@go-to-k/cdkd 0.278.30 → 0.278.32

package/dist/cli.js

@@ -1,7 +1,7 @@
 #!/usr/bin/env node
-import { $ as withRetry, $t as getAwsClients, A as red, At as synthesisStatusMessage, B as isTerminationProtectionPropagationError, Bt as stateBucketExistenceConfirmed, C as isStatefulRecreateTargetSync, Cn as normalizeAwsError, Ct as formatDockerLoginError, D as cyan, Dt as AssetManifestLoader, E as bold, Et as runDockerStreaming, F as ProviderRegistry, Ft as resolveCaptureObservedState, G as normalizeAwsTagsToCfn, Gt as findLargeInlineResources, H as cfnRefValueFromPhysicalId, Ht as CFN_TEMPLATE_BODY_LIMIT, I as findActionableSilentDrops, It as resolveSkipPrefix, J as readConfigString, Jt as AssemblyReader, K as resolveExplicitPhysicalId, Kt as uploadCfnTemplate, L as CloudControlProvider, Lt as resolveStateBucketWithDefault, M as IAMRoleProvider, Mt as getLegacyStateBucketName, N as collectInlinePolicyNamesManagedBySiblings, Nt as resolveApp, O as gray, Ot as getDockerImageBySourceHash, P as clearOnUpdateRemoval, Pt as resolveAutoAssetStorage, Q as describeTypeWithThrottleRetry, Qt as AwsClients, R as slowCcOperationTimeoutMs, Rt as resolveStateBucketWithDefaultAndSource, S as MULTI_REGION_RECREATE_BLOCKED_TYPES, St as buildDockerImage, T as formatResourceLine, Tt as runDockerForeground, U as refStateLookupFromResource, Ut as CFN_TEMPLATE_URL_LIMIT, V as IntrinsicFunctionResolver, Vt as warnDeprecatedNoPrefixCliFlag, W as WAFv2WebACLProvider, Wt as MIGRATE_TMP_PREFIX, X as applyRoleArnIfSet, Y as requireConfigString, Yt as processStackMessages, Z as DiffCalculator, Zt as resolveBucketRegion, _ as createPreDeleteFinalSnapshot, _n as StackHasActiveImportsError, _t as ensureAssetStorage, a as DeploymentEventsStore, at as S3StateBackend, b as unsupportedFinalSnapshotError, bt as validateAssetBucketName, c as replayFailedOperations, cn as LocalMigrateError, ct as AssetPublisher, d as IMPLICIT_DELETE_DEPENDENCIES, dn as MissingCdkCliError, dt as buildAssetRedirectMap, en as resetAwsClients, et as isRetryableTransientError, f as computeImplicitDeleteEdges, fn as NestedStackChildDirectDestroyError, ft as createAssetRedirectResolver, g as ccRoutedFinalSnapshotError, gn as ResourceUpdateNotSupportedError, gt as BOOTSTRAP_MARKER_PREFIX, h as buildFinalSnapshotIdentifier, hn as ResourceTimeoutError, ht as AssetModeResolver, i as DeploymentEventsReader, it as LockManager, j as yellow, jt as getDefaultStateBucketName, k as green, kt as Synthesizer, l as replayRollback, ln as LocalStartServiceError, lt as stringifyValue, m as PRE_DELETE_SNAPSHOT_TYPES, mn as ProvisioningError, mt as rewriteTemplateAssetReferences, n as DEFAULT_RESOURCE_WARN_AFTER_MS, nt as DagBuilder, o as planFailedOps, on as DeployCancelledError, ot as rebuildClientForBucketRegion, p as ATOMIC_FINAL_SNAPSHOT_TYPES, pn as PartialFailureError, pt as loadPublishableAssetManifest, q as assertRegionMatch, qt as expectedOwnerParam, r as DeployEngine, rn as CdkdError, rt as TemplateParser, s as planRollback, sn as LocalInvokeBuildError$1, st as shouldRetainResource, t as DEFAULT_RESOURCE_TIMEOUT_MS, tn as setAwsClients, tt as isThrottlingError, u as withResourceDeadline, ut as WorkGraph, v as isFinalSnapshotError, vn as StackTerminationProtectionError, vt as getBootstrapMarkerKey, w as renderStatefulReason, wn as withErrorHandling, wt as getDockerCmd, x as extractDeploymentEventError, xt as validateContainerRepoName, y as refusesFinalSnapshot, yt as parseBootstrapMarker, z as disableInstanceApiTermination, zt as resolveUseCdkBootstrapAssets } from "./deploy-engine-BLIg6xfm.js";
+import { $ as withRetry, $t as getAwsClients, A as red, At as synthesisStatusMessage, B as isTerminationProtectionPropagationError, Bt as stateBucketExistenceConfirmed, C as isStatefulRecreateTargetSync, Cn as normalizeAwsError, Ct as formatDockerLoginError, D as cyan, Dt as AssetManifestLoader, E as bold, Et as runDockerStreaming, F as ProviderRegistry, Ft as resolveCaptureObservedState, G as normalizeAwsTagsToCfn, Gt as findLargeInlineResources, H as cfnRefValueFromPhysicalId, Ht as CFN_TEMPLATE_BODY_LIMIT, I as findActionableSilentDrops, It as resolveSkipPrefix, J as readConfigString, Jt as AssemblyReader, K as resolveExplicitPhysicalId, Kt as uploadCfnTemplate, L as CloudControlProvider, Lt as resolveStateBucketWithDefault, M as IAMRoleProvider, Mt as getLegacyStateBucketName, N as collectInlinePolicyNamesManagedBySiblings, Nt as resolveApp, O as gray, Ot as getDockerImageBySourceHash, P as clearOnUpdateRemoval, Pt as resolveAutoAssetStorage, Q as describeTypeWithThrottleRetry, Qt as AwsClients, R as slowCcOperationTimeoutMs, Rt as resolveStateBucketWithDefaultAndSource, S as MULTI_REGION_RECREATE_BLOCKED_TYPES, St as buildDockerImage, T as formatResourceLine, Tt as runDockerForeground, U as refStateLookupFromResource, Ut as CFN_TEMPLATE_URL_LIMIT, V as IntrinsicFunctionResolver, Vt as warnDeprecatedNoPrefixCliFlag, W as WAFv2WebACLProvider, Wt as MIGRATE_TMP_PREFIX, X as applyRoleArnIfSet, Y as requireConfigString, Yt as processStackMessages, Z as DiffCalculator, Zt as resolveBucketRegion, _ as createPreDeleteFinalSnapshot, _n as StackHasActiveImportsError, _t as ensureAssetStorage, a as DeploymentEventsStore, at as S3StateBackend, b as unsupportedFinalSnapshotError, bt as validateAssetBucketName, c as replayFailedOperations, cn as LocalMigrateError, ct as AssetPublisher, d as IMPLICIT_DELETE_DEPENDENCIES, dn as MissingCdkCliError, dt as buildAssetRedirectMap, en as resetAwsClients, et as isRetryableTransientError, f as computeImplicitDeleteEdges, fn as NestedStackChildDirectDestroyError, ft as createAssetRedirectResolver, g as ccRoutedFinalSnapshotError, gn as ResourceUpdateNotSupportedError, gt as BOOTSTRAP_MARKER_PREFIX, h as buildFinalSnapshotIdentifier, hn as ResourceTimeoutError, ht as AssetModeResolver, i as DeploymentEventsReader, it as LockManager, j as yellow, jt as getDefaultStateBucketName, k as green, kt as Synthesizer, l as replayRollback, ln as LocalStartServiceError, lt as stringifyValue, m as PRE_DELETE_SNAPSHOT_TYPES, mn as ProvisioningError, mt as rewriteTemplateAssetReferences, n as DEFAULT_RESOURCE_WARN_AFTER_MS, nt as DagBuilder, o as planFailedOps, on as DeployCancelledError, ot as rebuildClientForBucketRegion, p as ATOMIC_FINAL_SNAPSHOT_TYPES, pn as PartialFailureError, pt as loadPublishableAssetManifest, q as assertRegionMatch, qt as expectedOwnerParam, r as DeployEngine, rn as CdkdError, rt as TemplateParser, s as planRollback, sn as LocalInvokeBuildError$1, st as shouldRetainResource, t as DEFAULT_RESOURCE_TIMEOUT_MS, tn as setAwsClients, tt as isThrottlingError, u as withResourceDeadline, ut as WorkGraph, v as isFinalSnapshotError, vn as StackTerminationProtectionError, vt as getBootstrapMarkerKey, w as renderStatefulReason, wn as withErrorHandling, wt as getDockerCmd, x as extractDeploymentEventError, xt as validateContainerRepoName, y as refusesFinalSnapshot, yt as parseBootstrapMarker, z as disableInstanceApiTermination, zt as resolveUseCdkBootstrapAssets } from "./deploy-engine-CEVFHtcP.js";
 import { a as getLiveRenderer, c as PATTERN_B_RESOURCE_TYPES, d as generateResourceNameWithFallback, f as withSkipPrefix, i as runStackBuffered, n as getLogger, o as PATTERN_B_NAME_OPTIONS, p as withStackName, s as PATTERN_B_NAME_PROPERTIES, u as generateResourceName } from "./logger-BYMEE-BS.js";
-import { t as ASGProvider } from "./asg-provider-CfVwvyCi.js";
+import { t as ASGProvider } from "./asg-provider-DLlrKwbd.js";
 import { AsyncLocalStorage } from "node:async_hooks";
 import { createHash, randomBytes, randomUUID } from "node:crypto";
