@go-to-k/cdkd 0.280.20 → 0.280.22

package/dist/cli.js

@@ -1,7 +1,7 @@
 #!/usr/bin/env node
-import { $ as requireConfigString, $t as processStackMessages, A as red, At as runDockerStreaming, B as isTerminationProtectionPropagationError, Bt as resolveSkipPrefix, C as isStatefulRecreateTargetSync, Ct as parseBootstrapMarker, D as cyan, Dn as normalizeAwsError, Dt as formatDockerLoginError, E as bold, Et as buildDockerImage, F as ProviderRegistry, Ft as getDefaultStateBucketName, G as normalizeAwsTagsToCfn, Gt as warnDeprecatedNoPrefixCliFlag, H as cfnRefValueFromPhysicalId, Ht as resolveStateBucketWithDefaultAndSource, I as findActionableSilentDrops, It as getLegacyStateBucketName, J as configStringRefusal, Jt as MIGRATE_TMP_PREFIX, K as resolveExplicitPhysicalId, Kt as CFN_TEMPLATE_BODY_LIMIT, L as CloudControlProvider, Lt as resolveApp, M as IAMRoleProvider, Mt as getDockerImageBySourceHash, N as collectInlinePolicyNamesManagedBySiblings, Nt as Synthesizer, O as gray, On as withErrorHandling, Ot as getDockerCmd, P as clearOnUpdateRemoval, Pt as synthesisStatusMessage, Q as requireConfigObject, Qt as AssemblyReader, R as slowCcOperationTimeoutMs, Rt as resolveAutoAssetStorage, S as MULTI_REGION_RECREATE_BLOCKED_TYPES, Sn as StackTerminationProtectionError, St as getBootstrapMarkerKey, T as formatResourceLine, Tt as validateContainerRepoName, U as refStateLookupFromResource, Ut as resolveUseCdkBootstrapAssets, V as IntrinsicFunctionResolver, Vt as resolveStateBucketWithDefault, W as WAFv2WebACLProvider, Wt as stateBucketExistenceConfirmed, X as replayWarn, Xt as uploadCfnTemplate, Y as readConfigString, Yt as findLargeInlineResources, Z as requireConfigArray, Zt as expectedOwnerParam, _ as createPreDeleteFinalSnapshot, _n as PartialFailureError, _t as loadPublishableAssetManifest, a as DeploymentEventsStore, an as setAwsClients, at as isThrottlingError, b as unsupportedFinalSnapshotError, bn as ResourceUpdateNotSupportedError, bt as BOOTSTRAP_MARKER_PREFIX, c as replayFailedOperations, ct as LockManager, d as IMPLICIT_DELETE_DEPENDENCIES, dn as LocalInvokeBuildError$1, dt as shouldRetainResource, et as applyRoleArnIfSet, f as computeImplicitDeleteEdges, fn as LocalMigrateError, ft as AssetPublisher, g as ccRoutedFinalSnapshotError, gn as NestedStackChildDirectDestroyError, gt as createAssetRedirectResolver, h as buildFinalSnapshotIdentifier, hn as MissingCdkCliError, ht as buildAssetRedirectMap, i as DeploymentEventsReader, in as resetAwsClients, it as isRetryableTransientError, j as yellow, jt as AssetManifestLoader, k as green, kt as runDockerForeground, l as replayRollback, lt as S3StateBackend, m as PRE_DELETE_SNAPSHOT_TYPES, mt as WorkGraph, n as DEFAULT_RESOURCE_WARN_AFTER_MS, nn as AwsClients, nt as describeTypeWithThrottleRetry, o as planFailedOps, ot as DagBuilder, p as ATOMIC_FINAL_SNAPSHOT_TYPES, pn as LocalStartServiceError, pt as stringifyValue, q as assertRegionMatch, qt as CFN_TEMPLATE_URL_LIMIT, r as DeployEngine, rn as getAwsClients, rt as withRetry, s as planRollback, sn as CdkdError, st as TemplateParser, t as DEFAULT_RESOURCE_TIMEOUT_MS, tn as resolveBucketRegion, tt as DiffCalculator, u as withResourceDeadline, un as DeployCancelledError, ut as rebuildClientForBucketRegion, v as isFinalSnapshotError, vn as ProvisioningError, vt as rewriteTemplateAssetReferences, w as renderStatefulReason, wt as validateAssetBucketName, x as extractDeploymentEventError, xn as StackHasActiveImportsError, xt as ensureAssetStorage, y as refusesFinalSnapshot, yn as ResourceTimeoutError, yt as AssetModeResolver, z as disableInstanceApiTermination, zt as resolveCaptureObservedState } from "./deploy-engine-CC3BV-Gp.js";
