@go-to-k/cdkd 0.278.53 → 0.278.54

package/dist/cli.js

@@ -1,7 +1,7 @@
 #!/usr/bin/env node
-import { $ as DiffCalculator, $t as resolveBucketRegion, A as red, At as getDockerImageBySourceHash, B as isTerminationProtectionPropagationError, Bt as resolveStateBucketWithDefaultAndSource, C as isStatefulRecreateTargetSync, Ct as validateContainerRepoName, D as cyan, Dt as runDockerForeground, E as bold, En as withErrorHandling, Et as getDockerCmd, F as ProviderRegistry, Ft as resolveApp, G as normalizeAwsTagsToCfn, Gt as CFN_TEMPLATE_URL_LIMIT, H as cfnRefValueFromPhysicalId, Ht as stateBucketExistenceConfirmed, I as findActionableSilentDrops, It as resolveAutoAssetStorage, J as readConfigString, Jt as uploadCfnTemplate, K as resolveExplicitPhysicalId, Kt as MIGRATE_TMP_PREFIX, L as CloudControlProvider, Lt as resolveCaptureObservedState, M as IAMRoleProvider, Mt as synthesisStatusMessage, N as collectInlinePolicyNamesManagedBySiblings, Nt as getDefaultStateBucketName, O as gray, Ot as runDockerStreaming, P as clearOnUpdateRemoval, Pt as getLegacyStateBucketName, Q as applyRoleArnIfSet, R as slowCcOperationTimeoutMs, Rt as resolveSkipPrefix, S as MULTI_REGION_RECREATE_BLOCKED_TYPES, St as validateAssetBucketName, T as formatResourceLine, Tn as normalizeAwsError, Tt as formatDockerLoginError, U as refStateLookupFromResource, Ut as warnDeprecatedNoPrefixCliFlag, V as IntrinsicFunctionResolver, Vt as resolveUseCdkBootstrapAssets, W as WAFv2WebACLProvider, Wt as CFN_TEMPLATE_BODY_LIMIT, X as requireConfigArray, Xt as AssemblyReader, Y as replayWarn, Yt as expectedOwnerParam, Z as requireConfigString, Zt as processStackMessages, _ as createPreDeleteFinalSnapshot, _n as ResourceTimeoutError, _t as AssetModeResolver, a as DeploymentEventsStore, an as CdkdError, at as TemplateParser, b as unsupportedFinalSnapshotError, bn as StackTerminationProtectionError, bt as getBootstrapMarkerKey, c as replayFailedOperations, cn as DeployCancelledError, ct as rebuildClientForBucketRegion, d as IMPLICIT_DELETE_DEPENDENCIES, dn as LocalStartServiceError, dt as stringifyValue, en as AwsClients, et as describeTypeWithThrottleRetry, f as computeImplicitDeleteEdges, ft as WorkGraph, g as ccRoutedFinalSnapshotError, gn as ProvisioningError, gt as rewriteTemplateAssetReferences, h as buildFinalSnapshotIdentifier, hn as PartialFailureError, ht as loadPublishableAssetManifest, i as DeploymentEventsReader, it as DagBuilder, j as yellow, jt as Synthesizer, k as green, kt as AssetManifestLoader, l as replayRollback, ln as LocalInvokeBuildError$1, lt as shouldRetainResource, m as PRE_DELETE_SNAPSHOT_TYPES, mn as NestedStackChildDirectDestroyError, mt as createAssetRedirectResolver, n as DEFAULT_RESOURCE_WARN_AFTER_MS, nn as resetAwsClients, nt as isRetryableTransientError, o as planFailedOps, ot as LockManager, p as ATOMIC_FINAL_SNAPSHOT_TYPES, pn as MissingCdkCliError, pt as buildAssetRedirectMap, q as assertRegionMatch, qt as findLargeInlineResources, r as DeployEngine, rn as setAwsClients, rt as isThrottlingError, s as planRollback, st as S3StateBackend, t as DEFAULT_RESOURCE_TIMEOUT_MS, tn as getAwsClients, tt as withRetry, u as withResourceDeadline, un as LocalMigrateError, ut as AssetPublisher, v as isFinalSnapshotError, vn as ResourceUpdateNotSupportedError, vt as BOOTSTRAP_MARKER_PREFIX, w as renderStatefulReason, wt as buildDockerImage, x as extractDeploymentEventError, xt as parseBootstrapMarker, y as refusesFinalSnapshot, yn as StackHasActiveImportsError, yt as ensureAssetStorage, z as disableInstanceApiTermination, zt as resolveStateBucketWithDefault } from "./deploy-engine-CeEJqaaT.js";