 import { CopyObjectCommand, CreateBucketCommand, DeleteBucketAnalyticsConfigurationCommand, DeleteBucketCommand, DeleteBucketCorsCommand, DeleteBucketEncryptionCommand, DeleteBucketIntelligentTieringConfigurationCommand, DeleteBucketInventoryConfigurationCommand, DeleteBucketLifecycleCommand, DeleteBucketMetricsConfigurationCommand, DeleteBucketOwnershipControlsCommand, DeleteBucketPolicyCommand, DeleteBucketReplicationCommand, DeleteBucketTaggingCommand, DeleteBucketWebsiteCommand, DeleteObjectsCommand, GetBucketAccelerateConfigurationCommand, GetBucketCorsCommand, GetBucketEncryptionCommand, GetBucketLifecycleConfigurationCommand, GetBucketLocationCommand, GetBucketLoggingCommand, GetBucketNotificationConfigurationCommand, GetBucketOwnershipControlsCommand, GetBucketPolicyCommand, GetBucketReplicationCommand, GetBucketTaggingCommand, GetBucketVersioningCommand, GetBucketWebsiteCommand, GetObjectCommand, GetObjectLockConfigurationCommand, GetPublicAccessBlockCommand, HeadBucketCommand, ListBucketAnalyticsConfigurationsCommand, ListBucketIntelligentTieringConfigurationsCommand, ListBucketInventoryConfigurationsCommand, ListBucketMetricsConfigurationsCommand, ListObjectVersionsCommand, ListObjectsV2Command, NoSuchBucket, PutBucketAccelerateConfigurationCommand, PutBucketAnalyticsConfigurationCommand, PutBucketCorsCommand, PutBucketEncryptionCommand, PutBucketIntelligentTieringConfigurationCommand, PutBucketInventoryConfigurationCommand, PutBucketLifecycleConfigurationCommand, PutBucketLoggingCommand, PutBucketMetricsConfigurationCommand, PutBucketNotificationConfigurationCommand, PutBucketOwnershipControlsCommand, PutBucketPolicyCommand, PutBucketReplicationCommand, PutBucketTaggingCommand, PutBucketVersioningCommand, PutBucketWebsiteCommand, PutObjectCommand, PutObjectLockConfigurationCommand, PutPublicAccessBlockCommand, S3Client, S3ServiceException } from "@aws-sdk/client-s3";
@@ -12328,9 +12328,10 @@ var DynamoDBGlobalTableProvider = class {
 				StreamViewType: "NEW_AND_OLD_IMAGES"
 			};
 		}
+		const diagnostics = [];
 		let sdkIndexes;
 		try {
-			sdkIndexes = toSdkGlobalSecondaryIndexes(properties, currentRegion, billingMode);
+			sdkIndexes = toSdkGlobalSecondaryIndexes(properties, currentRegion, billingMode, "min", diagnostics);
 		} catch (error) {
 			throw new ProvisioningError(error instanceof Error ? error.message : String(error), resourceType, logicalId, void 0, error instanceof Error ? error : void 0);
 		}
@@ -12345,10 +12346,21 @@ var DynamoDBGlobalTableProvider = class {
 		const dpeResolved = extractLocalDeletionProtection(properties, currentRegion);
 		if (dpeResolved !== void 0) createParams.DeletionProtectionEnabled = dpeResolved;
 		if (properties["TableClass"]) createParams.TableClass = properties["TableClass"];
-		const wodts = properties["WriteOnDemandThroughputSettings"];
-		if (wodts?.["MaxWriteRequestUnits"] !== void 0) createParams.OnDemandThroughput = { MaxWriteRequestUnits: Number(wodts["MaxWriteRequestUnits"]) };
+		const createCeilings = collectTableOnDemandCeilings(properties, currentRegion, diagnostics);
+		const createOnDemand = {
+			...createCeilings.read.value !== void 0 && { MaxReadRequestUnits: createCeilings.read.value },
+			...createCeilings.write.value !== void 0 && { MaxWriteRequestUnits: createCeilings.write.value }
+		};
+		if (billingMode !== "PROVISIONED" && Object.keys(createOnDemand).length > 0) createParams.OnDemandThroughput = createOnDemand;
 		const localReplicaTags = replicas.find((r) => r["Region"] === currentRegion)?.["Tags"];
 		if (localReplicaTags && localReplicaTags.length > 0) createParams.Tags = localReplicaTags;
+		for (const replica of replicas) {
+			const replicaRegion = replica["Region"];
+			if (!replicaRegion || replicaRegion === currentRegion) continue;
+			toSdkReplicaGlobalSecondaryIndexes(replica["GlobalSecondaryIndexes"], billingMode, diagnostics);
+			toSdkReplicaThroughputOverrides(replica, billingMode, diagnostics, {});
+		}
+		this.reportThroughputDiagnostics(diagnostics, logicalId, tableName);
 		try {
 			await this.dynamoDBClient.send(new CreateTableCommand(createParams));
 			this.logger.debug(`CreateTable initiated for ${tableName}, waiting for ACTIVE`);
@@ -12361,7 +12373,7 @@ var DynamoDBGlobalTableProvider = class {
 			for (const replica of replicas) {
 				const region = replica["Region"];
 				if (!region || region === currentRegion) continue;
-				await this.addReplica(tableName, replica, region, logicalId);
+				await this.addReplica(tableName, replica, region, logicalId, billingMode);
 			}
 			for (const replica of replicas) {
 				const region = replica["Region"];
@@ -12425,6 +12437,24 @@ var DynamoDBGlobalTableProvider = class {
 		}
 	}
 	/**
+	* Log a batch of {@link ThroughputDiagnostic}s at WARN, de-duplicated.
+	*
+	* The translators run over every index on both the create and the update
+	* path, so the same malformed block can be reported more than once in one
+	* call; a repeated warning reads as repeated damage and is worse than
+	* useless. Kept as ONE formatter so the five translation call sites cannot
+	* word the same defect differently.
+	*/
+	reportThroughputDiagnostics(diagnostics, logicalId, physicalId) {
+		const seen = /* @__PURE__ */ new Set();
+		for (const diagnostic of diagnostics) {
+			const line = `DynamoDB GlobalTable ${logicalId}: ${diagnostic.indexName ? `GSI '${diagnostic.indexName}' on ${physicalId}` : physicalId}: ${diagnostic.message}`;
+			if (seen.has(line)) continue;
+			seen.add(line);
+			this.logger.warn(line);
+		}
+	}
+	/**
 	* Add a single replica region. Issues one `UpdateTableCommand` with
 	* `ReplicaUpdates: [{ Create: { RegionName, ... } }]` and polls
 	* `DescribeTable` until the replica's `ReplicaStatus` flips to ACTIVE.
@@ -12445,11 +12475,14 @@ var DynamoDBGlobalTableProvider = class {
 	* is the granularity cdkd's pre-flight property-coverage check works at;
 	* these nested keys are tracked as a known gap, not a supported surface.
 	*/
-	async addReplica(tableName, replica, region, logicalId) {
+	async addReplica(tableName, replica, region, logicalId, billingMode, diagnostics) {
 		const create = { RegionName: region };
 		if (replica["KMSMasterKeyId"]) create.KMSMasterKeyId = replica["KMSMasterKeyId"];
-		const replicaIndexes = toSdkReplicaGlobalSecondaryIndexes(replica["GlobalSecondaryIndexes"]);
+		const replicaIndexes = toSdkReplicaGlobalSecondaryIndexes(replica["GlobalSecondaryIndexes"], billingMode, diagnostics);
 		if (replicaIndexes) create.GlobalSecondaryIndexes = replicaIndexes;
+		const tableOverrides = toSdkReplicaThroughputOverrides(replica, billingMode, diagnostics, {});
+		if (tableOverrides.ProvisionedThroughputOverride) create.ProvisionedThroughputOverride = tableOverrides.ProvisionedThroughputOverride;
+		if (tableOverrides.OnDemandThroughputOverride) create.OnDemandThroughputOverride = tableOverrides.OnDemandThroughputOverride;
 		if (replica["TableClassOverride"]) create.TableClassOverride = replica["TableClassOverride"];
 		const replicaUpdates = [{ Create: create }];
 		await this.dynamoDBClient.send(new UpdateTableCommand({
@@ -12494,8 +12527,9 @@ var DynamoDBGlobalTableProvider = class {
 		if (properties["LocalSecondaryIndexes"] !== void 0 && previousProperties["LocalSecondaryIndexes"] !== void 0 && !deepEqual$1(properties["LocalSecondaryIndexes"], previousProperties["LocalSecondaryIndexes"])) throw new ProvisioningError(`LocalSecondaryIndexes is immutable on AWS::DynamoDB::GlobalTable; replacement required (deploy with --replace, or destroy + redeploy)`, resourceType, logicalId, physicalId);
 		const oldAttrs = previousProperties["AttributeDefinitions"] ?? [];
 		const newAttrs = properties["AttributeDefinitions"] ?? [];
-		const removedAttrs = oldAttrs.filter((o) => !newAttrs.some((n) => n.AttributeName === o.AttributeName));
-		if (removedAttrs.length > 0) throw new ProvisioningError(`AttributeDefinitions removals are immutable on AWS::DynamoDB::GlobalTable (offenders: ${removedAttrs.map((a) => a.AttributeName).join(", ")}); replacement required`, resourceType, logicalId, physicalId);
+		const desiredKeyAttrNames = collectDesiredKeyAttributeNames(properties);
+		const removedButStillReferenced = oldAttrs.filter((o) => !newAttrs.some((n) => n.AttributeName === o.AttributeName)).filter((a) => a.AttributeName !== void 0 && desiredKeyAttrNames.has(a.AttributeName));
+		if (removedButStillReferenced.length > 0) throw new ProvisioningError(`AttributeDefinitions removals are immutable on AWS::DynamoDB::GlobalTable while a key schema still references them (offenders: ${removedButStillReferenced.map((a) => a.AttributeName).join(", ")}); replacement required`, resourceType, logicalId, physicalId);
 		const currentRegion = await this.dynamoDBClient.config.region() ?? "";
 		try {
 			await this.waitForTableActiveAfterUpdate(physicalId, logicalId);
@@ -12508,6 +12542,16 @@ var DynamoDBGlobalTableProvider = class {
 			const oldBilling = previousProperties["BillingMode"] ?? "PAY_PER_REQUEST";
 			const newBilling = properties["BillingMode"] ?? "PAY_PER_REQUEST";
 			const onDemandCeilingLive = oldBilling === "PAY_PER_REQUEST" && newBilling === "PAY_PER_REQUEST";
+			const diagnostics = [];
+			const desiredCeilings = collectTableOnDemandCeilings(properties, currentRegion, diagnostics);
