamicReference, y as ATOMIC_FINAL_SNAPSHOT_TYPES, yi as isMarkedNonRetryable, yn as recoverMaskedOutput, yr as synthesisStatusMessage, yt as isTerminationProtectionPropagationError, z as formatResourceLine, zn as stringifyValue, zr as canonicalizeRegion, zt as requireConfigArray } from "./deploy-engine-C287P1jL.js";
+import { $ as getCurrentResourceSecrets, $n as validateAssetBucketName, $t as findActionableSilentDrops, A as planOrphanAdoption, An as CUSTOM_RESOURCE_RESPONSE_PREFIX, Ar as warnDeprecatedNoPrefixCliFlag, At as resolveExplicitPhysicalId, B as bold, Bn as WorkGraph, Br as derivePartitionAndUrlSuffix, Bt as requireConfigObject, C as createPreDeleteFinalSnapshot, Ci as markNonRetryable, Cn as S3StateBackend, Cr as resolveAutoAssetStorage, Ct as coerceParameterTypedValue, D as makeCanonicalizePropertiesFn, Dn as forceQuitRecoveryClause, Dr as resolveStateBucketWithDefaultAndSource, Dt as refStateLookupFromResource, E as unsupportedFinalSnapshotError, En as buildLockContentionMessage, Er as resolveStateBucketWithDefault, Et as parameterTypeMayLoseSecretIdentity, F as WARM_THROUGHPUT_MEMBERS, Fn as orphansAfterRollback, Fr as uploadCfnTemplate, Ft as configIntegerRefusal, G as yellow, Gn as AssetModeResolver, Gr as AwsClients, Gt as s3BucketArn, H as gray, Hn as createAssetRedirectResolver, Hr as processStackMessages, Ht as classifyReplaySecretRegion, I as coerceWarmThroughput$1, In as orphansCarriedFrom, Ir as CUSTOM_RESOURCE_RESPONSE_OBJECT_DESCRIPTION, It as configStringRefusal, J as exportAliasCollisionScrubWarning, Jn as ensureAssetStorage, Jr as setAwsClients, Jt as s3BucketRegionalDomainName, K as collectDeclaredOutputNames, Kn as BOOTSTRAP_MARKER_PREFIX, Kr as getAwsClients, Kt as s3BucketDomainName, L as isWarmThroughputDecrease, Ln as shouldRetainResource, Lr as expectedOwnerParam, Lt as readConfigString, M as isStatefulRecreateTargetForReplace, Mn as exportNamesCarriedFrom, Mr as CFN_TEMPLATE_URL_LIMIT, Mt as coerceCfnBoolean, N as isStatefulRecreateTargetSync, Nn as importableOutputKeys, Nr as MIGRATE_TMP_PREFIX, Nt as coerceCfnInteger, O as extractDeploymentEventError, On as formatLockExpiry, Or as resolveUseCdkBootstrapAssets, Ot as WAFv2WebACLProvider, P as renderStatefulReason, Pn as importableOutputs, Pr as findLargeInlineResources, Pt as configBooleanRefusal, Q as secretSafeKeyDisplay, Qn as readBootstrapMarkerBody, Qr as CrossAccountSecretRefusalError, Qt as INTRINSIC_KEYS, R as toFiniteNumber, Rn as AssetPublisher, Rr as PARTITION_TABLE, Rt as replayWarn, S as ccRoutedFinalSnapshotError, Si as isTransientServerError, Sn as LockManager, Sr as resolveApp, St as cfnRefValueFromPhysicalId, T as refusesFinalSnapshot, Ti as retryClassificationText, Tn as buildForceUnlockCommand, Tr as resolveSkipPrefix, Tt as isUnboundTemplateParameter, U as green, Un as loadPublishableAssetManifest, Ut as producerRegionsFromState, V as cyan, Vn as buildAssetRedirectMap, Vr as AssemblyReader, Vt as requireConfigString, W as red, Wn as rewriteTemplateAssetReferences, Wr as resolveBucketRegion, Wt as withSharedDrainBudget, X as secretBearing, Xn as isCrossRegionRedirect, Xr as CdkdError, Xt as applyRoleArnIfSet, Y as isExportAliasCollision, Yn as getBootstrapMarkerKey, Yt as s3BucketWebsiteUrl, Z as secretBearingStateKeyWarning, Zn as parseBootstrapMarker, Zt as DiffCalculator, _ as isSecretBearingReferenceString, _i as normalizeAwsError, _n as maskSecretsInText, _r as getDockerImageBySourceHash, _t as deleteSkipReason, a as DeploymentEventsStore, an as STATE_SOURCED_BASELINE_RULES, ar as describeDockerExecFailure, at as createMaskedRetryLogger, b as PRE_DELETE_SNAPSHOT_TYPES, bi as isRetryableTransientError, bn as redactSecretsForState, br as getDefaultStateBucketName, bt as IntrinsicFunctionResolver, c as replayFailedOperations, ci as ProvisioningError, cn as TEMPLATE_SOURCED_RULES, cr as formatDockerLoginError, ct as beginCommandInterruptScope, d as updatePartialReason, di as StackHasActiveImportsError, dn as dynamicReferenceTokens, dr as redactDockerArgvValues, dt as isInterruptedWaitError, ei as DeployCancelledError, en as findSilentDropProperties, er as validateContainerRepoName, et as IAMRoleProvider, f as withResourceDeadline, fi as StackTerminationProtectionError, fn as errorCauseChain, fr as runDockerForeground, ft as startInterruptWatch, g as bagHoldsSecretExpression, gn as maskSecretsInError, gr as AssetManifestLoader, gt as deleteIndeterminateGuards, h as computeImplicitDeleteEdges, hn as markSameGenerationBag, hr as stripControlChars, ht as UNSPECIFIED_SKIP_REASON, i as DeploymentEventsReader, ii as LocalStartServiceError, in as TemplateParser, ir as describeDockerCapturedOutput, it as wouldReturnToSdkProvider, j as MULTI_REGION_RECREATE_BLOCKED_TYPES, jn as DEFAULT_STATE_PREFIX, jr as CFN_TEMPLATE_BODY_LIMIT, jt as assertRegionMatch, k as makeSiblingClaimReader, kn as shellQuote, kr as stateBucketExistenceConfirmed, kt as normalizeAwsTagsToCfn, l as replayRollback, li as ResourceTimeoutError, ln as carriesSecretMask, lr as getDockerCmd, lt as endCommandInterruptScope, m as IMPLICIT_DELETE_DEPENDENCIES, mn as isSingleDynamicReferenceToken, mr as escapeRegExp, mt as slowCcOperationTimeoutMs, n as DEFAULT_RESOURCE_WARN_AFTER_MS, ni as IntrinsicResolutionRefusalError, nn as withRetry, nr as describeAwsFailure, nt as clearOnUpdateRemoval, o as planFailedOps, oi as NestedStackChildDirectDestroyError, on as STATE_SOURCED_CROSS_GENERATION_RULES, or as describeDockerFailure, ot as maskDeep, p as maskingRetryLogger, pn as identityKeyFor, pr as runDockerStreaming, pt as CloudControlProvider, q as collectPublishedOutputNames, qn as assertAssetBucketRegion, qr as resetAwsClients, qt as s3BucketDualStackDomainName, r as DeployEngine, ri as LocalInvokeBuildError$1, rn as DagBuilder, rr as buildDockerImage, rt as ProviderRegistry, s as planRollback, si as PartialFailureError, sn as STATE_SOURCED_READBACK_RULES, sr as dockerSpawnEnvWithSensitive, st as maskerOrIdentity, t as DEFAULT_RESOURCE_TIMEOUT_MS, ti as DynamicReferenceRegionAmbiguousError, tn as describeTypeWithThrottleRetry, tr as buildDenyExternalAccessPolicy, tt as collectInlinePolicyNamesManagedBySiblings, u as updatePartialMessage, ui as ResourceUpdateNotSupportedError, un as createSecretMasker, ur as partitionSensitiveEnv, ut as interruptWatchListenerCount, v as bindingSkippedOutputs, vi as withErrorHandling, vn as recordMaskOnlyValue, vr as Synthesizer, vt as disableInstanceApiTermination, w as isFinalSnapshotError, wi as markRedactedCause, wn as rebuildClientForBucketRegion, wr as resolveCaptureObservedState, wt as getAccountInfo, x as buildFinalSnapshotIdentifier, xi as isThrottlingError, xn as scrubResourceRecord, xr as getLegacyStateBucketName, xt as carriesDynamicReference, y as ATOMIC_FINAL_SNAPSHOT_TYPES, yi as isMarkedNonRetryable, yn as recoverMaskedOutput, yr as synthesisStatusMessage, yt as isTerminationProtectionPropagationError, z as formatResourceLine, zn as stringifyValue, zr as canonicalizeRegion, zt as requireConfigArray } from "./deploy-engine-Nn9j2GPK.js";