+import { $ as DiffCalculator, $t as resolveBucketRegion, A as red, At as getDockerImageBySourceHash, B as isTerminationProtectionPropagationError, Bt as resolveStateBucketWithDefaultAndSource, C as isStatefulRecreateTargetSync, Ct as validateContainerRepoName, D as cyan, Dt as runDockerForeground, E as bold, En as withErrorHandling, Et as getDockerCmd, F as ProviderRegistry, Ft as resolveApp, G as normalizeAwsTagsToCfn, Gt as CFN_TEMPLATE_URL_LIMIT, H as cfnRefValueFromPhysicalId, Ht as stateBucketExistenceConfirmed, I as findActionableSilentDrops, It as resolveAutoAssetStorage, J as readConfigString, Jt as uploadCfnTemplate, K as resolveExplicitPhysicalId, Kt as MIGRATE_TMP_PREFIX, L as CloudControlProvider, Lt as resolveCaptureObservedState, M as IAMRoleProvider, Mt as synthesisStatusMessage, N as collectInlinePolicyNamesManagedBySiblings, Nt as getDefaultStateBucketName, O as gray, Ot as runDockerStreaming, P as clearOnUpdateRemoval, Pt as getLegacyStateBucketName, Q as applyRoleArnIfSet, R as slowCcOperationTimeoutMs, Rt as resolveSkipPrefix, S as MULTI_REGION_RECREATE_BLOCKED_TYPES, St as validateAssetBucketName, T as formatResourceLine, Tn as normalizeAwsError, Tt as formatDockerLoginError, U as refStateLookupFromResource, Ut as warnDeprecatedNoPrefixCliFlag, V as IntrinsicFunctionResolver, Vt as resolveUseCdkBootstrapAssets, W as WAFv2WebACLProvider, Wt as CFN_TEMPLATE_BODY_LIMIT, X as requireConfigArray, Xt as AssemblyReader, Y as replayWarn, Yt as expectedOwnerParam, Z as requireConfigString, Zt as processStackMessages, _ as createPreDeleteFinalSnapshot, _n as ResourceTimeoutError, _t as AssetModeResolver, a as DeploymentEventsStore, an as CdkdError, at as TemplateParser, b as unsupportedFinalSnapshotError, bn as StackTerminationProtectionError, bt as getBootstrapMarkerKey, c as replayFailedOperations, cn as DeployCancelledError, ct as rebuildClientForBucketRegion, d as IMPLICIT_DELETE_DEPENDENCIES, dn as LocalStartServiceError, dt as stringifyValue, en as AwsClients, et as describeTypeWithThrottleRetry, f as computeImplicitDeleteEdges, ft as WorkGraph, g as ccRoutedFinalSnapshotError, gn as ProvisioningError, gt as rewriteTemplateAssetReferences, h as buildFinalSnapshotIdentifier, hn as PartialFailureError, ht as loadPublishableAssetManifest, i as DeploymentEventsReader, it as DagBuilder, j as yellow, jt as Synthesizer, k as green, kt as AssetManifestLoader, l as replayRollback, ln as LocalInvokeBuildError$1, lt as shouldRetainResource, m as PRE_DELETE_SNAPSHOT_TYPES, mn as NestedStackChildDirectDestroyError, mt as createAssetRedirectResolver, n as DEFAULT_RESOURCE_WARN_AFTER_MS, nn as resetAwsClients, nt as isRetryableTransientError, o as planFailedOps, ot as LockManager, p as ATOMIC_FINAL_SNAPSHOT_TYPES, pn as MissingCdkCliError, pt as buildAssetRedirectMap, q as assertRegionMatch, qt as findLargeInlineResources, r as DeployEngine, rn as setAwsClients, rt as isThrottlingError, s as planRollback, st as S3StateBackend, t as DEFAULT_RESOURCE_TIMEOUT_MS, tn as getAwsClients, tt as withRetry, u as withResourceDeadline, un as LocalMigrateError, ut as AssetPublisher, v as isFinalSnapshotError, vn as ResourceUpdateNotSupportedError, vt as BOOTSTRAP_MARKER_PREFIX, w as renderStatefulReason, wt as buildDockerImage, x as extractDeploymentEventError, xt as parseBootstrapMarker, y as refusesFinalSnapshot, yn as StackHasActiveImportsError, yt as ensureAssetStorage, z as disableInstanceApiTermination, zt as resolveStateBucketWithDefault } from "./deploy-engine-CEoy1_C7.js";
