@go-to-k/cdkd 0.281.9 → 0.281.11

package/dist/cli.js

@@ -1,7 +1,7 @@
 #!/usr/bin/env node
-import { $ as replayWarn, $t as uploadCfnTemplate, A as green, An as normalizeAwsError, At as formatDockerLoginError, B as slowCcOperationTimeoutMs, Bt as resolveApp, C as MULTI_REGION_RECREATE_BLOCKED_TYPES, Cn as ResourceUpdateNotSupportedError, Ct as BOOTSTRAP_MARKER_PREFIX, D as bold, Dt as validateAssetBucketName, E as formatResourceLine, Et as parseBootstrapMarker, F as clearOnUpdateRemoval, Ft as getDockerImageBySourceHash, G as getAccountInfo, Gt as resolveStateBucketWithDefaultAndSource, H as isTerminationProtectionPropagationError, Ht as resolveCaptureObservedState, I as ProviderRegistry, It as Synthesizer, J as normalizeAwsTagsToCfn, Jt as warnDeprecatedNoPrefixCliFlag, K as refStateLookupFromResource, Kt as resolveUseCdkBootstrapAssets, L as findActionableSilentDrops, Lt as synthesisStatusMessage, M as yellow, Mt as runDockerForeground, N as IAMRoleProvider, Nt as runDockerStreaming, O as cyan, Ot as validateContainerRepoName, P as collectInlinePolicyNamesManagedBySiblings, Pt as AssetManifestLoader, Q as readConfigString, Qt as findLargeInlineResources, R as findSilentDropProperties, Rt as getDefaultStateBucketName, S as extractDeploymentEventError, Sn as ResourceTimeoutError, St as AssetModeResolver, T as renderStatefulReason, Tn as StackTerminationProtectionError, Tt as getBootstrapMarkerKey, U as IntrinsicFunctionResolver, Ut as resolveSkipPrefix, V as disableInstanceApiTermination, Vt as resolveAutoAssetStorage, W as cfnRefValueFromPhysicalId, Wt as resolveStateBucketWithDefault, X as assertRegionMatch, Xt as CFN_TEMPLATE_URL_LIMIT, Y as resolveExplicitPhysicalId, Yt as CFN_TEMPLATE_BODY_LIMIT, Z as configStringRefusal, Zt as MIGRATE_TMP_PREFIX, _ as createPreDeleteFinalSnapshot, _t as WorkGraph, a as DeploymentEventsStore, an as AwsClients, at as describeTypeWithThrottleRetry, b as unsupportedFinalSnapshotError, bn as PartialFailureError, bt as loadPublishableAssetManifest, c as replayFailedOperations, cn as setAwsClients, ct as isThrottlingError, d as IMPLICIT_DELETE_DEPENDENCIES, dt as LockManager, en as expectedOwnerParam, et as requireConfigArray, f as computeImplicitDeleteEdges, ft as S3StateBackend, g as ccRoutedFinalSnapshotError, gn as LocalStartServiceError, gt as stringifyValue, h as buildFinalSnapshotIdentifier, hn as LocalMigrateError, ht as AssetPublisher, i as DeploymentEventsReader, in as resolveBucketRegion, it as DiffCalculator, j as red, jn as withErrorHandling, jt as getDockerCmd, k as gray, kt as buildDockerImage, l as replayRollback, lt as DagBuilder, m as PRE_DELETE_SNAPSHOT_TYPES, mn as LocalInvokeBuildError$1, mt as shouldRetainResource, n as DEFAULT_RESOURCE_WARN_AFTER_MS, nn as processStackMessages, nt as requireConfigString, o as planFailedOps, on as getAwsClients, ot as withRetry, p as ATOMIC_FINAL_SNAPSHOT_TYPES, pn as DeployCancelledError, pt as rebuildClientForBucketRegion, q as WAFv2WebACLProvider, qt as stateBucketExistenceConfirmed, r as DeployEngine, rt as applyRoleArnIfSet, s as planRollback, sn as resetAwsClients, st as isRetryableTransientError, t as DEFAULT_RESOURCE_TIMEOUT_MS, tn as AssemblyReader, tt as requireConfigObject, u as withResourceDeadline, un as CdkdError, ut as TemplateParser, v as isFinalSnapshotError, vn as MissingCdkCliError, vt as buildAssetRedirectMap, w as isStatefulRecreateTargetSync, wn as StackHasActiveImportsError, wt as ensureAssetStorage, x as makeCanonicalizePropertiesFn, xn as ProvisioningError, xt as rewriteTemplateAssetReferences, y as refusesFinalSnapshot, yn as NestedStackChildDirectDestroyError, yt as createAssetRedirectResolver, z as CloudControlProvider, zt as getLegacyStateBucketName } from "./deploy-engine-DQ9kW3Pu.js";
