@go-to-k/cdkd 0.281.19 → 0.281.21

package/dist/cli.js

@@ -1,7 +1,7 @@
 #!/usr/bin/env node
-import { $ as configStringRefusal, $t as CFN_TEMPLATE_URL_LIMIT, A as green, At as validateContainerRepoName, B as slowCcOperationTimeoutMs, Bt as synthesisStatusMessage, C as MULTI_REGION_RECREATE_BLOCKED_TYPES, Cn as PartialFailureError, Ct as rewriteTemplateAssetReferences, D as bold, Dn as StackHasActiveImportsError, Dt as getBootstrapMarkerKey, E as formatResourceLine, En as ResourceUpdateNotSupportedError, Et as ensureAssetStorage, F as clearOnUpdateRemoval, Ft as runDockerForeground, G as getAccountInfo, Gt as resolveCaptureObservedState, H as isTerminationProtectionPropagationError, Ht as getLegacyStateBucketName, I as ProviderRegistry, It as runDockerStreaming, J as normalizeAwsTagsToCfn, Jt as resolveStateBucketWithDefaultAndSource, K as refStateLookupFromResource, Kt as resolveSkipPrefix, L as findActionableSilentDrops, Lt as AssetManifestLoader, M as yellow, Mt as buildDockerImage, N as IAMRoleProvider, Nn as normalizeAwsError, Nt as formatDockerLoginError, O as cyan, On as StackTerminationProtectionError, Ot as parseBootstrapMarker, P as collectInlinePolicyNamesManagedBySiblings, Pn as withErrorHandling, Pt as getDockerCmd, Q as configBooleanRefusal, Qt as CFN_TEMPLATE_BODY_LIMIT, R as findSilentDropProperties, Rt as getDockerImageBySourceHash, S as extractDeploymentEventError, Sn as NestedStackChildDirectDestroyError, St as loadPublishableAssetManifest, T as renderStatefulReason, Tn as ResourceTimeoutError, Tt as BOOTSTRAP_MARKER_PREFIX, U as IntrinsicFunctionResolver, Ut as resolveApp, V as disableInstanceApiTermination, Vt as getDefaultStateBucketName, W as cfnRefValueFromPhysicalId, Wt as resolveAutoAssetStorage, X as assertRegionMatch, Xt as stateBucketExistenceConfirmed, Y as resolveExplicitPhysicalId, Yt as resolveUseCdkBootstrapAssets, Z as coerceCfnBoolean, Zt as warnDeprecatedNoPrefixCliFlag, _ as createPreDeleteFinalSnapshot, _n as LocalInvokeBuildError$1, _t as AssetPublisher, a as DeploymentEventsStore, an as processStackMessages, at as applyRoleArnIfSet, b as unsupportedFinalSnapshotError, bt as buildAssetRedirectMap, c as replayFailedOperations, cn as AwsClients, ct as withRetry, d as IMPLICIT_DELETE_DEPENDENCIES, dn as setAwsClients, dt as DagBuilder, en as MIGRATE_TMP_PREFIX, et as readConfigString, f as computeImplicitDeleteEdges, ft as TemplateParser, g as ccRoutedFinalSnapshotError, gn as DeployCancelledError, gt as shouldRetainResource, h as buildFinalSnapshotIdentifier, ht as rebuildClientForBucketRegion, i as DeploymentEventsReader, in as AssemblyReader, it as requireConfigString, j as red, jt as derivePartitionAndUrlSuffix, k as gray, kt as validateAssetBucketName, l as replayRollback, ln as getAwsClients, lt as isRetryableTransientError, m as PRE_DELETE_SNAPSHOT_TYPES, mt as S3StateBackend, n as DEFAULT_RESOURCE_WARN_AFTER_MS, nn as uploadCfnTemplate, nt as requireConfigArray, o as planFailedOps, ot as DiffCalculator, p as ATOMIC_FINAL_SNAPSHOT_TYPES, pn as CdkdError, pt as LockManager, q as WAFv2WebACLProvider, qt as resolveStateBucketWithDefault, r as DeployEngine, rn as expectedOwnerParam, rt as requireConfigObject, s as planRollback, sn as resolveBucketRegion, st as describeTypeWithThrottleRetry, t as DEFAULT_RESOURCE_TIMEOUT_MS, tn as findLargeInlineResources, tt as replayWarn, u as withResourceDeadline, un as resetAwsClients, ut as isThrottlingError, v as isFinalSnapshotError, vn as LocalMigrateError, vt as stringifyValue, w as isStatefulRecreateTargetSync, wn as ProvisioningError, wt as AssetModeResolver, x as makeCanonicalizePropertiesFn, xn as MissingCdkCliError, xt as createAssetRedirectResolver, y as refusesFinalSnapshot, yn as LocalStartServiceError, yt as WorkGraph, z as CloudControlProvider, zt as Synthesizer } from "./deploy-engine-DPnxkjWi.js";
