@go-to-k/cdkd 0.290.3 → 0.290.5

package/dist/{program-CoRRfEe_.js → program-D30EPjOn.js}

@@ -1,8 +1,8 @@
-import { $ as secretSafeKeyDisplay, $n as parseBootstrapMarker, $t as DiffCalculator, A as planOrphanAdoption, An as formatLockExpiry, Ar as resolveUseCdkBootstrapAssets, At as WAFv2WebACLProvider, B as formatResourceLine, Bn as AssetPublisher, Br as PARTITION_TABLE, Bt as replayWarn, C as createPreDeleteFinalSnapshot, Ci as isThrottlingError, Cn as scrubResourceRecord, Cr as getLegacyStateBucketName, Ct as cfnRefValueFromPhysicalId, D as makeCanonicalizePropertiesFn, Di as retryClassificationText, Dn as buildForceUnlockCommand, Dr as resolveSkipPrefix, Dt as parameterTypeMayLoseSecretIdentity, E as unsupportedFinalSnapshotError, Ei as markRedactedCause, En as rebuildClientForBucketRegion, Er as resolveCaptureObservedState, Et as isUnboundTemplateParameter, F as WARM_THROUGHPUT_MEMBERS, Fn as importableOutputKeys, Fr as MIGRATE_TMP_PREFIX, Ft as coerceCfnInteger, G as red, Gn as loadPublishableAssetManifest, Gt as producerRegionsFromState, H as cyan, Hn as WorkGraph, Hr as derivePartitionAndUrlSuffix, Ht as requireConfigObject, I as coerceWarmThroughput$1, In as importableOutputs, Ir as findLargeInlineResources, It as configBooleanRefusal, J as collectPublishedOutputNames, Jn as BOOTSTRAP_MARKER_PREFIX, Jr as getAwsClients, Jt as s3BucketDomainName, K as yellow, Kn as rewriteTemplateAssetReferences, Kr as resolveBucketRegion, Kt as withSharedDrainBudget, L as isWarmThroughputDecrease, Ln as orphansAfterRollback, Lr as uploadCfnTemplate, Lt as configIntegerRefusal, M as isStatefulRecreateTargetForReplace, Mn as CUSTOM_RESOURCE_RESPONSE_PREFIX, Mr as warnDeprecatedNoPrefixCliFlag, Mt as resolveExplicitPhysicalId, N as isStatefulRecreateTargetSync, Nn as DEFAULT_STATE_PREFIX, Nr as CFN_TEMPLATE_BODY_LIMIT, Nt as assertRegionMatch, O as extractDeploymentEventError, On as buildLockContentionMessage, Or as resolveStateBucketWithDefault, Ot as refStateLookupFromResource, P as renderStatefulReason, Pn as exportNamesCarriedFrom, Pr as CFN_TEMPLATE_URL_LIMIT, Pt as coerceCfnBoolean, Q as secretBearingStateKeyWarning, Qn as isCrossRegionRedirect, Qr as CdkdError, Qt as applyRoleArnIfSet, R as toCfnInteger, Rn as orphansCarriedFrom, Rr as CUSTOM_RESOURCE_RESPONSE_OBJECT_DESCRIPTION, Rt as configStringRefusal, S as ccRoutedFinalSnapshotError, Si as isRetryableTransientError, Sn as redactSecretsForState, Sr as getDefaultStateBucketName, St as carriesDynamicReference, T as refusesFinalSnapshot, Ti as markNonRetryable, Tn as S3StateBackend, Tr as resolveAutoAssetStorage, Tt as getAccountInfo, U as gray, Un as buildAssetRedirectMap, Ur as AssemblyReader, Ut as requireConfigString, V as bold, Vn as stringifyValue, Vr as canonicalizeRegion, Vt as requireConfigArray, W as green, Wn as createAssetRedirectResolver, Wr as processStackMessages, Wt as classifyReplaySecretRegion, X as isExportAliasCollision, Xn as ensureAssetStorage, Xr as setAwsClients, Xt as s3BucketRegionalDomainName, Y as exportAliasCollisionScrubWarning, Yn as assertAssetBucketRegion, Yr as resetAwsClients, Yt as s3BucketDualStackDomainName, Z as secretBearing, Zn as getBootstrapMarkerKey, Zt as s3BucketWebsiteUrl, _ as isSecretBearingReferenceString, _n as markSameGenerationBag, _r as stripControlChars, _t as deleteIndeterminateGuards, a as DeploymentEventsStore, ai as LocalInvokeBuildError$1, an as DagBuilder, ar as buildDockerImage, at as wouldReturnToSdkProvider, b as PRE_DELETE_SNAPSHOT_TYPES, bi as withErrorHandling, bn as recordMaskOnlyValue, br as Synthesizer, bt as isTerminationProtectionPropagationError, c as replayFailedOperations, ci as NestedStackChildDirectDestroyError, cn as STATE_SOURCED_CROSS_GENERATION_RULES, cr as describeDockerFailure, ct as maskerOrIdentity, d as updatePartialReason, di as ResourceTimeoutError, dn as carriesSecretMask, dr as getDockerCmd, dt as interruptWatchListenerCount, ei as CrossAccountSecretRefusalError, en as INTRINSIC_KEYS, er as readBootstrapMarkerBody, et as getCurrentResourceSecrets, f as withResourceDeadline, fi as ResourceUpdateNotSupportedError, fn as createSecretMasker, fr as partitionSensitiveEnv, ft as isInterruptedWaitError, g as bagHoldsSecretExpression, gn as isSingleDynamicReferenceToken, gr as escapeRegExp, gt as UNSPECIFIED_SKIP_REASON, h as computeImplicitDeleteEdges, hn as identityKeyFor, hr as runDockerStreaming, ht as slowCcOperationTimeoutMs, i as DeploymentEventsReader, ii as IntrinsicResolutionRefusalError, in as withRetry, ir as describeAwsFailure, it as ProviderRegistry, j as MULTI_REGION_RECREATE_BLOCKED_TYPES, jn as shellQuote, jr as stateBucketExistenceConfirmed, jt as normalizeAwsTagsToCfn, k as makeSiblingClaimReader, kn as forceQuitRecoveryClause, kr as resolveStateBucketWithDefaultAndSource, kt as isSettledInstanceState, l as replayRollback, li as PartialFailureError, ln as STATE_SOURCED_READBACK_RULES, lr as dockerSpawnEnvWithSensitive, lt as beginCommandInterruptScope, m as IMPLICIT_DELETE_DEPENDENCIES, mi as StackTerminationProtectionError, mn as errorCauseChain, mr as runDockerForeground, mt as CloudControlProvider, n as DEFAULT_RESOURCE_WARN_AFTER_MS, ni as DeployCancelledError, nn as findSilentDropProperties, nr as validateContainerRepoName, nt as collectInlinePolicyNamesManagedBySiblings, o as planFailedOps, oi as LocalStartServiceError, on as TemplateParser, or as describeDockerCapturedOutput, ot as createMaskedRetryLogger, p as maskingRetryLogger, pi as StackHasActiveImportsError, pn as dynamicReferenceTokens, pr as redactDockerArgvValues, pt as startInterruptWatch, q as collectDeclaredOutputNames, qn as AssetModeResolver, qr as AwsClients, qt as s3BucketArn, r as DeployEngine, ri as DynamicReferenceRegionAmbiguousError, rn as describeTypeWithThrottleRetry, rr as buildDenyExternalAccessPolicy, rt as clearOnUpdateRemoval, s as planRollback, sn as STATE_SOURCED_BASELINE_RULES, sr as describeDockerExecFailure, st as maskDeep, t as DEFAULT_RESOURCE_TIMEOUT_MS, tn as findActionableSilentDrops, tr as validateAssetBucketName, tt as IAMRoleProvider, u as updatePartialMessage, ui as ProvisioningError, un as TEMPLATE_SOURCED_RULES, ur as formatDockerLoginError, ut as endCommandInterruptScope, v as bindingSkippedOutputs, vn as maskSecretsInError, vr as AssetManifestLoader, vt as deleteSkipReason, w as isFinalSnapshotError, wi as isTransientServerError, wn as LockManager, wr as resolveApp, wt as coerceParameterTypedValue, x as buildFinalSnapshotIdentifier, xi as isMarkedNonRetryable, xn as recoverMaskedOutput, xr as synthesisStatusMessage, xt as IntrinsicFunctionResolver, y as ATOMIC_FINAL_SNAPSHOT_TYPES, yi as normalizeAwsError, yn as maskSecretsInText, yr as getDockerImageBySourceHash, yt as disableInstanceApiTermination, z as toFiniteNumber, zn as shouldRetainResource, zr as expectedOwnerParam, zt as readConfigString } from "./deploy-engine-0Wg4MwP2.js";