+			const desiredSdkIndexes = toSdkGlobalSecondaryIndexes(properties, currentRegion, newBilling, "min", diagnostics);
+			for (const replica of properties["Replicas"] ?? []) {
+				const replicaRegion = asRecord$1(replica)?.["Region"];
+				if (typeof replicaRegion !== "string" || replicaRegion === currentRegion) continue;
+				toSdkReplicaGlobalSecondaryIndexes(replica["GlobalSecondaryIndexes"], newBilling, diagnostics);
+				toSdkReplicaThroughputOverrides(replica, newBilling, diagnostics, {});
+			}
+			this.reportThroughputDiagnostics(diagnostics, logicalId, physicalId);
 			const newDpe = extractLocalDeletionProtection(properties, currentRegion);
 			const oldDpe = extractLocalDeletionProtection(previousProperties, currentRegion);
 			const awsDpe = describeResp.Table?.DeletionProtectionEnabled;
@@ -12537,17 +12581,23 @@ var DynamoDBGlobalTableProvider = class {
 				};
 				flatChanged = true;
 			}
-			if (!deepEqual$1(properties["WriteOnDemandThroughputSettings"], previousProperties["WriteOnDemandThroughputSettings"])) {
-				const wodts = properties["WriteOnDemandThroughputSettings"];
-				const previousWodts = previousProperties["WriteOnDemandThroughputSettings"];
-				const rawMaxWrite = wodts?.["MaxWriteRequestUnits"];
-				if (rawMaxWrite !== void 0) {
-					flatUpdate.OnDemandThroughput = { MaxWriteRequestUnits: Number(rawMaxWrite) };
-					flatChanged = true;
-				} else if (onDemandCeilingLive && previousWodts?.["MaxWriteRequestUnits"] !== void 0) {
-					flatUpdate.OnDemandThroughput = { MaxWriteRequestUnits: ON_DEMAND_LIMIT_RESET };
-					flatChanged = true;
+			const awsOnDemand = describeResp.Table?.OnDemandThroughput;
+			const onDemandPayload = {};
+			const resolveCeiling = (desired, live) => {
+				if (desired.declared) {
+					if (desired.value === void 0) return void 0;
+					return desired.value !== live ? desired.value : void 0;
 				}
+				if (onDemandCeilingLive && live !== void 0) return ON_DEMAND_LIMIT_RESET;
+			};
+			const nextMaxRead = resolveCeiling(desiredCeilings.read, awsOnDemand?.MaxReadRequestUnits);
+			const nextMaxWrite = resolveCeiling(desiredCeilings.write, awsOnDemand?.MaxWriteRequestUnits);
+			if (nextMaxRead !== void 0) onDemandPayload.MaxReadRequestUnits = nextMaxRead;
+			if (nextMaxWrite !== void 0) onDemandPayload.MaxWriteRequestUnits = nextMaxWrite;
+			const deferCeilingsPastFlip = oldBilling === "PROVISIONED" && newBilling === "PAY_PER_REQUEST" && Object.keys(onDemandPayload).length > 0;
+			if (newBilling !== "PROVISIONED" && !deferCeilingsPastFlip && Object.keys(onDemandPayload).length > 0) {
+				flatUpdate.OnDemandThroughput = onDemandPayload;
+				flatChanged = true;
 			}
 			if (flatChanged) {
 				await this.dynamoDBClient.send(new UpdateTableCommand(flatUpdate));
@@ -12591,6 +12641,13 @@ var DynamoDBGlobalTableProvider = class {
 				await this.dynamoDBClient.send(new UpdateTableCommand(billingUpdate));
 				await this.waitForTableActiveAfterUpdate(physicalId, logicalId);
 			}
+			if (deferCeilingsPastFlip) {
+				await this.dynamoDBClient.send(new UpdateTableCommand({
+					TableName: physicalId,
+					OnDemandThroughput: onDemandPayload
+				}));
+				await this.waitForTableActiveAfterUpdate(physicalId, logicalId);
+			}
 			const writeAutoScalingOld = (previousProperties["WriteProvisionedThroughputSettings"] ?? {})["WriteCapacityAutoScalingSettings"];
 			const writeAutoScalingNew = (properties["WriteProvisionedThroughputSettings"] ?? {})["WriteCapacityAutoScalingSettings"];
 			const effectiveNewAutoScaling = oldBilling === "PROVISIONED" && newBilling === "PAY_PER_REQUEST" ? void 0 : writeAutoScalingNew;
@@ -12624,7 +12681,7 @@ var DynamoDBGlobalTableProvider = class {
 			for (const replica of replicaDiff.added) {
 				const region = replica["Region"];
 				if (!region || region === currentRegion) continue;
-				await this.addReplica(physicalId, replica, region, logicalId);
+				await this.addReplica(physicalId, replica, region, logicalId, newBilling);
 				const newReplicaTags = replica["Tags"];
 				await this.applyCrossRegionReplicaTagsDiff(tableArn, region, void 0, newReplicaTags, physicalId);
 				const newReadAutoScaling = (replica["ReadProvisionedThroughputSettings"] ?? {})["ReadCapacityAutoScalingSettings"];
@@ -12657,10 +12714,20 @@ var DynamoDBGlobalTableProvider = class {
 				}
 				const updateAction = { RegionName: region };
 				if (replica["KMSMasterKeyId"] !== void 0) updateAction.KMSMasterKeyId = replica["KMSMasterKeyId"];
-				const replicaIndexes = toSdkReplicaGlobalSecondaryIndexes(replica["GlobalSecondaryIndexes"]);
+				const replicaIndexes = toSdkReplicaGlobalSecondaryIndexes(replica["GlobalSecondaryIndexes"], newBilling);
 				if (replicaIndexes) updateAction.GlobalSecondaryIndexes = replicaIndexes;
+				const replicaOverrides = toSdkReplicaThroughputOverrides(replica, newBilling, void 0, {});
+				if (replicaOverrides.ProvisionedThroughputOverride) updateAction.ProvisionedThroughputOverride = replicaOverrides.ProvisionedThroughputOverride;
+				if (replicaOverrides.OnDemandThroughputOverride) updateAction.OnDemandThroughputOverride = replicaOverrides.OnDemandThroughputOverride;
+				if (oldBilling === newBilling) {
+					const oldReplicaOverrides = toSdkReplicaThroughputOverrides(oldReplica ?? {}, oldBilling, void 0, {});
+					const droppedOverrides = [];
+					if (oldReplicaOverrides.OnDemandThroughputOverride && !replicaOverrides.OnDemandThroughputOverride) droppedOverrides.push("ReadOnDemandThroughputSettings");
+					if (oldReplicaOverrides.ProvisionedThroughputOverride && !replicaOverrides.ProvisionedThroughputOverride) droppedOverrides.push("ReadProvisionedThroughputSettings");
+					if (droppedOverrides.length > 0) this.logger.warn(`Cross-region replica ${region} of ${physicalId}: the template no longer declares ${droppedOverrides.join(" / ")}, but DynamoDB offers no way to CLEAR a replica-level throughput override — a -1 sentinel is stored literally, and an empty override block wedges the table in UPDATING (both live-probed, issue #1436). The previous override is STILL IN EFFECT on AWS. Set an explicit value, or remove and re-add the replica, to change it.`);
+				}
 				if (replica["TableClassOverride"]) updateAction.TableClassOverride = replica["TableClassOverride"];
-				if (!(updateAction.KMSMasterKeyId !== void 0 || updateAction.GlobalSecondaryIndexes !== void 0 || updateAction.TableClassOverride !== void 0)) {
+				if (!(updateAction.KMSMasterKeyId !== void 0 || updateAction.GlobalSecondaryIndexes !== void 0 || updateAction.TableClassOverride !== void 0 || updateAction.ProvisionedThroughputOverride !== void 0 || updateAction.OnDemandThroughputOverride !== void 0)) {
 					this.logger.debug(`Cross-region replica ${region} of ${physicalId}: only Tags-style changes detected; UpdateReplica skipped (AWS rejects empty Update actions). Tags propagation handled above via per-region client.`);
 					continue;
 				}
@@ -12671,7 +12738,7 @@ var DynamoDBGlobalTableProvider = class {
 				await this.waitForReplicaActive(physicalId, region, logicalId);
 			}
 			const previousSdkIndexes = toSdkGlobalSecondaryIndexes(previousProperties, currentRegion, oldBilling);
-			const gsiDiff = diffGlobalSecondaryIndexes(previousSdkIndexes, toSdkGlobalSecondaryIndexes(properties, currentRegion, newBilling));
+			const gsiDiff = diffGlobalSecondaryIndexes(previousSdkIndexes, desiredSdkIndexes);
 			const rawOnDemandDeclarations = collectRawOnDemandDeclarations(properties, currentRegion);
 			const previousSdkByName = /* @__PURE__ */ new Map();
 			for (const prev of previousSdkIndexes) if (prev.IndexName) previousSdkByName.set(prev.IndexName, prev);
@@ -12716,7 +12783,6 @@ var DynamoDBGlobalTableProvider = class {
 					if (previousOnDemand.MaxWriteRequestUnits !== void 0 && onDemand.MaxWriteRequestUnits === void 0) if (declared?.writeDeclared) unresolvedMembers.push("MaxWriteRequestUnits");
 					else onDemand.MaxWriteRequestUnits = ON_DEMAND_LIMIT_RESET;
 				}
-				if (unresolvedMembers.length > 0) this.logger.warn(`GSI '${gsi.IndexName}' on ${physicalId}: the template declares ${unresolvedMembers.join(" / ")} but the value did not resolve to a number, so the on-demand limit was left UNCHANGED on AWS rather than applied or cleared. This is usually an unresolved intrinsic in the template; resolve it to a literal to change the ceiling, or remove the property entirely to clear it.`);
 				if (Object.keys(onDemand).length > 0) update.OnDemandThroughput = onDemand;