+import { $ as configStringRefusal, $t as CFN_TEMPLATE_URL_LIMIT, A as green, At as validateContainerRepoName, B as slowCcOperationTimeoutMs, Bt as synthesisStatusMessage, C as MULTI_REGION_RECREATE_BLOCKED_TYPES, Cn as PartialFailureError, Ct as rewriteTemplateAssetReferences, D as bold, Dn as StackHasActiveImportsError, Dt as getBootstrapMarkerKey, E as formatResourceLine, En as ResourceUpdateNotSupportedError, Et as ensureAssetStorage, F as clearOnUpdateRemoval, Ft as runDockerForeground, G as getAccountInfo, Gt as resolveCaptureObservedState, H as isTerminationProtectionPropagationError, Ht as getLegacyStateBucketName, I as ProviderRegistry, It as runDockerStreaming, J as normalizeAwsTagsToCfn, Jt as resolveStateBucketWithDefaultAndSource, K as refStateLookupFromResource, Kt as resolveSkipPrefix, L as findActionableSilentDrops, Lt as AssetManifestLoader, M as yellow, Mt as buildDockerImage, N as IAMRoleProvider, Nn as normalizeAwsError, Nt as formatDockerLoginError, O as cyan, On as StackTerminationProtectionError, Ot as parseBootstrapMarker, P as collectInlinePolicyNamesManagedBySiblings, Pn as withErrorHandling, Pt as getDockerCmd, Q as configBooleanRefusal, Qt as CFN_TEMPLATE_BODY_LIMIT, R as findSilentDropProperties, Rt as getDockerImageBySourceHash, S as extractDeploymentEventError, Sn as NestedStackChildDirectDestroyError, St as loadPublishableAssetManifest, T as renderStatefulReason, Tn as ResourceTimeoutError, Tt as BOOTSTRAP_MARKER_PREFIX, U as IntrinsicFunctionResolver, Ut as resolveApp, V as disableInstanceApiTermination, Vt as getDefaultStateBucketName, W as cfnRefValueFromPhysicalId, Wt as resolveAutoAssetStorage, X as assertRegionMatch, Xt as stateBucketExistenceConfirmed, Y as resolveExplicitPhysicalId, Yt as resolveUseCdkBootstrapAssets, Z as coerceCfnBoolean, Zt as warnDeprecatedNoPrefixCliFlag, _ as createPreDeleteFinalSnapshot, _n as LocalInvokeBuildError$1, _t as AssetPublisher, a as DeploymentEventsStore, an as processStackMessages, at as applyRoleArnIfSet, b as unsupportedFinalSnapshotError, bt as buildAssetRedirectMap, c as replayFailedOperations, cn as AwsClients, ct as withRetry, d as IMPLICIT_DELETE_DEPENDENCIES, dn as setAwsClients, dt as DagBuilder, en as MIGRATE_TMP_PREFIX, et as readConfigString, f as computeImplicitDeleteEdges, ft as TemplateParser, g as ccRoutedFinalSnapshotError, gn as DeployCancelledError, gt as shouldRetainResource, h as buildFinalSnapshotIdentifier, ht as rebuildClientForBucketRegion, i as DeploymentEventsReader, in as AssemblyReader, it as requireConfigString, j as red, jt as derivePartitionAndUrlSuffix, k as gray, kt as validateAssetBucketName, l as replayRollback, ln as getAwsClients, lt as isRetryableTransientError, m as PRE_DELETE_SNAPSHOT_TYPES, mt as S3StateBackend, n as DEFAULT_RESOURCE_WARN_AFTER_MS, nn as uploadCfnTemplate, nt as requireConfigArray, o as planFailedOps, ot as DiffCalculator, p as ATOMIC_FINAL_SNAPSHOT_TYPES, pn as CdkdError, pt