+import { $ as secretSafeKeyDisplay, $n as isCrossRegionRedirect, $r as CdkdError, $t as applyRoleArnIfSet, A as planOrphanAdoption, An as forceQuitRecoveryClause, Ar as resolveStateBucketWithDefaultAndSource, At as isSettledInstanceState, B as formatResourceLine, Bn as shouldRetainResource, Br as expectedOwnerParam, Bt as readConfigString, C as createPreDeleteFinalSnapshot, Ci as isRetryableTransientError, Cn as redactSecretsForState, Cr as getDefaultStateBucketName, Ct as cfnRefValueFromPhysicalId, D as makeCanonicalizePropertiesFn, Di as markRedactedCause, Dn as rebuildClientForBucketRegion, Dr as resolveCaptureObservedState, Dt as isUnboundTemplateParameter, E as unsupportedFinalSnapshotError, Ei as markNonRetryable, En as S3StateBackend, Er as resolveAutoAssetStorage, Et as isImpossibleEmptyStoredAttribute, F as WARM_THROUGHPUT_MEMBERS, Fn as exportNamesCarriedFrom, Fr as CFN_TEMPLATE_URL_LIMIT, Ft as coerceCfnBoolean, G as red, Gn as createAssetRedirectResolver, Gr as processStackMessages, Gt as classifyReplaySecretRegion, H as cyan, Hn as stringifyValue, Hr as canonicalizeRegion, Ht as requireConfigArray, I as coerceWarmThroughput$1, In as importableOutputKeys, Ir as MIGRATE_TMP_PREFIX, It as coerceCfnInteger, J as collectPublishedOutputNames, Jn as AssetModeResolver, Jr as AwsClients, Jt as s3BucketArn, K as yellow, Kn as loadPublishableAssetManifest, Kt as producerRegionsFromState, L as isWarmThroughputDecrease, Ln as importableOutputs, Lr as findLargeInlineResources, Lt as configBooleanRefusal, M as isStatefulRecreateTargetForReplace, Mn as shellQuote, Mr as stateBucketExistenceConfirmed, Mt as normalizeAwsTagsToCfn, N as isStatefulRecreateTargetSync, Nn as CUSTOM_RESOURCE_RESPONSE_PREFIX, Nr as warnDeprecatedNoPrefixCliFlag, Nt as resolveExplicitPhysicalId, O as extractDeploymentEventError, Oi as retryClassificationText, On as buildForceUnlockCommand, Or as resolveSkipPrefix, Ot as parameterTypeMayLoseSecretIdentity, P as renderStatefulReason, Pn as DEFAULT_STATE_PREFIX, Pr as CFN_TEMPLATE_BODY_LIMIT, Pt as assertRegionMatch, Q as secretBearingStateKeyWarning, Qn as getBootstrapMarkerKey, Qt as s3BucketWebsiteUrl, R as toCfnInteger, Rn as orphansAfterRollback, Rr as uploadCfnTemplate, Rt as configIntegerRefusal, S as ccRoutedFinalSnapshotError, Si as isMarkedNonRetryable, Sn as recoverMaskedOutput, Sr as synthesisStatusMessage, St as carriesDynamicReference, T as refusesFinalSnapshot, Ti as isTransientServerError, Tn as LockManager, Tr as resolveApp, Tt as getAccountInfo, U as gray, Un as WorkGraph, Ur as derivePartitionAndUrlSuffix, Ut as requireConfigObject, V as bold, Vn as AssetPublisher, Vr as PARTITION_TABLE, Vt as replayWarn, W as green, Wn as buildAssetRedirectMap, Wr as AssemblyReader, Wt as requireConfigString, X as isExportAliasCollision, Xn as assertAssetBucketRegion, Xr as resetAwsClients, Xt as s3BucketDualStackDomainName, Y as exportAliasCollisionScrubWarning, Yn as BOOTSTRAP_MARKER_PREFIX, Yr as getAwsClients, Yt as s3BucketDomainName, Z as secretBearing, Zn as ensureAssetStorage, Zr as setAwsClients, Zt as s3BucketRegionalDomainName, _ as isSecretBearingReferenceString, _n as isSingleDynamicReferenceToken, _r as escapeRegExp, _t as deleteIndeterminateGuards, a as DeploymentEventsStore, ai as IntrinsicResolutionRefusalError, an as withRetry, ar as describeAwsFailure, at as wouldReturnToSdkProvider, b as PRE_DELETE_SNAPSHOT_TYPES, bi as normalizeAwsError, bn as maskSecretsInText, br as getDockerImageBySourceHash, bt as isTerminationProtectionPropagationError, c as replayFailedOperations, cn as STATE_SOURCED_BASELINE_RULES, cr as describeDockerExecFailure, ct as maskerOrIdentity, d as updatePartialReason, di as ProvisioningError, dn as TEMPLATE_SOURCED_RULES, dr as formatDockerLoginError, dt as interruptWatchListenerCount, en as DiffCalculator, er as parseBootstrapMarker, et as getCurrentResourceSecrets, f as withResourceDeadline, fi as ResourceTimeoutError, fn as carriesSecretMask, fr as getDockerCmd, ft as isInterruptedWaitError, g as bagHoldsSecretExpression, gn as identityKeyFor, gr as runDockerStreaming, gt as UNSPECIFIED_SKIP_REASON, h as computeImplicitDeleteEdges, hi as StackTerminationProtectionError, hn as errorCauseChain, hr as runDockerForeground, ht as slowCcOperationTimeoutMs, i as DeploymentEventsReader, ii as DynamicReferenceRegionAmbiguousError, in as describeTypeWithThrottleRetry, ir as buildDenyExternalAccessPolicy, it as ProviderRegistry, j as MULTI_REGION_RECREATE_BLOCKED_TYPES, jn as formatLockExpiry, jr as resolveUseCdkBootstrapAssets, jt as WAFv2WebACLProvider, k as makeSiblingClaimReader, kn as buildLockContentionMessage, kr as resolveStateBucketWithDefault, kt as refStateLookupFromResource, l as replayRollback, li as NestedStackChildDirectDestroyError, ln as STATE_SOURCED_CROSS_GENERATION_RULES, lr as describeDockerFailure, lt as beginCommandInterruptScope, m as IMPLICIT_DELETE_DEPENDENCIES, mi as StackHasActiveImportsError, mn as dynamicReferenceTokens, mr as redactDockerArgvValues, mt as CloudControlProvider, n as DEFAULT_RESOURCE_WARN_AFTER_MS, nn as findActionableSilentDrops, nr as validateAssetBucketName, nt as collectInlinePolicyNamesManagedBySiblings, o as planFailedOps, oi as LocalInvokeBuildError$1, on as DagBuilder, or as buildDockerImage, ot as createMaskedRetryLogger, p as maskingRetryLogger, pi as ResourceUpdateNotSupportedError, pn as createSecretMasker, pr as partitionSensitiveEnv, pt as startInterruptWatch, q as collectDeclaredOutputNames, qn as rewriteTemplateAssetReferences, qr as resolveBucketRegion, qt as withSharedDrainBudget, r as DeployEngine, ri as DeployCancelledError, rn as findSilentDropProperties, rr as validateContainerRepoName, rt as clearOnUpdateRemoval, s as planRollback, si as LocalStartServiceError, sn as TemplateParser, sr as describeDockerCapturedOutput, st as maskDeep, t as DEFAULT_RESOURCE_TIMEOUT_MS, ti as CrossAccountSecretRefusalError, tn as INTRINSIC_KEYS, tr as readBootstrapMarkerBody, tt as IAMRoleProvider, u as updatePartialMessage, ui as PartialFailureError, un as STATE_SOURCED_READBACK_RULES, ur as dockerSpawnEnvWithSensitive, ut as endCommandInterruptScope, v as bindingSkippedOutputs, vn as markSameGenerationBag, vr as stripControlChars, vt as deleteSkipReason, w as isFinalSnapshotError, wi as isThrottlingError, wn as scrubResourceRecord, wr as getLegacyStateBucketName, wt as coerceParameterTypedValue, x as buildFinalSnapshotIdentifier, xi as withErrorHandling, xn as recordMaskOnlyValue, xr as Synthesizer, xt as IntrinsicFunctionResolver, y as ATOMIC_FINAL_SNAPSHOT_TYPES, yn as maskSecretsInError, yr as AssetManifestLoader, yt as disableInstanceApiTermination, z as toFiniteNumber, zn as orphansCarriedFrom, zr as CUSTOM_RESOURCE_RESPONSE_OBJECT_DESCRIPTION, zt as configStringRefusal } from "./deploy-engine-WFO9o9M0.js";
 import { S as truncateCodePoints, _ as withSkipPrefix, b as displayIdent, c as PATTERN_B_NAME_OPTIONS, f as explicitNamePropertyFor, h as getCurrentStackName, i as reserveStdoutForPayload, l as PATTERN_B_NAME_PROPERTIES, m as generateResourceNameWithFallback, n as getLogger, o as runStackBuffered, p as generateResourceName, s as getLiveRenderer, u as PATTERN_B_RESOURCE_TYPES, v as withStackName, x as displaySafe, y as UNRENDERABLE } from "./logger-th1myfgh.js";
 import { t as awsClientDefaults } from "./aws-client-defaults-D-iYiIJ6.js";
-import { t as getCdkdVersion } from "./version-BTao4oxo.js";
-import { a as renderDisableCommand, i as protectedReplacementAdvice, r as UNNAMEABLE_ID_CLAUSE, t as ASGProvider } from "./asg-provider-RLnpBIKj.js";
+import { t as getCdkdVersion } from "./version-BBIkp8ja.js";
+import { a as renderDisableCommand, i as protectedReplacementAdvice, r as UNNAMEABLE_ID_CLAUSE, t as ASGProvider } from "./asg-provider-DU7mN-cS.js";
 import { AsyncLocalStorage } from "node:async_hooks";
 import { createHash, randomBytes, randomUUID } from "node:crypto";
