@go-to-k/cdkd 0.278.49 → 0.278.50

package/dist/cli.js

@@ -1,7 +1,7 @@
 #!/usr/bin/env node
-import { $ as DiffCalculator, $t as resolveBucketRegion, A as red, At as getDockerImageBySourceHash, B as isTerminationProtectionPropagationError, Bt as resolveStateBucketWithDefaultAndSource, C as isStatefulRecreateTargetSync, Ct as validateContainerRepoName, D as cyan, Dt as runDockerForeground, E as bold, En as withErrorHandling, Et as getDockerCmd, F as ProviderRegistry, Ft as resolveApp, G as normalizeAwsTagsToCfn, Gt as CFN_TEMPLATE_URL_LIMIT, H as cfnRefValueFromPhysicalId, Ht as stateBucketExistenceConfirmed, I as findActionableSilentDrops, It as resolveAutoAssetStorage, J as readConfigString, Jt as uploadCfnTemplate, K as resolveExplicitPhysicalId, Kt as MIGRATE_TMP_PREFIX, L as CloudControlProvider, Lt as resolveCaptureObservedState, M as IAMRoleProvider, Mt as synthesisStatusMessage, N as collectInlinePolicyNamesManagedBySiblings, Nt as getDefaultStateBucketName, O as gray, Ot as runDockerStreaming, P as clearOnUpdateRemoval, Pt as getLegacyStateBucketName, Q as applyRoleArnIfSet, R as slowCcOperationTimeoutMs, Rt as resolveSkipPrefix, S as MULTI_REGION_RECREATE_BLOCKED_TYPES, St as validateAssetBucketName, T as formatResourceLine, Tn as normalizeAwsError, Tt as formatDockerLoginError, U as refStateLookupFromResource, Ut as warnDeprecatedNoPrefixCliFlag, V as IntrinsicFunctionResolver, Vt as resolveUseCdkBootstrapAssets, W as WAFv2WebACLProvider, Wt as CFN_TEMPLATE_BODY_LIMIT, X as requireConfigArray, Xt as AssemblyReader, Y as replayWarn, Yt as expectedOwnerParam, Z as requireConfigString, Zt as processStackMessages, _ as createPreDeleteFinalSnapshot, _n as ResourceTimeoutError, _t as AssetModeResolver, a as DeploymentEventsStore, an as CdkdError, at as TemplateParser, b as unsupportedFinalSnapshotError, bn as StackTerminationProtectionError, bt as getBootstrapMarkerKey, c as replayFailedOperations, cn as DeployCancelledError, ct as rebuildClientForBucketRegion, d as IMPLICIT_DELETE_DEPENDENCIES, dn as LocalStartServiceError, dt as stringifyValue, en as AwsClients, et as describeTypeWithThrottleRetry, f as computeImplicitDeleteEdges, ft as WorkGraph, g as ccRoutedFinalSnapshotError, gn as ProvisioningError, gt as rewriteTemplateAssetReferences, h as buildFinalSnapshotIdentifier, hn as PartialFailureError, ht as loadPublishableAssetManifest, i as DeploymentEventsReader, it as DagBuilder, j as yellow, jt as Synthesizer, k as green, kt as AssetManifestLoader, l as replayRollback, ln as LocalInvokeBuildError$1, lt as shouldRetainResource, m as PRE_DELETE_SNAPSHOT_TYPES, mn as NestedStackChildDirectDestroyError, mt as createAssetRedirectResolver, n as DEFAULT_RESOURCE_WARN_AFTER_MS, nn as resetAwsClients, nt as isRetryableTransientError, o as planFailedOps, ot as LockManager, p as ATOMIC_FINAL_SNAPSHOT_TYPES, pn as MissingCdkCliError, pt as buildAssetRedirectMap, q as assertRegionMatch, qt as findLargeInlineResources, r as DeployEngine, rn as setAwsClients, rt as isThrottlingError, s as planRollback, st as S3StateBackend, t as DEFAULT_RESOURCE_TIMEOUT_MS, tn as getAwsClients, tt as withRetry, u as withResourceDeadline, un as LocalMigrateError, ut as AssetPublisher, v as isFinalSnapshotError, vn as ResourceUpdateNotSupportedError, vt as BOOTSTRAP_MARKER_PREFIX, w as renderStatefulReason, wt as buildDockerImage, x as extractDeploymentEventError, xt as parseBootstrapMarker, y as refusesFinalSnapshot, yn as StackHasActiveImportsError, yt as ensureAssetStorage, z as disableInstanceApiTermination, zt as resolveStateBucketWithDefault } from "./deploy-engine-BgLg1tet.js";
