@go-to-k/cdkd 0.278.18 → 0.278.20

package/dist/cli.js

@@ -1,7 +1,7 @@
 #!/usr/bin/env node
-import { $ as DagBuilder, A as red, At as resolveApp, B as isTerminationProtectionPropagationError, Bt as CFN_TEMPLATE_URL_LIMIT, C as isStatefulRecreateTargetSync, Ct as runDockerStreaming, D as cyan, Dt as synthesisStatusMessage, E as bold, Et as Synthesizer, F as ProviderRegistry, Ft as resolveStateBucketWithDefaultAndSource, G as normalizeAwsTagsToCfn, Gt as AssemblyReader, H as cfnRefValueFromPhysicalId, Ht as findLargeInlineResources, I as findActionableSilentDrops, It as resolveUseCdkBootstrapAssets, J as applyRoleArnIfSet, Jt as resolveBucketRegion, K as resolveExplicitPhysicalId, Kt as processStackMessages, L as CloudControlProvider, Lt as stateBucketExistenceConfirmed, M as IAMRoleProvider, Mt as resolveCaptureObservedState, N as collectInlinePolicyNamesManagedBySiblings, Nt as resolveSkipPrefix, O as gray, Ot as getDefaultStateBucketName, P as clearOnUpdateRemoval, Pt as resolveStateBucketWithDefault, Q as isRetryableTransientError, Qt as setAwsClients, R as slowCcOperationTimeoutMs, Rt as warnDeprecatedNoPrefixCliFlag, S as MULTI_REGION_RECREATE_BLOCKED_TYPES, St as runDockerForeground, T as formatResourceLine, Tt as getDockerImageBySourceHash, U as refStateLookupFromResource, Ut as uploadCfnTemplate, V as IntrinsicFunctionResolver, Vt as MIGRATE_TMP_PREFIX, W as WAFv2WebACLProvider, Wt as expectedOwnerParam, X as describeTypeWithThrottleRetry, Xt as getAwsClients, Y as DiffCalculator, Yt as AwsClients, Z as withRetry, Zt as resetAwsClients, _ as createPreDeleteFinalSnapshot, _t as validateAssetBucketName, a as DeploymentEventsStore, an as LocalMigrateError, at as AssetPublisher, b as unsupportedFinalSnapshotError, bn as normalizeAwsError, bt as formatDockerLoginError, c as replayFailedOperations, cn as MissingCdkCliError, ct as buildAssetRedirectMap, d as IMPLICIT_DELETE_DEPENDENCIES, dn as ProvisioningError, dt as rewriteTemplateAssetReferences, en as CdkdError, et as TemplateParser, f as computeImplicitDeleteEdges, fn as ResourceTimeoutError, ft as AssetModeResolver, g as ccRoutedFinalSnapshotError, gt as parseBootstrapMarker, h as buildFinalSnapshotIdentifier, hn as StackTerminationProtectionError, ht as getBootstrapMarkerKey, i as DeploymentEventsReader, in as LocalInvokeBuildError$1, it as shouldRetainResource, j as yellow, jt as resolveAutoAssetStorage, k as green, kt as getLegacyStateBucketName, l as replayRollback, ln as NestedStackChildDirectDestroyError, lt as createAssetRedirectResolver, m as PRE_DELETE_SNAPSHOT_TYPES, mn as StackHasActiveImportsError, mt as ensureAssetStorage, n as DEFAULT_RESOURCE_WARN_AFTER_MS, nt as S3StateBackend, o as planFailedOps, on as LocalStartServiceError, ot as stringifyValue, p as ATOMIC_FINAL_SNAPSHOT_TYPES, pn as ResourceUpdateNotSupportedError, pt as BOOTSTRAP_MARKER_PREFIX, q as assertRegionMatch, r as DeployEngine, rn as DeployCancelledError, rt as rebuildClientForBucketRegion, s as planRollback, st as WorkGraph, t as DEFAULT_RESOURCE_TIMEOUT_MS, tt as LockManager, u as withResourceDeadline, un as PartialFailureError, ut as loadPublishableAssetManifest, v as isFinalSnapshotError, vt as validateContainerRepoName, w as renderStatefulReason, wt as AssetManifestLoader, x as extractDeploymentEventError, xn as withErrorHandling, xt as getDockerCmd, y as refusesFinalSnapshot, yt as buildDockerImage, z as disableInstanceApiTermination, zt as CFN_TEMPLATE_BODY_LIMIT } from "./deploy-engine-D9TPJSZY.js";
+import { $ as isThrottlingError, $t as setAwsClients, A as red, At as getLegacyStateBucketName, B as isTerminationProtectionPropagationError, Bt as CFN_TEMPLATE_BODY_LIMIT, C as isStatefulRecreateTargetSync, Ct as runDockerForeground, D as cyan, Dt as Synthesizer, E as bold, Et as getDockerImageBySourceHash, F as ProviderRegistry, Ft as resolveStateBucketWithDefault, G as normalizeAwsTagsToCfn, Gt as expectedOwnerParam, H as cfnRefValueFromPhysicalId, Ht as MIGRATE_TMP_PREFIX, I as findActionableSilentDrops, It as resolveStateBucketWithDefaultAndSource, J as applyRoleArnIfSet, K as resolveExplicitPhysicalId, Kt as AssemblyReader, L as CloudControlProvider, Lt as resolveUseCdkBootstrapAssets, M as IAMRoleProvider, Mt as resolveAutoAssetStorage, N as collectInlinePolicyNamesManagedBySiblings, Nt as resolveCaptureObservedState, O as gray, Ot as synthesisStatusMessage, P as clearOnUpdateRemoval, Pt as resolveSkipPrefix, Q as isRetryableTransientError, Qt as resetAwsClients, R as slowCcOperationTimeoutMs, Rt as stateBucketExistenceConfirmed, S as MULTI_REGION_RECREATE_BLOCKED_TYPES, Sn as withErrorHandling, St as getDockerCmd, T as formatResourceLine, Tt as AssetManifestLoader, U as refStateLookupFromResource, Ut as findLargeInlineResources, V as IntrinsicFunctionResolver, Vt as CFN_TEMPLATE_URL_LIMIT, W as WAFv2WebACLProvider, Wt as uploadCfnTemplate, X as describeTypeWithThrottleRetry, Xt as AwsClients, Y as DiffCalculator, Yt as resolveBucketRegion, Z as withRetry, Zt as getAwsClients, _ as createPreDeleteFinalSnapshot, _t as parseBootstrapMarker, a as DeploymentEventsStore, an as LocalInvokeBuildError$1, at as shouldRetainResource, b as unsupportedFinalSnapshotError, bt as buildDockerImage, c as replayFailedOperations, ct as WorkGraph, d as IMPLICIT_DELETE_DEPENDENCIES, dn as PartialFailureError, dt as loadPublishableAssetManifest, et as DagBuilder, f as computeImplicitDeleteEdges, fn as ProvisioningError, ft as rewriteTemplateAssetReferences, g as ccRoutedFinalSnapshotError, gn as StackTerminationProtectionError, gt as getBootstrapMarkerKey, h as buildFinalSnapshotIdentifier, hn as StackHasActiveImportsError, ht as ensureAssetStorage, i as DeploymentEventsReader, in as DeployCancelledError, it as rebuildClientForBucketRegion, j as yellow, jt as resolveApp, k as green, kt as getDefaultStateBucketName, l as replayRollback, ln as MissingCdkCliError, lt as buildAssetRedirectMap, m as PRE_DELETE_SNAPSHOT_TYPES, mn as ResourceUpdateNotSupportedError, mt as BOOTSTRAP_MARKER_PREFIX, n as DEFAULT_RESOURCE_WARN_AFTER_MS, nt as LockManager, o as planFailedOps, on as LocalMigrateError, ot as AssetPublisher, p as ATOMIC_FINAL_SNAPSHOT_TYPES, pn as ResourceTimeoutError, pt as AssetModeResolver, q as assertRegionMatch, qt as processStackMessages, r as DeployEngine, rt as S3StateBackend, s as planRollback, sn as LocalStartServiceError, st as stringifyValue, t as DEFAULT_RESOURCE_TIMEOUT_MS, tn as CdkdError, tt as TemplateParser, u as withResourceDeadline, un as NestedStackChildDirectDestroyError, ut as createAssetRedirectResolver, v as isFinalSnapshotError, vt as validateAssetBucketName, w as renderStatefulReason, wt as runDockerStreaming, x as extractDeploymentEventError, xn as normalizeAwsError, xt as formatDockerLoginError, y as refusesFinalSnapshot, yt as validateContainerRepoName, z as disableInstanceApiTermination, zt as warnDeprecatedNoPrefixCliFlag } from "./deploy-engine-Bv3IEbrU.js";