as LockManager, q as WAFv2WebACLProvider, qt as resolveStateBucketWithDefault, r as DeployEngine, rn as expectedOwnerParam, rt as requireConfigObject, s as planRollback, sn as resolveBucketRegion, st as describeTypeWithThrottleRetry, t as DEFAULT_RESOURCE_TIMEOUT_MS, tn as findLargeInlineResources, tt as replayWarn, u as withResourceDeadline, un as resetAwsClients, ut as isThrottlingError, v as isFinalSnapshotError, vn as LocalMigrateError, vt as stringifyValue, w as isStatefulRecreateTargetSync, wn as ProvisioningError, wt as AssetModeResolver, x as makeCanonicalizePropertiesFn, xn as MissingCdkCliError, xt as createAssetRedirectResolver, y as refusesFinalSnapshot, yn as LocalStartServiceError, yt as WorkGraph, z as CloudControlProvider, zt as Synthesizer } from "./deploy-engine-Cx48pqGQ.js";
 import { a as getLiveRenderer, c as PATTERN_B_RESOURCE_TYPES, d as generateResourceNameWithFallback, h as withStackName, i as runStackBuffered, m as withSkipPrefix, n as getLogger, o as PATTERN_B_NAME_OPTIONS, s as PATTERN_B_NAME_PROPERTIES, u as generateResourceName } from "./logger-zRrlbaQt.js";
-import { t as ASGProvider } from "./asg-provider-CE-lwlgZ.js";
+import { t as ASGProvider } from "./asg-provider-CH0YfbOn.js";
 import { AsyncLocalStorage } from "node:async_hooks";
 import { createHash, randomBytes, randomUUID } from "node:crypto";
 import { CopyObjectCommand, CreateBucketCommand, DeleteBucketAnalyticsConfigurationCommand, DeleteBucketCommand, DeleteBucketCorsCommand, DeleteBucketEncryptionCommand, DeleteBucketIntelligentTieringConfigurationCommand, DeleteBucketInventoryConfigurationCommand, DeleteBucketLifecycleCommand, DeleteBucketMetricsConfigurationCommand, DeleteBucketOwnershipControlsCommand, DeleteBucketPolicyCommand, DeleteBucketReplicationCommand, DeleteBucketTaggingCommand, DeleteBucketWebsiteCommand, DeleteObjectsCommand, GetBucketAccelerateConfigurationCommand, GetBucketCorsCommand, GetBucketEncryptionCommand, GetBucketLifecycleConfigurationCommand, GetBucketLocationCommand, GetBucketLoggingCommand, GetBucketNotificationConfigurationCommand, GetBucketOwnershipControlsCommand, GetBucketPolicyCommand, GetBucketReplicationCommand, GetBucketTaggingCommand, GetBucketVersioningCommand, GetBucketWebsiteCommand, GetObjectCommand, GetObjectLockConfigurationCommand, GetPublicAccessBlockCommand, HeadBucketCommand, ListBucketAnalyticsConfigurationsCommand, ListBucketIntelligentTieringConfigurationsCommand, ListBucketInventoryConfigurationsCommand, ListBucketMetricsConfigurationsCommand, ListObjectVersionsCommand, ListObjectsV2Command, NoSuchBucket, PutBucketAccelerateConfigurationCommand, PutBucketAnalyticsConfigurationCommand, PutBucketCorsCommand, PutBucketEncryptionCommand, PutBucketIntelligentTieringConfigurationCommand, PutBucketInventoryConfigurationCommand, PutBucketLifecycleConfigurationCommand, PutBucketLoggingCommand, PutBucketMetricsConfigurationCommand, PutBucketNotificationConfigurationCommand, PutBucketOwnershipControlsCommand, PutBucketPolicyCommand, PutBucketReplicationCommand, PutBucketTaggingCommand, PutBucketVersioningCommand, PutBucketWebsiteCommand, PutObjectCommand, PutObjectLockConfigurationCommand, PutPublicAccessBlockCommand, S3Client, S3ServiceException } from "@aws-sdk/client-s3";
@@ -13320,6 +13320,51 @@ const TABLE_ACTIVE_WAIT_ATTEMPTS = 60;
 * genuinely wedged capacity edit still fails in a minute rather than ten.