 import { a as getLiveRenderer, c as PATTERN_B_RESOURCE_TYPES, d as generateResourceNameWithFallback, f as withSkipPrefix, i as runStackBuffered, n as getLogger, o as PATTERN_B_NAME_OPTIONS, p as withStackName, s as PATTERN_B_NAME_PROPERTIES, u as generateResourceName } from "./logger-BYMEE-BS.js";
-import { t as ASGProvider } from "./asg-provider-Camwh-s6.js";
+import { t as ASGProvider } from "./asg-provider-Ro9B_1Sy.js";
 import { AsyncLocalStorage } from "node:async_hooks";
 import { createHash, randomBytes, randomUUID } from "node:crypto";
 import { CopyObjectCommand, CreateBucketCommand, DeleteBucketAnalyticsConfigurationCommand, DeleteBucketCommand, DeleteBucketCorsCommand, DeleteBucketEncryptionCommand, DeleteBucketIntelligentTieringConfigurationCommand, DeleteBucketInventoryConfigurationCommand, DeleteBucketLifecycleCommand, DeleteBucketMetricsConfigurationCommand, DeleteBucketOwnershipControlsCommand, DeleteBucketPolicyCommand, DeleteBucketReplicationCommand, DeleteBucketTaggingCommand, DeleteBucketWebsiteCommand, DeleteObjectsCommand, GetBucketAccelerateConfigurationCommand, GetBucketCorsCommand, GetBucketEncryptionCommand, GetBucketLifecycleConfigurationCommand, GetBucketLocationCommand, GetBucketLoggingCommand, GetBucketNotificationConfigurationCommand, GetBucketOwnershipControlsCommand, GetBucketPolicyCommand, GetBucketReplicationCommand, GetBucketTaggingCommand, GetBucketVersioningCommand, GetBucketWebsiteCommand, GetObjectCommand, GetObjectLockConfigurationCommand, GetPublicAccessBlockCommand, HeadBucketCommand, ListBucketAnalyticsConfigurationsCommand, ListBucketIntelligentTieringConfigurationsCommand, ListBucketInventoryConfigurationsCommand, ListBucketMetricsConfigurationsCommand, ListObjectVersionsCommand, ListObjectsV2Command, NoSuchBucket, PutBucketAccelerateConfigurationCommand, PutBucketAnalyticsConfigurationCommand, PutBucketCorsCommand, PutBucketEncryptionCommand, PutBucketIntelligentTieringConfigurationCommand, PutBucketInventoryConfigurationCommand, PutBucketLifecycleConfigurationCommand, PutBucketLoggingCommand, PutBucketMetricsConfigurationCommand, PutBucketNotificationConfigurationCommand, PutBucketOwnershipControlsCommand, PutBucketPolicyCommand, PutBucketReplicationCommand, PutBucketTaggingCommand, PutBucketVersioningCommand, PutBucketWebsiteCommand, PutObjectCommand, PutObjectLockConfigurationCommand, PutPublicAccessBlockCommand, S3Client, S3ServiceException } from "@aws-sdk/client-s3";
@@ -7775,8 +7775,20 @@ var SNSTopicProvider = class {
 	}
 	/**
 	* Create an SNS topic
+	*
+	* `context.replayingState` (issue #1551) downgrades this method's one
+	* template-shape refusal — `buildDeliveryStatusAttributeMap`'s `'throw'`
+	* mode — to a warning. The rollback executor's
+	* reverse-replacement arm revives the OLD topic with
+	* `create(..., previousState.properties, REPLAYING_STATE_CREATE_CONTEXT)`,
+	* so the properties bag can be a historical cdkd STATE record carrying a
+	* shape this provider now refuses — and the user has no template-side
+	* remedy for a state record. The parameter was previously absent, so that
+	* 4th argument was silently ignored and `buildDeliveryStatusAttributeMap`'s
+	* `'throw'` mode stranded the replay; issue #1538 fixed the update side
+	* only.