 import { a as getLiveRenderer, c as PATTERN_B_RESOURCE_TYPES, d as generateResourceNameWithFallback, f as withSkipPrefix, i as runStackBuffered, n as getLogger, o as PATTERN_B_NAME_OPTIONS, p as withStackName, s as PATTERN_B_NAME_PROPERTIES, u as generateResourceName } from "./logger-BYMEE-BS.js";
-import { t as ASGProvider } from "./asg-provider-DHs3PmZU.js";
+import { t as ASGProvider } from "./asg-provider-OB2CvUwn.js";
 import { AsyncLocalStorage } from "node:async_hooks";
 import { createHash, randomBytes, randomUUID } from "node:crypto";
 import { CopyObjectCommand, CreateBucketCommand, DeleteBucketAnalyticsConfigurationCommand, DeleteBucketCommand, DeleteBucketCorsCommand, DeleteBucketIntelligentTieringConfigurationCommand, DeleteBucketInventoryConfigurationCommand, DeleteBucketLifecycleCommand, DeleteBucketMetricsConfigurationCommand, DeleteBucketPolicyCommand, DeleteBucketReplicationCommand, DeleteBucketTaggingCommand, DeleteBucketWebsiteCommand, DeleteObjectsCommand, GetBucketAccelerateConfigurationCommand, GetBucketCorsCommand, GetBucketEncryptionCommand, GetBucketLifecycleConfigurationCommand, GetBucketLocationCommand, GetBucketLoggingCommand, GetBucketNotificationConfigurationCommand, GetBucketPolicyCommand, GetBucketReplicationCommand, GetBucketTaggingCommand, GetBucketVersioningCommand, GetBucketWebsiteCommand, GetObjectCommand, GetObjectLockConfigurationCommand, GetPublicAccessBlockCommand, HeadBucketCommand, ListBucketAnalyticsConfigurationsCommand, ListBucketIntelligentTieringConfigurationsCommand, ListBucketInventoryConfigurationsCommand, ListBucketMetricsConfigurationsCommand, ListObjectVersionsCommand, ListObjectsV2Command, NoSuchBucket, PutBucketAccelerateConfigurationCommand, PutBucketAnalyticsConfigurationCommand, PutBucketCorsCommand, PutBucketEncryptionCommand, PutBucketIntelligentTieringConfigurationCommand, PutBucketInventoryConfigurationCommand, PutBucketLifecycleConfigurationCommand, PutBucketLoggingCommand, PutBucketMetricsConfigurationCommand, PutBucketNotificationConfigurationCommand, PutBucketOwnershipControlsCommand, PutBucketPolicyCommand, PutBucketReplicationCommand, PutBucketTaggingCommand, PutBucketVersioningCommand, PutBucketWebsiteCommand, PutObjectCommand, PutObjectLockConfigurationCommand, PutPublicAccessBlockCommand, S3Client, S3ServiceException } from "@aws-sdk/client-s3";
@@ -12269,6 +12269,11 @@ var DynamoDBGlobalTableProvider = class {
 					}
 				}));
 			}
+			if (billingMode === "PROVISIONED") try {
+				await this.reconcileAutoScalingTargets(tableName, [], collectAutoScalingTargets(properties, currentRegion), currentRegion);
+			} catch (autoScalingErr) {
+				this.logger.warn(`Auto-scaling registration failed for ${tableName}: ${autoScalingErr instanceof Error ? autoScalingErr.message : String(autoScalingErr)}. The table was created successfully; re-run the deploy to register the scaling targets.`);
+			}
 			this.logger.debug(`Successfully created DynamoDB GlobalTable ${logicalId}: ${tableName}`);
 			return {
 				physicalId: tableName,
@@ -12442,12 +12447,12 @@ var DynamoDBGlobalTableProvider = class {
 					BillingMode: newBilling
 				};
 				if (newBilling === "PROVISIONED") {
-					billingUpdate.ProvisionedThroughput = derivePerCallProvisionedThroughput(properties, currentRegion);
-					const provisionedIndexes = toSdkGlobalSecondaryIndexes(properties, currentRegion, newBilling);
+					billingUpdate.ProvisionedThroughput = derivePerCallProvisionedThroughput(properties, currentRegion, "seed");
+					const provisionedIndexes = toSdkGlobalSecondaryIndexes(properties, currentRegion, newBilling, "seed");
 					const previousCfnIndexes = previousProperties["GlobalSecondaryIndexes"];
 					const existingIndexNames = new Set((Array.isArray(previousCfnIndexes) ? previousCfnIndexes : []).map((entry) => entry?.["IndexName"]).filter((name) => typeof name === "string"));
 					const previousByIndexName = /* @__PURE__ */ new Map();
-					for (const gsi of toSdkGlobalSecondaryIndexes(previousProperties, currentRegion, newBilling)) if (gsi.IndexName) previousByIndexName.set(gsi.IndexName, gsi);
+					for (const gsi of toSdkGlobalSecondaryIndexes(previousProperties, currentRegion, newBilling, "seed")) if (gsi.IndexName) previousByIndexName.set(gsi.IndexName, gsi);
 					const byIndexName = new Map(previousByIndexName);
 					const survivingIndexNames = /* @__PURE__ */ new Set();
 					for (const gsi of provisionedIndexes) {
@@ -12476,7 +12481,14 @@ var DynamoDBGlobalTableProvider = class {
 			const writeAutoScalingOld = (previousProperties["WriteProvisionedThroughputSettings"] ?? {})["WriteCapacityAutoScalingSettings"];
 			const writeAutoScalingNew = (properties["WriteProvisionedThroughputSettings"] ?? {})["WriteCapacityAutoScalingSettings"];
 			const effectiveNewAutoScaling = oldBilling === "PROVISIONED" && newBilling === "PAY_PER_REQUEST" ? void 0 : writeAutoScalingNew;
-			if ((newBilling === "PROVISIONED" || oldBilling === "PROVISIONED") && !deepEqual$1(writeAutoScalingOld, effectiveNewAutoScaling)) await this.applyAutoScalingDiff(physicalId, "dynamodb:table:WriteCapacityUnits", writeAutoScalingOld, effectiveNewAutoScaling);
+			const autoScalingApplied = /* @__PURE__ */ new Set();
+			if ((newBilling === "PROVISIONED" || oldBilling === "PROVISIONED") && !deepEqual$1(writeAutoScalingOld, effectiveNewAutoScaling)) {
+				await this.applyAutoScalingDiff(physicalId, "dynamodb:table:WriteCapacityUnits", writeAutoScalingOld, effectiveNewAutoScaling);
+				autoScalingApplied.add(autoScalingTargetKey({
+					dimension: "dynamodb:table:WriteCapacityUnits",
+					region: currentRegion
+				}));
+			}
 			const replicaDiff = diffReplicas(previousProperties["Replicas"] ?? [], properties["Replicas"] ?? []);
 			for (const replica of replicaDiff.removed) {
 				const region = replica["Region"];
@@ -12485,6 +12497,10 @@ var DynamoDBGlobalTableProvider = class {
 				if (removedReadAutoScaling) {