 */
 const BILLING_FLIP_ACTIVE_WAIT_ATTEMPTS = 600;
+/**
+* Is this `WarmThroughput` VALUE one cdkd will actually put on the wire
+* (issue #1760)?
+*
+* The single definition of the send rule. `create()` and `update()` call it
+* where they used to inline `if (properties['WarmThroughput'])`, and the
+* bag-level {@link declaresWarmThroughput} below calls it too — so the drift
+* side cannot answer "the template declared one" for a value the write side
+* silently skips. That divergence is not hypothetical: with the two sites
+* spelled independently, respelling either as `!== undefined` leaves every
+* test green while the pair starts disagreeing on `WarmThroughput: null`, and
+* the disagreement re-creates the exact phantom drift this issue removed —
+* cdkd sends nothing, AWS still computes 12000/4000, the readback emits it as
+* though the template had asked, and `--revert` can never clear it because the
+* write gate skips the falsy value. Keep this the ONLY spelling of the rule.
+*
+* Deliberately TRUTHINESS, because that is what the wire has always done.
+*/
+function isSendableWarmThroughput(value) {
+	return Boolean(value);
+}
+/**
+* Does this desired-property bag DECLARE a table-level `WarmThroughput`?
+*
+* The drift-side question ("did cdkd send one for this resource"), answered by
+* {@link isSendableWarmThroughput} so it cannot drift from the write path.
+*
+* An ABSENT or EMPTY bag answers TRUE: the caller supplied nothing to decide
+* with, so both drift consumers keep the pre-#1760 behavior (emit it, compare
+* it) rather than dropping a key on the strength of a bag that was never
+* passed. That fallback is exactly why the write sites take the VALUE-level
+* predicate instead of this one — handing `create()` an absent bag must send
+* nothing, not send `undefined`.
+*
+* Note the empty-bag arm carries the same residual as the declared arm
+* (issue #1768): a `properties: {}` record keeps the AWS-computed value in its
+* snapshot, so a `--revert` on such a resource can re-send it. Left as-is
+* rather than dropped, because a bag that was never populated is not evidence
+* the template declared nothing — and a wrong DROP here is unrecoverable
+* phantom drift, while the residual is a loud, per-resource revert failure.
+*/
+function declaresWarmThroughput(properties) {
+	if (properties === void 0 || Object.keys(properties).length === 0) return true;
+	return isSendableWarmThroughput(properties["WarmThroughput"]);
+}
 var DynamoDBTableProvider = class {
 	dynamoDBClient;
 	logger = getLogger().child("DynamoDBTableProvider");
@@ -13376,7 +13421,7 @@ var DynamoDBTableProvider = class {
 				};
 			}
 			if (properties["OnDemandThroughput"]) createParams.OnDemandThroughput = properties["OnDemandThroughput"];
-			if (properties["WarmThroughput"]) createParams.WarmThroughput = properties["WarmThroughput"];
+			if (isSendableWarmThroughput(properties["WarmThroughput"])) createParams.WarmThroughput = properties["WarmThroughput"];
 			if (properties["StreamSpecification"]) createParams.StreamSpecification = {
 				StreamEnabled: true,
 				StreamViewType: properties["StreamSpecification"]["StreamViewType"]
@@ -13539,7 +13584,7 @@ var DynamoDBTableProvider = class {
 				}
 			}
 			if (JSON.stringify(properties["WarmThroughput"]) !== JSON.stringify(previousProperties["WarmThroughput"])) {
-				if (properties["WarmThroughput"]) {
+				if (isSendableWarmThroughput(properties["WarmThroughput"])) {
 					await this.dynamoDBClient.send(new UpdateTableCommand({
 						TableName: physicalId,
 						WarmThroughput: properties["WarmThroughput"]
@@ -14131,6 +14176,75 @@ var DynamoDBTableProvider = class {
 		}
 	}
 	/**
+	* `AttributeDefinitions` is a SET, keyed by `AttributeName`: CFn accepts the
+	* members in any order and `DescribeTable` returns them in an order matching
+	* neither the request nor the template. Measured live (us-east-1,
+	* 2026-08-13): a `CreateTable` whose input declared
+	* `[{pk,S}, {gsipk,S}]` read back as `[{gsipk,S}, {pk,S}]` on the create
+	* response AND on every later `DescribeTable`. The comparator compares
+	* arrays positionally, so without this declaration the reorder is permanent
+	* phantom drift on a table nobody touched — reachable whenever the drift
+	* baseline is the template `properties` rather than `observedProperties`
+	* (after a reverse-replacement rollback, which strips `observedProperties`,
+	* or on a resource deployed before observed-capture existed; on the ordinary
+	* path both sides come from the same readback and already agree, which is
+	* why routine runs never surfaced it). Issue #1760, the
+	* `AWS::DynamoDB::Table` twin of issue #1742's `AWS::DynamoDB::GlobalTable`
+	* finding.
