@go-to-k/cdkd 0.280.4 → 0.280.5

package/dist/cli.js

@@ -1,7 +1,7 @@
 #!/usr/bin/env node
-import { $ as DiffCalculator, $t as resolveBucketRegion, A as red, At as getDockerImageBySourceHash, B as isTerminationProtectionPropagationError, Bt as resolveStateBucketWithDefaultAndSource, C as isStatefulRecreateTargetSync, Ct as validateContainerRepoName, D as cyan, Dt as runDockerForeground, E as bold, En as withErrorHandling, Et as getDockerCmd, F as ProviderRegistry, Ft as resolveApp, G as normalizeAwsTagsToCfn, Gt as CFN_TEMPLATE_URL_LIMIT, H as cfnRefValueFromPhysicalId, Ht as stateBucketExistenceConfirmed, I as findActionableSilentDrops, It as resolveAutoAssetStorage, J as readConfigString, Jt as uploadCfnTemplate, K as resolveExplicitPhysicalId, Kt as MIGRATE_TMP_PREFIX, L as CloudControlProvider, Lt as resolveCaptureObservedState, M as IAMRoleProvider, Mt as synthesisStatusMessage, N as collectInlinePolicyNamesManagedBySiblings, Nt as getDefaultStateBucketName, O as gray, Ot as runDockerStreaming, P as clearOnUpdateRemoval, Pt as getLegacyStateBucketName, Q as applyRoleArnIfSet, R as slowCcOperationTimeoutMs, Rt as resolveSkipPrefix, S as MULTI_REGION_RECREATE_BLOCKED_TYPES, St as validateAssetBucketName, T as formatResourceLine, Tn as normalizeAwsError, Tt as formatDockerLoginError, U as refStateLookupFromResource, Ut as warnDeprecatedNoPrefixCliFlag, V as IntrinsicFunctionResolver, Vt as resolveUseCdkBootstrapAssets, W as WAFv2WebACLProvider, Wt as CFN_TEMPLATE_BODY_LIMIT, X as requireConfigArray, Xt as AssemblyReader, Y as replayWarn, Yt as expectedOwnerParam, Z as requireConfigString, Zt as processStackMessages, _ as createPreDeleteFinalSnapshot, _n as ResourceTimeoutError, _t as AssetModeResolver, a as DeploymentEventsStore, an as CdkdError, at as TemplateParser, b as unsupportedFinalSnapshotError, bn as StackTerminationProtectionError, bt as getBootstrapMarkerKey, c as replayFailedOperations, cn as DeployCancelledError, ct as rebuildClientForBucketRegion, d as IMPLICIT_DELETE_DEPENDENCIES, dn as LocalStartServiceError, dt as stringifyValue, en as AwsClients, et as describeTypeWithThrottleRetry, f as computeImplicitDeleteEdges, ft as WorkGraph, g as ccRoutedFinalSnapshotError, gn as ProvisioningError, gt as rewriteTemplateAssetReferences, h as buildFinalSnapshotIdentifier, hn as PartialFailureError, ht as loadPublishableAssetManifest, i as DeploymentEventsReader, it as DagBuilder, j as yellow, jt as Synthesizer, k as green, kt as AssetManifestLoader, l as replayRollback, ln as LocalInvokeBuildError$1, lt as shouldRetainResource, m as PRE_DELETE_SNAPSHOT_TYPES, mn as NestedStackChildDirectDestroyError, mt as createAssetRedirectResolver, n as DEFAULT_RESOURCE_WARN_AFTER_MS, nn as resetAwsClients, nt as isRetryableTransientError, o as planFailedOps, ot as LockManager, p as ATOMIC_FINAL_SNAPSHOT_TYPES, pn as MissingCdkCliError, pt as buildAssetRedirectMap, q as assertRegionMatch, qt as findLargeInlineResources, r as DeployEngine, rn as setAwsClients, rt as isThrottlingError, s as planRollback, st as S3StateBackend, t as DEFAULT_RESOURCE_TIMEOUT_MS, tn as getAwsClients, tt as withRetry, u as withResourceDeadline, un as LocalMigrateError, ut as AssetPublisher, v as isFinalSnapshotError, vn as ResourceUpdateNotSupportedError, vt as BOOTSTRAP_MARKER_PREFIX, w as renderStatefulReason, wt as buildDockerImage, x as extractDeploymentEventError, xt as parseBootstrapMarker, y as refusesFinalSnapshot, yn as StackHasActiveImportsError, yt as ensureAssetStorage, z as disableInstanceApiTermination, zt as resolveStateBucketWithDefault } from "./deploy-engine-CttwgBIB.js";
