@go-to-k/cdkd 0.283.0 → 0.283.1

package/dist/cli.js

@@ -1,7 +1,7 @@
 #!/usr/bin/env node
-import { $ as configStringRefusal, $t as resolveStateBucketWithDefaultAndSource, A as green, An as NestedStackChildDirectDestroyError, At as BOOTSTRAP_MARKER_PREFIX, B as slowCcOperationTimeoutMs, Bt as runDockerForeground, C as MULTI_REGION_RECREATE_BLOCKED_TYPES, Ct as stringifyValue, D as bold, Dn as LocalStartServiceError, Dt as loadPublishableAssetManifest, E as formatResourceLine, En as LocalMigrateError, Et as createAssetRedirectResolver, F as clearOnUpdateRemoval, Fn as StackHasActiveImportsError, Ft as validateContainerRepoName, G as getAccountInfo, Gt as synthesisStatusMessage, H as isTerminationProtectionPropagationError, Hn as withErrorHandling, Ht as AssetManifestLoader, I as ProviderRegistry, In as StackTerminationProtectionError, It as buildDenyExternalAccessPolicy, J as normalizeAwsTagsToCfn, Jt as resolveApp, K as refStateLookupFromResource, Kt as getDefaultStateBucketName, L as findActionableSilentDrops, Lt as buildDockerImage, M as yellow, Mn as ProvisioningError, Mt as getBootstrapMarkerKey, N as IAMRoleProvider, Nn as ResourceTimeoutError, Nt as parseBootstrapMarker, O as cyan, Ot as rewriteTemplateAssetReferences, P as collectInlinePolicyNamesManagedBySiblings, Pn as ResourceUpdateNotSupportedError, Pt as validateAssetBucketName, Q as configBooleanRefusal, Qt as resolveStateBucketWithDefault, R as findSilentDropProperties, Rt as formatDockerLoginError, S as extractDeploymentEventError, St as AssetPublisher, T as renderStatefulReason, Tn as LocalInvokeBuildError$1, Tt as buildAssetRedirectMap, U as IntrinsicFunctionResolver, Ut as getDockerImageBySourceHash, V as disableInstanceApiTermination, Vn as normalizeAwsError, Vt as runDockerStreaming, W as cfnRefValueFromPhysicalId, Wt as Synthesizer, X as assertRegionMatch, Xt as resolveCaptureObservedState, Y as resolveExplicitPhysicalId, Yt as resolveAutoAssetStorage, Z as coerceCfnBoolean, Zt as resolveSkipPrefix, _ as createPreDeleteFinalSnapshot, _n as getAwsClients, _t as TemplateParser, a as DeploymentEventsStore, an as MIGRATE_TMP_PREFIX, at as s3BucketArn, b as unsupportedFinalSnapshotError, bt as rebuildClientForBucketRegion, c as replayFailedOperations, cn as expectedOwnerParam, ct as s3BucketRegionalDomainName, d as IMPLICIT_DELETE_DEPENDENCIES, dn as derivePartitionAndUrlSuffix, dt as DiffCalculator, en as resolveUseCdkBootstrapAssets, et as readConfigString, f as computeImplicitDeleteEdges, fn as AssemblyReader, ft as describeTypeWithThrottleRetry, g as ccRoutedFinalSnapshotError, gn as AwsClients, gt as DagBuilder, h as buildFinalSnapshotIdentifier, hn as resolveBucketRegion, ht as isThrottlingError, i as DeploymentEventsReader, in as CFN_TEMPLATE_URL_LIMIT, it as requireConfigString, j as red, jn as PartialFailureError, jt as ensureAssetStorage, k as gray, kn as MissingCdkCliError, kt as AssetModeResolver, l as replayRollback, ln as PARTITION_TABLE, lt as s3BucketWebsiteUrl, m as PRE_DELETE_SNAPSHOT_TYPES, mt as isRetryableTransientError, n as DEFAULT_RESOURCE_WARN_AFTER_MS, nn as warnDeprecatedNoPrefixCliFlag, nt as requireConfigArray, o as planFailedOps, on as findLargeInlineResources, ot as s3BucketDomainName, p