+	*
+	* `KeySchema` is deliberately NOT declared, at the table level or the index
+	* level: it is order-SIGNIFICANT (HASH before RANGE), so sorting it would
+	* HIDE a real key change rather than remove a phantom one.
+	*/
+	getDriftUnorderedPaths(resourceType) {
+		if (resourceType !== "AWS::DynamoDB::Table") return [];
+		return ["AttributeDefinitions"];
+	}
+	/**
+	* `WarmThroughput` is reported by AWS for EVERY table, whether or not the
+	* template ever asked for one. Measured live (us-east-1, 2026-08-13) on a
+	* `CreateTable` whose input declared NO `WarmThroughput`:
+	*
+	* ```
+	* "WarmThroughput": { "ReadUnitsPerSecond": 12000,
+	*                     "WriteUnitsPerSecond": 4000, "Status": "ACTIVE" }
+	* ```
+	*
+	* so `readCurrentState`'s emit-when-present guard could never do what its
+	* comment claimed ("only on tables that set warm throughput"). That value is
+	* AWS-computed and AWS-owned — it only ever increases as the table's traffic
+	* grows, and it cannot be lowered — so once it is frozen into an
+	* `observedProperties` baseline, a later AWS-side increase surfaces as drift
+	* on a property the user never declared and `--revert` would issue a
+	* decrease AWS rejects. `readCurrentState` therefore emits it only when the
+	* DESIRED bag declares it (the fix issue #1742 PROPOSES for the per-index
+	* sibling — still open and unlanded at the time of writing, so this is the
+	* first site to carry the shape), never as a blanket drop:
+	* `AWS::DynamoDB::Table` accepts an explicit `WarmThroughput` and a real
+	* change to one must stay visible. Known residual on that declared arm
+	* (issue #1768): AWS may GROW a declared value, which is reported as drift —
+	* correctly, cdkd holds a value AWS no longer has — but `--revert` then
+	* issues a decrease AWS rejects, surfacing as a per-resource revert failure
+	* rather than as a silent wrong answer.
+	*
+	* This declaration is the OTHER half: a state record written by an earlier
+	* binary already carries the computed value in `observedProperties`, so the
+	* gate alone would flip every such table to a one-sided `WarmThroughput`
+	* drift (baseline has it, the AWS side no longer emits it) until the next
+	* deploy refreshed the capture. Ignoring the path on BOTH sides when the
+	* template declares nothing covers the transition and the steady state
+	* alike; a table that DOES declare `WarmThroughput` is compared normally.
+	* Same per-resource scoping seam as `AWS::ApiGatewayV2::Integration`'s
+	* `TlsConfig` (issue #1602): an absent / empty bag falls back to the
+	* type-level answer of COMPARING, since hiding a real drift is the worse
+	* failure.
+	*/
+	getDriftUnknownPaths(resourceType, properties) {
+		if (resourceType !== "AWS::DynamoDB::Table") return [];
+		if (declaresWarmThroughput(properties)) return [];
+		return ["WarmThroughput"];
+	}
+	/**
 	* Read the AWS-current DynamoDB table configuration in CFn-property shape.
 	*
 	* `DescribeTable` returns every field cdkd manages in one call. AWS uses
@@ -14142,8 +14256,18 @@ var DynamoDBTableProvider = class {
 	*  - StreamSpecification's CFn shape includes only `StreamViewType`; the
 	*    API response carries `StreamEnabled` too. We surface both since the
 	*    drift comparator only descends into keys present in state.