 import { _ as withSkipPrefix, b as displaySafe, c as PATTERN_B_NAME_OPTIONS, f as explicitNamePropertyFor, h as getCurrentStackName, i as reserveStdoutForPayload, l as PATTERN_B_NAME_PROPERTIES, m as generateResourceNameWithFallback, n as getLogger, o as runStackBuffered, p as generateResourceName, s as getLiveRenderer, u as PATTERN_B_RESOURCE_TYPES, v as withStackName, x as truncateCodePoints, y as UNRENDERABLE } from "./logger-DTEUzYP_.js";
 import { t as awsClientDefaults } from "./aws-client-defaults-D-iYiIJ6.js";
-import { t as getCdkdVersion } from "./version-DH53RtuA.js";
-import { r as protectedReplacementAdvice, t as ASGProvider } from "./asg-provider-DVXRJSN_.js";
+import { t as getCdkdVersion } from "./version-7XwrjRzX.js";
+import { r as protectedReplacementAdvice, t as ASGProvider } from "./asg-provider-BsC_XndT.js";
 import { AsyncLocalStorage } from "node:async_hooks";
 import { createHash, randomBytes, randomUUID } from "node:crypto";
 import { CopyObjectCommand, CreateBucketCommand, DeleteBucketAnalyticsConfigurationCommand, DeleteBucketCommand, DeleteBucketCorsCommand, DeleteBucketEncryptionCommand, DeleteBucketIntelligentTieringConfigurationCommand, DeleteBucketInventoryConfigurationCommand, DeleteBucketLifecycleCommand, DeleteBucketMetricsConfigurationCommand, DeleteBucketOwnershipControlsCommand, DeleteBucketPolicyCommand, DeleteBucketReplicationCommand, DeleteBucketTaggingCommand, DeleteBucketWebsiteCommand, DeleteObjectsCommand, GetBucketAccelerateConfigurationCommand, GetBucketCorsCommand, GetBucketEncryptionCommand, GetBucketLifecycleConfigurationCommand, GetBucketLocationCommand, GetBucketLoggingCommand, GetBucketNotificationConfigurationCommand, GetBucketOwnershipControlsCommand, GetBucketPolicyCommand, GetBucketReplicationCommand, GetBucketTaggingCommand, GetBucketVersioningCommand, GetBucketWebsiteCommand, GetObjectCommand, GetObjectLockConfigurationCommand, GetPublicAccessBlockCommand, HeadBucketCommand, ListBucketAnalyticsConfigurationsCommand, ListBucketIntelligentTieringConfigurationsCommand, ListBucketInventoryConfigurationsCommand, ListBucketMetricsConfigurationsCommand, ListObjectVersionsCommand, ListObjectsV2Command, NoSuchBucket, NotFound, PutBucketAccelerateConfigurationCommand, PutBucketAnalyticsConfigurationCommand, PutBucketCorsCommand, PutBucketEncryptionCommand, PutBucketIntelligentTieringConfigurationCommand, PutBucketInventoryConfigurationCommand, PutBucketLifecycleConfigurationCommand, PutBucketLoggingCommand, PutBucketMetricsConfigurationCommand, PutBucketNotificationConfigurationCommand, PutBucketOwnershipControlsCommand, PutBucketPolicyCommand, PutBucketReplicationCommand, PutBucketTaggingCommand, PutBucketVersioningCommand, PutBucketWebsiteCommand, PutObjectCommand, PutObjectLockConfigurationCommand, PutPublicAccessBlockCommand, S3Client, S3ServiceException } from "@aws-sdk/client-s3";
@@ -26,9 +26,9 @@ import { AddTagsToResourceCommand as AddTagsToResourceCommand$1, CreateCacheClus
 import { ACMClient, AddTagsToCertificateCommand, DeleteCertificateCommand, DescribeCertificateCommand, ListTagsForCertificateCommand, RemoveTagsFromCertificateCommand, RequestCertificateCommand, ResourceNotFoundException as ResourceNotFoundException$7, UpdateCertificateOptionsCommand } from "@aws-sdk/client-acm";
 import { CreateMicrovmImageCommand, DeleteMicrovmImageCommand, GetMicrovmImageCommand, LambdaMicrovmsClient, ListTagsCommand as ListTagsCommand$1, ResourceNotFoundException as ResourceNotFoundException$8, TagResourceCommand as TagResourceCommand$10, UntagResourceCommand as UntagResourceCommand$10, UpdateMicrovmImageCommand } from "@aws-sdk/client-lambda-microvms";
 import * as fs from "node:fs";
-import { cpSync, existsSync, mkdirSync, mkdtempSync, readFileSync, rmSync, statSync, writeFileSync } from "node:fs";
+import { cpSync, existsSync, lstatSync, mkdirSync, mkdtempSync, readFileSync, readdirSync, readlinkSync, realpathSync, rmSync, statSync, symlinkSync, writeFileSync } from "node:fs";
 import * as path from "node:path";
-import { basename, dirname, isAbsolute, resolve } from "node:path";
+import { basename, dirname, isAbsolute, join, resolve } from "node:path";
 import { execFile, spawn } from "node:child_process";
 import { tmpdir } from "node:os";
 import { AssociateVPCWithHostedZoneCommand, ChangeResourceRecordSetsCommand, ChangeTagsForResourceCommand, CreateHostedZoneCommand, CreateQueryLoggingConfigCommand, DeleteHostedZoneCommand, DeleteQueryLoggingConfigCommand, DisassociateVPCFromHostedZoneCommand, GetHostedZoneCommand, HostedZoneAlreadyExists, ListHostedZonesByNameCommand, ListQueryLoggingConfigsCommand, ListResourceRecordSetsCommand, ListTagsForResourceCommand as ListTagsForResourceCommand$8, Route53Client, UpdateHostedZoneCommentCommand, UpdateHostedZoneFeaturesCommand } from "@aws-sdk/client-route-53";
@@ -25847,6 +25847,88 @@ var EventBridgeRuleProvider = class {
 	}
 };
 
+//#endregion
+//#region src/provisioning/attribute-map.ts
+/**
+* The ONE spelling of the attribute-map rule an SDK provider's `create()` /
+* `update()` / `import()` result follows (issue #3077, closing the `?? ''`
+* shape `docs/provider-development.md` forbids under "Never store an
+* empty-string placeholder"):
+*
+*   an attribute cdkd could not read back is ABSENT from the map — never
+*   recorded as the empty string, and never as a present-but-`undefined` key.