 import { CopyObjectCommand, CreateBucketCommand, DeleteBucketAnalyticsConfigurationCommand, DeleteBucketCommand, DeleteBucketCorsCommand, DeleteBucketEncryptionCommand, DeleteBucketIntelligentTieringConfigurationCommand, DeleteBucketInventoryConfigurationCommand, DeleteBucketLifecycleCommand, DeleteBucketMetricsConfigurationCommand, DeleteBucketOwnershipControlsCommand, DeleteBucketPolicyCommand, DeleteBucketReplicationCommand, DeleteBucketTaggingCommand, DeleteBucketWebsiteCommand, DeleteObjectsCommand, GetBucketAccelerateConfigurationCommand, GetBucketCorsCommand, GetBucketEncryptionCommand, GetBucketLifecycleConfigurationCommand, GetBucketLocationCommand, GetBucketLoggingCommand, GetBucketNotificationConfigurationCommand, GetBucketOwnershipControlsCommand, GetBucketPolicyCommand, GetBucketReplicationCommand, GetBucketTaggingCommand, GetBucketVersioningCommand, GetBucketWebsiteCommand, GetObjectCommand, GetObjectLockConfigurationCommand, GetPublicAccessBlockCommand, HeadBucketCommand, ListBucketAnalyticsConfigurationsCommand, ListBucketIntelligentTieringConfigurationsCommand, ListBucketInventoryConfigurationsCommand, ListBucketMetricsConfigurationsCommand, ListObjectVersionsCommand, ListObjectsV2Command, NoSuchBucket, NotFound, PutBucketAccelerateConfigurationCommand, PutBucketAnalyticsConfigurationCommand, PutBucketCorsCommand, PutBucketEncryptionCommand, PutBucketIntelligentTieringConfigurationCommand, PutBucketInventoryConfigurationCommand, PutBucketLifecycleConfigurationCommand, PutBucketLoggingCommand, PutBucketMetricsConfigurationCommand, PutBucketNotificationConfigurationCommand, PutBucketOwnershipControlsCommand, PutBucketPolicyCommand, PutBucketReplicationCommand, PutBucketTaggingCommand, PutBucketVersioningCommand, PutBucketWebsiteCommand, PutObjectCommand, PutObjectLockConfigurationCommand, PutPublicAccessBlockCommand, S3Client, S3ServiceException } from "@aws-sdk/client-s3";
@@ -18953,7 +18953,7 @@ var DynamoDBTableProvider = class {
 		const warn = (message) => this.logger.warn(maskSecrets(message));
 		const coerced = coerceWarmThroughput(value);
 		if (coerced === void 0) return void 0;
-		if (coerced.dropped.length > 0) warn(`${scope}: WarmThroughput member(s) ${coerced.dropped.join(", ")} in ${JSON.stringify(maskLeafValue$1(value, maskSecrets))} are not a number DynamoDB accepts, so they were dropped from the request, which leaves ${JSON.stringify(maskLeafValue$1(coerced.spec, maskSecrets))}. Check for an unresolved intrinsic or a non-numeric value.`);
+		if (coerced.dropped.length > 0) warn(`${scope}: WarmThroughput member(s) ${coerced.dropped.join(", ")} in ${JSON.stringify(maskLeafValue$1(value, maskSecrets))} are not a number DynamoDB accepts, so they were dropped from the request, which leaves ${JSON.stringify(maskLeafValue$1(coerced.spec, maskSecrets))}. Check for an unresolved intrinsic or a spelling CloudFormation would reject: an Integer here is an optional sign and decimal digits only (no surrounding whitespace, hex, exponent or decimal point).`);
 		return coerced.spec;
 	}
 	/**
@@ -20726,10 +20726,10 @@ var DynamoDBGlobalTableProvider = class {
 		const watch = startInterruptWatch(`DynamoDB auto-scaling for ${tableName}`);
 		try {
 			if (newEnabled) {
-				const minCapacity = Number(newSettings["MinCapacity"] ?? 0);
-				const maxCapacity = Number(newSettings["MaxCapacity"] ?? 0);
-				if (!Number.isFinite(minCapacity) || !Number.isFinite(maxCapacity)) {
-					warn(`Cannot apply auto-scaling diff on ${tableName} (${dimension}): MinCapacity / MaxCapacity must be numbers, got ${maskSecrets(String(newSettings["MinCapacity"]))} / ${maskSecrets(String(newSettings["MaxCapacity"]))}`);
+				const minCapacity = coerceCfnInteger(newSettings["MinCapacity"] ?? 0);
+				const maxCapacity = coerceCfnInteger(newSettings["MaxCapacity"] ?? 0);
+				if (minCapacity === void 0 || maxCapacity === void 0) {
+					warn(`Cannot apply auto-scaling diff on ${tableName} (${dimension}): MinCapacity / MaxCapacity must be integers CloudFormation accepts (an optional sign and decimal digits; no surrounding whitespace, hex, exponent or decimal point), got ${maskSecrets(String(newSettings["MinCapacity"]))} / ${maskSecrets(String(newSettings["MaxCapacity"]))}`);
 					return;
 				}
 				try {
@@ -20761,8 +20761,16 @@ var DynamoDBGlobalTableProvider = class {
 					PredefinedMetricSpecification: { PredefinedMetricType: metricType },
 					TargetValue: targetValue
 				};
-				if (tttCfg["ScaleInCooldown"] !== void 0) targetTrackingConfig["ScaleInCooldown"] = Number(tttCfg["ScaleInCooldown"]);
-				if (tttCfg["ScaleOutCooldown"] !== void 0) targetTrackingConfig["ScaleOutCooldown"] = Number(tttCfg["ScaleOutCooldown"]);
+				for (const cooldown of ["ScaleInCooldown", "ScaleOutCooldown"]) {
+					const raw = tttCfg[cooldown];
+					if (raw === void 0) continue;
+					const seconds = coerceCfnInteger(raw);
+					if (seconds === void 0) {
+						warn(`Auto-scaling policy on ${tableName} (${dimension}): TargetTrackingScalingPolicyConfiguration.${cooldown} is not an integer CloudFormation accepts (got ${JSON.stringify(maskDeep(raw, maskSecrets))?.slice(0, 80)}), so it is omitted and the service default applies.`);
+						continue;
+					}
+					targetTrackingConfig[cooldown] = seconds;
+				}
 				if (tttCfg["DisableScaleIn"] !== void 0) targetTrackingConfig["DisableScaleIn"] = Boolean(tttCfg["DisableScaleIn"]);
 				try {
 					await withRetry(() => asClient.send(new PutScalingPolicyCommand({
@@ -22145,13 +22153,13 @@ function warmThroughputDiagnostic(raw, coercion, indexName) {
 		return {
 			...scope,
 			...indexName !== void 0 && { indexName },
-			message: `WarmThroughput.${dropped} did not resolve to a number and was DROPPED; ${kept} is still sent. AWS types these as numbers, so a quoted "12000" is fine but an unresolved intrinsic or an object is not. The dropped member keeps its current AWS value until the template supplies a usable one.`
+			message: `WarmThroughput.${dropped} did not resolve to a number and was DROPPED; ${kept} is still sent. AWS types these as numbers, so a quoted "12000" is fine but an unresolved intrinsic or an object is not. The dropped member keeps its current AWS value until the template supplies a usable one. CloudFormation types this member as an Integer and accepts only an optional sign and decimal digits (no surrounding whitespace, hex, exponent or decimal point), so a spelling it would reject is treated the same way.`
 		};
 	}
 	return {
 		...scope,
 		...indexName !== void 0 && { indexName },
-		message: `WarmThroughput is declared but no member resolved to a number${dropped ? ` (${dropped})` : ""}, so the whole block is REFUSED and not sent. Forwarding it would fail as an opaque AWS validation error naming neither cdkd nor the property. Set WarmThroughput.ReadUnitsPerSecond / WriteUnitsPerSecond to numbers, or remove the block. Nothing else about the index is affected.`
+		message: `WarmThroughput is declared but no member resolved to a number${dropped ? ` (${dropped})` : ""}, so the whole block is REFUSED and not sent. Forwarding it would fail as an opaque AWS validation error naming neither cdkd nor the property. Set WarmThroughput.ReadUnitsPerSecond / WriteUnitsPerSecond to numbers, or remove the block. Nothing else about the index is affected. CloudFormation types this member as an Integer and accepts only an optional sign and decimal digits (no surrounding whitespace, hex, exponent or decimal point), so a spelling it would reject is treated the same way.`
 	};
 }
 /**
@@ -22165,9 +22173,10 @@ function warmThroughputDiagnostic(raw, coercion, indexName) {
 * the pre-fix code forwarded such a block VERBATIM. Three defects followed, and fixing any subset leaves a
 * live one, which is why this helper does all three at once:
 *
-*  1. **Coercion.** The verbatim forward was the ONE path that skipped
-*     {@link toFiniteNumber}, so a stringly-typed CFn `"5"` reached the SDK
-*     unnormalized while every derived value was a number.