+import { $ as replayWarn, $t as uploadCfnTemplate, A as green, An as normalizeAwsError, At as formatDockerLoginError, B as slowCcOperationTimeoutMs, Bt as resolveApp, C as MULTI_REGION_RECREATE_BLOCKED_TYPES, Cn as ResourceUpdateNotSupportedError, Ct as BOOTSTRAP_MARKER_PREFIX, D as bold, Dt as validateAssetBucketName, E as formatResourceLine, Et as parseBootstrapMarker, F as clearOnUpdateRemoval, Ft as getDockerImageBySourceHash, G as getAccountInfo, Gt as resolveStateBucketWithDefaultAndSource, H as isTerminationProtectionPropagationError, Ht as resolveCaptureObservedState, I as ProviderRegistry, It as Synthesizer, J as normalizeAwsTagsToCfn, Jt as warnDeprecatedNoPrefixCliFlag, K as refStateLookupFromResource, Kt as resolveUseCdkBootstrapAssets, L as findActionableSilentDrops, Lt as synthesisStatusMessage, M as yellow, Mt as runDockerForeground, N as IAMRoleProvider, Nt as runDockerStreaming, O as cyan, Ot as validateContainerRepoName, P as collectInlinePolicyNamesManagedBySiblings, Pt as AssetManifestLoader, Q as readConfigString, Qt as findLargeInlineResources, R as findSilentDropProperties, Rt as getDefaultStateBucketName, S as extractDeploymentEventError, Sn as ResourceTimeoutError, St as AssetModeResolver, T as renderStatefulReason, Tn as StackTerminationProtectionError, Tt as getBootstrapMarkerKey, U as IntrinsicFunctionResolver, Ut as resolveSkipPrefix, V as disableInstanceApiTermination, Vt as resolveAutoAssetStorage, W as cfnRefValueFromPhysicalId, Wt as resolveStateBucketWithDefault, X as assertRegionMatch, Xt as CFN_TEMPLATE_URL_LIMIT, Y as resolveExplicitPhysicalId, Yt as CFN_TEMPLATE_BODY_LIMIT, Z as configStringRefusal, Zt as MIGRATE_TMP_PREFIX, _ as createPreDeleteFinalSnapshot, _t as WorkGraph, a as DeploymentEventsStore, an as AwsClients, at as describeTypeWithThrottleRetry, b as unsupportedFinalSnapshotError, bn as PartialFailureError, bt as loadPublishableAssetManifest, c as replayFailedOperations, cn as setAwsClients, ct as isThrottlingError, d as IMPLICIT_DELETE_DEPENDENCIES, dt as LockManager, en as expectedOwnerParam, et as requireConfigArray, f as computeImplicitDeleteEdges, ft as S3StateBackend, g as ccRoutedFinalSnapshotError, gn as LocalStartServiceError, gt as stringifyValue, h as buildFinalSnapshotIdentifier, hn as LocalMigrateError, ht as AssetPublisher, i as DeploymentEventsReader, in as resolveBucketRegion, it as DiffCalculator, j as red, jn as withErrorHandling, jt as getDockerCmd, k as gray, kt as buildDockerImage, l as replayRollback, lt as DagBuilder, m as PRE_DELETE_SNAPSHOT_TYPES, mn as LocalInvokeBuildError$1, mt as shouldRetainResource, n as DEFAULT_RESOURCE_WARN_AFTER_MS, nn as processStackMessages, nt as requireConfigString, o as planFailedOps, on as getAwsClients, ot as withRetry, p as ATOMIC_FINAL_SNAPSHOT_TYPES, pn as DeployCancelledError, pt as rebuildClientForBucketRegion, q as WAFv2WebACLProvider, qt as stateBucketExistenceConfirmed, r as DeployEngine, rt as applyRoleArnIfSet, s as planRollback, sn as resetAwsClients, st as isRetryableTransientError, t as