+*
+* The consumers of `ResourceState.attributes` all key off exactly that
+* distinction, and a sentinel puts every one of them on the wrong branch:
+*
+*  - the deploy engine persists the map as-is, so `''` becomes the recorded
+*    value of a field AWS never assigned;
+*  - the intrinsic resolver serves a stored attribute whenever it is not
+*    `undefined`, so `''` shadows `constructAttribute` forever — the
+*    `AWS::EC2::Instance` IP / DNS / AZ arm re-describes the instance from
+*    AWS only on a MISS, the `Arn` arms of the RDS family rebuild the ARN
+*    only on a MISS;
+*  - the Outputs export pass publishes whatever the resolver returned, so a
+*    stored `''` is exported to every `Fn::ImportValue` consumer.
+*
+* It exists as a MODULE rather than a per-provider idiom because the rule was
+* prose and 96 attribute-position `?? ''` / `|| ''` / bare `''` sites across
+* 18 providers shipped anyway (measured 2026-09-14 with the TypeScript-compiler
+* walk that is now `tests/unit/provisioning/attribute-map.test.ts`). A helper
+* that DROPS the key is the one form a provider cannot spell wrong by habit.
+*
+* Two values are treated as "not read back":
+*
+*  - `undefined`: the SDK's spelling of an unassigned optional member.
+*  - `null`: no AWS SDK v3 read-back reports a scalar attribute as `null`, and
+*    a stored `null` takes the resolver's "not `undefined`" hit branch exactly
+*    like `''` does.
+*
+* Every other value is kept verbatim — INCLUDING an empty string AWS itself
+* reported (`false`, `0`, an empty array and an object likewise). The helper
+* stops cdkd MANUFACTURING `''` for a field it never read; a `''` that came
+* off the wire is a known value with a meaning the provider owns. The EC2
+* Instance provider is where that distinction is load-bearing: a `running`
+* instance with no public address is described with `PublicDnsName: ''` and
+* no `PublicIpAddress`, and CloudFormation answers `''` for both — a KNOWN
+* empty, recorded as such so a reference does not degrade to the instance id
+* on every resolution — while the same `''` on a `pending` instance means
+* "not yet", which that provider maps to `undefined` BEFORE calling this
+* helper (its `describedInstanceAttributes`). A caller that knows a `''`
+* means "unknown" is the one that must say so; this helper cannot tell.
+*
+* Deliberately NOT a general "compact this record" utility: it is scoped to
+* attribute maps. A property bag keeps its `undefined`-valued keys out by other
+* means (`.claude/rules/provider-property-fidelity.md`, "Remove the key rather
+* than setting it to `undefined`").
+*
+* A LEAF module (imports nothing) so every provider can take it without adding
+* an edge to the provider import ring.
+*/
+/**
+* Build an attribute map from read-back values, omitting every key whose value
+* is `undefined` or `null`.
+*/
+function definedAttributes(entries) {
+	const out = {};
+	for (const [key, value] of Object.entries(entries)) {
+		if (value === void 0 || value === null) continue;
+		out[key] = value;
+	}
+	return out;
+}
+/**
+* `String(value)` for a numeric read-back whose CloudFormation attribute is a
+* string (`Endpoint.Port`), or `undefined` when the field is unassigned — so
+* `definedAttributes` drops the key instead of recording the literal
+* `'undefined'`, which is what `String(described?.Port ?? '')` yields once its
+* `?? ''` is merely deleted.
+*/
+function stringifyIfAssigned(value) {
+	if (value === void 0 || value === null) return void 0;
+	return String(value);
+}
+
 //#endregion
 //#region src/provisioning/providers/eventbridge-bus-provider.ts
 /**
@@ -25909,14 +25991,14 @@ var EventBridgeBusProvider = class {
 			const dlcCreate = sanitizeDeadLetterConfig(properties["DeadLetterConfig"]);
 			if (dlcCreate) createParams.DeadLetterConfig = dlcCreate;
 			if (properties["LogConfig"] !== void 0) createParams.LogConfig = properties["LogConfig"];
-			const eventBusArn = (await this.eventBridgeClient.send(new CreateEventBusCommand(createParams))).EventBusArn ?? "";
+			const response = await this.eventBridgeClient.send(new CreateEventBusCommand(createParams));
 			if (properties["Policy"]) {}
 			return {
 				physicalId: name,
-				attributes: {
-					Arn: eventBusArn,
+				attributes: definedAttributes({
+					Arn: response.EventBusArn,
 					Name: name
-				}
+				})
 			};
 		} catch (error) {
 			const cause = error instanceof Error ? error : void 0;
@@ -26549,6 +26631,59 @@ function canonicalizeSgInlineRuleProtocols(properties) {
 * - AWS::EC2::SecurityGroupIngress
 * - AWS::EC2::Instance
 */
+/**
+* The `AWS::EC2::Instance` attribute map for a `DescribeInstances` read-back,
+* shared by `createInstance` and `updateInstance` so the two cannot answer
+* the same instance differently (issue #3077).
+*
+* The map distinguishes UNKNOWN from KNOWN-EMPTY, and the instance STATE is
+* what tells them apart:
+*
+*  - `pending` (a `--no-wait` create, or an update racing one): the private
+*    address, private DNS name and AZ are assigned at launch and are recorded
+*    when present; the PUBLIC pair may simply not exist yet — the API
+*    reports `PublicDnsName: ''` and no `PublicIpAddress` in that window — so
+*    an empty or absent public member is UNKNOWN and its key is OMITTED. A
+*    persisted `''` would shadow the resolver's live re-read for the life of
+*    the record (the defect the issue reports); an absent key sends the next
+*    `Fn::GetAtt` back to AWS.
+*  - any settled state (`running`, `stopped`, ...): what AWS reports IS the
+*    answer. A running instance in a private subnet is described exactly like
+*    the pending window above — `PublicDnsName: ''`, no `PublicIpAddress` —
+*    and CloudFormation answers `''` for both attributes, so the pair is
+*    recorded as the known empty string rather than omitted: omitted, every
+*    resolution would take the live arm, find nothing, and degrade to the
+*    instance id with a warning, permanently, on an ordinary private-subnet
+*    stack (review of the first cut).
+*  - no `State` at all (a read-back that returned no instance, or a shape
+*    without one): treated like `pending` — whatever members are present are
+*    recorded, and an empty or absent public member is omitted, since nothing
+*    says the instance has settled.
+*
+* `definedAttributes` then drops the `undefined` members; it keeps `''`, so the
+* pending-window normalization has to happen HERE, where the state is known.
+*
+* The residual that follows from the pending rule: a `--no-wait` create of an
+* instance in a PRIVATE subnet omits the public pair, and nothing later writes
+* it -- a no-change deploy's auto-refresh touches `observedProperties`, never
+* `attributes` -- so `Fn::GetAtt [.., PublicIp]` takes the resolver's live arm,
+* finds no address, and degrades to the instance id with a warning until the
+* next `update()` of that instance records the known-empty pair. Tracked on
+* go-to-k/cdkd#3096.
