@go-to-k/cdkd 0.278.11 → 0.278.13

package/dist/cli.js

@@ -1,7 +1,7 @@
 #!/usr/bin/env node
-import { $ as DagBuilder, A as red, At as resolveApp, B as isTerminationProtectionPropagationError, Bt as CFN_TEMPLATE_URL_LIMIT, C as isStatefulRecreateTargetSync, Ct as runDockerStreaming, D as cyan, Dt as synthesisStatusMessage, E as bold, Et as Synthesizer, F as ProviderRegistry, Ft as resolveStateBucketWithDefaultAndSource, G as normalizeAwsTagsToCfn, Gt as AssemblyReader, H as cfnRefValueFromPhysicalId, Ht as findLargeInlineResources, I as findActionableSilentDrops, It as resolveUseCdkBootstrapAssets, J as applyRoleArnIfSet, Jt as resolveBucketRegion, K as resolveExplicitPhysicalId, Kt as processStackMessages, L as CloudControlProvider, Lt as stateBucketExistenceConfirmed, M as IAMRoleProvider, Mt as resolveCaptureObservedState, N as collectInlinePolicyNamesManagedBySiblings, Nt as resolveSkipPrefix, O as gray, Ot as getDefaultStateBucketName, P as clearOnUpdateRemoval, Pt as resolveStateBucketWithDefault, Q as isRetryableTransientError, Qt as setAwsClients, R as slowCcOperationTimeoutMs, Rt as warnDeprecatedNoPrefixCliFlag, S as MULTI_REGION_RECREATE_BLOCKED_TYPES, St as runDockerForeground, T as formatResourceLine, Tt as getDockerImageBySourceHash, U as refStateLookupFromResource, Ut as uploadCfnTemplate, V as IntrinsicFunctionResolver, Vt as MIGRATE_TMP_PREFIX, W as WAFv2WebACLProvider, Wt as expectedOwnerParam, X as describeTypeWithThrottleRetry, Xt as getAwsClients, Y as DiffCalculator, Yt as AwsClients, Z as withRetry, Zt as resetAwsClients, _ as createPreDeleteFinalSnapshot, _t as validateAssetBucketName, a as DeploymentEventsStore, an as LocalMigrateError, at as AssetPublisher, b as unsupportedFinalSnapshotError, bn as normalizeAwsError, bt as formatDockerLoginError, c as replayFailedOperations, cn as MissingCdkCliError, ct as buildAssetRedirectMap, d as IMPLICIT_DELETE_DEPENDENCIES, dn as ProvisioningError, dt as rewriteTemplateAssetReferences, en as CdkdError, et as TemplateParser, f as computeImplicitDeleteEdges, fn as ResourceTimeoutError, ft as AssetModeResolver, g as ccRoutedFinalSnapshotError, gt as parseBootstrapMarker, h as buildFinalSnapshotIdentifier, hn as StackTerminationProtectionError, ht as getBootstrapMarkerKey, i as DeploymentEventsReader, in as LocalInvokeBuildError$1, it as shouldRetainResource, j as yellow, jt as resolveAutoAssetStorage, k as green, kt as getLegacyStateBucketName, l as replayRollback, ln as NestedStackChildDirectDestroyError, lt as createAssetRedirectResolver, m as PRE_DELETE_SNAPSHOT_TYPES, mn as StackHasActiveImportsError, mt as ensureAssetStorage, n as DEFAULT_RESOURCE_WARN_AFTER_MS, nt as S3StateBackend, o as planFailedOps, on as LocalStartServiceError, ot as stringifyValue, p as ATOMIC_FINAL_SNAPSHOT_TYPES, pn as ResourceUpdateNotSupportedError, pt as BOOTSTRAP_MARKER_PREFIX, q as assertRegionMatch, r as DeployEngine, rn as DeployCancelledError, rt as rebuildClientForBucketRegion, s as planRollback, st as WorkGraph, t as DEFAULT_RESOURCE_TIMEOUT_MS, tt as LockManager, u as withResourceDeadline, un as PartialFailureError, ut as loadPublishableAssetManifest, v as isFinalSnapshotError, vt as validateContainerRepoName, w as renderStatefulReason, wt as AssetManifestLoader, x as extractDeploymentEventError, xn as withErrorHandling, xt as getDockerCmd, y as refusesFinalSnapshot, yt as buildDockerImage, z as disableInstanceApiTermination, zt as CFN_TEMPLATE_BODY_LIMIT } from "./deploy-engine-DrlCNItN.js";
+import { $ as DagBuilder, A as red, At as resolveApp, B as isTerminationProtectionPropagationError, Bt as CFN_TEMPLATE_URL_LIMIT, C as isStatefulRecreateTargetSync, Ct as runDockerStreaming, D as cyan, Dt as synthesisStatusMessage, E as bold, Et as Synthesizer, F as ProviderRegistry, Ft as resolveStateBucketWithDefaultAndSource, G as normalizeAwsTagsToCfn, Gt as AssemblyReader, H as cfnRefValueFromPhysicalId, Ht as findLargeInlineResources, I as findActionableSilentDrops, It as resolveUseCdkBootstrapAssets, J as applyRoleArnIfSet, Jt as resolveBucketRegion, K as resolveExplicitPhysicalId, Kt as processStackMessages, L as CloudControlProvider, Lt as stateBucketExistenceConfirmed, M as IAMRoleProvider, Mt as resolveCaptureObservedState, N as collectInlinePolicyNamesManagedBySiblings, Nt as resolveSkipPrefix, O as gray, Ot as getDefaultStateBucketName, P as clearOnUpdateRemoval, Pt as resolveStateBucketWithDefault, Q as isRetryableTransientError, Qt as setAwsClients, R as slowCcOperationTimeoutMs, Rt as warnDeprecatedNoPrefixCliFlag, S as MULTI_REGION_RECREATE_BLOCKED_TYPES, St as runDockerForeground, T as formatResourceLine, Tt as getDockerImageBySourceHash, U as refStateLookupFromResource, Ut as uploadCfnTemplate, V as IntrinsicFunctionResolver, Vt as MIGRATE_TMP_PREFIX, W as WAFv2WebACLProvider, Wt as expectedOwnerParam, X as describeTypeWithThrottleRetry, Xt as getAwsClients, Y as DiffCalculator, Yt as AwsClients, Z as withRetry, Zt as resetAwsClients, _ as createPreDeleteFinalSnapshot, _t as