as ATOMIC_FINAL_SNAPSHOT_TYPES, pn as processStackMessages, pt as withRetry, q as WAFv2WebACLProvider, qt as getLegacyStateBucketName, r as DeployEngine, rn as CFN_TEMPLATE_BODY_LIMIT, rt as requireConfigObject, s as planRollback, sn as uploadCfnTemplate, st as s3BucketDualStackDomainName, t as DEFAULT_RESOURCE_TIMEOUT_MS, tn as stateBucketExistenceConfirmed, tt as replayWarn, u as withResourceDeadline, un as canonicalizeRegion, ut as applyRoleArnIfSet, v as isFinalSnapshotError, vn as resetAwsClients, vt as LockManager, w as isStatefulRecreateTargetSync, wn as DeployCancelledError, wt as WorkGraph, x as makeCanonicalizePropertiesFn, xn as CdkdError, xt as shouldRetainResource, y as refusesFinalSnapshot, yn as setAwsClients, yt as S3StateBackend, z as CloudControlProvider, zt as getDockerCmd } from "./deploy-engine-CEzMNZTA.js";
+import { $ as configStringRefusal, $t as resolveStateBucketWithDefaultAndSource, A as green, An as NestedStackChildDirectDestroyError, At as BOOTSTRAP_MARKER_PREFIX, B as slowCcOperationTimeoutMs, Bt as runDockerForeground, C as MULTI_REGION_RECREATE_BLOCKED_TYPES, Ct as stringifyValue, D as bold, Dn as LocalStartServiceError, Dt as loadPublishableAssetManifest, E as formatResourceLine, En as LocalMigrateError, Et as createAssetRedirectResolver, F as clearOnUpdateRemoval, Fn as StackHasActiveImportsError, Ft as validateContainerRepoName, G as getAccountInfo, Gt as synthesisStatusMessage, H as isTerminationProtectionPropagationError, Hn as withErrorHandling, Ht as AssetManifestLoader, I as ProviderRegistry, In as StackTerminationProtectionError, It as buildDenyExternalAccessPolicy, J as normalizeAwsTagsToCfn, Jt as resolveApp, K as refStateLookupFromResource, Kt as getDefaultStateBucketName, L as findActionableSilentDrops, Lt as buildDockerImage, M as yellow, Mn as ProvisioningError, Mt as getBootstrapMarkerKey, N as IAMRoleProvider, Nn as ResourceTimeoutError, Nt as parseBootstrapMarker, O as cyan, Ot as rewriteTemplateAssetReferences, P as collectInlinePolicyNamesManagedBySiblings, Pn as ResourceUpdateNotSupportedError, Pt as validateAssetBucketName, Q as configBooleanRefusal, Qt as resolveStateBucketWithDefault, R as findSilentDropProperties, Rt as formatDockerLoginError, S as extractDeploymentEventError, St as AssetPublisher, T as renderStatefulReason, Tn as LocalInvokeBuildError$1, Tt as buildAssetRedirectMap, U as IntrinsicFunctionResolver, Ut as getDockerImageBySourceHash, V as disableInstanceApiTermination, Vn as normalizeAwsError, Vt as runDockerStreaming, W as cfnRefValueFromPhysicalId, Wt as Synthesizer, X as assertRegionMatch, Xt as resolveCaptureObservedState, Y as resolveExplicitPhysicalId, Yt as resolveAutoAssetStorage, Z as coerceCfnBoolean, Zt as resolveSkipPrefix, _ as createPreDeleteFinalSnapshot, _n as getAwsClients, _t as TemplateParser, a as DeploymentEventsStore, an as MIGRATE_TMP_PREFIX, at as s3BucketArn, b as unsupportedFinalSnapshotError, bt as rebuildClientForBucketRegion, c as replayFailedOperations, cn as expectedOwnerParam, ct as s3BucketRegionalDomainName, d as IMPLICIT_DELETE_DEPENDENCIES, dn as derivePartitionAndUrlSuffix, dt as DiffCalculator, en as resolveUseCdkBootstrapAssets, et as readConfigString, f as computeImplicitDeleteEdges, fn