+*/
+function describedInstanceAttributes(instanceId, instance) {
+	const stateName = instance?.State?.Name;
+	const settled = stateName !== void 0 && stateName !== "pending";
+	const publicMember = (value) => settled ? value ?? "" : value || void 0;
+	return definedAttributes({
+		InstanceId: instanceId,
+		PrivateIp: instance?.PrivateIpAddress,
+		PublicIp: publicMember(instance?.PublicIpAddress),
+		PrivateDnsName: instance?.PrivateDnsName,
+		PublicDnsName: publicMember(instance?.PublicDnsName),
+		AvailabilityZone: instance?.Placement?.AvailabilityZone
+	});
+}
 var EC2Provider = class {
 	ec2Client;
 	logger = getLogger().child("EC2Provider");
@@ -26762,7 +26897,7 @@ var EC2Provider = class {
 				CidrBlock: cidrBlock,
 				InstanceTenancy: properties["InstanceTenancy"] ?? void 0
 			}))).Vpc.VpcId;
-			let defaultSgId = "";
+			let defaultSgId;
 			try {
 				if (properties["EnableDnsHostnames"] === true || properties["EnableDnsHostnames"] === "true") await this.ec2Client.send(new ModifyVpcAttributeCommand({
 					VpcId: vpcId,
@@ -26781,7 +26916,7 @@ var EC2Provider = class {
 					}, {
 						Name: "group-name",
 						Values: ["default"]
-					}] }))).SecurityGroups?.[0]?.GroupId || "";
+					}] }))).SecurityGroups?.[0]?.GroupId;
 				} catch {
 					this.logger.debug(`Failed to get default SG for VPC ${vpcId}`);
 				}
@@ -26797,12 +26932,11 @@ var EC2Provider = class {
 			this.logger.debug(`Successfully created VPC ${logicalId}: ${vpcId}`);
 			return {
 				physicalId: vpcId,
-				attributes: {
+				attributes: definedAttributes({
 					VpcId: vpcId,
 					CidrBlock: cidrBlock,
-					DefaultNetworkAcl: "",
 					DefaultSecurityGroup: defaultSgId
-				}
+				})
 			};
 		} catch (error) {
 			const cause = error instanceof Error ? error : void 0;
@@ -28008,14 +28142,7 @@ var EC2Provider = class {
 					} else await this.ensureIamInstanceProfileAssociated(instanceId, iamInstanceProfile.arn, iamInstanceProfile.name, logicalId);
 				}
 				const runningInstance = (await this.ec2Client.send(new DescribeInstancesCommand({ InstanceIds: [instanceId] }))).Reservations?.[0]?.Instances?.[0];
-				const attributes = {
-					InstanceId: instanceId,
-					PrivateIp: runningInstance?.PrivateIpAddress ?? "",
-					PublicIp: runningInstance?.PublicIpAddress ?? "",
-					PrivateDnsName: runningInstance?.PrivateDnsName ?? "",
-					PublicDnsName: runningInstance?.PublicDnsName ?? "",
-					AvailabilityZone: runningInstance?.Placement?.AvailabilityZone ?? ""
-				};
+				const attributes = describedInstanceAttributes(instanceId, runningInstance);
 				this.logger.debug(`Successfully created EC2 Instance ${logicalId}: ${instanceId}`);
 				runInstancesToken.release();
 				return {
@@ -28180,14 +28307,7 @@ var EC2Provider = class {
 			return {
 				physicalId,
 				wasReplaced: false,
-				attributes: {
-					InstanceId: physicalId,
-					PrivateIp: instance?.PrivateIpAddress ?? "",
-					PublicIp: instance?.PublicIpAddress ?? "",
-					PrivateDnsName: instance?.PrivateDnsName ?? "",
-					PublicDnsName: instance?.PublicDnsName ?? "",
-					AvailabilityZone: instance?.Placement?.AvailabilityZone ?? ""
-				}
+				attributes: describedInstanceAttributes(physicalId, instance)
 			};
 		} catch (error) {
 			const cause = error instanceof Error ? error : void 0;
@@ -33631,7 +33751,7 @@ var CloudFrontDistributionProvider = class {
 				DistributionConfig: sdkConfig
 			}));
 			const getResponse = await this.cloudFrontClient.send(new GetDistributionCommand({ Id: physicalId }));
-			const domainName = getResponse.Distribution?.DomainName ?? "";
+			const domainName = getResponse.Distribution?.DomainName;
 			const arn = getResponse.Distribution?.ARN;
 			await this.applyTagDiff(arn, previousProperties["Tags"], properties["Tags"], physicalId, logicalId, resourceType);
 			await this.settleDistribution(logicalId, physicalId);
@@ -33639,11 +33759,11 @@ var CloudFrontDistributionProvider = class {
 			return {
 				physicalId,
 				wasReplaced: false,
-				attributes: {
+				attributes: definedAttributes({
 					Id: physicalId,
 					DistributionId: physicalId,
 					DomainName: domainName
-				}
+				})
 			};
 		} catch (error) {
 			if (error instanceof CdkdError) throw error;
@@ -34631,11 +34751,11 @@ var AgentCoreRuntimeProvider = class {
 	* (issue #1179).
 	*/
 	buildAttributes(response, agentRuntimeName) {
-		const attributes = {
+		const attributes = definedAttributes({
 			AgentRuntimeArn: response.agentRuntimeArn,
 			AgentRuntimeId: response.agentRuntimeId,
 			AgentRuntimeName: agentRuntimeName
-		};
+		});
 		if (response.agentRuntimeVersion !== void 0) attributes["AgentRuntimeVersion"] = response.agentRuntimeVersion;
 		if (response.status !== void 0) attributes["Status"] = response.status;
 		if (response.createdAt !== void 0) attributes["CreatedAt"] = response.createdAt.toISOString();
@@ -34749,7 +34869,7 @@ var AgentCoreRuntimeProvider = class {
 			const resp = await this.client.send(new GetAgentRuntimeCommand({ agentRuntimeId: physicalId }));
 			return {
 				physicalId,
-				attributes: this.buildAttributes(resp, resp.agentRuntimeName ?? "")
+				attributes: this.buildAttributes(resp, resp.agentRuntimeName)
 			};
 		} catch (err) {
 			this.logger.debug(`Could not enrich imported BedrockAgentCore Runtime ${physicalId} attributes (${err instanceof Error ? err.message : String(err)}); recording AgentRuntimeId only (Fn::GetAtt resolves live via getAttribute)`);
@@ -34814,12 +34934,12 @@ var AgentCoreBrowserProvider = class {
 			this.logger.debug(`Adopted default browser ${DEFAULT_BROWSER_ID} (${browserArn})`);
 			return {
 				physicalId: browserArn,
-				attributes: {
+				attributes: definedAttributes({
 					BrowserArn: browserArn,
 					BrowserId: response.browserId ?? "aws.browser.v1",
-					Name: response.name ?? "",
-					Status: response.status ?? ""
-				}
+					Name: response.name,
+					Status: response.status
+				})
 			};
 		} catch (error) {
 			const cause = error instanceof Error ? error : void 0;
@@ -34872,12 +34992,12 @@ var AgentCoreBrowserProvider = class {
 		const response = await this.client.send(new GetBrowserCommand({ browserId: DEFAULT_BROWSER_ID }));
 		return {
 			physicalId: response.browserArn,
-			attributes: {
+			attributes: definedAttributes({
 				BrowserArn: response.browserArn,
 				BrowserId: response.browserId ?? "aws.browser.v1",
-				Name: response.name ?? "",
-				Status: response.status ?? ""
-			}
+				Name: response.name,
+				Status: response.status
+			})
 		};
 	}
 };
@@ -34929,11 +35049,11 @@ var AgentCoreCodeInterpreterProvider = class {
 			this.logger.debug(`Adopted default code interpreter ${DEFAULT_CODE_INTERPRETER_ID} (${codeInterpreterArn})`);
 			return {
 				physicalId: codeInterpreterArn,
-				attributes: {
+				attributes: definedAttributes({
 					CodeInterpreterArn: codeInterpreterArn,
 					CodeInterpreterId: response.codeInterpreterId ?? "aws.codeinterpreter.v1",
-					Status: response.status ?? ""
-				}
+					Status: response.status
+				})
 			};
 		} catch (error) {
 			const cause = error instanceof Error ? error : void 0;
@@ -34984,11 +35104,11 @@ var AgentCoreCodeInterpreterProvider = class {
 		const response = await this.client.send(new GetCodeInterpreterCommand({ codeInterpreterId: DEFAULT_CODE_INTERPRETER_ID }));
 		return {
 			physicalId: response.codeInterpreterArn,
