@go-to-k/cdkd 0.278.19 → 0.278.21

package/dist/cli.js

@@ -1,7 +1,7 @@
 #!/usr/bin/env node
-import { $ as DagBuilder, A as red, At as resolveApp, B as isTerminationProtectionPropagationError, Bt as CFN_TEMPLATE_URL_LIMIT, C as isStatefulRecreateTargetSync, Ct as runDockerStreaming, D as cyan, Dt as synthesisStatusMessage, E as bold, Et as Synthesizer, F as ProviderRegistry, Ft as resolveStateBucketWithDefaultAndSource, G as normalizeAwsTagsToCfn, Gt as AssemblyReader, H as cfnRefValueFromPhysicalId, Ht as findLargeInlineResources, I as findActionableSilentDrops, It as resolveUseCdkBootstrapAssets, J as applyRoleArnIfSet, Jt as resolveBucketRegion, K as resolveExplicitPhysicalId, Kt as processStackMessages, L as CloudControlProvider, Lt as stateBucketExistenceConfirmed, M as IAMRoleProvider, Mt as resolveCaptureObservedState, N as collectInlinePolicyNamesManagedBySiblings, Nt as resolveSkipPrefix, O as gray, Ot as getDefaultStateBucketName, P as clearOnUpdateRemoval, Pt as resolveStateBucketWithDefault, Q as isRetryableTransientError, Qt as setAwsClients, R as slowCcOperationTimeoutMs, Rt as warnDeprecatedNoPrefixCliFlag, S as MULTI_REGION_RECREATE_BLOCKED_TYPES, St as runDockerForeground, T as formatResourceLine, Tt as getDockerImageBySourceHash, U as refStateLookupFromResource, Ut as uploadCfnTemplate, V as IntrinsicFunctionResolver, Vt as MIGRATE_TMP_PREFIX, W as WAFv2WebACLProvider, Wt as expectedOwnerParam, X as describeTypeWithThrottleRetry, Xt as getAwsClients, Y as DiffCalculator, Yt as AwsClients, Z as withRetry, Zt as resetAwsClients, _ as createPreDeleteFinalSnapshot, _t as validateAssetBucketName, a as DeploymentEventsStore, an as LocalMigrateError, at as AssetPublisher, b as unsupportedFinalSnapshotError, bn as normalizeAwsError, bt as formatDockerLoginError, c as replayFailedOperations, cn as MissingCdkCliError, ct as buildAssetRedirectMap, d as IMPLICIT_DELETE_DEPENDENCIES, dn as ProvisioningError, dt as rewriteTemplateAssetReferences, en as CdkdError, et as TemplateParser, f as computeImplicitDeleteEdges, fn as ResourceTimeoutError, ft as AssetModeResolver, g as ccRoutedFinalSnapshotError, gt as parseBootstrapMarker, h as buildFinalSnapshotIdentifier, hn as StackTerminationProtectionError, ht as getBootstrapMarkerKey, i as DeploymentEventsReader, in as LocalInvokeBuildError$1, it as shouldRetainResource, j as yellow, jt as resolveAutoAssetStorage, k as green, kt as getLegacyStateBucketName, l as replayRollback, ln as NestedStackChildDirectDestroyError, lt as createAssetRedirectResolver, m as PRE_DELETE_SNAPSHOT_TYPES, mn as StackHasActiveImportsError, mt as ensureAssetStorage, n as DEFAULT_RESOURCE_WARN_AFTER_MS, nt as S3StateBackend, o as planFailedOps, on as LocalStartServiceError, ot as stringifyValue, p as ATOMIC_FINAL_SNAPSHOT_TYPES, pn as ResourceUpdateNotSupportedError, pt as BOOTSTRAP_MARKER_PREFIX, q as assertRegionMatch, r as DeployEngine, rn as DeployCancelledError, rt as rebuildClientForBucketRegion, s as planRollback, st as WorkGraph, t as DEFAULT_RESOURCE_TIMEOUT_MS, tt as LockManager, u as withResourceDeadline, un as PartialFailureError, ut as loadPublishableAssetManifest, v as isFinalSnapshotError, vt as validateContainerRepoName, w as renderStatefulReason, wt as AssetManifestLoader, x as extractDeploymentEventError, xn as withErrorHandling, xt as getDockerCmd, y as refusesFinalSnapshot, yt as buildDockerImage, z as disableInstanceApiTermination, zt as CFN_TEMPLATE_BODY_LIMIT } from "./deploy-engine-DOQs235O.js";
+import { $ as isThrottlingError, $t as setAwsClients, A as red, At as getLegacyStateBucketName, B as isTerminationProtectionPropagationError, Bt as CFN_TEMPLATE_BODY_LIMIT, C as isStatefulRecreateTargetSync, Ct as runDockerForeground, D as cyan, Dt as Synthesizer, E as bold, Et as getDockerImageBySourceHash, F as ProviderRegistry, Ft as resolveStateBucketWithDefault, G as normalizeAwsTagsToCfn, Gt as expectedOwnerParam, H as cfnRefValueFromPhysicalId, Ht as MIGRATE_TMP_PREFIX, I as findActionableSilentDrops, It as resolveStateBucketWithDefaultAndSource, J as applyRoleArnIfSet, K as resolveExplicitPhysicalId, Kt as AssemblyReader, L as CloudControlProvider, Lt as resolveUseCdkBootstrapAssets, M as IAMRoleProvider, Mt as resolveAutoAssetStorage, N as collectInlinePolicyNamesManagedBySiblings, Nt as resolveCaptureObservedState, O as gray, Ot as synthesisStatusMessage, P as clearOnUpdateRemoval, Pt as resolveSkipPrefix, Q as isRetryableTransientError, Qt as resetAwsClients, R as slowCcOperationTimeoutMs, Rt as stateBucketExistenceConfirmed, S as MULTI_REGION_RECREATE_BLOCKED_TYPES, Sn as withErrorHandling, St as getDockerCmd, T as formatResourceLine, Tt as AssetManifestLoader, U as refStateLookupFromResource, Ut as findLargeInlineResources, V as IntrinsicFunctionResolver, Vt as CFN_TEMPLATE_URL_LIMIT, W as WAFv2WebACLProvider, Wt as uploadCfnTemplate, X as describeTypeWithThrottleRetry, Xt as AwsClients, Y as DiffCalculator, Yt as resolveBucketRegion, Z as withRetry, Zt as getAwsClients, _ as createPreDeleteFinalSnapshot, _t as parseBootstrapMarker, a as DeploymentEventsStore, an as LocalInvokeBuildError$1, at as shouldRetainResource, b as unsupportedFinalSnapshotError, bt as buildDockerImage, c as replayFailedOperations, ct as WorkGraph, d as IMPLICIT_DELETE_DEPENDENCIES, dn as PartialFailureError, dt as loadPublishableAssetManifest, et as DagBuilder, f as computeImplicitDeleteEdges, fn as ProvisioningError, ft as rewriteTemplateAssetReferences, g as ccRoutedFinalSnapshotError, gn as StackTerminationProtectionError, gt as getBootstrapMarkerKey, h as buildFinalSnapshotIdentifier, hn as StackHasActiveImportsError, ht as ensureAssetStorage, i as DeploymentEventsReader, in as DeployCancelledError, it as rebuildClientForBucketRegion, j as yellow, jt as resolveApp, k as green, kt as getDefaultStateBucketName, l as replayRollback, ln as MissingCdkCliError, lt as buildAssetRedirectMap, m as PRE_DELETE_SNAPSHOT_TYPES, mn as ResourceUpdateNotSupportedError, mt as BOOTSTRAP_MARKER_PREFIX, n as DEFAULT_RESOURCE_WARN_AFTER_MS, nt as LockManager, o as planFailedOps, on as LocalMigrateError, ot as AssetPublisher, p as ATOMIC_FINAL_SNAPSHOT_TYPES, pn as ResourceTimeoutError, pt as AssetModeResolver, q as assertRegionMatch, qt as processStackMessages, r as DeployEngine, rt as S3StateBackend, s as planRollback, sn as LocalStartServiceError, st as stringifyValue, t as DEFAULT_RESOURCE_TIMEOUT_MS, tn as CdkdError, tt as TemplateParser, u as withResourceDeadline, un as NestedStackChildDirectDestroyError, ut as createAssetRedirectResolver, v as isFinalSnapshotError, vt as validateAssetBucketName, w as renderStatefulReason, wt as runDockerStreaming, x as extractDeploymentEventError, xn as normalizeAwsError, xt as formatDockerLoginError, y as refusesFinalSnapshot, yt as validateContainerRepoName, z as disableInstanceApiTermination, zt as warnDeprecatedNoPrefixCliFlag } from "./deploy-engine-dvS1K_ET.js";
