@go-to-k/cdkd 0.278.36 → 0.278.37

package/dist/cli.js

@@ -1,7 +1,7 @@
 #!/usr/bin/env node
-import { $ as describeTypeWithThrottleRetry, $t as AwsClients, A as red, At as Synthesizer, B as isTerminationProtectionPropagationError, Bt as resolveUseCdkBootstrapAssets, C as isStatefulRecreateTargetSync, Ct as buildDockerImage, D as cyan, Dt as runDockerStreaming, E as bold, Et as runDockerForeground, F as ProviderRegistry, Ft as resolveAutoAssetStorage, G as normalizeAwsTagsToCfn, Gt as MIGRATE_TMP_PREFIX, H as cfnRefValueFromPhysicalId, Ht as warnDeprecatedNoPrefixCliFlag, I as findActionableSilentDrops, It as resolveCaptureObservedState, J as readConfigString, Jt as expectedOwnerParam, K as resolveExplicitPhysicalId, Kt as findLargeInlineResources, L as CloudControlProvider, Lt as resolveSkipPrefix, M as IAMRoleProvider, Mt as getDefaultStateBucketName, N as collectInlinePolicyNamesManagedBySiblings, Nt as getLegacyStateBucketName, O as gray, Ot as AssetManifestLoader, P as clearOnUpdateRemoval, Pt as resolveApp, Q as DiffCalculator, Qt as resolveBucketRegion, R as slowCcOperationTimeoutMs, Rt as resolveStateBucketWithDefault, S as MULTI_REGION_RECREATE_BLOCKED_TYPES, St as validateContainerRepoName, T as formatResourceLine, Tn as withErrorHandling, Tt as getDockerCmd, U as refStateLookupFromResource, Ut as CFN_TEMPLATE_BODY_LIMIT, V as IntrinsicFunctionResolver, Vt as stateBucketExistenceConfirmed, W as WAFv2WebACLProvider, Wt as CFN_TEMPLATE_URL_LIMIT, X as requireConfigString, Xt as processStackMessages, Y as requireConfigArray, Yt as AssemblyReader, Z as applyRoleArnIfSet, _ as createPreDeleteFinalSnapshot, _n as ResourceUpdateNotSupportedError, _t as BOOTSTRAP_MARKER_PREFIX, a as DeploymentEventsStore, at as LockManager, b as unsupportedFinalSnapshotError, bt as parseBootstrapMarker, c as replayFailedOperations, cn as LocalInvokeBuildError$1, ct as shouldRetainResource, d as IMPLICIT_DELETE_DEPENDENCIES, dt as WorkGraph, en as getAwsClients, et as withRetry, f as computeImplicitDeleteEdges, fn as MissingCdkCliError, ft as buildAssetRedirectMap, g as ccRoutedFinalSnapshotError, gn as ResourceTimeoutError, gt as AssetModeResolver, h as buildFinalSnapshotIdentifier, hn as ProvisioningError, ht as rewriteTemplateAssetReferences, i as DeploymentEventsReader, in as CdkdError, it as TemplateParser, j as yellow, jt as synthesisStatusMessage, k as green, kt as getDockerImageBySourceHash, l as replayRollback, ln as LocalMigrateError, lt as AssetPublisher, m as PRE_DELETE_SNAPSHOT_TYPES, mn as PartialFailureError, mt as loadPublishableAssetManifest, n as DEFAULT_RESOURCE_WARN_AFTER_MS, nn as setAwsClients, nt as isThrottlingError, o as planFailedOps, ot as S3StateBackend, p as ATOMIC_FINAL_SNAPSHOT_TYPES, pn as NestedStackChildDirectDestroyError, pt as createAssetRedirectResolver, q as assertRegionMatch, qt as uploadCfnTemplate, r as DeployEngine, rt as DagBuilder, s as planRollback, sn as DeployCancelledError, st as rebuildClientForBucketRegion, t as DEFAULT_RESOURCE_TIMEOUT_MS, tn as resetAwsClients, tt as isRetryableTransientError, u as withResourceDeadline, un as LocalStartServiceError, ut as stringifyValue, v as isFinalSnapshotError, vn as StackHasActiveImportsError, vt as ensureAssetStorage, w as renderStatefulReason, wn as normalizeAwsError, wt as formatDockerLoginError, x as extractDeploymentEventError, xt as validateAssetBucketName, y as refusesFinalSnapshot, yn as StackTerminationProtectionError, yt as getBootstrapMarkerKey, z as disableInstanceApiTermination, zt as resolveStateBucketWithDefaultAndSource } from "./deploy-engine-iHGY-Q_U.js";