+*  1. **Coercion.** The verbatim forward was the ONE path that skipped the
+*     numeric reader (`coerceCfnInteger` since issue #3135), so a
+*     stringly-typed CFn `"5"` reached the SDK unnormalized while every
+*     derived value was a number.
 *  2. **Per-member merge.** Whole-block replacement meant a PARTIAL explicit
 *     block SUPPRESSED valid derived siblings — an explicit
 *     `{MaxReadRequestUnits: 41}` discarded a perfectly good
@@ -22194,16 +22203,17 @@ function mergeExplicitThroughputBlock(explicit, derived, members, diagnostics, c
 	const out = {};
 	for (const member of members) {
 		if (explicit && explicit[member] !== void 0) {
-			const coerced = toFiniteNumber(explicit[member]);
+			const coerced = coerceCfnInteger(explicit[member]);
 			if (coerced !== void 0) {
 				out[member] = coerced;
 				continue;
 			}
+			const standIn = derived?.[member];
 			diagnostics?.push({
 				kind: "unresolved-member",
 				...context.indexName !== void 0 && { indexName: context.indexName },
 				member,
-				message: `${context.blockName}.${member} is present but did not resolve to a number (${JSON.stringify(maskDeep(explicit[member], maskSecrets))?.slice(0, 80)}), so it was ignored. This is usually an unresolved intrinsic; resolve it to a literal.`
+				message: `${context.blockName}.${member} is present but did not resolve to a number (${JSON.stringify(maskDeep(explicit[member], maskSecrets))?.slice(0, 80)}), so ` + (typeof standIn === "number" ? `it was ignored and ${standIn} was sent instead. ` : `it was ignored. `) + "This is usually an unresolved intrinsic; resolve it to a literal. CloudFormation types this member as an Integer and accepts only an optional sign and decimal digits (no surrounding whitespace, hex, exponent or decimal point), so a spelling it would reject is treated the same way."
 			});
 		}
 		const derivedValue = derived?.[member];
@@ -22227,12 +22237,12 @@ function mergeExplicitThroughputBlock(explicit, derived, members, diagnostics, c
 function reportUnresolvedRawMember(rawValue, diagnostics, context, maskSecrets = (text) => text) {
 	if (!diagnostics) return;
 	if (rawValue === void 0) return;
-	if (toFiniteNumber(rawValue) !== void 0) return;
+	if (coerceCfnInteger(rawValue) !== void 0) return;
 	diagnostics.push({
 		kind: "unresolved-member",
 		...context.indexName !== void 0 && { indexName: context.indexName },
 		member: context.member,
-		message: `${context.blockName}.${context.member} is declared but did not resolve to a number (${JSON.stringify(maskDeep(rawValue, maskSecrets))?.slice(0, 80)}), so no throughput value was sent for it and the live AWS setting was left unchanged. This is usually an unresolved intrinsic; resolve it to a literal to apply the limit, or remove the property entirely to clear it.`
+		message: `${context.blockName}.${context.member} is declared but did not resolve to a number (${JSON.stringify(maskDeep(rawValue, maskSecrets))?.slice(0, 80)}), so no throughput value was sent for it and the live AWS setting was left unchanged. This is usually an unresolved intrinsic; resolve it to a literal to apply the limit, or remove the property entirely to clear it. CloudFormation types this member as an Integer and accepts only an optional sign and decimal digits (no surrounding whitespace, hex, exponent or decimal point), so a spelling it would reject is treated the same way.`
 	});
 }
 /**
@@ -22320,7 +22330,7 @@ function reportUnresolvedProvisionedCapacity(rawSettings, side, source, outcome,
 		kind: "unresolved-member",
 		...context.indexName !== void 0 && { indexName: context.indexName },
 		member: blame.relPath ? blame.relPath.slice(blame.relPath.lastIndexOf(".") + 1) : context.blockName.slice(context.blockName.lastIndexOf(".") + 1),
-		message: `${path} is declared but did not resolve to a number (${JSON.stringify(maskDeep(blame.value, maskSecrets))?.slice(0, 80)}), ${consequence}. This is usually an unresolved intrinsic; resolve it to a literal to apply the capacity you declared.`
+		message: `${path} is declared but did not resolve to a number (${JSON.stringify(maskDeep(blame.value, maskSecrets))?.slice(0, 80)}), ${consequence}. This is usually an unresolved intrinsic; resolve it to a literal to apply the capacity you declared. CloudFormation types this member as an Integer and accepts only an optional sign and decimal digits (no surrounding whitespace, hex, exponent or decimal point), so a spelling it would reject is treated the same way.`
 	});
 }
 /**
@@ -22347,7 +22357,7 @@ function reportUnresolvedProvisionedCapacity(rawSettings, side, source, outcome,
 */
 function deriveWriteCapacityUnits(settings, source = "min") {
 	if (!settings) return void 0;
-	const literal = toFiniteNumber(settings["WriteCapacityUnits"]);
+	const literal = coerceCfnInteger(settings["WriteCapacityUnits"]);
 	if (literal !== void 0) return literal;
 	const autoScaling = asRecord$1(settings["WriteCapacityAutoScalingSettings"]);
 	if (!autoScaling) return void 0;
@@ -22363,7 +22373,7 @@ function deriveWriteCapacityUnits(settings, source = "min") {
 */
 function deriveReadCapacityUnits(settings, source = "min") {
 	if (!settings) return void 0;
-	const literal = toFiniteNumber(settings["ReadCapacityUnits"]);
+	const literal = coerceCfnInteger(settings["ReadCapacityUnits"]);
 	if (literal !== void 0) return literal;
 	const autoScaling = asRecord$1(settings["ReadCapacityAutoScalingSettings"]);
 	if (!autoScaling) return void 0;
@@ -22371,9 +22381,9 @@ function deriveReadCapacityUnits(settings, source = "min") {
 }
 /** Resolve a `*CapacityAutoScalingSettings` block to one number. */
 function pickAutoScalingCapacity(autoScaling, source) {
-	const min = toFiniteNumber(autoScaling["MinCapacity"]);
-	if (source === "min") return min ?? toFiniteNumber(autoScaling["SeedCapacity"]);
-	return toFiniteNumber(autoScaling["SeedCapacity"]) ?? min;
+	const min = coerceCfnInteger(autoScaling["MinCapacity"]);
+	if (source === "min") return min ?? coerceCfnInteger(autoScaling["SeedCapacity"]);
+	return coerceCfnInteger(autoScaling["SeedCapacity"]) ?? min;
 }
 /**
 * Translate the CFn `AWS::DynamoDB::GlobalTable` `GlobalSecondaryIndexes[]`
@@ -22470,7 +22480,7 @@ function toSdkGlobalSecondaryIndexes(properties, region, billingMode, source = "