+import { $ as DiffCalculator, $t as resolveBucketRegion, A as red, At as getDockerImageBySourceHash, B as isTerminationProtectionPropagationError, Bt as resolveStateBucketWithDefaultAndSource, C as isStatefulRecreateTargetSync, Ct as validateContainerRepoName, D as cyan, Dt as runDockerForeground, E as bold, En as withErrorHandling, Et as getDockerCmd, F as ProviderRegistry, Ft as resolveApp, G as normalizeAwsTagsToCfn, Gt as CFN_TEMPLATE_URL_LIMIT, H as cfnRefValueFromPhysicalId, Ht as stateBucketExistenceConfirmed, I as findActionableSilentDrops, It as resolveAutoAssetStorage, J as readConfigString, Jt as uploadCfnTemplate, K as resolveExplicitPhysicalId, Kt as MIGRATE_TMP_PREFIX, L as CloudControlProvider, Lt as resolveCaptureObservedState, M as IAMRoleProvider, Mt as synthesisStatusMessage, N as collectInlinePolicyNamesManagedBySiblings, Nt as getDefaultStateBucketName, O as gray, Ot as runDockerStreaming, P as clearOnUpdateRemoval, Pt as getLegacyStateBucketName, Q as applyRoleArnIfSet, R as slowCcOperationTimeoutMs, Rt as resolveSkipPrefix, S as MULTI_REGION_RECREATE_BLOCKED_TYPES, St as validateAssetBucketName, T as formatResourceLine, Tn as normalizeAwsError, Tt as formatDockerLoginError, U as refStateLookupFromResource, Ut as warnDeprecatedNoPrefixCliFlag, V as IntrinsicFunctionResolver, Vt as resolveUseCdkBootstrapAssets, W as WAFv2WebACLProvider, Wt as CFN_TEMPLATE_BODY_LIMIT, X as requireConfigArray, Xt as AssemblyReader, Y as replayWarn, Yt as expectedOwnerParam, Z as requireConfigString, Zt as processStackMessages, _ as createPreDeleteFinalSnapshot, _n as ResourceTimeoutError, _t as AssetModeResolver, a as DeploymentEventsStore, an as CdkdError, at as TemplateParser, b as unsupportedFinalSnapshotError, bn as StackTerminationProtectionError, bt as getBootstrapMarkerKey, c as replayFailedOperations, cn as DeployCancelledError, ct as rebuildClientForBucketRegion, d as IMPLICIT_DELETE_DEPENDENCIES, dn as LocalStartServiceError, dt as stringifyValue, en as AwsClients, et as describeTypeWithThrottleRetry, f as computeImplicitDeleteEdges, ft as WorkGraph, g as ccRoutedFinalSnapshotError, gn as ProvisioningError, gt as rewriteTemplateAssetReferences, h as buildFinalSnapshotIdentifier, hn as PartialFailureError, ht as loadPublishableAssetManifest, i as DeploymentEventsReader, it as DagBuilder, j as yellow, jt as Synthesizer, k as green, kt as AssetManifestLoader, l as replayRollback, ln as LocalInvokeBuildError$1, lt as shouldRetainResource, m as PRE_DELETE_SNAPSHOT_TYPES, mn as NestedStackChildDirectDestroyError, mt as createAssetRedirectResolver, n as DEFAULT_RESOURCE_WARN_AFTER_MS, nn as resetAwsClients, nt as isRetryableTransientError, o as planFailedOps, ot as LockManager, p as ATOMIC_FINAL_SNAPSHOT_TYPES, pn as MissingCdkCliError, pt as buildAssetRedirectMap, q as assertRegionMatch, qt as findLargeInlineResources, r as DeployEngine, rn as setAwsClients, rt as isThrottlingError, s as planRollback, st as S3StateBackend, t as DEFAULT_RESOURCE_TIMEOUT_MS, tn as getAwsClients, tt as withRetry, u as withResourceDeadline, un as LocalMigrateError, ut as AssetPublisher, v as isFinalSnapshotError, vn as ResourceUpdateNotSupportedError, vt as BOOTSTRAP_MARKER_PREFIX, w as renderStatefulReason, wt as buildDockerImage, x as extractDeploymentEventError, xt as parseBootstrapMarker, y as refusesFinalSnapshot, yn as StackHasActiveImportsError, yt as ensureAssetStorage, z as disableInstanceApiTermination, zt as resolveStateBucketWithDefault } from "./deploy-engine-C5xOvZbg.js";