 				if (!billingFlipped && gsi.ProvisionedThroughput) update.ProvisionedThroughput = gsi.ProvisionedThroughput;
 				const previousSdk = previousSdkByName.get(gsi.IndexName);
@@ -13279,7 +13345,6 @@ var DynamoDBGlobalTableProvider = class {
 			if (table.AttributeDefinitions) result["AttributeDefinitions"] = table.AttributeDefinitions;
 			const billingMode = table.BillingModeSummary?.BillingMode;
 			if (billingMode) result["BillingMode"] = billingMode;
-			if (table.GlobalSecondaryIndexes && table.GlobalSecondaryIndexes.length > 0) result["GlobalSecondaryIndexes"] = table.GlobalSecondaryIndexes;
 			if (table.LocalSecondaryIndexes && table.LocalSecondaryIndexes.length > 0) result["LocalSecondaryIndexes"] = table.LocalSecondaryIndexes;
 			if (table.StreamSpecification?.StreamEnabled && table.StreamSpecification.StreamViewType) result["StreamSpecification"] = {
 				StreamEnabled: true,
@@ -13294,7 +13359,8 @@ var DynamoDBGlobalTableProvider = class {
 			if (table.DeletionProtectionEnabled !== void 0) result["DeletionProtectionEnabled"] = table.DeletionProtectionEnabled;
 			const currentRegion = await this.dynamoDBClient.config.region() ?? "";
 			const tableNameForSubs = table.TableName ?? physicalId;
-			result["Replicas"] = await Promise.all((table.Replicas ?? []).map(async (r) => {
+			const sdkReplicas = table.Replicas && table.Replicas.length > 0 ? table.Replicas : [{ RegionName: currentRegion }];
+			const replicas = await Promise.all(sdkReplicas.map(async (r) => {
 				const entry = { Region: r.RegionName };
 				if (r.KMSMasterKeyId !== void 0) entry["KMSMasterKeyId"] = r.KMSMasterKeyId;
 				if (!r.RegionName) return entry;
@@ -13324,8 +13390,38 @@ var DynamoDBGlobalTableProvider = class {
 				}
 				return entry;
 			}));
+			result["Replicas"] = replicas;
+			const localReplicaEntry = replicas.find((r) => r["Region"] === currentRegion);
+			if (table.GlobalSecondaryIndexes && table.GlobalSecondaryIndexes.length > 0) {
+				const cfnIndexes = [];
+				const replicaIndexEntries = [];
+				for (const gsi of table.GlobalSecondaryIndexes) {
+					if (!gsi.IndexName) continue;
+					const entry = { IndexName: gsi.IndexName };
+					if (gsi.KeySchema) entry["KeySchema"] = gsi.KeySchema;
+					if (gsi.Projection) entry["Projection"] = gsi.Projection;
+					if (gsi.WarmThroughput) entry["WarmThroughput"] = gsi.WarmThroughput;
+					const replicaEntry = { IndexName: gsi.IndexName };
+					if (billingMode === "PROVISIONED") {
+						const writeAutoScaling = await this.readAutoScalingSettings(tableNameForSubs, "dynamodb:index:WriteCapacityUnits", void 0, gsi.IndexName);
+						if (writeAutoScaling) entry["WriteProvisionedThroughputSettings"] = { WriteCapacityAutoScalingSettings: writeAutoScaling };
+						else if (gsi.ProvisionedThroughput?.WriteCapacityUnits !== void 0) entry["WriteProvisionedThroughputSettings"] = { WriteCapacityUnits: gsi.ProvisionedThroughput.WriteCapacityUnits };
+						const readAutoScaling = await this.readAutoScalingSettings(tableNameForSubs, "dynamodb:index:ReadCapacityUnits", void 0, gsi.IndexName);
+						if (readAutoScaling) replicaEntry["ReadProvisionedThroughputSettings"] = { ReadCapacityAutoScalingSettings: readAutoScaling };
+						else if (gsi.ProvisionedThroughput?.ReadCapacityUnits !== void 0) replicaEntry["ReadProvisionedThroughputSettings"] = { ReadCapacityUnits: gsi.ProvisionedThroughput.ReadCapacityUnits };
+					} else {
+						if (gsi.OnDemandThroughput?.MaxWriteRequestUnits !== void 0) entry["WriteOnDemandThroughputSettings"] = { MaxWriteRequestUnits: gsi.OnDemandThroughput.MaxWriteRequestUnits };
+						if (gsi.OnDemandThroughput?.MaxReadRequestUnits !== void 0) replicaEntry["ReadOnDemandThroughputSettings"] = { MaxReadRequestUnits: gsi.OnDemandThroughput.MaxReadRequestUnits };
+					}
+					cfnIndexes.push(entry);
+					if (Object.keys(replicaEntry).length > 1) replicaIndexEntries.push(replicaEntry);
+				}
+				result["GlobalSecondaryIndexes"] = cfnIndexes;
+				if (localReplicaEntry && replicaIndexEntries.length > 0) localReplicaEntry["GlobalSecondaryIndexes"] = replicaIndexEntries;
+			}
 			if (table.OnDemandThroughput?.MaxWriteRequestUnits !== void 0) result["WriteOnDemandThroughputSettings"] = { MaxWriteRequestUnits: table.OnDemandThroughput.MaxWriteRequestUnits };
 			else result["WriteOnDemandThroughputSettings"] = {};
+			if (localReplicaEntry && table.OnDemandThroughput?.MaxReadRequestUnits !== void 0) localReplicaEntry["ReadOnDemandThroughputSettings"] = { MaxReadRequestUnits: table.OnDemandThroughput.MaxReadRequestUnits };
 			if (billingMode === "PROVISIONED") {
 				const autoScaling = await this.readAutoScalingSettings(tableNameForSubs, "dynamodb:table:WriteCapacityUnits");
 				if (autoScaling) result["WriteProvisionedThroughputSettings"] = { WriteCapacityAutoScalingSettings: autoScaling };
@@ -13446,18 +13542,24 @@ var DynamoDBGlobalTableProvider = class {
 	* under `--verbose`.
 	*
 	* @param tableName DynamoDB table name (the `physicalId`).
-	* @param scalableDimension `'dynamodb:table:WriteCapacityUnits'` or
-	*   `'dynamodb:table:ReadCapacityUnits'`.
+	* @param scalableDimension Any of the four dimensions a GlobalTable can
+	*   register — the two `dynamodb:table:*` ones and, since issue #1420's
+	*   GSI reverse map, the two `dynamodb:index:*` ones.
 	* @param client Pre-built region-scoped autoscaling client. Defaults to
 	*   a fresh client in the local region — pass an explicit client when
 	*   reading from a cross-region replica.
+	* @param indexName Required for a `dynamodb:index:*` dimension; the
+	*   `ResourceId` is built through the shared {@link autoScalingResourceId}
+	*   so the read cannot spell it differently from the register / deregister
+	*   calls.
 	*/
-	async readAutoScalingSettings(tableName, scalableDimension, client) {
+	async readAutoScalingSettings(tableName, scalableDimension, client, indexName) {
+		const resourceId = autoScalingResourceId(tableName, indexName);
 		try {
 			const asClient = client ?? new ApplicationAutoScalingClient({ region: await this.dynamoDBClient.config.region() ?? "" });
 			const targets = (await asClient.send(new DescribeScalableTargetsCommand({
 				ServiceNamespace: "dynamodb",
-				ResourceIds: [`table/${tableName}`],
+				ResourceIds: [resourceId],
 				ScalableDimension: scalableDimension
 			}))).ScalableTargets ?? [];
 			if (targets.length === 0) return null;
@@ -13465,7 +13567,7 @@ var DynamoDBGlobalTableProvider = class {
 			if (target.MinCapacity === void 0 || target.MaxCapacity === void 0) return null;
 			const targetTracking = ((await asClient.send(new DescribeScalingPoliciesCommand({
 				ServiceNamespace: "dynamodb",
-				ResourceId: `table/${tableName}`,
+				ResourceId: resourceId,
 				ScalableDimension: scalableDimension
 			}))).ScalingPolicies ?? []).find((p) => p.PolicyType === "TargetTrackingScaling");
 			if (!targetTracking) return null;
@@ -13481,7 +13583,7 @@ var DynamoDBGlobalTableProvider = class {
 				TargetTrackingScalingPolicyConfiguration: tttConfig
 			};
 		} catch (err) {
-			this.logger.debug(`Could not read application-autoscaling settings for ${tableName} (${scalableDimension}): ${err instanceof Error ? err.message : String(err)}`);
+			this.logger.debug(`Could not read application-autoscaling settings for ${resourceId} (${scalableDimension}): ${err instanceof Error ? err.message : String(err)}`);
 			return null;
 		}
 	}
@@ -13507,6 +13609,17 @@ var DynamoDBGlobalTableProvider = class {
 	*  - `TimeToLiveSpecification` is reverse-mapped via
 	*    `DescribeTimeToLive` in `readCurrentState`.
 	*
+	* Issue #1420 + #1436 kept it empty rather than growing it:
+	*  - `GlobalSecondaryIndexes` is a real CFn-shaped reverse map (SDK-only
+	*    members stripped, write throughput at the top level, read throughput
+	*    on the local replica's index entry, auto-scaling recovered per index
+	*    via `dynamodb:index:*`). The alternative #1420 offered — declaring the
+	*    subtree here — would have turned drift OFF for every GSI, which is a
+	*    strictly worse trade than the phantom drift it removes.
+	*  - The table-level on-demand READ ceiling is reverse-mapped onto
+	*    `Replicas[local].ReadOnDemandThroughputSettings`, the CFn location it
+	*    is authored at.
+	*
 	* Returning an empty list is the canonical "no known-unknown paths"
 	* shape — keeping the method present (rather than removing it) for
 	* future additions and for backward compat on test reflection.