as AssemblyReader, ft as describeTypeWithThrottleRetry, g as ccRoutedFinalSnapshotError, gn as AwsClients, gt as DagBuilder, h as buildFinalSnapshotIdentifier, hn as resolveBucketRegion, ht as isThrottlingError, i as DeploymentEventsReader, in as CFN_TEMPLATE_URL_LIMIT, it as requireConfigString, j as red, jn as PartialFailureError, jt as ensureAssetStorage, k as gray, kn as MissingCdkCliError, kt as AssetModeResolver, l as replayRollback, ln as PARTITION_TABLE, lt as s3BucketWebsiteUrl, m as PRE_DELETE_SNAPSHOT_TYPES, mt as isRetryableTransientError, n as DEFAULT_RESOURCE_WARN_AFTER_MS, nn as warnDeprecatedNoPrefixCliFlag, nt as requireConfigArray, o as planFailedOps, on as findLargeInlineResources, ot as s3BucketDomainName, p as ATOMIC_FINAL_SNAPSHOT_TYPES, pn as processStackMessages, pt as withRetry, q as WAFv2WebACLProvider, qt as getLegacyStateBucketName, r as DeployEngine, rn as CFN_TEMPLATE_BODY_LIMIT, rt as requireConfigObject, s as planRollback, sn as uploadCfnTemplate, st as s3BucketDualStackDomainName, t as DEFAULT_RESOURCE_TIMEOUT_MS, tn as stateBucketExistenceConfirmed, tt as replayWarn, u as withResourceDeadline, un as canonicalizeRegion, ut as applyRoleArnIfSet, v as isFinalSnapshotError, vn as resetAwsClients, vt as LockManager, w as isStatefulRecreateTargetSync, wn as DeployCancelledError, wt as WorkGraph, x as makeCanonicalizePropertiesFn, xn as CdkdError, xt as shouldRetainResource, y as refusesFinalSnapshot, yn as setAwsClients, yt as S3StateBackend, z as CloudControlProvider, zt as getDockerCmd } from "./deploy-engine-InwDI9o0.js";
 import { a as getLiveRenderer, c as PATTERN_B_RESOURCE_TYPES, d as generateResourceNameWithFallback, h as withStackName, i as runStackBuffered, m as withSkipPrefix, n as getLogger, o as PATTERN_B_NAME_OPTIONS, s as PATTERN_B_NAME_PROPERTIES, u as generateResourceName } from "./logger-zRrlbaQt.js";
-import { t as ASGProvider } from "./asg-provider-BNuwJ11q.js";
+import { t as ASGProvider } from "./asg-provider-R3IdAR_3.js";
 import { AsyncLocalStorage } from "node:async_hooks";
 import { createHash, randomBytes, randomUUID } from "node:crypto";
 import { CopyObjectCommand, CreateBucketCommand, DeleteBucketAnalyticsConfigurationCommand, DeleteBucketCommand, DeleteBucketCorsCommand, DeleteBucketEncryptionCommand, DeleteBucketIntelligentTieringConfigurationCommand, DeleteBucketInventoryConfigurationCommand, DeleteBucketLifecycleCommand, DeleteBucketMetricsConfigurationCommand, DeleteBucketOwnershipControlsCommand, DeleteBucketPolicyCommand, DeleteBucketReplicationCommand, DeleteBucketTaggingCommand, DeleteBucketWebsiteCommand, DeleteObjectsCommand, GetBucketAccelerateConfigurationCommand, GetBucketCorsCommand, GetBucketEncryptionCommand, GetBucketLifecycleConfigurationCommand, GetBucketLocationCommand, GetBucketLoggingCommand, GetBucketNotificationConfigurationCommand, GetBucketOwnershipControlsCommand, GetBucketPolicyCommand, GetBucketReplicationCommand, GetBucketTaggingCommand, GetBucketVersioningCommand, GetBucketWebsiteCommand, GetObjectCommand, GetObjectLockConfigurationCommand, GetPublicAccessBlockCommand, HeadBucketCommand, ListBucketAnalyticsConfigurationsCommand, ListBucketIntelligentTieringConfigurationsCommand, ListBucketInventoryConfigurationsCommand, ListBucketMetricsConfigurationsCommand, ListObjectVersionsCommand, ListObjectsV2Command, NoSuchBucket, PutBucketAccelerateConfigurationCommand, PutBucketAnalyticsConfigurationCommand, PutBucketCorsCommand, PutBucketEncryptionCommand, PutBucketIntelligentTieringConfigurationCommand, PutBucketInventoryConfigurationCommand, PutBucketLifecycleConfigurationCommand, PutBucketLoggingCommand, PutBucketMetricsConfigurationCommand, PutBucketNotificationConfigurationCommand, PutBucketOwnershipControlsCommand, PutBucketPolicyCommand, PutBucketReplicationCommand, PutBucketTaggingCommand, PutBucketVersioningCommand, PutBucketWebsiteCommand, PutObjectCommand, PutObjectLockConfigurationCommand, PutPublicAccessBlockCommand, S3Client, S3ServiceException } from "@aws-sdk/client-s3";
@@ -15484,10 +15484,16 @@ var DynamoDBGlobalTableProvider = class {
 			};
 			if (tableArn) await this.applyTagDiff(tableArn, extractLocalTags(previousProperties), extractLocalTags(properties));
 			const recordedOldBilling = previousProperties["BillingMode"];
-			const recordedOldBillingUsable = recordedOldBilling === void 0 || typeof recordedOldBilling === "string" && recordedOldBilling.trim() !== "";
-			const liveBillingMode = describeResp.Table?.BillingModeSummary?.BillingMode ?? "PROVISIONED";
-			const oldBilling = recordedOldBillingUsable ? recordedOldBilling ?? "PAY_PER_REQUEST" : liveBillingMode;
-			if (!recordedOldBillingUsable) this.logger.warn(`AWS::DynamoDB::GlobalTable ${logicalId}: the recorded previous BillingMode is unusable (${JSON.stringify(recordedOldBilling)}) — using the table's actual billing mode (${oldBilling}) as the comparison baseline for this update so a corrected template does not issue a same-mode UpdateTable.`);
+			const recordedOldBillingAbsent = recordedOldBilling === void 0;
+			const recordedOldBillingUsable = typeof recordedOldBilling === "string" && recordedOldBilling.trim() !== "";
+			const rawLiveBillingMode = describeResp.Table?.BillingModeSummary?.BillingMode;
+			const reportedBillingMode = rawLiveBillingMode === "PROVISIONED" || rawLiveBillingMode === "PAY_PER_REQUEST" ? rawLiveBillingMode : void 0;
+			const liveBillingMode = reportedBillingMode ?? "PROVISIONED";
+			const desiredDeclaresBillingMode = properties["BillingMode"] !== void 0;
+			const seedAbsentFromLive = recordedOldBillingAbsent && desiredDeclaresBillingMode;
+			const oldBilling = recordedOldBillingUsable ? recordedOldBilling : recordedOldBillingAbsent ? seedAbsentFromLive ? liveBillingMode : "PAY_PER_REQUEST" : liveBillingMode;
+			if (!recordedOldBillingUsable && !recordedOldBillingAbsent) this.logger.warn(`AWS::DynamoDB::GlobalTable ${logicalId}: the recorded previous BillingMode is unusable (${JSON.stringify(recordedOldBilling)}) — using the table's actual billing mode (${oldBilling}) as the comparison baseline for this update so a corrected template does not issue a same-mode UpdateTable.`);
+			if (seedAbsentFromLive && oldBilling !== "PAY_PER_REQUEST") this.logger.warn(`AWS::DynamoDB::GlobalTable ${logicalId}: the cdkd state record declares no BillingMode — using ${oldBilling} as the comparison baseline for this update (${reportedBillingMode !== void 0 ? "the mode DescribeTable reports" : "inferred: DescribeTable reports no BillingModeSummary, which means the table was created without an explicit mode"}), so a template declaring a different mode still applies the flip instead of comparing equal to the create-path default.`);