 import { a as getLiveRenderer, c as PATTERN_B_RESOURCE_TYPES, d as generateResourceNameWithFallback, f as withSkipPrefix, i as runStackBuffered, n as getLogger, o as PATTERN_B_NAME_OPTIONS, p as withStackName, s as PATTERN_B_NAME_PROPERTIES, u as generateResourceName } from "./logger-BYMEE-BS.js";
-import { t as ASGProvider } from "./asg-provider-Cyuov8l5.js";
+import { t as ASGProvider } from "./asg-provider-DINOy61N.js";
 import { AsyncLocalStorage } from "node:async_hooks";
 import { createHash, randomBytes, randomUUID } from "node:crypto";
 import { CopyObjectCommand, CreateBucketCommand, DeleteBucketAnalyticsConfigurationCommand, DeleteBucketCommand, DeleteBucketCorsCommand, DeleteBucketEncryptionCommand, DeleteBucketIntelligentTieringConfigurationCommand, DeleteBucketInventoryConfigurationCommand, DeleteBucketLifecycleCommand, DeleteBucketMetricsConfigurationCommand, DeleteBucketOwnershipControlsCommand, DeleteBucketPolicyCommand, DeleteBucketReplicationCommand, DeleteBucketTaggingCommand, DeleteBucketWebsiteCommand, DeleteObjectsCommand, GetBucketAccelerateConfigurationCommand, GetBucketCorsCommand, GetBucketEncryptionCommand, GetBucketLifecycleConfigurationCommand, GetBucketLocationCommand, GetBucketLoggingCommand, GetBucketNotificationConfigurationCommand, GetBucketOwnershipControlsCommand, GetBucketPolicyCommand, GetBucketReplicationCommand, GetBucketTaggingCommand, GetBucketVersioningCommand, GetBucketWebsiteCommand, GetObjectCommand, GetObjectLockConfigurationCommand, GetPublicAccessBlockCommand, HeadBucketCommand, ListBucketAnalyticsConfigurationsCommand, ListBucketIntelligentTieringConfigurationsCommand, ListBucketInventoryConfigurationsCommand, ListBucketMetricsConfigurationsCommand, ListObjectVersionsCommand, ListObjectsV2Command, NoSuchBucket, PutBucketAccelerateConfigurationCommand, PutBucketAnalyticsConfigurationCommand, PutBucketCorsCommand, PutBucketEncryptionCommand, PutBucketIntelligentTieringConfigurationCommand, PutBucketInventoryConfigurationCommand, PutBucketLifecycleConfigurationCommand, PutBucketLoggingCommand, PutBucketMetricsConfigurationCommand, PutBucketNotificationConfigurationCommand, PutBucketOwnershipControlsCommand, PutBucketPolicyCommand, PutBucketReplicationCommand, PutBucketTaggingCommand, PutBucketVersioningCommand, PutBucketWebsiteCommand, PutObjectCommand, PutObjectLockConfigurationCommand, PutPublicAccessBlockCommand, S3Client, S3ServiceException } from "@aws-sdk/client-s3";
@@ -12954,7 +12954,8 @@ var DynamoDBGlobalTableProvider = class {
 			if (tableArn) await this.applyTagDiff(tableArn, extractLocalTags(previousProperties), extractLocalTags(properties));
 			const recordedOldBilling = previousProperties["BillingMode"];
 			const recordedOldBillingUsable = recordedOldBilling === void 0 || typeof recordedOldBilling === "string" && recordedOldBilling.trim() !== "";
-			const oldBilling = recordedOldBillingUsable ? recordedOldBilling ?? "PAY_PER_REQUEST" : describeResp.Table?.BillingModeSummary?.BillingMode ?? "PROVISIONED";
+			const liveBillingMode = describeResp.Table?.BillingModeSummary?.BillingMode ?? "PROVISIONED";