validateAssetBucketName, a as DeploymentEventsStore, an as LocalMigrateError, at as AssetPublisher, b as unsupportedFinalSnapshotError, bn as normalizeAwsError, bt as formatDockerLoginError, c as replayFailedOperations, cn as MissingCdkCliError, ct as buildAssetRedirectMap, d as IMPLICIT_DELETE_DEPENDENCIES, dn as ProvisioningError, dt as rewriteTemplateAssetReferences, en as CdkdError, et as TemplateParser, f as computeImplicitDeleteEdges, fn as ResourceTimeoutError, ft as AssetModeResolver, g as ccRoutedFinalSnapshotError, gt as parseBootstrapMarker, h as buildFinalSnapshotIdentifier, hn as StackTerminationProtectionError, ht as getBootstrapMarkerKey, i as DeploymentEventsReader, in as LocalInvokeBuildError$1, it as shouldRetainResource, j as yellow, jt as resolveAutoAssetStorage, k as green, kt as getLegacyStateBucketName, l as replayRollback, ln as NestedStackChildDirectDestroyError, lt as createAssetRedirectResolver, m as PRE_DELETE_SNAPSHOT_TYPES, mn as StackHasActiveImportsError, mt as ensureAssetStorage, n as DEFAULT_RESOURCE_WARN_AFTER_MS, nt as S3StateBackend, o as planFailedOps, on as LocalStartServiceError, ot as stringifyValue, p as ATOMIC_FINAL_SNAPSHOT_TYPES, pn as ResourceUpdateNotSupportedError, pt as BOOTSTRAP_MARKER_PREFIX, q as assertRegionMatch, r as DeployEngine, rn as DeployCancelledError, rt as rebuildClientForBucketRegion, s as planRollback, st as WorkGraph, t as DEFAULT_RESOURCE_TIMEOUT_MS, tt as LockManager, u as withResourceDeadline, un as PartialFailureError, ut as loadPublishableAssetManifest, v as isFinalSnapshotError, vt as validateContainerRepoName, w as renderStatefulReason, wt as AssetManifestLoader, x as extractDeploymentEventError, xn as withErrorHandling, xt as getDockerCmd, y as refusesFinalSnapshot, yt as buildDockerImage, z as disableInstanceApiTermination, zt as CFN_TEMPLATE_BODY_LIMIT } from "./deploy-engine-BpbIYUuG.js";
 import { a as getLiveRenderer, c as PATTERN_B_RESOURCE_TYPES, d as generateResourceNameWithFallback, f as withSkipPrefix, i as runStackBuffered, n as getLogger, o as PATTERN_B_NAME_OPTIONS, p as withStackName, s as PATTERN_B_NAME_PROPERTIES, u as generateResourceName } from "./logger-BYMEE-BS.js";
-import { t as ASGProvider } from "./asg-provider-DW0eC_5t.js";
+import { t as ASGProvider } from "./asg-provider-QQOSO3LR.js";
 import { AsyncLocalStorage } from "node:async_hooks";
 import { createHash, randomBytes, randomUUID } from "node:crypto";
 import { CopyObjectCommand, CreateBucketCommand, DeleteBucketAnalyticsConfigurationCommand, DeleteBucketCommand, DeleteBucketCorsCommand, DeleteBucketIntelligentTieringConfigurationCommand, DeleteBucketInventoryConfigurationCommand, DeleteBucketLifecycleCommand, DeleteBucketMetricsConfigurationCommand, DeleteBucketPolicyCommand, DeleteBucketReplicationCommand, DeleteBucketTaggingCommand, DeleteBucketWebsiteCommand, DeleteObjectsCommand, GetBucketAccelerateConfigurationCommand, GetBucketCorsCommand, GetBucketEncryptionCommand, GetBucketLifecycleConfigurationCommand, GetBucketLocationCommand, GetBucketLoggingCommand, GetBucketNotificationConfigurationCommand, GetBucketPolicyCommand, GetBucketReplicationCommand, GetBucketTaggingCommand, GetBucketVersioningCommand, GetBucketWebsiteCommand, GetObjectCommand, GetObjectLockConfigurationCommand, GetPublicAccessBlockCommand, HeadBucketCommand, ListBucketAnalyticsConfigurationsCommand, ListBucketIntelligentTieringConfigurationsCommand, ListBucketInventoryConfigurationsCommand, ListBucketMetricsConfigurationsCommand, ListObjectVersionsCommand, ListObjectsV2Command, NoSuchBucket, PutBucketAccelerateConfigurationCommand, PutBucketAnalyticsConfigurationCommand, PutBucketCorsCommand, PutBucketEncryptionCommand, PutBucketIntelligentTieringConfigurationCommand, PutBucketInventoryConfigurationCommand, PutBucketLifecycleConfigurationCommand, PutBucketLoggingCommand, PutBucketMetricsConfigurationCommand, PutBucketNotificationConfigurationCommand, PutBucketOwnershipControlsCommand, PutBucketPolicyCommand, PutBucketReplicationCommand, PutBucketTaggingCommand, PutBucketVersioningCommand, PutBucketWebsiteCommand, PutObjectCommand, PutObjectLockConfigurationCommand, PutPublicAccessBlockCommand, S3Client, S3ServiceException } from "@aws-sdk/client-s3";
@@ -4813,6 +4813,52 @@ function isTruthyCfnBoolean(value) {
 //#endregion
 //#region src/provisioning/providers/s3-bucket-provider.ts
 /**
+* A plain (non-array) object. `typeof x === 'object'` alone accepts arrays and
+* `null`; a `Transition: []` or an unresolved intrinsic pushed through as a
+* single transition entry makes S3 answer `MalformedXML` for the WHOLE
+* lifecycle configuration, so the legacy singular readers screen with this.
+*/
+function isPlainObject$1(value) {
+	return typeof value === "object" && value !== null && !Array.isArray(value);
+}
+/**
+* Coerce a CFn numeric to a finite number. CloudFormation is stringly typed —
+* a hand-written or imported template (the audience the legacy lifecycle
+* branches exist for) can carry `"365"` where the schema says number.
