@go-to-k/cdkd 0.283.0 → 0.283.2

package/dist/cli.js

@@ -1,7 +1,7 @@
 #!/usr/bin/env node
-import { $ as configStringRefusal, $t as resolveStateBucketWithDefaultAndSource, A as green, An as NestedStackChildDirectDestroyError, At as BOOTSTRAP_MARKER_PREFIX, B as slowCcOperationTimeoutMs, Bt as runDockerForeground, C as MULTI_REGION_RECREATE_BLOCKED_TYPES, Ct as stringifyValue, D as bold, Dn as LocalStartServiceError, Dt as loadPublishableAssetManifest, E as formatResourceLine, En as LocalMigrateError, Et as createAssetRedirectResolver, F as clearOnUpdateRemoval, Fn as StackHasActiveImportsError, Ft as validateContainerRepoName, G as getAccountInfo, Gt as synthesisStatusMessage, H as isTerminationProtectionPropagationError, Hn as withErrorHandling, Ht as AssetManifestLoader, I as ProviderRegistry, In as StackTerminationProtectionError, It as buildDenyExternalAccessPolicy, J as normalizeAwsTagsToCfn, Jt as resolveApp, K as refStateLookupFromResource, Kt as getDefaultStateBucketName, L as findActionableSilentDrops, Lt as buildDockerImage, M as yellow, Mn as ProvisioningError, Mt as getBootstrapMarkerKey, N as IAMRoleProvider, Nn as ResourceTimeoutError, Nt as parseBootstrapMarker, O as cyan, Ot as rewriteTemplateAssetReferences, P as collectInlinePolicyNamesManagedBySiblings, Pn as ResourceUpdateNotSupportedError, Pt as validateAssetBucketName, Q as configBooleanRefusal, Qt as resolveStateBucketWithDefault, R as findSilentDropProperties, Rt as formatDockerLoginError, S as extractDeploymentEventError, St as AssetPublisher, T as renderStatefulReason, Tn as LocalInvokeBuildError$1, Tt as buildAssetRedirectMap, U as IntrinsicFunctionResolver, Ut as getDockerImageBySourceHash, V as disableInstanceApiTermination, Vn as normalizeAwsError, Vt as runDockerStreaming, W as cfnRefValueFromPhysicalId, Wt as Synthesizer, X as assertRegionMatch, Xt as resolveCaptureObservedState, Y as resolveExplicitPhysicalId, Yt as resolveAutoAssetStorage, Z as coerceCfnBoolean, Zt as resolveSkipPrefix, _ as createPreDeleteFinalSnapshot, _n as getAwsClients, _t as TemplateParser, a as DeploymentEventsStore, an as MIGRATE_TMP_PREFIX, at as s3BucketArn, b as unsupportedFinalSnapshotError, bt as rebuildClientForBucketRegion, c as replayFailedOperations, cn as expectedOwnerParam, ct as s3BucketRegionalDomainName, d as IMPLICIT_DELETE_DEPENDENCIES, dn as derivePartitionAndUrlSuffix, dt as DiffCalculator, en as resolveUseCdkBootstrapAssets, et as readConfigString, f as computeImplicitDeleteEdges, fn as AssemblyReader, ft as describeTypeWithThrottleRetry, g as ccRoutedFinalSnapshotError, gn as AwsClients, gt as DagBuilder, h as buildFinalSnapshotIdentifier, hn as resolveBucketRegion, ht as isThrottlingError, i as DeploymentEventsReader, in as CFN_TEMPLATE_URL_LIMIT, it as requireConfigString, j as red, jn as PartialFailureError, jt as ensureAssetStorage, k as gray, kn as MissingCdkCliError, kt as AssetModeResolver, l as replayRollback, ln as PARTITION_TABLE, lt as s3BucketWebsiteUrl, m as PRE_DELETE_SNAPSHOT_TYPES, mt as isRetryableTransientError, n as DEFAULT_RESOURCE_WARN_AFTER_MS, nn as warnDeprecatedNoPrefixCliFlag, nt as requireConfigArray, o as planFailedOps, on as findLargeInlineResources, ot as s3BucketDomainName, p as ATOMIC_FINAL_SNAPSHOT_TYPES, pn as processStackMessages, pt as withRetry, q as WAFv2WebACLProvider, qt as getLegacyStateBucketName, r as DeployEngine, rn as CFN_TEMPLATE_BODY_LIMIT, rt as requireConfigObject, s as planRollback, sn as uploadCfnTemplate, st as s3BucketDualStackDomainName, t as DEFAULT_RESOURCE_TIMEOUT_MS, tn as stateBucketExistenceConfirmed, tt as replayWarn, u as withResourceDeadline, un as canonicalizeRegion, ut as applyRoleArnIfSet, v as isFinalSnapshotError, vn as resetAwsClients, vt as LockManager, w as isStatefulRecreateTargetSync, wn as DeployCancelledError, wt as WorkGraph, x as makeCanonicalizePropertiesFn, xn as CdkdError, xt as shouldRetainResource, y as refusesFinalSnapshot, yn as setAwsClients, yt as S3StateBackend, z as CloudControlProvider, zt as getDockerCmd } from "./deploy-engine-CEzMNZTA.js";