 	*/
-	async create(logicalId, resourceType, properties) {
+	async create(logicalId, resourceType, properties, context) {
 		this.logger.debug(`Creating SNS topic ${logicalId}`);
 		const topicName = properties["TopicName"] || generateResourceName(logicalId, { maxLength: 256 });
 		try {
@@ -7814,7 +7826,7 @@ var SNSTopicProvider = class {
 						AttributeValue: dataProtectionPolicy
 					}));
 				}
-				const deliveryStatusAttributes = buildDeliveryStatusAttributeMap(properties["DeliveryStatusLogging"], logicalId, "throw");
+				const deliveryStatusAttributes = buildDeliveryStatusAttributeMap(properties["DeliveryStatusLogging"], logicalId, context?.replayingState === true ? "warn" : "throw");
 				for (const [attributeName, attributeValue] of deliveryStatusAttributes) await this.snsClient.send(new SetTopicAttributesCommand({
 					TopicArn: topicArn,
 					AttributeName: attributeName,
@@ -8311,9 +8323,15 @@ const SNS_DELIVERY_STATUS_ATTRIBUTE_SUFFIXES = [
 * / unknown protocol, and encodes the create-vs-update distinction
 * (issue #1538):
 *
-* - `'throw'` — the CREATE desired side, which is always template-borne:
-*   a template error must fail fast, naming the offending value.
-* - `'warn'` — the UPDATE desired side, which is NOT always template-borne:
+* - `'throw'` — a TEMPLATE-borne desired side: an ordinary `create()`, where a
+*   template error must fail fast, naming the offending value.
+* - `'warn'` — a desired side that is NOT template-borne. That is every
+*   `update()`, and — since issue #1551 — a `create()` whose
+*   `CreateContext.replayingState` is set (the rollback executor's
+*   reverse-replacement arm, which revives the old topic from a state record).
+*   The wording below is therefore operation-neutral: on a create there is no
+*   previously-set attribute to reset, only one that is never applied. Same
+*   reason as before:
 *   the rollback executor's revert arm and `cdkd drift --revert` both call
 *   `update()` with a state-derived bag as the DESIRED properties, so a
 *   state record carrying an unsupported protocol / malformed shape (a
@@ -8346,8 +8364,9 @@ const SNS_DELIVERY_STATUS_ATTRIBUTE_SUFFIXES = [
 * protocol, non-array container, non-object entry) used to throw on that
 * side too, which made such a state record permanently unreplayable —
 * fixed by issue #1538, which moved `update()`'s desired side to `'warn'`
-* while `create()` keeps `'throw'` (a template create must still fail
-* fast; #1529 / #1536 deliberately left that contract unchanged).
+* while `create()` kept `'throw'`; issue #1551 then extended the downgrade to
+* a create that DECLARES a state replay, leaving the template-path create
+* strict (#1529 / #1536 deliberately left that contract unchanged).