+			const oldBilling = recordedOldBillingUsable ? recordedOldBilling ?? "PAY_PER_REQUEST" : liveBillingMode;
 			if (!recordedOldBillingUsable) this.logger.warn(`AWS::DynamoDB::GlobalTable ${logicalId}: the recorded previous BillingMode is unusable (${JSON.stringify(recordedOldBilling)}) — using the table's actual billing mode (${oldBilling}) as the comparison baseline for this update so a corrected template does not issue a same-mode UpdateTable.`);
 			let billingUnusable = false;
 			const requestedBilling = requireConfigString(properties["BillingMode"], "PAY_PER_REQUEST", "AWS::DynamoDB::GlobalTable BillingMode", { onUnusable: (message) => {
@@ -12970,12 +12971,12 @@ var DynamoDBGlobalTableProvider = class {
 			let desiredGsiUnusable = false;
 			const onUnusableGsiBlock = (message) => {
 				desiredGsiUnusable = true;
-				this.logger.warn(`${message} No GlobalSecondaryIndexes change is applied by this update; the table's existing indexes are left untouched.`);
+				this.logger.warn(`AWS::DynamoDB::GlobalTable ${logicalId}: ${message} No GlobalSecondaryIndexes change is applied by this update; the table's existing indexes are left untouched.`);
 			};
 			let previousGsiUnusable = false;
 			const onUnusablePreviousGsiBlock = (message) => {
 				previousGsiUnusable = true;
-				this.logger.warn(`${message} (recorded in cdkd state, not in the template) — using the table's LIVE indexes as the comparison baseline for this update, so a corrected template still applies.`);
+				this.logger.warn(`AWS::DynamoDB::GlobalTable ${logicalId}: ${message} (recorded in cdkd state, not in the template) — using the table's LIVE indexes as the comparison baseline for this update, so a corrected template still applies.`);
 			};
 			const liveIndexNames = new Set((describeResp.Table?.GlobalSecondaryIndexes ?? []).map((live) => live.IndexName).filter((name) => typeof name === "string"));
 			const desiredSdkIndexes = toSdkGlobalSecondaryIndexes(properties, currentRegion, newBilling, "min", flippingToProvisioned ? void 0 : diagnostics, onUnusableGsiBlock);
@@ -13182,11 +13183,15 @@ var DynamoDBGlobalTableProvider = class {
 				await this.waitForReplicaActive(physicalId, region, logicalId);
 			}
 			const previousTranslatedIndexes = toSdkGlobalSecondaryIndexes(previousProperties, currentRegion, oldBilling, "min", void 0, onUnusablePreviousGsiBlock);
-			const previousSdkIndexes = previousGsiUnusable ? desiredSdkIndexes.filter((gsi) => typeof gsi.IndexName === "string" && liveIndexNames.has(gsi.IndexName)) : previousTranslatedIndexes;
+			const previousSdkIndexes = previousGsiUnusable ? buildLiveRecoveryGsiBaseline(desiredSdkIndexes, describeResp.Table?.GlobalSecondaryIndexes, {
+				carryLiveValues: oldBilling === newBilling && liveBillingMode === newBilling,
+				liveBillingMode,
+				uncomparableCapacityIndexNames: collectUncomparableCapacityGsiNames(properties, currentRegion)
+			}) : previousTranslatedIndexes;
 			if (previousGsiUnusable) {
 				const desiredNames = new Set(desiredSdkIndexes.map((gsi) => gsi.IndexName).filter((name) => typeof name === "string"));
 				const liveOnly = [...liveIndexNames].filter((name) => !desiredNames.has(name));