+import { $ as configStringRefusal, $t as resolveStateBucketWithDefaultAndSource, A as green, An as NestedStackChildDirectDestroyError, At as BOOTSTRAP_MARKER_PREFIX, B as slowCcOperationTimeoutMs, Bt as runDockerForeground, C as MULTI_REGION_RECREATE_BLOCKED_TYPES, Ct as stringifyValue, D as bold, Dn as LocalStartServiceError, Dt as loadPublishableAssetManifest, E as formatResourceLine, En as LocalMigrateError, Et as createAssetRedirectResolver, F as clearOnUpdateRemoval, Fn as StackHasActiveImportsError, Ft as validateContainerRepoName, G as getAccountInfo, Gt as synthesisStatusMessage, H as isTerminationProtectionPropagationError, Hn as withErrorHandling, Ht as AssetManifestLoader, I as ProviderRegistry, In as StackTerminationProtectionError, It as buildDenyExternalAccessPolicy, J as normalizeAwsTagsToCfn, Jt as resolveApp, K as refStateLookupFromResource, Kt as getDefaultStateBucketName, L as findActionableSilentDrops, Lt as buildDockerImage, M as yellow, Mn as ProvisioningError, Mt as getBootstrapMarkerKey, N as IAMRoleProvider, Nn as ResourceTimeoutError, Nt as parseBootstrapMarker, O as cyan, Ot as rewriteTemplateAssetReferences, P as collectInlinePolicyNamesManagedBySiblings, Pn as ResourceUpdateNotSupportedError, Pt as validateAssetBucketName, Q as configBooleanRefusal, Qt as resolveStateBucketWithDefault, R as findSilentDropProperties, Rt as formatDockerLoginError, S as extractDeploymentEventError, St as AssetPublisher, T as renderStatefulReason, Tn as LocalInvokeBuildError$1, Tt as buildAssetRedirectMap, U as IntrinsicFunctionResolver, Ut as getDockerImageBySourceHash, V as disableInstanceApiTermination, Vn as normalizeAwsError, Vt as runDockerStreaming, W as cfnRefValueFromPhysicalId, Wt as Synthesizer, X as assertRegionMatch, Xt as resolveCaptureObservedState, Y as resolveExplicitPhysicalId, Yt as resolveAutoAssetStorage, Z as coerceCfnBoolean, Zt as resolveSkipPrefix, _ as createPreDeleteFinalSnapshot, _n as getAwsClients, _t as TemplateParser, a as DeploymentEventsStore, an as MIGRATE_TMP_PREFIX, at as s3BucketArn, b as unsupportedFinalSnapshotError, bt as rebuildClientForBucketRegion, c as replayFailedOperations, cn as expectedOwnerParam, ct as s3BucketRegionalDomainName, d as IMPLICIT_DELETE_DEPENDENCIES, dn as derivePartitionAndUrlSuffix, dt as DiffCalculator, en as resolveUseCdkBootstrapAssets, et as readConfigString, f as computeImplicitDeleteEdges, fn as AssemblyReader, ft as describeTypeWithThrottleRetry, g as ccRoutedFinalSnapshotError, gn as AwsClients, gt as DagBuilder, h as buildFinalSnapshotIdentifier, hn as resolveBucketRegion, ht as isThrottlingError, i as DeploymentEventsReader, in as CFN_TEMPLATE_URL_LIMIT, it as requireConfigString, j as red, jn as PartialFailureError, jt as ensureAssetStorage, k as gray, kn as MissingCdkCliError, kt as AssetModeResolver, l as replayRollback, ln as PARTITION_TABLE, lt as s3BucketWebsiteUrl, m as PRE_DELETE_SNAPSHOT_TYPES, mt as isRetryableTransientError, n as DEFAULT_RESOURCE_WARN_AFTER_MS, nn as warnDeprecatedNoPrefixCliFlag, nt as requireConfigArray, o as planFailedOps, on as findLargeInlineResources, ot as s3BucketDomainName, p as ATOMIC_FINAL_SNAPSHOT_TYPES, pn as processStackMessages, pt as withRetry, q as WAFv2WebACLProvider, qt as getLegacyStateBucketName, r as DeployEngine, rn as CFN_TEMPLATE_BODY_LIMIT, rt as requireConfigObject, s as planRollback, sn as uploadCfnTemplate, st as s3BucketDualStackDomainName, t as DEFAULT_RESOURCE_TIMEOUT_MS, tn as stateBucketExistenceConfirmed, tt as replayWarn, u as withResourceDeadline, un as canonicalizeRegion, ut as applyRoleArnIfSet, v as isFinalSnapshotError, vn as resetAwsClients, vt as LockManager, w as isStatefulRecreateTargetSync, wn as DeployCancelledError, wt as WorkGraph, x as makeCanonicalizePropertiesFn, xn as CdkdError, xt as shouldRetainResource, y as refusesFinalSnapshot, yn as setAwsClients, yt as S3StateBackend, z as CloudControlProvider, zt as getDockerCmd } from "./deploy-engine-DuYBir2W.js";
 import { a as getLiveRenderer, c as PATTERN_B_RESOURCE_TYPES, d as generateResourceNameWithFallback, h as withStackName, i as runStackBuffered, m as withSkipPrefix, n as getLogger, o as PATTERN_B_NAME_OPTIONS, s as PATTERN_B_NAME_PROPERTIES, u as generateResourceName } from "./logger-zRrlbaQt.js";
-import { t as ASGProvider } from "./asg-provider-BNuwJ11q.js";
+import { t as ASGProvider } from "./asg-provider-Cl4ATw1l.js";
 import { AsyncLocalStorage } from "node:async_hooks";
 import { createHash, randomBytes, randomUUID } from "node:crypto";