+import { $ as describeTypeWithThrottleRetry, $t as AwsClients, A as red, At as Synthesizer, B as isTerminationProtectionPropagationError, Bt as resolveUseCdkBootstrapAssets, C as isStatefulRecreateTargetSync, Ct as buildDockerImage, D as cyan, Dt as runDockerStreaming, E as bold, Et as runDockerForeground, F as ProviderRegistry, Ft as resolveAutoAssetStorage, G as normalizeAwsTagsToCfn, Gt as MIGRATE_TMP_PREFIX, H as cfnRefValueFromPhysicalId, Ht as warnDeprecatedNoPrefixCliFlag, I as findActionableSilentDrops, It as resolveCaptureObservedState, J as readConfigString, Jt as expectedOwnerParam, K as resolveExplicitPhysicalId, Kt as findLargeInlineResources, L as CloudControlProvider, Lt as resolveSkipPrefix, M as IAMRoleProvider, Mt as getDefaultStateBucketName, N as collectInlinePolicyNamesManagedBySiblings, Nt as getLegacyStateBucketName, O as gray, Ot as AssetManifestLoader, P as clearOnUpdateRemoval, Pt as resolveApp, Q as DiffCalculator, Qt as resolveBucketRegion, R as slowCcOperationTimeoutMs, Rt as resolveStateBucketWithDefault, S as MULTI_REGION_RECREATE_BLOCKED_TYPES, St as validateContainerRepoName, T as formatResourceLine, Tn as withErrorHandling, Tt as getDockerCmd, U as refStateLookupFromResource, Ut as CFN_TEMPLATE_BODY_LIMIT, V as IntrinsicFunctionResolver, Vt as stateBucketExistenceConfirmed, W as WAFv2WebACLProvider, Wt as CFN_TEMPLATE_URL_LIMIT, X as requireConfigString, Xt as processStackMessages, Y as requireConfigArray, Yt as AssemblyReader, Z as applyRoleArnIfSet, _ as createPreDeleteFinalSnapshot, _n as ResourceUpdateNotSupportedError, _t as BOOTSTRAP_MARKER_PREFIX, a as DeploymentEventsStore, at as LockManager, b as unsupportedFinalSnapshotError, bt as parseBootstrapMarker, c as replayFailedOperations, cn as LocalInvokeBuildError$1, ct as shouldRetainResource, d as IMPLICIT_DELETE_DEPENDENCIES, dt as WorkGraph, en as getAwsClients, et as withRetry, f as computeImplicitDeleteEdges, fn as MissingCdkCliError, ft as buildAssetRedirectMap, g as ccRoutedFinalSnapshotError, gn as ResourceTimeoutError, gt as AssetModeResolver, h as buildFinalSnapshotIdentifier, hn as ProvisioningError, ht as rewriteTemplateAssetReferences, i as DeploymentEventsReader, in as CdkdError, it as TemplateParser, j as yellow, jt as synthesisStatusMessage, k as green, kt as getDockerImageBySourceHash, l as replayRollback, ln as LocalMigrateError, lt as AssetPublisher, m as PRE_DELETE_SNAPSHOT_TYPES, mn as PartialFailureError, mt as loadPublishableAssetManifest, n as DEFAULT_RESOURCE_WARN_AFTER_MS, nn as setAwsClients, nt as isThrottlingError, o as planFailedOps, ot as S3StateBackend, p as ATOMIC_FINAL_SNAPSHOT_TYPES, pn as NestedStackChildDirectDestroyError, pt as createAssetRedirectResolver, q as assertRegionMatch, qt as uploadCfnTemplate, r as DeployEngine, rt as DagBuilder, s as planRollback, sn as DeployCancelledError, st as rebuildClientForBucketRegion, t as DEFAULT_RESOURCE_TIMEOUT_MS, tn as resetAwsClients, tt as isRetryableTransientError, u as withResourceDeadline, un as LocalStartServiceError, ut as stringifyValue, v as isFinalSnapshotError, vn as StackHasActiveImportsError, vt as ensureAssetStorage, w as renderStatefulReason, wn as normalizeAwsError, wt as formatDockerLoginError, x as extractDeploymentEventError, xt as validateAssetBucketName, y as refusesFinalSnapshot, yn as StackTerminationProtectionError, yt as getBootstrapMarkerKey, z as disableInstanceApiTermination, zt as resolveStateBucketWithDefaultAndSource } from "./deploy-engine-bEhHOGVR.js";
 import { a as getLiveRenderer, c as PATTERN_B_RESOURCE_TYPES, d as generateResourceNameWithFallback, f as withSkipPrefix, i as runStackBuffered, n as getLogger, o as PATTERN_B_NAME_OPTIONS, p as withStackName, s as PATTERN_B_NAME_PROPERTIES, u as generateResourceName } from "./logger-BYMEE-BS.js";