 			const rawWrite = gsi["WriteProvisionedThroughputSettings"];
 			const derivedRead = deriveReadCapacityUnits(asRecord$1(rawLocalRead), source) ?? deriveReadCapacityUnits(asRecord$1(rawGsiRead), source);
 			const derivedWrite = deriveWriteCapacityUnits(asRecord$1(rawWrite), source);
-			const explicitCovers = (member) => explicitProvisioned !== void 0 && toFiniteNumber(explicitProvisioned[member]) !== void 0;
+			const explicitCovers = (member) => explicitProvisioned !== void 0 && coerceCfnInteger(explicitProvisioned[member]) !== void 0;
 			if (derivedRead === void 0 && !explicitCovers("ReadCapacityUnits")) {
 				const fromReplica = rawLocalRead !== void 0;
 				reportUnresolvedProvisionedCapacity(fromReplica ? rawLocalRead : rawGsiRead, "Read", source, { appliedUnits: DEFAULT_CAPACITY_UNITS }, diagnostics, {
@@ -22503,8 +22513,8 @@ function toSdkGlobalSecondaryIndexes(properties, region, billingMode, source = "
 				blockName: rawReadLocal !== void 0 ? "Replicas[local].GlobalSecondaryIndexes[].ReadOnDemandThroughputSettings" : "ReadOnDemandThroughputSettings",
 				member: "MaxReadRequestUnits"
 			}, maskSecrets);
-			const maxWrite = toFiniteNumber(rawWrite);
-			const maxRead = toFiniteNumber(rawReadLocal) ?? toFiniteNumber(rawReadGsi);
+			const maxWrite = coerceCfnInteger(rawWrite);
+			const maxRead = coerceCfnInteger(rawReadLocal) ?? coerceCfnInteger(rawReadGsi);
 			const merged = mergeExplicitThroughputBlock(explicitOnDemand, {
 				...maxRead !== void 0 && { MaxReadRequestUnits: maxRead },
 				...maxWrite !== void 0 && { MaxWriteRequestUnits: maxWrite }
@@ -22797,7 +22807,7 @@ function isUnresolvedIntrinsicBlock(value) {
 * The per-GSI reset needs to know "did the template DROP this member", and the
 * only faithful answer is whether the CFn key is THERE — not whether its value
 * coerced. `toSdkGlobalSecondaryIndexes` runs every value through
-* {@link toFiniteNumber}, which returns `undefined` for a present-but-
+* `coerceCfnInteger`, which returns `undefined` for a present-but-
 * unparseable value (an unresolved `{Ref: …}`, `''`, an object). Deciding
 * "dropped" from that collapsed view sent the `-1` reset for a member the
 * template was actively trying to SET, silently clearing the ceiling — the same
@@ -22914,8 +22924,8 @@ function collectUncomparableCapacityGsiNames(properties, region) {
 			continue;
 		}
 		const explicitProvisioned = asRecord$1(gsi["ProvisionedThroughput"]);
-		const derivedRead = toFiniteNumber(explicitProvisioned?.["ReadCapacityUnits"]) ?? deriveReadCapacityUnits(asRecord$1(readBlocks[0])) ?? deriveReadCapacityUnits(asRecord$1(readBlocks[1]));
-		const derivedWrite = toFiniteNumber(explicitProvisioned?.["WriteCapacityUnits"]) ?? deriveWriteCapacityUnits(asRecord$1(writeBlock));
+		const derivedRead = coerceCfnInteger(explicitProvisioned?.["ReadCapacityUnits"]) ?? deriveReadCapacityUnits(asRecord$1(readBlocks[0])) ?? deriveReadCapacityUnits(asRecord$1(readBlocks[1]));
+		const derivedWrite = coerceCfnInteger(explicitProvisioned?.["WriteCapacityUnits"]) ?? deriveWriteCapacityUnits(asRecord$1(writeBlock));
 		if (derivedRead === void 0 || derivedWrite === void 0) out.add(name);
 	}
 	return out;
@@ -23068,7 +23078,7 @@ function toSdkReplicaThroughputOverrides(cfn, billingMode, diagnostics, context,
 	if (billingMode === "PROVISIONED") {
 		const rawRead = cfn["ReadProvisionedThroughputSettings"];
 		const readCapacity = deriveReadCapacityUnits(asRecord$1(rawRead));
-		if (readCapacity === void 0 && toFiniteNumber(explicitProvisioned?.["ReadCapacityUnits"]) === void 0) reportUnresolvedProvisionedCapacity(rawRead, "Read", "min", { suppressed: "so no ProvisionedThroughputOverride was sent and the replica keeps the source table's read capacity" }, diagnostics, {
+		if (readCapacity === void 0 && coerceCfnInteger(explicitProvisioned?.["ReadCapacityUnits"]) === void 0) reportUnresolvedProvisionedCapacity(rawRead, "Read", "min", { suppressed: "so no ProvisionedThroughputOverride was sent and the replica keeps the source table's read capacity" }, diagnostics, {
 			...context,
 			blockName: "ReadProvisionedThroughputSettings"
 		}, maskSecrets);
@@ -23084,7 +23094,7 @@ function toSdkReplicaThroughputOverrides(cfn, billingMode, diagnostics, context,
 		blockName: "ReadOnDemandThroughputSettings",
 		member: "MaxReadRequestUnits"
 	}, maskSecrets);
-	const maxReadRequestUnits = toFiniteNumber(rawMaxRead);
+	const maxReadRequestUnits = coerceCfnInteger(rawMaxRead);
 	const merged = mergeExplicitThroughputBlock(explicitOnDemand, maxReadRequestUnits !== void 0 ? { MaxReadRequestUnits: maxReadRequestUnits } : void 0, ["MaxReadRequestUnits"], diagnostics, {
 		...context,
 		blockName: "OnDemandThroughputOverride"
@@ -23127,11 +23137,11 @@ function collectTableOnDemandCeilings(properties, region, diagnostics, maskSecre
 	return {
 		read: {
 			declared: rawRead !== void 0 || isUnresolvedIntrinsicBlock(readBlock),
-			value: toFiniteNumber(rawRead)
+			value: coerceCfnInteger(rawRead)
 		},
 		write: {
 			declared: rawWrite !== void 0 || isUnresolvedIntrinsicBlock(writeBlock),
-			value: toFiniteNumber(rawWrite)
+			value: coerceCfnInteger(rawWrite)
 		}
 	};
 }
@@ -26555,6 +26565,19 @@ const SG_INGRESS_IP_PROTOCOL_DEFAULT = "-1";
 /** The refusal path both the create guard and the canonicalizer report under. */
 const SG_INGRESS_IP_PROTOCOL_PATH = "AWS::EC2::SecurityGroupIngress IpProtocol";
 /**
+* Bounded eventual-consistency retry for the `DescribeSecurityGroups`
+* read-back (`readSecurityGroupVpcId`, issue #3097): an answer
+* `isNotFoundError` classifies as not-found is retried, everything else omits
+* the attribute at once. Five ATTEMPTS (four retries) a second apart cover the
+* propagation window EC2 documents for its read APIs;
+* `securityGroupReadbackDelays.sleep` is the unit-test seam (the pattern
+* `deleteTableRetryDelays` uses), and the fallback is the provider's own
+* `sleep`, so the class has one timer to fake.
+*/
+const SG_READBACK_NOT_FOUND_ATTEMPTS = 5;
+const SG_READBACK_RETRY_DELAY_MS = 1e3;
+const securityGroupReadbackDelays = {};
+/**
 * Page ceiling for {@link EC2Provider.lookupIngressRuleId}'s
 * `DescribeSecurityGroupRules` walk (issue #1761).