 import { CopyObjectCommand, CreateBucketCommand, DeleteBucketAnalyticsConfigurationCommand, DeleteBucketCommand, DeleteBucketCorsCommand, DeleteBucketEncryptionCommand, DeleteBucketIntelligentTieringConfigurationCommand, DeleteBucketInventoryConfigurationCommand, DeleteBucketLifecycleCommand, DeleteBucketMetricsConfigurationCommand, DeleteBucketOwnershipControlsCommand, DeleteBucketPolicyCommand, DeleteBucketReplicationCommand, DeleteBucketTaggingCommand, DeleteBucketWebsiteCommand, DeleteObjectsCommand, GetBucketAccelerateConfigurationCommand, GetBucketCorsCommand, GetBucketEncryptionCommand, GetBucketLifecycleConfigurationCommand, GetBucketLocationCommand, GetBucketLoggingCommand, GetBucketNotificationConfigurationCommand, GetBucketOwnershipControlsCommand, GetBucketPolicyCommand, GetBucketReplicationCommand, GetBucketTaggingCommand, GetBucketVersioningCommand, GetBucketWebsiteCommand, GetObjectCommand, GetObjectLockConfigurationCommand, GetPublicAccessBlockCommand, HeadBucketCommand, ListBucketAnalyticsConfigurationsCommand, ListBucketIntelligentTieringConfigurationsCommand, ListBucketInventoryConfigurationsCommand, ListBucketMetricsConfigurationsCommand, ListObjectVersionsCommand, ListObjectsV2Command, NoSuchBucket, PutBucketAccelerateConfigurationCommand, PutBucketAnalyticsConfigurationCommand, PutBucketCorsCommand, PutBucketEncryptionCommand, PutBucketIntelligentTieringConfigurationCommand, PutBucketInventoryConfigurationCommand, PutBucketLifecycleConfigurationCommand, PutBucketLoggingCommand, PutBucketMetricsConfigurationCommand, PutBucketNotificationConfigurationCommand, PutBucketOwnershipControlsCommand, PutBucketPolicyCommand, PutBucketReplicationCommand, PutBucketTaggingCommand, PutBucketVersioningCommand, PutBucketWebsiteCommand, PutObjectCommand, PutObjectLockConfigurationCommand, PutPublicAccessBlockCommand, S3Client, S3ServiceException } from "@aws-sdk/client-s3";
@@ -9139,15 +9139,24 @@ var SQSQueueProvider = class {
 		}
 	}
 	/**
-	* Construct SQS queue ARN from account/region/queue name
+	* Construct SQS queue ARN from account/region/queue name.
+	*
+	* The partition is derived from the region through the same closed mapping
+	* `${AWS::Partition}` uses (issue #1815) rather than hardcoded to `aws` —
+	* this ARN is recorded into state and served as the queue's `Arn`
+	* attribute, so a commercial literal is structurally valid but wrong in
+	* `aws-cn` / `aws-us-gov` and nothing downstream rejects it.
 	*/
 	async constructArn(queueName) {
 		try {
 			const accountId = (await this.stsClient.send(new GetCallerIdentityCommand({}))).Account;
-			return `arn:aws:sqs:${await this.sqsClient.config.region()}:${accountId}:${queueName}`;
+			const region = await this.sqsClient.config.region();
+			const { partition } = derivePartitionAndUrlSuffix(region);
+			return `arn:${partition}:sqs:${region}:${accountId}:${queueName}`;
 		} catch {
 			this.logger.warn("Failed to construct SQS ARN from STS, using placeholder");
-			return `arn:aws:sqs:unknown:unknown:${queueName}`;
+			const { partition } = derivePartitionAndUrlSuffix(process.env["AWS_REGION"] ?? "");
+			return `arn:${partition}:sqs:unknown:unknown:${queueName}`;
 		}
 	}
 	/**
@@ -15484,10 +15493,16 @@ var DynamoDBGlobalTableProvider = class {
 			};
 			if (tableArn) await this.applyTagDiff(tableArn, extractLocalTags(previousProperties), extractLocalTags(properties));
 			const recordedOldBilling = previousProperties["BillingMode"];
-			const recordedOldBillingUsable = recordedOldBilling === void 0 || typeof recordedOldBilling === "string" && recordedOldBilling.trim() !== "";
-			const liveBillingMode = describeResp.Table?.BillingModeSummary?.BillingMode ?? "PROVISIONED";
-			const oldBilling = recordedOldBillingUsable ? recordedOldBilling ?? "PAY_PER_REQUEST" : liveBillingMode;
-			if (!recordedOldBillingUsable) this.logger.warn(`AWS::DynamoDB::GlobalTable ${logicalId}: the recorded previous BillingMode is unusable (${JSON.stringify(recordedOldBilling)}) — using the table's actual billing mode (${oldBilling}) as the comparison baseline for this update so a corrected template does not issue a same-mode UpdateTable.`);
+			const recordedOldBillingAbsent = recordedOldBilling === void 0;
+			const recordedOldBillingUsable = typeof recordedOldBilling === "string" && recordedOldBilling.trim() !== "";
+			const rawLiveBillingMode = describeResp.Table?.BillingModeSummary?.BillingMode;