@@ -13691,8 +13804,8 @@ function extractLocalDeletionProtection(props, region) {
 */
 function derivePerCallProvisionedThroughput(properties, region, source = "min") {
 	return {
-		ReadCapacityUnits: deriveReadCapacityUnits(asRecord((properties["Replicas"] ?? []).find((r) => r["Region"] === region)?.["ReadProvisionedThroughputSettings"]), source) ?? DEFAULT_CAPACITY_UNITS,
-		WriteCapacityUnits: deriveWriteCapacityUnits(asRecord(properties["WriteProvisionedThroughputSettings"]), source) ?? DEFAULT_CAPACITY_UNITS
+		ReadCapacityUnits: deriveReadCapacityUnits(asRecord$1((properties["Replicas"] ?? []).find((r) => r["Region"] === region)?.["ReadProvisionedThroughputSettings"]), source) ?? DEFAULT_CAPACITY_UNITS,
+		WriteCapacityUnits: deriveWriteCapacityUnits(asRecord$1(properties["WriteProvisionedThroughputSettings"]), source) ?? DEFAULT_CAPACITY_UNITS
 	};
 }
 /**
@@ -13757,7 +13870,7 @@ const DESCRIBE_SCALABLE_TARGETS_BATCH = 50;
 */
 function collectAutoScalingTargets(properties, localRegion) {
 	const specs = [];
-	const tableWrite = asRecord(asRecord(properties["WriteProvisionedThroughputSettings"])?.["WriteCapacityAutoScalingSettings"]);
+	const tableWrite = asRecord$1(asRecord$1(properties["WriteProvisionedThroughputSettings"])?.["WriteCapacityAutoScalingSettings"]);
 	if (tableWrite) specs.push({
 		dimension: "dynamodb:table:WriteCapacityUnits",
 		region: localRegion,
@@ -13765,10 +13878,10 @@ function collectAutoScalingTargets(properties, localRegion) {
 	});
 	const cfnIndexes = properties["GlobalSecondaryIndexes"];
 	if (Array.isArray(cfnIndexes)) for (const entry of cfnIndexes) {
-		const gsi = asRecord(entry);
+		const gsi = asRecord$1(entry);
 		const indexName = gsi?.["IndexName"];
 		if (!gsi || typeof indexName !== "string") continue;
-		const indexWrite = asRecord(asRecord(gsi["WriteProvisionedThroughputSettings"])?.["WriteCapacityAutoScalingSettings"]);
+		const indexWrite = asRecord$1(asRecord$1(gsi["WriteProvisionedThroughputSettings"])?.["WriteCapacityAutoScalingSettings"]);
 		if (indexWrite) specs.push({
 			dimension: "dynamodb:index:WriteCapacityUnits",
 			indexName,
@@ -13778,10 +13891,10 @@ function collectAutoScalingTargets(properties, localRegion) {
 	}
 	const replicas = properties["Replicas"];
 	if (Array.isArray(replicas)) for (const replicaEntry of replicas) {
-		const replica = asRecord(replicaEntry);
+		const replica = asRecord$1(replicaEntry);
 		const region = replica?.["Region"];
 		if (!replica || typeof region !== "string") continue;
-		const replicaRead = asRecord(asRecord(replica["ReadProvisionedThroughputSettings"])?.["ReadCapacityAutoScalingSettings"]);
+		const replicaRead = asRecord$1(asRecord$1(replica["ReadProvisionedThroughputSettings"])?.["ReadCapacityAutoScalingSettings"]);
 		if (replicaRead) specs.push({
 			dimension: "dynamodb:table:ReadCapacityUnits",
 			region,
@@ -13790,10 +13903,10 @@ function collectAutoScalingTargets(properties, localRegion) {
 		const replicaIndexes = replica["GlobalSecondaryIndexes"];
 		if (!Array.isArray(replicaIndexes)) continue;
 		for (const entry of replicaIndexes) {
-			const replicaIndex = asRecord(entry);
+			const replicaIndex = asRecord$1(entry);
 			const indexName = replicaIndex?.["IndexName"];
 			if (!replicaIndex || typeof indexName !== "string") continue;
-			const indexRead = asRecord(asRecord(replicaIndex["ReadProvisionedThroughputSettings"])?.["ReadCapacityAutoScalingSettings"]);
+			const indexRead = asRecord$1(asRecord$1(replicaIndex["ReadProvisionedThroughputSettings"])?.["ReadCapacityAutoScalingSettings"]);
 			if (indexRead) specs.push({
 				dimension: "dynamodb:index:ReadCapacityUnits",
 				indexName,
@@ -13804,8 +13917,38 @@ function collectAutoScalingTargets(properties, localRegion) {
 	}
 	return specs;
 }
+/**
+* Every attribute name some KEY SCHEMA in the desired template references:
+* the table's own `KeySchema`, each GSI's, and each LSI's. This is the set
+* the `AttributeDefinitions`-removal guard in `update()` tests membership
+* against — a removed attribute still in this set is a genuine
+* redefine-in-place (replacement required); one outside it is the normal
+* bookkeeping of a GSI deletion and must NOT force a replacement.
+*
+* Malformed / intrinsic-valued entries contribute nothing, which errs on the
+* PERMISSIVE side of the guard — correct here, because the guard's failure
+* mode is a forced replacement of a live table, and AWS itself still rejects
+* a genuinely-bad `UpdateTable` loudly.
+*/
+function collectDesiredKeyAttributeNames(properties) {
+	const names = /* @__PURE__ */ new Set();
+	const addKeySchema = (value) => {
+		if (!Array.isArray(value)) return;
+		for (const element of value) {
+			const name = asRecord$1(element)?.["AttributeName"];
+			if (typeof name === "string") names.add(name);
+		}
+	};
+	addKeySchema(properties["KeySchema"]);
+	for (const indexListKey of ["GlobalSecondaryIndexes", "LocalSecondaryIndexes"]) {
+		const indexes = properties[indexListKey];
+		if (!Array.isArray(indexes)) continue;
+		for (const index of indexes) addKeySchema(asRecord$1(index)?.["KeySchema"]);
+	}
+	return names;
+}
 /** Narrow an unknown CFn sub-object to a record (or `undefined`). */
-function asRecord(value) {
+function asRecord$1(value) {
 	return value !== null && typeof value === "object" && !Array.isArray(value) ? value : void 0;
 }
 /**
@@ -13820,10 +13963,93 @@ const ON_DEMAND_LIMIT_RESET = -1;
 /** Coerce a CFn numeric (CFn is stringly-typed) to a finite number. */
 function toFiniteNumber(value) {
 	if (value === void 0 || value === null || value === "") return void 0;
+	if (typeof value !== "number" && typeof value !== "string") return void 0;
 	const n = Number(value);
 	return Number.isFinite(n) ? n : void 0;
 }
 /**
+* Merge an explicitly-supplied, already-SDK-shaped throughput block over a
+* derived one, PER MEMBER (issue #1428).
+*
+* The CFn schema forbids `ProvisionedThroughput` / `OnDemandThroughput` /
+* `*ThroughputOverride` on `AWS::DynamoDB::GlobalTable`, so this only fires
+* for pre-#1387 cdkd state and hand-authored templates — but those ARE a
+* first-class cdkd surface (`cdkd import --migrate-from-cloudformation`,
+* `cdkd migrate --from-cfn-stack`), and the pre-fix code forwarded such a
+* block VERBATIM. Three defects followed, and fixing any subset leaves a
+* live one, which is why this helper does all three at once:
+*
+*  1. **Coercion.** The verbatim forward was the ONE path that skipped
+*     {@link toFiniteNumber}, so a stringly-typed CFn `"5"` reached the SDK
+*     unnormalized while every derived value was a number.
+*  2. **Per-member merge.** Whole-block replacement meant a PARTIAL explicit
+*     block SUPPRESSED valid derived siblings — an explicit
+*     `{MaxReadRequestUnits: 41}` discarded a perfectly good
+*     `WriteOnDemandThroughputSettings.MaxWriteRequestUnits` from the same
+*     template.
+*  3. **Billing gate.** That is the CALLER's job (it owns `billingMode`), but
+*     it only works because this helper never emits a block the caller did
+*     not ask for.
+*
+* WARN-AND-FALL-BACK, never throw. Three earlier designs are recorded on
+* issue #1428 and each was broken by the same lever: a present-but-
+* uncoercible member that THREW made a stack whose STATE carried the garbage
+* permanently undeployable (the helper also runs on `previousProperties`),
+* and throwing from the replica path threw AFTER `CreateTable` had already
+* committed a real table. So an uncoercible member is dropped, reported
+* through `diagnostics`, and the derived value stands in.
+*
+* Returns `undefined` when neither side contributes a single member — an
+* EMPTY block is not a safe stand-in, because AWS documents an empty
+* `ProvisionedThroughputOverride` / `OnDemandThroughputOverride` as "inherit
+* the source table's settings".
+*/
+function mergeExplicitThroughputBlock(explicit, derived, members, diagnostics, context) {
+	const out = {};
+	for (const member of members) {
+		if (explicit && explicit[member] !== void 0) {
+			const coerced = toFiniteNumber(explicit[member]);
+			if (coerced !== void 0) {
+				out[member] = coerced;
+				continue;
+			}
+			diagnostics?.push({
+				kind: "unresolved-member",
+				...context.indexName !== void 0 && { indexName: context.indexName },
+				member,
+				message: `${context.blockName}.${member} is present but did not resolve to a number (${JSON.stringify(explicit[member])?.slice(0, 80)}), so it was ignored. This is usually an unresolved intrinsic; resolve it to a literal.`
+			});
+		}
+		const derivedValue = derived?.[member];
+		if (typeof derivedValue === "number") out[member] = derivedValue;
+	}
+	return Object.keys(out).length > 0 ? out : void 0;
+}
+/**
+* Report a member the template DECLARED whose value did not coerce (#1444 A).
+*
+* The diagnostic has to be raised WHERE THE VALUE IS LOST — inside the
+* translation — not from the per-GSI reset gate in `update()`. That gate only
+* runs for an index the diff already classified `modified` AND only when a
+* previous ceiling happened to exist AND only when the billing mode did not
+* flip, so the very same template defect was silent in the two most likely
+* cases: a FIRST-TIME set (both translated sides lack the member, so the index
+* is not `modified` at all and the loop never runs) and a BILLING FLIP (the
+* gate short-circuits). The defect is identical in all three; only the
+* diagnostic was conditional.
+*/
+function reportUnresolvedRawMember(rawValue, diagnostics, context) {
+	if (!diagnostics) return;
+	if (rawValue === void 0) return;
+	if (toFiniteNumber(rawValue) !== void 0) return;
+	diagnostics.push({
+		kind: "unresolved-member",
+		...context.indexName !== void 0 && { indexName: context.indexName },
+		member: context.member,
+		message: `${context.blockName}.${context.member} is declared but did not resolve to a number (${JSON.stringify(rawValue)?.slice(0, 80)}), so no throughput value was sent for it and the live AWS setting was left unchanged. This is usually an unresolved intrinsic; resolve it to a literal to apply the limit, or remove the property entirely to clear it.`
+	});
+}
+/**
 * Derive a single WRITE capacity number from a CFn
 * `WriteProvisionedThroughputSettings` block.