 */
 function buildDeliveryStatusAttributeMap(logging, logicalId, onMalformed) {
 	const map = /* @__PURE__ */ new Map();
@@ -8358,7 +8377,7 @@ function buildDeliveryStatusAttributeMap(logging, logicalId, onMalformed) {
 	const seenProtocols = /* @__PURE__ */ new Set();
 	if (!Array.isArray(logging)) {
 		if (onMalformed === "throw") throw new Error(`SNS topic ${logicalId}: DeliveryStatusLogging must be an array of {Protocol, ...} objects, got ${JSON.stringify(logging)}`);
-		if (onMalformed === "warn") warn(`SNS topic ${logicalId}: DeliveryStatusLogging must be an array of {Protocol, ...} objects, got ${JSON.stringify(logging)} — treating it as empty for this update, so previously set delivery-status attributes are reset. The desired properties can come from a cdkd state record (rollback replay / drift --revert), so this does not fail the update; fix the template (or the state record on a replay) to clear this warning.`);
+		if (onMalformed === "warn") warn(`SNS topic ${logicalId}: DeliveryStatusLogging must be an array of {Protocol, ...} objects, got ${JSON.stringify(logging)} — treating it as empty, so no delivery-status attribute is applied (on an update, any previously set one is reset). The desired properties can come from a cdkd state record (rollback replay / drift --revert), so this does not fail the operation; fix the template (or the state record on a replay) to clear this warning.`);
 		return map;
 	}
 	for (const entry of logging) {
@@ -10083,9 +10102,16 @@ var LambdaUrlProvider = class {
 			wasReplaced: false,
 			attributes: {}
 		};
+		let authTypeUnusable = false;
+		const requestedAuthType = requireConfigString(properties["AuthType"], "NONE", "AWS::Lambda::Url AuthType", { onUnusable: (message) => {
+			authTypeUnusable = true;
+			this.logger.warn(`${message} The function URL's existing auth type is kept for this update rather than reset to the default (NONE), which would make the URL public.`);
+		} });
+		const previousAuthType = previousProperties["AuthType"];
+		const authType = authTypeUnusable ? typeof previousAuthType === "string" && previousAuthType.trim() !== "" ? previousAuthType : void 0 : requestedAuthType;
 		const updateParams = {
 			FunctionName: physicalId,
-			AuthType: requireConfigString(properties["AuthType"], "NONE", "AWS::Lambda::Url AuthType")
+			...authType !== void 0 && { AuthType: authType }
 		};
 		const invokeMode = clearOnUpdateRemoval(properties["InvokeMode"], previousProperties["InvokeMode"], "BUFFERED");
 		if (invokeMode !== void 0) updateParams.InvokeMode = invokeMode;
@@ -11729,7 +11755,10 @@ var DynamoDBTableProvider = class {
 			if (table?.TableArn) await this.applyTagDiff(table.TableArn, previousProperties["Tags"], properties["Tags"]);
 			const normalizeTableClass = (v) => typeof v === "string" && v.length > 0 ? v : "STANDARD";
 			const tableClassChanged = normalizeTableClass(properties["TableClass"]) !== normalizeTableClass(previousProperties["TableClass"]);
-			const prevBillingMode = previousProperties["BillingMode"];
+			const recordedPrevBillingMode = previousProperties["BillingMode"];
+			const recordedPrevBillingModeUsable = recordedPrevBillingMode === void 0 || typeof recordedPrevBillingMode === "string" && recordedPrevBillingMode.trim() !== "";
+			const prevBillingMode = recordedPrevBillingModeUsable ? recordedPrevBillingMode : table?.BillingModeSummary?.BillingMode ?? "PROVISIONED";
+			if (!recordedPrevBillingModeUsable) this.logger.warn(`AWS::DynamoDB::Table ${logicalId}: the recorded previous BillingMode is unusable (${JSON.stringify(recordedPrevBillingMode)}) — using the table's actual billing mode (${prevBillingMode}) as the comparison baseline for this update so a corrected template does not issue a same-mode UpdateTable.`);
 			let billingModeUnusable = false;