 *
@@ -27808,10 +27831,10 @@ var EC2Provider = class {
 			this.logger.debug(`Successfully created SecurityGroup ${logicalId}: ${groupId}`);
 			return {
 				physicalId: groupId,
-				attributes: {
+				attributes: definedAttributes({
 					GroupId: groupId,
-					VpcId: properties["VpcId"] ?? ""
-				}
+					VpcId: await this.readSecurityGroupVpcId(groupId)
+				})
 			};
 		} catch (error) {
 			const cause = error instanceof Error ? error : void 0;
@@ -27901,10 +27924,10 @@ var EC2Provider = class {
 			return {
 				physicalId,
 				wasReplaced: false,
-				attributes: {
+				attributes: definedAttributes({
 					GroupId: physicalId,
-					VpcId: properties["VpcId"] ?? ""
-				}
+					VpcId: await this.readSecurityGroupVpcId(physicalId)
+				})
 			};
 		} catch (error) {
 			const cause = error instanceof Error ? error : void 0;
@@ -27968,17 +27991,72 @@ var EC2Provider = class {
 			}
 		}));
 	}
-	async getSecurityGroupAttribute(physicalId, attributeName) {
-		if (attributeName === "GroupId") return physicalId;
-		try {
-			const sg = (await this.ec2Client.send(new DescribeSecurityGroupsCommand({ GroupIds: [physicalId] }))).SecurityGroups?.[0];
-			if (!sg) return void 0;
-			if (attributeName === "VpcId") return sg.VpcId;
-			return;
-		} catch {
+	/**
+	* The `VpcId` a security group's `attributes` map records, read back from
+	* `DescribeSecurityGroups` on the group id (issue #3097).
+	*
+	* The two `AWS::EC2::SecurityGroup` result maps used to copy the TEMPLATE's
+	* own `VpcId` property with a `?? ''` fallback — the last two sites issue
+	* #3077 left on that shape. A `CfnSecurityGroup` declared without `VpcId`
+	* lands in the account's default VPC, so the template has nothing to copy
+	* and the record held `''` where CloudFormation answers the default VPC's
+	* id. The read-back answers both shapes the same way: `CreateSecurityGroup`
+	* returns only the group id, and the describe reports `VpcId` for an
+	* explicit VPC and for the default one alike.
+	*
+	* Best-effort by design: the group is already created (or updated) and
+	* wired when this runs, so a failed or empty read must not fail the
+	* resource. It answers `undefined` then, which `definedAttributes` turns
+	* into an ABSENT key — never `''` — and the resolver's
+	* `AWS::EC2::SecurityGroup` `VpcId` arm re-reads it live on the next
+	* `Fn::GetAtt`. The error CLASS (and HTTP status when the SDK attached one)
+	* is what the debug line names at its head; AWS's own text follows it on the
+	* same debug line, since a denied describe quotes the caller's account, role
+	* and session (`.claude/rules/provider-resource-identity.md`).
+	*
+	* EC2's read API is eventually consistent: a `DescribeSecurityGroups` issued
+	* right after `CreateSecurityGroup` can answer `InvalidGroup.NotFound` for a
+	* group the write path already accepted tags and rules for (#3139 review).
+	* An answer `isNotFoundError` classifies as not-found (a substring
+	* predicate — on this API that is `InvalidGroup.NotFound`) is therefore
+	* retried a bounded number of times (`SG_READBACK_NOT_FOUND_ATTEMPTS`,
+	* `SG_READBACK_RETRY_DELAY_MS` apart) before the key is omitted; every
+	* other failure, and an EMPTY answer, omits at once. On the update path a
+	* group deleted out of band takes the same bounded wait and then omits —
+	* its own rule / tag calls MAY already have failed, but an update whose
+	* bags agree issues none, and the rollback replay / `drift --revert` reach
+	* `updateSecurityGroup` too, so this read can be the first call to touch
+	* it. `getSecurityGroupAttribute` (the orphan rewriter's live fetch) shares
+	* the wait. The sleep itself is inside the best-effort boundary: a
+	* rejecting sleep (only a test seam can reject) omits like a failed read.
+	*/
+	async readSecurityGroupVpcId(groupId) {
+		for (let attempt = 1;; attempt++) try {
+			const vpcId = (await this.ec2Client.send(new DescribeSecurityGroupsCommand({ GroupIds: [groupId] })))?.SecurityGroups?.[0]?.VpcId;
+			if (vpcId === void 0) this.logger.debug(`DescribeSecurityGroups reported no VpcId for SecurityGroup ${groupId}; omitting the attribute`);
+			return vpcId;
+		} catch (error) {
+			const name = error instanceof Error && error.name ? error.name : "Error";
+			const status = error?.$metadata?.httpStatusCode;
+			const errorClass = typeof status === "number" ? `${name}, HTTP ${status}` : name;
+			if (this.isNotFoundError(error) && attempt < 5) {
+				this.logger.debug(`DescribeSecurityGroups for SecurityGroup ${groupId} answered not-found (${errorClass}) on attempt ${attempt}/${5}; retrying in ${SG_READBACK_RETRY_DELAY_MS}ms (eventual consistency)`);
+				try {
+					await (securityGroupReadbackDelays.sleep ?? ((ms) => this.sleep(ms)))(SG_READBACK_RETRY_DELAY_MS);
+				} catch {
+					this.logger.debug(`DescribeSecurityGroups retry sleep for SecurityGroup ${groupId} rejected; omitting the VpcId attribute`);
+					return;
+				}
+				continue;
+			}
+			this.logger.debug(`DescribeSecurityGroups for SecurityGroup ${groupId} failed (${errorClass}); omitting the VpcId attribute: ${error instanceof Error ? error.message : String(error)}`);
 			return;
 		}
 	}
+	async getSecurityGroupAttribute(physicalId, attributeName) {
+		if (attributeName === "GroupId") return physicalId;
+		if (attributeName === "VpcId") return this.readSecurityGroupVpcId(physicalId);
+	}
 	/**
 	* @param onUnusableProtocol When supplied, a malformed `IpProtocol` WARNS and
 	*   defaults instead of throwing. Passed by `updateSecurityGroupIngress`,
@@ -29671,10 +29749,17 @@ var EC2Provider = class {
 					physicalId,
 					attributes: {}
 				} : null;
-				case "AWS::EC2::SecurityGroup": return (await this.ec2Client.send(new DescribeSecurityGroupsCommand({ GroupIds: [physicalId] }))).SecurityGroups?.[0] ? {
-					physicalId,
-					attributes: {}
-				} : null;
+				case "AWS::EC2::SecurityGroup": {
+					const group = (await this.ec2Client.send(new DescribeSecurityGroupsCommand({ GroupIds: [physicalId] }))).SecurityGroups?.[0];
+					if (!group) return null;
+					return {
+						physicalId,
+						attributes: definedAttributes({
+							GroupId: physicalId,
+							VpcId: group.VpcId
+						})
+					};
+				}
 				case "AWS::EC2::SecurityGroupIngress": {
 					if (!SG_RULE_ID_PATTERN$1.test(physicalId)) return null;
 					const rule = (await this.ec2Client.send(new DescribeSecurityGroupRulesCommand({ SecurityGroupRuleIds: [physicalId] }))).SecurityGroupRules?.[0];
@@ -63959,8 +64044,9 @@ const UNSUBSTITUTED_SUB_PLACEHOLDER = /\$\{[^}]*\}/;
 *
 * 1. `undefined` — the SAME signal the deploy side keys on. `resolve` returns it
 *    WITHOUT throwing for a constructible-but-unknown attribute
-*    (`AWS::DynamoDB::Table.StreamArn`, `AWS::IAM::Policy.PolicyId`,
-*    `AWS::EC2::SecurityGroup.VpcId`, ...). `JSON.stringify` drops an
+*    (`AWS::DynamoDB::Table.StreamArn`, `AWS::IAM::Policy.PolicyId`, ...;
+*    `AWS::EC2::SecurityGroup.VpcId` left this list in #3097 — it now reads
+*    the group live and REFUSES, which the catch below records). `JSON.stringify` drops an
 *    `undefined`-valued key, so state can never hold one and such an output
 *    would otherwise report a PERMANENT phantom `ADD` printing `new: undefined`.
 * 2. A symbol — `Ref: AWS::NoValue` resolves to a sentinel symbol, which
@@ -68661,6 +68747,87 @@ function createScrubCommand() {
 	return cmd;
 }
 
+//#endregion
+//#region src/utils/own-keys.ts
+/**
+* Own-key helpers for the bags that reach cdkd through `JSON.parse` — a
+* `state.json` record, a Cloud Control `Properties` document, a template — and
+* for the raw SDK readbacks compared against them.