 *
@@ -13849,7 +14075,7 @@ function deriveWriteCapacityUnits(settings, source = "min") {
 	if (!settings) return void 0;
 	const literal = toFiniteNumber(settings["WriteCapacityUnits"]);
 	if (literal !== void 0) return literal;
-	const autoScaling = asRecord(settings["WriteCapacityAutoScalingSettings"]);
+	const autoScaling = asRecord$1(settings["WriteCapacityAutoScalingSettings"]);
 	if (!autoScaling) return void 0;
 	return pickAutoScalingCapacity(autoScaling, source);
 }
@@ -13865,7 +14091,7 @@ function deriveReadCapacityUnits(settings, source = "min") {
 	if (!settings) return void 0;
 	const literal = toFiniteNumber(settings["ReadCapacityUnits"]);
 	if (literal !== void 0) return literal;
-	const autoScaling = asRecord(settings["ReadCapacityAutoScalingSettings"]);
+	const autoScaling = asRecord$1(settings["ReadCapacityAutoScalingSettings"]);
 	if (!autoScaling) return void 0;
 	return pickAutoScalingCapacity(autoScaling, source);
 }
@@ -13912,22 +14138,22 @@ function pickAutoScalingCapacity(autoScaling, source) {
 * written before this fix (and hand-authored templates) can carry them, and
 * silently re-deriving over an explicit value would be a regression.
 */
-function toSdkGlobalSecondaryIndexes(properties, region, billingMode, source = "min") {
+function toSdkGlobalSecondaryIndexes(properties, region, billingMode, source = "min", diagnostics) {
 	const rawIndexes = properties["GlobalSecondaryIndexes"];
 	if (rawIndexes !== void 0 && !Array.isArray(rawIndexes)) throw new Error(`AWS::DynamoDB::GlobalTable GlobalSecondaryIndexes must be an array, got ${typeof rawIndexes} (${JSON.stringify(rawIndexes)?.slice(0, 200)}). An unresolved intrinsic here would otherwise deploy a table with no indexes.`);
 	const cfnIndexes = rawIndexes ?? [];
 	if (cfnIndexes.length === 0) return [];
 	const replicas = properties["Replicas"] ?? [];
-	const localReplicaIndexes = (Array.isArray(replicas) ? replicas.find((r) => asRecord(r)?.["Region"] === region) : void 0)?.["GlobalSecondaryIndexes"] ?? [];
+	const localReplicaIndexes = (Array.isArray(replicas) ? replicas.find((r) => asRecord$1(r)?.["Region"] === region) : void 0)?.["GlobalSecondaryIndexes"] ?? [];
 	const localByName = /* @__PURE__ */ new Map();
 	if (Array.isArray(localReplicaIndexes)) for (const entry of localReplicaIndexes) {
-		const record = asRecord(entry);
+		const record = asRecord$1(entry);
 		const name = record?.["IndexName"];
 		if (record && typeof name === "string") localByName.set(name, record);
 	}
 	const result = [];
 	for (const entry of cfnIndexes) {
-		const gsi = asRecord(entry);
+		const gsi = asRecord$1(entry);
 		if (!gsi) {
 			result.push(entry);
 			continue;
@@ -13940,21 +14166,51 @@ function toSdkGlobalSecondaryIndexes(properties, region, billingMode, source = "
 			Projection: gsi["Projection"]
 		};
 		if (gsi["WarmThroughput"] !== void 0) sdk.WarmThroughput = gsi["WarmThroughput"];
-		const explicitProvisioned = asRecord(gsi["ProvisionedThroughput"]);
-		const explicitOnDemand = asRecord(gsi["OnDemandThroughput"]);
-		if (explicitProvisioned) sdk.ProvisionedThroughput = explicitProvisioned;
-		else if (billingMode === "PROVISIONED") sdk.ProvisionedThroughput = {
-			ReadCapacityUnits: deriveReadCapacityUnits(asRecord(localEntry?.["ReadProvisionedThroughputSettings"]), source) ?? deriveReadCapacityUnits(asRecord(gsi["ReadProvisionedThroughputSettings"]), source) ?? DEFAULT_CAPACITY_UNITS,
-			WriteCapacityUnits: deriveWriteCapacityUnits(asRecord(gsi["WriteProvisionedThroughputSettings"]), source) ?? DEFAULT_CAPACITY_UNITS
-		};
-		if (explicitOnDemand) sdk.OnDemandThroughput = explicitOnDemand;
-		else if (billingMode !== "PROVISIONED") {
-			const maxWrite = toFiniteNumber(asRecord(gsi["WriteOnDemandThroughputSettings"])?.["MaxWriteRequestUnits"]);
-			const maxRead = toFiniteNumber(asRecord(localEntry?.["ReadOnDemandThroughputSettings"])?.["MaxReadRequestUnits"]) ?? toFiniteNumber(asRecord(gsi["ReadOnDemandThroughputSettings"])?.["MaxReadRequestUnits"]);
-			if (maxWrite !== void 0 || maxRead !== void 0) sdk.OnDemandThroughput = {
+		const explicitProvisioned = asRecord$1(gsi["ProvisionedThroughput"]);
+		const explicitOnDemand = asRecord$1(gsi["OnDemandThroughput"]);
+		if (explicitProvisioned && billingMode !== "PROVISIONED") diagnostics?.push({
+			kind: "billing-mode-mismatch",
+			...typeof indexName === "string" && { indexName },
+			member: "ProvisionedThroughput",
+			message: `an explicit ProvisionedThroughput block was dropped because the table's BillingMode is ${billingMode}; AWS rejects provisioned capacity on an on-demand table. Remove the block, or set BillingMode: PROVISIONED.`
+		});
+		if (explicitOnDemand && billingMode === "PROVISIONED") diagnostics?.push({
+			kind: "billing-mode-mismatch",
+			...typeof indexName === "string" && { indexName },
+			member: "OnDemandThroughput",
+			message: "an explicit OnDemandThroughput block was dropped because the table's BillingMode is PROVISIONED; AWS rejects on-demand ceilings on a provisioned table. Remove the block, or set BillingMode: PAY_PER_REQUEST."
+		});
+		if (billingMode === "PROVISIONED") sdk.ProvisionedThroughput = mergeExplicitThroughputBlock(explicitProvisioned, {
+			ReadCapacityUnits: deriveReadCapacityUnits(asRecord$1(localEntry?.["ReadProvisionedThroughputSettings"]), source) ?? deriveReadCapacityUnits(asRecord$1(gsi["ReadProvisionedThroughputSettings"]), source) ?? DEFAULT_CAPACITY_UNITS,
+			WriteCapacityUnits: deriveWriteCapacityUnits(asRecord$1(gsi["WriteProvisionedThroughputSettings"]), source) ?? DEFAULT_CAPACITY_UNITS
+		}, ["ReadCapacityUnits", "WriteCapacityUnits"], diagnostics, {
+			...typeof indexName === "string" && { indexName },
+			blockName: "ProvisionedThroughput"
+		});
+		else {
+			const rawWrite = asRecord$1(gsi["WriteOnDemandThroughputSettings"])?.["MaxWriteRequestUnits"];
+			const rawReadLocal = asRecord$1(localEntry?.["ReadOnDemandThroughputSettings"])?.["MaxReadRequestUnits"];
+			const rawReadGsi = asRecord$1(gsi["ReadOnDemandThroughputSettings"])?.["MaxReadRequestUnits"];
+			reportUnresolvedRawMember(rawWrite, diagnostics, {
+				...typeof indexName === "string" && { indexName },
+				blockName: "WriteOnDemandThroughputSettings",
+				member: "MaxWriteRequestUnits"
+			});
+			reportUnresolvedRawMember(rawReadLocal !== void 0 ? rawReadLocal : rawReadGsi, diagnostics, {
+				...typeof indexName === "string" && { indexName },
+				blockName: rawReadLocal !== void 0 ? "Replicas[local].GlobalSecondaryIndexes[].ReadOnDemandThroughputSettings" : "ReadOnDemandThroughputSettings",
+				member: "MaxReadRequestUnits"
+			});
+			const maxWrite = toFiniteNumber(rawWrite);
+			const maxRead = toFiniteNumber(rawReadLocal) ?? toFiniteNumber(rawReadGsi);
+			const merged = mergeExplicitThroughputBlock(explicitOnDemand, {
 				...maxRead !== void 0 && { MaxReadRequestUnits: maxRead },
 				...maxWrite !== void 0 && { MaxWriteRequestUnits: maxWrite }
-			};
+			}, ["MaxReadRequestUnits", "MaxWriteRequestUnits"], diagnostics, {
+				...typeof indexName === "string" && { indexName },
+				blockName: "OnDemandThroughput"
+			});
+			if (merged) sdk.OnDemandThroughput = merged;
 		}
 		result.push(sdk);
 	}
@@ -13972,7 +14228,7 @@ function toSdkGlobalSecondaryIndexes(properties, region, billingMode, source = "
 * is issue #1440 one level up from where the member test looks.