 			const requestedBillingMode = properties["BillingMode"] === void 0 ? void 0 : requireConfigString(properties["BillingMode"], "PROVISIONED", "AWS::DynamoDB::Table BillingMode", { onUnusable: (message) => {
 				billingModeUnusable = true;
@@ -12707,7 +12736,8 @@ var DynamoDBGlobalTableProvider = class {
 		}
 		let sdkIndexes;
 		try {
-			sdkIndexes = toSdkGlobalSecondaryIndexes(properties, currentRegion, billingMode, "min", diagnostics, replayWarn(this.logger, context).onUnusable);
+			const onUnusableCreateIndexes = replayWarn(this.logger, context).onUnusable;
+			sdkIndexes = toSdkGlobalSecondaryIndexes(properties, currentRegion, billingMode, "min", diagnostics, onUnusableCreateIndexes && ((message) => onUnusableCreateIndexes(`${message} Omitting the malformed block, so this create carries NO indexes; the same value is REFUSED on a template-path create`)));
 		} catch (error) {
 			throw new ProvisioningError(error instanceof Error ? error.message : String(error), resourceType, logicalId, void 0, error instanceof Error ? error : void 0);
 		}
@@ -12915,7 +12945,10 @@ var DynamoDBGlobalTableProvider = class {
 				return (props["Replicas"] ?? []).find((r) => r["Region"] === currentRegion)?.["Tags"];
 			};
 			if (tableArn) await this.applyTagDiff(tableArn, extractLocalTags(previousProperties), extractLocalTags(properties));
-			const oldBilling = previousProperties["BillingMode"] ?? "PAY_PER_REQUEST";
+			const recordedOldBilling = previousProperties["BillingMode"];
+			const recordedOldBillingUsable = recordedOldBilling === void 0 || typeof recordedOldBilling === "string" && recordedOldBilling.trim() !== "";
+			const oldBilling = recordedOldBillingUsable ? recordedOldBilling ?? "PAY_PER_REQUEST" : describeResp.Table?.BillingModeSummary?.BillingMode ?? "PROVISIONED";
+			if (!recordedOldBillingUsable) this.logger.warn(`AWS::DynamoDB::GlobalTable ${logicalId}: the recorded previous BillingMode is unusable (${JSON.stringify(recordedOldBilling)}) — using the table's actual billing mode (${oldBilling}) as the comparison baseline for this update so a corrected template does not issue a same-mode UpdateTable.`);
 			let billingUnusable = false;
 			const requestedBilling = requireConfigString(properties["BillingMode"], "PAY_PER_REQUEST", "AWS::DynamoDB::GlobalTable BillingMode", { onUnusable: (message) => {
 				billingUnusable = true;
@@ -12927,8 +12960,19 @@ var DynamoDBGlobalTableProvider = class {
 			const desiredCeilings = collectTableOnDemandCeilings(properties, currentRegion, diagnostics);
 			const flippingToProvisioned = oldBilling !== newBilling && newBilling === "PROVISIONED";
 			if (flippingToProvisioned) derivePerCallProvisionedThroughput(properties, currentRegion, "seed", diagnostics);
-			const desiredSdkIndexes = toSdkGlobalSecondaryIndexes(properties, currentRegion, newBilling, "min", flippingToProvisioned ? void 0 : diagnostics);
-			if (flippingToProvisioned) toSdkGlobalSecondaryIndexes(properties, currentRegion, newBilling, "seed", diagnostics);
+			let desiredGsiUnusable = false;
+			const onUnusableGsiBlock = (message) => {
+				desiredGsiUnusable = true;
+				this.logger.warn(`${message} No GlobalSecondaryIndexes change is applied by this update; the table's existing indexes are left untouched.`);
+			};
+			let previousGsiUnusable = false;
+			const onUnusablePreviousGsiBlock = (message) => {
+				previousGsiUnusable = true;
+				this.logger.warn(`${message} (recorded in cdkd state, not in the template) — using the table's LIVE indexes as the comparison baseline for this update, so a corrected template still applies.`);
+			};
+			const liveIndexNames = new Set((describeResp.Table?.GlobalSecondaryIndexes ?? []).map((live) => live.IndexName).filter((name) => typeof name === "string"));
+			const desiredSdkIndexes = toSdkGlobalSecondaryIndexes(properties, currentRegion, newBilling, "min", flippingToProvisioned ? void 0 : diagnostics, onUnusableGsiBlock);