-import { t as ASGProvider } from "./asg-provider-5hYG8VHd.js";
+import { t as ASGProvider } from "./asg-provider-BTeSlton.js";
 import { AsyncLocalStorage } from "node:async_hooks";
 import { createHash, randomBytes, randomUUID } from "node:crypto";
 import { CopyObjectCommand, CreateBucketCommand, DeleteBucketAnalyticsConfigurationCommand, DeleteBucketCommand, DeleteBucketCorsCommand, DeleteBucketEncryptionCommand, DeleteBucketIntelligentTieringConfigurationCommand, DeleteBucketInventoryConfigurationCommand, DeleteBucketLifecycleCommand, DeleteBucketMetricsConfigurationCommand, DeleteBucketOwnershipControlsCommand, DeleteBucketPolicyCommand, DeleteBucketReplicationCommand, DeleteBucketTaggingCommand, DeleteBucketWebsiteCommand, DeleteObjectsCommand, GetBucketAccelerateConfigurationCommand, GetBucketCorsCommand, GetBucketEncryptionCommand, GetBucketLifecycleConfigurationCommand, GetBucketLocationCommand, GetBucketLoggingCommand, GetBucketNotificationConfigurationCommand, GetBucketOwnershipControlsCommand, GetBucketPolicyCommand, GetBucketReplicationCommand, GetBucketTaggingCommand, GetBucketVersioningCommand, GetBucketWebsiteCommand, GetObjectCommand, GetObjectLockConfigurationCommand, GetPublicAccessBlockCommand, HeadBucketCommand, ListBucketAnalyticsConfigurationsCommand, ListBucketIntelligentTieringConfigurationsCommand, ListBucketInventoryConfigurationsCommand, ListBucketMetricsConfigurationsCommand, ListObjectVersionsCommand, ListObjectsV2Command, NoSuchBucket, PutBucketAccelerateConfigurationCommand, PutBucketAnalyticsConfigurationCommand, PutBucketCorsCommand, PutBucketEncryptionCommand, PutBucketIntelligentTieringConfigurationCommand, PutBucketInventoryConfigurationCommand, PutBucketLifecycleConfigurationCommand, PutBucketLoggingCommand, PutBucketMetricsConfigurationCommand, PutBucketNotificationConfigurationCommand, PutBucketOwnershipControlsCommand, PutBucketPolicyCommand, PutBucketReplicationCommand, PutBucketTaggingCommand, PutBucketVersioningCommand, PutBucketWebsiteCommand, PutObjectCommand, PutObjectLockConfigurationCommand, PutPublicAccessBlockCommand, S3Client, S3ServiceException } from "@aws-sdk/client-s3";
@@ -12315,7 +12315,8 @@ var DynamoDBGlobalTableProvider = class {
 			AttributeDefinitions: attributeDefinitions,
 			BillingMode: billingMode
 		};
-		if (billingMode === "PROVISIONED") createParams.ProvisionedThroughput = derivePerCallProvisionedThroughput(properties, currentRegion);
+		const diagnostics = [];
+		if (billingMode === "PROVISIONED") createParams.ProvisionedThroughput = derivePerCallProvisionedThroughput(properties, currentRegion, "min", diagnostics);
 		const streamSpecInput = properties["StreamSpecification"];
 		const needsStream = replicas.some((r) => r["Region"] !== currentRegion) || replicas.length > 1;
 		if (streamSpecInput != null) {
@@ -12336,7 +12337,6 @@ var DynamoDBGlobalTableProvider = class {
 				StreamViewType: "NEW_AND_OLD_IMAGES"
 			};
 		}
-		const diagnostics = [];
 		let sdkIndexes;
 		try {
 			sdkIndexes = toSdkGlobalSecondaryIndexes(properties, currentRegion, billingMode, "min", diagnostics);
@@ -12552,7 +12552,10 @@ var DynamoDBGlobalTableProvider = class {
 			const onDemandCeilingLive = oldBilling === "PAY_PER_REQUEST" && newBilling === "PAY_PER_REQUEST";
 			const diagnostics = [];
 			const desiredCeilings = collectTableOnDemandCeilings(properties, currentRegion, diagnostics);
-			const desiredSdkIndexes = toSdkGlobalSecondaryIndexes(properties, currentRegion, newBilling, "min", diagnostics);
+			const flippingToProvisioned = oldBilling !== newBilling && newBilling === "PROVISIONED";
+			if (flippingToProvisioned) derivePerCallProvisionedThroughput(properties, currentRegion, "seed", diagnostics);