DEFAULT_RESOURCE_TIMEOUT_MS, tn as AssemblyReader, tt as requireConfigObject, u as withResourceDeadline, un as CdkdError, ut as TemplateParser, v as isFinalSnapshotError, vn as MissingCdkCliError, vt as buildAssetRedirectMap, w as isStatefulRecreateTargetSync, wn as StackHasActiveImportsError, wt as ensureAssetStorage, x as makeCanonicalizePropertiesFn, xn as ProvisioningError, xt as rewriteTemplateAssetReferences, y as refusesFinalSnapshot, yn as NestedStackChildDirectDestroyError, yt as createAssetRedirectResolver, z as CloudControlProvider, zt as getLegacyStateBucketName } from "./deploy-engine-BErTJjXl.js";
 import { a as getLiveRenderer, c as PATTERN_B_RESOURCE_TYPES, d as generateResourceNameWithFallback, h as withStackName, i as runStackBuffered, m as withSkipPrefix, n as getLogger, o as PATTERN_B_NAME_OPTIONS, s as PATTERN_B_NAME_PROPERTIES, u as generateResourceName } from "./logger-zRrlbaQt.js";
-import { t as ASGProvider } from "./asg-provider-C4zMjWYv.js";
+import { t as ASGProvider } from "./asg-provider-AKp6xuP0.js";
 import { AsyncLocalStorage } from "node:async_hooks";
 import { createHash, randomBytes, randomUUID } from "node:crypto";
 import { CopyObjectCommand, CreateBucketCommand, DeleteBucketAnalyticsConfigurationCommand, DeleteBucketCommand, DeleteBucketCorsCommand, DeleteBucketEncryptionCommand, DeleteBucketIntelligentTieringConfigurationCommand, DeleteBucketInventoryConfigurationCommand, DeleteBucketLifecycleCommand, DeleteBucketMetricsConfigurationCommand, DeleteBucketOwnershipControlsCommand, DeleteBucketPolicyCommand, DeleteBucketReplicationCommand, DeleteBucketTaggingCommand, DeleteBucketWebsiteCommand, DeleteObjectsCommand, GetBucketAccelerateConfigurationCommand, GetBucketCorsCommand, GetBucketEncryptionCommand, GetBucketLifecycleConfigurationCommand, GetBucketLocationCommand, GetBucketLoggingCommand, GetBucketNotificationConfigurationCommand, GetBucketOwnershipControlsCommand, GetBucketPolicyCommand, GetBucketReplicationCommand, GetBucketTaggingCommand, GetBucketVersioningCommand, GetBucketWebsiteCommand, GetObjectCommand, GetObjectLockConfigurationCommand, GetPublicAccessBlockCommand, HeadBucketCommand, ListBucketAnalyticsConfigurationsCommand, ListBucketIntelligentTieringConfigurationsCommand, ListBucketInventoryConfigurationsCommand, ListBucketMetricsConfigurationsCommand, ListObjectVersionsCommand, ListObjectsV2Command, NoSuchBucket, PutBucketAccelerateConfigurationCommand, PutBucketAnalyticsConfigurationCommand, PutBucketCorsCommand, PutBucketEncryptionCommand, PutBucketIntelligentTieringConfigurationCommand, PutBucketInventoryConfigurationCommand, PutBucketLifecycleConfigurationCommand, PutBucketLoggingCommand, PutBucketMetricsConfigurationCommand, PutBucketNotificationConfigurationCommand, PutBucketOwnershipControlsCommand, PutBucketPolicyCommand, PutBucketReplicationCommand, PutBucketTaggingCommand, PutBucketVersioningCommand, PutBucketWebsiteCommand, PutObjectCommand, PutObjectLockConfigurationCommand, PutPublicAccessBlockCommand, S3Client, S3ServiceException } from "@aws-sdk/client-s3";
@@ -6074,6 +6074,63 @@ var S3BucketProvider = class S3BucketProvider {
 		return config;
 	}
 	/**
+	* True when the DESIRED side DECLARES the property but its collection is
+	* empty — the shape {@link emptyListConfigToUndefined} folds to `undefined`
+	* and therefore cannot be told apart from an ABSENT property downstream
+	* (issue #1713).