+			if (flippingToProvisioned) toSdkGlobalSecondaryIndexes(properties, currentRegion, newBilling, "seed", diagnostics, onUnusableGsiBlock);
 			for (const replica of properties["Replicas"] ?? []) {
 				const replicaRegion = asRecord$1(replica)?.["Region"];
 				if (typeof replicaRegion !== "string" || replicaRegion === currentRegion) continue;
@@ -12959,11 +13003,18 @@ var DynamoDBGlobalTableProvider = class {
 				flatChanged = true;
 			}
 			if (properties["StreamSpecification"] !== void 0 && !deepEqual$1(properties["StreamSpecification"], previousProperties["StreamSpecification"])) {
-				flatUpdate.StreamSpecification = {
-					StreamEnabled: true,
-					StreamViewType: readConfigString(properties["StreamSpecification"], "StreamViewType", "NEW_AND_OLD_IMAGES", "AWS::DynamoDB::GlobalTable StreamSpecification")
-				};
-				flatChanged = true;
+				let streamSpecUnusable = false;
+				const streamViewType = readConfigString(properties["StreamSpecification"], "StreamViewType", "NEW_AND_OLD_IMAGES", "AWS::DynamoDB::GlobalTable StreamSpecification", { onUnusable: (message) => {
+					streamSpecUnusable = true;
+					this.logger.warn(`${message} The table's existing stream configuration is left untouched for this update rather than re-pointed at the default.`);
+				} });
+				if (!streamSpecUnusable) {
+					flatUpdate.StreamSpecification = {
+						StreamEnabled: true,
+						StreamViewType: streamViewType
+					};
+					flatChanged = true;
+				}
 			}
 			const awsOnDemand = describeResp.Table?.OnDemandThroughput;
 			const onDemandPayload = {};
@@ -12995,11 +13046,13 @@ var DynamoDBGlobalTableProvider = class {
 				};
 				if (newBilling === "PROVISIONED") {
 					billingUpdate.ProvisionedThroughput = derivePerCallProvisionedThroughput(properties, currentRegion, "seed");
-					const provisionedIndexes = toSdkGlobalSecondaryIndexes(properties, currentRegion, newBilling, "seed");
+					const provisionedIndexes = toSdkGlobalSecondaryIndexes(properties, currentRegion, newBilling, "seed", void 0, onUnusableGsiBlock);
+					const previousFlipIndexes = toSdkGlobalSecondaryIndexes(previousProperties, currentRegion, newBilling, "seed", void 0, onUnusablePreviousGsiBlock);
+					if (desiredGsiUnusable || previousGsiUnusable) throw new ProvisioningError(`Cannot flip AWS::DynamoDB::GlobalTable ${logicalId} to PROVISIONED while its GlobalSecondaryIndexes block is unusable: AWS requires per-index provisioned capacity in the same UpdateTable, and it cannot be derived from a malformed block (nor read from a table that is still on-demand). Fix the GlobalSecondaryIndexes value — in the template, or in the cdkd state record on a rollback / drift --revert replay — and re-deploy. The table is unchanged.`, resourceType, logicalId, physicalId);
+					const previousByIndexName = /* @__PURE__ */ new Map();
+					for (const gsi of previousFlipIndexes) if (gsi.IndexName) previousByIndexName.set(gsi.IndexName, gsi);
 					const previousCfnIndexes = previousProperties["GlobalSecondaryIndexes"];
 					const existingIndexNames = new Set((Array.isArray(previousCfnIndexes) ? previousCfnIndexes : []).map((entry) => entry?.["IndexName"]).filter((name) => typeof name === "string"));
-					const previousByIndexName = /* @__PURE__ */ new Map();
-					for (const gsi of toSdkGlobalSecondaryIndexes(previousProperties, currentRegion, newBilling, "seed")) if (gsi.IndexName) previousByIndexName.set(gsi.IndexName, gsi);
 					const byIndexName = new Map(previousByIndexName);
 					const survivingIndexNames = /* @__PURE__ */ new Set();
 					for (const gsi of provisionedIndexes) {
@@ -13121,8 +13174,18 @@ var DynamoDBGlobalTableProvider = class {
 				}));
 				await this.waitForReplicaActive(physicalId, region, logicalId);
 			}
-			const previousSdkIndexes = toSdkGlobalSecondaryIndexes(previousProperties, currentRegion, oldBilling);
-			const gsiDiff = diffGlobalSecondaryIndexes(previousSdkIndexes, desiredSdkIndexes);