+			const reportedBillingMode = rawLiveBillingMode === "PROVISIONED" || rawLiveBillingMode === "PAY_PER_REQUEST" ? rawLiveBillingMode : void 0;
+			const liveBillingMode = reportedBillingMode ?? "PROVISIONED";
+			const desiredDeclaresBillingMode = properties["BillingMode"] !== void 0;
+			const seedAbsentFromLive = recordedOldBillingAbsent && desiredDeclaresBillingMode;
+			const oldBilling = recordedOldBillingUsable ? recordedOldBilling : recordedOldBillingAbsent ? seedAbsentFromLive ? liveBillingMode : "PAY_PER_REQUEST" : liveBillingMode;
+			if (!recordedOldBillingUsable && !recordedOldBillingAbsent) this.logger.warn(`AWS::DynamoDB::GlobalTable ${logicalId}: the recorded previous BillingMode is unusable (${JSON.stringify(recordedOldBilling)}) — using the table's actual billing mode (${oldBilling}) as the comparison baseline for this update so a corrected template does not issue a same-mode UpdateTable.`);
+			if (seedAbsentFromLive && oldBilling !== "PAY_PER_REQUEST") this.logger.warn(`AWS::DynamoDB::GlobalTable ${logicalId}: the cdkd state record declares no BillingMode — using ${oldBilling} as the comparison baseline for this update (${reportedBillingMode !== void 0 ? "the mode DescribeTable reports" : "inferred: DescribeTable reports no BillingModeSummary, which means the table was created without an explicit mode"}), so a template declaring a different mode still applies the flip instead of comparing equal to the create-path default.`);
 			let billingUnusable = false;
 			const requestedBilling = requireConfigString(properties["BillingMode"], "PAY_PER_REQUEST", "AWS::DynamoDB::GlobalTable BillingMode", { onUnusable: (message) => {
 				billingUnusable = true;
@@ -15575,6 +15590,7 @@ var DynamoDBGlobalTableProvider = class {
 				effectiveProperties = { ...effectiveProperties ?? properties };
 				if (recordedOldBilling === void 0) delete effectiveProperties["BillingMode"];
 				else effectiveProperties["BillingMode"] = oldBilling;
+				effectiveProperties = retainUnsendableCapacityMembers(effectiveProperties, previousProperties, newBilling);
 			}
 			const awsOnDemand = describeResp.Table?.OnDemandThroughput;
 			const onDemandPayload = {};
@@ -17533,6 +17549,185 @@ function stripProvisionedCapacityKeys(properties) {
 	return result;
 }
 /**
+* The capacity member keys that can only reach AWS while the table is
+* PROVISIONED, per container level (issue #1738).
+*
+* Identical to the set {@link stripProvisionedCapacityKeys} removes, and that
+* is not a coincidence: both answer "which members are unsendable once the mode
+* is PAY_PER_REQUEST". The two spellings a pre-#1387 cdkd wrote into state
+* (`ProvisionedThroughput` / `ProvisionedThroughputOverride`) are included for
+* the same reason — a state replay is exactly that population.
+*/
+const PROVISIONED_ONLY_CAPACITY_KEYS = {
+	table: ["WriteProvisionedThroughputSettings"],
+	index: [
+		"WriteProvisionedThroughputSettings",
+		"ReadProvisionedThroughputSettings",
+		"ProvisionedThroughput"
+	],
+	replica: ["ReadProvisionedThroughputSettings", "ProvisionedThroughputOverride"],
+	replicaIndex: ["ReadProvisionedThroughputSettings", "ProvisionedThroughputOverride"]
+};
+/**
+* The mirror set: capacity members that can only reach AWS while the table is
+* PAY_PER_REQUEST (issue #1738).
+*
+* `stripProvisionedCapacityKeys` has no equivalent because the create arm it
+* serves always substitutes PAY_PER_REQUEST — the mode under which these ARE
+* sent, which is why its header says they are deliberately not stripped. On the
+* UPDATE path the kept mode can be PROVISIONED, and then it is this half that
+* never leaves the process.
+*/
+const ON_DEMAND_ONLY_CAPACITY_KEYS = {
+	table: ["WriteOnDemandThroughputSettings"],
+	index: [
+		"WriteOnDemandThroughputSettings",
+		"ReadOnDemandThroughputSettings",
+		"OnDemandThroughput"
+	],
+	replica: ["ReadOnDemandThroughputSettings", "OnDemandThroughputOverride"],
+	replicaIndex: ["ReadOnDemandThroughputSettings", "OnDemandThroughputOverride"]
+};
+/**
+* Replace every capacity member the KEPT billing mode cannot send with the
+* PREVIOUS record's value (issue #1738).
+*
+* Called from `update()`'s `BillingMode` warn-and-KEEP arm, where an unusable
+* desired mode suppresses the flip: AWS is left holding the mode it already
+* had, so every block belonging to the OTHER mode was silently dropped on the
+* way out while the engine recorded what the template declared.
+*
+* **The split is per MEMBER against the KEPT mode**, and each side was read off
+* the gates in this file rather than off the member's name-shape (the
+* name-shape trap #1726 records — an on-demand ceiling looks like capacity and
+* goes on the wire under precisely the on-demand mode):
+*
+* - KEPT `PROVISIONED` — the on-demand half is unsendable. Step 3's table-level
+*   `OnDemandThroughput` is gated on `newBilling !== 'PROVISIONED'`;
+*   `toSdkGlobalSecondaryIndexes` and `toSdkReplicaThroughputOverrides` both
+*   drop their on-demand branch under PROVISIONED. The provisioned half is NOT
+*   retained: step 4b and step 6b's auto-scaling reconcile are live whenever
+*   either side is PROVISIONED, and step 6's GSI diff carries per-index
+*   `ProvisionedThroughput` — those blocks really are applied.
+* - KEPT `PAY_PER_REQUEST` — the provisioned half is unsendable. The table-level
+*   `ProvisionedThroughput` rides step 4's flip and nothing else, the two
+*   auto-scaling reconciles are gated on either side being PROVISIONED, and both
+*   translators drop their provisioned branch. The on-demand half is NOT
+*   retained: step 3 sends the table-level ceilings and step 6 the per-index
+*   ones under exactly this mode.
+*
+* One residual is deliberately NOT covered, because the suppression did not
+* create it: the TABLE-level provisioned capacity NUMBER rides step 4's flip
+* and nothing else, so on ANY non-flip PROVISIONED -> PROVISIONED update it is
+* unsent while its `*CapacityAutoScalingSettings` sibling in the same block IS
+* reconciled. Retaining the block wholesale under a kept PROVISIONED mode would
+* therefore erase a real auto-scaling update to hide a pre-existing gap — so
+* the block stays as declared and the gap stays where it already lives.
+*
+* Retaining rather than DROPPING is the UPDATE row of
+* `.claude/rules/providers.md`: the call never ran, so AWS still holds the
+* previously-applied block and that IS what state should describe. Dropping
+* would leave a later template that REMOVES the block deriving no removal, so
+* the live setting would survive forever.
+*
+* **The previous side is VALIDATED before it is retained** (the #1653-review
+* rule) through `asRecord` — the SAME predicate every wire read of these blocks
+* applies, so the two cannot disagree about what a bare string / an array / a
+* number means. Be honest about what that buys: it refuses exactly the
+* not-a-plain-object shapes, and a block whose NUMERIC member is an unresolved
+* intrinsic passes it, because the wire accepts that block too (and then sends
+* nothing for the member, which is the same "AWS keeps what it had" outcome).
+* When the previous side is unusable OR absent the key is DROPPED — there is no
+* value cdkd can vouch for either way.
+*
+* COPIES each retained block one level rather than aliasing it: the rollback
+* executor spreads the returned bag shallowly, so handing back the previous
+* record's own object would leave two state records sharing one mutable value.
+* Scope that claim honestly — it covers the retained blocks only; every other
+* key of the input bag stays aliased, exactly as the sibling arms leave it.
+*
+* Deliberately NOT paired with a `canonicalizeDesiredProperties` twin: this is
+* a SKIP, not a narrowing, so there is no pure function of the desired bag to
+* fold both comparison sides with, and folding one would derive a REMOVAL of a
+* live capacity block from a template whose only fault is `BillingMode`.
+*
+* Pure and non-mutating at every level.
+*/
+function retainUnsendableCapacityMembers(desired, previous, keptBillingMode) {
+	const unsendable = keptBillingMode === "PROVISIONED" ? ON_DEMAND_ONLY_CAPACITY_KEYS : PROVISIONED_ONLY_CAPACITY_KEYS;
+	const result = retainCapacityKeys({ ...desired }, previous, unsendable.table);
+	const indexes = result["GlobalSecondaryIndexes"];
+	if (Array.isArray(indexes)) {
+		const previousIndexes = indexCapacityContainers(previous["GlobalSecondaryIndexes"], "IndexName");
+		result["GlobalSecondaryIndexes"] = indexes.map((entry) => {
+			const gsi = asRecord$1(entry);
+			if (!gsi) return entry;
+			const previousGsi = previousIndexes.get(gsi["IndexName"]);
+			return retainCapacityKeys({ ...gsi }, previousGsi, unsendable.index);
+		});
+	}
+	const replicas = result["Replicas"];
+	if (Array.isArray(replicas)) {
+		const previousReplicas = indexCapacityContainers(previous["Replicas"], "Region");
+		result["Replicas"] = replicas.map((entry) => {
+			const replica = asRecord$1(entry);
+			if (!replica) return entry;
+			const previousReplica = previousReplicas.get(replica["Region"]);
+			const copy = retainCapacityKeys({ ...replica }, previousReplica, unsendable.replica);
+			const replicaIndexes = copy["GlobalSecondaryIndexes"];
+			if (Array.isArray(replicaIndexes)) {
+				const previousReplicaIndexes = indexCapacityContainers(previousReplica?.["GlobalSecondaryIndexes"], "IndexName");
+				const kept = replicaIndexes.map((indexEntry) => {
+					const gsi = asRecord$1(indexEntry);
+					if (!gsi) return indexEntry;
+					const previousGsi = previousReplicaIndexes.get(gsi["IndexName"]);
+					return retainCapacityKeys({ ...gsi }, previousGsi, unsendable.replicaIndex);
+				}).filter((entry) => {
+					const gsi = asRecord$1(entry);
+					if (!gsi) return true;
+					return Object.keys(gsi).some((k) => k !== "IndexName");
+				});
+				if (kept.length > 0) copy["GlobalSecondaryIndexes"] = kept;
+				else delete copy["GlobalSecondaryIndexes"];
+			}
+			return copy;
+		});
+	}
+	return result;
+}
+/**
+* Retain (or drop) one container's unsendable capacity members, in place on a
+* bag the caller already copied.