 */
 function isUnresolvedIntrinsicBlock(value) {
-	const record = asRecord(value);
+	const record = asRecord$1(value);
 	if (!record) return false;
 	const keys = Object.keys(record);
 	return keys.length > 0 && keys.every((k) => k === "Ref" || k.startsWith("Fn::"));
@@ -14014,31 +14270,25 @@ function collectRawOnDemandDeclarations(properties, region) {
 	const rawIndexes = properties["GlobalSecondaryIndexes"];
 	if (!Array.isArray(rawIndexes)) return out;
 	const replicas = properties["Replicas"];
-	const localReplicaIndexes = asRecord(Array.isArray(replicas) ? replicas.find((r) => asRecord(r)?.["Region"] === region) : void 0)?.["GlobalSecondaryIndexes"];
+	const localReplicaIndexes = asRecord$1(Array.isArray(replicas) ? replicas.find((r) => asRecord$1(r)?.["Region"] === region) : void 0)?.["GlobalSecondaryIndexes"];
 	const localByName = /* @__PURE__ */ new Map();
 	if (Array.isArray(localReplicaIndexes)) for (const entry of localReplicaIndexes) {
-		const record = asRecord(entry);
+		const record = asRecord$1(entry);
 		const name = record?.["IndexName"];
 		if (record && typeof name === "string") localByName.set(name, record);
 	}
 	for (const entry of rawIndexes) {
-		const gsi = asRecord(entry);
+		const gsi = asRecord$1(entry);
 		const name = gsi?.["IndexName"];
 		if (!gsi || typeof name !== "string") continue;
 		const localEntry = localByName.get(name);
-		const explicitOnDemand = asRecord(gsi["OnDemandThroughput"]);
-		if (explicitOnDemand) {
-			out.set(name, {
-				readDeclared: explicitOnDemand["MaxReadRequestUnits"] !== void 0,
-				writeDeclared: explicitOnDemand["MaxWriteRequestUnits"] !== void 0
-			});
-			continue;
-		}
+		const explicitOnDemand = asRecord$1(gsi["OnDemandThroughput"]);
+		const explicitIsIntrinsic = isUnresolvedIntrinsicBlock(gsi["OnDemandThroughput"]);
 		const readBlocks = [localEntry?.["ReadOnDemandThroughputSettings"], gsi["ReadOnDemandThroughputSettings"]];
 		const writeBlock = gsi["WriteOnDemandThroughputSettings"];
 		out.set(name, {
-			readDeclared: readBlocks.some((block) => asRecord(block)?.["MaxReadRequestUnits"] !== void 0 || isUnresolvedIntrinsicBlock(block)),
-			writeDeclared: asRecord(writeBlock)?.["MaxWriteRequestUnits"] !== void 0 || isUnresolvedIntrinsicBlock(writeBlock)
+			readDeclared: explicitOnDemand?.["MaxReadRequestUnits"] !== void 0 || explicitIsIntrinsic || readBlocks.some((block) => asRecord$1(block)?.["MaxReadRequestUnits"] !== void 0 || isUnresolvedIntrinsicBlock(block)),
+			writeDeclared: explicitOnDemand?.["MaxWriteRequestUnits"] !== void 0 || explicitIsIntrinsic || asRecord$1(writeBlock)?.["MaxWriteRequestUnits"] !== void 0 || isUnresolvedIntrinsicBlock(writeBlock)
 		});
 	}
 	return out;
@@ -14063,23 +14313,113 @@ function collectRawOnDemandDeclarations(properties, region) {
 * status back in `readCurrentState`). Recorded here rather than silently
 * dropped; tracked with the other GlobalTable nested-key gaps.
 */
-function toSdkReplicaGlobalSecondaryIndexes(replicaIndexes) {
+function toSdkReplicaGlobalSecondaryIndexes(replicaIndexes, billingMode, diagnostics) {
 	if (!Array.isArray(replicaIndexes) || replicaIndexes.length === 0) return void 0;
 	return replicaIndexes.map((entry) => {
-		const cfn = asRecord(entry);
+		const cfn = asRecord$1(entry);
 		if (!cfn) return entry;
-		const sdk = { IndexName: cfn["IndexName"] };
-		const explicitProvisioned = asRecord(cfn["ProvisionedThroughputOverride"]);
-		const explicitOnDemand = asRecord(cfn["OnDemandThroughputOverride"]);
-		const readCapacity = deriveReadCapacityUnits(asRecord(cfn["ReadProvisionedThroughputSettings"]));
-		const maxReadRequestUnits = toFiniteNumber(asRecord(cfn["ReadOnDemandThroughputSettings"])?.["MaxReadRequestUnits"]);
-		if (explicitProvisioned) sdk.ProvisionedThroughputOverride = explicitProvisioned;
-		else if (readCapacity !== void 0) sdk.ProvisionedThroughputOverride = { ReadCapacityUnits: readCapacity };
-		if (explicitOnDemand) sdk.OnDemandThroughputOverride = explicitOnDemand;
-		else if (maxReadRequestUnits !== void 0) sdk.OnDemandThroughputOverride = { MaxReadRequestUnits: maxReadRequestUnits };
+		const indexName = cfn["IndexName"];
+		const sdk = { IndexName: indexName };
+		const overrides = toSdkReplicaThroughputOverrides(cfn, billingMode, diagnostics, { ...typeof indexName === "string" && { indexName } });
+		if (overrides.ProvisionedThroughputOverride) sdk.ProvisionedThroughputOverride = overrides.ProvisionedThroughputOverride;
+		if (overrides.OnDemandThroughputOverride) sdk.OnDemandThroughputOverride = overrides.OnDemandThroughputOverride;
 		return sdk;
 	});
 }
+/**
+* The `{Provisioned,OnDemand}ThroughputOverride` pair for ONE replica-scoped
+* CFn block — shared by the per-GSI replica entries and, since issue #1436,
+* by the replica's own TABLE-level entry, which carries the very same two CFn
+* spellings (`ReadProvisionedThroughputSettings` /
+* `ReadOnDemandThroughputSettings`) and maps to the very same two SDK members
+* on `{Create,Update}ReplicationGroupMemberAction`. One helper so the two
+* levels cannot disagree about the mapping.
+*
+* Same #1428 treatment as the GSI-level blocks: coerce, merge an explicit
+* SDK-shaped override PER MEMBER over the derived value, and gate on billing
+* mode. Both override members are READ-side only — a replica has no
+* independent write capacity, since writes replicate from the source table.
+*/
+function toSdkReplicaThroughputOverrides(cfn, billingMode, diagnostics, context) {
+	const explicitProvisioned = asRecord$1(cfn["ProvisionedThroughputOverride"]);
+	const explicitOnDemand = asRecord$1(cfn["OnDemandThroughputOverride"]);
+	if (explicitProvisioned && billingMode !== "PROVISIONED") diagnostics?.push({
+		kind: "billing-mode-mismatch",
+		...context,
+		member: "ProvisionedThroughputOverride",
+		message: `an explicit ProvisionedThroughputOverride was dropped because the table's BillingMode is ${billingMode}; AWS rejects provisioned capacity on an on-demand table.`
+	});
+	if (explicitOnDemand && billingMode === "PROVISIONED") diagnostics?.push({
+		kind: "billing-mode-mismatch",
+		...context,
+		member: "OnDemandThroughputOverride",
+		message: "an explicit OnDemandThroughputOverride was dropped because the table's BillingMode is PROVISIONED; AWS rejects on-demand ceilings on a provisioned table."
+	});
+	if (billingMode === "PROVISIONED") {
+		const readCapacity = deriveReadCapacityUnits(asRecord$1(cfn["ReadProvisionedThroughputSettings"]));
+		const merged = mergeExplicitThroughputBlock(explicitProvisioned, readCapacity !== void 0 ? { ReadCapacityUnits: readCapacity } : void 0, ["ReadCapacityUnits"], diagnostics, {
+			...context,
+			blockName: "ProvisionedThroughputOverride"
+		});
+		return merged ? { ProvisionedThroughputOverride: merged } : {};
+	}
+	const rawMaxRead = asRecord$1(cfn["ReadOnDemandThroughputSettings"])?.["MaxReadRequestUnits"];
+	reportUnresolvedRawMember(rawMaxRead, diagnostics, {
+		...context,
+		blockName: "ReadOnDemandThroughputSettings",
+		member: "MaxReadRequestUnits"
+	});
+	const maxReadRequestUnits = toFiniteNumber(rawMaxRead);
+	const merged = mergeExplicitThroughputBlock(explicitOnDemand, maxReadRequestUnits !== void 0 ? { MaxReadRequestUnits: maxReadRequestUnits } : void 0, ["MaxReadRequestUnits"], diagnostics, {
+		...context,
+		blockName: "OnDemandThroughputOverride"
+	});
+	return merged ? { OnDemandThroughputOverride: merged } : {};
+}
+/**
+* The TABLE-level on-demand ceilings, gathered from the two DIFFERENT places
+* the CFn `AWS::DynamoDB::GlobalTable` shape puts them (issue #1436).
+*
+* The write ceiling is top-level `WriteOnDemandThroughputSettings`, but the
+* READ ceiling lives on the LOCAL REPLICA as `ReadOnDemandThroughputSettings`
+* — the same write-here / read-on-the-replica split #1387 established one
+* level down for a GSI. The provider read only the write half, so the plain
+* CDK spelling
+*
+*     billing: Billing.onDemand({ maxReadRequestUnits: 100, maxWriteRequestUnits: 200 })
+*
+* deployed a table with NO read ceiling and reported success. That is a
+* drop on the way IN, not the absent-field-reset class of #1423 / #1434.
+*
+* The registry schema (`cloudformation:DescribeType`, 2026-08-09) confirms the
+* member on `ReplicaSpecification`:
+* `ReadOnDemandThroughputSettings: { MaxReadRequestUnits: integer, minimum 1 }`.