+import { $ as requireConfigString, $t as processStackMessages, A as red, At as runDockerStreaming, B as isTerminationProtectionPropagationError, Bt as resolveSkipPrefix, C as isStatefulRecreateTargetSync, Ct as parseBootstrapMarker, D as cyan, Dn as normalizeAwsError, Dt as formatDockerLoginError, E as bold, Et as buildDockerImage, F as ProviderRegistry, Ft as getDefaultStateBucketName, G as normalizeAwsTagsToCfn, Gt as warnDeprecatedNoPrefixCliFlag, H as cfnRefValueFromPhysicalId, Ht as resolveStateBucketWithDefaultAndSource, I as findActionableSilentDrops, It as getLegacyStateBucketName, J as configStringRefusal, Jt as MIGRATE_TMP_PREFIX, K as resolveExplicitPhysicalId, Kt as CFN_TEMPLATE_BODY_LIMIT, L as CloudControlProvider, Lt as resolveApp, M as IAMRoleProvider, Mt as getDockerImageBySourceHash, N as collectInlinePolicyNamesManagedBySiblings, Nt as Synthesizer, O as gray, On as withErrorHandling, Ot as getDockerCmd, P as clearOnUpdateRemoval, Pt as synthesisStatusMessage, Q as requireConfigObject, Qt as AssemblyReader, R as slowCcOperationTimeoutMs, Rt as resolveAutoAssetStorage, S as MULTI_REGION_RECREATE_BLOCKED_TYPES, Sn as StackTerminationProtectionError, St as getBootstrapMarkerKey, T as formatResourceLine, Tt as validateContainerRepoName, U as refStateLookupFromResource, Ut as resolveUseCdkBootstrapAssets, V as IntrinsicFunctionResolver, Vt as resolveStateBucketWithDefault, W as WAFv2WebACLProvider, Wt as stateBucketExistenceConfirmed, X as replayWarn, Xt as uploadCfnTemplate, Y as readConfigString, Yt as findLargeInlineResources, Z as requireConfigArray, Zt as expectedOwnerParam, _ as createPreDeleteFinalSnapshot, _n as PartialFailureError, _t as loadPublishableAssetManifest, a as DeploymentEventsStore, an as setAwsClients, at as isThrottlingError, b as unsupportedFinalSnapshotError, bn as ResourceUpdateNotSupportedError, bt as BOOTSTRAP_MARKER_PREFIX, c as replayFailedOperations, ct as LockManager, d as IMPLICIT_DELETE_DEPENDENCIES, dn as LocalInvokeBuildError$1, dt as shouldRetainResource, et as applyRoleArnIfSet, f as computeImplicitDeleteEdges, fn as LocalMigrateError, ft as AssetPublisher, g as ccRoutedFinalSnapshotError, gn as NestedStackChildDirectDestroyError, gt as createAssetRedirectResolver, h as buildFinalSnapshotIdentifier, hn as MissingCdkCliError, ht as buildAssetRedirectMap, i as DeploymentEventsReader, in as resetAwsClients, it as isRetryableTransientError, j as yellow, jt as AssetManifestLoader, k as green, kt as runDockerForeground, l as replayRollback, lt as S3StateBackend, m as PRE_DELETE_SNAPSHOT_TYPES, mt as WorkGraph, n as DEFAULT_RESOURCE_WARN_AFTER_MS, nn as AwsClients, nt as describeTypeWithThrottleRetry, o as planFailedOps, ot as DagBuilder, p as ATOMIC_FINAL_SNAPSHOT_TYPES, pn as LocalStartServiceError, pt as stringifyValue, q as assertRegionMatch, qt as CFN_TEMPLATE_URL_LIMIT, r as DeployEngine, rn as getAwsClients, rt as withRetry, s as planRollback, sn as CdkdError, st as TemplateParser, t as DEFAULT_RESOURCE_TIMEOUT_MS, tn as resolveBucketRegion, tt as DiffCalculator, u as