-	*  - GSI / LSI in the API response include `IndexStatus`, `ItemCount` and
-	*    sizing fields that cdkd never sets; the comparator filters them.
+	*  - GSI / LSI in the API response include `IndexStatus`, `ItemCount`,
+	*    `IndexArn` and sizing fields cdkd never sets, and they are forwarded
+	*    VERBATIM. This used to claim "the comparator filters them" — it does
+	*    NOT, and issue #1767 quotes that sentence as the bug: the filter is
+	*    `calculateResourceDrift`'s state-keys-only walk, which only reaches an
+	*    absent TOP-LEVEL key. These are members of an array under a key the
+	*    baseline DOES carry, and arrays compare positionally, so every
+	*    AWS-managed member participates — `ItemCount` MOVES as data lands, so
+	*    an in-use table with an index drifts against its own
+	*    `observedProperties` on the ordinary path. Fixing it needs a full
+	*    reverse-mapper plus the same migration companion this issue's
+	*    `WarmThroughput` gate needed, hence a separate issue.
 	*
 	* Returns `undefined` when the table is gone (`ResourceNotFoundException`).
 	*
@@ -14153,8 +14277,12 @@ var DynamoDBTableProvider = class {
 	* drift, and the result key is omitted entirely when AWS reports no user
 	* tags (matches `create()`'s behavior of only sending Tags when the
 	* template carries them).
+	*
+	* `properties` is the DESIRED bag (the state-recorded template intent every
+	* caller passes) and is consulted for exactly one field, `WarmThroughput` —
+	* see {@link getDriftUnknownPaths} for the measurement and the reasoning.
 	*/
-	async readCurrentState(physicalId, _logicalId, _resourceType) {
+	async readCurrentState(physicalId, _logicalId, _resourceType, properties) {
 		try {
 			const table = (await this.dynamoDBClient.send(new DescribeTableCommand({ TableName: physicalId }))).Table;
 			if (!table) return void 0;
@@ -14173,7 +14301,7 @@ var DynamoDBTableProvider = class {
 				if (table.OnDemandThroughput.MaxWriteRequestUnits !== void 0) odt["MaxWriteRequestUnits"] = table.OnDemandThroughput.MaxWriteRequestUnits;
 				if (Object.keys(odt).length > 0) result["OnDemandThroughput"] = odt;
 			}
-			if (table.WarmThroughput) {
+			if (table.WarmThroughput && declaresWarmThroughput(properties)) {
 				const wt = {};
 				if (table.WarmThroughput.ReadUnitsPerSecond !== void 0) wt["ReadUnitsPerSecond"] = table.WarmThroughput.ReadUnitsPerSecond;
 				if (table.WarmThroughput.WriteUnitsPerSecond !== void 0) wt["WriteUnitsPerSecond"] = table.WarmThroughput.WriteUnitsPerSecond;
@@ -14572,6 +14700,18 @@ var DynamoDBGlobalTableProvider = class {
 				delete copy["GlobalSecondaryIndexes"];
 				return copy;
 			});
+			const keptKeyAttributes = collectDesiredKeyAttributeNames(properties, { indexListKeys: ["LocalSecondaryIndexes"] });
+			if (keptKeyAttributes.size > 0 && Array.isArray(attributeDefinitions)) {
+				const prunedAttributeDefinitions = attributeDefinitions.filter((definition) => {
+					const name = asRecord$1(definition)?.["AttributeName"];
+					if (typeof name !== "string") return true;
+					return keptKeyAttributes.has(name);
+				});
+				if (prunedAttributeDefinitions.length !== attributeDefinitions.length) {
+					createParams.AttributeDefinitions = prunedAttributeDefinitions;
+					effectiveProperties["AttributeDefinitions"] = [...prunedAttributeDefinitions];
+				}
+			}
 		}
 		if (sdkIndexes.length > 0) createParams.GlobalSecondaryIndexes = sdkIndexes;
 		if (properties["LocalSecondaryIndexes"]) createParams.LocalSecondaryIndexes = properties["LocalSecondaryIndexes"];
@@ -15945,6 +16085,31 @@ var DynamoDBGlobalTableProvider = class {
 		return [];
 	}
 	/**
+	* `AttributeDefinitions` is an unordered SET, and the comparator compares
+	* arrays positionally (issue #1742).