+*/
+function coerceCfnNumber(value) {
+	if (typeof value !== "number" && typeof value !== "string") return void 0;
+	if (value === "") return void 0;
+	const n = Number(value);
+	return Number.isFinite(n) ? n : void 0;
+}
+/**
+* Merge a legacy SINGULAR action object into its modern plural array.
+*
+* S3 rejects two transitions with the same `StorageClass` and fails the whole
+* `PutBucketLifecycleConfiguration`, so a blind concatenation is unsafe. But
+* dropping the singular wholesale loses a legitimate template: a plural
+* `[{GLACIER, 30}]` alongside a singular `{DEEP_ARCHIVE, 90}` is two different
+* classes, which S3 accepts. So: keep both, let the PLURAL win on a
+* StorageClass collision, and say so rather than dropping in silence.
+*/
+function mergeLegacySingular(plural, singular, onCollision) {
+	const out = (Array.isArray(plural) ? plural : []).filter(isPlainObject$1);
+	if (!isPlainObject$1(singular)) return out;
+	const sc = singular["StorageClass"];
+	if (typeof sc === "string" && out.some((e) => e["StorageClass"] === sc)) {
+		onCollision(sc);
+		return out;
+	}
+	return [...out, singular];
+}
+/** Coerce a CFn boolean, which may arrive as the string `"true"` / `"false"`. */
+function coerceCfnBoolean(value) {
+	if (typeof value === "boolean") return value;
+	if (value === "true") return true;
+	if (value === "false") return false;
+}
+/**
 * SDK Provider for AWS::S3::Bucket
 *
 * Uses S3 SDK directly instead of CC API for synchronous bucket creation.
@@ -4982,7 +5028,7 @@ var S3BucketProvider = class {
 			const filter = rule["Filter"];
 			return {
 				prefix: filter?.["Prefix"] ?? rule["Prefix"],
-				tagFilters: filter?.["TagFilters"],
+				tagFilters: filter?.["TagFilters"] ?? rule["TagFilters"],
 				sizeGt: filter?.["ObjectSizeGreaterThan"] ?? rule["ObjectSizeGreaterThan"],
 				sizeLt: filter?.["ObjectSizeLessThan"] ?? rule["ObjectSizeLessThan"]
 			};
@@ -5010,24 +5056,37 @@ var S3BucketProvider = class {
 					ExpiredObjectDeleteMarker: exp["ExpiredObjectDeleteMarker"]
 				};
 			}
-			const nve = rule["NoncurrentVersionExpiration"];
+			if (coerceCfnBoolean(rule["ExpiredObjectDeleteMarker"]) === true) {
+				const exp = sdkRule.Expiration;
+				if (!(exp?.["Days"] !== void 0 || exp?.["Date"] !== void 0)) sdkRule.Expiration = { ExpiredObjectDeleteMarker: true };
+				else this.logger.warn(`Lifecycle rule '${rule["Id"] ?? "<unnamed>"}' on ${bucketName} sets ExpiredObjectDeleteMarker alongside an expiration Days/Date; S3 forbids combining them, so the delete-marker cleanup was not applied.`);
+			}
+			const nve = isPlainObject$1(rule["NoncurrentVersionExpiration"]) ? rule["NoncurrentVersionExpiration"] : void 0;
+			const legacyNveDays = rule["NoncurrentVersionExpirationInDays"];
 			if (nve) sdkRule.NoncurrentVersionExpiration = {
 				NoncurrentDays: nve["NoncurrentDays"],
 				NewerNoncurrentVersions: nve["NewerNoncurrentVersions"]
 			};
-			const nvts = rule["NoncurrentVersionTransitions"];
-			if (nvts && Array.isArray(nvts)) sdkRule.NoncurrentVersionTransitions = nvts.map((nvt) => ({
-				NoncurrentDays: nvt["NoncurrentDays"],
+			else if (coerceCfnNumber(legacyNveDays) !== void 0) sdkRule.NoncurrentVersionExpiration = { NoncurrentDays: coerceCfnNumber(legacyNveDays) };
+			const toSdkNvt = (nvt) => ({
+				NoncurrentDays: nvt["TransitionInDays"] ?? nvt["NoncurrentDays"],
 				StorageClass: nvt["StorageClass"],
 				NewerNoncurrentVersions: nvt["NewerNoncurrentVersions"]
-			}));
-			const transitions = rule["Transitions"];
-			if (transitions && Array.isArray(transitions)) sdkRule.Transitions = transitions.map((t) => ({
+			});
+			const nvts = rule["NoncurrentVersionTransitions"];
+			const singularNvt = rule["NoncurrentVersionTransition"];
+			const allNvts = mergeLegacySingular(nvts, singularNvt, (sc) => this.logger.warn(`Lifecycle rule '${rule["Id"] ?? "<unnamed>"}' on ${bucketName} declares both NoncurrentVersionTransitions and the legacy NoncurrentVersionTransition for storage class ${sc}; S3 rejects duplicates, so the legacy singular was ignored.`));
+			if (allNvts.length > 0) sdkRule.NoncurrentVersionTransitions = allNvts.map(toSdkNvt);
+			const toSdkTransition = (t) => ({
 				Days: t["TransitionInDays"] ?? t["Days"],
 				Date: t["TransitionDate"] ?? t["Date"] ? new Date(t["TransitionDate"] ?? t["Date"]) : void 0,
 				StorageClass: t["StorageClass"]
-			}));
-			const abort = rule["AbortIncompleteMultipartUpload"];
+			});
+			const transitions = rule["Transitions"];
+			const singularTransition = rule["Transition"];
+			const allTransitions = mergeLegacySingular(transitions, singularTransition, (sc) => this.logger.warn(`Lifecycle rule '${rule["Id"] ?? "<unnamed>"}' on ${bucketName} declares both Transitions and the legacy Transition for storage class ${sc}; S3 rejects duplicates, so the legacy singular was ignored.`));
+			if (allTransitions.length > 0) sdkRule.Transitions = allTransitions.map(toSdkTransition);
+			const abort = isPlainObject$1(rule["AbortIncompleteMultipartUpload"]) ? rule["AbortIncompleteMultipartUpload"] : void 0;
 			if (abort) sdkRule.AbortIncompleteMultipartUpload = { DaysAfterInitiation: abort["DaysAfterInitiation"] };
 			const { prefix, tagFilters, sizeGt, sizeLt } = gatherScope(rule);
 			const hasTags = tagFilters !== void 0 && tagFilters.length > 0;