withResourceDeadline, un as DeployCancelledError, ut as rebuildClientForBucketRegion, v as isFinalSnapshotError, vn as ProvisioningError, vt as rewriteTemplateAssetReferences, w as renderStatefulReason, wt as validateAssetBucketName, x as extractDeploymentEventError, xn as StackHasActiveImportsError, xt as ensureAssetStorage, y as refusesFinalSnapshot, yn as ResourceTimeoutError, yt as AssetModeResolver, z as disableInstanceApiTermination, zt as resolveCaptureObservedState } from "./deploy-engine-DObU-2va.js";
 import { a as getLiveRenderer, c as PATTERN_B_RESOURCE_TYPES, d as generateResourceNameWithFallback, f as withSkipPrefix, i as runStackBuffered, n as getLogger, o as PATTERN_B_NAME_OPTIONS, p as withStackName, s as PATTERN_B_NAME_PROPERTIES, u as generateResourceName } from "./logger-BYMEE-BS.js";
-import { t as ASGProvider } from "./asg-provider-BWT5cpBO.js";
+import { t as ASGProvider } from "./asg-provider-DVoWhe5E.js";
 import { AsyncLocalStorage } from "node:async_hooks";
 import { createHash, randomBytes, randomUUID } from "node:crypto";
 import { CopyObjectCommand, CreateBucketCommand, DeleteBucketAnalyticsConfigurationCommand, DeleteBucketCommand, DeleteBucketCorsCommand, DeleteBucketEncryptionCommand, DeleteBucketIntelligentTieringConfigurationCommand, DeleteBucketInventoryConfigurationCommand, DeleteBucketLifecycleCommand, DeleteBucketMetricsConfigurationCommand, DeleteBucketOwnershipControlsCommand, DeleteBucketPolicyCommand, DeleteBucketReplicationCommand, DeleteBucketTaggingCommand, DeleteBucketWebsiteCommand, DeleteObjectsCommand, GetBucketAccelerateConfigurationCommand, GetBucketCorsCommand, GetBucketEncryptionCommand, GetBucketLifecycleConfigurationCommand, GetBucketLocationCommand, GetBucketLoggingCommand, GetBucketNotificationConfigurationCommand, GetBucketOwnershipControlsCommand, GetBucketPolicyCommand, GetBucketReplicationCommand, GetBucketTaggingCommand, GetBucketVersioningCommand, GetBucketWebsiteCommand, GetObjectCommand, GetObjectLockConfigurationCommand, GetPublicAccessBlockCommand, HeadBucketCommand, ListBucketAnalyticsConfigurationsCommand, ListBucketIntelligentTieringConfigurationsCommand, ListBucketInventoryConfigurationsCommand, ListBucketMetricsConfigurationsCommand, ListObjectVersionsCommand, ListObjectsV2Command, NoSuchBucket, PutBucketAccelerateConfigurationCommand, PutBucketAnalyticsConfigurationCommand, PutBucketCorsCommand, PutBucketEncryptionCommand, PutBucketIntelligentTieringConfigurationCommand, PutBucketInventoryConfigurationCommand, PutBucketLifecycleConfigurationCommand, PutBucketLoggingCommand, PutBucketMetricsConfigurationCommand, PutBucketNotificationConfigurationCommand, PutBucketOwnershipControlsCommand, PutBucketPolicyCommand, PutBucketReplicationCommand, PutBucketTaggingCommand, PutBucketVersioningCommand, PutBucketWebsiteCommand, PutObjectCommand, PutObjectLockConfigurationCommand, PutPublicAccessBlockCommand, S3Client, S3ServiceException } from "@aws-sdk/client-s3";
@@ -11857,6 +11857,51 @@ function readCapacityNumber(block, member) {
 	return Number.isFinite(value) ? value : void 0;
 }
 /**
+* Whether a desired `GlobalSecondaryIndexes[]` entry declares BOTH capacity
+* members usably — the same test the BillingMode flip's per-index block applies
+* before it forwards the index, expressed as a predicate for the pre-flip
+* removal's look-ahead (issue #1617).