-				if (liveOnly.length > 0) this.logger.warn(`AWS::DynamoDB::GlobalTable ${logicalId}: ${liveOnly.join(", ")} exist(s) on the table but not in the template. No Delete is issued while the recorded GlobalSecondaryIndexes are unusable — a junk state record cannot prove cdkd created them. Re-deploy once state carries a valid block to remove them.`);
+				if (liveOnly.length > 0) this.logger.warn(`AWS::DynamoDB::GlobalTable ${logicalId}: ${liveOnly.join(", ")} exist(s) on the table but not in the template. No Delete is issued while the recorded GlobalSecondaryIndexes are unusable — a junk state record cannot prove cdkd created them, and an index delete is irreversible. This does NOT self-heal, and no later cdkd deploy will remove them: delete the index directly, e.g. aws dynamodb update-table --table-name ${physicalId} --global-secondary-index-updates '[{"Delete":{"IndexName":"<name>"}}]'.`);
 			}
 			const gsiDiff = desiredGsiUnusable ? {
 				added: [],
@@ -14941,6 +14946,159 @@ function collectRawOnDemandDeclarations(properties, region) {
 	return out;
 }
 /**
+* Names of the GSIs whose PROVISIONED capacity must NOT be compared against
+* the live table (issue #1571). Two disjoint reasons, and both are about the
+* DESIRED side being a number the template did not actually choose:
+*
+* - **auto-scaled** — the live number is owned by Application Auto Scaling
+*   while the translation takes `MinCapacity` (see {@link CapacitySource}), so
+*   a live 10 against a template min of 1 reads as a scale-down NOBODY ASKED
+*   FOR. This was one of the three measured failure modes of the first
+*   value-carrying baseline (#1551), and the only one that cannot be resolved
+*   by reading the live side more carefully — both numbers are correct, they
+*   answer different questions.
+* - **not template-determined** — no capacity resolves to a finite number, so
+*   `toSdkGlobalSecondaryIndexes` substitutes `DEFAULT_CAPACITY_UNITS` (5/5,
+*   the issue #1511 class). Comparing that invented default against the live
+*   value turns it into a WRITE. Found by review, not by the first cut.
+*
+* Walks the same two sources as {@link toSdkGlobalSecondaryIndexes} and
+* {@link collectRawOnDemandDeclarations} — the LOCAL replica's index entry
+* first (the canonical CDK spelling), the GSI-level block as the
+* hand-authored fallback for read, the top-level GSI for write. A divergence
+* between the three is what would re-open the bug, so they are kept adjacent.
+*
+* The auto-scaling arm tests PRESENCE of the `*CapacityAutoScalingSettings`
+* key, not whether its members coerce: a block that is itself an unresolved
+* intrinsic still means "this index is autoscaled", and "might be" must read
+* as "is" — a false negative issues an unrequested scale-down.
+*
+* KNOWN BOUND: detection is TEMPLATE-side only. An index autoscaled OUT OF
+* BAND (no `*CapacityAutoScalingSettings` in the template) has a
+* template-determined capacity, so its live value IS compared and the recovery
+* deploy re-asserts the template's number — which is what a clean previous
+* side would also have done, so this matches ordinary cdkd semantics rather
+* than being a recovery-path defect.
+*
+* And the cost of a false positive is a PERMANENT divergence, not "one deploy
+* of lag": the deploy records the template value as state, so the next diff
+* sees previous == desired and never revisits it. That is the same self-heal
+* fallacy this PR corrects in the live-only warning; it is accepted here
+* because the alternative is writing a number the user never asked for.