+	*
+	* That collapse is the whole defect. `OwnershipControls` /
+	* `BucketEncryption` normalize BOTH sides through the fold before
+	* `diffSubConfig`, so a non-empty previous against a declared-but-empty
+	* desired took the **onDelete** arm and issued
+	* `DeleteBucketOwnershipControls` / `DeleteBucketEncryption` — where the
+	* lifecycle / CORS siblings SKIP the Put and leave the live configuration
+	* alone (issue #1671). Measured against live CloudFormation (us-east-1,
+	* 2026-08-12): updating a deployed bucket from an `aws:kms` default and a
+	* `BucketOwnerPreferred` rule to `ServerSideEncryptionConfiguration: []` /
+	* `Rules: []` drives the stack to `UPDATE_ROLLBACK_COMPLETE` with
+	* `The XML you provided was not well-formed or did not validate against our
+	* published schema`, and BOTH live configurations survive unchanged. So CFn
+	* treats the empty collection as an INVALID template, not as a removal —
+	* the same answer the #1671 A/B produced for lifecycle / CORS on the same
+	* date and account — and cdkd was DELETING instead. For `BucketEncryption`
+	* that silently drops a declared `aws:kms` default down to SSE-S3 / AES256
+	* on a template whose only fault is a condition-pruned or
+	* intrinsic-collapsed array.
+	*
+	* The fold itself is load-bearing and is NOT what changes here:
+	* `readCurrentState` ALWAYS emits
+	* `BucketEncryption: { ServerSideEncryptionConfiguration: [] }` and
+	* `OwnershipControls: { Rules: [] }` for a bucket with no explicit setting,
+	* so `cdkd drift --revert` feeds that placeholder back through `update()`
+	* and both sides must keep normalizing for empty-vs-empty to compare EQUAL
+	* and issue no call at all. This predicate rides alongside it and only
+	* splits the arm the fold reaches: **declared-but-empty SKIPS, absent
+	* DELETES**. A removal therefore still works — dropping the whole property
+	* from the template is what expresses it, which is exactly what
+	* `emptyCollectionSkip`'s warning tells the user.
+	*
+	* **Scoped to the shape #1713 MEASURED — the list key PRESENT and EMPTY —
+	* and no wider.** The tempting spelling is "present, and the fold erased it",
+	* i.e. delegate to {@link emptyListConfigToUndefined}. That is wrong here:
+	* the fold ALSO erases a bare `{}`, which issue #1466 pinned as a REMOVAL and
+	* #1713's live A/B did not exercise, so delegating would have reversed that
+	* contract on evidence that does not cover it — caught when its pinned row
+	* failed. (`{listKey: null}` as the sole key is NOT folded — the block
+	* carries one key, so `emptyListConfigToUndefined` passes it through as
+	* MALFORMED; an earlier draft of this comment claimed it was, which the
+	* type's own `'{Rules: null} as the SOLE key is malformed'` test contradicts.)
+	*
+	* A MALFORMED block is out of scope for a different reason and needs no
+	* clause here: the fold passes it through unchanged, so it never reaches the
+	* Delete arm at all and is refused by name by the apply call.
+	*/
+	static declaresEmptyCollection(config, listKey) {
+		if (typeof config !== "object" || config === null || Array.isArray(config)) return false;
+		const list = config[listKey];
+		return Array.isArray(list) && list.length === 0;
+	}
+	/**
 	* Turn a set of per-property overrides into the `effectiveProperties` bag the
 	* deploy engine records in place of the desired one (issues #1612 / #1670).
 	*
@@ -6327,7 +6384,7 @@ var S3BucketProvider = class S3BucketProvider {
 	*   direction: a later template that REMOVES the block would then derive no
 	*   removal and the live configuration would survive forever.