+*
+* BOTH members are required, exactly as in the flip block: an entry declaring
+* only one is treated like an absent one there, so accepting it here would let
+* the pre-flip delete run ahead of a flip AWS still rejects.
+*/
+function hasUsableDeclaredCapacity(entry) {
+	const declared = entry?.["ProvisionedThroughput"];
+	return readCapacityNumber(declared, "ReadCapacityUnits") !== void 0 && readCapacityNumber(declared, "WriteCapacityUnits") !== void 0;
+}
+/**
+* Whether the desired TABLE-level `ProvisionedThroughput` is one the flip can
+* actually send (issue #1617 PR review).
+*
+* Deliberately NOT {@link hasUsableDeclaredCapacity}: the flip defaults each
+* member to 5 when absent (`Number(pt['ReadCapacityUnits'] ?? 5)`), so a
+* half-declared TABLE capacity is sendable while a half-declared per-INDEX one
+* is not.
+*
+* It mirrors the flip's GATE as well as its arithmetic, which the first version
+* did not and a second review round caught — both halves of that miss are real:
+*
+* - the gate is plain TRUTHINESS (`properties['ProvisionedThroughput']`), so a
+*   non-object truthy value sends `{5, 5}` and SUCCEEDS. Requiring a plain
+*   object refused it and skipped a removal that would have been fine.
+* - a DECLARED member that coerces to `0` (`''`, `false`, `[]`) is finite, so
+*   an arithmetic-only check accepted it — while AWS rejects a capacity below
+*   1, which is precisely the deterministic rejection this predicate exists to
+*   keep a delete from running ahead of.
+*/
+function hasUsableTableCapacity(value) {
+	if (!value) return false;
+	if (typeof value !== "object" || Array.isArray(value)) return true;
+	const pt = value;
+	for (const member of ["ReadCapacityUnits", "WriteCapacityUnits"]) {
+		if (pt[member] === void 0) continue;
+		const n = Number(pt[member]);
+		if (!Number.isFinite(n) || n < 1) return false;
+	}
+	return true;
+}
+/**
 * `DescribeTable` poll budget (seconds, 1 poll/s) after an ordinary
 * `UpdateTable` — capacity, TTL, tags, table class. Calibrated on those and
 * sufficient for them.
@@ -11997,6 +12042,41 @@ var DynamoDBTableProvider = class {
 			const billingMode = billingModeUnusable ? prevBillingMode : requestedBillingMode;
 			const billingOrThroughputChanged = billingMode !== prevBillingMode || JSON.stringify(properties["ProvisionedThroughput"]) !== JSON.stringify(previousProperties["ProvisionedThroughput"]);
 			if (billingOrThroughputChanged && billingMode === "PROVISIONED" && (prevBillingMode === "PAY_PER_REQUEST" || liveBillingMode === "PAY_PER_REQUEST") && properties["OnDemandThroughput"] !== void 0) throw new ProvisioningError(`AWS::DynamoDB::Table ${logicalId}: the template flips BillingMode to PROVISIONED${properties["BillingMode"] === void 0 ? " (BillingMode is absent from the template, which CloudFormation resets to PROVISIONED)" : ""} while still declaring OnDemandThroughput, which AWS accepts only on a PAY_PER_REQUEST table. Nothing was applied. Remove OnDemandThroughput, or keep BillingMode: PAY_PER_REQUEST.`, logicalId, resourceType);
+			const liveIndexes = table?.GlobalSecondaryIndexes ?? [];
+			const desiredIndexByName = /* @__PURE__ */ new Map();
+			for (const entry of Array.isArray(properties["GlobalSecondaryIndexes"]) ? properties["GlobalSecondaryIndexes"] : []) {
+				const name = entry?.["IndexName"];
+				if (typeof name === "string") desiredIndexByName.set(name, entry);
+			}
+			const preFlipDeletedIndexNames = /* @__PURE__ */ new Set();
+			const desiredIndexesUnusable = properties["GlobalSecondaryIndexes"] != null && !Array.isArray(properties["GlobalSecondaryIndexes"]);
+			if (billingOrThroughputChanged && billingMode === "PROVISIONED" && liveBillingMode === "PAY_PER_REQUEST" && liveIndexes.length > 0 && !desiredIndexesUnusable) {