+import { $ as DiffCalculator, $t as resolveBucketRegion, A as red, At as getDockerImageBySourceHash, B as isTerminationProtectionPropagationError, Bt as resolveStateBucketWithDefaultAndSource, C as isStatefulRecreateTargetSync, Ct as validateContainerRepoName, D as cyan, Dt as runDockerForeground, E as bold, En as withErrorHandling, Et as getDockerCmd, F as ProviderRegistry, Ft as resolveApp, G as normalizeAwsTagsToCfn, Gt as CFN_TEMPLATE_URL_LIMIT, H as cfnRefValueFromPhysicalId, Ht as stateBucketExistenceConfirmed, I as findActionableSilentDrops, It as resolveAutoAssetStorage, J as readConfigString, Jt as uploadCfnTemplate, K as resolveExplicitPhysicalId, Kt as MIGRATE_TMP_PREFIX, L as CloudControlProvider, Lt as resolveCaptureObservedState, M as IAMRoleProvider, Mt as synthesisStatusMessage, N as collectInlinePolicyNamesManagedBySiblings, Nt as getDefaultStateBucketName, O as gray, Ot as runDockerStreaming, P as clearOnUpdateRemoval, Pt as getLegacyStateBucketName, Q as applyRoleArnIfSet, R as slowCcOperationTimeoutMs, Rt as resolveSkipPrefix, S as MULTI_REGION_RECREATE_BLOCKED_TYPES, St as validateAssetBucketName, T as formatResourceLine, Tn as normalizeAwsError, Tt as formatDockerLoginError, U as refStateLookupFromResource, Ut as warnDeprecatedNoPrefixCliFlag, V as IntrinsicFunctionResolver, Vt as resolveUseCdkBootstrapAssets, W as WAFv2WebACLProvider, Wt as CFN_TEMPLATE_BODY_LIMIT, X as requireConfigArray, Xt as AssemblyReader, Y as replayWarn, Yt as expectedOwnerParam, Z as requireConfigString, Zt as processStackMessages, _ as createPreDeleteFinalSnapshot, _n as ResourceTimeoutError, _t as AssetModeResolver, a as DeploymentEventsStore, an as CdkdError, at as TemplateParser, b as unsupportedFinalSnapshotError, bn as StackTerminationProtectionError, bt as getBootstrapMarkerKey, c as replayFailedOperations, cn as DeployCancelledError, ct as rebuildClientForBucketRegion, d as IMPLICIT_DELETE_DEPENDENCIES, dn as LocalStartServiceError, dt as stringifyValue, en as AwsClients, et as describeTypeWithThrottleRetry, f as computeImplicitDeleteEdges, ft as WorkGraph, g as ccRoutedFinalSnapshotError, gn as ProvisioningError, gt as rewriteTemplateAssetReferences, h as buildFinalSnapshotIdentifier, hn as PartialFailureError, ht as loadPublishableAssetManifest, i as DeploymentEventsReader, it as DagBuilder, j as yellow, jt as Synthesizer, k as green, kt as AssetManifestLoader, l as replayRollback, ln as LocalInvokeBuildError$1, lt as shouldRetainResource, m as PRE_DELETE_SNAPSHOT_TYPES, mn as NestedStackChildDirectDestroyError, mt as createAssetRedirectResolver, n as DEFAULT_RESOURCE_WARN_AFTER_MS, nn as resetAwsClients, nt as isRetryableTransientError, o as planFailedOps, ot as LockManager, p as ATOMIC_FINAL_SNAPSHOT_TYPES, pn as MissingCdkCliError, pt as buildAssetRedirectMap, q as assertRegionMatch, qt as findLargeInlineResources, r as DeployEngine, rn as setAwsClients, rt as isThrottlingError, s as planRollback, st as S3StateBackend, t as DEFAULT_RESOURCE_TIMEOUT_MS, tn as getAwsClients, tt as withRetry, u as withResourceDeadline, un as LocalMigrateError, ut as AssetPublisher, v as isFinalSnapshotError, vn as ResourceUpdateNotSupportedError, vt as BOOTSTRAP_MARKER_PREFIX, w as renderStatefulReason, wt as buildDockerImage, x as extractDeploymentEventError, xt as parseBootstrapMarker, y as refusesFinalSnapshot, yn as StackHasActiveImportsError, yt as ensureAssetStorage, z as disableInstanceApiTermination, zt as resolveStateBucketWithDefault } from "./deploy-engine-D2mbS9va.js";