 			let billingUnusable = false;
 			const requestedBilling = requireConfigString(properties["BillingMode"], "PAY_PER_REQUEST", "AWS::DynamoDB::GlobalTable BillingMode", { onUnusable: (message) => {
 				billingUnusable = true;
@@ -15575,6 +15581,7 @@ var DynamoDBGlobalTableProvider = class {
 				effectiveProperties = { ...effectiveProperties ?? properties };
 				if (recordedOldBilling === void 0) delete effectiveProperties["BillingMode"];
 				else effectiveProperties["BillingMode"] = oldBilling;
+				effectiveProperties = retainUnsendableCapacityMembers(effectiveProperties, previousProperties, newBilling);
 			}
 			const awsOnDemand = describeResp.Table?.OnDemandThroughput;
 			const onDemandPayload = {};
@@ -17533,6 +17540,185 @@ function stripProvisionedCapacityKeys(properties) {
 	return result;
 }
 /**
+* The capacity member keys that can only reach AWS while the table is
+* PROVISIONED, per container level (issue #1738).
+*
+* Identical to the set {@link stripProvisionedCapacityKeys} removes, and that
+* is not a coincidence: both answer "which members are unsendable once the mode
+* is PAY_PER_REQUEST". The two spellings a pre-#1387 cdkd wrote into state
+* (`ProvisionedThroughput` / `ProvisionedThroughputOverride`) are included for
+* the same reason — a state replay is exactly that population.
+*/
+const PROVISIONED_ONLY_CAPACITY_KEYS = {
+	table: ["WriteProvisionedThroughputSettings"],
+	index: [
+		"WriteProvisionedThroughputSettings",
+		"ReadProvisionedThroughputSettings",
+		"ProvisionedThroughput"
+	],
+	replica: ["ReadProvisionedThroughputSettings", "ProvisionedThroughputOverride"],
+	replicaIndex: ["ReadProvisionedThroughputSettings", "ProvisionedThroughputOverride"]
+};
+/**
+* The mirror set: capacity members that can only reach AWS while the table is
+* PAY_PER_REQUEST (issue #1738).
+*
+* `stripProvisionedCapacityKeys` has no equivalent because the create arm it
+* serves always substitutes PAY_PER_REQUEST — the mode under which these ARE
+* sent, which is why its header says they are deliberately not stripped. On the
+* UPDATE path the kept mode can be PROVISIONED, and then it is this half that
+* never leaves the process.
+*/
+const ON_DEMAND_ONLY_CAPACITY_KEYS = {
+	table: ["WriteOnDemandThroughputSettings"],
+	index: [
+		"WriteOnDemandThroughputSettings",
+		"ReadOnDemandThroughputSettings",
+		"OnDemandThroughput"
+	],
+	replica: ["ReadOnDemandThroughputSettings", "OnDemandThroughputOverride"],
+	replicaIndex: ["ReadOnDemandThroughputSettings", "OnDemandThroughputOverride"]
+};
+/**
+* Replace every capacity member the KEPT billing mode cannot send with the
+* PREVIOUS record's value (issue #1738).
+*
+* Called from `update()`'s `BillingMode` warn-and-KEEP arm, where an unusable
+* desired mode suppresses the flip: AWS is left holding the mode it already
+* had, so every block belonging to the OTHER mode was silently dropped on the
+* way out while the engine recorded what the template declared.