+*
+* The counterpart container being `undefined` — no matching index / replica in
+* the previous record — is the ABSENT case, not a special one: there is nothing
+* to vouch for, so the key is dropped exactly as it is for an unusable value.
+*/
+function retainCapacityKeys(target, previousContainer, keys) {
+	for (const key of keys) {
+		const previousValue = asRecord$1(previousContainer?.[key]);
+		if (previousValue) target[key] = { ...previousValue };
+		else delete target[key];
+	}
+	return target;
+}
+/**
+* Index a previous-side array by its identity member, so a per-index /
+* per-replica retain reads the counterpart entry rather than the positional
+* one — AWS does not guarantee readback order and a template edit can reorder
+* either list.
+*/
+function indexCapacityContainers(value, identityKey) {
+	const byIdentity = /* @__PURE__ */ new Map();
+	if (!Array.isArray(value)) return byIdentity;
+	for (const entry of value) {
+		const record = asRecord$1(entry);
+		const identity = record?.[identityKey];
+		if (record && typeof identity === "string") byIdentity.set(identity, record);
+	}
+	return byIdentity;
+}
+/**
 * True when a CFn sub-object is nothing but an unresolved intrinsic
 * (`{"Fn::If": […]}` / `{"Ref": …}`), i.e. the template DID declare the block
 * but its value could not be resolved to a shape with members.
@@ -18239,14 +18434,23 @@ var LogsLogGroupProvider = class {
 		}
 	}
 	/**
-	* Build log group ARN from name
+	* Build log group ARN from name.
+	*
+	* The partition is derived from the region through the same closed mapping
+	* `${AWS::Partition}` uses (issue #1815) rather than hardcoded to `aws` —
+	* this ARN is recorded into state and served as the log group's `Arn`
+	* attribute, so a commercial literal is structurally valid but wrong in
+	* `aws-cn` / `aws-us-gov` and nothing downstream rejects it.
 	*/
 	async buildArn(logGroupName) {
 		try {
 			const accountId = (await this.stsClient.send(new GetCallerIdentityCommand({}))).Account;
-			return `arn:aws:logs:${await this.logsClient.config.region() || process.env["AWS_REGION"] || "us-east-1"}:${accountId}:log-group:${logGroupName}:*`;
+			const region = await this.logsClient.config.region() || process.env["AWS_REGION"] || "us-east-1";
+			const { partition } = derivePartitionAndUrlSuffix(region);
+			return `arn:${partition}:logs:${region}:${accountId}:log-group:${logGroupName}:*`;
 		} catch {
-			return `arn:aws:logs:unknown:unknown:log-group:${logGroupName}:*`;
+			const { partition } = derivePartitionAndUrlSuffix(process.env["AWS_REGION"] ?? "");
+			return `arn:${partition}:logs:unknown:unknown:log-group:${logGroupName}:*`;
 		}
 	}
 	/**
@@ -18507,9 +18711,12 @@ var CloudWatchAlarmProvider = class {
 			this.logger.debug(`Failed to describe alarm ${alarmName}, constructing ARN from config: ${error instanceof Error ? error.message : String(error)}`);
 		}
 		try {
-			return `arn:aws:cloudwatch:${await this.cloudWatchClient.config.region() || process.env["AWS_REGION"] || "us-east-1"}:*:alarm:${alarmName}`;
+			const region = await this.cloudWatchClient.config.region() || process.env["AWS_REGION"] || "us-east-1";
+			const { partition } = derivePartitionAndUrlSuffix(region);
+			return `arn:${partition}:cloudwatch:${region}:*:alarm:${alarmName}`;
 		} catch {
-			return `arn:aws:cloudwatch:*:*:alarm:${alarmName}`;
+			const { partition } = derivePartitionAndUrlSuffix(process.env["AWS_REGION"] ?? "");
+			return `arn:${partition}:cloudwatch:*:*:alarm:${alarmName}`;
 		}
 	}
 	/**
@@ -24797,13 +25004,23 @@ var ApiGatewayProvider = class ApiGatewayProvider {
 	/**
 	* Build the ARN for an API Gateway Stage, used for tag mutations.
 	*
-	* Format: `arn:aws:apigateway:{region}::/restapis/{restApiId}/stages/{stageName}`.
+	* Format:
+	* `arn:{partition}:apigateway:{region}::/restapis/{restApiId}/stages/{stageName}`.
 	* The double colon (`::`) is intentional: API Gateway tagging uses an
 	* account-id-less ARN.