-			attributes: {
+			attributes: definedAttributes({
 				CodeInterpreterArn: response.codeInterpreterArn,
 				CodeInterpreterId: response.codeInterpreterId ?? "aws.codeinterpreter.v1",
-				Status: response.status ?? ""
-			}
+				Status: response.status
+			})
 		};
 	}
 };
@@ -35100,12 +35220,12 @@ var AgentCoreEvaluatorProvider = class {
 			this.logger.debug(`Created BedrockAgentCore Evaluator: ${evaluatorId} (${evaluatorArn})`);
 			return {
 				physicalId: evaluatorArn,
-				attributes: {
+				attributes: definedAttributes({
 					EvaluatorArn: evaluatorArn,
 					EvaluatorId: evaluatorId,
-					Status: response.status ?? "",
-					CreatedAt: response.createdAt?.toISOString() ?? ""
-				}
+					Status: response.status,
+					CreatedAt: response.createdAt?.toISOString()
+				})
 			};
 		} catch (error) {
 			const cause = error instanceof Error ? error : void 0;
@@ -35135,12 +35255,12 @@ var AgentCoreEvaluatorProvider = class {
 			return {
 				physicalId: evaluatorArn,
 				wasReplaced: false,
-				attributes: {
+				attributes: definedAttributes({
 					EvaluatorArn: evaluatorArn,
 					EvaluatorId: response.evaluatorId ?? evaluatorIdFromArn(evaluatorArn),
-					Status: response.status ?? "",
-					UpdatedAt: response.updatedAt?.toISOString() ?? ""
-				}
+					Status: response.status,
+					UpdatedAt: response.updatedAt?.toISOString()
+				})
 			};
 		} catch (error) {
 			const cause = error instanceof Error ? error : void 0;
@@ -39151,13 +39271,13 @@ var RDSProvider = class {
 				const described = await this.describeDBCluster(dbClusterIdentifier);
 				return {
 					physicalId: dbClusterIdentifier,
-					attributes: {
-						"Endpoint.Address": described?.Endpoint ?? "",
-						"Endpoint.Port": String(described?.Port ?? ""),
-						"ReadEndpoint.Address": described?.ReaderEndpoint ?? "",
-						Arn: described?.DBClusterArn ?? "",
-						DBClusterResourceId: described?.DbClusterResourceId ?? ""
-					}
+					attributes: definedAttributes({
+						"Endpoint.Address": described?.Endpoint,
+						"Endpoint.Port": stringifyIfAssigned(described?.Port),
+						"ReadEndpoint.Address": described?.ReaderEndpoint,
+						Arn: described?.DBClusterArn,
+						DBClusterResourceId: described?.DbClusterResourceId
+					})
 				};
 			} catch (innerError) {
 				try {
@@ -39219,13 +39339,13 @@ var RDSProvider = class {
 			return {
 				physicalId,
 				wasReplaced: false,
-				attributes: {
-					"Endpoint.Address": described?.Endpoint ?? "",
-					"Endpoint.Port": String(described?.Port ?? ""),
-					"ReadEndpoint.Address": described?.ReaderEndpoint ?? "",
-					Arn: described?.DBClusterArn ?? "",
-					DBClusterResourceId: described?.DbClusterResourceId ?? ""
-				}
+				attributes: definedAttributes({
+					"Endpoint.Address": described?.Endpoint,
+					"Endpoint.Port": stringifyIfAssigned(described?.Port),
+					"ReadEndpoint.Address": described?.ReaderEndpoint,
+					Arn: described?.DBClusterArn,
+					DBClusterResourceId: described?.DbClusterResourceId
+				})
 			};
 		} catch (error) {
 			const cause = error instanceof Error ? error : void 0;
@@ -39304,11 +39424,11 @@ var RDSProvider = class {
 			const described = await this.describeDBInstance(dbInstanceIdentifier);
 			return {
 				physicalId: dbInstanceIdentifier,
-				attributes: {
-					"Endpoint.Address": described?.Endpoint?.Address ?? "",
-					"Endpoint.Port": String(described?.Endpoint?.Port ?? ""),
-					Arn: described?.DBInstanceArn ?? ""
-				}
+				attributes: definedAttributes({
+					"Endpoint.Address": described?.Endpoint?.Address,
+					"Endpoint.Port": stringifyIfAssigned(described?.Endpoint?.Port),
+					Arn: described?.DBInstanceArn
+				})
 			};
 		} catch (error) {
 			if (error instanceof ProvisioningError) throw error;
@@ -39349,11 +39469,11 @@ var RDSProvider = class {
 			return {
 				physicalId,
 				wasReplaced: false,
-				attributes: {
-					"Endpoint.Address": described?.Endpoint?.Address ?? "",
-					"Endpoint.Port": String(described?.Endpoint?.Port ?? ""),
-					Arn: described?.DBInstanceArn ?? ""
-				}
+				attributes: definedAttributes({
+					"Endpoint.Address": described?.Endpoint?.Address,
+					"Endpoint.Port": stringifyIfAssigned(described?.Endpoint?.Port),
+					Arn: described?.DBInstanceArn
+				})
 			};
 		} catch (error) {
 			const cause = error instanceof Error ? error : void 0;
@@ -39824,11 +39944,11 @@ var RDSDBProxyProvider = class {
 		if (!endpoint || !dbProxyArn) throw new ProvisioningError(`Timed out waiting for DBProxy ${dbProxyName} to become available (last status: ${status ?? "unknown"})`, resourceType, logicalId, dbProxyName);
 		return {
 			physicalId: dbProxyName,
-			attributes: {
+			attributes: definedAttributes({
 				DBProxyArn: dbProxyArn,
 				Endpoint: endpoint,
-				VpcId: vpcId ?? ""
-			}
+				VpcId: vpcId
+			})
 		};
 	}
 	async update(logicalId, physicalId, resourceType, properties, previousProperties) {
@@ -40156,12 +40276,12 @@ var RDSDBProxyEndpointProvider = class {
 		if (!endpoint || !arn) throw new ProvisioningError(`Timed out waiting for DBProxyEndpoint ${dbProxyEndpointName} to become available (last status: ${status ?? "unknown"})`, resourceType, logicalId, dbProxyEndpointName);
 		return {
 			physicalId: dbProxyEndpointName,
-			attributes: {
+			attributes: definedAttributes({
 				Endpoint: endpoint,
 				DBProxyEndpointArn: arn,
 				IsDefault: isDefault ?? false,
-				VpcId: vpcId ?? ""
-			}
+				VpcId: vpcId
+			})
 		};
 	}
 	async update(logicalId, physicalId, resourceType, properties, previousProperties) {
@@ -40853,13 +40973,13 @@ var DocDBProvider = class {
 			const described = await this.describeDBCluster(dbClusterIdentifier);
 			return {
 				physicalId: dbClusterIdentifier,
-				attributes: {
-					"Endpoint.Address": described?.Endpoint ?? "",
-					"Endpoint.Port": String(described?.Port ?? ""),
-					"ReadEndpoint.Address": described?.ReaderEndpoint ?? "",
-					Arn: described?.DBClusterArn ?? "",
-					ClusterResourceId: described?.DbClusterResourceId ?? ""
-				}
+				attributes: definedAttributes({
+					"Endpoint.Address": described?.Endpoint,
+					"Endpoint.Port": stringifyIfAssigned(described?.Port),
+					"ReadEndpoint.Address": described?.ReaderEndpoint,
+					Arn: described?.DBClusterArn,
+					ClusterResourceId: described?.DbClusterResourceId
+				})
 			};
 		} catch (error) {
 			if (error instanceof ProvisioningError) throw error;
@@ -40891,13 +41011,13 @@ var DocDBProvider = class {
 			return {
 				physicalId,
 				wasReplaced: false,
-				attributes: {
-					"Endpoint.Address": described?.Endpoint ?? "",
-					"Endpoint.Port": String(described?.Port ?? ""),
-					"ReadEndpoint.Address": described?.ReaderEndpoint ?? "",
-					Arn: described?.DBClusterArn ?? "",
-					ClusterResourceId: described?.DbClusterResourceId ?? ""
-				}
+				attributes: definedAttributes({
+					"Endpoint.Address": described?.Endpoint,
+					"Endpoint.Port": stringifyIfAssigned(described?.Port),
+					"ReadEndpoint.Address": described?.ReaderEndpoint,
+					Arn: described?.DBClusterArn,
+					ClusterResourceId: described?.DbClusterResourceId
+				})
 			};
 		} catch (error) {
 			const cause = error instanceof Error ? error : void 0;
@@ -40962,11 +41082,11 @@ var DocDBProvider = class {
 			const described = await this.describeDBInstance(dbInstanceIdentifier);