+	*
+	* `DescribeTable` returns the definitions in an order matching neither the
+	* request nor alphabetical — measured us-east-1 2026-08-13 on the
+	* `rollback-replay-effective-props` fixture, where a table declaring
+	* `[pk, gsipk]` read back as `[gsipk, pk]` — so an UNTOUCHED table drifted
+	* forever. Sorting cannot hide a real change here because the list is a
+	* genuine set: members are keyed by `AttributeName`, so adding, removing or
+	* retyping one still changes the canonicalized form.
+	*
+	* Reachable whenever the drift baseline is `properties` rather than
+	* `observedProperties` — i.e. after any reverse-replacement rollback, which
+	* `rollback-executor.ts` strips `observedProperties` on. That is also why it
+	* went unseen: on the ordinary path both sides come from the same readback.
+	*
+	* `KeySchema` is deliberately NOT declared, at the table level or per index:
+	* it is order-SIGNIFICANT (HASH before RANGE), so sorting it would silently
+	* hide a real key change — the failure direction this file's sibling rules
+	* call the worse one.
+	*/
+	getDriftUnorderedPaths(_resourceType) {
+		return ["AttributeDefinitions"];
+	}
+	/**
 	* Adopt an existing DynamoDB GlobalTable into cdkd state.
 	*
 	* Lookup order:
@@ -16293,12 +16458,21 @@ function collectAutoScalingTargets(properties, localRegion) {
 * redefine-in-place (replacement required); one outside it is the normal
 * bookkeeping of a GSI deletion and must NOT force a replacement.
 *
-* Malformed / intrinsic-valued entries contribute nothing, which errs on the
-* PERMISSIVE side of the guard — correct here, because the guard's failure
-* mode is a forced replacement of a live table, and AWS itself still rejects
-* a genuinely-bad `UpdateTable` loudly.
-*/
-function collectDesiredKeyAttributeNames(properties) {
+* Malformed / intrinsic-valued entries contribute nothing. For the `update()`
+* guard that errs on the PERMISSIVE side — correct there, because that guard's
+* failure mode is a forced replacement of a live table, and AWS still rejects a
+* genuinely-bad `UpdateTable` loudly. For the create-path prune below it errs
+* the other way (an unreadable LSI key schema prunes MORE), which is only
+* reachable on a bag AWS would reject anyway.
+*
+* `options.indexListKeys` narrows which index lists contribute, for the ONE
+* caller whose question is not "what does the template reference" but "what
+* will this call actually key on" — `create()`'s replay-CREATE GSI omit arm
+* (issue #1741), which sends NO indexes and therefore must not count the
+* omitted block's key attributes as still-referenced. It defaults to BOTH
+* lists, so the `update()` guard above reads exactly as it did before.
+*/
+function collectDesiredKeyAttributeNames(properties, options) {
 	const names = /* @__PURE__ */ new Set();
 	const addKeySchema = (value) => {
 		if (!Array.isArray(value)) return;
@@ -16308,7 +16482,8 @@ function collectDesiredKeyAttributeNames(properties) {
 		}
 	};
 	addKeySchema(properties["KeySchema"]);
-	for (const indexListKey of ["GlobalSecondaryIndexes", "LocalSecondaryIndexes"]) {
+	const indexListKeys = options?.indexListKeys ?? ["GlobalSecondaryIndexes", "LocalSecondaryIndexes"];
+	for (const indexListKey of indexListKeys) {
 		const indexes = properties[indexListKey];
 		if (!Array.isArray(indexes)) continue;
 		for (const index of indexes) addKeySchema(asRecord$1(index)?.["KeySchema"]);
@@ -74299,7 +74474,7 @@ function createMigrateCommand() {
 */
 function buildProgram() {
 	const program = new Command();
-	program.name("cdkd").description("CDK Direct - Deploy AWS CDK apps directly via SDK/Cloud Control API").version("0.281.19");
+	program.name("cdkd").description("CDK Direct - Deploy AWS CDK apps directly via SDK/Cloud Control API").version("0.281.21");
 	program.hook("preAction", (_thisCommand, actionCommand) => {
 		const { profile } = actionCommand.optsWithGlobals();
 		if (profile !== void 0) process.env["AWS_PROFILE"] = profile;