 import { a as getLiveRenderer, c as PATTERN_B_RESOURCE_TYPES, d as generateResourceNameWithFallback, f as withSkipPrefix, i as runStackBuffered, n as getLogger, o as PATTERN_B_NAME_OPTIONS, p as withStackName, s as PATTERN_B_NAME_PROPERTIES, u as generateResourceName } from "./logger-BYMEE-BS.js";
-import { t as ASGProvider } from "./asg-provider-DaP2cw8z.js";
+import { t as ASGProvider } from "./asg-provider-BN1QMZlz.js";
 import { AsyncLocalStorage } from "node:async_hooks";
 import { createHash, randomBytes, randomUUID } from "node:crypto";
 import { CopyObjectCommand, CreateBucketCommand, DeleteBucketAnalyticsConfigurationCommand, DeleteBucketCommand, DeleteBucketCorsCommand, DeleteBucketIntelligentTieringConfigurationCommand, DeleteBucketInventoryConfigurationCommand, DeleteBucketLifecycleCommand, DeleteBucketMetricsConfigurationCommand, DeleteBucketPolicyCommand, DeleteBucketReplicationCommand, DeleteBucketTaggingCommand, DeleteBucketWebsiteCommand, DeleteObjectsCommand, GetBucketAccelerateConfigurationCommand, GetBucketCorsCommand, GetBucketEncryptionCommand, GetBucketLifecycleConfigurationCommand, GetBucketLocationCommand, GetBucketLoggingCommand, GetBucketNotificationConfigurationCommand, GetBucketPolicyCommand, GetBucketReplicationCommand, GetBucketTaggingCommand, GetBucketVersioningCommand, GetBucketWebsiteCommand, GetObjectCommand, GetObjectLockConfigurationCommand, GetPublicAccessBlockCommand, HeadBucketCommand, ListBucketAnalyticsConfigurationsCommand, ListBucketIntelligentTieringConfigurationsCommand, ListBucketInventoryConfigurationsCommand, ListBucketMetricsConfigurationsCommand, ListObjectVersionsCommand, ListObjectsV2Command, NoSuchBucket, PutBucketAccelerateConfigurationCommand, PutBucketAnalyticsConfigurationCommand, PutBucketCorsCommand, PutBucketEncryptionCommand, PutBucketIntelligentTieringConfigurationCommand, PutBucketInventoryConfigurationCommand, PutBucketLifecycleConfigurationCommand, PutBucketLoggingCommand, PutBucketMetricsConfigurationCommand, PutBucketNotificationConfigurationCommand, PutBucketOwnershipControlsCommand, PutBucketPolicyCommand, PutBucketReplicationCommand, PutBucketTaggingCommand, PutBucketVersioningCommand, PutBucketWebsiteCommand, PutObjectCommand, PutObjectLockConfigurationCommand, PutPublicAccessBlockCommand, S3Client, S3ServiceException } from "@aws-sdk/client-s3";
@@ -12269,6 +12269,11 @@ var DynamoDBGlobalTableProvider = class {
 					}
 				}));
 			}
+			if (billingMode === "PROVISIONED") try {
+				await this.reconcileAutoScalingTargets(tableName, [], collectAutoScalingTargets(properties, currentRegion), currentRegion);
+			} catch (autoScalingErr) {
+				this.logger.warn(`Auto-scaling registration failed for ${tableName}: ${autoScalingErr instanceof Error ? autoScalingErr.message : String(autoScalingErr)}. The table was created successfully; re-run the deploy to register the scaling targets.`);
+			}
 			this.logger.debug(`Successfully created DynamoDB GlobalTable ${logicalId}: ${tableName}`);
 			return {
 				physicalId: tableName,
@@ -12442,12 +12447,12 @@ var DynamoDBGlobalTableProvider = class {
 					BillingMode: newBilling
 				};
 				if (newBilling === "PROVISIONED") {
-					billingUpdate.ProvisionedThroughput = derivePerCallProvisionedThroughput(properties, currentRegion);
-					const provisionedIndexes = toSdkGlobalSecondaryIndexes(properties, currentRegion, newBilling);
+					billingUpdate.ProvisionedThroughput = derivePerCallProvisionedThroughput(properties, currentRegion, "seed");
+					const provisionedIndexes = toSdkGlobalSecondaryIndexes(properties, currentRegion, newBilling, "seed");
 					const previousCfnIndexes = previousProperties["GlobalSecondaryIndexes"];
 					const existingIndexNames = new Set((Array.isArray(previousCfnIndexes) ? previousCfnIndexes : []).map((entry) => entry?.["IndexName"]).filter((name) => typeof name === "string"));
 					const previousByIndexName = /* @__PURE__ */ new Map();
-					for (const gsi of toSdkGlobalSecondaryIndexes(previousProperties, currentRegion, newBilling)) if (gsi.IndexName) previousByIndexName.set(gsi.IndexName, gsi);
+					for (const gsi of toSdkGlobalSecondaryIndexes(previousProperties, currentRegion, newBilling, "seed")) if (gsi.IndexName) previousByIndexName.set(gsi.IndexName, gsi);
 					const byIndexName = new Map(previousByIndexName);
 					const survivingIndexNames = /* @__PURE__ */ new Set();
 					for (const gsi of provisionedIndexes) {
@@ -12476,7 +12481,14 @@ var DynamoDBGlobalTableProvider = class {
 			const writeAutoScalingOld = (previousProperties["WriteProvisionedThroughputSettings"] ?? {})["WriteCapacityAutoScalingSettings"];
 			const writeAutoScalingNew = (properties["WriteProvisionedThroughputSettings"] ?? {})["WriteCapacityAutoScalingSettings"];
 			const effectiveNewAutoScaling = oldBilling === "PROVISIONED" && newBilling === "PAY_PER_REQUEST" ? void 0 : writeAutoScalingNew;
-			if ((newBilling === "PROVISIONED" || oldBilling === "PROVISIONED") && !deepEqual$1(writeAutoScalingOld, effectiveNewAutoScaling)) await this.applyAutoScalingDiff(physicalId, "dynamodb:table:WriteCapacityUnits", writeAutoScalingOld, effectiveNewAutoScaling);
+			const autoScalingApplied = /* @__PURE__ */ new Set();
+			if ((newBilling === "PROVISIONED" || oldBilling === "PROVISIONED") && !deepEqual$1(writeAutoScalingOld, effectiveNewAutoScaling)) {
+				await this.applyAutoScalingDiff(physicalId, "dynamodb:table:WriteCapacityUnits", writeAutoScalingOld, effectiveNewAutoScaling);
+				autoScalingApplied.add(autoScalingTargetKey({
+					dimension: "dynamodb:table:WriteCapacityUnits",
+					region: currentRegion
+				}));
+			}
 			const replicaDiff = diffReplicas(previousProperties["Replicas"] ?? [], properties["Replicas"] ?? []);
 			for (const replica of replicaDiff.removed) {
 				const region = replica["Region"];
@@ -12485,6 +12497,10 @@ var DynamoDBGlobalTableProvider = class {