 			return {
 				physicalId: dbInstanceIdentifier,
-				attributes: {
-					"Endpoint.Address": described?.Endpoint?.Address ?? "",
-					"Endpoint.Port": String(described?.Endpoint?.Port ?? ""),
-					Arn: described?.DBInstanceArn ?? ""
-				}
+				attributes: definedAttributes({
+					"Endpoint.Address": described?.Endpoint?.Address,
+					"Endpoint.Port": stringifyIfAssigned(described?.Endpoint?.Port),
+					Arn: described?.DBInstanceArn
+				})
 			};
 		} catch (error) {
 			if (error instanceof ProvisioningError) throw error;
@@ -40990,11 +41110,11 @@ var DocDBProvider = class {
 			return {
 				physicalId,
 				wasReplaced: false,
-				attributes: {
-					"Endpoint.Address": described?.Endpoint?.Address ?? "",
-					"Endpoint.Port": String(described?.Endpoint?.Port ?? ""),
-					Arn: described?.DBInstanceArn ?? ""
-				}
+				attributes: definedAttributes({
+					"Endpoint.Address": described?.Endpoint?.Address,
+					"Endpoint.Port": stringifyIfAssigned(described?.Endpoint?.Port),
+					Arn: described?.DBInstanceArn
+				})
 			};
 		} catch (error) {
 			const cause = error instanceof Error ? error : void 0;
@@ -41492,12 +41612,12 @@ var NeptuneProvider = class {
 			const described = await this.describeDBCluster(dbClusterIdentifier);
 			return {
 				physicalId: dbClusterIdentifier,
-				attributes: {
-					"Endpoint.Address": described?.Endpoint ?? "",
-					"Endpoint.Port": String(described?.Port ?? ""),
-					"ReadEndpoint.Address": described?.ReaderEndpoint ?? "",
-					ClusterResourceId: described?.DbClusterResourceId ?? ""
-				}
+				attributes: definedAttributes({
+					"Endpoint.Address": described?.Endpoint,
+					"Endpoint.Port": stringifyIfAssigned(described?.Port),
+					"ReadEndpoint.Address": described?.ReaderEndpoint,
+					ClusterResourceId: described?.DbClusterResourceId
+				})
 			};
 		} catch (error) {
 			if (error instanceof ProvisioningError) throw error;
@@ -41529,12 +41649,12 @@ var NeptuneProvider = class {
 			return {
 				physicalId,
 				wasReplaced: false,
-				attributes: {
-					"Endpoint.Address": described?.Endpoint ?? "",
-					"Endpoint.Port": String(described?.Port ?? ""),
-					"ReadEndpoint.Address": described?.ReaderEndpoint ?? "",
-					ClusterResourceId: described?.DbClusterResourceId ?? ""
-				}
+				attributes: definedAttributes({
+					"Endpoint.Address": described?.Endpoint,
+					"Endpoint.Port": stringifyIfAssigned(described?.Port),
+					"ReadEndpoint.Address": described?.ReaderEndpoint,
+					ClusterResourceId: described?.DbClusterResourceId
+				})
 			};
 		} catch (error) {
 			const cause = error instanceof Error ? error : void 0;
@@ -41602,10 +41722,10 @@ var NeptuneProvider = class {
 			const described = await this.describeDBInstance(dbInstanceIdentifier);
 			return {
 				physicalId: dbInstanceIdentifier,
-				attributes: {
-					"Endpoint.Address": described?.Endpoint?.Address ?? "",
-					"Endpoint.Port": String(described?.Endpoint?.Port ?? "")
-				}
+				attributes: definedAttributes({
+					"Endpoint.Address": described?.Endpoint?.Address,
+					"Endpoint.Port": stringifyIfAssigned(described?.Endpoint?.Port)
+				})
 			};
 		} catch (error) {
 			if (error instanceof ProvisioningError) throw error;
@@ -41631,10 +41751,10 @@ var NeptuneProvider = class {
 			return {
 				physicalId,
 				wasReplaced: false,
-				attributes: {
-					"Endpoint.Address": described?.Endpoint?.Address ?? "",
-					"Endpoint.Port": String(described?.Endpoint?.Port ?? "")
-				}
+				attributes: definedAttributes({
+					"Endpoint.Address": described?.Endpoint?.Address,
+					"Endpoint.Port": stringifyIfAssigned(described?.Endpoint?.Port)
+				})
 			};
 		} catch (error) {
 			const cause = error instanceof Error ? error : void 0;
@@ -45052,12 +45172,13 @@ var ElastiCacheProvider = class {
 			const attributes = {};
 			if (described?.CacheNodes?.[0]?.Endpoint) {
 				const endpoint = described.CacheNodes[0].Endpoint;
-				attributes["RedisEndpoint.Address"] = endpoint.Address ?? "";
-				attributes["RedisEndpoint.Port"] = String(endpoint.Port ?? "");
+				if (endpoint.Address !== void 0) attributes["RedisEndpoint.Address"] = endpoint.Address;
+				if (endpoint.Port !== void 0) attributes["RedisEndpoint.Port"] = String(endpoint.Port);
 			}
 			if (described?.ConfigurationEndpoint) {
-				attributes["ConfigurationEndpoint.Address"] = described.ConfigurationEndpoint.Address ?? "";
-				attributes["ConfigurationEndpoint.Port"] = String(described.ConfigurationEndpoint.Port ?? "");
+				const configurationEndpoint = described.ConfigurationEndpoint;
+				if (configurationEndpoint.Address !== void 0) attributes["ConfigurationEndpoint.Address"] = configurationEndpoint.Address;
+				if (configurationEndpoint.Port !== void 0) attributes["ConfigurationEndpoint.Port"] = String(configurationEndpoint.Port);
 			}
 			return {
 				physicalId: cacheClusterId,
@@ -45100,12 +45221,13 @@ var ElastiCacheProvider = class {
 			const attributes = {};
 			if (described?.CacheNodes?.[0]?.Endpoint) {
 				const endpoint = described.CacheNodes[0].Endpoint;
-				attributes["RedisEndpoint.Address"] = endpoint.Address ?? "";
-				attributes["RedisEndpoint.Port"] = String(endpoint.Port ?? "");
+				if (endpoint.Address !== void 0) attributes["RedisEndpoint.Address"] = endpoint.Address;
+				if (endpoint.Port !== void 0) attributes["RedisEndpoint.Port"] = String(endpoint.Port);
 			}
 			if (described?.ConfigurationEndpoint) {
-				attributes["ConfigurationEndpoint.Address"] = described.ConfigurationEndpoint.Address ?? "";
-				attributes["ConfigurationEndpoint.Port"] = String(described.ConfigurationEndpoint.Port ?? "");
+				const configurationEndpoint = described.ConfigurationEndpoint;
+				if (configurationEndpoint.Address !== void 0) attributes["ConfigurationEndpoint.Address"] = configurationEndpoint.Address;
+				if (configurationEndpoint.Port !== void 0) attributes["ConfigurationEndpoint.Port"] = String(configurationEndpoint.Port);
 			}
 			return {
 				physicalId,
@@ -45898,11 +46020,11 @@ var ServiceDiscoveryProvider = class ServiceDiscoveryProvider {
 			}
 			return {
 				physicalId: serviceId,
-				attributes: {
+				attributes: definedAttributes({
 					Id: serviceId,
-					Arn: service.Arn || "",
-					Name: service.Name || name || ""
-				}
+					Arn: service.Arn,
+					Name: service.Name || name
+				})
 			};
 		} catch (error) {
 			const cause = error instanceof Error ? error : void 0;
@@ -47563,16 +47685,16 @@ var AppSyncProvider = class {
 			createdApiId = response.graphqlApi?.apiId;
 			const apiId = response.graphqlApi.apiId;
 			const arn = response.graphqlApi.arn;
-			const graphQLUrl = response.graphqlApi.uris?.["GRAPHQL"] ?? "";
+			const graphQLUrl = response.graphqlApi.uris?.["GRAPHQL"];
 			await this.applyEnvironmentVariables(apiId, resourceType, logicalId, properties, void 0, context?.replayingState === true);
 			this.logger.debug(`Successfully created GraphQL API ${logicalId}: ${apiId}`);
 			return {
 				physicalId: apiId,
-				attributes: {
+				attributes: definedAttributes({
 					ApiId: apiId,
 					Arn: arn,
 					GraphQLUrl: graphQLUrl
-				}
+				})
 			};
 		} catch (error) {
 			if (createdApiId) try {
@@ -58708,14 +58830,14 @@ var CodeCommitRepositoryProvider = class {
 	* resolver can recover CFn's `Ref` value (the repository ID) from state.