+			const previousTranslatedIndexes = toSdkGlobalSecondaryIndexes(previousProperties, currentRegion, oldBilling, "min", void 0, onUnusablePreviousGsiBlock);
+			const previousSdkIndexes = previousGsiUnusable ? desiredSdkIndexes.filter((gsi) => typeof gsi.IndexName === "string" && liveIndexNames.has(gsi.IndexName)) : previousTranslatedIndexes;
+			if (previousGsiUnusable) {
+				const desiredNames = new Set(desiredSdkIndexes.map((gsi) => gsi.IndexName).filter((name) => typeof name === "string"));
+				const liveOnly = [...liveIndexNames].filter((name) => !desiredNames.has(name));
+				if (liveOnly.length > 0) this.logger.warn(`AWS::DynamoDB::GlobalTable ${logicalId}: ${liveOnly.join(", ")} exist(s) on the table but not in the template. No Delete is issued while the recorded GlobalSecondaryIndexes are unusable — a junk state record cannot prove cdkd created them. Re-deploy once state carries a valid block to remove them.`);
+			}
+			const gsiDiff = desiredGsiUnusable ? {
+				added: [],
+				removed: [],
+				modified: []
+			} : diffGlobalSecondaryIndexes(previousSdkIndexes, desiredSdkIndexes);
 			const rawOnDemandDeclarations = collectRawOnDemandDeclarations(properties, currentRegion);
 			const previousSdkByName = /* @__PURE__ */ new Map();
 			for (const prev of previousSdkIndexes) if (prev.IndexName) previousSdkByName.set(prev.IndexName, prev);
@@ -13182,7 +13245,10 @@ var DynamoDBGlobalTableProvider = class {
 				}));
 				await this.waitForTableActiveAfterUpdate(physicalId, logicalId);
 			}
-			if (newBilling === "PROVISIONED" || oldBilling === "PROVISIONED") {
+			const skipAutoScalingForUnusableGsi = desiredGsiUnusable && newBilling !== "PAY_PER_REQUEST";
+			const autoScalingMeaningfulForIndexes = (newBilling === "PROVISIONED" || oldBilling === "PROVISIONED") && !skipAutoScalingForUnusableGsi;
+			if (skipAutoScalingForUnusableGsi && oldBilling === "PROVISIONED") this.logger.warn(`AWS::DynamoDB::GlobalTable ${logicalId}: skipping the auto-scaling target reconcile because the GlobalSecondaryIndexes block is unusable — the per-index targets are derived from it, so reconciling would deregister the live indexes' scalable targets. Existing targets are left untouched.`);
+			if (autoScalingMeaningfulForIndexes) {
 				if (gsiDiff.added.length > 0) await this.waitForIndexesActive(physicalId, logicalId);
 				await this.reconcileAutoScalingTargets(physicalId, collectAutoScalingTargets(previousProperties, currentRegion), newBilling === "PAY_PER_REQUEST" ? [] : collectAutoScalingTargets(properties, currentRegion), currentRegion, autoScalingApplied);
 			}
@@ -14692,7 +14758,7 @@ function toSdkGlobalSecondaryIndexes(properties, region, billingMode, source = "
 	if (rawIndexes !== void 0 && !Array.isArray(rawIndexes)) {
 		const shapeDetail = `AWS::DynamoDB::GlobalTable GlobalSecondaryIndexes must be an array, got ${typeof rawIndexes} (${JSON.stringify(rawIndexes)?.slice(0, 200)}).`;
 		if (onUnusableIndexes) {
-			onUnusableIndexes(`${shapeDetail} Omitting the malformed block, so this create carries NO indexes; the same value is REFUSED on a template-path create`);
+			onUnusableIndexes(shapeDetail);
 			return [];
 		}
 		throw new Error(`${shapeDetail} An unresolved intrinsic here would otherwise deploy a table with no indexes.`);
@@ -68036,7 +68102,7 @@ function createMigrateCommand() {
 */
 function buildProgram() {
 	const program = new Command();
-	program.name("cdkd").description("CDK Direct - Deploy AWS CDK apps directly via SDK/Cloud Control API").version("0.278.53");
+	program.name("cdkd").description("CDK Direct - Deploy AWS CDK apps directly via SDK/Cloud Control API").version("0.278.54");
 	program.hook("preAction", (_thisCommand, actionCommand) => {
 		const { profile } = actionCommand.optsWithGlobals();
 		if (profile !== void 0) process.env["AWS_PROFILE"] = profile;