 					const regionalAutoScalingClient = this.getRegionalAutoScalingClient(region);
 					await this.applyAutoScalingDiff(physicalId, "dynamodb:table:ReadCapacityUnits", removedReadAutoScaling, void 0, regionalAutoScalingClient);
+					autoScalingApplied.add(autoScalingTargetKey({
+						dimension: "dynamodb:table:ReadCapacityUnits",
+						region
+					}));
 				}
 				await this.dynamoDBClient.send(new UpdateTableCommand({
 					TableName: physicalId,
@@ -12502,6 +12518,10 @@ var DynamoDBGlobalTableProvider = class {
 				if (newBilling === "PROVISIONED" && newReadAutoScaling) {
 					const regionalAutoScalingClient = this.getRegionalAutoScalingClient(region);
 					await this.applyAutoScalingDiff(physicalId, "dynamodb:table:ReadCapacityUnits", void 0, newReadAutoScaling, regionalAutoScalingClient);
+					autoScalingApplied.add(autoScalingTargetKey({
+						dimension: "dynamodb:table:ReadCapacityUnits",
+						region
+					}));
 				}
 			}
 			for (const replica of replicaDiff.modified) {
@@ -12517,6 +12537,10 @@ var DynamoDBGlobalTableProvider = class {
 				if ((newBilling === "PROVISIONED" || oldBilling === "PROVISIONED") && !deepEqual$1(oldReadAutoScaling, effectiveNewReadAutoScaling)) {
 					const regionalAutoScalingClient = this.getRegionalAutoScalingClient(region);
 					await this.applyAutoScalingDiff(physicalId, "dynamodb:table:ReadCapacityUnits", oldReadAutoScaling, effectiveNewReadAutoScaling, regionalAutoScalingClient);
+					autoScalingApplied.add(autoScalingTargetKey({
+						dimension: "dynamodb:table:ReadCapacityUnits",
+						region
+					}));
 				}
 				const updateAction = { RegionName: region };
 				if (replica["KMSMasterKeyId"] !== void 0) updateAction.KMSMasterKeyId = replica["KMSMasterKeyId"];
@@ -12535,6 +12559,7 @@ var DynamoDBGlobalTableProvider = class {
 			}
 			const previousSdkIndexes = toSdkGlobalSecondaryIndexes(previousProperties, currentRegion, oldBilling);
 			const gsiDiff = diffGlobalSecondaryIndexes(previousSdkIndexes, toSdkGlobalSecondaryIndexes(properties, currentRegion, newBilling));
+			const rawOnDemandDeclarations = collectRawOnDemandDeclarations(properties, currentRegion);
 			const previousSdkByName = /* @__PURE__ */ new Map();
 			for (const prev of previousSdkIndexes) if (prev.IndexName) previousSdkByName.set(prev.IndexName, prev);
 			for (const gsi of gsiDiff.removed) {
@@ -12564,22 +12589,27 @@ var DynamoDBGlobalTableProvider = class {
 				await this.waitForTableActiveAfterUpdate(physicalId, logicalId);
 			}
 			for (const gsi of gsiDiff.modified) {
-				if (!gsi.IndexName) continue;
+				if (typeof gsi.IndexName !== "string" || gsi.IndexName.length === 0) continue;
 				if (gsiHandledByBillingFlip.has(gsi.IndexName)) continue;
 				const billingFlipped = oldBilling !== newBilling;
 				const update = { IndexName: gsi.IndexName };
 				const previousOnDemand = previousSdkByName.get(gsi.IndexName)?.OnDemandThroughput;
+				const declared = rawOnDemandDeclarations.get(gsi.IndexName);
 				const onDemand = { ...gsi.OnDemandThroughput };
+				const unresolvedMembers = [];
 				if (!billingFlipped && previousOnDemand) {
-					if (previousOnDemand.MaxReadRequestUnits !== void 0 && onDemand.MaxReadRequestUnits === void 0) onDemand.MaxReadRequestUnits = ON_DEMAND_LIMIT_RESET;
-					if (previousOnDemand.MaxWriteRequestUnits !== void 0 && onDemand.MaxWriteRequestUnits === void 0) onDemand.MaxWriteRequestUnits = ON_DEMAND_LIMIT_RESET;
+					if (previousOnDemand.MaxReadRequestUnits !== void 0 && onDemand.MaxReadRequestUnits === void 0) if (declared?.readDeclared) unresolvedMembers.push("MaxReadRequestUnits");
+					else onDemand.MaxReadRequestUnits = ON_DEMAND_LIMIT_RESET;
+					if (previousOnDemand.MaxWriteRequestUnits !== void 0 && onDemand.MaxWriteRequestUnits === void 0) if (declared?.writeDeclared) unresolvedMembers.push("MaxWriteRequestUnits");
+					else onDemand.MaxWriteRequestUnits = ON_DEMAND_LIMIT_RESET;
 				}
+				if (unresolvedMembers.length > 0) this.logger.warn(`GSI '${gsi.IndexName}' on ${physicalId}: the template declares ${unresolvedMembers.join(" / ")} but the value did not resolve to a number, so the on-demand limit was left UNCHANGED on AWS rather than applied or cleared. This is usually an unresolved intrinsic in the template; resolve it to a literal to change the ceiling, or remove the property entirely to clear it.`);
 				if (Object.keys(onDemand).length > 0) update.OnDemandThroughput = onDemand;
 				if (!billingFlipped && gsi.ProvisionedThroughput) update.ProvisionedThroughput = gsi.ProvisionedThroughput;
 				const previousSdk = previousSdkByName.get(gsi.IndexName);
 				if (gsi.WarmThroughput !== void 0 && !deepEqual$1(gsi.WarmThroughput, previousSdk?.WarmThroughput)) update.WarmThroughput = gsi.WarmThroughput;
 				if (!update.ProvisionedThroughput && !update.OnDemandThroughput && !update.WarmThroughput) {
-					if (!billingFlipped) this.logger.warn(`GSI '${gsi.IndexName}' on ${physicalId} changed in a way DynamoDB's UpdateTable cannot express (KeySchema / Projection are immutable on an existing index). Recreate the index under a new name to apply the change.`);
+					if (!billingFlipped && unresolvedMembers.length === 0) this.logger.warn(`GSI '${gsi.IndexName}' on ${physicalId} changed in a way DynamoDB's UpdateTable cannot express (KeySchema / Projection are immutable on an existing index). Recreate the index under a new name to apply the change.`);
 					continue;
 				}
 				const gsiUpdate = { Update: update };
@@ -12589,6 +12619,10 @@ var DynamoDBGlobalTableProvider = class {
 				}));
 				await this.waitForTableActiveAfterUpdate(physicalId, logicalId);
 			}
+			if (newBilling === "PROVISIONED" || oldBilling === "PROVISIONED") {
+				if (gsiDiff.added.length > 0) await this.waitForIndexesActive(physicalId, logicalId);
+				await this.reconcileAutoScalingTargets(physicalId, collectAutoScalingTargets(previousProperties, currentRegion), newBilling === "PAY_PER_REQUEST" ? [] : collectAutoScalingTargets(properties, currentRegion), currentRegion, autoScalingApplied);
+			}
 			if (!deepEqual$1(properties["TimeToLiveSpecification"], previousProperties["TimeToLiveSpecification"])) {
 				const sendTtl = async (cmd) => {
 					try {
@@ -12759,11 +12793,10 @@ var DynamoDBGlobalTableProvider = class {
 	* create-only field with no corresponding `RegisterScalableTarget`
 	* surface; `readAutoScalingSettings` also explicitly skips it.