 import { a as getLiveRenderer, c as PATTERN_B_RESOURCE_TYPES, d as generateResourceNameWithFallback, f as withSkipPrefix, i as runStackBuffered, n as getLogger, o as PATTERN_B_NAME_OPTIONS, p as withStackName, s as PATTERN_B_NAME_PROPERTIES, u as generateResourceName } from "./logger-BYMEE-BS.js";
-import { t as ASGProvider } from "./asg-provider-t9dJL0zs.js";
+import { t as ASGProvider } from "./asg-provider-C217C6UE.js";
 import { AsyncLocalStorage } from "node:async_hooks";
 import { createHash, randomBytes, randomUUID } from "node:crypto";
 import { CopyObjectCommand, CreateBucketCommand, DeleteBucketAnalyticsConfigurationCommand, DeleteBucketCommand, DeleteBucketCorsCommand, DeleteBucketEncryptionCommand, DeleteBucketIntelligentTieringConfigurationCommand, DeleteBucketInventoryConfigurationCommand, DeleteBucketLifecycleCommand, DeleteBucketMetricsConfigurationCommand, DeleteBucketOwnershipControlsCommand, DeleteBucketPolicyCommand, DeleteBucketReplicationCommand, DeleteBucketTaggingCommand, DeleteBucketWebsiteCommand, DeleteObjectsCommand, GetBucketAccelerateConfigurationCommand, GetBucketCorsCommand, GetBucketEncryptionCommand, GetBucketLifecycleConfigurationCommand, GetBucketLocationCommand, GetBucketLoggingCommand, GetBucketNotificationConfigurationCommand, GetBucketOwnershipControlsCommand, GetBucketPolicyCommand, GetBucketReplicationCommand, GetBucketTaggingCommand, GetBucketVersioningCommand, GetBucketWebsiteCommand, GetObjectCommand, GetObjectLockConfigurationCommand, GetPublicAccessBlockCommand, HeadBucketCommand, ListBucketAnalyticsConfigurationsCommand, ListBucketIntelligentTieringConfigurationsCommand, ListBucketInventoryConfigurationsCommand, ListBucketMetricsConfigurationsCommand, ListObjectVersionsCommand, ListObjectsV2Command, NoSuchBucket, PutBucketAccelerateConfigurationCommand, PutBucketAnalyticsConfigurationCommand, PutBucketCorsCommand, PutBucketEncryptionCommand, PutBucketIntelligentTieringConfigurationCommand, PutBucketInventoryConfigurationCommand, PutBucketLifecycleConfigurationCommand, PutBucketLoggingCommand, PutBucketMetricsConfigurationCommand, PutBucketNotificationConfigurationCommand, PutBucketOwnershipControlsCommand, PutBucketPolicyCommand, PutBucketReplicationCommand, PutBucketTaggingCommand, PutBucketVersioningCommand, PutBucketWebsiteCommand, PutObjectCommand, PutObjectLockConfigurationCommand, PutPublicAccessBlockCommand, S3Client, S3ServiceException } from "@aws-sdk/client-s3";
@@ -7823,7 +7823,7 @@ var SNSTopicProvider = class {
 			}
 		}
 		if (JSON.stringify(properties["DeliveryStatusLogging"]) !== JSON.stringify(previousProperties["DeliveryStatusLogging"])) {
-			const desiredAttributes = buildDeliveryStatusAttributeMap(properties["DeliveryStatusLogging"], logicalId, "throw");
+			const desiredAttributes = buildDeliveryStatusAttributeMap(properties["DeliveryStatusLogging"], logicalId, "warn");
 			const previousAttributes = buildDeliveryStatusAttributeMap(previousProperties["DeliveryStatusLogging"], logicalId, "skip");
 			for (const [attributeName, attributeValue] of desiredAttributes) {
 				if (previousAttributes.get(attributeName) === attributeValue) continue;
@@ -8205,11 +8205,24 @@ const SNS_DELIVERY_STATUS_ATTRIBUTE_SUFFIXES = [
 * rate on create and update alike).