@@ -5037,6 +5096,7 @@ var S3BucketProvider = class {
 				ObjectSizeGreaterThan: sizeGt,
 				ObjectSizeLessThan: sizeLt
 			} };
+			else if (hasTags && tagFilters.length > 1) sdkRule.Filter = { And: { Tags: tagFilters } };
 			else if (hasTags) sdkRule.Filter = { Tag: tagFilters[0] };
 			else if (sizeGt !== void 0) sdkRule.Filter = { ObjectSizeGreaterThan: sizeGt };
 			else if (sizeLt !== void 0) sdkRule.Filter = { ObjectSizeLessThan: sizeLt };
@@ -5872,7 +5932,7 @@ var S3BucketProvider = class {
 				}
 				if (r.NoncurrentVersionTransitions && r.NoncurrentVersionTransitions.length > 0) out["NoncurrentVersionTransitions"] = r.NoncurrentVersionTransitions.map((nvt) => {
 					const item = {};
-					if (nvt.NoncurrentDays !== void 0) item["NoncurrentDays"] = nvt.NoncurrentDays;
+					if (nvt.NoncurrentDays !== void 0) item["TransitionInDays"] = nvt.NoncurrentDays;
 					if (nvt.StorageClass !== void 0) item["StorageClass"] = nvt.StorageClass;
 					if (nvt.NewerNoncurrentVersions !== void 0) item["NewerNoncurrentVersions"] = nvt.NewerNoncurrentVersions;
 					return item;
@@ -11948,10 +12008,15 @@ var DynamoDBTableProvider = class {
 *  - `update()` covers every mutable surface — Tags, DeletionProtection,
 *    TableClass, SSE, StreamSpec, OnDemand throughput, BillingMode flip,
 *    Replica add / remove / modify, GSI add / remove / modify, TTL toggle.
-*  - The serialization is load-bearing: AWS's `UpdateTable` accepts only
-*    ONE of `{BillingMode, ReplicaUpdates, GlobalSecondaryIndexUpdates}`
-*    per call, so each category is its own SDK round-trip with a wait-for
-*    -ACTIVE in between. Immutable property changes (TableName, KeySchema,
+*  - The serialization is load-bearing: AWS's `UpdateTable` does not accept
+*    `ReplicaUpdates` alongside `BillingMode` / `GlobalSecondaryIndexUpdates`,
+*    so each category is its own SDK round-trip with a wait-for-ACTIVE in
+*    between. `BillingMode` and `GlobalSecondaryIndexUpdates` DO combine, and
+*    only in the `PAY_PER_REQUEST -> PROVISIONED` flip, where AWS REQUIRES
+*    per-GSI `ProvisionedThroughput` in the SAME call as `BillingMode` ("you
+*    must specify read and write capacity unit values for the table and for
+*    each global secondary index") — so that path deliberately sends both
+*    together (Issue #1387). Immutable property changes (TableName, KeySchema,
 *    AttributeDefinitions removal, LocalSecondaryIndexes) throw
 *    `ProvisioningError` naming the offending field — the deploy engine's
 *    diff classification should catch these as REPLACEMENT before ever
@@ -12146,7 +12211,13 @@ var DynamoDBGlobalTableProvider = class {
 				StreamViewType: "NEW_AND_OLD_IMAGES"
 			};
 		}
-		if (properties["GlobalSecondaryIndexes"]) createParams.GlobalSecondaryIndexes = properties["GlobalSecondaryIndexes"];
+		let sdkIndexes;
+		try {
+			sdkIndexes = toSdkGlobalSecondaryIndexes(properties, currentRegion, billingMode);
+		} catch (error) {
+			throw new ProvisioningError(error instanceof Error ? error.message : String(error), resourceType, logicalId, void 0, error instanceof Error ? error : void 0);
+		}
+		if (sdkIndexes.length > 0) createParams.GlobalSecondaryIndexes = sdkIndexes;
 		if (properties["LocalSecondaryIndexes"]) createParams.LocalSecondaryIndexes = properties["LocalSecondaryIndexes"];
 		if (properties["SSESpecification"]) {
 			const sse = properties["SSESpecification"];
@@ -12237,11 +12308,26 @@ var DynamoDBGlobalTableProvider = class {
 	* `DescribeTable` until the replica's `ReplicaStatus` flips to ACTIVE.
 	* Capped at 10 minutes per replica (AWS Replica provisioning typically
 	* takes 1–5 min).
+	*
+	* DELIBERATELY UNMAPPED replica sub-keys (Issue #1387 — recorded rather
+	* than silently dropped; `CreateReplicationGroupMemberAction` simply has
+	* no member for them, so they need their own follow-up API calls):
+	*  - `ReplicaStreamSpecification.ResourcePolicy` — the DynamoDB Streams
+	*    resource policy is set by `PutResourcePolicy` against the replica's
+	*    STREAM ARN, not by any `UpdateTable` field.
+	*  - `ResourcePolicy` — the table-level resource policy, likewise a
+	*    separate `PutResourcePolicy` call.
+	*  - `GlobalSecondaryIndexes[].ContributorInsightsSpecification` — a
+	*    per-index `UpdateContributorInsights` call.
+	* `Replicas` is declared in `handledProperties` at the TOP level, which
+	* is the granularity cdkd's pre-flight property-coverage check works at;
+	* these nested keys are tracked as a known gap, not a supported surface.
 	*/
 	async addReplica(tableName, replica, region, logicalId) {
 		const create = { RegionName: region };
 		if (replica["KMSMasterKeyId"]) create.KMSMasterKeyId = replica["KMSMasterKeyId"];
-		if (replica["GlobalSecondaryIndexes"]) create.GlobalSecondaryIndexes = replica["GlobalSecondaryIndexes"];
+		const replicaIndexes = toSdkReplicaGlobalSecondaryIndexes(replica["GlobalSecondaryIndexes"]);
+		if (replicaIndexes) create.GlobalSecondaryIndexes = replicaIndexes;
 		if (replica["TableClassOverride"]) create.TableClassOverride = replica["TableClassOverride"];
 		const replicaUpdates = [{ Create: create }];
 		await this.dynamoDBClient.send(new UpdateTableCommand({
@@ -12253,10 +12339,14 @@ var DynamoDBGlobalTableProvider = class {
 	/**
 	* Update a DynamoDB Global Table in place.