 	*/
-	async applyAutoScalingDiff(tableName, dimension, oldSettings, newSettings, client) {
-		const isWrite = dimension === "dynamodb:table:WriteCapacityUnits";
-		const policyName = isWrite ? `DynamoDBWriteCapacityUtilization:table/${tableName}` : `DynamoDBReadCapacityUtilization:table/${tableName}`;
-		const metricType = isWrite ? "DynamoDBWriteCapacityUtilization" : "DynamoDBReadCapacityUtilization";
-		const resourceId = `table/${tableName}`;
+	async applyAutoScalingDiff(tableName, dimension, oldSettings, newSettings, client, indexName) {
+		const metricType = dimension.endsWith("WriteCapacityUnits") ? "DynamoDBWriteCapacityUtilization" : "DynamoDBReadCapacityUtilization";
+		const resourceId = autoScalingResourceId(tableName, indexName);
+		const policyName = `${metricType}:${resourceId}`;
 		const asClient = client ?? await this.getLocalAutoScalingClient();
 		const oldEnabled = oldSettings !== void 0 && oldSettings !== null;
 		const newEnabled = newSettings !== void 0 && newSettings !== null;
@@ -12776,13 +12809,16 @@ var DynamoDBGlobalTableProvider = class {
 				return;
 			}
 			try {
-				await asClient.send(new RegisterScalableTargetCommand({
+				await withRetry(() => asClient.send(new RegisterScalableTargetCommand({
 					ServiceNamespace: "dynamodb",
 					ResourceId: resourceId,
 					ScalableDimension: dimension,
 					MinCapacity: minCapacity,
 					MaxCapacity: maxCapacity
-				}));
+				})), `${resourceId} (${dimension})`, {
+					isRetryable: (_message, error) => isThrottlingError(error),
+					...autoScalingRetryDelays.sleep ? { sleep: autoScalingRetryDelays.sleep } : {}
+				});
 			} catch (err) {
 				this.logger.warn(`Could not register auto-scaling target on ${tableName} (${dimension}): ${err instanceof Error ? err.message : String(err)}. Run: aws application-autoscaling register-scalable-target --service-namespace dynamodb --resource-id ${resourceId} --scalable-dimension ${dimension} --min-capacity ${minCapacity} --max-capacity ${maxCapacity}`);
 				return;
@@ -12801,14 +12837,17 @@ var DynamoDBGlobalTableProvider = class {
 			if (tttCfg["ScaleOutCooldown"] !== void 0) targetTrackingConfig["ScaleOutCooldown"] = Number(tttCfg["ScaleOutCooldown"]);
 			if (tttCfg["DisableScaleIn"] !== void 0) targetTrackingConfig["DisableScaleIn"] = Boolean(tttCfg["DisableScaleIn"]);
 			try {
-				await asClient.send(new PutScalingPolicyCommand({
+				await withRetry(() => asClient.send(new PutScalingPolicyCommand({
 					PolicyName: policyName,
 					ServiceNamespace: "dynamodb",
 					ResourceId: resourceId,
 					ScalableDimension: dimension,
 					PolicyType: "TargetTrackingScaling",
 					TargetTrackingScalingPolicyConfiguration: targetTrackingConfig
-				}));
+				})), `${policyName}`, {
+					isRetryable: (_message, error) => isThrottlingError(error),
+					...autoScalingRetryDelays.sleep ? { sleep: autoScalingRetryDelays.sleep } : {}
+				});
 				this.logger.debug(`Upserted auto-scaling policy ${policyName} on ${tableName} (${dimension})`);
 			} catch (err) {
 				this.logger.warn(`Could not put auto-scaling policy on ${tableName} (${dimension}): ${err instanceof Error ? err.message : String(err)}. Run: aws application-autoscaling put-scaling-policy --policy-name ${policyName} --service-namespace dynamodb --resource-id ${resourceId} --scalable-dimension ${dimension} --policy-type TargetTrackingScaling`);
@@ -12843,6 +12882,130 @@ var DynamoDBGlobalTableProvider = class {
 		}
 	}
 	/**
+	* Resolve the application-autoscaling client that owns a given region's
+	* targets. The local region goes through the cached client; every other
+	* region gets the per-region cached client.
+	*/
+	async autoScalingClientForRegion(region, localRegion) {
+		return region === localRegion ? await this.getLocalAutoScalingClient() : this.getRegionalAutoScalingClient(region);
+	}
+	/**
+	* Probe which of the given targets are ALREADY registered, so the
+	* reconcile can skip the ones that are both present and unchanged
+	* (Issue #1419).
+	*
+	* Per region: `DescribeScalableTargets` (batched + paginated) AND
+	* `DescribeScalingPolicies`, returning the set of `autoScalingTargetKey`s
+	* for which BOTH a target and a target-tracking policy exist.
+	*
+	* Both halves are required. A target whose `PutScalingPolicy` failed is
+	* registered but scales nothing, and `applyAutoScalingDiff` swallows that
+	* failure into a WARN — so probing the target alone would mark it present
+	* and skip it on every later deploy, which is the same silent never-scales
+	* gap this whole change exists to close, one level down.
+	*
+	* Best-effort: on ANY failure it returns `null`, which the caller reads as
+	* "presence unknown" and falls back to upserting everything — an extra
+	* idempotent call is always safer than skipping a registration that was
+	* never made.
+	*/
+	async probeRegisteredTargets(tableName, specs, localRegion) {
+		const byRegion = /* @__PURE__ */ new Map();
+		for (const spec of specs) {
+			const list = byRegion.get(spec.region);
+			if (list) list.push(spec);
+			else byRegion.set(spec.region, [spec]);
+		}
+		const indexPrefix = `${autoScalingResourceId(tableName)}/index/`;
+		const keyOf = (resourceId, dimension, region) => {
+			return `${region}|${dimension}|${resourceId.startsWith(indexPrefix) ? resourceId.slice(indexPrefix.length) : ""}`;
+		};
+		const present = /* @__PURE__ */ new Set();
+		for (const [region, regionSpecs] of byRegion) {
+			const resourceIds = [...new Set(regionSpecs.map((s) => autoScalingResourceId(tableName, s.indexName)))];
+			const client = await this.autoScalingClientForRegion(region, localRegion);
+			const targets = /* @__PURE__ */ new Set();
+			const policies = /* @__PURE__ */ new Set();
+			for (let i = 0; i < resourceIds.length; i += DESCRIBE_SCALABLE_TARGETS_BATCH) {
+				const batch = resourceIds.slice(i, i + DESCRIBE_SCALABLE_TARGETS_BATCH);
+				try {
+					let nextToken;
+					do {
+						const res = await client.send(new DescribeScalableTargetsCommand({
+							ServiceNamespace: "dynamodb",
+							ResourceIds: batch,
+							...nextToken ? { NextToken: nextToken } : {}
+						}));
+						for (const target of res.ScalableTargets ?? []) {
+							if (!target.ResourceId || !target.ScalableDimension) continue;
+							targets.add(keyOf(target.ResourceId, target.ScalableDimension, region));
+						}
+						nextToken = res.NextToken;
+					} while (nextToken);
+					let policyToken;
+					do {
+						const res = await client.send(new DescribeScalingPoliciesCommand({
+							ServiceNamespace: "dynamodb",
+							...policyToken ? { NextToken: policyToken } : {}
+						}));
+						for (const policy of res.ScalingPolicies ?? []) {
+							if (!policy.ResourceId || !policy.ScalableDimension) continue;
+							if (policy.PolicyType !== "TargetTrackingScaling") continue;
+							policies.add(keyOf(policy.ResourceId, policy.ScalableDimension, region));
+						}
+						policyToken = res.NextToken;
+					} while (policyToken);
+				} catch (err) {
+					this.logger.debug(`Could not probe existing auto-scaling targets on ${tableName} in ${region}: ${err instanceof Error ? err.message : String(err)} — re-asserting every target instead.`);
+					return null;
+				}
+			}
+			for (const key of targets) if (policies.has(key)) present.add(key);
+		}
+		return present;
+	}
+	/**
+	* Reconcile the application-autoscaling targets a CFn template declares
+	* against the ones its previous version declared (Issue #1419).