 *
 * `onMalformed` picks the failure mode for a malformed container / entry
-* / unknown protocol: `'throw'` for the DESIRED side (a template error
-* must fail fast, naming the offending value), `'skip'` for the PREVIOUS
-* side (cdkd state — refusing a value an older binary recorded would make
-* the stack permanently undeployable, and an entry whose protocol cannot
-* be canonicalized maps to no attribute names anyway).
+* / unknown protocol, and encodes the create-vs-update distinction
+* (issue #1538):
+*
+* - `'throw'` — the CREATE desired side, which is always template-borne:
+*   a template error must fail fast, naming the offending value.
+* - `'warn'` — the UPDATE desired side, which is NOT always template-borne:
+*   the rollback executor's revert arm and `cdkd drift --revert` both call
+*   `update()` with a state-derived bag as the DESIRED properties, so a
+*   state record carrying an unsupported protocol / malformed shape (a
+*   hand-written imported template, or a record an older binary wrote)
+*   must warn-and-skip rather than fail the update permanently — there is
+*   no template-side remedy. Skip semantics are well-defined: an entry
+*   whose protocol cannot be canonicalized maps to no attribute names, a
+*   non-array container yields an empty map, and a non-object entry is
+*   skipped. Each warning names the logicalId and the offending value.
+* - `'skip'` — the PREVIOUS side (cdkd state): same tolerance, silently —
+*   warning on every update about a value the user cannot act on from the
+*   template would be pure noise (guard-the-desired-side-only rule).
 *
 * Two entries whose `Protocol` values canonicalize to the SAME prefix
 * (`http/s` + `https`, say) collapse onto one set of attribute names. The
@@ -8223,38 +8236,46 @@ const SNS_DELIVERY_STATUS_ATTRIBUTE_SUFFIXES = [
 * produced `HTTPS*` names AWS rejected outright, so no such template ever
 * deployed.
 *
-* The collision WARNS rather than throws because this function's `'throw'`
-* side is also fed by the rollback executor's `update()` replay of a cdkd
-* STATE record, where the user has no template-side remedy. NOTE the three
-* pre-existing throws below (unsupported protocol, non-array container,
-* non-object entry) sit on that same side and are NOT covered by that
-* reasoning — a state record carrying one of those is permanently
-* unreplayable. That is a real but latent gap, tracked as issue #1538;
-* #1529 deliberately did not widen its scope to change the create path's
-* validation contract.
+* The collision WARNS rather than throws for the same reason `'warn'` mode
+* exists: the update desired side is also fed by the rollback executor's
+* `update()` replay of a cdkd STATE record, where the user has no
+* template-side remedy. The three malformed-value sites below (unsupported
+* protocol, non-array container, non-object entry) used to throw on that
+* side too, which made such a state record permanently unreplayable —
+* fixed by issue #1538, which moved `update()`'s desired side to `'warn'`
+* while `create()` keeps `'throw'` (a template create must still fail
+* fast; #1529 / #1536 deliberately left that contract unchanged).