 	*/
-	async applySubConfigDiffs(bucketName, properties, previousProperties) {
+	async applySubConfigDiffs(bucketName, properties, previousProperties, context) {
 		const overrides = /* @__PURE__ */ new Map();
 		/** Record a WHOLE-BLOCK skip: the effective value is the previous one. */
 		const retainPrevious = (key) => {
@@ -6383,16 +6440,31 @@ var S3BucketProvider = class S3BucketProvider {
 		if (versioningRefusal === void 0 && versioningChanged && nextVersioning != null && desiredVersioningStatus !== "Suspended") {
 			if (!await this.applyVersioning(bucketName, nextVersioning, (m) => this.logger.warn(m))) retainPrevious("VersioningConfiguration");
 		}
+		const ownershipEmptyDesired = S3BucketProvider.declaresEmptyCollection(properties["OwnershipControls"], "Rules");
 		await this.diffSubConfig(bucketName, S3BucketProvider.emptyListConfigToUndefined(previousProperties["OwnershipControls"], "Rules"), S3BucketProvider.emptyListConfigToUndefined(properties["OwnershipControls"], "Rules"), async (cfg) => this.applyOwnershipControls(bucketName, cfg), async () => {
+			if (ownershipEmptyDesired && context?.desiredFromAwsReadback !== true) {
+				this.emptyCollectionSkip("OwnershipControls", "OwnershipControls.Rules", previousProperties, retainPrevious);
+				return;
+			}
 			await this.s3Client.send(new DeleteBucketOwnershipControlsCommand({ Bucket: bucketName }));
 			this.logger.debug(`Deleted ownership controls on bucket ${bucketName}`);
 		});
+		const encryptionEmptyDesired = S3BucketProvider.declaresEmptyCollection(properties["BucketEncryption"], "ServerSideEncryptionConfiguration");
 		await this.diffSubConfig(bucketName, S3BucketProvider.emptyListConfigToUndefined(previousProperties["BucketEncryption"], "ServerSideEncryptionConfiguration"), S3BucketProvider.emptyListConfigToUndefined(properties["BucketEncryption"], "ServerSideEncryptionConfiguration"), async (cfg) => this.applyBucketEncryption(bucketName, cfg), async () => {
+			if (encryptionEmptyDesired && context?.desiredFromAwsReadback !== true) {
+				this.emptyCollectionSkip("BucketEncryption", "BucketEncryption.ServerSideEncryptionConfiguration", previousProperties, retainPrevious);
+				return;
+			}
 			await this.s3Client.send(new DeleteBucketEncryptionCommand({ Bucket: bucketName }));
 			this.logger.debug(`Deleted bucket encryption on bucket ${bucketName}`);
 		});
 		await this.diffSubConfig(bucketName, previousProperties["LifecycleConfiguration"], properties["LifecycleConfiguration"], async (cfg) => {
 			if (!cfg.Rules || !Array.isArray(cfg.Rules) || cfg.Rules.length === 0) {
+				if (context?.desiredFromAwsReadback === true) {
+					await this.s3Client.send(new DeleteBucketLifecycleCommand({ Bucket: bucketName }));
+					this.logger.debug(`Deleted lifecycle configuration on bucket ${bucketName} (reverting to an unset baseline)`);
+					return;
+				}
 				this.emptyCollectionSkip("LifecycleConfiguration", "LifecycleConfiguration.Rules", previousProperties, retainPrevious);
 				return;
 			}
@@ -6403,6 +6475,11 @@ var S3BucketProvider = class S3BucketProvider {
 		});
 		await this.diffSubConfig(bucketName, previousProperties["CorsConfiguration"], properties["CorsConfiguration"], async (cfg) => {
 			if (!cfg.CorsRules || !Array.isArray(cfg.CorsRules) || cfg.CorsRules.length === 0) {
+				if (context?.desiredFromAwsReadback === true) {
+					await this.s3Client.send(new DeleteBucketCorsCommand({ Bucket: bucketName }));
+					this.logger.debug(`Deleted CORS configuration on bucket ${bucketName} (reverting to an unset baseline)`);
+					return;
+				}
 				this.emptyCollectionSkip("CorsConfiguration", "CorsConfiguration.CorsRules", previousProperties, retainPrevious);
 				return;
 			}