 	*
-	* AWS-side state-machine constraint: `UpdateTable` accepts only ONE of
-	* `{BillingMode, ReplicaUpdates, GlobalSecondaryIndexUpdates}` per call,
+	* AWS-side state-machine constraint: `UpdateTable` does not accept
+	* `ReplicaUpdates` alongside `BillingMode` / `GlobalSecondaryIndexUpdates`,
 	* so each category must serialize into its own SDK round-trip with a
-	* `waitForTableActiveAfterUpdate` between every step. Order:
+	* `waitForTableActiveAfterUpdate` between every step. `BillingMode` and
+	* `GlobalSecondaryIndexUpdates` DO combine, and only in step 4's
+	* `PAY_PER_REQUEST -> PROVISIONED` flip, which AWS requires to carry
+	* per-GSI `ProvisionedThroughput` in the same call (Issue #1387).
+	* Order:
 	*   1. Wait for current ACTIVE (defensive).
 	*   2. Tags diff (TagResource / UntagResource — no wait needed).
 	*   3. Non-conflicting flat fields (DeletionProtectionEnabled / TableClass
@@ -12335,12 +12425,41 @@ var DynamoDBGlobalTableProvider = class {
 			}
 			const oldBilling = previousProperties["BillingMode"] ?? "PAY_PER_REQUEST";
 			const newBilling = properties["BillingMode"] ?? "PAY_PER_REQUEST";
+			const gsiHandledByBillingFlip = /* @__PURE__ */ new Set();
 			if (oldBilling !== newBilling) {
 				const billingUpdate = {
 					TableName: physicalId,
 					BillingMode: newBilling
 				};
-				if (newBilling === "PROVISIONED") billingUpdate.ProvisionedThroughput = derivePerCallProvisionedThroughput(properties, currentRegion);
+				if (newBilling === "PROVISIONED") {
+					billingUpdate.ProvisionedThroughput = derivePerCallProvisionedThroughput(properties, currentRegion);
+					const provisionedIndexes = toSdkGlobalSecondaryIndexes(properties, currentRegion, newBilling);
+					const previousCfnIndexes = previousProperties["GlobalSecondaryIndexes"];
+					const existingIndexNames = new Set((Array.isArray(previousCfnIndexes) ? previousCfnIndexes : []).map((entry) => entry?.["IndexName"]).filter((name) => typeof name === "string"));
+					const previousByIndexName = /* @__PURE__ */ new Map();
+					for (const gsi of toSdkGlobalSecondaryIndexes(previousProperties, currentRegion, newBilling)) if (gsi.IndexName) previousByIndexName.set(gsi.IndexName, gsi);
+					const byIndexName = new Map(previousByIndexName);
+					const survivingIndexNames = /* @__PURE__ */ new Set();
+					for (const gsi of provisionedIndexes) {
+						if (!gsi.IndexName) continue;
+						survivingIndexNames.add(gsi.IndexName);
+						byIndexName.set(gsi.IndexName, gsi);
+					}
+					const indexUpdates = [];
+					for (const indexName of existingIndexNames) {
+						const gsi = byIndexName.get(indexName);
+						if (!gsi?.ProvisionedThroughput) continue;
+						const previousWarm = previousByIndexName.get(indexName)?.WarmThroughput;
+						const warmChanged = gsi.WarmThroughput !== void 0 && !deepEqual$1(gsi.WarmThroughput, previousWarm);
+						indexUpdates.push({ Update: {
+							IndexName: indexName,
+							ProvisionedThroughput: gsi.ProvisionedThroughput,
+							...warmChanged && { WarmThroughput: gsi.WarmThroughput }
+						} });
+						if (survivingIndexNames.has(indexName)) gsiHandledByBillingFlip.add(indexName);
+					}
+					if (indexUpdates.length > 0) billingUpdate.GlobalSecondaryIndexUpdates = indexUpdates;
+				}
 				await this.dynamoDBClient.send(new UpdateTableCommand(billingUpdate));
 				await this.waitForTableActiveAfterUpdate(physicalId, logicalId);
 			}
@@ -12391,7 +12510,8 @@ var DynamoDBGlobalTableProvider = class {
 				}
 				const updateAction = { RegionName: region };
 				if (replica["KMSMasterKeyId"] !== void 0) updateAction.KMSMasterKeyId = replica["KMSMasterKeyId"];
-				if (replica["GlobalSecondaryIndexes"]) updateAction.GlobalSecondaryIndexes = replica["GlobalSecondaryIndexes"];
+				const replicaIndexes = toSdkReplicaGlobalSecondaryIndexes(replica["GlobalSecondaryIndexes"]);
+				if (replicaIndexes) updateAction.GlobalSecondaryIndexes = replicaIndexes;
 				if (replica["TableClassOverride"]) updateAction.TableClassOverride = replica["TableClassOverride"];
 				if (!(updateAction.KMSMasterKeyId !== void 0 || updateAction.GlobalSecondaryIndexes !== void 0 || updateAction.TableClassOverride !== void 0)) {
 					this.logger.debug(`Cross-region replica ${region} of ${physicalId}: only Tags-style changes detected; UpdateReplica skipped (AWS rejects empty Update actions). Tags propagation handled above via per-region client.`);
@@ -12403,7 +12523,10 @@ var DynamoDBGlobalTableProvider = class {
 				}));
 				await this.waitForReplicaActive(physicalId, region, logicalId);
 			}
-			const gsiDiff = diffGlobalSecondaryIndexes(previousProperties["GlobalSecondaryIndexes"] ?? [], properties["GlobalSecondaryIndexes"] ?? []);
+			const previousSdkIndexes = toSdkGlobalSecondaryIndexes(previousProperties, currentRegion, oldBilling);
+			const gsiDiff = diffGlobalSecondaryIndexes(previousSdkIndexes, toSdkGlobalSecondaryIndexes(properties, currentRegion, newBilling));
+			const previousSdkByName = /* @__PURE__ */ new Map();
+			for (const prev of previousSdkIndexes) if (prev.IndexName) previousSdkByName.set(prev.IndexName, prev);
 			for (const gsi of gsiDiff.removed) {
 				if (!gsi.IndexName) continue;
 				const gsiUpdate = { Delete: { IndexName: gsi.IndexName } };