+*/
+function collectUncomparableCapacityGsiNames(properties, region) {
+	const out = /* @__PURE__ */ new Set();
+	const rawIndexes = properties["GlobalSecondaryIndexes"];
+	if (!Array.isArray(rawIndexes)) return out;
+	const replicas = properties["Replicas"];
+	const localReplicaIndexes = asRecord$1(Array.isArray(replicas) ? replicas.find((r) => asRecord$1(r)?.["Region"] === region) : void 0)?.["GlobalSecondaryIndexes"];
+	const localByName = /* @__PURE__ */ new Map();
+	if (Array.isArray(localReplicaIndexes)) for (const entry of localReplicaIndexes) {
+		const record = asRecord$1(entry);
+		const name = record?.["IndexName"];
+		if (record && typeof name === "string") localByName.set(name, record);
+	}
+	for (const entry of rawIndexes) {
+		const gsi = asRecord$1(entry);
+		const name = gsi?.["IndexName"];
+		if (!gsi || typeof name !== "string") continue;
+		const readBlocks = [localByName.get(name)?.["ReadProvisionedThroughputSettings"], gsi["ReadProvisionedThroughputSettings"]];
+		const writeBlock = gsi["WriteProvisionedThroughputSettings"];
+		if (readBlocks.some((block) => asRecord$1(block)?.["ReadCapacityAutoScalingSettings"] !== void 0 || isUnresolvedIntrinsicBlock(block)) || asRecord$1(writeBlock)?.["WriteCapacityAutoScalingSettings"] !== void 0 || isUnresolvedIntrinsicBlock(writeBlock)) {
+			out.add(name);
+			continue;
+		}
+		const explicitProvisioned = asRecord$1(gsi["ProvisionedThroughput"]);
+		const derivedRead = toFiniteNumber(explicitProvisioned?.["ReadCapacityUnits"]) ?? deriveReadCapacityUnits(asRecord$1(readBlocks[0])) ?? deriveReadCapacityUnits(asRecord$1(readBlocks[1]));
+		const derivedWrite = toFiniteNumber(explicitProvisioned?.["WriteCapacityUnits"]) ?? deriveWriteCapacityUnits(asRecord$1(writeBlock));
+		if (derivedRead === void 0 || derivedWrite === void 0) out.add(name);
+	}
+	return out;
+}
+/**
+* Build the GSI diff baseline used when the cdkd STATE record's
+* `GlobalSecondaryIndexes` is present-but-unusable (issue #1571, closing the
+* residual #1551 / PR #1562 measured and deliberately left open).
+*
+* The entries are the DESIRED indexes filtered to the names that EXIST live —
+* the live table is the only side that can answer "does this index exist",
+* which is what stops the permanent index loss #1562 was about. What #1562
+* could not settle was the VALUES: it copied the desired entry verbatim, so
+* the diff could only ever produce ADDs and every capacity / ceiling edit
+* silently lagged one deploy.
+*
+* This carries live VALUES, but only the ones that are safe to compare, and
+* the exclusions are the three measured failure modes of the first attempt
+* (recorded at the `liveIndexNames` call site) rather than a guess:
+*
+*  - **`ProvisionedThroughput` is gated on the LIVE billing mode.**
+*    `DescribeTable` reports `{ReadCapacityUnits: 0, WriteCapacityUnits: 0}`
+*    for every index of a PAY_PER_REQUEST table, so an ungated read produced a
+*    "modified" on every index and re-sent `{0, 0}`, which AWS rejects.
+*  - **An AUTOSCALED index keeps identity-only capacity.** The live number
+*    belongs to Application Auto Scaling; the desired side is `MinCapacity`.
+*    Comparing them reads as a scale-down the user never asked for.