+	*
+	* **A desired target is re-asserted even when the template did not
+	* change, unless it is known to already exist.** A purely diff-gated
+	* register would never backfill the targets that are the entire subject
+	* of this issue: on a table deployed before this fix the settings are
+	* byte-identical on both sides of every subsequent deploy, so a diff
+	* check sees no change and leaves the dimension unregistered forever.
+	*
+	* The naive form of that — upsert everything, every deploy — costs
+	* `2 x (1 + N_gsi x (1 + N_replica))` serial round trips on EVERY deploy
+	* of an autoscaled table (a 20-GSI, 3-replica table would spend well over
+	* a hundred sequential calls re-asserting a steady state). So presence is
+	* probed first with one batched `DescribeScalableTargets` per region, and
+	* a target that already exists AND whose settings are unchanged is
+	* skipped. When the probe fails, presence is unknown and everything is
+	* upserted — the correct direction to fail.
+	*/
+	async reconcileAutoScalingTargets(tableName, previousSpecs, desiredSpecs, localRegion, alreadyApplied = /* @__PURE__ */ new Set()) {
+		const previousSpecsToUse = previousSpecs.filter((s) => !alreadyApplied.has(autoScalingTargetKey(s)));
+		const desiredSpecsToUse = desiredSpecs.filter((s) => !alreadyApplied.has(autoScalingTargetKey(s)));
+		const previousByKey = /* @__PURE__ */ new Map();
+		for (const spec of previousSpecsToUse) previousByKey.set(autoScalingTargetKey(spec), spec);
+		const registered = desiredSpecsToUse.length > 0 && previousSpecsToUse.length > 0 ? await this.probeRegisteredTargets(tableName, desiredSpecsToUse, localRegion) : /* @__PURE__ */ new Set();
+		const handled = /* @__PURE__ */ new Set();
+		for (const spec of desiredSpecsToUse) {
+			const key = autoScalingTargetKey(spec);
+			handled.add(key);
+			const previous = previousByKey.get(key);
+			if (registered?.has(key) && previous !== void 0 && deepEqual$1(previous.settings, spec.settings)) continue;
+			const client = await this.autoScalingClientForRegion(spec.region, localRegion);
+			await this.applyAutoScalingDiff(tableName, spec.dimension, previous?.settings, spec.settings, client, spec.indexName);
+		}
+		for (const [key, spec] of previousByKey) {
+			if (handled.has(key)) continue;
+			const client = await this.autoScalingClientForRegion(spec.region, localRegion);
+			await this.applyAutoScalingDiff(tableName, spec.dimension, spec.settings, void 0, client, spec.indexName);
+		}
+	}
+	/**
 	* Delete a DynamoDB Global Table.
 	*
 	* Order is load-bearing:
@@ -12883,12 +13046,15 @@ var DynamoDBGlobalTableProvider = class {
 			throw new ProvisioningError(`Could not resolve client region for DynamoDB GlobalTable ${logicalId} delete — would risk dropping the local replica`, resourceType, logicalId, physicalId, cause);
 		}
 		try {
-			const replicas = (await this.dynamoDBClient.send(new DescribeTableCommand({ TableName: physicalId }))).Table?.Replicas ?? [];
+			const describe = await this.dynamoDBClient.send(new DescribeTableCommand({ TableName: physicalId }));
+			const replicas = describe.Table?.Replicas ?? [];
+			const tableIndexNames = (describe.Table?.GlobalSecondaryIndexes ?? []).map((gsi) => gsi.IndexName).filter((name) => typeof name === "string");
 			for (const replica of replicas) {
 				const region = replica.RegionName;
 				if (!region || region === currentRegion) continue;
 				try {
 					await this.applyAutoScalingDiff(physicalId, "dynamodb:table:ReadCapacityUnits", {}, void 0, this.getRegionalAutoScalingClient(region));
+					for (const indexName of tableIndexNames) await this.applyAutoScalingDiff(physicalId, "dynamodb:index:ReadCapacityUnits", {}, void 0, this.getRegionalAutoScalingClient(region), indexName);
 					await this.dynamoDBClient.send(new UpdateTableCommand({
 						TableName: physicalId,
 						ReplicaUpdates: [{ Delete: { RegionName: region } }]
@@ -12901,6 +13067,10 @@ var DynamoDBGlobalTableProvider = class {
 			const localAsClient = await this.getLocalAutoScalingClient();
 			await this.applyAutoScalingDiff(physicalId, "dynamodb:table:ReadCapacityUnits", {}, void 0, localAsClient);
 			await this.applyAutoScalingDiff(physicalId, "dynamodb:table:WriteCapacityUnits", {}, void 0, localAsClient);
+			for (const indexName of tableIndexNames) {
+				await this.applyAutoScalingDiff(physicalId, "dynamodb:index:WriteCapacityUnits", {}, void 0, localAsClient, indexName);
+				await this.applyAutoScalingDiff(physicalId, "dynamodb:index:ReadCapacityUnits", {}, void 0, localAsClient, indexName);
+			}
 		} catch (describeErr) {
 			if (!(describeErr instanceof ResourceNotFoundException$1)) {
 				const cause = describeErr instanceof Error ? describeErr : void 0;
@@ -13284,6 +13454,34 @@ var DynamoDBGlobalTableProvider = class {
 		throw new ProvisioningError(`Table ${tableName} did not reach ACTIVE within ${maxAttempts}s after UpdateTable`, "AWS::DynamoDB::GlobalTable", logicalId, tableName);
 	}
 	/**
+	* Wait until every GSI reports `IndexStatus: ACTIVE` (Issue #1419).
+	*
+	* `waitForTableActiveAfterUpdate` only checks `TableStatus`, and a GSI
+	* added by `UpdateTable` leaves the TABLE ACTIVE while the index itself
+	* is still `CREATING` — application-autoscaling rejects a target whose
+	* resource is not ready, so registering right after the GSI-add loop
+	* would skip the very index the deploy just introduced.
+	*
+	* **Best-effort by design**: on timeout it warns and returns rather than
+	* throwing. A missed registration self-heals on the next deploy (the
+	* reconcile re-asserts anything not already present), whereas throwing
+	* here would fail a deploy whose actual resources are all correct. Index
+	* backfill on a large table can take a long time, hence the 15-minute cap.