@@ -12420,7 +12543,8 @@ var DynamoDBGlobalTableProvider = class {
 					KeySchema: gsi.KeySchema,
 					Projection: gsi.Projection,
 					...gsi.ProvisionedThroughput && { ProvisionedThroughput: gsi.ProvisionedThroughput },
-					...gsi.OnDemandThroughput && { OnDemandThroughput: gsi.OnDemandThroughput }
+					...gsi.OnDemandThroughput && { OnDemandThroughput: gsi.OnDemandThroughput },
+					...gsi.WarmThroughput && { WarmThroughput: gsi.WarmThroughput }
 				} };
 				await this.dynamoDBClient.send(new UpdateTableCommand({
 					TableName: physicalId,
@@ -12431,11 +12555,18 @@ var DynamoDBGlobalTableProvider = class {
 			}
 			for (const gsi of gsiDiff.modified) {
 				if (!gsi.IndexName) continue;
-				const gsiUpdate = { Update: {
-					IndexName: gsi.IndexName,
-					...gsi.ProvisionedThroughput && { ProvisionedThroughput: gsi.ProvisionedThroughput },
-					...gsi.OnDemandThroughput && { OnDemandThroughput: gsi.OnDemandThroughput }
-				} };
+				if (gsiHandledByBillingFlip.has(gsi.IndexName)) continue;
+				const billingFlipped = oldBilling !== newBilling;
+				const update = { IndexName: gsi.IndexName };
+				if (gsi.OnDemandThroughput) update.OnDemandThroughput = gsi.OnDemandThroughput;
+				if (!billingFlipped && gsi.ProvisionedThroughput) update.ProvisionedThroughput = gsi.ProvisionedThroughput;
+				const previousSdk = previousSdkByName.get(gsi.IndexName);
+				if (gsi.WarmThroughput !== void 0 && !deepEqual$1(gsi.WarmThroughput, previousSdk?.WarmThroughput)) update.WarmThroughput = gsi.WarmThroughput;
+				if (!update.ProvisionedThroughput && !update.OnDemandThroughput && !update.WarmThroughput) {
+					if (!billingFlipped) this.logger.warn(`GSI '${gsi.IndexName}' on ${physicalId} changed in a way DynamoDB's UpdateTable cannot express (KeySchema / Projection are immutable on an existing index). Recreate the index under a new name to apply the change.`);
+					continue;
+				}
+				const gsiUpdate = { Update: update };
 				await this.dynamoDBClient.send(new UpdateTableCommand({
 					TableName: physicalId,
 					GlobalSecondaryIndexUpdates: [gsiUpdate]
@@ -13200,11 +13331,16 @@ var DynamoDBGlobalTableProvider = class {
 *
 * Source of truth (CFn `AWS::DynamoDB::GlobalTable` shape):
 *  - WriteCapacityUnits → `properties.WriteProvisionedThroughputSettings`
-*    (top-level on the table). Literal `WriteCapacityUnits` wins over
-*    auto-scaling `MinCapacity`; both default to 5 if absent.
+*    (top-level on the table). That block's ONLY member is
+*    `WriteCapacityAutoScalingSettings` — write capacity on a GlobalTable is
+*    always auto-scaled, so there is no literal `WriteCapacityUnits` to
+*    prefer. `CreateTable` needs one concrete number, so the auto-scaling
+*    block's `SeedCapacity` (documented as the value used until the scaling
+*    policies exist) is taken before `MinCapacity`; 5 if the block is absent.
 *  - ReadCapacityUnits → `Replicas[?Region==<region>].ReadProvisionedThroughputSettings`
-*    (per-replica, the deploy region's setting). Same literal-vs-auto-
-*    scaling-vs-default-5 precedence.
+*    (per-replica, the deploy region's setting). That block DOES carry a
+*    literal `ReadCapacityUnits`, which is taken before its auto-scaling
+*    `SeedCapacity` / `MinCapacity`; 5 if absent.
 */
 /**
 * Extract the local replica's `DeletionProtectionEnabled` from a CFn
@@ -13227,16 +13363,190 @@ function extractLocalDeletionProtection(props, region) {
 	return typeof topLevel === "boolean" ? topLevel : void 0;
 }
 function derivePerCallProvisionedThroughput(properties, region) {
-	const wps = properties["WriteProvisionedThroughputSettings"];
-	const writeAutoScaling = wps?.["WriteCapacityAutoScalingSettings"];
-	const writeCapacity = Number(wps?.["WriteCapacityUnits"] ?? writeAutoScaling?.["MinCapacity"] ?? 5);
-	const localReadSettings = (properties["Replicas"] ?? []).find((r) => r["Region"] === region)?.["ReadProvisionedThroughputSettings"];
-	const readAutoScaling = localReadSettings?.["ReadCapacityAutoScalingSettings"];
 	return {
-		ReadCapacityUnits: Number(localReadSettings?.["ReadCapacityUnits"] ?? readAutoScaling?.["MinCapacity"] ?? 5),
-		WriteCapacityUnits: writeCapacity
+		ReadCapacityUnits: deriveReadCapacityUnits(asRecord((properties["Replicas"] ?? []).find((r) => r["Region"] === region)?.["ReadProvisionedThroughputSettings"])) ?? DEFAULT_CAPACITY_UNITS,
+		WriteCapacityUnits: deriveWriteCapacityUnits(asRecord(properties["WriteProvisionedThroughputSettings"])) ?? DEFAULT_CAPACITY_UNITS
 	};
 }
+/**
+* Capacity units applied when a PROVISIONED template carries no usable
+* capacity value at all. Matches the pre-existing table-level default.
+*/
+const DEFAULT_CAPACITY_UNITS = 5;
+/** Narrow an unknown CFn sub-object to a record (or `undefined`). */
+function asRecord(value) {
+	return value !== null && typeof value === "object" && !Array.isArray(value) ? value : void 0;
+}
+/** Coerce a CFn numeric (CFn is stringly-typed) to a finite number. */
+function toFiniteNumber(value) {
+	if (value === void 0 || value === null || value === "") return void 0;
+	const n = Number(value);
+	return Number.isFinite(n) ? n : void 0;
+}
+/**
+* Derive a single WRITE capacity number from a CFn
+* `WriteProvisionedThroughputSettings` block.