 */
 function buildDeliveryStatusAttributeMap(logging, logicalId, onMalformed) {
 	const map = /* @__PURE__ */ new Map();
 	if (logging == null) return map;
+	const warn = (message) => {
+		getLogger().child("SNSTopicProvider").warn(message);
+	};
 	const seenProtocols = /* @__PURE__ */ new Set();
 	if (!Array.isArray(logging)) {
-		if (onMalformed === "skip") return map;
-		throw new Error(`SNS topic ${logicalId}: DeliveryStatusLogging must be an array of {Protocol, ...} objects, got ${JSON.stringify(logging)}`);
+		if (onMalformed === "throw") throw new Error(`SNS topic ${logicalId}: DeliveryStatusLogging must be an array of {Protocol, ...} objects, got ${JSON.stringify(logging)}`);
+		if (onMalformed === "warn") warn(`SNS topic ${logicalId}: DeliveryStatusLogging must be an array of {Protocol, ...} objects, got ${JSON.stringify(logging)} — treating it as empty for this update, so previously set delivery-status attributes are reset. The desired properties can come from a cdkd state record (rollback replay / drift --revert), so this does not fail the update; fix the template (or the state record on a replay) to clear this warning.`);
+		return map;
 	}
 	for (const entry of logging) {
 		if (entry == null || typeof entry !== "object" || Array.isArray(entry)) {
-			if (onMalformed === "skip") continue;
-			throw new Error(`SNS topic ${logicalId}: DeliveryStatusLogging entries must be {Protocol, ...} objects, got ${JSON.stringify(entry)}`);
+			if (onMalformed === "throw") throw new Error(`SNS topic ${logicalId}: DeliveryStatusLogging entries must be {Protocol, ...} objects, got ${JSON.stringify(entry)}`);
+			if (onMalformed === "warn") warn(`SNS topic ${logicalId}: skipping DeliveryStatusLogging entry ${JSON.stringify(entry)} — entries must be {Protocol, ...} objects. Attributes previously set for the skipped entry's protocol are reset, as if the entry had been removed.`);
+			continue;
 		}
 		const config = entry;
 		let protocol;
 		if (onMalformed === "throw") protocol = normalizeDeliveryStatusProtocolOrThrow(config["Protocol"], logicalId);
 		else {
 			const normalized = normalizeDeliveryStatusProtocol(config["Protocol"]);
-			if (normalized === void 0) continue;
+			if (normalized === void 0) {
+				if (onMalformed === "warn") warn(`SNS topic ${logicalId}: skipping DeliveryStatusLogging entry with unsupported protocol ${JSON.stringify(config["Protocol"])}. Expected one of ${SNS_DELIVERY_STATUS_PROTOCOL_SPELLINGS.join(", ")} (case-insensitive). Attributes previously set for the skipped entry's protocol are reset, as if the entry had been removed.`);
+				continue;
+			}
 			protocol = normalized;
 		}
-		if (onMalformed === "throw" && seenProtocols.has(protocol)) getLogger().child("SNSTopicProvider").warn(`SNS topic ${logicalId}: DeliveryStatusLogging declares more than one entry for the "${protocol}" attribute prefix (${JSON.stringify(config["Protocol"])} canonicalizes to it). AWS has one attribute set per prefix, so these are merged per field — a later entry overwrites only the sub-fields it declares, and a field it omits keeps the earlier entry's value. Declare a single entry per protocol.`);
+		if (onMalformed !== "skip" && seenProtocols.has(protocol)) warn(`SNS topic ${logicalId}: DeliveryStatusLogging declares more than one entry for the "${protocol}" attribute prefix (${JSON.stringify(config["Protocol"])} canonicalizes to it). AWS has one attribute set per prefix, so these are merged per field — a later entry overwrites only the sub-fields it declares, and a field it omits keeps the earlier entry's value. Declare a single entry per protocol.`);
 		seenProtocols.add(protocol);
 		for (const suffix of SNS_DELIVERY_STATUS_ATTRIBUTE_SUFFIXES) {
 			const value = config[suffix];
@@ -8330,10 +8351,13 @@ function normalizeDeliveryStatusProtocol(input) {
 	}
 }
 /**
-* Variant used by `create()` / `update()` to fail fast when a template
-* carries an unknown protocol. Throws a clear error naming the offending
-* value so the user sees what to fix instead of AWS's generic
-* `InvalidParameter` rejection.
+* Variant used by `create()` (the `'throw'` mode of
+* `buildDeliveryStatusAttributeMap`) to fail fast when a template carries
+* an unknown protocol. Throws a clear error naming the offending value so
+* the user sees what to fix instead of AWS's generic `InvalidParameter`
+* rejection. `update()`'s desired side warns-and-skips instead (issue
+* #1538) because its bag can be a cdkd state record on a rollback replay
+* or `drift --revert`.