+	*/
+	async waitForIndexesActive(tableName, logicalId) {
+		const maxAttempts = 900;
+		for (let attempt = 1; attempt <= maxAttempts; attempt++) {
+			try {
+				if (((await this.dynamoDBClient.send(new DescribeTableCommand({ TableName: tableName }))).Table?.GlobalSecondaryIndexes ?? []).every((gsi) => gsi.IndexStatus === "ACTIVE")) return;
+			} catch (err) {
+				this.logger.debug(`DescribeTable while waiting for indexes on ${tableName}: ${err instanceof Error ? err.message : String(err)}`);
+				return;
+			}
+			await new Promise((resolve) => setTimeout(resolve, 1e3));
+		}
+		this.logger.warn(`Indexes on ${tableName} (${logicalId}) did not all reach ACTIVE within ${maxAttempts}s; auto-scaling registration for a still-building index may have been skipped. The next deploy re-asserts it.`);
+	}
+	/**
 	* Wait until a specific replica's `ReplicaStatus` flips to ACTIVE.
 	* Replica provisioning typically takes 1–5 min; cap at 10 min.
 	*/
@@ -13339,26 +13537,6 @@ var DynamoDBGlobalTableProvider = class {
 * GlobalSecondaryIndexes, TableClassOverride — differ from the old shape).
 */
 /**
-* Derive the per-call `ProvisionedThroughput` shape required by
-* `CreateTableCommand` / `UpdateTableCommand` when BillingMode flips to
-* PROVISIONED. Shared between create() and the BillingMode-flip path in
-* update() so a user template's non-default read/write capacity is
-* preserved consistently across both code paths.
-*
-* Source of truth (CFn `AWS::DynamoDB::GlobalTable` shape):
-*  - WriteCapacityUnits → `properties.WriteProvisionedThroughputSettings`
-*    (top-level on the table). That block's ONLY member is
-*    `WriteCapacityAutoScalingSettings` — write capacity on a GlobalTable is
-*    always auto-scaled, so there is no literal `WriteCapacityUnits` to
-*    prefer. `CreateTable` needs one concrete number, so the auto-scaling
-*    block's `SeedCapacity` (documented as the value used until the scaling
-*    policies exist) is taken before `MinCapacity`; 5 if the block is absent.
-*  - ReadCapacityUnits → `Replicas[?Region==<region>].ReadProvisionedThroughputSettings`
-*    (per-replica, the deploy region's setting). That block DOES carry a
-*    literal `ReadCapacityUnits`, which is taken before its auto-scaling
-*    `SeedCapacity` / `MinCapacity`; 5 if absent.
-*/
-/**
 * Extract the local replica's `DeletionProtectionEnabled` from a CFn
 * properties shape. The `AWS::DynamoDB::GlobalTable` CFn schema places
 * the field inside `Replicas[?Region==<region>].DeletionProtectionEnabled`;
@@ -13378,10 +13556,30 @@ function extractLocalDeletionProtection(props, region) {
 	const topLevel = props["DeletionProtectionEnabled"];
 	return typeof topLevel === "boolean" ? topLevel : void 0;
 }
-function derivePerCallProvisionedThroughput(properties, region) {
+/**
+* Derive the per-call `ProvisionedThroughput` shape required by
+* `CreateTableCommand` / `UpdateTableCommand` when BillingMode is
+* PROVISIONED. Shared between create() and the BillingMode-flip path in
+* update() so a user template's non-default read/write capacity is
+* preserved consistently across both code paths.
+*
+* Source of truth (CFn `AWS::DynamoDB::GlobalTable` shape):
+*  - WriteCapacityUnits → `properties.WriteProvisionedThroughputSettings`
+*    (top-level on the table). That block's ONLY member is
+*    `WriteCapacityAutoScalingSettings` — write capacity on a GlobalTable is
+*    always auto-scaled, so there is no literal `WriteCapacityUnits` to
+*    prefer. `CreateTable` needs one concrete number; which member of the
+*    auto-scaling block supplies it is context-dependent — see
+*    {@link CapacitySource}, which `source` selects. 5 if the block is absent.
+*  - ReadCapacityUnits → `Replicas[?Region==<region>].ReadProvisionedThroughputSettings`
+*    (per-replica, the deploy region's setting). That block DOES carry a
+*    literal `ReadCapacityUnits`, which is taken before its auto-scaling
+*    members; 5 if absent.
+*/
+function derivePerCallProvisionedThroughput(properties, region, source = "min") {
 	return {
-		ReadCapacityUnits: deriveReadCapacityUnits(asRecord((properties["Replicas"] ?? []).find((r) => r["Region"] === region)?.["ReadProvisionedThroughputSettings"])) ?? DEFAULT_CAPACITY_UNITS,
-		WriteCapacityUnits: deriveWriteCapacityUnits(asRecord(properties["WriteProvisionedThroughputSettings"])) ?? DEFAULT_CAPACITY_UNITS
+		ReadCapacityUnits: deriveReadCapacityUnits(asRecord((properties["Replicas"] ?? []).find((r) => r["Region"] === region)?.["ReadProvisionedThroughputSettings"]), source) ?? DEFAULT_CAPACITY_UNITS,
+		WriteCapacityUnits: deriveWriteCapacityUnits(asRecord(properties["WriteProvisionedThroughputSettings"]), source) ?? DEFAULT_CAPACITY_UNITS
 	};
 }
 /**
@@ -13389,6 +13587,110 @@ function derivePerCallProvisionedThroughput(properties, region) {
 * capacity value at all. Matches the pre-existing table-level default.
 */
 const DEFAULT_CAPACITY_UNITS = 5;
+/**
+* Stable identity for an {@link AutoScalingTargetSpec}, used to diff the
+* previous template's targets against the desired ones.
+*/
+function autoScalingTargetKey(spec) {
+	return `${spec.region}|${spec.dimension}|${spec.indexName ?? ""}`;
+}
+/**
+* The application-autoscaling `ResourceId` for a DynamoDB table or one of
+* its indexes. ONE spelling, shared by the register / policy / deregister
+* calls, the presence probe, and the target key — a divergence between any
+* two of those would silently register one target and look up another.
+*/
+function autoScalingResourceId(tableName, indexName) {
+	return indexName ? `table/${tableName}/index/${indexName}` : `table/${tableName}`;
+}
+/**
+* Test seam for the auto-scaling throttle retry's backoff, mirroring
+* `describeTypeRetryDelays`. Production leaves `sleep` undefined so
+* `withRetry`'s real schedule applies; a test injects a no-op so the ~47s
+* budget does not have to be waited out.
+*/
+const autoScalingRetryDelays = {};
+/**
+* Resource ids per `DescribeScalableTargets` request. Kept at the API's
+* documented per-page ceiling rather than a larger guess — the request is
+* paginated anyway, and over-asking risks a `ValidationException` that would
+* degrade the probe to "presence unknown" for the whole region.
+*/
+const DESCRIBE_SCALABLE_TARGETS_BATCH = 50;
+/**
+* Collect every application-autoscaling target a CFn GlobalTable properties
+* bag declares (Issue #1419).