+	*
+	* The partition is derived from the region through the same closed mapping
+	* `${AWS::Partition}` uses (issue #1815) rather than hardcoded to `aws`.
+	* Unlike the pure attribute builders this one is passed straight to
+	* `TagResource` / `UntagResource` as `resourceArn`, so in `aws-cn` /
+	* `aws-us-gov` a commercial literal does not just record a wrong string —
+	* it aims the tag mutation at an ARN that names no stage.
 	*/
 	async buildStageArn(restApiId, stageName) {
 		try {
-			return `arn:aws:apigateway:${await this.apiGatewayClient.config.region()}::/restapis/${restApiId}/stages/${stageName}`;
+			const region = await this.apiGatewayClient.config.region();
+			const { partition } = derivePartitionAndUrlSuffix(region);
+			return `arn:${partition}:apigateway:${region}::/restapis/${restApiId}/stages/${stageName}`;
 		} catch {
 			return;
 		}
@@ -38556,11 +38773,19 @@ var ServiceDiscoveryProvider = class ServiceDiscoveryProvider {
 	}
 	/**
 	* Build a namespace ARN from namespace ID.
-	* Format: arn:aws:servicediscovery:{region}:{account}:namespace/{namespaceId}
+	* Format: `arn:{partition}:servicediscovery:{region}:{account}:namespace/{namespaceId}`
+	*
+	* The partition is derived from the region through the same closed mapping
+	* `${AWS::Partition}` uses (issue #1815) rather than hardcoded to `aws` —
+	* this ARN is recorded into state and served as the namespace's `Arn`
+	* attribute, so a commercial-partition literal is silently wrong (but
+	* structurally valid, hence unrejected) in `aws-cn` / `aws-us-gov`.
 	*/
 	async buildNamespaceArn(namespaceId) {
 		const accountId = (await this.getStsClient().send(new GetCallerIdentityCommand({}))).Account || "";
-		return `arn:aws:servicediscovery:${await this.getClient().config.region()}:${accountId}:namespace/${namespaceId}`;
+		const region = await this.getClient().config.region();
+		const { partition } = derivePartitionAndUrlSuffix(region);
+		return `arn:${partition}:servicediscovery:${region}:${accountId}:namespace/${namespaceId}`;
 	}
 };
 
@@ -43208,12 +43433,35 @@ var BudgetsBudgetProvider = class {
 	}
 	/**
 	* Budget ARN for the tagging APIs (`ListTagsForResource` / `TagResource` /
-	* `UntagResource`). Budgets ARNs carry no region component. The `aws`
-	* partition is assumed — consistent with other providers that construct
-	* ARNs; non-`aws` partitions are not supported by cdkd today.
-	*/
-	budgetArn(accountId, budgetName) {
-		return `arn:aws:budgets::${accountId}:budget/${budgetName}`;
+	* `UntagResource`), and the `Arn` attribute recorded into state.
+	*
+	* Budgets ARNs carry no region component, but they DO carry a partition, so
+	* a region is still needed to name it. It is read from the RESOLVED region
+	* of the very client that receives this ARN — the same
+	* `getClient().config.region()` the `delete()` path already consults for
+	* its `assertRegionMatch` guard — and routed through the closed mapping
+	* `${AWS::Partition}` uses (issue #1815).
+	*
+	* Asking the CLIENT rather than `providerRegion` is what makes the ARN and
+	* its consumer agree. `providerRegion` is `process.env['AWS_REGION']`, and
+	* when that is unset `getClient()` builds `new BudgetsClient({})`, leaving
+	* the SDK to resolve the region from its OWN chain (`AWS_DEFAULT_REGION`,
+	* the `~/.aws/config` profile). So a profile-configured `cn-north-1` /
+	* `us-gov-*` caller would have derived the COMMERCIAL partition from an
+	* empty string while the client itself talked to a non-commercial endpoint
+	* — on the PRIMARY path, not a fallback.
+	*
+	* The `aws` partition USED to be hardcoded here on the stated assumption
+	* that non-`aws` partitions were unsupported. That was wrong in the quiet
+	* direction: the literal is structurally valid everywhere, so in `aws-cn` /
+	* `aws-us-gov` nothing rejected it — the ARN was simply recorded into state
+	* and handed to `TagResource` naming no budget. A client whose region is
+	* unset or unrecognized still derives to `aws`, so commercial output is
+	* unchanged byte for byte.