+				const previousIndexNames = new Set((Array.isArray(previousProperties["GlobalSecondaryIndexes"]) ? previousProperties["GlobalSecondaryIndexes"] : []).map((entry) => entry?.["IndexName"]).filter((name) => typeof name === "string"));
+				const removable = [];
+				const remainingWithoutCapacity = [];
+				for (const live of liveIndexes) {
+					const indexName = live.IndexName;
+					if (typeof indexName !== "string") continue;
+					if (!desiredIndexByName.has(indexName)) {
+						if (previousIndexNames.has(indexName)) removable.push(indexName);
+						else remainingWithoutCapacity.push(indexName);
+						continue;
+					}
+					if (!hasUsableDeclaredCapacity(desiredIndexByName.get(indexName))) remainingWithoutCapacity.push(indexName);
+				}
+				const tableCapacityUnusable = !hasUsableTableCapacity(properties["ProvisionedThroughput"]);
+				if (removable.length > 0 && (remainingWithoutCapacity.length > 0 || tableCapacityUnusable)) {
+					const reasons = [];
+					if (remainingWithoutCapacity.length > 0) reasons.push(`index(es) ${remainingWithoutCapacity.join(", ")} stay live and declare no usable per-index ProvisionedThroughput (both ReadCapacityUnits and WriteCapacityUnits are required there)`);
+					if (tableCapacityUnusable) reasons.push(`the template declares no usable table-level ProvisionedThroughput`);
+					this.logger.warn(`AWS::DynamoDB::Table ${logicalId}: this deploy removes global secondary index(es) ${removable.join(", ")} and flips BillingMode to PROVISIONED. The removal would normally be applied BEFORE the flip, but ${reasons.join(" and ")}, so AWS rejects the flip either way. Nothing was removed.`);
+				} else if (removable.length > 0) {
+					this.logger.debug(`Deleting GSI(s) ${removable.join(", ")} on DynamoDB table ${physicalId} before the BillingMode flip to PROVISIONED`);
+					await this.runGsiOps(physicalId, removable.map((name) => ({ Delete: { IndexName: name } })), void 0);
+					for (const name of removable) preFlipDeletedIndexNames.add(name);
+				}
+			}
+			const currentLiveIndexNames = table ? new Set(liveIndexes.map((live) => live.IndexName).filter((name) => typeof name === "string").filter((name) => !preFlipDeletedIndexNames.has(name))) : void 0;
 			const gsiHandledByBillingFlip = /* @__PURE__ */ new Set();
 			if (billingOrThroughputChanged || tableClassChanged) {
 				const updateInput = { TableName: physicalId };
@@ -12009,20 +12089,14 @@ var DynamoDBTableProvider = class {
 						WriteCapacityUnits: Number(pt["WriteCapacityUnits"] ?? 5)
 					};
 				}
-				const liveIndexes = table?.GlobalSecondaryIndexes ?? [];
-				if (billingOrThroughputChanged && billingMode === "PROVISIONED" && liveBillingMode === "PAY_PER_REQUEST" && liveIndexes.length > 0) {
-					const desiredIndexes = Array.isArray(properties["GlobalSecondaryIndexes"]) ? properties["GlobalSecondaryIndexes"] : [];
-					const desiredByName = /* @__PURE__ */ new Map();
-					for (const entry of desiredIndexes) {
-						const name = entry?.["IndexName"];
-						if (typeof name === "string") desiredByName.set(name, entry);
-					}
+				const flipLiveIndexes = liveIndexes.filter((live) => typeof live.IndexName !== "string" || !preFlipDeletedIndexNames.has(live.IndexName));
+				if (billingOrThroughputChanged && billingMode === "PROVISIONED" && liveBillingMode === "PAY_PER_REQUEST" && flipLiveIndexes.length > 0) {
 					const indexUpdates = [];
 					const unspecified = [];
-					for (const live of liveIndexes) {
+					for (const live of flipLiveIndexes) {
 						const indexName = live.IndexName;
 						if (typeof indexName !== "string") continue;
-						const declared = desiredByName.get(indexName)?.["ProvisionedThroughput"];