+*
+* Where each dimension lives in the CFn shape — this is NOT symmetric, and
+* the asymmetry is the reason the per-index targets were missed:
+*
+* | dimension                            | CFn source                                                                    | region |
+* | ------------------------------------ | ----------------------------------------------------------------------------- | ------ |
+* | `dynamodb:table:WriteCapacityUnits`  | `WriteProvisionedThroughputSettings.WriteCapacityAutoScalingSettings`          | local  |
+* | `dynamodb:index:WriteCapacityUnits`  | `GlobalSecondaryIndexes[].WriteProvisionedThroughputSettings.…`                | local  |
+* | `dynamodb:table:ReadCapacityUnits`   | `Replicas[].ReadProvisionedThroughputSettings.ReadCapacityAutoScalingSettings` | replica's |
+* | `dynamodb:index:ReadCapacityUnits`   | `Replicas[].GlobalSecondaryIndexes[].ReadProvisionedThroughputSettings.…`      | replica's |
+*
+* WRITE capacity on a global table is owned by the source region only, so
+* both write dimensions register in the LOCAL region. READ capacity is
+* per-replica: each replica registers its own target with its own region's
+* application-autoscaling endpoint — including the LOCAL replica, whose
+* read target was never registered by any code path before this change
+* (`update()`'s replica loops all `continue` on the local region).
+*
+* A replica entry with no `Region` is skipped rather than defaulted: a
+* target registered against the wrong region's control plane is invisible
+* to every later diff and would leak on destroy.
+*/
+function collectAutoScalingTargets(properties, localRegion) {
+	const specs = [];
+	const tableWrite = asRecord(asRecord(properties["WriteProvisionedThroughputSettings"])?.["WriteCapacityAutoScalingSettings"]);
+	if (tableWrite) specs.push({
+		dimension: "dynamodb:table:WriteCapacityUnits",
+		region: localRegion,
+		settings: tableWrite
+	});
+	const cfnIndexes = properties["GlobalSecondaryIndexes"];
+	if (Array.isArray(cfnIndexes)) for (const entry of cfnIndexes) {
+		const gsi = asRecord(entry);
+		const indexName = gsi?.["IndexName"];
+		if (!gsi || typeof indexName !== "string") continue;
+		const indexWrite = asRecord(asRecord(gsi["WriteProvisionedThroughputSettings"])?.["WriteCapacityAutoScalingSettings"]);
+		if (indexWrite) specs.push({
+			dimension: "dynamodb:index:WriteCapacityUnits",
+			indexName,
+			region: localRegion,
+			settings: indexWrite
+		});
+	}
+	const replicas = properties["Replicas"];
+	if (Array.isArray(replicas)) for (const replicaEntry of replicas) {
+		const replica = asRecord(replicaEntry);
+		const region = replica?.["Region"];
+		if (!replica || typeof region !== "string") continue;
+		const replicaRead = asRecord(asRecord(replica["ReadProvisionedThroughputSettings"])?.["ReadCapacityAutoScalingSettings"]);
+		if (replicaRead) specs.push({
+			dimension: "dynamodb:table:ReadCapacityUnits",
+			region,
+			settings: replicaRead
+		});
+		const replicaIndexes = replica["GlobalSecondaryIndexes"];
+		if (!Array.isArray(replicaIndexes)) continue;
+		for (const entry of replicaIndexes) {
+			const replicaIndex = asRecord(entry);
+			const indexName = replicaIndex?.["IndexName"];
+			if (!replicaIndex || typeof indexName !== "string") continue;
+			const indexRead = asRecord(asRecord(replicaIndex["ReadProvisionedThroughputSettings"])?.["ReadCapacityAutoScalingSettings"]);
+			if (indexRead) specs.push({
+				dimension: "dynamodb:index:ReadCapacityUnits",
+				indexName,
+				region,
+				settings: indexRead
+			});
+		}
+	}
+	return specs;
+}
 /** Narrow an unknown CFn sub-object to a record (or `undefined`). */
 function asRecord(value) {
 	return value !== null && typeof value === "object" && !Array.isArray(value) ? value : void 0;
@@ -13417,38 +13719,48 @@ function toFiniteNumber(value) {
 * member — `WriteCapacityAutoScalingSettings` — i.e. write capacity on a
 * GlobalTable is ALWAYS auto-scaled; there is no literal `WriteCapacityUnits`
 * (that is why CDK 2.244's `TableV2` rejects `Capacity.fixed()` for write).
-* `CreateTable` / `UpdateTable` still require a concrete starting number, so
-* we take `SeedCapacity` ("the initial provisioned capacity units") when the
-* template supplies it, else `MinCapacity`.
+* `CreateTable` / `UpdateTable` still require a concrete starting number;
+* which member of the auto-scaling block supplies it is context-dependent
+* (`MinCapacity` on a create, `SeedCapacity` on a billing-mode flip) — see
+* {@link CapacitySource}, which `source` selects.
 *
 * A literal `WriteCapacityUnits` is still honored first: the CFn schema
 * forbids it, but hand-authored / imported templates and cdkd state written
 * before this helper existed can carry it, and honoring it is strictly more
 * faithful than ignoring it.
+*
+* `source` selects between the two contexts CloudFormation distinguishes —
+* see {@link CapacitySource}. Defaults to `'min'`, the common case.
 */
-function deriveWriteCapacityUnits(settings) {
+function deriveWriteCapacityUnits(settings, source = "min") {
 	if (!settings) return void 0;
 	const literal = toFiniteNumber(settings["WriteCapacityUnits"]);
 	if (literal !== void 0) return literal;
 	const autoScaling = asRecord(settings["WriteCapacityAutoScalingSettings"]);
 	if (!autoScaling) return void 0;
-	return toFiniteNumber(autoScaling["SeedCapacity"]) ?? toFiniteNumber(autoScaling["MinCapacity"]);
+	return pickAutoScalingCapacity(autoScaling, source);
 }
 /**
 * Derive a single READ capacity number from a CFn
 * `ReadProvisionedThroughputSettings` block (both the per-replica shape,
 * which carries `ReadCapacityUnits` + `ReadCapacityAutoScalingSettings`, and
 * the GSI/table-level `GlobalReadProvisionedThroughputSettings` shape, which
-* carries only `ReadCapacityUnits`). Same Seed-before-Min precedence as the
-* write side.
+* carries only `ReadCapacityUnits`). Same {@link CapacitySource} precedence
+* as the write side.
 */
-function deriveReadCapacityUnits(settings) {
+function deriveReadCapacityUnits(settings, source = "min") {
 	if (!settings) return void 0;
 	const literal = toFiniteNumber(settings["ReadCapacityUnits"]);
 	if (literal !== void 0) return literal;
 	const autoScaling = asRecord(settings["ReadCapacityAutoScalingSettings"]);
 	if (!autoScaling) return void 0;
-	return toFiniteNumber(autoScaling["SeedCapacity"]) ?? toFiniteNumber(autoScaling["MinCapacity"]);
+	return pickAutoScalingCapacity(autoScaling, source);
+}
+/** Resolve a `*CapacityAutoScalingSettings` block to one number. */
+function pickAutoScalingCapacity(autoScaling, source) {
+	const min = toFiniteNumber(autoScaling["MinCapacity"]);
+	if (source === "min") return min ?? toFiniteNumber(autoScaling["SeedCapacity"]);
+	return toFiniteNumber(autoScaling["SeedCapacity"]) ?? min;
 }
 /**
 * Translate the CFn `AWS::DynamoDB::GlobalTable` `GlobalSecondaryIndexes[]`
@@ -13487,7 +13799,7 @@ function deriveReadCapacityUnits(settings) {
 * written before this fix (and hand-authored templates) can carry them, and
 * silently re-deriving over an explicit value would be a regression.