+	*/
+	async budgetArn(accountId, budgetName) {
+		const { partition } = derivePartitionAndUrlSuffix(await this.getClient().config.region() ?? "");
+		return `arn:${partition}:budgets::${accountId}:budget/${budgetName}`;
 	}
 	/**
 	* Convert a CFn `Spend` shape to the SDK shape. CFn templates carry
@@ -43369,7 +43617,7 @@ var BudgetsBudgetProvider = class {
 			this.logger.debug(`Successfully created budget ${logicalId}: ${name}`);
 			return {
 				physicalId: name,
-				attributes: { Arn: this.budgetArn(accountId, name) }
+				attributes: { Arn: await this.budgetArn(accountId, name) }
 			};
 		} catch (error) {
 			if (error instanceof ProvisioningError) throw error;
@@ -43396,7 +43644,7 @@ var BudgetsBudgetProvider = class {
 			return {
 				physicalId,
 				wasReplaced: false,
-				attributes: { Arn: this.budgetArn(accountId, physicalId) }
+				attributes: { Arn: await this.budgetArn(accountId, physicalId) }
 			};
 		} catch (error) {
 			if (error instanceof ProvisioningError) throw error;
@@ -43512,7 +43760,7 @@ var BudgetsBudgetProvider = class {
 	async reconcileResourceTags(accountId, budgetName, oldTags, newTags) {
 		const sortedJson = (tags) => JSON.stringify([...tags].sort((a, b) => (a.Key ?? "").localeCompare(b.Key ?? "")));
 		if (sortedJson(oldTags) === sortedJson(newTags)) return;
-		const arn = this.budgetArn(accountId, budgetName);
+		const arn = await this.budgetArn(accountId, budgetName);
 		const newKeys = new Set(newTags.map((t) => t.Key));
 		const removedKeys = oldTags.map((t) => t.Key).filter((k) => {
 			return typeof k === "string" && !newKeys.has(k);
@@ -43555,7 +43803,7 @@ var BudgetsBudgetProvider = class {
 	/**
 	* `Fn::GetAtt` support. CloudFormation documents no attributes for
 	* `AWS::Budgets::Budget`; `Arn` is served as a cdkd convenience (computed
-	* — Budgets ARNs are `arn:aws:budgets::{account}:budget/{name}`, verified
+	* — Budgets ARNs are `arn:{partition}:budgets::{account}:budget/{name}`, verified
 	* to exist via `DescribeBudget` first).
 	*/
 	async getAttribute(physicalId, resourceType, attributeName) {
@@ -43566,7 +43814,7 @@ var BudgetsBudgetProvider = class {
 				AccountId: accountId,
 				BudgetName: physicalId
 			}));
-			return this.budgetArn(accountId, physicalId);
+			return await this.budgetArn(accountId, physicalId);
 		} catch (error) {
 			const cause = error instanceof Error ? error : void 0;
 			throw new ProvisioningError(`Failed to resolve Arn for budget ${physicalId}: ${cause?.message ?? String(error)}`, resourceType, physicalId, physicalId, cause);
@@ -43591,7 +43839,7 @@ var BudgetsBudgetProvider = class {
 			}));
 			return {
 				physicalId: explicit,
-				attributes: { Arn: this.budgetArn(accountId, explicit) }
+				attributes: { Arn: await this.budgetArn(accountId, explicit) }
 			};
 		} catch (error) {
 			if (error instanceof NotFoundException$5) return null;
@@ -51387,13 +51635,33 @@ var S3DirectoryBucketProvider = class {
 		return { Arn: await this.buildBucketArn(bucketName) };
 	}
 	/**
-	* Directory bucket ARN: `arn:aws:s3express:{region}:{account}:bucket/{name}`.
+	* Directory bucket ARN:
+	* `arn:{partition}:s3express:{region}:{account}:bucket/{name}`.
 	* Also the `ResourceArn` for the S3 Control tag operations. Callers that
 	* already resolved the account (for the S3 Control `AccountId` parameter)
 	* pass it in so the STS lookup runs once per operation.
+	*
+	* The partition is derived from the region through the same closed mapping
+	* `${AWS::Partition}` uses (issue #1815) rather than hardcoded to `aws`.
+	* Here it is load-bearing TWICE over: the value is served as the bucket's
+	* `Arn` attribute AND passed to S3 Control as the `ResourceArn` of a tag
+	* mutation, so outside the commercial partition the wrong literal does not
+	* merely record a bad string — it aims the tag call at an ARN that does not
+	* name this bucket.
+	*
+	* KNOWN BOUND (pre-existing, not introduced by #1815): the region — and now
+	* the partition derived from it — comes from `s3Client`, while the tag
+	* calls that consume this ARN go through `s3ControlClient`, built from
+	* `providerRegion` (`process.env['AWS_REGION']`). Those two can disagree,
+	* so the ARN can name a different region than the client receiving it. The
+	* region SEGMENT already had this exposure before the partition rode along
+	* with it; unifying the two clients' region resolution is a separate change.
 	*/
 	async buildBucketArn(bucketName, accountId) {
-		return `arn:aws:s3express:${await this.getRegion()}:${accountId ?? await this.getAccountId()}:bucket/${bucketName}`;
+		const region = await this.getRegion();
+		const account = accountId ?? await this.getAccountId();
+		const { partition } = derivePartitionAndUrlSuffix(region);
+		return `arn:${partition}:s3express:${region}:${account}:bucket/${bucketName}`;
 	}
 	/**
 	* Create an S3 Express Directory Bucket
@@ -76252,7 +76520,7 @@ function createMigrateCommand() {
 */
 function buildProgram() {
 	const program = new Command();
-	program.name("cdkd").description("CDK Direct - Deploy AWS CDK apps directly via SDK/Cloud Control API").version("0.283.0");
+	program.name("cdkd").description("CDK Direct - Deploy AWS CDK apps directly via SDK/Cloud Control API").version("0.283.2");
 	program.hook("preAction", (_thisCommand, actionCommand) => {
 		const { profile } = actionCommand.optsWithGlobals();
 		if (profile !== void 0) process.env["AWS_PROFILE"] = profile;