+*
+* **The split is per MEMBER against the KEPT mode**, and each side was read off
+* the gates in this file rather than off the member's name-shape (the
+* name-shape trap #1726 records — an on-demand ceiling looks like capacity and
+* goes on the wire under precisely the on-demand mode):
+*
+* - KEPT `PROVISIONED` — the on-demand half is unsendable. Step 3's table-level
+*   `OnDemandThroughput` is gated on `newBilling !== 'PROVISIONED'`;
+*   `toSdkGlobalSecondaryIndexes` and `toSdkReplicaThroughputOverrides` both
+*   drop their on-demand branch under PROVISIONED. The provisioned half is NOT
+*   retained: step 4b and step 6b's auto-scaling reconcile are live whenever
+*   either side is PROVISIONED, and step 6's GSI diff carries per-index
+*   `ProvisionedThroughput` — those blocks really are applied.
+* - KEPT `PAY_PER_REQUEST` — the provisioned half is unsendable. The table-level
+*   `ProvisionedThroughput` rides step 4's flip and nothing else, the two
+*   auto-scaling reconciles are gated on either side being PROVISIONED, and both
+*   translators drop their provisioned branch. The on-demand half is NOT
+*   retained: step 3 sends the table-level ceilings and step 6 the per-index
+*   ones under exactly this mode.
+*
+* One residual is deliberately NOT covered, because the suppression did not
+* create it: the TABLE-level provisioned capacity NUMBER rides step 4's flip
+* and nothing else, so on ANY non-flip PROVISIONED -> PROVISIONED update it is
+* unsent while its `*CapacityAutoScalingSettings` sibling in the same block IS
+* reconciled. Retaining the block wholesale under a kept PROVISIONED mode would
+* therefore erase a real auto-scaling update to hide a pre-existing gap — so
+* the block stays as declared and the gap stays where it already lives.
+*
+* Retaining rather than DROPPING is the UPDATE row of
+* `.claude/rules/providers.md`: the call never ran, so AWS still holds the
+* previously-applied block and that IS what state should describe. Dropping
+* would leave a later template that REMOVES the block deriving no removal, so
+* the live setting would survive forever.
+*
+* **The previous side is VALIDATED before it is retained** (the #1653-review
+* rule) through `asRecord` — the SAME predicate every wire read of these blocks
+* applies, so the two cannot disagree about what a bare string / an array / a
+* number means. Be honest about what that buys: it refuses exactly the
+* not-a-plain-object shapes, and a block whose NUMERIC member is an unresolved
+* intrinsic passes it, because the wire accepts that block too (and then sends
+* nothing for the member, which is the same "AWS keeps what it had" outcome).
+* When the previous side is unusable OR absent the key is DROPPED — there is no
+* value cdkd can vouch for either way.
+*
+* COPIES each retained block one level rather than aliasing it: the rollback
+* executor spreads the returned bag shallowly, so handing back the previous
+* record's own object would leave two state records sharing one mutable value.
+* Scope that claim honestly — it covers the retained blocks only; every other
+* key of the input bag stays aliased, exactly as the sibling arms leave it.
+*
+* Deliberately NOT paired with a `canonicalizeDesiredProperties` twin: this is
+* a SKIP, not a narrowing, so there is no pure function of the desired bag to
+* fold both comparison sides with, and folding one would derive a REMOVAL of a
+* live capacity block from a template whose only fault is `BillingMode`.
+*
+* Pure and non-mutating at every level.