+			const desiredSdkIndexes = toSdkGlobalSecondaryIndexes(properties, currentRegion, newBilling, "min", flippingToProvisioned ? void 0 : diagnostics);
+			if (flippingToProvisioned) toSdkGlobalSecondaryIndexes(properties, currentRegion, newBilling, "seed", diagnostics);
 			for (const replica of properties["Replicas"] ?? []) {
 				const replicaRegion = asRecord$1(replica)?.["Region"];
 				if (typeof replicaRegion !== "string" || replicaRegion === currentRegion) continue;
@@ -13232,9 +13235,11 @@ var DynamoDBGlobalTableProvider = class {
 			const cause = regionErr instanceof Error ? regionErr : void 0;
 			throw new ProvisioningError(`Could not resolve client region for DynamoDB GlobalTable ${logicalId} delete — would risk dropping the local replica`, resourceType, logicalId, physicalId, cause);
 		}
+		let preDeleteIndexes;
 		try {
 			const describe = await this.dynamoDBClient.send(new DescribeTableCommand({ TableName: physicalId }));
 			const replicas = describe.Table?.Replicas ?? [];
+			preDeleteIndexes = describe.Table?.GlobalSecondaryIndexes;
 			const tableIndexNames = (describe.Table?.GlobalSecondaryIndexes ?? []).map((gsi) => gsi.IndexName).filter((name) => typeof name === "string");
 			for (const replica of replicas) {
 				const region = replica.RegionName;
@@ -13265,6 +13270,10 @@ var DynamoDBGlobalTableProvider = class {
 			}
 		}
 		try {
+			if (hasTransitionalIndex(preDeleteIndexes)) {
+				this.logger.debug(`Waiting for indexes on ${physicalId} to settle before DeleteTable (issue #1521)`);
+				await this.waitForIndexesActive(physicalId, logicalId);
+			}
 			await this.dynamoDBClient.send(new DeleteTableCommand({ TableName: physicalId }));
 			await this.waitForTableGone(physicalId, logicalId);
 			this.logger.debug(`Successfully deleted DynamoDB GlobalTable ${logicalId}`);
@@ -13679,34 +13688,78 @@ var DynamoDBGlobalTableProvider = class {
 	* `waitForTableActive`, this tolerates any non-terminal status — the
 	* table may already be ACTIVE on the no-op path (already-disabled
 	* protection) or transition through UPDATING.
+	*
+	* **A table is ACTIVE while one of its INDEXES is still transitioning**, and
+	* the next `UpdateTable` in the serialized sequence is then rejected with
+	* `Attempt to change a resource which is still in use: Index is being
+	* updated` (issue #1521). That is not hypothetical: it broke the
+	* `PAY_PER_REQUEST -> PROVISIONED` flip that also drops a GSI — AWS applies
+	* the flip to every index, and cdkd issued the index DELETE while the index
+	* was still absorbing it. Reproduced on pristine `main`, three runs out of
+	* four on 2026-08-10, and the failed deploy's own `cdkd destroy` then
+	* ORPHANED the table for the same reason.
+	*
+	* So the wait has TWO conditions read off the SAME response (an extra
+	* `DescribeTable` per wait would double this path's API traffic for
+	* something the response already carries) — but they keep DIFFERENT failure
+	* semantics, and conflating them is a real regression rather than a
+	* simplification. A table that never reaches ACTIVE is a hard error: nothing
+	* can proceed. A still-transitioning INDEX is best-effort: `IndexStatus`
+	* stays `CREATING` for the whole BACKFILL of a newly added GSI, which on a
+	* populated table routinely outlives any cap — so throwing there would fail
+	* a deploy whose resources are all correct, and would do it on an unrelated
+	* tag-only edit that merely ran while an earlier index was still building.
+	* Past the cap the index half warns and proceeds, leaving AWS's own
+	* rejection as the backstop, which is the behavior it had before #1521 for
+	* every case except the one the wait exists to fix.