 	*/
 	toAttributes(metadata) {
-		return {
-			Arn: metadata?.Arn ?? "",
-			CloneUrlHttp: metadata?.cloneUrlHttp ?? "",
-			CloneUrlSsh: metadata?.cloneUrlSsh ?? "",
-			Name: metadata?.repositoryName ?? "",
-			KmsKeyId: metadata?.kmsKeyId ?? "",
-			RepositoryId: metadata?.repositoryId ?? ""
-		};
+		return definedAttributes({
+			Arn: metadata?.Arn,
+			CloneUrlHttp: metadata?.cloneUrlHttp,
+			CloneUrlSsh: metadata?.cloneUrlSsh,
+			Name: metadata?.repositoryName,
+			KmsKeyId: metadata?.kmsKeyId,
+			RepositoryId: metadata?.repositoryId
+		});
 	}
 	/**
 	* Create a CodeCommit Repository
@@ -59527,18 +59649,18 @@ var S3VectorsProvider = class {
 		const tagRecord = this.cfnTagsToRecord(properties["Tags"]);
 		const tags = Object.keys(tagRecord).length > 0 ? tagRecord : void 0;
 		try {
-			const vectorBucketArn = (await this.getClient().send(new CreateVectorBucketCommand({
+			const result = await this.getClient().send(new CreateVectorBucketCommand({
 				vectorBucketName,
 				encryptionConfiguration: encryptionConfiguration ? {
 					sseType: encryptionConfiguration["SseType"],
 					kmsKeyArn: encryptionConfiguration["KmsKeyArn"]
 				} : void 0,
 				...tags && Object.keys(tags).length > 0 ? { tags } : {}
-			}))).vectorBucketArn ?? "";
+			}));
 			this.logger.debug(`Successfully created S3 VectorBucket ${logicalId}: ${vectorBucketName}`);
 			return {
 				physicalId: vectorBucketName,
-				attributes: { VectorBucketArn: vectorBucketArn }
+				attributes: definedAttributes({ VectorBucketArn: result.vectorBucketArn })
 			};
 		} catch (error) {
 			const cause = error instanceof Error ? error : void 0;
@@ -61000,8 +61122,6 @@ var ECRProvider = class {
 				...tags ? { tags } : {}
 			}))).repository;
 			if (!repo?.repositoryName) throw new Error("CreateRepository did not return repository name");
-			const arn = repo.repositoryArn ?? "";
-			const repositoryUri = repo.repositoryUri ?? "";
 			const lifecyclePolicy = properties["LifecyclePolicy"];
 			if (lifecyclePolicy?.LifecyclePolicyText) {
 				await this.getClient().send(new PutLifecyclePolicyCommand({
@@ -61022,10 +61142,10 @@ var ECRProvider = class {
 			this.logger.debug(`Successfully created ECR Repository ${logicalId}: ${repo.repositoryName}`);
 			return {
 				physicalId: repo.repositoryName,
-				attributes: {
-					Arn: arn,
-					RepositoryUri: repositoryUri
-				}
+				attributes: definedAttributes({
+					Arn: repo.repositoryArn,
+					RepositoryUri: repo.repositoryUri
+				})
 			};
 		} catch (error) {
 			const cause = error instanceof Error ? error : void 0;
@@ -61119,10 +61239,10 @@ var ECRProvider = class {
 			return {
 				physicalId,
 				wasReplaced: false,
-				attributes: {
-					Arn: repo?.repositoryArn ?? "",
-					RepositoryUri: repo?.repositoryUri ?? ""
-				}
+				attributes: definedAttributes({
+					Arn: repo?.repositoryArn,
+					RepositoryUri: repo?.repositoryUri
+				})
 			};
 		} catch (error) {
 			const cause = error instanceof Error ? error : void 0;
@@ -83726,7 +83846,7 @@ function resolveAssetCodePath$1(stack, logicalId, resource) {
 * **Order is preserved**: `Properties.Layers` is iterated left-to-right
 * and the resulting `ResolvedLambdaLayer[]` carries the same order. The
 * caller (`local-invoke.ts`'s `materializeLambdaLayers` and
-* `local-start-api.ts`'s server-boot pre-merge) `cpSync`-merges every
+* `local-start-api.ts`'s server-boot pre-merge) merges every
 * entry into one host tmpdir in template order to honor AWS's
 * "last-layer-wins" file-collision semantics — Docker rejects multiple
 * bind mounts at the same target so cdkd cannot rely on overlay
@@ -83997,6 +84117,110 @@ function notFoundError$1(target, stack, resources) {
 	return new LocalInvokeResolutionError(msg.trimEnd());
 }
 
+//#endregion
+//#region src/local/layer-tree-copy.ts
+/**
+* Merge one Lambda Layer's asset tree into the directory that will be
+* bind-mounted at `/opt`, with AWS's "last layer wins" semantic and with
+* symlinks kept VERBATIM (issue #3106).
+*
+* Why this is a hand-written walk and not `cpSync`. The merge used to be
+* `cpSync(src, dest, { recursive: true, force: true })`, and every
+* `cpSync`-shaped repair of it was measured wrong in some direction:
+*
+*   - Without `verbatimSymlinks: true` (the default), `cpSync` rewrites a
+*     RELATIVE link target to the ABSOLUTE path of the source on the host —
+*     `bin/rel-link -> real.sh` arrives as `-> <cdk.out>/asset.<hash>/bin/
+*     real.sh`, which is dangling inside the container, where only `dest`
+*     is mounted. Measured on Node 22.12 / 24.21.
+*   - WITH `verbatimSymlinks: true`, Node's C++ `cpSync` (every release
+*     after 22.12) throws `EEXIST` when a later layer carries a symlink at a
+*     path an earlier layer already placed one — `nodejs/node_modules/.bin/
+*     <tool>` in two layers built from the same dependency is the ordinary
+*     case. Measured by the go-to-k/cdkd#3118 review on 22.23 / 24.15 /
+*     24.21; the JS implementation on 22.12 does not throw, which is why
+*     the floor alone did not show it.