 */
-function toSdkGlobalSecondaryIndexes(properties, region, billingMode) {
+function toSdkGlobalSecondaryIndexes(properties, region, billingMode, source = "min") {
 	const rawIndexes = properties["GlobalSecondaryIndexes"];
 	if (rawIndexes !== void 0 && !Array.isArray(rawIndexes)) throw new Error(`AWS::DynamoDB::GlobalTable GlobalSecondaryIndexes must be an array, got ${typeof rawIndexes} (${JSON.stringify(rawIndexes)?.slice(0, 200)}). An unresolved intrinsic here would otherwise deploy a table with no indexes.`);
 	const cfnIndexes = rawIndexes ?? [];
@@ -13519,8 +13831,8 @@ function toSdkGlobalSecondaryIndexes(properties, region, billingMode) {
 		const explicitOnDemand = asRecord(gsi["OnDemandThroughput"]);
 		if (explicitProvisioned) sdk.ProvisionedThroughput = explicitProvisioned;
 		else if (billingMode === "PROVISIONED") sdk.ProvisionedThroughput = {
-			ReadCapacityUnits: deriveReadCapacityUnits(asRecord(localEntry?.["ReadProvisionedThroughputSettings"])) ?? deriveReadCapacityUnits(asRecord(gsi["ReadProvisionedThroughputSettings"])) ?? DEFAULT_CAPACITY_UNITS,
-			WriteCapacityUnits: deriveWriteCapacityUnits(asRecord(gsi["WriteProvisionedThroughputSettings"])) ?? DEFAULT_CAPACITY_UNITS
+			ReadCapacityUnits: deriveReadCapacityUnits(asRecord(localEntry?.["ReadProvisionedThroughputSettings"]), source) ?? deriveReadCapacityUnits(asRecord(gsi["ReadProvisionedThroughputSettings"]), source) ?? DEFAULT_CAPACITY_UNITS,
+			WriteCapacityUnits: deriveWriteCapacityUnits(asRecord(gsi["WriteProvisionedThroughputSettings"]), source) ?? DEFAULT_CAPACITY_UNITS
 		};
 		if (explicitOnDemand) sdk.OnDemandThroughput = explicitOnDemand;
 		else if (billingMode !== "PROVISIONED") {
@@ -13536,6 +13848,89 @@ function toSdkGlobalSecondaryIndexes(properties, region, billingMode) {
 	return result;
 }
 /**
+* True when a CFn sub-object is nothing but an unresolved intrinsic
+* (`{"Fn::If": […]}` / `{"Ref": …}`), i.e. the template DID declare the block
+* but its value could not be resolved to a shape with members.
+*
+* Needed because presence is otherwise tested on the MEMBER key: an
+* intrinsic-valued block IS a record, so `asRecord` succeeds while
+* `['MaxReadRequestUnits']` is undefined — reporting "not declared" and firing
+* the destructive `-1` reset on a ceiling the template was trying to SET. That
+* is issue #1440 one level up from where the member test looks.
+*/
+function isUnresolvedIntrinsicBlock(value) {
+	const record = asRecord(value);
+	if (!record) return false;
+	const keys = Object.keys(record);
+	return keys.length > 0 && keys.every((k) => k === "Ref" || k.startsWith("Fn::"));
+}
+/**
+* Per-index RAW presence of the two per-GSI on-demand members, keyed by
+* `IndexName` (issue #1440).
+*
+* The per-GSI reset needs to know "did the template DROP this member", and the
+* only faithful answer is whether the CFn key is THERE — not whether its value
+* coerced. `toSdkGlobalSecondaryIndexes` runs every value through
+* {@link toFiniteNumber}, which returns `undefined` for a present-but-
+* unparseable value (an unresolved `{Ref: …}`, `''`, an object). Deciding
+* "dropped" from that collapsed view sent the `-1` reset for a member the
+* template was actively trying to SET, silently clearing the ceiling — the same
+* silent-wrong-action class the reset exists to remove, and the exact hazard
+* the table-level path was corrected for in #1434's PR.
+*
+* So this walks the same two sources as `toSdkGlobalSecondaryIndexes` — the
+* top-level GSI for the write half, the LOCAL replica's index entry (with the
+* GSI-level spelling as the documented fallback) for the read half — and
+* reports presence only. Keeping it beside that function is deliberate: the
+* two must agree on where each member lives, and a divergence between them is
+* exactly what would re-open the bug.
+*
+* A missing entry means "not declared", which lets the reset FIRE — i.e. the
+* DESTRUCTIVE direction, not a conservative one. Two DIFFERENT mechanisms keep
+* that safe, and neither is "the translation validates everything":
+*   - a non-array `GlobalSecondaryIndexes` is refused LOUDLY by
+*     `toSdkGlobalSecondaryIndexes` before any of this runs;
+*   - a malformed per-ENTRY shape is NOT refused — it is passed through
+*     untouched so AWS surfaces the real error — but such an entry carries no
+*     usable `IndexName`, so the reset loop skips it before consulting this map.
+* Do not relax either behavior on the assumption that this helper degrades
+* safely on its own; it does not.
+*/
+function collectRawOnDemandDeclarations(properties, region) {
+	const out = /* @__PURE__ */ new Map();
+	const rawIndexes = properties["GlobalSecondaryIndexes"];
+	if (!Array.isArray(rawIndexes)) return out;
+	const replicas = properties["Replicas"];
+	const localReplicaIndexes = asRecord(Array.isArray(replicas) ? replicas.find((r) => asRecord(r)?.["Region"] === region) : void 0)?.["GlobalSecondaryIndexes"];
+	const localByName = /* @__PURE__ */ new Map();
+	if (Array.isArray(localReplicaIndexes)) for (const entry of localReplicaIndexes) {
+		const record = asRecord(entry);
+		const name = record?.["IndexName"];
+		if (record && typeof name === "string") localByName.set(name, record);
+	}
+	for (const entry of rawIndexes) {
+		const gsi = asRecord(entry);
+		const name = gsi?.["IndexName"];
+		if (!gsi || typeof name !== "string") continue;
+		const localEntry = localByName.get(name);
+		const explicitOnDemand = asRecord(gsi["OnDemandThroughput"]);
+		if (explicitOnDemand) {
+			out.set(name, {
+				readDeclared: explicitOnDemand["MaxReadRequestUnits"] !== void 0,
+				writeDeclared: explicitOnDemand["MaxWriteRequestUnits"] !== void 0
+			});
+			continue;
+		}
+		const readBlocks = [localEntry?.["ReadOnDemandThroughputSettings"], gsi["ReadOnDemandThroughputSettings"]];
+		const writeBlock = gsi["WriteOnDemandThroughputSettings"];
+		out.set(name, {
+			readDeclared: readBlocks.some((block) => asRecord(block)?.["MaxReadRequestUnits"] !== void 0 || isUnresolvedIntrinsicBlock(block)),
+			writeDeclared: asRecord(writeBlock)?.["MaxWriteRequestUnits"] !== void 0 || isUnresolvedIntrinsicBlock(writeBlock)
+		});
+	}
+	return out;
+}
+/**
 * Translate a CFn `Replicas[].GlobalSecondaryIndexes[]` blob (the
 * `ReplicaGlobalSecondaryIndexSpecification` shape) into the SDK's
 * `ReplicaGlobalSecondaryIndex[]` used by `CreateReplicationGroupMemberAction`
@@ -65020,7 +65415,7 @@ function createMigrateCommand() {
 */
 function buildProgram() {
 	const program = new Command();
-	program.name("cdkd").description("CDK Direct - Deploy AWS CDK apps directly via SDK/Cloud Control API").version("0.278.18");
+	program.name("cdkd").description("CDK Direct - Deploy AWS CDK apps directly via SDK/Cloud Control API").version("0.278.20");
 	program.hook("preAction", (_thisCommand, actionCommand) => {
 		const { profile } = actionCommand.optsWithGlobals();
 		if (profile !== void 0) process.env["AWS_PROFILE"] = profile;