 	*/
 	async waitForTableActiveAfterUpdate(tableName, logicalId, maxAttempts = 600) {
+		let tableReachedActive = false;
 		for (let attempt = 1; attempt <= maxAttempts; attempt++) {
-			if ((await this.dynamoDBClient.send(new DescribeTableCommand({ TableName: tableName }))).Table?.TableStatus === "ACTIVE") return;
+			const response = await this.dynamoDBClient.send(new DescribeTableCommand({ TableName: tableName }));
+			if (response.Table?.TableStatus === "ACTIVE") {
+				tableReachedActive = true;
+				if (!hasTransitionalIndex(response.Table?.GlobalSecondaryIndexes)) return;
+			}
 			await new Promise((resolve) => setTimeout(resolve, 1e3));
 		}
+		if (tableReachedActive) {
+			this.logger.warn(`Indexes on ${tableName} (${logicalId}) were still transitioning after ${maxAttempts}s — a large index backfill can outlive this wait. Proceeding; AWS rejects the next call if it is still too early.`);
+			return;
+		}
 		throw new ProvisioningError(`Table ${tableName} did not reach ACTIVE within ${maxAttempts}s after UpdateTable`, "AWS::DynamoDB::GlobalTable", logicalId, tableName);
 	}
 	/**
 	* Wait until every GSI reports `IndexStatus: ACTIVE` (Issue #1419).
 	*
-	* `waitForTableActiveAfterUpdate` only checks `TableStatus`, and a GSI
-	* added by `UpdateTable` leaves the TABLE ACTIVE while the index itself
-	* is still `CREATING` — application-autoscaling rejects a target whose
-	* resource is not ready, so registering right after the GSI-add loop
+	* A GSI added by `UpdateTable` leaves the TABLE ACTIVE while the index
+	* itself is still `CREATING` — application-autoscaling rejects a target
+	* whose resource is not ready, so registering right after the GSI-add loop
 	* would skip the very index the deploy just introduced.
 	*
+	* Since issue #1521 the same distinction is enforced INSIDE
+	* {@link waitForTableActiveAfterUpdate} (which now reads both conditions off
+	* its own response), so this helper is no longer the only place that knows
+	* it. It remains the explicit wait for the two callers that have no
+	* table-status wait to piggyback on: the autoscaling registration above and
+	* the pre-`DeleteTable` gate, which AWS rejects while an index is
+	* transitioning. An index that is `DELETING` still reports, so the shared
+	* {@link hasTransitionalIndex} predicate covers `CREATING` / `UPDATING` /
+	* `DELETING` alike.
+	*
 	* **Best-effort by design**: on timeout it warns and returns rather than
 	* throwing. A missed registration self-heals on the next deploy (the
 	* reconcile re-asserts anything not already present), whereas throwing
 	* here would fail a deploy whose actual resources are all correct. Index
 	* backfill on a large table can take a long time, hence the 15-minute cap.
+	* The caller that follows it with a mutating call keeps AWS's own error as
+	* the backstop for the case where even that cap is not enough.
 	*/
 	async waitForIndexesActive(tableName, logicalId) {
 		const maxAttempts = 900;
 		for (let attempt = 1; attempt <= maxAttempts; attempt++) {
 			try {
-				if (((await this.dynamoDBClient.send(new DescribeTableCommand({ TableName: tableName }))).Table?.GlobalSecondaryIndexes ?? []).every((gsi) => gsi.IndexStatus === "ACTIVE")) return;
+				if (!hasTransitionalIndex((await this.dynamoDBClient.send(new DescribeTableCommand({ TableName: tableName }))).Table?.GlobalSecondaryIndexes ?? [])) return;
 			} catch (err) {
 				this.logger.debug(`DescribeTable while waiting for indexes on ${tableName}: ${err instanceof Error ? err.message : String(err)}`);
 				return;
@@ -13810,10 +13863,17 @@ function extractLocalDeletionProtection(props, region) {
 *    literal `ReadCapacityUnits`, which is taken before its auto-scaling
 *    members; 5 if absent.