+*   - A `cpSync` + `readdirSync({ recursive: true })` pair was worse:
+*     the recursive readdir DESCENDS INTO directory symlinks on every Node
+*     after 22.12 (not on 22.12), so a cyclic link (`sub/up -> ..`, or a
+*     pnpm-style `node_modules`) hung the merge, and an absolute link to a
+*     host directory made the walk delete and write INSIDE that host
+*     directory. And `cpSync`'s `force` writes THROUGH a destination that
+*     is already a directory symlink, so a later layer's real directory
+*     landed in the earlier layer's link target — on the host, when the
+*     link was absolute. Same review, same versions.
+*
+* So the walk is explicit and recurses only on a real directory (`d_type`,
+* via `Dirent.isDirectory()`, which reports a directory symlink as a
+* symlink on 22.12 and 24.21 alike). Per entry, "last layer wins" is applied
+* the same way for every kind: whatever sits at the destination path that is
+* not of the same kind is removed first — a link, a file, or a whole
+* directory an earlier layer placed — then the entry lands. A symlink is
+* recreated with the SOURCE's own target string and never resolved, so an
+* absolute link stays absolute and a dangling one stays dangling, exactly as
+* AWS extracts the layer ZIP into `/opt`; nothing is ever written through a
+* link. A file is copied with `cpSync` (single file, `force`), which is what
+* preserves the mode bits, so a layer's `bin/<script>` keeps its `+x` — the
+* property the `local-invoke-layers` fixture executes through.
+*
+* The ROOT may itself be a symlink (an asset dir handed over through a link
+* passes `resolveAssetCodePath`'s `statSync`). `readdirSync` follows a root
+* link by itself, so the `realpathSync` is not what makes that case work,
+* and it does not move where a dangling or looping root fails either (the
+* first `readdirSync` raises the same `ENOENT` / `ELOOP` naming the asset
+* path); it only keeps every path the walk joins real.
+*
+* Bound, stated rather than handled: a FIFO or a socket inside a layer
+* makes the single-file `cpSync` throw (`ERR_FS_CP_FIFO_PIPE` /
+* `ERR_FS_CP_SOCKET`, immediately, never blocking) where the old recursive
+* copy skipped it in silence on some releases. CDK's own asset staging
+* cannot stage such an entry, so no real layer carries one.
+*
+* Both layer merges (`cdkd local invoke` and `cdkd local start-api`) call
+* this; keep them on the one helper rather than re-spelling copy options.
+*/
+function copyLayerTreeLastWins(src, dest) {
+	mkdirSync(dest, { recursive: true });
+	copyDirLastWins(realpathSync(src), dest);
+}
+function copyDirLastWins(fromDir, toDir) {
+	for (const entry of readdirSync(fromDir, { withFileTypes: true })) {
+		const from = join(fromDir, entry.name);
+		const to = join(toDir, entry.name);
+		if (entry.isSymbolicLink()) {
+			removeUnless(to, "symlink");
+			symlinkSync(readlinkSync(from), to);
+		} else if (entry.isDirectory()) {
+			removeUnless(to, "directory");
+			mkdirSync(to, { recursive: true });
+			copyDirLastWins(from, to);
+		} else {
+			removeUnless(to, "file");
+			cpSync(from, to, { force: true });
+		}
+	}
+}
+/**
+* Clear the destination path unless what is there is already of `kind`. A
+* directory is kept so a later layer MERGES into it; a file is kept because
+* `cpSync` overwrites it in place; a symlink is always replaced (its target
+* string comes from the later layer).
+*/
+function removeUnless(to, kind) {
+	let st;
+	try {
+		st = lstatSync(to);
+	} catch {
+		return;
+	}
+	if (kind === "directory" && st.isDirectory()) return;
+	if (kind === "file" && st.isFile()) return;
+	rmSync(to, {
+		recursive: true,
+		force: true
+	});
+}
+
 //#endregion
 //#region src/local/ecs-task-resolver.ts
 function detectEcsImageResolutionNeeds(stack) {
@@ -87413,12 +87637,12 @@ async function resolveLocalBuildPlan$1(lambda) {
 *     when the entry is a same-stack asset. Literal-ARN entries always
 *     pre-materialize first.
 *   - 2+ layers → copy each into a fresh tmpdir IN ORDER (later
-*     layers overwrite earlier files via `cpSync({force: true})`),
+*     layers overwrite earlier files via `copyLayerTreeLastWins`),
 *     bind-mount the tmpdir at `/opt`. Records the tmpdir in
 *     `layerTmpDirs` so `shutdown(...)` removes it.
 *
 * Issue #448: literal-ARN entries (`{kind: 'arn', ...}`) are downloaded
-* + unzipped via `lambda:GetLayerVersion` BEFORE the cpSync-merge
+* + unzipped via `lambda:GetLayerVersion` BEFORE the merge
 * branches run. Every per-ARN tmpdir is also recorded in `layerTmpDirs`
 * so the same shutdown path cleans it up — even for the single-layer
 * fast path that bind-mounts the dir directly.
@@ -87448,10 +87672,15 @@ async function materializeLambdaLayers$1(layers, layerTmpDirs, layerRoleArn) {
 	}
 	if (flat.length === 1) return flat[0].assetPath;
 	const dir = mkdtempSync(path.join(tmpdir(), "cdkd-local-start-api-layers-"));
-	for (const layer of flat) cpSync(layer.assetPath, dir, {
-		recursive: true,
-		force: true
-	});
+	try {
+		for (const layer of flat) copyLayerTreeLastWins(layer.assetPath, dir);
+	} catch (error) {
+		rmSync(dir, {
+			recursive: true,
+			force: true
+		});
+		throw error;
+	}
 	layerTmpDirs.add(dir);
 	return dir;
 }
@@ -91402,7 +91631,7 @@ async function resolveZipImagePlan(lambda, options) {
 *   - Stage 2: the resulting `{logicalId, assetPath}[]` list (in
 *     template order — ARN entries surface their `arn` as the
 *     `logicalId` for log lines) is handed to the existing
-*     `materializeLambdaLayers` `cpSync`-merge path. AWS's "last layer
+*     `materializeLambdaLayers` merge path. AWS's "last layer
 *     wins" file-collision semantic is preserved across both layer
 *     kinds because the merge step is unchanged.
 */
@@ -91470,7 +91699,7 @@ function resolveTmpfsForLambda(lambda) {
 *      than copying since CDK has already unzipped the asset.
 *   3. **Multiple layers**: copies each layer's contents into a fresh
 *      tmpdir IN ORDER (later layers overwrite earlier files via
-*      `cpSync({force: true})`), then bind-mounts the merged tmpdir at
+*      `copyLayerTreeLastWins`), then bind-mounts the merged tmpdir at
 *      `/opt`. Returns `{ mount, tmpDir: <path> }` so the caller can
 *      `rmSync` the tmpdir on cleanup.
 *
@@ -91487,10 +91716,15 @@ function materializeLambdaLayers(layers) {
 		readOnly: true
 	} };
 	const tmpDir = mkdtempSync(path.join(tmpdir(), "cdkd-local-invoke-layers-"));
-	for (const layer of layers) cpSync(layer.assetPath, tmpDir, {
-		recursive: true,
-		force: true
-	});
+	try {
+		for (const layer of layers) copyLayerTreeLastWins(layer.assetPath, tmpDir);
+	} catch (error) {
+		rmSync(tmpDir, {
+			recursive: true,
+			force: true
+		});
+		throw error;
+	}
 	return {
 		mount: {
 			hostPath: tmpDir,
@@ -92057,4 +92291,4 @@ function buildProgram() {
 
 //#endregion
 export { buildProgram };
-//# sourceMappingURL=program-DUmAMwgQ.js.map
+//# sourceMappingURL=program-z-ESK5sd.js.map