@@ -6613,7 +6690,7 @@ var S3BucketProvider = class S3BucketProvider {
 	/**
 	* Update an S3 bucket
 	*/
-	async update(logicalId, physicalId, resourceType, properties, previousProperties) {
+	async update(logicalId, physicalId, resourceType, properties, previousProperties, context) {
 		this.logger.debug(`Updating S3 bucket ${logicalId}: ${physicalId}`);
 		const newBucketName = properties["BucketName"];
 		if (newBucketName && newBucketName !== physicalId) {
@@ -6628,7 +6705,7 @@ var S3BucketProvider = class S3BucketProvider {
 				skipTags: true,
 				skipDiffManaged: true
 			});
-			for (const [key, value] of await this.applySubConfigDiffs(physicalId, properties, previousProperties)) effectiveOverrides.set(key, value);
+			for (const [key, value] of await this.applySubConfigDiffs(physicalId, properties, previousProperties, context)) effectiveOverrides.set(key, value);
 			await this.applyTagDiff(physicalId, previousProperties["Tags"], properties["Tags"]);
 			const attributes = await this.buildAttributes(physicalId);
 			this.logger.debug(`Successfully updated S3 bucket ${logicalId}`);
@@ -13829,8 +13906,14 @@ var DynamoDBGlobalTableProvider = class {
 		if (!keySchema) throw new ProvisioningError(`KeySchema is required for DynamoDB GlobalTable ${logicalId}`, resourceType, logicalId);
 		if (!attributeDefinitions) throw new ProvisioningError(`AttributeDefinitions is required for DynamoDB GlobalTable ${logicalId}`, resourceType, logicalId);
 		let billingMode;
-		try {
-			billingMode = requireConfigString(properties["BillingMode"], "PAY_PER_REQUEST", "AWS::DynamoDB::GlobalTable BillingMode", replayWarn(this.logger, context));
+		let billingModeSubstituted = false;
+		try {
+			const billingReplayWarn = replayWarn(this.logger, context).onUnusable;
+			billingMode = requireConfigString(properties["BillingMode"], "PAY_PER_REQUEST", "AWS::DynamoDB::GlobalTable BillingMode", billingReplayWarn ? { onUnusable: (message) => {
+				billingModeSubstituted = true;
+				billingReplayWarn(message);
+			} } : {});
+			if (billingReplayWarn && properties["BillingMode"] === void 0) this.logger.warn(`AWS::DynamoDB::GlobalTable ${logicalId}: the state record declares no BillingMode, so this replay creates the table PAY_PER_REQUEST. If it was PROVISIONED, set the mode in the template and redeploy.`);
 		} catch (error) {
 			throw new ProvisioningError(error instanceof Error ? error.message : String(error), resourceType, logicalId, void 0, error instanceof Error ? error : void 0);
 		}
@@ -13845,6 +13928,10 @@ var DynamoDBGlobalTableProvider = class {
 		const diagnostics = [];
 		if (billingMode === "PROVISIONED") createParams.ProvisionedThroughput = derivePerCallProvisionedThroughput(properties, currentRegion, "min", diagnostics);
 		let effectiveProperties;
+		if (billingModeSubstituted) effectiveProperties = {
+			...properties,
+			BillingMode: billingMode
+		};
 		const streamSpecInput = properties["StreamSpecification"];
 		const needsStream = replicas.some((r) => r["Region"] !== currentRegion) || replicas.length > 1;
 		if (streamSpecInput != null) {
@@ -13864,7 +13951,7 @@ var DynamoDBGlobalTableProvider = class {
 				StreamViewType: streamViewType
 			};
 			if (streamSpecSubstituted) effectiveProperties = {
-				...properties,
+				...effectiveProperties ?? properties,
 				StreamSpecification: { StreamViewType: streamViewType }
 			};
 		} else if (needsStream) {
@@ -14095,7 +14182,7 @@ var DynamoDBGlobalTableProvider = class {
 			let billingUnusable = false;
 			const requestedBilling = requireConfigString(properties["BillingMode"], "PAY_PER_REQUEST", "AWS::DynamoDB::GlobalTable BillingMode", { onUnusable: (message) => {
 				billingUnusable = true;