+*
+* The `AWS::DynamoDB::GlobalTable` registry schema (verified 2026-08-09 via
+* `aws cloudformation describe-type`) declares this block with exactly ONE
+* member — `WriteCapacityAutoScalingSettings` — i.e. write capacity on a
+* GlobalTable is ALWAYS auto-scaled; there is no literal `WriteCapacityUnits`
+* (that is why CDK 2.244's `TableV2` rejects `Capacity.fixed()` for write).
+* `CreateTable` / `UpdateTable` still require a concrete starting number, so
+* we take `SeedCapacity` ("the initial provisioned capacity units") when the
+* template supplies it, else `MinCapacity`.
+*
+* A literal `WriteCapacityUnits` is still honored first: the CFn schema
+* forbids it, but hand-authored / imported templates and cdkd state written
+* before this helper existed can carry it, and honoring it is strictly more
+* faithful than ignoring it.
+*/
+function deriveWriteCapacityUnits(settings) {
+	if (!settings) return void 0;
+	const literal = toFiniteNumber(settings["WriteCapacityUnits"]);
+	if (literal !== void 0) return literal;
+	const autoScaling = asRecord(settings["WriteCapacityAutoScalingSettings"]);
+	if (!autoScaling) return void 0;
+	return toFiniteNumber(autoScaling["SeedCapacity"]) ?? toFiniteNumber(autoScaling["MinCapacity"]);
+}
+/**
+* Derive a single READ capacity number from a CFn
+* `ReadProvisionedThroughputSettings` block (both the per-replica shape,
+* which carries `ReadCapacityUnits` + `ReadCapacityAutoScalingSettings`, and
+* the GSI/table-level `GlobalReadProvisionedThroughputSettings` shape, which
+* carries only `ReadCapacityUnits`). Same Seed-before-Min precedence as the
+* write side.
+*/
+function deriveReadCapacityUnits(settings) {
+	if (!settings) return void 0;
+	const literal = toFiniteNumber(settings["ReadCapacityUnits"]);
+	if (literal !== void 0) return literal;
+	const autoScaling = asRecord(settings["ReadCapacityAutoScalingSettings"]);
+	if (!autoScaling) return void 0;
+	return toFiniteNumber(autoScaling["SeedCapacity"]) ?? toFiniteNumber(autoScaling["MinCapacity"]);
+}
+/**
+* Translate the CFn `AWS::DynamoDB::GlobalTable` `GlobalSecondaryIndexes[]`
+* blob into the SDK's `GlobalSecondaryIndex[]` shape (Issue #1387).
+*
+* The two schemas model per-GSI throughput COMPLETELY differently, and the
+* AWS SDK v3 serializer silently drops unknown members — so the pre-fix raw
+* cast meant a PROVISIONED GlobalTable with a GSI failed `CreateTable`
+* outright (AWS requires `ProvisionedThroughput` on every GSI), and every
+* `TableV2` per-GSI on-demand limit vanished without a trace.
+*
+* Verified mapping (CFn registry schema `AWS::DynamoDB::GlobalTable` +
+* `@aws-sdk/client-dynamodb` `models_0.d.ts`, both read 2026-08-09; the CFn
+* side additionally confirmed against a real `cdk synth` of `TableV2` with a
+* GSI under both billing modes):
+*
+* | CFn                                                                    | SDK                                     |
+* | ---------------------------------------------------------------------- | --------------------------------------- |
+* | `GSI.WriteProvisionedThroughputSettings.WriteCapacityAutoScalingSettings` | `ProvisionedThroughput.WriteCapacityUnits` |
+* | `Replicas[local].GlobalSecondaryIndexes[].ReadProvisionedThroughputSettings.ReadCapacityUnits` | `ProvisionedThroughput.ReadCapacityUnits` |
+* | `GSI.WriteOnDemandThroughputSettings.MaxWriteRequestUnits`             | `OnDemandThroughput.MaxWriteRequestUnits` |
+* | `Replicas[local].GlobalSecondaryIndexes[].ReadOnDemandThroughputSettings.MaxReadRequestUnits` | `OnDemandThroughput.MaxReadRequestUnits` |
+* | `GSI.WarmThroughput`                                                   | `WarmThroughput` (same spelling)        |
+*
+* READ capacity really does live on the REPLICA's GSI entry, not on the
+* top-level GSI — CDK's `globalSecondaryIndexes[].readCapacity` synthesizes
+* to `Replicas[?Region==<deploy region>].GlobalSecondaryIndexes[].
+* ReadProvisionedThroughputSettings`. `CreateTable` only ever provisions the
+* LOCAL replica, so the local entry is the right source. The GSI-level
+* `ReadProvisionedThroughputSettings` / `ReadOnDemandThroughputSettings`
+* (which the schema also permits) are honored as a fallback for
+* hand-authored templates.
+*
+* Already-SDK-shaped `ProvisionedThroughput` / `OnDemandThroughput` members
+* win over the derivation: the CFn schema forbids them, but cdkd state
+* written before this fix (and hand-authored templates) can carry them, and
+* silently re-deriving over an explicit value would be a regression.