+*  - **`KeySchema` / `Projection` / `WarmThroughput` are always the desired
+*    side.** All three are copied from `desired`, so they can never DIFFER —
+*    deliberately. `KeySchema` and `Projection` are immutable on an existing
+*    index (a difference produces only a "recreate the index" warning, and
+*    AWS's `Projection.NonKeyAttributes` READBACK ORDER is not guaranteed, so
+*    the comparison would be a coin flip); `WarmThroughput` reads back with a
+*    `Status` member the translated shape does not carry, and DynamoDB warm
+*    throughput is increase-only, so a manufactured difference is a real
+*    AWS-side risk.
+*
+* `OnDemandThroughput` IS carried from live on an on-demand table, and that is
+* the second thing this fixes: the `modified` loop derives the `-1` ceiling
+* RESET (the #1160 absent-field-removal class) from the PREVIOUS side, so with
+* a desired-copy baseline a template that dropped `MaxReadRequestUnits` left
+* the old ceiling live in AWS forever while cdkd reported success.
+*
+* REMOVES are still not derivable here and are deliberately absent: an index
+* live but not in the template is in NEITHER side, so no `Delete` is issued.
+* A junk state record cannot distinguish "cdkd created this and the template
+* dropped it" from "somebody added it out of band", the delete is irreversible
+* and a re-create costs a full backfill. The caller names the live-only
+* indexes and points at the remedy.
+*/
+function buildLiveRecoveryGsiBaseline(desiredSdkIndexes, liveIndexes, options) {
+	const liveByName = /* @__PURE__ */ new Map();
+	for (const live of liveIndexes ?? []) if (typeof live.IndexName === "string") liveByName.set(live.IndexName, live);
+	const baseline = [];
+	for (const desired of desiredSdkIndexes) {
+		if (typeof desired.IndexName !== "string") continue;
+		const live = liveByName.get(desired.IndexName);
+		if (!live) continue;
+		const entry = { ...desired };
+		if (!options.carryLiveValues) {
+			baseline.push(entry);
+			continue;
+		}
+		if (options.liveBillingMode === "PROVISIONED") {
+			if (options.uncomparableCapacityIndexNames.has(desired.IndexName)) {
+				baseline.push(entry);
+				continue;
+			}
+			const liveRead = toFiniteNumber(live.ProvisionedThroughput?.ReadCapacityUnits);
+			const liveWrite = toFiniteNumber(live.ProvisionedThroughput?.WriteCapacityUnits);
+			if (desired.ProvisionedThroughput && liveRead !== void 0 && liveWrite !== void 0) entry.ProvisionedThroughput = {
+				ReadCapacityUnits: liveRead,
+				WriteCapacityUnits: liveWrite
+			};
+		} else {
+			const liveRead = toFiniteNumber(live.OnDemandThroughput?.MaxReadRequestUnits);
+			const liveWrite = toFiniteNumber(live.OnDemandThroughput?.MaxWriteRequestUnits);
+			if (liveRead === void 0 && liveWrite === void 0) delete entry.OnDemandThroughput;
+			else entry.OnDemandThroughput = {
+				...liveRead !== void 0 && { MaxReadRequestUnits: liveRead },
+				...liveWrite !== void 0 && { MaxWriteRequestUnits: liveWrite }
+			};
+		}
+		baseline.push(entry);
+	}
+	return baseline;
+}
+/**
 * Translate a CFn `Replicas[].GlobalSecondaryIndexes[]` blob (the
 * `ReplicaGlobalSecondaryIndexSpecification` shape) into the SDK's
 * `ReplicaGlobalSecondaryIndex[]` used by `CreateReplicationGroupMemberAction`
@@ -68549,7 +68707,7 @@ function createMigrateCommand() {
 */
 function buildProgram() {
 	const program = new Command();
-	program.name("cdkd").description("CDK Direct - Deploy AWS CDK apps directly via SDK/Cloud Control API").version("0.280.4");
+	program.name("cdkd").description("CDK Direct - Deploy AWS CDK apps directly via SDK/Cloud Control API").version("0.280.5");
 	program.hook("preAction", (_thisCommand, actionCommand) => {
 		const { profile } = actionCommand.optsWithGlobals();
 		if (profile !== void 0) process.env["AWS_PROFILE"] = profile;