 				if (removedReadAutoScaling) {
 					const regionalAutoScalingClient = this.getRegionalAutoScalingClient(region);
 					await this.applyAutoScalingDiff(physicalId, "dynamodb:table:ReadCapacityUnits", removedReadAutoScaling, void 0, regionalAutoScalingClient);
+					autoScalingApplied.add(autoScalingTargetKey({
+						dimension: "dynamodb:table:ReadCapacityUnits",
+						region
+					}));
 				}
 				await this.dynamoDBClient.send(new UpdateTableCommand({
 					TableName: physicalId,
@@ -12502,6 +12518,10 @@ var DynamoDBGlobalTableProvider = class {
 				if (newBilling === "PROVISIONED" && newReadAutoScaling) {
 					const regionalAutoScalingClient = this.getRegionalAutoScalingClient(region);
 					await this.applyAutoScalingDiff(physicalId, "dynamodb:table:ReadCapacityUnits", void 0, newReadAutoScaling, regionalAutoScalingClient);
+					autoScalingApplied.add(autoScalingTargetKey({
+						dimension: "dynamodb:table:ReadCapacityUnits",
+						region
+					}));
 				}
 			}
 			for (const replica of replicaDiff.modified) {
@@ -12517,6 +12537,10 @@ var DynamoDBGlobalTableProvider = class {
 				if ((newBilling === "PROVISIONED" || oldBilling === "PROVISIONED") && !deepEqual$1(oldReadAutoScaling, effectiveNewReadAutoScaling)) {
 					const regionalAutoScalingClient = this.getRegionalAutoScalingClient(region);
 					await this.applyAutoScalingDiff(physicalId, "dynamodb:table:ReadCapacityUnits", oldReadAutoScaling, effectiveNewReadAutoScaling, regionalAutoScalingClient);
+					autoScalingApplied.add(autoScalingTargetKey({
+						dimension: "dynamodb:table:ReadCapacityUnits",
+						region
+					}));
 				}
 				const updateAction = { RegionName: region };
 				if (replica["KMSMasterKeyId"] !== void 0) updateAction.KMSMasterKeyId = replica["KMSMasterKeyId"];
@@ -12595,6 +12619,10 @@ var DynamoDBGlobalTableProvider = class {
 				}));
 				await this.waitForTableActiveAfterUpdate(physicalId, logicalId);
 			}
+			if (newBilling === "PROVISIONED" || oldBilling === "PROVISIONED") {
+				if (gsiDiff.added.length > 0) await this.waitForIndexesActive(physicalId, logicalId);
+				await this.reconcileAutoScalingTargets(physicalId, collectAutoScalingTargets(previousProperties, currentRegion), newBilling === "PAY_PER_REQUEST" ? [] : collectAutoScalingTargets(properties, currentRegion), currentRegion, autoScalingApplied);
+			}
 			if (!deepEqual$1(properties["TimeToLiveSpecification"], previousProperties["TimeToLiveSpecification"])) {
 				const sendTtl = async (cmd) => {
 					try {
@@ -12765,11 +12793,10 @@ var DynamoDBGlobalTableProvider = class {
 	* create-only field with no corresponding `RegisterScalableTarget`
 	* surface; `readAutoScalingSettings` also explicitly skips it.
 	*/
-	async applyAutoScalingDiff(tableName, dimension, oldSettings, newSettings, client) {
-		const isWrite = dimension === "dynamodb:table:WriteCapacityUnits";
-		const policyName = isWrite ? `DynamoDBWriteCapacityUtilization:table/${tableName}` : `DynamoDBReadCapacityUtilization:table/${tableName}`;
-		const metricType = isWrite ? "DynamoDBWriteCapacityUtilization" : "DynamoDBReadCapacityUtilization";
-		const resourceId = `table/${tableName}`;
+	async applyAutoScalingDiff(tableName, dimension, oldSettings, newSettings, client, indexName) {
+		const metricType = dimension.endsWith("WriteCapacityUnits") ? "DynamoDBWriteCapacityUtilization" : "DynamoDBReadCapacityUtilization";
+		const resourceId = autoScalingResourceId(tableName, indexName);
+		const policyName = `${metricType}:${resourceId}`;
 		const asClient = client ?? await this.getLocalAutoScalingClient();
 		const oldEnabled = oldSettings !== void 0 && oldSettings !== null;
 		const newEnabled = newSettings !== void 0 && newSettings !== null;
@@ -12782,13 +12809,16 @@ var DynamoDBGlobalTableProvider = class {
 				return;
 			}
 			try {
-				await asClient.send(new RegisterScalableTargetCommand({
+				await withRetry(() => asClient.send(new RegisterScalableTargetCommand({
 					ServiceNamespace: "dynamodb",
 					ResourceId: resourceId,
 					ScalableDimension: dimension,
 					MinCapacity: minCapacity,
 					MaxCapacity: maxCapacity
-				}));
+				})), `${resourceId} (${dimension})`, {
+					isRetryable: (_message, error) => isThrottlingError(error),
+					...autoScalingRetryDelays.sleep ? { sleep: autoScalingRetryDelays.sleep } : {}
+				});
 			} catch (err) {
 				this.logger.warn(`Could not register auto-scaling target on ${tableName} (${dimension}): ${err instanceof Error ? err.message : String(err)}. Run: aws application-autoscaling register-scalable-target --service-namespace dynamodb --resource-id ${resourceId} --scalable-dimension ${dimension} --min-capacity ${minCapacity} --max-capacity ${maxCapacity}`);
 				return;
@@ -12807,14 +12837,17 @@ var DynamoDBGlobalTableProvider = class {
 			if (tttCfg["ScaleOutCooldown"] !== void 0) targetTrackingConfig["ScaleOutCooldown"] = Number(tttCfg["ScaleOutCooldown"]);
 			if (tttCfg["DisableScaleIn"] !== void 0) targetTrackingConfig["DisableScaleIn"] = Boolean(tttCfg["DisableScaleIn"]);
 			try {
-				await asClient.send(new PutScalingPolicyCommand({
+				await withRetry(() => asClient.send(new PutScalingPolicyCommand({
 					PolicyName: policyName,
 					ServiceNamespace: "dynamodb",
 					ResourceId: resourceId,
 					ScalableDimension: dimension,
 					PolicyType: "TargetTrackingScaling",
 					TargetTrackingScalingPolicyConfiguration: targetTrackingConfig
-				}));
+				})), `${policyName}`, {
+					isRetryable: (_message, error) => isThrottlingError(error),
+					...autoScalingRetryDelays.sleep ? { sleep: autoScalingRetryDelays.sleep } : {}
+				});
 				this.logger.debug(`Upserted auto-scaling policy ${policyName} on ${tableName} (${dimension})`);
 			} catch (err) {
 				this.logger.warn(`Could not put auto-scaling policy on ${tableName} (${dimension}): ${err instanceof Error ? err.message : String(err)}. Run: aws application-autoscaling put-scaling-policy --policy-name ${policyName} --service-namespace dynamodb --resource-id ${resourceId} --scalable-dimension ${dimension} --policy-type TargetTrackingScaling`);
@@ -12849,6 +12882,130 @@ var DynamoDBGlobalTableProvider = class {
 		}
 	}
 	/**
+	* Resolve the application-autoscaling client that owns a given region's
+	* targets. The local region goes through the cached client; every other
+	* region gets the per-region cached client.