 */
 function normalizeDeliveryStatusProtocolOrThrow(input, logicalId) {
 	const normalized = normalizeDeliveryStatusProtocol(input);
@@ -9910,11 +9934,11 @@ var LambdaUrlProvider = class {
 	/**
 	* Create a Lambda Function URL
 	*/
-	async create(logicalId, resourceType, properties) {
+	async create(logicalId, resourceType, properties, context) {
 		this.logger.debug(`Creating Lambda URL ${logicalId}`);
 		const targetFunctionArn = properties["TargetFunctionArn"];
 		if (!targetFunctionArn) throw new ProvisioningError(`TargetFunctionArn is required for Lambda URL ${logicalId}`, resourceType, logicalId);
-		const authType = requireConfigString(properties["AuthType"], "NONE", "AWS::Lambda::Url AuthType");
+		const authType = requireConfigString(properties["AuthType"], "NONE", "AWS::Lambda::Url AuthType", replayWarn(this.logger, context));
 		try {
 			const cors = properties["Cors"];
 			const createParams = {
@@ -11519,7 +11543,7 @@ var DynamoDBTableProvider = class {
 	/**
 	* Create a DynamoDB table
 	*/
-	async create(logicalId, resourceType, properties) {
+	async create(logicalId, resourceType, properties, context) {
 		this.logger.debug(`Creating DynamoDB table ${logicalId}`);
 		const tableName = properties["TableName"] || generateResourceName(logicalId, { maxLength: 255 });
 		const keySchema = properties["KeySchema"];
@@ -11528,7 +11552,7 @@ var DynamoDBTableProvider = class {
 		if (!attributeDefinitions) throw new ProvisioningError(`AttributeDefinitions is required for DynamoDB table ${logicalId}`, resourceType, logicalId);
 		let tableCreated = false;
 		try {
-			const billingMode = properties["BillingMode"] || "PROVISIONED";
+			const billingMode = requireConfigString(properties["BillingMode"], "PROVISIONED", "AWS::DynamoDB::Table BillingMode", replayWarn(this.logger, context));
 			const createParams = {
 				TableName: tableName,
 				KeySchema: keySchema,
@@ -11602,9 +11626,15 @@ var DynamoDBTableProvider = class {
 			if (table?.TableArn) await this.applyTagDiff(table.TableArn, previousProperties["Tags"], properties["Tags"]);
 			const normalizeTableClass = (v) => typeof v === "string" && v.length > 0 ? v : "STANDARD";
 			const tableClassChanged = normalizeTableClass(properties["TableClass"]) !== normalizeTableClass(previousProperties["TableClass"]);
-			const billingOrThroughputChanged = JSON.stringify(properties["BillingMode"]) !== JSON.stringify(previousProperties["BillingMode"]) || JSON.stringify(properties["ProvisionedThroughput"]) !== JSON.stringify(previousProperties["ProvisionedThroughput"]);
+			const prevBillingMode = previousProperties["BillingMode"];
+			let billingModeUnusable = false;
+			const requestedBillingMode = properties["BillingMode"] === void 0 ? void 0 : requireConfigString(properties["BillingMode"], "PROVISIONED", "AWS::DynamoDB::Table BillingMode", { onUnusable: (message) => {
+				billingModeUnusable = true;
+				this.logger.warn(`${message} The table's current billing mode${prevBillingMode ? ` (${prevBillingMode})` : ""} is kept for this update rather than flipped to the default.`);
+			} });
+			const billingMode = billingModeUnusable ? prevBillingMode : requestedBillingMode;
+			const billingOrThroughputChanged = JSON.stringify(billingMode) !== JSON.stringify(prevBillingMode) || JSON.stringify(properties["ProvisionedThroughput"]) !== JSON.stringify(previousProperties["ProvisionedThroughput"]);
 			if (billingOrThroughputChanged || tableClassChanged) {
-				const billingMode = properties["BillingMode"];
 				const updateInput = { TableName: physicalId };
 				if (billingOrThroughputChanged && billingMode) updateInput.BillingMode = billingMode;
 				if (tableClassChanged) updateInput.TableClass = normalizeTableClass(properties["TableClass"]);
@@ -12557,7 +12587,7 @@ var DynamoDBGlobalTableProvider = class {
 		if (streamSpecInput != null) {
 			let streamViewType;
 			try {
-				streamViewType = readConfigString(streamSpecInput, "StreamViewType", "NEW_AND_OLD_IMAGES", "AWS::DynamoDB::GlobalTable StreamSpecification");
+				streamViewType = readConfigString(streamSpecInput, "StreamViewType", "NEW_AND_OLD_IMAGES", "AWS::DynamoDB::GlobalTable StreamSpecification", replayWarn(this.logger, context));
 			} catch (error) {
 				throw new ProvisioningError(error instanceof Error ? error.message : String(error), resourceType, logicalId, void 0, error instanceof Error ? error : void 0);
 			}
@@ -12574,7 +12604,7 @@ var DynamoDBGlobalTableProvider = class {
 		}
 		let sdkIndexes;
 		try {
-			sdkIndexes = toSdkGlobalSecondaryIndexes(properties, currentRegion, billingMode, "min", diagnostics);
+			sdkIndexes = toSdkGlobalSecondaryIndexes(properties, currentRegion, billingMode, "min", diagnostics, replayWarn(this.logger, context).onUnusable);
 		} catch (error) {
 			throw new ProvisioningError(error instanceof Error ? error.message : String(error), resourceType, logicalId, void 0, error instanceof Error ? error : void 0);
 		}
@@ -14554,9 +14584,16 @@ function pickAutoScalingCapacity(autoScaling, source) {
 * written before this fix (and hand-authored templates) can carry them, and
 * silently re-deriving over an explicit value would be a regression.