+*/
+function retainUnsendableCapacityMembers(desired, previous, keptBillingMode) {
+	const unsendable = keptBillingMode === "PROVISIONED" ? ON_DEMAND_ONLY_CAPACITY_KEYS : PROVISIONED_ONLY_CAPACITY_KEYS;
+	const result = retainCapacityKeys({ ...desired }, previous, unsendable.table);
+	const indexes = result["GlobalSecondaryIndexes"];
+	if (Array.isArray(indexes)) {
+		const previousIndexes = indexCapacityContainers(previous["GlobalSecondaryIndexes"], "IndexName");
+		result["GlobalSecondaryIndexes"] = indexes.map((entry) => {
+			const gsi = asRecord$1(entry);
+			if (!gsi) return entry;
+			const previousGsi = previousIndexes.get(gsi["IndexName"]);
+			return retainCapacityKeys({ ...gsi }, previousGsi, unsendable.index);
+		});
+	}
+	const replicas = result["Replicas"];
+	if (Array.isArray(replicas)) {
+		const previousReplicas = indexCapacityContainers(previous["Replicas"], "Region");
+		result["Replicas"] = replicas.map((entry) => {
+			const replica = asRecord$1(entry);
+			if (!replica) return entry;
+			const previousReplica = previousReplicas.get(replica["Region"]);
+			const copy = retainCapacityKeys({ ...replica }, previousReplica, unsendable.replica);
+			const replicaIndexes = copy["GlobalSecondaryIndexes"];
+			if (Array.isArray(replicaIndexes)) {
+				const previousReplicaIndexes = indexCapacityContainers(previousReplica?.["GlobalSecondaryIndexes"], "IndexName");
+				const kept = replicaIndexes.map((indexEntry) => {
+					const gsi = asRecord$1(indexEntry);
+					if (!gsi) return indexEntry;
+					const previousGsi = previousReplicaIndexes.get(gsi["IndexName"]);
+					return retainCapacityKeys({ ...gsi }, previousGsi, unsendable.replicaIndex);
+				}).filter((entry) => {
+					const gsi = asRecord$1(entry);
+					if (!gsi) return true;
+					return Object.keys(gsi).some((k) => k !== "IndexName");
+				});
+				if (kept.length > 0) copy["GlobalSecondaryIndexes"] = kept;
+				else delete copy["GlobalSecondaryIndexes"];
+			}
+			return copy;
+		});
+	}
+	return result;
+}
+/**
+* Retain (or drop) one container's unsendable capacity members, in place on a
+* bag the caller already copied.
+*
+* The counterpart container being `undefined` — no matching index / replica in
+* the previous record — is the ABSENT case, not a special one: there is nothing
+* to vouch for, so the key is dropped exactly as it is for an unusable value.
+*/
+function retainCapacityKeys(target, previousContainer, keys) {
+	for (const key of keys) {
+		const previousValue = asRecord$1(previousContainer?.[key]);
+		if (previousValue) target[key] = { ...previousValue };
+		else delete target[key];
+	}
+	return target;
+}
+/**
+* Index a previous-side array by its identity member, so a per-index /
+* per-replica retain reads the counterpart entry rather than the positional
+* one — AWS does not guarantee readback order and a template edit can reorder
+* either list.
+*/
+function indexCapacityContainers(value, identityKey) {
+	const byIdentity = /* @__PURE__ */ new Map();
+	if (!Array.isArray(value)) return byIdentity;
+	for (const entry of value) {
+		const record = asRecord$1(entry);
+		const identity = record?.[identityKey];
+		if (record && typeof identity === "string") byIdentity.set(identity, record);
+	}
+	return byIdentity;
+}
+/**
 * True when a CFn sub-object is nothing but an unresolved intrinsic
 * (`{"Fn::If": […]}` / `{"Ref": …}`), i.e. the template DID declare the block
 * but its value could not be resolved to a shape with members.
@@ -76252,7 +76438,7 @@ function createMigrateCommand() {
 */
 function buildProgram() {
 	const program = new Command();
-	program.name("cdkd").description("CDK Direct - Deploy AWS CDK apps directly via SDK/Cloud Control API").version("0.283.0");
+	program.name("cdkd").description("CDK Direct - Deploy AWS CDK apps directly via SDK/Cloud Control API").version("0.283.1");
 	program.hook("preAction", (_thisCommand, actionCommand) => {
 		const { profile } = actionCommand.optsWithGlobals();
 		if (profile !== void 0) process.env["AWS_PROFILE"] = profile;