+	*/
+	async autoScalingClientForRegion(region, localRegion) {
+		return region === localRegion ? await this.getLocalAutoScalingClient() : this.getRegionalAutoScalingClient(region);
+	}
+	/**
+	* Probe which of the given targets are ALREADY registered, so the
+	* reconcile can skip the ones that are both present and unchanged
+	* (Issue #1419).
+	*
+	* Per region: `DescribeScalableTargets` (batched + paginated) AND
+	* `DescribeScalingPolicies`, returning the set of `autoScalingTargetKey`s
+	* for which BOTH a target and a target-tracking policy exist.
+	*
+	* Both halves are required. A target whose `PutScalingPolicy` failed is
+	* registered but scales nothing, and `applyAutoScalingDiff` swallows that
+	* failure into a WARN — so probing the target alone would mark it present
+	* and skip it on every later deploy, which is the same silent never-scales
+	* gap this whole change exists to close, one level down.
+	*
+	* Best-effort: on ANY failure it returns `null`, which the caller reads as
+	* "presence unknown" and falls back to upserting everything — an extra
+	* idempotent call is always safer than skipping a registration that was
+	* never made.
+	*/
+	async probeRegisteredTargets(tableName, specs, localRegion) {
+		const byRegion = /* @__PURE__ */ new Map();
+		for (const spec of specs) {
+			const list = byRegion.get(spec.region);
+			if (list) list.push(spec);
+			else byRegion.set(spec.region, [spec]);
+		}
+		const indexPrefix = `${autoScalingResourceId(tableName)}/index/`;
+		const keyOf = (resourceId, dimension, region) => {
+			return `${region}|${dimension}|${resourceId.startsWith(indexPrefix) ? resourceId.slice(indexPrefix.length) : ""}`;
+		};
+		const present = /* @__PURE__ */ new Set();
+		for (const [region, regionSpecs] of byRegion) {
+			const resourceIds = [...new Set(regionSpecs.map((s) => autoScalingResourceId(tableName, s.indexName)))];
+			const client = await this.autoScalingClientForRegion(region, localRegion);
+			const targets = /* @__PURE__ */ new Set();
+			const policies = /* @__PURE__ */ new Set();
+			for (let i = 0; i < resourceIds.length; i += DESCRIBE_SCALABLE_TARGETS_BATCH) {
+				const batch = resourceIds.slice(i, i + DESCRIBE_SCALABLE_TARGETS_BATCH);
+				try {
+					let nextToken;
+					do {
+						const res = await client.send(new DescribeScalableTargetsCommand({
+							ServiceNamespace: "dynamodb",
+							ResourceIds: batch,
+							...nextToken ? { NextToken: nextToken } : {}
+						}));
+						for (const target of res.ScalableTargets ?? []) {
+							if (!target.ResourceId || !target.ScalableDimension) continue;
+							targets.add(keyOf(target.ResourceId, target.ScalableDimension, region));
+						}
+						nextToken = res.NextToken;
+					} while (nextToken);
+					let policyToken;
+					do {
+						const res = await client.send(new DescribeScalingPoliciesCommand({
+							ServiceNamespace: "dynamodb",
+							...policyToken ? { NextToken: policyToken } : {}
+						}));
+						for (const policy of res.ScalingPolicies ?? []) {
+							if (!policy.ResourceId || !policy.ScalableDimension) continue;
+							if (policy.PolicyType !== "TargetTrackingScaling") continue;
+							policies.add(keyOf(policy.ResourceId, policy.ScalableDimension, region));
+						}
+						policyToken = res.NextToken;
+					} while (policyToken);
+				} catch (err) {
+					this.logger.debug(`Could not probe existing auto-scaling targets on ${tableName} in ${region}: ${err instanceof Error ? err.message : String(err)} — re-asserting every target instead.`);
+					return null;
+				}
+			}
+			for (const key of targets) if (policies.has(key)) present.add(key);
+		}
+		return present;
+	}
+	/**
+	* Reconcile the application-autoscaling targets a CFn template declares
+	* against the ones its previous version declared (Issue #1419).
+	*
+	* **A desired target is re-asserted even when the template did not
+	* change, unless it is known to already exist.** A purely diff-gated
+	* register would never backfill the targets that are the entire subject
+	* of this issue: on a table deployed before this fix the settings are
+	* byte-identical on both sides of every subsequent deploy, so a diff
+	* check sees no change and leaves the dimension unregistered forever.
+	*
+	* The naive form of that — upsert everything, every deploy — costs
+	* `2 x (1 + N_gsi x (1 + N_replica))` serial round trips on EVERY deploy
+	* of an autoscaled table (a 20-GSI, 3-replica table would spend well over
+	* a hundred sequential calls re-asserting a steady state). So presence is
+	* probed first with one batched `DescribeScalableTargets` per region, and
+	* a target that already exists AND whose settings are unchanged is
+	* skipped. When the probe fails, presence is unknown and everything is
+	* upserted — the correct direction to fail.
+	*/
+	async reconcileAutoScalingTargets(tableName, previousSpecs, desiredSpecs, localRegion, alreadyApplied = /* @__PURE__ */ new Set()) {
+		const previousSpecsToUse = previousSpecs.filter((s) => !alreadyApplied.has(autoScalingTargetKey(s)));
+		const desiredSpecsToUse = desiredSpecs.filter((s) => !alreadyApplied.has(autoScalingTargetKey(s)));
+		const previousByKey = /* @__PURE__ */ new Map();
+		for (const spec of previousSpecsToUse) previousByKey.set(autoScalingTargetKey(spec), spec);
+		const registered = desiredSpecsToUse.length > 0 && previousSpecsToUse.length > 0 ? await this.probeRegisteredTargets(tableName, desiredSpecsToUse, localRegion) : /* @__PURE__ */ new Set();
+		const handled = /* @__PURE__ */ new Set();
+		for (const spec of desiredSpecsToUse) {
+			const key = autoScalingTargetKey(spec);
+			handled.add(key);
+			const previous = previousByKey.get(key);
+			if (registered?.has(key) && previous !== void 0 && deepEqual$1(previous.settings, spec.settings)) continue;
+			const client = await this.autoScalingClientForRegion(spec.region, localRegion);
+			await this.applyAutoScalingDiff(tableName, spec.dimension, previous?.settings, spec.settings, client, spec.indexName);
+		}
+		for (const [key, spec] of previousByKey) {
+			if (handled.has(key)) continue;
+			const client = await this.autoScalingClientForRegion(spec.region, localRegion);
+			await this.applyAutoScalingDiff(tableName, spec.dimension, spec.settings, void 0, client, spec.indexName);
+		}
+	}
+	/**
 	* Delete a DynamoDB Global Table.