+						const declared = desiredIndexByName.get(indexName)?.["ProvisionedThroughput"];
 						const read = readCapacityNumber(declared, "ReadCapacityUnits");
 						const write = readCapacityNumber(declared, "WriteCapacityUnits");
 						if (read === void 0 || write === void 0) {
@@ -12039,7 +12113,7 @@ var DynamoDBTableProvider = class {
 						gsiHandledByBillingFlip.add(indexName);
 					}
 					if (indexUpdates.length > 0) updateInput.GlobalSecondaryIndexUpdates = indexUpdates;
-					if (unspecified.length > 0) this.logger.warn(`AWS::DynamoDB::Table ${logicalId}: flipping BillingMode to PROVISIONED, but the template declares no usable ProvisionedThroughput for live index(es) ${unspecified.join(", ")}. AWS requires per-index capacity in the same UpdateTable and will reject the flip naming them. Declare GlobalSecondaryIndexes[].ProvisionedThroughput (both ReadCapacityUnits and WriteCapacityUnits) for each. If an index is listed here because this deploy REMOVES it, drop it in a separate deploy BEFORE the flip — AWS demands capacity for every index still live at flip time, so the two cannot be combined.`);
+					if (unspecified.length > 0) this.logger.warn(`AWS::DynamoDB::Table ${logicalId}: flipping BillingMode to PROVISIONED, but the template declares no usable ProvisionedThroughput for live index(es) ${unspecified.join(", ")}. AWS requires per-index capacity in the same UpdateTable and will reject the flip naming them. Declare GlobalSecondaryIndexes[].ProvisionedThroughput (both ReadCapacityUnits and WriteCapacityUnits) for each. An index this deploy REMOVES is deleted BEFORE the flip automatically (issue #1617), so a name here is one the template still keeps, one that exists in AWS but in neither the template nor cdkd state (created out of band), or one whose pre-flip removal was skipped for the reason warned above.`);
 				}
 				await this.dynamoDBClient.send(new UpdateTableCommand(updateInput));
 				if (billingMode !== liveBillingMode) await this.waitForTableAndIndexesActive(physicalId, BILLING_FLIP_ACTIVE_WAIT_ATTEMPTS);
@@ -12117,7 +12191,7 @@ var DynamoDBTableProvider = class {
 					this.logger.debug(`Disabled DynamoDB Stream on table ${physicalId}`);
 				}
 			}
-			if (JSON.stringify(properties["GlobalSecondaryIndexes"]) !== JSON.stringify(previousProperties["GlobalSecondaryIndexes"])) await this.applyGsiUpdates(physicalId, resourceType, logicalId, previousProperties["GlobalSecondaryIndexes"], properties["GlobalSecondaryIndexes"], properties["AttributeDefinitions"], gsiHandledByBillingFlip);
+			if (JSON.stringify(properties["GlobalSecondaryIndexes"]) !== JSON.stringify(previousProperties["GlobalSecondaryIndexes"])) await this.applyGsiUpdates(physicalId, resourceType, logicalId, previousProperties["GlobalSecondaryIndexes"], properties["GlobalSecondaryIndexes"], properties["AttributeDefinitions"], gsiHandledByBillingFlip, currentLiveIndexNames);
 			if (JSON.stringify(properties["PointInTimeRecoverySpecification"]) !== JSON.stringify(previousProperties["PointInTimeRecoverySpecification"])) await this.applyPointInTimeRecovery(physicalId, properties["PointInTimeRecoverySpecification"], previousProperties["PointInTimeRecoverySpecification"]);
 			if (JSON.stringify(properties["TimeToLiveSpecification"]) !== JSON.stringify(previousProperties["TimeToLiveSpecification"])) {
 				this.assertNoActiveTtlAttributeNameChange(logicalId, resourceType, physicalId, properties["TimeToLiveSpecification"], previousProperties["TimeToLiveSpecification"]);
@@ -12555,13 +12629,20 @@ var DynamoDBTableProvider = class {
 	*    a remove-then-add pair, so this method throws on such a change rather than
 	*    silently dropping it.