+*
+* `JSON.parse` yields a key literally named `__proto__` as an ORDINARY own
+* data property, and every comparator / rebuild walk over such a bag has to
+* keep treating it as one. Two idioms silently do not:
+*
+* - **Rebuilding onto a `{}` literal.** `out[k] = v` with `k === '__proto__'`
+*   runs `Object.prototype`'s accessor, SETS the node's prototype and DROPS
+*   the key — on BOTH comparison sides when the walk is a canonicalizer, so a
+*   drift at that key is invisible (issue
+*   [#3121](https://github.com/go-to-k/cdkd/issues/3121)), and on the WRITE
+*   path the member vanishes from the payload (issue
+*   [#2899](https://github.com/go-to-k/cdkd/issues/2899)). Rebuild onto
+*   {@link nullPrototypeRecord} (no accessor there, so plain assignment
+*   defines an own key) or, onto an existing plain object, define the key
+*   with {@link defineOwnKey}.
+* - **`key in bag` membership.** `in` reads the prototype chain, so a key
+*   named `constructor` / `toString` answers `true` for every plain object
+*   and the recursion then walks `Object`'s function. {@link hasOwnKey} asks
+*   the bag alone; {@link ownValue} is the matching read.
+*
+* And ONE shape test every such walk needs FIRST: {@link hasPlainPrototype}.
+* A non-plain object (`Date`, `Uint8Array`, `Map`, a class instance) has no
+* own enumerable keys, so a key-walk over one FABRICATES `{}` (or an index
+* map) and any two of them compare equal. Such a value is returned by
+* IDENTITY and compared as itself.
+*
+* Extracted from `src/cli/commands/drift.ts` (issue #2899, swept by PR #3124)
+* so the analyzer-side canonicalizers (#3121) share ONE spelling rather than a
+* fourth copy. A LEAF module, deliberately, and it must stay one: a value
+* import from a module other suites `vi.mock` wholesale reds those suites
+* with a missing-export failure (which is why `secret-redaction.ts` keeps its
+* own `hasPlainPrototype` — several drift suites mock that module).
+*/
+/** Own-key membership: `in` reads the prototype chain, which a `JSON.parse`d bag never means. */
+function hasOwnKey(target, key) {
+	return Object.prototype.hasOwnProperty.call(target, key);
+}
+/** An own-key read: `undefined` for an inherited name (`__proto__`, `constructor`, ...). */
+function ownValue(target, key) {
+	return hasOwnKey(target, key) ? target[key] : void 0;
+}
+/** An ordinary (writable, enumerable, configurable) own data property — never the prototype. */
+function defineOwnKey(target, key, value) {
+	Object.defineProperty(target, key, {
+		value,
+		writable: true,
+		enumerable: true,
+		configurable: true
+	});
+}
+/**
+* Does this value carry an ORDINARY object prototype?
+*
+* `typeof v === 'object'` admits `Date` / `Map` / `Set` / `Uint8Array` / class
+* instances, whose own enumerable keys are `[]` — so a key-walk over one
+* reports "no contradiction" between two values that actually differ, and a
+* rebuild over one fabricates `{}`. A NULL prototype counts as plain: it is
+* what {@link nullPrototypeRecord} yields, and a walk must be able to re-walk
+* its own output.
+*/
+function hasPlainPrototype(value) {
+	const proto = Object.getPrototypeOf(value);
+	return proto === Object.prototype || proto === null;
+}
+/**
+* A fresh rebuild target with NO prototype, so `out['__proto__'] = v` defines
+* an own key instead of setting the prototype. `JSON.stringify`,
+* `Object.keys` / `entries` and `structuredClone` all read it like a plain
+* object; only `instanceof Object` and a direct `.hasOwnProperty()` method call
+* do not, and no consumer on the drift path uses either.
+*/
+function nullPrototypeRecord() {
+	return Object.create(null);
+}
+
 //#endregion
 //#region src/analyzer/drift-normalize.ts
 /**
@@ -68693,6 +68860,24 @@ function createScrubCommand() {
 * `properties`-fallback baseline (a resource deployed before observed-capture,
 * whose baseline is the user's TEMPLATE order). Sorting only the AWS read side
 * would manufacture drift on exactly that path.
+*
+* Every object arm below returns a NON-PLAIN object (a `Date` the raw SDK
+* readback carries, a `Uint8Array`) BY IDENTITY and rebuilds a plain one onto
+* a NULL-prototype record (issue
+* [#3121](https://github.com/go-to-k/cdkd/issues/3121), the analyzer-side
+* population of the class PR #3124 closed in `drift.ts`). A `{}` literal
+* rebuild had two consequences, both on the COMPARISON copies: an own
+* `__proto__` key (what `JSON.parse` yields from `state.json`) became the
+* rebuilt node's prototype and was dropped on BOTH sides, so a drift at that
+* key was invisible; and `Object.entries(new Date())` is `[]`, so a `Date`
+* member was flattened to `{}` before `calculateResourceDrift` could see it
+* (phantom drift against an ISO-string baseline, and `--accept` persisted the
+* `{}`). The identity return is what makes the second visible to the
+* comparator; the null-prototype target is what keeps the first an own key.
+* One layer LATER the same flattening survives in `secret-redaction.ts`'s
+* value walk, which `--accept` runs over a resource that RECORDS a secret
+* (issue #2427) -- so the ISO string reaches the baseline only where that
+* walk does not run.
 */
 function canonicalizeTagListsDeep(v) {
 	if (Array.isArray(v)) {
@@ -68706,7 +68891,8 @@ function canonicalizeTagListsDeep(v) {
 		return mapped;
 	}
 	if (v && typeof v === "object") {
-		const out = {};
+		if (!hasPlainPrototype(v)) return v;
+		const out = nullPrototypeRecord();
 		for (const [k, val] of Object.entries(v)) out[k] = canonicalizeTagListsDeep(val);
 		return out;
 	}
@@ -68721,7 +68907,8 @@ function canonicalizeIdArraysDeep(v) {
 		return mapped;
 	}
 	if (v && typeof v === "object") {
-		const out = {};
+		if (!hasPlainPrototype(v)) return v;
+		const out = nullPrototypeRecord();
 		for (const [k, val] of Object.entries(v)) out[k] = canonicalizeIdArraysDeep(val);
 		return out;
 	}
@@ -68878,7 +69065,8 @@ function walkUnordered(v, path, paths) {
 		return mapped;
 	}
 	if (v && typeof v === "object") {
-		const out = {};
+		if (!hasPlainPrototype(v)) return v;
+		const out = nullPrototypeRecord();
 		for (const [k, val] of Object.entries(v)) out[k] = walkUnordered(val, path === "" ? k : `${path}.${k}`, paths);
 		return out;
 	}
@@ -69021,14 +69209,16 @@ function isIgnoredPath(path, ignorePaths) {
 * common case of "no drift" allocates nothing.
 */
 function diffAt(path, stateValue, awsValue, out, ignorePaths, unionWalkObjects) {
-	if (deepEqual(stateValue, awsValue)) return;
+	const stateForm = jsonForm(stateValue);
+	const awsForm = jsonForm(awsValue);
+	if (deepEqual(stateForm, awsForm)) return;
 	if (typeof stateValue === "string" && stateValue.includes("{{resolve:")) return;
-	if (isPlainObject(stateValue) && isPlainObject(awsValue) && !Array.isArray(stateValue) && !Array.isArray(awsValue)) {
-		const keys = unionWalkObjects ? /* @__PURE__ */ new Set([...Object.keys(stateValue), ...Object.keys(awsValue)]) : Object.keys(stateValue);
+	if (isPlainObject(stateForm) && isPlainObject(awsForm) && !Array.isArray(stateForm) && !Array.isArray(awsForm)) {
+		const keys = unionWalkObjects ? /* @__PURE__ */ new Set([...Object.keys(stateForm), ...Object.keys(awsForm)]) : Object.keys(stateForm);
 		for (const key of keys) {
 			const childPath = `${path}.${key}`;
 			if (isIgnoredPath(childPath, ignorePaths)) continue;
-			diffAt(childPath, stateValue[key], awsValue[key], out, ignorePaths, unionWalkObjects);
+			diffAt(childPath, stateForm[key], awsForm[key], out, ignorePaths, unionWalkObjects);
 		}
 		return;
 	}
@@ -69039,11 +69229,39 @@ function diffAt(path, stateValue, awsValue, out, ignorePaths, unionWalkObjects)
 	});
 }
 /**
+* The form `JSON.stringify` would serialize a value as, for the ONE shape the
+* comparator's "JSON-roundtrip equality" contract did not cover: a NON-PLAIN
+* object carrying `toJSON` (a `Date`, which serializes as its ISO string; a
+* `Buffer`, whose prototype `toJSON` yields `{type, data}`). Every other value
+* is returned untouched. What the comparator then does with an untouched
+* non-plain object is what it does with a plain one -- it walks the OWN keys
+* (`deepEqual` below, and `diffAt`'s descend gate, test `typeof === 'object'`
+* and nothing about the prototype) -- so a `Uint8Array` compares by its
+* index keys (the persisted `{"0":1,"1":2}` equals the readback typed array,
+* the convergence this fold exists for) and a keyless `Map` / class instance
+* compares equal to `{}` and to any other keyless one. That last case is
+* PRE-EXISTING and is not what the canonicalizers' identity return protects:
+* they keep a non-plain node from being REBUILT as `{}`, and this fold keeps
+* the JSON-carrying ones from drifting forever against their persisted form;
+* neither adds a prototype guard here, because a bare `hasPlainPrototype`
+* gate would break the typed-array convergence (PR #3148 delta review).