 	*
 	* Order is load-bearing:
@@ -12889,12 +13046,15 @@ var DynamoDBGlobalTableProvider = class {
 			throw new ProvisioningError(`Could not resolve client region for DynamoDB GlobalTable ${logicalId} delete — would risk dropping the local replica`, resourceType, logicalId, physicalId, cause);
 		}
 		try {
-			const replicas = (await this.dynamoDBClient.send(new DescribeTableCommand({ TableName: physicalId }))).Table?.Replicas ?? [];
+			const describe = await this.dynamoDBClient.send(new DescribeTableCommand({ TableName: physicalId }));
+			const replicas = describe.Table?.Replicas ?? [];
+			const tableIndexNames = (describe.Table?.GlobalSecondaryIndexes ?? []).map((gsi) => gsi.IndexName).filter((name) => typeof name === "string");
 			for (const replica of replicas) {
 				const region = replica.RegionName;
 				if (!region || region === currentRegion) continue;
 				try {
 					await this.applyAutoScalingDiff(physicalId, "dynamodb:table:ReadCapacityUnits", {}, void 0, this.getRegionalAutoScalingClient(region));
+					for (const indexName of tableIndexNames) await this.applyAutoScalingDiff(physicalId, "dynamodb:index:ReadCapacityUnits", {}, void 0, this.getRegionalAutoScalingClient(region), indexName);
 					await this.dynamoDBClient.send(new UpdateTableCommand({
 						TableName: physicalId,
 						ReplicaUpdates: [{ Delete: { RegionName: region } }]
@@ -12907,6 +13067,10 @@ var DynamoDBGlobalTableProvider = class {
 			const localAsClient = await this.getLocalAutoScalingClient();
 			await this.applyAutoScalingDiff(physicalId, "dynamodb:table:ReadCapacityUnits", {}, void 0, localAsClient);
 			await this.applyAutoScalingDiff(physicalId, "dynamodb:table:WriteCapacityUnits", {}, void 0, localAsClient);
+			for (const indexName of tableIndexNames) {
+				await this.applyAutoScalingDiff(physicalId, "dynamodb:index:WriteCapacityUnits", {}, void 0, localAsClient, indexName);
+				await this.applyAutoScalingDiff(physicalId, "dynamodb:index:ReadCapacityUnits", {}, void 0, localAsClient, indexName);
+			}
 		} catch (describeErr) {
 			if (!(describeErr instanceof ResourceNotFoundException$1)) {
 				const cause = describeErr instanceof Error ? describeErr : void 0;
@@ -13290,6 +13454,34 @@ var DynamoDBGlobalTableProvider = class {
 		throw new ProvisioningError(`Table ${tableName} did not reach ACTIVE within ${maxAttempts}s after UpdateTable`, "AWS::DynamoDB::GlobalTable", logicalId, tableName);
 	}
 	/**
+	* Wait until every GSI reports `IndexStatus: ACTIVE` (Issue #1419).
+	*
+	* `waitForTableActiveAfterUpdate` only checks `TableStatus`, and a GSI
+	* added by `UpdateTable` leaves the TABLE ACTIVE while the index itself
+	* is still `CREATING` — application-autoscaling rejects a target whose
+	* resource is not ready, so registering right after the GSI-add loop
+	* would skip the very index the deploy just introduced.
+	*
+	* **Best-effort by design**: on timeout it warns and returns rather than
+	* throwing. A missed registration self-heals on the next deploy (the
+	* reconcile re-asserts anything not already present), whereas throwing
+	* here would fail a deploy whose actual resources are all correct. Index
+	* backfill on a large table can take a long time, hence the 15-minute cap.
+	*/
+	async waitForIndexesActive(tableName, logicalId) {
+		const maxAttempts = 900;
+		for (let attempt = 1; attempt <= maxAttempts; attempt++) {
+			try {
+				if (((await this.dynamoDBClient.send(new DescribeTableCommand({ TableName: tableName }))).Table?.GlobalSecondaryIndexes ?? []).every((gsi) => gsi.IndexStatus === "ACTIVE")) return;
+			} catch (err) {
+				this.logger.debug(`DescribeTable while waiting for indexes on ${tableName}: ${err instanceof Error ? err.message : String(err)}`);
+				return;
+			}
+			await new Promise((resolve) => setTimeout(resolve, 1e3));
+		}
+		this.logger.warn(`Indexes on ${tableName} (${logicalId}) did not all reach ACTIVE within ${maxAttempts}s; auto-scaling registration for a still-building index may have been skipped. The next deploy re-asserts it.`);
+	}
+	/**
 	* Wait until a specific replica's `ReplicaStatus` flips to ACTIVE.
 	* Replica provisioning typically takes 1–5 min; cap at 10 min.
 	*/
@@ -13345,26 +13537,6 @@ var DynamoDBGlobalTableProvider = class {
 * GlobalSecondaryIndexes, TableClassOverride — differ from the old shape).
 */
 /**
-* Derive the per-call `ProvisionedThroughput` shape required by
-* `CreateTableCommand` / `UpdateTableCommand` when BillingMode flips to
-* PROVISIONED. Shared between create() and the BillingMode-flip path in
-* update() so a user template's non-default read/write capacity is
-* preserved consistently across both code paths.
-*
-* Source of truth (CFn `AWS::DynamoDB::GlobalTable` shape):
-*  - WriteCapacityUnits → `properties.WriteProvisionedThroughputSettings`
-*    (top-level on the table). That block's ONLY member is
-*    `WriteCapacityAutoScalingSettings` — write capacity on a GlobalTable is
-*    always auto-scaled, so there is no literal `WriteCapacityUnits` to
-*    prefer. `CreateTable` needs one concrete number, so the auto-scaling
-*    block's `SeedCapacity` (documented as the value used until the scaling
-*    policies exist) is taken before `MinCapacity`; 5 if the block is absent.
-*  - ReadCapacityUnits → `Replicas[?Region==<region>].ReadProvisionedThroughputSettings`
-*    (per-replica, the deploy region's setting). That block DOES carry a
-*    literal `ReadCapacityUnits`, which is taken before its auto-scaling
-*    `SeedCapacity` / `MinCapacity`; 5 if absent.
-*/
-/**
 * Extract the local replica's `DeletionProtectionEnabled` from a CFn
 * properties shape. The `AWS::DynamoDB::GlobalTable` CFn schema places
 * the field inside `Replicas[?Region==<region>].DeletionProtectionEnabled`;
@@ -13384,10 +13556,30 @@ function extractLocalDeletionProtection(props, region) {
 	const topLevel = props["DeletionProtectionEnabled"];
 	return typeof topLevel === "boolean" ? topLevel : void 0;
 }
-function derivePerCallProvisionedThroughput(properties, region) {
+/**
+* Derive the per-call `ProvisionedThroughput` shape required by
+* `CreateTableCommand` / `UpdateTableCommand` when BillingMode is
+* PROVISIONED. Shared between create() and the BillingMode-flip path in
+* update() so a user template's non-default read/write capacity is
+* preserved consistently across both code paths.
+*
+* Source of truth (CFn `AWS::DynamoDB::GlobalTable` shape):
+*  - WriteCapacityUnits → `properties.WriteProvisionedThroughputSettings`
+*    (top-level on the table). That block's ONLY member is
+*    `WriteCapacityAutoScalingSettings` — write capacity on a GlobalTable is
+*    always auto-scaled, so there is no literal `WriteCapacityUnits` to
+*    prefer. `CreateTable` needs one concrete number; which member of the
+*    auto-scaling block supplies it is context-dependent — see
+*    {@link CapacitySource}, which `source` selects. 5 if the block is absent.
+*  - ReadCapacityUnits → `Replicas[?Region==<region>].ReadProvisionedThroughputSettings`
+*    (per-replica, the deploy region's setting). That block DOES carry a
+*    literal `ReadCapacityUnits`, which is taken before its auto-scaling
+*    members; 5 if absent.
+*/
+function derivePerCallProvisionedThroughput(properties, region, source = "min") {
 	return {
-		ReadCapacityUnits: deriveReadCapacityUnits(asRecord((properties["Replicas"] ?? []).find((r) => r["Region"] === region)?.["ReadProvisionedThroughputSettings"])) ?? DEFAULT_CAPACITY_UNITS,
-		WriteCapacityUnits: deriveWriteCapacityUnits(asRecord(properties["WriteProvisionedThroughputSettings"])) ?? DEFAULT_CAPACITY_UNITS
+		ReadCapacityUnits: deriveReadCapacityUnits(asRecord((properties["Replicas"] ?? []).find((r) => r["Region"] === region)?.["ReadProvisionedThroughputSettings"]), source) ?? DEFAULT_CAPACITY_UNITS,
+		WriteCapacityUnits: deriveWriteCapacityUnits(asRecord(properties["WriteProvisionedThroughputSettings"]), source) ?? DEFAULT_CAPACITY_UNITS
 	};
 }
 /**
@@ -13395,6 +13587,110 @@ function derivePerCallProvisionedThroughput(properties, region) {
 * capacity value at all. Matches the pre-existing table-level default.