+*/
+function collectTableOnDemandCeilings(properties, region, diagnostics) {
+	const writeBlock = properties["WriteOnDemandThroughputSettings"];
+	const replicas = properties["Replicas"];
+	const readBlock = asRecord$1(Array.isArray(replicas) ? replicas.find((r) => asRecord$1(r)?.["Region"] === region) : void 0)?.["ReadOnDemandThroughputSettings"];
+	const rawRead = asRecord$1(readBlock)?.["MaxReadRequestUnits"];
+	const rawWrite = asRecord$1(writeBlock)?.["MaxWriteRequestUnits"];
+	reportUnresolvedRawMember(rawRead, diagnostics, {
+		blockName: "Replicas[local].ReadOnDemandThroughputSettings",
+		member: "MaxReadRequestUnits"
+	});
+	reportUnresolvedRawMember(rawWrite, diagnostics, {
+		blockName: "WriteOnDemandThroughputSettings",
+		member: "MaxWriteRequestUnits"
+	});
+	return {
+		read: {
+			declared: rawRead !== void 0 || isUnresolvedIntrinsicBlock(readBlock),
+			value: toFiniteNumber(rawRead)
+		},
+		write: {
+			declared: rawWrite !== void 0 || isUnresolvedIntrinsicBlock(writeBlock),
+			value: toFiniteNumber(rawWrite)
+		}
+	};
+}
 function diffReplicas(oldReplicas, newReplicas) {
 	const oldByRegion = /* @__PURE__ */ new Map();
 	const newByRegion = /* @__PURE__ */ new Map();
@@ -33237,6 +33577,7 @@ var GlueProvider = class {
 		try {
 			const builtTableInput = this.buildTableInput(tableInput, tableName);
 			this.preserveAwsManagedParameters(builtTableInput, tableInput["Parameters"], (previousProperties?.["TableInput"])?.["Parameters"], live.parameters);
+			this.preserveAwsManagedStorageDescriptor(builtTableInput, tableInput, previousProperties?.["TableInput"], live.storageDescriptor);
 			await this.getClient().send(new UpdateTableCommand$1({
 				...catalogId !== void 0 && { CatalogId: catalogId },
 				DatabaseName: databaseName,
@@ -33253,7 +33594,7 @@ var GlueProvider = class {
 			let message = `Failed to update Glue Table ${logicalId}: ${error instanceof Error ? error.message : String(error)}`;
 			if (error instanceof ConcurrentModificationException) {
 				message += ". Another writer changed the table between cdkd's pre-update read and its UpdateTable call.";
-				message += live.versionId !== void 0 ? ` cdkd sent the version it read (${live.versionId}) as a precondition and AWS rejected the write, rather than let it put back the AWS-managed Parameters read a moment earlier — which for an Apache Iceberg table would have pinned it to an older metadata_location (an effective snapshot rollback).` : " AWS returned no VersionId on the pre-update read, so cdkd could not attach a precondition; AWS rejected the write on its own.";
+				message += live.versionId !== void 0 ? ` cdkd sent the version it read (${live.versionId}) as a precondition and AWS rejected the write, rather than let it put back the AWS-managed Parameters and StorageDescriptor members read a moment earlier — which for an Apache Iceberg table would have pinned it to an older metadata_location (an effective snapshot rollback).` : " AWS returned no VersionId on the pre-update read, so cdkd could not attach a precondition; AWS rejected the write on its own.";
 				message += ` Re-run the deploy to pick up the current values.`;
 			}
 			throw new ProvisioningError(message, resourceType, logicalId, physicalId, cause);
@@ -33343,8 +33684,91 @@ var GlueProvider = class {
 		};
 	}
 	/**
-	* The live table state {@link preserveAwsManagedParameters} needs: its
-	* current `Parameters` plus the `VersionId` that pins them.
+	* Read-merge-write for out-of-band-authored `TableInput.StorageDescriptor`
+	* members (issue #1479) — the subtree sibling of
+	* {@link preserveAwsManagedParameters}, applied per SD MEMBER, with the two
+	* nested bags (`StorageDescriptor.Parameters`, `SerdeInfo.Parameters`)
+	* getting the same per-KEY rule one level down.
+	*
+	* Live probes (2026-08-10, us-east-1 — recorded on issue #1479) established
+	* WHO authors what, which is why this is per-member rather than a blanket
+	* merge:
+	*
+	* - A USER-authored `EXTERNAL_TABLE`: re-sending the template verbatim
+	*   reads back identical — the service itself authors only scalar defaults
+	*   (`Compressed: false`, `NumberOfBuckets: 0`, ...). Full-replace is
+	*   CORRECT for template-declared members, and `drift --revert` depends on
+	*   it to clear console-side edits.
+	* - A CRAWLER-populated table: the crawler authors `Columns`,
+	*   `InputFormat` / `OutputFormat`, `SerdeInfo` (incl. its `Parameters`
+	*   bag), and `StorageDescriptor.Parameters`; an UpdateTable restating only
+	*   a minimal template wiped ALL of them (`Columns` -> `[]`, `SerdeInfo`
+	*   gone) while reporting success.
+	* - An ICEBERG table: an UpdateTable omitting `Columns` was ACCEPTED and
+	*   wiped the catalog schema to `[]` (Glue re-derives Iceberg columns from
+	*   table metadata, so the catalog copy is metadata-authored between
+	*   engine commits).
+	*
+	* The preservation key is the SAME "present in NEITHER template side" test
+	* as {@link preserveAwsManagedParameters}, per member:
+	*
+	* | member in desired | member in previous | outcome                            |
+	* | ----------------- | ------------------ | ---------------------------------- |
+	* | yes               | (either)           | template wins                      |
+	* | no                | yes                | the USER REMOVED it -> stays removed |
+	* | no                | no                 | out-of-band authored -> carried forward from live |
+	*
+	* A template that never declared `StorageDescriptor` on EITHER side (a
+	* crawler-managed table adopted into a minimal template) carries the whole
+	* live block forward. Deliberately scoped to the `StorageDescriptor`
+	* subtree per issue #1479 — the crawler also authors `PartitionKeys` /
+	* `Owner`, but widening beyond the issue's member set is a separate
+	* decision (recorded there).
+	*
+	* TOCTOU: the write rides the same unconditional `VersionId` precondition
+	* as the Parameters merge (see {@link readLiveTableState}), so a concurrent
+	* out-of-band write fails the update loudly instead of being clobbered.
+	*/
+	preserveAwsManagedStorageDescriptor(built, desiredTableInput, previousTableInput, liveSd) {
+		if (!liveSd || Object.keys(liveSd).length === 0) return;
+		const desiredSdRaw = desiredTableInput["StorageDescriptor"];
+		const previousSdRaw = asRecord(previousTableInput)?.["StorageDescriptor"];
+		if (desiredSdRaw === void 0 && previousSdRaw === void 0) {
+			built.StorageDescriptor = liveSd;
+			return;
+		}
+		const desiredKeys = parameterKeySet(desiredSdRaw);
+		const previousKeys = parameterKeySet(previousSdRaw);
+		const sdOut = { ...built.StorageDescriptor ?? {} };
+		for (const [member, liveValue] of Object.entries(liveSd)) {
+			if (liveValue === void 0) continue;
+			if (desiredKeys.has(member) || previousKeys.has(member)) continue;
+			sdOut[member] = liveValue;
+		}
+		const desiredSd = asRecord(desiredSdRaw);
+		const previousSd = asRecord(previousSdRaw);
+		if (desiredKeys.has("Parameters") || previousKeys.has("Parameters")) this.preserveAwsManagedParameters(sdOut, desiredSd?.["Parameters"], previousSd?.["Parameters"], liveSd.Parameters);
+		if (desiredKeys.has("SerdeInfo") && liveSd.SerdeInfo) {
+			const desiredSerde = asRecord(desiredSd?.["SerdeInfo"]);
+			const previousSerde = asRecord(previousSd?.["SerdeInfo"]);
+			const desiredSerdeKeys = parameterKeySet(desiredSerde);
+			const previousSerdeKeys = parameterKeySet(previousSerde);
+			const serdeOut = { ...sdOut["SerdeInfo"] ?? {} };
+			for (const [member, liveValue] of Object.entries(liveSd.SerdeInfo)) {
+				if (liveValue === void 0) continue;
+				if (desiredSerdeKeys.has(member) || previousSerdeKeys.has(member)) continue;
+				serdeOut[member] = liveValue;
+			}
+			if (desiredSerdeKeys.has("Parameters") || previousSerdeKeys.has("Parameters")) this.preserveAwsManagedParameters(serdeOut, desiredSerde?.["Parameters"], previousSerde?.["Parameters"], liveSd.SerdeInfo.Parameters);
+			if (Object.keys(serdeOut).length > 0) sdOut["SerdeInfo"] = serdeOut;
+		}
+		if (Object.keys(sdOut).length > 0) built.StorageDescriptor = sdOut;
+	}
+	/**
+	* The live table state the two merges need: its current `Parameters` (for
+	* {@link preserveAwsManagedParameters}), its `StorageDescriptor` (for
+	* {@link preserveAwsManagedStorageDescriptor}, issue #1479), plus the
+	* `VersionId` that pins both.
 	*
 	* A missing table returns empty rather than throwing: `UpdateTable` is about
 	* to surface the real, more actionable error. Any OTHER failure is fatal by
@@ -33393,11 +33817,13 @@ var GlueProvider = class {
 			}));
 			return {
 				parameters: resp.Table?.Parameters,
+				storageDescriptor: resp.Table?.StorageDescriptor,
 				versionId: resp.Table?.VersionId
 			};
 		} catch (error) {
 			if (error instanceof EntityNotFoundException) return {
 				parameters: void 0,
+				storageDescriptor: void 0,
 				versionId: void 0
 			};
 			throw new ProvisioningError(preUpdateReadFailureMessage("Table", "glue:GetTable", logicalId, error), resourceType, logicalId, physicalId, error instanceof Error ? error : void 0);
@@ -34433,6 +34859,19 @@ function parameterKeySet(value) {
 	return new Set(Object.keys(value));
 }
 /**
+* Narrow an unknown template / state value to a plain object, or `undefined`.
+* A malformed side (string / array / null) yields `undefined` and therefore
+* an empty key set — the tolerant treatment `parameterKeySet` already gives
+* bags, extended to the StorageDescriptor merge's containers. (An unresolved
+* intrinsic is itself a plain object, so it passes through and contributes
+* its `Fn::*`/`Ref` key — harmless here, since providers only ever see
+* resolved values.)
+*/
+function asRecord(value) {
+	if (typeof value !== "object" || value === null || Array.isArray(value)) return;
+	return value;
+}
+/**
 * Message for a failed pre-update `Get*` read (issue #1461). Names the IAM
 * action so a permission gap is one line away from fixed, and says what the
 * read is FOR so the failure does not read as gratuitous.
@@ -66008,7 +66447,7 @@ function createMigrateCommand() {
 */
 function buildProgram() {
 	const program = new Command();
-	program.name("cdkd").description("CDK Direct - Deploy AWS CDK apps directly via SDK/Cloud Control API").version("0.278.30");
+	program.name("cdkd").description("CDK Direct - Deploy AWS CDK apps directly via SDK/Cloud Control API").version("0.278.32");
 	program.hook("preAction", (_thisCommand, actionCommand) => {
 		const { profile } = actionCommand.optsWithGlobals();
 		if (profile !== void 0) process.env["AWS_PROFILE"] = profile;