 */
-function derivePerCallProvisionedThroughput(properties, region, source = "min") {
+function derivePerCallProvisionedThroughput(properties, region, source = "min", diagnostics) {
+	const rawReplicas = properties["Replicas"];
+	const rawRead = (Array.isArray(rawReplicas) ? rawReplicas : []).find((r) => asRecord$1(r)?.["Region"] === region)?.["ReadProvisionedThroughputSettings"];
+	const rawWrite = properties["WriteProvisionedThroughputSettings"];
+	const read = deriveReadCapacityUnits(asRecord$1(rawRead), source);
+	const write = deriveWriteCapacityUnits(asRecord$1(rawWrite), source);
+	if (read === void 0) reportUnresolvedProvisionedCapacity(rawRead, "Read", source, { appliedUnits: DEFAULT_CAPACITY_UNITS }, diagnostics, { blockName: "Replicas[local].ReadProvisionedThroughputSettings" });
+	if (write === void 0) reportUnresolvedProvisionedCapacity(rawWrite, "Write", source, { appliedUnits: DEFAULT_CAPACITY_UNITS }, diagnostics, { blockName: "WriteProvisionedThroughputSettings" });
 	return {
-		ReadCapacityUnits: deriveReadCapacityUnits(asRecord$1((properties["Replicas"] ?? []).find((r) => r["Region"] === region)?.["ReadProvisionedThroughputSettings"]), source) ?? DEFAULT_CAPACITY_UNITS,
-		WriteCapacityUnits: deriveWriteCapacityUnits(asRecord$1(properties["WriteProvisionedThroughputSettings"]), source) ?? DEFAULT_CAPACITY_UNITS
+		ReadCapacityUnits: read ?? DEFAULT_CAPACITY_UNITS,
+		WriteCapacityUnits: write ?? DEFAULT_CAPACITY_UNITS
 	};
 }
 /**
@@ -13968,6 +14028,26 @@ function asRecord$1(value) {
 * read-back comparison must therefore expect ABSENCE, not this value.
 */
 const ON_DEMAND_LIMIT_RESET = -1;
+/**
+* The GSI states during which AWS refuses another `UpdateTable` or a
+* `DeleteTable` on the table (issue #1521) — a table is ACTIVE while one of
+* its indexes is still transitioning, which is what made the serialized
+* update sequence race and what left a table ORPHANED when the follow-up
+* destroy hit the same rule.
+*
+* `DELETING` is included because a dropped index keeps reporting until it is
+* actually gone. The test is on the TRANSITIONAL values rather than on
+* `!== 'ACTIVE'`: an absent or unrecognized status must not park the caller
+* for its whole cap on a table that is fine.
+*/
+const INDEX_TRANSITIONAL_STATUSES = /* @__PURE__ */ new Set([
+	"CREATING",
+	"UPDATING",
+	"DELETING"
+]);
+function hasTransitionalIndex(indexes) {
+	return (indexes ?? []).some((gsi) => INDEX_TRANSITIONAL_STATUSES.has(gsi.IndexStatus ?? ""));
+}
 /** Coerce a CFn numeric (CFn is stringly-typed) to a finite number. */
 function toFiniteNumber(value) {
 	if (value === void 0 || value === null || value === "") return void 0;
@@ -14058,6 +14138,94 @@ function reportUnresolvedRawMember(rawValue, diagnostics, context) {
 	});
 }
 /**
+* Which member of a `*ProvisionedThroughputSettings` block to blame when the
+* derivation came back `undefined` (issue #1511).
+*
+* The derivation reports only "no number", so the member is re-derived here in
+* the SAME order {@link deriveWriteCapacityUnits} / {@link deriveReadCapacityUnits}
+* / {@link pickAutoScalingCapacity} consult members — the literal first, then
+* the auto-scaling block's `source`-selected member. Reaching this function at
+* all means every one of them failed, so the first DECLARED one is the value
+* the user was trying to set.
+*
+* `relPath` is relative to the block, `''` meaning the block ITSELF is the
+* unusable value (a string / array / bare unresolved intrinsic, or an object
+* carrying no capacity member at all).
+*
+* Returns `undefined` for an ABSENT block: defaulting there is the documented
+* pre-existing behavior for a template that never asked for a capacity, and
+* warning about it would shout on every deploy of a table that is fine.