 */
 const DEFAULT_CAPACITY_UNITS = 5;
+/**
+* Stable identity for an {@link AutoScalingTargetSpec}, used to diff the
+* previous template's targets against the desired ones.
+*/
+function autoScalingTargetKey(spec) {
+	return `${spec.region}|${spec.dimension}|${spec.indexName ?? ""}`;
+}
+/**
+* The application-autoscaling `ResourceId` for a DynamoDB table or one of
+* its indexes. ONE spelling, shared by the register / policy / deregister
+* calls, the presence probe, and the target key — a divergence between any
+* two of those would silently register one target and look up another.
+*/
+function autoScalingResourceId(tableName, indexName) {
+	return indexName ? `table/${tableName}/index/${indexName}` : `table/${tableName}`;
+}
+/**
+* Test seam for the auto-scaling throttle retry's backoff, mirroring
+* `describeTypeRetryDelays`. Production leaves `sleep` undefined so
+* `withRetry`'s real schedule applies; a test injects a no-op so the ~47s
+* budget does not have to be waited out.
+*/
+const autoScalingRetryDelays = {};
+/**
+* Resource ids per `DescribeScalableTargets` request. Kept at the API's
+* documented per-page ceiling rather than a larger guess — the request is
+* paginated anyway, and over-asking risks a `ValidationException` that would
+* degrade the probe to "presence unknown" for the whole region.
+*/
+const DESCRIBE_SCALABLE_TARGETS_BATCH = 50;
+/**
+* Collect every application-autoscaling target a CFn GlobalTable properties
+* bag declares (Issue #1419).
+*
+* Where each dimension lives in the CFn shape — this is NOT symmetric, and
+* the asymmetry is the reason the per-index targets were missed:
+*
+* | dimension                            | CFn source                                                                    | region |
+* | ------------------------------------ | ----------------------------------------------------------------------------- | ------ |
+* | `dynamodb:table:WriteCapacityUnits`  | `WriteProvisionedThroughputSettings.WriteCapacityAutoScalingSettings`          | local  |
+* | `dynamodb:index:WriteCapacityUnits`  | `GlobalSecondaryIndexes[].WriteProvisionedThroughputSettings.…`                | local  |
+* | `dynamodb:table:ReadCapacityUnits`   | `Replicas[].ReadProvisionedThroughputSettings.ReadCapacityAutoScalingSettings` | replica's |
+* | `dynamodb:index:ReadCapacityUnits`   | `Replicas[].GlobalSecondaryIndexes[].ReadProvisionedThroughputSettings.…`      | replica's |
+*
+* WRITE capacity on a global table is owned by the source region only, so
+* both write dimensions register in the LOCAL region. READ capacity is
+* per-replica: each replica registers its own target with its own region's
+* application-autoscaling endpoint — including the LOCAL replica, whose
+* read target was never registered by any code path before this change
+* (`update()`'s replica loops all `continue` on the local region).
+*
+* A replica entry with no `Region` is skipped rather than defaulted: a
+* target registered against the wrong region's control plane is invisible
+* to every later diff and would leak on destroy.
+*/
+function collectAutoScalingTargets(properties, localRegion) {
+	const specs = [];
+	const tableWrite = asRecord(asRecord(properties["WriteProvisionedThroughputSettings"])?.["WriteCapacityAutoScalingSettings"]);
+	if (tableWrite) specs.push({
+		dimension: "dynamodb:table:WriteCapacityUnits",
+		region: localRegion,
+		settings: tableWrite
+	});
+	const cfnIndexes = properties["GlobalSecondaryIndexes"];
+	if (Array.isArray(cfnIndexes)) for (const entry of cfnIndexes) {
+		const gsi = asRecord(entry);
+		const indexName = gsi?.["IndexName"];
+		if (!gsi || typeof indexName !== "string") continue;
+		const indexWrite = asRecord(asRecord(gsi["WriteProvisionedThroughputSettings"])?.["WriteCapacityAutoScalingSettings"]);
+		if (indexWrite) specs.push({
+			dimension: "dynamodb:index:WriteCapacityUnits",
+			indexName,
+			region: localRegion,
+			settings: indexWrite
+		});
+	}
+	const replicas = properties["Replicas"];
+	if (Array.isArray(replicas)) for (const replicaEntry of replicas) {
+		const replica = asRecord(replicaEntry);
+		const region = replica?.["Region"];
+		if (!replica || typeof region !== "string") continue;
+		const replicaRead = asRecord(asRecord(replica["ReadProvisionedThroughputSettings"])?.["ReadCapacityAutoScalingSettings"]);
+		if (replicaRead) specs.push({
+			dimension: "dynamodb:table:ReadCapacityUnits",
+			region,
+			settings: replicaRead
+		});
+		const replicaIndexes = replica["GlobalSecondaryIndexes"];
+		if (!Array.isArray(replicaIndexes)) continue;
+		for (const entry of replicaIndexes) {
+			const replicaIndex = asRecord(entry);
+			const indexName = replicaIndex?.["IndexName"];
+			if (!replicaIndex || typeof indexName !== "string") continue;
+			const indexRead = asRecord(asRecord(replicaIndex["ReadProvisionedThroughputSettings"])?.["ReadCapacityAutoScalingSettings"]);
+			if (indexRead) specs.push({
+				dimension: "dynamodb:index:ReadCapacityUnits",
+				indexName,
+				region,
+				settings: indexRead
+			});
+		}
+	}
+	return specs;
+}
 /** Narrow an unknown CFn sub-object to a record (or `undefined`). */
 function asRecord(value) {
 	return value !== null && typeof value === "object" && !Array.isArray(value) ? value : void 0;
@@ -13423,38 +13719,48 @@ function toFiniteNumber(value) {
 * member — `WriteCapacityAutoScalingSettings` — i.e. write capacity on a
 * GlobalTable is ALWAYS auto-scaled; there is no literal `WriteCapacityUnits`
 * (that is why CDK 2.244's `TableV2` rejects `Capacity.fixed()` for write).
-* `CreateTable` / `UpdateTable` still require a concrete starting number, so
-* we take `SeedCapacity` ("the initial provisioned capacity units") when the
-* template supplies it, else `MinCapacity`.
+* `CreateTable` / `UpdateTable` still require a concrete starting number;
+* which member of the auto-scaling block supplies it is context-dependent
+* (`MinCapacity` on a create, `SeedCapacity` on a billing-mode flip) — see
+* {@link CapacitySource}, which `source` selects.
 *
 * A literal `WriteCapacityUnits` is still honored first: the CFn schema
 * forbids it, but hand-authored / imported templates and cdkd state written
 * before this helper existed can carry it, and honoring it is strictly more
 * faithful than ignoring it.
+*
+* `source` selects between the two contexts CloudFormation distinguishes —
+* see {@link CapacitySource}. Defaults to `'min'`, the common case.
 */
-function deriveWriteCapacityUnits(settings) {
+function deriveWriteCapacityUnits(settings, source = "min") {
 	if (!settings) return void 0;
 	const literal = toFiniteNumber(settings["WriteCapacityUnits"]);
 	if (literal !== void 0) return literal;
 	const autoScaling = asRecord(settings["WriteCapacityAutoScalingSettings"]);
 	if (!autoScaling) return void 0;
-	return toFiniteNumber(autoScaling["SeedCapacity"]) ?? toFiniteNumber(autoScaling["MinCapacity"]);
+	return pickAutoScalingCapacity(autoScaling, source);
 }
 /**
 * Derive a single READ capacity number from a CFn
 * `ReadProvisionedThroughputSettings` block (both the per-replica shape,
 * which carries `ReadCapacityUnits` + `ReadCapacityAutoScalingSettings`, and
 * the GSI/table-level `GlobalReadProvisionedThroughputSettings` shape, which
-* carries only `ReadCapacityUnits`). Same Seed-before-Min precedence as the
-* write side.