 	*/
-	async applyGsiUpdates(physicalId, resourceType, logicalId, previousGsis, desiredGsis, desiredAttributeDefinitions, handledByBillingFlip = /* @__PURE__ */ new Set()) {
+	async applyGsiUpdates(physicalId, resourceType, logicalId, previousGsis, desiredGsis, desiredAttributeDefinitions, handledByBillingFlip = /* @__PURE__ */ new Set(), liveIndexNames) {
 		const prev = previousGsis ?? [];
 		const desired = desiredGsis ?? [];
 		const prevByName = new Map(prev.filter((g) => g.IndexName).map((g) => [g.IndexName, g]));
 		const desiredByName = new Map(desired.filter((g) => g.IndexName).map((g) => [g.IndexName, g]));
 		const ops = [];
-		for (const name of prevByName.keys()) if (!desiredByName.has(name)) ops.push({ Delete: { IndexName: name } });
+		for (const name of prevByName.keys()) {
+			if (desiredByName.has(name)) continue;
+			if (liveIndexNames !== void 0 && !liveIndexNames.has(name)) {
+				this.logger.debug(`GSI ${name} is recorded in cdkd state but not live on DynamoDB table ${physicalId}; skipping its Delete (already removed)`);
+				continue;
+			}
+			ops.push({ Delete: { IndexName: name } });
+		}
 		for (const [name, gsi] of desiredByName) if (!prevByName.has(name)) {
 			if (!gsi.KeySchema) throw new ProvisioningError(`GlobalSecondaryIndex ${name} on DynamoDB table ${logicalId} is missing KeySchema`, resourceType, logicalId, physicalId);
 			ops.push({ Create: {
@@ -12579,6 +12660,18 @@ var DynamoDBTableProvider = class {
 				ProvisionedThroughput: gsi.ProvisionedThroughput
 			} });
 		}
+		await this.runGsiOps(physicalId, ops, desiredAttributeDefinitions);
+	}
+	/**
+	* Issue a list of `GlobalSecondaryIndexUpdates` ops, one per `UpdateTable`,
+	* waiting for the table AND every index to return to ACTIVE between each.
+	*
+	* Extracted from {@link applyGsiUpdates} so the pre-flip GSI removal (issue
+	* #1617) drives the identical call + wait sequence rather than a second copy
+	* of it — the wait is what makes the next op (there, the BillingMode flip)
+	* legal.
+	*/
+	async runGsiOps(physicalId, ops, desiredAttributeDefinitions) {
 		for (const op of ops) {
 			const input = {
 				TableName: physicalId,
@@ -52933,7 +53026,7 @@ function findRevertDroppedAwsKeys(drifts, desiredProperties, awsProperties) {
 	}
 	for (const key of driftedTopLevelKeys) {
 		if (!(key in desiredProperties)) continue;
-		collectMissingPaths(awsProperties[key], desiredProperties[key], key, dropped);
+		collectMissingPaths(awsProperties[key], desiredProperties[key], key, dropped, isTagListKey(key) ? isServiceManagedTagKey : void 0);
 	}
 	return [...dropped].sort();
 }
@@ -52941,12 +53034,46 @@ function findRevertDroppedAwsKeys(drifts, desiredProperties, awsProperties) {
 * Walk the AWS-side value against the desired-side value, recording every path
 * present on the AWS side and absent on the desired side.