+*/
+function blameUnresolvedProvisionedMember(rawSettings, side, source) {
+	if (rawSettings === void 0) return void 0;
+	const settings = asRecord$1(rawSettings);
+	if (!settings || isUnresolvedIntrinsicBlock(settings)) return {
+		relPath: "",
+		value: rawSettings
+	};
+	const literal = settings[`${side}CapacityUnits`];
+	if (literal !== void 0) return {
+		relPath: `${side}CapacityUnits`,
+		value: literal
+	};
+	const autoKey = `${side}CapacityAutoScalingSettings`;
+	const rawAutoScaling = settings[autoKey];
+	if (rawAutoScaling === void 0) return {
+		relPath: "",
+		value: rawSettings
+	};
+	const autoScaling = asRecord$1(rawAutoScaling);
+	if (!autoScaling || isUnresolvedIntrinsicBlock(autoScaling)) return {
+		relPath: autoKey,
+		value: rawAutoScaling
+	};
+	const order = source === "seed" ? ["SeedCapacity", "MinCapacity"] : ["MinCapacity", "SeedCapacity"];
+	for (const member of order) {
+		const value = autoScaling[member];
+		if (value !== void 0) return {
+			relPath: `${autoKey}.${member}`,
+			value
+		};
+	}
+	return {
+		relPath: autoKey,
+		value: rawAutoScaling
+	};
+}
+/**
+* Report a DECLARED provisioned capacity the template could not resolve — the
+* PROVISIONED twin of {@link reportUnresolvedRawMember} (issue #1511).
+*
+* The two sides need different wording because they have different outcomes,
+* which is exactly why #1503 deferred this half. An unreadable ON-DEMAND
+* ceiling is SUPPRESSED (nothing is sent, the live ceiling stands), so its
+* diagnostic says "nothing was sent". A provisioned table cannot suppress —
+* AWS requires `ProvisionedThroughput` on the table and on every GSI of it —
+* so the derivation falls through to {@link DEFAULT_CAPACITY_UNITS} and a
+* table the template explicitly sized is deployed at 5/5. That is a throttling
+* symptom days later rather than an error, which is what makes naming it here
+* worth a warning at all. The one provisioned site that CAN suppress is a
+* replica's `ProvisionedThroughputOverride` (absent = inherit the source
+* table), hence the `suppressed` outcome arm.
+*
+* Caller decides WHEN: only when the derivation returned `undefined` AND no
+* explicit SDK-shaped member is standing in for it, so the warning always
+* describes what actually reached AWS.
+*/
+function reportUnresolvedProvisionedCapacity(rawSettings, side, source, outcome, diagnostics, context) {
+	if (!diagnostics) return;
+	const blame = blameUnresolvedProvisionedMember(rawSettings, side, source);
+	if (!blame) return;
+	const path = blame.relPath ? `${context.blockName}.${blame.relPath}` : context.blockName;
+	const consequence = "appliedUnits" in outcome ? `so cdkd sent ${outcome.appliedUnits} capacity units instead (its default — AWS requires a concrete provisioned capacity here, so there was nothing to suppress)` : outcome.suppressed;
+	diagnostics.push({
+		kind: "unresolved-member",
+		...context.indexName !== void 0 && { indexName: context.indexName },
+		member: blame.relPath ? blame.relPath.slice(blame.relPath.lastIndexOf(".") + 1) : context.blockName.slice(context.blockName.lastIndexOf(".") + 1),
+		message: `${path} is declared but did not resolve to a number (${JSON.stringify(blame.value)?.slice(0, 80)}), ${consequence}. This is usually an unresolved intrinsic; resolve it to a literal to apply the capacity you declared.`
+	});
+}
+/**
 * Derive a single WRITE capacity number from a CFn
 * `WriteProvisionedThroughputSettings` block.
 *
@@ -14188,14 +14356,32 @@ function toSdkGlobalSecondaryIndexes(properties, region, billingMode, source = "
 			member: "OnDemandThroughput",
 			message: "an explicit OnDemandThroughput block was dropped because the table's BillingMode is PROVISIONED; AWS rejects on-demand ceilings on a provisioned table. Remove the block, or set BillingMode: PAY_PER_REQUEST."