+* carries only `ReadCapacityUnits`). Same {@link CapacitySource} precedence
+* as the write side.
 */
-function deriveReadCapacityUnits(settings) {
+function deriveReadCapacityUnits(settings, source = "min") {
 	if (!settings) return void 0;
 	const literal = toFiniteNumber(settings["ReadCapacityUnits"]);
 	if (literal !== void 0) return literal;
 	const autoScaling = asRecord(settings["ReadCapacityAutoScalingSettings"]);
 	if (!autoScaling) return void 0;
-	return toFiniteNumber(autoScaling["SeedCapacity"]) ?? toFiniteNumber(autoScaling["MinCapacity"]);
+	return pickAutoScalingCapacity(autoScaling, source);
+}
+/** Resolve a `*CapacityAutoScalingSettings` block to one number. */
+function pickAutoScalingCapacity(autoScaling, source) {
+	const min = toFiniteNumber(autoScaling["MinCapacity"]);
+	if (source === "min") return min ?? toFiniteNumber(autoScaling["SeedCapacity"]);
+	return toFiniteNumber(autoScaling["SeedCapacity"]) ?? min;
 }
 /**
 * Translate the CFn `AWS::DynamoDB::GlobalTable` `GlobalSecondaryIndexes[]`
@@ -13493,7 +13799,7 @@ function deriveReadCapacityUnits(settings) {
 * written before this fix (and hand-authored templates) can carry them, and
 * silently re-deriving over an explicit value would be a regression.
 */
-function toSdkGlobalSecondaryIndexes(properties, region, billingMode) {
+function toSdkGlobalSecondaryIndexes(properties, region, billingMode, source = "min") {
 	const rawIndexes = properties["GlobalSecondaryIndexes"];
 	if (rawIndexes !== void 0 && !Array.isArray(rawIndexes)) throw new Error(`AWS::DynamoDB::GlobalTable GlobalSecondaryIndexes must be an array, got ${typeof rawIndexes} (${JSON.stringify(rawIndexes)?.slice(0, 200)}). An unresolved intrinsic here would otherwise deploy a table with no indexes.`);
 	const cfnIndexes = rawIndexes ?? [];
@@ -13525,8 +13831,8 @@ function toSdkGlobalSecondaryIndexes(properties, region, billingMode) {
 		const explicitOnDemand = asRecord(gsi["OnDemandThroughput"]);
 		if (explicitProvisioned) sdk.ProvisionedThroughput = explicitProvisioned;
 		else if (billingMode === "PROVISIONED") sdk.ProvisionedThroughput = {
-			ReadCapacityUnits: deriveReadCapacityUnits(asRecord(localEntry?.["ReadProvisionedThroughputSettings"])) ?? deriveReadCapacityUnits(asRecord(gsi["ReadProvisionedThroughputSettings"])) ?? DEFAULT_CAPACITY_UNITS,
-			WriteCapacityUnits: deriveWriteCapacityUnits(asRecord(gsi["WriteProvisionedThroughputSettings"])) ?? DEFAULT_CAPACITY_UNITS
+			ReadCapacityUnits: deriveReadCapacityUnits(asRecord(localEntry?.["ReadProvisionedThroughputSettings"]), source) ?? deriveReadCapacityUnits(asRecord(gsi["ReadProvisionedThroughputSettings"]), source) ?? DEFAULT_CAPACITY_UNITS,
+			WriteCapacityUnits: deriveWriteCapacityUnits(asRecord(gsi["WriteProvisionedThroughputSettings"]), source) ?? DEFAULT_CAPACITY_UNITS
 		};
 		if (explicitOnDemand) sdk.OnDemandThroughput = explicitOnDemand;
 		else if (billingMode !== "PROVISIONED") {
@@ -32713,13 +33019,14 @@ var GlueProvider = class {
 		const tableName = tableInput["Name"] ?? properties["Name"];
 		if (!tableName) throw new ProvisioningError(`TableInput.Name or top-level Name is required for Glue Table ${logicalId}`, resourceType, logicalId);
 		const catalogId = properties["CatalogId"];
+		assertIcebergTableInputAbsent(logicalId, resourceType, properties);
 		const openTableFormatInput = properties["OpenTableFormatInput"];
 		try {
 			await this.getClient().send(new CreateTableCommand$1({
 				CatalogId: catalogId,
 				DatabaseName: databaseName,
 				TableInput: this.buildTableInput(tableInput, tableName),
-				...openTableFormatInput !== void 0 && { OpenTableFormatInput: toSdkOpenTableFormatInput(openTableFormatInput) }
+				...openTableFormatInput !== void 0 && { OpenTableFormatInput: openTableFormatInput }
 			}));
 			const physicalId = `${databaseName}|${tableName}`;
 			this.logger.debug(`Successfully created Glue Table ${logicalId}: ${physicalId}`);
@@ -32739,6 +33046,8 @@ var GlueProvider = class {
 		const tableInput = properties["TableInput"];
 		if (!tableInput) throw new ProvisioningError(`TableInput is required for Glue Table update ${logicalId}`, resourceType, logicalId, physicalId);
 		const catalogId = properties["CatalogId"];
+		const updateIcebergKey = findIcebergTableInputKey(properties);
+		if (updateIcebergKey !== void 0) this.logger.warn(icebergTableInputRefusalMessage(logicalId, updateIcebergKey, "update"));
 		try {
 			await this.getClient().send(new UpdateTableCommand$1({
 				CatalogId: catalogId,
@@ -33294,32 +33603,100 @@ function sleep$1(ms) {
 	return new Promise((resolve) => setTimeout(resolve, ms));
 }
 /**
-* Convert the CFn `AWS::Glue::Table.OpenTableFormatInput` blob to the SDK
-* `OpenTableFormatInput` shape.
-*
-* Every key matches the SDK model except one: CFn's
-* `IcebergInput.IcebergTableInput` is the SDK's
-* `IcebergInput.CreateIcebergTableInput` (@aws-sdk/client-glue `models_1.d.ts`
-* `IcebergInput`). The AWS SDK v3 serializer drops unknown members, so leaving
-* the CFn spelling in place silently discarded the ENTIRE Iceberg table spec
-* (`Location` / `Schema` / `PartitionSpec` / `WriteOrder` / `Properties`) while
-* `CreateTable` still reported success. The renamed object's own members match
-* CFn 1:1, so this is a single key rename.
-*
-* Non-object inputs (an unresolved intrinsic) pass through untouched so AWS
-* surfaces the real validation error.
-*/
-function toSdkOpenTableFormatInput(input) {
-	const iceberg = input["IcebergInput"];
-	if (typeof iceberg !== "object" || iceberg === null || Array.isArray(iceberg) || !("IcebergTableInput" in iceberg)) return input;
-	const { IcebergTableInput: icebergTableInput, ...rest } = iceberg;
-	return {
-		...input,
-		IcebergInput: {
-			...rest,
-			CreateIcebergTableInput: icebergTableInput
-		}
-	};
+* Both spellings of the Iceberg table spec cdkd refuses inside
+* `OpenTableFormatInput.IcebergInput`: the CFn registry schema's
+* `IcebergTableInput` and `@aws-sdk/client-glue`'s `CreateIcebergTableInput`.
+* A hand-written template can carry either, and neither is deployable, so the
+* pre-flight matches both and names whichever it found.