+*/
+function jsonForm(value) {
+	if (value === null || typeof value !== "object" || hasPlainPrototype(value)) return value;
+	const toJSON = value.toJSON;
+	return typeof toJSON === "function" ? toJSON.call(value) : value;
+}
+/**
 * Structural equality used by the drift comparator. Identical to a
 * plain `JSON.stringify`-roundtrip equality except it tolerates
 * undefined-vs-missing-key gaps the same way (both serialize away).
+* `Date`s (and anything else non-plain with `toJSON`) are compared in their
+* JSON form via {@link jsonForm}, so the persisted ISO string of an accepted
+* readback equals the `Date` the next readback returns.
 */
 function deepEqual(a, b) {
+	a = jsonForm(a);
+	b = jsonForm(b);
 	if (a === b) return true;
 	if (a === null || b === null || a === void 0 || b === void 0) return a === b;
 	if (typeof a !== typeof b) return false;
@@ -69126,6 +69344,12 @@ function isPlainObject(value) {
 * and manufacturing a different phantom drift, so the pass is scoped to the
 * object shape — which is what `AWS::S3::BucketPolicy` and the other
 * `PolicyDocument`-typed properties carry in cdkd state.
+*
+* The two rewrite walks rebuild onto a NULL-prototype record and return a
+* non-plain object by identity, for the reason `drift-normalize.ts`'s header
+* gives (issue #3121): they run on the comparison copies of BOTH sides, so a
+* `{}` literal rebuild dropped an own `__proto__` key symmetrically and
+* flattened a `Date` to `{}` before the comparator saw it.
 */
 /**
 * An IAM unique id as it appears in a rendered policy. The prefix set is
@@ -69215,7 +69439,8 @@ function collectPrincipalForms(value) {
 function rewritePrincipalUniqueIds(value, arnByUniqueId) {
 	if (Array.isArray(value)) return value.map((el) => rewritePrincipalUniqueIds(el, arnByUniqueId));
 	if (!value || typeof value !== "object") return value;
-	const out = {};
+	if (!hasPlainPrototype(value)) return value;
+	const out = nullPrototypeRecord();
 	for (const [key, member] of Object.entries(value)) out[key] = key === "Principal" || key === "NotPrincipal" ? rewritePrincipalValue(member, arnByUniqueId) : rewritePrincipalUniqueIds(member, arnByUniqueId);
 	return out;
 }
@@ -69224,7 +69449,8 @@ function rewritePrincipalValue(value, arnByUniqueId) {
 	if (typeof value === "string") return swap(value);
 	if (Array.isArray(value)) return value.map(swap);
 	if (!value || typeof value !== "object") return value;
-	const out = {};
+	if (!hasPlainPrototype(value)) return value;
+	const out = nullPrototypeRecord();
 	for (const [key, member] of Object.entries(value)) {
 		if (key !== "AWS") {
 			out[key] = rewritePrincipalUniqueIds(member, arnByUniqueId);
@@ -69482,7 +69708,12 @@ const CC_API_FALLBACK_DENY_LIST = {
 *
 * Strips are shallow only — fields are removed if they appear at any
 * depth (recursive walk) but the values themselves are not modified.
-* Arrays are walked element-wise.
+* Arrays are walked element-wise. The rebuild target is a NULL-prototype
+* record and a non-plain object is returned by identity, for the reason
+* `drift-normalize.ts`'s header gives (issue #3121): the walk feeds the
+* comparison copy, so a `{}` literal rebuild dropped an own `__proto__` key
+* (which the `JSON.parse`d `Properties` document can carry) and flattened a
+* non-plain member to `{}`.
 */
 /**
 * Field names AWS attaches to nearly every resource. These are NOT user
@@ -69538,7 +69769,8 @@ function stripWalk(value) {
 	if (value === null || value === void 0) return value;
 	if (Array.isArray(value)) return value.map(stripWalk);
 	if (typeof value === "object") {
-		const out = {};
+		if (!hasPlainPrototype(value)) return value;
+		const out = nullPrototypeRecord();
 		for (const [key, child] of Object.entries(value)) {
 			if (ALWAYS_STRIPPED_FIELDS.has(key)) continue;
 			out[key] = stripWalk(child);
@@ -70949,10 +71181,10 @@ function buildReadCurrentStateContext(state, excludedLogicalId) {
 * below would then compare against the accepted one. `undefined` is the answer
 * "the bag has nothing here", which is what an absent segment means.
 *
-* Exported, like `setAtPath`, as a test seam only: a `__proto__` path cannot
-* reach either through the command today (the comparison chain's normalisers
-* drop the key on both sides — issue #3121), so the own-key rule is pinned on
-* the helpers directly.
+* Exported, like `setAtPath`, as a test seam: the own-key rule is pinned on
+* the helpers directly, and since issue #3121 (the comparison chain's
+* normalisers keep the key as an own key on both sides) a top-level
+* `__proto__` drift also reaches both through the command.
 */
 function getAtPath(source, path) {
 	if (path.length === 0) return source;
@@ -70991,23 +71223,6 @@ function setAtPath(target, path, value) {
 	}
 	defineOwnKey(cursor, segments[segments.length - 1], value);
 }
-/** Own-key membership: `in` reads the prototype chain, which a `JSON.parse`d bag never means. */
-function hasOwnKey(target, key) {
-	return Object.prototype.hasOwnProperty.call(target, key);
-}
-/** An own-key read: `undefined` for an inherited name (`__proto__`, `constructor`, ...). */
-function ownValue(target, key) {
-	return hasOwnKey(target, key) ? target[key] : void 0;
-}
-/** An ordinary (writable, enumerable, configurable) own data property — never the prototype. */
-function defineOwnKey(target, key, value) {
-	Object.defineProperty(target, key, {
-		value,
-		writable: true,
-		enumerable: true,
-		configurable: true
-	});
-}
 /**
 * `--accept`: state ← AWS.
 *
@@ -71365,22 +71580,6 @@ function isPlainRecord(value) {
 	return typeof value === "object" && value !== null && !Array.isArray(value);
 }
 /**
-* Does this value carry an ORDINARY object prototype?
-*
-* {@link isPlainRecord} admits `Date` / `Map` / `Set` / class instances, whose
-* own enumerable keys are `[]` — so a key-walk over one reports "no
-* contradiction" between two values that actually differ. The redaction walk's
-* `deepEqualJsonValue` carries the same guard for the same reason
-* (`secret-redaction.ts`, issue #2869): a `Date` anchor corroborates NOTHING.
-* Kept file-local rather than imported because `secret-redaction.js` is
-* `vi.mock`ed by several drift suites, and a value import from it reds them
-* with a missing-export failure.
-*/
-function hasPlainPrototype(value) {
-	const proto = Object.getPrototypeOf(value);
-	return proto === Object.prototype || proto === null;
-}
-/**
 * Merge the AWS-current value with the revert baseline, KEEPING every path the
 * baseline does not declare (issue
 * [#1626](https://github.com/go-to-k/cdkd/issues/1626) items 2 + 3).
@@ -80886,7 +81085,9 @@ var AttributeFetcher = class {
 			ok: false,
 			reason
 		};
-		const cached = this.orphans[orphanLogicalId].attributes?.[attribute];
+		const orphan = this.orphans[orphanLogicalId];
+		const stored = orphan.attributes?.[attribute];
+		const cached = isImpossibleEmptyStoredAttribute(orphan.resourceType, attribute, stored) ? void 0 : stored;
 		if (cached === void 0) {
 			this.logger.warn(`--force: state.attributes also lacks '${orphanLogicalId}.${attribute}'; leaving the original intrinsic in place.`);
 			return {
@@ -92457,4 +92658,4 @@ function buildProgram() {
 
 //#endregion
 export { buildProgram };
-//# sourceMappingURL=program-CoRRfEe_.js.map
+//# sourceMappingURL=program-D30EPjOn.js.map