-				this.logger.warn(`${message} The table's current billing mode (${oldBilling}) is kept for this update rather than flipped to the default.`);
+				this.logger.warn(`AWS::DynamoDB::GlobalTable ${logicalId}: ${message} The mode this update compared against (${oldBilling}) is kept for this update rather than flipped to the default.`);
 			} });
 			const newBilling = billingUnusable ? oldBilling : requestedBilling;
 			const onDemandCeilingLive = oldBilling === "PAY_PER_REQUEST" && newBilling === "PAY_PER_REQUEST";
@@ -14160,11 +14247,26 @@ var DynamoDBGlobalTableProvider = class {
 				} else {
 					const previousStreamSpec = previousProperties["StreamSpecification"];
 					const previousStreamSpecUsable = previousStreamSpec !== void 0 && previousStreamSpec !== null && configStringRefusal(previousStreamSpec, "StreamViewType", "NEW_AND_OLD_IMAGES", "AWS::DynamoDB::GlobalTable StreamSpecification") === void 0;
-					effectiveProperties = { ...properties };
+					effectiveProperties = { ...effectiveProperties ?? properties };
 					if (previousStreamSpecUsable) effectiveProperties["StreamSpecification"] = { ...previousStreamSpec };
 					else delete effectiveProperties["StreamSpecification"];
 				}
 			}
+			if (desiredGsiUnusable) {
+				let previousGsiProbeUnusable = false;
+				toSdkGlobalSecondaryIndexes(previousProperties, currentRegion, oldBilling, "min", void 0, () => {
+					previousGsiProbeUnusable = true;
+				});
+				const previousIndexes = previousProperties["GlobalSecondaryIndexes"];
+				effectiveProperties = { ...effectiveProperties ?? properties };
+				if (!previousGsiProbeUnusable && previousIndexes !== void 0) effectiveProperties["GlobalSecondaryIndexes"] = [...previousIndexes];
+				else delete effectiveProperties["GlobalSecondaryIndexes"];
+			}
+			if (billingUnusable) {
+				effectiveProperties = { ...effectiveProperties ?? properties };
+				if (recordedOldBilling === void 0) delete effectiveProperties["BillingMode"];
+				else effectiveProperties["BillingMode"] = oldBilling;
+			}
 			const awsOnDemand = describeResp.Table?.OnDemandThroughput;
 			const onDemandPayload = {};
 			const resolveCeiling = (desired, live) => {
@@ -56226,7 +56328,7 @@ async function runRevert(reports, providerRegistry, stateBackend, stateConfig, a
 				const desiredProperties = stateResource.observedProperties ?? stateResource.properties ?? {};
 				const newProperties = buildRevertNewProperties(outcome.changes, desiredProperties, outcome.awsProperties, { preserveUntemplated: stateResource.observedProperties === void 0 });
 				try {
-					const updateResult = await withRetry(() => provider.update(outcome.logicalId, stateResource.physicalId, outcome.resourceType, newProperties, outcome.awsProperties), outcome.logicalId, { logger: { debug: (msg) => logger.debug(msg) } });
+					const updateResult = await withRetry(() => provider.update(outcome.logicalId, stateResource.physicalId, outcome.resourceType, newProperties, outcome.awsProperties, { desiredFromAwsReadback: true }), outcome.logicalId, { logger: { debug: (msg) => logger.debug(msg) } });
 					totalSucceeded++;
 					logger.info(`  ✓ ${report.stackName}/${outcome.logicalId} (${outcome.resourceType}): reverted.`);
 					try {
@@ -73411,7 +73513,7 @@ function createMigrateCommand() {
 */
 function buildProgram() {
 	const program = new Command();
-	program.name("cdkd").description("CDK Direct - Deploy AWS CDK apps directly via SDK/Cloud Control API").version("0.281.9");
+	program.name("cdkd").description("CDK Direct - Deploy AWS CDK apps directly via SDK/Cloud Control API").version("0.281.11");
 	program.hook("preAction", (_thisCommand, actionCommand) => {
 		const { profile } = actionCommand.optsWithGlobals();
 		if (profile !== void 0) process.env["AWS_PROFILE"] = profile;