+*/
+function toSdkGlobalSecondaryIndexes(properties, region, billingMode) {
+	const rawIndexes = properties["GlobalSecondaryIndexes"];
+	if (rawIndexes !== void 0 && !Array.isArray(rawIndexes)) throw new Error(`AWS::DynamoDB::GlobalTable GlobalSecondaryIndexes must be an array, got ${typeof rawIndexes} (${JSON.stringify(rawIndexes)?.slice(0, 200)}). An unresolved intrinsic here would otherwise deploy a table with no indexes.`);
+	const cfnIndexes = rawIndexes ?? [];
+	if (cfnIndexes.length === 0) return [];
+	const replicas = properties["Replicas"] ?? [];
+	const localReplicaIndexes = (Array.isArray(replicas) ? replicas.find((r) => asRecord(r)?.["Region"] === region) : void 0)?.["GlobalSecondaryIndexes"] ?? [];
+	const localByName = /* @__PURE__ */ new Map();
+	if (Array.isArray(localReplicaIndexes)) for (const entry of localReplicaIndexes) {
+		const record = asRecord(entry);
+		const name = record?.["IndexName"];
+		if (record && typeof name === "string") localByName.set(name, record);
+	}
+	const result = [];
+	for (const entry of cfnIndexes) {
+		const gsi = asRecord(entry);
+		if (!gsi) {
+			result.push(entry);
+			continue;
+		}
+		const indexName = gsi["IndexName"];
+		const localEntry = typeof indexName === "string" ? localByName.get(indexName) : void 0;
+		const sdk = {
+			IndexName: indexName,
+			KeySchema: gsi["KeySchema"],
+			Projection: gsi["Projection"]
+		};
+		if (gsi["WarmThroughput"] !== void 0) sdk.WarmThroughput = gsi["WarmThroughput"];
+		const explicitProvisioned = asRecord(gsi["ProvisionedThroughput"]);
+		const explicitOnDemand = asRecord(gsi["OnDemandThroughput"]);
+		if (explicitProvisioned) sdk.ProvisionedThroughput = explicitProvisioned;
+		else if (billingMode === "PROVISIONED") sdk.ProvisionedThroughput = {
+			ReadCapacityUnits: deriveReadCapacityUnits(asRecord(localEntry?.["ReadProvisionedThroughputSettings"])) ?? deriveReadCapacityUnits(asRecord(gsi["ReadProvisionedThroughputSettings"])) ?? DEFAULT_CAPACITY_UNITS,
+			WriteCapacityUnits: deriveWriteCapacityUnits(asRecord(gsi["WriteProvisionedThroughputSettings"])) ?? DEFAULT_CAPACITY_UNITS
+		};
+		if (explicitOnDemand) sdk.OnDemandThroughput = explicitOnDemand;
+		else if (billingMode !== "PROVISIONED") {
+			const maxWrite = toFiniteNumber(asRecord(gsi["WriteOnDemandThroughputSettings"])?.["MaxWriteRequestUnits"]);
+			const maxRead = toFiniteNumber(asRecord(localEntry?.["ReadOnDemandThroughputSettings"])?.["MaxReadRequestUnits"]) ?? toFiniteNumber(asRecord(gsi["ReadOnDemandThroughputSettings"])?.["MaxReadRequestUnits"]);
+			if (maxWrite !== void 0 || maxRead !== void 0) sdk.OnDemandThroughput = {
+				...maxRead !== void 0 && { MaxReadRequestUnits: maxRead },
+				...maxWrite !== void 0 && { MaxWriteRequestUnits: maxWrite }
+			};
+		}
+		result.push(sdk);
+	}
+	return result;
+}
+/**
+* Translate a CFn `Replicas[].GlobalSecondaryIndexes[]` blob (the
+* `ReplicaGlobalSecondaryIndexSpecification` shape) into the SDK's
+* `ReplicaGlobalSecondaryIndex[]` used by `CreateReplicationGroupMemberAction`
+* / `UpdateReplicationGroupMemberAction` (Issue #1387).
+*
+* Verified mapping:
+*
+* | CFn                                                        | SDK                                            |
+* | ---------------------------------------------------------- | ---------------------------------------------- |
+* | `ReadProvisionedThroughputSettings.ReadCapacityUnits`      | `ProvisionedThroughputOverride.ReadCapacityUnits` |
+* | `ReadOnDemandThroughputSettings.MaxReadRequestUnits`       | `OnDemandThroughputOverride.MaxReadRequestUnits`  |
+*
+* DELIBERATELY UNMAPPED: `ContributorInsightsSpecification`. The replica-GSI
+* SDK shape has no member for it — per-index contributor insights are toggled
+* by a separate `UpdateContributorInsights(TableName, IndexName)` call, which
+* this provider does not issue for any index (it only reads the TABLE-level
+* status back in `readCurrentState`). Recorded here rather than silently
+* dropped; tracked with the other GlobalTable nested-key gaps.
+*/
+function toSdkReplicaGlobalSecondaryIndexes(replicaIndexes) {
+	if (!Array.isArray(replicaIndexes) || replicaIndexes.length === 0) return void 0;
+	return replicaIndexes.map((entry) => {
+		const cfn = asRecord(entry);
+		if (!cfn) return entry;
+		const sdk = { IndexName: cfn["IndexName"] };
+		const explicitProvisioned = asRecord(cfn["ProvisionedThroughputOverride"]);
+		const explicitOnDemand = asRecord(cfn["OnDemandThroughputOverride"]);
+		const readCapacity = deriveReadCapacityUnits(asRecord(cfn["ReadProvisionedThroughputSettings"]));
+		const maxReadRequestUnits = toFiniteNumber(asRecord(cfn["ReadOnDemandThroughputSettings"])?.["MaxReadRequestUnits"]);
+		if (explicitProvisioned) sdk.ProvisionedThroughputOverride = explicitProvisioned;
+		else if (readCapacity !== void 0) sdk.ProvisionedThroughputOverride = { ReadCapacityUnits: readCapacity };
+		if (explicitOnDemand) sdk.OnDemandThroughputOverride = explicitOnDemand;
+		else if (maxReadRequestUnits !== void 0) sdk.OnDemandThroughputOverride = { MaxReadRequestUnits: maxReadRequestUnits };
+		return sdk;
+	});
+}
 function diffReplicas(oldReplicas, newReplicas) {
 	const oldByRegion = /* @__PURE__ */ new Map();
 	const newByRegion = /* @__PURE__ */ new Map();
@@ -64596,7 +64906,7 @@ function createMigrateCommand() {
 */
 function buildProgram() {
 	const program = new Command();
-	program.name("cdkd").description("CDK Direct - Deploy AWS CDK apps directly via SDK/Cloud Control API").version("0.278.11");
+	program.name("cdkd").description("CDK Direct - Deploy AWS CDK apps directly via SDK/Cloud Control API").version("0.278.13");
 	program.hook("preAction", (_thisCommand, actionCommand) => {
 		const { profile } = actionCommand.optsWithGlobals();
 		if (profile !== void 0) process.env["AWS_PROFILE"] = profile;