 		});
-		if (billingMode === "PROVISIONED") sdk.ProvisionedThroughput = mergeExplicitThroughputBlock(explicitProvisioned, {
-			ReadCapacityUnits: deriveReadCapacityUnits(asRecord$1(localEntry?.["ReadProvisionedThroughputSettings"]), source) ?? deriveReadCapacityUnits(asRecord$1(gsi["ReadProvisionedThroughputSettings"]), source) ?? DEFAULT_CAPACITY_UNITS,
-			WriteCapacityUnits: deriveWriteCapacityUnits(asRecord$1(gsi["WriteProvisionedThroughputSettings"]), source) ?? DEFAULT_CAPACITY_UNITS
-		}, ["ReadCapacityUnits", "WriteCapacityUnits"], diagnostics, {
-			...typeof indexName === "string" && { indexName },
-			blockName: "ProvisionedThroughput"
-		});
-		else {
+		if (billingMode === "PROVISIONED") {
+			const rawLocalRead = localEntry?.["ReadProvisionedThroughputSettings"];
+			const rawGsiRead = gsi["ReadProvisionedThroughputSettings"];
+			const rawWrite = gsi["WriteProvisionedThroughputSettings"];
+			const derivedRead = deriveReadCapacityUnits(asRecord$1(rawLocalRead), source) ?? deriveReadCapacityUnits(asRecord$1(rawGsiRead), source);
+			const derivedWrite = deriveWriteCapacityUnits(asRecord$1(rawWrite), source);
+			const explicitCovers = (member) => explicitProvisioned !== void 0 && toFiniteNumber(explicitProvisioned[member]) !== void 0;
+			if (derivedRead === void 0 && !explicitCovers("ReadCapacityUnits")) {
+				const fromReplica = rawLocalRead !== void 0;
+				reportUnresolvedProvisionedCapacity(fromReplica ? rawLocalRead : rawGsiRead, "Read", source, { appliedUnits: DEFAULT_CAPACITY_UNITS }, diagnostics, {
+					...typeof indexName === "string" && { indexName },
+					blockName: fromReplica ? "Replicas[local].GlobalSecondaryIndexes[].ReadProvisionedThroughputSettings" : "ReadProvisionedThroughputSettings"
+				});
+			}
+			if (derivedWrite === void 0 && !explicitCovers("WriteCapacityUnits")) reportUnresolvedProvisionedCapacity(rawWrite, "Write", source, { appliedUnits: DEFAULT_CAPACITY_UNITS }, diagnostics, {
+				...typeof indexName === "string" && { indexName },
+				blockName: "WriteProvisionedThroughputSettings"
+			});
+			sdk.ProvisionedThroughput = mergeExplicitThroughputBlock(explicitProvisioned, {
+				ReadCapacityUnits: derivedRead ?? DEFAULT_CAPACITY_UNITS,
+				WriteCapacityUnits: derivedWrite ?? DEFAULT_CAPACITY_UNITS
+			}, ["ReadCapacityUnits", "WriteCapacityUnits"], diagnostics, {
+				...typeof indexName === "string" && { indexName },
+				blockName: "ProvisionedThroughput"
+			});
+		} else {
 			const rawWrite = asRecord$1(gsi["WriteOnDemandThroughputSettings"])?.["MaxWriteRequestUnits"];
 			const rawReadLocal = asRecord$1(localEntry?.["ReadOnDemandThroughputSettings"])?.["MaxReadRequestUnits"];
 			const rawReadGsi = asRecord$1(gsi["ReadOnDemandThroughputSettings"])?.["MaxReadRequestUnits"];
@@ -14364,7 +14550,12 @@ function toSdkReplicaThroughputOverrides(cfn, billingMode, diagnostics, context)
 		message: "an explicit OnDemandThroughputOverride was dropped because the table's BillingMode is PROVISIONED; AWS rejects on-demand ceilings on a provisioned table."
 	});
 	if (billingMode === "PROVISIONED") {
-		const readCapacity = deriveReadCapacityUnits(asRecord$1(cfn["ReadProvisionedThroughputSettings"]));
+		const rawRead = cfn["ReadProvisionedThroughputSettings"];
+		const readCapacity = deriveReadCapacityUnits(asRecord$1(rawRead));
+		if (readCapacity === void 0 && toFiniteNumber(explicitProvisioned?.["ReadCapacityUnits"]) === void 0) reportUnresolvedProvisionedCapacity(rawRead, "Read", "min", { suppressed: "so no ProvisionedThroughputOverride was sent and the replica keeps the source table's read capacity" }, diagnostics, {
+			...context,
+			blockName: "ReadProvisionedThroughputSettings"
+		});
 		const merged = mergeExplicitThroughputBlock(explicitProvisioned, readCapacity !== void 0 ? { ReadCapacityUnits: readCapacity } : void 0, ["ReadCapacityUnits"], diagnostics, {
 			...context,
 			blockName: "ProvisionedThroughputOverride"
@@ -66706,7 +66897,7 @@ function createMigrateCommand() {
 */
 function buildProgram() {
 	const program = new Command();
-	program.name("cdkd").description("CDK Direct - Deploy AWS CDK apps directly via SDK/Cloud Control API").version("0.278.36");
+	program.name("cdkd").description("CDK Direct - Deploy AWS CDK apps directly via SDK/Cloud Control API").version("0.278.37");
 	program.hook("preAction", (_thisCommand, actionCommand) => {
 		const { profile } = actionCommand.optsWithGlobals();
 		if (profile !== void 0) process.env["AWS_PROFILE"] = profile;