 */
-function toSdkGlobalSecondaryIndexes(properties, region, billingMode, source = "min", diagnostics) {
+function toSdkGlobalSecondaryIndexes(properties, region, billingMode, source = "min", diagnostics, onUnusableIndexes) {
 	const rawIndexes = properties["GlobalSecondaryIndexes"];
-	if (rawIndexes !== void 0 && !Array.isArray(rawIndexes)) throw new Error(`AWS::DynamoDB::GlobalTable GlobalSecondaryIndexes must be an array, got ${typeof rawIndexes} (${JSON.stringify(rawIndexes)?.slice(0, 200)}). An unresolved intrinsic here would otherwise deploy a table with no indexes.`);
+	if (rawIndexes !== void 0 && !Array.isArray(rawIndexes)) {
+		const shapeDetail = `AWS::DynamoDB::GlobalTable GlobalSecondaryIndexes must be an array, got ${typeof rawIndexes} (${JSON.stringify(rawIndexes)?.slice(0, 200)}).`;
+		if (onUnusableIndexes) {
+			onUnusableIndexes(`${shapeDetail} Omitting the malformed block, so this create carries NO indexes; the same value is REFUSED on a template-path create`);
+			return [];
+		}
+		throw new Error(`${shapeDetail} An unresolved intrinsic here would otherwise deploy a table with no indexes.`);
+	}
 	const cfnIndexes = rawIndexes ?? [];
 	if (cfnIndexes.length === 0) return [];
 	const replicas = properties["Replicas"] ?? [];
@@ -44575,9 +44612,9 @@ var S3DirectoryBucketProvider = class {
 	/**
 	* Create an S3 Express Directory Bucket
 	*/
-	async create(logicalId, resourceType, properties) {
+	async create(logicalId, resourceType, properties, context) {
 		this.logger.debug(`Creating S3 Express Directory Bucket ${logicalId}`);
-		const dataRedundancy = requireConfigString(properties["DataRedundancy"], "SingleAvailabilityZone", "AWS::S3Express::DirectoryBucket DataRedundancy");
+		const dataRedundancy = requireConfigString(properties["DataRedundancy"], "SingleAvailabilityZone", "AWS::S3Express::DirectoryBucket DataRedundancy", replayWarn(this.logger, context));
 		const azName = properties["LocationName"]?.replace(/--x-s3$/, "") || "us-east-1a";
 		const azId = await this.getAzId(azName);
 		let bucketName = properties["BucketName"];
@@ -67565,7 +67602,7 @@ function createMigrateCommand() {
 */
 function buildProgram() {
 	const program = new Command();
-	program.name("cdkd").description("CDK Direct - Deploy AWS CDK apps directly via SDK/Cloud Control API").version("0.278.49");
+	program.name("cdkd").description("CDK Direct - Deploy AWS CDK apps directly via SDK/Cloud Control API").version("0.278.50");
 	program.hook("preAction", (_thisCommand, actionCommand) => {
 		const { profile } = actionCommand.optsWithGlobals();
 		if (profile !== void 0) process.env["AWS_PROFILE"] = profile;