+*/
+const ICEBERG_TABLE_INPUT_KEYS = ["IcebergTableInput", "CreateIcebergTableInput"];
+/**
+* Return whichever {@link ICEBERG_TABLE_INPUT_KEYS} spelling the template
+* carries under `OpenTableFormatInput.IcebergInput`, or `undefined`.
+*
+* Non-object shapes at either level (an unresolved intrinsic) are treated as
+* "absent" so AWS surfaces the real validation error rather than this refusal.
+*/
+function findIcebergTableInputKey(properties) {
+	const openTableFormatInput = properties["OpenTableFormatInput"];
+	if (typeof openTableFormatInput !== "object" || openTableFormatInput === null || Array.isArray(openTableFormatInput)) return;
+	const iceberg = openTableFormatInput["IcebergInput"];
+	if (typeof iceberg !== "object" || iceberg === null || Array.isArray(iceberg)) return;
+	return ICEBERG_TABLE_INPUT_KEYS.find((key) => key in iceberg);
+}
+/**
+* PRE-FLIGHT REFUSAL of `AWS::Glue::Table`
+* `OpenTableFormatInput.IcebergInput.IcebergTableInput` (issue #1454).
+*
+* **This is a deliberate PARITY DIVERGENCE, and it was a conscious choice.**
+* cdkd's compatibility target is CloudFormation, and CloudFormation does not
+* validate this property — it forwards it and lets the deploy roll back. cdkd
+* refuses it EARLIER and with a better message instead. The justification is
+* that no user is losing a working deployment: the live probe on issue #1408
+* (2026-08-09, us-east-1 — 5 raw `glue:CreateTable` shapes plus 5
+* `AWS::Glue::Table` CloudFormation stacks) proved the property is undeployable
+* on BOTH paths.
+*
+* - **The raw `glue:CreateTable` API — the call cdkd itself makes** — rejects
+*   every `CreateIcebergTableInput` shape: without a
+*   `TableInput.StorageDescriptor` it fails `Location information cannot be
+*   null while creating an iceberg table`, and with one it fails `Table
+*   metadata information present at multiple parts of input request`. The
+*   spec's own `Location` is never read. So this is NOT merely cdkd declining
+*   what CloudFormation declines — cdkd's own path cannot deploy it either.
+* - **CloudFormation** rolls back all three variants with `Table metadata is
+*   expected only via TableInput or via IcebergTableInputProperties inside
+*   OpenTableFormatInput` — naming a property that exists in NEITHER the CFn
+*   registry schema (`IcebergInput.IcebergTableInput`) NOR
+*   `@aws-sdk/client-glue` (`IcebergInput.CreateIcebergTableInput`). That
+*   three-way contract mismatch is an AWS-side bug.
+*
+* Because there is no shape in which the property works, forwarding it can only
+* produce a late, cryptic AWS error. Failing fast with the working shape spelled
+* out is strictly more useful.
+*
+* **CREATE only — update WARNS instead.** See the comment at the `updateTable`
+* call site: rollback replays from cdkd STATE, and a table created by a
+* pre-#1390 build carries the key in its state record, so refusing on update
+* would make such a table unrollbackable with no template-side remedy. cdkd
+* does not wire Glue's update-only `UpdateOpenTableFormatInput` shape and
+* `buildTableInput` is an explicit allow-list, so warning there forwards
+* nothing and loses no protection. One rollback arm is still exposed — the
+* reverse-replacement re-create replays a state record through `create()`;
+* see issue #1463 and the note at the `updateTable` call site.
+*
+* **Known bypass: the sticky Cloud Control route.** This is a GlueProvider
+* pre-flight, so it only runs on the SDK route. When a table's state record
+* carries `provisionedBy: 'cc-api'`, `ProviderRegistry.getProviderFor` sticky-
+* routes it to `CloudControlProvider`, which forwards the property to
+* CloudFormation and gets AWS's rollback instead of this message. That route is
+* opt-in only (`--recreate-via-cc-api`, or a legacy state record) —
+* `AWS::Glue::Table` has an empty `silentDrop` map, so no ordinary deploy takes
+* it. The outcome there is still a failure, just a later and less helpful one,
+* which is why this is documented rather than duplicated into the CC provider.
+*
+* **WARNING before relaxing this refusal.** cdkd used to RENAME the CFn
+* `IcebergTableInput` to the SDK's `CreateIcebergTableInput` (issue #1390); that
+* rename existed because the AWS SDK v3 serializer DROPS unknown members, so the
+* CFn spelling silently discarded the entire Iceberg spec while `CreateTable`
+* reported success. The rename was removed here as unreachable once this
+* refusal landed. If AWS ever ships a deployable shape and this check is
+* relaxed, the rename MUST be restored in the same change — otherwise the
+* silent-drop bug of #1390 comes straight back.
+*/
+function assertIcebergTableInputAbsent(logicalId, resourceType, properties, physicalId) {
+	const key = findIcebergTableInputKey(properties);
+	if (key === void 0) return;
+	throw new ProvisioningError(icebergTableInputRefusalMessage(logicalId, key, "create"), resourceType, logicalId, physicalId);
+}
+/**
+* The shared #1454 message body, so the CREATE refusal and the UPDATE warning
+* cannot drift apart. `mode` only changes the lead clause — everything after it
+* (the probe evidence and the working shape) is identical, because the user's
+* next action is the same either way.
+*/
+function icebergTableInputRefusalMessage(logicalId, key, mode) {
+	return `AWS::Glue::Table ${logicalId}: OpenTableFormatInput.IcebergInput.${key} ${mode === "create" ? `cannot be deployed by AWS in any shape, so cdkd refuses it before calling Glue (issue #1454).` : "cannot be deployed by AWS in any shape and is IGNORED on update — cdkd does not wire Glue's update-only UpdateOpenTableFormatInput shape, so it forwards nothing here and only warns (issue #1454). A CREATE of this table would be refused outright."}\n  Live-probed 2026-08-09 in us-east-1 (issue #1408): glue:CreateTable — the API cdkd calls — rejects every Iceberg table spec ("Location information cannot be null while creating an iceberg table" without a TableInput.StorageDescriptor, "Table metadata information present at multiple parts of input request" with one), and CloudFormation rolls the same template back with "Table metadata is expected only via TableInput or via IcebergTableInputProperties inside OpenTableFormatInput" — a property name that exists in neither the CFn registry schema (IcebergInput.IcebergTableInput) nor @aws-sdk/client-glue (IcebergInput.CreateIcebergTableInput).\n  Working shape — put the table metadata in TableInput and leave IcebergInput carrying only the create-time directive:\n    TableInput: { Name, TableType: 'EXTERNAL_TABLE', StorageDescriptor: { Location: 's3://your-bucket/prefix/', Columns: [...] } }\n    OpenTableFormatInput: { IcebergInput: { MetadataOperation: 'CREATE' } }   // Version: '2' is also accepted\n  Glue then writes the Iceberg metadata itself — the created table comes back with Parameters.table_type = ICEBERG and a populated Parameters.metadata_location.`;
 }
 /**
 * Build the SDK `EncryptionConfiguration` from the CFn-shape input
@@ -65109,7 +65486,7 @@ function createMigrateCommand() {
 */
 function buildProgram() {
 	const program = new Command();
-	program.name("cdkd").description("CDK Direct - Deploy AWS CDK apps directly via SDK/Cloud Control API").version("0.278.19");
+	program.name("cdkd").description("CDK Direct - Deploy AWS CDK apps directly via SDK/Cloud Control API").version("0.278.21");
 	program.hook("preAction", (_thisCommand, actionCommand) => {
 		const { profile } = actionCommand.optsWithGlobals();
 		if (profile !== void 0) process.env["AWS_PROFILE"] = profile;