 *
-* Only plain objects are descended into. An ARRAY is compared wholesale — the
-* drift comparator itself treats arrays as single values (its paths never
+* Plain objects are descended into. A POSITIONAL array is compared wholesale —
+* the drift comparator itself treats arrays as single values (its paths never
 * carry an index), so an element-wise walk here would report positions the
 * rest of the revert path cannot reason about.
-*/
-function collectMissingPaths(awsValue, desiredValue, path, out) {
+*
+* A KEYED list is the exception, and it is the shape with the most to drop
+* (issue [#1626](https://github.com/go-to-k/cdkd/issues/1626)). An
+* `[{Key, Value}]` list is semantically a MAP that CFn spells as an array —
+* ELBv2 `LoadBalancerAttributes`, `ListenerAttributes`, `TargetGroupAttributes`
+* and every `Tags` list are this shape — so its entries have stable identities,
+* not positions, and `Key` is exactly what the user would act on. Skipping it
+* left the pass blind precisely where `readCurrentState` returns AWS's FULL
+* attribute set (~20 entries) against a template that declares one or two: the
+* plan warned about nothing while the revert was about to touch eighteen keys.
+*
+* Keyed-list entries are reported in BRACKET form (`LoadBalancerAttributes
+* [deletion_protection.enabled]`) rather than dotted, because attribute keys
+* contain dots themselves and a dotted path would be ambiguous with a nested
+* object.
+*
+* `isPreservedKey` exempts entries the revert does NOT actually drop — the
+* caller passes {@link isServiceManagedTagKey} for a top-level TAG LIST, whose
+* revert goes through {@link mergeTagListForRevert} and keeps `aws:`-prefixed /
+* `AmazonECSManaged` entries (issue #1501). Reporting those would be a warning
+* about a loss that cannot happen.
+*/
+function collectMissingPaths(awsValue, desiredValue, path, out, isPreservedKey) {
+	if (isKeyedList(awsValue)) {
+		if (!isKeyedList(desiredValue)) {
+			if (desiredValue === void 0) out.add(path);
+			return;
+		}
+		const desiredKeys = new Set(desiredValue.map((e) => e.Key));
+		for (const entry of awsValue) {
+			if (desiredKeys.has(entry.Key)) continue;
+			if (isPreservedKey?.(entry.Key)) continue;
+			out.add(`${path}[${entry.Key}]`);
+		}
+		return;
+	}
 	if (!isPlainRecord(awsValue)) return;
 	if (!isPlainRecord(desiredValue)) {
 		if (desiredValue === void 0) out.add(path);
@@ -52961,6 +53088,17 @@ function collectMissingPaths(awsValue, desiredValue, path, out) {
 		collectMissingPaths(value, desiredValue[key], childPath, out);
 	}
 }
+/**
+* A NON-EMPTY array whose every element is an object carrying a string `Key`.
+*
+* Emptiness is deliberately excluded: `[]` carries no identities, so treating
+* it as keyed would report nothing on the AWS side and — as the DESIRED side —
+* would claim every AWS entry is dropped, which is already what the
+* whole-list arm reports more legibly.
+*/
+function isKeyedList(value) {
+	return Array.isArray(value) && value.length > 0 && value.every((e) => typeof e === "object" && e !== null && typeof e.Key === "string");
+}
 function isPlainRecord(value) {
 	return typeof value === "object" && value !== null && !Array.isArray(value);
 }
@@ -70107,7 +70245,7 @@ function createMigrateCommand() {
 */
 function buildProgram() {
 	const program = new Command();
-	program.name("cdkd").description("CDK Direct - Deploy AWS CDK apps directly via SDK/Cloud Control API").version("0.280.20");
+	program.name("cdkd").description("CDK Direct - Deploy AWS CDK apps directly via SDK/Cloud Control API").version("0.280.22");
 	program.hook("preAction", (_thisCommand, actionCommand) => {
 		const { profile } = actionCommand.optsWithGlobals();
 		if (profile !== void 0) process.env["AWS_PROFILE"] = profile;